@cortexkit/anthropic-auth-core 2.0.3 → 2.1.1

package/dist/internal-types/quota/format.d.ts

@@ -11,8 +11,14 @@ export declare const NO_LIMITS_REPORTED = "no limits reported";
 /**
  * `compact` fits a footer or a sidebar row: each window's figure, the credit
  * budget and the stale marker, without reset times. `full` adds each reset.
+ * `narrow` fits one line per account in a narrow sidebar: `5h 92% · 7d 66%
+ * · Fa 98% left`, the account-wide windows plus at most one model-scoped
+ * window or the budget (as `cr`), and no stale marker (see `isQuotaStale`).
+ * A reading whose windows belong to named groups and that has no
+ * account-wide window reads up to two groups instead:
+ * `Ge 7d 62% · Ot 7d 48% left`.
  */
-export type QuotaTextForm = 'compact' | 'full';
+export type QuotaTextForm = 'compact' | 'full' | 'narrow';
 export interface QuotaTextOptions {
     /** The current time in ms, for reset countdowns and the stale marker. */
     now: number;
@@ -55,17 +61,25 @@ export declare function quotaWindowName(limit: Pick<ProjectedLimit, 'scope' | 'l
  * and the optional age keep the shared formatter's wording.
  */
 export declare function quotaWindowParts(quota: ProjectedQuota | undefined, options: QuotaTextOptions): QuotaParts;
+/**
+ * Whether the reading is stale: true exactly when the compact and full forms
+ * would end with `checked … ago`. The narrow form leaves that age out to stay
+ * short, so a caller drawing a narrow line uses this to dim it instead.
+ */
+export declare function isQuotaStale(quota: ProjectedQuota | undefined, options: QuotaTextOptions): boolean;
 /**
  * The pieces of a quota text, in order: one per reported window
  * (`5h 58% left, resets 2h`), then the credit budget when there is one, then
  * `checked 3h ago` when the oldest piece shown is stale. Empty when nothing
  * was reported; `formatQuota` turns that into a sentence. A caller printing
- * one line per window (the terminal auth menu) uses these directly.
+ * one line per window (the terminal auth menu) uses these directly. In the
+ * narrow form the pieces are the narrow line's (`5h 92%`, `7d 66% left`).
  */
 export declare function quotaTextParts(quota: ProjectedQuota | undefined, options: QuotaTextOptions): string[];
 /**
  * A row's quota as one line: `5h 58% left · 7d 90% left` in the compact
- * form, with `, resets 2h` after each window in the full form. With nothing
+ * form, with `, resets 2h` after each window in the full form, and
+ * `5h 58% · 7d 90% left` in the narrow form. With nothing
  * reported it is `NO_QUOTA_READING`, or `NO_LIMITS_REPORTED` when the
  * provider answered without a limit for any window.
  */

package/dist/internal-types/quota/index.d.ts

@@ -1,10 +1,10 @@
 export type { QuotaCodec } from './codec.js';
 export { quotaCodec } from './codec.js';
 export type { QuotaParts, QuotaTextForm, QuotaTextOptions, QuotaWindowPart, } from './format.js';
-export { formatQuota, NO_LIMITS_REPORTED, NO_QUOTA_READING, QUOTA_STALE_AFTER_MS, quotaTextParts, quotaWindowName, quotaWindowParts, } from './format.js';
+export { formatQuota, isQuotaStale, NO_LIMITS_REPORTED, NO_QUOTA_READING, QUOTA_STALE_AFTER_MS, quotaTextParts, quotaWindowName, quotaWindowParts, } from './format.js';
 export type { CreditBudgetCleared, CreditBudgetEntry, CreditBudgetReading, QuotaAbsentEntry, QuotaCounter, QuotaEntry, QuotaMap, QuotaReadingEntry, QuotaRetiredEntry, } from './map.js';
 export { ALL_SCOPE, DEFAULT_REQUIRED_LABELS, decodeQuotaMap, emptyQuotaMap, isQuotaMap, } from './map.js';
 export type { ObservedBudget, ObservedPair, ObservedReading, QuotaObservation, } from './merge.js';
 export { isQuotaObservation, mergeQuotaObservation, QuotaCodecError, } from './merge.js';
-export type { ExhaustionReset, ProjectedBudget, ProjectedLimit, ProjectedQuota, } from './projection.js';
+export type { ExhaustionReset, ProjectedBudget, ProjectedLimit, ProjectedQuota, QuotaGroup, } from './projection.js';
 export { budgetExhaustedResetAt, futureResetAt, projectQuota, readsExhausted, } from './projection.js';

package/dist/internal-types/quota/projection.d.ts

@@ -19,6 +19,15 @@ export interface ProjectedBudget {
     remainingPercent?: number;
     resetsAt?: string;
 }
+/**
+ * A named group of windows, such as antigravity-auth's `Gemini` and
+ * `Other models`: every window stored under `scope` belongs to it, and
+ * `label` is the group's display name.
+ */
+export interface QuotaGroup {
+    scope: string;
+    label: string;
+}
 export interface ProjectedQuota {
     scope: string;
     /** One entry per label: longest known window first, unknown lengths last. */
@@ -31,6 +40,13 @@ export interface ProjectedQuota {
     /** Present only when the stored budget is a reading, not cleared. */
     budget?: ProjectedBudget;
     counters?: Record<string, QuotaCounter>;
+    /**
+     * The named groups the windows belong to, in the order the plugin lists
+     * them. Set only by a plugin whose windows all belong to such groups; the
+     * narrow form then shows one item per group (see `formatQuota`).
+     * `projectQuota` never sets it.
+     */
+    groups?: readonly QuotaGroup[];
 }
 /**
  * Resolves `map` for a request in `scope` (`all` or a model family). A family

package/dist/internal-types/setup/command-error.d.ts

@@ -1,3 +1,4 @@
+import type { SetupHostEnrollment } from './types.js';
 /**
  * Keeps the Pi install refusal message stable while exposing safe process details.
  * A clipped tail can start inside a credential, so discard its first line—or
@@ -15,3 +16,17 @@ export declare class SetupCommandError extends Error {
         stderrTruncated?: boolean;
     });
 }
+/** The line setup prints for one host's outcome, e.g. `Pi: not connected`. */
+export declare function setupEnrollmentLine({ host, outcome, }: SetupHostEnrollment): string;
+/**
+ * Remember which hosts a failed setup left connected to the vault, against the
+ * thrown value. Only objects can carry a record; a thrown primitive is left as
+ * it is, and the printed lines are then the only report.
+ */
+export declare function recordSetupEnrollment(failure: unknown, enrollment: readonly SetupHostEnrollment[]): void;
+/**
+ * The per-host vault enrollment outcomes a failed `runSetup` recorded for the
+ * value it threw, or `undefined` when setup failed before any host's enrollment
+ * began, or the value is not one setup threw (or is not an object).
+ */
+export declare function setupEnrollment(error: unknown): readonly SetupHostEnrollment[] | undefined;

package/dist/internal-types/setup/index.d.ts

@@ -1,6 +1,6 @@
 export { AMBIGUOUS_OPENCODE_MESSAGE, runSetup } from './command.js';
-export { SetupCommandError } from './command-error.js';
+export { SetupCommandError, setupEnrollment } from './command-error.js';
 export { detectHosts, detectOpenCodeGeneration, findExecutableOnPath, openCodeDesktopMarkers, } from './detect.js';
 export { assertHostsStopped, createProcessFence, listSetupProcesses, ProcessFenceViolationError, ProcessInspectionError, type ProcessInspectionStep, } from './process-fence.js';
 export { type PlannedWrite, planOpenCodeRegistration, registerOpenCode, registerPi, updatePluginConfig, } from './register.js';
-export type { CommandResult, CommandRunner, HostDetection, OpenCodeGeneration, ProcessFence, SetupCallbackContext, SetupDetection, SetupEnvironment, SetupFileSystem, SetupHost, SetupIO, SetupPlugin, SetupResult, } from './types.js';
+export type { CommandResult, CommandRunner, HostDetection, OpenCodeGeneration, ProcessFence, SetupCallbackContext, SetupDetection, SetupEnrollmentOutcome, SetupEnvironment, SetupFileSystem, SetupHost, SetupHostEnrollment, SetupIO, SetupPlugin, SetupResult, } from './types.js';

package/dist/internal-types/setup/types.d.ts

@@ -3,6 +3,18 @@ import type { ClaustrumEnrollmentConnection, hostEnrollmentPaths } from '../clau
 export type SetupHost = 'opencode' | 'pi';
 export type OpenCodeGeneration = '1' | '2' | 'both';
 export type SetupEnvironment = Record<string, string | undefined>;
+/**
+ * What a setup run recorded about one host's vault enrollment when it failed:
+ * `enrolled` once approval landed and the token was written, `not-enrolled`
+ * when the host was never asked or its enrollment was refused or gave up
+ * waiting, and `unknown` when setup failed while the enrollment was still in
+ * flight and the host's token file could not settle it.
+ */
+export type SetupEnrollmentOutcome = 'enrolled' | 'not-enrolled' | 'unknown';
+export interface SetupHostEnrollment {
+    host: SetupHost;
+    outcome: SetupEnrollmentOutcome;
+}
 /**
  * What setup decided before calling a plugin callback. The OpenCode generation
  * is the one being registered, after `--opencode` or the interactive choice, so

package/dist/mid-conversation-output-config.d.ts

@@ -1,9 +1,7 @@
-/** Per-message effort beta sent with every OAuth Fable 5.1 request. */
-export declare const MID_CONVERSATION_OUTPUT_CONFIG_BETA = "mid-conversation-output-config-2026-07-01";
 /**
- * Per-turn control beta that Claude Code sends on every Opus 5.5 and Sonnet
- * 5.5 request. It enables effort changes carried by an empty `role: "system"`
- * message on those two models.
+ * Per-turn control beta that Claude Code sends on Opus 5.5, Sonnet 5.5,
+ * Fable 5.1 and Haiku 5.5. It enables effort changes carried by empty
+ * `role: "system"` messages on the eligible models below.
  */
 export declare const PER_TURN_CONTROL_BETA = "per-turn-control-2026-07-01";
 export type AdaptiveEffort = 'low' | 'medium' | 'high' | 'xhigh' | 'max';
@@ -14,19 +12,18 @@ export type MidConversationEffortTransition = {
 };
 export declare function normalizeAdaptiveEffort(value: unknown): AdaptiveEffort | undefined;
 /**
- * Whether an OAuth request for this model carries the Fable 5.1 per-message
- * effort beta (`MID_CONVERSATION_OUTPUT_CONFIG_BETA`). Opus 5.5 and Sonnet
- * 5.5 use `PER_TURN_CONTROL_BETA` instead.
+ * Models that require adaptive thinking for per-message effort: Opus 5.5
+ * and Sonnet 5.5, including dated and `[1m]` context-window ids. Header
+ * eligibility is separate; `sendsPerTurnControlBeta` follows Claude Code.
  */
-export declare function usesMidConversationOutputConfig(body: Record<string, unknown>): boolean;
+export declare function usesPerTurnControl(model: unknown): boolean;
 /**
- * Opus 5.5 and Sonnet 5.5, including dated and `[1m]` context-window ids.
- * Their OAuth requests always carry `PER_TURN_CONTROL_BETA`, as Claude Code's
- * do. Anthropic also documents per-message effort for Mythos 5.1, Opus 5 and
- * Haiku 5.5, but without a Claude Code capture to match, those models keep
- * sending requests without the beta or effort markers.
+ * Models whose OAuth requests carry `PER_TURN_CONTROL_BETA`: Opus 5.5 and
+ * Sonnet 5.5, plus Fable 5.1 and Haiku 5.5, which Claude Code 2.1.302 also
+ * sends it on. Sending the beta does not by itself make a model eligible for
+ * effort markers; `supportsPerMessageEffort` decides that.
  */
-export declare function usesPerTurnControl(model: unknown): boolean;
+export declare function sendsPerTurnControlBeta(model: unknown): boolean;
 /**
  * Whether a request may move effort changes into empty system messages.
  *

package/dist/migration-source.d.ts

@@ -1,3 +1,4 @@
+import { type OwnerOnlyOptions } from './owner-only.ts';
 export type NativeMigrationSourceRole = 'config' | 'state' | 'hostAuth' | 'routing' | 'journal';
 export interface NativeMigrationSourceSnapshot {
     readonly role: NativeMigrationSourceRole;
@@ -20,6 +21,7 @@ export declare class NativeMigrationSourceError extends Error {
 }
 interface SourceReadHooks {
     onOpened?: () => Promise<void>;
+    ownership?: OwnerOnlyOptions;
 }
 /**
  * Capture exact import bytes without the legacy loader's missing-entry recovery.

package/dist/native-account-runtime.d.ts

@@ -7,7 +7,7 @@ import { type NativeLocalCredentialServiceOptions } from './native-local-credent
 import type { NativeLocalExternalPolicy } from './native-local-runtime-readers.ts';
 import { type NativeQuotaObservations } from './native-quota-observations.ts';
 import type { NativeKnownCredentialSubject, NativeRefreshResult, NativeRefreshSubject } from './native-refresh-coordinator.ts';
-import { type NativeDisplayProfile, type NativeVaultRuntime, type NativeVaultRuntimeOptions } from './native-vault-runtime.ts';
+import { type NativeDisplayProfile, type NativeVaultQuotaPurpose, type NativeVaultRuntime, type NativeVaultRuntimeOptions } from './native-vault-runtime.ts';
 import { type NativeLocalPoolBinding } from './pool-binding.ts';
 import { type NativePoolPaths } from './pool-paths.ts';
 import type { QuotaRequestDispatch } from './quota-manager.ts';
@@ -106,7 +106,8 @@ export interface NativeAccountRuntime {
     resetBackoff(routeId: string, fence: NativeRefreshSubject | NativeCustodyReceipt, kind?: 'refresh' | 'quota' | 'all'): Promise<boolean>;
     getOrCreateAuthLineage(routeId: string, fence: NativeKnownCredentialSubject | NativeCustodyReceipt): Promise<string | undefined>;
     incrementPrimeUsage(routeId: string, fence: NativeKnownCredentialSubject | NativeCustodyReceipt, delta?: PrimeUsageDelta): Promise<boolean>;
-    fetchQuota(routeId: string, fetchImpl?: typeof fetch, signal?: AbortSignal, dispatch?: QuotaRequestDispatch): Promise<OAuthQuotaSnapshot>;
+    /** `purpose` applies to vault accounts only; local accounts always poll. */
+    fetchQuota(routeId: string, fetchImpl?: typeof fetch, signal?: AbortSignal, dispatch?: QuotaRequestDispatch, purpose?: NativeVaultQuotaPurpose): Promise<OAuthQuotaSnapshot>;
     fetchProfile(routeId: string, fetchImpl?: typeof fetch, signal?: AbortSignal): Promise<OAuthAccountProfile>;
     /** Like fetchProfile, but returns before the profile is saved; see NativeDisplayProfile. */
     fetchProfileForDisplay(routeId: string, fetchImpl?: typeof fetch, signal?: AbortSignal): Promise<NativeDisplayProfile>;

package/dist/native-custody.d.ts

@@ -1,3 +1,12 @@
+/**
+ * Reads insula's quota cache from the vault daemon. Declared here with the
+ * same shape as common-auth's InsulaUsageTransport so this module's published
+ * declarations do not depend on common-auth.
+ */
+export interface NativeInsulaUsageTransport {
+    connectionFile: string;
+    getUsage(): Promise<unknown>;
+}
 /** Claustrum IPC operations for listing accounts, reading tokens, reporting rejection, and closing the connection. */
 export interface NativeCustodyClient {
     listScoped: (enrollmentToken?: string) => Promise<{
@@ -18,6 +27,16 @@ export interface NativeCustodyClient {
             readonly email?: string;
             readonly orgName?: string;
         }[];
+        /**
+         * How many grants this enrollment holds, and which. Undefined when the
+         * vault is too old to send them: unknown, never zero.
+         */
+        readonly grants: number | undefined;
+        readonly grantTuples: readonly {
+            readonly selectorKind: string;
+            readonly selector: string;
+            readonly operation: string;
+        }[] | undefined;
     }>;
     getScoped: (input: {
         credentialId: string;
@@ -41,6 +60,79 @@ export interface NativeCustodyClient {
         reporterSource: NativeCustodyReporterSource;
     }) => Promise<void>;
     close: () => void;
+    /**
+     * Open one vault watch that announces changes to the accounts this
+     * enrollment can see. Present from claustrum-client 0.12.0; without it the
+     * host keeps listing on its own timer.
+     */
+    watchScoped?(onNotice: (notice: NativeScopedWatchNotice) => void, options?: {
+        enrollmentToken?: string;
+    }): NativeScopedWatchHandle;
+    /**
+     * How to read insula's background quota cache on the same daemon. Present
+     * when the connection was made with connectClaustrumScopedClient; reading
+     * it opens a separate short-lived socket and never uses this connection.
+     */
+    insula?: NativeInsulaUsageTransport;
+}
+/**
+ * A vault watch notice. `view` is the same digest `listScoped` returns, so
+ * only a different view means the visible accounts changed. Declared here,
+ * like the rest of this client shape, so published declarations do not
+ * depend on claustrum-client or common-auth.
+ */
+export interface NativeScopedWatchNotice {
+    readonly kind: string;
+    readonly epoch: string;
+    readonly seq: number;
+    readonly view: string;
+}
+/**
+ * How a vault watch ended. `refused` carries the vault's refusal of the
+ * confirming account listing (a revoked enrollment answers `not_found`);
+ * `unsupported` means the vault does not know the watch method.
+ */
+export type NativeScopedWatchEnd = {
+    readonly kind: 'refused';
+    readonly error: unknown;
+} | {
+    readonly kind: 'transport_lost';
+    readonly error: unknown;
+} | {
+    readonly kind: 'ended' | 'not_accepting' | 'unsupported' | 'stopped';
+};
+export interface NativeScopedWatchHandle {
+    stop(): void;
+    readonly closed: Promise<NativeScopedWatchEnd>;
+}
+/**
+ * How the host currently learns about account changes. `watching`: a vault
+ * watch is open, so the host's list timer only needs to run as a slow safety
+ * net. `polling` and `fallback`: no watch is open, so the host lists at its
+ * usual pace.
+ */
+export type NativeRosterWatchMode = 'watching' | 'polling' | 'fallback';
+export interface NativeRosterWatchOptions {
+    /**
+     * Run the host's discovery and roster publication. Called when a notice
+     * shows the visible accounts changed since the roster the host holds; one
+     * call at a time, and notices that arrive meanwhile earn at most one more.
+     */
+    onView: (view: string) => unknown;
+    /** The view of the roster the host currently holds, if any. */
+    view?: () => string | undefined;
+    onMode?: (mode: NativeRosterWatchMode) => void;
+    /**
+     * The vault refused the watch and its confirming listing. Kept receipts are
+     * already dropped, as a refused listing drops them.
+     */
+    onRefused?: (error: unknown) => void;
+    onError?: (error: unknown) => void;
+}
+export interface NativeRosterWatch {
+    readonly mode: NativeRosterWatchMode;
+    /** Stop the watch and its timers. Safe to call more than once. */
+    close(): void;
 }
 export type NativeCustodyReporterSource = 'direct' | 'relay_status_field' | 'relay_message_parse';
 export interface NativeCustodyLogger {
@@ -57,6 +149,12 @@ export interface NativeCustodyOptions {
     env?: NodeJS.ProcessEnv;
     now?: () => number;
     logger?: NativeCustodyLogger;
+    /**
+     * Timer functions for the custody's outage probe and roster watch retries.
+     * Defaults to the global ones; tests pass their own.
+     */
+    setTimeout?: typeof globalThis.setTimeout;
+    clearTimeout?: typeof globalThis.clearTimeout;
 }
 export interface NativeCustodyIdentity {
     readonly credentialId: string;
@@ -74,6 +172,7 @@ export interface NativeCustodyReceipt {
     readonly recordVersion: number;
     readonly expiresAtMs: number | null;
     readonly accessToken: string;
+    readonly fromKeptReceipt?: true;
 }
 export interface NativeCustodyInventory {
     readonly view: string;
@@ -89,6 +188,20 @@ export interface NativeCustodyInventory {
         readonly credentialId?: string;
         readonly reason: 'empty credential id' | 'duplicate credential id' | 'blank account identity' | 'empty state';
     }[];
+    /**
+     * What this host's enrollment is granted, as the vault's list reply named
+     * it. It explains an empty listing: `grants === 0` means no grant at all,
+     * while `grants > 0` means a grant that reaches no credential. Undefined
+     * means unknown (the vault predates these fields), never zero grants.
+     */
+    readonly grantReach?: {
+        readonly grants: number;
+        readonly tuples: readonly {
+            readonly selectorKind: string;
+            readonly selector: string;
+            readonly operation: string;
+        }[];
+    };
 }
 export type NativeCustodyErrorCode = 'closed' | 'not-enrolled' | 'invalid-token' | 'unavailable' | 'identity-changed' | 'identity-unasserted' | 'insufficient-validity' | 'invalid-material' | 'not-active' | 'route-unavailable' | 'route-declined' | 'no-receipt' | 'unsafe-file' | 'invalid-state' | 'wrong-consumer' | 'roster-busy' | 'host-slot-login' | 'host-slot-placeholder' | 'placeholder-refresh';
 export declare class NativeCustodyError extends Error {
@@ -108,6 +221,23 @@ export interface NativeCustody {
     authorize: (identity: NativeCustodyIdentity, signal?: AbortSignal) => Promise<NativeCustodyReceipt>;
     reportFailure: (receipt: NativeCustodyReceipt, status: number, reporterSource: NativeCustodyReporterSource) => Promise<void>;
     prepareRetry: (served: NativeCustodyReceipt, signal?: AbortSignal) => Promise<NativeCustodyRetry>;
+    /** The shared connection's insula transport, connecting first if needed; undefined when the client has none. */
+    insulaTransport: () => Promise<NativeInsulaUsageTransport | undefined>;
+    retain: (rows: readonly (NativeCustodyIdentity & {
+        enabled: boolean;
+        state: string;
+    })[]) => void;
+    forget: (credentialId: string) => void;
+    keptReceiptState: () => Readonly<{
+        active: boolean;
+        since: number | null;
+    }>;
+    /**
+     * Watch the vault for account changes over the shared connection instead
+     * of relying on the host's list timer alone. A client or vault without the
+     * watch reports `fallback`. Closing the custody closes every watch.
+     */
+    watchRoster: (options: NativeRosterWatchOptions) => NativeRosterWatch;
     close: () => void;
 }
 /** Share a lazy Claustrum connection; each authorize call reads a fresh enrollment token and OAuth receipt. */

package/dist/native-enrollment-authority.d.ts

@@ -1,2 +1,6 @@
+import { enrollmentAuthority, readClaustrumEnrollmentStatus } from "./internal-types/claustrum/index.js";
 /** Enrollment files, not account settings, choose the host's credential source. */
-export declare function readNativeEnrollmentMode(host: 'opencode' | 'pi', env?: NodeJS.ProcessEnv): Promise<'local' | 'claustrum'>;
+export declare function readNativeEnrollmentMode(host: 'opencode' | 'pi', env?: NodeJS.ProcessEnv, dependencies?: {
+    enrollmentAuthority: typeof enrollmentAuthority;
+    readClaustrumEnrollmentStatus: typeof readClaustrumEnrollmentStatus;
+}): Promise<'local' | 'claustrum'>;

package/dist/native-host-auth-read.d.ts

@@ -1,3 +1,4 @@
 import { type NativeHostAuthEntryInspection } from './native-host-auth.ts';
+import { type OwnerOnlyOptions } from './owner-only.ts';
 /** Read only the host's login classification; credentials and source fingerprints never leave this boundary. */
-export declare function readNativeHostAuthKind(host: 'opencode' | 'pi', path: string): Promise<NativeHostAuthEntryInspection['kind']>;
+export declare function readNativeHostAuthKind(host: 'opencode' | 'pi', path: string, ownership?: OwnerOnlyOptions): Promise<NativeHostAuthEntryInspection['kind']>;

package/dist/native-host-auth-write.d.ts

@@ -1,3 +1,4 @@
+import { type PublicationOptions } from './publication-rename.ts';
 export interface NativeHostAuthWriteInput {
     readonly host: 'opencode' | 'pi';
     /**
@@ -16,6 +17,7 @@ export interface NativeHostAuthWriteInput {
     readonly processFence: () => Promise<void>;
 }
 export interface NativeHostAuthWriteHooks {
+    readonly publication?: PublicationOptions;
     readonly beforeRecheck?: () => Promise<void>;
     readonly beforeRename?: () => Promise<void>;
     readonly afterRename?: () => Promise<void>;

package/dist/native-runtime.d.ts

@@ -2,8 +2,10 @@ import type { AccountOperationError, OAuthAccountProfile, PrimeUsageCounters } f
 import { type NativeLocalCredentialValidation } from './native-credential-validation.ts';
 import { type NativeQuotaMap } from './native-quota-codec.ts';
 import type { NativeRefreshObservation, NativeRefreshSubject } from './native-refresh-coordinator.ts';
+import { type OwnerOnlyOptions } from './owner-only.ts';
 import { type NativeLocalPoolBinding } from './pool-binding.ts';
 import type { NativePoolPaths } from './pool-paths.ts';
+import { type PublicationOptions } from './publication-rename.ts';
 /** Identifies the vault credential and Claude account that supplied an observation. This binding contains no access token. */
 export interface NativeCustodyRuntimeBinding {
     kind: 'custody';
@@ -83,8 +85,9 @@ export declare class NativeRuntimeError extends Error {
 }
 /** Validate structure and internal identifier consistency. The publisher separately checks these identifiers against the current pool or vault roster. */
 export declare function decodeNativeRuntime(value: unknown, storageId: string): NativeRuntimeState;
-export declare function readNativeRuntime(path: string, storageId: string): Promise<NativeRuntimeRead>;
+export declare function readNativeRuntime(path: string, storageId: string, ownership?: OwnerOnlyOptions): Promise<NativeRuntimeRead>;
 export interface NativeRuntimeWriteHooks {
+    publication?: PublicationOptions;
     /** Verify that the observed account still matches the current pool record or vault roster and that the caller still owns the locks protecting those records. */
     beforeRename?: () => Promise<void>;
     /** Check caller authority after every lease assertion, immediately before replacement. This hook can only refuse publication. */
@@ -112,6 +115,7 @@ export type NativeRuntimeOptionalPublication = {
     status: 'skipped';
 };
 export interface NativeRuntimeOptionalWriteHooks {
+    publication?: PublicationOptions;
     /**
      * Same checks as NativeRuntimeWriteHooks.beforeRename, run at the same
      * point. Resolve 'skip' to discard the staged write without an error; throw

package/dist/native-vault-invalidation.d.ts

@@ -0,0 +1,9 @@
+import type { NativeVaultRosterDocument } from './native-roster-seed.ts';
+export declare function watchNativeVaultAuthority(holder: {
+    roster: string;
+    tokenPath: string;
+    retain: (roster: NativeVaultRosterDocument | undefined) => void;
+    close: () => void;
+}): () => void;
+export declare function retainNativeVaultRoster(path: string, roster: NativeVaultRosterDocument | undefined): void;
+export declare function closeNativeVaultAuthority(tokenPath: string): void;

package/dist/native-vault-runtime.d.ts

@@ -1,4 +1,4 @@
-import { type ClaustrumClientOptions } from '@cortexkit/claustrum-client';
+import type { ClaustrumClientOptions } from '@cortexkit/claustrum-client';
 import { type OAuthAccountProfile, type OAuthQuotaSnapshot, type PrimeUsageDelta } from './accounts.ts';
 import { type NativeAccountMetadataPatch } from './native-account-view.ts';
 import { type NativeCustodyClient, type NativeCustodyInventory, type NativeCustodyReceipt, type NativeCustodyReporterSource, type NativeCustodyRetry } from './native-custody.ts';
@@ -7,7 +7,7 @@ import { type NativeRosterSeedInput, type NativeVaultRosterDocument, type Native
 import { type NativeRuntimeState } from './native-runtime.ts';
 import type { NativeVaultPaths } from './native-vault-paths.ts';
 import type { NativePoolPaths } from './pool-paths.ts';
-import type { QuotaRequestDispatch } from './quota-manager.ts';
+import type { QuotaReadingPurpose, QuotaRequestDispatch } from './quota-manager.ts';
 export interface NativeVaultRuntimeOptions {
     paths: NativePoolPaths;
     host: 'opencode' | 'pi';
@@ -21,7 +21,34 @@ export interface NativeVaultRuntimeOptions {
     }>;
     env?: NodeJS.ProcessEnv;
     now?: () => number;
+    /**
+     * Timer functions for the vault custody's outage probe and roster watch
+     * retries. Defaults to the global ones; tests pass their own.
+     */
+    setTimeout?: typeof globalThis.setTimeout;
+    clearTimeout?: typeof globalThis.clearTimeout;
+    /**
+     * Called each time the runtime has finished handling a vault notice that
+     * asked it to rediscover the roster, after the discovery that notice ran.
+     * Common-auth asks when the notice's view differs from the roster held,
+     * after a gap in the notices, and on a re-subscribed watch's first notice.
+     * Tests use it to wait for that handling instead of for the clock.
+     */
+    onRosterNoticeHandled?: () => void;
 }
+/**
+ * Why a vault quota reading is wanted, which decides whether insula's
+ * background quota cache may answer instead of Anthropic's usage endpoint.
+ * - 'background': a periodic sweep. Refresh insula's cache (at most once a
+ *   minute per daemon and enrollment), look the route's account up in it,
+ *   and skip the usage GET when it holds a current reading.
+ * - 'admission': a request needs a reading. Look the served credential's
+ *   account up in insula's cache only, never refreshing it, then poll on a
+ *   miss.
+ * Omitted: poll Anthropic directly (explicit user refreshes and other
+ *   callers that must see the provider's own reading).
+ */
+export type NativeVaultQuotaPurpose = QuotaReadingPurpose;
 export interface NativeVaultWatchOptions {
     intervalMs: number;
     onRefresh?: () => void | Promise<void>;
@@ -73,7 +100,7 @@ export interface NativeVaultRuntime {
      */
     prepareRetry(receipt: NativeCustodyReceipt, signal?: AbortSignal, site?: NativeScoped401Site): Promise<NativeCustodyRetry>;
     publish(receipt: NativeCustodyReceipt, patch: NativeAccountMetadataPatch): Promise<boolean>;
-    fetchQuota(routeId: string, fetchImpl?: typeof fetch, signal?: AbortSignal, dispatch?: QuotaRequestDispatch): Promise<OAuthQuotaSnapshot>;
+    fetchQuota(routeId: string, fetchImpl?: typeof fetch, signal?: AbortSignal, dispatch?: QuotaRequestDispatch, purpose?: NativeVaultQuotaPurpose): Promise<OAuthQuotaSnapshot>;
     fetchProfile(routeId: string, fetchImpl?: typeof fetch, signal?: AbortSignal): Promise<OAuthAccountProfile>;
     /** Return the fetched account profile without waiting for its metadata write. NativeDisplayProfile.persisted reports whether that asynchronous write succeeded, failed or was refused. */
     fetchProfileForDisplay(routeId: string, fetchImpl?: typeof fetch, signal?: AbortSignal): Promise<NativeDisplayProfile>;
@@ -95,6 +122,8 @@ export declare function publishNativeVaultRosterSeed(paths: Pick<NativeVaultPath
 export declare function publishNativeVaultRuntimeSeed(paths: Pick<NativeVaultPaths, 'roster' | 'runtime' | 'storageId'>, state: NativeRuntimeState, options?: {
     assertOwned?: () => Promise<void>;
 }): Promise<void>;
+/** Connect through the same short deadline used when requests wait for a vault roster. */
+export declare function connectNativeVaultScopedClient(connectionFile: string, identity?: ClaustrumClientOptions['identity']): Promise<import("./internal-types/claustrum/index.js").ClaustrumScopedClient>;
 /** List accounts readable by this host's enrollment for offline setup. An inventory grants no bearer authority; every outbound request still needs a fresh scoped receipt. */
 export declare function discoverNativeVaultInventory(options: NativeVaultRuntimeOptions, signal?: AbortSignal): Promise<NativeCustodyInventory>;
 /** Retain the vault client's original per-attempt receipts and version provenance; access tokens never persist in roster or runtime metadata. */

package/dist/owner-only.d.ts

@@ -0,0 +1,19 @@
+import type * as PrivateFiles from '@cortexkit/private-files';
+/** Per-operation injection keeps simulated Windows policy out of process globals. */
+export interface OwnerOnlyOptions {
+    platform?: NodeJS.Platform;
+    privateFiles?: Pick<typeof PrivateFiles, 'verifyOwnerOnly' | 'readPrivateFile'> & Partial<Pick<typeof PrivateFiles, 'verifySafeParent' | 'createPrivateFile' | 'createPrivateDirectory'>>;
+}
+/** POSIX callers retain their exact mode/uid policy; Windows must prove its DACL. */
+export declare function isOwnerOnly(path: string, posix: () => boolean, options?: OwnerOnlyOptions): Promise<boolean>;
+/** Windows reads through the ACL-verified native handle, not a pathname reopen. */
+export declare function readWindowsOwnerOnly(path: string, options?: OwnerOnlyOptions): Promise<Buffer | undefined>;
+/** Ancestors protect directory entries; they need not themselves be private. */
+export declare function isSafeWindowsParent(path: string, options?: OwnerOnlyOptions): Promise<boolean | undefined>;
+/** Native creation establishes a protected DACL before any bytes are written. */
+export declare function createWindowsOwnerOnly(path: string, bytes: string, options?: OwnerOnlyOptions): Promise<boolean>;
+/**
+ * Create only missing Windows directories; never tighten an existing shared directory.
+ * Returns false off Windows so callers retain their POSIX directory policy.
+ */
+export declare function ensureWindowsOwnerOnlyDirectory(path: string, options?: OwnerOnlyOptions): Promise<boolean>;

package/dist/pool-authority.d.ts

@@ -1,4 +1,5 @@
 import { type NativeMigrationPreparedProof } from './native-migration-proof.ts';
+import { type OwnerOnlyOptions } from './owner-only.ts';
 import type { NativePoolPaths } from './pool-paths.ts';
 declare const PHASES: readonly ['building', 'verified', 'activation-installed', 'committed', 'retired'];
 export type NativeMigrationPhase = (typeof PHASES)[number];
@@ -134,7 +135,7 @@ export declare class NativeAuthorityError extends Error {
     readonly code: 'migration-required' | 'migration-incomplete' | 'invalid-journal' | 'journal-conflict';
     constructor(code: 'migration-required' | 'migration-incomplete' | 'invalid-journal' | 'journal-conflict');
 }
-export declare function readNativeMigrationJournal(paths: NativePoolPaths): Promise<NativeMigrationJournal | undefined>;
+export declare function readNativeMigrationJournal(paths: NativePoolPaths, ownership?: OwnerOnlyOptions): Promise<NativeMigrationJournal | undefined>;
 /**
  * The migration phase that authorizes serving, or undefined while the
  * migration or a requested switch to vault custody is unfinished. Every reader

package/dist/provider-error.d.ts

@@ -33,6 +33,39 @@ export declare const PROVIDER_ERROR_OVERSIZED_MESSAGE = "Provider error body exc
 export declare const PROVIDER_ERROR_MAX_BODY_BYTES: number;
 /** Largest SSE frame carried while looking for its end. */
 export declare const PROVIDER_ERROR_MAX_FRAME_BYTES: number;
+/**
+ * Error types kept in a generic replacement body. A closed list rather than
+ * a syntax check: an opaque credential can look like any identifier.
+ */
+declare const PROVIDER_ERROR_TYPES: readonly ['api_error', 'authentication_error', 'billing_error', 'invalid_request_error', 'not_found_error', 'overloaded_error', 'permission_error', 'rate_limit_error', 'relay_upstream_error', 'request_too_large', 'timeout_error'];
+type ProviderErrorType = (typeof PROVIDER_ERROR_TYPES)[number];
+declare const PREWARM_ERROR_MESSAGES: {
+    readonly http_validation: 'Provider rejected the prewarm request';
+    readonly http_error: 'Provider prewarm request failed';
+    readonly credential_unavailable: 'OAuth cache prewarm credential is unavailable';
+    readonly transport: 'Provider prewarm transport failed';
+    readonly withheld: 'Provider prewarm error details were withheld';
+    readonly parse_failure: 'Provider prewarm error response could not be parsed';
+};
+export type ProviderErrorSummary = {
+    status?: number;
+    provider_error: {
+        type: ProviderErrorType | 'unknown';
+        reason: keyof typeof PREWARM_ERROR_MESSAGES;
+        message: (typeof PREWARM_ERROR_MESSAGES)[keyof typeof PREWARM_ERROR_MESSAGES];
+    };
+};
+/**
+ * Prompt-safe prewarm metadata, not a replacement for per-send redaction.
+ * Read input.body from the response returned by ProviderErrorResponseScope's
+ * redactResponse, using a scope created for the physical request's credentials.
+ * Parsing is bounded independently; no provider text is copied to the result.
+ */
+export declare function summarizePrewarmProviderError(input: {
+    status?: number;
+    body?: string;
+    failure?: 'credential_unavailable' | 'transport';
+}): ProviderErrorSummary;
 /**
  * For producers of a non-2xx body, such as the relay, that stop buffering it
  * at PROVIDER_ERROR_MAX_BODY_BYTES: error the raw body stream with a new
@@ -137,3 +170,4 @@ export declare const PROVIDER_ERROR_RESPONSE_SCOPE_USED_MESSAGE = "Provider erro
  * once settled, `redactError` only returns a generic error.
  */
 export declare function createProviderErrorResponseScope(secrets: readonly string[], mode: ProviderResponseMode): ProviderErrorResponseScope;
+export {};

package/dist/publication-rename.d.ts

@@ -0,0 +1,11 @@
+/** Per-publication seams keep platform and sharing-failure tests out of process globals. */
+export interface PublicationOptions {
+    readonly platform?: NodeJS.Platform;
+    readonly rename?: (from: string, to: string) => Promise<void>;
+    readonly now?: () => number;
+    readonly sleep?: (ms: number) => Promise<void>;
+}
+/** Capture optional callbacks before staging I/O, just like the writer's other hooks. */
+export declare function capturePublicationOptions(options?: PublicationOptions): PublicationOptions;
+/** First publication is unconditional; only subsequent Windows sharing failures are retried. */
+export declare function renameWithWindowsSharingRetry(from: string, to: string, options?: PublicationOptions, beforeRetry?: () => Promise<'publish' | 'skip'>): Promise<'published' | 'skipped'>;