@cortexkit/anthropic-auth-core 2.1.2 → 2.2.1

package/dist/internal-types/claustrum/consumer.d.ts

@@ -3,7 +3,7 @@ import type { QuotaObservation } from '../quota/index.js';
 import type { RoutingRow } from '../routing/index.js';
 import { type ClaustrumFamily, type ClaustrumScopedAttempt, type ClaustrumScopedClient, type IdentityParser, type KeptReceiptState, type VaultGrantReach } from './custody.js';
 import { type ClaustrumLogger } from './errors.js';
-import { type InsulaQuotaOptions } from './insula.js';
+import { type InsulaQuotaOptions, type InsulaQuotaResult } from './insula.js';
 import { type AccountMapper, type QuotaReceipt, type VaultRosterFile } from './roster.js';
 import { type WatchMode } from './watch.js';
 export interface ClaustrumConsumerOptions<Q = QuotaObservation> {
@@ -134,6 +134,10 @@ export declare class ClaustrumConsumer<Q = QuotaObservation> {
      * A route without a known provider account cannot join an insula entry.
      */
     cachedInsulaQuotaForRoute(routeId: string): Promise<Q | undefined>;
+    /** Cache-only background lookup, preserving the reason a route has no reading. */
+    lookupInsulaQuotaForRoute(routeId: string): Promise<InsulaQuotaResult<Q>>;
+    /** Skip the fallback poll while insula is cold or its upstream fetch failed. */
+    pollInsulaQuotaForRoute(routeId: string, fallback: () => Promise<Q | undefined>): Promise<Q | undefined>;
     /**
      * Authorize one physical send on a vault route. The roster file is re-read
      * first, so a decline committed by another process applies before the next

package/dist/internal-types/claustrum/index.d.ts

@@ -7,7 +7,7 @@ export { type AccountIdentitySource, type ClaustrumFamily, type ClaustrumRosterW
 export { type ClaustrumEnrollmentClient, type ClaustrumEnrollmentConnection, type ClaustrumEnrollmentDisconnectResult, ClaustrumEnrollmentManager, type ClaustrumEnrollmentPaths, type ClaustrumEnrollmentResetResult, type ClaustrumEnrollmentStatus, classifyEnrollmentError, connectClaustrumEnrollmentClient, disconnectClaustrumEnrollment, type EnrollmentDisposition, enrollmentAuthority, enrollmentName, getClaustrumEnrollmentPaths, hostEnrollmentPaths, RETRYABLE_ENROLLMENT_CODES, readClaustrumEnrollmentStatus, readClaustrumEnrollmentToken, resetClaustrumEnrollmentState, TERMINAL_ENROLLMENT_CODES, } from './enrollment.js';
 export { ClaustrumConsumerError, type ClaustrumConsumerFailureKind, type ClaustrumLogger, } from './errors.js';
 export { assertHostSlotMatchesMode, assertNotCustodyPlaceholder, CUSTODY_PLACEHOLDER_PREFIX, classifyHostSlot, custodyPlaceholder, custodyPlaceholderKey, type HostSlotContent, isCustodyPlaceholder, isCustodyPlaceholderValue, } from './host-slot.js';
-export { acquireInsulaQuotaSource, type InsulaQuotaContext, type InsulaQuotaOptions, type InsulaQuotaSource, type InsulaUsageEntry, type InsulaUsageTransport, type InsulaUsageWatch, type InsulaUsageWindow, type InsulaWatchOptions, } from './insula.js';
+export { acquireInsulaQuotaSource, type InsulaQuotaContext, type InsulaQuotaLookup, type InsulaQuotaMiss, type InsulaQuotaOptions, type InsulaQuotaReading, type InsulaQuotaResult, type InsulaQuotaSource, type InsulaUsageEntry, type InsulaUsageTransport, type InsulaUsageWatch, type InsulaUsageWindow, type InsulaWatchOptions, } from './insula.js';
 export { acceptAccount, type DeclinedAccount, declineAccount, isDeclined, } from './interlock.js';
 export { type AccountMapper, acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, type MutateVaultRosterOptions, mutateVaultRoster, type ProjectionOptions, projectVaultRoster, type QuotaReceipt, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, resolveVaultPrimary, type VaultPrimary, type VaultPrimaryBinding, type VaultPrimaryUnavailableReason, type VaultRosterFile, type VaultRosterLockContext, type VaultRosterRow, vaultRoutingRows, } from './roster.js';
 export { type ChangeNotice, ChangeNoticeReader, RESUBSCRIBE_BACKOFF_MS, SAFETY_POLL_MS, ScopedRosterWatch, type ScopedRosterWatchOptions, type ScopedWatchEnd, type ScopedWatchHandle, type ScopedWatchNoticeShape, type ScopedWatchSource, WATCH_RETRY_MS, type WatchMode, } from './watch.js';

package/dist/internal-types/claustrum/insula.d.ts

@@ -34,6 +34,27 @@ export interface InsulaQuotaContext {
     fetchedAt: number;
     source?: string;
 }
+export type InsulaQuotaMiss = 'cold' | 'stale' | 'absent' | 'upstream-failed' | 'credential' | 'unreachable';
+export interface InsulaQuotaReading {
+    entry: InsulaUsageEntry;
+    context: InsulaQuotaContext;
+}
+/** A miss may retain a dated reading; it is not a current quota observation. */
+export type InsulaQuotaLookup = {
+    reading: InsulaQuotaReading;
+    miss?: never;
+} | {
+    miss: InsulaQuotaMiss;
+    reading?: InsulaQuotaReading;
+};
+/** The normalized equivalent of a source lookup, for a plugin's quota type. */
+export type InsulaQuotaResult<Q> = {
+    reading: Q;
+    miss?: never;
+} | {
+    miss: InsulaQuotaMiss;
+    reading?: Q;
+};
 export interface InsulaQuotaOptions<Q> {
     provider: 'codex' | 'claude' | 'antigravity';
     /**
@@ -110,6 +131,8 @@ export declare class InsulaQuotaSource {
         entry: InsulaUsageEntry;
         context: InsulaQuotaContext;
     } | undefined;
+    /** Cache-only background lookup; current() retains its original miss behavior. */
+    lookup(provider: string, accountId: string, now: number): InsulaQuotaLookup;
 }
 export declare function acquireInsulaQuotaSource(transport: InsulaUsageTransport, tokenPath: string): {
     source: InsulaQuotaSource;

package/dist/native-refresh-coordinator.d.ts

@@ -201,7 +201,7 @@ export interface NativeRefreshRequest {
     intent: 'serve' | 'refresh';
     mode: 'local' | 'claustrum';
     binding: NativeLocalPoolBinding;
-    /** A 401's dispatched access token, used only for replacement adoption. */
+    /** The access token dispatched on a 401; it must not be served again. */
     rejectedAccessToken?: string;
     signal?: AbortSignal;
 }

package/dist/native-transient-account.d.ts

@@ -1,9 +1,9 @@
 import { type NativeLockEvent } from './native-lock-observer.ts';
 import { type NativePoolStorePaths } from './pool-store.ts';
 /**
- * A local account could not be authorized because another writer was part
- * way through saving it (for example the refresh that records its first
- * account UUID) and did not finish within the short wait Core allows.
+ * A local account could not be authorized because the caller's short wait for
+ * an account write or a refresh replacing a provider-rejected token expired.
+ * The shared write or refresh may still finish after the caller stops waiting.
  *
  * The request should be retried. `code: 'ECONNRESET'` is how this package
  * marks an error retryable for its hosts. A host must surface it rather than

package/dist/native-vault-runtime.d.ts

@@ -8,7 +8,7 @@ import { type NativeRosterSeedInput, type NativeVaultRosterDocument, type Native
 import { type NativeRuntimeState } from './native-runtime.ts';
 import type { NativeVaultPaths } from './native-vault-paths.ts';
 import type { NativePoolPaths } from './pool-paths.ts';
-import type { QuotaReadingPurpose, QuotaRequestDispatch } from './quota-manager.ts';
+import { type QuotaReadingPurpose, type QuotaRequestDispatch } from './quota-manager.ts';
 export interface NativeVaultRuntimeOptions {
     paths: NativePoolPaths;
     host: 'opencode' | 'pi';
@@ -43,10 +43,12 @@ export interface NativeVaultRuntimeOptions {
  * background quota cache may answer instead of Anthropic's usage endpoint.
  * - 'background': a periodic sweep. Refresh insula's cache (at most once a
  *   minute per daemon and enrollment), look the route's account up in it,
- *   and skip the usage GET when it holds a current reading.
+ *   and skip the usage GET for a current reading, a cold cache or an upstream
+ *   failure. Skipped misses leave the account due for the next sweep.
  * - 'admission': a request needs a reading. Look the served credential's
  *   account up in insula's cache only, never refreshing it, then poll on a
- *   miss.
+ *   miss except an upstream failure, which uses a dated reading if attached
+ *   and otherwise leaves quota unknown.
  * Omitted: poll Anthropic directly (explicit user refreshes and other
  *   callers that must see the provider's own reading).
  */

package/dist/quota-manager.d.ts

@@ -24,6 +24,9 @@ export type QuotaRefreshResult = {
  * means poll the provider directly.
  */
 export type QuotaReadingPurpose = 'background' | 'admission';
+/** Insula is still fetching or its upstream failed; preserve quota without recording a poll. */
+export declare class QuotaRefreshDeferred extends Error {
+}
 /** Pace a physical usage GET and verify the selected credential is still eligible before sending. */
 export type QuotaRequestDispatch = (send: () => Promise<Response>, revalidate: () => Promise<void>) => Promise<Response>;
 export type QuotaManagerOptions = {

package/dist/turn-end-note.d.ts

@@ -0,0 +1,19 @@
+export declare const TURN_END_NOTE_BETA = "mid-conversation-system-clear-at-2026-08-21";
+export declare const TURN_END_NOTE_MIN_VISIBLE_CHARACTERS = 350;
+export declare const TURN_END_NOTE_CONTENT = "Your reply above has already reached the user. The tool call after it was housekeeping and changed nothing they need to know. Do not repeat, summarize or rewrite that reply. If no new work remains, end the turn without restating anything.";
+/**
+ * Model families that get turn-end notes. The note is a turn-scoped system
+ * message (`clear_at: "next_user_message"`), which needs the
+ * mid-conversation-system-clear-at beta that Claude Code sends for these models.
+ */
+export declare function supportsTurnEndNote(model: unknown): boolean;
+/**
+ * Call only on OAuth histories, after effort-marker validation and stripping.
+ * Map configured host names with the same stateless mapping used for history,
+ * never with the currently declared tool set: declarations can change later.
+ */
+export declare function applyTurnEndNotes(body: Record<string, unknown>, options?: {
+    tools?: readonly string[];
+    mapToolName?: (name: string) => string;
+    visibleText?: (message: Record<string, unknown>) => string;
+}): number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "2.1.2",
+  "version": "2.2.1",
   "type": "module",
   "repository": {
     "type": "git",
@@ -30,7 +30,7 @@
     "prepublishOnly": "bun run build"
   },
   "devDependencies": {
-    "@cortexkit/common-auth": "0.21.1"
+    "@cortexkit/common-auth": "0.22.0"
   },
   "dependencies": {
     "@cortexkit/claustrum-client": "0.12.0",