@cortexkit/anthropic-auth-core 2.4.3 → 2.4.5

package/dist/cachekeep.d.ts

@@ -1,5 +1,6 @@
 import type { AccountStorage } from './accounts.ts';
 import type { CacheKeepTrackedSession } from './cachekeep-registry.ts';
+import { type NativeAccountRefusalReason } from './native-account-refusal.ts';
 import { type ProviderErrorSummary } from './provider-error.ts';
 export declare const CLAUDE_CACHE_KEEP_COMMAND_NAME = "claude-cachekeep";
 export declare const CACHE_KEEP_TTL_MS: number;
@@ -60,7 +61,9 @@ export declare function executeCacheKeepCommand(input: {
     nextPrewarmAt?: number;
     hybridActive?: boolean;
 }): string;
-export declare function buildCacheKeepPrewarmBody(bodyText: string): Promise<{
+export declare function buildCacheKeepPrewarmBody(bodyText: string, options?: {
+    stripServerFallback?: boolean;
+}): Promise<{
     ok: true;
     bodyText: string;
 } | {
@@ -81,7 +84,33 @@ export type CacheKeepTarget = {
     oauthAccountIdentity?: string;
     accountStoragePath?: string;
     isSubagent: boolean;
+    /**
+     * A recovery-round warm for the original (source) model, tracked under a
+     * key that cannot collide with the session's live target. It follows the
+     * same send, auth, retry and logging path; the caller stops it through
+     * untrack() when the round ends or its prefix becomes unusable.
+     */
+    sourceWarm?: boolean;
 };
+/**
+ * Fingerprint of the cacheable prefix of a request body: tools, system
+ * blocks, and messages up to the last cache breakpoint. The billing header
+ * block is excluded because its signature is re-signed on every send, and
+ * everything past the last breakpoint (output limits, stream flags,
+ * thinking config) never affects the stored cache entry. Two bodies with
+ * the same fingerprint warm the same cache entry.
+ */
+export declare function cacheWarmCacheablePrefixFingerprint(bodyText: string): string | undefined;
+/**
+ * How many warms one idle recovery round may send before stopping: each
+ * warm pays a cache read, and the idle warms stay worth it while the reads
+ * sent since the last user turn cost less than one 1-hour rewrite, so the
+ * round stops after floor((1-hour write rate - read rate) / read rate)
+ * warms. Rates come from the source model's own catalogue pricing; models
+ * without catalogue facts (Opus 5) use the nearest sibling with 1-hour
+ * pricing.
+ */
+export declare function cacheKeepSourceWarmIdleCap(modelId: string): number;
 export type CacheKeepPrewarmAttempt = {
     id: number;
     /** One deadline covers credential authorization and the HTTP attempt. */
@@ -89,6 +118,7 @@ export type CacheKeepPrewarmAttempt = {
 };
 export type CacheKeepPrewarmResult = {
     ok: true;
+    refused?: false;
     usage?: {
         input_tokens?: number;
         cache_creation_input_tokens?: number;
@@ -96,10 +126,26 @@ export type CacheKeepPrewarmResult = {
     };
 } | {
     ok: false;
+    refused?: false;
     reason: string;
+    refusal?: NativeAccountRefusalReason;
     status?: number;
     transient?: true;
     provider_error?: ProviderErrorSummary['provider_error'];
+} | {
+    /** The warm was refused before any send; the target is removed. */
+    ok: false;
+    refused: true;
+    reason: string;
+    status?: undefined;
+    transient?: undefined;
+    provider_error?: undefined;
+};
+export type CacheKeepPrewarmValidation = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
 };
 export declare class CacheKeepManager {
     private readonly options;
@@ -125,7 +171,19 @@ export declare class CacheKeepManager {
             attempt: CacheKeepPrewarmAttempt;
         }) => Promise<Headers | undefined> | Headers | undefined;
         onTrackedSessionsChanged?: (sessions: readonly CacheKeepTrackedSession[]) => Promise<void> | void;
+        /** Hosts may mirror targets without delaying a live request on storage I/O. */
+        onTargetChanged?: (target: Readonly<CacheKeepTarget>) => void;
+        onTargetRemoved?: (id: string) => void;
         prepareBody?: (bodyText: string, target: CacheKeepTarget) => string | Promise<string>;
+        /**
+         * Veto a prewarm after its body is built but before anything is
+         * sent. A refusal removes the target without sending. Throwing also
+         * refuses, so a failing check can never send a mismatched warm.
+         */
+        validatePrewarm?: (input: {
+            target: CacheKeepTarget;
+            warmBodyText: string;
+        }) => CacheKeepPrewarmValidation | Promise<CacheKeepPrewarmValidation>;
         onResponse?: (input: {
             target: CacheKeepTarget;
             bodyText: string;
@@ -149,6 +207,26 @@ export declare class CacheKeepManager {
     trackedOAuthRoute(sessionId: string): {
         oauthAccountId?: string;
     } | undefined;
+    /**
+     * The last request actually sent for a session, as tracked live: the
+     * exact signed bytes, destination, and account they went out on. A copy
+     * of the headers; the body string itself is shared, never re-serialized.
+     */
+    trackedRequest(id: string): {
+        bodyText: string;
+        url: string;
+        headers: Record<string, string>;
+        oauthAccountId?: string;
+        oauthAccountIdentity?: string;
+        isSubagent: boolean;
+        cacheExpiresAt: number;
+    } | undefined;
+    /**
+     * Stop warming a session without logging: the caller owns the reason
+     * (a finished recovery round, a model change, a cleared session) and
+     * logs it where the decision is made. Returns whether a target existed.
+     */
+    untrack(id: string): boolean;
     trackedCount(): number;
     /**
      * Drop targets whose cache has already expired, without sending or
@@ -172,6 +250,9 @@ export declare class CacheKeepManager {
         oauthAccountIdentity?: string;
         accountStoragePath?: string;
         isSubagent?: boolean;
+        sourceWarm?: boolean;
+        /** Restore only the remaining lifetime, never grant a restarted cache a new hour. */
+        retained?: Pick<CacheKeepTarget, 'cacheExpiresAt' | 'nextPrewarmAt'>;
     }): {
         tracked: true;
     } | {

package/dist/index.d.ts

@@ -24,6 +24,7 @@ export type { ClaudeCodeBetaLists, ClaudeModelCapabilities, ClaudeModelCatalogue
 export { CLAUDE_CODE_DEFAULT_BETAS, CLAUDE_MODEL_CAPABILITIES, getClaudeModelCapabilities, getClaudeModelCatalogue, pinsEffortOnEveryRequest, resolveClaudeModelCapabilities, } from './model-capabilities.ts';
 export * from './model-remap.ts';
 export * from './models.ts';
+export * from './native-account-refusal.ts';
 export type { NativeAccountRuntime, NativeAccountRuntimeOptions, NativeAccountWriteInput, NativeApiSubject, NativeLocalAuthorizeOptions, NativeRelayUpdate, } from './native-account-runtime.ts';
 export { acquireNativeAccountRuntime, createNativeAccountRuntime, nativeAccountPolicy, } from './native-account-runtime.ts';
 export type { NativeAccountMetadataPatch, NativeAccountSnapshot, NativeAccountView, } from './native-account-view.ts';
@@ -65,7 +66,7 @@ export type { NativeVaultQuotaPurpose, NativeVaultRuntime, NativeVaultRuntimeOpt
 export { acquireNativeVaultRuntime, createNativeVaultRuntime, discoverNativeVaultInventory, publishNativeVaultRosterSeed, publishNativeVaultRuntimeSeed, } from './native-vault-runtime.ts';
 export * from './oauth-origin.ts';
 export * from './oauth-profile.ts';
-export { createWindowsOwnerOnly, ensureWindowsOwnerOnlyDirectory, isOwnerOnly, type OwnerOnlyOptions, } from './owner-only.ts';
+export { createWindowsOwnerOnly, ensureWindowsOwnerOnlyDirectory, isOwnerOnly, type OwnerOnlyOptions, readWindowsOwnerOnly, } from './owner-only.ts';
 export * from './pkce.ts';
 export type { NativeEmptyInitJournal, NativeLegacyMigrationJournal, NativeMigrationJournal, } from './pool-authority.ts';
 export { nativeJournalMayAdoptLaterHostLogin, nativeMigrationAuthorityPhase, readNativeMigrationJournal, } from './pool-authority.ts';
@@ -77,6 +78,7 @@ export * from './prime.ts';
 export * from './provider.ts';
 export type { ProviderErrorRedactor, ProviderErrorResponseScope, ProviderErrorSummary, ProviderResponseMode, ProviderResponseSettlement, } from './provider-error.ts';
 export { createProviderErrorRedactor, createProviderErrorResponseScope, summarizePrewarmProviderError, } from './provider-error.ts';
+export { renameWithWindowsSharingRetry } from './publication-rename.ts';
 export * from './quota-header-feed.ts';
 export * from './quota-headers.ts';
 export * from './quota-manager.ts';