@cortexkit/anthropic-auth-core 2.4.3 → 2.4.5

package/dist/internal-types/claustrum/consumer.d.ts

@@ -50,6 +50,12 @@ export interface ClaustrumConsumerOptions<Q = QuotaObservation> {
      * routine token refresh, which never moves the view.
      */
     onRoster?: (roster: VaultRosterFile) => void;
+    /**
+     * Called once when a coalesced discovery starts, with its completion promise.
+     * Covers explicit refresh, poll, watch and send-triggered discovery, even when
+     * the view does not change. Observe rejection when attaching async work.
+     */
+    onDiscovery?: (promise: Promise<VaultRosterFile | undefined>) => void;
     onError?: (error: unknown) => void;
     /**
      * How often `start()` ticks. A tick lists the vault when no vault watch is
@@ -104,6 +110,8 @@ export interface HubMemberPort {
     keptReceiptState(): KeptReceiptState;
     /** Apply the union of every member's roster in memory to kept receipts. */
     retainUnion(): void;
+    /** Share a committed preference change with live members using this roster file. */
+    publishRoster(roster: VaultRosterFile): void;
     forget(credentialId: string): void;
     /** The member closed: the hub stops committing and pushing to it. */
     detach(): void;
@@ -113,6 +121,8 @@ export interface HubRefreshOutcome {
 }
 /** What the hub may do to one member's memory. Package-internal. */
 export interface HubMemberHooks {
+    /** Observe a hub discovery without relying on member refresh overrides. */
+    discovery(promise: Promise<HubRefreshOutcome | undefined>): void;
     /**
      * Set the roster in memory as a consumer's own refresh does (pending quota
      * readings included) and notify `onRoster` when its view changed.

package/dist/internal-types/claustrum/custody.d.ts

@@ -25,7 +25,8 @@ export interface ClaustrumFamily {
 /** Non-secret classification facts, including rows decoded by older clients. */
 export interface VaultRowFacts {
     readonly credentialId: string;
-    readonly credentialType: string;
+    /** Internal serving type derived from `authMethod`, not the id's type hint. */
+    readonly credentialType: VaultCredentialType;
     readonly authMethod?: string;
     readonly refreshAdapter?: string;
     readonly providerIds?: readonly string[];
@@ -108,7 +109,10 @@ export interface VaultInventory {
     readonly view: string;
     readonly credentials: readonly VaultCredential[];
     readonly skipped: readonly SkippedVaultRecord[];
-    /** Classifying families only: fixed refusal codes, never classifier errors. */
+    /**
+     * Classifying families only: declared policy codes or the fixed library codes
+     * `unknown-auth-method`, `unmapped` and `unclassified`, never classifier errors.
+     */
     readonly refused?: readonly {
         credentialId?: string;
         code: string;

package/dist/internal-types/claustrum/hub.d.ts

@@ -1,5 +1,5 @@
 import type { QuotaObservation } from '../quota/index.js';
-import { type ClaustrumConsumer } from './consumer.js';
+import { type ClaustrumConsumer, type ClaustrumConsumerOptions } from './consumer.js';
 import { type ClassifyingClaustrumFamily, type ClaustrumScopedClient, ClaustrumScopedCustody, type IdentityParser, type KeptReceiptState, type VaultGrantReach } from './custody.js';
 import { type ClaustrumLogger } from './errors.js';
 import { type AccountMapper, type VaultRosterFile } from './roster.js';
@@ -100,6 +100,8 @@ export interface ClaustrumHubMemberOptions<_Q = QuotaObservation> {
     reservedRouteIds?: () => Iterable<string>;
     /** As `ClaustrumConsumerOptions.onRoster`: once per change of view. */
     onRoster?: (roster: VaultRosterFile) => void;
+    /** Observe every hub discovery's member result, including background work. */
+    onDiscovery?: ClaustrumConsumerOptions<_Q>['onDiscovery'];
     /** This member's own failures, such as a roster commit that failed. */
     onError?: (error: unknown) => void;
     logger?: ClaustrumLogger;

package/dist/internal-types/fs/refresh-file-lock.d.ts

@@ -21,7 +21,8 @@ export interface LockLoss {
 export interface RefreshFileLock {
     readonly ownerId: string;
     assertOwned(): Promise<void>;
-    release(): Promise<void>;
+    /** Abort stops release retries; the unrenewed lease is left to expire by TTL. */
+    release(signal?: AbortSignal): Promise<void>;
     /** Resolves once on detected loss; remains pending after an owner's release. */
     whenLost(): Promise<LockLoss>;
     hasLost(): boolean;

package/dist/native-account-refusal.d.ts

@@ -0,0 +1,11 @@
+import type { NativeRefreshResult } from './native-refresh-coordinator.ts';
+export type NativeAccountRefusalReason = 'account-policy' | 'account-unavailable' | 'credential-changed';
+/** A closed, credential-free refusal that retrying a background send cannot fix. */
+export declare class NativeAccountRefusal extends Error {
+    readonly reason: NativeAccountRefusalReason;
+    constructor(reason: NativeAccountRefusalReason);
+}
+/** Unknown failures and vault outages retain the caller's existing retry policy. */
+export declare function nativeAccountRefusal(error: unknown): NativeAccountRefusal | undefined;
+/** Refresh/validation backoff and failed I/O are not permanent account refusals. */
+export declare function nativeLocalAccountRefusal(result: NativeRefreshResult): NativeAccountRefusal | undefined;

package/dist/quota-headers.d.ts

@@ -1,4 +1,6 @@
 import type { OAuthQuotaSnapshot } from './accounts.ts';
 export declare function isQuotaBearingHeaderFrame(headers: Headers): boolean;
+/** Only a rejected status or raw utilization at least one confirms a 429's limit. */
+export declare function quotaExhaustionFromHeaders(headers: Headers, modelId?: string, now?: number): OAuthQuotaSnapshot;
 export declare function normalizeQuotaHeaders(headers: Headers, now?: number): OAuthQuotaSnapshot;
 export declare function mergeHeaderQuotaSnapshot(existing: OAuthQuotaSnapshot | undefined, incoming: OAuthQuotaSnapshot): OAuthQuotaSnapshot;

package/dist/sticky-routing.d.ts

@@ -90,9 +90,12 @@ export declare function stickyRouteCandidateWeight(input: {
 export declare function stickyRouteKnownFableExhausted(candidate: StickyRouteCandidate, storage: AccountStorage | null, now?: number): boolean;
 export declare function decideStickyQuotaFailure(input: {
     quota: OAuthQuotaSnapshot | QuotaState | undefined;
+    responseHeaders?: Headers;
     modelId?: string;
     now?: number;
 }): StickyQuotaFailureDecision;
+/** Bound an unconfirmed 429's host retry while preserving any shorter upstream wait. */
+export declare function stickyRetainRetryHeaders(upstream: Headers, now?: number): Headers;
 export declare function getStickyRoutingStatePath(accountStoragePath: string): string;
 export declare function stickyRetryAfterWithJitter(sessionId: string, retryAfterSeconds: number): number;
 export declare class StickySessionRouter {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "2.4.3",
+  "version": "2.4.5",
   "type": "module",
   "repository": {
     "type": "git",
@@ -30,7 +30,7 @@
     "prepublishOnly": "bun run build"
   },
   "devDependencies": {
-    "@cortexkit/common-auth": "0.29.0"
+    "@cortexkit/common-auth": "0.31.0"
   },
   "dependencies": {
     "@cortexkit/claustrum-client": "0.13.0",