@cortexkit/opencode-anthropic-auth 1.21.0 → 1.23.0

package/dist/custody-live.d.ts

@@ -0,0 +1,111 @@
+import * as core from '@cortexkit/anthropic-auth-core';
+import { type ClaustrumTakeoverPlan, type CustodyCacheCredential, type ExecuteClaustrumTakeoverDeps } from './custody-mode.ts';
+type Lock = {
+    release: () => Promise<void>;
+};
+type RawCacheCredential = core.ClaustrumCredential | CustodyCacheCredential;
+type LiveRoute = {
+    id: string;
+    label?: string;
+    type: string;
+    enabled?: boolean;
+    local?: unknown;
+    claustrumHandle?: string;
+};
+type ClaustrumTakeoverCommandDeps = {
+    storagePath: string;
+    loadStorage: () => Promise<core.AccountStorage | null>;
+    getCache: () => Promise<{
+        get: (handle: string, minTtlMs?: number) => Promise<RawCacheCredential>;
+    } | null>;
+    latestGetAuth?: () => Promise<unknown>;
+    now: () => number;
+    fallbackManager?: Pick<core.FallbackAccountManager, 'withAccountRefreshLock'>;
+    refreshManifest: () => Promise<void>;
+    debug?: (message: string) => void;
+};
+export declare function runClaustrumTakeoverCommand(deps: ClaustrumTakeoverCommandDeps, mode: 'local' | 'claustrum'): Promise<{
+    text: string;
+}>;
+export declare function createLiveCustodyDeps(input: {
+    storagePath: string;
+    cache: {
+        get: (handle: string, minTtlMs?: number) => Promise<RawCacheCredential>;
+    };
+    latestGetAuth: () => Promise<unknown>;
+    now: number | (() => number);
+    fallbackManager?: Pick<core.FallbackAccountManager, 'withAccountRefreshLock'>;
+    storage?: core.AccountStorage | null;
+    writeManifestEntryLocked?: typeof core.writeCustodyHandleManifestEntryLocked;
+    debug?: (message: string) => void;
+}): {
+    hostAuth: {
+        get: () => Promise<unknown>;
+    };
+    readonly manifestPath: string;
+    readBindings(routes: LiveRoute[]): Promise<{
+        accountId: string;
+        label: string;
+        handle: string;
+        credentialId: string;
+        source: "legacy" | "manifest";
+    }[]>;
+    cache: {
+        get: (handle: string, options: {
+            minTtlMs: number;
+        }) => Promise<CustodyCacheCredential>;
+    };
+    preflightInput(main: Pick<LiveRoute, 'id' | 'label' | 'enabled'>, fallbacks: LiveRoute[]): Promise<{
+        now: number;
+        storage: core.AccountStorage | null;
+        main: Pick<LiveRoute, "enabled" | "id" | "label">;
+        fallbacks: {
+            id: string;
+            label?: string;
+            type: string;
+            enabled?: boolean;
+            claustrumHandle?: string;
+            local: {};
+        }[];
+        hostAuth: {
+            get: () => Promise<unknown>;
+        };
+        bindings: {
+            accountId: string;
+            label: string;
+            handle: string;
+            credentialId: string;
+            source: "legacy" | "manifest";
+        }[];
+        cache: {
+            get: (handle: string, options: {
+                minTtlMs: number;
+            }) => Promise<CustodyCacheCredential>;
+        };
+        debug: ((message: string) => void) | undefined;
+    }>;
+    locks: {
+        storagePath: string;
+        readonly manifestPath: string;
+        acquireTransition: ({ name, path }: {
+            name: string;
+            path: string;
+        }) => Promise<{
+            release: () => Promise<void>;
+            assertOwned: () => Promise<void>;
+        } | null>;
+        acquireManifest: ({ path }: {
+            path: string;
+        }) => Promise<Lock>;
+        acquireRefresh: ({ name, path }: {
+            name: string;
+            path: string;
+        }) => Promise<Lock> | Promise<{
+            release: () => Promise<void>;
+            assertOwned: () => Promise<void>;
+        } | null>;
+        withFallbackRefreshLock: <T>(accountId: string, fn: () => Promise<T>) => Promise<T>;
+    };
+    takeoverDeps(plan: ClaustrumTakeoverPlan): ExecuteClaustrumTakeoverDeps;
+};
+export {};

package/dist/custody-manifest-watcher.d.ts

@@ -0,0 +1,16 @@
+import { watch } from 'node:fs';
+type Listener = () => void | Promise<void>;
+type WatchFactory = typeof watch;
+export declare function adoptCustodyManifestWatcher(manifestPath: string, listener: Listener, options?: {
+    watchImpl?: WatchFactory;
+    setTimeoutImpl?: typeof setTimeout;
+    clearTimeoutImpl?: typeof clearTimeout;
+    pollSetTimeoutImpl?: typeof setTimeout;
+    pollClearTimeoutImpl?: typeof clearTimeout;
+    debounceMs?: number;
+    pollIntervalMs?: number;
+    onError?: (error: unknown) => void;
+}): {
+    release: () => void;
+};
+export {};

package/dist/custody-mode.d.ts

@@ -0,0 +1,186 @@
+type ModeDimension = 'L' | 'C';
+type MainDimension = 'R' | 'T' | 'X';
+type FallbackDimension = 'R' | 'T' | 'M';
+type EvidenceDimension = 'V' | 'N' | 'unknown';
+type Lock = {
+    release: () => Promise<void>;
+};
+export declare const OPENCODE_MAIN_OAUTH_REFRESH_LOCK = "opencode-main-oauth-refresh";
+export declare const CUSTODY_PREFLIGHT_MIN_TTL_MS: number;
+export type CustodyCacheCredential = {
+    credentialId?: string;
+    recordVersion: number;
+    access: string;
+    refresh: string;
+    expiresAt: number | null;
+    state: 'usable' | 'revoked' | 'reauth' | 'timeout';
+};
+export type ClaustrumTakeoverPlan = {
+    accounts: Array<{
+        id: string;
+        label: string;
+        handle: string;
+        credentialId: string;
+        recordVersion: number;
+        bindingPersisted: boolean;
+        localAuthFingerprint: string;
+        cacheCredential: CustodyCacheCredential;
+    }>;
+    toJSON: () => unknown;
+    toString: () => string;
+};
+export type CustodyPreflightRefusalReason = 'TAKEOVER_INCOMPLETE_MAIN_REAL' | 'TAKEOVER_INCOMPLETE_MAIN_BINDING' | 'binding_missing' | 'credential_revoked' | 'credential_reauth' | 'credential_timeout' | 'credential_unusable' | 'credential_identity_mismatch' | 'divergence_fenced' | 'TAKEOVER_INCOMPLETE_MAIN_SLOT' | 'local_credential_unavailable';
+export type CustodyPreflightRefusal = {
+    label: string;
+    reason: CustodyPreflightRefusalReason;
+    guidance?: string;
+};
+export type MainCustodyRefusal = 'cold' | 'reauth' | 'takeover-incomplete' | 'identity-mismatch';
+export declare class CustodyPreflightRefusedError extends Error {
+    readonly accountId: string;
+    readonly reason: CustodyPreflightRefusalReason;
+    readonly refusals: CustodyPreflightRefusal[];
+    readonly code = "custody_preflight_refused";
+    constructor(accountId: string, reason: CustodyPreflightRefusalReason, refusals?: CustodyPreflightRefusal[]);
+    toJSON(): {
+        ok: boolean;
+        code: string;
+        accountId: string;
+        reason: CustodyPreflightRefusalReason;
+        refusals: CustodyPreflightRefusal[];
+    };
+}
+export declare class CustodyStateMismatchError extends Error {
+    readonly verdict: string;
+    readonly dimensions: {
+        mode: ModeDimension;
+        main: MainDimension;
+        fallbacks: FallbackDimension;
+        evidence: EvidenceDimension;
+    };
+    readonly code = "custody_state_mismatch";
+    constructor(verdict: string, dimensions: {
+        mode: ModeDimension;
+        main: MainDimension;
+        fallbacks: FallbackDimension;
+        evidence: EvidenceDimension;
+    });
+    toJSON(): {
+        code: string;
+        verdict: string;
+        dimensions: {
+            mode: ModeDimension;
+            main: MainDimension;
+            fallbacks: FallbackDimension;
+            evidence: EvidenceDimension;
+        };
+    };
+}
+export declare class CustodyLockBusyError extends Error {
+    readonly lockName: string;
+    readonly code = "lock_busy";
+    constructor(lockName: string);
+}
+type PreflightRoute = {
+    id: string;
+    label?: string;
+    enabled?: boolean;
+    type: string;
+    local?: unknown;
+};
+type PreflightBinding = {
+    accountId: string;
+    label: string;
+    handle: string;
+    credentialId: string;
+    source?: 'manifest' | 'legacy';
+};
+export type PreflightClaustrumTakeoverInput = {
+    now: number;
+    storage: {
+        refresh?: {
+            refreshBeforeExpiryMinutes?: number;
+        };
+        claustrumDivergence?: Record<string, {
+            minimumRecordVersion: number;
+            observedAt?: number;
+        }>;
+    } | null;
+    main: Pick<PreflightRoute, 'id' | 'label' | 'enabled'>;
+    fallbacks: PreflightRoute[];
+    hostAuth: {
+        get: () => unknown | Promise<unknown>;
+    };
+    bindings: PreflightBinding[];
+    cache: {
+        get: (handle: string, options: {
+            minTtlMs: number;
+        }) => Promise<CustodyCacheCredential | {
+            state: string;
+            expiresAt?: number;
+        }>;
+    };
+    debug?: (message: string) => void;
+};
+export declare function preflightClaustrumTakeover(input: PreflightClaustrumTakeoverInput): Promise<ClaustrumTakeoverPlan>;
+export declare function reconcileCustodyStartup(input: {
+    mode: ModeDimension;
+    main: MainDimension;
+    fallbacks: FallbackDimension;
+    evidence: EvidenceDimension;
+} | {
+    mode: ModeDimension;
+    mainSlot: 'unknown';
+    fallbacks: FallbackDimension;
+    evidence: EvidenceDimension;
+}): {
+    verdict: string;
+    provisional?: boolean;
+};
+export declare function acquireCustodyTransitionLocks(input: {
+    storagePath: string;
+    manifestPath: string;
+    fallbackAccountIds: string[];
+    acquireTransition: (input: {
+        name: 'claustrum-mode-transition';
+        path: string;
+    }) => Promise<Lock | null>;
+    acquireManifest: (input: {
+        path: string;
+    }) => Promise<Lock | null>;
+    acquireRefresh: (input: {
+        name: string;
+        path: string;
+    }) => Promise<Lock | null>;
+}): Promise<{
+    release: () => Promise<void>;
+}>;
+export declare class CustodyTransitionError extends Error {
+    readonly stage: 'reverify_fingerprint' | 'write_manifest' | 'write_sidecar' | 'readback' | 'mode_commit' | 'post_commit_readback';
+    readonly accountId?: string | undefined;
+    readonly guidance?: string | undefined;
+    readonly code = "custody_transition_failed";
+    constructor(stage: 'reverify_fingerprint' | 'write_manifest' | 'write_sidecar' | 'readback' | 'mode_commit' | 'post_commit_readback', accountId?: string | undefined, guidance?: string | undefined);
+    toJSON(): {
+        code: string;
+        stage: "mode_commit" | "post_commit_readback" | "readback" | "reverify_fingerprint" | "write_manifest" | "write_sidecar";
+        accountId: string | undefined;
+        guidance: string | undefined;
+    };
+}
+export type ExecuteClaustrumTakeoverDeps = {
+    locks: Parameters<typeof acquireCustodyTransitionLocks>[0];
+    getLocalAuth: (accountId: string) => Promise<unknown>;
+    isCommitted: (plan: ClaustrumTakeoverPlan) => Promise<boolean>;
+    writeManifestBindings: (plan: ClaustrumTakeoverPlan) => Promise<void>;
+    writeSidecarAccount: (account: ClaustrumTakeoverPlan['accounts'][number]) => Promise<void>;
+    verifyTarget: (plan: ClaustrumTakeoverPlan) => Promise<boolean>;
+    verifyCommitted: (plan: ClaustrumTakeoverPlan) => Promise<boolean>;
+    setMode: (mode: 'claustrum' | 'local') => Promise<'changed' | 'unchanged'>;
+};
+export declare function executeClaustrumTakeover(plan: ClaustrumTakeoverPlan, deps: ExecuteClaustrumTakeoverDeps): Promise<'changed' | 'unchanged'>;
+export declare function executeLocalExit(deps: {
+    path?: string;
+    setMode?: (mode: 'local') => Promise<'changed' | 'unchanged'>;
+}): Promise<"changed" | "unchanged">;
+export {};

package/dist/effort-history.d.ts

@@ -0,0 +1,62 @@
+import { type AdaptiveEffort } from '@cortexkit/anthropic-auth-core';
+export declare const EFFORT_MARKER_PREFIX = "<cortexkit-internal-effort-v2 ";
+export declare const EFFORT_ANCHOR_PREFIX = "<cortexkit-internal-effort-anchor-v1 ";
+export declare const EFFORT_PLAN_REQUEST_HEADER = "x-cortexkit-effort-plan";
+export type OpenCodeEffortMarkerPlan = {
+    scope: string;
+    baseline: AdaptiveEffort;
+    markerCount: number;
+    digest: string;
+    transitionTokens: readonly string[];
+    anchorToken?: string;
+    sessionId: string;
+    messageId: string;
+};
+export declare class EffortMarkerCorrelationError extends Error {
+    constructor(message: string);
+}
+type OpenCodeMessageInfo = {
+    id?: unknown;
+    sessionID?: unknown;
+    role?: unknown;
+    model?: {
+        providerID?: unknown;
+        modelID?: unknown;
+        variant?: unknown;
+    };
+};
+type MutableOpenCodePart = Record<string, unknown> & {
+    type?: unknown;
+    text?: unknown;
+    ignored?: unknown;
+    mime?: unknown;
+};
+type MutableOpenCodeMessage = {
+    info?: OpenCodeMessageInfo;
+    parts?: MutableOpenCodePart[];
+};
+export declare function encodeOpenCodeEffortPlan(plan: OpenCodeEffortMarkerPlan): string;
+/**
+ * Annotate effort-changing user turns before OpenCode lowers its internal
+ * message records. Markers are stable by session/message identity so later
+ * transforms may persist and restore them without changing request lineage.
+ */
+export declare function markOpenCodeEffortTransitions(messages: MutableOpenCodeMessage[]): OpenCodeEffortMarkerPlan | null;
+/** Consume request-correlated markers and insert Anthropic effort system messages. */
+export declare function applyOpenCodeEffortMarkers(body: Record<string, unknown>, enabled: boolean, requestPlanHeader?: string, resolvedPlan?: OpenCodeEffortMarkerPlan): {
+    found: number;
+    inserted: number;
+};
+export declare class OpenCodeEffortPlanTracker {
+    private readonly plans;
+    record(plan: OpenCodeEffortMarkerPlan): void;
+    clear(sessionId: string, messageId: string): void;
+    markHeaders(input: {
+        sessionId: string;
+        messageId: string;
+        headers: Record<string, string>;
+    }): boolean;
+    resolveHeader(value: string | undefined): OpenCodeEffortMarkerPlan | undefined;
+    private key;
+}
+export {};

package/dist/fable-fallback.d.ts

@@ -21,14 +21,13 @@ export type FableFallbackPlan = {
 };
 /**
  * Models whose content-filter refusal we recover from by downgrading to Opus 4.8
- * for a short window. Fable 5 is the original case; Opus 5 is identical in
- * shape (cyber safety classifiers that can return `stop_reason: "refusal"`,
- * Anthropic's own fallback default is `claude-opus-4-8`, same pricing). Mythos
- * has no classifiers and Sonnet 5 is not flagged — both stay outside this
- * gate. The single shared fallback id matches Anthropic's default for both
- * source models, so the recovery period is uniform.
+ * for a short window. Fable 5, Fable 5.1, and Opus 5 each have a separate
+ * source family because recovery state must not cross-contaminate distinct
+ * requested models. All three use Anthropic's `claude-opus-4-8` fallback for
+ * the same classifier refusal shape and recovery period. Mythos has no
+ * classifiers and Sonnet 5 is not flagged — both stay outside this gate.
  */
-export type RecoverableRefusalFamily = 'fable-5' | 'opus-5';
+export type RecoverableRefusalFamily = 'fable-5' | 'fable-5-1' | 'opus-5' | 'opus-5-5';
 export declare function recoverableRefusalFamily(model: unknown): RecoverableRefusalFamily | null;
 export declare function isRecoverableRefusalModel(model: unknown): model is string;
 export declare class FableFallbackManager {

package/dist/{index-w9d41yy9.js → index-0jfsxyn9.js}

@@ -1,2 +1,2 @@
 import{mkdir as l,readdir as u,readFile as c,rename as p,unlink as m,writeFile as d}from"node:fs/promises";import{join as a}from"node:path";function f(t){try{return process.kill(t,0),!0}catch(r){return r.code==="EPERM"}}async function b(t,r){await l(t,{recursive:!0});let s={...r,startedAt:Date.now()},e=a(t,`port-${r.pid}.json`),i=`${e}.${process.pid}.tmp`;return await d(i,JSON.stringify(s),{encoding:"utf8",mode:384}),await p(i,e),e}async function h(t,r){let s;try{s=await u(t)}catch{return null}let e=[];for(let n of s){if(!n.startsWith("port-")||!n.endsWith(".json"))continue;try{let o=JSON.parse(await c(a(t,n),"utf8"));if(Number.isFinite(o.port))if(f(o.pid))e.push(o);else m(a(t,n)).catch(()=>{})}catch{}}if(e.length===0)return null;let i=r&&r>=1?e.filter((n)=>n.pid===r):[];return(i.length>0?i:e).sort((n,o)=>o.startedAt-n.startedAt)[0]??null}
-export{b as Sc,h as Tc};
+export{b as oh,h as ph};