@cortexkit/opencode-anthropic-auth 1.23.0 → 2.0.0

package/dist/custody-dimensions.d.ts

@@ -1,36 +1,19 @@
-import { type AccountStorage, type ClaustrumCredential, type CustodyHandleManifest, type CustodyHandleResolution, type CustodyStatusState, type OAuthAccount } from '@cortexkit/anthropic-auth-core';
-type CustodyDimensionsDeps = {
-    getCache: () => {
-        peek: (handle: string) => ClaustrumCredential | undefined;
-    } | null | undefined;
-    now: () => number;
-    resolveAccountCustodyHandle: (account: OAuthAccount, storage: AccountStorage) => CustodyHandleResolution;
-    usableAccessToken: (credential: ClaustrumCredential | undefined, now: number) => string | undefined;
-    hasIdentityMismatch: (account: OAuthAccount, credential: ClaustrumCredential | undefined) => boolean;
-    isBlocked: (accountId: string) => boolean;
-    isReauth: (accountId: string) => boolean;
-    getManifest: () => CustodyHandleManifest | undefined;
-};
-export declare function fallbackCustodyDimensions(storage: AccountStorage | null, deps: Pick<CustodyDimensionsDeps, 'getCache' | 'now' | 'resolveAccountCustodyHandle' | 'usableAccessToken'> & {
-    construction?: boolean;
-}): {
-    fallbacks: "R" | "T";
-    evidence: "V" | "unknown";
-} | {
+import { type AccountStorage, type CustodyStatusState } from '@cortexkit/anthropic-auth-core';
+/** Only the enrolled scoped roster can establish vault ownership. */
+export declare function isFallbackAccountVaultServed(accountId: string, storage: AccountStorage | null): boolean;
+export declare function fallbackCustodyDimensions(storage: AccountStorage | null): {
     fallbacks: 'M';
-    evidence: "N" | "unknown";
+    evidence: 'N';
 } | {
     fallbacks: "R" | "T";
-    evidence: "N" | "V";
+    evidence: 'V';
 };
 export declare function mainCustodyDimension(auth: {
     type: string;
     access?: string;
     refresh?: string;
 }): "R" | "T" | "X";
-export declare function isFallbackAccountVaultServed(accountId: string, storage: AccountStorage | null, deps: Pick<CustodyDimensionsDeps, 'getCache' | 'now' | 'resolveAccountCustodyHandle' | 'usableAccessToken' | 'hasIdentityMismatch' | 'isBlocked'>): boolean;
 export declare function custodyStateFor(account: {
     id: string;
     role: 'main' | 'fallback';
-}, storage: AccountStorage | null, deps: CustodyDimensionsDeps, vaultServed?: boolean): CustodyStatusState;
-export {};
+}, storage: AccountStorage | null): CustodyStatusState;

package/dist/custody-mode.d.ts

@@ -1,186 +1,46 @@
-type ModeDimension = 'L' | 'C';
-type MainDimension = 'R' | 'T' | 'X';
-type FallbackDimension = 'R' | 'T' | 'M';
-type EvidenceDimension = 'V' | 'N' | 'unknown';
-type Lock = {
-    release: () => Promise<void>;
-};
-export declare const OPENCODE_MAIN_OAUTH_REFRESH_LOCK = "opencode-main-oauth-refresh";
-export declare const CUSTODY_PREFLIGHT_MIN_TTL_MS: number;
-export type CustodyCacheCredential = {
-    credentialId?: string;
-    recordVersion: number;
-    access: string;
-    refresh: string;
-    expiresAt: number | null;
-    state: 'usable' | 'revoked' | 'reauth' | 'timeout';
-};
-export type ClaustrumTakeoverPlan = {
-    accounts: Array<{
-        id: string;
-        label: string;
-        handle: string;
-        credentialId: string;
-        recordVersion: number;
-        bindingPersisted: boolean;
-        localAuthFingerprint: string;
-        cacheCredential: CustodyCacheCredential;
-    }>;
-    toJSON: () => unknown;
-    toString: () => string;
-};
-export type CustodyPreflightRefusalReason = 'TAKEOVER_INCOMPLETE_MAIN_REAL' | 'TAKEOVER_INCOMPLETE_MAIN_BINDING' | 'binding_missing' | 'credential_revoked' | 'credential_reauth' | 'credential_timeout' | 'credential_unusable' | 'credential_identity_mismatch' | 'divergence_fenced' | 'TAKEOVER_INCOMPLETE_MAIN_SLOT' | 'local_credential_unavailable';
-export type CustodyPreflightRefusal = {
-    label: string;
-    reason: CustodyPreflightRefusalReason;
-    guidance?: string;
-};
-export type MainCustodyRefusal = 'cold' | 'reauth' | 'takeover-incomplete' | 'identity-mismatch';
-export declare class CustodyPreflightRefusedError extends Error {
-    readonly accountId: string;
-    readonly reason: CustodyPreflightRefusalReason;
-    readonly refusals: CustodyPreflightRefusal[];
-    readonly code = "custody_preflight_refused";
-    constructor(accountId: string, reason: CustodyPreflightRefusalReason, refusals?: CustodyPreflightRefusal[]);
-    toJSON(): {
-        ok: boolean;
-        code: string;
-        accountId: string;
-        reason: CustodyPreflightRefusalReason;
-        refusals: CustodyPreflightRefusal[];
-    };
-}
 export declare class CustodyStateMismatchError extends Error {
     readonly verdict: string;
     readonly dimensions: {
-        mode: ModeDimension;
-        main: MainDimension;
-        fallbacks: FallbackDimension;
-        evidence: EvidenceDimension;
+        mode: 'L' | 'C';
+        main: 'R' | 'T' | 'X';
+        fallbacks: 'R' | 'T' | 'M';
+        evidence: 'V' | 'N';
     };
     readonly code = "custody_state_mismatch";
     constructor(verdict: string, dimensions: {
-        mode: ModeDimension;
-        main: MainDimension;
-        fallbacks: FallbackDimension;
-        evidence: EvidenceDimension;
+        mode: 'L' | 'C';
+        main: 'R' | 'T' | 'X';
+        fallbacks: 'R' | 'T' | 'M';
+        evidence: 'V' | 'N';
     });
     toJSON(): {
         code: string;
         verdict: string;
         dimensions: {
-            mode: ModeDimension;
-            main: MainDimension;
-            fallbacks: FallbackDimension;
-            evidence: EvidenceDimension;
+            mode: 'L' | 'C';
+            main: 'R' | 'T' | 'X';
+            fallbacks: 'R' | 'T' | 'M';
+            evidence: 'V' | 'N';
         };
     };
 }
-export declare class CustodyLockBusyError extends Error {
-    readonly lockName: string;
-    readonly code = "lock_busy";
-    constructor(lockName: string);
-}
-type PreflightRoute = {
-    id: string;
-    label?: string;
-    enabled?: boolean;
-    type: string;
-    local?: unknown;
-};
-type PreflightBinding = {
-    accountId: string;
-    label: string;
-    handle: string;
-    credentialId: string;
-    source?: 'manifest' | 'legacy';
-};
-export type PreflightClaustrumTakeoverInput = {
-    now: number;
-    storage: {
-        refresh?: {
-            refreshBeforeExpiryMinutes?: number;
-        };
-        claustrumDivergence?: Record<string, {
-            minimumRecordVersion: number;
-            observedAt?: number;
-        }>;
-    } | null;
-    main: Pick<PreflightRoute, 'id' | 'label' | 'enabled'>;
-    fallbacks: PreflightRoute[];
-    hostAuth: {
-        get: () => unknown | Promise<unknown>;
-    };
-    bindings: PreflightBinding[];
-    cache: {
-        get: (handle: string, options: {
-            minTtlMs: number;
-        }) => Promise<CustodyCacheCredential | {
-            state: string;
-            expiresAt?: number;
-        }>;
-    };
-    debug?: (message: string) => void;
-};
-export declare function preflightClaustrumTakeover(input: PreflightClaustrumTakeoverInput): Promise<ClaustrumTakeoverPlan>;
+/**
+ * Check custody independently from account availability. Modes L/C mean local
+ * and Claustrum vault. Main R/T/X means a real login, inert tombstone, or no
+ * recognized OAuth marker; fallback R/T/M means local rows, token-free vault
+ * inventory, or missing roster. Evidence V/N means verified or unavailable.
+ * Local mode still requires completed migration and local account rows. Vault
+ * mode requires enrollment authority, the host marker and a readable roster,
+ * not an active primary. Each request separately authorizes its chosen account;
+ * the marker enables the provider but cannot authenticate it. Ordinary OpenCode
+ * API-key authentication remains outside this OAuth custody check.
+ */
 export declare function reconcileCustodyStartup(input: {
-    mode: ModeDimension;
-    main: MainDimension;
-    fallbacks: FallbackDimension;
-    evidence: EvidenceDimension;
-} | {
-    mode: ModeDimension;
-    mainSlot: 'unknown';
-    fallbacks: FallbackDimension;
-    evidence: EvidenceDimension;
+    mode: 'L' | 'C';
+    main: 'R' | 'T' | 'X';
+    fallbacks: 'R' | 'T' | 'M';
+    evidence: 'V' | 'N';
+    authority?: 'committed' | 'retired';
 }): {
-    verdict: string;
-    provisional?: boolean;
-};
-export declare function acquireCustodyTransitionLocks(input: {
-    storagePath: string;
-    manifestPath: string;
-    fallbackAccountIds: string[];
-    acquireTransition: (input: {
-        name: 'claustrum-mode-transition';
-        path: string;
-    }) => Promise<Lock | null>;
-    acquireManifest: (input: {
-        path: string;
-    }) => Promise<Lock | null>;
-    acquireRefresh: (input: {
-        name: string;
-        path: string;
-    }) => Promise<Lock | null>;
-}): Promise<{
-    release: () => Promise<void>;
-}>;
-export declare class CustodyTransitionError extends Error {
-    readonly stage: 'reverify_fingerprint' | 'write_manifest' | 'write_sidecar' | 'readback' | 'mode_commit' | 'post_commit_readback';
-    readonly accountId?: string | undefined;
-    readonly guidance?: string | undefined;
-    readonly code = "custody_transition_failed";
-    constructor(stage: 'reverify_fingerprint' | 'write_manifest' | 'write_sidecar' | 'readback' | 'mode_commit' | 'post_commit_readback', accountId?: string | undefined, guidance?: string | undefined);
-    toJSON(): {
-        code: string;
-        stage: "mode_commit" | "post_commit_readback" | "readback" | "reverify_fingerprint" | "write_manifest" | "write_sidecar";
-        accountId: string | undefined;
-        guidance: string | undefined;
-    };
-}
-export type ExecuteClaustrumTakeoverDeps = {
-    locks: Parameters<typeof acquireCustodyTransitionLocks>[0];
-    getLocalAuth: (accountId: string) => Promise<unknown>;
-    isCommitted: (plan: ClaustrumTakeoverPlan) => Promise<boolean>;
-    writeManifestBindings: (plan: ClaustrumTakeoverPlan) => Promise<void>;
-    writeSidecarAccount: (account: ClaustrumTakeoverPlan['accounts'][number]) => Promise<void>;
-    verifyTarget: (plan: ClaustrumTakeoverPlan) => Promise<boolean>;
-    verifyCommitted: (plan: ClaustrumTakeoverPlan) => Promise<boolean>;
-    setMode: (mode: 'claustrum' | 'local') => Promise<'changed' | 'unchanged'>;
+    verdict: 'LOCAL_SERVE' | 'CLAUSTRUM_SERVE';
 };
-export declare function executeClaustrumTakeover(plan: ClaustrumTakeoverPlan, deps: ExecuteClaustrumTakeoverDeps): Promise<'changed' | 'unchanged'>;
-export declare function executeLocalExit(deps: {
-    path?: string;
-    setMode?: (mode: 'local') => Promise<'changed' | 'unchanged'>;
-}): Promise<"changed" | "unchanged">;
-export {};

package/dist/effort-history.d.ts

@@ -13,7 +13,9 @@ export type OpenCodeEffortMarkerPlan = {
     messageId: string;
 };
 export declare class EffortMarkerCorrelationError extends Error {
-    constructor(message: string);
+    readonly check: string;
+    readonly details: Record<string, unknown>;
+    constructor(message: string, check?: string, details?: Record<string, unknown>);
 }
 type OpenCodeMessageInfo = {
     id?: unknown;
@@ -49,6 +51,8 @@ export declare function applyOpenCodeEffortMarkers(body: Record<string, unknown>
 };
 export declare class OpenCodeEffortPlanTracker {
     private readonly plans;
+    private readonly history;
+    private readonly historyByMessage;
     record(plan: OpenCodeEffortMarkerPlan): void;
     clear(sessionId: string, messageId: string): void;
     markHeaders(input: {
@@ -57,6 +61,7 @@ export declare class OpenCodeEffortPlanTracker {
         headers: Record<string, string>;
     }): boolean;
     resolveHeader(value: string | undefined): OpenCodeEffortMarkerPlan | undefined;
+    private remember;
     private key;
 }
 export {};

package/dist/index-1jkyhgyr.js

@@ -0,0 +1,2 @@
+var z=(f)=>f!==null&&typeof f==="object"&&!Array.isArray(f),G=(f)=>z(f)&&typeof f.sessionId==="string"&&f.sessionId.length>0,Z=(f)=>{if(!G(f)||!z(f)||f.command!=="claude"||typeof f.sectionId!=="string"||typeof f.actionId!=="string")return!1;if(f.itemId!==void 0&&typeof f.itemId!=="string")return!1;if(f.confirmed!==void 0&&typeof f.confirmed!=="boolean")return!1;if(f.values!==void 0&&(!z(f.values)||!Object.values(f.values).every((q)=>q===null||typeof q==="string"||typeof q==="boolean"||typeof q==="number"&&Number.isFinite(q))))return!1;return!0};function B(f){return{"~standard":{version:1,vendor:"cortexkit-native",validate:(q)=>f(q)?{value:q}:{issues:[{message:"Invalid native menu payload"}]}}}}var W=(f)=>z(f)&&f.command==="claude"&&z(f.menu)&&f.menu.command==="claude"&&typeof f.menu.title==="string"&&Array.isArray(f.menu.sections),$=(f)=>z(f)&&f.command==="claude"&&typeof f.ok==="boolean"&&typeof f.text==="string"&&z(f.menu)&&Array.isArray(f.menu.sections),A={id:"cortexkit-anthropic-native",methods:{open:{input:B(G),output:B(W)},apply:{input:B(Z),output:B($)}},events:{opened:{schema:B((f)=>G(f)&&W(f.payload))},notification:{schema:B((f)=>G(f)&&typeof f.message==="string"&&["info","warning","error"].includes(String(f.kind)))}}};async function L(f,q,X){let K=new AbortController,H=(j)=>({sessionId:j,notify(F,J="info"){D.events.emit("notification",{sessionId:j,message:F,kind:J}).catch(()=>{})}}),D=await f.rpc.register(A,{open:(j)=>q.open(H(j.sessionId)),apply:(j)=>q.apply(j,H(j.sessionId))}),Q;try{Q=await f.command.transform((j)=>j.add({name:"claude",description:"Native Claude accounts and settings",async execute(F){let J=await q.open(H(F.sessionID));await D.events.emit("opened",{sessionId:F.sessionID,payload:J})}}))}catch(j){throw await D.dispose(),j}let Y=(async()=>{try{for await(let j of f.event.subscribe({signal:K.signal}))if(j.type==="session.deleted")X.forgetSession(j.data.sessionID)}catch{}})(),S=!1;return{async dispose(){if(S)return;S=!0,K.abort(),await Promise.all([D.dispose(),Q.dispose(),Y])}}}
+export{A as s,L as t};

package/dist/{index-8y2t4mwz.js → index-2arfb1y3.js}

@@ -1,2 +1,2 @@
 var t=["claude-account","claude-cache","claude-cachekeep","claude-prime","claude-start","claude-quota","claude-dump","claude-fast","claude-routing","claude-killswitch","claude-logging"];
-export{t as qh};
+export{t as p};

package/dist/{index-0jfsxyn9.js → index-4ya27n12.js}

@@ -1,2 +1,2 @@
 import{mkdir as l,readdir as u,readFile as c,rename as p,unlink as m,writeFile as d}from"node:fs/promises";import{join as a}from"node:path";function f(t){try{return process.kill(t,0),!0}catch(r){return r.code==="EPERM"}}async function b(t,r){await l(t,{recursive:!0});let s={...r,startedAt:Date.now()},e=a(t,`port-${r.pid}.json`),i=`${e}.${process.pid}.tmp`;return await d(i,JSON.stringify(s),{encoding:"utf8",mode:384}),await p(i,e),e}async function h(t,r){let s;try{s=await u(t)}catch{return null}let e=[];for(let n of s){if(!n.startsWith("port-")||!n.endsWith(".json"))continue;try{let o=JSON.parse(await c(a(t,n),"utf8"));if(Number.isFinite(o.port))if(f(o.pid))e.push(o);else m(a(t,n)).catch(()=>{})}catch{}}if(e.length===0)return null;let i=r&&r>=1?e.filter((n)=>n.pid===r):[];return(i.length>0?i:e).sort((n,o)=>o.startedAt-n.startedAt)[0]??null}
-export{b as oh,h as ph};
+export{b as pe,h as qe};

package/dist/index-aaajxwzd.js

@@ -0,0 +1,2 @@
+import{createRequire as q}from"node:module";var j=Object.create;var{getPrototypeOf:k,defineProperty:i,getOwnPropertyNames:l}=Object;var m=Object.prototype.hasOwnProperty;function n(a){return this[a]}var o,p,r=(a,b,d)=>{var f=a!=null&&typeof a==="object";if(f){var g=b?o??=new WeakMap:p??=new WeakMap,h=g.get(a);if(h)return h}d=a!=null?j(k(a)):{};let c=b||!a||!a.__esModule?i(d,"default",{value:a,enumerable:!0}):d;for(let e of l(a))if(!m.call(c,e))i(c,e,{get:n.bind(a,e),enumerable:!0});if(f)g.set(a,c);return c};var s=(a,b)=>()=>(b||a((b={exports:{}}).exports,b),b.exports);var u=q(import.meta.url);
+export{r as re,s as se,u as te};