@byokit/accounts 0.11.0 → 0.12.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## Unreleased
 
+## 0.12.0 (2026-09-30)
+
+
+
+- FIX: fileStore verifies optional sealing-adapter upgrades and atomically replaces authenticated ciphertext on read, allowing opt-in dual-wrap migration without losing the original store on interruption.
+- Claude Pro/Max subscription PKCE sign-in, direct Messages and single-flight refresh with on-device credentials.
+
+- Anthropic Messages with an app-passed API key (billed per use), explicit model and opt-in; typed native requests, streamed text/tools/thinking/message events, usage/raw results and the shared IncompleteError contract for max_tokens/refusal (including with tools) on every platform.
 - Expose fresh subscription access to host-side capabilities using the app’s own sign-in.
 
 ## 0.11.0 (2026-09-30)

package/NOTICE

@@ -0,0 +1,30 @@
+BYOKit accounts implements the Claude manual OAuth protocol independently, informed by:
+
+Hermes Agent, Nous Research, copyright (c) 2025 Nous Research.
+https://github.com/NousResearch/hermes-agent/tree/57a22675ef9f7761111feba9d24e5c366db3134b
+agent/anthropic_credentials.py and agent/anthropic_adapter.py.
+
+oh-my-pi, copyright (c) 2025 Mario Zechner; 2025-2026 Can Bölük; 2026 Stencil Labs.
+https://github.com/can1357/oh-my-pi/tree/2b023d1b80133c523d66412602d99b5427408395
+packages/catalog/src/compat/rules/auth/anthropic.kdl, packages/ai/src/registry/engine/refresh.ts.
+
+These references are MIT licensed. No reference project's installed credential store or CLI is used.
+The following MIT notice is retained for protocol adaptations, including constants and request construction:
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/README.md

@@ -8,8 +8,8 @@
 </p>
 
 <p align="center"><strong>Sign in with the AI plan you already pay for, inside your own app.</strong><br/>
-ChatGPT on every platform; OpenRouter on computers when an app offers it (API billing, never by default); Grok and
-GitHub Copilot hidden by default. Sign-ins go into your app's own store: on a computer (Node, Electron), in a browser
+ChatGPT and Claude Pro/Max on every platform (Claude needs Web Crypto); OpenRouter on computers when an app offers it (API billing, never by default); Grok and
+GitHub Copilot hidden by default. Anthropic uses an app-passed API key (billed per use), explicitly opted in. Sign-ins go into your app's own store: on a computer (Node, Electron), in a browser
 (a PWA, Electron's renderer) and on a phone (React Native and Expo, iOS and Android). One import; your bundler picks
 the platform's side (`package.json`'s `react-native` and `browser` conditions).</p>
 
@@ -135,6 +135,8 @@ and [`examples/pwa`](../../examples/pwa) (browser sign-in).
 | | Computer (Node, Electron main) | Browser (PWA, Electron renderer) | Phone (React Native: iOS, Android) |
 |---|---|---|---|
 | ChatGPT (subscription) | Its own page, straight back to this computer (port 1455); a code when asked or stuck | Device code | Device code |
+| Claude Pro/Max (subscription) | Provider page, paste its code back | Same PKCE flow; token endpoint CORS required | Same PKCE flow; app supplies Web Crypto |
+| Anthropic (API key, billed per use) | App passes its own key, explicitly | Same fetch-only Messages provider | Same fetch-only Messages provider |
 | OpenRouter (API billing) | Its own page, back to this computer (Pi's flow), when an app offers it (never by default) | Not yet | Not yet |
 | Grok, Copilot (hidden) | Pi's flows | No | No |
 | Where sign-ins are kept | `fileStore(path, safeStorage)`, sealing required | `browserStore(name)` (IndexedDB) | `secureStore(SecureStore, name)` (Keychain, Keystore) |
@@ -152,7 +154,7 @@ doesn't answer other web pages), so a PWA's model calls go through the app's own
 platform are shown: OpenRouter is API-billed and never offered by default. An explicit list is not platform-filtered,
 so choose from the table above. Show `billingWords(p)` next to every provider you list.
 
-Claude plan sign-in is never offered: Anthropic reserves it for its own apps.
+Anthropic Messages uses an app-passed API key (billed per use), with explicit opt-in; its authentication is separate from the Messages request.
 
 ```ts
 import { Accounts, billingWords, offered } from '@byokit/accounts';
@@ -162,7 +164,7 @@ for (const p of offered(['chatgpt', 'openrouter'])) console.log(`${p.name}: ${bi
 ```
 
 ```text
-[ 'chatgpt' ]
+[ 'chatgpt', 'claude' ]
 ChatGPT: Uses your ChatGPT plan.
 OpenRouter: Charged per use to your OpenRouter account, not a plan.
 ```
@@ -349,6 +351,10 @@ and the Linux `basic_text` backend. Other adapters must protect their keys outsi
 file and provide authenticated encryption. For a Node service, use a host-owned keystore through
 `recordStore(load, save)`, or provide an equivalent sealing adapter; the kit never discovers a key
 or invokes an OS keyring itself. Use `memoryStore()` for temporary sign-ins.
+If the adapter exposes optional `upgrade(bytes)`, a read validates the decrypted record, verifies
+that upgraded ciphertext decrypts to identical text and atomically replaces the original. This
+supports opt-in dual-wrap migration through `@byokit/secrets`; a failed replacement leaves the
+original envelope usable. Hold the host writer lock for read upgrades as well as ordinary writes.
 
 Use an app-owned directory: the immediate folder must be a real 0700 directory and credential
 files must be private regular files. Reuse one store instance for each path; a host lock is required
@@ -368,3 +374,118 @@ failures have no fallback rest. `classify` remains an alias. Pass a clock for de
 classification; the default uses `Date.now()`. It stores and logs no error text.
 
 For a capability running where the sign-in lives, `await accounts.access(member, signal)` returns fresh `{ access, accountId }` from the app’s own ChatGPT store. Keep these credentials in that process; proxy signaling or relay media for another device. This uses the same refresh and signed-out behavior as `respond`.
+
+## Anthropic Messages: API key (billed per use)
+
+This route is never a default or a subscription fallback. The app supplies the key and an explicit model.
+The kit never reads keys from environment variables, files or another tool's sign-in.
+
+```ts
+import { anthropic, AnthropicIncompleteError } from '@byokit/accounts';
+
+export async function askClaude(appKey: string, show: (text: string) => void) {
+  const claude = anthropic({ key: appKey });
+  try {
+    const answer = await claude.respond({
+      model: 'claude-opus-5-5', max_tokens: 1024,
+      system: 'Be brief.', messages: [{ role: 'user', content: 'Hello' }],
+      result: true, onText: (delta) => show(delta),
+    });
+    // answer.text, answer.output, answer.usage, answer.raw
+  } catch (error) {
+    if (error instanceof AnthropicIncompleteError) {
+      show(error.reason); // error.result carries partial text/output, usage and native raw response
+    } else throw error;
+  }
+}
+```
+
+Native `system`, `messages` (images, thinking, tool calls/results), `tools`, `tool_choice`, `thinking`,
+`max_tokens`, `stop_sequences`, `metadata`, sampling and `output_config` pass through unchanged.
+`onEvent` carries text deltas, tool JSON deltas, completed tools/content blocks, message events and an
+incomplete event for `max_tokens` or `refusal`. A stream without `message_stop` fails. With `tools` or
+`result: true`, the result carries metadata; without either, it returns text. Incomplete answers always
+throw the shared `IncompleteError` contract (the `AnthropicIncompleteError` subtype retains typed native
+metadata), including with tools or `result: true`. Call `isFunctionCall` on normalized `output` items; use native `raw.content` for the next Messages turn.
+
+The catalogue's `label` is exactly `API key (billed per use)`; show it when presenting the explicit key route.
+`billingWords` also supplies the existing plain sentence about per-use charges.
+
+An `Accounts` instance can also use this route, with `offer: ['anthropic']` and
+`accounts.respond(member, { provider: 'anthropic', key: appKey, model, max_tokens, messages, result: true })`.
+The key is used for that request, never stored by the kit; `login` does not launch a plan flow for this route.
+
+The existing `@byokit/decide` seam accepts it without a new dependency:
+
+```ts
+import { anthropic } from '@byokit/accounts';
+import { answerer } from '@byokit/decide';
+
+export function claudeBackend(appKey: string) {
+  const claude = anthropic({ key: appKey });
+  return answerer({ name: 'anthropic', leaves: true,
+    ask: (prompt, signal) => claude.respond({
+      model: 'claude-opus-5-5', max_tokens: 2048, signal,
+      messages: [{ role: 'user', content: prompt }],
+    }),
+  });
+}
+```
+
+An incomplete answer throws through this text seam, so decide abstains rather than parsing a partial answer.
+Browser apps should keep the API key in an app-owned server proxy (`base`); React Native can pass a streaming
+fetch such as Expo's. `betas` explicitly opts into native beta headers.
+
+## Claude Pro/Max subscription
+
+Anthropic's [developer guidance](https://code.claude.com/docs/en/legal-and-compliance#authentication-and-credential-use) prohibits third-party Claude.ai login without approval; BYOKit has no approval, and this route may stop working or lead to account restrictions (the separately billed API-key route is the documented alternative).
+
+Claude is available by default. Open its page, then paste the returned `code#state` into the app:
+
+```ts
+import { Accounts, memoryStore } from '@byokit/accounts';
+
+const member = 1;
+const credentials = memoryStore(); // replace with device-owned persistent storage in your app
+const accounts = new Accounts({ store: () => credentials });
+const pastedCode = 'code#state'; // collect the actual returned value from the person
+const pending = await accounts.login(member, 'claude');
+// Open pending.url in the person's browser, then collect the code from that page.
+accounts.paste(member, 'claude', pastedCode);
+await accounts.finished(member, 'claude');
+const text = await accounts.respond(member, {
+  provider: 'claude', model: 'claude-opus-5-5', max_tokens: 1024,
+  messages: [{ role: 'user', content: 'Hello' }],
+});
+```
+
+The manual HTTPS callback works without a local listener or an installed CLI. It uses PKCE (secure random verifier,
+SHA-256 challenge), independent state, strict `code#state` validation, and direct JSON exchange/refresh at
+`platform.claude.com/v1/oauth/token`. Refresh is single-flight for one store, saves an attempt before sending and commits the rotated credentials before
+returning access. An omitted replacement requires sign-in again. `ClaudePlanExpiredError` means sign in again, including after a refused or uncertain rotation or a
+failed durable save; a persisted attempt prevents replay after restart. A custom store must provide the refresh transaction seam (use
+`recordStore(load, save)`); a host lock is required for multiple processes. Local logout removes only this app's credentials; it does not promise server
+revocation. A Messages authentication refusal requests re-authentication without replaying the request or switching
+billing to an API key.
+
+Tokens belong in one device-owned `CredentialStore` per member. `keystoreStore(hostKeystore, 'member.1')` adapts
+`@byokit/secrets` without importing Node into the portable entry. Electron can pass safeStorage to `fileStore`;
+its sealed file writes atomically with mode 0600; a sealing adapter is required. Use one process per file (or a host-supplied cross-process lock).
+Phones use `secureStore` with device-only accessibility. PWA `browserStore` uses IndexedDB and Web Locks; page
+scripts can read its credentials. Tokens are never collected by a BYOKit server or logged. The default is memory-only.
+
+React Native hosts pass `claudePlan: { crypto: webCrypto }` when global Web Crypto is unavailable;
+`ClaudePlanPlatformError` reports missing secure randomness/SHA-256. Browsers require the provider token endpoint's
+CORS support; a network/CORS failure stays on-device and does not trigger a proxy. Browser User-Agent restrictions
+can affect compatibility. Tests replay protocol-shaped captures offline; no live OAuth, CORS, or current inference
+compatibility is claimed. This implementation supplies the manual-flow headers and Claude Code identity prelude,
+without relying on Pi's provider or executing an installed Claude CLI.
+
+Protocol references: [Hermes credentials at 57a22675, PKCE/exchange](https://github.com/NousResearch/hermes-agent/blob/57a22675ef9f7761111feba9d24e5c366db3134b/agent/anthropic_credentials.py#L747),
+[Hermes headers/identity](https://github.com/NousResearch/hermes-agent/blob/57a22675ef9f7761111feba9d24e5c366db3134b/agent/anthropic_adapter.py#L219),
+[oh-my-pi auth rule at 2b023d1b](https://github.com/can1357/oh-my-pi/blob/2b023d1b80133c523d66412602d99b5427408395/packages/catalog/src/compat/rules/auth/anthropic.kdl#L1),
+and [oh-my-pi refresh](https://github.com/can1357/oh-my-pi/blob/2b023d1b80133c523d66412602d99b5427408395/packages/ai/src/registry/engine/refresh.ts#L62).
+The common route follows Hermes's platform token host, three scopes and `axios/1.7.9` token User-Agent,
+with inference `claude-code/2.1.74 (external, cli)`, `x-app: cli`, bearer authorization, Messages version
+`2023-06-01` and betas `claude-code-20250219,oauth-2025-04-20`. The implementation is independent;
+[NOTICE](NOTICE) records the MIT protocol references.

package/dist/accounts.d.ts

@@ -1,4 +1,6 @@
 import type { CredentialStore, Models } from '@earendil-works/pi-ai';
+import { type ClaudePlanOptions } from './claude-plan.ts';
+import { type AnthropicAsk, type AnthropicResult, type AnthropicTool } from './anthropic.ts';
 import { type Provider } from './catalogue.ts';
 import { ResponseError, type Ask, type ResponseResult, type ResponseTool } from './responses.ts';
 import { type EndingStore, type RefreshStore } from './stores.ts';
@@ -45,8 +47,15 @@ export type Platform = {
 };
 /** Phones and browsers: ChatGPT by device code, no listener. */
 export declare const portable: Platform;
+export type ClaudePlanAsk = AnthropicAsk & {
+    provider: 'claude';
+};
+export type AnthropicAccountAsk = AnthropicAsk & {
+    provider: 'anthropic';
+    key: string;
+};
 export type AccountsOptions<M extends Member = Member> = {
-    /** The accounts this app offers, in order. Default: every provider not hidden (ChatGPT, OpenRouter). */
+    /** The accounts this app offers, in order. Default: supported subscription providers not hidden. */
     offer?: readonly string[];
     /** Each member's own store. Default: in memory. */
     store?: (member: M) => CredentialStore;
@@ -64,6 +73,10 @@ export type AccountsOptions<M extends Member = Member> = {
     authBase?: string;
     /** Where ChatGPT answers `respond`, for a stand-in in tests and demos. */
     apiBase?: string;
+    /** Anthropic Messages origin: an app-owned proxy or stand-in. */
+    anthropicBase?: string;
+    /** Claude PKCE transport and Web Crypto supplied by the app (React Native). */
+    claudePlan?: ClaudePlanOptions;
     /** The fetch `respond` asks with: one that streams on a phone (Expo's `expo/fetch`). Default: the platform's. */
     fetch?: typeof fetch;
     /** The originator header `respond` sends. Default: 'byokit'. */
@@ -80,6 +93,7 @@ export declare class Accounts<R extends AuthHost = AuthHost, M extends Member =
     private opts;
     private runtimes;
     private stores;
+    private baseStores;
     private generations;
     private signals;
     private chains;
@@ -135,6 +149,28 @@ export declare class Accounts<R extends AuthHost = AuthHost, M extends Member =
      *  ResponseError with the words to show. Without `tools` the answer is the plain text, as before: pass `input` as
      *  words or as turns (messages with `input_image`, then the `function_call` with its `function_call_output`). With
      *  `tools` it is the text with every output item, and `onEvent` sees each tool call as it lands. */
+    respond(member: M, ask: ClaudePlanAsk & {
+        result: true;
+    }): Promise<AnthropicResult>;
+    respond(member: M, ask: ClaudePlanAsk & {
+        tools: AnthropicTool[];
+    }): Promise<AnthropicResult>;
+    respond(member: M, ask: ClaudePlanAsk & {
+        tools?: undefined;
+        result?: false;
+    }): Promise<string>;
+    respond(member: M, ask: ClaudePlanAsk): Promise<string | AnthropicResult>;
+    respond(member: M, ask: AnthropicAccountAsk & {
+        result: true;
+    }): Promise<AnthropicResult>;
+    respond(member: M, ask: AnthropicAccountAsk & {
+        tools: AnthropicTool[];
+    }): Promise<AnthropicResult>;
+    respond(member: M, ask: AnthropicAccountAsk & {
+        tools?: undefined;
+        result?: false;
+    }): Promise<string>;
+    respond(member: M, ask: AnthropicAccountAsk): Promise<string | AnthropicResult>;
     respond(member: M, ask: Ask & {
         tools?: undefined;
     }): Promise<string>;

package/dist/accounts.js

@@ -1,3 +1,5 @@
+import { CLAUDE_PLAN_ID, ClaudePlanExpiredError, claudePlanMessages, withClaudePlan } from "./claude-plan.js";
+import { anthropic } from "./anthropic.js";
 import { offered, provider } from "./catalogue.js";
 import { claims, PORTABLE, portableEngine } from "./engine.js";
 import { classify, REST_MS } from "./limits.js";
@@ -5,7 +7,7 @@ import { respond, ResponseError } from "./responses.js";
 import { memoryStore, refreshCredential } from "./stores.js";
 import { callbackPage, clock, failure, say, signInError } from "./words.js";
 /** Phones and browsers: ChatGPT by device code, no listener. */
-export const portable = { engine: (c, base) => portableEngine(c, { base }), signsIn: (pi) => PORTABLE.includes(pi) };
+export const portable = { engine: (c, base) => portableEngine(c, { base }), signsIn: (pi) => pi === CLAUDE_PLAN_ID || PORTABLE.includes(pi) };
 /** The ChatGPT plan behind a sign-in, from its own token: a work plan (Business, Enterprise, Edu) follows the employer's rules. */
 export function planOf(access) {
     let c = {};
@@ -30,6 +32,7 @@ export class Accounts {
     opts;
     runtimes = new Map();
     stores = new Map();
+    baseStores = new Map();
     generations = new Map();
     signals = new WeakMap();
     chains = new Map();
@@ -59,6 +62,7 @@ export class Accounts {
         let s = this.stores.get(String(member));
         if (!s) {
             const base = (this.opts.store ?? memoryStore)(member);
+            this.baseStores.set(String(member), base);
             let chain = Promise.resolve();
             const serial = (fn) => { const result = chain.then(fn); chain = result.catch(() => { }); return result; };
             s = {
@@ -172,7 +176,7 @@ export class Accounts {
     }
     engine(member, raw) {
         const credentials = this.boundStore(member, raw);
-        return Promise.resolve(Object.assign(this.platform.engine(credentials, this.opts.authBase), {
+        return Promise.resolve(Object.assign(withClaudePlan(this.platform.engine(credentials, this.opts.authBase), credentials, this.baseStores.get(String(member)) ?? raw, { ...this.opts.claudePlan, fetch: this.opts.claudePlan?.fetch ?? this.opts.fetch }), {
             credentialStore: credentials, readCredential: (id) => credentials.read(id),
         }));
     }
@@ -252,7 +256,45 @@ export class Accounts {
         signal?.throwIfAborted();
         return { access, accountId: String(c.accountId ?? '') };
     }
-    async respond(member, ask) {
+    async respond(member, query) {
+        const ask = query;
+        if ('provider' in query && query.provider === 'claude') {
+            this.offer('claude');
+            const rt = await this.runtime(member);
+            const { provider: _provider, ...request } = query;
+            let access;
+            try {
+                access = (await rt.getAuth(CLAUDE_PLAN_ID))?.auth?.apiKey;
+            }
+            catch (e) {
+                if (e instanceof ClaudePlanExpiredError) {
+                    this.forget(member, 'claude');
+                    this.onExpired?.(member, 'claude');
+                }
+                throw e;
+            }
+            if (!access)
+                throw new ClaudePlanExpiredError();
+            try {
+                return await claudePlanMessages(access, { fetch: this.opts.fetch }).respond(request);
+            }
+            catch (e) {
+                if (e instanceof ResponseError && e.kind === 'signed_out') {
+                    await this.logout(member, 'claude').catch(() => { });
+                    this.forget(member, 'claude');
+                    this.onExpired?.(member, 'claude');
+                    throw new ClaudePlanExpiredError();
+                }
+                if (e instanceof ResponseError && e.kind)
+                    await this.failed(member, 'claude', e);
+                throw e;
+            }
+        }
+        if ('provider' in query && query.provider === 'anthropic') {
+            this.offer('anthropic');
+            const { provider: _provider, key, ...request } = query;
+            return anthropic({ key, fetch: this.opts.fetch, base: this.opts.anthropicBase }).respond(request);
+        }
         const key = 'chatgpt';
         const p = this.offer(key);
         const { access, accountId } = await this.access(member);
@@ -313,7 +355,9 @@ export class Accounts {
      *  stalls times out; nothing is kept unless the engine then sees a working sign-in; every failure ends in one plain
      *  sentence. Returns as soon as there is a page to open or a code to show (or it is over); the rest carries on by itself. */
     async login(member, key, body = {}) {
-        this.offer(key);
+        const p = this.offer(key);
+        if (p.auth === 'api-key')
+            throw new Error('Use the app-provided API key (billed per use) to ask this provider.');
         const id = `${member}:${key}`;
         const pending = this.signingOut.get(id);
         if (pending)
@@ -379,7 +423,7 @@ export class Accounts {
             },
         });
         const timer = setTimeout(() => { flow.timedOut = true; flow.abort.abort(); }, this.opts.signInMs ?? 15 * 60_000);
-        const stuck = setTimeout(() => this.toCode(flow), this.opts.redirectMs ?? 3 * 60_000);
+        const stuck = p.key === 'claude' ? undefined : setTimeout(() => this.toCode(flow), this.opts.redirectMs ?? 3 * 60_000);
         // Listen where the provider sends the browser back (the engine then finds the port taken and waits to be handed the address).
         const port = p.callbackPort && (this.opts.callbackPort ?? p.callbackPort);
         const catcher = port && body.via !== 'code' && this.platform.loopback ? await this.catchRedirect(this.platform.loopback, flow, p.name, port).catch(() => null) : undefined;

package/dist/anthropic.d.ts

@@ -0,0 +1,236 @@
+import { IncompleteError, type ResponseResult } from './responses.ts';
+export type AnthropicCacheControl = {
+    type: 'ephemeral';
+    ttl?: '5m' | '1h';
+};
+export type AnthropicText = {
+    type: 'text';
+    text: string;
+    cache_control?: AnthropicCacheControl;
+    citations?: unknown[];
+};
+export type AnthropicImage = {
+    type: 'image';
+    source: {
+        type: 'base64';
+        media_type: 'image/jpeg' | 'image/png' | 'image/gif' | 'image/webp';
+        data: string;
+    } | {
+        type: 'url';
+        url: string;
+    };
+    cache_control?: AnthropicCacheControl;
+};
+export type AnthropicToolUse = {
+    type: 'tool_use';
+    id: string;
+    name: string;
+    input: Record<string, unknown>;
+};
+export type AnthropicThinking = {
+    type: 'thinking';
+    thinking: string;
+    signature: string;
+};
+export type AnthropicContent = AnthropicText | AnthropicImage | AnthropicToolUse | AnthropicThinking | {
+    type: 'redacted_thinking';
+    data: string;
+} | {
+    type: 'tool_result';
+    tool_use_id: string;
+    content?: string | AnthropicContent[];
+    is_error?: boolean;
+    cache_control?: AnthropicCacheControl;
+} | {
+    type: string;
+    [key: string]: unknown;
+};
+export type AnthropicMessage = {
+    role: 'user' | 'assistant';
+    content: string | AnthropicContent[];
+};
+export type AnthropicTool = {
+    name: string;
+    description?: string;
+    input_schema: {
+        type: 'object';
+        properties?: Record<string, unknown>;
+        required?: string[];
+        [key: string]: unknown;
+    };
+    cache_control?: AnthropicCacheControl;
+    strict?: boolean;
+    defer_loading?: boolean;
+    input_examples?: Record<string, unknown>[];
+    allowed_callers?: string[];
+    [key: string]: unknown;
+} | {
+    type: string;
+    name: string;
+    [key: string]: unknown;
+};
+export type AnthropicToolChoice = {
+    type: 'auto' | 'any' | 'none';
+    disable_parallel_tool_use?: boolean;
+} | {
+    type: 'tool';
+    name: string;
+    disable_parallel_tool_use?: boolean;
+};
+export type AnthropicUsage = {
+    input_tokens: number;
+    output_tokens: number;
+    cache_creation_input_tokens?: number;
+    cache_read_input_tokens?: number;
+    [key: string]: unknown;
+};
+export type AnthropicResponse = {
+    id: string;
+    type: 'message';
+    role: 'assistant';
+    model: string;
+    content: AnthropicContent[];
+    stop_reason: string | null;
+    stop_sequence: string | null;
+    usage: AnthropicUsage;
+    [key: string]: unknown;
+};
+/** Native Messages options; no translation or silent selection of a billed provider/model. */
+export type AnthropicRequest = {
+    model: string;
+    max_tokens: number;
+    messages: AnthropicMessage[];
+    system?: string | AnthropicText[];
+    tools?: AnthropicTool[];
+    tool_choice?: AnthropicToolChoice;
+    thinking?: {
+        type: 'enabled';
+        budget_tokens: number;
+        display?: 'summarized' | 'omitted' | 'updates';
+    } | {
+        type: 'disabled';
+    } | {
+        type: 'adaptive';
+        display?: 'summarized' | 'omitted' | 'updates';
+    };
+    stop_sequences?: string[];
+    metadata?: {
+        user_id?: string;
+    };
+    temperature?: number;
+    top_p?: number;
+    top_k?: number;
+    service_tier?: 'auto' | 'standard_only';
+    output_config?: {
+        effort?: 'low' | 'medium' | 'high' | 'max';
+        format?: {
+            type: 'json_schema';
+            schema: Record<string, unknown>;
+        };
+        [key: string]: unknown;
+    };
+    cache_control?: AnthropicCacheControl;
+    /** Additional native options are passed through unchanged. */
+    [key: string]: unknown;
+};
+export type AnthropicResult = ResponseResult & {
+    status: 'completed' | 'incomplete';
+    incompleteReason?: string;
+    usage: AnthropicUsage;
+    raw: AnthropicResponse;
+};
+/** The shared incomplete contract, with native usage/raw retained on the partial result. */
+export declare class AnthropicIncompleteError extends IncompleteError {
+    result: AnthropicResult;
+    constructor(reason: string, result: AnthropicResult);
+}
+export type AnthropicStreamEvent = {
+    type: 'text_delta';
+    delta: string;
+} | {
+    type: 'tool_use_delta';
+    index: number;
+    id: string;
+    name: string;
+    delta: string;
+} | {
+    type: 'tool_use';
+    index: number;
+    tool: AnthropicToolUse;
+} | {
+    type: 'content_block';
+    index: number;
+    block: AnthropicContent;
+} | {
+    type: 'message_start';
+    message: AnthropicResponse;
+} | {
+    type: 'message_delta';
+    delta: Partial<AnthropicResponse>;
+    usage?: Partial<AnthropicUsage>;
+} | {
+    type: 'message_stop';
+    message: AnthropicResponse;
+} | {
+    type: 'incomplete';
+    reason: string;
+    response: AnthropicResponse;
+};
+export type AnthropicAsk = AnthropicRequest & {
+    onText?: (delta: string) => void;
+    onEvent?: (event: AnthropicStreamEvent) => void;
+    signal?: AbortSignal;
+    /** Return metadata even without tools. */
+    result?: boolean;
+};
+export type AnthropicOptions = {
+    /** API key (billed per use), passed by the app. Never loaded from env/files. */
+    key: string;
+    fetch?: typeof fetch;
+    /** An app-owned proxy or a stand-in in tests. */
+    base?: string;
+    /** Native beta headers, only when the app explicitly requests them. */
+    betas?: readonly string[];
+};
+/** Recorded Messages SSE, split at arbitrary UTF-8/chunk boundaries. Completion requires message_stop. */
+export declare function anthropicSseReader(onText?: (delta: string) => void, onEvent?: (event: AnthropicStreamEvent) => void): {
+    push(chunk: string): void;
+    result: () => AnthropicResult;
+    end(): string;
+};
+/** Explicit API-key backend. Use respond({ result: true }) for usage/raw. Incomplete answers always throw. */
+export declare function anthropic(opts: AnthropicOptions): {
+    respond: {
+        (o: AnthropicAsk & {
+            result: true;
+        }): Promise<AnthropicResult>;
+        (o: AnthropicAsk & {
+            tools: AnthropicTool[];
+        }): Promise<AnthropicResult>;
+        (o: AnthropicAsk & {
+            tools?: undefined;
+            result?: false;
+        }): Promise<string>;
+        (o: AnthropicAsk): Promise<string | AnthropicResult>;
+    };
+};
+/** Internal auth seam for the API-key and subscription routes. */
+export declare function anthropicMessages(opts: Pick<AnthropicOptions, 'fetch' | 'base' | 'betas'> & {
+    headers: Record<string, string>;
+    prepare?: (request: AnthropicRequest) => AnthropicRequest;
+    safeErrors?: boolean;
+}): {
+    respond: {
+        (o: AnthropicAsk & {
+            result: true;
+        }): Promise<AnthropicResult>;
+        (o: AnthropicAsk & {
+            tools: AnthropicTool[];
+        }): Promise<AnthropicResult>;
+        (o: AnthropicAsk & {
+            tools?: undefined;
+            result?: false;
+        }): Promise<string>;
+        (o: AnthropicAsk): Promise<string | AnthropicResult>;
+    };
+};

package/dist/anthropic.js

@@ -0,0 +1,268 @@
+// Messages over fetch alone. Authentication is explicit and separate from the request, so a future auth route can
+// supply different headers without changing messages, tools, events or results. No environment or credential reads.
+import { IncompleteError, ResponseError } from "./responses.js";
+/** The shared incomplete contract, with native usage/raw retained on the partial result. */
+export class AnthropicIncompleteError extends IncompleteError {
+    constructor(reason, result) {
+        super(reason, result);
+        this.message = 'Anthropic cut off its answer before it was complete.';
+    }
+}
+const record = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+const error = (status, value) => {
+    const e = record(value) && record(value.error) ? value.error : {};
+    const kind = status === 429 || e.type === 'rate_limit_error' ? 'rate_limit'
+        : status === 401 || status === 403 || e.type === 'authentication_error' ? 'signed_out'
+            : status >= 500 || e.type === 'overloaded_error' ? 'overloaded' : null;
+    return new ResponseError(typeof e.message === 'string' ? e.message : 'Anthropic could not answer. Try again.', kind);
+};
+/** Recorded Messages SSE, split at arbitrary UTF-8/chunk boundaries. Completion requires message_stop. */
+export function anthropicSseReader(onText, onEvent) {
+    let buffer = '', message, stopped = false, finished;
+    const blocks = new Map();
+    const fail = () => new ResponseError('Anthropic stopped before completing its answer.', 'network');
+    const notifyText = (delta) => { if (delta) {
+        onText?.(delta);
+        onEvent?.({ type: 'text_delta', delta });
+    } };
+    const event = (block) => {
+        const data = block.split('\n').filter((l) => l.startsWith('data:')).map((l) => l.slice(5).replace(/^ /, '')).join('\n');
+        if (!data)
+            return;
+        let e;
+        try {
+            e = JSON.parse(data);
+        }
+        catch {
+            throw new ResponseError("Anthropic's answer could not be read.", null);
+        }
+        if (!record(e))
+            throw fail();
+        if (e.type === 'error')
+            throw error(0, e);
+        if (stopped)
+            return;
+        if (e.type === 'message_start') {
+            if (message || !record(e.message) || !Array.isArray(e.message.content) || !record(e.message.usage))
+                throw fail();
+            message = { ...e.message, content: [...e.message.content], usage: { ...e.message.usage } };
+            onEvent?.({ type: 'message_start', message: structuredCopy(message) });
+            return;
+        }
+        if (e.type === 'ping')
+            return;
+        if (e.type === 'content_block_start') {
+            if (!message || !Number.isSafeInteger(e.index) || e.index < 0 || blocks.has(e.index) || !record(e.content_block))
+                throw fail();
+            const b = { ...e.content_block };
+            blocks.set(e.index, { block: b, json: '', stopped: false, landed: false });
+            message.content[e.index] = b;
+            if (b.type === 'text' && typeof b.text === 'string')
+                notifyText(b.text);
+        }
+        else if (e.type === 'content_block_delta') {
+            const at = blocks.get(e.index);
+            if (!at || at.stopped || !record(e.delta))
+                throw fail();
+            const d = e.delta;
+            if (d.type === 'text_delta' && typeof d.text === 'string') {
+                if (at.block.type !== 'text')
+                    throw fail();
+                at.block.text += d.text;
+                notifyText(d.text);
+            }
+            else if (d.type === 'input_json_delta' && typeof d.partial_json === 'string') {
+                if (at.block.type !== 'tool_use' && at.block.type !== 'server_tool_use')
+                    throw fail();
+                at.json += d.partial_json;
+                onEvent?.({ type: 'tool_use_delta', index: e.index, id: at.block.id, name: at.block.name, delta: d.partial_json });
+            }
+            else if (d.type === 'thinking_delta' && typeof d.thinking === 'string')
+                at.block.thinking = (at.block.thinking ?? '') + d.thinking;
+            else if (d.type === 'signature_delta' && typeof d.signature === 'string')
+                at.block.signature = (at.block.signature ?? '') + d.signature;
+            else if (d.type === 'citations_delta' && record(d.citation))
+                at.block.citations = [...(at.block.citations ?? []), d.citation];
+        }
+        else if (e.type === 'content_block_stop') {
+            const at = blocks.get(e.index);
+            if (!at || at.stopped)
+                throw fail();
+            at.stopped = true;
+            // Emit valid blocks as they land. An interrupted JSON block must wait for the stop reason: max_tokens
+            // preserves that partial call without emitting an executable tool-use event.
+            if (at.json) {
+                try {
+                    const input = JSON.parse(at.json);
+                    if (record(input))
+                        at.block.input = input;
+                    else
+                        return;
+                }
+                catch {
+                    return;
+                }
+            }
+            onEvent?.({ type: 'content_block', index: e.index, block: structuredCopy(at.block) });
+            if (at.block.type === 'tool_use') {
+                if (typeof at.block.id !== 'string' || typeof at.block.name !== 'string' || !record(at.block.input))
+                    throw fail();
+                onEvent?.({ type: 'tool_use', index: e.index, tool: structuredCopy(at.block) });
+            }
+            at.landed = true;
+        }
+        else if (e.type === 'message_delta') {
+            if (!message || !record(e.delta))
+                throw fail();
+            Object.assign(message, e.delta);
+            if (record(e.usage))
+                Object.assign(message.usage, e.usage); // cumulative, never summed
+            onEvent?.({ type: 'message_delta', delta: e.delta, ...(record(e.usage) ? { usage: e.usage } : {}) });
+        }
+        else if (e.type === 'message_stop') {
+            if (!message || !message.stop_reason || [...blocks.values()].some((b) => !b.stopped))
+                throw fail();
+            stopped = true;
+        }
+    };
+    const drain = (final) => {
+        let tail = '';
+        if (!final && buffer.endsWith('\r')) {
+            tail = '\r';
+            buffer = buffer.slice(0, -1);
+        }
+        const parts = buffer.replace(/\r\n/g, '\n').replace(/\r/g, '\n').split('\n\n');
+        buffer = (final ? '' : parts.pop()) + tail;
+        for (const part of parts)
+            event(part);
+    };
+    const result = () => {
+        if (finished) {
+            if (finished.status === 'incomplete')
+                throw new AnthropicIncompleteError(finished.incompleteReason, finished);
+            return finished;
+        }
+        drain(true);
+        if (!stopped || !message)
+            throw fail();
+        const incomplete = message.stop_reason === 'max_tokens' || message.stop_reason === 'refusal';
+        const output = [];
+        for (const [index, at] of [...blocks].sort(([a], [b]) => a - b)) {
+            if (at.json) {
+                try {
+                    const input = JSON.parse(at.json);
+                    if (!record(input))
+                        throw new Error('not an object');
+                    at.block.input = input;
+                }
+                catch {
+                    if (!incomplete)
+                        throw new ResponseError("Anthropic's tool call could not be read.", null);
+                    at.block.partial_json = at.json;
+                    delete at.block.input;
+                }
+            }
+            const b = at.block;
+            if (!at.landed)
+                onEvent?.({ type: 'content_block', index, block: b });
+            if (b.type === 'tool_use' && record(b.input)) {
+                output.push({ type: 'function_call', call_id: b.id, name: b.name, arguments: JSON.stringify(b.input) });
+                if (!incomplete && !at.landed)
+                    onEvent?.({ type: 'tool_use', index, tool: b });
+            }
+            else if (b.type === 'thinking' || b.type === 'redacted_thinking')
+                output.push({ ...b, type: 'reasoning' });
+        }
+        const text = message.content.filter((b) => b.type === 'text').map((b) => 'text' in b && typeof b.text === 'string' ? b.text : '').join('');
+        if (text)
+            output.unshift({ type: 'message', id: message.id, role: message.role, content: [{ type: 'output_text', text }] });
+        finished = { text, output, status: incomplete ? 'incomplete' : 'completed', ...(incomplete ? { incompleteReason: message.stop_reason } : {}), usage: message.usage, raw: message };
+        if (incomplete)
+            onEvent?.({ type: 'incomplete', reason: message.stop_reason, response: message });
+        onEvent?.({ type: 'message_stop', message });
+        if (incomplete)
+            throw new AnthropicIncompleteError(message.stop_reason, finished);
+        return finished;
+    };
+    return { push(chunk) { buffer += chunk; drain(false); }, result, end() { return result().text; } };
+}
+const structuredCopy = (value) => JSON.parse(JSON.stringify(value));
+/** Explicit API-key backend. Use respond({ result: true }) for usage/raw. Incomplete answers always throw. */
+export function anthropic(opts) {
+    if (!opts.key.trim())
+        throw new Error('Anthropic needs an API key (billed per use).');
+    return anthropicMessages({ ...opts, headers: { 'x-api-key': opts.key } });
+}
+/** Internal auth seam for the API-key and subscription routes. */
+export function anthropicMessages(opts) {
+    async function respond(o) {
+        try {
+            return await run(o);
+        }
+        catch (e) {
+            if (!opts.safeErrors || e instanceof AnthropicIncompleteError)
+                throw e;
+            throw new ResponseError('Claude could not answer. Try again or sign in again.', e instanceof ResponseError ? e.kind : 'network');
+        }
+    }
+    async function run(o) {
+        const { onText, onEvent, signal, result, ...request } = o;
+        if (!request.model || !Number.isSafeInteger(request.max_tokens) || request.max_tokens <= 0)
+            throw new Error('Anthropic needs a model and a positive max_tokens.');
+        const res = await (opts.fetch ?? fetch)(`${(opts.base ?? 'https://api.anthropic.com').replace(/\/$/, '')}/v1/messages`, {
+            method: 'POST', signal,
+            headers: { 'content-type': 'application/json', accept: 'text/event-stream', 'anthropic-version': '2023-06-01', ...opts.headers,
+                ...(opts.betas?.length ? { 'anthropic-beta': opts.betas.join(',') } : {}) },
+            body: JSON.stringify({ ...(opts.prepare ? opts.prepare(request) : request), stream: true }),
+        });
+        if (!res.ok) {
+            let body;
+            try {
+                body = await res.json();
+            }
+            catch { }
+            throw error(res.status, body);
+        }
+        const reader = anthropicSseReader(onText, onEvent);
+        const body = res.body;
+        if (res.headers?.get('content-type')?.includes('application/json')) {
+            let message;
+            try {
+                message = await res.json();
+            }
+            catch {
+                throw new ResponseError("Anthropic's answer could not be read.", null);
+            }
+            if (!record(message) || !Array.isArray(message.content))
+                throw new ResponseError("Anthropic's answer could not be read.", null);
+            const emit = (event) => reader.push(`data: ${JSON.stringify(event)}\n\n`);
+            emit({ type: 'message_start', message: { ...message, content: [] } });
+            for (const [index, block] of message.content.entries()) {
+                emit({ type: 'content_block_start', index, content_block: block });
+                emit({ type: 'content_block_stop', index });
+            }
+            emit({ type: 'message_delta', delta: { stop_reason: message.stop_reason, stop_sequence: message.stop_sequence }, usage: message.usage });
+            emit({ type: 'message_stop' });
+        }
+        else if (body?.getReader && typeof TextDecoder !== 'undefined') {
+            const r = body.getReader(), decoder = new TextDecoder();
+            try {
+                for (let c = await r.read(); !c.done; c = await r.read())
+                    reader.push(decoder.decode(c.value, { stream: true }));
+                reader.push(decoder.decode());
+            }
+            catch (e) {
+                await r.cancel().catch(() => { });
+                throw e;
+            }
+            finally {
+                r.releaseLock();
+            }
+        }
+        else
+            reader.push(await res.text());
+        const answer = reader.result();
+        return o.tools || result ? answer : answer.text;
+    }
+    return { respond };
+}

package/dist/catalogue.d.ts

@@ -16,6 +16,9 @@ export type Provider = {
     clientId?: string;
     revoke?: string;
     billing: Billing;
+    auth?: 'api-key' | 'oauth';
+    label?: string;
+    offer?: boolean;
     terms: Terms;
     hidden: boolean;
     why: string;

package/dist/catalogue.js

@@ -1,8 +1,7 @@
 // The AI accounts a person can bring, by the name they know, with each provider's billing and terms status as data
 // (catalogue.json, readable from Kotlin too). The kit labels; the app decides what to offer. API-billed rows are never
-// offered by default; an app names them explicitly. Claude plan sign-in is absent on purpose: Anthropic reserves it for
-// its own apps, so no app can wire it by mistake. Meta and Kimi are left out too (a competitor by the owner's choice;
-// Kimi refuses anything but coding agents).
+// offered by default; an app names them explicitly. Anthropic here is the app-passed API-key route; authentication
+// is separate from Messages, allowing additional opt-in auth routes to be implemented independently.
 import CATALOGUE from './catalogue.json' with { type: 'json' };
 export const PROVIDERS = Object.fromEntries(Object.entries(CATALOGUE).map(([key, p]) => [key, { key, ...p }]));
 export function provider(key) {
@@ -13,4 +12,4 @@ export function provider(key) {
 }
 /** What an app offers: the keys it names, in its order, or every subscription provider not hidden by default.
  *  API-billed rows are never in the default: an app offers them only by naming them. */
-export const offered = (keys) => keys ? keys.map(provider) : Object.values(PROVIDERS).filter((p) => !p.hidden && p.billing === 'subscription');
+export const offered = (keys) => keys ? keys.map(provider) : Object.values(PROVIDERS).filter((p) => !p.hidden && p.offer !== false && p.billing === 'subscription');

package/dist/catalogue.json

@@ -54,5 +54,37 @@
         "hidden": true,
         "why": "GitHub allows Copilot sign-in only in apps it has partnered with; this uses VS Code's client.",
         "source": "https://github.blog/changelog/2026-01-16-github-copilot-now-supports-opencode"
+    },
+    "anthropic": {
+        "pi": "anthropic",
+        "name": "Claude",
+        "company": "Anthropic",
+        "models": {
+            "strong": "claude-opus-5-5"
+        },
+        "billing": "api",
+        "terms": "allowed",
+        "hidden": false,
+        "auth": "api-key",
+        "label": "API key (billed per use)",
+        "offer": false,
+        "why": "The app passes an Anthropic API key explicitly. API key (billed per use), never a default or subscription fallback.",
+        "source": "https://platform.claude.com/docs/en/api/overview"
+    },
+    "claude": {
+        "pi": "byokit-claude-plan",
+        "name": "Claude",
+        "label": "Claude Pro/Max",
+        "company": "Anthropic",
+        "models": {
+            "strong": "claude-opus-5-5"
+        },
+        "clientId": "9d1c250a-e61b-44d9-88ed-5944d1962f5e",
+        "billing": "subscription",
+        "auth": "oauth",
+        "terms": "grey",
+        "hidden": false,
+        "why": "Anthropic prohibits third-party Claude.ai sign-in without approval; this route may stop working or lead to account restrictions.",
+        "source": "https://code.claude.com/docs/en/legal-and-compliance#authentication-and-credential-use"
     }
 }

package/dist/claude-plan.d.ts

@@ -0,0 +1,51 @@
+import type { CredentialStore } from '@earendil-works/pi-ai';
+import type { AuthHost } from './accounts.ts';
+export declare const CLAUDE_PLAN_ID = "byokit-claude-plan";
+export declare const CLAUDE_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+/** A refused/uncertain rotation requires a new sign-in; its old refresh token must not be tried again. */
+export declare class ClaudePlanExpiredError extends Error {
+    readonly code = "CLAUDE_PLAN_EXPIRED";
+    readonly status = 401;
+    constructor();
+}
+export declare class ClaudePlanPlatformError extends Error {
+    readonly code = "CLAUDE_PLAN_UNSUPPORTED_PLATFORM";
+    constructor();
+}
+export type ClaudePlanOptions = {
+    fetch?: typeof fetch;
+    /** Stand-ins for offline tests. Production uses the Hermes-reference endpoints directly. */
+    authorizeUrl?: string;
+    tokenUrl?: string;
+    /** On React Native, pass a Web Crypto implementation supplied by the app. */
+    crypto?: Pick<Crypto, 'getRandomValues' | 'subtle'>;
+    now?: () => number;
+};
+/** Pending state/verifier never enter persistent storage. */
+export declare function claudeAuthorization(options?: ClaudePlanOptions): Promise<{
+    url: string;
+    verifier: string;
+    state: string;
+    redirect: string;
+}>;
+export declare function claudeCode(paste: string, state: string): string;
+/** Adds only BYOKit's own Claude route; every other provider still belongs to the supplied engine. */
+export declare function withClaudePlan(engine: AuthHost, credentials: CredentialStore, lockKey: CredentialStore, options?: ClaudePlanOptions): AuthHost;
+/** Hermes's baseline native-client fingerprint. No installed CLI is consulted for its version. */
+export declare function claudePlanMessages(access: string, options?: {
+    fetch?: typeof fetch;
+}): {
+    respond: {
+        (o: import("./anthropic.ts").AnthropicAsk & {
+            result: true;
+        }): Promise<import("./anthropic.ts").AnthropicResult>;
+        (o: import("./anthropic.ts").AnthropicAsk & {
+            tools: import("./anthropic.ts").AnthropicTool[];
+        }): Promise<import("./anthropic.ts").AnthropicResult>;
+        (o: import("./anthropic.ts").AnthropicAsk & {
+            tools?: undefined;
+            result?: false;
+        }): Promise<string>;
+        (o: import("./anthropic.ts").AnthropicAsk): Promise<string | import("./anthropic.ts").AnthropicResult>;
+    };
+};

package/dist/claude-plan.js

@@ -0,0 +1,167 @@
+import { anthropicMessages } from "./anthropic.js";
+import { needsReauth, refreshCredential } from "./stores.js";
+export const CLAUDE_PLAN_ID = 'byokit-claude-plan';
+export const CLAUDE_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
+const REDIRECT = 'https://console.anthropic.com/oauth/code/callback';
+const SCOPES = 'org:create_api_key user:profile user:inference';
+/** A refused/uncertain rotation requires a new sign-in; its old refresh token must not be tried again. */
+export class ClaudePlanExpiredError extends Error {
+    code = 'CLAUDE_PLAN_EXPIRED';
+    status = 401;
+    constructor() { super('Sign in with Claude again.'); this.name = 'ClaudePlanExpiredError'; }
+}
+export class ClaudePlanPlatformError extends Error {
+    code = 'CLAUDE_PLAN_UNSUPPORTED_PLATFORM';
+    constructor() { super('Claude sign-in needs secure random bytes and SHA-256 on this device.'); this.name = 'ClaudePlanPlatformError'; }
+}
+const base64url = (bytes) => btoa(Array.from(bytes, (b) => String.fromCharCode(b)).join('')).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+/** Pending state/verifier never enter persistent storage. */
+export async function claudeAuthorization(options = {}) {
+    const crypto = options.crypto ?? globalThis.crypto;
+    if (!crypto?.getRandomValues || !crypto.subtle?.digest)
+        throw new ClaudePlanPlatformError();
+    const verifier = base64url(crypto.getRandomValues(new Uint8Array(32)));
+    const state = base64url(crypto.getRandomValues(new Uint8Array(32)));
+    const challenge = base64url(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))));
+    const url = new URL(options.authorizeUrl ?? 'https://claude.ai/oauth/authorize');
+    url.search = new URLSearchParams({ code: 'true', response_type: 'code', client_id: CLAUDE_CLIENT_ID,
+        redirect_uri: REDIRECT, scope: SCOPES, state, code_challenge: challenge, code_challenge_method: 'S256' }).toString();
+    return { url: url.toString(), verifier, state, redirect: REDIRECT };
+}
+export function claudeCode(paste, state) {
+    let code, returned;
+    if (/^https?:\/\//.test(paste)) {
+        const url = new URL(paste);
+        code = url.searchParams.get('code');
+        returned = url.searchParams.get('state');
+    }
+    else {
+        const parts = paste.trim().split('#');
+        code = parts.length === 2 ? parts[0] : null;
+        returned = parts.length === 2 ? parts[1] : null;
+    }
+    if (!code || !returned || returned !== state)
+        throw new Error('The Claude sign-in code does not match this sign-in. Try signing in again.');
+    return code;
+}
+const credential = (j, now, previous) => {
+    if (typeof j?.access_token !== 'string' || !j.access_token || typeof j.expires_in !== 'number'
+        || !Number.isFinite(j.expires_in) || j.expires_in <= 0 || !Number.isFinite(now + j.expires_in * 1000)
+        || (j.refresh_token !== undefined && (typeof j.refresh_token !== 'string' || !j.refresh_token)))
+        throw new Error('Claude could not complete the sign-in. Try signing in again.');
+    return { type: 'oauth', access: j.access_token, refresh: j.refresh_token ?? previous?.refresh ?? '', expires: now + j.expires_in * 1000 };
+};
+const states = new WeakMap();
+/** Adds only BYOKit's own Claude route; every other provider still belongs to the supplied engine. */
+export function withClaudePlan(engine, credentials, lockKey, options = {}) {
+    let shared = states.get(lockKey);
+    if (!shared)
+        states.set(lockKey, shared = { spent: new Set() });
+    const state = shared;
+    const now = options.now ?? Date.now;
+    const post = async (body, signal) => {
+        let res;
+        try {
+            res = await (options.fetch ?? fetch)(options.tokenUrl ?? 'https://platform.claude.com/v1/oauth/token', {
+                method: 'POST', signal: signal ?? AbortSignal.timeout(15_000),
+                headers: { 'content-type': 'application/json', 'user-agent': 'axios/1.7.9' }, body: JSON.stringify(body),
+            });
+        }
+        catch {
+            throw new Error('Claude could not complete the sign-in on this connection.');
+        }
+        if (!res.ok) {
+            if ([400, 401, 403].includes(res.status))
+                throw new ClaudePlanExpiredError();
+            throw new Error('Claude could not complete the sign-in. Try again later.');
+        }
+        try {
+            return await res.json();
+        }
+        catch {
+            throw new Error('Claude could not complete the sign-in. Try signing in again.');
+        }
+    };
+    const login = async ({ signal, notify, prompt }) => {
+        const pending = await claudeAuthorization(options);
+        if (signal?.aborted)
+            throw new Error('Login cancelled');
+        // Register the paste receiver before publishing the URL, so an immediate paste cannot be lost.
+        const pasted = prompt({ type: 'manual_code', message: 'Paste the code from the Claude page.', signal });
+        notify({ type: 'auth_url', url: pending.url });
+        const code = claudeCode(await pasted, pending.state);
+        if (signal?.aborted)
+            throw new Error('Login cancelled');
+        const c = credential(await post({ grant_type: 'authorization_code', client_id: CLAUDE_CLIENT_ID,
+            code, state: pending.state, redirect_uri: pending.redirect, code_verifier: pending.verifier }, signal), now());
+        if (signal?.aborted)
+            throw new Error('Login cancelled');
+        try {
+            await credentials.modify(CLAUDE_PLAN_ID, async () => c, { signal });
+        }
+        catch {
+            throw new Error('Claude sign-in could not be saved on this device. Try signing in again.');
+        }
+        if (signal?.aborted) {
+            await credentials.delete(CLAUDE_PLAN_ID);
+            throw new Error('Login cancelled');
+        }
+        return c;
+    };
+    const access = async (minOAuthValidityMs = 0) => {
+        const min = Math.max(300_000, minOAuthValidityMs);
+        const due = (c) => now() + min >= c.expires;
+        const c = await credentials.read(CLAUDE_PLAN_ID);
+        if (c?.type !== 'oauth')
+            return undefined;
+        if (state.flight)
+            return state.flight;
+        if (needsReauth(c) || state.spent.has(c.refresh))
+            throw new ClaudePlanExpiredError();
+        if (!due(c))
+            return c;
+        const work = refreshCredential(credentials, CLAUDE_PLAN_ID, due, async (current) => {
+            if (!current.refresh || state.spent.has(current.refresh))
+                throw new ClaudePlanExpiredError();
+            state.spent.add(current.refresh);
+            return credential(await post({ grant_type: 'refresh_token', client_id: CLAUDE_CLIENT_ID, refresh_token: current.refresh }), now(), current);
+        }).catch(async () => {
+            await credentials.delete(CLAUDE_PLAN_ID).catch(() => { });
+            throw new ClaudePlanExpiredError();
+        });
+        state.flight = work;
+        try {
+            const next = await work;
+            if (next)
+                state.spent.delete(next.refresh);
+            return next;
+        }
+        finally {
+            if (state.flight === work)
+                state.flight = undefined;
+        }
+    };
+    return Object.assign(engine, {
+        login: ((original) => (id, type, interaction) => id === CLAUDE_PLAN_ID ? login(interaction) : original.call(engine, id, type, interaction))(engine.login),
+        logout: ((original) => (id) => id === CLAUDE_PLAN_ID ? credentials.delete(id) : original.call(engine, id))(engine.logout),
+        checkAuth: ((original) => async (id) => id === CLAUDE_PLAN_ID
+            ? await (async () => { const c = await credentials.read(id); return c?.type === 'oauth' && !needsReauth(c) ? { source: 'OAuth', type: 'oauth' } : undefined; })()
+            : original.call(engine, id))(engine.checkAuth),
+        getAuth: ((original) => async (id, overrides) => {
+            if (id !== CLAUDE_PLAN_ID)
+                return original.call(engine, id, overrides);
+            const c = await access(overrides?.minOAuthValidityMs);
+            return c ? { auth: { apiKey: c.access }, source: 'OAuth' } : undefined;
+        })(engine.getAuth),
+    });
+}
+/** Hermes's baseline native-client fingerprint. No installed CLI is consulted for its version. */
+export function claudePlanMessages(access, options = {}) {
+    return anthropicMessages({ ...options, headers: {
+            authorization: `Bearer ${access}`, 'anthropic-beta': 'claude-code-20250219,oauth-2025-04-20',
+            'user-agent': 'claude-code/2.1.74 (external, cli)', 'x-app': 'cli', 'anthropic-dangerous-direct-browser-access': 'true',
+        }, prepare: (request) => ({ ...request, system: [
+                { type: 'text', text: "You are Claude Code, Anthropic's official CLI for Claude." },
+                ...(typeof request.system === 'string' ? [{ type: 'text', text: request.system }] : request.system ?? []),
+            ] }), safeErrors: true });
+}

package/dist/node-stores.d.ts

@@ -4,6 +4,8 @@ import { type EndingStore } from './stores.ts';
 export type SafeStorageLike = {
     encryptString(text: string): Uint8Array;
     decryptString(data: Buffer): string;
+    /** Optional authenticated format upgrade; fileStore verifies and atomically replaces it. */
+    upgrade?(data: Buffer): Uint8Array | undefined;
     isEncryptionAvailable?(): boolean;
     getSelectedStorageBackend?(): string;
 };

package/dist/node-stores.js

@@ -38,7 +38,16 @@ export function fileStore(path, safeStorage) {
             const st = fstatSync(fd);
             if (!st.isFile() || (st.mode & 0o077))
                 throw new Error('Credential storage requires a private regular file');
-            return JSON.parse(safeStorage.decryptString(readFileSync(fd)));
+            const bytes = readFileSync(fd);
+            const text = safeStorage.decryptString(bytes);
+            const data = JSON.parse(text);
+            const upgraded = safeStorage.upgrade?.(bytes);
+            if (upgraded) {
+                if (safeStorage.decryptString(Buffer.from(upgraded)) !== text)
+                    throw new Error('Credential upgrade verification failed');
+                replace(upgraded);
+            }
+            return data;
         }
         finally {
             closeSync(fd);
@@ -47,6 +56,9 @@ export function fileStore(path, safeStorage) {
     const save = async (data) => {
         ready();
         const sealed = safeStorage.encryptString(JSON.stringify(data, null, 2));
+        replace(sealed);
+    };
+    const replace = (sealed) => {
         mkdirSync(folder, { recursive: true, mode: 0o700 });
         privateFolder();
         const tmp = `${path}.${process.pid}.${randomBytes(12).toString('hex')}.tmp`;

package/dist/portable.d.ts

@@ -1,8 +1,10 @@
-export { Accounts, planOf, portable, type AccountsOptions, type AuthHost, type Loopback, type Member, type Platform, type SignIn, type Status } from './accounts.ts';
+export { Accounts, planOf, portable, type AccountsOptions, type ClaudePlanAsk, type AnthropicAccountAsk, type AuthHost, type Loopback, type Member, type Platform, type SignIn, type Status } from './accounts.ts';
 export { PROVIDERS, offered, provider, type Billing, type Provider, type Terms } from './catalogue.ts';
 export { PORTABLE, claims, credentialOf, devicePoll, deviceStart, portableEngine, type EngineOptions, type Poll } from './engine.ts';
 export { REST_MS, classify, classifyFailure, type Failure, type Kind } from './limits.ts';
 export { IncompleteError, ResponseError, isFunctionCall, limitResponse, respond, sseReader, type Ask, type ResponseFunctionCall, type ResponseInputItem, type ResponseOutputItem, type ResponseOutputMessage, type ResponseReasoning, type ResponseResult, type ResponseStreamEvent, type ResponseText, type ResponseTextFormat, type ResponseTool, type ResponseToolChoice } from './responses.ts';
-export { browserStore, memoryStore, recordStore, secureStore, RefreshRequiredError, type RefreshStore, type SecureStoreLike } from './stores.ts';
+export { browserStore, keystoreStore, memoryStore, recordStore, secureStore, RefreshRequiredError, type RefreshStore, type SecureStoreLike } from './stores.ts';
 export { WORDS, billingWords, callbackPage, clock, failure, say, signInError, type WordKey, type Why } from './words.ts';
 export { chatgptPlan, UnsupportedAccountError, type ChatGPTPlanAccount, type ChatGPTPlanSession } from './chatgpt-plan.ts';
+export { anthropic, anthropicSseReader, AnthropicIncompleteError, type AnthropicAsk, type AnthropicCacheControl, type AnthropicContent, type AnthropicImage, type AnthropicMessage, type AnthropicOptions, type AnthropicRequest, type AnthropicResponse, type AnthropicResult, type AnthropicStreamEvent, type AnthropicText, type AnthropicThinking, type AnthropicTool, type AnthropicToolChoice, type AnthropicToolUse, type AnthropicUsage } from './anthropic.ts';
+export { ClaudePlanExpiredError, ClaudePlanPlatformError, claudeAuthorization, claudeCode, type ClaudePlanOptions } from './claude-plan.ts';

package/dist/portable.js

@@ -5,6 +5,8 @@ export { PROVIDERS, offered, provider } from "./catalogue.js";
 export { PORTABLE, claims, credentialOf, devicePoll, deviceStart, portableEngine } from "./engine.js";
 export { REST_MS, classify, classifyFailure } from "./limits.js";
 export { IncompleteError, ResponseError, isFunctionCall, limitResponse, respond, sseReader } from "./responses.js";
-export { browserStore, memoryStore, recordStore, secureStore, RefreshRequiredError } from "./stores.js";
+export { browserStore, keystoreStore, memoryStore, recordStore, secureStore, RefreshRequiredError } from "./stores.js";
 export { WORDS, billingWords, callbackPage, clock, failure, say, signInError } from "./words.js";
 export { chatgptPlan, UnsupportedAccountError } from "./chatgpt-plan.js";
+export { anthropic, anthropicSseReader, AnthropicIncompleteError } from "./anthropic.js";
+export { ClaudePlanExpiredError, ClaudePlanPlatformError, claudeAuthorization, claudeCode } from "./claude-plan.js";

package/dist/stores.d.ts

@@ -39,3 +39,8 @@ export declare function secureStore(secure: SecureStoreLike, name: string, optio
 /** One person's sign-ins in the browser's IndexedDB (a PWA, or Electron's renderer), under `name`. A browser has no
  *  keychain: anything running on this page could read them, so keep the page free of scripts you don't control. */
 export declare function browserStore(name: string, db?: string): EndingStore;
+/** A device-owned @byokit/secrets backend, supplied by the host; no runtime Node import. One store per member/name. */
+export declare function keystoreStore(keystore: {
+    get(name: string): Promise<string | null>;
+    set(name: string, secret: string): Promise<void>;
+}, name: string): CredentialStore;

package/dist/stores.js

@@ -164,3 +164,7 @@ export function browserStore(name, db = 'byokit') {
         end: (id, fn) => locked(() => store.end(id, fn)),
     };
 }
+/** A device-owned @byokit/secrets backend, supplied by the host; no runtime Node import. One store per member/name. */
+export function keystoreStore(keystore, name) {
+    return recordStore(async () => JSON.parse(await keystore.get(name) ?? '{}'), async (data) => keystore.set(name, JSON.stringify(data)));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byokit/accounts",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Sign in with the AI plan you already pay for, into your app's own store.",
   "license": "Apache-2.0",
   "type": "module",
@@ -41,7 +41,8 @@
   "files": [
     "dist",
     "CHANGELOG.md",
-    "SECURITY.md"
+    "SECURITY.md",
+    "NOTICE"
   ],
   "scripts": {
     "prepack": "tsc -b && node ../../scripts/fix-words-dts.cjs"