@caeliq/llms 1.0.58 → 1.0.59

package/dist/routing/inbound-pipeline.d.ts

@@ -0,0 +1,31 @@
+import { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
+import { Transformer } from "../types/transformer";
+import { UnifiedChatRequest } from "../types/llm";
+import { ClientProtocolContext, ProtocolRouteMatch } from "./protocol-endpoints";
+export interface PreparedInboundRequest {
+    match: ProtocolRouteMatch;
+    protocolContext: ClientProtocolContext;
+    /** Original client wire body (preserved for Anthropic custom routers). */
+    originalBody: any;
+    /**
+     * Client wire body after protocol adaptation and CCR-only cleanup
+     * (subagent tag stripped, REWRITE_SYSTEM_PROMPT applied). This — not
+     * originalBody — is what an exact-wire passthrough must send upstream.
+     */
+    clientWireBody: any;
+    /** Normalized Unified body used for routing and provider conversion. */
+    unifiedBody: UnifiedChatRequest;
+    providerName: string;
+    modelName: string;
+}
+/**
+ * Stages 1–7 of the canonical inbound lifecycle:
+ * detect → adapt → normalize → route → validate destination.
+ */
+export declare function prepareInboundRequest(req: FastifyRequest, reply: FastifyReply, fastify: FastifyInstance, endpointTransformer: Transformer, routePath: string): Promise<PreparedInboundRequest>;
+export declare function resolveDestination(model: string | undefined, protocol?: ClientProtocolContext["protocol"]): {
+    providerName: string;
+    modelName: string;
+};
+export declare function throwProtocolError(protocol: ClientProtocolContext["protocol"] | undefined, message: string, statusCode: number, code: string, type?: string): never;
+export declare function protocolAwareBypass(provider: any, transformer: Transformer, protocolContext: ClientProtocolContext | undefined, modelName: string | undefined): boolean;

package/dist/routing/protocol-adapter.d.ts

@@ -0,0 +1,37 @@
+import type { UnifiedChatRequest } from "../types/llm";
+import type { Transformer } from "../types/transformer";
+import { ClientProtocolContext, ProtocolRouteMatch } from "./protocol-endpoints";
+export interface ProtocolAdaptResult {
+    /** Cloned client body used as normalization input (never the live req.body). */
+    normalizationInput: any;
+    context: ClientProtocolContext;
+}
+/**
+ * Adapt path/query fields into a cloned normalization input and build the
+ * initial ClientProtocolContext. Does not mutate the caller's body object.
+ */
+export declare function adaptClientRequest(match: ProtocolRouteMatch, rawBody: any, _query?: Record<string, unknown>): ProtocolAdaptResult;
+/**
+ * Normalize client wire → Unified once via the endpoint transformer's
+ * transformRequestOut when present. Chat Completions bodies are already
+ * Unified-shaped; until Phase 2/3 add full converters, fall back to a
+ * lightweight projection sufficient for routing.
+ */
+export declare function normalizeClientToUnified(protocol: ClientProtocolContext["protocol"], normalizationInput: any, endpointTransformer: Transformer, context: any): Promise<UnifiedChatRequest>;
+/**
+ * Provider transformers are allowed to mutate their input. Every primary and
+ * fallback attempt therefore needs an independent copy of the normalized body.
+ */
+export declare function cloneProtocolBody<T>(value: T): T;
+/**
+ * Preserve only known protocol/version and SDK metadata headers for exact-wire
+ * passthrough. An allowlist prevents an arbitrary client header from becoming
+ * an upstream credential or tenant-routing secret. Provider authentication is
+ * generated independently.
+ */
+export declare function sanitizePassthroughHeaders(headers: Headers | Record<string, unknown> | undefined): Record<string, string>;
+/**
+ * Protocol-aware passthrough: only bypass when the provider speaks the same
+ * client protocol (matching transformer name) and the request is same-protocol.
+ */
+export declare function shouldBypassTransformersProtocolAware(provider: any, endpointTransformer: Transformer, protocol: ClientProtocolContext["protocol"], bodyModel: string | undefined): boolean;

package/dist/routing/protocol-endpoints.d.ts

@@ -0,0 +1,77 @@
+import type { RouterScenarioType } from "../utils/router";
+/**
+ * Inbound client protocols supported by CCR's gateway lifecycle.
+ */
+export type ClientProtocol = "anthropic_messages" | "openai_chat_completions" | "openai_responses";
+export interface AnthropicSourceRequestFields {
+    metadata?: Record<string, unknown>;
+    thinking?: Record<string, unknown>;
+    outputConfig?: Record<string, unknown>;
+    stopSequences?: string[];
+}
+export interface ClientProtocolContext {
+    protocol: ClientProtocol;
+    pathname: string;
+    /** Canonical Fastify route path (without preset prefix), e.g. /v1/responses */
+    canonicalPath: string;
+    /** Alias path that matched, if different from canonical */
+    matchedPath: string;
+    originalModel?: string;
+    stream: boolean;
+    scenarioType?: RouterScenarioType;
+    /** Source-only Anthropic semantics retained before destination routing. */
+    anthropicSource?: AnthropicSourceRequestFields;
+    /** Keep explicit source cache directives or add provider-native automatic caching. */
+    anthropicCacheMode?: "preserve" | "automatic";
+    /** Claude Code routing metadata extracted without mutating the source billing block. */
+    claudeCodeSubagent?: boolean;
+    taggedSubagentModel?: string;
+    /** Transformer that owns this client protocol */
+    ownerTransformerName: string;
+}
+export interface ProtocolRouteMatch {
+    protocol: ClientProtocol;
+    canonicalPath: string;
+    matchedPath: string;
+    ownerTransformerName: string;
+    /** True when matchedPath is an alias of canonicalPath */
+    isAlias: boolean;
+    stream: boolean;
+    /** Preset namespace prefix without trailing slash, e.g. /preset/foo */
+    presetPrefix?: string;
+}
+interface ProtocolRouteSpec {
+    protocol: ClientProtocol;
+    canonicalPath: string;
+    aliases: string[];
+    ownerTransformerName: string;
+    /** Default stream intent when not encoded in the path */
+    defaultStream?: boolean;
+}
+/**
+ * Client-facing route table. Aliases are first-class; registration must not
+ * rely on transformer endPoint first-wins.
+ */
+export declare const PROTOCOL_ROUTE_SPECS: ProtocolRouteSpec[];
+/**
+ * Match a client LLM POST path to a protocol. Works with preset prefixes,
+ * trailing-slash normalization, and query stripping.
+ */
+export declare function matchClientProtocol(method: string, pathnameOrUrl: string): ProtocolRouteMatch | null;
+/** True when method+path is an in-scope routed LLM POST. */
+export declare function isRoutedLlmPost(method: string, pathnameOrUrl: string): boolean;
+/** All Fastify paths that should be registered for a protocol (canonical + aliases). */
+export declare function getRegisteredPathsForProtocol(protocol: ClientProtocol): string[];
+/** Flat list of registered client routes and their owner transformers. */
+export declare function listClientRouteRegistrations(): Array<{
+    path: string;
+    protocol: ClientProtocol;
+    ownerTransformerName: string;
+    isCanonical: boolean;
+}>;
+export declare function createClientProtocolContext(match: ProtocolRouteMatch, options?: {
+    originalModel?: string;
+    stream?: boolean;
+    scenarioType?: RouterScenarioType;
+}): ClientProtocolContext;
+export {};

package/dist/routing/protocol-errors.d.ts

@@ -0,0 +1,10 @@
+import type { ClientProtocol } from "./protocol-endpoints";
+export interface ProtocolErrorBody {
+    statusCode: number;
+    body: Record<string, unknown>;
+}
+/**
+ * Build a client-protocol-shaped error envelope for pre-provider failures
+ * (auth, validation, missing Router.default, etc.).
+ */
+export declare function protocolErrorBody(protocol: ClientProtocol | undefined, message: string, statusCode: number, code: string, type?: string): ProtocolErrorBody;

package/dist/server.d.ts

@@ -56,5 +56,7 @@ export { TokenizerService } from "./services/tokenizer";
 export { pluginManager, tokenSpeedPlugin, getTokenSpeedStats, getGlobalTokenSpeedStats, CCRPlugin, CCRPluginOptions, PluginMetadata } from "./plugins";
 export { SSEParserTransform, SSESerializerTransform, rewriteStream } from "./utils/sse";
 export { isClientAbortError } from "./utils/retry";
-export { sanitizeHeadersForLog, diffHeadersForLog, } from "./utils/redact";
+export { sanitizeHeadersForLog, diffHeadersForLog, sanitizeBodyForLog, DEFAULT_LOG_BODY_MAX_BYTES, } from "./utils/redact";
 export { exchangeAuthorizationCode, fetchUserEmail, resolveProjectId, saveTokens, loadTokens, getValidAccessToken, ANTIGRAVITY_CLIENT_ID, ANTIGRAVITY_CLIENT_SECRET, ANTIGRAVITY_REDIRECT_URI, ANTIGRAVITY_SCOPES, type AntigravityTokens, } from "./utils/antigravity-auth";
+export { matchClientProtocol, isRoutedLlmPost, listClientRouteRegistrations, type ClientProtocol, type ClientProtocolContext, type ProtocolRouteMatch, } from "./routing/protocol-endpoints";
+export { protocolErrorBody } from "./routing/protocol-errors";

package/dist/services/provider.d.ts

@@ -17,7 +17,7 @@ export declare class ProviderService {
     getProvider(name: string): LLMProvider | undefined;
     updateProvider(id: string, updates: Partial<LLMProvider>): LLMProvider | null;
     deleteProvider(id: string): boolean;
-    toggleProvider(name: string, enabled: boolean): boolean;
+    toggleProvider(name: string, _enabled: boolean): boolean;
     resolveModelRoute(modelName: string): RequestRouteInfo | null;
     getAvailableModelNames(): string[];
     getModelRoutes(): ModelRoute[];

package/dist/tests/anthropic.provider-wire.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/claude-auth.identity.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/client-abort-classification.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/inbound-protocol-routes.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/inbound-routing-pipeline.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/openai.inbound-chat.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/openai.inbound-responses.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/protocol-endpoints.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/redact.body-for-log.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/responses.call-id-sanitize.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/responses.parallel-and-failure.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/router-scenario-precedence.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/system-instructions-fold.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/upstream-error-semantics.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/transformer/anthropic.transformer.d.ts

@@ -7,7 +7,20 @@ export declare class AnthropicTransformer implements Transformer {
     private useBearer;
     logger?: any;
     constructor(options?: TransformerOptions | undefined);
-    auth(request: any, provider: LLMProvider, _context?: any): Promise<any>;
+    auth(request: any, provider: LLMProvider, context?: TransformerContext): Promise<any>;
+    /**
+     * Provider-side: Unified → Anthropic Messages wire.
+     * Enables cross-protocol clients (Chat/Responses) to reach Anthropic-shaped
+     * upstreams. Same-protocol Anthropic clients still use transformRequestOut
+     * for client→Unified and may bypass via protocol-aware passthrough.
+     */
+    transformRequestIn(request: UnifiedChatRequest, provider: LLMProvider, _context?: TransformerContext): Promise<Record<string, any>>;
+    /**
+     * Provider-side: Anthropic Messages wire → Unified (Chat Completions shape).
+     * Reuses the Vertex Claude Anthropic→Unified converter so streaming and JSON
+     * envelopes match existing Anthropic upstream behavior.
+     */
+    transformResponseOut(response: Response, _context?: TransformerContext): Promise<Response>;
     transformRequestOut(request: Record<string, any>, context?: TransformerContext): Promise<UnifiedChatRequest>;
     transformResponseIn(response: Response, context?: TransformerContext): Promise<Response>;
     /**
@@ -15,7 +28,7 @@ export declare class AnthropicTransformer implements Transformer {
      * Used by claude-auth.transformRequestIn() to reconstruct the body before
      * sending to Anthropic, preserving all original parameters.
      */
-    static buildAnthropicBody(request: UnifiedChatRequest, logger?: any): Record<string, any>;
+    static buildAnthropicBody(request: UnifiedChatRequest, logger?: any, context?: TransformerContext): Record<string, any>;
     private convertAnthropicToolsToUnified;
     private convertOpenAIStreamToAnthropic;
     private convertOpenAIResponseToAnthropic;

package/dist/transformer/claude-auth.transformer.d.ts

@@ -1,25 +1,57 @@
 import { UnifiedChatRequest } from "../types/llm";
 import { Transformer, TransformerContext } from "../types/transformer";
+import { ClaudeModelCatalogEntry } from "../utils/claude-model-catalog";
 /** Anthropic beta required for Claude subscription / Claude Code OAuth Bearer auth. */
 export declare const CLAUDE_OAUTH_REQUIRED_BETA = "oauth-2025-04-20";
 export declare function mergeAnthropicBetaValues(...values: Array<string | undefined | null>): string;
 /** Read a named header value from a Fastify/Node headers object (case-insensitive). */
 export declare function readHeaderValue(headers: Record<string, unknown> | undefined, name: string): string | undefined;
+/** True when the client's User-Agent identifies it as the genuine Claude Code CLI. */
+export declare function isClaudeCodeClient(userAgent: string | undefined): boolean;
 /**
  * Build outbound anthropic-beta for Claude subscription OAuth.
  *
  * - If the client sent anthropic-beta (e.g. Claude Code), merge with
  *   oauth-2025-04-20 (deduped, case-insensitive).
- * - Otherwise, send only oauth-2025-04-20. Do not synthesise Claude Code
- *   betas — Anthropic validates the attestation on claude-code-20250219
- *   and subscription OAuth works without it for non-Claude-Code clients.
+ * - Otherwise, send only oauth-2025-04-20.
  */
 export declare function resolveClaudeAuthAnthropicBeta(input: {
     clientBeta?: string;
 }): string;
+/**
+ * Build outbound anthropic-beta for the non-Claude-Code (full synthesis)
+ * branch, mirroring Claude Code's own model-driven beta selection. Never
+ * derived from model-name prefix matching — always from the capability
+ * catalog. `ANTHROPIC_BETA_FLAGS` replaces the list wholesale.
+ */
+export declare function resolveClaudeAuthBetas(modelId: string | undefined, opts?: {
+    envBeta?: string;
+}): string;
+/**
+ * Reshape a built Anthropic body's `thinking`/`output_config`/`max_tokens`
+ * to what the resolved model actually supports, replacing a hand-rolled
+ * per-model denylist with a single catalog-driven pass. Operates on the
+ * post-build Anthropic body (not the Unified request) because
+ * `buildAnthropicBody` may synthesize `thinking`/`output_config` itself.
+ */
+export declare function applyClaudeModelCapabilityAdjustments(anthropicBody: Record<string, any>, entry: ClaudeModelCatalogEntry | undefined): void;
+/** Test-only reset hook so session-id state doesn't leak across test cases. */
+export declare function __resetClaudeAuthTransformerStateForTests(): void;
 export declare class ClaudeAuthTransformer implements Transformer {
     name: string;
     logger?: any;
     transformRequestIn(request: UnifiedChatRequest, provider: any, context?: TransformerContext): Promise<Record<string, any>>;
-    transformResponseOut(response: Response): Promise<Response>;
+    /**
+     * Body/URL/wire-format conversion belong to AnthropicTransformer's
+     * provider pair, which already ran (response-side order is reversed, so
+     * it runs before this stage). This stage only inspects the resulting
+     * response for subscription-specific overage observability.
+     */
+    transformResponseOut(response: Response, context?: TransformerContext): Promise<Response>;
+    /**
+     * 401 recovery: reload the token file in case another process (e.g. a
+     * concurrent `ccr claude-auth` re-login) rotated it externally, otherwise
+     * refresh and persist. Never falls through to an unauthenticated request.
+     */
+    private recoverUnauthorizedAuth;
 }

package/dist/transformer/openai.responses.transformer.d.ts

@@ -1,11 +1,27 @@
 import { UnifiedChatRequest } from "../types/llm";
-import { Transformer } from "../types/transformer";
+import { Transformer, TransformerContext } from "../types/transformer";
 export declare class OpenAIResponsesTransformer implements Transformer {
     logger?: any;
     name: string;
     endPoint: string;
+    /**
+     * Client → Unified: validate Responses MVP and project to Chat Completions shape.
+     * Call-id mapping is stored on the transformer context for the response path.
+     */
+    transformRequestOut(request: any, context?: TransformerContext): Promise<UnifiedChatRequest>;
+    /**
+     * Unified → client Responses: JSON object or SSE lifecycle with mandatory
+     * content_part events (Codex requires these or streamed text is discarded).
+     */
+    transformResponseIn(response: Response, context?: TransformerContext): Promise<Response>;
+    private convertUnifiedStreamToResponses;
     transformRequestIn(request: UnifiedChatRequest, provider?: any, context?: any): Promise<UnifiedChatRequest>;
     transformResponseOut(response: Response): Promise<Response>;
+    /**
+     * Convert one Responses stream event to a Chat chunk. `choices[0].index` is
+     * always 0 — parallel-call identity lives in `delta.tool_calls[n].index`,
+     * allocated per Responses item by `toolIndexFor`.
+     */
     private convertStreamEvent;
     private normalizeRequestContent;
     private convertResponseToChat;

package/dist/transformer/openai.transformer.d.ts

@@ -1,39 +1,12 @@
-import { Transformer } from "../types/transformer";
+import { Transformer, TransformerContext } from "../types/transformer";
 import { UnifiedChatRequest } from "../types/llm";
 /**
  * Server-side route handler for the OpenAI Chat Completions API.
  *
- * ## How endPoint works
- *
- * At startup, `registerApiRoutes` (see `api/routes.ts`) scans all registered
- * transformers for ones that define `endPoint`. For each, it registers a
- * `POST` route at that path. When a request hits the route,
- * `handleTransformerEndpoint` is invoked with the matching transformer as
- * the "endpoint transformer" — the one responsible for converting between
- * the external wire format and the internal Unified format.
- *
- * ## Request handling
- *
- * The Unified format IS the OpenAI Chat Completions format. The conversion
- * from Anthropic → Unified already happened in
- * `AnthropicTransformer.transformRequestOut()` (which runs first in the
- * pipeline). So by the time the provider chain executes, the body is already
- * in the right shape — no further conversion is needed.
- *
- * `transformRequestIn` also translates Claude Code cache intent to the
- * selected provider's native Chat Completions behavior. The provider identity
- * is checked before adding request-level fields so OpenAI-compatible services
- * do not receive OpenAI-only parameters.
- *
- * ## Relationship to OpenAIResponsesTransformer
- *
- * `OpenAIResponsesTransformer` (in `openai.responses.transformer.ts`) is the
- * counterpart for the Responses API (`/v1/responses`). Unlike this
- * transformer, it defines `transformRequestIn` / `transformResponseOut`
- * because the Responses API uses a different wire format (e.g. `messages`
- * → `input`, function tools → flat tool definitions). It also uses the
- * shared utilities in `openai.util.ts` (`validateOpenAIToolCalls`,
- * `injectPromptCaching`) to sanitize the Unified body before converting it.
+ * The Unified format IS the OpenAI Chat Completions format. Client inbound
+ * normalization validates the MVP subset and passes through already-correct
+ * Chat bodies. Provider-side transformRequestIn applies cache policy for
+ * OpenAI-compatible upstreams.
  *
  * ## Full request pipeline (for context)
  *
@@ -44,9 +17,30 @@ import { UnifiedChatRequest } from "../types/llm";
  *       → provider.transformer.use[].transformResponseOut() // provider middleware (reversed)
  *       → AnthropicTransformer.transformResponseIn()        // Unified (OpenAI) → Anthropic
  *       → Client
+ *
+ * For inbound Chat Completions clients:
+ *
+ *     Client → POST /v1/chat/completions
+ *       → OpenAITransformer.transformRequestOut()           // validate → Unified
+ *       → provider.transformer.use[].transformRequestIn()
+ *       → … → OpenAITransformer.transformResponseIn()       // identity / light normalize
  */
 export declare class OpenAITransformer implements Transformer {
     name: string;
     endPoint: string;
+    /**
+     * Client → Unified: validate the Chat Completions MVP subset.
+     * Unified is already Chat-shaped, so this is validation + light normalization.
+     */
+    transformRequestOut(request: any, _context?: TransformerContext): Promise<UnifiedChatRequest>;
+    /**
+     * Provider-side: apply OpenAI-native cache policy to a Unified Chat body.
+     */
     transformRequestIn(request: UnifiedChatRequest, provider: any, context: any): Promise<UnifiedChatRequest>;
+    /**
+     * Unified → client Chat Completions: pass through already-correct Chat JSON/SSE.
+     * Ensures Content-Type and that streaming responses terminate with [DONE] when
+     * the upstream already speaks Chat Completions.
+     */
+    transformResponseIn(response: Response, _context?: TransformerContext): Promise<Response>;
 }

package/dist/transformer/tooluse.transformer.d.ts

@@ -2,6 +2,6 @@ import { UnifiedChatRequest } from "../types/llm";
 import { Transformer } from "../types/transformer";
 export declare class TooluseTransformer implements Transformer {
     name: string;
-    transformRequestIn(request: UnifiedChatRequest, provider?: any, context?: any): Promise<any>;
+    transformRequestIn(request: UnifiedChatRequest, _provider?: any, _context?: any): Promise<any>;
     transformResponseOut(response: Response): Promise<Response>;
 }

package/dist/transformer/vercel.transformer.d.ts

@@ -6,6 +6,6 @@ export declare class VercelTransformer implements Transformer {
     logger?: any;
     endPoint: string;
     constructor(options?: TransformerOptions | undefined);
-    transformRequestIn(request: UnifiedChatRequest, provider?: any, context?: any): Promise<UnifiedChatRequest>;
+    transformRequestIn(request: UnifiedChatRequest, _provider?: any, _context?: any): Promise<UnifiedChatRequest>;
     transformResponseOut(response: Response): Promise<Response>;
 }

package/dist/transformer/vertex-claude.transformer.d.ts

@@ -3,7 +3,7 @@ import { Transformer } from "../types/transformer";
 export declare class VertexClaudeTransformer implements Transformer {
     logger?: any;
     name: string;
-    transformRequestIn(request: UnifiedChatRequest, provider: LLMProvider): Promise<Record<string, any>>;
+    transformRequestIn(request: UnifiedChatRequest, _provider: LLMProvider): Promise<Record<string, any>>;
     transformRequestOut(request: Record<string, any>): Promise<UnifiedChatRequest>;
     transformResponseOut(response: Response): Promise<Response>;
 }

package/dist/transformer/vertex-gemini.transformer.d.ts

@@ -6,7 +6,7 @@ export declare class VertexGeminiTransformer implements Transformer {
     name: string;
     private readonly thoughtSignatureFallback;
     constructor(options?: TransformerOptions);
-    transformRequestIn(request: UnifiedChatRequest, provider: LLMProvider, context?: any): Promise<Record<string, any>>;
+    transformRequestIn(request: UnifiedChatRequest, provider: LLMProvider, _context?: any): Promise<Record<string, any>>;
     transformRequestOut(request: Record<string, any>): Promise<UnifiedChatRequest>;
     transformResponseOut(response: Response, context?: TransformerContext): Promise<Response>;
 }

package/dist/types/transformer.d.ts

@@ -14,6 +14,15 @@ export interface TransformerContext {
     signal?: AbortSignal;
     /** Protocol semantics that must not be serialized into the provider body. */
     unifiedRequest?: UnifiedRequestRuntime;
+    /**
+     * Set by claude-auth's transformRequestIn (non-Claude-Code branch) so that
+     * AnthropicTransformer.transformRequestIn — which owns building the wire
+     * body — can apply claude-auth's catalog-driven capability clamping and
+     * synthesized user_id metadata immediately after building it. Keeps model
+     * capability/identity-synthesis policy owned by claude-auth while
+     * AnthropicTransformer remains the sole body-shape/timing owner.
+     */
+    claudeAuthPostBuildHook?: (anthropicBody: Record<string, any>) => void;
     [key: string]: any;
 }
 export type Transformer = {

package/dist/utils/claude-auth.d.ts

@@ -1,4 +1,5 @@
-declare const CLAUDE_AUTH_FILE: string;
+declare function getClaudeAuthFilePath(): string;
+declare function getClaudeDeviceFilePath(): string;
 declare const OAUTH_CONFIG: {
     client_id: string;
     authorization_endpoint: string;
@@ -19,4 +20,10 @@ export declare function saveTokens(tokens: ClaudeTokens): void;
 export declare function isTokenExpired(tokens: ClaudeTokens, leewaySeconds?: number): boolean;
 export declare function refreshTokens(refreshToken: string): Promise<ClaudeTokens>;
 export declare function getValidAccessToken(): Promise<ClaudeTokens>;
-export { OAUTH_CONFIG, CLAUDE_AUTH_FILE };
+/**
+ * Load the persisted synthesized-client device id, minting and persisting a
+ * fresh 64-hex value on first use. Stored alongside the OAuth token file
+ * (mode 0600) but kept separate from it — it is not a credential.
+ */
+export declare function loadOrCreateDeviceId(): string;
+export { OAUTH_CONFIG, getClaudeAuthFilePath, getClaudeDeviceFilePath };

package/dist/utils/claude-billing.d.ts

@@ -0,0 +1,58 @@
+import { TextContent, UnifiedChatRequest, UnifiedMessage } from "../types/llm";
+/** Salt used in Claude Code's `cc_version` suffix hash (`RYn()`). */
+export declare const BILLING_SALT = "59cf53e54c78";
+export declare const CC_VERSION: string;
+export declare const CC_ENTRYPOINT: string;
+export declare const SYSTEM_IDENTITY = "You are Claude Code, Anthropic's official CLI for Claude.";
+export declare function extractFirstUserMessageText(messages: UnifiedMessage[] | undefined): string;
+export declare function computeVersionSuffix(text: string, version: string): string;
+/** 5 lowercase hex chars, cached per process — not a content hash. */
+export declare function sessionCch(): string;
+export declare function __resetClaudeBillingStateForTests(): void;
+export declare function buildClaudeBillingHeaderValue(messages: UnifiedMessage[] | undefined, version?: string, entrypoint?: string): string;
+/**
+ * Normalize `request.system` to an array as a complete ordered fold:
+ * top-level `request.system` blocks first, then every `role:"system"` /
+ * `role:"developer"` message's text blocks in source order. Consumed messages
+ * are removed from `request.messages` so no downstream builder can drop or
+ * double-emit them. Block-level `cache_control` is preserved.
+ */
+export declare function normalizeSystemToArray(request: UnifiedChatRequest): TextContent[];
+/** Drop any existing billing entry (dedupe) and prepend a fresh one at system[0]. */
+export declare function applyClaudeBillingSystemBlock(system: TextContent[], messages: UnifiedMessage[] | undefined): void;
+/**
+ * Insert SYSTEM_IDENTITY as its own entry at system[1]. Any remaining
+ * caller system content is left in place here — relocateForeignSystemContent
+ * (called separately, afterwards) is what moves it out of system[].
+ */
+export declare function applyClaudeSystemIdentity(system: TextContent[]): void;
+/**
+ * Move everything in `system[]` past the identity block (index 1) into the
+ * first user message instead. Anthropic's OAuth billing validator appears to
+ * inspect `system[]` content beyond the identity prefix and reject requests
+ * whose system array carries a foreign harness prompt with an "out of extra
+ * usage" 400 — the same approach used by third-party Claude Code OAuth
+ * clients (e.g. opencode-claude-auth). The relocated text still reaches the
+ * model, just as part of the first user turn rather than
+ * `system[]`.
+ *
+ * A no-op when there is no user message to attach the content to, so nothing
+ * is silently dropped — the caller's system content stays in `system[]`
+ * instead.
+ */
+export declare function relocateForeignSystemContent(system: TextContent[], messages: UnifiedMessage[] | undefined): void;
+/**
+ * Claude Code's OAuth validator expects tool names in the mcp_PascalCase
+ * spelling used by the official CLI. Non-Claude-Code clients commonly send
+ * ordinary names such as `bash` or `read`, so normalize them before the
+ * Anthropic body is built. The prefix check keeps this operation idempotent.
+ */
+export declare function prefixClaudeToolName(name: string): string;
+/** Restore a Claude Code tool name to the caller's original spelling. */
+export declare function unprefixClaudeToolName(name: string): string;
+/** Rewrite tool names in a Unified request in place for the OAuth wire path. */
+export declare function prefixClaudeToolNames(request: UnifiedChatRequest, nameMap?: Map<string, string>): void;
+/** Rewrite tool names in a Unified/OpenAI-shaped response in place. */
+export declare function unprefixClaudeToolNames(value: any, nameMap?: Map<string, string>): void;
+/** Rewrite one OpenAI SSE data payload's tool names. */
+export declare function unprefixClaudeToolNamesInSseData(value: any, nameMap?: Map<string, string>): void;

package/dist/utils/claude-model-catalog.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Claude Code's bundled model capability catalog (extracted from v2.1.220).
+ *
+ * Every model-dependent decision in the claude-auth impersonation path (beta
+ * flags, effort support, thinking shape, max_tokens ceiling) is driven by
+ * `capabilities` membership here, never by matching on the model name.
+ */
+export interface ClaudeModelCatalogEntry {
+    /** Context window in tokens, or undefined when the model predates 1M-context routing. */
+    window?: number;
+    /** Router carries a native (unconditional) 1M-token context window. */
+    nativeOneMillion: boolean;
+    /** Model can opt into a 1M-token window via the context-1m-2025-08-07 beta. */
+    supportsOneMillionBeta: boolean;
+    /** Model id accepts an explicit "[1m]" wire suffix. */
+    supportsOneMillionSuffix: boolean;
+    maxOutputTokens: {
+        default: number;
+        upper: number;
+    };
+    defaultEffort?: string;
+    capabilities: string[];
+}
+export declare const CLAUDE_MODEL_CATALOG: Record<string, ClaudeModelCatalogEntry>;
+/** Strip the "[1m]" wire marker, reporting whether it was present. */
+export declare function stripOneMillionContextMarker(modelId: string | undefined): {
+    modelId: string;
+    requestedOneMillion: boolean;
+};
+/**
+ * Normalize a routed model id (CCR "provider,model" selector, an optional
+ * "[1m]" marker, and Anthropic's dated model-id suffix) down to a catalog
+ * key, e.g. "anthropic,claude-opus-5-20260101[1m]" -> "claude-opus-5".
+ */
+export declare function normalizeModelIdForCatalog(modelId: string | undefined): string;
+/** Look up a model's catalog entry. Unknown models resolve to undefined (minimal capability set). */
+export declare function lookupClaudeModelCatalogEntry(modelId: string | undefined): ClaudeModelCatalogEntry | undefined;
+export declare function catalogEntryHasCapability(entry: ClaudeModelCatalogEntry | undefined, capability: string): boolean;
+/**
+ * Whether extended-thinking betas apply to this model. The catalog has no
+ * dedicated "supports_thinking" column, but every entry that predates the
+ * Claude 4 thinking generation (claude-3-5-haiku, claude-3-5-sonnet,
+ * claude-3-7-sonnet) — plus the not-yet-classified claude-mythos-5 — carries
+ * an empty capability set; every thinking-capable model carries at least
+ * "context_management". A non-empty capability set is therefore a reliable,
+ * self-documenting proxy that also degrades unknown models to "no thinking"
+ * rather than guessing.
+ */
+export declare function catalogEntrySupportsThinking(entry: ClaudeModelCatalogEntry | undefined): boolean;

package/dist/utils/headers.d.ts

@@ -0,0 +1,10 @@
+export type HeaderRecord = Record<string, string | undefined>;
+export declare function mergeHeadersCaseInsensitive(base: HeaderRecord | undefined, update: HeaderRecord | undefined): HeaderRecord;
+/**
+ * Carry non-representational upstream response headers (rate-limit/usage
+ * metadata, request ids, etc.) onto a reshaped `Response`, so overage
+ * observability (`anthropic-ratelimit-unified-*`) survives SSE re-framing.
+ */
+export declare function preserveUpstreamResponseHeaders(headers: Headers | undefined): Record<string, string>;
+export declare function selectSafeDownstreamHeaders(headers: Headers | HeaderRecord | undefined): Record<string, string>;
+export declare function canonicalizeOutboundHeaders(headers: HeaderRecord | undefined, fallbackBearer?: string): Record<string, string>;

package/dist/utils/mistral.util.d.ts

@@ -2,7 +2,7 @@ import { UnifiedChatRequest } from "../types/llm";
 /**
  * Transform incoming request to Mistral-compatible format
  */
-export declare function buildRequestBody(request: UnifiedChatRequest, context?: any, provider?: any): Record<string, any>;
+export declare function buildRequestBody(request: UnifiedChatRequest, context?: any, _provider?: any): Record<string, any>;
 /**
  * Transform a Mistral provider request back into a UnifiedChatRequest
  */