@caeliq/llms 1.0.58 → 1.0.60

package/dist/routing/inbound-pipeline.d.ts

@@ -0,0 +1,34 @@
+import { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
+import { Transformer } from "../types/transformer";
+import { UnifiedChatRequest } from "../types/llm";
+import { ClientProtocolContext, ProtocolRouteMatch } from "./protocol-endpoints";
+export interface PreparedInboundRequest {
+    match: ProtocolRouteMatch;
+    protocolContext: ClientProtocolContext;
+    /** Original client wire body (preserved for Anthropic custom routers). */
+    originalBody: any;
+    /** Client wire body after protocol adaptation and CCR-only cleanup. */
+    clientWireBody: any;
+    /** Normalized Unified body used for routing and provider conversion. */
+    unifiedBody: UnifiedChatRequest;
+    /** Unified projection before destination-specific Anthropic emulation. */
+    prePolicyUnifiedBody: UnifiedChatRequest;
+    providerName: string;
+    modelName: string;
+}
+/**
+ * Stages 1–7 of the canonical inbound lifecycle:
+ * detect → adapt → normalize → route → validate destination.
+ */
+export declare function prepareInboundRequest(req: FastifyRequest, reply: FastifyReply, fastify: FastifyInstance, endpointTransformer: Transformer, routePath: string): Promise<PreparedInboundRequest>;
+export declare function resolveDestination(model: string | undefined, protocol?: ClientProtocolContext["protocol"]): {
+    providerName: string;
+    modelName: string;
+};
+/**
+ * Decode a discovery alias before scenario routing. Aliases are constrained to
+ * configured canonical routes; ordinary `provider,model` ids are unchanged.
+ */
+export declare function resolveConfiguredClaudeModelAlias(model: string | undefined, isConfigured: (canonicalId: string) => boolean, protocol?: ClientProtocolContext["protocol"]): string | undefined;
+export declare function throwProtocolError(protocol: ClientProtocolContext["protocol"] | undefined, message: string, statusCode: number, code: string, type?: string): never;
+export declare function protocolAwareBypass(provider: any, transformer: Transformer, protocolContext: ClientProtocolContext | undefined, modelName: string | undefined): boolean;

package/dist/routing/protocol-adapter.d.ts

@@ -0,0 +1,36 @@
+import type { UnifiedChatRequest } from "../types/llm";
+import type { Transformer } from "../types/transformer";
+import { ClientProtocolContext, ProtocolRouteMatch } from "./protocol-endpoints";
+export interface ProtocolAdaptResult {
+    /** Cloned client body used as normalization input (never the live req.body). */
+    normalizationInput: any;
+    context: ClientProtocolContext;
+}
+/**
+ * Adapt path/query fields into a cloned normalization input and build the
+ * initial ClientProtocolContext. Does not mutate the caller's body object.
+ */
+export declare function adaptClientRequest(match: ProtocolRouteMatch, rawBody: any, _query?: Record<string, unknown>): ProtocolAdaptResult;
+/**
+ * Normalize client wire → Unified once via the endpoint transformer's
+ * transformRequestOut when present. Chat Completions bodies are already
+ * Unified-shaped; until Phase 2/3 add full converters, fall back to a
+ * lightweight projection sufficient for routing.
+ */
+export declare function normalizeClientToUnified(protocol: ClientProtocolContext["protocol"], normalizationInput: any, endpointTransformer: Transformer, context: any): Promise<UnifiedChatRequest>;
+/**
+ * Provider transformers are allowed to mutate their input. Every primary and
+ * fallback attempt therefore needs an independent copy of the normalized body.
+ */
+export declare function cloneProtocolBody<T>(value: T): T;
+/**
+ * Preserve all end-to-end application headers for a native client. Only
+ * credentials, cookies, CCR/proxy routing metadata and hop-by-hop transport
+ * headers are removed; provider authentication is generated independently.
+ */
+export declare function sanitizePassthroughHeaders(headers: Headers | Record<string, unknown> | undefined): Record<string, string>;
+/**
+ * Protocol-aware passthrough: only bypass when the provider speaks the same
+ * client protocol (matching transformer name) and the request is same-protocol.
+ */
+export declare function shouldBypassTransformersProtocolAware(provider: any, endpointTransformer: Transformer, protocol: ClientProtocolContext["protocol"], bodyModel: string | undefined): boolean;

package/dist/routing/protocol-endpoints.d.ts

@@ -0,0 +1,89 @@
+import type { RouterScenarioType } from "../utils/router";
+import type { AnthropicClientKind, AnthropicProviderMode } from "../utils/anthropic-client-policy";
+/**
+ * Inbound client protocols supported by CCR's gateway lifecycle.
+ */
+export type ClientProtocol = "anthropic_messages" | "openai_chat_completions" | "openai_responses";
+export interface AnthropicSourceRequestFields {
+    metadata?: Record<string, unknown>;
+    thinking?: Record<string, unknown>;
+    outputConfig?: Record<string, unknown>;
+    stopSequences?: string[];
+}
+export interface ClientProtocolContext {
+    protocol: ClientProtocol;
+    pathname: string;
+    /** Canonical Fastify route path (without preset prefix), e.g. /v1/responses */
+    canonicalPath: string;
+    /** Alias path that matched, if different from canonical */
+    matchedPath: string;
+    originalModel?: string;
+    /** Client selected the gateway's trailing `[1m]` context variant. */
+    requestedOneMillion?: boolean;
+    stream: boolean;
+    scenarioType?: RouterScenarioType;
+    /** Source-only Anthropic semantics retained before destination routing. */
+    anthropicSource?: AnthropicSourceRequestFields;
+    /** Client fingerprint captured before Anthropic normalization. */
+    anthropicClientKind?: AnthropicClientKind;
+    /** In-scope Anthropic destination/auth variant selected after routing. */
+    anthropicProviderMode?: AnthropicProviderMode;
+    anthropicDestinationInScope?: boolean;
+    /** Native Desktop/CLI requests must bypass body and response conversion. */
+    anthropicNativeWire?: boolean;
+    /** Third-party emulation has already modified the Unified projection. */
+    anthropicPolicyApplied?: boolean;
+    anthropicSystemTransformed?: boolean;
+    claudeAuthToolNameMap?: Map<string, string>;
+    /** Claude Code routing metadata extracted without mutating the source billing block. */
+    claudeCodeSubagent?: boolean;
+    taggedSubagentModel?: string;
+    /** Transformer that owns this client protocol */
+    ownerTransformerName: string;
+}
+export interface ProtocolRouteMatch {
+    protocol: ClientProtocol;
+    canonicalPath: string;
+    matchedPath: string;
+    ownerTransformerName: string;
+    /** True when matchedPath is an alias of canonicalPath */
+    isAlias: boolean;
+    stream: boolean;
+    /** Preset namespace prefix without trailing slash, e.g. /preset/foo */
+    presetPrefix?: string;
+}
+interface ProtocolRouteSpec {
+    protocol: ClientProtocol;
+    canonicalPath: string;
+    aliases: string[];
+    ownerTransformerName: string;
+    /** Default stream intent when not encoded in the path */
+    defaultStream?: boolean;
+}
+/**
+ * Client-facing route table. Aliases are first-class; registration must not
+ * rely on transformer endPoint first-wins.
+ */
+export declare const PROTOCOL_ROUTE_SPECS: ProtocolRouteSpec[];
+/**
+ * Match a client LLM POST path to a protocol. Works with preset prefixes,
+ * trailing-slash normalization, and query stripping.
+ */
+export declare function matchClientProtocol(method: string, pathnameOrUrl: string): ProtocolRouteMatch | null;
+/** True when method+path is an in-scope routed LLM POST. */
+export declare function isRoutedLlmPost(method: string, pathnameOrUrl: string): boolean;
+/** All Fastify paths that should be registered for a protocol (canonical + aliases). */
+export declare function getRegisteredPathsForProtocol(protocol: ClientProtocol): string[];
+/** Flat list of registered client routes and their owner transformers. */
+export declare function listClientRouteRegistrations(): Array<{
+    path: string;
+    protocol: ClientProtocol;
+    ownerTransformerName: string;
+    isCanonical: boolean;
+}>;
+export declare function createClientProtocolContext(match: ProtocolRouteMatch, options?: {
+    originalModel?: string;
+    stream?: boolean;
+    scenarioType?: RouterScenarioType;
+}): ClientProtocolContext;
+export {};

package/dist/routing/protocol-errors.d.ts

@@ -0,0 +1,10 @@
+import type { ClientProtocol } from "./protocol-endpoints";
+export interface ProtocolErrorBody {
+    statusCode: number;
+    body: Record<string, unknown>;
+}
+/**
+ * Build a client-protocol-shaped error envelope for pre-provider failures
+ * (auth, validation, missing Router.default, etc.).
+ */
+export declare function protocolErrorBody(protocol: ClientProtocol | undefined, message: string, statusCode: number, code: string, type?: string): ProtocolErrorBody;

package/dist/server.d.ts

@@ -56,5 +56,7 @@ export { TokenizerService } from "./services/tokenizer";
 export { pluginManager, tokenSpeedPlugin, getTokenSpeedStats, getGlobalTokenSpeedStats, CCRPlugin, CCRPluginOptions, PluginMetadata } from "./plugins";
 export { SSEParserTransform, SSESerializerTransform, rewriteStream } from "./utils/sse";
 export { isClientAbortError } from "./utils/retry";
-export { sanitizeHeadersForLog, diffHeadersForLog, } from "./utils/redact";
+export { sanitizeHeadersForLog, diffHeadersForLog, sanitizeBodyForLog, DEFAULT_LOG_BODY_MAX_BYTES, } from "./utils/redact";
 export { exchangeAuthorizationCode, fetchUserEmail, resolveProjectId, saveTokens, loadTokens, getValidAccessToken, ANTIGRAVITY_CLIENT_ID, ANTIGRAVITY_CLIENT_SECRET, ANTIGRAVITY_REDIRECT_URI, ANTIGRAVITY_SCOPES, type AntigravityTokens, } from "./utils/antigravity-auth";
+export { matchClientProtocol, isRoutedLlmPost, listClientRouteRegistrations, type ClientProtocol, type ClientProtocolContext, type ProtocolRouteMatch, } from "./routing/protocol-endpoints";
+export { protocolErrorBody } from "./routing/protocol-errors";

package/dist/services/provider.d.ts

@@ -17,7 +17,7 @@ export declare class ProviderService {
     getProvider(name: string): LLMProvider | undefined;
     updateProvider(id: string, updates: Partial<LLMProvider>): LLMProvider | null;
     deleteProvider(id: string): boolean;
-    toggleProvider(name: string, enabled: boolean): boolean;
+    toggleProvider(name: string, _enabled: boolean): boolean;
     resolveModelRoute(modelName: string): RequestRouteInfo | null;
     getAvailableModelNames(): string[];
     getModelRoutes(): ModelRoute[];

package/dist/tests/anthropic.client-policy.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/anthropic.provider-wire.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/claude-auth.identity.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/client-abort-classification.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/inbound-protocol-routes.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/inbound-routing-pipeline.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/openai.inbound-chat.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/openai.inbound-responses.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/protocol-endpoints.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/reasoning.effort-levels.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/redact.body-for-log.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/responses.call-id-sanitize.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/responses.parallel-and-failure.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/router-scenario-precedence.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/system-instructions-fold.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/upstream-error-semantics.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/transformer/anthropic.transformer.d.ts

@@ -7,7 +7,20 @@ export declare class AnthropicTransformer implements Transformer {
     private useBearer;
     logger?: any;
     constructor(options?: TransformerOptions | undefined);
-    auth(request: any, provider: LLMProvider, _context?: any): Promise<any>;
+    auth(request: any, provider: LLMProvider, context?: TransformerContext): Promise<any>;
+    /**
+     * Provider-side: Unified → Anthropic Messages wire.
+     * Enables cross-protocol clients (Chat/Responses) to reach Anthropic-shaped
+     * upstreams. Same-protocol Anthropic clients still use transformRequestOut
+     * for client→Unified and may bypass via protocol-aware passthrough.
+     */
+    transformRequestIn(request: UnifiedChatRequest, provider: LLMProvider, _context?: TransformerContext): Promise<Record<string, any>>;
+    /**
+     * Provider-side: Anthropic Messages wire → Unified (Chat Completions shape).
+     * Reuses the Vertex Claude Anthropic→Unified converter so streaming and JSON
+     * envelopes match existing Anthropic upstream behavior.
+     */
+    transformResponseOut(response: Response, _context?: TransformerContext): Promise<Response>;
     transformRequestOut(request: Record<string, any>, context?: TransformerContext): Promise<UnifiedChatRequest>;
     transformResponseIn(response: Response, context?: TransformerContext): Promise<Response>;
     /**
@@ -15,7 +28,7 @@ export declare class AnthropicTransformer implements Transformer {
      * Used by claude-auth.transformRequestIn() to reconstruct the body before
      * sending to Anthropic, preserving all original parameters.
      */
-    static buildAnthropicBody(request: UnifiedChatRequest, logger?: any): Record<string, any>;
+    static buildAnthropicBody(request: UnifiedChatRequest, logger?: any, context?: TransformerContext): Record<string, any>;
     private convertAnthropicToolsToUnified;
     private convertOpenAIStreamToAnthropic;
     private convertOpenAIResponseToAnthropic;

package/dist/transformer/claude-auth.transformer.d.ts

@@ -1,25 +1,80 @@
 import { UnifiedChatRequest } from "../types/llm";
 import { Transformer, TransformerContext } from "../types/transformer";
+import { HeaderRecord } from "../utils/headers";
+import { ClaudeModelCatalogEntry } from "../utils/claude-model-catalog";
 /** Anthropic beta required for Claude subscription / Claude Code OAuth Bearer auth. */
 export declare const CLAUDE_OAUTH_REQUIRED_BETA = "oauth-2025-04-20";
 export declare function mergeAnthropicBetaValues(...values: Array<string | undefined | null>): string;
 /** Read a named header value from a Fastify/Node headers object (case-insensitive). */
 export declare function readHeaderValue(headers: Record<string, unknown> | undefined, name: string): string | undefined;
+/** True when the client's User-Agent identifies it as the genuine Claude Code CLI. */
+export declare function isClaudeCodeClient(userAgent: string | undefined): boolean;
 /**
  * Build outbound anthropic-beta for Claude subscription OAuth.
  *
  * - If the client sent anthropic-beta (e.g. Claude Code), merge with
  *   oauth-2025-04-20 (deduped, case-insensitive).
- * - Otherwise, send only oauth-2025-04-20. Do not synthesise Claude Code
- *   betas — Anthropic validates the attestation on claude-code-20250219
- *   and subscription OAuth works without it for non-Claude-Code clients.
+ * - Otherwise, send only oauth-2025-04-20.
  */
 export declare function resolveClaudeAuthAnthropicBeta(input: {
     clientBeta?: string;
 }): string;
+/**
+ * Build outbound anthropic-beta for the non-Claude-Code (full synthesis)
+ * branch, mirroring Claude Code's current model-driven beta selection. Model
+ * capabilities come from the catalog; the CLI's one family-level exception
+ * (the ordinary Haiku profile omits the Claude Code beta) is retained from the
+ * decompiled `cui()` branch. Current CLI `ANTHROPIC_BETAS` values are appended
+ * to the profile; OAuth callers still add their required OAuth beta at the auth
+ * boundary.
+ */
+export declare function resolveClaudeAuthBetas(modelId: string | undefined, opts?: {
+    envBeta?: string;
+    includeOAuthBeta?: boolean;
+    includeToolSearch?: boolean;
+    includeEffort?: boolean;
+    includeFallbackCredit?: boolean;
+}): string;
+/**
+ * Recreate the SDK's context marker only for models whose 1M window is a beta.
+ * Native-1M models still accept the gateway picker suffix, but must not receive
+ * the legacy context beta upstream.
+ */
+export declare function modelIdForRequestedOneMillionBeta(modelId: string | undefined, requestedOneMillion: boolean | undefined): string | undefined;
+/**
+ * Reshape a built Anthropic body's `thinking`/`output_config`/`max_tokens`
+ * to what the resolved model actually supports, replacing a hand-rolled
+ * per-model denylist with a single catalog-driven pass. Operates on the
+ * post-build Anthropic body (not the Unified request) because
+ * `buildAnthropicBody` may synthesize `thinking`/`output_config` itself.
+ */
+export declare function applyClaudeModelCapabilityAdjustments(anthropicBody: Record<string, any>, entry: ClaudeModelCatalogEntry | undefined): void;
+/** Test-only reset hook so session-id state doesn't leak across test cases. */
+export declare function __resetClaudeAuthTransformerStateForTests(): void;
+/** Synthesized Claude Code identity headers for the non-Claude-Code branch. */
+export declare function buildSynthesizedIdentityHeaders(): HeaderRecord;
+export declare function buildSynthesizedUserMetadata(): Record<string, string>;
 export declare class ClaudeAuthTransformer implements Transformer {
     name: string;
     logger?: any;
     transformRequestIn(request: UnifiedChatRequest, provider: any, context?: TransformerContext): Promise<Record<string, any>>;
-    transformResponseOut(response: Response): Promise<Response>;
+    /**
+     * Auth-only path used by native Desktop/CLI raw-wire requests. It keeps the
+     * original body and application headers untouched while still replacing the
+     * caller credential with CCR's OAuth token.
+     */
+    auth(request: any, provider: any, context?: TransformerContext): Promise<any>;
+    /**
+     * Body/URL/wire-format conversion belong to AnthropicTransformer's
+     * provider pair, which already ran (response-side order is reversed, so
+     * it runs before this stage). This stage only inspects the resulting
+     * response for subscription-specific overage observability.
+     */
+    transformResponseOut(response: Response, context?: TransformerContext): Promise<Response>;
+    /**
+     * 401 recovery: reload the token file in case another process (e.g. a
+     * concurrent `ccr claude-auth` re-login) rotated it externally, otherwise
+     * refresh and persist. Never falls through to an unauthenticated request.
+     */
+    private recoverUnauthorizedAuth;
 }

package/dist/transformer/openai.responses.transformer.d.ts

@@ -1,11 +1,27 @@
 import { UnifiedChatRequest } from "../types/llm";
-import { Transformer } from "../types/transformer";
+import { Transformer, TransformerContext } from "../types/transformer";
 export declare class OpenAIResponsesTransformer implements Transformer {
     logger?: any;
     name: string;
     endPoint: string;
+    /**
+     * Client → Unified: validate Responses MVP and project to Chat Completions shape.
+     * Call-id mapping is stored on the transformer context for the response path.
+     */
+    transformRequestOut(request: any, context?: TransformerContext): Promise<UnifiedChatRequest>;
+    /**
+     * Unified → client Responses: JSON object or SSE lifecycle with mandatory
+     * content_part events (Codex requires these or streamed text is discarded).
+     */
+    transformResponseIn(response: Response, context?: TransformerContext): Promise<Response>;
+    private convertUnifiedStreamToResponses;
     transformRequestIn(request: UnifiedChatRequest, provider?: any, context?: any): Promise<UnifiedChatRequest>;
     transformResponseOut(response: Response): Promise<Response>;
+    /**
+     * Convert one Responses stream event to a Chat chunk. `choices[0].index` is
+     * always 0 — parallel-call identity lives in `delta.tool_calls[n].index`,
+     * allocated per Responses item by `toolIndexFor`.
+     */
     private convertStreamEvent;
     private normalizeRequestContent;
     private convertResponseToChat;

package/dist/transformer/openai.transformer.d.ts

@@ -1,39 +1,12 @@
-import { Transformer } from "../types/transformer";
+import { Transformer, TransformerContext } from "../types/transformer";
 import { UnifiedChatRequest } from "../types/llm";
 /**
  * Server-side route handler for the OpenAI Chat Completions API.
  *
- * ## How endPoint works
- *
- * At startup, `registerApiRoutes` (see `api/routes.ts`) scans all registered
- * transformers for ones that define `endPoint`. For each, it registers a
- * `POST` route at that path. When a request hits the route,
- * `handleTransformerEndpoint` is invoked with the matching transformer as
- * the "endpoint transformer" — the one responsible for converting between
- * the external wire format and the internal Unified format.
- *
- * ## Request handling
- *
- * The Unified format IS the OpenAI Chat Completions format. The conversion
- * from Anthropic → Unified already happened in
- * `AnthropicTransformer.transformRequestOut()` (which runs first in the
- * pipeline). So by the time the provider chain executes, the body is already
- * in the right shape — no further conversion is needed.
- *
- * `transformRequestIn` also translates Claude Code cache intent to the
- * selected provider's native Chat Completions behavior. The provider identity
- * is checked before adding request-level fields so OpenAI-compatible services
- * do not receive OpenAI-only parameters.
- *
- * ## Relationship to OpenAIResponsesTransformer
- *
- * `OpenAIResponsesTransformer` (in `openai.responses.transformer.ts`) is the
- * counterpart for the Responses API (`/v1/responses`). Unlike this
- * transformer, it defines `transformRequestIn` / `transformResponseOut`
- * because the Responses API uses a different wire format (e.g. `messages`
- * → `input`, function tools → flat tool definitions). It also uses the
- * shared utilities in `openai.util.ts` (`validateOpenAIToolCalls`,
- * `injectPromptCaching`) to sanitize the Unified body before converting it.
+ * The Unified format IS the OpenAI Chat Completions format. Client inbound
+ * normalization validates the MVP subset and passes through already-correct
+ * Chat bodies. Provider-side transformRequestIn applies cache policy for
+ * OpenAI-compatible upstreams.
  *
  * ## Full request pipeline (for context)
  *
@@ -44,9 +17,30 @@ import { UnifiedChatRequest } from "../types/llm";
  *       → provider.transformer.use[].transformResponseOut() // provider middleware (reversed)
  *       → AnthropicTransformer.transformResponseIn()        // Unified (OpenAI) → Anthropic
  *       → Client
+ *
+ * For inbound Chat Completions clients:
+ *
+ *     Client → POST /v1/chat/completions
+ *       → OpenAITransformer.transformRequestOut()           // validate → Unified
+ *       → provider.transformer.use[].transformRequestIn()
+ *       → … → OpenAITransformer.transformResponseIn()       // identity / light normalize
  */
 export declare class OpenAITransformer implements Transformer {
     name: string;
     endPoint: string;
+    /**
+     * Client → Unified: validate the Chat Completions MVP subset.
+     * Unified is already Chat-shaped, so this is validation + light normalization.
+     */
+    transformRequestOut(request: any, _context?: TransformerContext): Promise<UnifiedChatRequest>;
+    /**
+     * Provider-side: apply OpenAI-native cache policy to a Unified Chat body.
+     */
     transformRequestIn(request: UnifiedChatRequest, provider: any, context: any): Promise<UnifiedChatRequest>;
+    /**
+     * Unified → client Chat Completions: pass through already-correct Chat JSON/SSE.
+     * Ensures Content-Type and that streaming responses terminate with [DONE] when
+     * the upstream already speaks Chat Completions.
+     */
+    transformResponseIn(response: Response, _context?: TransformerContext): Promise<Response>;
 }

package/dist/transformer/tooluse.transformer.d.ts

@@ -2,6 +2,6 @@ import { UnifiedChatRequest } from "../types/llm";
 import { Transformer } from "../types/transformer";
 export declare class TooluseTransformer implements Transformer {
     name: string;
-    transformRequestIn(request: UnifiedChatRequest, provider?: any, context?: any): Promise<any>;
+    transformRequestIn(request: UnifiedChatRequest, _provider?: any, _context?: any): Promise<any>;
     transformResponseOut(response: Response): Promise<Response>;
 }

package/dist/transformer/vercel.transformer.d.ts

@@ -6,6 +6,6 @@ export declare class VercelTransformer implements Transformer {
     logger?: any;
     endPoint: string;
     constructor(options?: TransformerOptions | undefined);
-    transformRequestIn(request: UnifiedChatRequest, provider?: any, context?: any): Promise<UnifiedChatRequest>;
+    transformRequestIn(request: UnifiedChatRequest, _provider?: any, _context?: any): Promise<UnifiedChatRequest>;
     transformResponseOut(response: Response): Promise<Response>;
 }

package/dist/transformer/vertex-claude.transformer.d.ts

@@ -3,7 +3,7 @@ import { Transformer } from "../types/transformer";
 export declare class VertexClaudeTransformer implements Transformer {
     logger?: any;
     name: string;
-    transformRequestIn(request: UnifiedChatRequest, provider: LLMProvider): Promise<Record<string, any>>;
+    transformRequestIn(request: UnifiedChatRequest, _provider: LLMProvider): Promise<Record<string, any>>;
     transformRequestOut(request: Record<string, any>): Promise<UnifiedChatRequest>;
     transformResponseOut(response: Response): Promise<Response>;
 }

package/dist/transformer/vertex-gemini.transformer.d.ts

@@ -6,7 +6,7 @@ export declare class VertexGeminiTransformer implements Transformer {
     name: string;
     private readonly thoughtSignatureFallback;
     constructor(options?: TransformerOptions);
-    transformRequestIn(request: UnifiedChatRequest, provider: LLMProvider, context?: any): Promise<Record<string, any>>;
+    transformRequestIn(request: UnifiedChatRequest, provider: LLMProvider, _context?: any): Promise<Record<string, any>>;
     transformRequestOut(request: Record<string, any>): Promise<UnifiedChatRequest>;
     transformResponseOut(response: Response, context?: TransformerContext): Promise<Response>;
 }

package/dist/types/llm.d.ts

@@ -84,7 +84,8 @@ export interface UnifiedTool {
         ttl?: "5m" | "1h";
     };
 }
-export type ThinkLevel = "none" | "low" | "medium" | "high" | "xhigh" | "max";
+export declare const THINK_LEVELS: readonly ["none", "minimal", "low", "medium", "high", "xhigh", "max", "ultra"];
+export type ThinkLevel = (typeof THINK_LEVELS)[number];
 export interface UnifiedChatRequest {
     messages: UnifiedMessage[];
     model: string;

package/dist/types/transformer.d.ts

@@ -14,6 +14,15 @@ export interface TransformerContext {
     signal?: AbortSignal;
     /** Protocol semantics that must not be serialized into the provider body. */
     unifiedRequest?: UnifiedRequestRuntime;
+    /**
+     * Set by claude-auth's transformRequestIn (non-Claude-Code branch) so that
+     * AnthropicTransformer.transformRequestIn — which owns building the wire
+     * body — can apply claude-auth's catalog-driven capability clamping and
+     * synthesized user_id metadata immediately after building it. Keeps model
+     * capability/identity-synthesis policy owned by claude-auth while
+     * AnthropicTransformer remains the sole body-shape/timing owner.
+     */
+    claudeAuthPostBuildHook?: (anthropicBody: Record<string, any>) => void;
     [key: string]: any;
 }
 export type Transformer = {

package/dist/utils/anthropic-client-policy.d.ts

@@ -0,0 +1,45 @@
+import { UnifiedChatRequest } from "../types/llm";
+export type AnthropicClientKind = "claude_desktop" | "claude_code" | "other";
+export type AnthropicProviderMode = "api_key" | "claude_oauth" | "out_of_scope";
+export interface AnthropicClientFingerprintSignals {
+    desktopMarker: boolean;
+    desktopUserAgent: boolean;
+    desktopAgentSdkUserAgent: boolean;
+    cliUserAgent: boolean;
+    cliApp: boolean;
+    cliSession: boolean;
+    stainlessPackage: boolean;
+    billingSystem: boolean;
+    identitySystem: boolean;
+}
+export interface AnthropicClientPolicyContext {
+    anthropicClientKind?: AnthropicClientKind;
+    anthropicProviderMode?: AnthropicProviderMode;
+    anthropicDestinationInScope?: boolean;
+    anthropicNativeWire?: boolean;
+    anthropicPolicyApplied?: boolean;
+    anthropicSystemTransformed?: boolean;
+    claudeAuthToolNameMap?: Map<string, string>;
+}
+export declare function readHeaderValue(headers: Record<string, unknown> | undefined, name: string): string | undefined;
+/**
+ * Classify the original Anthropic wire request. A generic SDK UA is never
+ * enough to grant native pass-through; incomplete fingerprints fail closed to
+ * the third-party emulation path.
+ */
+export declare function classifyAnthropicClient(headers: Record<string, unknown> | undefined, body: any): AnthropicClientKind;
+/** Return only non-sensitive boolean fingerprint signals for debug logging. */
+export declare function inspectAnthropicClientFingerprint(headers: Record<string, unknown> | undefined, body: any): AnthropicClientFingerprintSignals;
+/**
+ * The feature is intentionally scoped to CCR's real Anthropic provider, with
+ * either the exact Anthropic API-key chain or the exact claude-auth + Anthropic
+ * OAuth chain. Adjacent middleware makes a provider out of scope.
+ */
+export declare function getAnthropicProviderMode(provider: any, endpointTransformerName?: string): AnthropicProviderMode;
+export declare function isNativeAnthropicClient(kind: AnthropicClientKind): boolean;
+/**
+ * Apply the one and only system transformation allowed by the gateway policy.
+ * This runs after routing has identified an in-scope Anthropic destination and
+ * before the provider's Anthropic body builder runs.
+ */
+export declare function applyThirdPartyAnthropicPolicy(request: UnifiedChatRequest, context: AnthropicClientPolicyContext, configService: any): Promise<void>;

package/dist/utils/anthropic-url.d.ts

@@ -0,0 +1 @@
+export declare function buildAnthropicMessagesUrl(baseUrl: string | undefined): string;

package/dist/utils/claude-auth.d.ts

@@ -1,4 +1,5 @@
-declare const CLAUDE_AUTH_FILE: string;
+declare function getClaudeAuthFilePath(): string;
+declare function getClaudeDeviceFilePath(): string;
 declare const OAUTH_CONFIG: {
     client_id: string;
     authorization_endpoint: string;
@@ -19,4 +20,10 @@ export declare function saveTokens(tokens: ClaudeTokens): void;
 export declare function isTokenExpired(tokens: ClaudeTokens, leewaySeconds?: number): boolean;
 export declare function refreshTokens(refreshToken: string): Promise<ClaudeTokens>;
 export declare function getValidAccessToken(): Promise<ClaudeTokens>;
-export { OAUTH_CONFIG, CLAUDE_AUTH_FILE };
+/**
+ * Load the persisted synthesized-client device id, minting and persisting a
+ * fresh 64-hex value on first use. Stored alongside the OAuth token file
+ * (mode 0600) but kept separate from it — it is not a credential.
+ */
+export declare function loadOrCreateDeviceId(): string;
+export { OAUTH_CONFIG, getClaudeAuthFilePath, getClaudeDeviceFilePath };