@cortexkit/anthropic-auth-core 1.0.0

package/dist/auth.js

@@ -0,0 +1,93 @@
+import { AUTHORIZE_URLS, CLIENT_ID, CODE_CALLBACK_URL, OAUTH_SCOPES, TOKEN_URL, } from "./constants.js";
+import { generatePKCE } from "./pkce.js";
+function generateState() {
+    return crypto.randomUUID().replace(/-/g, '');
+}
+function parseCallbackInput(input) {
+    const trimmed = input.trim();
+    try {
+        const url = new URL(trimmed);
+        const code = url.searchParams.get('code');
+        const state = url.searchParams.get('state');
+        if (code && state) {
+            return { code, state };
+        }
+    }
+    catch {
+        // Fall through to legacy/manual formats.
+    }
+    const hashSplits = trimmed.split('#');
+    if (hashSplits.length === 2 && hashSplits[0] && hashSplits[1]) {
+        return { code: hashSplits[0], state: hashSplits[1] };
+    }
+    const params = new URLSearchParams(trimmed);
+    const code = params.get('code');
+    const state = params.get('state');
+    if (code && state) {
+        return { code, state };
+    }
+    return null;
+}
+async function exchangeCode(callback, verifier, redirectUri) {
+    const result = await fetch(TOKEN_URL, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            Accept: 'application/json, text/plain, */*',
+            'User-Agent': 'axios/1.13.6',
+        },
+        body: JSON.stringify({
+            code: callback.code,
+            state: callback.state,
+            grant_type: 'authorization_code',
+            client_id: CLIENT_ID,
+            redirect_uri: redirectUri,
+            code_verifier: verifier,
+        }),
+    });
+    if (!result.ok) {
+        return {
+            type: 'failed',
+        };
+    }
+    const json = (await result.json());
+    return {
+        type: 'success',
+        refresh: json.refresh_token,
+        access: json.access_token,
+        expires: Date.now() + json.expires_in * 1000,
+    };
+}
+export async function authorize(mode) {
+    const pkce = await generatePKCE();
+    const state = generateState();
+    const url = new URL(AUTHORIZE_URLS[mode], import.meta.url);
+    url.searchParams.set('code', 'true');
+    url.searchParams.set('client_id', CLIENT_ID);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('redirect_uri', CODE_CALLBACK_URL);
+    url.searchParams.set('scope', OAUTH_SCOPES.join(' '));
+    url.searchParams.set('code_challenge', pkce.challenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    url.searchParams.set('state', state);
+    return {
+        url: url.toString(),
+        redirectUri: CODE_CALLBACK_URL,
+        state,
+        verifier: pkce.verifier,
+    };
+}
+export async function exchange(input, verifier, redirectUri, expectedState) {
+    const callback = parseCallbackInput(input);
+    if (!callback) {
+        return {
+            type: 'failed',
+        };
+    }
+    if (expectedState && callback.state !== expectedState) {
+        return {
+            type: 'failed',
+        };
+    }
+    return exchangeCode(callback, verifier, redirectUri);
+}

package/dist/cache1h.d.ts

@@ -0,0 +1,33 @@
+import { type Cache1hMode } from './constants.ts';
+export declare const CACHE_1H_COMMAND_NAME = "claude-cache";
+export type Cache1hCommandAction = {
+    type: 'status';
+} | {
+    type: 'enable';
+} | {
+    type: 'disable';
+} | {
+    type: 'mode';
+    mode: Cache1hMode;
+} | {
+    type: 'usage';
+};
+export declare function isCache1hEnabled(): boolean;
+export declare function getCache1hMode(): "explicit" | "automatic" | "hybrid";
+export declare function setCache1hEnabled(enabled: boolean): void;
+export declare function setCache1hMode(mode: Cache1hMode): void;
+export declare function setCache1hState(input: {
+    enabled: boolean;
+    mode: Cache1hMode;
+}): void;
+export declare function resetCache1hState(): void;
+export declare function parseCache1hCommandAction(argumentsText: string): Cache1hCommandAction;
+export declare function buildCache1hStatusSummary(input?: {
+    enabled?: boolean;
+    mode?: Cache1hMode;
+}): string;
+export declare function executeCache1hCommand(input: {
+    argumentsText: string;
+    enabled?: boolean;
+    mode?: Cache1hMode;
+}): string;

package/dist/cache1h.js

@@ -0,0 +1,97 @@
+import { DEFAULT_CACHE_1H_MODE } from "./constants.js";
+export const CACHE_1H_COMMAND_NAME = 'claude-cache';
+const CACHE_1H_STATUS_TITLE = '## Claude Cache Status';
+const CACHE_1H_ENABLED_TITLE = '## Claude Cache Enabled';
+const CACHE_1H_DISABLED_TITLE = '## Claude Cache Disabled';
+const CACHE_1H_USAGE_TITLE = '## Claude Cache Usage';
+const CACHE_1H_USAGE = 'Usage: `/claude-cache`, `/claude-cache on`, `/claude-cache off`, or `/claude-cache mode explicit|automatic|hybrid`.';
+let cache1hEnabled = false;
+let cache1hMode = DEFAULT_CACHE_1H_MODE;
+export function isCache1hEnabled() {
+    return cache1hEnabled;
+}
+export function getCache1hMode() {
+    return cache1hMode;
+}
+export function setCache1hEnabled(enabled) {
+    cache1hEnabled = enabled;
+}
+export function setCache1hMode(mode) {
+    cache1hMode = mode;
+}
+export function setCache1hState(input) {
+    cache1hEnabled = input.enabled;
+    cache1hMode = input.mode;
+}
+export function resetCache1hState() {
+    cache1hEnabled = false;
+    cache1hMode = DEFAULT_CACHE_1H_MODE;
+}
+export function parseCache1hCommandAction(argumentsText) {
+    const normalized = argumentsText.trim().split(/\s+/).filter(Boolean);
+    if (normalized.length === 0)
+        return { type: 'status' };
+    if (normalized.length === 1 && normalized[0] === 'on')
+        return { type: 'enable' };
+    if (normalized.length === 1 && normalized[0] === 'off')
+        return { type: 'disable' };
+    if (normalized.length === 2 &&
+        normalized[0] === 'mode' &&
+        (normalized[1] === 'explicit' ||
+            normalized[1] === 'automatic' ||
+            normalized[1] === 'hybrid')) {
+        return { type: 'mode', mode: normalized[1] };
+    }
+    return { type: 'usage' };
+}
+export function buildCache1hStatusSummary(input) {
+    const enabled = input?.enabled ?? cache1hEnabled;
+    const mode = input?.mode ?? cache1hMode;
+    return [
+        CACHE_1H_STATUS_TITLE,
+        '',
+        `- Enabled: ${enabled ? 'enabled' : 'disabled'}`,
+        `- Mode: ${mode}`,
+        '- Persisted: ~/.config/opencode/anthropic-auth.json',
+        '- Scope: main sessions only; subagent sessions keep default ephemeral cache behavior',
+        '- Modes: explicit = existing OpenCode breakpoints; automatic = top-level cache_control only; hybrid = system + messages[0] + top-level cache_control',
+        '- TTL: 1h when enabled for main sessions; default ephemeral cache behavior otherwise',
+    ].join('\n');
+}
+export function executeCache1hCommand(input) {
+    const action = parseCache1hCommandAction(input.argumentsText);
+    const enabled = input.enabled ?? cache1hEnabled;
+    const mode = input.mode ?? cache1hMode;
+    if (action.type === 'status')
+        return buildCache1hStatusSummary({ enabled, mode });
+    if (action.type === 'enable') {
+        return [
+            CACHE_1H_ENABLED_TITLE,
+            '',
+            buildCache1hStatusSummary({ enabled: true, mode }),
+        ].join('\n');
+    }
+    if (action.type === 'disable') {
+        return [
+            CACHE_1H_DISABLED_TITLE,
+            '',
+            buildCache1hStatusSummary({ enabled: false, mode }),
+        ].join('\n');
+    }
+    if (action.type === 'mode') {
+        return [
+            CACHE_1H_STATUS_TITLE,
+            '',
+            `Mode updated to \`${action.mode}\`.`,
+            '',
+            buildCache1hStatusSummary({ enabled, mode: action.mode }),
+        ].join('\n');
+    }
+    return [
+        CACHE_1H_USAGE_TITLE,
+        '',
+        CACHE_1H_USAGE,
+        '',
+        buildCache1hStatusSummary({ enabled, mode }),
+    ].join('\n');
+}

package/dist/cch.d.ts

@@ -0,0 +1,36 @@
+type Message = {
+    role?: string;
+    content?: string | Array<{
+        type?: string;
+        text?: string;
+    }>;
+};
+export declare const CCH_PATTERN: RegExp;
+/**
+ * Extract text from the first user message's first text block.
+ * Kept for diagnostics/backward-compatible tests; CCH signing no longer uses it.
+ */
+export declare function extractFirstUserMessageText(messages: Message[]): string;
+/**
+ * Compute Claude Code's cch token over the final serialized request body.
+ *
+ * Real Claude Code signs the full body bytes with xxHash64 using a fixed seed,
+ * masks to 20 bits, and writes that value into the billing-header placeholder.
+ */
+export declare function computeCCH(bodyBytes: Uint8Array): Promise<string>;
+export declare function signRequestBody(bodyString: string): Promise<string>;
+/**
+ * Compute a stable 3-character suffix for cc_version.
+ *
+ * The previous implementation sampled the first user message, which could make
+ * the system billing header change with conversation content. Keep this suffix
+ * stable for a day so it resembles a rotating Claude Code fingerprint without
+ * busting prompt-cache prefixes on every turn.
+ */
+export declare function computeVersionSuffix(version?: string, date?: Date): string;
+/**
+ * Build the billing header with a cch placeholder.
+ * signRequestBody() must run after final request serialization to replace it.
+ */
+export declare function buildBillingHeaderValue(_messages: Message[], version: string | undefined, entrypoint: string, date?: Date): string;
+export {};

package/dist/cch.js

@@ -0,0 +1,77 @@
+import { createHash } from 'node:crypto';
+import xxhashInit from 'xxhash-wasm';
+import { CLAUDE_CODE_VERSION } from "./constants.js";
+const CCH_SEED = 0x6e52736ac806831en;
+export const CCH_PATTERN = /\bcch=([0-9a-f]{5});/;
+let xxhashPromise = null;
+let xxhash64Raw = null;
+async function ensureXxhash() {
+    if (xxhash64Raw)
+        return;
+    xxhashPromise ??= (async () => {
+        const hasher = await xxhashInit();
+        xxhash64Raw = hasher.h64Raw;
+    })();
+    await xxhashPromise;
+}
+/**
+ * Extract text from the first user message's first text block.
+ * Kept for diagnostics/backward-compatible tests; CCH signing no longer uses it.
+ */
+export function extractFirstUserMessageText(messages) {
+    const userMsg = messages.find((message) => message.role === 'user');
+    if (!userMsg)
+        return '';
+    const { content } = userMsg;
+    if (typeof content === 'string')
+        return content;
+    if (Array.isArray(content)) {
+        const textBlock = content.find((block) => block.type === 'text');
+        if (textBlock?.text)
+            return textBlock.text;
+    }
+    return '';
+}
+/**
+ * Compute Claude Code's cch token over the final serialized request body.
+ *
+ * Real Claude Code signs the full body bytes with xxHash64 using a fixed seed,
+ * masks to 20 bits, and writes that value into the billing-header placeholder.
+ */
+export async function computeCCH(bodyBytes) {
+    await ensureXxhash();
+    const hash = xxhash64Raw?.(bodyBytes, CCH_SEED) ?? 0n;
+    return (hash & 0xfffffn).toString(16).padStart(5, '0');
+}
+export async function signRequestBody(bodyString) {
+    if (!CCH_PATTERN.test(bodyString))
+        return bodyString;
+    const token = await computeCCH(new TextEncoder().encode(bodyString));
+    return bodyString.replace(CCH_PATTERN, `cch=${token};`);
+}
+/**
+ * Compute a stable 3-character suffix for cc_version.
+ *
+ * The previous implementation sampled the first user message, which could make
+ * the system billing header change with conversation content. Keep this suffix
+ * stable for a day so it resembles a rotating Claude Code fingerprint without
+ * busting prompt-cache prefixes on every turn.
+ */
+export function computeVersionSuffix(version = CLAUDE_CODE_VERSION, date = new Date()) {
+    const dayStamp = date.toISOString().slice(0, 10);
+    return createHash('sha256')
+        .update(`${dayStamp}${version}`)
+        .digest('hex')
+        .slice(0, 3);
+}
+/**
+ * Build the billing header with a cch placeholder.
+ * signRequestBody() must run after final request serialization to replace it.
+ */
+export function buildBillingHeaderValue(_messages, version = CLAUDE_CODE_VERSION, entrypoint, date = new Date()) {
+    const suffix = computeVersionSuffix(version, date);
+    return ('x-anthropic-billing-header: ' +
+        `cc_version=${version}.${suffix}; ` +
+        `cc_entrypoint=${entrypoint}; ` +
+        'cch=00000;');
+}

package/dist/constants.d.ts

@@ -0,0 +1,39 @@
+export declare const CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+export declare const AUTHORIZE_URLS: {
+    readonly console: "https://platform.claude.com/oauth/authorize";
+    readonly max: "https://claude.ai/oauth/authorize";
+};
+export declare const CODE_CALLBACK_URL = "https://platform.claude.com/oauth/code/callback";
+export declare const TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
+export declare const OAUTH_SCOPES: string[];
+export declare const TOOL_PREFIX = "mcp_";
+export declare const REQUIRED_BETAS: string[];
+export declare const OPENCODE_IDENTITY_PREFIX = "You are OpenCode";
+export declare const CLAUDE_CODE_IDENTITY = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
+export declare const CCH_SALT = "59cf53e54c78";
+export declare const CCH_POSITIONS: number[];
+export declare const CLAUDE_CODE_VERSION = "2.1.87";
+export declare const CLAUDE_CODE_ENTRYPOINT = "sdk-cli";
+export declare const USER_AGENT = "claude-cli/2.1.87 (external, cli)";
+export declare const CACHE_1H_MODES: readonly ["explicit", "automatic", "hybrid"];
+export type Cache1hMode = (typeof CACHE_1H_MODES)[number];
+export declare const DEFAULT_CACHE_1H_MODE: Cache1hMode;
+/**
+ * Anchors that identify paragraphs to remove from the system prompt.
+ * Any paragraph (text between blank lines) containing one of these
+ * strings is removed entirely.
+ *
+ * This is resilient to upstream rewording — as long as the anchor
+ * string (typically a URL) still appears somewhere in the paragraph,
+ * the removal works regardless of how the surrounding text changes.
+ */
+export declare const PARAGRAPH_REMOVAL_ANCHORS: string[];
+/**
+ * Inline text replacements applied after paragraph removal.
+ * These handle cases where "OpenCode" appears inside a paragraph
+ * we want to keep (so we can't remove the whole paragraph).
+ */
+export declare const TEXT_REPLACEMENTS: {
+    match: string;
+    replacement: string;
+}[];

package/dist/constants.js

@@ -0,0 +1,56 @@
+export const CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
+export const AUTHORIZE_URLS = {
+    console: 'https://platform.claude.com/oauth/authorize',
+    max: 'https://claude.ai/oauth/authorize',
+};
+export const CODE_CALLBACK_URL = 'https://platform.claude.com/oauth/code/callback';
+export const TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
+export const OAUTH_SCOPES = [
+    'org:create_api_key',
+    'user:profile',
+    'user:inference',
+    'user:sessions:claude_code',
+    'user:mcp_servers',
+    'user:file_upload',
+];
+export const TOOL_PREFIX = 'mcp_';
+export const REQUIRED_BETAS = [
+    'oauth-2025-04-20',
+    'interleaved-thinking-2025-05-14',
+];
+export const OPENCODE_IDENTITY_PREFIX = 'You are OpenCode';
+export const CLAUDE_CODE_IDENTITY = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
+export const CCH_SALT = '59cf53e54c78';
+export const CCH_POSITIONS = [4, 7, 20];
+export const CLAUDE_CODE_VERSION = '2.1.87';
+export const CLAUDE_CODE_ENTRYPOINT = 'sdk-cli';
+export const USER_AGENT = 'claude-cli/2.1.87 (external, cli)';
+export const CACHE_1H_MODES = ['explicit', 'automatic', 'hybrid'];
+export const DEFAULT_CACHE_1H_MODE = 'explicit';
+/**
+ * Anchors that identify paragraphs to remove from the system prompt.
+ * Any paragraph (text between blank lines) containing one of these
+ * strings is removed entirely.
+ *
+ * This is resilient to upstream rewording — as long as the anchor
+ * string (typically a URL) still appears somewhere in the paragraph,
+ * the removal works regardless of how the surrounding text changes.
+ */
+export const PARAGRAPH_REMOVAL_ANCHORS = [
+    // Help/feedback block — references the OpenCode GitHub repo
+    'github.com/anomalyco/opencode',
+    // OpenCode docs guidance — references the OpenCode docs URL
+    'opencode.ai/docs',
+];
+/**
+ * Inline text replacements applied after paragraph removal.
+ * These handle cases where "OpenCode" appears inside a paragraph
+ * we want to keep (so we can't remove the whole paragraph).
+ */
+export const TEXT_REPLACEMENTS = [
+    { match: 'if OpenCode honestly', replacement: 'if the assistant honestly' },
+    {
+        match: 'Here is some useful information about the environment you are running in:',
+        replacement: 'Environment context you are running in:',
+    },
+];

package/dist/dump.d.ts

@@ -0,0 +1,33 @@
+export declare const CLAUDE_DUMP_COMMAND_NAME = "claude-dump";
+export type DumpCommandAction = {
+    type: 'status';
+} | {
+    type: 'enable';
+} | {
+    type: 'disable';
+} | {
+    type: 'usage';
+};
+export declare function isDumpEnabled(): boolean;
+export declare function setDumpEnabled(enabled: boolean): void;
+export declare function resetDumpState(): void;
+export declare function getDumpDirectory(): string;
+export declare function parseDumpCommandAction(argumentsText: string): DumpCommandAction;
+export declare function buildDumpStatusSummary(input?: {
+    enabled?: boolean;
+}): string;
+export declare function executeDumpCommand(input: {
+    argumentsText: string;
+    enabled?: boolean;
+}): string;
+export declare function dumpRelayRequest(input: {
+    affinity: string;
+    transport: 'http' | 'websocket';
+    protocol: 1 | 2;
+    mode: 'full_sync' | 'patch';
+    status?: number;
+    bodyText: string;
+    previousBodyText?: string;
+    payload: unknown;
+    relayBytes: number;
+}): Promise<void>;

package/dist/dump.js

@@ -0,0 +1,218 @@
+import { createHash } from 'node:crypto';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { relayLog } from "./logger.js";
+export const CLAUDE_DUMP_COMMAND_NAME = 'claude-dump';
+const DUMP_STATUS_TITLE = '## Claude Dump Status';
+const DUMP_ENABLED_TITLE = '## Claude Dump Enabled';
+const DUMP_DISABLED_TITLE = '## Claude Dump Disabled';
+const DUMP_USAGE_TITLE = '## Claude Dump Usage';
+const DUMP_USAGE = 'Usage: `/claude-dump`, `/claude-dump on`, or `/claude-dump off`.';
+const DUMP_DIR = join(tmpdir(), 'opencode-anthropic-auth-dumps');
+let dumpEnabled = false;
+let nextDumpId = 0;
+export function isDumpEnabled() {
+    return dumpEnabled;
+}
+export function setDumpEnabled(enabled) {
+    dumpEnabled = enabled;
+}
+export function resetDumpState() {
+    dumpEnabled = false;
+}
+export function getDumpDirectory() {
+    return DUMP_DIR;
+}
+export function parseDumpCommandAction(argumentsText) {
+    const normalized = argumentsText.trim().split(/\s+/).filter(Boolean);
+    if (normalized.length === 0)
+        return { type: 'status' };
+    if (normalized.length === 1 && normalized[0] === 'on')
+        return { type: 'enable' };
+    if (normalized.length === 1 && normalized[0] === 'off')
+        return { type: 'disable' };
+    return { type: 'usage' };
+}
+export function buildDumpStatusSummary(input) {
+    const enabled = input?.enabled ?? dumpEnabled;
+    return [
+        DUMP_STATUS_TITLE,
+        '',
+        `- Enabled: ${enabled ? 'enabled' : 'disabled'}`,
+        `- Directory: ${DUMP_DIR}`,
+        '- Persisted: ~/.config/opencode/anthropic-auth.json',
+        '- Captures: final rewritten Anthropic body plus redacted relay payload metadata',
+        '- Warning: body dumps may contain prompt/session content; turn this off after debugging',
+    ].join('\n');
+}
+export function executeDumpCommand(input) {
+    const action = parseDumpCommandAction(input.argumentsText);
+    const enabled = input.enabled ?? dumpEnabled;
+    if (action.type === 'status')
+        return buildDumpStatusSummary({ enabled });
+    if (action.type === 'enable') {
+        return [
+            DUMP_ENABLED_TITLE,
+            '',
+            buildDumpStatusSummary({ enabled: true }),
+        ].join('\n');
+    }
+    if (action.type === 'disable') {
+        return [
+            DUMP_DISABLED_TITLE,
+            '',
+            buildDumpStatusSummary({ enabled: false }),
+        ].join('\n');
+    }
+    return [
+        DUMP_USAGE_TITLE,
+        '',
+        DUMP_USAGE,
+        '',
+        buildDumpStatusSummary({ enabled }),
+    ].join('\n');
+}
+function shortAffinity(affinity) {
+    return affinity.length <= 16 ? affinity : `${affinity.slice(0, 12)}…`;
+}
+function hashText(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function cchToken(bodyText) {
+    return bodyText.match(/\bcch=([0-9a-f]{5});/)?.[1] ?? null;
+}
+function diffSummary(previousBodyText, bodyText) {
+    if (previousBodyText == null)
+        return null;
+    if (previousBodyText === bodyText) {
+        return {
+            changed: false,
+            firstByte: -1,
+            lastPreviousByte: -1,
+            lastCurrentByte: -1,
+            previousBytes: previousBodyText.length,
+            currentBytes: bodyText.length,
+        };
+    }
+    let firstByte = 0;
+    while (firstByte < previousBodyText.length &&
+        firstByte < bodyText.length &&
+        previousBodyText[firstByte] === bodyText[firstByte]) {
+        firstByte += 1;
+    }
+    let previousTail = previousBodyText.length - 1;
+    let currentTail = bodyText.length - 1;
+    while (previousTail >= firstByte &&
+        currentTail >= firstByte &&
+        previousBodyText[previousTail] === bodyText[currentTail]) {
+        previousTail -= 1;
+        currentTail -= 1;
+    }
+    return {
+        changed: true,
+        firstByte,
+        lastPreviousByte: previousTail,
+        lastCurrentByte: currentTail,
+        changedPreviousBytes: previousTail - firstByte + 1,
+        changedCurrentBytes: currentTail - firstByte + 1,
+        previousBytes: previousBodyText.length,
+        currentBytes: bodyText.length,
+    };
+}
+function parseBody(bodyText) {
+    try {
+        const parsed = JSON.parse(bodyText);
+        return parsed != null &&
+            typeof parsed === 'object' &&
+            !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch (error) {
+        relayLog(`dump body parse failed: ${error instanceof Error ? error.message : String(error)}`);
+        return null;
+    }
+}
+function hashJson(value) {
+    return hashText(JSON.stringify(value));
+}
+function bodyStructureSummary(bodyText) {
+    const parsed = parseBody(bodyText);
+    if (!parsed)
+        return { parseable: false };
+    const messages = Array.isArray(parsed.messages) ? parsed.messages : [];
+    const system = Array.isArray(parsed.system) ? parsed.system : [];
+    const message0 = messages[0];
+    const messagesAfter0 = messages.slice(1);
+    return {
+        parseable: true,
+        model: typeof parsed.model === 'string' ? parsed.model : undefined,
+        stream: parsed.stream,
+        systemCount: system.length,
+        messagesCount: messages.length,
+        systemHash: hashJson(system),
+        message0Hash: message0 === undefined ? null : hashJson(message0),
+        message0Bytes: message0 === undefined ? 0 : JSON.stringify(message0).length,
+        messagesAfter0Hash: hashJson(messagesAfter0),
+        messagesAfter0Bytes: JSON.stringify(messagesAfter0).length,
+        cch: cchToken(bodyText),
+    };
+}
+function redactForDump(value) {
+    if (Array.isArray(value))
+        return value.map(redactForDump);
+    if (value == null || typeof value !== 'object')
+        return value;
+    const redacted = {};
+    for (const [key, entry] of Object.entries(value)) {
+        const lower = key.toLowerCase();
+        if (lower === 'authorization' ||
+            lower === 'x-api-key' ||
+            lower === 'cookie' ||
+            lower === 'set-cookie') {
+            redacted[key] = '[redacted]';
+            continue;
+        }
+        redacted[key] = redactForDump(entry);
+    }
+    return redacted;
+}
+export async function dumpRelayRequest(input) {
+    if (!dumpEnabled)
+        return;
+    nextDumpId += 1;
+    const id = `${new Date().toISOString().replace(/[:.]/g, '-')}-${String(nextDumpId).padStart(5, '0')}-${input.transport}-p${input.protocol}-${input.mode}`;
+    const prefix = join(DUMP_DIR, id);
+    try {
+        await mkdir(DUMP_DIR, { recursive: true });
+        const metadata = {
+            id,
+            createdAt: new Date().toISOString(),
+            session: shortAffinity(input.affinity),
+            transport: input.transport,
+            protocol: input.protocol,
+            mode: input.mode,
+            status: input.status,
+            bodyBytes: input.bodyText.length,
+            relayBytes: input.relayBytes,
+            bodyHash: hashText(input.bodyText),
+            diff: diffSummary(input.previousBodyText, input.bodyText),
+            body: bodyStructureSummary(input.bodyText),
+            files: {
+                body: `${prefix}.body.json`,
+                relay: `${prefix}.relay.json`,
+                metadata: `${prefix}.meta.json`,
+            },
+        };
+        await Promise.all([
+            writeFile(`${prefix}.body.json`, input.bodyText, 'utf8'),
+            writeFile(`${prefix}.relay.json`, `${JSON.stringify(redactForDump(input.payload), null, 2)}\n`, 'utf8'),
+            writeFile(`${prefix}.meta.json`, `${JSON.stringify(metadata, null, 2)}\n`, 'utf8'),
+        ]);
+        relayLog(`dumped request id=${id} session=${shortAffinity(input.affinity)} body=${prefix}.body.json meta=${prefix}.meta.json`);
+    }
+    catch (error) {
+        relayLog(`dump failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}