@cortexkit/anthropic-auth-core 1.16.0 → 1.17.0

package/dist/index.d.ts

@@ -13,8 +13,10 @@ export * from './killswitch.ts';
 export * from './logger.ts';
 export * from './logging.ts';
 export * from './models.ts';
+export * from './oauth-profile.ts';
 export * from './pkce.ts';
 export * from './provider.ts';
+export * from './quota-headers.ts';
 export * from './quota-manager.ts';
 export * from './quotas.ts';
 export * from './relay.ts';

package/dist/index.js

@@ -13,8 +13,10 @@ export * from "./killswitch.js";
 export * from "./logger.js";
 export * from "./logging.js";
 export * from "./models.js";
+export * from "./oauth-profile.js";
 export * from "./pkce.js";
 export * from "./provider.js";
+export * from "./quota-headers.js";
 export * from "./quota-manager.js";
 export * from "./quotas.js";
 export * from "./relay.js";

package/dist/oauth-profile.d.ts

@@ -0,0 +1,11 @@
+import type { OAuthAccountProfile } from './accounts.ts';
+export declare const PROFILE_TTL_MS: number;
+export declare function fetchOAuthAccountProfile(input: {
+    accessToken: string;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    signal?: AbortSignal;
+}): Promise<OAuthAccountProfile>;
+export declare function oauthProfileMatchesToken(profile: OAuthAccountProfile | undefined, accessToken: string): boolean;
+export declare function oauthProfileIsFresh(profile: OAuthAccountProfile | undefined, now?: number): boolean;
+export declare function formatOAuthAccountTier(profile: OAuthAccountProfile | undefined): string | undefined;

package/dist/oauth-profile.js

@@ -0,0 +1,48 @@
+import { tokenFingerprint } from "./quota-manager.js";
+const PROFILE_URL = 'https://api.anthropic.com/api/oauth/profile';
+export const PROFILE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+export async function fetchOAuthAccountProfile(input) {
+    const response = await (input.fetchImpl ?? fetch)(PROFILE_URL, {
+        method: 'GET',
+        signal: input.signal,
+        headers: {
+            Authorization: `Bearer ${input.accessToken}`,
+            Accept: 'application/json',
+            'anthropic-beta': 'oauth-2025-04-20',
+        },
+    });
+    if (!response.ok) {
+        throw new Error(`Claude profile check failed: ${response.status}`);
+    }
+    const value = (await response.json());
+    const tier = value.organization?.rate_limit_tier;
+    const orgType = value.organization?.organization_type;
+    if (typeof tier !== 'string' ||
+        tier.trim() === '' ||
+        typeof orgType !== 'string' ||
+        orgType.trim() === '') {
+        throw new Error('Claude profile response is missing account metadata');
+    }
+    return {
+        tier,
+        orgType,
+        checkedAt: input.now?.() ?? Date.now(),
+        tokenFingerprint: tokenFingerprint(input.accessToken),
+    };
+}
+export function oauthProfileMatchesToken(profile, accessToken) {
+    return profile?.tokenFingerprint === tokenFingerprint(accessToken);
+}
+export function oauthProfileIsFresh(profile, now = Date.now()) {
+    return Boolean(profile &&
+        Number.isFinite(profile.checkedAt) &&
+        now >= profile.checkedAt &&
+        now - profile.checkedAt < PROFILE_TTL_MS);
+}
+export function formatOAuthAccountTier(profile) {
+    const match = profile?.tier.match(/^default_claude_max_(\d+)x$/);
+    if (!match)
+        return undefined;
+    const label = `Max ${match[1]}x`;
+    return profile?.orgType === 'claude_team' ? `Team · ${label}` : label;
+}

package/dist/quota-headers.d.ts

@@ -0,0 +1,4 @@
+import type { OAuthQuotaSnapshot } from './accounts.ts';
+export declare function isQuotaBearingHeaderFrame(headers: Headers): boolean;
+export declare function normalizeQuotaHeaders(headers: Headers, now?: number): OAuthQuotaSnapshot;
+export declare function mergeHeaderQuotaSnapshot(existing: OAuthQuotaSnapshot | undefined, incoming: OAuthQuotaSnapshot): OAuthQuotaSnapshot;

package/dist/quota-headers.js

@@ -0,0 +1,66 @@
+const PREFIX = 'anthropic-ratelimit-unified-';
+const WINDOW_KEYS = {
+    '5h': 'five_hour',
+    '7d': 'seven_day',
+};
+export function isQuotaBearingHeaderFrame(headers) {
+    return Object.keys(WINDOW_KEYS).some((suffix) => Number.isFinite(finiteHeaderNumber(headers, `${PREFIX}${suffix}-utilization`)));
+}
+function finiteHeaderNumber(headers, name) {
+    const value = headers.get(name);
+    if (value == null || value.trim() === '')
+        return undefined;
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : undefined;
+}
+function normalizeWindow(headers, suffix, checkedAt) {
+    const utilization = finiteHeaderNumber(headers, `${PREFIX}${suffix}-utilization`);
+    if (utilization == null)
+        return undefined;
+    const usedPercent = Math.min(100, Math.max(0, Math.round(utilization * 100)));
+    const resetSeconds = finiteHeaderNumber(headers, `${PREFIX}${suffix}-reset`);
+    const resetDate = resetSeconds == null ? undefined : new Date(resetSeconds * 1000);
+    const resetsAt = resetDate && Number.isFinite(resetDate.getTime())
+        ? resetDate.toISOString()
+        : undefined;
+    return {
+        usedPercent,
+        remainingPercent: 100 - usedPercent,
+        ...(resetsAt && { resetsAt }),
+        checkedAt,
+    };
+}
+export function normalizeQuotaHeaders(headers, now = Date.now()) {
+    const snapshot = {
+        fallbackAdvised: headers.get(`${PREFIX}fallback`) === 'available',
+        source: 'headers',
+        checkedAt: now,
+    };
+    for (const [suffix, key] of Object.entries(WINDOW_KEYS)) {
+        const window = normalizeWindow(headers, suffix, now);
+        if (window)
+            snapshot[key] = window;
+    }
+    const representativeClaim = headers.get(`${PREFIX}representative-claim`);
+    if (representativeClaim) {
+        snapshot.bindingWindow = representativeClaim;
+        snapshot.bindingWindowSource = 'headers';
+    }
+    return snapshot;
+}
+export function mergeHeaderQuotaSnapshot(existing, incoming) {
+    return {
+        ...existing,
+        ...incoming,
+        scoped: existing && 'scoped' in existing ? existing.scoped : undefined,
+        extraUsage: existing?.extraUsage,
+        bindingWindow: existing?.bindingWindowSource === 'poll'
+            ? existing.bindingWindow
+            : (incoming.bindingWindow ?? existing?.bindingWindow),
+        bindingWindowSource: existing?.bindingWindowSource === 'poll'
+            ? 'poll'
+            : (incoming.bindingWindowSource ?? existing?.bindingWindowSource),
+        // Source tracks 5h/7d freshness; preserved scoped and credit fields remain poll-owned.
+        source: 'headers',
+    };
+}

package/dist/quota-manager.d.ts

@@ -6,12 +6,7 @@
  * Handles deduplication, rate-limiting (429 backoff), and staleness.
  */
 import type { AccountOperationError, AccountStorage, OAuthAccount, OAuthQuotaSnapshot } from './accounts.ts';
-/**
- * Stable, non-reversible fingerprint of an access token. Used to detect a
- * main-account switch so a different account's persisted/cached quota is never
- * reused. Not a secret — a truncated SHA-256, safe to persist alongside quota.
- */
-export declare function tokenFingerprint(token: string): string;
+export { tokenFingerprint } from './token-fingerprint.ts';
 export type QuotaEntry = {
     quota: OAuthQuotaSnapshot;
     refreshAfter: number;
@@ -60,6 +55,8 @@ export declare class QuotaManager {
     getAllFallbacks(): Map<string, QuotaEntry>;
     setMain(accessToken: string, entry: QuotaEntry): void;
     setFallback(accountId: string, entry: QuotaEntry, accessToken?: string): void;
+    pushMainFromHeaders(accessToken: string, incoming: OAuthQuotaSnapshot): QuotaEntry;
+    pushFallbackFromHeaders(accountId: string, accessToken: string, incoming: OAuthQuotaSnapshot): QuotaEntry;
     refreshMain(accessToken: string): Promise<OAuthQuotaSnapshot>;
     refreshFallback(accountId: string, accessToken: string): Promise<OAuthQuotaSnapshot>;
     refreshAllFallbacks(accounts: OAuthAccount[]): Promise<void>;

package/dist/quota-manager.js

@@ -5,17 +5,32 @@
  * share one QuotaManager instance so they see the same in-memory cache.
  * Handles deduplication, rate-limiting (429 backoff), and staleness.
  */
-import { createHash } from 'node:crypto';
 import { acquireRefreshFileLock, buildQuotaOperationError, fetchOAuthQuotaSnapshot, getPersistedMainQuota, getQuotaCheckIntervalMs, getQuotaNextRefreshAt, getQuotaRefreshEveryNRequests, getScopedQuotaWindowForModel, isQuotaPolicyAuthError, quotaBackoffActive, } from "./accounts.js";
+import { mergeHeaderQuotaSnapshot } from "./quota-headers.js";
+export { tokenFingerprint } from "./token-fingerprint.js";
+import { tokenFingerprint } from "./token-fingerprint.js";
 // Capture real setTimeout before tests can mock globalThis.setTimeout
 const nativeSetTimeout = globalThis.setTimeout;
-/**
- * Stable, non-reversible fingerprint of an access token. Used to detect a
- * main-account switch so a different account's persisted/cached quota is never
- * reused. Not a secret — a truncated SHA-256, safe to persist alongside quota.
- */
-export function tokenFingerprint(token) {
-    return createHash('sha256').update(token).digest('hex').slice(0, 16);
+function mergePollCompletionWithNewerHeaders(current, polled) {
+    if (current?.source !== 'headers')
+        return polled;
+    const fiveHourIsNewer = Boolean(current.five_hour &&
+        current.five_hour.checkedAt > (polled.five_hour?.checkedAt ?? 0));
+    const sevenDayIsNewer = Boolean(current.seven_day &&
+        current.seven_day.checkedAt > (polled.seven_day?.checkedAt ?? 0));
+    if (!fiveHourIsNewer && !sevenDayIsNewer)
+        return polled;
+    return mergeHeaderQuotaSnapshot(polled, {
+        ...(fiveHourIsNewer && { five_hour: current.five_hour }),
+        ...(sevenDayIsNewer && { seven_day: current.seven_day }),
+        fallbackAdvised: current.fallbackAdvised,
+        ...(current.bindingWindowSource === 'headers' && {
+            bindingWindow: current.bindingWindow,
+            bindingWindowSource: current.bindingWindowSource,
+        }),
+        source: 'headers',
+        checkedAt: Math.max(fiveHourIsNewer ? (current.five_hour?.checkedAt ?? 0) : 0, sevenDayIsNewer ? (current.seven_day?.checkedAt ?? 0) : 0),
+    });
 }
 // ---------------------------------------------------------------------------
 // Class
@@ -116,6 +131,29 @@ export class QuotaManager {
             this.fallbackTokenFps.delete(accountId);
         }
     }
+    pushMainFromHeaders(accessToken, incoming) {
+        const checkedAt = incoming.checkedAt ?? this.now();
+        const accessTokenFp = tokenFingerprint(accessToken);
+        const quota = mergeHeaderQuotaSnapshot(this.mainTokenFp === accessTokenFp ? this.main?.quota : undefined, incoming);
+        const entry = {
+            quota,
+            checkedAt,
+            refreshAfter: getQuotaNextRefreshAt(quota, this.storage, checkedAt),
+        };
+        this.setMain(accessToken, entry);
+        return entry;
+    }
+    pushFallbackFromHeaders(accountId, accessToken, incoming) {
+        const checkedAt = incoming.checkedAt ?? this.now();
+        const quota = mergeHeaderQuotaSnapshot(this.getFallback(accountId, accessToken)?.quota, incoming);
+        const entry = {
+            quota,
+            checkedAt,
+            refreshAfter: getQuotaNextRefreshAt(quota, this.storage, checkedAt),
+        };
+        this.setFallback(accountId, entry, accessToken);
+        return entry;
+    }
     // =========================================================================
     // Refresh (async, deduplicated, rate-limited)
     // =========================================================================
@@ -380,15 +418,16 @@ export class QuotaManager {
                         now: this.now,
                     });
                     const now = this.now();
+                    const completedQuota = mergePollCompletionWithNewerHeaders(this.mainTokenFp === thisFetchFp ? this.main?.quota : undefined, quota);
                     this.mainTokenFp = tokenFingerprint(accessToken);
                     this.main = {
-                        quota,
-                        refreshAfter: getQuotaNextRefreshAt(quota, this.storage, now),
-                        checkedAt: now,
+                        quota: completedQuota,
+                        refreshAfter: getQuotaNextRefreshAt(completedQuota, this.storage, now),
+                        checkedAt: completedQuota.checkedAt ?? now,
                     };
                     this.mainLastApiError = undefined;
-                    this.onMainQuotaFetched?.(quota, now, this.mainTokenFp, fetchStartedAt);
-                    return quota;
+                    this.onMainQuotaFetched?.(completedQuota, now, this.mainTokenFp, fetchStartedAt);
+                    return completedQuota;
                 }
                 catch (error) {
                     this._handleMainFetchError(error);
@@ -433,14 +472,15 @@ export class QuotaManager {
                         now: this.now,
                     });
                     const now = this.now();
+                    const completedQuota = mergePollCompletionWithNewerHeaders(this.getFallback(accountId, accessToken)?.quota, quota);
                     this.setFallback(accountId, {
-                        quota,
-                        refreshAfter: now + getQuotaCheckIntervalMs(this.storage),
-                        checkedAt: now,
+                        quota: completedQuota,
+                        refreshAfter: getQuotaNextRefreshAt(completedQuota, this.storage, now),
+                        checkedAt: completedQuota.checkedAt ?? now,
                     }, accessToken);
                     this.fallbackApiErrors.delete(accountId);
                     this.fallbackErrorTokenFps.delete(accountId);
-                    return quota;
+                    return completedQuota;
                 }
                 finally {
                     await fileLock.release();

package/dist/quotas.d.ts

@@ -1,4 +1,4 @@
-import type { AccountStorage, OAuthQuotaSnapshot } from './accounts.ts';
+import type { AccountStorage, OAuthQuotaSnapshot, QuotaMoney } from './accounts.ts';
 export declare const CLAUDE_QUOTAS_COMMAND_NAME = "claude-quota";
 export type QuotaAccountSummary = {
     name: string;
@@ -7,14 +7,17 @@ export type QuotaAccountSummary = {
     quota?: OAuthQuotaSnapshot;
     lastRefreshedAt?: number;
     error?: string;
+    tierLabel?: string;
 };
+export declare function formatQuotaMoney(money: QuotaMoney): string;
 export declare function buildFallbackQuotaSummaries(storage: AccountStorage | null, errors?: ReadonlyMap<string, string>): {
     error?: string | undefined;
+    lastRefreshedAt: number | undefined;
+    tierLabel?: string | undefined;
     name: string;
     role: "fallback";
     enabled: boolean;
     quota: OAuthQuotaSnapshot | undefined;
-    lastRefreshedAt: number | undefined;
 }[];
 export declare function buildClaudeQuotaSummary(input: {
     accounts: QuotaAccountSummary[];

package/dist/quotas.js

@@ -1,4 +1,5 @@
 import { isOAuthAccount } from "./accounts.js";
+import { formatOAuthAccountTier } from "./oauth-profile.js";
 export const CLAUDE_QUOTAS_COMMAND_NAME = 'claude-quota';
 const WINDOW_LABELS = {
     five_hour: '5h',
@@ -43,14 +44,28 @@ function formatReset(resetsAt, now) {
         return '';
     return `, resets ${formatResetDuration(resetsAt, now)}`;
 }
-function formatWindow(key, window, now) {
+function formatWindow(key, window, now, bindingWindow) {
     if (!window)
         return `  - ${WINDOW_LABELS[key]}: unknown`;
-    return [
+    const line = [
         `  - ${WINDOW_LABELS[key]}: ${formatPercent(window.remainingPercent)} remaining`,
         ` (${formatPercent(window.usedPercent)} used`,
         `${formatReset(window.resetsAt, now)}, checked ${formatAge(window.checkedAt, now)})`,
     ].join('');
+    return bindingWindow === key ? `${line} •` : line;
+}
+export function formatQuotaMoney(money) {
+    try {
+        return new Intl.NumberFormat('en-US', {
+            style: 'currency',
+            currency: money.currency,
+            minimumFractionDigits: money.exponent,
+            maximumFractionDigits: money.exponent,
+        }).format(money.amountMinor / 10 ** money.exponent);
+    }
+    catch {
+        return `${money.amountMinor} ${money.currency}`;
+    }
 }
 function formatScopedWindow(window, now) {
     return [
@@ -75,6 +90,9 @@ export function buildFallbackQuotaSummaries(storage, errors = new Map()) {
             role: 'fallback',
             enabled: account.enabled !== false,
             quota: account.quota,
+            ...(formatOAuthAccountTier(account.profile) && {
+                tierLabel: formatOAuthAccountTier(account.profile),
+            }),
             lastRefreshedAt: account.lastRefreshedAt,
             ...(error && { error }),
         };
@@ -94,16 +112,28 @@ export function buildClaudeQuotaSummary(input) {
         const role = account.role === 'main' ? 'main' : 'fallback';
         const disabled = account.enabled === false ? ' disabled' : '';
         lines.push(`### ${account.name} (${role}${disabled})`);
+        if (account.tierLabel)
+            lines.push(`  - Tier: ${account.tierLabel}`);
         if (account.lastRefreshedAt) {
             lines.push(`  - Last token refresh: ${formatAge(account.lastRefreshedAt, now)}`);
         }
         if (account.error) {
             lines.push(`  - Error: ${account.error}`);
         }
-        lines.push(formatWindow('five_hour', account.quota?.five_hour, now));
-        lines.push(formatWindow('seven_day', account.quota?.seven_day, now));
+        lines.push(formatWindow('five_hour', account.quota?.five_hour, now, account.quota?.bindingWindow));
+        lines.push(formatWindow('seven_day', account.quota?.seven_day, now, account.quota?.bindingWindow));
         for (const window of account.quota?.scoped ?? []) {
-            lines.push(formatScopedWindow(window, now));
+            const line = formatScopedWindow(window, now);
+            lines.push(account.quota?.bindingWindow === window.id ? `${line} •` : line);
+        }
+        const extraUsage = account.quota?.extraUsage;
+        if (extraUsage) {
+            const used = formatQuotaMoney(extraUsage.used);
+            const limit = formatQuotaMoney(extraUsage.limit);
+            lines.push(`  - credits ${used}/${limit}${extraUsage.exhausted ? ' · exhausted' : ''}`);
+        }
+        if (account.quota?.fallbackAdvised === true) {
+            lines.push('  - → fallback advised');
         }
         lines.push('');
     }

package/dist/relay.d.ts

@@ -24,5 +24,12 @@ export declare function sendViaRelay(options: {
     fallback: () => Promise<Response>;
     affinity?: string | null;
     optimisticResponse?: boolean;
+    /**
+     * Observes genuine upstream headers once per delivered response. WebSocket
+     * retries before downstream bytes replace staged headers, so the callback
+     * receives only the final accepted response; duplicate response_start frames
+     * within an attempt are ignored.
+     */
+    onResponseHeaders?: (headers: Headers) => void;
 }): Promise<Response>;
 export declare const WORKER_SCRIPT = "\nasync function hashBody(body) {\n  const bytes = new TextEncoder().encode(body)\n  const digest = await crypto.subtle.digest('SHA-256', bytes)\n  const hex = [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('')\n  return 'sha256:' + hex\n}\n\nfunction applyPatch(base, patch) {\n  return base.slice(0, patch.start) + patch.insert + base.slice(patch.start + patch.deleteCount)\n}\n\nfunction applyPatchSet(base, patch) {\n  if (!Array.isArray(patch)) return applyPatch(base, patch)\n  if (patch.length === 0) return base\n\n  let result = ''\n  let cursor = 0\n  for (const item of patch) {\n    if (item.start < cursor) return { error: 'overlapping patch', status: 400 }\n    result += base.slice(cursor, item.start)\n    result += item.insert\n    cursor = item.start + item.deleteCount\n  }\n  return result + base.slice(cursor)\n}\n\nasync function readState(env, affinity) {\n  const raw = await env.RELAY_STATE.get('session:' + affinity)\n  return raw ? JSON.parse(raw) : null\n}\n\nasync function writeState(env, affinity, state) {\n  await env.RELAY_STATE.put('session:' + affinity, JSON.stringify(state), { expirationTtl: 86400 })\n}\n\nasync function resolveBody(env, payload) {\n  if (payload.mode === 'full_sync') return payload.body\n  if (payload.mode === 'patch') {\n    const state = await readState(env, payload.affinity)\n    if (!state || state.hash !== payload.base_hash) {\n      return { error: 'state mismatch', status: 409 }\n    }\n    return applyPatchSet(state.body, payload.patch)\n  }\n  return { error: 'unknown mode', status: 400 }\n}\n\nasync function prepareUpstream(env, payload) {\n  if ((payload.protocol !== 1 && payload.protocol !== 2) || payload.type !== 'request' || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {\n    return { error: 'invalid payload', status: 400 }\n  }\n\n  const body = await resolveBody(env, payload)\n  if (body && typeof body === 'object' && 'error' in body) return body\n\n  if (typeof body !== 'string' || (await hashBody(body)) !== payload.next_hash) {\n    return { error: 'hash mismatch', status: 409 }\n  }\n\n  const stateWrite = writeState(env, payload.affinity, { body, hash: payload.next_hash, revision: payload.revision }).catch(() => {})\n  console.log(JSON.stringify({\n    relay: 'opencode-anthropic-auth',\n    transport: 'relay',\n    mode: payload.mode,\n    revision: payload.revision,\n    affinity: String(payload.affinity).slice(0, 12),\n    bodyBytes: body.length,\n  }))\n\n  return { body, stateWrite }\n}\n\nfunction resolveBodyFromState(state, payload) {\n  if (payload.mode === 'full_sync') return payload.body\n  if (payload.mode === 'patch') {\n    if (!state || state.hash !== payload.base_hash) {\n      return { error: 'state mismatch', status: 409 }\n    }\n    return applyPatchSet(state.body, payload.patch)\n  }\n  return { error: 'unknown mode', status: 400 }\n}\n\nfunction deferWorkerTask(task) {\n  return new Promise((resolve) => setTimeout(resolve, 0)).then(task)\n}\n\nconst WEBSOCKET_STREAM_FLUSH_BYTES = 1024\nconst WEBSOCKET_STREAM_FLUSH_MS = 20\n\nfunction createWebSocketStreamCoalescer(socket, options = {}) {\n  const flushBytes = options.flushBytes || WEBSOCKET_STREAM_FLUSH_BYTES\n  const flushMs = options.flushMs ?? WEBSOCKET_STREAM_FLUSH_MS\n  let chunks = []\n  let byteLength = 0\n  let flushTimer = null\n  const stats = {\n    upstreamChunks: 0,\n    upstreamBytes: 0,\n    frames: 0,\n    frameBytes: 0,\n  }\n\n  const clearFlushTimer = () => {\n    if (flushTimer === null) return\n    clearTimeout(flushTimer)\n    flushTimer = null\n  }\n\n  const mergeChunks = () => {\n    if (chunks.length === 1) return chunks[0]\n    const frame = new Uint8Array(byteLength)\n    let offset = 0\n    for (const chunk of chunks) {\n      frame.set(chunk, offset)\n      offset += chunk.byteLength\n    }\n    return frame\n  }\n\n  const flush = () => {\n    clearFlushTimer()\n    if (byteLength === 0) return\n    const frame = mergeChunks()\n    chunks = []\n    byteLength = 0\n    socket.send(frame)\n    stats.frames += 1\n    stats.frameBytes += frame.byteLength\n  }\n\n  const scheduleFlush = () => {\n    if (flushTimer !== null) return\n    flushTimer = setTimeout(flush, flushMs)\n  }\n\n  return {\n    push(value) {\n      const chunk = value instanceof Uint8Array ? value : new Uint8Array(value)\n      if (chunk.byteLength === 0) return\n      stats.upstreamChunks += 1\n      stats.upstreamBytes += chunk.byteLength\n      chunks.push(chunk)\n      byteLength += chunk.byteLength\n      if (byteLength >= flushBytes) flush()\n      else scheduleFlush()\n    },\n    flush,\n    stats() {\n      return { ...stats, pendingBytes: byteLength }\n    },\n  }\n}\n\nfunction checkpointWebSocketState(env, payload, body, nextState) {\n  return deferWorkerTask(async () => {\n    try {\n      if ((await hashBody(body)) !== payload.next_hash) {\n        throw new Error('hash mismatch')\n      }\n      await writeState(env, payload.affinity, nextState)\n    } catch (error) {\n      console.log(JSON.stringify({\n        relay: 'opencode-anthropic-auth',\n        transport: 'websocket',\n        event: 'checkpoint_write_failed',\n        affinity: String(payload.affinity).slice(0, 12),\n        message: error instanceof Error ? error.message : String(error),\n      }))\n    }\n  })\n}\n\nasync function prepareWebSocketUpstream(env, state, payload) {\n  if (payload.protocol !== 2 || payload.type !== 'request' || !payload.id || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {\n    return { error: 'invalid payload', status: 400 }\n  }\n\n  const body = resolveBodyFromState(state, payload)\n  if (body && typeof body === 'object' && 'error' in body) return body\n  if (typeof body !== 'string') return { error: 'invalid body', status: 400 }\n  if ((await hashBody(body)) !== payload.next_hash) {\n    return { error: 'hash mismatch', status: 409 }\n  }\n\n  const nextState = { body, hash: payload.next_hash, revision: payload.revision }\n  const checkpoint = checkpointWebSocketState(env, payload, body, nextState)\n  const logAccepted = () => console.log(JSON.stringify({\n    relay: 'opencode-anthropic-auth',\n    transport: 'websocket',\n    mode: payload.mode,\n    revision: payload.revision,\n    affinity: String(payload.affinity).slice(0, 12),\n    bodyBytes: body.length,\n  }))\n\n  return { body, state: nextState, checkpoint, logAccepted }\n}\n\nfunction headersToObject(headers) {\n  const result = {}\n  for (const [key, value] of headers.entries()) result[key] = value\n  return result\n}\n\nasync function handleRelayPayload(env, payload) {\n  const prepared = await prepareUpstream(env, payload)\n  if (prepared.error) return prepared\n  const upstream = await fetch(payload.upstream.url, {\n    method: payload.upstream.method || 'POST',\n    headers: payload.upstream.headers,\n    body: prepared.body,\n  })\n  return { upstream, stateWrite: prepared.stateWrite }\n}\n\nasync function handleWebSocket(socket, env, ctx, payload, getState, setState) {\n  const heartbeat = setInterval(() => {\n    try {\n      socket.send(JSON.stringify({ protocol: 2, type: 'keepalive' }))\n    } catch {\n      clearInterval(heartbeat)\n    }\n  }, 15000)\n  let streamCoalescer = null\n  try {\n    const result = await prepareWebSocketUpstream(env, getState(), payload)\n    if (result.error) {\n      socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: result.status, message: result.error }))\n      return\n    }\n\n    setState(result.state)\n    socket.send(JSON.stringify({ protocol: 2, type: 'accepted', id: payload.id, hash: result.state.hash, revision: result.state.revision }))\n    ctx?.waitUntil?.(deferWorkerTask(result.logAccepted))\n\n    const upstreamPromise = fetch(payload.upstream.url, {\n      method: payload.upstream.method || 'POST',\n      headers: payload.upstream.headers,\n      body: result.body,\n    })\n    ctx?.waitUntil?.(result.checkpoint)\n    const upstream = await upstreamPromise\n    socket.send(JSON.stringify({\n      protocol: 2,\n      type: 'response_start',\n      id: payload.id,\n      status: upstream.status,\n      statusText: upstream.statusText,\n      headers: headersToObject(upstream.headers),\n    }))\n\n    const reader = upstream.body?.getReader()\n    if (reader) {\n      streamCoalescer = createWebSocketStreamCoalescer(socket)\n      while (true) {\n        const { done, value } = await reader.read()\n        if (done) break\n        streamCoalescer.push(value)\n      }\n      streamCoalescer.flush()\n    }\n    const stats = streamCoalescer?.stats?.() || {}\n    socket.send(JSON.stringify({ protocol: 2, type: 'done', id: payload.id, ...stats }))\n  } catch (error) {\n    try {\n      streamCoalescer?.flush?.()\n    } catch {}\n    socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: 500, message: error instanceof Error ? error.message : String(error) }))\n  } finally {\n    clearInterval(heartbeat)\n  }\n}\n\nexport default {\n  async fetch(request, env, ctx) {\n    if (request.headers.get('Upgrade') === 'websocket') {\n      const url = new URL(request.url)\n      const token = url.searchParams.get('token')\n      const affinity = url.searchParams.get('affinity')\n      if (token !== env.RELAY_TOKEN) return new Response('unauthorized', { status: 401 })\n      if (!affinity) return new Response('missing affinity', { status: 400 })\n      const pair = new WebSocketPair()\n      const client = pair[0]\n      const server = pair[1]\n      server.binaryType = 'arraybuffer'\n      let state = null\n      let ready = false\n      server.accept()\n      const loadState = readState(env, affinity).then((loadedState) => {\n        state = loadedState\n        ready = true\n        server.send(JSON.stringify({\n          protocol: 2,\n          type: 'ready',\n          state: state ? { hash: state.hash, revision: state.revision } : null,\n        }))\n      }).catch((error) => {\n        server.send(JSON.stringify({ protocol: 2, type: 'error', status: 500, message: error instanceof Error ? error.message : String(error) }))\n        server.close(1011, 'state load failed')\n      })\n      ctx?.waitUntil?.(loadState)\n      if (!ctx?.waitUntil) void loadState\n      let busy = false\n      server.addEventListener('message', (event) => {\n        if (!ready) {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 425, message: 'relay state is not ready' }))\n          return\n        }\n        if (busy) {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 429, message: 'request already in flight' }))\n          return\n        }\n        let payload\n        try {\n          payload = JSON.parse(event.data)\n        } catch {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 400, message: 'invalid JSON payload' }))\n          return\n        }\n        payload.affinity = affinity\n        busy = true\n        const run = handleWebSocket(server, env, ctx, payload, () => state, (nextState) => { state = nextState }).finally(() => { busy = false })\n        ctx?.waitUntil?.(run)\n        if (!ctx?.waitUntil) void run\n      })\n      return new Response(null, { status: 101, webSocket: client })\n    }\n\n    if (request.method === 'GET') {\n      return Response.json({ status: 'ok', transports: ['http', 'websocket'] })\n    }\n    if (request.method !== 'POST') return new Response('method not allowed', { status: 405 })\n    if (request.headers.get('x-relay-token') !== env.RELAY_TOKEN) {\n      return new Response('unauthorized', { status: 401 })\n    }\n\n    try {\n      const payload = await request.json()\n      const result = await handleRelayPayload(env, payload)\n      if (result.error) return Response.json({ error: result.error }, { status: result.status })\n\n      if (result.stateWrite) ctx.waitUntil(result.stateWrite)\n\n      const upstream = result.upstream\n      return new Response(upstream.body, {\n        status: upstream.status,\n        statusText: upstream.statusText,\n        headers: upstream.headers,\n      })\n    } catch (error) {\n      return Response.json(\n        { error: error instanceof Error ? error.message : 'internal relay error' },\n        { status: 502 },\n      )\n    }\n  },\n}\n";

package/dist/relay.js

@@ -323,12 +323,12 @@ class PersistentRelaySession {
         this.serverState = undefined;
         this.connecting = undefined;
     }
-    send(payload, bodyText, optimisticResponse = false) {
+    send(payload, bodyText, optimisticResponse = false, onResponseHeaders) {
         this.touch();
         const enqueuedAt = perfNowMs();
         const start = this.queue
             .catch(() => { })
-            .then(() => this.startQueued(payload, bodyText, enqueuedAt, optimisticResponse));
+            .then(() => this.startQueued(payload, bodyText, enqueuedAt, optimisticResponse, onResponseHeaders));
         const result = start.then(async ({ response, getPayload }) => ({
             response: await response,
             payload: getPayload(),
@@ -339,7 +339,7 @@ class PersistentRelaySession {
         this.queue = start.then(({ done }) => done.catch(() => { }), () => { });
         return result;
     }
-    async startQueued(payload, bodyText, enqueuedAt, optimisticResponse) {
+    async startQueued(payload, bodyText, enqueuedAt, optimisticResponse, onResponseHeaders) {
         const connectStart = perfNowMs();
         await this.ensureConnected();
         const connectedAt = perfNowMs();
@@ -363,7 +363,7 @@ class PersistentRelaySession {
         }
         relayLog(`perf websocket send_start session=${shortAffinity(this.affinity)} request=${requestPayload.id} mode=${requestPayload.mode} queueMs=${formatMs(connectedAt - enqueuedAt)} connectMs=${formatMs(connectedAt - connectStart)} bodyBytes=${bodyText.length} relayBytes=${JSON.stringify(requestPayload).length}`);
         let activePayload = requestPayload;
-        const first = this.sendPayload(requestPayload, bodyText, optimisticResponse);
+        const first = this.sendPayload(requestPayload, bodyText, optimisticResponse, onResponseHeaders);
         void first.done.catch(() => { });
         let activeDone = first.done;
         const response = first.response.catch((error) => {
@@ -376,7 +376,7 @@ class PersistentRelaySession {
             fullSync.id = createRequestId();
             fullSync.revision = (this.serverState?.revision ?? 0) + 1;
             activePayload = fullSync;
-            const retry = this.sendPayload(fullSync, bodyText, optimisticResponse);
+            const retry = this.sendPayload(fullSync, bodyText, optimisticResponse, onResponseHeaders);
             void retry.done.catch(() => { });
             activeDone = retry.done;
             return retry.response;
@@ -457,7 +457,7 @@ class PersistentRelaySession {
         });
         await this.connecting;
     }
-    sendPayload(payload, bodyText, optimisticResponse) {
+    sendPayload(payload, bodyText, optimisticResponse, onResponseHeaders) {
         const socket = this.socket;
         if (!socket || socket.readyState !== WebSocket.OPEN) {
             throw new Error('relay websocket is not connected');
@@ -486,6 +486,9 @@ class PersistentRelaySession {
                 streamByteCount: 0,
                 retryAttempts: 0,
                 retryingBeforeResponse: false,
+                onResponseHeaders,
+                stagedResponseHeaders: undefined,
+                responseHeadersDelivered: false,
             };
             this.pending = pending;
             this.resetPendingTimeout(pending);
@@ -540,6 +543,8 @@ class PersistentRelaySession {
                 pending.accepted = false;
                 pending.acceptedAt = undefined;
                 pending.responseStartedAt = undefined;
+                pending.stagedResponseHeaders = undefined;
+                pending.responseHeadersDelivered = false;
                 pending.sentAt = perfNowMs();
                 pending.retryingBeforeResponse = false;
                 const socket = this.socket;
@@ -559,10 +564,21 @@ class PersistentRelaySession {
         return true;
     }
     enqueueStreamChunk(pending, chunk) {
+        this.deliverResponseHeaders(pending);
         pending.streamChunkCount += 1;
         pending.streamByteCount += chunk.byteLength;
         pending.streamController?.enqueue(chunk);
     }
+    deliverResponseHeaders(pending) {
+        if (pending.responseHeadersDelivered ||
+            pending.stagedResponseHeaders == null)
+            return;
+        pending.responseHeadersDelivered = true;
+        try {
+            pending.onResponseHeaders?.(pending.stagedResponseHeaders);
+        }
+        catch { }
+    }
     handleBinaryChunk(data) {
         const pending = this.pending;
         if (!pending?.responseStarted)
@@ -609,12 +625,17 @@ class PersistentRelaySession {
             return;
         }
         if (message.type === 'response_start') {
+            if (pending.responseStartedAt != null)
+                return;
             const responseStartedAt = perfNowMs();
             pending.responseStartedAt = responseStartedAt;
             relayLog(`perf websocket response_start session=${shortAffinity(this.affinity)} request=${pending.payload.id} sentMs=${formatMs(responseStartedAt - pending.sentAt)} upstreamMs=${pending.acceptedAt == null ? 'unknown' : formatMs(responseStartedAt - pending.acceptedAt)} status=${message.status}`);
             clearTimeout(pending.timeout);
+            if (message.headers)
+                pending.stagedResponseHeaders = new Headers(message.headers);
             this.resolvePendingResponse(pending, message.status, message.statusText, message.headers);
             if (pending.optimisticResponse && message.status >= 400) {
+                this.deliverResponseHeaders(pending);
                 pending.streamController?.enqueue(new TextEncoder().encode(`event: error\ndata: ${JSON.stringify({ type: 'error', error: { type: 'relay_upstream_error', message: `Relay upstream returned HTTP ${message.status}` } })}\n\n`));
                 this.finishPending();
             }
@@ -635,6 +656,7 @@ class PersistentRelaySession {
             // inject an SSE error event and close cleanly.
             if (pending.optimisticResponse && pending.responseStartedAt != null) {
                 relayLog(`websocket relay error during optimistic response session=${shortAffinity(this.affinity)} request=${pending.payload.id} status=${message.status} message=${message.message || 'unknown'} chunks=${pending.streamChunkCount} bytes=${pending.streamByteCount}`);
+                this.deliverResponseHeaders(pending);
                 pending.streamController?.enqueue(new TextEncoder().encode(`event: error\ndata: ${JSON.stringify({ type: 'error', error: { type: 'relay_error', message: message.message || 'relay error' } })}\n\n`));
                 this.finishPending();
                 this.socket?.close();
@@ -661,6 +683,7 @@ class PersistentRelaySession {
         relayLog(`perf websocket done session=${shortAffinity(this.affinity)} request=${pending.payload.id} sentMs=${formatMs(finishedAt - pending.sentAt)} streamMs=${pending.responseStartedAt == null ? 'unknown' : formatMs(finishedAt - pending.responseStartedAt)} chunks=${pending.streamChunkCount} bytes=${pending.streamByteCount}${workerStats}`);
         clearTimeout(pending.timeout);
         if (!pending.streamDone) {
+            this.deliverResponseHeaders(pending);
             pending.streamDone = true;
             pending.streamController?.close();
         }
@@ -727,7 +750,7 @@ function getPersistentRelaySession(config, affinity) {
     return session;
 }
 export async function sendViaRelay(options) {
-    const { config, input, init, headers, body, fallback, affinity: explicitAffinity, optimisticResponse, } = options;
+    const { config, input, init, headers, body, fallback, affinity: explicitAffinity, optimisticResponse, onResponseHeaders, } = options;
     if (!config || !isRelayableAnthropicRequest(input, body))
         return fallback();
     const affinity = explicitAffinity ||
@@ -769,7 +792,7 @@ export async function sendViaRelay(options) {
         if (config.transport === 'websocket') {
             try {
                 const session = getPersistentRelaySession(config, affinity);
-                result = await session.send(payload, bodyText, optimisticResponse === true);
+                result = await session.send(payload, bodyText, optimisticResponse === true, onResponseHeaders);
             }
             catch (error) {
                 relayLog(`websocket relay failed session=${shortAffinity(affinity)}; trying http relay: ${error instanceof Error ? error.message : String(error)}`);
@@ -802,6 +825,12 @@ export async function sendViaRelay(options) {
         });
         if (!result.usedRelay)
             return result.response;
+        if (result.transport === 'http') {
+            try {
+                onResponseHeaders?.(result.response.headers);
+            }
+            catch { }
+        }
         if (result.transport === 'http') {
             updateLocalRelayState(affinity, bodyText, result.payload.next_hash, result.payload.revision);
         }

package/dist/token-fingerprint.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Stable, non-reversible fingerprint used to bind persisted state to an access
+ * token without storing another copy of the credential.
+ */
+export declare function tokenFingerprint(token: string): string;

package/dist/token-fingerprint.js

@@ -0,0 +1,8 @@
+import { createHash } from 'node:crypto';
+/**
+ * Stable, non-reversible fingerprint used to bind persisted state to an access
+ * token without storing another copy of the credential.
+ */
+export function tokenFingerprint(token) {
+    return createHash('sha256').update(token).digest('hex').slice(0, 16);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "1.16.0",
+  "version": "1.17.0",
   "type": "module",
   "repository": {
     "type": "git",