@cortexkit/anthropic-auth-core 1.19.1 → 1.21.0

package/dist/dump.d.ts

@@ -9,6 +9,11 @@ export type DumpCommandAction = {
 } | {
     type: 'usage';
 };
+export type DumpTag = 'cachekeep' | 'start';
+export type DumpHandle = {
+    responsePath: string;
+    tag?: DumpTag;
+};
 export declare function isDumpEnabled(): boolean;
 export declare function setDumpEnabled(enabled: boolean): void;
 export declare function resetDumpState(): void;
@@ -49,7 +54,8 @@ export declare function dumpDirectRequest(input: {
     url?: string;
     method?: string;
     headers?: DumpHeaders;
-}): Promise<void>;
+    tag?: DumpTag;
+}): Promise<DumpHandle | null>;
 export declare function dumpRelayRequest(input: {
     affinity: string;
     transport: 'http' | 'websocket';
@@ -60,5 +66,11 @@ export declare function dumpRelayRequest(input: {
     previousBodyText?: string;
     payload: unknown;
     relayBytes: number;
+    tag?: DumpTag;
+}): Promise<DumpHandle | null>;
+export declare function dumpResponseArtifact(handle: DumpHandle | null, input: {
+    status: number;
+    message: unknown;
+    complete?: boolean;
 }): Promise<void>;
 export {};

package/dist/dump.js

@@ -1,9 +1,9 @@
 import { createHash, randomBytes } from 'node:crypto';
-import { lstat, mkdir, readdir, rename, unlink, writeFile, } from 'node:fs/promises';
+import { lstat, mkdir, readdir, readFile, rename, unlink, writeFile, } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
-import { extractBillingHeaderCCH } from "./cch.js";
-import { isSecretKey, logger, relayLog } from "./logger.js";
+import { extractBillingHeaderCCH } from './cch.js';
+import { isSecretKey, logger, relayLog } from './logger.js';
 export const CLAUDE_DUMP_COMMAND_NAME = 'claude-dump';
 const DUMP_STATUS_TITLE = '## Claude Dump Status';
 const DUMP_ENABLED_TITLE = '## Claude Dump Enabled';
@@ -17,12 +17,14 @@ const DEFAULT_DUMP_MAX_BYTES = 512 * 1024 * 1024;
 const DUMP_SWEEP_INTERVAL_MS = 5 * 60 * 1000;
 const DUMP_SWEEP_NEWNESS_FLOOR_MS = 60 * 1000;
 const DUMP_PARTIAL_STALE_MS = 10 * 60 * 1000;
-const DUMP_ARTIFACT_SUFFIX_PATTERN = /\.(body|meta|relay|request)\.json$/;
+const DUMP_ARTIFACT_SUFFIX_PATTERN = /\.(body|meta|relay|request|response)\.json$/;
 // Earlier builds emitted five-digit counters; current counters grow without truncation.
 const DUMP_ARTIFACT_ID_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z-\d{5,}-(.+)$/;
 const DUMP_SEGMENT_PATTERN = '[a-zA-Z0-9._-]';
 const DIRECT_DUMP_PATTERN = new RegExp(`^${DUMP_SEGMENT_PATTERN}{1,80}-direct(?:-${DUMP_SEGMENT_PATTERN}{1,80})?$`);
 const RELAY_DUMP_PATTERN = new RegExp(`^${DUMP_SEGMENT_PATTERN}{1,80}-(?:http|websocket)-p[12]-(?:full_sync|patch)$`);
+const DIRECT_DUMP_SUFFIX_PATTERN = new RegExp(`^-direct(?:-${DUMP_SEGMENT_PATTERN}{1,80})?$`);
+const RELAY_DUMP_SUFFIX_PATTERN = /^-(?:http|websocket)-p[12]-(?:full_sync|patch)$/;
 let dumpEnabled = false;
 let nextDumpId = 0;
 let lastDumpSweepAt = 0;
@@ -136,6 +138,9 @@ export async function sweepDumpDirectory(options) {
                     size: stats.size,
                     mtimeMs: stats.mtimeMs,
                     partial,
+                    ...(!partial && {
+                        artifactGroup: entry.name.replace(DUMP_ARTIFACT_SUFFIX_PATTERN, ''),
+                    }),
                 });
             }
             catch {
@@ -143,18 +148,9 @@ export async function sweepDumpDirectory(options) {
             }
         }));
         let totalBytes = files.reduce((total, file) => total + file.size, 0);
-        files.sort((left, right) => left.mtimeMs - right.mtimeMs || left.path.localeCompare(right.path));
         let removed = 0;
         let freedBytes = 0;
-        for (const file of files) {
-            if (protectedPaths.has(resolve(file.path)))
-                continue;
-            const ageMs = now - file.mtimeMs;
-            const stalePartial = file.partial && ageMs >= partialStaleMs;
-            if (!stalePartial && totalBytes <= maxBytes)
-                continue;
-            if (file.partial ? !stalePartial : ageMs < minAgeMs)
-                continue;
+        const removeFile = async (file) => {
             try {
                 await unlink(file.path);
                 totalBytes -= file.size;
@@ -164,6 +160,43 @@ export async function sweepDumpDirectory(options) {
             catch {
                 // Dump cleanup is best-effort and must not affect request handling.
             }
+        };
+        // Partials are not usable dump records. Reclaim stale ones independently,
+        // including while the completed-artifact set is already below the cap.
+        const partials = files
+            .filter((file) => file.partial)
+            .sort((left, right) => left.mtimeMs - right.mtimeMs || left.path.localeCompare(right.path));
+        for (const file of partials) {
+            if (protectedPaths.has(resolve(file.path)))
+                continue;
+            if (now - file.mtimeMs < partialStaleMs)
+                continue;
+            await removeFile(file);
+        }
+        const artifactGroups = new Map();
+        for (const file of files) {
+            if (file.partial || !file.artifactGroup)
+                continue;
+            const group = artifactGroups.get(file.artifactGroup) ?? {
+                files: [],
+                newestMtimeMs: 0,
+            };
+            group.files.push(file);
+            group.newestMtimeMs = Math.max(group.newestMtimeMs, file.mtimeMs);
+            artifactGroups.set(file.artifactGroup, group);
+        }
+        const completedGroups = [...artifactGroups.entries()].sort(([leftName, left], [rightName, right]) => left.newestMtimeMs - right.newestMtimeMs ||
+            leftName.localeCompare(rightName));
+        for (const [, group] of completedGroups) {
+            if (totalBytes <= maxBytes)
+                break;
+            if (now - group.newestMtimeMs < minAgeMs)
+                continue;
+            if (group.files.some((file) => protectedPaths.has(resolve(file.path)))) {
+                continue;
+            }
+            for (const file of group.files)
+                await removeFile(file);
         }
         if (removed > 0) {
             logger.debug('dump', 'removed old dump files', { removed, freedBytes });
@@ -233,14 +266,16 @@ export function executeDumpCommand(input) {
 function shortAffinity(affinity) {
     return affinity.length <= 16 ? affinity : `${affinity.slice(0, 12)}…`;
 }
-function dumpFileSessionSegment(affinity) {
+function dumpFileSessionSegment(affinity, maxLength = 80) {
     const normalized = affinity
         .trim()
         .replace(/[^a-zA-Z0-9._-]+/g, '-')
         .replace(/^-+|-+$/g, '');
     if (!normalized)
         return 'session-unknown';
-    return normalized.length <= 80 ? normalized : normalized.slice(0, 80);
+    return normalized.length <= maxLength
+        ? normalized
+        : normalized.slice(0, maxLength);
 }
 function dumpRequestSegment(input) {
     if (input.transport !== 'direct') {
@@ -249,12 +284,85 @@ function dumpRequestSegment(input) {
     const route = input.route ? `-${dumpFileSessionSegment(input.route)}` : '';
     return `direct${route}`;
 }
+function dumpTagSegment(tag) {
+    if (tag === 'cachekeep')
+        return '-prewarm-cachekeep';
+    if (tag === 'start')
+        return '-start';
+    return '';
+}
 function directDumpPreviousKey(input) {
     const affinity = input.affinity?.trim();
     if (affinity)
         return `session:${affinity}`;
     return `request:${input.route ?? 'direct'}:${input.url ?? ''}`;
 }
+function dumpBodyTagForAffinity(name, affinity) {
+    if (!name.endsWith('.body.json'))
+        return undefined;
+    const stem = name.replace(DUMP_ARTIFACT_SUFFIX_PATTERN, '');
+    const requestPath = DUMP_ARTIFACT_ID_PATTERN.exec(stem)?.[1];
+    if (!requestPath ||
+        (!DIRECT_DUMP_PATTERN.test(requestPath) &&
+            !RELAY_DUMP_PATTERN.test(requestPath))) {
+        return undefined;
+    }
+    const cachekeepTag = dumpTagSegment('cachekeep');
+    const candidates = [
+        { prefix: dumpFileSessionSegment(affinity), tag: null },
+        {
+            prefix: `${dumpFileSessionSegment(affinity, 80 - cachekeepTag.length)}${cachekeepTag}`,
+            tag: 'cachekeep',
+        },
+    ];
+    for (const candidate of candidates) {
+        if (!requestPath.startsWith(`${candidate.prefix}-`))
+            continue;
+        const suffix = requestPath.slice(candidate.prefix.length);
+        if (DIRECT_DUMP_SUFFIX_PATTERN.test(suffix) ||
+            RELAY_DUMP_SUFFIX_PATTERN.test(suffix)) {
+            return candidate.tag;
+        }
+    }
+    return undefined;
+}
+async function loadLatestDumpBody(input) {
+    const affinity = input.affinity?.trim();
+    if (!affinity)
+        return undefined;
+    const dumpDir = getDumpDirectory();
+    let names;
+    try {
+        names = await readdir(dumpDir);
+    }
+    catch {
+        return undefined;
+    }
+    const candidates = names
+        .map((name) => ({ name, tag: dumpBodyTagForAffinity(name, affinity) }))
+        .filter((candidate) => candidate.tag !== undefined)
+        .sort((a, b) => b.name.localeCompare(a.name));
+    for (const candidate of candidates) {
+        try {
+            const path = join(dumpDir, candidate.name);
+            const metadataPath = path.replace(/\.body\.json$/, '.meta.json');
+            if (!(await lstat(path)).isFile())
+                continue;
+            const metadata = JSON.parse(await readFile(metadataPath, 'utf8'));
+            if (metadata.session !== shortAffinity(affinity) ||
+                (candidate.tag === null
+                    ? metadata.tag != null
+                    : metadata.tag !== candidate.tag)) {
+                continue;
+            }
+            return await readFile(path, 'utf8');
+        }
+        catch {
+            // A concurrent sweep can remove the newest artifact; try its predecessor.
+        }
+    }
+    return undefined;
+}
 function rememberDirectDumpBody(key, bodyText) {
     if (!directDumpPreviousBodies.has(key)) {
         while (directDumpPreviousBodies.size >= DIRECT_DUMP_PREVIOUS_BODY_LIMIT) {
@@ -376,15 +484,17 @@ function redactForDump(value) {
 }
 async function dumpRequest(input) {
     if (!dumpEnabled)
-        return;
+        return null;
     nextDumpId += 1;
     const affinity = input.affinity?.trim() || 'session-unknown';
-    const id = `${new Date().toISOString().replace(/[:.]/g, '-')}-${String(nextDumpId).padStart(6, '0')}-${dumpFileSessionSegment(affinity)}-${dumpRequestSegment(input)}`;
+    const tagSegment = dumpTagSegment(input.tag);
+    const id = `${new Date().toISOString().replace(/[:.]/g, '-')}-${String(nextDumpId).padStart(6, '0')}-${dumpFileSessionSegment(affinity, 80 - tagSegment.length)}${tagSegment}-${dumpRequestSegment(input)}`;
     const dumpDir = getDumpDirectory();
     const prefix = join(dumpDir, id);
     const files = {
         body: `${prefix}.body.json`,
         metadata: `${prefix}.meta.json`,
+        response: `${prefix}.response.json`,
     };
     if (input.payload !== undefined)
         files.relay = `${prefix}.relay.json`;
@@ -392,6 +502,7 @@ async function dumpRequest(input) {
         files.request = `${prefix}.request.json`;
     try {
         await mkdir(dumpDir, { recursive: true });
+        const previousBodyText = input.previousBodyText ?? (await loadLatestDumpBody(input));
         const metadata = {
             id,
             createdAt: new Date().toISOString(),
@@ -402,10 +513,11 @@ async function dumpRequest(input) {
             route: input.route,
             status: input.status,
             error: input.error,
+            tag: input.tag,
             bodyBytes: input.bodyText.length,
             relayBytes: input.relayBytes,
             bodyHash: hashText(input.bodyText),
-            diff: diffSummary(input.previousBodyText, input.bodyText),
+            diff: diffSummary(previousBodyText, input.bodyText),
             body: bodyStructureSummary(input.bodyText),
             files,
         };
@@ -428,14 +540,19 @@ async function dumpRequest(input) {
     }
     catch (error) {
         relayLog(`dump failed: ${error instanceof Error ? error.message : String(error)}`);
+        return null;
     }
+    return {
+        responsePath: files.response,
+        ...(input.tag ? { tag: input.tag } : {}),
+    };
 }
 export async function dumpDirectRequest(input) {
     if (!dumpEnabled)
-        return;
+        return null;
     const previousKey = directDumpPreviousKey(input);
     const previousBodyText = directDumpPreviousBodies.get(previousKey);
-    await dumpRequest({
+    const handle = await dumpRequest({
         affinity: input.affinity,
         transport: 'direct',
         route: input.route,
@@ -448,11 +565,13 @@ export async function dumpDirectRequest(input) {
             method: input.method,
             headers: input.headers,
         },
+        tag: input.tag,
     });
     rememberDirectDumpBody(previousKey, input.bodyText);
+    return handle;
 }
 export async function dumpRelayRequest(input) {
-    await dumpRequest({
+    return dumpRequest({
         affinity: input.affinity,
         transport: input.transport,
         protocol: input.protocol,
@@ -462,5 +581,35 @@ export async function dumpRelayRequest(input) {
         previousBodyText: input.previousBodyText,
         payload: input.payload,
         relayBytes: input.relayBytes,
+        tag: input.tag,
     });
 }
+export async function dumpResponseArtifact(handle, input) {
+    if (!handle)
+        return;
+    const message = input.message != null &&
+        typeof input.message === 'object' &&
+        !Array.isArray(input.message)
+        ? input.message
+        : {};
+    const artifact = {
+        status: input.status,
+        stream_complete: input.complete ?? true,
+    };
+    if (typeof message.id === 'string' && message.id.length > 0)
+        artifact.message_id = message.id;
+    if (typeof message.model === 'string' && message.model.length > 0)
+        artifact.model = message.model;
+    if (Object.hasOwn(message, 'usage'))
+        artifact.usage = message.usage;
+    if (Object.hasOwn(message, 'diagnostics'))
+        artifact.diagnostics = message.diagnostics;
+    if (typeof message.stop_reason === 'string' && message.stop_reason.length > 0)
+        artifact.stop_reason = message.stop_reason;
+    try {
+        await writeDumpFile(handle.responsePath, `${JSON.stringify(artifact, null, 2)}\n`);
+    }
+    catch (error) {
+        relayLog(`dump response failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}

package/dist/index.d.ts

@@ -15,10 +15,13 @@ export * from './logging.ts';
 export * from './models.ts';
 export * from './oauth-profile.ts';
 export * from './pkce.ts';
+export * from './prime.ts';
 export * from './provider.ts';
+export * from './quota-header-feed.ts';
 export * from './quota-headers.ts';
 export * from './quota-manager.ts';
 export * from './quotas.ts';
 export * from './relay.ts';
 export * from './routing.ts';
+export * from './start.ts';
 export * from './sticky-routing.ts';

package/dist/index.js

@@ -1,24 +1,27 @@
-export * from "./accounts.js";
-export * from "./auth.js";
-export * from "./cache1h.js";
-export * from "./cachekeep.js";
-export * from "./cachekeep-registry.js";
-export * from "./cch.js";
-export * from "./claude-code.js";
-export * from "./commands/account.js";
-export * from "./constants.js";
-export * from "./dump.js";
-export * from "./fast.js";
-export * from "./killswitch.js";
-export * from "./logger.js";
-export * from "./logging.js";
-export * from "./models.js";
-export * from "./oauth-profile.js";
-export * from "./pkce.js";
-export * from "./provider.js";
-export * from "./quota-headers.js";
-export * from "./quota-manager.js";
-export * from "./quotas.js";
-export * from "./relay.js";
-export * from "./routing.js";
-export * from "./sticky-routing.js";
+export * from './accounts.js';
+export * from './auth.js';
+export * from './cache1h.js';
+export * from './cachekeep.js';
+export * from './cachekeep-registry.js';
+export * from './cch.js';
+export * from './claude-code.js';
+export * from './commands/account.js';
+export * from './constants.js';
+export * from './dump.js';
+export * from './fast.js';
+export * from './killswitch.js';
+export * from './logger.js';
+export * from './logging.js';
+export * from './models.js';
+export * from './oauth-profile.js';
+export * from './pkce.js';
+export * from './prime.js';
+export * from './provider.js';
+export * from './quota-header-feed.js';
+export * from './quota-headers.js';
+export * from './quota-manager.js';
+export * from './quotas.js';
+export * from './relay.js';
+export * from './routing.js';
+export * from './start.js';
+export * from './sticky-routing.js';

package/dist/killswitch.js

@@ -1,4 +1,4 @@
-import { DEFAULT_KILLSWITCH_THRESHOLDS as DEFAULT_THRESHOLDS, normalizeKillswitchThresholds, } from "./accounts.js";
+import { DEFAULT_KILLSWITCH_THRESHOLDS as DEFAULT_THRESHOLDS, normalizeKillswitchThresholds, } from './accounts.js';
 export const KILLSWITCH_COMMAND_NAME = 'claude-killswitch';
 export function parseKillswitchCommandAction(argumentsText) {
     const parts = argumentsText.trim().split(/\s+/).filter(Boolean);

package/dist/models.d.ts

@@ -1,10 +1,26 @@
 export declare const CLAUDE_FABLE_5_MODEL_ID = "claude-fable-5";
 export declare const CLAUDE_MYTHOS_5_MODEL_ID = "claude-mythos-5";
+/**
+ * Haiku 4.5 model identifier used by `/claude-prime` to start each OAuth
+ * account's five-hour quota window with a minimal request. Usage is measured
+ * from response accounting. Kept distinct from the Fable/Mythos pricing block
+ * above so per-million-token cost estimation does not conflate families.
+ */
+export declare const CLAUDE_HAIKU_4_5_MODEL_ID = "claude-haiku-4-5";
+/**
+ * Per-million-token USD pricing for Haiku 4.5. Used to project the cumulative
+ * cost of prime requests from persisted usage counters — never persisted on
+ * disk; derive at display time so future pricing revisions land in one place.
+ */
+export declare const CLAUDE_HAIKU_4_5_PRICING: {
+    readonly input: 1;
+    readonly output: 5;
+};
 export declare const CLAUDE_FABLE_MYTHOS_5_MODEL_IDS: readonly ["claude-fable-5", "claude-mythos-5"];
 export type ClaudeFableMythos5ModelId = (typeof CLAUDE_FABLE_MYTHOS_5_MODEL_IDS)[number];
 export declare const CLAUDE_FABLE_MYTHOS_5_SUMMARIZED_THINKING: {
-    readonly type: "adaptive";
-    readonly display: "summarized";
+    readonly type: 'adaptive';
+    readonly display: 'summarized';
 };
 export declare const CLAUDE_FABLE_MYTHOS_5_PRICING: {
     readonly input: 10;
@@ -30,8 +46,8 @@ export declare const CLAUDE_SONNET_5_MODEL_ID = "claude-sonnet-5";
  * shape because the API contract is identical.
  */
 export declare const CLAUDE_SONNET_5_ADAPTIVE_THINKING: {
-    readonly type: "adaptive";
-    readonly display: "summarized";
+    readonly type: 'adaptive';
+    readonly display: 'summarized';
 };
 export declare function isClaudeSonnet5Model(model: unknown): boolean;
 export declare const CLAUDE_OPUS_5_MODEL_ID = "claude-opus-5";
@@ -44,8 +60,8 @@ export declare const CLAUDE_OPUS_5_MODEL_ID = "claude-opus-5";
  * only changes this re-export, not every call site.
  */
 export declare const CLAUDE_OPUS_5_ADAPTIVE_THINKING: {
-    readonly type: "adaptive";
-    readonly display: "summarized";
+    readonly type: 'adaptive';
+    readonly display: 'summarized';
 };
 export declare function isClaudeOpus5Model(model: unknown): boolean;
 export declare function isOpenAIReasoningSignature(value: unknown): boolean;

package/dist/models.js

@@ -1,5 +1,21 @@
 export const CLAUDE_FABLE_5_MODEL_ID = 'claude-fable-5';
 export const CLAUDE_MYTHOS_5_MODEL_ID = 'claude-mythos-5';
+/**
+ * Haiku 4.5 model identifier used by `/claude-prime` to start each OAuth
+ * account's five-hour quota window with a minimal request. Usage is measured
+ * from response accounting. Kept distinct from the Fable/Mythos pricing block
+ * above so per-million-token cost estimation does not conflate families.
+ */
+export const CLAUDE_HAIKU_4_5_MODEL_ID = 'claude-haiku-4-5';
+/**
+ * Per-million-token USD pricing for Haiku 4.5. Used to project the cumulative
+ * cost of prime requests from persisted usage counters — never persisted on
+ * disk; derive at display time so future pricing revisions land in one place.
+ */
+export const CLAUDE_HAIKU_4_5_PRICING = {
+    input: 1,
+    output: 5,
+};
 export const CLAUDE_FABLE_MYTHOS_5_MODEL_IDS = [
     CLAUDE_FABLE_5_MODEL_ID,
     CLAUDE_MYTHOS_5_MODEL_ID,

package/dist/oauth-profile.d.ts

@@ -2,10 +2,11 @@ import type { OAuthAccountProfile } from './accounts.ts';
 export declare const PROFILE_TTL_MS: number;
 export declare function fetchOAuthAccountProfile(input: {
     accessToken: string;
+    accountIdentity?: string;
     fetchImpl?: typeof fetch;
     now?: () => number;
     signal?: AbortSignal;
 }): Promise<OAuthAccountProfile>;
-export declare function oauthProfileMatchesToken(profile: OAuthAccountProfile | undefined, accessToken: string): boolean;
+export declare function oauthProfileMatchesIdentity(profile: OAuthAccountProfile | undefined, accountIdentity: string | undefined): boolean;
 export declare function oauthProfileIsFresh(profile: OAuthAccountProfile | undefined, now?: number): boolean;
 export declare function formatOAuthAccountTier(profile: OAuthAccountProfile | undefined): string | undefined;

package/dist/oauth-profile.js

@@ -1,4 +1,3 @@
-import { tokenFingerprint } from "./quota-manager.js";
 const PROFILE_URL = 'https://api.anthropic.com/api/oauth/profile';
 export const PROFILE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 export async function fetchOAuthAccountProfile(input) {
@@ -27,11 +26,18 @@ export async function fetchOAuthAccountProfile(input) {
         tier,
         orgType,
         checkedAt: input.now?.() ?? Date.now(),
-        tokenFingerprint: tokenFingerprint(input.accessToken),
+        ...(input.accountIdentity !== undefined && {
+            accountIdentity: input.accountIdentity,
+        }),
     };
 }
-export function oauthProfileMatchesToken(profile, accessToken) {
-    return profile?.tokenFingerprint === tokenFingerprint(accessToken);
+export function oauthProfileMatchesIdentity(profile, accountIdentity) {
+    if (!profile)
+        return false;
+    if (accountIdentity === undefined)
+        return true;
+    return (profile.accountIdentity === undefined ||
+        profile.accountIdentity === accountIdentity);
 }
 export function oauthProfileIsFresh(profile, now = Date.now()) {
     return Boolean(profile &&