@cortexkit/anthropic-auth-core 1.21.0 → 1.23.0

package/dist/auth.js

@@ -1,4 +1,6 @@
+import { assertNotCustodyTombstone } from './claustrum.js';
 import { AUTHORIZE_URLS, AXIOS_USER_AGENT, CLIENT_ID, CODE_CALLBACK_URL, OAUTH_SCOPES, REFRESH_SCOPE, TOKEN_URL, } from './constants.js';
+import { isTransientNetworkError } from './network-errors.js';
 import { generatePKCE } from './pkce.js';
 export function parseRetryAfterHeader(value) {
     if (!value)
@@ -33,17 +35,11 @@ export class ClaudeOAuthRefreshError extends Error {
         this.retryAfter = parseRetryAfterHeader(retryAfterHeader ?? undefined);
     }
 }
-function isTransientNetworkError(error) {
-    if (!(error instanceof Error))
-        return false;
-    const code = error.code;
-    return (error.message.includes('fetch failed') ||
-        code === 'ECONNRESET' ||
-        code === 'ECONNREFUSED' ||
-        code === 'ETIMEDOUT' ||
-        code === 'UND_ERR_CONNECT_TIMEOUT');
-}
 export async function refreshClaudeOAuthToken(input) {
+    assertNotCustodyTombstone(input.refreshToken, 'anthropic');
+    if (typeof input.refreshToken !== 'string' || !input.refreshToken.trim()) {
+        throw new Error('Local OAuth refresh credential is unavailable');
+    }
     const fetchImpl = input.fetchImpl ?? fetch;
     const maxRetries = input.maxRetries ?? 2;
     const baseDelayMs = input.baseDelayMs ?? 500;

package/dist/cachekeep.d.ts

@@ -76,8 +76,15 @@ export type CacheKeepTarget = {
     consecutiveFailures: number;
     dayKey: string;
     oauthAccountId?: string;
+    oauthAccountIdentity?: string;
+    accountStoragePath?: string;
     isSubagent: boolean;
 };
+export type CacheKeepPrewarmAttempt = {
+    id: number;
+    /** One deadline covers credential authorization and the HTTP attempt. */
+    signal?: AbortSignal;
+};
 export type CacheKeepPrewarmResult = {
     ok: true;
     usage?: {
@@ -96,6 +103,7 @@ export declare class CacheKeepManager {
     private readonly targets;
     private timer;
     private tickPromise;
+    private nextPrewarmAttemptId;
     constructor(options: {
         loadStorage: () => Promise<AccountStorage | null>;
         fetchImpl?: typeof fetch;
@@ -103,7 +111,7 @@ export declare class CacheKeepManager {
         prewarmTimeoutMs?: number;
         setIntervalImpl?: typeof globalThis.setInterval;
         clearIntervalImpl?: typeof globalThis.clearInterval;
-        prepareHeaders?: (headers: Headers, target: CacheKeepTarget) => Promise<Headers> | Headers;
+        prepareHeaders?: (headers: Headers, target: CacheKeepTarget, attempt: CacheKeepPrewarmAttempt) => Promise<Headers | undefined> | Headers | undefined;
         onTrackedSessionsChanged?: (sessions: readonly CacheKeepTrackedSession[]) => Promise<void> | void;
         prepareBody?: (bodyText: string, target: CacheKeepTarget) => string | Promise<string>;
         onResponse?: (input: {
@@ -112,6 +120,11 @@ export declare class CacheKeepManager {
             status: number;
             data: unknown;
             receivedAt: number;
+            attempt: CacheKeepPrewarmAttempt;
+        }) => void | Promise<void>;
+        onComplete?: (input: {
+            target: CacheKeepTarget;
+            attempt: CacheKeepPrewarmAttempt;
         }) => void | Promise<void>;
     });
     start(): void;
@@ -137,6 +150,8 @@ export declare class CacheKeepManager {
         storage: AccountStorage | null;
         cacheMode: string;
         oauthAccountId?: string;
+        oauthAccountIdentity?: string;
+        accountStoragePath?: string;
         isSubagent?: boolean;
     }): {
         tracked: boolean;
@@ -151,6 +166,8 @@ export declare class CacheKeepManager {
         headers: Headers;
         bodyText: string;
         oauthAccountId?: string;
+        oauthAccountIdentity?: string;
+        accountStoragePath?: string;
         isSubagent?: boolean;
     }): Promise<CacheKeepPrewarmResult>;
     tick(): Promise<void>;

package/dist/cachekeep.js

@@ -1,4 +1,4 @@
-import { signRequestBody } from './cch.js';
+import { signRequestBody, stripBillingLineageFromBody } from './cch.js';
 import { orderClaudeCodeBody } from './claude-code.js';
 import { dumpDirectRequest, dumpResponseArtifact } from './dump.js';
 import { logger } from './logger.js';
@@ -216,6 +216,7 @@ export async function buildCacheKeepPrewarmBody(bodyText) {
         return { ok: false, reason: 'body has no explicit cache breakpoints' };
     }
     const warm = structuredClone(body);
+    stripBillingLineageFromBody(warm);
     warm.max_tokens = 0;
     delete warm.stream;
     const thinking = warm.thinking;
@@ -247,6 +248,7 @@ export class CacheKeepManager {
     targets = new Map();
     timer = null;
     tickPromise = null;
+    nextPrewarmAttemptId = 0;
     constructor(options) {
         this.options = options;
     }
@@ -374,6 +376,8 @@ export class CacheKeepManager {
             consecutiveFailures: 0,
             dayKey: today,
             oauthAccountId: input.oauthAccountId,
+            oauthAccountIdentity: input.oauthAccountIdentity,
+            accountStoragePath: input.accountStoragePath,
             isSubagent: input.isSubagent ?? false,
         });
         this.pruneTargets(now, today);
@@ -396,6 +400,8 @@ export class CacheKeepManager {
             consecutiveFailures: 0,
             dayKey: '',
             oauthAccountId: input.oauthAccountId,
+            oauthAccountIdentity: input.oauthAccountIdentity,
+            accountStoragePath: input.accountStoragePath,
             isSubagent: input.isSubagent ?? false,
         };
         return this.sendPrewarm(target);
@@ -454,96 +460,116 @@ export class CacheKeepManager {
         this.publishTrackedSessions();
     }
     async sendPrewarm(target) {
-        let bodyText = target.bodyText;
-        if (this.options.prepareBody) {
+        const attempt = {
+            id: ++this.nextPrewarmAttemptId,
+            signal: AbortSignal.timeout(this.options.prewarmTimeoutMs ?? CACHE_KEEP_PREWARM_TIMEOUT_MS),
+        };
+        try {
+            let bodyText = target.bodyText;
+            if (this.options.prepareBody) {
+                try {
+                    bodyText = await this.options.prepareBody(bodyText, target);
+                }
+                catch (error) {
+                    logger.warn('cachekeep', 'prepare body failed', {
+                        session: target.id,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            }
+            const preparedTarget = { ...target, bodyText };
+            const prewarm = await buildCacheKeepPrewarmBody(bodyText);
+            if (!prewarm.ok)
+                return prewarm;
+            const fetchImpl = this.options.fetchImpl ?? fetch;
+            const prewarmTarget = { ...preparedTarget, bodyText: prewarm.bodyText };
+            const headers = this.options.prepareHeaders
+                ? await this.options.prepareHeaders(new Headers(target.headers), prewarmTarget, attempt)
+                : new Headers(target.headers);
+            if (!headers) {
+                return {
+                    ok: false,
+                    reason: 'OAuth cache prewarm credential is unavailable',
+                    transient: true,
+                };
+            }
+            headers.delete('content-length');
+            headers.delete('transfer-encoding');
+            let response;
             try {
-                bodyText = await this.options.prepareBody(bodyText, target);
+                response = await fetchImpl(target.url, {
+                    method: 'POST',
+                    headers,
+                    body: prewarm.bodyText,
+                    signal: attempt.signal,
+                });
             }
             catch (error) {
-                logger.warn('cachekeep', 'prepare body failed', {
+                return {
+                    ok: false,
+                    reason: error instanceof Error ? error.message : String(error),
+                    transient: true,
+                };
+            }
+            const receivedAt = this.options.now?.() ?? Date.now();
+            const raw = await response.text().catch(() => '');
+            let data = null;
+            try {
+                data = raw ? JSON.parse(raw) : null;
+            }
+            catch { }
+            try {
+                await this.options.onResponse?.({
+                    target,
+                    bodyText: prewarm.bodyText,
+                    status: response.status,
+                    data,
+                    receivedAt,
+                    attempt,
+                });
+            }
+            catch { }
+            try {
+                const dumpHandle = await dumpDirectRequest({
+                    affinity: target.id,
+                    route: 'cachekeep',
+                    status: response.status,
+                    bodyText: prewarm.bodyText,
+                    url: target.url,
+                    method: 'POST',
+                    headers,
+                    tag: 'cachekeep',
+                });
+                await dumpResponseArtifact(dumpHandle, {
+                    status: response.status,
+                    message: data,
+                });
+            }
+            catch (error) {
+                logger.debug('cachekeep', 'dump failed', {
                     session: target.id,
                     error: error instanceof Error ? error.message : String(error),
                 });
             }
+            if (!response.ok) {
+                return {
+                    ok: false,
+                    reason: raw || `HTTP ${response.status}`,
+                    status: response.status,
+                };
+            }
+            const objectData = data && typeof data === 'object' && !Array.isArray(data)
+                ? data
+                : null;
+            const usage = objectData?.usage;
+            return { ok: true, ...(usage && { usage }) };
         }
-        const preparedTarget = { ...target, bodyText };
-        const prewarm = await buildCacheKeepPrewarmBody(bodyText);
-        if (!prewarm.ok)
-            return prewarm;
-        const fetchImpl = this.options.fetchImpl ?? fetch;
-        const prewarmTarget = { ...preparedTarget, bodyText: prewarm.bodyText };
-        const headers = this.options.prepareHeaders
-            ? await this.options.prepareHeaders(new Headers(target.headers), prewarmTarget)
-            : new Headers(target.headers);
-        headers.delete('content-length');
-        headers.delete('transfer-encoding');
-        let response;
-        try {
-            response = await fetchImpl(target.url, {
-                method: 'POST',
-                headers,
-                body: prewarm.bodyText,
-                signal: AbortSignal.timeout(this.options.prewarmTimeoutMs ?? CACHE_KEEP_PREWARM_TIMEOUT_MS),
-            });
-        }
-        catch (error) {
-            return {
-                ok: false,
-                reason: error instanceof Error ? error.message : String(error),
-                transient: true,
-            };
-        }
-        const receivedAt = this.options.now?.() ?? Date.now();
-        const raw = await response.text().catch(() => '');
-        let data = null;
-        try {
-            data = raw ? JSON.parse(raw) : null;
-        }
-        catch { }
-        try {
-            await this.options.onResponse?.({
-                target,
-                bodyText: prewarm.bodyText,
-                status: response.status,
-                data,
-                receivedAt,
-            });
-        }
-        catch { }
-        try {
-            const dumpHandle = await dumpDirectRequest({
-                affinity: target.id,
-                route: 'cachekeep',
-                status: response.status,
-                bodyText: prewarm.bodyText,
-                url: target.url,
-                method: 'POST',
-                headers,
-                tag: 'cachekeep',
-            });
-            await dumpResponseArtifact(dumpHandle, {
-                status: response.status,
-                message: data,
-            });
-        }
-        catch (error) {
-            logger.debug('cachekeep', 'dump failed', {
-                session: target.id,
-                error: error instanceof Error ? error.message : String(error),
-            });
-        }
-        if (!response.ok) {
-            return {
-                ok: false,
-                reason: raw || `HTTP ${response.status}`,
-                status: response.status,
-            };
+        finally {
+            try {
+                await this.options.onComplete?.({ target, attempt });
+            }
+            catch { }
         }
-        const objectData = data && typeof data === 'object' && !Array.isArray(data)
-            ? data
-            : null;
-        const usage = objectData?.usage;
-        return { ok: true, ...(usage && { usage }) };
     }
     async prewarm(target, now) {
         const result = await this.sendPrewarm(target);

package/dist/cch.d.ts

@@ -1,3 +1,9 @@
+export interface BillingLineageFields {
+    previousRequestId?: string;
+    promptId?: string;
+}
+export declare function isValidAnthropicRequestId(value: string): boolean;
+export declare function isValidBillingPromptId(value: string): boolean;
 type Message = {
     role?: string;
     content?: string | Array<{
@@ -7,10 +13,18 @@ type Message = {
 };
 export declare const CCH_PATTERN: RegExp;
 /**
- * Extract text from the first user message's first text block.
- * Kept for diagnostics/backward-compatible tests; CCH signing no longer uses it.
+ * Extract the visible prompt from the first user message. Claude Code prepends
+ * reminder blocks and derives its version suffix from the final text block.
  */
 export declare function extractFirstUserMessageText(messages: Message[]): string;
+export declare class ClaudeCodeFirstUserTextTracker {
+    #private;
+    readonly limit: number;
+    constructor(limit?: number);
+    resolve(sessionId: string, messages: Message[], pin?: boolean): string;
+    has(sessionId: string): boolean;
+    clear(): void;
+}
 /**
  * Compute Claude Code's cch token over the final serialized request body.
  *
@@ -23,16 +37,16 @@ export declare function resetBillingHeaderCCH(bodyString: string): string;
 export declare function extractBillingHeaderCCH(bodyString: string): string | null;
 export declare function signRequestBody(bodyString: string): Promise<string>;
 /**
- * Compute a stable 3-character suffix for cc_version.
- *
- * The captured Claude Code version uses its observed build hash. Custom/future
- * versions get a deterministic version-only suffix so date changes never rotate
- * the billing header and bust prompt-cache prefixes.
+ * Compute Claude Code's 3-character suffix for cc_version.
  */
-export declare function computeVersionSuffix(version?: string, _date?: Date): string;
+export declare function computeCcVersionSuffix(firstUserText: string, version?: string): string;
 /**
  * Build the billing header with a cch placeholder.
  * signRequestBody() must run after final request serialization to replace it.
  */
-export declare function buildBillingHeaderValue(_messages: Message[], version: string | undefined, entrypoint: string, date?: Date): string;
+export declare function buildBillingHeaderValue(messages: Message[], version: string | undefined, entrypoint: string, pinnedFirstUserText?: string, lineage?: BillingLineageFields): string;
+/** Remove request-scoped Claude Code lineage from a billing header string. */
+export declare function stripBillingLineageFields(value: string): string;
+/** Remove request-scoped Claude Code lineage before reusing a request body. */
+export declare function stripBillingLineageFromBody(body: unknown): number;
 export {};

package/dist/cch.js

@@ -1,7 +1,16 @@
 import { createHash } from 'node:crypto';
 import xxhashInit from 'xxhash-wasm';
-import { CLAUDE_CODE_BUILD_HASH, CLAUDE_CODE_VERSION } from './constants.js';
-const CCH_SEED = 0x6e52736ac806831en;
+import { CCH_POSITIONS, CCH_SALT, CLAUDE_CODE_VERSION } from './constants.js';
+const ANTHROPIC_REQUEST_ID_PATTERN = /^req_[A-Za-z0-9_-]{8,128}$/;
+const PROMPT_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const BILLING_LINEAGE_FIELD_PATTERN = / cc_(?:prev_req|prompt_id)=[^;\r\n]*;/g;
+export function isValidAnthropicRequestId(value) {
+    return ANTHROPIC_REQUEST_ID_PATTERN.test(value);
+}
+export function isValidBillingPromptId(value) {
+    return PROMPT_ID_PATTERN.test(value);
+}
+const CCH_SEED = 0x4d659218e32a3268n;
 const CCH_PLACEHOLDER = 'cch=00000;';
 export const CCH_PATTERN = /\bcch=([0-9a-f]{5});/;
 const BILLING_HEADER_CCH_PATTERN = /("system":\[\{"type":"text","text":"x-anthropic-billing-header: cc_version=[^;"]+; cc_entrypoint=[^;"]+; )cch=([0-9a-f]{5});/;
@@ -18,8 +27,8 @@ async function ensureXxhash() {
     await xxhashPromise;
 }
 /**
- * Extract text from the first user message's first text block.
- * Kept for diagnostics/backward-compatible tests; CCH signing no longer uses it.
+ * Extract the visible prompt from the first user message. Claude Code prepends
+ * reminder blocks and derives its version suffix from the final text block.
  */
 export function extractFirstUserMessageText(messages) {
     const userMsg = messages.find((message) => message.role === 'user');
@@ -29,12 +38,48 @@ export function extractFirstUserMessageText(messages) {
     if (typeof content === 'string')
         return content;
     if (Array.isArray(content)) {
-        const textBlock = content.find((block) => block.type === 'text');
-        if (textBlock?.text)
-            return textBlock.text;
+        const textBlocks = content.filter((block) => block.type === 'text');
+        const commandBlock = textBlocks.find((block) => block.text?.includes('<command-name>'));
+        if (commandBlock?.text) {
+            return commandBlock.text.slice(commandBlock.text.indexOf('<command-name>'));
+        }
+        const visibleBlock = textBlocks.findLast((block) => typeof block.text === 'string' && block.text.length > 0);
+        if (visibleBlock?.text)
+            return visibleBlock.text;
     }
     return '';
 }
+export class ClaudeCodeFirstUserTextTracker {
+    limit;
+    #values = new Map();
+    constructor(limit = 1_000) {
+        this.limit = limit;
+    }
+    resolve(sessionId, messages, pin = true) {
+        const existing = this.#values.get(sessionId);
+        if (existing !== undefined) {
+            this.#values.delete(sessionId);
+            this.#values.set(sessionId, existing);
+            return existing;
+        }
+        const value = extractFirstUserMessageText(messages);
+        if (pin) {
+            if (!this.#values.has(sessionId) && this.#values.size >= this.limit) {
+                const oldest = this.#values.keys().next().value;
+                if (oldest !== undefined)
+                    this.#values.delete(oldest);
+            }
+            this.#values.set(sessionId, value);
+        }
+        return value;
+    }
+    has(sessionId) {
+        return this.#values.has(sessionId);
+    }
+    clear() {
+        this.#values.clear();
+    }
+}
 /**
  * Compute Claude Code's cch token over the final serialized request body.
  *
@@ -61,29 +106,67 @@ export async function signRequestBody(bodyString) {
     if (!BILLING_HEADER_CCH_PATTERN.test(bodyString))
         return bodyString;
     const unsignedBodyString = resetBillingHeaderCCH(bodyString);
-    const token = await computeCCH(new TextEncoder().encode(unsignedBodyString));
+    const canonicalBody = JSON.parse(unsignedBodyString);
+    if ('model' in canonicalBody)
+        canonicalBody.model = '';
+    delete canonicalBody.max_tokens;
+    const token = await computeCCH(new TextEncoder().encode(JSON.stringify(canonicalBody)));
     return unsignedBodyString.replace(BILLING_HEADER_CCH_PLACEHOLDER_PATTERN, `$1cch=${token};`);
 }
 /**
- * Compute a stable 3-character suffix for cc_version.
- *
- * The captured Claude Code version uses its observed build hash. Custom/future
- * versions get a deterministic version-only suffix so date changes never rotate
- * the billing header and bust prompt-cache prefixes.
+ * Compute Claude Code's 3-character suffix for cc_version.
  */
-export function computeVersionSuffix(version = CLAUDE_CODE_VERSION, _date = new Date()) {
-    if (version === CLAUDE_CODE_VERSION)
-        return CLAUDE_CODE_BUILD_HASH;
-    return createHash('sha256').update(version).digest('hex').slice(0, 3);
+export function computeCcVersionSuffix(firstUserText, version = CLAUDE_CODE_VERSION) {
+    const sampledText = CCH_POSITIONS.map((position) => firstUserText[position] ?? '0').join('');
+    return createHash('sha256')
+        .update(`${CCH_SALT}${sampledText}${version}`)
+        .digest('hex')
+        .slice(0, 3);
 }
 /**
  * Build the billing header with a cch placeholder.
  * signRequestBody() must run after final request serialization to replace it.
  */
-export function buildBillingHeaderValue(_messages, version = CLAUDE_CODE_VERSION, entrypoint, date = new Date()) {
-    const suffix = computeVersionSuffix(version, date);
-    return ('x-anthropic-billing-header: ' +
+export function buildBillingHeaderValue(messages, version = CLAUDE_CODE_VERSION, entrypoint, pinnedFirstUserText, lineage) {
+    const suffix = computeCcVersionSuffix(pinnedFirstUserText ?? extractFirstUserMessageText(messages), version);
+    let value = 'x-anthropic-billing-header: ' +
         `cc_version=${version}.${suffix}; ` +
         `cc_entrypoint=${entrypoint}; ` +
-        'cch=00000;');
+        'cch=00000;';
+    if (lineage?.previousRequestId &&
+        isValidAnthropicRequestId(lineage.previousRequestId)) {
+        value += ` cc_prev_req=${lineage.previousRequestId};`;
+    }
+    if (lineage?.promptId && isValidBillingPromptId(lineage.promptId)) {
+        value += ` cc_prompt_id=${lineage.promptId};`;
+    }
+    return value;
+}
+/** Remove request-scoped Claude Code lineage from a billing header string. */
+export function stripBillingLineageFields(value) {
+    return value.replace(BILLING_LINEAGE_FIELD_PATTERN, '');
+}
+/** Remove request-scoped Claude Code lineage before reusing a request body. */
+export function stripBillingLineageFromBody(body) {
+    if (!body || typeof body !== 'object')
+        return 0;
+    const system = body.system;
+    if (!Array.isArray(system))
+        return 0;
+    let stripped = 0;
+    for (const block of system) {
+        if (!block || typeof block !== 'object')
+            continue;
+        const text = block.text;
+        if (typeof text !== 'string' ||
+            !text.startsWith('x-anthropic-billing-header:')) {
+            continue;
+        }
+        const clean = stripBillingLineageFields(text);
+        if (clean === text)
+            continue;
+        block.text = clean;
+        stripped += 1;
+    }
+    return stripped;
 }

package/dist/claude-code.d.ts

@@ -1,16 +1,22 @@
+export type ProviderAccountUuid = string & {
+    readonly __providerAccountUuid: unique symbol;
+};
 export type ClaudeCodeIdentity = {
     deviceId: string;
     accountIdentity?: string;
-    accountUuid?: string;
+    accountUuid?: ProviderAccountUuid;
     sessionId: string;
 };
 export declare function setBounded<K, V>(map: Map<K, V>, key: K, value: V, limit?: number): void;
 export declare function getClaudeCodeIdentity(seed: string): ClaudeCodeIdentity;
 export declare function resetClaudeCodeIdentityCachesForTest(): void;
+/** Use the identity already verified by the credential custodian, without an
+ * additional bootstrap request carrying a previously authorized token. */
+export declare function getClaudeCodeIdentityForVerifiedAccount(accountIdentity: string, accountUuid: ProviderAccountUuid): ClaudeCodeIdentity;
 export declare function resolveClaudeCodeIdentity(accessToken: string, model: string | undefined, accountIdentity: string | undefined): Promise<ClaudeCodeIdentity>;
 export declare function buildClaudeCodeMetadataUserId(identity: ClaudeCodeIdentity): string | null;
 export declare function applyClaudeCodeMetadata(body: Record<string, unknown>, identity: ClaudeCodeIdentity): boolean;
-export declare const CLAUDE_CODE_FULL_AGENT_BETAS: readonly ['oauth-2025-04-20', 'interleaved-thinking-2025-05-14', 'thinking-token-count-2026-05-13', 'context-management-2025-06-27', 'prompt-caching-scope-2026-01-05', 'claude-code-20250219', 'advisor-tool-2026-03-01', 'advanced-tool-use-2025-11-20', 'extended-cache-ttl-2025-04-11', 'cache-diagnosis-2026-04-07'];
+export declare const CLAUDE_CODE_FULL_AGENT_BETAS: readonly ['oauth-2025-04-20', 'interleaved-thinking-2025-05-14', 'thinking-token-count-2026-05-13', 'context-management-2025-06-27', 'prompt-caching-scope-2026-01-05', 'claude-code-20250219', 'advisor-tool-2026-03-01', 'advanced-tool-use-2025-11-20', 'mid-conversation-system-2026-04-07', 'effort-2025-11-24', 'fallback-credit-2026-06-01', 'extended-cache-ttl-2025-04-11', 'cache-diagnosis-2026-04-07'];
 export declare function selectClaudeCodeBetas(body?: Record<string, unknown> | null, extraBetas?: string[]): string;
 export declare function applyClaudeCodeHeaders(headers: Headers, accessToken: string, options?: {
     body?: Record<string, unknown> | null;
@@ -18,5 +24,4 @@ export declare function applyClaudeCodeHeaders(headers: Headers, accessToken: st
     extraBetas?: string[];
 }): Headers;
 export declare function orderClaudeCodeBody<T extends Record<string, unknown>>(body: T): T;
-export declare function claudeCodeBuildHash(): string;
 export declare function claudeCodeEntrypoint(): string;

package/dist/claude-code.js

@@ -1,5 +1,5 @@
 import { randomBytes, randomUUID } from 'node:crypto';
-import { CLAUDE_CODE_BUILD_HASH, CLAUDE_CODE_ENTRYPOINT, CLAUDE_CODE_STAINLESS_PACKAGE_VERSION, CLAUDE_CODE_STAINLESS_RUNTIME_VERSION, CLAUDE_CODE_VERSION, FAST_MODE_BETA, USER_AGENT, } from './constants.js';
+import { CLAUDE_CODE_ENTRYPOINT, CLAUDE_CODE_STAINLESS_PACKAGE_VERSION, CLAUDE_CODE_STAINLESS_RUNTIME_VERSION, CLAUDE_CODE_VERSION, FAST_MODE_BETA, USER_AGENT, } from './constants.js';
 const IDENTITY_CACHE_LIMIT = 1_000;
 const identityCache = new Map();
 export function setBounded(map, key, value, limit = IDENTITY_CACHE_LIMIT) {
@@ -101,7 +101,9 @@ async function fetchClaudeCodeAccountUuid(accessToken, model) {
             return null;
         const data = (await response.json().catch(() => null));
         const accountUuid = data?.oauth_account?.account_uuid;
-        return typeof accountUuid === 'string' && accountUuid ? accountUuid : null;
+        return typeof accountUuid === 'string' && accountUuid
+            ? accountUuid
+            : null;
     }
     catch {
         return null;
@@ -110,6 +112,18 @@ async function fetchClaudeCodeAccountUuid(accessToken, model) {
         clearTimeout(timeout);
     }
 }
+/** Use the identity already verified by the credential custodian, without an
+ * additional bootstrap request carrying a previously authorized token. */
+export function getClaudeCodeIdentityForVerifiedAccount(accountIdentity, accountUuid) {
+    if (!accountIdentity.trim() || !accountUuid.trim()) {
+        throw new Error('A verified provider account identity is required');
+    }
+    const base = identityCache.get(accountCacheKey(accountUuid, accountIdentity)) ??
+        getClaudeCodeIdentity(explicitCacheKey(accountIdentity));
+    const identity = { ...base, accountIdentity, accountUuid };
+    cacheAccountIdentity(identity, accountIdentity, accountUuid);
+    return identity;
+}
 export async function resolveClaudeCodeIdentity(accessToken, model, accountIdentity) {
     const stableAccountIdentity = accountIdentity?.trim() || undefined;
     const cacheKey = stableAccountIdentity
@@ -130,8 +144,9 @@ export async function resolveClaudeCodeIdentity(accessToken, model, accountIdent
         setBounded(identityCache, cacheKey, identity);
         setBounded(identityCache, accessToken, identity);
     }
-    if (!accessToken.startsWith('sk-ant-oat'))
-        return identity;
+    if (!accessToken.startsWith('sk-ant-oat')) {
+        return clearCachedAccountUuid(cacheKey, identity);
+    }
     const now = Date.now();
     // A slot-stable identity survives account replacement; bootstrap is the
     // account lookup that must be repeated for each credential presented to it.
@@ -232,6 +247,8 @@ export function applyClaudeCodeMetadata(body, identity) {
         metadata.user_id = userId;
     return true;
 }
+// Claude Code 2.1.258 sends redact-thinking-2026-02-12, but it suppresses
+// thinking-block content that OpenCode displays; deliberately omitted after A/B proof on 2026-09-01.
 export const CLAUDE_CODE_FULL_AGENT_BETAS = [
     'oauth-2025-04-20',
     'interleaved-thinking-2025-05-14',
@@ -241,6 +258,9 @@ export const CLAUDE_CODE_FULL_AGENT_BETAS = [
     'claude-code-20250219',
     'advisor-tool-2026-03-01',
     'advanced-tool-use-2025-11-20',
+    'mid-conversation-system-2026-04-07',
+    'effort-2025-11-24',
+    'fallback-credit-2026-06-01',
     'extended-cache-ttl-2025-04-11',
     'cache-diagnosis-2026-04-07',
 ];
@@ -378,9 +398,6 @@ export function orderClaudeCodeBody(body) {
     }
     return ordered;
 }
-export function claudeCodeBuildHash() {
-    return CLAUDE_CODE_BUILD_HASH;
-}
 export function claudeCodeEntrypoint() {
     return CLAUDE_CODE_ENTRYPOINT;
 }

package/dist/claustrum-enrollment-registry.d.ts

@@ -0,0 +1,17 @@
+import { type ClaustrumEnrollmentConnection, type ClaustrumEnrollmentPaths, type ClaustrumEnrollmentStatus } from './claustrum-enrollment.js';
+export declare function getHostClaustrumEnrollmentPaths(host: 'opencode' | 'pi', env?: NodeJS.ProcessEnv, cwd?: string): ClaustrumEnrollmentPaths;
+export interface ClaustrumEnrollmentAdoption {
+    status(): ClaustrumEnrollmentStatus;
+    reconcileNow(): Promise<void>;
+    resetTerminal(): Promise<'reset' | 'idle' | 'refused-pending' | 'refused-approved' | 'busy'>;
+    release(): void;
+}
+export declare function adoptClaustrumEnrollment(options: {
+    proposedName: string;
+    paths: ClaustrumEnrollmentPaths;
+    connect: () => Promise<ClaustrumEnrollmentConnection>;
+    onStatus?: (status: ClaustrumEnrollmentStatus) => void;
+    setTimeoutImpl?: typeof setTimeout;
+    clearTimeoutImpl?: typeof clearTimeout;
+    pollIntervalMs?: number;
+}): ClaustrumEnrollmentAdoption;