@cortexkit/anthropic-auth-core 1.21.0 → 1.23.0

package/dist/commands/account.d.ts

@@ -1,7 +1,12 @@
-import type { AccountStorage } from '../accounts.ts';
+import type { AccountStorage, ClaustrumMode, FallbackAccount } from '../accounts.ts';
+import type { ClaustrumDetection, CustodyHandleResolution } from '../claustrum.ts';
+import type { ClaustrumEnrollmentStatus } from '../claustrum-enrollment.ts';
 export declare const CLAUDE_ACCOUNT_COMMAND_NAME = "claude-account";
 export type AccountCommandAction = {
     type: 'status';
+} | {
+    type: 'claustrum-mode';
+    mode: ClaustrumMode;
 } | {
     type: 'enable';
     id: string;
@@ -17,6 +22,10 @@ export type AccountCommandAction = {
 } | {
     type: 'move-down';
     id: string;
+} | {
+    type: 'reset-backoff';
+} | {
+    type: 'enrollment-reset';
 } | {
     type: 'add-apikey';
     apiKey: string;
@@ -32,6 +41,17 @@ export type AccountCommandAction = {
 } | {
     type: 'usage';
 };
+export type AccountCommandResult = {
+    text: string;
+    updated?: {
+        id: string;
+        action: 'enable' | 'disable' | 'remove' | 'reorder' | 'reset-backoff';
+        enabled?: boolean;
+        previousOrder?: string[];
+        newOrder?: string[];
+    };
+};
+export type ClaustrumModeTransition = (mode: ClaustrumMode) => Promise<AccountCommandResult>;
 export declare function parseAccountCommandAction(argumentsText: string): AccountCommandAction;
 export interface AccountListItem {
     id: string;
@@ -41,17 +61,29 @@ export interface AccountListItem {
     quotaPercent: number | null;
     tierLabel?: string;
 }
+export type CustodyStatusState = 'na' | 'off' | 'on-vault-served' | 'on-vault-reauth' | 'on-cold' | 'unknown-identity' | 'on-identity-mismatch' | 'on-corrupt-binding';
+export declare function custodyStatusLabel(state: CustodyStatusState): string;
+export declare function formatEnrollmentStatus(status: ClaustrumEnrollmentStatus, scopedServing?: boolean): string[];
+export type AccountCommandStatusProjection = {
+    claustrumDetection: string;
+    claustrumEnrollment?: ClaustrumEnrollmentStatus;
+    custodyMode?: 'local' | 'claustrum';
+    custodyModeKnown?: boolean;
+    accounts: Array<AccountListItem & {
+        claustrumGate: 'on' | 'off' | 'na';
+        vaultServed: boolean;
+        vaultReauth: boolean;
+        custodyState: CustodyStatusState;
+    }>;
+};
 export declare function buildAccountList(storage: AccountStorage): AccountListItem[];
 export declare function executeAccountCommand(input: {
     argumentsText: string;
     storage: AccountStorage;
-}): {
-    text: string;
-    updated?: {
-        id: string;
-        action: 'enable' | 'disable' | 'remove' | 'reorder';
-        enabled?: boolean;
-        previousOrder?: string[];
-        newOrder?: string[];
-    };
-};
+    claustrum?: ClaustrumDetection;
+    statusProjection?: AccountCommandStatusProjection;
+    resolveCustodyBinding?: (account: FallbackAccount) => CustodyHandleResolution;
+    path?: string;
+    transition?: ClaustrumModeTransition;
+    resetEnrollment?: () => Promise<AccountCommandResult>;
+}): Promise<AccountCommandResult>;

package/dist/commands/account.js

@@ -1,3 +1,4 @@
+import { getClaustrumMode, isOAuthAccount, isOAuthAccountVaultOwned, } from '../accounts.js';
 import { formatOAuthAccountTier } from '../oauth-profile.js';
 export const CLAUDE_ACCOUNT_COMMAND_NAME = 'claude-account';
 export function parseAccountCommandAction(argumentsText) {
@@ -16,6 +17,16 @@ export function parseAccountCommandAction(argumentsText) {
         return { type: 'move-up', id: rest };
     if (action === 'move-down' && rest)
         return { type: 'move-down', id: rest };
+    if (action === 'reset-backoff' && !rest)
+        return { type: 'reset-backoff' };
+    if (action === 'enrollment-reset' && !rest)
+        return { type: 'enrollment-reset' };
+    if (action === 'claustrum' && !rest) {
+        return { type: 'claustrum-mode', mode: 'claustrum' };
+    }
+    if (action === 'local' && !rest) {
+        return { type: 'claustrum-mode', mode: 'local' };
+    }
     if (action === 'add-apikey' && rest) {
         let remaining = rest;
         let baseURL;
@@ -81,6 +92,71 @@ export function parseAccountCommandAction(argumentsText) {
     }
     return { type: 'usage' };
 }
+export function custodyStatusLabel(state) {
+    switch (state) {
+        case 'na':
+            return 'n/a (OpenCode-managed)';
+        case 'off':
+            return 'not enrolled';
+        case 'on-vault-served':
+            return 'vault-served';
+        case 'on-vault-reauth':
+            return 'vault reauth';
+        case 'on-cold':
+            return 'vault cold';
+        case 'unknown-identity':
+            return 'unknown identity';
+        case 'on-identity-mismatch':
+            return 'identity mismatch';
+        case 'on-corrupt-binding':
+            return 'corrupt binding';
+    }
+}
+export function formatEnrollmentStatus(status, scopedServing = false) {
+    switch (status.state) {
+        case 'idle':
+            return ['- Enrollment: not enrolled'];
+        case 'busy':
+            return ['- Enrollment: another plugin process is reconciling'];
+        case 'unavailable':
+            return ['- Enrollment: temporarily unavailable'];
+        case 'pending':
+            return status.requestId && /^[A-Za-z0-9_-]{1,128}$/.test(status.requestId)
+                ? [
+                    `- Enrollment: pending approval (${status.requestId})`,
+                    `- Approve: \`ck auth enroll approve --request-id ${status.requestId}\``,
+                ]
+                : status.requestId
+                    ? [
+                        '- Enrollment: pending approval; inspect it with `ck auth enroll list`',
+                    ]
+                    : ['- Enrollment: preparing request'];
+        case 'approved': {
+            const name = status.approvedName ?? status.proposedName;
+            return /^[A-Za-z0-9_-]{1,128}$/.test(name)
+                ? [
+                    `- Enrollment: approved as enrolled:${name} (generation ${status.tokenGeneration}${scopedServing ? '' : '; scoped serving not active yet'})`,
+                    ...(scopedServing
+                        ? []
+                        : [
+                            `- Grant: \`ck auth grant --principal enrolled:${name} --selector-kind category --selector anthropic-native --operation read\``,
+                        ]),
+                ]
+                : [
+                    `- Enrollment: approved (generation ${status.tokenGeneration}${scopedServing ? '' : '; scoped serving not active yet'})`,
+                    ...(scopedServing
+                        ? []
+                        : [
+                            '- Inspect the approved name with `ck auth enroll list` before granting access.',
+                        ]),
+                ];
+        }
+        case 'denied':
+            return ['- Enrollment: denied by operator'];
+        case 'blocked':
+            return [`- Enrollment: blocked (${status.code})`];
+    }
+}
 export function buildAccountList(storage) {
     const list = [];
     const fiveHour = storage.quota?.mainQuota?.five_hour;
@@ -113,24 +189,52 @@ const USAGE_TEXT = [
     '  /claude-account enable <id>           Enable a fallback account',
     '  /claude-account disable <id>          Disable a fallback account',
     '  /claude-account remove <id>           Remove a fallback account',
+    '  /claude-account claustrum             Enable Claustrum mode',
+    '  /claude-account local                 Enable local mode',
     '  /claude-account move-up <id>          Move a fallback account up',
     '  /claude-account move-down <id>        Move a fallback account down',
+    '  /claude-account reset-backoff          Clear main OAuth refresh and quota backoff',
+    '  /claude-account enrollment-reset       Retry a denied/blocked enrollment',
     '  /claude-account add-apikey <key>      Add an API key fallback account',
     '  /claude-account add-oauth-start       Start OAuth device flow',
     '  /claude-account add-oauth-finish <code>  Complete OAuth flow',
 ].join('\n');
-export function executeAccountCommand(input) {
+export async function executeAccountCommand(input) {
     const action = parseAccountCommandAction(input.argumentsText);
     const accounts = input.storage.accounts;
     const mainId = 'main';
     if (action.type === 'status') {
-        const list = buildAccountList(input.storage);
-        const lines = ['## Claude Accounts', ''];
+        const list = input.statusProjection?.accounts ?? buildAccountList(input.storage);
+        const detection = input.statusProjection?.claustrumDetection ??
+            input.claustrum?.status ??
+            'unknown';
+        const lines = [
+            '## Claude Accounts',
+            '',
+            `- Custody mode: ${getClaustrumMode(input.storage)}`,
+            `- Claustrum: ${detection}`,
+            ...(input.statusProjection?.claustrumEnrollment
+                ? formatEnrollmentStatus(input.statusProjection.claustrumEnrollment)
+                : []),
+            '',
+        ];
         for (const a of list) {
             const pct = a.quotaPercent != null ? ` ${Math.round(a.quotaPercent)}%` : '';
             const status = !a.enabled ? ' (disabled)' : '';
             const tier = a.tierLabel ? ` · ${a.tierLabel}` : '';
-            lines.push(`- **${a.label}** [${a.role}]${tier}${status}${pct}`);
+            const projected = input.statusProjection?.accounts.find((account) => account.id === a.id);
+            const storedAccount = input.storage.accounts.find((account) => account.id === a.id);
+            const binding = storedAccount
+                ? input.resolveCustodyBinding?.(storedAccount)
+                : undefined;
+            const custody = projected
+                ? custodyStatusLabel(projected.custodyState)
+                : a.id !== mainId &&
+                    storedAccount &&
+                    isOAuthAccountVaultOwned(input.storage, storedAccount, binding)
+                    ? custodyStatusLabel('on-cold')
+                    : 'local';
+            lines.push(`- **${a.label}** [${a.role}]${tier}${status}${pct} · ${custody}`);
         }
         lines.push('', USAGE_TEXT);
         return { text: lines.join('\n') };
@@ -138,6 +242,23 @@ export function executeAccountCommand(input) {
     if (action.type === 'usage') {
         return { text: USAGE_TEXT };
     }
+    if (action.type === 'claustrum-mode') {
+        if (!input.transition) {
+            return { text: 'Claustrum mode transition is unavailable.' };
+        }
+        return input.transition(action.mode);
+    }
+    if (action.type === 'enrollment-reset') {
+        if (getClaustrumMode(input.storage) !== 'claustrum') {
+            return {
+                text: 'Claustrum enrollment is available only in Claustrum mode.',
+            };
+        }
+        if (!input.resetEnrollment) {
+            return { text: 'Claustrum enrollment reset is unavailable.' };
+        }
+        return input.resetEnrollment();
+    }
     if (action.type === 'add-apikey') {
         return { text: 'add-apikey' };
     }
@@ -147,6 +268,12 @@ export function executeAccountCommand(input) {
     if (action.type === 'add-oauth-finish') {
         return { text: 'add-oauth-finish' };
     }
+    if (action.type === 'reset-backoff') {
+        return {
+            text: 'Main OAuth refresh and quota backoff cleared.',
+            updated: { id: 'main', action: 'reset-backoff' },
+        };
+    }
     const id = action.id;
     if (id === mainId) {
         return {
@@ -172,6 +299,22 @@ export function executeAccountCommand(input) {
         if (!target) {
             return { text: `Account "${id}" not found.` };
         }
+        if (getClaustrumMode(input.storage) === 'claustrum' &&
+            isOAuthAccount(target) &&
+            target.claustrumScopedCredentialId) {
+            return {
+                text: `Account "${target.label ?? id}" is managed by Claustrum. Disable it to stop routing, or remove it from the vault.`,
+            };
+        }
+        const binding = input.resolveCustodyBinding?.(target);
+        if (getClaustrumMode(input.storage) === 'claustrum' &&
+            isOAuthAccount(target) &&
+            binding?.status === 'resolved' &&
+            binding.source === 'manifest') {
+            return {
+                text: `Account "${target.label ?? id}" is bound by the Claustrum manifest. Disable it to stop routing, or remove its Claustrum binding before removing the routing row.`,
+            };
+        }
         return {
             text: `Account "${target.label ?? id}" removed.`,
             updated: { id, action: 'remove' },

package/dist/constants.d.ts

@@ -5,6 +5,7 @@ export declare const AUTHORIZE_URLS: {
 };
 export declare const CODE_CALLBACK_URL = "https://platform.claude.com/oauth/code/callback";
 export declare const TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
+export declare const CUSTODY_HANDLE_PATTERN: RegExp;
 export declare const AXIOS_USER_AGENT = "axios/1.15.2";
 export declare const OAUTH_SCOPES: string[];
 export declare const REFRESH_SCOPE = "user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
@@ -18,12 +19,11 @@ export declare const CLAUDE_CODE_IDENTITY = "You are Claude Code, Anthropic's of
 export declare const PARALLEL_TOOL_CALLS_SYSTEM_PROMPT: string;
 export declare const CCH_SALT = "59cf53e54c78";
 export declare const CCH_POSITIONS: number[];
-export declare const CLAUDE_CODE_VERSION = "2.1.177";
-export declare const CLAUDE_CODE_BUILD_HASH = "3bf";
+export declare const CLAUDE_CODE_VERSION = "2.1.280";
 export declare const CLAUDE_CODE_ENTRYPOINT = "cli";
-export declare const CLAUDE_CODE_STAINLESS_PACKAGE_VERSION = "0.94.0";
-export declare const CLAUDE_CODE_STAINLESS_RUNTIME_VERSION = "v24.3.0";
-export declare const USER_AGENT = "claude-cli/2.1.177 (external, cli)";
+export declare const CLAUDE_CODE_STAINLESS_PACKAGE_VERSION = "0.112.1";
+export declare const CLAUDE_CODE_STAINLESS_RUNTIME_VERSION = "v26.3.0";
+export declare const USER_AGENT = "claude-cli/2.1.280 (external, cli)";
 export declare const CACHE_1H_MODES: readonly ['explicit', 'automatic', 'hybrid'];
 export type Cache1hMode = (typeof CACHE_1H_MODES)[number];
 export declare const DEFAULT_CACHE_1H_MODE: Cache1hMode;

package/dist/constants.js

@@ -5,6 +5,7 @@ export const AUTHORIZE_URLS = {
 };
 export const CODE_CALLBACK_URL = 'https://platform.claude.com/oauth/code/callback';
 export const TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
+export const CUSTODY_HANDLE_PATTERN = /^ckh_[A-Za-z0-9_-]{43}$/;
 export const AXIOS_USER_AGENT = 'axios/1.15.2';
 export const OAUTH_SCOPES = [
     'org:create_api_key',
@@ -46,12 +47,11 @@ export const PARALLEL_TOOL_CALLS_SYSTEM_PROMPT = [
 ].join('\n');
 export const CCH_SALT = '59cf53e54c78';
 export const CCH_POSITIONS = [4, 7, 20];
-export const CLAUDE_CODE_VERSION = '2.1.177';
-export const CLAUDE_CODE_BUILD_HASH = '3bf';
+export const CLAUDE_CODE_VERSION = '2.1.280';
 export const CLAUDE_CODE_ENTRYPOINT = 'cli';
-export const CLAUDE_CODE_STAINLESS_PACKAGE_VERSION = '0.94.0';
-export const CLAUDE_CODE_STAINLESS_RUNTIME_VERSION = 'v24.3.0';
-export const USER_AGENT = 'claude-cli/2.1.177 (external, cli)';
+export const CLAUDE_CODE_STAINLESS_PACKAGE_VERSION = '0.112.1';
+export const CLAUDE_CODE_STAINLESS_RUNTIME_VERSION = 'v26.3.0';
+export const USER_AGENT = `claude-cli/${CLAUDE_CODE_VERSION} (external, ${CLAUDE_CODE_ENTRYPOINT})`;
 export const CACHE_1H_MODES = ['explicit', 'automatic', 'hybrid'];
 export const DEFAULT_CACHE_1H_MODE = 'explicit';
 /**

package/dist/custom-headers.d.ts

@@ -0,0 +1,3 @@
+export declare const ANTHROPIC_CUSTOM_HEADERS_ENV = "ANTHROPIC_CUSTOM_HEADERS";
+export declare function parseCustomHeaders(raw: string | undefined): Headers;
+export declare function applyCustomHeaders(headers: Headers, raw?: string | undefined): Headers;

package/dist/custom-headers.js

@@ -0,0 +1,102 @@
+import { parseJsonRedacted } from './json.js';
+import { logger } from './logger.js';
+export const ANTHROPIC_CUSTOM_HEADERS_ENV = 'ANTHROPIC_CUSTOM_HEADERS';
+const CUSTOM_HEADER_CACHE_LIMIT = 64;
+const parsedHeadersByRawValue = new Map();
+const warnedMalformedRawValues = new Set();
+// Proxy-specific metadata is allowed, but custom configuration must never
+// replace route authentication, protocol negotiation, body framing, or
+// plugin-internal correlation headers after those guards have run.
+const PROTECTED_HEADERS = new Set([
+    'authorization',
+    'proxy-authorization',
+    'x-api-key',
+    'host',
+    'content-length',
+    'content-type',
+    'connection',
+    'transfer-encoding',
+    'upgrade',
+    'keep-alive',
+    'te',
+    'trailer',
+    'anthropic-version',
+    'anthropic-beta',
+    'x-parent-session-id',
+    'x-session-affinity',
+    'x-opencode-session',
+    'x-anthropic-effort-plan',
+    'x-cortexkit-billing-lineage',
+]);
+function cacheParsed(raw, entries) {
+    parsedHeadersByRawValue.delete(raw);
+    parsedHeadersByRawValue.set(raw, entries);
+    while (parsedHeadersByRawValue.size > CUSTOM_HEADER_CACHE_LIMIT) {
+        const oldest = parsedHeadersByRawValue.keys().next().value;
+        if (oldest === undefined)
+            break;
+        parsedHeadersByRawValue.delete(oldest);
+        warnedMalformedRawValues.delete(oldest);
+    }
+}
+function setCustomHeader(headers, name, value) {
+    if (PROTECTED_HEADERS.has(name.trim().toLowerCase())) {
+        throw new TypeError('protected header');
+    }
+    headers.set(name, value);
+}
+export function parseCustomHeaders(raw) {
+    if (!raw?.trim())
+        return new Headers();
+    const cached = parsedHeadersByRawValue.get(raw);
+    if (cached !== undefined || parsedHeadersByRawValue.has(raw)) {
+        return new Headers(cached ?? []);
+    }
+    try {
+        const headers = new Headers();
+        const trimmed = raw.trim();
+        if (!trimmed.startsWith('{') && !trimmed.startsWith('[')) {
+            for (const entry of trimmed
+                .split(/\r?\n|,\s*(?=[^,\s:]+:)/)
+                .map((value) => value.trim())
+                .filter(Boolean)) {
+                const separator = entry.indexOf(':');
+                if (separator <= 0) {
+                    throw new TypeError('invalid header entry');
+                }
+                setCustomHeader(headers, entry.slice(0, separator).trim(), entry.slice(separator + 1).trim());
+            }
+        }
+        else {
+            const parsed = parseJsonRedacted(trimmed);
+            if (parsed == null ||
+                typeof parsed !== 'object' ||
+                Array.isArray(parsed)) {
+                throw new TypeError('invalid header object');
+            }
+            for (const [key, value] of Object.entries(parsed)) {
+                if (value == null)
+                    continue;
+                setCustomHeader(headers, key, Array.isArray(value) ? value.map(String).join(', ') : String(value));
+            }
+        }
+        const entries = [...headers.entries()];
+        cacheParsed(raw, entries);
+        return new Headers(entries);
+    }
+    catch {
+        cacheParsed(raw, null);
+        if (!warnedMalformedRawValues.has(raw)) {
+            warnedMalformedRawValues.add(raw);
+            logger.warn('custom-headers', 'ignoring malformed ANTHROPIC_CUSTOM_HEADERS', { reason: 'invalid or protected header configuration' });
+        }
+        return new Headers();
+    }
+}
+export function applyCustomHeaders(headers, raw = process.env[ANTHROPIC_CUSTOM_HEADERS_ENV]) {
+    const customHeaders = parseCustomHeaders(raw);
+    customHeaders.forEach((value, key) => {
+        headers.set(key, value);
+    });
+    return headers;
+}

package/dist/dump.js

@@ -3,6 +3,7 @@ import { lstat, mkdir, readdir, readFile, rename, unlink, writeFile, } from 'nod
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { extractBillingHeaderCCH } from './cch.js';
+import { parseJsonRedacted } from './json.js';
 import { isSecretKey, logger, relayLog } from './logger.js';
 export const CLAUDE_DUMP_COMMAND_NAME = 'claude-dump';
 const DUMP_STATUS_TITLE = '## Claude Dump Status';
@@ -425,7 +426,7 @@ function diffSummary(previousBodyText, bodyText) {
 }
 function parseBody(bodyText) {
     try {
-        const parsed = JSON.parse(bodyText);
+        const parsed = parseJsonRedacted(bodyText);
         return parsed != null &&
             typeof parsed === 'object' &&
             !Array.isArray(parsed)

package/dist/fast.js

@@ -32,7 +32,7 @@ export function buildFastModeStatusSummary(input) {
         `- Enabled: ${enabled ? 'enabled' : 'disabled'}`,
         '- Persisted: ~/.config/opencode/anthropic-auth.json',
         '- Scope: adds Anthropic fast mode to supported Opus requests',
-        '- Supported models: claude-opus-4-6, claude-opus-4-7, claude-opus-4-8, and claude-opus-5',
+        '- Supported models: claude-opus-4-6, claude-opus-4-7, claude-opus-4-8, claude-opus-5, and claude-opus-5-5',
         '- Request changes: adds `speed: "fast"` and the `fast-mode-2026-02-01` beta header',
         '- Note: fast and standard speeds do not share prompt-cache prefixes',
     ].join('\n');

package/dist/index.d.ts

@@ -5,13 +5,23 @@ export * from './cachekeep.ts';
 export * from './cachekeep-registry.ts';
 export * from './cch.ts';
 export * from './claude-code.ts';
+export * from './claustrum.ts';
+export * from './claustrum-enrollment.ts';
+export * from './claustrum-enrollment-registry.ts';
+export * from './claustrum-scoped.ts';
+export * from './claustrum-scoped-roster.ts';
+export * from './claustrum-scoped-runtime.ts';
 export * from './commands/account.ts';
 export * from './constants.ts';
+export * from './custom-headers.ts';
 export * from './dump.ts';
 export * from './fast.ts';
+export * from './json.ts';
 export * from './killswitch.ts';
 export * from './logger.ts';
 export * from './logging.ts';
+export * from './mid-conversation-output-config.ts';
+export * from './model-remap.ts';
 export * from './models.ts';
 export * from './oauth-profile.ts';
 export * from './pkce.ts';
@@ -25,3 +35,4 @@ export * from './relay.ts';
 export * from './routing.ts';
 export * from './start.ts';
 export * from './sticky-routing.ts';
+export * from './thinking-binding.ts';

package/dist/index.js

@@ -5,13 +5,23 @@ export * from './cachekeep.js';
 export * from './cachekeep-registry.js';
 export * from './cch.js';
 export * from './claude-code.js';
+export * from './claustrum.js';
+export * from './claustrum-enrollment.js';
+export * from './claustrum-enrollment-registry.js';
+export * from './claustrum-scoped.js';
+export * from './claustrum-scoped-roster.js';
+export * from './claustrum-scoped-runtime.js';
 export * from './commands/account.js';
 export * from './constants.js';
+export * from './custom-headers.js';
 export * from './dump.js';
 export * from './fast.js';
+export * from './json.js';
 export * from './killswitch.js';
 export * from './logger.js';
 export * from './logging.js';
+export * from './mid-conversation-output-config.js';
+export * from './model-remap.js';
 export * from './models.js';
 export * from './oauth-profile.js';
 export * from './pkce.js';
@@ -25,3 +35,4 @@ export * from './relay.js';
 export * from './routing.js';
 export * from './start.js';
 export * from './sticky-routing.js';
+export * from './thinking-binding.js';

package/dist/json.d.ts

@@ -0,0 +1 @@
+export declare function parseJsonRedacted(text: string): unknown;

package/dist/json.js

@@ -0,0 +1,10 @@
+export function parseJsonRedacted(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch (error) {
+        if (error instanceof SyntaxError)
+            throw new SyntaxError('invalid JSON');
+        throw error;
+    }
+}

package/dist/logger.js

@@ -1,6 +1,7 @@
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
+import { CUSTODY_HANDLE_PATTERN } from './constants.js';
 const LEVEL_ORDER = {
     error: 0,
     warn: 1,
@@ -75,7 +76,7 @@ function rotateLogFile() {
     }
 }
 // -- Redaction ------------------------------------------------------------
-export const SECRET_KEY_EXACT = /^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i;
+export const SECRET_KEY_EXACT = /^(authorization|x-api-key|cookie|set-cookie|refresh|access|token|handle)$/i;
 export function isSecretKey(key) {
     if (SECRET_KEY_EXACT.test(key))
         return true;
@@ -92,6 +93,7 @@ const REDACT_VALUE_PATTERNS = [
     /Bearer\s+\S+/,
     /sk-[A-Za-z0-9-]+/,
     /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/,
+    CUSTODY_HANDLE_PATTERN,
 ];
 function isRedactableValue(value) {
     if (typeof value !== 'string')

package/dist/mid-conversation-output-config.d.ts

@@ -0,0 +1,13 @@
+export declare const MID_CONVERSATION_OUTPUT_CONFIG_BETA = "mid-conversation-output-config-2026-07-01";
+export type AdaptiveEffort = 'low' | 'medium' | 'high' | 'xhigh' | 'max';
+export type MidConversationEffortTransition = {
+    /** Number of assistant messages preceding the user boundary for this effort. */
+    afterAssistantMessages: number;
+    effort: AdaptiveEffort;
+};
+export declare function normalizeAdaptiveEffort(value: unknown): AdaptiveEffort | undefined;
+export declare function usesMidConversationOutputConfig(body: Record<string, unknown>): boolean;
+export declare function applyMidConversationOutputConfig(body: Record<string, unknown>, transitions: readonly MidConversationEffortTransition[]): {
+    applied: boolean;
+    inserted: number;
+};