@genesislcap/foundation-ai 15.11.0 → 15.12.0

package/dist/esm/transports/anthropic-transport.js

@@ -2,6 +2,7 @@ import { __awaiter } from "tslib";
 import { SUPPORTED_ANTHROPIC_MODEL_IDS, } from '../types';
 import { logger } from '../utils/logger';
 import { scaleTemperature } from '../utils/temperature';
+import { anthropicTokenCost } from '../utils/token-cost';
 import { enforceAnthropicToolSchema } from '../utils/tool-schema';
 import { VENDOR_LABELS } from './budget-exhausted-error';
 import { postWithRetry } from './post-with-retry';
@@ -52,25 +53,6 @@ function assertSupportedAnthropicModel(model) {
         throw new Error(`AnthropicTransport: unsupported model "${model}". Use one of: ${SUPPORTED_ANTHROPIC_MODEL_IDS.join(', ')}.`);
     }
 }
-/**
- * Standard tier pricing per million tokens — https://docs.claude.com/en/docs/about-claude/pricing
- */
-function estimatedAnthropicRatesUsdPerMillion(model) {
-    if (model === 'claude-haiku-4-5-20251001') {
-        return { promptPerMillion: 1, candidatePerMillion: 5 };
-    }
-    // Fable 5 — Anthropic's most capable widely-released model; priced above Opus tier.
-    if (model === 'claude-fable-5') {
-        return { promptPerMillion: 10, candidatePerMillion: 50 };
-    }
-    // Sonnet 5 and Sonnet 4.6 share the standard Sonnet tier ($3 / $15 per MTok). Sonnet 5's
-    // introductory rate ($2 / $10 through 2026-08-31) is deliberately NOT used here — standard rates.
-    if (model === 'claude-sonnet-5' || model === 'claude-sonnet-4-6') {
-        return { promptPerMillion: 3, candidatePerMillion: 15 };
-    }
-    // Opus 4.7 / 4.8 — same $5 / $25 per MTok.
-    return { promptPerMillion: 5, candidatePerMillion: 25 };
-}
 /**
  * Models that reject non-default sampling parameters (`temperature`/`top_p`/`top_k`) with a 400 —
  * the Opus 4.7+ / Sonnet 5 / Fable 5 generation. Sonnet 4.6 and Haiku 4.5 still accept them.
@@ -94,39 +76,74 @@ function supportsNativeStructuredOutput(model) {
         model === 'claude-haiku-4-5-20251001');
 }
 /**
- * Extended-thinking posture for a request. Sonnet 5 and Fable 5 run adaptive thinking with
- * `display:'summarized'` — regardless of `tool_choice`. First-party has no forced-tool-vs-thinking
- * restriction (that's Bedrock-only), and "adaptive" self-regulates (the model thinks little on
- * trivial/mechanical turns on its own), so there is no reason to special-case forced tool calls.
- * `display:'summarized'` means the reasoning summary is always returned (billed regardless; the
- * host's toggle decides visibility).
+ * Whether a model accepts `thinking: {type:'adaptive'}` at all. Everything from the 4.6
+ * generation on does; Haiku 4.5 does not, and asking for it there is a 400 rather than a
+ * no-op — so a caller's `'auto'` degrades to the model default instead of failing the turn.
+ */
+function supportsAdaptiveThinking(model) {
+    return model !== 'claude-haiku-4-5-20251001';
+}
+/**
+ * Models that think **unconditionally** — `{type:'disabled'}` is a 400, not a no-op. The same
+ * constraint exists on the other provider (Gemini 2.5 Pro), so this is a property of flagship
+ * reasoning models rather than an Anthropic quirk; see `ChatThinkingPolicy`.
+ */
+function thinkingIsMandatory(model) {
+    return model === 'claude-fable-5';
+}
+/**
+ * Extended-thinking posture for a request, given the model and the caller's
+ * {@link ChatThinkingPolicy} for this turn.
  *
- * Fable 5 runs thinking *unconditionally* (it cannot be disabled — an explicit
- * `{type:'disabled'}` is a 400), so it must never be sent `disabled`; `{type:'adaptive'}`
- * is the accepted posture and is what we return.
+ * **`policy === undefined` is the per-model default, and is a distinct third state** — not a
+ * synonym for either value. It reproduces exactly what this function returned before the option
+ * existed, so an agent that leaves `thinkingPolicy` unset (or whose resolver returns `undefined`
+ * on a given turn) is priced and behaves identically to before:
  *
- * Every other model (Opus 4.8/4.7, Sonnet 4.6, Haiku) returns undefined → `thinking` is omitted
- * → it runs WITHOUT thinking on the chat path (Opus 4.8 adaptive thinking is opt-in). So the older
- * "forced tool + thinking is incompatible" restriction never applies to them (you can't hit it when
- * thinking is off). If thinking is ever enabled for one of those, revisit the forced-tool
- * interaction for that model then.
+ * - Sonnet 5 and Fable 5 → adaptive thinking with `display:'summarized'`, regardless of
+ *   `tool_choice`. First-party has no forced-tool-vs-thinking restriction (that's Bedrock-only),
+ *   and "adaptive" self-regulates (the model thinks little on trivial turns on its own), so there
+ *   is no reason to special-case forced tool calls. `display:'summarized'` means the reasoning
+ *   summary is always returned — billed regardless, with the host's toggle deciding only
+ *   *visibility*. Hiding the steps saves no money; `'off'` is what saves money.
+ * - Every other model (Opus 4.8/4.7, Sonnet 4.6, Haiku) → `thinking` omitted, so it runs WITHOUT
+ *   thinking on the chat path (their adaptive thinking is opt-in). The older "forced tool +
+ *   thinking is incompatible" restriction therefore never applies to them — you cannot hit it
+ *   when thinking is off.
+ *
+ * An explicit policy overrides that default, **clamped to what the model can actually honour**
+ * so a policy can never turn a turn into a 400:
+ *
+ * - `'off'` on a mandatory-thinking model (Fable 5) → left at its default. Requesting `disabled`
+ *   there is a 400; the caller is told once via {@link AnthropicTransport} rather than losing
+ *   the turn.
+ * - `'auto'` on a model without adaptive support (Haiku) → omitted, i.e. its default.
+ *
+ * `'off'` is expressed as an *omission* on models that already default to no thinking, rather
+ * than an explicit `{type:'disabled'}`: the two are equivalent on the wire there, and omitting
+ * keeps the request identical to the one those models have always received.
  */
-function anthropicThinking(model) {
-    if (model !== 'claude-sonnet-5' && model !== 'claude-fable-5')
-        return undefined;
-    return { type: 'adaptive', display: 'summarized' };
+function anthropicThinking(model, policy) {
+    const defaultsToThinking = model === 'claude-sonnet-5' || thinkingIsMandatory(model);
+    const adaptive = { type: 'adaptive', display: 'summarized' };
+    if (policy === 'off') {
+        // Cannot be turned off — keep the model's default rather than 400 the turn.
+        if (thinkingIsMandatory(model))
+            return adaptive;
+        // Already off by default: omitting and disabling are the same request.
+        return defaultsToThinking ? { type: 'disabled' } : undefined;
+    }
+    if (policy === 'auto') {
+        return supportsAdaptiveThinking(model) ? adaptive : undefined;
+    }
+    // policy === undefined → the per-model default, unchanged.
+    return defaultsToThinking ? adaptive : undefined;
 }
 /**
- * Prompt-cache pricing multipliers, applied to the model's base input rate
- * (`promptPerMillion`) — https://docs.claude.com/en/docs/build-with-claude/prompt-caching
- * Reads bill at ~0.1× base input; writes bill by TTL — 5-minute at ~1.25× and 1-hour at 2×.
- * Both write TTLs are reachable (`CachePolicy.ttl` is `'5m' | '1h'` and `applyCacheControl`
- * emits either), so the cost path costs each TTL bucket from the response's per-TTL
- * `cache_creation` breakdown rather than assuming a single rate.
+ * Key under which this transport stashes its round-trip state on a tool call's
+ * provider-neutral `providerMetadata` bag. Private to AnthropicTransport.
  */
-const ANTHROPIC_CACHE_READ_MULTIPLIER = 0.1;
-const ANTHROPIC_CACHE_WRITE_5M_MULTIPLIER = 1.25;
-const ANTHROPIC_CACHE_WRITE_1H_MULTIPLIER = 2;
+const ANTHROPIC_PROVIDER_KEY = 'anthropic';
 /**
  * Thrown when a response was cut off at the output-token limit (Anthropic
  * `stop_reason: 'max_tokens'`, Gemini `finishReason: 'MAX_TOKENS'`) in a way
@@ -184,6 +201,27 @@ export class ResponseTruncatedError extends Error {
  * @beta
  */
 export class AnthropicTransport {
+    /**
+     * Warn once when a requested policy is silently clamped, in EITHER direction — which is what
+     * `ChatThinkingPolicy` promises callers. Both directions cost the caller something they asked
+     * for and would otherwise get no signal about: `'off'` on a model that always thinks keeps
+     * billing reasoning as output, and `'auto'` on a model without adaptive support means an agent
+     * that asked to reason quietly does not. (Gemini's twin deliberately stays silent on `'auto'`,
+     * but only because dynamic thinking is already the default there; Haiku defaults to none, so
+     * the same silence would hide a real difference.)
+     */
+    warnIfThinkingUnclampable(policy) {
+        if (this.warnedThinkingClamped)
+            return;
+        const clamped = (policy === 'off' && thinkingIsMandatory(this.model)) ||
+            (policy === 'auto' && !supportsAdaptiveThinking(this.model));
+        if (!clamped)
+            return;
+        this.warnedThinkingClamped = true;
+        logger.warn(policy === 'off'
+            ? `AnthropicTransport: thinkingPolicy 'off' ignored — ${this.model} always thinks and rejects an explicit disable. Reasoning tokens are still billed as output; switch model if you need them gone.`
+            : `AnthropicTransport: thinkingPolicy 'auto' ignored — ${this.model} does not support adaptive thinking, so this turn runs without reasoning. Use a Sonnet or Opus tier if the agent needs it.`);
+    }
     constructor(config = {}) {
         var _a, _b, _c, _d;
         /**
@@ -199,6 +237,16 @@ export class AnthropicTransport {
          * accrue. Surfaced alongside `getLifetimeCost`.
          */
         this.lifetimeSavingsUsd = 0;
+        /**
+         * Whether we have already told the caller their `thinkingPolicy: 'off'` cannot be honoured
+         * on this model. Latched, because it would otherwise fire on every turn of a tool loop.
+         */
+        this.warnedThinkingClamped = false;
+        /**
+         * Serving-model ids already reported as unrecognised. Per-id rather than a single flag, so a
+         * second unknown model is still announced. See {@link AnthropicTransport.servingModel}.
+         */
+        this.warnedUnknownServingModels = new Set();
         const model = (_a = config.model) !== null && _a !== void 0 ? _a : DEFAULT_MODEL;
         assertSupportedAnthropicModel(model);
         this.model = model;
@@ -276,7 +324,9 @@ export class AnthropicTransport {
             }
             // Sonnet 5 runs adaptive thinking by default; disable it for one-shot prompts — the reasoning
             // would be billed but discarded. Fable 5 runs thinking unconditionally (cannot be disabled — a
-            // 400), so it is left on; its summary is simply unused here.
+            // 400), so it is left on; its summary is simply unused here. Not routed through
+            // `anthropicThinking`: this path wants the summary suppressed rather than returned, so a
+            // clamped Fable 5 must keep omitting the field rather than opting into `display:'summarized'`.
             if (this.model === 'claude-sonnet-5')
                 body.thinking = { type: 'disabled' };
             const response = yield this.post(body);
@@ -294,8 +344,16 @@ export class AnthropicTransport {
     // ── ChatTransport (multi-turn chat) ────────────────────────────────────
     sendChatMessage(history, userMessage, options) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c;
-            const messages = this.toAnthropicMessages(history, userMessage, options === null || options === void 0 ? void 0 : options.attachments);
+            var _a, _b, _c, _d;
+            // The models this request could actually be served by — the configured one plus any
+            // fallback target. Needed when replaying reasoning: a signature is only valid for the
+            // model that produced it, so stored blocks are replayed only when their producer is
+            // still reachable on THIS request. See `reasoningToReplay`.
+            const reachableModels = new Set([
+                this.model,
+                ...((_a = options === null || options === void 0 ? void 0 : options.fallbacks) !== null && _a !== void 0 ? _a : []).map((f) => f.model),
+            ]);
+            const messages = this.toAnthropicMessages(history, userMessage, options === null || options === void 0 ? void 0 : options.attachments, reachableModels);
             const body = {
                 model: this.model,
                 max_tokens: this.maxTokens,
@@ -303,7 +361,7 @@ export class AnthropicTransport {
             };
             if (options === null || options === void 0 ? void 0 : options.systemPrompt)
                 body.system = options.systemPrompt;
-            if ((_a = options === null || options === void 0 ? void 0 : options.tools) === null || _a === void 0 ? void 0 : _a.length) {
+            if ((_b = options === null || options === void 0 ? void 0 : options.tools) === null || _b === void 0 ? void 0 : _b.length) {
                 // `enforceSchema` is a per-tool opt-in, and the provider compiles per tool:
                 // an unenforced tool is never compiled and costs nothing against the
                 // compilation limits, so marking one tool in a large surface is legitimate.
@@ -317,21 +375,31 @@ export class AnthropicTransport {
             // Map the requested tool-call mode to Anthropic's tool_choice — only
             // meaningful when tools exist. `'required'`/`{ tool }` force a tool call so
             // a turn can only end via one (e.g. a sub-agent's completion tool).
-            if ((_b = body.tools) === null || _b === void 0 ? void 0 : _b.length) {
+            if ((_c = body.tools) === null || _c === void 0 ? void 0 : _c.length) {
                 const toolChoice = toAnthropicToolChoice(options === null || options === void 0 ? void 0 : options.toolChoice);
                 if (toolChoice)
                     body.tool_choice = toolChoice;
             }
-            // Extended thinking (Sonnet 5). Always adaptive regardless of `tool_choice` — first-party has
-            // no forced-tool-vs-thinking restriction (that's Bedrock-only) and adaptive self-regulates on
-            // mechanical turns. Older models omit it (see `anthropicThinking`).
-            const thinking = anthropicThinking(this.model);
+            // Extended thinking. Adaptive regardless of `tool_choice` — first-party has no
+            // forced-tool-vs-thinking restriction (that's Bedrock-only) and adaptive self-regulates on
+            // mechanical turns. The per-turn `thinkingPolicy` overrides the per-model default; an
+            // undefined policy reproduces it exactly (see `anthropicThinking`).
+            this.warnIfThinkingUnclampable(options === null || options === void 0 ? void 0 : options.thinkingPolicy);
+            const thinking = anthropicThinking(this.model, options === null || options === void 0 ? void 0 : options.thinkingPolicy);
             if (thinking)
                 body.thinking = thinking;
             // Normalized [0,1] temperature → Anthropic's native range, anchored so 0.5 maps to its default.
-            // (Default == max here, so the upper half is flat.) Skipped on models that reject sampling
-            // params (Opus 4.7+ / Sonnet 5), where sending `temperature` is a 400.
-            if ((options === null || options === void 0 ? void 0 : options.temperature) != null && !rejectsSamplingParams(this.model)) {
+            // (Default == max here, so the upper half is flat.) Skipped in two cases:
+            //
+            //  - models that reject sampling params outright (Opus 4.7+ / Sonnet 5 / Fable 5), where
+            //    sending `temperature` is a 400 whether or not thinking is on;
+            //  - ANY model with thinking enabled, because temperature is incompatible with thinking on
+            //    the models that still accept sampling params. Sonnet 4.6 is the live case: it takes a
+            //    temperature happily until `thinkingPolicy: 'auto'` turns thinking on, at which point
+            //    `{ thinkingPolicy: 'auto', temperature: 0 }` — an entirely reasonable agent config —
+            //    becomes an invalid request. The thinking posture wins; temperature is dropped.
+            const thinkingEnabled = (thinking === null || thinking === void 0 ? void 0 : thinking.type) === 'adaptive';
+            if ((options === null || options === void 0 ? void 0 : options.temperature) != null && !rejectsSamplingParams(this.model) && !thinkingEnabled) {
                 body.temperature = scaleTemperature(options.temperature, {
                     defaultTemp: ANTHROPIC_DEFAULT_TEMPERATURE,
                     maxTemp: ANTHROPIC_MAX_TEMPERATURE,
@@ -350,7 +418,7 @@ export class AnthropicTransport {
             // Refusal fallback chain (e.g. Fable 5 → Opus 4.8). Sent as the server-side `fallbacks`
             // param; `post` adds the required beta header when this is present. A refused turn is
             // re-run on the next model in one round trip.
-            if ((_c = options === null || options === void 0 ? void 0 : options.fallbacks) === null || _c === void 0 ? void 0 : _c.length) {
+            if ((_d = options === null || options === void 0 ? void 0 : options.fallbacks) === null || _d === void 0 ? void 0 : _d.length) {
                 body.fallbacks = options.fallbacks.map((f) => f.maxTokens != null ? { model: f.model, max_tokens: f.maxTokens } : { model: f.model });
             }
             // Place prompt-cache breakpoints per the resolved policy (no-op for `'default'`/absent).
@@ -429,42 +497,31 @@ export class AnthropicTransport {
      * and returns the per-call total so the caller can attach it to the response
      * message.
      */
-    logTokenUsage(promptTokens, candidateTokens, cacheReadTokens, cacheCreationTokens, cacheCreation1hTokens) {
-        const { promptPerMillion, candidatePerMillion } = estimatedAnthropicRatesUsdPerMillion(this.model);
-        const m = AnthropicTransport.TOKENS_PER_MILLION;
-        // `promptTokens` is `input_tokens` — the UNCACHED remainder, billed at the full input
-        // rate. Cache reads bill at ~0.1×. Cache writes bill by TTL — 5-min at ~1.25×, 1-hour at
-        // 2× — so split the creation total into its 1-hour portion (from the response breakdown)
-        // and the 5-min remainder, costing each at its own rate. All buckets are off the same base
-        // input rate. Summing them keeps the cost correct whether or not caching was active (all
-        // cache fields are 0 when it wasn't).
-        const cacheCreation5mTokens = Math.max(0, cacheCreationTokens - cacheCreation1hTokens);
-        const promptCost = (promptTokens / m) * promptPerMillion;
-        const cacheReadCost = (cacheReadTokens / m) * promptPerMillion * ANTHROPIC_CACHE_READ_MULTIPLIER;
-        const cacheWriteCost = (cacheCreation5mTokens / m) * promptPerMillion * ANTHROPIC_CACHE_WRITE_5M_MULTIPLIER +
-            (cacheCreation1hTokens / m) * promptPerMillion * ANTHROPIC_CACHE_WRITE_1H_MULTIPLIER;
-        const candidateCost = (candidateTokens / m) * candidatePerMillion;
-        const totalCost = promptCost + cacheReadCost + cacheWriteCost + candidateCost;
-        this.lifetimeCostUsd += totalCost;
-        // Net savings vs no caching: the cache-read tokens would have cost full input price
-        // (we paid ~0.1× of that), while the write premium (~0.25× over full) is an upfront cost
-        // that pays back on later reads — so the net can dip negative on a write-heavy request and
-        // climb positive as reads accrue. Zero when caching was inactive.
-        const cacheReadFull = (cacheReadTokens / m) * promptPerMillion;
-        const cacheWriteFull = (cacheCreationTokens / m) * promptPerMillion;
-        const saved = cacheReadFull - cacheReadCost + (cacheWriteFull - cacheWriteCost);
-        this.lifetimeSavingsUsd += saved;
+    logTokenUsage(model, promptTokens, candidateTokens, cacheReadTokens, cacheCreationTokens, cacheCreation1hTokens) {
+        // The arithmetic and the rate table live in `utils/token-cost` so a host pricing
+        // its own requests — a server proxy, a usage ledger — uses the same numbers
+        // instead of a hand-copied table that drifts. This method keeps only what is
+        // instance-scoped: the lifetime accumulators and the log.
+        const { costUsd, savedUsd, breakdown } = anthropicTokenCost(model, {
+            uncachedInputTokens: promptTokens,
+            outputTokens: candidateTokens,
+            cacheReadTokens,
+            cacheWriteTokens: cacheCreationTokens,
+            cacheWrite1hTokens: cacheCreation1hTokens,
+        });
+        this.lifetimeCostUsd += costUsd;
+        this.lifetimeSavingsUsd += savedUsd;
         const dp = AnthropicTransport.COST_DECIMAL_PLACES;
-        console.log(`--- Anthropic Token Usage (${this.model}) ---`);
-        console.log(`Prompt Tokens:    ${promptTokens} ($${promptCost.toFixed(dp)})`);
-        console.log(`Cache Read:       ${cacheReadTokens} ($${cacheReadCost.toFixed(dp)})`);
-        console.log(`Cache Write:      ${cacheCreationTokens} ($${cacheWriteCost.toFixed(dp)})`);
-        console.log(`Candidate Tokens: ${candidateTokens} ($${candidateCost.toFixed(dp)})`);
-        console.log(`Total Cost:       $${totalCost.toFixed(dp)}`);
-        console.log(`Cache Saved:      $${saved.toFixed(dp)} (lifetime $${this.lifetimeSavingsUsd.toFixed(dp)})`);
+        console.log(`--- Anthropic Token Usage (${model}) ---`);
+        console.log(`Prompt Tokens:    ${promptTokens} ($${breakdown.promptUsd.toFixed(dp)})`);
+        console.log(`Cache Read:       ${cacheReadTokens} ($${breakdown.cacheReadUsd.toFixed(dp)})`);
+        console.log(`Cache Write:      ${cacheCreationTokens} ($${breakdown.cacheWriteUsd.toFixed(dp)})`);
+        console.log(`Candidate Tokens: ${candidateTokens} ($${breakdown.candidateUsd.toFixed(dp)})`);
+        console.log(`Total Cost:       $${costUsd.toFixed(dp)}`);
+        console.log(`Cache Saved:      $${savedUsd.toFixed(dp)} (lifetime $${this.lifetimeSavingsUsd.toFixed(dp)})`);
         console.log(`Lifetime Cost:    $${this.lifetimeCostUsd.toFixed(dp)}`);
         console.log('--------------------------');
-        return totalCost;
+        return costUsd;
     }
     /**
      * Convert the internal `ChatMessage[]` history into Anthropic's message format.
@@ -475,7 +532,7 @@ export class AnthropicTransport {
      * Consecutive same-role turns are merged by the API but we merge here to keep
      * the payload tidy.
      */
-    toAnthropicMessages(history, userMessage, attachments) {
+    toAnthropicMessages(history, userMessage, attachments, reachableModels = new Set([this.model])) {
         var _a, _b, _c;
         const messages = [];
         const pushBlock = (role, block) => {
@@ -505,6 +562,14 @@ export class AnthropicTransport {
                 continue;
             }
             if ((_a = msg.toolCalls) === null || _a === void 0 ? void 0 : _a.length) {
+                // Reasoning first, then text, then the calls — the order the model produced them,
+                // which is the order the API validates. A tool-use loop is one assistant turn, so
+                // resuming it requires the thinking that led to the call to still be present and
+                // byte-identical. Replayed from the first call's stashed blocks (see
+                // `AnthropicToolCallState`), never rebuilt from the display summary.
+                for (const block of this.reasoningToReplay(msg.toolCalls[0], reachableModels)) {
+                    pushBlock('assistant', block);
+                }
                 if (msg.content) {
                     pushBlock('assistant', { type: 'text', text: msg.content });
                 }
@@ -539,23 +604,165 @@ export class AnthropicTransport {
         }
         return messages;
     }
+    /**
+     * The blocks to replay ahead of a tool call — fallback boundaries then reasoning, or none.
+     *
+     * A `signature` is only valid for the model that produced it, so reasoning captured under a
+     * *different* model is normally dropped: an agent that varies `provider` by state can switch
+     * models mid-loop, and replaying the old model's signatures would send blocks the new one
+     * cannot verify.
+     *
+     * Two ways the producer can be the model that will validate:
+     *
+     * 1. **It is the model we are asking for.** `state.model === this.model` — the ordinary case.
+     * 2. **Sticky routing will send this conversation back to it.** After a conversation falls
+     *    back, later requests carrying `fallbacks` go straight to the model that served, without
+     *    re-running the one that declined. That is what makes a fallback producer's reasoning
+     *    replayable at all (Fable 5 configured, Opus 4.8 serving — the pairing this transport's
+     *    own constructor warning recommends). But it holds only while the conversation continues
+     *    under the SAME request configuration, which is why `requestedModel` is compared rather
+     *    than just checking the chain for the producer.
+     *
+     * That second condition is deliberately narrow. Chain membership alone is too weak: a
+     * fallback target is only *contingently* the server, so an agent that switches `provider` to
+     * a model whose own chain happens to contain the old producer would replay foreign
+     * signatures to whichever model actually answers. Requiring the requested model to be
+     * unchanged separates "this conversation is still going" from "we are somewhere else now".
+     *
+     * State captured before `requestedModel` existed falls back to condition 1 alone, which is
+     * the conservative branch — it can drop reasoning, never misdirect it.
+     *
+     * Boundaries themselves are always echoed: keeping them in place is the documented rule, and
+     * with no thinking blocks around them they are inert rather than harmful.
+     */
+    reasoningToReplay(firstCall, reachableModels) {
+        var _a, _b, _c;
+        const state = (_a = firstCall.providerMetadata) === null || _a === void 0 ? void 0 : _a[ANTHROPIC_PROVIDER_KEY];
+        if (!state)
+            return [];
+        const boundaries = (_b = state.fallbacks) !== null && _b !== void 0 ? _b : [];
+        const stickyToProducer = state.requestedModel === this.model && reachableModels.has(state.model);
+        const vouched = state.model === this.model || stickyToProducer;
+        return [...boundaries, ...(vouched ? ((_c = state.reasoning) !== null && _c !== void 0 ? _c : []) : [])];
+    }
+    /**
+     * The model that actually served this response.
+     *
+     * A server-side `fallbacks` chain re-runs a declined request on another model and
+     * names it in the response's top-level `model`. Pricing must follow that, not the
+     * model we asked for: a Fable 5 request served by Opus 4.8 costed at Fable's
+     * $10/$50 instead of $5/$25 doubles that part of the bill.
+     *
+     * An unrecognised model id is NOT priced at a guessed rate — that is precisely how
+     * a consumer ended up billing Haiku at Sonnet rates. It warns and falls back to the
+     * configured model, which is at least a figure someone chose.
+     */
+    servingModel(response) {
+        const served = response.model;
+        if (!served || served === this.model)
+            return this.model;
+        if (SUPPORTED_ANTHROPIC_MODEL_IDS.includes(served)) {
+            return served;
+        }
+        // Latched per id: this is reached once per response AND once per fallback-chain attempt, so
+        // an unrecognised model would otherwise repeat on every iteration of every turn for the
+        // session's life — burying the one message the operator needs at exactly the moment cost
+        // reporting has gone wrong. Keyed by id so a second unknown model still gets its own line.
+        if (!this.warnedUnknownServingModels.has(served)) {
+            this.warnedUnknownServingModels.add(served);
+            logger.warn(`AnthropicTransport: response was served by "${served}", which is not a known model — ` +
+                `pricing it at the configured "${this.model}" rate instead of guessing. The reported ` +
+                `cost for this request may be wrong; add the model to SUPPORTED_ANTHROPIC_MODEL_IDS.`);
+        }
+        return this.model;
+    }
+    /**
+     * Whether a fallback-chain attempt is a refusal that was **not billed**.
+     *
+     * Anthropic does not charge for a refusal that arrives before any output: the token counts
+     * still appear in `usage`, but they are not on the bill. Pricing them anyway turns the
+     * fallback undercount this reducer was written to fix into an overcount — the documented
+     * example declines with `input_tokens: 535, output_tokens: 0`, which is real money at
+     * Fable 5's prompt rate.
+     *
+     * A **mid-output** refusal *is* billed for the input and whatever it streamed, so output
+     * tokens are the discriminator rather than the refusal itself.
+     *
+     * Declined attempts appear as `type: 'message'`; the attempt that served the turn is
+     * `type: 'fallback_message'`. The serving entry is normally billable — except when every
+     * model in the chain declined, where the last entry is both the serving one and a refusal,
+     * which `lastAndRefused` covers.
+     *
+     * Also called for a response with no chain at all, as `isUnbilledRefusal({}, usage, refused)`:
+     * a direct request that was declined has no `iterations` array, and the same rule applies to
+     * it. That is in fact the common case — `iterations` only appears when `fallbacks` was
+     * configured.
+     */
+    isUnbilledRefusal(attempt, usage, lastAndRefused) {
+        var _a;
+        if (((_a = usage.output_tokens) !== null && _a !== void 0 ? _a : 0) > 0)
+            return false;
+        return attempt.type === 'message' || lastAndRefused;
+    }
+    /** Cost one attempt's usage block at `model`'s rates, logging and banking it. */
+    costAttempt(model, usage) {
+        var _a, _b, _c, _d, _e, _f;
+        const cacheRead = (_a = usage.cache_read_input_tokens) !== null && _a !== void 0 ? _a : 0;
+        // 1-hour writes bill at 2× vs 1.25× for 5-min, so read the per-TTL breakdown when present
+        // and let the cost path split the buckets. Fall back to the flat total (treated as 5-min)
+        // when the breakdown is absent.
+        const breakdown = usage.cache_creation;
+        const cacheCreation1h = (_b = breakdown === null || breakdown === void 0 ? void 0 : breakdown.ephemeral_1h_input_tokens) !== null && _b !== void 0 ? _b : 0;
+        const cacheCreation = (_c = usage.cache_creation_input_tokens) !== null && _c !== void 0 ? _c : (breakdown ? ((_d = breakdown.ephemeral_5m_input_tokens) !== null && _d !== void 0 ? _d : 0) + cacheCreation1h : 0);
+        return this.logTokenUsage(model, (_e = usage.input_tokens) !== null && _e !== void 0 ? _e : 0, (_f = usage.output_tokens) !== null && _f !== void 0 ? _f : 0, cacheRead, cacheCreation, cacheCreation1h);
+    }
     fromAnthropicResponse(response) {
-        var _a, _b, _c, _d, _e, _f, _g, _h;
+        var _a, _b, _c, _d, _e, _f, _g;
         let inputTokens;
         let outputTokens;
         let cacheReadTokens;
         let cacheWriteTokens;
         let cost;
+        const servingModel = this.servingModel(response);
         if (response.usage) {
             const uncachedInput = (_a = response.usage.input_tokens) !== null && _a !== void 0 ? _a : 0;
             const cacheRead = (_b = response.usage.cache_read_input_tokens) !== null && _b !== void 0 ? _b : 0;
-            // 1-hour writes bill at 2× vs 1.25× for 5-min, so read the per-TTL breakdown when present
-            // and let the cost path split the buckets. Fall back to the flat total (treated as 5-min)
-            // when the breakdown is absent.
             const breakdown = response.usage.cache_creation;
             const cacheCreation1h = (_c = breakdown === null || breakdown === void 0 ? void 0 : breakdown.ephemeral_1h_input_tokens) !== null && _c !== void 0 ? _c : 0;
             const cacheCreation = (_d = response.usage.cache_creation_input_tokens) !== null && _d !== void 0 ? _d : (breakdown ? ((_e = breakdown.ephemeral_5m_input_tokens) !== null && _e !== void 0 ? _e : 0) + cacheCreation1h : 0);
-            cost = this.logTokenUsage(uncachedInput, (_f = response.usage.output_tokens) !== null && _f !== void 0 ? _f : 0, cacheRead, cacheCreation, cacheCreation1h);
+            // Top-level `usage` describes only the attempt that produced this message. When a
+            // fallback chain ran, the ATTEMPTS BEFORE IT were billed too — a mid-output decline
+            // bills for what it streamed — and they may have run on a different model at a
+            // different rate. Cost each attempt at its own model and sum; the token fields
+            // below still describe the serving attempt, which is what the message's content is.
+            const attempts = response.usage.iterations;
+            if (attempts === null || attempts === void 0 ? void 0 : attempts.length) {
+                const refused = response.stop_reason === 'refusal';
+                cost = attempts.reduce((total, attempt, index) => {
+                    var _a;
+                    const usage = (_a = attempt.usage) !== null && _a !== void 0 ? _a : attempt;
+                    if (this.isUnbilledRefusal(attempt, usage, index === attempts.length - 1 && refused)) {
+                        return total;
+                    }
+                    // An omitted `model` means the attempt ran on the model we ASKED for — which on a
+                    // chain turn is precisely not the one that served it. Defaulting to `servingModel`
+                    // here would price a declining Fable 5 attempt at Opus 4.8's $5/$25 instead of
+                    // $10/$50: half its real cost, in the same silent-undercount direction this reducer
+                    // exists to fix.
+                    const model = attempt.model ? this.servingModel({ model: attempt.model }) : this.model;
+                    return total + this.costAttempt(model, usage);
+                }, 0);
+            }
+            else if (this.isUnbilledRefusal({}, response.usage, response.stop_reason === 'refusal')) {
+                // A refusal with no chain behind it — the model was called directly, declined before
+                // producing anything, and was not charged. The `iterations` branch above only sees
+                // this when `fallbacks` was configured; most refusals arrive here instead, so pricing
+                // this path is the difference between an occasional phantom charge and a routine one.
+                cost = 0;
+            }
+            else {
+                cost = this.costAttempt(servingModel, response.usage);
+            }
             // Report TOTAL prompt size (uncached + cache read + cache write) so `inputTokens` means
             // "prompt tokens" consistently whether or not caching was active — matching Gemini's
             // `promptTokenCount`, which already includes cached tokens. Cost (above) reflects the
@@ -571,25 +778,65 @@ export class AnthropicTransport {
                 outputTokens = response.usage.output_tokens;
             }
         }
-        const blocks = (_g = response.content) !== null && _g !== void 0 ? _g : [];
+        const blocks = (_f = response.content) !== null && _f !== void 0 ? _f : [];
         const toolCalls = [];
         const thoughtParts = [];
         const textParts = [];
-        for (const block of blocks) {
+        // Raw reasoning blocks, kept verbatim for wire replay. Distinct from `thoughtParts`,
+        // which is the readable text for display — that copy is lossy (no signature) and must
+        // never be what goes back to the API.
+        const reasoningBlocks = [];
+        // A server-side fallback splits the turn: everything before the LAST `fallback` block was
+        // produced by a model that then declined. Its reasoning and client tool calls must be
+        // dropped when echoing the turn — they belong to a model that is no longer answering, and
+        // their signatures are not valid for the one that is. Replaying blocks from both sides of
+        // the boundary is a rejected request, not a degraded one. Absent a fallback (the normal
+        // case) this is -1, so every block counts as post-boundary and nothing changes.
+        const fallbackIndex = blocks.map((b) => b.type).lastIndexOf('fallback');
+        const fallbackBlocks = blocks.filter((b) => b.type === 'fallback');
+        for (const [index, block] of blocks.entries()) {
+            const postBoundary = index > fallbackIndex;
             if (block.type === 'tool_use') {
-                toolCalls.push({
-                    id: block.id,
-                    name: block.name,
-                    args: (_h = block.input) !== null && _h !== void 0 ? _h : {},
-                });
+                // A pre-boundary client tool call was abandoned with the declined attempt; echoing it
+                // would ask the serving model to own a call it never made.
+                if (postBoundary) {
+                    toolCalls.push({
+                        id: block.id,
+                        name: block.name,
+                        args: (_g = block.input) !== null && _g !== void 0 ? _g : {},
+                    });
+                }
             }
             else if (block.type === 'thinking') {
+                if (postBoundary)
+                    reasoningBlocks.push(block);
                 thoughtParts.push(block.thinking);
             }
+            else if (block.type === 'redacted_thinking') {
+                // No readable text by design — replayable but never displayable.
+                if (postBoundary)
+                    reasoningBlocks.push(block);
+            }
             else if (block.type === 'text') {
                 textParts.push(block.text);
             }
         }
+        // Attach the turn's reasoning to the FIRST tool call, which is where it is replayed
+        // from: the blocks precede the whole `tool_use` group in the assistant message, not
+        // each call individually. Stored only when a tool call exists — without one the turn
+        // ends and there is nothing to resume, so the blocks have no further wire role. The
+        // boundary marker travels with them so it can be re-emitted in position, which is what
+        // the API validates the surrounding thinking blocks against.
+        if (toolCalls.length > 0 && (reasoningBlocks.length > 0 || fallbackBlocks.length > 0)) {
+            const state = {
+                reasoning: reasoningBlocks,
+                model: servingModel,
+                requestedModel: this.model,
+            };
+            if (fallbackBlocks.length > 0)
+                state.fallbacks = fallbackBlocks;
+            toolCalls[0].providerMetadata = Object.assign(Object.assign({}, toolCalls[0].providerMetadata), { [ANTHROPIC_PROVIDER_KEY]: state });
+        }
         // A `max_tokens` stop means the response was cut off mid-stream. For a turn
         // carrying tool calls this is fatal: the final tool call's argument JSON was
         // truncated before it closed, so its args are incomplete and the call cannot
@@ -617,6 +864,11 @@ export class AnthropicTransport {
             base.cacheWriteTokens = cacheWriteTokens;
         if (cost != null)
             base.cost = cost;
+        // The model that actually answered — which is NOT the configured one when a
+        // fallback chain served the request. Stamped here rather than left to the driver,
+        // which only knows what was asked for; a usage ledger attributing spend to the
+        // requested model would misattribute every fallback-served turn.
+        base.model = servingModel;
         // Surface a non-standard stop reason for observability and parity with the
         // Gemini transport's `responseMeta.finishReason`. A text-only `max_tokens`
         // stop yields partial-but-legible content, so it is returned (not raised) with