@omnicross/core 0.1.2 → 0.1.3

package/dist/chunk-UNEFIWXI.cjs

@@ -0,0 +1,32 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }// src/openrouter.ts
+function isOpenRouterProvider(provider) {
+  const baseUrl = (provider.api_base_url || "").toLowerCase();
+  return baseUrl.includes("openrouter.ai");
+}
+var DEFAULT_APP_IDENTITY = {
+  referer: "https://github.com/Dumoedss/omnicross",
+  title: "Omnicross"
+};
+var OPENROUTER_APP_HEADERS = {
+  "HTTP-Referer": DEFAULT_APP_IDENTITY.referer,
+  "X-Title": DEFAULT_APP_IDENTITY.title
+};
+function setOpenRouterAppIdentity(identity) {
+  const referer = _optionalChain([identity, 'access', _ => _.referer, 'optionalAccess', _2 => _2.trim, 'call', _3 => _3()]);
+  const title = _optionalChain([identity, 'access', _4 => _4.title, 'optionalAccess', _5 => _5.trim, 'call', _6 => _6()]);
+  if (referer) OPENROUTER_APP_HEADERS["HTTP-Referer"] = referer;
+  if (title) OPENROUTER_APP_HEADERS["X-Title"] = title;
+}
+function getOpenRouterAppIdentity() {
+  return {
+    referer: OPENROUTER_APP_HEADERS["HTTP-Referer"],
+    title: OPENROUTER_APP_HEADERS["X-Title"]
+  };
+}
+
+
+
+
+
+
+exports.isOpenRouterProvider = isOpenRouterProvider; exports.OPENROUTER_APP_HEADERS = OPENROUTER_APP_HEADERS; exports.setOpenRouterAppIdentity = setOpenRouterAppIdentity; exports.getOpenRouterAppIdentity = getOpenRouterAppIdentity;

package/dist/chunk-VQY5W4YW.cjs

@@ -0,0 +1,311 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } var _class;// src/pipeline/SubscriptionAccountHealth.ts
+var OVERLOAD_TTL_MS = 10 * 6e4;
+var OVERLOAD_ENABLED_DEFAULT = true;
+var AUTH_ERROR_TTL_MS = 30 * 6e4;
+var SERVER_ERROR_TTL_MS = 5 * 6e4;
+var BAN_BODY_MARKERS = [
+  "this organization has been disabled",
+  "oauth authentication is currently not allowed"
+];
+function readHeader(headers, name) {
+  if (typeof headers.get === "function") {
+    return headers.get(name);
+  }
+  const rec = headers;
+  return _nullishCoalesce(_nullishCoalesce(rec[name], () => ( rec[name.toLowerCase()])), () => ( null));
+}
+function parseIntHeader(value) {
+  if (value == null) return null;
+  const n = Number.parseInt(value.trim(), 10);
+  return Number.isFinite(n) ? n : null;
+}
+function resolveResetSeconds(providerId, headers) {
+  const unified = parseIntHeader(readHeader(headers, "anthropic-ratelimit-unified-reset"));
+  if (providerId === "claude") {
+    return { resetHeaderSeconds: unified, retryAfterSeconds: null };
+  }
+  const providerReset = _nullishCoalesce(parseIntHeader(readHeader(headers, "x-ratelimit-reset")), () => ( parseIntHeader(readHeader(headers, "ratelimit-reset"))));
+  const retryAfter = parseIntHeader(readHeader(headers, "retry-after"));
+  return {
+    resetHeaderSeconds: _nullishCoalesce(unified, () => ( providerReset)),
+    retryAfterSeconds: retryAfter
+  };
+}
+function isBanBody(bodyText) {
+  if (!bodyText) return false;
+  const lower = bodyText.toLowerCase();
+  return BAN_BODY_MARKERS.some((marker) => lower.includes(marker));
+}
+function isRecordEmpty(record) {
+  return record.rateLimitEndAt === void 0 && record.overloadUntil === void 0 && record.tempUnavailableUntil === void 0 && !record.blocked;
+}
+var KEY_SEP = "\0";
+var SubscriptionAccountHealth = (_class = class {
+  __init() {this.records = /* @__PURE__ */ new Map()}
+  __init2() {this.listeners = /* @__PURE__ */ new Set()}
+  __init3() {this.anomalyListeners = /* @__PURE__ */ new Set()}
+  
+  
+  
+  
+  
+  constructor(opts = {}) {;_class.prototype.__init.call(this);_class.prototype.__init2.call(this);_class.prototype.__init3.call(this);
+    this.now = _nullishCoalesce(opts.now, () => ( Date.now));
+    this.overloadEnabled = _nullishCoalesce(opts.overloadEnabled, () => ( OVERLOAD_ENABLED_DEFAULT));
+    this.overloadTtlMs = _nullishCoalesce(opts.overloadTtlMs, () => ( OVERLOAD_TTL_MS));
+    this.authErrorTtlMs = _nullishCoalesce(opts.authErrorTtlMs, () => ( AUTH_ERROR_TTL_MS));
+    this.serverErrorTtlMs = _nullishCoalesce(opts.serverErrorTtlMs, () => ( SERVER_ERROR_TTL_MS));
+  }
+  /**
+   * Re-apply cooldown config to the LIVE shared instance (subscription-account-
+   * health, LEAD OQ1). `buildDaemon` is synchronous so it cannot await the
+   * persisted server config; the async `start.ts` path loads it and applies the
+   * `accountHealth` segment here — every strategy/relay/sweeper that already
+   * captured this instance picks the new values up. Only defined fields override.
+   */
+  configure(opts) {
+    if (opts.overloadEnabled !== void 0) this.overloadEnabled = opts.overloadEnabled;
+    if (opts.overloadTtlMs !== void 0) this.overloadTtlMs = opts.overloadTtlMs;
+    if (opts.authErrorTtlMs !== void 0) this.authErrorTtlMs = opts.authErrorTtlMs;
+    if (opts.serverErrorTtlMs !== void 0) this.serverErrorTtlMs = opts.serverErrorTtlMs;
+  }
+  /**
+   * Whether an account may be scheduled RIGHT NOW. `blocked` → false; any timer
+   * still in the future → false. Expired timers are lazily deleted on read (CRS
+   * lazy-clear parity) so an elapsed cooldown restores the account WITHOUT a
+   * timer — but the recovery SIGNAL is the sweeper's job (`sweepRecoveries`), so
+   * this read never emits (correctness is independent of the tick).
+   */
+  isSchedulable(providerId, accountId, now = this.now()) {
+    const key = this.key(providerId, accountId);
+    const record = this.records.get(key);
+    if (!record) return true;
+    if (record.blocked) return false;
+    const active = this.clearExpired(record, now);
+    if (!active && isRecordEmpty(record)) this.records.delete(key);
+    return !active;
+  }
+  /**
+   * The single marking entry point (design D3). Faithful to CRS status semantics:
+   *  - 429 + authoritative reset → `rateLimitEndAt`; a non-claude 429 may use
+   *    `retryAfterSeconds`; a bare 429 (no resolvable reset) is NOT marked;
+   *  - 529 → `overloadUntil` (gated by `overloadEnabled`);
+   *  - 403-ban body → `blocked` (permanent); plain 403 → transient;
+   *  - final-401 → transient; 5xx / thrown(null) → transient;
+   *  - non-429 4xx → NEUTRAL (never marked);
+   *  - 2xx → clear rate-limit + transient state (keep `blocked`).
+   */
+  recordUpstreamOutcome(providerId, accountId, input) {
+    const now = _nullishCoalesce(input.now, () => ( this.now()));
+    const key = this.key(providerId, accountId);
+    const preExisting = this.records.get(key);
+    const record = _nullishCoalesce(preExisting, () => ( {}));
+    const status = input.status;
+    const wasUnhealthyBefore = preExisting ? this.isUnhealthyAt(preExisting, now) : false;
+    let anomalyState;
+    let recovered = false;
+    if (status === null) {
+      record.tempUnavailableUntil = now + this.serverErrorTtlMs;
+    } else if (status >= 200 && status < 300) {
+      const wasUnhealthy = record.rateLimitEndAt !== void 0 || record.overloadUntil !== void 0 || record.tempUnavailableUntil !== void 0;
+      delete record.rateLimitEndAt;
+      delete record.overloadUntil;
+      delete record.tempUnavailableUntil;
+      recovered = wasUnhealthy && !record.blocked;
+    } else if (status === 429) {
+      if (input.resetHeaderSeconds != null) {
+        record.rateLimitEndAt = input.resetHeaderSeconds * 1e3;
+        anomalyState = "rate_limited";
+      } else if (input.retryAfterSeconds != null) {
+        record.rateLimitEndAt = now + input.retryAfterSeconds * 1e3;
+        anomalyState = "rate_limited";
+      }
+    } else if (status === 529) {
+      if (this.overloadEnabled) {
+        record.overloadUntil = now + this.overloadTtlMs;
+        anomalyState = "overloaded";
+      }
+    } else if (status === 403) {
+      if (isBanBody(input.bodyText)) {
+        record.blocked = true;
+        anomalyState = "blocked";
+      } else {
+        record.tempUnavailableUntil = now + this.authErrorTtlMs;
+        anomalyState = "unauthorized";
+      }
+    } else if (status === 401) {
+      record.tempUnavailableUntil = now + this.authErrorTtlMs;
+      anomalyState = "unauthorized";
+    } else if (status >= 500) {
+      record.tempUnavailableUntil = now + this.serverErrorTtlMs;
+    }
+    if (isRecordEmpty(record)) this.records.delete(key);
+    else this.records.set(key, record);
+    if (recovered) this.emit({ providerId, accountId, at: now, kind: "rateLimitRecovery" });
+    if (anomalyState && !wasUnhealthyBefore) {
+      this.emitAnomaly({ providerId, accountId, at: now, state: anomalyState });
+    }
+  }
+  /** Whether a record is unhealthy at `now`: blocked, or any timer still future. */
+  isUnhealthyAt(record, now) {
+    if (record.blocked) return true;
+    if (record.rateLimitEndAt !== void 0 && now < record.rateLimitEndAt) return true;
+    if (record.overloadUntil !== void 0 && now < record.overloadUntil) return true;
+    if (record.tempUnavailableUntil !== void 0 && now < record.tempUnavailableUntil) return true;
+    return false;
+  }
+  /**
+   * Clear ONLY the auth/transient unavailability mark (`tempUnavailableUntil`) —
+   * the narrow healing a background PROBE is allowed to do (subscription-account-
+   * probe #8, review M1). A probe 2xx from the lightweight `GET /v1/models` attests
+   * the TOKEN works (so a final-401 / plain-403 / 5xx transient may be healed), but
+   * it does NOT prove the traffic endpoint's rate-limit / overload has recovered —
+   * so it MUST NOT touch `rateLimitEndAt` / `overloadUntil` (those clear only on the
+   * upstream's authoritative reset, or a REAL-traffic 2xx). `blocked` (a ban) is
+   * never cleared here. Distinct from `recordUpstreamOutcome`'s 2xx path, which is
+   * UNCHANGED and still clears rate + transient together because it IS traffic.
+   * Returns whether a transient mark was actually cleared. Does NOT emit a recovery
+   * signal (a probe is internal maintenance; the account is schedulable-on-read).
+   */
+  clearTransientMark(providerId, accountId) {
+    const key = this.key(providerId, accountId);
+    const record = this.records.get(key);
+    if (!record || record.tempUnavailableUntil === void 0) return false;
+    delete record.tempUnavailableUntil;
+    if (isRecordEmpty(record)) this.records.delete(key);
+    else this.records.set(key, record);
+    return true;
+  }
+  /**
+   * Proactively surface accounts that transitioned unhealthy → schedulable since
+   * the last sweep (design D6). Clears their expired timers, emits a recovery
+   * signal for each through `onRecovered`, and returns the list. A `blocked`
+   * account never recovers here. Correctness does NOT depend on this running —
+   * `isSchedulable` already restores an elapsed cooldown lazily; this adds the
+   * proactive signal (#5/#8) + lets the daemon nudge a token refresh.
+   */
+  sweepRecoveries(now = this.now()) {
+    const recovered = [];
+    for (const [key, record] of this.records) {
+      if (record.blocked) continue;
+      const hadTimer = record.rateLimitEndAt !== void 0 || record.overloadUntil !== void 0 || record.tempUnavailableUntil !== void 0;
+      const active = this.clearExpired(record, now);
+      if (hadTimer && !active && isRecordEmpty(record)) {
+        const [pid, aid] = this.parseKey(key);
+        recovered.push({ providerId: pid, accountId: aid, at: now, kind: "rateLimitRecovery" });
+        this.records.delete(key);
+      }
+    }
+    for (const event of recovered) this.emit(event);
+    return recovered;
+  }
+  /** Admin-facing coarse status + cooldown-until for one account (secret-free). */
+  getStatus(providerId, accountId, now = this.now()) {
+    const record = this.records.get(this.key(providerId, accountId));
+    if (!record) return { state: "healthy" };
+    if (record.blocked) return { state: "blocked" };
+    if (record.rateLimitEndAt !== void 0 && now < record.rateLimitEndAt) {
+      return { state: "rate_limited", cooldownUntil: record.rateLimitEndAt };
+    }
+    if (record.overloadUntil !== void 0 && now < record.overloadUntil) {
+      return { state: "overloaded", cooldownUntil: record.overloadUntil };
+    }
+    if (record.tempUnavailableUntil !== void 0 && now < record.tempUnavailableUntil) {
+      return { state: "transient", cooldownUntil: record.tempUnavailableUntil };
+    }
+    return { state: "healthy" };
+  }
+  /**
+   * Register a recovery listener (the OQ3 seam #5 webhooks + #8 health-cron
+   * consume). Returns an unsubscribe function. Two edges fire it:
+   *  - TRAFFIC-DRIVEN: a `recordUpstreamOutcome` 2xx that clears an unhealthy
+   *    account (guaranteed — the sweep would miss it, as the 2xx deletes the
+   *    record first); and
+   *  - PURE-IDLE: `sweepRecoveries` when an idle account's cooldown elapsed with
+   *    no traffic (best-effort, on the 60s tick).
+   * A lazy `isSchedulable` read that heals an account does NOT emit (a request is
+   * already using it) — so consumers never double-count a recovery.
+   */
+  onRecovered(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  emit(event) {
+    for (const listener of this.listeners) {
+      try {
+        listener(event);
+      } catch (e) {
+      }
+    }
+  }
+  /**
+   * Register an anomaly listener (the ADDITIVE seam #5 webhooks consumes; the
+   * frozen `kind` discriminator on {@link AccountRecoveryEvent} anticipated it).
+   * Fires ONLY on the healthy→unhealthy EDGE inside `recordUpstreamOutcome`
+   * (de-duped: an already-unhealthy account escalating does NOT re-fire). Returns
+   * an unsubscribe function. Existing marking/recovery behavior is UNCHANGED.
+   */
+  onAnomaly(listener) {
+    this.anomalyListeners.add(listener);
+    return () => this.anomalyListeners.delete(listener);
+  }
+  emitAnomaly(event) {
+    for (const listener of this.anomalyListeners) {
+      try {
+        listener(event);
+      } catch (e2) {
+      }
+    }
+  }
+  /**
+   * Delete every EXPIRED timer field on the record in place; return whether any
+   * timer is STILL active (in the future). `blocked` is not a timer and is left
+   * untouched here (only an explicit reset / restart clears a ban).
+   */
+  clearExpired(record, now) {
+    let active = false;
+    if (record.rateLimitEndAt !== void 0) {
+      if (now >= record.rateLimitEndAt) delete record.rateLimitEndAt;
+      else active = true;
+    }
+    if (record.overloadUntil !== void 0) {
+      if (now >= record.overloadUntil) delete record.overloadUntil;
+      else active = true;
+    }
+    if (record.tempUnavailableUntil !== void 0) {
+      if (now >= record.tempUnavailableUntil) delete record.tempUnavailableUntil;
+      else active = true;
+    }
+    return active;
+  }
+  key(providerId, accountId) {
+    return `${providerId}${KEY_SEP}${accountId}`;
+  }
+  parseKey(key) {
+    const idx = key.indexOf(KEY_SEP);
+    return [key.slice(0, idx), key.slice(idx + 1)];
+  }
+}, _class);
+var _shared = null;
+function getSharedAccountHealth() {
+  if (!_shared) _shared = new SubscriptionAccountHealth();
+  return _shared;
+}
+function setSharedAccountHealth(instance) {
+  _shared = instance;
+}
+function __resetSharedAccountHealthForTests() {
+  _shared = null;
+}
+
+
+
+
+
+
+
+
+
+
+
+exports.OVERLOAD_TTL_MS = OVERLOAD_TTL_MS; exports.OVERLOAD_ENABLED_DEFAULT = OVERLOAD_ENABLED_DEFAULT; exports.AUTH_ERROR_TTL_MS = AUTH_ERROR_TTL_MS; exports.SERVER_ERROR_TTL_MS = SERVER_ERROR_TTL_MS; exports.resolveResetSeconds = resolveResetSeconds; exports.SubscriptionAccountHealth = SubscriptionAccountHealth; exports.getSharedAccountHealth = getSharedAccountHealth; exports.setSharedAccountHealth = setSharedAccountHealth; exports.__resetSharedAccountHealthForTests = __resetSharedAccountHealthForTests;

package/dist/chunk-WNY4WMRF.js

@@ -0,0 +1,32 @@
+// src/pipeline/auditSink.ts
+var sink = null;
+var captureConfig = null;
+function setAuditSink(fn) {
+  sink = fn;
+}
+function setAuditCaptureConfig(config) {
+  captureConfig = config && config.enabled ? config : null;
+}
+function getAuditCaptureConfig() {
+  return captureConfig;
+}
+function recordAudit(record) {
+  const active = sink;
+  if (!active) return;
+  try {
+    active(record);
+  } catch {
+  }
+}
+function __resetAuditSinkForTests() {
+  sink = null;
+  captureConfig = null;
+}
+
+export {
+  setAuditSink,
+  setAuditCaptureConfig,
+  getAuditCaptureConfig,
+  recordAudit,
+  __resetAuditSinkForTests
+};

package/dist/chunk-XEKD23J5.js

@@ -0,0 +1,9 @@
+// src/outbound-api/types.ts
+var ENDPOINT_MODEL_KINDS = {
+  messages: ["fable", "opus", "sonnet", "haiku"],
+  responses: ["codex", "mini"]
+};
+
+export {
+  ENDPOINT_MODEL_KINDS
+};

package/dist/chunk-XTEI64OU.js

@@ -0,0 +1,145 @@
+import {
+  refreshNonStainless,
+  sanitizeFrozenHeaders
+} from "./chunk-XX6NQJMA.js";
+
+// src/provider-proxy/identity/SubscriptionIdentityStore.ts
+var CC_HEADER_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var KEY_SEP = "\0";
+function normalizeUa(ua) {
+  if (typeof ua !== "string") return void 0;
+  const trimmed = ua.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+var SubscriptionIdentityStore = class {
+  identities = /* @__PURE__ */ new Map();
+  now;
+  enabled;
+  ua;
+  ccHeaderTtlMs;
+  persistence = null;
+  constructor(opts = {}) {
+    this.now = opts.now ?? Date.now;
+    this.enabled = opts.enabled ?? false;
+    this.ua = normalizeUa(opts.ua);
+    this.ccHeaderTtlMs = opts.ccHeaderTtlMs ?? CC_HEADER_TTL_MS;
+  }
+  /** Whether capture/replay is engaged (config flag). */
+  isEnabled() {
+    return this.enabled;
+  }
+  /** The operator UA baseline (piece 4), or undefined when unset. */
+  uaBaseline() {
+    return this.ua;
+  }
+  /**
+   * Re-apply config to the LIVE shared instance (bootstrap, mirroring the health
+   * tracker's `configure`). Only defined fields override; `ua: null` clears the
+   * baseline.
+   */
+  configure(opts) {
+    if (opts.enabled !== void 0) this.enabled = opts.enabled;
+    if (opts.ua !== void 0) this.ua = normalizeUa(opts.ua ?? void 0);
+  }
+  /** Install (or clear) the write-through persistence port (P2). */
+  setPersistence(port) {
+    this.persistence = port;
+  }
+  /**
+   * Boot seed (P2, D5): install a PERSISTED identity for an account, but NEVER
+   * over a live in-memory capture (a re-captured identity from this session wins).
+   * A no-op for an empty/absent identity. Does NOT write back through the port.
+   */
+  seed(providerId, accountId, identity) {
+    if (!accountId || !identity) return;
+    const headers = sanitizeFrozenHeaders(identity.headers ?? {});
+    if (Object.keys(headers).length === 0) return;
+    const key = this.key(providerId, accountId);
+    if (this.identities.has(key)) return;
+    this.identities.set(key, {
+      headers,
+      capturedAt: typeof identity.capturedAt === "number" ? identity.capturedAt : this.now()
+    });
+  }
+  /**
+   * Capture a real client's fingerprint headers for an account. First-seen ⇒
+   * FREEZE the whole (sanitized) bag. Already-frozen ⇒ within the TTL, no change
+   * (stable identity); past the TTL, refresh the NON-stainless headers from the
+   * new observation while keeping stainless frozen-stable (P2). An empty/absent
+   * account id or an empty sanitized bag is a no-op (so an account with no
+   * fingerprint headers never freezes an empty identity → the caller falls back
+   * to the UA baseline). Fires the persistence port on a freeze/refresh.
+   */
+  capture(providerId, accountId, incoming, now = this.now()) {
+    if (!accountId) return;
+    const clean = sanitizeFrozenHeaders(incoming);
+    if (Object.keys(clean).length === 0) return;
+    const key = this.key(providerId, accountId);
+    const existing = this.identities.get(key);
+    if (!existing) {
+      const frozen = { headers: clean, capturedAt: now };
+      this.identities.set(key, frozen);
+      this.emitPersist(providerId, accountId, frozen);
+      return;
+    }
+    if (now - existing.capturedAt < this.ccHeaderTtlMs) return;
+    const refreshed = {
+      headers: refreshNonStainless(existing.headers, clean),
+      capturedAt: now
+    };
+    this.identities.set(key, refreshed);
+    this.emitPersist(providerId, accountId, refreshed);
+  }
+  /**
+   * The frozen identity headers for an account, or `undefined` when none is
+   * frozen (or the frozen set is empty). Returns a COPY (the caller merges it into
+   * a mutable outbound header bag).
+   */
+  replay(providerId, accountId) {
+    if (!accountId) return void 0;
+    const frozen = this.identities.get(this.key(providerId, accountId));
+    if (!frozen || Object.keys(frozen.headers).length === 0) return void 0;
+    return { ...frozen.headers };
+  }
+  /** Whether an identity is frozen for an account (admin coarse status — D7). */
+  hasIdentity(providerId, accountId) {
+    const frozen = this.identities.get(this.key(providerId, accountId));
+    return !!frozen && Object.keys(frozen.headers).length > 0;
+  }
+  /** The freeze/refresh time for an account's identity (admin coarse status). */
+  capturedAt(providerId, accountId) {
+    return this.identities.get(this.key(providerId, accountId))?.capturedAt;
+  }
+  emitPersist(providerId, accountId, identity) {
+    if (!this.persistence) return;
+    try {
+      this.persistence.persist(providerId, accountId, {
+        headers: { ...identity.headers },
+        capturedAt: identity.capturedAt
+      });
+    } catch {
+    }
+  }
+  key(providerId, accountId) {
+    return `${providerId}${KEY_SEP}${accountId}`;
+  }
+};
+var _shared = null;
+function getSharedIdentityStore() {
+  if (!_shared) _shared = new SubscriptionIdentityStore();
+  return _shared;
+}
+function setSharedIdentityStore(instance) {
+  _shared = instance;
+}
+function __resetSharedIdentityStoreForTests() {
+  _shared = null;
+}
+
+export {
+  CC_HEADER_TTL_MS,
+  SubscriptionIdentityStore,
+  getSharedIdentityStore,
+  setSharedIdentityStore,
+  __resetSharedIdentityStoreForTests
+};

package/dist/chunk-XX6NQJMA.js

@@ -0,0 +1,92 @@
+// src/provider-proxy/identity/fingerprintHeaders.ts
+var STAINLESS_PREFIX = "x-stainless-";
+var FINGERPRINT_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "user-agent",
+  "anthropic-beta",
+  "anthropic-version",
+  "anthropic-dangerous-direct-browser-access",
+  "x-app"
+]);
+var EXCLUDED_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "authorization",
+  "x-api-key",
+  "cookie",
+  "proxy-authorization",
+  "set-cookie"
+]);
+var PROTECTED_OUTBOUND = /* @__PURE__ */ new Set(["authorization", "content-type"]);
+function isStainless(name) {
+  return name.toLowerCase().startsWith(STAINLESS_PREFIX);
+}
+function extractFingerprintHeaders(reqHeaders) {
+  const out = {};
+  for (const [rawKey, rawVal] of Object.entries(reqHeaders)) {
+    if (rawVal === void 0) continue;
+    const key = rawKey.toLowerCase();
+    if (EXCLUDED_HEADER_NAMES.has(key)) continue;
+    const whitelisted = FINGERPRINT_HEADER_NAMES.has(key) || key.startsWith(STAINLESS_PREFIX);
+    if (!whitelisted) continue;
+    const value = Array.isArray(rawVal) ? rawVal.filter((v) => typeof v === "string").join(", ") : rawVal;
+    if (typeof value === "string" && value.length > 0) out[key] = value;
+  }
+  return out;
+}
+function captureCallerIdentity(store, reqHeaders) {
+  if (!store.isEnabled()) return void 0;
+  return extractFingerprintHeaders(reqHeaders);
+}
+function sanitizeFrozenHeaders(headers) {
+  const out = {};
+  for (const [k, v] of Object.entries(headers)) {
+    if (typeof v !== "string" || v.length === 0) continue;
+    const lower = k.toLowerCase();
+    if (EXCLUDED_HEADER_NAMES.has(lower) || PROTECTED_OUTBOUND.has(lower)) continue;
+    out[lower] = v;
+  }
+  return out;
+}
+function refreshNonStainless(frozen, incoming) {
+  const out = {};
+  for (const [k, v] of Object.entries(frozen)) {
+    if (isStainless(k)) out[k] = v;
+  }
+  const nonStainlessKeys = /* @__PURE__ */ new Set();
+  for (const k of Object.keys(frozen)) if (!isStainless(k)) nonStainlessKeys.add(k);
+  for (const k of Object.keys(incoming)) if (!isStainless(k)) nonStainlessKeys.add(k);
+  for (const k of nonStainlessKeys) {
+    const v = incoming[k] ?? frozen[k];
+    if (typeof v === "string" && v.length > 0) out[k] = v;
+  }
+  return out;
+}
+function mergeFrozenIdentity(headers, identity) {
+  const present = new Set(Object.keys(headers).map((k) => k.toLowerCase()));
+  for (const [k, v] of Object.entries(identity)) {
+    const lower = k.toLowerCase();
+    if (PROTECTED_OUTBOUND.has(lower)) continue;
+    if (present.has(lower)) continue;
+    headers[k] = v;
+  }
+}
+function applyFingerprint(store, headers, providerId, accountId, callerIdentity, now) {
+  if (!store.isEnabled() || !accountId) return;
+  if (callerIdentity) store.capture(providerId, accountId, callerIdentity, now);
+  const identity = store.replay(providerId, accountId);
+  if (identity) {
+    mergeFrozenIdentity(headers, identity);
+    return;
+  }
+  const ua = store.uaBaseline();
+  if (ua) mergeFrozenIdentity(headers, { "user-agent": ua });
+}
+
+export {
+  STAINLESS_PREFIX,
+  isStainless,
+  extractFingerprintHeaders,
+  captureCallerIdentity,
+  sanitizeFrozenHeaders,
+  refreshNonStainless,
+  mergeFrozenIdentity,
+  applyFingerprint
+};

package/dist/{chunk-N3V2J5ZO.cjs → chunk-Y6OM7EV7.cjs}

@@ -31,15 +31,18 @@ var SubscriptionAuthSource = class {
     try {
       await this.profile.authStrategy.applyHeaders(headers, {
         upstreamUrl: hints.upstreamUrl,
-        resolvedModel: hints.model
+        resolvedModel: hints.model,
+        sessionKey: hints.sessionKey,
+        reportSelection: hints.reportSelection
       });
     } catch (err) {
       console.warn("[SubscriptionAuthSource] authStrategy.applyHeaders threw:", _chunkSVNDB62Dcjs.serializeError.call(void 0, err));
     }
   }
-  /** Delegate the 401-refresh decision to the bound strategy. */
-  async onUnauthorized() {
-    return this.profile.authStrategy.onUnauthorized();
+  /** Delegate the 401-refresh decision to the bound strategy, threading the
+   *  session key so the account actually served is the one refreshed (D7). */
+  async onUnauthorized(sessionKey) {
+    return this.profile.authStrategy.onUnauthorized(sessionKey);
   }
   /** Resolve the upstream URL from the profile, when it provides one. */
   resolveUpstreamUrl(model) {

package/dist/{chunk-745DV5FL.js → chunk-Y7FO65VT.js}

@@ -1,12 +1,12 @@
-import {
-  isOpenRouterProvider
-} from "./chunk-E3WHL7CO.js";
 import {
   API_FORMAT_PROVIDER_MAP,
   NATIVE_SEARCH_EXCLUDED_MODELS,
   NATIVE_SEARCH_MODEL_PATTERNS,
   OPENAI_CHAT_COMPLETION_SEARCH_MODELS
 } from "./chunk-FMOBD2OQ.js";
+import {
+  isOpenRouterProvider
+} from "./chunk-HUZZZ3JL.js";
 
 // src/completion/NativeSearchInjector.ts
 function detectNativeSearch(modelId, apiFormat, provider, userExplicit) {

package/dist/{chunk-PXUJF5HS.js → chunk-ZY6KU6P3.js}

@@ -4,7 +4,7 @@ import {
 import {
   OPENROUTER_APP_HEADERS,
   isOpenRouterProvider
-} from "./chunk-E3WHL7CO.js";
+} from "./chunk-HUZZZ3JL.js";
 
 // src/completion/header-builder.ts
 function getProviderHeaders(provider, apiKey) {
@@ -14,7 +14,9 @@ function getProviderHeaders(provider, apiKey) {
     case "anthropic":
       headers = {
         "Content-Type": "application/json",
-        "x-api-key": apiKey,
+        // Third-party Anthropic-Messages relays often gate on a Bearer token
+        // rather than x-api-key; `provider.useBearer` opts into that.
+        ...provider.useBearer ? { Authorization: `Bearer ${apiKey}` } : { "x-api-key": apiKey },
         "anthropic-version": "2025-01-10"
         // Required for extended thinking feature
       };