@velum-labs/routekit-daemon 1.3.2 → 1.5.0

package/dist/internal-providers/provider-bedrock/test/connection.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/internal-providers/provider-bedrock/test/connection.test.js

@@ -0,0 +1,249 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { runRouteKitEffect } from "@velum-labs/routekit-runtime/effect";
+import { bedrockRoleCredentials, bedrockRoleEnrollment, makeBedrockRoleCredentials } from "../connection.js";
+import { BEDROCK_MASTER_CREDENTIALS_DISABLED, BEDROCK_MASTER_CREDENTIALS_RESOURCE } from "../workload-credentials.js";
+const context = {
+    enrollmentId: "00000000-0000-4000-8000-000000000001", sourceId: "production",
+    nonce: "x".repeat(43), callbackUrl: "https://cloud.example/callback",
+    settings: {
+        rolePrincipalArn: "arn:aws:iam::123456789012:role/RouteKitCloud",
+        roleTemplateUrl: "https://routekit-templates.s3.us-east-1.amazonaws.com/connection-role.yaml"
+    },
+    fetch: async () => { assert.fail("Role setup must not make HTTP requests"); }
+};
+test("role onboarding uses an enrollment-specific external ID and stores a renewable role binding", async () => {
+    const start = await runRouteKitEffect(bedrockRoleEnrollment.start(context, { region: "us-east-1" }));
+    if (start.kind !== "action" || start.action.kind !== "external")
+        throw new Error("Missing setup action");
+    const url = new URL(start.action.url);
+    assert.equal(url.origin, "https://us-east-1.console.aws.amazon.com");
+    assert.match(url.hash, /^#\/stacks\/create\/review\?/u);
+    const params = new URLSearchParams(url.hash.split("?")[1]);
+    assert.equal(params.get("param_ExternalId"), context.nonce);
+    assert.equal(params.get("param_RouteKitPrincipalArn"), context.settings.rolePrincipalArn);
+    assert.match(params.get("stackName") ?? "", /^RouteKit-[A-Za-z0-9-]+-[a-f0-9]{24}$/u);
+    const form = await runRouteKitEffect(bedrockRoleEnrollment.resume(context, start.state, { kind: "submit", stepId: "setup", values: {} }));
+    if (form.kind !== "action" || form.action.kind !== "form")
+        throw new Error("Missing role form");
+    const complete = await runRouteKitEffect(bedrockRoleEnrollment.resume(context, form.state, {
+        kind: "submit",
+        stepId: "role",
+        values: {
+            "role-arn": "arn:aws:iam::999999999999:role/routekit-cloud/CustomerConnection"
+        }
+    }));
+    if (complete.kind !== "complete")
+        throw new Error("Missing binding");
+    assert.deepEqual(complete.connection.environment, {});
+    assert.equal(complete.connection.credential?.kind, "assume-role");
+    const first = await runRouteKitEffect(bedrockRoleCredentials.resolve(complete.connection.credential, { sourceId: "one" }));
+    const second = await runRouteKitEffect(bedrockRoleCredentials.resolve(complete.connection.credential, { sourceId: "two" }));
+    assert.equal(first.environment?.AWS_REGION, "us-east-1");
+    assert.equal(first.environment?.AWS_ACCESS_KEY_ID, undefined);
+    assert.equal(typeof first.resources?.bedrockCredentials, "function");
+    assert.notEqual(first.resources?.bedrockCredentials, second.resources?.bedrockCredentials);
+});
+test("role connection availability requires deployment configuration and rejects malformed bindings", async () => {
+    assert.equal(bedrockRoleEnrollment.available?.({}), false);
+    assert.equal(bedrockRoleEnrollment.available?.(context.settings), true);
+    for (const roleTemplateUrl of [
+        "http://localhost/role.yaml",
+        "https://routekit-templates.s3.us-east-1.amazonaws.com/",
+        "https://s3.us-east-1.amazonaws.com/routekit-templates",
+        "https://routekit-templates.s3-website-us-east-1.amazonaws.com/role.yaml",
+        "https://routekit-templates.s3-accelerate.amazonaws.com/role.yaml",
+        "https://access:secret@routekit-templates.s3.us-east-1.amazonaws.com/role.yaml",
+        "https://routekit-templates.s3.us-east-1.amazonaws.com/role.yaml?versionId=one",
+        "https://routekit-templates.s3.us-east-1.amazonaws.com/role.yaml#fragment",
+        "https://routekit-templates.s3.us-east-1.amazonaws.com.example/role.yaml"
+    ]) {
+        assert.equal(bedrockRoleEnrollment.available?.({
+            ...context.settings,
+            roleTemplateUrl
+        }), false, roleTemplateUrl);
+    }
+    await assert.rejects(runRouteKitEffect(bedrockRoleCredentials.resolve({
+        version: 1, kind: "assume-role", payload: { roleArn: "bad", region: "us-east-1", externalId: "short" }
+    }, { sourceId: "one" })));
+    await assert.rejects(runRouteKitEffect(bedrockRoleEnrollment.resume(context, { version: 2, data: {} }, { kind: "submit", stepId: "role", values: {} })));
+});
+test("role onboarding rejects out-of-scope roles and malformed enrollment nonces", async () => {
+    const started = await runRouteKitEffect(bedrockRoleEnrollment.start(context, { region: "us-east-1" }));
+    if (started.kind !== "action")
+        throw new Error("Missing setup action");
+    for (const roleArn of [
+        "arn:aws:iam::999999999999:role/CustomerConnection",
+        "arn:aws:iam::999999999999:role/routekit-cloudish/CustomerConnection",
+        "arn:aws:iam::999999999999:role/routekit-cloud/",
+        "arn:aws:iam::99999999999:role/routekit-cloud/CustomerConnection",
+        "arn:aws-us-gov:iam::999999999999:role/routekit-cloud/CustomerConnection",
+        `arn:aws:iam::999999999999:role/routekit-cloud/${"x".repeat(2049)}`
+    ]) {
+        await assert.rejects(runRouteKitEffect(bedrockRoleEnrollment.resume(context, started.state, {
+            kind: "submit",
+            stepId: "role",
+            values: { "role-arn": roleArn }
+        })), /Enter the RoleArn/);
+    }
+    for (const nonce of [
+        "x".repeat(42),
+        "x".repeat(44),
+        "x".repeat(42) + "=",
+        "x".repeat(42) + "/"
+    ]) {
+        await assert.rejects(runRouteKitEffect(bedrockRoleEnrollment.start({ ...context, nonce }, { region: "us-east-1" })), /Choose a valid AWS region/);
+    }
+});
+test("role onboarding creates deterministic collision-resistant legal stack names", async () => {
+    const enrollmentIds = [
+        "12345678-0000-4000-8000-000000000001",
+        "12345678-0000-4000-8000-000000000002",
+        `${"long/id with unsafe characters ".repeat(12)}one`,
+        `${"long/id with unsafe characters ".repeat(12)}two`
+    ];
+    const names = [];
+    for (const enrollmentId of enrollmentIds) {
+        const started = await runRouteKitEffect(bedrockRoleEnrollment.start({ ...context, enrollmentId }, { region: "us-east-1" }));
+        if (started.kind !== "action" || started.action.kind !== "external") {
+            throw new Error("Missing setup action");
+        }
+        const url = new URL(started.action.url);
+        const parameters = new URLSearchParams(url.hash.split("?")[1]);
+        const stackName = parameters.get("stackName");
+        assert.ok(stackName);
+        assert.match(stackName, /^[A-Za-z][A-Za-z0-9-]*$/u);
+        assert.ok(stackName.length <= 128);
+        names.push(stackName);
+        const replay = await runRouteKitEffect(bedrockRoleEnrollment.start({ ...context, enrollmentId }, { region: "us-east-1" }));
+        if (replay.kind !== "action" || replay.action.kind !== "external") {
+            throw new Error("Missing replay setup action");
+        }
+        const replayParameters = new URLSearchParams(new URL(replay.action.url).hash.split("?")[1]);
+        assert.equal(replayParameters.get("stackName"), stackName);
+    }
+    assert.equal(new Set(names).size, enrollmentIds.length);
+});
+test("role credentials prefer an injected renewable master provider and isolate every binding", async () => {
+    const injectedMaster = async () => ({
+        accessKeyId: "platform-temporary",
+        secretAccessKey: "platform-secret",
+        sessionToken: "platform-token"
+    });
+    let nodeProviderCalls = 0;
+    const calls = [];
+    const adapter = makeBedrockRoleCredentials({
+        nodeProviderChain: () => {
+            nodeProviderCalls += 1;
+            return async () => ({
+                accessKeyId: "node-temporary",
+                secretAccessKey: "node-secret"
+            });
+        },
+        temporaryCredentials: ((input) => {
+            calls.push(input);
+            return async () => ({
+                accessKeyId: `customer-${calls.length}`,
+                secretAccessKey: "customer-secret",
+                sessionToken: "customer-token"
+            });
+        })
+    });
+    const firstBinding = {
+        version: 1,
+        kind: "assume-role",
+        payload: {
+            roleArn: "arn:aws:iam::111111111111:role/routekit-cloud/First",
+            externalId: "a".repeat(43),
+            region: "us-east-1"
+        }
+    };
+    const secondBinding = {
+        version: 1,
+        kind: "assume-role",
+        payload: {
+            roleArn: "arn:aws:iam::222222222222:role/routekit-cloud/Second",
+            externalId: "b".repeat(43),
+            region: "us-west-2"
+        }
+    };
+    const resources = { [BEDROCK_MASTER_CREDENTIALS_RESOURCE]: injectedMaster };
+    const first = await runRouteKitEffect(adapter.resolve(firstBinding, { sourceId: "first", resources }));
+    const second = await runRouteKitEffect(adapter.resolve(secondBinding, { sourceId: "second", resources }));
+    assert.equal(nodeProviderCalls, 0);
+    assert.equal(calls.length, 2);
+    assert.equal(calls[0]?.masterCredentials, injectedMaster);
+    assert.equal(calls[1]?.masterCredentials, injectedMaster);
+    assert.deepEqual(calls[0]?.params, {
+        RoleArn: firstBinding.payload.roleArn,
+        ExternalId: firstBinding.payload.externalId,
+        RoleSessionName: "routekit-cloud"
+    });
+    assert.deepEqual(calls[1]?.params, {
+        RoleArn: secondBinding.payload.roleArn,
+        ExternalId: secondBinding.payload.externalId,
+        RoleSessionName: "routekit-cloud"
+    });
+    assert.notEqual(first.resources?.bedrockCredentials, second.resources?.bedrockCredentials);
+    assert.doesNotMatch(JSON.stringify(firstBinding), /platform-temporary|customer-temporary/u);
+});
+test("role credentials use the Node chain only when the master resource is absent", async () => {
+    const nodeMaster = async () => ({
+        accessKeyId: "node-temporary",
+        secretAccessKey: "node-secret"
+    });
+    let nodeProviderCalls = 0;
+    let capturedMaster;
+    const adapter = makeBedrockRoleCredentials({
+        nodeProviderChain: () => {
+            nodeProviderCalls += 1;
+            return nodeMaster;
+        },
+        temporaryCredentials: ((input) => {
+            capturedMaster = input.masterCredentials;
+            return async () => ({
+                accessKeyId: "customer-temporary",
+                secretAccessKey: "customer-secret"
+            });
+        })
+    });
+    await runRouteKitEffect(adapter.resolve({
+        version: 1,
+        kind: "assume-role",
+        payload: {
+            roleArn: "arn:aws:iam::111111111111:role/Customer",
+            externalId: "x".repeat(43),
+            region: "us-east-1"
+        }
+    }, { sourceId: "fallback" }));
+    assert.equal(nodeProviderCalls, 1);
+    assert.equal(capturedMaster, nodeMaster);
+    await assert.rejects(runRouteKitEffect(adapter.resolve({
+        version: 1,
+        kind: "assume-role",
+        payload: {
+            roleArn: "arn:aws:iam::111111111111:role/Customer",
+            externalId: "x".repeat(43),
+            region: "us-east-1"
+        }
+    }, {
+        sourceId: "disabled",
+        resources: {
+            [BEDROCK_MASTER_CREDENTIALS_RESOURCE]: BEDROCK_MASTER_CREDENTIALS_DISABLED
+        }
+    })), /stored AWS role connection is invalid/u);
+    assert.equal(nodeProviderCalls, 1);
+    await assert.rejects(runRouteKitEffect(adapter.resolve({
+        version: 1,
+        kind: "assume-role",
+        payload: {
+            roleArn: "arn:aws:iam::111111111111:role/Customer",
+            externalId: "x".repeat(43),
+            region: "us-east-1"
+        }
+    }, {
+        sourceId: "invalid",
+        resources: { [BEDROCK_MASTER_CREDENTIALS_RESOURCE]: "not-a-provider" }
+    })), /stored AWS role connection is invalid/u);
+    assert.equal(nodeProviderCalls, 1);
+});

package/dist/internal-providers/provider-bedrock/test/workload-credentials.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/internal-providers/provider-bedrock/test/workload-credentials.test.js

@@ -0,0 +1,29 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { BEDROCK_MASTER_CREDENTIALS_DISABLED, BEDROCK_MASTER_CREDENTIALS_RESOURCE, bedrockMasterCredentialsFromResources } from "../workload-credentials.js";
+test("Bedrock master credential resources are optional renewable providers", async () => {
+    assert.equal(bedrockMasterCredentialsFromResources(undefined, "bedrock"), undefined);
+    assert.equal(bedrockMasterCredentialsFromResources({}, "bedrock"), undefined);
+    let calls = 0;
+    const provider = async () => {
+        calls += 1;
+        return {
+            accessKeyId: `temporary-${calls}`,
+            secretAccessKey: "temporary-secret",
+            sessionToken: "temporary-token"
+        };
+    };
+    const resolved = bedrockMasterCredentialsFromResources({ [BEDROCK_MASTER_CREDENTIALS_RESOURCE]: provider }, "bedrock");
+    assert.equal(resolved, provider);
+    assert.equal(calls, 0, "resource validation must not eagerly obtain credentials");
+    assert.equal((await resolved?.()).accessKeyId, "temporary-1");
+    assert.equal((await resolved?.()).accessKeyId, "temporary-2");
+});
+test("Bedrock master credential resources fail closed when present but invalid", () => {
+    assert.throws(() => bedrockMasterCredentialsFromResources({
+        [BEDROCK_MASTER_CREDENTIALS_RESOURCE]: BEDROCK_MASTER_CREDENTIALS_DISABLED
+    }, "customer"), /host connector is disabled/);
+    for (const invalid of [null, {}, [], "credential", 1, true]) {
+        assert.throws(() => bedrockMasterCredentialsFromResources({ [BEDROCK_MASTER_CREDENTIALS_RESOURCE]: invalid }, "customer"), /invalid "bedrockMasterCredentials" resource/);
+    }
+});

package/dist/internal-providers/provider-bedrock/workload-credentials.d.ts

@@ -0,0 +1,5 @@
+import type { BedrockClientConfig } from "@aws-sdk/client-bedrock";
+export declare const BEDROCK_MASTER_CREDENTIALS_RESOURCE = "bedrockMasterCredentials";
+export declare const BEDROCK_MASTER_CREDENTIALS_DISABLED: unique symbol;
+export type BedrockMasterCredentialsProvider = Extract<NonNullable<BedrockClientConfig["credentials"]>, (...arguments_: never[]) => unknown>;
+export declare function bedrockMasterCredentialsFromResources(resources: Readonly<Record<string, unknown>> | undefined, sourceId: string): BedrockMasterCredentialsProvider | undefined;

package/dist/internal-providers/provider-bedrock/workload-credentials.js

@@ -0,0 +1,14 @@
+export const BEDROCK_MASTER_CREDENTIALS_RESOURCE = "bedrockMasterCredentials";
+export const BEDROCK_MASTER_CREDENTIALS_DISABLED = Symbol.for("@velum-labs/routekit-provider-bedrock/master-credentials-disabled");
+export function bedrockMasterCredentialsFromResources(resources, sourceId) {
+    const resource = resources?.[BEDROCK_MASTER_CREDENTIALS_RESOURCE];
+    if (resource === undefined)
+        return undefined;
+    if (resource === BEDROCK_MASTER_CREDENTIALS_DISABLED) {
+        throw new Error(`provider source "${sourceId}" cannot use "${BEDROCK_MASTER_CREDENTIALS_RESOURCE}" while the host connector is disabled`);
+    }
+    if (typeof resource !== "function") {
+        throw new Error(`provider source "${sourceId}" received an invalid "${BEDROCK_MASTER_CREDENTIALS_RESOURCE}" resource`);
+    }
+    return resource;
+}

package/dist/internal-providers/provider-claude-code/index.d.ts

@@ -0,0 +1,6 @@
+import { AnthropicBackendRelay } from "./relay.js";
+import type { SubscriptionAccountSet } from "@velum-labs/routekit-accounts";
+export { anthropicProvider, claudeCode, claudeCodeSubscriptionProvider } from "./module-api.js";
+export type { AnthropicRelayOptions } from "./relay.js";
+export { AnthropicBackendRelay } from "./relay.js";
+export declare const claudeCodeRelayFactory: (accounts: SubscriptionAccountSet) => AnthropicBackendRelay;

package/dist/internal-providers/provider-claude-code/index.js

@@ -0,0 +1,4 @@
+import { AnthropicBackendRelay } from "./relay.js";
+export { anthropicProvider, claudeCode, claudeCodeSubscriptionProvider } from "./module-api.js";
+export { AnthropicBackendRelay } from "./relay.js";
+export const claudeCodeRelayFactory = (accounts) => new AnthropicBackendRelay({ accounts });

package/dist/internal-providers/provider-claude-code/module-api.d.ts

@@ -0,0 +1,25 @@
+import { SubscriptionAccountBackend } from "@velum-labs/routekit-accounts/provider";
+import { Effect } from "effect";
+export declare const claudeCode: {
+    readonly id: "claude-code";
+    readonly protocol: "anthropic";
+    readonly accountClass: "subscription";
+    readonly billingMode: "subscription";
+    readonly connection: Readonly<{
+        validate?: (context: Readonly<{
+            sourceId: string;
+            config: import("@velum-labs/routekit-config-core").SourceConfig;
+            env: Readonly<Record<string, string | undefined>>;
+            resources?: Readonly<Record<string, unknown>>;
+        }>) => Effect.Effect<void, Error, import("@velum-labs/routekit-runtime/effect").RouteKitPlatform>;
+        credentialValidation?: "registry-key-probe" | "registry-key-probe-if-configured-models";
+        manifest: import("@velum-labs/routekit-provider-core").ProviderConnectionManifest;
+        prepare?: (input: import("@velum-labs/routekit-provider-core").PrepareProviderConnectionInput) => import("@velum-labs/routekit-provider-core").PreparedProviderConnection;
+        enrollment?: Readonly<Record<string, import("@velum-labs/routekit-provider-core").ProviderEnrollmentAdapter>>;
+        credentials?: import("@velum-labs/routekit-provider-core").ProviderCredentialAdapter;
+        subscriptionMode?: import("@velum-labs/routekit-registry").SubscriptionMode;
+    }>;
+    readonly createSource: (context: import("@velum-labs/routekit-provider-core").ProviderModuleContext) => Effect.Effect<SubscriptionAccountBackend, never, never>;
+};
+export { anthropicProvider } from "./subscription.js";
+export declare const claudeCodeSubscriptionProvider: import("@velum-labs/routekit-accounts").SubscriptionProvider<"claude-code">;

package/dist/internal-providers/provider-claude-code/module-api.js

@@ -0,0 +1,31 @@
+import { SubscriptionAccountBackend } from "@velum-labs/routekit-accounts/provider";
+import { AnthropicBackend, defineProviderConnection, defineProvider } from "@velum-labs/routekit-provider-core";
+import { Effect } from "effect";
+import { anthropicProvider } from "./subscription.js";
+export const claudeCode = defineProvider({
+    id: "claude-code",
+    protocol: "anthropic",
+    accountClass: "subscription",
+    billingMode: "subscription",
+    connection: defineProviderConnection({
+        subscriptionMode: "claude-code",
+        manifest: {
+            version: 1, id: "claude-code", displayName: "Claude Code", category: "subscription",
+            description: "Connect a Claude subscription through the Claude Code OAuth flow.",
+            methods: [{ id: "oauth", kind: "oauth", label: "Sign in with Claude", schemaRevision: 1, fields: [] }]
+        }
+    }),
+    createSource: (context) => Effect.sync(() => {
+        const accountSet = context.resources?.accountSet;
+        if (accountSet === undefined || accountSet.mode !== "claude-code") {
+            throw new Error('provider module "claude-code" requires its daemon-owned account set');
+        }
+        return new SubscriptionAccountBackend({
+            sourceId: context.sourceId,
+            accountSet,
+            backendFactory: (_mode, backendOptions) => new AnthropicBackend(backendOptions)
+        });
+    })
+});
+export { anthropicProvider } from "./subscription.js";
+export const claudeCodeSubscriptionProvider = anthropicProvider();

package/dist/internal-providers/provider-claude-code/relay.d.ts

@@ -0,0 +1,20 @@
+import type { IncomingHttpHeaders } from "node:http";
+import { type SubscriptionAccountSet, type SubscriptionAccountSetSnapshot, type SubscriptionAnthropicRequest, type SubscriptionGatewayRequestRelay, type SubscriptionRelay, type SubscriptionResponsesRequest } from "@velum-labs/routekit-accounts";
+import { Effect } from "effect";
+export type AnthropicRelayOptions = {
+    accounts: SubscriptionAccountSet;
+    backendUrl?: string;
+};
+export declare class AnthropicBackendRelay implements SubscriptionRelay {
+    #private;
+    readonly kind: "request";
+    readonly dialect: "anthropic";
+    readonly httpSubmission: SubscriptionGatewayRequestRelay["httpSubmission"];
+    constructor(options: AnthropicRelayOptions);
+    shouldRelay(_headers: IncomingHttpHeaders, model: string | undefined, servesLocally: (model: string) => boolean): boolean;
+    relay(headers: IncomingHttpHeaders, body: SubscriptionAnthropicRequest | SubscriptionResponsesRequest, signal?: AbortSignal, options?: Parameters<SubscriptionGatewayRequestRelay["relay"]>[3]): Effect.Effect<Response, Error | import("effect/PlatformError").PlatformError, any>;
+    models(headers: IncomingHttpHeaders, search: string, signal?: AbortSignal): Effect.Effect<Response, Error | import("effect/PlatformError").PlatformError, any>;
+    countTokens(headers: IncomingHttpHeaders, body: SubscriptionAnthropicRequest, signal?: AbortSignal): Effect.Effect<Response, Error | import("effect/PlatformError").PlatformError, any>;
+    snapshot(): SubscriptionAccountSetSnapshot;
+    close(): Effect.Effect<void, import("@velum-labs/routekit-runtime/effect").RouteKitFailure, never>;
+}

package/dist/internal-providers/provider-claude-code/relay.js

@@ -0,0 +1,115 @@
+import { randomUUID } from "node:crypto";
+import { forwardRelayHeaders } from "@velum-labs/routekit-accounts";
+import { providerDefaultBaseUrl, subscriptionInfo } from "@velum-labs/routekit-registry";
+import { executeInferenceRequest, executeWebRequest, routeKitError } from "@velum-labs/routekit-runtime/effect";
+import { trimTrailingSlashes } from "@velum-labs/routekit-runtime/network";
+import { Effect } from "effect";
+function mergeHeaderTokens(current, required) {
+    const tokens = new Set([current, required]
+        .flatMap((value) => value?.split(",") ?? [])
+        .map((value) => value.trim())
+        .filter((value) => value.length > 0));
+    return [...tokens].join(",");
+}
+function withAnthropicAccount(body, accountId) {
+    if (accountId === undefined)
+        return body;
+    const request = body;
+    const userId = request.metadata?.user_id;
+    if (typeof userId !== "string")
+        return body;
+    try {
+        const parsed = JSON.parse(userId);
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+            return body;
+        return {
+            ...body,
+            metadata: {
+                ...request.metadata,
+                user_id: JSON.stringify({
+                    ...parsed,
+                    account_uuid: accountId
+                })
+            }
+        };
+    }
+    catch {
+        return body;
+    }
+}
+export class AnthropicBackendRelay {
+    kind = "request";
+    dialect = "anthropic";
+    httpSubmission;
+    #accounts;
+    #backendUrl;
+    constructor(options) {
+        this.#accounts = options.accounts;
+        this.#backendUrl = trimTrailingSlashes(options.backendUrl ?? providerDefaultBaseUrl("anthropic") ?? "https://api.anthropic.com");
+        this.httpSubmission =
+            this.#accounts.mode === "claude-code" &&
+                this.#backendUrl === trimTrailingSlashes(providerDefaultBaseUrl("anthropic") ?? "")
+                ? "credential-owner-http-v1"
+                : undefined;
+    }
+    shouldRelay(_headers, model, servesLocally) {
+        return model === undefined || model.length === 0 || !servesLocally(model);
+    }
+    relay(headers, body, signal, options) {
+        const operationId = randomUUID();
+        return this.#accounts.execute(body.model, (credential) => {
+            const upstreamHeaders = this.#upstreamHeaders(headers, credential.accessToken);
+            return executeInferenceRequest(`${this.#backendUrl}/v1/messages`, {
+                method: "POST",
+                headers: upstreamHeaders,
+                body: JSON.stringify(withAnthropicAccount(body, credential.accountId)),
+                ...(signal !== undefined ? { signal } : {})
+            }).pipe(Effect.mapError((error) => routeKitError(error)));
+        }, signal, {
+            responseMode: options?.responseMode,
+            onAttempt: (account) => options?.onAttribution?.({
+                accountAttempt: {
+                    operationId,
+                    seat: account.seat,
+                    credentialId: account.credentialId
+                }
+            }),
+            onRetriedAttempt: (attempt) => options?.onAttribution?.({
+                accountAttemptResult: { operationId, ...attempt }
+            })
+        });
+    }
+    models(headers, search, signal) {
+        return this.#accounts.execute(undefined, (credential) => executeWebRequest(`${this.#backendUrl}/v1/models${search}`, {
+            headers: this.#upstreamHeaders(headers, credential.accessToken),
+            ...(signal !== undefined ? { signal } : {})
+        }).pipe(Effect.mapError((error) => routeKitError(error))));
+    }
+    countTokens(headers, body, signal) {
+        return this.#accounts.execute(body.model, (credential) => executeWebRequest(`${this.#backendUrl}/v1/messages/count_tokens`, {
+            method: "POST",
+            headers: this.#upstreamHeaders(headers, credential.accessToken),
+            body: JSON.stringify(withAnthropicAccount(body, credential.accountId)),
+            ...(signal !== undefined ? { signal } : {})
+        }).pipe(Effect.mapError((error) => routeKitError(error))));
+    }
+    snapshot() {
+        return this.#accounts.statusSnapshot();
+    }
+    close() {
+        return this.#accounts.close();
+    }
+    #upstreamHeaders(headers, accessToken) {
+        const forwarded = forwardRelayHeaders(headers);
+        delete forwarded.authorization;
+        delete forwarded.Authorization;
+        delete forwarded["x-api-key"];
+        const oauthBeta = subscriptionInfo("claude-code").oauthBetaHeader ?? "oauth-2025-04-20";
+        Object.assign(forwarded, {
+            authorization: `Bearer ${accessToken}`,
+            "anthropic-beta": mergeHeaderTokens(forwarded["anthropic-beta"], oauthBeta),
+            "content-type": "application/json"
+        });
+        return forwarded;
+    }
+}

package/dist/internal-providers/provider-claude-code/subscription.d.ts

@@ -0,0 +1,2 @@
+import type { SubscriptionProvider } from "@velum-labs/routekit-accounts";
+export declare function anthropicProvider(): SubscriptionProvider<"claude-code">;