clauderipple 0.2.0

package/dist/router/src/presets.js

@@ -0,0 +1,267 @@
+// Curated providers with a documented native Anthropic Messages endpoint.
+// Keep this catalog conservative: providers with only an OpenAI-compatible API belong
+// behind a translation adapter, not in this host-rewrite-only catalog.
+export const PRESETS = [
+    // Docs: https://api-docs.deepseek.com/guides/anthropic_api/
+    {
+        id: "deepseek",
+        kind: "anthropic-compatible",
+        name: "DeepSeek",
+        vendorUrl: "https://www.deepseek.com/",
+        anthropicBaseUrl: "https://api.deepseek.com/anthropic",
+        authHeader: "x-api-key",
+        fallbackModels: [
+            { id: "deepseek-v4-pro", name: "DeepSeek V4 Pro" },
+            { id: "deepseek-flash", name: "DeepSeek Flash" },
+        ],
+        // https://api-docs.deepseek.com/guides/anthropic_api/ documents thinking and output_config.effort,
+        // but no accepted effort-level set for its Anthropic endpoint; strip effort rather than guess.
+        effortLevels: [],
+        thinking: "enabled",
+        verified: true,
+        notes: "Anthropic thinking is accepted; budget_tokens is ignored.",
+        docsUrl: "https://api-docs.deepseek.com/guides/anthropic_api/",
+    },
+    // Docs: https://platform.kimi.ai/docs/api/overview
+    {
+        id: "kimi",
+        kind: "anthropic-compatible",
+        name: "Kimi (Moonshot AI)",
+        vendorUrl: "https://platform.kimi.ai/",
+        anthropicBaseUrl: "https://api.moonshot.ai/anthropic",
+        authHeader: "authorization-bearer",
+        modelsUrl: "https://api.moonshot.ai/v1/models",
+        modelsAuthHeader: "authorization-bearer",
+        fallbackModels: [
+            { id: "kimi-k3", name: "Kimi K3" },
+            { id: "kimi-k2.7-code", name: "Kimi K2.7 Code" },
+        ],
+        // https://platform.kimi.ai/docs/api/overview documents the endpoint but no Anthropic effort/thinking contract.
+        effortLevels: [],
+        thinking: "none",
+        verified: true,
+        notes: "K3 exists and is documented alongside K2.7 Code for Claude Code.",
+        docsUrl: "https://platform.kimi.ai/docs/api/overview",
+    },
+    // Docs: https://docs.z.ai/devpack/tool/others
+    {
+        id: "zai",
+        kind: "anthropic-compatible",
+        name: "Z.AI (GLM)",
+        vendorUrl: "https://z.ai/",
+        anthropicBaseUrl: "https://api.z.ai/api/anthropic",
+        authHeader: "authorization-bearer",
+        fallbackModels: [{ id: "glm-5.2", name: "GLM-5.2" }],
+        // https://docs.z.ai/devpack/tool/others documents the endpoint but not an Anthropic effort/thinking contract.
+        effortLevels: [],
+        thinking: "none",
+        verified: false,
+        notes: "The Anthropic endpoint is documented; model discovery and an effort field were not verified in the Anthropic-protocol documentation.",
+        docsUrl: "https://docs.z.ai/devpack/tool/others",
+    },
+    // Docs: https://platform.minimax.io/docs/api-reference/text-anthropic-api
+    {
+        id: "minimax",
+        kind: "anthropic-compatible",
+        name: "MiniMax",
+        vendorUrl: "https://www.minimax.io/",
+        anthropicBaseUrl: "https://api.minimax.io/anthropic",
+        authHeader: "x-api-key",
+        fallbackModels: [
+            { id: "MiniMax-M3", name: "MiniMax M3" },
+            { id: "MiniMax-M2.7", name: "MiniMax M2.7" },
+        ],
+        // https://platform.minimax.io/docs/api-reference/text-anthropic-api documents adaptive thinking,
+        // but not output_config.effort.
+        effortLevels: [],
+        thinking: "enabled",
+        verified: true,
+        notes: "Uses the thinking parameter; M3 supports adaptive thinking.",
+        docsUrl: "https://platform.minimax.io/docs/api-reference/text-anthropic-api",
+    },
+    // Docs: https://help.aliyun.com/en/model-studio/claude-code
+    {
+        id: "dashscope-intl",
+        kind: "anthropic-compatible",
+        name: "Qwen (DashScope International)",
+        vendorUrl: "https://www.alibabacloud.com/product/model-studio",
+        anthropicBaseUrl: "https://dashscope-intl.aliyuncs.com/apps/anthropic",
+        authHeader: "authorization-bearer",
+        fallbackModels: [
+            { id: "qwen3.8-max", name: "Qwen 3.8 Max" },
+            { id: "qwen3.6-flash", name: "Qwen 3.6 Flash" },
+        ],
+        // https://help.aliyun.com/en/model-studio/anthropic-api-messages documents enabled thinking;
+        // it explicitly does not support reasoning_effort on the Anthropic endpoint.
+        effortLevels: [],
+        thinking: "enabled",
+        verified: true,
+        notes: "Keys are region-specific. The Anthropic-compatible endpoint has no model-list endpoint.",
+        docsUrl: "https://help.aliyun.com/en/model-studio/claude-code",
+    },
+    // Docs: https://help.aliyun.com/en/model-studio/claude-code
+    {
+        id: "dashscope-cn",
+        kind: "anthropic-compatible",
+        name: "Qwen (DashScope China)",
+        vendorUrl: "https://bailian.console.aliyun.com/",
+        anthropicBaseUrl: "https://dashscope.aliyuncs.com/apps/anthropic",
+        authHeader: "authorization-bearer",
+        fallbackModels: [
+            { id: "qwen3.8-max", name: "Qwen 3.8 Max" },
+            { id: "qwen3.6-flash", name: "Qwen 3.6 Flash" },
+        ],
+        // https://help.aliyun.com/en/model-studio/anthropic-api-messages documents enabled thinking;
+        // it explicitly does not support reasoning_effort on the Anthropic endpoint.
+        effortLevels: [],
+        thinking: "enabled",
+        verified: true,
+        notes: "Keys are region-specific. The Anthropic-compatible endpoint has no model-list endpoint.",
+        docsUrl: "https://help.aliyun.com/en/model-studio/claude-code",
+    },
+    // Docs: https://openrouter.ai/docs/cookbook/coding-agents/claude-code-integration
+    {
+        id: "openrouter",
+        kind: "anthropic-compatible",
+        name: "OpenRouter",
+        vendorUrl: "https://openrouter.ai/",
+        anthropicBaseUrl: "https://openrouter.ai/api",
+        authHeader: "authorization-bearer",
+        modelsUrl: "https://openrouter.ai/api/v1/models",
+        modelsAuthHeader: "authorization-bearer",
+        // Ids verified against GET /api/v1/models on 2026-09-13 (the "-latest" aliases do not exist there).
+        fallbackModels: [
+            { id: "anthropic/claude-sonnet-5", name: "Claude Sonnet 5" },
+            { id: "anthropic/claude-opus-5", name: "Claude Opus 5" },
+        ],
+        // https://openrouter.ai/docs/api/api-reference/anthropic-messages/create-a-message supports
+        // provider passthrough; per-model capabilities vary, so low/medium/high is the conservative default.
+        effortLevels: ["low", "medium", "high"],
+        thinking: "enabled",
+        verified: true,
+        notes: "The Anthropic skin passes through thinking blocks and native tool use.",
+        docsUrl: "https://openrouter.ai/docs/cookbook/coding-agents/claude-code-integration",
+    },
+    // Docs: https://docs.x.ai/docs/guides/reasoning
+    {
+        id: "xai-grok",
+        kind: "openai-compatible",
+        name: "xAI Grok",
+        vendorUrl: "https://x.ai/",
+        anthropicBaseUrl: "https://api.x.ai/v1",
+        authHeader: "authorization-bearer",
+        modelsUrl: "https://api.x.ai/v1/models",
+        modelsAuthHeader: "authorization-bearer",
+        wire: "responses",
+        // https://docs.x.ai/docs/guides/reasoning documents low/medium/high/xhigh but does not publish a stable catalog id here.
+        fallbackModels: [],
+        effortLevels: ["low", "medium", "high", "xhigh"],
+        thinking: "none",
+        verified: true,
+        notes: "Responses supports reasoning.effort; Chat Completions may vary by model. Model discovery is used instead of a stale fallback id.",
+        docsUrl: "https://docs.x.ai/docs/guides/reasoning",
+    },
+    // Docs: https://docs.mistral.ai/api/endpoint/chat and https://docs.mistral.ai/api/endpoint/models
+    {
+        id: "mistral",
+        kind: "openai-compatible",
+        name: "Mistral AI",
+        vendorUrl: "https://mistral.ai/",
+        anthropicBaseUrl: "https://api.mistral.ai/v1",
+        authHeader: "authorization-bearer",
+        modelsUrl: "https://api.mistral.ai/v1/models",
+        modelsAuthHeader: "authorization-bearer",
+        fallbackModels: [],
+        effortLevels: [],
+        thinking: "none",
+        verified: true,
+        notes: "Official Chat Completions and model-list endpoints are documented; no provider-wide reasoning-effort contract is assumed.",
+        docsUrl: "https://docs.mistral.ai/api/endpoint/chat",
+    },
+    // Docs: https://console.groq.com/docs/openai
+    {
+        id: "groq",
+        kind: "openai-compatible",
+        name: "Groq",
+        vendorUrl: "https://groq.com/",
+        anthropicBaseUrl: "https://api.groq.com/openai/v1",
+        authHeader: "authorization-bearer",
+        modelsUrl: "https://api.groq.com/openai/v1/models",
+        modelsAuthHeader: "authorization-bearer",
+        fallbackModels: [],
+        effortLevels: [],
+        thinking: "none",
+        verified: true,
+        notes: "OpenAI compatibility is documented; prompt-cache and provider-wide reasoning support are not documented here.",
+        docsUrl: "https://console.groq.com/docs/openai",
+    },
+    // Docs: https://docs.together.ai/docs/openai-api-compatibility
+    {
+        id: "together",
+        kind: "openai-compatible",
+        name: "Together AI",
+        vendorUrl: "https://www.together.ai/",
+        anthropicBaseUrl: "https://api.together.xyz/v1",
+        authHeader: "authorization-bearer",
+        modelsUrl: "https://api.together.xyz/v1/models",
+        modelsAuthHeader: "authorization-bearer",
+        fallbackModels: [],
+        // https://docs.together.ai/docs/openai-api-compatibility documents low/medium/high for GPT-OSS only.
+        effortLevels: ["low", "medium", "high"],
+        thinking: "none",
+        verified: true,
+        notes: "reasoning_effort is documented only for GPT-OSS models; select a model that supports it.",
+        docsUrl: "https://docs.together.ai/docs/openai-api-compatibility",
+    },
+    // Docs: https://docs.fireworks.ai/tools-sdks/openai-compatibility
+    {
+        id: "fireworks",
+        kind: "openai-compatible",
+        name: "Fireworks AI",
+        vendorUrl: "https://fireworks.ai/",
+        anthropicBaseUrl: "https://api.fireworks.ai/inference/v1",
+        authHeader: "authorization-bearer",
+        modelsUrl: "https://api.fireworks.ai/inference/v1/models",
+        modelsAuthHeader: "authorization-bearer",
+        fallbackModels: [],
+        effortLevels: [],
+        thinking: "none",
+        verified: true,
+        notes: "Chat Completions and streaming usage are documented; model discovery avoids stale account/model identifiers.",
+        docsUrl: "https://docs.fireworks.ai/tools-sdks/openai-compatibility",
+    },
+    // Docs: https://docs.ollama.com/api/openai-compatibility
+    {
+        id: "ollama",
+        kind: "openai-compatible",
+        name: "Ollama (local)",
+        vendorUrl: "https://ollama.com/",
+        anthropicBaseUrl: "http://127.0.0.1:11434/v1",
+        authHeader: "authorization-bearer",
+        modelsUrl: "http://127.0.0.1:11434/v1/models",
+        modelsAuthHeader: "authorization-bearer",
+        fallbackModels: [],
+        effortLevels: [],
+        thinking: "none",
+        verified: true,
+        notes: "No API key is required locally. Both stateless Responses and Chat Completions are documented; cache behavior is not documented.",
+        docsUrl: "https://docs.ollama.com/api/openai-compatibility",
+    },
+    // Docs: https://lmstudio.ai/docs/developer/openai-compat/models
+    {
+        id: "lmstudio",
+        kind: "openai-compatible",
+        name: "LM Studio (local)",
+        vendorUrl: "https://lmstudio.ai/",
+        anthropicBaseUrl: "http://127.0.0.1:1234/v1",
+        authHeader: "authorization-bearer",
+        modelsUrl: "http://127.0.0.1:1234/v1/models",
+        modelsAuthHeader: "authorization-bearer",
+        fallbackModels: [],
+        effortLevels: [],
+        thinking: "none",
+        verified: true,
+        notes: "The local OpenAI-compatible model list and Chat Completions APIs are documented; cache and Responses support are not assumed.",
+        docsUrl: "https://lmstudio.ai/docs/developer/openai-compat/models",
+    },
+];

package/dist/router/src/providers/anthropic-observed.js

@@ -0,0 +1,88 @@
+// Claude Code OAuth observed while transparently passing a real CLI request. Kept in RAM and,
+// when a file path is given, mirrored to that file (mode 0600, owner's home) so the OpenAI ingress
+// keeps working right after a router restart or a reboot — otherwise nothing works until the next
+// Code-tab request happens to pass through. No diagnostics or listing surface exists.
+import fs from "node:fs";
+export const OBSERVED_CLAUDE_CODE_TTL_MS = 12 * 60 * 60 * 1_000;
+function isObservedHeader(name) {
+    const lower = name.toLowerCase();
+    return lower === "authorization"
+        || lower === "anthropic-beta"
+        || lower === "anthropic-version"
+        || lower === "user-agent"
+        || lower === "x-app"
+        || lower.startsWith("x-stainless-")
+        || lower.startsWith("anthropic-client-");
+}
+/**
+ * Stores the latest valid CLI Authorization plus its protocol-identifying headers in RAM.
+ * Callers receive no inspection or listing API: getFresh() exists solely for direct forwarding.
+ */
+export class ObservedClaudeCodeAuth {
+    snapshot = null;
+    file;
+    constructor(file) {
+        this.file = file ?? null;
+        if (this.file) {
+            try {
+                const raw = JSON.parse(fs.readFileSync(this.file, "utf8"));
+                if (raw && typeof raw.authorization === "string" && raw.headers && typeof raw.observedAt === "number") {
+                    this.snapshot = { authorization: raw.authorization, headers: Object.freeze({ ...raw.headers }), observedAt: raw.observedAt };
+                }
+            }
+            catch {
+                /* no file yet or unreadable: start empty */
+            }
+        }
+    }
+    persist() {
+        if (!this.file || !this.snapshot)
+            return;
+        try {
+            const tmp = `${this.file}.tmp-${process.pid}`;
+            fs.writeFileSync(tmp, JSON.stringify(this.snapshot), { mode: 0o600 });
+            fs.renameSync(tmp, this.file);
+        }
+        catch {
+            /* best effort */
+        }
+    }
+    observe(rawHeaders, observedAt = Date.now()) {
+        const headers = {};
+        let authorization = null;
+        for (let index = 0; index + 1 < rawHeaders.length; index += 2) {
+            const name = rawHeaders[index];
+            const value = rawHeaders[index + 1];
+            if (!isObservedHeader(name))
+                continue;
+            if (name.toLowerCase() === "authorization") {
+                if (!/^Bearer\s+\S+$/i.test(value))
+                    continue;
+                authorization = value;
+            }
+            headers[name] = value;
+        }
+        if (!authorization)
+            return;
+        const changed = !this.snapshot || this.snapshot.authorization !== authorization || observedAt - this.snapshot.observedAt > 5 * 60_000;
+        this.snapshot = {
+            authorization,
+            headers: Object.freeze({ ...headers }),
+            observedAt,
+        };
+        if (changed)
+            this.persist();
+    }
+    getFresh(now = Date.now()) {
+        const snapshot = this.snapshot;
+        if (!snapshot)
+            return null;
+        if (now < snapshot.observedAt || now - snapshot.observedAt >= OBSERVED_CLAUDE_CODE_TTL_MS) {
+            this.snapshot = null;
+            if (this.file)
+                fs.rmSync(this.file, { force: true });
+            return null;
+        }
+        return snapshot;
+    }
+}

package/dist/router/src/providers/anthropic-token-file.js

@@ -0,0 +1,48 @@
+// ClaudeRipple-owned storage for a Claude subscription credential of our own: either a long-lived
+// `claude setup-token` token or an OAuth grant obtained by `clauderipple claude-login` (browser
+// flow, PKCE). This is intentionally separate from Claude Code's own credential stores, which are
+// only ever read.
+import fs from "node:fs";
+import path from "node:path";
+export function claudeAuthPath(home) {
+    return path.join(home, "claude-auth.json");
+}
+export function readClaudeAuthFile(home) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(claudeAuthPath(home), "utf8"));
+        if (typeof raw.token !== "string" || raw.token.length === 0 || typeof raw.createdAt !== "string")
+            return null;
+        if (raw.source === "setup-token")
+            return { token: raw.token, createdAt: raw.createdAt, source: "setup-token" };
+        if (raw.source === "oauth" && typeof raw.refreshToken === "string" && raw.refreshToken.length > 0 && typeof raw.expiresAt === "number" && Number.isFinite(raw.expiresAt)) {
+            return { token: raw.token, createdAt: raw.createdAt, source: "oauth", refreshToken: raw.refreshToken, expiresAt: raw.expiresAt };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeClaudeAuthFile(home, value) {
+    fs.mkdirSync(home, { recursive: true, mode: 0o700 });
+    const file = claudeAuthPath(home);
+    fs.writeFileSync(file, JSON.stringify(value) + "\n", { mode: 0o600 });
+    fs.chmodSync(file, 0o600);
+}
+export function saveClaudeAuthFile(home, token, createdAt = new Date().toISOString()) {
+    writeClaudeAuthFile(home, { token, createdAt, source: "setup-token" });
+}
+export function saveClaudeOAuthFile(home, grant, createdAt = new Date().toISOString()) {
+    writeClaudeAuthFile(home, { token: grant.accessToken, createdAt, source: "oauth", refreshToken: grant.refreshToken, expiresAt: grant.expiresAt });
+}
+export function removeClaudeAuthFile(home) {
+    try {
+        fs.unlinkSync(claudeAuthPath(home));
+        return true;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}

package/dist/router/src/providers/anthropic.js

@@ -0,0 +1,203 @@
+// Anthropic native provider used by the OpenAI ingress.
+// `claude-code` auth borrows Claude Code's credential read-only. It never refreshes, writes, or
+// logs a token because refresh-token rotation would invalidate Claude Code's own credential.
+import { execFileSync } from "node:child_process";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {} from "./anthropic-observed.js";
+import { readClaudeAuthFile, saveClaudeOAuthFile } from "./anthropic-token-file.js";
+import { CLAUDE_OAUTH, refreshClaudeOAuth } from "./claude-oauth.js";
+export const CLAUDE_CODE_OAUTH_BETA = "claude-code-20250219,oauth-2025-04-20";
+export const CLAUDE_CODE_IDENTITY = "You are Claude Code, Anthropic's official CLI for Claude.";
+const KEYCHAIN_SERVICE = "Claude Code-credentials";
+const CACHE_MS = 60_000;
+function claudeConfigDir() {
+    return path.join(os.homedir(), ".claude");
+}
+export function readClaudeCodeKeychain() {
+    if (process.platform !== "darwin")
+        return null;
+    try {
+        return execFileSync("security", ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-w"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000 }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+export function readClaudeCodeCredentialsFile() {
+    try {
+        return fs.readFileSync(path.join(claudeConfigDir(), ".credentials.json"), "utf8").trim();
+    }
+    catch {
+        return null;
+    }
+}
+/** Keychain first on macOS, then Claude Code's credential-file fallback. */
+export function readClaudeCodeCredentials() {
+    const keychain = readClaudeCodeKeychain();
+    return parseClaudeCodeCredentials(keychain) ? keychain : readClaudeCodeCredentialsFile();
+}
+export function parseClaudeCodeCredentials(raw) {
+    if (!raw)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        const oauth = parsed.claudeAiOauth;
+        if (typeof oauth?.accessToken !== "string" || oauth.accessToken.length === 0 || typeof oauth.expiresAt !== "number" || !Number.isFinite(oauth.expiresAt))
+            return null;
+        return { accessToken: oauth.accessToken, expiresAt: oauth.expiresAt };
+    }
+    catch {
+        return null;
+    }
+}
+export class ClaudeCodeCredentialStore {
+    cached = null;
+    checkedAt = 0;
+    read;
+    now;
+    constructor(read = readClaudeCodeCredentials, now = Date.now) {
+        this.read = read;
+        this.now = now;
+    }
+    /** Valid credential or a client-safe error. This deliberately never refreshes it. */
+    get() {
+        const now = this.now();
+        if (!this.cached || now - this.checkedAt >= CACHE_MS) {
+            this.cached = parseClaudeCodeCredentials(this.read());
+            this.checkedAt = now;
+        }
+        if (!this.cached)
+            return new Error("Claude Code login unavailable — open Claude Code and sign in");
+        if (now >= this.cached.expiresAt)
+            return new Error("Claude Code login expired — open Claude Code once to refresh");
+        return this.cached;
+    }
+}
+/**
+ * Selects a Claude Code subscription credential without refreshing or mutating Claude Code's login.
+ * A process-local observed header snapshot wins; all non-observed token sources use the normal OAuth wire shape.
+ */
+export class ClaudeCodeAuthStore {
+    credentials;
+    observed;
+    home;
+    env;
+    now;
+    fetchImpl;
+    log;
+    refreshing = null;
+    constructor(credentials = new ClaudeCodeCredentialStore(), options = {}) {
+        this.credentials = credentials;
+        this.observed = options.observed;
+        this.home = options.home ?? (process.env.CLAUDERIPPLE_HOME?.trim() || path.join(os.homedir(), ".clauderipple"));
+        this.env = options.env ?? process.env;
+        this.now = options.now ?? Date.now;
+        this.fetchImpl = options.fetch;
+        this.log = options.log ?? (() => { });
+    }
+    get() {
+        const observed = this.observed?.getFresh(this.now());
+        if (observed)
+            return { source: "observed", observed };
+        const environment = this.env.CLAUDE_CODE_OAUTH_TOKEN?.trim();
+        if (environment)
+            return { source: "env", credentials: { accessToken: environment, expiresAt: Number.POSITIVE_INFINITY } };
+        const stored = this.credentials.get();
+        if (!(stored instanceof Error))
+            return { source: "stored", credentials: stored };
+        const tokenFile = readClaudeAuthFile(this.home);
+        if (tokenFile?.source === "setup-token")
+            return { source: "token-file", credentials: { accessToken: tokenFile.token, expiresAt: Number.POSITIVE_INFINITY } };
+        if (tokenFile?.source === "oauth") {
+            if (this.now() >= tokenFile.expiresAt)
+                return new Error("ClaudeRipple's Claude sign-in expired and could not be refreshed — connect the subscription again");
+            return { source: "token-file", credentials: { accessToken: tokenFile.token, expiresAt: tokenFile.expiresAt } };
+        }
+        return stored;
+    }
+    /**
+     * Refreshes our own OAuth grant when it is about to expire. Only ClaudeRipple's file is ever
+     * written; Claude Code's credential is never refreshed (rotation would invalidate its copy).
+     * Concurrent callers share one refresh. Failures are logged and leave the file as it was, so
+     * get() reports the expiry once it arrives.
+     */
+    refreshIfNeeded() {
+        if (this.refreshing)
+            return this.refreshing;
+        // Higher-precedence sources make the file irrelevant; do not touch the network for it.
+        if (this.observed?.getFresh(this.now()) || this.env.CLAUDE_CODE_OAUTH_TOKEN?.trim() || !(this.credentials.get() instanceof Error))
+            return Promise.resolve();
+        const tokenFile = readClaudeAuthFile(this.home);
+        if (tokenFile?.source !== "oauth" || this.now() < tokenFile.expiresAt - CLAUDE_OAUTH.refreshLeadMs)
+            return Promise.resolve();
+        this.refreshing = refreshClaudeOAuth(tokenFile.refreshToken, { ...(this.fetchImpl ? { fetch: this.fetchImpl } : {}), now: this.now })
+            .then((grant) => {
+            saveClaudeOAuthFile(this.home, grant, tokenFile.createdAt);
+            this.log(`claude oauth: access token refreshed, valid until ${new Date(grant.expiresAt).toISOString()}`);
+        }, (error) => {
+            this.log(`claude oauth: refresh failed: ${error.message}`);
+        })
+            .finally(() => {
+            this.refreshing = null;
+        });
+        return this.refreshing;
+    }
+    /**
+     * Returns only the currently usable credential source. This never returns a credential,
+     * tests validity using the same precedence as get(), and does not refresh anything.
+     */
+    describeSource() {
+        if (this.observed?.getFresh(this.now()))
+            return "observed";
+        if (this.env.CLAUDE_CODE_OAUTH_TOKEN?.trim())
+            return "env";
+        const keychain = parseClaudeCodeCredentials(readClaudeCodeKeychain());
+        if (keychain && this.now() < keychain.expiresAt)
+            return "keychain";
+        const credentialsFile = parseClaudeCodeCredentials(readClaudeCodeCredentialsFile());
+        if (credentialsFile && this.now() < credentialsFile.expiresAt)
+            return "credentials-file";
+        return readClaudeAuthFile(this.home) ? "token-file" : null;
+    }
+}
+/** Prefix custom tool names for subscription OAuth; builtin Anthropic tools stay unchanged. */
+export function toClaudeCodeToolName(name) {
+    return /^(custom_|web_search$|code_execution$|text_editor$|computer$)/i.test(name) ? name : `custom_${name}`;
+}
+export function fromClaudeCodeToolName(name) {
+    return name.startsWith("custom_") ? name.slice("custom_".length) : name;
+}
+/**
+ * Construct native Anthropic auth headers. OAuth wire requirements are behaviorally measured,
+ * while API-key mode follows the public Messages API header convention.
+ */
+/** Reuses an observed CLI header set without adding manufactured fingerprint fields. */
+export function observedAnthropicHeaders(observed) {
+    return { ...observed.headers };
+}
+export function nativeAnthropicHeaders(provider, credentials) {
+    if (provider.auth === "api-key") {
+        const apiKey = provider.apiKey ?? process.env.ANTHROPIC_API_KEY;
+        if (!apiKey)
+            throw new Error("Anthropic API key missing — set providers.<name>.apiKey or ANTHROPIC_API_KEY");
+        return { "x-api-key": apiKey, "anthropic-version": "2023-06-01" };
+    }
+    if (!credentials)
+        throw new Error("Claude Code login unavailable — open Claude Code and sign in");
+    return {
+        authorization: `Bearer ${credentials.accessToken}`,
+        "anthropic-version": "2023-06-01",
+        "anthropic-beta": CLAUDE_CODE_OAUTH_BETA,
+        "user-agent": "claude-cli/2.1.266 (external, cli)",
+        "x-app": "cli",
+        "x-stainless-lang": "js",
+        "x-stainless-package-version": "0.74.0",
+        "x-stainless-os": process.platform,
+        "x-stainless-arch": process.arch,
+        "x-claude-code-session-id": crypto.randomUUID(),
+        "x-client-request-id": crypto.randomUUID(),
+    };
+}