Module anthropic 

The Anthropic backend. The account’s credential is its setup token, which probes a minimal billed /v1/messages call - the usage endpoint refuses setup tokens, while a /v1/messages response carries the anthropic-ratelimit-unified-* windows as headers, a 429 most of all. An account with no token has no credential at all.

Re-exports

use std::collections::HashMap; 🔒

use async_trait::async_trait; 🔒

use reqwest::header::AUTHORIZATION; 🔒

use reqwest::header::CONTENT_TYPE; 🔒

use reqwest::header::HeaderMap; 🔒

use reqwest::header::HeaderValue; 🔒

use reqwest::header::USER_AGENT; 🔒

use serde_json::json; 🔒

use forge_primitives::usage::oauth::OauthUsageError; 🔒

use forge_primitives::usage::UsageSnapshot; 🔒

use forge_primitives::usage::UsageSourceKind; 🔒

use forge_primitives::usage::UsageWindow; 🔒

use crate::helpers::OAUTH_TIMEOUT; 🔒

use crate::helpers::parse_retry_after; 🔒

use crate::helpers::redacted_body; 🔒

use crate::helpers::system_time_from_epoch; 🔒

use crate::AccountEnv; 🔒

use crate::BillingModel; 🔒

use crate::ProbeError; 🔒

use crate::Provider; 🔒

use crate::ProviderBackend; 🔒

use crate::ProviderHost; 🔒

Structs

Anthropic

The Anthropic [[accounts]] provider token.

Constants

CLAUDE_CODE_OAUTH_TOKEN_ENV

The variable the flat token key is stamped onto for an Anthropic account (minted by claude setup-token). Its presence makes the account token-mode: the token is the account’s only credential. The value is trimmed once where it enters forge’s config, so every reader sees the same credential.

MESSAGES_URL 🔒

PROBE_MODEL 🔒

The token probe’s model: the cheapest haiku-class ID; its retired predecessor 404s, and 404s carry no headers.

UNIFIED_PREFIX 🔒

Functions

messages_headers 🔒

messages_probe 🔒

One round-trip against /v1/messages with the minimal probe call: the cheapest haiku model, max_tokens 1, a tiny input - about nine billed tokens. On a 200 the response headers carry the unified windows, so the HeaderMap is the payload; a 429 keeps the windows it carried on the error; every other status classifies exactly like the windowed probe so the loader and poller treat both probes alike.

messages_url 🔒

/v1/messages on the official host, or an override with any trailing slash trimmed. Production always passes None: the unified headers only ride the official base.

rate_limited_snapshot 🔒

The windows a 429 carried. A 429 with no unified headers - a reverse proxy’s limit, or a plan without unified limits - has no reading and keeps the bare rate-limited verdict.

snapshot_from_unified_headers 🔒

Map a 200’s unified headers into a snapshot. Lenient by design: a 200 without the unified headers (an API-key bearer rather than a plan credential, or a plan without unified limits) is the barless row the scope refusal used to settle to, not a fetch error.

token_bearer

The setup token env carries, when non-empty. An empty value stays None: whitespace is the config loader’s to strip (once, at load), and this reads the credential as the child gets it.

unified_header_value 🔒

unified_window 🔒

One unified window off a response’s headers: utilization arrives on a 0..1 scale and maps into the snapshot’s percentage scale, the reset arrives as an epoch, and the status is the provider’s own verdict on the window. Each header is independently optional.