Module helpers 

Composable pieces the backends build probes and snapshots from: the windowed /api/oauth/usage round-trip, the payload-to-window mappers, and the timestamp parsing the snapshot mappers share.

Re-exports

use std::collections::HashMap; 🔒

use std::time::Duration; 🔒

use std::time::SystemTime; 🔒

use reqwest::header::ACCEPT; 🔒

use reqwest::header::AUTHORIZATION; 🔒

use reqwest::header::CONTENT_TYPE; 🔒

use reqwest::header::HeaderMap; 🔒

use reqwest::header::HeaderValue; 🔒

use reqwest::header::USER_AGENT; 🔒

use serde_json::Value; 🔒

use forge_primitives::usage::oauth::OauthExtraUsage; 🔒

use forge_primitives::usage::oauth::OauthUsage; 🔒

use forge_primitives::usage::oauth::OauthUsageError; 🔒

use forge_primitives::usage::oauth::OauthUsageWindow; 🔒

use forge_primitives::usage::ExtraUsage; 🔒

use forge_primitives::usage::UsageSnapshot; 🔒

use forge_primitives::usage::UsageSourceKind; 🔒

use forge_primitives::usage::UsageWindow; 🔒

Structs

BaseUrlCredential

The base-url credential an account’s env carries: the ANTHROPIC_BASE_URL endpoint and the ANTHROPIC_AUTH_TOKEN bearer beside it.

MissingBase

The read of a base-url credential that found no usable ANTHROPIC_BASE_URL.

Constants

OAUTH_BETA_HEADER 🔒

OAUTH_TIMEOUT

Per-call timeout the probes bake into their client.

OAUTH_USAGE_URL 🔒

TAG 🔒

The width of the token piece a mask matches on: long enough that it is key material rather than a scheme, short enough to survive a truncation.

Functions

anthropic_windowed_probe

One round-trip against /api/oauth/usage with the windowed request shape: ACCEPT + content-type + the oauth-beta header + claude-code/<version> UA + Bearer. Status classification: 200 / 401 / 403-with-oauth_scope_insufficient-body / 429 + Retry-After / other. The client and UA arrive injected; building them is the host port’s job.

base_url_credential

The base-url credential shared by every base-url provider: the stamped ANTHROPIC_BASE_URL (trimmed, empty after trim = missing) and ANTHROPIC_AUTH_TOKEN, absent = empty bearer - a localhost proxy ignores the bearer and the probe must still fire.

days_from_civil 🔒

Days since 1970-01-01 (Howard Hinnant’s civil-from-days inverse).

is_scope_refusal 🔒

Whether a 403 body is the usage endpoint’s scope refusal rather than an auth failure. Keyed on the body’s error.details.error_code - the verified live shape for a valid setup token; a revoked one answers 401 authentication_error, so the two never share a class.

map_extra_usage 🔒

map_window 🔒

mask_quoted_runs 🔒

Every double-quoted run containing a window of the token masked; an unterminated quote takes its tail with it rather than printing a value whose end nobody found. A run’s spaces stay inside it, which the bare-word pass over it cannot see.

oauth_headers 🔒

parse_iso8601_timestamp 🔒

Hand-rolled ISO-8601 / RFC-3339 datetime parser. Subset: YYYY-MM-DD[T| ]HH:MM[:SS[.fffffffff]][Z|+HH:MM|-HH:MM]. Returns None on any field-level parse failure.

parse_retry_after

RFC 7231 section 7.1.3 Retry-After accepts either delta-seconds ("120") or an HTTP-date ("Wed, 21 Oct 2015 07:28:00 GMT"). Anthropic emits the integer form today, but the spec leaves the HTTP-date form open and proxies / CDNs in the path may swap shapes. Try the integer form first; fall back to httpdate parsing and compute the delta from now.

parse_timestamp_value

Parse a JSON value (string OR number) as a SystemTime. Accepts:

redacted_body

A body as a log field’s suffix (": ...", capped at 200 chars), with the request’s credential masked.

redacted_message

Text with the credential masked, for a field that is not a body - a serde message beside one, which can quote a value it was decoding.

snapshot_from_payload_lenient

Map a windowed payload to a snapshot with every window treated as independently optional, never requiring five_hour. This is the base-url and token path’s mapper: an alternate-endpoint proxy emits each window on its own ({}, {five_hour}, {seven_day}, {five_hour, seven_day}), and a missing five_hour is a valid steady state - the cold start before the first upstream request, and the post-5h-reset window where the proxy drops the key entirely - not a malformed response. {} maps to all-None (n/a bars); an out-of-contract error-shaped 200 lands here as n/a too rather than erroring. Infallible - there is no window this can reject.

split_time_and_offset 🔒

system_time_from_epoch

Convert a non-negative epoch integer to SystemTime. Values >= 1e12 are interpreted as milliseconds; smaller values as seconds. Negative values fail.

usage_url 🔒

The /api/oauth/usage endpoint URL. Defaults to the hardcoded Anthropic host; a base_url override (an account’s ANTHROPIC_BASE_URL) redirects the probe to an alternate endpoint serving the same OauthUsage shape. Any trailing slash on the override is trimmed so http://host/ and http://host behave identically.