@byokit/accounts 0.10.0 → 0.12.0

package/dist/claude-plan.js

@@ -0,0 +1,167 @@
+import { anthropicMessages } from "./anthropic.js";
+import { needsReauth, refreshCredential } from "./stores.js";
+export const CLAUDE_PLAN_ID = 'byokit-claude-plan';
+export const CLAUDE_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
+const REDIRECT = 'https://console.anthropic.com/oauth/code/callback';
+const SCOPES = 'org:create_api_key user:profile user:inference';
+/** A refused/uncertain rotation requires a new sign-in; its old refresh token must not be tried again. */
+export class ClaudePlanExpiredError extends Error {
+    code = 'CLAUDE_PLAN_EXPIRED';
+    status = 401;
+    constructor() { super('Sign in with Claude again.'); this.name = 'ClaudePlanExpiredError'; }
+}
+export class ClaudePlanPlatformError extends Error {
+    code = 'CLAUDE_PLAN_UNSUPPORTED_PLATFORM';
+    constructor() { super('Claude sign-in needs secure random bytes and SHA-256 on this device.'); this.name = 'ClaudePlanPlatformError'; }
+}
+const base64url = (bytes) => btoa(Array.from(bytes, (b) => String.fromCharCode(b)).join('')).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+/** Pending state/verifier never enter persistent storage. */
+export async function claudeAuthorization(options = {}) {
+    const crypto = options.crypto ?? globalThis.crypto;
+    if (!crypto?.getRandomValues || !crypto.subtle?.digest)
+        throw new ClaudePlanPlatformError();
+    const verifier = base64url(crypto.getRandomValues(new Uint8Array(32)));
+    const state = base64url(crypto.getRandomValues(new Uint8Array(32)));
+    const challenge = base64url(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))));
+    const url = new URL(options.authorizeUrl ?? 'https://claude.ai/oauth/authorize');
+    url.search = new URLSearchParams({ code: 'true', response_type: 'code', client_id: CLAUDE_CLIENT_ID,
+        redirect_uri: REDIRECT, scope: SCOPES, state, code_challenge: challenge, code_challenge_method: 'S256' }).toString();
+    return { url: url.toString(), verifier, state, redirect: REDIRECT };
+}
+export function claudeCode(paste, state) {
+    let code, returned;
+    if (/^https?:\/\//.test(paste)) {
+        const url = new URL(paste);
+        code = url.searchParams.get('code');
+        returned = url.searchParams.get('state');
+    }
+    else {
+        const parts = paste.trim().split('#');
+        code = parts.length === 2 ? parts[0] : null;
+        returned = parts.length === 2 ? parts[1] : null;
+    }
+    if (!code || !returned || returned !== state)
+        throw new Error('The Claude sign-in code does not match this sign-in. Try signing in again.');
+    return code;
+}
+const credential = (j, now, previous) => {
+    if (typeof j?.access_token !== 'string' || !j.access_token || typeof j.expires_in !== 'number'
+        || !Number.isFinite(j.expires_in) || j.expires_in <= 0 || !Number.isFinite(now + j.expires_in * 1000)
+        || (j.refresh_token !== undefined && (typeof j.refresh_token !== 'string' || !j.refresh_token)))
+        throw new Error('Claude could not complete the sign-in. Try signing in again.');
+    return { type: 'oauth', access: j.access_token, refresh: j.refresh_token ?? previous?.refresh ?? '', expires: now + j.expires_in * 1000 };
+};
+const states = new WeakMap();
+/** Adds only BYOKit's own Claude route; every other provider still belongs to the supplied engine. */
+export function withClaudePlan(engine, credentials, lockKey, options = {}) {
+    let shared = states.get(lockKey);
+    if (!shared)
+        states.set(lockKey, shared = { spent: new Set() });
+    const state = shared;
+    const now = options.now ?? Date.now;
+    const post = async (body, signal) => {
+        let res;
+        try {
+            res = await (options.fetch ?? fetch)(options.tokenUrl ?? 'https://platform.claude.com/v1/oauth/token', {
+                method: 'POST', signal: signal ?? AbortSignal.timeout(15_000),
+                headers: { 'content-type': 'application/json', 'user-agent': 'axios/1.7.9' }, body: JSON.stringify(body),
+            });
+        }
+        catch {
+            throw new Error('Claude could not complete the sign-in on this connection.');
+        }
+        if (!res.ok) {
+            if ([400, 401, 403].includes(res.status))
+                throw new ClaudePlanExpiredError();
+            throw new Error('Claude could not complete the sign-in. Try again later.');
+        }
+        try {
+            return await res.json();
+        }
+        catch {
+            throw new Error('Claude could not complete the sign-in. Try signing in again.');
+        }
+    };
+    const login = async ({ signal, notify, prompt }) => {
+        const pending = await claudeAuthorization(options);
+        if (signal?.aborted)
+            throw new Error('Login cancelled');
+        // Register the paste receiver before publishing the URL, so an immediate paste cannot be lost.
+        const pasted = prompt({ type: 'manual_code', message: 'Paste the code from the Claude page.', signal });
+        notify({ type: 'auth_url', url: pending.url });
+        const code = claudeCode(await pasted, pending.state);
+        if (signal?.aborted)
+            throw new Error('Login cancelled');
+        const c = credential(await post({ grant_type: 'authorization_code', client_id: CLAUDE_CLIENT_ID,
+            code, state: pending.state, redirect_uri: pending.redirect, code_verifier: pending.verifier }, signal), now());
+        if (signal?.aborted)
+            throw new Error('Login cancelled');
+        try {
+            await credentials.modify(CLAUDE_PLAN_ID, async () => c, { signal });
+        }
+        catch {
+            throw new Error('Claude sign-in could not be saved on this device. Try signing in again.');
+        }
+        if (signal?.aborted) {
+            await credentials.delete(CLAUDE_PLAN_ID);
+            throw new Error('Login cancelled');
+        }
+        return c;
+    };
+    const access = async (minOAuthValidityMs = 0) => {
+        const min = Math.max(300_000, minOAuthValidityMs);
+        const due = (c) => now() + min >= c.expires;
+        const c = await credentials.read(CLAUDE_PLAN_ID);
+        if (c?.type !== 'oauth')
+            return undefined;
+        if (state.flight)
+            return state.flight;
+        if (needsReauth(c) || state.spent.has(c.refresh))
+            throw new ClaudePlanExpiredError();
+        if (!due(c))
+            return c;
+        const work = refreshCredential(credentials, CLAUDE_PLAN_ID, due, async (current) => {
+            if (!current.refresh || state.spent.has(current.refresh))
+                throw new ClaudePlanExpiredError();
+            state.spent.add(current.refresh);
+            return credential(await post({ grant_type: 'refresh_token', client_id: CLAUDE_CLIENT_ID, refresh_token: current.refresh }), now(), current);
+        }).catch(async () => {
+            await credentials.delete(CLAUDE_PLAN_ID).catch(() => { });
+            throw new ClaudePlanExpiredError();
+        });
+        state.flight = work;
+        try {
+            const next = await work;
+            if (next)
+                state.spent.delete(next.refresh);
+            return next;
+        }
+        finally {
+            if (state.flight === work)
+                state.flight = undefined;
+        }
+    };
+    return Object.assign(engine, {
+        login: ((original) => (id, type, interaction) => id === CLAUDE_PLAN_ID ? login(interaction) : original.call(engine, id, type, interaction))(engine.login),
+        logout: ((original) => (id) => id === CLAUDE_PLAN_ID ? credentials.delete(id) : original.call(engine, id))(engine.logout),
+        checkAuth: ((original) => async (id) => id === CLAUDE_PLAN_ID
+            ? await (async () => { const c = await credentials.read(id); return c?.type === 'oauth' && !needsReauth(c) ? { source: 'OAuth', type: 'oauth' } : undefined; })()
+            : original.call(engine, id))(engine.checkAuth),
+        getAuth: ((original) => async (id, overrides) => {
+            if (id !== CLAUDE_PLAN_ID)
+                return original.call(engine, id, overrides);
+            const c = await access(overrides?.minOAuthValidityMs);
+            return c ? { auth: { apiKey: c.access }, source: 'OAuth' } : undefined;
+        })(engine.getAuth),
+    });
+}
+/** Hermes's baseline native-client fingerprint. No installed CLI is consulted for its version. */
+export function claudePlanMessages(access, options = {}) {
+    return anthropicMessages({ ...options, headers: {
+            authorization: `Bearer ${access}`, 'anthropic-beta': 'claude-code-20250219,oauth-2025-04-20',
+            'user-agent': 'claude-code/2.1.74 (external, cli)', 'x-app': 'cli', 'anthropic-dangerous-direct-browser-access': 'true',
+        }, prepare: (request) => ({ ...request, system: [
+                { type: 'text', text: "You are Claude Code, Anthropic's official CLI for Claude." },
+                ...(typeof request.system === 'string' ? [{ type: 'text', text: request.system }] : request.system ?? []),
+            ] }), safeErrors: true });
+}

package/dist/node-stores.d.ts

@@ -4,6 +4,8 @@ import { type EndingStore } from './stores.ts';
 export type SafeStorageLike = {
     encryptString(text: string): Uint8Array;
     decryptString(data: Buffer): string;
+    /** Optional authenticated format upgrade; fileStore verifies and atomically replaces it. */
+    upgrade?(data: Buffer): Uint8Array | undefined;
     isEncryptionAvailable?(): boolean;
     getSelectedStorageBackend?(): string;
 };

package/dist/node-stores.js

@@ -38,7 +38,16 @@ export function fileStore(path, safeStorage) {
             const st = fstatSync(fd);
             if (!st.isFile() || (st.mode & 0o077))
                 throw new Error('Credential storage requires a private regular file');
-            return JSON.parse(safeStorage.decryptString(readFileSync(fd)));
+            const bytes = readFileSync(fd);
+            const text = safeStorage.decryptString(bytes);
+            const data = JSON.parse(text);
+            const upgraded = safeStorage.upgrade?.(bytes);
+            if (upgraded) {
+                if (safeStorage.decryptString(Buffer.from(upgraded)) !== text)
+                    throw new Error('Credential upgrade verification failed');
+                replace(upgraded);
+            }
+            return data;
         }
         finally {
             closeSync(fd);
@@ -47,6 +56,9 @@ export function fileStore(path, safeStorage) {
     const save = async (data) => {
         ready();
         const sealed = safeStorage.encryptString(JSON.stringify(data, null, 2));
+        replace(sealed);
+    };
+    const replace = (sealed) => {
         mkdirSync(folder, { recursive: true, mode: 0o700 });
         privateFolder();
         const tmp = `${path}.${process.pid}.${randomBytes(12).toString('hex')}.tmp`;

package/dist/portable.d.ts

@@ -1,8 +1,10 @@
-export { Accounts, planOf, portable, type AccountsOptions, type AuthHost, type Loopback, type Member, type Platform, type SignIn, type Status } from './accounts.ts';
+export { Accounts, planOf, portable, type AccountsOptions, type ClaudePlanAsk, type AnthropicAccountAsk, type AuthHost, type Loopback, type Member, type Platform, type SignIn, type Status } from './accounts.ts';
 export { PROVIDERS, offered, provider, type Billing, type Provider, type Terms } from './catalogue.ts';
 export { PORTABLE, claims, credentialOf, devicePoll, deviceStart, portableEngine, type EngineOptions, type Poll } from './engine.ts';
 export { REST_MS, classify, classifyFailure, type Failure, type Kind } from './limits.ts';
 export { IncompleteError, ResponseError, isFunctionCall, limitResponse, respond, sseReader, type Ask, type ResponseFunctionCall, type ResponseInputItem, type ResponseOutputItem, type ResponseOutputMessage, type ResponseReasoning, type ResponseResult, type ResponseStreamEvent, type ResponseText, type ResponseTextFormat, type ResponseTool, type ResponseToolChoice } from './responses.ts';
-export { browserStore, memoryStore, recordStore, secureStore, RefreshRequiredError, type RefreshStore, type SecureStoreLike } from './stores.ts';
+export { browserStore, keystoreStore, memoryStore, recordStore, secureStore, RefreshRequiredError, type RefreshStore, type SecureStoreLike } from './stores.ts';
 export { WORDS, billingWords, callbackPage, clock, failure, say, signInError, type WordKey, type Why } from './words.ts';
 export { chatgptPlan, UnsupportedAccountError, type ChatGPTPlanAccount, type ChatGPTPlanSession } from './chatgpt-plan.ts';
+export { anthropic, anthropicSseReader, AnthropicIncompleteError, type AnthropicAsk, type AnthropicCacheControl, type AnthropicContent, type AnthropicImage, type AnthropicMessage, type AnthropicOptions, type AnthropicRequest, type AnthropicResponse, type AnthropicResult, type AnthropicStreamEvent, type AnthropicText, type AnthropicThinking, type AnthropicTool, type AnthropicToolChoice, type AnthropicToolUse, type AnthropicUsage } from './anthropic.ts';
+export { ClaudePlanExpiredError, ClaudePlanPlatformError, claudeAuthorization, claudeCode, type ClaudePlanOptions } from './claude-plan.ts';

package/dist/portable.js

@@ -5,6 +5,8 @@ export { PROVIDERS, offered, provider } from "./catalogue.js";
 export { PORTABLE, claims, credentialOf, devicePoll, deviceStart, portableEngine } from "./engine.js";
 export { REST_MS, classify, classifyFailure } from "./limits.js";
 export { IncompleteError, ResponseError, isFunctionCall, limitResponse, respond, sseReader } from "./responses.js";
-export { browserStore, memoryStore, recordStore, secureStore, RefreshRequiredError } from "./stores.js";
+export { browserStore, keystoreStore, memoryStore, recordStore, secureStore, RefreshRequiredError } from "./stores.js";
 export { WORDS, billingWords, callbackPage, clock, failure, say, signInError } from "./words.js";
 export { chatgptPlan, UnsupportedAccountError } from "./chatgpt-plan.js";
+export { anthropic, anthropicSseReader, AnthropicIncompleteError } from "./anthropic.js";
+export { ClaudePlanExpiredError, ClaudePlanPlatformError, claudeAuthorization, claudeCode } from "./claude-plan.js";

package/dist/responses.d.ts

@@ -175,6 +175,8 @@ export type Ask = {
     model?: string;
     /** The tools the model may call. Passed, the result carries the output items next to the text. */
     tools?: ResponseTool[];
+    /** Whether ChatGPT may call tools in parallel. Omitted: the provider's default. */
+    parallelToolCalls?: boolean;
     /** Which tool the model must use. Default: whatever it wants. */
     tool_choice?: ResponseToolChoice;
     /** How hard the model thinks. Default: none. */

package/dist/responses.js

@@ -182,6 +182,7 @@ export async function respond(o) {
         body: JSON.stringify({
             model: o.model, store: false, stream: true, instructions: o.instructions, input,
             ...(o.tools ? { tools: o.tools } : {}),
+            ...(o.parallelToolCalls !== undefined ? { parallel_tool_calls: o.parallelToolCalls } : {}),
             ...(o.tool_choice !== undefined ? { tool_choice: o.tool_choice } : {}),
             text: { verbosity, ...(format ? { format } : {}), ...textRest },
             reasoning: { effort, ...reasoningRest },

package/dist/stores.d.ts

@@ -39,3 +39,8 @@ export declare function secureStore(secure: SecureStoreLike, name: string, optio
 /** One person's sign-ins in the browser's IndexedDB (a PWA, or Electron's renderer), under `name`. A browser has no
  *  keychain: anything running on this page could read them, so keep the page free of scripts you don't control. */
 export declare function browserStore(name: string, db?: string): EndingStore;
+/** A device-owned @byokit/secrets backend, supplied by the host; no runtime Node import. One store per member/name. */
+export declare function keystoreStore(keystore: {
+    get(name: string): Promise<string | null>;
+    set(name: string, secret: string): Promise<void>;
+}, name: string): CredentialStore;

package/dist/stores.js

@@ -164,3 +164,7 @@ export function browserStore(name, db = 'byokit') {
         end: (id, fn) => locked(() => store.end(id, fn)),
     };
 }
+/** A device-owned @byokit/secrets backend, supplied by the host; no runtime Node import. One store per member/name. */
+export function keystoreStore(keystore, name) {
+    return recordStore(async () => JSON.parse(await keystore.get(name) ?? '{}'), async (data) => keystore.set(name, JSON.stringify(data)));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byokit/accounts",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "Sign in with the AI plan you already pay for, into your app's own store.",
   "license": "Apache-2.0",
   "type": "module",
@@ -41,7 +41,8 @@
   "files": [
     "dist",
     "CHANGELOG.md",
-    "SECURITY.md"
+    "SECURITY.md",
+    "NOTICE"
   ],
   "scripts": {
     "prepack": "tsc -b && node ../../scripts/fix-words-dts.cjs"