@code-yeongyu/senpi 2026.8.25 → 2026.8.26

package/node_modules/@anthropic-ai/sdk/src/lib/credentials/credential-chain.ts

@@ -0,0 +1,292 @@
+import type { Fetch } from '../../internal/builtin-types';
+import { readEnv } from '../../internal/utils/env';
+import {
+  CREDENTIALS_FILE_VERSION,
+  loadConfigWithSource,
+  getCredentialsPath,
+  type AnthropicConfig,
+} from '../../core/credentials';
+import type { AccessTokenProvider, CredentialResult, IdentityTokenProvider } from './types';
+import {
+  MANDATORY_REFRESH_THRESHOLD_IN_SECONDS,
+  WorkloadIdentityError,
+  checkCredentialsFileSafety,
+  writeCredentialsFileAtomic,
+} from './types';
+import { nowAsSeconds } from '../../internal/utils/time';
+import { identityTokenFromFile, identityTokenFromValue } from './identity-token';
+import { oidcFederationProvider } from './oidc-federation';
+import { userOAuthProvider } from './user-oauth';
+
+/**
+ * Builds a {@link CredentialResult} from an explicit {@link AnthropicConfig}.
+ *
+ * Use this when constructing a client from an in-memory config object rather
+ * than from profile files or environment variables.
+ *
+ * For `oidc_federation`, `authentication.credentials_path` is optional —
+ * if omitted, every call performs a fresh exchange with no on-disk cache.
+ * For `user_oauth`, `authentication.credentials_path` is required (it is
+ * where the access/refresh tokens live).
+ */
+export type ResolverOptions = {
+  baseURL: string;
+  fetch: Fetch;
+  userAgent?: string | undefined;
+  onCacheWriteError?: ((err: unknown) => void) | undefined;
+  onSafetyWarning?: ((msg: string) => void) | undefined;
+};
+
+export function resolveCredentialsFromConfig(
+  config: AnthropicConfig,
+  options: ResolverOptions,
+): CredentialResult {
+  const credentialsPath = config.authentication.credentials_path ?? null;
+  const effectiveBaseURL = (config.base_url || options.baseURL).replace(/\/+$/, '');
+
+  const provider = buildProvider(config, credentialsPath, effectiveBaseURL, options);
+
+  const extraHeaders: Record<string, string> = {};
+  // For federation profiles workspace_id is sent in the jwt-bearer exchange
+  // body, not as a request header (the minted token is already
+  // workspace-scoped, so the header would be ignored).
+  if (config.workspace_id && config.authentication.type === 'user_oauth') {
+    extraHeaders['anthropic-workspace-id'] = config.workspace_id;
+  }
+
+  // Surface the profile's own base_url (not the options.baseURL fallback) so
+  // the client can adopt it for outbound API requests when the caller didn't
+  // pin one explicitly. Echoing options.baseURL back would defeat precedence.
+  return { provider, extraHeaders, baseURL: config.base_url || undefined };
+}
+
+/**
+ * Resolves a {@link CredentialResult} from the environment. Returns `null`
+ * when no credentials can be resolved.
+ *
+ * Resolution order:
+ *
+ *   1. Config file for the active profile (or the explicit `profile` argument)
+ *      → dispatch on `authentication.type` (`oidc_federation`, `user_oauth`)
+ *   2. Environment variables `ANTHROPIC_FEDERATION_RULE_ID` +
+ *      `ANTHROPIC_ORGANIZATION_ID` (+ identity token) → OIDC federation
+ *   3. Nothing matches → `null`
+ *
+ * Passing `profile` selects `<config_dir>/configs/<profile>.json` directly,
+ * skipping `ANTHROPIC_PROFILE` / `active_config` resolution.
+ */
+export async function defaultCredentials(
+  options: ResolverOptions,
+  profile?: string,
+): Promise<CredentialResult | null> {
+  const loaded = await loadConfigWithSource(profile);
+  if (!loaded) {
+    return null;
+  }
+  const { config, fromFile } = loaded;
+
+  // For file-loaded configs, default credentials_path to the per-profile
+  // location so user_oauth and federation caching work. Shallow-clone first
+  // so callers that retain a reference to the loaded config don't observe the
+  // patched-in default.
+  //
+  // Env-only credentials (no profile file on disk) skip the disk cache —
+  // matching the other SDKs. A disk cache keyed by profile path would
+  // re-serve a stale token after a change to ANTHROPIC_WORKSPACE_ID (or
+  // ANTHROPIC_ORGANIZATION_ID / ANTHROPIC_FEDERATION_RULE_ID) until the
+  // cached token expired, so the env-only chain stays in-memory only.
+  const withPath: AnthropicConfig =
+    config.authentication.credentials_path || !fromFile ?
+      config
+    : {
+        ...config,
+        authentication: {
+          ...config.authentication,
+          credentials_path: (await getCredentialsPath(config, profile)) ?? undefined,
+        },
+      };
+
+  return resolveCredentialsFromConfig(withPath, options);
+}
+
+function buildProvider(
+  config: AnthropicConfig,
+  credentialsPath: string | null,
+  baseURL: string,
+  options: ResolverOptions,
+): AccessTokenProvider {
+  switch (config.authentication.type) {
+    case 'oidc_federation': {
+      const auth = config.authentication;
+      const identityProvider = resolveIdentityTokenProvider(auth);
+      if (!identityProvider) {
+        throw new WorkloadIdentityError(
+          'oidc_federation config requires an identity token (set authentication.identity_token, ' +
+            'ANTHROPIC_IDENTITY_TOKEN_FILE, or ANTHROPIC_IDENTITY_TOKEN)',
+        );
+      }
+      if (!auth.federation_rule_id) {
+        throw new WorkloadIdentityError(
+          "oidc_federation config requires 'federation_rule_id'. Set it in authentication.federation_rule_id in your profile, or via ANTHROPIC_FEDERATION_RULE_ID (profile takes precedence).",
+        );
+      }
+      if (!config.organization_id) {
+        throw new WorkloadIdentityError(
+          'oidc_federation config requires organization_id (set ANTHROPIC_ORGANIZATION_ID or config.organization_id)',
+        );
+      }
+
+      const exchange = oidcFederationProvider({
+        identityTokenProvider: identityProvider,
+        federationRuleId: auth.federation_rule_id,
+        organizationId: config.organization_id,
+        serviceAccountId: auth.service_account_id,
+        workspaceId: config.workspace_id,
+        baseURL,
+        fetch: options.fetch,
+        userAgent: options.userAgent,
+      });
+
+      // If there's a credentials file path, wrap the exchange with file caching
+      // (check file for fresh token before exchanging, write back after).
+      if (credentialsPath) {
+        return cachedExchangeProvider(
+          exchange,
+          credentialsPath,
+          options.onCacheWriteError,
+          options.onSafetyWarning,
+        );
+      }
+      return exchange;
+    }
+
+    case 'user_oauth': {
+      if (!credentialsPath) {
+        throw new WorkloadIdentityError(
+          'user_oauth config requires authentication.credentials_path ' +
+            '(or load via a profile so it defaults to <config_dir>/credentials/<profile>.json)',
+        );
+      }
+      return userOAuthProvider({
+        credentialsPath,
+        clientId: config.authentication.client_id,
+        baseURL,
+        fetch: options.fetch,
+        userAgent: options.userAgent,
+        onSafetyWarning: options.onSafetyWarning,
+      });
+    }
+
+    default: {
+      const t = (config.authentication as { type: string }).type;
+      throw new WorkloadIdentityError(`authentication.type "${t}" is not a known authentication type`);
+    }
+  }
+}
+
+/**
+ * Resolves the identity token provider from config fields or environment variables.
+ *
+ * Resolution order:
+ *   1. `identity_token.path` from the config (source: "file")
+ *   2. `ANTHROPIC_IDENTITY_TOKEN_FILE` env var
+ *   3. `ANTHROPIC_IDENTITY_TOKEN` env var (static value)
+ */
+function resolveIdentityTokenProvider(
+  auth: Extract<AnthropicConfig['authentication'], { type: 'oidc_federation' }>,
+): IdentityTokenProvider | null {
+  if (auth.identity_token) {
+    // Cast needed to stringify an unknown source value for the error message:
+    // the on-disk JSON may contain a source this SDK version doesn't know about.
+    const source = (auth.identity_token as { source: string }).source;
+    if (source !== 'file') {
+      throw new WorkloadIdentityError(
+        `identity_token.source "${source}" is not supported by this SDK version (only "file")`,
+      );
+    }
+    if (!auth.identity_token.path) {
+      throw new WorkloadIdentityError(`identity_token.source "file" requires a non-empty path`);
+    }
+    return identityTokenFromFile(auth.identity_token.path);
+  }
+
+  const tokenFile = readEnv('ANTHROPIC_IDENTITY_TOKEN_FILE');
+  if (tokenFile) {
+    return identityTokenFromFile(tokenFile);
+  }
+
+  const tokenValue = readEnv('ANTHROPIC_IDENTITY_TOKEN');
+  if (tokenValue) {
+    return identityTokenFromValue(tokenValue);
+  }
+
+  return null;
+}
+
+/**
+ * Wraps a federation exchange provider with credential file caching.
+ * Checks the file for a fresh token before exchanging, and writes the
+ * result back after a successful exchange (best-effort, atomic replace).
+ *
+ * Note: this is not cross-process serialized — two SDK instances that
+ * miss the cache simultaneously will both perform a full exchange and
+ * the last writer wins. That is acceptable: federation exchanges are
+ * idempotent and the cache is an optimization, not a correctness gate.
+ */
+function cachedExchangeProvider(
+  exchange: AccessTokenProvider,
+  credentialsPath: string,
+  onCacheWriteError: ((err: unknown) => void) | undefined,
+  onSafetyWarning: ((msg: string) => void) | undefined,
+): AccessTokenProvider {
+  return async (opts) => {
+    const fs = await import('node:fs');
+
+    await checkCredentialsFileSafety(credentialsPath, onSafetyWarning);
+
+    // Try cached credentials file
+    let existing: Record<string, unknown> | undefined;
+    try {
+      const raw = await fs.promises.readFile(credentialsPath, 'utf-8');
+      existing = JSON.parse(raw);
+      const token = existing?.['access_token'] as string | undefined;
+      if (token && !opts?.forceRefresh) {
+        const expiresAt = existing?.['expires_at'] as number | undefined;
+        if (expiresAt == null || nowAsSeconds() < expiresAt - MANDATORY_REFRESH_THRESHOLD_IN_SECONDS) {
+          return { token, expiresAt: expiresAt ?? null };
+        }
+      }
+    } catch (err) {
+      // ENOENT or invalid-JSON → no usable cache, exchange fresh. Other
+      // errors (EACCES, EISDIR, …) indicate a broken cache path; surface to
+      // the optional hook so they're at least debuggable, then proceed.
+      const code = (err as NodeJS.ErrnoException)?.code;
+      if (code !== 'ENOENT' && !(err instanceof SyntaxError)) {
+        onCacheWriteError?.(err);
+      }
+    }
+
+    // Exchange for a new token
+    const result = await exchange(opts);
+
+    // Write cache back (best-effort). Preserve any unknown keys from the
+    // existing file (notably refresh_token, in the unlikely case this path
+    // is shared with a user_oauth profile) so the federation cache writer
+    // doesn't clobber material it didn't own.
+    try {
+      await writeCredentialsFileAtomic(credentialsPath, {
+        ...(existing ?? {}),
+        version: CREDENTIALS_FILE_VERSION,
+        type: 'oauth_token',
+        access_token: result.token,
+        expires_at: result.expiresAt,
+      });
+    } catch (err) {
+      // Best-effort caching: surface to the optional hook but never fail
+      // the exchange itself.
+      onCacheWriteError?.(err);
+    }
+
+    return result;
+  };
+}

package/node_modules/@anthropic-ai/sdk/src/lib/credentials/identity-token.ts

@@ -0,0 +1,37 @@
+import { AnthropicError } from '../../core/error';
+import type { IdentityTokenProvider } from './types';
+
+/**
+ * Reads a JWT from a file on every call. Supports automatic rotation
+ * (e.g. Kubernetes projected service-account tokens).
+ */
+export function identityTokenFromFile(path: string): IdentityTokenProvider {
+  if (!path) {
+    throw new AnthropicError('Identity token file path is empty');
+  }
+
+  return async () => {
+    const fs = await import('node:fs');
+    let content: string;
+    try {
+      content = await fs.promises.readFile(path, 'utf-8');
+    } catch (err) {
+      throw new AnthropicError(`Failed to read identity token file at ${path}: ${err}`);
+    }
+    const token = content.trim();
+    if (!token) {
+      throw new AnthropicError(`Identity token file at ${path} is empty`);
+    }
+    return token;
+  };
+}
+
+/**
+ * Wraps a static JWT string as an {@link IdentityTokenProvider}.
+ */
+export function identityTokenFromValue(token: string): IdentityTokenProvider {
+  if (!token) {
+    throw new AnthropicError('Identity token value is empty');
+  }
+  return () => token;
+}

package/node_modules/@anthropic-ai/sdk/src/lib/credentials/oidc-federation.ts

@@ -0,0 +1,140 @@
+import type { Fetch } from '../../internal/builtin-types';
+import type { AccessTokenProvider, IdentityTokenProvider } from './types';
+import {
+  FEDERATION_BETA_HEADER,
+  GRANT_TYPE_JWT_BEARER,
+  OAUTH_API_BETA_HEADER,
+  TOKEN_ENDPOINT,
+  WorkloadIdentityError,
+  parseTokenResponse,
+  redactSensitive,
+  requireSecureTokenEndpoint,
+} from './types';
+import { nowAsSeconds } from '../../internal/utils/time';
+import { VERSION } from '../../version';
+
+export type OIDCFederationConfig = {
+  identityTokenProvider: IdentityTokenProvider;
+  federationRuleId: string;
+  organizationId: string;
+  serviceAccountId?: string | undefined;
+  /**
+   * Optional `wrkspc_*` tagged ID, or the literal `"default"` to scope the
+   * token to the organization's default workspace. When omitted the server
+   * picks the rule's sole enabled workspace, else the org default if the rule
+   * covers it. Required when the rule enables more than one non-default
+   * workspace, or to target a specific workspace other than the one the
+   * server would pick. The minted token is workspace-scoped: per-request
+   * workspace selection (the `anthropic-workspace-id` header) is not supported
+   * for federation tokens — switching workspaces requires a new token exchange
+   * with a different `workspaceId`.
+   */
+  workspaceId?: string | undefined;
+  baseURL: string;
+  fetch: Fetch;
+  /**
+   * Overrides the outgoing User-Agent header on the token exchange. When
+   * empty, sends an SDK-identified UA so the token endpoint's access logs
+   * identify the caller.
+   */
+  userAgent?: string | undefined;
+};
+
+/**
+ * Exchanges an external OIDC JWT for an Anthropic access token via the
+ * RFC 7523 jwt-bearer grant.
+ *
+ * Each invocation performs a fresh token exchange. Wrap in a
+ * {@link TokenCache} to avoid exchanging on every request.
+ *
+ * Federation grants do not return a refresh token — callers re-exchange
+ * their assertion on expiry.
+ */
+export function oidcFederationProvider(config: OIDCFederationConfig): AccessTokenProvider {
+  return async () => {
+    requireSecureTokenEndpoint(config.baseURL);
+
+    const jwt = await config.identityTokenProvider();
+    // The token endpoint enforces a 16 KiB assertion limit; surface a clear
+    // client-side error so misconfigured projected-token sources are
+    // diagnosable without a server round-trip.
+    if (jwt.length > 16 * 1024) {
+      throw new WorkloadIdentityError(
+        `Identity token is ${Math.ceil(jwt.length / 1024)} KiB, exceeds the 16 KiB assertion limit`,
+      );
+    }
+
+    const body: Record<string, string> = {
+      grant_type: GRANT_TYPE_JWT_BEARER,
+      assertion: jwt,
+      federation_rule_id: config.federationRuleId,
+      organization_id: config.organizationId,
+    };
+    if (config.serviceAccountId) {
+      body['service_account_id'] = config.serviceAccountId;
+    }
+    if (config.workspaceId) {
+      body['workspace_id'] = config.workspaceId;
+    }
+
+    const url = `${config.baseURL}${TOKEN_ENDPOINT}`;
+    let resp: Response;
+    try {
+      resp = await config.fetch(url, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'anthropic-beta': `${OAUTH_API_BETA_HEADER},${FEDERATION_BETA_HEADER}`,
+          'User-Agent': config.userAgent || `anthropic-sdk-typescript/${VERSION} oidcFederationProvider`,
+        },
+        body: JSON.stringify(body),
+      });
+    } catch (err) {
+      throw new WorkloadIdentityError(`Failed to reach token endpoint ${url}: ${err}`);
+    }
+
+    const requestId = resp.headers.get('Request-Id');
+
+    if (!resp.ok) {
+      const text = await resp.text().catch(() => '');
+      const redacted = redactSensitive(text);
+      // A 401 is hard to debug from the status code alone, so surface
+      // guidance: check the federation rule, optionally set a workspace ID
+      // (the most common fix when no workspaceId is configured), and point at
+      // the Workload identity page in Claude Console for the server-side
+      // authentication event log. Other statuses (5xx, 400, ...) get no hint.
+      let hint = '';
+      if (resp.status === 401) {
+        const hintMiddle =
+          config.workspaceId ? '' : (
+            "If your federation rule is scoped to multiple workspaces, set the ANTHROPIC_WORKSPACE_ID environment variable, the 'workspace_id' config key, or the `workspaceId` option. "
+          );
+        hint = ` Ensure your federation rule matches your identity token. ${hintMiddle}View your authentication events in the Workload identity page of Claude Console for more details.`;
+      }
+      throw new WorkloadIdentityError(
+        `Token exchange failed with status ${resp.status}${
+          requestId ? ` (request-id ${requestId})` : ''
+        }: ${redacted}${hint}`,
+        resp.status,
+        redacted,
+        requestId,
+      );
+    }
+
+    const data = await parseTokenResponse(resp, requestId);
+    const expiresIn = Number(data.expires_in);
+    if (!Number.isFinite(expiresIn)) {
+      throw new WorkloadIdentityError(
+        `Token endpoint response missing required fields: ${JSON.stringify(redactSensitive(data))}`,
+        resp.status,
+        redactSensitive(data),
+        requestId,
+      );
+    }
+
+    return {
+      token: data.access_token,
+      expiresAt: nowAsSeconds() + expiresIn,
+    };
+  };
+}

package/node_modules/@anthropic-ai/sdk/src/lib/credentials/token-cache.ts

@@ -0,0 +1,130 @@
+import type { AccessToken, AccessTokenProvider } from './types';
+import {
+  ADVISORY_REFRESH_BACKOFF_IN_SECONDS,
+  ADVISORY_REFRESH_THRESHOLD_IN_SECONDS,
+  MANDATORY_REFRESH_THRESHOLD_IN_SECONDS,
+} from './types';
+import { nowAsSeconds } from '../../internal/utils/time';
+
+/**
+ * Wraps an {@link AccessTokenProvider} with two-tier proactive refresh
+ * and concurrent deduplication.
+ *
+ * Refresh policy on each {@link getToken} call:
+ *
+ * - No cached token → call provider (blocking), cache, return.
+ * - Cached with `expiresAt == null` → return cached forever.
+ * - More than 120s remaining → return cached.
+ * - 30–120s remaining (advisory window) → return stale token immediately,
+ *   kick off background refresh. On failure, log and keep stale.
+ * - Less than 30s remaining or expired (mandatory) → block and refresh.
+ *   On failure, throw.
+ *
+ * Concurrent mandatory callers coalesce into a single provider call.
+ */
+export class TokenCache {
+  private provider: AccessTokenProvider;
+  private cached: AccessToken | null = null;
+  private pendingRefresh: Promise<AccessToken> | null = null;
+  private nextForce = false;
+  private lastAdvisoryError = 0;
+  private onAdvisoryRefreshError: ((err: unknown) => void) | undefined;
+
+  constructor(provider: AccessTokenProvider, onAdvisoryRefreshError?: (err: unknown) => void) {
+    this.provider = provider;
+    this.onAdvisoryRefreshError = onAdvisoryRefreshError;
+  }
+
+  async getToken(): Promise<string> {
+    const force = this.nextForce;
+    this.nextForce = false;
+    const cached = this.cached;
+
+    if (force || cached == null) {
+      const token = await this.refresh(force);
+      return token.token;
+    }
+
+    if (cached.expiresAt == null) {
+      return cached.token;
+    }
+
+    const remaining = cached.expiresAt - nowAsSeconds();
+
+    if (remaining > ADVISORY_REFRESH_THRESHOLD_IN_SECONDS) {
+      return cached.token;
+    }
+
+    if (remaining > MANDATORY_REFRESH_THRESHOLD_IN_SECONDS) {
+      this.backgroundRefresh();
+      return cached.token;
+    }
+
+    const token = await this.refresh();
+    return token.token;
+  }
+
+  /**
+   * Clears the cached token and marks the next {@link getToken} as a forced
+   * refresh, so the underlying provider bypasses any on-disk freshness check.
+   * Called after a 401 — the server has just told us the token is bad even
+   * if its `expires_at` still looks fresh.
+   */
+  invalidate(): void {
+    this.cached = null;
+    this.nextForce = true;
+  }
+
+  /**
+   * Mandatory refresh. Joins any in-flight refresh unless forced — a forced
+   * refresh must not coalesce into a non-forced one that may re-serve the
+   * same stale disk token.
+   */
+  private refresh(force = false): Promise<AccessToken> {
+    if (this.pendingRefresh && !force) {
+      return this.pendingRefresh;
+    }
+    return this.doRefresh(force);
+  }
+
+  /**
+   * Advisory background refresh. Shares the same in-flight promise as
+   * mandatory refreshes for deduplication, but swallows errors so the
+   * stale cached token keeps being served. Backs off for
+   * {@link ADVISORY_REFRESH_BACKOFF_IN_SECONDS} after a failure so an
+   * outage during the advisory window doesn't hammer the token endpoint.
+   */
+  private backgroundRefresh(): void {
+    if (this.pendingRefresh) {
+      return;
+    }
+    if (nowAsSeconds() - this.lastAdvisoryError < ADVISORY_REFRESH_BACKOFF_IN_SECONDS) {
+      return;
+    }
+    this.doRefresh().catch((err) => {
+      this.lastAdvisoryError = nowAsSeconds();
+      // Advisory failure: keep serving the stale cached token, but surface
+      // the error to the caller-provided hook so it can be logged.
+      this.onAdvisoryRefreshError?.(err);
+    });
+  }
+
+  /**
+   * Core refresh. Sets {@link pendingRefresh} so concurrent callers
+   * (both advisory and mandatory) coalesce into a single provider call.
+   */
+  private doRefresh(force = false): Promise<AccessToken> {
+    this.pendingRefresh = this.provider(force ? { forceRefresh: true } : undefined).then(
+      (token) => {
+        this.cached = token;
+        this.pendingRefresh = null;
+        return token;
+      },
+      (err) => {
+        this.pendingRefresh = null;
+        throw err;
+      },
+    );
+    return this.pendingRefresh;
+  }
+}