@cortexkit/anthropic-auth-core 1.0.0

package/dist/accounts.js

@@ -0,0 +1,606 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { CACHE_1H_MODES, CLAUDE_CODE_VERSION, CLIENT_ID, DEFAULT_CACHE_1H_MODE, TOKEN_URL, } from "./constants.js";
+export const ACCOUNT_FILE_NAME = 'anthropic-auth.json';
+export const QUOTA_URL = 'https://api.anthropic.com/api/oauth/usage';
+const DEFAULT_FALLBACK_ON = [401, 403, 429];
+const DEFAULT_REFRESH_BEFORE_EXPIRY_MINUTES = 30;
+const DEFAULT_QUOTA_CHECK_INTERVAL_MINUTES = 5;
+const DEFAULT_MINIMUM_REMAINING = {
+    five_hour: 0,
+    seven_day: 0,
+};
+const DEFAULT_FAIL_CLOSED_ON_UNKNOWN_QUOTA = true;
+const BACKGROUND_TICK_MS = 60_000;
+function getConfigDir() {
+    if (process.env.OPENCODE_CONFIG_DIR?.trim()) {
+        return process.env.OPENCODE_CONFIG_DIR.trim();
+    }
+    return join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'opencode');
+}
+export function getAccountStoragePath() {
+    return (process.env.OPENCODE_ANTHROPIC_AUTH_FILE?.trim() ||
+        join(getConfigDir(), ACCOUNT_FILE_NAME));
+}
+function isRecord(value) {
+    return value != null && typeof value === 'object' && !Array.isArray(value);
+}
+function normalizeAccount(value) {
+    if (!isRecord(value))
+        return null;
+    if (value.type !== 'oauth')
+        return null;
+    if (typeof value.refresh !== 'string' || !value.refresh.trim())
+        return null;
+    return {
+        id: typeof value.id === 'string' && value.id.trim()
+            ? value.id.trim()
+            : randomUUID(),
+        label: typeof value.label === 'string' ? value.label : undefined,
+        type: 'oauth',
+        access: typeof value.access === 'string' ? value.access : undefined,
+        refresh: value.refresh,
+        expires: typeof value.expires === 'number' ? value.expires : undefined,
+        enabled: typeof value.enabled === 'boolean' ? value.enabled : undefined,
+        addedAt: typeof value.addedAt === 'number' ? value.addedAt : undefined,
+        lastUsed: typeof value.lastUsed === 'number' ? value.lastUsed : undefined,
+        lastRefreshedAt: typeof value.lastRefreshedAt === 'number'
+            ? value.lastRefreshedAt
+            : undefined,
+        lastRefreshError: normalizeOperationError(value.lastRefreshError),
+        lastQuotaRefreshError: normalizeOperationError(value.lastQuotaRefreshError),
+        quota: normalizeQuota(value.quota),
+    };
+}
+function normalizeOperationError(value) {
+    if (!isRecord(value))
+        return undefined;
+    if (typeof value.message !== 'string')
+        return undefined;
+    const checkedAt = Number(value.checkedAt);
+    if (!Number.isFinite(checkedAt))
+        return undefined;
+    return { message: value.message, checkedAt };
+}
+function normalizeQuota(value) {
+    if (!isRecord(value))
+        return undefined;
+    const quota = {};
+    for (const key of ['five_hour', 'seven_day']) {
+        const window = value[key];
+        if (!isRecord(window))
+            continue;
+        const usedPercent = Number(window.usedPercent);
+        const remainingPercent = Number(window.remainingPercent);
+        const checkedAt = Number(window.checkedAt);
+        if (!Number.isFinite(usedPercent) ||
+            !Number.isFinite(remainingPercent) ||
+            !Number.isFinite(checkedAt)) {
+            continue;
+        }
+        quota[key] = {
+            usedPercent,
+            remainingPercent,
+            checkedAt,
+            resetsAt: typeof window.resetsAt === 'string' ? window.resetsAt : undefined,
+        };
+    }
+    return Object.keys(quota).length ? quota : undefined;
+}
+function normalizeStorage(value) {
+    if (!isRecord(value) || !Array.isArray(value.accounts))
+        return null;
+    return {
+        version: 1,
+        main: { type: 'opencode', provider: 'anthropic' },
+        fallbackOn: Array.isArray(value.fallbackOn)
+            ? value.fallbackOn.filter((status) => Number.isInteger(status))
+            : undefined,
+        refresh: isRecord(value.refresh) ? value.refresh : undefined,
+        quota: isRecord(value.quota) ? value.quota : undefined,
+        claudeCache: isRecord(value.claudeCache) ? value.claudeCache : undefined,
+        dump: isRecord(value.dump) ? value.dump : undefined,
+        relay: isRecord(value.relay) ? value.relay : undefined,
+        accounts: value.accounts
+            .map(normalizeAccount)
+            .filter((account) => account != null),
+    };
+}
+export async function loadAccounts(path = getAccountStoragePath()) {
+    try {
+        const raw = await readFile(path, 'utf8');
+        return normalizeStorage(JSON.parse(raw));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        return null;
+    }
+}
+async function loadExistingTopLevelFields(path) {
+    try {
+        const raw = await readFile(path, 'utf8');
+        const parsed = JSON.parse(raw);
+        return isRecord(parsed) ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+function omitUndefinedTopLevel(value) {
+    return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined));
+}
+export async function saveAccounts(storage, path = getAccountStoragePath()) {
+    await mkdir(dirname(path), { recursive: true });
+    const existing = await loadExistingTopLevelFields(path);
+    const next = { ...existing, ...omitUndefinedTopLevel(storage) };
+    const tempPath = `${path}.${randomUUID()}.tmp`;
+    await writeFile(tempPath, `${JSON.stringify(next, null, 2)}\n`, {
+        encoding: 'utf8',
+        mode: 0o600,
+    });
+    await rename(tempPath, path);
+}
+export function isCache1hPersistentlyEnabled(storage) {
+    return storage?.claudeCache?.enabled === true;
+}
+function normalizeCache1hMode(value) {
+    return typeof value === 'string' &&
+        CACHE_1H_MODES.includes(value)
+        ? value
+        : DEFAULT_CACHE_1H_MODE;
+}
+export function getCache1hPersistentMode(storage) {
+    return normalizeCache1hMode(storage?.claudeCache?.mode);
+}
+export async function setCache1hPersistentEnabled(enabled, mode, path = getAccountStoragePath()) {
+    const storage = (await loadAccounts(path)) ?? {
+        version: 1,
+        main: { type: 'opencode', provider: 'anthropic' },
+        accounts: [],
+    };
+    storage.claudeCache = {
+        ...(storage.claudeCache ?? {}),
+        enabled,
+        mode: mode ?? getCache1hPersistentMode(storage),
+    };
+    await saveAccounts(storage, path);
+    return storage;
+}
+export async function setCache1hPersistentMode(mode, path = getAccountStoragePath()) {
+    const storage = (await loadAccounts(path)) ?? {
+        version: 1,
+        main: { type: 'opencode', provider: 'anthropic' },
+        accounts: [],
+    };
+    storage.claudeCache = {
+        ...(storage.claudeCache ?? {}),
+        enabled: storage.claudeCache?.enabled === true,
+        mode,
+    };
+    await saveAccounts(storage, path);
+    return storage;
+}
+export function isDumpPersistentlyEnabled(storage) {
+    return storage?.dump?.enabled === true;
+}
+export async function setDumpPersistentEnabled(enabled, path = getAccountStoragePath()) {
+    const storage = (await loadAccounts(path)) ?? {
+        version: 1,
+        main: { type: 'opencode', provider: 'anthropic' },
+        accounts: [],
+    };
+    storage.dump = {
+        ...(storage.dump ?? {}),
+        enabled,
+    };
+    await saveAccounts(storage, path);
+    return storage;
+}
+function getFallbackStatuses(storage) {
+    return storage?.fallbackOn?.length ? storage.fallbackOn : DEFAULT_FALLBACK_ON;
+}
+export function shouldFallbackStatus(status, storage) {
+    return getFallbackStatuses(storage).includes(status);
+}
+function normalizeThresholds(storage) {
+    const configured = storage?.quota?.minimumRemaining || {};
+    return {
+        five_hour: configured.five_hour ??
+            configured['5h'] ??
+            DEFAULT_MINIMUM_REMAINING.five_hour,
+        seven_day: configured.seven_day ??
+            configured['1w'] ??
+            DEFAULT_MINIMUM_REMAINING.seven_day,
+    };
+}
+function quotaEnabled(storage) {
+    return storage?.quota?.enabled !== false;
+}
+function refreshEnabled(storage) {
+    return storage?.refresh?.enabled !== false;
+}
+function refreshBeforeExpiryMs(storage) {
+    const minutes = storage?.refresh?.refreshBeforeExpiryMinutes ??
+        DEFAULT_REFRESH_BEFORE_EXPIRY_MINUTES;
+    return Math.max(0, minutes) * 60_000;
+}
+export function getQuotaCheckIntervalMs(storage) {
+    const minutes = storage?.quota?.checkIntervalMinutes ?? DEFAULT_QUOTA_CHECK_INTERVAL_MINUTES;
+    return Math.max(1, minutes) * 60_000;
+}
+function failClosedOnUnknownQuota(storage) {
+    return (storage?.quota?.failClosedOnUnknownQuota ??
+        DEFAULT_FAIL_CLOSED_ON_UNKNOWN_QUOTA);
+}
+export function quotaSnapshotPassesPolicy(quota, storage) {
+    if (!quotaEnabled(storage))
+        return true;
+    const thresholds = normalizeThresholds(storage);
+    for (const key of ['five_hour', 'seven_day']) {
+        const window = quota?.[key];
+        if (!window)
+            return !failClosedOnUnknownQuota(storage);
+        if (window.remainingPercent < thresholds[key])
+            return false;
+    }
+    return true;
+}
+export function getQuotaNextRefreshAt(quota, storage, now) {
+    if (!quotaEnabled(storage))
+        return now + getQuotaCheckIntervalMs(storage);
+    const thresholds = normalizeThresholds(storage);
+    const blockedResetTimes = [];
+    for (const key of ['five_hour', 'seven_day']) {
+        const window = quota?.[key];
+        if (!window)
+            return now + getQuotaCheckIntervalMs(storage);
+        if (window.remainingPercent >= thresholds[key])
+            continue;
+        const resetTime = window.resetsAt ? Date.parse(window.resetsAt) : Number.NaN;
+        if (!Number.isFinite(resetTime) || resetTime <= now) {
+            return now + getQuotaCheckIntervalMs(storage);
+        }
+        blockedResetTimes.push(resetTime);
+    }
+    if (!blockedResetTimes.length)
+        return now + getQuotaCheckIntervalMs(storage);
+    return Math.min(...blockedResetTimes) + 60_000;
+}
+function tokenNeedsRefresh(account, storage, now) {
+    return (!account.access ||
+        !account.expires ||
+        account.expires - now <= refreshBeforeExpiryMs(storage));
+}
+function quotaIsStale(account, storage, now) {
+    if (!quotaEnabled(storage))
+        return false;
+    const maxAge = getQuotaCheckIntervalMs(storage);
+    return ['five_hour', 'seven_day'].some((key) => {
+        const window = account.quota?.[key];
+        return !window || now - window.checkedAt >= maxAge;
+    });
+}
+function clampPercent(value) {
+    if (!Number.isFinite(value))
+        return 0;
+    if (value < 0)
+        return 0;
+    if (value > 100)
+        return 100;
+    return value;
+}
+function mapUsageWindow(window, checkedAt) {
+    if (typeof window?.utilization !== 'number')
+        return undefined;
+    const usedPercent = clampPercent(window.utilization);
+    return {
+        usedPercent,
+        remainingPercent: clampPercent(100 - usedPercent),
+        resetsAt: window.resets_at,
+        checkedAt,
+    };
+}
+export async function fetchOAuthQuotaSnapshot(input) {
+    const fetchImpl = input.fetchImpl ?? fetch;
+    const response = await fetchImpl(QUOTA_URL, {
+        method: 'GET',
+        headers: {
+            Authorization: `Bearer ${input.accessToken}`,
+            Accept: 'application/json',
+            'Content-Type': 'application/json',
+            'anthropic-beta': 'oauth-2025-04-20',
+            'User-Agent': `claude-code/${CLAUDE_CODE_VERSION}`,
+        },
+    });
+    if (!response.ok) {
+        const body = await response.text().catch(() => '');
+        throw new Error(`Claude quota check failed: ${response.status} — ${body}`);
+    }
+    const checkedAt = input.now?.() ?? Date.now();
+    const usage = (await response.json());
+    return {
+        five_hour: mapUsageWindow(usage.five_hour, checkedAt),
+        seven_day: mapUsageWindow(usage.seven_day, checkedAt),
+    };
+}
+function updateStoredAccount(storage, account) {
+    const index = storage.accounts.findIndex((candidate) => candidate.id === account.id);
+    if (index >= 0)
+        storage.accounts[index] = account;
+}
+function formatErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function recordRefreshError(account, error, now) {
+    account.lastRefreshError = {
+        message: formatErrorMessage(error),
+        checkedAt: now,
+    };
+}
+function recordQuotaRefreshError(account, error, now) {
+    account.lastQuotaRefreshError = {
+        message: formatErrorMessage(error),
+        checkedAt: now,
+    };
+}
+export class FallbackAccountManager {
+    now;
+    fetchImpl;
+    configPath;
+    refreshPromises = new Map();
+    refreshTimer = null;
+    quotaTimer = null;
+    constructor(options = {}) {
+        this.now = options.now ?? Date.now;
+        this.fetchImpl = options.fetchImpl ?? fetch;
+        this.configPath = options.configPath ?? getAccountStoragePath();
+    }
+    async load() {
+        return loadAccounts(this.configPath);
+    }
+    async save(storage) {
+        await saveAccounts(storage, this.configPath);
+    }
+    startBackgroundRefresh() {
+        void this.refreshDueAccounts().catch(() => { });
+        void this.refreshQuotaForDueAccounts().catch(() => { });
+        if (!this.refreshTimer) {
+            this.refreshTimer = setInterval(() => {
+                void this.refreshDueAccounts().catch(() => { });
+            }, BACKGROUND_TICK_MS);
+            if ('unref' in this.refreshTimer)
+                this.refreshTimer.unref();
+        }
+        if (!this.quotaTimer) {
+            this.quotaTimer = setInterval(() => {
+                void this.refreshQuotaForDueAccounts().catch(() => { });
+            }, BACKGROUND_TICK_MS);
+            if ('unref' in this.quotaTimer)
+                this.quotaTimer.unref();
+        }
+    }
+    stopBackgroundRefresh() {
+        if (this.refreshTimer)
+            clearInterval(this.refreshTimer);
+        if (this.quotaTimer)
+            clearInterval(this.quotaTimer);
+        this.refreshTimer = null;
+        this.quotaTimer = null;
+    }
+    async getUsableFallbackAccounts() {
+        const storage = await this.load();
+        if (!storage)
+            return [];
+        const usable = [];
+        let changed = false;
+        for (const account of storage.accounts) {
+            if (account.enabled === false)
+                continue;
+            try {
+                let next = account;
+                if (tokenNeedsRefresh(next, storage, this.now())) {
+                    next = await this.refreshAccount(next, storage);
+                    changed = true;
+                }
+                if (quotaIsStale(next, storage, this.now())) {
+                    next = await this.refreshAccountQuota(next, storage);
+                    changed = true;
+                }
+                if (this.accountPassesQuotaPolicy(next, storage))
+                    usable.push(next);
+            }
+            catch {
+                if (!failClosedOnUnknownQuota(storage))
+                    usable.push(account);
+            }
+        }
+        if (changed)
+            await this.save(storage);
+        return usable;
+    }
+    async markUsed(account) {
+        const storage = await this.load();
+        if (!storage)
+            return;
+        const stored = storage.accounts.find((candidate) => candidate.id === account.id);
+        if (!stored)
+            return;
+        stored.lastUsed = this.now();
+        await this.save(storage);
+    }
+    accountPassesQuotaPolicy(account, storage) {
+        return quotaSnapshotPassesPolicy(account.quota, storage);
+    }
+    async refreshDueAccounts() {
+        const storage = await this.load();
+        if (!storage || !refreshEnabled(storage))
+            return;
+        let changed = false;
+        for (const account of storage.accounts) {
+            if (account.enabled === false)
+                continue;
+            if (!tokenNeedsRefresh(account, storage, this.now()))
+                continue;
+            try {
+                await this.refreshAccount(account, storage);
+                changed = true;
+            }
+            catch (error) {
+                recordRefreshError(account, error, this.now());
+                updateStoredAccount(storage, account);
+                changed = true;
+                // Background refresh must not break the plugin request path.
+            }
+        }
+        if (changed)
+            await this.save(storage);
+    }
+    async refreshQuotaForDueAccounts() {
+        const storage = await this.load();
+        if (!storage || !quotaEnabled(storage))
+            return;
+        let changed = false;
+        for (const account of storage.accounts) {
+            if (account.enabled === false)
+                continue;
+            let next = account;
+            try {
+                if (tokenNeedsRefresh(next, storage, this.now())) {
+                    next = await this.refreshAccount(next, storage);
+                    changed = true;
+                }
+                if (!quotaIsStale(next, storage, this.now()))
+                    continue;
+                await this.refreshAccountQuota(next, storage);
+                changed = true;
+            }
+            catch (error) {
+                recordQuotaRefreshError(account, error, this.now());
+                updateStoredAccount(storage, account);
+                changed = true;
+                // Quota probes are advisory; failed probes fail closed at selection time.
+            }
+        }
+        if (changed)
+            await this.save(storage);
+    }
+    async refreshQuotaForAllAccounts() {
+        const storage = await this.load();
+        const errors = [];
+        if (!storage || !quotaEnabled(storage))
+            return { storage, errors };
+        let changed = false;
+        for (const account of storage.accounts) {
+            if (account.enabled === false)
+                continue;
+            let next = account;
+            try {
+                if (tokenNeedsRefresh(next, storage, this.now())) {
+                    next = await this.refreshAccount(next, storage);
+                    changed = true;
+                }
+                await this.refreshAccountQuota(next, storage);
+                changed = true;
+            }
+            catch (error) {
+                recordQuotaRefreshError(account, error, this.now());
+                updateStoredAccount(storage, account);
+                changed = true;
+                errors.push({
+                    accountId: account.id,
+                    message: formatErrorMessage(error),
+                });
+            }
+        }
+        if (changed)
+            await this.save(storage);
+        return { storage, errors };
+    }
+    async refreshAccount(account, storage, options = {}) {
+        const existing = this.refreshPromises.get(account.id);
+        if (existing) {
+            const refreshed = await existing;
+            updateStoredAccount(storage, refreshed);
+            return refreshed;
+        }
+        const promise = this.refreshAccountNow(account, storage, options).finally(() => {
+            this.refreshPromises.delete(account.id);
+        });
+        this.refreshPromises.set(account.id, promise);
+        const refreshed = await promise;
+        updateStoredAccount(storage, refreshed);
+        return refreshed;
+    }
+    async refreshAccountNow(account, storage, options) {
+        const latestStorage = await this.load();
+        const latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id);
+        if (latestAccount &&
+            !options.force &&
+            !tokenNeedsRefresh(latestAccount, latestStorage, this.now())) {
+            updateStoredAccount(storage, latestAccount);
+            return latestAccount;
+        }
+        const sourceAccount = latestAccount ?? account;
+        const refreshToken = sourceAccount.refresh;
+        const response = await this.fetchImpl(TOKEN_URL, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Accept: 'application/json, text/plain, */*',
+                'User-Agent': 'axios/1.13.6',
+            },
+            body: JSON.stringify({
+                grant_type: 'refresh_token',
+                refresh_token: refreshToken,
+                client_id: CLIENT_ID,
+            }),
+        });
+        if (!response.ok) {
+            const body = await response.text().catch(() => '');
+            throw new Error(`Fallback token refresh failed: ${response.status} — ${body}`);
+        }
+        const json = (await response.json());
+        const refreshedAt = this.now();
+        sourceAccount.access = json.access_token;
+        sourceAccount.refresh = json.refresh_token ?? refreshToken;
+        sourceAccount.expires = refreshedAt + json.expires_in * 1000;
+        sourceAccount.lastRefreshedAt = refreshedAt;
+        sourceAccount.lastRefreshError = undefined;
+        updateStoredAccount(storage, sourceAccount);
+        return sourceAccount;
+    }
+    async refreshAccountQuota(account, storage) {
+        let target = account;
+        if (!target.access) {
+            throw new Error(`Fallback account ${account.id} has no access token`);
+        }
+        try {
+            target.quota = await fetchOAuthQuotaSnapshot({
+                accessToken: target.access,
+                fetchImpl: this.fetchImpl,
+                now: this.now,
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (!message.includes('Claude quota check failed: 401'))
+                throw error;
+            target = await this.refreshAccount(account, storage, {
+                force: true,
+            });
+            if (!target.access)
+                throw error;
+            target.quota = await fetchOAuthQuotaSnapshot({
+                accessToken: target.access,
+                fetchImpl: this.fetchImpl,
+                now: this.now,
+            });
+        }
+        target.lastQuotaRefreshError = undefined;
+        updateStoredAccount(storage, target);
+        return target;
+    }
+}

package/dist/auth.d.ts

@@ -0,0 +1,16 @@
+export type AuthorizationResult = {
+    url: string;
+    redirectUri: string;
+    state: string;
+    verifier: string;
+};
+export declare function authorize(mode: 'max' | 'console'): Promise<AuthorizationResult>;
+export type ExchangeResult = {
+    type: 'success';
+    refresh: string;
+    access: string;
+    expires: number;
+} | {
+    type: 'failed';
+};
+export declare function exchange(input: string, verifier: string, redirectUri: string, expectedState?: string): Promise<ExchangeResult>;