@cortexkit/anthropic-auth-core 1.0.0

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export * from './accounts.ts';
+export * from './auth.ts';
+export * from './cache1h.ts';
+export * from './cch.ts';
+export * from './constants.ts';
+export * from './dump.ts';
+export * from './logger.ts';
+export * from './pkce.ts';
+export * from './quotas.ts';
+export * from './relay.ts';

package/dist/index.js

@@ -0,0 +1,10 @@
+export * from "./accounts.js";
+export * from "./auth.js";
+export * from "./cache1h.js";
+export * from "./cch.js";
+export * from "./constants.js";
+export * from "./dump.js";
+export * from "./logger.js";
+export * from "./pkce.js";
+export * from "./quotas.js";
+export * from "./relay.js";

package/dist/logger.d.ts

@@ -0,0 +1,3 @@
+export declare function log(message: string, data?: unknown): void;
+export declare function relayLog(message: string, data?: unknown): void;
+export declare function getLogFilePath(): string;

package/dist/logger.js

@@ -0,0 +1,66 @@
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+const LOG_FILE = path.join(os.tmpdir(), 'opencode-anthropic-auth.log');
+const isTestEnv = process.env.NODE_ENV === 'test';
+const FLUSH_INTERVAL_MS = 500;
+const BUFFER_SIZE_LIMIT = 50;
+let buffer = [];
+let flushTimer = null;
+function flush() {
+    if (flushTimer) {
+        clearTimeout(flushTimer);
+        flushTimer = null;
+    }
+    if (buffer.length === 0)
+        return;
+    const data = buffer.join('');
+    buffer = [];
+    try {
+        fs.appendFileSync(LOG_FILE, data);
+    }
+    catch {
+        // Logging must never throw.
+    }
+}
+function scheduleFlush() {
+    if (flushTimer)
+        return;
+    flushTimer = setTimeout(() => {
+        flushTimer = null;
+        flush();
+    }, FLUSH_INTERVAL_MS);
+}
+function serialize(data) {
+    if (data === undefined)
+        return '';
+    if (data instanceof Error) {
+        return ` ${data.message}${data.stack ? `\n${data.stack}` : ''}`;
+    }
+    return ` ${JSON.stringify(data)}`;
+}
+export function log(message, data) {
+    if (isTestEnv)
+        return;
+    try {
+        buffer.push(`[${new Date().toISOString()}] ${message}${serialize(data)}\n`);
+        if (buffer.length >= BUFFER_SIZE_LIMIT) {
+            flush();
+        }
+        else {
+            scheduleFlush();
+        }
+    }
+    catch {
+        // Logging must never throw.
+    }
+}
+export function relayLog(message, data) {
+    log(`[relay] ${message}`, data);
+}
+export function getLogFilePath() {
+    return LOG_FILE;
+}
+if (!isTestEnv) {
+    process.on('exit', flush);
+}

package/dist/pkce.d.ts

@@ -0,0 +1,5 @@
+export declare function generatePKCE(): Promise<{
+    verifier: string;
+    challenge: string;
+    method: 'S256';
+}>;

package/dist/pkce.js

@@ -0,0 +1,17 @@
+function base64UrlEncode(bytes) {
+    let bin = '';
+    for (const byte of bytes)
+        bin += String.fromCharCode(byte);
+    return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+}
+export async function generatePKCE() {
+    const buf = new Uint8Array(64);
+    crypto.getRandomValues(buf);
+    const verifier = base64UrlEncode(buf);
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+    return {
+        verifier,
+        challenge: base64UrlEncode(new Uint8Array(digest)),
+        method: 'S256',
+    };
+}

package/dist/quotas.d.ts

@@ -0,0 +1,23 @@
+import type { AccountQuotaWindow, AccountStorage, OAuthQuotaSnapshot, QuotaWindowName } from './accounts.ts';
+export declare const CLAUDE_QUOTAS_COMMAND_NAME = "claude-quota";
+export type QuotaAccountSummary = {
+    name: string;
+    role: 'main' | 'fallback';
+    enabled?: boolean;
+    quota?: OAuthQuotaSnapshot;
+    lastRefreshedAt?: number;
+    error?: string;
+};
+export declare function buildFallbackQuotaSummaries(storage: AccountStorage | null, errors?: ReadonlyMap<string, string>): {
+    error?: string | undefined;
+    name: string;
+    role: "fallback";
+    enabled: boolean;
+    quota: Partial<Record<QuotaWindowName, AccountQuotaWindow>> | undefined;
+    lastRefreshedAt: number | undefined;
+}[];
+export declare function buildClaudeQuotaSummary(input: {
+    accounts: QuotaAccountSummary[];
+    refreshedAt?: number;
+    now?: number;
+}): string;

package/dist/quotas.js

@@ -0,0 +1,100 @@
+export const CLAUDE_QUOTAS_COMMAND_NAME = 'claude-quota';
+const WINDOW_LABELS = {
+    five_hour: '5h',
+    seven_day: '1w',
+};
+function formatPercent(value) {
+    return `${Math.round(value * 10) / 10}%`;
+}
+function formatAge(checkedAt, now) {
+    const elapsedMs = Math.max(0, now - checkedAt);
+    const minutes = Math.floor(elapsedMs / 60_000);
+    if (minutes < 1)
+        return 'just now';
+    if (minutes === 1)
+        return '1m ago';
+    if (minutes < 60)
+        return `${minutes}m ago`;
+    const hours = Math.floor(minutes / 60);
+    const remainder = minutes % 60;
+    if (remainder === 0)
+        return `${hours}h ago`;
+    return `${hours}h ${remainder}m ago`;
+}
+function formatResetDuration(resetsAt, now) {
+    const resetTime = Date.parse(resetsAt);
+    if (!Number.isFinite(resetTime))
+        return resetsAt;
+    const remainingMs = resetTime - now;
+    if (remainingMs <= 0)
+        return 'now';
+    const totalMinutes = Math.max(1, Math.ceil(remainingMs / 60_000));
+    if (totalMinutes < 60)
+        return `in ${totalMinutes}m`;
+    const hours = Math.floor(totalMinutes / 60);
+    const minutes = totalMinutes % 60;
+    if (minutes === 0)
+        return `in ${hours}h`;
+    return `in ${hours}h ${minutes}m`;
+}
+function formatReset(resetsAt, now) {
+    if (!resetsAt)
+        return '';
+    return `, resets ${formatResetDuration(resetsAt, now)}`;
+}
+function formatWindow(key, window, now) {
+    if (!window)
+        return `  - ${WINDOW_LABELS[key]}: unknown`;
+    return [
+        `  - ${WINDOW_LABELS[key]}: ${formatPercent(window.remainingPercent)} remaining`,
+        ` (${formatPercent(window.usedPercent)} used`,
+        `${formatReset(window.resetsAt, now)}, checked ${formatAge(window.checkedAt, now)})`,
+    ].join('');
+}
+function accountName(account) {
+    return account.label?.trim() || account.id;
+}
+function accountStoredError(account) {
+    return (account.lastQuotaRefreshError?.message ?? account.lastRefreshError?.message);
+}
+export function buildFallbackQuotaSummaries(storage, errors = new Map()) {
+    if (!storage?.accounts.length)
+        return [];
+    return storage.accounts.map((account) => {
+        const error = errors.get(account.id) ?? accountStoredError(account);
+        return {
+            name: accountName(account),
+            role: 'fallback',
+            enabled: account.enabled !== false,
+            quota: account.quota,
+            lastRefreshedAt: account.lastRefreshedAt,
+            ...(error && { error }),
+        };
+    });
+}
+export function buildClaudeQuotaSummary(input) {
+    const now = input.now ?? Date.now();
+    const lines = ['## Claude Quotas', ''];
+    if (input.refreshedAt) {
+        lines.push(`Refreshed: ${formatAge(input.refreshedAt, now)}`, '');
+    }
+    if (!input.accounts.length) {
+        lines.push('No Claude OAuth accounts found yet.');
+        return lines.join('\n');
+    }
+    for (const account of input.accounts) {
+        const role = account.role === 'main' ? 'main' : 'fallback';
+        const disabled = account.enabled === false ? ' disabled' : '';
+        lines.push(`### ${account.name} (${role}${disabled})`);
+        if (account.lastRefreshedAt) {
+            lines.push(`  - Last token refresh: ${formatAge(account.lastRefreshedAt, now)}`);
+        }
+        if (account.error) {
+            lines.push(`  - Error: ${account.error}`);
+        }
+        lines.push(formatWindow('five_hour', account.quota?.five_hour, now));
+        lines.push(formatWindow('seven_day', account.quota?.seven_day, now));
+        lines.push('');
+    }
+    return lines.join('\n').trimEnd();
+}

package/dist/relay.d.ts

@@ -0,0 +1,27 @@
+import type { AccountStorage } from './accounts.ts';
+export type RelayConfig = {
+    enabled: boolean;
+    url: string;
+    token: string;
+    fallbackToDirect: boolean;
+    transport: 'http' | 'websocket';
+};
+export type RelayPatch = {
+    start: number;
+    deleteCount: number;
+    insert: string;
+};
+export declare function getRelayConfig(storage: AccountStorage | null): RelayConfig | null;
+export declare function generateRelayToken(): string;
+export declare function hashBody(body: string): string;
+export declare function createStringPatch(previous: string, next: string): RelayPatch;
+export declare function sendViaRelay(options: {
+    config: RelayConfig | null;
+    input: string | URL | Request;
+    init: RequestInit | undefined;
+    headers: Headers;
+    body: RequestInit['body'] | null | undefined;
+    fallback: () => Promise<Response>;
+    optimisticResponse?: boolean;
+}): Promise<Response>;
+export declare const WORKER_SCRIPT = "\nasync function hashBody(body) {\n  const bytes = new TextEncoder().encode(body)\n  const digest = await crypto.subtle.digest('SHA-256', bytes)\n  const hex = [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('')\n  return 'sha256:' + hex\n}\n\nfunction applyPatch(base, patch) {\n  return base.slice(0, patch.start) + patch.insert + base.slice(patch.start + patch.deleteCount)\n}\n\nfunction applyPatchSet(base, patch) {\n  if (!Array.isArray(patch)) return applyPatch(base, patch)\n  if (patch.length === 0) return base\n\n  let result = ''\n  let cursor = 0\n  for (const item of patch) {\n    if (item.start < cursor) return { error: 'overlapping patch', status: 400 }\n    result += base.slice(cursor, item.start)\n    result += item.insert\n    cursor = item.start + item.deleteCount\n  }\n  return result + base.slice(cursor)\n}\n\nasync function readState(env, affinity) {\n  const raw = await env.RELAY_STATE.get('session:' + affinity)\n  return raw ? JSON.parse(raw) : null\n}\n\nasync function writeState(env, affinity, state) {\n  await env.RELAY_STATE.put('session:' + affinity, JSON.stringify(state), { expirationTtl: 86400 })\n}\n\nasync function resolveBody(env, payload) {\n  if (payload.mode === 'full_sync') return payload.body\n  if (payload.mode === 'patch') {\n    const state = await readState(env, payload.affinity)\n    if (!state || state.hash !== payload.base_hash) {\n      return { error: 'state mismatch', status: 409 }\n    }\n    return applyPatchSet(state.body, payload.patch)\n  }\n  return { error: 'unknown mode', status: 400 }\n}\n\nasync function prepareUpstream(env, payload) {\n  if ((payload.protocol !== 1 && payload.protocol !== 2) || payload.type !== 'request' || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {\n    return { error: 'invalid payload', status: 400 }\n  }\n\n  const body = await resolveBody(env, payload)\n  if (body && typeof body === 'object' && 'error' in body) return body\n\n  if (typeof body !== 'string' || (await hashBody(body)) !== payload.next_hash) {\n    return { error: 'hash mismatch', status: 409 }\n  }\n\n  await writeState(env, payload.affinity, { body, hash: payload.next_hash, revision: payload.revision })\n  console.log(JSON.stringify({\n    relay: 'opencode-anthropic-auth',\n    transport: 'relay',\n    mode: payload.mode,\n    revision: payload.revision,\n    affinity: String(payload.affinity).slice(0, 12),\n    bodyBytes: body.length,\n  }))\n\n  return { body }\n}\n\nfunction resolveBodyFromState(state, payload) {\n  if (payload.mode === 'full_sync') return payload.body\n  if (payload.mode === 'patch') {\n    if (!state || state.hash !== payload.base_hash) {\n      return { error: 'state mismatch', status: 409 }\n    }\n    return applyPatchSet(state.body, payload.patch)\n  }\n  return { error: 'unknown mode', status: 400 }\n}\n\nfunction deferWorkerTask(task) {\n  return new Promise((resolve) => setTimeout(resolve, 0)).then(task)\n}\n\nfunction checkpointWebSocketState(env, payload, body, nextState) {\n  return deferWorkerTask(async () => {\n    try {\n      if ((await hashBody(body)) !== payload.next_hash) {\n        throw new Error('hash mismatch')\n      }\n      await writeState(env, payload.affinity, nextState)\n    } catch (error) {\n      console.log(JSON.stringify({\n        relay: 'opencode-anthropic-auth',\n        transport: 'websocket',\n        event: 'checkpoint_write_failed',\n        affinity: String(payload.affinity).slice(0, 12),\n        message: error instanceof Error ? error.message : String(error),\n      }))\n    }\n  })\n}\n\nfunction prepareWebSocketUpstream(env, state, payload) {\n  if (payload.protocol !== 2 || payload.type !== 'request' || !payload.id || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {\n    return { error: 'invalid payload', status: 400 }\n  }\n\n  const body = resolveBodyFromState(state, payload)\n  if (body && typeof body === 'object' && 'error' in body) return body\n  if (typeof body !== 'string') return { error: 'invalid body', status: 400 }\n\n  const nextState = { body, hash: payload.next_hash, revision: payload.revision }\n  const checkpoint = checkpointWebSocketState(env, payload, body, nextState)\n  const logAccepted = () => console.log(JSON.stringify({\n    relay: 'opencode-anthropic-auth',\n    transport: 'websocket',\n    mode: payload.mode,\n    revision: payload.revision,\n    affinity: String(payload.affinity).slice(0, 12),\n    bodyBytes: body.length,\n  }))\n\n  return { body, state: nextState, checkpoint, logAccepted }\n}\n\nfunction headersToObject(headers) {\n  const result = {}\n  for (const [key, value] of headers.entries()) result[key] = value\n  return result\n}\n\nasync function handleRelayPayload(env, payload) {\n  const prepared = await prepareUpstream(env, payload)\n  if (prepared.error) return prepared\n  const upstream = await fetch(payload.upstream.url, {\n    method: payload.upstream.method || 'POST',\n    headers: payload.upstream.headers,\n    body: prepared.body,\n  })\n  return { upstream }\n}\n\nasync function handleWebSocket(socket, env, ctx, payload, getState, setState) {\n  const heartbeat = setInterval(() => {\n    try {\n      socket.send(JSON.stringify({ protocol: 2, type: 'keepalive' }))\n    } catch {\n      clearInterval(heartbeat)\n    }\n  }, 5000)\n  try {\n    const result = prepareWebSocketUpstream(env, getState(), payload)\n    if (result.error) {\n      socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: result.status, message: result.error }))\n      return\n    }\n\n    setState(result.state)\n    socket.send(JSON.stringify({ protocol: 2, type: 'accepted', id: payload.id, hash: result.state.hash, revision: result.state.revision }))\n    ctx?.waitUntil?.(deferWorkerTask(result.logAccepted))\n\n    const upstreamPromise = fetch(payload.upstream.url, {\n      method: payload.upstream.method || 'POST',\n      headers: payload.upstream.headers,\n      body: result.body,\n    })\n    ctx?.waitUntil?.(result.checkpoint)\n    const upstream = await upstreamPromise\n    socket.send(JSON.stringify({\n      protocol: 2,\n      type: 'response_start',\n      id: payload.id,\n      status: upstream.status,\n      statusText: upstream.statusText,\n      headers: headersToObject(upstream.headers),\n    }))\n\n    const reader = upstream.body?.getReader()\n    if (reader) {\n      while (true) {\n        const { done, value } = await reader.read()\n        if (done) break\n        socket.send(value)\n      }\n    }\n    socket.send(JSON.stringify({ protocol: 2, type: 'done', id: payload.id }))\n  } catch (error) {\n    socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: 500, message: error instanceof Error ? error.message : String(error) }))\n  } finally {\n    clearInterval(heartbeat)\n  }\n}\n\nexport default {\n  async fetch(request, env, ctx) {\n    if (request.headers.get('Upgrade') === 'websocket') {\n      const url = new URL(request.url)\n      const token = url.searchParams.get('token')\n      const affinity = url.searchParams.get('affinity')\n      if (token !== env.RELAY_TOKEN) return new Response('unauthorized', { status: 401 })\n      if (!affinity) return new Response('missing affinity', { status: 400 })\n      const pair = new WebSocketPair()\n      const client = pair[0]\n      const server = pair[1]\n      server.binaryType = 'arraybuffer'\n      let state = null\n      let ready = false\n      server.accept()\n      const loadState = readState(env, affinity).then((loadedState) => {\n        state = loadedState\n        ready = true\n        server.send(JSON.stringify({\n          protocol: 2,\n          type: 'ready',\n          state: state ? { hash: state.hash, revision: state.revision } : null,\n        }))\n      }).catch((error) => {\n        server.send(JSON.stringify({ protocol: 2, type: 'error', status: 500, message: error instanceof Error ? error.message : String(error) }))\n        server.close(1011, 'state load failed')\n      })\n      ctx?.waitUntil?.(loadState)\n      if (!ctx?.waitUntil) void loadState\n      let busy = false\n      server.addEventListener('message', (event) => {\n        if (!ready) {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 425, message: 'relay state is not ready' }))\n          return\n        }\n        if (busy) {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 429, message: 'request already in flight' }))\n          return\n        }\n        let payload\n        try {\n          payload = JSON.parse(event.data)\n        } catch {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 400, message: 'invalid JSON payload' }))\n          return\n        }\n        payload.affinity = affinity\n        busy = true\n        const run = handleWebSocket(server, env, ctx, payload, () => state, (nextState) => { state = nextState }).finally(() => { busy = false })\n        ctx?.waitUntil?.(run)\n        if (!ctx?.waitUntil) void run\n      })\n      return new Response(null, { status: 101, webSocket: client })\n    }\n\n    if (request.method === 'GET') return new Response('ok')\n    if (request.method !== 'POST') return new Response('method not allowed', { status: 405 })\n    if (request.headers.get('x-relay-token') !== env.RELAY_TOKEN) {\n      return new Response('unauthorized', { status: 401 })\n    }\n\n    const payload = await request.json()\n    const result = await handleRelayPayload(env, payload)\n    if (result.error) return Response.json({ error: result.error }, { status: result.status })\n\n    const upstream = result.upstream\n    return new Response(upstream.body, {\n      status: upstream.status,\n      statusText: upstream.statusText,\n      headers: upstream.headers,\n    })\n  },\n}\n";