@cortexkit/anthropic-auth-core 1.2.1 → 1.2.3

package/dist/accounts.js

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from 'node:crypto';
-import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { ClaudeOAuthRefreshError, refreshClaudeOAuthToken } from "./auth.js";
@@ -21,6 +21,7 @@ const DEFAULT_MINIMUM_REMAINING = {
 };
 const DEFAULT_FAIL_CLOSED_ON_UNKNOWN_QUOTA = true;
 const BACKGROUND_TICK_MS = 60_000;
+const BACKGROUND_TICK_JITTER_MS = 60_000;
 function getConfigDir() {
     if (process.env.OPENCODE_CONFIG_DIR?.trim()) {
         return process.env.OPENCODE_CONFIG_DIR.trim();
@@ -162,46 +163,64 @@ export async function saveAccounts(storage, path = getAccountStoragePath()) {
 }
 export async function acquireRefreshFileLock(options) {
     const accountPath = options.path ?? getAccountStoragePath();
-    const lockDir = `${accountPath}.${options.name}.lock`;
-    const ownerPath = join(lockDir, 'owner.json');
+    const lockPath = `${accountPath}.${options.name}.lock`;
+    const legacyOwnerPath = join(lockPath, 'owner.json');
     const ownerId = randomUUID();
     const now = options.now ?? Date.now;
+    async function readOwner() {
+        try {
+            return JSON.parse(await readFile(lockPath, 'utf8'));
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== 'EISDIR')
+                throw error;
+            return JSON.parse(await readFile(legacyOwnerPath, 'utf8'));
+        }
+    }
     async function tryAcquire() {
         try {
-            await mkdir(lockDir, { mode: 0o700 });
-            await writeFile(ownerPath, `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}\n`, { encoding: 'utf8', mode: 0o600 });
+            await writeFile(lockPath, `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
             return true;
         }
         catch (error) {
-            if (error.code !== 'EEXIST')
-                throw error;
-            return false;
+            const code = error.code;
+            if (code === 'EEXIST' || code === 'EISDIR')
+                return false;
+            throw error;
         }
     }
     if (!(await tryAcquire())) {
         try {
-            const owner = JSON.parse(await readFile(ownerPath, 'utf8'));
+            const owner = await readOwner();
             if (Number(owner?.expiresAt) > now())
                 return null;
         }
         catch {
-            // Broken owner metadata is treated as stale.
+            try {
+                const current = await stat(lockPath);
+                if (current.mtimeMs + options.ttlMs > Date.now())
+                    return null;
+            }
+            catch {
+                return null;
+            }
         }
-        await rm(lockDir, { recursive: true, force: true }).catch(() => { });
+        await rm(lockPath, { recursive: true, force: true }).catch(() => { });
         if (!(await tryAcquire()))
             return null;
     }
     return {
         release: async () => {
             try {
-                const owner = JSON.parse(await readFile(ownerPath, 'utf8'));
+                const owner = await readOwner();
                 if (owner?.ownerId !== ownerId)
                     return;
             }
             catch {
                 return;
             }
-            await rm(lockDir, { recursive: true, force: true }).catch(() => { });
+            await rm(lockPath, { recursive: true, force: true }).catch(() => { });
         },
     };
 }
@@ -327,6 +346,9 @@ function quotaEnabled(storage) {
 function refreshEnabled(storage) {
     return storage?.refresh?.enabled !== false;
 }
+function jitterMs(maxMs) {
+    return Math.floor(Math.random() * Math.max(0, maxMs));
+}
 function refreshBeforeExpiryMs(storage) {
     const minutes = storage?.refresh?.refreshBeforeExpiryMinutes ??
         DEFAULT_REFRESH_BEFORE_EXPIRY_MINUTES;
@@ -358,9 +380,17 @@ export function buildRefreshOperationError(input) {
         ? (input.previous.retryCount ?? 0)
         : 0;
     const retryCount = previousRetryCount + 1;
-    const delay = isTransientRefreshError(input.error)
-        ? Math.min(MAX_REFRESH_RETRY_DELAY_MS, MIN_REFRESH_RETRY_DELAY_MS * 2 ** Math.min(retryCount - 1, 6))
-        : NON_TRANSIENT_REFRESH_RETRY_DELAY_MS;
+    let delay;
+    if (input.error instanceof ClaudeOAuthRefreshError &&
+        input.error.retryAfter) {
+        delay = input.error.retryAfter * 1000;
+    }
+    else if (isTransientRefreshError(input.error)) {
+        delay = Math.min(MAX_REFRESH_RETRY_DELAY_MS, MIN_REFRESH_RETRY_DELAY_MS * 2 ** Math.min(retryCount - 1, 6));
+    }
+    else {
+        delay = NON_TRANSIENT_REFRESH_RETRY_DELAY_MS;
+    }
     return {
         message: formatErrorMessage(input.error),
         checkedAt: input.now,
@@ -531,7 +561,7 @@ export class FallbackAccountManager {
         if (!this.refreshTimer) {
             this.refreshTimer = setInterval(() => {
                 void run().catch(() => { });
-            }, BACKGROUND_TICK_MS);
+            }, BACKGROUND_TICK_MS + jitterMs(BACKGROUND_TICK_JITTER_MS));
             if ('unref' in this.refreshTimer)
                 this.refreshTimer.unref();
         }

package/dist/auth.d.ts

@@ -1,7 +1,9 @@
 export declare class ClaudeOAuthRefreshError extends Error {
     readonly status: number;
     readonly body: string;
-    constructor(status: number, body: string);
+    /** Parsed Retry-After value in seconds, if the server provided one. */
+    readonly retryAfter: number | undefined;
+    constructor(status: number, body: string, retryAfterHeader?: string | null);
 }
 export type ClaudeOAuthRefreshResult = {
     access: string;

package/dist/auth.js

@@ -1,13 +1,29 @@
 import { AUTHORIZE_URLS, CLIENT_ID, CODE_CALLBACK_URL, OAUTH_SCOPES, TOKEN_URL, } from "./constants.js";
 import { generatePKCE } from "./pkce.js";
+function parseRetryAfterHeader(value) {
+    if (!value)
+        return undefined;
+    const seconds = Number(value);
+    if (Number.isFinite(seconds) && seconds > 0)
+        return Math.ceil(seconds);
+    const date = Date.parse(value);
+    if (Number.isFinite(date)) {
+        const delta = Math.ceil((date - Date.now()) / 1000);
+        return delta > 0 ? delta : undefined;
+    }
+    return undefined;
+}
 export class ClaudeOAuthRefreshError extends Error {
     status;
     body;
-    constructor(status, body) {
+    /** Parsed Retry-After value in seconds, if the server provided one. */
+    retryAfter;
+    constructor(status, body, retryAfterHeader) {
         super(`Claude OAuth refresh failed: ${status} — ${body}`);
         this.status = status;
         this.body = body;
         this.name = 'ClaudeOAuthRefreshError';
+        this.retryAfter = parseRetryAfterHeader(retryAfterHeader ?? undefined);
     }
 }
 function isTransientNetworkError(error) {
@@ -35,6 +51,7 @@ export async function refreshClaudeOAuthToken(input) {
                 headers: {
                     'Content-Type': 'application/json',
                     Accept: 'application/json',
+                    'User-Agent': 'axios/1.13.6',
                 },
                 body: JSON.stringify({
                     grant_type: 'refresh_token',
@@ -48,7 +65,7 @@ export async function refreshClaudeOAuthToken(input) {
                     continue;
                 }
                 const body = await response.text().catch(() => '');
-                throw new ClaudeOAuthRefreshError(response.status, body);
+                throw new ClaudeOAuthRefreshError(response.status, body, response.headers.get('retry-after'));
             }
             const json = (await response.json());
             const refreshedAt = input.now?.() ?? Date.now();

package/dist/constants.d.ts

@@ -4,7 +4,7 @@ export declare const AUTHORIZE_URLS: {
     readonly max: "https://claude.ai/oauth/authorize";
 };
 export declare const CODE_CALLBACK_URL = "https://platform.claude.com/oauth/code/callback";
-export declare const TOKEN_URL = "https://api.anthropic.com/v1/oauth/token";
+export declare const TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
 export declare const OAUTH_SCOPES: string[];
 export declare const TOOL_PREFIX = "mcp_";
 export declare const REQUIRED_BETAS: string[];

package/dist/constants.js

@@ -4,7 +4,7 @@ export const AUTHORIZE_URLS = {
     max: 'https://claude.ai/oauth/authorize',
 };
 export const CODE_CALLBACK_URL = 'https://platform.claude.com/oauth/code/callback';
-export const TOKEN_URL = 'https://api.anthropic.com/v1/oauth/token';
+export const TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
 export const OAUTH_SCOPES = [
     'org:create_api_key',
     'user:profile',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "type": "module",
   "repository": {
     "type": "git",