@cortexkit/anthropic-auth-core 1.2.2 → 1.2.4

package/dist/accounts.d.ts

@@ -153,6 +153,7 @@ export declare class FallbackAccountManager {
     refreshAccount(account: OAuthAccount, storage: AccountStorage, options?: {
         force?: boolean;
     }): Promise<OAuthAccount>;
+    private waitForConcurrentFallbackRefresh;
     private refreshAccountNow;
     refreshAccountQuota(account: OAuthAccount, storage: AccountStorage): Promise<OAuthAccount>;
 }

package/dist/accounts.js

@@ -22,6 +22,9 @@ const DEFAULT_MINIMUM_REMAINING = {
 const DEFAULT_FAIL_CLOSED_ON_UNKNOWN_QUOTA = true;
 const BACKGROUND_TICK_MS = 60_000;
 const BACKGROUND_TICK_JITTER_MS = 60_000;
+const FALLBACK_REFRESH_LOCK_TTL_MS = 2 * 60_000;
+const FALLBACK_REFRESH_JOIN_WAIT_MS = 10_000;
+const FALLBACK_REFRESH_JOIN_POLL_MS = 100;
 function getConfigDir() {
     if (process.env.OPENCODE_CONFIG_DIR?.trim()) {
         return process.env.OPENCODE_CONFIG_DIR.trim();
@@ -380,9 +383,17 @@ export function buildRefreshOperationError(input) {
         ? (input.previous.retryCount ?? 0)
         : 0;
     const retryCount = previousRetryCount + 1;
-    const delay = isTransientRefreshError(input.error)
-        ? Math.min(MAX_REFRESH_RETRY_DELAY_MS, MIN_REFRESH_RETRY_DELAY_MS * 2 ** Math.min(retryCount - 1, 6))
-        : NON_TRANSIENT_REFRESH_RETRY_DELAY_MS;
+    let delay;
+    if (input.error instanceof ClaudeOAuthRefreshError &&
+        input.error.retryAfter) {
+        delay = input.error.retryAfter * 1000;
+    }
+    else if (isTransientRefreshError(input.error)) {
+        delay = Math.min(MAX_REFRESH_RETRY_DELAY_MS, MIN_REFRESH_RETRY_DELAY_MS * 2 ** Math.min(retryCount - 1, 6));
+    }
+    else {
+        delay = NON_TRANSIENT_REFRESH_RETRY_DELAY_MS;
+    }
     return {
         message: formatErrorMessage(input.error),
         checkedAt: input.now,
@@ -526,6 +537,12 @@ function recordQuotaRefreshError(account, error, now) {
         recordRefreshError(account, error, now);
     }
 }
+function fallbackRefreshLockName(accountId) {
+    return `fallback-oauth-refresh-${createHash('sha256')
+        .update(accountId)
+        .digest('hex')
+        .slice(0, 16)}`;
+}
 export class FallbackAccountManager {
     now;
     fetchImpl;
@@ -741,43 +758,105 @@ export class FallbackAccountManager {
         updateStoredAccount(storage, refreshed);
         return refreshed;
     }
+    async waitForConcurrentFallbackRefresh(account, storage, previous, options) {
+        const deadline = Date.now() + FALLBACK_REFRESH_JOIN_WAIT_MS;
+        while (Date.now() < deadline) {
+            await new Promise((resolve) => setTimeout(resolve, FALLBACK_REFRESH_JOIN_POLL_MS));
+            const latestStorage = await this.load();
+            const latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id);
+            if (!latestAccount)
+                continue;
+            const changed = latestAccount.access !== previous.access ||
+                latestAccount.refresh !== previous.refresh ||
+                (latestAccount.expires ?? 0) > (previous.expires ?? 0) + 60_000;
+            if (changed &&
+                (options.force ||
+                    !tokenNeedsRefresh(latestAccount, latestStorage, this.now()))) {
+                updateStoredAccount(storage, latestAccount);
+                log('[refresh] fallback oauth joined concurrent refresh', {
+                    accountId: latestAccount.id,
+                    expiresInMs: latestAccount.expires
+                        ? latestAccount.expires - this.now()
+                        : undefined,
+                });
+                return latestAccount;
+            }
+            const refreshError = latestAccount.lastRefreshError;
+            if (refreshError &&
+                refreshBackoffActive(refreshError, latestAccount.refresh, this.now())) {
+                updateStoredAccount(storage, latestAccount);
+                throw new Error(formatRefreshBackoffMessage(refreshError, this.now()));
+            }
+        }
+        return null;
+    }
     async refreshAccountNow(account, storage, options) {
-        const latestStorage = await this.load();
-        const latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id);
+        let latestStorage = await this.load();
+        let latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id);
         if (latestAccount &&
             !options.force &&
             !tokenNeedsRefresh(latestAccount, latestStorage, this.now())) {
             updateStoredAccount(storage, latestAccount);
             return latestAccount;
         }
-        const sourceAccount = latestAccount ?? account;
-        const refreshToken = sourceAccount.refresh;
-        log('[refresh] fallback oauth refresh request start', {
-            accountId: sourceAccount.id,
-            force: options.force === true,
-            expiresInMs: sourceAccount.expires
-                ? sourceAccount.expires - this.now()
-                : undefined,
-        });
-        const refreshed = await refreshClaudeOAuthToken({
-            refreshToken,
-            fetchImpl: this.fetchImpl,
+        let sourceAccount = latestAccount ?? account;
+        const fileLock = await acquireRefreshFileLock({
+            name: fallbackRefreshLockName(sourceAccount.id),
+            ttlMs: FALLBACK_REFRESH_LOCK_TTL_MS,
+            path: this.configPath,
             now: this.now,
         });
-        sourceAccount.access = refreshed.access;
-        sourceAccount.refresh = refreshed.refresh;
-        sourceAccount.expires = refreshed.expires;
-        sourceAccount.lastRefreshedAt =
-            refreshed.expires - refreshed.expiresIn * 1000;
-        sourceAccount.lastRefreshError = undefined;
-        updateStoredAccount(storage, sourceAccount);
-        log('[refresh] fallback oauth refresh succeeded', {
-            accountId: sourceAccount.id,
-            expiresInMs: sourceAccount.expires
-                ? sourceAccount.expires - this.now()
-                : undefined,
-        });
-        return sourceAccount;
+        if (!fileLock) {
+            log('[refresh] fallback oauth refresh skipped file lock', {
+                accountId: sourceAccount.id,
+            });
+            const concurrent = await this.waitForConcurrentFallbackRefresh(account, storage, sourceAccount, options);
+            if (concurrent)
+                return concurrent;
+            throw new Error('Fallback OAuth refresh is already in progress');
+        }
+        try {
+            latestStorage = await this.load();
+            latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id);
+            if (latestAccount &&
+                !options.force &&
+                !tokenNeedsRefresh(latestAccount, latestStorage, this.now())) {
+                updateStoredAccount(storage, latestAccount);
+                return latestAccount;
+            }
+            sourceAccount = latestAccount ?? sourceAccount;
+            const refreshToken = sourceAccount.refresh;
+            log('[refresh] fallback oauth refresh request start', {
+                accountId: sourceAccount.id,
+                force: options.force === true,
+                expiresInMs: sourceAccount.expires
+                    ? sourceAccount.expires - this.now()
+                    : undefined,
+            });
+            const refreshed = await refreshClaudeOAuthToken({
+                refreshToken,
+                fetchImpl: this.fetchImpl,
+                now: this.now,
+            });
+            sourceAccount.access = refreshed.access;
+            sourceAccount.refresh = refreshed.refresh;
+            sourceAccount.expires = refreshed.expires;
+            sourceAccount.lastRefreshedAt =
+                refreshed.expires - refreshed.expiresIn * 1000;
+            sourceAccount.lastRefreshError = undefined;
+            updateStoredAccount(storage, sourceAccount);
+            await this.save(storage);
+            log('[refresh] fallback oauth refresh succeeded', {
+                accountId: sourceAccount.id,
+                expiresInMs: sourceAccount.expires
+                    ? sourceAccount.expires - this.now()
+                    : undefined,
+            });
+            return sourceAccount;
+        }
+        finally {
+            await fileLock.release();
+        }
     }
     async refreshAccountQuota(account, storage) {
         let target = account;

package/dist/auth.d.ts

@@ -1,7 +1,9 @@
 export declare class ClaudeOAuthRefreshError extends Error {
     readonly status: number;
     readonly body: string;
-    constructor(status: number, body: string);
+    /** Parsed Retry-After value in seconds, if the server provided one. */
+    readonly retryAfter: number | undefined;
+    constructor(status: number, body: string, retryAfterHeader?: string | null);
 }
 export type ClaudeOAuthRefreshResult = {
     access: string;

package/dist/auth.js

@@ -1,13 +1,29 @@
 import { AUTHORIZE_URLS, CLIENT_ID, CODE_CALLBACK_URL, OAUTH_SCOPES, TOKEN_URL, } from "./constants.js";
 import { generatePKCE } from "./pkce.js";
+function parseRetryAfterHeader(value) {
+    if (!value)
+        return undefined;
+    const seconds = Number(value);
+    if (Number.isFinite(seconds) && seconds > 0)
+        return Math.ceil(seconds);
+    const date = Date.parse(value);
+    if (Number.isFinite(date)) {
+        const delta = Math.ceil((date - Date.now()) / 1000);
+        return delta > 0 ? delta : undefined;
+    }
+    return undefined;
+}
 export class ClaudeOAuthRefreshError extends Error {
     status;
     body;
-    constructor(status, body) {
+    /** Parsed Retry-After value in seconds, if the server provided one. */
+    retryAfter;
+    constructor(status, body, retryAfterHeader) {
         super(`Claude OAuth refresh failed: ${status} — ${body}`);
         this.status = status;
         this.body = body;
         this.name = 'ClaudeOAuthRefreshError';
+        this.retryAfter = parseRetryAfterHeader(retryAfterHeader ?? undefined);
     }
 }
 function isTransientNetworkError(error) {
@@ -35,6 +51,7 @@ export async function refreshClaudeOAuthToken(input) {
                 headers: {
                     'Content-Type': 'application/json',
                     Accept: 'application/json',
+                    'User-Agent': 'axios/1.13.6',
                 },
                 body: JSON.stringify({
                     grant_type: 'refresh_token',
@@ -48,7 +65,7 @@ export async function refreshClaudeOAuthToken(input) {
                     continue;
                 }
                 const body = await response.text().catch(() => '');
-                throw new ClaudeOAuthRefreshError(response.status, body);
+                throw new ClaudeOAuthRefreshError(response.status, body, response.headers.get('retry-after'));
             }
             const json = (await response.json());
             const refreshedAt = input.now?.() ?? Date.now();

package/dist/constants.d.ts

@@ -4,7 +4,7 @@ export declare const AUTHORIZE_URLS: {
     readonly max: "https://claude.ai/oauth/authorize";
 };
 export declare const CODE_CALLBACK_URL = "https://platform.claude.com/oauth/code/callback";
-export declare const TOKEN_URL = "https://api.anthropic.com/v1/oauth/token";
+export declare const TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
 export declare const OAUTH_SCOPES: string[];
 export declare const TOOL_PREFIX = "mcp_";
 export declare const REQUIRED_BETAS: string[];

package/dist/constants.js

@@ -4,7 +4,7 @@ export const AUTHORIZE_URLS = {
     max: 'https://claude.ai/oauth/authorize',
 };
 export const CODE_CALLBACK_URL = 'https://platform.claude.com/oauth/code/callback';
-export const TOKEN_URL = 'https://api.anthropic.com/v1/oauth/token';
+export const TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
 export const OAUTH_SCOPES = [
     'org:create_api_key',
     'user:profile',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "1.2.2",
+  "version": "1.2.4",
   "type": "module",
   "repository": {
     "type": "git",