@cortexkit/anthropic-auth-core 1.23.0 → 2.0.1

package/dist/auth.js

@@ -1,185 +0,0 @@
-import { assertNotCustodyTombstone } from './claustrum.js';
-import { AUTHORIZE_URLS, AXIOS_USER_AGENT, CLIENT_ID, CODE_CALLBACK_URL, OAUTH_SCOPES, REFRESH_SCOPE, TOKEN_URL, } from './constants.js';
-import { isTransientNetworkError } from './network-errors.js';
-import { generatePKCE } from './pkce.js';
-export function parseRetryAfterHeader(value) {
-    if (!value)
-        return undefined;
-    const seconds = Number(value);
-    if (Number.isFinite(seconds) && seconds > 0)
-        return Math.ceil(seconds);
-    const date = Date.parse(value);
-    if (Number.isFinite(date)) {
-        const delta = Math.ceil((date - Date.now()) / 1000);
-        return delta > 0 ? delta : undefined;
-    }
-    return undefined;
-}
-export class ClaudeOAuthRefreshError extends Error {
-    status;
-    body;
-    /** Parsed Retry-After value in seconds, if the server provided one. */
-    retryAfter;
-    /**
-     * Duck-typed marker: any error carrying `isRefreshError: true` arms the
-     * refresh backoff in consumers that receive it (recordQuotaRefreshError).
-     * Provider-agnostic — shared-core extraction of anthropic-auth and
-     * openai-auth relies on this field instead of instanceof.
-     */
-    isRefreshError = true;
-    constructor(status, body, retryAfterHeader) {
-        super(`Claude OAuth refresh failed: ${status} — ${body}`);
-        this.status = status;
-        this.body = body;
-        this.name = 'ClaudeOAuthRefreshError';
-        this.retryAfter = parseRetryAfterHeader(retryAfterHeader ?? undefined);
-    }
-}
-export async function refreshClaudeOAuthToken(input) {
-    assertNotCustodyTombstone(input.refreshToken, 'anthropic');
-    if (typeof input.refreshToken !== 'string' || !input.refreshToken.trim()) {
-        throw new Error('Local OAuth refresh credential is unavailable');
-    }
-    const fetchImpl = input.fetchImpl ?? fetch;
-    const maxRetries = input.maxRetries ?? 2;
-    const baseDelayMs = input.baseDelayMs ?? 500;
-    const setTimeoutImpl = input.setTimeoutImpl ?? globalThis.setTimeout;
-    for (let attempt = 0; attempt <= maxRetries; attempt++) {
-        try {
-            if (attempt > 0) {
-                const delay = baseDelayMs * 2 ** (attempt - 1);
-                await new Promise((resolve) => setTimeoutImpl(resolve, delay));
-            }
-            const response = await fetchImpl(TOKEN_URL, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    Accept: 'application/json, text/plain, */*',
-                    'User-Agent': AXIOS_USER_AGENT,
-                },
-                body: JSON.stringify({
-                    grant_type: 'refresh_token',
-                    refresh_token: input.refreshToken,
-                    client_id: CLIENT_ID,
-                    scope: REFRESH_SCOPE,
-                }),
-            });
-            if (!response.ok) {
-                if (response.status >= 500 && attempt < maxRetries) {
-                    await response.body?.cancel().catch(() => { });
-                    continue;
-                }
-                const body = await response.text().catch(() => '');
-                throw new ClaudeOAuthRefreshError(response.status, body, response.headers.get('retry-after'));
-            }
-            const json = (await response.json());
-            const refreshedAt = input.now?.() ?? Date.now();
-            return {
-                access: json.access_token,
-                refresh: json.refresh_token ?? input.refreshToken,
-                expires: refreshedAt + json.expires_in * 1000,
-                expiresIn: json.expires_in,
-                authLineageId: input.authLineageId,
-            };
-        }
-        catch (error) {
-            if (error instanceof ClaudeOAuthRefreshError)
-                throw error;
-            if (attempt < maxRetries && isTransientNetworkError(error))
-                continue;
-            throw error;
-        }
-    }
-    throw new Error('Token refresh exhausted all retries');
-}
-function generateState() {
-    return crypto.randomUUID().replace(/-/g, '');
-}
-function parseCallbackInput(input) {
-    const trimmed = input.trim();
-    try {
-        const url = new URL(trimmed);
-        const code = url.searchParams.get('code');
-        const state = url.searchParams.get('state');
-        if (code && state) {
-            return { code, state };
-        }
-    }
-    catch {
-        // Fall through to legacy/manual formats.
-    }
-    const hashSplits = trimmed.split('#');
-    if (hashSplits.length === 2 && hashSplits[0] && hashSplits[1]) {
-        return { code: hashSplits[0], state: hashSplits[1] };
-    }
-    const params = new URLSearchParams(trimmed);
-    const code = params.get('code');
-    const state = params.get('state');
-    if (code && state) {
-        return { code, state };
-    }
-    return null;
-}
-async function exchangeCode(callback, verifier, redirectUri) {
-    const result = await fetch(TOKEN_URL, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            Accept: 'application/json, text/plain, */*',
-            'User-Agent': AXIOS_USER_AGENT,
-        },
-        body: JSON.stringify({
-            code: callback.code,
-            state: callback.state,
-            grant_type: 'authorization_code',
-            client_id: CLIENT_ID,
-            redirect_uri: redirectUri,
-            code_verifier: verifier,
-        }),
-    });
-    if (!result.ok) {
-        return {
-            type: 'failed',
-        };
-    }
-    const json = (await result.json());
-    return {
-        type: 'success',
-        refresh: json.refresh_token,
-        access: json.access_token,
-        expires: Date.now() + json.expires_in * 1000,
-    };
-}
-export async function authorize(mode) {
-    const pkce = await generatePKCE();
-    const state = generateState();
-    const url = new URL(AUTHORIZE_URLS[mode], import.meta.url);
-    url.searchParams.set('code', 'true');
-    url.searchParams.set('client_id', CLIENT_ID);
-    url.searchParams.set('response_type', 'code');
-    url.searchParams.set('redirect_uri', CODE_CALLBACK_URL);
-    url.searchParams.set('scope', OAUTH_SCOPES.join(' '));
-    url.searchParams.set('code_challenge', pkce.challenge);
-    url.searchParams.set('code_challenge_method', 'S256');
-    url.searchParams.set('state', state);
-    return {
-        url: url.toString(),
-        redirectUri: CODE_CALLBACK_URL,
-        state,
-        verifier: pkce.verifier,
-    };
-}
-export async function exchange(input, verifier, redirectUri, expectedState) {
-    const callback = parseCallbackInput(input);
-    if (!callback) {
-        return {
-            type: 'failed',
-        };
-    }
-    if (expectedState && callback.state !== expectedState) {
-        return {
-            type: 'failed',
-        };
-    }
-    return exchangeCode(callback, verifier, redirectUri);
-}

package/dist/cache1h.js

@@ -1,97 +0,0 @@
-import { DEFAULT_CACHE_1H_MODE } from './constants.js';
-export const CACHE_1H_COMMAND_NAME = 'claude-cache';
-const CACHE_1H_STATUS_TITLE = '## Claude Cache Status';
-const CACHE_1H_ENABLED_TITLE = '## Claude Cache Enabled';
-const CACHE_1H_DISABLED_TITLE = '## Claude Cache Disabled';
-const CACHE_1H_USAGE_TITLE = '## Claude Cache Usage';
-const CACHE_1H_USAGE = 'Usage: `/claude-cache`, `/claude-cache on`, `/claude-cache off`, or `/claude-cache mode explicit|automatic|hybrid`.';
-let cache1hEnabled = false;
-let cache1hMode = DEFAULT_CACHE_1H_MODE;
-export function isCache1hEnabled() {
-    return cache1hEnabled;
-}
-export function getCache1hMode() {
-    return cache1hMode;
-}
-export function setCache1hEnabled(enabled) {
-    cache1hEnabled = enabled;
-}
-export function setCache1hMode(mode) {
-    cache1hMode = mode;
-}
-export function setCache1hState(input) {
-    cache1hEnabled = input.enabled;
-    cache1hMode = input.mode;
-}
-export function resetCache1hState() {
-    cache1hEnabled = false;
-    cache1hMode = DEFAULT_CACHE_1H_MODE;
-}
-export function parseCache1hCommandAction(argumentsText) {
-    const normalized = argumentsText.trim().split(/\s+/).filter(Boolean);
-    if (normalized.length === 0)
-        return { type: 'status' };
-    if (normalized.length === 1 && normalized[0] === 'on')
-        return { type: 'enable' };
-    if (normalized.length === 1 && normalized[0] === 'off')
-        return { type: 'disable' };
-    if (normalized.length === 2 &&
-        normalized[0] === 'mode' &&
-        (normalized[1] === 'explicit' ||
-            normalized[1] === 'automatic' ||
-            normalized[1] === 'hybrid')) {
-        return { type: 'mode', mode: normalized[1] };
-    }
-    return { type: 'usage' };
-}
-export function buildCache1hStatusSummary(input) {
-    const enabled = input?.enabled ?? cache1hEnabled;
-    const mode = input?.mode ?? cache1hMode;
-    return [
-        CACHE_1H_STATUS_TITLE,
-        '',
-        `- Enabled: ${enabled ? 'enabled' : 'disabled'}`,
-        `- Mode: ${mode}`,
-        '- Persisted: ~/.config/opencode/anthropic-auth.json',
-        '- Scope: main sessions only; subagent sessions keep default ephemeral cache behavior',
-        '- Modes: explicit = existing OpenCode breakpoints; automatic = top-level cache_control only; hybrid = system + messages[0] + top-level cache_control',
-        '- TTL: 1h when enabled for main sessions; default ephemeral cache behavior otherwise',
-    ].join('\n');
-}
-export function executeCache1hCommand(input) {
-    const action = parseCache1hCommandAction(input.argumentsText);
-    const enabled = input.enabled ?? cache1hEnabled;
-    const mode = input.mode ?? cache1hMode;
-    if (action.type === 'status')
-        return buildCache1hStatusSummary({ enabled, mode });
-    if (action.type === 'enable') {
-        return [
-            CACHE_1H_ENABLED_TITLE,
-            '',
-            buildCache1hStatusSummary({ enabled: true, mode }),
-        ].join('\n');
-    }
-    if (action.type === 'disable') {
-        return [
-            CACHE_1H_DISABLED_TITLE,
-            '',
-            buildCache1hStatusSummary({ enabled: false, mode }),
-        ].join('\n');
-    }
-    if (action.type === 'mode') {
-        return [
-            CACHE_1H_STATUS_TITLE,
-            '',
-            `Mode updated to \`${action.mode}\`.`,
-            '',
-            buildCache1hStatusSummary({ enabled, mode: action.mode }),
-        ].join('\n');
-    }
-    return [
-        CACHE_1H_USAGE_TITLE,
-        '',
-        CACHE_1H_USAGE,
-        '',
-        buildCache1hStatusSummary({ enabled, mode }),
-    ].join('\n');
-}

package/dist/cachekeep-registry.js

@@ -1,124 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { mkdir, readdir, readFile, rename, rm, writeFile, } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-export const CACHE_KEEP_REGISTRY_LEASE_MS = 3 * 60_000;
-function normalizeSession(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return;
-    const record = value;
-    if (typeof record.id !== 'string' ||
-        record.id.length === 0 ||
-        typeof record.cacheExpiresAt !== 'number' ||
-        !Number.isFinite(record.cacheExpiresAt) ||
-        typeof record.nextPrewarmAt !== 'number' ||
-        !Number.isFinite(record.nextPrewarmAt)) {
-        return;
-    }
-    return {
-        id: record.id,
-        cacheExpiresAt: record.cacheExpiresAt,
-        nextPrewarmAt: record.nextPrewarmAt,
-    };
-}
-function normalizeRecord(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return;
-    const record = value;
-    if (record.version !== 1 ||
-        typeof record.updatedAt !== 'number' ||
-        !Number.isFinite(record.updatedAt) ||
-        !Array.isArray(record.sessions)) {
-        return;
-    }
-    return {
-        version: 1,
-        updatedAt: record.updatedAt,
-        sessions: record.sessions.flatMap((session) => {
-            const normalized = normalizeSession(session);
-            return normalized ? [normalized] : [];
-        }),
-    };
-}
-export function getDefaultCacheKeepRegistryDirectory(scope) {
-    return join(tmpdir(), 'opencode-anthropic-auth', 'cachekeep-sessions', scope);
-}
-export class CacheKeepSessionRegistry {
-    options;
-    filePath;
-    writeChain = Promise.resolve();
-    constructor(options) {
-        this.options = options;
-        const instanceId = options.instanceId ?? `${process.pid}-${randomUUID()}`;
-        this.filePath = join(options.directory, `${instanceId}.json`);
-    }
-    publish(sessions) {
-        const snapshot = sessions.map((session) => ({ ...session }));
-        this.writeChain = this.writeChain
-            .catch(() => { })
-            .then(async () => {
-            if (snapshot.length === 0) {
-                await rm(this.filePath, { force: true });
-                return;
-            }
-            await mkdir(this.options.directory, { recursive: true, mode: 0o700 });
-            const tempPath = `${this.filePath}.${randomUUID()}.tmp`;
-            const record = {
-                version: 1,
-                updatedAt: this.options.now?.() ?? Date.now(),
-                sessions: snapshot,
-            };
-            await writeFile(tempPath, `${JSON.stringify(record)}\n`, {
-                mode: 0o600,
-            });
-            await rename(tempPath, this.filePath);
-        });
-        return this.writeChain;
-    }
-    async list(localSessions = []) {
-        await this.writeChain.catch(() => { });
-        const now = this.options.now?.() ?? Date.now();
-        const leaseMs = this.options.leaseMs ?? CACHE_KEEP_REGISTRY_LEASE_MS;
-        let names;
-        try {
-            names = (await readdir(this.options.directory)).filter((name) => name.endsWith('.json'));
-        }
-        catch {
-            names = [];
-        }
-        const records = await Promise.all(names.map(async (name) => {
-            try {
-                const raw = await readFile(join(this.options.directory, name), 'utf8');
-                return normalizeRecord(JSON.parse(raw));
-            }
-            catch {
-                return undefined;
-            }
-        }));
-        const sessions = new Map();
-        for (const record of records) {
-            if (!record ||
-                now - record.updatedAt > leaseMs ||
-                record.updatedAt > now) {
-                continue;
-            }
-            for (const session of record.sessions) {
-                const existing = sessions.get(session.id);
-                if (!existing || session.cacheExpiresAt > existing.cacheExpiresAt) {
-                    sessions.set(session.id, session);
-                }
-            }
-        }
-        for (const session of localSessions) {
-            const existing = sessions.get(session.id);
-            if (!existing || session.cacheExpiresAt > existing.cacheExpiresAt) {
-                sessions.set(session.id, { ...session });
-            }
-        }
-        return [...sessions.values()].sort((left, right) => left.id.localeCompare(right.id));
-    }
-    async dispose() {
-        await this.writeChain.catch(() => { });
-        await rm(this.filePath, { force: true });
-    }
-}