@cortexkit/opencode-claustrum-auth 0.1.0 → 0.1.2

package/dist/index.js

@@ -94,6 +94,26 @@ function transitionActivation(previous, event) {
   }
   return result;
 }
+// ../core/src/balance.ts
+var balanceProbeMs = 5 * 60 * 1000;
+function isBalanceFailure(service, body) {
+  if (service === "deepseek")
+    return true;
+  if (service !== "openrouter")
+    return false;
+  try {
+    const value = JSON.parse(body ?? "");
+    if (typeof value !== "object" || value === null || !("error" in value))
+      return false;
+    const error = value.error;
+    if (typeof error !== "object" || error === null || !("metadata" in error))
+      return false;
+    const metadata = error.metadata;
+    return typeof metadata === "object" && metadata !== null && "limit_source" in metadata && metadata.limit_source === "openrouter_credits" && (!("reason" in metadata) || metadata.reason !== "weight_exceeds_budget");
+  } catch {
+    return false;
+  }
+}
 // ../../node_modules/.bun/@cortexkit+common-auth@0.29.1+e881539e648aba62/node_modules/@cortexkit/common-auth/dist/redaction/index.js
 import { types } from "node:util";
 
@@ -1076,7 +1096,7 @@ function retryExpiry(response, now) {
     if (Number.isFinite(date) && date > now)
       return date;
   }
-  return now + 60000;
+  return now + (response.status === 402 ? balanceProbeMs : 60000);
 }
 function limited(marks, now) {
   const expiries = [...marks.values()].filter((expiry) => expiry > now);
@@ -1109,6 +1129,7 @@ function createFetch(options) {
     const tried = new Set;
     const secrets = [];
     let saw429 = false;
+    let saw402 = false;
     try {
       for (;; ) {
         signal.throwIfAborted();
@@ -1119,6 +1140,7 @@ function createFetch(options) {
           throw new ClaustrumAuthError("no-vault-account");
         }
         tried.add(route);
+        const previousMark = rateLimitMarks.get(route);
         let target = url;
         let method = template.method;
         let bytes = body;
@@ -1168,11 +1190,26 @@ function createFetch(options) {
           }
           target = next;
         }
-        if (response.status !== 429 && response.status !== 401)
+        let balance402 = false;
+        if (response.status === 402) {
+          let text;
+          if (options.entry.service === "openrouter") {
+            try {
+              text = await response.clone().text();
+            } catch {}
+          }
+          balance402 = isBalanceFailure(options.entry.service, text);
+        }
+        if ((response.ok || response.status === 402 && !balance402) && previousMark !== undefined && previousMark <= now() && rateLimitMarks.get(route) === previousMark)
+          rateLimitMarks.delete(route);
+        if (response.status !== 401 && response.status !== 429 && !balance402)
           return await redactResponse(response, secrets);
         signal.throwIfAborted();
-        if (response.status === 429) {
-          saw429 = true;
+        if (response.status === 429 || balance402) {
+          if (response.status === 429)
+            saw429 = true;
+          else
+            saw402 = true;
           rateLimitMarks.set(route, retryExpiry(response, now()));
         }
         const next = orderedRoutes(routing, tried)[0];
@@ -1180,7 +1217,7 @@ function createFetch(options) {
           await response.body?.cancel().catch(() => {});
           continue;
         }
-        if (response.status === 401 && saw429) {
+        if (saw429 && (response.status === 401 || saw402)) {
           await response.body?.cancel().catch(() => {});
           return limited(rateLimitMarks, now());
         }
@@ -7185,6 +7222,13 @@ var supportedProviders = [
     class: "A",
     origins: ["https://api.kimi.com", "https://api.kimi.ai"]
   },
+  {
+    service: "minimax-coding-plan",
+    ids: ["minimax-coding-plan"],
+    hosts: { opencode2: "minimax-coding-plan" },
+    class: "A",
+    origins: ["https://api.minimax.io"]
+  },
   {
     service: "openrouter",
     ids: ["openrouter"],
@@ -7196,6 +7240,13 @@ var supportedProviders = [
     class: "A",
     origins: ["https://openrouter.ai"]
   },
+  {
+    service: "synthetic",
+    ids: ["synthetic"],
+    hosts: { opencode1: "synthetic", opencode2: "synthetic" },
+    class: "A",
+    origins: ["https://api.synthetic.new"]
+  },
   {
     service: "typesafe",
     ids: ["typesafe"],
@@ -7456,12 +7507,21 @@ function configIdentity(configDir) {
   }
 }
 function resolveOpencodeStateDir(env = process.env, home = homedir()) {
+  const override = env.OPENCODE_CLAUSTRUM_AUTH_STATE_DIR?.trim();
+  if (override)
+    return path.resolve(override);
   const configDir = opencodeConfigDir(env, home);
   const identity = configIdentity(configDir);
   const key = identity === configIdentity(path.resolve(home, ".config", "opencode")) ? "opencode" : `opencode-${createHash3("sha256").update(identity).digest("hex").slice(0, 16)}`;
   return path.resolve(env.XDG_STATE_HOME || path.join(home, ".local", "state"), "cortexkit", "claustrum-auth", key);
 }
 async function opencodeStateDir(env = process.env, home = homedir()) {
+  if (env.OPENCODE_CLAUSTRUM_AUTH_STATE_DIR?.trim()) {
+    const stateDir = resolveOpencodeStateDir(env, home);
+    if (!stateDir || !path.isAbsolute(stateDir))
+      throw startupRefusal("opencode-start");
+    return stateDir;
+  }
   const identity = configIdentity(opencodeConfigDir(env, home));
   const stateDir = resolveOpencodeStateDir(env, home);
   const manifest = path.join(stateDir, "config-dir.json");

package/dist/server.js

@@ -94,6 +94,26 @@ function transitionActivation(previous, event) {
   }
   return result;
 }
+// ../core/src/balance.ts
+var balanceProbeMs = 5 * 60 * 1000;
+function isBalanceFailure(service, body) {
+  if (service === "deepseek")
+    return true;
+  if (service !== "openrouter")
+    return false;
+  try {
+    const value = JSON.parse(body ?? "");
+    if (typeof value !== "object" || value === null || !("error" in value))
+      return false;
+    const error = value.error;
+    if (typeof error !== "object" || error === null || !("metadata" in error))
+      return false;
+    const metadata = error.metadata;
+    return typeof metadata === "object" && metadata !== null && "limit_source" in metadata && metadata.limit_source === "openrouter_credits" && (!("reason" in metadata) || metadata.reason !== "weight_exceeds_budget");
+  } catch {
+    return false;
+  }
+}
 // ../../node_modules/.bun/@cortexkit+common-auth@0.29.1+e881539e648aba62/node_modules/@cortexkit/common-auth/dist/redaction/index.js
 import { types } from "node:util";
 
@@ -1110,7 +1130,7 @@ function retryExpiry(response, now) {
     if (Number.isFinite(date) && date > now)
       return date;
   }
-  return now + 60000;
+  return now + (response.status === 402 ? balanceProbeMs : 60000);
 }
 function limited(marks, now) {
   const expiries = [...marks.values()].filter((expiry) => expiry > now);
@@ -1143,6 +1163,7 @@ function createFetch(options) {
     const tried = new Set;
     const secrets = [];
     let saw429 = false;
+    let saw402 = false;
     try {
       for (;; ) {
         signal.throwIfAborted();
@@ -1153,6 +1174,7 @@ function createFetch(options) {
           throw new ClaustrumAuthError("no-vault-account");
         }
         tried.add(route);
+        const previousMark = rateLimitMarks.get(route);
         let target = url;
         let method = template.method;
         let bytes = body;
@@ -1202,11 +1224,26 @@ function createFetch(options) {
           }
           target = next;
         }
-        if (response.status !== 429 && response.status !== 401)
+        let balance402 = false;
+        if (response.status === 402) {
+          let text;
+          if (options.entry.service === "openrouter") {
+            try {
+              text = await response.clone().text();
+            } catch {}
+          }
+          balance402 = isBalanceFailure(options.entry.service, text);
+        }
+        if ((response.ok || response.status === 402 && !balance402) && previousMark !== undefined && previousMark <= now() && rateLimitMarks.get(route) === previousMark)
+          rateLimitMarks.delete(route);
+        if (response.status !== 401 && response.status !== 429 && !balance402)
           return await redactResponse(response, secrets);
         signal.throwIfAborted();
-        if (response.status === 429) {
-          saw429 = true;
+        if (response.status === 429 || balance402) {
+          if (response.status === 429)
+            saw429 = true;
+          else
+            saw402 = true;
           rateLimitMarks.set(route, retryExpiry(response, now()));
         }
         const next = orderedRoutes(routing, tried)[0];
@@ -1214,7 +1251,7 @@ function createFetch(options) {
           await response.body?.cancel().catch(() => {});
           continue;
         }
-        if (response.status === 401 && saw429) {
+        if (saw429 && (response.status === 401 || saw402)) {
           await response.body?.cancel().catch(() => {});
           return limited(rateLimitMarks, now());
         }
@@ -7219,6 +7256,13 @@ var supportedProviders = [
     class: "A",
     origins: ["https://api.kimi.com", "https://api.kimi.ai"]
   },
+  {
+    service: "minimax-coding-plan",
+    ids: ["minimax-coding-plan"],
+    hosts: { opencode2: "minimax-coding-plan" },
+    class: "A",
+    origins: ["https://api.minimax.io"]
+  },
   {
     service: "openrouter",
     ids: ["openrouter"],
@@ -7230,6 +7274,13 @@ var supportedProviders = [
     class: "A",
     origins: ["https://openrouter.ai"]
   },
+  {
+    service: "synthetic",
+    ids: ["synthetic"],
+    hosts: { opencode1: "synthetic", opencode2: "synthetic" },
+    class: "A",
+    origins: ["https://api.synthetic.new"]
+  },
   {
     service: "typesafe",
     ids: ["typesafe"],
@@ -7490,12 +7541,21 @@ function configIdentity(configDir) {
   }
 }
 function resolveOpencodeStateDir(env = process.env, home = homedir()) {
+  const override = env.OPENCODE_CLAUSTRUM_AUTH_STATE_DIR?.trim();
+  if (override)
+    return path.resolve(override);
   const configDir = opencodeConfigDir(env, home);
   const identity = configIdentity(configDir);
   const key = identity === configIdentity(path.resolve(home, ".config", "opencode")) ? "opencode" : `opencode-${createHash3("sha256").update(identity).digest("hex").slice(0, 16)}`;
   return path.resolve(env.XDG_STATE_HOME || path.join(home, ".local", "state"), "cortexkit", "claustrum-auth", key);
 }
 async function opencodeStateDir(env = process.env, home = homedir()) {
+  if (env.OPENCODE_CLAUSTRUM_AUTH_STATE_DIR?.trim()) {
+    const stateDir = resolveOpencodeStateDir(env, home);
+    if (!stateDir || !path.isAbsolute(stateDir))
+      throw startupRefusal("opencode-start");
+    return stateDir;
+  }
   const identity = configIdentity(opencodeConfigDir(env, home));
   const stateDir = resolveOpencodeStateDir(env, home);
   const manifest = path.join(stateDir, "config-dir.json");
@@ -9345,34 +9405,32 @@ function frameCode(event) {
   const code = event.code ?? nested?.code ?? nested?.type;
   return typeof code === "string" ? code : undefined;
 }
-function inspectResponsesFrame(data, attempt) {
+function inspectResponsesFrame(data, attempt, service) {
   let event;
   try {
     event = JSON.parse(data);
   } catch {
-    return;
+    return { outputStarted: true };
   }
   if (!isRecord6(event))
-    return;
+    return { outputStarted: true };
   const type = typeof event.type === "string" ? event.type : event.error != null ? "error" : undefined;
-  if (type === undefined)
+  if (type === "response.created" || type === "response.in_progress" || type?.startsWith("codex."))
     return;
   if (type === "response.completed" || type === "response.incomplete")
-    return { done: true };
+    return { done: true, outputStarted: true };
   if (type === "error" || type === "response.failed") {
     const status = frameStatus(event);
     if (attempt && status !== undefined)
       attempt.frameStatus = status;
     const code = frameCode(event);
-    const limited = status === 429 || code !== undefined && /rate.?limit/iu.test(code);
+    const limited = status !== 402 && (status === 429 || code !== undefined && /rate.?limit/iu.test(code));
     return {
       error: "the provider answered with an error frame",
-      ...limited ? { limit: { reason: "rate-limit", status: status ?? 429 } } : {}
+      ...status === 402 && isBalanceFailure(service, data) ? { limit: { reason: "payment-required", status } } : limited ? { limit: { reason: "rate-limit", status: status ?? 429 } } : {}
     };
   }
-  if (type.startsWith("response.") && type.endsWith(".delta"))
-    return { outputStarted: true };
-  return;
+  return { outputStarted: true };
 }
 var defaultMarkMs = 60000;
 function retryAfterMs(headers, now) {
@@ -9386,7 +9444,7 @@ function retryAfterMs(headers, now) {
   return Number.isFinite(date) && date > now ? date - now : undefined;
 }
 function markUntil(limit, now) {
-  return now + (limit.retryAfterMs ?? defaultMarkMs);
+  return now + (limit.retryAfterMs ?? (limit.status === 402 ? balanceProbeMs : defaultMarkMs));
 }
 async function rebuild(request, url, headers) {
   const body = request.body === null ? undefined : await request.clone().arrayBuffer();
@@ -9413,7 +9471,7 @@ function createVaultAdapter(options) {
     now,
     rateLimitMarks: marks
   }, tried);
-  const inspectEvent = options.entry.handshakeOrigins?.length ? ({ transport, data, attempt }) => transport === "ws" ? inspectResponsesFrame(data, attempt.data) : undefined : undefined;
+  const inspectEvent = options.entry.handshakeOrigins?.length ? ({ transport, data, attempt }) => transport === "ws" ? inspectResponsesFrame(data, attempt.data, options.entry.service) : undefined : undefined;
   const noAccount = async () => {
     let mode;
     try {
@@ -9529,12 +9587,22 @@ function createVaultAdapter(options) {
         return;
       return redactResponse(response, [secret]);
     },
-    limitFromResponse({ status, headers }) {
-      if (status !== 429)
+    async limitFromResponse({ status, headers, body }) {
+      if (status !== 429 && status !== 402)
         return;
+      if (status === 402) {
+        let text;
+        if (options.entry.service === "openrouter") {
+          try {
+            text = await body();
+          } catch {}
+        }
+        if (!isBalanceFailure(options.entry.service, text))
+          return;
+      }
       const wait = retryAfterMs(headers, now());
       return {
-        reason: "rate-limit",
+        reason: status === 402 ? "payment-required" : "rate-limit",
         status,
         ...wait === undefined ? {} : { retryAfterMs: wait }
       };

package/dist/setup-bin.js

@@ -7,6 +7,8 @@ import { pathToFileURL } from "node:url";
 // src/setup.ts
 import { homedir as homedir2 } from "node:os";
 import path2 from "node:path";
+// ../core/src/balance.ts
+var balanceProbeMs = 5 * 60 * 1000;
 // ../../node_modules/.bun/@cortexkit+common-auth@0.29.1+e881539e648aba62/node_modules/@cortexkit/common-auth/dist/logger/redact.js
 var SECRET_KEY_EXACT = /^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i;
 var TOKEN_VALUE = /\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g;
@@ -5787,6 +5789,13 @@ var supportedProviders = [
     class: "A",
     origins: ["https://api.kimi.com", "https://api.kimi.ai"]
   },
+  {
+    service: "minimax-coding-plan",
+    ids: ["minimax-coding-plan"],
+    hosts: { opencode2: "minimax-coding-plan" },
+    class: "A",
+    origins: ["https://api.minimax.io"]
+  },
   {
     service: "openrouter",
     ids: ["openrouter"],
@@ -5798,6 +5807,13 @@ var supportedProviders = [
     class: "A",
     origins: ["https://openrouter.ai"]
   },
+  {
+    service: "synthetic",
+    ids: ["synthetic"],
+    hosts: { opencode1: "synthetic", opencode2: "synthetic" },
+    class: "A",
+    origins: ["https://api.synthetic.new"]
+  },
   {
     service: "typesafe",
     ids: ["typesafe"],
@@ -6014,7 +6030,7 @@ import {
 // ../pi/package.json
 var package_default = {
   name: "@cortexkit/pi-claustrum-auth",
-  version: "0.1.0",
+  version: "0.1.2",
   description: "Claustrum vault credentials for Pi",
   type: "module",
   license: "MIT",
@@ -6063,7 +6079,7 @@ var package_default = {
 // package.json
 var package_default2 = {
   name: "@cortexkit/opencode-claustrum-auth",
-  version: "0.1.0",
+  version: "0.1.2",
   description: "Claustrum vault credentials for OpenCode 1 and OpenCode 2",
   type: "module",
   license: "MIT",
@@ -6143,12 +6159,21 @@ function configIdentity(configDir) {
   }
 }
 function resolveOpencodeStateDir(env = process.env, home = homedir()) {
+  const override = env.OPENCODE_CLAUSTRUM_AUTH_STATE_DIR?.trim();
+  if (override)
+    return path.resolve(override);
   const configDir = opencodeConfigDir(env, home);
   const identity = configIdentity(configDir);
   const key = identity === configIdentity(path.resolve(home, ".config", "opencode")) ? "opencode" : `opencode-${createHash3("sha256").update(identity).digest("hex").slice(0, 16)}`;
   return path.resolve(env.XDG_STATE_HOME || path.join(home, ".local", "state"), "cortexkit", "claustrum-auth", key);
 }
 async function opencodeStateDir(env = process.env, home = homedir()) {
+  if (env.OPENCODE_CLAUSTRUM_AUTH_STATE_DIR?.trim()) {
+    const stateDir = resolveOpencodeStateDir(env, home);
+    if (!stateDir || !path.isAbsolute(stateDir))
+      throw startupRefusal("opencode-start");
+    return stateDir;
+  }
   const identity = configIdentity(opencodeConfigDir(env, home));
   const stateDir = resolveOpencodeStateDir(env, home);
   const manifest = path.join(stateDir, "config-dir.json");
@@ -6234,8 +6259,11 @@ async function runClaustrumSetup(rawArgv = [], io = {}, options = { table: suppo
     beforeSignIn: async (host, context) => {
       if (context.mode !== "claustrum")
         throw new Error(vaultOnlyMessage);
-      if (host === "opencode")
+      if (host === "opencode") {
         await opencodeStateDir(env, home);
+        if (env.OPENCODE_CLAUSTRUM_AUTH_STATE_DIR?.trim() && argv.includes("--enroll-only"))
+          print(`State directory: ${states.opencode}`);
+      }
     },
     signInLocal: async () => {
       throw new Error(vaultOnlyMessage);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/opencode-claustrum-auth",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Claustrum vault credentials for OpenCode 1 and OpenCode 2",
   "type": "module",
   "license": "MIT",