@hilbras/omnihilbras 1.71.0 → 1.75.0

package/dist/adapters/claude-code.d.ts

@@ -0,0 +1,165 @@
+import { type HttpTransport } from '../transport.js';
+import type { ChatChunk, ChatRequest, ChatResponse, Model, ProviderAdapter, ProviderCapabilities, ProviderCredential, ProviderHealth, ProviderRequestContext } from '../types.js';
+/**
+ * Claude Code — an Anthropic subscription reached by OAuth, not an Anthropic API key.
+ *
+ * ## Why this is a separate provider from `anthropic`
+ *
+ * `api.anthropic.com` with an `x-api-key` is metered per token and sold separately from a Claude
+ * subscription. A Claude Code credential is an OAuth grant for `user:inference`, carried as a bearer
+ * token. Both reach the same `/v1/messages` endpoint, but they are different accounts with different
+ * billing, so they get different provider ids and different cards — the same reasoning as `kimi` versus
+ * `kimi-code`.
+ *
+ * ## What was verified, and what was taken on trust
+ *
+ * ```
+ * POST https://api.anthropic.com/v1/oauth/token   -> 400 {"type":"error","error":{"type":"invalid_request_error","message":"Unsupported grant_type: None"}}
+ * GET  https://claude.ai/oauth/authorize           -> 403 "Just a moment..." (Cloudflare interstitial)
+ * POST https://api.anthropic.com/v1/messages       -> 401 x-api-key header is required
+ * ```
+ *
+ * The 400 and the 401 are the useful ones: a real service answering with a *typed refusal* rather than
+ * a 404. The `authorize` endpoint returning a Cloudflare challenge is the reason this flow **must** be a
+ * browser redirect — there is no API to call for an authorization code, and a server-side fetch of that
+ * URL would receive an HTML challenge page rather than a code.
+ *
+ * The client id is Anthropic's own published value, copied rather than registered. A wrong one fails at
+ * the first exchange with `invalid_grant`, which is visible and safe.
+ *
+ * ## The risk, stated once and not repeated as a warning on every line
+ *
+ * Anthropic's consumer terms do not permit using a Claude subscription for third-party API access. 9router
+ * ships this provider with `deprecated: true` and a `RISK_NOTICE`. The operator decides; this file's job is
+ * to be honest about what the credential is rather than to editorialise on every line of it.
+ */
+export declare const CLAUDE_CODE: {
+    /** The API host, which serves both the token exchange and `/v1/messages`. */
+    readonly server: "https://api.anthropic.com";
+    /** The authorization host, which is a different origin and answers through a browser challenge. */
+    readonly authorizeOrigin: "https://claude.ai";
+    /**
+     * Anthropic's public Claude Code client id.
+     *
+     * Copied from Anthropic's own published integrations rather than registered here, because the token
+     * endpoint is bound to it and an unregistered id is refused with `invalid_grant`.
+     */
+    readonly clientId: "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+    readonly authorizePath: "/oauth/authorize";
+    readonly tokenPath: "/v1/oauth/token";
+    readonly messagesPath: "/v1/messages";
+    /** Scoped to inference and profile only — **not** `org:create_api_key`, which would mint API keys. */
+    readonly scopes: readonly ["org:create_api_key", "user:profile", "user:inference"];
+    readonly grantType: "authorization_code";
+    readonly refreshGrantType: "refresh_token";
+    readonly apiVersion: "2023-06-01";
+};
+export declare const claudeCodeProviderId = "claude-code";
+/**
+ * The callback path a sign-in returns to.
+ *
+ * **Declared here but owned by the gateway.** `apps/gateway/src/oauth.ts` re-exports its own copy
+ * under the same name and is the authority the route table and the cross-site exemption both read.
+ * This value is the one the adapter's own docs and `exchangeClaudeCodeCode` describe, and the two
+ * must agree or a redirect lands on a path nothing serves. Cline's callback is declared the same
+ * way for the same reason: a path is a gateway decision, and a provider module must not be a second
+ * place that decides one.
+ */
+export declare const claudeCodeCallbackPath = "/v1/oauth/claude-code/callback";
+export type ClaudeCodeAdapterOptions = {
+    transport?: HttpTransport;
+    timeoutMs?: number;
+    onTokensRefreshed?: (credential: ProviderCredential) => void | Promise<void>;
+    now?: () => number;
+};
+export declare class ClaudeCodeAdapter implements ProviderAdapter {
+    readonly id = "claude-code";
+    readonly name = "Claude Code";
+    readonly capabilities: ProviderCapabilities;
+    private readonly baseUrl;
+    private readonly transport;
+    private readonly onTokensRefreshed?;
+    private readonly now;
+    private readonly headers;
+    /** Renewed credentials keyed by the access token they replaced. */
+    private readonly renewed;
+    constructor(options?: ClaudeCodeAdapterOptions);
+    /**
+     * The catalog, from the models endpoint rather than a list written here.
+     *
+     * **A hardcoded model list is a claim that goes stale silently**, and this provider has an obvious
+     * temptation: 9router names five ids, one of which (`claude-fable-5`) could not be confirmed against the
+     * API. Asking Anthropic is the only answer that is current when it is read.
+     */
+    listModels(context?: ProviderRequestContext): Promise<Model[]>;
+    chat(request: ChatRequest, context?: ProviderRequestContext): Promise<ChatResponse>;
+    streamChat(request: ChatRequest, context?: ProviderRequestContext): AsyncIterable<ChatChunk>;
+    /**
+     * Reads `/v1/models`, which is free and never bills.
+     *
+     * A health check that spends money would be a real cost on every sweep — and a check that launches a
+     * browser was a defect already fixed in the credential-lifecycle work. A free authenticated read is both.
+     */
+    healthCheck(context?: ProviderRequestContext): Promise<ProviderHealth>;
+    /** The token, renewed without asking the user to sign in again. */
+    private credential;
+    private url;
+    /**
+     * An OAuth grant goes in `Authorization: Bearer`, which is the header Anthropic reads it from.
+     *
+     * `x-api-key` is accepted too, so the same card works for someone who obtained a key by another route —
+     * but the OAuth path is the one this adapter is for, and it is the one the credential decides.
+     */
+    private requestHeaders;
+    private toRequestBody;
+    private toChatResponse;
+}
+/**
+ * The URL the user opens, with a PKCE challenge.
+ *
+ * The verifier is supplied rather than minted here so the caller can keep it: a PKCE flow whose verifier
+ * does not survive until the callback cannot exchange its own code. `generatePkcePair` produces one.
+ *
+ * `code=true` is what tells Claude Code to return the code on the callback rather than running a CLI — it
+ * is a request for a redirect we can read, and omitting it produces a page with no code on it.
+ */
+export declare function claudeCodeAuthorizeUrl(input: {
+    redirectUri: string;
+    state: string;
+    codeChallenge: string;
+}): string;
+/**
+ * Exchanges an authorization code for tokens.
+ *
+ * Anthropic's callback puts the code in the query and repeats the state after a `#`, and 9router's client
+ * splits on that separator before exchanging. Both halves are handled here, because the alternative is an
+ * exchange rejected with `invalid_grant` for a code that was correct.
+ *
+ * The 4xx is read for `error_description` — a wrong `state` and a wrong `code_verifier` both answer 400 and
+ * mean different things to the user — so the transport flag is used rather than a generic refusal.
+ */
+export declare function exchangeClaudeCodeCode(input: {
+    code: string;
+    state?: string;
+    codeVerifier: string;
+    redirectUri: string;
+    transport?: HttpTransport;
+    signal?: AbortSignal;
+}): Promise<ProviderCredential>;
+/**
+ * Splits `code#state`, which is what Claude Code's callback answers with.
+ *
+ * The `#` half is the state Anthropic echoed, and it is checked against the one we sent. A crossed state
+ * means the code belongs to a different sign-in, so it is refused rather than exchanged.
+ */
+export declare function splitCallbackFragment(raw: string, expectedState?: string): {
+    code: string;
+    state?: string;
+};
+/**
+ * Whether the credential is definitely expired. Three answers, because the third is the load-bearing one:
+ * `true` is definitely expired, `false` is definitely not, and `undefined` means *this adapter cannot say*
+ * — so the gateway asks the provider rather than ejecting a working connection.
+ */
+export declare function claudeCodeCredentialExpired(credential: ProviderCredential | undefined, now: number): boolean | undefined;
+//# sourceMappingURL=claude-code.d.ts.map

package/dist/adapters/claude-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code.d.ts","sourceRoot":"","sources":["../../src/adapters/claude-code.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEzE,OAAO,KAAK,EAAE,SAAS,EAAe,WAAW,EAAE,YAAY,EAAgB,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,cAAc,EAAE,sBAAsB,EAAwC,MAAM,aAAa,CAAC;AAEnP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,eAAO,MAAM,WAAW;IACtB,6EAA6E;;IAE7E,mGAAmG;;IAEnG;;;;;OAKG;;;;;IAKH,sGAAsG;;;;;CAK9F,CAAC;AAEX,eAAO,MAAM,oBAAoB,gBAAgB,CAAC;AAElD;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,mCAAmC,CAAC;AAEvE,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AA4CF,qBAAa,iBAAkB,YAAW,eAAe;IACvD,QAAQ,CAAC,EAAE,iBAAwB;IACnC,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAiD;IAE5F,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgB;IAC1C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAA2D;IAC9F,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;gBAErD,OAAO,GAAE,wBAA6B;IAuBlD;;;;;;OAMG;IACG,UAAU,CAAC,OAAO,GAAE,sBAA2B,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAclE,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,GAAE,sBAA2B,GAAG,OAAO,CAAC,YAAY,CAAC;IAatF,UAAU,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,GAAE,sBAA2B,GAAG,aAAa,CAAC,SAAS,CAAC;IAwEvG;;;;;OAKG;IACG,WAAW,CAAC,OAAO,GAAE,sBAA2B,GAAG,OAAO,CAAC,cAAc,CAAC;IAgBhF,mEAAmE;YACrD,UAAU;IA8BxB,OAAO,CAAC,GAAG;IAIX;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAkBtB,OAAO,CAAC,aAAa;IAkBrB,OAAO,CAAC,cAAc;CA6BvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAWnH;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA+B9B;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAY3G;AAYD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,kBAAkB,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAQxH"}