@indigoai-us/hq-cli 5.345.92 → 5.345.93

package/dist/lib/capacity/collectors/claude-oauth.js

@@ -0,0 +1,1211 @@
+/**
+ * Claude OAuth usage collector (US-005).
+ *
+ * Reads the Claude Code credential read-only (macOS Keychain item
+ * `Claude Code-credentials`, plus `Claude Code-credentials-<hash>` seats,
+ * or the credentials JSON under ~/.claude/ on Linux). GETs
+ * https://api.anthropic.com/api/oauth/usage with the oauth-2025-04-20 beta
+ * header. This module does not refresh the token, write the Keychain or
+ * ~/.claude, call an OAuth token endpoint, or invoke the claude CLI except
+ * `claude --version` when the caller does not pass cliVersion.
+ *
+ * The legacy shape (seven_day_opus populated, no limits[]) is drift.
+ * observedAt is the response time. One collect appends every account's
+ * readings and failures in one rebuild.
+ */
+import { execFile, spawnSync } from "node:child_process";
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { DIR_MODE, FILE_MODE, appendReadings, capacityRoot, EXPIRED_REASON, readCollectorMark, } from "../ledger.js";
+import { hashClaudeAccountId } from "./claude-statusline.js";
+export const CLAUDE_OAUTH_PARSER_VERSION = "claude-oauth-usage.1";
+export const CLAUDE_OAUTH_PROVIDER = "claude";
+export const CLAUDE_OAUTH_SOURCE = "oauth-usage";
+export const CLAUDE_OAUTH_URL = "https://api.anthropic.com/api/oauth/usage";
+export const CLAUDE_OAUTH_PROFILE_URL = "https://api.anthropic.com/api/oauth/profile";
+export const CLAUDE_OAUTH_BETA = "oauth-2025-04-20";
+export const CLAUDE_ORG_CACHE_MS = 24 * 60 * 60 * 1000;
+export const CLAUDE_ORG_CACHE_FILE = "claude-org-cache.json";
+export const CLAUDE_OAUTH_POLL_MS = 5 * 60 * 1000;
+/** Freshness is shorter than the 5 minute tick so the next tick is not skipped. */
+export const CLAUDE_OAUTH_FRESH_MS = CLAUDE_OAUTH_POLL_MS - 15_000;
+export const CLAUDE_OAUTH_KEYCHAIN_BACKOFF_MS = 60 * 60 * 1000;
+export const CLAUDE_OAUTH_FETCH_TIMEOUT_MS = 10_000;
+export const CLAUDE_OAUTH_SECURITY_TIMEOUT_MS = 5_000;
+export const CLAUDE_OAUTH_POLL_FILE = "claude-oauth-last-call.json";
+export const CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials";
+const SESSION_MINUTES = 5 * 60;
+const WEEKLY_MINUTES = 7 * 24 * 60;
+const ACCOUNT_ID_KEYS = [
+    "organizationUuid",
+    "organizationId",
+    "organization_id",
+    "orgUuid",
+    "orgId",
+    "accountUuid",
+    "accountId",
+    "account_id",
+    "uuid",
+];
+export function claudeOAuthPollPath(root) {
+    return path.join(root, CLAUDE_OAUTH_POLL_FILE);
+}
+export function defaultClaudeCredentialsPath(home = os.homedir()) {
+    return path.join(home, ".claude", ".credentials.json");
+}
+/**
+ * Claude Code's keychain service for a config dir.
+ * The default home uses `Claude Code-credentials`. Any other resolved
+ * path uses that name plus the first 8 hex chars of SHA-256(utf8 path).
+ */
+export function claudeKeychainServiceName(configDir, defaultConfigDir = path.join(os.homedir(), ".claude")) {
+    const resolved = path.resolve(configDir);
+    if (resolved === path.resolve(defaultConfigDir))
+        return CLAUDE_KEYCHAIN_SERVICE;
+    const suffix = crypto.createHash("sha256").update(resolved, "utf8").digest("hex").slice(0, 8);
+    return `${CLAUDE_KEYCHAIN_SERVICE}-${suffix}`;
+}
+export function parseClaudeCliVersion(text) {
+    const match = /\b(\d+\.\d+\.\d+)\b/.exec(text);
+    return match?.[1] ?? null;
+}
+/** Map a usage JSON body. Does not read credentials or call the network. */
+export function mapClaudeOAuthUsage(body, options) {
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+        return { readings: [], failures: [failure(options, "claude oauth usage field drift: limits")] };
+    }
+    const root = body;
+    if (!Array.isArray(root.limits)) {
+        return { readings: [], failures: [failure(options, "claude oauth usage field drift: limits")] };
+    }
+    const readings = [];
+    const failures = [];
+    const indexed = [];
+    for (let index = 0; index < root.limits.length; index += 1) {
+        const mapped = mapLimit(root.limits[index], options);
+        if ("error" in mapped) {
+            failures.push(failure(options, mapped.error));
+            continue;
+        }
+        readings.push(mapped.reading);
+        indexed.push({ index, reading: mapped.reading });
+    }
+    attachShares(root.weekly_scoped_shares, indexed, failures, options);
+    const extra = mapExtraUsage(root.extra_usage, options);
+    if (extra) {
+        if ("error" in extra)
+            failures.push(failure(options, extra.error));
+        else
+            readings.push(extra.reading);
+    }
+    const spend = mapSpend(root.spend, options);
+    if (spend) {
+        if ("error" in spend)
+            failures.push(failure(options, spend.error));
+        else
+            readings.push(spend.reading);
+    }
+    return { readings, failures };
+}
+export async function collectClaudeOAuth(options = {}) {
+    const ledger = ledgerOptions(options);
+    const root = ledger.root ?? capacityRoot(ledger.env, ledger.home);
+    const scoped = { ...ledger, root };
+    const clock = options.now ?? ledger.now ?? (() => new Date());
+    const empty = (extra = {}) => ({
+        readings: [],
+        failures: [],
+        view: null,
+        keychain: "no-prompt",
+        httpStatus: null,
+        accountIds: [],
+        ...extra,
+    });
+    if (!readCollectorMark(scoped)?.enabled && !options.allowDisabled) {
+        return empty({ skipped: "disabled" });
+    }
+    const cliVersion = options.cliVersion ?? readInstalledClaudeVersion(options.readVersion);
+    if (!options.credentialsPath && !options.readCredentials) {
+        const accounts = options.accounts ?? [{
+                label: "default",
+                home: path.join(options.ledger?.home ?? os.homedir(), ".claude"),
+            }];
+        return collectEnumeratedClaude({ ...options, accounts }, scoped, root, clock, cliVersion);
+    }
+    const nowMs = clock().getTime();
+    const loaded = loadAccounts(options, nowMs);
+    const keychainFailed = loaded.keychain === "timeout"
+        || loaded.keychain === "prompt"
+        || (loaded.keychain === "error" && loaded.accounts.length === 0 && loaded.store === "keychain");
+    if (keychainFailed) {
+        const observedAt = clock().toISOString();
+        const accountId = hashClaudeAccountId("claude-oauth-keychain");
+        const failures = [failure({
+                observedAt,
+                cliVersion,
+                accountId,
+                planType: null,
+            }, "unavailable: keychain")];
+        writeKeychainBlock(root, new Date(nowMs + CLAUDE_OAUTH_KEYCHAIN_BACKOFF_MS).toISOString());
+        const view = appendReadings([], failures, null, scoped);
+        return {
+            readings: [],
+            failures,
+            view,
+            keychain: loaded.keychain === "error" ? "error" : loaded.keychain,
+            httpStatus: null,
+            accountIds: [accountId],
+        };
+    }
+    if (loaded.accounts.length === 0 && loaded.failures.length === 0 && loaded.keychain === "error") {
+        const observedAt = clock().toISOString();
+        const accountId = hashClaudeAccountId(loaded.seat || "claude-oauth-credentials");
+        const failures = [failure({
+                observedAt,
+                cliVersion,
+                accountId,
+                planType: null,
+            }, "unavailable: keychain")];
+        const view = appendReadings([], failures, null, scoped);
+        return { readings: [], failures, view, keychain: "error", httpStatus: null, accountIds: [accountId] };
+    }
+    const endpoint = options.endpoint ?? CLAUDE_OAUTH_URL;
+    const fetchImpl = options.fetchImpl ?? defaultClaudeFetch;
+    const readings = [];
+    const failures = [...loaded.failures];
+    const accountIds = [];
+    let httpStatus = null;
+    let fetched = false;
+    for (const account of loaded.accounts) {
+        accountIds.push(account.accountId);
+        const observedAt = clock().toISOString();
+        const mapContext = {
+            observedAt,
+            cliVersion,
+            accountId: account.accountId,
+            planType: account.planType,
+        };
+        if (pollIsFresh(root, account.accountId, nowMs))
+            continue;
+        writeAccountPoll(root, account.accountId, new Date(nowMs).toISOString());
+        if (account.blocked) {
+            failures.push(failure(mapContext, credentialBlockReason(account.blocked)));
+            continue;
+        }
+        const token = account.token;
+        if (!token)
+            continue;
+        fetched = true;
+        let status;
+        let text;
+        let retryAfter;
+        try {
+            const response = await fetchImpl(endpoint, usageInit(token));
+            status = response.status;
+            retryAfter = response.headers?.get("retry-after") ?? null;
+            text = status === 200 ? await response.text() : "";
+        }
+        catch {
+            failures.push(failure(mapContext, "claude oauth usage request failed"));
+            continue;
+        }
+        if (httpStatus === null)
+            httpStatus = status;
+        if (status === 401 || status === 403) {
+            failures.push(failure(mapContext, "signed out: auth rejected"));
+            continue;
+        }
+        if (status === 429 || status >= 500) {
+            failures.push(failure(mapContext, `unavailable: http ${status}`));
+            noteHttpBackoff(root, account.accountId, nowMs, retryAfter);
+            continue;
+        }
+        if (status !== 200) {
+            failures.push(failure(mapContext, `unavailable: http ${status}`));
+            continue;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            failures.push(failure(mapContext, "claude oauth usage response is not JSON"));
+            continue;
+        }
+        const mapped = mapClaudeOAuthUsage(parsed, mapContext);
+        readings.push(...mapped.readings);
+        failures.push(...mapped.failures);
+    }
+    if (!fetched && failures.length === 0) {
+        return empty({
+            skipped: "rate-limit",
+            keychain: loaded.keychain,
+            accountIds,
+        });
+    }
+    if (readings.length === 0 && failures.length === 0) {
+        return {
+            readings,
+            failures,
+            view: null,
+            keychain: loaded.keychain,
+            httpStatus,
+            accountIds,
+        };
+    }
+    const view = appendReadings(readings, failures, null, scoped);
+    return { readings, failures, view, keychain: loaded.keychain, httpStatus, accountIds };
+}
+async function collectEnumeratedClaude(options, scoped, root, clock, cliVersion) {
+    const nowMs = clock().getTime();
+    const groups = groupHomes(options.accounts ?? []);
+    if (groups.length > 0 && groups.every((group) => homeKeychainBlocked(root, group.home, nowMs))) {
+        return {
+            readings: [],
+            failures: [],
+            view: null,
+            skipped: "keychain-backoff",
+            keychain: "timeout",
+            httpStatus: null,
+            accountIds: [],
+        };
+    }
+    const loaded = [];
+    for (const group of groups)
+        loaded.push(await readEnumeratedHome(group, options, nowMs, root));
+    const merged = mergeEnumerated(loaded);
+    const endpoint = options.endpoint ?? CLAUDE_OAUTH_URL;
+    const fetchImpl = options.fetchImpl ?? defaultClaudeFetch;
+    const readings = [];
+    const failures = [];
+    const accountIds = [];
+    let httpStatus = null;
+    let fetched = false;
+    let keychain = "no-prompt";
+    for (const account of merged) {
+        accountIds.push(account.accountId);
+        if (account.keychain === "prompt" || account.keychain === "timeout")
+            keychain = account.keychain;
+        else if (account.keychain === "error" && keychain === "no-prompt")
+            keychain = "error";
+        const label = primaryLabel(account.labels);
+        const home = account.homes[0];
+        const observedAt = clock().toISOString();
+        const mapContext = {
+            observedAt,
+            cliVersion,
+            accountId: account.accountId,
+            planType: account.planType,
+            accountLabel: label,
+            accountLabels: account.labels,
+            accountHome: home,
+            organization: null,
+        };
+        if (account.blocked) {
+            failures.push(failure(mapContext, account.blocked));
+            continue;
+        }
+        if (pollIsFresh(root, account.accountId, nowMs))
+            continue;
+        writeAccountPoll(root, account.accountId, new Date(nowMs).toISOString());
+        const token = account.token;
+        if (!token)
+            continue;
+        mapContext.organization = await resolveOrganization(root, account.accountId, token, fetchImpl, nowMs);
+        fetched = true;
+        let status;
+        let text;
+        let retryAfter;
+        try {
+            const response = await fetchImpl(endpoint, usageInit(token));
+            status = response.status;
+            retryAfter = response.headers?.get("retry-after") ?? null;
+            text = status === 200 ? await response.text() : "";
+        }
+        catch {
+            failures.push(failure(mapContext, "claude oauth usage request failed"));
+            continue;
+        }
+        if (httpStatus === null)
+            httpStatus = status;
+        if (status === 401 || status === 403) {
+            failures.push(failure(mapContext, "signed out: auth rejected"));
+            continue;
+        }
+        if (status === 429 || status >= 500) {
+            failures.push(failure(mapContext, `unavailable: http ${status}`));
+            noteHttpBackoff(root, account.accountId, nowMs, retryAfter);
+            continue;
+        }
+        if (status !== 200) {
+            failures.push(failure(mapContext, `unavailable: http ${status}`));
+            continue;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            failures.push(failure(mapContext, "claude oauth usage response is not JSON"));
+            continue;
+        }
+        const mapped = mapClaudeOAuthUsage(parsed, mapContext);
+        readings.push(...mapped.readings);
+        failures.push(...mapped.failures);
+    }
+    if (!fetched && failures.length === 0) {
+        return {
+            readings: [],
+            failures: [],
+            view: null,
+            skipped: "rate-limit",
+            keychain,
+            httpStatus: null,
+            accountIds,
+        };
+    }
+    if (readings.length === 0 && failures.length === 0) {
+        return { readings, failures, view: null, keychain, httpStatus, accountIds };
+    }
+    const view = appendReadings(readings, failures, null, scoped);
+    return { readings, failures, view, keychain, httpStatus, accountIds };
+}
+function groupHomes(accounts) {
+    const groups = new Map();
+    for (const account of accounts) {
+        const key = path.resolve(account.home);
+        const group = groups.get(key) ?? { home: account.home, labels: [] };
+        if (!group.labels.includes(account.label))
+            group.labels.push(account.label);
+        groups.set(key, group);
+    }
+    return [...groups.values()];
+}
+function primaryLabel(labels) {
+    return labels.find((label) => label !== "default") ?? labels[0] ?? "default";
+}
+async function readEnumeratedHome(group, options, nowMs, root) {
+    const labels = [...group.labels];
+    const platform = options.platform ?? process.platform;
+    const seat = platform === "darwin"
+        ? `keychain:${claudeKeychainServiceName(group.home)}`
+        : `file:${path.resolve(group.home)}`;
+    const accountId = hashClaudeAccountId(seat);
+    if (homeKeychainBlocked(root, group.home, nowMs)) {
+        return {
+            accountId,
+            labels,
+            homes: [group.home],
+            token: null,
+            planType: null,
+            blocked: "unavailable: keychain",
+            keychain: "timeout",
+        };
+    }
+    if (pollIsFresh(root, accountId, nowMs)) {
+        return {
+            accountId,
+            labels,
+            homes: [group.home],
+            token: null,
+            planType: null,
+            blocked: null,
+            keychain: "no-prompt",
+        };
+    }
+    if (platform === "darwin")
+        return readEnumeratedKeychain(group, labels, options, nowMs, root);
+    return readEnumeratedFile(group, labels, nowMs);
+}
+function readEnumeratedFile(group, labels, nowMs) {
+    const file = path.join(group.home, ".credentials.json");
+    let text;
+    try {
+        text = fs.readFileSync(file, "utf8");
+    }
+    catch {
+        return blockedCredential(group, labels, "signed out: credential missing", "error");
+    }
+    const parsed = parseCredentialDocument(text, `file:${path.resolve(group.home)}`, nowMs, "underlying");
+    if (!parsed || parsed.length === 0) {
+        return blockedCredential(group, labels, "signed out: credential unreadable", "error");
+    }
+    return outcomeCredential(group, labels, parsed[0], "no-prompt");
+}
+async function readEnumeratedKeychain(group, labels, options, nowMs, root) {
+    const service = claudeKeychainServiceName(group.home);
+    const username = os.userInfo().username;
+    let read = await callSecurity(options, ["find-generic-password", "-s", service, "-a", username, "-w"], CLAUDE_OAUTH_SECURITY_TIMEOUT_MS);
+    let status = classifySecurity(read);
+    if (status === "prompt" || status === "timeout") {
+        noteKeychainBackoff(root, group.home, nowMs);
+        return blockedCredential(group, labels, "unavailable: keychain", status);
+    }
+    if (isKeychainMiss(read)) {
+        read = await callSecurity(options, ["find-generic-password", "-s", service, "-w"], CLAUDE_OAUTH_SECURITY_TIMEOUT_MS);
+        status = classifySecurity(read);
+        if (status === "prompt" || status === "timeout") {
+            noteKeychainBackoff(root, group.home, nowMs);
+            return blockedCredential(group, labels, "unavailable: keychain", status);
+        }
+    }
+    if (status !== "no-prompt") {
+        const reason = isKeychainMiss(read) ? "signed out: credential missing" : "signed out: credential unreadable";
+        return blockedCredential(group, labels, reason, "error");
+    }
+    const parsed = parseCredentialDocument(read.stdout.replace(/\n$/, ""), `keychain:${service}`, nowMs, "underlying");
+    if (!parsed || parsed.length === 0) {
+        return blockedCredential(group, labels, "signed out: credential unreadable", "error");
+    }
+    return outcomeCredential(group, labels, parsed[0], "no-prompt");
+}
+function blockedCredential(group, labels, reason, keychain) {
+    return {
+        accountId: hashClaudeAccountId(`missing:${path.resolve(group.home)}`),
+        labels,
+        homes: [group.home],
+        token: null,
+        planType: null,
+        blocked: reason,
+        keychain,
+    };
+}
+function outcomeCredential(group, labels, outcome, keychain) {
+    if (!outcome)
+        return blockedCredential(group, labels, "signed out: credential unreadable", "error");
+    const blocked = outcome.blocked ? credentialBlockReason(outcome.blocked) : null;
+    return {
+        accountId: outcome.accountId,
+        labels,
+        homes: [group.home],
+        token: outcome.token ?? null,
+        planType: outcome.planType,
+        blocked,
+        keychain,
+    };
+}
+function credentialBlockReason(blocked) {
+    if (blocked.startsWith("signed out:") || blocked.startsWith("expired:"))
+        return blocked;
+    if (blocked === "unavailable: token_expired")
+        return EXPIRED_REASON;
+    if (blocked === "unavailable: missing_scope")
+        return "signed out: missing profile scope";
+    if (blocked === "unavailable: auth")
+        return "signed out: auth rejected";
+    return `signed out: ${blocked}`;
+}
+function mergeEnumerated(loaded) {
+    const merged = [];
+    for (const account of loaded) {
+        const existing = merged.find((row) => row.accountId === account.accountId);
+        if (!existing) {
+            merged.push({ ...account, labels: [...account.labels], homes: [...account.homes] });
+            continue;
+        }
+        for (const label of account.labels) {
+            if (!existing.labels.includes(label))
+                existing.labels.push(label);
+        }
+        for (const home of account.homes) {
+            if (!existing.homes.includes(home))
+                existing.homes.push(home);
+        }
+        if (!existing.token && account.token) {
+            existing.token = account.token;
+            existing.blocked = account.blocked;
+            existing.planType = account.planType;
+        }
+    }
+    return merged;
+}
+function isKeychainMiss(result) {
+    if (result.status === 44)
+        return true;
+    return /could not be found in the keychain/i.test(result.stderr);
+}
+/** sha256 hex, first 16 characters. The only account id the cache may store. */
+const IDENTITY_KEY_RE = /^[0-9a-f]{16}$/;
+/**
+ * Ledger account id → hashed profile account id. Rows with no captured
+ * identity are omitted. The raw uuid is never returned.
+ */
+export function claudeIdentityKeys(root) {
+    const keys = new Map();
+    for (const [accountId, entry] of Object.entries(readOrgCache(root).accounts)) {
+        if (entry.identityKey)
+            keys.set(accountId, entry.identityKey);
+    }
+    return keys;
+}
+async function resolveOrganization(root, accountId, token, fetchImpl, nowMs) {
+    const fingerprint = crypto.createHash("sha256").update(token, "utf8").digest("hex").slice(0, 16);
+    const cache = readOrgCache(root);
+    const cached = cache.accounts[accountId];
+    if (cached && cached.tokenFingerprint === fingerprint && orgCacheFresh(cached, nowMs))
+        return cached.organization;
+    let organization = cached?.organization ?? null;
+    try {
+        const response = await fetchImpl(CLAUDE_OAUTH_PROFILE_URL, usageInit(token));
+        if (response.status === 200) {
+            const text = await response.text();
+            const body = JSON.parse(text);
+            organization = organizationName(body);
+            cache.accounts[accountId] = {
+                organization,
+                fetchedAt: new Date(nowMs).toISOString(),
+                identityKey: accountIdentityKey(body),
+                identityCaptured: true,
+                tokenFingerprint: fingerprint,
+            };
+            writeOrgCache(root, cache);
+        }
+    }
+    catch {
+        return organization;
+    }
+    return organization;
+}
+function orgCacheFresh(entry, nowMs) {
+    if (!entry.identityCaptured)
+        return false;
+    const at = Date.parse(entry.fetchedAt);
+    return !Number.isNaN(at) && nowMs - at >= 0 && nowMs - at < CLAUDE_ORG_CACHE_MS;
+}
+/**
+ * Identity is the profile account id, hashed. Organization ids are not
+ * account identity: the desktop app can rewrite `.claude.json` for a
+ * different account than the token that was read.
+ */
+function accountIdentityKey(body) {
+    const raw = accountIdentityRaw(body);
+    if (!raw)
+        return null;
+    return crypto.createHash("sha256").update(raw, "utf8").digest("hex").slice(0, 16);
+}
+function accountIdentityRaw(body) {
+    if (!body || typeof body !== "object" || Array.isArray(body))
+        return null;
+    const account = body.account;
+    if (!account || typeof account !== "object" || Array.isArray(account))
+        return null;
+    const record = account;
+    for (const key of ["uuid", "account_uuid", "accountUuid", "id"]) {
+        const value = record[key];
+        if (typeof value !== "string")
+            continue;
+        const trimmed = value.trim();
+        if (!trimmed || trimmed.includes("@") || looksSecret(trimmed))
+            continue;
+        return trimmed;
+    }
+    return null;
+}
+function organizationName(body) {
+    if (!body || typeof body !== "object" || Array.isArray(body))
+        return null;
+    const organization = body.organization;
+    if (!organization || typeof organization !== "object" || Array.isArray(organization))
+        return null;
+    const name = organization.name;
+    if (typeof name !== "string")
+        return null;
+    return displayOrganization(name);
+}
+/** Mail providers whose domain says nothing about the account, shown as "Personal". */
+const CONSUMER_MAIL_DOMAINS = new Set([
+    "gmail.com", "googlemail.com", "icloud.com", "me.com", "mac.com", "outlook.com",
+    "hotmail.com", "live.com", "msn.com", "yahoo.com", "aol.com", "proton.me",
+    "protonmail.com", "pm.me", "fastmail.com", "hey.com",
+]);
+/**
+ * Claude names an individual plan's organization "<email>'s Organization".
+ * The ledger never stores an email, so such a name becomes the email's
+ * domain (for example "getindigo.ai"), or "Personal" for a consumer mail
+ * domain. Any other name containing "@" is dropped.
+ */
+export function displayOrganization(name) {
+    const trimmed = name.trim();
+    if (!trimmed)
+        return null;
+    const personal = /^[^@\s]+@([a-z0-9.-]+\.[a-z]{2,})'s organization$/i.exec(trimmed);
+    if (personal) {
+        const domain = personal[1].toLowerCase();
+        return CONSUMER_MAIL_DOMAINS.has(domain) ? "Personal" : domain;
+    }
+    if (trimmed.includes("@"))
+        return null;
+    return trimmed;
+}
+/** null = profile had no account id. undefined = missing or not a hash, so refetch. */
+function storedIdentityKey(value) {
+    if (value === null)
+        return null;
+    if (typeof value === "string" && IDENTITY_KEY_RE.test(value))
+        return value;
+    return undefined;
+}
+function readOrgCache(root) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(root, CLAUDE_ORG_CACHE_FILE), "utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return { accounts: {} };
+        const accounts = parsed.accounts;
+        if (!accounts || typeof accounts !== "object" || Array.isArray(accounts))
+            return { accounts: {} };
+        const out = {};
+        for (const [key, value] of Object.entries(accounts)) {
+            if (!value || typeof value !== "object" || Array.isArray(value))
+                continue;
+            const row = value;
+            if (typeof row.fetchedAt !== "string")
+                continue;
+            const organization = typeof row.organization === "string" && !row.organization.includes("@")
+                ? row.organization
+                : null;
+            const identity = Object.prototype.hasOwnProperty.call(row, "identityKey")
+                ? storedIdentityKey(row.identityKey)
+                : undefined;
+            const fingerprint = typeof row.tokenFingerprint === "string" && IDENTITY_KEY_RE.test(row.tokenFingerprint)
+                ? row.tokenFingerprint
+                : undefined;
+            out[key] = {
+                organization,
+                fetchedAt: row.fetchedAt,
+                identityKey: identity ?? null,
+                identityCaptured: identity !== undefined,
+                tokenFingerprint: fingerprint,
+            };
+        }
+        return { accounts: out };
+    }
+    catch {
+        return { accounts: {} };
+    }
+}
+function writeOrgCache(root, cache) {
+    fs.mkdirSync(root, { recursive: true, mode: DIR_MODE });
+    try {
+        fs.chmodSync(root, DIR_MODE);
+    }
+    catch {
+        // The directory mode is best-effort when the root already exists.
+    }
+    const dest = path.join(root, CLAUDE_ORG_CACHE_FILE);
+    const stored = {
+        accounts: Object.fromEntries(Object.entries(cache.accounts).map(([id, entry]) => {
+            const row = {
+                organization: entry.organization,
+                fetchedAt: entry.fetchedAt,
+            };
+            if (entry.identityCaptured)
+                row.identityKey = entry.identityKey;
+            if (entry.tokenFingerprint && IDENTITY_KEY_RE.test(entry.tokenFingerprint)) {
+                row.tokenFingerprint = entry.tokenFingerprint;
+            }
+            return [id, row];
+        })),
+    };
+    const body = `${JSON.stringify(stored)}\n`;
+    const tmp = path.join(root, `.${CLAUDE_ORG_CACHE_FILE}.${process.pid}.tmp`);
+    fs.writeFileSync(tmp, body, { mode: FILE_MODE });
+    fs.renameSync(tmp, dest);
+    fs.chmodSync(dest, FILE_MODE);
+}
+export function claudeSeatAccountId(seat, orgId) {
+    const material = orgId ? `${orgId}\0${seat}` : seat;
+    return hashClaudeAccountId(material);
+}
+function loadAccounts(options, nowMs) {
+    if (options.readCredentials) {
+        const read = options.readCredentials();
+        return {
+            keychain: read.keychain,
+            store: "injected",
+            seat: "injected",
+            failures: [],
+            accounts: read.accounts.map((account) => classifyAccount(account, nowMs)),
+        };
+    }
+    if (options.credentialsPath || (options.platform ?? process.platform) !== "darwin") {
+        const file = options.credentialsPath ?? defaultClaudeCredentialsPath(options.ledger?.home);
+        const seat = `file:${path.basename(file)}`;
+        const read = readCredentialFile(file, seat, nowMs);
+        if ("error" in read) {
+            return { keychain: "error", accounts: [], failures: [], store: "file", seat };
+        }
+        return { keychain: "no-prompt", accounts: read.accounts, failures: [], store: "file", seat };
+    }
+    const file = defaultClaudeCredentialsPath(options.ledger?.home);
+    const seat = `file:${path.basename(file)}`;
+    const read = readCredentialFile(file, seat, nowMs);
+    if ("error" in read) {
+        return { keychain: "error", accounts: [], failures: [], store: "file", seat };
+    }
+    return { keychain: "no-prompt", accounts: read.accounts, failures: [], store: "file", seat };
+}
+function classifyAccount(account, nowMs) {
+    const planType = account.planType ?? null;
+    if (isExpired(account.expiresAt ?? null, nowMs)) {
+        return { blocked: "unavailable: token_expired", accountId: account.accountId, planType };
+    }
+    if (!hasProfileScope(account.scopes)) {
+        return { blocked: "unavailable: missing_scope", accountId: account.accountId, planType };
+    }
+    return { token: account.token, accountId: account.accountId, planType };
+}
+function readCredentialFile(file, seat, nowMs) {
+    let text;
+    try {
+        text = fs.readFileSync(file, "utf8");
+    }
+    catch {
+        return { error: "missing" };
+    }
+    const accounts = parseCredentialDocument(text, seat, nowMs);
+    if (!accounts || accounts.length === 0)
+        return { error: "invalid" };
+    return { accounts };
+}
+function parseCredentialDocument(text, seat, nowMs, identity = "seat") {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return null;
+    const root = parsed;
+    const oauth = root.claudeAiOauth && typeof root.claudeAiOauth === "object" && !Array.isArray(root.claudeAiOauth)
+        ? root.claudeAiOauth
+        : null;
+    if (!oauth)
+        return [];
+    const token = typeof oauth.accessToken === "string" && oauth.accessToken.trim()
+        ? oauth.accessToken
+        : (typeof oauth.access_token === "string" ? oauth.access_token : "");
+    if (!token)
+        return [];
+    const orgId = findAccountId(oauth);
+    // A profile or credential account id is the seat. An organization id is
+    // not: two people in one org must stay two accounts. With no account id,
+    // the home (keychain service or credentials path) keeps them apart.
+    const accountId = identity === "underlying"
+        ? hashClaudeAccountId(underlyingAccountRaw(oauth) ?? seat)
+        : claudeSeatAccountId(seat, orgId);
+    const scopes = Array.isArray(oauth.scopes)
+        ? oauth.scopes.filter((scope) => typeof scope === "string")
+        : null;
+    const planType = typeof oauth.subscriptionType === "string" && oauth.subscriptionType.trim()
+        ? oauth.subscriptionType.trim()
+        : (typeof oauth.rateLimitTier === "string" && oauth.rateLimitTier.trim() ? oauth.rateLimitTier.trim() : null);
+    const expiresAt = typeof oauth.expiresAt === "number" && Number.isFinite(oauth.expiresAt) ? oauth.expiresAt : null;
+    return [classifyAccount({ token, accountId, expiresAt, scopes, planType }, nowMs)];
+}
+function underlyingAccountRaw(oauth) {
+    for (const key of ["accountUuid", "accountId", "account_id", "uuid"]) {
+        const value = oauth[key];
+        if (typeof value === "string" && value.trim() && !value.includes("@") && !looksSecret(value)) {
+            return value.trim();
+        }
+    }
+    return null;
+}
+function findAccountId(oauth) {
+    for (const key of ACCOUNT_ID_KEYS) {
+        const value = oauth[key];
+        if (typeof value === "string" && value.trim() && !value.includes("@") && !looksSecret(value))
+            return value.trim();
+    }
+    const organization = oauth.organization;
+    if (organization && typeof organization === "object" && !Array.isArray(organization)) {
+        const nested = findAccountId(organization);
+        if (nested)
+            return nested;
+    }
+    return null;
+}
+function looksSecret(value) {
+    return value.startsWith("sk-ant-") || value.startsWith("eyJ");
+}
+function hasProfileScope(scopes) {
+    return Array.isArray(scopes) && scopes.includes("user:profile");
+}
+function isExpired(expiresAt, nowMs) {
+    if (expiresAt === null)
+        return false;
+    const ms = expiresAt < 1e12 ? expiresAt * 1000 : expiresAt;
+    return ms <= nowMs;
+}
+function classifySecurity(result) {
+    if (result.timedOut)
+        return "timeout";
+    const text = `${result.stderr}\n${result.stdout}`;
+    if (/interaction is not allowed|User canceled|errSecUserCanceled|errSecInteractionNotAllowed|-25308/i.test(text) && result.status !== 0) {
+        return "prompt";
+    }
+    if (result.status !== 0)
+        return "error";
+    return "no-prompt";
+}
+function usageInit(token) {
+    return {
+        method: "GET",
+        headers: {
+            Authorization: `Bearer ${token}`,
+            "anthropic-beta": CLAUDE_OAUTH_BETA,
+            Accept: "application/json",
+        },
+        redirect: "manual",
+        signal: AbortSignal.timeout(CLAUDE_OAUTH_FETCH_TIMEOUT_MS),
+    };
+}
+const defaultClaudeFetch = async (url, init) => {
+    const response = await fetch(url, init);
+    return {
+        status: response.status,
+        text: () => response.text(),
+        headers: { get: (name) => response.headers.get(name) },
+    };
+};
+export function readInstalledClaudeVersion(readVersion = defaultClaudeVersionText) {
+    try {
+        return parseClaudeCliVersion(readVersion()) ?? "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+/** Async `claude --version` for the daemon. The sync reader stays for one-shot callers. */
+export function readInstalledClaudeVersionAsync() {
+    return execFileText("claude", ["--version"]).then((text) => parseClaudeCliVersion(text) ?? "unknown", () => "unknown");
+}
+function execFileText(command, args) {
+    return new Promise((resolve, reject) => {
+        execFile(command, [...args], { timeout: 5_000, encoding: "utf8", windowsHide: true }, (error, stdout, stderr) => {
+            if (error && !stdout && !stderr) {
+                reject(error);
+                return;
+            }
+            resolve(`${stdout ?? ""}\n${stderr ?? ""}`);
+        });
+    });
+}
+function defaultClaudeVersionText() {
+    const result = spawnSync("claude", ["--version"], {
+        encoding: "utf8",
+        timeout: 5_000,
+        stdio: ["ignore", "pipe", "pipe"],
+        windowsHide: true,
+    });
+    if (result.error)
+        throw result.error;
+    return `${result.stdout ?? ""}\n${result.stderr ?? ""}`;
+}
+function mapLimit(value, options) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return { error: "claude oauth usage field drift: limits" };
+    }
+    const record = value;
+    const kind = record.kind;
+    if (kind !== "session" && kind !== "weekly_all" && kind !== "weekly_scoped") {
+        return { error: "claude oauth usage field drift: limits" };
+    }
+    if (!isFiniteNumber(record.percent))
+        return { error: "claude oauth usage field drift: limits" };
+    const resetsAt = normalizeReset(record.resets_at);
+    if (typeof record.resets_at === "string" && record.resets_at.trim() && !resetsAt) {
+        return { error: "claude oauth usage field drift: limits" };
+    }
+    const scope = kind === "weekly_scoped" ? readScope(record.scope) : null;
+    const windowMinutes = kind === "session" ? SESSION_MINUTES : WEEKLY_MINUTES;
+    return {
+        reading: reading(options, {
+            limitId: scope ? `${kind}:${scope}` : kind,
+            kind,
+            scope,
+            usedPercent: record.percent,
+            windowMinutes,
+            resetsAt,
+            balance: null,
+            planType: options.planType,
+        }),
+    };
+}
+function attachShares(value, indexed, failures, options) {
+    if (value === undefined || value === null)
+        return;
+    if (!Array.isArray(value)) {
+        failures.push(failure(options, "claude oauth usage field drift: weekly_scoped_shares"));
+        return;
+    }
+    for (const share of value) {
+        if (!share || typeof share !== "object" || Array.isArray(share))
+            continue;
+        const record = share;
+        if (typeof record.limit_index !== "number")
+            continue;
+        if (!isFiniteNumber(record.allowance_percent_of_weekly))
+            continue;
+        const hit = indexed.find((row) => row.index === record.limit_index && row.reading.limit.kind === "weekly_scoped");
+        if (!hit)
+            continue;
+        hit.reading.limit.allowancePercentOfWeekly = record.allowance_percent_of_weekly;
+    }
+}
+function mapExtraUsage(value, options) {
+    if (value === undefined || value === null)
+        return null;
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return { error: "claude oauth usage field drift: extra_usage" };
+    }
+    const record = value;
+    if (typeof record.is_enabled !== "boolean")
+        return { error: "claude oauth usage field drift: extra_usage" };
+    if ("utilization" in record && record.utilization !== null && !isFiniteNumber(record.utilization)) {
+        return { error: "claude oauth usage field drift: extra_usage" };
+    }
+    const currency = typeof record.currency === "string" && record.currency.trim() ? record.currency.trim() : null;
+    return {
+        reading: reading(options, {
+            limitId: "extra_usage",
+            kind: "credits",
+            scope: currency,
+            usedPercent: isFiniteNumber(record.utilization) ? record.utilization : null,
+            windowMinutes: null,
+            resetsAt: null,
+            balance: creditsBalance(record.used_credits, record.monthly_limit),
+            planType: options.planType,
+            hasCredits: record.is_enabled,
+        }),
+    };
+}
+function mapSpend(value, options) {
+    if (value === undefined || value === null)
+        return null;
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return { error: "claude oauth usage field drift: spend" };
+    }
+    const record = value;
+    if (!isFiniteNumber(record.percent))
+        return { error: "claude oauth usage field drift: spend" };
+    const used = record.used && typeof record.used === "object" && !Array.isArray(record.used)
+        ? record.used
+        : null;
+    const currency = used && typeof used.currency === "string" && used.currency.trim() ? used.currency.trim() : null;
+    const amount = used && isFiniteNumber(used.amount_minor) ? used.amount_minor : null;
+    return {
+        reading: reading(options, {
+            limitId: "spend",
+            kind: "credits",
+            scope: currency,
+            usedPercent: record.percent,
+            windowMinutes: null,
+            resetsAt: null,
+            balance: amount,
+            planType: options.planType,
+            hasCredits: typeof record.enabled === "boolean" ? record.enabled : null,
+        }),
+    };
+}
+function creditsBalance(used, limit) {
+    const usedOk = isFiniteNumber(used);
+    const limitOk = isFiniteNumber(limit);
+    if (usedOk && limitOk)
+        return `${used}/${limit}`;
+    if (usedOk)
+        return used;
+    if (limitOk)
+        return limit;
+    return null;
+}
+function readScope(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const model = value.model;
+    if (!model || typeof model !== "object" || Array.isArray(model))
+        return null;
+    const name = model.display_name;
+    return typeof name === "string" && name.trim() ? name.trim() : null;
+}
+function normalizeReset(value) {
+    if (typeof value !== "string" || !value.trim())
+        return null;
+    const parsed = Date.parse(value);
+    if (Number.isNaN(parsed))
+        return null;
+    return new Date(parsed).toISOString();
+}
+function reading(options, limit) {
+    const row = {
+        readingId: makeReadingId([
+            CLAUDE_OAUTH_SOURCE,
+            options.accountId,
+            limit.limitId,
+            options.observedAt,
+            String(limit.usedPercent),
+            String(limit.balance),
+        ]),
+        observedAt: options.observedAt,
+        provider: CLAUDE_OAUTH_PROVIDER,
+        accountId: options.accountId,
+        source: CLAUDE_OAUTH_SOURCE,
+        cliVersion: options.cliVersion,
+        confidence: "fetched",
+        parserVersion: CLAUDE_OAUTH_PARSER_VERSION,
+        limit,
+    };
+    return stampAccount(row, options);
+}
+function failure(options, error) {
+    const event = {
+        event: "parser_failure",
+        observedAt: options.observedAt,
+        provider: CLAUDE_OAUTH_PROVIDER,
+        source: CLAUDE_OAUTH_SOURCE,
+        error,
+        accountId: options.accountId,
+        cliVersion: options.cliVersion,
+        parserVersion: CLAUDE_OAUTH_PARSER_VERSION,
+    };
+    return stampAccount(event, options);
+}
+function stampAccount(row, options) {
+    if (options.accountLabel)
+        row.accountLabel = options.accountLabel;
+    if (options.accountLabels)
+        row.accountLabels = [...options.accountLabels];
+    if (options.accountHome)
+        row.accountHome = options.accountHome;
+    if (options.organization !== undefined)
+        row.organization = options.organization;
+    return row;
+}
+function makeReadingId(parts) {
+    const digest = crypto.createHash("sha256").update(parts.join("\0"), "utf8").digest("hex").slice(0, 20);
+    return `rdg_${digest}`;
+}
+function ledgerOptions(options) {
+    return { ...(options.ledger ?? {}) };
+}
+function pollIsFresh(root, accountId, nowMs) {
+    const state = readPoll(claudeOAuthPollPath(root));
+    const last = state.accounts[accountId];
+    if (!last)
+        return false;
+    const at = Date.parse(last);
+    if (Number.isNaN(at))
+        return false;
+    const delta = nowMs - at;
+    return delta >= 0 && delta < CLAUDE_OAUTH_FRESH_MS;
+}
+function homeBlockKey(home) {
+    return `block:${path.resolve(home)}`;
+}
+function homeKeychainBlocked(root, home, nowMs) {
+    if (keychainBlocked(root, nowMs))
+        return true;
+    const until = readPoll(claudeOAuthPollPath(root)).accounts[homeBlockKey(home)];
+    if (!until)
+        return false;
+    const at = Date.parse(until);
+    return !Number.isNaN(at) && nowMs < at;
+}
+function noteKeychainBackoff(root, home, nowMs) {
+    const until = new Date(nowMs + CLAUDE_OAUTH_KEYCHAIN_BACKOFF_MS).toISOString();
+    writeKeychainBlock(root, until);
+    const state = readPoll(claudeOAuthPollPath(root));
+    state.accounts[homeBlockKey(home)] = until;
+    writePoll(root, state);
+}
+function noteHttpBackoff(root, accountId, nowMs, retryAfter) {
+    let retryMs = 0;
+    if (retryAfter) {
+        const seconds = Number(retryAfter);
+        if (Number.isFinite(seconds) && seconds >= 0)
+            retryMs = seconds * 1000;
+        else {
+            const at = Date.parse(retryAfter);
+            if (!Number.isNaN(at))
+                retryMs = Math.max(0, at - nowMs);
+        }
+    }
+    const backoffMs = Math.max(retryMs, CLAUDE_OAUTH_POLL_MS);
+    writeAccountPoll(root, accountId, new Date(nowMs + backoffMs - CLAUDE_OAUTH_FRESH_MS).toISOString());
+}
+function callSecurity(options, args, timeoutMs) {
+    if (options.securityExec)
+        return Promise.resolve(options.securityExec(args, timeoutMs));
+    return new Promise((resolve) => {
+        execFile("security", [...args], { timeout: timeoutMs, encoding: "utf8", maxBuffer: 8 * 1024 * 1024 }, (error, stdout, stderr) => {
+            const err = error;
+            const timedOut = err?.code === "ETIMEDOUT";
+            const status = typeof err?.code === "number" ? err.code : (err ? 1 : 0);
+            resolve({
+                status,
+                stdout: typeof stdout === "string" ? stdout : "",
+                stderr: typeof stderr === "string" ? stderr : "",
+                timedOut,
+            });
+        });
+    });
+}
+function keychainBlocked(root, nowMs) {
+    const until = readPoll(claudeOAuthPollPath(root)).keychainBlockedUntil;
+    if (!until)
+        return false;
+    const at = Date.parse(until);
+    return !Number.isNaN(at) && nowMs < at;
+}
+function readPoll(file) {
+    const empty = { accounts: {}, keychainBlockedUntil: null };
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return empty;
+        const record = parsed;
+        const accounts = {};
+        if (record.accounts && typeof record.accounts === "object" && !Array.isArray(record.accounts)) {
+            for (const [key, value] of Object.entries(record.accounts)) {
+                if (typeof value === "string")
+                    accounts[key] = value;
+            }
+        }
+        const blocked = typeof record.keychainBlockedUntil === "string" ? record.keychainBlockedUntil : null;
+        return { accounts, keychainBlockedUntil: blocked };
+    }
+    catch {
+        return empty;
+    }
+}
+function writeAccountPoll(root, accountId, at) {
+    const state = readPoll(claudeOAuthPollPath(root));
+    state.accounts[accountId] = at;
+    writePoll(root, state);
+}
+function writeKeychainBlock(root, until) {
+    const state = readPoll(claudeOAuthPollPath(root));
+    state.keychainBlockedUntil = until;
+    writePoll(root, state);
+}
+function writePoll(root, state) {
+    fs.mkdirSync(root, { recursive: true, mode: DIR_MODE });
+    fs.chmodSync(root, DIR_MODE);
+    const dest = claudeOAuthPollPath(root);
+    const body = `${JSON.stringify({
+        accounts: state.accounts,
+        keychainBlockedUntil: state.keychainBlockedUntil,
+    }, null, 2)}\n`;
+    const tmp = path.join(root, `.${CLAUDE_OAUTH_POLL_FILE}.${process.pid}.tmp`);
+    fs.writeFileSync(tmp, body, { mode: FILE_MODE });
+    fs.renameSync(tmp, dest);
+    fs.chmodSync(dest, FILE_MODE);
+}
+function isFiniteNumber(value) {
+    return typeof value === "number" && Number.isFinite(value);
+}
+//# sourceMappingURL=claude-oauth.js.map