@modelprofile.com/authswitch 5.1.0 → 6.0.0

package/ts/classes.operations.ts

@@ -1,11 +1,14 @@
 import * as plugins from './plugins.js';
 import { authSwitchHome } from './classes.credentialstore.js';
+import { assertAuthSwitchMutation, type TAuthSwitchMutation } from './mutation.js';
 import type { IAuthHarness, IHarnessOutcome } from './interfaces.harness.js';
 
-export type TAuthSwitchMutation = { harnessId: string } & (
-  | { action: 'save'; accountId?: string; keepActive: boolean }
-  | { action: 'switch' | 'remove'; accountId: string }
-);
+/**
+ * The mutation command and its rules live in a leaf module so that a browser host can import them
+ * through `@modelprofile.com/authswitch/mutation`; they stay exported here for every Node caller.
+ */
+export { assertAuthSwitchMutation, authSwitchMutationReplacesLogin, type TAuthSwitchMutation } from './mutation.js';
+
 export interface IAuthSwitchCoordinationRequest {
   protocolVersion: 1;
   /** Identifies credential locations; a host must refuse a different environment. */
@@ -38,24 +41,6 @@ export const authSwitchEnvironmentId = (env: NodeJS.ProcessEnv = process.env): s
   openCodeOverride: env.OPENCODE_AUTH_CONTENT !== undefined,
 })).digest('hex');
 
-/** Validate the secret-free command boundary, including callers that do not use TypeScript. */
-export const assertAuthSwitchMutation: (value: unknown) => asserts value is TAuthSwitchMutation = (value) => {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('Invalid account operation.');
-  const item = value as Record<string, unknown>;
-  const keys = item.action === 'save' ? ['harnessId', 'action', 'accountId', 'keepActive'] : ['harnessId', 'action', 'accountId'];
-  if (Object.keys(item).some(key => !keys.includes(key))
-    || typeof item.harnessId !== 'string' || !/^[a-z][a-z0-9-]{0,63}$/.test(item.harnessId)
-    || !['save', 'switch', 'remove'].includes(String(item.action))
-    || (item.accountId !== undefined && (typeof item.accountId !== 'string' || !item.accountId.length || item.accountId.length > 512))
-    || (item.action === 'save' ? typeof item.keepActive !== 'boolean' : typeof item.accountId !== 'string')) {
-    throw new Error('Invalid account operation.');
-  }
-};
-
-/** Whether a mutation replaces the harness's active login, and therefore concerns running instances. */
-export const authSwitchMutationReplacesLogin = (mutationArg: TAuthSwitchMutation): boolean =>
-  mutationArg.action === 'switch' || (mutationArg.action === 'save' && !mutationArg.keepActive);
-
 export const runAuthSwitchMutation = async (harness: IAuthHarness, mutation: TAuthSwitchMutation): Promise<IHarnessOutcome> => {
   assertAuthSwitchMutation(mutation);
   if (harness.id !== mutation.harnessId) throw new Error('Account operation targets a different harness.');

package/ts/claudehttp.ts

@@ -13,6 +13,28 @@ export class ClaudeLoginRejectedError extends ClaudeRequestError {
   constructor() { super(CLAUDE_LOGIN_REJECTED); }
 }
 
+/**
+ * Where Claude Code 2.1.273 sends an account the service put on hold (`T5e`, bundle offset @190070402). A hold is
+ * not a dead login: the service refuses the grant while it lasts and accepts it again once it is lifted.
+ */
+export const CLAUDE_ACCOUNT_ON_HOLD_URL = 'https://claude.ai/restricted';
+
+/** The service put this account on hold. The login itself is intact, so it is never remembered as refused. */
+export class ClaudeAccountOnHoldError extends ClaudeRequestError {
+  constructor() { super(`This Claude account is on hold and cannot sign in. View details or appeal: ${CLAUDE_ACCOUNT_ON_HOLD_URL}`); }
+}
+
+/**
+ * The OAuth error code a response names, read as Claude Code 2.1.273 reads it (`xc`, @191165290): the `error` field
+ * as a string, or the `type` of the object some Anthropic endpoints send it as.
+ */
+export const oauthErrorCode = (bodyArg: Record<string, unknown> | null): string | undefined => {
+  const error = bodyArg?.error;
+  if (typeof error === 'string') return error;
+  const type = typeof error === 'object' && error !== null ? (error as Record<string, unknown>).type : undefined;
+  return typeof type === 'string' ? type : undefined;
+};
+
 /** The service refused a request for too many requests. That says nothing about the account's usage or login. */
 export class ClaudeRateLimitError extends ClaudeRequestError {
   constructor(subjectArg: string, public readonly retryAt: string | null) {

package/ts/mutation.ts

@@ -0,0 +1,32 @@
+/**
+ * The account mutation command and the rules that read it, with no dependency of any kind.
+ *
+ * A host decides what a mutation means to the instances it runs long before it can touch a
+ * credential, and a browser is such a host. This module therefore imports nothing -- no Node
+ * built-in, no package, not even another module of this package -- so that it can be bundled
+ * for a browser through the `@modelprofile.com/authswitch/mutation` entry point. Everything
+ * that reads a credential stays behind the main entry point, which is Node-only.
+ */
+
+export type TAuthSwitchMutation = { harnessId: string } & (
+  | { action: 'save'; accountId?: string; keepActive: boolean }
+  | { action: 'switch' | 'remove'; accountId: string }
+);
+
+/** Validate the secret-free command boundary, including callers that do not use TypeScript. */
+export const assertAuthSwitchMutation: (value: unknown) => asserts value is TAuthSwitchMutation = (value) => {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('Invalid account operation.');
+  const item = value as Record<string, unknown>;
+  const keys = item.action === 'save' ? ['harnessId', 'action', 'accountId', 'keepActive'] : ['harnessId', 'action', 'accountId'];
+  if (Object.keys(item).some(key => !keys.includes(key))
+    || typeof item.harnessId !== 'string' || !/^[a-z][a-z0-9-]{0,63}$/.test(item.harnessId)
+    || !['save', 'switch', 'remove'].includes(String(item.action))
+    || (item.accountId !== undefined && (typeof item.accountId !== 'string' || !item.accountId.length || item.accountId.length > 512))
+    || (item.action === 'save' ? typeof item.keepActive !== 'boolean' : typeof item.accountId !== 'string')) {
+    throw new Error('Invalid account operation.');
+  }
+};
+
+/** Whether a mutation replaces the harness's active login, and therefore concerns running instances. */
+export const authSwitchMutationReplacesLogin = (mutationArg: TAuthSwitchMutation): boolean =>
+  mutationArg.action === 'switch' || (mutationArg.action === 'save' && !mutationArg.keepActive);