@moxxy/plugin-provider-claude-code 0.21.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Moxxy (moxxy.ai)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/constants.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Constants for the Claude subscription (Pro/Max) provider.
+ *
+ * These are the public Claude Code OAuth client parameters — the same values
+ * the `claude` CLI uses — so a token minted here interoperates with one from
+ * `claude setup-token`, and vice-versa. We never embed a client secret; the
+ * flow is PKCE + an out-of-band (manual paste) authorization code.
+ */
+/** Provider name in the registry / `/model` picker / `provider.name` config. */
+export declare const CLAUDE_CODE_PROVIDER_ID = "claude-code";
+/** Human-readable upstream service, shown in `moxxy login` and the init wizard. */
+export declare const CLAUDE_CODE_SERVICE_NAME = "Claude (Pro/Max subscription)";
+export declare const CLAUDE_AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+export declare const CLAUDE_TOKEN_URL = "https://console.anthropic.com/v1/oauth/token";
+export declare const CLAUDE_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+/**
+ * Out-of-band redirect: after consent, Anthropic shows the user a
+ * `code#state` string to paste back into the terminal (no loopback server).
+ */
+export declare const CLAUDE_REDIRECT_URI = "https://console.anthropic.com/oauth/code/callback";
+export declare const CLAUDE_SCOPES: readonly ["org:create_api_key", "user:profile", "user:inference"];
+/**
+ * `anthropic-beta` values sent with every request. `oauth-2025-04-20` is the
+ * flag that makes the Messages API accept a subscription bearer token at all;
+ * `claude-code-20250219` matches what the real CLI sends. Sent comma-joined.
+ */
+export declare const CLAUDE_OAUTH_BETA: readonly ["oauth-2025-04-20", "claude-code-20250219"];
+/**
+ * Required first system block. Claude rejects a subscription token unless the
+ * system prompt leads with this exact identity line; moxxy's real system
+ * prompt is appended as the following block. (Verified against the working
+ * opencode / claude-code-router behaviour.)
+ */
+export declare const CLAUDE_CODE_SYSTEM = "You are Claude Code, Anthropic's official CLI for Claude.";
+/**
+ * Env vars a pasted/CI token can arrive through. `CLAUDE_CODE_OAUTH_TOKEN` is
+ * what `claude setup-token` documents; `ANTHROPIC_AUTH_TOKEN` is the
+ * SDK-native bearer var. Checked in this order.
+ */
+export declare const CLAUDE_TOKEN_ENV_VARS: readonly ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_AUTH_TOKEN"];
+//# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,gFAAgF;AAChF,eAAO,MAAM,uBAAuB,gBAAgB,CAAC;AAErD,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,kCAAkC,CAAC;AAExE,eAAO,MAAM,oBAAoB,sCAAsC,CAAC;AACxE,eAAO,MAAM,gBAAgB,iDAAiD,CAAC;AAC/E,eAAO,MAAM,gBAAgB,yCAAyC,CAAC;AACvE;;;GAGG;AACH,eAAO,MAAM,mBAAmB,sDAAsD,CAAC;AACvF,eAAO,MAAM,aAAa,mEAAoE,CAAC;AAE/F;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,uDAAwD,CAAC;AAEvF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,8DAA8D,CAAC;AAE9F;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,8DAA+D,CAAC"}

package/dist/constants.js

@@ -0,0 +1,41 @@
+/**
+ * Constants for the Claude subscription (Pro/Max) provider.
+ *
+ * These are the public Claude Code OAuth client parameters — the same values
+ * the `claude` CLI uses — so a token minted here interoperates with one from
+ * `claude setup-token`, and vice-versa. We never embed a client secret; the
+ * flow is PKCE + an out-of-band (manual paste) authorization code.
+ */
+/** Provider name in the registry / `/model` picker / `provider.name` config. */
+export const CLAUDE_CODE_PROVIDER_ID = 'claude-code';
+/** Human-readable upstream service, shown in `moxxy login` and the init wizard. */
+export const CLAUDE_CODE_SERVICE_NAME = 'Claude (Pro/Max subscription)';
+export const CLAUDE_AUTHORIZE_URL = 'https://claude.ai/oauth/authorize';
+export const CLAUDE_TOKEN_URL = 'https://console.anthropic.com/v1/oauth/token';
+export const CLAUDE_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
+/**
+ * Out-of-band redirect: after consent, Anthropic shows the user a
+ * `code#state` string to paste back into the terminal (no loopback server).
+ */
+export const CLAUDE_REDIRECT_URI = 'https://console.anthropic.com/oauth/code/callback';
+export const CLAUDE_SCOPES = ['org:create_api_key', 'user:profile', 'user:inference'];
+/**
+ * `anthropic-beta` values sent with every request. `oauth-2025-04-20` is the
+ * flag that makes the Messages API accept a subscription bearer token at all;
+ * `claude-code-20250219` matches what the real CLI sends. Sent comma-joined.
+ */
+export const CLAUDE_OAUTH_BETA = ['oauth-2025-04-20', 'claude-code-20250219'];
+/**
+ * Required first system block. Claude rejects a subscription token unless the
+ * system prompt leads with this exact identity line; moxxy's real system
+ * prompt is appended as the following block. (Verified against the working
+ * opencode / claude-code-router behaviour.)
+ */
+export const CLAUDE_CODE_SYSTEM = "You are Claude Code, Anthropic's official CLI for Claude.";
+/**
+ * Env vars a pasted/CI token can arrive through. `CLAUDE_CODE_OAUTH_TOKEN` is
+ * what `claude setup-token` documents; `ANTHROPIC_AUTH_TOKEN` is the
+ * SDK-native bearer var. Checked in this order.
+ */
+export const CLAUDE_TOKEN_ENV_VARS = ['CLAUDE_CODE_OAUTH_TOKEN', 'ANTHROPIC_AUTH_TOKEN'];
+//# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAErD,mFAAmF;AACnF,MAAM,CAAC,MAAM,wBAAwB,GAAG,+BAA+B,CAAC;AAExE,MAAM,CAAC,MAAM,oBAAoB,GAAG,mCAAmC,CAAC;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,8CAA8C,CAAC;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,sCAAsC,CAAC;AACvE;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,mDAAmD,CAAC;AACvF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,oBAAoB,EAAE,cAAc,EAAE,gBAAgB,CAAU,CAAC;AAE/F;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,kBAAkB,EAAE,sBAAsB,CAAU,CAAC;AAEvF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,2DAA2D,CAAC;AAE9F;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,yBAAyB,EAAE,sBAAsB,CAAU,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export declare const claudeCodeProviderDef: import("@moxxy/sdk").ProviderDef;
+export declare const claudeCodePlugin: import("@moxxy/sdk").Plugin;
+export default claudeCodePlugin;
+export { CLAUDE_CODE_PROVIDER_ID, CLAUDE_CODE_SERVICE_NAME, CLAUDE_CODE_SYSTEM, CLAUDE_OAUTH_BETA, CLAUDE_TOKEN_ENV_VARS, } from './constants.js';
+export { claudeLogin, claudeLogout, claudeStatus, ensureFreshClaudeTokens, refreshClaudeAccessToken, type FreshClaudeTokens, } from './login.js';
+export { createClaudeCodeClient, type ClaudeCodeProviderConfig } from './provider.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,qBAAqB,kCAehC,CAAC;AAEH,eAAO,MAAM,gBAAgB,6BAI3B,CAAC;AAEH,eAAe,gBAAgB,CAAC;AAEhC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,sBAAsB,EAAE,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,31 @@
+import { defineProvider, definePlugin } from '@moxxy/sdk';
+import { anthropicModels } from '@moxxy/plugin-provider-anthropic';
+import { CLAUDE_CODE_PROVIDER_ID, CLAUDE_CODE_SERVICE_NAME } from './constants.js';
+import { createClaudeCodeClient } from './provider.js';
+import { claudeLogin, claudeLogout, claudeStatus } from './login.js';
+export const claudeCodeProviderDef = defineProvider({
+    name: CLAUDE_CODE_PROVIDER_ID,
+    // Same Claude models as the API-key `anthropic` provider — it's the same
+    // Messages API, only the credential differs.
+    models: [...anthropicModels],
+    createClient: (config) => createClaudeCodeClient(config),
+    // No validateKey: an OAuth bearer is validated by the request itself, and
+    // an interactive paste/sign-in already proves the token round-trips.
+    auth: {
+        kind: 'oauth',
+        serviceName: CLAUDE_CODE_SERVICE_NAME,
+        login: claudeLogin,
+        logout: claudeLogout,
+        status: claudeStatus,
+    },
+});
+export const claudeCodePlugin = definePlugin({
+    name: '@moxxy/plugin-provider-claude-code',
+    version: '0.0.0',
+    providers: [claudeCodeProviderDef],
+});
+export default claudeCodePlugin;
+export { CLAUDE_CODE_PROVIDER_ID, CLAUDE_CODE_SERVICE_NAME, CLAUDE_CODE_SYSTEM, CLAUDE_OAUTH_BETA, CLAUDE_TOKEN_ENV_VARS, } from './constants.js';
+export { claudeLogin, claudeLogout, claudeStatus, ensureFreshClaudeTokens, refreshClaudeAccessToken, } from './login.js';
+export { createClaudeCodeClient } from './provider.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAiC,MAAM,eAAe,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAErE,MAAM,CAAC,MAAM,qBAAqB,GAAG,cAAc,CAAC;IAClD,IAAI,EAAE,uBAAuB;IAC7B,yEAAyE;IACzE,6CAA6C;IAC7C,MAAM,EAAE,CAAC,GAAG,eAAe,CAAC;IAC5B,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,sBAAsB,CAAC,MAAkC,CAAC;IACpF,0EAA0E;IAC1E,qEAAqE;IACrE,IAAI,EAAE;QACJ,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,wBAAwB;QACrC,KAAK,EAAE,WAAW;QAClB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,YAAY;KACrB;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;IAC3C,IAAI,EAAE,oCAAoC;IAC1C,OAAO,EAAE,OAAO;IAChB,SAAS,EAAE,CAAC,qBAAqB,CAAC;CACnC,CAAC,CAAC;AAEH,eAAe,gBAAgB,CAAC;AAEhC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,uBAAuB,EACvB,wBAAwB,GAEzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,sBAAsB,EAAiC,MAAM,eAAe,CAAC"}

package/dist/login.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Claude subscription login + token lifecycle.
+ *
+ * Claude's OAuth is an out-of-band (manual code-paste) authorization-code +
+ * PKCE flow whose token endpoint speaks JSON (not the form-encoded dialect
+ * the framework's `exchangeCodeForToken` / `refreshAccessToken` assume), so
+ * the HTTP exchange + refresh are implemented here. Everything else is reused
+ * from `@moxxy/plugin-oauth`: PKCE, the auth-URL builder, the browser opener,
+ * vault storage layout, and `parseTokenResponse`.
+ */
+import { type OAuthVault } from '@moxxy/plugin-oauth';
+import type { ProviderAuthContext, ProviderOAuthResult, ProviderOAuthStatus } from '@moxxy/sdk';
+/**
+ * Drive an interactive Claude sign-in. Two ways in, both through one command:
+ *   1. paste an existing `claude setup-token` token (stored verbatim), or
+ *   2. press Enter to run the browser out-of-band authorization-code flow.
+ * Needs `ctx.prompt` (a TTY); headless callers use `CLAUDE_CODE_OAUTH_TOKEN`.
+ */
+export declare function claudeLogin(ctx: ProviderAuthContext): Promise<ProviderOAuthResult>;
+export declare function claudeLogout(ctx: ProviderAuthContext): Promise<boolean>;
+export declare function claudeStatus(ctx: ProviderAuthContext): Promise<ProviderOAuthStatus | null>;
+export interface FreshClaudeTokens {
+    readonly accessToken: string;
+    readonly expiresAt?: number;
+    /** True when a refresh_token is stored, so a 401 can be recovered. */
+    readonly canRefresh: boolean;
+}
+/**
+ * Read the stored Claude creds, refreshing first if the access token is near
+ * expiry and a refresh_token is available. Returns null when nothing is
+ * stored. Persists rotated tokens BEFORE returning so a crash can't strand a
+ * single-use refresh_token. The refresh itself is serialized per credential
+ * (in-process + cross-process) and coalesces with concurrent refreshers.
+ */
+export declare function ensureFreshClaudeTokens(vault: OAuthVault): Promise<FreshClaudeTokens | null>;
+/**
+ * Force a refresh of the stored Claude tokens and persist the rotated bundle.
+ * Used as the provider's reactive 401 recovery. Throws if no refresh_token is
+ * stored (e.g. a pasted `setup-token`).
+ */
+export declare function refreshClaudeAccessToken(vault: OAuthVault): Promise<{
+    token: string;
+    expiresAt?: number;
+}>;
+export declare function __setClaudeFetch(f: typeof fetch): void;
+export declare function __setClaudeOpenBrowser(f: (url: string) => Promise<void>): void;
+export declare function __setClaudeSleep(f: (ms: number) => Promise<void>): void;
+export declare function __setClaudeTimeoutMs(ms: number): void;
+//# sourceMappingURL=login.d.ts.map

package/dist/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAaL,KAAK,UAAU,EAGhB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAepB;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAuFxF;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAM7E;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAUhG;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAalG;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAYhD;AA4ED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,KAAK,GAAG,IAAI,CAEtD;AAID,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAE9E;AAID,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAEvE;AAID,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAErD"}

package/dist/login.js

@@ -0,0 +1,342 @@
+/**
+ * Claude subscription login + token lifecycle.
+ *
+ * Claude's OAuth is an out-of-band (manual code-paste) authorization-code +
+ * PKCE flow whose token endpoint speaks JSON (not the form-encoded dialect
+ * the framework's `exchangeCodeForToken` / `refreshAccessToken` assume), so
+ * the HTTP exchange + refresh are implemented here. Everything else is reused
+ * from `@moxxy/plugin-oauth`: PKCE, the auth-URL builder, the browser opener,
+ * vault storage layout, and `parseTokenResponse`.
+ */
+import { buildAuthUrl, clearStoredCreds, computeCodeChallenge, generateCodeVerifier, generateState, isAuthRejection, isExpired, openInBrowser, parseTokenResponse, readStoredCreds, storeTokenSet, withCredentialLock, } from '@moxxy/plugin-oauth';
+import { MoxxyError } from '@moxxy/sdk';
+import { CLAUDE_AUTHORIZE_URL, CLAUDE_CLIENT_ID, CLAUDE_CODE_PROVIDER_ID, CLAUDE_CODE_SERVICE_NAME, CLAUDE_REDIRECT_URI, CLAUDE_SCOPES, CLAUDE_TOKEN_URL, } from './constants.js';
+const PASTE_PROMPT = 'Paste a token from `claude setup-token` (or press Enter to sign in via browser): ';
+const CODE_PROMPT = 'Paste the authorization code shown after you approve: ';
+/**
+ * Drive an interactive Claude sign-in. Two ways in, both through one command:
+ *   1. paste an existing `claude setup-token` token (stored verbatim), or
+ *   2. press Enter to run the browser out-of-band authorization-code flow.
+ * Needs `ctx.prompt` (a TTY); headless callers use `CLAUDE_CODE_OAUTH_TOKEN`.
+ */
+export async function claudeLogin(ctx) {
+    if (!ctx.prompt) {
+        throw new MoxxyError({
+            code: 'OAUTH_FLOW_NOT_SUPPORTED',
+            message: 'Claude sign-in needs an interactive terminal.',
+            hint: 'Run `claude setup-token` and set CLAUDE_CODE_OAUTH_TOKEN, or run ' +
+                '`moxxy login claude-code` in a terminal.',
+            context: { provider: CLAUDE_CODE_PROVIDER_ID },
+        });
+    }
+    const pasted = (await ctx.prompt(PASTE_PROMPT, { mask: true })).trim();
+    if (pasted) {
+        // A `setup-token` is a long-lived bearer with no refresh token; store it
+        // as-is. `isExpired` treats a missing expiry as non-expiring.
+        await storeTokenSet(ctx.vault, CLAUDE_CODE_PROVIDER_ID, { accessToken: pasted, tokenType: 'Bearer' }, { clientId: CLAUDE_CLIENT_ID, tokenUrl: CLAUDE_TOKEN_URL });
+        ctx.write('\nStored your Claude token.\n');
+        return {};
+    }
+    const verifier = generateCodeVerifier();
+    const challenge = computeCodeChallenge(verifier);
+    const state = generateState();
+    const authUrl = buildAuthUrl({
+        authUrl: CLAUDE_AUTHORIZE_URL,
+        clientId: CLAUDE_CLIENT_ID,
+        redirectUri: CLAUDE_REDIRECT_URI,
+        scopes: [...CLAUDE_SCOPES],
+        codeChallenge: challenge,
+        state,
+        extraAuthParams: { code: 'true' },
+    });
+    ctx.write(`\nSign in to ${CLAUDE_CODE_SERVICE_NAME} to authorize moxxy.\n\n` +
+        `If your browser doesn't open automatically, paste this URL:\n\n  ${authUrl}\n\n` +
+        `After approving, copy the authorization code shown and paste it back here.\n` +
+        `(Anthropic's sign-in page sometimes shows "Internal server error" on the\n` +
+        ` first attempt — just click "Try again" and it goes through.)\n\n`);
+    try {
+        await openBrowserImpl(authUrl);
+    }
+    catch {
+        // Non-fatal — the user can open the URL surfaced above by hand.
+    }
+    // The authorization code is a single-use, exchangeable credential — mask it
+    // so it doesn't echo into scrollback / screen-share, matching the token paste.
+    const entered = (await ctx.prompt(CODE_PROMPT, { mask: true })).trim();
+    if (!entered) {
+        throw new MoxxyError({
+            code: 'AUTH_DENIED',
+            message: 'No authorization code entered — sign-in cancelled.',
+            context: { provider: CLAUDE_CODE_PROVIDER_ID },
+        });
+    }
+    // Anthropic returns `code#state`, but often shows just the bare code, so the
+    // state check below is best-effort: it only fires when a state was pasted.
+    // The real CSRF/code-injection defense is PKCE — the `code_verifier` binds
+    // the code to this client session, so a foreign code fails the exchange.
+    const hash = entered.indexOf('#');
+    const code = hash >= 0 ? entered.slice(0, hash) : entered;
+    const returnedState = hash >= 0 ? entered.slice(hash + 1) : '';
+    if (returnedState && returnedState !== state) {
+        throw new MoxxyError({
+            code: 'AUTH_INVALID',
+            message: 'Authorization state mismatch — please run sign-in again.',
+            context: { provider: CLAUDE_CODE_PROVIDER_ID },
+        });
+    }
+    const { tokenSet, accountEmail } = await exchangeClaudeCode(code, returnedState || state, verifier);
+    await persistClaudeTokens(ctx.vault, tokenSet, accountEmail);
+    ctx.write(`\nSigned in to Claude${accountEmail ? ` as ${accountEmail}` : ''}.\n`);
+    // Omit `expiresAt` when the credential never expires (setup-token paste, or a
+    // token response without `expires_in`). Surfacing `0` would read as "epoch =
+    // already expired" to the CLI status renderer, which only checks `!== undefined`.
+    return {
+        ...(accountEmail ? { accountId: accountEmail } : {}),
+        ...(tokenSet.expiresAt !== undefined ? { expiresAt: tokenSet.expiresAt } : {}),
+    };
+}
+export async function claudeLogout(ctx) {
+    try {
+        return (await clearStoredCreds(ctx.vault, CLAUDE_CODE_PROVIDER_ID)) > 0;
+    }
+    catch {
+        return false;
+    }
+}
+export async function claudeStatus(ctx) {
+    const stored = await readStoredCreds(ctx.vault, CLAUDE_CODE_PROVIDER_ID);
+    if (!stored)
+        return null;
+    return {
+        accountId: stored.extras.account_email ?? null,
+        // Omit when absent — a stored setup-token has no expiry, and `0` would be
+        // mis-rendered as "expired" (the CLI only treats `!== undefined` as set).
+        ...(stored.tokenSet.expiresAt !== undefined ? { expiresAt: stored.tokenSet.expiresAt } : {}),
+        vaultKey: `oauth/${CLAUDE_CODE_PROVIDER_ID}/*`,
+    };
+}
+/**
+ * Read the stored Claude creds, refreshing first if the access token is near
+ * expiry and a refresh_token is available. Returns null when nothing is
+ * stored. Persists rotated tokens BEFORE returning so a crash can't strand a
+ * single-use refresh_token. The refresh itself is serialized per credential
+ * (in-process + cross-process) and coalesces with concurrent refreshers.
+ */
+export async function ensureFreshClaudeTokens(vault) {
+    const stored = await readStoredCreds(vault, CLAUDE_CODE_PROVIDER_ID);
+    if (!stored)
+        return null;
+    const { tokenSet } = stored;
+    if (tokenSet.refreshToken && isExpired(tokenSet)) {
+        const refreshed = await refreshClaudeUnderLock(vault, stored);
+        return { accessToken: refreshed.accessToken, ...(refreshed.expiresAt !== undefined ? { expiresAt: refreshed.expiresAt } : {}), canRefresh: true };
+    }
+    return {
+        accessToken: tokenSet.accessToken,
+        ...(tokenSet.expiresAt !== undefined ? { expiresAt: tokenSet.expiresAt } : {}),
+        canRefresh: tokenSet.refreshToken !== undefined,
+    };
+}
+/**
+ * Force a refresh of the stored Claude tokens and persist the rotated bundle.
+ * Used as the provider's reactive 401 recovery. Throws if no refresh_token is
+ * stored (e.g. a pasted `setup-token`).
+ */
+export async function refreshClaudeAccessToken(vault) {
+    const stored = await readStoredCreds(vault, CLAUDE_CODE_PROVIDER_ID);
+    if (!stored?.tokenSet.refreshToken) {
+        throw new MoxxyError({
+            code: 'AUTH_EXPIRED',
+            message: 'Claude token expired and no refresh_token is stored.',
+            hint: 'Run `moxxy login claude-code` again, or refresh `CLAUDE_CODE_OAUTH_TOKEN` via `claude setup-token`.',
+            context: { provider: CLAUDE_CODE_PROVIDER_ID },
+        });
+    }
+    const refreshed = await refreshClaudeUnderLock(vault, stored);
+    return { token: refreshed.accessToken, ...(refreshed.expiresAt !== undefined ? { expiresAt: refreshed.expiresAt } : {}) };
+}
+/**
+ * Refresh + persist under the per-credential lock. Anthropic ROTATES the
+ * refresh_token on every refresh and invalidates the previous one, so two
+ * concurrent refreshes (a second consumer in this process, or another moxxy
+ * process — TUI alongside a desktop runner) must not both burn the same
+ * stored token. Under the lock we:
+ *   1. re-read the vault — if someone else already rotated and the new access
+ *      token is still fresh, reuse it (coalesce; no IdP call at all);
+ *   2. otherwise refresh with the freshest stored refresh_token;
+ *   3. on an invalid_grant-style rejection, re-read once more — if the
+ *      on-disk refresh_token changed under us (another process won a race we
+ *      couldn't see), retry ONCE with the fresher token before declaring
+ *      re-auth necessary.
+ */
+async function refreshClaudeUnderLock(vault, baseline) {
+    return withCredentialLock(`oauth-${CLAUDE_CODE_PROVIDER_ID}`, async () => {
+        const current = (await readStoredCreds(vault, CLAUDE_CODE_PROVIDER_ID)) ?? baseline;
+        if (current.tokenSet.accessToken !== baseline.tokenSet.accessToken && !isExpired(current.tokenSet)) {
+            return current.tokenSet;
+        }
+        const refreshToken = current.tokenSet.refreshToken ?? baseline.tokenSet.refreshToken;
+        if (!refreshToken) {
+            throw new MoxxyError({
+                code: 'AUTH_EXPIRED',
+                message: 'Claude token expired and no refresh_token is stored.',
+                hint: 'Run `moxxy login claude-code` again, or refresh `CLAUDE_CODE_OAUTH_TOKEN` via `claude setup-token`.',
+                context: { provider: CLAUDE_CODE_PROVIDER_ID },
+            });
+        }
+        const email = current.extras.account_email ?? baseline.extras.account_email;
+        try {
+            return await refreshAndPersist(vault, refreshToken, email);
+        }
+        catch (err) {
+            if (isAuthRejection(err)) {
+                const latest = await readStoredCreds(vault, CLAUDE_CODE_PROVIDER_ID);
+                const latestRefresh = latest?.tokenSet.refreshToken;
+                if (latestRefresh && latestRefresh !== refreshToken) {
+                    return refreshAndPersist(vault, latestRefresh, latest.extras.account_email ?? email);
+                }
+            }
+            throw err;
+        }
+    });
+}
+/**
+ * Anthropic's OAuth endpoints (both `claude.ai/oauth/authorize` and the token
+ * endpoint) intermittently return a transient HTTP 500 — the *same* request
+ * then succeeds on retry. So retry 5xx/429/network failures with a short
+ * backoff before giving up. 4xx (bad/expired/already-used code, invalid_grant)
+ * is deterministic and surfaced immediately, never retried.
+ */
+const TOKEN_POST_MAX_ATTEMPTS = 3;
+const TOKEN_POST_BACKOFF_MS = [600, 1800];
+/**
+ * Per-attempt deadline on the token POST. Node's `fetch` has NO default
+ * timeout, so a half-open TCP socket (server accepts but never responds — a
+ * stalled edge node, a black-holing proxy, a captive portal that keeps the
+ * connection alive) would hang the whole login/refresh indefinitely. Bound
+ * each attempt; a timeout aborts the request and is classed as a transient
+ * network error, so the retry loop tries again and ultimately surfaces the
+ * "endpoint kept failing" hint instead of wedging forever.
+ */
+const TOKEN_POST_TIMEOUT_MS = 30_000;
+/** Test seam so the exchange/refresh can run against a fake fetch. */
+let fetchImpl = fetch;
+export function __setClaudeFetch(f) {
+    fetchImpl = f;
+}
+/** Test seam so the OOB login can run without launching a real browser. */
+let openBrowserImpl = openInBrowser;
+export function __setClaudeOpenBrowser(f) {
+    openBrowserImpl = f;
+}
+/** Test seam so the retry backoff doesn't actually sleep under test. */
+let sleepImpl = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+export function __setClaudeSleep(f) {
+    sleepImpl = f;
+}
+/** Test seam to shrink the per-attempt network deadline (default {@link TOKEN_POST_TIMEOUT_MS}). */
+let timeoutMs = TOKEN_POST_TIMEOUT_MS;
+export function __setClaudeTimeoutMs(ms) {
+    timeoutMs = ms;
+}
+async function exchangeClaudeCode(code, state, verifier) {
+    return postClaudeToken({
+        grant_type: 'authorization_code',
+        code,
+        state,
+        client_id: CLAUDE_CLIENT_ID,
+        redirect_uri: CLAUDE_REDIRECT_URI,
+        code_verifier: verifier,
+    });
+}
+async function refreshAndPersist(vault, refreshToken, priorEmail) {
+    const { tokenSet, accountEmail } = await postClaudeToken({
+        grant_type: 'refresh_token',
+        refresh_token: refreshToken,
+        client_id: CLAUDE_CLIENT_ID,
+    });
+    // Claude rotates the refresh_token on every refresh; if a response ever
+    // omits one, keep the prior so we don't lock ourselves out.
+    const merged = tokenSet.refreshToken
+        ? tokenSet
+        : { ...tokenSet, refreshToken };
+    await persistClaudeTokens(vault, merged, accountEmail ?? priorEmail);
+    return merged;
+}
+async function persistClaudeTokens(vault, tokenSet, accountEmail) {
+    await storeTokenSet(vault, CLAUDE_CODE_PROVIDER_ID, tokenSet, {
+        clientId: CLAUDE_CLIENT_ID,
+        tokenUrl: CLAUDE_TOKEN_URL,
+        ...(accountEmail ? { extras: { account_email: accountEmail } } : {}),
+    });
+}
+async function postClaudeToken(body) {
+    let transient = '';
+    for (let attempt = 1; attempt <= TOKEN_POST_MAX_ATTEMPTS; attempt++) {
+        if (attempt > 1)
+            await sleepImpl(TOKEN_POST_BACKOFF_MS[attempt - 2] ?? 1800);
+        let res;
+        try {
+            res = await fetchImpl(CLAUDE_TOKEN_URL, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+                body: JSON.stringify(body),
+                // Bound a hung connection so it surfaces as a retryable network error
+                // (TimeoutError) rather than blocking the login/refresh forever.
+                signal: AbortSignal.timeout(timeoutMs),
+            });
+        }
+        catch (err) {
+            transient = `network error (${err instanceof Error ? err.message : String(err)})`;
+            continue;
+        }
+        if (res.ok) {
+            // A captive portal / proxy / misbehaving edge can return 200 with an HTML
+            // or empty body, or a JSON primitive/array. Treat any of these as a
+            // transient and retry rather than letting a raw SyntaxError escape the
+            // retry/classify path.
+            let parsed;
+            try {
+                parsed = await res.json();
+            }
+            catch {
+                transient = 'HTTP 200 with non-JSON body';
+                continue;
+            }
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                transient = 'HTTP 200 with malformed token response';
+                continue;
+            }
+            const json = parsed;
+            return { tokenSet: parseTokenResponse(json), ...extractAccountEmail(json) };
+        }
+        const text = await res.text().catch(() => '');
+        // Deterministic client errors: surface immediately, don't burn retries.
+        if (res.status < 500 && res.status !== 429) {
+            throw new MoxxyError({
+                code: res.status === 401 || res.status === 403 ? 'AUTH_DENIED' : 'AUTH_INVALID',
+                message: `Claude token endpoint returned HTTP ${res.status}: ${text.slice(0, 300)}`,
+                context: { provider: CLAUDE_CODE_PROVIDER_ID, status: res.status },
+            });
+        }
+        // 5xx / 429 — Anthropic-side flake; loop and try the same request again.
+        transient = `HTTP ${res.status}: ${text.slice(0, 200)}`;
+    }
+    throw new MoxxyError({
+        code: 'AUTH_INVALID',
+        message: `Claude token endpoint kept failing after ${TOKEN_POST_MAX_ATTEMPTS} attempts (last: ${transient}).`,
+        hint: "Anthropic's OAuth endpoint is returning transient errors right now — " +
+            'wait a few seconds and run `moxxy login claude-code` again.',
+        context: { provider: CLAUDE_CODE_PROVIDER_ID },
+    });
+}
+function extractAccountEmail(json) {
+    const account = json.account;
+    if (account && typeof account === 'object') {
+        const email = account.email_address;
+        if (typeof email === 'string' && email)
+            return { accountEmail: email };
+    }
+    return {};
+}
+//# sourceMappingURL=login.js.map

package/dist/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,eAAe,EACf,SAAS,EACT,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,kBAAkB,GAInB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAMxC,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,aAAa,EACb,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAExB,MAAM,YAAY,GAChB,mFAAmF,CAAC;AACtF,MAAM,WAAW,GAAG,wDAAwD,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAwB;IACxD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,+CAA+C;YACxD,IAAI,EACF,mEAAmE;gBACnE,0CAA0C;YAC5C,OAAO,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,IAAI,MAAM,EAAE,CAAC;QACX,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,aAAa,CACjB,GAAG,CAAC,KAAK,EACT,uBAAuB,EACvB,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAC5C,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAC3D,CAAC;QACF,GAAG,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC3C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,YAAY,CAAC;QAC3B,OAAO,EAAE,oBAAoB;QAC7B,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,mBAAmB;QAChC,MAAM,EAAE,CAAC,GAAG,aAAa,CAAC;QAC1B,aAAa,EAAE,SAAS;QACxB,KAAK;QACL,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;KAClC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CACP,gBAAgB,wBAAwB,0BAA0B;QAChE,oEAAoE,OAAO,MAAM;QACjF,8EAA8E;QAC9E,4EAA4E;QAC5E,mEAAmE,CACtE,CAAC;IACF,IAAI,CAAC;QACH,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;IAED,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,oDAAoD;YAC7D,OAAO,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;IACD,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1D,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,IAAI,aAAa,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;QAC7C,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,0DAA0D;YACnE,OAAO,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,aAAa,IAAI,KAAK,EAAE,QAAQ,CAAC,CAAC;IACpG,MAAM,mBAAmB,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC7D,GAAG,CAAC,KAAK,CAAC,wBAAwB,YAAY,CAAC,CAAC,CAAC,OAAO,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClF,8EAA8E;IAC9E,6EAA6E;IAC7E,kFAAkF;IAClF,OAAO;QACL,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAwB;IACzD,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAwB;IACzD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,IAAI,IAAI;QAC9C,0EAA0E;QAC1E,0EAA0E;QAC1E,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,QAAQ,EAAE,SAAS,uBAAuB,IAAI;KAC/C,CAAC;AACJ,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAAiB;IAC7D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5B,IAAI,QAAQ,CAAC,YAAY,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9D,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACpJ,CAAC;IACD,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,UAAU,EAAE,QAAQ,CAAC,YAAY,KAAK,SAAS;KAChD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;QACnC,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,sDAAsD;YAC/D,IAAI,EAAE,qGAAqG;YAC3G,OAAO,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9D,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC5H,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,sBAAsB,CAAC,KAAiB,EAAE,QAAqB;IAC5E,OAAO,kBAAkB,CAAC,SAAS,uBAAuB,EAAE,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC,IAAI,QAAQ,CAAC;QACpF,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,QAAQ,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnG,OAAO,OAAO,CAAC,QAAQ,CAAC;QAC1B,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QACrF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,UAAU,CAAC;gBACnB,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,sDAAsD;gBAC/D,IAAI,EAAE,qGAAqG;gBAC3G,OAAO,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAE;aAC/C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC;QAC5E,IAAI,CAAC;YACH,OAAO,MAAM,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;gBACrE,MAAM,aAAa,GAAG,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC;gBACpD,IAAI,aAAa,IAAI,aAAa,KAAK,YAAY,EAAE,CAAC;oBACpD,OAAO,iBAAiB,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,IAAI,KAAK,CAAC,CAAC;gBACvF,CAAC;YACH,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AASD;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAClC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,IAAI,CAAU,CAAC;AACnD;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,sEAAsE;AACtE,IAAI,SAAS,GAAiB,KAAK,CAAC;AACpC,MAAM,UAAU,gBAAgB,CAAC,CAAe;IAC9C,SAAS,GAAG,CAAC,CAAC;AAChB,CAAC;AAED,2EAA2E;AAC3E,IAAI,eAAe,GAAmC,aAAa,CAAC;AACpE,MAAM,UAAU,sBAAsB,CAAC,CAAiC;IACtE,eAAe,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,wEAAwE;AACxE,IAAI,SAAS,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACjG,MAAM,UAAU,gBAAgB,CAAC,CAAgC;IAC/D,SAAS,GAAG,CAAC,CAAC;AAChB,CAAC;AAED,oGAAoG;AACpG,IAAI,SAAS,GAAG,qBAAqB,CAAC;AACtC,MAAM,UAAU,oBAAoB,CAAC,EAAU;IAC7C,SAAS,GAAG,EAAE,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAAY,EACZ,KAAa,EACb,QAAgB;IAEhB,OAAO,eAAe,CAAC;QACrB,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,KAAK;QACL,SAAS,EAAE,gBAAgB;QAC3B,YAAY,EAAE,mBAAmB;QACjC,aAAa,EAAE,QAAQ;KACxB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAiB,EACjB,YAAoB,EACpB,UAA8B;IAE9B,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,eAAe,CAAC;QACvD,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,YAAY;QAC3B,SAAS,EAAE,gBAAgB;KAC5B,CAAC,CAAC;IACH,wEAAwE;IACxE,4DAA4D;IAC5D,MAAM,MAAM,GAAa,QAAQ,CAAC,YAAY;QAC5C,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,CAAC;IAClC,MAAM,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,IAAI,UAAU,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAiB,EACjB,QAAkB,EAClB,YAAgC;IAEhC,MAAM,aAAa,CAAC,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE;QAC5D,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAA4B;IACzD,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,uBAAuB,EAAE,OAAO,EAAE,EAAE,CAAC;QACpE,IAAI,OAAO,GAAG,CAAC;YAAE,MAAM,SAAS,CAAC,qBAAqB,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAE7E,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,SAAS,CAAC,gBAAgB,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,sEAAsE;gBACtE,iEAAiE;gBACjE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;aACvC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YAClF,SAAS;QACX,CAAC;QAED,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,0EAA0E;YAC1E,oEAAoE;YACpE,uEAAuE;YACvE,uBAAuB;YACvB,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,GAAG,6BAA6B,CAAC;gBAC1C,SAAS;YACX,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,SAAS,GAAG,wCAAwC,CAAC;gBACrD,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,MAAiC,CAAC;YAC/C,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,wEAAwE;QACxE,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC3C,MAAM,IAAI,UAAU,CAAC;gBACnB,IAAI,EAAE,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc;gBAC/E,OAAO,EAAE,uCAAuC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACnF,OAAO,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;QACD,yEAAyE;QACzE,SAAS,GAAG,QAAQ,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,UAAU,CAAC;QACnB,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,4CAA4C,uBAAuB,oBAAoB,SAAS,IAAI;QAC7G,IAAI,EACF,uEAAuE;YACvE,6DAA6D;QAC/D,OAAO,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAE;KAC/C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,IAA6B;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAI,OAAuC,CAAC,aAAa,CAAC;QACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK;YAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/provider.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The Claude subscription provider is the standard Anthropic Messages API
+ * with a bearer (OAuth) credential instead of an API key, so it reuses
+ * `AnthropicProvider` in OAuth mode rather than duplicating the streaming /
+ * tool-call event handling. This module just stamps in the Claude-specific
+ * constants (beta headers + the required identity preamble) and forwards the
+ * resolved token + refresh callback.
+ */
+import { AnthropicProvider } from '@moxxy/plugin-provider-anthropic';
+export interface ClaudeCodeProviderConfig {
+    /** Claude Code OAuth access token (bearer). Resolved by the host. */
+    readonly oauthToken?: string;
+    /** Epoch-ms expiry of `oauthToken`, when known (drives proactive refresh). */
+    readonly oauthExpiresAt?: number;
+    /** Refresh callback wired by the host; omitted for non-refreshable tokens. */
+    readonly oauthRefresh?: () => Promise<{
+        readonly token: string;
+        readonly expiresAt?: number;
+    }>;
+    /** Optional default model override. */
+    readonly defaultModel?: string;
+}
+export declare function createClaudeCodeClient(config?: ClaudeCodeProviderConfig): AnthropicProvider;
+//# sourceMappingURL=provider.d.ts.map

package/dist/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAGrE,MAAM,WAAW,wBAAwB;IACvC,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/F,uCAAuC;IACvC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,wBAAgB,sBAAsB,CAAC,MAAM,GAAE,wBAA6B,GAAG,iBAAiB,CAU/F"}

package/dist/provider.js

@@ -0,0 +1,22 @@
+/**
+ * The Claude subscription provider is the standard Anthropic Messages API
+ * with a bearer (OAuth) credential instead of an API key, so it reuses
+ * `AnthropicProvider` in OAuth mode rather than duplicating the streaming /
+ * tool-call event handling. This module just stamps in the Claude-specific
+ * constants (beta headers + the required identity preamble) and forwards the
+ * resolved token + refresh callback.
+ */
+import { AnthropicProvider } from '@moxxy/plugin-provider-anthropic';
+import { CLAUDE_CODE_PROVIDER_ID, CLAUDE_CODE_SYSTEM, CLAUDE_OAUTH_BETA } from './constants.js';
+export function createClaudeCodeClient(config = {}) {
+    return new AnthropicProvider({
+        name: CLAUDE_CODE_PROVIDER_ID,
+        oauthBeta: [...CLAUDE_OAUTH_BETA],
+        systemPreamble: CLAUDE_CODE_SYSTEM,
+        ...(config.oauthToken ? { oauthToken: config.oauthToken } : {}),
+        ...(config.oauthExpiresAt !== undefined ? { oauthExpiresAt: config.oauthExpiresAt } : {}),
+        ...(config.oauthRefresh ? { oauthRefresh: config.oauthRefresh } : {}),
+        ...(config.defaultModel ? { defaultModel: config.defaultModel } : {}),
+    });
+}
+//# sourceMappingURL=provider.js.map

package/dist/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAahG,MAAM,UAAU,sBAAsB,CAAC,SAAmC,EAAE;IAC1E,OAAO,IAAI,iBAAiB,CAAC;QAC3B,IAAI,EAAE,uBAAuB;QAC7B,SAAS,EAAE,CAAC,GAAG,iBAAiB,CAAC;QACjC,cAAc,EAAE,kBAAkB;QAClC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC,CAAC;AACL,CAAC"}