@oneie/claude 0.9.0 → 0.10.0

package/scripts/node_modules/@anthropic-ai/sdk/src/lib/beta-parser.ts

@@ -1,148 +0,0 @@
-import type { Logger } from '../client';
-import { AnthropicError } from '../core/error';
-import {
-  BetaContentBlock,
-  BetaJSONOutputFormat,
-  BetaMessage,
-  BetaOutputConfig,
-  BetaTextBlock,
-  MessageCreateParams,
-} from '../resources/beta/messages/messages';
-
-// vendored from typefest just to make things look a bit nicer on hover
-type Simplify<T> = { [KeyType in keyof T]: T[KeyType] } & {};
-
-type AutoParseableBetaOutputConfig = Omit<BetaOutputConfig, 'format'> & {
-  format?: BetaJSONOutputFormat | AutoParseableBetaOutputFormat<any> | null;
-};
-
-export type BetaParseableMessageCreateParams = Simplify<
-  Omit<MessageCreateParams, 'output_format' | 'output_config'> & {
-    /**
-     * @deprecated Use `output_config.format` instead. This parameter will be removed in a future
-     *   release.
-     */
-    output_format?: BetaJSONOutputFormat | AutoParseableBetaOutputFormat<any> | null;
-    output_config?: AutoParseableBetaOutputConfig | null;
-  }
->;
-
-export type ExtractParsedContentFromBetaParams<Params extends BetaParseableMessageCreateParams> =
-  Params['output_format'] extends AutoParseableBetaOutputFormat<infer P> ? P
-  : Params['output_config'] extends { format: AutoParseableBetaOutputFormat<infer P> } ? P
-  : null;
-
-export type AutoParseableBetaOutputFormat<ParsedT> = BetaJSONOutputFormat & {
-  parse(content: string): ParsedT;
-};
-
-export type ParsedBetaMessage<ParsedT> = BetaMessage & {
-  content: Array<ParsedBetaContentBlock<ParsedT>>;
-  parsed_output: ParsedT | null;
-};
-
-export type ParsedBetaContentBlock<ParsedT> =
-  | (BetaTextBlock & { parsed_output: ParsedT | null })
-  | Exclude<BetaContentBlock, BetaTextBlock>;
-
-function getOutputFormat(
-  params: BetaParseableMessageCreateParams | null,
-): BetaJSONOutputFormat | AutoParseableBetaOutputFormat<any> | null | undefined {
-  // Prefer output_format (deprecated) over output_config.format for backward compatibility
-  return params?.output_format ?? params?.output_config?.format;
-}
-
-export function maybeParseBetaMessage<Params extends BetaParseableMessageCreateParams | null>(
-  message: BetaMessage,
-  params: Params,
-  opts: { logger: Logger },
-): ParsedBetaMessage<ExtractParsedContentFromBetaParams<NonNullable<Params>>> {
-  const outputFormat = getOutputFormat(params);
-  if (!params || !('parse' in (outputFormat ?? {}))) {
-    return {
-      ...message,
-      content: message.content.map((block) => {
-        if (block.type === 'text') {
-          const parsedBlock = Object.defineProperty({ ...block }, 'parsed_output', {
-            value: null,
-            enumerable: false,
-          }) as ParsedBetaContentBlock<ExtractParsedContentFromBetaParams<NonNullable<Params>>>;
-
-          return Object.defineProperty(parsedBlock, 'parsed', {
-            get() {
-              opts.logger.warn(
-                'The `parsed` property on `text` blocks is deprecated, please use `parsed_output` instead.',
-              );
-              return null;
-            },
-            enumerable: false,
-          });
-        }
-        return block;
-      }),
-      parsed_output: null,
-    } as ParsedBetaMessage<ExtractParsedContentFromBetaParams<NonNullable<Params>>>;
-  }
-
-  return parseBetaMessage(message, params, opts);
-}
-
-export function parseBetaMessage<Params extends BetaParseableMessageCreateParams>(
-  message: BetaMessage,
-  params: Params,
-  opts: { logger: Logger },
-): ParsedBetaMessage<ExtractParsedContentFromBetaParams<Params>> {
-  let firstParsedOutput: ReturnType<typeof parseBetaOutputFormat<Params>> | null = null;
-
-  const content: Array<ParsedBetaContentBlock<ExtractParsedContentFromBetaParams<Params>>> =
-    message.content.map((block) => {
-      if (block.type === 'text') {
-        const parsedOutput = parseBetaOutputFormat(params, block.text);
-
-        if (firstParsedOutput === null) {
-          firstParsedOutput = parsedOutput;
-        }
-
-        const parsedBlock = Object.defineProperty({ ...block }, 'parsed_output', {
-          value: parsedOutput,
-          enumerable: false,
-        }) as ParsedBetaContentBlock<ExtractParsedContentFromBetaParams<Params>>;
-        return Object.defineProperty(parsedBlock, 'parsed', {
-          get() {
-            opts.logger.warn(
-              'The `parsed` property on `text` blocks is deprecated, please use `parsed_output` instead.',
-            );
-            return parsedOutput;
-          },
-          enumerable: false,
-        });
-      }
-      return block;
-    });
-
-  return {
-    ...message,
-    content,
-    parsed_output: firstParsedOutput,
-  } as ParsedBetaMessage<ExtractParsedContentFromBetaParams<Params>>;
-}
-
-function parseBetaOutputFormat<Params extends BetaParseableMessageCreateParams>(
-  params: Params,
-  content: string,
-): ExtractParsedContentFromBetaParams<Params> | null {
-  const outputFormat = getOutputFormat(params);
-  if (outputFormat?.type !== 'json_schema') {
-    return null;
-  }
-
-  try {
-    if ('parse' in outputFormat) {
-      return outputFormat.parse(content);
-    }
-
-    return JSON.parse(content);
-  } catch (error) {
-    throw new AnthropicError(`Failed to parse structured output: ${error}`);
-  }
-}

package/scripts/node_modules/@anthropic-ai/sdk/src/lib/credentials/credential-chain.ts

@@ -1,292 +0,0 @@
-import type { Fetch } from '../../internal/builtin-types';
-import { readEnv } from '../../internal/utils/env';
-import {
-  CREDENTIALS_FILE_VERSION,
-  loadConfigWithSource,
-  getCredentialsPath,
-  type AnthropicConfig,
-} from '../../core/credentials';
-import type { AccessTokenProvider, CredentialResult, IdentityTokenProvider } from './types';
-import {
-  MANDATORY_REFRESH_THRESHOLD_IN_SECONDS,
-  WorkloadIdentityError,
-  checkCredentialsFileSafety,
-  writeCredentialsFileAtomic,
-} from './types';
-import { nowAsSeconds } from '../../internal/utils/time';
-import { identityTokenFromFile, identityTokenFromValue } from './identity-token';
-import { oidcFederationProvider } from './oidc-federation';
-import { userOAuthProvider } from './user-oauth';
-
-/**
- * Builds a {@link CredentialResult} from an explicit {@link AnthropicConfig}.
- *
- * Use this when constructing a client from an in-memory config object rather
- * than from profile files or environment variables.
- *
- * For `oidc_federation`, `authentication.credentials_path` is optional —
- * if omitted, every call performs a fresh exchange with no on-disk cache.
- * For `user_oauth`, `authentication.credentials_path` is required (it is
- * where the access/refresh tokens live).
- */
-export type ResolverOptions = {
-  baseURL: string;
-  fetch: Fetch;
-  userAgent?: string | undefined;
-  onCacheWriteError?: ((err: unknown) => void) | undefined;
-  onSafetyWarning?: ((msg: string) => void) | undefined;
-};
-
-export function resolveCredentialsFromConfig(
-  config: AnthropicConfig,
-  options: ResolverOptions,
-): CredentialResult {
-  const credentialsPath = config.authentication.credentials_path ?? null;
-  const effectiveBaseURL = (config.base_url || options.baseURL).replace(/\/+$/, '');
-
-  const provider = buildProvider(config, credentialsPath, effectiveBaseURL, options);
-
-  const extraHeaders: Record<string, string> = {};
-  // For federation profiles workspace_id is sent in the jwt-bearer exchange
-  // body, not as a request header (the minted token is already
-  // workspace-scoped, so the header would be ignored).
-  if (config.workspace_id && config.authentication.type === 'user_oauth') {
-    extraHeaders['anthropic-workspace-id'] = config.workspace_id;
-  }
-
-  // Surface the profile's own base_url (not the options.baseURL fallback) so
-  // the client can adopt it for outbound API requests when the caller didn't
-  // pin one explicitly. Echoing options.baseURL back would defeat precedence.
-  return { provider, extraHeaders, baseURL: config.base_url || undefined };
-}
-
-/**
- * Resolves a {@link CredentialResult} from the environment. Returns `null`
- * when no credentials can be resolved.
- *
- * Resolution order:
- *
- *   1. Config file for the active profile (or the explicit `profile` argument)
- *      → dispatch on `authentication.type` (`oidc_federation`, `user_oauth`)
- *   2. Environment variables `ANTHROPIC_FEDERATION_RULE_ID` +
- *      `ANTHROPIC_ORGANIZATION_ID` (+ identity token) → OIDC federation
- *   3. Nothing matches → `null`
- *
- * Passing `profile` selects `<config_dir>/configs/<profile>.json` directly,
- * skipping `ANTHROPIC_PROFILE` / `active_config` resolution.
- */
-export async function defaultCredentials(
-  options: ResolverOptions,
-  profile?: string,
-): Promise<CredentialResult | null> {
-  const loaded = await loadConfigWithSource(profile);
-  if (!loaded) {
-    return null;
-  }
-  const { config, fromFile } = loaded;
-
-  // For file-loaded configs, default credentials_path to the per-profile
-  // location so user_oauth and federation caching work. Shallow-clone first
-  // so callers that retain a reference to the loaded config don't observe the
-  // patched-in default.
-  //
-  // Env-only credentials (no profile file on disk) skip the disk cache —
-  // matching the other SDKs. A disk cache keyed by profile path would
-  // re-serve a stale token after a change to ANTHROPIC_WORKSPACE_ID (or
-  // ANTHROPIC_ORGANIZATION_ID / ANTHROPIC_FEDERATION_RULE_ID) until the
-  // cached token expired, so the env-only chain stays in-memory only.
-  const withPath: AnthropicConfig =
-    config.authentication.credentials_path || !fromFile ?
-      config
-    : {
-        ...config,
-        authentication: {
-          ...config.authentication,
-          credentials_path: (await getCredentialsPath(config, profile)) ?? undefined,
-        },
-      };
-
-  return resolveCredentialsFromConfig(withPath, options);
-}
-
-function buildProvider(
-  config: AnthropicConfig,
-  credentialsPath: string | null,
-  baseURL: string,
-  options: ResolverOptions,
-): AccessTokenProvider {
-  switch (config.authentication.type) {
-    case 'oidc_federation': {
-      const auth = config.authentication;
-      const identityProvider = resolveIdentityTokenProvider(auth);
-      if (!identityProvider) {
-        throw new WorkloadIdentityError(
-          'oidc_federation config requires an identity token (set authentication.identity_token, ' +
-            'ANTHROPIC_IDENTITY_TOKEN_FILE, or ANTHROPIC_IDENTITY_TOKEN)',
-        );
-      }
-      if (!auth.federation_rule_id) {
-        throw new WorkloadIdentityError(
-          "oidc_federation config requires 'federation_rule_id'. Set it in authentication.federation_rule_id in your profile, or via ANTHROPIC_FEDERATION_RULE_ID (profile takes precedence).",
-        );
-      }
-      if (!config.organization_id) {
-        throw new WorkloadIdentityError(
-          'oidc_federation config requires organization_id (set ANTHROPIC_ORGANIZATION_ID or config.organization_id)',
-        );
-      }
-
-      const exchange = oidcFederationProvider({
-        identityTokenProvider: identityProvider,
-        federationRuleId: auth.federation_rule_id,
-        organizationId: config.organization_id,
-        serviceAccountId: auth.service_account_id,
-        workspaceId: config.workspace_id,
-        baseURL,
-        fetch: options.fetch,
-        userAgent: options.userAgent,
-      });
-
-      // If there's a credentials file path, wrap the exchange with file caching
-      // (check file for fresh token before exchanging, write back after).
-      if (credentialsPath) {
-        return cachedExchangeProvider(
-          exchange,
-          credentialsPath,
-          options.onCacheWriteError,
-          options.onSafetyWarning,
-        );
-      }
-      return exchange;
-    }
-
-    case 'user_oauth': {
-      if (!credentialsPath) {
-        throw new WorkloadIdentityError(
-          'user_oauth config requires authentication.credentials_path ' +
-            '(or load via a profile so it defaults to <config_dir>/credentials/<profile>.json)',
-        );
-      }
-      return userOAuthProvider({
-        credentialsPath,
-        clientId: config.authentication.client_id,
-        baseURL,
-        fetch: options.fetch,
-        userAgent: options.userAgent,
-        onSafetyWarning: options.onSafetyWarning,
-      });
-    }
-
-    default: {
-      const t = (config.authentication as { type: string }).type;
-      throw new WorkloadIdentityError(`authentication.type "${t}" is not a known authentication type`);
-    }
-  }
-}
-
-/**
- * Resolves the identity token provider from config fields or environment variables.
- *
- * Resolution order:
- *   1. `identity_token.path` from the config (source: "file")
- *   2. `ANTHROPIC_IDENTITY_TOKEN_FILE` env var
- *   3. `ANTHROPIC_IDENTITY_TOKEN` env var (static value)
- */
-function resolveIdentityTokenProvider(
-  auth: Extract<AnthropicConfig['authentication'], { type: 'oidc_federation' }>,
-): IdentityTokenProvider | null {
-  if (auth.identity_token) {
-    // Cast needed to stringify an unknown source value for the error message:
-    // the on-disk JSON may contain a source this SDK version doesn't know about.
-    const source = (auth.identity_token as { source: string }).source;
-    if (source !== 'file') {
-      throw new WorkloadIdentityError(
-        `identity_token.source "${source}" is not supported by this SDK version (only "file")`,
-      );
-    }
-    if (!auth.identity_token.path) {
-      throw new WorkloadIdentityError(`identity_token.source "file" requires a non-empty path`);
-    }
-    return identityTokenFromFile(auth.identity_token.path);
-  }
-
-  const tokenFile = readEnv('ANTHROPIC_IDENTITY_TOKEN_FILE');
-  if (tokenFile) {
-    return identityTokenFromFile(tokenFile);
-  }
-
-  const tokenValue = readEnv('ANTHROPIC_IDENTITY_TOKEN');
-  if (tokenValue) {
-    return identityTokenFromValue(tokenValue);
-  }
-
-  return null;
-}
-
-/**
- * Wraps a federation exchange provider with credential file caching.
- * Checks the file for a fresh token before exchanging, and writes the
- * result back after a successful exchange (best-effort, atomic replace).
- *
- * Note: this is not cross-process serialized — two SDK instances that
- * miss the cache simultaneously will both perform a full exchange and
- * the last writer wins. That is acceptable: federation exchanges are
- * idempotent and the cache is an optimization, not a correctness gate.
- */
-function cachedExchangeProvider(
-  exchange: AccessTokenProvider,
-  credentialsPath: string,
-  onCacheWriteError: ((err: unknown) => void) | undefined,
-  onSafetyWarning: ((msg: string) => void) | undefined,
-): AccessTokenProvider {
-  return async (opts) => {
-    const fs = await import('node:fs');
-
-    await checkCredentialsFileSafety(credentialsPath, onSafetyWarning);
-
-    // Try cached credentials file
-    let existing: Record<string, unknown> | undefined;
-    try {
-      const raw = await fs.promises.readFile(credentialsPath, 'utf-8');
-      existing = JSON.parse(raw);
-      const token = existing?.['access_token'] as string | undefined;
-      if (token && !opts?.forceRefresh) {
-        const expiresAt = existing?.['expires_at'] as number | undefined;
-        if (expiresAt == null || nowAsSeconds() < expiresAt - MANDATORY_REFRESH_THRESHOLD_IN_SECONDS) {
-          return { token, expiresAt: expiresAt ?? null };
-        }
-      }
-    } catch (err) {
-      // ENOENT or invalid-JSON → no usable cache, exchange fresh. Other
-      // errors (EACCES, EISDIR, …) indicate a broken cache path; surface to
-      // the optional hook so they're at least debuggable, then proceed.
-      const code = (err as NodeJS.ErrnoException)?.code;
-      if (code !== 'ENOENT' && !(err instanceof SyntaxError)) {
-        onCacheWriteError?.(err);
-      }
-    }
-
-    // Exchange for a new token
-    const result = await exchange(opts);
-
-    // Write cache back (best-effort). Preserve any unknown keys from the
-    // existing file (notably refresh_token, in the unlikely case this path
-    // is shared with a user_oauth profile) so the federation cache writer
-    // doesn't clobber material it didn't own.
-    try {
-      await writeCredentialsFileAtomic(credentialsPath, {
-        ...(existing ?? {}),
-        version: CREDENTIALS_FILE_VERSION,
-        type: 'oauth_token',
-        access_token: result.token,
-        expires_at: result.expiresAt,
-      });
-    } catch (err) {
-      // Best-effort caching: surface to the optional hook but never fail
-      // the exchange itself.
-      onCacheWriteError?.(err);
-    }
-
-    return result;
-  };
-}

package/scripts/node_modules/@anthropic-ai/sdk/src/lib/credentials/identity-token.ts

@@ -1,37 +0,0 @@
-import { AnthropicError } from '../../core/error';
-import type { IdentityTokenProvider } from './types';
-
-/**
- * Reads a JWT from a file on every call. Supports automatic rotation
- * (e.g. Kubernetes projected service-account tokens).
- */
-export function identityTokenFromFile(path: string): IdentityTokenProvider {
-  if (!path) {
-    throw new AnthropicError('Identity token file path is empty');
-  }
-
-  return async () => {
-    const fs = await import('node:fs');
-    let content: string;
-    try {
-      content = await fs.promises.readFile(path, 'utf-8');
-    } catch (err) {
-      throw new AnthropicError(`Failed to read identity token file at ${path}: ${err}`);
-    }
-    const token = content.trim();
-    if (!token) {
-      throw new AnthropicError(`Identity token file at ${path} is empty`);
-    }
-    return token;
-  };
-}
-
-/**
- * Wraps a static JWT string as an {@link IdentityTokenProvider}.
- */
-export function identityTokenFromValue(token: string): IdentityTokenProvider {
-  if (!token) {
-    throw new AnthropicError('Identity token value is empty');
-  }
-  return () => token;
-}

package/scripts/node_modules/@anthropic-ai/sdk/src/lib/credentials/oidc-federation.ts

@@ -1,140 +0,0 @@
-import type { Fetch } from '../../internal/builtin-types';
-import type { AccessTokenProvider, IdentityTokenProvider } from './types';
-import {
-  FEDERATION_BETA_HEADER,
-  GRANT_TYPE_JWT_BEARER,
-  OAUTH_API_BETA_HEADER,
-  TOKEN_ENDPOINT,
-  WorkloadIdentityError,
-  parseTokenResponse,
-  redactSensitive,
-  requireSecureTokenEndpoint,
-} from './types';
-import { nowAsSeconds } from '../../internal/utils/time';
-import { VERSION } from '../../version';
-
-export type OIDCFederationConfig = {
-  identityTokenProvider: IdentityTokenProvider;
-  federationRuleId: string;
-  organizationId: string;
-  serviceAccountId?: string | undefined;
-  /**
-   * Optional `wrkspc_*` tagged ID, or the literal `"default"` to scope the
-   * token to the organization's default workspace. When omitted the server
-   * picks the rule's sole enabled workspace, else the org default if the rule
-   * covers it. Required when the rule enables more than one non-default
-   * workspace, or to target a specific workspace other than the one the
-   * server would pick. The minted token is workspace-scoped: per-request
-   * workspace selection (the `anthropic-workspace-id` header) is not supported
-   * for federation tokens — switching workspaces requires a new token exchange
-   * with a different `workspaceId`.
-   */
-  workspaceId?: string | undefined;
-  baseURL: string;
-  fetch: Fetch;
-  /**
-   * Overrides the outgoing User-Agent header on the token exchange. When
-   * empty, sends an SDK-identified UA so the token endpoint's access logs
-   * identify the caller.
-   */
-  userAgent?: string | undefined;
-};
-
-/**
- * Exchanges an external OIDC JWT for an Anthropic access token via the
- * RFC 7523 jwt-bearer grant.
- *
- * Each invocation performs a fresh token exchange. Wrap in a
- * {@link TokenCache} to avoid exchanging on every request.
- *
- * Federation grants do not return a refresh token — callers re-exchange
- * their assertion on expiry.
- */
-export function oidcFederationProvider(config: OIDCFederationConfig): AccessTokenProvider {
-  return async () => {
-    requireSecureTokenEndpoint(config.baseURL);
-
-    const jwt = await config.identityTokenProvider();
-    // The token endpoint enforces a 16 KiB assertion limit; surface a clear
-    // client-side error so misconfigured projected-token sources are
-    // diagnosable without a server round-trip.
-    if (jwt.length > 16 * 1024) {
-      throw new WorkloadIdentityError(
-        `Identity token is ${Math.ceil(jwt.length / 1024)} KiB, exceeds the 16 KiB assertion limit`,
-      );
-    }
-
-    const body: Record<string, string> = {
-      grant_type: GRANT_TYPE_JWT_BEARER,
-      assertion: jwt,
-      federation_rule_id: config.federationRuleId,
-      organization_id: config.organizationId,
-    };
-    if (config.serviceAccountId) {
-      body['service_account_id'] = config.serviceAccountId;
-    }
-    if (config.workspaceId) {
-      body['workspace_id'] = config.workspaceId;
-    }
-
-    const url = `${config.baseURL}${TOKEN_ENDPOINT}`;
-    let resp: Response;
-    try {
-      resp = await config.fetch(url, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-          'anthropic-beta': `${OAUTH_API_BETA_HEADER},${FEDERATION_BETA_HEADER}`,
-          'User-Agent': config.userAgent || `anthropic-sdk-typescript/${VERSION} oidcFederationProvider`,
-        },
-        body: JSON.stringify(body),
-      });
-    } catch (err) {
-      throw new WorkloadIdentityError(`Failed to reach token endpoint ${url}: ${err}`);
-    }
-
-    const requestId = resp.headers.get('Request-Id');
-
-    if (!resp.ok) {
-      const text = await resp.text().catch(() => '');
-      const redacted = redactSensitive(text);
-      // A 401 is hard to debug from the status code alone, so surface
-      // guidance: check the federation rule, optionally set a workspace ID
-      // (the most common fix when no workspaceId is configured), and point at
-      // the Workload identity page in Claude Console for the server-side
-      // authentication event log. Other statuses (5xx, 400, ...) get no hint.
-      let hint = '';
-      if (resp.status === 401) {
-        const hintMiddle =
-          config.workspaceId ? '' : (
-            "If your federation rule is scoped to multiple workspaces, set the ANTHROPIC_WORKSPACE_ID environment variable, the 'workspace_id' config key, or the `workspaceId` option. "
-          );
-        hint = ` Ensure your federation rule matches your identity token. ${hintMiddle}View your authentication events in the Workload identity page of Claude Console for more details.`;
-      }
-      throw new WorkloadIdentityError(
-        `Token exchange failed with status ${resp.status}${
-          requestId ? ` (request-id ${requestId})` : ''
-        }: ${redacted}${hint}`,
-        resp.status,
-        redacted,
-        requestId,
-      );
-    }
-
-    const data = await parseTokenResponse(resp, requestId);
-    const expiresIn = Number(data.expires_in);
-    if (!Number.isFinite(expiresIn)) {
-      throw new WorkloadIdentityError(
-        `Token endpoint response missing required fields: ${JSON.stringify(redactSensitive(data))}`,
-        resp.status,
-        redactSensitive(data),
-        requestId,
-      );
-    }
-
-    return {
-      token: data.access_token,
-      expiresAt: nowAsSeconds() + expiresIn,
-    };
-  };
-}