@scrylog/cli 0.3.0 → 0.3.2

package/src/usage/providers/claude.ts

@@ -1,233 +0,0 @@
-import type { UsageClient } from "../client";
-import {
-  AnthropicOAuthUsageClient,
-  fetchOAuthProfile,
-} from "../clients/anthropic-oauth-usage";
-import { InvalidCredentialsError, AnthropicWebUsageClient } from "../clients/anthropic-web-usage";
-import { ClaudeCliProbeClient } from "../clients/claude-cli-probe";
-import { classifyUsageError, UsageError } from "../errors";
-import { mapClaudeToEntry } from "../mappers";
-import type { ClaudeSourcePlanner } from "../planner";
-import type { TokenResolver } from "../resolver";
-import type {
-  ClaudeOAuthCredentials,
-  ClaudePlannedRoute,
-  ClaudeUsageSnapshot,
-  ClaudeWebSession,
-  UsageProviderEntry,
-} from "../types";
-
-interface ClaudeClients {
-  oauth: UsageClient<ClaudeOAuthCredentials, ClaudeUsageSnapshot>;
-  web: UsageClient<ClaudeWebSession, ClaudeUsageSnapshot>;
-  cli: UsageClient<string, ClaudeUsageSnapshot>;
-}
-
-interface WebExtrasPrimaryIdentity {
-  email: string | null;
-  organizationId: string | null;
-  organizationName: string | null;
-}
-
-interface KeychainDiagnostics {
-  describeKeychainFailure?(): string | null;
-}
-
-const DEFAULT_PROFILE_IDENTITY_TTL_MS = 30 * 60 * 1_000;
-
-function nullIdentity(): WebExtrasPrimaryIdentity {
-  return { email: null, organizationId: null, organizationName: null };
-}
-
-function normalizedIdentity(value: string | null | undefined): string | null {
-  const trimmed = value?.trim().toLowerCase();
-  return trimmed ? trimmed : null;
-}
-
-function webExtrasIdentityMatches(primary: WebExtrasPrimaryIdentity, web: ClaudeUsageSnapshot): boolean {
-  const webEmail = normalizedIdentity(web.accountEmail);
-  if (primary.email && webEmail && normalizedIdentity(primary.email) === webEmail) return true;
-  const webOrganizationId = normalizedIdentity(web.accountOrganizationId);
-  if (primary.organizationId && webOrganizationId && normalizedIdentity(primary.organizationId) === webOrganizationId) return true;
-  const webOrganizationName = normalizedIdentity(web.accountOrganization);
-  if (primary.organizationName && webOrganizationName && normalizedIdentity(primary.organizationName) === webOrganizationName) return true;
-  return false;
-}
-
-export class ClaudeUsageProvider {
-  private readonly clients: ClaudeClients;
-  private readonly oauthResolver: TokenResolver<ClaudeOAuthCredentials> & KeychainDiagnostics;
-  private readonly webResolver: TokenResolver<ClaudeWebSession> & KeychainDiagnostics;
-  private readonly profileIdentityTtlMs: number;
-  private profileIdentity?: { token: string; identity: WebExtrasPrimaryIdentity; fetchedAt: number };
-
-  constructor(
-    private readonly planner: ClaudeSourcePlanner,
-    oauthResolver: TokenResolver<ClaudeOAuthCredentials> & KeychainDiagnostics,
-    webResolver: TokenResolver<ClaudeWebSession> & KeychainDiagnostics,
-    _cliResolver: TokenResolver<string>,
-    clients?: Partial<ClaudeClients>,
-    options?: { profileIdentityTtlMs?: number },
-  ) {
-    this.oauthResolver = oauthResolver;
-    this.webResolver = webResolver;
-    this.profileIdentityTtlMs = options?.profileIdentityTtlMs ?? DEFAULT_PROFILE_IDENTITY_TTL_MS;
-    this.clients = {
-      oauth: clients?.oauth ?? new AnthropicOAuthUsageClient(),
-      web: clients?.web ?? new AnthropicWebUsageClient(),
-      cli: clients?.cli ?? new ClaudeCliProbeClient(),
-    };
-  }
-
-  async fetch(options?: { signal?: AbortSignal }): Promise<{ entry: UsageProviderEntry; snapshot: ClaudeUsageSnapshot | null }> {
-    const decision = await this.planner.decide();
-    if (decision.routes.length === 0) {
-      // Surface actionable keychain diagnostics when a blocking failure (not
-      // merely missing credentials) explains the empty route plan.
-      const reason =
-        this.oauthResolver.describeKeychainFailure?.() ??
-        this.webResolver.describeKeychainFailure?.() ??
-        null;
-      return { entry: mapClaudeToEntry(null, reason ? [reason] : [], false, null), snapshot: null };
-    }
-
-    const errors: string[] = [];
-    let sawNonAuthFailure = false;
-    for (let index = 0; index < decision.routes.length; index++) {
-      const route = decision.routes[index]!;
-      try {
-        const snapshot = await this.fetchRoute(route, options);
-        const withExtras = await this.mergeWebExtras(snapshot, route, decision.webExtrasCredentials, options);
-        const winningOAuth = route.type === "oauth" ? route.credentials : null;
-        return { entry: mapClaudeToEntry(withExtras, [], true, winningOAuth), snapshot: withExtras };
-      } catch (error) {
-        const classified = error instanceof InvalidCredentialsError
-          ? new UsageError("invalid-credentials", error.message)
-          : classifyUsageError(error);
-        if (classified.kind === "cancelled") throw classified;
-        errors.push(`${route.type}: ${classified.message}`);
-        if (classified.kind !== "invalid-credentials") sawNonAuthFailure = true;
-        if (classified.kind === "invalid-credentials" && route.type === "oauth") {
-          // Invalidate the daemon-lifetime credential cache so the next poll
-          // re-resolves the OAuth source after an authentication rejection.
-          // The profile identity cache is keyed by token, so dropping it
-          // forces re-verification once the rotated token arrives.
-          (this.oauthResolver as Partial<{ invalidate?: () => void }>).invalidate?.();
-          this.profileIdentity = undefined;
-        }
-        const canRecover = classified.kind === "invalid-credentials" && index + 1 < decision.routes.length;
-        if (!canRecover) break;
-      }
-    }
-
-    if (errors.length > 0 && !sawNonAuthFailure) {
-      // Every attempted route failed with authentication failures: surface a
-      // single actionable state instead of raw probe errors.
-      const sessionExpired = errors.some((message) => message.includes("expired") || message.includes("re-login"));
-      if (sessionExpired) {
-        return {
-          entry: mapClaudeToEntry(null, ["Claude session expired — run \"claude\" to re-login"], false, null),
-          snapshot: null,
-        };
-      }
-      return { entry: mapClaudeToEntry(null, [], false, null), snapshot: null };
-    }
-
-    return { entry: mapClaudeToEntry(null, errors, true, null), snapshot: null };
-  }
-
-  private fetchRoute(
-    route: ClaudePlannedRoute,
-    options?: { signal?: AbortSignal },
-  ): Promise<ClaudeUsageSnapshot> {
-    if (route.type === "oauth") {
-      if (route.credentials.isStale) {
-        return Promise.reject(new UsageError("invalid-credentials", "Claude-owned OAuth token is expired or near expiry"));
-      }
-      return this.clients.oauth.fetch(route.credentials, options);
-    }
-    if (route.type === "web") return this.fetchWebRoute(route.credentials, options);
-    return this.clients.cli.fetch(route.credentials, options);
-  }
-
-  private async fetchWebRoute(
-    session: ClaudeWebSession,
-    options?: { signal?: AbortSignal },
-  ): Promise<ClaudeUsageSnapshot> {
-    let cookieHeader = session.cookieHeader;
-    if (!cookieHeader && session.importNext) {
-      cookieHeader = (await session.importNext()) ?? "";
-    }
-    if (!cookieHeader) {
-      // Prefer the resolver's keychain diagnostic when a blocking failure (not
-      // a transient import miss) is why no web session could be produced. It
-      // is an environment failure, not rejected credentials, so transient
-      // classification keeps the reason visible in the reported entry.
-      const reason = this.webResolver.describeKeychainFailure?.();
-      throw new UsageError(
-        reason ? "transient" : "invalid-credentials",
-        reason
-          ? `${reason} (no Claude web session available)`
-          : "No Claude web session available",
-      );
-    }
-    return this.clients.web.fetch({ ...session, cookieHeader }, options);
-  }
-
-  private async mergeWebExtras(
-    snapshot: ClaudeUsageSnapshot,
-    route: ClaudePlannedRoute,
-    webCredentials: ClaudeWebSession | undefined,
-    options?: { signal?: AbortSignal },
-  ): Promise<ClaudeUsageSnapshot> {
-    if (!webCredentials || snapshot.source === "web") return snapshot;
-    try {
-      const web = await this.clients.web.fetch(webCredentials, options);
-      const primary = await this.primaryWebExtrasIdentity(snapshot, route, options);
-      if (!webExtrasIdentityMatches(primary, web)) return snapshot;
-      return {
-        ...snapshot,
-        extraRateWindows: snapshot.extraRateWindows.length === 0 ? web.extraRateWindows : snapshot.extraRateWindows,
-        providerCost: snapshot.providerCost ?? web.providerCost,
-      };
-    } catch (error) {
-      if (classifyUsageError(error).kind === "cancelled") throw error;
-      return snapshot;
-    }
-  }
-
-  private async primaryWebExtrasIdentity(
-    snapshot: ClaudeUsageSnapshot,
-    route: ClaudePlannedRoute,
-    options?: { signal?: AbortSignal },
-  ): Promise<WebExtrasPrimaryIdentity> {
-    if (snapshot.accountEmail || snapshot.accountOrganization || snapshot.accountOrganizationId) {
-      return {
-        email: snapshot.accountEmail,
-        organizationId: snapshot.accountOrganizationId,
-        organizationName: snapshot.accountOrganization,
-      };
-    }
-    if (route.type !== "oauth") return nullIdentity();
-
-    const token = route.credentials.accessToken;
-    const cached = this.profileIdentity;
-    if (cached && cached.token === token && Date.now() - cached.fetchedAt < this.profileIdentityTtlMs) {
-      return cached.identity;
-    }
-    try {
-      const profile = await fetchOAuthProfile(token, options);
-      const identity: WebExtrasPrimaryIdentity = {
-        email: profile.email,
-        organizationId: profile.organizationId,
-        organizationName: null,
-      };
-      this.profileIdentity = { token, identity, fetchedAt: Date.now() };
-      return identity;
-    } catch (error) {
-      if (classifyUsageError(error).kind === "cancelled") throw error;
-      // Best-effort: do not cache failures so the next poll can retry.
-      return nullIdentity();
-    }
-  }
-}

package/src/usage/providers/codex.ts

@@ -1,115 +0,0 @@
-import type { UsageClient } from "../client";
-import type { CodexDataSource, CodexOAuthCredentials, CodexUsageSnapshot, UsageProviderEntry } from "../types";
-import type { TokenResolver } from "../resolver";
-import { CodexMonthlySpendClient, CodexOAuthUsageClient } from "../clients/codex-oauth-usage";
-import { CodexAppServerClient } from "../clients/codex-app-server";
-import { classifyUsageError, isRecoverableAuthenticationError } from "../errors";
-import { isCodexCredentialFresh } from "../resolvers/codex-auth";
-import { mapCodexToEntry } from "../mappers";
-
-interface CodexAppServerUsageClient {
-  fetch(
-    identity?: Pick<CodexOAuthCredentials, "accountEmail" | "accountId">,
-    options?: { signal?: AbortSignal },
-  ): Promise<CodexUsageSnapshot>;
-}
-
-interface CodexMonthlySpendUsageClient {
-  fetch(
-    credentials: CodexOAuthCredentials,
-    accountId: string,
-    options?: { signal?: AbortSignal },
-  ): Promise<NonNullable<CodexUsageSnapshot["individualLimit"]> | null>;
-}
-
-export interface CodexUsageProviderDependencies {
-  oauthClient?: UsageClient<CodexOAuthCredentials, CodexUsageSnapshot>;
-  appServerClient?: CodexAppServerUsageClient;
-  monthlySpendClient?: CodexMonthlySpendUsageClient;
-}
-
-export class CodexUsageProvider {
-  private readonly oauthClient: UsageClient<CodexOAuthCredentials, CodexUsageSnapshot>;
-  private readonly appServerClient: CodexAppServerUsageClient;
-  private readonly monthlySpendClient: CodexMonthlySpendUsageClient;
-
-  constructor(
-    private readonly oauthResolver: TokenResolver<CodexOAuthCredentials>,
-    private readonly dataSource: CodexDataSource = "auto",
-    dependencies: CodexUsageProviderDependencies = {},
-  ) {
-    this.oauthClient = dependencies.oauthClient ?? new CodexOAuthUsageClient();
-    this.appServerClient = dependencies.appServerClient ?? new CodexAppServerClient();
-    this.monthlySpendClient = dependencies.monthlySpendClient ?? new CodexMonthlySpendClient();
-  }
-
-  async fetch(options?: { signal?: AbortSignal }): Promise<{ entry: UsageProviderEntry; snapshot: CodexUsageSnapshot | null }> {
-    let oauthCreds: CodexOAuthCredentials | null;
-    try {
-      oauthCreds = await this.oauthResolver.resolve();
-    } catch (error) {
-      const failure = classifyUsageError(error);
-      return { entry: mapCodexToEntry(null, [`oauth: ${failure.message}`], true, null), snapshot: null };
-    }
-
-    if (!oauthCreds) {
-      return { entry: mapCodexToEntry(null, [], false, null), snapshot: null };
-    }
-
-    if (!isCodexCredentialFresh(oauthCreds)) {
-      return this.fetchFromCli(oauthCreds, options);
-    }
-
-    try {
-      let snapshot = await this.oauthClient.fetch(oauthCreds, options);
-      snapshot = await this.enrichMonthlySpend(snapshot, oauthCreds, options);
-      return { entry: mapCodexToEntry(snapshot, [], true, oauthCreds), snapshot };
-    } catch (error) {
-      const failure = classifyUsageError(error);
-      if (failure.kind === "cancelled") throw failure;
-      if (this.dataSource === "auto" && isRecoverableAuthenticationError(failure)) {
-        return this.fetchFromCli(oauthCreds, options);
-      }
-      return {
-        entry: mapCodexToEntry(null, [`oauth: ${failure.message}`], true, oauthCreds),
-        snapshot: null,
-      };
-    }
-  }
-
-  private async enrichMonthlySpend(
-    snapshot: CodexUsageSnapshot,
-    oauthCreds: CodexOAuthCredentials,
-    options?: { signal?: AbortSignal },
-  ): Promise<CodexUsageSnapshot> {
-    const accountId = snapshot.accountId ?? oauthCreds.accountId;
-    if (snapshot.source !== "oauth" || !snapshot.spendControlPresent || snapshot.individualLimit || !accountId) {
-      return snapshot;
-    }
-    try {
-      const individualLimit = await this.monthlySpendClient.fetch(oauthCreds, accountId, options);
-      return individualLimit ? { ...snapshot, individualLimit } : snapshot;
-    } catch (error) {
-      const failure = classifyUsageError(error);
-      if (failure.kind === "cancelled") throw failure;
-      return snapshot;
-    }
-  }
-
-  private async fetchFromCli(
-    oauthCreds: CodexOAuthCredentials,
-    options?: { signal?: AbortSignal },
-  ): Promise<{ entry: UsageProviderEntry; snapshot: CodexUsageSnapshot | null }> {
-    try {
-      const snapshot = await this.appServerClient.fetch(oauthCreds, options);
-      return { entry: mapCodexToEntry(snapshot, [], true, null), snapshot };
-    } catch (error) {
-      const failure = classifyUsageError(error);
-      if (failure.kind === "cancelled") throw failure;
-      return {
-        entry: mapCodexToEntry(null, [`cli: ${failure.message}`], true, oauthCreds),
-        snapshot: null,
-      };
-    }
-  }
-}

package/src/usage/providers/opencode-go.ts

@@ -1,115 +0,0 @@
-import type { TokenResolver } from "../resolver";
-import type { OpenCodeGoUsageSnapshot } from "../types";
-import type { UsageProviderEntry } from "../types";
-import { OpenCodeGoUsageClient } from "../clients/opencode-go-usage";
-import { mapOpenCodeGoToEntry } from "../mappers";
-import { classifyUsageError, isRecoverableAuthenticationError } from "../errors";
-import { usageWebSessionCache, type WebSessionCache } from "../web-session-cache";
-import { OpenCodeGoApiKeyUsageClient } from "../clients/opencode-go-api";
-import { OpenCodeGoLocalUsageReader, type OpenCodeGoLocalUsageFetcher } from "../local/opencode-go-local";
-import type { OpenCodeGoWebCredentials } from "../resolvers/opencode-go-web";
-
-export interface OpenCodeGoApiKeyUsageClientLike {
-  fetch(): Promise<OpenCodeGoUsageSnapshot | null>;
-}
-
-const CACHE_KEY = "opencode-go";
-
-export class OpenCodeGoUsageProvider {
-  constructor(
-    private readonly resolver: TokenResolver<OpenCodeGoWebCredentials>,
-    private readonly serverFnId: string,
-    private readonly client = new OpenCodeGoUsageClient(),
-    private readonly cache: WebSessionCache = usageWebSessionCache,
-    private readonly localReader: OpenCodeGoLocalUsageFetcher = new OpenCodeGoLocalUsageReader(),
-    private readonly apiKeyClient: OpenCodeGoApiKeyUsageClientLike = new OpenCodeGoApiKeyUsageClient(),
-  ) {}
-
-  async fetch(options?: { signal?: AbortSignal }): Promise<{ entry: UsageProviderEntry; snapshot: OpenCodeGoUsageSnapshot | null }> {
-    // Official Go usage API is authoritative and independent of browser cookies.
-    try {
-      const apiSnapshot = await this.apiKeyClient.fetch();
-      if (apiSnapshot) {
-        return { entry: mapOpenCodeGoToEntry(apiSnapshot, [], true), snapshot: apiSnapshot };
-      }
-    } catch {
-      // Fall through to cookie-based collection.
-    }
-    return this.fetchWithCookies(options);
-  }
-
-  private async fetchWithCookies(options?: { signal?: AbortSignal }): Promise<{ entry: UsageProviderEntry; snapshot: OpenCodeGoUsageSnapshot | null }> {
-    const errors: string[] = [];
-    const creds = await this.resolver.resolve();
-    const observed = this.cache.observe(CACHE_KEY);
-    if (!observed.value && !creds?.candidates.length) {
-      return { entry: mapOpenCodeGoToEntry(null, [], false), snapshot: null };
-    }
-
-    const attempts = [
-      ...(observed.value ? [{ cookies: observed.value, cached: true }] : []),
-      ...(creds?.candidates ?? [])
-        .filter((candidate) => candidate.cookies !== observed.value)
-        .map((candidate) => ({ cookies: candidate.cookies, cached: false })),
-    ].slice(0, 2);
-    let expectedRevision = observed.revision;
-
-    for (let index = 0; index < attempts.length; index++) {
-      const attempt = attempts[index]!;
-      let rotated = false;
-      try {
-        const snapshot = await this.client.fetch(
-          {
-            cookies: attempt.cookies,
-            serverFnId: this.serverFnId,
-            onCookieRotation: (cookies) => {
-              rotated = true;
-              const stored = this.cache.store(CACHE_KEY, cookies, expectedRevision);
-              if (stored) expectedRevision = stored.revision;
-            },
-          },
-          options,
-        );
-        if (!attempt.cached && !rotated && this.cache.observe(CACHE_KEY).revision === expectedRevision) {
-          const stored = this.cache.store(CACHE_KEY, attempt.cookies, expectedRevision);
-          if (stored) expectedRevision = stored.revision;
-        }
-        return { entry: mapOpenCodeGoToEntry(snapshot, [], true), snapshot };
-      } catch (error) {
-        const failure = classifyUsageError(error);
-        if (failure.kind === "cancelled") throw failure;
-        if (failure.kind === "invalid-credentials") {
-          if (this.cache.clear(CACHE_KEY, expectedRevision)) expectedRevision = 0;
-          // Advance the demand-driven cursor at most once per attempt, keeping
-          // the two-candidate bound across cached and imported candidates.
-          const imported = attempts.length < 2 ? (await creds?.importNext?.()) ?? null : null;
-          if (imported && !attempts.some((candidate) => candidate.cookies === imported.cookies)) {
-            attempts.push({ cookies: imported.cookies, cached: false });
-            continue;
-          }
-        }
-        if (!(isRecoverableAuthenticationError(failure) && index + 1 < attempts.length)) {
-          errors.push(`OpenCode Go: ${failure.message}`);
-          return this.fetchLocalFallback(errors);
-        }
-      }
-    }
-
-    return this.fetchLocalFallback(errors);
-  }
-
-  /**
-   * Last resort after every web attempt fails: report locally accumulated
-   * opencode-go costs as estimated windows instead of an error. Mirrors the
-   * CodexBar "local" source so a stale browser session stays usable.
-   */
-  private async fetchLocalFallback(errors: string[]): Promise<{ entry: UsageProviderEntry; snapshot: OpenCodeGoUsageSnapshot | null }> {
-    const local = await this.localReader.fetch();
-    if (local) {
-      // Keeping errors here would force status "error" in the mapper; the local
-      // snapshot is reported as a usable estimate instead.
-      return { entry: mapOpenCodeGoToEntry(local, [], true), snapshot: local };
-    }
-    return { entry: mapOpenCodeGoToEntry(null, errors, true), snapshot: null };
-  }
-}

package/src/usage/resolver.ts

@@ -1,4 +0,0 @@
-export interface TokenResolver<T> {
-  resolve(): Promise<T | null>;
-  isAvailable(): Promise<boolean>;
-}