@stevenzxs/ccharness 1.0.0

package/dist/chunk-mdgtpe1j.js

@@ -0,0 +1,152 @@
+// @bun
+import {
+  init_analytics,
+  logEvent
+} from "./chunk-j1mep9ck.js";
+import {
+  init_diagLogs,
+  logForDiagnosticsNoPII
+} from "./chunk-0fnzcgq4.js";
+import {
+  errorMessage,
+  init_debug,
+  init_errors,
+  init_slowOperations,
+  jsonParse,
+  logForDebugging
+} from "./chunk-7fxg2tat.js";
+
+// src/bridge/jwtUtils.ts
+init_analytics();
+init_debug();
+init_diagLogs();
+init_errors();
+init_slowOperations();
+function formatDuration(ms) {
+  if (ms < 60000)
+    return `${Math.round(ms / 1000)}s`;
+  const m = Math.floor(ms / 60000);
+  const s = Math.round(ms % 60000 / 1000);
+  return s > 0 ? `${m}m ${s}s` : `${m}m`;
+}
+function decodeJwtPayload(token) {
+  const jwt = token.startsWith("sk-ant-si-") ? token.slice("sk-ant-si-".length) : token;
+  const parts = jwt.split(".");
+  if (parts.length !== 3 || !parts[1])
+    return null;
+  try {
+    return jsonParse(Buffer.from(parts[1], "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+function decodeJwtExpiry(token) {
+  const payload = decodeJwtPayload(token);
+  if (payload !== null && typeof payload === "object" && "exp" in payload && typeof payload.exp === "number") {
+    return payload.exp;
+  }
+  return null;
+}
+var TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1000;
+var FALLBACK_REFRESH_INTERVAL_MS = 30 * 60 * 1000;
+var MAX_REFRESH_FAILURES = 3;
+var REFRESH_RETRY_DELAY_MS = 60000;
+function createTokenRefreshScheduler({
+  getAccessToken,
+  onRefresh,
+  label,
+  refreshBufferMs = TOKEN_REFRESH_BUFFER_MS
+}) {
+  const timers = new Map;
+  const failureCounts = new Map;
+  const generations = new Map;
+  function nextGeneration(sessionId) {
+    const gen = (generations.get(sessionId) ?? 0) + 1;
+    generations.set(sessionId, gen);
+    return gen;
+  }
+  function schedule(sessionId, token) {
+    const expiry = decodeJwtExpiry(token);
+    if (!expiry) {
+      logForDebugging(`[${label}:token] Could not decode JWT expiry for sessionId=${sessionId}, token prefix=${token.slice(0, 15)}\u2026, keeping existing timer`);
+      return;
+    }
+    const existing = timers.get(sessionId);
+    if (existing) {
+      clearTimeout(existing);
+    }
+    const gen = nextGeneration(sessionId);
+    const expiryDate = new Date(expiry * 1000).toISOString();
+    const delayMs = expiry * 1000 - Date.now() - refreshBufferMs;
+    if (delayMs <= 0) {
+      logForDebugging(`[${label}:token] Token for sessionId=${sessionId} expires=${expiryDate} (past or within buffer), refreshing immediately`);
+      doRefresh(sessionId, gen);
+      return;
+    }
+    logForDebugging(`[${label}:token] Scheduled token refresh for sessionId=${sessionId} in ${formatDuration(delayMs)} (expires=${expiryDate}, buffer=${refreshBufferMs / 1000}s)`);
+    const timer = setTimeout(doRefresh, delayMs, sessionId, gen);
+    timers.set(sessionId, timer);
+  }
+  function scheduleFromExpiresIn(sessionId, expiresInSeconds) {
+    const existing = timers.get(sessionId);
+    if (existing)
+      clearTimeout(existing);
+    const gen = nextGeneration(sessionId);
+    const delayMs = Math.max(expiresInSeconds * 1000 - refreshBufferMs, 30000);
+    logForDebugging(`[${label}:token] Scheduled token refresh for sessionId=${sessionId} in ${formatDuration(delayMs)} (expires_in=${expiresInSeconds}s, buffer=${refreshBufferMs / 1000}s)`);
+    const timer = setTimeout(doRefresh, delayMs, sessionId, gen);
+    timers.set(sessionId, timer);
+  }
+  async function doRefresh(sessionId, gen) {
+    let oauthToken;
+    try {
+      oauthToken = await getAccessToken();
+    } catch (err) {
+      logForDebugging(`[${label}:token] getAccessToken threw for sessionId=${sessionId}: ${errorMessage(err)}`, { level: "error" });
+    }
+    if (generations.get(sessionId) !== gen) {
+      logForDebugging(`[${label}:token] doRefresh for sessionId=${sessionId} stale (gen ${gen} vs ${generations.get(sessionId)}), skipping`);
+      return;
+    }
+    if (!oauthToken) {
+      const failures = (failureCounts.get(sessionId) ?? 0) + 1;
+      failureCounts.set(sessionId, failures);
+      logForDebugging(`[${label}:token] No OAuth token available for refresh, sessionId=${sessionId} (failure ${failures}/${MAX_REFRESH_FAILURES})`, { level: "error" });
+      logForDiagnosticsNoPII("error", "bridge_token_refresh_no_oauth");
+      if (failures < MAX_REFRESH_FAILURES) {
+        const retryTimer = setTimeout(doRefresh, REFRESH_RETRY_DELAY_MS, sessionId, gen);
+        timers.set(sessionId, retryTimer);
+      }
+      return;
+    }
+    failureCounts.delete(sessionId);
+    logForDebugging(`[${label}:token] Refreshing token for sessionId=${sessionId}: new token prefix=${oauthToken.slice(0, 15)}\u2026`);
+    logEvent("tengu_bridge_token_refreshed", {});
+    onRefresh(sessionId, oauthToken);
+    const timer = setTimeout(doRefresh, FALLBACK_REFRESH_INTERVAL_MS, sessionId, gen);
+    timers.set(sessionId, timer);
+    logForDebugging(`[${label}:token] Scheduled follow-up refresh for sessionId=${sessionId} in ${formatDuration(FALLBACK_REFRESH_INTERVAL_MS)}`);
+  }
+  function cancel(sessionId) {
+    nextGeneration(sessionId);
+    const timer = timers.get(sessionId);
+    if (timer) {
+      clearTimeout(timer);
+      timers.delete(sessionId);
+    }
+    failureCounts.delete(sessionId);
+  }
+  function cancelAll() {
+    for (const sessionId of generations.keys()) {
+      nextGeneration(sessionId);
+    }
+    for (const timer of timers.values()) {
+      clearTimeout(timer);
+    }
+    timers.clear();
+    failureCounts.clear();
+  }
+  return { schedule, scheduleFromExpiresIn, cancel, cancelAll };
+}
+
+export { decodeJwtExpiry, createTokenRefreshScheduler };

package/dist/chunk-mexn06rd.js

@@ -0,0 +1,32 @@
+// @bun
+import {
+  getClaudeAIOAuthTokens,
+  init_auth
+} from "./chunk-a07hgnvm.js";
+import {
+  getOauthConfig,
+  init_oauth
+} from "./chunk-t50j5994.js";
+import {
+  __esm
+} from "./chunk-hhsxm2yr.js";
+
+// src/bridge/bridgeConfig.ts
+function getBridgeTokenOverride() {
+  return process.env.USER_TYPE === "ant" && process.env.CLAUDE_BRIDGE_OAUTH_TOKEN || undefined;
+}
+function getBridgeBaseUrlOverride() {
+  return process.env.USER_TYPE === "ant" && process.env.CLAUDE_BRIDGE_BASE_URL || undefined;
+}
+function getBridgeAccessToken() {
+  return getBridgeTokenOverride() ?? getClaudeAIOAuthTokens()?.accessToken;
+}
+function getBridgeBaseUrl() {
+  return getBridgeBaseUrlOverride() ?? getOauthConfig().BASE_API_URL;
+}
+var init_bridgeConfig = __esm(() => {
+  init_oauth();
+  init_auth();
+});
+
+export { getBridgeTokenOverride, getBridgeBaseUrlOverride, getBridgeAccessToken, getBridgeBaseUrl, init_bridgeConfig };

package/dist/chunk-mezfesfw.js

@@ -0,0 +1,184 @@
+// @bun
+import {
+  require_dist_cjs as require_dist_cjs5
+} from "./chunk-bw1n8g13.js";
+import {
+  require_dist_cjs3 as require_dist_cjs4
+} from "./chunk-h3my9t3s.js";
+import {
+  require_client
+} from "./chunk-xbawq95y.js";
+import {
+  require_dist_cjs2
+} from "./chunk-dnrj70b6.js";
+import {
+  require_dist_cjs
+} from "./chunk-gshmd2yw.js";
+import {
+  require_dist_cjs as require_dist_cjs3
+} from "./chunk-vsaf1n7a.js";
+import {
+  __esm,
+  __toESM
+} from "./chunk-hhsxm2yr.js";
+
+// node_modules/.bun/@aws-sdk+credential-provider-http@3.972.26/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/checkUrl.js
+var import_property_provider, ECS_CONTAINER_HOST = "169.254.170.2", EKS_CONTAINER_HOST_IPv4 = "169.254.170.23", EKS_CONTAINER_HOST_IPv6 = "[fd00:ec2::23]", checkUrl = (url, logger) => {
+  if (url.protocol === "https:") {
+    return;
+  }
+  if (url.hostname === ECS_CONTAINER_HOST || url.hostname === EKS_CONTAINER_HOST_IPv4 || url.hostname === EKS_CONTAINER_HOST_IPv6) {
+    return;
+  }
+  if (url.hostname.includes("[")) {
+    if (url.hostname === "[::1]" || url.hostname === "[0000:0000:0000:0000:0000:0000:0000:0001]") {
+      return;
+    }
+  } else {
+    if (url.hostname === "localhost") {
+      return;
+    }
+    const ipComponents = url.hostname.split(".");
+    const inRange = (component) => {
+      const num = parseInt(component, 10);
+      return 0 <= num && num <= 255;
+    };
+    if (ipComponents[0] === "127" && inRange(ipComponents[1]) && inRange(ipComponents[2]) && inRange(ipComponents[3]) && ipComponents.length === 4) {
+      return;
+    }
+  }
+  throw new import_property_provider.CredentialsProviderError(`URL not accepted. It must either be HTTPS or match one of the following:
+  - loopback CIDR 127.0.0.0/8 or [::1/128]
+  - ECS container host 169.254.170.2
+  - EKS container host 169.254.170.23 or [fd00:ec2::23]`, { logger });
+};
+var init_checkUrl = __esm(() => {
+  import_property_provider = __toESM(require_dist_cjs3(), 1);
+});
+
+// node_modules/.bun/@aws-sdk+credential-provider-http@3.972.26/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/requestHelpers.js
+function createGetRequest(url) {
+  return new import_protocol_http.HttpRequest({
+    protocol: url.protocol,
+    hostname: url.hostname,
+    port: Number(url.port),
+    path: url.pathname,
+    query: Array.from(url.searchParams.entries()).reduce((acc, [k, v]) => {
+      acc[k] = v;
+      return acc;
+    }, {}),
+    fragment: url.hash
+  });
+}
+async function getCredentials(response, logger) {
+  const stream = import_util_stream.sdkStreamMixin(response.body);
+  const str = await stream.transformToString();
+  if (response.statusCode === 200) {
+    const parsed = JSON.parse(str);
+    if (typeof parsed.AccessKeyId !== "string" || typeof parsed.SecretAccessKey !== "string" || typeof parsed.Token !== "string" || typeof parsed.Expiration !== "string") {
+      throw new import_property_provider2.CredentialsProviderError("HTTP credential provider response not of the required format, an object matching: " + "{ AccessKeyId: string, SecretAccessKey: string, Token: string, Expiration: string(rfc3339) }", { logger });
+    }
+    return {
+      accessKeyId: parsed.AccessKeyId,
+      secretAccessKey: parsed.SecretAccessKey,
+      sessionToken: parsed.Token,
+      expiration: import_smithy_client.parseRfc3339DateTime(parsed.Expiration)
+    };
+  }
+  if (response.statusCode >= 400 && response.statusCode < 500) {
+    let parsedBody = {};
+    try {
+      parsedBody = JSON.parse(str);
+    } catch (e) {}
+    throw Object.assign(new import_property_provider2.CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger }), {
+      Code: parsedBody.Code,
+      Message: parsedBody.Message
+    });
+  }
+  throw new import_property_provider2.CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger });
+}
+var import_property_provider2, import_protocol_http, import_smithy_client, import_util_stream;
+var init_requestHelpers = __esm(() => {
+  import_property_provider2 = __toESM(require_dist_cjs3(), 1);
+  import_protocol_http = __toESM(require_dist_cjs(), 1);
+  import_smithy_client = __toESM(require_dist_cjs5(), 1);
+  import_util_stream = __toESM(require_dist_cjs4(), 1);
+});
+
+// node_modules/.bun/@aws-sdk+credential-provider-http@3.972.26/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/retry-wrapper.js
+var retryWrapper = (toRetry, maxRetries, delayMs) => {
+  return async () => {
+    for (let i = 0;i < maxRetries; ++i) {
+      try {
+        return await toRetry();
+      } catch (e) {
+        await new Promise((resolve) => setTimeout(resolve, delayMs));
+      }
+    }
+    return await toRetry();
+  };
+};
+var init_retry_wrapper = () => {};
+
+// node_modules/.bun/@aws-sdk+credential-provider-http@3.972.26/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/fromHttp.js
+import fs from "fs/promises";
+var import_client, import_node_http_handler, import_property_provider3, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2", AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI", AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE = "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", AWS_CONTAINER_AUTHORIZATION_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN", fromHttp = (options = {}) => {
+  options.logger?.debug("@aws-sdk/credential-provider-http - fromHttp");
+  let host;
+  const relative = options.awsContainerCredentialsRelativeUri ?? process.env[AWS_CONTAINER_CREDENTIALS_RELATIVE_URI];
+  const full = options.awsContainerCredentialsFullUri ?? process.env[AWS_CONTAINER_CREDENTIALS_FULL_URI];
+  const token = options.awsContainerAuthorizationToken ?? process.env[AWS_CONTAINER_AUTHORIZATION_TOKEN];
+  const tokenFile = options.awsContainerAuthorizationTokenFile ?? process.env[AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE];
+  const warn = options.logger?.constructor?.name === "NoOpLogger" || !options.logger?.warn ? console.warn : options.logger.warn.bind(options.logger);
+  if (relative && full) {
+    warn("@aws-sdk/credential-provider-http: " + "you have set both awsContainerCredentialsRelativeUri and awsContainerCredentialsFullUri.");
+    warn("awsContainerCredentialsFullUri will take precedence.");
+  }
+  if (token && tokenFile) {
+    warn("@aws-sdk/credential-provider-http: " + "you have set both awsContainerAuthorizationToken and awsContainerAuthorizationTokenFile.");
+    warn("awsContainerAuthorizationToken will take precedence.");
+  }
+  if (full) {
+    host = full;
+  } else if (relative) {
+    host = `${DEFAULT_LINK_LOCAL_HOST}${relative}`;
+  } else {
+    throw new import_property_provider3.CredentialsProviderError(`No HTTP credential provider host provided.
+Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`, { logger: options.logger });
+  }
+  const url = new URL(host);
+  checkUrl(url, options.logger);
+  const requestHandler = import_node_http_handler.NodeHttpHandler.create({
+    requestTimeout: options.timeout ?? 1000,
+    connectionTimeout: options.timeout ?? 1000
+  });
+  return retryWrapper(async () => {
+    const request = createGetRequest(url);
+    if (token) {
+      request.headers.Authorization = token;
+    } else if (tokenFile) {
+      request.headers.Authorization = (await fs.readFile(tokenFile)).toString();
+    }
+    try {
+      const result = await requestHandler.handle(request);
+      return getCredentials(result.response).then((creds) => import_client.setCredentialFeature(creds, "CREDENTIALS_HTTP", "z"));
+    } catch (e) {
+      throw new import_property_provider3.CredentialsProviderError(String(e), { logger: options.logger });
+    }
+  }, options.maxRetries ?? 3, options.timeout ?? 1000);
+};
+var init_fromHttp = __esm(() => {
+  init_checkUrl();
+  init_requestHelpers();
+  init_retry_wrapper();
+  import_client = __toESM(require_client(), 1);
+  import_node_http_handler = __toESM(require_dist_cjs2(), 1);
+  import_property_provider3 = __toESM(require_dist_cjs3(), 1);
+});
+
+// node_modules/.bun/@aws-sdk+credential-provider-http@3.972.26/node_modules/@aws-sdk/credential-provider-http/dist-es/index.js
+var init_dist_es = __esm(() => {
+  init_fromHttp();
+});
+
+export { fromHttp, init_dist_es };