@velum-labs/routekit-daemon 1.3.2 → 1.5.0

package/dist/internal-providers/provider-claude-code/subscription.js

@@ -0,0 +1,194 @@
+import { providerDefaultBaseUrl, subscriptionInfo } from "@velum-labs/routekit-registry";
+import { executeWebRequest, toRouteKitFailure } from "@velum-labs/routekit-runtime/effect";
+import { Effect } from "effect";
+import { loadSubscriptionCredential, persistSubscriptionCredential } from "@velum-labs/routekit-accounts";
+import { decodeJsonBody } from "@velum-labs/routekit-accounts";
+import { discoveredProviderLimitsFromUsagePayload, extraUsageFromUsagePayload } from "@velum-labs/routekit-accounts/provider";
+import { adminRequest, authenticationFailure, canonicalRateLimitWindowKey, defineWindow, discoverSubscriptionModels, epochSeconds, errorMessage, refreshNetworkFailure, refreshResponseBody, retryAfter, SubscriptionRefreshError, usageRequest, utilization, windowsFromUsagePayload } from "@velum-labs/routekit-accounts";
+export function anthropicProvider() {
+    const mode = "claude-code";
+    const info = subscriptionInfo(mode);
+    return {
+        mode,
+        upstreamBaseUrl: providerDefaultBaseUrl("anthropic") ?? "https://api.anthropic.com",
+        requestPath: "/v1/messages",
+        loadCredential: (path) => Effect.tryPromise({
+            try: () => loadSubscriptionCredential(mode, path),
+            catch: toRouteKitFailure
+        }),
+        persistCredential: (previous, next) => Effect.tryPromise({
+            try: () => persistSubscriptionCredential(previous, next),
+            catch: toRouteKitFailure
+        }),
+        discoverModels: (credential, signal) => discoverSubscriptionModels(mode, providerDefaultBaseUrl("anthropic") ?? "https://api.anthropic.com", thisAnthropicHeaders(info, credential), signal),
+        authHeaders: (credential) => ({
+            authorization: `Bearer ${credential.accessToken}`,
+            "anthropic-beta": info.oauthBetaHeader ?? "oauth-2025-04-20"
+        }),
+        refresh: (credential, signal) => Effect.gen(function* () {
+            if (credential.refreshToken === undefined) {
+                return yield* Effect.fail(new SubscriptionRefreshError({
+                    kind: "permanent",
+                    reasonCode: "missing_refresh_token"
+                }));
+            }
+            const response = yield* executeWebRequest(info.oauth.tokenEndpoint, {
+                method: "POST",
+                headers: { accept: "application/json", "content-type": "application/json" },
+                body: JSON.stringify({
+                    grant_type: "refresh_token",
+                    refresh_token: credential.refreshToken,
+                    client_id: credential.oauthClientId ?? info.oauth.clientId
+                }),
+                ...(signal !== undefined ? { signal } : {})
+            }).pipe(Effect.mapError((error) => refreshNetworkFailure(error)));
+            const decoded = yield* Effect.tryPromise({
+                try: () => decodeJsonBody(response),
+                catch: (cause) => refreshNetworkFailure(cause)
+            });
+            if (response.ok && !decoded.hasJsonBody) {
+                return yield* Effect.fail(new SubscriptionRefreshError({
+                    kind: "transient",
+                    status: response.status,
+                    failureKind: "protocol"
+                }));
+            }
+            return yield* Effect.try({
+                try: () => refreshResponseBody(response, decoded.body, credential),
+                catch: (cause) => refreshNetworkFailure(cause)
+            });
+        }).pipe(Effect.mapError(refreshNetworkFailure)),
+        fetchUsage: (credential, signal) => Effect.gen(function* () {
+            const payload = yield* usageRequest(info.oauth.usageEndpoint, {
+                ...thisAnthropicHeaders(info, credential)
+            }, signal);
+            const observedAt = Date.now() / 1000;
+            const parsed = windowsFromUsagePayload(mode, payload, observedAt, "usage");
+            const discovered = discoveredProviderLimitsFromUsagePayload(payload, observedAt, "usage");
+            const extraUsage = extraUsageFromUsagePayload(payload, observedAt, "usage");
+            const diagnostics = [...parsed.diagnostics, ...discovered.diagnostics];
+            return {
+                windows: parsed.windows,
+                ...(discovered.limits.length > 0 ? { discoveredLimits: discovered.limits } : {}),
+                ...(extraUsage !== undefined ? { extraUsage } : {}),
+                ...(diagnostics.length > 0 ? { diagnostics } : {}),
+                observedAt,
+                source: "usage",
+                completeness: "snapshot"
+            };
+        }),
+        parseLimits: (headers) => anthropicLimitsFromHeaders(headers),
+        parseStreamEvent: () => undefined,
+        classify: (status, headers, body) => {
+            const authentication = authenticationFailure(status, body, `Anthropic returned ${status}`);
+            if (authentication !== undefined)
+                return authentication;
+            if (status !== 429 && status < 500)
+                return undefined;
+            const rejection = anthropicRejectionFromHeaders(headers);
+            const message = errorMessage(body, `Anthropic returned ${status}`);
+            const quota = rejection.rejected ||
+                /(?:usage|weekly|five.?hour).*(?:limit|quota)|limit reached/i.test(message);
+            const retryAfterSeconds = retryAfter(headers, mode);
+            return {
+                category: quota ? "quota_exhausted" : "transient",
+                status,
+                message,
+                ...(retryAfterSeconds !== undefined ? { retryAfter: retryAfterSeconds } : {}),
+                ...(rejection.resetsAt !== undefined ? { resetsAt: rejection.resetsAt } : {})
+            };
+        },
+        fetchAdminUsageCost: (adminKey, range, signal) => Effect.gen(function* () {
+            const query = new URLSearchParams({
+                starting_at: new Date(range.startTime * 1000).toISOString(),
+                bucket_width: "1d"
+            });
+            if (range.endTime !== undefined) {
+                query.set("ending_at", new Date(range.endTime * 1000).toISOString());
+            }
+            const headers = {
+                "x-api-key": adminKey,
+                "anthropic-version": "2023-06-01"
+            };
+            const [usage, cost] = yield* Effect.all([
+                adminRequest(info.admin.usageEndpoint, query, headers, signal),
+                adminRequest(info.admin.costEndpoint, query, headers, signal)
+            ], { concurrency: "unbounded" });
+            return { usage, cost };
+        })
+    };
+}
+function anthropicRejectionFromHeaders(headers) {
+    const prefix = subscriptionInfo("claude-code").rateLimit.headerPrefix.toLowerCase();
+    const now = Date.now() / 1000;
+    let rejected = false;
+    let resetsAt;
+    for (const [name, value] of headers) {
+        if ((name !== `${prefix}-status` &&
+            !(name.startsWith(`${prefix}-`) && name.endsWith("-status"))) ||
+            !["rejected", "exceeded"].includes(value.trim().toLowerCase())) {
+            continue;
+        }
+        rejected = true;
+        const reset = epochSeconds(headers.get(`${name.slice(0, -"-status".length)}-reset`));
+        // Rejection is useful even when utilization is absent. Do not fabricate a
+        // usage window, or let a healthy/expired window shorten its cooldown. All
+        // known rejected windows must clear before the account is ready again.
+        if (reset !== undefined && reset > now) {
+            resetsAt = Math.max(resetsAt ?? reset, reset);
+        }
+    }
+    return { rejected, ...(resetsAt !== undefined ? { resetsAt } : {}) };
+}
+function thisAnthropicHeaders(info, credential) {
+    return {
+        authorization: `Bearer ${credential.accessToken}`,
+        "anthropic-beta": info.oauthBetaHeader ?? "oauth-2025-04-20"
+    };
+}
+function anthropicLimitsFromHeaders(headers) {
+    const prefix = subscriptionInfo("claude-code").rateLimit.headerPrefix.toLowerCase();
+    const observedAt = Date.now() / 1000;
+    const windows = Object.create(null);
+    const diagnostics = [];
+    const suffixes = new Set();
+    for (const [name] of headers) {
+        const lowered = name.toLowerCase();
+        const match = new RegExp(`^${prefix}-(.+)-(utilization|status|reset)$`).exec(lowered);
+        if (match?.[1] !== undefined)
+            suffixes.add(match[1]);
+    }
+    for (const key of suffixes) {
+        const window = canonicalRateLimitWindowKey("claude-code", key);
+        const raw = headers.get(`${prefix}-${key}-utilization`);
+        const used = utilization(raw);
+        if (used === undefined) {
+            if (raw !== null) {
+                diagnostics.push({
+                    code: "invalid_utilization",
+                    window,
+                    field: "utilization"
+                });
+            }
+            continue;
+        }
+        const status = headers.get(`${prefix}-${key}-status`);
+        const resetsAt = epochSeconds(headers.get(`${prefix}-${key}-reset`));
+        defineWindow(windows, window, {
+            utilization: used,
+            ...(status !== null ? { status } : {}),
+            ...(resetsAt !== undefined ? { resetsAt } : {}),
+            observedAt,
+            source: "headers"
+        });
+    }
+    return Object.keys(windows).length > 0 || diagnostics.length > 0
+        ? {
+            windows,
+            ...(diagnostics.length > 0 ? { diagnostics } : {}),
+            observedAt,
+            source: "headers",
+            completeness: "partial"
+        }
+        : undefined;
+}

package/dist/internal-providers/provider-claude-code/test/http-submission.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/internal-providers/provider-claude-code/test/http-submission.test.js

@@ -0,0 +1,140 @@
+import assert from "node:assert/strict";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { createServer } from "node:http";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import { SubscriptionAccountSet } from "@velum-labs/routekit-accounts";
+import { HttpSubmissionAuthority, HttpSubmissionError, runRouteKitEffect, toRouteKitFailure } from "@velum-labs/routekit-runtime/effect";
+import { Effect } from "effect";
+import { AnthropicBackendRelay } from "../relay.js";
+import { anthropicProvider } from "../subscription.js";
+const MODEL = "claude-sonnet-4-5";
+const TOKEN = "offline-native-claude-token";
+for (const disconnect of [false, true]) {
+    test(`native managed Claude relay observes ${disconnect ? "unknown without retry" : "raw completion"} at its credential-owning POST`, async (t) => {
+        const directory = await mkdtemp(join(tmpdir(), "routekit-native-claude-submission-"));
+        const intents = [];
+        const outcomes = [];
+        const posts = [];
+        const errors = [];
+        let accounts;
+        const wire = [
+            'event: content_block_delta\ndata: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"offline claude"}}\n\n',
+            'event: message_stop\ndata: {"type":"message_stop"}\n\n'
+        ].join("");
+        const server = createServer((request, response) => {
+            void (async () => {
+                const chunks = [];
+                for await (const chunk of request)
+                    chunks.push(Buffer.from(chunk));
+                posts.push({
+                    body: JSON.parse(Buffer.concat(chunks).toString("utf8")),
+                    complete: request.complete,
+                    authorization: request.headers.authorization,
+                    apiKey: request.headers["x-api-key"],
+                    intentsBeforePost: intents.length
+                });
+                assert.equal(request.url, "/v1/messages");
+                if (disconnect) {
+                    response.destroy();
+                    return;
+                }
+                response.writeHead(200, { "content-type": "text/event-stream" });
+                response.end(wire);
+            })().catch((cause) => {
+                errors.push(cause);
+                response.destroy();
+            });
+        });
+        t.after(async () => {
+            try {
+                if (accounts !== undefined)
+                    await runRouteKitEffect(accounts.close());
+            }
+            finally {
+                try {
+                    await new Promise((resolve, reject) => {
+                        server.close((error) => (error === undefined ? resolve() : reject(error)));
+                        server.closeAllConnections();
+                    });
+                }
+                finally {
+                    await rm(directory, { recursive: true, force: true });
+                }
+            }
+            assert.deepEqual(errors, []);
+        });
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(0, "127.0.0.1", resolve);
+        });
+        const address = server.address();
+        assert.ok(address !== null && typeof address === "object");
+        await writeFile(join(directory, "account.json"), JSON.stringify({
+            claudeAiOauth: {
+                accessToken: TOKEN,
+                expiresAt: Date.now() + 3_600_000
+            }
+        }), { mode: 0o600 });
+        accounts = await runRouteKitEffect(SubscriptionAccountSet.open(anthropicProvider(), {
+            source: { kind: "directory", path: directory },
+            publishedModels: [MODEL],
+            probeIntervalMs: 0
+        }));
+        const relay = new AnthropicBackendRelay({
+            accounts,
+            backendUrl: `http://127.0.0.1:${address.port}`
+        });
+        assert.equal(relay.httpSubmission, undefined, "an overridden endpoint is not publicly certified");
+        assert.equal(new AnthropicBackendRelay({ accounts }).httpSubmission, "credential-owner-http-v1");
+        const authority = {
+            begin: (request) => Effect.sync(() => {
+                intents.push(request);
+                return { attemptId: `offline-native-${intents.length}` };
+            }),
+            settle: (_attemptId, outcome) => Effect.sync(() => {
+                outcomes.push(outcome);
+            })
+        };
+        let retries = 0;
+        const result = await runRouteKitEffect(relay
+            .relay({ authorization: "Bearer offline-ingress-token", "x-api-key": "offline-ingress-key" }, {
+            model: MODEL,
+            stream: true,
+            max_tokens: 32,
+            messages: [{ role: "user", content: "hello" }]
+        }, undefined, {
+            responseMode: "buffered",
+            onAttribution: (update) => {
+                if (update.accountAttemptResult !== undefined)
+                    retries += 1;
+            }
+        })
+            .pipe(Effect.flatMap((response) => Effect.tryPromise({
+            try: () => response.text(),
+            catch: (cause) => cause instanceof HttpSubmissionError ? cause : toRouteKitFailure(cause)
+        })), Effect.catch((cause) => Effect.succeed(cause)), Effect.scoped, Effect.provideService(HttpSubmissionAuthority, authority)));
+        assert.equal(posts.length, 1);
+        assert.equal(posts[0]?.complete, true);
+        assert.equal(posts[0]?.intentsBeforePost, 1);
+        assert.equal(posts[0]?.authorization, `Bearer ${TOKEN}`);
+        assert.equal(posts[0]?.apiKey, undefined);
+        assert.equal(posts[0]?.body.model, MODEL);
+        assert.equal(intents[0]?.model, MODEL);
+        assert.match(intents[0]?.accountIdentity ?? "", /^[a-f0-9]{64}$/u);
+        assert.equal(retries, 0);
+        assert.ok(accounts.snapshot().members.every((member) => member.inFlight === 0));
+        assert.equal(JSON.stringify(intents).includes(TOKEN), false);
+        if (disconnect) {
+            assert.ok(result instanceof HttpSubmissionError);
+            assert.equal(result.code, "unknown-submission");
+            assert.deepEqual(outcomes, [{ state: "unknown", reason: "transport-error" }]);
+        }
+        else {
+            assert.equal(result, wire, "the native relay must preserve exact upstream bytes");
+            assert.equal(outcomes[0]?.state, "completed");
+            assert.equal(outcomes[0]?.state === "completed" ? outcomes[0].terminal : undefined, "messages-stop");
+        }
+    });
+}

package/dist/internal-providers/provider-claude-code/test/relay.test.d.ts

@@ -0,0 +1 @@
+export {};