aisubs 0.3.6 → 0.3.8

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.3.8 - 2026-09-19
+
+- Breaking: `createSubscriptionAuth` now requires an explicit credential store.
+- Breaking: provider factories use the `aisubs/providers/*` entrypoints so the core `aisubs` import stays runtime-portable.
+- Add `aisubs/node` SQLite credential and API-key stores with shared-connection support and cross-process refresh ownership.
+- Persist standalone AISubs records in `~/.aisubs/aisubs.db` without retaining the legacy file-store implementation.
+
+## 0.3.7 - 2026-09-16
+
+- Improve provider compatibility, proxy handling, and request normalization.
+- Harden dashboard account flows, modal interactions, and stale-load handling.
+- Add regression coverage for compatibility, proxy headers, authentication, and
+  dashboard behavior.
+
 ## 0.3.6 - 2026-09-15
 
 - Preserve provider cache controls and cache usage across OpenAI-compatible,

package/README.md

@@ -438,9 +438,14 @@ bun add aisubs
 ```
 
 ```js
-import { chatGptProvider, createSubscriptionAuth } from "aisubs";
+import { createSubscriptionAuth } from "aisubs";
+import { SqliteCredentialStore } from "aisubs/node";
+import { chatGptProvider } from "aisubs/providers/chatgpt";
 
-const subscriptions = createSubscriptionAuth({ providers: [chatGptProvider()] });
+const subscriptions = createSubscriptionAuth({
+  store: new SqliteCredentialStore("./data/aisubs.db"),
+  providers: [chatGptProvider()],
+});
 const account = subscriptions.account("chatgpt", "personal");
 
 if (!(await account.status()).authenticated) {
@@ -493,19 +498,16 @@ Useful account methods:
 <summary><strong>Configure every provider and custom credential storage</strong></summary>
 
 ```js
-import {
-  FileCredentialStore,
-  chatGptProvider,
-  claudeProvider,
-  copilotProvider,
-  createSubscriptionAuth,
-  grokProvider,
-  openCodeGoProvider,
-  openCodeZenProvider,
-} from "aisubs";
+import { createSubscriptionAuth } from "aisubs";
+import { SqliteCredentialStore } from "aisubs/node";
+import { chatGptProvider } from "aisubs/providers/chatgpt";
+import { claudeProvider } from "aisubs/providers/claude";
+import { copilotProvider } from "aisubs/providers/copilot";
+import { grokProvider } from "aisubs/providers/grok";
+import { openCodeGoProvider, openCodeZenProvider } from "aisubs/providers/opencode";
 
 const subscriptions = createSubscriptionAuth({
-  store: new FileCredentialStore("./data/aisubs-credentials.json"),
+  store: new SqliteCredentialStore("./data/aisubs.db"),
   providers: [
     chatGptProvider(),
     claudeProvider(),
@@ -517,9 +519,10 @@ const subscriptions = createSubscriptionAuth({
 });
 ```
 
-Without a custom store, credentials are saved to
-`~/.aisubs/credentials.json`. Select an account with its provider ID and a
-local account name:
+Storage is always explicit. The core SDK never discovers a home directory,
+creates files, starts a server, or opens a browser. The standalone CLI composes
+the SQLite adapter at `~/.aisubs/aisubs.db`. Select an account with its provider
+ID and a local account name:
 
 ```js
 const chatgpt = subscriptions.account("chatgpt", "personal");
@@ -596,25 +599,23 @@ const response = await selected.proxy("responses", requestOptions);
 <summary><strong>Run the local HTTP server from Node.js</strong></summary>
 
 This is the programmatic equivalent of `aisubs dashboard`. The API key is
-created once and reused across restarts; delete or regenerate the key file only
-when clients should receive a new key.
+created once and reused across restarts; regenerate it when clients should
+receive a new key.
 
 ```js
 import { homedir } from "node:os";
 import { join } from "node:path";
-import {
-  FileApiKeyStore,
-  FileCredentialStore,
-  chatGptProvider,
-  claudeProvider,
-  createSubscriptionAuth,
-} from "aisubs";
+import { createSubscriptionAuth } from "aisubs";
 import { createSubscriptionAuthServer } from "aisubs/http";
+import { SqliteApiKeyStore, SqliteCredentialStore } from "aisubs/node";
+import { chatGptProvider } from "aisubs/providers/chatgpt";
+import { claudeProvider } from "aisubs/providers/claude";
 
 const directory = join(homedir(), ".aisubs");
-const apiKey = await new FileApiKeyStore(join(directory, "api-key")).readOrCreate();
+const database = join(directory, "aisubs.db");
+const apiKey = await new SqliteApiKeyStore(database).readOrCreate();
 const auth = createSubscriptionAuth({
-  store: new FileCredentialStore(join(directory, "credentials.json")),
+  store: new SqliteCredentialStore(database),
   providers: [chatGptProvider(), claudeProvider()],
 });
 
@@ -674,8 +675,7 @@ the old key.
 
 ## Storage and security
 
-- Credentials: `~/.aisubs/credentials.json`.
-- Persistent local API key: `~/.aisubs/api-key`.
+- Credentials and persistent local API key: `~/.aisubs/aisubs.db`.
 - Optional Codex catalog: `~/.codex/aisubs-catalog.json`.
 - Codex integration stores the local AISubs key in the user-private Codex config.
 - State directories and files use private permissions where the platform supports them.

package/dist/auth.d.ts

@@ -29,6 +29,7 @@ export declare class SubscriptionAuth {
     private readonly attempts;
     private readonly generations;
     private readonly refreshes;
+    private readonly coordinatedRefreshes;
     private readonly usageCache;
     private readonly modelsCache;
     private readonly usageInflight;
@@ -53,6 +54,7 @@ export declare class SubscriptionAuth {
         error: string | null;
     } | null;
     cancelLoginAttempt(id: string): boolean;
+    private cancelAttempt;
     status(provider: ProviderId, options?: {
         validate?: boolean;
         account?: string;
@@ -61,6 +63,7 @@ export declare class SubscriptionAuth {
     listAccounts(provider: ProviderId): Promise<Session[]>;
     signOut(provider: ProviderId, account?: string): Promise<void>;
     private credential;
+    private coordinatedCredential;
     getAccessToken(provider: ProviderId, account?: string): Promise<string>;
     credentialSummary(provider: ProviderId, account?: string): Promise<CredentialSummary>;
     details(provider: ProviderId, account?: string, signal?: AbortSignal): Promise<SubscriptionAccountDetails>;
@@ -73,6 +76,6 @@ export declare class SubscriptionAuth {
     account(provider: ProviderId, account: string): SubscriptionAccount;
 }
 export declare function createSubscriptionAuth(options: {
-    store?: CredentialStore;
+    store: CredentialStore;
     providers: readonly ProviderAdapter[];
 } & SubscriptionAuthOptions): SubscriptionAuth;

package/dist/auth.js

@@ -1,9 +1,13 @@
-import { defaultAiSubsDataDir, FileCredentialStore } from "./store.js";
 import { errorMessage } from "./utils.js";
-import { join } from "node:path";
 export const DEFAULT_ACCOUNT = "default";
 const ACCOUNT_STORAGE_PREFIX = "$subscription-account$";
 const LOGIN_ATTEMPT_RETENTION_MS = 5 * 60_000;
+function isCoordinatedStore(store) {
+    return ("readVersioned" in store &&
+        "replaceCredential" in store &&
+        "claimRefresh" in store &&
+        "commitRefresh" in store);
+}
 function normalizeAccountKey(value) {
     if (value == null)
         return DEFAULT_ACCOUNT;
@@ -63,6 +67,7 @@ export class SubscriptionAuth {
     attempts = new Map();
     generations = new Map();
     refreshes = new Map();
+    coordinatedRefreshes = new Map();
     usageCache = new Map();
     modelsCache = new Map();
     usageInflight = new Map();
@@ -157,31 +162,53 @@ export class SubscriptionAuth {
         const accountKey = normalizeAccountKey(options?.account);
         const scope = credentialKey(provider, accountKey);
         const replace = options?.replace !== false;
-        if (!replace && (await this.store.read(scope))) {
+        const durable = isCoordinatedStore(this.store)
+            ? await this.store.readVersioned(scope)
+            : undefined;
+        if (!replace && (durable?.credential ?? (await this.store.read(scope)))) {
             throw new Error(`Account name ${accountKey} is already connected for ${provider}`);
         }
         const epoch = this.advance(scope);
         for (const attempt of this.attempts.values()) {
-            if (attempt.scope === scope && attempt.state === "pending")
-                attempt.abort.abort();
+            if (attempt.scope === scope)
+                this.cancelAttempt(attempt);
         }
         const abort = new AbortController();
+        const id = crypto.randomUUID();
         const providerOptions = { ...options };
         delete providerOptions.account;
         delete providerOptions.replace;
         const login = await adapter.startLogin(abort.signal, providerOptions);
-        const id = crypto.randomUUID();
+        if (this.generation(scope) !== epoch) {
+            abort.abort();
+            void login.complete.catch(() => { });
+            throw new Error("Login cancelled");
+        }
         let record;
         const promise = login.complete
             .then(async (credential) => {
-            const saved = await this.store.modify(scope, (current) => {
-                if (this.generation(scope) !== epoch)
-                    return current;
-                if (current && !replace) {
-                    throw new Error(`Account name ${accountKey} is already connected for ${provider}`);
-                }
-                return credential;
-            });
+            let saved;
+            if (isCoordinatedStore(this.store)) {
+                const replacement = await this.store.replaceCredential({
+                    provider: scope,
+                    credential,
+                    expectedGeneration: durable?.generation ?? 0,
+                    operationId: `login:${id}`,
+                });
+                if (!replacement.applied)
+                    throw new Error("Login cancelled");
+                saved = replacement.record.credential;
+            }
+            else {
+                saved = await this.store.modify(scope, (current) => {
+                    if (this.generation(scope) !== epoch)
+                        return current;
+                    if (current && !replace) {
+                        throw new Error(`Account name ${accountKey} is already connected for ${provider}`);
+                    }
+                    return credential;
+                });
+            }
             if (this.generation(scope) !== epoch || !saved)
                 throw new Error("Login cancelled");
             this.clearMetadata(scope);
@@ -199,6 +226,7 @@ export class SubscriptionAuth {
             provider,
             accountKey,
             scope,
+            generation: epoch,
             state: "pending",
             error: null,
             abort,
@@ -218,10 +246,7 @@ export class SubscriptionAuth {
                 return record.error;
             },
             wait: () => record.promise,
-            cancel: () => {
-                this.advance(scope);
-                abort.abort();
-            },
+            cancel: () => this.cancelAttempt(record),
         };
     }
     expireLoginAttempt(id) {
@@ -243,10 +268,17 @@ export class SubscriptionAuth {
         const attempt = this.attempts.get(id);
         if (!attempt || attempt.state !== "pending")
             return false;
-        this.advance(attempt.scope);
-        attempt.abort.abort();
+        this.cancelAttempt(attempt);
         return true;
     }
+    cancelAttempt(attempt) {
+        if (attempt.state !== "pending")
+            return;
+        if (this.generation(attempt.scope) === attempt.generation)
+            this.advance(attempt.scope);
+        attempt.state = "cancelled";
+        attempt.abort.abort();
+    }
     async status(provider, options = {}) {
         const accountKey = normalizeAccountKey(options.account);
         if (options.validate)
@@ -277,15 +309,34 @@ export class SubscriptionAuth {
         for (const refresh of this.refreshes.get(scope) ?? [])
             refresh.abort();
         for (const attempt of this.attempts.values()) {
-            if (attempt.scope === scope && attempt.state === "pending")
-                attempt.abort.abort();
+            if (attempt.scope === scope)
+                this.cancelAttempt(attempt);
+        }
+        if (isCoordinatedStore(this.store)) {
+            await this.store.deleteCredential({
+                provider: scope,
+                operationId: `logout:${crypto.randomUUID()}`,
+            });
+        }
+        else {
+            await this.store.delete(scope);
         }
-        await this.store.delete(scope);
     }
     async credential(provider, account, forceRefresh = false) {
         const adapter = this.adapter(provider);
         const accountKey = normalizeAccountKey(account);
         const scope = credentialKey(provider, accountKey);
+        if (isCoordinatedStore(this.store)) {
+            const pending = this.coordinatedRefreshes.get(scope);
+            if (pending)
+                return pending;
+            const operation = this.coordinatedCredential(this.store, adapter, provider, accountKey, scope, forceRefresh).finally(() => {
+                if (this.coordinatedRefreshes.get(scope) === operation)
+                    this.coordinatedRefreshes.delete(scope);
+            });
+            this.coordinatedRefreshes.set(scope, operation);
+            return operation;
+        }
         const observed = await this.store.read(scope);
         if (!observed)
             throw new Error(`Not authenticated with ${provider} account ${accountKey}`);
@@ -340,6 +391,74 @@ export class SubscriptionAuth {
         this.clearMetadata(scope);
         return refreshed;
     }
+    async coordinatedCredential(store, adapter, provider, accountKey, scope, forceRefresh) {
+        const observed = await store.readVersioned(scope);
+        const credential = observed.credential;
+        if (!credential)
+            throw new Error(`Not authenticated with ${provider} account ${accountKey}`);
+        if (credential.metadata?.reauthRequired === true) {
+            throw new Error(`Session expired for ${provider} account ${accountKey}; sign in again`);
+        }
+        if (!forceRefresh && credential.expiresAt > Date.now())
+            return credential;
+        const claimId = crypto.randomUUID();
+        const claim = await store.claimRefresh({
+            provider: scope,
+            expectedVersion: observed.version,
+            expectedGeneration: observed.generation,
+            claimId,
+            operationId: `refresh-claim:${claimId}`,
+        });
+        if (claim === "missing") {
+            throw new Error(`Not authenticated with ${provider} account ${accountKey}`);
+        }
+        if (claim !== "claimed") {
+            const deadline = Date.now() + this.refreshTimeoutMs;
+            while (Date.now() < deadline) {
+                await new Promise((resolve) => setTimeout(resolve, 50));
+                const latest = await store.readVersioned(scope);
+                if (latest.version === observed.version && latest.generation === observed.generation)
+                    continue;
+                if (!latest.credential || latest.credential.metadata?.reauthRequired === true)
+                    break;
+                if (latest.credential.expiresAt > Date.now())
+                    return latest.credential;
+                break;
+            }
+            throw new Error(`Refresh outcome is uncertain for ${provider} account ${accountKey}; sign in again`);
+        }
+        let next;
+        try {
+            next = await adapter.refresh(credential, AbortSignal.timeout(this.refreshTimeoutMs));
+        }
+        catch (error) {
+            if (!adapter.isPermanentRefreshError?.(error))
+                throw error;
+            next = {
+                accessToken: "",
+                expiresAt: 0,
+                account: credential.account,
+                metadata: { ...credential.metadata, reauthRequired: true },
+            };
+        }
+        const committed = await store.commitRefresh({
+            provider: scope,
+            claimId,
+            expectedGeneration: observed.generation,
+            credential: next,
+            operationId: `refresh-commit:${claimId}`,
+        });
+        if (!committed.applied) {
+            throw new Error(`Session changed while refreshing ${provider} account ${accountKey}`);
+        }
+        const saved = committed.record.credential;
+        if (!saved || saved.metadata?.reauthRequired === true) {
+            this.clearMetadata(scope);
+            throw new Error(`Session expired for ${provider} account ${accountKey}; sign in again`);
+        }
+        this.clearMetadata(scope);
+        return saved;
+    }
     async getAccessToken(provider, account = DEFAULT_ACCOUNT) {
         const credential = await this.credential(provider, account);
         if (credential.metadata?.delegatedCli === true) {
@@ -502,6 +621,5 @@ export class SubscriptionAuth {
     }
 }
 export function createSubscriptionAuth(options) {
-    const store = options.store ?? new FileCredentialStore(join(defaultAiSubsDataDir(), "credentials.json"));
-    return new SubscriptionAuth(store, options.providers, options);
+    return new SubscriptionAuth(options.store, options.providers, options);
 }

package/dist/cli.js

@@ -8,7 +8,8 @@ import { claudeProvider } from "./providers/claude.js";
 import { copilotProvider } from "./providers/copilot.js";
 import { grokProvider } from "./providers/grok.js";
 import { openCodeGoProvider, openCodeZenProvider } from "./providers/opencode.js";
-import { defaultAiSubsDataDir, FileApiKeyStore, FileCredentialStore } from "./store.js";
+import { defaultAiSubsDataDir } from "./store.js";
+import { SqliteApiKeyStore, SqliteCredentialStore } from "./sqlite-store.js";
 const DEFAULT_DASHBOARD_PORT = 4319;
 function usage() {
     console.log(`AI Subs
@@ -61,8 +62,9 @@ async function main() {
     }
     if (!Number.isInteger(port) || port < 0 || port > 65535)
         throw new Error("Invalid port");
-    const store = new FileCredentialStore(join(dataDirectory, "credentials.json"));
-    const apiKeys = new FileApiKeyStore(join(dataDirectory, "api-key"));
+    const database = join(dataDirectory, "aisubs.db");
+    const store = new SqliteCredentialStore(database);
+    const apiKeys = new SqliteApiKeyStore(database);
     const auth = createSubscriptionAuth({
         store,
         providers: [