claude-use 5.1.0 → 5.2.0

package/dist/index.mjs

@@ -1759,12 +1759,283 @@ function recoveryDiagnostics(recovery, identity) {
 }
 
 // src/frontdoor/connect.ts
+import { X509Certificate as X509Certificate2, createPrivateKey as createPrivateKey2 } from "node:crypto";
 import * as fs from "node:fs";
 import * as http from "node:http";
 import * as https from "node:https";
-import * as net from "node:net";
+import * as net2 from "node:net";
 import * as tls from "node:tls";
-import forge from "node-forge";
+
+// src/frontdoor/x509.ts
+import { createHash, createPrivateKey, generateKeyPairSync, randomBytes, sign, X509Certificate } from "node:crypto";
+import net from "node:net";
+var TAG_BOOLEAN = 1;
+var TAG_INTEGER = 2;
+var TAG_BIT_STRING = 3;
+var TAG_OCTET_STRING = 4;
+var TAG_NULL = 5;
+var TAG_OID = 6;
+var TAG_UTF8_STRING = 12;
+var TAG_UTC_TIME = 23;
+var TAG_GENERALIZED_TIME = 24;
+var TAG_SEQUENCE = 48;
+var TAG_SET = 49;
+var TAG_VERSION = 160;
+var TAG_EXTENSIONS = 163;
+var TAG_GENERAL_NAME_DNS = 130;
+var TAG_GENERAL_NAME_IP = 135;
+var TAG_KEY_IDENTIFIER = 128;
+var OID_COMMON_NAME = "2.5.4.3";
+var OID_SHA256_WITH_RSA = "1.2.840.113549.1.1.11";
+var OID_SUBJECT_KEY_IDENTIFIER = "2.5.29.14";
+var OID_KEY_USAGE = "2.5.29.15";
+var OID_SUBJECT_ALT_NAME = "2.5.29.17";
+var OID_BASIC_CONSTRAINTS = "2.5.29.19";
+var OID_AUTHORITY_KEY_IDENTIFIER = "2.5.29.35";
+var OID_EXT_KEY_USAGE = "2.5.29.37";
+var OID_SERVER_AUTH = "1.3.6.1.5.5.7.3.1";
+var VERSION_3 = 2;
+var SERIAL_NUMBER_BYTES = 16;
+var RSA_MODULUS_BITS = 2048;
+var BITS_PER_BYTE = 8;
+var BYTE_MASK = 255;
+var HIGH_BIT = 128;
+var BASE_128_PAYLOAD_MASK = 127;
+var FIRST_ARC_WEIGHT = 40;
+var SHORT_FORM_MAX_LENGTH = 127;
+var MS_PER_SECOND = 1e3;
+var UTC_TIME_LAST_YEAR = 2049;
+var YEAR_DIGITS = 4;
+var TWO_DIGIT_YEAR_DIGITS = 2;
+var COMPACT_TIME_DIGITS = 14;
+var KEY_USAGE = { digitalSignature: 0, keyEncipherment: 2, keyCertSign: 5, cRLSign: 6 };
+function tlv(tag, content) {
+  const length = content.length;
+  if (length <= SHORT_FORM_MAX_LENGTH) {
+    return Buffer.concat([Buffer.from([tag, length]), content]);
+  }
+  const lengthBytes = [];
+  for (let remaining = length; remaining > 0; remaining = Math.floor(remaining / (BYTE_MASK + 1))) {
+    lengthBytes.unshift(remaining & BYTE_MASK);
+  }
+  return Buffer.concat([Buffer.from([tag, HIGH_BIT | lengthBytes.length, ...lengthBytes]), content]);
+}
+function sequence(...parts) {
+  return tlv(TAG_SEQUENCE, Buffer.concat(parts));
+}
+function unsignedInteger(magnitude) {
+  let start = 0;
+  while (start < magnitude.length - 1 && magnitude[start] === 0) {
+    start += 1;
+  }
+  const trimmed = magnitude.subarray(start);
+  const first = trimmed[0];
+  const padded = first !== void 0 && (first & HIGH_BIT) !== 0 ? Buffer.concat([Buffer.from([0]), trimmed]) : Buffer.from(trimmed);
+  return tlv(TAG_INTEGER, padded);
+}
+function smallInteger(value) {
+  return unsignedInteger(Buffer.from([value]));
+}
+function oid(dotted) {
+  const arcs = dotted.split(".").map(Number);
+  const [first, second, ...rest] = arcs;
+  if (first === void 0 || second === void 0 || arcs.some((arc) => !Number.isInteger(arc) || arc < 0)) {
+    throw new Error(`invalid object identifier ${dotted}`);
+  }
+  const encoded = [];
+  for (const arc of [first * FIRST_ARC_WEIGHT + second, ...rest]) {
+    const groups = [arc & BASE_128_PAYLOAD_MASK];
+    for (let remaining = Math.floor(arc / HIGH_BIT); remaining > 0; remaining = Math.floor(remaining / HIGH_BIT)) {
+      groups.unshift(remaining & BASE_128_PAYLOAD_MASK | HIGH_BIT);
+    }
+    encoded.push(...groups);
+  }
+  return tlv(TAG_OID, Buffer.from(encoded));
+}
+function boolean(value) {
+  return tlv(TAG_BOOLEAN, Buffer.from([value ? BYTE_MASK : 0]));
+}
+function octetString(content) {
+  return tlv(TAG_OCTET_STRING, content);
+}
+function wholeBitString(content) {
+  return tlv(TAG_BIT_STRING, Buffer.concat([Buffer.from([0]), content]));
+}
+function time(instant) {
+  const iso = new Date(Math.floor(instant.getTime() / MS_PER_SECOND) * MS_PER_SECOND).toISOString();
+  const compact = `${iso.replace(/[-:T]/g, "").slice(0, COMPACT_TIME_DIGITS)}Z`;
+  if (instant.getUTCFullYear() > UTC_TIME_LAST_YEAR) {
+    return tlv(TAG_GENERALIZED_TIME, Buffer.from(compact, "ascii"));
+  }
+  return tlv(TAG_UTC_TIME, Buffer.from(compact.slice(YEAR_DIGITS - TWO_DIGIT_YEAR_DIGITS), "ascii"));
+}
+function commonNameOnly(commonName) {
+  return sequence(tlv(TAG_SET, sequence(oid(OID_COMMON_NAME), tlv(TAG_UTF8_STRING, Buffer.from(commonName, "utf8")))));
+}
+var SIGNATURE_ALGORITHM = sequence(oid(OID_SHA256_WITH_RSA), tlv(TAG_NULL, Buffer.alloc(0)));
+function extension(extensionOid, critical, value) {
+  return sequence(oid(extensionOid), ...critical ? [boolean(true)] : [], octetString(value));
+}
+function keyUsageExtension(bits) {
+  const highest = Math.max(...bits);
+  const byteCount = Math.floor(highest / BITS_PER_BYTE) + 1;
+  const bytes = Buffer.alloc(byteCount);
+  for (const bit of bits) {
+    const index = Math.floor(bit / BITS_PER_BYTE);
+    bytes[index] = (bytes[index] ?? 0) | HIGH_BIT >> bit % BITS_PER_BYTE;
+  }
+  const unusedBits = BITS_PER_BYTE - 1 - highest % BITS_PER_BYTE;
+  return extension(OID_KEY_USAGE, true, tlv(TAG_BIT_STRING, Buffer.concat([Buffer.from([unusedBits]), bytes])));
+}
+var IPV6_GROUPS = 8;
+var HEX_RADIX = 16;
+var BYTES_PER_IPV6_GROUP = 2;
+function ipv6Groups(address) {
+  const [head = "", tail] = address.split("::");
+  const split = (text) => text === "" ? [] : text.split(":");
+  const expand = (groups) => groups.flatMap((group) => {
+    if (!net.isIPv4(group)) {
+      return [Number.parseInt(group, HEX_RADIX)];
+    }
+    const [a = 0, b = 0, c = 0, d = 0] = group.split(".").map(Number);
+    return [a * (BYTE_MASK + 1) + b, c * (BYTE_MASK + 1) + d];
+  });
+  const before = expand(split(head));
+  const after = tail === void 0 ? [] : expand(split(tail));
+  const filler = tail === void 0 ? [] : Array.from({ length: IPV6_GROUPS - before.length - after.length }, () => 0);
+  return [...before, ...filler, ...after];
+}
+function ipBytes(address) {
+  if (net.isIPv4(address)) {
+    return Buffer.from(address.split(".").map(Number));
+  }
+  if (!net.isIPv6(address)) {
+    throw new Error(`${address} is not an IP address`);
+  }
+  const bytes = Buffer.alloc(IPV6_GROUPS * BYTES_PER_IPV6_GROUP);
+  ipv6Groups(address).forEach((group, index) => {
+    bytes.writeUInt16BE(group, index * BYTES_PER_IPV6_GROUP);
+  });
+  return bytes;
+}
+function keyIdentifier(publicKey) {
+  return createHash("sha1").update(publicKey.export({ type: "pkcs1", format: "der" })).digest();
+}
+function readElement(buffer, offset) {
+  const tag = buffer[offset];
+  const first = buffer[offset + 1];
+  if (tag === void 0 || first === void 0) {
+    throw new Error("truncated DER");
+  }
+  let length = first;
+  let contentStart = offset + 2;
+  if ((first & HIGH_BIT) !== 0) {
+    const count = first & BASE_128_PAYLOAD_MASK;
+    length = 0;
+    for (let index = 0; index < count; index += 1) {
+      length = length * (BYTE_MASK + 1) + (buffer[offset + 2 + index] ?? 0);
+    }
+    contentStart = offset + 2 + count;
+  }
+  return { tag, start: offset, contentStart, end: contentStart + length };
+}
+function subjectNameOf(certificateDer) {
+  const certificate = readElement(certificateDer, 0);
+  let cursor = readElement(certificateDer, certificate.contentStart);
+  const tbsEnd = cursor.end;
+  cursor = readElement(certificateDer, cursor.contentStart);
+  if (cursor.tag === TAG_VERSION) {
+    cursor = readElement(certificateDer, cursor.end);
+  }
+  const fieldsBeforeSubject = 4;
+  for (let skipped = 1; skipped < fieldsBeforeSubject; skipped += 1) {
+    cursor = readElement(certificateDer, cursor.end);
+  }
+  const subject = readElement(certificateDer, cursor.end);
+  if (subject.end > tbsEnd) {
+    throw new Error("certificate has no subject");
+  }
+  return Buffer.from(certificateDer.subarray(subject.start, subject.end));
+}
+function toPem(label, der) {
+  const body = Buffer.from(der).toString("base64").match(/.{1,64}/g) ?? [];
+  return `-----BEGIN ${label}-----
+${body.join("\n")}
+-----END ${label}-----
+`;
+}
+function randomSerial() {
+  const bytes = randomBytes(SERIAL_NUMBER_BYTES);
+  bytes[0] = (bytes[0] ?? 0) & BASE_128_PAYLOAD_MASK | HIGH_BIT >> 1;
+  return bytes;
+}
+function assemble(spec) {
+  const tbs = sequence(
+    tlv(TAG_VERSION, smallInteger(VERSION_3)),
+    unsignedInteger(randomSerial()),
+    SIGNATURE_ALGORITHM,
+    spec.issuerName,
+    sequence(time(spec.notBefore), time(spec.notAfter)),
+    spec.subjectName,
+    spec.subjectPublicKey.export({ type: "spki", format: "der" }),
+    tlv(TAG_EXTENSIONS, sequence(...spec.extensions))
+  );
+  const signature = sign("sha256", tbs, spec.signingKey);
+  return sequence(tbs, SIGNATURE_ALGORITHM, wholeBitString(signature));
+}
+function subjectKeyIdentifierExtension(publicKey) {
+  return extension(OID_SUBJECT_KEY_IDENTIFIER, false, octetString(keyIdentifier(publicKey)));
+}
+function basicConstraintsExtension(isCa) {
+  return extension(OID_BASIC_CONSTRAINTS, true, sequence(...isCa ? [boolean(true)] : []));
+}
+function rsaKeyPair() {
+  return generateKeyPairSync("rsa", { modulusLength: RSA_MODULUS_BITS });
+}
+function keyPem(privateKey) {
+  return privateKey.export({ type: "pkcs8", format: "pem" });
+}
+function issueCaCertificate(commonName, notBefore, notAfter) {
+  const { publicKey, privateKey } = rsaKeyPair();
+  const name = commonNameOnly(commonName);
+  const der = assemble({
+    subjectPublicKey: publicKey,
+    subjectName: name,
+    issuerName: name,
+    signingKey: privateKey,
+    notBefore,
+    notAfter,
+    extensions: [basicConstraintsExtension(true), keyUsageExtension([KEY_USAGE.keyCertSign, KEY_USAGE.cRLSign]), subjectKeyIdentifierExtension(publicKey)]
+  });
+  return { certPem: toPem("CERTIFICATE", der), keyPem: keyPem(privateKey) };
+}
+function issueLeafCertificate(ca, names, notBefore, notAfter) {
+  const [commonName] = names;
+  if (commonName === void 0) {
+    throw new Error("a leaf certificate needs at least one name");
+  }
+  const caCertificate = new X509Certificate(ca.certPem);
+  const caPrivateKey = createPrivateKey(ca.keyPem);
+  const { publicKey, privateKey } = rsaKeyPair();
+  const generalNames = names.map((name) => net.isIP(name) === 0 ? tlv(TAG_GENERAL_NAME_DNS, Buffer.from(name, "ascii")) : tlv(TAG_GENERAL_NAME_IP, ipBytes(name)));
+  const der = assemble({
+    subjectPublicKey: publicKey,
+    subjectName: commonNameOnly(commonName),
+    issuerName: subjectNameOf(caCertificate.raw),
+    signingKey: caPrivateKey,
+    notBefore,
+    notAfter,
+    extensions: [
+      basicConstraintsExtension(false),
+      keyUsageExtension([KEY_USAGE.digitalSignature, KEY_USAGE.keyEncipherment]),
+      extension(OID_EXT_KEY_USAGE, false, sequence(oid(OID_SERVER_AUTH))),
+      extension(OID_SUBJECT_ALT_NAME, false, sequence(...generalNames)),
+      subjectKeyIdentifierExtension(publicKey),
+      extension(OID_AUTHORITY_KEY_IDENTIFIER, false, sequence(tlv(TAG_KEY_IDENTIFIER, keyIdentifier(caCertificate.publicKey))))
+    ]
+  });
+  return { certPem: toPem("CERTIFICATE", der), keyPem: keyPem(privateKey) };
+}
 
 // src/frontdoor/capability.ts
 var CONNECT_PROXY_REALM = "claude-use front door";
@@ -1967,7 +2238,6 @@ var CONNECT_INTERCEPT_HOST = "api.anthropic.com";
 var ROUTED_PATH_PREFIX = "/v1/";
 var HTTPS_PORT = 443;
 var MAX_PORT = 65535;
-var SERIAL_NUMBER_BYTES = 16;
 var HTTP_BAD_GATEWAY = 502;
 var CA_KEY_FILE_MODE = 384;
 var CONNECT_LINE_TOKENS = 3;
@@ -2039,50 +2309,10 @@ function forwardableHeaders(headers) {
   return result;
 }
 function generateCa(now) {
-  const keys = forge.pki.rsa.generateKeyPair({ bits: 2048 });
-  const cert = forge.pki.createCertificate();
-  cert.publicKey = keys.publicKey;
-  cert.serialNumber = forge.util.bytesToHex(forge.random.getBytesSync(SERIAL_NUMBER_BYTES));
-  cert.validity.notBefore = new Date(now.getTime() - MS_PER_DAY);
-  cert.validity.notAfter = new Date(now.getTime() + CA_VALIDITY_DAYS * MS_PER_DAY);
-  const subject = [{ name: "commonName", value: CA_SUBJECT_COMMON_NAME }];
-  cert.setSubject(subject);
-  cert.setIssuer(subject);
-  cert.setExtensions([
-    { name: "basicConstraints", cA: true, critical: true },
-    { name: "keyUsage", keyCertSign: true, cRLSign: true, critical: true },
-    { name: "subjectKeyIdentifier" }
-  ]);
-  cert.sign(keys.privateKey, forge.md.sha256.create());
-  return { certPem: forge.pki.certificateToPem(cert), keyPem: forge.pki.privateKeyToPem(keys.privateKey) };
-}
-var SAN_TYPE_DNS = 2;
-var SAN_TYPE_IP = 7;
+  return issueCaCertificate(CA_SUBJECT_COMMON_NAME, new Date(now.getTime() - MS_PER_DAY), new Date(now.getTime() + CA_VALIDITY_DAYS * MS_PER_DAY));
+}
 function mintLeaf(ca, names, now) {
-  const [commonName] = names;
-  if (commonName === void 0) {
-    throw new Error("a leaf certificate needs at least one name");
-  }
-  const caCert = forge.pki.certificateFromPem(ca.certPem);
-  const caKey = forge.pki.privateKeyFromPem(ca.keyPem);
-  const keys = forge.pki.rsa.generateKeyPair({ bits: 2048 });
-  const cert = forge.pki.createCertificate();
-  cert.publicKey = keys.publicKey;
-  cert.serialNumber = forge.util.bytesToHex(forge.random.getBytesSync(SERIAL_NUMBER_BYTES));
-  cert.validity.notBefore = new Date(now.getTime() - MS_PER_DAY);
-  cert.validity.notAfter = new Date(now.getTime() + LEAF_VALIDITY_DAYS * MS_PER_DAY);
-  cert.setSubject([{ name: "commonName", value: commonName }]);
-  cert.setIssuer(caCert.subject.attributes);
-  cert.setExtensions([
-    { name: "basicConstraints", cA: false, critical: true },
-    { name: "keyUsage", digitalSignature: true, keyEncipherment: true, critical: true },
-    { name: "extKeyUsage", serverAuth: true },
-    { name: "subjectAltName", altNames: names.map((name) => net.isIP(name) === 0 ? { type: SAN_TYPE_DNS, value: name } : { type: SAN_TYPE_IP, ip: name }) },
-    { name: "subjectKeyIdentifier" },
-    { name: "authorityKeyIdentifier", keyLocatorFields: [] }
-  ]);
-  cert.sign(caKey, forge.md.sha256.create());
-  return { certPem: forge.pki.certificateToPem(cert), keyPem: forge.pki.privateKeyToPem(keys.privateKey) };
+  return issueLeafCertificate(ca, names, new Date(now.getTime() - MS_PER_DAY), new Date(now.getTime() + LEAF_VALIDITY_DAYS * MS_PER_DAY));
 }
 function createLeafCache(ca, now) {
   const cache = /* @__PURE__ */ new Map();
@@ -2107,8 +2337,8 @@ function ensureCa(store, generate) {
 }
 function caParses(ca) {
   try {
-    forge.pki.certificateFromPem(ca.certPem);
-    forge.pki.privateKeyFromPem(ca.keyPem);
+    new X509Certificate2(ca.certPem);
+    createPrivateKey2(ca.keyPem);
     return true;
   } catch {
     return false;
@@ -2314,7 +2544,7 @@ function realConnectEffects() {
   const tlsAgent = new https.Agent({ keepAlive: true });
   const listenOnce = async (port, onSocket) => await new Promise((resolve, reject) => {
     const accepted = /* @__PURE__ */ new Set();
-    const server = net.createServer((socket) => {
+    const server = net2.createServer((socket) => {
       accepted.add(socket);
       socket.on("close", () => {
         accepted.delete(socket);
@@ -2387,7 +2617,7 @@ function realConnectEffects() {
       };
     },
     connectTcp: async (host, port) => await new Promise((resolve, reject) => {
-      const socket = net.connect({ host, port });
+      const socket = net2.connect({ host, port });
       socket.once("connect", () => {
         resolve(socket);
       });
@@ -2452,8 +2682,8 @@ function realConnectCertStore(paths) {
   return {
     loadCa: () => {
       const certPem = read(paths.frontdoorCaCertFile);
-      const keyPem = read(paths.frontdoorCaKeyFile);
-      return certPem === void 0 || keyPem === void 0 ? void 0 : { certPem, keyPem };
+      const keyPem2 = read(paths.frontdoorCaKeyFile);
+      return certPem === void 0 || keyPem2 === void 0 ? void 0 : { certPem, keyPem: keyPem2 };
     },
     writeCa: (ca) => {
       fs.mkdirSync(paths.frontdoorCaDir, { recursive: true });
@@ -2468,7 +2698,7 @@ function realConnectCertStore(paths) {
 import { randomUUID as randomUUID2 } from "node:crypto";
 
 // src/headroom/state.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import path6 from "node:path";
 import { z as z4 } from "zod";
 var HEADROOM_ANTHROPIC_UPSTREAM = "https://api.anthropic.com";
@@ -2530,7 +2760,7 @@ function headroomUpstreams(providers, frontDoorOrigin2) {
   return upstreams;
 }
 function hashAllowlist(allowlist) {
-  return createHash("sha256").update(allowlist.join("\n")).digest("hex");
+  return createHash2("sha256").update(allowlist.join("\n")).digest("hex");
 }
 function readAllProviders(fs2, providersDir) {
   const result = [];
@@ -2708,7 +2938,7 @@ function ensureHeadroom(params) {
 }
 
 // src/headroom/settings.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 function settingsOf(config) {
   return {
     ...config.mode === void 0 ? {} : { mode: config.mode },
@@ -2733,7 +2963,7 @@ function settingsEnv(settings) {
   return settings.rolloutChannel === void 0 ? {} : { HEADROOM_ROLLOUT_CHANNEL: settings.rolloutChannel };
 }
 function hashSettings(settings) {
-  return createHash2("sha256").update(JSON.stringify([...settingsArgs(settings), JSON.stringify(settingsEnv(settings))])).digest("hex");
+  return createHash3("sha256").update(JSON.stringify([...settingsArgs(settings), JSON.stringify(settingsEnv(settings))])).digest("hex");
 }
 
 // src/headroom/supervisor.ts

package/dist/types/frontdoor/connect.d.ts

@@ -69,7 +69,7 @@ export interface LeafCert {
     readonly certPem: string;
     readonly keyPem: string;
 }
-/** Generates the local CA: one RSA keypair, self-signed, CA-only by basicConstraints and keyUsage, with a random serial. Pure node-forge, no openssl, so the same code works on every platform claude-use ships to. */
+/** Generates the local CA: one RSA keypair, self-signed, CA-only by basicConstraints and keyUsage, with a random serial. Built on `node:crypto` alone (see `x509.ts`), no openssl, so the same code works on every platform claude-use ships to. */
 export declare function generateCa(now: Readonly<Date>): CaMaterial;
 /** The names the front door's provider listener answers to: the loopback address every provider session's base URL names, plus the loopback hostname for a client that spells it that way. */
 export declare const LOOPBACK_LEAF_NAMES: readonly string[];
@@ -77,7 +77,7 @@ export declare const LOOPBACK_LEAF_NAMES: readonly string[];
  * Mints a TLS leaf signed by the CA: its own RSA keypair, server-auth usage only, the first name as the subject's common name and every name in the SAN. A name that parses as an IP address goes in as an IP SAN, because TLS clients match an IP host only against IP SANs, never against a DNS SAN spelling the same digits.
  */
 export declare function mintLeaf(ca: CaMaterial, names: readonly string[], now: Readonly<Date>): LeafCert;
-/** Mints each host's leaf once from the CA and reuses it, because a 2048-bit keypair in pure JS costs seconds and nothing about the certificate changes between sessions. */
+/** Mints each host's leaf once from the CA and reuses it, because generating a 2048-bit RSA keypair costs noticeable time and nothing about the certificate changes between sessions. */
 export declare function createLeafCache(ca: CaMaterial, now: () => Date): (host: string) => LeafCert;
 /**
  * Persistence for the CA: generated once on the machine's first headroom start and reused forever after, because regenerating it would invalidate every child's `NODE_EXTRA_CA_CERTS` pointing at the old file. The real implementation writes the key with mode 0600; injected fakes keep it in memory.
@@ -89,7 +89,7 @@ export interface ConnectCertStore {
     readonly writeCa: (ca: CaMaterial) => void;
 }
 /**
- * Loads the persisted CA, generating and persisting one when no usable CA exists. A stored pair that node-forge cannot parse is treated as absent and replaced: a truncated write is the one failure mode a regeneration can actually repair, and every child that trusted the old file needs a new `NODE_EXTRA_CA_CERTS` anyway once its CA stops parsing.
+ * Loads the persisted CA, generating and persisting one when no usable CA exists. A stored pair that `node:crypto` cannot parse is treated as absent and replaced: a truncated write is the one failure mode a regeneration can actually repair, and every child that trusted the old file needs a new `NODE_EXTRA_CA_CERTS` anyway once its CA stops parsing.
  */
 export declare function ensureCa(store: ConnectCertStore, generate: () => CaMaterial): CaMaterial;
 /** Where one forwarded request goes, and how: the connect surface's own forwards go to the real upstream over TLS, while a local hop over plain HTTP is what tests redirect to. */

package/dist/types/frontdoor/x509.d.ts

@@ -0,0 +1,11 @@
+/** An IP address as the 4 or 16 octets an iPAddress GeneralName carries. */
+export declare function ipBytes(address: string): Buffer;
+/** A key pair in the PEM forms claude-use persists. */
+export interface PemKeyPair {
+    readonly certPem: string;
+    readonly keyPem: string;
+}
+/** Generates a self-signed CA certificate, CA-only by basicConstraints and keyUsage, with a random serial. */
+export declare function issueCaCertificate(commonName: string, notBefore: Readonly<Date>, notAfter: Readonly<Date>): PemKeyPair;
+/** Issues a server-auth leaf under a CA: its own RSA key, the first name as the common name, every name in the subjectAltName (an IP address as an iPAddress entry, because TLS clients match an IP host only against those). */
+export declare function issueLeafCertificate(ca: PemKeyPair, names: readonly string[], notBefore: Readonly<Date>, notAfter: Readonly<Date>): PemKeyPair;

package/dist/types/launcher/ports.d.ts

@@ -46,6 +46,8 @@ export interface FarmFs {
     readonly mkdirPrivate: (path: string) => void;
     /** Writes a file's full contents as UTF-8 text readable only by its owner (mode 0600), atomically: a temporary sibling is written at that mode and renamed into place, so no reader ever sees a partial file or a wider mode. */
     readonly writeFilePrivate: (path: string, contents: string) => void;
+    /** Appends UTF-8 text to a file readable only by its owner (mode 0600), creating it at that mode when it is missing and narrowing an existing wider mode. The file is opened in append mode, so the text always lands at the end however the file grew; a reader running at the same moment can still see a trailing partial write. It is the primitive an append-only log with one writer per file is built on. */
+    readonly appendFilePrivate: (path: string, contents: string) => void;
     /** Creates a file only if it does not already exist, returning false when it does. This is the exclusive-create the identity lock depends on for its mutual exclusion — a read-then-write pair would race. */
     readonly writeFileExclusive: (path: string, contents: string) => boolean;
     /** A stable content hash of one file, or undefined when it is missing or is not a regular file. Used only to recognise farm data that has already been adopted into the canonical tree. */

package/dist/types/paths.d.ts

@@ -52,6 +52,12 @@ export interface LayoutPaths {
     readonly frontdoorSessionsDir: string;
     /** Path to the front door's log: one line per lifecycle event and routed failure, never a token. */
     readonly frontdoorLogPath: string;
+    /** Directory holding the usage store, mode 0700: the request log and the per-identity snapshots. Metadata only, never content or credentials. */
+    readonly usageDir: string;
+    /** Directory of the append-only usage log: one `<YYYY-MM-DD>.<writer-pid>.jsonl` segment per writing process per UTC day. */
+    readonly usageLogDir: string;
+    /** Directory of the latest-state snapshots, one `<identity>.json` per identity: the stable file other tools read. */
+    readonly usageSnapshotsDir: string;
 }
 /**
  * Resolves the current CLAUDE_USE_HOME root: the environment variable when set to a non-empty string, otherwise `~/.claude-use`. An empty string counts as unset, consistent with how this project treats empty-string environment variables elsewhere (see the ambient-credential guard).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-use",
-  "version": "5.1.0",
+  "version": "5.2.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "Apache-2.0",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",
@@ -51,7 +51,6 @@
     "@clack/prompts": "^1.8.0",
     "commander": "^15.0.0",
     "cosmiconfig": "^9.0.2",
-    "node-forge": "1.4.0",
     "picomatch": "^4.0.7",
     "undici": "7.29.1",
     "zod": "^4.6.1"
@@ -64,7 +63,6 @@
     "@semantic-release/git": "^11.0.1",
     "@semantic-release/npm": "^13.1.5",
     "@types/node": "^26.5.1",
-    "@types/node-forge": "1.3.14",
     "@types/picomatch": "^4.0.3",
     "@vitest/coverage-v8": "^4.1.11",
     "conventional-changelog-conventionalcommits": "^10.4.0",