clauderipple 0.2.0

package/dist/router/src/providers/chatgpt/translate.js

@@ -0,0 +1,393 @@
+// Anthropic Messages  ⇄  OpenAI Responses (Codex backend). Pure functions, no I/O.
+//
+// Prompt-cache rule: the Responses `input` we build must be a byte-stable prefix of the
+// next turn's `input`. Claude Code resends the whole history every turn, so the mapping
+// has to be deterministic and must not inject anything that varies (timestamps, salts,
+// re-signed reasoning). Thinking blocks from earlier assistant turns are dropped for the
+// same reason. `prompt_cache_key` is derived from the conversation's first user message.
+import crypto from "node:crypto";
+import { identityLine } from "../../identity.js";
+function blockText(c) {
+    if (typeof c === "string")
+        return c;
+    if (!Array.isArray(c))
+        return "";
+    return c
+        .map((b) => (b.type === "text" ? b.text : b.type === "image" ? "[image omitted]" : ""))
+        .filter((s) => s.length > 0)
+        .join("\n");
+}
+// Claude Code's first system block is Anthropic billing telemetry ("x-anthropic-billing-header: …
+// cch=<hash> …") whose hash changes on every turn. Left in, it sits at the top of `instructions`
+// and invalidates the prompt cache for everything after it (measured 2026-09-13: cached_tokens
+// stuck at the tools prefix while input grew 39k→43k). It means nothing to another provider.
+const BILLING_BLOCK = /^x-anthropic-billing-header:/;
+export function systemText(system) {
+    if (typeof system === "string")
+        return system.replace(/^x-anthropic-billing-header:[^\n]*\n*/, "");
+    if (!Array.isArray(system))
+        return "";
+    return system
+        .map((b) => b.text ?? "")
+        .filter((s) => s.length > 0 && !BILLING_BLOCK.test(s))
+        .join("\n\n");
+}
+export function conversationKey(req) {
+    const first = req.messages.find((m) => m.role === "user");
+    const seed = `${req.metadata?.user_id ?? ""}\n${first ? blockText(first.content).slice(0, 4000) : ""}`;
+    return crypto.createHash("sha256").update(seed).digest("hex").slice(0, 32);
+}
+// The Codex backend validates every `pattern` in a tool schema with a regex engine that has no
+// lookaround or backreferences; one such pattern anywhere fails the whole request with
+// "Invalid schema for function 'X': '...' is not a 'regex'" (measured 2026-09-13 with the
+// Claude Code Artifact tool). Those patterns are dropped; the client validates inputs itself.
+const UNSUPPORTED_REGEX = /\(\?[=!<]|\\[1-9]/;
+export function unsupportedPattern(p) {
+    return UNSUPPORTED_REGEX.test(p);
+}
+function scrubSchema(node) {
+    if (Array.isArray(node))
+        return node.map(scrubSchema);
+    if (typeof node !== "object" || node === null)
+        return node;
+    const out = {};
+    for (const [k, v] of Object.entries(node)) {
+        if (k === "pattern" && typeof v === "string" && unsupportedPattern(v))
+            continue;
+        out[k] = scrubSchema(v);
+    }
+    return out;
+}
+export function normalizeSchema(s) {
+    const out = scrubSchema(s ?? {});
+    if (out.type !== "object")
+        out.type = "object";
+    if (typeof out.properties !== "object" || out.properties === null)
+        out.properties = {};
+    if (out.required !== undefined && !Array.isArray(out.required))
+        delete out.required;
+    return out;
+}
+export function toResponsesRequest(req, opts) {
+    const parts = [];
+    // Effort is named here because the model cannot see its own reasoning setting and will otherwise guess.
+    // Constant per (model, effort): changing effort mid-session costs one cache miss, which is acceptable.
+    if (opts.identity)
+        parts.push(identityLine(opts.model, opts.effort));
+    const sys = systemText(req.system);
+    if (sys)
+        parts.push(sys);
+    if (opts.instructionsAppend)
+        parts.push(opts.instructionsAppend);
+    const input = [];
+    // Claude Code sends side queries whose history starts with a bare tool_result (e.g. summarising a
+    // large tool output). Anthropic tolerates the orphan; the Responses API rejects a function_call_output
+    // whose call_id has no function_call in the same input ("No tool call found…", measured 2026-09-13).
+    // Such results are sent as plain user text instead.
+    const knownCalls = new Set();
+    for (const m of req.messages) {
+        const role = m.role === "assistant" ? "assistant" : "user";
+        if (typeof m.content === "string") {
+            if (m.content.length > 0)
+                input.push({ type: "message", role, content: [{ type: role === "user" ? "input_text" : "output_text", text: m.content }] });
+            continue;
+        }
+        if (!Array.isArray(m.content))
+            continue;
+        let pending = [];
+        const flush = () => {
+            if (pending.length > 0)
+                input.push({ type: "message", role, content: pending });
+            pending = [];
+        };
+        for (const b of m.content) {
+            switch (b.type) {
+                case "text": {
+                    const t = b.text;
+                    if (t.length > 0)
+                        pending.push({ type: role === "user" ? "input_text" : "output_text", text: t });
+                    break;
+                }
+                case "image": {
+                    const src = b.source;
+                    if (role === "user") {
+                        if (src.type === "base64" && src.data)
+                            pending.push({ type: "input_image", image_url: `data:${src.media_type ?? "image/png"};base64,${src.data}` });
+                        else if (src.type === "url" && src.url)
+                            pending.push({ type: "input_image", image_url: src.url });
+                    }
+                    break;
+                }
+                case "tool_use": {
+                    flush();
+                    const tu = b;
+                    knownCalls.add(tu.id);
+                    input.push({ type: "function_call", call_id: tu.id, name: tu.name, arguments: typeof tu.input === "string" ? tu.input : JSON.stringify(tu.input ?? {}) });
+                    break;
+                }
+                case "tool_result": {
+                    flush();
+                    const tr = b;
+                    let out = blockText(tr.content);
+                    if (tr.is_error && !out)
+                        out = "Tool execution failed";
+                    if (knownCalls.has(tr.tool_use_id))
+                        input.push({ type: "function_call_output", call_id: tr.tool_use_id, output: out });
+                    else
+                        pending.push({ type: "input_text", text: `[Tool result]\n${out}` });
+                    break;
+                }
+                default:
+                    // thinking / redacted_thinking / unknown: dropped on purpose (see header comment)
+                    break;
+            }
+        }
+        flush();
+    }
+    const tools = (req.tools ?? [])
+        .filter((t) => typeof t.name === "string")
+        .map((t) => ({ type: "function", name: t.name, description: t.description ?? "", parameters: normalizeSchema(t.input_schema), strict: false }));
+    let tool_choice;
+    const tc = req.tool_choice;
+    if (tools.length > 0) {
+        if (!tc || tc.type === "auto")
+            tool_choice = "auto";
+        else if (tc.type === "any")
+            tool_choice = "required";
+        else if (tc.type === "none")
+            tool_choice = "none";
+        else if (tc.type === "tool" && tc.name)
+            tool_choice = { type: "function", name: tc.name };
+    }
+    const out = {
+        model: opts.model,
+        instructions: parts.join("\n\n"),
+        input,
+        reasoning: { effort: opts.effort, summary: "auto" },
+        text: { verbosity: "medium" },
+        store: false,
+        stream: true,
+        prompt_cache_key: conversationKey(req),
+    };
+    if (tools.length > 0) {
+        out.tools = tools;
+        out.parallel_tool_calls = !(tc?.disable_parallel_tool_use ?? false);
+    }
+    if (tool_choice)
+        out.tool_choice = tool_choice;
+    return out;
+}
+/** Rough token estimate for /v1/messages/count_tokens when the model is not Anthropic's. */
+export function estimateTokens(req) {
+    const text = JSON.stringify({ s: req.system ?? "", m: req.messages, t: req.tools ?? [] });
+    return Math.ceil(text.length / 4);
+}
+/** Stateful mapper: feed Responses SSE events, get Anthropic SSE events. */
+export class StreamMapper {
+    started = false;
+    blockIndex = -1;
+    open = null;
+    sawToolCall = false;
+    finished = false;
+    messageId;
+    model;
+    usage = { input_tokens: 0, output_tokens: 0, cache_read_input_tokens: 0, cache_creation_input_tokens: 0 };
+    /** Latest `codex.rate_limits` payload, if the backend sent one. */
+    rateLimits = null;
+    /** Accumulated content for non-streaming responses. */
+    content = [];
+    stopReason = "end_turn";
+    /** Input-token figure announced in message_start (the real one only arrives with response.completed). */
+    startInput;
+    constructor(model, startInput = 0) {
+        this.model = model;
+        this.startInput = startInput;
+        this.messageId = `msg_${crypto.randomBytes(12).toString("hex")}`;
+    }
+    get isFinished() {
+        return this.finished;
+    }
+    start() {
+        if (this.started)
+            return [];
+        this.started = true;
+        return [
+            {
+                event: "message_start",
+                data: {
+                    type: "message_start",
+                    // Claude Code snapshots `message.usage` per streamed content block, before message_delta
+                    // (measured 2026-09-13: with zeros here the app showed "1 token" for a 118k-token subagent and
+                    // the CLI's context accounting saw an empty context). Announce an estimate; the true figures
+                    // follow in message_delta and the SDK merges them into the final message.
+                    message: { id: this.messageId, type: "message", role: "assistant", model: this.model, content: [], stop_reason: null, stop_sequence: null, usage: { input_tokens: this.startInput, output_tokens: 0, cache_read_input_tokens: 0, cache_creation_input_tokens: 0 } },
+                },
+            },
+        ];
+    }
+    closeBlock() {
+        if (!this.open)
+            return [];
+        const evs = [];
+        if (this.open.kind === "thinking")
+            evs.push({ event: "content_block_delta", data: { type: "content_block_delta", index: this.blockIndex, delta: { type: "signature_delta", signature: "" } } });
+        evs.push({ event: "content_block_stop", data: { type: "content_block_stop", index: this.blockIndex } });
+        this.open = null;
+        return evs;
+    }
+    openBlock(kind, block, itemId) {
+        const evs = this.closeBlock();
+        this.blockIndex++;
+        this.open = itemId ? { kind, itemId } : { kind };
+        evs.push({ event: "content_block_start", data: { type: "content_block_start", index: this.blockIndex, content_block: block } });
+        return evs;
+    }
+    /** Map one upstream event. Returns Anthropic events to emit (possibly none). */
+    feed(ev) {
+        const type = ev.type;
+        const out = [...this.start()];
+        switch (type) {
+            case "codex.rate_limits":
+                this.rateLimits = ev;
+                break;
+            case "response.output_item.added": {
+                const item = ev.item;
+                if (item.type === "function_call") {
+                    this.sawToolCall = true;
+                    const id = item.call_id ?? item.id ?? `call_${crypto.randomBytes(8).toString("hex")}`;
+                    this.content.push({ type: "tool_use", id, name: item.name ?? "tool", input: {}, _args: "" });
+                    out.push(...this.openBlock("tool", { type: "tool_use", id, name: item.name ?? "tool", input: {} }, item.id));
+                }
+                else if (item.type === "reasoning") {
+                    this.content.push({ type: "thinking", thinking: "", signature: "" });
+                    out.push(...this.openBlock("thinking", { type: "thinking", thinking: "" }, item.id));
+                }
+                else if (item.type === "message") {
+                    this.content.push({ type: "text", text: "" });
+                    out.push(...this.openBlock("text", { type: "text", text: "" }, item.id));
+                }
+                break;
+            }
+            case "response.output_text.delta": {
+                const delta = String(ev.delta ?? "");
+                if (!this.open || this.open.kind !== "text") {
+                    this.content.push({ type: "text", text: "" });
+                    out.push(...this.openBlock("text", { type: "text", text: "" }));
+                }
+                const last = this.content[this.content.length - 1];
+                if (last?.type === "text")
+                    last.text += delta;
+                out.push({ event: "content_block_delta", data: { type: "content_block_delta", index: this.blockIndex, delta: { type: "text_delta", text: delta } } });
+                break;
+            }
+            case "response.reasoning_summary_text.delta":
+            case "response.reasoning_text.delta": {
+                const delta = String(ev.delta ?? "");
+                if (!this.open || this.open.kind !== "thinking") {
+                    this.content.push({ type: "thinking", thinking: "", signature: "" });
+                    out.push(...this.openBlock("thinking", { type: "thinking", thinking: "" }));
+                }
+                const last = this.content[this.content.length - 1];
+                if (last?.type === "thinking")
+                    last.thinking += delta;
+                out.push({ event: "content_block_delta", data: { type: "content_block_delta", index: this.blockIndex, delta: { type: "thinking_delta", thinking: delta } } });
+                break;
+            }
+            case "response.function_call_arguments.delta": {
+                const delta = String(ev.delta ?? "");
+                const last = this.content[this.content.length - 1];
+                if (last?.type === "tool_use")
+                    last._args = (last._args ?? "") + delta;
+                if (this.open?.kind === "tool")
+                    out.push({ event: "content_block_delta", data: { type: "content_block_delta", index: this.blockIndex, delta: { type: "input_json_delta", partial_json: delta } } });
+                break;
+            }
+            case "response.function_call_arguments.done": {
+                const last = this.content[this.content.length - 1];
+                if (last?.type === "tool_use") {
+                    const args = typeof ev.arguments === "string" ? ev.arguments : last._args ?? "";
+                    try {
+                        last.input = args ? JSON.parse(args) : {};
+                    }
+                    catch {
+                        last.input = {};
+                    }
+                    delete last._args;
+                }
+                break;
+            }
+            case "response.output_item.done": {
+                out.push(...this.closeBlock());
+                break;
+            }
+            case "response.completed":
+            case "response.incomplete": {
+                const r = ev.response;
+                const u = r?.usage;
+                if (u) {
+                    const cached = u.input_tokens_details?.cached_tokens ?? 0;
+                    this.usage = {
+                        input_tokens: Math.max(0, (u.input_tokens ?? 0) - cached),
+                        output_tokens: u.output_tokens ?? 0,
+                        cache_read_input_tokens: cached,
+                        cache_creation_input_tokens: 0,
+                    };
+                }
+                this.stopReason = this.sawToolCall ? "tool_use" : r?.incomplete_details?.reason === "max_output_tokens" ? "max_tokens" : "end_turn";
+                out.push(...this.finish());
+                break;
+            }
+            case "response.failed": {
+                const r = ev.response;
+                out.push(...this.fail(r?.error?.message ?? "upstream response failed", r?.error?.code));
+                break;
+            }
+            case "error": {
+                const e = ev.error;
+                out.push(...this.fail(e?.message ?? "upstream error", e?.code));
+                break;
+            }
+            default:
+                break; // response.created / in_progress / content_part.* / reasoning_summary_part.* etc. carry nothing we need
+        }
+        return out;
+    }
+    finish() {
+        if (this.finished)
+            return [];
+        this.finished = true;
+        const out = [...this.start(), ...this.closeBlock()];
+        out.push({ event: "message_delta", data: { type: "message_delta", delta: { stop_reason: this.stopReason, stop_sequence: null }, usage: this.usage } });
+        out.push({ event: "message_stop", data: { type: "message_stop" } });
+        return out;
+    }
+    fail(message, code) {
+        if (this.finished)
+            return [];
+        this.finished = true;
+        const type = code === "server_is_overloaded" ? "overloaded_error" : code === "rate_limit_exceeded" || code === "usage_limit_reached" ? "rate_limit_error" : "api_error";
+        return [...this.start(), ...this.closeBlock(), { event: "error", data: { type: "error", error: { type, message } } }];
+    }
+    /** Non-streaming body once finished. */
+    message() {
+        const content = this.content.map((b) => {
+            if (b.type === "tool_use") {
+                const { _args, ...rest } = b;
+                if (_args !== undefined) {
+                    try {
+                        rest.input = _args ? JSON.parse(_args) : {};
+                    }
+                    catch {
+                        rest.input = {};
+                    }
+                }
+                return rest;
+            }
+            return b;
+        });
+        return { id: this.messageId, type: "message", role: "assistant", model: this.model, content, stop_reason: this.stopReason, stop_sequence: null, usage: this.usage };
+    }
+}
+export function formatSse(ev) {
+    return `event: ${ev.event}\ndata: ${JSON.stringify(ev.data)}\n\n`;
+}

package/dist/router/src/providers/claude-oauth.js

@@ -0,0 +1,252 @@
+// Claude subscription sign-in of our own: the OAuth authorization-code flow with PKCE that Claude
+// Code itself uses, driven from ClaudeRipple so that no terminal is needed. Until 0.1.2 the only
+// way to connect a subscription was `claude setup-token`, an interactive terminal flow that the
+// tray app and the GUI cannot host (2026-09-15, Windows report).
+//
+// Wire facts are behaviorally measured against Claude Code's public client and are not an
+// Anthropic guarantee (docs/ARCHITECTURE.md §4b). The browser is sent to claude.ai; the code comes
+// back either to a loopback listener on the registered port or, when that port is taken, through
+// the manual "paste the code" page (`code#state`). Tokens are stored only in <home>/claude-auth.json
+// (mode 0600) and never logged or returned by the admin API.
+import crypto from "node:crypto";
+import http from "node:http";
+import net from "node:net";
+import { saveClaudeOAuthFile } from "./anthropic-token-file.js";
+// Endpoints, scopes and body shapes are what Claude Code 2.1.271 sends (read from its binary on
+// 2026-09-16): the claude.ai login is `claude.com/cai/oauth/authorize`, tokens come from
+// `platform.claude.com`. The previous `claude.ai/oauth/authorize` answers "Invalid request format".
+export const CLAUDE_OAUTH = {
+    clientId: "9d1c250a-e61b-44d9-88ed-5944d1962f5e",
+    authorizeUrl: "https://claude.com/cai/oauth/authorize",
+    tokenUrl: "https://platform.claude.com/v1/oauth/token",
+    scope: "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload",
+    /** The refresh grant names the subscription scopes only (as Claude Code does). */
+    refreshScope: "user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload",
+    /** Preferred loopback port; any free port is accepted by the authorize server, so a taken port falls back to a random one. */
+    port: 54545,
+    callbackPath: "/callback",
+    /** Anthropic's own page that shows the code for pasting when no loopback listener can be reached. */
+    manualRedirectUri: "https://platform.claude.com/oauth/code/callback",
+    /** How long a sign-in may stay open before it is abandoned. */
+    timeoutMs: 5 * 60 * 1000,
+    /** Refresh this long before the access token expires. */
+    refreshLeadMs: 5 * 60 * 1000,
+};
+function base64url(buffer) {
+    return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function postToken(fetchImpl, body) {
+    const response = await fetchImpl(CLAUDE_OAUTH.tokenUrl, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(30_000),
+    });
+    const text = await response.text();
+    let parsed = {};
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        // A non-JSON body is reported through the status below.
+    }
+    if (!response.ok) {
+        const detail = typeof parsed.error_description === "string" ? parsed.error_description : typeof parsed.error === "string" ? parsed.error : `HTTP ${response.status}`;
+        throw new Error(`Claude sign-in was refused by the token endpoint: ${detail}`);
+    }
+    return parsed;
+}
+function grantFrom(reply, now, previousRefresh) {
+    if (typeof reply.access_token !== "string" || reply.access_token.length === 0)
+        throw new Error("Claude sign-in returned no access token");
+    const refreshToken = typeof reply.refresh_token === "string" && reply.refresh_token.length > 0 ? reply.refresh_token : previousRefresh;
+    if (!refreshToken)
+        throw new Error("Claude sign-in returned no refresh token");
+    // A missing or absurd expires_in is treated as one hour: better an early refresh than a token
+    // believed valid forever.
+    const expiresIn = typeof reply.expires_in === "number" && Number.isFinite(reply.expires_in) && reply.expires_in > 0 ? reply.expires_in : 3600;
+    return { accessToken: reply.access_token, refreshToken, expiresAt: now + expiresIn * 1000 };
+}
+/** Exchanges a refresh token; the caller persists the result. */
+export async function refreshClaudeOAuth(refreshToken, options = {}) {
+    const reply = await postToken(options.fetch ?? fetch, { grant_type: "refresh_token", client_id: CLAUDE_OAUTH.clientId, refresh_token: refreshToken, scope: CLAUDE_OAUTH.refreshScope });
+    return grantFrom(reply, (options.now ?? Date.now)(), refreshToken);
+}
+/**
+ * One sign-in attempt. `start()` returns the authorize URL; the grant arrives through the loopback
+ * callback or `submitCode()`, whichever comes first; `result` resolves when the credential file is
+ * written or the attempt failed. A session is single-use.
+ */
+export class ClaudeOAuthSession {
+    result;
+    options;
+    verifier = base64url(crypto.randomBytes(32));
+    // 32 bytes, the size Claude Code 2.1.272 uses for both the verifier and the state.
+    state = base64url(crypto.randomBytes(32));
+    redirectUri = "";
+    server = null;
+    server6 = null;
+    settle;
+    grant;
+    timer = null;
+    finished = false;
+    stateSnapshot = { running: false, url: null, manual: false, startedAt: null, finishedAt: null, ok: null, error: null };
+    constructor(options) {
+        this.options = options;
+        this.grant = new Promise((resolve, reject) => {
+            this.settle = { resolve, reject };
+        });
+        this.result = this.grant.then((grant) => {
+            saveClaudeOAuthFile(options.home, grant);
+            this.stateSnapshot = { ...this.stateSnapshot, running: false, finishedAt: new Date().toISOString(), ok: true };
+        }, (error) => {
+            this.stateSnapshot = { ...this.stateSnapshot, running: false, finishedAt: new Date().toISOString(), ok: false, error: error.message };
+            throw error;
+        });
+        // Nobody may be awaiting `result` (the GUI polls state instead); do not surface it as unhandled.
+        this.result.catch(() => { });
+    }
+    get snapshot() {
+        return this.stateSnapshot;
+    }
+    /** The loopback port in use, once started. */
+    port = null;
+    /** Starts the loopback listener when possible and returns the URL to open. */
+    async start() {
+        const manual = this.options.manual ? true : !(await this.listen(this.options.port ?? CLAUDE_OAUTH.port)) && !(await this.listen(0));
+        this.redirectUri = manual ? CLAUDE_OAUTH.manualRedirectUri : `http://localhost:${this.port}${CLAUDE_OAUTH.callbackPath}`;
+        const url = new URL(CLAUDE_OAUTH.authorizeUrl);
+        url.search = new URLSearchParams({
+            code: "true",
+            client_id: CLAUDE_OAUTH.clientId,
+            response_type: "code",
+            redirect_uri: this.redirectUri,
+            scope: CLAUDE_OAUTH.scope,
+            code_challenge: base64url(crypto.createHash("sha256").update(this.verifier).digest()),
+            code_challenge_method: "S256",
+            state: this.state,
+        }).toString();
+        this.timer = setTimeout(() => this.fail(new Error("Claude sign-in timed out; start it again")), CLAUDE_OAUTH.timeoutMs);
+        this.timer.unref();
+        this.stateSnapshot = { running: true, url: url.toString(), manual, startedAt: new Date().toISOString(), finishedAt: null, ok: null, error: null };
+        return { url: url.toString(), manual };
+    }
+    /** Accepts `code`, `code#state`, or the full redirect URL the browser landed on. */
+    async submitCode(input) {
+        let code = input.trim();
+        let state = null;
+        try {
+            const u = new URL(code);
+            code = u.searchParams.get("code") ?? "";
+            state = u.searchParams.get("state");
+        }
+        catch {
+            const hash = code.indexOf("#");
+            if (hash >= 0) {
+                state = code.slice(hash + 1) || null;
+                code = code.slice(0, hash);
+            }
+        }
+        if (!code) {
+            this.fail(new Error("No authorization code in what was pasted"));
+            return;
+        }
+        if (state !== null && state !== this.state) {
+            this.fail(new Error("The pasted code belongs to a different sign-in attempt"));
+            return;
+        }
+        await this.exchange(code);
+    }
+    /** Abandons the attempt (a new one may start). */
+    cancel() {
+        this.fail(new Error("Claude sign-in cancelled"));
+    }
+    listen(port) {
+        return new Promise((resolve) => {
+            const handler = (req, res) => {
+                const u = new URL(req.url ?? "/", "http://localhost");
+                if (u.pathname !== CLAUDE_OAUTH.callbackPath) {
+                    res.writeHead(404).end();
+                    return;
+                }
+                const error = u.searchParams.get("error");
+                const code = u.searchParams.get("code");
+                // A request that is not for this attempt (wrong or missing state) is refused but does not
+                // end the attempt: anything on the machine can hit a loopback port, and the real redirect
+                // may still be on its way.
+                if (u.searchParams.get("state") !== this.state || (!error && !code)) {
+                    res.writeHead(400, { "content-type": "text/plain; charset=utf-8" }).end("Claude sign-in: this is not the sign-in ClaudeRipple is waiting for. You can close this tab.");
+                    return;
+                }
+                if (error || !code) {
+                    res.writeHead(400, { "content-type": "text/plain; charset=utf-8" }).end(`Claude sign-in failed: ${error}. You can close this tab.`);
+                    this.fail(new Error(`Claude refused the sign-in: ${error}`));
+                    return;
+                }
+                res.writeHead(200, { "content-type": "text/plain; charset=utf-8" }).end("ClaudeRipple: Claude subscription connected. You can close this tab.");
+                void this.exchange(code);
+            };
+            const server = http.createServer(handler);
+            server.once("error", () => resolve(false));
+            server.listen(port, "127.0.0.1", () => {
+                this.server = server;
+                this.port = server.address().port;
+                // The browser resolves "localhost" to ::1 or 127.0.0.1 as it likes; answer on both when
+                // IPv6 loopback is available. Best effort: the IPv4 listener alone is enough on most systems.
+                const six = http.createServer(handler);
+                six.once("error", () => { });
+                six.listen(this.port, "::1", () => {
+                    this.server6 = six;
+                });
+                resolve(true);
+            });
+        });
+    }
+    async exchange(code) {
+        if (this.finished)
+            return;
+        try {
+            const reply = await postToken(this.options.fetch ?? fetch, {
+                grant_type: "authorization_code",
+                client_id: CLAUDE_OAUTH.clientId,
+                code,
+                state: this.state,
+                redirect_uri: this.redirectUri,
+                code_verifier: this.verifier,
+            });
+            this.finish();
+            this.settle.resolve(grantFrom(reply, (this.options.now ?? Date.now)()));
+        }
+        catch (error) {
+            this.fail(error);
+        }
+    }
+    fail(error) {
+        if (this.finished)
+            return;
+        this.finish();
+        this.settle.reject(error);
+    }
+    finish() {
+        this.finished = true;
+        if (this.timer)
+            clearTimeout(this.timer);
+        for (const server of [this.server, this.server6]) {
+            if (!server)
+                continue;
+            server.close();
+            // Keep-alive connections would otherwise hold the port for their idle timeout.
+            server.closeAllConnections?.();
+        }
+        this.server = null;
+        this.server6 = null;
+    }
+}
+/** True when nothing is listening on the registered callback port (a hint for the GUI, not a guarantee). */
+export function callbackPortFree(port = CLAUDE_OAUTH.port) {
+    return new Promise((resolve) => {
+        const probe = net.createServer();
+        probe.once("error", () => resolve(false));
+        probe.listen(port, "127.0.0.1", () => probe.close(() => resolve(true)));
+    });
+}