coding-tool-x 3.8.4 → 3.8.5

package/src/server/websocket-server.js

@@ -4,6 +4,7 @@ const fs = require('fs');
 const path = require('path');
 const { loadConfig } = require('../config/loader');
 const { PATHS } = require('../config/paths');
+const eventBus = require('../plugins/event-bus');
 const {
   normalizeAddress,
   isLoopbackAddress,
@@ -11,19 +12,28 @@ const {
 } = require('./services/network-access');
 
 const MAX_PERSISTED_LOGS = 500;
+const LOG_PERSIST_DEBOUNCE_MS = 250;
+
+let maxLogsLimit = 100;
 
 function getMaxLogsLimit() {
+  return maxLogsLimit;
+}
+
+function refreshMaxLogsLimit(config = null) {
   try {
-    const config = loadConfig();
-    const limit = parseInt(config.maxLogs, 10);
+    const limit = parseInt((config || loadConfig()).maxLogs, 10);
     if (!Number.isFinite(limit)) {
-      return 100;
+      maxLogsLimit = 100;
+    } else {
+      maxLogsLimit = Math.min(Math.max(limit, 50), MAX_PERSISTED_LOGS);
     }
-    return Math.min(Math.max(limit, 50), MAX_PERSISTED_LOGS);
   } catch (err) {
     console.error('Failed to load log limit from config:', err);
-    return 100;
+    maxLogsLimit = 100;
   }
+  trimLogCache();
+  return maxLogsLimit;
 }
 
 let wss = null;
@@ -227,8 +237,7 @@ function filterTodayLogs(logs) {
   });
 }
 
-function enforcePerSourceLimit(logs) {
-  const limit = getMaxLogsLimit();
+function enforcePerSourceLimit(logs, limit = getMaxLogsLimit()) {
   if (!limit || limit <= 0) {
     return logs;
   }
@@ -263,21 +272,130 @@ function loadPersistedLogs() {
   return [];
 }
 
-// 保存日志到文件
-function saveLogsToFile(logs) {
+function serializeLogs(logs) {
   try {
-    const logsFile = getLogsFilePath();
-    // 只保留最新的 MAX_PERSISTED_LOGS 条，且仅保存今日日志
     const todayLogs = enforcePerSourceLimit(filterTodayLogs(logs));
     const logsToSave = todayLogs.slice(-MAX_PERSISTED_LOGS);
-    fs.writeFileSync(logsFile, JSON.stringify(logsToSave, null, 2), 'utf8');
+    return JSON.stringify(logsToSave, null, 2);
   } catch (err) {
-    console.error('Failed to save logs to file:', err);
+    console.error('Failed to serialize logs:', err);
+    return '[]';
   }
 }
 
 // 内存中的日志缓存
 let logsCache = [];
+let logSourceCounts = new Map();
+let cacheDayStartMs = null;
+let persistTimer = null;
+let persistGeneration = 0;
+let persistedGeneration = 0;
+let enqueuedGeneration = 0;
+let persistChain = Promise.resolve();
+let configSavedListener = null;
+
+function rebuildLogSourceCounts() {
+  logSourceCounts = new Map();
+  logsCache.forEach(log => {
+    const source = log.source || 'claude';
+    logSourceCounts.set(source, (logSourceCounts.get(source) || 0) + 1);
+  });
+}
+
+function removeLogAt(index) {
+  if (index < 0 || index >= logsCache.length) return;
+  const [removed] = logsCache.splice(index, 1);
+  const source = removed?.source || 'claude';
+  const count = (logSourceCounts.get(source) || 1) - 1;
+  if (count > 0) logSourceCounts.set(source, count);
+  else logSourceCounts.delete(source);
+}
+
+function trimLogCache() {
+  const { startMs, endMs } = getTodayRange();
+  if (cacheDayStartMs !== startMs) {
+    logsCache = logsCache.filter(log => {
+      let timestamp = typeof log.timestamp === 'number' ? log.timestamp : Date.parse(log.timestamp);
+      if (!Number.isFinite(timestamp)) timestamp = Date.now();
+      log.timestamp = timestamp;
+      log.source = inferSource(log);
+      return timestamp >= startMs && timestamp < endMs;
+    });
+    cacheDayStartMs = startMs;
+    rebuildLogSourceCounts();
+  }
+
+  const limit = getMaxLogsLimit();
+  if (limit > 0) {
+    for (const [source, count] of [...logSourceCounts]) {
+      let remaining = count - limit;
+      if (remaining <= 0) continue;
+      for (let index = 0; index < logsCache.length && remaining > 0; index += 1) {
+        if (logsCache[index].source === source) {
+          removeLogAt(index);
+          index -= 1;
+          remaining -= 1;
+        }
+      }
+    }
+  }
+  while (logsCache.length > MAX_PERSISTED_LOGS) removeLogAt(0);
+}
+
+function appendLogToCache(payload) {
+  trimLogCache();
+  logsCache.push(payload);
+  const source = payload.source || 'claude';
+  logSourceCounts.set(source, (logSourceCounts.get(source) || 0) + 1);
+  trimLogCache();
+}
+
+function enqueueLogPersistence(data, generation) {
+  enqueuedGeneration = Math.max(enqueuedGeneration, generation);
+  persistChain = persistChain
+    .catch(() => {})
+    .then(async () => {
+      await fs.promises.writeFile(getLogsFilePath(), data, 'utf8');
+      persistedGeneration = Math.max(persistedGeneration, generation);
+    })
+    .catch((error) => {
+      console.error('Failed to save logs to file:', error);
+    });
+  return persistChain;
+}
+
+function scheduleLogPersistence({ markDirty = true } = {}) {
+  if (markDirty) persistGeneration += 1;
+  if (persistTimer) return;
+  persistTimer = setTimeout(() => {
+    persistTimer = null;
+    flushPendingLogs();
+  }, LOG_PERSIST_DEBOUNCE_MS);
+  if (typeof persistTimer.unref === 'function') persistTimer.unref();
+}
+
+function flushPendingLogs() {
+  if (persistTimer) {
+    clearTimeout(persistTimer);
+    persistTimer = null;
+  }
+  if (persistGeneration <= persistedGeneration || persistGeneration <= enqueuedGeneration) {
+    return persistChain;
+  }
+  const generation = persistGeneration;
+  const data = serializeLogs(logsCache.slice());
+  return enqueueLogPersistence(data, generation).then(() => {
+    if (persistGeneration > generation && persistGeneration > enqueuedGeneration) {
+      scheduleLogPersistence({ markDirty: false });
+    }
+  });
+}
+
+function ensureConfigListener() {
+  if (configSavedListener) return;
+  configSavedListener = ({ config } = {}) => refreshMaxLogsLimit(config);
+  eventBus.on('config:saved', configSavedListener);
+}
 
 // 启动 WebSocket 服务器（附加到现有的 HTTP 服务器）
 function startWebSocketServer(httpServer, options = {}) {
@@ -290,8 +408,12 @@ function startWebSocketServer(httpServer, options = {}) {
     host: options.host || '127.0.0.1'
   };
 
+  ensureConfigListener();
+  refreshMaxLogsLimit();
   // 加载持久化的日志到缓存
   logsCache = loadPersistedLogs();
+  cacheDayStartMs = getTodayRange().startMs;
+  rebuildLogSourceCounts();
   const counts = logsCache.reduce((acc, log) => {
     const source = log.source || 'unknown';
     acc[source] = (acc[source] || 0) + 1;
@@ -389,7 +511,7 @@ function startWebSocketServer(httpServer, options = {}) {
 // 停止 WebSocket 服务器
 function stopWebSocketServer() {
   if (!wss) {
-    return;
+    return flushPendingLogs();
   }
 
   // 清除心跳定时器
@@ -410,6 +532,7 @@ function stopWebSocketServer() {
   });
 
   wss = null;
+  return flushPendingLogs();
 }
 
 // 广播日志消息
@@ -422,16 +545,9 @@ function broadcastLog(logData) {
 
   payload.source = payload.source || inferSource(payload);
 
-  // 添加到缓存
-  logsCache.push(payload);
-  logsCache = enforcePerSourceLimit(filterTodayLogs(logsCache));
-
-  if (logsCache.length > MAX_PERSISTED_LOGS) {
-    logsCache = logsCache.slice(-MAX_PERSISTED_LOGS);
-  }
-
-  // 保存到文件
-  saveLogsToFile(logsCache);
+  // 添加到有界内存缓存，持久化由防抖队列合并处理。
+  appendLogToCache(payload);
+  scheduleLogPersistence();
 
   // 广播给所有连接的客户端
   if (wss && wsClients.size > 0) {
@@ -448,17 +564,25 @@ function broadcastLog(logData) {
 // 清空所有日志
 function clearAllLogs() {
   logsCache = [];
-  saveLogsToFile([]);
+  logSourceCounts = new Map();
+  cacheDayStartMs = getTodayRange().startMs;
+  persistGeneration += 1;
+  if (persistTimer) {
+    clearTimeout(persistTimer);
+    persistTimer = null;
+  }
+  const generation = persistGeneration;
+  enqueueLogPersistence('[]', generation);
   console.log('[OK] All logs cleared');
+  return persistChain;
 }
 
-// 去掉敏感字段
+// 复制渠道状态，保留 API key 供前端展示
 function sanitizeChannel(channel) {
   if (!channel || typeof channel !== 'object') {
     return null;
   }
-  const { apiKey, ...rest } = channel;
-  return rest;
+  return { ...channel };
 }
 
 function sanitizeChannels(channels) {
@@ -531,6 +655,7 @@ module.exports = {
   stopWebSocketServer,
   broadcastLog,
   clearAllLogs,
+  flushPendingLogs,
   broadcastProxyState,
   broadcastSchedulerState,
   broadcastBrowserNotification

package/src/{server/services/base → shared}/base-channel-service.js

@@ -1,8 +1,7 @@
 /**
  * BaseChannelService - 四平台渠道管理的公共基类
  *
- * 提取 channels.js / codex-channels.js / gemini-channels.js / opencode-channels.js
- * 中的共享 CRUD、启用/禁用、单渠道强制等逻辑。
+ * 为各平台 Driver 实现提供共享 CRUD、启用/禁用、单渠道强制等基础能力。
  *
  * 子类通过覆写钩子方法实现平台差异化行为。
  */
@@ -11,16 +10,25 @@ const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
 const { normalizeGatewaySourceType, normalizeNumber } = require('./proxy-utils');
-const { resolveChannelWebsiteUrl } = require('../../../config/channel-preset-websites');
-
+const { resolveChannelWebsiteUrl } = require('../config/channel-preset-websites');
+const { assertAuthMode, validateEnabledTransition } = require('./channel-auth-policy');
 function clearChannelBalanceCache(platform, channel) {
   try {
-    require('../channel-balance').clearChannelBalanceCache(platform, channel);
+    require('../server/services/channel-balance').clearChannelBalanceCache(platform, channel);
   } catch (_) {
     // Balance cache invalidation is an optimization; channel updates must still succeed.
   }
 }
 
+function invalidateDashboardSource(platform) {
+  try {
+    const { invalidateDashboardSourceSnapshot } = require('../server/services/snapshot-cache');
+    invalidateDashboardSourceSnapshot(platform);
+  } catch (_) {
+    // Dashboard snapshots are an optimization; channel mutations still succeed.
+  }
+}
+
 class BaseChannelService {
   /**
    * @param {object} config
@@ -33,9 +41,16 @@ class BaseChannelService {
     this.platform = config.platform;
     this.channelsFilePath = config.channelsFilePath;
     this.defaultGatewaySource = config.defaultGatewaySource || config.platform;
+    this.oauthChannelPolicy = config.oauthChannelPolicy || 'mixed';
     this._isProxyRunning = config.isProxyRunning || (() => false);
+    this._channelCache = { value: null, mtimeMs: 0, invalidated: true };
   }
 
+  _generateId() {
+    return crypto.randomUUID();
+  }
+
+
   // ── 文件 I/O ──
 
   _ensureDir() {
@@ -45,23 +60,59 @@ class BaseChannelService {
     }
   }
 
+  _channelFileMtime() {
+    try {
+      return fs.statSync(this.channelsFilePath).mtimeMs;
+    } catch (_) {
+      return 0;
+    }
+  }
+
+  _cloneChannelData(data) {
+    return {
+      channels: Array.isArray(data?.channels)
+        ? data.channels.map(channel => ({ ...channel }))
+        : []
+    };
+  }
+
   loadChannels() {
     this._ensureDir();
+    const mtimeMs = this._channelFileMtime();
+    if (!this._channelCache.invalidated
+      && this._channelCache.mtimeMs === mtimeMs
+      && this._channelCache.value) {
+      return this._cloneChannelData(this._channelCache.value);
+    }
+
+    let value = { channels: [] };
     try {
       if (fs.existsSync(this.channelsFilePath)) {
         const raw = JSON.parse(fs.readFileSync(this.channelsFilePath, 'utf8'));
         const channels = Array.isArray(raw?.channels) ? raw.channels : [];
-        return { channels: channels.map(ch => this._applyDefaults(ch)) };
+        value = { channels: channels.map(channel => this._applyDefaults(channel)) };
       }
     } catch (err) {
       console.error(`[${this.platform}-channels] Error loading channels:`, err.message);
     }
-    return { channels: [] };
+    this._channelCache = { value, mtimeMs: this._channelFileMtime(), invalidated: false };
+    return this._cloneChannelData(value);
   }
 
   saveChannels(data) {
     this._ensureDir();
     fs.writeFileSync(this.channelsFilePath, JSON.stringify(data, null, 2), 'utf8');
+    const value = {
+      channels: Array.isArray(data?.channels)
+        ? data.channels.map(channel => this._applyDefaults(channel))
+        : []
+    };
+    this._channelCache = { value, mtimeMs: this._channelFileMtime(), invalidated: false };
+    invalidateDashboardSource(this.platform);
+  }
+
+  invalidate() {
+    this._channelCache.invalidated = true;
   }
 
   // ── 查询 ──
@@ -76,23 +127,22 @@ class BaseChannelService {
   }
 
   // ── CRUD ──
-
-  createChannel(fields) {
+  createChannel(fields = {}) {
     const data = this.loadChannels();
+    const normalizedFields = this._normalizeAuthFields(fields, data.channels);
 
-    // 子类可覆写的唯一性校验
-    this._validateUniqueness(data.channels, fields);
+    this._validateUniqueness(data.channels, normalizedFields);
 
     const channel = this._applyDefaults({
       id: this._generateId(),
-      ...fields,
+      ...normalizedFields,
       createdAt: Date.now(),
       updatedAt: Date.now(),
     });
 
     data.channels.push(channel);
-
-    // 单渠道强制：代理未运行时只允许一个渠道启用
+    this._validateOAuthEnabledTransition(data.channels, channel, null);
+    this._validateBeforeChannelMutation(channel, data.channels, { operation: 'create' });
     if (channel.enabled && !this._isProxyRunning()) {
       this._enforceSingleChannel(data.channels, data.channels.length - 1);
     }
@@ -101,28 +151,23 @@ class BaseChannelService {
     this._onAfterCreate(channel, data.channels);
     return channel;
   }
-
-  updateChannel(channelId, updates) {
+  updateChannel(channelId, updates = {}) {
     const data = this.loadChannels();
     const index = data.channels.findIndex(ch => ch.id === channelId);
-    if (index === -1) {
-      throw new Error('Channel not found');
-    }
+    if (index === -1) throw new Error('Channel not found');
 
     const oldChannel = data.channels[index];
-
-    // 子类可覆写的唯一性校验（排除自身）
-    this._validateUniqueness(data.channels, updates, channelId);
-
+    const normalizedUpdates = this._normalizeAuthFields(updates, data.channels, oldChannel);
+    this._validateUniqueness(data.channels, normalizedUpdates, channelId);
     const nextChannel = this._applyDefaults({
       ...oldChannel,
-      ...updates,
+      ...normalizedUpdates,
       id: channelId,
       updatedAt: Date.now(),
     });
+    this._validateOAuthEnabledTransition(data.channels, nextChannel, oldChannel);
+    this._validateBeforeChannelMutation(nextChannel, data.channels, { operation: 'update', oldChannel });
     data.channels[index] = nextChannel;
-
-    // 单渠道强制
     const isProxyRunning = this._isProxyRunning();
     if (!isProxyRunning && nextChannel.enabled && !oldChannel.enabled) {
       this._enforceSingleChannel(data.channels, index);
@@ -163,6 +208,7 @@ class BaseChannelService {
     if (!channel) {
       throw new Error('Channel not found');
     }
+    this._validateBeforeChannelMutation(channel, data.channels, { operation: 'apply' });
 
     // 单渠道模式：只启用目标渠道
     const wasEnabled = channel.enabled !== false;
@@ -206,11 +252,79 @@ class BaseChannelService {
   }
 
   // ── 内部方法 ──
+  _normalizeAuthFields(fields = {}, channels = [], existing = null) {
+    const next = { ...fields };
+    const currentMode = existing?.authMode || (existing ? 'api_key' : null);
+    const authMode = next.authMode || currentMode || 'api_key';
+    assertAuthMode(authMode);
+    const unsafeField = Object.keys(fields).find(key => {
+      if (key === 'balanceToken') {
+        return authMode === 'oauth' && String(fields[key] || '').trim() !== '';
+      }
+      return /token|secret|password|refresh|access/i.test(key);
+    });
+    if (unsafeField) {
+      const error = new Error('Invalid OAuth auth payload');
+      error.code = 'invalid_auth_payload';
+      error.statusCode = 400;
+      throw error;
+    }
+    if (currentMode && next.authMode && next.authMode !== currentMode) {
+      const error = new Error('Channel authMode is immutable');
+      error.code = 'auth_mode_immutable';
+      error.statusCode = 409;
+      throw error;
+    }
+    if (next.authRef && typeof next.authRef === 'object') {
+      const allowed = ['credentialId', 'providerId', 'accountId', 'identityKey', 'accountEmail'];
+      const unsafe = Object.keys(next.authRef).find(key => !allowed.includes(key));
+      if (unsafe) {
+        const error = new Error('Invalid OAuth auth payload');
+        error.code = 'invalid_auth_payload';
+        error.statusCode = 400;
+        throw error;
+      }
+      next.authRef = Object.fromEntries(allowed.map(key => [key, String(next.authRef[key] || '').trim()]));
+    } else if (next.authRef !== undefined && next.authRef !== null) {
+      const error = new Error('Invalid OAuth auth payload');
+      error.code = 'invalid_auth_payload';
+      error.statusCode = 400;
+      throw error;
+    }
+    if (authMode === 'oauth') {
+      if ((next.authSource || existing?.authSource) !== 'synced-local') {
+        const error = new Error('OAuth channels must use synced-local auth');
+        error.code = 'invalid_auth_payload';
+        error.statusCode = 400;
+        throw error;
+      }
+      next.authSource = 'synced-local';
+      const authRef = next.authRef || existing?.authRef;
+      const hasReference = authRef
+        && Object.values(authRef).some(value => String(value || '').trim() !== '');
+      if (!hasReference) {
+        const error = new Error('OAuth reference unavailable');
+        error.code = 'oauth_reference_unavailable';
+        error.statusCode = 422;
+        throw error;
+      }
+      next.apiKey = '';
+      next.baseUrl = next.baseUrl || '';
+    } else if (authMode === 'none') {
+      next.apiKey = '';
+      next.authRef = undefined;
+      next.authSource = undefined;
+    }
+    next.authMode = authMode;
+    return next;
+  }
 
-  _generateId() {
-    return crypto.randomUUID();
+  _validateOAuthEnabledTransition(channels, channel) {
+    validateEnabledTransition(channels, channel, this.oauthChannelPolicy);
   }
 
+  _validateBeforeChannelMutation(_channel, _allChannels, _context) {}
+
   _enforceSingleChannel(channels, enabledIndex) {
     channels.forEach((ch, i) => {
       if (i !== enabledIndex && ch.enabled) {
@@ -233,6 +347,20 @@ class BaseChannelService {
     }
     normalized.weight = normalizeNumber(normalized.weight, 1, 100);
     // maxConcurrency: null 表示不限制并发；只有用户显式设置正整数时才生效
+    normalized.authMode = ['api_key', 'oauth', 'none'].includes(normalized.authMode)
+      ? normalized.authMode
+      : 'api_key';
+    if (normalized.authMode === 'oauth') {
+      normalized.authSource = normalized.authSource || 'synced-local';
+      normalized.authRef = {
+        credentialId: String(normalized.authRef?.credentialId || '').trim(),
+        providerId: String(normalized.authRef?.providerId || '').trim(),
+        accountId: String(normalized.authRef?.accountId || '').trim(),
+        identityKey: String(normalized.authRef?.identityKey || '').trim(),
+        accountEmail: String(normalized.authRef?.accountEmail || '').trim()
+      };
+      normalized.apiKey = '';
+    }
     const rawConcurrency = normalized.maxConcurrency;
     normalized.maxConcurrency = (rawConcurrency !== null && rawConcurrency !== undefined && Number(rawConcurrency) > 0)
       ? Number(rawConcurrency)

package/src/shared/capability-driver.js

@@ -0,0 +1,104 @@
+'use strict';
+
+const { ok, unsupported, failed } = require('./driver-result');
+
+function createCapabilityDriver({
+  platform,
+  capability,
+  servicePath,
+  localServicePath,
+  methods = {},
+  customMethods = {},
+  adapterPath,
+  adapterLocalPath,
+  adapterMethods = {},
+  preservePayloadUpdatedAt = false,
+  parserVersion = 1,
+  requireImpl,
+  prependPlatform = false,
+  context = {},
+  ...injected
+} = {}) {
+  let service;
+  let adapter;
+  let configured = false;
+  let adapterConfigured = false;
+  const configureService = target => {
+    if (configured) return;
+    if (typeof target?.configure === 'function') {
+      target.configure({ ...injected, ...context, platform, capability });
+    }
+    configured = true;
+  };
+  const loadAdapter = () => {
+    if (!adapter && (adapterPath || adapterLocalPath)) {
+      adapter = adapterPath && requireImpl ? requireImpl(adapterPath) : require(adapterLocalPath);
+    }
+    if (!adapterConfigured && adapter) {
+      if (typeof adapter.configure === 'function') {
+        adapter.configure({ ...injected, ...context, platform, capability });
+      }
+      adapterConfigured = true;
+    }
+    return adapter;
+  };
+  const load = () => {
+    if (!service) {
+      service = requireImpl ? requireImpl(servicePath) : require(localServicePath);
+      configureService(service);
+    }
+    return service;
+  };
+  const driver = { platform, capability, preservePayloadUpdatedAt, parserVersion, ...context };
+  for (const [operation, methodName] of Object.entries(methods)) {
+    driver[operation] = (...args) => {
+      try {
+        const target = load();
+        if (typeof target?.[methodName] !== 'function') return unsupported(platform, capability, operation);
+        const value = target[methodName](...args);
+        const wrap = result => {
+          if (typeof onSuccess === 'function') onSuccess(operation, result);
+          return ok(platform, capability, operation, result);
+        };
+        return value && typeof value.then === 'function'
+          ? value.then(wrap).catch(error => failed(platform, capability, operation, error))
+          : wrap(value);
+      } catch (error) {
+        return failed(platform, capability, operation, error);
+      }
+    };
+  }
+  for (const [operation, customMethod] of Object.entries(customMethods)) {
+    driver[operation] = (...args) => {
+      try {
+        const target = load();
+        const value = customMethod(target, ...(prependPlatform ? [platform, ...args] : args));
+        const wrap = result => ok(platform, capability, operation, result);
+        return value && typeof value.then === 'function'
+          ? value.then(wrap).catch(error => failed(platform, capability, operation, error))
+          : wrap(value);
+      } catch (error) {
+        return failed(platform, capability, operation, error);
+      }
+    };
+  }
+  for (const [operation, methodName] of Object.entries(adapterMethods)) {
+    driver[operation] = (...args) => {
+      try {
+        const target = loadAdapter();
+        if (typeof target?.[methodName] !== 'function') return unsupported(platform, capability, operation);
+        const value = target[methodName](...args);
+        const wrap = result => ok(platform, capability, operation, result);
+        return value && typeof value.then === 'function'
+          ? value.then(wrap).catch(error => failed(platform, capability, operation, error))
+          : wrap(value);
+      } catch (error) {
+        return failed(platform, capability, operation, error);
+      }
+    };
+  }
+  Object.defineProperty(driver, '_service', { value: load, enumerable: false });
+  return driver;
+}
+
+module.exports = { createCapabilityDriver };

package/src/shared/channel-auth-policy.js

@@ -0,0 +1,27 @@
+'use strict';
+
+const AUTH_MODES = new Set(['api_key', 'oauth', 'none']);
+
+function createAuthError(message, code, statusCode) {
+  const error = new Error(message);
+  error.code = code;
+  error.statusCode = statusCode;
+  return error;
+}
+
+function validateEnabledTransition(channels, channel, policy = 'mixed') {
+  if (channel.authMode !== 'oauth' || channel.enabled === false || policy !== 'single-enabled') return;
+  const conflict = channels.find(item => item.id !== channel.id && item.authMode === 'oauth' && item.enabled !== false);
+  if (!conflict) return;
+  const error = createAuthError(`OAuth channel conflicts with ${conflict.name || conflict.id}`, 'oauth_channel_conflict', 409);
+  error.conflictingChannelId = conflict.id;
+  error.conflictingChannelName = conflict.name || conflict.id;
+  throw error;
+}
+
+function assertAuthMode(mode) {
+  if (!AUTH_MODES.has(mode)) throw createAuthError('Invalid auth mode', 'invalid_auth_payload', 400);
+  return mode;
+}
+
+module.exports = { AUTH_MODES, assertAuthMode, validateEnabledTransition };