dsh-claude-subscription 0.2.0

package/lib/index.js

@@ -0,0 +1,724 @@
+import { credentialRef } from "@deepseek-ai/dsh-credentials";
+import { LlmError } from "@deepseek-ai/dsh-llm";
+import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
+import { settingsNamespace } from "@deepseek-ai/dsh-settings";
+import z from "@deepseek-ai/schemastery";
+import { spawn } from "node:child_process";
+import { anthropicProvider as createAnthropicProvider } from "@earendil-works/pi-ai/providers/anthropic";
+import { createModels } from "@earendil-works/pi-ai";
+//#region src/credential-store.js
+const PROVIDER$1 = "anthropic";
+const abortIfNeeded = (options) => options?.signal?.throwIfAborted();
+const clone = (value) => value === void 0 ? void 0 : structuredClone(value);
+function assertProvider(providerId) {
+	if (providerId !== PROVIDER$1) throw new Error(`Claude credential store does not own provider ${JSON.stringify(providerId)}`);
+}
+function assertOAuthCredential(value) {
+	if (value === void 0) return void 0;
+	if (value === null || typeof value !== "object" || value.type !== "oauth" || typeof value.access !== "string" || value.access.length === 0 || typeof value.refresh !== "string" || value.refresh.length === 0 || typeof value.expires !== "number" || !Number.isFinite(value.expires)) throw new Error("Claude credential store received a malformed OAuth credential");
+	return clone(value);
+}
+function parseOAuthCredential(value) {
+	try {
+		return assertOAuthCredential(JSON.parse(value));
+	} catch (error) {
+		if (error?.message === "Claude credential store received a malformed OAuth credential") throw error;
+		throw new Error("Claude credential store contains malformed OAuth JSON", { cause: error });
+	}
+}
+/**
+* Adapt DSH's managed string credential service to pi-ai's typed OAuth store.
+* Refresh/login/logout operations are serialized so an older refresh response
+* cannot overwrite a newer rotated token.
+*/
+var DshOAuthCredentialStore = class {
+	#chains = /* @__PURE__ */ new Map();
+	constructor(credentials, ref, legacyRefs = []) {
+		if (credentials === void 0 || credentials === null) throw new Error("Claude OAuth requires the DSH credentials service");
+		this.credentials = credentials;
+		this.ref = ref;
+		this.legacyRefs = Object.freeze([...legacyRefs]);
+	}
+	#enqueue(providerId, operation, options) {
+		assertProvider(providerId);
+		const current = (this.#chains.get(providerId) ?? Promise.resolve()).catch(() => void 0).then(async () => {
+			abortIfNeeded(options);
+			return operation();
+		});
+		const tail = current.catch(() => void 0);
+		this.#chains.set(providerId, tail);
+		tail.finally(() => {
+			if (this.#chains.get(providerId) === tail) this.#chains.delete(providerId);
+		});
+		return current;
+	}
+	async read(providerId, options) {
+		assertProvider(providerId);
+		abortIfNeeded(options);
+		let hit = await this.credentials.resolve(this.ref);
+		if (hit?.value === void 0 || hit.value === "") for (const legacyRef of this.legacyRefs) {
+			const legacy = await this.credentials.resolve(legacyRef);
+			if (legacy?.value === void 0 || legacy.value === "") continue;
+			const migrated = parseOAuthCredential(legacy.value);
+			await this.credentials.set(this.ref, JSON.stringify(migrated));
+			await this.credentials.unset(legacyRef);
+			hit = { value: JSON.stringify(migrated) };
+			break;
+		}
+		abortIfNeeded(options);
+		if (hit?.value === void 0 || hit.value === "") return void 0;
+		return parseOAuthCredential(hit.value);
+	}
+	async list(options) {
+		abortIfNeeded(options);
+		return await this.read(PROVIDER$1, options) === void 0 ? [] : [{
+			providerId: PROVIDER$1,
+			type: "oauth"
+		}];
+	}
+	modify(providerId, update, options) {
+		return this.#enqueue(providerId, async () => {
+			const current = await this.read(providerId, options);
+			const next = await update(clone(current));
+			abortIfNeeded(options);
+			if (next === void 0) return current;
+			const validated = assertOAuthCredential(next);
+			await this.credentials.set(this.ref, JSON.stringify(validated));
+			for (const legacyRef of this.legacyRefs) await this.credentials.unset(legacyRef);
+			abortIfNeeded(options);
+			return clone(validated);
+		}, options);
+	}
+	delete(providerId, options) {
+		return this.#enqueue(providerId, async () => {
+			await this.credentials.unset(this.ref);
+			for (const legacyRef of this.legacyRefs) await this.credentials.unset(legacyRef);
+			abortIfNeeded(options);
+		}, options);
+	}
+};
+/** Return only account state that is safe to expose to the browser client. */
+function createClaudeAuthService(models, store) {
+	return Object.freeze({
+		async status(options) {
+			const current = await store.read(PROVIDER$1, options);
+			if (current === void 0) return {
+				authenticated: false,
+				provider: PROVIDER$1
+			};
+			return {
+				authenticated: true,
+				provider: PROVIDER$1,
+				type: "oauth",
+				expiresAt: current.expires
+			};
+		},
+		login(interaction) {
+			return models.login(PROVIDER$1, "oauth", interaction);
+		},
+		logout(options) {
+			return models.logout(PROVIDER$1, options);
+		}
+	});
+}
+//#endregion
+//#region src/external-url.js
+const CLAUDE_AUTH_ORIGIN = "https://claude.ai";
+/** Validate the only external origin this plugin may launch. */
+function assertClaudeAuthUrl(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error("Claude auth URL is invalid");
+	}
+	if (url.protocol !== "https:") throw new Error("Claude auth URL must use HTTPS");
+	if (url.origin !== CLAUDE_AUTH_ORIGIN || url.username !== "" || url.password !== "") throw new Error("Claude auth URL must use the claude.ai origin");
+	return url.href;
+}
+/** Return a shell-free native opener command for the current desktop. */
+function commandForClaudeAuthUrl(value, platform = process.platform) {
+	const url = assertClaudeAuthUrl(value);
+	if (platform === "win32") return {
+		file: "rundll32.exe",
+		args: ["url.dll,FileProtocolHandler", url],
+		shell: false
+	};
+	if (platform === "darwin") return {
+		file: "open",
+		args: [url],
+		shell: false
+	};
+	if (platform === "linux") return {
+		file: "xdg-open",
+		args: [url],
+		shell: false
+	};
+	throw new Error(`Claude auth URL opener is unsupported on ${platform}`);
+}
+function openClaudeAuthUrl(value, options = {}) {
+	const command = commandForClaudeAuthUrl(value, options.platform);
+	const spawnProcess = options.spawn ?? spawn;
+	return new Promise((resolve, reject) => {
+		const child = spawnProcess(command.file, command.args, {
+			detached: true,
+			stdio: "ignore",
+			windowsHide: true,
+			shell: command.shell
+		});
+		child.once("error", reject);
+		child.once("spawn", () => {
+			child.unref();
+			resolve();
+		});
+	});
+}
+//#endregion
+//#region src/login-coordinator.js
+const LOGIN_METHODS = /* @__PURE__ */ new Set(["browser"]);
+const TERMINAL_PHASES = /* @__PURE__ */ new Set([
+	"authenticated",
+	"failed",
+	"cancelled"
+]);
+const publicClone = (value) => structuredClone(value);
+const asObject = (value) => value !== null && typeof value === "object" ? value : {};
+const ok = (value) => ({
+	ok: true,
+	value
+});
+const badRequest = (message) => ({
+	ok: false,
+	error: {
+		code: "bad-request",
+		message,
+		details: { issues: [] }
+	}
+});
+const deferred = () => {
+	let resolve;
+	let reject;
+	return {
+		promise: new Promise((onResolve, onReject) => {
+			resolve = onResolve;
+			reject = onReject;
+		}),
+		resolve,
+		reject
+	};
+};
+const publicPrompt = (prompt) => ({
+	type: prompt.type,
+	message: String(prompt.message ?? ""),
+	...typeof prompt.placeholder === "string" ? { placeholder: prompt.placeholder } : {}
+});
+/** Own one host-side login without exposing tokens to the browser client. */
+var ClaudeLoginCoordinator = class {
+	#sessions = /* @__PURE__ */ new Map();
+	#activeId;
+	constructor(auth, options = {}) {
+		this.auth = auth;
+		this.createId = options.createId ?? (() => crypto.randomUUID());
+	}
+	async accountStatus(options) {
+		return publicClone(await this.auth.status(options));
+	}
+	async start({ method }) {
+		if (!LOGIN_METHODS.has(method)) throw new Error(`unsupported Claude login method: ${String(method)}`);
+		const active = this.#activeId === void 0 ? void 0 : this.#sessions.get(this.#activeId);
+		if (active !== void 0 && !TERMINAL_PHASES.has(active.view.phase)) throw new Error("a Claude login is already active");
+		if (active !== void 0) this.#sessions.delete(active.view.id);
+		const id = this.createId();
+		const ready = deferred();
+		const controller = new AbortController();
+		const session = {
+			controller,
+			prompt: void 0,
+			ready,
+			view: {
+				id,
+				provider: "anthropic",
+				method,
+				phase: "starting",
+				authenticated: false
+			}
+		};
+		this.#sessions.set(id, session);
+		this.#activeId = id;
+		const publishReady = () => ready.resolve(this.read(id));
+		const interaction = {
+			signal: controller.signal,
+			prompt: async (prompt) => {
+				controller.signal.throwIfAborted();
+				if (prompt.type === "select") return method;
+				if (![
+					"manual_code",
+					"text",
+					"secret"
+				].includes(prompt.type)) throw new Error(`unsupported Claude auth prompt: ${String(prompt.type)}`);
+				const answer = deferred();
+				session.prompt = answer;
+				session.view = {
+					...session.view,
+					phase: "waiting_input",
+					prompt: publicPrompt(prompt)
+				};
+				const abortPrompt = () => answer.reject(controller.signal.reason ?? /* @__PURE__ */ new Error("login cancelled"));
+				controller.signal.addEventListener("abort", abortPrompt, { once: true });
+				prompt.signal?.addEventListener("abort", abortPrompt, { once: true });
+				publishReady();
+				try {
+					return await answer.promise;
+				} finally {
+					controller.signal.removeEventListener("abort", abortPrompt);
+					prompt.signal?.removeEventListener("abort", abortPrompt);
+					if (session.prompt === answer) session.prompt = void 0;
+				}
+			},
+			notify: (event) => {
+				if (controller.signal.aborted) return;
+				if (event.type === "auth_url") session.view = {
+					...session.view,
+					phase: "waiting_browser",
+					authUrl: assertClaudeAuthUrl(event.url),
+					...typeof event.instructions === "string" ? { instructions: event.instructions } : {}
+				};
+				else session.view = {
+					...session.view,
+					message: String(event.message ?? "")
+				};
+				publishReady();
+			}
+		};
+		session.run = Promise.resolve().then(() => this.auth.login(interaction)).then(async () => {
+			if (controller.signal.aborted) return;
+			const status = await this.auth.status();
+			session.view = {
+				id,
+				provider: "anthropic",
+				method,
+				phase: "authenticated",
+				authenticated: status.authenticated === true,
+				...typeof status.expiresAt === "number" ? { expiresAt: status.expiresAt } : {}
+			};
+		}).catch((error) => {
+			if (controller.signal.aborted) {
+				session.view = {
+					id,
+					provider: "anthropic",
+					method,
+					phase: "cancelled",
+					authenticated: false
+				};
+				return;
+			}
+			session.view = {
+				id,
+				provider: "anthropic",
+				method,
+				phase: "failed",
+				authenticated: false,
+				error: "Claude login failed"
+			};
+			session.hostError = error;
+		}).finally(publishReady);
+		return ready.promise;
+	}
+	read(id) {
+		const session = this.#sessions.get(id);
+		if (session === void 0) throw new Error("unknown Claude login");
+		return publicClone(session.view);
+	}
+	async submit({ id, value }) {
+		const session = this.#sessions.get(id);
+		if (session === void 0) throw new Error("unknown Claude login");
+		if (session.prompt === void 0 || session.view.phase !== "waiting_input") throw new Error("Claude login is not waiting for input");
+		if (typeof value !== "string" || value.trim() === "") throw new Error("Claude login input is empty");
+		const answer = session.prompt;
+		session.prompt = void 0;
+		session.view = {
+			...session.view,
+			phase: session.view.authUrl === void 0 ? "starting" : "waiting_browser",
+			prompt: void 0
+		};
+		answer.resolve(value);
+		return this.read(id);
+	}
+	async cancel(id) {
+		const session = this.#sessions.get(id);
+		if (session === void 0) throw new Error("unknown Claude login");
+		if (!TERMINAL_PHASES.has(session.view.phase)) {
+			session.view = {
+				id,
+				provider: "anthropic",
+				method: session.view.method,
+				phase: "cancelled",
+				authenticated: false
+			};
+			session.controller.abort(/* @__PURE__ */ new Error("Claude login cancelled"));
+		}
+		await Promise.resolve(session.run).catch(() => void 0);
+		return this.read(id);
+	}
+	async logout(options) {
+		if (this.#activeId !== void 0) {
+			const active = this.#sessions.get(this.#activeId);
+			if (active !== void 0 && !TERMINAL_PHASES.has(active.view.phase)) await this.cancel(active.view.id);
+		}
+		await this.auth.logout(options);
+		return this.accountStatus(options);
+	}
+};
+/** Map the loopback-only DSH Connection channel onto the coordinator. */
+function createClaudeRpcHandler(coordinator, options = {}) {
+	const openExternal = options.openExternal;
+	return async (endpoint, payload, signal) => {
+		try {
+			signal.throwIfAborted();
+			const input = asObject(payload);
+			if (endpoint === "status") return ok(await coordinator.accountStatus({ signal }));
+			if (endpoint === "login/start") {
+				const started = await coordinator.start({ method: input.method });
+				if (input.openExternal !== true) return ok(started);
+				const url = started.authUrl;
+				if (typeof url !== "string" || openExternal === void 0) return ok({
+					...started,
+					externalOpened: false
+				});
+				try {
+					await openExternal(url);
+					return ok({
+						...started,
+						externalOpened: true
+					});
+				} catch {
+					return ok({
+						...started,
+						externalOpened: false
+					});
+				}
+			}
+			if (endpoint === "login/status") return ok(coordinator.read(input.id));
+			if (endpoint === "login/submit") return ok(await coordinator.submit({
+				id: input.id,
+				value: input.value
+			}));
+			if (endpoint === "login/cancel") return ok(await coordinator.cancel(input.id));
+			if (endpoint === "logout") return ok(await coordinator.logout({ signal }));
+			return badRequest(`unknown Claude auth endpoint: ${endpoint}`);
+		} catch (error) {
+			if (signal.aborted) throw error;
+			const message = error instanceof Error && /^(unknown|unsupported|a Claude|Claude login)/.test(error.message) ? error.message : "Claude request failed";
+			return badRequest(message);
+		}
+	};
+}
+//#endregion
+//#region src/pi-ai-runtime.js
+/**
+* Preserve pi-ai's native Anthropic OAuth provider (Claude Pro/Max) while
+* allowing DSH's generic PiAiAdapter to pass the access token resolved by the
+* host credential store.
+*
+* PiAiAdapter owns a request-local Models collection without a credential
+* store. A pure OAuth provider ignores its `apiKey` request override and fails
+* before dispatch with "Provider is not configured". This non-interactive
+* bridge teaches that collection how to consume only the already-refreshed
+* token for this request; login, refresh, persistence, headers, transport, and
+* model behavior remain owned by the original provider.
+*/
+function anthropicSubscriptionProvider() {
+	const provider = createAnthropicProvider();
+	const requestToken = Object.freeze({
+		name: "DSH-managed Anthropic OAuth request token",
+		async resolve({ credential }) {
+			const token = credential?.type === "api_key" ? credential.key : void 0;
+			if (typeof token !== "string" || token.length === 0) return void 0;
+			return {
+				auth: { apiKey: token },
+				source: "DSH-managed OAuth request"
+			};
+		}
+	});
+	return Object.freeze({
+		...provider,
+		auth: Object.freeze({
+			...provider.auth,
+			apiKey: requestToken
+		})
+	});
+}
+const PI_AI_RUNTIME_VERSION = "0.82.1";
+//#endregion
+//#region src/settings-contract.js
+const SETTINGS_NAMESPACE = "claude-subscription";
+const QUICK_QUOTA_FIELD = "quickQuotaVisible";
+Object.freeze({ [QUICK_QUOTA_FIELD]: false });
+//#endregion
+//#region src/usage.js
+const CLAUDE_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
+const DEFAULT_TTL_MS = 6e4;
+const DEFAULT_TIMEOUT_MS = 15e3;
+const OAUTH_BETA = "oauth-2025-04-20";
+const WINDOW_IDS = Object.freeze([
+	"five_hour",
+	"seven_day",
+	"seven_day_opus",
+	"seven_day_sonnet"
+]);
+const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+function epochSecondsOf(value) {
+	if (typeof value !== "string" || value.length === 0) return void 0;
+	const parsed = Date.parse(value);
+	return Number.isFinite(parsed) ? Math.floor(parsed / 1e3) : void 0;
+}
+function windowOf(id, value) {
+	if (value === void 0 || value === null) return void 0;
+	if (!record(value)) throw new Error("Claude returned a malformed usage window");
+	const utilization = value.utilization;
+	if (!Number.isFinite(utilization) || utilization < 0 || utilization > 100) throw new Error("Claude returned an invalid utilization percentage");
+	const resetsAt = epochSecondsOf(value.resets_at);
+	return {
+		id,
+		remainingPercent: 100 - utilization,
+		...resetsAt === void 0 ? {} : { resetsAt }
+	};
+}
+function decimalOf(value, label) {
+	if (value === void 0 || value === null) return void 0;
+	if (!Number.isFinite(value) || value < 0) throw new Error(`Claude returned an invalid ${label}`);
+	return value;
+}
+function extraUsageOf(value) {
+	if (value === void 0 || value === null) return void 0;
+	if (!record(value)) throw new Error("Claude returned malformed extra usage details");
+	if (typeof value.is_enabled !== "boolean") return void 0;
+	const monthlyLimit = decimalOf(value.monthly_limit, "monthly credit limit");
+	const usedCredits = decimalOf(value.used_credits, "used credit amount");
+	const utilization = decimalOf(value.utilization, "extra usage utilization");
+	return {
+		enabled: value.is_enabled,
+		...monthlyLimit === void 0 ? {} : { monthlyLimit },
+		...usedCredits === void 0 ? {} : { usedCredits },
+		...utilization === void 0 ? {} : { utilization }
+	};
+}
+/** Reduce the provider payload to a browser-safe quota projection. */
+function parseClaudeUsage(value) {
+	if (!record(value)) throw new Error("Claude returned a malformed usage response");
+	const windows = WINDOW_IDS.map((id) => windowOf(id, value[id])).filter((entry) => entry !== void 0);
+	const extraUsage = extraUsageOf(value.extra_usage);
+	return {
+		windows,
+		...extraUsage === void 0 ? {} : { extraUsage }
+	};
+}
+const requestSignal = (signal, timeoutMs) => {
+	const timeout = AbortSignal.timeout(timeoutMs);
+	return signal === void 0 ? timeout : AbortSignal.any([signal, timeout]);
+};
+function messageForStatus(status) {
+	if (status === 401 || status === 403) return "Claude sign-in needs to be renewed";
+	if (status === 429) return "Claude usage requests are rate limited. Try again later";
+	return `Claude usage request failed (HTTP ${status})`;
+}
+/**
+* Read quota through the same refreshable OAuth lifecycle used by model turns.
+* The browser receives only a parsed quota projection; the bearer token is a
+* request-local host value. Concurrent polls share one request.
+*/
+function createClaudeUsageReader(options) {
+	const getAuth = options.getAuth;
+	const fetchUsage = options.fetch ?? fetch;
+	const now = options.now ?? Date.now;
+	const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+	const userAgent = options.userAgent ?? "dsh-claude-subscription/0.2.0";
+	let cached;
+	let inFlight;
+	const load = async (signal) => {
+		const access = (await getAuth({ signal }))?.auth?.apiKey;
+		if (typeof access !== "string" || access.length === 0) throw new Error("Claude subscription is not signed in");
+		const response = await fetchUsage(CLAUDE_USAGE_URL, {
+			method: "GET",
+			redirect: "error",
+			headers: {
+				authorization: `Bearer ${access}`,
+				"anthropic-beta": OAUTH_BETA,
+				accept: "application/json",
+				"cache-control": "no-store",
+				"user-agent": userAgent
+			},
+			signal: requestSignal(signal, timeoutMs)
+		});
+		if (!response.ok) throw new Error(messageForStatus(response.status));
+		let value;
+		try {
+			value = await response.json();
+		} catch {
+			throw new Error("Claude returned an unreadable usage response");
+		}
+		return {
+			...parseClaudeUsage(value),
+			fetchedAt: now()
+		};
+	};
+	return Object.freeze({
+		read({ force = false, signal } = {}) {
+			if (!force && cached !== void 0 && now() - cached.fetchedAt < ttlMs) return Promise.resolve(structuredClone(cached));
+			if (inFlight !== void 0) return inFlight.then(structuredClone);
+			const current = load(signal).then((value) => {
+				cached = structuredClone(value);
+				return structuredClone(value);
+			}).finally(() => {
+				if (inFlight === current) inFlight = void 0;
+			});
+			inFlight = current;
+			return current;
+		},
+		clear() {
+			cached = void 0;
+		}
+	});
+}
+//#endregion
+//#region src/composer-quota.js
+const SHARED_WINDOW_IDS = Object.freeze(["five_hour", "seven_day"]);
+const MODEL_WINDOW_IDS = Object.freeze({
+	opus: "seven_day_opus",
+	sonnet: "seven_day_sonnet"
+});
+const isDisplayableWindow = (window) => Number.isFinite(window?.remainingPercent) && window.remainingPercent >= 0 && window.remainingPercent <= 100;
+const normalized = (value) => String(value ?? "").toLocaleLowerCase("en-US");
+function applicableIds(model) {
+	const name = normalized(model);
+	const family = Object.entries(MODEL_WINDOW_IDS).find(([key]) => name.includes(key));
+	return family === void 0 ? SHARED_WINDOW_IDS : [...SHARED_WINDOW_IDS, family[1]];
+}
+/** Pick the tightest quota window that constrains the given model. */
+function selectModelQuota(usage, model) {
+	const ids = applicableIds(model);
+	const windows = Array.isArray(usage?.windows) ? usage.windows.filter((window) => ids.includes(window?.id) && isDisplayableWindow(window)) : [];
+	if (windows.length === 0) return void 0;
+	const selected = windows.reduce((lowest, candidate) => candidate.remainingPercent < lowest.remainingPercent ? candidate : lowest);
+	return {
+		id: selected.id,
+		remainingPercent: selected.remainingPercent,
+		...Number.isSafeInteger(selected.resetsAt) ? { resetsAt: selected.resetsAt } : {}
+	};
+}
+//#endregion
+//#region src/index.js
+const name = "claude-subscription";
+const inject = [
+	"llm",
+	"credentials",
+	"connection",
+	"settings"
+];
+const PROVIDER = "anthropic";
+const CREDENTIAL_REF = credentialRef("ANTHROPIC_SUBSCRIPTION_OAUTH");
+const CHANNEL = "/claude-subscription";
+const publicError = (code, message) => ({
+	ok: false,
+	error: {
+		code,
+		message,
+		details: { issues: [] }
+	}
+});
+const KNOWN_USAGE_ERRORS = /* @__PURE__ */ new Set([
+	"Claude subscription is not signed in",
+	"Claude sign-in needs to be renewed",
+	"Claude usage requests are rate limited. Try again later"
+]);
+/**
+* Extend the account RPC with the preference toggle and the quota projection.
+* Unknown endpoints stay owned by the login coordinator.
+*/
+function createSubscriptionRpcHandler({ authHandler, usageReader, preferences }) {
+	return async (endpoint, payload, signal) => {
+		if (endpoint === "preferences/status" || endpoint === "preferences/update") try {
+			signal.throwIfAborted();
+			if (endpoint === "preferences/update") {
+				if (!Object.hasOwn(payload ?? {}, "quickQuotaVisible")) return publicError("internal", "Invalid preference update");
+				if (typeof payload["quickQuotaVisible"] !== "boolean") return publicError("internal", "Invalid quick quota preference");
+				await preferences.update({ [QUICK_QUOTA_FIELD]: payload[QUICK_QUOTA_FIELD] });
+			}
+			return {
+				ok: true,
+				value: preferences.status()
+			};
+		} catch (error) {
+			if (signal.aborted) throw error;
+			return publicError("internal", "Could not update preferences");
+		}
+		if (endpoint === "usage") try {
+			signal.throwIfAborted();
+			return {
+				ok: true,
+				value: await usageReader.read({
+					force: payload?.force === true,
+					signal
+				})
+			};
+		} catch (error) {
+			if (signal.aborted) throw error;
+			const message = error instanceof Error && KNOWN_USAGE_ERRORS.has(error.message) ? error.message : "Could not read Claude usage";
+			return publicError("internal", message);
+		}
+		const result = await authHandler(endpoint, payload, signal);
+		if (endpoint === "logout" && result.ok === true) usageReader.clear();
+		return result;
+	};
+}
+function apply(ctx) {
+	const settings = ctx.settings.register(settingsNamespace(SETTINGS_NAMESPACE), z.object({ [QUICK_QUOTA_FIELD]: z.boolean().default(false) }));
+	const preferences = {
+		status: () => ({
+			[QUICK_QUOTA_FIELD]: settings.get()[QUICK_QUOTA_FIELD],
+			writable: ctx.settings.writable
+		}),
+		update: (patch) => settings.update(patch)
+	};
+	const store = new DshOAuthCredentialStore(ctx.credentials, CREDENTIAL_REF);
+	const provider = anthropicSubscriptionProvider();
+	const authModels = createModels({ credentials: store });
+	authModels.setProvider(provider);
+	const profile = Object.freeze({
+		provider: PROVIDER,
+		displayName: "Claude subscription",
+		piProvider: provider,
+		configuredMaxTokens: /* @__PURE__ */ new Map(),
+		streamIdleTimeoutMs: 600 * 1e3,
+		cacheRetention: "short",
+		transport: "sse"
+	});
+	const profiles = /* @__PURE__ */ new Map([[PROVIDER, profile]]);
+	const resolveAuth = () => authModels.getAuth(PROVIDER);
+	const adapter = new PiAiAdapter({
+		profiles: () => profiles,
+		resolveApiKey: async () => {
+			let resolved;
+			try {
+				resolved = await resolveAuth();
+			} catch {
+				throw new LlmError("Claude subscription authorization failed", "AUTH_FAILED");
+			}
+			if (typeof resolved?.auth.apiKey !== "string" || resolved.auth.apiKey.length === 0) throw new LlmError("Claude subscription is not signed in", "MISSING_CREDENTIAL");
+			return resolved.auth.apiKey;
+		},
+		resolveAttachments: () => void 0
+	});
+	ctx.llm.registerAdapter([PROVIDER], adapter);
+	const coordinator = new ClaudeLoginCoordinator(createClaudeAuthService(authModels, store));
+	const usageReader = createClaudeUsageReader({ getAuth: resolveAuth });
+	const handler = createSubscriptionRpcHandler({
+		authHandler: createClaudeRpcHandler(coordinator, { openExternal: openClaudeAuthUrl }),
+		usageReader,
+		preferences
+	});
+	ctx.effect(() => ctx.connection.rpc.handle(CHANNEL, handler, { authority: "loopback" }), "claude-subscription: loopback account RPC");
+}
+//#endregion
+export { CLAUDE_USAGE_URL, ClaudeLoginCoordinator, DshOAuthCredentialStore, PI_AI_RUNTIME_VERSION, anthropicSubscriptionProvider, apply, assertClaudeAuthUrl, createClaudeAuthService, createClaudeRpcHandler, createClaudeUsageReader, createSubscriptionRpcHandler, inject, name, openClaudeAuthUrl, parseClaudeUsage, selectModelQuota };