dsh-claude-subscription 0.3.1 → 0.4.0

package/lib/composer-quota.js

@@ -0,0 +1,20 @@
+function isDisplayableWindow(window) {
+    return (Number.isFinite(window?.remainingPercent) &&
+        window.remainingPercent >= 0 &&
+        window.remainingPercent <= 100);
+}
+/** Pick the tightest API-reported quota window that applies to the model. */
+export function selectModelQuota(usage, model) {
+    const windows = Array.isArray(usage?.windows)
+        ? usage.windows.filter((window) => (window.appliesTo === "all" || window.appliesTo === model) &&
+            isDisplayableWindow(window))
+        : [];
+    if (windows.length === 0)
+        return undefined;
+    const selected = windows.reduce((lowest, candidate) => candidate.remainingPercent < lowest.remainingPercent ? candidate : lowest);
+    return {
+        id: selected.id,
+        remainingPercent: selected.remainingPercent,
+        ...(Number.isSafeInteger(selected.resetsAt) ? { resetsAt: selected.resetsAt } : {}),
+    };
+}

package/lib/credential-store.js

@@ -0,0 +1,151 @@
+const PROVIDER = "anthropic";
+function abortIfNeeded(options) {
+    options?.signal?.throwIfAborted();
+}
+function clone(value) {
+    return value === undefined ? undefined : structuredClone(value);
+}
+function assertProvider(providerId) {
+    if (providerId !== PROVIDER)
+        throw new Error(`Claude credential store does not own provider ${JSON.stringify(providerId)}`);
+}
+function assertOAuthCredential(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === null ||
+        typeof value !== "object" ||
+        value.type !== "oauth" ||
+        typeof value.access !== "string" ||
+        value.access.length === 0 ||
+        typeof value.refresh !== "string" ||
+        value.refresh.length === 0 ||
+        typeof value.expires !== "number" ||
+        !Number.isFinite(value.expires))
+        throw new Error("Claude credential store received a malformed OAuth credential");
+    return clone(value);
+}
+function parseOAuthCredential(value) {
+    try {
+        return assertOAuthCredential(JSON.parse(value));
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            error.message === "Claude credential store received a malformed OAuth credential")
+            throw error;
+        throw new Error("Claude credential store contains malformed OAuth JSON", { cause: error });
+    }
+}
+/**
+ * Adapt DSH's managed string credential service to pi-ai's typed OAuth store.
+ * Refresh/login/logout operations are serialized so an older refresh response
+ * cannot overwrite a newer rotated token.
+ */
+export class DshOAuthCredentialStore {
+    credentials;
+    ref;
+    legacyRefs;
+    #chains = new Map();
+    constructor(credentials, ref, legacyRefs = []) {
+        if (credentials === undefined || credentials === null)
+            throw new Error("Claude OAuth requires the DSH credentials service");
+        this.credentials = credentials;
+        this.ref = ref;
+        this.legacyRefs = Object.freeze([...legacyRefs]);
+    }
+    #enqueue(providerId, operation, options) {
+        assertProvider(providerId);
+        const current = (this.#chains.get(providerId) ?? Promise.resolve())
+            .catch(() => undefined)
+            .then(async () => {
+            abortIfNeeded(options);
+            return operation();
+        });
+        const tail = current.catch(() => undefined).then(() => undefined);
+        this.#chains.set(providerId, tail);
+        tail.finally(() => {
+            if (this.#chains.get(providerId) === tail)
+                this.#chains.delete(providerId);
+        });
+        return current;
+    }
+    async read(providerId, options) {
+        assertProvider(providerId);
+        abortIfNeeded(options);
+        let hit = await this.credentials.resolve(this.ref);
+        if (hit?.value === undefined || hit.value === "") {
+            for (const legacyRef of this.legacyRefs) {
+                const legacy = await this.credentials.resolve(legacyRef);
+                if (legacy?.value === undefined || legacy.value === "")
+                    continue;
+                const migrated = parseOAuthCredential(legacy.value);
+                await this.credentials.set(this.ref, JSON.stringify(migrated));
+                await this.credentials.unset(legacyRef);
+                hit = { value: JSON.stringify(migrated) };
+                break;
+            }
+        }
+        abortIfNeeded(options);
+        if (hit?.value === undefined || hit.value === "")
+            return undefined;
+        return parseOAuthCredential(hit.value);
+    }
+    async list(options) {
+        abortIfNeeded(options);
+        return (await this.read(PROVIDER, options)) === undefined
+            ? []
+            : [
+                {
+                    providerId: PROVIDER,
+                    type: "oauth",
+                },
+            ];
+    }
+    modify(providerId, update, options) {
+        return this.#enqueue(providerId, async () => {
+            const current = await this.read(providerId, options);
+            const next = await update(clone(current));
+            abortIfNeeded(options);
+            if (next === undefined)
+                return current;
+            const validated = assertOAuthCredential(next);
+            await this.credentials.set(this.ref, JSON.stringify(validated));
+            for (const legacyRef of this.legacyRefs)
+                await this.credentials.unset(legacyRef);
+            abortIfNeeded(options);
+            return clone(validated);
+        }, options);
+    }
+    delete(providerId, options) {
+        return this.#enqueue(providerId, async () => {
+            await this.credentials.unset(this.ref);
+            for (const legacyRef of this.legacyRefs)
+                await this.credentials.unset(legacyRef);
+            abortIfNeeded(options);
+        }, options);
+    }
+}
+/** Return only account state that is safe to expose to the browser client. */
+export function createClaudeAuthService(models, store) {
+    return Object.freeze({
+        async status(options) {
+            const current = await store.read(PROVIDER, options);
+            if (current === undefined)
+                return {
+                    authenticated: false,
+                    provider: PROVIDER,
+                };
+            return {
+                authenticated: true,
+                provider: PROVIDER,
+                type: "oauth",
+                expiresAt: current.expires,
+            };
+        },
+        login(interaction) {
+            return models.login(PROVIDER, "oauth", interaction);
+        },
+        logout(options) {
+            return models.logout(PROVIDER, options);
+        },
+    });
+}

package/lib/external-url.js

@@ -0,0 +1,57 @@
+import { spawn } from "node:child_process";
+export const CLAUDE_AUTH_ORIGIN = "https://claude.ai";
+/** Validate the only external origin this plugin may launch. */
+export function assertClaudeAuthUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error("Claude auth URL is invalid");
+    }
+    if (url.protocol !== "https:")
+        throw new Error("Claude auth URL must use HTTPS");
+    if (url.origin !== CLAUDE_AUTH_ORIGIN || url.username !== "" || url.password !== "")
+        throw new Error("Claude auth URL must use the claude.ai origin");
+    return url.href;
+}
+/** Return a shell-free native opener command for the current desktop. */
+export function commandForClaudeAuthUrl(value, platform = process.platform) {
+    const url = assertClaudeAuthUrl(value);
+    if (platform === "win32")
+        return {
+            file: "rundll32.exe",
+            args: ["url.dll,FileProtocolHandler", url],
+            shell: false,
+        };
+    if (platform === "darwin")
+        return {
+            file: "open",
+            args: [url],
+            shell: false,
+        };
+    if (platform === "linux")
+        return {
+            file: "xdg-open",
+            args: [url],
+            shell: false,
+        };
+    throw new Error(`Claude auth URL opener is unsupported on ${platform}`);
+}
+export function openClaudeAuthUrl(value, options = {}) {
+    const command = commandForClaudeAuthUrl(value, options.platform);
+    const spawnProcess = options.spawn ?? spawn;
+    return new Promise((resolve, reject) => {
+        const child = spawnProcess(command.file, [...command.args], {
+            detached: true,
+            stdio: "ignore",
+            windowsHide: true,
+            shell: command.shell,
+        });
+        child.once("error", reject);
+        child.once("spawn", () => {
+            child.unref();
+            resolve();
+        });
+    });
+}