dsh-claude-subscription 0.3.1 → 0.4.0

package/lib/login-coordinator.js

@@ -0,0 +1,282 @@
+import { assertClaudeAuthUrl } from "./external-url.js";
+const LOGIN_METHODS = new Set(["browser"]);
+const TERMINAL_PHASES = new Set(["authenticated", "failed", "cancelled"]);
+function publicClone(value) {
+    return structuredClone(value);
+}
+function asObject(value) {
+    return value !== null && typeof value === "object"
+        ? value
+        : {};
+}
+function ok(value) {
+    return {
+        ok: true,
+        value,
+    };
+}
+function badRequest(message) {
+    return {
+        ok: false,
+        error: {
+            code: "bad-request",
+            message,
+            details: { issues: [] },
+        },
+    };
+}
+function deferred() {
+    let resolve;
+    let reject;
+    return {
+        promise: new Promise((onResolve, onReject) => {
+            resolve = onResolve;
+            reject = onReject;
+        }),
+        resolve,
+        reject,
+    };
+}
+function publicPrompt(prompt) {
+    return {
+        type: prompt.type,
+        message: String(prompt.message ?? ""),
+        ...(typeof prompt.placeholder === "string" ? { placeholder: prompt.placeholder } : {}),
+    };
+}
+/** Own one host-side login without exposing tokens to the browser client. */
+export class ClaudeLoginCoordinator {
+    auth;
+    createId;
+    #sessions = new Map();
+    #activeId;
+    constructor(auth, options = {}) {
+        this.auth = auth;
+        this.createId = options.createId ?? (() => crypto.randomUUID());
+    }
+    async accountStatus(options) {
+        return publicClone(await this.auth.status(options));
+    }
+    async start({ method }) {
+        if (!LOGIN_METHODS.has(method))
+            throw new Error(`unsupported Claude login method: ${String(method)}`);
+        const active = this.#activeId === undefined ? undefined : this.#sessions.get(this.#activeId);
+        if (active !== undefined && !TERMINAL_PHASES.has(active.view.phase))
+            throw new Error("a Claude login is already active");
+        if (active !== undefined)
+            this.#sessions.delete(active.view.id);
+        const id = this.createId();
+        const ready = deferred();
+        const controller = new AbortController();
+        const session = {
+            controller,
+            prompt: undefined,
+            ready,
+            view: {
+                id,
+                provider: "anthropic",
+                method,
+                phase: "starting",
+                authenticated: false,
+            },
+        };
+        this.#sessions.set(id, session);
+        this.#activeId = id;
+        const publishReady = () => {
+            ready.resolve(this.read(id));
+        };
+        const interaction = {
+            signal: controller.signal,
+            prompt: async (prompt) => {
+                controller.signal.throwIfAborted();
+                if (prompt.type === "select")
+                    return method;
+                if (!["manual_code", "text", "secret"].includes(prompt.type))
+                    throw new Error(`unsupported Claude auth prompt: ${String(prompt.type)}`);
+                const answer = deferred();
+                session.prompt = answer;
+                session.view = {
+                    ...session.view,
+                    phase: "waiting_input",
+                    prompt: publicPrompt(prompt),
+                };
+                const abortPrompt = () => {
+                    answer.reject(controller.signal.reason ?? new Error("login cancelled"));
+                };
+                controller.signal.addEventListener("abort", abortPrompt, { once: true });
+                prompt.signal?.addEventListener("abort", abortPrompt, { once: true });
+                publishReady();
+                try {
+                    return await answer.promise;
+                }
+                finally {
+                    controller.signal.removeEventListener("abort", abortPrompt);
+                    prompt.signal?.removeEventListener("abort", abortPrompt);
+                    if (session.prompt === answer)
+                        session.prompt = undefined;
+                }
+            },
+            notify: (event) => {
+                if (controller.signal.aborted)
+                    return;
+                if (event.type === "auth_url")
+                    session.view = {
+                        ...session.view,
+                        phase: "waiting_browser",
+                        authUrl: assertClaudeAuthUrl(event.url),
+                        ...(typeof event.instructions === "string" ? { instructions: event.instructions } : {}),
+                    };
+                else
+                    session.view = {
+                        ...session.view,
+                        message: String(event.message ?? ""),
+                    };
+                publishReady();
+            },
+        };
+        session.run = Promise.resolve()
+            .then(() => this.auth.login(interaction))
+            .then(async () => {
+            if (controller.signal.aborted)
+                return;
+            const status = (await this.auth.status());
+            session.view = {
+                id,
+                provider: "anthropic",
+                method,
+                phase: "authenticated",
+                authenticated: status.authenticated === true,
+                ...(typeof status.expiresAt === "number" ? { expiresAt: status.expiresAt } : {}),
+            };
+        })
+            .catch((error) => {
+            if (controller.signal.aborted) {
+                session.view = {
+                    id,
+                    provider: "anthropic",
+                    method,
+                    phase: "cancelled",
+                    authenticated: false,
+                };
+                return;
+            }
+            session.view = {
+                id,
+                provider: "anthropic",
+                method,
+                phase: "failed",
+                authenticated: false,
+                error: "Claude login failed",
+            };
+            session.hostError = error;
+        })
+            .finally(publishReady);
+        return ready.promise;
+    }
+    read(id) {
+        const session = this.#sessions.get(id);
+        if (session === undefined)
+            throw new Error("unknown Claude login");
+        return publicClone(session.view);
+    }
+    async submit({ id, value }) {
+        const session = this.#sessions.get(id);
+        if (session === undefined)
+            throw new Error("unknown Claude login");
+        if (session.prompt === undefined || session.view.phase !== "waiting_input")
+            throw new Error("Claude login is not waiting for input");
+        if (typeof value !== "string" || value.trim() === "")
+            throw new Error("Claude login input is empty");
+        const answer = session.prompt;
+        session.prompt = undefined;
+        session.view = {
+            ...session.view,
+            phase: session.view.authUrl === undefined ? "starting" : "waiting_browser",
+            prompt: undefined,
+        };
+        answer.resolve(value);
+        return this.read(id);
+    }
+    async cancel(id) {
+        const session = this.#sessions.get(id);
+        if (session === undefined)
+            throw new Error("unknown Claude login");
+        if (!TERMINAL_PHASES.has(session.view.phase)) {
+            session.view = {
+                id,
+                provider: "anthropic",
+                method: session.view.method,
+                phase: "cancelled",
+                authenticated: false,
+            };
+            session.controller.abort(new Error("Claude login cancelled"));
+        }
+        await Promise.resolve(session.run).catch(() => undefined);
+        return this.read(id);
+    }
+    async logout(options) {
+        if (this.#activeId !== undefined) {
+            const active = this.#sessions.get(this.#activeId);
+            if (active !== undefined && !TERMINAL_PHASES.has(active.view.phase))
+                await this.cancel(active.view.id);
+        }
+        await this.auth.logout(options);
+        return this.accountStatus(options);
+    }
+}
+/** Map the authenticated DSH Connection channel onto the coordinator. */
+export function createClaudeRpcHandler(coordinator, options = {}) {
+    const openExternal = options.openExternal;
+    return async (endpoint, payload, signal) => {
+        try {
+            signal.throwIfAborted();
+            const input = asObject(payload);
+            if (endpoint === "status")
+                return ok(await coordinator.accountStatus({ signal }));
+            if (endpoint === "login/start") {
+                const started = await coordinator.start({ method: input.method });
+                if (input.openExternal !== true)
+                    return ok(started);
+                const url = started.authUrl;
+                if (typeof url !== "string" || openExternal === undefined)
+                    return ok({
+                        ...started,
+                        externalOpened: false,
+                    });
+                try {
+                    await openExternal(url);
+                    return ok({
+                        ...started,
+                        externalOpened: true,
+                    });
+                }
+                catch {
+                    return ok({
+                        ...started,
+                        externalOpened: false,
+                    });
+                }
+            }
+            if (endpoint === "login/status")
+                return ok(coordinator.read(input.id));
+            if (endpoint === "login/submit")
+                return ok(await coordinator.submit({
+                    id: input.id,
+                    value: input.value,
+                }));
+            if (endpoint === "login/cancel")
+                return ok(await coordinator.cancel(input.id));
+            if (endpoint === "logout")
+                return ok(await coordinator.logout({ signal }));
+            return badRequest(`unknown Claude auth endpoint: ${endpoint}`);
+        }
+        catch (error) {
+            if (signal.aborted)
+                throw error;
+            const message = error instanceof Error && /^(unknown|unsupported|a Claude|Claude login)/.test(error.message)
+                ? error.message
+                : "Claude request failed";
+            return badRequest(message);
+        }
+    };
+}

package/lib/money.js

@@ -0,0 +1,9 @@
+export function money(value, currency, decimalPlaces) {
+    return new Intl.NumberFormat(undefined, {
+        style: "currency",
+        currency,
+        currencyDisplay: "code",
+        minimumFractionDigits: decimalPlaces,
+        maximumFractionDigits: decimalPlaces,
+    }).format(value / 10 ** decimalPlaces);
+}

package/lib/pi-ai-runtime.js

@@ -0,0 +1,61 @@
+import { anthropicProvider as createAnthropicProvider } from "@earendil-works/pi-ai/providers/anthropic";
+import { access } from "node:fs/promises";
+import { homedir } from "node:os";
+import { resolve as resolvePath } from "node:path";
+/**
+ * Preserve pi-ai's native Anthropic OAuth provider (Claude Pro/Max) while
+ * allowing DSH's generic PiAiAdapter to pass the access token resolved by the
+ * host credential store.
+ *
+ * PiAiAdapter owns a request-local Models collection without a credential
+ * store. A pure OAuth provider ignores its `apiKey` request override and fails
+ * before dispatch with "Provider is not configured". This non-interactive
+ * bridge teaches that collection how to consume only the already-refreshed
+ * token for this request; login, refresh, persistence, headers, transport, and
+ * model behavior remain owned by the original provider.
+ */
+export function anthropicSubscriptionProvider() {
+    const provider = createAnthropicProvider();
+    let models = Object.freeze([]);
+    const requestToken = Object.freeze({
+        name: "DSH-managed Anthropic OAuth request token",
+        async resolve({ credential }) {
+            const token = credential?.type === "api_key" ? credential.key : undefined;
+            if (typeof token !== "string" || token.length === 0)
+                return undefined;
+            return {
+                auth: { apiKey: token },
+                source: "DSH-managed OAuth request",
+            };
+        },
+    });
+    return Object.freeze({
+        ...provider,
+        auth: Object.freeze({
+            ...(provider.auth ?? {}),
+            apiKey: requestToken,
+        }),
+        getModels: () => models,
+        setModels(value) {
+            models = Object.freeze([...value]);
+        },
+    });
+}
+export const PI_AI_RUNTIME_VERSION = "0.85.1";
+export const PI_AI_AUTH_CONTEXT = Object.freeze({
+    async env(name) {
+        return process.env[name];
+    },
+    async fileExists(path) {
+        const expanded = path === "~" || path.startsWith("~/")
+            ? resolvePath(homedir(), path.slice(1).replace(/^\//, ""))
+            : path;
+        try {
+            await access(expanded);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+});

package/lib/settings-contract.js

@@ -0,0 +1,3 @@
+export const SETTINGS_NAMESPACE = "claude-subscription";
+export const QUICK_QUOTA_FIELD = "quickQuotaVisible";
+Object.freeze({ [QUICK_QUOTA_FIELD]: false });

package/lib/types/client.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/types/composer-quota.d.ts

@@ -0,0 +1,17 @@
+export interface QuotaWindow {
+    readonly id: string;
+    readonly label?: string | undefined;
+    readonly remainingPercent: number;
+    readonly resetsAt?: number | undefined;
+    readonly appliesTo?: string | undefined;
+}
+export interface QuotaUsage {
+    readonly windows?: readonly QuotaWindow[] | undefined;
+}
+export interface ModelQuota {
+    readonly id: string;
+    readonly remainingPercent: number;
+    readonly resetsAt?: number | undefined;
+}
+/** Pick the tightest API-reported quota window that applies to the model. */
+export declare function selectModelQuota(usage: QuotaUsage | undefined | null, model: string): ModelQuota | undefined;

package/lib/types/credential-store.d.ts

@@ -0,0 +1,45 @@
+import type { AuthOperationOptions, Credential, CredentialInfo, CredentialStore } from "@earendil-works/pi-ai";
+import type { CredentialRef } from "@deepseek-ai/dsh-credentials";
+declare const PROVIDER = "anthropic";
+export interface DshCredentialRecord {
+    readonly value?: string | undefined;
+}
+export interface DshCredentialsService {
+    readonly resolve: (ref: CredentialRef) => Promise<DshCredentialRecord | undefined>;
+    readonly set: (ref: CredentialRef, value: string) => Promise<void>;
+    readonly unset: (ref: CredentialRef) => Promise<void>;
+}
+export interface ClaudeModelsLike {
+    readonly login: (providerId: string, type: "oauth", interaction: unknown) => Promise<unknown>;
+    readonly logout: (providerId: string, options?: AuthOperationOptions) => Promise<unknown>;
+}
+export interface ClaudeAccountStatus {
+    readonly authenticated: boolean;
+    readonly provider: typeof PROVIDER;
+    readonly type?: "oauth" | undefined;
+    readonly expiresAt?: number | undefined;
+}
+export interface ClaudeAuthService {
+    readonly status: (options?: AuthOperationOptions) => Promise<ClaudeAccountStatus>;
+    readonly login: (interaction: unknown) => Promise<unknown>;
+    readonly logout: (options?: AuthOperationOptions) => Promise<unknown>;
+}
+/**
+ * Adapt DSH's managed string credential service to pi-ai's typed OAuth store.
+ * Refresh/login/logout operations are serialized so an older refresh response
+ * cannot overwrite a newer rotated token.
+ */
+export declare class DshOAuthCredentialStore implements CredentialStore {
+    #private;
+    readonly credentials: DshCredentialsService;
+    readonly ref: CredentialRef;
+    readonly legacyRefs: readonly CredentialRef[];
+    constructor(credentials: DshCredentialsService, ref: CredentialRef, legacyRefs?: readonly CredentialRef[]);
+    read(providerId: string, options?: AuthOperationOptions): Promise<Credential | undefined>;
+    list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]>;
+    modify(providerId: string, update: (current: Credential | undefined) => Promise<Credential | undefined>, options?: AuthOperationOptions): Promise<Credential | undefined>;
+    delete(providerId: string, options?: AuthOperationOptions): Promise<void>;
+}
+/** Return only account state that is safe to expose to the browser client. */
+export declare function createClaudeAuthService(models: ClaudeModelsLike, store: DshOAuthCredentialStore): ClaudeAuthService;
+export {};

package/lib/types/external-url.d.ts

@@ -0,0 +1,17 @@
+import { spawn } from "node:child_process";
+export declare const CLAUDE_AUTH_ORIGIN = "https://claude.ai";
+export interface ClaudeAuthOpenerCommand {
+    readonly file: string;
+    readonly args: readonly string[];
+    readonly shell: false;
+}
+export type ClaudeAuthPlatform = "win32" | "darwin" | "linux" | (string & {});
+export interface OpenClaudeAuthUrlOptions {
+    readonly platform?: string | undefined;
+    readonly spawn?: typeof spawn | undefined;
+}
+/** Validate the only external origin this plugin may launch. */
+export declare function assertClaudeAuthUrl(value: unknown): string;
+/** Return a shell-free native opener command for the current desktop. */
+export declare function commandForClaudeAuthUrl(value: unknown, platform?: string): ClaudeAuthOpenerCommand;
+export declare function openClaudeAuthUrl(value: unknown, options?: OpenClaudeAuthUrlOptions): Promise<void>;

package/lib/types/index.d.ts

@@ -0,0 +1,85 @@
+import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
+import type { PiAiAdapterOptions } from "@deepseek-ai/dsh-llm-pi-ai";
+import { DshOAuthCredentialStore, createClaudeAuthService } from "./credential-store.js";
+import { assertClaudeAuthUrl, openClaudeAuthUrl } from "./external-url.js";
+import { ClaudeLoginCoordinator, createClaudeRpcHandler } from "./login-coordinator.js";
+import type { ClaudeRpcHandler } from "./login-coordinator.js";
+import { anthropicSubscriptionProvider, PI_AI_RUNTIME_VERSION } from "./pi-ai-runtime.js";
+import { CLAUDE_MODELS_URL, CLAUDE_USAGE_URL, parseClaudeModels, parseClaudeUsage, createClaudeModelReader, createClaudeUsageReader } from "./usage.js";
+import type { UsageReader, ModelReader, FetchedUsage } from "./usage.js";
+import { selectModelQuota } from "./composer-quota.js";
+export { CLAUDE_MODELS_URL, CLAUDE_USAGE_URL, ClaudeLoginCoordinator, DshOAuthCredentialStore, PI_AI_RUNTIME_VERSION, anthropicSubscriptionProvider, assertClaudeAuthUrl, createClaudeAuthService, createClaudeModelReader, createClaudeRpcHandler, createClaudeUsageReader, parseClaudeModels, parseClaudeUsage, selectModelQuota, openClaudeAuthUrl, };
+export declare const name = "claude-subscription";
+export declare const inject: readonly string[];
+export interface RpcErrorEnvelope {
+    readonly ok: false;
+    readonly error: {
+        readonly code: string;
+        readonly message: string;
+        readonly details: {
+            readonly issues: readonly unknown[];
+        };
+    };
+}
+export interface RpcOkEnvelope<T> {
+    readonly ok: true;
+    readonly value: T;
+}
+export type RpcEnvelope<T> = RpcOkEnvelope<T> | RpcErrorEnvelope;
+export interface PreferenceStatus {
+    readonly quickQuotaVisible: boolean;
+    readonly writable: boolean;
+}
+export interface PreferenceStore {
+    readonly status: () => PreferenceStatus;
+    readonly update: (patch: {
+        readonly quickQuotaVisible: boolean;
+    }) => Promise<unknown>;
+}
+interface SubscriptionRpcDeps {
+    readonly authHandler: ClaudeRpcHandler;
+    readonly usageReader: UsageReader;
+    readonly modelReader?: ModelReader | undefined;
+    readonly preferences: PreferenceStore;
+}
+/**
+ * Extend the account RPC with the preference toggle and the quota projection.
+ * Unknown endpoints stay owned by the login coordinator.
+ */
+export declare function createSubscriptionRpcHandler({ authHandler, usageReader, modelReader, preferences, }: SubscriptionRpcDeps): ClaudeRpcHandler;
+interface HostSettings {
+    readonly writable: boolean;
+    readonly installSection: (ctx: unknown, namespace: string, schema: unknown, defaults: unknown, hooks: {
+        readonly setSource: (current: any) => void;
+        readonly onChange: () => void;
+    }) => void;
+    readonly update: (namespace: string, patch: unknown) => Promise<void>;
+}
+interface HostContext {
+    readonly settings: HostSettings;
+    readonly credentials: never;
+    readonly llm: {
+        readonly registerAdapter: (providers: readonly string[], adapter: unknown) => unknown;
+    };
+    readonly inject: (services: readonly string[], callback: (ctx: {
+        readonly connection: {
+            readonly rpc: {
+                readonly handle: (channel: string, handler: unknown) => unknown;
+            };
+        };
+        readonly effect: (fn: () => unknown, label?: string) => unknown;
+    }) => unknown) => unknown;
+    readonly [key: string]: unknown;
+}
+export declare function apply(ctx: HostContext): void;
+export declare class ClaudeApiAdapter extends PiAiAdapter {
+    readonly modelReader: ModelReader;
+    constructor(options: PiAiAdapterOptions, modelReader: ModelReader);
+    listModels(provider: string): Promise<readonly never[]>;
+    resolveModel(provider: string, model: string, signal?: AbortSignal): Promise<never>;
+    prepareCall(provider: string, model: string, signal?: AbortSignal): Promise<never>;
+    stream(options: {
+        readonly signal?: AbortSignal;
+    }): AsyncIterable<never>;
+}
+export type { FetchedUsage };

package/lib/types/login-coordinator.d.ts

@@ -0,0 +1,66 @@
+import type { ClaudeAuthService } from "./credential-store.js";
+export type LoginPhase = "starting" | "waiting_input" | "waiting_browser" | "authenticated" | "failed" | "cancelled";
+export interface LoginPromptView {
+    readonly type: string;
+    readonly message: string;
+    readonly placeholder?: string | undefined;
+}
+export interface LoginView {
+    readonly id: string;
+    readonly provider: "anthropic";
+    readonly method: string;
+    readonly phase: LoginPhase;
+    readonly authenticated: boolean;
+    readonly authUrl?: string | undefined;
+    readonly instructions?: string | undefined;
+    readonly message?: string | undefined;
+    readonly prompt?: LoginPromptView | undefined;
+    readonly expiresAt?: number | undefined;
+    readonly error?: string | undefined;
+}
+export interface LoginCoordinatorOptions {
+    readonly createId?: (() => string) | undefined;
+}
+export interface RpcOk<T> {
+    readonly ok: true;
+    readonly value: T;
+}
+export interface RpcErr {
+    readonly ok: false;
+    readonly error: {
+        readonly code: string;
+        readonly message: string;
+        readonly details: {
+            readonly issues: readonly unknown[];
+        };
+    };
+}
+export type RpcResult<T> = RpcOk<T> | RpcErr;
+/** Own one host-side login without exposing tokens to the browser client. */
+export declare class ClaudeLoginCoordinator {
+    #private;
+    readonly auth: ClaudeAuthService;
+    readonly createId: () => string;
+    constructor(auth: ClaudeAuthService, options?: LoginCoordinatorOptions);
+    accountStatus(options?: {
+        readonly signal?: AbortSignal | undefined;
+    }): Promise<unknown>;
+    start({ method }: {
+        readonly method: string;
+    }): Promise<LoginView>;
+    read(id: string): LoginView;
+    submit({ id, value }: {
+        readonly id: string;
+        readonly value: unknown;
+    }): Promise<LoginView>;
+    cancel(id: string): Promise<LoginView>;
+    logout(options?: {
+        readonly signal?: AbortSignal | undefined;
+    }): Promise<unknown>;
+}
+export interface RpcHandlerOptions {
+    readonly openExternal?: ((url: string) => Promise<void>) | undefined;
+}
+export type ClaudeRpcHandler = (endpoint: string, payload: unknown, signal: AbortSignal) => Promise<RpcResult<unknown>>;
+/** Map the authenticated DSH Connection channel onto the coordinator. */
+export declare function createClaudeRpcHandler(coordinator: ClaudeLoginCoordinator, options?: RpcHandlerOptions): ClaudeRpcHandler;

package/lib/types/money.d.ts

@@ -0,0 +1 @@
+export declare function money(value: number, currency: string, decimalPlaces: number): string;

package/lib/types/pi-ai-runtime.d.ts

@@ -0,0 +1,22 @@
+import type { AuthContext } from "@earendil-works/pi-ai";
+import type { ClaudeModel } from "./usage.js";
+export interface SubscriptionProvider {
+    readonly getModels: () => readonly ClaudeModel[];
+    readonly setModels: (value: readonly ClaudeModel[]) => void;
+    readonly [key: string]: unknown;
+}
+/**
+ * Preserve pi-ai's native Anthropic OAuth provider (Claude Pro/Max) while
+ * allowing DSH's generic PiAiAdapter to pass the access token resolved by the
+ * host credential store.
+ *
+ * PiAiAdapter owns a request-local Models collection without a credential
+ * store. A pure OAuth provider ignores its `apiKey` request override and fails
+ * before dispatch with "Provider is not configured". This non-interactive
+ * bridge teaches that collection how to consume only the already-refreshed
+ * token for this request; login, refresh, persistence, headers, transport, and
+ * model behavior remain owned by the original provider.
+ */
+export declare function anthropicSubscriptionProvider(): SubscriptionProvider;
+export declare const PI_AI_RUNTIME_VERSION = "0.85.1";
+export declare const PI_AI_AUTH_CONTEXT: AuthContext;

package/lib/types/settings-contract.d.ts

@@ -0,0 +1,6 @@
+export declare const SETTINGS_NAMESPACE = "claude-subscription";
+export declare const QUICK_QUOTA_FIELD: "quickQuotaVisible";
+export type QuickQuotaField = typeof QUICK_QUOTA_FIELD;
+export interface ClaudeSubscriptionPreferences {
+    readonly quickQuotaVisible: boolean;
+}