teamclaude-cloud 1.5.2 → 1.5.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teamclaude-cloud",
-  "version": "1.5.2",
+  "version": "1.5.3",
   "description": "Multi-account Claude proxy with quota-based rotation + cloud token sync and auth-key control",
   "type": "module",
   "main": "src/index.js",

package/src/cloud.js

@@ -218,8 +218,11 @@ export function buildUsageFromQuota(entry) {
  * `usageByUuid` (optional Map/object accountUuid → usage from buildUsageFromQuota)
  * rides along so the dashboard can show 5h/7d/Fable utilization.
  */
-export async function cloudPush(cloud, accounts, usageByUuid = null) {
-  requireSession(cloud);
+export async function cloudPush(cloud, accounts, usageByUuid = null, authKey = null) {
+  // Auth: an auth key (push to the key's OWNER tenant, no owner login) OR the owner
+  // session. The key path only needs the endpoint (requireCloud), not a session.
+  if (authKey) requireCloud(cloud); else requireSession(cloud);
+  const authHeader = authKey ? { 'x-teamclaude-key': authKey } : { Authorization: `Bearer ${cloud.session.access_token}` };
   const usageOf = (uuid) => {
     if (!usageByUuid || !uuid) return undefined;
     const u = usageByUuid instanceof Map ? usageByUuid.get(uuid) : usageByUuid[uuid];
@@ -239,7 +242,7 @@ export async function cloudPush(cloud, accounts, usageByUuid = null) {
   };
   const res = await httpJson(`${fnBase(cloud)}/sync/push`, {
     method: 'POST',
-    headers: fnHeaders(cloud, { Authorization: `Bearer ${cloud.session.access_token}` }),
+    headers: fnHeaders(cloud, authHeader),
     body: payload,
   });
   if (!res.ok) throw new Error(`Cloud push failed (${res.status}): ${describe(res.data)}`);

package/src/index.js

@@ -322,18 +322,10 @@ async function serverCommand() {
           return am ? { ...a, accessToken: am.credential, refreshToken: am.refreshToken, expiresAt: am.expiresAt } : a;
         });
         if (!accounts.length) throw new Error('No OAuth accounts to push');
-        // Prefer the AUTH KEY (push to your own tenant, no expiring owner login).
+        // Prefer the AUTH KEY (push to your own tenant, no expiring owner login) —
+        // it CREATES + updates accounts. Fall back to an owner session only if no key.
         const fresh = (await loadConfig()) || config;
         const key = fresh.cloud?.pullKey || config.cloud?.pullKey;
-        if (key) {
-          const r = await cloudPushViaKey(resolveCloud(fresh), key, accounts);
-          const na = r.notAllowed ? `, ${r.notAllowed} not in the key's group` : '';
-          const sk = r.skipped ? `, ${r.skipped} skipped` : '';
-          return { summary: `${r.updated} updated, ${r.unchanged} unchanged${na}${sk} (via auth key)` };
-        }
-        // No key — owner login (also creates new accounts) + usage snapshot.
-        const cloud = await ensureCloudSession(fresh);
-        if (!cloud?.session?.access_token) throw new Error('No auth key and not logged in — pull once with a key, or run `teamclaude cloud login`');
         const usageByUuid = new Map();
         const quotaCache = await readQuotaCache();
         for (const entry of quotaCache?.accounts || []) {
@@ -341,8 +333,14 @@ async function serverCommand() {
           const usage = buildUsageFromQuota(entry);
           if (usage) usageByUuid.set(entry.accountUuid, usage);
         }
-        const r = await cloudPush(cloud, accounts, usageByUuid);
-        return { summary: `${r.pushed} new, ${r.updated} updated, ${r.skipped} skipped${usageByUuid.size ? `, usage ${r.usage ?? 0}` : ''}` };
+        let cloud, authKey = null;
+        if (key) { cloud = resolveCloud(fresh); authKey = key; }
+        else {
+          cloud = await ensureCloudSession(fresh);
+          if (!cloud?.session?.access_token) throw new Error('No auth key and not logged in — pull once with a key, or run `teamclaude cloud login`');
+        }
+        const r = await cloudPush(cloud, accounts, usageByUuid, authKey);
+        return { summary: `${r.pushed} new, ${r.updated} updated, ${r.skipped} skipped${usageByUuid.size ? `, usage ${r.usage ?? 0}` : ''}${authKey ? ' (via auth key)' : ''}` };
       }) : undefined,
     });
     hooks = {
@@ -905,7 +903,7 @@ async function accountsCommand() {
       a.refreshToken = newTokens.refreshToken;
       a.expiresAt = newTokens.expiresAt;
       configDirty = true;
-    } catch (err) {
+    } catch {
       // refresh failed — fetchProfile will report the specific error
     }
   }));
@@ -1727,36 +1725,24 @@ async function cloudLoginCommand(config) {
   console.log(`Logged in to cloud as ${email}.`);
 }
 
-// Push account tokens to the cloud using an AUTH KEY — no owner login needed. Reuses
-// the key-authenticated, group-scoped, freshest-wins /sync/report-token path, so the
-// tokens land in the KEY'S OWNER tenant (your personal key → your own account). This
-// UPDATES accounts already registered + in the key's group; an account the key can't
-// pull is reported as "not in the key's group" (create it via an owner login once).
-async function cloudPushViaKey(cloud, key, accounts) {
-  const r = { updated: 0, unchanged: 0, notAllowed: 0, skipped: 0 };
-  for (const a of accounts) {
-    if (!a.accountUuid || !a.accessToken || !a.refreshToken) { r.skipped++; continue; }
-    try {
-      const res = await cloudReportToken(cloud, key, a.accountUuid, { accessToken: a.accessToken, refreshToken: a.refreshToken, expiresAt: a.expiresAt });
-      if (res.action === 'updated') r.updated++; else r.unchanged++;
-    } catch (e) {
-      if (/\(40[34]\)/.test(e.message)) r.notAllowed++; else r.skipped++; // 403 not in group / 404 unknown account
-    }
-  }
-  return r;
-}
-
 async function cloudPushCommand(config) {
   const accounts = (config.accounts || []).filter(a => a.type !== 'apikey');
   if (!accounts.length) { console.error('No OAuth accounts to push.'); process.exit(1); }
   // Prefer the AUTH KEY: pushing to your own tenant is the key's job — no separate,
-  // short-lived owner login required (the key is the credential, same as pull).
+  // short-lived owner login required (the key is the credential, same as pull). This
+  // CREATES + updates accounts in the key's owner tenant (freshest-wins + plan limits).
   const key = config.cloud?.pullKey || process.env.TEAMCLAUDE_AUTH_KEY;
   if (key) {
-    const r = await cloudPushViaKey(resolveCloud(config), key, accounts);
-    const na = r.notAllowed ? `, ${r.notAllowed} not in the key's group` : '';
-    const sk = r.skipped ? `, ${r.skipped} skipped (no/expired token)` : '';
-    console.log(`Pushed tokens via auth key: ${r.updated} updated, ${r.unchanged} unchanged${na}${sk}.`);
+    const usageByUuid = new Map();
+    const quotaCache = await readQuotaCache();
+    for (const entry of quotaCache?.accounts || []) {
+      if (!entry?.accountUuid) continue;
+      const usage = buildUsageFromQuota(entry);
+      if (usage) usageByUuid.set(entry.accountUuid, usage);
+    }
+    const r = await cloudPush(resolveCloud(config), accounts, usageByUuid, key);
+    const usageNote = usageByUuid.size ? `, usage ${r.usage ?? 0}/${usageByUuid.size}` : '';
+    console.log(`Pushed to your account via auth key: ${r.pushed} new, ${r.updated} updated, ${r.skipped} skipped${usageNote}.`);
     return;
   }
   // No auth key — fall back to an owner login (which also CREATES new accounts) and