@cortexkit/opencode-anthropic-auth 1.22.0 → 2.0.0

package/dist/index-nngmvczq.js

@@ -0,0 +1,450 @@
+import*as O4 from"node:fs";import*as CG from"node:os";import*as SG from"node:path";import{createHash as xA,randomUUID as j9}from"node:crypto";import{mkdir as N1,readFile as o7,rename as yG,rm as H8,stat as TX,writeFile as r7}from"node:fs/promises";import{homedir as $B}from"node:os";import{dirname as x1,join as k8,resolve as ZB}from"node:path";import{readdirSync as JB,statSync as XB}from"node:fs";import*as uG from"node:fs/promises";import{tmpdir as YB,userInfo as i2}from"node:os";import{join as A9}from"node:path";import{createHash as NB}from"node:crypto";import{createHash as wq}from"node:crypto";var HW=new Uint8Array([0,97,115,109,1,0,0,0,1,48,8,96,3,127,127,127,1,127,96,3,127,127,127,0,96,2,127,127,0,96,1,127,1,127,96,3,127,127,126,1,126,96,3,126,127,127,1,126,96,2,127,126,0,96,1,127,1,126,3,11,10,0,0,2,1,3,4,5,6,1,7,5,3,1,0,1,7,85,9,3,109,101,109,2,0,5,120,120,104,51,50,0,0,6,105,110,105,116,51,50,0,2,8,117,112,100,97,116,101,51,50,0,3,8,100,105,103,101,115,116,51,50,0,4,5,120,120,104,54,52,0,5,6,105,110,105,116,54,52,0,7,8,117,112,100,97,116,101,54,52,0,8,8,100,105,103,101,115,116,54,52,0,9,10,251,22,10,242,1,1,4,127,32,0,32,1,106,33,3,32,1,65,16,79,4,127,32,3,65,16,107,33,6,32,2,65,168,136,141,161,2,106,33,3,32,2,65,137,235,208,208,7,107,33,4,32,2,65,207,140,162,142,6,106,33,5,3,64,32,3,32,0,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,3,32,4,32,0,65,4,106,34,0,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,4,32,2,32,0,65,4,106,34,0,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,2,32,5,32,0,65,4,106,34,0,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,5,32,6,32,0,65,4,106,34,0,79,13,0,11,32,2,65,12,119,32,5,65,18,119,106,32,4,65,7,119,106,32,3,65,1,119,106,5,32,2,65,177,207,217,178,1,106,11,32,1,106,32,0,32,1,65,15,113,16,1,11,146,1,0,32,1,32,2,106,33,2,3,64,32,1,65,4,106,32,2,75,69,4,64,32,0,32,1,40,2,0,65,189,220,202,149,124,108,106,65,17,119,65,175,214,211,190,2,108,33,0,32,1,65,4,106,33,1,12,1,11,11,3,64,32,1,32,2,79,69,4,64,32,0,32,1,45,0,0,65,177,207,217,178,1,108,106,65,11,119,65,177,243,221,241,121,108,33,0,32,1,65,1,106,33,1,12,1,11,11,32,0,32,0,65,15,118,115,65,247,148,175,175,120,108,34,0,65,13,118,32,0,115,65,189,220,202,149,124,108,34,0,65,16,118,32,0,115,11,63,0,32,0,65,8,106,32,1,65,168,136,141,161,2,106,54,2,0,32,0,65,12,106,32,1,65,137,235,208,208,7,107,54,2,0,32,0,65,16,106,32,1,54,2,0,32,0,65,20,106,32,1,65,207,140,162,142,6,106,54,2,0,11,195,4,1,6,127,32,1,32,2,106,33,6,32,0,65,24,106,33,4,32,0,65,40,106,40,2,0,33,3,32,0,32,0,40,2,0,32,2,106,54,2,0,32,0,65,4,106,34,5,32,5,40,2,0,32,2,65,16,79,32,0,40,2,0,65,16,79,114,114,54,2,0,32,2,32,3,106,65,16,73,4,64,32,3,32,4,106,32,1,32,2,252,10,0,0,32,0,65,40,106,32,2,32,3,106,54,2,0,15,11,32,3,4,64,32,3,32,4,106,32,1,65,16,32,3,107,34,2,252,10,0,0,32,0,65,8,106,34,3,32,3,40,2,0,32,4,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,54,2,0,32,0,65,12,106,34,3,32,3,40,2,0,32,4,65,4,106,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,54,2,0,32,0,65,16,106,34,3,32,3,40,2,0,32,4,65,8,106,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,54,2,0,32,0,65,20,106,34,3,32,3,40,2,0,32,4,65,12,106,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,54,2,0,32,0,65,40,106,65,0,54,2,0,32,1,32,2,106,33,1,11,32,1,32,6,65,16,107,77,4,64,32,6,65,16,107,33,8,32,0,65,8,106,40,2,0,33,2,32,0,65,12,106,40,2,0,33,3,32,0,65,16,106,40,2,0,33,5,32,0,65,20,106,40,2,0,33,7,3,64,32,2,32,1,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,2,32,3,32,1,65,4,106,34,1,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,3,32,5,32,1,65,4,106,34,1,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,5,32,7,32,1,65,4,106,34,1,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,7,32,8,32,1,65,4,106,34,1,79,13,0,11,32,0,65,8,106,32,2,54,2,0,32,0,65,12,106,32,3,54,2,0,32,0,65,16,106,32,5,54,2,0,32,0,65,20,106,32,7,54,2,0,11,32,1,32,6,73,4,64,32,4,32,1,32,6,32,1,107,34,1,252,10,0,0,32,0,65,40,106,32,1,54,2,0,11,11,97,1,1,127,32,0,65,16,106,40,2,0,33,1,32,0,65,4,106,40,2,0,4,127,32,1,65,12,119,32,0,65,20,106,40,2,0,65,18,119,106,32,0,65,12,106,40,2,0,65,7,119,106,32,0,65,8,106,40,2,0,65,1,119,106,5,32,1,65,177,207,217,178,1,106,11,32,0,40,2,0,106,32,0,65,24,106,32,0,65,40,106,40,2,0,16,1,11,255,3,2,3,126,1,127,32,0,32,1,106,33,6,32,1,65,32,79,4,126,32,6,65,32,107,33,6,32,2,66,214,235,130,238,234,253,137,245,224,0,124,33,3,32,2,66,177,169,172,193,173,184,212,166,61,125,33,4,32,2,66,249,234,208,208,231,201,161,228,225,0,124,33,5,3,64,32,3,32,0,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,3,32,4,32,0,65,8,106,34,0,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,4,32,2,32,0,65,8,106,34,0,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,2,32,5,32,0,65,8,106,34,0,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,5,32,6,32,0,65,8,106,34,0,79,13,0,11,32,2,66,12,137,32,5,66,18,137,124,32,4,66,7,137,124,32,3,66,1,137,124,32,3,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,4,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,2,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,5,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,5,32,2,66,197,207,217,178,241,229,186,234,39,124,11,32,1,173,124,32,0,32,1,65,31,113,16,6,11,134,2,0,32,1,32,2,106,33,2,3,64,32,2,32,1,65,8,106,79,4,64,32,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,32,0,133,66,27,137,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,33,0,32,1,65,8,106,33,1,12,1,11,11,32,1,65,4,106,32,2,77,4,64,32,0,32,1,53,2,0,66,135,149,175,175,152,182,222,155,158,127,126,133,66,23,137,66,207,214,211,190,210,199,171,217,66,126,66,249,243,221,241,153,246,153,171,22,124,33,0,32,1,65,4,106,33,1,11,3,64,32,1,32,2,73,4,64,32,0,32,1,49,0,0,66,197,207,217,178,241,229,186,234,39,126,133,66,11,137,66,135,149,175,175,152,182,222,155,158,127,126,33,0,32,1,65,1,106,33,1,12,1,11,11,32,0,32,0,66,33,136,133,66,207,214,211,190,210,199,171,217,66,126,34,0,32,0,66,29,136,133,66,249,243,221,241,153,246,153,171,22,126,34,0,32,0,66,32,136,133,11,77,0,32,0,65,8,106,32,1,66,214,235,130,238,234,253,137,245,224,0,124,55,3,0,32,0,65,16,106,32,1,66,177,169,172,193,173,184,212,166,61,125,55,3,0,32,0,65,24,106,32,1,55,3,0,32,0,65,32,106,32,1,66,249,234,208,208,231,201,161,228,225,0,124,55,3,0,11,244,4,2,3,127,4,126,32,1,32,2,106,33,5,32,0,65,40,106,33,4,32,0,65,200,0,106,40,2,0,33,3,32,0,32,0,41,3,0,32,2,173,124,55,3,0,32,2,32,3,106,65,32,73,4,64,32,3,32,4,106,32,1,32,2,252,10,0,0,32,0,65,200,0,106,32,2,32,3,106,54,2,0,15,11,32,3,4,64,32,3,32,4,106,32,1,65,32,32,3,107,34,2,252,10,0,0,32,0,65,8,106,34,3,32,3,41,3,0,32,4,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,55,3,0,32,0,65,16,106,34,3,32,3,41,3,0,32,4,65,8,106,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,55,3,0,32,0,65,24,106,34,3,32,3,41,3,0,32,4,65,16,106,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,55,3,0,32,0,65,32,106,34,3,32,3,41,3,0,32,4,65,24,106,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,55,3,0,32,0,65,200,0,106,65,0,54,2,0,32,1,32,2,106,33,1,11,32,1,65,32,106,32,5,77,4,64,32,5,65,32,107,33,2,32,0,65,8,106,41,3,0,33,6,32,0,65,16,106,41,3,0,33,7,32,0,65,24,106,41,3,0,33,8,32,0,65,32,106,41,3,0,33,9,3,64,32,6,32,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,6,32,7,32,1,65,8,106,34,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,7,32,8,32,1,65,8,106,34,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,8,32,9,32,1,65,8,106,34,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,9,32,2,32,1,65,8,106,34,1,79,13,0,11,32,0,65,8,106,32,6,55,3,0,32,0,65,16,106,32,7,55,3,0,32,0,65,24,106,32,8,55,3,0,32,0,65,32,106,32,9,55,3,0,11,32,1,32,5,73,4,64,32,4,32,1,32,5,32,1,107,34,1,252,10,0,0,32,0,65,200,0,106,32,1,54,2,0,11,11,188,2,1,5,126,32,0,65,24,106,41,3,0,33,1,32,0,41,3,0,34,2,66,32,90,4,126,32,0,65,8,106,41,3,0,34,3,66,1,137,32,0,65,16,106,41,3,0,34,4,66,7,137,124,32,1,66,12,137,32,0,65,32,106,41,3,0,34,5,66,18,137,124,124,32,3,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,4,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,1,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,5,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,5,32,1,66,197,207,217,178,241,229,186,234,39,124,11,32,2,124,32,0,65,40,106,32,2,66,31,131,167,16,6,11]);async function vJ(){return function($){let{exports:{mem:Z,xxh32:J,xxh64:X,init32:Y,update32:G,digest32:z,init64:Q,update64:K,digest64:W}}=$,V=new Uint8Array(Z.buffer);function B(x,C){if(Z.buffer.byteLength<x+C){let v=Math.ceil((x+C-Z.buffer.byteLength)/65536);Z.grow(v),V=new Uint8Array(Z.buffer)}}function j(x,C,v,k,m,l){B(x);let P=new Uint8Array(x);return V.set(P),v(0,C),P.set(V.subarray(0,x)),{update(M){let _;return V.set(P),typeof M=="string"?(B(3*M.length,x),_=U.encodeInto(M,V.subarray(x)).written):(B(M.byteLength,x),V.set(M,x),_=M.byteLength),k(0,x,_),P.set(V.subarray(0,x)),this},digest:()=>(V.set(P),l(m(0)))}}function H(x){return x>>>0}let q=2n**64n-1n;function N(x){return x&q}let U=new TextEncoder,L=0,D=0n;function w(x,C=L){return B(3*x.length,0),H(J(0,U.encodeInto(x,V).written,C))}function O(x,C=D){return B(3*x.length,0),N(X(0,U.encodeInto(x,V).written,C))}return{h32:w,h32ToString:(x,C=L)=>w(x,C).toString(16).padStart(8,"0"),h32Raw:(x,C=L)=>(B(x.byteLength,0),V.set(x),H(J(0,x.byteLength,C))),create32:(x=L)=>j(48,x,Y,G,z,H),h64:O,h64ToString:(x,C=D)=>O(x,C).toString(16).padStart(16,"0"),h64Raw:(x,C=D)=>(B(x.byteLength,0),V.set(x),N(X(0,x.byteLength,C))),create64:(x=D)=>j(88,x,Q,K,W,N)}}((await WebAssembly.instantiate(HW)).instance)}import{randomBytes as pq,randomUUID as Bz}from"node:crypto";import{createHash as Gj,randomBytes as zj}from"node:crypto";import{lstat as e2,mkdir as Qj,readdir as jz,readFile as iX,rename as Kj,unlink as Hz,writeFile as Wj}from"node:fs/promises";import{tmpdir as Vj}from"node:os";import{join as L0,resolve as U9}from"node:path";import{Buffer as C9}from"node:buffer";import{types as $8}from"node:util";import{types as k1}from"node:util";import{randomUUID as BY}from"node:crypto";import{mkdir as ML,readdir as PL,readFile as _L,rename as wL,rm as qY,writeFile as AL}from"node:fs/promises";import{tmpdir as RL}from"node:os";import{join as z5}from"node:path";import{createHash as kL,randomBytes as vL,randomUUID as fL}from"node:crypto";import{constants as jY}from"node:fs";import{chmod as EL,mkdir as u1,open as dz,realpath as bL,rename as hL,stat as gL,unlink as sz}from"node:fs/promises";import{homedir as yL}from"node:os";import{basename as tz,dirname as n9,extname as HY,isAbsolute as uL,join as hZ,resolve as mL}from"node:path";import{readdirSync as eW,statSync as $V}from"node:fs";import{tmpdir as qX,userInfo as ZV}from"node:os";import{join as Q8}from"node:path";import{debuglog as AW}from"node:util";import{createHmac as xW,randomBytes as DW,timingSafeEqual as OW}from"node:crypto";import NW from"node:net";var a$=2,K7=21,W7=5,v0=67108864,u;(function($){$[$.Request=0]="Request",$[$.Response=1]="Response",$[$.Push=2]="Push",$[$.StreamData=3]="StreamData",$[$.StreamEnd=4]="StreamEnd",$[$.Error=5]="Error",$[$.Cancel=6]="Cancel",$[$.Ping=7]="Ping",$[$.Pong=8]="Pong",$[$.Hello=9]="Hello",$[$.HelloAck=10]="HelloAck",$[$.Goodbye=11]="Goodbye"})(u||(u={}));var fJ=u.Goodbye;function EJ($){return $===u.Cancel||$===u.Ping||$===u.Pong||$===u.Goodbye}var w$;(function($){$[$.Passive=0]="Passive",$[$.Interactive=1]="Interactive",$[$.Background=2]="Background"})(w$||(w$={}));var b$;(function($){$[$.Normal=0]="Normal",$[$.Expedite=1]="Expedite",$[$.Sheddable=2]="Sheddable"})(b$||(b$={}));var bJ=1,hJ=6,f0=1,LW=8,gJ=48,E0=4;var yJ=0;function u$($,Z,J,X=b$.Normal){let Y=0;if($)Y|=bJ;if(Y|=Z<<f0,J)Y|=LW;return Y|=X<<E0,Y}function b0($){return($&bJ)!==0}function uJ($){let Z=new Uint8Array(21),J=new DataView(Z.buffer);return J.setUint32(0,$.len,!0),Z[4]=$.ver,Z[5]=$.ty,Z[6]=$.flags,J.setUint16(7,$.channel,!0),J.setUint32(9,$.epoch,!0),J.setBigUint64(13,$.corr,!0),Z}class Q$ extends Error{code;constructor($,Z){super($);this.code=Z,this.name="DecodeError"}}function UW($){let Z=$.len>>>0,J=$.ver>>>0&255,X=$.ty>>>0&255,Y=$.flags>>>0&255,G=$.channel>>>0&65535,z=$.epoch>>>0;if(BigInt.asUintN(64,$.corr),J!==2)throw new Q$(`unsupported envelope version ${J}`,"unsupported_version");if(X>fJ)throw new Q$(`unknown frame type byte ${X}`,"unknown_frame_type");let Q=X;if((Y&yJ)!==0)throw new Q$(`reserved flag bits set in flags 0b${Y.toString(2).padStart(8,"0")}`,"reserved_flag_bits");if((Y&hJ)>>f0===3)throw new Q$(`reserved priority bits set in flags 0b${Y.toString(2).padStart(8,"0")}`,"reserved_priority_bits");let K=(Y&gJ)>>E0;if(K===3)throw new Q$(`reserved admission class set in flags 0b${Y.toString(2).padStart(8,"0")}`,"reserved_admission_class");if(K===b$.Sheddable&&Q!==u.Push&&Q!==u.StreamData)throw new Q$(`SHEDDABLE admission class is illegal on ${u[Q]} in flags 0b${Y.toString(2).padStart(8,"0")}`,"sheddable_illegal_frame_type");if(G===0&&z!==0)throw new Q$(`control channel carried nonzero epoch ${z}`,"nonzero_epoch_on_control_channel");if(EJ(Q)&&Z!==0)throw new Q$(`pure-header frame ${u[Q]} declared non-zero body length ${Z}`,"pure_header_frame_with_body")}function h0($){if($.length<5)throw new Q$(`header shorter than frozen prefix: have ${$.length} bytes`,"too_short_for_prefix");let Z=$[4];if(Z!==2)throw new Q$(`unsupported envelope version ${Z}`,"unsupported_version");if($.length<21)throw new Q$(`header too short for version: have ${$.length} bytes, need 21`,"too_short_for_header");let J=new DataView($.buffer,$.byteOffset,$.byteLength),X=J.getUint32(0,!0),Y=$[5];if(Y>fJ)throw new Q$(`unknown frame type byte ${Y}`,"unknown_frame_type");let G=Y,z=$[6];if((z&yJ)!==0)throw new Q$(`reserved flag bits set in flags 0b${z.toString(2).padStart(8,"0")}`,"reserved_flag_bits");if((z&hJ)>>f0===3)throw new Q$(`reserved priority bits set in flags 0b${z.toString(2).padStart(8,"0")}`,"reserved_priority_bits");let Q=(z&gJ)>>E0;if(Q===3)throw new Q$(`reserved admission class set in flags 0b${z.toString(2).padStart(8,"0")}`,"reserved_admission_class");if(Q===b$.Sheddable&&G!==u.Push&&G!==u.StreamData)throw new Q$(`SHEDDABLE admission class is illegal on ${u[G]} in flags 0b${z.toString(2).padStart(8,"0")}`,"sheddable_illegal_frame_type");let K=J.getUint16(7,!0),W=J.getUint32(9,!0);if(K===0&&W!==0)throw new Q$(`control channel carried nonzero epoch ${W}`,"nonzero_epoch_on_control_channel");if(EJ(G)&&X!==0)throw new Q$(`pure-header frame ${u[G]} declared non-zero body length ${X}`,"pure_header_frame_with_body");return{len:X,ver:Z,ty:G,flags:z,channel:K,epoch:W,corr:J.getBigUint64(13,!0)}}function h$($,Z,J,X,Y,G){return P4(2,$,Z,J,X,Y,G)}function P4($,Z,J,X,Y,G,z){if(z.length>67108864)throw new Q$(`frame body ${z.length} exceeds max 67108864`,"frame_body_too_large");let Q={len:z.length,ver:$,ty:Z,flags:J,channel:X,epoch:Y,corr:G};return UW(Q),{header:Q,body:z}}function B4($){if($.header.len!==$.body.length)throw new Q$(`frame header length ${$.header.len} does not match body length ${$.body.length}`,"frame_length_mismatch");let Z=uJ($.header),J=new Uint8Array(Z.length+$.body.length);return J.set(Z,0),J.set($.body,Z.length),J}class g4 extends Error{}class q4 extends Error{}class _4 extends Error{cause;constructor($,Z){super($);this.cause=Z}}class r4 extends Error{cause;constructor($,Z){super($);this.cause=Z}}function mJ($){return Buffer.from($.buffer,$.byteOffset,$.byteLength)}var pJ=Symbol("subc.socket.writeBorrowed"),cJ=Symbol("subc.socket.writeTrackedBorrowed");function j4($,Z,J){let X=$[pJ];return X?X.call($,Z,J):$.write(Z,J)}function g0($,Z,J){let X=$[cJ];return X?X.call($,Z,J):$.writeTracked(Z,J)}class w6{sock;chunks=[];buffered=0;waiter=null;closedErr=null;bufferedBytes(){return this.buffered}constructor($){this.sock=$,$.on("data",(J)=>{this.chunks.push(J),this.buffered+=J.length,this.tryServe()});let Z=(J)=>{if(!this.closedErr)this.closedErr=J;this.tryServe()};$.on("error",(J)=>Z(J instanceof Error?J:Error(String(J)))),$.on("end",()=>Z(new g4("subc closed the connection"))),$.on("close",()=>Z(new g4("subc connection closed")))}localPort(){return this.sock.localPort??null}static connect($,Z,J){return new Promise((X,Y)=>{let G=NW.connect({host:$,port:Z});G.setNoDelay(!0);let z=setTimeout(()=>{G.destroy(),Y(new q4(`timed out connecting to ${$}:${Z}`))},Math.max(0,J-Date.now()));G.once("connect",()=>{clearTimeout(z),X(new w6(G))}),G.once("error",(Q)=>{clearTimeout(z),Y(Q)})})}async readFrame($,Z,J){let X=await this.readExact(W7,$),Y=X[4];if(Y!==a$)throw new Q$(`unsupported envelope version ${Y}`,"unsupported_version");let G=await this.readExact(K7-W7,$),z=new Uint8Array(K7);z.set(X),z.set(G,W7);let Q=h0(z);if(Q.len>v0)throw new Q$(`frame body ${Q.len} exceeds max ${v0}`,"frame_body_too_large");J?.();let K=typeof Z==="number"?Z:Date.now()+Z.afterHeaderMs,W=Q.len===0?new Uint8Array(0):await this.readExact(Q.len,K);return{header:Q,body:W}}readExact($,Z){if(this.waiter)return Promise.reject(Error("concurrent readExact is not supported"));if($===0)return Promise.resolve(new Uint8Array(0));return new Promise((J,X)=>{let Y=null;if(Number.isFinite(Z)){let G=Z-Date.now();if(G<=0){X(new q4(`timed out waiting for ${$} bytes`));return}Y=setTimeout(()=>{this.waiter=null,X(new q4(`timed out waiting for ${$} bytes`))},G)}this.waiter={need:$,resolve:J,reject:X,timer:Y},this.tryServe()})}async write($,Z){await this.writeBuffer(Buffer.from($),Z)}writeTracked($,Z){return this.writeTrackedBuffer(Buffer.from($),Z)}async[pJ]($,Z){await this.writeBuffer(mJ($),Z)}[cJ]($,Z){return this.writeTrackedBuffer(mJ($),Z)}async writeBuffer($,Z){try{await this.writeTrackedBuffer($,Z).completed}catch(J){if(J instanceof _4||J instanceof r4)throw J.cause??J;throw J}}writeTrackedBuffer($,Z){if(this.closedErr)return{queued:!1,completed:Promise.reject(new _4("subc socket was closed before bytes could be queued",this.closedErr))};let J=!1,X=!1,Y=null,G=new Promise((z,Q)=>{let K=(V)=>{if(X)return;if(X=!0,Y)clearTimeout(Y);V()},W=Z-Date.now();if(W<=0){K(()=>Q(new _4("timed out before bytes could be queued to subc",new q4("timed out writing to subc"))));return}Y=setTimeout(()=>{let V=new q4("timed out writing to subc");K(()=>Q(J?new r4("timed out after bytes were handed to the subc socket",V):new _4("timed out before bytes could be queued to subc",V)))},W);try{this.sock.write($,(V)=>{K(()=>{if(V)Q(new r4("subc socket reported a write error after bytes were handed to the socket",V instanceof Error?V:Error(String(V))));else z()})}),J=!0}catch(V){K(()=>Q(new _4("subc socket write threw before bytes could be queued",V instanceof Error?V:Error(String(V)))))}});return{queued:J,completed:G}}close(){this.sock.destroy()}tryServe(){let $=this.waiter;if(!$)return;if(this.buffered>=$.need){let Z=this.take($.need);if(this.waiter=null,$.timer)clearTimeout($.timer);$.resolve(Z);return}if(this.closedErr){if(this.waiter=null,$.timer)clearTimeout($.timer);$.reject(this.closedErr)}}take($){let Z=Buffer.allocUnsafe($),J=0;while(J<$){let X=this.chunks[0],Y=$-J;if(X.length<=Y)X.copy(Z,J),J+=X.length,this.chunks.shift();else X.copy(Z,J,0,Y),this.chunks[0]=X.subarray(Y),J+=Y}return this.buffered-=$,Z}}var dJ=32;var V7=4096,sJ="subc-server-v1",tJ="subc-client-v1",IW="client";class m$ extends Error{}function u0($,Z,J,X,Y){let G=xW("sha256",Buffer.from($));return G.update(Buffer.from(Z,"utf8")),G.update(Buffer.from(J)),G.update(Buffer.from(X)),G.update(Buffer.from(Y)),new Uint8Array(G.digest())}function lJ($,Z){if($.length!==Z.length)return!1;return OW(Buffer.from($),Buffer.from(Z))}async function iJ($,Z,J){let X=Buffer.from(JSON.stringify(Z),"utf8");if(X.length>V7)throw new m$(`auth message too large: ${X.length} > ${V7}`);let Y=new Uint8Array(4);new DataView(Y.buffer).setUint32(0,X.length,!0),await j4($,Y,J),await j4($,X,J)}async function MW($,Z){let J=await $.readExact(4,Z),X=new DataView(J.buffer,J.byteOffset,4).getUint32(0,!0);if(X>V7)throw new m$(`auth message too large: ${X} > ${V7}`);let Y=X===0?new Uint8Array(0):await $.readExact(X,Z);try{return JSON.parse(Buffer.from(Y).toString("utf8"))}catch(G){throw new m$(`auth message JSON decode failed: ${String(G)}`)}}function y0($,Z){if(!Array.isArray($))throw new m$(`auth field '${Z}' must be a byte array`);for(let J of $)if(typeof J!=="number"||!Number.isInteger(J)||J<0||J>255)throw new m$(`auth field '${Z}' has invalid byte ${String(J)}`);return Uint8Array.from($)}async function d8($,Z,J){let X=new Uint8Array(DW(dJ));await iJ($,{client_nonce:Array.from(X),role:IW},J);let Y=await MW($,J),G=y0(Y.server_nonce,"server_nonce"),z=y0(Y.daemon_id,"daemon_id"),Q=y0(Y.server_proof,"server_proof"),K=u0(Z.key,sJ,X,G,z);if(!lJ(K,Q))throw new m$("server proof mismatch — wrong key or impostor daemon");if(!lJ(z,Z.daemonId))throw new m$("daemon id mismatch — connection file points at a different daemon");let W=u0(Z.key,tJ,X,G,z);await iJ($,{client_auth:Array.from(W)},J)}import{promises as m0}from"node:fs";var aJ=1,nJ=32,oJ=16;class C$ extends Error{}function rJ($,Z){if(!Array.isArray($))throw new C$(`connection file field '${Z}' must be a JSON array of bytes`);for(let J of $)if(typeof J!=="number"||!Number.isInteger(J)||J<0||J>255)throw new C$(`connection file field '${Z}' has invalid byte ${String(J)}`);return Uint8Array.from($)}function PW($){if($.schema!==aJ)throw new C$(`unsupported connection file schema ${$.schema}; expected ${aJ}`);if($.endpoints.length===0)throw new C$("connection file must include at least one endpoint");if($.key.length<nJ)throw new C$(`connection file key is too short: ${$.key.length} bytes, need at least ${nJ}`);if($.daemonId.length!==oJ)throw new C$(`connection file daemon_id must be ${oJ} bytes, got ${$.daemonId.length}`)}async function _W($){if(process.platform==="win32")return;let J=(await m0.stat($)).mode&511;if((J&63)!==0)throw new C$(`connection file ${$} has insecure permissions 0o${J.toString(8)}; expected owner-only 0600`)}async function Y8($){await _W($);let Z=await m0.readFile($,"utf8"),J;try{J=JSON.parse(Z)}catch(Q){throw new C$(`connection file JSON read failed for ${$}: ${String(Q)}`)}let X=J.wire_version;if(X!==void 0&&X!==a$)throw new C$(`connection file wire_version ${String(X)} but this client speaks ${a$}; the client library must be upgraded`);let Y=J.endpoints;if(!Array.isArray(Y))throw new C$("connection file 'endpoints' must be an array");let G=Y.map((Q)=>{let K=Q;if(typeof K.host!=="string"||typeof K.port!=="number")throw new C$("connection file endpoint must be { host: string, port: number }");return{host:K.host,port:K.port}}),z={schema:J.schema,endpoints:G,key:rJ(J.key,"key"),daemonId:rJ(J.daemon_id,"daemon_id"),pid:J.pid,daemonVer:J.daemon_ver??""};return PW(z),z}var eJ=new WeakMap,p0=new WeakMap;class c0 extends Error{methodFamily;code="reverse_request_capability_not_declared";constructor($){super(`reverse-request capability ${JSON.stringify($)} was not registered before route.open`);this.methodFamily=$,this.name="ReverseRequestRegistrationError"}}class e4{handlers=new Map;declaredFamilies=null;onRequest($,Z){if(!wW($))throw TypeError(`reverse-request method family must be a capability identifier, got ${JSON.stringify($)}`);if(typeof Z!=="function")throw TypeError("reverse-request handler must be a function");if(this.declaredFamilies&&!this.declaredFamilies.has($))throw new c0($);this.handlers.set($,Z)}capabilities(){return[...this.handlers.keys()].sort()}handler($){return this.handlers.get($)}seal(){this.declaredFamilies??=new Set(this.handlers.keys())}}class B7{channel;epoch;constructor($,Z,J,X){if(!Number.isInteger($)||$<=0||$>65535)throw RangeError(`route channel must be an integer in 1..65535, got ${$}`);if(!Number.isInteger(Z)||Z<=0||Z>4294967295)throw RangeError(`route epoch must be an integer in 1..4294967295, got ${Z}`);this.channel=$,this.epoch=Z,X.seal(),eJ.set(this,J),p0.set(this,X),Object.freeze(this)}onRequest($,Z){p0.get(this).onRequest($,Z)}static create($,Z,J,X){return new B7($,Z,J,X)}}function q7($,Z,J,X=new e4){return B7.create($,Z,J,X)}function $X($,Z){return p0.get($)?.handler(Z)}function wW($){return/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/.test($)}class y4 extends Error{handle;code="stale_route_handle";constructor($){super(`route handle (${$.channel}, ${$.epoch}) is not live on the current connection`);this.handle=$,this.name="StaleRouteHandleError"}}function G8(){return Object.freeze({})}function s8($,Z){return eJ.get($)===Z}function j7($,Z){return $===Z}var ZX=AW("subc-client"),RW=1e4,z8=30000,TW=50,FW=2000,JX="request_deadline",l0="deadline_exceeded_no_drop_observed",CW=30000,SW=30000,XX=new Uint8Array(0),kW="management_surface",N7="SUBC_MODULE_ID",x7="SUBC_LAUNCH_NONCE",D7={baseMs:100,capMs:2000,maxAttempts:6};class S$ extends Error{kind;code;cause;constructor($,Z,J,X){super(Z);this.kind=$,this.code=J,this.cause=X,this.name="SubcCallError"}get detail(){return this.cause instanceof Z$?this.cause.detail:void 0}}class Z$ extends Error{code;detail;constructor($,Z,J){super($);this.code=Z,this.detail=J}}var YX=new WeakMap;function i0($){if($ instanceof Uint8Array)return $;let Z=$===null?"null":Array.isArray($)?"array":typeof $;throw new Z$(`binary request body must be a Uint8Array; got ${Z}`,"binary_body_required")}class A6{sock;currentConn;opts;nextCorr=1n;pending=new Map;lateResponses=new Map;routes=new Map;liveRoutes=new Map;connectionToken=G8();ingressEpochDropCount=0;closedErr=null;closeStarted=!1;reconnecting=null;generation=1;readerActive=!1;constructor($,Z,J){this.sock=$,this.currentConn=Z,this.opts=J,this.readLoop($,this.generation)}get conn(){return this.currentConn}static async connect($){let Z=EW($),J=await A6.openConnection(Z);return new A6(J.sock,J.conn,Z)}async catalogList($){let Z=this.encode($===void 0?{op:"catalog.list"}:{op:"catalog.list",module_id:$}),J=await this.controlRpc(Z);return this.parseJson(J).modules??[]}async resolveProvider($){let Z=await this.resolveProviders($);if(Z.length===0)throw new Z$(`no catalog claimant for capability ${$}`,"capability_unprovided");if(Z.length>1)throw new Z$(`multiple catalog claimants for capability ${$}: ${Z.join(", ")}`,"capability_ambiguous");return Z[0]}async resolveProviders($){if(!KX($))throw new Z$(`malformed capability identifier ${JSON.stringify($)}`,"invalid_capability_identifier");return(await this.catalogList()).filter((J)=>J.capabilities?.provides.includes($)??!1).map((J)=>J.module_id).sort()}async routeOpen($,Z,J={}){let X=d0(J),Y=J.reverseRequests??new e4;Y.seal();let G=Y.capabilities(),z=this.encode({op:"route.open",target:$,identity:Z,...X?{consumer_identity:X}:{},...G.length>0?{consumer_capabilities:G}:{}}),Q=null,K=(V)=>{if(V.header.ty!==u.Response)return!0;let B=this.parseJson(V);if(typeof B.route_channel!=="number"||typeof B.route_epoch!=="number")throw new Z$(`route.open returned no route handle: ${JSON.stringify(B)}`);return Q=this.installRoute(B.route_channel,B.route_epoch,Y),!0},W=(V)=>{if(V.header.ty!==u.Response)return;try{let B=this.parseJson(V);if(typeof B.route_channel!=="number"||typeof B.route_epoch!=="number")return;let j=this.installRoute(B.route_channel,B.route_epoch);this.failHandle(j,new Z$("late route.open was closed","route_closed")),this.liveRoutes.delete(j.channel),this.sendRouteGoodbye(j,!0)}catch{this.closeConnectionAfterCleanupFailure()}};if(await this.controlRpc(z,K,W),!Q)throw new Z$("route.open response was not installed");return Q}async request($,Z,J={}){this.assertLiveHandle($);let X=J.binary??!1,Y=X?i0(Z):Z instanceof Uint8Array?Z:this.encode(Z),G=J.priority??w$.Interactive,z=J.admissionClass??b$.Normal,Q=await this.send($,Y,G,z,J.timeoutMs,J.onProgress,void 0,void 0,X,J.signal);return this.decodeReply(Q)}async call($,Z,J,X={}){if(X.binary)throw new Z$("call() builds a JSON body and cannot send a binary request; use callBinary(moduleId, body, opts) with a Uint8Array","binary_call_requires_call_binary");let Y=J===void 0?{method:Z}:{method:Z,params:J};return await this.managedCall($,Y,X)}async callBinary($,Z,J={}){let X=i0(Z);return this.managedCall($,X,{...J,binary:!0})}async managedCall($,Z,J){let X=!1;for(;;){let Y=await this.cachedRouteHandle($,J);try{return await this.managedRequest(Y,Z,J)}catch(G){if(!(G instanceof S$))throw this.terminalCallError("managed call failed",G);let z=O7(G.cause instanceof Z$?YX.get(G.cause)??0:0,G.code);if(z&&!X&&!this.closeStarted){X=!0,this.evictRouteHandle(Y);continue}if(z&&X)this.evictRouteHandle(Y);if(G.code==="route_closed")throw this.evictRouteHandle(Y),G;if(G.kind==="not_sent"){if(!this.closedErr)throw G;try{await this.reconnectAfterDrop(G)}catch(Q){throw this.notSentRecoveryError("managed call was not sent",Q)}continue}if(G.kind==="outcome_unknown"&&G.code!==l0){if(this.closedErr)this.scheduleReconnectAfterDrop(G)}else if(G.kind==="outcome_unknown"&&G.code===l0)this.probeLivenessAfterDeadline();throw G}}}subscribe($,Z,J,X={}){this.assertLiveHandle($);let Y=Z instanceof Uint8Array?Z:this.encode(Z),G=X.priority??w$.Interactive,z=X.admissionClass??b$.Normal,Q=this.allocateCorr(),K=H7($,Q),W=null,V=null,B=new Promise((q,N)=>{if(this.closedErr){N(this.closedErr);return}V=q,W={handle:$,resolve:()=>q(),reject:N,onProgress:J,timer:null,subscription:!0},this.pending.set(K,W);let U=h$(u.Request,u$(!1,G,!1,z),$.channel,$.epoch,Q,Y);j4(this.sock,B4(U),Date.now()+z8).catch((L)=>{let D=this.pending.get(K);if(D)this.rejectPending(K,D,L instanceof Error?L:new Z$(String(L)))})}),j=!1;return{unsubscribe:()=>{if(j)return;if(j=!0,W&&V)this.settle(K,W,V);if(this.isLiveHandle($))this.cancel($,Q,G)},closed:B}}attachCancelSignal($,Z,J,X,Y){if(!J)return;let G=()=>{if(!this.pending.has(Z))return;try{this.cancel(J,X,Y)}catch{}};if($.aborted){G();return}$.addEventListener("abort",G,{once:!0});let z=this.pending.get(Z);if(z){let Q=z.onSettle;z.onSettle=()=>{Q?.(),$.removeEventListener("abort",G)}}}cancel($,Z,J=w$.Interactive){this.assertLiveHandle($);let X=h$(u.Cancel,u$(!1,J,!1),$.channel,$.epoch,Z,XX);j4(this.sock,B4(X),Date.now()+z8).catch(()=>{return})}async routePoll($,Z){this.assertLiveHandle($);let J=this.encode({op:"route.poll",route_channel:$.channel,route_epoch:$.epoch,kind:Z}),X=await this.controlRpc(J,(Y)=>{if(Y.header.ty!==u.Response)return!0;let G=this.parseJson(Y);return G.route_channel===$.channel&&G.route_epoch===$.epoch});return this.parseJson(X)}async closeRoute($,Z={}){this.assertLiveHandle($);for(let[J,X]of this.routes)if(X.handle&&j7(X.handle,$))X.closed=!0,X.handle=null,this.routes.delete(J);if(Z.drain)await this.drainUnaryOnHandle($);if(this.failHandle($,new Z$("route closed by closeRoute","route_closed")),this.liveRoutes.get($.channel)===$)this.liveRoutes.delete($.channel);this.sendRouteGoodbye($)}async closeManagedRoute($,Z,J={}){let X=GX($,Z,d0(J),(J.reverseRequests??new e4).capabilities()),Y=this.routes.get(X);if(!Y)return;Y.closed=!0,this.routes.delete(X);let G=Y.handle;if(Y.handle=null,G)await this.closeRoute(G,J)}async closeRouteChannel($,Z={}){await this.closeRoute($,Z)}close(){this.closeStarted=!0,this.fail(new Z$("client closed")),this.sock.close()}drainUnaryOnHandle($){let Z=[];for(let J of this.pending.values())if(J.handle===$&&!J.subscription)Z.push(new Promise((X)=>{let Y=J.onSettle;J.onSettle=()=>{Y?.(),X()}}));return Promise.all(Z).then(()=>{return})}sendRouteGoodbye($,Z=!1){if(this.assertLiveConnection($),this.closedErr){if(Z)this.closeConnectionAfterCleanupFailure();return}let J=h$(u.Goodbye,u$(!1,w$.Interactive,!1),$.channel,$.epoch,0n,XX),X=g0(this.sock,B4(J),Date.now()+z8);if(!X.queued&&Z)this.closeConnectionAfterCleanupFailure();X.completed.catch(()=>{if(Z&&!X.queued)this.closeConnectionAfterCleanupFailure()})}static async openConnection($){let Z=await Y8($.connectionFile),J=Date.now()+($.handshakeTimeoutMs??RW),X=Z.endpoints[0],Y=await w6.connect(X.host,X.port,J);try{await d8(Y,Z,J)}catch(G){throw Y.close(),G}return{sock:Y,conn:Z}}async controlRpc($,Z,J){return this.send(null,$,w$.Interactive,b$.Normal,void 0,void 0,Z,J)}send($,Z,J,X,Y,G,z,Q,K=!1,W){if($)this.assertLiveHandle($);if(this.closedErr)return Promise.reject(this.closedErr);let V;try{V=this.allocateCorr()}catch(N){return Promise.reject(N)}let B=H7($,V),j=$?.channel??0,H=$?.epoch??0,q=h$(u.Request,u$(K,J,!1,X),j,H,V,Z);return new Promise((N,U)=>{let L=Y??z8,D={handle:$,resolve:N,reject:U,onProgress:G,timer:null,acceptFrame:z,onLateResponse:Q};if(D.timer=setTimeout(()=>this.arbitrateTimeout(B,D,j,V,L),L),this.pending.set(B,D),W)this.attachCancelSignal(W,B,$,V,J);j4(this.sock,B4(q),Date.now()+L).catch((w)=>{let O=this.pending.get(B);if(O)this.rejectPending(B,O,w instanceof Error?w:new Z$(String(w)))})})}arbitrateTimeout($,Z,J,X,Y){let G=()=>{if(Z.onLateResponse)this.lateResponses.set($,Z.onLateResponse);this.rejectPending($,Z,new Z$(this.timeoutMessage(J,X,Y),JX))},z=Date.now()+this.opts.timeoutArbitrationGraceMs,Q=()=>{if(this.pending.get($)!==Z)return;if((this.readerActive||this.sock.bufferedBytes()>0)&&Date.now()<z){setImmediate(Q);return}G()};setImmediate(Q)}async managedRequest($,Z,J){let X=J.binary??!1,Y=X?i0(Z):Z instanceof Uint8Array?Z:this.encode(Z),G=J.priority??w$.Interactive,z=J.admissionClass??b$.Normal;try{let Q=await this.sendManaged($,Y,G,z,J.timeoutMs,J.onProgress,X,J.signal);return this.decodeReply(Q)}catch(Q){if(Q instanceof S$)throw Q;throw this.terminalCallError("managed call failed",Q)}}sendManaged($,Z,J,X,Y,G,z=!1,Q){try{this.assertLiveHandle($)}catch(H){return Promise.reject(this.notSentCallError("request used a stale route handle",H))}if(this.closedErr)return Promise.reject(this.notSentCallError("request was not sent because the subc connection was already closed",this.closedErr));let K;try{K=this.allocateCorr()}catch(H){return Promise.reject(this.notSentCallError("request correlation allocator was exhausted",H))}let W=H7($,K),V=h$(u.Request,u$(z,J,!1,X),$.channel,$.epoch,K,Z),B=!1,j=(H)=>{if(!B)return this.notSentCallError("request bytes were not queued to the subc socket",H);if(H instanceof Z$&&H.code===JX)return new S$("outcome_unknown",`managed call deadline exceeded after request bytes were queued to the local socket; no terminal response was observed; outcome unknown${t8(H)}`,l0,H);return this.outcomeUnknownCallError("connection dropped before the managed call returned a response",H)};return new Promise((H,q)=>{let N=Y??z8,U={handle:$,resolve:H,reject:q,onProgress:G,timer:null,classifyFailure:j};if(U.timer=setTimeout(()=>this.arbitrateTimeout(W,U,$.channel,K,N),N),this.pending.set(W,U),Q)this.attachCancelSignal(Q,W,$,K,J);let L=g0(this.sock,B4(V),Date.now()+N);B=L.queued,L.completed.catch((D)=>{let w=this.pending.get(W);if(w)this.rejectPending(W,w,D instanceof Error?D:new Z$(String(D)))})})}async cachedRouteHandle($,Z){let J=Z.identity??this.opts.identity;if(!J)throw new S$("terminal","managed call requires a BindIdentity in SubcClient.connect({ identity }) or call(..., { identity })","missing_identity");let X={kind:Z.targetKind??this.opts.targetKind,module_id:$},Y=d0(Z),G=Z.reverseRequests??new e4;G.seal();let z=GX(X,J,Y,G.capabilities()),Q=this.routes.get(z);if(!Q)Q={key:z,moduleId:$,target:X,identity:J,consumerIdentity:Y,reverseRequests:G,handle:null,opening:null},this.routes.set(z,Q);if(Q.handle&&this.isLiveHandle(Q.handle))return Q.handle;if(!Q.opening)Q.opening=this.openCachedRoute(Q).finally(()=>{Q.opening=null});return Q.opening}async openCachedRoute($){let Z=Date.now()+this.opts.routeOpenRetryDeadlineMs,J=this.opts.reconnectBackoff.baseMs,X=0;for(;;){if($.closed)throw this.routeClosedDuringOpen();try{await this.ensureConnectedForManaged()}catch(Y){throw this.notSentRecoveryError("route.open could not run because reconnect failed",Y)}if($.handle&&this.isLiveHandle($.handle))return $.handle;try{let Y=await this.routeOpen($.target,$.identity,{consumerIdentity:$.consumerIdentity??null,reverseRequests:$.reverseRequests});if($.closed)throw this.liveRoutes.delete(Y.channel),this.sendRouteGoodbye(Y),this.routeClosedDuringOpen();return $.handle=Y,Y}catch(Y){if(Y instanceof S$&&Y.code==="route_closed")throw Y;if(!this.closeStarted&&L7(Y)){try{await this.reconnectAfterDrop(Y)}catch(G){throw this.notSentRecoveryError("route.open was not sent and reconnect failed",G)}continue}if(!this.closeStarted&&Y instanceof Z$&&fW(Y.code)){if(X+=1,Date.now()<Z){await this.opts.sleep(J),J=Math.min(J*2,this.opts.reconnectBackoff.capMs);continue}throw this.notSentCallError(`route.open failed for module ${$.moduleId}: ${Y.code} (retry deadline exhausted after ${X} attempts)`,Y)}throw this.terminalCallError(`route.open failed for module ${$.moduleId}`,Y)}}}lastInboundAtMs=0;livenessProbe=null;hasControlPending(){for(let $ of this.pending.values())if($.handle===null)return!0;return!1}probeLivenessAfterDeadline(){if(this.livenessProbe||this.closeStarted||this.closedErr)return;if(this.hasControlPending())return;let $=this.sock,Z=this.generation,J;try{J=this.allocateCorr()}catch{return}let X=Date.now(),Y=h$(u.Ping,u$(!1,w$.Interactive,!1,b$.Normal),0,0,J,new Uint8Array),G=(async()=>{if(await j4($,B4(Y),X+this.opts.livenessProbeWindowMs).catch(()=>{}),await this.opts.sleep(this.opts.livenessProbeWindowMs),this.sock!==$||this.generation!==Z||this.closeStarted)return;if(this.lastInboundAtMs>=X)return;if(this.hasControlPending())return;this.fail(new g4(`liveness probe convicted a half-open socket: no inbound frame for ${this.opts.livenessProbeWindowMs}ms after a channel-0 Ping (deadline-no-drop settles preceded this); closing so the next call reconnects`)),$.close()})().finally(()=>{this.livenessProbe=null});this.livenessProbe=G}async ensureConnectedForManaged(){if(this.closeStarted)throw new Z$("client closed");if(this.reconnecting)await this.reconnecting;if(this.closedErr)await this.reconnectAfterDrop(this.closedErr)}scheduleReconnectAfterDrop($){if(this.closeStarted||this.reconnecting)return;this.reconnectAfterDrop($).catch(()=>{})}reconnectAfterDrop($){if(this.closeStarted)return Promise.reject(new Z$("client closed"));if(this.reconnecting)return this.reconnecting;let Z=this.reconnectWithRetry($).finally(()=>{if(this.reconnecting===Z)this.reconnecting=null});return this.reconnecting=Z,Z}async reconnectWithRetry($){let Z=0,J=this.opts.reconnectBackoff.baseMs;for(;;){if(this.closeStarted)throw new Z$("client closed");Z+=1;try{let X=await A6.openConnection(this.opts);if(this.closeStarted)throw X.sock.close(),new Z$("client closed");this.replaceConnection(X),await this.reopenCachedRoutes();return}catch(X){if(!L7(X)||Z>=this.opts.reconnectBackoff.maxAttempts){if(X instanceof m$&&Z>1)throw new m$(`reconnect gave up after ${Z} attempts: ${X.message} — the connection file and the daemon's key disagree persistently `+"(daemon restarting in a loop, split connection-file paths, or a genuinely foreign daemon on this port); check the daemon, then restart this host app");throw X}await this.opts.sleep(J),J=Math.min(J*2,this.opts.reconnectBackoff.capMs)}}}replaceConnection($){this.fail(new Z$("subc connection replaced")),this.sock.close(),this.sock=$.sock,this.currentConn=$.conn,this.closedErr=null,this.generation+=1,this.connectionToken=G8(),this.liveRoutes.clear(),this.lateResponses.clear(),this.nextCorr=1n,this.readLoop($.sock,this.generation)}async reopenCachedRoutes(){let $=[...this.routes.keys()];for(let Z of $){let J=this.routes.get(Z);if(J)J.handle=null}for(let Z of $){let J=this.routes.get(Z);if(!J||J.closed)continue;try{let X=await this.routeOpen(J.target,J.identity,{consumerIdentity:J.consumerIdentity??null,reverseRequests:J.reverseRequests});if(J.closed){this.liveRoutes.delete(X.channel),this.sendRouteGoodbye(X);continue}J.handle=X}catch(X){if(vW(X)){this.routes.delete(Z);continue}throw X}}}timeoutMessage($,Z,J){let X=this.sock.localPort();return`request on ${X===null?"channel":`local_port=${X} channel`} ${$} corr ${Z} timed out after ${J}ms`}routeClosedDuringOpen(){return new S$("not_sent","route was closed before route.open completed","route_closed")}async readLoop($,Z){try{for(;;){this.readerActive=!1;let J=await $.readFrame(Number.POSITIVE_INFINITY,{afterHeaderMs:SW},()=>{this.readerActive=!0});try{if(this.sock===$&&this.generation===Z)this.dispatch(J)}finally{this.readerActive=!1}}}catch(J){if(this.sock===$&&this.generation===Z)this.fail(J instanceof Error?J:new Z$(String(J)))}}dispatch($){if(this.lastInboundAtMs=Date.now(),$.header.channel===0&&$.header.ty===u.Push){let G=this.opts.onControlPush;if(G){let z=null;try{let Q=this.parseJson($);if(Q&&typeof Q.op==="string")z={op:Q.op,body:Q}}catch{}if(z)try{G(z)}catch{}}return}let Z=null;if($.header.channel!==0){if(Z=this.liveRoutes.get($.header.channel)??null,!Z||Z.epoch!==$.header.epoch){this.ingressEpochDropCount+=1;return}}if($.header.ty===u.Request&&Z){this.dispatchReverseRequest($,Z);return}let J=H7(Z,$.header.corr),X=this.pending.get(J);if(X){if(X.acceptFrame&&!X.acceptFrame($))return;switch($.header.ty){case u.Push:case u.StreamData:try{X.onProgress?.($.body)}catch{}return;case u.Response:case u.StreamEnd:this.settle(J,X,()=>X.resolve($));return;case u.Error:this.settle(J,X,()=>X.reject(this.errorFromFrame($)));return;default:return}}let Y=this.lateResponses.get(J);if(Y&&($.header.ty===u.Response||$.header.ty===u.Error)){this.lateResponses.delete(J),Y($);return}if($.header.ty===u.Goodbye&&Z){if(this.failHandle(Z,new Z$("route closed by subc (GOODBYE)","route_closed")),this.liveRoutes.get(Z.channel)===Z)this.liveRoutes.delete(Z.channel);this.evictRouteHandle(Z);return}if($.header.ty===u.Response||$.header.ty===u.Error||$.header.ty===u.StreamEnd)ZX("dropped terminal frame with no waiter: type=%d channel=%d epoch=%d corr=%s port=%s",$.header.ty,$.header.channel,$.header.epoch,$.header.corr,this.sock.localPort()??"?")}settle($,Z,J){if(this.pending.get($)!==Z)return!1;if(this.pending.delete($),Z.timer)clearTimeout(Z.timer);return J(),Z.onSettle?.(),!0}rejectPending($,Z,J){this.settle($,Z,()=>Z.reject(Z.classifyFailure?.(J)??J))}dispatchReverseRequest($,Z){let J=bW($.body),X=J?.split("/",1)[0],Y=X?$X(Z,X):void 0,G=this.sock,z=this.generation;(async()=>{if(!Y||!J){await this.sendReverseError($,Z,"reverse_request_unhandled",X?`no reverse-request handler is registered for ${X}`:"reverse request has no valid method",G,z);return}let K;try{if(K=await Y($.body,{corr:$.header.corr,method:J}),!(K instanceof Uint8Array))throw TypeError("reverse-request handler must return a Uint8Array")}catch(W){await this.sendReverseError($,Z,"reverse_request_unhandled",W instanceof Error?W.message:String(W),G,z);return}await this.sendReverseReply($,Z,u.Response,K,G,z)})().catch((K)=>{if(this.sock===G&&this.generation===z&&!this.closeStarted)ZX("failed to answer reverse request: %s",t8(K))})}async sendReverseError($,Z,J,X,Y,G){await this.sendReverseReply($,Z,u.Error,this.encode({code:J,message:X}),Y,G)}async sendReverseReply($,Z,J,X,Y,G){if(this.sock!==Y||this.generation!==G||!this.isLiveHandle(Z)||this.closeStarted||this.closedErr)return;let z=h$(J,u$(!1,w$.Interactive,!1),Z.channel,Z.epoch,$.header.corr,X);await j4(Y,B4(z),Date.now()+z8)}errorFromFrame($){try{let Z=JSON.parse(Buffer.from($.body).toString("utf8")),J=new Z$(Z.message??"subc error",Z.code,Z.detail);return YX.set(J,$.header.flags),J}catch{return new Z$(Buffer.from($.body).toString("utf8")||"subc error")}}evictRouteHandle($){for(let Z of this.routes.values())if(Z.handle&&j7(Z.handle,$))Z.handle=null}failHandle($,Z){for(let[J,X]of this.pending)if(X.handle&&j7(X.handle,$))this.rejectPending(J,X,Z)}fail($){if(!this.closedErr)this.closedErr=$;for(let[Z,J]of this.pending)this.rejectPending(Z,J,$)}notSentCallError($,Z){return new S$("not_sent",`${$}${t8(Z)}`,U7(Z),Z)}outcomeUnknownCallError($,Z){return new S$("outcome_unknown",`${$}${t8(Z)}`,U7(Z),Z)}terminalCallError($,Z){if(Z instanceof S$)return Z;return new S$("terminal",`${$}${t8(Z)}`,U7(Z),Z)}notSentRecoveryError($,Z){if(Z instanceof S$)return Z;if(L7(Z))return this.notSentCallError($,Z);return this.terminalCallError($,Z)}get droppedIngressFrames(){return this.ingressEpochDropCount}installRoute($,Z,J=new e4){let X=q7($,Z,this.connectionToken,J);return this.liveRoutes.set($,X),X}isLiveHandle($){return s8($,this.connectionToken)&&this.liveRoutes.get($.channel)===$}assertLiveConnection($){if(!s8($,this.connectionToken))throw new y4($)}assertLiveHandle($){if(!this.isLiveHandle($))throw new y4($)}allocateCorr(){let $=0xffffffffffffffffn;if(this.nextCorr>$){let J=new Z$("channel-0 correlation id allocator exhausted","corr_exhausted");throw this.fail(J),this.sock.close(),this.scheduleReconnectAfterDrop(J),J}let Z=this.nextCorr;return this.nextCorr+=1n,Z}closeConnectionAfterCleanupFailure(){let $=new Z$("late route cleanup could not be queued","late_route_cleanup_failed");this.fail($),this.sock.close(),this.scheduleReconnectAfterDrop($)}encode($){return Buffer.from(JSON.stringify($),"utf8")}decodeReply($){return b0($.header.flags)?$.body:this.parseJson($)}parseJson($){let Z=$.body;return JSON.parse(Buffer.from(Z.buffer,Z.byteOffset,Z.byteLength).toString("utf8"))}}function L7($){if($ instanceof g4||$ instanceof q4)return!0;if($ instanceof _4||$ instanceof r4)return!0;if($ instanceof S$)return $.kind==="not_sent"||$.kind==="outcome_unknown";if($ instanceof m$)return!0;if($ instanceof Z$||$ instanceof C$)return!1;let Z=U7($);return Z==="ECONNREFUSED"||Z==="ECONNRESET"||Z==="EPIPE"||Z==="ETIMEDOUT"||Z==="ENOENT"}function vW($){return $ instanceof Z$&&typeof $.code==="string"}function fW($){if($==="capability_forbidden")return!1;return $==="module_reloading"||$==="module_warming"||$==="target_unavailable"||$==="module_timeout"}var zX="unknown_channel",QX="stale_route_epoch";function O7($,Z){return Z===zX||Z===QX}function EW($){return{connectionFile:$.connectionFile,handshakeTimeoutMs:$.handshakeTimeoutMs,identity:$.identity,targetKind:$.targetKind??kW,reconnectBackoff:$.reconnectBackoff??D7,sleep:$.sleep??((Z)=>new Promise((J)=>setTimeout(J,Z))),routeOpenRetryDeadlineMs:$.routeOpenRetryDeadlineMs??CW,timeoutArbitrationGraceMs:$.timeoutArbitrationGraceMs??TW,livenessProbeWindowMs:$.livenessProbeWindowMs??FW,onControlPush:$.onControlPush}}function KX($){if(/\s/u.test($))return!1;let Z=$.indexOf("/v");if(Z<=0||$.indexOf("/v",Z+1)!==-1)return!1;let J=$.slice(0,Z),X=$.slice(Z+2);if(new TextEncoder().encode(J).byteLength>64||X.length===0)return!1;if(!/^[a-z][a-z0-9-]*[a-z0-9]$/u.test(J)&&!/^[a-z]$/u.test(J))return!1;if(J.includes("--"))return!1;if(!/^\d+$/u.test(X)||X.length>1&&X.startsWith("0"))return!1;let Y=Number(X);return Number.isSafeInteger(Y)&&Y>=1&&Y<=4294967295}function GX($,Z,J,X){let Y=J?`${J.module_id}\x00${J.launch_nonce}`:"",G=[...X].sort().join("\x00");return`${$.kind}\x00${$.module_id}\x00${Z.project_root}\x00${Z.harness}\x00${Z.session}\x00${Y}\x00${G}`}function d0($={}){if($.consumerIdentity!==void 0)return $.consumerIdentity??void 0;let Z=process.env[N7],J=process.env[x7];if(!Z||!J)return;return{module_id:Z,launch_nonce:J}}function U7($){if(typeof $==="object"&&$!==null&&"code"in $){let Z=$.code;if(typeof Z==="string")return Z}return}function t8($){if($===void 0)return"";return`: ${$ instanceof Error?$.message:String($)}`}function H7($,Z){return $?`${$.channel}:${$.epoch}:${Z}`:`0:0:${Z}`}function bW($){try{let Z=JSON.parse(Buffer.from($).toString("utf8"));return typeof Z.method==="string"&&Z.method.length>0?Z.method:void 0}catch{return}}import{Buffer as r0}from"node:buffer";var hW=1e4,gW=30000,VX=30000,yW=250,s0=64,n0="health.check",BX=1n,uW=/^[0-9a-f]{32}$/;function o0($){let Z=$.machine_id;return typeof Z==="string"&&uW.test(Z)?Z:void 0}class M7{available;waiters=[];constructor($){if(!Number.isInteger($)||$<=0)throw new W$("provider handler capacity must be a positive integer","invalid_handler_capacity");this.available=$}async acquire(){if(this.available>0)return this.available-=1,this.releaseOnce();return await new Promise(($)=>{this.waiters.push($)}),this.releaseOnce()}releaseOnce(){let $=!1;return()=>{if($)return;$=!0;let Z=this.waiters.shift();if(Z)Z();else this.available+=1}}}class W$ extends Error{code;kind;detail;constructor($,Z,J="terminal",X){super($);this.code=Z,this.kind=J,this.detail=X}}class a8{sock;currentConn;opts;closed;resolveClosed=()=>{return};closeStarted=!1;closedErr=null;inflight=new Map;pending=new Map;liveRoutes=new Map;connectionToken=G8();nextCorr=1n;ingressEpochDropCount=0;requestGate=new M7(s0);reconnecting=null;generation=1;connectionEpoch=1;stateQueue=[];drainingStateQueue=!1;restoredDebounceToken=0;storage;machineId;constructor($,Z,J,X){this.sock=$,this.currentConn=Z,this.opts=J,this.storage=X.storage,this.machineId=o0(X),this.closed=new Promise((Y)=>{this.resolveClosed=Y}),this.readLoop($,this.generation),this.enqueueConnectionState({state:"connected",epoch:this.connectionEpoch})}get droppedIngressFrames(){return this.ingressEpochDropCount}get conn(){return this.currentConn}currentEpoch(){return this.connectionEpoch}async request($,Z,J={}){this.assertLiveHandle($);let X=this.allocateCorr(),Y=I7($,X),G=J.timeoutMs??VX,z=h$(u.Request,u$(!1,J.priority??w$.Interactive,!1,J.admissionClass??b$.Normal),$.channel,$.epoch,X,Z);return await new Promise((Q,K)=>{let W=setTimeout(()=>{if(this.pending.delete(Y))K(new W$("reverse request timed out","request_timeout"))},G);this.pending.set(Y,{resolve:(V)=>Q(V.body),reject:K,timer:W}),this.sendOn(this.sock,this.generation,z).catch((V)=>{let B=this.pending.get(Y);if(!B)return;this.pending.delete(Y),clearTimeout(B.timer),K(V instanceof Error?V:new W$(String(V)))})})}async push($,Z,J={}){this.assertLiveHandle($),await this.sendOn(this.sock,this.generation,h$(u.Push,u$(!1,J.priority??w$.Interactive,!1,J.admissionClass??b$.Normal),$.channel,$.epoch,0n,Z))}cancel($,Z){this.assertLiveHandle($),this.sendOn(this.sock,this.generation,h$(u.Cancel,w4(),$.channel,$.epoch,Z,new Uint8Array(0))).catch(()=>{return})}closeRoute($){this.assertLiveHandle($),this.liveRoutes.delete($.channel),this.abortHandle($),this.sendOn(this.sock,this.generation,h$(u.Goodbye,w4(),$.channel,$.epoch,0n,new Uint8Array(0))).catch(()=>{return})}static async connect($){if($.manifest.protocol_ver!==a$)throw new W$(`manifest protocol_ver ${$.manifest.protocol_ver} does not match client protocol ${a$}`,"invalid_manifest");let Z=pW($),J=await a8.openConnection(Z);return new a8(J.sock,J.conn,Z,J.ack)}async close(){if(!this.closeStarted){this.closeStarted=!0,this.cancelRestoredDebounce();let $=this.sock;try{await a0($,h$(u.Goodbye,w4(),0,0,0n,new Uint8Array(0)))}catch{}finally{$.close(),this.finishClosed()}}await this.closed}static async openConnection($,Z){let J=await Y8($.connectionFile),X=Date.now()+($.handshakeTimeoutMs??hW),Y=J.endpoints[0],G=await w6.connect(Y.host,Y.port,X);try{Z?.(G),await d8(G,J,X),await a0(G,lW($));let z=await tW(G,X);return{sock:G,conn:J,ack:z}}catch(z){throw G.close(),z}}async readLoop($,Z){try{for(;;){let J=await $.readFrame(Number.POSITIVE_INFINITY,{afterHeaderMs:gW});if(!await this.dispatch(J,$,Z)){if(this.sock===$&&this.generation===Z)this.closeStarted=!0;break}}}catch(J){if(this.sock===$&&this.generation===Z&&!this.closeStarted){this.handleUnexpectedDrop($,Z,J instanceof Error?J:new W$(String(J)));return}}finally{if(this.sock===$&&this.generation===Z){if($.close(),this.closeStarted)this.finishClosed()}}}async dispatch($,Z,J){let X=null;if($.header.channel!==0){if(X=this.liveRoutes.get($.header.channel)??null,!X||X.epoch!==$.header.epoch)return this.ingressEpochDropCount+=1,!0}if(X){let Y=I7(X,$.header.corr),G=this.pending.get(Y);if(G){if($.header.ty===u.Push||$.header.ty===u.StreamData)return!0;if($.header.ty===u.Response||$.header.ty===u.StreamEnd)return this.pending.delete(Y),clearTimeout(G.timer),G.resolve($),!0;if($.header.ty===u.Error)return this.pending.delete(Y),clearTimeout(G.timer),G.reject(mW($)),!0}}switch($.header.ty){case u.Ping:if($.header.channel===0)await this.sendOn(Z,J,P4($.header.ver,u.Pong,$.header.flags,0,0,$.header.corr,new Uint8Array(0)));return!0;case u.Goodbye:if(!X)return!1;return this.liveRoutes.delete(X.channel),this.abortHandle(X),await this.reportRouteGone(X),!0;case u.Cancel:if(X)this.inflight.get(I7(X,$.header.corr))?.abort();return!0;case u.Request:if($.header.channel===0)await this.handleControlRequest($,Z,J);else if(X)this.handleDataRequest($,X,Z,J).catch((Y)=>{if(!this.closeStarted&&this.sock===Z&&this.generation===J)console.warn("SubcProvider handler failed after its request was dispatched",Y)});return!0;default:return!0}}async reportRouteBound($){if(!this.opts.onBound)return;try{await this.opts.onBound($)}catch(Z){console.warn("SubcProvider bound callback failed",Z)}}async reportRouteGone($){if(!this.opts.onRouteGone)return;try{await this.opts.onRouteGone($)}catch(Z){console.warn("SubcProvider route-gone callback failed",Z)}}abortHandle($){let Z=`${$.channel}:${$.epoch}:`;for(let[J,X]of this.inflight)if(J.startsWith(Z))X.abort();for(let[J,X]of this.pending){if(!J.startsWith(Z))continue;this.pending.delete(J),clearTimeout(X.timer),X.reject(new y4($))}}abortGeneration($){this.abortAllInflight();for(let[Z,J]of this.pending)this.pending.delete(Z),clearTimeout(J.timer),J.reject(new W$("provider connection dropped","connection_dropped"));this.liveRoutes.clear()}abortAllInflight(){for(let $ of this.inflight.values())$.abort()}async handleControlRequest($,Z,J){let X=_7($.body);if(X.op===n0){this.handleHealthRequest($,Z,J).catch((B)=>{if(!this.closeStarted&&this.sock===Z&&this.generation===J)console.warn("SubcProvider health handler failed after its request was dispatched",B)});return}if(X.op!=="route.bind")throw new W$(`unsupported module control request ${X.op??"<missing op>"}`);let Y=WX(X.route_channel,"route_channel"),G=WX(X.epoch,"epoch"),z=this.liveRoutes.get(Y);if(z){if(G<=z.epoch){await this.sendError($,"route_rejected",`route.bind epoch ${G} does not supersede installed epoch ${z.epoch} on channel ${Y}`,w4(),Z,J);return}this.liveRoutes.delete(z.channel),this.abortHandle(z),await this.reportRouteGone(z)}let Q=q7(Y,G,this.connectionToken),K={handle:Q,target:X.target,identity:X.identity,principal:X.principal,consumer_capabilities:X.consumer_capabilities},W;try{W=await this.opts.onBind?.(K)}catch(B){try{await this.sendError($,"route_rejected",B instanceof Error?B.message:String(B),w4(),Z,J)}finally{await this.reportRouteGone(Q)}return}let V=aW(W);if(V){try{await this.sendError($,V.code,V.message,w4(),Z,J)}finally{await this.reportRouteGone(Q)}return}try{await this.sendOn(Z,J,P4($.header.ver,u.Response,w4(),0,0,$.header.corr,P7({op:"route.bind"})))}catch(B){throw await this.reportRouteGone(Q),B}if(this.sock!==Z||this.generation!==J||this.closeStarted||this.closedErr){await this.reportRouteGone(Q);return}this.liveRoutes.set(Q.channel,Q),await this.reportRouteBound(Q)}async handleDataRequest($,Z,J,X){let{corr:Y,ver:G}=$.header,z=I7(Z,Y),Q=new AbortController;this.inflight.set(z,Q);let K={handle:Z,signal:Q.signal,currentEpoch:()=>this.connectionEpoch,emit:async(B,j={})=>{if(this.assertLiveHandle(Z),Q.signal.aborted)return;await this.sendOn(J,X,P4(G,u.StreamData,u$(!1,j.priority??w$.Interactive,!1,j.admissionClass??b$.Normal),Z.channel,Z.epoch,Y,B))}},W=await(this.requestGate??new M7(s0)).acquire(),V=u$(!1,w$.Interactive,!1);try{if(Q.signal.aborted){await this.sendError($,"cancelled","request cancelled",V,J,X);return}let B=await this.opts.handler(Z,$.body,K);if(Q.signal.aborted){await this.sendError($,"cancelled","request cancelled",V,J,X);return}if(this.assertLiveHandle(Z),B===void 0)await this.sendOn(J,X,P4(G,u.StreamEnd,V,Z.channel,Z.epoch,Y,new Uint8Array(0)));else if(B instanceof Uint8Array)await this.sendOn(J,X,P4(G,u.Response,V,Z.channel,Z.epoch,Y,B));else throw new W$("provider handler must return a Uint8Array or void","invalid_handler_response")}catch(B){if(B instanceof y4)return;if(Q.signal.aborted){await this.sendError($,"cancelled","request cancelled",V,J,X);return}await this.sendError($,B instanceof W$&&B.code?B.code:"handler_error",B instanceof Error?B.message:String(B),V,J,X)}finally{if(W(),this.inflight.get(z)===Q)this.inflight.delete(z)}}async handleHealthRequest($,Z,J){let{corr:X,ver:Y}=$.header,G=`control:${J}:${X}`,z=new AbortController;this.inflight.set(G,z);let Q=await(this.requestGate??new M7(s0)).acquire();try{if(z.signal.aborted)return;let K=await this.opts.health();await this.sendOn(Z,J,P4(Y,u.Response,w4(),0,0,X,P7({op:n0,status:K.status,...K.detail===void 0?{}:{detail:K.detail},...K.metrics===void 0?{}:{metrics:K.metrics}})))}catch(K){await this.sendError($,K instanceof W$&&K.code?K.code:"health_error",K instanceof Error?K.message:String(K),w4(),Z,J)}finally{if(Q(),this.inflight.get(G)===z)this.inflight.delete(G)}}async sendError($,Z,J,X,Y,G){if($.header.channel!==0){let z=this.liveRoutes.get($.header.channel);if(!z||z.epoch!==$.header.epoch||!this.isLiveHandle(z))return}await this.sendOn(Y,G,P4($.header.ver,u.Error,X,$.header.channel,$.header.epoch,$.header.corr,P7({code:Z,message:J})))}async sendOn($,Z,J){if(this.sock!==$||this.generation!==Z||this.closeStarted||this.closedErr)return;await a0($,J)}handleUnexpectedDrop($,Z,J){if(this.closeStarted||this.sock!==$||this.generation!==Z)return;if(!this.opts.reconnectOnDrop){this.failFatal(J);return}this.cancelRestoredDebounce(),this.abortGeneration(Z),this.generation+=1,$.close(),this.scheduleReconnectAfterDrop(J,this.generation,$)}scheduleReconnectAfterDrop($,Z,J){if(this.closeStarted)return;let X=this.reconnecting;if(X){if(!this.shouldSupersedeReconnect(X,Z,J))return;X.superseded=!0,X.socket?.close()}let Y={generation:Z,socket:null,socketDied:!1,superseded:!1};this.reconnecting=Y,this.enqueueConnectionState({state:"down",cause:$}),this.reconnectWithRetry(Y).catch((G)=>{if(this.isCurrentReconnect(Y)&&!this.closeStarted)this.failFatal(G instanceof Error?G:new W$(String(G)))}).finally(()=>{if(this.isCurrentReconnect(Y))this.reconnecting=null})}async reconnectWithRetry($){let Z=0,J=this.opts.reconnectBackoff.baseMs;for(;;){if(!this.isCurrentReconnect($))return;if(this.closeStarted)throw new W$("provider closed");$.socket=null,$.socketDied=!1,Z+=1,this.enqueueReconnectState($,Z);try{let X=await a8.openConnection(this.opts,(G)=>{if(!this.isCurrentReconnect($)){G.close();return}$.socket=G});if(!this.isCurrentReconnect($)||this.closeStarted){if(X.sock.close(),this.closeStarted)throw new W$("provider closed");return}let Y=this.replaceConnection(X,$.generation);if(this.reconnecting=null,this.reconnecting!==null)throw new W$("reconnect state must clear before restored","reconnect_state");this.scheduleRestored($.generation,Y);return}catch(X){if(!this.isCurrentReconnect($))return;if($.socket)$.socketDied=!0;if(this.closeStarted)throw X;if(!iW(X))throw X;await this.opts.sleep(J),J=Math.min(J*2,this.opts.reconnectBackoff.capMs)}}}isCurrentReconnect($){return!$.superseded&&this.reconnecting===$&&this.generation===$.generation}shouldSupersedeReconnect($,Z,J){return $.generation<Z||$.socketDied||$.socket===J}enqueueReconnectState($,Z){if(!this.isCurrentReconnect($))return;this.enqueueConnectionState({state:"reconnecting",attempt:Z},$.generation,$)}replaceConnection($,Z){return this.sock.close(),this.sock=$.sock,this.currentConn=$.conn,this.storage=$.ack.storage,this.machineId=o0($.ack),this.closedErr=null,this.connectionEpoch+=1,this.connectionToken=G8(),this.liveRoutes.clear(),this.nextCorr=1n,this.readLoop($.sock,Z),this.connectionEpoch}scheduleRestored($,Z){if(!this.opts.onConnectionState)return;let J=++this.restoredDebounceToken;this.opts.sleep(this.opts.restoredDebounceMs).then(()=>{if(J===this.restoredDebounceToken&&!this.closeStarted&&this.sock&&this.generation===$&&this.connectionEpoch===Z)this.enqueueConnectionState({state:"restored",epoch:Z},$)}).catch((X)=>{if(J===this.restoredDebounceToken&&!this.closeStarted)console.warn("SubcProvider restored debounce timer failed",X)})}cancelRestoredDebounce(){this.restoredDebounceToken+=1}enqueueConnectionState($,Z,J){if(!this.opts.onConnectionState)return;if(this.stateQueue.push({event:$,generation:Z,reconnect:J}),!this.drainingStateQueue)this.drainConnectionStateQueue()}async drainConnectionStateQueue(){if(this.drainingStateQueue)return;this.drainingStateQueue=!0;try{while(this.stateQueue.length>0){let $=this.stateQueue[0];if(this.closeStarted||$.generation!==void 0&&$.generation!==this.generation||$.reconnect?.superseded){this.stateQueue.shift();continue}let{event:Z}=$;try{await this.opts.onConnectionState?.(Z),this.stateQueue.shift()}catch(J){if(Z.state==="restored"){console.warn("SubcProvider restored callback failed; retrying delivery",J),await sW();continue}console.warn("SubcProvider connection-state callback failed",J),this.stateQueue.shift()}}}finally{if(this.drainingStateQueue=!1,this.stateQueue.length>0)this.drainConnectionStateQueue()}}isLiveHandle($){return s8($,this.connectionToken)&&this.liveRoutes.get($.channel)===$}assertLiveHandle($){if(!this.isLiveHandle($))throw new y4($)}allocateCorr(){let $=0xffffffffffffffffn;if(this.nextCorr>$){let J=new W$("channel-0 correlation id allocator exhausted","corr_exhausted");throw this.handleUnexpectedDrop(this.sock,this.generation,J),J}let Z=this.nextCorr;return this.nextCorr+=1n,Z}failFatal($){if(!this.closedErr)this.closedErr=$;this.closeStarted=!0,this.cancelRestoredDebounce(),this.abortAllInflight(),this.sock.close(),this.finishClosed()}finishClosed(){this.resolveClosed()}}function I7($,Z){return`${$.channel}:${$.epoch}:${Z}`}function mW($){try{let Z=_7($.body);return new W$(Z.message??"subc error",Z.code,O7($.header.flags,Z.code)?"not_sent":"terminal",Z.detail)}catch{return new W$(r0.from($.body).toString("utf8")||"subc error")}}function t0($){return $&&$.length>0?$:void 0}function pW($){let Z=t0(process.env[N7]),J=t0(process.env[x7]),X=Z!==void 0&&J!==void 0;return{connectionFile:$.connectionFile,manifest:$.manifest,handler:$.handler,health:$.health??(()=>({status:"ok"})),handshakeTimeoutMs:$.handshakeTimeoutMs,controlOps:$.controlOps,onBind:$.onBind,onBound:$.onBound,onRouteGone:$.onRouteGone,reconnectBackoff:$.reconnectBackoff??D7,sleep:$.sleep??((Y)=>new Promise((G)=>setTimeout(G,Y))),restoredDebounceMs:$.restoredDebounceMs??yW,onConnectionState:$.onConnectionState,launchNonce:t0($.launchNonce??J),reconnectOnDrop:$.reconnectOnDrop??!X}}function cW($){if($===null)return null;let Z=new Set($??[]);return Z.add(n0),[...Z]}function lW($){let Z=$.launchNonce;return h$(u.Hello,w4(),0,0,BX,P7({manifest:nW($.manifest),protocol_ver:a$,control_ops:cW($.controlOps),...Z?{launch_nonce:Z}:{}}))}function iW($){if($ instanceof W$)return $.code==="duplicate_module_id";if($ instanceof g4||$ instanceof q4)return!0;if($ instanceof _4||$ instanceof r4)return!0;if($ instanceof m$)return!0;if($ instanceof C$)return!1;let Z=dW($);return Z==="ECONNREFUSED"||Z==="ECONNRESET"||Z==="EPIPE"||Z==="ETIMEDOUT"||Z==="ENOENT"}function dW($){if(typeof $==="object"&&$!==null&&"code"in $){let Z=$.code;if(typeof Z==="string")return Z}return}async function sW(){await new Promise(($)=>setTimeout($,0))}function w4(){return u$(!1,w$.Passive,!1)}async function a0($,Z){await j4($,B4(Z),Date.now()+VX)}async function tW($,Z){let J=await $.readFrame(Z,Z);switch(J.header.ty){case u.HelloAck:{let X=_7(J.body);if(X.negotiated_ver!==a$)throw new W$(`subc negotiated protocol ${X.negotiated_ver}; expected exactly ${a$}`,"unsupported_version");return X}case u.Error:{let X=_7(J.body);throw new W$(`subc rejected HELLO: ${X.code??"unknown"} — ${X.message??"subc error"}`,X.code)}default:throw new W$(`unexpected frame ${u[J.header.ty]} awaiting HELLO_ACK`)}}function P7($){return new Uint8Array(r0.from(JSON.stringify($),"utf8"))}function _7($){return JSON.parse(r0.from($).toString("utf8"))}function WX($,Z){if(typeof $!=="number"||!Number.isInteger($))throw new W$(`route.bind ${Z} must be an integer`);return $}function aW($){if($===void 0||$===!0)return null;if($===!1)return{code:"route_rejected",message:"route.bind rejected by provider"};if($.accept)return null;return{code:$.code??"route_rejected",message:$.message??"route.bind rejected by provider"}}function nW($){return{module_id:$.module_id,module_version:$.module_version,protocol_ver:$.protocol_ver,trust_tier:$.trust_tier,provides:$.provides.map(oW),consumes:$.consumes.map(rW),bindings:{storage:{kind:$.bindings.storage.kind,scope:$.bindings.storage.scope,owns_schema:$.bindings.storage.owns_schema},vault_grants:$.bindings.vault_grants.map((Z)=>({secret:Z.secret,reason:Z.reason})),identity:{requires:[...$.bindings.identity.requires],optional:[...$.bindings.identity.optional]}}}}function oW($){switch($.role){case"tool_provider":return{role:"tool_provider",tools:$.tools.map((Z)=>({name:Z.name,...Z.description===void 0?{}:{description:Z.description},execution_mode:Z.execution_mode,schema:Z.schema})),identity_scope:[...$.identity_scope],concurrency:$.concurrency,emits_push:$.emits_push,sub_supervises:$.sub_supervises};case"pipeline_stage":return{role:"pipeline_stage",stage:$.stage,applies_to:{provider:$.applies_to.provider,model:$.applies_to.model},interface:$.interface,declares_frozen_floor:$.declares_frozen_floor,needs_signals:[...$.needs_signals],conformance_class:$.conformance_class};case"management_surface":return{role:"management_surface",operations:$.operations.map((Z)=>({name:Z.name,kind:Z.kind})),config_schema:$.config_schema,observability:$.observability.map((Z)=>({name:Z.name,kind:Z.kind})),identity_scope:[...$.identity_scope],concurrency:$.concurrency};case"internal_service":return{role:"internal_service",service_id:$.service_id,transport:$.transport,agent_facing:$.agent_facing,operations:[...$.operations]}}}function rW($){switch($.role){case"tool_client":return{role:"tool_client",of:[...$.of]};case"llm_client":return{role:"llm_client",via:$.via,auth:$.auth};case"service_client":return{role:"service_client",of:[...$.of]}}}var A7="subc-connection.json",jX="subc-",HX=".connection.json";function LX(){let $=process.env.HOME;return $?Q8($,".local","share","cortexkit","run",A7):void 0}function JV(){let $=process.env.XDG_RUNTIME_DIR;if($)return Q8($,A7);let Z=LX();if(Z)return Z;return Q8(ZV().homedir,".local","share","cortexkit","run",A7)}function XV(){if(process.env.SUBC_CONNECTION_FILE)return process.env.SUBC_CONNECTION_FILE;let $=process.env.XDG_RUNTIME_DIR;if($){let Y=Q8($,A7);if(w7(Y))return Y}let Z=LX();if(Z&&w7(Z))return Z;let J=Q8(qX(),`${jX}${YV()}${HX}`);if(w7(J))return J;let X=GV(qX());return X.length===1?X[0]:void 0}function YV($=process.getuid??null,Z=process.env){if($)return String($());for(let J of["USER","USERNAME","HOME","USERPROFILE"]){let X=Z[J];if(X)return Array.from(X,(Y)=>/^[a-zA-Z0-9_-]$/.test(Y)?Y:"_").join("")}return"unknown"}function UX(){return XV()??JV()}function e0($){return $?.trim()||process.env.SUBC_CONNECTION_FILE||process.env.CLAUSTRUM_SUBC_CONNECTION?.trim()||UX()}function w7($){try{return $V($).isFile()}catch{return!1}}function GV($){let Z;try{Z=eW($)}catch{return[]}let J=[];for(let X of Z){if(typeof X!=="string")continue;if(!X.startsWith(jX)||!X.endsWith(HX))continue;let Y=Q8($,X);if(w7(Y))J.push(Y)}return J.sort(),J}import{createHash as zV}from"node:crypto";import{existsSync as QV,realpathSync as NX}from"node:fs";import{dirname as KV,relative as WV,resolve as VV}from"node:path";function xX($){let Z=$,J;try{J=NX(Z)}catch(X){if(X.code!=="ENOENT")throw X;let Y=Z;while(!QV(Y)){let G=KV(Y);if(G===Y)break;Y=G}J=VV(NX(Y),WV(Y,Z))}return zV("sha256").update(J).digest("hex")}function $2($,Z){return{project_root:$,harness:"opencode",session:`store-${xX(Z)}`}}import{AsyncLocalStorage as BV}from"node:async_hooks";import{readFile as DX}from"node:fs/promises";var qV=new BV;function OX($,Z){return $.split(`
+`).filter((J)=>J.trim()!==""&&!J.trimStart().startsWith("#")).map((J)=>{let X=J.split(":");if(X.length!==Z||!X[0]||/\s/.test(X[0])||!/^\d+$/.test(X[2])||!Number.isSafeInteger(Number(X[2]))||Number(X[2])>4294967295||Z===7&&(!/^\d+$/.test(X[3])||!Number.isSafeInteger(Number(X[3]))||Number(X[3])>4294967295))throw Error("malformed account record");if(Z===4&&X[3]!==""&&X[3].split(",").some((Y)=>Y===""||/\s/.test(Y)))throw Error("malformed group members");return X})}async function R7($,Z=qV.getStore()??{euid:process.geteuid?.(),egid:process.getegid?.(),passwdPath:"/etc/passwd",groupPath:"/etc/group"}){if(($.mode&18)===0||($.mode&512)!==0)return!0;if(($.mode&2)!==0||Z.euid===void 0||Z.egid===void 0||$.uid!==Z.euid||$.gid!==Z.egid)return!1;try{let J=OX(new TextDecoder("utf-8",{fatal:!0}).decode(await DX(Z.passwdPath)),7),X=OX(new TextDecoder("utf-8",{fatal:!0}).decode(await DX(Z.groupPath)),4),Y=J.filter((Q)=>Number(Q[2])===Z.euid),G=X.filter((Q)=>Number(Q[2])===Z.egid);if(Y.length!==1||G.length!==1)return!1;let z=Y[0][0];return(G[0][3]===""||G[0][3].split(",").every((Q)=>Q===z))&&!J.some((Q)=>Number(Q[2])!==Z.euid&&Number(Q[3])===Z.egid)}catch{return!1}}import{randomBytes as jV}from"node:crypto";import{chmod as HV,mkdir as LV,open as UV,realpath as NV,rename as xV,stat as DV,unlink as OV}from"node:fs/promises";import{basename as IV,dirname as IX,join as MV}from"node:path";var PV=/^[0-9a-f]{64}$/;function _V($){if(!PV.test($.token))throw Error("enrollment token must be exactly 64 lowercase hex characters");if(!Number.isSafeInteger($.token_generation)||$.token_generation<1)throw Error("enrollment token generation must be a positive safe integer")}async function wV($){let Z;try{Z=await NV($)}catch{return}for(;;){let J=await DV(Z).catch(()=>{return});if(J&&!await R7(J))throw Error(`enrollment token ancestor ${Z} is group- or world-writable without sticky bit`);let X=IX(Z);if(X===Z)return;Z=X}}async function n8($,Z){_V(Z);let J=IX($);await LV(J,{recursive:!0,mode:448}),await wV(J);let X=MV(J,`.${IV($)}.${process.pid}.${jV(12).toString("hex")}.tmp`),Y=!1;try{let G=await UV(X,"wx",384);Y=!0;try{await G.writeFile(`${JSON.stringify(Z)}
+`,"utf8"),await G.sync(),await HV(X,384)}finally{await G.close()}await xV(X,$),Y=!1}finally{if(Y)await OV(X).catch(()=>{return})}}var MX=["transient","permanent","auth_required","context_overflow"];class k$ extends Error{code;action;["class"];constructor($,Z,J){super(`Claustrum credential request failed: ${$}`);this.code=$,this.action=J,this.name="ClaustrumCredentialError",this.class=Z}}function K8($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function PX($){switch($){case"permanent":return"gone";case"auth_required":return"reauth";case"context_overflow":return"reduce_and_retry";case"transient":return"retry"}}function X$($,Z="invalid_response",J=(X)=>console.warn(X)){let X=K8($)&&K8($.result)?$.result:void 0,Y=X&&K8(X.error)?X.error:void 0,G=Y?.class,z=Y?.code,Q=typeof G==="string"&&MX.includes(G),K=typeof z==="string",V=Q&&K?G:"transient";if(typeof G!=="string")J("unknown");else if(!Q)J(G);return new k$(K?z:Z,V,PX(V))}function R6($){return K8($)&&K8($.result)&&K8($.result.error)}var _X="claustrum",TV=60000;function n$($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function J2($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0?$:void 0}function A4($){return $===void 0||typeof $==="string"}function wX($,Z){if(R6($))throw X$($,"invalid_response",Z);let J=n$($)&&n$($.result)?$.result:void 0,X=J?.payload;if(!Array.isArray(X)||X.length===0||!X.every((H)=>typeof H==="number"&&Number.isInteger(H)&&H>=0&&H<=255))throw X$($,"invalid_response",Z);let Y=J2(J?.record_version);if(Y===void 0)throw X$($,"invalid_record_version",Z);let G=J?.expires_at_ms,z=G===void 0||G===null?null:typeof G==="number"&&Number.isFinite(G)?G:void 0;if(z===void 0)throw X$($,"invalid_expiry",Z);let Q=J?.credential_id,K=J?.project_id,W=J?.account_id,V=J?.email,B=J?.org_name;if(!A4(Q)||!A4(K)||!A4(W)||!A4(V)||!A4(B))throw X$($,"invalid_response",Z);let j;try{j=new TextDecoder("utf-8",{fatal:!0}).decode(Uint8Array.from(X))}catch{throw X$($,"invalid_response",Z)}return{material:j,recordVersion:Y,expiresAtMs:z,credentialId:Q,projectId:K,accountId:W,email:V,orgName:B}}function FV($,Z){if(R6($))throw X$($,"invalid_response",Z);let J=n$($)&&n$($.result)?$.result:void 0,X=J?.record_version,Y=X===void 0?void 0:J2(X),G=J?.credential_id;if(typeof J?.ready!=="boolean"||J?.last_error_code!==void 0&&J?.last_error_code!==null&&typeof J?.last_error_code!=="string"||typeof J?.lease_held!=="boolean"||X!==void 0&&Y===void 0||!A4(G)||J?.stale_pending!==void 0&&typeof J.stale_pending!=="boolean")throw X$($,"invalid_status",Z);return{ready:J.ready,lastErrorCode:J.last_error_code??null,leaseHeld:J.lease_held,...G===void 0?{}:{credentialId:G},...Y===void 0?{}:{recordVersion:Y},...J.stale_pending===void 0?{}:{stalePending:J.stale_pending}}}class H4{#$;#Z;#G;#X;#Q;#Y;#J=null;#W=0;#K=!1;constructor($,Z,J,X,Y,G){this.#$=$,this.#Z=Z,this.#G=J,this.#X=X,this.#Q=Y,this.#Y=G}static async connect($={}){let Z=e0($.connectionFile),J=$.connector??((G)=>A6.connect(G)),X=$.identity??$2($.projectRoot??process.cwd(),$.storagePath??process.cwd()),Y=await J({connectionFile:Z,handshakeTimeoutMs:$.handshakeTimeoutMs});return new H4(Y,J,Z,$.handshakeTimeoutMs,X,$.logger??((G)=>console.warn(G)))}async getCredential($,Z){let J=await this.#z("credential.get",{handle:$,min_ttl_ms:Z,force_refresh:!1});return wX(J,this.#Y)}async statusCredential($){let Z=await this.#z("credential.status",{handle:$});return FV(Z,this.#Y)}async reportAuthFailure($){let Z=await this.#z("credential.report_auth_failure",{handle:$.handle,provider_status:$.providerStatus,record_version:$.recordVersion,reporter_source:$.reporterSource});if(R6(Z))throw X$(Z,"invalid_response",this.#Y);if((n$(Z)&&n$(Z.result)?Z.result:void 0)?.accepted!==!0)throw X$(Z,"invalid_response",this.#Y)}async listScoped($){let Z=await this.#z("credential.list_scoped",$===void 0?{}:{enrollment_token:$});return CV(Z,this.#Y)}async getScoped($){let Z=await this.#z("credential.get_scoped",{credential_id:$.credentialId,enrollment_token:$.enrollmentToken,min_ttl_ms:$.minTtlMs});return wX(Z,this.#Y)}async reportAuthFailureScoped($){let Z=await this.#z("credential.report_auth_failure",{credential_id:$.credentialId,enrollment_token:$.enrollmentToken,provider_status:$.providerStatus,record_version:$.recordVersion,reporter_source:$.reporterSource});if(R6(Z))throw X$(Z,"invalid_response",this.#Y);if((n$(Z)&&n$(Z.result)?Z.result:void 0)?.accepted!==!0)throw X$(Z,"invalid_response",this.#Y)}async enrollPropose($){let Z=await this.#z("auth.enroll_propose",{proposed_name:$.name,request_secret_hash:$.requestSecretHash}),X=Z2(Z,this.#Y).request_id;if(typeof X!=="string"||X.length===0)throw X$(Z,"invalid_response",this.#Y);return{requestId:X}}async enrollPoll($){let Z=await this.#z("auth.enroll_poll",{request_id:$.requestId,request_secret:$.requestSecret});return SV(Z,this.#Y)}async enrollRotate($){let Z=await this.#z("auth.enroll_rotate",{token:$.token,expected_token_generation:$.expectedTokenGeneration}),J=Z2(Z,this.#Y),X=J.token,Y=J.token_generation;if(typeof X!=="string"||X.length===0||typeof Y!=="number"||!Number.isInteger(Y)||Y<0)throw X$(Z,"invalid_response",this.#Y);return{token:X,tokenGeneration:Y}}close(){this.#K=!0,this.#$.close()}async#z($,Z){let J=this.#$;try{return await J.call(_X,$,Z,{identity:this.#Q,consumerIdentity:null})}catch(X){if(this.#B(X)){try{if(this.#$===J)await this.#q()}catch(Y){throw this.#V(Y)}try{return await this.#$.call(_X,$,Z,{identity:this.#Q,consumerIdentity:null})}catch(Y){throw this.#V(Y)}}throw this.#V(X)}}#V($){if($ instanceof k$)return $;let Z=$ instanceof S$&&$.code?$.code:"transport_error";return new k$(Z,"transient","retry")}#B($){return!this.#K&&$ instanceof S$&&$.kind==="terminal"&&$.code!=="missing_identity"&&$.code!=="invalid_control_body"&&$.code!=="unknown_module"}async#q(){if(this.#K)throw Error("Claustrum client is closed");if(this.#J){await this.#J;return}let $=Date.now();if($<this.#W)throw Error("Claustrum client reconnect is backed off");this.#W=$+TV,this.#J=this.#Z({connectionFile:this.#G,handshakeTimeoutMs:this.#X}).then((Z)=>{if(this.#K)throw Z.close(),Error("Claustrum client is closed");let J=this.#$;this.#$=Z,J.close()}).finally(()=>{this.#J=null}),await this.#J}}function CV($,Z){if(R6($))throw X$($,"invalid_response",Z);let J=n$($)&&n$($.result)?$.result:void 0,X=J?.credentials;if(!Array.isArray(X))throw X$($,"invalid_response",Z);let Y=J?.view;if(typeof Y!=="string"||Y.length===0)throw X$($,"invalid_response",Z);return{rows:X.map((z)=>{if(!n$(z))throw X$($,"invalid_response",Z);let Q=J2(z.record_version);if(Q===void 0)throw X$($,"invalid_record_version",Z);let K=(B)=>{if(!Array.isArray(B)||!B.every((j)=>typeof j==="string"))throw X$($,"invalid_response",Z);return B};if(typeof z.id!=="string"||typeof z.type!=="string"||typeof z.state!=="string")throw X$($,"invalid_response",Z);let W=z.created_at_ms===void 0||z.created_at_ms===null?null:typeof z.created_at_ms==="number"&&Number.isFinite(z.created_at_ms)?z.created_at_ms:void 0;if(W===void 0)throw X$($,"invalid_response",Z);let V=z.auth_method;if(V!==void 0&&V!=="apikey"&&V!=="chatgpt"&&V!=="antigravity"&&V!=="oauth")throw X$($,"invalid_response",Z);if(!A4(z.refresh_adapter))throw X$($,"invalid_response",Z);if(!A4(z.account_id)||!A4(z.email)||!A4(z.org_name))throw X$($,"invalid_response",Z);return{id:z.id,categories:K(z.categories),credentialType:z.type,serves:K(z.serves),providerIds:z.provider_ids===void 0?[]:K(z.provider_ids),authMethod:V,state:z.state,refreshAdapter:z.refresh_adapter,recordVersion:Q,operations:K(z.operations),createdAtMs:W,accountId:z.account_id,email:z.email,orgName:z.org_name}}),view:Y}}function Z2($,Z){if(R6($))throw X$($,"invalid_response",Z);let J=n$($)&&n$($.result)?$.result:void 0;if(J===void 0)throw X$($,"invalid_response",Z);return J}function SV($,Z){let J=Z2($,Z),X=J.status;if(X==="pending")return{status:"pending"};if(X==="denied")return{status:"denied"};if(X!=="approved")throw X$($,"invalid_response",Z);let{name:Y,token:G,token_generation:z}=J;if(typeof Y!=="string"||typeof G!=="string"||G.length===0||typeof z!=="number"||!Number.isInteger(z))throw X$($,"invalid_response",Z);return{status:"approved",name:Y,token:G,tokenGeneration:z}}import{createHash as l1}from"node:crypto";import{randomUUID as b7}from"node:crypto";import{randomUUID as fU}from"node:crypto";import{mkdir as EU,open as yZ,rename as bU,rm as hU}from"node:fs/promises";import{dirname as B5}from"node:path";import{randomUUID as h7}from"node:crypto";import{mkdir as FY,open as gU,readFile as H2,rename as CY,rm as q8,stat as SY,writeFile as L2}from"node:fs/promises";import{dirname as yU,join as kY}from"node:path";import{readFile as lU}from"node:fs/promises";import{setTimeout as iU}from"node:timers/promises";import{AsyncLocalStorage as dU}from"node:async_hooks";import{createHash as $7}from"node:crypto";import{randomUUID as EY}from"node:crypto";import{randomUUID as pN}from"node:crypto";import{isDeepStrictEqual as lN}from"node:util";import{types as GJ}from"node:util";import{randomUUID as Bx}from"node:crypto";import{constants as lY}from"node:fs";import{lstat as qx,mkdir as jx,open as mQ,rename as Hx,rm as Lx}from"node:fs/promises";import{basename as Ux,dirname as iY,isAbsolute as Nx,join as xx}from"node:path";import{types as Dx}from"node:util";import{createHash as Ox}from"node:crypto";import{lstat as Mx,readFile as Px}from"node:fs/promises";import{createHash as lQ}from"node:crypto";import{createHash as _x}from"node:crypto";import{createHash as Ax}from"node:crypto";import{types as WJ}from"node:util";import{appendFileSync as XD,chmodSync as YD,existsSync as E5,renameSync as Y3,statSync as GD}from"node:fs";import{createHash as UD,randomBytes as ND,randomUUID as xD}from"node:crypto";import{constants as Q3}from"node:fs";import{chmod as DD,mkdir as OD,open as jK,readFile as K3,realpath as ID,rename as MD,stat as HK,unlink as UJ}from"node:fs/promises";import{basename as PD,dirname as d6,extname as zF,isAbsolute as QF,join as _D,resolve as KF}from"node:path";import{createHash as pD}from"node:crypto";import{readFile as cD}from"node:fs/promises";import{types as QO}from"node:util";import{createHash as WO}from"node:crypto";import{isAbsolute as UO,normalize as NO,parse as xO,sep as i7}from"node:path";import{createHash as DO}from"node:crypto";import{constants as w2}from"node:fs";import{lstat as x3,open as OO}from"node:fs/promises";import{resolve as V9}from"node:path";import{createHash as mO}from"node:crypto";import{basename as pO,dirname as cO,join as lO}from"node:path";import{randomUUID as iO}from"node:crypto";import{types as dO}from"node:util";import{createHash as bK,randomUUID as $I}from"node:crypto";import{mkdir as ZI,readFile as JI,rename as XI,rm as YI,stat as GI,writeFile as zI}from"node:fs/promises";import{basename as QI,dirname as hK,join as KI}from"node:path";import{randomUUID as II}from"node:crypto";import{lstat as MI,open as PI,rename as _I,unlink as v3}from"node:fs/promises";import{dirname as wI,isAbsolute as AI,join as RI}from"node:path";import{createHash as TI}from"node:crypto";import{lstat as FI,mkdir as CI,unlink as SI}from"node:fs/promises";import{dirname as kI,isAbsolute as vI}from"node:path";import{createHash as fI}from"node:crypto";import{realpath as EI}from"node:fs/promises";import{basename as lK,dirname as iK,join as dK,resolve as bI}from"node:path";import{types as g9}from"node:util";import{types as nK}from"node:util";import{dirname as vM,join as fM,resolve as EM}from"node:path";import{createHash as gM}from"node:crypto";import{constants as i3}from"node:fs";import{lstat as $W,mkdir as d3,open as ZW,unlink as yM}from"node:fs/promises";import{dirname as s7,resolve as s3}from"node:path";import{setTimeout as uM}from"node:timers/promises";import{rmdirSync as mM,statSync as pM}from"node:fs";import{mkdir as cM,rmdir as lM,stat as Z0,utimes as JW}from"node:fs/promises";import{createHash as ZP}from"node:crypto";import{realpathSync as JP}from"node:fs";import{mkdir as XP,readdir as o3,rm as t7,stat as r3,writeFile as YP}from"node:fs/promises";import{tmpdir as GP}from"node:os";import{join as l8,resolve as zP}from"node:path";import{randomUUID as GG}from"node:crypto";import{chmod as zG,lstat as _P,mkdir as wP,readdir as QG,readFile as KG,rename as AP,rm as g2,stat as RP,writeFile as TP}from"node:fs/promises";import{tmpdir as FP}from"node:os";import{join as NZ}from"node:path";import{Buffer as pP}from"node:buffer";import{createHash as cP,randomBytes as lP}from"node:crypto";var kV=Object.defineProperty,vV=($)=>$;function fV($,Z){this[$]=vV.bind(null,Z)}var EV=($,Z)=>{for(var J in Z)kV($,J,{get:Z[J],enumerable:!0,configurable:!0,set:fV.bind(Z,J)})},MG=($,Z)=>()=>($&&(Z=$($=0)),Z);function qA($,Z){let J=($??"").split(",").map((X)=>X.trim()).filter(Boolean);return[...new Set([...J,...Z])].join(",")}function jA($){return typeof $==="string"&&($.startsWith("claude-opus-4-8")||$.startsWith("claude-opus-5"))}var G0="9d1c250a-e61b-44d9-88ed-5944d1962f5e",V1,c2="https://platform.claude.com/oauth/code/callback",PG="https://platform.claude.com/v1/oauth/token",_G,wG="axios/1.15.2",B1,bV="user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload",HA="mcp_",hV,gV="fast-mode-2026-02-01",LA="You are OpenCode",UA="You are Claude Code, Anthropic's official CLI for Claude.",yV,uV="59cf53e54c78",AG,l9="2.1.280",RG="cli",mV="0.112.1",pV="v26.3.0",TG,q1,FG="explicit",cV,lV,a4=MG(()=>{V1={console:"https://platform.claude.com/oauth/authorize",max:"https://claude.com/cai/oauth/authorize"},_G=/^ckh_[A-Za-z0-9_-]{43}$/,B1=["org:create_api_key","user:profile","user:inference","user:sessions:claude_code","user:mcp_servers","user:file_upload"],hV=["oauth-2025-04-20","interleaved-thinking-2025-05-14"],yV=["<use_parallel_tool_calls>","For maximum efficiency, whenever you perform multiple independent operations, invoke all relevant tools simultaneously rather than sequentially. Prioritize calling independent tools in parallel whenever possible. For example, when reading 3 known files, run 3 tool calls in parallel to read all 3 files into context at the same time. When running multiple independent read-only commands like `ls` or `list_dir`, run all of those commands in parallel. Err on the side of maximizing parallel tool calls for independent work rather than running too many tools sequentially.","","Do not parallelize tool calls when one call depends on the output of another call. If a tool call needs an ID, filename, search result, or any other value returned by a previous tool call, run the first call, wait for its result, then run the dependent call using the real returned value. Never invent placeholder IDs, guessed task IDs, or other guessed values for dependent tool calls just to place them in the same parallel block.","</use_parallel_tool_calls>"].join(`
+`),AG=[4,7,20],TG=`claude-cli/${l9} (external, ${RG})`,q1=["explicit","automatic","hybrid"],cV=["github.com/anomalyco/opencode","opencode.ai/docs"],lV=[{match:"if OpenCode honestly",replacement:"if the assistant honestly"},{match:"Here is some useful information about the environment you are running in:",replacement:"Environment context you are running in:"}]}),iV={};EV(iV,{shouldEmit:()=>z0,setLogLevel:()=>kG,relayLog:()=>B$,redactPayload:()=>H1,parseLogLevel:()=>OZ,logger:()=>d,log:()=>oV,isSecretKey:()=>j1,getLogLevel:()=>vG,getLogFilePath:()=>dV,formatLogLine:()=>fG,__setLogTestSink:()=>aV,SECRET_KEY_EXACT:()=>U1});function OZ($){if(!$)return null;let Z=$.trim().toLowerCase();return EG.has(Z)?Z:null}function kG($){Q0=$}function vG(){return Q0}function z0($){return IZ[$]<=IZ[Q0]}function dV(){return z6}function sV(){try{if(!O4.existsSync(z6))return;if(O4.statSync(z6).size<bG)return}catch{return}try{for(let $=RX;$>=1;$--){let Z=$===1?z6:`${z6}.${$-1}`,J=`${z6}.${$}`;try{if($===RX)try{O4.unlinkSync(J)}catch{}if(O4.existsSync(Z))O4.renameSync(Z,J)}catch{}}}catch{}}function j1($){if(U1.test($))return!0;let Z=$.toLowerCase().replace(/[-_]/g,"");if(Z.includes("apikey"))return!0;if(Z.endsWith("secret")||Z.endsWith("password"))return!0;if(Z.endsWith("token")&&!Z.endsWith("tokens"))return!0;return!1}function tV($){if(typeof $!=="string")return!1;return hG.some((Z)=>Z.test($))}function H1($){if($==null||Object.keys($).length===0)return;let Z=new WeakSet;function J(X){if(X==null||typeof X!=="object"){if(tV(X))return"***REDACTED***";return X}if(Z.has(X))return"[Circular]";Z.add(X);try{if(Array.isArray(X))return X.map(J);let Y=X,G={};for(let[z,Q]of Object.entries(Y)){if(j1(z)){G[z]="***REDACTED***";continue}G[z]=J(Q)}return G}finally{Z.delete(X)}}return J($)}function fG($,Z,J,X){let Y=new Date().toISOString(),G=$.toUpperCase().padEnd(5),z=Z?` [${Z}]`:"",Q=(()=>{try{let K=H1(X),W=K?{...K,pid:process.pid}:{pid:process.pid};return` ${JSON.stringify(W)}`}catch{return` {"pid":${process.pid},"payload":"[unserializable]"}`}})();return`[${Y}] ${G}${z} ${J}${Q}`}function aV($){l2=$}function k6($,Z,J,X){if(!z0($))return;if(l2)try{l2({level:$,channel:Z,message:J,payload:H1(X)})}catch{}if(K0)return;try{let Y=`${fG($,Z,J,X)}
+`;if(O8.push(Y),O8.length>=eV)L1();else nV()}catch{}}function L1(){if(I8)clearTimeout(I8),I8=null;if(O8.length===0)return;let $=O8.join("");O8=[];try{sV(),O4.appendFileSync(z6,$)}catch{}}function nV(){if(I8)return;I8=setTimeout(()=>{I8=null,L1()},rV)}function oV($,Z){if(!z0("debug"))return;if(K0)return;try{let J="",X=$,Y=$.match(gG);if(Y)J=Y[1]??"",X=$.slice(Y[0].length);let G;if(Z!=null){if(Z instanceof Error)G={error:`${Z.message}${Z.stack?`
+${Z.stack}`:""}`};else if(typeof Z==="object")G=Z}k6("debug",J,X,G)}catch{}}function B$($,Z){if(!z0("debug"))return;if(K0)return;try{let J;if(Z!=null){if(typeof Z==="object"&&!(Z instanceof Error))J=Z}k6("debug","relay",$,J)}catch{}}var IZ,EG,AX,Q0,z6,bG,RX=3,U1,hG,l2=null,d,K0=!1,rV=500,eV=50,O8,I8=null,gG,Y4=MG(()=>{if(a4(),IZ={error:0,warn:1,info:2,debug:3,trace:4},EG=new Set(Object.keys(IZ)),AX=OZ(process.env.OPENCODE_ANTHROPIC_AUTH_LOG_LEVEL),Q0=AX??"info",z6=process.env.OPENCODE_ANTHROPIC_AUTH_LOG_FILE??SG.join(CG.tmpdir(),"opencode-anthropic-auth.log"),bG=5242880,U1=/^(authorization|x-api-key|cookie|set-cookie|refresh|access|token|handle)$/i,hG=[/Bearer\s+\S+/,/sk-[A-Za-z0-9-]+/,/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/,_G],d={error($,Z,J){k6("error",$,Z,J)},warn($,Z,J){k6("warn",$,Z,J)},info($,Z,J){k6("info",$,Z,J)},debug($,Z,J){k6("debug",$,Z,J)},trace($,Z,J){k6("trace",$,Z,J)}},O8=[],gG=/^\[([\w-]+)\]\s*/,!K0)process.on("exit",L1)});function GB($){return $&&typeof $==="object"&&"code"in $&&typeof $.code==="string"?$.code:"unknown"}var M8="subc-connection.json",zB="subc-",QB=".connection.json";function H9($){try{return XB($).isFile()}catch{return!1}}function KB($){let Z;try{Z=JB($)}catch{return[]}let J=[];for(let X of Z){if(typeof X!=="string")continue;if(!X.startsWith(zB)||!X.endsWith(QB))continue;let Y=A9($,X);if(H9(Y))J.push(Y)}return J.sort(),J}function WB($=process.env){let Z=$.XDG_RUNTIME_DIR?.trim();if(Z){let z=A9(Z,M8);if(H9(z))return z}let J=$.HOME?.trim();if(J){let z=A9(J,".local","share","cortexkit","run",M8);if(H9(z))return z}let Y=`/run/user/${process.getuid?.()??i2().uid}/${M8}`;if(H9(Y))return Y;let G=KB(YB());if(G.length===1)return G[0];return}function VB($=process.env){let Z=WB($);if(Z)return Z;let J=$.XDG_RUNTIME_DIR?.trim();if(J&&(process.platform!=="darwin"||H9(J)))return A9(J,M8);if(process.platform==="darwin"){let Y=$.HOME?.trim()||i2().homedir;return A9(Y,".local","share","cortexkit","run",M8)}return`/run/user/${process.getuid?.()??i2().uid}/${M8}`}function mG($,Z=process.env){return $?.trim()||Z.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE?.trim()||Z.CLAUSTRUM_SUBC_CONNECTION?.trim()||VB(Z)}function D1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function BB($){return D1($)&&typeof $.host==="string"&&$.host.trim().length>0&&typeof $.port==="number"&&Number.isInteger($.port)&&$.port>0&&$.port<=65535}async function wA($){let Z=mG($),J;try{J=await uG.readFile(Z,"utf8")}catch(Y){let G=GB(Y);if(G==="ENOENT")return{status:"absent",path:Z};return{status:"malformed",path:Z,reason:`unreadable (${G})`}}let X;try{X=JSON.parse(J)}catch{return{status:"malformed",path:Z,reason:"invalid JSON"}}if(!D1(X)||typeof X.schema!=="number"||!Number.isFinite(X.schema)||typeof X.wire_version!=="number"||!Number.isFinite(X.wire_version)||!Array.isArray(X.endpoints)||X.endpoints.length===0||!X.endpoints.every(BB))return{status:"malformed",path:Z,reason:"connection file has an invalid schema, wire_version, or endpoints"};return{status:"available",schema:X.schema,wireVersion:X.wire_version,endpoints:X.endpoints.map((Y)=>({host:Y.host,port:Y.port}))}}var O1="claustrum-tombstone:v1:";function MZ($){return`${O1}${$}`}function W0($){return{type:"oauth",access:"",refresh:MZ($),expires:0}}function pG($){return typeof $==="string"&&$.startsWith(O1)}function AA($,Z){if(!D1($)||$.type!=="oauth")return!1;return $.refresh===MZ(Z)}class I1 extends Error{provider;code="custody_tombstone_refresh";constructor($){super(`${$} OAuth credentials are vault-custodied; local token refresh is forbidden`);this.provider=$,this.name="CustodyTombstoneRefreshError"}}function M1($,Z){if(pG($))throw new I1(Z)}a4();var FX=new Set(["EAI_AGAIN","ECONNREFUSED","ECONNRESET","EHOSTUNREACH","ENETUNREACH","ENOTFOUND","ETIMEDOUT","UND_ERR_CONNECT_TIMEOUT"]);function CX($,Z){if(!$||typeof $!=="object")return;let J=$[Z];return typeof J==="string"?J:void 0}function h4($){let Z=CX($,"code");if(Z&&FX.has(Z))return!0;let J=$ instanceof Error?$.message:CX($,"message")??String($);if(J.includes("fetch failed"))return!0;return[...FX].some((X)=>J.includes(X))}function SX($){let Z="";for(let J of $)Z+=String.fromCharCode(J);return btoa(Z).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async function qB(){let $=new Uint8Array(64);crypto.getRandomValues($);let Z=SX($),J=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(Z));return{verifier:Z,challenge:SX(new Uint8Array(J)),method:"S256"}}function cG($){if(!$)return;let Z=Number($);if(Number.isFinite(Z)&&Z>0)return Math.ceil(Z);let J=Date.parse($);if(Number.isFinite(J)){let X=Math.ceil((J-Date.now())/1000);return X>0?X:void 0}return}class R9 extends Error{status;body;retryAfter;isRefreshError=!0;constructor($,Z,J){super(`Claude OAuth refresh failed: ${$} — ${Z}`);this.status=$,this.body=Z,this.name="ClaudeOAuthRefreshError",this.retryAfter=cG(J??void 0)}}async function jB($){if(M1($.refreshToken,"anthropic"),typeof $.refreshToken!=="string"||!$.refreshToken.trim())throw Error("Local OAuth refresh credential is unavailable");let Z=$.fetchImpl??fetch,J=$.maxRetries??2,X=$.baseDelayMs??500,Y=$.setTimeoutImpl??globalThis.setTimeout;for(let G=0;G<=J;G++)try{if(G>0){let W=X*2**(G-1);await new Promise((V)=>Y(V,W))}let z=await Z(PG,{method:"POST",redirect:"error",headers:{"Content-Type":"application/json",Accept:"application/json, text/plain, */*","User-Agent":wG},body:JSON.stringify({grant_type:"refresh_token",refresh_token:$.refreshToken,client_id:G0,scope:bV})});if(!z.ok){if(z.status>=500&&G<J){await z.body?.cancel().catch(()=>{});continue}let W=await z.text().catch(()=>"");throw new R9(z.status,W,z.headers.get("retry-after"))}let Q=await z.json(),K=$.now?.()??Date.now();return{access:Q.access_token,refresh:Q.refresh_token??$.refreshToken,expires:K+Q.expires_in*1000,expiresIn:Q.expires_in,authLineageId:$.authLineageId}}catch(z){if(z instanceof R9)throw z;if(G<J&&h4(z))continue;throw z}throw Error("Token refresh exhausted all retries")}function HB(){return crypto.randomUUID().replace(/-/g,"")}function LB($){let Z=$.trim();try{let z=new URL(Z),Q=z.searchParams.get("code"),K=z.searchParams.get("state");if(Q&&K)return{code:Q,state:K}}catch{}let J=Z.split("#");if(J.length===2&&J[0]&&J[1])return{code:J[0],state:J[1]};let X=new URLSearchParams(Z),Y=X.get("code"),G=X.get("state");if(Y&&G)return{code:Y,state:G};return null}async function UB($,Z,J){let X=await fetch(PG,{method:"POST",redirect:"error",headers:{"Content-Type":"application/json",Accept:"application/json, text/plain, */*","User-Agent":wG},body:JSON.stringify({code:$.code,state:$.state,grant_type:"authorization_code",client_id:G0,redirect_uri:J,code_verifier:Z})});if(!X.ok)return{type:"failed"};let Y=await X.json();return{type:"success",refresh:Y.refresh_token,access:Y.access_token,expires:Date.now()+Y.expires_in*1000}}async function RA($){let Z=await qB(),J=HB(),X=new URL(V1[$],import.meta.url);return X.searchParams.set("code","true"),X.searchParams.set("client_id",G0),X.searchParams.set("response_type","code"),X.searchParams.set("redirect_uri",c2),X.searchParams.set("scope",B1.join(" ")),X.searchParams.set("code_challenge",Z.challenge),X.searchParams.set("code_challenge_method","S256"),X.searchParams.set("state",J),{url:X.toString(),redirectUri:c2,state:J,verifier:Z.verifier}}async function TA($,Z,J,X){let Y=LB($);if(!Y)return{type:"failed"};if(X&&Y.state!==X)return{type:"failed"};return UB(Y,Z,J)}a4();function I6($){try{return JSON.parse($)}catch(Z){if(Z instanceof SyntaxError)throw SyntaxError("invalid JSON");throw Z}}Y4();function S4($){return NB("sha256").update($).digest("hex").slice(0,16)}var xB=globalThis.setTimeout.bind(globalThis),DB=globalThis.clearTimeout.bind(globalThis),lG="anthropic-auth.json",OB="anthropic-auth-state.json",IB="https://api.anthropic.com/api/oauth/usage",i9=["five_hour","seven_day","scoped","extraUsage","bindingWindow","fallbackAdvised"];function kX($){return $.access==null&&($.refresh==null||$.refresh==="")}function E$($){return $.type==="oauth"}function d2($){return $.type==="api"}function V0($){let Z=$?.trim();if(!Z)return!1;try{let J=new URL(Z);return(J.protocol==="http:"||J.protocol==="https:")&&!J.username&&!J.password}catch{return!1}}function CA($){return $.costZeroing?.enabled!==!1}var MB=[401,403,429];var s2=300000,PB=3600000,iG=86400000,_B=60000,wB=900000,AB=300000,RB=5,vX={five_hour:0,seven_day:0},TB=!0,SA=60000;function FB(){if(process.env.OPENCODE_CONFIG_DIR?.trim())return process.env.OPENCODE_CONFIG_DIR.trim();return k8(process.env.XDG_CONFIG_HOME||k8($B(),".config"),"opencode")}function B0(){return process.env.OPENCODE_ANTHROPIC_AUTH_FILE?.trim()||k8(FB(),lG)}function P1($=B0()){let Z=process.env.OPENCODE_ANTHROPIC_AUTH_STATE_FILE?.trim();if(Z)return Z;return $.endsWith(lG)?k8(x1($),OB):`${$}.state.json`}function s($){return $!=null&&typeof $==="object"&&!Array.isArray($)}function fX($){return{id:typeof $.id==="string"&&$.id.trim()?$.id.trim():j9(),label:typeof $.label==="string"?$.label:void 0,enabled:typeof $.enabled==="boolean"?$.enabled:void 0,addedAt:typeof $.addedAt==="number"?$.addedAt:void 0,lastUsed:typeof $.lastUsed==="number"?$.lastUsed:void 0}}function dG($){if(!s($))return null;if($.type==="api"){let Y=typeof $.baseURL==="string"?$.baseURL.trim():"",G=typeof $.apiKey==="string"?$.apiKey.trim():"";if(!V0(Y))return null;let z=$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer";return{...fX($),type:"api",apiKey:G||void 0,baseURL:Y,authHeader:z}}if($.type!=="oauth")return null;let Z=typeof $.refresh==="string"?$.refresh:"",J=$.enabled===!0&&typeof $.id==="string"&&Boolean($.id.trim())&&typeof $.label==="string"&&Boolean($.label.trim())&&kX($),X=typeof $.claustrumScopedCredentialId==="string"&&Boolean($.claustrumScopedCredentialId.trim())&&typeof $.anthropicAccountUuid==="string"&&Boolean($.anthropicAccountUuid.trim())&&kX($);if(!Z.trim()&&!J&&!X)return null;return{...fX($),type:"oauth",authLineageId:typeof $.authLineageId==="string"&&$.authLineageId.trim()?$.authLineageId:void 0,anthropicAccountUuid:typeof $.anthropicAccountUuid==="string"&&$.anthropicAccountUuid.trim()?$.anthropicAccountUuid.trim():void 0,claustrumScopedCredentialId:typeof $.claustrumScopedCredentialId==="string"&&$.claustrumScopedCredentialId.trim()?$.claustrumScopedCredentialId.trim():void 0,claustrumScopedState:typeof $.claustrumScopedState==="string"&&$.claustrumScopedState.trim()?$.claustrumScopedState.trim():void 0,access:typeof $.access==="string"?$.access:void 0,refresh:Z,expires:typeof $.expires==="number"?$.expires:void 0,lastRefreshedAt:typeof $.lastRefreshedAt==="number"?$.lastRefreshedAt:void 0,lastRefreshError:EX($.lastRefreshError),lastQuotaRefreshError:EX($.lastQuotaRefreshError),quota:CB($.quota),profile:_1($.profile),prime:w1($.prime)}}function _1($){if(!s($))return;if(typeof $.tier!=="string"||!$.tier.trim()||typeof $.orgType!=="string"||!$.orgType.trim()||typeof $.checkedAt!=="number"||!Number.isFinite($.checkedAt))return;return{tier:$.tier.trim(),orgType:$.orgType.trim(),checkedAt:$.checkedAt,...typeof $.accountIdentity==="string"&&$.accountIdentity.trim()&&{accountIdentity:$.accountIdentity.trim()},...typeof $.providerAccountUuid==="string"&&$.providerAccountUuid.trim()&&{providerAccountUuid:$.providerAccountUuid.trim()},...typeof $.tokenFingerprint==="string"&&$.tokenFingerprint.trim()&&{tokenFingerprint:$.tokenFingerprint.trim()}}}function EX($){if(!s($))return;if(typeof $.message!=="string")return;let Z=Number($.checkedAt);if(!Number.isFinite(Z))return;let J=Number($.nextRetryAt),X=Number($.retryCount),Y=Number($.status);return{message:$.message,checkedAt:Z,nextRetryAt:Number.isFinite(J)?J:void 0,retryCount:Number.isFinite(X)?X:void 0,accountIdentity:typeof $.accountIdentity==="string"&&$.accountIdentity.trim()?$.accountIdentity.trim():void 0,tokenHash:typeof $.tokenHash==="string"?$.tokenHash:void 0,refreshTokenFingerprint:typeof $.refreshTokenFingerprint==="string"&&$.refreshTokenFingerprint.trim()?$.refreshTokenFingerprint.trim():void 0,status:Number.isFinite(Y)?Y:void 0,permanent:typeof $.permanent==="boolean"?$.permanent:void 0}}function bX($){if(!s($))return;let Z=Number($.usedPercent),J=Number($.remainingPercent),X=Number($.checkedAt);if(!Number.isFinite(Z)||!Number.isFinite(J)||!Number.isFinite(X))return;return{usedPercent:Z,remainingPercent:J,checkedAt:X,resetsAt:typeof $.resetsAt==="string"?$.resetsAt:void 0}}function w1($){if(!s($))return;let Z=Number($.count),J=Number($.inputTokens),X=Number($.outputTokens),Y=Number($.since);if(![Z,J,X,Y].every(Number.isFinite)||Z<0||J<0||X<0||Y<0)return;return{count:Math.floor(Z),inputTokens:Math.floor(J),outputTokens:Math.floor(X),since:Math.floor(Y)}}function CB($){if(!s($))return;let Z={};for(let J of["five_hour","seven_day"]){let X=bX($[J]);if(X)Z[J]=X}if(typeof $.checkedAt==="number"&&Number.isFinite($.checkedAt))Z.checkedAt=$.checkedAt;if(typeof $.accountIdentity==="string"&&$.accountIdentity.trim())Z.accountIdentity=$.accountIdentity.trim();if(Array.isArray($.scoped)){let J=$.scoped.map((X)=>{if(!s(X))return;let Y=bX(X);if(!Y)return;if(typeof X.id!=="string"||!X.id.trim())return;if(typeof X.title!=="string"||!X.title.trim())return;if(typeof X.modelName!=="string"||!X.modelName.trim())return;let G=typeof X.modelId==="string"&&X.modelId.trim()?X.modelId.trim():void 0;return{...Y,id:X.id.trim(),title:X.title.trim(),...G&&{modelId:G},modelName:X.modelName.trim()}}).filter((X)=>X!=null);Z.scoped=J}if(s($.extraUsage)){let J=hX($.extraUsage.used),X=hX($.extraUsage.limit);if(J&&X&&typeof $.extraUsage.exhausted==="boolean")Z.extraUsage={used:J,limit:X,...typeof $.extraUsage.utilizationPercent==="number"&&Number.isFinite($.extraUsage.utilizationPercent)&&{utilizationPercent:$.extraUsage.utilizationPercent},...typeof $.extraUsage.severity==="string"&&{severity:$.extraUsage.severity},exhausted:$.extraUsage.exhausted}}if(typeof $.bindingWindow==="string"&&$.bindingWindow.trim())Z.bindingWindow=$.bindingWindow.trim();if($.bindingWindowSource==="poll"||$.bindingWindowSource==="headers")Z.bindingWindowSource=$.bindingWindowSource;if(typeof $.fallbackAdvised==="boolean")Z.fallbackAdvised=$.fallbackAdvised;if($.source==="poll"||$.source==="headers")Z.source=$.source;if(s($.fieldSources)){let J={};for(let X of i9){if(Z[X]===void 0)continue;let Y=$.fieldSources[X];if(Y==="poll"||Y==="headers")J[X]=Y}if(Object.keys(J).length>0)Z.fieldSources=J}return Object.keys(Z).length?Z:void 0}function hX($){if(!s($))return;if(typeof $.amountMinor!=="number"||!Number.isFinite($.amountMinor)||typeof $.currency!=="string"||!$.currency.trim()||typeof $.exponent!=="number"||!Number.isFinite($.exponent))return;return{amountMinor:$.amountMinor,currency:$.currency.trim(),exponent:$.exponent}}function sG(){return{version:1,main:{type:"opencode",provider:"anthropic"},accounts:[]}}function SB($){if(!s($)||!Array.isArray($.accounts))return null;return{version:1,mainAccountId:typeof $.mainAccountId==="string"&&$.mainAccountId.trim()?$.mainAccountId.trim():void 0,main:{type:"opencode",provider:"anthropic",profile:_1(s($.main)?$.main.profile:void 0)},routing:s($.routing)?$.routing:void 0,fallbackOn:Array.isArray($.fallbackOn)?$.fallbackOn.filter((Z)=>Number.isInteger(Z)):void 0,refresh:s($.refresh)?$.refresh:void 0,quota:s($.quota)?$.quota:void 0,quotaHeaderFeed:s($.quotaHeaderFeed)?$.quotaHeaderFeed:void 0,claudeCache:s($.claudeCache)?$.claudeCache:void 0,dump:s($.dump)?$.dump:void 0,claudeFast:s($.claudeFast)?$.claudeFast:void 0,thinkingBinding:s($.thinkingBinding)?$.thinkingBinding:void 0,costZeroing:s($.costZeroing)?$.costZeroing:void 0,cacheKeep:s($.cacheKeep)?$.cacheKeep:void 0,relay:s($.relay)?$.relay:void 0,claustrum:tG($.claustrum),logging:s($.logging)?$.logging:void 0,killswitch:s($.killswitch)?$.killswitch:void 0,prime:(()=>{if(!s($.prime))return;let Z=typeof $.prime.enabled==="boolean"?$.prime.enabled:void 0,J=w1($.prime.main),X=typeof $.prime.mainAuthLineageId==="string"&&$.prime.mainAuthLineageId.trim()?$.prime.mainAuthLineageId:void 0,Y=typeof $.prime.mainAuthLineageRefreshTokenFingerprint==="string"&&$.prime.mainAuthLineageRefreshTokenFingerprint.trim()?$.prime.mainAuthLineageRefreshTokenFingerprint:void 0;if(Z===void 0&&!J&&!X&&!Y)return;return{...Z!==void 0&&{enabled:Z},...J&&{main:J},...X&&{mainAuthLineageId:X},...Y&&{mainAuthLineageRefreshTokenFingerprint:Y}}})(),accounts:$.accounts.map(dG).filter((Z)=>Z!=null)}}function tG($){if(!s($))return;let Z=$.mode==="local"||$.mode==="claustrum"?$.mode:void 0,J=s($.primaryAccount)?$.primaryAccount:void 0,X=J&&typeof J.credentialId==="string"&&J.credentialId.trim()&&typeof J.accountId==="string"&&J.accountId.trim()&&typeof J.state==="string"?{credentialId:J.credentialId.trim(),accountId:J.accountId.trim(),state:J.state}:void 0,Y=$.scopedRoster===!0,G=typeof $.rosterView==="string"&&$.rosterView.length>0&&$.rosterView.length<=4096?$.rosterView:void 0,z=Array.isArray($.disabledAccountIdentities)?[...new Set($.disabledAccountIdentities.filter((Q)=>typeof Q==="string"&&Q.trim().length>0).map((Q)=>Q.trim()))]:[];if(!Z&&!Y&&z.length===0)return;return{...Z&&{mode:Z},...Y&&{scopedRoster:!0},...Y&&G&&{rosterView:G},...X&&{primaryAccount:X},...z.length>0&&{disabledAccountIdentities:z}}}async function T9($){try{return{exists:!0,value:I6(await o7($,"utf8"))}}catch(Z){if(Z.code==="ENOENT")return{exists:!1,value:null};let J=Z instanceof Error?Z.message:String(Z);throw Error(`account store at ${$} is corrupt or unreadable (${J}) — fix or remove it`)}}function s6($){return Object.fromEntries(Object.entries($).filter(([,Z])=>Z!==void 0))}function e7($){return typeof $==="number"&&Number.isFinite($)?$:0}function L8($,Z){if(Z===void 0||!Number.isFinite(Z))return $;if($===void 0||!Number.isFinite($))return Z;return Math.max($,Z)}function kB($,Z){if(Z===void 0||!Number.isFinite(Z))return $;if($===void 0||!Number.isFinite($))return Z;return Math.max($,Z)}function t2($){return Math.max(e7($.lastRefreshedAt),e7($.lastUsed),e7($.addedAt))}function vB($,Z){if($.type!=="oauth")return!1;if(typeof $.refresh!=="string"||!$.refresh.trim())return!1;if(!Boolean(typeof $.access==="string"&&typeof Z.access==="string"&&$.access!==Z.access||typeof $.refresh==="string"&&typeof Z.refresh==="string"&&$.refresh!==Z.refresh))return!1;return t2($)>t2(Z)}function aG($,Z){if(typeof $.claustrumScopedCredentialId==="string"&&typeof $.anthropicAccountUuid==="string"){let X={...Z.claustrumScopedCredentialId===$.claustrumScopedCredentialId&&Z.anthropicAccountUuid===$.anthropicAccountUuid?Z:{},...$,refresh:""};return delete X.access,delete X.expires,delete X.lastRefreshedAt,delete X.lastRefreshError,X}if(vB($,Z)){let J={...Z,...$},X=t2($);if(X>e7(J.lastRefreshedAt))J.lastRefreshedAt=X;return delete J.quota,delete J.lastRefreshError,delete J.lastQuotaRefreshError,J}return{...$,...Z}}function fB($){if($.type!=="api"&&$.type!=="oauth")return!0;if($.type==="api"&&"baseURL"in $&&(typeof $.baseURL!=="string"||!V0($.baseURL)))return!0;if($.type==="oauth"&&"refresh"in $&&(typeof $.refresh!=="string"||!$.refresh.trim()))return!0;return!1}function EB($,Z){if(!s($))return $;let J=s(Z)?Z:{},X=s(J.main)?J.main:void 0,Y=s(J.accounts)?J.accounts:{},G=s($.quota)?$.quota:{},z=s($.refresh)?$.refresh:{},Q=X??G,K=X??z,W=typeof X?.quotaErrorClearedAt==="number"&&Number.isFinite(X.quotaErrorClearedAt)&&X.quotaErrorClearedAt>=0?X.quotaErrorClearedAt:void 0,V=typeof X?.refreshErrorClearedAt==="number"&&Number.isFinite(X.refreshErrorClearedAt)&&X.refreshErrorClearedAt>=0?X.refreshErrorClearedAt:void 0,B=G.mainLastQuotaApiError,j=X?.lastQuotaApiError??(W!==void 0&&s(B)&&typeof B.checkedAt==="number"&&B.checkedAt<=W?void 0:B),H=z.mainLastRefreshError,q=X?.lastRefreshError??(V!==void 0&&s(H)&&typeof H.checkedAt==="number"&&H.checkedAt<=V?void 0:H),N=Array.isArray($.accounts)?$.accounts.map((U)=>{if(!s(U))return U;let L=typeof U.id==="string"?U.id:void 0,D=L?Y[L]??Y[L.trim()]:void 0,w=s(D)?D:{};return aG(U,w)}):[];return{...$,main:{type:"opencode",provider:"anthropic",profile:_1(X?.profile)},refresh:s6({...z,mainLastRefreshError:q,mainRefreshErrorClearedAt:K.refreshErrorClearedAt,mainRefreshLeaseId:K.refreshLeaseId,mainRefreshLeaseUntil:K.refreshLeaseUntil,mainRefreshLeaseTokenHash:K.refreshLeaseTokenHash}),quota:s6({...G,mainQuota:Q.quota,mainQuotaCheckedAt:Q.quotaCheckedAt,mainQuotaToken:Q.quotaToken,mainLastQuotaApiError:j,mainQuotaErrorGeneration:Q.quotaErrorGeneration,mainQuotaErrorClearedAt:Q.quotaErrorClearedAt}),prime:(()=>{let U=s($.prime)?$.prime:void 0,L=w1(X?.prime),D=typeof X?.primeAuthLineageId==="string"&&X.primeAuthLineageId.trim()?X.primeAuthLineageId:void 0,w=typeof X?.primeAuthLineageRefreshTokenFingerprint==="string"&&X.primeAuthLineageRefreshTokenFingerprint.trim()?X.primeAuthLineageRefreshTokenFingerprint:void 0;if(!U&&!L&&!D&&!w)return;return{...U&&typeof U.enabled==="boolean"&&{enabled:U.enabled},...L&&{main:L},...D&&{mainAuthLineageId:D},...w&&{mainAuthLineageRefreshTokenFingerprint:w}}})(),accounts:N}}async function V6($=B0()){let Z=await T9($),J=await T9(P1($));if(!Z.exists&&!J.exists)return null;let X=Z.exists?Z.value:sG();return SB(EB(X,J.value))}async function bB($){let Z=await T9($);return s(Z.value)?Z.value:{}}function hB($){return Object.fromEntries(Object.entries($).filter(([,Z])=>Z!==void 0))}function gB($){return s6({id:$.id,label:$.label,type:$.type,enabled:$.enabled,addedAt:$.addedAt,baseURL:$.type==="api"?$.baseURL:void 0,authHeader:$.type==="api"?$.authHeader:void 0,claustrumScopedCredentialId:$.type==="oauth"?$.claustrumScopedCredentialId:void 0,anthropicAccountUuid:$.type==="oauth"&&$.claustrumScopedCredentialId?$.anthropicAccountUuid:void 0})}function X2($){if($.type==="api")return s6({apiKey:$.apiKey,lastUsed:$.lastUsed});return s6({authLineageId:$.authLineageId,anthropicAccountUuid:$.anthropicAccountUuid,claustrumScopedCredentialId:$.claustrumScopedCredentialId,claustrumScopedState:$.claustrumScopedState,access:$.access,refresh:$.refresh,expires:$.expires,lastUsed:$.lastUsed,lastRefreshedAt:$.lastRefreshedAt,lastRefreshError:$.lastRefreshError,lastQuotaRefreshError:$.lastQuotaRefreshError,quota:$.quota,profile:$.profile,prime:$.prime})}function Q4($){return Math.max($?.five_hour?.checkedAt??0,$?.seven_day?.checkedAt??0,...$?.scoped?.map((Z)=>Z.checkedAt)??[],$?.checkedAt??0)}function v8($){if($?.source==="poll")return 2;if($?.source==="headers")return 1;return 0}function yB($,Z){if(!("scoped"in $))return Z.scoped;if(!Array.isArray($.scoped)||$.scoped.length===0)return $.scoped;if(!Array.isArray(Z.scoped)||Z.scoped.length===0)return $.scoped;let J=new Map(Z.scoped.map((X)=>[X.id,X]));for(let X of $.scoped){let Y=J.get(X.id);if(!Y||X.checkedAt>=Y.checkedAt)J.set(X.id,X)}return[...J.values()]}function gX($,Z,J){let X=$[J],Y=Z[J];if(!Y)return X;if(!X)return Y;if(Y.checkedAt>X.checkedAt)return Y;if(Y.checkedAt<X.checkedAt)return X;return v8($)>v8(Z)?X:Y}function Q6($,Z){if(!$||$[Z]===void 0)return;return $.fieldSources?.[Z]??($.source==="poll"||$.source==="headers"?$.source:void 0)}function uB($,Z,J){let X={};for(let Y of i9){if(J[Y]===void 0)continue;if(Y==="scoped"||Y==="extraUsage"){X[Y]="poll";continue}if(Y==="bindingWindow"&&$.bindingWindowSource==="poll"&&$.bindingWindow===J.bindingWindow){X[Y]="poll";continue}if(Y==="fallbackAdvised"&&Z.fieldSources?.fallbackAdvised===void 0){let z=Q6($,Y);if(z)X[Y]=z;continue}let G=Z[Y]===J[Y]?Q6(Z,Y):$[Y]===J[Y]?Q6($,Y):Q6($,Y)??Q6(Z,Y);if(G)X[Y]=G}return Object.keys(X).length>0?X:void 0}function A1($,Z){if(!$||Z.source!=="headers")return Z;let J=$.bindingWindowSource==="poll",X={...$,...Z,five_hour:gX($,Z,"five_hour"),seven_day:gX($,Z,"seven_day"),scoped:yB($,Z),extraUsage:$.extraUsage??Z.extraUsage,fallbackAdvised:Z.fieldSources?.fallbackAdvised!==void 0?Z.fallbackAdvised:$.fallbackAdvised??Z.fallbackAdvised,bindingWindow:J?$.bindingWindow:Z.bindingWindow??$.bindingWindow,bindingWindowSource:J?"poll":Z.bindingWindowSource??$.bindingWindowSource},Y=uB($,Z,X);return{...X,...Y&&{fieldSources:Y}}}function a2($,Z){if(!s($))return Z;let J={...Z},X=$,Y=Boolean(X.access&&J.access&&X.access!==J.access||X.refresh&&J.refresh&&X.refresh!==J.refresh),G=Boolean(!Y&&J.quota?.source==="headers"),z=G&&J.quota?{...J,quota:A1(X.quota,J.quota)}:J;if(X.refresh===MZ("anthropic")&&(typeof z.access==="string"&&z.access.length>0||typeof z.refresh==="string"&&z.refresh!==MZ("anthropic"))&&(!z.authLineageId||z.authLineageId===X.authLineageId)){d.warn("accounts","discarded stale credential write over a custody tombstone");let{access:j,refresh:H,expires:q,...N}=z;return a2(X,N)}let Q=(()=>{let j=X.lastRefreshError,H=z.lastRefreshError;if(!j)return H;if(H)return H.checkedAt>=j.checkedAt?H:j;return(z.lastRefreshedAt??0)>(X.lastRefreshedAt??0)?void 0:j})(),K=Q4(X.quota),W=Q4(z.quota),V=Boolean(K===W&&v8(X.quota)>v8(z.quota));if(!G&&(K>W||V)){let j=X.lastRefreshedAt??0,H=z.lastRefreshedAt??0;if(Y&&H<=j){let N={...X};if(typeof z.lastUsed==="number"&&(typeof X.lastUsed!=="number"||z.lastUsed>X.lastUsed))N.lastUsed=z.lastUsed;return N}let q={...X,...z};if(Y){if(!("profile"in z))delete q.profile;if(z.quota?.source)q.quota=z.quota;else delete q.quota;if(!("lastQuotaRefreshError"in z))delete q.lastQuotaRefreshError;return q.lastRefreshError=Q,q}return{...q,quota:X.quota,lastQuotaRefreshError:X.lastQuotaRefreshError,lastRefreshError:Q}}let B={...X,...z};if(Y){if(!("profile"in z))delete B.profile;if(!z.quota?.source)delete B.quota}if(!("lastQuotaRefreshError"in z))delete B.lastQuotaRefreshError;return B.lastRefreshError=Q,B}function mB($){let Z=$.refresh?s6({enabled:$.refresh.enabled,intervalMinutes:$.refresh.intervalMinutes,refreshBeforeExpiryMinutes:$.refresh.refreshBeforeExpiryMinutes}):void 0,J=$.quota?s6({enabled:$.quota.enabled,checkIntervalMinutes:$.quota.checkIntervalMinutes,refreshEveryNRequests:$.quota.refreshEveryNRequests,minimumRemaining:$.quota.minimumRemaining,failClosedOnUnknownQuota:$.quota.failClosedOnUnknownQuota,showToasts:$.quota.showToasts}):void 0;return hB({version:1,mainAccountId:$.mainAccountId,main:{type:"opencode",provider:"anthropic"},routing:$.routing,fallbackOn:$.fallbackOn,refresh:Z,quota:J,quotaHeaderFeed:$.quotaHeaderFeed,claudeCache:$.claudeCache,dump:$.dump,logging:$.logging,claudeFast:$.claudeFast,thinkingBinding:$.thinkingBinding,costZeroing:$.costZeroing,cacheKeep:$.cacheKeep,relay:$.relay,claustrum:$.claustrum,killswitch:$.killswitch,prime:(()=>{if(typeof $.prime?.enabled!=="boolean")return;return{enabled:$.prime.enabled}})(),accounts:$.accounts.map(gB)})}function C4($){return $?.claustrum?.mode==="claustrum"?"claustrum":"local"}var yX=Promise.resolve();function pB($){return new Promise((Z,J)=>{yX=yX.then(()=>$().then(Z,J),()=>$().then(Z,J))})}async function nG($,Z){await N1(x1($),{recursive:!0});let J=`${$}.${j9()}.tmp`;await r7(J,`${JSON.stringify(Z,null,2)}
+`,{encoding:"utf8",mode:384});try{await yG(J,$)}catch(X){throw await H8(J,{force:!0}).catch(()=>{}),X}}var cB=Symbol("writeClaustrumMode"),oG=Symbol("mutateAccountRoster");function uX($,Z){return $.id===Z.id||Boolean($.label&&Z.label&&$.label===Z.label)}function rG($,Z,J){let X=new Set(J.removedAccountIds??[]),Y=$.filter((W)=>!X.has(W.id)),G=Z.filter((W)=>!X.has(W.id)),z=Y.filter((W)=>!G.some((V)=>uX(V,W)));if(!z.length)return[...G];if(J.preserveExistingAccountOrder===!1)return[...G,...z];let Q=new Set,K=Y.map((W)=>{let V=G.findIndex((j,H)=>!Q.has(H)&&uX(j,W)),B=G[V];if(!B)return W;return Q.add(V),B});for(let W=0;W<G.length;W++){let V=G[W];if(!Q.has(W)&&V)K.push(V)}return K}function lB($,Z,J){let X=rG($.filter(d2),Z.filter(d2),J),Y=new Map(X.map((z)=>[z.id,z])),G=$.flatMap((z)=>{if(E$(z))return[z];let Q=Y.get(z.id);if(!Q)return[];return Y.delete(z.id),[Q]});return G.push(...Y.values()),G}var iB=1e4,dB=12000,sB=1e4,tB=12000;async function eG($){let{path:Z,name:J,ttlMs:X,waitMs:Y,description:G}=$;await N1(x1(Z),{recursive:!0});let z=Date.now()+Y;while(!0){let Q=await t6({name:J,ttlMs:X,path:Z,renew:!0});if(Q)return Q;if(Date.now()>=z)throw Error(`Timed out waiting for the account ${G} lock`);await new Promise((K)=>setTimeout(K,25))}}function aB($){return eG({path:$,name:"config-write",ttlMs:iB,waitMs:dB,description:"configuration write"})}function nB($){return eG({path:$,name:"state-write",ttlMs:sB,waitMs:tB,description:"state write"})}function oB($,Z,J={}){let X=ZB($);return pB(async()=>{let Y=await aB(X);try{let G=await V6(X)??sG(),z=Z(G);if(z.save!==!1)await J.assertAuthority?.(),await rB(z.storage,X,{...z.options,[oG]:!0});return z.result}finally{await Y.release()}})}async function rB($,Z,J){let X=await V6(Z),Y=X?.claustrum?.scopedRoster===!0&&!J[oG],G=Y?{...J,removedAccountIds:J.removedAccountIds?.filter((V)=>X?.accounts.some((B)=>B.id===V&&d2(B)))}:J,z={...$,...$.claustrum&&{claustrum:{...X?.claustrum,...$.claustrum,...Y&&X?.claustrum,...J[cB]?{mode:$.claustrum.mode}:X?.claustrum?.mode?{mode:X.claustrum.mode}:{}}},...!$.claustrum&&X?.claustrum&&{claustrum:X.claustrum},accounts:Y?lB(X?.accounts??[],$.accounts,G):rG(X?.accounts??[],$.accounts,G)},K={...await bB(Z),...mB(z)};if(!z.claustrum)delete K.claustrum;await nG(Z,K);let W=await nB(Z);try{await Yq(z,Z,{mainQuota:!0,mainRefresh:!0,accounts:!0})}finally{await W.release()}}function eB($,Z){$.main=$.main??{},$.main.profile=Z.main?.profile}function $q($,Z){$.main=$.main??{};let J=Z.quota?.mainLastQuotaApiError,X=typeof Z.quota?.mainQuotaErrorGeneration==="number"&&Number.isSafeInteger(Z.quota.mainQuotaErrorGeneration)&&Z.quota.mainQuotaErrorGeneration>=0?Z.quota.mainQuotaErrorGeneration:void 0,Y=typeof Z.quota?.mainQuotaErrorClearedAt==="number"&&Number.isFinite(Z.quota.mainQuotaErrorClearedAt)&&Z.quota.mainQuotaErrorClearedAt>=0?Z.quota.mainQuotaErrorClearedAt:void 0,G=typeof $.main.quotaErrorGeneration==="number"&&Number.isSafeInteger($.main.quotaErrorGeneration)&&$.main.quotaErrorGeneration>=0?$.main.quotaErrorGeneration:0,z=typeof $.main.lastQuotaApiError?.checkedAt==="number"&&Number.isFinite($.main.lastQuotaApiError.checkedAt)&&$.main.lastQuotaApiError.checkedAt>=0?$.main.lastQuotaApiError.checkedAt:void 0,Q=typeof $.main.quotaErrorClearedAt==="number"&&Number.isFinite($.main.quotaErrorClearedAt)&&$.main.quotaErrorClearedAt>=0?$.main.quotaErrorClearedAt:void 0,K=Math.max(z??0,Q??0),W=typeof J?.checkedAt==="number"&&Number.isFinite(J.checkedAt)&&J.checkedAt>=0?J.checkedAt:void 0;if(J===void 0&&Y!==void 0&&Y>=K){if($.main.lastQuotaApiError=void 0,$.main.quotaErrorClearedAt=L8(Q,Y),X!==void 0&&X>=G)$.main.quotaErrorGeneration=X}else if(J&&typeof J.checkedAt==="number"&&Number.isFinite(J.checkedAt)&&J.checkedAt>K){let L=W!==void 0&&W>K,D=W!==void 0&&W===K&&z!==void 0&&Q===void 0&&X!==void 0&&X>=G,w=W===void 0&&Y===void 0&&X!==void 0&&X>=G&&Q===void 0;if(L||D||w){if($.main.lastQuotaApiError=J,X!==void 0)$.main.quotaErrorGeneration=Math.max(G,X)}}let V=Z.quota?.mainQuota,B=Boolean($.main.quotaToken&&Z.quota?.mainQuotaToken&&$.main.quotaToken===Z.quota.mainQuotaToken),j=B&&V?.source==="headers"?A1($.main.quota,V):V,H=Boolean(B&&V?.source==="headers"),q=Q4($.main.quota),N=Q4(j);if(!H&&(q>N||q===N&&v8($.main.quota)>v8(j)))return;$.main.quota=j;let U=Q4(j);$.main.quotaCheckedAt=U>0?U:void 0,$.main.quotaToken=Z.quota?.mainQuotaToken}function Zq($,Z){$.main=$.main??{};let J=Z.refresh?.mainLastRefreshError,X=Z.refresh?.mainRefreshErrorClearedAt,Y=$.main.lastRefreshError?.checkedAt,G=$.main.refreshErrorClearedAt,z=Math.max(Y??0,G??0);if(J===void 0&&X!==void 0&&X>=z)$.main.lastRefreshError=void 0,$.main.refreshErrorClearedAt=kB(G,X);else if(J&&typeof J.checkedAt==="number"&&Number.isFinite(J.checkedAt)&&J.checkedAt>z)$.main.lastRefreshError=J;$.main.refreshLeaseId=Z.refresh?.mainRefreshLeaseId,$.main.refreshLeaseUntil=Z.refresh?.mainRefreshLeaseUntil,$.main.refreshLeaseTokenHash=Z.refresh?.mainRefreshLeaseTokenHash}function Jq($,Z){let J=Z.prime?.main,X=Z.prime?.mainAuthLineageId,Y=Z.prime?.mainAuthLineageRefreshTokenFingerprint;if(!J&&!X&&!Y)return;if($.main=$.main??{},J)$.main.prime=J;if(X)$.main.primeAuthLineageId=X;if(Y)$.main.primeAuthLineageRefreshTokenFingerprint=Y}function n2($){if(Array.isArray($))return $.map(n2);if(!s($))return $;return Object.fromEntries(Object.entries($).filter(([,Z])=>Z!==void 0).map(([Z,J])=>[Z,n2(J)]))}function Xq($,Z){if(!s($.main))$.main={};let J=$.main;if(!Z||J.scopedAccountIdentity!==Z)delete J.prime,delete J.primeAuthLineageId,delete J.primeAuthLineageRefreshTokenFingerprint,delete J.quotaErrorGeneration,delete J.quotaErrorClearedAt;if(J.scopedAccountIdentity=Z,!Z||J.quota?.accountIdentity!==Z)delete J.quota,delete J.quotaCheckedAt,delete J.quotaToken;if(!Z||J.lastQuotaApiError?.accountIdentity!==Z)delete J.lastQuotaApiError;if(!Z||(J.profile?.providerAccountUuid??J.profile?.accountIdentity)!==Z)delete J.profile,delete J.profileToken;delete J.lastRefreshError,delete J.refreshErrorClearedAt,delete J.refreshLeaseId,delete J.refreshLeaseUntil,delete J.refreshLeaseTokenHash}async function Yq($,Z,J){let X=P1(Z),Y=(await T9(X)).value,G=s(Y)?{...Y,version:1}:{version:1},z=(await T9(Z)).value,Q=s(z)?tG(z.claustrum):void 0,K=Q?.mode==="claustrum"&&Q.scopedRoster===!0,W=Q?.primaryAccount?.accountId,V=Boolean(W&&$.claustrum?.primaryAccount?.accountId===W);if(K)Xq(G,W);let B=$.main?.profile?.providerAccountUuid??$.main?.profile?.accountIdentity;if(J.mainProfile&&(!K||V&&(!$.main?.profile||B===W)))eB(G,$);let j=V&&(!$.quota?.mainQuota||$.quota.mainQuota.accountIdentity===W)&&(!$.quota?.mainLastQuotaApiError||$.quota.mainLastQuotaApiError.accountIdentity===W);if(J.mainQuota&&(!K||j))$q(G,K?{...$,quota:{...$.quota,mainQuotaToken:W}}:$);if(J.mainRefresh&&!K)Zq(G,$);if(J.mainPrime&&(!K||V))Jq(G,$);if(J.accounts){let H=J.accounts===!0?null:new Set(J.accounts),q=z,N=s(q)&&Array.isArray(q.accounts)?new Map(q.accounts.filter(s).map((L)=>[String(L.id??"").trim(),L])):new Map,U=(()=>{if(!s(q)||!Array.isArray(q.accounts))return null;if(q.accounts.length===0)return new Set;let L=s(G.accounts)?G.accounts:{},D=Object.fromEntries($.accounts.map((O)=>[O.id.trim(),X2(O)])),w=q.accounts.map((O)=>{if(!s(O)||typeof O.id!=="string")return null;let x=O.id.trim();if(!x)return null;if(fB(O))return null;let C=L[O.id]??L[x],v=s(C)?C:{},k=D[x];return dG(aG(O,k??v))?[O.id,x]:null});return w.every((O)=>O!==null)?new Set(w.flatMap((O)=>O??[])):null})();G.accounts={...s(G.accounts)?G.accounts:{}};for(let L of $.accounts){let D=L.id.trim();if(H&&!H.has(L.id)&&!H.has(D))continue;if(U&&!U.has(L.id)&&!U.has(D))continue;let w=Object.keys(G.accounts).filter((v)=>v!==D&&v.trim()===D),O=w[0],x=G.accounts[D]??(O?G.accounts[O]:void 0);for(let v of w)delete G.accounts[v];let C=N.get(D);if(C&&typeof C.claustrumScopedCredentialId==="string"&&typeof C.anthropicAccountUuid==="string"){let v=(P)=>s(P)&&P.claustrumScopedCredentialId===C.claustrumScopedCredentialId&&P.anthropicAccountUuid===C.anthropicAccountUuid,k=X2(L),m=a2(v(x)?x:void 0,v(k)?k:{});G.accounts[D]={...m,claustrumScopedCredentialId:C.claustrumScopedCredentialId,anthropicAccountUuid:C.anthropicAccountUuid,refresh:""};let l=G.accounts[D];delete l.access,delete l.expires,delete l.lastRefreshedAt,delete l.lastRefreshError}else{let v=a2(x,X2(L));if(C)delete v.claustrumScopedCredentialId,delete v.claustrumScopedState;G.accounts[D]=v}}if(U){for(let L of Object.keys(G.accounts))if(!U.has(L))delete G.accounts[L]}if(H){for(let L of H)if(!$.accounts.some((D)=>D.id===L))delete G.accounts[L]}}await nG(X,n2(G))}async function t6($){let J=`${$.path??B0()}.${$.name}.lock`,X=k8(J,"owner.json"),Y=j9(),G=$.now??Date.now,z=null,Q=!1;async function K(){try{return JSON.parse(await o7(J,"utf8"))}catch(H){if(H.code!=="EISDIR")throw H;return JSON.parse(await o7(X,"utf8"))}}async function W(){await r7(J,`${JSON.stringify({ownerId:Y,expiresAt:G()+$.ttlMs})}
+`,{encoding:"utf8",mode:384})}async function V(){try{return await r7(J,`${JSON.stringify({ownerId:Y,expiresAt:G()+$.ttlMs})}
+`,{encoding:"utf8",mode:384,flag:"wx"}),!0}catch(H){let q=H.code;if(q==="EEXIST"||q==="EISDIR")return!1;throw H}}function B(){if(!$.renew||Q)return;let H=$.renewIntervalMs??Math.max(1000,Math.floor($.ttlMs/3));if(z=xB(()=>{(async()=>{try{let q=await K(),N=G();if(Q||q?.ownerId!==Y||Number(q?.expiresAt)<=N)return;await W(),B()}catch{}})()},H),"unref"in z)z.unref()}let j=await V();if(!j){let H=`${J}.evicting`,q=k8(H,"owner.json"),N=j9(),U=5000,L=8;async function D(){await new Promise((v)=>setTimeout(v,Math.floor(Math.random()*4)))}async function w(){try{let v=await K();return Number(v?.expiresAt)>G()}catch{try{return(await TX(J)).mtimeMs+$.ttlMs>G()}catch{return!1}}}async function O(){try{return JSON.parse(await o7(q,"utf8"))?.ownerId===N}catch{return!1}}async function x(){await N1(H);try{await r7(q,`${JSON.stringify({ownerId:N,createdAt:G()})}
+`,{encoding:"utf8",mode:384,flag:"wx"})}catch(v){let k=v.code;if(k==="ENOENT"||k==="EINVAL")return!1;throw await C(),v}return await $.onStep?.("eviction-marker-acquired"),!0}async function C(){if(await O())await H8(H,{recursive:!0,force:!0}).catch(()=>{})}for(let v=0;v<8;v++){if(j=await V(),j)break;if(await w())return null;try{if(!await x()){await D();continue}}catch(k){if(k.code!=="EEXIST")throw k;let l;try{l=await TX(H)}catch(M){if(M.code==="ENOENT"){await D();continue}throw M}if(l.mtimeMs+5000>G())return null;await $.onStep?.("stale-marker-stat");let P=`${H}.${j9()}`;try{await yG(H,P)}catch(M){if(M.code==="ENOENT"){await D();continue}throw M}await $.onStep?.("stale-marker-claimed"),await H8(P,{recursive:!0,force:!0}).catch(()=>{}),await D();continue}try{if(await w())return null;if(!await O())return null;if(await $.onStep?.("stale-lock-confirmed"),!await O())return null;if(await H8(J,{recursive:!0,force:!0}).catch(()=>{}),!await O())return null;if(j=await V(),!j)return null;if(!await O())return await H8(J,{recursive:!0,force:!0}).catch(()=>{}),j=!1,null;break}finally{await C()}}}if(!j)return null;return B(),{assertOwned:async()=>{let H=await K().catch(()=>{return});if(Q||H?.ownerId!==Y)throw Error("Account file lock ownership was lost")},release:async()=>{if(Q=!0,z)DB(z),z=null;try{if((await K())?.ownerId!==Y)return}catch{return}await H8(J,{recursive:!0,force:!0}).catch(()=>{})}}}function kA($){return $?.claudeCache?.enabled===!0}function Gq($){return typeof $==="string"&&q1.includes($)?$:FG}function vA($){return Gq($?.claudeCache?.mode)}function fA($){return $?.dump?.enabled===!0}function EA($){return $?.claudeFast?.enabled===!0}function bA($){return $?.cacheKeep?.subagents===!0}function hA($){return $?.prime?.enabled===!0}function zq($){return $?.fallbackOn?.length?$.fallbackOn:MB}function gA($,Z){return zq(Z).includes($)}function R1($){let Z=$?.quota?.minimumRemaining||{};return{five_hour:Z.five_hour??Z["5h"]??vX.five_hour,seven_day:Z.seven_day??Z["1w"]??vX.seven_day}}function $z($){return $?.quota?.enabled!==!1}function Qq($){let Z=$.status;if(typeof Z==="number"&&Number.isFinite(Z))return Z===429||Z>=500;return h4($)}function Kq($){let J=($.previous?.accountIdentity===$.accountIdentity&&$.previous?.refreshTokenFingerprint===$.refreshTokenFingerprint?$.previous?.retryCount??0:0)+1,X=$.error.retryAfter,Y;if(typeof X==="number"&&X>0)Y=X*1000;else if(h4($.error))Y=s2;else if(Qq($.error))Y=Math.min(PB,s2*2**Math.min(J-1,6));else Y=iG;let G=$.error.status,z=typeof G==="number"&&Number.isFinite(G)?G:void 0,Q=q0($.error),W=(typeof $.error.body==="string"?$.error.body:"").includes("invalid_grant")||Q.includes("invalid_grant");return{message:Q,checkedAt:$.now,nextRetryAt:$.now+Y,retryCount:J,accountIdentity:$.accountIdentity,refreshTokenFingerprint:$.refreshTokenFingerprint,status:z,permanent:z===400&&W}}function PZ($){if(!$)return!1;if(typeof $.permanent==="boolean")return $.permanent;if(typeof $.status==="number")return $.status===400;if(h4($))return!1;if(typeof $.nextRetryAt==="number")return $.nextRetryAt-$.checkedAt>=iG;return!1}function Zz($){let Z=$.nextRetryAt;if(!Z||!h4($))return Z;return Math.min(Z,$.checkedAt+s2)}function yA($,Z,J,X){if(!$)return!1;let Y=Zz($);if(!Y||Y<=J)return!1;if($.refreshTokenFingerprint&&X&&$.refreshTokenFingerprint!==X)return!1;if(!$.accountIdentity)return!0;if(!Z)return!0;return $.accountIdentity===Z}function uA($,Z){return`Claude OAuth refresh is backed off for ${Math.max(1,Math.ceil(((Zz($)??Z)-Z)/1000))}s after: ${$.message}`}function mA($){if(!$)return[];return $.accounts.filter((Z)=>Z.enabled!==!1&&E$(Z)&&PZ(Z.lastRefreshError)).map((Z)=>Z.label?.trim()||Z.id)}function Wq($){if($.status===403)return!0;return/Claude quota check failed: 403\b/.test(q0($))}function o2($){let J=($.previous?.accountIdentity===$.accountIdentity?$.previous?.retryCount??0:0)+1,X=Uq($.error)?Math.min(wB,_B*2**Math.min(J-1,6)):AB;return{message:q0($.error),checkedAt:$.now,nextRetryAt:$.now+X,retryCount:J,...$.accountIdentity!==void 0&&{accountIdentity:$.accountIdentity}}}function T7($,Z){if(!$?.nextRetryAt||$.nextRetryAt<=Z)return!1;return!0}function pA($,Z){return`Quota API backed off for ${Math.max(1,Math.ceil((($.nextRetryAt??Z)-Z)/1000))}s after: ${$.message}`}function L9($){let Z=$?.quota?.checkIntervalMinutes??RB;return Math.max(1,Z)*60000}function cA($){return $?.logging?.level}function Vq($){let Z=$?.quota?.mainQuota;if(!Z)return null;return{quota:Z,checkedAt:Q4(Z),tokenFingerprint:$.quota?.mainQuotaToken,accountIdentity:Z.accountIdentity}}function Bq($){let Z=$?.quota?.refreshEveryNRequests;return typeof Z==="number"&&Number.isFinite(Z)&&Z>0?Math.floor(Z):0}function r2($){return $?.quota?.failClosedOnUnknownQuota??TB}function Jz($){return $.toLowerCase().replace(/[^a-z0-9]/g,"")}function qq($){if(typeof $!=="string")return null;let Z=Jz($);if(Z.includes("fable"))return"fable";if(Z.includes("mythos"))return"mythos";return Z}function n4($,Z){let J=qq(Z);if(!J)return;return $?.scoped?.find((X)=>{return[X.modelId,X.modelName,X.title].filter((G)=>typeof G==="string").map(Jz).join(" ").includes(J)})}function jq($,Z){let J=n4($,Z);return Boolean(J&&Number.isFinite(J.remainingPercent)&&J.remainingPercent<=0)}function Xz($,Z){return!jq($,Z)}function Hq($,Z){if(!$z(Z))return!0;let J=R1(Z);for(let X of["five_hour","seven_day"]){let Y=$?.[X];if(!Y)return!r2(Z);if(!Number.isFinite(Y.remainingPercent))return!r2(Z);if(Y.remainingPercent<J[X])return!1}return!0}function lA($){return Boolean($?.five_hour&&$.seven_day)}var P8={five_hour:5,seven_day:10,scoped:0};function _Z($){let Z=$?.five_hour??$?.["5h"],J=$?.seven_day??$?.["1w"],X=$?.scoped;return{five_hour:typeof Z==="number"&&Number.isFinite(Z)?Z:P8.five_hour,seven_day:typeof J==="number"&&Number.isFinite(J)?J:P8.seven_day,scoped:typeof X==="number"&&Number.isFinite(X)?X:P8.scoped}}function Yz($){return $?.killswitch?.enabled===!0}function Gz($,Z){if(!$?.killswitch)return P8;if(Z&&$.killswitch.accounts?.[Z])return _Z($.killswitch.accounts[Z]);return _Z($.killswitch.main)}function zz($,Z,J,X){if(!Yz(Z))return!0;let Y=Gz(Z,J),G=!1;for(let z of["five_hour","seven_day"]){let Q=$?.[z];if(!Q||!Number.isFinite(Q.remainingPercent)){if(Y[z]>0)return!1;G=!0;continue}if(Q.remainingPercent<Y[z])return!1}if(X){if(Y.scoped>0&&$?.scoped===void 0)return!1;let z=n4($,X);if(z&&(!Number.isFinite(z.remainingPercent)&&Y.scoped>0||z.remainingPercent<=Y.scoped))return!1}if(G)return!r2(Z);return!0}function Lq($,Z,J,X){let Y=[],G=[$,...Z.map((z)=>z.quota)];for(let z of G)if(X){let K=n4(z,X)?.resetsAt;if(!K)continue;let W=Date.parse(K);if(Number.isFinite(W)&&W>J)Y.push(W)}else for(let Q of["five_hour","seven_day"]){let K=z?.[Q]?.resetsAt;if(!K)continue;let W=Date.parse(K);if(Number.isFinite(W)&&W>J)Y.push(W)}if(!Y.length)return 300;return Math.max(1,Math.ceil((Math.min(...Y)-J)/1000))+60}function iA($){return $?.killswitch??{enabled:!1}}function W8($,Z,J){let X=L9(Z);if(!$z(Z))return J+X;let Y=Math.min(...[...["five_hour","seven_day"].map((K)=>$?.[K]?.checkedAt),...($?.scoped??[]).map((K)=>K.checkedAt)].filter((K)=>Number.isFinite(K)).map((K)=>K+X)),G=(K)=>Number.isFinite(Y)?Math.min(K,Y):K,z=R1(Z),Q=[];for(let K of["five_hour","seven_day"]){let W=$?.[K];if(!W)return G(J+X);if(W.remainingPercent>=z[K])continue;let V=W.resetsAt?Date.parse(W.resetsAt):Number.NaN;if(!Number.isFinite(V)||V<=J)return G(J+X);Q.push(V)}if(!Q.length)return G(J+X);return G(Math.min(...Q)+60000)}function Uq($){let Z=$.status;if(typeof Z==="number"&&Number.isFinite(Z)){if(Z===429||Z>=500)return!0}let J=q0($);if(/Claude quota check failed: (429|5\d\d)\b/.test(J))return!0;if(J.includes("Quota refresh is already in progress"))return!0;return h4($)}function wZ($){if(!Number.isFinite($))return 0;if($<0)return 0;if($>100)return 100;return $}function q6($){return typeof $==="string"&&$.trim()?$.trim():void 0}function Qz($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}function Nq($,Z){if(!Array.isArray($))return[];let J=new Set,X=[];for(let Y of $){if(Y?.kind!=="weekly_scoped"||Y.group!=="weekly")continue;if(typeof Y.percent!=="number"||!Number.isFinite(Y.percent))continue;let G=q6(Y.scope?.model?.display_name);if(!G)continue;let z=q6(Y.scope?.model?.id)??G,Q=Qz(z);if(!Q)continue;let K=`claude-weekly-scoped-${Q}`;if(J.has(K))continue;J.add(K);let W=wZ(Y.percent),V=q6(Y.scope?.model?.id);X.push({id:K,title:`${G} only`,...V&&{modelId:V},modelName:G,usedPercent:W,remainingPercent:wZ(100-W),resetsAt:Y.resets_at??void 0,checkedAt:Z})}return X}function xq($){if($.extra_usage?.is_enabled!==!0)return;let Z=$.extra_usage.used_credits,J=$.extra_usage.monthly_limit;if(typeof Z!=="number"||!Number.isFinite(Z)||typeof J!=="number"||!Number.isFinite(J))return;let X=$.spend?.limit?.currency,Y=X==null?"USD":q6(X),G=$.spend?.limit?.exponent,z=G==null?2:G;if(!Y||!/^[A-Za-z]{3}$/.test(Y)||!Number.isInteger(z)||z<0||z>20)return;return{used:{amountMinor:Z,currency:Y,exponent:z},limit:{amountMinor:J,currency:Y,exponent:z},...typeof $.extra_usage.utilization==="number"&&Number.isFinite($.extra_usage.utilization)&&{utilizationPercent:$.extra_usage.utilization},...q6($.spend?.severity)&&{severity:q6($.spend?.severity)},exhausted:Z>=J}}function Dq($){if(!Array.isArray($))return;let Z=$.find((G)=>G?.is_active===!0);if(!Z)return;if(Z.kind==="session")return"five_hour";if(Z.kind==="weekly_all")return"seven_day";if(Z.kind!=="weekly_scoped"||Z.group!=="weekly")return;let J=q6(Z.scope?.model?.display_name);if(!J)return;let X=q6(Z.scope?.model?.id)??J,Y=Qz(X);return Y?`claude-weekly-scoped-${Y}`:void 0}function mX($,Z){if(typeof $?.utilization!=="number")return;if(!Number.isFinite($.utilization))return;let J=wZ($.utilization);return{usedPercent:J,remainingPercent:wZ(100-J),resetsAt:$.resets_at??void 0,checkedAt:Z}}async function F9($){M1($.accessToken,"anthropic");let J=await($.fetchImpl??fetch)(IB,{method:"GET",headers:{Authorization:`Bearer ${$.accessToken}`,Accept:"application/json","Content-Type":"application/json","anthropic-beta":"oauth-2025-04-20","User-Agent":`claude-code/${l9}`}});if(!J.ok){let K=await J.text().catch(()=>"");throw Object.assign(Error(`Claude quota check failed: ${J.status} — ${K}`),{status:J.status,retryAfter:cG(J.headers.get("Retry-After"))})}let X=$.now?.()??Date.now(),Y=await J.json(),G=Dq(Y.limits),z={five_hour:mX(Y.five_hour,X),seven_day:mX(Y.seven_day,X),scoped:Nq(Y.limits,X),extraUsage:xq(Y),...G&&{bindingWindow:G,bindingWindowSource:"poll"},source:"poll",checkedAt:X},Q={...z.five_hour&&{five_hour:"poll"},...z.seven_day&&{seven_day:"poll"},...z.scoped&&{scoped:"poll"},...z.extraUsage&&{extraUsage:"poll"},...z.bindingWindow&&{bindingWindow:"poll"}};return{...z,...Object.keys(Q).length>0&&{fieldSources:Q}}}function dA($,Z){if(!$||$.authLineageId!==Z)return null;return $.anthropicAccountUuid??null}function q0($){return $ instanceof Error?$.message:String($)}a4();var Kz="## Claude Cache Status",Oq="## Claude Cache Enabled",Iq="## Claude Cache Disabled",Mq="## Claude Cache Usage",Pq="Usage: `/claude-cache`, `/claude-cache on`, `/claude-cache off`, or `/claude-cache mode explicit|automatic|hybrid`.",j0=!1,H0=FG;function sA(){return j0}function tA(){return H0}function aA($){j0=$.enabled,H0=$.mode}function _q($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="on")return{type:"enable"};if(Z.length===1&&Z[0]==="off")return{type:"disable"};if(Z.length===2&&Z[0]==="mode"&&(Z[1]==="explicit"||Z[1]==="automatic"||Z[1]==="hybrid"))return{type:"mode",mode:Z[1]};return{type:"usage"}}function o8($){let Z=$?.enabled??j0,J=$?.mode??H0;return[Kz,"",`- Enabled: ${Z?"enabled":"disabled"}`,`- Mode: ${J}`,"- Persisted: ~/.config/opencode/anthropic-auth.json","- Scope: main sessions only; subagent sessions keep default ephemeral cache behavior","- Modes: explicit = existing OpenCode breakpoints; automatic = top-level cache_control only; hybrid = system + messages[0] + top-level cache_control","- TTL: 1h when enabled for main sessions; default ephemeral cache behavior otherwise"].join(`
+`)}function nA($){let Z=_q($.argumentsText),J=$.enabled??j0,X=$.mode??H0;if(Z.type==="status")return o8({enabled:J,mode:X});if(Z.type==="enable")return[Oq,"",o8({enabled:!0,mode:X})].join(`
+`);if(Z.type==="disable")return[Iq,"",o8({enabled:!1,mode:X})].join(`
+`);if(Z.type==="mode")return[Kz,"",`Mode updated to \`${Z.mode}\`.`,"",o8({enabled:J,mode:Z.mode})].join(`
+`);return[Mq,"",Pq,"",o8({enabled:J,mode:X})].join(`
+`)}a4();var Aq=/^req_[A-Za-z0-9_-]{8,128}$/,Rq=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,Tq=/ cc_(?:prev_req|prompt_id)=[^;\r\n]*;/g;function Fq($){return Aq.test($)}function Cq($){return Rq.test($)}var Sq=0x4d659218e32a3268n,kq="cch=00000;";var T1=/("system":\[\{"type":"text","text":"x-anthropic-billing-header: cc_version=[^;"]+; cc_entrypoint=[^;"]+; )cch=([0-9a-f]{5});/,vq=/("system":\[\{"type":"text","text":"x-anthropic-billing-header: cc_version=[^;"]+; cc_entrypoint=[^;"]+; )cch=00000;/,pX=null,AZ=null;async function Wz(){if(AZ)return;pX??=(async()=>{AZ=(await vJ()).h64Raw})(),await pX}function Vz($){let Z=$.find((X)=>X.role==="user");if(!Z)return"";let{content:J}=Z;if(typeof J==="string")return J;if(Array.isArray(J)){let X=J.filter((z)=>z.type==="text"),Y=X.find((z)=>z.text?.includes("<command-name>"));if(Y?.text)return Y.text.slice(Y.text.indexOf("<command-name>"));let G=X.findLast((z)=>typeof z.text==="string"&&z.text.length>0);if(G?.text)return G.text}return""}class fq{limit;#$=new Map;constructor($=1000){this.limit=$}resolve($,Z,J=!0){let X=this.#$.get($);if(X!==void 0)return this.#$.delete($),this.#$.set($,X),X;let Y=Vz(Z);if(J){if(!this.#$.has($)&&this.#$.size>=this.limit){let G=this.#$.keys().next().value;if(G!==void 0)this.#$.delete(G)}this.#$.set($,Y)}return Y}has($){return this.#$.has($)}clear(){this.#$.clear()}}async function Eq($){return await Wz(),((AZ?.($,Sq)??0n)&0xfffffn).toString(16).padStart(5,"0")}async function eA($){return await Wz(),(AZ?.(new TextEncoder().encode($),0n)??0n).toString(16).padStart(16,"0").slice(0,16)}function bq($){return $.replace(T1,`$1${kq}`)}function hq($){return T1.exec($)?.[2]??null}async function gq($){if(!T1.test($))return $;let Z=bq($),J=JSON.parse(Z);if("model"in J)J.model="";delete J.max_tokens;let X=await Eq(new TextEncoder().encode(JSON.stringify(J)));return Z.replace(vq,`$1cch=${X};`)}function yq($,Z=l9){let J=AG.map((X)=>$[X]??"0").join("");return wq("sha256").update(`${uV}${J}${Z}`).digest("hex").slice(0,3)}function $R($,Z=l9,J,X,Y){let G=yq(X??Vz($),Z),z=`x-anthropic-billing-header: cc_version=${Z}.${G}; cc_entrypoint=${J}; cch=00000;`;if(Y?.previousRequestId&&Fq(Y.previousRequestId))z+=` cc_prev_req=${Y.previousRequestId};`;if(Y?.promptId&&Cq(Y.promptId))z+=` cc_prompt_id=${Y.promptId};`;return z}function uq($){return $.replace(Tq,"")}function mq($){if(!$||typeof $!=="object")return 0;let Z=$.system;if(!Array.isArray(Z))return 0;let J=0;for(let X of Z){if(!X||typeof X!=="object")continue;let Y=X.text;if(typeof Y!=="string"||!Y.startsWith("x-anthropic-billing-header:"))continue;let G=uq(Y);if(G===Y)continue;X.text=G,J+=1}return J}a4();var cq=1000,U$=new Map;function L4($,Z,J,X=cq){if(!$.has(Z)&&$.size>=X){let Y=$.keys().next().value;if(Y!==void 0)$.delete(Y)}$.set(Z,J)}function Y2($,Z){if(!Z.accountUuid)return Z;if(U$.get($)!==Z)return{...Z,accountUuid:void 0};let J={...Z,accountUuid:void 0};return L4(U$,$,J),J}function RZ($){let Z=$||"anonymous",J=U$.get(Z);if(J)return J;let X={deviceId:pq(32).toString("hex"),sessionId:Bz()};return L4(U$,Z,X),X}var lq=86400000,iq=300000,F7=new Map,cX=new Map;function dq($){return`compat:${$||"anonymous"}`}function F1($){return`identity:${$}`}function TZ($,Z){return`account:${$}:${Z}`}function C7($,Z,J){if(!$)return;if($.accountIdentity!==void 0&&$.accountIdentity!==Z)return;if(J!==void 0&&$.accountUuid!==void 0&&$.accountUuid!==J)return;if($.accountIdentity===Z&&(J===void 0||$.accountUuid===J))return $;return{...$,accountIdentity:Z,...J!==void 0&&{accountUuid:J}}}function K9($,Z,J){L4(U$,F1(Z),$),L4(U$,TZ(J,Z),$)}async function sq($,Z){if(!$.startsWith("sk-ant-oat"))return null;let J=new AbortController,X=setTimeout(()=>J.abort(),5000);try{let Y=new URL("https://api.anthropic.com/api/claude_cli/bootstrap");if(Y.searchParams.set("entrypoint",RG),Z)Y.searchParams.set("model",Z);let G=await fetch(Y,{method:"GET",redirect:"error",headers:{accept:"application/json, text/plain, */*",authorization:`Bearer ${$}`,"content-type":"application/json","anthropic-beta":"oauth-2025-04-20","user-agent":`claude-code/${l9}`},signal:J.signal});if(!G.ok)return null;let Q=(await G.json().catch(()=>null))?.oauth_account?.account_uuid;return typeof Q==="string"&&Q?Q:null}catch{return null}finally{clearTimeout(X)}}function JR($,Z){if(!$.trim()||!Z.trim())throw Error("A verified provider account identity is required");let X={...U$.get(TZ(Z,$))??RZ(F1($)),accountIdentity:$,accountUuid:Z};return K9(X,$,Z),X}async function qz($,Z,J){let X=J?.trim()||void 0,Y=X?F1(X):dq($),G;if(X)G=C7(U$.get(Y)??U$.get($),X)??RZ(Y),G=C7(G,X)??G,L4(U$,Y,G);else G=U$.get(Y)??U$.get($)??RZ(Y),L4(U$,Y,G),L4(U$,$,G);if(!$.startsWith("sk-ant-oat"))return Y2(Y,G);let z=Date.now(),Q=`${Y}:${$}`,K=cX.get(Q);if(K&&K.expiresAt>z){if(!K.accountUuid)return G=Y2(Y,G),G;if(!X){if(G.accountUuid===K.accountUuid)return G;return G={...G,accountUuid:K.accountUuid},L4(U$,Q,G),G}let j=C7(U$.get(TZ(K.accountUuid,X))??U$.get(`account:${K.accountUuid}`),X,K.accountUuid);if(j)return G=j,K9(G,X,K.accountUuid),G;if(G.accountUuid===K.accountUuid)return G;return G={...G,accountIdentity:X,accountUuid:K.accountUuid},K9(G,X,K.accountUuid),G}let W=F7.get(Q);if(!W)W=sq($,Z),L4(F7,Q,W);let V=await W.finally(()=>{if(F7.get(Q)===W)F7.delete(Q)});if(L4(cX,Q,{accountUuid:V,expiresAt:z+(V?lq:iq)}),!V)return G=Y2(Y,G),G;if(!X)return G={...G,accountUuid:V},L4(U$,Q,G),G;let B=C7(U$.get(TZ(V,X))??U$.get(`account:${V}`),X,V);if(B)return G=B,K9(G,X,V),G;return G={...G,accountIdentity:X,accountUuid:V},K9(G,X,V),G}class C1 extends Error{code="unsupported-access";constructor(){super("Claude OAuth access credential is not supported; sign in to this account again");this.name="ClaudeUnsupportedAccessError"}}async function tq($,Z,J){if(typeof $!=="string"||!$.startsWith("sk-ant-oat"))throw new C1;return qz($,Z,J)}function h6($){return $!=null&&typeof $==="object"&&!Array.isArray($)}function aq($){if(!$.accountUuid)return null;return JSON.stringify({device_id:$.deviceId,account_uuid:$.accountUuid,session_id:$.sessionId})}function XR($,Z){let J=aq(Z);if(!J){if(h6($.metadata))delete $.metadata.user_id;return!1}if(!h6($.metadata))$.metadata={};let X=$.metadata;if(h6(X))X.user_id=J;return!0}var nq=["oauth-2025-04-20","interleaved-thinking-2025-05-14","thinking-token-count-2026-05-13","context-management-2025-06-27","prompt-caching-scope-2026-01-05","claude-code-20250219","advisor-tool-2026-03-01","advanced-tool-use-2025-11-20","mid-conversation-system-2026-04-07","effort-2025-11-24","fallback-credit-2026-06-01","extended-cache-ttl-2025-04-11","cache-diagnosis-2026-04-07"],oq=["oauth-2025-04-20","interleaved-thinking-2025-05-14","thinking-token-count-2026-05-13","context-management-2025-06-27","prompt-caching-scope-2026-01-05","advisor-tool-2026-03-01","structured-outputs-2025-12-15","cache-diagnosis-2026-04-07"],lX=["oauth-2025-04-20","interleaved-thinking-2025-05-14","thinking-token-count-2026-05-13","context-management-2025-06-27","prompt-caching-scope-2026-01-05","advisor-tool-2026-03-01","advanced-tool-use-2025-11-20","extended-cache-ttl-2025-04-11","cache-diagnosis-2026-04-07"];function rq($){return $.output_config?.format?.type==="json_schema"}function eq($){return Array.isArray($.tools)&&$.tools.length>0&&Array.isArray($.system)&&h6($.thinking)&&h6($.context_management)&&h6($.output_config)&&h6($.diagnostics)}function $j($,Z=[]){let J=$?eq($)?[...nq]:rq($)?[...oq]:[...lX]:[...lX];if($?.speed==="fast")J.push(gV);for(let X of Z){let Y=X.trim();if(Y)J.push(Y)}return[...new Set(J)].join(",")}function Zj(){switch(process.platform){case"darwin":return"MacOS";case"win32":return"Windows";case"linux":return"Linux";case"freebsd":return"FreeBSD";default:return"Unknown"}}function Jj(){switch(process.arch){case"arm64":return"arm64";case"x64":return"x64";case"ia32":return"x32";default:return process.arch}}function YR($,Z,J={}){let X=J.identity??RZ(Z),G=[...($.get("anthropic-beta")??"").split(",").map((z)=>z.trim()).filter(Boolean),...J.extraBetas??[]];return $.set("accept","application/json"),$.set("authorization",`Bearer ${Z}`),$.set("content-type","application/json"),$.set("user-agent",TG),$.set("anthropic-beta",$j(J.body,G)),$.set("anthropic-dangerous-direct-browser-access","true"),$.set("anthropic-version","2023-06-01"),$.set("x-app","cli"),$.set("x-client-request-id",Bz()),$.set("x-claude-code-session-id",X.sessionId),$.set("x-stainless-arch",Jj()),$.set("x-stainless-lang","js"),$.set("x-stainless-os",Zj()),$.set("x-stainless-package-version",mV),$.set("x-stainless-retry-count","0"),$.set("x-stainless-runtime","node"),$.set("x-stainless-runtime-version",pV),$.set("x-stainless-timeout","600"),$.delete("x-api-key"),$}var Xj=["model","messages","system","tools","tool_choice","metadata","max_tokens","temperature","thinking","context_management","output_config","diagnostics","stream","speed"];function Yj($){let Z={};for(let J of Xj)if(Object.hasOwn($,J))Z[J]=$[J];for(let[J,X]of Object.entries($))if(!Object.hasOwn(Z,J))Z[J]=X;return Z}Y4();var Bj="## Claude Dump Status",qj="## Claude Dump Enabled",jj="## Claude Dump Disabled",Hj="## Claude Dump Usage",Lj="Usage: `/claude-dump`, `/claude-dump on`, or `/claude-dump off`.",Uj="OPENCODE_ANTHROPIC_AUTH_DUMP_DIR",Nj="OPENCODE_ANTHROPIC_AUTH_DUMP_MAX_BYTES",xj=L0(Vj(),"opencode-anthropic-auth-dumps"),Dj=536870912,Oj=300000,Ij=60000,Mj=600000,S1=/\.(body|meta|relay|request|response)\.json$/,Lz=/^\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z-\d{5,}-(.+)$/,FZ="[a-zA-Z0-9._-]",Uz=new RegExp(`^${FZ}{1,80}-direct(?:-${FZ}{1,80})?$`),Nz=new RegExp(`^${FZ}{1,80}-(?:http|websocket)-p[12]-(?:full_sync|patch)$`),Pj=new RegExp(`^-direct(?:-${FZ}{1,80})?$`),_j=/^-(?:http|websocket)-p[12]-(?:full_sync|patch)$/,d9=!1,dX=0,sX=0,wj=100,U8=new Map;function WR($){d9=$}function s9(){return process.env[Uj]||xj}function Aj(){let $=Number(process.env[Nj]);return Number.isFinite($)&&$>=0?Math.floor($):Dj}function Rj($){return U9($)===U9(s9())}function $5($){let Z=$.replace(S1,"");if(Z===$)return!1;let X=Lz.exec(Z)?.[1];if(!X)return!1;return Uz.test(X)||Nz.test(X)}function Tj($){if(!$.endsWith(".partial"))return!1;let Z=$.slice(0,-8);if($5(Z))return!0;let J=Z.lastIndexOf(".");if(J<0)return!1;let X=Z.slice(J+1);return/^[a-f0-9]{24}$/.test(X)&&$5(Z.slice(0,J))}async function W9($,Z){for(let J=0;J<2;J+=1){let X=zj(12).toString("hex"),Y=`${$}.${X}.partial`,G=!1;try{return await Wj(Y,Z,{encoding:"utf8",flag:"wx"}),G=!0,await Kj(Y,$),!0}catch(z){if(z.code==="EEXIST")continue;if(G)await Hz(Y).catch(()=>{});throw z}}return!1}async function Fj($){let Z=$.dumpDir??s9(),J=$.maxBytes??Aj(),X=$.now??Date.now(),Y=$.minAgeMs??Ij,G=$.partialStaleMs??Mj,z={removed:0,freedBytes:0};if(!Rj(Z)||J<=0)return z;try{if((await e2(Z)).isSymbolicLink())return z;let K=new Set(($.protectedPaths??[]).map((D)=>U9(D))),W=await jz(Z,{withFileTypes:!0}),V=[];await Promise.all(W.map(async(D)=>{if(!D.isFile())return;let w=Tj(D.name);if(!w&&!$5(D.name))return;let O=L0(Z,D.name);try{let x=await e2(O);if(!x.isFile()||x.isSymbolicLink())return;V.push({path:O,size:x.size,mtimeMs:x.mtimeMs,partial:w,...!w&&{artifactGroup:D.name.replace(S1,"")}})}catch{}}));let B=V.reduce((D,w)=>D+w.size,0),j=0,H=0,q=async(D)=>{try{await Hz(D.path),B-=D.size,H+=D.size,j+=1}catch{}},N=V.filter((D)=>D.partial).sort((D,w)=>D.mtimeMs-w.mtimeMs||D.path.localeCompare(w.path));for(let D of N){if(K.has(U9(D.path)))continue;if(X-D.mtimeMs<G)continue;await q(D)}let U=new Map;for(let D of V){if(D.partial||!D.artifactGroup)continue;let w=U.get(D.artifactGroup)??{files:[],newestMtimeMs:0};w.files.push(D),w.newestMtimeMs=Math.max(w.newestMtimeMs,D.mtimeMs),U.set(D.artifactGroup,w)}let L=[...U.entries()].sort(([D,w],[O,x])=>w.newestMtimeMs-x.newestMtimeMs||D.localeCompare(O));for(let[,D]of L){if(B<=J)break;if(X-D.newestMtimeMs<Y)continue;if(D.files.some((w)=>K.has(U9(w.path))))continue;for(let w of D.files)await q(w)}if(j>0)d.debug("dump","removed old dump files",{removed:j,freedBytes:H});return{removed:j,freedBytes:H}}catch{return z}}function Cj($,Z){let J=Date.now();if(J-sX<Oj)return;sX=J,Fj({dumpDir:$,protectedPaths:Z}).catch(()=>{})}function Sj($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="on")return{type:"enable"};if(Z.length===1&&Z[0]==="off")return{type:"disable"};return{type:"usage"}}function S7($){let Z=$?.enabled??d9;return[Bj,"",`- Enabled: ${Z?"enabled":"disabled"}`,`- Directory: ${s9()}`,"- Persisted: ~/.config/opencode/anthropic-auth.json","- Captures: final rewritten Anthropic body in direct and relay modes; request/relay metadata is redacted","- Warning: body dumps may contain prompt/session content; turn this off after debugging"].join(`
+`)}function VR($){let Z=Sj($.argumentsText),J=$.enabled??d9;if(Z.type==="status")return S7({enabled:J});if(Z.type==="enable")return[qj,"",S7({enabled:!0})].join(`
+`);if(Z.type==="disable")return[jj,"",S7({enabled:!1})].join(`
+`);return[Hj,"",Lj,"",S7({enabled:J})].join(`
+`)}function $Z($){return $.length<=16?$:`${$.slice(0,12)}…`}function CZ($,Z=80){let J=$.trim().replace(/[^a-zA-Z0-9._-]+/g,"-").replace(/^-+|-+$/g,"");if(!J)return"session-unknown";return J.length<=Z?J:J.slice(0,Z)}function kj($){if($.transport!=="direct")return`${$.transport}-p${$.protocol}-${$.mode}`;return`direct${$.route?`-${CZ($.route)}`:""}`}function xz($){if($==="cachekeep")return"-prewarm-cachekeep";if($==="start")return"-start";return""}function vj($){let Z=$.affinity?.trim();if(Z)return`session:${Z}`;return`request:${$.route??"direct"}:${$.url??""}`}function fj($,Z){if(!$.endsWith(".body.json"))return;let J=$.replace(S1,""),X=Lz.exec(J)?.[1];if(!X||!Uz.test(X)&&!Nz.test(X))return;let Y=xz("cachekeep"),G=[{prefix:CZ(Z),tag:null},{prefix:`${CZ(Z,80-Y.length)}${Y}`,tag:"cachekeep"}];for(let z of G){if(!X.startsWith(`${z.prefix}-`))continue;let Q=X.slice(z.prefix.length);if(Pj.test(Q)||_j.test(Q))return z.tag}return}async function Ej($){let Z=$.affinity?.trim();if(!Z)return;let J=s9(),X;try{X=await jz(J)}catch{return}let Y=X.map((G)=>({name:G,tag:fj(G,Z)})).filter((G)=>G.tag!==void 0).sort((G,z)=>z.name.localeCompare(G.name));for(let G of Y)try{let z=L0(J,G.name),Q=z.replace(/\.body\.json$/,".meta.json");if(!(await e2(z)).isFile())continue;let K=JSON.parse(await iX(Q,"utf8"));if(K.session!==$Z(Z)||(G.tag===null?K.tag!=null:K.tag!==G.tag))continue;return await iX(z,"utf8")}catch{}return}function bj($,Z){if(!U8.has($))while(U8.size>=wj){let J=U8.keys().next().value;if(J===void 0)break;U8.delete(J)}U8.set($,Z)}function hj($){if($==null)return;return Object.fromEntries(new Headers($).entries())}function Dz($){return Gj("sha256").update($).digest("hex")}function gj($){return hq($)}function yj($,Z){if($==null)return null;if($===Z)return{changed:!1,firstByte:-1,lastPreviousByte:-1,lastCurrentByte:-1,previousBytes:$.length,currentBytes:Z.length};let J=0;while(J<$.length&&J<Z.length&&$[J]===Z[J])J+=1;let X=$.length-1,Y=Z.length-1;while(X>=J&&Y>=J&&$[X]===Z[Y])X-=1,Y-=1;return{changed:!0,firstByte:J,lastPreviousByte:X,lastCurrentByte:Y,changedPreviousBytes:X-J+1,changedCurrentBytes:Y-J+1,previousBytes:$.length,currentBytes:Z.length}}function uj($){try{let Z=I6($);return Z!=null&&typeof Z==="object"&&!Array.isArray(Z)?Z:null}catch{return B$("dump body parse failed"),null}}function G2($){return Dz(JSON.stringify($))}function mj($){let Z=uj($);if(!Z)return{parseable:!1};let J=Array.isArray(Z.messages)?Z.messages:[],X=Array.isArray(Z.system)?Z.system:[],Y=J[0],G=J.slice(1);return{parseable:!0,model:typeof Z.model==="string"?Z.model:void 0,stream:Z.stream,systemCount:X.length,messagesCount:J.length,systemHash:G2(X),message0Hash:Y===void 0?null:G2(Y),message0Bytes:Y===void 0?0:JSON.stringify(Y).length,messagesAfter0Hash:G2(G),messagesAfter0Bytes:JSON.stringify(G).length,cch:gj($)}}function SZ($){if(Array.isArray($))return $.map(SZ);if($==null||typeof $!=="object")return $;let Z={};for(let[J,X]of Object.entries($)){let Y=J.toLowerCase();if(Y==="authorization"||Y==="x-api-key"||Y==="cookie"||Y==="set-cookie"||j1(J)){Z[J]="[redacted]";continue}Z[J]=SZ(X)}return Z}async function Oz($){if(!d9)return null;dX+=1;let Z=$.affinity?.trim()||"session-unknown",J=xz($.tag),X=`${new Date().toISOString().replace(/[:.]/g,"-")}-${String(dX).padStart(6,"0")}-${CZ(Z,80-J.length)}${J}-${kj($)}`,Y=s9(),G=L0(Y,X),z={body:`${G}.body.json`,metadata:`${G}.meta.json`,response:`${G}.response.json`};if($.payload!==void 0)z.relay=`${G}.relay.json`;if($.request!==void 0)z.request=`${G}.request.json`;try{await Qj(Y,{recursive:!0});let Q=$.previousBodyText??await Ej($),K={id:X,createdAt:new Date().toISOString(),session:$Z(Z),transport:$.transport,protocol:$.protocol,mode:$.mode,route:$.route,status:$.status,error:$.error,tag:$.tag,bodyBytes:$.bodyText.length,relayBytes:$.relayBytes,bodyHash:Dz($.bodyText),diff:yj(Q,$.bodyText),body:mj($.bodyText),files:z},W=[W9(z.body,$.bodyText),W9(z.metadata,`${JSON.stringify(K,null,2)}
+`)];if($.payload!==void 0&&z.relay)W.push(W9(z.relay,`${JSON.stringify(SZ($.payload),null,2)}
+`));if($.request!==void 0&&z.request)W.push(W9(z.request,`${JSON.stringify(SZ({...$.request,headers:hj($.request.headers)}),null,2)}
+`));await Promise.all(W),Cj(Y,Object.values(z)),B$(`dumped request id=${X} session=${$Z(Z)} body=${z.body} meta=${z.metadata}`)}catch{return B$(`dump failed session=${$Z(Z)}`),null}return{responsePath:z.response,...$.tag?{tag:$.tag}:{}}}async function pj($){if(!d9)return null;let Z=vj($),J=U8.get(Z),X=await Oz({affinity:$.affinity,transport:"direct",route:$.route,status:$.status,error:$.error,bodyText:$.bodyText,previousBodyText:J,request:{url:$.url,method:$.method,headers:$.headers},tag:$.tag});return bj(Z,$.bodyText),X}async function cj($){return Oz({affinity:$.affinity,transport:$.transport,protocol:$.protocol,mode:$.mode,status:$.status,bodyText:$.bodyText,previousBodyText:$.previousBodyText,payload:$.payload,relayBytes:$.relayBytes,tag:$.tag})}async function lj($,Z){if(!$)return;let J=Z.message!=null&&typeof Z.message==="object"&&!Array.isArray(Z.message)?Z.message:{},X={status:Z.status,stream_complete:Z.complete??!0};if(typeof J.id==="string"&&J.id.length>0)X.message_id=J.id;if(typeof J.model==="string"&&J.model.length>0)X.model=J.model;if(Object.hasOwn(J,"usage"))X.usage=J.usage;if(Object.hasOwn(J,"diagnostics"))X.diagnostics=J.diagnostics;if(typeof J.stop_reason==="string"&&J.stop_reason.length>0)X.stop_reason=J.stop_reason;try{await W9($.responsePath,`${JSON.stringify(X,null,2)}
+`)}catch{B$(`dump response failed status=${Z.status}`)}}Y4();var ZZ=8388608,_8=10,N9=13;class w8 extends Error{code="SSE_FRAME_TOO_LARGE";maxFrameBytes;constructor($){super(`SSE frame exceeded ${$} bytes without a terminator`);this.name="SseFrameTooLargeError",this.maxFrameBytes=$}}function ij($){if($===void 0)return ZZ;if($===null||typeof $!=="object"||k1.isProxy($))throw TypeError("SSE framer options must be an object");let Z=Object.getOwnPropertyDescriptor($,"maxFrameBytes");if(Z===void 0)return ZZ;if(!("value"in Z))throw TypeError("SSE framer maxFrameBytes must be a data property");let J=Z.value;if(J===void 0)return ZZ;if(typeof J!=="number"||!Number.isSafeInteger(J)||J<1)throw TypeError("SSE framer maxFrameBytes must be a positive integer");return J}function dj($){let Z=ij($),J=new Uint8Array(0),X=0,Y=!0,G=!1,z=!1,Q=!1,K=()=>{throw Q=!0,J=new Uint8Array(0),X=0,new w8(Z)},W=(j,H)=>{let q=(H?X:0)+j.length;if(q>Z)K();if(J.length<q){let N=new Uint8Array(Math.min(Z,Math.max(q,J.length*2,1024)));if(H)N.set(J.subarray(0,X),0);J=N}J.set(j,H?X:0),X=q};return Object.freeze({push:(j)=>{if(Q)throw new w8(Z);if(!k1.isUint8Array(j))throw TypeError("SSE framer input must be a Uint8Array");let H=j.length;if(H===0)return[];let q=[],N=0,U=0,L=Y?0:-1,D=(x)=>{if(X>0){let C=X+x;if(C>Z)K();let v=new Uint8Array(C);v.set(J.subarray(0,X),0),v.set(j.subarray(0,x),X),X=0,q.push(v)}else{if(x-N>Z)K();q.push(j.subarray(N,x))}N=x};if(G){if(G=!1,j[0]===_8)U=1;if(z)z=!1,D(U);L=U}let w=-2,O=-2;while(U<H){if(w!==-1&&w<U)w=j.indexOf(_8,U);if(O!==-1&&O<U)O=j.indexOf(N9,U);let x;if(w===-1)x=O;else if(O===-1)x=w;else x=Math.min(w,O);if(x===-1)break;let C=x+1;if(j[x]===N9){if(C===H){G=!0,z=x===L,L=H;break}if(j[C]===_8)C+=1}if(x===L)D(C);L=C,U=C}if(N<H)W(j.subarray(N,H),X>0),Y=L===H;else Y=!0;return q},finish:()=>{if(Q)throw new w8(Z);let j=X>0?J.slice(0,X):void 0;return J=new Uint8Array(0),X=0,Y=!0,G=!1,z=!1,j},get bufferedBytes(){return X}})}var sj=new TextDecoder("utf-8",{ignoreBOM:!0}),tj=65279;function aj($){if($===null||typeof $!=="object"||k1.isProxy($))return!1;let Z=Object.getOwnPropertyDescriptor($,"streamStart");return Z!==void 0&&"value"in Z&&Z.value===!0}function U0($,Z){let J=sj.decode($);return J.charCodeAt(0)===tj&&aj(Z)?J.slice(1):J}function nj($){let Z=typeof $==="string"?$:U0($),J={},X;for(let Y of Z.split(/\r\n|\r|\n/)){if(Y===""||Y.charCodeAt(0)===58)continue;let G=Y.indexOf(":"),z=G===-1?Y:Y.slice(0,G),Q=G===-1?"":Y.slice(G+1);if(Q.charCodeAt(0)===32)Q=Q.slice(1);switch(z){case"event":J.event=Q;break;case"data":if(X)X.push(Q);else X=[Q];break;case"id":if(!Q.includes("\x00"))J.id=Q;break;case"retry":if(/^[0-9]+$/.test(Q))J.retry=Number(Q);break}}if(X)J.data=X.join(`
+`);return J}function oj($){let Z=$.length;if(Z===0)return!1;let J=$[Z-1];if(J!==_8&&J!==N9)return!1;let X=Z-1;if(J===_8&&X>0&&$[X-1]===N9)X-=1;if(X===0)return!0;let Y=$[X-1];return Y===_8||Y===N9}var rj=Buffer.from("error"),ej=Buffer.from("\\u");function $H($){let Z=Buffer.from($.buffer,$.byteOffset,$.byteLength);return Z.indexOf(rj)!==-1||Z.indexOf(ej)!==-1}var a6="[REDACTED]",f8="Provider error details were withheld because the request attempt has ended",Iz="Provider error body exceeded the redaction size limit and was withheld",v1=1048576,ZH=ZZ,Mz=32,JH=2000,f1=1000,XH=/\bBearer\s+([A-Za-z0-9._~+/=-]{16,})/gi,YH=/(?<![A-Za-z0-9_-])sk-[A-Za-z0-9_-]{16,}/g,Z5=/\\(?:u([0-9a-fA-F]{4})|(["\\/bfnrt]))/g,GH={'"':'"',"\\":"\\","/":"/",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t"},zH=new Set(["api_error","authentication_error","billing_error","invalid_request_error","not_found_error","overloaded_error","permission_error","rate_limit_error","relay_upstream_error","request_too_large","timeout_error"]),kZ=new TextEncoder;function K6($,Z){$.onTerminal?.(Z)}function E1($){if(!Array.isArray($)||$8.isProxy($))throw TypeError("Provider error redactor secrets must be an array");let J=Object.getOwnPropertyDescriptor($,"length")?.value;if(typeof J!=="number")throw TypeError("Provider error redactor secrets must be an array");let X=new Set;for(let Y=0;Y<J;Y+=1){let G=Object.getOwnPropertyDescriptor($,String(Y));if(G===void 0||!("value"in G))throw TypeError(`Provider error redactor secret ${Y} must be a data property`);let z=G.value;if(typeof z!=="string")throw TypeError(`Provider error redactor secret ${Y} must be a string`);if(z!=="")X.add(z)}return[...X].sort((Y,G)=>G.length-Y.length)}var tX=46;function Pz($){return $>=48&&$<=57||$>=65&&$<=90||$>=97&&$<=122||$===95}function z2($,Z){let J=Z;for(;J<$.length;J+=1){let X=$.charCodeAt(J);if(!Pz(X)&&X!==45)break}return J}function QH($,Z){let J=$.indexOf("eyJ");while(J!==-1){let X=z2($,J),Y=J;while(Y!==-1&&Y<X&&!(Y+3<X&&(Y===0||!Pz($.charCodeAt(Y-1)))))Y=$.indexOf("eyJ",Y+1);if(Y===-1)return;if(Y>=X){J=Y;continue}let G=X;if($.charCodeAt(X)===tX){let z=z2($,X+1);if(z>X+1&&$.charCodeAt(z)===tX){let Q=z2($,z+1);if(Q>z+1)Z.push(Y,Q),G=Q}}J=$.indexOf("eyJ",G)}}function aX($,Z,J){Z.lastIndex=0;for(let X=Z.exec($);X!==null;X=Z.exec($)){let Y=X.index+X[0].length,G=X[1];J.push(G===void 0?X.index:Y-G.length,Y)}}function nX($,Z,J){for(let X of Z)for(let Y=$.indexOf(X);Y!==-1;Y=$.indexOf(X,Y+X.length))J.push(Y,Y+X.length);aX($,XH,J),aX($,YH,J),QH($,J)}function KH($,Z,J){if(Z!==void 0)return String.fromCharCode(Number.parseInt(Z,16));return J===void 0?"":GH[J]??J}function WH($,Z){let J=[...Z.keys()].sort((Q,K)=>(Z[Q]??0)-(Z[K]??0)),X=Array(Z.length).fill($.length),Y=0,G=0,z=0;Z5.lastIndex=0;for(;;){let Q=Z5.exec($),K=Q?Q.index:$.length;for(;Y<J.length;Y+=1){let W=J[Y]??0,V=Z[W]??0;if(V>z+(K-G))break;X[W]=G+(V-z)}if(!Q||Y===J.length)return X;z+=K-G+1,G=Q.index+Q[0].length}}function VH($,Z){let J=[];for(let Q=0;Q+1<Z.length;Q+=2)J.push([Z[Q]??0,Z[Q+1]??0]);J.sort((Q,K)=>Q[0]-K[0]||K[1]-Q[1]);let X="",Y=0,G=-1,z=-1;for(let[Q,K]of J){if(G!==-1&&Q<z){z=Math.max(z,K);continue}if(G!==-1)X+=$.slice(Y,G)+a6,Y=z;G=Q,z=K}if(G!==-1)X+=$.slice(Y,G)+a6,Y=z;return X+$.slice(Y)}function M$($,Z){let J=[];if(nX($,Z,J),$.includes("\\")){let X=$.replace(Z5,KH);if(X!==$){let Y=[];nX(X,Z,Y);for(let G of WH($,Y))J.push(G)}}if(J.length===0)return $;return VH($,J)}function M6($,Z){let J=Object.getOwnPropertyDescriptor($,Z)?.get;if(typeof J!=="function")throw Error(`Platform accessor ${Z} is unavailable`);return J}var _z=M6(Response.prototype,"status"),wz=M6(Response.prototype,"statusText"),BH=M6(Response.prototype,"ok"),Az=M6(Response.prototype,"headers"),qH=M6(Response.prototype,"body"),jH=M6(Response.prototype,"url"),Rz=Headers.prototype.forEach,HH=M6(DOMException.prototype,"name"),LH=M6(DOMException.prototype,"message");function U4($,Z){return Reflect.apply($,Z,[])}function J5($){try{return $()}catch(Z){if(Z instanceof TypeError)return;throw Z}}function UH($){let Z=[];return Reflect.apply(Rz,$,[(J,X)=>{if(typeof X==="string"&&typeof J==="string")Z.push([X,J])}]),Z}function NH($){return $ instanceof ReadableStream}function Tz($){if($===null||typeof $!=="object"||$8.isProxy($))return;let Z=J5(()=>U4(_z,$));if(typeof Z!=="number")return;let J=U4(wz,$),X=U4(BH,$),Y=U4(jH,$);if(typeof J!=="string"||typeof X!=="boolean"||typeof Y!=="string")throw TypeError("Response slots could not be read");return{status:Z,statusText:J,ok:X,headers:UH(U4(Az,$)),url:Y,body(){let G=U4(qH,$);if(G===null||NH(G))return G;throw TypeError("Response body slot could not be read")}}}function xH($,Z){if(Object.getPrototypeOf($)!==Z)return!1;return Reflect.ownKeys($).every((J)=>!(J in Z))}function DH($){for(let[Z,J]of $)if(Z.toLowerCase()==="content-type")return J;return""}function X5($,Z,J=0){if(typeof $==="string")return M$($,Z);if($===null||typeof $!=="object")return x9($,Z)?$:a6;if(J>=Mz)return a6;if(Array.isArray($)){let z;for(let Q=0;Q<$.length;Q+=1){let K=$[Q],W=X5(K,Z,J+1);if(W!==K)z??=$.slice(),z[Q]=W}return z??$}if(!vZ($))return $;let X=!1,Y=[];for(let z of Object.keys($)){let Q=$[z],K=M$(z,Z),W=X5(Q,Z,J+1);if(K!==z||W!==Q)X=!0;Y.push([K,W])}if(!X)return $;let G={};for(let[z,Q]of Y)Object.defineProperty(G,z,{value:Q,enumerable:!0,writable:!0,configurable:!0});return G}function x9($,Z){let J=JSON.stringify($);return typeof J!=="string"||M$(J,Z)===J}function vZ($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function OH($){if(!vZ($))return!1;return $.type==="error"||Object.hasOwn($,"error")}function N0($){if(!vZ($))return;let Z=$.error;if(!vZ(Z))return;let J=Z.type;return typeof J==="string"&&zH.has(J)?J:void 0}function t9($,Z){return JSON.stringify({type:"error",error:Z===void 0?{message:$}:{type:Z,message:$}})}function b1($){try{return{ok:!0,value:JSON.parse($)}}catch{return}}function Fz($,Z){let J=M$($,Z);if(J===$)return $;let X=b1($);if(!X)return J;let Y=JSON.stringify(X5(X.value,Z));return M$(Y,Z)===Y?Y:t9(fZ,N0(X.value))}var IH=[["name","text"],["message","text"],["type","text"],["status","status"],["statusCode","status"],["code","code"],["retryAfter","retry"],["isRetryable","boolean"],["request_id","requestId"],["requestID","requestId"],["syscall","syscall"],["closeCode","closeCode"],["wasClean","boolean"],["error","nested"],["cause","nested"],["response","nested"],["headers","headers"],["responseHeaders","headers"],["errors","list"]],MH=new Set(["websocket","anthropic-sse"]),PH=[Symbol.for("vercel.ai.error"),Symbol.for("vercel.ai.error.AI_APICallError")],_H=new Map([["Error",Error],["TypeError",TypeError],["RangeError",RangeError],["SyntaxError",SyntaxError],["ReferenceError",ReferenceError],["EvalError",EvalError],["URIError",URIError]]),wH=/^[A-Za-z0-9_-]{1,128}$/,AH=64,oX="Provider error details exceeded the redaction size limit and were withheld",RH=24;function t$($,Z){if(Z>$.bytes)return!1;return $.bytes-=Z,!0}function Cz($){return typeof $==="string"||typeof $==="object"&&$?0:RH}function Sz($,Z,J){if(!t$($,Z))return!1;let X=J()-Z;return X<=0||t$($,X)}function h1($,Z){if($.length>Z.bytes)return;let J=M$($,Z.secrets);return Sz(Z,$.length,()=>C9.byteLength(J,"utf8"))?J:void 0}function D9($,Z){let J=h1($,Z);if(J!==void 0)return J;return t$(Z,oX.length)?oX:void 0}function kz($){let Z=$;for(let J=0;Z!==null;J+=1){if(J>AH||$8.isProxy(Z))return!1;Z=Object.getPrototypeOf(Z)}return!0}function D6($,Z){let J=Object.getOwnPropertyDescriptor($,Z);return J!==void 0&&"value"in J?J.value:void 0}function TH($){for(let Z=$;Z!==null;Z=Object.getPrototypeOf(Z)){let J=Object.getOwnPropertyDescriptor(Z,"name");if(J!==void 0)return"value"in J?J.value:void 0}return}function g1($,Z,J){Object.defineProperty($,Z,{value:J,enumerable:!0,writable:!0,configurable:!0})}function g6($,Z,J,X){let Y=typeof Z==="string"?Z.length:0;if(J!==void 0&&t$(X,Y+Cz(J)))g1($,Z,J)}function vz($){return Number.isInteger($)&&Number($)>=0&&Number($)<=999}function fz($,Z,J,X){let Y=Z.length+J.length;if(Y>X.bytes)return;if(M$(Z,X.secrets)!==Z){t$(X,Y);return}let G=M$(J,X.secrets);if(Sz(X,Y,()=>C9.byteLength(Z,"utf8")+C9.byteLength(G,"utf8")))g1($,Z,G)}var rX=Object.freeze({});function Ez($,Z){let J={},X=0;try{Reflect.apply(Rz,$,[(Y,G)=>{if(X>=f1||Z.bytes===0)throw rX;if(X+=1,typeof G==="string"&&typeof Y==="string")fz(J,G,Y,Z)}])}catch(Y){if(Y===rX)return J;if(Y instanceof TypeError)return;throw Y}return J}function FH($,Z){if($===null||typeof $!=="object"||!kz($))return;let J=Ez($,Z);if(J)return J;let X=Reflect.ownKeys($);if(X.length>f1)return;let Y={};for(let G of X){let z=typeof G==="string"?D6($,G):void 0;if(typeof G==="string"&&typeof z==="string")fz(Y,G,z,Z)}return Y}function eX($,Z,J,X){switch($){case"text":return typeof Z==="string"?D9(Z,J):void 0;case"status":return vz(Z)&&x9(Z,J.secrets)?Z:void 0;case"code":case"retry":if(typeof Z==="string")return h1(Z,J);return Number.isFinite(Z)&&x9(Z,J.secrets)?Z:void 0;case"boolean":return typeof Z==="boolean"?Z:void 0;case"syscall":return typeof Z==="string"&&MH.has(Z)&&t$(J,Z.length)?Z:void 0;case"closeCode":return Number.isInteger(Z)&&Number(Z)>=1000&&Number(Z)<=4999&&x9(Z,J.secrets)?Z:void 0;case"requestId":return typeof Z==="string"&&wH.test(Z)&&M$(Z,J.secrets)===Z&&t$(J,Z.length)?Z:void 0;case"nested":return Z===void 0?void 0:S9(Z,J,X);case"headers":return FH(Z,J);case"list":return Array.isArray(Z)?S9(Z,J,X):void 0}}var CH=128;function SH($,Z){if($==="nested"||$==="headers"||$==="list")return!1;return typeof Z!=="string"||Z.length<=CH}function bz($,Z,J,X,Y,G){for(let Q of PH)if(D6($,Q)===!0)g6(Z,Q,!0,J);let z=[];for(let[Q,K]of IH){if(Y.has(Q))continue;let W=D6($,Q);if(!SH(K,W))z.push([Q,K,W]);else g6(Z,Q,eX(K,W,J,X+1),J)}G?.();for(let[Q,K,W]of z)g6(Z,Q,eX(K,W,J,X+1),J)}var kH=new Set(["message"]),vH=new Set(["message","errors"]),fH=new Set,hz=12;function gz($,Z,J,X){if(J===void 0){Reflect.deleteProperty($,"stack");return}let Y=C9.byteLength(Z,"utf8"),G=J===""?0:2+C9.byteLength(J,"utf8"),z="";if(t$(X,Y+G))z=J===""?Z:`${Z}: ${J}`;else if(t$(X,Y))z=Z;Object.defineProperty($,"stack",{value:z,writable:!0,enumerable:!1,configurable:!0})}function EH($,Z,J){let X=TH($),Y=X==="AggregateError",G=typeof X==="string"?_H.get(X):void 0,z=t$(Z,hz+(Y?6:0)),Q=Y?AggregateError([]):new(G??Error);if(Y&&!z)Reflect.deleteProperty(Q,"errors");if(Z.memo.set($,Q),bz($,Q,Z,J,Y?vH:kH,()=>{let W=D6($,"message"),V=!z?void 0:typeof W==="string"?D9(W,Z)??"":"";if(V!==void 0)Object.defineProperty(Q,"message",{value:V,writable:!0,enumerable:!1,configurable:!0});gz(Q,Y?"AggregateError":G&&typeof X==="string"?X:"Error",V,Z)}),Y&&z){let W=D6($,"errors"),V=Array.isArray(W)?S9(W,Z,J+1):void 0;Object.defineProperty(Q,"errors",{value:Array.isArray(V)?V:[],writable:!0,configurable:!0})}return Q}function bH($,Z,J){let X=D6($,"length");if(typeof X!=="number"||X>f1)return JZ(Z);let Y=[];Z.memo.set($,Y);for(let G=0;G<X;G+=1){let z=D6($,String(G));if(!t$(Z,1))break;let Q=S9(z,Z,J+1);if(!t$(Z,Cz(Q)))break;Y.push(Q)}return Y}function JZ($){return t$($,a6.length)?a6:void 0}function S9($,Z,J){if(typeof $==="string")return D9($,Z)??"";if(typeof $==="symbol"||typeof $==="function")return JZ(Z);if($===null||typeof $!=="object")return $;if(Z.memo.has($))return Z.memo.get($);if(!kz($))return JZ(Z);if(Z.budget-=1,Z.budget<0||J>=Mz)return JZ(Z);let X=J5(()=>U4(_z,$));if(typeof X==="number"){let z=U4(wz,$);if(typeof z!=="string")throw TypeError("Response slots could not be read");let Q={};Z.memo.set($,Q),g6(Q,"status",X,Z),g6(Q,"statusText",h1(z,Z)??"",Z);let K=U4(Az,$);return g6(Q,"headers",Ez(K,Z)??{},Z),Q}let Y=J5(()=>U4(LH,$));if(typeof Y==="string"){let z=t$(Z,hz)?D9(Y,Z)??"":void 0,Q=Error(z);gz(Q,"Error",z,Z);let K=U4(HH,$);if(typeof K==="string")g6(Q,"name",D9(K,Z),Z);return Z.memo.set($,Q),Q}if($8.isNativeError($))return EH($,Z,J);if(Array.isArray($))return bH($,Z,J);let G={};return Z.memo.set($,G),bz($,G,Z,J,fH),G}function Q2($,Z){let J=Error(Z);try{if($!==null&&typeof $==="object"&&!$8.isProxy($)){let X=D6($,"status");if(vz(X))g1(J,"status",X)}}catch{}return J}var fZ="Provider error could not be inspected safely";function a9($,Z){let J=Z.secrets,X=$!==null&&typeof $==="object"||typeof $==="function"||typeof $==="symbol";if(J===null){if(typeof $==="string")return f8;return X?Q2($,f8):$}try{let Y=S9($,{secrets:J,memo:new Map,budget:JH,bytes:v1},0);return X&&Y===a6?Q2(void 0,fZ):Y}catch{return Q2(void 0,fZ)}}function hH($,Z){let J=U0($,{streamStart:!0}),X=Z.secrets;if(X===null)return kZ.encode(t9(f8,N0(b1(J)?.value)));let Y=Fz(J,X);return Y===J?$:kZ.encode(Y)}function gH($,Z){if($.length===1&&$[0])return $[0];let J=new Uint8Array(Z),X=0;for(let Y of $)J.set(Y,X),X+=Y.byteLength;return J}function K2($,Z,J){try{if(Z)$.enqueue(Z);if(J)$.close()}catch{}}function yz($,Z){return $.cancel(Z).then(()=>{return},()=>{throw Error(f8)})}var uz=new WeakSet;class mz extends Error{constructor(){super(Iz);this.name="ProviderErrorSourceOversizedError",uz.add(this)}}function yH($){return typeof $==="object"&&$!==null&&uz.has($)}function $Y(){return kZ.encode(t9(Iz))}function uH($,Z){Z.wrappedBodies+=1;let J=()=>$.getReader(),X;return new ReadableStream({async pull(Y){let G=[],z=0,Q,K;try{Q=J(),X=Q;for(;;){let{done:W,value:V}=await Q.read();if(W)break;if(!$8.isUint8Array(V))throw TypeError("Provider error body chunk must be bytes");if(V.byteLength===0)continue;if(z+=V.byteLength,z>v1){K2(Y,$Y(),!0),K6(Z,"eof"),await Q.cancel().catch(()=>{});return}G.push(V)}K=hH(gH(G,z),Z)}catch(W){if(yH(W)){if(K2(Y,$Y(),!0),K6(Z,"eof"),Q)await Q.cancel().catch(()=>{});return}let V=a9(W,Z);K6(Z,"error");try{Y.error(V)}catch{}if(Q)await Q.cancel(V).catch(()=>{});return}K2(Y,K,!0),K6(Z,"eof")},cancel(Y){return K6(Z,"cancel"),yz(X??$,Y)}},{highWaterMark:0})}function mH($){let Z=/\r\n|\r|\n/.exec($);return Z?Z[0]:`
+`}function Y5($,Z,J){let X=[];if(J.event!==void 0)X.push(`event: ${J.event}`);if(J.id!==void 0)X.push(`id: ${J.id}`);if(J.retry!==void 0)X.push(`retry: ${J.retry}`);if(J.data!==void 0)for(let Y of J.data.split(/\r\n|\r|\n/))X.push(`data: ${Y}`);return pH($,Z,X)}function pH($,Z,J){let X=mH(Z),Y="";if(oj($))Y=X+X;else if(/[\r\n]$/.test(Z))Y=X;return kZ.encode(J.join(X)+Y)}function cH($,Z,J){if(!$H($))return $;let X=U0($,{streamStart:J}),Y=nj(X),G=Y.data===void 0?void 0:b1(Y.data);if(!(Y.event==="error"||G!==void 0&&OH(G.value)))return $;let Q=Z.secrets,K=Q===null?Y5($,X,{event:Y.event===void 0?void 0:"error",data:Y.data===void 0?void 0:t9(f8,N0(G?.value))}):M$(X,Q)===X&&(Y.data===void 0||M$(Y.data,Q)===Y.data)?$:Y5($,X,{event:Y.event===void 0?void 0:M$(Y.event,Q),id:Y.id===void 0?void 0:M$(Y.id,Q),retry:Y.retry!==void 0&&Number.isSafeInteger(Y.retry)&&x9(Y.retry,Q)?Y.retry:void 0,data:Y.data===void 0?void 0:Fz(Y.data,Q)}),W=K===$||Q===null?K:lH(K,$,X,Y,G,Q);if(W===$||!J||!iH($))return W;let V=new Uint8Array(A8.length+W.length);return V.set(A8,0),V.set(W,A8.length),V}function lH($,Z,J,X,Y,G){let z=U0($);if(M$(z,G)===z)return $;return Y5(Z,J,{event:X.event===void 0?void 0:"error",data:X.data===void 0?void 0:t9(fZ,N0(Y?.value))})}var A8=Uint8Array.of(239,187,191);function iH($){return $[0]===A8[0]&&$[1]===A8[1]&&$[2]===A8[2]}function dH($,Z){Z.wrappedBodies+=1;let J=pz(Z),X=()=>$.getReader(),Y,G=(z,Q)=>{for(let K of Q)z.enqueue(K)};return new ReadableStream({async pull(z){let Q=Y,K=!1;try{Q??=X(),Y=Q;for(;;){let{done:W,value:V}=await Q.read();if(W){K=!0;let j=J.finish();K=!1,G(z,j),z.close(),K6(Z,"eof");return}if(!$8.isUint8Array(V))throw TypeError("Provider event-stream chunk must be bytes");K=!0;let B=J.push(V);if(K=!1,B.length>0){G(z,B);return}}}catch(W){let V=K&&W instanceof w8?W:a9(W,Z);K6(Z,"error");try{z.error(V)}catch{}if(Q)await Q.cancel(V).catch(()=>{})}},cancel(z){return K6(Z,"cancel"),yz(Y??$,z)}},{highWaterMark:0})}function pz($){let Z=dj({maxFrameBytes:ZH}),J=!0,X=(Y)=>{let G=[],z;for(let Q of Y){let K=cH(Q,$,J);if(J=!1,K===Q&&z!==void 0&&z.buffer===Q.buffer&&z.byteOffset+z.byteLength===Q.byteOffset){z=new Uint8Array(z.buffer,z.byteOffset,z.byteLength+Q.byteLength);continue}if(z)G.push(z);if(z=void 0,K===Q)z=Q;else G.push(K)}if(z)G.push(z);return G};return{push:(Y)=>X(Z.push(Y)),finish:()=>{let Y=Z.finish();return Y?X([Y]):[]}}}var sH="Provider error stream scope is closed";function tH($){let Z={secrets:E1($),wrappedBodies:0},J=pz(Z),X=()=>{Z.secrets=null,J=null},Y=()=>{if(J===null)throw Error(sH);return J};return Object.freeze({push(G){let z=Y();try{return z.push(G)}catch(Q){throw X(),Q}},finish(){let G=Y();try{return G.finish()}finally{X()}},redactError(G){return a9(G,Z)},dispose:X})}var aH=new Set([101,103,204,205,304]),u4="anthropic-ratelimit-unified-",nH=new Set(["allowed","allowed_warning","rejected"]),oH=new Set(["five_hour","seven_day","seven_day_opus","seven_day_sonnet","overage"]),rH=new Set(["available","unavailable"]),eH=/^[0-9]{1,15}(\.[0-9]{1,15})?$/,$L=/^[0-9]{1,10}$/,ZL=/^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), [0-9]{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) [0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} GMT$/,JL=($)=>$L.test($)||ZL.test($),W2=($)=>nH.has($),k7=($)=>eH.test($),XL=new Map([["retry-after",JL],["x-should-retry",($)=>$==="true"||$==="false"],[`${u4}status`,W2],[`${u4}representative-claim`,($)=>oH.has($)],[`${u4}fallback`,($)=>rH.has($)],[`${u4}5h-status`,W2],[`${u4}5h-utilization`,k7],[`${u4}5h-reset`,k7],[`${u4}7d-status`,W2],[`${u4}7d-utilization`,k7],[`${u4}7d-reset`,k7]]);function YL($,Z){return XL.get($.toLowerCase())?.(Z)===!0}function V2($,Z,J){let X=new Headers;for(let[Y,G]of $){if(Z==="verified-only"&&!YL(Y,G))continue;if(Z==="scrub"&&M$(Y,J)!==Y)continue;X.append(Y,Z==="scrub"?M$(G,J):G)}return X.delete("content-length"),X}function ZY($,Z,J){if(Z!==""&&J!==null)Object.defineProperty($,"url",{value:M$(Z,J),enumerable:!0});return $}function cz($,Z,J,X){let Y=J.secrets,G=xH($,Response.prototype);if(Z.ok){let K=X==="content-type"?/text\/event-stream/i.test(DH(Z.headers)):X==="event-stream";if(G&&!K)return $;let W=Z.body();if(G&&W===null)return $;let V=W===null||!K?W:dH(W,J);return ZY(new Response(V,{status:Z.status,statusText:Z.statusText,headers:V2(Z.headers,"keep",[])}),Z.url,Y)}if(Z.status===0)return G?$:Response.error();let z=aH.has(Z.status)?null:Z.body(),Q=z===null?null:uH(z,J);if(Y===null){let K=V2(Z.headers,"verified-only",[]);if(Q!==null)K.set("content-type","application/json");return new Response(Q,{status:Z.status,headers:K})}return ZY(new Response(Q,{status:Z.status,statusText:M$(Z.statusText,Y),headers:V2(Z.headers,"scrub",Y)}),Z.url,Y)}function GL($,Z){let J=Tz($);if(!J)throw TypeError("Provider error redactor expects a Response");let X=cz($,J,Z,"content-type");if(!(X instanceof Response))throw TypeError("Provider error redactor expects a Response");return X}function HR($){let Z={secrets:E1($),wrappedBodies:0};return Object.freeze({redactText(J){if(typeof J!=="string")throw TypeError("Provider error redactor expects text");let X=Z.secrets;return X===null?f8:M$(J,X)},redactError(J){return a9(J,Z)},redactResponse(J){return GL(J,Z)},dispose(){Z.secrets=null}})}var zL="Provider error response scope accepts one response while live";function y1($,Z){if(Z!=="event-stream"&&Z!=="http")throw TypeError("Provider error response scope mode must be 'event-stream' or 'http'");let J=Z,X={secrets:E1($),wrappedBodies:0},Y=()=>{},G=new Promise((V)=>{Y=V}),z=!1,Q=!1,K=(V)=>{if(z)return;z=!0,X.secrets=null,X.onTerminal=void 0,Y(V)};X.onTerminal=K;let W={get settled(){return G},redactResponse(V){if(Q||z)throw TypeError(zL);let B=Tz(V);if(!B)throw TypeError("Provider error redactor expects a Response");Q=!0;let j;try{j=cz(V,B,X,J)}catch(H){throw K("disposed"),H}if(X.wrappedBodies===0)K("untouched");if(!(j instanceof Response))throw TypeError("Provider error redactor expects a Response");return j},redactError(V){return a9(V,X)},dispose(){K("disposed")}};return Object.defineProperty(W,"settled",{enumerable:!1}),Object.freeze(W)}var B2=3600000,JY=300000,QL=60000,LR="extended-cache-ttl-2025-04-11",KL=32,XY=16777216,WL=30000,VL=60000,BL=900000,qL=30000,YY="OAuth cache prewarm credential is unavailable",GY="## Claude Cache Keep Status",zY="## Claude Cache Keep Enabled",jL="## Claude Cache Keep Disabled",HL="## Claude Cache Keep Usage",LL="Usage: `/claude-cachekeep`, `/claude-cachekeep always`, `/claude-cachekeep off`, or `/claude-cachekeep HH-HH`.";function EZ($){return String($).padStart(2,"0")}function UL($){let Z=$.trim();if(!Z)return{type:"status"};if(Z==="off")return{type:"disable"};if(Z==="always")return{type:"always"};if(Z==="subagents on")return{type:"subagents",enabled:!0};if(Z==="subagents off")return{type:"subagents",enabled:!1};let J=/^(\d{1,2})-(\d{1,2})$/.exec(Z);if(!J)return{type:"usage"};let X=Number(J[1]),Y=Number(J[2]);if(!Number.isInteger(X)||!Number.isInteger(Y)||X<0||X>23||Y<0||Y>23||X===Y)return{type:"usage"};return{type:"window",startHour:X,endHour:Y}}function bZ($){let Z=Number($?.cacheKeep?.startHour),J=Number($?.cacheKeep?.endHour);if(!Number.isInteger(Z)||!Number.isInteger(J)||Z<0||Z>23||J<0||J>23||Z===J)return;return{startHour:Z,endHour:J}}function x0($){return $?.cacheKeep?.enabled===!0&&$.cacheKeep.always===!0}function lz($){return $?.cacheKeep?.enabled===!0&&(x0($)||!!bZ($))}function NL($){return lz($)&&$?.claudeCache?.enabled===!0&&$.claudeCache.mode==="hybrid"}function xL($,Z=new Date){if(!$)return!1;let J=Z.getHours();if($.startHour<$.endHour)return J>=$.startHour&&J<$.endHour;return J>=$.startHour||J<$.endHour}function QY($,Z=new Date){if($?.cacheKeep?.enabled!==!0)return!1;return x0($)||xL(bZ($),Z)}function KY($=new Date){return`${$.getFullYear()}-${EZ($.getMonth()+1)}-${EZ($.getDate())}`}function iz($,Z=new Date){if($&&$.startHour>$.endHour&&Z.getHours()<$.endHour){let J=new Date(Z);return J.setDate(J.getDate()-1),KY(J)}return KY(Z)}function WY($,Z,J=new Date){return x0($)?"always":iz(Z,J)}function V8($){let Z=$.always?"always (while this process is running)":$.window?`${EZ($.window.startHour)}-${EZ($.window.endHour)}`:"not configured",J=[`Cache keep: ${$.enabled?"enabled":"disabled"}`,`Schedule: ${Z}`,"Mode requirement: `/claude-cache mode hybrid` must be active."];if(typeof $.hybridActive==="boolean")J.push(`Hybrid active: ${$.hybridActive?"yes":"no"}`);if(typeof $.trackedSessions==="number")J.push(`Tracked sessions: ${$.trackedSessions}`);if($.trackedSessionDetails?.length){J.push("Sessions:");for(let X of $.trackedSessionDetails)J.push(`- ${X.id}`)}if($.nextPrewarmAt)J.push(`Next prewarm: ${new Date($.nextPrewarmAt).toLocaleString()}`);return J.join(`
+`)}function UR($){let Z=UL($.argumentsText),J={enabled:$.enabled??!1,always:$.always,window:$.window,trackedSessions:$.trackedSessions,trackedSessionDetails:$.trackedSessionDetails,nextPrewarmAt:$.nextPrewarmAt,hybridActive:$.hybridActive};if(Z.type==="status")return[GY,"",V8(J)].join(`
+`);if(Z.type==="disable")return[jL,"",V8({...J,enabled:!1})].join(`
+`);if(Z.type==="always")return[zY,"",V8({...J,enabled:!0,always:!0,window:void 0})].join(`
+`);if(Z.type==="window")return[zY,"",V8({...J,enabled:!0,always:!1,window:{startHour:Z.startHour,endHour:Z.endHour}})].join(`
+`);if(Z.type==="subagents")return[GY,"",V8(J),"",`Subagent tracking: ${Z.enabled?"enabled":"disabled"}`].join(`
+`);return[HL,"",LL,"",V8(J)].join(`
+`)}function G5($){if(!$||typeof $!=="object")return!1;if(Array.isArray($))return $.some(G5);let Z=$,J=Z.cache_control;if(J&&typeof J==="object"&&J.type==="ephemeral")return!0;return Object.values(Z).some(G5)}async function DL($){let Z;try{Z=JSON.parse($)}catch{return{ok:!1,reason:"body is not valid JSON"}}if(!G5(Z))return{ok:!1,reason:"body has no explicit cache breakpoints"};let J=structuredClone(Z);if(mq(J),J.max_tokens=0,delete J.stream,J.thinking?.type==="enabled")delete J.thinking;if(J.output_config?.format)delete J.output_config;let G=J.tool_choice;if(G?.type==="tool"||G?.type==="any")delete J.tool_choice;return{ok:!0,bodyText:await gq(JSON.stringify(Yj(J)))}}function VY($,Z){let J=Math.min(BL,VL*2**Math.min(Math.max(Z-1,0),8)),X=2166136261;for(let G of`${$}:${Z}`)X^=G.charCodeAt(0),X=Math.imul(X,16777619);let Y=(X>>>0)%(Math.min(qL,J/4)+1);return J+Y}function OL($){let Z=[],J=$.get("authorization");if(J){Z.push(J);let Y=/^Bearer\s+(.+)$/i.exec(J)?.[1]?.trim();if(Y)Z.push(Y)}let X=$.get("x-api-key");if(X)Z.push(X);return Z}class IL{options;targets=new Map;timer=null;tickPromise=null;nextPrewarmAttemptId=0;constructor($){this.options=$}start(){if(this.timer)return;if(d.debug("cachekeep","started"),this.timer=(this.options.setIntervalImpl??globalThis.setInterval)(()=>{this.tick().catch(()=>{d.warn("cachekeep","tick failed")})},QL),"unref"in this.timer)this.timer.unref()}stop(){if(!this.timer)return;d.debug("cachekeep","stopped"),(this.options.clearIntervalImpl??globalThis.clearInterval)(this.timer),this.timer=null}stats($,Z=this.options.now?.()??Date.now(),J=!1){let X=J?"always":iz($,new Date(Z)),Y=[...this.targets.values()].filter((z)=>z.dayKey===X),G=Y.length?Math.min(...Y.map((z)=>z.nextPrewarmAt)):void 0;return{trackedSessions:Y.length,nextPrewarmAt:G}}trackedSessions(){return[...this.targets.values()].map(($)=>({id:$.id,cacheExpiresAt:$.cacheExpiresAt,nextPrewarmAt:$.nextPrewarmAt})).sort(($,Z)=>$.id.localeCompare(Z.id))}trackedOAuthRoute($){let Z=this.targets.get($);return Z?{oauthAccountId:Z.oauthAccountId}:void 0}trackedCount(){return this.targets.size}publishTrackedSessions(){let $=this.options.onTrackedSessionsChanged;if(!$)return;try{Promise.resolve($(this.trackedSessions())).catch(()=>{d.warn("cachekeep","failed to publish tracked sessions")})}catch{d.warn("cachekeep","failed to publish tracked sessions")}}totalBodyBytes(){return[...this.targets.values()].reduce(($,Z)=>$+Z.bodyText.length,0)}evictOldestTarget(){let $=this.targets.keys().next().value;if($!==void 0)this.targets.delete($)}pruneTargets($,Z){for(let[J,X]of this.targets){if(Z&&X.dayKey!==Z){this.targets.delete(J);continue}if($>=X.cacheExpiresAt)this.targets.delete(J)}while(this.targets.size>KL)this.evictOldestTarget();while(this.totalBodyBytes()>XY){let J=this.targets.size;if(this.evictOldestTarget(),this.targets.size===J)break}}track($){if(!$.sessionId)return{tracked:!1,reason:"missing session id"};if(!lz($.storage))return{tracked:!1,reason:"cachekeep disabled"};if($.cacheMode!=="hybrid")return{tracked:!1,reason:"cache mode is not hybrid"};if($.bodyText.length>XY)return{tracked:!1,reason:"body exceeds cachekeep memory budget"};let Z=this.options.now?.()??Date.now(),J=bZ($.storage);if(!QY($.storage,new Date(Z)))return{tracked:!1,reason:"outside configured schedule"};let X=WY($.storage,J,new Date(Z));if(this.pruneTargets(Z,X),this.targets.has($.sessionId))this.targets.delete($.sessionId);let Y={};return $.headers.forEach((G,z)=>{Y[z]=G}),this.targets.set($.sessionId,{id:$.sessionId,url:$.url,headers:Y,bodyText:$.bodyText,cacheExpiresAt:Z+B2,nextPrewarmAt:Z+B2-JY,consecutiveFailures:0,dayKey:X,oauthAccountId:$.oauthAccountId,oauthAccountIdentity:$.oauthAccountIdentity,accountStoragePath:$.accountStoragePath,isSubagent:$.isSubagent??!1}),this.pruneTargets(Z,X),this.publishTrackedSessions(),this.start(),{tracked:!0}}async prewarmNow($){let Z={};$.headers.forEach((X,Y)=>{Z[Y]=X});let J={id:$.sessionId,url:$.url,headers:Z,bodyText:$.bodyText,cacheExpiresAt:this.options.now?.()??Date.now(),nextPrewarmAt:this.options.now?.()??Date.now(),consecutiveFailures:0,dayKey:"",oauthAccountId:$.oauthAccountId,oauthAccountIdentity:$.oauthAccountIdentity,accountStoragePath:$.accountStoragePath,isSubagent:$.isSubagent??!1};return this.sendPrewarm(J)}tick(){if(this.tickPromise)return this.tickPromise;let $;return $=this.runTick().finally(()=>{if(this.tickPromise===$)this.tickPromise=null}),this.tickPromise=$,$}async runTick(){let $=await this.options.loadStorage(),Z=bZ($),J=this.options.now?.()??Date.now(),X=WY($,Z,new Date(J));if(x0($))for(let Y of this.targets.values())Y.dayKey="always";if(this.pruneTargets(J,X),!this.targets.size){this.publishTrackedSessions(),this.stop();return}if(!NL($)){this.publishTrackedSessions();return}if(!QY($,new Date(J))){this.publishTrackedSessions();return}d.debug("cachekeep","fired",{targets:this.targets.size});for(let Y of this.targets.values()){if(Y.nextPrewarmAt>J)continue;try{await this.prewarm(Y,J)}catch{d.warn("cachekeep","prewarm failed",{session:Y.id}),Y.consecutiveFailures+=1,Y.nextPrewarmAt=J+VY(Y.id,Y.consecutiveFailures)}}this.publishTrackedSessions()}async sendPrewarm($){let Z={id:++this.nextPrewarmAttemptId,signal:AbortSignal.timeout(this.options.prewarmTimeoutMs??WL)};try{let J=$.bodyText;if(this.options.prepareBody)try{J=await this.options.prepareBody(J,$)}catch{d.warn("cachekeep","prepare body failed",{session:$.id})}let X={...$,bodyText:J},Y=await DL(J);if(!Y.ok)return Y;let G=this.options.fetchImpl??fetch,z={...X,bodyText:Y.bodyText},Q=this.options.prepareHeaders?await this.options.prepareHeaders(new Headers($.headers),z,Z):new Headers($.headers);if(!Q)return{ok:!1,reason:YY,transient:!0};Q.delete("content-length"),Q.delete("transfer-encoding");let K,W=async(N)=>{let U=y1(OL(N),"http");try{let L=await G($.url,{method:"POST",headers:N,body:Y.bodyText,signal:Z.signal});return U.redactResponse(L)}catch(L){let D=U.redactError(L);throw U.dispose(),D}};try{if(K=await W(Q),K.status===401&&!Z.signal?.aborted&&this.options.retryOnUnauthorized){let N;try{N=await this.options.retryOnUnauthorized({target:z,headers:Q,bodyText:Y.bodyText,attempt:Z})}catch{}if(N&&!Z.signal?.aborted)N.delete("content-length"),N.delete("transfer-encoding"),await K.body?.cancel().catch(()=>{}),Q=N,K=await W(Q)}}catch(N){return{ok:!1,reason:N instanceof Error?N.message:String(N),transient:!0}}let V=this.options.now?.()??Date.now(),B=await K.text().catch(()=>""),j=null;try{j=B?JSON.parse(B):null}catch{}try{await this.options.onResponse?.({target:$,bodyText:Y.bodyText,status:K.status,data:j,receivedAt:V,attempt:Z})}catch{}try{let N=await pj({affinity:$.id,route:"cachekeep",status:K.status,bodyText:Y.bodyText,url:$.url,method:"POST",headers:Q,tag:"cachekeep"});await lj(N,{status:K.status,message:j})}catch{d.debug("cachekeep","dump failed",{session:$.id})}if(!K.ok)return{ok:!1,reason:B||`HTTP ${K.status}`,status:K.status};let q=(j&&typeof j==="object"&&!Array.isArray(j)?j:null)?.usage;return{ok:!0,...q&&{usage:q}}}finally{try{await this.options.onComplete?.({target:$,attempt:Z})}catch{}}}async prewarm($,Z){let J=await this.sendPrewarm($);if(!J.ok){if(J.status==null&&!J.transient)d.debug("cachekeep","prewarm skipped",{session:$.id,reason:J.reason}),this.targets.delete($.id);else d.warn("cachekeep","prewarm failed",{session:$.id,status:J.status,...J.transient&&{transient:!0},...J.reason===YY&&{reason:J.reason}}),$.consecutiveFailures+=1,$.nextPrewarmAt=Z+VY($.id,$.consecutiveFailures);return}$.cacheExpiresAt=Z+B2,$.nextPrewarmAt=$.cacheExpiresAt-JY,$.consecutiveFailures=0,d.debug("cachekeep","prewarm succeeded",{session:$.id,...J.usage&&{usage:J.usage}})}}var TL=180000;function FL($){if(!$||typeof $!=="object"||Array.isArray($))return;let Z=$;if(typeof Z.id!=="string"||Z.id.length===0||typeof Z.cacheExpiresAt!=="number"||!Number.isFinite(Z.cacheExpiresAt)||typeof Z.nextPrewarmAt!=="number"||!Number.isFinite(Z.nextPrewarmAt))return;return{id:Z.id,cacheExpiresAt:Z.cacheExpiresAt,nextPrewarmAt:Z.nextPrewarmAt}}function CL($){if(!$||typeof $!=="object"||Array.isArray($))return;let Z=$;if(Z.version!==1||typeof Z.updatedAt!=="number"||!Number.isFinite(Z.updatedAt)||!Array.isArray(Z.sessions))return;return{version:1,updatedAt:Z.updatedAt,sessions:Z.sessions.flatMap((J)=>{let X=FL(J);return X?[X]:[]})}}function IR($){return z5(RL(),"opencode-anthropic-auth","cachekeep-sessions",$)}class SL{options;filePath;writeChain=Promise.resolve();constructor($){this.options=$;let Z=$.instanceId??`${process.pid}-${BY()}`;this.filePath=z5($.directory,`${Z}.json`)}publish($){let Z=$.map((J)=>({...J}));return this.writeChain=this.writeChain.catch(()=>{}).then(async()=>{if(Z.length===0){await qY(this.filePath,{force:!0});return}await ML(this.options.directory,{recursive:!0,mode:448});let J=`${this.filePath}.${BY()}.tmp`,X={version:1,updatedAt:this.options.now?.()??Date.now(),sessions:Z};await AL(J,`${JSON.stringify(X)}
+`,{mode:384}),await wL(J,this.filePath)}),this.writeChain}async list($=[]){await this.writeChain.catch(()=>{});let Z=this.options.now?.()??Date.now(),J=this.options.leaseMs??TL,X;try{X=(await PL(this.options.directory)).filter((z)=>z.endsWith(".json"))}catch{X=[]}let Y=await Promise.all(X.map(async(z)=>{try{let Q=await _L(z5(this.options.directory,z),"utf8");return CL(JSON.parse(Q))}catch{return}})),G=new Map;for(let z of Y){if(!z||Z-z.updatedAt>J||z.updatedAt>Z)continue;for(let Q of z.sessions){let K=G.get(Q.id);if(!K||Q.cacheExpiresAt>K.cacheExpiresAt)G.set(Q.id,Q)}}for(let z of $){let Q=G.get(z.id);if(!Q||z.cacheExpiresAt>Q.cacheExpiresAt)G.set(z.id,{...z})}return[...G.values()].sort((z,Q)=>z.id.localeCompare(Q.id))}async dispose(){await this.writeChain.catch(()=>{}),await qY(this.filePath,{force:!0})}}var pL="anthropic-auth-opencode";var cL=1,Q5=16384,az=30000,m1=/^[0-9a-f]{64}$/,LY=new Set(["invalid_params","pending_exists","not_found","already_consumed","superseded","stale_generation"]);function TR($={}){return H4.connect($)}function lL($){let Z=HY($)||".json",J=tz($,HY($));return{statePath:hZ(n9($),`${J}-state${Z}`),tokenPath:$}}function o9($,Z=process.env,J=process.cwd()){let X=Z[`${$.toUpperCase()}_ANTHROPIC_AUTH_CLAUSTRUM_ENROLLMENT_FILE`]?.trim(),Y=X?uL(X)?X:mL(J,X):hZ(Z.XDG_STATE_HOME||hZ(yL(),".local","state"),"cortexkit","anthropic-auth",`${$}-enrollment.json`);return lL(Y)}function nz($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function v7($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0}function oz($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=1}function p1($){if(!nz($)||$.version!==cL||typeof $.proposedName!=="string"||$.proposedName.length===0)throw Error("invalid Claustrum enrollment state");if($.phase==="pending"){if(!m1.test(String($.requestSecret??""))||$.requestId!==void 0&&(typeof $.requestId!=="string"||$.requestId.length===0)||!v7($.createdAt)||!v7($.updatedAt))throw Error("invalid Claustrum enrollment state");return{version:1,phase:"pending",proposedName:$.proposedName,requestSecret:$.requestSecret,...$.requestId!==void 0&&{requestId:$.requestId},createdAt:$.createdAt,updatedAt:$.updatedAt}}if($.phase==="approved"){if($.approvedName!==void 0&&(typeof $.approvedName!=="string"||$.approvedName.length===0)||!oz($.tokenGeneration)||!v7($.updatedAt))throw Error("invalid Claustrum enrollment state");return{version:1,phase:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration,updatedAt:$.updatedAt}}if($.phase==="denied"||$.phase==="blocked"){if($.errorCode!==void 0&&typeof $.errorCode!=="string"||!v7($.updatedAt))throw Error("invalid Claustrum enrollment state");return{version:1,phase:$.phase,proposedName:$.proposedName,...$.errorCode!==void 0&&{errorCode:$.errorCode},updatedAt:$.updatedAt}}throw Error("invalid Claustrum enrollment state")}function c1($){if(!nz($)||!m1.test(String($.token??""))||!oz($.token_generation))throw Error("invalid Claustrum enrollment token file");return{token:$.token,token_generation:$.token_generation}}function iL($){if(!$.isFile())throw Error("Claustrum enrollment file must be a regular file");if(($.mode&63)!==0)throw Error("Claustrum enrollment file must be owner-only");let Z=process.getuid?.();if(Z!==void 0&&$.uid!==Z)throw Error("Claustrum enrollment file must be owned by the current user")}async function n6($){let Z;try{Z=await dz($,jY.O_RDONLY|jY.O_NOFOLLOW)}catch(J){if(J.code==="ENOENT")return;throw Error("Claustrum enrollment file could not be opened safely")}try{iL(await Z.stat());let J=Buffer.alloc(Q5+1),{bytesRead:X}=await Z.read(J,0,J.byteLength,0);if(X>Q5)throw Error("Claustrum enrollment file is too large");return I6(J.subarray(0,X).toString("utf8"))}finally{await Z.close()}}async function rz($){let Z;try{Z=await bL($)}catch{return}for(;;){let J=await gL(Z).catch(()=>{return});if(J&&(J.mode&18)!==0&&(J.mode&512)===0)throw Error("Claustrum enrollment path has an unsafe writable ancestor");let X=n9(Z);if(X===Z)return;Z=X}}async function $6($,Z){let J=n9($);await u1(J,{recursive:!0,mode:448}),await rz(J);let X=`${JSON.stringify(Z)}
+`;if(Buffer.byteLength(X)>Q5)throw Error("Claustrum enrollment state is too large");let Y=hZ(J,`.${tz($)}.${process.pid}.${fL()}.tmp`),G;try{G=await dz(Y,"wx",384),await G.writeFile(X,"utf8"),await G.sync(),await G.close(),G=void 0,await EL(Y,384),await hL(Y,$)}finally{await G?.close().catch(()=>{}),await sz(Y).catch(()=>{})}}async function dL($,Z=pL){let J=await n6($.tokenPath),X=J===void 0?void 0:c1(J),Y=await n6($.statePath),G=Y===void 0?void 0:p1(Y);if(X)return{state:"approved",proposedName:G?.proposedName??Z,...G?.phase==="approved"&&G.approvedName!==void 0&&{approvedName:G.approvedName},tokenGeneration:X.token_generation};if(!G)return{state:"idle"};if(G.phase==="pending")return{state:"pending",proposedName:G.proposedName,...G.requestId!==void 0&&{requestId:G.requestId}};if(G.phase==="approved")return{state:"blocked",proposedName:G.proposedName,code:"missing_token"};if(G.phase==="denied")return{state:"denied",proposedName:G.proposedName};return{state:"blocked",proposedName:G.proposedName,code:G.errorCode??"unknown"}}async function sL($){await rz($);let Z=await n6($);if(Z===void 0)throw Error("Claustrum enrollment is not configured");return c1(Z)}function Z6($){if($.phase==="pending")return{state:"pending",proposedName:$.proposedName,...$.requestId!==void 0&&{requestId:$.requestId}};if($.phase==="approved")return{state:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration};if($.phase==="denied")return{state:"denied",proposedName:$.proposedName};return{state:"blocked",proposedName:$.proposedName,code:$.errorCode??"unknown"}}class tL{#$;#Z;#G;#X;#Q;#Y;constructor($){this.#$=$.client,this.#Z=$.paths,this.#G=$.proposedName,this.#X=$.now??Date.now,this.#Q=$.mintSecret??(()=>vL(32).toString("hex")),this.#Y=$.writeTokenFile??n8}async status(){return dL(this.#Z,this.#G)}async resetTerminal(){return aL(this.#Z,this.#G)}async reconcile(){await u1(n9(this.#Z.statePath),{recursive:!0,mode:448});let $=await t6({name:"ceremony",path:this.#Z.statePath,ttlMs:az,renew:!0});if(!$)return{state:"busy"};try{let Z=await n6(this.#Z.tokenPath),J=Z===void 0?void 0:c1(Z),X=await n6(this.#Z.statePath),Y=X===void 0?void 0:p1(X);if(Y&&Y.proposedName!==this.#G)throw Error("Claustrum enrollment state belongs to a different consumer");if(J){if(!Y||Y.phase==="pending"){let z={version:1,phase:"approved",proposedName:Y?.proposedName??this.#G,tokenGeneration:J.token_generation,updatedAt:this.#X()};await $6(this.#Z.statePath,z),Y=z}return{state:"approved",proposedName:Y.proposedName,...Y.phase==="approved"&&Y.approvedName!==void 0&&{approvedName:Y.approvedName},tokenGeneration:J.token_generation}}if(Y?.phase==="approved"){let z={version:1,phase:"blocked",proposedName:Y.proposedName,errorCode:"missing_token",updatedAt:this.#X()};return await $6(this.#Z.statePath,z),Z6(z)}if(Y&&Y.phase!=="pending")return Z6(Y);if(!Y){let z=this.#X();if(Y={version:1,phase:"pending",proposedName:this.#G,requestSecret:this.#Q(),createdAt:z,updatedAt:z},!m1.test(Y.requestSecret))throw Error("invalid minted Claustrum enrollment secret");await $6(this.#Z.statePath,Y)}if(!Y.requestId)try{let z=kL("sha256").update(Buffer.from(Y.requestSecret,"hex")).digest("hex"),Q=await this.#$.enrollPropose({name:Y.proposedName,requestSecretHash:z});Y={...Y,requestId:Q.requestId,updatedAt:this.#X()},await $6(this.#Z.statePath,Y)}catch(z){if(z instanceof k$){if(!LY.has(z.code)&&(z.code==="pending_queue_full"||z.action==="retry"))return{state:"pending",proposedName:Y.proposedName,retryCode:z.code};let Q={version:1,phase:"blocked",proposedName:Y.proposedName,errorCode:z.code,updatedAt:this.#X()};return await $6(this.#Z.statePath,Q),Z6(Q)}throw z}let G=Y.requestId;if(!G)return Z6(Y);try{let z=await this.#$.enrollPoll({requestId:G,requestSecret:Y.requestSecret});if(z.status==="pending")return Z6(Y);if(z.status==="denied"){let K={version:1,phase:"denied",proposedName:Y.proposedName,updatedAt:this.#X()};return await $6(this.#Z.statePath,K),Z6(K)}await this.#Y(this.#Z.tokenPath,{token:z.token,token_generation:z.tokenGeneration});let Q={version:1,phase:"approved",proposedName:Y.proposedName,approvedName:z.name,tokenGeneration:z.tokenGeneration,updatedAt:this.#X()};return await $6(this.#Z.statePath,Q),Z6(Q)}catch(z){if(!(z instanceof k$))throw z;if(!LY.has(z.code)&&z.action==="retry")return{state:"pending",proposedName:Y.proposedName,requestId:G,retryCode:z.code};let Q={version:1,phase:"blocked",proposedName:Y.proposedName,errorCode:z.code,updatedAt:this.#X()};return await $6(this.#Z.statePath,Q),Z6(Q)}}finally{await $.release()}}}async function aL($,Z){await u1(n9($.statePath),{recursive:!0,mode:448});let J=await t6({name:"ceremony",path:$.statePath,ttlMs:az,renew:!0});if(!J)return"busy";try{if(await n6($.tokenPath)!==void 0)return"refused-approved";let X=await n6($.statePath);if(X===void 0)return"idle";let Y=p1(X);if(Y.proposedName!==Z)throw Error("Claustrum enrollment state belongs to a different consumer");if(Y.phase==="pending")return"refused-pending";return await J.assertOwned(),await sz($.statePath),"reset"}finally{await J.release()}}Y4();function nL($,Z){return Z!==void 0&&Z.credentialId===$.credentialId&&Z.accountId===$.accountId&&Z.recordVersion!==$.recordVersion}function oL($,Z){if(Z===void 0)return"reauthorize-failed";if(Z.credentialId!==$.credentialId)return"credential-changed";if(Z.accountId!==$.accountId)return"account-changed";if(Z.recordVersion===$.recordVersion)return"version-unchanged";return"rotated"}function rL($,Z,J){let X=nL(Z,J);return d.debug("claustrum","scoped 401 re-authorized",{site:$,credentialId:Z.credentialId,servedVersion:Z.recordVersion,currentVersion:J?.recordVersion??null,retry:X,reason:oL(Z,J)}),X}var UY=300000;function eL($){let Z=$.trim();if(Z.startsWith("{")){let J;try{J=I6(Z)}catch{throw Error("Claustrum returned invalid OAuth material")}if(!J||typeof J!=="object")throw Error("Claustrum returned invalid OAuth material");let X=J,Y=X.access_token??X.access;Z=typeof Y==="string"?Y:""}if(!/^[\x21-\x7e]+$/.test(Z)||Z.startsWith(O1))throw Error("Claustrum returned invalid OAuth material");return Z}class ez{#$;#Z;#G;#X=new WeakMap;#Q=new WeakMap;#Y=!1;constructor($){let Z=$.tokenPath;if($.readToken)this.#Z=$.readToken;else if(Z)this.#Z=()=>sL(Z);else throw Error("Claustrum enrollment token path is required");this.#$=$.client,this.#G=$.now??Date.now}#J($){if(this.#Y)throw Error("Claustrum scoped custody is closed");$?.throwIfAborted()}async#W($){this.#J($);let Z=await this.#Z();if(this.#J($),!/^[0-9a-f]{64}$/.test(Z.token)||!Number.isSafeInteger(Z.token_generation)||Z.token_generation<1)throw Error("Invalid Claustrum enrollment token");return Z.token}async#K($,Z){this.#J(Z);let J,X;try{let Y=$();J=Z?await Promise.race([Y,new Promise((G,z)=>{let Q=()=>z(Z.reason);if(Z.addEventListener("abort",Q,{once:!0}),X=()=>Z.removeEventListener("abort",Q),Z.aborted)Q()})]):await Y}catch(Y){if(this.#J(Z),Y instanceof k$)throw Y;throw Error("Claustrum scoped operation unavailable")}finally{X?.()}return this.#J(Z),J}async discover($){let Z=await this.#W($),J=await this.#K(()=>this.#$.listScoped(Z),$),X=new Set,Y=[];for(let G of J.rows){if(G.refreshAdapter!=="anthropic"||G.credentialType!=="oauth"||!G.operations.includes("read"))continue;if(!G.id||!G.accountId?.trim()||X.has(G.id))throw Error("Claustrum inventory has missing or ambiguous account identity");X.add(G.id),Y.push(Object.freeze({credentialId:G.id,accountId:G.accountId,state:G.state,...G.email!==void 0&&{email:G.email},...G.orgName!==void 0&&{orgName:G.orgName}}))}return{view:J.view,accounts:Object.freeze(Y)}}async authorize($,Z){if(!$.credentialId||!$.accountId)throw Error("Claustrum dispatch requires account identity");let{credentialId:J,accountId:X}=$,Y=await this.#W(Z),G=await this.#K(()=>this.#$.getScoped({credentialId:J,enrollmentToken:Y,minTtlMs:UY}),Z);if(G.credentialId!==J||G.accountId!==X)throw Error("Claustrum served credential identity changed");if(!Number.isSafeInteger(G.recordVersion)||G.recordVersion<0||G.expiresAtMs===null||!Number.isFinite(G.expiresAtMs)||G.expiresAtMs-this.#G()<UY)throw Error("Claustrum served credential has insufficient validity");let z=eL(G.material),Q=Object.freeze(Object.defineProperty({credentialId:J,accountId:X,recordVersion:G.recordVersion,expiresAtMs:G.expiresAtMs},"accessToken",{value:z,enumerable:!1}));return this.#X.set(Q,Y),Q}async reportFailure($,Z,J){if(Z!==401)return;this.#J();let X=this.#X.get($);if(!X)throw Error("Claustrum failure report requires an original dispatch receipt");let Y=this.#Q.get($);if(Y)return Y;let G=this.#K(()=>this.#$.reportAuthFailureScoped({credentialId:$.credentialId,enrollmentToken:X,providerStatus:401,recordVersion:$.recordVersion,reporterSource:J}));this.#Q.set($,G);try{await G,d.debug("claustrum","scoped 401 reported",{credentialId:$.credentialId,recordVersion:$.recordVersion,reporterSource:J})}catch(z){throw this.#Q.delete($),z}}close(){if(this.#Y)return;this.#Y=!0,this.#$.close()}}class $Q extends Error{code="claustrum_roster_busy";constructor(){super("Claustrum account discovery is already in progress")}}function ZQ($){let Z=$.split(":");return Z.length>=3&&Z[2]?.trim()?Z.slice(2).join(":").trim():void 0}function $U($){let Z=ZQ($.credentialId);if(Z)return Z;return`scoped-${l1("sha256").update($.accountId).digest("hex")}`}function ZU($,Z){let J=new Set,X=new Map;for(let Y of Z){if(!Y.credentialId.trim()||!Y.accountId.trim()||J.has(Y.credentialId))throw Error("Claustrum returned an ambiguous account inventory");J.add(Y.credentialId);let G=X.get(Y.accountId)??[];G.push(Y),X.set(Y.accountId,G)}return[...X.values()].map((Y)=>{let G=$.accounts.find((V)=>E$(V)&&V.anthropicAccountUuid===Y[0]?.accountId),z=Y.toSorted((V,B)=>V.credentialId.localeCompare(B.credentialId)),Q=z.filter((V)=>V.state==="active"),K=Q.length?Q:z,W=K.find((V)=>V.credentialId==="oauth:anthropic")??K.find((V)=>V.credentialId===G?.claustrumScopedCredentialId)??K[0];if(!W)throw Error("Claustrum returned an empty account identity group");return W}).sort((Y,G)=>Y.credentialId.localeCompare(G.credentialId))}function JU($,Z,J,X=Date.now()){if(new Set($.accounts.map((q)=>q.id)).size!==$.accounts.length)throw Error("Account configuration contains duplicate route identities");let Y=ZU($,Z),G=Z.find((q)=>q.credentialId==="oauth:anthropic")?.accountId,z=Y.find((q)=>q.accountId===G),Q=new Set($.claustrum?.disabledAccountIdentities??[]);for(let q of $.accounts){if(!E$(q)||!q.anthropicAccountUuid)continue;if(q.enabled===!1)Q.add(q.anthropicAccountUuid);else Q.delete(q.anthropicAccountUuid)}let K=new Set($.accounts.filter(E$).map((q)=>q.id)),W=new Set($.accounts.map((q)=>q.id)),V=Y.filter((q)=>q!==z).map((q)=>{let N=$.accounts.find((L)=>E$(L)&&K.has(L.id)&&L.anthropicAccountUuid===q.accountId),U=N?.id??$U(q);while(U!==N?.id&&W.has(U)||U==="main")U=`scoped-${U}`;if(W.add(U),N)K.delete(N.id);return{id:U,label:N?.label??ZQ(q.credentialId)??q.email??q.credentialId,type:"oauth",enabled:N?N.enabled!==!1:!Q.has(q.accountId),addedAt:N?.addedAt??X,anthropicAccountUuid:q.accountId,claustrumScopedCredentialId:q.credentialId,claustrumScopedState:q.state,authLineageId:`scoped:${l1("sha256").update(q.accountId).digest("hex")}`,refresh:"",quota:N?.quota,profile:N?.profile,prime:N?.prime,lastUsed:N?.lastUsed,lastQuotaRefreshError:N?.lastQuotaRefreshError}}),B=new Map(V.map((q)=>[q.id,q])),j=$.accounts.flatMap((q)=>{if(!E$(q))return[q];let N=B.get(q.id);if(!N)return[];return B.delete(q.id),[N]});j.push(...B.values());let H={...$,claustrum:{...$.claustrum,scopedRoster:!0,rosterView:J,primaryAccount:z?{credentialId:z.credentialId,accountId:z.accountId,state:z.state}:void 0,disabledAccountIdentities:[...Q].sort()},accounts:j};return{primary:z,accounts:V,storage:H,view:J}}async function XU($){if($.signal?.throwIfAborted(),C4(await V6($.path))!=="claustrum")return;let Z=await t6({name:"scoped-roster",path:$.path,ttlMs:30000,renew:!0});if(!Z){let J=await V6($.path);if($.signal?.throwIfAborted(),C4(J)!=="claustrum"||J?.claustrum?.scopedRoster!==!0||!J.claustrum.primaryAccount?.credentialId||!J.claustrum.primaryAccount.accountId)throw new $Q;let X=J.claustrum.primaryAccount,Y=J.accounts.filter((z)=>E$(z)&&Boolean(z.claustrumScopedCredentialId)),G=J.claustrum.rosterView??`persisted:${l1("sha256").update(JSON.stringify([X.credentialId,X.accountId,X.state,Y.map((z)=>[z.id,z.claustrumScopedCredentialId,z.anthropicAccountUuid,z.claustrumScopedState,z.enabled])])).digest("hex")}`;return{primary:X,accounts:Y,storage:J,view:G}}try{if(C4(await V6($.path))!=="claustrum")return;let J=await $.custody.discover($.signal);$.signal?.throwIfAborted();let X=await oB($.path,(G)=>{if(C4(G)!=="claustrum")return{storage:G,result:void 0,save:!1};let z=JU(G,J.accounts,J.view,$.now?.()),Q=new Set(z.storage.accounts.map((W)=>W.id)),K=G.accounts.filter((W)=>E$(W)&&!Q.has(W.id)).map((W)=>W.id);return{storage:z.storage,result:z,options:{removedAccountIds:K,preserveExistingAccountOrder:!1},save:JSON.stringify(G)!==JSON.stringify(z.storage)}},{assertAuthority:async()=>{$.signal?.throwIfAborted(),await Z.assertOwned()}});if(!X)return;let Y=await V6($.path);if($.signal?.throwIfAborted(),await Z.assertOwned(),!Y||C4(Y)!=="claustrum")return;return{...X,storage:Y,accounts:Y.accounts.filter((G)=>E$(G)&&Boolean(G.claustrumScopedCredentialId))}}finally{await Z.release()}}var YU="https://api.anthropic.com/api/oauth/profile",GU=604800000;async function i1($){M1($.accessToken,"anthropic");let Z=await($.fetchImpl??fetch)(YU,{method:"GET",signal:$.signal,headers:{Authorization:`Bearer ${$.accessToken}`,Accept:"application/json","anthropic-beta":"oauth-2025-04-20"}});if(!Z.ok)throw Error(`Claude profile check failed: ${Z.status}`);let J=await Z.json(),X=J.organization?.rate_limit_tier,Y=J.organization?.organization_type;if(typeof X!=="string"||X.trim()===""||typeof Y!=="string"||Y.trim()==="")throw Error("Claude profile response is missing account metadata");return{tier:X,orgType:Y,checkedAt:$.now?.()??Date.now(),...$.accountIdentity!==void 0&&{accountIdentity:$.accountIdentity},...$.providerAccountUuid!==void 0&&{providerAccountUuid:$.providerAccountUuid}}}function kR($,Z){if(!$)return!1;if(Z===void 0)return!0;return $.accountIdentity===void 0||$.accountIdentity===Z}function vR($,Z=Date.now()){return Boolean($&&Number.isFinite($.checkedAt)&&Z>=$.checkedAt&&Z-$.checkedAt<GU)}function gZ($){let Z=$?.tier.match(/^default_claude_max_(\d+)x$/);if(!Z)return;let J=`Max ${Z[1]}x`;return $?.orgType==="claude_team"?`Team · ${J}`:J}class zU{#$;#Z=new AbortController;#G;#X;#Q;#Y;#J;#W=!1;constructor($){this.#$=$}#K($){this.#Z.signal.throwIfAborted(),$?.throwIfAborted()}#z($,Z){let J=AbortSignal.any([this.#Z.signal,...Z?[Z]:[]]);return new Promise((X,Y)=>{let G=()=>J.removeEventListener("abort",z),z=()=>{G(),Y(J.reason)};if(J.addEventListener("abort",z,{once:!0}),$.then((Q)=>{if(G(),J.aborted)Y(J.reason);else X(Q)},(Q)=>{G(),Y(Q)}),J.aborted)z()})}async#V(){if(this.#K(),this.#G)return this.#G;if(!this.#X)this.#X=this.#$.connect().then(($)=>{if(this.#Z.signal.aborted)$.close(),this.#K();return this.#G=new ez({client:$,tokenPath:this.#$.tokenPath}),this.#G}).finally(()=>{this.#X=void 0});return this.#z(this.#X)}snapshot(){return this.#Y}refresh(){if(this.#K(),this.#Q)return this.#Q;return this.#Q=(async()=>{if(C4(await V6(this.#$.storagePath))!=="claustrum"){this.#Y=void 0,this.#G?.close(),this.#G=void 0;return}let $=await this.#V(),Z=await XU({path:this.#$.storagePath,custody:$,signal:this.#Z.signal});this.#K();let J=Z?.view!==this.#Y?.view;if(this.#Y=Z,Z&&J)this.#$.onRoster?.(Z);return Z})().finally(()=>{this.#Q=void 0}),this.#Q}start(){if(this.#W)return;this.#K(),this.#W=!0;let $=async()=>{try{await this.refresh()}catch{if(!this.#Z.signal.aborted)this.#$.onError?.()}if(this.#Z.signal.aborted)return;let Z=this.#$.pollIntervalMs??5000;if(Z<=0)return;this.#J=(this.#$.setTimeoutImpl??setTimeout)(()=>{this.#J=void 0,$()},Z),this.#J.unref?.()};$()}async authorize($,Z){this.#K(Z);let J=this.#Y??await this.#z(this.refresh(),Z),X=await V6(this.#$.storagePath);if(this.#K(Z),!J||C4(X)!=="claustrum")throw Error("Claustrum scoped custody is not active");let Y,G;if($==="main"){let z=X?.claustrum?.primaryAccount;if(J.primary?.state!=="active"||z?.state!=="active"||z.accountId!==J.primary.accountId||z.credentialId!==J.primary.credentialId)throw Error("Claustrum primary account is unavailable or changed");if(Y=J.primary.credentialId,G=J.primary.accountId,X?.claustrum?.disabledAccountIdentities?.includes(G))throw Error("Claustrum primary account is disabled")}else{let z=J.accounts.find((K)=>K.id===$),Q=X?.accounts.find((K)=>K.id===$);if(!z||!Q||!E$(Q)||Q.enabled===!1||Q.claustrumScopedState!=="active"||Q.claustrumScopedCredentialId!==z.claustrumScopedCredentialId||Q.anthropicAccountUuid!==z.anthropicAccountUuid)throw Error("Claustrum route is disabled, removed or changed");Y=z.claustrumScopedCredentialId,G=z.anthropicAccountUuid}if(!Y||!G)throw Error("Claustrum route has no verified identity");return(await this.#z(this.#V(),Z)).authorize({credentialId:Y,accountId:G},AbortSignal.any([this.#Z.signal,...Z?[Z]:[]]))}async reportFailure($,Z,J){if(this.#K(),!this.#G)throw Error("Claustrum dispatch receipt has no active owner");await this.#G.reportFailure($,Z,J)}async fetchQuota($,Z=fetch){let J=await this.authorize($);return F9({accessToken:J.accessToken,fetchImpl:this.#B($,J,Z)})}async fetchProfile($,Z=fetch,J){let X=await this.authorize($,J);return i1({accessToken:X.accessToken,accountIdentity:X.accountId,providerAccountUuid:X.accountId,signal:J,fetchImpl:this.#B($,X,Z)})}#B($,Z,J){return Object.assign(async(X,Y)=>{this.#K();let G=AbortSignal.any([this.#Z.signal,...Y?.signal?[Y.signal]:[]]),z=await J(X,{...Y,signal:G}),Q=Z;if(z.status===401&&!G.aborted){let K;try{K=await this.authorize($,G)}catch{}if(rL("quota-profile",Q,K)){await z.body?.cancel().catch(()=>{});let W=new Headers(Y?.headers);W.set("authorization",`Bearer ${K.accessToken}`),Q=K,z=await J(X,{...Y,headers:W,signal:G})}}if(z.status===401)await this.reportFailure(Q,401,"direct").catch(()=>this.#$.onError?.());return z},{preconnect:J.preconnect})}close(){if(this.#Z.signal.aborted)return;if(this.#Z.abort(Error("Claustrum scoped runtime is closed")),this.#J)(this.#$.clearTimeoutImpl??clearTimeout)(this.#J);this.#J=void 0,this.#G?.close(),this.#Y=void 0}}function QU($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};let J=Z[0],X=Z.slice(1).join(" ");if(J==="enable"&&X)return{type:"enable",id:X};if(J==="disable"&&X)return{type:"disable",id:X};if(J==="remove"&&X)return{type:"remove",id:X};if(J==="move-up"&&X)return{type:"move-up",id:X};if(J==="move-down"&&X)return{type:"move-down",id:X};if(J==="reset-backoff"&&!X)return{type:"reset-backoff"};if(J==="enrollment-reset"&&!X)return{type:"enrollment-reset"};if(J==="claustrum"&&!X)return{type:"claustrum-mode",mode:"claustrum"};if(J==="local"&&!X)return{type:"claustrum-mode",mode:"local"};if(J==="add-apikey"&&X){let Y=X,G,z,Q=Y.match(/--base-url\s+(\S+)/);if(Q)G=Q[1],Y=Y.replace(Q[0],"").trim();let K=Y.match(/--auth-header\s+(authorization-bearer|x-api-key)/);if(K)z=K[1],Y=Y.replace(K[0],"").trim();let W,V=Y.match(/--label\s+(.+)/);if(V)W=V[1]?.trim()||void 0,Y=Y.replace(V[0],"").trim();let B=Y.indexOf(" ");if(B===-1){if(!Y)return{type:"usage"};return{type:"add-apikey",apiKey:Y,baseURL:G,authHeader:z,label:W}}let j=Y.slice(0,B),H=Y.slice(B+1).trim();return{type:"add-apikey",apiKey:j,label:W??(H||void 0),baseURL:G,authHeader:z}}if(J==="add-oauth-start")return{type:"add-oauth-start"};if(J==="add-oauth-finish"&&X){let Y=X,G,z=Y.match(/--label\s+(.+)/);if(z)G=z[1]?.trim()||void 0,Y=Y.replace(z[0],"").trim();if(!Y)return{type:"usage"};return{type:"add-oauth-finish",code:Y,label:G}}return{type:"usage"}}function NY($){switch($){case"na":return"n/a (OpenCode-managed)";case"off":return"not enrolled";case"on-vault-served":return"vault-served";case"on-vault-reauth":return"vault reauth";case"on-cold":return"vault cold";case"unknown-identity":return"unknown identity";case"on-identity-mismatch":return"identity mismatch";case"on-corrupt-binding":return"corrupt binding"}}function KU($,Z=!1){switch($.state){case"idle":return["- Enrollment: not enrolled"];case"busy":return["- Enrollment: setup is busy"];case"unavailable":return["- Enrollment: temporarily unavailable"];case"pending":return $.requestId&&/^[A-Za-z0-9_-]{1,128}$/.test($.requestId)?[`- Enrollment: pending approval (${$.requestId})`,"- Next: Quit the host and run `bunx @cortexkit/opencode-anthropic-auth setup`"]:[$.requestId?"- Enrollment: pending approval":"- Enrollment: request not sent","- Next: Quit the host and run `bunx @cortexkit/opencode-anthropic-auth setup`"];case"approved":{let X=$.approvedName??$.proposedName;return/^[A-Za-z0-9_-]{1,128}$/.test(X)?[`- Enrollment: approved as enrolled:${X} (generation ${$.tokenGeneration}${Z?"":"; scoped serving not active yet"})`,...Z?[]:["- Next: Quit the host and run `bunx @cortexkit/opencode-anthropic-auth setup`"]]:[`- Enrollment: approved (generation ${$.tokenGeneration}${Z?"":"; scoped serving not active yet"})`,...Z?[]:["- Next: Quit the host and run `bunx @cortexkit/opencode-anthropic-auth setup`"]]}case"denied":return["- Enrollment: denied by operator"];case"blocked":return[`- Enrollment: blocked (${$.code})`]}}function WU($){let Z=[],J=$.quota?.mainQuota?.five_hour;Z.push({id:"main",label:$.main?.provider==="anthropic"?"OpenCode anthropic":"Main",role:"main",enabled:!0,quotaPercent:J?.usedPercent??null,tierLabel:gZ($.main?.profile)});for(let X of $.accounts){let Y=X.quota?.five_hour;Z.push({id:X.id,label:X.label??X.id,role:"fallback",enabled:X.enabled!==!1,quotaPercent:Y?.usedPercent??null,tierLabel:X.type==="oauth"?gZ(X.profile):void 0})}return Z}var q2=["Usage:","  /claude-account                       Show account list","  /claude-account enable <id>           Enable a fallback account","  /claude-account disable <id>          Disable a fallback account","  /claude-account remove <id>           Remove a fallback account","  /claude-account claustrum             Enable Claustrum mode","  /claude-account local                 Enable local mode","  /claude-account move-up <id>          Move a fallback account up","  /claude-account move-down <id>        Move a fallback account down","  /claude-account reset-backoff          Clear main OAuth refresh and quota backoff","  /claude-account enrollment-reset       Clear denied/blocked state; rerun setup","  /claude-account add-apikey <key>      Add an API key fallback account","  /claude-account add-oauth-start       Start OAuth device flow","  /claude-account add-oauth-finish <code>  Complete OAuth flow"].join(`
+`);async function ER($){let Z=QU($.argumentsText),J=$.storage.accounts,X="main";if(Z.type==="status"){let G=$.statusProjection?.accounts??WU($.storage),z=$.statusProjection?.claustrumDetection??$.claustrum?.status??"unknown",Q=["## Claude Accounts","",`- Custody mode: ${C4($.storage)}`,`- Claustrum: ${z}`,...$.statusProjection?.claustrumEnrollment?KU($.statusProjection.claustrumEnrollment,$.statusProjection.accounts.some((K)=>K.role==="main"&&K.vaultServed)):[],""];for(let K of G){let W=K.quotaPercent!=null?` ${Math.round(K.quotaPercent)}%`:"",V=!K.enabled?" (disabled)":"",B=K.tierLabel?` · ${K.tierLabel}`:"",j=$.statusProjection?.accounts.find((N)=>N.id===K.id),H=$.storage.accounts.find((N)=>N.id===K.id),q=j?NY(j.custodyState):K.id!=="main"&&H&&C4($.storage)==="claustrum"&&E$(H)&&H.claustrumScopedCredentialId?NY("on-cold"):"local";Q.push(`- **${K.label}** [${K.role}]${B}${V}${W} · ${q}`)}return Q.push("",q2),{text:Q.join(`
+`)}}if(Z.type==="usage")return{text:q2};if(Z.type==="claustrum-mode"){if(!$.transition)return{text:"Claustrum mode transition is unavailable."};return $.transition(Z.mode)}if(Z.type==="enrollment-reset"){if(!$.resetEnrollment)return{text:"Claustrum enrollment reset is unavailable."};return $.resetEnrollment()}if(Z.type==="add-apikey")return{text:"add-apikey"};if(Z.type==="add-oauth-start")return{text:"add-oauth-start"};if(Z.type==="add-oauth-finish")return{text:"add-oauth-finish"};if(Z.type==="reset-backoff")return{text:"Main OAuth refresh and quota backoff cleared.",updated:{id:"main",action:"reset-backoff"}};let Y=Z.id;if(Y==="main")return{text:`Cannot ${Z.type} the main account (OpenCode managed).`};if(Z.type==="enable"||Z.type==="disable"){let G=J.find((z)=>z.id===Y);if(!G)return{text:`Account "${Y}" not found.`};return{text:`Account "${G.label??Y}" ${Z.type}d.`,updated:{id:Y,action:Z.type,enabled:Z.type==="enable"}}}if(Z.type==="remove"){let G=J.find((z)=>z.id===Y);if(!G)return{text:`Account "${Y}" not found.`};if(C4($.storage)==="claustrum"&&E$(G)&&G.claustrumScopedCredentialId)return{text:`Account "${G.label??Y}" is managed by Claustrum. Disable it to stop routing, or remove it from the vault.`};return{text:`Account "${G.label??Y}" removed.`,updated:{id:Y,action:"remove"}}}if(Z.type==="move-up"){let G=J.findIndex((W)=>W.id===Y);if(G<0)return{text:`Account "${Y}" not found.`};if(G===0)return{text:`Account "${J[G]?.label??Y}" is already first.`};let z=J.map((W)=>W.id),Q=[...J];[Q[G-1],Q[G]]=[Q[G],Q[G-1]];let K=Q.map((W)=>W.id);return{text:`Account "${J[G]?.label??Y}" moved up.`,updated:{id:Y,action:"reorder",previousOrder:z,newOrder:K}}}if(Z.type==="move-down"){let G=J.findIndex((W)=>W.id===Y);if(G<0)return{text:`Account "${Y}" not found.`};if(G===J.length-1)return{text:`Account "${J[G]?.label??Y}" is already last.`};let z=J.map((W)=>W.id),Q=[...J];[Q[G],Q[G+1]]=[Q[G+1],Q[G]];let K=Q.map((W)=>W.id);return{text:`Account "${J[G]?.label??Y}" moved down.`,updated:{id:Y,action:"reorder",previousOrder:z,newOrder:K}}}return{text:q2}}a4();Y4();var VU="ANTHROPIC_CUSTOM_HEADERS",BU=64,v6=new Map,K5=new Set,qU=new Set(["authorization","proxy-authorization","x-api-key","host","content-length","content-type","connection","transfer-encoding","upgrade","keep-alive","te","trailer","anthropic-version","anthropic-beta","x-parent-session-id","x-session-affinity","x-opencode-session","x-anthropic-effort-plan","x-cortexkit-billing-lineage"]);function xY($,Z){v6.delete($),v6.set($,Z);while(v6.size>BU){let J=v6.keys().next().value;if(J===void 0)break;v6.delete(J),K5.delete(J)}}function DY($,Z,J){if(qU.has(Z.trim().toLowerCase()))throw TypeError("protected header");$.set(Z,J)}function jU($){if(!$?.trim())return new Headers;let Z=v6.get($);if(Z!==void 0||v6.has($))return new Headers(Z??[]);try{let J=new Headers,X=$.trim();if(!X.startsWith("{")&&!X.startsWith("["))for(let G of X.split(/\r?\n|,\s*(?=[^,\s:]+:)/).map((z)=>z.trim()).filter(Boolean)){let z=G.indexOf(":");if(z<=0)throw TypeError("invalid header entry");DY(J,G.slice(0,z).trim(),G.slice(z+1).trim())}else{let G=I6(X);if(G==null||typeof G!=="object"||Array.isArray(G))throw TypeError("invalid header object");for(let[z,Q]of Object.entries(G)){if(Q==null)continue;DY(J,z,Array.isArray(Q)?Q.map(String).join(", "):String(Q))}}let Y=[...J.entries()];return xY($,Y),new Headers(Y)}catch{if(xY($,null),!K5.has($))K5.add($),d.warn("custom-headers","ignoring malformed ANTHROPIC_CUSTOM_HEADERS",{reason:"invalid or protected header configuration"});return new Headers}}function bR($,Z=process.env[VU]){return jU(Z).forEach((X,Y)=>{$.set(Y,X)}),$}var HU="## Claude Fast Mode Status",LU="## Claude Fast Mode Enabled",UU="## Claude Fast Mode Disabled",NU="## Claude Fast Mode Usage",xU="Usage: `/claude-fast`, `/claude-fast on`, or `/claude-fast off`.",D0=!1;function hR(){return D0}function gR($){D0=$}function DU($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="on")return{type:"enable"};if(Z.length===1&&Z[0]==="off")return{type:"disable"};return{type:"usage"}}function f7($){let Z=$?.enabled??D0;return[HU,"",`- Enabled: ${Z?"enabled":"disabled"}`,"- Persisted: ~/.config/opencode/anthropic-auth.json","- Scope: adds Anthropic fast mode to supported Opus requests","- Supported models: claude-opus-4-8, claude-opus-5, and claude-opus-5-5",'- Request changes: adds `speed: "fast"` and the `fast-mode-2026-02-01` beta header',"- Note: fast and standard speeds do not share prompt-cache prefixes"].join(`
+`)}function yR($){let Z=DU($.argumentsText),J=$.enabled??D0;if(Z.type==="status")return f7({enabled:J});if(Z.type==="enable")return[LU,"",f7({enabled:!0})].join(`
+`);if(Z.type==="disable")return[UU,"",f7({enabled:!1})].join(`
+`);return[NU,"",xU,"",f7({enabled:J})].join(`
+`)}var B8="claude-killswitch";function OU($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="on")return{type:"on"};if(Z.length===1&&Z[0]==="off")return{type:"off"};if(Z[0]==="set"){let J=[];for(let X=1;X<Z.length;X++){let Y=Z[X]?.match(/^([^:]+):(\d+),(\d+)(?:,(\d+))?$/);if(!Y)return{type:"usage"};let[,G,z,Q,K]=Y,W=typeof K==="string"&&K.length>0?Number.parseInt(K,10):void 0,V={account:G,fh:Number.parseInt(z,10),sd:Number.parseInt(Q,10)};if(W!==void 0)V.scoped=W;J.push(V)}if(J.length===0)return{type:"usage"};return{type:"set",entries:J}}return{type:"usage"}}function E7($,Z){let J=$.enabled===!0,X=["## Killswitch","",`Status: **${J?"ON":"OFF"}**`];if(J){X.push(""),X.push("| Account | 5h threshold | 1w threshold | Scoped |"),X.push("| ------- | ------------ | ------------ | ------ |");let Y=_Z($.main);X.push(`| main | ≥ ${Y.five_hour}% | ≥ ${Y.seven_day}% | ≤ ${Y.scoped}% |`);for(let G of Z){let z=_Z($.accounts?.[G]??$.main);X.push(`| ${G} | ≥ ${z.five_hour}% | ≥ ${z.seven_day}% | ≤ ${z.scoped}% |`)}}return X.join(`
+`)}var OY=["## Killswitch Commands","","```",`/${B8}              — show status`,`/${B8} on           — enable with current or default thresholds`,`/${B8} off          — disable`,`/${B8} set all:5,10 — set all accounts to 5h≥5%, 1w≥10%`,`/${B8} set main:3,8,0 — set 5h≥3%, 1w≥8%, scoped≤0%`,`/${B8} set main:3,8 work-alt:5,10 — per-account`,"```"].join(`
+`);function uR($){let Z=OU($.argumentsText);if(Z.type==="status")return{text:`${E7($.config,$.accountIds)}
+
+${OY}`};if(Z.type==="on"){let X={...$.config,enabled:!0,main:$.config.main??{five_hour:P8.five_hour,seven_day:P8.seven_day}};return{text:`## Killswitch Enabled
+
+${E7(X,$.accountIds)}`,updatedConfig:X}}if(Z.type==="off")return{text:"## Killswitch Disabled",updatedConfig:{...$.config,enabled:!1}};if(Z.type==="set"){let X={...$.config.accounts??{}},Y={...$.config,enabled:!0,accounts:X};for(let z of Z.entries){let Q={five_hour:z.fh,seven_day:z.sd};if(z.scoped!==void 0)Q.scoped=z.scoped;if(z.account==="main")Y.main=Q;else if(z.account==="all"){Y.main=Q;for(let K of $.accountIds)X[K]=Q}else X[z.account]=Q}return{text:`## Killswitch Updated
+
+${E7(Y,$.accountIds)}`,updatedConfig:Y}}return{text:`${E7($.config,$.accountIds)}
+
+${OY}`}}Y4();var IU=["error","warn","info","debug","trace"],JQ="Usage: `/claude-logging`, `/claude-logging error|warn|info|debug|trace`.";function MU($){let Z=$.trim().toLowerCase().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&IU.includes(Z[0]))return{type:"level",level:Z[0]};return{type:"usage"}}function j2($){return["## Claude Log Level","",`Current log level: \`${$?.level??"info"}\``,"- Persisted: ~/.config/opencode/anthropic-auth.json","- Valid levels: error, warn, info, debug, trace","",JQ].join(`
+`)}function mR($){let Z=MU($.argumentsText),J=$.level??"info";if(Z.type==="status")return j2({level:J});if(Z.type==="level")return["## Claude Log Level Updated","",`Level set to \`${Z.level}\`.`,"",...j2({level:Z.level}).split(`
+`).slice(2)].join(`
+`);return["## Claude Log Level Usage","",JQ,"",...j2({level:J}).split(`
+`).slice(2)].join(`
+`)}var W5="claude-fable-5",V5="claude-mythos-5",o6="claude-fable-5-1",k9="claude-mythos-5-1",XQ="claude-haiku-4-5";function P6($){return $.endsWith("[1m]")?$.slice(0,-4):$}var IY={input:1,output:5},YQ=[o6,k9],PU=[W5,V5,...YQ],r9={type:"adaptive",display:"summarized"},pR={input:10,output:50,cacheRead:1,cacheWrite5m:12.5,cacheWrite1h:20},cR={input:10,output:50,cacheRead:0.25,cacheWrite5m:12.5,cacheWrite1h:20},lR=1e6,iR=128000,_U="2026-06-09",wU="2026-09-01",MY={[W5]:{id:W5,name:"Claude Fable 5"},[V5]:{id:V5,name:"Claude Mythos 5",limited:!0},[o6]:{id:o6,name:"Claude Fable 5.1"},[k9]:{id:k9,name:"Claude Mythos 5.1",limited:!0}},dR={[o6]:MY[o6],[k9]:MY[k9]};function AU($){if(typeof $!=="string")return!1;let Z=P6($);return PU.some((J)=>Z===J||Z.startsWith(`${J}-`))}function RU($){if(typeof $!=="string")return!1;let Z=P6($);return YQ.some((J)=>Z===J||Z.startsWith(`${J}-`))}function GQ($){if(typeof $!=="string")return!1;let Z=P6($);return Z===o6||Z.startsWith(`${o6}-`)}function sR($){return RU($)?wU:_U}var PY="claude-sonnet-5",tR=r9;function aR($){if(typeof $!=="string")return!1;let Z=P6($);return!zQ(Z)&&(Z===PY||Z.startsWith(`${PY}-`))}var _Y="claude-sonnet-5-5",nR="2026-09-28",oR=1e6,rR=128000,eR={input:2,output:10,cacheRead:0.2,cacheWrite5m:2.5,cacheWrite1h:4},$T=r9;function zQ($){if(typeof $!=="string")return!1;let Z=P6($);return Z===_Y||Z.startsWith(`${_Y}-`)}var TU="claude-haiku-5-5",ZT="2026-10-07",JT=1e6,XT=128000,YT=1e5,GT={input:0.1,output:0.5,cacheRead:0.01,cacheWrite5m:0.125,cacheWrite1h:0.2},zT={input:0.5,output:2.5,cacheRead:0.05,cacheWrite5m:0.625,cacheWrite1h:1},QT=r9;function FU($){if(typeof $!=="string")return!1;let Z=P6($);return Z===TU||/^claude-haiku-5-5-\d{8}$/.test(Z)}var wY="claude-opus-5",KT=r9;function CU($){if(typeof $!=="string")return!1;let Z=P6($);return!d1(Z)&&(Z===wY||Z.startsWith(`${wY}-`))}var AY="claude-opus-5-5",WT="2026-09-18",VT=1e6,BT=128000,qT={input:4,output:20,cacheRead:0.2,cacheWrite5m:5,cacheWrite1h:8},jT=r9;function d1($){if(typeof $!=="string")return!1;let Z=P6($);return Z===AY||Z.startsWith(`${AY}-`)}function HT($){return CU($)||d1($)}function LT($){if(typeof $!=="string")return!1;if($.startsWith("gAAAA"))return!0;if(!$.startsWith("{"))return!1;try{let Z=JSON.parse($);return Z.type==="reasoning"&&typeof Z.id==="string"&&Z.id.startsWith("rs_")&&typeof Z.encrypted_content==="string"&&Z.encrypted_content.startsWith("gAAAA")}catch{return!1}}var UT="mid-conversation-output-config-2026-07-01";function NT($){if($==="minimal")return"low";if($==="low"||$==="medium"||$==="high"||$==="xhigh"||$==="max")return $;return}function xT($){return GQ($.model)}function RY($){return process.env[$]?.trim()||void 0}function SU($){if(/^claude-sonnet(?:-|$)/.test($))return"sonnet";if(/^claude-opus(?:-|$)/.test($))return"opus";if(/^claude-haiku(?:-|$)/.test($))return"haiku";if(/^claude-(?:fable|mythos)(?:-|$)/.test($))return"fable";return null}var kU={sonnet:"ANTHROPIC_DEFAULT_SONNET_MODEL",opus:"ANTHROPIC_DEFAULT_OPUS_MODEL",haiku:"ANTHROPIC_DEFAULT_HAIKU_MODEL",fable:"ANTHROPIC_DEFAULT_FABLE_MODEL"};function vU($){if(typeof $!=="string"||!$)return $;let Z=SU($);if(Z){let J=RY(kU[Z]);if(J)return J}if($.startsWith("claude-")){let J=RY("ANTHROPIC_MODEL");if(J)return J}return $}function DT($){if(typeof $.model!=="string")return!1;let Z=vU($.model);if(Z===$.model)return!1;return $.model=Z,!0}class uZ extends Error{constructor($){super("file or directory sync failed",{cause:$});this.name="AtomicSyncError"}}async function u8($,Z,J={}){await QQ($,Z,J)}async function QQ($,Z,J,X){await EU(B5($),{recursive:!0});let Y=`${$}.${(J.stageName??fU)()}.tmp`,G,z=!1;try{if(G=await yZ(Y,"wx",384),z=!0,await G.writeFile(J.serialize?J.serialize(Z):`${JSON.stringify(Z,null,2)}
+`,"utf8"),await G.chmod(384),J.durable)try{await G.sync()}catch(Q){throw new uZ(Q)}if(await G.close(),G=void 0,await J.beforeRename?.(),await bU(Y,$),z=!1,X?.(),J.durable){let Q=await yZ(B5($),"r");try{await Q.sync()}catch(K){throw new uZ(K)}finally{await Q.close()}}}finally{if(await G?.close().catch(()=>{}),z)await hU(Y,{force:!0}).catch(()=>{})}}async function TY($){let Z=await yZ($,"r");try{await Z.sync()}finally{await Z.close()}let J=await yZ(B5($),"r");try{await J.sync()}finally{await J.close()}}var _T=Object.freeze({sidebar:Object.freeze({name:"sidebar-write",ttlMs:1e4,timeoutMs:15000,renew:!0}),preferences:Object.freeze({name:"preferences",ttlMs:1e4,timeoutMs:2000,renew:!0})});function uU($,Z){return`${$}.${Z}.lock`}class E8 extends Error{details;constructor($){super(`Timed out acquiring ${$.name} lock for ${$.target}`);this.name="LockContentionError",this.details=$}}class s1 extends Error{details;constructor($){super(`Lost ${$.name} lock for ${$.target}`);this.name="LockOwnershipError",this.details=$}}async function d$($,Z,J){let X=performance.now();for(;;){let Y=await _6({path:$,name:Z.name,ttlMs:Z.ttlMs,renew:Z.renew??!1});if(Y)try{return await J(Y)}finally{await Y.release()}let G=Z.timeoutMs-(performance.now()-X);if(G<=0)throw new E8({target:$,name:Z.name,timeoutMs:Z.timeoutMs});await new Promise((z)=>setTimeout(z,Math.min(25,Math.ceil(G))))}}var mU=globalThis.setTimeout.bind(globalThis),pU=globalThis.clearTimeout.bind(globalThis);function cU($){let Z=$?.code;return Z==="ENOENT"||Z==="EINVAL"||Z==="ENOTDIR"}async function _6($){let Z=uU($.path,$.name),J=kY(Z,"owner.json"),X=h7(),Y=$.now??Date.now,G=null,z=!1,Q,K,W=new Promise((A)=>{K=A});function V(A){try{let R=$.onRenewalTimer?.(A);if(R&&(typeof R==="object"||typeof R==="function")&&"then"in R&&typeof R.then==="function")Promise.resolve(R).catch(()=>{})}catch{}}function B(){if(!G)return;pU(G),G=null,V("cancelled")}function j(A,R){if(Q||z)return;Q=Object.freeze({reason:A,expectedOwnerId:X,...typeof R?.ownerId==="string"?{observedOwnerId:R.ownerId}:{},...typeof R?.expiresAt==="number"?{observedExpiresAt:R.expiresAt}:{}}),B(),K(Q)}let H=null,q=`${Z}.evicting`,N=kY(q,"owner.json"),U=h7(),L=5000,D=8;async function w(){try{return JSON.parse(await H2(Z,"utf8"))}catch(A){if(A.code!=="EISDIR")throw A;return JSON.parse(await H2(J,"utf8"))}}async function O(){let A=`${Z}.${h7()}.tmp`,R,T=!1;try{R=await gU(A,"wx",384),T=!0,await R.writeFile(`${JSON.stringify({ownerId:X,expiresAt:Y()+$.ttlMs})}
+`,"utf8"),await R.chmod(384),await R.close(),R=void 0,await CY(A,Z),T=!1}finally{if(await R?.close().catch(()=>{}),T)await q8(A,{force:!0}).catch(()=>{})}}async function x(){try{return await L2(Z,`${JSON.stringify({ownerId:X,expiresAt:Y()+$.ttlMs})}
+`,{encoding:"utf8",mode:384,flag:"wx"}),!0}catch(A){let R=A.code;if(R==="EEXIST"||R==="EISDIR")return!1;if(R==="ENOENT"){await FY(yU(Z),{recursive:!0});try{return await L2(Z,`${JSON.stringify({ownerId:X,expiresAt:Y()+$.ttlMs})}
+`,{encoding:"utf8",mode:384,flag:"wx"}),!0}catch(T){let E=T.code;if(E==="EEXIST"||E==="EISDIR")return!1;throw T}}throw A}}async function C(){await new Promise((A)=>setTimeout(A,Math.floor(Math.random()*4)))}async function v(){try{let A=await w();return Number(A?.expiresAt)>Y()}catch{try{return(await SY(Z)).mtimeMs+$.ttlMs>Y()}catch{return!1}}}async function k(){try{return JSON.parse(await H2(N,"utf8"))?.ownerId===U}catch{return!1}}async function m(){if(await k())await q8(q,{recursive:!0,force:!0}).catch(()=>{})}async function l(){await FY(q);try{await L2(N,`${JSON.stringify({ownerId:U,createdAt:Y()})}
+`,{encoding:"utf8",mode:384,flag:"wx"})}catch(A){if(cU(A))return!1;throw await m(),A}if($.onStep)await $.onStep("eviction-marker-acquired");return!0}async function P(){let A;try{A=await SY(q)}catch(T){if(T.code==="ENOENT")return"missing";throw T}if(A.mtimeMs+L>Y())return"fresh";if($.onStep)await $.onStep("stale-marker-stat");let R=`${q}.${h7()}`;try{await CY(q,R)}catch(T){if(T.code==="ENOENT")return"missing";throw T}if($.onStep)await $.onStep("stale-marker-claimed");return await q8(R,{recursive:!0,force:!0}).catch(()=>{}),"recovered"}async function M(A){try{if(!await l())return!1}catch(R){if(R.code==="EEXIST")return!1;throw R}try{await A()}finally{await m()}return!0}async function _(){for(let A=0;A<D;A++){if($.onStep)await $.onStep("relinquish-read");let R;try{R=await w()}catch{return}if(R?.ownerId!==X)return;try{await q8(Z,{recursive:!0,force:!0});return}catch{await C()}}}function S(){if(!$.renew||z||Q)return;let A=$.renewIntervalMs??Math.max(1000,Math.floor($.ttlMs/3));if(G=mU(()=>{G=null;let R=(async()=>{let T=!z;try{if(!await M(async()=>{let f=await w(),h=Y();if(z||Q){T=!1;return}if(f?.ownerId!==X){j("taken-over",f),T=!1;return}if(!(Number(f?.expiresAt)>h)){j("expired",f),T=!1;return}if($.onStep)await $.onStep("renewal-owner-confirmed");if(z||Q){T=!1;return}if(!await k())return;if($.onStep)await $.onStep("renewal-write-fenced");if(z||Q){T=!1;return}if(!await k())return;if($.onStep)await $.onStep("renewal-write-ready");if(z||Q){T=!1;return}if(await O(),!await k()){j("marker-lost"),T=!1,await _();return}})&&$.onStep)await $.onStep("renewal-marker-unavailable")}catch{try{let E=await w();if(E?.ownerId!==X)j("taken-over",E);else if(!(Number(E?.expiresAt)>Y()))j("expired",E)}catch{j("renewal-failed")}}finally{if($.onStep)try{await $.onStep("renewal-finished")}catch{}if(T&&!z&&!Q)S()}})();H=R,R.finally(()=>{if(H===R)H=null})},A),"unref"in G)G.unref();V("scheduled")}function I(){try{let A=$.onContended?.();if(A&&(typeof A==="object"||typeof A==="function")&&"then"in A&&typeof A.then==="function")Promise.resolve(A).catch(()=>{})}catch{}return null}let F=await x();if(!F)for(let A=0;A<D;A++){if(F=await x(),F)break;if(await v())return I();if($.onStep)await $.onStep("stale-lock-observed");try{if(!await l()){await C();continue}}catch(R){if(R.code!=="EEXIST")throw R;if(await P()==="fresh")return null;await C();continue}try{if(await v())return I();if(!await k())return null;if($.onStep)await $.onStep("stale-lock-confirmed");if(!await k())return null;if(await q8(Z,{recursive:!0,force:!0}).catch(()=>{}),!await k())return null;if($.onStep)await $.onStep("stale-lock-removed");if(F=await x(),!F)return null;if($.onStep)await $.onStep("stale-lock-recreated");if(!await k())return await _(),F=!1,null;break}finally{await m()}}if(!F)return null;return S(),{ownerId:X,whenLost:()=>W,hasLost:()=>Q!==void 0,assertOwned:async()=>{let A;try{let R=await w();if(A=R,!z&&!Q&&R?.ownerId===X&&Number(R?.expiresAt)>Y())return;j(R?.ownerId!==X?"taken-over":"expired",R)}catch{j("unreadable")}throw new s1({target:$.path,name:$.name,expectedOwnerId:X,...typeof A?.ownerId==="string"?{observedOwnerId:A.ownerId}:{},...typeof A?.expiresAt==="number"?{observedExpiresAt:A.expiresAt}:{}})},release:async()=>{z=!0,B(),await H;for(let A=0;A<D;A++){try{if(await M(async()=>{if((await w())?.ownerId!==X)return;if($.onStep)await $.onStep("release-owner-confirmed");if(!await k())return;await q8(Z,{recursive:!0,force:!0}).catch(()=>{})}))return;await P()}catch{return}await C()}}}}class G$ extends Error{operation;rowId;phase;retryable;kind;committed;constructor($){super($.message??`${$.operation} failed (${$.kind}, ${$.phase})`,$.cause===void 0?void 0:{cause:$.cause});this.name="PoolOperationError",this.operation=$.operation,this.rowId=$.rowId,this.phase=$.phase,this.retryable=$.retryable,this.kind=$.kind,this.committed=$.committed}}class KQ extends Error{operation;constructor($){super(`${$} was called from inside a store hook; hand it to the caller's continuation instead`);this.name="PoolReentryError",this.operation=$}}var O0="identity-contradicted: ",WQ="duplicate-identity";function b8($,Z,J){let X=$.rosterRow(Z);if(!X)return;X.enabled=!1;let Y=$.entry(Z)??{credentialEpoch:1,needsFirstReading:!0},G=typeof Y.disabledReason==="string"&&Y.disabledReason.startsWith(O0);$.setEntry(Z,{...Y,disabledReason:G?Y.disabledReason:J})}function q5($,Z){let J=$.rosterRow(Z);if(!J)return;J.enabled=!0;let X=$.entry(Z);if(X&&"disabledReason"in X){let Y={...X};delete Y.disabledReason,$.setEntry(Z,Y)}}function I0($,Z){let J=$.rows().filter((Y)=>Y.invalid===void 0&&!Y.staged&&Y.type==="oauth"&&Y.enabled&&Y.identity===Z),X=[];for(let Y of J.slice(1))b8($,Y.id,WQ),X.push(Y.id);return X}function M0($,Z,J){let X=$.rosterRow(Z);if(!X)return[];return X.accountId=J,I0($,J)}var VQ=new dU;function I4($){if(VQ.getStore()!==void 0)throw new KQ($)}function m8($,Z){return VQ.run($,async()=>await Z())}async function sU($,Z,J,X,Y){if(!Z)return;try{await m8($,()=>Z(J,X))}catch(G){Y?.warn("store failure hook threw; the original failure stands",{operation:$,rowId:J,error:G instanceof Error?G.message:String(G)})}}var y$=Object.freeze({ttlMs:1e4,timeoutMs:15000,retryMs:50,renew:!0});async function tU($,Z,J){let X=(z)=>{try{let Q=J.onLockEvent?.({type:z,name:$.name,path:$.path});if(Q&&(typeof Q==="object"||typeof Q==="function")&&"then"in Q&&typeof Q.then==="function")Promise.resolve(Q).catch(()=>{})}catch{}},Y={...Z,...aU($)},G=performance.now();for(;;){let z=await _6({name:$.name,path:$.path,ttlMs:Y.ttlMs,now:J.now,renew:Y.renew,onContended:()=>X("contended"),...Y.renewIntervalMs!==void 0?{renewIntervalMs:Y.renewIntervalMs}:{},...J.onLockStep?{onStep:(W)=>J.onLockStep?.({name:$.name,path:$.path},W)}:{}});if(z){X("acquired");let W={name:$.name,path:$.path,assertOwned:()=>z.assertOwned(),release:async()=>{await z.release(),X("released")}};try{await W.assertOwned()}catch(V){throw await W.release(),V}return W}let Q=Y.timeoutMs-(performance.now()-G);if(Q<=0)throw new E8({target:$.path,name:$.name,timeoutMs:Y.timeoutMs});let K=Math.floor(Math.random()*(Y.retryMs+1));await new Promise((W)=>setTimeout(W,Math.min(Y.retryMs+K,Q)))}}function aU($){let Z={};if($.ttlMs!==void 0)Z.ttlMs=$.ttlMs;if($.timeoutMs!==void 0)Z.timeoutMs=$.timeoutMs;if($.retryMs!==void 0)Z.retryMs=$.retryMs;if($.renew!==void 0)Z.renew=$.renew;if($.renewIntervalMs!==void 0)Z.renewIntervalMs=$.renewIntervalMs;return Z}class e9{defaults;env;held=[];constructor($,Z){this.defaults=$,this.env=Z}async acquire($){let Z=await tU($,this.defaults,this.env);return this.held.push(Z),await this.assertAll(),Z}async assertAll(){for(let $ of this.held)await $.assertOwned()}async releaseTo($){while(this.held.length>$)await this.held.pop()?.release().catch(()=>{})}async releaseAll(){await this.releaseTo(0)}}function mZ($,Z,J){if(J!==void 0)throw new G$({operation:$,rowId:Z,kind:"row-staged",phase:$==="pull"?"pull":"before-first-write",retryable:!1,message:`row ${Z} is reserved for roster publication`})}var L$="commonAuthPool",v9=1,c4="rows",XZ="retiredEpochs",j5=1,BQ=300000,q$=L$;function nU($){let Z=JSON.parse(JSON.stringify($)),J=(X)=>{if(Array.isArray(X))return`[${X.map(J).join(",")}]`;if(y(X))return`{${Object.keys(X).sort().map((Y)=>`${JSON.stringify(Y)}:${J(X[Y])}`).join(",")}}`;return JSON.stringify(X)};return J(Z)}function f9($){return $7("sha256").update(nU($)).digest("hex")}function qQ($){if(!y($)||Object.keys($).length!==1||typeof $.reservation!=="string"||!$.reservation)return;return{reservation:$.reservation}}function oU($){if(!y($)||typeof $.reservation!=="string"||!$.reservation||typeof $.disabledReason!=="string")return;if(Object.keys($).some((Z)=>!["reservation","label","disabledReason","providerState"].includes(Z)))return;if("label"in $&&typeof $.label!=="string")return;if("providerState"in $&&(typeof $.providerState!=="string"||!/^[a-f0-9]{64}$/.test($.providerState)))return;return $}var D4="commonAuthProviderState";function y($){return $!=null&&typeof $==="object"&&!Array.isArray($)}var rU=new Set(["__proto__","constructor","prototype"]);function pZ($){if(typeof $!=="string"||$.length===0)return"id must be non-empty";if($.trim()!==$)return"id must not carry surrounding whitespace";if(rU.has($))return"id is a reserved object key";return}function t1($){let Z=typeof $==="string"?$.trim():"";if(!Z)return!1;try{let J=new URL(Z);return(J.protocol==="http:"||J.protocol==="https:")&&!J.username&&!J.password}catch{return!1}}function jQ($){return $.type==="oauth"?`oauth\x00${$.refresh}`:`api\x00${$.apiKey}`}function I$($){return $7("sha256").update(jQ($)).digest("hex")}function Z8($){return $7("sha256").update(`credential-stamp\x00${jQ($)}`).digest("hex")}function p6($){let Z=$.type==="oauth"?["oauth",typeof $.access==="string"?$.access:null,$.refresh,typeof $.expires==="number"&&Number.isFinite($.expires)?$.expires:null]:["api",$.apiKey,$.baseURL.trim(),$.authHeader??"authorization-bearer"];return $7("sha256").update(`credential-dispatch\x00${JSON.stringify(Z)}`).digest("hex")}function HQ($,Z,J,X={}){return{credentialEpoch:Z,digest:Z8($),dispatch:p6($),binding:{...J},...X.replace?{replace:!0}:{},...X.providerState!==void 0?{providerState:X.providerState}:{}}}function P0($,Z){let J=$?.credentialBound?$.credentialBound(Z):Z;return $7("sha256").update(`provider-state\x00${JSON.stringify(J??null)}`).digest("hex")}function a1($,Z,J,X){if(!Z||J===void 0)return;if(!y($)||!Object.hasOwn($,D4))return;let Y=v4($[q$]);if(!Y||Y.providerState===void 0||Y.digest!==Z8(Z)||Y.credentialEpoch!==J||Y.binding?.identity!==X)return;return Y.providerState}function J4($){return Number.isSafeInteger($)&&$>=1}function v4($){if(!y($))return;let Z=$.credentialEpoch;if(!J4(Z))return;if(typeof $.digest!=="string")return;if("dispatch"in $&&typeof $.dispatch!=="string")return;if("replace"in $&&$.replace!==!0)return;if("providerState"in $&&typeof $.providerState!=="string")return;let J="staged"in $?oU($.staged):void 0;if("staged"in $&&!J)return;let X={...J?{staged:J}:{},...typeof $.dispatch==="string"?{dispatch:$.dispatch}:{},...$.replace===!0?{replace:!0}:{},...typeof $.providerState==="string"?{providerState:$.providerState}:{}};if(!("binding"in $))return"dispatch"in $||"replace"in $||"providerState"in $||"staged"in $?void 0:{credentialEpoch:Z,digest:$.digest};let Y=$.binding;if(!y(Y))return;if("identity"in Y&&(typeof Y.identity!=="string"||!Y.identity))return;if("baseURL"in Y&&!t1(Y.baseURL))return;if("authHeader"in Y&&Y.authHeader!=="authorization-bearer"&&Y.authHeader!=="x-api-key")return;return{credentialEpoch:Z,digest:$.digest,...X,binding:{...typeof Y.identity==="string"?{identity:Y.identity}:{},...typeof Y.baseURL==="string"?{baseURL:Y.baseURL.trim()}:{},...Y.authHeader==="authorization-bearer"||Y.authHeader==="x-api-key"?{authHeader:Y.authHeader}:{}}}}function eU($,Z,J){if($.identity!==J)return!1;if($.baseURL!==void 0&&(Z.type!=="api"||Z.baseURL!==$.baseURL))return!1;if($.authHeader!==void 0&&(Z.type!=="api"||Z.authHeader!==$.authHeader))return!1;return!0}function $N($,Z,J,X){if(!$)return"none";if(!y(X)||!Object.hasOwn(X,q$))return"missing";let Y=v4(X[q$]);if(!Y)return"malformed";if(Y.digest!==Z8($))return"mismatched";if(Y.dispatch===void 0)return"legacy";if(Y.credentialEpoch!==Z)return"mismatched";if(!Y.binding||!eU(Y.binding,$,J))return"mismatched";if(Y.dispatch!==p6($))return"mismatched";return"bound"}function ZN($){if(!$.exists)return{status:"ready",exists:!1,config:{}};if("parseError"in $)return{status:"error",reason:"config file is not valid JSON"};let Z=$.value;if(!y(Z))return{status:"error",reason:"config root is not an object"};if("accounts"in Z&&!Array.isArray(Z.accounts))return{status:"error",reason:"config accounts is not an array"};if(!(L$ in Z))return Array.isArray(Z.accounts)?{status:"pending-migration",config:Z}:{status:"ready",exists:!0,config:Z};let J=Z[L$];if(!y(J))return{status:"error",reason:`${L$} is not an object`};let X=J.schemaVersion;if(typeof X!=="number"||!Number.isInteger(X)||X<1)return{status:"error",reason:`${L$}.schemaVersion is invalid`};if(X>v9)return{status:"error",reason:`${L$}.schemaVersion ${X} is newer than ${v9}`};if(c4 in J&&!y(J[c4]))return{status:"error",reason:`${L$}.${c4} is not an object`};return{status:"ready",exists:!0,config:Z}}function JN($){if(!$.exists)return{status:"ready",exists:!1,state:{}};if("parseError"in $)return{status:"error",reason:"state file is not valid JSON"};if(!y($.value))return{status:"error",reason:"state root is not an object"};if("accounts"in $.value&&!y($.value.accounts))return{status:"error",reason:"state accounts is not an object"};return{status:"ready",exists:!0,state:$.value}}function _0($){return Array.isArray($.accounts)?$.accounts:[]}function LQ($){let Z=$[L$];if(!y(Z))return{};let J=Z[c4];return y(J)?J:{}}function XN($){return y($.accounts)?$.accounts:{}}function YN($){if(!y($))return"not an object";let Z=pZ($.id);if(Z)return Z;if($.type==="api")return t1($.baseURL)?void 0:"invalid baseURL";if($.type==="oauth")return;return"unknown type"}function GN($,Z){if(!y($))return;let J=$.credentialEpoch;if(!J4(J))return;if("needsFirstReading"in $&&typeof $.needsFirstReading!=="boolean")return;if("disabledReason"in $&&typeof $.disabledReason!=="string")return;if("quota"in $&&!Z.validate($.quota))return;if("staged"in $&&!qQ($.staged))return;return{credentialEpoch:J,needsFirstReading:$.needsFirstReading===!0,...typeof $.disabledReason==="string"?{disabledReason:$.disabledReason}:{},..."quota"in $?{quota:$.quota}:{}}}function zN($,Z){if(!y(Z))return;if($.type==="api"){let X=typeof Z.apiKey==="string"?Z.apiKey.trim():"";if(!X)return;return{type:"api",apiKey:X,baseURL:String($.baseURL).trim(),authHeader:$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer"}}if($.corrupt===!0)return;let J=Z.refresh;if(typeof J!=="string"||!J.trim())return;return{type:"oauth",refresh:J,...typeof Z.access==="string"?{access:Z.access}:{},...typeof Z.expires==="number"?{expires:Z.expires}:{},...typeof Z.lastRefreshedAt==="number"?{lastRefreshedAt:Z.lastRefreshedAt}:{}}}function UQ($,Z){return _0($).find((J)=>y(J)&&J.id===Z)}function NQ($){if(!y($[L$]))$[L$]={};return $[L$]}function xQ($){let Z=NQ($);if(!y(Z[c4]))Z[c4]={};return Z[c4]}function Z7($,Z){let J=LQ($),X=Object.hasOwn(J,Z)?J[Z]:void 0;return y(X)?X:void 0}function DQ($,Z,J){Object.defineProperty(xQ($),Z,{value:J,enumerable:!0,writable:!0,configurable:!0})}function OQ($,Z){let J=$[L$];if(!y(J))return;let X=J[XZ];if(!y(X)||!Object.hasOwn(X,Z))return;let Y=X[Z];return J4(Y)?Y:void 0}function IQ($,Z){let J=Z7($,Z)?.credentialEpoch;return J4(J)?J:void 0}function n1($,Z){return Math.max(OQ($,Z)??0,IQ($,Z)??0)+1}function QN($,Z){let J=[...Z];if(J.length===0)return;let X=NQ($),Y=y(X[XZ])?X[XZ]:{},G={},z=(Q,K)=>Object.defineProperty(G,Q,{value:K,enumerable:!0,writable:!0,configurable:!0});for(let[Q,K]of Object.entries(Y))if(J4(K))z(Q,K);for(let Q of J)z(Q,Math.max(OQ($,Q)??0,IQ($,Q)??1));X[XZ]=G}function p8($,Z,J,X){let Y=LQ($),G=XN(Z),z=new Set,Q=[];for(let K of _0($)){let W=YN(K),V=y(K)&&typeof K.id==="string"?K.id:void 0,B=V===void 0?void 0:Y[V],j=y(B)&&Object.hasOwn(B,"staged"),H=j?qQ(B.staged):void 0;if(W||!y(K)||V===void 0||z.has(V)){if(V!==void 0&&!z.has(V))z.add(V);if(V!==void 0)Q.push({id:V,type:y(K)&&K.type==="api"?"api":"oauth",enabled:!1,needsFirstReading:!0,hasEntry:Object.hasOwn(Y,V),candidate:!1,invalid:"roster",stamp:"none",...H?{staged:H}:{}});continue}z.add(V);let q=K.type==="api"?"api":"oauth",N=Object.hasOwn(Y,V),U=N?GN(Y[V],J):void 0,L=zN(K,G[V]),D=K.enabled!==!1,w=U?U.credentialEpoch:N?void 0:1,O=typeof K.accountId==="string"&&K.accountId?K.accountId:void 0,x={id:V,type:q,enabled:D,needsFirstReading:U?U.needsFirstReading:q==="oauth",hasEntry:N,candidate:!1,...typeof K.label==="string"?{label:K.label}:{},...typeof K.addedAt==="number"?{addedAt:K.addedAt}:{},...O!==void 0?{identity:O}:{},...L?{credential:L,fingerprint:I$(L)}:{},...U?{credentialEpoch:U.credentialEpoch}:{},...H?{staged:H}:{},...U?.disabledReason!==void 0?{disabledReason:U.disabledReason}:{},...U&&"quota"in U?{quota:U.quota}:{},...KN(G[V],L,w,O,X),stamp:$N(L,w,O,G[V])};if(N&&!U)x.invalid="entry";else x.candidate=D&&L!==void 0&&!j;Q.push(x)}return Q}function KN($,Z,J,X,Y){if(!y($)||!Object.hasOwn($,D4))return{};let G=a1($,Z,J,X);if(G===void 0)return{providerStateDropped:"uncovered"};let z=$[D4];if(!Y?.validate(z))return{providerStateDropped:"invalid"};if(P0(Y,z)!==G)return{providerStateDropped:"uncovered"};return{providerState:z}}function F$($){return $.identity??$.id}function o1($,Z){if($===void 0||$>Z+BQ)return Z;return Math.max(Z,$+1)}function vY($,Z){return o1($,Z)>Z+BQ}function E9($){let{id:Z,credential:J,identity:X,label:Y,addedAt:G}=$;return{id:Z,...Y!==void 0?{label:Y}:{},type:J.type,addedAt:G,...X!==void 0?{accountId:X}:{},...J.type==="api"?{baseURL:J.baseURL.trim(),authHeader:J.authHeader??"authorization-bearer"}:{}}}function WN($,Z){if($.type==="api")return{apiKey:$.apiKey};return{...$.access!==void 0?{access:$.access}:{},refresh:$.refresh,...$.expires!==void 0?{expires:$.expires}:{},...Z!==void 0?{lastRefreshedAt:Z}:{}}}function VN($,Z){if($.type==="api")return{...$,baseURL:$.baseURL.trim(),authHeader:$.authHeader??"authorization-bearer"};return{...$,...Z!==void 0?{lastRefreshedAt:Z}:{}}}function BN($,Z={}){if(!y($))return"credential must be an object";if($.type==="oauth"){if(typeof $.refresh!=="string"||!$.refresh.trim())return"oauth credential needs a refresh token";return}if($.type==="api"){if(typeof $.apiKey!=="string"||!$.apiKey.trim())return"api credential needs an api key";if($.apiKey.trim()!==$.apiKey)return"api key must not carry surrounding whitespace";if(!(Z.baseURLOptional&&$.baseURL===void 0)&&!t1($.baseURL))return"api credential needs a valid baseURL";return}return"credential type must be oauth or api"}var r1="transition",MQ="transitionMark";function qN($){if(!y($))return;let Z=$[r1];if(!y(Z))return;if(typeof Z.mark!=="string"||Z.mark.length===0)return;if(Z.enabled===!0)return{mark:Z.mark,enabled:!0};if(Z.enabled===!1&&typeof Z.reason==="string")return{mark:Z.mark,enabled:!1,reason:Z.reason};return}function e1($,Z,J){if(J.enabled)q5($,Z);else b8($,Z,J.reason??"");if(!$.rosterRow(Z))return;let X=$.entry(Z)??{credentialEpoch:1,needsFirstReading:!0};if($.setEntry(Z,{...X,[MQ]:J.mark}),!J.enabled)return;let Y=$.rows().find((G)=>G.id===Z);if(Y?.type==="oauth"&&Y.identity!==void 0)I0($,Y.identity)}function jN($,Z){if($.type!=="api")return $;return{...$,...Z.baseURL!==void 0?{baseURL:Z.baseURL}:{},...Z.authHeader!==void 0?{authHeader:Z.authHeader}:{}}}function HN($){if(!$.binding)return!1;return $.replace===!0||$.dispatch===void 0}function LN($,Z,J,X={}){let Y=y(Z.accounts)?Z.accounts:{},G=new Map;for(let z of p8($,Z,J)){if(z.invalid||z.staged||!z.credential)continue;let Q=Object.hasOwn(Y,z.id)?Y[z.id]:void 0;if(!y(Q))continue;let K=v4(Q[q$]);if(!K?.binding)continue;if(K.digest!==Z8(z.credential))continue;let W=z.credentialEpoch??1;if(K.credentialEpoch>W){if(!HN(K))continue;if(X.requireCredentialStamps){if(K.dispatch===void 0)continue;if(K.dispatch!==p6(jN(z.credential,K.binding)))continue}G.set(z.id,{kind:"replace",stamp:{...K,binding:K.binding}})}else if(K.credentialEpoch===W&&K.dispatch!==void 0&&K.dispatch===p6(z.credential)&&K.binding.identity!==void 0&&z.identity===void 0)G.set(z.id,{kind:"identity",identity:K.binding.identity});else if(K.credentialEpoch===W&&K.binding.identity===z.identity){if(X.requireCredentialStamps&&K.dispatch!==p6(z.credential))continue;let V=qN(Q[q$]);if(V&&Z7($,z.id)?.[MQ]!==V.mark)G.set(z.id,{kind:"transition",transition:V})}}return G}function PQ($,Z,J,X){let G={...$.entry(Z)??{},credentialEpoch:J,needsFirstReading:!0};if(delete G.quota,X.identity!==void 0&&typeof G.disabledReason==="string"&&G.disabledReason.startsWith(O0))delete G.disabledReason;$.setEntry(Z,G);let z=$.rosterRow(Z);if(!z)return;if(X.identity!==void 0)z.accountId=X.identity;else delete z.accountId;if(X.baseURL!==void 0)z.baseURL=X.baseURL;if(X.authHeader!==void 0)z.authHeader=X.authHeader}function _Q($,Z,J,X={}){let Y=LN($,Z,J,X);if(Y.size===0)return{config:$,torn:[]};let G=structuredClone($),z={rows:()=>p8(G,Z,J),rosterRow:(Q)=>UQ(G,Q),entry:(Q)=>Z7(G,Q),setEntry:(Q,K)=>DQ(G,Q,K)};for(let[Q,K]of Y)if(K.kind==="replace")PQ(z,Q,K.stamp.credentialEpoch,K.stamp.binding);for(let[Q,K]of Y)if(K.kind==="identity")M0(z,Q,K.identity);else if(K.kind==="transition")e1(z,Q,K.transition);else if(K.stamp.binding.identity!==void 0)I0(z,K.stamp.binding.identity);return{config:G,torn:[...Y.keys()]}}function wQ($,Z,J,X={}){let{config:Y,torn:G}=_Q($,Z,J,X),z=p8(Y,Z,J,X.providerState);for(let Q of z){if(G.includes(Q.id))Q.torn=!0,Q.candidate=!1;if(X.requireCredentialStamps&&Q.stamp!=="bound")Q.unbound=!0,Q.candidate=!1}return z}async function U2($){try{return await lU($,"utf8")}catch(Z){if(Z.code==="ENOENT")return;throw Z}}function fY($){if($===void 0)return{exists:!1};try{return{exists:!0,value:JSON.parse($)}}catch(Z){return{exists:!0,parseError:Z}}}async function f4($){for(let Z=0;Z<3;Z++){let J=await U2($.configPath),X=await U2($.statePath),Y=await U2($.configPath);if(J!==Y){if(Z<2)await iU(2+Math.floor(Math.random()*4));continue}let G=ZN(fY(J));if(G.status==="error")return{status:"error",file:"config",reason:G.reason};let z=JN(fY(X));if(z.status==="error")return{status:"error",file:"state",reason:z.reason};if(G.status==="pending-migration")return{status:"pending-migration",config:G.config};return{status:"ready",configExists:G.exists,stateExists:z.exists,config:G.config,state:z.state,rows:wQ(G.config,z.state,$.codec,{requireCredentialStamps:$.requireCredentialStamps===!0,...$.providerState?{providerState:$.providerState}:{}})}}return{status:"error",file:"config",kind:"snapshot-contended",retryable:!0,reason:"The store was changing; retry the operation once writes settle."}}function J8($,Z,J,X="before-first-write"){if($.status==="error"&&$.kind==="snapshot-contended")return new G$({operation:Z,...J!==void 0?{rowId:J}:{},phase:X,kind:"snapshot-contended",retryable:!0,message:$.reason});return new G$({operation:Z,...J!==void 0?{rowId:J}:{},phase:X,retryable:!1,kind:$.status==="pending-migration"?"pending-migration":"load-error",message:$.status==="pending-migration"?"the config holds a legacy roster that has not been migrated into the pool":`${$.file} file cannot be loaded: ${$.reason}`})}class AQ{ctx;snapshot;locks;progress;info;config;state;constructor($,Z,J,X,Y){this.ctx=$,this.snapshot=Z,this.locks=J,this.progress=X,this.info=Y,this.config=structuredClone(Z.config),this.state=structuredClone(Z.state)}rows(){return wQ(this.config,this.state,this.ctx.codec,{requireCredentialStamps:this.ctx.requireCredentialStamps===!0,...this.ctx.providerState?{providerState:this.ctx.providerState}:{}})}row($){return this.rows().find((Z)=>Z.id===$)}reservation($){if(this.rosterRow($)){let J=this.entry($);return J&&Object.hasOwn(J,"staged")?J.staged:void 0}let Z=this.stateAccount($)?.[q$];return y(Z)&&Object.hasOwn(Z,"staged")?Z.staged:void 0}assertNotStaged($){mZ(this.info.operation,$,this.reservation($))}roster(){if(!Array.isArray(this.config.accounts))this.config.accounts=[];return this.config.accounts}rosterRow($){return this.roster(),UQ(this.config,$)}dropRosterRows($){let Z=this.roster(),J=Z.filter((X)=>!(y(X)&&X.id===$));return this.config.accounts=J,Z.length-J.length}entries(){return xQ(this.config)}entry($){return this.entries(),Z7(this.config,$)}setEntry($,Z){DQ(this.config,$,Z)}async completeTorn(){let{config:$,torn:Z}=_Q(this.config,this.state,this.ctx.codec,{requireCredentialStamps:this.ctx.requireCredentialStamps===!0});if(Z.length===0)return;this.config=$,await this.commitConfig({counted:!1})}stateAccount($){let Z=y(this.state.accounts)?this.state.accounts:{},J=Object.hasOwn(Z,$)?Z[$]:void 0;return y(J)?J:void 0}dropStateAccount($){if(y(this.state.accounts)&&Object.hasOwn(this.state.accounts,$))delete this.state.accounts[$]}setStateAccount($,Z){if(!y(this.state.accounts))this.state.accounts={};Object.defineProperty(this.state.accounts,$,{value:Z,enumerable:!0,writable:!0,configurable:!0})}async commitConfig($={}){let Z=this.roster(),J=new Set;for(let K of Z)if(y(K)&&typeof K.id==="string")J.add(K.id);let X=new Set;for(let K of _0(this.snapshot.config))if(y(K)&&typeof K.id==="string"&&!J.has(K.id))X.add(K.id);for(let K of Object.keys(this.entries()))if(!J.has(K))X.add(K);QN(this.config,X);let Y=this.entries(),G={};for(let[K,W]of Object.entries(Y))if(J.has(K))Object.defineProperty(G,K,{value:W,enumerable:!0,writable:!0,configurable:!0});let z=this.config[L$],Q={...this.config,version:j5,accounts:Z,[L$]:{...z,schemaVersion:v9,[c4]:G}};await this.write(this.ctx.configPath,Q,"config",$.counted??!0,$.durable??!1,()=>{if($.publicationDecision)this.markPublicationDecision();for(let K of X)this.ctx.removedIds.add(K);this.config=Q}),this.config=Q}async commitState($,Z={}){let J={...this.state,version:j5,accounts:y(this.state.accounts)?this.state.accounts:{}};if(await this.write(this.ctx.statePath,J,"state",!0,Z.durable??!1),this.state=J,$)this.progress.committed=$}async assertAll(){await this.locks.assertAll()}async syncState(){await this.assertAll();try{if(this.snapshot.stateExists)await TY(this.ctx.statePath)}catch($){throw new G$({operation:this.info.operation,rowId:this.info.rowId,phase:"before-first-write",kind:"publication-sync",retryable:!0,message:"Publication sync failed before the decision; nothing was written. Retry the same plan.",cause:$})}}markPublicationDecision(){this.progress.publicationDecided=!0}async syncConfig(){await this.assertAll(),await TY(this.ctx.configPath)}async write($,Z,J,X=!0,Y=!1,G){await QQ($,Z,{durable:Y,beforeRename:async()=>{await this.ctx.onStep?.(`before-${J}-write`,this.info),await this.locks.assertAll()}},()=>{if(X)this.progress.writes++;G?.()}),await this.ctx.onStep?.(`after-${J}-write`,this.info)}}async function UN($,Z){let J=new e9($.lockDefaults,$.lockEnv),X={writes:0};try{for(let Q of $.storeLocks)await J.acquire(Q);let Y=await f4($);if(Y.status==="error")throw J8(Y,"initialize",void 0);if(Y.status==="ready")return"already-ready";let G={};for(let[Q,K]of Object.entries(Y.config))if(!Z.includes(Q))G[Q]=K;G.version=j5,G[L$]={schemaVersion:v9,[c4]:{}};let z={operation:"initialize",rowId:void 0};return await u8($.configPath,G,{beforeRename:async()=>{await $.onStep?.("before-config-write",z),await J.assertAll()}}),X.writes++,await $.onStep?.("after-config-write",z),"initialized"}catch(Y){throw w0(Y,"initialize",void 0,X)}finally{await J.releaseAll()}}async function X4($,Z,J,X,Y,G={}){let z=Z.held.length;try{for(let W of $.storeLocks)await Z.acquire(W);let Q=await f4($);if(Q.status!=="ready")throw J8(Q,X.operation,X.rowId,J.writes>0?"after-first-write":"before-first-write");let K=new AQ($,Q,Z,J,X);if(X.rowId!==void 0&&!["add","remove","pull","publishRoster","enable","disable"].includes(X.operation))K.assertNotStaged(X.rowId);if(G.completeTorn??!0)await K.completeTorn();return await Y(K)}finally{await Z.releaseTo(z)}}function w0($,Z,J,X){let Y=Z==="pull"?"pull":X.writes>0?"after-first-write":"before-first-write",G=Y==="after-first-write"?X.committed:void 0;if(Z==="publishRoster"&&X.publicationDecided)return new G$({operation:Z,...J!==void 0?{rowId:J}:{},phase:Y,kind:"publication-incomplete",retryable:!0,message:"The publication may already be decided. Replay the same plan or check publication(operationId).",cause:$});if(Z==="publishRoster"&&$ instanceof uZ)return new G$({operation:Z,...J!==void 0?{rowId:J}:{},phase:Y,kind:"publication-sync",retryable:!0,message:"Publication sync failed before the decision; nothing was written. Retry the same plan.",cause:$});if($ instanceof G$){if($.phase===Y&&$.rowId===J&&$.operation===Z&&$.committed===G)return $;return new G$({operation:Z,...J!==void 0?{rowId:J}:{},phase:$.kind==="after-persist-hook"?$.phase:Y,retryable:$.retryable,kind:$.kind,...$.committed??G?{committed:$.committed??G}:{},message:$.message,...$.cause!==void 0?{cause:$.cause}:{}})}let z={operation:Z,...J!==void 0?{rowId:J}:{},phase:Y,...G?{committed:G}:{},cause:$};if($ instanceof s1)return new G$({...z,retryable:!0,kind:"lock-ownership",message:Y==="after-first-write"?`${Z} lost a lease after its first write; the intermediate stays on disk`:`${Z} lost a lease before writing; nothing was written`});if($ instanceof E8)return new G$({...z,retryable:!0,kind:"lock-contention",message:$.message});return new G$({...z,retryable:!1,kind:"unexpected",message:$ instanceof Error?$.message:String($)})}async function M4($,Z,J,X,Y){let G=new e9($.lockDefaults,$.lockEnv),z={writes:0};try{return await Y(G,z)}catch(Q){let K=w0(Q,Z,J,z);if(K.kind!=="after-persist-hook")await sU(Z,X,J,K,$.logger);throw K}finally{await G.releaseAll()}}function o4($,Z){return{...$.rowLockOptions,name:`row-${encodeURIComponent(F$(Z))}`,path:$.ctx.statePath}}async function c8($,Z,J){let X=await f4($.ctx);if(X.status!=="ready")throw J8(X,Z,J);let Y=X.rows.find((W)=>W.id===J),G=Z7(X.config,J),z=X.state.accounts,Q=y(z)&&Object.hasOwn(z,J)?z[J]:void 0,K=y(Q)?Q[q$]:void 0;if(Y&&!["enable","disable"].includes(Z)&&G&&Object.hasOwn(G,"staged"))mZ(Z,J,G.staged);if(!Y&&y(K)&&Object.hasOwn(K,"staged"))mZ(Z,J,K.staged);if(!Y)throw O6(Z,J);return{result:X,row:Y}}function O6($,Z){return new G$({operation:$,rowId:Z,phase:$==="pull"?"pull":"before-first-write",retryable:!1,kind:"unknown-row",message:`no row ${Z} in the pool`})}function E4($,Z){if(Z.unbound)throw g($,Z.id,"unbound-credential",`row ${Z.id}'s credential is not the one this store stamped for it (stamp ${Z.stamp}); replace it with fresh material`)}function g($,Z,J,X,Y=!1){return new G$({operation:$,rowId:Z,phase:$==="pull"?"pull":"before-first-write",retryable:Y,kind:J,message:X})}async function RQ($,Z,J,X){let{ctx:Y}=$,G=new e9(Y.lockDefaults,Y.lockEnv),z={writes:0};try{if(!J4(J?.credentialEpoch))throw g("pull",Z,"invalid-input","the credential epoch the reading was issued for must be a positive safe integer");await X4(Y,G,z,{operation:"pull",rowId:Z},async(Q)=>{Q.assertNotStaged(Z);let K=Q.row(Z);if(!K)throw O6("pull",Z);if(K.invalid)throw g("pull",Z,"invalid-row",`row ${Z} is invalid`);if(!K.credential)throw g("pull",Z,"no-credential",`row ${Z} holds no credential`);E4("pull",K);let W=Q.entry(Z);if(K.torn||!W||W.credentialEpoch!==J.credentialEpoch||K.identity!==J.identity)throw new G$({operation:"pull",rowId:Z,phase:"pull",retryable:!0,kind:"attribution",message:`quota for ${Z} was issued for a credential the row no longer holds`});let V=Y.codec.merge(W.quota,X);if(!Y.codec.validate(V))throw g("pull",Z,"invalid-quota","the quota codec rejected the merged map");Q.setEntry(Z,{...W,quota:V,needsFirstReading:!1}),await Q.commitConfig()},{completeTorn:!1})}catch(Q){throw w0(Q,"pull",Z,z)}finally{await G.releaseAll()}}function X8($,Z,J,X,Y="the provider state"){if(!$)throw g(Z,J,"invalid-input","the store was opened without a provider-state codec");let G;try{let z=JSON.stringify(X);G=z===void 0?void 0:JSON.parse(z)}catch{G=void 0}if(G===void 0)throw g(Z,J,"invalid-provider-state",`${Y} cannot be stored as JSON`);if(!$.validate(G))throw g(Z,J,"invalid-provider-state",`the provider-state codec rejected ${Y}`);return G}function $J($,Z,J,X,Y){if(X===void 0||!$?.merge)return{kind:"set",value:Y};return{kind:"set",value:X8($,Z,J,$.merge(structuredClone(X),structuredClone(Y)),"the merged provider state")}}function NN($,Z,J,X,Y){let G=$?.onReplace,z=G?G(Z.providerState===void 0?void 0:structuredClone(Z.providerState),{id:Z.id,credentialEpoch:J,...Z.identity!==void 0?{previousIdentity:Z.identity}:{},...X!==void 0?{identity:X}:{},...Y!==void 0?{incoming:structuredClone(Y)}:{}}):Y;if(z===void 0)return{kind:"clear"};if(!G)return{kind:"set",value:z};return{kind:"set",value:X8($,"replace",Z.id,z,"the provider state onReplace returned")}}function xN($,Z,J,X,Y){if(Z.kind==="set")return P0($,Z.value);if(Z.kind==="clear")return;return a1(J,X?.credential,Y,X?.identity)}async function DN($,Z,J,X,Y={}){I4("updateProviderState");let{ctx:G}=$,z="updateProviderState";return M4(G,z,Z,Y.onFailure,async(Q,K)=>{let W=G.providerState;if(!W)throw g(z,Z,"invalid-input","the store was opened without a provider-state codec");if(typeof X!=="function")throw g(z,Z,"invalid-input","a mutator is required");let V=y(J)?J.credentialEpoch:void 0;if(!J4(V))throw g(z,Z,"invalid-input","the credential epoch the provider state was read at is required");let{row:B}=await c8($,z,Z);await Q.acquire(o4($,B));for(let j of Y.extraLocks??[])await Q.acquire(j);return X4(G,Q,K,{operation:z,rowId:Z},async(j)=>{let H=j.row(Z);if(!H)throw O6(z,Z);if(F$(H)!==F$(B))throw g(z,Z,"row-key-changed",`row ${Z}'s wire identity changed while its lock was being taken`,!0);if(H.invalid)throw g(z,Z,"invalid-row",`row ${Z} failed validation`);if(!H.credential)throw g(z,Z,"no-credential",`row ${Z} holds no credential`);if(E4(z,H),(H.credentialEpoch??1)!==V||H.identity!==J.identity)throw g(z,Z,"attribution",`the provider state for ${Z} was read for a credential or account the row no longer holds`,!0);let N=await TQ(j,W,z,H,X);if(N.kind!=="changed")return{id:Z,outcome:"unchanged",...N.kind==="unchanged"&&N.value!==void 0?{providerState:N.value}:{}};return j.setStateAccount(Z,N.account),await j.commitState(),N.value===void 0?{id:Z,outcome:"cleared"}:{id:Z,outcome:"updated",providerState:N.value}})})}var ON=Symbol.for("@cortexkit/common-auth/store/decline-transition");async function TQ($,Z,J,X,Y,G=!1){let{id:z,credential:Q}=X;if(!Q)throw g(J,z,"no-credential",`row ${z} holds no credential`);let K=X.credentialEpoch??1,W=$.stateAccount(z),V=W?.[q$],B=v4(V);if(!y(V)||!B?.binding||B.digest!==Z8(Q)||B.credentialEpoch!==K||B.binding.identity!==X.identity)throw g(J,z,"unbound-credential",`row ${z}'s credential carries no stamp of this store to bind a provider state to (stamp ${X.stamp}); rotate or replace it first`);let j=X.providerState===void 0?void 0:structuredClone(X.providerState),H=await m8(J,()=>Y(j,X));if(G&&H===ON)return{kind:"declined"};let q=H===void 0?void 0:X8(Z,J,z,H,"the provider state the mutator returned"),N=W!==void 0&&Object.hasOwn(W,D4);if(q===void 0?!N:X.providerState!==void 0&&JSON.stringify(X.providerState)===JSON.stringify(q))return{kind:"unchanged",...q!==void 0?{value:q}:{}};let U={...W};if(q===void 0){delete U[D4];let L={...V};delete L.providerState,U[q$]=L}else{U[D4]=q;let L=P0(Z,q);if(B.providerState!==L)U[q$]={...V,providerState:L}}return{kind:"changed",...q!==void 0?{value:q}:{},account:U}}async function ZJ($,Z,J){if(!J)return;let X=$.rows().map((G)=>{let{id:z,type:Q,label:K,enabled:W,disabledReason:V,identity:B,credentialEpoch:j,stamp:H,staged:q,torn:N,invalid:U}=G;return{id:z,type:Q,label:K,enabled:W,disabledReason:V,identity:B,credentialEpoch:j,stamp:H,staged:q,torn:N,invalid:U}}),Y=await m8($.info.operation,()=>J({id:Z,row:X.find((G)=>G.id===Z),rows:X,config:structuredClone($.snapshot.config)}));if(Y!==void 0)throw g($.info.operation,Z,"row-protected",Y)}var IN=["access","refresh","expires","lastRefreshedAt","apiKey"];function MN($){return{baseURL:String($.baseURL).trim(),authHeader:$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer"}}function PN($,Z,J){if(J.type!=="api")return J;let X=$.rosterRow(Z);if(!y(X)){if(J.baseURL===void 0)throw g($.info.operation,Z,"invalid-input","api credential needs a valid baseURL");return{...J,baseURL:J.baseURL}}let Y=$.row(Z)?.credential,G=Y?.type==="api"?{baseURL:Y.baseURL.trim(),authHeader:Y.authHeader??"authorization-bearer"}:MN(X),z=J.baseURL?.trim()??G.baseURL,Q=J.authHeader??G.authHeader;if(z!==G.baseURL||Q!==G.authHeader)throw g($.info.operation,Z,"endpoint-mismatch",`row ${Z} sends its key to another endpoint or header; a key for another endpoint is a replacement`);return{...J,baseURL:z,authHeader:Q}}function FQ($,Z,J,X){let Y=$.rosterRow(Z),G=$.row(Z),z=X??(G?G.identity:y(Y)&&typeof Y.accountId==="string"&&Y.accountId?Y.accountId:void 0);return{...z!==void 0?{identity:z}:{},...J.type==="api"?{baseURL:J.baseURL,authHeader:J.authHeader??"authorization-bearer"}:{}}}function YZ($,Z,J,X,Y={}){let G=PN(Z,J,X),z=Z.stateAccount(J),Q=Y.providerState??{kind:"keep"},K=Z.row(J)?.credentialEpoch??Z.entry(J)?.credentialEpoch,W=typeof K==="number"?K:1,V=xN($.ctx.providerState,Q,z,z&&Object.hasOwn(z,D4)?Z.row(J):void 0,W),B=typeof z?.lastRefreshedAt==="number"?z.lastRefreshedAt:void 0,j=G.type==="oauth"?Y.stamp??o1(B,$.ctx.now()):void 0,H={...z??{}};for(let U of IN)delete H[U];if(Y.clearErrors)delete H.lastRefreshError,delete H.lastQuotaRefreshError,delete H.quota;if(Q.kind==="clear")delete H[D4];else if(Q.kind==="set")H[D4]=Q.value;let q=VN(G,j),N={...H,...WN(G,j),[q$]:{...Y.staged?{staged:Y.staged}:{},...Y.transition!==void 0?{[r1]:Y.transition}:{},...HQ(q,W,Y.binding??FQ(Z,J,q,Y.identity),{replace:Y.binding!==void 0,...V!==void 0?{providerState:V}:{}})}};return{stored:q,account:N}}async function GZ($,Z,J){return $.setStateAccount(Z,J.account),await $.commitState(J.stored),J.stored}async function JJ($,Z,J,X,Y={}){return GZ(Z,J,YZ($,Z,J,X,Y))}async function _N($,Z,J){if(!Z.credential||Z.stamp!=="bound")return;let X=$.stateAccount(Z.id),Y=a1(X,Z.credential,Z.credentialEpoch??1,Z.identity);$.setStateAccount(Z.id,{...X??{},[q$]:HQ(Z.credential,Z.credentialEpoch??1,FQ($,Z.id,Z.credential,J),Y!==void 0?{providerState:Y}:{})}),await $.commitState()}function XJ($,Z,J){let X=$==="add"?pZ(Z):void 0;if(X)throw g($,Z,"invalid-input",X);let Y=BN(J,{baseURLOptional:$==="rotate"});if(Y)throw g($,Z,"invalid-input",Y)}function A0($,Z,J,X){if(!J)throw O6($,Z);if(J.invalid)throw g($,Z,"invalid-row",`row ${Z} failed validation`);if(X&&X.type!==J.type)throw g($,Z,"type-mismatch",`row ${Z} holds a ${J.type} credential`);return J}function J7($,Z,J){if(J!==void 0&&!J4(y(J)?J.credentialEpoch:void 0))throw g($,Z,"invalid-input","the attribution must name a credential epoch that is a positive safe integer")}function R0($,Z,J,X){if(!J)throw O6($,Z);if(J.invalid)throw g($,Z,"invalid-row",`row ${Z} failed validation`);if((J.credentialEpoch??1)!==X.credentialEpoch||J.identity!==X.identity)throw g($,Z,"attribution",`the ${$} of ${Z} was issued for a credential or account the row no longer holds`,!0)}function cZ($,Z){return g($,Z,"identity-mismatch",`row ${Z} is recorded for another account; a credential of a different account is a replacement`)}function X7($,Z){return g($,Z,"row-key-changed",`row ${Z}'s wire identity changed while its lock was being taken`,!0)}function wN($,Z,J,X){let{id:Y,credential:G,identity:z}=J;if(!$.ctx.requireCredentialStamps||Z.rosterRow(Y)||!R8(Z.state,Y))return;let Q=()=>{throw g("add",Y,"unbound-credential",`orphan ${Y} cannot be bound to this add's material; remove it explicitly before adding different material`)},K=Z.stateAccount(Y),W=v4(K?.[q$]);if(!W?.binding||W.dispatch===void 0||W.replace)return Q();if(G.type==="api"&&(W.binding.baseURL===void 0||W.binding.authHeader===void 0))return Q();let V=G.type==="api"?{...G,baseURL:W.binding.baseURL,authHeader:W.binding.authHeader}:G,[B]=p8({accounts:[E9({id:Y,credential:V,identity:W.binding.identity,addedAt:0})],[L$]:{rows:{[Y]:{credentialEpoch:n1(Z.config,Y)}}}},Z.state,$.ctx.codec,$.ctx.providerState);if(!B?.credential||B.invalid||B.stamp!=="bound")return Q();if(z!==void 0&&z!==B.identity)return Q();if(Z8(G)!==W.digest)return Q();if(G.type==="api"){if(G.baseURL.trim()!==W.binding.baseURL)return Q();if((G.authHeader??"authorization-bearer")!==W.binding.authHeader)return Q()}else if(p6(G)!==W.dispatch)return Q();if(W.providerState!==void 0&&B.providerState===void 0)return Q();if(X!==void 0&&P0($.ctx.providerState,X)!==W.providerState)return Q();return B}function AN($,Z,J,X){let{id:Y,credential:G,identity:z,label:Q}=J,K=Z.rosterRow(Y),W=()=>{throw g("add",Y,K?"id-exists":"unbound-credential",`row ${Y} does not match this staged add`)},V=Z.stateAccount(Y),B=v4(V?.[q$]),j=B?.staged;if(!B?.binding||!j||B.replace||B.dispatch===void 0)return W();if(K&&(K.type!==G.type||K.label!==Q||K.accountId!==z))return W();if(j.reservation!==J.stage?.reservation||j.label!==Q||j.disabledReason!==J.disabled?.reason||B.binding.identity!==z)return W();let H=X===void 0?void 0:f9(X),q=V?.[D4],N=q===void 0?void 0:f9(q);if(j.providerState!==H||j.providerState!==N)return W();if(Z8(G)!==B.digest||p6(G)!==B.dispatch)return W();let U=K?Z.config:{accounts:[{...E9({id:Y,credential:G.type==="api"?{...G,baseURL:B.binding.baseURL??"",authHeader:B.binding.authHeader}:G,identity:B.binding.identity,label:j.label,addedAt:0}),enabled:!1}],[L$]:{rows:{[Y]:{credentialEpoch:B.credentialEpoch,disabledReason:j.disabledReason,staged:{reservation:j.reservation}}}}},L=p8(U,Z.state,$.ctx.codec,$.ctx.providerState).find((D)=>D.id===Y);if(!L?.credential||L.invalid||L.stamp!=="bound"||L.type!==G.type||L.enabled||L.label!==j.label||L.identity!==B.binding.identity||L.disabledReason!==j.disabledReason||L.staged?.reservation!==j.reservation)return W();if(K)return{id:Y,outcome:"exists",credential:L.credential,credentialEpoch:B.credentialEpoch};if(n1(Z.config,Y)!==B.credentialEpoch)return W();return Z.roster().push({...E9({id:Y,credential:G,identity:z,label:Q,addedAt:$.ctx.now()}),enabled:!1}),Z.setEntry(Y,{credentialEpoch:B.credentialEpoch,needsFirstReading:G.type==="oauth",disabledReason:j.disabledReason,staged:{reservation:j.reservation}}),Z.commitConfig().then(()=>({id:Y,outcome:"completed",credential:L.credential,credentialEpoch:B.credentialEpoch}))}async function RN($,Z,J={}){I4("add");let{ctx:X}=$,{id:Y,credential:G,identity:z,label:Q}=Z,K=Z.stage!==void 0||Z.disabled!==void 0,W=await M4(X,"add",Y,J.onFailure,async(V,B)=>{XJ("add",Y,G);let j=J.onExisting??"rotate";if(Z.stage!==void 0&&j==="rotate")throw g("add",Y,"invalid-input","a staged add needs onExisting: 'refuse' or 'stage-duplicate'");if(!["rotate","refuse","stage-duplicate"].includes(j)||Z.stage!==void 0&&(Q!==void 0&&typeof Q!=="string"||z!==void 0&&(typeof z!=="string"||!z))||Z.disabled!==void 0&&(!y(Z.disabled)||typeof Z.disabled.reason!=="string")||Z.stage!==void 0&&(!y(Z.stage)||typeof Z.stage.reservation!=="string"||!Z.stage.reservation||!Z.disabled)||j==="stage-duplicate"&&(!Z.disabled||!Z.stage))throw g("add",Y,"invalid-input","staging requires a reservation and a disabled reason");let H=Z.providerState===void 0?void 0:X8(X.providerState,"add",Y,Z.providerState);if(await V.acquire(o4($,{id:Y,identity:z})),G.type==="oauth")await V.acquire(J.providerLock??$.providerLock);for(let q of J.extraLocks??[])await V.acquire(q);return X4(X,V,B,{operation:"add",rowId:Y},async(q)=>{await ZJ(q,Y,J.protect);let N=y(q.state.accounts)?q.state.accounts:{},U=Object.entries(N).find(([P,M])=>{if(P===Y||q.rosterRow(P)||!y(M))return!1;let _=M[q$];if(!y(_)||!Object.hasOwn(_,"staged"))return!1;return G.type==="oauth"?M.refresh===G.refresh:typeof M.apiKey==="string"&&M.apiKey.trim()===G.apiKey.trim()});if(U)throw g("add",U[0],"row-staged",`orphan ${U[0]} reserves this secret until its staged add is replayed or removed`);if(X.removedIds.has(Y))throw g("add",Y,"id-removed",`id ${Y} was removed from the roster in this process and is not reused`);if(Z.stage&&j!=="rotate"&&(q.rosterRow(Y)||R8(q.state,Y)))return AN($,q,Z,H);if(j==="rotate"){q.assertNotStaged(Y);let P=q.rows().find((M)=>M.fingerprint===I$(G));if(P)q.assertNotStaged(P.id)}if(j==="refuse"){let P=q.rows().find((I)=>I.fingerprint===I$(G)||I.id===Y&&I.credential),M=y(q.state.accounts)?q.state.accounts:{},_=Object.entries(M).find(([,I])=>{if(!y(I))return!1;if(G.type==="oauth")return I.refresh===G.refresh;return typeof I.apiKey==="string"&&I.apiKey.trim()===G.apiKey.trim()})?.[0],S=P?.id??_??Y;if(P||_!==void 0||R8(q.state,Y))throw g("add",S,"credential-exists",`row ${S} already holds this secret or id`)}if(j==="stage-duplicate"&&(q.rosterRow(Y)||R8(q.state,Y)))throw g("add",Y,"id-exists",`row ${Y} already exists`);let L=wN($,q,Z,H),D=q.rows(),w=I$(G),O=j==="rotate"&&!L&&D.find((P)=>P.invalid===void 0&&P.fingerprint===w);if(O){if(q.assertNotStaged(O.id),E4("add",O),z!==void 0&&O.identity!==void 0&&z!==O.identity)throw cZ("add",O.id);let P=YZ($,q,O.id,G,{...H!==void 0?{providerState:$J(X.providerState,"add",O.id,O.providerState,H)}:{}});await q.completeTorn(),q.assertNotStaged(O.id);let M=await GZ(q,O.id,P);return{id:O.id,outcome:"rotated",credential:M,credentialEpoch:O.credentialEpoch??1}}let x=D.find((P)=>P.id===Y);if(x){if(x.invalid)throw g("add",Y,"invalid-row",`row ${Y} is invalid`);if(x.credential)throw g("add",Y,"id-exists",`row ${Y} already holds a credential`);if(E4("add",x),x.type!==G.type)throw g("add",Y,"type-mismatch",`row ${Y} is a ${x.type} row`);if(z!==void 0&&x.identity!==void 0&&z!==x.identity)throw cZ("add",Y);if(!x.hasEntry)q.setEntry(Y,{credentialEpoch:1,needsFirstReading:G.type==="oauth"});let P=YZ($,q,Y,G,{clearErrors:!0,...H!==void 0?{providerState:{kind:"set",value:H}}:{}});await q.completeTorn();let M=await GZ(q,Y,P);if(!x.hasEntry)await q.commitConfig();return{id:Y,outcome:"completed",credential:M,credentialEpoch:x.credentialEpoch??1}}let C=n1(q.config,Y);if(!J4(C))throw g("add",Y,"id-removed",`id ${Y} has held every credential epoch and is not reused; add the credential under another id`);let v=L?.identity??z;q.roster().push(E9({id:Y,credential:G,...v!==void 0?{identity:v}:{},...Q!==void 0?{label:Q}:{},addedAt:X.now()})),q.setEntry(Y,{credentialEpoch:C,needsFirstReading:G.type==="oauth",...Z.stage?{staged:{reservation:Z.stage.reservation}}:{}});let k="added";if(Z.disabled)b8(q,Y,Z.disabled.reason),k="added-disabled";if(!Z.disabled&&v!==void 0&&G.type==="oauth"){if(D.find((M)=>M.invalid===void 0&&M.type==="oauth"&&M.enabled&&M.identity===v))b8(q,Y,WQ),k="added-disabled"}if(L?.credential)return await q.commitConfig(),{id:Y,outcome:k,credential:L.credential,credentialEpoch:L.credentialEpoch??C};q.dropStateAccount(Y);let m=YZ($,q,Y,G,{...Z.stage&&Z.disabled?{staged:{reservation:Z.stage.reservation,disabledReason:Z.disabled.reason,...Q!==void 0?{label:Q}:{},...H!==void 0?{providerState:f9(H)}:{}}}:{},...H!==void 0?{providerState:{kind:"set",value:H}}:{}});if(j==="rotate")await q.completeTorn();let l=await GZ(q,Y,m);return await q.commitConfig(),{id:Y,outcome:k,credential:l,credentialEpoch:C}},{completeTorn:!1})});if(!K&&G.type==="oauth"&&(W.outcome==="added"||W.outcome==="completed"))$.firePull(W.id,"add");return W}async function TN($,Z,J,X={},Y={}){I4("replace");let{ctx:G}=$,z=await M4(G,"replace",Z,Y.onFailure,async(Q,K)=>{XJ("replace",Z,J),J7("replace",Z,Y.attribution);let W=X.providerState===void 0?void 0:X8(G.providerState,"replace",Z,X.providerState),{row:V}=await c8($,"replace",Z);if(await Q.acquire(o4($,V)),J.type==="oauth")await Q.acquire(Y.providerLock??$.providerLock);for(let B of Y.extraLocks??[])await Q.acquire(B);return X4(G,Q,K,{operation:"replace",rowId:Z},async(B)=>{if(Y.attribution!==void 0)R0("replace",Z,B.row(Z),Y.attribution),await B.completeTorn();let j=A0("replace",Z,B.row(Z),J);if(F$(j)!==F$(V))throw X7("replace",Z);let H=B.entry(Z)?.credentialEpoch,q=(typeof H==="number"?H:1)+1;if(!J4(q))throw g("replace",Z,"invalid-row",`row ${Z}'s credential epoch cannot advance past ${Number.MAX_SAFE_INTEGER}; remove the row and add the new credential as a new row`);let N=NN(G.providerState,j,q,X.identity,W),U={...X.identity!==void 0?{identity:X.identity}:{},...J.type==="api"?{baseURL:J.baseURL.trim(),authHeader:J.authHeader??"authorization-bearer"}:{}};if(PQ(B,Z,q,U),X.identity!==void 0)I0(B,X.identity);let L=await JJ($,B,Z,J,{clearErrors:!0,binding:U,providerState:N});return await B.commitConfig(),{id:Z,credential:L,credentialEpoch:q}},{completeTorn:Y.attribution===void 0})});if(J.type==="oauth")$.firePull(Z,"replace");return z}async function FN($,Z,J,X={},Y={}){I4("rotate");let{ctx:G}=$;return M4(G,"rotate",Z,Y.onFailure,async(z,Q)=>{XJ("rotate",Z,J),J7("rotate",Z,Y.attribution);let K=X.providerState===void 0?void 0:X8(G.providerState,"rotate",Z,X.providerState),{row:W}=await c8($,"rotate",Z);if(await z.acquire(o4($,W)),X.identity!==void 0&&J.type==="oauth")await z.acquire(Y.providerLock??$.providerLock);for(let V of Y.extraLocks??[])await z.acquire(V);return X4(G,z,Q,{operation:"rotate",rowId:Z},async(V)=>{if(Y.attribution!==void 0)R0("rotate",Z,V.row(Z),Y.attribution),await V.completeTorn();let B=A0("rotate",Z,V.row(Z),J);if(F$(B)!==F$(W))throw X7("rotate",Z);if(E4("rotate",B),X.identity!==void 0&&B.identity!==void 0&&X.identity!==B.identity)throw cZ("rotate",Z);let j=X.identity!==void 0&&B.identity===void 0?X.identity:void 0,H=await JJ($,V,Z,J,{identity:j,...K!==void 0?{providerState:$J(G.providerState,"rotate",Z,B.providerState,K)}:{}}),q=!1;if(!B.hasEntry)V.setEntry(Z,{credentialEpoch:1,needsFirstReading:B.type==="oauth"}),q=!0;if(X.identity!==void 0&&B.identity!==X.identity)M0(V,Z,X.identity),q=!0;if(q)await V.commitConfig();return{id:Z,credential:H}},{completeTorn:Y.attribution===void 0})})}async function CQ($,Z,J,X,Y){I4(Z);let{ctx:G}=$,z=G.providerState,Q=Y.attribution,K=Y.providerState;return M4(G,Z,J,Y.onFailure,async(W,V)=>{if(J7(Z,J,Q),K!==void 0){if(typeof K!=="function")throw g(Z,J,"invalid-input","the provider-state mutator must be a function");if(Q===void 0)throw g(Z,J,"invalid-input","a provider-state change needs the attribution of the credential it is for");if(!z)throw g(Z,J,"invalid-input","the store was opened without a provider-state codec")}let{row:B}=await c8($,Z,J);await W.acquire(o4($,B));for(let j of Y.extraLocks??[])await W.acquire(j);return X4(G,W,V,{operation:Z,rowId:J},async(j)=>{await ZJ(j,J,Y.protect),j.assertNotStaged(J);let H=j.row(J),q=X.enabled?A0("enable",J,H):H;if(!q||!j.rosterRow(J))throw O6(Z,J);if(F$(q)!==F$(B))throw X7(Z,J);if(Q!==void 0)R0(Z,J,q,Q);if(X.enabled&&q.disabledReason?.startsWith(O0))throw g("enable",J,"identity-contradicted",`row ${J} needs an identity-validated credential replacement before it can be enabled`);let N=!X.enabled||!q.enabled||q.disabledReason!==void 0;if(X.enabled&&N&&q.type==="oauth"){let O=q.identity===void 0?void 0:j.rows().find((x)=>x.id!==J&&x.invalid===void 0&&x.type==="oauth"&&x.enabled&&x.identity===q.identity);if(O)throw g("enable",J,"duplicate-identity",`row ${O.id} is enabled with the same identity as row ${J}`)}if(K===void 0||z===void 0){if(await j.completeTorn(),!N)return{id:J};if(X.enabled)q5(j,J);else b8(j,J,X.reason);return await j.commitConfig(),{id:J}}if(!q.credential)throw g(Z,J,"no-credential",`row ${J} holds no credential`);E4(Z,q);let U=await TQ(j,z,Z,q,K,!0);if(U.kind==="declined")return{id:J,declined:!0};await j.completeTorn();let L={id:J,providerStateOutcome:U.kind==="unchanged"?"unchanged":U.value===void 0?"cleared":"updated",...U.value!==void 0?{providerState:U.value}:{}};if(U.kind==="unchanged"){if(N){if(X.enabled)q5(j,J);else b8(j,J,X.reason);await j.commitConfig()}return L}if(!N)return j.setStateAccount(J,U.account),await j.commitState(),L;let D=X.enabled?{mark:EY(),enabled:!0}:{mark:EY(),enabled:!1,reason:X.reason},w=U.account[q$];return j.setStateAccount(J,{...U.account,[q$]:{...w,[r1]:D}}),await j.commitState(),e1(j,J,D),await j.commitConfig(),L},{completeTorn:!1})})}function CN($,Z,J,X={}){return CQ($,"disable",Z,{enabled:!1,reason:J},X)}function SN($,Z,J={}){return CQ($,"enable",Z,{enabled:!0},J)}async function kN($,Z,J={}){I4("remove");let{ctx:X}=$;return M4(X,"remove",Z,J.onFailure,async(Y,G)=>{if(typeof Z!=="string"||Z.length===0)throw g("remove",Z,"invalid-input","id must be non-empty");let z=J.attribution;if(J7("remove",Z,z),J.staged!==void 0&&(!y(J.staged)||typeof J.staged.reservation!=="string"||!J.staged.reservation))throw g("remove",Z,"invalid-input","a staged removal needs a reservation");let Q=await f4(X);if(Q.status!=="ready")throw J8(Q,"remove",Z);let K=Q.rows.find((V)=>V.id===Z);if(!K&&!R8(Q.state,Z))throw O6("remove",Z);let W=F$(K??{id:Z});await Y.acquire(o4($,K??{id:Z}));for(let V of J.extraLocks??[])await Y.acquire(V);return X4(X,Y,G,{operation:"remove",rowId:Z},async(V)=>{let B=V.reservation(Z);if(B!==void 0){if(!y(B)||!J.staged||B.reservation!==J.staged.reservation)throw g("remove",Z,"row-staged",`row ${Z} is reserved for roster publication`)}else if(J.staged)throw g("remove",Z,"attribution",`row ${Z} is no longer reserved`);let j=V.row(Z),H=R8(V.state,Z);if(!j&&!H)throw O6("remove",Z);if(F$(j??{id:Z})!==W)throw X7("remove",Z);if(z!==void 0)if(j)H5(Z,j,z);else vN($,V,Z,z);let q=J.protect;if(q){let N={row:j,config:V.snapshot.config,state:V.snapshot.state},U=await m8("remove",()=>q(Z,N));if(U!==void 0)throw g("remove",Z,"row-protected",U)}if(j){if(z===void 0)await V.completeTorn();V.dropRosterRows(Z),await V.commitConfig()}if(H)V.dropStateAccount(Z),await V.commitState();return{id:Z,outcome:j?"removed":"completed"}},{completeTorn:!1})})}function H5($,Z,J,X="remove"){if(R0(X,$,Z,J),Z.torn)throw g(X,$,"attribution",`row ${$} is between the writes of another operation; retry once it completes`,!0);if(Z.stamp!=="bound")throw g(X,$,"unbound-credential",`row ${$}'s credential is not bound to its stamp, so the removal cannot be attributed to it`)}function vN($,Z,J,X){let Y=()=>g("remove",J,"unbound-credential",`orphan ${J} has no credential stamp this store can bind, so the removal cannot be attributed to it`),G=Z.stateAccount(J),z=v4(G?.[q$]);if(!G||!z?.binding||z.dispatch===void 0||z.replace)throw Y();let Q;if(typeof G.apiKey==="string"){if(z.binding.baseURL===void 0||z.binding.authHeader===void 0)throw Y();Q={type:"api",apiKey:G.apiKey,baseURL:z.binding.baseURL,authHeader:z.binding.authHeader}}else if(typeof G.refresh==="string")Q={type:"oauth",refresh:G.refresh};else throw Y();let[K]=p8({accounts:[E9({id:J,credential:Q,identity:z.binding.identity,addedAt:0})],[L$]:{rows:{[J]:{credentialEpoch:z.credentialEpoch}}}},Z.state,$.ctx.codec,$.ctx.providerState);if(!K?.credential||K.invalid||K.stamp!=="bound")throw Y();if(z.credentialEpoch!==X.credentialEpoch||z.binding.identity!==X.identity)throw g("remove",J,"attribution",`orphan ${J} was written for a credential or account other than the one this removal was decided for`,!0)}function R8($,Z){let J=$.accounts;return y(J)&&Object.hasOwn(J,Z)}function L5($){return y($)&&typeof $.id==="string"?$.id:void 0}function fN($,Z){if(!Array.isArray(Z))return"ids must be an array of roster ids";let J=new Set;for(let G of $){let z=L5(G);if(z!==void 0)J.add(z)}let X=new Set;for(let G of Z){if(typeof G!=="string")return"ids must be an array of roster ids";if(X.has(G))return`id ${G} appears more than once`;if(!J.has(G))return`id ${G} is not in the roster`;X.add(G)}let Y=[...J].filter((G)=>!X.has(G));if(Y.length>0)return`the order leaves out roster id(s) ${Y.join(", ")}`;return}function EN($,Z){let J=new Map;for(let G of $){let z=L5(G);if(z===void 0)continue;let Q=J.get(z);if(Q)Q.push(G);else J.set(z,[G])}let X=Z.flatMap((G)=>J.get(G)??[]),Y=0;return $.map((G)=>L5(G)===void 0?G:X[Y++])}async function bN($,Z,J={}){I4("reorder");let{ctx:X}=$,Y=J.onFailure;return M4(X,"reorder",void 0,Y&&((G,z)=>Y(z)),async(G,z)=>{for(let Q of J.extraLocks??[])await G.acquire(Q);return X4(X,G,z,{operation:"reorder",rowId:void 0},async(Q)=>{let K=Q.roster(),W=fN(K,Z);if(W)throw new G$({operation:"reorder",phase:"before-first-write",retryable:!1,kind:"invalid-order",message:W});let V=[...Z],B=EN(K,V);if(B.every((j,H)=>j===K[H]))return{ids:V,outcome:"unchanged"};return Q.config.accounts=B,await Q.commitConfig(),{ids:V,outcome:"reordered"}},{completeTorn:!1})})}async function hN($,Z,J,X,Y={}){return I4("recordIdentity"),M4($.ctx,"recordIdentity",Z,Y.onFailure,async(G,z)=>{if(typeof J!=="string"||J.length===0)throw g("recordIdentity",Z,"invalid-input","identity must be non-empty");let Q=y(X)?X.credentialEpoch:void 0;if(!J4(Q))throw g("recordIdentity",Z,"invalid-input","the credential epoch the identity lookup was issued for is required");let{row:K}=await c8($,"recordIdentity",Z);await G.acquire(o4($,K)),await G.acquire(Y.providerLock??$.providerLock);for(let W of Y.extraLocks??[])await G.acquire(W);return X4($.ctx,G,z,{operation:"recordIdentity",rowId:Z},async(W)=>{let V=A0("recordIdentity",Z,W.row(Z));if(F$(V)!==F$(K))throw X7("recordIdentity",Z);if(E4("recordIdentity",V),(V.credentialEpoch??1)!==Q)throw g("recordIdentity",Z,"attribution",`the identity for ${Z} was looked up for a credential the row no longer holds`,!0);if(V.identity!==void 0&&V.identity!==J)throw cZ("recordIdentity",Z);if(V.identity===void 0)await _N(W,V,J);let B=M0(W,Z,J);return await W.commitConfig(),{id:Z,disabled:B}})})}function SQ($){let Z=$[L$];return y(Z)&&y(Z.publications)?Z.publications:{}}function kQ($,Z){let J=SQ($);if(!Object.hasOwn(J,Z))return;let X=J[Z];if(!y(X)||X.operationId!==Z||typeof X.planDigest!=="string"||!/^[a-f0-9]{64}$/.test(X.planDigest)||!["committed","cleaned"].includes(String(X.phase))||!Array.isArray(X.removed)||!Array.isArray(X.finalized)||X.removed.some((Y)=>!y(Y)||typeof Y.id!=="string"||!J4(Y.credentialEpoch))||X.finalized.some((Y)=>!y(Y)||typeof Y.id!=="string"||!J4(Y.credentialEpoch)||typeof Y.reservation!=="string"||!Y.reservation||typeof Y.enabled!=="boolean"))throw g("publishRoster",Z,"invalid-input","the stored publication receipt is malformed");return structuredClone(X)}async function gN($,Z){let J=await f4($.ctx);if(J.status!=="ready")throw J8(J,"publishRoster",Z);return kQ(J.config,Z)}function yN($,Z){let J=()=>{throw g("publishRoster",Z?.operationId??"","invalid-input","the publication plan is invalid")};if(!y(Z)||typeof Z.operationId!=="string"||!Z.operationId||!Array.isArray(Z.remove)||!Array.isArray(Z.finalize)||!Array.isArray(Z.order))J();let X=new Set;for(let Y of[...Z.remove,...Z.finalize]){if(!y(Y)||typeof Y.id!=="string"||pZ(Y.id)||X.has(Y.id)||!Y.attribution)J();if(X.add(Y.id),J7("publishRoster",Y.id,Y.attribution),Y.attribution.identity!==void 0&&(typeof Y.attribution.identity!=="string"||!Y.attribution.identity))J()}for(let Y of Z.remove)if($.ctx.requireRemovedFingerprint&&!Y.fingerprint||Y.fingerprint!==void 0&&typeof Y.fingerprint!=="string")J();for(let Y of Z.finalize)if(typeof Y.reservation!=="string"||!Y.reservation||typeof Y.enabled!=="boolean"||(Y.enabled?Y.disabledReason!==void 0:typeof Y.disabledReason!=="string"))J();if(Z.order.some((Y)=>typeof Y!=="string"||pZ(Y))||new Set(Z.order).size!==Z.order.length)J()}function vQ($,Z){$.entries();let J=$.config[L$],X={...SQ($.config)};Object.defineProperty(X,Z.operationId,{value:Z,enumerable:!0,writable:!0,configurable:!0}),J.publications=X,delete J.publicationOrder}function uN($,Z,J){let X=new Set;for(let z of _0($.config)){if(!y(z)||typeof z.id!=="string")continue;if(X.has(z.id))throw g("publishRoster",Z.operationId,"invalid-input","publication needs a roster of unique named rows");X.add(z.id)}let Y=new Set(Z.remove.map((z)=>z.id)),G=J.filter((z)=>z.invalid!=="roster"&&!Y.has(z.id));if(G.length!==Z.order.length||Z.order.some((z)=>!G.some((Q)=>Q.id===z))||G.some((z)=>!Z.order.includes(z.id)))throw g("publishRoster",Z.operationId,"invalid-input","order must name exactly the surviving roster");return G}async function bY($,Z){await $.assertAll();for(let X of Z.removed)if(v4($.stateAccount(X.id)?.[q$])?.credentialEpoch===X.credentialEpoch&&!$.rosterRow(X.id))$.dropStateAccount(X.id);for(let X of Z.finalized){let Y=$.stateAccount(X.id),G=v4(Y?.[q$]);if(Y&&G?.credentialEpoch===X.credentialEpoch&&G.staged?.reservation===X.reservation){let z={...Y[q$]};delete z.staged,$.setStateAccount(X.id,{...Y,[q$]:z})}}await $.commitState(void 0,{durable:!0});let J={...Z,phase:"cleaned"};return vQ($,J),await $.commitConfig({durable:!0}),J}async function mN($,Z,J={}){return I4("publishRoster"),M4($.ctx,"publishRoster",Z?.operationId??"",J.onFailure,async(X,Y)=>{if(!y(Z)||typeof Z.operationId!=="string"||!Z.operationId)throw g("publishRoster",Z?.operationId??"","invalid-input","the publication needs an operation id");Z=structuredClone(Z);let G=f9(Z),z=[...Array.isArray(Z.remove)?Z.remove:[],...Array.isArray(Z.finalize)?Z.finalize:[]].filter((Q)=>y(Q)&&typeof Q.id==="string");for(let Q=0;;Q++){let K=await f4($.ctx);if(K.status!=="ready")throw J8(K,"publishRoster",Z.operationId);let W=new Map(z.map(({id:B})=>[B,F$(K.rows.find((j)=>j.id===B)??{id:B})]));for(let B of[...new Set(W.values())].sort())await X.acquire(o4($,{id:B}));await X.acquire(J.providerLock??$.providerLock);for(let B of J.extraLocks??[])await X.acquire(B);let V=await X4($.ctx,X,Y,{operation:"publishRoster",rowId:Z.operationId},async(B)=>{let j=B.rows();if(z.some(({id:x})=>F$(j.find((C)=>C.id===x)??{id:x})!==W.get(x)))return;let H=kQ(B.config,Z.operationId);if(H){if(H.planDigest!==G)throw g("publishRoster",Z.operationId,"publication-mismatch","the operation id belongs to a different publication plan");if(H.phase==="cleaned")return{outcome:"already-cleaned",receipt:H};return B.markPublicationDecision(),await B.syncConfig(),{outcome:"cleaned",receipt:await bY(B,H)}}yN($,Z);let q=uN(B,Z,j),N=[];for(let x of Z.remove){B.assertNotStaged(x.id);let C=j.find((v)=>v.id===x.id);if(!C)throw g("publishRoster",x.id,"attribution","the removed row no longer exists");if(H5(x.id,C,x.attribution,"publishRoster"),!C.credential||x.fingerprint!==void 0&&I$(C.credential)!==x.fingerprint)throw g("publishRoster",x.id,"attribution","the removed secret no longer matches");N.push(C)}let U=[];for(let x of Z.finalize){let C=j.find((M)=>M.id===x.id),v=v4(B.stateAccount(x.id)?.[q$]);if(!C||C.staged?.reservation!==x.reservation||v?.staged?.reservation!==x.reservation||C.enabled)throw g("publishRoster",x.id,"row-staged","the finalized row is not disabled under this reservation");let k=B.stateAccount(x.id),m=B.rosterRow(x.id),l=k?.[D4],P=l===void 0?void 0:f9(l);if(!v?.staged||v.staged.label!==m?.label||v.staged.disabledReason!==C.disabledReason||v.staged.providerState!==P)throw g("publishRoster",x.id,"row-staged","the staged label, disabled reason or full provider state no longer matches its stamp");H5(x.id,C,x.attribution,"publishRoster"),U.push(C)}let L=q.find((x)=>x.torn);if(L)throw g("publishRoster",Z.operationId,"attribution",`Row ${L.id} has an interrupted write; complete it with a normal store operation before publishing.`,!1);let D=new Set;for(let x of q){if(!(Z.finalize.find((v)=>v.id===x.id)?.enabled??x.enabled)||x.type!=="oauth"||x.identity===void 0)continue;if(D.has(x.identity))throw g("publishRoster",x.id,"invalid-input","the final enabled roster repeats a known identity");D.add(x.identity)}for(let x of q)if(x.identity!==void 0&&x.fingerprint!==void 0&&q.some((C)=>C.id!==x.id&&C.identity!==void 0&&C.identity!==x.identity&&C.fingerprint===x.fingerprint))throw g("publishRoster",x.id,"attribution","the resulting pool gives the same secret different known identities");for(let x of U)if(x.identity!==void 0&&N.some((C)=>C.identity!==void 0&&C.identity!==x.identity&&C.fingerprint===x.fingerprint))throw g("publishRoster",x.id,"attribution","the staged secret belonged to a different known identity");await ZJ(B,Z.operationId,J.protect);let w={operationId:Z.operationId,planDigest:G,phase:"committed",removed:N.map((x)=>({id:x.id,credentialEpoch:x.credentialEpoch??1})),finalized:Z.finalize.map((x,C)=>({id:x.id,credentialEpoch:U[C]?.credentialEpoch??1,reservation:x.reservation,enabled:x.enabled}))};for(let x of Z.remove)B.dropRosterRows(x.id);for(let x of Z.finalize){let C=B.rosterRow(x.id);C.enabled=x.enabled;let v={...B.entry(x.id)};if(delete v.staged,x.enabled)delete v.disabledReason;else v.disabledReason=x.disabledReason;B.setEntry(x.id,v)}let O=B.roster().filter((x)=>!y(x)||typeof x.id!=="string"||j.find((C)=>C.id===x.id)?.invalid==="roster");return B.config.accounts=[...Z.order.map((x)=>B.rosterRow(x)),...O],vQ(B,w),await B.syncState(),await B.commitConfig({durable:!0,publicationDecision:!0}),{outcome:"published",receipt:await bY(B,w)}},{completeTorn:!1});if(V)return V;if(await X.releaseAll(),Q>=1)throw g("publishRoster",Z.operationId,"row-key-changed","a named row changed lock key twice during publication",!0)}})}class fQ{rt;hook;onFailure;firedAtLoad;logger;inflight=new Set;constructor($,Z,J,X,Y){this.rt=$,this.hook=Z,this.onFailure=J,this.firedAtLoad=X,this.logger=Y}fire($,Z){if(!this.hook)return;if(Z==="load"){if(this.firedAtLoad.has($))return;this.firedAtLoad.add($)}let J=this.run($,Z);this.inflight.add(J),J.finally(()=>this.inflight.delete(J))}async settled(){while(this.inflight.size>0)await Promise.allSettled([...this.inflight])}async run($,Z){let J=this.rt(),{ctx:X}=J,Y=new e9(X.lockDefaults,X.lockEnv),G={writes:0};try{let z=await X4(X,Y,G,{operation:"pull",rowId:$},async(K)=>{if(K.reservation($)!==void 0)return;await K.completeTorn();let W=K.row($);if(W?.unbound&&W.enabled&&W.type==="oauth"&&W.credential&&!W.invalid)E4("pull",W);if(!W?.candidate||W.type!=="oauth")return;if(!W.hasEntry)K.setEntry($,{credentialEpoch:1,needsFirstReading:!0}),await K.commitConfig();let V=K.row($);if(!V?.credential||V.credentialEpoch===void 0)return;return{id:$,credential:V.credential,credentialEpoch:V.credentialEpoch,...V.identity!==void 0?{identity:V.identity}:{},reason:Z}},{completeTorn:!1});if(await Y.releaseAll(),!z){this.firedAtLoad.delete($);return}await X.hold?.("pull-before-request",$);let Q;try{Q=await this.hook?.(z)}catch(K){throw new G$({operation:"pull",rowId:$,phase:"pull",retryable:!0,kind:"pull",message:"the quota pull rejected",cause:K})}await RQ(J,$,{credentialEpoch:z.credentialEpoch,...z.identity!==void 0?{identity:z.identity}:{}},Q)}catch(z){this.firedAtLoad.delete($);let Q=w0(z,"pull",$,G);if(this.onFailure)try{await this.onFailure($,Q)}catch(K){this.logger?.warn("pull failure hook threw",{rowId:$,error:K instanceof Error?K.message:String(K)})}else this.logger?.warn("quota pull failed",{rowId:$,kind:Q.kind})}finally{await Y.releaseAll()}}}function N2($,Z){if(mZ("refresh",$,Z?.staged),!Z)throw g("refresh",$,"unknown-row",`no row ${$} in the pool`);if(Z.invalid)throw g("refresh",$,"invalid-row",`row ${$} is invalid`);if(Z.type!=="oauth"||Z.credential?.type!=="oauth")throw g("refresh",$,"no-credential",`row ${$} holds no OAuth credential`);if(!Z.enabled)throw g("refresh",$,"row-disabled",`row ${$} is disabled`);return Z}function hY($){return g("refresh",$,"refresh-stamp-ahead",`row ${$}'s stored refresh stamp is ahead of the clock; a rotation now could not be stamped newer within the trust bound`,!0)}async function cN($,Z,J,X={}){I4("refresh");let{ctx:Y}=$;return M4(Y,"refresh",Z,X.onFailure,async(G,z)=>{let{row:Q}=await c8($,"refresh",Z);N2(Z,Q);let K=await X.refuse?.(Q);if(K!==void 0)return{status:"refused",rowId:Z,reason:K};let W=F$(Q),V;for(let q=0;;q++){await G.acquire(o4($,{id:Z,identity:W===Z?void 0:W})),await G.acquire(X.providerLock??$.providerLock);for(let L of X.extraLocks??[])await G.acquire(L);let U=await X4(Y,G,{writes:0},{operation:"refresh",rowId:Z},async(L)=>{let D=N2(Z,L.row(Z));if(E4("refresh",D),!D.hasEntry)L.setEntry(Z,{credentialEpoch:1,needsFirstReading:!0}),await L.commitConfig(),D=N2(Z,L.row(Z));if(F$(D)!==W)return{keyNow:F$(D)};let w=await X.refuse?.(D);if(w!==void 0)return{refused:w};return{row:D,credential:D.credential,credentialEpoch:D.credentialEpoch,identity:D.identity}});if("refused"in U)return{status:"refused",rowId:Z,reason:U.refused};if("keyNow"in U){if(await G.releaseAll(),q>=1)throw g("refresh",Z,"row-key-changed",`row ${Z}'s wire identity changed twice while its lock was held`,!0);W=U.keyNow;continue}V=U;break}if(vY(V.credential.lastRefreshedAt,Y.now()))throw hY(Z);await Y.hold?.("refresh-before-provider",Z),await G.assertAll();let B;try{B=await J(V.credential,V.row)}catch(q){throw new G$({operation:"refresh",rowId:Z,phase:"before-first-write",retryable:!0,kind:"provider",message:"the provider refresh failed",cause:q})}if(typeof B?.refresh!=="string"||!B.refresh.trim())throw g("refresh",Z,"provider","the provider returned no refresh token",!0);let j=B.providerState===void 0?void 0:X8(Y.providerState,"refresh",Z,B.providerState,"the provider state the provider returned"),H=await X4(Y,G,z,{operation:"refresh",rowId:Z},async(q)=>{let N=q.row(Z),U=q.entry(Z);if(!N||N.invalid||!U||U.credentialEpoch!==V.credentialEpoch||N.identity!==V.identity)throw new G$({operation:"refresh",rowId:Z,phase:"before-first-write",retryable:!0,kind:"attribution",message:`row ${Z} changed credential while its refresh was in flight; the rotation is discarded`});E4("refresh",N);let L=await X.refuse?.(N);if(L!==void 0)return{refused:L};let D=Y.now(),w=N.credential?.type==="oauth"?N.credential.lastRefreshedAt:void 0;if(vY(w,D))throw hY(Z);let O={type:"oauth",access:B.access,refresh:B.refresh,expires:B.expires},x=N.identity!==void 0&&B.identity!==void 0&&N.identity!==B.identity?{expectedIdentity:N.identity,returnedIdentity:B.identity}:void 0,C=x?{mark:pN(),enabled:!1,reason:`${O0}${JSON.stringify(x)}`}:void 0,v=N.identity===void 0&&B.identity?B.identity:void 0,k=await JJ($,q,Z,O,{stamp:o1(w,D),transition:C,identity:v,...j!==void 0?{providerState:$J(Y.providerState,"refresh",Z,N.providerState,j)}:{}});if(C!==void 0)e1(q,Z,C),await q.commitConfig();let m=N.identity;if(v!==void 0)M0(q,Z,v),m=v,await q.commitConfig();return{stored:k,identity:m,contradiction:x,refused:void 0}});if(H.refused!==void 0)return{status:"refused",rowId:Z,reason:H.refused};if(H.contradiction!==void 0)return{status:"identity-contradicted",rowId:Z,...H.contradiction,credential:H.stored};if(X.onPersisted)try{let q=X.onPersisted;await m8("refresh",()=>q(Z,H.stored))}catch(q){throw new G$({operation:"refresh",rowId:Z,phase:"after-first-write",retryable:!1,kind:"after-persist-hook",committed:H.stored,message:"the after-persist hook threw; the rotation stays committed",cause:q})}return{status:"rotated",rowId:Z,credential:H.stored,...H.identity!==void 0?{identity:H.identity}:{}}})}var YJ=Object.freeze(["version","accounts",L$]);function U5($){let Z={};for(let[J,X]of Object.entries($))if(!YJ.includes(J))zZ(Z,J,X);return Z}function zZ($,Z,J){Object.defineProperty($,Z,{value:J,enumerable:!0,writable:!0,configurable:!0})}function iN($,Z){let J={};for(let[X,Y]of Object.entries($))if(YJ.includes(X))zZ(J,X,Y);else if(Object.hasOwn(Z,X))zZ(J,X,Z[X]);for(let[X,Y]of Object.entries(Z))if(!Object.hasOwn($,X))zZ(J,X,Y);return J}function gY($){return new G$({operation:"updateSettings",phase:"before-first-write",retryable:!1,kind:"invalid-input",message:$})}async function dN($){let Z=await f4($.ctx);if(Z.status==="error")return Z;return{status:Z.status,settings:U5(Z.config)}}async function sN($,Z,J={}){I4("updateSettings");let{ctx:X}=$,Y=J.onFailure;return M4(X,"updateSettings",void 0,Y&&((G,z)=>Y(z)),async(G,z)=>{for(let K of J.extraLocks??[])await G.acquire(K);let Q=G.held.length;try{for(let U of X.storeLocks)await G.acquire(U);let K=await f4(X);if(K.status!=="ready")throw J8(K,"updateSettings",void 0);let W=U5(K.config),V=structuredClone(W),B=await m8("updateSettings",()=>Z(V)),j=B===void 0?V:B;if(!y(j))throw gY("the settings mutator must produce an object");let H=YJ.filter((U)=>Object.hasOwn(j,U));if(H.length>0)throw gY(`settings cannot set the pool-owned key(s) ${H.join(", ")}`);if(lN(j,W))return{settings:W,outcome:"unchanged"};let q=iN(K.config,j),N={operation:"updateSettings",rowId:void 0};return await u8(X.configPath,q,{beforeRename:async()=>{await X.onStep?.("before-config-write",N),await G.assertAll()}}),z.writes++,await X.onStep?.("after-config-write",N),{settings:U5(q),outcome:"updated"}}finally{await G.releaseTo(Q)}})}var yY=new Map;function tN($){let Z=yY.get($);if(!Z)Z={removedIds:new Set,firedAtLoad:new Set},yY.set($,Z);return Z}function uY($){if($.status==="ready")return{status:"ready",schemaVersion:v9,rows:$.rows};if($.status==="pending-migration")return{status:"pending-migration",roster:Array.isArray($.config.accounts)?$.config.accounts:[]};return $}function aN($){let Z=tN($.configPath),J={...y$,...$.lockOptions},X={provider:$.provider,configPath:$.configPath,statePath:$.statePath,codec:$.quota,...$.providerState?{providerState:$.providerState}:{},now:$.now??Date.now,storeLocks:$.storeLocks??[{name:"save",path:$.configPath},{name:"save",path:$.statePath}],lockDefaults:J,lockEnv:{now:$.now??Date.now,...$.onLockEvent?{onLockEvent:$.onLockEvent}:{},...$.onLockStep?{onLockStep:$.onLockStep}:{}},removedIds:Z.removedIds,requireCredentialStamps:$.requireCredentialStamps===!0,requireRemovedFingerprint:$.requireRemovedFingerprint===!0,...$.logger?{logger:$.logger}:{},...$.onStep?{onStep:$.onStep}:{},...$.hold?{hold:$.hold}:{}},Y=new fQ(()=>G,$.pull,$.onPullFailure,Z.firedAtLoad,$.logger),G={ctx:X,providerLock:$.providerLock??{name:`provider-${encodeURIComponent($.provider)}`,path:$.statePath},rowLockOptions:$.rowLockOptions??{},firePull:(z,Q)=>Y.fire(z,Q)};return{async load(){let z=await f4(X);if(z.status==="ready"){for(let Q of z.rows)if((Q.candidate||Q.torn&&Q.enabled)&&Q.type==="oauth"&&Q.needsFirstReading)Y.fire(Q.id,"load")}return uY(z)},async read(){return uY(await f4(X))},async initialize(z={}){return{status:await UN(X,z.dropKeys??[])}},add:(z,Q)=>RN(G,z,Q),publishRoster:(z,Q)=>mN(G,z,Q),publication:(z)=>gN(G,z),replace:(z,Q,K,W)=>TN(G,z,Q,K,W),rotate:(z,Q,K,W)=>FN(G,z,Q,K,W),updateProviderState:(z,Q,K,W)=>DN(G,z,Q,K,W),disable:(z,Q,K)=>CN(G,z,Q,K),enable:(z,Q)=>SN(G,z,Q),remove:(z,Q)=>kN(G,z,Q),reorder:(z,Q)=>bN(G,z,Q),readSettings:()=>dN(G),updateSettings:(z,Q)=>sN(G,z,Q),recordIdentity:(z,Q,K,W)=>hN(G,z,Q,K,W),refresh:(z,Q,K)=>cN(G,z,Q,K),recordQuota:(z,Q,K)=>RQ(G,z,Q,K),requestReading:(z)=>Y.fire(z,"admission"),pullsSettled:()=>Y.settled()}}Y4();var N5="all",bT=Object.freeze(["primary"]);function nN($){return $.kind==="retired"?$.retiredAt:$.checkedAt}function O9($,Z){return JSON.stringify([$,Z])}function zJ($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function N4($){return typeof $==="number"&&Number.isFinite($)}function mY($){return typeof $==="string"&&$.length>0}function F4($,Z,J){return $[Z]===void 0||J($[Z])}function oN($){return N4($)&&$>0}function x5($){return typeof $==="string"}function rN($){if(!zJ($)||!mY($.scope)||!mY($.label))return!1;switch($.kind){case"reading":return N4($.checkedAt)&&N4($.usedPercent)&&F4($,"resetsAt",x5)&&F4($,"windowMinutes",oN);case"retired":return N4($.retiredAt);case"absent":return N4($.checkedAt);default:return!1}}function eN($){if(!zJ($)||!N4($.checkedAt))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&F4($,"remainingPercent",N4)&&F4($,"usedPercent",N4)&&F4($,"resetsAt",x5)&&F4($,"limit",N4)&&F4($,"used",N4)&&F4($,"remaining",N4)&&F4($,"unit",x5)}function Y7($){if(!zJ($)||!Array.isArray($.limits))return!1;let Z=new Set;for(let J of $.limits){if(!rN(J))return!1;let X=O9(J.scope,J.label);if(Z.has(X))return!1;Z.add(X)}return F4($,"budget",eN)}class D5 extends TypeError{constructor($){super($);this.name="QuotaCodecError"}}function T0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function lZ($){return typeof $==="number"&&Number.isFinite($)}function EQ($){return $===void 0||typeof $==="string"&&$!==""}function bQ($){return typeof $==="string"&&$!==""}function r8($,Z){return $[Z]===void 0||lZ($[Z])}function O5($,Z){return $[Z]===void 0||typeof $[Z]==="string"}function $x($){return T0($)&&EQ($.scope)&&bQ($.label)&&lZ($.usedPercent)&&O5($,"resetsAt")&&($.windowMinutes===void 0||lZ($.windowMinutes)&&$.windowMinutes>0)}function Zx($){return T0($)&&EQ($.scope)&&bQ($.label)}function Jx($){if(!T0($))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&r8($,"remainingPercent")&&r8($,"usedPercent")&&O5($,"resetsAt")&&r8($,"limit")&&r8($,"used")&&r8($,"remaining")&&O5($,"unit")}function Xx($){if(!T0($)||!lZ($.checkedAt))return!1;let Z=$.readings??[],J=$.coverage??[];if(!Array.isArray(Z)||!Array.isArray(J))return!1;let X=new Set;for(let Y of Z){if(!$x(Y))return!1;let G=O9(Y.scope??N5,Y.label);if(X.has(G))return!1;X.add(G)}if(!J.every(Zx))return!1;return $.budget===void 0||Jx($.budget)}function Yx($,Z){if($.scope!==Z.scope)return $.scope<Z.scope?-1:1;if($.label!==Z.label)return $.label<Z.label?-1:1;return 0}function Gx($,Z,J){if(Z===void 0)return $;if($!==void 0&&J<$.checkedAt)return $;return{...Z,checkedAt:J}}function hQ($,Z){if($!==void 0&&!Y7($))throw new D5("stored quota map is malformed");if(!Xx(Z))throw new D5("quota observation is malformed");let J=$??{limits:[]},X=Z.checkedAt,Y=new Map;for(let B of J.limits)Y.set(O9(B.scope,B.label),B);let G=(B)=>{let j=Y.get(B);return j===void 0||X>=nN(j)},z=new Set;for(let B of Z.readings??[]){let j=B.scope??N5,H=O9(j,B.label);if(z.add(H),!G(H))continue;Y.set(H,{scope:j,label:B.label,kind:"reading",checkedAt:X,usedPercent:B.usedPercent,...B.resetsAt===void 0?{}:{resetsAt:B.resetsAt},...B.windowMinutes===void 0?{}:{windowMinutes:B.windowMinutes}})}for(let B of Z.coverage??[]){let j=B.scope??N5,H=O9(j,B.label);if(z.has(H)||!G(H))continue;let q=Y.get(H);Y.set(H,q===void 0||q.kind==="absent"?{scope:j,label:B.label,kind:"absent",checkedAt:X}:{scope:j,label:B.label,kind:"retired",retiredAt:X})}let{limits:Q,budget:K,...W}=J,V=Gx(J.budget,Z.budget,X);return{...W,limits:[...Y.values()].sort(Yx),...V===void 0?{}:{budget:V}}}var hT=Object.freeze({validate:Y7,merge:hQ});class j6 extends Error{constructor(){super("Anthropic quota observation is invalid");this.name="NativeQuotaCodecError"}}function W4($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function b4($,Z,J=[]){return Z.every((X)=>Object.hasOwn($,X))&&Object.keys($).every((X)=>Z.includes(X)||J.includes(X))}function i4($){return typeof $==="number"&&Number.isFinite($)}function QJ($){return i4($)&&$>=0}function $4($){return typeof $==="string"&&$.length>0&&$.trim()===$}function R$($,Z,J){return $[Z]===void 0||J($[Z])}function I5($){return $==="poll"||$==="headers"}function pY($){return W4($)&&b4($,["amountMinor","currency","exponent"])&&i4($.amountMinor)&&$4($.currency)&&/^[A-Za-z]{3}$/.test($.currency)&&i4($.exponent)&&Number.isInteger($.exponent)&&$.exponent>=0&&$.exponent<=20}function zx($){return W4($)&&b4($,["used","limit","exhausted"],["utilizationPercent","severity"])&&pY($.used)&&pY($.limit)&&typeof $.exhausted==="boolean"&&R$($,"utilizationPercent",i4)&&R$($,"severity",(Z)=>typeof Z==="string")}function Qx($){return W4($)&&b4($,[],i9)&&Object.values($).every(I5)}var gQ=["checkedAt","accountIdentity","extraUsage","bindingWindow","bindingWindowSource","fieldSources","fallbackAdvised","source"];function yQ($){return R$($,"checkedAt",QJ)&&R$($,"accountIdentity",$4)&&R$($,"extraUsage",zx)&&R$($,"bindingWindow",$4)&&R$($,"bindingWindowSource",I5)&&R$($,"fieldSources",Qx)&&R$($,"fallbackAdvised",(Z)=>typeof Z==="boolean")&&R$($,"source",I5)}function x2($,Z){if(!W4($)||!b4($,Z?["usedPercent","remainingPercent","checkedAt","id","title","modelName"]:["usedPercent","remainingPercent","checkedAt"],Z?["resetsAt","modelId"]:["resetsAt"]))return!1;return i4($.usedPercent)&&i4($.remainingPercent)&&QJ($.checkedAt)&&R$($,"resetsAt",(J)=>typeof J==="string")&&(!Z||$4($.id)&&$4($.title)&&$4($.modelName)&&R$($,"modelId",$4))}function M5($){return W4($)&&b4($,[],["five_hour","seven_day","scoped",...gQ])&&yQ($)&&R$($,"five_hour",(Z)=>x2(Z,!1))&&R$($,"seven_day",(Z)=>x2(Z,!1))&&R$($,"scoped",(Z)=>Array.isArray(Z)&&Z.every((J)=>x2(J,!0))&&new Set(Z.map((J)=>J.id)).size===Z.length)}function Kx($){return W4($)&&b4($,["id","title","modelName","remainingPercent"],["modelId"])&&$4($.id)&&$4($.title)&&$4($.modelName)&&R$($,"modelId",$4)&&i4($.remainingPercent)}function Wx($){return W4($)&&b4($,["version","remainingPercent"],["scoped",...gQ])&&$.version===1&&yQ($)&&W4($.remainingPercent)&&b4($.remainingPercent,[],["five_hour","seven_day"])&&Object.values($.remainingPercent).every(i4)&&R$($,"scoped",(Z)=>Array.isArray(Z)&&Z.every(Kx))}function cY($){let Z=$.toLowerCase().replace(/[^a-z0-9]/g,"");if(Z.includes("fable"))return"fable";if(Z.includes("mythos"))return"mythos";return`model:${Z}`}function uQ($){let Z=cY([$.modelId,$.modelName,$.title].join(" "));return{scope:Z==="fable"||Z==="mythos"?Z:cY($.modelId??$.modelName),label:`seven_day:${$.id}`}}function c6($){if(!M5($))throw new j6;let Z=JSON.parse(JSON.stringify($));if(!M5(Z))throw new j6;let{five_hour:J,seven_day:X,scoped:Y,...G}=Z,z=[],Q={};if(J){let{remainingPercent:V,...B}=J;Q.five_hour=V,z.push({scope:"all",label:"five_hour",kind:"reading",...B})}if(X){let{remainingPercent:V,...B}=X;Q.seven_day=V,z.push({scope:"all",label:"seven_day",kind:"reading",...B})}let K=Y?.map((V)=>{let{usedPercent:B,checkedAt:j,resetsAt:H,...q}=V;return z.push({...uQ(q),kind:"reading",usedPercent:B,checkedAt:j,...H!==void 0?{resetsAt:H}:{}}),q}),W={limits:z,anthropic:{version:1,remainingPercent:Q,...G,...K!==void 0?{scoped:K}:{}}};if(G.extraUsage&&G.checkedAt!==void 0)W.budget={kind:"reading",checkedAt:G.checkedAt,reached:G.extraUsage.exhausted,...G.extraUsage.utilizationPercent!==void 0?{usedPercent:G.extraUsage.utilizationPercent}:{}};if(!Y7(W))throw new j6;return W}function Vx($){return W4($)&&b4($,["scope","label","kind","checkedAt","usedPercent"],["resetsAt"])&&$4($.scope)&&$4($.label)&&$.kind==="reading"&&QJ($.checkedAt)&&i4($.usedPercent)&&R$($,"resetsAt",(Z)=>typeof Z==="string")}function P5($,Z){if(Array.isArray($)&&Array.isArray(Z))return $.length===Z.length&&$.every((J,X)=>P5(J,Z[X]));if(W4($)&&W4(Z))return Object.keys($).length===Object.keys(Z).length&&Object.keys($).every((J)=>Object.hasOwn(Z,J)&&P5($[J],Z[J]));return $===Z}function H6($){if(!W4($)||!b4($,["limits","anthropic"],["budget"])||!Y7($)||!$.limits.every(Vx)||!Wx($.anthropic))throw new j6;let{version:Z,remainingPercent:J,scoped:X,...Y}=$.anthropic,G=structuredClone(Y);for(let z of["five_hour","seven_day"]){let Q=$.limits.find((V)=>V.scope==="all"&&V.label===z),K=z==="five_hour"?J.five_hour:J.seven_day;if(Q?.kind!=="reading"||K===void 0)continue;let W={usedPercent:Q.usedPercent,remainingPercent:K,checkedAt:Q.checkedAt,...Q.resetsAt!==void 0?{resetsAt:Q.resetsAt}:{}};if(z==="five_hour")G.five_hour=W;else G.seven_day=W}if(X!==void 0)G.scoped=X.map((z)=>{let Q=uQ(z),K=$.limits.find((W)=>W.scope===Q.scope&&W.label===Q.label);if(K?.kind!=="reading")throw new j6;return{...structuredClone(z),usedPercent:K.usedPercent,checkedAt:K.checkedAt,...K.resetsAt!==void 0?{resetsAt:K.resetsAt}:{}}});if(!P5(c6(G),$))throw new j6;return G}var l4={validate($){try{return H6($),!0}catch{return!1}},merge($,Z){let J=H6(Z);if($===void 0)return c6(J);let X=H6($);if(X.accountIdentity!==J.accountIdentity)throw new j6;if(J.source==="headers")return c6(A1(X,J));let Y=Q4(X),G=Q4(J);return c6(Y>G||Y===G&&X.source==="poll"&&J.source!=="poll"?X:J)}};class iZ extends Error{constructor(){super("Anthropic account binding is unavailable or changed");this.name="NativePoolBindingError"}}function dZ($){return typeof $==="string"&&$.length>0&&$.trim()===$}function KJ($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function x$($){if(!$||typeof $!=="object"||Array.isArray($))return!1;let Z=$;return Z.kind==="local"&&typeof Z.storageId==="string"&&/^[a-f0-9]{64}$/.test(Z.storageId)&&dZ(Z.rowId)&&KJ(Z.credentialEpoch)&&(Z.identity===void 0||dZ(Z.identity))&&["kind","storageId","rowId","credentialEpoch"].every((J)=>Object.hasOwn(Z,J))&&(Z.identity===void 0||Object.hasOwn(Z,"identity"))&&Object.keys(Z).every((J)=>["kind","storageId","rowId","credentialEpoch","identity"].includes(J))}function pQ($){return $.stamp==="bound"&&!$.invalid&&!$.torn&&!$.unbound&&dZ($.id)&&KJ($.credentialEpoch)&&($.identity===void 0||dZ($.identity))}function Ix($,Z){let J=Z.credentialEpoch;if(!Z.candidate||!pQ(Z)||!KJ(J))throw new iZ;let X={kind:"local",storageId:$.storageId,rowId:Z.id,credentialEpoch:J,...Z.identity!==void 0?{identity:Z.identity}:{}};if(!x$(X))throw new iZ;return Object.freeze(X)}function x4($,Z,J){return x$($)&&pQ(J)&&$.storageId===Z.storageId&&$.rowId===J.id&&$.credentialEpoch===J.credentialEpoch&&$.identity===J.identity}function dY($){if(!x$($))throw new iZ;return Ox("sha256").update(JSON.stringify(["anthropic-local-refresh",$.storageId,$.credentialEpoch,$.identity===void 0?["row",$.rowId]:["account",$.identity]])).digest("hex")}function _5($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function sY($,Z,J=[]){return Z.every((X)=>Object.hasOwn($,X))&&Object.keys($).every((X)=>Z.includes(X)||J.includes(X))}function sZ($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0}function tY($){return typeof $==="string"&&$.length>0&&$.trim()===$}function r6($){if(!_5($)||!sY($,["binding","credentialFingerprint","version"])||!x$($.binding)||$.binding.identity===void 0||typeof $.credentialFingerprint!=="string"||!/^[a-f0-9]{64}$/.test($.credentialFingerprint)||!_5($.version)||!sY($.version,["accessFingerprint","expires"],["lastRefreshedAt"]))return!1;return typeof $.version.accessFingerprint==="string"&&/^[a-f0-9]{16}$/.test($.version.accessFingerprint)&&sZ($.version.expires)&&$.version.expires>0&&(!Object.hasOwn($.version,"lastRefreshedAt")||sZ($.version.lastRefreshedAt))}function y6($,Z,J){if(!r6($)||!x$(Z)||Z.identity===void 0||!_5(J)||J.type!=="oauth"||!tY(J.access)||!tY(J.refresh)||!sZ(J.expires)||J.expires<=0||Object.hasOwn(J,"lastRefreshedAt")&&!sZ(J.lastRefreshedAt))return!1;return $.binding.storageId===Z.storageId&&$.binding.rowId===Z.rowId&&$.binding.credentialEpoch===Z.credentialEpoch&&$.binding.identity===Z.identity&&$.credentialFingerprint===I$({type:"oauth",refresh:J.refresh})&&$.version.accessFingerprint===S4(J.access)&&$.version.expires===J.expires&&Object.hasOwn($.version,"lastRefreshedAt")===Object.hasOwn(J,"lastRefreshedAt")&&$.version.lastRefreshedAt===J.lastRefreshedAt}function cQ($){if(!$)return;return(Z)=>{try{let J=$(Z);if(J!==null&&(typeof J==="object"||typeof J==="function")&&"then"in J&&typeof J.then==="function")Promise.resolve(J).catch(()=>{})}catch{}}}a4();class L6 extends Error{code;constructor($){super($==="supervised-auth-snapshot"?"Local login cannot be verified while OPENCODE_AUTH_CONTENT is set. Run setup without OPENCODE_AUTH_CONTENT in the environment.":"Invalid native host auth source.");this.name="NativeHostAuthError",this.code=$==="supervised-auth-snapshot"?$:"invalid-source"}}function wx($){return $.OPENCODE_AUTH_CONTENT!==void 0}function iQ($){if(wx($))throw new L6("supervised-auth-snapshot")}function D$(){throw new L6("invalid-source")}function QZ($){if($===null||typeof $!=="object"||Array.isArray($))return!1;let Z=Object.getPrototypeOf($);return Z===Object.prototype||Z===null}function I9($){let Z=new Map;for(let J of Reflect.ownKeys($)){if(typeof J!=="string")D$();let X=Object.getOwnPropertyDescriptor($,J);if(!X||!Object.hasOwn(X,"value"))D$();Z.set(J,X.value)}return Z}function w5($,Z=new Set){if($===null||typeof $==="string"||typeof $==="boolean")return JSON.stringify($);if(typeof $==="number"){if(!Number.isFinite($))D$();return JSON.stringify($)}if(typeof $!=="object")D$();if(Z.has($))D$();Z.add($);try{if(Array.isArray($)){if(Object.getPrototypeOf($)!==Array.prototype)D$();let X=I9($),Y=X.get("length");if(X.size!==Y+1)D$();let G=[];for(let z=0;z<Y;z++){let Q=String(z);if(!X.has(Q))D$();G.push(w5(X.get(Q),Z))}return`[${G.join(",")}]`}if(!QZ($))D$();let J=I9($);return`{${[...J.keys()].sort().map((X)=>`${JSON.stringify(X)}:${w5(J.get(X),Z)}`).join(",")}}`}finally{Z.delete($)}}function l$($,Z){try{if($!=="opencode"&&$!=="pi")D$();if(Z===void 0)return Object.freeze({kind:"absent",digest:"absent"});if(!QZ(Z))D$();let J=I9(Z);if(!J.has("anthropic"))return Object.freeze({kind:"absent",digest:"absent"});let X=J.get("anthropic");if(!QZ(X))D$();let Y=I9(X),G=w5(X),z,Q=Y.get("type");if(Q==="oauth"){if(typeof Y.get("access")!=="string"||typeof Y.get("refresh")!=="string"||typeof Y.get("expires")!=="number"||!Number.isFinite(Y.get("expires")))D$();let K=W0("anthropic");z=Y.size===4&&Object.entries(K).every(([W,V])=>Y.get(W)===V)?"activation":"oauth"}else if($==="opencode"&&Q==="api"){if(typeof Y.get("key")!=="string")D$();z="api"}else if($==="pi"&&Q==="api_key"){if(Y.has("key")&&typeof Y.get("key")!=="string")D$();if(Y.has("env")){let K=Y.get("env");if(!QZ(K))D$();for(let W of I9(K).values())if(typeof W!=="string")D$()}z="api_key"}else D$();if(z!=="activation")for(let K of["access","refresh","key"]){let W=Y.get(K);if(typeof W==="string"&&W.startsWith("claustrum-tombstone:"))D$()}return Object.freeze({kind:z,digest:_x("sha256").update(G,"utf8").digest("hex")})}catch{throw new L6("invalid-source")}}class VJ extends Error{code="prepared-proof-refused";constructor(){super("Native migration prepared proof is unavailable or changed");this.name="NativeMigrationProofError"}}function K$(){throw new VJ}function BJ($){if(!$||typeof $!=="object"||Array.isArray($)||WJ.isProxy($))K$();let Z=Object.getPrototypeOf($);if(Z!==Object.prototype&&Z!==null)K$();for(let J of Reflect.ownKeys($)){if(typeof J!=="string")K$();let X=Object.getOwnPropertyDescriptor($,J);if(!X||!Object.hasOwn(X,"value"))K$()}}function l6($){let Z=new Set;function J(X){if(X===null||typeof X==="string"||typeof X==="boolean")return X;if(typeof X==="number"&&Number.isFinite(X))return X;if(typeof X!=="object"||WJ.isProxy(X)||Z.has(X))K$();let Y=Object.getPrototypeOf(X);if(Y!==(Array.isArray(X)?Array.prototype:Object.prototype)&&!(Y===null&&!Array.isArray(X)))K$();Z.add(X);try{let G=new Map;for(let Q of Reflect.ownKeys(X)){if(typeof Q!=="string")K$();let K=Object.getOwnPropertyDescriptor(X,Q);if(!K||!Object.hasOwn(K,"value"))K$();G.set(Q,K.value)}if(Array.isArray(X)){let Q=G.get("length");if(typeof Q!=="number"||G.size!==Q+1)K$();return Array.from({length:Q},(K,W)=>{if(!G.has(String(W)))K$();return J(G.get(String(W)))})}let z=Object.create(null);for(let Q of[...G.keys()].sort())z[Q]=J(G.get(Q));return z}finally{Z.delete(X)}}return J($)}function O$($){return JSON.stringify(l6($))}function A5($){return Ax("sha256").update(O$($)).digest("hex")}function R5($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function g7($,Z,J){if(!Object.hasOwn($,Z))return["absent"];if(typeof $[Z]!==J)K$();return["present",$[Z]]}function Rx($){let Z=l6($);if(!R5(Z))K$();if(Z.type==="oauth"&&typeof Z.refresh==="string"){if(Object.keys(Z).some((J)=>!["type","access","refresh","expires","lastRefreshedAt"].includes(J)))K$();return A5(["anthropic-prepared-credential-v1","oauth",g7(Z,"access","string"),Z.refresh,g7(Z,"expires","number"),g7(Z,"lastRefreshedAt","number")])}if(Z.type==="api"&&typeof Z.apiKey==="string"&&typeof Z.baseURL==="string"){if(Object.keys(Z).some((J)=>!["type","apiKey","baseURL","authHeader"].includes(J)))K$();if(Object.hasOwn(Z,"authHeader")&&Z.authHeader!=="x-api-key"&&Z.authHeader!=="authorization-bearer")K$();return A5(["anthropic-prepared-credential-v1","api",Z.apiKey,Z.baseURL,g7(Z,"authHeader","string")])}return K$()}function dQ($,Z){if(WJ.isProxy($)||!Array.isArray($)||Object.getPrototypeOf($)!==Array.prototype)K$();let J=Object.getOwnPropertyDescriptors($);if(Reflect.ownKeys(J).length!==$.length+1)K$();let X=Array.from({length:$.length},(Y,G)=>{let z=J[String(G)];if(!z||!Object.hasOwn(z,"value"))K$();let Q=z.value;if(BJ(Q),Q.stamp!=="bound"||Q.invalid||Q.torn||Q.unbound||!Q.credential||typeof Q.credentialEpoch!=="number"||!Number.isSafeInteger(Q.credentialEpoch)||Q.credentialEpoch<=0||typeof Q.id!=="string"||!Q.id||Q.identity!==void 0&&(typeof Q.identity!=="string"||!Q.identity))K$();return{id:Q.id,credentialEpoch:Q.credentialEpoch,identity:Q.identity??null,stamp:"bound",credentialDigest:Rx(Q.credential)}}).sort((Y,G)=>Y.id<G.id?-1:Y.id>G.id?1:0);if(new Set(X.map((Y)=>Y.id)).size!==X.length)K$();return{version:1,rows:X,runtimeDigest:A5(Z)}}function sQ($){let Z=l6($),J=(Y)=>typeof Y==="string"&&/^[a-f0-9]{64}$/.test(Y);if(!R5(Z)||Object.keys(Z).length!==3||Z.version!==1||!Array.isArray(Z.rows)||!J(Z.runtimeDigest))K$();let X=Z.rows.map((Y)=>{if(!R5(Y)||Object.keys(Y).length!==5||typeof Y.id!=="string"||!Y.id||typeof Y.credentialEpoch!=="number"||!Number.isSafeInteger(Y.credentialEpoch)||Y.credentialEpoch<=0||!(Y.identity===null||typeof Y.identity==="string"&&Y.identity.length>0)||Y.stamp!=="bound"||typeof Y.credentialDigest!=="string"||!J(Y.credentialDigest))K$();return{id:Y.id,credentialEpoch:Y.credentialEpoch,identity:Y.identity,stamp:"bound",credentialDigest:Y.credentialDigest}});if(new Set(X.map((Y)=>Y.id)).size!==X.length)K$();return{version:1,rows:X,runtimeDigest:Z.runtimeDigest}}function D2($,Z,J){if(!$||O$(sQ($))!==O$(dQ(Z,J)))K$()}class qJ extends Error{code="invalid-migration-source";constructor(){super("Native migration source cannot be imported safely");this.name="NativeMigrationProjectionError"}}function $$(){throw new qJ}function h8($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function v$($){if($===void 0)return Object.create(null);if(!h8($))$$();return $}function r$($){return typeof $==="string"&&$.length>0&&$.trim()===$}function aY($){if(!r$($)||["__proto__","constructor","prototype"].includes($))$$();return $}function C6($){return typeof $==="number"&&Number.isFinite($)&&$>=0?$:0}function nY($){if($===void 0)return;if(!r$($))$$();return $}function T8($,Z){return Object.fromEntries(Z.filter((J)=>Object.hasOwn($,J)).map((J)=>[J,$[J]]))}var tQ={routing:["mode"],refresh:["enabled","intervalMinutes","refreshBeforeExpiryMinutes"],quota:["enabled","checkIntervalMinutes","refreshEveryNRequests","minimumRemaining","failClosedOnUnknownQuota","showToasts"],quotaHeaderFeed:["enabled"],claudeCache:["enabled","mode"],dump:["enabled"],logging:["level"],claudeFast:["enabled"],thinkingBinding:["prefixMismatchBehavior"],costZeroing:["enabled"],cacheKeep:["enabled","always","startHour","endHour","subagents"],prime:["enabled"],relay:["enabled","url","fallbackToDirect","transport"],killswitch:["enabled","main","accounts"]};function T5($){let Z=(X)=>h8(X)&&Object.entries(X).every(([Y,G])=>["five_hour","seven_day","5h","1w","scoped"].includes(Y)&&typeof G==="number"&&Number.isFinite(G)&&G>=0&&G<=100),J={"routing.mode":["main-first","fallback-first","sticky-balanced"],"claudeCache.mode":q1,"logging.level":["debug","info","warn","error","trace"],"thinkingBinding.prefixMismatchBehavior":["account-default","error","drop_block"],"relay.transport":["http","websocket"]};for(let[X,Y]of Object.entries(tQ)){if($[X]===void 0)continue;let G=v$($[X]);for(let z of Y){if(G[z]===void 0)continue;let Q=J[`${X}.${z}`];if(Q){if(typeof G[z]!=="string"||!Q.includes(G[z]))$$();continue}if(["enabled","always","subagents","failClosedOnUnknownQuota","showToasts","fallbackToDirect"].includes(z)){if(typeof G[z]!=="boolean")$$()}else if(z==="url"){if(typeof G[z]!=="string"||!V0(G[z]))$$()}else if(z==="minimumRemaining"||z==="main"){if(!Z(G[z]))$$()}else if(z==="accounts"){if(!h8(G[z])||!Object.entries(G[z]).every(([K,W])=>r$(K)&&Z(W)))$$()}else if(typeof G[z]!=="number"||!Number.isFinite(G[z])||G[z]<0)$$()}}}function O2($){if($.type==="oauth"&&r$($.refresh)){if($.access!==void 0&&typeof $.access!=="string"||$.expires!==void 0&&(typeof $.expires!=="number"||!Number.isFinite($.expires)))$$();return{type:"oauth",refresh:$.refresh,...typeof $.access==="string"?{access:$.access}:{},...typeof $.expires==="number"?{expires:$.expires}:{}}}if($.type==="api"&&r$($.apiKey)&&typeof $.baseURL==="string"&&V0($.baseURL)){if($.authHeader!==void 0&&$.authHeader!=="authorization-bearer"&&$.authHeader!=="x-api-key")$$();return{type:"api",apiKey:$.apiKey,baseURL:$.baseURL,authHeader:$.authHeader??"authorization-bearer"}}return $$()}function oY($,Z,J){let X=T8($,["lastUsed","lastRefreshedAt","refreshErrorClearedAt","quotaErrorClearedAt","quotaErrorGeneration","prime","authLineageId","primeAuthLineageRefreshTokenFingerprint"]),Y=J?.type==="oauth"?S4(J.access??""):Z;if($.quotaToken!==void 0&&$.quotaToken===Y){if(X.quotaToken=$.quotaToken,$.quotaCheckedAt!==void 0)X.quotaCheckedAt=$.quotaCheckedAt}if(h8($.profile)&&Z!==void 0&&($.profile.providerAccountUuid===Z||$.profile.accountIdentity===Z))X.profile=T8($.profile,["tier","orgType","checkedAt","accountIdentity","providerAccountUuid","tokenFingerprint"]);for(let G of["lastRefreshError","lastQuotaRefreshError"]){let z=$[G],Q=X[G==="lastRefreshError"?"refreshErrorClearedAt":"quotaErrorClearedAt"];if(!h8(z)||typeof Q==="number"&&C6(z.checkedAt)<=Q||z.accountIdentity!==void 0&&z.accountIdentity!==Z)continue;let K=T8(z,["checkedAt","nextRetryAt","retryCount","accountIdentity","status","permanent"]);if(K.message=G==="lastRefreshError"?"Imported refresh failure":"Imported quota failure",G==="lastRefreshError"&&J?.type==="oauth"&&z.tokenHash===lQ("sha256").update(J.refresh).digest("hex"))K.credentialFingerprint=I$(J);X[G]=K}return X}function rY($,Z){if($===void 0)return;if(!M5($))return;if(Z===void 0||$.accountIdentity!==Z)return;return c6($)}function Tx($){try{BJ($);let Z=v$($.config===void 0?void 0:l6($.config)),J=v$($.state===void 0?void 0:l6($.state)),X=v$($.hostAuth===void 0?void 0:l6($.hostAuth)),Y=l$($.host,X);if(Z.version!==void 0&&Z.version!==1||J.version!==void 0&&J.version!==1)$$();let G=lQ("sha256").update(JSON.stringify([$.storageId,$.configDigest,"former-main"])).digest("hex"),z=Z.mainAccountId===void 0?`${G.slice(0,8)}-${G.slice(8,12)}-${G.slice(12,16)}-${G.slice(16,20)}-${G.slice(20,32)}`:aY(Z.mainAccountId),Q={mainAccountId:z,formerMainRowId:z};for(let[O,x]of Object.entries(tQ))if(Z[O]!==void 0)Q[O]=T8(v$(Z[O]),x);if(Z.fallbackOn!==void 0){if(!Array.isArray(Z.fallbackOn)||Z.fallbackOn.some((O)=>typeof O!=="number"||!Number.isInteger(O)))$$();Q.fallbackOn=Z.fallbackOn}let K=v$(Z.claustrum),W=K.primaryAccount,V;if(W!==void 0){let O=v$(W);if(!r$(O.credentialId)||!r$(O.accountId))$$();V={credentialId:O.credentialId,accountIdentity:O.accountId}}let B=K.disabledAccountIdentities??[];if(!Array.isArray(B)||B.some((O)=>!r$(O)))$$();let j=[];for(let O of B){if(!r$(O))$$();j.push(O)}if(K.mode==="claustrum"&&!V)$$();Q.claustrum={mode:V?"claustrum":"local",...W?{primaryAccount:W}:{},disabledAccountIdentities:B};let H=[],q=[],N={...v$(Z.main),...v$(J.main)};if(V||Y.kind==="oauth"){let O;if(!V){let _=v$(X.anthropic);O=Y.kind==="oauth"?O2(_):O2({type:"api",apiKey:_.key,baseURL:"https://api.anthropic.com",authHeader:"x-api-key"})}let x=V?.accountIdentity??(h8(N.profile)&&O?.type==="oauth"&&(N.profileToken===S4(O.access??"")||N.profile.tokenFingerprint===S4(O.access??""))?nY(N.profile.providerAccountUuid):void 0),C=v$(Z.quota),v=v$(Z.refresh),k=v$(Z.prime),m={...T8(v,[]),...N};for(let[_,S]of Object.entries({lastRefreshError:"mainLastRefreshError",refreshErrorClearedAt:"mainRefreshErrorClearedAt"}))if(!Object.hasOwn(m,_)&&v[S]!==void 0)m[_]=v[S];for(let[_,S]of Object.entries({lastQuotaRefreshError:"mainLastQuotaApiError",quotaErrorClearedAt:"mainQuotaErrorClearedAt",quotaErrorGeneration:"mainQuotaErrorGeneration"}))if(!Object.hasOwn(m,_)&&C[S]!==void 0)m[_]=C[S];if(N.lastQuotaApiError!==void 0)m.lastQuotaRefreshError=N.lastQuotaApiError;if(m.authLineageId=N.primeAuthLineageId??k.mainAuthLineageId,m.primeAuthLineageRefreshTokenFingerprint=N.primeAuthLineageRefreshTokenFingerprint??k.mainAuthLineageRefreshTokenFingerprint,m.prime===void 0&&k.main!==void 0)m.prime=k.main;let l={id:z,enabled:!0,runtime:oY(m,x,O),...x!==void 0?{identity:x}:{},...O?{credential:O}:{}},P=N.quota??C.mainQuota,M=N.quotaToken??C.mainQuotaToken;if(V||O?.type==="oauth"&&M===S4(O.access??""))l.quota=rY(P,x);H.push(l)}if(Z.accounts!==void 0&&!Array.isArray(Z.accounts))$$();let U=v$(J.accounts);for(let O of Array.isArray(Z.accounts)?Z.accounts:[]){let x=v$(O),C=aY(x.id);if(x.enabled!==void 0&&typeof x.enabled!=="boolean")$$();let v=T8(v$(U[C]),["access","refresh","expires","apiKey","lastUsed","lastRefreshedAt","anthropicAccountUuid","claustrumScopedCredentialId","claustrumScopedState","authLineageId","lastRefreshError","lastQuotaRefreshError","quota","profile","prime","refreshErrorClearedAt","quotaErrorClearedAt","quotaErrorGeneration"]),k=x.claustrumScopedCredentialId!==void 0,m=k&&v.claustrumScopedCredentialId===x.claustrumScopedCredentialId&&v.anthropicAccountUuid===x.anthropicAccountUuid,l=Math.max(C6(x.lastRefreshedAt),C6(x.lastUsed),C6(x.addedAt)),P=Math.max(C6(v.lastRefreshedAt),C6(v.lastUsed),C6(v.addedAt)),M=["access","refresh","apiKey"].some((T)=>x[T]!==void 0&&v[T]!==void 0&&x[T]!==v[T]),_=M&&l>P;if(M&&l===P)$$();let S=k?{...m?v:{},...x}:_?{...v,...x}:{...x,...v};if(_)delete S.quota,delete S.lastRefreshError,delete S.lastQuotaRefreshError;let I=nY(x.anthropicAccountUuid??S.anthropicAccountUuid);if(x.anthropicAccountUuid!==void 0&&v.anthropicAccountUuid!==void 0&&x.anthropicAccountUuid!==v.anthropicAccountUuid)$$();if(V&&x.type==="oauth"&&!k)$$();let F=k?void 0:O2(S);if(k){if(x.type!=="oauth"||!r$(x.claustrumScopedCredentialId)||!I||r$(x.refresh)||x.access!==void 0)$$();q.push({routeId:C,scopedCredentialId:x.claustrumScopedCredentialId,anthropicAccountUuid:I,enabled:x.enabled!==!1,...r$(x.label)?{label:x.label}:{},...typeof x.addedAt==="number"?{addedAt:x.addedAt}:{}})}let A={id:C,enabled:x.enabled!==!1,runtime:oY(S,I,F),...I!==void 0?{identity:I}:{},...r$(x.label)?{label:x.label}:{},...F?{credential:F}:{}},R=rY(S.quota,I);if(R)A.quota=R;H.push(A)}if(new Set(H.map((O)=>O.id)).size!==H.length)$$();let L=new Set,D=new Set;for(let O of H){if(O.enabled&&O.identity){if(L.has(O.identity))$$();L.add(O.identity)}if(O.credential){let x=I$(O.credential);if(D.has(x))$$();D.add(x),Object.defineProperty(O,"credential",{enumerable:!1})}for(let x of Object.keys(O.runtime))if(O.runtime[x]===void 0)delete O.runtime[x];if(O.quota===void 0)delete O.quota}T5(Q);let w=v$(Z.relay);return{accounts:H,settings:Q,mainRouteId:z,custodyRows:q,disabledAccountIdentities:j,...V?{custodyPrimary:V}:{},...typeof w.token==="string"?{relay:{token:w.token}}:{}}}catch{return $$()}}function e8($,Z,J=!0){let X=$.accounts.filter((Y)=>Y.credential!==void 0);if(Z.length!==X.length)$$();for(let Y of X){let G=Z.find((Q)=>Q.id===Y.id);if(G?.stamp!=="bound"||G.invalid||G.torn||G.unbound||G.identity!==Y.identity||G.enabled!==Y.enabled||!G.credential)$$();let z;if(G.credential.type==="oauth"){let{lastRefreshedAt:Q,...K}=G.credential;z=K}else z=G.credential;if(O$(z)!==O$(Y.credential))$$();if(J&&O$(G.quota??null)!==O$(Y.quota??null))$$()}}function F5($,Z,J,X){let Y=Object.create(null);for(let G of Z.accounts.filter((z)=>z.credential)){let z=J.find((Q)=>Q.id===G.id);if(z?.stamp!=="bound"||z.credentialEpoch===void 0)$$();Y[G.id]={binding:{kind:"local",storageId:$.storageId,rowId:z.id,credentialEpoch:z.credentialEpoch,...z.identity!==void 0?{identity:z.identity}:{}},...G.runtime}}if(X)for(let G of Z.accounts.filter((z)=>!z.credential)){let z=X.rows.find((Q)=>Q.routeId===G.id);if(!z?.accountIdentity||z.accountIdentity!==G.identity)$$();Y[G.id]={binding:{kind:"custody",storageId:$.storageId,routeId:z.routeId,credentialId:z.credentialId,accountIdentity:z.accountIdentity,recordVersion:0},...G.runtime,...G.quota?{quota:G.quota}:{}}}return jJ({version:1,storageId:$.storageId,accounts:Y,...Z.relay?{relay:Z.relay}:{}},$.storageId)}function u6($){return $!==null&&typeof $==="object"&&!Array.isArray($)}async function C5($){try{return JSON.parse(await Px($,"utf8"))}catch{return}}async function KZ($){try{return await Mx($),!1}catch(Z){if(Z instanceof Error&&"code"in Z&&Z.code==="ENOENT")return!0;throw Z}}var Fx={routing:["mode"],claudeCache:["enabled","mode"],cacheKeep:["enabled","always","startHour","endHour","subagents"],quota:["enabled","checkIntervalMinutes","minimumRemaining","failClosedOnUnknownQuota"],killswitch:["enabled","main"],claudeFast:["enabled"],prime:["enabled"],logging:["level"],dump:["enabled"]};async function Cx($){let Z=await C5($),J={};if(!u6(Z)||Z.version!==void 0&&Z.version!==1)return J;for(let[X,Y]of Object.entries(Fx)){let G=Z[X];if(!u6(G))continue;let z={};for(let Q of Y){let K=G[Q];if(K===void 0)continue;if((Q==="minimumRemaining"||X==="killswitch"&&Q==="main")&&u6(K)){let W={};for(let V of["five_hour","seven_day","5h","1w","scoped"]){if(K[V]===void 0)continue;try{T5({[X]:{[Q]:{[V]:K[V]}}}),W[V]=K[V]}catch{}}if(Object.keys(W).length)z[Q]=W;continue}try{T5({[X]:{[Q]:K}}),z[Q]=K}catch{}}if(Object.keys(z).length)J[X]=z}if(Array.isArray(Z.fallbackOn))J.fallbackOn=Z.fallbackOn.filter((X)=>typeof X==="number"&&Number.isInteger(X));return J}function I2($){return typeof $==="string"&&/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test($)}function Sx($,Z){let J=new Map;if(!u6($)||$.version!==void 0&&$.version!==1)return J;let X=new Map,Y=new Set;for(let W of Z.rows){if(W.credentialType!=="oauth"||W.state!=="active"||W.stale||W.unclaimed||!I2(W.accountIdentity))continue;if(X.has(W.accountIdentity))Y.add(W.accountIdentity);X.set(W.accountIdentity,W.routeId)}function G(W,V){if(typeof W!=="string"||!I2(V)||Y.has(V))return;let B=X.get(V);if(B)J.set(W,{routeId:B,accountIdentity:V})}let z=u6($.claustrum)?$.claustrum:void 0,Q=u6(z?.primaryAccount)?z.primaryAccount:void 0,K=I2(Q?.accountId)?Q.accountId:$.mainAccountId;G("main",K),G($.mainAccountId,K);for(let W of Array.isArray($.accounts)?$.accounts:[])if(u6(W)&&W.type==="oauth")G(W.id,W.anthropicAccountUuid);return J}function G7($){return[{path:$.config,name:"pool-config"},{path:$.state,name:"pool-state"}]}function U6($){let Z=aN({provider:"anthropic",configPath:$.paths.config,statePath:$.paths.state,storeLocks:G7($.paths),requireCredentialStamps:!0,quota:$.quota,now:$.now,onStep:$.onStep,hold:$.hold,logger:$.logger,onLockEvent:cQ($.onLockEvent),onLockStep:$.onLockStep}),J=$.paths.legacySeedConfig;if(!J)return Z;return{...Z,updateSettings:(X,Y)=>Z.updateSettings(async(G)=>{if(await KZ($.paths.config))Object.assign(G,await Cx(J));return X(G)},Y)}}class b extends Error{code;constructor($){super({"invalid-runtime":"Anthropic runtime state is invalid","unsafe-runtime":"Anthropic runtime file is not owner-only regular storage","runtime-io":"Anthropic runtime storage is unavailable","runtime-conflict":"Anthropic runtime observation is older than persisted state","publication-refused":"Anthropic runtime publication was refused"}[$]);this.code=$,this.name="NativeRuntimeError"}}function P$($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function V4($,Z,J=[]){return Z.every((X)=>Object.hasOwn($,X))&&Object.keys($).every((X)=>Z.includes(X)||J.includes(X))}function Z4($){return typeof $==="string"&&$.length>0&&$.trim()===$}function d4($){return typeof $==="number"&&Number.isFinite($)&&$>=0}function _$($){return d4($)&&Number.isSafeInteger($)}function z$($,Z,J){return!Object.hasOwn($,Z)||J($[Z])}function s4($){return typeof $==="string"&&/^[a-f0-9]{64}$/.test($)}function g8($){return typeof $==="string"&&/^[a-f0-9]{16}$/.test($)}function aQ($){return typeof $==="string"&&/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test($)}function kx($){return x$($)||P$($)&&V4($,["kind","storageId","routeId","credentialId","accountIdentity","recordVersion"])&&$.kind==="custody"&&s4($.storageId)&&Z4($.routeId)&&Z4($.credentialId)&&Z4($.accountIdentity)&&_$($.recordVersion)}function M9($,Z=[]){return P$($)&&V4($,["message","checkedAt"],["nextRetryAt","retryCount","accountIdentity","tokenHash","refreshTokenFingerprint","status","permanent",...Z])&&typeof $.message==="string"&&d4($.checkedAt)&&z$($,"nextRetryAt",d4)&&z$($,"retryCount",_$)&&z$($,"accountIdentity",Z4)&&z$($,"tokenHash",s4)&&z$($,"refreshTokenFingerprint",g8)&&z$($,"status",(J)=>_$(J)&&J>=100&&J<=599)&&z$($,"permanent",(J)=>typeof J==="boolean")}function S5($){return M9($,["credentialFingerprint"])&&P$($)&&z$($,"credentialFingerprint",s4)}function vx($,Z){return P$($)&&V4($,["subject","checkedAt","nextRetryAt"])&&Z.kind==="local"&&Z.identity!==void 0&&r6($.subject)&&$.subject.binding.storageId===Z.storageId&&$.subject.binding.rowId===Z.rowId&&$.subject.binding.credentialEpoch===Z.credentialEpoch&&$.subject.binding.identity===Z.identity&&_$($.checkedAt)&&_$($.nextRetryAt)&&$.nextRetryAt>=$.checkedAt}function fx($){return P$($)&&V4($,["tier","orgType","checkedAt"],["accountIdentity","providerAccountUuid","tokenFingerprint"])&&Z4($.tier)&&Z4($.orgType)&&d4($.checkedAt)&&z$($,"accountIdentity",Z4)&&z$($,"providerAccountUuid",Z4)&&z$($,"tokenFingerprint",g8)}function Ex($){return P$($)&&V4($,["count","inputTokens","outputTokens","since"])&&_$($.count)&&_$($.inputTokens)&&_$($.outputTokens)&&d4($.since)}var bx=["credentialValidation","validationRetry","lastUsed","lastRefreshedAt","lastRefreshError","refreshErrorClearedAt","refreshLeaseId","refreshLeaseUntil","refreshLeaseTokenHash","lastQuotaRefreshError","quotaErrorGeneration","quotaErrorClearedAt","quota","quotaCheckedAt","quotaToken","profile","profileToken","prime","authLineageId","primeAuthLineageRefreshTokenFingerprint"];function hx($,Z,J){if(!P$($)||!V4($,["binding"],bx)||!kx($.binding)||$.binding.storageId!==J||($.binding.kind==="local"?$.binding.rowId:$.binding.routeId)!==Z)return!1;let X=$.binding;if(!z$($,"validationRetry",(z)=>vx(z,X)))return!1;if(Object.hasOwn($,"credentialValidation")){let z=$.credentialValidation;if(X.kind!=="local"||X.identity===void 0||!r6(z)||z.binding.storageId!==X.storageId||z.binding.rowId!==X.rowId||z.binding.credentialEpoch!==X.credentialEpoch||z.binding.identity!==X.identity)return!1}for(let z of["lastUsed","lastRefreshedAt","refreshErrorClearedAt","refreshLeaseUntil","quotaErrorClearedAt","quotaCheckedAt"])if(!z$($,z,d4))return!1;for(let z of["refreshLeaseId","authLineageId"])if(!z$($,z,Z4))return!1;if(Object.hasOwn($,"profileToken")||!z$($,"refreshLeaseTokenHash",s4)||!z$($,"primeAuthLineageRefreshTokenFingerprint",g8)||!z$($,"quotaToken",(z)=>X.kind==="local"?g8(z):aQ(z)&&z===X.accountIdentity)||!z$($,"quotaErrorGeneration",_$)||!z$($,"profile",fx)||!z$($,"prime",Ex)||!z$($,"lastRefreshError",X.kind==="local"?S5:M9)||!z$($,"lastQuotaRefreshError",M9))return!1;let Y=$.binding.kind==="local"?$.binding.identity:$.binding.accountIdentity;for(let z of[$.profile,$.lastRefreshError,$.lastQuotaRefreshError])if(P$(z)&&(z.accountIdentity!==void 0&&z.accountIdentity!==Y||z.providerAccountUuid!==void 0&&z.providerAccountUuid!==Y))return!1;if(Object.hasOwn($,"quota")){if($.binding.kind!=="custody")return!1;try{if(H6($.quota).accountIdentity!==Y)return!1}catch{return!1}}let G=[["lastRefreshError","refreshErrorClearedAt"],["lastQuotaRefreshError","quotaErrorClearedAt"]];for(let[z,Q]of G){let K=$[z],W=$[Q];if((z==="lastRefreshError"&&X.kind==="local"?S5:M9)(K)&&d4(W)&&K.checkedAt<=W)return!1}return!0}function jJ($,Z){if(!P$($)||!V4($,["version","storageId","accounts"],["relay"])||$.version!==1||!s4(Z)||$.storageId!==Z||!P$($.accounts)||!z$($,"relay",(X)=>P$(X)&&V4(X,["token"])&&typeof X.token==="string"))throw new b("invalid-runtime");let J=Object.create(null);for(let[X,Y]of Object.entries($.accounts)){if(!Z4(X)||!hx(Y,X,Z))throw new b("invalid-runtime");J[X]=structuredClone(Y)}return{version:1,storageId:Z,accounts:J,...P$($.relay)&&typeof $.relay.token==="string"?{relay:{token:$.relay.token}}:{}}}function gx($){return $ instanceof Error&&"code"in $&&$.code==="ENOENT"}function nQ($){if(!Nx($))throw new b("unsafe-runtime")}async function p4($,Z){if(nQ($),!s4(Z))throw new b("invalid-runtime");let J=lY.O_NOFOLLOW??0;try{for(let X=0;X<2;X++){let Y=await qx($);if(!Y.isFile()||(Y.mode&511)!==384||typeof process.geteuid==="function"&&Y.uid!==process.geteuid())throw new b("unsafe-runtime");let G=await mQ($,lY.O_RDONLY|J);try{let z=await G.stat();if(!z.isFile()||(z.mode&511)!==384||typeof process.geteuid==="function"&&z.uid!==process.geteuid())throw new b("unsafe-runtime");if(!J&&(z.dev!==Y.dev||z.ino!==Y.ino)){if(X===0)continue;throw new b("unsafe-runtime")}let Q;try{Q=new TextDecoder("utf-8",{fatal:!0}).decode(await G.readFile())}catch(K){if(K instanceof TypeError)throw new b("invalid-runtime");throw K}return{status:"ready",state:jJ(I6(Q),Z)}}finally{await G.close()}}throw new b("unsafe-runtime")}catch(X){if(gx(X))return{status:"missing"};if(X instanceof b)throw X;if(X instanceof SyntaxError)throw new b("invalid-runtime");throw new b("runtime-io")}}function K4($,Z){return $.storageId===Z.storageId&&$.rowId===Z.rowId&&$.credentialEpoch===Z.credentialEpoch&&$.identity===Z.identity}function yx($,Z,J){let X=!1;for(let[Y,G]of Object.entries(Z.accounts)){let z=$.accounts[Y];if(!z)continue;if(z.binding.kind!==G.binding.kind)continue;if(z.binding.kind==="local"&&G.binding.kind==="local"){if(G.binding.credentialEpoch<z.binding.credentialEpoch)throw new b("runtime-conflict");if(G.binding.credentialEpoch>z.binding.credentialEpoch)continue;if(z.binding.identity!==G.binding.identity){if(!J||X||Y!==J.predecessor.rowId||z.binding.identity!==void 0||!K4(z.binding,J.predecessor)||!K4(G.binding,J.proof.binding))throw new b("runtime-conflict");X=!0}}else if(z.binding.kind==="custody"&&G.binding.kind==="custody"){if(z.binding.credentialId!==G.binding.credentialId||z.binding.accountIdentity!==G.binding.accountIdentity)continue;if(G.binding.recordVersion<z.binding.recordVersion)throw new b("runtime-conflict")}let Q=["quotaErrorGeneration","quotaErrorClearedAt","refreshErrorClearedAt"];for(let K of Q){let W=z[K],V=G[K];if(W!==void 0&&(V===void 0||V<W))throw new b("runtime-conflict")}if(z.profile&&G.profile&&G.profile.checkedAt<z.profile.checkedAt)throw new b("runtime-conflict");if(z.quota&&G.quota&&Q4(H6(G.quota))<Q4(H6(z.quota)))throw new b("runtime-conflict");for(let[K,W]of[["lastRefreshError","refreshErrorClearedAt"],["lastQuotaRefreshError","quotaErrorClearedAt"]]){let V=z[K],B=G[K],j=G[W],H=K==="lastRefreshError"&&G.binding.kind==="local"?S5:M9;if(H(V)&&(!H(B)?!d4(j)||j<V.checkedAt:B.checkedAt<V.checkedAt))throw new b("runtime-conflict")}}if(J&&!X)throw new b("publication-refused")}async function k5($,Z,J,X={}){return oQ($,Z,J,X)}async function ux($,Z,J,X){return rQ($,Z,J,{beforeRename:X.beforeRename})}async function oQ($,Z,J,X,Y){let G=await rQ($,Z,J,{beforeRename:async()=>{return await X.beforeRename?.(),"publish"},beforePublish:X.beforePublish,afterRename:X.afterRename},Y);if(G.status!=="published")throw new b("publication-refused");return G.state}async function rQ($,Z,J,X,Y){nQ($);try{return await jx(iY($),{recursive:!0,mode:448}),await d$($,{name:"native-runtime",ttlMs:1e4,timeoutMs:15000,renew:!0},async(G)=>{let z=await p4($,Z),Q=z.status==="ready"?z.state:{version:1,storageId:Z,accounts:{}},K=jJ(await J(structuredClone(Q)),Z);yx(Q,K,Y);let W=`${JSON.stringify(K,null,2)}
+`,V=xx(iY($),`${Ux($)}.native-runtime.${Bx()}.partial`),B=!1;try{let j=await mQ(V,"wx",384);B=!0;try{await j.writeFile(W,"utf8"),await j.sync()}finally{await j.close()}let H;try{H=await X.beforeRename()}catch{throw new b("publication-refused")}try{await G.assertOwned()}catch{throw new b("publication-refused")}if(H==="skip")return{status:"skipped"};try{await X.beforePublish?.()}catch{throw new b("publication-refused")}await Hx(V,$),B=!1;try{await X.afterRename?.()}catch{throw new b("publication-refused")}return{status:"published",state:K}}finally{if(B)await Lx(V,{force:!0})}})}catch(G){if(G instanceof b)throw G;throw new b("runtime-io")}}function i6($){return P$($)&&V4($,[],["accessFingerprint","expires","lastRefreshedAt"])&&z$($,"accessFingerprint",(Z)=>Z===void 0||g8(Z))&&z$($,"expires",(Z)=>Z===void 0||_$(Z))&&z$($,"lastRefreshedAt",_$)}function b9($,Z){return["accessFingerprint","expires","lastRefreshedAt"].every((J)=>Object.hasOwn($,J)===Object.hasOwn(Z,J)&&$[J]===Z[J])}function eQ($,Z){let J=()=>new b("publication-refused"),X=structuredClone(Z),Y=X.context;if(!["persisted","validation-observed"].includes(X.status)||X.bootstrap!=="resolved"||!("identity"in X)||!aQ(X.identity)||!x$(X.binding)||X.binding.storageId!==$.storageId||X.binding.identity!==void 0&&X.binding.identity!==X.identity||!s4(X.credentialFingerprint)||!i6(X.credentialVersion)||!Y||!P$(Y.subject)||!x$(Y.subject.binding)||!K4(Y.subject.binding,X.binding)||Y.subject.credentialFingerprint!==X.credentialFingerprint||!i6(Y.subject.version)||!b9(Y.subject.version,X.credentialVersion)||![Y.refreshErrorClearedAt,Y.quotaErrorClearedAt,Y.quotaErrorGeneration].every((Q)=>Q===null||_$(Q)))throw J();let G={...X.binding,identity:X.identity},z;if(X.status==="persisted"){if(z={binding:G,credentialFingerprint:X.successorFingerprint,version:X.successorVersion},!r6(z)||!P$(X.committed)||!V4(X.committed,["credentialFingerprint","version"])||X.committed.credentialFingerprint!==z.credentialFingerprint||!i6(X.committed.version)||!b9(X.committed.version,{...z.version}))throw J()}else if(X.status==="validation-observed"){if(X.binding.identity!==X.identity)throw J();z={binding:G,credentialFingerprint:X.credentialFingerprint,version:X.credentialVersion}}if(!r6(z))throw J();return{context:Y,proof:z}}function mx($,Z){let J=eQ($,Z),X=J.context.runtimeBinding;if(!x$(X)||X.identity!==void 0||!K4(X,{...J.proof.binding,identity:void 0}))throw new b("publication-refused");return{...J,predecessor:X}}function HJ($,Z){return($?.refreshErrorClearedAt??null)===Z.refreshErrorClearedAt&&($?.quotaErrorClearedAt??null)===Z.quotaErrorClearedAt&&($?.quotaErrorGeneration??null)===Z.quotaErrorGeneration}function px($,Z){let{predecessor:J,context:X,proof:Y}=Z;if($?.binding.kind!=="local"||!K4($.binding,J)||!HJ($,X))throw new b("publication-refused");let G=(K,W)=>{let V=K===void 0?W?.checkedAt:Math.max(K,W?.checkedAt??K);if(V!==void 0&&!_$(V))throw new b("publication-refused");return V},z=G($.refreshErrorClearedAt,$.lastRefreshError),Q=G($.quotaErrorClearedAt,$.lastQuotaRefreshError);return{binding:Y.binding,credentialValidation:Y,...z!==void 0?{refreshErrorClearedAt:z}:{},...Q!==void 0?{quotaErrorClearedAt:Q}:{},...$.quotaErrorGeneration!==void 0?{quotaErrorGeneration:$.quotaErrorGeneration}:{}}}async function cx($,Z,J={}){try{$={...$};let X=mx($,Z);return await LJ($,X.proof,(Y)=>y6(X.proof,X.proof.binding,Y),(Y)=>px(Y,X),X,void 0,J)}catch(X){if(X instanceof b)throw X;throw new b("publication-refused")}}function lx($,Z){let{context:J,proof:X}=Z;if(!HJ($,J))throw new b("publication-refused");if(!$){if(J.runtimeBinding!==null)throw new b("publication-refused");return{binding:X.binding,credentialValidation:X}}if($.binding.kind!=="local"||!x$(J.runtimeBinding)||!K4($.binding,J.runtimeBinding)||!K4($.binding,X.binding))throw new b("publication-refused");return{...$,credentialValidation:X}}async function ix($,Z,J={}){try{$={...$};let X=eQ($,Z),{context:Y,proof:G}=X;if(Y.subject.binding.identity!==G.binding.identity||Y.runtimeBinding!==null&&(!x$(Y.runtimeBinding)||!K4(Y.runtimeBinding,G.binding)))throw new b("publication-refused");return await LJ($,G,(z)=>y6(G,G.binding,z),(z)=>lx(z,X),void 0,void 0,J)}catch(X){if(X instanceof b)throw X;throw new b("publication-refused")}}function dx($){return i6($)&&g8($.accessFingerprint)&&_$($.expires)&&$.expires>0}function WZ($){let Z=new WeakSet,J=(X,Y)=>{if(X===null||X===void 0||["string","number","boolean"].includes(typeof X))return X;if(typeof X!=="object"||Dx.isProxy(X)||Y>32||Z.has(X))throw new b("publication-refused");let G=Object.getPrototypeOf(X);if(G!==Object.prototype&&G!==null)throw new b("publication-refused");Z.add(X);try{let z=Object.getOwnPropertyDescriptors(X),Q=Object.create(null);for(let K of Reflect.ownKeys(z)){if(typeof K!=="string")throw new b("publication-refused");let W=z[K];if(!W||!Object.hasOwn(W,"value"))throw new b("publication-refused");Object.defineProperty(Q,K,{value:J(W.value,Y+1),enumerable:!0,writable:!0,configurable:!0})}return Q}finally{Z.delete(X)}};try{return J($,0)}catch{throw new b("publication-refused")}}function $K($){try{return sx(WZ($))}catch{throw new b("publication-refused")}}function sx($){if($.status!=="failed"&&$.status!=="persisted")return{kind:"none",reason:"not-a-failure"};if($.context===void 0)return{kind:"none",reason:"no-context"};if(!P$($.context))throw new b("publication-refused");if($.status==="failed"&&(!P$($.failure)||!V4($.failure,["kind","classification"],["status","retryAfter"])||!Z4($.failure.kind)||!["transient","invalid-grant","permanent"].includes($.failure.classification)||$.failure.status!==void 0&&(!_$($.failure.status)||$.failure.status<100||$.failure.status>599)||$.failure.retryAfter!==void 0&&!d4($.failure.retryAfter)||typeof $.persisted!=="boolean"))throw new b("publication-refused");if($.status==="failed"&&$.persisted&&!$.committed)return{kind:"none",reason:"missing-committed"};if($.bootstrap==="resolved"||$.status==="failed"&&($.failure.kind==="caller-hook"||!$.persisted&&!["provider","validation"].includes($.failure.kind)))return{kind:"none",reason:"not-attributable"};let Z=$.context;if(!x$($.binding)||!s4($.credentialFingerprint)||!i6($.credentialVersion)||!P$(Z.subject)||!x$(Z.subject.binding)||!K4(Z.subject.binding,$.binding)||Z.subject.credentialFingerprint!==$.credentialFingerprint||!i6(Z.subject.version)||!b9(Z.subject.version,$.credentialVersion)||Z.runtimeBinding!==null&&!x$(Z.runtimeBinding)||![Z.refreshErrorClearedAt,Z.quotaErrorClearedAt,Z.quotaErrorGeneration].every((K)=>K===null||_$(K)))throw new b("publication-refused");let J=$.status==="persisted"||$.persisted,X=$.committed;if(J&&(!P$(X)||!V4(X,["credentialFingerprint","version"])||!s4(X.credentialFingerprint)||!dx(X.version)))throw new b("publication-refused");if($.status==="persisted"&&(!i6($.successorVersion)||$.successorFingerprint!==X?.credentialFingerprint||!b9($.successorVersion,{...X?.version})))throw new b("publication-refused");if($.status==="failed"&&!J&&$.committed!==void 0)throw new b("publication-refused");let Y=J?X:{credentialFingerprint:$.credentialFingerprint,version:$.credentialVersion};if(!Y)throw new b("publication-refused");let G={binding:{...$.binding},credentialFingerprint:Y.credentialFingerprint,version:{...Y.version}},z=J?"committed":"captured";if(J&&$.bootstrap==="unsupported-credential")return{kind:"unsupported-successor",target:"committed",subject:G};if(J&&G.binding.identity!==void 0||$.status==="failed"&&$.failure.kind==="validation"){if(!r6(G))throw new b("publication-refused");return{kind:"validation-retry",target:z,subject:G}}if(J)return{kind:"refresh-error",target:z,subject:G,permanent:!1,message:"Local account-check recovery required"};if($.status!=="failed")throw new b("publication-refused");let Q=$.failure.status;if(Q!==void 0&&(!Number.isInteger(Q)||Q<100||Q>599))throw new b("publication-refused");return{kind:"refresh-error",target:z,subject:G,permanent:$.failure.classification==="invalid-grant"&&Q===400,message:"Local refresh failed",...Q!==void 0?{status:Q}:{}}}function tx($,Z){if(Z?.type!=="oauth"||!Z4(Z.refresh))return!1;let J=$.version;return $.credentialFingerprint===I$({type:"oauth",refresh:Z.refresh})&&(J.accessFingerprint===void 0?!Object.hasOwn(Z,"access"):Z4(Z.access)&&J.accessFingerprint===S4(Z.access))&&(J.expires===void 0?!Object.hasOwn(Z,"expires"):J.expires===Z.expires)&&Object.hasOwn(J,"lastRefreshedAt")===Object.hasOwn(Z,"lastRefreshedAt")&&J.lastRefreshedAt===Z.lastRefreshedAt}async function ax($,Z,J,X={}){let Y,G=(z)=>{throw Y=z,new b("publication-refused")};try{$=WZ($);let z=WZ(Z);J=WZ(J);let Q=$K(z);if(Q.kind==="none")return{status:"skipped",reason:Q.reason};let{subject:K}=Q,W=z.context;if(!W||K.binding.storageId!==$.storageId||!_$(J.checkedAt)||J.nextRetryAt!==void 0&&(!_$(J.nextRetryAt)||J.nextRetryAt<J.checkedAt)||J.retryCount!==void 0&&!_$(J.retryCount)||(Q.kind==="validation-retry"||Q.kind==="refresh-error"&&!Q.permanent)&&J.nextRetryAt===void 0)throw new b("publication-refused");let V=await LJ($,K,(B)=>tx(K,B),(B)=>{if(!B&&W.runtimeBinding!==null||B&&(B.binding.kind!=="local"||!x$(W.runtimeBinding)||!K4(B.binding,W.runtimeBinding)||!K4(B.binding,K.binding)))G("entry-binding");if(!HJ(B,W))G("reset-context");if(B?.refreshErrorClearedAt!==void 0&&J.checkedAt<=B.refreshErrorClearedAt)throw new b("publication-refused");let j=B?{...B}:{binding:K.binding};if(Q.kind==="unsupported-successor"){let H=!1;if(j.lastRefreshError&&j.lastRefreshError.checkedAt<=J.checkedAt)delete j.lastRefreshError,H=!0;if(j.validationRetry&&j.validationRetry.checkedAt<=J.checkedAt)delete j.validationRetry,H=!0;if(H)j.refreshErrorClearedAt=Math.max(j.refreshErrorClearedAt??0,J.checkedAt)}else if(Q.kind==="validation-retry"){let H=J.nextRetryAt;if(H===void 0)throw new b("publication-refused");let q=(N)=>K4(N.binding,K.binding)&&N.credentialFingerprint===K.credentialFingerprint&&b9({...N.version},{...K.version});if(B?.credentialValidation&&q(B.credentialValidation))G("already-proven");if(B?.validationRetry&&q(B.validationRetry.subject)&&(B.validationRetry.checkedAt>J.checkedAt||B.validationRetry.checkedAt===J.checkedAt&&B.validationRetry.nextRetryAt!==J.nextRetryAt))G("older-than-stored");j.validationRetry={subject:Q.subject,checkedAt:J.checkedAt,nextRetryAt:H}}else{if(B?.lastRefreshError&&J.checkedAt<B.lastRefreshError.checkedAt)G("older-than-stored");j.lastRefreshError={message:Q.message,credentialFingerprint:K.credentialFingerprint,permanent:Q.permanent,checkedAt:J.checkedAt,...K.binding.identity!==void 0?{accountIdentity:K.binding.identity}:{},...Q.status!==void 0?{status:Q.status}:{},...J.nextRetryAt!==void 0?{nextRetryAt:J.nextRetryAt}:{},...J.retryCount!==void 0?{retryCount:J.retryCount}:{}}}return j},void 0,G,X);return{status:"published",attribution:Q,state:V}}catch(z){if(Y&&z instanceof b&&z.code==="publication-refused")return{status:"superseded",reason:Y};if(z instanceof b)throw z;throw new b("publication-refused")}}async function LJ($,Z,J,X,Y,G,z={}){try{let Q=U6({paths:$,quota:l4}),[K,W]=G7($),V=async()=>{let B=await Q.read();if(B.status!=="ready")throw new b("publication-refused");let j=B.rows.find((H)=>H.id===Z.binding.rowId);if(!j||!x4(Z.binding,$,j))throw G?.("row-binding"),new b("publication-refused");if(!J(j.credential))throw G?.("row-credential"),new b("publication-refused")};return await d$(K.path,{...y$,name:K.name},async(B)=>d$(W.path,{...y$,name:W.name},async(j)=>{return await V(),oQ($.runtime,$.storageId,(H)=>{let q=Z.binding.rowId;return H.accounts[q]=X(H.accounts[q]),H},{beforeRename:async()=>{await V(),await B.assertOwned(),await j.assertOwned()},beforePublish:z.beforePublish},Y)}))}catch(Q){if(Q instanceof b)throw Q;throw new b("publication-refused")}}function aT($){let Z=$.state;if(Z===void 0||Z==="")return"";if(Z==="unsupported-access")return"unsupported credential: the saved access token is not a Claude OAuth token; sign in to this account again";return Z}function v5($){let Z=new Set;function J(X){if(X===null||typeof X==="string"||typeof X==="boolean"||X===void 0)return X;if(typeof X==="number"&&Number.isFinite(X))return X;if(!X||typeof X!=="object"||GJ.isProxy(X)||Z.has(X))throw new b("publication-refused");Z.add(X);try{if(Array.isArray(X)){if(Reflect.ownKeys(X).some((G)=>typeof G!=="string"||G!=="length"&&!/^(0|[1-9][0-9]*)$/.test(G)))throw new b("publication-refused");return Array.from({length:X.length},(G,z)=>{let Q=Object.getOwnPropertyDescriptor(X,String(z));if(!Q||!("value"in Q))throw new b("publication-refused");return J(Q.value)})}if(Object.getPrototypeOf(X)!==Object.prototype&&Object.getPrototypeOf(X)!==null)throw new b("publication-refused");let Y={};for(let G of Reflect.ownKeys(X)){let z=Object.getOwnPropertyDescriptor(X,G);if(typeof G!=="string"||!z||!("value"in z)||G==="__proto__")throw new b("publication-refused");Y[G]=J(z.value)}return Y}finally{Z.delete(X)}}return J($)}function ZK($){let Z=v5($);if(!Z||Object.keys(Z).some((J)=>!["quota","profile","lastUsed","lastQuotaRefreshError","quotaErrorClearedAt","quotaErrorGeneration","prime","authLineageId"].includes(J)))throw new b("publication-refused");return Z}function JK($,Z){let{quota:J,...X}=Z,Y={...$,...X};if(Z.lastUsed!==void 0){if(!Number.isFinite(Z.lastUsed)||Z.lastUsed<0)throw new b("publication-refused");Y.lastUsed=Math.max($.lastUsed??0,Z.lastUsed)}if(J){let G=c6(J);Y.quota=l4.merge($.quota,G),Y.quotaCheckedAt=J.checkedAt}if(Z.quotaErrorClearedAt!==void 0)Y.quotaErrorClearedAt=Math.max($.quotaErrorClearedAt??0,Z.quotaErrorClearedAt);if(Z.quotaErrorGeneration!==void 0)Y.quotaErrorGeneration=Math.max($.quotaErrorGeneration??0,Z.quotaErrorGeneration);if($.lastQuotaRefreshError&&Z.lastQuotaRefreshError&&Z.lastQuotaRefreshError.checkedAt<$.lastQuotaRefreshError.checkedAt)Y.lastQuotaRefreshError=$.lastQuotaRefreshError;if(Y.lastQuotaRefreshError&&Y.lastQuotaRefreshError.checkedAt<=(Y.quotaErrorClearedAt??-1))delete Y.lastQuotaRefreshError;return Y}function XK($,Z,J,X){let Y=Error("OAuth quota check failed");if($&&typeof $==="object"&&!GJ.isProxy($)){for(let W of["status","retryAfter"]){let V=Object.getOwnPropertyDescriptor($,W)?.value;if(typeof V==="number"&&Number.isFinite(V))Object.assign(Y,{[W]:V})}let Q=Object.getOwnPropertyDescriptor($,"code")?.value,K=Object.getOwnPropertyDescriptor($,"message")?.value;if(h4({code:typeof Q==="string"?Q:"",message:typeof K==="string"?K:""}))Object.assign(Y,{code:"ECONNRESET"})}let G=Object.getOwnPropertyDescriptor(Y,"status")?.value;if(G===401||G===403)return;return{...o2({error:Y,accountIdentity:Z,now:J,previous:X}),...typeof G==="number"&&Number.isFinite(G)?{status:G}:{}}}class YK extends Error{status;retryAfter;code;constructor($,Z,J){super(`OAuth metadata read failed${$!==void 0?`: ${$}`:""}`);this.status=$,this.retryAfter=Z,this.code=J,this.name="NativeAccountReadError"}}function GK($,Z){let J={};if($&&typeof $==="object"&&!GJ.isProxy($))for(let z of["status","retryAfter","code","message"])J[z]=Object.getOwnPropertyDescriptor($,z)?.value;let X=typeof J.status==="number"&&Number.isFinite(J.status)?J.status:void 0,Y=J.retryAfter,G=X===void 0&&h4({code:typeof J.code==="string"?J.code:"",message:typeof J.message==="string"?J.message:""})?"ECONNRESET":void 0;return new YK(Z??X,typeof Y==="number"&&Number.isFinite(Y)?Y:void 0,G)}var y7="oauth:anthropic";function tZ($){let J=$.claustrum?.primaryAccount;if(typeof $.mainAccountId!=="string"||!$.mainAccountId||typeof J?.credentialId!=="string"||!J.credentialId||typeof J.accountId!=="string"||!J.accountId)return;return{routeId:$.mainAccountId,credentialId:J.credentialId,accountIdentity:J.accountId}}function f5($,Z){if(!Z)return;return $?.rows.find((J)=>J.routeId===Z.routeId&&J.accountIdentity===Z.accountIdentity&&(J.credentialId===Z.credentialId||J.aliases?.includes(Z.credentialId)))}var nx={routing:["mode"],refresh:["enabled","intervalMinutes","refreshBeforeExpiryMinutes"],quota:["enabled","checkIntervalMinutes","refreshEveryNRequests","minimumRemaining","failClosedOnUnknownQuota","showToasts"],quotaHeaderFeed:["enabled"],claudeCache:["enabled","mode"],dump:["enabled"],logging:["level"],claudeFast:["enabled"],thinkingBinding:["prefixMismatchBehavior"],costZeroing:["enabled"],cacheKeep:["enabled","always","startHour","endHour","subagents"],prime:["enabled"],relay:["enabled","url","fallbackToDirect","transport"],claustrum:["mode","disabledAccountIdentities"],killswitch:["enabled","main","accounts"]};function zK($){let Z={};if(typeof $.mainAccountId==="string")Z.mainAccountId=$.mainAccountId;if(Array.isArray($.nativeAccountOrder))Z.nativeAccountOrder=$.nativeAccountOrder.filter((X)=>typeof X==="string");if(Array.isArray($.fallbackOn))Z.fallbackOn=$.fallbackOn.filter((X)=>Number.isInteger(X));for(let[X,Y]of Object.entries(nx)){let G=$[X];if(!G||typeof G!=="object"||Array.isArray(G))continue;let z={};for(let Q of Y){let K=Object.getOwnPropertyDescriptor(G,Q)?.value;if(K!==void 0)z[Q]=structuredClone(K)}Z[X]=z}let J=$.claustrum;if(J?.primaryAccount){let X=Z.claustrum;X.primaryAccount={credentialId:J.primaryAccount.credentialId,accountId:J.primaryAccount.accountId,state:J.primaryAccount.state}}return Z}function eY($,Z){let J=$?.binding;return J?.kind==="local"&&J.storageId===Z.storageId&&J.rowId===Z.rowId&&J.identity===Z.identity&&J.credentialEpoch===Z.credentialEpoch}function $3($,Z){let J=$.runtime?.accounts[Z.routeId],X=J?.binding;return X?.kind==="custody"&&X.storageId===$.paths.storageId&&X.routeId===Z.routeId&&X.accountIdentity===Z.accountIdentity&&(X.credentialId===Z.credentialId||Z.aliases?.includes(X.credentialId))?J:void 0}function Z3($){if(!$)return;return{message:"OAuth operation failed",checkedAt:$.checkedAt,nextRetryAt:$.nextRetryAt,retryCount:$.retryCount,accountIdentity:$.accountIdentity,status:$.status,permanent:$.permanent}}function J3($){return{lastUsed:$?.lastUsed,lastRefreshedAt:$?.lastRefreshedAt,lastRefreshError:Z3($?.lastRefreshError),lastQuotaRefreshError:Z3($?.lastQuotaRefreshError),quotaErrorClearedAt:$?.quotaErrorClearedAt,quotaErrorGeneration:$?.quotaErrorGeneration,refreshErrorClearedAt:$?.refreshErrorClearedAt,profile:$?.profile&&{tier:$.profile.tier,orgType:$.profile.orgType,checkedAt:$.profile.checkedAt,accountIdentity:$.profile.accountIdentity,providerAccountUuid:$.profile.providerAccountUuid},prime:$?.prime&&{...$.prime}}}function QK($,Z,J){let X=J?.binding;if(X?.kind==="local"&&X.credentialEpoch!==Z.credentialEpoch||Z.type!=="oauth"||Z.torn!==!0||Z.enabled!==!0||Z.disabledReason!==void 0||Z.credential===void 0||Z.staged!==void 0||Z.invalid!==void 0||Z.unbound===!0||Z.stamp!=="bound"||Z.credentialEpoch===void 0)return!1;let{torn:Y,...G}=Z;return x4({kind:"local",storageId:$.storageId,rowId:Z.id,credentialEpoch:Z.credentialEpoch,...Z.identity!==void 0?{identity:Z.identity}:{}},$,G)}function ox($,Z,J,X,Y){let G=zK(J).mainAccountId,z=Z.find((Q)=>(Q.id===G?"main":Q.id)===X);return z!==void 0&&QK($,z,Y?.accounts[z.id])}function rx($){let Z=zK($.settings),J=Z.claustrum?.mode==="claustrum"?"claustrum":"local",X=[];for(let V of $.rows){if(J==="claustrum")continue;let B=V.credentialEpoch!==void 0?{kind:"local",storageId:$.paths.storageId,rowId:V.id,credentialEpoch:V.credentialEpoch,...V.identity!==void 0?{identity:V.identity}:{}}:void 0,j=B&&x4(B,$.paths,V)?B:void 0,H=$.runtime?.accounts[V.id],q=j&&eY(H,j)?H:void 0,N=V.id===Z.mainAccountId?"main":V.id,U=V.type==="oauth"&&V.quota!==void 0?H6(V.quota):void 0,L=V.identity!==void 0&&U?.accountIdentity===V.identity?U:void 0,D=J3(q);if(q?.lastRefreshError?.credentialFingerprint&&(!V.credential||q.lastRefreshError.credentialFingerprint!==I$(V.credential)))delete D.lastRefreshError;X.push({id:N,type:V.type,source:"local",...V.credential?.type==="oauth"&&V.credential.access&&!V.credential.access.startsWith("sk-ant-oat")?{state:"unsupported-access"}:{},enabled:V.enabled&&(V.candidate||QK($.paths,V,$.runtime?.accounts[V.id])),label:V.label,addedAt:V.addedAt,accountIdentity:V.identity,binding:j,...D,...L?{quota:L}:{},...V.credential?.type==="api"?{baseURL:V.credential.baseURL,authHeader:V.credential.authHeader}:{}})}if(J==="claustrum"){let V=f5($.roster,tZ(Z));for(let B of $.roster?.rows??[]){if(B.credentialType!=="oauth")continue;let j=$3($,B);X.push({id:B===V?"main":B.routeId,type:"oauth",source:"vault",enabled:B.enabled&&B.state==="active",label:B.label,addedAt:B.addedAt,accountIdentity:B.accountIdentity,credentialId:B.credentialId,state:B.state,...J3(j),...j?.quota?{quota:H6(j.quota)}:{}})}}if(Array.isArray(Z.nativeAccountOrder)){let V=Z.nativeAccountOrder;X.sort((B,j)=>{let H=V.indexOf(B.id),q=V.indexOf(j.id);return(H<0?V.length:H)-(q<0?V.length:q)})}let Y=X.filter((V)=>V.id!=="main").map((V)=>V.type==="oauth"?{id:V.id,type:"oauth",refresh:"",label:V.label,enabled:V.enabled,addedAt:V.addedAt,anthropicAccountUuid:V.accountIdentity,claustrumScopedCredentialId:V.credentialId,claustrumScopedState:V.state,authLineageId:V.binding?JSON.stringify(V.binding):V.credentialId?JSON.stringify([V.credentialId,V.accountIdentity]):void 0,quota:V.quota,profile:V.profile,prime:V.prime,lastUsed:V.lastUsed,lastRefreshedAt:V.lastRefreshedAt,lastRefreshError:V.lastRefreshError,lastQuotaRefreshError:V.lastQuotaRefreshError}:{id:V.id,type:"api",label:V.label,enabled:V.enabled,addedAt:V.addedAt,baseURL:V.baseURL??"",authHeader:V.authHeader,lastUsed:V.lastUsed}),G={version:1,...Z,accounts:Y},z=X.find((V)=>V.id==="main"),Q=f5($.roster,tZ(Z)),K=z?.source==="local"&&z.binding?$.runtime?.accounts[z.binding.rowId]:Q?$3($,Q):void 0,W=z?.source==="local"&&z.binding&&!eY(K,z.binding)?void 0:K;if(z)G.mainAccountId=z.accountIdentity??z.binding?.rowId,G.main={type:"opencode",provider:"anthropic",profile:z.profile},G.quota={...G.quota,mainQuota:z.quota,mainQuotaCheckedAt:W?.quotaCheckedAt??z.quota?.checkedAt,mainQuotaToken:z.accountIdentity,mainLastQuotaApiError:z.lastQuotaRefreshError,mainQuotaErrorClearedAt:W?.quotaErrorClearedAt,mainQuotaErrorGeneration:W?.quotaErrorGeneration},G.refresh={...G.refresh,mainLastRefreshError:z.lastRefreshError,mainRefreshErrorClearedAt:W?.refreshErrorClearedAt},G.prime={...G.prime,main:z.prime,mainAuthLineageId:W?.authLineageId};return structuredClone({mode:J,settings:Z,accounts:X,policyStorage:G})}Y4();function X3($,Z){let J=$[Z];return J&&typeof J==="object"&&!Array.isArray(J)?J:{}}var ex=["five_hour","seven_day","5h","1w","scoped"];function KK($){if(!$||typeof $!=="object"||Array.isArray($))return;let Z=$,J={};for(let X of ex){let Y=Z[X];if(typeof Y==="number"&&Number.isFinite(Y))J[X]=Y}return J}function $D($){if(!$||typeof $!=="object"||Array.isArray($))return;let Z={};for(let[J,X]of Object.entries($)){let Y=KK(X);if(Y)Z[J]=Y}return Z}function WK($){let Z=X3($,"killswitch"),J=X3($,"logging").level;return{killswitchEnabled:Z.enabled===!0,killswitchMain:KK(Z.main),killswitchAccounts:$D(Z.accounts),logLevel:typeof J==="string"?J:void 0}}function ZD($,Z){let J=WK(Z);if(J.killswitchEnabled!==$.killswitchEnabled)d.info("commands","killswitch changed",{enabled:J.killswitchEnabled});if(JSON.stringify(J.killswitchMain)!==JSON.stringify($.killswitchMain)||JSON.stringify(J.killswitchAccounts)!==JSON.stringify($.killswitchAccounts))d.info("commands","killswitch thresholds changed",{thresholds:J.killswitchMain??J.killswitchAccounts});let X=OZ(J.logLevel);if(X&&X!==OZ($.logLevel))VK(X)}function VK($){if(vG()===$)return!1;return d.info("commands","log level changed",{level:$}),kG($),!0}function u7($,Z){d.info("commands",$,{id:Z.id,label:Z.label,...$==="account enabled"||$==="account disabled"?{enabled:$==="account enabled"}:{}})}function JD($){d.info("commands","account added",{id:$.id,label:$.label,type:$.type==="api"?"apikey":"oauth"})}var zD=/^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i,QD=/\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g,G3="***REDACTED***",KD=8;function WD($){return $ instanceof Error||Object.prototype.toString.call($)==="[object Error]"}function P9($={}){let Z=[QD,...$.extraValuePatterns??[]].map((G)=>new RegExp(G.source,G.flags.includes("g")?G.flags:`${G.flags}g`));function J(G){let z=G.toLowerCase().replace(/[-_]/g,"");return zD.test(G)||z.includes("apikey")||z.endsWith("secret")||z.endsWith("password")||z.endsWith("token")&&!z.endsWith("tokens")||!!$.extraSecretKeys?.(z)}function X(G){let z=G,Q=[["name",G.name],["message",G.message],["stack",G.stack]];for(let W of["code","status","cause"])if(z[W]!==void 0)Q.push([W,z[W]]);let K=new Set(Q.map(([W])=>W));for(let W of Object.entries(G))if(!K.has(W[0]))Q.push(W);return Q}function Y(G,z,Q,K=0){if(typeof G==="string")return Z.reduce((W,V)=>W.replace(V,G3),G);if(!G||typeof G!=="object")return G;if(Q.has(G))return"[Circular]";Q.add(G);try{if(Array.isArray(G))return G.map((B)=>Y(B,z,Q,K));let W=WD(G);if(W&&K>=KD)return"[Truncated]";let V=W?K+1:K;return Object.fromEntries((W?X(G):Object.entries(G)).map(([B,j])=>[B,z&&J(B)?G3:Y(j,z,Q,V)]))}finally{Q.delete(G)}}return{redact:(G)=>Y(G,!0,new WeakSet),redactStrings:(G)=>Y(G,!1,new WeakSet)}}var BK=P9(),eT=BK.redact,$F=BK.redactStrings,m7={error:0,warn:1,info:2,debug:3,trace:4},VD=5242880,BD=3;function b5($){try{YD($,384)}catch{}}function qD($){try{if(!(E5($)&&GD($).size>=VD))return;for(let J=BD-1;J>=1;J--)if(E5(`${$}.${J}`)){let X=`${$}.${J+1}`;Y3(`${$}.${J}`,X),b5(X)}let Z=`${$}.1`;Y3($,Z),b5(Z)}catch{}}function jD($){try{return` ${JSON.stringify($)}`}catch{return" [unserializable]"}}function HD($){let Z,J,X,Y=P9(),G,z=[],Q;function K(L){Z=L.file,J=L.level,Y=P9(L),G=L.captureSink}function W(L){if(L===void 0||L in m7)X=L}function V(){if(Z===void 0)return;return(typeof Z==="function"?Z():Z)||void 0}function B(){if(X)return X;let L=typeof J==="function"?J():J;if(L&&L in m7)return L;return"info"}function j(){if(Q)clearTimeout(Q),Q=void 0;if(!z.length)return;let L;try{L=V()}catch{z=[];return}let D=z.join("");if(z=[],!L)return;try{if(qD(L),E5(L))b5(L);XD(L,D,{encoding:"utf8",mode:384})}catch{}}function H(){if(!Q)Q=setTimeout(()=>{Q=void 0,j()},500)}function q(L,D,w,O){if(Z===void 0&&G===void 0)return;try{if(m7[D]>m7[B()])return;let x=Y.redactStrings(w),C;try{C=Y.redact(O)}catch{C="[unserializable]"}let v=`[${new Date().toISOString()}] ${D.toUpperCase()} [${L}] ${x}`+(O===void 0?"":jD(C))+`
+`;try{G?.({channel:L,level:D,message:x,data:C})}catch{}if(Z===void 0)return;if(z.push(v),z.length>=50)j();else H()}catch{}}function N(L){return{error:(D,w)=>q(L,"error",D,w),warn:(D,w)=>q(L,"warn",D,w),info:(D,w)=>q(L,"info",D,w),debug:(D,w)=>q(L,"debug",D,w),trace:(D,w)=>q(L,"trace",D,w)}}function U(){if(z=[],Q)clearTimeout(Q),Q=void 0;Z=void 0,J=void 0,X=void 0,Y=P9(),G=void 0}if($)K($);return{configure:K,createLogger:N,setLogLevel:W,flushLogs:j,reset:U}}var LD=HD();function qK($){return LD.createLogger($)}function z3($){let Z=new AbortController,J=[],X=!1,Y=()=>{if(X)return;X=!0;for(let{source:Q,listener:K}of J)Q.removeEventListener("abort",K);J.length=0},G=(Q)=>{if(X||Z.signal.aborted)return;Z.abort(Q),Y()},z=$.find((Q)=>Q.aborted);if(z)return Z.abort(z.reason),{signal:Z.signal,dispose:Y};for(let Q of $){if(Z.signal.aborted)break;let K=()=>G(Q.reason);if(J.push({source:Q,listener:K}),Q.addEventListener("abort",K,{once:!0}),Q.aborted)G(Q.reason)}return{signal:Z.signal,dispose:Y}}class n extends Error{kind;constructor($,Z){super(Z);this.name="ClaustrumConsumerError",this.kind=$}}var wD=1,h5=16384,NJ=30000,xJ=/^[0-9a-f]{64}$/,AD=new Set(["invalid_params","pending_exists","not_found","already_consumed","superseded","stale_generation"]),RD=new Set(["pending_queue_full"]);function W3($){if(!($ instanceof k$))return;if(AD.has($.code))return{code:$.code,disposition:"terminal"};if(RD.has($.code))return{code:$.code,disposition:"retry"};return{code:$.code,disposition:$.action==="retry"?"retry":"terminal"}}function LK($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function p7($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0}function UK($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=1}function $9(){return new n("invalid-state","invalid Claustrum enrollment state")}function z7($){if(!LK($)||$.version!==wD||typeof $.proposedName!=="string"||$.proposedName.length===0)throw $9();if($.phase==="pending"){if(!xJ.test(String($.requestSecret??""))||$.requestId!==void 0&&(typeof $.requestId!=="string"||$.requestId.length===0)||!p7($.createdAt)||!p7($.updatedAt))throw $9();return{version:1,phase:"pending",proposedName:$.proposedName,requestSecret:$.requestSecret,...$.requestId!==void 0&&{requestId:$.requestId},createdAt:$.createdAt,updatedAt:$.updatedAt}}if($.phase==="approved"){if($.approvedName!==void 0&&(typeof $.approvedName!=="string"||$.approvedName.length===0)||!UK($.tokenGeneration)||!p7($.updatedAt))throw $9();return{version:1,phase:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration,updatedAt:$.updatedAt}}if($.phase==="denied"||$.phase==="blocked"){if($.errorCode!==void 0&&typeof $.errorCode!=="string"||!p7($.updatedAt))throw $9();return{version:1,phase:$.phase,proposedName:$.proposedName,...$.errorCode!==void 0&&{errorCode:$.errorCode},updatedAt:$.updatedAt}}throw $9()}function DJ($){if(!LK($)||!xJ.test(String($.token??""))||!UK($.token_generation))throw new n("invalid-token","invalid Claustrum enrollment token file");return{token:$.token,token_generation:$.token_generation}}function TD($){if(!$.isFile())throw new n("unsafe-file","Claustrum enrollment file must be a regular file");if(($.mode&63)!==0)throw new n("unsafe-file","Claustrum enrollment file must be owner-only");let Z=process.geteuid?.();if(Z!==void 0&&$.uid!==Z)throw new n("unsafe-file","Claustrum enrollment file must be owned by the current user")}function FD($){try{return JSON.parse($)}catch{throw new n("invalid-state","Claustrum enrollment file is not valid JSON")}}async function t4($){let Z;try{Z=await jK($,Q3.O_RDONLY|Q3.O_NOFOLLOW)}catch(J){if(J.code==="ENOENT")return;throw new n("unsafe-file","Claustrum enrollment file could not be opened safely")}try{TD(await Z.stat());let J=Buffer.alloc(h5+1),{bytesRead:X}=await Z.read(J,0,J.byteLength,0);if(X>h5)throw new n("unsafe-file","Claustrum enrollment file is too large");return FD(J.subarray(0,X).toString("utf8"))}finally{await Z.close()}}function V3($,Z){let J=[];for(let X of $.split(`
+`)){if(X.trim()===""||X.startsWith("#"))continue;let Y=X.split(":");if(Y.length!==Z||!/^[^\s:,]+$/.test(Y[0]??"")||!/^\d+$/.test(Y[2]??"")||!Number.isSafeInteger(Number(Y[2]))||Z===7&&(!/^\d+$/.test(Y[3]??"")||!Number.isSafeInteger(Number(Y[3])))||Z===4&&Y[3]!==""&&!/^[^\s:,]+(?:,[^\s:,]+)*$/.test(Y[3]??""))return;J.push(Y)}return J}async function CD($,Z,J){try{let[X,Y]=await Promise.all([K3(J.passwdPath??"/etc/passwd","utf8"),K3(J.groupPath??"/etc/group","utf8")]),G=V3(X,7),z=V3(Y,4);if(!G||!z)return!1;let Q=G.filter((B)=>Number(B[2])===$),K=z.filter((B)=>Number(B[2])===Z);if(Q.length!==1||K.length!==1)return!1;let W=Q[0]?.[0],V=K[0]?.[3]??"";return(V===""||V.split(",").every((B)=>B===W))&&!G.some((B)=>Number(B[2])!==$&&Number(B[3])===Z)}catch{return!1}}async function NK($,Z={}){let J=process.geteuid?.();if(J===void 0)return;let X=process.getegid?.(),Y;try{Y=await ID($)}catch{return}let G;for(;;){let z=await HK(Y).catch(()=>{return});if(z&&(z.mode&18)!==0&&(z.mode&512)===0){if(G===void 0)G=X!==void 0&&await CD(J,X,Z);if((z.mode&2)!==0||z.uid!==J||z.gid!==X||!G)throw new n("unsafe-file",`Claustrum enrollment path has a writable ancestor: ${Y}. Another user could replace it. Run: chmod g-w,o-w ${Y}`)}let Q=d6(Y);if(Q===Y)return;Y=Q}}async function h9($){await OD($,{recursive:!0,mode:448});let Z=await HK($),J=process.geteuid?.();if(J!==void 0&&Z.uid!==J)throw new n("unsafe-file","Claustrum enrollment directory must be owned by the current user");if((Z.mode&63)!==0)await DD($,448)}async function T6($,Z,J={}){let X=d6($);await h9(X),await NK(X,J);let Y=`${JSON.stringify(Z)}
+`;if(Buffer.byteLength(Y)>h5)throw new n("invalid-state","Claustrum enrollment state is too large");let G=_D(X,`.${PD($)}.${process.pid}.${xD()}.tmp`),z,Q=!1;try{z=await jK(G,"wx",384),Q=!0,await z.writeFile(Y,"utf8"),await z.chmod(384),await z.sync(),await z.close(),z=void 0,await MD(G,$),Q=!1}finally{if(await z?.close().catch(()=>{}),Q)await UJ(G).catch(()=>{})}}async function xK($,Z){let J=await t4($.tokenPath),X=J===void 0?void 0:DJ(J),Y=await t4($.statePath),G=Y===void 0?void 0:z7(Y);if(X)return{state:"approved",proposedName:G?.proposedName??Z,...G?.phase==="approved"&&G.approvedName!==void 0&&{approvedName:G.approvedName},tokenGeneration:X.token_generation};if(!G)return{state:"idle"};if(G.phase==="approved")return{state:"blocked",proposedName:G.proposedName,code:"missing_token"};return G6(G)}async function SD($,Z){let J;try{J=await xK($,Z)}catch(X){if(!(X instanceof n)||X.kind!=="invalid-state"&&X.kind!=="invalid-token")return"unreadable";try{let Y=await t4($.statePath);if(Y===void 0)return"unreadable";let G=z7(Y);return G.phase==="approved"&&G.proposedName===Z?"vault":"unreadable"}catch{return"unreadable"}}if("proposedName"in J&&J.proposedName!==Z)return"unreadable";if(J.state==="approved"||J.state==="blocked"&&J.code==="missing_token")return"vault";return"local"}async function kD($){let Z=await t4($);if(Z===void 0)throw new n("not-enrolled","Claustrum enrollment is not configured");return DJ(Z)}function G6($){if($.phase==="pending")return{state:"pending",proposedName:$.proposedName,...$.requestId!==void 0&&{requestId:$.requestId}};if($.phase==="approved")return{state:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration};if($.phase==="denied")return{state:"denied",proposedName:$.proposedName};return{state:"blocked",proposedName:$.proposedName,code:$.errorCode??"unknown"}}function OJ(){return new n("wrong-consumer","Claustrum enrollment state belongs to a different consumer")}class vD{#$;#Z;#G;#X;#Q;#Y;#J;constructor($){this.#J=$.ancestorOptions??{},this.#$=$.client,this.#Z=$.paths,this.#G=$.proposedName,this.#X=$.now??Date.now,this.#Q=$.mintSecret??(()=>ND(32).toString("hex")),this.#Y=$.writeTokenFile??n8}async status(){return xK(this.#Z,this.#G)}async resetTerminal(){return fD(this.#Z,this.#G)}async#W($,Z){let J={version:1,phase:"blocked",proposedName:$.proposedName,errorCode:Z,updatedAt:this.#X()};return await T6(this.#Z.statePath,J,this.#J),G6(J)}async reconcile(){await h9(d6(this.#Z.statePath));let $=await _6({name:"ceremony",path:this.#Z.statePath,ttlMs:NJ,renew:!0});if(!$)return{state:"busy"};try{let Z=await t4(this.#Z.tokenPath),J=Z===void 0?void 0:DJ(Z),X=await t4(this.#Z.statePath),Y=X===void 0?void 0:z7(X);if(Y&&Y.proposedName!==this.#G)throw OJ();if(J){if(!Y||Y.phase==="pending"){let z={version:1,phase:"approved",proposedName:Y?.proposedName??this.#G,tokenGeneration:J.token_generation,updatedAt:this.#X()};await T6(this.#Z.statePath,z,this.#J),Y=z}return{state:"approved",proposedName:Y.proposedName,...Y.phase==="approved"&&Y.approvedName!==void 0&&{approvedName:Y.approvedName},tokenGeneration:J.token_generation}}if(Y?.phase==="approved"){let z={version:1,phase:"blocked",proposedName:Y.proposedName,errorCode:"missing_token",updatedAt:this.#X()};return await T6(this.#Z.statePath,z,this.#J),G6(z)}if(Y&&Y.phase!=="pending")return G6(Y);if(!Y){let z=this.#X();if(Y={version:1,phase:"pending",proposedName:this.#G,requestSecret:this.#Q(),createdAt:z,updatedAt:z},!xJ.test(Y.requestSecret))throw new n("invalid-state","invalid minted Claustrum enrollment secret");await T6(this.#Z.statePath,Y,this.#J)}if(!Y.requestId)try{let z=UD("sha256").update(Buffer.from(Y.requestSecret,"hex")).digest("hex"),Q=await this.#$.enrollPropose({name:Y.proposedName,requestSecretHash:z});Y={...Y,requestId:Q.requestId,updatedAt:this.#X()},await T6(this.#Z.statePath,Y,this.#J)}catch(z){let Q=W3(z);if(!Q)throw z;if(Q.disposition==="retry")return{state:"pending",proposedName:Y.proposedName,retryCode:Q.code};return this.#W(Y,Q.code)}let G=Y.requestId;if(!G)return G6(Y);try{let z=await this.#$.enrollPoll({requestId:G,requestSecret:Y.requestSecret});if(z.status==="pending")return G6(Y);if(z.status==="denied"){let K={version:1,phase:"denied",proposedName:Y.proposedName,updatedAt:this.#X()};return await T6(this.#Z.statePath,K,this.#J),G6(K)}await h9(d6(this.#Z.tokenPath)),await NK(d6(this.#Z.tokenPath),this.#J),await this.#Y(this.#Z.tokenPath,{token:z.token,token_generation:z.tokenGeneration});let Q={version:1,phase:"approved",proposedName:Y.proposedName,approvedName:z.name,tokenGeneration:z.tokenGeneration,updatedAt:this.#X()};return await T6(this.#Z.statePath,Q,this.#J),G6(Q)}catch(z){let Q=W3(z);if(!Q)throw z;if(Q.disposition==="retry")return{state:"pending",proposedName:Y.proposedName,requestId:G,retryCode:Q.code};return this.#W(Y,Q.code)}}finally{await $.release()}}}async function fD($,Z){await h9(d6($.statePath));let J=await _6({name:"ceremony",path:$.statePath,ttlMs:NJ,renew:!0});if(!J)return"busy";try{if(await t4($.tokenPath)!==void 0)return"refused-approved";let X=await t4($.statePath);if(X===void 0)return"idle";let Y=z7(X);if(Y.proposedName!==Z)throw OJ();if(Y.phase==="pending")return"refused-pending";return await J.assertOwned(),await UJ($.statePath),"reset"}finally{await J.release()}}async function B3($){try{return await UJ($),!0}catch(Z){if(Z.code==="ENOENT")return!1;throw Z}}async function ED($,Z){await h9(d6($.statePath));let J=await _6({name:"ceremony",path:$.statePath,ttlMs:NJ,renew:!0});if(!J)return"busy";try{let X;try{let z=await t4($.statePath);X=z===void 0?void 0:z7(z)}catch(z){if(!(z instanceof n)||z.kind!=="invalid-state")throw z}if(X&&X.proposedName!==Z)throw OJ();await J.assertOwned();let Y=await B3($.tokenPath);await J.assertOwned();let G=await B3($.statePath);return Y||G?"disconnected":"idle"}finally{await J.release()}}var bD="claustrum-tombstone:v1:";function hD($,Z){return Z!==void 0&&Z.credentialId===$.credentialId&&Z.accountIdentity===$.accountIdentity&&Z.recordVersion!==$.recordVersion}function gD($,Z){if(Z===void 0)return"reauthorize-failed";if(Z.credentialId!==$.credentialId)return"credential-changed";if(Z.accountIdentity!==$.accountIdentity)return"account-changed";if(Z.recordVersion===$.recordVersion)return"version-unchanged";return"rotated"}var DK=qK("claustrum");function yD($,Z,J,X=DK){let Y=hD(Z,J);return X.debug("scoped 401 re-authorized",{site:$,credentialId:Z.credentialId,servedVersion:Z.recordVersion,currentVersion:J?.recordVersion??null,retry:Y,reason:gD(Z,J)}),Y}var q3=300000;function M2(){return new n("invalid-material","Claustrum returned invalid credential material")}function uD($){let Z=$.trim();if(Z.startsWith("{")){let J;try{J=JSON.parse(Z)}catch{throw M2()}if(!J||typeof J!=="object")throw M2();let X=J,Y=X.access_token??X.access;Z=typeof Y==="string"?Y:""}if(!/^[\x21-\x7e]+$/.test(Z)||Z.startsWith(bD))throw M2();return Z}function mD($,Z){if(!$.operations.includes("read"))return;if(!$.categories.includes(Z.category))return;if($.credentialType==="oauth")return $.refreshAdapter===Z.refreshAdapter?"oauth":void 0;if($.credentialType==="api_key"&&Z.apiKeys)return $.refreshAdapter===void 0?"api_key":void 0;return}class IJ{#$;#Z;#G;#X;#Q;#Y;#J;#W=new WeakMap;#K=new WeakMap;#z=!1;constructor($){let Z=$.tokenPath;if($.readToken)this.#Z=$.readToken;else if(Z)this.#Z=()=>kD(Z);else throw new n("not-enrolled","Claustrum enrollment token path is required");this.#$=$.client,this.#X=$.family,this.#Q=$.parseIdentity,this.#Y=$.requireAssertion??!1,this.#G=$.now??Date.now,this.#J=$.logger??DK}#V($){if(this.#z)throw new n("closed","Claustrum scoped custody is closed");$?.throwIfAborted()}async#B($){this.#V($);let Z=await this.#Z();if(this.#V($),!/^[0-9a-f]{64}$/.test(Z.token)||!Number.isSafeInteger(Z.token_generation)||Z.token_generation<1)throw new n("invalid-token","Invalid Claustrum enrollment token");return Z.token}async#q($,Z){this.#V(Z);let J,X;try{let Y=$();J=Z?await Promise.race([Y,new Promise((G,z)=>{let Q=()=>z(Z.reason);if(Z.addEventListener("abort",Q,{once:!0}),X=()=>Z.removeEventListener("abort",Q),Z.aborted)Q()})]):await Y}catch(Y){if(this.#V(Z),Y instanceof k$)throw Y;throw new n("unavailable","Claustrum scoped operation unavailable")}finally{X?.()}return this.#V(Z),J}async discover($){let Z=await this.#B($),J=await this.#q(()=>this.#$.listScoped(Z),$),X=[],Y=[],G=new Map;for(let Q of J.rows){let K=mD(Q,this.#X);if(!K)continue;Y.push({row:Q,type:K}),G.set(Q.id,(G.get(Q.id)??0)+1)}let z=[];for(let{row:Q,type:K}of Y){let W;if(!Q.id.trim())W="empty credential id";else if((G.get(Q.id)??0)>1)W="duplicate credential id";else if(Q.accountId!==void 0&&!Q.accountId.trim())W="blank account identity";else if(!Q.state.trim())W="empty state";if(W){X.push({...Q.id.trim()&&{credentialId:Q.id},reason:W});continue}z.push(Object.freeze({credentialId:Q.id,credentialType:K,...Q.accountId!==void 0&&{accountIdentity:Q.accountId},state:Q.state,...Q.email!==void 0&&{email:Q.email},...Q.orgName!==void 0&&{orgName:Q.orgName}}))}for(let Q of X)this.#J.warn("skipped malformed vault record",Q);return{view:J.view,credentials:Object.freeze(z),skipped:Object.freeze(X)}}async authorize($,Z){if(!$.credentialId)throw new n("route-unavailable","Claustrum dispatch requires a credential id");let{credentialId:J,credentialType:X,accountIdentity:Y}=$;if(this.#Y&&Y===void 0)throw new n("identity-unasserted","Claustrum dispatch requires a known account identity");let G=await this.#B(Z),z=await this.#q(()=>this.#$.getScoped({credentialId:J,enrollmentToken:G,...X==="oauth"&&{minTtlMs:q3}}),Z);if(z.credentialId!==void 0&&z.credentialId!==J)throw new n("identity-changed","Claustrum served credential identity changed");let Q=z.expiresAtMs;if(!Number.isSafeInteger(z.recordVersion)||z.recordVersion<0||Q===null&&X==="oauth"||Q!==null&&(!Number.isFinite(Q)||Q-this.#G()<q3))throw new n("insufficient-validity","Claustrum served credential has insufficient validity");let K=uD(z.material),W=z.accountId?.trim()?z.accountId:void 0;if(this.#Y&&(z.credentialId===void 0||W===void 0))throw new n("identity-unasserted","Claustrum served credential did not assert its identity");let V=W===void 0?this.#Q?.(K):void 0,B=W??V;if(Y!==void 0&&B!==void 0&&B!==Y)throw new n("identity-changed","Claustrum served credential identity changed");let j=B??Y,q=Object.freeze(Object.defineProperty({credentialId:J,credentialType:X,...j!==void 0&&{accountIdentity:j},accountIdentitySource:W!==void 0?"asserted":V!==void 0?"parsed":Y!==void 0?"expected":"none",...Y!==void 0&&{expectedAccountIdentity:Y},...z.credentialId!==void 0&&{assertedCredentialId:z.credentialId},...W!==void 0&&{assertedAccountIdentity:W},...z.projectId!==void 0&&{projectId:z.projectId},recordVersion:z.recordVersion,expiresAtMs:Q},"accessToken",{value:K,enumerable:!1}));return this.#W.set(q,G),q}async reportFailure($,Z,J){if(Z!==401)return;this.#V();let X=this.#W.get($);if(!X)throw new n("no-receipt","Claustrum failure report requires an original dispatch receipt");let Y=this.#K.get($);if(Y)return Y;let G=this.#q(()=>this.#$.reportAuthFailureScoped({credentialId:$.credentialId,enrollmentToken:X,providerStatus:401,recordVersion:$.recordVersion,reporterSource:J}));this.#K.set($,G);try{await G,this.#J.debug("scoped 401 reported",{credentialId:$.credentialId,recordVersion:$.recordVersion,reporterSource:J})}catch(z){throw this.#K.delete($),z}}close(){if(this.#z)return;this.#z=!0,this.#$.close()}}function OK($,Z,J){if($.accountIdentity!==void 0&&J!==void 0)return $.accountIdentity===J;return $.credentialId===Z}function lD($,Z,J){return $.some((X)=>OK(X,Z,J))}function IK($,Z,J){let X={credentialId:Z,...J!==void 0&&{accountIdentity:J}};return[...$.filter((Y)=>Y.credentialId!==Z||Y.accountIdentity!==J),X]}function MK($,Z,J){return $.filter((X)=>!Z.some((Y)=>OK(X,Y,J)))}var iD="vault:";function dD($){return pD("sha256").update($).digest("hex")}function sD($){let Z=$.credentialId.split(":");return(Z.length>=3?Z.slice(2).join(":").trim():void 0)||$.email||$.credentialId}function tD($){return $.identity!==void 0?`identity:${$.identity}`:`credential:${$.credential.credentialId}`}function W6($){return[$.credentialId,...$.aliases??[]]}function aD($,Z,J={}){let X=J.now??Date.now(),Y=J.routePrefix??iD,G=J.reservedRouteIds??new Set,z=$?.rows??[],Q=[...$?.declined??[]],K=Z.skipped.length===0,W=new Set(Z.credentials.map((O)=>O.credentialId)),V=new Set(Z.skipped.flatMap((O)=>O.credentialId===void 0?[]:[O.credentialId])),B=Z.skipped.some((O)=>O.credentialId===void 0),j=(O)=>!W.has(O)&&(V.has(O)||B),H=new Map;for(let O of z){if(O.accountIdentity===void 0)continue;for(let x of W6(O))if(!H.has(x))H.set(x,O.accountIdentity)}let q=new Map;for(let O of Z.credentials){let x=O.accountIdentity!==void 0?{credential:O,identity:O.accountIdentity,claimed:!0}:{credential:O,identity:H.get(O.credentialId),claimed:!1},C=tD(x),v=q.get(C)??[];v.push(x),q.set(C,v)}let N=new Set,U=new Set(G),L=[],D=(O,x)=>O.credential.credentialId.localeCompare(x.credential.credentialId),w=[...q.values()].map((O)=>O.toSorted(D)).sort((O,x)=>O[0]&&x[0]?D(O[0],x[0]):0);for(let O of w){let x=O[0]?.identity,C=O.filter((T)=>T.credential.state==="active"),v=C.length?C:O,k=v.filter((T)=>T.claimed),m=k.length?k:v,l=new Set(O.map((T)=>T.credential.credentialId)),P=z.find((T)=>!N.has(T)&&W6(T).some((E)=>l.has(E))&&(T.accountIdentity===void 0||T.accountIdentity===x)),M=m.find((T)=>T.credential.credentialId===P?.credentialId)??m[0];if(!M)continue;let _=M.credential,S=P??(x===void 0?void 0:z.find((T)=>!N.has(T)&&T.accountIdentity===x));if(S)N.add(S);let I=S?.routeId;if(!I||G.has(I)){let T=`${Y}${_.credentialId}${x===void 0?"":`~${dD(x).slice(0,10)}`}`;I=T;for(let E=2;U.has(I);E++)I=`${T}~${E}`}U.add(I);let F=S?W6(S).filter(j):[],A=[...new Set([...O.map((T)=>T.credential.credentialId),...F])].filter((T)=>T!==_.credentialId).sort((T,E)=>T.localeCompare(E)),R=J.mapAccount?.(_)??{};L.push({previousIndex:S?z.indexOf(S):1/0,row:{routeId:I,credentialId:_.credentialId,credentialType:_.credentialType,...x!==void 0&&{accountIdentity:x},...A.length&&{aliases:A},state:_.state,label:R.label?.trim()||sD(_),..._.email!==void 0&&{email:_.email},..._.orgName!==void 0&&{orgName:_.orgName},enabled:![_.credentialId,...A].some((T)=>lD(Q,T,x)),addedAt:S?.addedAt??X,...S?.quota!==void 0&&{quota:S.quota},...!M.claimed&&x!==void 0&&{unclaimed:!0}}})}return z.forEach((O,x)=>{if(N.has(O)||!W6(O).some(j))return;if(U.has(O.routeId))return;let[C,...v]=W6(O).filter((l)=>!W.has(l));if(C===void 0)return;U.add(O.routeId);let{aliases:k,...m}=O;L.push({previousIndex:x,row:{...m,credentialId:C,...v.length&&{aliases:v},stale:!0}})}),L.sort((O,x)=>O.previousIndex===x.previousIndex?O.row.credentialId.localeCompare(x.row.credentialId):O.previousIndex-x.previousIndex),{version:1,view:Z.view,complete:K,...!K&&{rejected:Z.skipped.map((O)=>({...O.credentialId!==void 0&&{credentialId:O.credentialId},reason:O.reason}))},rows:L.map((O)=>O.row),declined:Q}}function nD($){return($?.rows??[]).filter((Z)=>Z.enabled&&Z.state==="active").map((Z)=>({id:Z.routeId,kind:Z.credentialType==="oauth"?"oauth":"api-key",...Z.quota!==void 0&&{quota:Z.quota}}))}function aZ($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function F8($){return $===void 0||typeof $==="string"}function oD($){if(!aZ($)||typeof $.routeId!=="string"||typeof $.credentialId!=="string"||$.credentialType!=="oauth"&&$.credentialType!=="api_key"||typeof $.state!=="string"||typeof $.label!=="string"||typeof $.enabled!=="boolean"||typeof $.addedAt!=="number"||!F8($.accountIdentity)||!F8($.email)||!F8($.orgName)||$.aliases!==void 0&&(!Array.isArray($.aliases)||!$.aliases.every((Z)=>typeof Z==="string"))||$.quota!==void 0&&!Y7($.quota)||$.stale!==void 0&&$.stale!==!0||$.unclaimed!==void 0&&$.unclaimed!==!0)return;return $}var rD=new Set(["empty credential id","duplicate credential id","blank account identity","empty state"]);function j3($){if(!Array.isArray($))return;let Z=[];for(let J of $){if(!aZ(J)||!F8(J.credentialId)||typeof J.reason!=="string"||!rD.has(J.reason))return;Z.push(J)}return Z}function eD($){if(!aZ($)||$.version!==1||!F8($.view)||!Array.isArray($.rows)||!Array.isArray($.declined)||$.complete!==void 0&&typeof $.complete!=="boolean"||$.rejected!==void 0&&!j3($.rejected))throw new n("invalid-state","Claustrum roster file is not valid");let Z=[];for(let Y of $.rows){let G=oD(Y);if(!G)throw new n("invalid-state","Claustrum roster file is not valid");Z.push(G)}let J=[];for(let Y of $.declined){if(!aZ(Y)||typeof Y.credentialId!=="string"||!F8(Y.accountIdentity))throw new n("invalid-state","Claustrum roster file is not valid");J.push(Y)}let X=j3($.rejected);return{version:1,...typeof $.view==="string"&&{view:$.view},complete:$.complete!==!1,...X&&{rejected:X},rows:Z,declined:J}}async function i$($){let Z;try{Z=await cD($,"utf8")}catch(X){if(X.code==="ENOENT")return;throw X}let J;try{J=JSON.parse(Z)}catch{throw new n("invalid-state","Claustrum roster file is not valid")}return eD(J)}var $O={name:"claustrum-roster-write",ttlMs:1e4,timeoutMs:5000},ZO={name:"claustrum-roster",ttlMs:30000};async function N6($,Z,J={}){return d$($,$O,async(X)=>{let Y=await i$($),{next:G,result:z}=await Z(Y,{assertOwned:()=>X.assertOwned()});if(G)await X.assertOwned(),await u8($,G,{beforeRename:async()=>{await J.beforePublish?.(),await X.assertOwned()}});return z})}function JO($,Z){return N6($,(J)=>{let X=J?.rows.find((G)=>G.routeId===Z);if(!J||!X)throw new n("route-unavailable","Claustrum route is not in the roster");let Y=IK(J.declined,X.credentialId,X.accountIdentity);return{next:{...J,declined:Y,rows:J.rows.map((G)=>G===X?{...G,enabled:!1}:G)},result:void 0}})}function XO($,Z){return N6($,(J)=>{let X=J?.rows.find((Y)=>Y.routeId===Z);if(!J||!X)throw new n("route-unavailable","Claustrum route is not in the roster");return{next:{...J,declined:MK(J.declined,W6(X),X.accountIdentity),rows:J.rows.map((Y)=>Y===X?{...Y,enabled:!0}:Y)},result:void 0}})}function YO($,Z){if(!W6($).includes(Z.credentialId))return"refuse";if($.unclaimed&&(Z.accountIdentitySource==="expected"||Z.accountIdentitySource==="none"))return"refuse";if($.accountIdentity===Z.accountIdentity)return"hold";if($.accountIdentity===void 0&&Z.expectedAccountIdentity===void 0&&Z.accountIdentity!==void 0&&(Z.accountIdentitySource==="asserted"||Z.accountIdentitySource==="parsed")&&W6($).length===1)return"bind";return"refuse"}function GO($,Z){return N6($,(J)=>{let X=J?.rows.find((Q)=>Q.routeId===Z.routeId),Y=!J||!X?"refuse":YO(X,Z);if(!J||!X||Y==="refuse")return{result:!1};let G=hQ(X.quota,Z.observation),z=Y==="bind"?{accountIdentity:Z.accountIdentity,unclaimed:!0}:{};return{next:{...J,rows:J.rows.map((Q)=>Q===X?{...Q,...z,quota:G}:Q)},result:!0}})}async function PK($){$.signal?.throwIfAborted();let Z=async()=>await $.isActive?.()??!0;if(!await Z())return;let J=await _6({...ZO,path:$.path,renew:!0});if(!J){let X=await i$($.path);if($.signal?.throwIfAborted(),!X?.view)throw new n("roster-busy","Claustrum account discovery is already in progress");return X}try{let X=await $.custody.discover($.signal);return $.signal?.throwIfAborted(),await N6($.path,async(Y)=>{if(!await Z())return{result:void 0};$.signal?.throwIfAborted(),await J.assertOwned();let G=typeof $.projection==="function"?$.projection():$.projection,z=aD(Y,X,G);return{...JSON.stringify(Y)!==JSON.stringify(z)&&{next:z},result:z}})}finally{await J.release()}}class zO{#$;#Z=new AbortController;#G;#X;#Q;#Y;#J;#W;#K=!1;constructor($){this.#$=$,this.#G=$.logger??qK("claustrum")}#z($){this.#Z.signal.throwIfAborted(),$?.throwIfAborted()}async#V(){return await this.#$.isCustodyActive?.()??!0}#B($,Z){let J=z3([this.#Z.signal,...Z?[Z]:[]]);return new Promise((X,Y)=>{let G=()=>{J.signal.removeEventListener("abort",z),J.dispose()},z=()=>{G(),Y(J.signal.reason)};if(J.signal.addEventListener("abort",z,{once:!0}),$.then((Q)=>{if(G(),J.signal.aborted)Y(J.signal.reason);else X(Q)},(Q)=>{G(),Y(Q)}),J.signal.aborted)z()})}async#q(){if(this.#z(),this.#X)return this.#X;if(!this.#Q)this.#Q=this.#$.connect().then(($)=>{if(this.#Z.signal.aborted)$.close(),this.#z();return this.#X=new IJ({client:$,family:this.#$.family,tokenPath:this.#$.tokenPath,parseIdentity:this.#$.parseIdentity,requireAssertion:this.#$.requireAssertion,now:this.#$.now,logger:this.#G}),this.#X}).finally(()=>{this.#Q=void 0});return this.#B(this.#Q)}snapshot(){return this.#J}routingRows(){return nD(this.#J)}refresh(){if(this.#z(),this.#Y)return this.#Y;return this.#Y=(async()=>{if(!await this.#V()){this.#J=void 0,this.#X?.close(),this.#X=void 0;return}let $=await this.#q(),Z=await PK({path:this.#$.rosterPath,custody:$,isActive:()=>this.#V(),signal:this.#Z.signal,projection:()=>({reservedRouteIds:new Set(this.#$.reservedRouteIds?.()??[]),routePrefix:this.#$.routePrefix,mapAccount:this.#$.mapAccount,now:(this.#$.now??Date.now)()})});this.#z();let J=Z?.view!==this.#J?.view;if(this.#J=Z,Z&&J)this.#$.onRoster?.(Z);return Z})().finally(()=>{this.#Y=void 0}),this.#Y}start(){if(this.#K)return;this.#z(),this.#K=!0;let $=async()=>{try{await this.refresh()}catch(J){if(!this.#Z.signal.aborted)this.#$.onError?.(J)}if(this.#Z.signal.aborted)return;let Z=this.#$.pollIntervalMs??5000;if(Z<=0)return;this.#W=(this.#$.setTimeoutImpl??setTimeout)(()=>{this.#W=void 0,$()},Z),this.#W.unref?.()};$()}async authorize($,Z){this.#z(Z);let J=this.#J??await this.#B(this.refresh(),Z);if(!J||!await this.#V())throw new n("not-active","Claustrum scoped custody is not active");let X=await i$(this.#$.rosterPath);this.#z(Z);let Y=J.rows.find((K)=>K.routeId===$),G=X?.rows.find((K)=>K.routeId===$);if(G&&!G.enabled)throw new n("route-declined","Claustrum route is disabled");if(!Y||!G||G.state!=="active"||G.credentialId!==Y.credentialId||G.accountIdentity!==Y.accountIdentity)throw new n("route-unavailable","Claustrum route is disabled, removed or changed");let z=await this.#B(this.#q(),Z),Q=z3([this.#Z.signal,...Z?[Z]:[]]);try{return await z.authorize({credentialId:G.credentialId,credentialType:G.credentialType,...G.accountIdentity!==void 0&&{accountIdentity:G.accountIdentity}},Q.signal)}finally{Q.dispose()}}async reportFailure($,Z,J){if(this.#z(),!this.#X)throw new n("no-receipt","Claustrum dispatch receipt has no active owner");await this.#X.reportFailure($,Z,J)}async send($,Z,J){let X=J.signal,Y=await this.authorize($,X),G=await Z(Y,X);if(G.status===401&&!X?.aborted){let z;try{z=await this.authorize($,X)}catch{}if(yD(J.site,Y,z,this.#G))await G.body?.cancel().catch(()=>{}),Y=z,G=await Z(z,X)}if(G.status===401)await this.reportFailure(Y,401,J.reporterSource??"direct").catch((z)=>this.#$.onError?.(z)),Promise.resolve().then(()=>this.refresh()).catch((z)=>{if(!this.#Z.signal.aborted)this.#$.onError?.(z)});return G}async decline($){this.#z(),await JO(this.#$.rosterPath,$),this.#J=await i$(this.#$.rosterPath)}async accept($){this.#z(),await XO(this.#$.rosterPath,$),this.#J=await i$(this.#$.rosterPath)}async recordQuota($,Z,J){this.#z();let X=await GO(this.#$.rosterPath,{routeId:$,observation:Z,credentialId:J.credentialId,accountIdentitySource:J.accountIdentitySource,...J.accountIdentity!==void 0&&{accountIdentity:J.accountIdentity},...J.expectedAccountIdentity!==void 0&&{expectedAccountIdentity:J.expectedAccountIdentity}});if(X)this.#J=await i$(this.#$.rosterPath);return X}close(){if(this.#Z.signal.aborted)return;if(this.#Z.abort(new n("closed","Claustrum consumer is closed")),this.#W)(this.#$.clearTimeoutImpl??clearTimeout)(this.#W);this.#W=void 0,this.#X?.close(),this.#J=void 0}}function VZ($){switch($){case"closed":case"not-enrolled":case"invalid-token":case"unavailable":case"identity-changed":case"identity-unasserted":case"insufficient-validity":case"invalid-material":case"not-active":case"route-unavailable":case"route-declined":case"no-receipt":case"unsafe-file":case"invalid-state":case"wrong-consumer":case"roster-busy":case"host-slot-login":case"host-slot-placeholder":case"placeholder-refresh":return $;default:return"unavailable"}}class a extends Error{code;constructor($){let Z=VZ($);super(`Native custody refused: ${Z}`);this.name="NativeCustodyError",this.code=Z}}function _K($){let Z={...$.env??process.env},J=$.connect,X=$.logger,Y=!1,G,z,Q=new Set,K=new WeakSet;function W(U){if(Y)throw new a("closed");U?.throwIfAborted()}function V(){return W(),z??=Promise.resolve().then(J).then((U)=>{if(Y)throw U.close(),new a("closed");return G=U,U}).catch((U)=>{throw z=void 0,U}),z}async function B(U){let L=await V();return W(),U(L)}let j=new IJ({client:{listScoped:(U)=>B((L)=>L.listScoped(U)),getScoped:(U)=>B((L)=>L.getScoped(U)),reportAuthFailureScoped:(U)=>B((L)=>L.reportAuthFailureScoped(U)),close:()=>G?.close()},family:{refreshAdapter:"anthropic",category:"anthropic-native",apiKeys:!1},requireAssertion:!0,...$.readToken?{readToken:$.readToken}:{tokenPath:o9($.host,Z).tokenPath},now:$.now,logger:{warn:()=>X?.warn("Native custody inventory record skipped"),debug:()=>X?.debug("Native custody failure reported")}});async function H(U,L){W(L);let D=()=>{},w=()=>{},O=new Promise((x,C)=>{D=()=>C(new a("closed")),w=()=>C(L?.reason),Q.add(D),L?.addEventListener("abort",w,{once:!0})});try{let x=await Promise.race([U(),O]);return W(L),x}catch(x){throw W(L),new a(x instanceof n?VZ(x.kind):x instanceof a?VZ(x.code):"unavailable")}finally{Q.delete(D),L?.removeEventListener("abort",w)}}function q(U){if(!K.has(U))throw new a("no-receipt")}let N={discover:(U)=>H(()=>j.discover(U),U),authorize:(U,L)=>H(async()=>{let{credentialId:D,accountIdentity:w}=U;if(typeof D!=="string")throw new a("unavailable");if(w!==void 0&&typeof w!=="string")throw new a("unavailable");if(!w?.trim())throw new a("identity-unasserted");let O=await j.authorize({credentialId:D,accountIdentity:w,credentialType:"oauth"},L);return W(L),K.add(O),O},L),reportFailure:(U,L,D)=>H(async()=>{q(U),await j.reportFailure(U,L,D)}),prepareRetry:async(U,L)=>{if(W(L),q(U),U.assertedAccountIdentity===void 0)throw new a("no-receipt");let D;try{D=await N.authorize({credentialId:U.credentialId,accountIdentity:U.assertedAccountIdentity},L)}catch(w){if(W(L),w instanceof a&&w.code==="closed")throw w;return{retry:!1,reason:"reauthorize-failed",code:w instanceof a?VZ(w.code):"unavailable"}}if(W(L),D.credentialId!==U.credentialId)return{retry:!1,reason:"credential-changed"};if(D.assertedAccountIdentity!==U.assertedAccountIdentity)return{retry:!1,reason:"account-changed"};if(!(D.recordVersion>U.recordVersion))return{retry:!1,reason:"version-not-newer"};return{retry:!0,receipt:D}},close:()=>{if(Y)return;Y=!0;for(let U of Q)U();j.close()}};return N}async function BZ($,Z=process.env){let J=await SD(o9($,Z),`anthropic-auth-${$}`);if(J==="unreadable")throw new a("invalid-token");return J==="vault"?"claustrum":"local"}function wK($,Z){return $.kind===Z.kind&&$.storageId===Z.storageId&&$.rowId===Z.rowId&&$.credentialEpoch===Z.credentialEpoch&&$.identity===Z.identity}function H3($,Z){return wK($.binding,Z.binding)&&$.credentialFingerprint===Z.credentialFingerprint&&$.version.accessFingerprint===Z.version.accessFingerprint&&$.version.expires===Z.version.expires&&Object.hasOwn($.version,"lastRefreshedAt")===Object.hasOwn(Z.version,"lastRefreshedAt")&&$.version.lastRefreshedAt===Z.version.lastRefreshedAt}function L3($,Z,J){let X=$?.lastRefreshError;if($?.binding.kind==="local"&&wK($.binding,Z.binding)&&X?.credentialFingerprint===Z.credentialFingerprint){if(X.permanent===!0)return{status:"blocked",reason:"invalid-grant",credentialFingerprint:Z.credentialFingerprint};if(X.nextRetryAt!==void 0&&X.nextRetryAt>J)return{status:"blocked",reason:"refresh-backoff",credentialFingerprint:Z.credentialFingerprint}}return{status:"allowed"}}function KO($){let{paths:Z,externalPolicy:J}=$,X=$.now??Date.now;if(typeof J!=="function")throw TypeError("Native local external policy gate is required");function Y(z){let Q=J(z);if(Q?.status==="allowed"&&Object.keys(Q).length===1)return{status:"allowed"};if(Q?.status==="blocked"&&Object.keys(Q).length===2&&["quota-ineligible","account-disabled","local-mode-unavailable"].includes(Q.reason))return{status:"blocked",reason:Q.reason};throw TypeError("Native local external policy result is invalid")}async function G(z){if(!x$(z.binding))throw new b("invalid-runtime");let Q=await p4(Z.runtime,Z.storageId),K=Q.status==="ready"?Q.state.accounts[z.binding.rowId]:void 0;if(K&&K.binding.kind!=="local")throw new b("invalid-runtime");return K}return{async readRestrictions(z){let Q=await G(z),K=Y(z);return{restriction:K.status==="blocked"?K:L3(Q,z,X()),context:{subject:z,runtimeBinding:Q?.binding.kind==="local"?Q.binding:null,refreshErrorClearedAt:Q?.refreshErrorClearedAt??null,quotaErrorClearedAt:Q?.quotaErrorClearedAt??null,quotaErrorGeneration:Q?.quotaErrorGeneration??null}}},async readAdmission(z){let Q=await G(z),K=Y(z);if(K.status==="blocked")return K;let W=X(),V=L3(Q,z,W);if(V.status==="blocked")return{status:"blocked",reason:V.reason};if(!r6(z))throw new b("invalid-runtime");let B=Q?.credentialValidation;if(B&&H3(B,z))return{status:"proven",validation:B};let j=Q?.validationRetry;if(j&&z.version.expires>W&&j.nextRetryAt>W&&H3(j.subject,z))return{status:"blocked",reason:"validation-backoff"};return{status:"unproven"}}}}var g5=3;function P2($,Z){let J=WO("sha256").update(JSON.stringify([$.storageId,Z])).digest("hex");return{path:$.state,name:`native-account-provider-${J}`,...y$}}function U3($){return $ instanceof C1||$ instanceof I1}var f6=new Map;function j8($,Z){if(f6.get(Z)===$)f6.delete(Z);$.keys.delete(Z)}function Z9($){let Z=$ instanceof G$?$.cause:$,J=$ instanceof G$?$.kind:"caller-hook";if(J==="provider"&&Z instanceof R9){let X=Z.status===400&&/\binvalid_grant\b/.test(Z.body);return{kind:J,classification:X?"invalid-grant":Z.status===429||Z.status>=500?"transient":"permanent",status:Z.status,...Z.retryAfter!==void 0?{retryAfter:Z.retryAfter}:{}}}return{kind:J,classification:J==="provider"&&h4(Z)?"transient":"permanent"}}function c7($){return $ instanceof Error?$:Error("Native refresh callback failed",{cause:$})}function x8($){if($.type!=="oauth")throw Error("Local refresh requires an OAuth credential");return Object.freeze({accessFingerprint:$.access?S4($.access):void 0,expires:$.expires,...Object.hasOwn($,"lastRefreshedAt")?{lastRefreshedAt:$.lastRefreshedAt}:{}})}class _9 extends Error{reason;constructor($){super("Local refresh policy refused the exchange");this.reason=$}}function _2($,Z){if($.status==="allowed")return;if($.reason!=="refresh-backoff"&&$.reason!=="invalid-grant")return $.reason;return $.credentialFingerprint===Z?$.reason:void 0}function VO($,Z){let J=$.credential,X=Z.credential;return J?.type==="oauth"&&X?.type==="oauth"&&J.access===X.access&&J.refresh===X.refresh&&J.expires===X.expires&&Object.hasOwn(J,"lastRefreshedAt")===Object.hasOwn(X,"lastRefreshedAt")&&J.lastRefreshedAt===X.lastRefreshedAt}function BO($){throw Error(`Unsupported refresh outcome: ${String($)}`)}function qO($,Z){return x$($)&&x$(Z)&&$.storageId===Z.storageId&&$.rowId===Z.rowId&&$.credentialEpoch===Z.credentialEpoch&&$.identity===Z.identity}function jO($,Z){return qO($.binding,Z.binding)&&$.credentialFingerprint===Z.credentialFingerprint&&$.version.accessFingerprint===Z.version.accessFingerprint&&$.version.expires===Z.version.expires&&Object.hasOwn($.version,"lastRefreshedAt")===Object.hasOwn(Z.version,"lastRefreshedAt")&&$.version.lastRefreshedAt===Z.version.lastRefreshedAt}function nZ($){return Object.freeze({...$,binding:Object.freeze({...$.binding}),version:Object.freeze({...$.version})})}function N3($,Z){if(Z.credential?.type!=="oauth"||!Z.fingerprint)throw new _9("access-unavailable");return nZ({binding:$,credentialFingerprint:Z.fingerprint,version:x8(Z.credential)})}function l7($){return Object.freeze({credentialFingerprint:I$($),version:x8($)})}function HO($,Z){if(!jO($.subject,Z)||$.runtimeBinding!==null&&!x$($.runtimeBinding)||![$.refreshErrorClearedAt,$.quotaErrorClearedAt,$.quotaErrorGeneration].every((J)=>J===null||Number.isSafeInteger(J)&&Number(J)>=0))throw Error("Native policy context does not match the captured subject");return Object.freeze({subject:nZ(Z),runtimeBinding:$.runtimeBinding===null?null:Object.freeze({...$.runtimeBinding}),refreshErrorClearedAt:$.refreshErrorClearedAt,quotaErrorClearedAt:$.quotaErrorClearedAt,quotaErrorGeneration:$.quotaErrorGeneration})}function LO($){let Z=U6($),J=$.now??Date.now,X=$.refreshToken??jB,Y=$.resolveIdentity??tq,G=cQ($.onLockEvent);async function z(j){let H=await Z.read();return H.status==="ready"?H.rows.find((q)=>q.id===j.rowId):void 0}async function Q(j){let H;try{H=await $.readRestrictions(j)}catch(q){throw Error("Native policy callback failed",{cause:q})}return Object.freeze({restriction:Object.freeze({...H.restriction}),context:HO(H.context,j)})}async function K(j,H,q,N,U){let L=(x)=>({status:"refused",reason:x,persisted:U});if(!q||!x4(H,$.paths,q)||!q.enabled||!q.candidate)return L("row-ineligible");if(H.identity===void 0)return L("identity-unproven");let D=q.credential;if(D?.type!=="oauth"||!D.access||typeof D.expires!=="number"||D.expires<=J())return L("access-unavailable");if(D.access===j.rejectedAccessToken)return L("rejected-access-unchanged");let w=nZ({binding:{...H,identity:H.identity},credentialFingerprint:I$(D),version:{...x8(D),accessFingerprint:S4(D.access),expires:D.expires}}),O;try{O=await $.readAdmission(w)}catch(x){throw Error("Native admission callback failed",{cause:x})}if(O.status==="blocked")return L(O.reason);if(O.status!=="proven")return L("proof-missing");if(!y6(O.validation,H,D))return L("proof-mismatch");if(j.signal?.aborted)return L("cancelled");if(D.expires<=J())return L("access-unavailable");return Object.freeze({status:"usable",source:N,binding:w.binding,access:D.access,expires:D.expires,subject:w,validation:nZ(O.validation)})}async function W(j){let H=P2($.paths,j),q=performance.now();for(;;){let N=await _6({name:H.name,path:H.path,ttlMs:y$.ttlMs,renew:!0,now:J,onContended:G?()=>G({type:"contended",name:H.name,path:H.path}):void 0,onStep:$.onLockStep?(L)=>$.onLockStep?.(H,L):void 0});if(N){try{await N.assertOwned()}catch(L){throw await N.release().catch(()=>{}),G?.({type:"released",name:H.name,path:H.path}),L}return G?.({type:"acquired",name:H.name,path:H.path}),N}let U=y$.timeoutMs-(performance.now()-q);if(U<=0)throw new E8({target:H.path,name:H.name,timeoutMs:y$.timeoutMs});await new Promise((L)=>setTimeout(L,Math.min(y$.retryMs,U)))}}async function V(j,H){let q=H.binding,N=0,U=!1,L=!1,D,w="unavailable",O="not-needed",x,C,v,k,m,l,P,M,_=!1;function S(){return w==="unsupported-credential"}function I(){return{binding:q,attempt:N,credentialFingerprint:x,credentialVersion:C,context:k,bootstrap:w,handoff:O}}async function F(T){try{await $.reconcile(T)}catch(E){throw _=!0,Error("Native reconciliation callback failed",{cause:E})}}async function A(){let T=m;if(m=void 0,P?.(),P=void 0,T)l=(async()=>{if(await T.release().catch(()=>{}),D){let E=P2($.paths,D);G?.({type:"released",name:E.name,path:E.path})}})();await l}async function R(){if(O="skipped-loss",M)j8(j,M);await A()}try{for(N=1;N<=g5;N++){U=!1;let T=!1;D=void 0,x=void 0,C=void 0,v=void 0,k=void 0,M=void 0,w="unavailable",O="not-needed";let E,f=await z(q);x=f?.fingerprint,C=f?.credential?.type==="oauth"?x8(f.credential):void 0;let h,c=!f||!x4(q,$.paths,f)?"binding-changed":H.signal?.aborted?"cancelled":!f.candidate||!f.enabled?"row-ineligible":void 0;if(c)return await F({...I(),status:"refused",reason:c,consumed:!1}),{status:"refused",reason:c,persisted:!1};if(!f)throw Error("Captured row unavailable");h=await Q(N3(q,f));let e=_2(h.restriction,f.fingerprint);if(e)return await F({...I(),status:"refused",reason:e,consumed:!1}),{status:"refused",reason:e,persisted:!1};if(q.identity!==void 0&&(H.intent==="serve"||H.rejectedAccessToken!==void 0)&&f?.credential?.type==="oauth"&&f.credential.access&&f.credential.access!==H.rejectedAccessToken&&(f.credential.expires??0)>J()){let o=await K(H,q,f,"adopted",!1);if(o.status==="usable")await F({...I(),status:"adopted",successorFingerprint:I$(f.credential),successorVersion:x8(f.credential)});else if(o.status==="refused"&&o.reason==="proof-missing"){k=h.context;let i,p;try{if(i=(await Y(f.credential.access,void 0,void 0)).accountUuid,w=i?"resolved":"unavailable",!i)p={kind:"validation",classification:"transient"}}catch(r){if(U3(r))return w="unsupported-credential",await F({...I(),status:"refused",reason:"unsupported-access",consumed:!1}),{status:"refused",reason:"unsupported-access",persisted:!1};w="failed",p={kind:"validation",classification:h4(r)||r instanceof R9&&(r.status===429||r.status>=500)?"transient":"permanent"}}if(p){Object.freeze(p);try{await F({...I(),status:"failed",failure:p,persisted:!1})}catch{}return{status:"failed",failure:p,persisted:!1,reconciliationFailed:_}}if(i!==q.identity)return await F({...I(),status:"refused",reason:"validation-contradicted",consumed:!1}),{status:"refused",reason:"validation-contradicted",persisted:!1};await F({...I(),status:"validation-observed",identity:q.identity,context:k})}else return o;return{status:"completed",source:o.status==="usable"?H.rejectedAccessToken?"adopted":"current":"validated",identity:q.identity,persisted:!1}}try{let o=await Z.refresh(q.rowId,async(i,p)=>{if(E=p,x=p.fingerprint,C=x8(i),pG(i.refresh))throw new _9("custody-tombstone");h=await Q(N3(q,p)),k=h.context;let r=H.signal?.aborted?"cancelled":_2(h.restriction,x);if(r)throw new _9(r);T=!0;let H$=await X({refreshToken:i.refresh,maxRetries:0,now:J});U=!0;try{let V$=(await Y(H$.access,void 0,void 0)).accountUuid;D=typeof V$==="string"&&V$.length>0&&V$.trim()===V$?V$:void 0,w=D?"resolved":"unavailable"}catch(V$){w=U3(V$)?"unsupported-credential":"failed"}if(q.identity===void 0&&D){if(M=dY({...q,identity:D}),!f6.has(M))f6.set(M,j),j.keys.add(M);if(H.signal?.aborted)O="skipped-cancelled",j8(j,M);else try{m=await W(D),O="acquired";let V$=m,s$=()=>{if(m!==V$)return;if(O="skipped-cancelled",M)j8(j,M);A()};if(H.signal?.addEventListener("abort",s$,{once:!0}),P=()=>H.signal?.removeEventListener("abort",s$),H.signal?.aborted)s$();if(V$.whenLost().then(async()=>{if(m===V$)await R()}).catch(()=>{}),m===V$)await V$.assertOwned()}catch(V$){O=V$ instanceof E8?"skipped-contention":"skipped-loss",j8(j,M),await A()}}return{access:H$.access,refresh:H$.refresh,expires:H$.expires,...D?{identity:D}:{}}},{...q.identity!==void 0?{providerLock:P2($.paths,q.identity)}:{},refuse:async(i)=>{if(!x4(q,$.paths,i))return"binding-changed";if(E&&!VO(E,i))return"dispatch-changed";if(m)try{await m.assertOwned()}catch{await R()}if(U)return;if(H.signal?.aborted)return"cancelled";if(!i.candidate||!i.enabled)return"row-ineligible";return h?_2(h.restriction,i.fingerprint):void 0},onPersisted:async(i,p)=>{L=!0,v=l7(p);try{if(m)try{await m.assertOwned()}catch{await R()}await F({...I(),status:"persisted",identity:D,successorFingerprint:v.credentialFingerprint,successorVersion:v.version,committed:v})}finally{await A()}}});switch(o.status){case"rotated":if(S())return{status:"refused",reason:"unsupported-access",persisted:!0};return{status:"completed",source:"rotated",identity:o.identity,persisted:!0};case"refused":return await F({...I(),status:"refused",reason:o.reason,consumed:U}),{status:"refused",reason:o.reason,persisted:!1};case"identity-contradicted":return L=!0,v=l7(o.credential),await F({...I(),status:"identity-contradicted",expectedIdentity:o.expectedIdentity,returnedIdentity:o.returnedIdentity,successorFingerprint:v.credentialFingerprint,successorVersion:v.version,committed:v}),{status:"identity-contradicted",expectedIdentity:o.expectedIdentity,returnedIdentity:o.returnedIdentity,persisted:!0};default:return BO(o)}}catch(o){let i=c7(o);if(L||=i instanceof G$&&(i.committed!==void 0||i.phase==="after-first-write"),i instanceof G$&&i.committed?.type==="oauth")v=l7(i.committed);if(!T&&i instanceof G$&&i.cause instanceof _9)return await F({...I(),status:"refused",reason:i.cause.reason,consumed:!1}),{status:"refused",reason:i.cause.reason,persisted:!1};let p=Z9(i);if(!T&&p.kind==="provider")p.kind="caller-hook",p.classification="permanent";Object.freeze(p);try{await F({...I(),status:"failed",failure:p,persisted:L,committed:v})}catch{}if(T&&!U&&!L&&!_&&!H.signal?.aborted&&p.kind==="provider"&&p.classification==="transient"&&p.status!==429&&N<g5){if(await A(),M)j8(j,M);continue}return{status:"failed",failure:p,persisted:L,reconciliationFailed:_}}finally{await A()}}throw Error("Unreachable refresh attempt budget")}catch(T){let E=c7(T);if(L||=E instanceof G$&&(E.committed!==void 0||E.phase==="after-first-write"),E instanceof G$&&E.committed?.type==="oauth")v=l7(E.committed);try{await F({...I(),status:"failed",failure:Z9(E),persisted:L,committed:v})}catch{}return{status:"failed",failure:Z9(E),persisted:L,reconciliationFailed:_}}finally{await A()}}async function B(j){if(j.mode!=="local")return{status:"refused",reason:"custody-mode",persisted:!1};if(j.intent!=="serve"&&j.intent!=="refresh")return{status:"refused",reason:"invalid-intent",persisted:!1};if(!x$(j.binding)||j.binding.storageId!==$.paths.storageId)return{status:"refused",reason:"binding-changed",persisted:!1};if(j={...j,binding:Object.freeze({...j.binding})},j.signal?.aborted)return{status:"refused",reason:"cancelled",persisted:!1};let H=dY(j.binding),q=f6.get(H);if(!q&&j.intent==="serve"){try{let U=await K(j,j.binding,await z(j.binding),"current",!1);if(U.status!=="refused"||!["proof-missing","identity-unproven","access-unavailable","rejected-access-unchanged"].includes(U.reason))return U}catch(U){return{status:"failed",failure:Z9(c7(U)),persisted:!1,reconciliationFailed:!1}}q=f6.get(H)}if(!q){q={keys:new Set([H]),promise:Promise.resolve({status:"refused",reason:"initializing",persisted:!1})},f6.set(H,q);let U=q;q.promise=V(U,j).finally(()=>{for(let L of U.keys)j8(U,L)})}let N=await q.promise;if(j.signal?.aborted)return{status:"refused",reason:"cancelled",persisted:N.persisted};if(N.status!=="completed")return N;try{let U=j.binding.identity===void 0&&N.source==="rotated"?{...j.binding,...N.identity?{identity:N.identity}:{}}:j.binding,L=await z(j.binding);return await K(j,U,L,N.source,N.persisted)}catch(U){return{status:"failed",failure:Z9(c7(U)),persisted:N.persisted,reconciliationFailed:!1}}}return{authorize:B}}class f$ extends Error{role;code;constructor($,Z){super(`Anthropic migration ${$} input: ${Z}`);this.role=$,this.code=Z,this.name="NativeMigrationSourceError"}}var D3=4194304;function IO($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function MO($){let Z=[$];while(Z.length){let J=Z.pop();if(!J)continue;for(let X of Object.values(J))if(X!==null&&typeof X==="object")Z.push(X);Object.freeze(J)}return $}function O3($){return Object.defineProperty($,"data",{enumerable:!1}),Object.freeze($)}async function T$($,Z,J={}){let X=O3({role:$,path:Z,digest:null,data:void 0,metadata:void 0}),Y;try{Y=await x3(Z,{bigint:!0})}catch(z){if(z instanceof Error&&"code"in z&&z.code==="ENOENT")return X;throw new f$($,"source-io")}if(!Y.isFile()||Y.isSymbolicLink())throw new f$($,"unsafe-source");let G;try{G=await OO(Z,w2.O_RDONLY|(w2.O_NOFOLLOW??0)|(w2.O_NONBLOCK??0));let z=await G.stat({bigint:!0});if(!z.isFile()||z.dev!==Y.dev||z.ino!==Y.ino)throw new f$($,"source-changed");if(z.size>D3)throw new f$($,"source-too-large");await J.onOpened?.();let Q=[],K=0;for(;;){let H=Buffer.alloc(65536),q=await G.read(H);if(!q.bytesRead)break;if(K+=q.bytesRead,K>D3)throw new f$($,"source-too-large");Q.push(H.subarray(0,q.bytesRead))}let W=await G.stat({bigint:!0}),V=await x3(Z,{bigint:!0});if(z.uid!==W.uid||z.gid!==W.gid||z.mode!==W.mode||V.uid!==z.uid||V.gid!==z.gid||V.mode!==z.mode||z.dev!==W.dev||z.ino!==W.ino||z.mtimeNs!==W.mtimeNs||z.ctimeNs!==W.ctimeNs||z.size!==W.size||V.dev!==z.dev||V.ino!==z.ino||V.isSymbolicLink()||V.mtimeNs!==z.mtimeNs||V.ctimeNs!==z.ctimeNs||V.size!==z.size||BigInt(K)!==z.size)throw new f$($,"source-changed");let B=Buffer.concat(Q,K),j;try{j=I6(new TextDecoder("utf-8",{fatal:!0}).decode(B))}catch{throw new f$($,"invalid-source")}if(!IO(j))throw new f$($,"invalid-source");return O3({role:$,path:Z,digest:DO("sha256").update(B).digest("hex"),data:MO(j),metadata:Object.freeze({uid:Number(z.uid),mode:Number(z.mode),device:z.dev.toString(),inode:z.ino.toString(),modified:z.mtimeNs.toString(),changed:z.ctimeNs.toString()})})}catch(z){if(z instanceof f$)throw z;if(z instanceof Error&&"code"in z){if(z.code==="ENOENT")throw new f$($,"source-changed");if(z.code==="ELOOP")throw new f$($,"unsafe-source")}if(z instanceof SyntaxError)throw new f$($,"invalid-source");throw new f$($,"source-io")}finally{await G?.close()}}async function B6($){let Z=await T$($.role,$.path);if(Z.digest!==$.digest||JSON.stringify(Z.metadata)!==JSON.stringify($.metadata))throw new f$($.role,"source-changed")}var y5=["building","verified","activation-installed","committed","retired"];class Y$ extends Error{code;constructor($){super({"migration-required":"Anthropic account migration is required. Stop OpenCode, LiteCode and Pi, then run bunx @cortexkit/opencode-anthropic-auth@2.0.0 setup","migration-incomplete":"Anthropic account migration is incomplete; resume setup","invalid-journal":"Anthropic account migration journal is invalid","journal-conflict":"Anthropic account migration journal changed"}[$]);this.code=$,this.name="NativeAuthorityError"}}function k4($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function AK($){try{return l6($)}catch{throw new Y$("invalid-journal")}}function MJ($){try{return sQ($)}catch{throw new Y$("invalid-journal")}}function u5($){return y5.some((Z)=>Z===$)}function z4($,Z){return Object.keys($).length===Z.length&&Z.every((J)=>Object.hasOwn($,J))}function oZ($){return typeof $==="string"&&$.length===64&&/^[a-f0-9]{64}$/.test($)}function w9($){return $===null||oZ($)}function F0($){return $==="absent"||oZ($)}function m5($){return typeof $==="string"&&UO($)&&!/\p{Cc}/u.test($)&&!$.endsWith(i7)&&NO($)===$&&(i7!=="\\"||xO($).root!==i7)&&!$.split(i7).some((Z)=>Z==="."||Z==="..")}function PO($){return k4($)&&z4($,["config","state","hostAuth","routing"])&&w9($.config)&&w9($.state)&&F0($.hostAuth)&&w9($.routing)}function _O($){return k4($)&&z4($,["source","destination"])&&m5($.source)&&m5($.destination)}function G4($){return typeof $==="string"&&$.length>0}function wO($){if(!k4($)||!z4($,["version","view","complete","rows","declined"])||$.version!==1||!G4($.view)||$.complete!==!0||!Array.isArray($.rows)||!Array.isArray($.declined))throw new Y$("invalid-journal");let Z=$.rows.map((X)=>{if(!k4(X)||!z4(X,["routeId","credentialId","credentialType","accountIdentity","state","label","enabled","addedAt"])||!G4(X.routeId)||!G4(X.credentialId)||X.credentialType!=="oauth"||!G4(X.accountIdentity)||!G4(X.state)||typeof X.label!=="string"||typeof X.enabled!=="boolean"||typeof X.addedAt!=="number"||!Number.isFinite(X.addedAt))throw new Y$("invalid-journal");return{routeId:X.routeId,credentialId:X.credentialId,credentialType:"oauth",accountIdentity:X.accountIdentity,state:X.state,label:X.label,enabled:X.enabled,addedAt:X.addedAt}}),J=$.declined.map((X)=>{if(!k4(X)||!G4(X.credentialId)||!(z4(X,["credentialId"])||z4(X,["credentialId","accountIdentity"])&&G4(X.accountIdentity)))throw new Y$("invalid-journal");return G4(X.accountIdentity)?{credentialId:X.credentialId,accountIdentity:X.accountIdentity}:{credentialId:X.credentialId}});if(new Set(Z.map((X)=>X.routeId)).size!==Z.length)throw new Y$("invalid-journal");return{version:1,view:$.view,complete:!0,rows:Z,declined:J}}function A2($,Z,J){if(!k4($)||!z4($,[...Z])||!Z.every((X)=>J($[X])))throw new Y$("invalid-journal");return Object.fromEntries(Z.map((X)=>[X,$[X]]))}var AO=["prepared","published","committed"];function RO($,Z){if($===null)return null;if(!k4($))throw new Y$("invalid-journal");if($.kind==="requested"&&z4($,["kind"]))return{kind:"requested"};if($.kind!=="activation"||Z!=="retired"||!z4($,["kind","phase","primary","roster","localProof","removeIds","settings","runtime","hostAuth"])||!AO.some((Q)=>Q===$.phase)||!k4($.primary)||!z4($.primary,["routeId","credentialId","accountIdentity"])||!G4($.primary.routeId)||!G4($.primary.credentialId)||!G4($.primary.accountIdentity)||!Array.isArray($.removeIds)||!$.removeIds.every(G4))throw new Y$("invalid-journal");let J={routeId:$.primary.routeId,credentialId:$.primary.credentialId,accountIdentity:$.primary.accountIdentity},X=wO($.roster),Y=MJ($.localProof),G=[...$.removeIds],z=new Set(Y.rows.map((Q)=>Q.id));if(G.some((Q,K)=>!z.has(Q)||K>0&&(G[K-1]??"")>=Q)||!X.rows.some((Q)=>Q.routeId===J.routeId&&Q.credentialId===J.credentialId&&Q.accountIdentity===J.accountIdentity))throw new Y$("invalid-journal");return{kind:"activation",phase:$.phase,primary:J,roster:X,localProof:Y,removeIds:G,settings:A2($.settings,["source","target"],oZ),runtime:A2($.runtime,["source","target"],oZ),hostAuth:A2($.hostAuth,["source","expected"],F0)}}function PJ($,Z){let J=AK($);if(!k4(J)||!z4(J,["version","storageId","host","phase","sources","routingPaths","hostAuthPath","expectedHostAuth","expectedRouting","preparedProof","activation"])||J.version!==4||J.storageId!==Z||J.host!=="opencode"&&J.host!=="pi"||!u5(J.phase)||!PO(J.sources)||!_O(J.routingPaths)||!m5(J.hostAuthPath)||J.expectedHostAuth!=="unprepared"&&!F0(J.expectedHostAuth)||J.expectedRouting!=="unprepared"&&!w9(J.expectedRouting))throw new Y$("invalid-journal");let X=J.expectedHostAuth==="unprepared",Y=J.preparedProof===null?null:MJ(J.preparedProof);if(X!==(J.expectedRouting==="unprepared")||X!==(Y===null)||J.phase==="building"&&!X||J.phase!=="building"&&J.phase!=="verified"&&X||!X&&J.sources.routing===null!==(J.expectedRouting===null))throw new Y$("invalid-journal");return{version:4,storageId:Z,host:J.host,phase:J.phase,sources:{config:J.sources.config,state:J.sources.state,hostAuth:J.sources.hostAuth,routing:J.sources.routing},routingPaths:{source:J.routingPaths.source,destination:J.routingPaths.destination},hostAuthPath:J.hostAuthPath,expectedHostAuth:J.expectedHostAuth,expectedRouting:J.expectedRouting,preparedProof:Y,activation:RO(J.activation,J.phase)}}async function Q7($){try{let Z=await T$("journal",$.journal);if(!Z.data)return;if(!Z.metadata||(Z.metadata.mode&511)!==384||process.getuid&&Z.metadata.uid!==process.getuid())throw new Y$("invalid-journal");return PJ(Z.data,$.storageId)}catch{throw new Y$("invalid-journal")}}function TO($){if(!$)return;if($.phase!=="committed"&&$.phase!=="retired")return;if($.activation!==null&&($.activation.kind!=="activation"||$.activation.phase!=="committed"))return;return $.phase}async function p5($){let Z=await Q7($);if(!Z)throw new Y$("migration-required");if(!TO(Z))throw new Y$("migration-incomplete")}function RK($){if($===null||typeof $!=="object")return;for(let Z of Object.values($))RK(Z);Object.freeze($)}async function _J($,Z,J,X){let Y=PJ(Z,$.storageId);if(Y.preparedProof){for(let G of Y.preparedProof.rows)Object.freeze(G);Object.freeze(Y.preparedProof.rows),Object.freeze(Y.preparedProof)}Object.freeze(Y.sources),Object.freeze(Y.routingPaths),RK(Y.activation),Object.freeze(Y),await u8($.journal,Y,{beforeRename:async()=>{await X.onWriteStep?.("before-write",Y),await X.assertOwned?.(),await J()}}),await X.onWriteStep?.("after-write",Y)}async function FO($,Z,J={}){try{BJ(Z)}catch{throw new Y$("invalid-journal")}let X=PJ({version:4,storageId:$.storageId,host:Z.host,phase:"building",sources:Z.sources,routingPaths:Z.routingPaths,hostAuthPath:Z.hostAuthPath,expectedHostAuth:"unprepared",expectedRouting:"unprepared",preparedProof:null,activation:Z.activation===void 0?null:Z.activation==="requested"?{kind:"requested"}:"invalid"},$.storageId);return d$($.journal,{name:"migration-journal",ttlMs:30000,timeoutMs:15000,...J.lockOptions,renew:!0},async(Y)=>{let G=await Q7($);if(G){if(G.host!==X.host||G.sources.config!==X.sources.config||G.sources.state!==X.sources.state||G.sources.hostAuth!==X.sources.hostAuth||G.sources.routing!==X.sources.routing||G.routingPaths.source!==X.routingPaths.source||G.routingPaths.destination!==X.routingPaths.destination||G.hostAuthPath!==X.hostAuthPath||G.activation===null!==(X.activation===null))throw new Y$("journal-conflict");return G}return await _J($,X,()=>Y.assertOwned(),J),X})}async function CO($,Z,J={}){let X=AK(Z);if(!k4(X)||!z4(X,["expectedHostAuth","expectedRouting","preparedProof"])||!F0(X.expectedHostAuth)||!w9(X.expectedRouting))throw new Y$("invalid-journal");let{expectedHostAuth:Y,expectedRouting:G}=X,z=MJ(X.preparedProof);return d$($.journal,{name:"migration-journal",ttlMs:30000,timeoutMs:15000,...J.lockOptions,renew:!0},async(Q)=>{let K=await Q7($);if(!K)throw new Y$("migration-required");if(K.phase!=="verified"||K.sources.routing===null!==(G===null))throw new Y$("journal-conflict");if(K.expectedHostAuth!=="unprepared"){if(K.expectedHostAuth!==Y||K.expectedRouting!==G||O$(K.preparedProof)!==O$(z))throw new Y$("journal-conflict");return K}let W={...K,expectedHostAuth:Y,expectedRouting:G,preparedProof:z};return await _J($,W,()=>Q.assertOwned(),J),W})}async function qZ($,Z,J,X={}){if(!u5(Z)||!u5(J)||y5.indexOf(J)!==y5.indexOf(Z)+1)throw new Y$("journal-conflict");return d$($.journal,{name:"migration-journal",ttlMs:30000,timeoutMs:15000,...X.lockOptions,renew:!0},async(Y)=>{let G=await Q7($);if(!G)throw new Y$("migration-required");if(G.phase===J)return G;if(G.phase!==Z)throw new Y$("journal-conflict");if(J==="activation-installed"&&G.expectedHostAuth==="unprepared")throw new Y$("journal-conflict");let z={...G,phase:J};return await _J($,z,()=>Y.assertOwned(),X),z})}var SO=["paths","publicationGuard","externalPolicy","failurePolicy","now","refreshToken","resolveIdentity"],I3=["legacyConfig","legacyState","config","state","runtime","journal","roster","storageId"],kO=["checkedAt","nextRetryAt","retryCount"];function rZ($){return TypeError(`Native local credential service option ${$} is invalid`)}function wJ($,Z){if($===null||typeof $!=="object"||QO.isProxy($)||Object.getPrototypeOf($)!==Object.prototype&&Object.getPrototypeOf($)!==null)return;let J=Object.getOwnPropertyDescriptors($);for(let X of Reflect.ownKeys(J)){let Y=J[X];if(typeof X!=="string"||!Z.includes(X)||!Y||!Object.hasOwn(Y,"value"))return}return J}function R2($,Z){let J=$[Z]?.value;if(typeof J!=="function")throw rZ(Z);return J}function T2($,Z){let J=$[Z]?.value;if(J===void 0)return;if(typeof J!=="function")throw rZ(Z);return J}function vO($){let Z=wJ($,I3);if(!Z)throw rZ("paths");let J={};for(let X of I3){let Y=Z[X]?.value;if(typeof Y!=="string"||Y.length===0)throw rZ("paths");J[X]=Y}return Object.freeze(J)}function M3($){let Z=structuredClone($),J=(X)=>{if(X===null||typeof X!=="object")return;for(let Y of Object.values(X))J(Y);Object.freeze(X)};return J(Z),Z}function fO($){let Z=wJ($,kO);if(!Z||!Object.hasOwn(Z,"checkedAt"))throw TypeError("Native local failure policy result is invalid");let J=(G)=>Z[G]?.value,X=J("nextRetryAt"),Y=J("retryCount");return Object.freeze({checkedAt:J("checkedAt"),...X!==void 0?{nextRetryAt:X}:{},...Y!==void 0?{retryCount:Y}:{}})}function EO($){let Z=wJ($,SO);if(!Z)throw TypeError("Native local credential service options are invalid");let J=vO(Z.paths?.value),X=R2(Z,"publicationGuard"),Y=R2(Z,"externalPolicy"),G=R2(Z,"failurePolicy"),z=T2(Z,"now"),Q=T2(Z,"refreshToken"),K=T2(Z,"resolveIdentity");async function W(q,N){if(await X(q)!==!0)return;let U={beforePublish:async()=>{if(await X(q)!==!0)throw new b("publication-refused")}};try{await N(U)}catch(L){if(L instanceof b&&L.code==="publication-refused"&&await X(q)!==!0)return;throw L}}async function V(q){let N=M3(q);if((N.status==="persisted"||N.status==="validation-observed")&&N.bootstrap==="resolved"){let D=N.context?.runtimeBinding;await W(N,(w)=>D&&D.identity===void 0?cx(J,N,w):ix(J,N,w));return}if(N.status!=="failed"&&N.status!=="persisted")return;let U=$K(N);if(U.kind==="none")return;let L=fO(G(Object.freeze({observation:N,attribution:M3(U)})));await W(N,(D)=>ax(J,N,L,D))}let B=LO({paths:J,quota:l4,...z?{now:z}:{},...Q?{refreshToken:Q}:{},...K?{resolveIdentity:K}:{},...KO({paths:J,externalPolicy:Y,...z?{now:z}:{}}),reconcile:V});function j(q,N){return{status:"refused",reason:q instanceof Y$?q.code:"authority-unavailable",persisted:N}}async function H(q){try{await p5(J)}catch(U){return j(U,!1)}let N=await B.authorize(q);if(N.status!=="usable")return N;return p5(J).then(()=>N,(U)=>j(U,N.source==="rotated"))}return Object.freeze({authorize:H})}var P3=new WeakMap,bO=0;function TK($){if(!$)return;let Z=P3.get($);if(Z===void 0)Z=++bO,P3.set($,Z);return Z}function hO($){let Z=$.env??process.env,J=o9($.host,Z),X=AJ($.host,Z),Y=$.paths;return JSON.stringify([$.host,Y.storageId,...["legacyConfig","legacyState","config","state","runtime","journal","roster"].map((G)=>V9(Y[G])),V9(J.tokenPath),V9(J.statePath),V9(X)])}function AJ($,Z){return V9(mG($==="pi"?Z.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE:void 0,$==="pi"?{...Z,OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE:void 0}:Z))}class RJ{entries=new Map;acquire($,Z){let J=this.entries.get($);if(!J)J={runtime:Z(),users:0},this.entries.set($,J);let X=J;X.users++;let Y=!1;return{use:()=>{if(Y)throw new a("closed");return X.runtime},close:()=>{if(Y)return;if(Y=!0,--X.users!==0)return;if(this.entries.get($)===X)this.entries.delete($);X.runtime.close()}}}}var _3="Anthropic account update in progress; retry the request",FK=new WeakSet;class c5 extends Error{constructor(){super(_3);let $={name:"NativeTransientAccountError",message:_3,code:"ECONNRESET",syscall:"native-account-update"};for(let[Z,J]of Object.entries($))Object.defineProperty(this,Z,{value:J,enumerable:Z==="code"||Z==="syscall",writable:!1,configurable:!1});FK.add(this)}}function DF($){return typeof $==="object"&&$!==null&&FK.has($)}var gO=2000;async function yO($,Z,J,X=Date.now){let Y=performance.now(),G=()=>gO-(performance.now()-Y),z=[],Q="joined",K;try{for(let V of G7($)){for(;;){if(J(),G()<=0){Q="deadline";break}let B=await _6({path:V.path,name:V.name,ttlMs:y$.ttlMs,renew:!1,now:X});if(B)z.push(B);if(G()<=0){Q="deadline";break}if(B)break;await uO(Math.min(y$.retryMs,G()),Z)}if(Q==="deadline")break}}catch(V){K={error:V}}let W;for(let V of z.reverse()){let[B]=await Promise.allSettled([V.release()]);if(B.status==="rejected")W??={error:B.reason}}if(K)throw K.error;if(W)throw W.error;return J(),Q}function uO($,Z){if(Z.some((J)=>J.aborted))return Promise.resolve();return new Promise((J)=>{let X=()=>{clearTimeout(Y);for(let G of Z)G.removeEventListener("abort",X);J()},Y=setTimeout(X,$);for(let G of Z)G.addEventListener("abort",X,{once:!0})})}function J9($,Z,J,X){return pO($)===Z?lO(cO($),J):$.replace(/(?:\.json)?$/,`.${X}.json`)}function CK($){let Z=J9($.legacyConfig,"anthropic-auth.json","anthropic-auth-vault-settings.json","vault-settings"),J=J9($.legacyState,"anthropic-auth-state.json","anthropic-auth-vault-store-state.json","vault-store"),X=J9($.legacyState,"anthropic-auth-state.json","anthropic-auth-vault-state.json","vault-native"),Y=J9($.legacyState,"anthropic-auth-state.json","anthropic-auth-vault-roster.json","vault-roster"),G=J9($.legacyState,"anthropic-auth-state.json","anthropic-auth-vault-routing-state.json","vault-routing"),z=[Z,J,X,Y,G],Q=[$.legacyConfig,$.legacyState,$.config,$.state,$.runtime,$.journal,$.roster];if(new Set([...Q,...z]).size!==Q.length+z.length)throw Error("Vault storage overlaps local account storage");return{legacySeedConfig:$.legacyConfig,config:Z,state:J,runtime:X,roster:Y,routing:G,storageId:mO("sha256").update(JSON.stringify(["anthropic-vault",Z,J])).digest("hex")}}Y4();function sO($){switch($){case"roster-incomplete":case"unenrolled-local-row":case"roster-route-conflict":case"seed-conflict":return $;default:return"seed-conflict"}}class l5 extends Error{code;constructor($){let Z=sO($);super(`Native roster seed refused: ${Z}`);this.name="NativeRosterSeedError",this.code=Z}}function SK($){let Z={fallback:"seed-conflict"},J=(X)=>{throw Z.refused=X,new l5(X)};try{return $(Z,J)}catch{throw new l5(Z.refused??Z.fallback)}}function o$($){return typeof $==="string"&&$.trim()!==""}function C0($,Z,J){if(typeof $!=="object"||$===null||dO.isProxy($))J(Z);return $}function S0($,Z,J,X){let Y=Object.getOwnPropertyDescriptor($,Z);if(Y===void 0)return;if(Object.hasOwn(Y,"get")||Object.hasOwn(Y,"set"))X(J);return Y.value}function m6($,Z,J,X){let Y=C0($,J,X),G={};for(let z of Z)G[z]=S0(Y,z,J,X);return G}function i5($,Z,J){let X=C0($,Z,J);if(!Array.isArray(X))J(Z);let Y=S0(X,"length",Z,J);if(typeof Y!=="number")J(Z);return Y}function E6($,Z,J){let X=C0($,Z,J),Y=i5(X,Z,J),G=[];for(let z=0;z<Y;z++)G.push(S0(X,String(z),Z,J));return G}function kK($,Z,J){let X=C0($,"seed-conflict",J),Y=(_,S)=>S0(X,_,S,J);Z.fallback="roster-incomplete";let G=m6(Y("inventory","roster-incomplete"),["view","credentials","skipped"],"roster-incomplete",J),z=G.view,Q=E6(G.skipped,"roster-incomplete",J),K=E6(G.credentials,"roster-incomplete",J).map((_)=>m6(_,["credentialId","credentialType","accountIdentity","state"],"roster-incomplete",J));if(!o$(z)||Q.length>0)J("roster-incomplete");let W=new Map;for(let _ of K){let{credentialId:S,credentialType:I,accountIdentity:F,state:A}=_;if(!o$(S)||!o$(F)||!o$(A)||W.has(S))J("roster-incomplete");W.set(S,{credentialType:I,accountIdentity:F,state:A})}let V=m6(Y("primary","roster-incomplete"),["credentialId","accountIdentity"],"roster-incomplete",J),B=V.credentialId,j=V.accountIdentity;Z.fallback="seed-conflict";let H=Y("primaryRouteId","seed-conflict"),q=E6(Y("legacyRows","seed-conflict"),"seed-conflict",J).map((_)=>m6(_,["routeId","scopedCredentialId","anthropicAccountUuid","label","addedAt","enabled"],"seed-conflict",J)),N=E6(Y("disabledAccountIdentities","seed-conflict"),"seed-conflict",J),U=E6(Y("reservedRouteIds","seed-conflict"),"seed-conflict",J);for(let _ of[...N,...U])if(typeof _!=="string")J("seed-conflict");let L=new Set(N),D=new Set(U);function w(_,S){let I=W.get(_);if(I?.credentialType!=="oauth"||I.accountIdentity!==S)J("roster-incomplete");return I.state}if(!o$(B)||!o$(j))J("roster-incomplete");let O=w(B,j);for(let _ of q)if(!o$(_.scopedCredentialId))J("unenrolled-local-row");let x=q.map((_)=>{let{scopedCredentialId:S,anthropicAccountUuid:I}=_;if(!o$(S)||!o$(I))J("roster-incomplete");return{row:_,credentialId:S,identity:I,state:w(S,I)}}),C=new Set;for(let _ of[H,...q.map((S)=>S.routeId)]){if(!o$(_)||_==="main"||D.has(_)||C.has(_))J("roster-route-conflict");C.add(_)}if(!o$(H))J("roster-route-conflict");let v=new Set([B]),k=new Set([j]),m=x.map(({row:_,credentialId:S,identity:I,state:F})=>{if(v.has(S)||k.has(I))J("seed-conflict");v.add(S),k.add(I);let{routeId:A,label:R,addedAt:T,enabled:E}=_;if(!o$(A)||typeof E!=="boolean"||T!==void 0&&(typeof T!=="number"||!Number.isFinite(T))||R!==void 0&&typeof R!=="string")J("seed-conflict");return{routeId:A,credentialId:S,credentialType:"oauth",accountIdentity:I,state:F,label:o$(R)?R:A,enabled:E,addedAt:T??0}}),l=[{routeId:H,credentialId:B,credentialType:"oauth",accountIdentity:j,state:O,label:H,enabled:!L.has(j),addedAt:0},...m],P=l.filter((_)=>!_.enabled).map((_)=>({credentialId:_.credentialId,accountIdentity:_.accountIdentity,exactCredential:!0})),M=[...L].filter((_)=>!k.has(_)).sort();for(let _ of M){let S=[...W].filter(([,I])=>I.accountIdentity===_).map(([I])=>I).sort()[0];if(S!==void 0)P.push({credentialId:S,accountIdentity:_,exactCredential:!1})}return{view:z,rows:l,declined:P,unseeded:new Set(M)}}function d5($){return SK((Z,J)=>{let X=kK($,Z,J);return{version:1,view:X.view,complete:!0,rows:X.rows.map((Y)=>({...Y})),declined:X.declined.map(({credentialId:Y,accountIdentity:G})=>({credentialId:Y,accountIdentity:G}))}})}function tO($,Z){SK((J,X)=>{let Y=kK(Z,J,X);J.fallback="seed-conflict";let G=m6($,["version","complete","view","rejected","rows","declined"],"seed-conflict",X),{version:z,complete:Q,view:K,rejected:W}=G,V=E6(G.rows,"seed-conflict",X).map((U)=>m6(U,["routeId","credentialId","credentialType","accountIdentity","aliases","label","addedAt","enabled","stale","unclaimed"],"seed-conflict",X)),B=E6(G.declined,"seed-conflict",X).map((U)=>m6(U,["credentialId","accountIdentity"],"seed-conflict",X));if(z!==1||Q!==!0||typeof K!=="string"||W!==void 0&&i5(W,"seed-conflict",X)>0||V.length!==Y.rows.length)X("seed-conflict");let j=new Map(Y.rows.map((U)=>[U.routeId,U])),H=new Set;for(let U of V){let L=typeof U.routeId==="string"?j.get(U.routeId):void 0;if(!L||H.has(L.routeId)||U.credentialId!==L.credentialId||U.credentialType!=="oauth"||U.accountIdentity!==L.accountIdentity||U.aliases!==void 0&&i5(U.aliases,"seed-conflict",X)>0||U.label!==L.label||U.addedAt!==L.addedAt||U.enabled!==L.enabled||U.stale!==void 0||U.unclaimed!==void 0)X("seed-conflict");H.add(L.routeId)}let q=new Map(Y.declined.map((U)=>[U.accountIdentity,U])),N=new Set;for(let{credentialId:U,accountIdentity:L}of B){if(typeof U!=="string"||typeof L!=="string"||N.has(L))X("seed-conflict");let D=q.get(L);if(D?D.exactCredential&&U!==D.credentialId:!Y.unseeded.has(L))X("seed-conflict");N.add(L)}for(let U of q.keys())if(!N.has(U))X("seed-conflict")})}function vK($,Z,J){return{profile:{tier:$.tier,orgType:$.orgType,checkedAt:$.checkedAt,...$.accountIdentity!==void 0&&{accountIdentity:$.accountIdentity},...$.providerAccountUuid!==void 0&&{providerAccountUuid:$.providerAccountUuid}},persisted:Promise.resolve().then(Z).then((X)=>X?"saved":"refused",(X)=>X instanceof a||X instanceof Y$||X instanceof b&&X.code!=="runtime-io"?"refused":"failed"),isCurrent:()=>Promise.resolve().then(J).then((X)=>X,()=>!1)}}async function wF($,Z){let J={...$.env??process.env},X=AJ($.host,J),Y=_K({host:$.host,readToken:$.readToken,now:$.now,env:J,connect:$.connect??(()=>H4.connect({connectionFile:X,identity:$.identity}))});try{return await Y.discover(Z)}finally{Y.close()}}function aO($){let Z=Object.freeze(CK($.paths)),J={...$.env??process.env},X=AJ($.host,J),Y=$.identity?{...$.identity}:void 0,G=new AbortController,z=U6({paths:Z,quota:l4}),Q=_K({host:$.host,readToken:$.readToken,now:$.now,connect:$.connect??(()=>H4.connect({connectionFile:X,identity:Y})),env:J}),K=new WeakMap,W=new WeakSet,V=new Map,B=new Set(["main"]),j,H=new Set,q,N,U;function L(){let I=[...H].filter((A)=>A.intervalMs>0).sort((A,R)=>A.intervalMs-R.intervalMs)[0];if(U?.ms===I?.intervalMs)return;if(U)U.clear(U.handle);if(U=void 0,!I)return;let F=(I.setInterval??setInterval)(()=>{D().catch(()=>{})},I.intervalMs);F.unref?.(),U={handle:F,clear:I.clearInterval??clearInterval,ms:I.intervalMs}}function D(){if(N)return N;return N=(async()=>{let I=await Promise.all([...H].map(async(F)=>!F.shouldRefresh||await F.shouldRefresh()));if(G.signal.aborted||!I.some(Boolean))return;if(await l.refresh(G.signal),G.signal.aborted)return;for(let F of H)Promise.resolve().then(()=>{if(H.has(F))return F.onRefresh?.()}).catch(()=>{})})().finally(()=>{N=void 0}),N}function w(I){if(G.signal.aborted)throw new a("closed");I?.throwIfAborted()}function O(I){return w(I),AbortSignal.any([G.signal,...I?[I]:[]])}async function x(){w();let I=await BZ($.host,J);return w(),I==="claustrum"}async function C(I){if(w(I),!await x())throw new a("route-unavailable");w(I)}async function v(I,F=!1){if(await C(I),F&&!await KZ(Z.config))return;await N6(Z.roster,async(A,R)=>{if(F&&!await KZ(Z.config))return{result:void 0};let T=A?.rows.find((c)=>(c.credentialId===y7||c.aliases?.includes(y7))&&c.credentialType==="oauth"&&c.state==="active"&&!c.stale&&!c.unclaimed&&typeof c.accountIdentity==="string"&&c.accountIdentity.length>0),E=await z.readSettings();if(E.status!=="ready")throw new a("invalid-state");let f=tZ(E.settings);if(!F&&(!T&&!f||T&&f?.routeId===T.routeId&&f.credentialId===y7&&f.accountIdentity===T.accountIdentity))return{result:void 0};return await U6({paths:Z,quota:l4,onStep:async(c)=>{if(c==="before-config-write"||c==="before-state-write")await C(I),await R.assertOwned()}}).updateSettings(async(c)=>{if(F&&!await KZ(Z.config))return c;if(T)c.mainAccountId=T.routeId,c.claustrum={primaryAccount:{credentialId:y7,accountId:T.accountIdentity}};else delete c.mainAccountId,delete c.claustrum;return c}),{result:void 0}})}async function k(I,F){let A=await z.readSettings();if(A.status!=="ready")throw new a("invalid-state");let R=tZ(A.settings);return F==="main"||F===R?.routeId?f5(I,R):I?.rows.find((T)=>T.routeId===F)}function m(I){w();let F=K.get(I);if(!F)throw new a("no-receipt");return F}let l={watch(I){if(w(),!Number.isFinite(I.intervalMs)||I.intervalMs<0)throw RangeError("Invalid native vault poll interval");let F={...I};H.add(F),L(),q??=D();let A=!1;return{ready:q,close(){if(A)return;if(A=!0,H.delete(F),L(),!H.size)q=void 0}}},initializeSettings:()=>v(void 0,!0),async read(){await C();let I=await i$(Z.roster);return w(),I},async refresh(I){if(w(I),!await x())return;return w(I),j??=PK({path:Z.roster,custody:$.discover?{discover:$.discover}:Q,signal:G.signal,isActive:x,projection:()=>({reservedRouteIds:B})}).then(async(F)=>{return await v(G.signal),F}).finally(()=>{j=void 0}),oO(j,O(I))},async authorize(I,F){let A=O(F);await C(A);let R=await i$(Z.roster)??await l.refresh(A),T=await k(R,I);if(T?.credentialType!=="oauth"||!T.accountIdentity)throw new a("route-unavailable");if(!T.enabled)throw new a("route-declined");if(T.state!=="active")throw new a("not-active");let E=await Q.authorize({credentialId:T.credentialId,accountIdentity:T.accountIdentity},A);await C(A);let f=await k(await i$(Z.roster),I);if(!f?.enabled||f.routeId!==T.routeId||f.accountIdentity!==T.accountIdentity||f.credentialId!==E.credentialId&&!f.aliases?.includes(E.credentialId))throw new a("identity-changed");if(f.state!=="active")throw new a("not-active");w(A),K.set(E,{routeId:T.routeId,logicalId:I});let h=JSON.stringify([T.routeId,E.credentialId,E.assertedAccountIdentity]);return V.set(h,Math.max(V.get(h)??0,E.recordVersion)),E},async reportFailure(I,F,A){m(I),await Q.reportFailure(I,F,A)},async prepareRetry(I,F,A){let R=m(I),T=async()=>{if(W.has(I))return[{retry:!1,reason:"version-not-newer"},void 0];W.add(I);let h;try{h=await l.authorize(R.logicalId,F)}catch(c){return w(F),[{retry:!1,reason:"reauthorize-failed",code:c instanceof a?c.code:"unavailable"},void 0]}if(h.credentialId!==I.credentialId)return[{retry:!1,reason:"credential-changed"},h];if(h.assertedAccountIdentity!==I.assertedAccountIdentity)return[{retry:!1,reason:"account-changed"},h];if(!(h.recordVersion>I.recordVersion))return[{retry:!1,reason:"version-not-newer"},h];return W.add(h),[{retry:!0,receipt:h},h]},[E,f]=await T();if(A)d.debug("claustrum","scoped 401 re-authorized",{site:A,credentialId:I.credentialId,servedVersion:I.recordVersion,currentVersion:f?.recordVersion??null,retry:E.retry,reason:E.retry?"rotated":E.reason});return E},publish(I,F){let A=ZK(F);return M(I,(R)=>JK(R,A),nO(A)?"skip":"refuse")},resetBackoff(I,F="all"){return M(I,(A)=>{let R=Math.max($.now?.()??Date.now(),A.refreshErrorClearedAt??0,A.quotaErrorClearedAt??0,A.lastRefreshError?.checkedAt??0,A.lastQuotaRefreshError?.checkedAt??0),T={...A};if(F!=="quota")delete T.lastRefreshError,T.refreshErrorClearedAt=R;if(F!=="refresh")delete T.lastQuotaRefreshError,T.quotaErrorClearedAt=R,T.quotaErrorGeneration=(A.quotaErrorGeneration??0)+1;return T})},async getOrCreateAuthLineage(I){let F;return await M(I,(R)=>{return F=R.authLineageId??iO(),{...R,authLineageId:F}})?F:void 0},incrementPrimeUsage(I,F={}){let A=F.inputTokens??0,R=F.outputTokens??0;if(![A,R].every((T)=>Number.isSafeInteger(T)&&T>=0))throw new b("publication-refused");return M(I,(T)=>({...T,prime:{count:(T.prime?.count??0)+1,inputTokens:(T.prime?.inputTokens??0)+A,outputTokens:(T.prime?.outputTokens??0)+R,since:T.prime?.since??$.now?.()??Date.now()}}))},async fetchQuota(I,F=fetch,A,R){let T=await k(await l.read(),I),E=await p4(Z.runtime,Z.storageId),f=E.status==="ready"?E.state.accounts[T?.routeId??""]:void 0,h=(i)=>{let p=K.get(i),r=f?.binding;return p&&r?.kind==="custody"&&r.storageId===Z.storageId&&r.routeId===p.routeId&&r.credentialId===i.credentialId&&r.accountIdentity===i.assertedAccountIdentity&&r.recordVersion<=i.recordVersion?f:void 0},c=await _(I,F,A,(i,p)=>F9({accessToken:i.accessToken,fetchImpl:p,now:$.now}),async(i,p)=>{let r=h(p),H$=XK(i,p.assertedAccountIdentity,Math.max($.now?.()??Date.now(),(r?.quotaErrorClearedAt??-1)+1),r?.lastQuotaRefreshError);if(H$)await l.publish(p,{lastQuotaRefreshError:H$})},R),e={...c.value,accountIdentity:c.receipt.assertedAccountIdentity},o=h(c.receipt);return await l.publish(c.receipt,{quota:e,quotaErrorClearedAt:Math.max(e.checkedAt??$.now?.()??Date.now(),o?.quotaErrorClearedAt??0,o?.lastQuotaRefreshError?.checkedAt??0)}),e},async fetchProfile(I,F=fetch,A){let R=await S(I,F,A);return await l.publish(R.receipt,{profile:R.value}),R.value},async fetchProfileForDisplay(I,F=fetch,A){let R=await S(I,F,A);return vK(R.value,()=>l.publish(R.receipt,{profile:R.value}),P(R.receipt))},async setEnabled(I,F){await C();let A=await i$(Z.roster),R=await k(A,I);if(!R)throw new a("route-unavailable");return N6(Z.roster,(T)=>{let E=T?.rows.find((f)=>f.routeId===R.routeId);if(!T||!E)throw new n("route-unavailable","Claustrum route is not in the roster");return{next:{...T,declined:F?MK(T.declined,[E.credentialId,...E.aliases??[]],E.accountIdentity):IK(T.declined,E.credentialId,E.accountIdentity),rows:T.rows.map((f)=>f===E?{...f,enabled:F}:f)},result:E.enabled!==F}})},close(){if(H.clear(),L(),G.signal.aborted)return;G.abort(new a("closed")),Q.close()}};function P(I){let{routeId:F,logicalId:A}=m(I),R={routeId:F,logicalId:A,credentialId:I.credentialId,accountIdentity:I.assertedAccountIdentity,recordVersion:I.recordVersion},T=JSON.stringify([F,R.credentialId,R.accountIdentity]);return async()=>{await C();let E=await k(await i$(Z.roster),R.logicalId);if(!E?.enabled||E.state!=="active"||E.routeId!==R.routeId||E.accountIdentity!==R.accountIdentity||E.credentialId!==R.credentialId&&!E.aliases?.includes(R.credentialId)||(V.get(T)??0)>R.recordVersion)return!1;let f=await p4(Z.runtime,Z.storageId);if(f.status==="missing")return!0;if(f.status!=="ready")return!1;let h=f.state.accounts[R.routeId]?.binding;return!h||h.kind==="custody"&&h.accountIdentity===R.accountIdentity&&h.credentialId===R.credentialId&&h.recordVersion<=R.recordVersion}}async function M(I,F,A="refuse"){let R=m(I);await C();let T=JSON.stringify([R.routeId,I.credentialId,I.assertedAccountIdentity]);if((V.get(T)??0)>I.recordVersion)return!1;return N6(Z.roster,async(E,f)=>{let h=await k(E,R.logicalId);if(!h?.accountIdentity||h.routeId!==R.routeId||h.accountIdentity!==I.assertedAccountIdentity||h.credentialId!==I.credentialId&&!h.aliases?.includes(I.credentialId))return{result:!1};let c=h.accountIdentity,e=!1;try{if((await ux(Z.runtime,Z.storageId,(i)=>{let p=i.accounts[R.routeId],r=p?.binding;if(r?.kind==="custody"&&r.credentialId===I.credentialId&&r.accountIdentity===I.assertedAccountIdentity&&r.recordVersion>I.recordVersion)throw new b("runtime-conflict");let H$=r?.kind==="custody"&&r.accountIdentity===I.assertedAccountIdentity;return i.accounts[R.routeId]=F({...H$?p:{},binding:{kind:"custody",storageId:Z.storageId,routeId:R.routeId,credentialId:I.credentialId,accountIdentity:c,recordVersion:I.recordVersion}}),e=!0,i},{beforeRename:async()=>{await C();let i=await k(E,R.logicalId);if(!i||i.routeId!==R.routeId||i.accountIdentity!==I.assertedAccountIdentity)throw new b("publication-refused");let p=(V.get(T)??0)>I.recordVersion;if(p&&A==="refuse")throw new b("runtime-conflict");return await f.assertOwned(),p?"skip":"publish"}})).status==="skipped")return{result:!1}}catch(o){if(o instanceof b&&o.code==="runtime-conflict")return{result:!1};throw o}return{result:e}})}async function _(I,F,A,R,T,E){let f=O(A),h=await l.authorize(I,f),c=(p,r)=>{let H$=()=>F(p,{...r,signal:f});if(!E)return H$();return E(H$,async()=>{await C(f);let V$=m(h),s$=await k(await i$(Z.roster),V$.logicalId),i8=JSON.stringify([V$.routeId,h.credentialId,h.assertedAccountIdentity]);if(!s$?.enabled||s$.state!=="active"||s$.routeId!==V$.routeId||s$.accountIdentity!==h.assertedAccountIdentity||s$.credentialId!==h.credentialId&&!s$.aliases?.includes(h.credentialId)||(V.get(i8)??h.recordVersion)>h.recordVersion)throw new a("identity-changed");await C(f)})},e,o=Object.assign(async(p,r)=>{e=void 0;let H$=await c(p,r);if(e=H$.status,H$.status===401&&!f.aborted){await H$.body?.cancel().catch(()=>{});let V$=(k0)=>l.reportFailure(k0,401,"direct").catch(()=>{w(f)}),s$=h,i8;try{i8=await l.prepareRetry(s$,f,"quota-profile")}catch(k0){throw await V$(s$),k0}if(!i8.retry)return await V$(s$),H$;h=i8.receipt;let kJ=new Headers(r?.headers);if(kJ.set("authorization",`Bearer ${h.accessToken}`),e=void 0,H$=await c(p,{...r,headers:kJ}),e=H$.status,H$.status===401)await V$(h)}return H$},{preconnect:F.preconnect}),i;try{i=await R(h,o)}catch(p){w(f);let r=p instanceof a||p instanceof b?p:GK(p,e);throw await T?.(r,h),r}return w(f),{value:i,receipt:h}}function S(I,F,A){return _(I,F,A,(R,T)=>i1({accessToken:R.accessToken,accountIdentity:R.assertedAccountIdentity,fetchImpl:T,now:$.now,signal:A}))}return l}function nO($){let Z=Object.keys($);return Z.length===1&&Z[0]==="lastUsed"&&typeof $.lastUsed==="number"}function oO($,Z){return new Promise((J,X)=>{let Y=()=>{G(),X(Z.reason)},G=()=>Z.removeEventListener("abort",Y);if(Z.addEventListener("abort",Y,{once:!0}),$.then((z)=>{G(),Z.aborted?X(Z.reason):J(z)},(z)=>{G(),X(z)}),Z.aborted)Y()})}var rO=new RJ;function fK($){return JSON.stringify([hO($),$.identity?Object.entries($.identity).sort(([Z],[J])=>Z.localeCompare(J)):void 0,...[$.connect,$.discover,$.readToken,$.now].map(TK)])}function eO($){let{use:Z,close:J}=rO.acquire(fK($),()=>aO($));return EK(Z,J)}function EK($,Z){let J=new Set;return{watch:(X)=>{let Y=$().watch(X);return J.add(Y),{ready:Y.ready,close(){J.delete(Y),Y.close()}}},initializeSettings:()=>$().initializeSettings(),read:()=>$().read(),refresh:(X)=>$().refresh(X),authorize:(X,Y)=>$().authorize(X,Y),reportFailure:(X,Y,G)=>$().reportFailure(X,Y,G),prepareRetry:(X,Y,G)=>$().prepareRetry(X,Y,G),publish:(X,Y)=>$().publish(X,Y),fetchQuota:(X,Y,G,z)=>$().fetchQuota(X,Y,G,z),fetchProfile:(X,Y,G)=>$().fetchProfile(X,Y,G),fetchProfileForDisplay:(X,Y,G)=>$().fetchProfileForDisplay(X,Y,G),setEnabled:(X,Y)=>$().setEnabled(X,Y),resetBackoff:(X,Y)=>$().resetBackoff(X,Y),getOrCreateAuthLineage:(X)=>$().getOrCreateAuthLineage(X),incrementPrimeUsage:(X,Y)=>$().incrementPrimeUsage(X,Y),close(){for(let X of J)X.close();J.clear(),Z()}}}var gK="main",WI=900000,w3=604800000,VI=3600000,BI=1e4,qI=5000,jI=10,A3=4096,HI=0.000001;function FF($){let Z=$.modelId,J=Z?$.routeQuotas.map((j)=>n4(j,Z)).find(Boolean)?.modelName:void 0,X;if(PZ($.mainRefreshError))X=J?`Main Claude OAuth account requires re-login, and no fallback OAuth account is currently routable for ${J}.`:"Main Claude OAuth account requires re-login, and no fallback OAuth account is currently routable.";else if($.fallbackReauthLabels?.length)X=`No OAuth account is currently routable${J?` for ${J}`:""}. Fallback Claude OAuth accounts require re-login: ${$.fallbackReauthLabels.join(", ")}.`;if(X)return new Response(JSON.stringify({type:"error",error:{type:"authentication_error",message:X}}),{status:401,headers:{"content-type":"application/json"}});let Y=Boolean(Z&&$.routeQuotas.length>0&&$.routeQuotas.every((j)=>!Xz(j,Z))),[G,...z]=$.routeQuotas,Q=Lq(G,z.map((j)=>({quota:j})),$.now??Date.now(),Y?Z:void 0),K=Math.floor(Q/60),W=Q%60,B=`${Y&&J?`${J} weekly limit reached, no routable OAuth accounts.`:"No OAuth account currently satisfies sticky-balanced quota policy."} Retry in ${K}m ${W}s.`;return new Response(JSON.stringify({type:"error",error:{type:"rate_limit_error",message:B}}),{status:429,headers:{"content-type":"application/json","retry-after":String(Q)}})}function x6($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function B9($){return typeof $==="number"&&Number.isFinite($)?$:void 0}function yK($){if(!x6($))return;if(typeof $.accountId!=="string"||!["fable","opus","general"].includes(String($.family)))return;let Z=B9($.assignedAt),J=B9($.lastSeenAt),X=B9($.initialInputBytes),Y=B9($.quotaCheckedAt);if(Z===void 0||J===void 0||X===void 0||Y===void 0)return;if(Object.hasOwn($,"affinityModelId")&&typeof $.affinityModelId!=="string")return;if(Object.hasOwn($,"accountIdentity")&&(typeof $.accountIdentity!=="string"||$.accountIdentity.length===0||$.accountIdentity.trim()!==$.accountIdentity))return;return{accountId:$.accountId,...typeof $.accountIdentity==="string"?{accountIdentity:$.accountIdentity}:{},family:$.family,affinityModelId:typeof $.affinityModelId==="string"?$.affinityModelId:void 0,assignedAt:Z,lastSeenAt:J,initialInputBytes:Math.max(0,X),quotaCheckedAt:Y}}function uK($){if(!x6($)||$.version!==1||!x6($.assignments))return;let Z={};for(let[J,X]of Object.entries($.assignments)){let Y=yK(X);if(Y)Z[J]=Y}return{version:1,updatedAt:B9($.updatedAt)??0,assignments:Z,...$.vaultLegacySeed==="pending"||$.vaultLegacySeed==="complete"?{vaultLegacySeed:$.vaultLegacySeed}:{}}}function LI($,Z){try{if(!x6($)||!x6($.assignments))throw Error();let J=Object.entries($.assignments),X=uK({...$,assignments:Object.fromEntries(J.map(([,G],z)=>[String(z),G]))});if(!X||Object.keys($).length!==3||!Object.hasOwn($,"version")||!Object.hasOwn($,"updatedAt")||!Object.hasOwn($,"assignments")||!Object.is($.updatedAt,X.updatedAt))throw Error();for(let G of Z.values())if(typeof G!=="string"||G.length===0||G.trim()!==G)throw Error();let Y=Object.create(null);for(let[G,[z,Q]]of J.entries()){let K=X.assignments[String(G)];if(!x6(Q)||!K)throw Error();let W=Object.keys(K).filter((B)=>B!=="affinityModelId"||Object.hasOwn(Q,"affinityModelId"));if(Object.keys(Q).length!==W.length||W.some((B)=>!Object.hasOwn(Q,B)||!Object.is(Q[B],Reflect.get(K,B))))throw Error();let V=Z.get(K.accountId);if(V===void 0)continue;Y[z]={...K,accountId:V}}return`${JSON.stringify({...X,assignments:Y},null,2)}
+`}catch{throw Error("invalid-source")}}function R3($){return{version:1,updatedAt:$,assignments:{}}}function T3($){return bK("sha256").update($).digest("hex")}function mK($,Z,J=Date.now(),X){let Y=L9(Z);if(!["five_hour","seven_day"].every((Q)=>{let K=$?.[Q];return Boolean(K&&J-K.checkedAt<Y)}))return!1;let z=n4($,X);return!z||J-z.checkedAt<Y}function F3($){return Math.max($.checkedAt??0,$.five_hour?.checkedAt??0,$.seven_day?.checkedAt??0,...($.scoped??[]).map((Z)=>Z.checkedAt??0))}function C8($){if(!$)return;if("kind"in $)return $.kind==="known"?$.quota:void 0;return $}function C3($,Z,J){let X=R1($),Y=J==="five_hour"?X.five_hour:J==="seven_day"?X.seven_day:0;if(!Yz($))return Y;let G=Gz($,Z===gK?void 0:Z);return Math.max(Y,G[J])}function S3($,Z,J,X){let Y=Math.max(0,$-Z);if(Y<=0)return 0;if(!J)return Y;let G=Date.parse(J);if(!Number.isFinite(G)||G<=X)return Y;let z=Math.max((G-X)/3600000,0.016666666666666666);return Y/z}function CF($){if(AU($))return"fable";return typeof $==="string"&&$.toLowerCase().includes("opus")?"opus":"general"}function k3($){let Z=$.now??Date.now(),{candidate:J,storage:X}=$,Y=C8(J.quota);if(!Y)return 0;if(!mK(Y,X,Z,$.modelId))return 0;let G=[];for(let z of["five_hour","seven_day"]){let Q=Y[z];if(!Q||!Number.isFinite(Q.remainingPercent))return 0;G.push(S3(Q.remainingPercent,C3(X,J.accountId,z),Q.resetsAt,Z))}if($.family==="fable"){let z=n4(Y,$.modelId);if(z&&Number.isFinite(z.remainingPercent))G.push(S3(z.remainingPercent,C3(X,J.accountId,"scoped"),z.resetsAt,Z))}return Math.min(...G)}function UI($,Z,J=Date.now()){let X=C8($.quota),Y=n4(X,"claude-fable-5");return Boolean(Y&&mK(X,Z,J,"claude-fable-5")&&Number.isFinite(Y.remainingPercent)&&Y.remainingPercent<=0)}function SF($){let Z=$.now??Date.now(),J=C8($.quota);if(!J)return{action:"retain",reason:"unknown"};let X=n4(J,$.modelId);if(X&&Number.isFinite(X.remainingPercent)&&X.remainingPercent<=0)return{action:"migrate",reason:"model-scoped"};let Y=J.seven_day;if(Y&&Number.isFinite(Y.remainingPercent)&&Y.remainingPercent<=0)return{action:"migrate",reason:"seven-day"};let G=J.five_hour;if(G&&Number.isFinite(G.remainingPercent)&&G.remainingPercent<=0){let z=G.resetsAt?Date.parse(G.resetsAt):NaN;if(Number.isFinite(z)&&z>Z&&z-Z<=WI)return{action:"hold",reason:"five-hour-short-reset",retryAfterSeconds:Math.max(1,Math.ceil((z-Z)/1000))};return{action:"migrate",reason:"five-hour"}}return{action:"retain",reason:"not-exhausted"}}function NI($){let Z=QI($),J=Z.endsWith(".json")?Z.slice(0,-5):Z;return KI(hK($),`${J}-routing-state.json`)}function kF($,Z){let J=bK("sha256").update($).digest().readUInt32BE(0);return Math.max(1,Math.ceil(Z))+J%21}class pK{options;loaded=!1;state;stateMtimeNs;touchChain=Promise.resolve();seedFinalized=!1;constructor($){this.options=$,this.state=R3(this.now())}now(){return this.options.now?.()??Date.now()}async readState(){try{let $=await JI(this.options.path,"utf8"),Z=uK(JSON.parse($));if(!Z)throw Error(`Invalid sticky routing state at ${this.options.path}`);return Z}catch($){if($.code==="ENOENT")return{...R3(this.now()),...this.options.vaultSeed?{vaultLegacySeed:"pending"}:{}};throw $}}async readStateMtimeNs(){try{return(await GI(this.options.path,{bigint:!0})).mtimeNs}catch($){if($.code==="ENOENT")return 0n;throw $}}async refreshStateIfChanged(){for(let $=0;$<3;$++){let Z=await this.readStateMtimeNs();if(this.loaded&&Z===this.stateMtimeNs)return;let J=await this.readState(),X=await this.readStateMtimeNs();if(Z!==X)continue;this.state=J,this.stateMtimeNs=X,this.loaded=!0;return}this.state=await this.readState(),this.stateMtimeNs=await this.readStateMtimeNs(),this.loaded=!0}async acquireLock(){await ZI(hK(this.options.path),{recursive:!0,mode:448});let $=this.now()+qI;while(!0){let Z=await t6({name:"write",path:this.options.path,ttlMs:BI,renew:!0});if(Z)return Z;if(this.now()>=$)throw Error("Timed out acquiring sticky routing state lock");await new Promise((J)=>setTimeout(J,jI))}}assignmentIsActive($){return $.lastSeenAt>=this.now()-(this.options.assignmentTtlMs??w3)}prune($){let Z=this.now()-(this.options.assignmentTtlMs??w3);for(let[X,Y]of Object.entries($.assignments))if(Y.lastSeenAt<Z)delete $.assignments[X];let J=Object.entries($.assignments);if(J.length<=A3)return;J.sort((X,Y)=>Y[1].lastSeenAt-X[1].lastSeenAt).slice(A3).forEach(([X])=>{delete $.assignments[X]})}async writeState($,Z=!0,J){if(Z)this.prune($);$.updatedAt=this.now();let X=`${this.options.path}.${$I()}.tmp`;try{await zI(X,`${JSON.stringify($)}
+`,{mode:384}),await J?.(),await XI(X,this.options.path)}finally{await YI(X,{force:!0}).catch(()=>{})}this.state=$,this.stateMtimeNs=await this.readStateMtimeNs(),this.loaded=!0}async prepareLegacySeed($){let Z=this.options.vaultSeed;if(!Z||this.seedFinalized)return;try{await this.refreshStateIfChanged()}catch{this.seedFinalized=!0;return}if(this.state.vaultLegacySeed!=="pending"){this.seedFinalized=!0;return}let J=$===void 0?await i$(Z.roster):$;if(!J?.complete)return;let X=await this.acquireLock();try{let Y=await this.readState();if(Y.vaultLegacySeed!=="pending"){this.seedFinalized=!0;return}let G=await C5(Z.legacyConfig),z=Sx(G,J),Q=await C5(NI(Z.legacyConfig));if(x6(Q)&&Q.version===1&&x6(Q.assignments))for(let[K,W]of Object.entries(Q.assignments)){if(!/^[0-9a-f]{64}$/.test(K)||Object.hasOwn(Y.assignments,K))continue;let V=yK(W),B=V&&z.get(V.accountId);if(V&&B)Y.assignments[K]={...V,accountId:B.routeId,accountIdentity:B.accountIdentity}}Y.vaultLegacySeed="complete",await this.writeState(Y,!1,()=>X.assertOwned()),this.seedFinalized=!0}finally{await X.release()}}logicalAccountId($){return $.accountId===this.options.vaultSeed?.mainRouteId?gK:$.accountId}setVaultSeed($){this.options.vaultSeed=$}scheduleTouch($){this.touchChain=this.touchChain.catch(()=>{}).then(async()=>{let Z=await this.acquireLock();try{let J=await this.readState(),X=J.assignments[$];if(!X)return;X.lastSeenAt=this.now(),await this.writeState(J)}finally{await Z.release()}}).catch(()=>{})}selectCandidate($){let Z=[...$.candidates];if($.family==="opus"){let Y=Z.filter((G)=>UI(G,$.storage,this.now()));if(Y.length>0)Z=Y}let J=Z.flatMap((Y)=>{let G=k3({candidate:Y,family:$.family,modelId:$.modelId,storage:$.storage,now:this.now()});return G>0?[{candidate:Y,weight:G}]:[]});if(J.length===0&&Z.every((Y)=>!C8(Y.quota)))return[...Z].sort((Y,G)=>Y.order-G.order||Y.accountId.localeCompare(G.accountId))[0];let X=new Map;for(let Y of Object.values($.state.assignments)){let G=J.find((Q)=>Q.candidate.accountId===this.logicalAccountId(Y))?.candidate;if(!G)continue;let z=C8(G.quota);if(z&&Y.quotaCheckedAt!==F3(z))continue;X.set(this.logicalAccountId(Y),(X.get(this.logicalAccountId(Y))??0)+Y.initialInputBytes)}return J.map(({candidate:Y,weight:G})=>({candidate:Y,score:((X.get(Y.accountId)??0)+$.inputBytes)/Math.max(G,HI)})).sort((Y,G)=>Y.score-G.score||Y.candidate.order-G.candidate.order||Y.candidate.accountId.localeCompare(G.candidate.accountId))[0]?.candidate}async resolve($){if(!$.sessionId)return null;await this.prepareLegacySeed(),await this.refreshStateIfChanged();let Z=T3($.sessionId),J=$.affinityModelId??$.modelId,X=(K)=>J!==void 0?K.affinityModelId===J:K.family===$.family,Y=(K)=>{let W=$.accountIdentities?.get(K);return typeof W==="string"&&W.length>0&&W.trim()===W?W:void 0},G=(K)=>{if(!$.accountIdentities)return!0;let W=Y(this.logicalAccountId(K));return W!==void 0&&K.accountIdentity===W},z=this.state.assignments[Z];if(z&&this.assignmentIsActive(z)&&X(z)&&G(z)&&$.retainAccountIds.has(this.logicalAccountId(z))&&!$.excludeAccountIds?.has(this.logicalAccountId(z))){if(this.now()-z.lastSeenAt>=VI)z.lastSeenAt=this.now(),this.scheduleTouch(Z);return{accountId:this.logicalAccountId(z),assignment:{...z},created:!1,migrated:!1}}let Q=await this.acquireLock();try{let K=await this.readState();this.prune(K);let W=K.assignments[Z];if(W&&X(W)&&G(W)&&$.retainAccountIds.has(this.logicalAccountId(W))&&!$.excludeAccountIds?.has(this.logicalAccountId(W)))return W.lastSeenAt=this.now(),await this.writeState(K),{accountId:this.logicalAccountId(W),assignment:{...W},created:!1,migrated:!1};let V=Boolean(W&&!X(W)),B=Boolean(W&&!G(W));if(V||B)delete K.assignments[Z];let j=$.candidates.filter((D)=>!$.excludeAccountIds?.has(D.accountId)&&(!$.accountIdentities||Y(D.accountId)!==void 0)),q=(!V&&!B&&$.preferredAccountId?j.find((D)=>D.accountId===$.preferredAccountId&&k3({candidate:D,family:$.family,modelId:$.modelId,storage:$.storage,now:this.now()})>0):void 0)??this.selectCandidate({...$,candidates:j,state:K});if(!q){if(W)delete K.assignments[Z],await this.writeState(K);return null}let N=this.now(),U=C8(q.quota),L={accountId:q.accountId,...$.accountIdentities?{accountIdentity:Y(q.accountId)}:{},family:$.family,affinityModelId:J,assignedAt:N,lastSeenAt:N,initialInputBytes:Math.max(1,$.inputBytes),quotaCheckedAt:U?F3(U):0};return K.assignments[Z]=L,await this.writeState(K),{accountId:q.accountId,assignment:{...L},created:!W,migrated:Boolean(W&&(B||W.accountId!==q.accountId))}}finally{await Q.release()}}async clear($){if(!$)return;let Z=T3($),J=await this.acquireLock();try{let X=await this.readState();if(!(Z in X.assignments))return;delete X.assignments[Z],await this.writeState(X)}finally{await J.release()}}}var xI=new RJ;function vF($){let Z=JSON.stringify([fK({...$.vault,paths:$.paths,host:$.host}),...[$.beforePoolWrite,$.local?.refreshToken,$.local?.resolveIdentity,$.local?.failurePolicy,$.local?.now].map(TK)]),{use:J,close:X}=xI.acquire(Z,()=>DI($)),Y=EK(()=>J().vault,X);return{vault:Y,getRelayConfig:()=>J().getRelayConfig(),updateRelay:(G)=>J().updateRelay(G),read:()=>J().read(),authorizeLocal:(G,z)=>J().authorizeLocal(G,z),authorizeApi:(G,z)=>J().authorizeApi(G,z),authorizeVault:(G,z)=>J().authorizeVault(G,z),loginOAuth:(G)=>J().loginOAuth(G),putAccount:(G)=>J().putAccount(G),addApi:(G)=>J().addApi(G),updateSettings:(G)=>J().updateSettings(G),setLoggingLevel:(G)=>J().setLoggingLevel(G),setEnabled:(G,z)=>J().setEnabled(G,z),remove:(G)=>J().remove(G),reorder:(G,z)=>J().reorder(G,z),captureLocalSubject:(G)=>J().captureLocalSubject(G),publishLocal:(G,z)=>J().publishLocal(G,z),publishApi:(G,z)=>J().publishApi(G,z),resetBackoff:(G,z,Q)=>J().resetBackoff(G,z,Q),getOrCreateAuthLineage:(G,z)=>J().getOrCreateAuthLineage(G,z),incrementPrimeUsage:(G,z,Q)=>J().incrementPrimeUsage(G,z,Q),fetchQuota:(G,z,Q,K)=>J().fetchQuota(G,z,Q,K),fetchProfile:(G,z,Q)=>J().fetchProfile(G,z,Q),fetchProfileForDisplay:(G,z,Q)=>J().fetchProfileForDisplay(G,z,Q),close:()=>Y.close()}}function fF($,Z,J){if(!$.enabled)return{status:"blocked",reason:"account-disabled"};if(!Hq($.quota,Z.policyStorage)||!Xz($.quota,J)||!zz($.quota,Z.policyStorage,$.id==="main"?void 0:$.id,J))return{status:"blocked",reason:"quota-ineligible"};return{status:"allowed"}}function DI($){let Z=Object.freeze({...$.paths}),J=$.local?.now??$.vault?.now??Date.now,X={...$.vault?.env??process.env},Y=CK(Z),G={legacyConfig:Z.legacyConfig,roster:Y.roster},z=new pK({path:Y.routing,vaultSeed:G,now:J}),Q,K=U6({paths:Y,quota:l4,now:J,onStep:async(P)=>{if(P==="before-config-write"||P==="before-state-write")await q("claustrum")}}),W=new AbortController,V=U6({paths:Z,quota:l4,now:J,onStep:async(P)=>{if(P==="before-config-write"||P==="before-state-write"){if($.beforePoolWrite)await N(),await $.beforePoolWrite();await N()}}}),B=eO({...$.vault,paths:Z,host:$.host});function j(P){if(W.signal.aborted)throw new a("closed");P?.throwIfAborted()}async function H(P){j(P);let M=await BZ($.host,X);if(M==="local")await p5(Z),M=await BZ($.host,X);return j(P),M}async function q(P,M){if(await H(M)!==P)throw new a("route-unavailable")}async function N(P){await q("local",P)}async function U(){let P=await H();return{mode:P,paths:P==="claustrum"?Y:Z,store:P==="claustrum"?K:V}}async function L(P){let M=await V.read();if(M.status!=="ready")throw new b("publication-refused");return M.rows.find((_)=>_.id===P)}async function D(P){if(P!=="main")return P;let M=await V.readSettings();if(M.status!=="ready"||typeof M.settings.mainAccountId!=="string")throw new a("route-unavailable");return M.settings.mainAccountId}async function w(P,M,_=!0){if(await H()!=="local")return!1;let S=P.binding,I=async()=>{let R=await L(S.rowId);if(!R||!x4(S,Z,R)||R.stamp!=="bound"||!R.credential)return!1;if(_==="binding")return R.credential.type===("kind"in P?"api":"oauth");if("kind"in P)return R.credential.type==="api"&&I$(R.credential)===P.credentialFingerprint&&R.credential.baseURL===P.baseURL&&R.credential.authHeader===P.authHeader;if(R.credential.type!=="oauth"||I$(R.credential)!==P.credentialFingerprint)return!1;return!_||y6(P,S,R.credential)},[F,A]=G7(Z);try{return await d$(F.path,{...y$,name:F.name},async(R)=>d$(A.path,{...y$,name:A.name},async(T)=>{if(!await I())return!1;return await k5(Z.runtime,Z.storageId,(E)=>{let f=E.accounts[S.rowId],h=f?.binding,c=h?.kind==="local"&&h.rowId===S.rowId&&h.identity===S.identity&&h.credentialEpoch===S.credentialEpoch;return E.accounts[S.rowId]=M(c&&f?f:{binding:S},f),E},{beforeRename:async()=>{if(!await I())throw new b("publication-refused");await R.assertOwned(),await T.assertOwned(),await N()},beforePublish:()=>N()}),!0}))}catch(R){if(R instanceof b&&R.code==="runtime-conflict"||R instanceof a&&R.code==="route-unavailable")return!1;throw R}}async function O(P){let M=await L(P);if(!M?.credential||M.credentialEpoch===void 0)throw new b("publication-refused");let _={kind:"local",storageId:Z.storageId,rowId:M.id,credentialEpoch:M.credentialEpoch,...M.identity!==void 0?{identity:M.identity}:{}},S=M.credential.type==="api"?{kind:"api",binding:_,credentialFingerprint:I$(M.credential),baseURL:M.credential.baseURL,authHeader:M.credential.authHeader}:{binding:_,credentialFingerprint:I$(M.credential),version:{}};if(!await w(S,(F,A)=>{let R=A?.binding;if(R?.kind==="local"&&R.credentialEpoch===_.credentialEpoch&&R.identity===_.identity)return F;let T=R?.kind==="local"&&R.rowId===_.rowId&&_.identity!==void 0&&R.identity===_.identity,E={binding:_,...M.credential?.type==="oauth"?{authLineageId:b7()}:{}};if(T&&A){for(let f of["prime","profile","lastUsed","lastQuotaRefreshError","quotaErrorClearedAt","quotaErrorGeneration"])if(A[f]!==void 0)Object.assign(E,{[f]:A[f]})}return E},"binding"))throw new b("publication-refused")}async function x(){let P=await H();if(P==="claustrum")Q??=B.initializeSettings().catch((T)=>{throw Q=void 0,T}),await Q;let M=P==="claustrum"?Y:Z,_=P==="claustrum"?K:V,[S,I,F]=await Promise.all([_.read(),_.readSettings(),p4(M.runtime,M.storageId)]);if(S.status!=="ready"||I.status!=="ready")throw new b("publication-refused");let A=P==="claustrum"?await B.read():void 0;j();let R=rx({paths:{...Z,...M},rows:S.rows,settings:{...I.settings,claustrum:{...I.settings.claustrum,mode:P}},runtime:F.status==="ready"?F.state:void 0,roster:A});if(P==="claustrum")G.mainRouteId=typeof I.settings.mainAccountId==="string"?I.settings.mainAccountId:void 0,await z.prepareLegacySeed(A??null),R.routingPath=Y.routing,R.routingSeed={...G};return{snapshot:R,rows:S.rows,settings:I.settings,runtime:F.status==="ready"?F.state:void 0}}let C=new WeakMap;function v(P,M){let _=C.get(P);return _!==void 0&&ox(Z,_.rows,_.settings,M,_.runtime)}let k={vault:B,async getRelayConfig(){let{mode:P,paths:M,store:_}=await U();return d$(M.config,{...y$,name:"native-relay"},async(S)=>{let I=await _.readSettings();if(I.status!=="ready")throw new b("publication-refused");let F=F2(I.settings.relay),A=await p4(M.runtime,M.storageId),R=A.status==="ready"?A.state.relay?.token:void 0;if(await q(P),await S.assertOwned(),!F.enabled||!F.url||!R)return null;return{...F,token:R}})},async updateRelay(P){let M=v5(P);if(!M||typeof M!=="object"||Array.isArray(M)||Object.keys(M).some((F)=>!["enabled","url","token","fallbackToDirect","transport"].includes(F)))throw new b("publication-refused");for(let F of["enabled","fallbackToDirect"])if(M[F]!==void 0&&typeof M[F]!=="boolean")throw new b("publication-refused");if(M.url!==void 0&&typeof M.url!=="string")throw new b("publication-refused");if(M.transport!==void 0&&!["http","websocket"].includes(M.transport))throw new b("publication-refused");if(M.token!==void 0&&M.token!==null&&(typeof M.token!=="string"||!M.token.trim()||/\p{Cc}/u.test(M.token)))throw new b("publication-refused");let{mode:_,paths:S,store:I}=await U();await d$(S.config,{...y$,name:"native-relay"},async(F)=>{let A=await I.readSettings();if(A.status!=="ready")throw new b("publication-refused");let R=F2(A.settings.relay),T=await p4(S.runtime,S.storageId),E=M.token===void 0?T.status==="ready"?T.state.relay?.token:void 0:M.token?.trim(),f=F2({...R,...M,enabled:M.token===null?!1:M.enabled??R.enabled});if(f.enabled&&(!f.url||!E))throw new b("publication-refused");async function h(c){await I.updateSettings(async(e)=>{await q(_),await F.assertOwned(),e.relay=c})}if(await h({...R,enabled:!1}),M.token!==void 0)await k5(S.runtime,S.storageId,(c)=>{if(E)c.relay={token:E};else delete c.relay;return c},{beforeRename:async()=>{await q(_),await F.assertOwned()}});await h(f)})},async read(){let P=await x();return C.set(P.snapshot,P),P.snapshot},async authorizeLocal(P,M={}){await H(M.signal);let _=await k.read(),S=_.accounts.find((f)=>f.id===P);if(_.mode!=="local")return{status:"refused",reason:"custody-mode",persisted:!1};if(!S?.binding&&v(_,P)){if(d.debug("native-auth","waiting for an account write to finish",{phase:"waiting"}),await yO(Z,M.signal?[W.signal,M.signal]:[W.signal],()=>j(M.signal),J)==="deadline")throw d.warn("native-auth","account write did not finish in time",{outcome:"deadline"}),new c5;if(_=await k.read(),S=_.accounts.find((h)=>h.id===P),_.mode!=="local")return{status:"refused",reason:"custody-mode",persisted:!1};if(!S?.binding&&v(_,P))throw d.warn("native-auth","account write is still unfinished",{outcome:"still-torn"}),new c5;d.debug("native-auth","account write finished",{outcome:"joined"})}if(!S?.binding||S.source!=="local"||S.type!=="oauth")return{status:"refused",reason:"row-ineligible",persisted:!1};if(S.state==="unsupported-access")return{status:"refused",reason:"unsupported-access",persisted:!1};let I=await p4(Z.runtime,Z.storageId),F=I.status==="ready"?I.state.accounts[S.binding.rowId]?.binding:void 0;if(F?.kind==="local"&&F.credentialEpoch<S.binding.credentialEpoch){if(await O(S.binding.rowId),_=await k.read(),S=_.accounts.find((f)=>f.id===P),!S?.binding)return{status:"refused",reason:"row-ineligible",persisted:!1}}let A=(f,h)=>{if(h.mode!=="local")return{status:"blocked",reason:"local-mode-unavailable"};if(!f?.enabled)return{status:"blocked",reason:"account-disabled"};return{status:"allowed"}},R=(f,h)=>{let c=A(f,h);return c.status==="allowed"&&f?M.policy?.(f,h)??c:c};if(R(S,_).status==="blocked")return{status:"refused",reason:"quota-ineligible",persisted:!1};let E=await EO({paths:Z,...$.local,now:J,publicationGuard:async(f)=>{if(f.status==="persisted"||f.status==="failed"&&f.persisted&&f.committed!==void 0)return!0;try{return await BZ($.host,X)==="local"}catch{return!1}},externalPolicy:()=>A(S,_),failurePolicy:$.local?.failurePolicy??((f)=>{let h=f.observation.status==="failed"?f.observation.failure:void 0,c=Object.assign(Error(h?.classification==="invalid-grant"?"invalid_grant":"Local refresh failed"),{status:h?.status,retryAfter:h?.retryAfter,...h?.classification==="transient"&&h.status===void 0?{code:"ECONNRESET"}:{}}),e=Kq({error:c,now:J(),accountIdentity:f.attribution.subject.binding.identity,previous:{message:"Local refresh failed",checkedAt:J(),accountIdentity:f.attribution.subject.binding.identity,retryCount:Math.max(0,f.observation.attempt-1)}}),o=f.observation.status==="failed"&&h?.kind==="provider"&&h.classification==="transient"&&h.status!==429&&!f.observation.persisted&&!f.observation.committed&&f.observation.attempt<g5;return{checkedAt:e.checkedAt,nextRetryAt:o?e.checkedAt:e.nextRetryAt,retryCount:e.retryCount}})}).authorize({intent:M.intent??"serve",mode:"local",binding:S.binding,rejectedAccessToken:M.rejectedAccessToken,signal:AbortSignal.any([W.signal,...M.signal?[M.signal]:[]])});if(j(M.signal),E.status==="usable"){let f=await k.read(),h=f.accounts.find((c)=>c.id===P);if(R(h,f).status==="blocked"||!h?.binding||h.binding.rowId!==E.binding.rowId||h.binding.credentialEpoch!==E.binding.credentialEpoch||h.binding.identity!==E.binding.identity)return{status:"refused",reason:"row-ineligible",persisted:!1}}return E},async authorizeApi(P,M){await N(M);let _=await L(await D(P));if(j(M),!_?.enabled||!_.candidate||_.stamp!=="bound"||_.credential?.type!=="api")throw new a("route-unavailable");return await N(M),{..._.credential,subject:{kind:"api",binding:Ix(Z,_),credentialFingerprint:I$(_.credential),baseURL:_.credential.baseURL,authHeader:_.credential.authHeader}}},authorizeVault:(P,M)=>{return j(M),B.authorize(P,M)},async loginOAuth(P){if((await k.read()).mode!=="local")throw new a("route-unavailable");let _;try{if(!P.credential.access.startsWith("sk-ant-oat"))throw Error("Unsupported OAuth credential");if(_=(await($.local?.resolveIdentity??qz)(P.credential.access,void 0,void 0)).accountUuid,!_?.trim())throw Error("Missing account identity")}catch{throw Error("Claude account identity could not be verified; retry sign-in. No account changes were saved.")}return k.putAccount({...P,accountIdentity:_,replace:P.replace??!0,credential:{type:"oauth",...P.credential}})},async putAccount(P){await N();let M=await k.read();if(M.mode!=="local")throw new a("route-unavailable");let _=P.routeId==="main"?await D("main").catch(()=>b7()):P.routeId;if(P.credential.type==="api"&&(P.routeId==="main"||_===M.settings.mainAccountId))throw new a("route-unavailable");let S=await L(_),I=_,F=!1;if(P.replace&&S){if(!S.credentialEpoch)throw new b("publication-refused");await V.replace(_,P.credential,{identity:P.accountIdentity},{attribution:{credentialEpoch:S.credentialEpoch,identity:S.identity}})}else{let T=await V.add({id:_,credential:P.credential,identity:P.accountIdentity,label:P.label});I=T.id,F=T.outcome==="added"||T.outcome==="added-disabled"}if(P.routeId==="main")await V.updateSettings((T)=>{T.mainAccountId=I});await O(I);let R=(await k.read()).accounts.find((T)=>T.binding?.rowId===I);if(!R)throw new a("route-unavailable");if(F)JD(R);return R},addApi:(P)=>k.putAccount({routeId:P.routeId??b7(),label:P.label,replace:P.replace,credential:{type:"api",apiKey:P.apiKey,baseURL:P.baseURL??"https://api.anthropic.com",authHeader:P.authHeader}}),async updateSettings(P){let M=await U(),_={},S=await M.store.updateSettings(async(I)=>{function F(E){let f=E.claustrum;return[E.mainAccountId,f?.mode,f?.primaryAccount,f?.scopedRoster,f?.rosterView,E.relay]}let A=JSON.stringify(F(I));_.before=WK(I);let R=await P(I),T=v5(R??I);if(JSON.stringify(F(T))!==A)throw new a("route-unavailable");return T});if(S.outcome==="updated"&&_.before)ZD(_.before,S.settings);return S},async setLoggingLevel(P){await k.updateSettings((M)=>({...M,logging:{...M.logging&&typeof M.logging==="object"&&!Array.isArray(M.logging)?M.logging:{},level:P}})),VK(P)},async setEnabled(P,M){let _=await k.read(),S=_.accounts.find((f)=>f.id===P),I={id:P,label:S?.label},F=M?"account enabled":"account disabled";if(_.mode==="claustrum"){if(S?.source!=="vault")throw new a("route-unavailable");if(await B.setEnabled(P,M))u7(F,I);return}await N();let A=await D(P),R=M?"enable":"disable",T={},E=U6({paths:Z,quota:l4,now:J,onStep:async(f,h)=>{if(f==="before-config-write"||f==="before-state-write")await N();if(f!=="before-config-write"||h.operation!==R||h.rowId!==A)return;T.before=void 0;try{let c=await V.read();if(c.status==="ready")T.before=c.rows.find((e)=>e.id===A)?.enabled}catch{}await N()}});if(M)await E.enable(A);else await E.disable(A,"user-disabled");if(T.before!==void 0&&T.before!==M)u7(F,I)},async remove(P){await N();let M=await k.read();if(M.mode!=="local")throw new a("route-unavailable");let _=M.accounts.find((I)=>I.id===P);if((await V.remove(await D(P))).outcome==="removed")u7("account removed",{id:P,label:_?.label})},async reorder(P,M){await N();let _=await k.read();if(_.mode!=="local")throw new a("route-unavailable");let S=await V.read();if(S.status!=="ready")throw new b("publication-refused");let I=await Promise.all(P.map(D)),F=S.rows.find((A)=>A.id===_.settings.mainAccountId);if(F&&!I.includes(F.id))I.unshift(F.id);if((await V.reorder(I)).outcome==="reordered")u7("account reordered",_.accounts.find((A)=>A.id===M)??{id:M})},async captureLocalSubject(P){await N();let M=await L(await D(P));if(M?.credential?.type!=="oauth"||M.stamp!=="bound")throw new a("route-unavailable");let _=M.credential,S={kind:"local",storageId:Z.storageId,rowId:M.id,credentialEpoch:M.credentialEpoch??0,...M.identity!==void 0?{identity:M.identity}:{}};if(!x4(S,Z,M))throw new a("route-unavailable");return{binding:S,credentialFingerprint:I$(_),version:{..._.access?{accessFingerprint:S4(_.access)}:{},..._.expires!==void 0?{expires:_.expires}:{},...Object.hasOwn(_,"lastRefreshedAt")?{lastRefreshedAt:_.lastRefreshedAt}:{}}}},async publishLocal(P,M){let _=ZK(M);if(await H()!=="local")return!1;let{quota:S,...I}=_,F=S!==void 0&&Object.keys(I).length===0,A=await L(P.binding.rowId);if(A?.stamp!=="bound"||A.credential?.type!=="oauth"||!x4(P.binding,Z,A)||!F&&!y6(P,P.binding,A.credential))return!1;if(S){if(S.accountIdentity!==P.binding.identity)throw new b("publication-refused");await V.recordQuota(P.binding.rowId,{credentialEpoch:P.binding.credentialEpoch,identity:P.binding.identity},c6(S))}return w(P,(R)=>JK(R,I),F?"binding":!0)},publishApi:(P,M)=>w(P,(_)=>({..._,lastUsed:Math.max(_.lastUsed??0,M.lastUsed)})),async resetBackoff(P,M,_="all"){if("accessToken"in M)return B.resetBackoff(M,_);if(await H()!=="local")return!1;if(await D(P)!==M.binding.rowId)return!1;return w(M,(S)=>{let I=Math.max(J(),S.refreshErrorClearedAt??0,S.quotaErrorClearedAt??0,S.lastRefreshError?.checkedAt??0,S.lastQuotaRefreshError?.checkedAt??0),F={...S};if(_!=="quota")delete F.lastRefreshError,delete F.validationRetry,F.refreshErrorClearedAt=I;if(_!=="refresh")delete F.lastQuotaRefreshError,F.quotaErrorClearedAt=I,F.quotaErrorGeneration=(S.quotaErrorGeneration??0)+1;return F},!1)},async getOrCreateAuthLineage(P,M){if("accessToken"in M)return B.getOrCreateAuthLineage(M);if(await H()!=="local")return;if(await D(P)!==M.binding.rowId)return;let _;return await w(M,(I)=>{return _=I.authLineageId??b7(),{...I,authLineageId:_}})?_:void 0},async incrementPrimeUsage(P,M,_={}){if("accessToken"in M)return B.incrementPrimeUsage(M,_);if(await H()!=="local")return!1;if(await D(P)!==M.binding.rowId)return!1;let S=OI(_);return w(M,(I)=>({...I,prime:{count:(I.prime?.count??0)+1,inputTokens:(I.prime?.inputTokens??0)+S.inputTokens,outputTokens:(I.prime?.outputTokens??0)+S.outputTokens,since:I.prime?.since??J()}}))},async fetchQuota(P,M=fetch,_,S){let I=await k.read();if(I.mode==="claustrum")return B.fetchQuota(P,M,_,S);let F=I.accounts.find((E)=>E.id===P),A=await l(P,M,_,(E,f)=>F9({accessToken:E.access,fetchImpl:f,now:J}),async(E,f)=>{let h=F?.binding&&F.binding.rowId===f.binding.rowId&&F.binding.credentialEpoch===f.binding.credentialEpoch&&F.binding.identity===f.binding.identity?F:void 0,c=XK(E,f.binding.identity,Math.max(J(),(h?.quotaErrorClearedAt??-1)+1),h?.lastQuotaRefreshError);if(c)await k.publishLocal(f.subject,{lastQuotaRefreshError:c})},S),R={...A.value,accountIdentity:A.attempt.binding.identity},T=F?.binding&&F.binding.rowId===A.attempt.binding.rowId&&F.binding.credentialEpoch===A.attempt.binding.credentialEpoch&&F.binding.identity===A.attempt.binding.identity?F:void 0;return await k.publishLocal(A.attempt.subject,{quota:R,quotaErrorClearedAt:Math.max(R.checkedAt??J(),T?.quotaErrorClearedAt??0,T?.lastQuotaRefreshError?.checkedAt??0)}),R},async fetchProfile(P,M=fetch,_){if((await k.read()).mode==="claustrum")return B.fetchProfile(P,M,_);let S=await m(P,M,_);return await k.publishLocal(S.attempt.subject,{profile:S.value}),S.value},async fetchProfileForDisplay(P,M=fetch,_){if((await k.read()).mode==="claustrum")return B.fetchProfileForDisplay(P,M,_);let S=await m(P,M,_),I=structuredClone(S.attempt.subject),F=S.value;return vK(F,()=>k.publishLocal(I,{profile:F}),async()=>{if((await k.read()).mode!=="local"||await D(P)!==I.binding.rowId)return!1;let A=await L(I.binding.rowId);return A?.stamp==="bound"&&A.enabled!==!1&&A.credential?.type==="oauth"&&x4(I.binding,Z,A)&&y6(I,I.binding,A.credential)})},close(){if(!W.signal.aborted)W.abort(new a("closed")),B.close()}};function m(P,M,_){return l(P,M,_,(S,I)=>i1({accessToken:S.access,accountIdentity:S.binding.identity,fetchImpl:I,now:J,signal:_}))}async function l(P,M,_,S,I,F){let A=AbortSignal.any([W.signal,..._?[_]:[]]),R=await k.authorizeLocal(P,{signal:A});if(R.status!=="usable")throw new a("route-unavailable");let T=R,E=(e,o)=>{let i=()=>M(e,{...o,signal:A});if(!F)return i();return F(i,async()=>{await N(A);let p=await L(T.binding.rowId);if(!p?.enabled||p.stamp!=="bound"||p.credential?.type!=="oauth"||!x4(T.binding,Z,p)||!y6(T.subject,T.binding,p.credential)||await D(P)!==T.binding.rowId)throw new a("identity-changed");await N(A)})},f,h=Object.assign(async(e,o)=>{f=void 0;let i=await E(e,o);if(f=i.status,i.status===401&&!A.aborted){await i.body?.cancel().catch(()=>{}),j(A);let p=await k.authorizeLocal(P,{rejectedAccessToken:T.access,signal:A});if(p.status==="usable"&&p.binding.rowId===T.binding.rowId&&p.binding.credentialEpoch===T.binding.credentialEpoch&&p.binding.identity===T.binding.identity&&p.access!==T.access&&p.subject.version.lastRefreshedAt!==void 0&&(T.subject.version.lastRefreshedAt===void 0||p.subject.version.lastRefreshedAt>T.subject.version.lastRefreshedAt)){T=p;let r=new Headers(o?.headers);r.set("authorization",`Bearer ${T.access}`),f=void 0,i=await E(e,{...o,headers:r}),f=i.status}}return i},{preconnect:M.preconnect}),c;try{c=await S(T,h)}catch(e){j(A);let o=e instanceof a||e instanceof b?e:GK(e,f);throw await I?.(o,T),o}return j(A),{value:c,attempt:T}}return k}function OI($){let Z=$.inputTokens??0,J=$.outputTokens??0;if(![Z,J].every((X)=>Number.isSafeInteger(X)&&X>=0))throw new b("publication-refused");return{inputTokens:Z,outputTokens:J}}function F2($){let Z=$&&typeof $==="object"?$:{},J=typeof Z.url==="string"?Z.url.trim():"",X=Z.transport==="http"?"http":"websocket";if(J)try{let Y=new URL(J);if(!["https:","http:","wss:","ws:"].includes(Y.protocol)||Y.username||Y.password||X==="http"&&!["https:","http:"].includes(Y.protocol))throw Error("invalid endpoint")}catch{throw new b("publication-refused")}return{enabled:Z.enabled===!0,url:J,transport:X,fallbackToDirect:Z.fallbackToDirect!==!1}}class T4 extends Error{code;effect;constructor($,Z=void 0){super(`Native host auth write: ${$}`);this.code=$,this.effect=Z,this.name="NativeHostAuthWriteError"}}function f3($){return typeof $==="string"&&($==="absent"||$.length===64&&/^[a-f0-9]{64}$/.test($))}async function X9($,Z,J){try{await $?.()}catch{throw new T4(Z,J)}}async function cK($,Z={}){let J,X,Y;try{let{host:G,authPath:z,sourceDigest:Q,expectedDigest:K,removePiAnthropicAuth:W,processFence:V}=$;iQ($.env);let{beforeRecheck:B,beforeRename:j,afterRename:H,afterUnlink:q}=Z;if(G!=="opencode"&&G!=="pi"||typeof z!=="string"||!AI(z)||/\p{Cc}/u.test(z)||!f3(Q)||!f3(K)||typeof V!=="function")throw new T4("invalid-source");let N=await T$("hostAuth",z);if(N.metadata&&process.getuid&&N.metadata.uid!==process.getuid())throw new T4("unsafe-source");let U=l$(G,N.data);if(U.digest!==Q)throw new T4("invalid-source");let L=Object.assign(Object.create(null),N.data);if(G==="opencode"){if(U.kind!=="api"&&U.kind!=="activation")L.anthropic=W0("anthropic")}else delete L.anthropic;if(l$(G,L).digest!==K)throw new T4("invalid-source");if(G==="opencode"&&(U.kind==="api"||U.kind==="activation")||G==="pi"&&U.kind==="absent")return Object.freeze({status:"unchanged"});if(G==="pi"&&W!==!0)throw new T4("consent-required");let D=G==="pi"&&Object.keys(L).length===0,w=Object.freeze(G==="pi"?{status:"removed",file:D?"unlinked":"replaced"}:{status:N.data===void 0?"created":"replaced"});if(!D){J=RI(wI(z),`.native-host-auth-write.${II()}.tmp`);let O=await PI(J,"wx",384);try{let x=await O.stat();X={dev:x.dev,ino:x.ino},await O.writeFile(`${JSON.stringify(L,null,2)}
+`,"utf8"),await O.chmod(N.metadata?N.metadata.mode&4095:384),await O.sync()}finally{await O.close()}}if(await X9(B,"hook-failed"),await B6(N),await X9(j,"hook-failed"),await X9(V,"process-fence-refused"),D)await v3(z),Y=w,await X9(q,"hook-failed",Y);else await _I(J,z),X=void 0,Y=w,await X9(H,"hook-failed",Y);return w}catch(G){if(G instanceof T4||G instanceof L6)throw G;if(G instanceof f$)throw new T4(G.code==="unsafe-source"?"unsafe-source":"invalid-source",Y);throw new T4("write-io",Y)}finally{if(J&&X)try{let G=await MI(J);if(G.dev===X.dev&&G.ino===X.ino)await v3(J)}catch{}}}async function g$($){let Z=bI($);try{return await EI(Z)}catch(X){if(!(X instanceof Error)||!("code"in X)||X.code!=="ENOENT")throw X}let J=iK(Z);if(J===Z)return Z;return dK(await g$(J),lK(Z))}function Y9($,Z,J,X){return lK($)===Z?dK(iK($),J):`${$}.${X}.json`}async function hI($=B0(),Z=P1($)){let[J,X]=await Promise.all([g$($),g$(Z)]),Y=await g$(Y9(J,"anthropic-auth.json","anthropic-auth-pool.json","pool")),G=await g$(Y9(X,"anthropic-auth-state.json","anthropic-auth-pool-state.json","pool")),z=await g$(Y9(X,"anthropic-auth-state.json","anthropic-auth-native-state.json","native")),Q=await g$(Y9(X,"anthropic-auth-state.json","anthropic-auth-migration.json","migration")),K=await g$(Y9(X,"anthropic-auth-state.json","anthropic-auth-custody-roster.json","roster")),W=[J,X,Y,G,z,Q,K];if(new Set(W).size!==W.length)throw Error("Anthropic account storage paths overlap; migration requires separate files");let V=fI("sha256").update(JSON.stringify(["anthropic",Y,G])).digest("hex");return{legacyConfig:J,legacyState:X,config:Y,state:G,runtime:z,journal:Q,roster:K,storageId:V}}class TJ extends Error{code;constructor($){super($==="primary-unverified"?"Stop OpenCode and Pi, then run bunx @cortexkit/opencode-anthropic-auth setup --login --no-claustrum. Existing credentials have not been changed.":`Native migration: ${$}`);this.code=$,this.name="NativeMigrationError"}}var E3=new WeakMap;function t($="invalid-source"){throw new TJ($)}function e6($){if($.metadata&&process.getuid&&$.metadata.uid!==process.getuid())t("unsafe-source")}async function s5($){try{return await FI($),!1}catch(Z){if(Z instanceof Error&&"code"in Z&&Z.code==="ENOENT")return!0;return t("unsafe-source")}}async function gI($){iQ($.env),await $.processFence();let Z=await hI($.paths.legacyConfig,$.paths.legacyState);for(let q of Object.keys(Z))if($.paths[q]!==Z[q])t();for(let q of[$.hostAuthPath,$.routingSourcePath,$.routingDestinationPath])if(!vI(q)||/\p{Cc}/u.test(q))t();let J=await Q7($.paths),X=await T$("hostAuth",$.hostAuthPath);e6(X);let Y=l$($.host,X.data);if($.host==="pi"&&Y.kind!=="absent"&&!$.removePiAnthropicAuth)t("consent-required");let G=await g$($.hostAuthPath),z=await g$($.routingSourcePath),Q=await g$($.routingDestinationPath),K=[$.paths.legacyConfig,$.paths.legacyState,$.paths.config,$.paths.state,$.paths.runtime,$.paths.roster,$.paths.journal,G,z];if(new Set(K).size!==K.length||Q!==z&&K.includes(Q))t();if(J&&(J.host!==$.host||J.hostAuthPath!==G||J.routingPaths.source!==z||J.routingPaths.destination!==Q))t();if(J?.phase==="committed"||J?.phase==="retired"){let q=(N,U)=>({role:N,path:U,digest:null,data:void 0,metadata:void 0});return{config:q("config",$.paths.legacyConfig),state:q("state",$.paths.legacyState),routing:q("routing",$.routingSourcePath),auth:X,journal:J,hostAuthPath:G,routingSourcePath:z,routingDestinationPath:Q}}if(!J){for(let q of[$.paths.config,$.paths.state,$.paths.runtime,$.paths.roster])if(!await s5(q))t();if(z!==Q&&!await s5($.routingDestinationPath))t()}let W=await T$("config",$.legacyConfigPath??$.paths.legacyConfig),V=await T$("state",$.legacyStatePath??$.paths.legacyState),B=await T$("routing",$.routingSourcePath);for(let q of[W,V,B])e6(q);if(await g$(W.path)!==$.paths.legacyConfig||await g$(V.path)!==$.paths.legacyState)t();if(J&&(J.sources.config!==W.digest||J.sources.state!==V.digest||J.expectedRouting==="unprepared"&&J.sources.routing!==B.digest))t();if(J&&Y.digest!==J.sources.hostAuth&&Y.digest!==J.expectedHostAuth)t();let j,H;if(!J||J.expectedHostAuth==="unprepared"||Y.digest===J.sources.hostAuth){j=Tx({host:$.host,storageId:$.paths.storageId,configDigest:W.digest,config:W.data,state:V.data,hostAuth:X.data});let q=j.mainRouteId,N=j.accounts.find((L)=>L.id===q);if(($.requestVaultActivation||J?.activation?.kind==="requested")&&N?.credential?.type==="oauth"&&!N.identity)t("primary-unverified");if(j.custodyPrimary){if(!$.custody)t();H={inventory:await $.custody.discover(),primary:j.custodyPrimary,primaryRouteId:j.mainRouteId,legacyRows:j.custodyRows,disabledAccountIdentities:j.disabledAccountIdentities,reservedRouteIds:j.accounts.filter((L)=>L.credential?.type==="api").map((L)=>L.id)},d5(H)}let U=j.accounts.filter((L)=>L.credential).map((L)=>({id:L.id,type:L.credential?.type??"oauth",credential:L.credential,identity:L.identity,credentialEpoch:1,enabled:L.enabled,stamp:"bound",hasEntry:!0,needsFirstReading:!1,candidate:L.enabled}));F5($.paths,j,U,H?d5(H):void 0)}return{config:W,state:V,routing:B,auth:X,journal:J,projection:j,seedInput:H,hostAuthPath:G,routingSourcePath:z,routingDestinationPath:Q}}async function J6($){let Z=await $.read();if(Z.status!=="ready")t();return Z.rows}async function jZ($){let Z=await p4($.runtime,$.storageId);if(Z.status!=="ready")t();return Z.state}async function C2($,Z,J){let X=await Z.readSettings();if(X.status!=="ready")t();let Y=await T$("state",$.roster);e6(Y);let G=Y.data?await i$($.roster):null;if(Y.data&&!G)t();return{runtime:await jZ($),settings:X.settings,accounts:J.map((z)=>({id:z.id,type:z.type,enabled:z.enabled,label:z.label??null,addedAt:z.addedAt??null,disabledReason:z.disabledReason??null,quota:z.quota??null})),roster:G}}async function b3($,Z,J){let X=G7($);async function Y(G,z){let Q=X[G];if(!Q)return N6($.roster,async(K,W)=>{return{result:await d$($.runtime,{name:"native-runtime",...y$,renew:!0},(B)=>J(async()=>{await Z();for(let j of z)await j();await W.assertOwned(),await B.assertOwned()}))}});return d$(Q.path,{...y$,...Q,renew:!0},(K)=>Y(G+1,[...z,()=>K.assertOwned()]))}return Y(0,[])}function S2($){if(!$.routing.data)return;if(!$.projection)t();let Z=new Map($.projection.accounts.map((J)=>[J.id,J.id]));return Z.set("main",$.projection.mainRouteId),LI($.routing.data,Z)}function h3($){return $===void 0?null:TI("sha256").update($).digest("hex")}function sK($,Z){let J=l$($.host,Z.data);return $.host==="pi"?"absent":J.kind==="api"?J.digest:l$("opencode",{anthropic:W0("anthropic")}).digest}async function X6($){await B6($.config),await B6($.state)}async function k2($,Z){if(await g$($.hostAuthPath)!==Z.hostAuthPath||await g$($.routingSourcePath)!==Z.routingSourcePath||await g$($.routingDestinationPath)!==Z.routingDestinationPath)t()}async function g3($,Z,J,X){let Y=[{role:"config",path:$.legacyConfigPath??$.paths.legacyConfig,digest:Z.sources.config},{role:"state",path:$.legacyStatePath??$.paths.legacyState,digest:Z.sources.state},...Z.routingPaths.source===Z.routingPaths.destination?[]:[{role:"routing",path:$.routingSourcePath,digest:Z.sources.routing}]],G=await Promise.all(Y.map(async(z)=>{let Q=await T$(z.role,z.path);if(e6(Q),Q.data&&Q.digest!==z.digest)t("retirement-refused");return Q}));for(let z of G){if(!z.data)continue;await X.onStep?.(`before:retire:${z.role}`),await B6(z),await $.processFence(),await J(),await SI(z.path),await X.onStep?.(`after:retire:${z.role}`)}return qZ($.paths,"committed","retired",{assertOwned:async()=>{for(let z of Y)if(!await s5(z.path))t("retirement-refused");await $.processFence(),await J()},onWriteStep:async(z)=>X.onStep?.(`${z}:journal:retired`)})}async function y3($,Z,J){let X=await T$("hostAuth",$.hostAuthPath);e6(X);let Y=l$($.host,X.data);await cK({host:$.host,authPath:$.hostAuthPath,sourceDigest:Y.digest,expectedDigest:sK($,X),env:$.env,removePiAnthropicAuth:$.removePiAnthropicAuth,processFence:async()=>{await $.processFence(),await Z()}},J.hostWrite)}async function lF($,Z={}){let J={...$.paths},X={...$,paths:J,env:{...$.env}};try{return await d$(J.journal,{name:"native-migration",ttlMs:30000,timeoutMs:15000,renew:!0},async(Y)=>{let G=async()=>{try{await Y.assertOwned()}catch{t("ownership-lost")}},z=await gI(X);if(X.preflight){let H=E3.get(X.preflight);if(!H||X.preflight.storageId!==J.storageId||X.preflight.host!==X.host||H.config.digest!==z.config.digest||H.state.digest!==z.state.digest||H.routing.digest!==z.routing.digest||l$(X.host,H.auth.data).digest!==l$(X.host,z.auth.data).digest||H.hostAuthPath!==z.hostAuthPath||H.routingSourcePath!==z.routingSourcePath||H.routingDestinationPath!==z.routingDestinationPath)t()}let Q=z.journal,K=async(H)=>Z.onStep?.(H),W={assertOwned:async()=>{await k2(X,z),await X6(z),await X.processFence(),await G()},onWriteStep:async(H,q)=>{await K(q.phase==="verified"&&q.preparedProof?`${H}:proof`:`${H}:journal:${q.phase}`)}};if(Q?.phase==="retired"){if(Q.activation===null)await y3(X,G,Z);return Q}if(Q?.phase==="committed"){if(Q=await g3(X,Q,G,Z),Q.activation===null)await y3(X,G,Z);return Q}if(!Q)await G(),Q=await FO(J,{host:X.host,sources:{config:z.config.digest,state:z.state.digest,hostAuth:l$(X.host,z.auth.data).digest,routing:z.routing.digest},hostAuthPath:z.hostAuthPath,routingPaths:{source:z.routingSourcePath,destination:z.routingDestinationPath},...X.requestVaultActivation?{activation:"requested"}:{}},W);let V=U6({paths:J,quota:l4,onLockStep:Z.store?.onLockStep,onStep:async(H,q)=>{if(await Z.store?.onStep?.(H,q),await K(`${H}:store:${q.operation}`),H.startsWith("before-"))await X6(z),await X.processFence(),await G()}}),B,j;if(Q.phase==="building"){let H=z.projection;if(!H)t();let q=async()=>{await k2(X,z),await X6(z),await X.processFence(),await G()};await q(),await V.initialize();for(let L of[...H.accounts].filter((D)=>D.credential).sort((D,w)=>Number(D.enabled)-Number(w.enabled))){let D=(await J6(V)).find((w)=>w.id===L.id);if(D)e8({...H,accounts:[{...L,credential:L.credential,enabled:D.enabled}]},[D],!1);else{if(await q(),!L.credential)t();if((await V.add({id:L.id,credential:L.credential,...L.identity!==void 0?{identity:L.identity}:{},...L.label!==void 0?{label:L.label}:{}})).id!==L.id)t();await K(`after:add:${L.id}`)}if(await q(),!L.enabled)await V.disable(L.id,"user-disabled");else await V.enable(L.id);if(L.quota){let w=(await J6(V)).find((O)=>O.id===L.id);if(!w?.credentialEpoch)t();await q(),await V.recordQuota(L.id,{credentialEpoch:w.credentialEpoch,...w.identity!==void 0?{identity:w.identity}:{}},L.quota)}}if(await q(),await V.reorder(H.accounts.filter((L)=>L.credential).map((L)=>L.id)),await q(),await V.updateSettings(()=>H.settings),z.seedInput){if(await q(),await K("before:roster"),!X.custody)t();j=await X.custody.publishSeed(J,z.seedInput,{assertOwned:q}),await G(),await K("after:roster")}let N=await J6(V);e8(H,N);let U=F5(J,H,N,j);if(await q(),await K("before:runtime"),z.seedInput){if(!X.custody)t();await X.custody.publishRuntimeSeed(J,U,{assertOwned:q})}else await k5(J.runtime,J.storageId,(L)=>{if(Object.keys(L.accounts).length>0&&O$(L)!==O$(U))t();return U},{beforeRename:q});await K("after:runtime"),B=S2(z),await b3(J,G,async(L)=>{if(await X6(z),e8(H,await J6(V)),O$(await jZ(J))!==O$(U))t();Q=await qZ(J,"building","verified",{...W,assertOwned:async()=>{if(await X6(z),e8(H,await J6(V)),O$(await jZ(J))!==O$(U))t();await X.processFence(),await L()}})})}return Q=await b3(J,G,async(H)=>{if(!Q)t();await X6(z);let q=await J6(V),N=await C2(J,V,q);if(Q.expectedHostAuth==="unprepared"){if(!z.projection)t();e8(z.projection,q);let D=await V.readSettings();if(D.status!=="ready"||O$(D.settings)!==O$(z.projection.settings))t();if(z.seedInput&&!j){if(!X.custody)t();if(!(await T$("state",J.roster)).data)t();let x=await i$(J.roster);if(!x)t();tO(x,z.seedInput),j=d5(z.seedInput)}if(O$(await jZ(J))!==O$(F5(J,z.projection,q,j)))t();await B6(z.routing),B??=S2(z);let w=dQ(q,N);Q=await CO(J,{expectedHostAuth:sK(X,z.auth),expectedRouting:h3(B),preparedProof:w},{...W,assertOwned:async()=>{await X6(z),await B6(z.routing);let O=await J6(V);D2(w,O,await C2(J,V,O)),await X.processFence(),await H()}})}D2(Q.preparedProof,q,N);let U=Q,L=async()=>{await k2(X,z),await X6(z),q=await J6(V),N=await C2(J,V,q),D2(U.preparedProof,q,N),await X.processFence(),await H()};return await d$(X.routingDestinationPath,{name:"write",ttlMs:30000,timeoutMs:15000,renew:!0},async(D)=>{let w=await T$("routing",X.routingDestinationPath);if(e6(w),w.digest!==U.expectedRouting){if(U.phase!=="verified"||(z.routingSourcePath!==z.routingDestinationPath?w.digest!==null:w.digest!==U.sources.routing))t();if(await B6(z.routing),B??=S2(z),h3(B)!==U.expectedRouting||!B)t();await K("before:routing"),await u8(X.routingDestinationPath,JSON.parse(B),{beforeRename:async()=>{await B6(w),await L(),await D.assertOwned()}}),await K("after:routing")}let O=await T$("hostAuth",X.hostAuthPath);e6(O);let x=l$(X.host,O.data);if(x.digest!==U.sources.hostAuth&&x.digest!==U.expectedHostAuth)t();if(U.phase==="activation-installed"&&x.digest!==U.expectedHostAuth)t();if(await K("before:host"),await L(),await CI(kI(X.hostAuthPath),{recursive:!0,mode:448}),x.digest!==U.expectedHostAuth)await cK({host:X.host,authPath:X.hostAuthPath,sourceDigest:U.sources.hostAuth,expectedDigest:U.expectedHostAuth,env:X.env,removePiAnthropicAuth:X.removePiAnthropicAuth,processFence:async()=>{await L(),await D.assertOwned()}},Z.hostWrite);await K("after:host"),await L();let C=await T$("hostAuth",X.hostAuthPath);if(l$(X.host,C.data).digest!==U.expectedHostAuth)t();if((await T$("routing",X.routingDestinationPath)).digest!==U.expectedRouting)t();let k={...W,assertOwned:async()=>{await L();let m=await T$("hostAuth",X.hostAuthPath),l=await T$("routing",X.routingDestinationPath);if(l$(X.host,m.data).digest!==U.expectedHostAuth||l.digest!==U.expectedRouting)t();await D.assertOwned()}};if(Q?.phase==="verified")Q=await qZ(J,"verified","activation-installed",k);Q=await qZ(J,"activation-installed","committed",k)}),Q}),await g3(X,Q,G,Z)})}catch(Y){if(Y instanceof f$)t(Y.code==="unsafe-source"?"unsafe-source":"invalid-source");if(Y instanceof qJ)t();if(Y instanceof VJ||Y instanceof TJ)throw Y;if(Y instanceof Error&&Y.name==="LockContentionError")t("migration-busy");throw Y}finally{if(X.preflight)E3.delete(X.preflight)}}var iF=l$("opencode",{anthropic:W0("anthropic")}).digest;async function dF($,Z){try{if($!=="opencode"&&$!=="pi")throw new L6("invalid-source");let J=await T$("hostAuth",Z);if(J.metadata){let X=typeof process.getuid==="function"?process.getuid():void 0;if(X!==void 0&&J.metadata.uid!==X||(J.metadata.mode&63)!==0)throw new L6("invalid-source")}return l$($,J.data).kind}catch{throw new L6("invalid-source")}}var yI=Object.freeze(["Accounts","Quota","Routing","Limits","Cache","Diagnostics","Extras"]),J$={kind:"action",destructive:!1,interactive:!1},G9={id:"id",kind:"account-id",required:!0},u3={id:"label",kind:"text",required:!1,protectedEntry:!1};function uI($){for(let Z of $.parameters){if(Z.kind==="choice")Object.freeze(Z.choices);if(Z.kind==="limit-entries")Object.freeze(Z.fields);Object.freeze(Z)}if(Object.freeze($.parameters),$.kind==="setup-guidance")Object.freeze($.setupInstructions);return Object.freeze($)}var t5=Object.freeze([{...J$,id:"enable",command:"account",group:"Accounts",label:"Enable account",parameters:[G9]},{...J$,id:"disable",command:"account",group:"Accounts",label:"Disable account",parameters:[G9]},{...J$,id:"remove",command:"account",group:"Accounts",label:"Remove account",parameters:[G9],destructive:!0,confirm:"Remove the selected account from this host?"},{...J$,id:"move-up",command:"account",group:"Accounts",label:"Move account up",parameters:[G9]},{...J$,id:"move-down",command:"account",group:"Accounts",label:"Move account down",parameters:[G9]},{...J$,id:"reset-backoff",command:"account",group:"Accounts",label:"Reset account backoff",parameters:[]},{...J$,id:"enrollment-reset",command:"account",group:"Accounts",label:"Reset host enrollment",parameters:[],destructive:!0,confirm:"Clear denied or blocked enrollment state for this host?"},{...J$,id:"add-apikey",command:"account",group:"Accounts",label:"Add API-key fallback",interactive:!0,headlessRefusal:"interactive-required",parameters:[{id:"apiKey",kind:"text",required:!0,protectedEntry:!0},u3,{id:"baseURL",kind:"text",required:!1,protectedEntry:!1},{id:"authHeader",kind:"choice",required:!1,choices:["authorization-bearer","x-api-key"]}]},{...J$,id:"add-oauth-start",command:"account",group:"Accounts",label:"Start OAuth sign-in",parameters:[],interactive:!0,headlessRefusal:"interactive-required"},{...J$,id:"add-oauth-finish",command:"account",group:"Accounts",label:"Finish OAuth sign-in",parameters:[{id:"code",kind:"text",required:!0,protectedEntry:!0},u3],interactive:!0,headlessRefusal:"interactive-required"},{id:"custody-mode",kind:"setup-guidance",command:"account",group:"Accounts",label:"Custody setup guidance",destructive:!1,interactive:!0,headlessRefusal:"offline-required",offlineRequired:!0,parameters:[{id:"mode",kind:"choice",required:!0,choices:["local","claustrum"]}],setupInstructions:["Stop all selected hosts before changing credential authority.","Use the explicit offline setup flow for the selected local or claustrum mode.","This menu only provides guidance; it does not change settings, propose enrollment, or report setup success."]},{id:"vault-disconnect",kind:"vault-disconnect",command:"account",group:"Accounts",label:"Disconnect from the vault",destructive:!0,confirm:"Disconnect this host from the vault and return to local accounts? The vault keeps this host's enrollment approved until an operator revokes it there.",interactive:!0,headlessRefusal:"interactive-required",parameters:[]},{...J$,id:"quota-refresh",command:"quota",group:"Quota",label:"Refresh quota",parameters:[]},{...J$,id:"routing-mode",command:"routing",group:"Routing",label:"Routing mode",parameters:[{id:"mode",kind:"choice",required:!0,choices:["main-first","fallback-first","sticky-balanced"]}]},{...J$,id:"routing-reset",command:"routing",group:"Routing",label:"Reset routing session",parameters:[]},{...J$,id:"killswitch-on",command:"killswitch",group:"Limits",label:"Enable killswitch",parameters:[]},{...J$,id:"killswitch-off",command:"killswitch",group:"Limits",label:"Disable killswitch",parameters:[]},{...J$,id:"killswitch-set",command:"killswitch",group:"Limits",label:"Set killswitch thresholds",parameters:[{id:"entries",kind:"limit-entries",required:!0,fields:["account","fh","sd","scoped?"]}]},{...J$,id:"cache-on",command:"cache",group:"Cache",label:"Enable cache",parameters:[]},{...J$,id:"cache-off",command:"cache",group:"Cache",label:"Disable cache",parameters:[]},{...J$,id:"cache-mode",command:"cache",group:"Cache",label:"Cache mode",parameters:[{id:"mode",kind:"choice",required:!0,choices:["explicit","automatic","hybrid"]}]},{...J$,id:"cachekeep-always",command:"cachekeep",group:"Cache",label:"Keep cache warm always",parameters:[]},{...J$,id:"cachekeep-off",command:"cachekeep",group:"Cache",label:"Disable cache keep",parameters:[]},{...J$,id:"cachekeep-window",command:"cachekeep",group:"Cache",label:"Cache keep window",parameters:[{id:"startHour",kind:"number",required:!0},{id:"endHour",kind:"number",required:!0}]},{...J$,id:"cachekeep-subagents",command:"cachekeep",group:"Cache",label:"Cache keep for subagents",parameters:[{id:"enabled",kind:"choice",required:!0,choices:["on","off"]}]},{...J$,id:"dump-on",command:"dump",group:"Diagnostics",label:"Enable request dumps",parameters:[]},{...J$,id:"dump-off",command:"dump",group:"Diagnostics",label:"Disable request dumps",parameters:[]},{...J$,id:"logging-level",command:"logging",group:"Diagnostics",label:"Logging level",parameters:[{id:"level",kind:"choice",required:!0,choices:["error","warn","info","debug","trace"]}]},{...J$,id:"fast-on",command:"fast",group:"Extras",label:"Enable fast mode",parameters:[]},{...J$,id:"fast-off",command:"fast",group:"Extras",label:"Disable fast mode",parameters:[]},{...J$,id:"prime-on",command:"prime",group:"Extras",label:"Enable Prime",parameters:[]},{...J$,id:"prime-off",command:"prime",group:"Extras",label:"Disable Prime",parameters:[]},{...J$,id:"start-fire",command:"start",group:"Extras",label:"Fire lane start",parameters:[]}].map(uI)),mI=Object.freeze([{kind:"status",id:"account-status",command:"account",group:"Accounts",label:"Account status and usage"},{kind:"status",id:"quota-status",command:"quota",group:"Quota",label:"Quota summary"},{kind:"status",id:"routing-status",command:"routing",group:"Routing",label:"Routing status"},{kind:"status",id:"killswitch-status",command:"killswitch",group:"Limits",label:"Killswitch status"},{kind:"status",id:"cache-status",command:"cache",group:"Cache",label:"Cache status"},{kind:"status",id:"cachekeep-status",command:"cachekeep",group:"Cache",label:"Cache keep status"},{kind:"status",id:"dump-status",command:"dump",group:"Diagnostics",label:"Dump status"},{kind:"status",id:"logging-status",command:"logging",group:"Diagnostics",label:"Logging status"},{kind:"status",id:"fast-status",command:"fast",group:"Extras",label:"Fast mode status"},{kind:"status",id:"prime-status",command:"prime",group:"Extras",label:"Prime quota window status"}].map(($)=>Object.freeze($))),pI=Object.freeze(["remove","move-up","move-down","enrollment-reset","add-apikey","add-oauth-start","add-oauth-finish","custody-mode"]),cI=new Set(pI);function FJ($){return cI.has($)}var lI=Object.freeze(["vault-disconnect"]),iI=new Set(lI);function tK($){return iI.has($)}function dI($,Z){return $==="local"?!tK(Z):!FJ(Z)}function a5($,Z){return $==="opencode"||!["quota","killswitch","prime","start"].includes(Z.command)}function d7($,Z){return Object.freeze({host:$,groups:Object.freeze(yI.map((J)=>Object.freeze({id:J,actions:Object.freeze(t5.filter((X)=>X.group===J&&a5($,X)&&dI(Z,X.id))),statuses:Object.freeze(mI.filter((X)=>X.group===J&&($==="opencode"||X.command!=="killswitch")))})))})}var sI=Object.freeze({opencode:Object.freeze({local:d7("opencode","local"),claustrum:d7("opencode","claustrum")}),pi:Object.freeze({local:d7("pi","local"),claustrum:d7("pi","claustrum")})}),tI=Object.freeze({opencode:Object.freeze(t5.filter(($)=>a5("opencode",$))),pi:Object.freeze(t5.filter(($)=>a5("pi",$)))});function aK($){return tI[$]}function aI($,Z){return sI[$][Z]}var nI=new Set(["routing-reset","start-fire","add-oauth-start","add-oauth-finish"]),oI=new Set(["opencode","pi"]),eZ=Object.getOwnPropertyDescriptor(AbortSignal.prototype,"aborted")?.get;function c$($,Z,J){return Object.freeze({status:"refused",code:$,...Z!==void 0?{action:Z}:{},...J!==void 0?{parameter:J}:{}})}function y8($,Z){if($===null||typeof $!=="object")return"malformed";if(g9.isProxy($))return"malformed";let J=Object.getPrototypeOf($);if(J!==Object.prototype&&J!==null)return"malformed";let X=new Map,Y=!1;for(let G of Reflect.ownKeys($)){if(typeof G!=="string")return"malformed";let z=Reflect.getOwnPropertyDescriptor($,G);if(!z||!Object.hasOwn(z,"value"))return"malformed";if(!Z.includes(G))Y=!0;else X.set(G,z.value)}return Y?"unknown-key":X}function rI($){if($===null||typeof $!=="object")return;if(g9.isProxy($))return;if(!Array.isArray($))return;if(Object.getPrototypeOf($)!==Array.prototype)return;let J=Reflect.getOwnPropertyDescriptor($,"length")?.value;if(typeof J!=="number")return;if(Reflect.ownKeys($).length!==J+1)return;let Y=[];for(let G=0;G<J;G++){let z=Reflect.getOwnPropertyDescriptor($,String(G));if(!z||!Object.hasOwn(z,"value"))return;Y.push(z.value)}return Y}function $0($){return/\S/.test($)}function HZ($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0&&!Object.is($,-0)}function eI($){return HZ($)&&$<=23}function $M($){try{let Z=new URL($.trim());return(Z.protocol==="http:"||Z.protocol==="https:")&&!Z.username&&!Z.password}catch{return!1}}function ZM($){return typeof $==="string"&&$0($)}var JM=["account","fh","sd","scoped"];function XM($){let Z=rI($);if(!Z||Z.length===0)return;let J=[];for(let X of Z){let Y=y8(X,JM);if(!(Y instanceof Map))return;let G=Y.get("account"),z=Y.get("fh"),Q=Y.get("sd"),K=Y.get("scoped");if(!ZM(G))return;if(!HZ(z)||!HZ(Q))return;if(K!==void 0&&!HZ(K))return;J.push(Object.freeze(K===void 0?{account:G,fh:z,sd:Q}:{account:G,fh:z,sd:Q,scoped:K}))}return Object.freeze(J)}var F6={ok:!1,code:"missing-parameter"},Y6={ok:!1,code:"invalid-parameter"},v2={ok:!0,present:!1};function z9($){return{ok:!0,present:!0,value:$}}function YM($,Z,J){let X=!Z||J===void 0||J===null;switch($.kind){case"account-id":if(X)return F6;if(typeof J!=="string")return Y6;return $0(J)?z9(J):F6;case"text":{if(X)return $.required?F6:v2;if(typeof J!=="string")return Y6;if(!$0(J))return $.required?F6:v2;if($.id==="apiKey"&&/\s/.test(J))return Y6;if($.id==="baseURL"&&!$M(J))return Y6;return z9(J)}case"choice":if(X)return $.required?F6:v2;if(typeof J!=="string")return Y6;return $.choices.includes(J)?z9(J):Y6;case"number":if(X)return F6;return eI(J)?z9(J):Y6;case"limit-entries":{if(X)return F6;let Y=XM(J);return Y?z9(Y):Y6}default:return $}}function GM($){if($===null||typeof $!=="object")return"malformed";if(g9.isProxy($)||!eZ)return"malformed";try{Reflect.apply(eZ,$,[])}catch{return"malformed"}return $}function zM($){return $!==void 0&&eZ!==void 0?Reflect.apply(eZ,$,[])===!0:!1}var QM=["interactive","custodyMode","confirmed","sessionId","signal"];function KM($){let Z=y8($,QM);if(!(Z instanceof Map))return;let J=Z.get("interactive"),X=Z.get("custodyMode"),Y=Z.get("confirmed"),G=Z.get("sessionId"),z=Z.get("signal");if(typeof J!=="boolean")return;if(X!=="local"&&X!=="claustrum")return;if(Y!==void 0&&typeof Y!=="boolean")return;if(G!==void 0&&typeof G!=="string")return;let Q;if(z!==void 0){let K=GM(z);if(K==="malformed")return;Q=K}return{interactive:J,custodyMode:X,confirmed:Y===!0,...G!==void 0&&$0(G)?{sessionId:G}:{},...Q!==void 0?{signal:Q}:{}}}function p$($){return{kind:"done",result:$}}function WM($,Z,J){let X=y8(Z,["action","values"]);if(!(X instanceof Map))return p$(c$("invalid-request"));let Y=X.get("action");if(typeof Y!=="string")return p$(c$("invalid-request"));let G=$.get(Y);if(!G)return p$(c$("unsupported-action"));let z=KM(J);if(!z)return p$(c$("invalid-context",G.id));if(z.custodyMode==="claustrum"&&FJ(G.id))return p$(c$("vault-managed",G.id));if(z.custodyMode==="local"&&tK(G.id))return p$(c$("vault-not-connected",G.id));if(G.interactive&&!z.interactive)return p$(c$(G.headlessRefusal,G.id));let Q=X.get("values"),K=G.parameters.map((q)=>q.id),W=Q===void 0?new Map:y8(Q,K);if(W==="malformed")return p$(c$("invalid-request",G.id));if(W==="unknown-key")return p$(c$("unknown-parameter",G.id));let V={};for(let q of G.parameters){let N=YM(q,W.has(q.id),W.get(q.id));if(!N.ok)return p$(c$(N.code,G.id,q.id));if(N.present)V[q.id]=N.value}if(G.id==="cachekeep-window"&&V.startHour===V.endHour)return p$(c$("invalid-parameter",G.id,"endHour"));if(G.destructive&&!z.confirmed)return p$(c$("confirmation-required",G.id));let B=nI.has(G.id);if(B&&z.sessionId===void 0)return p$(c$("session-required",G.id));if(zM(z.signal))return p$(c$("aborted",G.id));if(G.kind==="setup-guidance")return p$(Object.freeze({status:"guidance",action:G.id,mode:V.mode,instructions:G.setupInstructions}));let j=Object.freeze(z.signal!==void 0?{signal:z.signal}:{});if(G.kind==="vault-disconnect")return{kind:"disconnect",options:j};let H=Object.freeze({action:G.id,values:Object.freeze(V),...B?{sessionId:z.sessionId}:{}});return{kind:"dispatch",action:G.id,request:H,options:j}}var VM=new Set(["disconnected","idle","busy","conflict"]);function BM($,Z){let J=y8(Z,["ok","text"]),X=J instanceof Map?J.get("ok"):void 0,Y=J instanceof Map?J.get("text"):void 0;if(typeof X!=="boolean"||typeof Y!=="string")return Object.freeze({status:"failed",action:$,code:"invalid-outcome"});return Object.freeze({status:"executed",action:$,ok:X,text:Y})}function f2($){return TypeError(`Native menu executor option ${$} is invalid`)}function qM($){let Z=y8($,["host","dispatch","disconnectVault"]);if(!(Z instanceof Map))throw TypeError("Native menu executor options are invalid");let J=Z.get("host"),X=Z.get("dispatch"),Y=Z.get("disconnectVault");if(!oI.has(J))throw f2("host");if(typeof X!=="function"||g9.isProxy(X))throw f2("dispatch");if(Y!==void 0&&(typeof Y!=="function"||g9.isProxy(Y)))throw f2("disconnectVault");let G=new Map;for(let K of aK(J))if(K.kind!=="vault-disconnect"||Y!==void 0)G.set(K.id,K);let z=async(K)=>{let W;try{W=await Reflect.apply(Y,void 0,[K])}catch{return Object.freeze({status:"failed",action:"vault-disconnect",code:"execution-failed"})}if(!VM.has(W))return Object.freeze({status:"failed",action:"vault-disconnect",code:"invalid-outcome"});return Object.freeze({status:"disconnect",action:"vault-disconnect",result:W})};return Object.freeze({execute:Object.freeze(async(K,W)=>{let V;try{V=WM(G,K,W)}catch{return c$("invalid-request")}if(V.kind==="done")return V.result;if(V.kind==="disconnect")return z(V.options);let B;try{B=await Reflect.apply(X,void 0,[V.request,V.options])}catch{return Object.freeze({status:"failed",action:V.action,code:"execution-failed"})}return BM(V.action,B)})})}var jM=[/\b[\w-]*(?:secret|token|password|passwd|api[_-]?key|authorization|verifier)["']?\s*[:=]\s*["']?(?:(?:Bearer|Basic)\s+)?[^\s"'&,;}]+/gi,/\b[0-9a-fA-F]{32,}\b/g];function HM($={}){let{redactStrings:Z}=P9({...$,extraValuePatterns:[...jM,...$.extraValuePatterns??[]]});return(J)=>Z(J)}function LM($){return $===null||typeof $==="string"||typeof $==="boolean"||typeof $==="number"&&Number.isFinite($)}function UM($){if($===null||typeof $!=="object"||Array.isArray($))return;let Z=$;if(typeof Z.command!=="string"||typeof Z.sectionId!=="string"||typeof Z.actionId!=="string")return;if(Z.itemId!==void 0&&typeof Z.itemId!=="string")return;if(Z.sessionId!==void 0&&typeof Z.sessionId!=="string")return;if(Z.confirmed!==void 0&&typeof Z.confirmed!=="boolean")return;let J={};if(Z.values!==void 0){if(Z.values===null||typeof Z.values!=="object"||Array.isArray(Z.values))return;for(let[X,Y]of Object.entries(Z.values)){if(!LM(Y))return;Object.defineProperty(J,X,{value:Y,enumerable:!0,writable:!0,configurable:!0})}}return{command:Z.command,sectionId:Z.sectionId,actionId:Z.actionId,...typeof Z.itemId==="string"?{itemId:Z.itemId}:{},...Z.values!==void 0?{values:J}:{},...Z.confirmed===!0?{confirmed:!0}:{},...typeof Z.sessionId==="string"?{sessionId:Z.sessionId}:{}}}a4();var oK="Accounts are managed in the vault. Disconnect from the vault to use local accounts.",m3="Account custody could not be read, so local account changes are unavailable.",NM={Accounts:"accounts",Quota:"quota",Routing:"routing",Limits:"limits",Cache:"cache",Diagnostics:"diagnostics",Extras:"extra"};function p3($,Z){if($===null||typeof $!=="object"||nK.isProxy($))return;try{let J=Object.getOwnPropertyDescriptor($,Z);return J&&"value"in J?J.value:void 0}catch{return}}function c3($){if($===null||typeof $!=="object"||nK.isProxy($))return!1;try{if(Array.isArray($))return!1;let Z=Object.getPrototypeOf($);if(Z!==Object.prototype&&Z!==null)return!1;return Reflect.ownKeys($).every((J)=>{let X=Object.getOwnPropertyDescriptor($,J);return X!==void 0&&"value"in X})}catch{return!1}}function xM($){switch($.kind){case"choice":return{kind:"choice",id:$.id,label:$.id,choices:[...!$.required?[{value:"",label:"Default"}]:[],...$.choices.map((Z)=>({value:Z,label:Z}))]};case"number":return{kind:"number",id:$.id,label:$.id,required:!0,min:0,max:23};case"account-id":return{kind:"text",id:$.id,label:"Account ID (copy the complete ID from status)",required:!0};case"text":return{kind:"text",id:$.id,label:$.id,required:$.required,masked:$.protectedEntry};case"limit-entries":return{kind:"text",id:$.id,label:"Threshold rows as JSON: account, fh, sd, optional scoped",required:!0,placeholder:'[{"account":"main","fh":5,"sd":10,"scoped":0}]'}}}var rK={code:"true",client_id:G0,response_type:"code",redirect_uri:c2,scope:B1.join(" "),code_challenge_method:"S256"},l3=[...Object.keys(rK),"code_challenge","state"],DM=new Set(Object.values(V1)),OM=/^[A-Za-z0-9_-]{43}$/,IM=/^[0-9a-f]{32}$/;function MM($){let Z;try{Z=new URL($)}catch{return!1}if(Z.href!==$||$.includes("#")||Z.username!==""||Z.password!==""||!DM.has(`${Z.origin}${Z.pathname}`))return!1;let J=[...Z.searchParams.keys()];if(J.length!==l3.length||!l3.every((X)=>J.includes(X)))return!1;return Object.entries(rK).every(([X,Y])=>Z.searchParams.get(X)===Y)&&OM.test(Z.searchParams.get("code_challenge")??"")&&IM.test(Z.searchParams.get("state")??"")}function PM($,Z){let J=new Set(($.match(/https:\/\/\S+/g)??[]).filter(MM)),[X]=J;if(J.size!==1||X===void 0)return Z($);return $.split(X).map(Z).join(X)}var _M={disconnected:{ok:!0,text:"Disconnected from the vault. This host uses local accounts again."},idle:{ok:!0,text:"This host has no active vault enrollment."},busy:{ok:!1,code:"busy",text:"Vault disconnect could not finish because another process is changing this host's enrollment. Try again."},conflict:{ok:!1,code:"conflict",text:"Disconnect stopped: this host already has a different stored sign-in, so it and the sign-in saved when the host joined the vault were both kept, and the vault connection remains. Resolve the two sign-ins with offline setup."}};function wM($){switch($.status){case"executed":return{ok:$.ok,text:$.text,...!$.ok?{code:"refused"}:{}};case"guidance":return{ok:!0,text:`Offline ${$.mode} setup guidance (nothing changed):
+${$.instructions.join(`
+`)}`};case"disconnect":return _M[$.result];case"failed":return{ok:!1,code:$.code,text:"Action failed."};case"refused":if($.code==="vault-managed")return{ok:!1,code:$.code,text:`Action refused: ${oK}`};if($.code==="vault-not-connected")return{ok:!1,code:$.code,text:"Action refused: this host is not connected to the vault."};return{ok:!1,code:$.code,text:`Action refused: ${$.code}${$.parameter?` (${$.parameter})`:""}.`,...$.code==="confirmation-required"?{needsConfirmation:!0}:{}}}}function aF($){let{host:Z,dispatch:J,readStatus:X,readMode:Y,disconnectVault:G,interactive:z}=$;if(typeof Y!=="function")throw TypeError("Native UI requires a custody mode reader");if(typeof G!=="function")throw TypeError("Native UI requires a vault disconnect callback");let Q=aK(Z),K=qM({host:Z,dispatch:J,disconnectVault:G}),W=new Set(Q.flatMap((q)=>q.parameters.flatMap((N)=>N.kind==="text"&&N.protectedEntry?[N.id]:[]))),V=HM({extraValuePatterns:[/sk-ant-[A-Za-z0-9_-]+/g]});function B(q,N=V){let{sessionId:U,notify:L}=q;return{...U!==void 0?{sessionId:U}:{},notify:(D,w)=>L(N(D),w)}}async function j(){try{let q=await Y();return q==="local"||q==="claustrum"?q:void 0}catch{return}}async function H(q,N=V,U=!0){let L=B(q,N),D=await j(),w=aI(Z,D??"claustrum"),O=[];for(let x of w.groups){let C=[];if(x.id==="Accounts"&&D!=="local")C.push(D==="claustrum"?oK:m3);if(x.id==="Accounts"&&D==="claustrum"&&$.readAccounts)try{let v=await $.readAccounts();for(let k of v.accounts)if(k.source==="vault"&&k.state==="needs_reauth"&&k.credentialId)C.push(N(`${k.label||k.id} (${k.credentialId}) needs signing in again. Run: ck auth login --provider anthropic --id ${k.credentialId} --replace`))}catch{C.push("Vault sign-in status unavailable; reopen /claude to retry.")}for(let v of x.statuses){if(!U){C.push(`${v.label}: status unavailable.`);continue}try{C.push(N(await X(v.command,L)))}catch{C.push(`${v.label}: status unavailable.`)}}O.push({id:x.id,slot:NM[x.id],title:x.id,lines:C,items:[],actions:x.actions.map((v)=>({id:v.id,label:v.label,knobs:v.parameters.map(xM),...v.destructive?{confirm:{message:v.confirm,irreversible:v.kind!=="vault-disconnect"}}:{},...v.kind==="setup-guidance"?{description:"Offline guidance only; no settings are changed."}:{}}))})}return{command:"claude",title:"Claude",sections:O}}return{command:"claude",async open(q){return{command:"claude",menu:await H(B(q))}},async apply(q,N){let U=B(N),L,D=p3(q,"values"),w=c3(q)&&(D===void 0||c3(D));try{L=w?UM(q):void 0}catch{L=void 0}let O=Q.find((P)=>P.id===L?.actionId&&P.group===L?.sectionId),x={...L?.values},C=[];for(let P of W)for(let M of[x,D]){let _=p3(M,P);if(typeof _==="string"&&_.length>0)C.push(_)}let v=(P)=>{let M=P;for(let _ of C)M=M.split(_).join("[REDACTED]");return V(M)},k=async(P,M=!1)=>({command:"claude",...P,text:M?PM(P.text,v):v(P.text),menu:await H(U,v,w)});if(L?.command!=="claude"||!O||L.itemId!==void 0||L.sessionId!==void 0&&L.sessionId!==U.sessionId)return k({ok:!1,code:"invalid-request",text:"Invalid menu request."});for(let P of O.parameters){if(P.kind==="choice"&&!P.required&&x[P.id]==="")x[P.id]=null;if(P.kind==="limit-entries"&&typeof x[P.id]==="string")try{let M=JSON.parse(String(x[P.id]));x[P.id]=M}catch{return k({ok:!1,code:"invalid-parameter",text:"Threshold rows must be valid JSON."})}}let m=await j();if(m===void 0&&FJ(O.id))return k({ok:!1,code:"custody-unavailable",text:`Action refused: ${m3}`});let l=await K.execute({action:O.id,values:x},{interactive:z,custodyMode:m??"claustrum",confirmed:L.confirmed,sessionId:U.sessionId});return k(wM(l),l.status==="executed"&&l.action==="add-oauth-start"&&l.ok&&C.length===0)}}}Y4();function AM($){if(!($ instanceof Error))return!1;if($.name==="NativeCustodyError")return!0;if($.name!=="NativeRuntimeError")return!1;let Z=Reflect.get($,"code");return Z==="publication-refused"||Z==="unsafe-runtime"||Z==="invalid-runtime"}var RM=new Set(["Error","NativeCustodyError","NativeRuntimeError","LockContentionError"]),TM=new Set(["closed","not-enrolled","invalid-token","unavailable","identity-changed","identity-unasserted","insufficient-validity","invalid-material","not-active","route-unavailable","route-declined","no-receipt","unsafe-file","invalid-state","wrong-consumer","roster-busy","host-slot-login","host-slot-placeholder","placeholder-refresh","publication-refused","unsafe-runtime","invalid-runtime","runtime-io","runtime-conflict","EIO","ENOENT","EACCES","EPERM","ENOSPC"]);function FM($,Z){let J="warn",X="unknown",Y="unknown";try{if(AM(Z))J="error";if(Z instanceof Error){if(RM.has(Z.name))X=Z.name;let G=Reflect.get(Z,"code");if(typeof G==="string"&&TM.has(G))Y=G}}catch{}d[J]($,"Account usage publication unavailable",{name:X,code:Y})}function nF($){let Z=new Set;return{publish(J){let X=new Promise((Y)=>setTimeout(Y,0)).then(J).then(()=>{},(Y)=>FM($,Y));Z.add(X),X.then(()=>Z.delete(X),()=>Z.delete(X))},async drain(){while(Z.size)await Promise.allSettled([...Z])}}}var CM="No vault account can serve this request. Open /claude to see which account needs signing in again.";class n5 extends Error{constructor(){super(CM);this.name="NativeVaultNoAccountError"}}var E2=new WeakMap;function eK($){return $.accounts.some((Z)=>Z.source==="vault"&&Z.type==="oauth"&&Z.enabled&&Z.state==="active")}async function oF($,Z){Z?.throwIfAborted();let J=await $.read();if(Z?.throwIfAborted(),J.mode!=="claustrum")return J;let X=Boolean((await $.vault.read())?.view);if(Z?.throwIfAborted(),X&&eK(J))return J;let Y=E2.get($);if(!Y)Y=SM($,X).finally(()=>E2.delete($)),E2.set($,Y);return kM(Y,Z)}async function SM($,Z){let J=new AbortController,X=setTimeout(()=>J.abort(),2000),Y=J.signal;try{while(!Y.aborted){let G;try{G=await $.vault.refresh(Y)}catch{if(Z||Y.aborted)break}if(G?.view){let z=await $.read();if(z.mode!=="claustrum"||eK(z))return z;throw new n5}if(Z)break;if(Y.aborted)break;await new Promise((z)=>{let Q=()=>{clearTimeout(K),Y.removeEventListener("abort",Q),z()},K=setTimeout(Q,25);if(Y.addEventListener("abort",Q,{once:!0}),Y.aborted)Q()})}throw new n5}finally{clearTimeout(X)}}function kM($,Z){if(!Z)return $;return new Promise((J,X)=>{let Y=()=>X(Z.reason);if(Z.addEventListener("abort",Y,{once:!0}),$.then(J,X).finally(()=>Z.removeEventListener("abort",Y)),Z.aborted)Y()})}var bM="common-auth-placeholder";function hM($){return`${bM}.${$}`}var iM=30000,LZ=1e4,dM=3000,o5,q9=new Map;process.once("exit",()=>{for(let[$,Z]of q9)try{if(Z.renewedAt+LZ<Date.now())continue;let J=pM($);if(r5(J,Z)&&J.mtime.getTime()===Z.mtime)mM($)}catch{}});function r5($,Z){return $.dev===Z.dev&&$.ino===Z.ino}function y9($){return typeof $==="object"&&$!==null&&"code"in $?$.code:void 0}function t3(){return Object.assign(Error("Pi auth lock held"),{code:"ELOCKED"})}async function e5($){try{await lM($)}catch(Z){if(y9(Z)!=="ENOENT")throw Z}}async function $1($,Z){try{await cM($)}catch(J){if(y9(J)!=="EEXIST")throw J;if(Z<=0)throw t3();let X;try{X=(await Z0($)).mtime.getTime()}catch(Y){if(y9(Y)==="ENOENT")return $1($,0);throw Y}if(!(X<Date.now()-Z))throw t3();return await e5($),$1($,0)}try{if(!o5){let Y=new Date(Math.ceil(Date.now()/1000)*1000+5);await JW($,Y,Y)}let J=await Z0($),X=J.mtime.getTime();return o5??=X%1000===0?"s":"ms",{dev:J.dev,ino:J.ino,mtime:X}}catch(J){throw await e5($).catch(()=>{}),J}}async function sM($,Z,J){let X=`${$}.lock`,Y=await $1(X,iM),G=Y.mtime,z=Date.now(),Q=!1,K;q9.set(X,{...Y,renewedAt:z});function W(){if(Q=!0,K)clearTimeout(K);q9.delete(X),Z()}function V(){if(!Q&&z+LZ<Date.now())W()}function B(q=dM){if(Q)return;K=setTimeout(()=>{H()},q),K.unref()}function j(q){if(Q)return;if(y9(q)==="ENOENT"||z+LZ<Date.now())W();else B(1000)}async function H(){if(V(),Q)return;let q;try{q=await Z0(X)}catch(U){j(U);return}if(V(),Q)return;if(!r5(q,Y)||q.mtime.getTime()!==G){W();return}let N=new Date(o5==="s"?Math.ceil(Date.now()/1000)*1000:Date.now());try{await JW(X,N,N)}catch(U){j(U);return}if(Q)return;G=N.getTime(),z=Date.now(),q9.set(X,{...Y,mtime:G,renewedAt:z}),B()}return J?.(async()=>{if(K)clearTimeout(K);await H()}),B(),{assertFresh:V,async release(){if(Q)return;if(Q=!0,K)clearTimeout(K);q9.delete(X);let q=()=>z+LZ<Date.now();if(q()){W();return}let N;try{N=await Z0(X)}catch(U){if(y9(U)!=="ENOENT")throw U;W();return}if(q()||!r5(N,Y)||G!==N.mtime.getTime()){W();return}await e5(X)}}}class A$ extends Error{code;constructor($){super(`Pi slot: ${$}`);this.code=$,this.name="PiSlotError"}}function tM($){let Z=$.indexOf("{")+1,J={offset:Z-1,children:[]},X=()=>{while(/\s/.test($[Z]??"")&&Z<$.length)Z++},Y=()=>{Z++;while(Z<$.length){if($[Z++]==='"')return;if($[Z-1]==="\\")Z++}};X();while($[Z]!=="}"){let G=Z;Y();let z=JSON.parse($.slice(G,Z));X(),Z++,X();let Q=Z,K=0;while(Z<$.length){let V=$[Z];if(V==='"'){Y();continue}if(V==="{"||V==="[")K++;if(V==="}"||V==="]"){if(K===0)break;K--}if(V===","&&K===0)break;Z++}let W=Z;while(/\s/.test($[W-1]??""))W--;if(J.children.push({key:z,offset:G,length:W-G,value:{offset:Q,length:W-Q}}),X(),$[Z]==="}")break;Z++,X()}return J}function u9($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function Z1($){if(Array.isArray($))return`[${$.map(Z1).join(",")}]`;if(u9($))return`{${Object.keys($).sort().map((Z)=>`${JSON.stringify(Z)}:${Z1($[Z])}`).join(",")}}`;return JSON.stringify($)}function R4($){return gM("sha256").update(Z1($)).digest("hex")}function UZ($){return u9($)?$.code:void 0}async function a3($,Z=!1,J){let X;try{X=await ZW($,i3.O_RDONLY|i3.O_NOFOLLOW);let Y=await X.stat();if(!Y.isFile()||Z&&(Y.mode&511)!==384)throw new A$("unsafe-path");await J?.($);let G=await $W($);if(!G.isFile()||G.dev!==Y.dev||G.ino!==Y.ino)throw new A$("unsafe-path");let z=await X.readFile(),Q=z.toString("utf8");if(!z.equals(Buffer.from(Q)))throw new A$(Z?"invalid-stash":"invalid-auth");return Q}catch(Y){if(UZ(Y)==="ENOENT"&&!X)return;if(UZ(Y)==="ELOOP"||UZ(Y)==="ENOENT")throw new A$("unsafe-path");throw Y}finally{await X?.close()}}function aM($,Z){try{let J=JSON.parse($);if(!u9(J))throw Error();let X=tM($),Y=X.children,G=Y.map((K)=>K.key);if(new Set(G).size!==G.length)throw Error();let z=Y.find((K)=>K.key===Z),Q=z?J[Z]:null;if(Q!==null&&!u9(Q))throw Error();if(z&&Q===null)throw Error();return{text:$,root:X,property:z,entry:Q}}catch{throw new A$("invalid-auth")}}function nM($){let Z=$.property?.value;return Z?$.text.slice(Z.offset,Z.offset+Z.length):null}function n3($,Z,J){let{text:X,root:Y,property:G}=$,z=Y.children??[];if(G){let W=G.value;if(!W)throw new A$("invalid-auth");if(J!==null)return X.slice(0,W.offset)+J+X.slice(W.offset+W.length);let V=z.indexOf(G),B=z[V-1],j=z[V+1],H=B?B.offset+B.length:G.offset,q=!B&&j?j.offset:G.offset+G.length;return X.slice(0,H)+X.slice(q)}if(J===null)return X;let Q=z.at(-1),K=Q?Q.offset+Q.length:Y.offset+1;return`${X.slice(0,K)}${Q?",":""}${JSON.stringify(Z)}:${J}${X.slice(K)}`}async function oM($){let Z=await ZW($,"r");try{await Z.sync()}finally{await Z.close()}}async function b2($,Z,J,X){await u8($,null,{serialize:()=>Z,durable:!0,beforeRename:async()=>{await X?.($),J()}})}function rM($){return eM($)}function eM($,Z,J){let{provider:X,placeholderKey:Y}=$,G=$.lockTimeoutMs??30000;if(!X||!$.authPath||!$.stashPath||!Y||Y.startsWith("!")||Y.includes("$")||!Number.isFinite(G)||G<0)throw new A$("invalid-options");let z=s3($.authPath),Q=s3($.stashPath);if(z===Q||Q===`${z}.lock`)throw new A$("invalid-options");let K=R4(z),W=R4(Y),V={type:"api_key",key:Y},B=(U)=>R4(U)===R4(V);async function j(){let U=await a3(Q,!0,J?.afterReadCheck);if(U===void 0)return;try{let L=JSON.parse(U);if(L.version!==1||L.provider!==X||L.authIdentity!==K||L.placeholderIdentity!==W||L.entry!==null&&!u9(L.entry)||L.sha256!==R4(L.entry)||(L.entry===null?L.entryJson!==null:typeof L.entryJson!=="string"||R4(JSON.parse(L.entryJson))!==L.sha256))throw Error();return L}catch{throw new A$("invalid-stash")}}async function H(U){let L,D,w=!1,O=()=>{if(D?.(),w)throw new A$("lock-compromised")};try{await d3(s7(z),{recursive:!0,mode:448});let x=Date.now()+G,C=0;while(!L)try{let k=await sM(z,()=>{w=!0},J?.onRenew);L=k.release,D=k.assertFresh}catch(k){if(UZ(k)!=="ELOCKED")throw k;let m=x-Date.now();if(m<=0)throw new A$("lock-timeout");await uM(Math.min(Math.round(Math.min(10*2**C++,1000)*(1+Math.random())),m))}O();let v=await U(O);return O(),v}catch(x){if(x instanceof A$)throw x;throw new A$("io")}finally{await L?.().catch(()=>{}),O()}}async function q(){let U=aM(await a3(z,!1,J?.afterReadCheck)??"{}",X),L=await j();return{auth:U,stash:L}}async function N(U){U(),await yM(Q),await oM(s7(Q)),Z?.("stash-deleted")}return{inspect:()=>H(async()=>{let{auth:U,stash:L}=await q();return{slot:B(U.entry)?"placeholder":U.entry===null?"empty":!L||R4(U.entry)===L.sha256?"original":"foreign",stash:L?"valid":"missing"}}),enterVault:()=>H(async(U)=>{let{auth:L,stash:D}=await q();if(B(L.entry)){if(!D)throw new A$("missing-stash");return}if(D&&R4(L.entry)!==D.sha256)throw new A$("conflict");if(!D){await d3(s7(Q),{recursive:!0,mode:448});let w=await $W(s7(Q));if(!w.isDirectory()||(w.mode&511)!==448)throw new A$("unsafe-path");let O={version:1,provider:X,authIdentity:K,placeholderIdentity:W,entry:L.entry,entryJson:nM(L),sha256:R4(L.entry)};await b2(Q,JSON.stringify(O),U,J?.beforeRename),Z?.("stash-written")}await b2(z,n3(L,X,JSON.stringify(V)),U,J?.beforeRename),Z?.("auth-written")}),exitVault:()=>H(async(U)=>{let{auth:L,stash:D}=await q();if(!D){if(B(L.entry))throw new A$("missing-stash");return"nothing-to-do"}if(B(L.entry))await b2(z,n3(L,X,D.entryJson),U,J?.beforeRename),Z?.("auth-written");else if(R4(L.entry)!==D.sha256)return"conflict";return await N(U),"restored"})}}function $P($){return{authPath:EM($.authPath),stashPath:fM(vM(o9("pi",$.env).tokenPath),"pi-auth-slot","anthropic.json"),provider:"anthropic",placeholderKey:hM("anthropic")}}function zC($){return rM($P($))}async function QC($){if($.host==="pi"&&await $.slot.exitVault()==="conflict")return"conflict";return ED(o9($.host,$.env),`anthropic-auth-${$.host}`)}Y4();var QP=60000,XW=60000,KP=21600000,WP=90000,VP=300000;function BP($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="on")return{type:"enable"};if(Z.length===1&&Z[0]==="off")return{type:"disable"};return{type:"usage"}}function J1($){if(!$)return 0;return($.inputTokens*IY.input+$.outputTokens*IY.output)/1e6}function qP($,Z,J){if(J?.label?.trim())return J.label;if($==="main")return"main";let X=Z?.accounts?.find((Y)=>Y.id===$);if(X?.label?.trim())return X.label;return $}function jP($,Z){let J=Z?.transient,X=$?.quota?.mainQuota,Y=$?.prime?.main,G={id:"main",label:"main",nextDueAt:e3(X?.five_hour),lastPrimedAt:J?.get("main")?.lastPrimedAt??null,lastResult:J?.get("main")?.lastResult,usage:Y,estimatedCostUsd:J1(Y)},z=($?.accounts??[]).filter(E$).filter((Q)=>Q.id!=="main").filter((Q)=>Q.enabled!==!1).map((Q)=>({id:Q.id,label:qP(Q.id,$,Q),nextDueAt:e3(Q.quota?.five_hour),lastPrimedAt:J?.get(Q.id)?.lastPrimedAt??null,lastResult:J?.get(Q.id)?.lastResult,usage:Q.prime,estimatedCostUsd:J1(Q.prime)}));return[G,...z]}function e3($){if(!$?.resetsAt)return;let Z=Date.parse($.resetsAt);if(!Number.isFinite(Z))return;return Z+XW}function a7($){let J=[$.enabled?"## Claude Prime Status":"## Claude Prime Disabled",""];J.push(`Status: ${$.enabled?"enabled":"disabled"}`),J.push(""),J.push("Accounts:");for(let X of $.accounts){let G=X.usage?.count??0,z=HP(X.nextDueAt),Q=LP(X.lastPrimedAt,X.lastResult),K=[`${X.label}`];if(z)K.push(`next prime ${z}`);if(Q)K.push(Q);if(G>0)K.push(`${G} ${G===1?"prime":"primes"} ≈ $${UP(X.estimatedCostUsd??0)}`);J.push(`- ${K.join(" · ")}`)}return J.push(""),J.push("Usage: `/claude-prime on`, `/claude-prime off`, or status."),J.join(`
+`)}function HP($){if(typeof $!=="number")return"";return new Date($).toLocaleTimeString([],{hour:"2-digit",minute:"2-digit"})}function LP($,Z){if(typeof $!=="number")return"";let J=new Date($).toLocaleTimeString([],{hour:"2-digit",minute:"2-digit"});if(Z==="error")return`primed ${J} err`;if(Z==="skipped")return`primed ${J} skipped`;return`primed ${J} ✓`}function UP($){if($===0)return"0";if($<0.0001)return $.toExponential(2);return $.toFixed(Math.min(6,Math.max(0,4)))}function jC($){let Z=BP($.argumentsText);if(Z.type==="status")return{text:a7({enabled:$.enabled,accounts:$.accounts})};if(Z.type==="enable")return{text:a7({enabled:!0,accounts:$.accounts}),updated:{enabled:!0}};if(Z.type==="disable")return{text:a7({enabled:!1,accounts:$.accounts}),updated:{enabled:!1}};return{text:["## Claude Prime Usage","","Usage: `/claude-prime`, `/claude-prime on`, or `/claude-prime off`.","",a7({enabled:$.enabled,accounts:$.accounts})].join(`
+`)}}var NP={"not-oauth":"API-key account",disabled:"disabled","needs-reauth":"needs re-login",killswitch:"killswitch"};function xP($){if(!$.isOAuth)return{eligible:!1,reason:"not-oauth"};if(!$.isEnabled)return{eligible:!1,reason:"disabled"};if($.hasPermanentRefreshError)return{eligible:!1,reason:"needs-reauth"};return{eligible:!0}}function $G($){return NP[$]}var DP={model:XQ,max_tokens:1,system:"Reply with 1 when you receive 0.",messages:[{role:"user",content:"0"}]};function HC(){return JSON.parse(JSON.stringify(DP))}function ZG(){return l8(GP(),"opencode-anthropic-auth","prime")}function OP($){let Z=zP($),J;try{J=JP(Z)}catch(X){if(X.code!=="ENOENT")throw X;J=Z}return ZP("sha256").update(J).digest("hex").slice(0,12)}function YW($,Z){return l8($,OP(Z))}function IP($,Z,J){if(!/^[a-f0-9]{12,}$/i.test(J))throw Error("Prime account fingerprint must be a hexadecimal digest");return l8(YW($,Z),J.toLowerCase().slice(0,12))}function JG($,Z,J){return l8($,`${encodeURIComponent(Z)}-${J}`)}function XG($,Z){return l8($,`${encodeURIComponent(Z)}-bootstrap`)}function h2($,Z){if($==="main")return"main";if(Z&&"label"in Z&&Z.label?.trim())return Z.label;return $}function MP($){let Z=[],J=$.refresh?.mainLastRefreshError;Z.push({id:"main",label:"main",isOAuth:!0,isEnabled:!0,hasPermanentRefreshError:PZ(J),storedQuota:$.quota?.mainQuota,storedFiveHour:$.quota?.mainQuota?.five_hour});for(let X of $.accounts??[]){if(X.id==="main"){d.debug("prime","ineligible",{account:h2(X.id,X),reason:"reserved-id"});continue}if(!E$(X)){Z.push({id:X.id,label:h2(X.id,X),isOAuth:!1,isEnabled:X.enabled!==!1,hasPermanentRefreshError:!1});continue}Z.push({id:X.id,label:h2(X.id,X),isOAuth:!0,isEnabled:X.enabled!==!1,hasPermanentRefreshError:PZ(X.lastRefreshError),storedQuota:X.quota,storedFiveHour:X.quota?.five_hour})}return Z}function YG($){if(!$?.resetsAt)return;let Z=Date.parse($.resetsAt);return Number.isFinite(Z)?Z:void 0}class PP{timer=null;setIntervalImpl;clearIntervalImpl;setTimeoutImpl;clearTimeoutImpl;postFireRefreshTimers=new Set;lastForcedCheck=new Map;stopped=!1;options;transient=new Map;counters=new Map;windowActive=new Map;constructor($){this.options=$,this.setIntervalImpl=$.setIntervalImpl??globalThis.setInterval,this.clearIntervalImpl=$.clearIntervalImpl??globalThis.clearInterval,this.setTimeoutImpl=$.setTimeoutImpl??globalThis.setTimeout,this.clearTimeoutImpl=$.clearTimeoutImpl??globalThis.clearTimeout}updateOptions($){this.options=$}start(){if(this.timer)return;if(this.stopped=!1,d.trace("prime","manager started"),this.timer=this.setIntervalImpl(()=>{this.tick().catch(()=>{d.warn("prime","tick failed")})},QP),typeof this.timer==="object"&&"unref"in this.timer)this.timer.unref?.()}stop(){let $=this.timer!==null,Z=this.postFireRefreshTimers.size>0;if(this.stopped=!0,this.timer)this.clearIntervalImpl(this.timer),this.timer=null;for(let J of this.postFireRefreshTimers)this.clearTimeoutImpl(J);if(this.postFireRefreshTimers.clear(),this.lastForcedCheck.clear(),!$&&!Z)return;d.trace("prime","manager stopped")}isStopped(){return this.stopped}async tick(){let $=this.options.now?.()??Date.now();if(d.trace("prime","tick start",{now:$}),await this.sweepMarkers($),this.stopped){d.trace("prime","tick: stopped, aborting");return}let Z=await this.options.loadStorage();if(!Z){d.trace("prime","tick: no storage, skipping");return}if(Z.prime?.enabled!==!0){d.trace("prime","tick: feature disabled, skipping");return}let J=MP(Z);await Promise.all(J.map((X)=>this.runForAccount(X,Z,$))),d.trace("prime","tick end")}stats($,Z){let J=jP($??null,{now:Z,transient:this.transient});if(this.counters.size===0)return J;return J.map((X)=>{let Y=this.counters.get(X.id);if(!Y)return X;return{...X,usage:Y,estimatedCostUsd:J1(Y)}})}isWindowActive($){return this.windowActive.has($)}async runForAccount($,Z,J){try{if(this.stopped)return;let X=xP({storage:Z,accountId:$.id,isOAuth:$.isOAuth,isEnabled:$.isEnabled,hasPermanentRefreshError:$.hasPermanentRefreshError,quota:$.storedQuota});if(!X.eligible){d.debug("prime","ineligible",{account:$.label,reason:$G(X.reason)});return}let Y=YG($.storedFiveHour);if(Y!==void 0&&J<Y+XW){d.trace("prime","not due",{account:$.label});return}let G=await this.options.getAccountFingerprint($.id);if(!G){d.debug("prime","credential identity unavailable",{account:$.label});return}let z=`${$.id}:${G.toLowerCase().slice(0,12)}`,Q=this.markerDir(G),K=XG(Q,$.id),W=Y===void 0?K:JG(Q,$.id,Y);try{await r3(W);return}catch(D){if(D.code!=="ENOENT")throw D}if(Y===void 0&&await this.hasAnyClaimMarker($.id,G))return;if(this.stopped)return;let V=this.lastForcedCheck.get(z);if(V!==void 0&&V.resetEpoch===Y&&J<V.at+VP)return;this.lastForcedCheck.set(z,{at:J,resetEpoch:Y});let B;try{B=await this.options.refreshQuota($.id)}catch{d.warn("prime","refresh failed",{account:$.label});return}if(this.stopped)return;let j=await this.options.loadStorage();if(j?.prime?.enabled!==!0)return;let H=B.quota;if(!B.fresh){d.debug("prime","stale fresh-check",{account:$.label});return}if(!zz(H,j,$.id,XQ)){d.debug("prime","ineligible",{account:$.label,reason:$G("killswitch")});return}let q=YG(H?.five_hour);if(q!==void 0&&q>J){d.debug("prime","window active",{account:$.label,resetsAt:H.five_hour?.resetsAt}),this.windowActive.set($.id,J);return}this.windowActive.delete($.id);let N=q??Y,U=N===void 0?await this.tryClaimBootstrap($.id,G):await this.tryClaim($.id,G,N);if(!U){d.debug("prime","claim lost",{account:$.label,marker:`${$.id}-${N??"bootstrap"}`});return}let L=await this.options.loadStorage();if(this.stopped||L?.prime?.enabled!==!0){await t7(U,{force:!0});return}if(N!==void 0){if(await t7(K,{force:!0}),this.stopped){await t7(U,{force:!0});return}}await this.fire($,J,L)}catch{d.warn("prime","account evaluation failed",{account:$.label})}}async tryClaim($,Z,J){let X=this.markerDir(Z),Y=JG(X,$,J);return this.tryClaimPath(X,Y)}async tryClaimBootstrap($,Z){let J=this.markerDir(Z),X=XG(J,$);return this.tryClaimPath(J,X)}async tryClaimPath($,Z){try{await XP($,{recursive:!0})}catch{}try{return await YP(Z,"",{encoding:"utf8",flag:"wx"}),Z}catch(J){if(J.code==="EEXIST")return null;throw J}}async hasAnyClaimMarker($,Z){let J=this.markerDir(Z),X=`${encodeURIComponent($)}-`;try{return(await o3(J)).some((Y)=>Y.startsWith(X))}catch(Y){if(Y.code==="ENOENT")return!1;throw Y}}async fire($,Z,J){let X;try{X=await this.options.sendPrime($.id)}catch{d.warn("prime","prime fire threw",{account:$.label}),this.transient.set($.id,{lastPrimedAt:Z,lastResult:"error"});return}if(this.stopped)return;if(!X.ok){if(X.reason==="token-refresh")d.warn("prime","prime token refresh failed",{account:$.label,reason:"token-refresh"});else if(X.reason==="vault-cold")d.debug("prime","prime vault credential cold",{account:$.label,reason:X.reason});else d.warn("prime","prime fire failed",{account:$.label,status:X.status,reason:"send"});this.transient.set($.id,{lastPrimedAt:Z,lastResult:X.reason==="vault-cold"?"skipped":"error"});return}let Y={inputTokens:X.usage?.inputTokens,outputTokens:X.usage?.outputTokens};try{let G=await this.options.recordSuccess($.id,Y);if(this.stopped){this.transient.delete($.id),this.counters.delete($.id);return}this.counters.set($.id,G),this.transient.set($.id,{lastPrimedAt:Z,lastResult:"ok"}),d.info("prime","prime fired",{account:$.label,status:X.status,ms:X.ms,usage:{inputTokens:G.inputTokens,outputTokens:G.outputTokens}}),this.schedulePostFireRefresh($)}catch{d.warn("prime","recordSuccess failed",{account:$.label}),this.transient.set($.id,{lastPrimedAt:Z,lastResult:"error"})}}schedulePostFireRefresh($){let Z=this.setTimeoutImpl(()=>{if(this.postFireRefreshTimers.delete(Z),this.stopped)return;(async()=>{let J=await this.options.loadStorage();if(this.stopped||J?.prime?.enabled!==!0)return;await this.options.refreshQuota($.id)})().catch(()=>{d.debug("prime","post-fire refresh failed",{account:$.label})})},WP);if(this.postFireRefreshTimers.add(Z),typeof Z==="object"&&"unref"in Z)Z.unref?.()}async sweepMarkers($){let Z=this.storageMarkerDir(),J=await this.sweepMarkerDirectory(Z,$);if(J>0)d.trace("prime","swept stale markers",{swept:J})}async sweepMarkerDirectory($,Z){let J;try{J=await o3($)}catch{return 0}let X=0;for(let Y of J)try{let G=l8($,Y),z=await r3(G);if(z.isDirectory()){X+=await this.sweepMarkerDirectory(G,Z);continue}if(Z-z.mtimeMs>KP)await t7(G,{force:!0}),X+=1}catch{}return X}storageMarkerDir(){return YW(this.options.markerDir??ZG(),this.options.storagePath)}markerDir($){return IP(this.options.markerDir??ZG(),this.options.storagePath,$)}}var D8=3,y2=180000;function u2(){return process.env.OPENCODE_ANTHROPIC_AUTH_QUOTA_FEED_DIR??NZ(FP(),"opencode-anthropic-auth","quota-header-feed")}function DC($){return($.storage?.accounts.filter(E$).length??0)+($.mainOAuthConfigured?1:0)}function GW($){if($.schema_version!==D8||$.provider!=="anthropic")return!1;if(!Number.isFinite($.configured_account_count)||!Number.isFinite($.observed_at_ms))return!1;if(!$.quota||typeof $.quota!=="object")return!1;if(!Object.hasOwn($,"anthropic_account_uuid")||$.anthropic_account_uuid!==null&&typeof $.anthropic_account_uuid!=="string")return!1;if($.identity_source==="none")return!("credential_id"in $)&&!("account_ref"in $);if($.identity_source==="credential_id")return typeof $.credential_id==="string"&&$.credential_id.length>0&&$.credential_id!=="main"&&!("account_ref"in $);if($.identity_source==="account_ref")return typeof $.account_ref==="string"&&$.account_ref.length>0&&$.account_ref!=="main"&&!("credential_id"in $);return!1}function CP($){if($.schema_version!==D8||$.provider!=="anthropic"||!GW($))throw Error("Invalid quota header feed entry")}function S8($){return typeof $==="number"&&Number.isFinite($)}function X1($){if(!$||typeof $!=="object")return;let Z=$;if(!S8(Z.usedPercent)||!S8(Z.remainingPercent)||!S8(Z.checkedAt))return;return{usedPercent:Z.usedPercent,remainingPercent:Z.remainingPercent,...typeof Z.resetsAt==="string"&&{resetsAt:Z.resetsAt},checkedAt:Z.checkedAt}}function SP($){if(!$||typeof $!=="object")return;let Z=$,J=X1(Z);if(!J||typeof Z.id!=="string"||!Z.id.trim()||typeof Z.title!=="string"||!Z.title.trim()||typeof Z.modelName!=="string"||!Z.modelName.trim())return;return{...J,id:Z.id,title:Z.title,...typeof Z.modelId==="string"&&Z.modelId.trim()&&{modelId:Z.modelId},modelName:Z.modelName}}function WG($){if(!$||typeof $!=="object")return;let Z=$;if(!S8(Z.amountMinor)||typeof Z.currency!=="string"||!Z.currency.trim()||!S8(Z.exponent))return;return{amountMinor:Z.amountMinor,currency:Z.currency,exponent:Z.exponent}}function kP($){if(!$||typeof $!=="object")return;let Z=$,J=WG(Z.used),X=WG(Z.limit);if(!J||!X||typeof Z.exhausted!=="boolean")return;return{used:J,limit:X,...S8(Z.utilizationPercent)&&{utilizationPercent:Z.utilizationPercent},...typeof Z.severity==="string"&&{severity:Z.severity},exhausted:Z.exhausted}}function vP($,Z){if(!$||typeof $!=="object")return;let J=$,X={};for(let Y of i9){if(!Z.has(Y))continue;let G=J[Y];if(G==="poll"||G==="headers")X[Y]=G}return Object.keys(X).length>0?X:void 0}function fP($){let Z=X1($.five_hour),J=X1($.seven_day),X=Array.isArray($.scoped)?$.scoped.map(SP).filter((Q)=>Q!=null):void 0,Y=kP($.extraUsage),G=new Set;if(Z)G.add("five_hour");if(J)G.add("seven_day");if(typeof $.bindingWindow==="string")G.add("bindingWindow");if(typeof $.fallbackAdvised==="boolean")G.add("fallbackAdvised");if(X)G.add("scoped");if(Y)G.add("extraUsage");let z=vP($.fieldSources,G);return{...Z&&{five_hour:Z},...J&&{seven_day:J},...typeof $.bindingWindow==="string"&&{bindingWindow:$.bindingWindow},...typeof $.fallbackAdvised==="boolean"&&{fallbackAdvised:$.fallbackAdvised},...X&&{scoped:X},...Y&&{extraUsage:Y},...z&&{provenance:z}}}class EP{options;filePath;writeChain=Promise.resolve();constructor($={}){this.options=$;let Z=$.instanceId??`${process.pid}-${GG()}`;this.filePath=NZ($.directory??u2(),`${Z}.json`)}publish($){let{accountKey:Z,quota:J}=$;try{CP($)}catch(G){return Promise.reject(G)}let Y={...$.identity_source==="credential_id"?{identity_source:"credential_id",credential_id:$.credential_id}:$.identity_source==="account_ref"?{identity_source:"account_ref",account_ref:$.account_ref}:{identity_source:"none"},schema_version:$.schema_version,provider:$.provider,configured_account_count:$.configured_account_count,observed_at_ms:$.observed_at_ms,anthropic_account_uuid:$.anthropic_account_uuid,quota:fP(J)};if(!Z)return Promise.reject(Error("Invalid quota header feed account key"));return this.writeChain=this.writeChain.catch(()=>{}).then(async()=>{let G=this.options.directory??u2();await wP(G,{recursive:!0,mode:448}),await zG(G,448),await this.reapStaleSiblingLeases(G);let z={};try{let K=JSON.parse(await KG(this.filePath,"utf8"));if(K.version===D8&&K.entries&&typeof K.entries==="object")z=K.entries}catch{}z[Z]=Y;let Q=`${this.filePath}.${GG()}.tmp`;try{await TP(Q,`${JSON.stringify({version:D8,lease_horizon_ms:this.options.leaseMs??y2,entries:z})}
+`,{mode:384}),await zG(Q,384),await AP(Q,this.filePath)}finally{await g2(Q,{force:!0})}}),this.writeChain}async reapStaleSiblingLeases($){let Z=this.options.now?.()??Date.now(),J=this.options.leaseMs??y2,X;try{X=await QG($)}catch{return}await Promise.all(X.filter((Y)=>/^\d+-[0-9a-f-]+\.json$/i.test(Y)).map(async(Y)=>{let G=NZ($,Y);if(G===this.filePath)return;try{let z=await RP(G);if(z.mtimeMs>Z||Z-z.mtimeMs<J)return;await this.options.beforeRemoveFile?.(G);let Q=await _P(G);if(Q.ino!==z.ino||Q.mtimeMs!==z.mtimeMs)return;await(this.options.removeFile??((K)=>g2(K)))(G)}catch{}}))}async list(){await this.writeChain.catch(()=>{});let $=this.options.directory??u2(),Z=this.options.now?.()??Date.now(),J=this.options.leaseMs??y2,X;try{X=(await QG($)).filter((G)=>G.endsWith(".json"))}catch{return[]}let Y=new Map;return await Promise.all(X.map(async(G)=>{try{let z=JSON.parse(await KG(NZ($,G),"utf8"));if(z.version!==D8||!z.entries||typeof z.entries!=="object")return;for(let[Q,K]of Object.entries(z.entries)){if(!K||typeof K!=="object"||K.schema_version!==D8||K.provider!=="anthropic"||!GW(K))continue;let W=K.observed_at_ms;if(W>Z||Z-W>=J)continue;let V=Y.get(Q);if(!V||W>V.observed_at_ms)Y.set(Q,K)}}catch{}})),[...Y.values()].sort((G,z)=>G.observed_at_ms-z.observed_at_ms)}async dispose(){await this.writeChain.catch(()=>{}),await g2(this.filePath,{force:!0})}}var m9="anthropic-ratelimit-unified-",zW={"5h":"five_hour","7d":"seven_day"};function OC($){return Object.keys(zW).some((Z)=>Number.isFinite(Y1($,`${m9}${Z}-utilization`)))}function Y1($,Z){let J=$.get(Z);if(J==null||J.trim()==="")return;let X=Number(J);return Number.isFinite(X)?X:void 0}function bP($,Z,J){let X=Y1($,`${m9}${Z}-utilization`);if(X==null)return;let Y=Math.min(100,Math.max(0,Math.round(X*100))),G=Y1($,`${m9}${Z}-reset`),z=G==null?void 0:new Date(G*1000),Q=z&&Number.isFinite(z.getTime())?z.toISOString():void 0;return{usedPercent:Y,remainingPercent:100-Y,...Q&&{resetsAt:Q},checkedAt:J}}function IC($,Z=Date.now()){let J={},X=$.get(`${m9}fallback`),Y={fallbackAdvised:X==="available",source:"headers",checkedAt:Z};for(let[z,Q]of Object.entries(zW)){let K=bP($,z,Z);if(K)Y[Q]=K,J[Q]="headers"}let G=$.get(`${m9}representative-claim`);if(G)Y.bindingWindow=G,Y.bindingWindowSource="headers",J.bindingWindow="headers";if(X!==null)J.fallbackAdvised="headers";return{...Y,fieldSources:J}}function xZ($,Z){let{scoped:J,extraUsage:X,fieldSources:Y,...G}=$??{},{scoped:z,extraUsage:Q,fieldSources:K,...W}=Z,V={};for(let B of i9){let j=B==="scoped"?J:B==="extraUsage"?X:B==="fallbackAdvised"?K?.fallbackAdvised!==void 0?Z.fallbackAdvised:$?.fallbackAdvised??Z.fallbackAdvised:B==="bindingWindow"?$?.bindingWindowSource==="poll"?$?.bindingWindow:Z.bindingWindow??$?.bindingWindow:Z[B]??$?.[B];if(j===void 0)continue;let H=B==="fallbackAdvised"?K?.fallbackAdvised??($?.fallbackAdvised!==void 0?Y?Y.fallbackAdvised:Q6($,B):void 0):(B==="scoped"||B==="extraUsage")&&j!==void 0?"poll":B==="bindingWindow"&&$?.bindingWindowSource==="poll"&&$.bindingWindow!==void 0?"poll":Z[B]!==void 0?K?.[B]??Q6(Z,B):Y?.[B]??Q6($,B);if(H)V[B]=H}return{...G,...W,...Array.isArray(J)&&{scoped:J},...X!=null&&{extraUsage:X},fallbackAdvised:K?.fallbackAdvised!==void 0?Z.fallbackAdvised:$?.fallbackAdvised??Z.fallbackAdvised,bindingWindow:$?.bindingWindowSource==="poll"?$.bindingWindow:Z.bindingWindow??$?.bindingWindow,bindingWindowSource:$?.bindingWindowSource==="poll"?"poll":Z.bindingWindowSource??$?.bindingWindowSource,...Object.keys(V).length>0&&{fieldSources:V},source:"headers"}}Y4();var hP=globalThis.setTimeout;function VG($,Z){if($?.source!=="headers")return Z;let J=Boolean($.five_hour&&$.five_hour.checkedAt>(Z.five_hour?.checkedAt??0)),X=Boolean($.seven_day&&$.seven_day.checkedAt>(Z.seven_day?.checkedAt??0));if(!J&&!X)return Z;return xZ(Z,{...J&&{five_hour:$.five_hour},...X&&{seven_day:$.seven_day},fallbackAdvised:$.fallbackAdvised,...$.bindingWindowSource==="headers"&&{bindingWindow:$.bindingWindow,bindingWindowSource:$.bindingWindowSource},source:"headers",checkedAt:Math.max(J?$.five_hour?.checkedAt??0:0,X?$.seven_day?.checkedAt??0:0)})}class S6{main=null;mainAccountId;mainQuotaIdentityKnown=!1;mainQuotaIdentityStrict=!1;mainGeneration=0;mainQuotaErrorGeneration=0;mainQuotaErrorClearedAt;fallbacks=new Map;fallbackAuthLineages=new Map;fallbackGenerations=new Map;inflightMain=null;lastMainPollAttempt;inflightMainAccountId;inflightMainAccessToken;inflightMainToken=0;inflightFallbacks=new Map;mainLastApiError=void 0;fallbackApiErrors=new Map;apiGate=Promise.resolve();lastApiCallAt;storage;fetchImpl;fetchQuotaSnapshot;now;onMainQuotaFetched;onApiError;onFallbackQuotaFetched;onFallbackApiError;constructor($){this.storage=$.storage,this.fetchImpl=$.fetchImpl??fetch,this.fetchQuotaSnapshot=$.fetchQuotaSnapshot,this.now=$.now??Date.now,this.onMainQuotaFetched=$.onMainQuotaFetched,this.onApiError=$.onApiError,this.onFallbackQuotaFetched=$.onFallbackQuotaFetched,this.onFallbackApiError=$.onFallbackApiError,this.seedMainFromStorage($.storage,$.storage?.mainAccountId),this.seedMainBackoffFromStorage($.storage)}getMain($){if(this.mainAccountId!==$)return null;if(this.mainQuotaIdentityKnown&&this.mainQuotaIdentityStrict&&($===void 0||this.main?.quota.accountIdentity!==$))return null;return this.main}getFallback($,Z){return this.bindFallbackLineage($,Z),this.fallbacks.get($)??null}canFetchWithoutAccessToken(){return Boolean(this.fetchQuotaSnapshot)}getAllFallbacks(){return this.fallbacks}setMain($,Z){this.mainAccountId=$,this.main=Z}clearMain(){this.mainAccountId=void 0,this.main=null}setMainQuotaAccountIdentity($,Z=!0,J=!1){let X=this.mainQuotaIdentityKnown,Y=this.mainAccountId,G=J||!X||this.mainAccountId!==$||this.mainQuotaIdentityStrict!==Z;if(this.mainQuotaIdentityKnown=!0,this.mainQuotaIdentityStrict=Z,!G)return;if(this.mainGeneration+=1,this.mainAccountId=$,J)this.main=null,this.mainLastApiError=void 0,this.mainQuotaErrorGeneration+=1,this.mainQuotaErrorClearedAt=L8(this.mainQuotaErrorClearedAt,this.now());else if($!==void 0&&this.main?.quota.accountIdentity!==$)this.main=null;if($!==void 0&&this.mainLastApiError&&(this.mainLastApiError.accountIdentity!==void 0?this.mainLastApiError.accountIdentity!==$:X&&Y!==void 0&&Y!==$))return this.mainLastApiError=void 0,this.mainQuotaErrorGeneration+=1,this.mainQuotaErrorClearedAt=L8(this.mainQuotaErrorClearedAt,this.now()),this.mainQuotaErrorGeneration;return}setFallback($,Z,J){this.bindFallbackLineage($,J),this.fallbacks.set($,Z)}clearFallback($){this.fallbackGenerations.set($,(this.fallbackGenerations.get($)??0)+1),this.fallbacks.delete($),this.fallbackApiErrors.delete($),this.inflightFallbacks.delete(S6.fallbackInflightKey($))}pushMainFromHeaders($,Z){let J=Z.checkedAt??this.now(),X=xZ(this.mainAccountId===$&&(!this.mainQuotaIdentityKnown||!this.mainQuotaIdentityStrict||this.main?.quota.accountIdentity===$)?this.main?.quota:void 0,{...Z,...$!==void 0&&{accountIdentity:$}}),Y={quota:X,checkedAt:J,refreshAfter:W8(X,this.storage,J)};return this.setMain($,Y),Y}pushFallbackFromHeaders($,Z,J){if(!this.acceptFallbackQuotaObservation($,J))return null;let X=Z.checkedAt??this.now(),Y=xZ(this.fallbacks.get($)?.quota,{...Z,accountIdentity:$}),G={quota:Y,checkedAt:X,refreshAfter:W8(Y,this.storage,X)};return this.fallbacks.set($,G),G}async refreshMain($,Z,J){let X=$,Y=Z??$;if(!Y&&!this.canFetchWithoutAccessToken())throw Error("Main OAuth access token is unavailable");return(await this.refreshMainWithMetadata(X,Y,J)).quota}async refreshMainWithMetadata($,Z,J){let X=$,Y=Z??$;if(!Y&&!this.canFetchWithoutAccessToken())throw Error("Main OAuth access token is unavailable");if(J!==void 0&&(this.mainGeneration!==J||this.mainAccountId!==X))throw Error("Main quota identity changed before refresh");if(this.mainAccountId!==X){if(this.main=null,this.mainAccountId=X,this.mainQuotaIdentityKnown)this.mainGeneration+=1}if(this.inflightMain&&this.inflightMainAccountId===X&&this.inflightMainAccessToken===Y)return this.inflightMain;if(this.isBackedOff()){if(this.main&&this.mainAccountId===X)return{quota:this.main.quota,fetched:!1};throw Error("Quota API rate-limited — try again later")}this.inflightMainAccountId=X,this.inflightMainAccessToken=Y;let G=this.mainGeneration,z=++this.inflightMainToken;return this.inflightMain=this._fetchMain(X,Y??"",G,z),this.inflightMain}async refreshFallback($,Z,J){return(await this.refreshFallbackWithMetadata($,Z,J)).quota}async refreshFallbackWithMetadata($,Z,J){if(!Z&&!this.canFetchWithoutAccessToken())throw Error("Fallback OAuth access token is unavailable");this.bindFallbackLineage($,J);let X=S6.fallbackInflightKey($),Y=this.inflightFallbacks.get(X);if(Y)return Y;if(this.isFallbackBackedOff($)){let Q=this.getFallback($);if(Q)return{quota:Q.quota,fetched:!1};throw Error("Quota API rate-limited — try again later")}let G=this.fallbackGenerations.get($)??0,z=this._fetchFallback($,Z,G,J);return this.inflightFallbacks.set(X,z),z.then(()=>{if(this.inflightFallbacks.get(X)===z)this.inflightFallbacks.delete(X)},()=>{if(this.inflightFallbacks.get(X)===z)this.inflightFallbacks.delete(X)}),z}async refreshAllFallbacks($,Z){let J=this.now();for(let X of $){if(X.enabled===!1)continue;let Y=Z!==void 0?Z(X):X.access&&X.expires!==void 0&&X.expires>J?X.access:void 0;if(!Y)continue;this.bindFallbackLineage(X.id,X);let G=this.getFallback(X.id);if(G&&J<G.refreshAfter)continue;try{await this.refreshFallback(X.id,Y,X)}catch{}}}refreshMainInBackground($){if(this.inflightMain)return;if(this.isBackedOff())return;this.refreshMain(this.mainAccountId,$).catch(()=>{})}scopedWindowIsStale($,Z){let J=n4($.quota,Z);return Boolean(J&&this.now()-J.checkedAt>=L9(this.storage))}isMainStale($){if(!this.main)return!0;if(this.mainQuotaIdentityKnown&&this.mainQuotaIdentityStrict&&(this.mainAccountId===void 0||this.main.quota.accountIdentity!==this.mainAccountId))return!0;return this.now()>=this.main.refreshAfter||this.scopedWindowIsStale(this.main,$)||this.main.quota.source==="headers"&&this.main.quota.scoped===void 0&&(this.lastMainPollAttempt===void 0||this.lastMainPollAttempt.accountId!==this.mainAccountId||this.now()-this.lastMainPollAttempt.at>=L9(this.storage))}isFallbackStale($,Z,J,X){let Y=this.getFallback($,X);if(!Y)return!0;return this.now()>=Y.refreshAfter||this.scopedWindowIsStale(Y,J)}shouldRefreshOnRequestCount($){let Z=Bq(this.storage);if(Z<=0)return!1;return $>0&&$%Z===0}needsRefresh($,Z){return this.isMainStale(Z)||this.shouldRefreshOnRequestCount($)}updateStorage($){this.storage=$,this.seedMainFromStorage($,this.mainQuotaIdentityKnown?this.mainAccountId:$?.mainAccountId),this.seedMainBackoffFromStorage($)}seedMainFromStorage($,Z){let J=Vq($);if(!J)return;let X={quota:{...J.quota,...(!this.mainQuotaIdentityKnown||!this.mainQuotaIdentityStrict)&&Z!==void 0&&J.accountIdentity===void 0&&{accountIdentity:Z}},refreshAfter:W8(J.quota,$,J.checkedAt),checkedAt:J.checkedAt},Y=this.main&&this.mainAccountId===Z&&(!this.mainQuotaIdentityKnown||!this.mainQuotaIdentityStrict||this.main.quota.accountIdentity===Z)?this.main:void 0;if(Y&&Y.checkedAt>=X.checkedAt&&Y.quota.source==="headers"&&X.quota.source==="poll"){let G=xZ(X.quota,Y.quota);this.main={quota:G,refreshAfter:W8(G,$,Y.checkedAt),checkedAt:Y.checkedAt};return}if(this.main&&this.mainAccountId===Z&&this.main.checkedAt>=X.checkedAt)return;if(this.main=X,Z!==void 0)this.mainAccountId=Z}seedMainBackoffFromStorage($){let Z=$?.quota?.mainLastQuotaApiError,J=Z?.accountIdentity,X=typeof $?.quota?.mainQuotaErrorGeneration==="number"&&Number.isSafeInteger($.quota.mainQuotaErrorGeneration)&&$.quota.mainQuotaErrorGeneration>=0?$.quota.mainQuotaErrorGeneration:void 0,Y=typeof $?.quota?.mainQuotaErrorClearedAt==="number"&&Number.isFinite($.quota.mainQuotaErrorClearedAt)&&$.quota.mainQuotaErrorClearedAt>=0?$.quota.mainQuotaErrorClearedAt:void 0;if(Y!==void 0&&(this.mainQuotaErrorClearedAt===void 0||Y>this.mainQuotaErrorClearedAt)){if(this.mainQuotaErrorClearedAt=L8(this.mainQuotaErrorClearedAt,Y),(!Z||typeof Z.checkedAt==="number"&&Z.checkedAt<=Y)&&(this.mainLastApiError?.checkedAt===void 0||this.mainLastApiError.checkedAt<=Y))this.mainLastApiError=void 0}if(X!==void 0&&X>this.mainQuotaErrorGeneration){if(this.mainQuotaErrorGeneration=X,!Z&&(this.mainLastApiError?.checkedAt===void 0||this.mainQuotaErrorClearedAt===void 0||this.mainLastApiError.checkedAt<=this.mainQuotaErrorClearedAt))this.mainLastApiError=void 0}if(Z&&(!this.mainQuotaIdentityKnown||J===void 0||J===this.mainAccountId)&&(this.mainQuotaErrorClearedAt===void 0||typeof Z.checkedAt!=="number"||Z.checkedAt>this.mainQuotaErrorClearedAt)&&(this.mainLastApiError?.checkedAt===void 0||Z.checkedAt>=this.mainLastApiError.checkedAt)&&T7(Z,this.now())){if(this.mainLastApiError=Z,X!==void 0)this.mainQuotaErrorGeneration=X;return}if(this.mainAccountId!==void 0&&this.mainLastApiError?.accountIdentity!==void 0&&this.mainLastApiError.accountIdentity!==this.mainAccountId)this.mainLastApiError=void 0}seedFallbacksFromAccounts($){let Z=L9(this.storage),J=new Set($.map((X)=>X.id));for(let X of this.fallbackAuthLineages.keys())if(!J.has(X))this.clearFallback(X),this.fallbackAuthLineages.delete(X);for(let X of $){if(this.bindFallbackLineage(X.id,X))continue;if(X.enabled===!1)continue;let G=X.lastQuotaRefreshError,z=Q4(X.quota),Q=this.fallbackApiErrors.get(X.id);if(G&&T7(G,this.now())&&z<=(G.checkedAt??0)&&(!Q||G.checkedAt>=Q.checkedAt))this.fallbackApiErrors.set(X.id,G);else if(Q&&z>=Q.checkedAt)this.fallbackApiErrors.delete(X.id);if(!X.quota)continue;let K=Q4(X.quota);if(K<=0)continue;let W=this.getFallback(X.id);if(W&&W.checkedAt>=K)continue;this.setFallback(X.id,{quota:{...X.quota,accountIdentity:X.id},refreshAfter:K+Z,checkedAt:K},X)}}isBackedOff(){return T7(this.mainLastApiError,this.now())}isFallbackBackedOff($){return T7(this.fallbackApiErrors.get($),this.now())}getLastApiError(){return this.mainLastApiError}getMainQuotaErrorGeneration(){return this.mainQuotaErrorGeneration}getMainQuotaIdentityGeneration(){return this.mainGeneration}getMainQuotaErrorClearedAt(){return this.mainQuotaErrorClearedAt}clearMainBackoff(){if(!this.mainLastApiError)return;return this.mainLastApiError=void 0,this.mainQuotaErrorGeneration+=1,this.mainQuotaErrorClearedAt=L8(this.mainQuotaErrorClearedAt,this.now()),this.mainQuotaErrorGeneration}static API_CALL_GAP_MS=1000;static fallbackInflightKey($){return $}static quotaLockName($){return`opencode-fallback-quota-refresh-${$.replace(/[^a-zA-Z0-9._-]+/g,"-")||"account"}`}bindFallbackLineage($,Z){if(!Z)return!1;let J=this.fallbackAuthLineages.has($),X=this.fallbackAuthLineages.get($),Y=J&&Z.authLineageId!==void 0&&X!==Z.authLineageId;if(Y)this.clearFallback($);return this.fallbackAuthLineages.set($,Z.authLineageId),Y}acceptFallbackQuotaObservation($,Z){let J=this.fallbackAuthLineages.has($),X=this.fallbackAuthLineages.get($),Y=Z?.authLineageId;if(J&&X!==Y)return d.trace("quota","skipped stale fallback quota observation after lineage change",{accountId:$,storedLineage:X,servedLineage:Y}),!1;if(!J)this.fallbackAuthLineages.set($,Y);return!0}isClosed=!1;close(){this.isClosed=!0,this.inflightFallbacks.clear(),this.inflightMain=null}_enqueueApiFetch($){let Z=async()=>{if(this.isClosed)throw Error("QuotaManager is closed");return $()},J=this.apiGate.then(Z,Z);return this.apiGate=J.catch(()=>{}),J}_quotaDispatch($,Z){return async(J,X)=>{if(this.lastApiCallAt!==void 0){let G=S6.API_CALL_GAP_MS-(this.now()-this.lastApiCallAt);if(G>0)await new Promise((z)=>{let Q=hP(z,G);if(typeof Q==="object"&&"unref"in Q)Q.unref()})}if(this.isClosed)throw Error("QuotaManager is closed");if(await X(),await Z?.(),this.isClosed)throw Error("QuotaManager is closed");let Y=this.now();$?.(Y);try{return J()}finally{this.lastApiCallAt=this.now()}}}_quotaFetch($){return Object.assign((Z,J)=>$(()=>this.fetchImpl(Z,J),async()=>J?.signal?.throwIfAborted()),{preconnect:this.fetchImpl.preconnect})}async _fetchMain($,Z,J,X){return this._enqueueApiFetch(async()=>{try{if(this.isBackedOff()){if(this.main&&this.mainAccountId===$)return{quota:this.main.quota,fetched:!1};throw Error("Quota API rate-limited — try again later")}if(this.mainQuotaIdentityKnown&&this.mainQuotaIdentityStrict&&this.mainGeneration!==J)return{quota:{accountIdentity:$},fetched:!1};let Y=await t6({name:"opencode-main-quota-refresh",ttlMs:30000});if(!Y){let G=this.main;if(G&&this.mainAccountId===$&&this.now()<G.refreshAfter)return{quota:G.quota,fetched:!1};throw Error("Quota refresh is already in progress")}try{let G=this.now(),z=!1,Q=this._quotaDispatch((B)=>{if(!z)G=B;z=!0,this.lastMainPollAttempt={accountId:$,at:B}},async()=>{if(await Y.assertOwned(),this.mainGeneration!==J)throw Error("Main quota identity changed before dispatch")}),K=this.fetchQuotaSnapshot?await this.fetchQuotaSnapshot({kind:"main",accountId:$,accessToken:Z},Q):await F9({accessToken:Z,fetchImpl:this._quotaFetch(Q),now:this.now}),W=this.now();if(this.mainQuotaIdentityKnown&&this.mainQuotaIdentityStrict&&this.mainGeneration!==J)return{quota:{...K,...$!==void 0&&{accountIdentity:$}},fetched:!0};let V=VG(this.mainAccountId===$&&(!this.mainQuotaIdentityKnown||!this.mainQuotaIdentityStrict||this.main?.quota.accountIdentity===$)?this.main?.quota:void 0,{...K,...$!==void 0&&{accountIdentity:$}});if(this.mainAccountId=$,this.main={quota:V,refreshAfter:W8(V,this.storage,W),checkedAt:V.checkedAt??W},this.mainLastApiError)this.mainLastApiError=void 0,this.mainQuotaErrorGeneration+=1,this.mainQuotaErrorClearedAt=L8(this.mainQuotaErrorClearedAt,W);return this.onMainQuotaFetched?.(V,W,S4(Z),G,this.mainQuotaErrorGeneration,this.mainQuotaErrorClearedAt),{quota:V,fetched:!0}}catch(G){throw this._handleMainFetchError(G,J),G}finally{await Y.release()}}finally{if(this.inflightMainToken===X)this.inflightMain=null,this.inflightMainAccountId=void 0}})}async _fetchFallback($,Z,J,X){return this._enqueueApiFetch(async()=>{try{if((this.fallbackGenerations.get($)??0)!==J)return{quota:{accountIdentity:$},fetched:!1};if(this.isFallbackBackedOff($)){let G=this.getFallback($,X);if(G)return{quota:G.quota,fetched:!1};throw Error("Quota API rate-limited — try again later")}let Y=await t6({name:S6.quotaLockName($),ttlMs:30000});if(!Y){let G=this.getFallback($,X);if(G&&this.now()<G.refreshAfter)return{quota:G.quota,fetched:!1};throw Error("Quota refresh is already in progress")}try{let G=this.now(),z=!1,Q=this._quotaDispatch((B)=>{if(!z)G=B;z=!0},async()=>{if(await Y.assertOwned(),(this.fallbackGenerations.get($)??0)!==J)throw Error("Fallback quota identity changed before dispatch")}),K=this.fetchQuotaSnapshot?await this.fetchQuotaSnapshot({kind:"fallback",accountId:$,accessToken:Z},Q):await F9({accessToken:Z,fetchImpl:this._quotaFetch(Q),now:this.now}),W=this.now();if((this.fallbackGenerations.get($)??0)!==J)return{quota:{...K,accountIdentity:$},fetched:!0};let V=VG(this.getFallback($,X)?.quota,{...K,accountIdentity:$});return this.setFallback($,{quota:V,refreshAfter:W8(V,this.storage,W),checkedAt:V.checkedAt??W},X),this.fallbackApiErrors.delete($),this.onFallbackQuotaFetched?.($,V,W,G),{quota:V,fetched:!0}}finally{await Y.release()}}catch(Y){throw this._handleFallbackFetchError($,Y,J),Y}})}static isAuthError($){if($.status===401||Wq($))return!0;let J=$ instanceof Error?$.message:String($);return/quota check failed: 401\b/.test(J)}_handleMainFetchError($,Z){if(this.mainGeneration!==Z)return;if(this.mainQuotaIdentityKnown&&this.mainQuotaIdentityStrict&&this.mainAccountId===void 0)return;if(S6.isAuthError($))return;this.mainLastApiError=o2({error:$,now:this.now(),accountIdentity:this.mainAccountId,previous:this.mainLastApiError}),this.mainQuotaErrorGeneration+=1,this.onApiError?.(this.mainLastApiError,this.mainQuotaErrorGeneration)}_handleFallbackFetchError($,Z,J){if((this.fallbackGenerations.get($)??0)!==J)return;if(S6.isAuthError(Z))return;let X=this.fallbackApiErrors.get($),Y=o2({error:Z,now:this.now(),previous:X,accountIdentity:$});this.fallbackApiErrors.set($,Y),this.onFallbackApiError?.($,Y)}}var BG={five_hour:"5h",seven_day:"1w"};function J0($){return`${Math.round($*10)/10}%`}function X0($,Z){let J=Math.max(0,Z-$),X=Math.floor(J/60000);if(X<1)return"just now";if(X===1)return"1m ago";if(X<60)return`${X}m ago`;let Y=Math.floor(X/60),G=X%60;if(G===0)return`${Y}h ago`;return`${Y}h ${G}m ago`}function gP($,Z){let J=Date.parse($);if(!Number.isFinite(J))return $;let X=J-Z;if(X<=0)return"now";let Y=Math.max(1,Math.ceil(X/60000));if(Y<60)return`in ${Y}m`;let G=Math.floor(Y/60),z=Y%60;if(z===0)return`in ${G}h`;return`in ${G}h ${z}m`}function QW($,Z){if(!$)return"";return`, resets ${gP($,Z)}`}function qG($,Z,J,X){if(!Z)return`  - ${BG[$]}: unknown`;let Y=[`  - ${BG[$]}: ${J0(Z.remainingPercent)} remaining`,` (${J0(Z.usedPercent)} used`,`${QW(Z.resetsAt,J)}, checked ${X0(Z.checkedAt,J)})`].join("");return X===$?`${Y} •`:Y}function jG($){try{return new Intl.NumberFormat("en-US",{style:"currency",currency:$.currency,minimumFractionDigits:$.exponent,maximumFractionDigits:$.exponent}).format($.amountMinor/10**$.exponent)}catch{return`${$.amountMinor} ${$.currency}`}}function yP($,Z){return[`  - ${$.title}: ${J0($.remainingPercent)} remaining`,` (${J0($.usedPercent)} used`,`${QW($.resetsAt,Z)}, checked ${X0($.checkedAt,Z)})`].join("")}function uP($){return $.label?.trim()||$.id}function mP($){return $.lastQuotaRefreshError?.message??$.lastRefreshError?.message}function MC($,Z=new Map){if(!$?.accounts.length)return[];return $.accounts.filter(E$).map((J)=>{let X=Z.get(J.id)??mP(J);return{name:uP(J),role:"fallback",enabled:J.enabled!==!1,quota:J.quota,...gZ(J.profile)&&{tierLabel:gZ(J.profile)},lastRefreshedAt:J.lastRefreshedAt,...X&&{error:X}}})}function PC($){let Z=$.now??Date.now(),J=["## Claude Quotas",""];if($.refreshedAt)J.push(`Refreshed: ${X0($.refreshedAt,Z)}`,"");if(!$.accounts.length)return J.push("No Claude OAuth accounts found yet."),J.join(`
+`);for(let X of $.accounts){let Y=X.role==="main"?"main":"fallback",G=X.enabled===!1?" disabled":"";if(J.push(`### ${X.name} (${Y}${G})`),X.tierLabel)J.push(`  - Tier: ${X.tierLabel}`);if(X.lastRefreshedAt)J.push(`  - Last token refresh: ${X0(X.lastRefreshedAt,Z)}`);if(X.error)J.push(`  - Error: ${X.error}`);J.push(qG("five_hour",X.quota?.five_hour,Z,X.quota?.bindingWindow)),J.push(qG("seven_day",X.quota?.seven_day,Z,X.quota?.bindingWindow));for(let Q of X.quota?.scoped??[]){let K=yP(Q,Z);J.push(X.quota?.bindingWindow===Q.id?`${K} •`:K)}let z=X.quota?.extraUsage;if(z){let Q=jG(z.used),K=jG(z.limit);J.push(`  - credits ${Q}/${K}${z.exhausted?" · exhausted":""}`)}if(X.quota?.fallbackAdvised===!0)J.push("  - → fallback advised");J.push("")}return J.join(`
+`).trimEnd()}Y4();class p9 extends Error{failure;constructor($){super("Relay request authorization failed");this.failure=$}}function iP($){let Z=[],J=$.authorization?.trim();if(J){Z.push(J);let Y=/^\S+\s+(\S.*)$/.exec(J)?.[1];if(Y)Z.push(Y)}let X=$["x-api-key"]?.trim();if(X)Z.push(X);return Z}async function DZ($,Z,J,X){try{let Y=J?await J():void 0;if(Y)Z.upstream={...Z.upstream,headers:WW(Y.headers)};return{authorization:Y,scope:X([$.token,...iP(Z.upstream.headers),...Y?.errorSecrets??[]])}}catch(Y){throw new p9(Y)}}function Q9($){return typeof $==="number"&&Number.isFinite($)?$:"unknown"}function dP($){let Z;try{Z=I6($)}catch{return"http"}if(Z===null||typeof Z!=="object"||Array.isArray(Z))return"http";return"stream"in Z&&Z.stream===!0?"event-stream":"http"}class G1 extends Error{}class Y0 extends Error{}var sP="relay websocket response_start metadata is invalid",tP=new Set([101,103,204,205,304]);class z1 extends Error{code="ECONNRESET";syscall="websocket";closeCode;closeReason;wasClean;constructor($,Z){super($);this.name="RelayWebSocketConnectionResetError",this.closeCode=Z?.code,this.closeReason=Z?.reason,this.wasClean=Z?.wasClean}}var m4=new Map,b6=new Map;var aP=7200000,nP=1800000,oP=128,rP=32,HG=0;function m2(){return HG+=1,`req_${Date.now().toString(36)}_${HG.toString(36)}`}function AC(){return lP(32).toString("base64url")}function eP($){return`sha256:${cP("sha256").update($).digest("hex")}`}function LG($,Z){let J=0,X=Math.min($.length,Z.length);while(J<X&&$.charCodeAt(J)===Z.charCodeAt(J))J++;let Y=$.length,G=Z.length;while(Y>J&&G>J&&$.charCodeAt(Y-1)===Z.charCodeAt(G-1))Y--,G--;return{start:J,deleteCount:Y-J,insert:Z.slice(J,G)}}function $_($){return $.deleteCount===0&&$.insert.length===0}function UG($){let Z=$.match(/\bcch=([0-9a-f]{5});/),J=Z?.[1];if(!J||Z.index==null)return null;let X=Z.index+4;return{start:X,end:X+J.length,token:J}}function Z_($,Z,J,X){return`${$.slice(0,Z)}${X}${$.slice(J)}`}function KW($,Z){let J=UG($),X=UG(Z);if(J&&X&&J.start===X.start&&J.end-J.start===X.end-X.start&&J.token!==X.token){let Y={start:J.start,deleteCount:J.end-J.start,insert:X.token},G=Z_($,J.start,J.end,X.token),z=LG(G,Z);return $_(z)?Y:[Y,z]}return LG($,Z)}function J_($,Z){if(typeof Z!=="string")return!1;try{let J=$ instanceof Request?new URL($.url):new URL($.toString());return J.pathname==="/v1/messages"||J.pathname==="/messages"}catch{return!1}}function WW($){let Z={};for(let[J,X]of $.entries()){if(J==="x-session-affinity"||J==="x-opencode-session")continue;Z[J]=X}return Z}async function X_($,Z,J){let X=N$(),Y=JSON.stringify(Z);return N8("http_payload_stringify",{session:j$(Z.affinity),ms:e$(N$()-X),relayBytes:Y.length,mode:Z.mode}),fetch($.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":$.token},body:Y,signal:J??void 0})}function j$($){return $.length>12?`${$.slice(0,12)}…`:$}function N$(){return performance.now()}function e$($){return Math.round($*10)/10}function Y_(){return process.env.OPENCODE_ANTHROPIC_AUTH_PERF==="1"}function N8($,Z){if(!Y_())return;B$(`[perf] relay ${$} ${JSON.stringify(Z)}`)}function G_($){let{input:Z,init:J,headers:X,bodyText:Y,affinity:G,previous:z,nextHash:Q}=$,K=Z instanceof Request?Z.url:Z.toString(),W={protocol:1,type:"request",affinity:G,upstream:{url:K,method:J?.method||(Z instanceof Request?Z.method:"POST"),headers:WW(X)},next_hash:Q};return z?{...W,mode:"patch",base_hash:z.hash,revision:z.revision+1,patch:KW(z.body,Y)}:{...W,mode:"full_sync",revision:1,body:Y}}function Q1($,Z){return{protocol:$.protocol,type:"request",affinity:$.affinity,upstream:$.upstream,next_hash:$.next_hash,mode:"full_sync",revision:1,body:Z}}function VW($,Z,J,X){let Y=Date.now();m4.delete($),m4.set($,{body:Z,hash:J,revision:X,updatedAt:Y}),K1(Y)}async function NG($,Z,J,X,Y){let{authorization:G,scope:z}=await DZ($,Z,X,(K)=>y1(K,Y)),Q;try{Q=await X_($,Z,J)}catch(K){let W=z.redactError(K);throw z.dispose(),W}try{return{authorization:G,scope:z,response:z.redactResponse(Q)}}catch(K){throw z.dispose(),await Q.body?.cancel().catch(()=>{}),K}}async function p2($){$.scope.dispose(),await $.response.body?.cancel().catch(()=>{})}async function xG($){let{config:Z,payload:J,bodyText:X,requestMode:Y,fallback:G,signal:z,authorizeAttempt:Q}=$,K=Y(),W=J,V=await NG(Z,W,z,Q,K);if(V.response.status===409&&W.mode==="patch")B$(`state mismatch from relay session=${j$(W.affinity)}; retrying full_sync`),await p2(V),W=Q1(W,X),V=await NG(Z,W,z,Q,K);let{response:B,authorization:j}=V,H=/^req_[A-Za-z0-9_-]+$/.test(B.headers.get("request-id")??"");if(B.status===401&&!H){if(await p2(V),Z.fallbackToDirect)return B$(`relay authentication rejected; falling back direct session=${j$(W.affinity)}`),{response:await G(),payload:W,transport:"http",protocol:W.protocol,usedRelay:!1};return{response:Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502}),payload:W,transport:"http",protocol:W.protocol,usedRelay:!1}}if(H)try{j?.onUpstreamStatus?.(B.status)}catch{}if(!B.ok&&B.status>=500&&Z.fallbackToDirect)return B$(`relay returned ${B.status}; falling back direct session=${j$(W.affinity)}`),await p2(V),{response:await G(),payload:W,transport:"http",protocol:W.protocol,usedRelay:!1};return{response:B,payload:W,transport:"http",protocol:W.protocol,usedRelay:!0}}function z_($,Z){let J=new URL($);return J.protocol=J.protocol==="http:"?"ws:":"wss:",J.pathname="/ws",J.searchParams.set("token",Z),J.toString()}function Q_($){return new Uint8Array(pP.from($,"base64"))}function K_($){if($ instanceof Uint8Array)return $;if($ instanceof ArrayBuffer)return new Uint8Array($);if(ArrayBuffer.isView($))return new Uint8Array($.buffer,$.byteOffset,$.byteLength);throw TypeError("relay websocket binary frame must be an ArrayBuffer or byte view")}function W_($){return JSON.parse($)}function DG($){let Z=$;return[`code=${Z.code??"unknown"}`,`wasClean=${Z.wasClean??"unknown"}`].join(" ")}function V_($){let Z=$.message||"relay websocket error";return $.status?`relay websocket error ${$.status}: ${Z}`:Z}function OG($,Z){return{stream:tH($),response:y1($,Z)}}function IG($){$.stream.dispose(),$.response.dispose()}class BW{config;affinity;timers;socket;connecting;queue=Promise.resolve();pending;serverState;lastUsedAt=Date.now();constructor($,Z,J){this.config=$,this.affinity=Z,this.timers=J}touch($=Date.now()){this.lastUsedAt=$}canEvict($=Date.now()){return!this.pending&&!this.connecting&&$-this.lastUsedAt>nP}dispose(){if(this.pending)this.retireAttempt(this.pending);this.socket?.close(),this.socket=void 0,this.serverState=void 0,this.connecting=void 0}send($,Z,J,X,Y,G){this.touch();let z=N$(),Q=this.queue.catch(()=>{}).then(()=>this.startQueued($,Z,z,J,X,Y,G)),K=Q.then(async({response:W,getPayload:V})=>({response:await W,payload:V(),transport:"websocket",protocol:2,usedRelay:!0}));return this.queue=Q.then(({done:W})=>W.catch(()=>{}),()=>{}),K}async startQueued($,Z,J,X,Y,G,z){let Q=(w)=>OG(w,z),K=N$();await this.ensureConnected();let W=N$(),V=m4.get(this.affinity),B=this.serverState?.hash,j={...$,protocol:2,id:m2()};if(j.mode==="patch"&&(!B||B!==j.base_hash))j.mode="full_sync",j.revision=(this.serverState?.revision??0)+1,delete j.base_hash,delete j.patch,j.body=Z;if(j.mode==="patch"&&V)j.patch=KW(V.body,Z);B$(`perf websocket send_start session=${j$(this.affinity)} request=${j.id} mode=${j.mode} queueMs=${e$(W-J)} connectMs=${e$(W-K)} bodyBytes=${Z.length} relayBytes=${JSON.stringify(j).length}`);let H=await DZ(this.config,j,G,Q),q=j,N=this.sendPayload(j,Z,X,Y,G,H,z);N.done.catch(()=>{});let U=N.done,L=N.response.catch(async(w)=>{if(!(w instanceof G1)||j.mode!=="patch")throw w;let O=Q1(j,Z);O.protocol=2,O.id=m2(),O.revision=(this.serverState?.revision??0)+1;let x=await DZ(this.config,O,G,Q);q=O;let C=this.sendPayload(O,Z,X,Y,G,x,z);return C.done.catch(()=>{}),U=C.done,C.response}),D=L.then(()=>U,()=>U.catch(()=>{}));return{response:L,done:D,getPayload:()=>q}}async ensureConnected(){if(this.socket?.readyState===WebSocket.OPEN&&this.serverState!==void 0)return;if(this.connecting)return await this.connecting;this.connecting=new Promise(($,Z)=>{let J=z_(this.config.url,this.config.token),X=new URL(J);X.searchParams.set("affinity",this.affinity);let Y=new WebSocket(X.toString());Y.binaryType="arraybuffer",this.socket=Y,this.serverState=void 0;let G=this.timers.setTimeout(()=>{Y.close(),Z(Error("relay websocket ready timed out"))},15000);Y.addEventListener("message",(z)=>{try{if(typeof z.data!=="string"){this.handleBinaryChunk(z.data);return}let Q=W_(z.data);if(Q.type==="ready"){this.timers.clearTimeout(G),this.serverState=Q.state,$();return}this.handleMessage(Q)}catch(Q){this.timers.clearTimeout(G),Z(Q),this.failPending(Q),Y.close()}}),Y.addEventListener("error",()=>{this.timers.clearTimeout(G);let z=new z1("relay websocket error");Z(z),this.failPending(z)}),Y.addEventListener("close",(z)=>{if(this.timers.clearTimeout(G),this.socket===Y)this.socket=void 0,this.serverState=void 0,this.connecting=void 0;if(this.socket!==void 0)return;if(this.pending){if(this.pending.retryingBeforeResponse)return;let Q=this.pending.responseStartedAt!=null||this.pending.streamByteCount>0,K=Q?"closed after response_start before stream bytes":"closed before response";if(this.retryPendingBeforeResponse(this.pending,K,z))return;let W=Q?new z1("relay websocket closed during response stream",z):Error("relay websocket closed before response");B$(`websocket ${Q?"closed during response stream":"closed before response without retry"} session=${j$(this.affinity)} request=${this.pending.payload.id} chunks=${this.pending.streamChunkCount} bytes=${this.pending.streamByteCount} ${DG(z)}`),this.failPending(W)}})}).finally(()=>{this.connecting=void 0}),await this.connecting}sendPayload($,Z,J,X,Y,G,z){let Q=this.socket;if(!Q||Q.readyState!==WebSocket.OPEN)throw IG(G.scope),Error("relay websocket is not connected");let K=N$(),W,V,B=new Promise((H,q)=>{W=H,V=q});return{response:new Promise((H,q)=>{let N={payload:$,bodyText:Z,resolve:H,reject:q,streamDone:!1,accepted:!1,responseStarted:!1,resolveDone:W,rejectDone:V,sentAt:K,optimisticResponse:J,streamChunkCount:0,streamByteCount:0,retryAttempts:0,retryingBeforeResponse:!1,onResponseHeaders:X,authorizeAttempt:Y,authorization:G.authorization,scope:G.scope.stream,responseScope:G.scope.response,responseMode:z,rawBody:!1,retired:!1,stagedResponseHeaders:void 0,responseHeadersDelivered:!1};if(this.pending=N,this.resetPendingTimeout(N),Q.send(JSON.stringify($)),J)this.resolvePendingResponse(N,200,"OK",{"content-type":"text/event-stream","x-cortexkit-relay-optimistic":"true"})}),done:B}}resetPendingTimeout($){this.timers.clearTimeout($.timeout),$.timeout=this.timers.setTimeout(()=>{if(this.pending!==$)return;if(this.retryPendingBeforeResponse($,"response timed out"))return;this.failPending(Error("relay websocket response timed out")),this.socket?.close()},45000)}retryPendingBeforeResponse($,Z,J){if($.streamByteCount>0)return!1;if($.streamDone)return!1;if(!$.optimisticResponse&&$.responseStarted)return!1;if($.retired)return!1;if($.retryAttempts>=1)return!1;$.retryAttempts+=1,$.retryingBeforeResponse=!0,this.timers.clearTimeout($.timeout);let X=$.retryAttempts,Y=$.payload.id;return B$(`websocket ${Z}; reconnecting and retrying full_sync session=${j$(this.affinity)} request=${Y} retry=${X} chunks=${$.streamChunkCount} bytes=${$.streamByteCount}${J?` ${DG(J)}`:""}`),this.socket?.close(),this.socket=void 0,this.serverState=void 0,this.connecting=void 0,(async()=>{try{if(await this.ensureConnected(),this.pending!==$)return;if($.retired)return this.endCancelledRetry($);let G=Q1($.payload,$.bodyText);G.protocol=2,G.id=m2(),G.revision=(this.serverState?.revision??0)+1;let z=await DZ(this.config,G,$.authorizeAttempt,(K)=>OG(K,$.responseMode));if(this.pending!==$||$.streamDone||$.retired){if(IG(z.scope),this.pending===$&&$.retired)this.endCancelledRetry($);return}this.installAttempt($,z),$.payload=G,$.accepted=!1,$.acceptedAt=void 0,$.responseStartedAt=void 0,$.stagedResponseHeaders=void 0,$.responseHeadersDelivered=!1,$.sentAt=N$(),$.retryingBeforeResponse=!1;let Q=this.socket;if(!Q||Q.readyState!==WebSocket.OPEN)throw Error("relay websocket is not connected");this.resetPendingTimeout($),B$(`perf websocket retry_send session=${j$(this.affinity)} request=${G.id} previous=${Y} mode=full_sync retry=${X} bodyBytes=${$.bodyText.length} relayBytes=${JSON.stringify(G).length}`),Q.send(JSON.stringify(G))}catch(G){if($.retryingBeforeResponse=!1,this.pending!==$)return;if(G instanceof p9)this.failPending(G.failure,!1);else this.failPending(G)}})(),!0}endCancelledRetry($){$.retryingBeforeResponse=!1,this.failPending(Error("relay websocket response was cancelled"),!1)}installAttempt($,Z){$.scope?.dispose(),$.responseScope?.dispose(),$.authorization=Z.authorization,$.scope=Z.scope.stream,$.responseScope=Z.scope.response}retireAttempt($){$.retired=!0,$.scope?.dispose(),$.scope=void 0,$.responseScope?.dispose(),$.responseScope=void 0,$.errorBody=void 0,$.authorization=void 0}redactAttemptError($,Z){return $.scope?$.scope.redactError(Z):Error("relay websocket request ended")}enqueueStreamChunk($,Z){this.deliverResponseHeaders($),$.streamChunkCount+=1,$.streamByteCount+=Z.byteLength,this.forwardStreamBytes($,Z)}forwardStreamBytes($,Z){let{streamController:J,scope:X}=$;if(!J||!X)return;if($.rawBody){let G=$.errorBody;if(G){if(G.bytes+=Z.byteLength,G.bytes>v1){this.endOversizedErrorBody($,J,G.scope);return}}J.enqueue(Z);return}let Y;try{Y=X.push(Z)}catch(G){this.failPending(G,!(G instanceof w8)),this.socket?.close();return}for(let G of Y)J.enqueue(G)}endOversizedErrorBody($,Z,J){if(Z.error(new mz),J.dispose(),B$(`websocket error body exceeded the redaction bound; ending request session=${j$(this.affinity)} request=${$.payload.id} chunks=${$.streamChunkCount} bytes=${$.streamByteCount}`),this.timers.clearTimeout($.timeout),$.streamDone=!0,this.retireAttempt($),$.authorizeAttempt=void 0,$.onResponseHeaders=void 0,$.resolveDone(),this.pending===$)this.pending=void 0;let X=this.socket;this.socket=void 0,this.serverState=void 0,this.connecting=void 0,X?.close()}deliverResponseHeaders($){if($.responseHeadersDelivered||$.stagedResponseHeaders==null)return;$.responseHeadersDelivered=!0;try{$.onResponseHeaders?.($.stagedResponseHeaders)}catch{}}handleBinaryChunk($){let Z=this.pending;if(!Z?.responseStarted)return;this.enqueueStreamChunk(Z,K_($))}resolvePendingResponse($,Z,J,X){if($.responseStarted)return;let Y,G=tP.has(Z)?null:new ReadableStream({start:(V)=>{Y=V},cancel:()=>{this.retireAttempt($),this.socket?.close()}}),z;try{z=new Response(G,{status:Z,statusText:J,headers:X})}catch{this.failInvalidResponseStart();return}if($.responseStarted=!0,$.streamController=Y,$.optimisticResponse){$.resolve(z);return}let Q=$.responseScope;if($.responseScope=void 0,z.ok&&$.responseMode==="event-stream"||!Q){if(Q?.dispose(),X&&z.ok)$.stagedResponseHeaders=new Headers(z.headers);$.resolve(z);return}$.rawBody=!0;let W;try{W=Q.redactResponse(z)}catch(V){$.responseStarted=!1,this.failPending(V),this.socket?.close();return}if(X)$.stagedResponseHeaders=new Headers(W.headers);if(!z.ok&&G)$.errorBody={scope:Q,bytes:0};$.resolve(W)}stageOptimisticResponseHeaders($,Z){let J=$.responseScope;$.responseScope=void 0;let X;try{X=new Response(null,{status:Z.status,statusText:Z.statusText,headers:Z.headers})}catch{return J?.dispose(),this.failInvalidResponseStart(),!1}if(!Z.headers)return J?.dispose(),!0;if(X.ok)return J?.dispose(),$.stagedResponseHeaders=new Headers(X.headers),!0;if(!J)return!0;try{$.stagedResponseHeaders=new Headers(J.redactResponse(X).headers)}catch{}return!0}failInvalidResponseStart(){this.failPending(new Y0(sP),!1),this.socket?.close()}handleMessage($){if($.type==="keepalive"){if(this.pending)this.resetPendingTimeout(this.pending);return}let Z=this.pending;if(!Z)return;if("id"in $&&$.id&&$.id!==Z.payload.id)return;if($.type==="accepted"){let J=N$();Z.accepted=!0,Z.acceptedAt=J,B$(`perf websocket accepted session=${j$(this.affinity)} request=${Z.payload.id} sentMs=${e$(J-Z.sentAt)} mode=${Z.payload.mode}`),this.serverState={hash:$.hash,revision:$.revision},VW(this.affinity,Z.bodyText,$.hash,$.revision),this.resetPendingTimeout(Z);return}if($.type==="response_start"){if(Z.responseStartedAt!=null)return;let J=N$();Z.responseStartedAt=J;try{Z.authorization?.onUpstreamStatus?.($.status)}catch{}if(B$(`perf websocket response_start session=${j$(this.affinity)} request=${Z.payload.id} sentMs=${e$(J-Z.sentAt)} upstreamMs=${Z.acceptedAt==null?"unknown":e$(J-Z.acceptedAt)} status=${Q9($.status)}`),this.timers.clearTimeout(Z.timeout),!Z.optimisticResponse){this.resolvePendingResponse(Z,$.status,$.statusText,$.headers);return}if(!this.stageOptimisticResponseHeaders(Z,$))return;if($.status>=400)this.deliverResponseHeaders(Z),this.forwardStreamBytes(Z,new TextEncoder().encode(`event: error
+data: ${JSON.stringify({type:"error",error:{type:"relay_upstream_error",message:`Relay upstream returned HTTP ${$.status}`}})}
+
+`)),this.finishPending();return}if($.type==="chunk"){this.enqueueStreamChunk(Z,Q_($.base64));return}if($.type==="done"){this.finishPending($);return}if($.type==="error"){if(Z.optimisticResponse&&Z.responseStartedAt!=null){B$(`websocket relay error during optimistic response session=${j$(this.affinity)} request=${Z.payload.id} status=${Number.isFinite($.status)?$.status:"unknown"} code=relay_stream_error chunks=${Z.streamChunkCount} bytes=${Z.streamByteCount}`),this.deliverResponseHeaders(Z),this.forwardStreamBytes(Z,new TextEncoder().encode(`event: error
+data: ${JSON.stringify({type:"error",error:{type:"relay_error",message:$.message||"relay error"}})}
+
+`)),this.finishPending(),this.socket?.close();return}if($.status===409&&this.retryPendingBeforeResponse(Z,"state mismatch"))return;let J=$.status===409?new G1("state mismatch"):Error(V_($));this.failPending(J)}}finishPending($){let Z=this.pending;if(!Z)return;let J=N$(),X=$&&"frames"in $?` upstreamChunks=${Q9($.upstreamChunks)} upstreamBytes=${Q9($.upstreamBytes)} frames=${Q9($.frames)} frameBytes=${Q9($.frameBytes)}`:"";B$(`perf websocket done session=${j$(this.affinity)} request=${Z.payload.id} sentMs=${e$(J-Z.sentAt)} streamMs=${Z.responseStartedAt==null?"unknown":e$(J-Z.responseStartedAt)} chunks=${Z.streamChunkCount} bytes=${Z.streamByteCount}${X}`),this.timers.clearTimeout(Z.timeout);try{if(!Z.streamDone){this.deliverResponseHeaders(Z),Z.streamDone=!0;let Y=Z.rawBody?[]:Z.scope?.finish()??[];for(let G of Y)Z.streamController?.enqueue(G);Z.streamController?.close()}}finally{this.retireAttempt(Z),Z.authorizeAttempt=void 0,Z.onResponseHeaders=void 0}Z.resolveDone(),this.pending=void 0}failPending($,Z=!0){let J=this.pending;if(!J)return;let X=Z?this.redactAttemptError(J,$):$;if(this.timers.clearTimeout(J.timeout),this.pending=void 0,this.retireAttempt(J),J.authorizeAttempt=void 0,J.onResponseHeaders=void 0,J.responseStarted)J.streamController?.error(X);else J.reject(X);J.rejectDone(X)}}function K1($=Date.now()){for(let[Z,J]of m4)if($-J.updatedAt>aP)m4.delete(Z);while(m4.size>oP){let Z=m4.keys().next().value;if(Z===void 0)break;m4.delete(Z)}for(let[Z,J]of b6)if(J.canEvict($))J.dispose(),b6.delete(Z);while(b6.size>rP){let Z=!1;for(let[J,X]of b6){if(!X.canEvict($))continue;X.dispose(),b6.delete(J),Z=!0;break}if(!Z)break}}function B_($,Z,J){K1();let X=b6.get(Z);if(X)return X.touch(),X;let Y=new BW($,Z,J);return b6.set(Z,Y),K1(),Y}async function RC($){let{config:Z,input:J,init:X,headers:Y,body:G,fallback:z,affinity:Q,optimisticResponse:K,authorizeAttempt:W,onResponseHeaders:V,dumpTag:B,onDumpCreated:j,setTimeoutImpl:H=globalThis.setTimeout,clearTimeoutImpl:q=globalThis.clearTimeout}=$;if(!Z||!J_(J,G))return z();let N=Q||Y.get("x-session-affinity")||Y.get("x-opencode-session");if(!N)return B$("skipping relay: missing x-session-affinity header"),z();let U=G,L=N$(),D=eP(U);N8("hash_body",{session:j$(N),ms:e$(N$()-L),bodyBytes:U.length});let w=m4.get(N),O=N$(),x=G_({input:J,init:X,headers:Y,bodyText:U,affinity:N,previous:w,nextHash:D});N8("create_payload",{session:j$(N),ms:e$(N$()-O),mode:x.mode,bodyBytes:U.length,previousBytes:w?.body.length});let C,v=()=>{return C??=dP(U),C};try{let k,m=N$();if(Z.transport==="websocket")try{let S=B_(Z,N,{setTimeout:H,clearTimeout:q}),I=K===!0&&v()==="event-stream";k=await S.send(x,U,I,V,W,v())}catch(S){if(S instanceof p9||S instanceof Y0)throw S;B$(`websocket relay failed session=${j$(N)}; trying http relay code=relay_transport_error`),k=await xG({config:Z,payload:x,bodyText:U,requestMode:v,fallback:z,signal:X?.signal,authorizeAttempt:W})}else k=await xG({config:Z,payload:x,bodyText:U,requestMode:v,fallback:z,signal:X?.signal,authorizeAttempt:W});if(N8("send",{session:j$(N),ms:e$(N$()-m),transport:k.transport,protocol:k.protocol,mode:k.payload.mode,status:k.response.status,usedRelay:k.usedRelay}),!k.usedRelay)return k.response;if(k.transport==="http")try{V?.(k.response.headers)}catch{}if(k.transport==="http")VW(N,U,k.payload.next_hash,k.payload.revision);let l=N$(),P=JSON.stringify(k.payload).length;N8("payload_stringify",{session:j$(N),ms:e$(N$()-l),relayBytes:P}),B$(`used relay transport=${k.transport} protocol=${k.protocol} mode=${k.payload.mode} status=${k.response.status} session=${j$(N)} bodyBytes=${U.length} relayBytes=${P}`);let M=N$(),_=await cj({affinity:N,transport:k.transport,protocol:k.protocol,mode:k.payload.mode,status:k.response.status,bodyText:U,previousBodyText:w?.body,payload:k.payload,relayBytes:P,tag:B});try{if(_)j?.(_)}catch{}return N8("dump",{session:j$(N),ms:e$(N$()-M),enabled:!0}),k.response}catch(k){if(k instanceof p9)throw k.failure;if(k instanceof Y0)throw k;if(!Z.fallbackToDirect)throw B$(`relay failed session=${j$(N)} and fallbackToDirect=false code=relay_transport_error`),k;return B$(`relay failed; falling back direct session=${j$(N)} code=relay_transport_error`),z()}}var TC=`
+async function hashBody(body) {
+  const bytes = new TextEncoder().encode(body)
+  const digest = await crypto.subtle.digest('SHA-256', bytes)
+  const hex = [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('')
+  return 'sha256:' + hex
+}
+
+function applyPatch(base, patch) {
+  return base.slice(0, patch.start) + patch.insert + base.slice(patch.start + patch.deleteCount)
+}
+
+function applyPatchSet(base, patch) {
+  if (!Array.isArray(patch)) return applyPatch(base, patch)
+  if (patch.length === 0) return base
+
+  let result = ''
+  let cursor = 0
+  for (const item of patch) {
+    if (item.start < cursor) return { error: 'overlapping patch', status: 400 }
+    result += base.slice(cursor, item.start)
+    result += item.insert
+    cursor = item.start + item.deleteCount
+  }
+  return result + base.slice(cursor)
+}
+
+async function readState(env, affinity) {
+  const raw = await env.RELAY_STATE.get('session:' + affinity)
+  return raw ? JSON.parse(raw) : null
+}
+
+async function writeState(env, affinity, state) {
+  await env.RELAY_STATE.put('session:' + affinity, JSON.stringify(state), { expirationTtl: 86400 })
+}
+
+async function resolveBody(env, payload) {
+  if (payload.mode === 'full_sync') return payload.body
+  if (payload.mode === 'patch') {
+    const state = await readState(env, payload.affinity)
+    if (!state || state.hash !== payload.base_hash) {
+      return { error: 'state mismatch', status: 409 }
+    }
+    return applyPatchSet(state.body, payload.patch)
+  }
+  return { error: 'unknown mode', status: 400 }
+}
+
+async function prepareUpstream(env, payload) {
+  if ((payload.protocol !== 1 && payload.protocol !== 2) || payload.type !== 'request' || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {
+    return { error: 'invalid payload', status: 400 }
+  }
+
+  const body = await resolveBody(env, payload)
+  if (body && typeof body === 'object' && 'error' in body) return body
+
+  if (typeof body !== 'string' || (await hashBody(body)) !== payload.next_hash) {
+    return { error: 'hash mismatch', status: 409 }
+  }
+
+  const stateWrite = writeState(env, payload.affinity, { body, hash: payload.next_hash, revision: payload.revision }).catch(() => {})
+  console.log(JSON.stringify({
+    relay: 'opencode-anthropic-auth',
+    transport: 'relay',
+    mode: payload.mode,
+    revision: payload.revision,
+    affinity: String(payload.affinity).slice(0, 12),
+    bodyBytes: body.length,
+  }))
+
+  return { body, stateWrite }
+}
+
+function resolveBodyFromState(state, payload) {
+  if (payload.mode === 'full_sync') return payload.body
+  if (payload.mode === 'patch') {
+    if (!state || state.hash !== payload.base_hash) {
+      return { error: 'state mismatch', status: 409 }
+    }
+    return applyPatchSet(state.body, payload.patch)
+  }
+  return { error: 'unknown mode', status: 400 }
+}
+
+function deferWorkerTask(task) {
+  return new Promise((resolve) => setTimeout(resolve, 0)).then(task)
+}
+
+const WEBSOCKET_STREAM_FLUSH_BYTES = 1024
+const WEBSOCKET_STREAM_FLUSH_MS = 20
+
+function createWebSocketStreamCoalescer(socket, options = {}) {
+  const flushBytes = options.flushBytes || WEBSOCKET_STREAM_FLUSH_BYTES
+  const flushMs = options.flushMs ?? WEBSOCKET_STREAM_FLUSH_MS
+  let chunks = []
+  let byteLength = 0
+  let flushTimer = null
+  const stats = {
+    upstreamChunks: 0,
+    upstreamBytes: 0,
+    frames: 0,
+    frameBytes: 0,
+  }
+
+  const clearFlushTimer = () => {
+    if (flushTimer === null) return
+    clearTimeout(flushTimer)
+    flushTimer = null
+  }
+
+  const mergeChunks = () => {
+    if (chunks.length === 1) return chunks[0]
+    const frame = new Uint8Array(byteLength)
+    let offset = 0
+    for (const chunk of chunks) {
+      frame.set(chunk, offset)
+      offset += chunk.byteLength
+    }
+    return frame
+  }
+
+  const flush = () => {
+    clearFlushTimer()
+    if (byteLength === 0) return
+    const frame = mergeChunks()
+    chunks = []
+    byteLength = 0
+    socket.send(frame)
+    stats.frames += 1
+    stats.frameBytes += frame.byteLength
+  }
+
+  const scheduleFlush = () => {
+    if (flushTimer !== null) return
+    flushTimer = setTimeout(flush, flushMs)
+  }
+
+  return {
+    push(value) {
+      const chunk = value instanceof Uint8Array ? value : new Uint8Array(value)
+      if (chunk.byteLength === 0) return
+      stats.upstreamChunks += 1
+      stats.upstreamBytes += chunk.byteLength
+      chunks.push(chunk)
+      byteLength += chunk.byteLength
+      if (byteLength >= flushBytes) flush()
+      else scheduleFlush()
+    },
+    flush,
+    stats() {
+      return { ...stats, pendingBytes: byteLength }
+    },
+  }
+}
+
+function checkpointWebSocketState(env, payload, body, nextState) {
+  return deferWorkerTask(async () => {
+    try {
+      if ((await hashBody(body)) !== payload.next_hash) {
+        throw new Error('hash mismatch')
+      }
+      await writeState(env, payload.affinity, nextState)
+    } catch {
+      console.log(JSON.stringify({
+        relay: 'opencode-anthropic-auth',
+        transport: 'websocket',
+        event: 'checkpoint_write_failed',
+        affinity: String(payload.affinity).slice(0, 12),
+        code: 'checkpoint_write_error',
+      }))
+    }
+  })
+}
+
+async function prepareWebSocketUpstream(env, state, payload) {
+  if (payload.protocol !== 2 || payload.type !== 'request' || !payload.id || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {
+    return { error: 'invalid payload', status: 400 }
+  }
+
+  const body = resolveBodyFromState(state, payload)
+  if (body && typeof body === 'object' && 'error' in body) return body
+  if (typeof body !== 'string') return { error: 'invalid body', status: 400 }
+  if ((await hashBody(body)) !== payload.next_hash) {
+    return { error: 'hash mismatch', status: 409 }
+  }
+
+  const nextState = { body, hash: payload.next_hash, revision: payload.revision }
+  const checkpoint = checkpointWebSocketState(env, payload, body, nextState)
+  const logAccepted = () => console.log(JSON.stringify({
+    relay: 'opencode-anthropic-auth',
+    transport: 'websocket',
+    mode: payload.mode,
+    revision: payload.revision,
+    affinity: String(payload.affinity).slice(0, 12),
+    bodyBytes: body.length,
+  }))
+
+  return { body, state: nextState, checkpoint, logAccepted }
+}
+
+function headersToObject(headers) {
+  const result = {}
+  for (const [key, value] of headers.entries()) result[key] = value
+  return result
+}
+
+async function handleRelayPayload(env, payload) {
+  const prepared = await prepareUpstream(env, payload)
+  if (prepared.error) return prepared
+  const upstream = await fetch(payload.upstream.url, {
+    method: payload.upstream.method || 'POST',
+    headers: payload.upstream.headers,
+    body: prepared.body,
+  })
+  return { upstream, stateWrite: prepared.stateWrite }
+}
+
+async function handleWebSocket(socket, env, ctx, payload, getState, setState) {
+  const heartbeat = setInterval(() => {
+    try {
+      socket.send(JSON.stringify({ protocol: 2, type: 'keepalive' }))
+    } catch {
+      clearInterval(heartbeat)
+    }
+  }, 15000)
+  let streamCoalescer = null
+  try {
+    const result = await prepareWebSocketUpstream(env, getState(), payload)
+    if (result.error) {
+      socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: result.status, message: result.error }))
+      return
+    }
+
+    setState(result.state)
+    socket.send(JSON.stringify({ protocol: 2, type: 'accepted', id: payload.id, hash: result.state.hash, revision: result.state.revision }))
+    ctx?.waitUntil?.(deferWorkerTask(result.logAccepted))
+
+    const upstreamPromise = fetch(payload.upstream.url, {
+      method: payload.upstream.method || 'POST',
+      headers: payload.upstream.headers,
+      body: result.body,
+    })
+    ctx?.waitUntil?.(result.checkpoint)
+    const upstream = await upstreamPromise
+    socket.send(JSON.stringify({
+      protocol: 2,
+      type: 'response_start',
+      id: payload.id,
+      status: upstream.status,
+      statusText: upstream.statusText,
+      headers: headersToObject(upstream.headers),
+    }))
+
+    const reader = upstream.body?.getReader()
+    if (reader) {
+      streamCoalescer = createWebSocketStreamCoalescer(socket)
+      while (true) {
+        const { done, value } = await reader.read()
+        if (done) break
+        streamCoalescer.push(value)
+      }
+      streamCoalescer.flush()
+    }
+    const stats = streamCoalescer?.stats?.() || {}
+    socket.send(JSON.stringify({ protocol: 2, type: 'done', id: payload.id, ...stats }))
+  } catch (error) {
+    try {
+      streamCoalescer?.flush?.()
+    } catch {}
+    socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: 500, message: error instanceof Error ? error.message : String(error) }))
+  } finally {
+    clearInterval(heartbeat)
+  }
+}
+
+export default {
+  async fetch(request, env, ctx) {
+    if (request.headers.get('Upgrade') === 'websocket') {
+      const url = new URL(request.url)
+      const token = url.searchParams.get('token')
+      const affinity = url.searchParams.get('affinity')
+      if (token !== env.RELAY_TOKEN) return new Response('unauthorized', { status: 401 })
+      if (!affinity) return new Response('missing affinity', { status: 400 })
+      const pair = new WebSocketPair()
+      const client = pair[0]
+      const server = pair[1]
+      server.binaryType = 'arraybuffer'
+      let state = null
+      let ready = false
+      server.accept()
+      const loadState = readState(env, affinity).then((loadedState) => {
+        state = loadedState
+        ready = true
+        server.send(JSON.stringify({
+          protocol: 2,
+          type: 'ready',
+          state: state ? { hash: state.hash, revision: state.revision } : null,
+        }))
+      }).catch((error) => {
+        server.send(JSON.stringify({ protocol: 2, type: 'error', status: 500, message: error instanceof Error ? error.message : String(error) }))
+        server.close(1011, 'state load failed')
+      })
+      ctx?.waitUntil?.(loadState)
+      if (!ctx?.waitUntil) void loadState
+      let busy = false
+      server.addEventListener('message', (event) => {
+        if (!ready) {
+          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 425, message: 'relay state is not ready' }))
+          return
+        }
+        if (busy) {
+          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 429, message: 'request already in flight' }))
+          return
+        }
+        let payload
+        try {
+          payload = JSON.parse(event.data)
+        } catch {
+          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 400, message: 'invalid JSON payload' }))
+          return
+        }
+        payload.affinity = affinity
+        busy = true
+        const run = handleWebSocket(server, env, ctx, payload, () => state, (nextState) => { state = nextState }).finally(() => { busy = false })
+        ctx?.waitUntil?.(run)
+        if (!ctx?.waitUntil) void run
+      })
+      return new Response(null, { status: 101, webSocket: client })
+    }
+
+    if (request.method === 'GET') {
+      return Response.json({ status: 'ok', transports: ['http', 'websocket'] })
+    }
+    if (request.method !== 'POST') return new Response('method not allowed', { status: 405 })
+    if (request.headers.get('x-relay-token') !== env.RELAY_TOKEN) {
+      return new Response('unauthorized', { status: 401 })
+    }
+
+    try {
+      const payload = await request.json()
+      const result = await handleRelayPayload(env, payload)
+      if (result.error) return Response.json({ error: result.error }, { status: result.status })
+
+      if (result.stateWrite) ctx.waitUntil(result.stateWrite)
+
+      const upstream = result.upstream
+      return new Response(upstream.body, {
+        status: upstream.status,
+        statusText: upstream.statusText,
+        headers: upstream.headers,
+      })
+    } catch (error) {
+      return Response.json(
+        { error: error instanceof Error ? error.message : 'internal relay error' },
+        { status: 502 },
+      )
+    }
+  },
+}
+`,q_="Cannot send this request: the history ends on an assistant turn. Send a new message to continue; assistant content will not be discarded to replay the previous question.";class qW extends Error{details;check="meaningful_trailing_assistant";constructor($){super(q_);this.details=$,this.name="TrailingAssistantHistoryError"}}var j_=new Set(["text","thinking","redacted_thinking","tool_use","server_tool_use","image","document"]),H_=new Set(["type","text","cache_control"]);function CJ($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function L_($){if(typeof $==="string")return $.trim()==="";if(!Array.isArray($))return!1;return $.every((Z)=>CJ(Z)&&Z.type==="text"&&typeof Z.text==="string"&&Z.text.trim()===""&&Object.keys(Z).every((J)=>H_.has(J)))}function U_($){if(Array.isArray($))return{contentShape:"array",contentBlockCount:$.length,contentBlockTypes:$.map((Z)=>CJ(Z)&&typeof Z.type==="string"&&j_.has(Z.type)?Z.type:"other")};if(typeof $==="string")return{contentShape:"string"};if($===void 0)return{contentShape:"missing"};return{contentShape:"other"}}function N_($){let Z=$.length;while(Z>0){let J=$[Z-1];if(!CJ(J)||J.role!=="assistant")break;if(!L_(J.content))throw new qW({messageCount:$.length,trailingMessageIndex:Z-1,emptyMessagesAfter:$.length-Z,...U_(J.content)});Z--}return $.length-Z}function FC($){if(!Array.isArray($))return 0;let Z=N_($);if(Z)$.length-=Z;return Z}var W1=["main-first","fallback-first","sticky-balanced"],SJ="main-first",jW="Usage: `/claude-routing`, `/claude-routing main-first`, `/claude-routing fallback-first`, `/claude-routing sticky-balanced`, or `/claude-routing reset`.";function x_($){return typeof $==="string"&&W1.includes($)?$:SJ}function CC($){return x_($?.routing?.mode)}function D_($){let Z=$.trim().toLowerCase().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="reset")return{type:"reset"};if(Z.length===1&&W1.includes(Z[0]))return{type:"mode",mode:Z[0]};if(Z.length===2&&Z[0]==="mode"&&W1.includes(Z[1]))return{type:"mode",mode:Z[1]};return{type:"usage"}}function O_($){if($==="fallback-first")return"Try usable fallback accounts before the main account. If no fallback succeeds, try the main account.";if($==="sticky-balanced")return"Assign each session to a quota-weighted OAuth account, keep it sticky across transient failures, and migrate only for confirmed long-lived exhaustion or permanent account failure.";return"Try the main account first. Use fallback accounts only when quota policy or fallback errors require it."}function n7($){let Z=$?.mode??SJ;return["## Claude Routing Status","",`- Mode: \`${Z}\``,`- Behavior: ${O_(Z)}`,"",jW].join(`
+`)}function SC($){let Z=D_($.argumentsText),J=$.mode??SJ;if(Z.type==="status")return n7({mode:J});if(Z.type==="mode")return["## Claude Routing Updated","",`Mode updated to \`${Z.mode}\`.`,"",...n7({mode:Z.mode}).split(`
+`).slice(2)].join(`
+`);if(Z.type==="reset")return["## Claude Routing Assignment Reset","","The current session will be assigned again on its next request.","",...n7({mode:J}).split(`
+`).slice(2)].join(`
+`);return["## Claude Routing Usage","",jW,"",...n7({mode:J}).split(`
+`).slice(2)].join(`
+`)}var I_="## Claude Lane Start Status",M_="## Claude Lane Start Queued",P_="## Claude Lane Start Usage",__="Usage: `/claude-start`.";function w_($){if($.trim().split(/\s+/).filter(Boolean).length===0)return{type:"fire"};return{type:"usage"}}function kC($){let Z=w_($.argumentsText);if(Z.type==="fire")return{action:Z,text:[M_,"","- Queued an explicit lane-start request.","- This is a billed request: the one-token limit does not remove prompt-cache read or write charges."].join(`
+`)};return{action:Z,text:[P_,"",__,"",I_].join(`
+`)}}var vC="thinking-binding-controls-2026-08-01";function c9($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function A_($){if(!c9($))return!1;if($.type==="thinking")return typeof $.signature==="string"&&$.signature.length>0;if($.type==="redacted_thinking")return typeof $.data==="string"&&$.data.length>0;return!1}function fC($){let Z=$?.thinkingBinding?.prefixMismatchBehavior;return Z==="error"||Z==="drop_block"?Z:"account-default"}function R_($){if(!Array.isArray($.messages))return!1;return $.messages.some((Z)=>{if(!c9(Z)||Z.role!=="assistant")return!1;return Array.isArray(Z.content)&&Z.content.some(A_)})}function EC($,Z="account-default"){if(Z==="account-default")return!1;if(!GQ($.model)&&!d1($.model)&&!zQ($.model)&&!FU($.model))return!1;if(!R_($))return!1;if(!c9($.thinking)||$.thinking.type!=="adaptive")return!1;return $.thinking.block_binding={prefix_mismatch_behavior:Z},!0}function bC($){if(!c9($.thinking))return!1;if(!c9($.thinking.block_binding))return!1;let Z=$.thinking.block_binding.prefix_mismatch_behavior;return Z==="error"||Z==="drop_block"}
+export{n8 as Z,k$ as _,H4 as $,qA as aa,jA as ba,HA as ca,gV as da,LA as ea,UA as fa,yV as ga,RG as ha,cV as ia,lV as ja,kG as ka,j1 as la,fG as ma,oV as na,d as oa,mG as pa,wA as qa,W0 as ra,AA as sa,M1 as ta,RA as ua,TA as va,S4 as wa,lG as xa,OB as ya,kX as za,E$ as Aa,d2 as Ba,V0 as Ca,CA as Da,SA as Ea,B0 as Fa,sG as Ga,Q4 as Ha,A1 as Ia,C4 as Ja,kA as Ka,vA as La,fA as Ma,EA as Na,bA as Oa,hA as Pa,gA as Qa,PZ as Ra,yA as Sa,uA as Ta,mA as Ua,pA as Va,L9 as Wa,cA as Xa,n4 as Ya,jq as Za,Xz as _a,Hq as $a,lA as ab,Yz as bb,Gz as cb,zz as db,Lq as eb,iA as fb,W8 as gb,dA as hb,sA as ib,tA as jb,aA as kb,_q as lb,nA as mb,Fq as nb,Cq as ob,fq as pb,eA as qb,gq as rb,$R as sb,mq as tb,L4 as ub,JR as vb,qz as wb,XR as xb,$j as yb,YR as zb,Yj as Ab,WR as Bb,Sj as Cb,VR as Db,pj as Eb,lj as Fb,dj as Gb,U0 as Hb,nj as Ib,HR as Jb,y1 as Kb,LR as Lb,UL as Mb,bZ as Nb,x0 as Ob,lz as Pb,NL as Qb,UR as Rb,IL as Sb,IR as Tb,SL as Ub,pL as Vb,TR as Wb,o9 as Xb,dL as Yb,aL as Zb,kR as _b,vR as $b,gZ as ac,QU as bc,KU as cc,WU as dc,ER as ec,bR as fc,hR as gc,gR as hc,DU as ic,yR as jc,uR as kc,MU as lc,mR as mc,W5 as nc,o6 as oc,XQ as pc,P6 as qc,r9 as rc,pR as sc,cR as tc,lR as uc,iR as vc,MY as wc,AU as xc,RU as yc,GQ as zc,sR as Ac,tR as Bc,aR as Cc,_Y as Dc,nR as Ec,oR as Fc,rR as Gc,eR as Hc,$T as Ic,zQ as Jc,TU as Kc,ZT as Lc,JT as Mc,XT as Nc,YT as Oc,GT as Pc,zT as Qc,QT as Rc,FU as Sc,KT as Tc,CU as Uc,AY as Vc,WT as Wc,VT as Xc,BT as Yc,qT as Zc,jT as _c,d1 as $c,HT as ad,LT as bd,UT as cd,NT as dd,xT as ed,vU as fd,DT as gd,iQ as hd,l$ as id,aT as jd,a as kd,BZ as ld,Q7 as md,TO as nd,DF as od,wF as pd,gK as qd,FF as rd,mK as sd,CF as td,SF as ud,NI as vd,kF as wd,pK as xd,vF as yd,fF as zd,DI as Ad,g$ as Bd,hI as Cd,TJ as Dd,lF as Ed,dF as Fd,UM as Gd,aF as Hd,nF as Id,n5 as Jd,oF as Kd,A$ as Ld,zC as Md,QC as Nd,BP as Od,jP as Pd,a7 as Qd,jC as Rd,HC as Sd,OP as Td,PP as Ud,D8 as Vd,DC as Wd,EP as Xd,OC as Yd,IC as Zd,S6 as _d,MC as $d,PC as ae,AC as be,RC as ce,TC as de,qW as ee,FC as fe,CC as ge,D_ as he,SC as ie,w_ as je,kC as ke,vC as le,fC as me,EC as ne,bC as oe};