@cortexkit/opencode-anthropic-auth 1.23.0 → 2.0.1

package/dist/index-yxtdke11.js

@@ -0,0 +1,449 @@
+import{ve as LX}from"./index-p4wvcwhh.js";import{Ue as jX}from"./index-3xqv3rw3.js";import{createHash as Kw,randomUUID as K7}from"node:crypto";import{mkdir as CV,readFile as W7,rename as SV,rm as Z9,stat as IX,writeFile as V7}from"node:fs/promises";import{homedir as kV}from"node:os";import{dirname as vV,join as k8}from"node:path";import{readdirSync as fV,statSync as EV}from"node:fs";import*as xG from"node:fs/promises";import{tmpdir as bV,userInfo as n7}from"node:os";import{join as f9}from"node:path";import{createHash as hB}from"node:crypto";var YW=new Uint8Array([0,97,115,109,1,0,0,0,1,48,8,96,3,127,127,127,1,127,96,3,127,127,127,0,96,2,127,127,0,96,1,127,1,127,96,3,127,127,126,1,126,96,3,126,127,127,1,126,96,2,127,126,0,96,1,127,1,126,3,11,10,0,0,2,1,3,4,5,6,1,7,5,3,1,0,1,7,85,9,3,109,101,109,2,0,5,120,120,104,51,50,0,0,6,105,110,105,116,51,50,0,2,8,117,112,100,97,116,101,51,50,0,3,8,100,105,103,101,115,116,51,50,0,4,5,120,120,104,54,52,0,5,6,105,110,105,116,54,52,0,7,8,117,112,100,97,116,101,54,52,0,8,8,100,105,103,101,115,116,54,52,0,9,10,251,22,10,242,1,1,4,127,32,0,32,1,106,33,3,32,1,65,16,79,4,127,32,3,65,16,107,33,6,32,2,65,168,136,141,161,2,106,33,3,32,2,65,137,235,208,208,7,107,33,4,32,2,65,207,140,162,142,6,106,33,5,3,64,32,3,32,0,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,3,32,4,32,0,65,4,106,34,0,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,4,32,2,32,0,65,4,106,34,0,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,2,32,5,32,0,65,4,106,34,0,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,5,32,6,32,0,65,4,106,34,0,79,13,0,11,32,2,65,12,119,32,5,65,18,119,106,32,4,65,7,119,106,32,3,65,1,119,106,5,32,2,65,177,207,217,178,1,106,11,32,1,106,32,0,32,1,65,15,113,16,1,11,146,1,0,32,1,32,2,106,33,2,3,64,32,1,65,4,106,32,2,75,69,4,64,32,0,32,1,40,2,0,65,189,220,202,149,124,108,106,65,17,119,65,175,214,211,190,2,108,33,0,32,1,65,4,106,33,1,12,1,11,11,3,64,32,1,32,2,79,69,4,64,32,0,32,1,45,0,0,65,177,207,217,178,1,108,106,65,11,119,65,177,243,221,241,121,108,33,0,32,1,65,1,106,33,1,12,1,11,11,32,0,32,0,65,15,118,115,65,247,148,175,175,120,108,34,0,65,13,118,32,0,115,65,189,220,202,149,124,108,34,0,65,16,118,32,0,115,11,63,0,32,0,65,8,106,32,1,65,168,136,141,161,2,106,54,2,0,32,0,65,12,106,32,1,65,137,235,208,208,7,107,54,2,0,32,0,65,16,106,32,1,54,2,0,32,0,65,20,106,32,1,65,207,140,162,142,6,106,54,2,0,11,195,4,1,6,127,32,1,32,2,106,33,6,32,0,65,24,106,33,4,32,0,65,40,106,40,2,0,33,3,32,0,32,0,40,2,0,32,2,106,54,2,0,32,0,65,4,106,34,5,32,5,40,2,0,32,2,65,16,79,32,0,40,2,0,65,16,79,114,114,54,2,0,32,2,32,3,106,65,16,73,4,64,32,3,32,4,106,32,1,32,2,252,10,0,0,32,0,65,40,106,32,2,32,3,106,54,2,0,15,11,32,3,4,64,32,3,32,4,106,32,1,65,16,32,3,107,34,2,252,10,0,0,32,0,65,8,106,34,3,32,3,40,2,0,32,4,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,54,2,0,32,0,65,12,106,34,3,32,3,40,2,0,32,4,65,4,106,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,54,2,0,32,0,65,16,106,34,3,32,3,40,2,0,32,4,65,8,106,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,54,2,0,32,0,65,20,106,34,3,32,3,40,2,0,32,4,65,12,106,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,54,2,0,32,0,65,40,106,65,0,54,2,0,32,1,32,2,106,33,1,11,32,1,32,6,65,16,107,77,4,64,32,6,65,16,107,33,8,32,0,65,8,106,40,2,0,33,2,32,0,65,12,106,40,2,0,33,3,32,0,65,16,106,40,2,0,33,5,32,0,65,20,106,40,2,0,33,7,3,64,32,2,32,1,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,2,32,3,32,1,65,4,106,34,1,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,3,32,5,32,1,65,4,106,34,1,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,5,32,7,32,1,65,4,106,34,1,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,7,32,8,32,1,65,4,106,34,1,79,13,0,11,32,0,65,8,106,32,2,54,2,0,32,0,65,12,106,32,3,54,2,0,32,0,65,16,106,32,5,54,2,0,32,0,65,20,106,32,7,54,2,0,11,32,1,32,6,73,4,64,32,4,32,1,32,6,32,1,107,34,1,252,10,0,0,32,0,65,40,106,32,1,54,2,0,11,11,97,1,1,127,32,0,65,16,106,40,2,0,33,1,32,0,65,4,106,40,2,0,4,127,32,1,65,12,119,32,0,65,20,106,40,2,0,65,18,119,106,32,0,65,12,106,40,2,0,65,7,119,106,32,0,65,8,106,40,2,0,65,1,119,106,5,32,1,65,177,207,217,178,1,106,11,32,0,40,2,0,106,32,0,65,24,106,32,0,65,40,106,40,2,0,16,1,11,255,3,2,3,126,1,127,32,0,32,1,106,33,6,32,1,65,32,79,4,126,32,6,65,32,107,33,6,32,2,66,214,235,130,238,234,253,137,245,224,0,124,33,3,32,2,66,177,169,172,193,173,184,212,166,61,125,33,4,32,2,66,249,234,208,208,231,201,161,228,225,0,124,33,5,3,64,32,3,32,0,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,3,32,4,32,0,65,8,106,34,0,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,4,32,2,32,0,65,8,106,34,0,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,2,32,5,32,0,65,8,106,34,0,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,5,32,6,32,0,65,8,106,34,0,79,13,0,11,32,2,66,12,137,32,5,66,18,137,124,32,4,66,7,137,124,32,3,66,1,137,124,32,3,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,4,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,2,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,5,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,5,32,2,66,197,207,217,178,241,229,186,234,39,124,11,32,1,173,124,32,0,32,1,65,31,113,16,6,11,134,2,0,32,1,32,2,106,33,2,3,64,32,2,32,1,65,8,106,79,4,64,32,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,32,0,133,66,27,137,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,33,0,32,1,65,8,106,33,1,12,1,11,11,32,1,65,4,106,32,2,77,4,64,32,0,32,1,53,2,0,66,135,149,175,175,152,182,222,155,158,127,126,133,66,23,137,66,207,214,211,190,210,199,171,217,66,126,66,249,243,221,241,153,246,153,171,22,124,33,0,32,1,65,4,106,33,1,11,3,64,32,1,32,2,73,4,64,32,0,32,1,49,0,0,66,197,207,217,178,241,229,186,234,39,126,133,66,11,137,66,135,149,175,175,152,182,222,155,158,127,126,33,0,32,1,65,1,106,33,1,12,1,11,11,32,0,32,0,66,33,136,133,66,207,214,211,190,210,199,171,217,66,126,34,0,32,0,66,29,136,133,66,249,243,221,241,153,246,153,171,22,126,34,0,32,0,66,32,136,133,11,77,0,32,0,65,8,106,32,1,66,214,235,130,238,234,253,137,245,224,0,124,55,3,0,32,0,65,16,106,32,1,66,177,169,172,193,173,184,212,166,61,125,55,3,0,32,0,65,24,106,32,1,55,3,0,32,0,65,32,106,32,1,66,249,234,208,208,231,201,161,228,225,0,124,55,3,0,11,244,4,2,3,127,4,126,32,1,32,2,106,33,5,32,0,65,40,106,33,4,32,0,65,200,0,106,40,2,0,33,3,32,0,32,0,41,3,0,32,2,173,124,55,3,0,32,2,32,3,106,65,32,73,4,64,32,3,32,4,106,32,1,32,2,252,10,0,0,32,0,65,200,0,106,32,2,32,3,106,54,2,0,15,11,32,3,4,64,32,3,32,4,106,32,1,65,32,32,3,107,34,2,252,10,0,0,32,0,65,8,106,34,3,32,3,41,3,0,32,4,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,55,3,0,32,0,65,16,106,34,3,32,3,41,3,0,32,4,65,8,106,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,55,3,0,32,0,65,24,106,34,3,32,3,41,3,0,32,4,65,16,106,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,55,3,0,32,0,65,32,106,34,3,32,3,41,3,0,32,4,65,24,106,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,55,3,0,32,0,65,200,0,106,65,0,54,2,0,32,1,32,2,106,33,1,11,32,1,65,32,106,32,5,77,4,64,32,5,65,32,107,33,2,32,0,65,8,106,41,3,0,33,6,32,0,65,16,106,41,3,0,33,7,32,0,65,24,106,41,3,0,33,8,32,0,65,32,106,41,3,0,33,9,3,64,32,6,32,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,6,32,7,32,1,65,8,106,34,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,7,32,8,32,1,65,8,106,34,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,8,32,9,32,1,65,8,106,34,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,9,32,2,32,1,65,8,106,34,1,79,13,0,11,32,0,65,8,106,32,6,55,3,0,32,0,65,16,106,32,7,55,3,0,32,0,65,24,106,32,8,55,3,0,32,0,65,32,106,32,9,55,3,0,11,32,1,32,5,73,4,64,32,4,32,1,32,5,32,1,107,34,1,252,10,0,0,32,0,65,200,0,106,32,1,54,2,0,11,11,188,2,1,5,126,32,0,65,24,106,41,3,0,33,1,32,0,41,3,0,34,2,66,32,90,4,126,32,0,65,8,106,41,3,0,34,3,66,1,137,32,0,65,16,106,41,3,0,34,4,66,7,137,124,32,1,66,12,137,32,0,65,32,106,41,3,0,34,5,66,18,137,124,124,32,3,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,4,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,1,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,5,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,5,32,1,66,197,207,217,178,241,229,186,234,39,124,11,32,2,124,32,0,65,40,106,32,2,66,31,131,167,16,6,11]);async function R2(){return function($){let{exports:{mem:Z,xxh32:J,xxh64:X,init32:Y,update32:G,digest32:z,init64:Q,update64:K,digest64:W}}=$,V=new Uint8Array(Z.buffer);function B(L,w){if(Z.buffer.byteLength<L+w){let S=Math.ceil((L+w-Z.buffer.byteLength)/65536);Z.grow(S),V=new Uint8Array(Z.buffer)}}function q(L,w,S,f,d,s){B(L);let _=new Uint8Array(L);return V.set(_),S(0,w),_.set(V.subarray(0,L)),{update(O){let P;return V.set(_),typeof O=="string"?(B(3*O.length,L),P=N.encodeInto(O,V.subarray(L)).written):(B(O.byteLength,L),V.set(O,L),P=O.byteLength),f(0,L,P),_.set(V.subarray(0,L)),this},digest:()=>(V.set(_),s(d(0)))}}function H(L){return L>>>0}let j=2n**64n-1n;function x(L){return L&j}let N=new TextEncoder,U=0,D=0n;function A(L,w=U){return B(3*L.length,0),H(J(0,N.encodeInto(L,V).written,w))}function I(L,w=D){return B(3*L.length,0),x(X(0,N.encodeInto(L,V).written,w))}return{h32:A,h32ToString:(L,w=U)=>A(L,w).toString(16).padStart(8,"0"),h32Raw:(L,w=U)=>(B(L.byteLength,0),V.set(L),H(J(0,L.byteLength,w))),create32:(L=U)=>q(48,L,Y,G,z,H),h64:I,h64ToString:(L,w=D)=>I(L,w).toString(16).padStart(16,"0"),h64Raw:(L,w=D)=>(B(L.byteLength,0),V.set(L),x(X(0,L.byteLength,w))),create64:(L=D)=>q(88,L,Q,K,W,x)}}((await WebAssembly.instantiate(YW)).instance)}import{randomBytes as Jq,randomUUID as dG}from"node:crypto";import{createHash as Dq,randomBytes as Oq}from"node:crypto";import{lstat as ZJ,mkdir as Mq,readdir as sG,readFile as vX,rename as Iq,unlink as tG,writeFile as _q}from"node:fs/promises";import{tmpdir as Pq}from"node:os";import{join as UZ,resolve as I9}from"node:path";import*as D$ from"node:fs";import*as aG from"node:os";import*as nG from"node:path";import{Buffer as g9}from"node:buffer";import{types as J8}from"node:util";import{types as R5}from"node:util";import{randomUUID as ZY}from"node:crypto";import{mkdir as nH,readdir as oH,readFile as rH,rename as eH,rm as JY,writeFile as $L}from"node:fs/promises";import{tmpdir as ZL}from"node:os";import{join as VJ}from"node:path";import{createHash as zL,randomBytes as QL,randomUUID as Cz}from"node:crypto";import{constants as XY}from"node:fs";import{chmod as KL,mkdir as E5,open as Sz,realpath as WL,rename as kz,stat as VL,unlink as b5}from"node:fs/promises";import{homedir as BL}from"node:os";import{basename as g5,dirname as u8,extname as YY,isAbsolute as qL,join as h9,resolve as jL}from"node:path";import{readdirSync as cW,statSync as lW}from"node:fs";import{tmpdir as zX,userInfo as dW}from"node:os";import{join as W8}from"node:path";import{debuglog as NW}from"node:util";import{createHmac as KW,randomBytes as WW,timingSafeEqual as VW}from"node:crypto";import QW from"node:net";var a6=2,H1=21,L1=5,bZ=67108864,i;(function($){$[$.Request=0]="Request",$[$.Response=1]="Response",$[$.Push=2]="Push",$[$.StreamData=3]="StreamData",$[$.StreamEnd=4]="StreamEnd",$[$.Error=5]="Error",$[$.Cancel=6]="Cancel",$[$.Ping=7]="Ping",$[$.Pong=8]="Pong",$[$.Hello=9]="Hello",$[$.HelloAck=10]="HelloAck",$[$.Goodbye=11]="Goodbye"})(i||(i={}));var T2=i.Goodbye;function F2($){return $===i.Cancel||$===i.Ping||$===i.Pong||$===i.Goodbye}var w6;(function($){$[$.Passive=0]="Passive",$[$.Interactive=1]="Interactive",$[$.Background=2]="Background"})(w6||(w6={}));var f6;(function($){$[$.Normal=0]="Normal",$[$.Expedite=1]="Expedite",$[$.Sheddable=2]="Sheddable"})(f6||(f6={}));var C2=1,S2=6,gZ=1,GW=8,k2=48,yZ=4;var v2=0;function h6($,Z,J,X=f6.Normal){let Y=0;if($)Y|=C2;if(Y|=Z<<gZ,J)Y|=GW;return Y|=X<<yZ,Y}function hZ($){return($&C2)!==0}function f2($){let Z=new Uint8Array(21),J=new DataView(Z.buffer);return J.setUint32(0,$.len,!0),Z[4]=$.ver,Z[5]=$.ty,Z[6]=$.flags,J.setUint16(7,$.channel,!0),J.setUint32(9,$.epoch,!0),J.setBigUint64(13,$.corr,!0),Z}class Q6 extends Error{code;constructor($,Z){super($);this.code=Z,this.name="DecodeError"}}function zW($){let Z=$.len>>>0,J=$.ver>>>0&255,X=$.ty>>>0&255,Y=$.flags>>>0&255,G=$.channel>>>0&65535,z=$.epoch>>>0;if(BigInt.asUintN(64,$.corr),J!==2)throw new Q6(`unsupported envelope version ${J}`,"unsupported_version");if(X>T2)throw new Q6(`unknown frame type byte ${X}`,"unknown_frame_type");let Q=X;if((Y&v2)!==0)throw new Q6(`reserved flag bits set in flags 0b${Y.toString(2).padStart(8,"0")}`,"reserved_flag_bits");if((Y&S2)>>gZ===3)throw new Q6(`reserved priority bits set in flags 0b${Y.toString(2).padStart(8,"0")}`,"reserved_priority_bits");let K=(Y&k2)>>yZ;if(K===3)throw new Q6(`reserved admission class set in flags 0b${Y.toString(2).padStart(8,"0")}`,"reserved_admission_class");if(K===f6.Sheddable&&Q!==i.Push&&Q!==i.StreamData)throw new Q6(`SHEDDABLE admission class is illegal on ${i[Q]} in flags 0b${Y.toString(2).padStart(8,"0")}`,"sheddable_illegal_frame_type");if(G===0&&z!==0)throw new Q6(`control channel carried nonzero epoch ${z}`,"nonzero_epoch_on_control_channel");if(F2(Q)&&Z!==0)throw new Q6(`pure-header frame ${i[Q]} declared non-zero body length ${Z}`,"pure_header_frame_with_body")}function mZ($){if($.length<5)throw new Q6(`header shorter than frozen prefix: have ${$.length} bytes`,"too_short_for_prefix");let Z=$[4];if(Z!==2)throw new Q6(`unsupported envelope version ${Z}`,"unsupported_version");if($.length<21)throw new Q6(`header too short for version: have ${$.length} bytes, need 21`,"too_short_for_header");let J=new DataView($.buffer,$.byteOffset,$.byteLength),X=J.getUint32(0,!0),Y=$[5];if(Y>T2)throw new Q6(`unknown frame type byte ${Y}`,"unknown_frame_type");let G=Y,z=$[6];if((z&v2)!==0)throw new Q6(`reserved flag bits set in flags 0b${z.toString(2).padStart(8,"0")}`,"reserved_flag_bits");if((z&S2)>>gZ===3)throw new Q6(`reserved priority bits set in flags 0b${z.toString(2).padStart(8,"0")}`,"reserved_priority_bits");let Q=(z&k2)>>yZ;if(Q===3)throw new Q6(`reserved admission class set in flags 0b${z.toString(2).padStart(8,"0")}`,"reserved_admission_class");if(Q===f6.Sheddable&&G!==i.Push&&G!==i.StreamData)throw new Q6(`SHEDDABLE admission class is illegal on ${i[G]} in flags 0b${z.toString(2).padStart(8,"0")}`,"sheddable_illegal_frame_type");let K=J.getUint16(7,!0),W=J.getUint32(9,!0);if(K===0&&W!==0)throw new Q6(`control channel carried nonzero epoch ${W}`,"nonzero_epoch_on_control_channel");if(F2(G)&&X!==0)throw new Q6(`pure-header frame ${i[G]} declared non-zero body length ${X}`,"pure_header_frame_with_body");return{len:X,ver:Z,ty:G,flags:z,channel:K,epoch:W,corr:J.getBigUint64(13,!0)}}function E6($,Z,J,X,Y,G){return _$(2,$,Z,J,X,Y,G)}function _$($,Z,J,X,Y,G,z){if(z.length>67108864)throw new Q6(`frame body ${z.length} exceeds max 67108864`,"frame_body_too_large");let Q={len:z.length,ver:$,ty:Z,flags:J,channel:X,epoch:Y,corr:G};return zW(Q),{header:Q,body:z}}function B$($){if($.header.len!==$.body.length)throw new Q6(`frame header length ${$.header.len} does not match body length ${$.body.length}`,"frame_length_mismatch");let Z=f2($.header),J=new Uint8Array(Z.length+$.body.length);return J.set(Z,0),J.set($.body,Z.length),J}class y$ extends Error{}class q$ extends Error{}class P$ extends Error{cause;constructor($,Z){super($);this.cause=Z}}class e$ extends Error{cause;constructor($,Z){super($);this.cause=Z}}function E2($){return Buffer.from($.buffer,$.byteOffset,$.byteLength)}var b2=Symbol("subc.socket.writeBorrowed"),g2=Symbol("subc.socket.writeTrackedBorrowed");function j$($,Z,J){let X=$[b2];return X?X.call($,Z,J):$.write(Z,J)}function uZ($,Z,J){let X=$[g2];return X?X.call($,Z,J):$.writeTracked(Z,J)}class T0{sock;chunks=[];buffered=0;waiter=null;closedErr=null;bufferedBytes(){return this.buffered}constructor($){this.sock=$,$.on("data",(J)=>{this.chunks.push(J),this.buffered+=J.length,this.tryServe()});let Z=(J)=>{if(!this.closedErr)this.closedErr=J;this.tryServe()};$.on("error",(J)=>Z(J instanceof Error?J:Error(String(J)))),$.on("end",()=>Z(new y$("subc closed the connection"))),$.on("close",()=>Z(new y$("subc connection closed")))}localPort(){return this.sock.localPort??null}static connect($,Z,J){return new Promise((X,Y)=>{let G=QW.connect({host:$,port:Z});G.setNoDelay(!0);let z=setTimeout(()=>{G.destroy(),Y(new q$(`timed out connecting to ${$}:${Z}`))},Math.max(0,J-Date.now()));G.once("connect",()=>{clearTimeout(z),X(new T0(G))}),G.once("error",(Q)=>{clearTimeout(z),Y(Q)})})}async readFrame($,Z,J){let X=await this.readExact(L1,$),Y=X[4];if(Y!==a6)throw new Q6(`unsupported envelope version ${Y}`,"unsupported_version");let G=await this.readExact(H1-L1,$),z=new Uint8Array(H1);z.set(X),z.set(G,L1);let Q=mZ(z);if(Q.len>bZ)throw new Q6(`frame body ${Q.len} exceeds max ${bZ}`,"frame_body_too_large");J?.();let K=typeof Z==="number"?Z:Date.now()+Z.afterHeaderMs,W=Q.len===0?new Uint8Array(0):await this.readExact(Q.len,K);return{header:Q,body:W}}readExact($,Z){if(this.waiter)return Promise.reject(Error("concurrent readExact is not supported"));if($===0)return Promise.resolve(new Uint8Array(0));return new Promise((J,X)=>{let Y=null;if(Number.isFinite(Z)){let G=Z-Date.now();if(G<=0){X(new q$(`timed out waiting for ${$} bytes`));return}Y=setTimeout(()=>{this.waiter=null,X(new q$(`timed out waiting for ${$} bytes`))},G)}this.waiter={need:$,resolve:J,reject:X,timer:Y},this.tryServe()})}async write($,Z){await this.writeBuffer(Buffer.from($),Z)}writeTracked($,Z){return this.writeTrackedBuffer(Buffer.from($),Z)}async[b2]($,Z){await this.writeBuffer(E2($),Z)}[g2]($,Z){return this.writeTrackedBuffer(E2($),Z)}async writeBuffer($,Z){try{await this.writeTrackedBuffer($,Z).completed}catch(J){if(J instanceof P$||J instanceof e$)throw J.cause??J;throw J}}writeTrackedBuffer($,Z){if(this.closedErr)return{queued:!1,completed:Promise.reject(new P$("subc socket was closed before bytes could be queued",this.closedErr))};let J=!1,X=!1,Y=null,G=new Promise((z,Q)=>{let K=(V)=>{if(X)return;if(X=!0,Y)clearTimeout(Y);V()},W=Z-Date.now();if(W<=0){K(()=>Q(new P$("timed out before bytes could be queued to subc",new q$("timed out writing to subc"))));return}Y=setTimeout(()=>{let V=new q$("timed out writing to subc");K(()=>Q(J?new e$("timed out after bytes were handed to the subc socket",V):new P$("timed out before bytes could be queued to subc",V)))},W);try{this.sock.write($,(V)=>{K(()=>{if(V)Q(new e$("subc socket reported a write error after bytes were handed to the socket",V instanceof Error?V:Error(String(V))));else z()})}),J=!0}catch(V){K(()=>Q(new P$("subc socket write threw before bytes could be queued",V instanceof Error?V:Error(String(V)))))}});return{queued:J,completed:G}}close(){this.sock.destroy()}tryServe(){let $=this.waiter;if(!$)return;if(this.buffered>=$.need){let Z=this.take($.need);if(this.waiter=null,$.timer)clearTimeout($.timer);$.resolve(Z);return}if(this.closedErr){if(this.waiter=null,$.timer)clearTimeout($.timer);$.reject(this.closedErr)}}take($){let Z=Buffer.allocUnsafe($),J=0;while(J<$){let X=this.chunks[0],Y=$-J;if(X.length<=Y)X.copy(Z,J),J+=X.length,this.chunks.shift();else X.copy(Z,J,0,Y),this.chunks[0]=X.subarray(Y),J+=Y}return this.buffered-=$,Z}}var m2=32;var N1=4096,u2="subc-server-v1",p2="subc-client-v1",BW="client";class m6 extends Error{}function cZ($,Z,J,X,Y){let G=KW("sha256",Buffer.from($));return G.update(Buffer.from(Z,"utf8")),G.update(Buffer.from(J)),G.update(Buffer.from(X)),G.update(Buffer.from(Y)),new Uint8Array(G.digest())}function y2($,Z){if($.length!==Z.length)return!1;return VW(Buffer.from($),Buffer.from(Z))}async function h2($,Z,J){let X=Buffer.from(JSON.stringify(Z),"utf8");if(X.length>N1)throw new m6(`auth message too large: ${X.length} > ${N1}`);let Y=new Uint8Array(4);new DataView(Y.buffer).setUint32(0,X.length,!0),await j$($,Y,J),await j$($,X,J)}async function qW($,Z){let J=await $.readExact(4,Z),X=new DataView(J.buffer,J.byteOffset,4).getUint32(0,!0);if(X>N1)throw new m6(`auth message too large: ${X} > ${N1}`);let Y=X===0?new Uint8Array(0):await $.readExact(X,Z);try{return JSON.parse(Buffer.from(Y).toString("utf8"))}catch(G){throw new m6(`auth message JSON decode failed: ${String(G)}`)}}function pZ($,Z){if(!Array.isArray($))throw new m6(`auth field '${Z}' must be a byte array`);for(let J of $)if(typeof J!=="number"||!Number.isInteger(J)||J<0||J>255)throw new m6(`auth field '${Z}' has invalid byte ${String(J)}`);return Uint8Array.from($)}async function a8($,Z,J){let X=new Uint8Array(WW(m2));await h2($,{client_nonce:Array.from(X),role:BW},J);let Y=await qW($,J),G=pZ(Y.server_nonce,"server_nonce"),z=pZ(Y.daemon_id,"daemon_id"),Q=pZ(Y.server_proof,"server_proof"),K=cZ(Z.key,u2,X,G,z);if(!y2(K,Q))throw new m6("server proof mismatch — wrong key or impostor daemon");if(!y2(z,Z.daemonId))throw new m6("daemon id mismatch — connection file points at a different daemon");let W=cZ(Z.key,p2,X,G,z);await h2($,{client_auth:Array.from(W)},J)}import{promises as lZ}from"node:fs";var c2=1,l2=32,d2=16;class C6 extends Error{}function i2($,Z){if(!Array.isArray($))throw new C6(`connection file field '${Z}' must be a JSON array of bytes`);for(let J of $)if(typeof J!=="number"||!Number.isInteger(J)||J<0||J>255)throw new C6(`connection file field '${Z}' has invalid byte ${String(J)}`);return Uint8Array.from($)}function jW($){if($.schema!==c2)throw new C6(`unsupported connection file schema ${$.schema}; expected ${c2}`);if($.endpoints.length===0)throw new C6("connection file must include at least one endpoint");if($.key.length<l2)throw new C6(`connection file key is too short: ${$.key.length} bytes, need at least ${l2}`);if($.daemonId.length!==d2)throw new C6(`connection file daemon_id must be ${d2} bytes, got ${$.daemonId.length}`)}async function HW($){if(process.platform==="win32")return;let J=(await lZ.stat($)).mode&511;if((J&63)!==0)throw new C6(`connection file ${$} has insecure permissions 0o${J.toString(8)}; expected owner-only 0600`)}async function z8($){await HW($);let Z=await lZ.readFile($,"utf8"),J;try{J=JSON.parse(Z)}catch(Q){throw new C6(`connection file JSON read failed for ${$}: ${String(Q)}`)}let X=J.wire_version;if(X!==void 0&&X!==a6)throw new C6(`connection file wire_version ${String(X)} but this client speaks ${a6}; the client library must be upgraded`);let Y=J.endpoints;if(!Array.isArray(Y))throw new C6("connection file 'endpoints' must be an array");let G=Y.map((Q)=>{let K=Q;if(typeof K.host!=="string"||typeof K.port!=="number")throw new C6("connection file endpoint must be { host: string, port: number }");return{host:K.host,port:K.port}}),z={schema:J.schema,endpoints:G,key:i2(J.key,"key"),daemonId:i2(J.daemon_id,"daemon_id"),pid:J.pid,daemonVer:J.daemon_ver??""};return jW(z),z}var s2=new WeakMap,dZ=new WeakMap;class iZ extends Error{methodFamily;code="reverse_request_capability_not_declared";constructor($){super(`reverse-request capability ${JSON.stringify($)} was not registered before route.open`);this.methodFamily=$,this.name="ReverseRequestRegistrationError"}}class $0{handlers=new Map;declaredFamilies=null;onRequest($,Z){if(!LW($))throw TypeError(`reverse-request method family must be a capability identifier, got ${JSON.stringify($)}`);if(typeof Z!=="function")throw TypeError("reverse-request handler must be a function");if(this.declaredFamilies&&!this.declaredFamilies.has($))throw new iZ($);this.handlers.set($,Z)}capabilities(){return[...this.handlers.keys()].sort()}handler($){return this.handlers.get($)}seal(){this.declaredFamilies??=new Set(this.handlers.keys())}}class U1{channel;epoch;constructor($,Z,J,X){if(!Number.isInteger($)||$<=0||$>65535)throw RangeError(`route channel must be an integer in 1..65535, got ${$}`);if(!Number.isInteger(Z)||Z<=0||Z>4294967295)throw RangeError(`route epoch must be an integer in 1..4294967295, got ${Z}`);this.channel=$,this.epoch=Z,X.seal(),s2.set(this,J),dZ.set(this,X),Object.freeze(this)}onRequest($,Z){dZ.get(this).onRequest($,Z)}static create($,Z,J,X){return new U1($,Z,J,X)}}function x1($,Z,J,X=new $0){return U1.create($,Z,J,X)}function t2($,Z){return dZ.get($)?.handler(Z)}function LW($){return/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/.test($)}class h$ extends Error{handle;code="stale_route_handle";constructor($){super(`route handle (${$.channel}, ${$.epoch}) is not live on the current connection`);this.handle=$,this.name="StaleRouteHandleError"}}function Q8(){return Object.freeze({})}function n8($,Z){return s2.get($)===Z}function D1($,Z){return $===Z}var a2=NW("subc-client"),UW=1e4,K8=30000,xW=50,DW=2000,n2="request_deadline",sZ="deadline_exceeded_no_drop_observed",OW=30000,MW=30000,o2=new Uint8Array(0),IW="management_surface",_1="SUBC_MODULE_ID",P1="SUBC_LAUNCH_NONCE",A1={baseMs:100,capMs:2000,maxAttempts:6};class S6 extends Error{kind;code;cause;constructor($,Z,J,X){super(Z);this.kind=$,this.code=J,this.cause=X,this.name="SubcCallError"}get detail(){return this.cause instanceof Z6?this.cause.detail:void 0}}class Z6 extends Error{code;detail;constructor($,Z,J){super($);this.code=Z,this.detail=J}}var r2=new WeakMap;function tZ($){if($ instanceof Uint8Array)return $;let Z=$===null?"null":Array.isArray($)?"array":typeof $;throw new Z6(`binary request body must be a Uint8Array; got ${Z}`,"binary_body_required")}class F0{sock;currentConn;opts;nextCorr=1n;pending=new Map;lateResponses=new Map;routes=new Map;liveRoutes=new Map;connectionToken=Q8();ingressEpochDropCount=0;closedErr=null;closeStarted=!1;reconnecting=null;generation=1;readerActive=!1;constructor($,Z,J){this.sock=$,this.currentConn=Z,this.opts=J,this.readLoop($,this.generation)}get conn(){return this.currentConn}static async connect($){let Z=AW($),J=await F0.openConnection(Z);return new F0(J.sock,J.conn,Z)}async catalogList($){let Z=this.encode($===void 0?{op:"catalog.list"}:{op:"catalog.list",module_id:$}),J=await this.controlRpc(Z);return this.parseJson(J).modules??[]}async resolveProvider($){let Z=await this.resolveProviders($);if(Z.length===0)throw new Z6(`no catalog claimant for capability ${$}`,"capability_unprovided");if(Z.length>1)throw new Z6(`multiple catalog claimants for capability ${$}: ${Z.join(", ")}`,"capability_ambiguous");return Z[0]}async resolveProviders($){if(!JX($))throw new Z6(`malformed capability identifier ${JSON.stringify($)}`,"invalid_capability_identifier");return(await this.catalogList()).filter((J)=>J.capabilities?.provides.includes($)??!1).map((J)=>J.module_id).sort()}async routeOpen($,Z,J={}){let X=aZ(J),Y=J.reverseRequests??new $0;Y.seal();let G=Y.capabilities(),z=this.encode({op:"route.open",target:$,identity:Z,...X?{consumer_identity:X}:{},...G.length>0?{consumer_capabilities:G}:{}}),Q=null,K=(V)=>{if(V.header.ty!==i.Response)return!0;let B=this.parseJson(V);if(typeof B.route_channel!=="number"||typeof B.route_epoch!=="number")throw new Z6(`route.open returned no route handle: ${JSON.stringify(B)}`);return Q=this.installRoute(B.route_channel,B.route_epoch,Y),!0},W=(V)=>{if(V.header.ty!==i.Response)return;try{let B=this.parseJson(V);if(typeof B.route_channel!=="number"||typeof B.route_epoch!=="number")return;let q=this.installRoute(B.route_channel,B.route_epoch);this.failHandle(q,new Z6("late route.open was closed","route_closed")),this.liveRoutes.delete(q.channel),this.sendRouteGoodbye(q,!0)}catch{this.closeConnectionAfterCleanupFailure()}};if(await this.controlRpc(z,K,W),!Q)throw new Z6("route.open response was not installed");return Q}async request($,Z,J={}){this.assertLiveHandle($);let X=J.binary??!1,Y=X?tZ(Z):Z instanceof Uint8Array?Z:this.encode(Z),G=J.priority??w6.Interactive,z=J.admissionClass??f6.Normal,Q=await this.send($,Y,G,z,J.timeoutMs,J.onProgress,void 0,void 0,X,J.signal);return this.decodeReply(Q)}async call($,Z,J,X={}){if(X.binary)throw new Z6("call() builds a JSON body and cannot send a binary request; use callBinary(moduleId, body, opts) with a Uint8Array","binary_call_requires_call_binary");let Y=J===void 0?{method:Z}:{method:Z,params:J};return await this.managedCall($,Y,X)}async callBinary($,Z,J={}){let X=tZ(Z);return this.managedCall($,X,{...J,binary:!0})}async managedCall($,Z,J){let X=!1;for(;;){let Y=await this.cachedRouteHandle($,J);try{return await this.managedRequest(Y,Z,J)}catch(G){if(!(G instanceof S6))throw this.terminalCallError("managed call failed",G);let z=w1(G.cause instanceof Z6?r2.get(G.cause)??0:0,G.code);if(z&&!X&&!this.closeStarted){X=!0,this.evictRouteHandle(Y);continue}if(z&&X)this.evictRouteHandle(Y);if(G.code==="route_closed")throw this.evictRouteHandle(Y),G;if(G.kind==="not_sent"){if(!this.closedErr)throw G;try{await this.reconnectAfterDrop(G)}catch(Q){throw this.notSentRecoveryError("managed call was not sent",Q)}continue}if(G.kind==="outcome_unknown"&&G.code!==sZ){if(this.closedErr)this.scheduleReconnectAfterDrop(G)}else if(G.kind==="outcome_unknown"&&G.code===sZ)this.probeLivenessAfterDeadline();throw G}}}subscribe($,Z,J,X={}){this.assertLiveHandle($);let Y=Z instanceof Uint8Array?Z:this.encode(Z),G=X.priority??w6.Interactive,z=X.admissionClass??f6.Normal,Q=this.allocateCorr(),K=O1($,Q),W=null,V=null,B=new Promise((j,x)=>{if(this.closedErr){x(this.closedErr);return}V=j,W={handle:$,resolve:()=>j(),reject:x,onProgress:J,timer:null,subscription:!0},this.pending.set(K,W);let N=E6(i.Request,h6(!1,G,!1,z),$.channel,$.epoch,Q,Y);j$(this.sock,B$(N),Date.now()+K8).catch((U)=>{let D=this.pending.get(K);if(D)this.rejectPending(K,D,U instanceof Error?U:new Z6(String(U)))})}),q=!1;return{unsubscribe:()=>{if(q)return;if(q=!0,W&&V)this.settle(K,W,V);if(this.isLiveHandle($))this.cancel($,Q,G)},closed:B}}attachCancelSignal($,Z,J,X,Y){if(!J)return;let G=()=>{if(!this.pending.has(Z))return;try{this.cancel(J,X,Y)}catch{}};if($.aborted){G();return}$.addEventListener("abort",G,{once:!0});let z=this.pending.get(Z);if(z){let Q=z.onSettle;z.onSettle=()=>{Q?.(),$.removeEventListener("abort",G)}}}cancel($,Z,J=w6.Interactive){this.assertLiveHandle($);let X=E6(i.Cancel,h6(!1,J,!1),$.channel,$.epoch,Z,o2);j$(this.sock,B$(X),Date.now()+K8).catch(()=>{return})}async routePoll($,Z){this.assertLiveHandle($);let J=this.encode({op:"route.poll",route_channel:$.channel,route_epoch:$.epoch,kind:Z}),X=await this.controlRpc(J,(Y)=>{if(Y.header.ty!==i.Response)return!0;let G=this.parseJson(Y);return G.route_channel===$.channel&&G.route_epoch===$.epoch});return this.parseJson(X)}async closeRoute($,Z={}){this.assertLiveHandle($);for(let[J,X]of this.routes)if(X.handle&&D1(X.handle,$))X.closed=!0,X.handle=null,this.routes.delete(J);if(Z.drain)await this.drainUnaryOnHandle($);if(this.failHandle($,new Z6("route closed by closeRoute","route_closed")),this.liveRoutes.get($.channel)===$)this.liveRoutes.delete($.channel);this.sendRouteGoodbye($)}async closeManagedRoute($,Z,J={}){let X=e2($,Z,aZ(J),(J.reverseRequests??new $0).capabilities()),Y=this.routes.get(X);if(!Y)return;Y.closed=!0,this.routes.delete(X);let G=Y.handle;if(Y.handle=null,G)await this.closeRoute(G,J)}async closeRouteChannel($,Z={}){await this.closeRoute($,Z)}close(){this.closeStarted=!0,this.fail(new Z6("client closed")),this.sock.close()}drainUnaryOnHandle($){let Z=[];for(let J of this.pending.values())if(J.handle===$&&!J.subscription)Z.push(new Promise((X)=>{let Y=J.onSettle;J.onSettle=()=>{Y?.(),X()}}));return Promise.all(Z).then(()=>{return})}sendRouteGoodbye($,Z=!1){if(this.assertLiveConnection($),this.closedErr){if(Z)this.closeConnectionAfterCleanupFailure();return}let J=E6(i.Goodbye,h6(!1,w6.Interactive,!1),$.channel,$.epoch,0n,o2),X=uZ(this.sock,B$(J),Date.now()+K8);if(!X.queued&&Z)this.closeConnectionAfterCleanupFailure();X.completed.catch(()=>{if(Z&&!X.queued)this.closeConnectionAfterCleanupFailure()})}static async openConnection($){let Z=await z8($.connectionFile),J=Date.now()+($.handshakeTimeoutMs??UW),X=Z.endpoints[0],Y=await T0.connect(X.host,X.port,J);try{await a8(Y,Z,J)}catch(G){throw Y.close(),G}return{sock:Y,conn:Z}}async controlRpc($,Z,J){return this.send(null,$,w6.Interactive,f6.Normal,void 0,void 0,Z,J)}send($,Z,J,X,Y,G,z,Q,K=!1,W){if($)this.assertLiveHandle($);if(this.closedErr)return Promise.reject(this.closedErr);let V;try{V=this.allocateCorr()}catch(x){return Promise.reject(x)}let B=O1($,V),q=$?.channel??0,H=$?.epoch??0,j=E6(i.Request,h6(K,J,!1,X),q,H,V,Z);return new Promise((x,N)=>{let U=Y??K8,D={handle:$,resolve:x,reject:N,onProgress:G,timer:null,acceptFrame:z,onLateResponse:Q};if(D.timer=setTimeout(()=>this.arbitrateTimeout(B,D,q,V,U),U),this.pending.set(B,D),W)this.attachCancelSignal(W,B,$,V,J);j$(this.sock,B$(j),Date.now()+U).catch((A)=>{let I=this.pending.get(B);if(I)this.rejectPending(B,I,A instanceof Error?A:new Z6(String(A)))})})}arbitrateTimeout($,Z,J,X,Y){let G=()=>{if(Z.onLateResponse)this.lateResponses.set($,Z.onLateResponse);this.rejectPending($,Z,new Z6(this.timeoutMessage(J,X,Y),n2))},z=Date.now()+this.opts.timeoutArbitrationGraceMs,Q=()=>{if(this.pending.get($)!==Z)return;if((this.readerActive||this.sock.bufferedBytes()>0)&&Date.now()<z){setImmediate(Q);return}G()};setImmediate(Q)}async managedRequest($,Z,J){let X=J.binary??!1,Y=X?tZ(Z):Z instanceof Uint8Array?Z:this.encode(Z),G=J.priority??w6.Interactive,z=J.admissionClass??f6.Normal;try{let Q=await this.sendManaged($,Y,G,z,J.timeoutMs,J.onProgress,X,J.signal);return this.decodeReply(Q)}catch(Q){if(Q instanceof S6)throw Q;throw this.terminalCallError("managed call failed",Q)}}sendManaged($,Z,J,X,Y,G,z=!1,Q){try{this.assertLiveHandle($)}catch(H){return Promise.reject(this.notSentCallError("request used a stale route handle",H))}if(this.closedErr)return Promise.reject(this.notSentCallError("request was not sent because the subc connection was already closed",this.closedErr));let K;try{K=this.allocateCorr()}catch(H){return Promise.reject(this.notSentCallError("request correlation allocator was exhausted",H))}let W=O1($,K),V=E6(i.Request,h6(z,J,!1,X),$.channel,$.epoch,K,Z),B=!1,q=(H)=>{if(!B)return this.notSentCallError("request bytes were not queued to the subc socket",H);if(H instanceof Z6&&H.code===n2)return new S6("outcome_unknown",`managed call deadline exceeded after request bytes were queued to the local socket; no terminal response was observed; outcome unknown${o8(H)}`,sZ,H);return this.outcomeUnknownCallError("connection dropped before the managed call returned a response",H)};return new Promise((H,j)=>{let x=Y??K8,N={handle:$,resolve:H,reject:j,onProgress:G,timer:null,classifyFailure:q};if(N.timer=setTimeout(()=>this.arbitrateTimeout(W,N,$.channel,K,x),x),this.pending.set(W,N),Q)this.attachCancelSignal(Q,W,$,K,J);let U=uZ(this.sock,B$(V),Date.now()+x);B=U.queued,U.completed.catch((D)=>{let A=this.pending.get(W);if(A)this.rejectPending(W,A,D instanceof Error?D:new Z6(String(D)))})})}async cachedRouteHandle($,Z){let J=Z.identity??this.opts.identity;if(!J)throw new S6("terminal","managed call requires a BindIdentity in SubcClient.connect({ identity }) or call(..., { identity })","missing_identity");let X={kind:Z.targetKind??this.opts.targetKind,module_id:$},Y=aZ(Z),G=Z.reverseRequests??new $0;G.seal();let z=e2(X,J,Y,G.capabilities()),Q=this.routes.get(z);if(!Q)Q={key:z,moduleId:$,target:X,identity:J,consumerIdentity:Y,reverseRequests:G,handle:null,opening:null},this.routes.set(z,Q);if(Q.handle&&this.isLiveHandle(Q.handle))return Q.handle;if(!Q.opening)Q.opening=this.openCachedRoute(Q).finally(()=>{Q.opening=null});return Q.opening}async openCachedRoute($){let Z=Date.now()+this.opts.routeOpenRetryDeadlineMs,J=this.opts.reconnectBackoff.baseMs,X=0;for(;;){if($.closed)throw this.routeClosedDuringOpen();try{await this.ensureConnectedForManaged()}catch(Y){throw this.notSentRecoveryError("route.open could not run because reconnect failed",Y)}if($.handle&&this.isLiveHandle($.handle))return $.handle;try{let Y=await this.routeOpen($.target,$.identity,{consumerIdentity:$.consumerIdentity??null,reverseRequests:$.reverseRequests});if($.closed)throw this.liveRoutes.delete(Y.channel),this.sendRouteGoodbye(Y),this.routeClosedDuringOpen();return $.handle=Y,Y}catch(Y){if(Y instanceof S6&&Y.code==="route_closed")throw Y;if(!this.closeStarted&&M1(Y)){try{await this.reconnectAfterDrop(Y)}catch(G){throw this.notSentRecoveryError("route.open was not sent and reconnect failed",G)}continue}if(!this.closeStarted&&Y instanceof Z6&&PW(Y.code)){if(X+=1,Date.now()<Z){await this.opts.sleep(J),J=Math.min(J*2,this.opts.reconnectBackoff.capMs);continue}throw this.notSentCallError(`route.open failed for module ${$.moduleId}: ${Y.code} (retry deadline exhausted after ${X} attempts)`,Y)}throw this.terminalCallError(`route.open failed for module ${$.moduleId}`,Y)}}}lastInboundAtMs=0;livenessProbe=null;hasControlPending(){for(let $ of this.pending.values())if($.handle===null)return!0;return!1}probeLivenessAfterDeadline(){if(this.livenessProbe||this.closeStarted||this.closedErr)return;if(this.hasControlPending())return;let $=this.sock,Z=this.generation,J;try{J=this.allocateCorr()}catch{return}let X=Date.now(),Y=E6(i.Ping,h6(!1,w6.Interactive,!1,f6.Normal),0,0,J,new Uint8Array),G=(async()=>{if(await j$($,B$(Y),X+this.opts.livenessProbeWindowMs).catch(()=>{}),await this.opts.sleep(this.opts.livenessProbeWindowMs),this.sock!==$||this.generation!==Z||this.closeStarted)return;if(this.lastInboundAtMs>=X)return;if(this.hasControlPending())return;this.fail(new y$(`liveness probe convicted a half-open socket: no inbound frame for ${this.opts.livenessProbeWindowMs}ms after a channel-0 Ping (deadline-no-drop settles preceded this); closing so the next call reconnects`)),$.close()})().finally(()=>{this.livenessProbe=null});this.livenessProbe=G}async ensureConnectedForManaged(){if(this.closeStarted)throw new Z6("client closed");if(this.reconnecting)await this.reconnecting;if(this.closedErr)await this.reconnectAfterDrop(this.closedErr)}scheduleReconnectAfterDrop($){if(this.closeStarted||this.reconnecting)return;this.reconnectAfterDrop($).catch(()=>{})}reconnectAfterDrop($){if(this.closeStarted)return Promise.reject(new Z6("client closed"));if(this.reconnecting)return this.reconnecting;let Z=this.reconnectWithRetry($).finally(()=>{if(this.reconnecting===Z)this.reconnecting=null});return this.reconnecting=Z,Z}async reconnectWithRetry($){let Z=0,J=this.opts.reconnectBackoff.baseMs;for(;;){if(this.closeStarted)throw new Z6("client closed");Z+=1;try{let X=await F0.openConnection(this.opts);if(this.closeStarted)throw X.sock.close(),new Z6("client closed");this.replaceConnection(X),await this.reopenCachedRoutes();return}catch(X){if(!M1(X)||Z>=this.opts.reconnectBackoff.maxAttempts){if(X instanceof m6&&Z>1)throw new m6(`reconnect gave up after ${Z} attempts: ${X.message} — the connection file and the daemon's key disagree persistently `+"(daemon restarting in a loop, split connection-file paths, or a genuinely foreign daemon on this port); check the daemon, then restart this host app");throw X}await this.opts.sleep(J),J=Math.min(J*2,this.opts.reconnectBackoff.capMs)}}}replaceConnection($){this.fail(new Z6("subc connection replaced")),this.sock.close(),this.sock=$.sock,this.currentConn=$.conn,this.closedErr=null,this.generation+=1,this.connectionToken=Q8(),this.liveRoutes.clear(),this.lateResponses.clear(),this.nextCorr=1n,this.readLoop($.sock,this.generation)}async reopenCachedRoutes(){let $=[...this.routes.keys()];for(let Z of $){let J=this.routes.get(Z);if(J)J.handle=null}for(let Z of $){let J=this.routes.get(Z);if(!J||J.closed)continue;try{let X=await this.routeOpen(J.target,J.identity,{consumerIdentity:J.consumerIdentity??null,reverseRequests:J.reverseRequests});if(J.closed){this.liveRoutes.delete(X.channel),this.sendRouteGoodbye(X);continue}J.handle=X}catch(X){if(_W(X)){this.routes.delete(Z);continue}throw X}}}timeoutMessage($,Z,J){let X=this.sock.localPort();return`request on ${X===null?"channel":`local_port=${X} channel`} ${$} corr ${Z} timed out after ${J}ms`}routeClosedDuringOpen(){return new S6("not_sent","route was closed before route.open completed","route_closed")}async readLoop($,Z){try{for(;;){this.readerActive=!1;let J=await $.readFrame(Number.POSITIVE_INFINITY,{afterHeaderMs:MW},()=>{this.readerActive=!0});try{if(this.sock===$&&this.generation===Z)this.dispatch(J)}finally{this.readerActive=!1}}}catch(J){if(this.sock===$&&this.generation===Z)this.fail(J instanceof Error?J:new Z6(String(J)))}}dispatch($){if(this.lastInboundAtMs=Date.now(),$.header.channel===0&&$.header.ty===i.Push){let G=this.opts.onControlPush;if(G){let z=null;try{let Q=this.parseJson($);if(Q&&typeof Q.op==="string")z={op:Q.op,body:Q}}catch{}if(z)try{G(z)}catch{}}return}let Z=null;if($.header.channel!==0){if(Z=this.liveRoutes.get($.header.channel)??null,!Z||Z.epoch!==$.header.epoch){this.ingressEpochDropCount+=1;return}}if($.header.ty===i.Request&&Z){this.dispatchReverseRequest($,Z);return}let J=O1(Z,$.header.corr),X=this.pending.get(J);if(X){if(X.acceptFrame&&!X.acceptFrame($))return;switch($.header.ty){case i.Push:case i.StreamData:try{X.onProgress?.($.body)}catch{}return;case i.Response:case i.StreamEnd:this.settle(J,X,()=>X.resolve($));return;case i.Error:this.settle(J,X,()=>X.reject(this.errorFromFrame($)));return;default:return}}let Y=this.lateResponses.get(J);if(Y&&($.header.ty===i.Response||$.header.ty===i.Error)){this.lateResponses.delete(J),Y($);return}if($.header.ty===i.Goodbye&&Z){if(this.failHandle(Z,new Z6("route closed by subc (GOODBYE)","route_closed")),this.liveRoutes.get(Z.channel)===Z)this.liveRoutes.delete(Z.channel);this.evictRouteHandle(Z);return}if($.header.ty===i.Response||$.header.ty===i.Error||$.header.ty===i.StreamEnd)a2("dropped terminal frame with no waiter: type=%d channel=%d epoch=%d corr=%s port=%s",$.header.ty,$.header.channel,$.header.epoch,$.header.corr,this.sock.localPort()??"?")}settle($,Z,J){if(this.pending.get($)!==Z)return!1;if(this.pending.delete($),Z.timer)clearTimeout(Z.timer);return J(),Z.onSettle?.(),!0}rejectPending($,Z,J){this.settle($,Z,()=>Z.reject(Z.classifyFailure?.(J)??J))}dispatchReverseRequest($,Z){let J=wW($.body),X=J?.split("/",1)[0],Y=X?t2(Z,X):void 0,G=this.sock,z=this.generation;(async()=>{if(!Y||!J){await this.sendReverseError($,Z,"reverse_request_unhandled",X?`no reverse-request handler is registered for ${X}`:"reverse request has no valid method",G,z);return}let K;try{if(K=await Y($.body,{corr:$.header.corr,method:J}),!(K instanceof Uint8Array))throw TypeError("reverse-request handler must return a Uint8Array")}catch(W){await this.sendReverseError($,Z,"reverse_request_unhandled",W instanceof Error?W.message:String(W),G,z);return}await this.sendReverseReply($,Z,i.Response,K,G,z)})().catch((K)=>{if(this.sock===G&&this.generation===z&&!this.closeStarted)a2("failed to answer reverse request: %s",o8(K))})}async sendReverseError($,Z,J,X,Y,G){await this.sendReverseReply($,Z,i.Error,this.encode({code:J,message:X}),Y,G)}async sendReverseReply($,Z,J,X,Y,G){if(this.sock!==Y||this.generation!==G||!this.isLiveHandle(Z)||this.closeStarted||this.closedErr)return;let z=E6(J,h6(!1,w6.Interactive,!1),Z.channel,Z.epoch,$.header.corr,X);await j$(Y,B$(z),Date.now()+K8)}errorFromFrame($){try{let Z=JSON.parse(Buffer.from($.body).toString("utf8")),J=new Z6(Z.message??"subc error",Z.code,Z.detail);return r2.set(J,$.header.flags),J}catch{return new Z6(Buffer.from($.body).toString("utf8")||"subc error")}}evictRouteHandle($){for(let Z of this.routes.values())if(Z.handle&&D1(Z.handle,$))Z.handle=null}failHandle($,Z){for(let[J,X]of this.pending)if(X.handle&&D1(X.handle,$))this.rejectPending(J,X,Z)}fail($){if(!this.closedErr)this.closedErr=$;for(let[Z,J]of this.pending)this.rejectPending(Z,J,$)}notSentCallError($,Z){return new S6("not_sent",`${$}${o8(Z)}`,I1(Z),Z)}outcomeUnknownCallError($,Z){return new S6("outcome_unknown",`${$}${o8(Z)}`,I1(Z),Z)}terminalCallError($,Z){if(Z instanceof S6)return Z;return new S6("terminal",`${$}${o8(Z)}`,I1(Z),Z)}notSentRecoveryError($,Z){if(Z instanceof S6)return Z;if(M1(Z))return this.notSentCallError($,Z);return this.terminalCallError($,Z)}get droppedIngressFrames(){return this.ingressEpochDropCount}installRoute($,Z,J=new $0){let X=x1($,Z,this.connectionToken,J);return this.liveRoutes.set($,X),X}isLiveHandle($){return n8($,this.connectionToken)&&this.liveRoutes.get($.channel)===$}assertLiveConnection($){if(!n8($,this.connectionToken))throw new h$($)}assertLiveHandle($){if(!this.isLiveHandle($))throw new h$($)}allocateCorr(){let $=0xffffffffffffffffn;if(this.nextCorr>$){let J=new Z6("channel-0 correlation id allocator exhausted","corr_exhausted");throw this.fail(J),this.sock.close(),this.scheduleReconnectAfterDrop(J),J}let Z=this.nextCorr;return this.nextCorr+=1n,Z}closeConnectionAfterCleanupFailure(){let $=new Z6("late route cleanup could not be queued","late_route_cleanup_failed");this.fail($),this.sock.close(),this.scheduleReconnectAfterDrop($)}encode($){return Buffer.from(JSON.stringify($),"utf8")}decodeReply($){return hZ($.header.flags)?$.body:this.parseJson($)}parseJson($){let Z=$.body;return JSON.parse(Buffer.from(Z.buffer,Z.byteOffset,Z.byteLength).toString("utf8"))}}function M1($){if($ instanceof y$||$ instanceof q$)return!0;if($ instanceof P$||$ instanceof e$)return!0;if($ instanceof S6)return $.kind==="not_sent"||$.kind==="outcome_unknown";if($ instanceof m6)return!0;if($ instanceof Z6||$ instanceof C6)return!1;let Z=I1($);return Z==="ECONNREFUSED"||Z==="ECONNRESET"||Z==="EPIPE"||Z==="ETIMEDOUT"||Z==="ENOENT"}function _W($){return $ instanceof Z6&&typeof $.code==="string"}function PW($){if($==="capability_forbidden")return!1;return $==="module_reloading"||$==="module_warming"||$==="target_unavailable"||$==="module_timeout"}var $X="unknown_channel",ZX="stale_route_epoch";function w1($,Z){return Z===$X||Z===ZX}function AW($){return{connectionFile:$.connectionFile,handshakeTimeoutMs:$.handshakeTimeoutMs,identity:$.identity,targetKind:$.targetKind??IW,reconnectBackoff:$.reconnectBackoff??A1,sleep:$.sleep??((Z)=>new Promise((J)=>setTimeout(J,Z))),routeOpenRetryDeadlineMs:$.routeOpenRetryDeadlineMs??OW,timeoutArbitrationGraceMs:$.timeoutArbitrationGraceMs??xW,livenessProbeWindowMs:$.livenessProbeWindowMs??DW,onControlPush:$.onControlPush}}function JX($){if(/\s/u.test($))return!1;let Z=$.indexOf("/v");if(Z<=0||$.indexOf("/v",Z+1)!==-1)return!1;let J=$.slice(0,Z),X=$.slice(Z+2);if(new TextEncoder().encode(J).byteLength>64||X.length===0)return!1;if(!/^[a-z][a-z0-9-]*[a-z0-9]$/u.test(J)&&!/^[a-z]$/u.test(J))return!1;if(J.includes("--"))return!1;if(!/^\d+$/u.test(X)||X.length>1&&X.startsWith("0"))return!1;let Y=Number(X);return Number.isSafeInteger(Y)&&Y>=1&&Y<=4294967295}function e2($,Z,J,X){let Y=J?`${J.module_id}\x00${J.launch_nonce}`:"",G=[...X].sort().join("\x00");return`${$.kind}\x00${$.module_id}\x00${Z.project_root}\x00${Z.harness}\x00${Z.session}\x00${Y}\x00${G}`}function aZ($={}){if($.consumerIdentity!==void 0)return $.consumerIdentity??void 0;let Z=process.env[_1],J=process.env[P1];if(!Z||!J)return;return{module_id:Z,launch_nonce:J}}function I1($){if(typeof $==="object"&&$!==null&&"code"in $){let Z=$.code;if(typeof Z==="string")return Z}return}function o8($){if($===void 0)return"";return`: ${$ instanceof Error?$.message:String($)}`}function O1($,Z){return $?`${$.channel}:${$.epoch}:${Z}`:`0:0:${Z}`}function wW($){try{let Z=JSON.parse(Buffer.from($).toString("utf8"));return typeof Z.method==="string"&&Z.method.length>0?Z.method:void 0}catch{return}}import{Buffer as Z7}from"node:buffer";var RW=1e4,TW=30000,YX=30000,FW=250,nZ=64,eZ="health.check",GX=1n,CW=/^[0-9a-f]{32}$/;function $7($){let Z=$.machine_id;return typeof Z==="string"&&CW.test(Z)?Z:void 0}class T1{available;waiters=[];constructor($){if(!Number.isInteger($)||$<=0)throw new W6("provider handler capacity must be a positive integer","invalid_handler_capacity");this.available=$}async acquire(){if(this.available>0)return this.available-=1,this.releaseOnce();return await new Promise(($)=>{this.waiters.push($)}),this.releaseOnce()}releaseOnce(){let $=!1;return()=>{if($)return;$=!0;let Z=this.waiters.shift();if(Z)Z();else this.available+=1}}}class W6 extends Error{code;kind;detail;constructor($,Z,J="terminal",X){super($);this.code=Z,this.kind=J,this.detail=X}}class r8{sock;currentConn;opts;closed;resolveClosed=()=>{return};closeStarted=!1;closedErr=null;inflight=new Map;pending=new Map;liveRoutes=new Map;connectionToken=Q8();nextCorr=1n;ingressEpochDropCount=0;requestGate=new T1(nZ);reconnecting=null;generation=1;connectionEpoch=1;stateQueue=[];drainingStateQueue=!1;restoredDebounceToken=0;storage;machineId;constructor($,Z,J,X){this.sock=$,this.currentConn=Z,this.opts=J,this.storage=X.storage,this.machineId=$7(X),this.closed=new Promise((Y)=>{this.resolveClosed=Y}),this.readLoop($,this.generation),this.enqueueConnectionState({state:"connected",epoch:this.connectionEpoch})}get droppedIngressFrames(){return this.ingressEpochDropCount}get conn(){return this.currentConn}currentEpoch(){return this.connectionEpoch}async request($,Z,J={}){this.assertLiveHandle($);let X=this.allocateCorr(),Y=R1($,X),G=J.timeoutMs??YX,z=E6(i.Request,h6(!1,J.priority??w6.Interactive,!1,J.admissionClass??f6.Normal),$.channel,$.epoch,X,Z);return await new Promise((Q,K)=>{let W=setTimeout(()=>{if(this.pending.delete(Y))K(new W6("reverse request timed out","request_timeout"))},G);this.pending.set(Y,{resolve:(V)=>Q(V.body),reject:K,timer:W}),this.sendOn(this.sock,this.generation,z).catch((V)=>{let B=this.pending.get(Y);if(!B)return;this.pending.delete(Y),clearTimeout(B.timer),K(V instanceof Error?V:new W6(String(V)))})})}async push($,Z,J={}){this.assertLiveHandle($),await this.sendOn(this.sock,this.generation,E6(i.Push,h6(!1,J.priority??w6.Interactive,!1,J.admissionClass??f6.Normal),$.channel,$.epoch,0n,Z))}cancel($,Z){this.assertLiveHandle($),this.sendOn(this.sock,this.generation,E6(i.Cancel,A$(),$.channel,$.epoch,Z,new Uint8Array(0))).catch(()=>{return})}closeRoute($){this.assertLiveHandle($),this.liveRoutes.delete($.channel),this.abortHandle($),this.sendOn(this.sock,this.generation,E6(i.Goodbye,A$(),$.channel,$.epoch,0n,new Uint8Array(0))).catch(()=>{return})}static async connect($){if($.manifest.protocol_ver!==a6)throw new W6(`manifest protocol_ver ${$.manifest.protocol_ver} does not match client protocol ${a6}`,"invalid_manifest");let Z=kW($),J=await r8.openConnection(Z);return new r8(J.sock,J.conn,Z,J.ack)}async close(){if(!this.closeStarted){this.closeStarted=!0,this.cancelRestoredDebounce();let $=this.sock;try{await rZ($,E6(i.Goodbye,A$(),0,0,0n,new Uint8Array(0)))}catch{}finally{$.close(),this.finishClosed()}}await this.closed}static async openConnection($,Z){let J=await z8($.connectionFile),X=Date.now()+($.handshakeTimeoutMs??RW),Y=J.endpoints[0],G=await T0.connect(Y.host,Y.port,X);try{Z?.(G),await a8(G,J,X),await rZ(G,fW($));let z=await yW(G,X);return{sock:G,conn:J,ack:z}}catch(z){throw G.close(),z}}async readLoop($,Z){try{for(;;){let J=await $.readFrame(Number.POSITIVE_INFINITY,{afterHeaderMs:TW});if(!await this.dispatch(J,$,Z)){if(this.sock===$&&this.generation===Z)this.closeStarted=!0;break}}}catch(J){if(this.sock===$&&this.generation===Z&&!this.closeStarted){this.handleUnexpectedDrop($,Z,J instanceof Error?J:new W6(String(J)));return}}finally{if(this.sock===$&&this.generation===Z){if($.close(),this.closeStarted)this.finishClosed()}}}async dispatch($,Z,J){let X=null;if($.header.channel!==0){if(X=this.liveRoutes.get($.header.channel)??null,!X||X.epoch!==$.header.epoch)return this.ingressEpochDropCount+=1,!0}if(X){let Y=R1(X,$.header.corr),G=this.pending.get(Y);if(G){if($.header.ty===i.Push||$.header.ty===i.StreamData)return!0;if($.header.ty===i.Response||$.header.ty===i.StreamEnd)return this.pending.delete(Y),clearTimeout(G.timer),G.resolve($),!0;if($.header.ty===i.Error)return this.pending.delete(Y),clearTimeout(G.timer),G.reject(SW($)),!0}}switch($.header.ty){case i.Ping:if($.header.channel===0)await this.sendOn(Z,J,_$($.header.ver,i.Pong,$.header.flags,0,0,$.header.corr,new Uint8Array(0)));return!0;case i.Goodbye:if(!X)return!1;return this.liveRoutes.delete(X.channel),this.abortHandle(X),await this.reportRouteGone(X),!0;case i.Cancel:if(X)this.inflight.get(R1(X,$.header.corr))?.abort();return!0;case i.Request:if($.header.channel===0)await this.handleControlRequest($,Z,J);else if(X)this.handleDataRequest($,X,Z,J).catch((Y)=>{if(!this.closeStarted&&this.sock===Z&&this.generation===J)console.warn("SubcProvider handler failed after its request was dispatched",Y)});return!0;default:return!0}}async reportRouteBound($){if(!this.opts.onBound)return;try{await this.opts.onBound($)}catch(Z){console.warn("SubcProvider bound callback failed",Z)}}async reportRouteGone($){if(!this.opts.onRouteGone)return;try{await this.opts.onRouteGone($)}catch(Z){console.warn("SubcProvider route-gone callback failed",Z)}}abortHandle($){let Z=`${$.channel}:${$.epoch}:`;for(let[J,X]of this.inflight)if(J.startsWith(Z))X.abort();for(let[J,X]of this.pending){if(!J.startsWith(Z))continue;this.pending.delete(J),clearTimeout(X.timer),X.reject(new h$($))}}abortGeneration($){this.abortAllInflight();for(let[Z,J]of this.pending)this.pending.delete(Z),clearTimeout(J.timer),J.reject(new W6("provider connection dropped","connection_dropped"));this.liveRoutes.clear()}abortAllInflight(){for(let $ of this.inflight.values())$.abort()}async handleControlRequest($,Z,J){let X=C1($.body);if(X.op===eZ){this.handleHealthRequest($,Z,J).catch((B)=>{if(!this.closeStarted&&this.sock===Z&&this.generation===J)console.warn("SubcProvider health handler failed after its request was dispatched",B)});return}if(X.op!=="route.bind")throw new W6(`unsupported module control request ${X.op??"<missing op>"}`);let Y=XX(X.route_channel,"route_channel"),G=XX(X.epoch,"epoch"),z=this.liveRoutes.get(Y);if(z){if(G<=z.epoch){await this.sendError($,"route_rejected",`route.bind epoch ${G} does not supersede installed epoch ${z.epoch} on channel ${Y}`,A$(),Z,J);return}this.liveRoutes.delete(z.channel),this.abortHandle(z),await this.reportRouteGone(z)}let Q=x1(Y,G,this.connectionToken),K={handle:Q,target:X.target,identity:X.identity,principal:X.principal,consumer_capabilities:X.consumer_capabilities},W;try{W=await this.opts.onBind?.(K)}catch(B){try{await this.sendError($,"route_rejected",B instanceof Error?B.message:String(B),A$(),Z,J)}finally{await this.reportRouteGone(Q)}return}let V=hW(W);if(V){try{await this.sendError($,V.code,V.message,A$(),Z,J)}finally{await this.reportRouteGone(Q)}return}try{await this.sendOn(Z,J,_$($.header.ver,i.Response,A$(),0,0,$.header.corr,F1({op:"route.bind"})))}catch(B){throw await this.reportRouteGone(Q),B}if(this.sock!==Z||this.generation!==J||this.closeStarted||this.closedErr){await this.reportRouteGone(Q);return}this.liveRoutes.set(Q.channel,Q),await this.reportRouteBound(Q)}async handleDataRequest($,Z,J,X){let{corr:Y,ver:G}=$.header,z=R1(Z,Y),Q=new AbortController;this.inflight.set(z,Q);let K={handle:Z,signal:Q.signal,currentEpoch:()=>this.connectionEpoch,emit:async(B,q={})=>{if(this.assertLiveHandle(Z),Q.signal.aborted)return;await this.sendOn(J,X,_$(G,i.StreamData,h6(!1,q.priority??w6.Interactive,!1,q.admissionClass??f6.Normal),Z.channel,Z.epoch,Y,B))}},W=await(this.requestGate??new T1(nZ)).acquire(),V=h6(!1,w6.Interactive,!1);try{if(Q.signal.aborted){await this.sendError($,"cancelled","request cancelled",V,J,X);return}let B=await this.opts.handler(Z,$.body,K);if(Q.signal.aborted){await this.sendError($,"cancelled","request cancelled",V,J,X);return}if(this.assertLiveHandle(Z),B===void 0)await this.sendOn(J,X,_$(G,i.StreamEnd,V,Z.channel,Z.epoch,Y,new Uint8Array(0)));else if(B instanceof Uint8Array)await this.sendOn(J,X,_$(G,i.Response,V,Z.channel,Z.epoch,Y,B));else throw new W6("provider handler must return a Uint8Array or void","invalid_handler_response")}catch(B){if(B instanceof h$)return;if(Q.signal.aborted){await this.sendError($,"cancelled","request cancelled",V,J,X);return}await this.sendError($,B instanceof W6&&B.code?B.code:"handler_error",B instanceof Error?B.message:String(B),V,J,X)}finally{if(W(),this.inflight.get(z)===Q)this.inflight.delete(z)}}async handleHealthRequest($,Z,J){let{corr:X,ver:Y}=$.header,G=`control:${J}:${X}`,z=new AbortController;this.inflight.set(G,z);let Q=await(this.requestGate??new T1(nZ)).acquire();try{if(z.signal.aborted)return;let K=await this.opts.health();await this.sendOn(Z,J,_$(Y,i.Response,A$(),0,0,X,F1({op:eZ,status:K.status,...K.detail===void 0?{}:{detail:K.detail},...K.metrics===void 0?{}:{metrics:K.metrics}})))}catch(K){await this.sendError($,K instanceof W6&&K.code?K.code:"health_error",K instanceof Error?K.message:String(K),A$(),Z,J)}finally{if(Q(),this.inflight.get(G)===z)this.inflight.delete(G)}}async sendError($,Z,J,X,Y,G){if($.header.channel!==0){let z=this.liveRoutes.get($.header.channel);if(!z||z.epoch!==$.header.epoch||!this.isLiveHandle(z))return}await this.sendOn(Y,G,_$($.header.ver,i.Error,X,$.header.channel,$.header.epoch,$.header.corr,F1({code:Z,message:J})))}async sendOn($,Z,J){if(this.sock!==$||this.generation!==Z||this.closeStarted||this.closedErr)return;await rZ($,J)}handleUnexpectedDrop($,Z,J){if(this.closeStarted||this.sock!==$||this.generation!==Z)return;if(!this.opts.reconnectOnDrop){this.failFatal(J);return}this.cancelRestoredDebounce(),this.abortGeneration(Z),this.generation+=1,$.close(),this.scheduleReconnectAfterDrop(J,this.generation,$)}scheduleReconnectAfterDrop($,Z,J){if(this.closeStarted)return;let X=this.reconnecting;if(X){if(!this.shouldSupersedeReconnect(X,Z,J))return;X.superseded=!0,X.socket?.close()}let Y={generation:Z,socket:null,socketDied:!1,superseded:!1};this.reconnecting=Y,this.enqueueConnectionState({state:"down",cause:$}),this.reconnectWithRetry(Y).catch((G)=>{if(this.isCurrentReconnect(Y)&&!this.closeStarted)this.failFatal(G instanceof Error?G:new W6(String(G)))}).finally(()=>{if(this.isCurrentReconnect(Y))this.reconnecting=null})}async reconnectWithRetry($){let Z=0,J=this.opts.reconnectBackoff.baseMs;for(;;){if(!this.isCurrentReconnect($))return;if(this.closeStarted)throw new W6("provider closed");$.socket=null,$.socketDied=!1,Z+=1,this.enqueueReconnectState($,Z);try{let X=await r8.openConnection(this.opts,(G)=>{if(!this.isCurrentReconnect($)){G.close();return}$.socket=G});if(!this.isCurrentReconnect($)||this.closeStarted){if(X.sock.close(),this.closeStarted)throw new W6("provider closed");return}let Y=this.replaceConnection(X,$.generation);if(this.reconnecting=null,this.reconnecting!==null)throw new W6("reconnect state must clear before restored","reconnect_state");this.scheduleRestored($.generation,Y);return}catch(X){if(!this.isCurrentReconnect($))return;if($.socket)$.socketDied=!0;if(this.closeStarted)throw X;if(!EW(X))throw X;await this.opts.sleep(J),J=Math.min(J*2,this.opts.reconnectBackoff.capMs)}}}isCurrentReconnect($){return!$.superseded&&this.reconnecting===$&&this.generation===$.generation}shouldSupersedeReconnect($,Z,J){return $.generation<Z||$.socketDied||$.socket===J}enqueueReconnectState($,Z){if(!this.isCurrentReconnect($))return;this.enqueueConnectionState({state:"reconnecting",attempt:Z},$.generation,$)}replaceConnection($,Z){return this.sock.close(),this.sock=$.sock,this.currentConn=$.conn,this.storage=$.ack.storage,this.machineId=$7($.ack),this.closedErr=null,this.connectionEpoch+=1,this.connectionToken=Q8(),this.liveRoutes.clear(),this.nextCorr=1n,this.readLoop($.sock,Z),this.connectionEpoch}scheduleRestored($,Z){if(!this.opts.onConnectionState)return;let J=++this.restoredDebounceToken;this.opts.sleep(this.opts.restoredDebounceMs).then(()=>{if(J===this.restoredDebounceToken&&!this.closeStarted&&this.sock&&this.generation===$&&this.connectionEpoch===Z)this.enqueueConnectionState({state:"restored",epoch:Z},$)}).catch((X)=>{if(J===this.restoredDebounceToken&&!this.closeStarted)console.warn("SubcProvider restored debounce timer failed",X)})}cancelRestoredDebounce(){this.restoredDebounceToken+=1}enqueueConnectionState($,Z,J){if(!this.opts.onConnectionState)return;if(this.stateQueue.push({event:$,generation:Z,reconnect:J}),!this.drainingStateQueue)this.drainConnectionStateQueue()}async drainConnectionStateQueue(){if(this.drainingStateQueue)return;this.drainingStateQueue=!0;try{while(this.stateQueue.length>0){let $=this.stateQueue[0];if(this.closeStarted||$.generation!==void 0&&$.generation!==this.generation||$.reconnect?.superseded){this.stateQueue.shift();continue}let{event:Z}=$;try{await this.opts.onConnectionState?.(Z),this.stateQueue.shift()}catch(J){if(Z.state==="restored"){console.warn("SubcProvider restored callback failed; retrying delivery",J),await gW();continue}console.warn("SubcProvider connection-state callback failed",J),this.stateQueue.shift()}}}finally{if(this.drainingStateQueue=!1,this.stateQueue.length>0)this.drainConnectionStateQueue()}}isLiveHandle($){return n8($,this.connectionToken)&&this.liveRoutes.get($.channel)===$}assertLiveHandle($){if(!this.isLiveHandle($))throw new h$($)}allocateCorr(){let $=0xffffffffffffffffn;if(this.nextCorr>$){let J=new W6("channel-0 correlation id allocator exhausted","corr_exhausted");throw this.handleUnexpectedDrop(this.sock,this.generation,J),J}let Z=this.nextCorr;return this.nextCorr+=1n,Z}failFatal($){if(!this.closedErr)this.closedErr=$;this.closeStarted=!0,this.cancelRestoredDebounce(),this.abortAllInflight(),this.sock.close(),this.finishClosed()}finishClosed(){this.resolveClosed()}}function R1($,Z){return`${$.channel}:${$.epoch}:${Z}`}function SW($){try{let Z=C1($.body);return new W6(Z.message??"subc error",Z.code,w1($.header.flags,Z.code)?"not_sent":"terminal",Z.detail)}catch{return new W6(Z7.from($.body).toString("utf8")||"subc error")}}function oZ($){return $&&$.length>0?$:void 0}function kW($){let Z=oZ(process.env[_1]),J=oZ(process.env[P1]),X=Z!==void 0&&J!==void 0;return{connectionFile:$.connectionFile,manifest:$.manifest,handler:$.handler,health:$.health??(()=>({status:"ok"})),handshakeTimeoutMs:$.handshakeTimeoutMs,controlOps:$.controlOps,onBind:$.onBind,onBound:$.onBound,onRouteGone:$.onRouteGone,reconnectBackoff:$.reconnectBackoff??A1,sleep:$.sleep??((Y)=>new Promise((G)=>setTimeout(G,Y))),restoredDebounceMs:$.restoredDebounceMs??FW,onConnectionState:$.onConnectionState,launchNonce:oZ($.launchNonce??J),reconnectOnDrop:$.reconnectOnDrop??!X}}function vW($){if($===null)return null;let Z=new Set($??[]);return Z.add(eZ),[...Z]}function fW($){let Z=$.launchNonce;return E6(i.Hello,A$(),0,0,GX,F1({manifest:mW($.manifest),protocol_ver:a6,control_ops:vW($.controlOps),...Z?{launch_nonce:Z}:{}}))}function EW($){if($ instanceof W6)return $.code==="duplicate_module_id";if($ instanceof y$||$ instanceof q$)return!0;if($ instanceof P$||$ instanceof e$)return!0;if($ instanceof m6)return!0;if($ instanceof C6)return!1;let Z=bW($);return Z==="ECONNREFUSED"||Z==="ECONNRESET"||Z==="EPIPE"||Z==="ETIMEDOUT"||Z==="ENOENT"}function bW($){if(typeof $==="object"&&$!==null&&"code"in $){let Z=$.code;if(typeof Z==="string")return Z}return}async function gW(){await new Promise(($)=>setTimeout($,0))}function A$(){return h6(!1,w6.Passive,!1)}async function rZ($,Z){await j$($,B$(Z),Date.now()+YX)}async function yW($,Z){let J=await $.readFrame(Z,Z);switch(J.header.ty){case i.HelloAck:{let X=C1(J.body);if(X.negotiated_ver!==a6)throw new W6(`subc negotiated protocol ${X.negotiated_ver}; expected exactly ${a6}`,"unsupported_version");return X}case i.Error:{let X=C1(J.body);throw new W6(`subc rejected HELLO: ${X.code??"unknown"} — ${X.message??"subc error"}`,X.code)}default:throw new W6(`unexpected frame ${i[J.header.ty]} awaiting HELLO_ACK`)}}function F1($){return new Uint8Array(Z7.from(JSON.stringify($),"utf8"))}function C1($){return JSON.parse(Z7.from($).toString("utf8"))}function XX($,Z){if(typeof $!=="number"||!Number.isInteger($))throw new W6(`route.bind ${Z} must be an integer`);return $}function hW($){if($===void 0||$===!0)return null;if($===!1)return{code:"route_rejected",message:"route.bind rejected by provider"};if($.accept)return null;return{code:$.code??"route_rejected",message:$.message??"route.bind rejected by provider"}}function mW($){return{module_id:$.module_id,module_version:$.module_version,protocol_ver:$.protocol_ver,trust_tier:$.trust_tier,provides:$.provides.map(uW),consumes:$.consumes.map(pW),bindings:{storage:{kind:$.bindings.storage.kind,scope:$.bindings.storage.scope,owns_schema:$.bindings.storage.owns_schema},vault_grants:$.bindings.vault_grants.map((Z)=>({secret:Z.secret,reason:Z.reason})),identity:{requires:[...$.bindings.identity.requires],optional:[...$.bindings.identity.optional]}}}}function uW($){switch($.role){case"tool_provider":return{role:"tool_provider",tools:$.tools.map((Z)=>({name:Z.name,...Z.description===void 0?{}:{description:Z.description},execution_mode:Z.execution_mode,schema:Z.schema})),identity_scope:[...$.identity_scope],concurrency:$.concurrency,emits_push:$.emits_push,sub_supervises:$.sub_supervises};case"pipeline_stage":return{role:"pipeline_stage",stage:$.stage,applies_to:{provider:$.applies_to.provider,model:$.applies_to.model},interface:$.interface,declares_frozen_floor:$.declares_frozen_floor,needs_signals:[...$.needs_signals],conformance_class:$.conformance_class};case"management_surface":return{role:"management_surface",operations:$.operations.map((Z)=>({name:Z.name,kind:Z.kind})),config_schema:$.config_schema,observability:$.observability.map((Z)=>({name:Z.name,kind:Z.kind})),identity_scope:[...$.identity_scope],concurrency:$.concurrency};case"internal_service":return{role:"internal_service",service_id:$.service_id,transport:$.transport,agent_facing:$.agent_facing,operations:[...$.operations]}}}function pW($){switch($.role){case"tool_client":return{role:"tool_client",of:[...$.of]};case"llm_client":return{role:"llm_client",via:$.via,auth:$.auth};case"service_client":return{role:"service_client",of:[...$.of]}}}var k1="subc-connection.json",QX="subc-",KX=".connection.json";function WX(){let $=process.env.HOME;return $?W8($,".local","share","cortexkit","run",k1):void 0}function iW(){let $=process.env.XDG_RUNTIME_DIR;if($)return W8($,k1);let Z=WX();if(Z)return Z;return W8(dW().homedir,".local","share","cortexkit","run",k1)}function sW(){if(process.env.SUBC_CONNECTION_FILE)return process.env.SUBC_CONNECTION_FILE;let $=process.env.XDG_RUNTIME_DIR;if($){let Y=W8($,k1);if(S1(Y))return Y}let Z=WX();if(Z&&S1(Z))return Z;let J=W8(zX(),`${QX}${tW()}${KX}`);if(S1(J))return J;let X=aW(zX());return X.length===1?X[0]:void 0}function tW($=process.getuid??null,Z=process.env){if($)return String($());for(let J of["USER","USERNAME","HOME","USERPROFILE"]){let X=Z[J];if(X)return Array.from(X,(Y)=>/^[a-zA-Z0-9_-]$/.test(Y)?Y:"_").join("")}return"unknown"}function VX(){return sW()??iW()}function J7($){return $?.trim()||process.env.SUBC_CONNECTION_FILE||process.env.CLAUSTRUM_SUBC_CONNECTION?.trim()||VX()}function S1($){try{return lW($).isFile()}catch{return!1}}function aW($){let Z;try{Z=cW($)}catch{return[]}let J=[];for(let X of Z){if(typeof X!=="string")continue;if(!X.startsWith(QX)||!X.endsWith(KX))continue;let Y=W8($,X);if(S1(Y))J.push(Y)}return J.sort(),J}import{createHash as nW}from"node:crypto";import{existsSync as oW,realpathSync as BX}from"node:fs";import{dirname as rW,relative as eW,resolve as $V}from"node:path";function qX($){let Z=$,J;try{J=BX(Z)}catch(X){if(X.code!=="ENOENT")throw X;let Y=Z;while(!oW(Y)){let G=rW(Y);if(G===Y)break;Y=G}J=$V(BX(Y),eW(Y,Z))}return nW("sha256").update(J).digest("hex")}function X7($,Z){return{project_root:$,harness:"opencode",session:`store-${qX(Z)}`}}import*as Z0 from"node:fs/promises";import{win32 as HX}from"node:path";async function e8($){let Z;try{Z=await import("./index-zdgceztz.js")}catch(J){throw Error("@cortexkit/private-files is unavailable; refusing the Windows private operation",{cause:J})}try{return await $(Z)}catch(J){if(J instanceof Z.PrivateFilesUnavailableError)throw Error(`@cortexkit/private-files native addon is unavailable; refusing the Windows private operation: ${J.message}`,{cause:J});throw J}}function ZV($,Z){return{ok:!1,reason:Z,path:$}}function JV($){return $?.code==="ENOENT"}async function XV($,Z){let J=$,X=!1;try{if(!$||$.includes("\x00")||!HX.isAbsolute($))throw Error("expected an absolute Windows path");for(;;){let Y;try{Y=await Z.lstat(J)}catch(G){if(!JV(G))throw G;let z=HX.dirname(J);if(z===J)throw G;J=z,X=!0;continue}if(X&&!Y.isDirectory())throw Error("nearest existing ancestor is not a directory");return await e8((G)=>G.verifyPrivatePath(J,Y.isDirectory()?"directory":"file")),{ok:!0}}}catch(Y){return ZV(J,`Windows private-path verification refused: ${Y instanceof Error?Y.message:String(Y)}`)}}async function C0($,Z={}){let J={realpath:Z0.realpath,lstat:Z0.lstat,stat:Z0.stat,readFile:Z0.readFile,...Z.fs};if((Z.platform??process.platform)==="win32")return XV($,J);return LX($,Z)}import{mkdir as YV,open as GV,realpath as zV,rmdir as QV}from"node:fs/promises";import{dirname as Y7}from"node:path";var KV="sticky ancestor without an owner-only child";function G7($){return Error(`Private creation refused: ${$.reason}: ${$.path}`)}async function WV($){let Z=await C0(Y7($));if(!Z.ok)throw G7(Z)}async function v1($,Z=""){if(process.platform==="win32")return e8((X)=>X.createPrivateFile($,Z));await WV($);let J=await GV($,"wx",384);try{await J.writeFile(Z)}finally{await J.close()}}async function f1($){if(process.platform==="win32")return e8((Y)=>Y.createPrivateDirectory($));let Z=await C0(Y7($)),J=!1;if(!Z.ok){if(J=Z.reason===KV&&Z.path===await zV(Y7($)).catch(()=>{return}),!J)throw G7(Z)}if(await YV($,{mode:448}),!J)return;let X=await C0($);if(!X.ok)throw await QV($).catch(()=>{return}),G7(X)}import{AsyncLocalStorage as VV}from"node:async_hooks";import{stat as NX}from"node:fs/promises";import{dirname as BV,resolve as qV}from"node:path";var jV=new VV,E1=($,Z)=>C0(qV($),jV.getStore()??Z);function b1($,Z){return`${$} ${Z.path} is not private: ${Z.reason}`}function g1($){let Z=$;if(Z?.code==="ERR_PRIVATE_FILES_SECURITY"&&Z.reason==="io-error"){if(Z.win32Code===80||Z.win32Code===183)return"EEXIST";if(Z.win32Code===2||Z.win32Code===3)return"ENOENT"}return Z?.code}async function y1($){try{await NX($);return}catch(J){if(J.code!=="ENOENT")throw J}let Z=BV($);if(Z!==$)await y1(Z);try{await f1($)}catch(J){if(g1(J)!=="EEXIST")throw J;if(!(await NX($)).isDirectory())throw J}}import{randomBytes as HV}from"node:crypto";import{open as LV,rename as NV,unlink as UV}from"node:fs/promises";import{basename as xV,dirname as DV,join as OV,resolve as MV}from"node:path";var IV=/^[0-9a-f]{64}$/;function _V($){if(!IV.test($.token))throw Error("enrollment token must be exactly 64 lowercase hex characters");if(!Number.isSafeInteger($.token_generation)||$.token_generation<1)throw Error("enrollment token generation must be a positive safe integer")}async function UX($){let Z=await E1($);if(!Z.ok)throw Error(b1("enrollment token folder",Z))}async function $9($,Z){_V(Z),$=MV($);let J=DV($);if(process.platform!=="win32")await UX(J);await y1(J),await UX(J);let X=OV(J,`.${xV($)}.${process.pid}.${HV(12).toString("hex")}.tmp`),Y=!1;try{Y=!0;try{await v1(X,`${JSON.stringify(Z)}
+`)}catch(z){if(g1(z)==="EEXIST")Y=!1;throw z}let G=await LV(X,"r+");try{await G.sync()}finally{await G.close()}await NV(X,$),Y=!1}finally{if(Y)await UV(X).catch(()=>{return})}}var xX=["transient","permanent","auth_required","context_overflow"];class s6 extends Error{code;action;["class"];constructor($,Z,J){super(`Claustrum credential request failed: ${$}`);this.code=$,this.action=J,this.name="ClaustrumCredentialError",this.class=Z}}function V8($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function DX($){switch($){case"permanent":return"gone";case"auth_required":return"reauth";case"context_overflow":return"reduce_and_retry";case"transient":return"retry"}}function J6($,Z="invalid_response",J=(X)=>console.warn(X)){let X=V8($)&&V8($.result)?$.result:void 0,Y=X&&V8(X.error)?X.error:void 0,G=Y?.class,z=Y?.code,Q=typeof G==="string"&&xX.includes(G),K=typeof z==="string",V=Q&&K?G:"transient";if(typeof G!=="string")J("unknown");else if(!Q)J(G);return new s6(K?z:Z,V,DX(V))}function S0($){return V8($)&&V8($.result)&&V8($.result.error)}var OX="claustrum",wV=60000;function n6($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function Q7($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0?$:void 0}function w$($){return $===void 0||typeof $==="string"}function MX($,Z){if(S0($))throw J6($,"invalid_response",Z);let J=n6($)&&n6($.result)?$.result:void 0,X=J?.payload;if(!Array.isArray(X)||X.length===0||!X.every((H)=>typeof H==="number"&&Number.isInteger(H)&&H>=0&&H<=255))throw J6($,"invalid_response",Z);let Y=Q7(J?.record_version);if(Y===void 0)throw J6($,"invalid_record_version",Z);let G=J?.expires_at_ms,z=G===void 0||G===null?null:typeof G==="number"&&Number.isFinite(G)?G:void 0;if(z===void 0)throw J6($,"invalid_expiry",Z);let Q=J?.credential_id,K=J?.project_id,W=J?.account_id,V=J?.email,B=J?.org_name;if(!w$(Q)||!w$(K)||!w$(W)||!w$(V)||!w$(B))throw J6($,"invalid_response",Z);let q;try{q=new TextDecoder("utf-8",{fatal:!0}).decode(Uint8Array.from(X))}catch{throw J6($,"invalid_response",Z)}return{material:q,recordVersion:Y,expiresAtMs:z,credentialId:Q,projectId:K,accountId:W,email:V,orgName:B}}function RV($,Z){if(S0($))throw J6($,"invalid_response",Z);let J=n6($)&&n6($.result)?$.result:void 0,X=J?.record_version,Y=X===void 0?void 0:Q7(X),G=J?.credential_id;if(typeof J?.ready!=="boolean"||J?.last_error_code!==void 0&&J?.last_error_code!==null&&typeof J?.last_error_code!=="string"||typeof J?.lease_held!=="boolean"||X!==void 0&&Y===void 0||!w$(G)||J?.stale_pending!==void 0&&typeof J.stale_pending!=="boolean")throw J6($,"invalid_status",Z);return{ready:J.ready,lastErrorCode:J.last_error_code??null,leaseHeld:J.lease_held,...G===void 0?{}:{credentialId:G},...Y===void 0?{}:{recordVersion:Y},...J.stale_pending===void 0?{}:{stalePending:J.stale_pending}}}class R${#$;#Z;#z;#J;#Q;#Y;#X=null;#K=0;#V=!1;constructor($,Z,J,X,Y,G){this.#$=$,this.#Z=Z,this.#z=J,this.#J=X,this.#Q=Y,this.#Y=G}static async connect($={}){let Z=J7($.connectionFile),J=$.connector??((G)=>F0.connect(G)),X=$.identity??X7($.projectRoot??process.cwd(),$.storagePath??process.cwd()),Y=await J({connectionFile:Z,handshakeTimeoutMs:$.handshakeTimeoutMs});return new R$(Y,J,Z,$.handshakeTimeoutMs,X,$.logger??((G)=>console.warn(G)))}async getCredential($,Z){let J=await this.#G("credential.get",{handle:$,min_ttl_ms:Z,force_refresh:!1});return MX(J,this.#Y)}async statusCredential($){let Z=await this.#G("credential.status",{handle:$});return RV(Z,this.#Y)}async reportAuthFailure($){let Z=await this.#G("credential.report_auth_failure",{handle:$.handle,provider_status:$.providerStatus,record_version:$.recordVersion,reporter_source:$.reporterSource});if(S0(Z))throw J6(Z,"invalid_response",this.#Y);if((n6(Z)&&n6(Z.result)?Z.result:void 0)?.accepted!==!0)throw J6(Z,"invalid_response",this.#Y)}async listScoped($){let Z=await this.#G("credential.list_scoped",$===void 0?{}:{enrollment_token:$});return TV(Z,this.#Y)}async getScoped($){let Z=await this.#G("credential.get_scoped",{credential_id:$.credentialId,enrollment_token:$.enrollmentToken,min_ttl_ms:$.minTtlMs});return MX(Z,this.#Y)}async reportAuthFailureScoped($){let Z=await this.#G("credential.report_auth_failure",{credential_id:$.credentialId,enrollment_token:$.enrollmentToken,provider_status:$.providerStatus,record_version:$.recordVersion,reporter_source:$.reporterSource});if(S0(Z))throw J6(Z,"invalid_response",this.#Y);if((n6(Z)&&n6(Z.result)?Z.result:void 0)?.accepted!==!0)throw J6(Z,"invalid_response",this.#Y)}async enrollPropose($){let Z=await this.#G("auth.enroll_propose",{proposed_name:$.name,request_secret_hash:$.requestSecretHash}),X=z7(Z,this.#Y).request_id;if(typeof X!=="string"||X.length===0)throw J6(Z,"invalid_response",this.#Y);return{requestId:X}}async enrollPoll($){let Z=await this.#G("auth.enroll_poll",{request_id:$.requestId,request_secret:$.requestSecret});return FV(Z,this.#Y)}async enrollRotate($){let Z=await this.#G("auth.enroll_rotate",{token:$.token,expected_token_generation:$.expectedTokenGeneration}),J=z7(Z,this.#Y),X=J.token,Y=J.token_generation;if(typeof X!=="string"||X.length===0||typeof Y!=="number"||!Number.isInteger(Y)||Y<0)throw J6(Z,"invalid_response",this.#Y);return{token:X,tokenGeneration:Y}}close(){this.#V=!0,this.#$.close()}async#G($,Z){let J=this.#$;try{return await J.call(OX,$,Z,{identity:this.#Q,consumerIdentity:null})}catch(X){if(this.#B(X)){try{if(this.#$===J)await this.#q()}catch(Y){throw this.#W(Y)}try{return await this.#$.call(OX,$,Z,{identity:this.#Q,consumerIdentity:null})}catch(Y){throw this.#W(Y)}}throw this.#W(X)}}#W($){if($ instanceof s6)return $;let Z=$ instanceof S6&&$.code?$.code:"transport_error";return new s6(Z,"transient","retry")}#B($){return!this.#V&&$ instanceof S6&&$.kind==="terminal"&&$.code!=="missing_identity"&&$.code!=="invalid_control_body"&&$.code!=="unknown_module"}async#q(){if(this.#V)throw Error("Claustrum client is closed");if(this.#X){await this.#X;return}let $=Date.now();if($<this.#K)throw Error("Claustrum client reconnect is backed off");this.#K=$+wV,this.#X=this.#Z({connectionFile:this.#z,handshakeTimeoutMs:this.#J}).then((Z)=>{if(this.#V)throw Z.close(),Error("Claustrum client is closed");let J=this.#$;this.#$=Z,J.close()}).finally(()=>{this.#X=null}),await this.#X}}function TV($,Z){if(S0($))throw J6($,"invalid_response",Z);let J=n6($)&&n6($.result)?$.result:void 0,X=J?.credentials;if(!Array.isArray(X))throw J6($,"invalid_response",Z);let Y=J?.view;if(typeof Y!=="string"||Y.length===0)throw J6($,"invalid_response",Z);return{rows:X.map((z)=>{if(!n6(z))throw J6($,"invalid_response",Z);let Q=Q7(z.record_version);if(Q===void 0)throw J6($,"invalid_record_version",Z);let K=(H)=>{if(!Array.isArray(H)||!H.every((j)=>typeof j==="string"))throw J6($,"invalid_response",Z);return H};if(typeof z.id!=="string"||typeof z.type!=="string"||typeof z.state!=="string")throw J6($,"invalid_response",Z);let W=z.created_at_ms===void 0||z.created_at_ms===null?null:typeof z.created_at_ms==="number"&&Number.isFinite(z.created_at_ms)?z.created_at_ms:void 0;if(W===void 0)throw J6($,"invalid_response",Z);let V=z.plan_tier;if(V!==void 0&&(typeof V!=="string"||!/^[a-z][a-z0-9_]{0,31}(?![\s\S])/.test(V)))throw J6($,"invalid_response",Z);let{auth_method:B,plan_tier_source:q}=z;if(q!==void 0&&q!=="operator"&&q!=="detected")throw J6($,"invalid_response",Z);if(B!==void 0&&B!=="apikey"&&B!=="chatgpt"&&B!=="antigravity"&&B!=="oauth")throw J6($,"invalid_response",Z);if(!w$(z.refresh_adapter))throw J6($,"invalid_response",Z);if(!w$(z.account_id)||!w$(z.email)||!w$(z.org_name))throw J6($,"invalid_response",Z);return{id:z.id,categories:K(z.categories),credentialType:z.type,serves:K(z.serves),providerIds:z.provider_ids===void 0?[]:K(z.provider_ids),authMethod:B,planTier:V,planTierSource:q,state:z.state,refreshAdapter:z.refresh_adapter,recordVersion:Q,operations:K(z.operations),createdAtMs:W,accountId:z.account_id,email:z.email,orgName:z.org_name}}),view:Y}}function z7($,Z){if(S0($))throw J6($,"invalid_response",Z);let J=n6($)&&n6($.result)?$.result:void 0;if(J===void 0)throw J6($,"invalid_response",Z);return J}function FV($,Z){let J=z7($,Z),X=J.status;if(X==="pending")return{status:"pending"};if(X==="denied")return{status:"denied"};if(X!=="approved")throw J6($,"invalid_response",Z);let{name:Y,token:G,token_generation:z}=J;if(typeof Y!=="string"||typeof G!=="string"||G.length===0||typeof z!=="number"||!Number.isInteger(z))throw J6($,"invalid_response",Z);return{status:"approved",name:Y,token:G,tokenGeneration:z}}import{randomUUID as s1}from"node:crypto";import{randomUUID as UY}from"node:crypto";import{mkdir as rL,open as l4,rename as eL,rm as $N}from"node:fs/promises";import{dirname as LJ}from"node:path";import{randomUUID as ZN}from"node:crypto";import{lstat as cz,readFile as lz,rename as JN,unlink as xY}from"node:fs/promises";import{dirname as H0,resolve as K$}from"node:path";import{randomUUID as t1}from"node:crypto";import{mkdir as IY,open as GN,readFile as _Y,rename as PY,rm as a1,stat as AY,writeFile as wY}from"node:fs/promises";import{dirname as I7,join as RY}from"node:path";import{setTimeout as VN}from"node:timers/promises";import{AsyncLocalStorage as BN}from"node:async_hooks";import{createHash as z1}from"node:crypto";import{randomUUID as CY}from"node:crypto";import{randomUUID as QU}from"node:crypto";import{isDeepStrictEqual as WU}from"node:util";import{types as e5}from"node:util";import{randomUUID as CU}from"node:crypto";import{constants as hY}from"node:fs";import{lstat as SU,mkdir as kU,open as RQ,rename as vU,rm as fU}from"node:fs/promises";import{basename as EU,dirname as mY,isAbsolute as bU,join as gU}from"node:path";import{types as yU}from"node:util";import{createHash as hU}from"node:crypto";import{createHash as uU}from"node:crypto";import{lstat as pU,readFile as cU}from"node:fs/promises";import{createHash as CQ}from"node:crypto";import{createHash as lU}from"node:crypto";import{createHash as iU}from"node:crypto";import{types as X2}from"node:util";import{appendFileSync as _x,chmodSync as Px,existsSync as mJ,renameSync as eY,statSync as Ax}from"node:fs";import{open as wx}from"node:fs/promises";import{dirname as Rx,resolve as Tx}from"node:path";import{createHash as yx,randomBytes as hx,randomUUID as mx}from"node:crypto";import{constants as X3}from"node:fs";import{chmod as ux,mkdir as px,open as ZK,readFile as pJ,realpath as cx,rename as lx,stat as JK,unlink as V2}from"node:fs/promises";import{basename as dx,dirname as D0,extname as KF,isAbsolute as WF,join as ix,resolve as VF}from"node:path";import{createHash as WD}from"node:crypto";import{types as RD}from"node:util";import{createHash as FD}from"node:crypto";import{isAbsolute as bD,normalize as gD,parse as yD,sep as X4}from"node:path";import{createHash as hD}from"node:crypto";import{constants as k7}from"node:fs";import{lstat as H3,open as mD}from"node:fs/promises";import{resolve as N9}from"node:path";import{createHash as QO}from"node:crypto";import{basename as KO,dirname as WO,join as VO}from"node:path";import{randomUUID as BO}from"node:crypto";import{types as qO}from"node:util";import{createHash as AK,randomUUID as OO}from"node:crypto";import{mkdir as MO,readFile as IO,rename as _O,rm as PO,stat as AO,writeFile as wO}from"node:fs/promises";import{basename as RO,dirname as wK,join as TO}from"node:path";import{randomUUID as uO}from"node:crypto";import{lstat as pO,open as cO,rename as lO,unlink as F3}from"node:fs/promises";import{dirname as dO,isAbsolute as iO,join as sO}from"node:path";import{createHash as tO}from"node:crypto";import{lstat as aO,mkdir as nO,unlink as oO}from"node:fs/promises";import{dirname as rO,isAbsolute as eO}from"node:path";import{createHash as $M}from"node:crypto";import{realpath as ZM}from"node:fs/promises";import{basename as vK,dirname as fK,join as EK,resolve as JM}from"node:path";import{types as i9}from"node:util";import{types as mK}from"node:util";import{dirname as eM,join as $I,resolve as ZI}from"node:path";import{createHash as YI}from"node:crypto";import{constants as u3}from"node:fs";import{lstat as lK,mkdir as p3,open as dK,unlink as GI}from"node:fs/promises";import{dirname as L8,resolve as c3}from"node:path";import{setTimeout as zI}from"node:timers/promises";import{rmdirSync as QI,statSync as KI}from"node:fs";import{mkdir as WI,rmdir as VI,stat as QZ,utimes as iK}from"node:fs/promises";import{createHash as MI}from"node:crypto";import{realpathSync as II}from"node:fs";import{mkdir as _I,readdir as s3,rm as G4,stat as t3,writeFile as PI}from"node:fs/promises";import{tmpdir as AI}from"node:os";import{join as s8,resolve as wI}from"node:path";import{randomUUID as ZG}from"node:crypto";import{chmod as JG,lstat as lI,mkdir as dI,readdir as XG,readFile as YG,rename as iI,rm as d7,stat as sI,writeFile as tI}from"node:fs/promises";import{tmpdir as aI}from"node:os";import{join as A4}from"node:path";import{Buffer as K_}from"node:buffer";import{createHash as W_,randomBytes as V_}from"node:crypto";function gV($){return $&&typeof $==="object"&&"code"in $&&typeof $.code==="string"?$.code:"unknown"}var M8="subc-connection.json",yV="subc-",hV=".connection.json";function O9($){try{return EV($).isFile()}catch{return!1}}function mV($){let Z;try{Z=fV($)}catch{return[]}let J=[];for(let X of Z){if(typeof X!=="string")continue;if(!X.startsWith(yV)||!X.endsWith(hV))continue;let Y=f9($,X);if(O9(Y))J.push(Y)}return J.sort(),J}function uV($=process.env){let Z=$.XDG_RUNTIME_DIR?.trim();if(Z){let z=f9(Z,M8);if(O9(z))return z}let J=$.HOME?.trim();if(J){let z=f9(J,".local","share","cortexkit","run",M8);if(O9(z))return z}let Y=`/run/user/${process.getuid?.()??n7().uid}/${M8}`;if(O9(Y))return Y;let G=mV(bV());if(G.length===1)return G[0];return}function pV($=process.env){let Z=uV($);if(Z)return Z;let J=$.XDG_RUNTIME_DIR?.trim();if(J&&(process.platform!=="darwin"||O9(J)))return f9(J,M8);if(process.platform==="darwin"){let Y=$.HOME?.trim()||n7().homedir;return f9(Y,".local","share","cortexkit","run",M8)}return`/run/user/${process.getuid?.()??n7().uid}/${M8}`}function DG($,Z=process.env){return $?.trim()||Z.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE?.trim()||Z.CLAUSTRUM_SUBC_CONNECTION?.trim()||pV(Z)}function L5($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function cV($){return L5($)&&typeof $.host==="string"&&$.host.trim().length>0&&typeof $.port==="number"&&Number.isInteger($.port)&&$.port>0&&$.port<=65535}async function Lw($){let Z=DG($),J;try{J=await xG.readFile(Z,"utf8")}catch(Y){let G=gV(Y);if(G==="ENOENT")return{status:"absent",path:Z};return{status:"malformed",path:Z,reason:`unreadable (${G})`}}let X;try{X=JSON.parse(J)}catch{return{status:"malformed",path:Z,reason:"invalid JSON"}}if(!L5(X)||typeof X.schema!=="number"||!Number.isFinite(X.schema)||typeof X.wire_version!=="number"||!Number.isFinite(X.wire_version)||!Array.isArray(X.endpoints)||X.endpoints.length===0||!X.endpoints.every(cV))return{status:"malformed",path:Z,reason:"connection file has an invalid schema, wire_version, or endpoints"};return{status:"available",schema:X.schema,wireVersion:X.wire_version,endpoints:X.endpoints.map((Y)=>({host:Y.host,port:Y.port}))}}var OG="claustrum-tombstone:v1:";function MG($){return`${OG}${$}`}function BZ($){return{type:"oauth",access:"",refresh:MG($),expires:0}}function IG($){return typeof $==="string"&&$.startsWith(OG)}function Nw($,Z){if(!L5($)||$.type!=="oauth")return!1;return $.refresh===MG(Z)}class N5 extends Error{provider;code="custody_tombstone_refresh";constructor($){super(`${$} OAuth credentials are vault-custodied; local token refresh is forbidden`);this.provider=$,this.name="CustodyTombstoneRefreshError"}}function U5($,Z){if(IG($))throw new N5(Z)}var qZ="9d1c250a-e61b-44d9-88ed-5944d1962f5e",_G={console:"https://platform.claude.com/oauth/authorize",max:"https://claude.com/cai/oauth/authorize"},o7="https://platform.claude.com/oauth/code/callback",PG="https://platform.claude.com/v1/oauth/token",lV=/^ckh_[A-Za-z0-9_-]{43}$/,AG="axios/1.15.2",wG=["org:create_api_key","user:profile","user:inference","user:sessions:claude_code","user:mcp_servers","user:file_upload"],dV="user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload",Uw="mcp_";var iV="fast-mode-2026-02-01";function xw($,Z){let J=($??"").split(",").map((X)=>X.trim()).filter(Boolean);return[...new Set([...J,...Z])].join(",")}function Dw($){return typeof $==="string"&&($.startsWith("claude-opus-4-8")||$.startsWith("claude-opus-5"))}var Ow="You are OpenCode",Mw="You are Claude Code, Anthropic's official CLI for Claude.",Iw=["<use_parallel_tool_calls>","For maximum efficiency, whenever you perform multiple independent operations, invoke all relevant tools simultaneously rather than sequentially. Prioritize calling independent tools in parallel whenever possible. For example, when reading 3 known files, run 3 tool calls in parallel to read all 3 files into context at the same time. When running multiple independent read-only commands like `ls` or `list_dir`, run all of those commands in parallel. Err on the side of maximizing parallel tool calls for independent work rather than running too many tools sequentially.","","Do not parallelize tool calls when one call depends on the output of another call. If a tool call needs an ID, filename, search result, or any other value returned by a previous tool call, run the first call, wait for its result, then run the dependent call using the real returned value. Never invent placeholder IDs, guessed task IDs, or other guessed values for dependent tool calls just to place them in the same parallel block.","</use_parallel_tool_calls>"].join(`
+`),sV="59cf53e54c78",tV=[4,7,20],r9="2.1.280",RG="cli",aV="0.112.1",nV="v26.3.0",oV=`claude-cli/${r9} (external, ${RG})`,TG=["explicit","automatic","hybrid"],FG="explicit",_w=["github.com/anomalyco/opencode","opencode.ai/docs"],Pw=[{match:"if OpenCode honestly",replacement:"if the assistant honestly"},{match:"Here is some useful information about the environment you are running in:",replacement:"Environment context you are running in:"}],_X=new Set(["EAI_AGAIN","ECONNREFUSED","ECONNRESET","EHOSTUNREACH","ENETUNREACH","ENOTFOUND","ETIMEDOUT","UND_ERR_CONNECT_TIMEOUT"]);function PX($,Z){if(!$||typeof $!=="object")return;let J=$[Z];return typeof J==="string"?J:void 0}function g$($){let Z=PX($,"code");if(Z&&_X.has(Z))return!0;let J=$ instanceof Error?$.message:PX($,"message")??String($);if(J.includes("fetch failed"))return!0;return[..._X].some((X)=>J.includes(X))}function AX($){let Z="";for(let J of $)Z+=String.fromCharCode(J);return btoa(Z).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async function rV(){let $=new Uint8Array(64);crypto.getRandomValues($);let Z=AX($),J=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(Z));return{verifier:Z,challenge:AX(new Uint8Array(J)),method:"S256"}}function CG($){if(!$)return;let Z=Number($);if(Number.isFinite(Z)&&Z>0)return Math.ceil(Z);let J=Date.parse($);if(Number.isFinite(J)){let X=Math.ceil((J-Date.now())/1000);return X>0?X:void 0}return}class E9 extends Error{status;body;retryAfter;isRefreshError=!0;constructor($,Z,J){super(`Claude OAuth refresh failed: ${$} — ${Z}`);this.status=$,this.body=Z,this.name="ClaudeOAuthRefreshError",this.retryAfter=CG(J??void 0)}}async function eV($){if(U5($.refreshToken,"anthropic"),typeof $.refreshToken!=="string"||!$.refreshToken.trim())throw Error("Local OAuth refresh credential is unavailable");let Z=$.fetchImpl??fetch,J=$.maxRetries??2,X=$.baseDelayMs??500,Y=$.setTimeoutImpl??globalThis.setTimeout;for(let G=0;G<=J;G++)try{if(G>0){let W=X*2**(G-1);await new Promise((V)=>Y(V,W))}let z=await Z(PG,{method:"POST",redirect:"error",headers:{"Content-Type":"application/json",Accept:"application/json, text/plain, */*","User-Agent":AG},body:JSON.stringify({grant_type:"refresh_token",refresh_token:$.refreshToken,client_id:qZ,scope:dV})});if(!z.ok){if(z.status>=500&&G<J){await z.body?.cancel().catch(()=>{});continue}let W=await z.text().catch(()=>"");throw new E9(z.status,W,z.headers.get("retry-after"))}let Q=await z.json(),K=$.now?.()??Date.now();return{access:Q.access_token,refresh:Q.refresh_token??$.refreshToken,expires:K+Q.expires_in*1000,expiresIn:Q.expires_in,authLineageId:$.authLineageId}}catch(z){if(z instanceof E9)throw z;if(G<J&&g$(z))continue;throw z}throw Error("Token refresh exhausted all retries")}function $B(){return crypto.randomUUID().replace(/-/g,"")}function ZB($){let Z=$.trim();try{let z=new URL(Z),Q=z.searchParams.get("code"),K=z.searchParams.get("state");if(Q&&K)return{code:Q,state:K}}catch{}let J=Z.split("#");if(J.length===2&&J[0]&&J[1])return{code:J[0],state:J[1]};let X=new URLSearchParams(Z),Y=X.get("code"),G=X.get("state");if(Y&&G)return{code:Y,state:G};return null}async function JB($,Z,J){let X=await fetch(PG,{method:"POST",redirect:"error",headers:{"Content-Type":"application/json",Accept:"application/json, text/plain, */*","User-Agent":AG},body:JSON.stringify({code:$.code,state:$.state,grant_type:"authorization_code",client_id:qZ,redirect_uri:J,code_verifier:Z})});if(!X.ok)return{type:"failed"};let Y=await X.json();return{type:"success",refresh:Y.refresh_token,access:Y.access_token,expires:Date.now()+Y.expires_in*1000}}async function Aw($){let Z=await rV(),J=$B(),X=new URL(_G[$],import.meta.url);return X.searchParams.set("code","true"),X.searchParams.set("client_id",qZ),X.searchParams.set("response_type","code"),X.searchParams.set("redirect_uri",o7),X.searchParams.set("scope",wG.join(" ")),X.searchParams.set("code_challenge",Z.challenge),X.searchParams.set("code_challenge_method","S256"),X.searchParams.set("state",J),{url:X.toString(),redirectUri:o7,state:J,verifier:Z.verifier}}async function ww($,Z,J,X){let Y=ZB($);if(!Y)return{type:"failed"};if(X&&Y.state!==X)return{type:"failed"};return JB(Y,Z,J)}var XB=globalThis.setTimeout.bind(globalThis),YB=globalThis.clearTimeout.bind(globalThis),SG="anthropic-auth.json",GB="anthropic-auth-state.json",zB="https://api.anthropic.com/api/oauth/usage",jZ=["five_hour","seven_day","scoped","extraUsage","bindingWindow","fallbackAdvised"];function Rw($){return $.access==null&&($.refresh==null||$.refresh==="")}function n0($){return $.type==="oauth"}function Tw($){return $.type==="api"}function kG($){let Z=$?.trim();if(!Z)return!1;try{let J=new URL(Z);return(J.protocol==="http:"||J.protocol==="https:")&&!J.username&&!J.password}catch{return!1}}function Fw($){return $.costZeroing?.enabled!==!1}var QB=[401,403,429];var r7=300000,KB=3600000,vG=86400000,WB=60000,VB=900000,BB=300000,qB=5,wX={five_hour:0,seven_day:0},jB=!0,Cw=60000;function HB(){if(process.env.OPENCODE_CONFIG_DIR?.trim())return process.env.OPENCODE_CONFIG_DIR.trim();return k8(process.env.XDG_CONFIG_HOME||k8(kV(),".config"),"opencode")}function x5(){return process.env.OPENCODE_ANTHROPIC_AUTH_FILE?.trim()||k8(HB(),SG)}function LB($=x5()){let Z=process.env.OPENCODE_ANTHROPIC_AUTH_STATE_FILE?.trim();if(Z)return Z;return $.endsWith(SG)?k8(vV($),GB):`${$}.state.json`}function Sw(){return{version:1,main:{type:"opencode",provider:"anthropic"},accounts:[]}}function J9($,Z){if(Z===void 0||!Number.isFinite(Z))return $;if($===void 0||!Number.isFinite($))return Z;return Math.max($,Z)}function o0($){return Math.max($?.five_hour?.checkedAt??0,$?.seven_day?.checkedAt??0,...$?.scoped?.map((Z)=>Z.checkedAt)??[],$?.checkedAt??0)}function RX($){if($?.source==="poll")return 2;if($?.source==="headers")return 1;return 0}function NB($,Z){if(!("scoped"in $))return Z.scoped;if(!Array.isArray($.scoped)||$.scoped.length===0)return $.scoped;if(!Array.isArray(Z.scoped)||Z.scoped.length===0)return $.scoped;let J=new Map(Z.scoped.map((X)=>[X.id,X]));for(let X of $.scoped){let Y=J.get(X.id);if(!Y||X.checkedAt>=Y.checkedAt)J.set(X.id,X)}return[...J.values()]}function TX($,Z,J){let X=$[J],Y=Z[J];if(!Y)return X;if(!X)return Y;if(Y.checkedAt>X.checkedAt)return Y;if(Y.checkedAt<X.checkedAt)return X;return RX($)>RX(Z)?X:Y}function K0($,Z){if(!$||$[Z]===void 0)return;return $.fieldSources?.[Z]??($.source==="poll"||$.source==="headers"?$.source:void 0)}function UB($,Z,J){let X={};for(let Y of jZ){if(J[Y]===void 0)continue;if(Y==="scoped"||Y==="extraUsage"){X[Y]="poll";continue}if(Y==="bindingWindow"&&$.bindingWindowSource==="poll"&&$.bindingWindow===J.bindingWindow){X[Y]="poll";continue}if(Y==="fallbackAdvised"&&Z.fieldSources?.fallbackAdvised===void 0){let z=K0($,Y);if(z)X[Y]=z;continue}let G=Z[Y]===J[Y]?K0(Z,Y):$[Y]===J[Y]?K0($,Y):K0($,Y)??K0(Z,Y);if(G)X[Y]=G}return Object.keys(X).length>0?X:void 0}function xB($,Z){if(!$||Z.source!=="headers")return Z;let J=$.bindingWindowSource==="poll",X={...$,...Z,five_hour:TX($,Z,"five_hour"),seven_day:TX($,Z,"seven_day"),scoped:NB($,Z),extraUsage:$.extraUsage??Z.extraUsage,fallbackAdvised:Z.fieldSources?.fallbackAdvised!==void 0?Z.fallbackAdvised:$.fallbackAdvised??Z.fallbackAdvised,bindingWindow:J?$.bindingWindow:Z.bindingWindow??$.bindingWindow,bindingWindowSource:J?"poll":Z.bindingWindowSource??$.bindingWindowSource},Y=UB($,Z,X);return{...X,...Y&&{fieldSources:Y}}}function B7($){return $?.claustrum?.mode==="claustrum"?"claustrum":"local"}async function b9($){let J=`${$.path??x5()}.${$.name}.lock`,X=k8(J,"owner.json"),Y=K7(),G=$.now??Date.now,z=null,Q=!1;async function K(){try{return JSON.parse(await W7(J,"utf8"))}catch(H){if(H.code!=="EISDIR")throw H;return JSON.parse(await W7(X,"utf8"))}}async function W(){await V7(J,`${JSON.stringify({ownerId:Y,expiresAt:G()+$.ttlMs})}
+`,{encoding:"utf8",mode:384})}async function V(){try{return await V7(J,`${JSON.stringify({ownerId:Y,expiresAt:G()+$.ttlMs})}
+`,{encoding:"utf8",mode:384,flag:"wx"}),!0}catch(H){let j=H.code;if(j==="EEXIST"||j==="EISDIR")return!1;throw H}}function B(){if(!$.renew||Q)return;let H=$.renewIntervalMs??Math.max(1000,Math.floor($.ttlMs/3));if(z=XB(()=>{(async()=>{try{let j=await K(),x=G();if(Q||j?.ownerId!==Y||Number(j?.expiresAt)<=x)return;await W(),B()}catch{}})()},H),"unref"in z)z.unref()}let q=await V();if(!q){let H=`${J}.evicting`,j=k8(H,"owner.json"),x=K7(),N=5000,U=8;async function D(){await new Promise((S)=>setTimeout(S,Math.floor(Math.random()*4)))}async function A(){try{let S=await K();return Number(S?.expiresAt)>G()}catch{try{return(await IX(J)).mtimeMs+$.ttlMs>G()}catch{return!1}}}async function I(){try{return JSON.parse(await W7(j,"utf8"))?.ownerId===x}catch{return!1}}async function L(){await CV(H);try{await V7(j,`${JSON.stringify({ownerId:x,createdAt:G()})}
+`,{encoding:"utf8",mode:384,flag:"wx"})}catch(S){let f=S.code;if(f==="ENOENT"||f==="EINVAL")return!1;throw await w(),S}return await $.onStep?.("eviction-marker-acquired"),!0}async function w(){if(await I())await Z9(H,{recursive:!0,force:!0}).catch(()=>{})}for(let S=0;S<8;S++){if(q=await V(),q)break;if(await A())return null;try{if(!await L()){await D();continue}}catch(f){if(f.code!=="EEXIST")throw f;let s;try{s=await IX(H)}catch(O){if(O.code==="ENOENT"){await D();continue}throw O}if(s.mtimeMs+5000>G())return null;await $.onStep?.("stale-marker-stat");let _=`${H}.${K7()}`;try{await SV(H,_)}catch(O){if(O.code==="ENOENT"){await D();continue}throw O}await $.onStep?.("stale-marker-claimed"),await Z9(_,{recursive:!0,force:!0}).catch(()=>{}),await D();continue}try{if(await A())return null;if(!await I())return null;if(await $.onStep?.("stale-lock-confirmed"),!await I())return null;if(await Z9(J,{recursive:!0,force:!0}).catch(()=>{}),!await I())return null;if(q=await V(),!q)return null;if(!await I())return await Z9(J,{recursive:!0,force:!0}).catch(()=>{}),q=!1,null;break}finally{await w()}}}if(!q)return null;return B(),{assertOwned:async()=>{let H=await K().catch(()=>{return});if(Q||H?.ownerId!==Y)throw Error("Account file lock ownership was lost")},release:async()=>{if(Q=!0,z)YB(z),z=null;try{if((await K())?.ownerId!==Y)return}catch{return}await Z9(J,{recursive:!0,force:!0}).catch(()=>{})}}}function kw($){return $?.claudeCache?.enabled===!0}function DB($){return typeof $==="string"&&TG.includes($)?$:FG}function vw($){return DB($?.claudeCache?.mode)}function fw($){return $?.dump?.enabled===!0}function Ew($){return $?.claudeFast?.enabled===!0}function bw($){return $?.cacheKeep?.subagents===!0}function gw($){return $?.prime?.enabled===!0}function OB($){return $?.fallbackOn?.length?$.fallbackOn:QB}function yw($,Z){return OB(Z).includes($)}function D5($){let Z=$?.quota?.minimumRemaining||{};return{five_hour:Z.five_hour??Z["5h"]??wX.five_hour,seven_day:Z.seven_day??Z["1w"]??wX.seven_day}}function fG($){return $?.quota?.enabled!==!1}function MB($){let Z=$.status;if(typeof Z==="number"&&Number.isFinite(Z))return Z===429||Z>=500;return g$($)}function IB($){let J=($.previous?.accountIdentity===$.accountIdentity&&$.previous?.refreshTokenFingerprint===$.refreshTokenFingerprint?$.previous?.retryCount??0:0)+1,X=$.error.retryAfter,Y;if(typeof X==="number"&&X>0)Y=X*1000;else if(g$($.error))Y=r7;else if(MB($.error))Y=Math.min(KB,r7*2**Math.min(J-1,6));else Y=vG;let G=$.error.status,z=typeof G==="number"&&Number.isFinite(G)?G:void 0,Q=HZ($.error),W=(typeof $.error.body==="string"?$.error.body:"").includes("invalid_grant")||Q.includes("invalid_grant");return{message:Q,checkedAt:$.now,nextRetryAt:$.now+Y,retryCount:J,accountIdentity:$.accountIdentity,refreshTokenFingerprint:$.refreshTokenFingerprint,status:z,permanent:z===400&&W}}function T4($){if(!$)return!1;if(typeof $.permanent==="boolean")return $.permanent;if(typeof $.status==="number")return $.status===400;if(g$($))return!1;if(typeof $.nextRetryAt==="number")return $.nextRetryAt-$.checkedAt>=vG;return!1}function EG($){let Z=$.nextRetryAt;if(!Z||!g$($))return Z;return Math.min(Z,$.checkedAt+r7)}function hw($,Z,J,X){if(!$)return!1;let Y=EG($);if(!Y||Y<=J)return!1;if($.refreshTokenFingerprint&&X&&$.refreshTokenFingerprint!==X)return!1;if(!$.accountIdentity)return!0;if(!Z)return!0;return $.accountIdentity===Z}function mw($,Z){return`Claude OAuth refresh is backed off for ${Math.max(1,Math.ceil(((EG($)??Z)-Z)/1000))}s after: ${$.message}`}function uw($){if(!$)return[];return $.accounts.filter((Z)=>Z.enabled!==!1&&n0(Z)&&T4(Z.lastRefreshError)).map((Z)=>Z.label?.trim()||Z.id)}function _B($){if($.status===403)return!0;return/Claude quota check failed: 403\b/.test(HZ($))}function e7($){let J=($.previous?.accountIdentity===$.accountIdentity?$.previous?.retryCount??0:0)+1,X=vB($.error)?Math.min(VB,WB*2**Math.min(J-1,6)):BB;return{message:HZ($.error),checkedAt:$.now,nextRetryAt:$.now+X,retryCount:J,...$.accountIdentity!==void 0&&{accountIdentity:$.accountIdentity}}}function h1($,Z){if(!$?.nextRetryAt||$.nextRetryAt<=Z)return!1;return!0}function pw($,Z){return`Quota API backed off for ${Math.max(1,Math.ceil((($.nextRetryAt??Z)-Z)/1000))}s after: ${$.message}`}function M9($){let Z=$?.quota?.checkIntervalMinutes??qB;return Math.max(1,Z)*60000}function cw($){return $?.logging?.level}function PB($){let Z=$?.quota?.mainQuota;if(!Z)return null;return{quota:Z,checkedAt:o0(Z),tokenFingerprint:$.quota?.mainQuotaToken,accountIdentity:Z.accountIdentity}}function AB($){let Z=$?.quota?.refreshEveryNRequests;return typeof Z==="number"&&Number.isFinite(Z)&&Z>0?Math.floor(Z):0}function $J($){return $?.quota?.failClosedOnUnknownQuota??jB}function bG($){return $.toLowerCase().replace(/[^a-z0-9]/g,"")}function wB($){if(typeof $!=="string")return null;let Z=bG($);if(Z.includes("fable"))return"fable";if(Z.includes("mythos"))return"mythos";return Z}function o$($,Z){let J=wB(Z);if(!J)return;return $?.scoped?.find((X)=>{return[X.modelId,X.modelName,X.title].filter((G)=>typeof G==="string").map(bG).join(" ").includes(J)})}function RB($,Z){let J=o$($,Z);return Boolean(J&&Number.isFinite(J.remainingPercent)&&J.remainingPercent<=0)}function gG($,Z){return!RB($,Z)}function TB($,Z){if(!fG(Z))return!0;let J=D5(Z);for(let X of["five_hour","seven_day"]){let Y=$?.[X];if(!Y)return!$J(Z);if(!Number.isFinite(Y.remainingPercent))return!$J(Z);if(Y.remainingPercent<J[X])return!1}return!0}function lw($){return Boolean($?.five_hour&&$.seven_day)}var I8={five_hour:5,seven_day:10,scoped:0};function F4($){let Z=$?.five_hour??$?.["5h"],J=$?.seven_day??$?.["1w"],X=$?.scoped;return{five_hour:typeof Z==="number"&&Number.isFinite(Z)?Z:I8.five_hour,seven_day:typeof J==="number"&&Number.isFinite(J)?J:I8.seven_day,scoped:typeof X==="number"&&Number.isFinite(X)?X:I8.scoped}}function yG($){return $?.killswitch?.enabled===!0}function hG($,Z){if(!$?.killswitch)return I8;if(Z&&$.killswitch.accounts?.[Z])return F4($.killswitch.accounts[Z]);return F4($.killswitch.main)}function mG($,Z,J,X){if(!yG(Z))return!0;let Y=hG(Z,J),G=!1;for(let z of["five_hour","seven_day"]){let Q=$?.[z];if(!Q||!Number.isFinite(Q.remainingPercent)){if(Y[z]>0)return!1;G=!0;continue}if(Q.remainingPercent<Y[z])return!1}if(X){if(Y.scoped>0&&$?.scoped===void 0)return!1;let z=o$($,X);if(z&&(!Number.isFinite(z.remainingPercent)&&Y.scoped>0||z.remainingPercent<=Y.scoped))return!1}if(G)return!$J(Z);return!0}function FB($,Z,J,X){let Y=[],G=[$,...Z.map((z)=>z.quota)];for(let z of G)if(X){let K=o$(z,X)?.resetsAt;if(!K)continue;let W=Date.parse(K);if(Number.isFinite(W)&&W>J)Y.push(W)}else for(let Q of["five_hour","seven_day"]){let K=z?.[Q]?.resetsAt;if(!K)continue;let W=Date.parse(K);if(Number.isFinite(W)&&W>J)Y.push(W)}if(!Y.length)return 300;return Math.max(1,Math.ceil((Math.min(...Y)-J)/1000))+60}function dw($){return $?.killswitch??{enabled:!1}}function B8($,Z,J){let X=M9(Z);if(!fG(Z))return J+X;let Y=Math.min(...[...["five_hour","seven_day"].map((K)=>$?.[K]?.checkedAt),...($?.scoped??[]).map((K)=>K.checkedAt)].filter((K)=>Number.isFinite(K)).map((K)=>K+X)),G=(K)=>Number.isFinite(Y)?Math.min(K,Y):K,z=D5(Z),Q=[];for(let K of["five_hour","seven_day"]){let W=$?.[K];if(!W)return G(J+X);if(W.remainingPercent>=z[K])continue;let V=W.resetsAt?Date.parse(W.resetsAt):Number.NaN;if(!Number.isFinite(V)||V<=J)return G(J+X);Q.push(V)}if(!Q.length)return G(J+X);return G(Math.min(...Q)+60000)}function C4($){if(!Number.isFinite($))return 0;if($<0)return 0;if($>100)return 100;return $}function j0($){return typeof $==="string"&&$.trim()?$.trim():void 0}function uG($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}function CB($,Z){if(!Array.isArray($))return[];let J=new Set,X=[];for(let Y of $){if(Y?.kind!=="weekly_scoped"||Y.group!=="weekly")continue;if(typeof Y.percent!=="number"||!Number.isFinite(Y.percent))continue;let G=j0(Y.scope?.model?.display_name);if(!G)continue;let z=j0(Y.scope?.model?.id)??G,Q=uG(z);if(!Q)continue;let K=`claude-weekly-scoped-${Q}`;if(J.has(K))continue;J.add(K);let W=C4(Y.percent),V=j0(Y.scope?.model?.id);X.push({id:K,title:`${G} only`,...V&&{modelId:V},modelName:G,usedPercent:W,remainingPercent:C4(100-W),resetsAt:Y.resets_at??void 0,checkedAt:Z})}return X}function SB($){if($.extra_usage?.is_enabled!==!0)return;let Z=$.extra_usage.used_credits,J=$.extra_usage.monthly_limit;if(typeof Z!=="number"||!Number.isFinite(Z)||typeof J!=="number"||!Number.isFinite(J))return;let X=$.spend?.limit?.currency,Y=X==null?"USD":j0(X),G=$.spend?.limit?.exponent,z=G==null?2:G;if(!Y||!/^[A-Za-z]{3}$/.test(Y)||!Number.isInteger(z)||z<0||z>20)return;return{used:{amountMinor:Z,currency:Y,exponent:z},limit:{amountMinor:J,currency:Y,exponent:z},...typeof $.extra_usage.utilization==="number"&&Number.isFinite($.extra_usage.utilization)&&{utilizationPercent:$.extra_usage.utilization},...j0($.spend?.severity)&&{severity:j0($.spend?.severity)},exhausted:Z>=J}}function kB($){if(!Array.isArray($))return;let Z=$.find((G)=>G?.is_active===!0);if(!Z)return;if(Z.kind==="session")return"five_hour";if(Z.kind==="weekly_all")return"seven_day";if(Z.kind!=="weekly_scoped"||Z.group!=="weekly")return;let J=j0(Z.scope?.model?.display_name);if(!J)return;let X=j0(Z.scope?.model?.id)??J,Y=uG(X);return Y?`claude-weekly-scoped-${Y}`:void 0}function FX($,Z){if(typeof $?.utilization!=="number")return;if(!Number.isFinite($.utilization))return;let J=C4($.utilization);return{usedPercent:J,remainingPercent:C4(100-J),resetsAt:$.resets_at??void 0,checkedAt:Z}}async function S4($){U5($.accessToken,"anthropic");let J=await($.fetchImpl??fetch)(zB,{method:"GET",headers:{Authorization:`Bearer ${$.accessToken}`,Accept:"application/json","Content-Type":"application/json","anthropic-beta":"oauth-2025-04-20","User-Agent":`claude-code/${r9}`}});if(!J.ok){let K=await J.text().catch(()=>"");throw Object.assign(Error(`Claude quota check failed: ${J.status} — ${K}`),{status:J.status,retryAfter:CG(J.headers.get("Retry-After"))})}let X=$.now?.()??Date.now(),Y=await J.json(),G=kB(Y.limits),z={five_hour:FX(Y.five_hour,X),seven_day:FX(Y.seven_day,X),scoped:CB(Y.limits,X),extraUsage:SB(Y),...G&&{bindingWindow:G,bindingWindowSource:"poll"},source:"poll",checkedAt:X},Q={...z.five_hour&&{five_hour:"poll"},...z.seven_day&&{seven_day:"poll"},...z.scoped&&{scoped:"poll"},...z.extraUsage&&{extraUsage:"poll"},...z.bindingWindow&&{bindingWindow:"poll"}};return{...z,...Object.keys(Q).length>0&&{fieldSources:Q}}}function iw($,Z){if(!$||$.authLineageId!==Z)return null;return $.anthropicAccountUuid??null}function HZ($){return $ instanceof Error?$.message:String($)}function vB($){let Z=$.status;if(typeof Z==="number"&&Number.isFinite(Z)){if(Z===429||Z>=500)return!0}let J=HZ($);if(/Claude quota check failed: (429|5\d\d)\b/.test(J))return!0;if(J.includes("Quota refresh is already in progress"))return!0;return g$($)}var pG="## Claude Cache Status",fB="## Claude Cache Enabled",EB="## Claude Cache Disabled",bB="## Claude Cache Usage",gB="Usage: `/claude-cache`, `/claude-cache on`, `/claude-cache off`, or `/claude-cache mode explicit|automatic|hybrid`.",LZ=!1,NZ=FG;function sw(){return LZ}function tw(){return NZ}function aw($){LZ=$.enabled,NZ=$.mode}function yB($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="on")return{type:"enable"};if(Z.length===1&&Z[0]==="off")return{type:"disable"};if(Z.length===2&&Z[0]==="mode"&&(Z[1]==="explicit"||Z[1]==="automatic"||Z[1]==="hybrid"))return{type:"mode",mode:Z[1]};return{type:"usage"}}function X9($){let Z=$?.enabled??LZ,J=$?.mode??NZ;return[pG,"",`- Enabled: ${Z?"enabled":"disabled"}`,`- Mode: ${J}`,"- Persisted: ~/.config/opencode/anthropic-auth.json","- Scope: main sessions only; subagent sessions keep default ephemeral cache behavior","- Modes: explicit = existing OpenCode breakpoints; automatic = top-level cache_control only; hybrid = system + messages[0] + top-level cache_control","- TTL: 1h when enabled for main sessions; default ephemeral cache behavior otherwise"].join(`
+`)}function nw($){let Z=yB($.argumentsText),J=$.enabled??LZ,X=$.mode??NZ;if(Z.type==="status")return X9({enabled:J,mode:X});if(Z.type==="enable")return[fB,"",X9({enabled:!0,mode:X})].join(`
+`);if(Z.type==="disable")return[EB,"",X9({enabled:!1,mode:X})].join(`
+`);if(Z.type==="mode")return[pG,"",`Mode updated to \`${Z.mode}\`.`,"",X9({enabled:J,mode:Z.mode})].join(`
+`);return[bB,"",gB,"",X9({enabled:J,mode:X})].join(`
+`)}var mB=/^req_[A-Za-z0-9_-]{8,128}$/,uB=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,pB=/ cc_(?:prev_req|prompt_id)=[^;\r\n]*;/g;function cB($){return mB.test($)}function lB($){return uB.test($)}var dB=0x4d659218e32a3268n,iB="cch=00000;";var O5=/("system":\[\{"type":"text","text":"x-anthropic-billing-header: cc_version=[^;"]+; cc_entrypoint=[^;"]+; )cch=([0-9a-f]{5});/,sB=/("system":\[\{"type":"text","text":"x-anthropic-billing-header: cc_version=[^;"]+; cc_entrypoint=[^;"]+; )cch=00000;/,CX=null,k4=null;async function cG(){if(k4)return;CX??=(async()=>{k4=(await R2()).h64Raw})(),await CX}function lG($){let Z=$.find((X)=>X.role==="user");if(!Z)return"";let{content:J}=Z;if(typeof J==="string")return J;if(Array.isArray(J)){let X=J.filter((z)=>z.type==="text"),Y=X.find((z)=>z.text?.includes("<command-name>"));if(Y?.text)return Y.text.slice(Y.text.indexOf("<command-name>"));let G=X.findLast((z)=>typeof z.text==="string"&&z.text.length>0);if(G?.text)return G.text}return""}class tB{limit;#$=new Map;constructor($=1000){this.limit=$}resolve($,Z,J=!0){let X=this.#$.get($);if(X!==void 0)return this.#$.delete($),this.#$.set($,X),X;let Y=lG(Z);if(J){if(!this.#$.has($)&&this.#$.size>=this.limit){let G=this.#$.keys().next().value;if(G!==void 0)this.#$.delete(G)}this.#$.set($,Y)}return Y}has($){return this.#$.has($)}clear(){this.#$.clear()}}async function aB($){return await cG(),((k4?.($,dB)??0n)&0xfffffn).toString(16).padStart(5,"0")}async function ew($){return await cG(),(k4?.(new TextEncoder().encode($),0n)??0n).toString(16).padStart(16,"0").slice(0,16)}function nB($){return $.replace(O5,`$1${iB}`)}function oB($){return O5.exec($)?.[2]??null}async function rB($){if(!O5.test($))return $;let Z=nB($),J=JSON.parse(Z);if("model"in J)J.model="";delete J.max_tokens;let X=await aB(new TextEncoder().encode(JSON.stringify(J)));return Z.replace(sB,`$1cch=${X};`)}function eB($,Z=r9){let J=tV.map((X)=>$[X]??"0").join("");return hB("sha256").update(`${sV}${J}${Z}`).digest("hex").slice(0,3)}function $R($,Z=r9,J,X,Y){let G=eB(X??lG($),Z),z=`x-anthropic-billing-header: cc_version=${Z}.${G}; cc_entrypoint=${J}; cch=00000;`;if(Y?.previousRequestId&&cB(Y.previousRequestId))z+=` cc_prev_req=${Y.previousRequestId};`;if(Y?.promptId&&lB(Y.promptId))z+=` cc_prompt_id=${Y.promptId};`;return z}function $q($){return $.replace(pB,"")}function Zq($){if(!$||typeof $!=="object")return 0;let Z=$.system;if(!Array.isArray(Z))return 0;let J=0;for(let X of Z){if(!X||typeof X!=="object")continue;let Y=X.text;if(typeof Y!=="string"||!Y.startsWith("x-anthropic-billing-header:"))continue;let G=$q(Y);if(G===Y)continue;X.text=G,J+=1}return J}var Xq=1000,N6=new Map;function H$($,Z,J,X=Xq){if(!$.has(Z)&&$.size>=X){let Y=$.keys().next().value;if(Y!==void 0)$.delete(Y)}$.set(Z,J)}function q7($,Z){if(!Z.accountUuid)return Z;if(N6.get($)!==Z)return{...Z,accountUuid:void 0};let J={...Z,accountUuid:void 0};return H$(N6,$,J),J}function v4($){let Z=$||"anonymous",J=N6.get(Z);if(J)return J;let X={deviceId:Jq(32).toString("hex"),sessionId:dG()};return H$(N6,Z,X),X}var Yq=86400000,Gq=300000,m1=new Map,SX=new Map;function zq($){return`compat:${$||"anonymous"}`}function M5($){return`identity:${$}`}function f4($,Z){return`account:${$}:${Z}`}function u1($,Z,J){if(!$)return;if($.accountIdentity!==void 0&&$.accountIdentity!==Z)return;if(J!==void 0&&$.accountUuid!==void 0&&$.accountUuid!==J)return;if($.accountIdentity===Z&&(J===void 0||$.accountUuid===J))return $;return{...$,accountIdentity:Z,...J!==void 0&&{accountUuid:J}}}function H9($,Z,J){H$(N6,M5(Z),$),H$(N6,f4(J,Z),$)}async function Qq($,Z){if(!$.startsWith("sk-ant-oat"))return null;let J=new AbortController,X=setTimeout(()=>J.abort(),5000);try{let Y=new URL("https://api.anthropic.com/api/claude_cli/bootstrap");if(Y.searchParams.set("entrypoint",RG),Z)Y.searchParams.set("model",Z);let G=await fetch(Y,{method:"GET",redirect:"error",headers:{accept:"application/json, text/plain, */*",authorization:`Bearer ${$}`,"content-type":"application/json","anthropic-beta":"oauth-2025-04-20","user-agent":`claude-code/${r9}`},signal:J.signal});if(!G.ok)return null;let Q=(await G.json().catch(()=>null))?.oauth_account?.account_uuid;return typeof Q==="string"&&Q?Q:null}catch{return null}finally{clearTimeout(X)}}function JR($,Z){if(!$.trim()||!Z.trim())throw Error("A verified provider account identity is required");let X={...N6.get(f4(Z,$))??v4(M5($)),accountIdentity:$,accountUuid:Z};return H9(X,$,Z),X}async function iG($,Z,J){let X=J?.trim()||void 0,Y=X?M5(X):zq($),G;if(X)G=u1(N6.get(Y)??N6.get($),X)??v4(Y),G=u1(G,X)??G,H$(N6,Y,G);else G=N6.get(Y)??N6.get($)??v4(Y),H$(N6,Y,G),H$(N6,$,G);if(!$.startsWith("sk-ant-oat"))return q7(Y,G);let z=Date.now(),Q=`${Y}:${$}`,K=SX.get(Q);if(K&&K.expiresAt>z){if(!K.accountUuid)return G=q7(Y,G),G;if(!X){if(G.accountUuid===K.accountUuid)return G;return G={...G,accountUuid:K.accountUuid},H$(N6,Q,G),G}let q=u1(N6.get(f4(K.accountUuid,X))??N6.get(`account:${K.accountUuid}`),X,K.accountUuid);if(q)return G=q,H9(G,X,K.accountUuid),G;if(G.accountUuid===K.accountUuid)return G;return G={...G,accountIdentity:X,accountUuid:K.accountUuid},H9(G,X,K.accountUuid),G}let W=m1.get(Q);if(!W)W=Qq($,Z),H$(m1,Q,W);let V=await W.finally(()=>{if(m1.get(Q)===W)m1.delete(Q)});if(H$(SX,Q,{accountUuid:V,expiresAt:z+(V?Yq:Gq)}),!V)return G=q7(Y,G),G;if(!X)return G={...G,accountUuid:V},H$(N6,Q,G),G;let B=u1(N6.get(f4(V,X))??N6.get(`account:${V}`),X,V);if(B)return G=B,H9(G,X,V),G;return G={...G,accountIdentity:X,accountUuid:V},H9(G,X,V),G}class I5 extends Error{code="unsupported-access";constructor(){super("Claude OAuth access credential is not supported; sign in to this account again");this.name="ClaudeUnsupportedAccessError"}}async function Kq($,Z,J){if(typeof $!=="string"||!$.startsWith("sk-ant-oat"))throw new I5;return iG($,Z,J)}function u0($){return $!=null&&typeof $==="object"&&!Array.isArray($)}function Wq($){if(!$.accountUuid)return null;return JSON.stringify({device_id:$.deviceId,account_uuid:$.accountUuid,session_id:$.sessionId})}function XR($,Z){let J=Wq(Z);if(!J){if(u0($.metadata))delete $.metadata.user_id;return!1}if(!u0($.metadata))$.metadata={};let X=$.metadata;if(u0(X))X.user_id=J;return!0}var Vq=["oauth-2025-04-20","interleaved-thinking-2025-05-14","thinking-token-count-2026-05-13","context-management-2025-06-27","prompt-caching-scope-2026-01-05","claude-code-20250219","advisor-tool-2026-03-01","advanced-tool-use-2025-11-20","mid-conversation-system-2026-04-07","effort-2025-11-24","fallback-credit-2026-06-01","extended-cache-ttl-2025-04-11","cache-diagnosis-2026-04-07"],Bq=["oauth-2025-04-20","interleaved-thinking-2025-05-14","thinking-token-count-2026-05-13","context-management-2025-06-27","prompt-caching-scope-2026-01-05","advisor-tool-2026-03-01","structured-outputs-2025-12-15","cache-diagnosis-2026-04-07"],kX=["oauth-2025-04-20","interleaved-thinking-2025-05-14","thinking-token-count-2026-05-13","context-management-2025-06-27","prompt-caching-scope-2026-01-05","advisor-tool-2026-03-01","advanced-tool-use-2025-11-20","extended-cache-ttl-2025-04-11","cache-diagnosis-2026-04-07"];function qq($){return $.output_config?.format?.type==="json_schema"}function jq($){return Array.isArray($.tools)&&$.tools.length>0&&Array.isArray($.system)&&u0($.thinking)&&u0($.context_management)&&u0($.output_config)&&u0($.diagnostics)}function Hq($,Z=[]){let J=$?jq($)?[...Vq]:qq($)?[...Bq]:[...kX]:[...kX];if($?.speed==="fast")J.push(iV);for(let X of Z){let Y=X.trim();if(Y)J.push(Y)}return[...new Set(J)].join(",")}function Lq(){switch(process.platform){case"darwin":return"MacOS";case"win32":return"Windows";case"linux":return"Linux";case"freebsd":return"FreeBSD";default:return"Unknown"}}function Nq(){switch(process.arch){case"arm64":return"arm64";case"x64":return"x64";case"ia32":return"x32";default:return process.arch}}function YR($,Z,J={}){let X=J.identity??v4(Z),G=[...($.get("anthropic-beta")??"").split(",").map((z)=>z.trim()).filter(Boolean),...J.extraBetas??[]];return $.set("accept","application/json"),$.set("authorization",`Bearer ${Z}`),$.set("content-type","application/json"),$.set("user-agent",oV),$.set("anthropic-beta",Hq(J.body,G)),$.set("anthropic-dangerous-direct-browser-access","true"),$.set("anthropic-version","2023-06-01"),$.set("x-app","cli"),$.set("x-client-request-id",dG()),$.set("x-claude-code-session-id",X.sessionId),$.set("x-stainless-arch",Nq()),$.set("x-stainless-lang","js"),$.set("x-stainless-os",Lq()),$.set("x-stainless-package-version",aV),$.set("x-stainless-retry-count","0"),$.set("x-stainless-runtime","node"),$.set("x-stainless-runtime-version",nV),$.set("x-stainless-timeout","600"),$.delete("x-api-key"),$}var Uq=["model","messages","system","tools","tool_choice","metadata","max_tokens","temperature","thinking","context_management","output_config","diagnostics","stream","speed"];function xq($){let Z={};for(let J of Uq)if(Object.hasOwn($,J))Z[J]=$[J];for(let[J,X]of Object.entries($))if(!Object.hasOwn(Z,J))Z[J]=X;return Z}function m8($){try{return JSON.parse($)}catch(Z){if(Z instanceof SyntaxError)throw SyntaxError("invalid JSON");throw Z}}var JJ={error:0,warn:1,info:2,debug:3,trace:4},Aq=new Set(Object.keys(JJ));function XJ($){if(!$)return null;let Z=$.trim().toLowerCase();return Aq.has(Z)?Z:null}var wq=XJ(process.env.OPENCODE_ANTHROPIC_AUTH_LOG_LEVEL),_5=wq??"info";function Rq($){_5=$}function Tq(){return _5}function P5($){return JJ[$]<=JJ[_5]}var N8=process.env.OPENCODE_ANTHROPIC_AUTH_LOG_FILE??nG.join(aG.tmpdir(),"opencode-anthropic-auth.log");var Fq=5242880,fX=3;function Cq(){try{if(!D$.existsSync(N8))return;if(D$.statSync(N8).size<Fq)return}catch{return}try{for(let $=fX;$>=1;$--){let Z=$===1?N8:`${N8}.${$-1}`,J=`${N8}.${$}`;try{if($===fX)try{D$.unlinkSync(J)}catch{}if(D$.existsSync(Z))D$.renameSync(Z,J)}catch{}}}catch{}}var Sq=/^(authorization|x-api-key|cookie|set-cookie|refresh|access|token|handle)$/i;function oG($){if(Sq.test($))return!0;let Z=$.toLowerCase().replace(/[-_]/g,"");if(Z.includes("apikey"))return!0;if(Z.endsWith("secret")||Z.endsWith("password"))return!0;if(Z.endsWith("token")&&!Z.endsWith("tokens"))return!0;return!1}var kq=[/Bearer\s+\S+/,/sk-[A-Za-z0-9-]+/,/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/,lV];function vq($){if(typeof $!=="string")return!1;return kq.some((Z)=>Z.test($))}function rG($){if($==null||Object.keys($).length===0)return;let Z=new WeakSet;function J(X){if(X==null||typeof X!=="object"){if(vq(X))return"***REDACTED***";return X}if(Z.has(X))return"[Circular]";Z.add(X);try{if(Array.isArray(X))return X.map(J);let Y=X,G={};for(let[z,Q]of Object.entries(Y)){if(oG(z)){G[z]="***REDACTED***";continue}G[z]=J(Q)}return G}finally{Z.delete(X)}}return J($)}function fq($,Z,J,X){let Y=new Date().toISOString(),G=$.toUpperCase().padEnd(5),z=Z?` [${Z}]`:"",Q=(()=>{try{let K=rG(X),W=K?{...K,pid:process.pid}:{pid:process.pid};return` ${JSON.stringify(W)}`}catch{return` {"pid":${process.pid},"payload":"[unserializable]"}`}})();return`[${Y}] ${G}${z} ${J}${Q}`}var EX=null;function b0($,Z,J,X){if(!P5($))return;if(EX)try{EX({level:$,channel:Z,message:J,payload:rG(X)})}catch{}if(xZ)return;try{let Y=`${fq($,Z,J,X)}
+`;if(_9.push(Y),_9.length>=bq)A5();else gq()}catch{}}var t={error($,Z,J){b0("error",$,Z,J)},warn($,Z,J){b0("warn",$,Z,J)},info($,Z,J){b0("info",$,Z,J)},debug($,Z,J){b0("debug",$,Z,J)},trace($,Z,J){b0("trace",$,Z,J)}},xZ=!1,Eq=500,bq=50,_9=[],_8=null;function A5(){if(_8)clearTimeout(_8),_8=null;if(_9.length===0)return;let $=_9.join("");_9=[];try{Cq(),D$.appendFileSync(N8,$)}catch{}}function gq(){if(_8)return;_8=setTimeout(()=>{_8=null,A5()},Eq)}var yq=/^\[([\w-]+)\]\s*/;function WR($,Z){if(!P5("debug"))return;if(xZ)return;try{let J="",X=$,Y=$.match(yq);if(Y)J=Y[1]??"",X=$.slice(Y[0].length);let G;if(Z!=null){if(Z instanceof Error)G={error:`${Z.message}${Z.stack?`
+${Z.stack}`:""}`};else if(typeof Z==="object")G=Z}b0("debug",J,X,G)}catch{}}function q6($,Z){if(!P5("debug"))return;if(xZ)return;try{let J;if(Z!=null){if(typeof Z==="object"&&!(Z instanceof Error))J=Z}b0("debug","relay",$,J)}catch{}}if(!xZ)process.on("exit",A5);var hq="## Claude Dump Status",mq="## Claude Dump Enabled",uq="## Claude Dump Disabled",pq="## Claude Dump Usage",cq="Usage: `/claude-dump`, `/claude-dump on`, or `/claude-dump off`.",lq="OPENCODE_ANTHROPIC_AUTH_DUMP_DIR",dq="OPENCODE_ANTHROPIC_AUTH_DUMP_MAX_BYTES",iq=UZ(Pq(),"opencode-anthropic-auth-dumps"),sq=536870912,tq=300000,aq=60000,nq=600000,w5=/\.(body|meta|relay|request|response)\.json$/,eG=/^\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z-\d{5,}-(.+)$/,E4="[a-zA-Z0-9._-]",$z=new RegExp(`^${E4}{1,80}-direct(?:-${E4}{1,80})?$`),Zz=new RegExp(`^${E4}{1,80}-(?:http|websocket)-p[12]-(?:full_sync|patch)$`),oq=new RegExp(`^-direct(?:-${E4}{1,80})?$`),rq=/^-(?:http|websocket)-p[12]-(?:full_sync|patch)$/,e9=!1,bX=0,gX=0,eq=100,U8=new Map;function VR($){e9=$}function $1(){return process.env[lq]||iq}function $j(){let $=Number(process.env[dq]);return Number.isFinite($)&&$>=0?Math.floor($):sq}function Zj($){return I9($)===I9($1())}function YJ($){let Z=$.replace(w5,"");if(Z===$)return!1;let X=eG.exec(Z)?.[1];if(!X)return!1;return $z.test(X)||Zz.test(X)}function Jj($){if(!$.endsWith(".partial"))return!1;let Z=$.slice(0,-8);if(YJ(Z))return!0;let J=Z.lastIndexOf(".");if(J<0)return!1;let X=Z.slice(J+1);return/^[a-f0-9]{24}$/.test(X)&&YJ(Z.slice(0,J))}async function L9($,Z){for(let J=0;J<2;J+=1){let X=Oq(12).toString("hex"),Y=`${$}.${X}.partial`,G=!1;try{return await _q(Y,Z,{encoding:"utf8",flag:"wx"}),G=!0,await Iq(Y,$),!0}catch(z){if(z.code==="EEXIST")continue;if(G)await tG(Y).catch(()=>{});throw z}}return!1}async function Xj($){let Z=$.dumpDir??$1(),J=$.maxBytes??$j(),X=$.now??Date.now(),Y=$.minAgeMs??aq,G=$.partialStaleMs??nq,z={removed:0,freedBytes:0};if(!Zj(Z)||J<=0)return z;try{if((await ZJ(Z)).isSymbolicLink())return z;let K=new Set(($.protectedPaths??[]).map((D)=>I9(D))),W=await sG(Z,{withFileTypes:!0}),V=[];await Promise.all(W.map(async(D)=>{if(!D.isFile())return;let A=Jj(D.name);if(!A&&!YJ(D.name))return;let I=UZ(Z,D.name);try{let L=await ZJ(I);if(!L.isFile()||L.isSymbolicLink())return;V.push({path:I,size:L.size,mtimeMs:L.mtimeMs,partial:A,...!A&&{artifactGroup:D.name.replace(w5,"")}})}catch{}}));let B=V.reduce((D,A)=>D+A.size,0),q=0,H=0,j=async(D)=>{try{await tG(D.path),B-=D.size,H+=D.size,q+=1}catch{}},x=V.filter((D)=>D.partial).sort((D,A)=>D.mtimeMs-A.mtimeMs||D.path.localeCompare(A.path));for(let D of x){if(K.has(I9(D.path)))continue;if(X-D.mtimeMs<G)continue;await j(D)}let N=new Map;for(let D of V){if(D.partial||!D.artifactGroup)continue;let A=N.get(D.artifactGroup)??{files:[],newestMtimeMs:0};A.files.push(D),A.newestMtimeMs=Math.max(A.newestMtimeMs,D.mtimeMs),N.set(D.artifactGroup,A)}let U=[...N.entries()].sort(([D,A],[I,L])=>A.newestMtimeMs-L.newestMtimeMs||D.localeCompare(I));for(let[,D]of U){if(B<=J)break;if(X-D.newestMtimeMs<Y)continue;if(D.files.some((A)=>K.has(I9(A.path))))continue;for(let A of D.files)await j(A)}if(q>0)t.debug("dump","removed old dump files",{removed:q,freedBytes:H});return{removed:q,freedBytes:H}}catch{return z}}function Yj($,Z){let J=Date.now();if(J-gX<tq)return;gX=J,Xj({dumpDir:$,protectedPaths:Z}).catch(()=>{})}function Gj($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="on")return{type:"enable"};if(Z.length===1&&Z[0]==="off")return{type:"disable"};return{type:"usage"}}function p1($){let Z=$?.enabled??e9;return[hq,"",`- Enabled: ${Z?"enabled":"disabled"}`,`- Directory: ${$1()}`,"- Persisted: ~/.config/opencode/anthropic-auth.json","- Captures: final rewritten Anthropic body in direct and relay modes; request/relay metadata is redacted","- Warning: body dumps may contain prompt/session content; turn this off after debugging"].join(`
+`)}function BR($){let Z=Gj($.argumentsText),J=$.enabled??e9;if(Z.type==="status")return p1({enabled:J});if(Z.type==="enable")return[mq,"",p1({enabled:!0})].join(`
+`);if(Z.type==="disable")return[uq,"",p1({enabled:!1})].join(`
+`);return[pq,"",cq,"",p1({enabled:J})].join(`
+`)}function K4($){return $.length<=16?$:`${$.slice(0,12)}…`}function b4($,Z=80){let J=$.trim().replace(/[^a-zA-Z0-9._-]+/g,"-").replace(/^-+|-+$/g,"");if(!J)return"session-unknown";return J.length<=Z?J:J.slice(0,Z)}function zj($){if($.transport!=="direct")return`${$.transport}-p${$.protocol}-${$.mode}`;return`direct${$.route?`-${b4($.route)}`:""}`}function Jz($){if($==="cachekeep")return"-prewarm-cachekeep";if($==="start")return"-start";return""}function Qj($){let Z=$.affinity?.trim();if(Z)return`session:${Z}`;return`request:${$.route??"direct"}:${$.url??""}`}function Kj($,Z){if(!$.endsWith(".body.json"))return;let J=$.replace(w5,""),X=eG.exec(J)?.[1];if(!X||!$z.test(X)&&!Zz.test(X))return;let Y=Jz("cachekeep"),G=[{prefix:b4(Z),tag:null},{prefix:`${b4(Z,80-Y.length)}${Y}`,tag:"cachekeep"}];for(let z of G){if(!X.startsWith(`${z.prefix}-`))continue;let Q=X.slice(z.prefix.length);if(oq.test(Q)||rq.test(Q))return z.tag}return}async function Wj($){let Z=$.affinity?.trim();if(!Z)return;let J=$1(),X;try{X=await sG(J)}catch{return}let Y=X.map((G)=>({name:G,tag:Kj(G,Z)})).filter((G)=>G.tag!==void 0).sort((G,z)=>z.name.localeCompare(G.name));for(let G of Y)try{let z=UZ(J,G.name),Q=z.replace(/\.body\.json$/,".meta.json");if(!(await ZJ(z)).isFile())continue;let K=JSON.parse(await vX(Q,"utf8"));if(K.session!==K4(Z)||(G.tag===null?K.tag!=null:K.tag!==G.tag))continue;return await vX(z,"utf8")}catch{}return}function Vj($,Z){if(!U8.has($))while(U8.size>=eq){let J=U8.keys().next().value;if(J===void 0)break;U8.delete(J)}U8.set($,Z)}function Bj($){if($==null)return;return Object.fromEntries(new Headers($).entries())}function Xz($){return Dq("sha256").update($).digest("hex")}function qj($){return oB($)}function jj($,Z){if($==null)return null;if($===Z)return{changed:!1,firstByte:-1,lastPreviousByte:-1,lastCurrentByte:-1,previousBytes:$.length,currentBytes:Z.length};let J=0;while(J<$.length&&J<Z.length&&$[J]===Z[J])J+=1;let X=$.length-1,Y=Z.length-1;while(X>=J&&Y>=J&&$[X]===Z[Y])X-=1,Y-=1;return{changed:!0,firstByte:J,lastPreviousByte:X,lastCurrentByte:Y,changedPreviousBytes:X-J+1,changedCurrentBytes:Y-J+1,previousBytes:$.length,currentBytes:Z.length}}function Hj($){try{let Z=m8($);return Z!=null&&typeof Z==="object"&&!Array.isArray(Z)?Z:null}catch{return q6("dump body parse failed"),null}}function j7($){return Xz(JSON.stringify($))}function Lj($){let Z=Hj($);if(!Z)return{parseable:!1};let J=Array.isArray(Z.messages)?Z.messages:[],X=Array.isArray(Z.system)?Z.system:[],Y=J[0],G=J.slice(1);return{parseable:!0,model:typeof Z.model==="string"?Z.model:void 0,stream:Z.stream,systemCount:X.length,messagesCount:J.length,systemHash:j7(X),message0Hash:Y===void 0?null:j7(Y),message0Bytes:Y===void 0?0:JSON.stringify(Y).length,messagesAfter0Hash:j7(G),messagesAfter0Bytes:JSON.stringify(G).length,cch:qj($)}}function g4($){if(Array.isArray($))return $.map(g4);if($==null||typeof $!=="object")return $;let Z={};for(let[J,X]of Object.entries($)){let Y=J.toLowerCase();if(Y==="authorization"||Y==="x-api-key"||Y==="cookie"||Y==="set-cookie"||oG(J)){Z[J]="[redacted]";continue}Z[J]=g4(X)}return Z}async function Yz($){if(!e9)return null;bX+=1;let Z=$.affinity?.trim()||"session-unknown",J=Jz($.tag),X=`${new Date().toISOString().replace(/[:.]/g,"-")}-${String(bX).padStart(6,"0")}-${b4(Z,80-J.length)}${J}-${zj($)}`,Y=$1(),G=UZ(Y,X),z={body:`${G}.body.json`,metadata:`${G}.meta.json`,response:`${G}.response.json`};if($.payload!==void 0)z.relay=`${G}.relay.json`;if($.request!==void 0)z.request=`${G}.request.json`;try{await Mq(Y,{recursive:!0});let Q=$.previousBodyText??await Wj($),K={id:X,createdAt:new Date().toISOString(),session:K4(Z),transport:$.transport,protocol:$.protocol,mode:$.mode,route:$.route,status:$.status,error:$.error,tag:$.tag,bodyBytes:$.bodyText.length,relayBytes:$.relayBytes,bodyHash:Xz($.bodyText),diff:jj(Q,$.bodyText),body:Lj($.bodyText),files:z},W=[L9(z.body,$.bodyText),L9(z.metadata,`${JSON.stringify(K,null,2)}
+`)];if($.payload!==void 0&&z.relay)W.push(L9(z.relay,`${JSON.stringify(g4($.payload),null,2)}
+`));if($.request!==void 0&&z.request)W.push(L9(z.request,`${JSON.stringify(g4({...$.request,headers:Bj($.request.headers)}),null,2)}
+`));await Promise.all(W),Yj(Y,Object.values(z)),q6(`dumped request id=${X} session=${K4(Z)} body=${z.body} meta=${z.metadata}`)}catch{return q6(`dump failed session=${K4(Z)}`),null}return{responsePath:z.response,...$.tag?{tag:$.tag}:{}}}async function Nj($){if(!e9)return null;let Z=Qj($),J=U8.get(Z),X=await Yz({affinity:$.affinity,transport:"direct",route:$.route,status:$.status,error:$.error,bodyText:$.bodyText,previousBodyText:J,request:{url:$.url,method:$.method,headers:$.headers},tag:$.tag});return Vj(Z,$.bodyText),X}async function Uj($){return Yz({affinity:$.affinity,transport:$.transport,protocol:$.protocol,mode:$.mode,status:$.status,bodyText:$.bodyText,previousBodyText:$.previousBodyText,payload:$.payload,relayBytes:$.relayBytes,tag:$.tag})}async function xj($,Z){if(!$)return;let J=Z.message!=null&&typeof Z.message==="object"&&!Array.isArray(Z.message)?Z.message:{},X={status:Z.status,stream_complete:Z.complete??!0};if(typeof J.id==="string"&&J.id.length>0)X.message_id=J.id;if(typeof J.model==="string"&&J.model.length>0)X.model=J.model;if(Object.hasOwn(J,"usage"))X.usage=J.usage;if(Object.hasOwn(J,"diagnostics"))X.diagnostics=J.diagnostics;if(typeof J.stop_reason==="string"&&J.stop_reason.length>0)X.stop_reason=J.stop_reason;try{await L9($.responsePath,`${JSON.stringify(X,null,2)}
+`)}catch{q6(`dump response failed status=${Z.status}`)}}var W4=8388608,P8=10,P9=13;class A8 extends Error{code="SSE_FRAME_TOO_LARGE";maxFrameBytes;constructor($){super(`SSE frame exceeded ${$} bytes without a terminator`);this.name="SseFrameTooLargeError",this.maxFrameBytes=$}}function Dj($){if($===void 0)return W4;if($===null||typeof $!=="object"||R5.isProxy($))throw TypeError("SSE framer options must be an object");let Z=Object.getOwnPropertyDescriptor($,"maxFrameBytes");if(Z===void 0)return W4;if(!("value"in Z))throw TypeError("SSE framer maxFrameBytes must be a data property");let J=Z.value;if(J===void 0)return W4;if(typeof J!=="number"||!Number.isSafeInteger(J)||J<1)throw TypeError("SSE framer maxFrameBytes must be a positive integer");return J}function Oj($){let Z=Dj($),J=new Uint8Array(0),X=0,Y=!0,G=!1,z=!1,Q=!1,K=()=>{throw Q=!0,J=new Uint8Array(0),X=0,new A8(Z)},W=(q,H)=>{let j=(H?X:0)+q.length;if(j>Z)K();if(J.length<j){let x=new Uint8Array(Math.min(Z,Math.max(j,J.length*2,1024)));if(H)x.set(J.subarray(0,X),0);J=x}J.set(q,H?X:0),X=j};return Object.freeze({push:(q)=>{if(Q)throw new A8(Z);if(!R5.isUint8Array(q))throw TypeError("SSE framer input must be a Uint8Array");let H=q.length;if(H===0)return[];let j=[],x=0,N=0,U=Y?0:-1,D=(L)=>{if(X>0){let w=X+L;if(w>Z)K();let S=new Uint8Array(w);S.set(J.subarray(0,X),0),S.set(q.subarray(0,L),X),X=0,j.push(S)}else{if(L-x>Z)K();j.push(q.subarray(x,L))}x=L};if(G){if(G=!1,q[0]===P8)N=1;if(z)z=!1,D(N);U=N}let A=-2,I=-2;while(N<H){if(A!==-1&&A<N)A=q.indexOf(P8,N);if(I!==-1&&I<N)I=q.indexOf(P9,N);let L;if(A===-1)L=I;else if(I===-1)L=A;else L=Math.min(A,I);if(L===-1)break;let w=L+1;if(q[L]===P9){if(w===H){G=!0,z=L===U,U=H;break}if(q[w]===P8)w+=1}if(L===U)D(w);U=w,N=w}if(x<H)W(q.subarray(x,H),X>0),Y=U===H;else Y=!0;return j},finish:()=>{if(Q)throw new A8(Z);let q=X>0?J.slice(0,X):void 0;return J=new Uint8Array(0),X=0,Y=!0,G=!1,z=!1,q},get bufferedBytes(){return X}})}var Mj=new TextDecoder("utf-8",{ignoreBOM:!0}),Ij=65279;function _j($){if($===null||typeof $!=="object"||R5.isProxy($))return!1;let Z=Object.getOwnPropertyDescriptor($,"streamStart");return Z!==void 0&&"value"in Z&&Z.value===!0}function DZ($,Z){let J=Mj.decode($);return J.charCodeAt(0)===Ij&&_j(Z)?J.slice(1):J}function Pj($){let Z=typeof $==="string"?$:DZ($),J={},X;for(let Y of Z.split(/\r\n|\r|\n/)){if(Y===""||Y.charCodeAt(0)===58)continue;let G=Y.indexOf(":"),z=G===-1?Y:Y.slice(0,G),Q=G===-1?"":Y.slice(G+1);if(Q.charCodeAt(0)===32)Q=Q.slice(1);switch(z){case"event":J.event=Q;break;case"data":if(X)X.push(Q);else X=[Q];break;case"id":if(!Q.includes("\x00"))J.id=Q;break;case"retry":if(/^[0-9]+$/.test(Q))J.retry=Number(Q);break}}if(X)J.data=X.join(`
+`);return J}function Aj($){let Z=$.length;if(Z===0)return!1;let J=$[Z-1];if(J!==P8&&J!==P9)return!1;let X=Z-1;if(J===P8&&X>0&&$[X-1]===P9)X-=1;if(X===0)return!0;let Y=$[X-1];return Y===P8||Y===P9}var wj=Buffer.from("error"),Rj=Buffer.from("\\u");function Tj($){let Z=Buffer.from($.buffer,$.byteOffset,$.byteLength);return Z.indexOf(wj)!==-1||Z.indexOf(Rj)!==-1}var r0="[REDACTED]",v8="Provider error details were withheld because the request attempt has ended",Gz="Provider error body exceeded the redaction size limit and was withheld",T5=1048576,Fj=W4,zz=32,Cj=2000,F5=1000,Sj=/\bBearer\s+([A-Za-z0-9._~+/=-]{16,})/gi,kj=/(?<![A-Za-z0-9_-])sk-[A-Za-z0-9_-]{16,}/g,GJ=/\\(?:u([0-9a-fA-F]{4})|(["\\/bfnrt]))/g,vj={'"':'"',"\\":"\\","/":"/",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t"},fj=new Set(["api_error","authentication_error","billing_error","invalid_request_error","not_found_error","overloaded_error","permission_error","rate_limit_error","relay_upstream_error","request_too_large","timeout_error"]),y4=new TextEncoder;function W0($,Z){$.onTerminal?.(Z)}function C5($){if(!Array.isArray($)||J8.isProxy($))throw TypeError("Provider error redactor secrets must be an array");let J=Object.getOwnPropertyDescriptor($,"length")?.value;if(typeof J!=="number")throw TypeError("Provider error redactor secrets must be an array");let X=new Set;for(let Y=0;Y<J;Y+=1){let G=Object.getOwnPropertyDescriptor($,String(Y));if(G===void 0||!("value"in G))throw TypeError(`Provider error redactor secret ${Y} must be a data property`);let z=G.value;if(typeof z!=="string")throw TypeError(`Provider error redactor secret ${Y} must be a string`);if(z!=="")X.add(z)}return[...X].sort((Y,G)=>G.length-Y.length)}var yX=46;function Qz($){return $>=48&&$<=57||$>=65&&$<=90||$>=97&&$<=122||$===95}function H7($,Z){let J=Z;for(;J<$.length;J+=1){let X=$.charCodeAt(J);if(!Qz(X)&&X!==45)break}return J}function Ej($,Z){let J=$.indexOf("eyJ");while(J!==-1){let X=H7($,J),Y=J;while(Y!==-1&&Y<X&&!(Y+3<X&&(Y===0||!Qz($.charCodeAt(Y-1)))))Y=$.indexOf("eyJ",Y+1);if(Y===-1)return;if(Y>=X){J=Y;continue}let G=X;if($.charCodeAt(X)===yX){let z=H7($,X+1);if(z>X+1&&$.charCodeAt(z)===yX){let Q=H7($,z+1);if(Q>z+1)Z.push(Y,Q),G=Q}}J=$.indexOf("eyJ",G)}}function hX($,Z,J){Z.lastIndex=0;for(let X=Z.exec($);X!==null;X=Z.exec($)){let Y=X.index+X[0].length,G=X[1];J.push(G===void 0?X.index:Y-G.length,Y)}}function mX($,Z,J){for(let X of Z)for(let Y=$.indexOf(X);Y!==-1;Y=$.indexOf(X,Y+X.length))J.push(Y,Y+X.length);hX($,Sj,J),hX($,kj,J),Ej($,J)}function bj($,Z,J){if(Z!==void 0)return String.fromCharCode(Number.parseInt(Z,16));return J===void 0?"":vj[J]??J}function gj($,Z){let J=[...Z.keys()].sort((Q,K)=>(Z[Q]??0)-(Z[K]??0)),X=Array(Z.length).fill($.length),Y=0,G=0,z=0;GJ.lastIndex=0;for(;;){let Q=GJ.exec($),K=Q?Q.index:$.length;for(;Y<J.length;Y+=1){let W=J[Y]??0,V=Z[W]??0;if(V>z+(K-G))break;X[W]=G+(V-z)}if(!Q||Y===J.length)return X;z+=K-G+1,G=Q.index+Q[0].length}}function yj($,Z){let J=[];for(let Q=0;Q+1<Z.length;Q+=2)J.push([Z[Q]??0,Z[Q+1]??0]);J.sort((Q,K)=>Q[0]-K[0]||K[1]-Q[1]);let X="",Y=0,G=-1,z=-1;for(let[Q,K]of J){if(G!==-1&&Q<z){z=Math.max(z,K);continue}if(G!==-1)X+=$.slice(Y,G)+r0,Y=z;G=Q,z=K}if(G!==-1)X+=$.slice(Y,G)+r0,Y=z;return X+$.slice(Y)}function _6($,Z){let J=[];if(mX($,Z,J),$.includes("\\")){let X=$.replace(GJ,bj);if(X!==$){let Y=[];mX(X,Z,Y);for(let G of gj($,Y))J.push(G)}}if(J.length===0)return $;return yj($,J)}function A0($,Z){let J=Object.getOwnPropertyDescriptor($,Z)?.get;if(typeof J!=="function")throw Error(`Platform accessor ${Z} is unavailable`);return J}var Kz=A0(Response.prototype,"status"),Wz=A0(Response.prototype,"statusText"),hj=A0(Response.prototype,"ok"),Vz=A0(Response.prototype,"headers"),mj=A0(Response.prototype,"body"),uj=A0(Response.prototype,"url"),Bz=Headers.prototype.forEach,pj=A0(DOMException.prototype,"name"),cj=A0(DOMException.prototype,"message");function L$($,Z){return Reflect.apply($,Z,[])}function zJ($){try{return $()}catch(Z){if(Z instanceof TypeError)return;throw Z}}function lj($){let Z=[];return Reflect.apply(Bz,$,[(J,X)=>{if(typeof X==="string"&&typeof J==="string")Z.push([X,J])}]),Z}function dj($){return $ instanceof ReadableStream}function qz($){if($===null||typeof $!=="object"||J8.isProxy($))return;let Z=zJ(()=>L$(Kz,$));if(typeof Z!=="number")return;let J=L$(Wz,$),X=L$(hj,$),Y=L$(uj,$);if(typeof J!=="string"||typeof X!=="boolean"||typeof Y!=="string")throw TypeError("Response slots could not be read");return{status:Z,statusText:J,ok:X,headers:lj(L$(Vz,$)),url:Y,body(){let G=L$(mj,$);if(G===null||dj(G))return G;throw TypeError("Response body slot could not be read")}}}function ij($,Z){if(Object.getPrototypeOf($)!==Z)return!1;return Reflect.ownKeys($).every((J)=>!(J in Z))}function sj($){for(let[Z,J]of $)if(Z.toLowerCase()==="content-type")return J;return""}function QJ($,Z,J=0){if(typeof $==="string")return _6($,Z);if($===null||typeof $!=="object")return A9($,Z)?$:r0;if(J>=zz)return r0;if(Array.isArray($)){let z;for(let Q=0;Q<$.length;Q+=1){let K=$[Q],W=QJ(K,Z,J+1);if(W!==K)z??=$.slice(),z[Q]=W}return z??$}if(!h4($))return $;let X=!1,Y=[];for(let z of Object.keys($)){let Q=$[z],K=_6(z,Z),W=QJ(Q,Z,J+1);if(K!==z||W!==Q)X=!0;Y.push([K,W])}if(!X)return $;let G={};for(let[z,Q]of Y)Object.defineProperty(G,z,{value:Q,enumerable:!0,writable:!0,configurable:!0});return G}function A9($,Z){let J=JSON.stringify($);return typeof J!=="string"||_6(J,Z)===J}function h4($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function tj($){if(!h4($))return!1;return $.type==="error"||Object.hasOwn($,"error")}function OZ($){if(!h4($))return;let Z=$.error;if(!h4(Z))return;let J=Z.type;return typeof J==="string"&&fj.has(J)?J:void 0}function Z1($,Z){return JSON.stringify({type:"error",error:Z===void 0?{message:$}:{type:Z,message:$}})}function S5($){try{return{ok:!0,value:JSON.parse($)}}catch{return}}function jz($,Z){let J=_6($,Z);if(J===$)return $;let X=S5($);if(!X)return J;let Y=JSON.stringify(QJ(X.value,Z));return _6(Y,Z)===Y?Y:Z1(m4,OZ(X.value))}var aj=[["name","text"],["message","text"],["type","text"],["status","status"],["statusCode","status"],["code","code"],["retryAfter","retry"],["isRetryable","boolean"],["request_id","requestId"],["requestID","requestId"],["syscall","syscall"],["closeCode","closeCode"],["wasClean","boolean"],["error","nested"],["cause","nested"],["response","nested"],["headers","headers"],["responseHeaders","headers"],["errors","list"]],nj=new Set(["websocket","anthropic-sse"]),oj=[Symbol.for("vercel.ai.error"),Symbol.for("vercel.ai.error.AI_APICallError")],rj=new Map([["Error",Error],["TypeError",TypeError],["RangeError",RangeError],["SyntaxError",SyntaxError],["ReferenceError",ReferenceError],["EvalError",EvalError],["URIError",URIError]]),ej=/^[A-Za-z0-9_-]{1,128}$/,$H=64,uX="Provider error details exceeded the redaction size limit and were withheld",ZH=24;function t6($,Z){if(Z>$.bytes)return!1;return $.bytes-=Z,!0}function Hz($){return typeof $==="string"||typeof $==="object"&&$?0:ZH}function Lz($,Z,J){if(!t6($,Z))return!1;let X=J()-Z;return X<=0||t6($,X)}function k5($,Z){if($.length>Z.bytes)return;let J=_6($,Z.secrets);return Lz(Z,$.length,()=>g9.byteLength(J,"utf8"))?J:void 0}function w9($,Z){let J=k5($,Z);if(J!==void 0)return J;return t6(Z,uX.length)?uX:void 0}function Nz($){let Z=$;for(let J=0;Z!==null;J+=1){if(J>$H||J8.isProxy(Z))return!1;Z=Object.getPrototypeOf(Z)}return!0}function I0($,Z){let J=Object.getOwnPropertyDescriptor($,Z);return J!==void 0&&"value"in J?J.value:void 0}function JH($){for(let Z=$;Z!==null;Z=Object.getPrototypeOf(Z)){let J=Object.getOwnPropertyDescriptor(Z,"name");if(J!==void 0)return"value"in J?J.value:void 0}return}function v5($,Z,J){Object.defineProperty($,Z,{value:J,enumerable:!0,writable:!0,configurable:!0})}function p0($,Z,J,X){let Y=typeof Z==="string"?Z.length:0;if(J!==void 0&&t6(X,Y+Hz(J)))v5($,Z,J)}function Uz($){return Number.isInteger($)&&Number($)>=0&&Number($)<=999}function xz($,Z,J,X){let Y=Z.length+J.length;if(Y>X.bytes)return;if(_6(Z,X.secrets)!==Z){t6(X,Y);return}let G=_6(J,X.secrets);if(Lz(X,Y,()=>g9.byteLength(Z,"utf8")+g9.byteLength(G,"utf8")))v5($,Z,G)}var pX=Object.freeze({});function Dz($,Z){let J={},X=0;try{Reflect.apply(Bz,$,[(Y,G)=>{if(X>=F5||Z.bytes===0)throw pX;if(X+=1,typeof G==="string"&&typeof Y==="string")xz(J,G,Y,Z)}])}catch(Y){if(Y===pX)return J;if(Y instanceof TypeError)return;throw Y}return J}function XH($,Z){if($===null||typeof $!=="object"||!Nz($))return;let J=Dz($,Z);if(J)return J;let X=Reflect.ownKeys($);if(X.length>F5)return;let Y={};for(let G of X){let z=typeof G==="string"?I0($,G):void 0;if(typeof G==="string"&&typeof z==="string")xz(Y,G,z,Z)}return Y}function cX($,Z,J,X){switch($){case"text":return typeof Z==="string"?w9(Z,J):void 0;case"status":return Uz(Z)&&A9(Z,J.secrets)?Z:void 0;case"code":case"retry":if(typeof Z==="string")return k5(Z,J);return Number.isFinite(Z)&&A9(Z,J.secrets)?Z:void 0;case"boolean":return typeof Z==="boolean"?Z:void 0;case"syscall":return typeof Z==="string"&&nj.has(Z)&&t6(J,Z.length)?Z:void 0;case"closeCode":return Number.isInteger(Z)&&Number(Z)>=1000&&Number(Z)<=4999&&A9(Z,J.secrets)?Z:void 0;case"requestId":return typeof Z==="string"&&ej.test(Z)&&_6(Z,J.secrets)===Z&&t6(J,Z.length)?Z:void 0;case"nested":return Z===void 0?void 0:y9(Z,J,X);case"headers":return XH(Z,J);case"list":return Array.isArray(Z)?y9(Z,J,X):void 0}}var YH=128;function GH($,Z){if($==="nested"||$==="headers"||$==="list")return!1;return typeof Z!=="string"||Z.length<=YH}function Oz($,Z,J,X,Y,G){for(let Q of oj)if(I0($,Q)===!0)p0(Z,Q,!0,J);let z=[];for(let[Q,K]of aj){if(Y.has(Q))continue;let W=I0($,Q);if(!GH(K,W))z.push([Q,K,W]);else p0(Z,Q,cX(K,W,J,X+1),J)}G?.();for(let[Q,K,W]of z)p0(Z,Q,cX(K,W,J,X+1),J)}var zH=new Set(["message"]),QH=new Set(["message","errors"]),KH=new Set,Mz=12;function Iz($,Z,J,X){if(J===void 0){Reflect.deleteProperty($,"stack");return}let Y=g9.byteLength(Z,"utf8"),G=J===""?0:2+g9.byteLength(J,"utf8"),z="";if(t6(X,Y+G))z=J===""?Z:`${Z}: ${J}`;else if(t6(X,Y))z=Z;Object.defineProperty($,"stack",{value:z,writable:!0,enumerable:!1,configurable:!0})}function WH($,Z,J){let X=JH($),Y=X==="AggregateError",G=typeof X==="string"?rj.get(X):void 0,z=t6(Z,Mz+(Y?6:0)),Q=Y?AggregateError([]):new(G??Error);if(Y&&!z)Reflect.deleteProperty(Q,"errors");if(Z.memo.set($,Q),Oz($,Q,Z,J,Y?QH:zH,()=>{let W=I0($,"message"),V=!z?void 0:typeof W==="string"?w9(W,Z)??"":"";if(V!==void 0)Object.defineProperty(Q,"message",{value:V,writable:!0,enumerable:!1,configurable:!0});Iz(Q,Y?"AggregateError":G&&typeof X==="string"?X:"Error",V,Z)}),Y&&z){let W=I0($,"errors"),V=Array.isArray(W)?y9(W,Z,J+1):void 0;Object.defineProperty(Q,"errors",{value:Array.isArray(V)?V:[],writable:!0,configurable:!0})}return Q}function VH($,Z,J){let X=I0($,"length");if(typeof X!=="number"||X>F5)return V4(Z);let Y=[];Z.memo.set($,Y);for(let G=0;G<X;G+=1){let z=I0($,String(G));if(!t6(Z,1))break;let Q=y9(z,Z,J+1);if(!t6(Z,Hz(Q)))break;Y.push(Q)}return Y}function V4($){return t6($,r0.length)?r0:void 0}function y9($,Z,J){if(typeof $==="string")return w9($,Z)??"";if(typeof $==="symbol"||typeof $==="function")return V4(Z);if($===null||typeof $!=="object")return $;if(Z.memo.has($))return Z.memo.get($);if(!Nz($))return V4(Z);if(Z.budget-=1,Z.budget<0||J>=zz)return V4(Z);let X=zJ(()=>L$(Kz,$));if(typeof X==="number"){let z=L$(Wz,$);if(typeof z!=="string")throw TypeError("Response slots could not be read");let Q={};Z.memo.set($,Q),p0(Q,"status",X,Z),p0(Q,"statusText",k5(z,Z)??"",Z);let K=L$(Vz,$);return p0(Q,"headers",Dz(K,Z)??{},Z),Q}let Y=zJ(()=>L$(cj,$));if(typeof Y==="string"){let z=t6(Z,Mz)?w9(Y,Z)??"":void 0,Q=Error(z);Iz(Q,"Error",z,Z);let K=L$(pj,$);if(typeof K==="string")p0(Q,"name",w9(K,Z),Z);return Z.memo.set($,Q),Q}if(J8.isNativeError($))return WH($,Z,J);if(Array.isArray($))return VH($,Z,J);let G={};return Z.memo.set($,G),Oz($,G,Z,J,KH),G}function L7($,Z){let J=Error(Z);try{if($!==null&&typeof $==="object"&&!J8.isProxy($)){let X=I0($,"status");if(Uz(X))v5(J,"status",X)}}catch{}return J}var m4="Provider error could not be inspected safely";function J1($,Z){let J=Z.secrets,X=$!==null&&typeof $==="object"||typeof $==="function"||typeof $==="symbol";if(J===null){if(typeof $==="string")return v8;return X?L7($,v8):$}try{let Y=y9($,{secrets:J,memo:new Map,budget:Cj,bytes:T5},0);return X&&Y===r0?L7(void 0,m4):Y}catch{return L7(void 0,m4)}}function BH($,Z){let J=DZ($,{streamStart:!0}),X=Z.secrets;if(X===null)return y4.encode(Z1(v8,OZ(S5(J)?.value)));let Y=jz(J,X);return Y===J?$:y4.encode(Y)}function qH($,Z){if($.length===1&&$[0])return $[0];let J=new Uint8Array(Z),X=0;for(let Y of $)J.set(Y,X),X+=Y.byteLength;return J}function N7($,Z,J){try{if(Z)$.enqueue(Z);if(J)$.close()}catch{}}function _z($,Z){return $.cancel(Z).then(()=>{return},()=>{throw Error(v8)})}var Pz=new WeakSet;class Az extends Error{constructor(){super(Gz);this.name="ProviderErrorSourceOversizedError",Pz.add(this)}}function jH($){return typeof $==="object"&&$!==null&&Pz.has($)}function lX(){return y4.encode(Z1(Gz))}function HH($,Z){Z.wrappedBodies+=1;let J=()=>$.getReader(),X;return new ReadableStream({async pull(Y){let G=[],z=0,Q,K;try{Q=J(),X=Q;for(;;){let{done:W,value:V}=await Q.read();if(W)break;if(!J8.isUint8Array(V))throw TypeError("Provider error body chunk must be bytes");if(V.byteLength===0)continue;if(z+=V.byteLength,z>T5){N7(Y,lX(),!0),W0(Z,"eof"),await Q.cancel().catch(()=>{});return}G.push(V)}K=BH(qH(G,z),Z)}catch(W){if(jH(W)){if(N7(Y,lX(),!0),W0(Z,"eof"),Q)await Q.cancel().catch(()=>{});return}let V=J1(W,Z);W0(Z,"error");try{Y.error(V)}catch{}if(Q)await Q.cancel(V).catch(()=>{});return}N7(Y,K,!0),W0(Z,"eof")},cancel(Y){return W0(Z,"cancel"),_z(X??$,Y)}},{highWaterMark:0})}function LH($){let Z=/\r\n|\r|\n/.exec($);return Z?Z[0]:`
+`}function KJ($,Z,J){let X=[];if(J.event!==void 0)X.push(`event: ${J.event}`);if(J.id!==void 0)X.push(`id: ${J.id}`);if(J.retry!==void 0)X.push(`retry: ${J.retry}`);if(J.data!==void 0)for(let Y of J.data.split(/\r\n|\r|\n/))X.push(`data: ${Y}`);return NH($,Z,X)}function NH($,Z,J){let X=LH(Z),Y="";if(Aj($))Y=X+X;else if(/[\r\n]$/.test(Z))Y=X;return y4.encode(J.join(X)+Y)}function UH($,Z,J){if(!Tj($))return $;let X=DZ($,{streamStart:J}),Y=Pj(X),G=Y.data===void 0?void 0:S5(Y.data);if(!(Y.event==="error"||G!==void 0&&tj(G.value)))return $;let Q=Z.secrets,K=Q===null?KJ($,X,{event:Y.event===void 0?void 0:"error",data:Y.data===void 0?void 0:Z1(v8,OZ(G?.value))}):_6(X,Q)===X&&(Y.data===void 0||_6(Y.data,Q)===Y.data)?$:KJ($,X,{event:Y.event===void 0?void 0:_6(Y.event,Q),id:Y.id===void 0?void 0:_6(Y.id,Q),retry:Y.retry!==void 0&&Number.isSafeInteger(Y.retry)&&A9(Y.retry,Q)?Y.retry:void 0,data:Y.data===void 0?void 0:jz(Y.data,Q)}),W=K===$||Q===null?K:xH(K,$,X,Y,G,Q);if(W===$||!J||!DH($))return W;let V=new Uint8Array(w8.length+W.length);return V.set(w8,0),V.set(W,w8.length),V}function xH($,Z,J,X,Y,G){let z=DZ($);if(_6(z,G)===z)return $;return KJ(Z,J,{event:X.event===void 0?void 0:"error",data:X.data===void 0?void 0:Z1(m4,OZ(Y?.value))})}var w8=Uint8Array.of(239,187,191);function DH($){return $[0]===w8[0]&&$[1]===w8[1]&&$[2]===w8[2]}function OH($,Z){Z.wrappedBodies+=1;let J=wz(Z),X=()=>$.getReader(),Y,G=(z,Q)=>{for(let K of Q)z.enqueue(K)};return new ReadableStream({async pull(z){let Q=Y,K=!1;try{Q??=X(),Y=Q;for(;;){let{done:W,value:V}=await Q.read();if(W){K=!0;let q=J.finish();K=!1,G(z,q),z.close(),W0(Z,"eof");return}if(!J8.isUint8Array(V))throw TypeError("Provider event-stream chunk must be bytes");K=!0;let B=J.push(V);if(K=!1,B.length>0){G(z,B);return}}}catch(W){let V=K&&W instanceof A8?W:J1(W,Z);W0(Z,"error");try{z.error(V)}catch{}if(Q)await Q.cancel(V).catch(()=>{})}},cancel(z){return W0(Z,"cancel"),_z(Y??$,z)}},{highWaterMark:0})}function wz($){let Z=Oj({maxFrameBytes:Fj}),J=!0,X=(Y)=>{let G=[],z;for(let Q of Y){let K=UH(Q,$,J);if(J=!1,K===Q&&z!==void 0&&z.buffer===Q.buffer&&z.byteOffset+z.byteLength===Q.byteOffset){z=new Uint8Array(z.buffer,z.byteOffset,z.byteLength+Q.byteLength);continue}if(z)G.push(z);if(z=void 0,K===Q)z=Q;else G.push(K)}if(z)G.push(z);return G};return{push:(Y)=>X(Z.push(Y)),finish:()=>{let Y=Z.finish();return Y?X([Y]):[]}}}var MH="Provider error stream scope is closed";function IH($){let Z={secrets:C5($),wrappedBodies:0},J=wz(Z),X=()=>{Z.secrets=null,J=null},Y=()=>{if(J===null)throw Error(MH);return J};return Object.freeze({push(G){let z=Y();try{return z.push(G)}catch(Q){throw X(),Q}},finish(){let G=Y();try{return G.finish()}finally{X()}},redactError(G){return J1(G,Z)},dispose:X})}var _H=new Set([101,103,204,205,304]),m$="anthropic-ratelimit-unified-",PH=new Set(["allowed","allowed_warning","rejected"]),AH=new Set(["five_hour","seven_day","seven_day_opus","seven_day_sonnet","overage"]),wH=new Set(["available","unavailable"]),RH=/^[0-9]{1,15}(\.[0-9]{1,15})?$/,TH=/^[0-9]{1,10}$/,FH=/^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), [0-9]{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) [0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} GMT$/,CH=($)=>TH.test($)||FH.test($),U7=($)=>PH.has($),c1=($)=>RH.test($),SH=new Map([["retry-after",CH],["x-should-retry",($)=>$==="true"||$==="false"],[`${m$}status`,U7],[`${m$}representative-claim`,($)=>AH.has($)],[`${m$}fallback`,($)=>wH.has($)],[`${m$}5h-status`,U7],[`${m$}5h-utilization`,c1],[`${m$}5h-reset`,c1],[`${m$}7d-status`,U7],[`${m$}7d-utilization`,c1],[`${m$}7d-reset`,c1]]);function kH($,Z){return SH.get($.toLowerCase())?.(Z)===!0}function x7($,Z,J){let X=new Headers;for(let[Y,G]of $){if(Z==="verified-only"&&!kH(Y,G))continue;if(Z==="scrub"&&_6(Y,J)!==Y)continue;X.append(Y,Z==="scrub"?_6(G,J):G)}return X.delete("content-length"),X}function dX($,Z,J){if(Z!==""&&J!==null)Object.defineProperty($,"url",{value:_6(Z,J),enumerable:!0});return $}function Rz($,Z,J,X){let Y=J.secrets,G=ij($,Response.prototype);if(Z.ok){let K=X==="content-type"?/text\/event-stream/i.test(sj(Z.headers)):X==="event-stream";if(G&&!K)return $;let W=Z.body();if(G&&W===null)return $;let V=W===null||!K?W:OH(W,J);return dX(new Response(V,{status:Z.status,statusText:Z.statusText,headers:x7(Z.headers,"keep",[])}),Z.url,Y)}if(Z.status===0)return G?$:Response.error();let z=_H.has(Z.status)?null:Z.body(),Q=z===null?null:HH(z,J);if(Y===null){let K=x7(Z.headers,"verified-only",[]);if(Q!==null)K.set("content-type","application/json");return new Response(Q,{status:Z.status,headers:K})}return dX(new Response(Q,{status:Z.status,statusText:_6(Z.statusText,Y),headers:x7(Z.headers,"scrub",Y)}),Z.url,Y)}function vH($,Z){let J=qz($);if(!J)throw TypeError("Provider error redactor expects a Response");let X=Rz($,J,Z,"content-type");if(!(X instanceof Response))throw TypeError("Provider error redactor expects a Response");return X}function LR($){let Z={secrets:C5($),wrappedBodies:0};return Object.freeze({redactText(J){if(typeof J!=="string")throw TypeError("Provider error redactor expects text");let X=Z.secrets;return X===null?v8:_6(J,X)},redactError(J){return J1(J,Z)},redactResponse(J){return vH(J,Z)},dispose(){Z.secrets=null}})}var fH="Provider error response scope accepts one response while live";function f5($,Z){if(Z!=="event-stream"&&Z!=="http")throw TypeError("Provider error response scope mode must be 'event-stream' or 'http'");let J=Z,X={secrets:C5($),wrappedBodies:0},Y=()=>{},G=new Promise((V)=>{Y=V}),z=!1,Q=!1,K=(V)=>{if(z)return;z=!0,X.secrets=null,X.onTerminal=void 0,Y(V)};X.onTerminal=K;let W={get settled(){return G},redactResponse(V){if(Q||z)throw TypeError(fH);let B=qz(V);if(!B)throw TypeError("Provider error redactor expects a Response");Q=!0;let q;try{q=Rz(V,B,X,J)}catch(H){throw K("disposed"),H}if(X.wrappedBodies===0)K("untouched");if(!(q instanceof Response))throw TypeError("Provider error redactor expects a Response");return q},redactError(V){return J1(V,X)},dispose(){K("disposed")}};return Object.defineProperty(W,"settled",{enumerable:!1}),Object.freeze(W)}var D7=3600000,iX=300000,EH=60000,NR="extended-cache-ttl-2025-04-11",bH=32,sX=16777216,gH=30000,yH=60000,hH=900000,mH=30000,tX="OAuth cache prewarm credential is unavailable",aX="## Claude Cache Keep Status",nX="## Claude Cache Keep Enabled",uH="## Claude Cache Keep Disabled",pH="## Claude Cache Keep Usage",cH="Usage: `/claude-cachekeep`, `/claude-cachekeep always`, `/claude-cachekeep off`, or `/claude-cachekeep HH-HH`.";function u4($){return String($).padStart(2,"0")}function lH($){let Z=$.trim();if(!Z)return{type:"status"};if(Z==="off")return{type:"disable"};if(Z==="always")return{type:"always"};if(Z==="subagents on")return{type:"subagents",enabled:!0};if(Z==="subagents off")return{type:"subagents",enabled:!1};let J=/^(\d{1,2})-(\d{1,2})$/.exec(Z);if(!J)return{type:"usage"};let X=Number(J[1]),Y=Number(J[2]);if(!Number.isInteger(X)||!Number.isInteger(Y)||X<0||X>23||Y<0||Y>23||X===Y)return{type:"usage"};return{type:"window",startHour:X,endHour:Y}}function p4($){let Z=Number($?.cacheKeep?.startHour),J=Number($?.cacheKeep?.endHour);if(!Number.isInteger(Z)||!Number.isInteger(J)||Z<0||Z>23||J<0||J>23||Z===J)return;return{startHour:Z,endHour:J}}function MZ($){return $?.cacheKeep?.enabled===!0&&$.cacheKeep.always===!0}function Tz($){return $?.cacheKeep?.enabled===!0&&(MZ($)||!!p4($))}function dH($){return Tz($)&&$?.claudeCache?.enabled===!0&&$.claudeCache.mode==="hybrid"}function iH($,Z=new Date){if(!$)return!1;let J=Z.getHours();if($.startHour<$.endHour)return J>=$.startHour&&J<$.endHour;return J>=$.startHour||J<$.endHour}function oX($,Z=new Date){if($?.cacheKeep?.enabled!==!0)return!1;return MZ($)||iH(p4($),Z)}function rX($=new Date){return`${$.getFullYear()}-${u4($.getMonth()+1)}-${u4($.getDate())}`}function Fz($,Z=new Date){if($&&$.startHour>$.endHour&&Z.getHours()<$.endHour){let J=new Date(Z);return J.setDate(J.getDate()-1),rX(J)}return rX(Z)}function eX($,Z,J=new Date){return MZ($)?"always":Fz(Z,J)}function q8($){let Z=$.always?"always (while this process is running)":$.window?`${u4($.window.startHour)}-${u4($.window.endHour)}`:"not configured",J=[`Cache keep: ${$.enabled?"enabled":"disabled"}`,`Schedule: ${Z}`,"Mode requirement: `/claude-cache mode hybrid` must be active."];if(typeof $.hybridActive==="boolean")J.push(`Hybrid active: ${$.hybridActive?"yes":"no"}`);if(typeof $.trackedSessions==="number")J.push(`Tracked sessions: ${$.trackedSessions}`);if($.trackedSessionDetails?.length){J.push("Sessions:");for(let X of $.trackedSessionDetails)J.push(`- ${X.id}`)}if($.nextPrewarmAt)J.push(`Next prewarm: ${new Date($.nextPrewarmAt).toLocaleString()}`);return J.join(`
+`)}function UR($){let Z=lH($.argumentsText),J={enabled:$.enabled??!1,always:$.always,window:$.window,trackedSessions:$.trackedSessions,trackedSessionDetails:$.trackedSessionDetails,nextPrewarmAt:$.nextPrewarmAt,hybridActive:$.hybridActive};if(Z.type==="status")return[aX,"",q8(J)].join(`
+`);if(Z.type==="disable")return[uH,"",q8({...J,enabled:!1})].join(`
+`);if(Z.type==="always")return[nX,"",q8({...J,enabled:!0,always:!0,window:void 0})].join(`
+`);if(Z.type==="window")return[nX,"",q8({...J,enabled:!0,always:!1,window:{startHour:Z.startHour,endHour:Z.endHour}})].join(`
+`);if(Z.type==="subagents")return[aX,"",q8(J),"",`Subagent tracking: ${Z.enabled?"enabled":"disabled"}`].join(`
+`);return[pH,"",cH,"",q8(J)].join(`
+`)}function WJ($){if(!$||typeof $!=="object")return!1;if(Array.isArray($))return $.some(WJ);let Z=$,J=Z.cache_control;if(J&&typeof J==="object"&&J.type==="ephemeral")return!0;return Object.values(Z).some(WJ)}async function sH($){let Z;try{Z=JSON.parse($)}catch{return{ok:!1,reason:"body is not valid JSON"}}if(!WJ(Z))return{ok:!1,reason:"body has no explicit cache breakpoints"};let J=structuredClone(Z);if(Zq(J),J.max_tokens=0,delete J.stream,J.thinking?.type==="enabled")delete J.thinking;if(J.output_config?.format)delete J.output_config;let G=J.tool_choice;if(G?.type==="tool"||G?.type==="any")delete J.tool_choice;return{ok:!0,bodyText:await rB(JSON.stringify(xq(J)))}}function $Y($,Z){let J=Math.min(hH,yH*2**Math.min(Math.max(Z-1,0),8)),X=2166136261;for(let G of`${$}:${Z}`)X^=G.charCodeAt(0),X=Math.imul(X,16777619);let Y=(X>>>0)%(Math.min(mH,J/4)+1);return J+Y}function tH($){let Z=[],J=$.get("authorization");if(J){Z.push(J);let Y=/^Bearer\s+(.+)$/i.exec(J)?.[1]?.trim();if(Y)Z.push(Y)}let X=$.get("x-api-key");if(X)Z.push(X);return Z}class aH{options;targets=new Map;timer=null;tickPromise=null;nextPrewarmAttemptId=0;constructor($){this.options=$}start(){if(this.timer)return;if(t.debug("cachekeep","started"),this.timer=(this.options.setIntervalImpl??globalThis.setInterval)(()=>{this.tick().catch(()=>{t.warn("cachekeep","tick failed")})},EH),"unref"in this.timer)this.timer.unref()}stop(){if(!this.timer)return;t.debug("cachekeep","stopped"),(this.options.clearIntervalImpl??globalThis.clearInterval)(this.timer),this.timer=null}stats($,Z=this.options.now?.()??Date.now(),J=!1){let X=J?"always":Fz($,new Date(Z)),Y=[...this.targets.values()].filter((z)=>z.dayKey===X),G=Y.length?Math.min(...Y.map((z)=>z.nextPrewarmAt)):void 0;return{trackedSessions:Y.length,nextPrewarmAt:G}}trackedSessions(){return[...this.targets.values()].map(($)=>({id:$.id,cacheExpiresAt:$.cacheExpiresAt,nextPrewarmAt:$.nextPrewarmAt})).sort(($,Z)=>$.id.localeCompare(Z.id))}trackedOAuthRoute($){let Z=this.targets.get($);return Z?{oauthAccountId:Z.oauthAccountId}:void 0}trackedCount(){return this.targets.size}publishTrackedSessions(){let $=this.options.onTrackedSessionsChanged;if(!$)return;try{Promise.resolve($(this.trackedSessions())).catch(()=>{t.warn("cachekeep","failed to publish tracked sessions")})}catch{t.warn("cachekeep","failed to publish tracked sessions")}}totalBodyBytes(){return[...this.targets.values()].reduce(($,Z)=>$+Z.bodyText.length,0)}evictOldestTarget(){let $=this.targets.keys().next().value;if($!==void 0)this.targets.delete($)}pruneTargets($,Z){for(let[J,X]of this.targets){if(Z&&X.dayKey!==Z){this.targets.delete(J);continue}if($>=X.cacheExpiresAt)this.targets.delete(J)}while(this.targets.size>bH)this.evictOldestTarget();while(this.totalBodyBytes()>sX){let J=this.targets.size;if(this.evictOldestTarget(),this.targets.size===J)break}}track($){if(!$.sessionId)return{tracked:!1,reason:"missing session id"};if(!Tz($.storage))return{tracked:!1,reason:"cachekeep disabled"};if($.cacheMode!=="hybrid")return{tracked:!1,reason:"cache mode is not hybrid"};if($.bodyText.length>sX)return{tracked:!1,reason:"body exceeds cachekeep memory budget"};let Z=this.options.now?.()??Date.now(),J=p4($.storage);if(!oX($.storage,new Date(Z)))return{tracked:!1,reason:"outside configured schedule"};let X=eX($.storage,J,new Date(Z));if(this.pruneTargets(Z,X),this.targets.has($.sessionId))this.targets.delete($.sessionId);let Y={};return $.headers.forEach((G,z)=>{Y[z]=G}),this.targets.set($.sessionId,{id:$.sessionId,url:$.url,headers:Y,bodyText:$.bodyText,cacheExpiresAt:Z+D7,nextPrewarmAt:Z+D7-iX,consecutiveFailures:0,dayKey:X,oauthAccountId:$.oauthAccountId,oauthAccountIdentity:$.oauthAccountIdentity,accountStoragePath:$.accountStoragePath,isSubagent:$.isSubagent??!1}),this.pruneTargets(Z,X),this.publishTrackedSessions(),this.start(),{tracked:!0}}async prewarmNow($){let Z={};$.headers.forEach((X,Y)=>{Z[Y]=X});let J={id:$.sessionId,url:$.url,headers:Z,bodyText:$.bodyText,cacheExpiresAt:this.options.now?.()??Date.now(),nextPrewarmAt:this.options.now?.()??Date.now(),consecutiveFailures:0,dayKey:"",oauthAccountId:$.oauthAccountId,oauthAccountIdentity:$.oauthAccountIdentity,accountStoragePath:$.accountStoragePath,isSubagent:$.isSubagent??!1};return this.sendPrewarm(J)}tick(){if(this.tickPromise)return this.tickPromise;let $;return $=this.runTick().finally(()=>{if(this.tickPromise===$)this.tickPromise=null}),this.tickPromise=$,$}async runTick(){let $=await this.options.loadStorage(),Z=p4($),J=this.options.now?.()??Date.now(),X=eX($,Z,new Date(J));if(MZ($))for(let Y of this.targets.values())Y.dayKey="always";if(this.pruneTargets(J,X),!this.targets.size){this.publishTrackedSessions(),this.stop();return}if(!dH($)){this.publishTrackedSessions();return}if(!oX($,new Date(J))){this.publishTrackedSessions();return}t.debug("cachekeep","fired",{targets:this.targets.size});for(let Y of this.targets.values()){if(Y.nextPrewarmAt>J)continue;try{await this.prewarm(Y,J)}catch{t.warn("cachekeep","prewarm failed",{session:Y.id}),Y.consecutiveFailures+=1,Y.nextPrewarmAt=J+$Y(Y.id,Y.consecutiveFailures)}}this.publishTrackedSessions()}async sendPrewarm($){let Z={id:++this.nextPrewarmAttemptId,signal:AbortSignal.timeout(this.options.prewarmTimeoutMs??gH)};try{let J=$.bodyText;if(this.options.prepareBody)try{J=await this.options.prepareBody(J,$)}catch{t.warn("cachekeep","prepare body failed",{session:$.id})}let X={...$,bodyText:J},Y=await sH(J);if(!Y.ok)return Y;let G=this.options.fetchImpl??fetch,z={...X,bodyText:Y.bodyText},Q=this.options.prepareHeaders?await this.options.prepareHeaders(new Headers($.headers),z,Z):new Headers($.headers);if(!Q)return{ok:!1,reason:tX,transient:!0};Q.delete("content-length"),Q.delete("transfer-encoding");let K,W=async(x)=>{let N=f5(tH(x),"http");try{let U=await G($.url,{method:"POST",headers:x,body:Y.bodyText,signal:Z.signal});return N.redactResponse(U)}catch(U){let D=N.redactError(U);throw N.dispose(),D}};try{if(K=await W(Q),K.status===401&&!Z.signal?.aborted&&this.options.retryOnUnauthorized){let x;try{x=await this.options.retryOnUnauthorized({target:z,headers:Q,bodyText:Y.bodyText,attempt:Z})}catch{}if(x&&!Z.signal?.aborted)x.delete("content-length"),x.delete("transfer-encoding"),await K.body?.cancel().catch(()=>{}),Q=x,K=await W(Q)}}catch(x){return{ok:!1,reason:x instanceof Error?x.message:String(x),transient:!0}}let V=this.options.now?.()??Date.now(),B=await K.text().catch(()=>""),q=null;try{q=B?JSON.parse(B):null}catch{}try{await this.options.onResponse?.({target:$,bodyText:Y.bodyText,status:K.status,data:q,receivedAt:V,attempt:Z})}catch{}try{let x=await Nj({affinity:$.id,route:"cachekeep",status:K.status,bodyText:Y.bodyText,url:$.url,method:"POST",headers:Q,tag:"cachekeep"});await xj(x,{status:K.status,message:q})}catch{t.debug("cachekeep","dump failed",{session:$.id})}if(!K.ok)return{ok:!1,reason:B||`HTTP ${K.status}`,status:K.status};let j=(q&&typeof q==="object"&&!Array.isArray(q)?q:null)?.usage;return{ok:!0,...j&&{usage:j}}}finally{try{await this.options.onComplete?.({target:$,attempt:Z})}catch{}}}async prewarm($,Z){let J=await this.sendPrewarm($);if(!J.ok){if(J.status==null&&!J.transient)t.debug("cachekeep","prewarm skipped",{session:$.id,reason:J.reason}),this.targets.delete($.id);else t.warn("cachekeep","prewarm failed",{session:$.id,status:J.status,...J.transient&&{transient:!0},...J.reason===tX&&{reason:J.reason}}),$.consecutiveFailures+=1,$.nextPrewarmAt=Z+$Y($.id,$.consecutiveFailures);return}$.cacheExpiresAt=Z+D7,$.nextPrewarmAt=$.cacheExpiresAt-iX,$.consecutiveFailures=0,t.debug("cachekeep","prewarm succeeded",{session:$.id,...J.usage&&{usage:J.usage}})}}var JL=180000;function XL($){if(!$||typeof $!=="object"||Array.isArray($))return;let Z=$;if(typeof Z.id!=="string"||Z.id.length===0||typeof Z.cacheExpiresAt!=="number"||!Number.isFinite(Z.cacheExpiresAt)||typeof Z.nextPrewarmAt!=="number"||!Number.isFinite(Z.nextPrewarmAt))return;return{id:Z.id,cacheExpiresAt:Z.cacheExpiresAt,nextPrewarmAt:Z.nextPrewarmAt}}function YL($){if(!$||typeof $!=="object"||Array.isArray($))return;let Z=$;if(Z.version!==1||typeof Z.updatedAt!=="number"||!Number.isFinite(Z.updatedAt)||!Array.isArray(Z.sessions))return;return{version:1,updatedAt:Z.updatedAt,sessions:Z.sessions.flatMap((J)=>{let X=XL(J);return X?[X]:[]})}}function IR($){return VJ(ZL(),"opencode-anthropic-auth","cachekeep-sessions",$)}class GL{options;filePath;writeChain=Promise.resolve();constructor($){this.options=$;let Z=$.instanceId??`${process.pid}-${ZY()}`;this.filePath=VJ($.directory,`${Z}.json`)}publish($){let Z=$.map((J)=>({...J}));return this.writeChain=this.writeChain.catch(()=>{}).then(async()=>{if(Z.length===0){await JY(this.filePath,{force:!0});return}await nH(this.options.directory,{recursive:!0,mode:448});let J=`${this.filePath}.${ZY()}.tmp`,X={version:1,updatedAt:this.options.now?.()??Date.now(),sessions:Z};await $L(J,`${JSON.stringify(X)}
+`,{mode:384}),await eH(J,this.filePath)}),this.writeChain}async list($=[]){await this.writeChain.catch(()=>{});let Z=this.options.now?.()??Date.now(),J=this.options.leaseMs??JL,X;try{X=(await oH(this.options.directory)).filter((z)=>z.endsWith(".json"))}catch{X=[]}let Y=await Promise.all(X.map(async(z)=>{try{let Q=await rH(VJ(this.options.directory,z),"utf8");return YL(JSON.parse(Q))}catch{return}})),G=new Map;for(let z of Y){if(!z||Z-z.updatedAt>J||z.updatedAt>Z)continue;for(let Q of z.sessions){let K=G.get(Q.id);if(!K||Q.cacheExpiresAt>K.cacheExpiresAt)G.set(Q.id,Q)}}for(let z of $){let Q=G.get(z.id);if(!Q||z.cacheExpiresAt>Q.cacheExpiresAt)G.set(z.id,{...z})}return[...G.values()].sort((z,Q)=>z.id.localeCompare(Q.id))}async dispose(){await this.writeChain.catch(()=>{}),await JY(this.filePath,{force:!0})}}var HL="anthropic-auth-opencode";var LL=1,BJ=16384,vz=30000,y5=/^[0-9a-f]{64}$/,GY=new Set(["invalid_params","pending_exists","not_found","already_consumed","superseded","stale_generation"]);function FR($={}){return R$.connect($)}function NL($){let Z=YY($)||".json",J=g5($,YY($));return{statePath:h9(u8($),`${J}-state${Z}`),tokenPath:$}}function X1($,Z=process.env,J=process.cwd()){let X=Z[`${$.toUpperCase()}_ANTHROPIC_AUTH_CLAUSTRUM_ENROLLMENT_FILE`]?.trim(),Y=X?qL(X)?X:jL(J,X):h9(Z.XDG_STATE_HOME||h9(BL(),".local","state"),"cortexkit","anthropic-auth",`${$}-enrollment.json`);return NL(Y)}function fz($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function l1($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0}function Ez($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=1}function h5($){if(!fz($)||$.version!==LL||typeof $.proposedName!=="string"||$.proposedName.length===0)throw Error("invalid Claustrum enrollment state");if($.phase==="pending"){if(!y5.test(String($.requestSecret??""))||$.requestId!==void 0&&(typeof $.requestId!=="string"||$.requestId.length===0)||!l1($.createdAt)||!l1($.updatedAt))throw Error("invalid Claustrum enrollment state");return{version:1,phase:"pending",proposedName:$.proposedName,requestSecret:$.requestSecret,...$.requestId!==void 0&&{requestId:$.requestId},createdAt:$.createdAt,updatedAt:$.updatedAt}}if($.phase==="approved"){if($.approvedName!==void 0&&(typeof $.approvedName!=="string"||$.approvedName.length===0)||!Ez($.tokenGeneration)||!l1($.updatedAt))throw Error("invalid Claustrum enrollment state");return{version:1,phase:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration,updatedAt:$.updatedAt}}if($.phase==="denied"||$.phase==="blocked"){if($.errorCode!==void 0&&typeof $.errorCode!=="string"||!l1($.updatedAt))throw Error("invalid Claustrum enrollment state");return{version:1,phase:$.phase,proposedName:$.proposedName,...$.errorCode!==void 0&&{errorCode:$.errorCode},updatedAt:$.updatedAt}}throw Error("invalid Claustrum enrollment state")}function bz($){if(!fz($)||!y5.test(String($.token??""))||!Ez($.token_generation))throw Error("invalid Claustrum enrollment token file");return{token:$.token,token_generation:$.token_generation}}function UL($){if(!$.isFile())throw Error("Claustrum enrollment file must be a regular file");if(($.mode&63)!==0)throw Error("Claustrum enrollment file must be owner-only");let Z=process.getuid?.();if(Z!==void 0&&$.uid!==Z)throw Error("Claustrum enrollment file must be owned by the current user")}async function f8($){let Z;try{Z=await Sz($,XY.O_RDONLY|XY.O_NOFOLLOW)}catch(J){if(J.code==="ENOENT")return;throw Error("Claustrum enrollment file could not be opened safely")}try{UL(await Z.stat());let J=Buffer.alloc(BJ+1),{bytesRead:X}=await Z.read(J,0,J.byteLength,0);if(X>BJ)throw Error("Claustrum enrollment file is too large");return m8(J.subarray(0,X).toString("utf8"))}finally{await Z.close()}}async function xL($){let Z;try{Z=await WL($)}catch{return}for(;;){let J=await VL(Z).catch(()=>{return});if(J&&(J.mode&18)!==0&&(J.mode&512)===0)throw Error("Claustrum enrollment path has an unsafe writable ancestor");let X=u8(Z);if(X===Z)return;Z=X}}async function J0($,Z,J){let X=u8($);await E5(X,{recursive:!0,mode:448}),await xL(X);let Y=`${JSON.stringify(Z)}
+`;if(Buffer.byteLength(Y)>BJ)throw Error("Claustrum enrollment state is too large");let G=h9(X,`.${g5($)}.${process.pid}.${Cz()}.tmp`),z;try{z=await Sz(G,"wx",384),await z.writeFile(Y,"utf8"),await z.sync(),await z.close(),z=void 0,await KL(G,384),await J(),await kz(G,$)}finally{await z?.close().catch(()=>{}),await b5(G).catch(()=>{})}}async function DL($,Z,J,X){let Y=h9(u8($),`.${g5($)}.${process.pid}.${Cz()}.tmp`);try{await J(Y,Z),await X(),await kz(Y,$)}finally{await b5(Y).catch(()=>{})}}async function OL($,Z=HL){let J=await f8($.tokenPath),X=J===void 0?void 0:bz(J),Y=await f8($.statePath),G=Y===void 0?void 0:h5(Y);if(X)return{state:"approved",proposedName:G?.proposedName??Z,...G?.phase==="approved"&&G.approvedName!==void 0&&{approvedName:G.approvedName},tokenGeneration:X.token_generation};if(!G)return{state:"idle"};if(G.phase==="pending")return{state:"pending",proposedName:G.proposedName,...G.requestId!==void 0&&{requestId:G.requestId}};if(G.phase==="approved")return{state:"blocked",proposedName:G.proposedName,code:"missing_token"};if(G.phase==="denied")return{state:"denied",proposedName:G.proposedName};return{state:"blocked",proposedName:G.proposedName,code:G.errorCode??"unknown"}}function X0($){if($.phase==="pending")return{state:"pending",proposedName:$.proposedName,...$.requestId!==void 0&&{requestId:$.requestId}};if($.phase==="approved")return{state:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration};if($.phase==="denied")return{state:"denied",proposedName:$.proposedName};return{state:"blocked",proposedName:$.proposedName,code:$.errorCode??"unknown"}}class ML{#$;#Z;#z;#J;#Q;#Y;constructor($){this.#$=$.client,this.#Z=$.paths,this.#z=$.proposedName,this.#J=$.now??Date.now,this.#Q=$.mintSecret??(()=>QL(32).toString("hex")),this.#Y=$.writeTokenFile??$9}async status(){return OL(this.#Z,this.#z)}async resetTerminal(){return IL(this.#Z,this.#z)}async reconcile(){await E5(u8(this.#Z.statePath),{recursive:!0,mode:448});let $=await b9({name:"ceremony",path:this.#Z.statePath,ttlMs:vz,renew:!0});if(!$)return{state:"busy"};try{let Z=await f8(this.#Z.tokenPath),J=Z===void 0?void 0:bz(Z),X=await f8(this.#Z.statePath),Y=X===void 0?void 0:h5(X);if(Y&&Y.proposedName!==this.#z)throw Error("Claustrum enrollment state belongs to a different consumer");if(J){if(!Y||Y.phase==="pending"){let z={version:1,phase:"approved",proposedName:Y?.proposedName??this.#z,tokenGeneration:J.token_generation,updatedAt:this.#J()};await J0(this.#Z.statePath,z,()=>$.assertOwned()),Y=z}return{state:"approved",proposedName:Y.proposedName,...Y.phase==="approved"&&Y.approvedName!==void 0&&{approvedName:Y.approvedName},tokenGeneration:J.token_generation}}if(Y?.phase==="approved"){let z={version:1,phase:"blocked",proposedName:Y.proposedName,errorCode:"missing_token",updatedAt:this.#J()};return await J0(this.#Z.statePath,z,()=>$.assertOwned()),X0(z)}if(Y&&Y.phase!=="pending")return X0(Y);if(!Y){let z=this.#J();if(Y={version:1,phase:"pending",proposedName:this.#z,requestSecret:this.#Q(),createdAt:z,updatedAt:z},!y5.test(Y.requestSecret))throw Error("invalid minted Claustrum enrollment secret");await J0(this.#Z.statePath,Y,()=>$.assertOwned())}if(!Y.requestId)try{let z=zL("sha256").update(Buffer.from(Y.requestSecret,"hex")).digest("hex"),Q=await this.#$.enrollPropose({name:Y.proposedName,requestSecretHash:z});Y={...Y,requestId:Q.requestId,updatedAt:this.#J()},await J0(this.#Z.statePath,Y,()=>$.assertOwned())}catch(z){if(z instanceof s6){if(!GY.has(z.code)&&(z.code==="pending_queue_full"||z.action==="retry"))return{state:"pending",proposedName:Y.proposedName,retryCode:z.code};let Q={version:1,phase:"blocked",proposedName:Y.proposedName,errorCode:z.code,updatedAt:this.#J()};return await J0(this.#Z.statePath,Q,()=>$.assertOwned()),X0(Q)}throw z}let G=Y.requestId;if(!G)return X0(Y);try{let z=await this.#$.enrollPoll({requestId:G,requestSecret:Y.requestSecret});if(z.status==="pending")return X0(Y);if(z.status==="denied"){let K={version:1,phase:"denied",proposedName:Y.proposedName,updatedAt:this.#J()};return await J0(this.#Z.statePath,K,()=>$.assertOwned()),X0(K)}await DL(this.#Z.tokenPath,{token:z.token,token_generation:z.tokenGeneration},this.#Y,()=>$.assertOwned());let Q={version:1,phase:"approved",proposedName:Y.proposedName,approvedName:z.name,tokenGeneration:z.tokenGeneration,updatedAt:this.#J()};return await J0(this.#Z.statePath,Q,()=>$.assertOwned()),X0(Q)}catch(z){if(!(z instanceof s6))throw z;if(!GY.has(z.code)&&z.action==="retry")return{state:"pending",proposedName:Y.proposedName,requestId:G,retryCode:z.code};let Q={version:1,phase:"blocked",proposedName:Y.proposedName,errorCode:z.code,updatedAt:this.#J()};return await J0(this.#Z.statePath,Q,()=>$.assertOwned()),X0(Q)}}finally{await $.release()}}}async function IL($,Z){await E5(u8($.statePath),{recursive:!0,mode:448});let J=await b9({name:"ceremony",path:$.statePath,ttlMs:vz,renew:!0});if(!J)return"busy";try{if(await f8($.tokenPath)!==void 0)return"refused-approved";let X=await f8($.statePath);if(X===void 0)return"idle";let Y=h5(X);if(Y.proposedName!==Z)throw Error("Claustrum enrollment state belongs to a different consumer");if(Y.phase==="pending")return"refused-pending";return await J.assertOwned(),await b5($.statePath),"reset"}finally{await J.release()}}var _L="https://api.anthropic.com/api/oauth/profile",PL=604800000;async function gz($){U5($.accessToken,"anthropic");let Z=await($.fetchImpl??fetch)(_L,{method:"GET",signal:$.signal,headers:{Authorization:`Bearer ${$.accessToken}`,Accept:"application/json","anthropic-beta":"oauth-2025-04-20"}});if(!Z.ok)throw Error(`Claude profile check failed: ${Z.status}`);let J=await Z.json(),X=J.organization?.rate_limit_tier,Y=J.organization?.organization_type;if(typeof X!=="string"||X.trim()===""||typeof Y!=="string"||Y.trim()==="")throw Error("Claude profile response is missing account metadata");return{tier:X,orgType:Y,checkedAt:$.now?.()??Date.now(),...$.accountIdentity!==void 0&&{accountIdentity:$.accountIdentity},...$.providerAccountUuid!==void 0&&{providerAccountUuid:$.providerAccountUuid}}}function CR($,Z){if(!$)return!1;if(Z===void 0)return!0;return $.accountIdentity===void 0||$.accountIdentity===Z}function SR($,Z=Date.now()){return Boolean($&&Number.isFinite($.checkedAt)&&Z>=$.checkedAt&&Z-$.checkedAt<PL)}function c4($){let Z=$?.tier.match(/^default_claude_max_(\d+)x$/);if(!Z)return;let J=`Max ${Z[1]}x`;return $?.orgType==="claude_team"?`Team · ${J}`:J}function AL($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};let J=Z[0],X=Z.slice(1).join(" ");if(J==="enable"&&X)return{type:"enable",id:X};if(J==="disable"&&X)return{type:"disable",id:X};if(J==="remove"&&X)return{type:"remove",id:X};if(J==="move-up"&&X)return{type:"move-up",id:X};if(J==="move-down"&&X)return{type:"move-down",id:X};if(J==="reset-backoff"&&!X)return{type:"reset-backoff"};if(J==="enrollment-reset"&&!X)return{type:"enrollment-reset"};if(J==="claustrum"&&!X)return{type:"claustrum-mode",mode:"claustrum"};if(J==="local"&&!X)return{type:"claustrum-mode",mode:"local"};if(J==="add-apikey"&&X){let Y=X,G,z,Q=Y.match(/--base-url\s+(\S+)/);if(Q)G=Q[1],Y=Y.replace(Q[0],"").trim();let K=Y.match(/--auth-header\s+(authorization-bearer|x-api-key)/);if(K)z=K[1],Y=Y.replace(K[0],"").trim();let W,V=Y.match(/--label\s+(.+)/);if(V)W=V[1]?.trim()||void 0,Y=Y.replace(V[0],"").trim();let B=Y.indexOf(" ");if(B===-1){if(!Y)return{type:"usage"};return{type:"add-apikey",apiKey:Y,baseURL:G,authHeader:z,label:W}}let q=Y.slice(0,B),H=Y.slice(B+1).trim();return{type:"add-apikey",apiKey:q,label:W??(H||void 0),baseURL:G,authHeader:z}}if(J==="add-oauth-start")return{type:"add-oauth-start"};if(J==="add-oauth-finish"&&X){let Y=X,G,z=Y.match(/--label\s+(.+)/);if(z)G=z[1]?.trim()||void 0,Y=Y.replace(z[0],"").trim();if(!Y)return{type:"usage"};return{type:"add-oauth-finish",code:Y,label:G}}return{type:"usage"}}function zY($){switch($){case"na":return"n/a (OpenCode-managed)";case"off":return"not enrolled";case"on-vault-served":return"vault-served";case"on-vault-reauth":return"vault reauth";case"on-cold":return"vault cold";case"unknown-identity":return"unknown identity";case"on-identity-mismatch":return"identity mismatch";case"on-corrupt-binding":return"corrupt binding"}}function wL($,Z=!1){switch($.state){case"idle":return["- Enrollment: not enrolled"];case"busy":return["- Enrollment: setup is busy"];case"unavailable":return["- Enrollment: temporarily unavailable"];case"pending":return $.requestId&&/^[A-Za-z0-9_-]{1,128}$/.test($.requestId)?[`- Enrollment: pending approval (${$.requestId})`,"- Next: Quit the host and run `bunx @cortexkit/opencode-anthropic-auth setup`"]:[$.requestId?"- Enrollment: pending approval":"- Enrollment: request not sent","- Next: Quit the host and run `bunx @cortexkit/opencode-anthropic-auth setup`"];case"approved":{let X=$.approvedName??$.proposedName;return/^[A-Za-z0-9_-]{1,128}$/.test(X)?[`- Enrollment: approved as enrolled:${X} (generation ${$.tokenGeneration}${Z?"":"; scoped serving not active yet"})`,...Z?[]:["- Next: Quit the host and run `bunx @cortexkit/opencode-anthropic-auth setup`"]]:[`- Enrollment: approved (generation ${$.tokenGeneration}${Z?"":"; scoped serving not active yet"})`,...Z?[]:["- Next: Quit the host and run `bunx @cortexkit/opencode-anthropic-auth setup`"]]}case"denied":return["- Enrollment: denied by operator"];case"blocked":return[`- Enrollment: blocked (${$.code})`]}}function RL($){let Z=[],J=$.quota?.mainQuota?.five_hour;Z.push({id:"main",label:$.main?.provider==="anthropic"?"OpenCode anthropic":"Main",role:"main",enabled:!0,quotaPercent:J?.usedPercent??null,tierLabel:c4($.main?.profile)});for(let X of $.accounts){let Y=X.quota?.five_hour;Z.push({id:X.id,label:X.label??X.id,role:"fallback",enabled:X.enabled!==!1,quotaPercent:Y?.usedPercent??null,tierLabel:X.type==="oauth"?c4(X.profile):void 0})}return Z}var O7=["Usage:","  /claude-account                       Show account list","  /claude-account enable <id>           Enable a fallback account","  /claude-account disable <id>          Disable a fallback account","  /claude-account remove <id>           Remove a fallback account","  /claude-account claustrum             Enable Claustrum mode","  /claude-account local                 Enable local mode","  /claude-account move-up <id>          Move a fallback account up","  /claude-account move-down <id>        Move a fallback account down","  /claude-account reset-backoff          Clear main OAuth refresh and quota backoff","  /claude-account enrollment-reset       Clear denied/blocked state; rerun setup","  /claude-account add-apikey <key>      Add an API key fallback account","  /claude-account add-oauth-start       Start OAuth device flow","  /claude-account add-oauth-finish <code>  Complete OAuth flow"].join(`
+`);async function kR($){let Z=AL($.argumentsText),J=$.storage.accounts,X="main";if(Z.type==="status"){let G=$.statusProjection?.accounts??RL($.storage),z=$.statusProjection?.claustrumDetection??$.claustrum?.status??"unknown",Q=["## Claude Accounts","",`- Custody mode: ${B7($.storage)}`,`- Claustrum: ${z}`,...$.statusProjection?.claustrumEnrollment?wL($.statusProjection.claustrumEnrollment,$.statusProjection.accounts.some((K)=>K.role==="main"&&K.vaultServed)):[],""];for(let K of G){let W=K.quotaPercent!=null?` ${Math.round(K.quotaPercent)}%`:"",V=!K.enabled?" (disabled)":"",B=K.tierLabel?` · ${K.tierLabel}`:"",q=$.statusProjection?.accounts.find((x)=>x.id===K.id),H=$.storage.accounts.find((x)=>x.id===K.id),j=q?zY(q.custodyState):K.id!=="main"&&H&&B7($.storage)==="claustrum"&&n0(H)&&H.claustrumScopedCredentialId?zY("on-cold"):"local";Q.push(`- **${K.label}** [${K.role}]${B}${V}${W} · ${j}`)}return Q.push("",O7),{text:Q.join(`
+`)}}if(Z.type==="usage")return{text:O7};if(Z.type==="claustrum-mode"){if(!$.transition)return{text:"Claustrum mode transition is unavailable."};return $.transition(Z.mode)}if(Z.type==="enrollment-reset"){if(!$.resetEnrollment)return{text:"Claustrum enrollment reset is unavailable."};return $.resetEnrollment()}if(Z.type==="add-apikey")return{text:"add-apikey"};if(Z.type==="add-oauth-start")return{text:"add-oauth-start"};if(Z.type==="add-oauth-finish")return{text:"add-oauth-finish"};if(Z.type==="reset-backoff")return{text:"Main OAuth refresh and quota backoff cleared.",updated:{id:"main",action:"reset-backoff"}};let Y=Z.id;if(Y==="main")return{text:`Cannot ${Z.type} the main account (OpenCode managed).`};if(Z.type==="enable"||Z.type==="disable"){let G=J.find((z)=>z.id===Y);if(!G)return{text:`Account "${Y}" not found.`};return{text:`Account "${G.label??Y}" ${Z.type}d.`,updated:{id:Y,action:Z.type,enabled:Z.type==="enable"}}}if(Z.type==="remove"){let G=J.find((z)=>z.id===Y);if(!G)return{text:`Account "${Y}" not found.`};if(B7($.storage)==="claustrum"&&n0(G)&&G.claustrumScopedCredentialId)return{text:`Account "${G.label??Y}" is managed by Claustrum. Disable it to stop routing, or remove it from the vault.`};return{text:`Account "${G.label??Y}" removed.`,updated:{id:Y,action:"remove"}}}if(Z.type==="move-up"){let G=J.findIndex((W)=>W.id===Y);if(G<0)return{text:`Account "${Y}" not found.`};if(G===0)return{text:`Account "${J[G]?.label??Y}" is already first.`};let z=J.map((W)=>W.id),Q=[...J];[Q[G-1],Q[G]]=[Q[G],Q[G-1]];let K=Q.map((W)=>W.id);return{text:`Account "${J[G]?.label??Y}" moved up.`,updated:{id:Y,action:"reorder",previousOrder:z,newOrder:K}}}if(Z.type==="move-down"){let G=J.findIndex((W)=>W.id===Y);if(G<0)return{text:`Account "${Y}" not found.`};if(G===J.length-1)return{text:`Account "${J[G]?.label??Y}" is already last.`};let z=J.map((W)=>W.id),Q=[...J];[Q[G],Q[G+1]]=[Q[G+1],Q[G]];let K=Q.map((W)=>W.id);return{text:`Account "${J[G]?.label??Y}" moved down.`,updated:{id:Y,action:"reorder",previousOrder:z,newOrder:K}}}return{text:O7}}var TL="ANTHROPIC_CUSTOM_HEADERS",FL=64,g0=new Map,qJ=new Set,CL=new Set(["authorization","proxy-authorization","x-api-key","host","content-length","content-type","connection","transfer-encoding","upgrade","keep-alive","te","trailer","anthropic-version","anthropic-beta","x-parent-session-id","x-session-affinity","x-opencode-session","x-anthropic-effort-plan","x-cortexkit-billing-lineage"]);function QY($,Z){g0.delete($),g0.set($,Z);while(g0.size>FL){let J=g0.keys().next().value;if(J===void 0)break;g0.delete(J),qJ.delete(J)}}function KY($,Z,J){if(CL.has(Z.trim().toLowerCase()))throw TypeError("protected header");$.set(Z,J)}function SL($){if(!$?.trim())return new Headers;let Z=g0.get($);if(Z!==void 0||g0.has($))return new Headers(Z??[]);try{let J=new Headers,X=$.trim();if(!X.startsWith("{")&&!X.startsWith("["))for(let G of X.split(/\r?\n|,\s*(?=[^,\s:]+:)/).map((z)=>z.trim()).filter(Boolean)){let z=G.indexOf(":");if(z<=0)throw TypeError("invalid header entry");KY(J,G.slice(0,z).trim(),G.slice(z+1).trim())}else{let G=m8(X);if(G==null||typeof G!=="object"||Array.isArray(G))throw TypeError("invalid header object");for(let[z,Q]of Object.entries(G)){if(Q==null)continue;KY(J,z,Array.isArray(Q)?Q.map(String).join(", "):String(Q))}}let Y=[...J.entries()];return QY($,Y),new Headers(Y)}catch{if(QY($,null),!qJ.has($))qJ.add($),t.warn("custom-headers","ignoring malformed ANTHROPIC_CUSTOM_HEADERS",{reason:"invalid or protected header configuration"});return new Headers}}function vR($,Z=process.env[TL]){return SL(Z).forEach((X,Y)=>{$.set(Y,X)}),$}var kL="## Claude Fast Mode Status",vL="## Claude Fast Mode Enabled",fL="## Claude Fast Mode Disabled",EL="## Claude Fast Mode Usage",bL="Usage: `/claude-fast`, `/claude-fast on`, or `/claude-fast off`.",IZ=!1;function fR(){return IZ}function ER($){IZ=$}function gL($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="on")return{type:"enable"};if(Z.length===1&&Z[0]==="off")return{type:"disable"};return{type:"usage"}}function d1($){let Z=$?.enabled??IZ;return[kL,"",`- Enabled: ${Z?"enabled":"disabled"}`,"- Persisted: ~/.config/opencode/anthropic-auth.json","- Scope: adds Anthropic fast mode to supported Opus requests","- Supported models: claude-opus-4-8, claude-opus-5, and claude-opus-5-5",'- Request changes: adds `speed: "fast"` and the `fast-mode-2026-02-01` beta header',"- Note: fast and standard speeds do not share prompt-cache prefixes"].join(`
+`)}function bR($){let Z=gL($.argumentsText),J=$.enabled??IZ;if(Z.type==="status")return d1({enabled:J});if(Z.type==="enable")return[vL,"",d1({enabled:!0})].join(`
+`);if(Z.type==="disable")return[fL,"",d1({enabled:!1})].join(`
+`);return[EL,"",bL,"",d1({enabled:J})].join(`
+`)}var j8="claude-killswitch";function yL($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="on")return{type:"on"};if(Z.length===1&&Z[0]==="off")return{type:"off"};if(Z[0]==="set"){let J=[];for(let X=1;X<Z.length;X++){let Y=Z[X]?.match(/^([^:]+):(\d+),(\d+)(?:,(\d+))?$/);if(!Y)return{type:"usage"};let[,G,z,Q,K]=Y,W=typeof K==="string"&&K.length>0?Number.parseInt(K,10):void 0,V={account:G,fh:Number.parseInt(z,10),sd:Number.parseInt(Q,10)};if(W!==void 0)V.scoped=W;J.push(V)}if(J.length===0)return{type:"usage"};return{type:"set",entries:J}}return{type:"usage"}}function i1($,Z){let J=$.enabled===!0,X=["## Killswitch","",`Status: **${J?"ON":"OFF"}**`];if(J){X.push(""),X.push("| Account | 5h threshold | 1w threshold | Scoped |"),X.push("| ------- | ------------ | ------------ | ------ |");let Y=F4($.main);X.push(`| main | ≥ ${Y.five_hour}% | ≥ ${Y.seven_day}% | ≤ ${Y.scoped}% |`);for(let G of Z){let z=F4($.accounts?.[G]??$.main);X.push(`| ${G} | ≥ ${z.five_hour}% | ≥ ${z.seven_day}% | ≤ ${z.scoped}% |`)}}return X.join(`
+`)}var WY=["## Killswitch Commands","","```",`/${j8}              — show status`,`/${j8} on           — enable with current or default thresholds`,`/${j8} off          — disable`,`/${j8} set all:5,10 — set all accounts to 5h≥5%, 1w≥10%`,`/${j8} set main:3,8,0 — set 5h≥3%, 1w≥8%, scoped≤0%`,`/${j8} set main:3,8 work-alt:5,10 — per-account`,"```"].join(`
+`);function gR($){let Z=yL($.argumentsText);if(Z.type==="status")return{text:`${i1($.config,$.accountIds)}
+
+${WY}`};if(Z.type==="on"){let X={...$.config,enabled:!0,main:$.config.main??{five_hour:I8.five_hour,seven_day:I8.seven_day}};return{text:`## Killswitch Enabled
+
+${i1(X,$.accountIds)}`,updatedConfig:X}}if(Z.type==="off")return{text:"## Killswitch Disabled",updatedConfig:{...$.config,enabled:!1}};if(Z.type==="set"){let X={...$.config.accounts??{}},Y={...$.config,enabled:!0,accounts:X};for(let z of Z.entries){let Q={five_hour:z.fh,seven_day:z.sd};if(z.scoped!==void 0)Q.scoped=z.scoped;if(z.account==="main")Y.main=Q;else if(z.account==="all"){Y.main=Q;for(let K of $.accountIds)X[K]=Q}else X[z.account]=Q}return{text:`## Killswitch Updated
+
+${i1(Y,$.accountIds)}`,updatedConfig:Y}}return{text:`${i1($.config,$.accountIds)}
+
+${WY}`}}var hL=["error","warn","info","debug","trace"],yz="Usage: `/claude-logging`, `/claude-logging error|warn|info|debug|trace`.";function mL($){let Z=$.trim().toLowerCase().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&hL.includes(Z[0]))return{type:"level",level:Z[0]};return{type:"usage"}}function M7($){return["## Claude Log Level","",`Current log level: \`${$?.level??"info"}\``,"- Persisted: ~/.config/opencode/anthropic-auth.json","- Valid levels: error, warn, info, debug, trace","",yz].join(`
+`)}function yR($){let Z=mL($.argumentsText),J=$.level??"info";if(Z.type==="status")return M7({level:J});if(Z.type==="level")return["## Claude Log Level Updated","",`Level set to \`${Z.level}\`.`,"",...M7({level:Z.level}).split(`
+`).slice(2)].join(`
+`);return["## Claude Log Level Usage","",yz,"",...M7({level:J}).split(`
+`).slice(2)].join(`
+`)}var jJ="claude-fable-5",HJ="claude-mythos-5",e0="claude-fable-5-1",m9="claude-mythos-5-1",hz="claude-haiku-4-5";function w0($){return $.endsWith("[1m]")?$.slice(0,-4):$}var VY={input:1,output:5},mz=[e0,m9],uL=[jJ,HJ,...mz],Y1={type:"adaptive",display:"summarized"},hR={input:10,output:50,cacheRead:1,cacheWrite5m:12.5,cacheWrite1h:20},mR={input:10,output:50,cacheRead:0.25,cacheWrite5m:12.5,cacheWrite1h:20},uR=1e6,pR=128000,pL="2026-06-09",cL="2026-09-01",BY={[jJ]:{id:jJ,name:"Claude Fable 5"},[HJ]:{id:HJ,name:"Claude Mythos 5",limited:!0},[e0]:{id:e0,name:"Claude Fable 5.1"},[m9]:{id:m9,name:"Claude Mythos 5.1",limited:!0}},cR={[e0]:BY[e0],[m9]:BY[m9]};function lL($){if(typeof $!=="string")return!1;let Z=w0($);return uL.some((J)=>Z===J||Z.startsWith(`${J}-`))}function dL($){if(typeof $!=="string")return!1;let Z=w0($);return mz.some((J)=>Z===J||Z.startsWith(`${J}-`))}function uz($){if(typeof $!=="string")return!1;let Z=w0($);return Z===e0||Z.startsWith(`${e0}-`)}function lR($){return dL($)?cL:pL}var qY="claude-sonnet-5",dR=Y1;function iR($){if(typeof $!=="string")return!1;let Z=w0($);return!pz(Z)&&(Z===qY||Z.startsWith(`${qY}-`))}var jY="claude-sonnet-5-5",sR="2026-09-28",tR=1e6,aR=128000,nR={input:2,output:10,cacheRead:0.2,cacheWrite5m:2.5,cacheWrite1h:4},oR=Y1;function pz($){if(typeof $!=="string")return!1;let Z=w0($);return Z===jY||Z.startsWith(`${jY}-`)}var iL="claude-haiku-5-5",rR="2026-10-07",eR=1e6,$T=128000,ZT=1e5,JT={input:0.1,output:0.5,cacheRead:0.01,cacheWrite5m:0.125,cacheWrite1h:0.2},XT={input:0.5,output:2.5,cacheRead:0.05,cacheWrite5m:0.625,cacheWrite1h:1},YT=Y1;function sL($){if(typeof $!=="string")return!1;let Z=w0($);return Z===iL||/^claude-haiku-5-5-\d{8}$/.test(Z)}var HY="claude-opus-5",GT=Y1;function tL($){if(typeof $!=="string")return!1;let Z=w0($);return!m5(Z)&&(Z===HY||Z.startsWith(`${HY}-`))}var LY="claude-opus-5-5",zT="2026-09-18",QT=1e6,KT=128000,WT={input:4,output:20,cacheRead:0.2,cacheWrite5m:5,cacheWrite1h:8},VT=Y1;function m5($){if(typeof $!=="string")return!1;let Z=w0($);return Z===LY||Z.startsWith(`${LY}-`)}function BT($){return tL($)||m5($)}function qT($){if(typeof $!=="string")return!1;if($.startsWith("gAAAA"))return!0;if(!$.startsWith("{"))return!1;try{let Z=JSON.parse($);return Z.type==="reasoning"&&typeof Z.id==="string"&&Z.id.startsWith("rs_")&&typeof Z.encrypted_content==="string"&&Z.encrypted_content.startsWith("gAAAA")}catch{return!1}}var jT="mid-conversation-output-config-2026-07-01";function HT($){if($==="minimal")return"low";if($==="low"||$==="medium"||$==="high"||$==="xhigh"||$==="max")return $;return}function LT($){return uz($.model)}function NY($){return process.env[$]?.trim()||void 0}function aL($){if(/^claude-sonnet(?:-|$)/.test($))return"sonnet";if(/^claude-opus(?:-|$)/.test($))return"opus";if(/^claude-haiku(?:-|$)/.test($))return"haiku";if(/^claude-(?:fable|mythos)(?:-|$)/.test($))return"fable";return null}var nL={sonnet:"ANTHROPIC_DEFAULT_SONNET_MODEL",opus:"ANTHROPIC_DEFAULT_OPUS_MODEL",haiku:"ANTHROPIC_DEFAULT_HAIKU_MODEL",fable:"ANTHROPIC_DEFAULT_FABLE_MODEL"};function oL($){if(typeof $!=="string"||!$)return $;let Z=aL($);if(Z){let J=NY(nL[Z]);if(J)return J}if($.startsWith("claude-")){let J=NY("ANTHROPIC_MODEL");if(J)return J}return $}function NT($){if(typeof $.model!=="string")return!1;let Z=oL($.model);if(Z===$.model)return!1;return $.model=Z,!0}var o=process.platform==="win32",DY=new Set;function NJ($){if($?.reason==="io-error"){if($.win32Code===2||$.win32Code===3)return"ENOENT";if($.win32Code===80||$.win32Code===183)return"EEXIST"}return $?.code??"ERR_PRIVATE_FILE"}var OY;function p8(){return OY??=import("./index-zdgceztz.js"),OY}class g6 extends Error{path;stage;code;win32Code;reason;published=!1;durabilityConfirmed=!1;fileDurable=!1;attempts=0;elapsedMs=0;orphanPath;constructor($,Z,J){let X=J;super(`Private file refused at ${Z}: ${$} (${X?.reason??X?.code??"io-error"}). Use a safe parent directory. Repair only a named secret file in safe ancestry whose owner the published policy trusts, without changing its owner or any existing directory. Previously exposed credentials may need rotation. Windows requires the private-files native prebuild and an ACL-persisting local filesystem such as NTFS.`,{cause:J});this.path=$,this.stage=Z,this.name="PrivateFileError",this.code=NJ(X),this.win32Code=X?.win32Code,this.reason=X?.reason}}async function O$($,Z,J){try{return await J()}catch(X){if(X instanceof g6)throw X;throw new g6($,Z,X)}}var XN;async function _0($,Z){$=K$($),Z??=XN,await O$($,"safe-parent",async()=>{let J=await(await p8()).verifySafeParent($,Z);if(J.ok===!1){if(J.reason==="io-error"||J.reason==="wrong-kind")await cz($);throw new g6(J.level??J.path,"safe-parent",{...J,code:"ERR_PRIVATE_FILES_SECURITY"})}})}async function $$($,Z,J=!1){if($=K$($),Z==="directory")return _0($);await O$($,"verify",async()=>{let X=await p8(),Y=await X.verifyOwnerOnly($),G=!1;if(!Y.ok){let{reason:z}=Y.refusal;if(z==="io-error")await X.verifyPrivatePath($,Z);if(J&&[X.EXTRA_ACE,X.NOT_PROTECTED,X.NULL_DACL,X.EMPTY_DACL].includes(z))await _0(H0($)),await X.securePrivatePath($,Z),G=!0;else throw Object.assign(Error("Owner-only verification refused"),{reason:z,code:"ERR_PRIVATE_FILES_SECURITY"})}if(await X.verifyPrivatePath($,Z),G&&!DY.has($))DY.add($),process.emitWarning(`Private permissions tightened: ${$}. This object may have been readable before; rotate credentials if needed.`,"PrivateFileMigration")})}async function i$($,Z=!1,J){$=K$($),await O$($,"directory",async()=>{let X=await p8();try{return await cz($),await _0($,J)}catch(G){if(NJ(G)!=="ENOENT")throw G}let Y=H0($);if(Y===$)throw Object.assign(Error("Missing root"),{code:"ENOENT"});await i$(Y,!1,J);try{await X.createOwnerOnly($,{kind:"dir"})}catch(G){if(NJ(G)!=="EEXIST")throw G}await _0($,J)})}async function V0($,Z=!1){if(!o)return lz($,"utf8");return(await dz($,Z)).toString("utf8")}async function dz($,Z=!1){if(!o)return lz($);if($=K$($),Z)await _0(H0($)),await $$($,"file",!0);return O$($,"read",async()=>(await p8()).readOwnerOnly($))}async function d4($,Z){await _0(H0(K$($))),await O$($,"create",async()=>{await(await p8()).createPrivateFile(K$($),Z)})}async function YN($){await _0(H0(K$($))),await O$($,"directory-create",async()=>{await(await p8()).createOwnerOnly(K$($),{kind:"dir"})})}async function iz($,Z,J={}){$=K$($),Z=K$(Z);let X=J.now??(()=>performance.now()),Y=X(),G=Math.min(Y+500,J.deadline??1/0),z=[0,10,20,40,80,100],Q,K=0;for(let V of z){if(X()>=G)break;if(V)await(J.sleep??((B)=>new Promise((q)=>setTimeout(q,B))))(Math.min(V,Math.max(0,G-X())));if(X()>=G)break;if(await J.beforeRename?.(),X()>=G)break;K++;try{return await(J.rename??JN)($,Z),{attempts:K,elapsedMs:X()-Y}}catch(B){Q??=B;let q=B;if(!(q.win32Code!==void 0?q.win32Code===32||q.win32Code===33:["EBUSY","EPERM","EACCES"].includes(q.code??"")&&!q.reason))break}}let W=new g6(Z,"rename",Q??Object.assign(Error("Publication deadline expired"),{code:"ETIMEDOUT"}));throw W.attempts=K,W.elapsedMs=X()-Y,W}async function u5($,Z,J={}){$=K$($),await i$(H0($));try{await $$($,"file",!0)}catch(W){if(W.code!=="ENOENT")throw W}let X=K$(J.stagePath??`${$}.${ZN()}.tmp`);if(H0(X)!==H0($))throw new g6($,"stage-directory",{code:"EXDEV"});let Y=!1,G=!1,z={attempts:0,elapsedMs:0},Q="stage-create",K=(W)=>{try{J.onOutcome?.({path:$,stage:W?.stage??"published",published:G,fileDurable:G,durabilityConfirmed:!1,attempts:W?.attempts??z.attempts,elapsedMs:W?.elapsedMs??z.elapsedMs,...W&&{code:W.code,win32Code:W.win32Code}})}catch{}};try{if(await d4(X,Z),Y=!0,Q="before-rename",z=await iz(X,$,J),Y=!1,G=!0,Q="published-callback",J.onRenamed?.(),Q="published-verify",await $$($,"file"),J.durable&&J.durability!=="file-only-on-windows")throw new g6($,"directory-sync-unsupported",{code:"ENOTSUP"});K()}catch(W){let V=W instanceof g6?W:new g6($,Q,W);if(V.published=G,V.fileDurable=G,G)Object.assign(V,z);if(Y){try{await xY(X)}catch{V.orphanPath=X}Y=!1}throw K(V),V}finally{if(Y)await xY(X).catch(()=>{})}}class i4 extends Error{constructor($){super("file or directory sync failed",{cause:$});this.name="AtomicSyncError"}}async function c8($,Z,J={}){await sz($,Z,J)}async function sz($,Z,J,X){if(o)return u5($,J.serialize?J.serialize(Z):`${JSON.stringify(Z,null,2)}
+`,{beforeRename:J.beforeRename,stagePath:`${$}.${(J.stageName??UY)()}.tmp`,onRenamed:X,durable:J.durable,durability:J.durability,onOutcome:J.onOutcome});await rL(LJ($),{recursive:!0});let Y=`${$}.${(J.stageName??UY)()}.tmp`,G,z=!1;try{if(G=await l4(Y,"wx",384),z=!0,await G.writeFile(J.serialize?J.serialize(Z):`${JSON.stringify(Z,null,2)}
+`,"utf8"),await G.chmod(384),J.durable)try{await G.sync()}catch(Q){throw new i4(Q)}if(await G.close(),G=void 0,await J.beforeRename?.(),await eL(Y,$),z=!1,X?.(),J.durable){let Q=await l4(LJ($),"r");try{await Q.sync()}catch(K){throw new i4(K)}finally{await Q.close()}}}finally{if(await G?.close().catch(()=>{}),z)await $N(Y,{force:!0}).catch(()=>{})}}async function MY($){if(o){await $$($,"file");let X=new g6($,"directory-sync-unsupported",{code:"ENOTSUP"});throw X.published=!0,X}let Z=await l4($,"r");try{await Z.sync()}finally{await Z.close()}let J=await l4(LJ($),"r");try{await J.sync()}finally{await J.close()}}var PT=Object.freeze({sidebar:Object.freeze({name:"sidebar-write",ttlMs:1e4,timeoutMs:15000,renew:!0}),preferences:Object.freeze({name:"preferences",ttlMs:1e4,timeoutMs:2000,renew:!0})});function zN($,Z){return`${$}.${Z}.lock`}class E8 extends Error{details;constructor($){super(`Timed out acquiring ${$.name} lock for ${$.target}`);this.name="LockContentionError",this.details=$}}class R9 extends Error{details;constructor($){super(`Lost ${$.name} lock for ${$.target}`);this.name="LockOwnershipError",this.details=$}}async function d6($,Z,J){let X=performance.now();for(;;){let Y=await R0({path:$,name:Z.name,ttlMs:Z.ttlMs,renew:Z.renew??!1,...Z.onStep?{onStep:Z.onStep}:{},...Z.onRenewalTimer?{onRenewalTimer:Z.onRenewalTimer}:{}});if(Y)try{return await J(Y)}finally{await Y.release()}let G=Z.timeoutMs-(performance.now()-X);if(G<=0)throw new E8({target:$,name:Z.name,timeoutMs:Z.timeoutMs});await new Promise((z)=>setTimeout(z,Math.min(25,Math.ceil(G))))}}var QN=globalThis.setTimeout.bind(globalThis),KN=globalThis.clearTimeout.bind(globalThis);function WN($){let Z=$?.code;return Z==="ENOENT"||!o&&(Z==="EINVAL"||Z==="ENOTDIR")}async function R0($){let Z=zN($.path,$.name),J=RY(Z,"owner.json"),X=t1(),Y=$.now??Date.now,G=null,z=!1,Q=!1,K,W,V=new Promise((C)=>{W=C});function B(C){try{let y=$.onRenewalTimer?.(C);if(y&&(typeof y==="object"||typeof y==="function")&&"then"in y&&typeof y.then==="function")Promise.resolve(y).catch(()=>{})}catch{}}function q(){if(!G)return;KN(G),G=null,B("cancelled")}function H(C,y){if(K||z)return;K=Object.freeze({reason:C,expectedOwnerId:X,...typeof y?.ownerId==="string"?{observedOwnerId:y.ownerId}:{},...typeof y?.expiresAt==="number"?{observedExpiresAt:y.expiresAt}:{}}),q(),W(K)}let j,x=null,N=`${Z}.evicting`,U=RY(N,"owner.json"),D=t1(),A=5000,I=8;async function L(){if(o)try{return JSON.parse(await V0(Z,!0))}catch(C){if(C.code!=="EISDIR"&&C.reason!=="wrong-kind")throw C;return await $$(Z,"directory",!0),JSON.parse(await V0(J,!0))}try{return JSON.parse(await _Y(Z,"utf8"))}catch(C){if(C.code!=="EISDIR")throw C;return JSON.parse(await _Y(J,"utf8"))}}async function w(){if(o){let u=await L(),c=Number(u?.expiresAt)-Y();await u5(Z,`${JSON.stringify({ownerId:X,expiresAt:Y()+$.ttlMs})}
+`,{deadline:performance.now()+Math.max(0,c),beforeRename:async()=>{let e=await L();if(e?.ownerId!==X||!(Number(e?.expiresAt)>Y())||!await P())throw new R9({target:$.path,name:$.name})}});return}let C=`${Z}.${t1()}.tmp`,y,m=!1;try{y=await GN(C,"wx",384),m=!0,await y.writeFile(`${JSON.stringify({ownerId:X,expiresAt:Y()+$.ttlMs})}
+`,"utf8"),await y.chmod(384),await y.close(),y=void 0;let u=await L();if(u?.ownerId!==X||!(Number(u?.expiresAt)>Y())||!await P())throw new R9({target:$.path,name:$.name});await PY(C,Z),m=!1}finally{if(await y?.close().catch(()=>{}),m)await a1(C,{force:!0}).catch(()=>{})}}async function S(){let C=`${JSON.stringify({ownerId:X,expiresAt:Y()+$.ttlMs})}
+`;if(o)await d4(Z,C);else await wY(Z,C,{encoding:"utf8",mode:384,flag:"wx"})}async function f(C){let y=C.code;if(y==="EEXIST"){if(o)await L();return!0}if(y==="EISDIR"){if(o)await $$(Z,"directory",!0),await V0(J,!0);return!0}return!1}async function d(){if(o)await i$(I7(Z));try{return await S(),!0}catch(C){let y=C.code;if(await f(C))return!1;if(y==="ENOENT"){if(o)await i$(I7(Z));else await IY(I7(Z),{recursive:!0});try{return await S(),!0}catch(m){if(await f(m))return!1;throw m}}throw C}}async function s(){await new Promise((C)=>setTimeout(C,Math.floor(Math.random()*4)))}async function _(C=!0){if(C&&$.onStep)await $.onStep("lock-read-ready");let y;try{y=await L()}catch(u){if(o&&u.code!=="ENOENT")throw u}let m=Number(y?.expiresAt);if(Number.isFinite(m)&&m>Y())return{status:"live"};if(typeof y?.ownerId==="string"&&Number.isFinite(m))return{status:"stale",identity:{kind:"owner",ownerId:y.ownerId,expiresAt:m}};try{let u=await AY(Z),c=Number.isFinite(m)?m:u.mtimeMs+$.ttlMs;if(c>Y())return{status:"live"};return{status:"stale",identity:{kind:"stat",dev:u.dev,ino:u.ino,mtimeMs:u.mtimeMs,expiresAt:c}}}catch(u){if(u.code==="ENOENT"){if($.onStep)await $.onStep("lock-missing");return{status:"missing"}}throw u}}function O(C,y){if(y.status!=="stale")return!1;let m=y.identity;if(C.kind==="owner"&&m.kind==="owner")return C.ownerId===m.ownerId&&C.expiresAt===m.expiresAt;return C.kind==="stat"&&m.kind==="stat"&&C.dev===m.dev&&C.ino===m.ino&&C.mtimeMs===m.mtimeMs&&C.expiresAt===m.expiresAt}async function P(){try{return JSON.parse(await V0(U,o))?.ownerId===D}catch(C){if(o&&C.code!=="ENOENT")throw C;return!1}}async function F(C){if(o)await O$(C,"remove",()=>a1(C,{recursive:!0,force:!0}));else await a1(C,{recursive:!0,force:!0}).catch(()=>{})}async function M(){if(await P())await F(N)}async function R(){if(o)await YN(N);else await IY(N);try{let C=`${JSON.stringify({ownerId:D,createdAt:Y()})}
+`;if(o)await d4(U,C);else await wY(U,C,{encoding:"utf8",mode:384,flag:"wx"})}catch(C){if(WN(C))return!1;throw await M(),C}if($.onStep)await $.onStep("eviction-marker-acquired");return!0}async function k(){let C;try{C=await AY(N)}catch(m){if(m.code==="ENOENT")return"missing";throw m}if(o)await $$(N,"directory",!0);if(C.mtimeMs+A>Y())return"fresh";if($.onStep)await $.onStep("stale-marker-stat");let y=`${N}.${t1()}`;try{await PY(N,y)}catch(m){if(m.code==="ENOENT")return"missing";throw m}if($.onStep)await $.onStep("stale-marker-claimed");return await F(y),"recovered"}async function v(C){try{if(!await R())return!1}catch(y){if(y.code==="EEXIST"){if(o){await $$(N,"directory",!0);try{await V0(U,!0)}catch(m){if(m.code!=="ENOENT")throw m}}return!1}throw y}try{await C()}finally{await M()}return!0}async function T(){for(let C=0;C<I;C++){if($.onStep)await $.onStep("relinquish-read");let y;try{y=await L()}catch(m){if(o)throw m;return}if(y?.ownerId!==X)return;try{await a1(Z,{recursive:!0,force:!0});return}catch(m){if(o)throw m;await s()}}}function g(){if(!$.renew||z||K)return;let C=$.renewIntervalMs??Math.max(1000,Math.floor($.ttlMs/3));if(G=QN(()=>{G=null;let y=(async()=>{let m=!z;try{if(!await v(async()=>{let c=await L(),e=Y();if(z||K){m=!1;return}if(c?.ownerId!==X){H("taken-over",c),m=!1;return}if(!(Number(c?.expiresAt)>e)){H("expired",c),m=!1;return}if($.onStep)await $.onStep("renewal-owner-confirmed");if(z||K){m=!1;return}if(!await P())return;if($.onStep)await $.onStep("renewal-write-fenced");if(z||K){m=!1;return}if(!await P())return;if($.onStep)await $.onStep("renewal-write-ready");if(z||K){m=!1;return}if(await w(),$.onStep)await $.onStep("renewal-write-finished");if(!await P()){H("marker-lost"),m=!1,await T();return}})&&$.onStep)await $.onStep("renewal-marker-unavailable")}catch(u){if(o&&u instanceof g6)j=u,H("renewal-failed"),m=!1;try{let c=await L();if(c?.ownerId!==X)H("taken-over",c);else if(!(Number(c?.expiresAt)>Y()))H("expired",c)}catch{H("renewal-failed")}}finally{if($.onStep)try{await $.onStep("renewal-finished")}catch{}if(m&&!z&&!K)g()}})();x=y,y.finally(()=>{if(x===y)x=null})},C),"unref"in G)G.unref();B("scheduled")}function E(){try{let C=$.onContended?.();if(C&&(typeof C==="object"||typeof C==="function")&&"then"in C&&typeof C.then==="function")Promise.resolve(C).catch(()=>{})}catch{}return null}let h=await d();if(!h)for(let C=0;C<I;C++){if(h=await d(),h)break;let y=await _();if(y.status==="live")return E();if(y.status==="missing")continue;if($.onStep)await $.onStep("stale-lock-observed");try{if(!await R()){await s();continue}}catch(m){if(m.code!=="EEXIST")throw m;if(await k()==="fresh")return null;await s();continue}try{let m=await _();if(m.status==="live")return E();if(!O(y.identity,m))continue;if(!await P())return null;if($.onStep)await $.onStep("stale-lock-confirmed");if(!await P())return null;let u=await _(!1);if(!O(y.identity,u))continue;if(await F(Z),!await P())return null;if($.onStep)await $.onStep("stale-lock-removed");if(h=await d(),!h)return null;if($.onStep)await $.onStep("stale-lock-recreated");if(!await P())return await T(),h=!1,null;break}finally{await M()}}if(!h)return null;return g(),{ownerId:X,whenLost:()=>V,hasLost:()=>K!==void 0,assertOwned:async()=>{if(j)throw j;let C;try{let y=await L();if(C=y,!z&&!K&&y?.ownerId===X&&Number(y?.expiresAt)>Y())return;H(y?.ownerId!==X?"taken-over":"expired",y)}catch(y){if(H("unreadable"),o&&y instanceof g6)throw y}throw new R9({target:$.path,name:$.name,expectedOwnerId:X,...typeof C?.ownerId==="string"?{observedOwnerId:C.ownerId}:{},...typeof C?.expiresAt==="number"?{observedExpiresAt:C.expiresAt}:{}})},release:async()=>{if(o&&Q)return;z=!0,q(),await x;for(let C=0;C<I;C++){try{let y=!1;if(await v(async()=>{let u;try{u=await L()}catch(c){if(o&&c.code==="ENOENT"){y=!0;return}throw c}if(u?.ownerId!==X){y=!0;return}if($.onStep)await $.onStep("release-owner-confirmed");if(!await P())return;await F(Z),y=!0})){if(o&&!y)throw new g6(Z,"release-not-confirmed",{code:"EIO"});Q=y;return}await k()}catch(y){if(o)throw y;return}await s()}if(o)throw new g6(Z,"release-not-confirmed",{code:"ETIMEDOUT"})}}}class G6 extends Error{operation;rowId;phase;retryable;kind;committed;constructor($){super($.message??`${$.operation} failed (${$.kind}, ${$.phase})`,$.cause===void 0?void 0:{cause:$.cause});this.name="PoolOperationError",this.operation=$.operation,this.rowId=$.rowId,this.phase=$.phase,this.retryable=$.retryable,this.kind=$.kind,this.committed=$.committed}}class tz extends Error{operation;constructor($){super(`${$} was called from inside a store hook; hand it to the caller's continuation instead`);this.name="PoolReentryError",this.operation=$}}var _Z="identity-contradicted: ",az="duplicate-identity";function b8($,Z,J){let X=$.rosterRow(Z);if(!X)return;X.enabled=!1;let Y=$.entry(Z)??{credentialEpoch:1,needsFirstReading:!0},G=typeof Y.disabledReason==="string"&&Y.disabledReason.startsWith(_Z);$.setEntry(Z,{...Y,disabledReason:G?Y.disabledReason:J})}function UJ($,Z){let J=$.rosterRow(Z);if(!J)return;J.enabled=!0;let X=$.entry(Z);if(X&&"disabledReason"in X){let Y={...X};delete Y.disabledReason,$.setEntry(Z,Y)}}function PZ($,Z){let J=$.rows().filter((Y)=>Y.invalid===void 0&&!Y.staged&&Y.type==="oauth"&&Y.enabled&&Y.identity===Z),X=[];for(let Y of J.slice(1))b8($,Y.id,az),X.push(Y.id);return X}function AZ($,Z,J){let X=$.rosterRow(Z);if(!X)return[];return X.accountId=J,PZ($,J)}var nz=new BN;function M$($){if(nz.getStore()!==void 0)throw new tz($)}function l8($,Z){return nz.run($,async()=>await Z())}async function qN($,Z,J,X,Y){if(!Z)return;try{await l8($,()=>Z(J,X))}catch(G){Y?.warn("store failure hook threw; the original failure stands",{operation:$,rowId:J,error:G instanceof Error?G.message:String(G)})}}var y6=Object.freeze({ttlMs:1e4,timeoutMs:15000,retryMs:50,renew:!0});async function jN($,Z,J){let X=(z)=>{try{let Q=J.onLockEvent?.({type:z,name:$.name,path:$.path});if(Q&&(typeof Q==="object"||typeof Q==="function")&&"then"in Q&&typeof Q.then==="function")Promise.resolve(Q).catch(()=>{})}catch{}},Y={...Z,...HN($)},G=performance.now();for(;;){let z=await R0({name:$.name,path:$.path,ttlMs:Y.ttlMs,now:J.now,renew:Y.renew,onContended:()=>X("contended"),...J.onRenewalTimer?{onRenewalTimer:(W)=>J.onRenewalTimer?.({name:$.name,path:$.path},W)}:{},...Y.renewIntervalMs!==void 0?{renewIntervalMs:Y.renewIntervalMs}:{},...J.onLockStep?{onStep:(W)=>J.onLockStep?.({name:$.name,path:$.path},W)}:{}});if(z){X("acquired");let W={name:$.name,path:$.path,assertOwned:()=>z.assertOwned(),release:async()=>{await z.release(),X("released")}};try{await W.assertOwned()}catch(V){throw await W.release(),V}return W}let Q=Y.timeoutMs-(performance.now()-G);if(Q<=0)throw new E8({target:$.path,name:$.name,timeoutMs:Y.timeoutMs});let K=Math.floor(Math.random()*(Y.retryMs+1));await new Promise((W)=>setTimeout(W,Math.min(Y.retryMs+K,Q)))}}function HN($){let Z={};if($.ttlMs!==void 0)Z.ttlMs=$.ttlMs;if($.timeoutMs!==void 0)Z.timeoutMs=$.timeoutMs;if($.retryMs!==void 0)Z.retryMs=$.retryMs;if($.renew!==void 0)Z.renew=$.renew;if($.renewIntervalMs!==void 0)Z.renewIntervalMs=$.renewIntervalMs;return Z}class G1{defaults;env;held=[];constructor($,Z){this.defaults=$,this.env=Z}async acquire($){let Z=await jN($,this.defaults,this.env);return this.held.push(Z),await this.assertAll(),Z}async assertAll(){for(let $ of this.held)await $.assertOwned()}async releaseTo($){while(this.held.length>$)await this.held.pop()?.release().catch(()=>{})}async releaseAll(){await this.releaseTo(0)}}function s4($,Z,J){if(J!==void 0)throw new G6({operation:$,rowId:Z,kind:"row-staged",phase:$==="pull"?"pull":"before-first-write",retryable:!1,message:`row ${Z} is reserved for roster publication`})}var L6="commonAuthPool",u9=1,l$="rows",B4="retiredEpochs",xJ=1,oz=300000,B6=L6;function LN($){let Z=JSON.parse(JSON.stringify($)),J=(X)=>{if(Array.isArray(X))return`[${X.map(J).join(",")}]`;if(l(X))return`{${Object.keys(X).sort().map((Y)=>`${JSON.stringify(Y)}:${J(X[Y])}`).join(",")}}`;return JSON.stringify(X)};return J(Z)}function p9($){return z1("sha256").update(LN($)).digest("hex")}function rz($){if(!l($)||Object.keys($).length!==1||typeof $.reservation!=="string"||!$.reservation)return;return{reservation:$.reservation}}function NN($){if(!l($)||typeof $.reservation!=="string"||!$.reservation||typeof $.disabledReason!=="string")return;if(Object.keys($).some((Z)=>!["reservation","label","disabledReason","providerState"].includes(Z)))return;if("label"in $&&typeof $.label!=="string")return;if("providerState"in $&&(typeof $.providerState!=="string"||!/^[a-f0-9]{64}$/.test($.providerState)))return;return $}var x$="commonAuthProviderState";function l($){return $!=null&&typeof $==="object"&&!Array.isArray($)}var UN=new Set(["__proto__","constructor","prototype"]);function t4($){if(typeof $!=="string"||$.length===0)return"id must be non-empty";if($.trim()!==$)return"id must not carry surrounding whitespace";if(UN.has($))return"id is a reserved object key";return}function p5($){let Z=typeof $==="string"?$.trim():"";if(!Z)return!1;try{let J=new URL(Z);return(J.protocol==="http:"||J.protocol==="https:")&&!J.username&&!J.password}catch{return!1}}function ez($){return $.type==="oauth"?`oauth\x00${$.refresh}`:`api\x00${$.apiKey}`}function I6($){return z1("sha256").update(ez($)).digest("hex")}function X8($){return z1("sha256").update(`credential-stamp\x00${ez($)}`).digest("hex")}function i0($){let Z=$.type==="oauth"?["oauth",typeof $.access==="string"?$.access:null,$.refresh,typeof $.expires==="number"&&Number.isFinite($.expires)?$.expires:null]:["api",$.apiKey,$.baseURL.trim(),$.authHeader??"authorization-bearer"];return z1("sha256").update(`credential-dispatch\x00${JSON.stringify(Z)}`).digest("hex")}function $Q($,Z,J,X={}){return{credentialEpoch:Z,digest:X8($),dispatch:i0($),binding:{...J},...X.replace?{replace:!0}:{},...X.providerState!==void 0?{providerState:X.providerState}:{}}}function wZ($,Z){let J=$?.credentialBound?$.credentialBound(Z):Z;return z1("sha256").update(`provider-state\x00${JSON.stringify(J??null)}`).digest("hex")}function c5($,Z,J,X){if(!Z||J===void 0)return;if(!l($)||!Object.hasOwn($,x$))return;let Y=v$($[B6]);if(!Y||Y.providerState===void 0||Y.digest!==X8(Z)||Y.credentialEpoch!==J||Y.binding?.identity!==X)return;return Y.providerState}function X$($){return Number.isSafeInteger($)&&$>=1}function v$($){if(!l($))return;let Z=$.credentialEpoch;if(!X$(Z))return;if(typeof $.digest!=="string")return;if("dispatch"in $&&typeof $.dispatch!=="string")return;if("replace"in $&&$.replace!==!0)return;if("providerState"in $&&typeof $.providerState!=="string")return;let J="staged"in $?NN($.staged):void 0;if("staged"in $&&!J)return;let X={...J?{staged:J}:{},...typeof $.dispatch==="string"?{dispatch:$.dispatch}:{},...$.replace===!0?{replace:!0}:{},...typeof $.providerState==="string"?{providerState:$.providerState}:{}};if(!("binding"in $))return"dispatch"in $||"replace"in $||"providerState"in $||"staged"in $?void 0:{credentialEpoch:Z,digest:$.digest};let Y=$.binding;if(!l(Y))return;if("identity"in Y&&(typeof Y.identity!=="string"||!Y.identity))return;if("baseURL"in Y&&!p5(Y.baseURL))return;if("authHeader"in Y&&Y.authHeader!=="authorization-bearer"&&Y.authHeader!=="x-api-key")return;return{credentialEpoch:Z,digest:$.digest,...X,binding:{...typeof Y.identity==="string"?{identity:Y.identity}:{},...typeof Y.baseURL==="string"?{baseURL:Y.baseURL.trim()}:{},...Y.authHeader==="authorization-bearer"||Y.authHeader==="x-api-key"?{authHeader:Y.authHeader}:{}}}}function xN($,Z,J){if($.identity!==J)return!1;if($.baseURL!==void 0&&(Z.type!=="api"||Z.baseURL!==$.baseURL))return!1;if($.authHeader!==void 0&&(Z.type!=="api"||Z.authHeader!==$.authHeader))return!1;return!0}function DN($,Z,J,X){if(!$)return"none";if(!l(X)||!Object.hasOwn(X,B6))return"missing";let Y=v$(X[B6]);if(!Y)return"malformed";if(Y.digest!==X8($))return"mismatched";if(Y.dispatch===void 0)return"legacy";if(Y.credentialEpoch!==Z)return"mismatched";if(!Y.binding||!xN(Y.binding,$,J))return"mismatched";if(Y.dispatch!==i0($))return"mismatched";return"bound"}function ON($){if(!$.exists)return{status:"ready",exists:!1,config:{}};if("parseError"in $)return{status:"error",reason:"config file is not valid JSON"};let Z=$.value;if(!l(Z))return{status:"error",reason:"config root is not an object"};if("accounts"in Z&&!Array.isArray(Z.accounts))return{status:"error",reason:"config accounts is not an array"};if(!(L6 in Z))return Array.isArray(Z.accounts)?{status:"pending-migration",config:Z}:{status:"ready",exists:!0,config:Z};let J=Z[L6];if(!l(J))return{status:"error",reason:`${L6} is not an object`};let X=J.schemaVersion;if(typeof X!=="number"||!Number.isInteger(X)||X<1)return{status:"error",reason:`${L6}.schemaVersion is invalid`};if(X>u9)return{status:"error",reason:`${L6}.schemaVersion ${X} is newer than ${u9}`};if(l$ in J&&!l(J[l$]))return{status:"error",reason:`${L6}.${l$} is not an object`};return{status:"ready",exists:!0,config:Z}}function MN($){if(!$.exists)return{status:"ready",exists:!1,state:{}};if("parseError"in $)return{status:"error",reason:"state file is not valid JSON"};if(!l($.value))return{status:"error",reason:"state root is not an object"};if("accounts"in $.value&&!l($.value.accounts))return{status:"error",reason:"state accounts is not an object"};return{status:"ready",exists:!0,state:$.value}}function RZ($){return Array.isArray($.accounts)?$.accounts:[]}function ZQ($){let Z=$[L6];if(!l(Z))return{};let J=Z[l$];return l(J)?J:{}}function IN($){return l($.accounts)?$.accounts:{}}function _N($){if(!l($))return"not an object";let Z=t4($.id);if(Z)return Z;if($.type==="api")return p5($.baseURL)?void 0:"invalid baseURL";if($.type==="oauth")return;return"unknown type"}function PN($,Z){if(!l($))return;let J=$.credentialEpoch;if(!X$(J))return;if("needsFirstReading"in $&&typeof $.needsFirstReading!=="boolean")return;if("disabledReason"in $&&typeof $.disabledReason!=="string")return;if("quota"in $&&!Z.validate($.quota))return;if("staged"in $&&!rz($.staged))return;return{credentialEpoch:J,needsFirstReading:$.needsFirstReading===!0,...typeof $.disabledReason==="string"?{disabledReason:$.disabledReason}:{},..."quota"in $?{quota:$.quota}:{}}}function AN($,Z){if(!l(Z))return;if($.type==="api"){let X=typeof Z.apiKey==="string"?Z.apiKey.trim():"";if(!X)return;return{type:"api",apiKey:X,baseURL:String($.baseURL).trim(),authHeader:$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer"}}if($.corrupt===!0)return;let J=Z.refresh;if(typeof J!=="string"||!J.trim())return;return{type:"oauth",refresh:J,...typeof Z.access==="string"?{access:Z.access}:{},...typeof Z.expires==="number"?{expires:Z.expires}:{},...typeof Z.lastRefreshedAt==="number"?{lastRefreshedAt:Z.lastRefreshedAt}:{}}}function JQ($,Z){return RZ($).find((J)=>l(J)&&J.id===Z)}function XQ($){if(!l($[L6]))$[L6]={};return $[L6]}function YQ($){let Z=XQ($);if(!l(Z[l$]))Z[l$]={};return Z[l$]}function Q1($,Z){let J=ZQ($),X=Object.hasOwn(J,Z)?J[Z]:void 0;return l(X)?X:void 0}function GQ($,Z,J){Object.defineProperty(YQ($),Z,{value:J,enumerable:!0,writable:!0,configurable:!0})}function zQ($,Z){let J=$[L6];if(!l(J))return;let X=J[B4];if(!l(X)||!Object.hasOwn(X,Z))return;let Y=X[Z];return X$(Y)?Y:void 0}function QQ($,Z){let J=Q1($,Z)?.credentialEpoch;return X$(J)?J:void 0}function l5($,Z){return Math.max(zQ($,Z)??0,QQ($,Z)??0)+1}function wN($,Z){let J=[...Z];if(J.length===0)return;let X=XQ($),Y=l(X[B4])?X[B4]:{},G={},z=(Q,K)=>Object.defineProperty(G,Q,{value:K,enumerable:!0,writable:!0,configurable:!0});for(let[Q,K]of Object.entries(Y))if(X$(K))z(Q,K);for(let Q of J)z(Q,Math.max(zQ($,Q)??0,QQ($,Q)??1));X[B4]=G}function d8($,Z,J,X){let Y=ZQ($),G=IN(Z),z=new Set,Q=[];for(let K of RZ($)){let W=_N(K),V=l(K)&&typeof K.id==="string"?K.id:void 0,B=V===void 0?void 0:Y[V],q=l(B)&&Object.hasOwn(B,"staged"),H=q?rz(B.staged):void 0;if(W||!l(K)||V===void 0||z.has(V)){if(V!==void 0&&!z.has(V))z.add(V);if(V!==void 0)Q.push({id:V,type:l(K)&&K.type==="api"?"api":"oauth",enabled:!1,needsFirstReading:!0,hasEntry:Object.hasOwn(Y,V),candidate:!1,invalid:"roster",stamp:"none",...H?{staged:H}:{}});continue}z.add(V);let j=K.type==="api"?"api":"oauth",x=Object.hasOwn(Y,V),N=x?PN(Y[V],J):void 0,U=AN(K,G[V]),D=K.enabled!==!1,A=N?N.credentialEpoch:x?void 0:1,I=typeof K.accountId==="string"&&K.accountId?K.accountId:void 0,L={id:V,type:j,enabled:D,needsFirstReading:N?N.needsFirstReading:j==="oauth",hasEntry:x,candidate:!1,...typeof K.label==="string"?{label:K.label}:{},...typeof K.addedAt==="number"?{addedAt:K.addedAt}:{},...I!==void 0?{identity:I}:{},...U?{credential:U,fingerprint:I6(U)}:{},...N?{credentialEpoch:N.credentialEpoch}:{},...H?{staged:H}:{},...N?.disabledReason!==void 0?{disabledReason:N.disabledReason}:{},...N&&"quota"in N?{quota:N.quota}:{},...RN(G[V],U,A,I,X),stamp:DN(U,A,I,G[V])};if(x&&!N)L.invalid="entry";else L.candidate=D&&U!==void 0&&!q;Q.push(L)}return Q}function RN($,Z,J,X,Y){if(!l($)||!Object.hasOwn($,x$))return{};let G=c5($,Z,J,X);if(G===void 0)return{providerStateDropped:"uncovered"};let z=$[x$];if(!Y?.validate(z))return{providerStateDropped:"invalid"};if(wZ(Y,z)!==G)return{providerStateDropped:"uncovered"};return{providerState:z}}function F6($){return $.identity??$.id}function d5($,Z){if($===void 0||$>Z+oz)return Z;return Math.max(Z,$+1)}function TY($,Z){return d5($,Z)>Z+oz}function c9($){let{id:Z,credential:J,identity:X,label:Y,addedAt:G}=$;return{id:Z,...Y!==void 0?{label:Y}:{},type:J.type,addedAt:G,...X!==void 0?{accountId:X}:{},...J.type==="api"?{baseURL:J.baseURL.trim(),authHeader:J.authHeader??"authorization-bearer"}:{}}}function TN($,Z){if($.type==="api")return{apiKey:$.apiKey};return{...$.access!==void 0?{access:$.access}:{},refresh:$.refresh,...$.expires!==void 0?{expires:$.expires}:{},...Z!==void 0?{lastRefreshedAt:Z}:{}}}function FN($,Z){if($.type==="api")return{...$,baseURL:$.baseURL.trim(),authHeader:$.authHeader??"authorization-bearer"};return{...$,...Z!==void 0?{lastRefreshedAt:Z}:{}}}function CN($,Z={}){if(!l($))return"credential must be an object";if($.type==="oauth"){if(typeof $.refresh!=="string"||!$.refresh.trim())return"oauth credential needs a refresh token";return}if($.type==="api"){if(typeof $.apiKey!=="string"||!$.apiKey.trim())return"api credential needs an api key";if($.apiKey.trim()!==$.apiKey)return"api key must not carry surrounding whitespace";if(!(Z.baseURLOptional&&$.baseURL===void 0)&&!p5($.baseURL))return"api credential needs a valid baseURL";return}return"credential type must be oauth or api"}var i5="transition",KQ="transitionMark";function SN($){if(!l($))return;let Z=$[i5];if(!l(Z))return;if(typeof Z.mark!=="string"||Z.mark.length===0)return;if(Z.enabled===!0)return{mark:Z.mark,enabled:!0};if(Z.enabled===!1&&typeof Z.reason==="string")return{mark:Z.mark,enabled:!1,reason:Z.reason};return}function s5($,Z,J){if(J.enabled)UJ($,Z);else b8($,Z,J.reason??"");if(!$.rosterRow(Z))return;let X=$.entry(Z)??{credentialEpoch:1,needsFirstReading:!0};if($.setEntry(Z,{...X,[KQ]:J.mark}),!J.enabled)return;let Y=$.rows().find((G)=>G.id===Z);if(Y?.type==="oauth"&&Y.identity!==void 0)PZ($,Y.identity)}function kN($,Z){if($.type!=="api")return $;return{...$,...Z.baseURL!==void 0?{baseURL:Z.baseURL}:{},...Z.authHeader!==void 0?{authHeader:Z.authHeader}:{}}}function vN($){if(!$.binding)return!1;return $.replace===!0||$.dispatch===void 0}function fN($,Z,J,X={}){let Y=l(Z.accounts)?Z.accounts:{},G=new Map;for(let z of d8($,Z,J)){if(z.invalid||z.staged||!z.credential)continue;let Q=Object.hasOwn(Y,z.id)?Y[z.id]:void 0;if(!l(Q))continue;let K=v$(Q[B6]);if(!K?.binding)continue;if(K.digest!==X8(z.credential))continue;let W=z.credentialEpoch??1;if(K.credentialEpoch>W){if(!vN(K))continue;if(X.requireCredentialStamps){if(K.dispatch===void 0)continue;if(K.dispatch!==i0(kN(z.credential,K.binding)))continue}G.set(z.id,{kind:"replace",stamp:{...K,binding:K.binding}})}else if(K.credentialEpoch===W&&K.dispatch!==void 0&&K.dispatch===i0(z.credential)&&K.binding.identity!==void 0&&z.identity===void 0)G.set(z.id,{kind:"identity",identity:K.binding.identity});else if(K.credentialEpoch===W&&K.binding.identity===z.identity){if(X.requireCredentialStamps&&K.dispatch!==i0(z.credential))continue;let V=SN(Q[B6]);if(V&&Q1($,z.id)?.[KQ]!==V.mark)G.set(z.id,{kind:"transition",transition:V})}}return G}function WQ($,Z,J,X){let G={...$.entry(Z)??{},credentialEpoch:J,needsFirstReading:!0};if(delete G.quota,X.identity!==void 0&&typeof G.disabledReason==="string"&&G.disabledReason.startsWith(_Z))delete G.disabledReason;$.setEntry(Z,G);let z=$.rosterRow(Z);if(!z)return;if(X.identity!==void 0)z.accountId=X.identity;else delete z.accountId;if(X.baseURL!==void 0)z.baseURL=X.baseURL;if(X.authHeader!==void 0)z.authHeader=X.authHeader}function VQ($,Z,J,X={}){let Y=fN($,Z,J,X);if(Y.size===0)return{config:$,torn:[]};let G=structuredClone($),z={rows:()=>d8(G,Z,J),rosterRow:(Q)=>JQ(G,Q),entry:(Q)=>Q1(G,Q),setEntry:(Q,K)=>GQ(G,Q,K)};for(let[Q,K]of Y)if(K.kind==="replace")WQ(z,Q,K.stamp.credentialEpoch,K.stamp.binding);for(let[Q,K]of Y)if(K.kind==="identity")AZ(z,Q,K.identity);else if(K.kind==="transition")s5(z,Q,K.transition);else if(K.stamp.binding.identity!==void 0)PZ(z,K.stamp.binding.identity);return{config:G,torn:[...Y.keys()]}}function BQ($,Z,J,X={}){let{config:Y,torn:G}=VQ($,Z,J,X),z=d8(Y,Z,J,X.providerState);for(let Q of z){if(G.includes(Q.id))Q.torn=!0,Q.candidate=!1;if(X.requireCredentialStamps&&Q.stamp!=="bound")Q.unbound=!0,Q.candidate=!1}return z}async function _7($){try{return await V0($,o)}catch(Z){if(Z.code==="ENOENT")return;throw Z}}function FY($){if($===void 0)return{exists:!1};try{return{exists:!0,value:JSON.parse($)}}catch(Z){return{exists:!0,parseError:Z}}}async function f$($){for(let Z=0;Z<3;Z++){let J=await _7($.configPath),X=await _7($.statePath),Y=await _7($.configPath);if(J!==Y){if(Z<2)await VN(2+Math.floor(Math.random()*4));continue}let G=ON(FY(J));if(G.status==="error")return{status:"error",file:"config",reason:G.reason};let z=MN(FY(X));if(z.status==="error")return{status:"error",file:"state",reason:z.reason};if(G.status==="pending-migration")return{status:"pending-migration",config:G.config};return{status:"ready",configExists:G.exists,stateExists:z.exists,config:G.config,state:z.state,rows:BQ(G.config,z.state,$.codec,{requireCredentialStamps:$.requireCredentialStamps===!0,...$.providerState?{providerState:$.providerState}:{}})}}return{status:"error",file:"config",kind:"snapshot-contended",retryable:!0,reason:"The store was changing; retry the operation once writes settle."}}function Y8($,Z,J,X="before-first-write"){if($.status==="error"&&$.kind==="snapshot-contended")return new G6({operation:Z,...J!==void 0?{rowId:J}:{},phase:X,kind:"snapshot-contended",retryable:!0,message:$.reason});return new G6({operation:Z,...J!==void 0?{rowId:J}:{},phase:X,retryable:!1,kind:$.status==="pending-migration"?"pending-migration":"load-error",message:$.status==="pending-migration"?"the config holds a legacy roster that has not been migrated into the pool":`${$.file} file cannot be loaded: ${$.reason}`})}class qQ{ctx;snapshot;locks;progress;info;config;state;constructor($,Z,J,X,Y){this.ctx=$,this.snapshot=Z,this.locks=J,this.progress=X,this.info=Y,this.config=structuredClone(Z.config),this.state=structuredClone(Z.state)}rows(){return BQ(this.config,this.state,this.ctx.codec,{requireCredentialStamps:this.ctx.requireCredentialStamps===!0,...this.ctx.providerState?{providerState:this.ctx.providerState}:{}})}row($){return this.rows().find((Z)=>Z.id===$)}reservation($){if(this.rosterRow($)){let J=this.entry($);return J&&Object.hasOwn(J,"staged")?J.staged:void 0}let Z=this.stateAccount($)?.[B6];return l(Z)&&Object.hasOwn(Z,"staged")?Z.staged:void 0}assertNotStaged($){s4(this.info.operation,$,this.reservation($))}roster(){if(!Array.isArray(this.config.accounts))this.config.accounts=[];return this.config.accounts}rosterRow($){return this.roster(),JQ(this.config,$)}dropRosterRows($){let Z=this.roster(),J=Z.filter((X)=>!(l(X)&&X.id===$));return this.config.accounts=J,Z.length-J.length}entries(){return YQ(this.config)}entry($){return this.entries(),Q1(this.config,$)}setEntry($,Z){GQ(this.config,$,Z)}async completeTorn(){let{config:$,torn:Z}=VQ(this.config,this.state,this.ctx.codec,{requireCredentialStamps:this.ctx.requireCredentialStamps===!0});if(Z.length===0)return;this.config=$,await this.commitConfig({counted:!1})}stateAccount($){let Z=l(this.state.accounts)?this.state.accounts:{},J=Object.hasOwn(Z,$)?Z[$]:void 0;return l(J)?J:void 0}dropStateAccount($){if(l(this.state.accounts)&&Object.hasOwn(this.state.accounts,$))delete this.state.accounts[$]}setStateAccount($,Z){if(!l(this.state.accounts))this.state.accounts={};Object.defineProperty(this.state.accounts,$,{value:Z,enumerable:!0,writable:!0,configurable:!0})}async commitConfig($={}){let Z=this.roster(),J=new Set;for(let K of Z)if(l(K)&&typeof K.id==="string")J.add(K.id);let X=new Set;for(let K of RZ(this.snapshot.config))if(l(K)&&typeof K.id==="string"&&!J.has(K.id))X.add(K.id);for(let K of Object.keys(this.entries()))if(!J.has(K))X.add(K);wN(this.config,X);let Y=this.entries(),G={};for(let[K,W]of Object.entries(Y))if(J.has(K))Object.defineProperty(G,K,{value:W,enumerable:!0,writable:!0,configurable:!0});let z=this.config[L6],Q={...this.config,version:xJ,accounts:Z,[L6]:{...z,schemaVersion:u9,[l$]:G}};await this.write(this.ctx.configPath,Q,"config",$.counted??!0,$.durable??!1,()=>{if($.publicationDecision)this.markPublicationDecision();for(let K of X)this.ctx.removedIds.add(K);this.config=Q}),this.config=Q}async commitState($,Z={}){let J={...this.state,version:xJ,accounts:l(this.state.accounts)?this.state.accounts:{}};if(await this.write(this.ctx.statePath,J,"state",!0,Z.durable??!1),this.state=J,$)this.progress.committed=$}async assertAll(){await this.locks.assertAll()}async syncState(){await this.assertAll();try{if(this.snapshot.stateExists)await MY(this.ctx.statePath)}catch($){throw new G6({operation:this.info.operation,rowId:this.info.rowId,phase:"before-first-write",kind:"publication-sync",retryable:!0,message:"Publication sync failed before the decision; nothing was written. Retry the same plan.",cause:$})}}markPublicationDecision(){this.progress.publicationDecided=!0}async syncConfig(){await this.assertAll(),await MY(this.ctx.configPath)}async write($,Z,J,X=!0,Y=!1,G){await sz($,Z,{durable:Y,beforeRename:async()=>{await this.ctx.onStep?.(`before-${J}-write`,this.info),await this.locks.assertAll()}},()=>{if(X)this.progress.writes++;G?.()}),await this.ctx.onStep?.(`after-${J}-write`,this.info)}}async function EN($,Z){let J=new G1($.lockDefaults,$.lockEnv),X={writes:0};try{for(let Q of $.storeLocks)await J.acquire(Q);let Y=await f$($);if(Y.status==="error")throw Y8(Y,"initialize",void 0);if(Y.status==="ready")return"already-ready";let G={};for(let[Q,K]of Object.entries(Y.config))if(!Z.includes(Q))G[Q]=K;G.version=xJ,G[L6]={schemaVersion:u9,[l$]:{}};let z={operation:"initialize",rowId:void 0};return await c8($.configPath,G,{beforeRename:async()=>{await $.onStep?.("before-config-write",z),await J.assertAll()}}),X.writes++,await $.onStep?.("after-config-write",z),"initialized"}catch(Y){throw TZ(Y,"initialize",void 0,X)}finally{await J.releaseAll()}}async function Y$($,Z,J,X,Y,G={}){let z=Z.held.length;try{for(let W of $.storeLocks)await Z.acquire(W);let Q=await f$($);if(Q.status!=="ready")throw Y8(Q,X.operation,X.rowId,J.writes>0?"after-first-write":"before-first-write");let K=new qQ($,Q,Z,J,X);if(X.rowId!==void 0&&!["add","remove","pull","publishRoster","enable","disable"].includes(X.operation))K.assertNotStaged(X.rowId);if(G.completeTorn??!0)await K.completeTorn();return await Y(K)}finally{await Z.releaseTo(z)}}function TZ($,Z,J,X){let Y=Z==="pull"?"pull":X.writes>0?"after-first-write":"before-first-write",G=Y==="after-first-write"?X.committed:void 0;if(Z==="publishRoster"&&X.publicationDecided)return new G6({operation:Z,...J!==void 0?{rowId:J}:{},phase:Y,kind:"publication-incomplete",retryable:!0,message:"The publication may already be decided. Replay the same plan or check publication(operationId).",cause:$});if(Z==="publishRoster"&&$ instanceof i4)return new G6({operation:Z,...J!==void 0?{rowId:J}:{},phase:Y,kind:"publication-sync",retryable:!0,message:"Publication sync failed before the decision; nothing was written. Retry the same plan.",cause:$});if($ instanceof G6){if($.phase===Y&&$.rowId===J&&$.operation===Z&&$.committed===G)return $;return new G6({operation:Z,...J!==void 0?{rowId:J}:{},phase:$.kind==="after-persist-hook"?$.phase:Y,retryable:$.retryable,kind:$.kind,...$.committed??G?{committed:$.committed??G}:{},message:$.message,...$.cause!==void 0?{cause:$.cause}:{}})}let z={operation:Z,...J!==void 0?{rowId:J}:{},phase:Y,...G?{committed:G}:{},cause:$};if($ instanceof R9)return new G6({...z,retryable:!0,kind:"lock-ownership",message:Y==="after-first-write"?`${Z} lost a lease after its first write; the intermediate stays on disk`:`${Z} lost a lease before writing; nothing was written`});if($ instanceof E8)return new G6({...z,retryable:!0,kind:"lock-contention",message:$.message});return new G6({...z,retryable:!1,kind:"unexpected",message:$ instanceof Error?$.message:String($)})}async function I$($,Z,J,X,Y){let G=new G1($.lockDefaults,$.lockEnv),z={writes:0};try{return await Y(G,z)}catch(Q){let K=TZ(Q,Z,J,z);if(K.kind!=="after-persist-hook")await qN(Z,X,J,K,$.logger);throw K}finally{await G.releaseAll()}}function r$($,Z){return{...$.rowLockOptions,name:`row-${encodeURIComponent(F6(Z))}`,path:$.ctx.statePath}}async function i8($,Z,J){let X=await f$($.ctx);if(X.status!=="ready")throw Y8(X,Z,J);let Y=X.rows.find((W)=>W.id===J),G=Q1(X.config,J),z=X.state.accounts,Q=l(z)&&Object.hasOwn(z,J)?z[J]:void 0,K=l(Q)?Q[B6]:void 0;if(Y&&!["enable","disable"].includes(Z)&&G&&Object.hasOwn(G,"staged"))s4(Z,J,G.staged);if(!Y&&l(K)&&Object.hasOwn(K,"staged"))s4(Z,J,K.staged);if(!Y)throw P0(Z,J);return{result:X,row:Y}}function P0($,Z){return new G6({operation:$,rowId:Z,phase:$==="pull"?"pull":"before-first-write",retryable:!1,kind:"unknown-row",message:`no row ${Z} in the pool`})}function E$($,Z){if(Z.unbound)throw p($,Z.id,"unbound-credential",`row ${Z.id}'s credential is not the one this store stamped for it (stamp ${Z.stamp}); replace it with fresh material`)}function p($,Z,J,X,Y=!1){return new G6({operation:$,rowId:Z,phase:$==="pull"?"pull":"before-first-write",retryable:Y,kind:J,message:X})}async function jQ($,Z,J,X){let{ctx:Y}=$,G=new G1(Y.lockDefaults,Y.lockEnv),z={writes:0};try{if(!X$(J?.credentialEpoch))throw p("pull",Z,"invalid-input","the credential epoch the reading was issued for must be a positive safe integer");await Y$(Y,G,z,{operation:"pull",rowId:Z},async(Q)=>{Q.assertNotStaged(Z);let K=Q.row(Z);if(!K)throw P0("pull",Z);if(K.invalid)throw p("pull",Z,"invalid-row",`row ${Z} is invalid`);if(!K.credential)throw p("pull",Z,"no-credential",`row ${Z} holds no credential`);E$("pull",K);let W=Q.entry(Z);if(K.torn||!W||W.credentialEpoch!==J.credentialEpoch||K.identity!==J.identity)throw new G6({operation:"pull",rowId:Z,phase:"pull",retryable:!0,kind:"attribution",message:`quota for ${Z} was issued for a credential the row no longer holds`});let V=Y.codec.merge(W.quota,X);if(!Y.codec.validate(V))throw p("pull",Z,"invalid-quota","the quota codec rejected the merged map");Q.setEntry(Z,{...W,quota:V,needsFirstReading:!1}),await Q.commitConfig()},{completeTorn:!1})}catch(Q){throw TZ(Q,"pull",Z,z)}finally{await G.releaseAll()}}function G8($,Z,J,X,Y="the provider state"){if(!$)throw p(Z,J,"invalid-input","the store was opened without a provider-state codec");let G;try{let z=JSON.stringify(X);G=z===void 0?void 0:JSON.parse(z)}catch{G=void 0}if(G===void 0)throw p(Z,J,"invalid-provider-state",`${Y} cannot be stored as JSON`);if(!$.validate(G))throw p(Z,J,"invalid-provider-state",`the provider-state codec rejected ${Y}`);return G}function t5($,Z,J,X,Y){if(X===void 0||!$?.merge)return{kind:"set",value:Y};return{kind:"set",value:G8($,Z,J,$.merge(structuredClone(X),structuredClone(Y)),"the merged provider state")}}function bN($,Z,J,X,Y){let G=$?.onReplace,z=G?G(Z.providerState===void 0?void 0:structuredClone(Z.providerState),{id:Z.id,credentialEpoch:J,...Z.identity!==void 0?{previousIdentity:Z.identity}:{},...X!==void 0?{identity:X}:{},...Y!==void 0?{incoming:structuredClone(Y)}:{}}):Y;if(z===void 0)return{kind:"clear"};if(!G)return{kind:"set",value:z};return{kind:"set",value:G8($,"replace",Z.id,z,"the provider state onReplace returned")}}function gN($,Z,J,X,Y){if(Z.kind==="set")return wZ($,Z.value);if(Z.kind==="clear")return;return c5(J,X?.credential,Y,X?.identity)}async function yN($,Z,J,X,Y={}){M$("updateProviderState");let{ctx:G}=$,z="updateProviderState";return I$(G,z,Z,Y.onFailure,async(Q,K)=>{let W=G.providerState;if(!W)throw p(z,Z,"invalid-input","the store was opened without a provider-state codec");if(typeof X!=="function")throw p(z,Z,"invalid-input","a mutator is required");let V=l(J)?J.credentialEpoch:void 0;if(!X$(V))throw p(z,Z,"invalid-input","the credential epoch the provider state was read at is required");let{row:B}=await i8($,z,Z);await Q.acquire(r$($,B));for(let q of Y.extraLocks??[])await Q.acquire(q);return Y$(G,Q,K,{operation:z,rowId:Z},async(q)=>{let H=q.row(Z);if(!H)throw P0(z,Z);if(F6(H)!==F6(B))throw p(z,Z,"row-key-changed",`row ${Z}'s wire identity changed while its lock was being taken`,!0);if(H.invalid)throw p(z,Z,"invalid-row",`row ${Z} failed validation`);if(!H.credential)throw p(z,Z,"no-credential",`row ${Z} holds no credential`);if(E$(z,H),(H.credentialEpoch??1)!==V||H.identity!==J.identity)throw p(z,Z,"attribution",`the provider state for ${Z} was read for a credential or account the row no longer holds`,!0);let x=await HQ(q,W,z,H,X);if(x.kind!=="changed")return{id:Z,outcome:"unchanged",...x.kind==="unchanged"&&x.value!==void 0?{providerState:x.value}:{}};return q.setStateAccount(Z,x.account),await q.commitState(),x.value===void 0?{id:Z,outcome:"cleared"}:{id:Z,outcome:"updated",providerState:x.value}})})}var hN=Symbol.for("@cortexkit/common-auth/store/decline-transition");async function HQ($,Z,J,X,Y,G=!1){let{id:z,credential:Q}=X;if(!Q)throw p(J,z,"no-credential",`row ${z} holds no credential`);let K=X.credentialEpoch??1,W=$.stateAccount(z),V=W?.[B6],B=v$(V);if(!l(V)||!B?.binding||B.digest!==X8(Q)||B.credentialEpoch!==K||B.binding.identity!==X.identity)throw p(J,z,"unbound-credential",`row ${z}'s credential carries no stamp of this store to bind a provider state to (stamp ${X.stamp}); rotate or replace it first`);let q=X.providerState===void 0?void 0:structuredClone(X.providerState),H=await l8(J,()=>Y(q,X));if(G&&H===hN)return{kind:"declined"};let j=H===void 0?void 0:G8(Z,J,z,H,"the provider state the mutator returned"),x=W!==void 0&&Object.hasOwn(W,x$);if(j===void 0?!x:X.providerState!==void 0&&JSON.stringify(X.providerState)===JSON.stringify(j))return{kind:"unchanged",...j!==void 0?{value:j}:{}};let N={...W};if(j===void 0){delete N[x$];let U={...V};delete U.providerState,N[B6]=U}else{N[x$]=j;let U=wZ(Z,j);if(B.providerState!==U)N[B6]={...V,providerState:U}}return{kind:"changed",...j!==void 0?{value:j}:{},account:N}}async function a5($,Z,J){if(!J)return;let X=$.rows().map((G)=>{let{id:z,type:Q,label:K,enabled:W,disabledReason:V,identity:B,credentialEpoch:q,stamp:H,staged:j,torn:x,invalid:N}=G;return{id:z,type:Q,label:K,enabled:W,disabledReason:V,identity:B,credentialEpoch:q,stamp:H,staged:j,torn:x,invalid:N}}),Y=await l8($.info.operation,()=>J({id:Z,row:X.find((G)=>G.id===Z),rows:X,config:structuredClone($.snapshot.config)}));if(Y!==void 0)throw p($.info.operation,Z,"row-protected",Y)}var mN=["access","refresh","expires","lastRefreshedAt","apiKey"];function uN($){return{baseURL:String($.baseURL).trim(),authHeader:$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer"}}function pN($,Z,J){if(J.type!=="api")return J;let X=$.rosterRow(Z);if(!l(X)){if(J.baseURL===void 0)throw p($.info.operation,Z,"invalid-input","api credential needs a valid baseURL");return{...J,baseURL:J.baseURL}}let Y=$.row(Z)?.credential,G=Y?.type==="api"?{baseURL:Y.baseURL.trim(),authHeader:Y.authHeader??"authorization-bearer"}:uN(X),z=J.baseURL?.trim()??G.baseURL,Q=J.authHeader??G.authHeader;if(z!==G.baseURL||Q!==G.authHeader)throw p($.info.operation,Z,"endpoint-mismatch",`row ${Z} sends its key to another endpoint or header; a key for another endpoint is a replacement`);return{...J,baseURL:z,authHeader:Q}}function LQ($,Z,J,X){let Y=$.rosterRow(Z),G=$.row(Z),z=X??(G?G.identity:l(Y)&&typeof Y.accountId==="string"&&Y.accountId?Y.accountId:void 0);return{...z!==void 0?{identity:z}:{},...J.type==="api"?{baseURL:J.baseURL,authHeader:J.authHeader??"authorization-bearer"}:{}}}function q4($,Z,J,X,Y={}){let G=pN(Z,J,X),z=Z.stateAccount(J),Q=Y.providerState??{kind:"keep"},K=Z.row(J)?.credentialEpoch??Z.entry(J)?.credentialEpoch,W=typeof K==="number"?K:1,V=gN($.ctx.providerState,Q,z,z&&Object.hasOwn(z,x$)?Z.row(J):void 0,W),B=typeof z?.lastRefreshedAt==="number"?z.lastRefreshedAt:void 0,q=G.type==="oauth"?Y.stamp??d5(B,$.ctx.now()):void 0,H={...z??{}};for(let N of mN)delete H[N];if(Y.clearErrors)delete H.lastRefreshError,delete H.lastQuotaRefreshError,delete H.quota;if(Q.kind==="clear")delete H[x$];else if(Q.kind==="set")H[x$]=Q.value;let j=FN(G,q),x={...H,...TN(G,q),[B6]:{...Y.staged?{staged:Y.staged}:{},...Y.transition!==void 0?{[i5]:Y.transition}:{},...$Q(j,W,Y.binding??LQ(Z,J,j,Y.identity),{replace:Y.binding!==void 0,...V!==void 0?{providerState:V}:{}})}};return{stored:j,account:x}}async function j4($,Z,J){return $.setStateAccount(Z,J.account),await $.commitState(J.stored),J.stored}async function n5($,Z,J,X,Y={}){return j4(Z,J,q4($,Z,J,X,Y))}async function cN($,Z,J){if(!Z.credential||Z.stamp!=="bound")return;let X=$.stateAccount(Z.id),Y=c5(X,Z.credential,Z.credentialEpoch??1,Z.identity);$.setStateAccount(Z.id,{...X??{},[B6]:$Q(Z.credential,Z.credentialEpoch??1,LQ($,Z.id,Z.credential,J),Y!==void 0?{providerState:Y}:{})}),await $.commitState()}function o5($,Z,J){let X=$==="add"?t4(Z):void 0;if(X)throw p($,Z,"invalid-input",X);let Y=CN(J,{baseURLOptional:$==="rotate"});if(Y)throw p($,Z,"invalid-input",Y)}function FZ($,Z,J,X){if(!J)throw P0($,Z);if(J.invalid)throw p($,Z,"invalid-row",`row ${Z} failed validation`);if(X&&X.type!==J.type)throw p($,Z,"type-mismatch",`row ${Z} holds a ${J.type} credential`);return J}function K1($,Z,J){if(J!==void 0&&!X$(l(J)?J.credentialEpoch:void 0))throw p($,Z,"invalid-input","the attribution must name a credential epoch that is a positive safe integer")}function CZ($,Z,J,X){if(!J)throw P0($,Z);if(J.invalid)throw p($,Z,"invalid-row",`row ${Z} failed validation`);if((J.credentialEpoch??1)!==X.credentialEpoch||J.identity!==X.identity)throw p($,Z,"attribution",`the ${$} of ${Z} was issued for a credential or account the row no longer holds`,!0)}function a4($,Z){return p($,Z,"identity-mismatch",`row ${Z} is recorded for another account; a credential of a different account is a replacement`)}function W1($,Z){return p($,Z,"row-key-changed",`row ${Z}'s wire identity changed while its lock was being taken`,!0)}function lN($,Z,J,X){let{id:Y,credential:G,identity:z}=J;if(!$.ctx.requireCredentialStamps||Z.rosterRow(Y)||!R8(Z.state,Y))return;let Q=()=>{throw p("add",Y,"unbound-credential",`orphan ${Y} cannot be bound to this add's material; remove it explicitly before adding different material`)},K=Z.stateAccount(Y),W=v$(K?.[B6]);if(!W?.binding||W.dispatch===void 0||W.replace)return Q();if(G.type==="api"&&(W.binding.baseURL===void 0||W.binding.authHeader===void 0))return Q();let V=G.type==="api"?{...G,baseURL:W.binding.baseURL,authHeader:W.binding.authHeader}:G,[B]=d8({accounts:[c9({id:Y,credential:V,identity:W.binding.identity,addedAt:0})],[L6]:{rows:{[Y]:{credentialEpoch:l5(Z.config,Y)}}}},Z.state,$.ctx.codec,$.ctx.providerState);if(!B?.credential||B.invalid||B.stamp!=="bound")return Q();if(z!==void 0&&z!==B.identity)return Q();if(X8(G)!==W.digest)return Q();if(G.type==="api"){if(G.baseURL.trim()!==W.binding.baseURL)return Q();if((G.authHeader??"authorization-bearer")!==W.binding.authHeader)return Q()}else if(i0(G)!==W.dispatch)return Q();if(W.providerState!==void 0&&B.providerState===void 0)return Q();if(X!==void 0&&wZ($.ctx.providerState,X)!==W.providerState)return Q();return B}function dN($,Z,J,X){let{id:Y,credential:G,identity:z,label:Q}=J,K=Z.rosterRow(Y),W=()=>{throw p("add",Y,K?"id-exists":"unbound-credential",`row ${Y} does not match this staged add`)},V=Z.stateAccount(Y),B=v$(V?.[B6]),q=B?.staged;if(!B?.binding||!q||B.replace||B.dispatch===void 0)return W();if(K&&(K.type!==G.type||K.label!==Q||K.accountId!==z))return W();if(q.reservation!==J.stage?.reservation||q.label!==Q||q.disabledReason!==J.disabled?.reason||B.binding.identity!==z)return W();let H=X===void 0?void 0:p9(X),j=V?.[x$],x=j===void 0?void 0:p9(j);if(q.providerState!==H||q.providerState!==x)return W();if(X8(G)!==B.digest||i0(G)!==B.dispatch)return W();let N=K?Z.config:{accounts:[{...c9({id:Y,credential:G.type==="api"?{...G,baseURL:B.binding.baseURL??"",authHeader:B.binding.authHeader}:G,identity:B.binding.identity,label:q.label,addedAt:0}),enabled:!1}],[L6]:{rows:{[Y]:{credentialEpoch:B.credentialEpoch,disabledReason:q.disabledReason,staged:{reservation:q.reservation}}}}},U=d8(N,Z.state,$.ctx.codec,$.ctx.providerState).find((D)=>D.id===Y);if(!U?.credential||U.invalid||U.stamp!=="bound"||U.type!==G.type||U.enabled||U.label!==q.label||U.identity!==B.binding.identity||U.disabledReason!==q.disabledReason||U.staged?.reservation!==q.reservation)return W();if(K)return{id:Y,outcome:"exists",credential:U.credential,credentialEpoch:B.credentialEpoch};if(l5(Z.config,Y)!==B.credentialEpoch)return W();return Z.roster().push({...c9({id:Y,credential:G,identity:z,label:Q,addedAt:$.ctx.now()}),enabled:!1}),Z.setEntry(Y,{credentialEpoch:B.credentialEpoch,needsFirstReading:G.type==="oauth",disabledReason:q.disabledReason,staged:{reservation:q.reservation}}),Z.commitConfig().then(()=>({id:Y,outcome:"completed",credential:U.credential,credentialEpoch:B.credentialEpoch}))}async function iN($,Z,J={}){M$("add");let{ctx:X}=$,{id:Y,credential:G,identity:z,label:Q}=Z,K=Z.stage!==void 0||Z.disabled!==void 0,W=await I$(X,"add",Y,J.onFailure,async(V,B)=>{o5("add",Y,G);let q=J.onExisting??"rotate";if(Z.stage!==void 0&&q==="rotate")throw p("add",Y,"invalid-input","a staged add needs onExisting: 'refuse' or 'stage-duplicate'");if(!["rotate","refuse","stage-duplicate"].includes(q)||Z.stage!==void 0&&(Q!==void 0&&typeof Q!=="string"||z!==void 0&&(typeof z!=="string"||!z))||Z.disabled!==void 0&&(!l(Z.disabled)||typeof Z.disabled.reason!=="string")||Z.stage!==void 0&&(!l(Z.stage)||typeof Z.stage.reservation!=="string"||!Z.stage.reservation||!Z.disabled)||q==="stage-duplicate"&&(!Z.disabled||!Z.stage))throw p("add",Y,"invalid-input","staging requires a reservation and a disabled reason");let H=Z.providerState===void 0?void 0:G8(X.providerState,"add",Y,Z.providerState);if(await V.acquire(r$($,{id:Y,identity:z})),G.type==="oauth")await V.acquire(J.providerLock??$.providerLock);for(let j of J.extraLocks??[])await V.acquire(j);return Y$(X,V,B,{operation:"add",rowId:Y},async(j)=>{await a5(j,Y,J.protect);let x=l(j.state.accounts)?j.state.accounts:{},N=Object.entries(x).find(([_,O])=>{if(_===Y||j.rosterRow(_)||!l(O))return!1;let P=O[B6];if(!l(P)||!Object.hasOwn(P,"staged"))return!1;return G.type==="oauth"?O.refresh===G.refresh:typeof O.apiKey==="string"&&O.apiKey.trim()===G.apiKey.trim()});if(N)throw p("add",N[0],"row-staged",`orphan ${N[0]} reserves this secret until its staged add is replayed or removed`);if(X.removedIds.has(Y))throw p("add",Y,"id-removed",`id ${Y} was removed from the roster in this process and is not reused`);if(Z.stage&&q!=="rotate"&&(j.rosterRow(Y)||R8(j.state,Y)))return dN($,j,Z,H);if(q==="rotate"){j.assertNotStaged(Y);let _=j.rows().find((O)=>O.fingerprint===I6(G));if(_)j.assertNotStaged(_.id)}if(q==="refuse"){let _=j.rows().find((M)=>M.fingerprint===I6(G)||M.id===Y&&M.credential),O=l(j.state.accounts)?j.state.accounts:{},P=Object.entries(O).find(([,M])=>{if(!l(M))return!1;if(G.type==="oauth")return M.refresh===G.refresh;return typeof M.apiKey==="string"&&M.apiKey.trim()===G.apiKey.trim()})?.[0],F=_?.id??P??Y;if(_||P!==void 0||R8(j.state,Y))throw p("add",F,"credential-exists",`row ${F} already holds this secret or id`)}if(q==="stage-duplicate"&&(j.rosterRow(Y)||R8(j.state,Y)))throw p("add",Y,"id-exists",`row ${Y} already exists`);let U=lN($,j,Z,H),D=j.rows(),A=I6(G),I=q==="rotate"&&!U&&D.find((_)=>_.invalid===void 0&&_.fingerprint===A);if(I){if(j.assertNotStaged(I.id),E$("add",I),z!==void 0&&I.identity!==void 0&&z!==I.identity)throw a4("add",I.id);let _=q4($,j,I.id,G,{...H!==void 0?{providerState:t5(X.providerState,"add",I.id,I.providerState,H)}:{}});await j.completeTorn(),j.assertNotStaged(I.id);let O=await j4(j,I.id,_);return{id:I.id,outcome:"rotated",credential:O,credentialEpoch:I.credentialEpoch??1}}let L=D.find((_)=>_.id===Y);if(L){if(L.invalid)throw p("add",Y,"invalid-row",`row ${Y} is invalid`);if(L.credential)throw p("add",Y,"id-exists",`row ${Y} already holds a credential`);if(E$("add",L),L.type!==G.type)throw p("add",Y,"type-mismatch",`row ${Y} is a ${L.type} row`);if(z!==void 0&&L.identity!==void 0&&z!==L.identity)throw a4("add",Y);if(!L.hasEntry)j.setEntry(Y,{credentialEpoch:1,needsFirstReading:G.type==="oauth"});let _=q4($,j,Y,G,{clearErrors:!0,...H!==void 0?{providerState:{kind:"set",value:H}}:{}});await j.completeTorn();let O=await j4(j,Y,_);if(!L.hasEntry)await j.commitConfig();return{id:Y,outcome:"completed",credential:O,credentialEpoch:L.credentialEpoch??1}}let w=l5(j.config,Y);if(!X$(w))throw p("add",Y,"id-removed",`id ${Y} has held every credential epoch and is not reused; add the credential under another id`);let S=U?.identity??z;j.roster().push(c9({id:Y,credential:G,...S!==void 0?{identity:S}:{},...Q!==void 0?{label:Q}:{},addedAt:X.now()})),j.setEntry(Y,{credentialEpoch:w,needsFirstReading:G.type==="oauth",...Z.stage?{staged:{reservation:Z.stage.reservation}}:{}});let f="added";if(Z.disabled)b8(j,Y,Z.disabled.reason),f="added-disabled";if(!Z.disabled&&S!==void 0&&G.type==="oauth"){if(D.find((O)=>O.invalid===void 0&&O.type==="oauth"&&O.enabled&&O.identity===S))b8(j,Y,az),f="added-disabled"}if(U?.credential)return await j.commitConfig(),{id:Y,outcome:f,credential:U.credential,credentialEpoch:U.credentialEpoch??w};j.dropStateAccount(Y);let d=q4($,j,Y,G,{...Z.stage&&Z.disabled?{staged:{reservation:Z.stage.reservation,disabledReason:Z.disabled.reason,...Q!==void 0?{label:Q}:{},...H!==void 0?{providerState:p9(H)}:{}}}:{},...H!==void 0?{providerState:{kind:"set",value:H}}:{}});if(q==="rotate")await j.completeTorn();let s=await j4(j,Y,d);return await j.commitConfig(),{id:Y,outcome:f,credential:s,credentialEpoch:w}},{completeTorn:!1})});if(!K&&G.type==="oauth"&&(W.outcome==="added"||W.outcome==="completed"))$.firePull(W.id,"add");return W}async function sN($,Z,J,X={},Y={}){M$("replace");let{ctx:G}=$,z=await I$(G,"replace",Z,Y.onFailure,async(Q,K)=>{o5("replace",Z,J),K1("replace",Z,Y.attribution);let W=X.providerState===void 0?void 0:G8(G.providerState,"replace",Z,X.providerState),{row:V}=await i8($,"replace",Z);if(await Q.acquire(r$($,V)),J.type==="oauth")await Q.acquire(Y.providerLock??$.providerLock);for(let B of Y.extraLocks??[])await Q.acquire(B);return Y$(G,Q,K,{operation:"replace",rowId:Z},async(B)=>{if(Y.attribution!==void 0)CZ("replace",Z,B.row(Z),Y.attribution),await B.completeTorn();let q=FZ("replace",Z,B.row(Z),J);if(F6(q)!==F6(V))throw W1("replace",Z);let H=B.entry(Z)?.credentialEpoch,j=(typeof H==="number"?H:1)+1;if(!X$(j))throw p("replace",Z,"invalid-row",`row ${Z}'s credential epoch cannot advance past ${Number.MAX_SAFE_INTEGER}; remove the row and add the new credential as a new row`);let x=bN(G.providerState,q,j,X.identity,W),N={...X.identity!==void 0?{identity:X.identity}:{},...J.type==="api"?{baseURL:J.baseURL.trim(),authHeader:J.authHeader??"authorization-bearer"}:{}};if(WQ(B,Z,j,N),X.identity!==void 0)PZ(B,X.identity);let U=await n5($,B,Z,J,{clearErrors:!0,binding:N,providerState:x});return await B.commitConfig(),{id:Z,credential:U,credentialEpoch:j}},{completeTorn:Y.attribution===void 0})});if(J.type==="oauth")$.firePull(Z,"replace");return z}async function tN($,Z,J,X={},Y={}){M$("rotate");let{ctx:G}=$;return I$(G,"rotate",Z,Y.onFailure,async(z,Q)=>{o5("rotate",Z,J),K1("rotate",Z,Y.attribution);let K=X.providerState===void 0?void 0:G8(G.providerState,"rotate",Z,X.providerState),{row:W}=await i8($,"rotate",Z);if(await z.acquire(r$($,W)),X.identity!==void 0&&J.type==="oauth")await z.acquire(Y.providerLock??$.providerLock);for(let V of Y.extraLocks??[])await z.acquire(V);return Y$(G,z,Q,{operation:"rotate",rowId:Z},async(V)=>{if(Y.attribution!==void 0)CZ("rotate",Z,V.row(Z),Y.attribution),await V.completeTorn();let B=FZ("rotate",Z,V.row(Z),J);if(F6(B)!==F6(W))throw W1("rotate",Z);if(E$("rotate",B),X.identity!==void 0&&B.identity!==void 0&&X.identity!==B.identity)throw a4("rotate",Z);let q=X.identity!==void 0&&B.identity===void 0?X.identity:void 0,H=await n5($,V,Z,J,{identity:q,...K!==void 0?{providerState:t5(G.providerState,"rotate",Z,B.providerState,K)}:{}}),j=!1;if(!B.hasEntry)V.setEntry(Z,{credentialEpoch:1,needsFirstReading:B.type==="oauth"}),j=!0;if(X.identity!==void 0&&B.identity!==X.identity)AZ(V,Z,X.identity),j=!0;if(j)await V.commitConfig();return{id:Z,credential:H}},{completeTorn:Y.attribution===void 0})})}async function NQ($,Z,J,X,Y){M$(Z);let{ctx:G}=$,z=G.providerState,Q=Y.attribution,K=Y.providerState;return I$(G,Z,J,Y.onFailure,async(W,V)=>{if(K1(Z,J,Q),K!==void 0){if(typeof K!=="function")throw p(Z,J,"invalid-input","the provider-state mutator must be a function");if(Q===void 0)throw p(Z,J,"invalid-input","a provider-state change needs the attribution of the credential it is for");if(!z)throw p(Z,J,"invalid-input","the store was opened without a provider-state codec")}let{row:B}=await i8($,Z,J);await W.acquire(r$($,B));for(let q of Y.extraLocks??[])await W.acquire(q);return Y$(G,W,V,{operation:Z,rowId:J},async(q)=>{await a5(q,J,Y.protect),q.assertNotStaged(J);let H=q.row(J),j=X.enabled?FZ("enable",J,H):H;if(!j||!q.rosterRow(J))throw P0(Z,J);if(F6(j)!==F6(B))throw W1(Z,J);if(Q!==void 0)CZ(Z,J,j,Q);if(X.enabled&&j.disabledReason?.startsWith(_Z))throw p("enable",J,"identity-contradicted",`row ${J} needs an identity-validated credential replacement before it can be enabled`);let x=!X.enabled||!j.enabled||j.disabledReason!==void 0;if(X.enabled&&x&&j.type==="oauth"){let I=j.identity===void 0?void 0:q.rows().find((L)=>L.id!==J&&L.invalid===void 0&&L.type==="oauth"&&L.enabled&&L.identity===j.identity);if(I)throw p("enable",J,"duplicate-identity",`row ${I.id} is enabled with the same identity as row ${J}`)}if(K===void 0||z===void 0){if(await q.completeTorn(),!x)return{id:J};if(X.enabled)UJ(q,J);else b8(q,J,X.reason);return await q.commitConfig(),{id:J}}if(!j.credential)throw p(Z,J,"no-credential",`row ${J} holds no credential`);E$(Z,j);let N=await HQ(q,z,Z,j,K,!0);if(N.kind==="declined")return{id:J,declined:!0};await q.completeTorn();let U={id:J,providerStateOutcome:N.kind==="unchanged"?"unchanged":N.value===void 0?"cleared":"updated",...N.value!==void 0?{providerState:N.value}:{}};if(N.kind==="unchanged"){if(x){if(X.enabled)UJ(q,J);else b8(q,J,X.reason);await q.commitConfig()}return U}if(!x)return q.setStateAccount(J,N.account),await q.commitState(),U;let D=X.enabled?{mark:CY(),enabled:!0}:{mark:CY(),enabled:!1,reason:X.reason},A=N.account[B6];return q.setStateAccount(J,{...N.account,[B6]:{...A,[i5]:D}}),await q.commitState(),s5(q,J,D),await q.commitConfig(),U},{completeTorn:!1})})}function aN($,Z,J,X={}){return NQ($,"disable",Z,{enabled:!1,reason:J},X)}function nN($,Z,J={}){return NQ($,"enable",Z,{enabled:!0},J)}async function oN($,Z,J={}){M$("remove");let{ctx:X}=$;return I$(X,"remove",Z,J.onFailure,async(Y,G)=>{if(typeof Z!=="string"||Z.length===0)throw p("remove",Z,"invalid-input","id must be non-empty");let z=J.attribution;if(K1("remove",Z,z),J.staged!==void 0&&(!l(J.staged)||typeof J.staged.reservation!=="string"||!J.staged.reservation))throw p("remove",Z,"invalid-input","a staged removal needs a reservation");let Q=await f$(X);if(Q.status!=="ready")throw Y8(Q,"remove",Z);let K=Q.rows.find((V)=>V.id===Z);if(!K&&!R8(Q.state,Z))throw P0("remove",Z);let W=F6(K??{id:Z});await Y.acquire(r$($,K??{id:Z}));for(let V of J.extraLocks??[])await Y.acquire(V);return Y$(X,Y,G,{operation:"remove",rowId:Z},async(V)=>{let B=V.reservation(Z);if(B!==void 0){if(!l(B)||!J.staged||B.reservation!==J.staged.reservation)throw p("remove",Z,"row-staged",`row ${Z} is reserved for roster publication`)}else if(J.staged)throw p("remove",Z,"attribution",`row ${Z} is no longer reserved`);let q=V.row(Z),H=R8(V.state,Z);if(!q&&!H)throw P0("remove",Z);if(F6(q??{id:Z})!==W)throw W1("remove",Z);if(z!==void 0)if(q)DJ(Z,q,z);else rN($,V,Z,z);let j=J.protect;if(j){let x={row:q,config:V.snapshot.config,state:V.snapshot.state},N=await l8("remove",()=>j(Z,x));if(N!==void 0)throw p("remove",Z,"row-protected",N)}if(q){if(z===void 0)await V.completeTorn();V.dropRosterRows(Z),await V.commitConfig()}if(H)V.dropStateAccount(Z),await V.commitState();return{id:Z,outcome:q?"removed":"completed"}},{completeTorn:!1})})}function DJ($,Z,J,X="remove"){if(CZ(X,$,Z,J),Z.torn)throw p(X,$,"attribution",`row ${$} is between the writes of another operation; retry once it completes`,!0);if(Z.stamp!=="bound")throw p(X,$,"unbound-credential",`row ${$}'s credential is not bound to its stamp, so the removal cannot be attributed to it`)}function rN($,Z,J,X){let Y=()=>p("remove",J,"unbound-credential",`orphan ${J} has no credential stamp this store can bind, so the removal cannot be attributed to it`),G=Z.stateAccount(J),z=v$(G?.[B6]);if(!G||!z?.binding||z.dispatch===void 0||z.replace)throw Y();let Q;if(typeof G.apiKey==="string"){if(z.binding.baseURL===void 0||z.binding.authHeader===void 0)throw Y();Q={type:"api",apiKey:G.apiKey,baseURL:z.binding.baseURL,authHeader:z.binding.authHeader}}else if(typeof G.refresh==="string")Q={type:"oauth",refresh:G.refresh};else throw Y();let[K]=d8({accounts:[c9({id:J,credential:Q,identity:z.binding.identity,addedAt:0})],[L6]:{rows:{[J]:{credentialEpoch:z.credentialEpoch}}}},Z.state,$.ctx.codec,$.ctx.providerState);if(!K?.credential||K.invalid||K.stamp!=="bound")throw Y();if(z.credentialEpoch!==X.credentialEpoch||z.binding.identity!==X.identity)throw p("remove",J,"attribution",`orphan ${J} was written for a credential or account other than the one this removal was decided for`,!0)}function R8($,Z){let J=$.accounts;return l(J)&&Object.hasOwn(J,Z)}function OJ($){return l($)&&typeof $.id==="string"?$.id:void 0}function eN($,Z){if(!Array.isArray(Z))return"ids must be an array of roster ids";let J=new Set;for(let G of $){let z=OJ(G);if(z!==void 0)J.add(z)}let X=new Set;for(let G of Z){if(typeof G!=="string")return"ids must be an array of roster ids";if(X.has(G))return`id ${G} appears more than once`;if(!J.has(G))return`id ${G} is not in the roster`;X.add(G)}let Y=[...J].filter((G)=>!X.has(G));if(Y.length>0)return`the order leaves out roster id(s) ${Y.join(", ")}`;return}function $U($,Z){let J=new Map;for(let G of $){let z=OJ(G);if(z===void 0)continue;let Q=J.get(z);if(Q)Q.push(G);else J.set(z,[G])}let X=Z.flatMap((G)=>J.get(G)??[]),Y=0;return $.map((G)=>OJ(G)===void 0?G:X[Y++])}async function ZU($,Z,J={}){M$("reorder");let{ctx:X}=$,Y=J.onFailure;return I$(X,"reorder",void 0,Y&&((G,z)=>Y(z)),async(G,z)=>{for(let Q of J.extraLocks??[])await G.acquire(Q);return Y$(X,G,z,{operation:"reorder",rowId:void 0},async(Q)=>{let K=Q.roster(),W=eN(K,Z);if(W)throw new G6({operation:"reorder",phase:"before-first-write",retryable:!1,kind:"invalid-order",message:W});let V=[...Z],B=$U(K,V);if(B.every((q,H)=>q===K[H]))return{ids:V,outcome:"unchanged"};return Q.config.accounts=B,await Q.commitConfig(),{ids:V,outcome:"reordered"}},{completeTorn:!1})})}async function JU($,Z,J,X,Y={}){return M$("recordIdentity"),I$($.ctx,"recordIdentity",Z,Y.onFailure,async(G,z)=>{if(typeof J!=="string"||J.length===0)throw p("recordIdentity",Z,"invalid-input","identity must be non-empty");let Q=l(X)?X.credentialEpoch:void 0;if(!X$(Q))throw p("recordIdentity",Z,"invalid-input","the credential epoch the identity lookup was issued for is required");let{row:K}=await i8($,"recordIdentity",Z);await G.acquire(r$($,K)),await G.acquire(Y.providerLock??$.providerLock);for(let W of Y.extraLocks??[])await G.acquire(W);return Y$($.ctx,G,z,{operation:"recordIdentity",rowId:Z},async(W)=>{let V=FZ("recordIdentity",Z,W.row(Z));if(F6(V)!==F6(K))throw W1("recordIdentity",Z);if(E$("recordIdentity",V),(V.credentialEpoch??1)!==Q)throw p("recordIdentity",Z,"attribution",`the identity for ${Z} was looked up for a credential the row no longer holds`,!0);if(V.identity!==void 0&&V.identity!==J)throw a4("recordIdentity",Z);if(V.identity===void 0)await cN(W,V,J);let B=AZ(W,Z,J);return await W.commitConfig(),{id:Z,disabled:B}})})}function UQ($){let Z=$[L6];return l(Z)&&l(Z.publications)?Z.publications:{}}function xQ($,Z){let J=UQ($);if(!Object.hasOwn(J,Z))return;let X=J[Z];if(!l(X)||X.operationId!==Z||typeof X.planDigest!=="string"||!/^[a-f0-9]{64}$/.test(X.planDigest)||!["committed","cleaned"].includes(String(X.phase))||!Array.isArray(X.removed)||!Array.isArray(X.finalized)||X.removed.some((Y)=>!l(Y)||typeof Y.id!=="string"||!X$(Y.credentialEpoch))||X.finalized.some((Y)=>!l(Y)||typeof Y.id!=="string"||!X$(Y.credentialEpoch)||typeof Y.reservation!=="string"||!Y.reservation||typeof Y.enabled!=="boolean"))throw p("publishRoster",Z,"invalid-input","the stored publication receipt is malformed");return structuredClone(X)}async function XU($,Z){let J=await f$($.ctx);if(J.status!=="ready")throw Y8(J,"publishRoster",Z);return xQ(J.config,Z)}function YU($,Z){let J=()=>{throw p("publishRoster",Z?.operationId??"","invalid-input","the publication plan is invalid")};if(!l(Z)||typeof Z.operationId!=="string"||!Z.operationId||!Array.isArray(Z.remove)||!Array.isArray(Z.finalize)||!Array.isArray(Z.order))J();let X=new Set;for(let Y of[...Z.remove,...Z.finalize]){if(!l(Y)||typeof Y.id!=="string"||t4(Y.id)||X.has(Y.id)||!Y.attribution)J();if(X.add(Y.id),K1("publishRoster",Y.id,Y.attribution),Y.attribution.identity!==void 0&&(typeof Y.attribution.identity!=="string"||!Y.attribution.identity))J()}for(let Y of Z.remove)if($.ctx.requireRemovedFingerprint&&!Y.fingerprint||Y.fingerprint!==void 0&&typeof Y.fingerprint!=="string")J();for(let Y of Z.finalize)if(typeof Y.reservation!=="string"||!Y.reservation||typeof Y.enabled!=="boolean"||(Y.enabled?Y.disabledReason!==void 0:typeof Y.disabledReason!=="string"))J();if(Z.order.some((Y)=>typeof Y!=="string"||t4(Y))||new Set(Z.order).size!==Z.order.length)J()}function DQ($,Z){$.entries();let J=$.config[L6],X={...UQ($.config)};Object.defineProperty(X,Z.operationId,{value:Z,enumerable:!0,writable:!0,configurable:!0}),J.publications=X,delete J.publicationOrder}function GU($,Z,J){let X=new Set;for(let z of RZ($.config)){if(!l(z)||typeof z.id!=="string")continue;if(X.has(z.id))throw p("publishRoster",Z.operationId,"invalid-input","publication needs a roster of unique named rows");X.add(z.id)}let Y=new Set(Z.remove.map((z)=>z.id)),G=J.filter((z)=>z.invalid!=="roster"&&!Y.has(z.id));if(G.length!==Z.order.length||Z.order.some((z)=>!G.some((Q)=>Q.id===z))||G.some((z)=>!Z.order.includes(z.id)))throw p("publishRoster",Z.operationId,"invalid-input","order must name exactly the surviving roster");return G}async function SY($,Z){await $.assertAll();for(let X of Z.removed)if(v$($.stateAccount(X.id)?.[B6])?.credentialEpoch===X.credentialEpoch&&!$.rosterRow(X.id))$.dropStateAccount(X.id);for(let X of Z.finalized){let Y=$.stateAccount(X.id),G=v$(Y?.[B6]);if(Y&&G?.credentialEpoch===X.credentialEpoch&&G.staged?.reservation===X.reservation){let z={...Y[B6]};delete z.staged,$.setStateAccount(X.id,{...Y,[B6]:z})}}await $.commitState(void 0,{durable:!0});let J={...Z,phase:"cleaned"};return DQ($,J),await $.commitConfig({durable:!0}),J}async function zU($,Z,J={}){return M$("publishRoster"),I$($.ctx,"publishRoster",Z?.operationId??"",J.onFailure,async(X,Y)=>{if(!l(Z)||typeof Z.operationId!=="string"||!Z.operationId)throw p("publishRoster",Z?.operationId??"","invalid-input","the publication needs an operation id");Z=structuredClone(Z);let G=p9(Z),z=[...Array.isArray(Z.remove)?Z.remove:[],...Array.isArray(Z.finalize)?Z.finalize:[]].filter((Q)=>l(Q)&&typeof Q.id==="string");for(let Q=0;;Q++){let K=await f$($.ctx);if(K.status!=="ready")throw Y8(K,"publishRoster",Z.operationId);let W=new Map(z.map(({id:B})=>[B,F6(K.rows.find((q)=>q.id===B)??{id:B})]));for(let B of[...new Set(W.values())].sort())await X.acquire(r$($,{id:B}));await X.acquire(J.providerLock??$.providerLock);for(let B of J.extraLocks??[])await X.acquire(B);let V=await Y$($.ctx,X,Y,{operation:"publishRoster",rowId:Z.operationId},async(B)=>{let q=B.rows();if(z.some(({id:L})=>F6(q.find((w)=>w.id===L)??{id:L})!==W.get(L)))return;let H=xQ(B.config,Z.operationId);if(H){if(H.planDigest!==G)throw p("publishRoster",Z.operationId,"publication-mismatch","the operation id belongs to a different publication plan");if(H.phase==="cleaned")return{outcome:"already-cleaned",receipt:H};return B.markPublicationDecision(),await B.syncConfig(),{outcome:"cleaned",receipt:await SY(B,H)}}YU($,Z);let j=GU(B,Z,q),x=[];for(let L of Z.remove){B.assertNotStaged(L.id);let w=q.find((S)=>S.id===L.id);if(!w)throw p("publishRoster",L.id,"attribution","the removed row no longer exists");if(DJ(L.id,w,L.attribution,"publishRoster"),!w.credential||L.fingerprint!==void 0&&I6(w.credential)!==L.fingerprint)throw p("publishRoster",L.id,"attribution","the removed secret no longer matches");x.push(w)}let N=[];for(let L of Z.finalize){let w=q.find((O)=>O.id===L.id),S=v$(B.stateAccount(L.id)?.[B6]);if(!w||w.staged?.reservation!==L.reservation||S?.staged?.reservation!==L.reservation||w.enabled)throw p("publishRoster",L.id,"row-staged","the finalized row is not disabled under this reservation");let f=B.stateAccount(L.id),d=B.rosterRow(L.id),s=f?.[x$],_=s===void 0?void 0:p9(s);if(!S?.staged||S.staged.label!==d?.label||S.staged.disabledReason!==w.disabledReason||S.staged.providerState!==_)throw p("publishRoster",L.id,"row-staged","the staged label, disabled reason or full provider state no longer matches its stamp");DJ(L.id,w,L.attribution,"publishRoster"),N.push(w)}let U=j.find((L)=>L.torn);if(U)throw p("publishRoster",Z.operationId,"attribution",`Row ${U.id} has an interrupted write; complete it with a normal store operation before publishing.`,!1);let D=new Set;for(let L of j){if(!(Z.finalize.find((S)=>S.id===L.id)?.enabled??L.enabled)||L.type!=="oauth"||L.identity===void 0)continue;if(D.has(L.identity))throw p("publishRoster",L.id,"invalid-input","the final enabled roster repeats a known identity");D.add(L.identity)}for(let L of j)if(L.identity!==void 0&&L.fingerprint!==void 0&&j.some((w)=>w.id!==L.id&&w.identity!==void 0&&w.identity!==L.identity&&w.fingerprint===L.fingerprint))throw p("publishRoster",L.id,"attribution","the resulting pool gives the same secret different known identities");for(let L of N)if(L.identity!==void 0&&x.some((w)=>w.identity!==void 0&&w.identity!==L.identity&&w.fingerprint===L.fingerprint))throw p("publishRoster",L.id,"attribution","the staged secret belonged to a different known identity");await a5(B,Z.operationId,J.protect);let A={operationId:Z.operationId,planDigest:G,phase:"committed",removed:x.map((L)=>({id:L.id,credentialEpoch:L.credentialEpoch??1})),finalized:Z.finalize.map((L,w)=>({id:L.id,credentialEpoch:N[w]?.credentialEpoch??1,reservation:L.reservation,enabled:L.enabled}))};for(let L of Z.remove)B.dropRosterRows(L.id);for(let L of Z.finalize){let w=B.rosterRow(L.id);w.enabled=L.enabled;let S={...B.entry(L.id)};if(delete S.staged,L.enabled)delete S.disabledReason;else S.disabledReason=L.disabledReason;B.setEntry(L.id,S)}let I=B.roster().filter((L)=>!l(L)||typeof L.id!=="string"||q.find((w)=>w.id===L.id)?.invalid==="roster");return B.config.accounts=[...Z.order.map((L)=>B.rosterRow(L)),...I],DQ(B,A),await B.syncState(),await B.commitConfig({durable:!0,publicationDecision:!0}),{outcome:"published",receipt:await SY(B,A)}},{completeTorn:!1});if(V)return V;if(await X.releaseAll(),Q>=1)throw p("publishRoster",Z.operationId,"row-key-changed","a named row changed lock key twice during publication",!0)}})}class OQ{rt;hook;onFailure;firedAtLoad;logger;inflight=new Set;constructor($,Z,J,X,Y){this.rt=$,this.hook=Z,this.onFailure=J,this.firedAtLoad=X,this.logger=Y}fire($,Z){if(!this.hook)return;if(Z==="load"){if(this.firedAtLoad.has($))return;this.firedAtLoad.add($)}let J=this.run($,Z);this.inflight.add(J),J.finally(()=>this.inflight.delete(J))}async settled(){while(this.inflight.size>0)await Promise.allSettled([...this.inflight])}async run($,Z){let J=this.rt(),{ctx:X}=J,Y=new G1(X.lockDefaults,X.lockEnv),G={writes:0};try{let z=await Y$(X,Y,G,{operation:"pull",rowId:$},async(K)=>{if(K.reservation($)!==void 0)return;await K.completeTorn();let W=K.row($);if(W?.unbound&&W.enabled&&W.type==="oauth"&&W.credential&&!W.invalid)E$("pull",W);if(!W?.candidate||W.type!=="oauth")return;if(!W.hasEntry)K.setEntry($,{credentialEpoch:1,needsFirstReading:!0}),await K.commitConfig();let V=K.row($);if(!V?.credential||V.credentialEpoch===void 0)return;return{id:$,credential:V.credential,credentialEpoch:V.credentialEpoch,...V.identity!==void 0?{identity:V.identity}:{},reason:Z}},{completeTorn:!1});if(await Y.releaseAll(),!z){this.firedAtLoad.delete($);return}await X.hold?.("pull-before-request",$);let Q;try{Q=await this.hook?.(z)}catch(K){throw new G6({operation:"pull",rowId:$,phase:"pull",retryable:!0,kind:"pull",message:"the quota pull rejected",cause:K})}await jQ(J,$,{credentialEpoch:z.credentialEpoch,...z.identity!==void 0?{identity:z.identity}:{}},Q)}catch(z){this.firedAtLoad.delete($);let Q=TZ(z,"pull",$,G);if(this.onFailure)try{await this.onFailure($,Q)}catch(K){this.logger?.warn("pull failure hook threw",{rowId:$,error:K instanceof Error?K.message:String(K)})}else this.logger?.warn("quota pull failed",{rowId:$,kind:Q.kind})}finally{await Y.releaseAll()}}}function P7($,Z){if(s4("refresh",$,Z?.staged),!Z)throw p("refresh",$,"unknown-row",`no row ${$} in the pool`);if(Z.invalid)throw p("refresh",$,"invalid-row",`row ${$} is invalid`);if(Z.type!=="oauth"||Z.credential?.type!=="oauth")throw p("refresh",$,"no-credential",`row ${$} holds no OAuth credential`);if(!Z.enabled)throw p("refresh",$,"row-disabled",`row ${$} is disabled`);return Z}function kY($){return p("refresh",$,"refresh-stamp-ahead",`row ${$}'s stored refresh stamp is ahead of the clock; a rotation now could not be stamped newer within the trust bound`,!0)}async function KU($,Z,J,X={}){M$("refresh");let{ctx:Y}=$;return I$(Y,"refresh",Z,X.onFailure,async(G,z)=>{let{row:Q}=await i8($,"refresh",Z);P7(Z,Q);let K=await X.refuse?.(Q);if(K!==void 0)return{status:"refused",rowId:Z,reason:K};let W=F6(Q),V;for(let j=0;;j++){await G.acquire(r$($,{id:Z,identity:W===Z?void 0:W})),await G.acquire(X.providerLock??$.providerLock);for(let U of X.extraLocks??[])await G.acquire(U);let N=await Y$(Y,G,{writes:0},{operation:"refresh",rowId:Z},async(U)=>{let D=P7(Z,U.row(Z));if(E$("refresh",D),!D.hasEntry)U.setEntry(Z,{credentialEpoch:1,needsFirstReading:!0}),await U.commitConfig(),D=P7(Z,U.row(Z));if(F6(D)!==W)return{keyNow:F6(D)};let A=await X.refuse?.(D);if(A!==void 0)return{refused:A};return{row:D,credential:D.credential,credentialEpoch:D.credentialEpoch,identity:D.identity}});if("refused"in N)return{status:"refused",rowId:Z,reason:N.refused};if("keyNow"in N){if(await G.releaseAll(),j>=1)throw p("refresh",Z,"row-key-changed",`row ${Z}'s wire identity changed twice while its lock was held`,!0);W=N.keyNow;continue}V=N;break}if(TY(V.credential.lastRefreshedAt,Y.now()))throw kY(Z);await Y.hold?.("refresh-before-provider",Z),await G.assertAll();let B;try{B=await J(V.credential,V.row)}catch(j){throw new G6({operation:"refresh",rowId:Z,phase:"before-first-write",retryable:!0,kind:"provider",message:"the provider refresh failed",cause:j})}if(typeof B?.refresh!=="string"||!B.refresh.trim())throw p("refresh",Z,"provider","the provider returned no refresh token",!0);let q=B.providerState===void 0?void 0:G8(Y.providerState,"refresh",Z,B.providerState,"the provider state the provider returned"),H=await Y$(Y,G,z,{operation:"refresh",rowId:Z},async(j)=>{let x=j.row(Z),N=j.entry(Z);if(!x||x.invalid||!N||N.credentialEpoch!==V.credentialEpoch||x.identity!==V.identity)throw new G6({operation:"refresh",rowId:Z,phase:"before-first-write",retryable:!0,kind:"attribution",message:`row ${Z} changed credential while its refresh was in flight; the rotation is discarded`});E$("refresh",x);let U=await X.refuse?.(x);if(U!==void 0)return{refused:U};let D=Y.now(),A=x.credential?.type==="oauth"?x.credential.lastRefreshedAt:void 0;if(TY(A,D))throw kY(Z);let I={type:"oauth",access:B.access,refresh:B.refresh,expires:B.expires},L=x.identity!==void 0&&B.identity!==void 0&&x.identity!==B.identity?{expectedIdentity:x.identity,returnedIdentity:B.identity}:void 0,w=L?{mark:QU(),enabled:!1,reason:`${_Z}${JSON.stringify(L)}`}:void 0,S=x.identity===void 0&&B.identity?B.identity:void 0,f=await n5($,j,Z,I,{stamp:d5(A,D),transition:w,identity:S,...q!==void 0?{providerState:t5(Y.providerState,"refresh",Z,x.providerState,q)}:{}});if(w!==void 0)s5(j,Z,w),await j.commitConfig();let d=x.identity;if(S!==void 0)AZ(j,Z,S),d=S,await j.commitConfig();return{stored:f,identity:d,contradiction:L,refused:void 0}});if(H.refused!==void 0)return{status:"refused",rowId:Z,reason:H.refused};if(H.contradiction!==void 0)return{status:"identity-contradicted",rowId:Z,...H.contradiction,credential:H.stored};if(X.onPersisted)try{let j=X.onPersisted;await l8("refresh",()=>j(Z,H.stored))}catch(j){throw new G6({operation:"refresh",rowId:Z,phase:"after-first-write",retryable:!1,kind:"after-persist-hook",committed:H.stored,message:"the after-persist hook threw; the rotation stays committed",cause:j})}return{status:"rotated",rowId:Z,credential:H.stored,...H.identity!==void 0?{identity:H.identity}:{}}})}var r5=Object.freeze(["version","accounts",L6]);function MJ($){let Z={};for(let[J,X]of Object.entries($))if(!r5.includes(J))H4(Z,J,X);return Z}function H4($,Z,J){Object.defineProperty($,Z,{value:J,enumerable:!0,writable:!0,configurable:!0})}function VU($,Z){let J={};for(let[X,Y]of Object.entries($))if(r5.includes(X))H4(J,X,Y);else if(Object.hasOwn(Z,X))H4(J,X,Z[X]);for(let[X,Y]of Object.entries(Z))if(!Object.hasOwn($,X))H4(J,X,Y);return J}function vY($){return new G6({operation:"updateSettings",phase:"before-first-write",retryable:!1,kind:"invalid-input",message:$})}async function BU($){let Z=await f$($.ctx);if(Z.status==="error")return Z;return{status:Z.status,settings:MJ(Z.config)}}async function qU($,Z,J={}){M$("updateSettings");let{ctx:X}=$,Y=J.onFailure;return I$(X,"updateSettings",void 0,Y&&((G,z)=>Y(z)),async(G,z)=>{for(let K of J.extraLocks??[])await G.acquire(K);let Q=G.held.length;try{for(let N of X.storeLocks)await G.acquire(N);let K=await f$(X);if(K.status!=="ready")throw Y8(K,"updateSettings",void 0);let W=MJ(K.config),V=structuredClone(W),B=await l8("updateSettings",()=>Z(V)),q=B===void 0?V:B;if(!l(q))throw vY("the settings mutator must produce an object");let H=r5.filter((N)=>Object.hasOwn(q,N));if(H.length>0)throw vY(`settings cannot set the pool-owned key(s) ${H.join(", ")}`);if(WU(q,W))return{settings:W,outcome:"unchanged"};let j=VU(K.config,q),x={operation:"updateSettings",rowId:void 0};return await c8(X.configPath,j,{beforeRename:async()=>{await X.onStep?.("before-config-write",x),await G.assertAll()}}),z.writes++,await X.onStep?.("after-config-write",x),{settings:MJ(j),outcome:"updated"}}finally{await G.releaseTo(Q)}})}var fY=new Map;function jU($){let Z=fY.get($);if(!Z)Z={removedIds:new Set,firedAtLoad:new Set},fY.set($,Z);return Z}function EY($){if($.status==="ready")return{status:"ready",schemaVersion:u9,rows:$.rows};if($.status==="pending-migration")return{status:"pending-migration",roster:Array.isArray($.config.accounts)?$.config.accounts:[]};return $}function HU($){let Z=jU($.configPath),J={...y6,...$.lockOptions},X={provider:$.provider,configPath:$.configPath,statePath:$.statePath,codec:$.quota,...$.providerState?{providerState:$.providerState}:{},now:$.now??Date.now,storeLocks:$.storeLocks??[{name:"save",path:$.configPath},{name:"save",path:$.statePath}],lockDefaults:J,lockEnv:{now:$.now??Date.now,...$.onLockEvent?{onLockEvent:$.onLockEvent}:{},...$.onLockStep?{onLockStep:$.onLockStep}:{},...$.onRenewalTimer?{onRenewalTimer:$.onRenewalTimer}:{}},removedIds:Z.removedIds,requireCredentialStamps:$.requireCredentialStamps===!0,requireRemovedFingerprint:$.requireRemovedFingerprint===!0,...$.logger?{logger:$.logger}:{},...$.onStep?{onStep:$.onStep}:{},...$.hold?{hold:$.hold}:{}},Y=new OQ(()=>G,$.pull,$.onPullFailure,Z.firedAtLoad,$.logger),G={ctx:X,providerLock:$.providerLock??{name:`provider-${encodeURIComponent($.provider)}`,path:$.statePath},rowLockOptions:$.rowLockOptions??{},firePull:(z,Q)=>Y.fire(z,Q)};return{async load(){let z=await f$(X);if(z.status==="ready"){for(let Q of z.rows)if((Q.candidate||Q.torn&&Q.enabled)&&Q.type==="oauth"&&Q.needsFirstReading)Y.fire(Q.id,"load")}return EY(z)},async read(){return EY(await f$(X))},async initialize(z={}){return{status:await EN(X,z.dropKeys??[])}},add:(z,Q)=>iN(G,z,Q),publishRoster:(z,Q)=>zU(G,z,Q),publication:(z)=>XU(G,z),replace:(z,Q,K,W)=>sN(G,z,Q,K,W),rotate:(z,Q,K,W)=>tN(G,z,Q,K,W),updateProviderState:(z,Q,K,W)=>yN(G,z,Q,K,W),disable:(z,Q,K)=>aN(G,z,Q,K),enable:(z,Q)=>nN(G,z,Q),remove:(z,Q)=>oN(G,z,Q),reorder:(z,Q)=>ZU(G,z,Q),readSettings:()=>BU(G),updateSettings:(z,Q)=>qU(G,z,Q),recordIdentity:(z,Q,K,W)=>JU(G,z,Q,K,W),refresh:(z,Q,K)=>KU(G,z,Q,K),recordQuota:(z,Q,K)=>jQ(G,z,Q,K),requestReading:(z)=>Y.fire(z,"admission"),pullsSettled:()=>Y.settled()}}var IJ="all",ET=Object.freeze(["primary"]);function LU($){return $.kind==="retired"?$.retiredAt:$.checkedAt}function T9($,Z){return JSON.stringify([$,Z])}function $2($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function N$($){return typeof $==="number"&&Number.isFinite($)}function bY($){return typeof $==="string"&&$.length>0}function C$($,Z,J){return $[Z]===void 0||J($[Z])}function NU($){return N$($)&&$>0}function _J($){return typeof $==="string"}function UU($){if(!$2($)||!bY($.scope)||!bY($.label))return!1;switch($.kind){case"reading":return N$($.checkedAt)&&N$($.usedPercent)&&C$($,"resetsAt",_J)&&C$($,"windowMinutes",NU);case"retired":return N$($.retiredAt);case"absent":return N$($.checkedAt);default:return!1}}function xU($){if(!$2($)||!N$($.checkedAt))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&C$($,"remainingPercent",N$)&&C$($,"usedPercent",N$)&&C$($,"resetsAt",_J)&&C$($,"limit",N$)&&C$($,"used",N$)&&C$($,"remaining",N$)&&C$($,"unit",_J)}function V1($){if(!$2($)||!Array.isArray($.limits))return!1;let Z=new Set;for(let J of $.limits){if(!UU(J))return!1;let X=T9(J.scope,J.label);if(Z.has(X))return!1;Z.add(X)}return C$($,"budget",xU)}class PJ extends TypeError{constructor($){super($);this.name="QuotaCodecError"}}function SZ($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function n4($){return typeof $==="number"&&Number.isFinite($)}function MQ($){return $===void 0||typeof $==="string"&&$!==""}function IQ($){return typeof $==="string"&&$!==""}function Y9($,Z){return $[Z]===void 0||n4($[Z])}function AJ($,Z){return $[Z]===void 0||typeof $[Z]==="string"}function DU($){return SZ($)&&MQ($.scope)&&IQ($.label)&&n4($.usedPercent)&&AJ($,"resetsAt")&&($.windowMinutes===void 0||n4($.windowMinutes)&&$.windowMinutes>0)}function OU($){return SZ($)&&MQ($.scope)&&IQ($.label)}function MU($){if(!SZ($))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&Y9($,"remainingPercent")&&Y9($,"usedPercent")&&AJ($,"resetsAt")&&Y9($,"limit")&&Y9($,"used")&&Y9($,"remaining")&&AJ($,"unit")}function IU($){if(!SZ($)||!n4($.checkedAt))return!1;let Z=$.readings??[],J=$.coverage??[];if(!Array.isArray(Z)||!Array.isArray(J))return!1;let X=new Set;for(let Y of Z){if(!DU(Y))return!1;let G=T9(Y.scope??IJ,Y.label);if(X.has(G))return!1;X.add(G)}if(!J.every(OU))return!1;return $.budget===void 0||MU($.budget)}function _U($,Z){if($.scope!==Z.scope)return $.scope<Z.scope?-1:1;if($.label!==Z.label)return $.label<Z.label?-1:1;return 0}function PU($,Z,J){if(Z===void 0)return $;if($!==void 0&&J<$.checkedAt)return $;return{...Z,checkedAt:J}}function _Q($,Z){if($!==void 0&&!V1($))throw new PJ("stored quota map is malformed");if(!IU(Z))throw new PJ("quota observation is malformed");let J=$??{limits:[]},X=Z.checkedAt,Y=new Map;for(let B of J.limits)Y.set(T9(B.scope,B.label),B);let G=(B)=>{let q=Y.get(B);return q===void 0||X>=LU(q)},z=new Set;for(let B of Z.readings??[]){let q=B.scope??IJ,H=T9(q,B.label);if(z.add(H),!G(H))continue;Y.set(H,{scope:q,label:B.label,kind:"reading",checkedAt:X,usedPercent:B.usedPercent,...B.resetsAt===void 0?{}:{resetsAt:B.resetsAt},...B.windowMinutes===void 0?{}:{windowMinutes:B.windowMinutes}})}for(let B of Z.coverage??[]){let q=B.scope??IJ,H=T9(q,B.label);if(z.has(H)||!G(H))continue;let j=Y.get(H);Y.set(H,j===void 0||j.kind==="absent"?{scope:q,label:B.label,kind:"absent",checkedAt:X}:{scope:q,label:B.label,kind:"retired",retiredAt:X})}let{limits:Q,budget:K,...W}=J,V=PU(J.budget,Z.budget,X);return{...W,limits:[...Y.values()].sort(_U),...V===void 0?{}:{budget:V}}}var bT=Object.freeze({validate:V1,merge:_Q});class L0 extends Error{constructor(){super("Anthropic quota observation is invalid");this.name="NativeQuotaCodecError"}}function W$($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function b$($,Z,J=[]){return Z.every((X)=>Object.hasOwn($,X))&&Object.keys($).every((X)=>Z.includes(X)||J.includes(X))}function s$($){return typeof $==="number"&&Number.isFinite($)}function Z2($){return s$($)&&$>=0}function Z$($){return typeof $==="string"&&$.length>0&&$.trim()===$}function R6($,Z,J){return $[Z]===void 0||J($[Z])}function wJ($){return $==="poll"||$==="headers"}function gY($){return W$($)&&b$($,["amountMinor","currency","exponent"])&&s$($.amountMinor)&&Z$($.currency)&&/^[A-Za-z]{3}$/.test($.currency)&&s$($.exponent)&&Number.isInteger($.exponent)&&$.exponent>=0&&$.exponent<=20}function AU($){return W$($)&&b$($,["used","limit","exhausted"],["utilizationPercent","severity"])&&gY($.used)&&gY($.limit)&&typeof $.exhausted==="boolean"&&R6($,"utilizationPercent",s$)&&R6($,"severity",(Z)=>typeof Z==="string")}function wU($){return W$($)&&b$($,[],jZ)&&Object.values($).every(wJ)}var PQ=["checkedAt","accountIdentity","extraUsage","bindingWindow","bindingWindowSource","fieldSources","fallbackAdvised","source"];function AQ($){return R6($,"checkedAt",Z2)&&R6($,"accountIdentity",Z$)&&R6($,"extraUsage",AU)&&R6($,"bindingWindow",Z$)&&R6($,"bindingWindowSource",wJ)&&R6($,"fieldSources",wU)&&R6($,"fallbackAdvised",(Z)=>typeof Z==="boolean")&&R6($,"source",wJ)}function A7($,Z){if(!W$($)||!b$($,Z?["usedPercent","remainingPercent","checkedAt","id","title","modelName"]:["usedPercent","remainingPercent","checkedAt"],Z?["resetsAt","modelId"]:["resetsAt"]))return!1;return s$($.usedPercent)&&s$($.remainingPercent)&&Z2($.checkedAt)&&R6($,"resetsAt",(J)=>typeof J==="string")&&(!Z||Z$($.id)&&Z$($.title)&&Z$($.modelName)&&R6($,"modelId",Z$))}function RJ($){return W$($)&&b$($,[],["five_hour","seven_day","scoped",...PQ])&&AQ($)&&R6($,"five_hour",(Z)=>A7(Z,!1))&&R6($,"seven_day",(Z)=>A7(Z,!1))&&R6($,"scoped",(Z)=>Array.isArray(Z)&&Z.every((J)=>A7(J,!0))&&new Set(Z.map((J)=>J.id)).size===Z.length)}function RU($){return W$($)&&b$($,["id","title","modelName","remainingPercent"],["modelId"])&&Z$($.id)&&Z$($.title)&&Z$($.modelName)&&R6($,"modelId",Z$)&&s$($.remainingPercent)}function TU($){return W$($)&&b$($,["version","remainingPercent"],["scoped",...PQ])&&$.version===1&&AQ($)&&W$($.remainingPercent)&&b$($.remainingPercent,[],["five_hour","seven_day"])&&Object.values($.remainingPercent).every(s$)&&R6($,"scoped",(Z)=>Array.isArray(Z)&&Z.every(RU))}function yY($){let Z=$.toLowerCase().replace(/[^a-z0-9]/g,"");if(Z.includes("fable"))return"fable";if(Z.includes("mythos"))return"mythos";return`model:${Z}`}function wQ($){let Z=yY([$.modelId,$.modelName,$.title].join(" "));return{scope:Z==="fable"||Z==="mythos"?Z:yY($.modelId??$.modelName),label:`seven_day:${$.id}`}}function s0($){if(!RJ($))throw new L0;let Z=JSON.parse(JSON.stringify($));if(!RJ(Z))throw new L0;let{five_hour:J,seven_day:X,scoped:Y,...G}=Z,z=[],Q={};if(J){let{remainingPercent:V,...B}=J;Q.five_hour=V,z.push({scope:"all",label:"five_hour",kind:"reading",...B})}if(X){let{remainingPercent:V,...B}=X;Q.seven_day=V,z.push({scope:"all",label:"seven_day",kind:"reading",...B})}let K=Y?.map((V)=>{let{usedPercent:B,checkedAt:q,resetsAt:H,...j}=V;return z.push({...wQ(j),kind:"reading",usedPercent:B,checkedAt:q,...H!==void 0?{resetsAt:H}:{}}),j}),W={limits:z,anthropic:{version:1,remainingPercent:Q,...G,...K!==void 0?{scoped:K}:{}}};if(G.extraUsage&&G.checkedAt!==void 0)W.budget={kind:"reading",checkedAt:G.checkedAt,reached:G.extraUsage.exhausted,...G.extraUsage.utilizationPercent!==void 0?{usedPercent:G.extraUsage.utilizationPercent}:{}};if(!V1(W))throw new L0;return W}function FU($){return W$($)&&b$($,["scope","label","kind","checkedAt","usedPercent"],["resetsAt"])&&Z$($.scope)&&Z$($.label)&&$.kind==="reading"&&Z2($.checkedAt)&&s$($.usedPercent)&&R6($,"resetsAt",(Z)=>typeof Z==="string")}function TJ($,Z){if(Array.isArray($)&&Array.isArray(Z))return $.length===Z.length&&$.every((J,X)=>TJ(J,Z[X]));if(W$($)&&W$(Z))return Object.keys($).length===Object.keys(Z).length&&Object.keys($).every((J)=>Object.hasOwn(Z,J)&&TJ($[J],Z[J]));return $===Z}function N0($){if(!W$($)||!b$($,["limits","anthropic"],["budget"])||!V1($)||!$.limits.every(FU)||!TU($.anthropic))throw new L0;let{version:Z,remainingPercent:J,scoped:X,...Y}=$.anthropic,G=structuredClone(Y);for(let z of["five_hour","seven_day"]){let Q=$.limits.find((V)=>V.scope==="all"&&V.label===z),K=z==="five_hour"?J.five_hour:J.seven_day;if(Q?.kind!=="reading"||K===void 0)continue;let W={usedPercent:Q.usedPercent,remainingPercent:K,checkedAt:Q.checkedAt,...Q.resetsAt!==void 0?{resetsAt:Q.resetsAt}:{}};if(z==="five_hour")G.five_hour=W;else G.seven_day=W}if(X!==void 0)G.scoped=X.map((z)=>{let Q=wQ(z),K=$.limits.find((W)=>W.scope===Q.scope&&W.label===Q.label);if(K?.kind!=="reading")throw new L0;return{...structuredClone(z),usedPercent:K.usedPercent,checkedAt:K.checkedAt,...K.resetsAt!==void 0?{resetsAt:K.resetsAt}:{}}});if(!TJ(s0(G),$))throw new L0;return G}var d$={validate($){try{return N0($),!0}catch{return!1}},merge($,Z){let J=N0(Z);if($===void 0)return s0(J);let X=N0($);if(X.accountIdentity!==J.accountIdentity)throw new L0;if(J.source==="headers")return s0(xB(X,J));let Y=o0(X),G=o0(J);return s0(Y>G||Y===G&&X.source==="poll"&&J.source!=="poll"?X:J)}};class o4 extends Error{constructor(){super("Anthropic account binding is unavailable or changed");this.name="NativePoolBindingError"}}function r4($){return typeof $==="string"&&$.length>0&&$.trim()===$}function J2($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function x6($){if(!$||typeof $!=="object"||Array.isArray($))return!1;let Z=$;return Z.kind==="local"&&typeof Z.storageId==="string"&&/^[a-f0-9]{64}$/.test(Z.storageId)&&r4(Z.rowId)&&J2(Z.credentialEpoch)&&(Z.identity===void 0||r4(Z.identity))&&["kind","storageId","rowId","credentialEpoch"].every((J)=>Object.hasOwn(Z,J))&&(Z.identity===void 0||Object.hasOwn(Z,"identity"))&&Object.keys(Z).every((J)=>["kind","storageId","rowId","credentialEpoch","identity"].includes(J))}function TQ($){return $.stamp==="bound"&&!$.invalid&&!$.torn&&!$.unbound&&r4($.id)&&J2($.credentialEpoch)&&($.identity===void 0||r4($.identity))}function mU($,Z){let J=Z.credentialEpoch;if(!Z.candidate||!TQ(Z)||!J2(J))throw new o4;let X={kind:"local",storageId:$.storageId,rowId:Z.id,credentialEpoch:J,...Z.identity!==void 0?{identity:Z.identity}:{}};if(!x6(X))throw new o4;return Object.freeze(X)}function U$($,Z,J){return x6($)&&TQ(J)&&$.storageId===Z.storageId&&$.rowId===J.id&&$.credentialEpoch===J.credentialEpoch&&$.identity===J.identity}function uY($){if(!x6($))throw new o4;return hU("sha256").update(JSON.stringify(["anthropic-local-refresh",$.storageId,$.credentialEpoch,$.identity===void 0?["row",$.rowId]:["account",$.identity]])).digest("hex")}function S$($){return uU("sha256").update($).digest("hex").slice(0,16)}function FJ($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function pY($,Z,J=[]){return Z.every((X)=>Object.hasOwn($,X))&&Object.keys($).every((X)=>Z.includes(X)||J.includes(X))}function e4($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0}function cY($){return typeof $==="string"&&$.length>0&&$.trim()===$}function $8($){if(!FJ($)||!pY($,["binding","credentialFingerprint","version"])||!x6($.binding)||$.binding.identity===void 0||typeof $.credentialFingerprint!=="string"||!/^[a-f0-9]{64}$/.test($.credentialFingerprint)||!FJ($.version)||!pY($.version,["accessFingerprint","expires"],["lastRefreshedAt"]))return!1;return typeof $.version.accessFingerprint==="string"&&/^[a-f0-9]{16}$/.test($.version.accessFingerprint)&&e4($.version.expires)&&$.version.expires>0&&(!Object.hasOwn($.version,"lastRefreshedAt")||e4($.version.lastRefreshedAt))}function c0($,Z,J){if(!$8($)||!x6(Z)||Z.identity===void 0||!FJ(J)||J.type!=="oauth"||!cY(J.access)||!cY(J.refresh)||!e4(J.expires)||J.expires<=0||Object.hasOwn(J,"lastRefreshedAt")&&!e4(J.lastRefreshedAt))return!1;return $.binding.storageId===Z.storageId&&$.binding.rowId===Z.rowId&&$.binding.credentialEpoch===Z.credentialEpoch&&$.binding.identity===Z.identity&&$.credentialFingerprint===I6({type:"oauth",refresh:J.refresh})&&$.version.accessFingerprint===S$(J.access)&&$.version.expires===J.expires&&Object.hasOwn($.version,"lastRefreshedAt")===Object.hasOwn(J,"lastRefreshedAt")&&$.version.lastRefreshedAt===J.lastRefreshedAt}function FQ($){if(!$)return;return(Z)=>{try{let J=$(Z);if(J!==null&&(typeof J==="object"||typeof J==="function")&&"then"in J&&typeof J.then==="function")Promise.resolve(J).catch(()=>{})}catch{}}}class U0 extends Error{code;constructor($){super($==="supervised-auth-snapshot"?"Local login cannot be verified while OPENCODE_AUTH_CONTENT is set. Run setup without OPENCODE_AUTH_CONTENT in the environment.":"Invalid native host auth source.");this.name="NativeHostAuthError",this.code=$==="supervised-auth-snapshot"?$:"invalid-source"}}function dU($){return $.OPENCODE_AUTH_CONTENT!==void 0}function SQ($){if(dU($))throw new U0("supervised-auth-snapshot")}function O6(){throw new U0("invalid-source")}function L4($){if($===null||typeof $!=="object"||Array.isArray($))return!1;let Z=Object.getPrototypeOf($);return Z===Object.prototype||Z===null}function F9($){let Z=new Map;for(let J of Reflect.ownKeys($)){if(typeof J!=="string")O6();let X=Object.getOwnPropertyDescriptor($,J);if(!X||!Object.hasOwn(X,"value"))O6();Z.set(J,X.value)}return Z}function CJ($,Z=new Set){if($===null||typeof $==="string"||typeof $==="boolean")return JSON.stringify($);if(typeof $==="number"){if(!Number.isFinite($))O6();return JSON.stringify($)}if(typeof $!=="object")O6();if(Z.has($))O6();Z.add($);try{if(Array.isArray($)){if(Object.getPrototypeOf($)!==Array.prototype)O6();let X=F9($),Y=X.get("length");if(X.size!==Y+1)O6();let G=[];for(let z=0;z<Y;z++){let Q=String(z);if(!X.has(Q))O6();G.push(CJ(X.get(Q),Z))}return`[${G.join(",")}]`}if(!L4($))O6();let J=F9($);return`{${[...J.keys()].sort().map((X)=>`${JSON.stringify(X)}:${CJ(J.get(X),Z)}`).join(",")}}`}finally{Z.delete($)}}function c6($,Z){try{if($!=="opencode"&&$!=="pi")O6();if(Z===void 0)return Object.freeze({kind:"absent",digest:"absent"});if(!L4(Z))O6();let J=F9(Z);if(!J.has("anthropic"))return Object.freeze({kind:"absent",digest:"absent"});let X=J.get("anthropic");if(!L4(X))O6();let Y=F9(X),G=CJ(X),z,Q=Y.get("type");if(Q==="oauth"){if(typeof Y.get("access")!=="string"||typeof Y.get("refresh")!=="string"||typeof Y.get("expires")!=="number"||!Number.isFinite(Y.get("expires")))O6();let K=BZ("anthropic");z=Y.size===4&&Object.entries(K).every(([W,V])=>Y.get(W)===V)?"activation":"oauth"}else if($==="opencode"&&Q==="api"){if(typeof Y.get("key")!=="string")O6();z="api"}else if($==="pi"&&Q==="api_key"){if(Y.has("key")&&typeof Y.get("key")!=="string")O6();if(Y.has("env")){let K=Y.get("env");if(!L4(K))O6();for(let W of F9(K).values())if(typeof W!=="string")O6()}z="api_key"}else O6();if(z!=="activation")for(let K of["access","refresh","key"]){let W=Y.get(K);if(typeof W==="string"&&W.startsWith("claustrum-tombstone:"))O6()}return Object.freeze({kind:z,digest:lU("sha256").update(G,"utf8").digest("hex")})}catch{throw new U0("invalid-source")}}class Y2 extends Error{code="prepared-proof-refused";constructor(){super("Native migration prepared proof is unavailable or changed");this.name="NativeMigrationProofError"}}function K6(){throw new Y2}function G2($){if(!$||typeof $!=="object"||Array.isArray($)||X2.isProxy($))K6();let Z=Object.getPrototypeOf($);if(Z!==Object.prototype&&Z!==null)K6();for(let J of Reflect.ownKeys($)){if(typeof J!=="string")K6();let X=Object.getOwnPropertyDescriptor($,J);if(!X||!Object.hasOwn(X,"value"))K6()}}function t0($){let Z=new Set;function J(X){if(X===null||typeof X==="string"||typeof X==="boolean")return X;if(typeof X==="number"&&Number.isFinite(X))return X;if(typeof X!=="object"||X2.isProxy(X)||Z.has(X))K6();let Y=Object.getPrototypeOf(X);if(Y!==(Array.isArray(X)?Array.prototype:Object.prototype)&&!(Y===null&&!Array.isArray(X)))K6();Z.add(X);try{let G=new Map;for(let Q of Reflect.ownKeys(X)){if(typeof Q!=="string")K6();let K=Object.getOwnPropertyDescriptor(X,Q);if(!K||!Object.hasOwn(K,"value"))K6();G.set(Q,K.value)}if(Array.isArray(X)){let Q=G.get("length");if(typeof Q!=="number"||G.size!==Q+1)K6();return Array.from({length:Q},(K,W)=>{if(!G.has(String(W)))K6();return J(G.get(String(W)))})}let z=Object.create(null);for(let Q of[...G.keys()].sort())z[Q]=J(G.get(Q));return z}finally{Z.delete(X)}}return J($)}function M6($){return JSON.stringify(t0($))}function SJ($){return iU("sha256").update(M6($)).digest("hex")}function kJ($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function n1($,Z,J){if(!Object.hasOwn($,Z))return["absent"];if(typeof $[Z]!==J)K6();return["present",$[Z]]}function sU($){let Z=t0($);if(!kJ(Z))K6();if(Z.type==="oauth"&&typeof Z.refresh==="string"){if(Object.keys(Z).some((J)=>!["type","access","refresh","expires","lastRefreshedAt"].includes(J)))K6();return SJ(["anthropic-prepared-credential-v1","oauth",n1(Z,"access","string"),Z.refresh,n1(Z,"expires","number"),n1(Z,"lastRefreshedAt","number")])}if(Z.type==="api"&&typeof Z.apiKey==="string"&&typeof Z.baseURL==="string"){if(Object.keys(Z).some((J)=>!["type","apiKey","baseURL","authHeader"].includes(J)))K6();if(Object.hasOwn(Z,"authHeader")&&Z.authHeader!=="x-api-key"&&Z.authHeader!=="authorization-bearer")K6();return SJ(["anthropic-prepared-credential-v1","api",Z.apiKey,Z.baseURL,n1(Z,"authHeader","string")])}return K6()}function kQ($,Z){if(X2.isProxy($)||!Array.isArray($)||Object.getPrototypeOf($)!==Array.prototype)K6();let J=Object.getOwnPropertyDescriptors($);if(Reflect.ownKeys(J).length!==$.length+1)K6();let X=Array.from({length:$.length},(Y,G)=>{let z=J[String(G)];if(!z||!Object.hasOwn(z,"value"))K6();let Q=z.value;if(G2(Q),Q.stamp!=="bound"||Q.invalid||Q.torn||Q.unbound||!Q.credential||typeof Q.credentialEpoch!=="number"||!Number.isSafeInteger(Q.credentialEpoch)||Q.credentialEpoch<=0||typeof Q.id!=="string"||!Q.id||Q.identity!==void 0&&(typeof Q.identity!=="string"||!Q.identity))K6();return{id:Q.id,credentialEpoch:Q.credentialEpoch,identity:Q.identity??null,stamp:"bound",credentialDigest:sU(Q.credential)}}).sort((Y,G)=>Y.id<G.id?-1:Y.id>G.id?1:0);if(new Set(X.map((Y)=>Y.id)).size!==X.length)K6();return{version:1,rows:X,runtimeDigest:SJ(Z)}}function vQ($){let Z=t0($),J=(Y)=>typeof Y==="string"&&/^[a-f0-9]{64}$/.test(Y);if(!kJ(Z)||Object.keys(Z).length!==3||Z.version!==1||!Array.isArray(Z.rows)||!J(Z.runtimeDigest))K6();let X=Z.rows.map((Y)=>{if(!kJ(Y)||Object.keys(Y).length!==5||typeof Y.id!=="string"||!Y.id||typeof Y.credentialEpoch!=="number"||!Number.isSafeInteger(Y.credentialEpoch)||Y.credentialEpoch<=0||!(Y.identity===null||typeof Y.identity==="string"&&Y.identity.length>0)||Y.stamp!=="bound"||typeof Y.credentialDigest!=="string"||!J(Y.credentialDigest))K6();return{id:Y.id,credentialEpoch:Y.credentialEpoch,identity:Y.identity,stamp:"bound",credentialDigest:Y.credentialDigest}});if(new Set(X.map((Y)=>Y.id)).size!==X.length)K6();return{version:1,rows:X,runtimeDigest:Z.runtimeDigest}}function w7($,Z,J){if(!$||M6(vQ($))!==M6(kQ(Z,J)))K6()}class z2 extends Error{code="invalid-migration-source";constructor(){super("Native migration source cannot be imported safely");this.name="NativeMigrationProjectionError"}}function $6(){throw new z2}function g8($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function k6($){if($===void 0)return Object.create(null);if(!g8($))$6();return $}function r6($){return typeof $==="string"&&$.length>0&&$.trim()===$}function lY($){if(!r6($)||["__proto__","constructor","prototype"].includes($))$6();return $}function f0($){return typeof $==="number"&&Number.isFinite($)&&$>=0?$:0}function dY($){if($===void 0)return;if(!r6($))$6();return $}function T8($,Z){return Object.fromEntries(Z.filter((J)=>Object.hasOwn($,J)).map((J)=>[J,$[J]]))}var fQ={routing:["mode"],refresh:["enabled","intervalMinutes","refreshBeforeExpiryMinutes"],quota:["enabled","checkIntervalMinutes","refreshEveryNRequests","minimumRemaining","failClosedOnUnknownQuota","showToasts"],quotaHeaderFeed:["enabled"],claudeCache:["enabled","mode"],dump:["enabled"],logging:["level"],claudeFast:["enabled"],thinkingBinding:["prefixMismatchBehavior"],costZeroing:["enabled"],cacheKeep:["enabled","always","startHour","endHour","subagents"],prime:["enabled"],relay:["enabled","url","fallbackToDirect","transport"],killswitch:["enabled","main","accounts"]};function vJ($){let Z=(X)=>g8(X)&&Object.entries(X).every(([Y,G])=>["five_hour","seven_day","5h","1w","scoped"].includes(Y)&&typeof G==="number"&&Number.isFinite(G)&&G>=0&&G<=100),J={"routing.mode":["main-first","fallback-first","sticky-balanced"],"claudeCache.mode":TG,"logging.level":["debug","info","warn","error","trace"],"thinkingBinding.prefixMismatchBehavior":["account-default","error","drop_block"],"relay.transport":["http","websocket"]};for(let[X,Y]of Object.entries(fQ)){if($[X]===void 0)continue;let G=k6($[X]);for(let z of Y){if(G[z]===void 0)continue;let Q=J[`${X}.${z}`];if(Q){if(typeof G[z]!=="string"||!Q.includes(G[z]))$6();continue}if(["enabled","always","subagents","failClosedOnUnknownQuota","showToasts","fallbackToDirect"].includes(z)){if(typeof G[z]!=="boolean")$6()}else if(z==="url"){if(typeof G[z]!=="string"||!kG(G[z]))$6()}else if(z==="minimumRemaining"||z==="main"){if(!Z(G[z]))$6()}else if(z==="accounts"){if(!g8(G[z])||!Object.entries(G[z]).every(([K,W])=>r6(K)&&Z(W)))$6()}else if(typeof G[z]!=="number"||!Number.isFinite(G[z])||G[z]<0)$6()}}}function R7($){if($.type==="oauth"&&r6($.refresh)){if($.access!==void 0&&typeof $.access!=="string"||$.expires!==void 0&&(typeof $.expires!=="number"||!Number.isFinite($.expires)))$6();return{type:"oauth",refresh:$.refresh,...typeof $.access==="string"?{access:$.access}:{},...typeof $.expires==="number"?{expires:$.expires}:{}}}if($.type==="api"&&r6($.apiKey)&&typeof $.baseURL==="string"&&kG($.baseURL)){if($.authHeader!==void 0&&$.authHeader!=="authorization-bearer"&&$.authHeader!=="x-api-key")$6();return{type:"api",apiKey:$.apiKey,baseURL:$.baseURL,authHeader:$.authHeader??"authorization-bearer"}}return $6()}function iY($,Z,J){let X=T8($,["lastUsed","lastRefreshedAt","refreshErrorClearedAt","quotaErrorClearedAt","quotaErrorGeneration","prime","authLineageId","primeAuthLineageRefreshTokenFingerprint"]),Y=J?.type==="oauth"?S$(J.access??""):Z;if($.quotaToken!==void 0&&$.quotaToken===Y){if(X.quotaToken=$.quotaToken,$.quotaCheckedAt!==void 0)X.quotaCheckedAt=$.quotaCheckedAt}if(g8($.profile)&&Z!==void 0&&($.profile.providerAccountUuid===Z||$.profile.accountIdentity===Z))X.profile=T8($.profile,["tier","orgType","checkedAt","accountIdentity","providerAccountUuid","tokenFingerprint"]);for(let G of["lastRefreshError","lastQuotaRefreshError"]){let z=$[G],Q=X[G==="lastRefreshError"?"refreshErrorClearedAt":"quotaErrorClearedAt"];if(!g8(z)||typeof Q==="number"&&f0(z.checkedAt)<=Q||z.accountIdentity!==void 0&&z.accountIdentity!==Z)continue;let K=T8(z,["checkedAt","nextRetryAt","retryCount","accountIdentity","status","permanent"]);if(K.message=G==="lastRefreshError"?"Imported refresh failure":"Imported quota failure",G==="lastRefreshError"&&J?.type==="oauth"&&z.tokenHash===CQ("sha256").update(J.refresh).digest("hex"))K.credentialFingerprint=I6(J);X[G]=K}return X}function sY($,Z){if($===void 0)return;if(!RJ($))return;if(Z===void 0||$.accountIdentity!==Z)return;return s0($)}function tU($){try{G2($);let Z=k6($.config===void 0?void 0:t0($.config)),J=k6($.state===void 0?void 0:t0($.state)),X=k6($.hostAuth===void 0?void 0:t0($.hostAuth)),Y=c6($.host,X);if(Z.version!==void 0&&Z.version!==1||J.version!==void 0&&J.version!==1)$6();let G=CQ("sha256").update(JSON.stringify([$.storageId,$.configDigest,"former-main"])).digest("hex"),z=Z.mainAccountId===void 0?`${G.slice(0,8)}-${G.slice(8,12)}-${G.slice(12,16)}-${G.slice(16,20)}-${G.slice(20,32)}`:lY(Z.mainAccountId),Q={mainAccountId:z,formerMainRowId:z};for(let[I,L]of Object.entries(fQ))if(Z[I]!==void 0)Q[I]=T8(k6(Z[I]),L);if(Z.fallbackOn!==void 0){if(!Array.isArray(Z.fallbackOn)||Z.fallbackOn.some((I)=>typeof I!=="number"||!Number.isInteger(I)))$6();Q.fallbackOn=Z.fallbackOn}let K=k6(Z.claustrum),W=K.primaryAccount,V;if(W!==void 0){let I=k6(W);if(!r6(I.credentialId)||!r6(I.accountId))$6();V={credentialId:I.credentialId,accountIdentity:I.accountId}}let B=K.disabledAccountIdentities??[];if(!Array.isArray(B)||B.some((I)=>!r6(I)))$6();let q=[];for(let I of B){if(!r6(I))$6();q.push(I)}if(K.mode==="claustrum"&&!V)$6();Q.claustrum={mode:V?"claustrum":"local",...W?{primaryAccount:W}:{},disabledAccountIdentities:B};let H=[],j=[],x={...k6(Z.main),...k6(J.main)};if(V||Y.kind==="oauth"){let I;if(!V){let P=k6(X.anthropic);I=Y.kind==="oauth"?R7(P):R7({type:"api",apiKey:P.key,baseURL:"https://api.anthropic.com",authHeader:"x-api-key"})}let L=V?.accountIdentity??(g8(x.profile)&&I?.type==="oauth"&&(x.profileToken===S$(I.access??"")||x.profile.tokenFingerprint===S$(I.access??""))?dY(x.profile.providerAccountUuid):void 0),w=k6(Z.quota),S=k6(Z.refresh),f=k6(Z.prime),d={...T8(S,[]),...x};for(let[P,F]of Object.entries({lastRefreshError:"mainLastRefreshError",refreshErrorClearedAt:"mainRefreshErrorClearedAt"}))if(!Object.hasOwn(d,P)&&S[F]!==void 0)d[P]=S[F];for(let[P,F]of Object.entries({lastQuotaRefreshError:"mainLastQuotaApiError",quotaErrorClearedAt:"mainQuotaErrorClearedAt",quotaErrorGeneration:"mainQuotaErrorGeneration"}))if(!Object.hasOwn(d,P)&&w[F]!==void 0)d[P]=w[F];if(x.lastQuotaApiError!==void 0)d.lastQuotaRefreshError=x.lastQuotaApiError;if(d.authLineageId=x.primeAuthLineageId??f.mainAuthLineageId,d.primeAuthLineageRefreshTokenFingerprint=x.primeAuthLineageRefreshTokenFingerprint??f.mainAuthLineageRefreshTokenFingerprint,d.prime===void 0&&f.main!==void 0)d.prime=f.main;let s={id:z,enabled:!0,runtime:iY(d,L,I),...L!==void 0?{identity:L}:{},...I?{credential:I}:{}},_=x.quota??w.mainQuota,O=x.quotaToken??w.mainQuotaToken;if(V||I?.type==="oauth"&&O===S$(I.access??""))s.quota=sY(_,L);H.push(s)}if(Z.accounts!==void 0&&!Array.isArray(Z.accounts))$6();let N=k6(J.accounts);for(let I of Array.isArray(Z.accounts)?Z.accounts:[]){let L=k6(I),w=lY(L.id);if(L.enabled!==void 0&&typeof L.enabled!=="boolean")$6();let S=T8(k6(N[w]),["access","refresh","expires","apiKey","lastUsed","lastRefreshedAt","anthropicAccountUuid","claustrumScopedCredentialId","claustrumScopedState","authLineageId","lastRefreshError","lastQuotaRefreshError","quota","profile","prime","refreshErrorClearedAt","quotaErrorClearedAt","quotaErrorGeneration"]),f=L.claustrumScopedCredentialId!==void 0,d=f&&S.claustrumScopedCredentialId===L.claustrumScopedCredentialId&&S.anthropicAccountUuid===L.anthropicAccountUuid,s=Math.max(f0(L.lastRefreshedAt),f0(L.lastUsed),f0(L.addedAt)),_=Math.max(f0(S.lastRefreshedAt),f0(S.lastUsed),f0(S.addedAt)),O=["access","refresh","apiKey"].some((T)=>L[T]!==void 0&&S[T]!==void 0&&L[T]!==S[T]),P=O&&s>_;if(O&&s===_)$6();let F=f?{...d?S:{},...L}:P?{...S,...L}:{...L,...S};if(P)delete F.quota,delete F.lastRefreshError,delete F.lastQuotaRefreshError;let M=dY(L.anthropicAccountUuid??F.anthropicAccountUuid);if(L.anthropicAccountUuid!==void 0&&S.anthropicAccountUuid!==void 0&&L.anthropicAccountUuid!==S.anthropicAccountUuid)$6();if(V&&L.type==="oauth"&&!f)$6();let R=f?void 0:R7(F);if(f){if(L.type!=="oauth"||!r6(L.claustrumScopedCredentialId)||!M||r6(L.refresh)||L.access!==void 0)$6();j.push({routeId:w,scopedCredentialId:L.claustrumScopedCredentialId,anthropicAccountUuid:M,enabled:L.enabled!==!1,...r6(L.label)?{label:L.label}:{},...typeof L.addedAt==="number"?{addedAt:L.addedAt}:{}})}let k={id:w,enabled:L.enabled!==!1,runtime:iY(F,M,R),...M!==void 0?{identity:M}:{},...r6(L.label)?{label:L.label}:{},...R?{credential:R}:{}},v=sY(F.quota,M);if(v)k.quota=v;H.push(k)}if(new Set(H.map((I)=>I.id)).size!==H.length)$6();let U=new Set,D=new Set;for(let I of H){if(I.enabled&&I.identity){if(U.has(I.identity))$6();U.add(I.identity)}if(I.credential){let L=I6(I.credential);if(D.has(L))$6();D.add(L),Object.defineProperty(I,"credential",{enumerable:!1})}for(let L of Object.keys(I.runtime))if(I.runtime[L]===void 0)delete I.runtime[L];if(I.quota===void 0)delete I.quota}vJ(Q);let A=k6(Z.relay);return{accounts:H,settings:Q,mainRouteId:z,custodyRows:j,disabledAccountIdentities:q,...V?{custodyPrimary:V}:{},...typeof A.token==="string"?{relay:{token:A.token}}:{}}}catch{return $6()}}function G9($,Z,J=!0){let X=$.accounts.filter((Y)=>Y.credential!==void 0);if(Z.length!==X.length)$6();for(let Y of X){let G=Z.find((Q)=>Q.id===Y.id);if(G?.stamp!=="bound"||G.invalid||G.torn||G.unbound||G.identity!==Y.identity||G.enabled!==Y.enabled||!G.credential)$6();let z;if(G.credential.type==="oauth"){let{lastRefreshedAt:Q,...K}=G.credential;z=K}else z=G.credential;if(M6(z)!==M6(Y.credential))$6();if(J&&M6(G.quota??null)!==M6(Y.quota??null))$6()}}function fJ($,Z,J,X){let Y=Object.create(null);for(let G of Z.accounts.filter((z)=>z.credential)){let z=J.find((Q)=>Q.id===G.id);if(z?.stamp!=="bound"||z.credentialEpoch===void 0)$6();Y[G.id]={binding:{kind:"local",storageId:$.storageId,rowId:z.id,credentialEpoch:z.credentialEpoch,...z.identity!==void 0?{identity:z.identity}:{}},...G.runtime}}if(X)for(let G of Z.accounts.filter((z)=>!z.credential)){let z=X.rows.find((Q)=>Q.routeId===G.id);if(!z?.accountIdentity||z.accountIdentity!==G.identity)$6();Y[G.id]={binding:{kind:"custody",storageId:$.storageId,routeId:z.routeId,credentialId:z.credentialId,accountIdentity:z.accountIdentity,recordVersion:0},...G.runtime,...G.quota?{quota:G.quota}:{}}}return Q2({version:1,storageId:$.storageId,accounts:Y,...Z.relay?{relay:Z.relay}:{}},$.storageId)}function l0($){return $!==null&&typeof $==="object"&&!Array.isArray($)}async function EJ($){try{return JSON.parse(await cU($,"utf8"))}catch{return}}async function N4($){try{return await pU($),!1}catch(Z){if(Z instanceof Error&&"code"in Z&&Z.code==="ENOENT")return!0;throw Z}}var aU={routing:["mode"],claudeCache:["enabled","mode"],cacheKeep:["enabled","always","startHour","endHour","subagents"],quota:["enabled","checkIntervalMinutes","minimumRemaining","failClosedOnUnknownQuota"],killswitch:["enabled","main"],claudeFast:["enabled"],prime:["enabled"],logging:["level"],dump:["enabled"]};async function nU($){let Z=await EJ($),J={};if(!l0(Z)||Z.version!==void 0&&Z.version!==1)return J;for(let[X,Y]of Object.entries(aU)){let G=Z[X];if(!l0(G))continue;let z={};for(let Q of Y){let K=G[Q];if(K===void 0)continue;if((Q==="minimumRemaining"||X==="killswitch"&&Q==="main")&&l0(K)){let W={};for(let V of["five_hour","seven_day","5h","1w","scoped"]){if(K[V]===void 0)continue;try{vJ({[X]:{[Q]:{[V]:K[V]}}}),W[V]=K[V]}catch{}}if(Object.keys(W).length)z[Q]=W;continue}try{vJ({[X]:{[Q]:K}}),z[Q]=K}catch{}}if(Object.keys(z).length)J[X]=z}if(Array.isArray(Z.fallbackOn))J.fallbackOn=Z.fallbackOn.filter((X)=>typeof X==="number"&&Number.isInteger(X));return J}function T7($){return typeof $==="string"&&/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test($)}function oU($,Z){let J=new Map;if(!l0($)||$.version!==void 0&&$.version!==1)return J;let X=new Map,Y=new Set;for(let W of Z.rows){if(W.credentialType!=="oauth"||W.state!=="active"||W.stale||W.unclaimed||!T7(W.accountIdentity))continue;if(X.has(W.accountIdentity))Y.add(W.accountIdentity);X.set(W.accountIdentity,W.routeId)}function G(W,V){if(typeof W!=="string"||!T7(V)||Y.has(V))return;let B=X.get(V);if(B)J.set(W,{routeId:B,accountIdentity:V})}let z=l0($.claustrum)?$.claustrum:void 0,Q=l0(z?.primaryAccount)?z.primaryAccount:void 0,K=T7(Q?.accountId)?Q.accountId:$.mainAccountId;G("main",K),G($.mainAccountId,K);for(let W of Array.isArray($.accounts)?$.accounts:[])if(l0(W)&&W.type==="oauth")G(W.id,W.anthropicAccountUuid);return J}function B1($){return[{path:$.config,name:"pool-config"},{path:$.state,name:"pool-state"}]}function x0($){let Z=HU({provider:"anthropic",configPath:$.paths.config,statePath:$.paths.state,storeLocks:B1($.paths),requireCredentialStamps:!0,quota:$.quota,now:$.now,onStep:$.onStep,hold:$.hold,logger:$.logger,onLockEvent:FQ($.onLockEvent),onLockStep:$.onLockStep}),J=$.paths.legacySeedConfig;if(!J)return Z;return{...Z,updateSettings:(X,Y)=>Z.updateSettings(async(G)=>{if(await N4($.paths.config))Object.assign(G,await nU(J));return X(G)},Y)}}class b extends Error{code;constructor($){super({"invalid-runtime":"Anthropic runtime state is invalid","unsafe-runtime":"Anthropic runtime file is not owner-only regular storage","runtime-io":"Anthropic runtime storage is unavailable","runtime-conflict":"Anthropic runtime observation is older than persisted state","publication-refused":"Anthropic runtime publication was refused"}[$]);this.code=$,this.name="NativeRuntimeError"}}function P6($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function V$($,Z,J=[]){return Z.every((X)=>Object.hasOwn($,X))&&Object.keys($).every((X)=>Z.includes(X)||J.includes(X))}function J$($){return typeof $==="string"&&$.length>0&&$.trim()===$}function t$($){return typeof $==="number"&&Number.isFinite($)&&$>=0}function A6($){return t$($)&&Number.isSafeInteger($)}function z6($,Z,J){return!Object.hasOwn($,Z)||J($[Z])}function a$($){return typeof $==="string"&&/^[a-f0-9]{64}$/.test($)}function y8($){return typeof $==="string"&&/^[a-f0-9]{16}$/.test($)}function EQ($){return typeof $==="string"&&/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test($)}function rU($){return x6($)||P6($)&&V$($,["kind","storageId","routeId","credentialId","accountIdentity","recordVersion"])&&$.kind==="custody"&&a$($.storageId)&&J$($.routeId)&&J$($.credentialId)&&J$($.accountIdentity)&&A6($.recordVersion)}function C9($,Z=[]){return P6($)&&V$($,["message","checkedAt"],["nextRetryAt","retryCount","accountIdentity","tokenHash","refreshTokenFingerprint","status","permanent",...Z])&&typeof $.message==="string"&&t$($.checkedAt)&&z6($,"nextRetryAt",t$)&&z6($,"retryCount",A6)&&z6($,"accountIdentity",J$)&&z6($,"tokenHash",a$)&&z6($,"refreshTokenFingerprint",y8)&&z6($,"status",(J)=>A6(J)&&J>=100&&J<=599)&&z6($,"permanent",(J)=>typeof J==="boolean")}function bJ($){return C9($,["credentialFingerprint"])&&P6($)&&z6($,"credentialFingerprint",a$)}function eU($,Z){return P6($)&&V$($,["subject","checkedAt","nextRetryAt"])&&Z.kind==="local"&&Z.identity!==void 0&&$8($.subject)&&$.subject.binding.storageId===Z.storageId&&$.subject.binding.rowId===Z.rowId&&$.subject.binding.credentialEpoch===Z.credentialEpoch&&$.subject.binding.identity===Z.identity&&A6($.checkedAt)&&A6($.nextRetryAt)&&$.nextRetryAt>=$.checkedAt}function $x($){return P6($)&&V$($,["tier","orgType","checkedAt"],["accountIdentity","providerAccountUuid","tokenFingerprint"])&&J$($.tier)&&J$($.orgType)&&t$($.checkedAt)&&z6($,"accountIdentity",J$)&&z6($,"providerAccountUuid",J$)&&z6($,"tokenFingerprint",y8)}function Zx($){return P6($)&&V$($,["count","inputTokens","outputTokens","since"])&&A6($.count)&&A6($.inputTokens)&&A6($.outputTokens)&&t$($.since)}var Jx=["credentialValidation","validationRetry","lastUsed","lastRefreshedAt","lastRefreshError","refreshErrorClearedAt","refreshLeaseId","refreshLeaseUntil","refreshLeaseTokenHash","lastQuotaRefreshError","quotaErrorGeneration","quotaErrorClearedAt","quota","quotaCheckedAt","quotaToken","profile","profileToken","prime","authLineageId","primeAuthLineageRefreshTokenFingerprint"];function Xx($,Z,J){if(!P6($)||!V$($,["binding"],Jx)||!rU($.binding)||$.binding.storageId!==J||($.binding.kind==="local"?$.binding.rowId:$.binding.routeId)!==Z)return!1;let X=$.binding;if(!z6($,"validationRetry",(z)=>eU(z,X)))return!1;if(Object.hasOwn($,"credentialValidation")){let z=$.credentialValidation;if(X.kind!=="local"||X.identity===void 0||!$8(z)||z.binding.storageId!==X.storageId||z.binding.rowId!==X.rowId||z.binding.credentialEpoch!==X.credentialEpoch||z.binding.identity!==X.identity)return!1}for(let z of["lastUsed","lastRefreshedAt","refreshErrorClearedAt","refreshLeaseUntil","quotaErrorClearedAt","quotaCheckedAt"])if(!z6($,z,t$))return!1;for(let z of["refreshLeaseId","authLineageId"])if(!z6($,z,J$))return!1;if(Object.hasOwn($,"profileToken")||!z6($,"refreshLeaseTokenHash",a$)||!z6($,"primeAuthLineageRefreshTokenFingerprint",y8)||!z6($,"quotaToken",(z)=>X.kind==="local"?y8(z):EQ(z)&&z===X.accountIdentity)||!z6($,"quotaErrorGeneration",A6)||!z6($,"profile",$x)||!z6($,"prime",Zx)||!z6($,"lastRefreshError",X.kind==="local"?bJ:C9)||!z6($,"lastQuotaRefreshError",C9))return!1;let Y=$.binding.kind==="local"?$.binding.identity:$.binding.accountIdentity;for(let z of[$.profile,$.lastRefreshError,$.lastQuotaRefreshError])if(P6(z)&&(z.accountIdentity!==void 0&&z.accountIdentity!==Y||z.providerAccountUuid!==void 0&&z.providerAccountUuid!==Y))return!1;if(Object.hasOwn($,"quota")){if($.binding.kind!=="custody")return!1;try{if(N0($.quota).accountIdentity!==Y)return!1}catch{return!1}}let G=[["lastRefreshError","refreshErrorClearedAt"],["lastQuotaRefreshError","quotaErrorClearedAt"]];for(let[z,Q]of G){let K=$[z],W=$[Q];if((z==="lastRefreshError"&&X.kind==="local"?bJ:C9)(K)&&t$(W)&&K.checkedAt<=W)return!1}return!0}function Q2($,Z){if(!P6($)||!V$($,["version","storageId","accounts"],["relay"])||$.version!==1||!a$(Z)||$.storageId!==Z||!P6($.accounts)||!z6($,"relay",(X)=>P6(X)&&V$(X,["token"])&&typeof X.token==="string"))throw new b("invalid-runtime");let J=Object.create(null);for(let[X,Y]of Object.entries($.accounts)){if(!J$(X)||!Xx(Y,X,Z))throw new b("invalid-runtime");J[X]=structuredClone(Y)}return{version:1,storageId:Z,accounts:J,...P6($.relay)&&typeof $.relay.token==="string"?{relay:{token:$.relay.token}}:{}}}function Yx($){return $ instanceof Error&&"code"in $&&$.code==="ENOENT"}function bQ($){if(!bU($))throw new b("unsafe-runtime")}async function c$($,Z){if(bQ($),!a$(Z))throw new b("invalid-runtime");let J=hY.O_NOFOLLOW??0;try{for(let X=0;X<2;X++){let Y=await SU($);if(!Y.isFile()||(Y.mode&511)!==384||typeof process.geteuid==="function"&&Y.uid!==process.geteuid())throw new b("unsafe-runtime");let G=await RQ($,hY.O_RDONLY|J);try{let z=await G.stat();if(!z.isFile()||(z.mode&511)!==384||typeof process.geteuid==="function"&&z.uid!==process.geteuid())throw new b("unsafe-runtime");if(!J&&(z.dev!==Y.dev||z.ino!==Y.ino)){if(X===0)continue;throw new b("unsafe-runtime")}let Q;try{Q=new TextDecoder("utf-8",{fatal:!0}).decode(await G.readFile())}catch(K){if(K instanceof TypeError)throw new b("invalid-runtime");throw K}return{status:"ready",state:Q2(m8(Q),Z)}}finally{await G.close()}}throw new b("unsafe-runtime")}catch(X){if(Yx(X))return{status:"missing"};if(X instanceof b)throw X;if(X instanceof SyntaxError)throw new b("invalid-runtime");throw new b("runtime-io")}}function Q$($,Z){return $.storageId===Z.storageId&&$.rowId===Z.rowId&&$.credentialEpoch===Z.credentialEpoch&&$.identity===Z.identity}function Gx($,Z,J){let X=!1;for(let[Y,G]of Object.entries(Z.accounts)){let z=$.accounts[Y];if(!z)continue;if(z.binding.kind!==G.binding.kind)continue;if(z.binding.kind==="local"&&G.binding.kind==="local"){if(G.binding.credentialEpoch<z.binding.credentialEpoch)throw new b("runtime-conflict");if(G.binding.credentialEpoch>z.binding.credentialEpoch)continue;if(z.binding.identity!==G.binding.identity){if(!J||X||Y!==J.predecessor.rowId||z.binding.identity!==void 0||!Q$(z.binding,J.predecessor)||!Q$(G.binding,J.proof.binding))throw new b("runtime-conflict");X=!0}}else if(z.binding.kind==="custody"&&G.binding.kind==="custody"){if(z.binding.credentialId!==G.binding.credentialId||z.binding.accountIdentity!==G.binding.accountIdentity)continue;if(G.binding.recordVersion<z.binding.recordVersion)throw new b("runtime-conflict")}let Q=["quotaErrorGeneration","quotaErrorClearedAt","refreshErrorClearedAt"];for(let K of Q){let W=z[K],V=G[K];if(W!==void 0&&(V===void 0||V<W))throw new b("runtime-conflict")}if(z.profile&&G.profile&&G.profile.checkedAt<z.profile.checkedAt)throw new b("runtime-conflict");if(z.quota&&G.quota&&o0(N0(G.quota))<o0(N0(z.quota)))throw new b("runtime-conflict");for(let[K,W]of[["lastRefreshError","refreshErrorClearedAt"],["lastQuotaRefreshError","quotaErrorClearedAt"]]){let V=z[K],B=G[K],q=G[W],H=K==="lastRefreshError"&&G.binding.kind==="local"?bJ:C9;if(H(V)&&(!H(B)?!t$(q)||q<V.checkedAt:B.checkedAt<V.checkedAt))throw new b("runtime-conflict")}}if(J&&!X)throw new b("publication-refused")}async function gJ($,Z,J,X={}){return gQ($,Z,J,X)}async function zx($,Z,J,X){return yQ($,Z,J,{beforeRename:X.beforeRename})}async function gQ($,Z,J,X,Y){let G=await yQ($,Z,J,{beforeRename:async()=>{return await X.beforeRename?.(),"publish"},beforePublish:X.beforePublish,afterRename:X.afterRename},Y);if(G.status!=="published")throw new b("publication-refused");return G.state}async function yQ($,Z,J,X,Y){bQ($);try{return await kU(mY($),{recursive:!0,mode:448}),await d6($,{name:"native-runtime",ttlMs:1e4,timeoutMs:15000,renew:!0},async(G)=>{let z=await c$($,Z),Q=z.status==="ready"?z.state:{version:1,storageId:Z,accounts:{}},K=Q2(await J(structuredClone(Q)),Z);Gx(Q,K,Y);let W=`${JSON.stringify(K,null,2)}
+`,V=gU(mY($),`${EU($)}.native-runtime.${CU()}.partial`),B=!1;try{let q=await RQ(V,"wx",384);B=!0;try{await q.writeFile(W,"utf8"),await q.sync()}finally{await q.close()}let H;try{H=await X.beforeRename()}catch{throw new b("publication-refused")}try{await G.assertOwned()}catch{throw new b("publication-refused")}if(H==="skip")return{status:"skipped"};try{if(await X.beforePublish?.(),X.beforePublish)await G.assertOwned()}catch{throw new b("publication-refused")}await vU(V,$),B=!1;try{await X.afterRename?.()}catch{throw new b("publication-refused")}return{status:"published",state:K}}finally{if(B)await fU(V,{force:!0})}})}catch(G){if(G instanceof b)throw G;throw new b("runtime-io")}}function a0($){return P6($)&&V$($,[],["accessFingerprint","expires","lastRefreshedAt"])&&z6($,"accessFingerprint",(Z)=>Z===void 0||y8(Z))&&z6($,"expires",(Z)=>Z===void 0||A6(Z))&&z6($,"lastRefreshedAt",A6)}function l9($,Z){return["accessFingerprint","expires","lastRefreshedAt"].every((J)=>Object.hasOwn($,J)===Object.hasOwn(Z,J)&&$[J]===Z[J])}function hQ($,Z){let J=()=>new b("publication-refused"),X=structuredClone(Z),Y=X.context;if(!["persisted","validation-observed"].includes(X.status)||X.bootstrap!=="resolved"||!("identity"in X)||!EQ(X.identity)||!x6(X.binding)||X.binding.storageId!==$.storageId||X.binding.identity!==void 0&&X.binding.identity!==X.identity||!a$(X.credentialFingerprint)||!a0(X.credentialVersion)||!Y||!P6(Y.subject)||!x6(Y.subject.binding)||!Q$(Y.subject.binding,X.binding)||Y.subject.credentialFingerprint!==X.credentialFingerprint||!a0(Y.subject.version)||!l9(Y.subject.version,X.credentialVersion)||![Y.refreshErrorClearedAt,Y.quotaErrorClearedAt,Y.quotaErrorGeneration].every((Q)=>Q===null||A6(Q)))throw J();let G={...X.binding,identity:X.identity},z;if(X.status==="persisted"){if(z={binding:G,credentialFingerprint:X.successorFingerprint,version:X.successorVersion},!$8(z)||!P6(X.committed)||!V$(X.committed,["credentialFingerprint","version"])||X.committed.credentialFingerprint!==z.credentialFingerprint||!a0(X.committed.version)||!l9(X.committed.version,{...z.version}))throw J()}else if(X.status==="validation-observed"){if(X.binding.identity!==X.identity)throw J();z={binding:G,credentialFingerprint:X.credentialFingerprint,version:X.credentialVersion}}if(!$8(z))throw J();return{context:Y,proof:z}}function Qx($,Z){let J=hQ($,Z),X=J.context.runtimeBinding;if(!x6(X)||X.identity!==void 0||!Q$(X,{...J.proof.binding,identity:void 0}))throw new b("publication-refused");return{...J,predecessor:X}}function K2($,Z){return($?.refreshErrorClearedAt??null)===Z.refreshErrorClearedAt&&($?.quotaErrorClearedAt??null)===Z.quotaErrorClearedAt&&($?.quotaErrorGeneration??null)===Z.quotaErrorGeneration}function Kx($,Z){let{predecessor:J,context:X,proof:Y}=Z;if($?.binding.kind!=="local"||!Q$($.binding,J)||!K2($,X))throw new b("publication-refused");let G=(K,W)=>{let V=K===void 0?W?.checkedAt:Math.max(K,W?.checkedAt??K);if(V!==void 0&&!A6(V))throw new b("publication-refused");return V},z=G($.refreshErrorClearedAt,$.lastRefreshError),Q=G($.quotaErrorClearedAt,$.lastQuotaRefreshError);return{binding:Y.binding,credentialValidation:Y,...z!==void 0?{refreshErrorClearedAt:z}:{},...Q!==void 0?{quotaErrorClearedAt:Q}:{},...$.quotaErrorGeneration!==void 0?{quotaErrorGeneration:$.quotaErrorGeneration}:{}}}async function Wx($,Z,J={}){try{$={...$};let X=Qx($,Z);return await W2($,X.proof,(Y)=>c0(X.proof,X.proof.binding,Y),(Y)=>Kx(Y,X),X,void 0,J)}catch(X){if(X instanceof b)throw X;throw new b("publication-refused")}}function Vx($,Z){let{context:J,proof:X}=Z;if(!K2($,J))throw new b("publication-refused");if(!$){if(J.runtimeBinding!==null)throw new b("publication-refused");return{binding:X.binding,credentialValidation:X}}if($.binding.kind!=="local"||!x6(J.runtimeBinding)||!Q$($.binding,J.runtimeBinding)||!Q$($.binding,X.binding))throw new b("publication-refused");return{...$,credentialValidation:X}}async function Bx($,Z,J={}){try{$={...$};let X=hQ($,Z),{context:Y,proof:G}=X;if(Y.subject.binding.identity!==G.binding.identity||Y.runtimeBinding!==null&&(!x6(Y.runtimeBinding)||!Q$(Y.runtimeBinding,G.binding)))throw new b("publication-refused");return await W2($,G,(z)=>c0(G,G.binding,z),(z)=>Vx(z,X),void 0,void 0,J)}catch(X){if(X instanceof b)throw X;throw new b("publication-refused")}}function qx($){return a0($)&&y8($.accessFingerprint)&&A6($.expires)&&$.expires>0}function U4($){let Z=new WeakSet,J=(X,Y)=>{if(X===null||X===void 0||["string","number","boolean"].includes(typeof X))return X;if(typeof X!=="object"||yU.isProxy(X)||Y>32||Z.has(X))throw new b("publication-refused");let G=Object.getPrototypeOf(X);if(G!==Object.prototype&&G!==null)throw new b("publication-refused");Z.add(X);try{let z=Object.getOwnPropertyDescriptors(X),Q=Object.create(null);for(let K of Reflect.ownKeys(z)){if(typeof K!=="string")throw new b("publication-refused");let W=z[K];if(!W||!Object.hasOwn(W,"value"))throw new b("publication-refused");Object.defineProperty(Q,K,{value:J(W.value,Y+1),enumerable:!0,writable:!0,configurable:!0})}return Q}finally{Z.delete(X)}};try{return J($,0)}catch{throw new b("publication-refused")}}function mQ($){try{return jx(U4($))}catch{throw new b("publication-refused")}}function jx($){if($.status!=="failed"&&$.status!=="persisted")return{kind:"none",reason:"not-a-failure"};if($.context===void 0)return{kind:"none",reason:"no-context"};if(!P6($.context))throw new b("publication-refused");if($.status==="failed"&&(!P6($.failure)||!V$($.failure,["kind","classification"],["status","retryAfter"])||!J$($.failure.kind)||!["transient","invalid-grant","permanent"].includes($.failure.classification)||$.failure.status!==void 0&&(!A6($.failure.status)||$.failure.status<100||$.failure.status>599)||$.failure.retryAfter!==void 0&&!t$($.failure.retryAfter)||typeof $.persisted!=="boolean"))throw new b("publication-refused");if($.status==="failed"&&$.persisted&&!$.committed)return{kind:"none",reason:"missing-committed"};if($.bootstrap==="resolved"||$.status==="failed"&&($.failure.kind==="caller-hook"||!$.persisted&&!["provider","validation"].includes($.failure.kind)))return{kind:"none",reason:"not-attributable"};let Z=$.context;if(!x6($.binding)||!a$($.credentialFingerprint)||!a0($.credentialVersion)||!P6(Z.subject)||!x6(Z.subject.binding)||!Q$(Z.subject.binding,$.binding)||Z.subject.credentialFingerprint!==$.credentialFingerprint||!a0(Z.subject.version)||!l9(Z.subject.version,$.credentialVersion)||Z.runtimeBinding!==null&&!x6(Z.runtimeBinding)||![Z.refreshErrorClearedAt,Z.quotaErrorClearedAt,Z.quotaErrorGeneration].every((K)=>K===null||A6(K)))throw new b("publication-refused");let J=$.status==="persisted"||$.persisted,X=$.committed;if(J&&(!P6(X)||!V$(X,["credentialFingerprint","version"])||!a$(X.credentialFingerprint)||!qx(X.version)))throw new b("publication-refused");if($.status==="persisted"&&(!a0($.successorVersion)||$.successorFingerprint!==X?.credentialFingerprint||!l9($.successorVersion,{...X?.version})))throw new b("publication-refused");if($.status==="failed"&&!J&&$.committed!==void 0)throw new b("publication-refused");let Y=J?X:{credentialFingerprint:$.credentialFingerprint,version:$.credentialVersion};if(!Y)throw new b("publication-refused");let G={binding:{...$.binding},credentialFingerprint:Y.credentialFingerprint,version:{...Y.version}},z=J?"committed":"captured";if(J&&$.bootstrap==="unsupported-credential")return{kind:"unsupported-successor",target:"committed",subject:G};if(J&&G.binding.identity!==void 0||$.status==="failed"&&$.failure.kind==="validation"){if(!$8(G))throw new b("publication-refused");return{kind:"validation-retry",target:z,subject:G}}if(J)return{kind:"refresh-error",target:z,subject:G,permanent:!1,message:"Local account-check recovery required"};if($.status!=="failed")throw new b("publication-refused");let Q=$.failure.status;if(Q!==void 0&&(!Number.isInteger(Q)||Q<100||Q>599))throw new b("publication-refused");return{kind:"refresh-error",target:z,subject:G,permanent:$.failure.classification==="invalid-grant"&&Q===400,message:"Local refresh failed",...Q!==void 0?{status:Q}:{}}}function Hx($,Z){if(Z?.type!=="oauth"||!J$(Z.refresh))return!1;let J=$.version;return $.credentialFingerprint===I6({type:"oauth",refresh:Z.refresh})&&(J.accessFingerprint===void 0?!Object.hasOwn(Z,"access"):J$(Z.access)&&J.accessFingerprint===S$(Z.access))&&(J.expires===void 0?!Object.hasOwn(Z,"expires"):J.expires===Z.expires)&&Object.hasOwn(J,"lastRefreshedAt")===Object.hasOwn(Z,"lastRefreshedAt")&&J.lastRefreshedAt===Z.lastRefreshedAt}async function Lx($,Z,J,X={}){let Y,G=(z)=>{throw Y=z,new b("publication-refused")};try{$=U4($);let z=U4(Z);J=U4(J);let Q=mQ(z);if(Q.kind==="none")return{status:"skipped",reason:Q.reason};let{subject:K}=Q,W=z.context;if(!W||K.binding.storageId!==$.storageId||!A6(J.checkedAt)||J.nextRetryAt!==void 0&&(!A6(J.nextRetryAt)||J.nextRetryAt<J.checkedAt)||J.retryCount!==void 0&&!A6(J.retryCount)||(Q.kind==="validation-retry"||Q.kind==="refresh-error"&&!Q.permanent)&&J.nextRetryAt===void 0)throw new b("publication-refused");let V=await W2($,K,(B)=>Hx(K,B),(B)=>{if(!B&&W.runtimeBinding!==null||B&&(B.binding.kind!=="local"||!x6(W.runtimeBinding)||!Q$(B.binding,W.runtimeBinding)||!Q$(B.binding,K.binding)))G("entry-binding");if(!K2(B,W))G("reset-context");if(B?.refreshErrorClearedAt!==void 0&&J.checkedAt<=B.refreshErrorClearedAt)throw new b("publication-refused");let q=B?{...B}:{binding:K.binding};if(Q.kind==="unsupported-successor"){let H=!1;if(q.lastRefreshError&&q.lastRefreshError.checkedAt<=J.checkedAt)delete q.lastRefreshError,H=!0;if(q.validationRetry&&q.validationRetry.checkedAt<=J.checkedAt)delete q.validationRetry,H=!0;if(H)q.refreshErrorClearedAt=Math.max(q.refreshErrorClearedAt??0,J.checkedAt)}else if(Q.kind==="validation-retry"){let H=J.nextRetryAt;if(H===void 0)throw new b("publication-refused");let j=(x)=>Q$(x.binding,K.binding)&&x.credentialFingerprint===K.credentialFingerprint&&l9({...x.version},{...K.version});if(B?.credentialValidation&&j(B.credentialValidation))G("already-proven");if(B?.validationRetry&&j(B.validationRetry.subject)&&(B.validationRetry.checkedAt>J.checkedAt||B.validationRetry.checkedAt===J.checkedAt&&B.validationRetry.nextRetryAt!==J.nextRetryAt))G("older-than-stored");q.validationRetry={subject:Q.subject,checkedAt:J.checkedAt,nextRetryAt:H}}else{if(B?.lastRefreshError&&J.checkedAt<B.lastRefreshError.checkedAt)G("older-than-stored");q.lastRefreshError={message:Q.message,credentialFingerprint:K.credentialFingerprint,permanent:Q.permanent,checkedAt:J.checkedAt,...K.binding.identity!==void 0?{accountIdentity:K.binding.identity}:{},...Q.status!==void 0?{status:Q.status}:{},...J.nextRetryAt!==void 0?{nextRetryAt:J.nextRetryAt}:{},...J.retryCount!==void 0?{retryCount:J.retryCount}:{}}}return q},void 0,G,X);return{status:"published",attribution:Q,state:V}}catch(z){if(Y&&z instanceof b&&z.code==="publication-refused")return{status:"superseded",reason:Y};if(z instanceof b)throw z;throw new b("publication-refused")}}async function W2($,Z,J,X,Y,G,z={}){try{let Q=x0({paths:$,quota:d$}),[K,W]=B1($),V=async()=>{let B=await Q.read();if(B.status!=="ready")throw new b("publication-refused");let q=B.rows.find((H)=>H.id===Z.binding.rowId);if(!q||!U$(Z.binding,$,q))throw G?.("row-binding"),new b("publication-refused");if(!J(q.credential))throw G?.("row-credential"),new b("publication-refused")};return await d6(K.path,{...y6,name:K.name},async(B)=>d6(W.path,{...y6,name:W.name},async(q)=>{return await V(),gQ($.runtime,$.storageId,(H)=>{let j=Z.binding.rowId;return H.accounts[j]=X(H.accounts[j]),H},{beforeRename:async()=>{await V(),await B.assertOwned(),await q.assertOwned()},beforePublish:z.beforePublish},Y)}))}catch(Q){if(Q instanceof b)throw Q;throw new b("publication-refused")}}function aT($){let Z=$.state;if(Z===void 0||Z==="")return"";if(Z==="unsupported-access")return"unsupported credential: the saved access token is not a Claude OAuth token; sign in to this account again";return Z}function yJ($){let Z=new Set;function J(X){if(X===null||typeof X==="string"||typeof X==="boolean"||X===void 0)return X;if(typeof X==="number"&&Number.isFinite(X))return X;if(!X||typeof X!=="object"||e5.isProxy(X)||Z.has(X))throw new b("publication-refused");Z.add(X);try{if(Array.isArray(X)){if(Reflect.ownKeys(X).some((G)=>typeof G!=="string"||G!=="length"&&!/^(0|[1-9][0-9]*)$/.test(G)))throw new b("publication-refused");return Array.from({length:X.length},(G,z)=>{let Q=Object.getOwnPropertyDescriptor(X,String(z));if(!Q||!("value"in Q))throw new b("publication-refused");return J(Q.value)})}if(Object.getPrototypeOf(X)!==Object.prototype&&Object.getPrototypeOf(X)!==null)throw new b("publication-refused");let Y={};for(let G of Reflect.ownKeys(X)){let z=Object.getOwnPropertyDescriptor(X,G);if(typeof G!=="string"||!z||!("value"in z)||G==="__proto__")throw new b("publication-refused");Y[G]=J(z.value)}return Y}finally{Z.delete(X)}}return J($)}function uQ($){let Z=yJ($);if(!Z||Object.keys(Z).some((J)=>!["quota","profile","lastUsed","lastQuotaRefreshError","quotaErrorClearedAt","quotaErrorGeneration","prime","authLineageId"].includes(J)))throw new b("publication-refused");return Z}function pQ($,Z){let{quota:J,...X}=Z,Y={...$,...X};if(Z.lastUsed!==void 0){if(!Number.isFinite(Z.lastUsed)||Z.lastUsed<0)throw new b("publication-refused");Y.lastUsed=Math.max($.lastUsed??0,Z.lastUsed)}if(J){let G=s0(J);Y.quota=d$.merge($.quota,G),Y.quotaCheckedAt=J.checkedAt}if(Z.quotaErrorClearedAt!==void 0)Y.quotaErrorClearedAt=Math.max($.quotaErrorClearedAt??0,Z.quotaErrorClearedAt);if(Z.quotaErrorGeneration!==void 0)Y.quotaErrorGeneration=Math.max($.quotaErrorGeneration??0,Z.quotaErrorGeneration);if($.lastQuotaRefreshError&&Z.lastQuotaRefreshError&&Z.lastQuotaRefreshError.checkedAt<$.lastQuotaRefreshError.checkedAt)Y.lastQuotaRefreshError=$.lastQuotaRefreshError;if(Y.lastQuotaRefreshError&&Y.lastQuotaRefreshError.checkedAt<=(Y.quotaErrorClearedAt??-1))delete Y.lastQuotaRefreshError;return Y}function cQ($,Z,J,X){let Y=Error("OAuth quota check failed");if($&&typeof $==="object"&&!e5.isProxy($)){for(let W of["status","retryAfter"]){let V=Object.getOwnPropertyDescriptor($,W)?.value;if(typeof V==="number"&&Number.isFinite(V))Object.assign(Y,{[W]:V})}let Q=Object.getOwnPropertyDescriptor($,"code")?.value,K=Object.getOwnPropertyDescriptor($,"message")?.value;if(g$({code:typeof Q==="string"?Q:"",message:typeof K==="string"?K:""}))Object.assign(Y,{code:"ECONNRESET"})}let G=Object.getOwnPropertyDescriptor(Y,"status")?.value;if(G===401||G===403)return;return{...e7({error:Y,accountIdentity:Z,now:J,previous:X}),...typeof G==="number"&&Number.isFinite(G)?{status:G}:{}}}class lQ extends Error{status;retryAfter;code;constructor($,Z,J){super(`OAuth metadata read failed${$!==void 0?`: ${$}`:""}`);this.status=$,this.retryAfter=Z,this.code=J,this.name="NativeAccountReadError"}}function dQ($,Z){let J={};if($&&typeof $==="object"&&!e5.isProxy($))for(let z of["status","retryAfter","code","message"])J[z]=Object.getOwnPropertyDescriptor($,z)?.value;let X=typeof J.status==="number"&&Number.isFinite(J.status)?J.status:void 0,Y=J.retryAfter,G=X===void 0&&g$({code:typeof J.code==="string"?J.code:"",message:typeof J.message==="string"?J.message:""})?"ECONNRESET":void 0;return new lQ(Z??X,typeof Y==="number"&&Number.isFinite(Y)?Y:void 0,G)}var o1="oauth:anthropic";function $Z($){let J=$.claustrum?.primaryAccount;if(typeof $.mainAccountId!=="string"||!$.mainAccountId||typeof J?.credentialId!=="string"||!J.credentialId||typeof J.accountId!=="string"||!J.accountId)return;return{routeId:$.mainAccountId,credentialId:J.credentialId,accountIdentity:J.accountId}}function hJ($,Z){if(!Z)return;return $?.rows.find((J)=>J.routeId===Z.routeId&&J.accountIdentity===Z.accountIdentity&&(J.credentialId===Z.credentialId||J.aliases?.includes(Z.credentialId)))}var Nx={routing:["mode"],refresh:["enabled","intervalMinutes","refreshBeforeExpiryMinutes"],quota:["enabled","checkIntervalMinutes","refreshEveryNRequests","minimumRemaining","failClosedOnUnknownQuota","showToasts"],quotaHeaderFeed:["enabled"],claudeCache:["enabled","mode"],dump:["enabled"],logging:["level"],claudeFast:["enabled"],thinkingBinding:["prefixMismatchBehavior"],costZeroing:["enabled"],cacheKeep:["enabled","always","startHour","endHour","subagents"],prime:["enabled"],relay:["enabled","url","fallbackToDirect","transport"],claustrum:["mode","disabledAccountIdentities"],killswitch:["enabled","main","accounts"]};function iQ($){let Z={};if(typeof $.mainAccountId==="string")Z.mainAccountId=$.mainAccountId;if(Array.isArray($.nativeAccountOrder))Z.nativeAccountOrder=$.nativeAccountOrder.filter((X)=>typeof X==="string");if(Array.isArray($.fallbackOn))Z.fallbackOn=$.fallbackOn.filter((X)=>Number.isInteger(X));for(let[X,Y]of Object.entries(Nx)){let G=$[X];if(!G||typeof G!=="object"||Array.isArray(G))continue;let z={};for(let Q of Y){let K=Object.getOwnPropertyDescriptor(G,Q)?.value;if(K!==void 0)z[Q]=structuredClone(K)}Z[X]=z}let J=$.claustrum;if(J?.primaryAccount){let X=Z.claustrum;X.primaryAccount={credentialId:J.primaryAccount.credentialId,accountId:J.primaryAccount.accountId,state:J.primaryAccount.state}}return Z}function tY($,Z){let J=$?.binding;return J?.kind==="local"&&J.storageId===Z.storageId&&J.rowId===Z.rowId&&J.identity===Z.identity&&J.credentialEpoch===Z.credentialEpoch}function aY($,Z){let J=$.runtime?.accounts[Z.routeId],X=J?.binding;return X?.kind==="custody"&&X.storageId===$.paths.storageId&&X.routeId===Z.routeId&&X.accountIdentity===Z.accountIdentity&&(X.credentialId===Z.credentialId||Z.aliases?.includes(X.credentialId))?J:void 0}function nY($){if(!$)return;return{message:"OAuth operation failed",checkedAt:$.checkedAt,nextRetryAt:$.nextRetryAt,retryCount:$.retryCount,accountIdentity:$.accountIdentity,status:$.status,permanent:$.permanent}}function oY($){return{lastUsed:$?.lastUsed,lastRefreshedAt:$?.lastRefreshedAt,lastRefreshError:nY($?.lastRefreshError),lastQuotaRefreshError:nY($?.lastQuotaRefreshError),quotaErrorClearedAt:$?.quotaErrorClearedAt,quotaErrorGeneration:$?.quotaErrorGeneration,refreshErrorClearedAt:$?.refreshErrorClearedAt,profile:$?.profile&&{tier:$.profile.tier,orgType:$.profile.orgType,checkedAt:$.profile.checkedAt,accountIdentity:$.profile.accountIdentity,providerAccountUuid:$.profile.providerAccountUuid},prime:$?.prime&&{...$.prime}}}function sQ($,Z,J){let X=J?.binding;if(X?.kind==="local"&&X.credentialEpoch!==Z.credentialEpoch||Z.type!=="oauth"||Z.torn!==!0||Z.enabled!==!0||Z.disabledReason!==void 0||Z.credential===void 0||Z.staged!==void 0||Z.invalid!==void 0||Z.unbound===!0||Z.stamp!=="bound"||Z.credentialEpoch===void 0)return!1;let{torn:Y,...G}=Z;return U$({kind:"local",storageId:$.storageId,rowId:Z.id,credentialEpoch:Z.credentialEpoch,...Z.identity!==void 0?{identity:Z.identity}:{}},$,G)}function Ux($,Z,J,X,Y){let G=iQ(J).mainAccountId,z=Z.find((Q)=>(Q.id===G?"main":Q.id)===X);return z!==void 0&&sQ($,z,Y?.accounts[z.id])}function xx($){let Z=iQ($.settings),J=Z.claustrum?.mode==="claustrum"?"claustrum":"local",X=[];for(let V of $.rows){if(J==="claustrum")continue;let B=V.credentialEpoch!==void 0?{kind:"local",storageId:$.paths.storageId,rowId:V.id,credentialEpoch:V.credentialEpoch,...V.identity!==void 0?{identity:V.identity}:{}}:void 0,q=B&&U$(B,$.paths,V)?B:void 0,H=$.runtime?.accounts[V.id],j=q&&tY(H,q)?H:void 0,x=V.id===Z.mainAccountId?"main":V.id,N=V.type==="oauth"&&V.quota!==void 0?N0(V.quota):void 0,U=V.identity!==void 0&&N?.accountIdentity===V.identity?N:void 0,D=oY(j);if(j?.lastRefreshError?.credentialFingerprint&&(!V.credential||j.lastRefreshError.credentialFingerprint!==I6(V.credential)))delete D.lastRefreshError;X.push({id:x,type:V.type,source:"local",...V.credential?.type==="oauth"&&V.credential.access&&!V.credential.access.startsWith("sk-ant-oat")?{state:"unsupported-access"}:{},enabled:V.enabled&&(V.candidate||sQ($.paths,V,$.runtime?.accounts[V.id])),label:V.label,addedAt:V.addedAt,accountIdentity:V.identity,binding:q,...D,...U?{quota:U}:{},...V.credential?.type==="api"?{baseURL:V.credential.baseURL,authHeader:V.credential.authHeader}:{}})}if(J==="claustrum"){let V=hJ($.roster,$Z(Z));for(let B of $.roster?.rows??[]){if(B.credentialType!=="oauth")continue;let q=aY($,B);X.push({id:B===V?"main":B.routeId,type:"oauth",source:"vault",enabled:B.enabled&&B.state==="active",label:B.label,addedAt:B.addedAt,accountIdentity:B.accountIdentity,credentialId:B.credentialId,state:B.state,...oY(q),...q?.quota?{quota:N0(q.quota)}:{}})}}if(Array.isArray(Z.nativeAccountOrder)){let V=Z.nativeAccountOrder;X.sort((B,q)=>{let H=V.indexOf(B.id),j=V.indexOf(q.id);return(H<0?V.length:H)-(j<0?V.length:j)})}let Y=X.filter((V)=>V.id!=="main").map((V)=>V.type==="oauth"?{id:V.id,type:"oauth",refresh:"",label:V.label,enabled:V.enabled,addedAt:V.addedAt,anthropicAccountUuid:V.accountIdentity,claustrumScopedCredentialId:V.credentialId,claustrumScopedState:V.state,authLineageId:V.binding?JSON.stringify(V.binding):V.credentialId?JSON.stringify([V.credentialId,V.accountIdentity]):void 0,quota:V.quota,profile:V.profile,prime:V.prime,lastUsed:V.lastUsed,lastRefreshedAt:V.lastRefreshedAt,lastRefreshError:V.lastRefreshError,lastQuotaRefreshError:V.lastQuotaRefreshError}:{id:V.id,type:"api",label:V.label,enabled:V.enabled,addedAt:V.addedAt,baseURL:V.baseURL??"",authHeader:V.authHeader,lastUsed:V.lastUsed}),G={version:1,...Z,accounts:Y},z=X.find((V)=>V.id==="main"),Q=hJ($.roster,$Z(Z)),K=z?.source==="local"&&z.binding?$.runtime?.accounts[z.binding.rowId]:Q?aY($,Q):void 0,W=z?.source==="local"&&z.binding&&!tY(K,z.binding)?void 0:K;if(z)G.mainAccountId=z.accountIdentity??z.binding?.rowId,G.main={type:"opencode",provider:"anthropic",profile:z.profile},G.quota={...G.quota,mainQuota:z.quota,mainQuotaCheckedAt:W?.quotaCheckedAt??z.quota?.checkedAt,mainQuotaToken:z.accountIdentity,mainLastQuotaApiError:z.lastQuotaRefreshError,mainQuotaErrorClearedAt:W?.quotaErrorClearedAt,mainQuotaErrorGeneration:W?.quotaErrorGeneration},G.refresh={...G.refresh,mainLastRefreshError:z.lastRefreshError,mainRefreshErrorClearedAt:W?.refreshErrorClearedAt},G.prime={...G.prime,main:z.prime,mainAuthLineageId:W?.authLineageId};return structuredClone({mode:J,settings:Z,accounts:X,policyStorage:G})}function rY($,Z){let J=$[Z];return J&&typeof J==="object"&&!Array.isArray(J)?J:{}}var Dx=["five_hour","seven_day","5h","1w","scoped"];function tQ($){if(!$||typeof $!=="object"||Array.isArray($))return;let Z=$,J={};for(let X of Dx){let Y=Z[X];if(typeof Y==="number"&&Number.isFinite(Y))J[X]=Y}return J}function Ox($){if(!$||typeof $!=="object"||Array.isArray($))return;let Z={};for(let[J,X]of Object.entries($)){let Y=tQ(X);if(Y)Z[J]=Y}return Z}function aQ($){let Z=rY($,"killswitch"),J=rY($,"logging").level;return{killswitchEnabled:Z.enabled===!0,killswitchMain:tQ(Z.main),killswitchAccounts:Ox(Z.accounts),logLevel:typeof J==="string"?J:void 0}}function Mx($,Z){let J=aQ(Z);if(J.killswitchEnabled!==$.killswitchEnabled)t.info("commands","killswitch changed",{enabled:J.killswitchEnabled});if(JSON.stringify(J.killswitchMain)!==JSON.stringify($.killswitchMain)||JSON.stringify(J.killswitchAccounts)!==JSON.stringify($.killswitchAccounts))t.info("commands","killswitch thresholds changed",{thresholds:J.killswitchMain??J.killswitchAccounts});let X=XJ(J.logLevel);if(X&&X!==XJ($.logLevel))nQ(X)}function nQ($){if(Tq()===$)return!1;return t.info("commands","log level changed",{level:$}),Rq($),!0}function r1($,Z){t.info("commands",$,{id:Z.id,label:Z.label,...$==="account enabled"||$==="account disabled"?{enabled:$==="account enabled"}:{}})}function Ix($){t.info("commands","account added",{id:$.id,label:$.label,type:$.type==="api"?"apikey":"oauth"})}var Fx=/^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i,Cx=/\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g,$3="***REDACTED***",Sx=8;function kx($){return $ instanceof Error||Object.prototype.toString.call($)==="[object Error]"}function S9($={}){let Z=[Cx,...$.extraValuePatterns??[]].map((G)=>new RegExp(G.source,G.flags.includes("g")?G.flags:`${G.flags}g`));function J(G){let z=G.toLowerCase().replace(/[-_]/g,"");return Fx.test(G)||z.includes("apikey")||z.endsWith("secret")||z.endsWith("password")||z.endsWith("token")&&!z.endsWith("tokens")||!!$.extraSecretKeys?.(z)}function X(G){let z=G,Q=[["name",G.name],["message",G.message],["stack",G.stack]];for(let W of["code","status","cause"])if(z[W]!==void 0)Q.push([W,z[W]]);let K=new Set(Q.map(([W])=>W));for(let W of Object.entries(G))if(!K.has(W[0]))Q.push(W);return Q}function Y(G,z,Q,K=0){if(typeof G==="string")return Z.reduce((W,V)=>W.replace(V,$3),G);if(!G||typeof G!=="object")return G;if(Q.has(G))return"[Circular]";Q.add(G);try{if(Array.isArray(G))return G.map((B)=>Y(B,z,Q,K));let W=kx(G);if(W&&K>=Sx)return"[Truncated]";let V=W?K+1:K;return Object.fromEntries((W?X(G):Object.entries(G)).map(([B,q])=>[B,z&&J(B)?$3:Y(q,z,Q,V)]))}finally{Q.delete(G)}}return{redact:(G)=>Y(G,!0,new WeakSet),redactStrings:(G)=>Y(G,!1,new WeakSet)}}var oQ=S9(),ZF=oQ.redact,JF=oQ.redactStrings,e1={error:0,warn:1,info:2,debug:3,trace:4},rQ=5242880,eQ=3;function uJ($){try{Px($,384)}catch{}}function vx($){try{if(!(mJ($)&&Ax($).size>=rQ))return;for(let J=eQ-1;J>=1;J--)if(mJ(`${$}.${J}`)){let X=`${$}.${J+1}`;eY(`${$}.${J}`,X),uJ(X)}let Z=`${$}.1`;eY($,Z),uJ(Z)}catch{}}async function u$($){let{file:Z,handle:J}=$;if($.file=void 0,$.handle=void 0,Z&&J)await O$(Z,"log-close",()=>J.close())}async function Z3($,Z){await i$(Rx(Z));try{await $$(Z,"file",!0)}catch(J){if(J.code!=="ENOENT")throw J;try{await d4(Z,"")}catch(X){if(X.code!=="EEXIST")throw X;await $$(Z,"file",!0)}}return $.handle=await O$(Z,"log-open",()=>wx(Z,"a")),$.file=Z,$.handle}async function fx($,Z,J){Z=Tx(Z);try{if($.file!==Z)await u$($);let X=$.handle??await Z3($,Z);if((await O$(Z,"log-stat",()=>X.stat())).size>=rQ){await u$($);for(let G=eQ-1;G>=0;G--){let z=G===0?Z:`${Z}.${G}`,Q=`${Z}.${G+1}`;try{await $$(z,"file",!0)}catch(K){if(K.code==="ENOENT")continue;throw K}try{await $$(Q,"file",!0)}catch(K){if(K.code!=="ENOENT")throw K}await iz(z,Q),await $$(Q,"file")}X=await Z3($,Z)}await O$(Z,"log-append",()=>X.appendFile(J,"utf8"))}catch(X){throw await u$($).catch(()=>{}),X}}function Ex($){try{return` ${JSON.stringify($)}`}catch{return" [unserializable]"}}function bx($){let Z,J,X,Y=S9(),G,z=[],Q,K=Promise.resolve(),W,V={};function B(L){let w=K.then(L);return K=w.catch((S)=>{W=S}),w}function q(L){if(o&&L.file!==Z)B(()=>u$(V)).catch(()=>{});Z=L.file,J=L.level,Y=S9(L),G=L.captureSink}function H(L){if(L===void 0||L in e1)X=L}function j(){if(Z===void 0)return;return(typeof Z==="function"?Z():Z)||void 0}function x(){if(X)return X;let L=typeof J==="function"?J():J;if(L&&L in e1)return L;return"info"}function N(L=!0){if(Q)clearTimeout(Q),Q=void 0;if(!z.length){if(o)return B(async()=>{if(L)await u$(V);if(W)throw W});return}let w;try{w=j()}catch{if(z=[],o&&L)return B(()=>u$(V));return}let S=z.join("");if(z=[],!w){if(o&&L)return B(()=>u$(V));return}if(o)return B(async()=>{try{await fx(V,w,S)}finally{if(L)await u$(V)}});try{if(vx(w),mJ(w))uJ(w);_x(w,S,{encoding:"utf8",mode:384})}catch{}}function U(){if(!Q)Q=setTimeout(()=>{Q=void 0;let L=N(!1);if(L instanceof Promise)L.catch(()=>{})},500)}function D(L,w,S,f){if(Z===void 0&&G===void 0)return;try{if(e1[w]>e1[x()])return;let d=Y.redactStrings(S),s;try{s=Y.redact(f)}catch{s="[unserializable]"}let _=`[${new Date().toISOString()}] ${w.toUpperCase()} [${L}] ${d}`+(f===void 0?"":Ex(s))+`
+`;try{G?.({channel:L,level:w,message:d,data:s})}catch{}if(Z===void 0)return;if(z.push(_),z.length>=50){let O=N(!1);if(O instanceof Promise)O.catch(()=>{})}else U()}catch{}}function A(L){return{error:(w,S)=>D(L,"error",w,S),warn:(w,S)=>D(L,"warn",w,S),info:(w,S)=>D(L,"info",w,S),debug:(w,S)=>D(L,"debug",w,S),trace:(w,S)=>D(L,"trace",w,S)}}function I(){if(o)B(()=>u$(V)).catch(()=>{});if(W=void 0,z=[],Q)clearTimeout(Q),Q=void 0;Z=void 0,J=void 0,X=void 0,Y=S9(),G=void 0}if($)q($);return{configure:q,createLogger:A,setLogLevel:H,flushLogs:N,reset:I}}var gx=bx();function $K($){return gx.createLogger($)}function J3($){let Z=new AbortController,J=[],X=!1,Y=()=>{if(X)return;X=!0;for(let{source:Q,listener:K}of J)Q.removeEventListener("abort",K);J.length=0},G=(Q)=>{if(X||Z.signal.aborted)return;Z.abort(Q),Y()},z=$.find((Q)=>Q.aborted);if(z)return Z.abort(z.reason),{signal:Z.signal,dispose:Y};for(let Q of $){if(Z.signal.aborted)break;let K=()=>G(Q.reason);if(J.push({source:Q,listener:K}),Q.addEventListener("abort",K,{once:!0}),Q.aborted)G(Q.reason)}return{signal:Z.signal,dispose:Y}}class r extends Error{kind;constructor($,Z){super(Z);this.name="ClaustrumConsumerError",this.kind=$}}var sx=1,x4=16384,B2=30000,q2=/^[0-9a-f]{64}$/,tx=new Set(["invalid_params","pending_exists","not_found","already_consumed","superseded","stale_generation"]),ax=new Set(["pending_queue_full"]);function Y3($){if(!($ instanceof s6))return;if(tx.has($.code))return{code:$.code,disposition:"terminal"};if(ax.has($.code))return{code:$.code,disposition:"retry"};return{code:$.code,disposition:$.action==="retry"?"retry":"terminal"}}function XK($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function $4($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0}function YK($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=1}function z9(){return new r("invalid-state","invalid Claustrum enrollment state")}function q1($){if(!XK($)||$.version!==sx||typeof $.proposedName!=="string"||$.proposedName.length===0)throw z9();if($.phase==="pending"){if(!q2.test(String($.requestSecret??""))||$.requestId!==void 0&&(typeof $.requestId!=="string"||$.requestId.length===0)||!$4($.createdAt)||!$4($.updatedAt))throw z9();return{version:1,phase:"pending",proposedName:$.proposedName,requestSecret:$.requestSecret,...$.requestId!==void 0&&{requestId:$.requestId},createdAt:$.createdAt,updatedAt:$.updatedAt}}if($.phase==="approved"){if($.approvedName!==void 0&&(typeof $.approvedName!=="string"||$.approvedName.length===0)||!YK($.tokenGeneration)||!$4($.updatedAt))throw z9();return{version:1,phase:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration,updatedAt:$.updatedAt}}if($.phase==="denied"||$.phase==="blocked"){if($.errorCode!==void 0&&typeof $.errorCode!=="string"||!$4($.updatedAt))throw z9();return{version:1,phase:$.phase,proposedName:$.proposedName,...$.errorCode!==void 0&&{errorCode:$.errorCode},updatedAt:$.updatedAt}}throw z9()}function j2($){if(!XK($)||!q2.test(String($.token??""))||!YK($.token_generation))throw new r("invalid-token","invalid Claustrum enrollment token file");return{token:$.token,token_generation:$.token_generation}}function nx($){if(!$.isFile())throw new r("unsafe-file","Claustrum enrollment file must be a regular file");if(($.mode&63)!==0)throw new r("unsafe-file","Claustrum enrollment file must be owner-only");let Z=process.geteuid?.();if(Z!==void 0&&$.uid!==Z)throw new r("unsafe-file","Claustrum enrollment file must be owned by the current user")}function G3($){try{return JSON.parse($)}catch{throw new r("invalid-state","Claustrum enrollment file is not valid JSON")}}async function n$($){if(o)try{await i$(D0($));let J=await V0($,!0);if(Buffer.byteLength(J)>x4)throw new r("unsafe-file","Claustrum enrollment file is too large");return G3(J)}catch(J){if(J.code==="ENOENT")return;throw J}let Z;try{Z=await ZK($,X3.O_RDONLY|X3.O_NOFOLLOW)}catch(J){if(J.code==="ENOENT")return;throw new r("unsafe-file","Claustrum enrollment file could not be opened safely")}try{nx(await Z.stat());let J=Buffer.alloc(x4+1),{bytesRead:X}=await Z.read(J,0,J.byteLength,0);if(X>x4)throw new r("unsafe-file","Claustrum enrollment file is too large");return G3(J.subarray(0,X).toString("utf8"))}finally{await Z.close()}}function z3($,Z){let J=[];for(let X of $.split(`
+`)){if(X.trim()===""||X.startsWith("#"))continue;let Y=X.split(":");if(Y.length!==Z||!/^[^\s:,]+$/.test(Y[0]??"")||!/^\d+$/.test(Y[2]??"")||!Number.isSafeInteger(Number(Y[2]))||Z===7&&(!/^\d+$/.test(Y[3]??"")||!Number.isSafeInteger(Number(Y[3])))||Z===4&&Y[3]!==""&&!/^[^\s:,]+(?:,[^\s:,]+)*$/.test(Y[3]??""))return;J.push(Y)}return J}async function ox($,Z,J){try{let[X,Y]=await Promise.all([pJ(J.passwdPath??"/etc/passwd","utf8"),pJ(J.groupPath??"/etc/group","utf8")]),G=z3(X,7),z=z3(Y,4);if(!G||!z)return!1;let Q=G.filter((B)=>Number(B[2])===$),K=z.filter((B)=>Number(B[2])===Z);if(Q.length!==1||K.length!==1)return!1;let W=Q[0]?.[0],V=K[0]?.[3]??"";return(V===""||V.split(",").every((B)=>B===W))&&!G.some((B)=>Number(B[2])!==$&&Number(B[3])===Z)}catch{return!1}}function GK($){if(!$.passwdPath&&!$.groupPath)return;return{fs:{readFile:(Z)=>pJ(Z==="/etc/passwd"?$.passwdPath??Z:Z==="/etc/group"?$.groupPath??Z:Z)}}}async function zK($,Z={}){if(!o){let J=process.geteuid?.();if(J===void 0)return;let X=process.getegid?.(),Y;try{Y=await cx($)}catch{return}let G;for(;;){let z=await JK(Y).catch(()=>{return});if(z&&(z.mode&18)!==0&&(z.mode&512)===0){if(G===void 0)G=X!==void 0&&await ox(J,X,Z);if((z.mode&2)!==0||z.uid!==J||z.gid!==X||!G)throw new r("unsafe-file",`Claustrum enrollment path has a writable ancestor: ${Y}. Another user could replace it. Run: chmod g-w,o-w ${Y}`)}let Q=D0(Y);if(Q===Y)return;Y=Q}}try{await _0($,GK(Z))}catch(J){if(!(J instanceof g6))throw J;throw new r("unsafe-file",`Claustrum enrollment parent refused: ${J.path} (${J.reason??J.code}). Use a folder that other users cannot write or replace.`)}}async function d9($,Z={}){if(o){await i$($,!1,GK(Z));return}await px($,{recursive:!0,mode:448});let J=await JK($),X=process.geteuid?.();if(X!==void 0&&J.uid!==X)throw new r("unsafe-file","Claustrum enrollment directory must be owned by the current user");if((J.mode&63)!==0)await ux($,448)}async function k0($,Z,J={}){let X=D0($);await d9(X,J),await zK(X,J);let Y=`${JSON.stringify(Z)}
+`;if(Buffer.byteLength(Y)>x4)throw new r("invalid-state","Claustrum enrollment state is too large");if(o)return u5($,Y);let G=ix(X,`.${dx($)}.${process.pid}.${mx()}.tmp`),z,Q=!1;try{z=await ZK(G,"wx",384),Q=!0,await z.writeFile(Y,"utf8"),await z.chmod(384),await z.sync(),await z.close(),z=void 0,await lx(G,$),Q=!1}finally{if(await z?.close().catch(()=>{}),Q)await V2(G).catch(()=>{})}}async function QK($,Z){let J=await n$($.tokenPath),X=J===void 0?void 0:j2(J),Y=await n$($.statePath),G=Y===void 0?void 0:q1(Y);if(X)return{state:"approved",proposedName:G?.proposedName??Z,...G?.phase==="approved"&&G.approvedName!==void 0&&{approvedName:G.approvedName},tokenGeneration:X.token_generation};if(!G)return{state:"idle"};if(G.phase==="approved")return{state:"blocked",proposedName:G.proposedName,code:"missing_token"};return Q0(G)}async function rx($,Z){let J;try{J=await QK($,Z)}catch(X){if(!(X instanceof r)||X.kind!=="invalid-state"&&X.kind!=="invalid-token")return"unreadable";try{let Y=await n$($.statePath);if(Y===void 0)return"unreadable";let G=q1(Y);return G.phase==="approved"&&G.proposedName===Z?"vault":"unreadable"}catch{return"unreadable"}}if("proposedName"in J&&J.proposedName!==Z)return"unreadable";if(J.state==="approved"||J.state==="blocked"&&J.code==="missing_token")return"vault";return"local"}async function ex($){let Z=await n$($);if(Z===void 0)throw new r("not-enrolled","Claustrum enrollment is not configured");return j2(Z)}function Q0($){if($.phase==="pending")return{state:"pending",proposedName:$.proposedName,...$.requestId!==void 0&&{requestId:$.requestId}};if($.phase==="approved")return{state:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration};if($.phase==="denied")return{state:"denied",proposedName:$.proposedName};return{state:"blocked",proposedName:$.proposedName,code:$.errorCode??"unknown"}}function H2(){return new r("wrong-consumer","Claustrum enrollment state belongs to a different consumer")}class $D{#$;#Z;#z;#J;#Q;#Y;#X;constructor($){this.#X=$.ancestorOptions??{},this.#$=$.client,this.#Z=$.paths,this.#z=$.proposedName,this.#J=$.now??Date.now,this.#Q=$.mintSecret??(()=>hx(32).toString("hex")),this.#Y=$.writeTokenFile??$9}async status(){return QK(this.#Z,this.#z)}async resetTerminal(){return ZD(this.#Z,this.#z)}async#K($,Z){let J={version:1,phase:"blocked",proposedName:$.proposedName,errorCode:Z,updatedAt:this.#J()};return await k0(this.#Z.statePath,J,this.#X),Q0(J)}async reconcile(){await d9(D0(this.#Z.statePath),this.#X);let $=await R0({name:"ceremony",path:this.#Z.statePath,ttlMs:B2,renew:!0});if(!$)return{state:"busy"};try{let Z=await n$(this.#Z.tokenPath),J=Z===void 0?void 0:j2(Z),X=await n$(this.#Z.statePath),Y=X===void 0?void 0:q1(X);if(Y&&Y.proposedName!==this.#z)throw H2();if(J){if(!Y||Y.phase==="pending"){let z={version:1,phase:"approved",proposedName:Y?.proposedName??this.#z,tokenGeneration:J.token_generation,updatedAt:this.#J()};await k0(this.#Z.statePath,z,this.#X),Y=z}return{state:"approved",proposedName:Y.proposedName,...Y.phase==="approved"&&Y.approvedName!==void 0&&{approvedName:Y.approvedName},tokenGeneration:J.token_generation}}if(Y?.phase==="approved"){let z={version:1,phase:"blocked",proposedName:Y.proposedName,errorCode:"missing_token",updatedAt:this.#J()};return await k0(this.#Z.statePath,z,this.#X),Q0(z)}if(Y&&Y.phase!=="pending")return Q0(Y);if(!Y){let z=this.#J();if(Y={version:1,phase:"pending",proposedName:this.#z,requestSecret:this.#Q(),createdAt:z,updatedAt:z},!q2.test(Y.requestSecret))throw new r("invalid-state","invalid minted Claustrum enrollment secret");await k0(this.#Z.statePath,Y,this.#X)}if(!Y.requestId)try{let z=yx("sha256").update(Buffer.from(Y.requestSecret,"hex")).digest("hex"),Q=await this.#$.enrollPropose({name:Y.proposedName,requestSecretHash:z});Y={...Y,requestId:Q.requestId,updatedAt:this.#J()},await k0(this.#Z.statePath,Y,this.#X)}catch(z){let Q=Y3(z);if(!Q)throw z;if(Q.disposition==="retry")return{state:"pending",proposedName:Y.proposedName,retryCode:Q.code};return this.#K(Y,Q.code)}let G=Y.requestId;if(!G)return Q0(Y);try{let z=await this.#$.enrollPoll({requestId:G,requestSecret:Y.requestSecret});if(z.status==="pending")return Q0(Y);if(z.status==="denied"){let K={version:1,phase:"denied",proposedName:Y.proposedName,updatedAt:this.#J()};return await k0(this.#Z.statePath,K,this.#X),Q0(K)}await d9(D0(this.#Z.tokenPath),this.#X),await zK(D0(this.#Z.tokenPath),this.#X),await this.#Y(this.#Z.tokenPath,{token:z.token,token_generation:z.tokenGeneration});let Q={version:1,phase:"approved",proposedName:Y.proposedName,approvedName:z.name,tokenGeneration:z.tokenGeneration,updatedAt:this.#J()};return await k0(this.#Z.statePath,Q,this.#X),Q0(Q)}catch(z){let Q=Y3(z);if(!Q)throw z;if(Q.disposition==="retry")return{state:"pending",proposedName:Y.proposedName,requestId:G,retryCode:Q.code};return this.#K(Y,Q.code)}}finally{await $.release()}}}async function ZD($,Z){await d9(D0($.statePath));let J=await R0({name:"ceremony",path:$.statePath,ttlMs:B2,renew:!0});if(!J)return"busy";try{if(await n$($.tokenPath)!==void 0)return"refused-approved";let X=await n$($.statePath);if(X===void 0)return"idle";let Y=q1(X);if(Y.proposedName!==Z)throw H2();if(Y.phase==="pending")return"refused-pending";return await J.assertOwned(),await V2($.statePath),"reset"}finally{await J.release()}}async function Q3($){try{return await V2($),!0}catch(Z){if(Z.code==="ENOENT")return!1;throw Z}}async function JD($,Z){await d9(D0($.statePath));let J=await R0({name:"ceremony",path:$.statePath,ttlMs:B2,renew:!0});if(!J)return"busy";try{let X;try{let z=await n$($.statePath);X=z===void 0?void 0:q1(z)}catch(z){if(!(z instanceof r)||z.kind!=="invalid-state")throw z}if(X&&X.proposedName!==Z)throw H2();await J.assertOwned();let Y=await Q3($.tokenPath);await J.assertOwned();let G=await Q3($.statePath);return Y||G?"disconnected":"idle"}finally{await J.release()}}var XD="claustrum-tombstone:v1:";function YD($,Z){return Z!==void 0&&Z.credentialId===$.credentialId&&Z.accountIdentity===$.accountIdentity&&Z.recordVersion!==$.recordVersion}function GD($,Z){if(Z===void 0)return"reauthorize-failed";if(Z.credentialId!==$.credentialId)return"credential-changed";if(Z.accountIdentity!==$.accountIdentity)return"account-changed";if(Z.recordVersion===$.recordVersion)return"version-unchanged";return"rotated"}var KK=$K("claustrum");function zD($,Z,J,X=KK){let Y=YD(Z,J);return X.debug("scoped 401 re-authorized",{site:$,credentialId:Z.credentialId,servedVersion:Z.recordVersion,currentVersion:J?.recordVersion??null,retry:Y,reason:GD(Z,J)}),Y}var K3=300000;function F7(){return new r("invalid-material","Claustrum returned invalid credential material")}function QD($){let Z=$.trim();if(Z.startsWith("{")){let J;try{J=JSON.parse(Z)}catch{throw F7()}if(!J||typeof J!=="object")throw F7();let X=J,Y=X.access_token??X.access;Z=typeof Y==="string"?Y:""}if(!/^[\x21-\x7e]+$/.test(Z)||Z.startsWith(XD))throw F7();return Z}function KD($,Z){if(!$.operations.includes("read"))return;if(!$.categories.includes(Z.category))return;if($.credentialType==="oauth")return $.refreshAdapter===Z.refreshAdapter?"oauth":void 0;if($.credentialType==="api_key"&&Z.apiKeys)return $.refreshAdapter===void 0?"api_key":void 0;return}class L2{#$;#Z;#z;#J;#Q;#Y;#X;#K=new WeakMap;#V=new WeakMap;#G=!1;constructor($){let Z=$.tokenPath;if($.readToken)this.#Z=$.readToken;else if(Z)this.#Z=()=>ex(Z);else throw new r("not-enrolled","Claustrum enrollment token path is required");this.#$=$.client,this.#J=$.family,this.#Q=$.parseIdentity,this.#Y=$.requireAssertion??!1,this.#z=$.now??Date.now,this.#X=$.logger??KK}#W($){if(this.#G)throw new r("closed","Claustrum scoped custody is closed");$?.throwIfAborted()}async#B($){this.#W($);let Z=await this.#Z();if(this.#W($),!/^[0-9a-f]{64}$/.test(Z.token)||!Number.isSafeInteger(Z.token_generation)||Z.token_generation<1)throw new r("invalid-token","Invalid Claustrum enrollment token");return Z.token}async#q($,Z){this.#W(Z);let J,X;try{let Y=$();J=Z?await Promise.race([Y,new Promise((G,z)=>{let Q=()=>z(Z.reason);if(Z.addEventListener("abort",Q,{once:!0}),X=()=>Z.removeEventListener("abort",Q),Z.aborted)Q()})]):await Y}catch(Y){if(this.#W(Z),Y instanceof s6)throw Y;throw new r("unavailable","Claustrum scoped operation unavailable")}finally{X?.()}return this.#W(Z),J}async discover($){let Z=await this.#B($),J=await this.#q(()=>this.#$.listScoped(Z),$),X=[],Y=[],G=new Map;for(let Q of J.rows){let K=KD(Q,this.#J);if(!K)continue;Y.push({row:Q,type:K}),G.set(Q.id,(G.get(Q.id)??0)+1)}let z=[];for(let{row:Q,type:K}of Y){let W;if(!Q.id.trim())W="empty credential id";else if((G.get(Q.id)??0)>1)W="duplicate credential id";else if(Q.accountId!==void 0&&!Q.accountId.trim())W="blank account identity";else if(!Q.state.trim())W="empty state";if(W){X.push({...Q.id.trim()&&{credentialId:Q.id},reason:W});continue}z.push(Object.freeze({credentialId:Q.id,credentialType:K,...Q.accountId!==void 0&&{accountIdentity:Q.accountId},state:Q.state,...Q.email!==void 0&&{email:Q.email},...Q.orgName!==void 0&&{orgName:Q.orgName}}))}for(let Q of X)this.#X.warn("skipped malformed vault record",Q);return{view:J.view,credentials:Object.freeze(z),skipped:Object.freeze(X)}}async authorize($,Z){if(!$.credentialId)throw new r("route-unavailable","Claustrum dispatch requires a credential id");let{credentialId:J,credentialType:X,accountIdentity:Y}=$;if(this.#Y&&Y===void 0)throw new r("identity-unasserted","Claustrum dispatch requires a known account identity");let G=await this.#B(Z),z=await this.#q(()=>this.#$.getScoped({credentialId:J,enrollmentToken:G,...X==="oauth"&&{minTtlMs:K3}}),Z);if(z.credentialId!==void 0&&z.credentialId!==J)throw new r("identity-changed","Claustrum served credential identity changed");let Q=z.expiresAtMs;if(!Number.isSafeInteger(z.recordVersion)||z.recordVersion<0||Q===null&&X==="oauth"||Q!==null&&(!Number.isFinite(Q)||Q-this.#z()<K3))throw new r("insufficient-validity","Claustrum served credential has insufficient validity");let K=QD(z.material),W=z.accountId?.trim()?z.accountId:void 0;if(this.#Y&&(z.credentialId===void 0||W===void 0))throw new r("identity-unasserted","Claustrum served credential did not assert its identity");let V=W===void 0?this.#Q?.(K):void 0,B=W??V;if(Y!==void 0&&B!==void 0&&B!==Y)throw new r("identity-changed","Claustrum served credential identity changed");let q=B??Y,j=Object.freeze(Object.defineProperty({credentialId:J,credentialType:X,...q!==void 0&&{accountIdentity:q},accountIdentitySource:W!==void 0?"asserted":V!==void 0?"parsed":Y!==void 0?"expected":"none",...Y!==void 0&&{expectedAccountIdentity:Y},...z.credentialId!==void 0&&{assertedCredentialId:z.credentialId},...W!==void 0&&{assertedAccountIdentity:W},...z.projectId!==void 0&&{projectId:z.projectId},recordVersion:z.recordVersion,expiresAtMs:Q},"accessToken",{value:K,enumerable:!1}));return this.#K.set(j,G),j}async reportFailure($,Z,J){if(Z!==401)return;this.#W();let X=this.#K.get($);if(!X)throw new r("no-receipt","Claustrum failure report requires an original dispatch receipt");let Y=this.#V.get($);if(Y)return Y;let G=this.#q(()=>this.#$.reportAuthFailureScoped({credentialId:$.credentialId,enrollmentToken:X,providerStatus:401,recordVersion:$.recordVersion,reporterSource:J}));this.#V.set($,G);try{await G,this.#X.debug("scoped 401 reported",{credentialId:$.credentialId,recordVersion:$.recordVersion,reporterSource:J})}catch(z){throw this.#V.delete($),z}}close(){if(this.#G)return;this.#G=!0,this.#$.close()}}function WK($,Z,J){if($.accountIdentity!==void 0&&J!==void 0)return $.accountIdentity===J;return $.credentialId===Z}function VD($,Z,J){return $.some((X)=>WK(X,Z,J))}function VK($,Z,J){let X={credentialId:Z,...J!==void 0&&{accountIdentity:J}};return[...$.filter((Y)=>Y.credentialId!==Z||Y.accountIdentity!==J),X]}function BK($,Z,J){return $.filter((X)=>!Z.some((Y)=>WK(X,Y,J)))}var BD="vault:";function qD($){return WD("sha256").update($).digest("hex")}function jD($){let Z=$.credentialId.split(":");return(Z.length>=3?Z.slice(2).join(":").trim():void 0)||$.email||$.credentialId}function HD($){return $.identity!==void 0?`identity:${$.identity}`:`credential:${$.credential.credentialId}`}function B0($){return[$.credentialId,...$.aliases??[]]}function LD($,Z,J={}){let X=J.now??Date.now(),Y=J.routePrefix??BD,G=J.reservedRouteIds??new Set,z=$?.rows??[],Q=[...$?.declined??[]],K=Z.skipped.length===0,W=new Set(Z.credentials.map((I)=>I.credentialId)),V=new Set(Z.skipped.flatMap((I)=>I.credentialId===void 0?[]:[I.credentialId])),B=Z.skipped.some((I)=>I.credentialId===void 0),q=(I)=>!W.has(I)&&(V.has(I)||B),H=new Map;for(let I of z){if(I.accountIdentity===void 0)continue;for(let L of B0(I))if(!H.has(L))H.set(L,I.accountIdentity)}let j=new Map;for(let I of Z.credentials){let L=I.accountIdentity!==void 0?{credential:I,identity:I.accountIdentity,claimed:!0}:{credential:I,identity:H.get(I.credentialId),claimed:!1},w=HD(L),S=j.get(w)??[];S.push(L),j.set(w,S)}let x=new Set,N=new Set(G),U=[],D=(I,L)=>I.credential.credentialId.localeCompare(L.credential.credentialId),A=[...j.values()].map((I)=>I.toSorted(D)).sort((I,L)=>I[0]&&L[0]?D(I[0],L[0]):0);for(let I of A){let L=I[0]?.identity,w=I.filter((T)=>T.credential.state==="active"),S=w.length?w:I,f=S.filter((T)=>T.claimed),d=f.length?f:S,s=new Set(I.map((T)=>T.credential.credentialId)),_=z.find((T)=>!x.has(T)&&B0(T).some((g)=>s.has(g))&&(T.accountIdentity===void 0||T.accountIdentity===L)),O=d.find((T)=>T.credential.credentialId===_?.credentialId)??d[0];if(!O)continue;let P=O.credential,F=_??(L===void 0?void 0:z.find((T)=>!x.has(T)&&T.accountIdentity===L));if(F)x.add(F);let M=F?.routeId;if(!M||G.has(M)){let T=`${Y}${P.credentialId}${L===void 0?"":`~${qD(L).slice(0,10)}`}`;M=T;for(let g=2;N.has(M);g++)M=`${T}~${g}`}N.add(M);let R=F?B0(F).filter(q):[],k=[...new Set([...I.map((T)=>T.credential.credentialId),...R])].filter((T)=>T!==P.credentialId).sort((T,g)=>T.localeCompare(g)),v=J.mapAccount?.(P)??{};U.push({previousIndex:F?z.indexOf(F):1/0,row:{routeId:M,credentialId:P.credentialId,credentialType:P.credentialType,...L!==void 0&&{accountIdentity:L},...k.length&&{aliases:k},state:P.state,label:v.label?.trim()||jD(P),...P.email!==void 0&&{email:P.email},...P.orgName!==void 0&&{orgName:P.orgName},enabled:![P.credentialId,...k].some((T)=>VD(Q,T,L)),addedAt:F?.addedAt??X,...F?.quota!==void 0&&{quota:F.quota},...!O.claimed&&L!==void 0&&{unclaimed:!0}}})}return z.forEach((I,L)=>{if(x.has(I)||!B0(I).some(q))return;if(N.has(I.routeId))return;let[w,...S]=B0(I).filter((s)=>!W.has(s));if(w===void 0)return;N.add(I.routeId);let{aliases:f,...d}=I;U.push({previousIndex:L,row:{...d,credentialId:w,...S.length&&{aliases:S},stale:!0}})}),U.sort((I,L)=>I.previousIndex===L.previousIndex?I.row.credentialId.localeCompare(L.row.credentialId):I.previousIndex-L.previousIndex),{version:1,view:Z.view,complete:K,...!K&&{rejected:Z.skipped.map((I)=>({...I.credentialId!==void 0&&{credentialId:I.credentialId},reason:I.reason}))},rows:U.map((I)=>I.row),declined:Q}}function ND($){return($?.rows??[]).filter((Z)=>Z.enabled&&Z.state==="active").map((Z)=>({id:Z.routeId,kind:Z.credentialType==="oauth"?"oauth":"api-key",...Z.quota!==void 0&&{quota:Z.quota}}))}function ZZ($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function F8($){return $===void 0||typeof $==="string"}function UD($){if(!ZZ($)||typeof $.routeId!=="string"||typeof $.credentialId!=="string"||$.credentialType!=="oauth"&&$.credentialType!=="api_key"||typeof $.state!=="string"||typeof $.label!=="string"||typeof $.enabled!=="boolean"||typeof $.addedAt!=="number"||!F8($.accountIdentity)||!F8($.email)||!F8($.orgName)||$.aliases!==void 0&&(!Array.isArray($.aliases)||!$.aliases.every((Z)=>typeof Z==="string"))||$.quota!==void 0&&!V1($.quota)||$.stale!==void 0&&$.stale!==!0||$.unclaimed!==void 0&&$.unclaimed!==!0)return;return $}var xD=new Set(["empty credential id","duplicate credential id","blank account identity","empty state"]);function W3($){if(!Array.isArray($))return;let Z=[];for(let J of $){if(!ZZ(J)||!F8(J.credentialId)||typeof J.reason!=="string"||!xD.has(J.reason))return;Z.push(J)}return Z}function DD($){if(!ZZ($)||$.version!==1||!F8($.view)||!Array.isArray($.rows)||!Array.isArray($.declined)||$.complete!==void 0&&typeof $.complete!=="boolean"||$.rejected!==void 0&&!W3($.rejected))throw new r("invalid-state","Claustrum roster file is not valid");let Z=[];for(let Y of $.rows){let G=UD(Y);if(!G)throw new r("invalid-state","Claustrum roster file is not valid");Z.push(G)}let J=[];for(let Y of $.declined){if(!ZZ(Y)||typeof Y.credentialId!=="string"||!F8(Y.accountIdentity))throw new r("invalid-state","Claustrum roster file is not valid");J.push(Y)}let X=W3($.rejected);return{version:1,...typeof $.view==="string"&&{view:$.view},complete:$.complete!==!1,...X&&{rejected:X},rows:Z,declined:J}}async function l6($){let Z;try{Z=await V0($,o)}catch(X){if(X.code==="ENOENT")return;throw X}let J;try{J=JSON.parse(Z)}catch{throw new r("invalid-state","Claustrum roster file is not valid")}return DD(J)}var OD={name:"claustrum-roster-write",ttlMs:1e4,timeoutMs:5000},MD={name:"claustrum-roster",ttlMs:30000};async function O0($,Z,J={}){return d6($,OD,async(X)=>{let Y=await l6($),{next:G,result:z}=await Z(Y,{assertOwned:()=>X.assertOwned()});if(G)await X.assertOwned(),await c8($,G,{beforeRename:async()=>{await J.beforePublish?.(),await X.assertOwned()}});return z})}function ID($,Z){return O0($,(J)=>{let X=J?.rows.find((G)=>G.routeId===Z);if(!J||!X)throw new r("route-unavailable","Claustrum route is not in the roster");let Y=VK(J.declined,X.credentialId,X.accountIdentity);return{next:{...J,declined:Y,rows:J.rows.map((G)=>G===X?{...G,enabled:!1}:G)},result:void 0}})}function _D($,Z){return O0($,(J)=>{let X=J?.rows.find((Y)=>Y.routeId===Z);if(!J||!X)throw new r("route-unavailable","Claustrum route is not in the roster");return{next:{...J,declined:BK(J.declined,B0(X),X.accountIdentity),rows:J.rows.map((Y)=>Y===X?{...Y,enabled:!0}:Y)},result:void 0}})}function PD($,Z){if(!B0($).includes(Z.credentialId))return"refuse";if($.unclaimed&&(Z.accountIdentitySource==="expected"||Z.accountIdentitySource==="none"))return"refuse";if($.accountIdentity===Z.accountIdentity)return"hold";if($.accountIdentity===void 0&&Z.expectedAccountIdentity===void 0&&Z.accountIdentity!==void 0&&(Z.accountIdentitySource==="asserted"||Z.accountIdentitySource==="parsed")&&B0($).length===1)return"bind";return"refuse"}function AD($,Z){return O0($,(J)=>{let X=J?.rows.find((Q)=>Q.routeId===Z.routeId),Y=!J||!X?"refuse":PD(X,Z);if(!J||!X||Y==="refuse")return{result:!1};let G=_Q(X.quota,Z.observation),z=Y==="bind"?{accountIdentity:Z.accountIdentity,unclaimed:!0}:{};return{next:{...J,rows:J.rows.map((Q)=>Q===X?{...Q,...z,quota:G}:Q)},result:!0}})}async function qK($){$.signal?.throwIfAborted();let Z=async()=>await $.isActive?.()??!0;if(!await Z())return;let J=await R0({...MD,path:$.path,renew:!0});if(!J){let X=await l6($.path);if($.signal?.throwIfAborted(),!X?.view)throw new r("roster-busy","Claustrum account discovery is already in progress");return X}try{let X=await $.custody.discover($.signal);return $.signal?.throwIfAborted(),await O0($.path,async(Y)=>{if(!await Z())return{result:void 0};$.signal?.throwIfAborted(),await J.assertOwned();let G=typeof $.projection==="function"?$.projection():$.projection,z=LD(Y,X,G);return{...JSON.stringify(Y)!==JSON.stringify(z)&&{next:z},result:z}})}finally{await J.release()}}class wD{#$;#Z=new AbortController;#z;#J;#Q;#Y;#X;#K;#V=!1;constructor($){this.#$=$,this.#z=$.logger??$K("claustrum")}#G($){this.#Z.signal.throwIfAborted(),$?.throwIfAborted()}async#W(){return await this.#$.isCustodyActive?.()??!0}#B($,Z){let J=J3([this.#Z.signal,...Z?[Z]:[]]);return new Promise((X,Y)=>{let G=()=>{J.signal.removeEventListener("abort",z),J.dispose()},z=()=>{G(),Y(J.signal.reason)};if(J.signal.addEventListener("abort",z,{once:!0}),$.then((Q)=>{if(G(),J.signal.aborted)Y(J.signal.reason);else X(Q)},(Q)=>{G(),Y(Q)}),J.signal.aborted)z()})}async#q(){if(this.#G(),this.#J)return this.#J;if(!this.#Q)this.#Q=this.#$.connect().then(($)=>{if(this.#Z.signal.aborted)$.close(),this.#G();return this.#J=new L2({client:$,family:this.#$.family,tokenPath:this.#$.tokenPath,parseIdentity:this.#$.parseIdentity,requireAssertion:this.#$.requireAssertion,now:this.#$.now,logger:this.#z}),this.#J}).finally(()=>{this.#Q=void 0});return this.#B(this.#Q)}snapshot(){return this.#X}routingRows(){return ND(this.#X)}refresh(){if(this.#G(),this.#Y)return this.#Y;return this.#Y=(async()=>{if(!await this.#W()){this.#X=void 0,this.#J?.close(),this.#J=void 0;return}let $=await this.#q(),Z=await qK({path:this.#$.rosterPath,custody:$,isActive:()=>this.#W(),signal:this.#Z.signal,projection:()=>({reservedRouteIds:new Set(this.#$.reservedRouteIds?.()??[]),routePrefix:this.#$.routePrefix,mapAccount:this.#$.mapAccount,now:(this.#$.now??Date.now)()})});this.#G();let J=Z?.view!==this.#X?.view;if(this.#X=Z,Z&&J)this.#$.onRoster?.(Z);return Z})().finally(()=>{this.#Y=void 0}),this.#Y}start(){if(this.#V)return;this.#G(),this.#V=!0;let $=async()=>{try{await this.refresh()}catch(J){if(!this.#Z.signal.aborted)this.#$.onError?.(J)}if(this.#Z.signal.aborted)return;let Z=this.#$.pollIntervalMs??5000;if(Z<=0)return;this.#K=(this.#$.setTimeoutImpl??setTimeout)(()=>{this.#K=void 0,$()},Z),this.#K.unref?.()};$()}async authorize($,Z){this.#G(Z);let J=this.#X??await this.#B(this.refresh(),Z);if(!J||!await this.#W())throw new r("not-active","Claustrum scoped custody is not active");let X=await l6(this.#$.rosterPath);this.#G(Z);let Y=J.rows.find((K)=>K.routeId===$),G=X?.rows.find((K)=>K.routeId===$);if(G&&!G.enabled)throw new r("route-declined","Claustrum route is disabled");if(!Y||!G||G.state!=="active"||G.credentialId!==Y.credentialId||G.accountIdentity!==Y.accountIdentity)throw new r("route-unavailable","Claustrum route is disabled, removed or changed");let z=await this.#B(this.#q(),Z),Q=J3([this.#Z.signal,...Z?[Z]:[]]);try{return await z.authorize({credentialId:G.credentialId,credentialType:G.credentialType,...G.accountIdentity!==void 0&&{accountIdentity:G.accountIdentity}},Q.signal)}finally{Q.dispose()}}async reportFailure($,Z,J){if(this.#G(),!this.#J)throw new r("no-receipt","Claustrum dispatch receipt has no active owner");await this.#J.reportFailure($,Z,J)}async send($,Z,J){let X=J.signal,Y=await this.authorize($,X),G=await Z(Y,X);if(G.status===401&&!X?.aborted){let z;try{z=await this.authorize($,X)}catch{}if(zD(J.site,Y,z,this.#z))await G.body?.cancel().catch(()=>{}),Y=z,G=await Z(z,X)}if(G.status===401)await this.reportFailure(Y,401,J.reporterSource??"direct").catch((z)=>this.#$.onError?.(z)),Promise.resolve().then(()=>this.refresh()).catch((z)=>{if(!this.#Z.signal.aborted)this.#$.onError?.(z)});return G}async decline($){this.#G(),await ID(this.#$.rosterPath,$),this.#X=await l6(this.#$.rosterPath)}async accept($){this.#G(),await _D(this.#$.rosterPath,$),this.#X=await l6(this.#$.rosterPath)}async recordQuota($,Z,J){this.#G();let X=await AD(this.#$.rosterPath,{routeId:$,observation:Z,credentialId:J.credentialId,accountIdentitySource:J.accountIdentitySource,...J.accountIdentity!==void 0&&{accountIdentity:J.accountIdentity},...J.expectedAccountIdentity!==void 0&&{expectedAccountIdentity:J.expectedAccountIdentity}});if(X)this.#X=await l6(this.#$.rosterPath);return X}close(){if(this.#Z.signal.aborted)return;if(this.#Z.abort(new r("closed","Claustrum consumer is closed")),this.#K)(this.#$.clearTimeoutImpl??clearTimeout)(this.#K);this.#K=void 0,this.#J?.close(),this.#X=void 0}}function D4($){switch($){case"closed":case"not-enrolled":case"invalid-token":case"unavailable":case"identity-changed":case"identity-unasserted":case"insufficient-validity":case"invalid-material":case"not-active":case"route-unavailable":case"route-declined":case"no-receipt":case"unsafe-file":case"invalid-state":case"wrong-consumer":case"roster-busy":case"host-slot-login":case"host-slot-placeholder":case"placeholder-refresh":return $;default:return"unavailable"}}class n extends Error{code;constructor($){let Z=D4($);super(`Native custody refused: ${Z}`);this.name="NativeCustodyError",this.code=Z}}function jK($){let Z={...$.env??process.env},J=$.connect,X=$.logger,Y=!1,G,z,Q=new Set,K=new WeakSet;function W(N){if(Y)throw new n("closed");N?.throwIfAborted()}function V(){return W(),z??=Promise.resolve().then(J).then((N)=>{if(Y)throw N.close(),new n("closed");return G=N,N}).catch((N)=>{throw z=void 0,N}),z}async function B(N){let U=await V();return W(),N(U)}let q=new L2({client:{listScoped:(N)=>B((U)=>U.listScoped(N)),getScoped:(N)=>B((U)=>U.getScoped(N)),reportAuthFailureScoped:(N)=>B((U)=>U.reportAuthFailureScoped(N)),close:()=>G?.close()},family:{refreshAdapter:"anthropic",category:"anthropic-native",apiKeys:!1},requireAssertion:!0,...$.readToken?{readToken:$.readToken}:{tokenPath:X1($.host,Z).tokenPath},now:$.now,logger:{warn:()=>X?.warn("Native custody inventory record skipped"),debug:()=>X?.debug("Native custody failure reported")}});async function H(N,U){W(U);let D=()=>{},A=()=>{},I=new Promise((L,w)=>{D=()=>w(new n("closed")),A=()=>w(U?.reason),Q.add(D),U?.addEventListener("abort",A,{once:!0})});try{let L=await Promise.race([N(),I]);return W(U),L}catch(L){throw W(U),new n(L instanceof r?D4(L.kind):L instanceof n?D4(L.code):"unavailable")}finally{Q.delete(D),U?.removeEventListener("abort",A)}}function j(N){if(!K.has(N))throw new n("no-receipt")}let x={discover:(N)=>H(()=>q.discover(N),N),authorize:(N,U)=>H(async()=>{let{credentialId:D,accountIdentity:A}=N;if(typeof D!=="string")throw new n("unavailable");if(A!==void 0&&typeof A!=="string")throw new n("unavailable");if(!A?.trim())throw new n("identity-unasserted");let I=await q.authorize({credentialId:D,accountIdentity:A,credentialType:"oauth"},U);return W(U),K.add(I),I},U),reportFailure:(N,U,D)=>H(async()=>{j(N),await q.reportFailure(N,U,D)}),prepareRetry:async(N,U)=>{if(W(U),j(N),N.assertedAccountIdentity===void 0)throw new n("no-receipt");let D;try{D=await x.authorize({credentialId:N.credentialId,accountIdentity:N.assertedAccountIdentity},U)}catch(A){if(W(U),A instanceof n&&A.code==="closed")throw A;return{retry:!1,reason:"reauthorize-failed",code:A instanceof n?D4(A.code):"unavailable"}}if(W(U),D.credentialId!==N.credentialId)return{retry:!1,reason:"credential-changed"};if(D.assertedAccountIdentity!==N.assertedAccountIdentity)return{retry:!1,reason:"account-changed"};if(!(D.recordVersion>N.recordVersion))return{retry:!1,reason:"version-not-newer"};return{retry:!0,receipt:D}},close:()=>{if(Y)return;Y=!0;for(let N of Q)N();q.close()}};return x}async function O4($,Z=process.env){let J=await rx(X1($,Z),`anthropic-auth-${$}`);if(J==="unreadable")throw new n("invalid-token");return J==="vault"?"claustrum":"local"}function HK($,Z){return $.kind===Z.kind&&$.storageId===Z.storageId&&$.rowId===Z.rowId&&$.credentialEpoch===Z.credentialEpoch&&$.identity===Z.identity}function V3($,Z){return HK($.binding,Z.binding)&&$.credentialFingerprint===Z.credentialFingerprint&&$.version.accessFingerprint===Z.version.accessFingerprint&&$.version.expires===Z.version.expires&&Object.hasOwn($.version,"lastRefreshedAt")===Object.hasOwn(Z.version,"lastRefreshedAt")&&$.version.lastRefreshedAt===Z.version.lastRefreshedAt}function B3($,Z,J){let X=$?.lastRefreshError;if($?.binding.kind==="local"&&HK($.binding,Z.binding)&&X?.credentialFingerprint===Z.credentialFingerprint){if(X.permanent===!0)return{status:"blocked",reason:"invalid-grant",credentialFingerprint:Z.credentialFingerprint};if(X.nextRetryAt!==void 0&&X.nextRetryAt>J)return{status:"blocked",reason:"refresh-backoff",credentialFingerprint:Z.credentialFingerprint}}return{status:"allowed"}}function TD($){let{paths:Z,externalPolicy:J}=$,X=$.now??Date.now;if(typeof J!=="function")throw TypeError("Native local external policy gate is required");function Y(z){let Q=J(z);if(Q?.status==="allowed"&&Object.keys(Q).length===1)return{status:"allowed"};if(Q?.status==="blocked"&&Object.keys(Q).length===2&&["quota-ineligible","account-disabled","local-mode-unavailable"].includes(Q.reason))return{status:"blocked",reason:Q.reason};throw TypeError("Native local external policy result is invalid")}async function G(z){if(!x6(z.binding))throw new b("invalid-runtime");let Q=await c$(Z.runtime,Z.storageId),K=Q.status==="ready"?Q.state.accounts[z.binding.rowId]:void 0;if(K&&K.binding.kind!=="local")throw new b("invalid-runtime");return K}return{async readRestrictions(z){let Q=await G(z),K=Y(z);return{restriction:K.status==="blocked"?K:B3(Q,z,X()),context:{subject:z,runtimeBinding:Q?.binding.kind==="local"?Q.binding:null,refreshErrorClearedAt:Q?.refreshErrorClearedAt??null,quotaErrorClearedAt:Q?.quotaErrorClearedAt??null,quotaErrorGeneration:Q?.quotaErrorGeneration??null}}},async readAdmission(z){let Q=await G(z),K=Y(z);if(K.status==="blocked")return K;let W=X(),V=B3(Q,z,W);if(V.status==="blocked")return{status:"blocked",reason:V.reason};if(!$8(z))throw new b("invalid-runtime");let B=Q?.credentialValidation;if(B&&V3(B,z))return{status:"proven",validation:B};let q=Q?.validationRetry;if(q&&z.version.expires>W&&q.nextRetryAt>W&&V3(q.subject,z))return{status:"blocked",reason:"validation-backoff"};return{status:"unproven"}}}}var cJ=3;function C7($,Z){let J=FD("sha256").update(JSON.stringify([$.storageId,Z])).digest("hex");return{path:$.state,name:`native-account-provider-${J}`,...y6}}function q3($){return $ instanceof I5||$ instanceof N5}var y0=new Map;function H8($,Z){if(y0.get(Z)===$)y0.delete(Z);$.keys.delete(Z)}function Q9($){let Z=$ instanceof G6?$.cause:$,J=$ instanceof G6?$.kind:"caller-hook";if(J==="provider"&&Z instanceof E9){let X=Z.status===400&&/\binvalid_grant\b/.test(Z.body);return{kind:J,classification:X?"invalid-grant":Z.status===429||Z.status>=500?"transient":"permanent",status:Z.status,...Z.retryAfter!==void 0?{retryAfter:Z.retryAfter}:{}}}return{kind:J,classification:J==="provider"&&g$(Z)?"transient":"permanent"}}function Z4($){return $ instanceof Error?$:Error("Native refresh callback failed",{cause:$})}function D8($){if($.type!=="oauth")throw Error("Local refresh requires an OAuth credential");return Object.freeze({accessFingerprint:$.access?S$($.access):void 0,expires:$.expires,...Object.hasOwn($,"lastRefreshedAt")?{lastRefreshedAt:$.lastRefreshedAt}:{}})}class k9 extends Error{reason;constructor($){super("Local refresh policy refused the exchange");this.reason=$}}function S7($,Z){if($.status==="allowed")return;if($.reason!=="refresh-backoff"&&$.reason!=="invalid-grant")return $.reason;return $.credentialFingerprint===Z?$.reason:void 0}function CD($,Z){let J=$.credential,X=Z.credential;return J?.type==="oauth"&&X?.type==="oauth"&&J.access===X.access&&J.refresh===X.refresh&&J.expires===X.expires&&Object.hasOwn(J,"lastRefreshedAt")===Object.hasOwn(X,"lastRefreshedAt")&&J.lastRefreshedAt===X.lastRefreshedAt}function SD($){throw Error(`Unsupported refresh outcome: ${String($)}`)}function kD($,Z){return x6($)&&x6(Z)&&$.storageId===Z.storageId&&$.rowId===Z.rowId&&$.credentialEpoch===Z.credentialEpoch&&$.identity===Z.identity}function vD($,Z){return kD($.binding,Z.binding)&&$.credentialFingerprint===Z.credentialFingerprint&&$.version.accessFingerprint===Z.version.accessFingerprint&&$.version.expires===Z.version.expires&&Object.hasOwn($.version,"lastRefreshedAt")===Object.hasOwn(Z.version,"lastRefreshedAt")&&$.version.lastRefreshedAt===Z.version.lastRefreshedAt}function JZ($){return Object.freeze({...$,binding:Object.freeze({...$.binding}),version:Object.freeze({...$.version})})}function j3($,Z){if(Z.credential?.type!=="oauth"||!Z.fingerprint)throw new k9("access-unavailable");return JZ({binding:$,credentialFingerprint:Z.fingerprint,version:D8(Z.credential)})}function J4($){return Object.freeze({credentialFingerprint:I6($),version:D8($)})}function fD($,Z){if(!vD($.subject,Z)||$.runtimeBinding!==null&&!x6($.runtimeBinding)||![$.refreshErrorClearedAt,$.quotaErrorClearedAt,$.quotaErrorGeneration].every((J)=>J===null||Number.isSafeInteger(J)&&Number(J)>=0))throw Error("Native policy context does not match the captured subject");return Object.freeze({subject:JZ(Z),runtimeBinding:$.runtimeBinding===null?null:Object.freeze({...$.runtimeBinding}),refreshErrorClearedAt:$.refreshErrorClearedAt,quotaErrorClearedAt:$.quotaErrorClearedAt,quotaErrorGeneration:$.quotaErrorGeneration})}function ED($){let Z=x0($),J=$.now??Date.now,X=$.refreshToken??eV,Y=$.resolveIdentity??Kq,G=FQ($.onLockEvent);async function z(q){let H=await Z.read();return H.status==="ready"?H.rows.find((j)=>j.id===q.rowId):void 0}async function Q(q){let H;try{H=await $.readRestrictions(q)}catch(j){throw Error("Native policy callback failed",{cause:j})}return Object.freeze({restriction:Object.freeze({...H.restriction}),context:fD(H.context,q)})}async function K(q,H,j,x,N){let U=(L)=>({status:"refused",reason:L,persisted:N});if(!j||!U$(H,$.paths,j)||!j.enabled||!j.candidate)return U("row-ineligible");if(H.identity===void 0)return U("identity-unproven");let D=j.credential;if(D?.type!=="oauth"||!D.access||typeof D.expires!=="number"||D.expires<=J())return U("access-unavailable");if(D.access===q.rejectedAccessToken)return U("rejected-access-unchanged");let A=JZ({binding:{...H,identity:H.identity},credentialFingerprint:I6(D),version:{...D8(D),accessFingerprint:S$(D.access),expires:D.expires}}),I;try{I=await $.readAdmission(A)}catch(L){throw Error("Native admission callback failed",{cause:L})}if(I.status==="blocked")return U(I.reason);if(I.status!=="proven")return U("proof-missing");if(!c0(I.validation,H,D))return U("proof-mismatch");if(q.signal?.aborted)return U("cancelled");if(D.expires<=J())return U("access-unavailable");return Object.freeze({status:"usable",source:x,binding:A.binding,access:D.access,expires:D.expires,subject:A,validation:JZ(I.validation)})}async function W(q){let H=C7($.paths,q),j=performance.now();for(;;){let x=await R0({name:H.name,path:H.path,ttlMs:y6.ttlMs,renew:!0,now:J,onContended:G?()=>G({type:"contended",name:H.name,path:H.path}):void 0,onStep:$.onLockStep?(U)=>$.onLockStep?.(H,U):void 0});if(x){try{await x.assertOwned()}catch(U){throw await x.release().catch(()=>{}),G?.({type:"released",name:H.name,path:H.path}),U}return G?.({type:"acquired",name:H.name,path:H.path}),x}let N=y6.timeoutMs-(performance.now()-j);if(N<=0)throw new E8({target:H.path,name:H.name,timeoutMs:y6.timeoutMs});await new Promise((U)=>setTimeout(U,Math.min(y6.retryMs,N)))}}async function V(q,H){let j=H.binding,x=0,N=!1,U=!1,D,A="unavailable",I="not-needed",L,w,S,f,d,s,_,O,P=!1;function F(){return A==="unsupported-credential"}function M(){return{binding:j,attempt:x,credentialFingerprint:L,credentialVersion:w,context:f,bootstrap:A,handoff:I}}async function R(T){try{await $.reconcile(T)}catch(g){throw P=!0,Error("Native reconciliation callback failed",{cause:g})}}async function k(){let T=d;if(d=void 0,_?.(),_=void 0,T)s=(async()=>{if(await T.release().catch(()=>{}),D){let g=C7($.paths,D);G?.({type:"released",name:g.name,path:g.path})}})();await s}async function v(){if(I="skipped-loss",O)H8(q,O);await k()}try{for(x=1;x<=cJ;x++){N=!1;let T=!1;D=void 0,L=void 0,w=void 0,S=void 0,f=void 0,O=void 0,A="unavailable",I="not-needed";let g,E=await z(j);L=E?.fingerprint,w=E?.credential?.type==="oauth"?D8(E.credential):void 0;let h,C=!E||!U$(j,$.paths,E)?"binding-changed":H.signal?.aborted?"cancelled":!E.candidate||!E.enabled?"row-ineligible":void 0;if(C)return await R({...M(),status:"refused",reason:C,consumed:!1}),{status:"refused",reason:C,persisted:!1};if(!E)throw Error("Captured row unavailable");h=await Q(j3(j,E));let y=S7(h.restriction,E.fingerprint);if(y)return await R({...M(),status:"refused",reason:y,consumed:!1}),{status:"refused",reason:y,persisted:!1};if(j.identity!==void 0&&(H.intent==="serve"||H.rejectedAccessToken!==void 0)&&E?.credential?.type==="oauth"&&E.credential.access&&E.credential.access!==H.rejectedAccessToken&&(E.credential.expires??0)>J()){let m=await K(H,j,E,"adopted",!1);if(m.status==="usable")await R({...M(),status:"adopted",successorFingerprint:I6(E.credential),successorVersion:D8(E.credential)});else if(m.status==="refused"&&m.reason==="proof-missing"){f=h.context;let u,c;try{if(u=(await Y(E.credential.access,void 0,void 0)).accountUuid,A=u?"resolved":"unavailable",!u)c={kind:"validation",classification:"transient"}}catch(e){if(q3(e))return A="unsupported-credential",await R({...M(),status:"refused",reason:"unsupported-access",consumed:!1}),{status:"refused",reason:"unsupported-access",persisted:!1};A="failed",c={kind:"validation",classification:g$(e)||e instanceof E9&&(e.status===429||e.status>=500)?"transient":"permanent"}}if(c){Object.freeze(c);try{await R({...M(),status:"failed",failure:c,persisted:!1})}catch{}return{status:"failed",failure:c,persisted:!1,reconciliationFailed:P}}if(u!==j.identity)return await R({...M(),status:"refused",reason:"validation-contradicted",consumed:!1}),{status:"refused",reason:"validation-contradicted",persisted:!1};await R({...M(),status:"validation-observed",identity:j.identity,context:f})}else return m;return{status:"completed",source:m.status==="usable"?H.rejectedAccessToken?"adopted":"current":"validated",identity:j.identity,persisted:!1}}try{let m=await Z.refresh(j.rowId,async(u,c)=>{if(g=c,L=c.fingerprint,w=D8(u),IG(u.refresh))throw new k9("custody-tombstone");h=await Q(j3(j,c)),f=h.context;let e=H.signal?.aborted?"cancelled":S7(h.restriction,L);if(e)throw new k9(e);T=!0;let H6=await X({refreshToken:u.refresh,maxRetries:0,now:J});N=!0;try{let V6=(await Y(H6.access,void 0,void 0)).accountUuid;D=typeof V6==="string"&&V6.length>0&&V6.trim()===V6?V6:void 0,A=D?"resolved":"unavailable"}catch(V6){A=q3(V6)?"unsupported-credential":"failed"}if(j.identity===void 0&&D){if(O=uY({...j,identity:D}),!y0.has(O))y0.set(O,q),q.keys.add(O);if(H.signal?.aborted)I="skipped-cancelled",H8(q,O);else try{d=await W(D),I="acquired";let V6=d,i6=()=>{if(d!==V6)return;if(I="skipped-cancelled",O)H8(q,O);k()};if(H.signal?.addEventListener("abort",i6,{once:!0}),_=()=>H.signal?.removeEventListener("abort",i6),H.signal?.aborted)i6();if(V6.whenLost().then(async()=>{if(d===V6)await v()}).catch(()=>{}),d===V6)await V6.assertOwned()}catch(V6){I=V6 instanceof E8?"skipped-contention":"skipped-loss",H8(q,O),await k()}}return{access:H6.access,refresh:H6.refresh,expires:H6.expires,...D?{identity:D}:{}}},{...j.identity!==void 0?{providerLock:C7($.paths,j.identity)}:{},refuse:async(u)=>{if(!U$(j,$.paths,u))return"binding-changed";if(g&&!CD(g,u))return"dispatch-changed";if(d)try{await d.assertOwned()}catch{await v()}if(N)return;if(H.signal?.aborted)return"cancelled";if(!u.candidate||!u.enabled)return"row-ineligible";return h?S7(h.restriction,u.fingerprint):void 0},onPersisted:async(u,c)=>{U=!0,S=J4(c);try{if(d)try{await d.assertOwned()}catch{await v()}await R({...M(),status:"persisted",identity:D,successorFingerprint:S.credentialFingerprint,successorVersion:S.version,committed:S})}finally{await k()}}});switch(m.status){case"rotated":if(F())return{status:"refused",reason:"unsupported-access",persisted:!0};return{status:"completed",source:"rotated",identity:m.identity,persisted:!0};case"refused":return await R({...M(),status:"refused",reason:m.reason,consumed:N}),{status:"refused",reason:m.reason,persisted:!1};case"identity-contradicted":return U=!0,S=J4(m.credential),await R({...M(),status:"identity-contradicted",expectedIdentity:m.expectedIdentity,returnedIdentity:m.returnedIdentity,successorFingerprint:S.credentialFingerprint,successorVersion:S.version,committed:S}),{status:"identity-contradicted",expectedIdentity:m.expectedIdentity,returnedIdentity:m.returnedIdentity,persisted:!0};default:return SD(m)}}catch(m){let u=Z4(m);if(U||=u instanceof G6&&(u.committed!==void 0||u.phase==="after-first-write"),u instanceof G6&&u.committed?.type==="oauth")S=J4(u.committed);if(!T&&u instanceof G6&&u.cause instanceof k9)return await R({...M(),status:"refused",reason:u.cause.reason,consumed:!1}),{status:"refused",reason:u.cause.reason,persisted:!1};let c=Q9(u);if(!T&&c.kind==="provider")c.kind="caller-hook",c.classification="permanent";Object.freeze(c);try{await R({...M(),status:"failed",failure:c,persisted:U,committed:S})}catch{}if(T&&!N&&!U&&!P&&!H.signal?.aborted&&c.kind==="provider"&&c.classification==="transient"&&c.status!==429&&x<cJ){if(await k(),O)H8(q,O);continue}return{status:"failed",failure:c,persisted:U,reconciliationFailed:P}}finally{await k()}}throw Error("Unreachable refresh attempt budget")}catch(T){let g=Z4(T);if(U||=g instanceof G6&&(g.committed!==void 0||g.phase==="after-first-write"),g instanceof G6&&g.committed?.type==="oauth")S=J4(g.committed);try{await R({...M(),status:"failed",failure:Q9(g),persisted:U,committed:S})}catch{}return{status:"failed",failure:Q9(g),persisted:U,reconciliationFailed:P}}finally{await k()}}async function B(q){if(q.mode!=="local")return{status:"refused",reason:"custody-mode",persisted:!1};if(q.intent!=="serve"&&q.intent!=="refresh")return{status:"refused",reason:"invalid-intent",persisted:!1};if(!x6(q.binding)||q.binding.storageId!==$.paths.storageId)return{status:"refused",reason:"binding-changed",persisted:!1};if(q={...q,binding:Object.freeze({...q.binding})},q.signal?.aborted)return{status:"refused",reason:"cancelled",persisted:!1};let H=uY(q.binding),j=y0.get(H);if(!j&&q.intent==="serve"){try{let N=await K(q,q.binding,await z(q.binding),"current",!1);if(N.status!=="refused"||!["proof-missing","identity-unproven","access-unavailable","rejected-access-unchanged"].includes(N.reason))return N}catch(N){return{status:"failed",failure:Q9(Z4(N)),persisted:!1,reconciliationFailed:!1}}j=y0.get(H)}if(!j){j={keys:new Set([H]),promise:Promise.resolve({status:"refused",reason:"initializing",persisted:!1})},y0.set(H,j);let N=j;j.promise=V(N,q).finally(()=>{for(let U of N.keys)H8(N,U)})}let x=await j.promise;if(q.signal?.aborted)return{status:"refused",reason:"cancelled",persisted:x.persisted};if(x.status!=="completed")return x;try{let N=q.binding.identity===void 0&&x.source==="rotated"?{...q.binding,...x.identity?{identity:x.identity}:{}}:q.binding,U=await z(q.binding);return await K(q,N,U,x.source,x.persisted)}catch(N){return{status:"failed",failure:Q9(Z4(N)),persisted:x.persisted,reconciliationFailed:!1}}}return{authorize:B}}class v6 extends Error{role;code;constructor($,Z){super(`Anthropic migration ${$} input: ${Z}`);this.role=$,this.code=Z,this.name="NativeMigrationSourceError"}}var L3=4194304;function uD($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function pD($){let Z=[$];while(Z.length){let J=Z.pop();if(!J)continue;for(let X of Object.values(J))if(X!==null&&typeof X==="object")Z.push(X);Object.freeze(J)}return $}function N3($){return Object.defineProperty($,"data",{enumerable:!1}),Object.freeze($)}async function T6($,Z,J={}){let X=N3({role:$,path:Z,digest:null,data:void 0,metadata:void 0}),Y;try{Y=await H3(Z,{bigint:!0})}catch(z){if(z instanceof Error&&"code"in z&&z.code==="ENOENT")return X;throw new v6($,"source-io")}if(!Y.isFile()||Y.isSymbolicLink())throw new v6($,"unsafe-source");let G;try{G=await mD(Z,k7.O_RDONLY|(k7.O_NOFOLLOW??0)|(k7.O_NONBLOCK??0));let z=await G.stat({bigint:!0});if(!z.isFile()||z.dev!==Y.dev||z.ino!==Y.ino)throw new v6($,"source-changed");if(z.size>L3)throw new v6($,"source-too-large");await J.onOpened?.();let Q=[],K=0;for(;;){let H=Buffer.alloc(65536),j=await G.read(H);if(!j.bytesRead)break;if(K+=j.bytesRead,K>L3)throw new v6($,"source-too-large");Q.push(H.subarray(0,j.bytesRead))}let W=await G.stat({bigint:!0}),V=await H3(Z,{bigint:!0});if(z.uid!==W.uid||z.gid!==W.gid||z.mode!==W.mode||V.uid!==z.uid||V.gid!==z.gid||V.mode!==z.mode||z.dev!==W.dev||z.ino!==W.ino||z.mtimeNs!==W.mtimeNs||z.ctimeNs!==W.ctimeNs||z.size!==W.size||V.dev!==z.dev||V.ino!==z.ino||V.isSymbolicLink()||V.mtimeNs!==z.mtimeNs||V.ctimeNs!==z.ctimeNs||V.size!==z.size||BigInt(K)!==z.size)throw new v6($,"source-changed");let B=Buffer.concat(Q,K),q;try{q=m8(new TextDecoder("utf-8",{fatal:!0}).decode(B))}catch{throw new v6($,"invalid-source")}if(!uD(q))throw new v6($,"invalid-source");return N3({role:$,path:Z,digest:hD("sha256").update(B).digest("hex"),data:pD(q),metadata:Object.freeze({uid:Number(z.uid),mode:Number(z.mode),device:z.dev.toString(),inode:z.ino.toString(),modified:z.mtimeNs.toString(),changed:z.ctimeNs.toString()})})}catch(z){if(z instanceof v6)throw z;if(z instanceof Error&&"code"in z){if(z.code==="ENOENT")throw new v6($,"source-changed");if(z.code==="ELOOP")throw new v6($,"unsafe-source")}if(z instanceof SyntaxError)throw new v6($,"invalid-source");throw new v6($,"source-io")}finally{await G?.close()}}async function q0($){let Z=await T6($.role,$.path);if(Z.digest!==$.digest||JSON.stringify(Z.metadata)!==JSON.stringify($.metadata))throw new v6($.role,"source-changed")}var lJ=["building","verified","activation-installed","committed","retired"];class Y6 extends Error{code;constructor($){super({"migration-required":"Anthropic account migration is required. Stop OpenCode, LiteCode and Pi, then run bunx @cortexkit/opencode-anthropic-auth@2.0.0 setup","migration-incomplete":"Anthropic account migration is incomplete; resume setup","invalid-journal":"Anthropic account migration journal is invalid","journal-conflict":"Anthropic account migration journal changed"}[$]);this.code=$,this.name="NativeAuthorityError"}}function k$($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function LK($){try{return t0($)}catch{throw new Y6("invalid-journal")}}function N2($){try{return vQ($)}catch{throw new Y6("invalid-journal")}}function dJ($){return lJ.some((Z)=>Z===$)}function z$($,Z){return Object.keys($).length===Z.length&&Z.every((J)=>Object.hasOwn($,J))}function XZ($){return typeof $==="string"&&$.length===64&&/^[a-f0-9]{64}$/.test($)}function v9($){return $===null||XZ($)}function kZ($){return $==="absent"||XZ($)}function iJ($){return typeof $==="string"&&bD($)&&!/\p{Cc}/u.test($)&&!$.endsWith(X4)&&gD($)===$&&(X4!=="\\"||yD($).root!==X4)&&!$.split(X4).some((Z)=>Z==="."||Z==="..")}function cD($){return k$($)&&z$($,["config","state","hostAuth","routing"])&&v9($.config)&&v9($.state)&&kZ($.hostAuth)&&v9($.routing)}function lD($){return k$($)&&z$($,["source","destination"])&&iJ($.source)&&iJ($.destination)}function G$($){return typeof $==="string"&&$.length>0}function dD($){if(!k$($)||!z$($,["version","view","complete","rows","declined"])||$.version!==1||!G$($.view)||$.complete!==!0||!Array.isArray($.rows)||!Array.isArray($.declined))throw new Y6("invalid-journal");let Z=$.rows.map((X)=>{if(!k$(X)||!z$(X,["routeId","credentialId","credentialType","accountIdentity","state","label","enabled","addedAt"])||!G$(X.routeId)||!G$(X.credentialId)||X.credentialType!=="oauth"||!G$(X.accountIdentity)||!G$(X.state)||typeof X.label!=="string"||typeof X.enabled!=="boolean"||typeof X.addedAt!=="number"||!Number.isFinite(X.addedAt))throw new Y6("invalid-journal");return{routeId:X.routeId,credentialId:X.credentialId,credentialType:"oauth",accountIdentity:X.accountIdentity,state:X.state,label:X.label,enabled:X.enabled,addedAt:X.addedAt}}),J=$.declined.map((X)=>{if(!k$(X)||!G$(X.credentialId)||!(z$(X,["credentialId"])||z$(X,["credentialId","accountIdentity"])&&G$(X.accountIdentity)))throw new Y6("invalid-journal");return G$(X.accountIdentity)?{credentialId:X.credentialId,accountIdentity:X.accountIdentity}:{credentialId:X.credentialId}});if(new Set(Z.map((X)=>X.routeId)).size!==Z.length)throw new Y6("invalid-journal");return{version:1,view:$.view,complete:!0,rows:Z,declined:J}}function v7($,Z,J){if(!k$($)||!z$($,[...Z])||!Z.every((X)=>J($[X])))throw new Y6("invalid-journal");return Object.fromEntries(Z.map((X)=>[X,$[X]]))}var iD=["prepared","published","committed"];function sD($,Z){if($===null)return null;if(!k$($))throw new Y6("invalid-journal");if($.kind==="requested"&&z$($,["kind"]))return{kind:"requested"};if($.kind!=="activation"||Z!=="retired"||!z$($,["kind","phase","primary","roster","localProof","removeIds","settings","runtime","hostAuth"])||!iD.some((Q)=>Q===$.phase)||!k$($.primary)||!z$($.primary,["routeId","credentialId","accountIdentity"])||!G$($.primary.routeId)||!G$($.primary.credentialId)||!G$($.primary.accountIdentity)||!Array.isArray($.removeIds)||!$.removeIds.every(G$))throw new Y6("invalid-journal");let J={routeId:$.primary.routeId,credentialId:$.primary.credentialId,accountIdentity:$.primary.accountIdentity},X=dD($.roster),Y=N2($.localProof),G=[...$.removeIds],z=new Set(Y.rows.map((Q)=>Q.id));if(G.some((Q,K)=>!z.has(Q)||K>0&&(G[K-1]??"")>=Q)||!X.rows.some((Q)=>Q.routeId===J.routeId&&Q.credentialId===J.credentialId&&Q.accountIdentity===J.accountIdentity))throw new Y6("invalid-journal");return{kind:"activation",phase:$.phase,primary:J,roster:X,localProof:Y,removeIds:G,settings:v7($.settings,["source","target"],XZ),runtime:v7($.runtime,["source","target"],XZ),hostAuth:v7($.hostAuth,["source","expected"],kZ)}}function U2($,Z){let J=LK($);if(!k$(J)||!z$(J,["version","storageId","host","phase","sources","routingPaths","hostAuthPath","expectedHostAuth","expectedRouting","preparedProof","activation"])||J.version!==4||J.storageId!==Z||J.host!=="opencode"&&J.host!=="pi"||!dJ(J.phase)||!cD(J.sources)||!lD(J.routingPaths)||!iJ(J.hostAuthPath)||J.expectedHostAuth!=="unprepared"&&!kZ(J.expectedHostAuth)||J.expectedRouting!=="unprepared"&&!v9(J.expectedRouting))throw new Y6("invalid-journal");let X=J.expectedHostAuth==="unprepared",Y=J.preparedProof===null?null:N2(J.preparedProof);if(X!==(J.expectedRouting==="unprepared")||X!==(Y===null)||J.phase==="building"&&!X||J.phase!=="building"&&J.phase!=="verified"&&X||!X&&J.sources.routing===null!==(J.expectedRouting===null))throw new Y6("invalid-journal");return{version:4,storageId:Z,host:J.host,phase:J.phase,sources:{config:J.sources.config,state:J.sources.state,hostAuth:J.sources.hostAuth,routing:J.sources.routing},routingPaths:{source:J.routingPaths.source,destination:J.routingPaths.destination},hostAuthPath:J.hostAuthPath,expectedHostAuth:J.expectedHostAuth,expectedRouting:J.expectedRouting,preparedProof:Y,activation:sD(J.activation,J.phase)}}async function j1($){try{let Z=await T6("journal",$.journal);if(!Z.data)return;if(!Z.metadata||(Z.metadata.mode&511)!==384||process.getuid&&Z.metadata.uid!==process.getuid())throw new Y6("invalid-journal");return U2(Z.data,$.storageId)}catch{throw new Y6("invalid-journal")}}function tD($){if(!$)return;if($.phase!=="committed"&&$.phase!=="retired")return;if($.activation!==null&&($.activation.kind!=="activation"||$.activation.phase!=="committed"))return;return $.phase}async function sJ($){let Z=await j1($);if(!Z)throw new Y6("migration-required");if(!tD(Z))throw new Y6("migration-incomplete")}function NK($){if($===null||typeof $!=="object")return;for(let Z of Object.values($))NK(Z);Object.freeze($)}async function x2($,Z,J,X){let Y=U2(Z,$.storageId);if(Y.preparedProof){for(let G of Y.preparedProof.rows)Object.freeze(G);Object.freeze(Y.preparedProof.rows),Object.freeze(Y.preparedProof)}Object.freeze(Y.sources),Object.freeze(Y.routingPaths),NK(Y.activation),Object.freeze(Y),await c8($.journal,Y,{beforeRename:async()=>{await X.onWriteStep?.("before-write",Y),await X.assertOwned?.(),await J()}}),await X.onWriteStep?.("after-write",Y)}async function aD($,Z,J={}){try{G2(Z)}catch{throw new Y6("invalid-journal")}let X=U2({version:4,storageId:$.storageId,host:Z.host,phase:"building",sources:Z.sources,routingPaths:Z.routingPaths,hostAuthPath:Z.hostAuthPath,expectedHostAuth:"unprepared",expectedRouting:"unprepared",preparedProof:null,activation:Z.activation===void 0?null:Z.activation==="requested"?{kind:"requested"}:"invalid"},$.storageId);return d6($.journal,{name:"migration-journal",ttlMs:30000,timeoutMs:15000,...J.lockOptions,renew:!0},async(Y)=>{let G=await j1($);if(G){if(G.host!==X.host||G.sources.config!==X.sources.config||G.sources.state!==X.sources.state||G.sources.hostAuth!==X.sources.hostAuth||G.sources.routing!==X.sources.routing||G.routingPaths.source!==X.routingPaths.source||G.routingPaths.destination!==X.routingPaths.destination||G.hostAuthPath!==X.hostAuthPath||G.activation===null!==(X.activation===null))throw new Y6("journal-conflict");return G}return await x2($,X,()=>Y.assertOwned(),J),X})}async function nD($,Z,J={}){let X=LK(Z);if(!k$(X)||!z$(X,["expectedHostAuth","expectedRouting","preparedProof"])||!kZ(X.expectedHostAuth)||!v9(X.expectedRouting))throw new Y6("invalid-journal");let{expectedHostAuth:Y,expectedRouting:G}=X,z=N2(X.preparedProof);return d6($.journal,{name:"migration-journal",ttlMs:30000,timeoutMs:15000,...J.lockOptions,renew:!0},async(Q)=>{let K=await j1($);if(!K)throw new Y6("migration-required");if(K.phase!=="verified"||K.sources.routing===null!==(G===null))throw new Y6("journal-conflict");if(K.expectedHostAuth!=="unprepared"){if(K.expectedHostAuth!==Y||K.expectedRouting!==G||M6(K.preparedProof)!==M6(z))throw new Y6("journal-conflict");return K}let W={...K,expectedHostAuth:Y,expectedRouting:G,preparedProof:z};return await x2($,W,()=>Q.assertOwned(),J),W})}async function M4($,Z,J,X={}){if(!dJ(Z)||!dJ(J)||lJ.indexOf(J)!==lJ.indexOf(Z)+1)throw new Y6("journal-conflict");return d6($.journal,{name:"migration-journal",ttlMs:30000,timeoutMs:15000,...X.lockOptions,renew:!0},async(Y)=>{let G=await j1($);if(!G)throw new Y6("migration-required");if(G.phase===J)return G;if(G.phase!==Z)throw new Y6("journal-conflict");if(J==="activation-installed"&&G.expectedHostAuth==="unprepared")throw new Y6("journal-conflict");let z={...G,phase:J};return await x2($,z,()=>Y.assertOwned(),X),z})}var oD=["paths","publicationGuard","externalPolicy","failurePolicy","now","refreshToken","resolveIdentity"],U3=["legacyConfig","legacyState","config","state","runtime","journal","roster","storageId"],rD=["checkedAt","nextRetryAt","retryCount"];function YZ($){return TypeError(`Native local credential service option ${$} is invalid`)}function D2($,Z){if($===null||typeof $!=="object"||RD.isProxy($)||Object.getPrototypeOf($)!==Object.prototype&&Object.getPrototypeOf($)!==null)return;let J=Object.getOwnPropertyDescriptors($);for(let X of Reflect.ownKeys(J)){let Y=J[X];if(typeof X!=="string"||!Z.includes(X)||!Y||!Object.hasOwn(Y,"value"))return}return J}function f7($,Z){let J=$[Z]?.value;if(typeof J!=="function")throw YZ(Z);return J}function E7($,Z){let J=$[Z]?.value;if(J===void 0)return;if(typeof J!=="function")throw YZ(Z);return J}function eD($){let Z=D2($,U3);if(!Z)throw YZ("paths");let J={};for(let X of U3){let Y=Z[X]?.value;if(typeof Y!=="string"||Y.length===0)throw YZ("paths");J[X]=Y}return Object.freeze(J)}function x3($){let Z=structuredClone($),J=(X)=>{if(X===null||typeof X!=="object")return;for(let Y of Object.values(X))J(Y);Object.freeze(X)};return J(Z),Z}function $O($){let Z=D2($,rD);if(!Z||!Object.hasOwn(Z,"checkedAt"))throw TypeError("Native local failure policy result is invalid");let J=(G)=>Z[G]?.value,X=J("nextRetryAt"),Y=J("retryCount");return Object.freeze({checkedAt:J("checkedAt"),...X!==void 0?{nextRetryAt:X}:{},...Y!==void 0?{retryCount:Y}:{}})}function ZO($){let Z=D2($,oD);if(!Z)throw TypeError("Native local credential service options are invalid");let J=eD(Z.paths?.value),X=f7(Z,"publicationGuard"),Y=f7(Z,"externalPolicy"),G=f7(Z,"failurePolicy"),z=E7(Z,"now"),Q=E7(Z,"refreshToken"),K=E7(Z,"resolveIdentity");async function W(j,x){if(await X(j)!==!0)return;let N={beforePublish:async()=>{if(await X(j)!==!0)throw new b("publication-refused")}};try{await x(N)}catch(U){if(U instanceof b&&U.code==="publication-refused"&&await X(j)!==!0)return;throw U}}async function V(j){let x=x3(j);if((x.status==="persisted"||x.status==="validation-observed")&&x.bootstrap==="resolved"){let D=x.context?.runtimeBinding;await W(x,(A)=>D&&D.identity===void 0?Wx(J,x,A):Bx(J,x,A));return}if(x.status!=="failed"&&x.status!=="persisted")return;let N=mQ(x);if(N.kind==="none")return;let U=$O(G(Object.freeze({observation:x,attribution:x3(N)})));await W(x,(D)=>Lx(J,x,U,D))}let B=ED({paths:J,quota:d$,...z?{now:z}:{},...Q?{refreshToken:Q}:{},...K?{resolveIdentity:K}:{},...TD({paths:J,externalPolicy:Y,...z?{now:z}:{}}),reconcile:V});function q(j,x){return{status:"refused",reason:j instanceof Y6?j.code:"authority-unavailable",persisted:x}}async function H(j){try{await sJ(J)}catch(N){return q(N,!1)}let x=await B.authorize(j);if(x.status!=="usable")return x;return sJ(J).then(()=>x,(N)=>q(N,x.source==="rotated"))}return Object.freeze({authorize:H})}var D3=new WeakMap,JO=0;function UK($){if(!$)return;let Z=D3.get($);if(Z===void 0)Z=++JO,D3.set($,Z);return Z}function XO($){let Z=$.env??process.env,J=X1($.host,Z),X=O2($.host,Z),Y=$.paths;return JSON.stringify([$.host,Y.storageId,...["legacyConfig","legacyState","config","state","runtime","journal","roster"].map((G)=>N9(Y[G])),N9(J.tokenPath),N9(J.statePath),N9(X)])}function O2($,Z){return N9(DG($==="pi"?Z.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE:void 0,$==="pi"?{...Z,OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE:void 0}:Z))}class M2{entries=new Map;acquire($,Z){let J=this.entries.get($);if(!J)J={runtime:Z(),users:0},this.entries.set($,J);let X=J;X.users++;let Y=!1;return{use:()=>{if(Y)throw new n("closed");return X.runtime},close:()=>{if(Y)return;if(Y=!0,--X.users!==0)return;if(this.entries.get($)===X)this.entries.delete($);X.runtime.close()}}}}var O3="Anthropic account update in progress; retry the request",xK=new WeakSet;class tJ extends Error{constructor(){super(O3);let $={name:"NativeTransientAccountError",message:O3,code:"ECONNRESET",syscall:"native-account-update"};for(let[Z,J]of Object.entries($))Object.defineProperty(this,Z,{value:J,enumerable:Z==="code"||Z==="syscall",writable:!1,configurable:!1});xK.add(this)}}function OF($){return typeof $==="object"&&$!==null&&xK.has($)}var YO=2000;async function GO($,Z,J,X=Date.now){let Y=performance.now(),G=()=>YO-(performance.now()-Y),z=[],Q="joined",K;try{for(let V of B1($)){for(;;){if(J(),G()<=0){Q="deadline";break}let B=await R0({path:V.path,name:V.name,ttlMs:y6.ttlMs,renew:!1,now:X});if(B)z.push(B);if(G()<=0){Q="deadline";break}if(B)break;await zO(Math.min(y6.retryMs,G()),Z)}if(Q==="deadline")break}}catch(V){K={error:V}}let W;for(let V of z.reverse()){let[B]=await Promise.allSettled([V.release()]);if(B.status==="rejected")W??={error:B.reason}}if(K)throw K.error;if(W)throw W.error;return J(),Q}function zO($,Z){if(Z.some((J)=>J.aborted))return Promise.resolve();return new Promise((J)=>{let X=()=>{clearTimeout(Y);for(let G of Z)G.removeEventListener("abort",X);J()},Y=setTimeout(X,$);for(let G of Z)G.addEventListener("abort",X,{once:!0})})}function K9($,Z,J,X){return KO($)===Z?VO(WO($),J):$.replace(/(?:\.json)?$/,`.${X}.json`)}function DK($){let Z=K9($.legacyConfig,"anthropic-auth.json","anthropic-auth-vault-settings.json","vault-settings"),J=K9($.legacyState,"anthropic-auth-state.json","anthropic-auth-vault-store-state.json","vault-store"),X=K9($.legacyState,"anthropic-auth-state.json","anthropic-auth-vault-state.json","vault-native"),Y=K9($.legacyState,"anthropic-auth-state.json","anthropic-auth-vault-roster.json","vault-roster"),G=K9($.legacyState,"anthropic-auth-state.json","anthropic-auth-vault-routing-state.json","vault-routing"),z=[Z,J,X,Y,G],Q=[$.legacyConfig,$.legacyState,$.config,$.state,$.runtime,$.journal,$.roster];if(new Set([...Q,...z]).size!==Q.length+z.length)throw Error("Vault storage overlaps local account storage");return{legacySeedConfig:$.legacyConfig,config:Z,state:J,runtime:X,roster:Y,routing:G,storageId:QO("sha256").update(JSON.stringify(["anthropic-vault",Z,J])).digest("hex")}}function jO($){switch($){case"roster-incomplete":case"unenrolled-local-row":case"roster-route-conflict":case"seed-conflict":return $;default:return"seed-conflict"}}class aJ extends Error{code;constructor($){let Z=jO($);super(`Native roster seed refused: ${Z}`);this.name="NativeRosterSeedError",this.code=Z}}function OK($){let Z={fallback:"seed-conflict"},J=(X)=>{throw Z.refused=X,new aJ(X)};try{return $(Z,J)}catch{throw new aJ(Z.refused??Z.fallback)}}function o6($){return typeof $==="string"&&$.trim()!==""}function vZ($,Z,J){if(typeof $!=="object"||$===null||qO.isProxy($))J(Z);return $}function fZ($,Z,J,X){let Y=Object.getOwnPropertyDescriptor($,Z);if(Y===void 0)return;if(Object.hasOwn(Y,"get")||Object.hasOwn(Y,"set"))X(J);return Y.value}function d0($,Z,J,X){let Y=vZ($,J,X),G={};for(let z of Z)G[z]=fZ(Y,z,J,X);return G}function nJ($,Z,J){let X=vZ($,Z,J);if(!Array.isArray(X))J(Z);let Y=fZ(X,"length",Z,J);if(typeof Y!=="number")J(Z);return Y}function h0($,Z,J){let X=vZ($,Z,J),Y=nJ(X,Z,J),G=[];for(let z=0;z<Y;z++)G.push(fZ(X,String(z),Z,J));return G}function MK($,Z,J){let X=vZ($,"seed-conflict",J),Y=(P,F)=>fZ(X,P,F,J);Z.fallback="roster-incomplete";let G=d0(Y("inventory","roster-incomplete"),["view","credentials","skipped"],"roster-incomplete",J),z=G.view,Q=h0(G.skipped,"roster-incomplete",J),K=h0(G.credentials,"roster-incomplete",J).map((P)=>d0(P,["credentialId","credentialType","accountIdentity","state"],"roster-incomplete",J));if(!o6(z)||Q.length>0)J("roster-incomplete");let W=new Map;for(let P of K){let{credentialId:F,credentialType:M,accountIdentity:R,state:k}=P;if(!o6(F)||!o6(R)||!o6(k)||W.has(F))J("roster-incomplete");W.set(F,{credentialType:M,accountIdentity:R,state:k})}let V=d0(Y("primary","roster-incomplete"),["credentialId","accountIdentity"],"roster-incomplete",J),B=V.credentialId,q=V.accountIdentity;Z.fallback="seed-conflict";let H=Y("primaryRouteId","seed-conflict"),j=h0(Y("legacyRows","seed-conflict"),"seed-conflict",J).map((P)=>d0(P,["routeId","scopedCredentialId","anthropicAccountUuid","label","addedAt","enabled"],"seed-conflict",J)),x=h0(Y("disabledAccountIdentities","seed-conflict"),"seed-conflict",J),N=h0(Y("reservedRouteIds","seed-conflict"),"seed-conflict",J);for(let P of[...x,...N])if(typeof P!=="string")J("seed-conflict");let U=new Set(x),D=new Set(N);function A(P,F){let M=W.get(P);if(M?.credentialType!=="oauth"||M.accountIdentity!==F)J("roster-incomplete");return M.state}if(!o6(B)||!o6(q))J("roster-incomplete");let I=A(B,q);for(let P of j)if(!o6(P.scopedCredentialId))J("unenrolled-local-row");let L=j.map((P)=>{let{scopedCredentialId:F,anthropicAccountUuid:M}=P;if(!o6(F)||!o6(M))J("roster-incomplete");return{row:P,credentialId:F,identity:M,state:A(F,M)}}),w=new Set;for(let P of[H,...j.map((F)=>F.routeId)]){if(!o6(P)||P==="main"||D.has(P)||w.has(P))J("roster-route-conflict");w.add(P)}if(!o6(H))J("roster-route-conflict");let S=new Set([B]),f=new Set([q]),d=L.map(({row:P,credentialId:F,identity:M,state:R})=>{if(S.has(F)||f.has(M))J("seed-conflict");S.add(F),f.add(M);let{routeId:k,label:v,addedAt:T,enabled:g}=P;if(!o6(k)||typeof g!=="boolean"||T!==void 0&&(typeof T!=="number"||!Number.isFinite(T))||v!==void 0&&typeof v!=="string")J("seed-conflict");return{routeId:k,credentialId:F,credentialType:"oauth",accountIdentity:M,state:R,label:o6(v)?v:k,enabled:g,addedAt:T??0}}),s=[{routeId:H,credentialId:B,credentialType:"oauth",accountIdentity:q,state:I,label:H,enabled:!U.has(q),addedAt:0},...d],_=s.filter((P)=>!P.enabled).map((P)=>({credentialId:P.credentialId,accountIdentity:P.accountIdentity,exactCredential:!0})),O=[...U].filter((P)=>!f.has(P)).sort();for(let P of O){let F=[...W].filter(([,M])=>M.accountIdentity===P).map(([M])=>M).sort()[0];if(F!==void 0)_.push({credentialId:F,accountIdentity:P,exactCredential:!1})}return{view:z,rows:s,declined:_,unseeded:new Set(O)}}function oJ($){return OK((Z,J)=>{let X=MK($,Z,J);return{version:1,view:X.view,complete:!0,rows:X.rows.map((Y)=>({...Y})),declined:X.declined.map(({credentialId:Y,accountIdentity:G})=>({credentialId:Y,accountIdentity:G}))}})}function HO($,Z){OK((J,X)=>{let Y=MK(Z,J,X);J.fallback="seed-conflict";let G=d0($,["version","complete","view","rejected","rows","declined"],"seed-conflict",X),{version:z,complete:Q,view:K,rejected:W}=G,V=h0(G.rows,"seed-conflict",X).map((N)=>d0(N,["routeId","credentialId","credentialType","accountIdentity","aliases","label","addedAt","enabled","stale","unclaimed"],"seed-conflict",X)),B=h0(G.declined,"seed-conflict",X).map((N)=>d0(N,["credentialId","accountIdentity"],"seed-conflict",X));if(z!==1||Q!==!0||typeof K!=="string"||W!==void 0&&nJ(W,"seed-conflict",X)>0||V.length!==Y.rows.length)X("seed-conflict");let q=new Map(Y.rows.map((N)=>[N.routeId,N])),H=new Set;for(let N of V){let U=typeof N.routeId==="string"?q.get(N.routeId):void 0;if(!U||H.has(U.routeId)||N.credentialId!==U.credentialId||N.credentialType!=="oauth"||N.accountIdentity!==U.accountIdentity||N.aliases!==void 0&&nJ(N.aliases,"seed-conflict",X)>0||N.label!==U.label||N.addedAt!==U.addedAt||N.enabled!==U.enabled||N.stale!==void 0||N.unclaimed!==void 0)X("seed-conflict");H.add(U.routeId)}let j=new Map(Y.declined.map((N)=>[N.accountIdentity,N])),x=new Set;for(let{credentialId:N,accountIdentity:U}of B){if(typeof N!=="string"||typeof U!=="string"||x.has(U))X("seed-conflict");let D=j.get(U);if(D?D.exactCredential&&N!==D.credentialId:!Y.unseeded.has(U))X("seed-conflict");x.add(U)}for(let N of j.keys())if(!x.has(N))X("seed-conflict")})}function IK($,Z,J){return{profile:{tier:$.tier,orgType:$.orgType,checkedAt:$.checkedAt,...$.accountIdentity!==void 0&&{accountIdentity:$.accountIdentity},...$.providerAccountUuid!==void 0&&{providerAccountUuid:$.providerAccountUuid}},persisted:Promise.resolve().then(Z).then((X)=>X?"saved":"refused",(X)=>X instanceof n||X instanceof Y6||X instanceof b&&X.code!=="runtime-io"?"refused":"failed"),isCurrent:()=>Promise.resolve().then(J).then((X)=>X,()=>!1)}}async function wF($,Z){let J={...$.env??process.env},X=O2($.host,J),Y=jK({host:$.host,readToken:$.readToken,now:$.now,env:J,connect:$.connect??(()=>R$.connect({connectionFile:X,identity:$.identity}))});try{return await Y.discover(Z)}finally{Y.close()}}function LO($){let Z=Object.freeze(DK($.paths)),J={...$.env??process.env},X=O2($.host,J),Y=$.identity?{...$.identity}:void 0,G=new AbortController,z=x0({paths:Z,quota:d$}),Q=jK({host:$.host,readToken:$.readToken,now:$.now,connect:$.connect??(()=>R$.connect({connectionFile:X,identity:Y})),env:J}),K=new WeakMap,W=new WeakSet,V=new Map,B=new Set(["main"]),q,H=new Set,j,x,N;function U(){let M=[...H].filter((k)=>k.intervalMs>0).sort((k,v)=>k.intervalMs-v.intervalMs)[0];if(N?.ms===M?.intervalMs)return;if(N)N.clear(N.handle);if(N=void 0,!M)return;let R=(M.setInterval??setInterval)(()=>{D().catch(()=>{})},M.intervalMs);R.unref?.(),N={handle:R,clear:M.clearInterval??clearInterval,ms:M.intervalMs}}function D(){if(x)return x;return x=(async()=>{let M=await Promise.all([...H].map(async(R)=>!R.shouldRefresh||await R.shouldRefresh()));if(G.signal.aborted||!M.some(Boolean))return;if(await s.refresh(G.signal),G.signal.aborted)return;for(let R of H)Promise.resolve().then(()=>{if(H.has(R))return R.onRefresh?.()}).catch(()=>{})})().finally(()=>{x=void 0}),x}function A(M){if(G.signal.aborted)throw new n("closed");M?.throwIfAborted()}function I(M){return A(M),AbortSignal.any([G.signal,...M?[M]:[]])}async function L(){A();let M=await O4($.host,J);return A(),M==="claustrum"}async function w(M){if(A(M),!await L())throw new n("route-unavailable");A(M)}async function S(M,R=!1){if(await w(M),R&&!await N4(Z.config))return;await O0(Z.roster,async(k,v)=>{if(R&&!await N4(Z.config))return{result:void 0};let T=k?.rows.find((C)=>(C.credentialId===o1||C.aliases?.includes(o1))&&C.credentialType==="oauth"&&C.state==="active"&&!C.stale&&!C.unclaimed&&typeof C.accountIdentity==="string"&&C.accountIdentity.length>0),g=await z.readSettings();if(g.status!=="ready")throw new n("invalid-state");let E=$Z(g.settings);if(!R&&(!T&&!E||T&&E?.routeId===T.routeId&&E.credentialId===o1&&E.accountIdentity===T.accountIdentity))return{result:void 0};return await x0({paths:Z,quota:d$,onStep:async(C)=>{if(C==="before-config-write"||C==="before-state-write")await w(M),await v.assertOwned()}}).updateSettings(async(C)=>{if(R&&!await N4(Z.config))return C;if(T)C.mainAccountId=T.routeId,C.claustrum={primaryAccount:{credentialId:o1,accountId:T.accountIdentity}};else delete C.mainAccountId,delete C.claustrum;return C}),{result:void 0}})}async function f(M,R){let k=await z.readSettings();if(k.status!=="ready")throw new n("invalid-state");let v=$Z(k.settings);return R==="main"||R===v?.routeId?hJ(M,v):M?.rows.find((T)=>T.routeId===R)}function d(M){A();let R=K.get(M);if(!R)throw new n("no-receipt");return R}let s={watch(M){if(A(),!Number.isFinite(M.intervalMs)||M.intervalMs<0)throw RangeError("Invalid native vault poll interval");let R={...M};H.add(R),U(),j??=D();let k=!1;return{ready:j,close(){if(k)return;if(k=!0,H.delete(R),U(),!H.size)j=void 0}}},initializeSettings:()=>S(void 0,!0),async read(){await w();let M=await l6(Z.roster);return A(),M},async refresh(M){if(A(M),!await L())return;return A(M),q??=qK({path:Z.roster,custody:$.discover?{discover:$.discover}:Q,signal:G.signal,isActive:L,projection:()=>({reservedRouteIds:B})}).then(async(R)=>{return await S(G.signal),R}).finally(()=>{q=void 0}),UO(q,I(M))},async authorize(M,R){let k=I(R);await w(k);let v=await l6(Z.roster)??await s.refresh(k),T=await f(v,M);if(T?.credentialType!=="oauth"||!T.accountIdentity)throw new n("route-unavailable");if(!T.enabled)throw new n("route-declined");if(T.state!=="active")throw new n("not-active");let g=await Q.authorize({credentialId:T.credentialId,accountIdentity:T.accountIdentity},k);await w(k);let E=await f(await l6(Z.roster),M);if(!E?.enabled||E.routeId!==T.routeId||E.accountIdentity!==T.accountIdentity||E.credentialId!==g.credentialId&&!E.aliases?.includes(g.credentialId))throw new n("identity-changed");if(E.state!=="active")throw new n("not-active");A(k),K.set(g,{routeId:T.routeId,logicalId:M});let h=JSON.stringify([T.routeId,g.credentialId,g.assertedAccountIdentity]);return V.set(h,Math.max(V.get(h)??0,g.recordVersion)),g},async reportFailure(M,R,k){d(M),await Q.reportFailure(M,R,k)},async prepareRetry(M,R,k){let v=d(M),T=async()=>{if(W.has(M))return[{retry:!1,reason:"version-not-newer"},void 0];W.add(M);let h;try{h=await s.authorize(v.logicalId,R)}catch(C){return A(R),[{retry:!1,reason:"reauthorize-failed",code:C instanceof n?C.code:"unavailable"},void 0]}if(h.credentialId!==M.credentialId)return[{retry:!1,reason:"credential-changed"},h];if(h.assertedAccountIdentity!==M.assertedAccountIdentity)return[{retry:!1,reason:"account-changed"},h];if(!(h.recordVersion>M.recordVersion))return[{retry:!1,reason:"version-not-newer"},h];return W.add(h),[{retry:!0,receipt:h},h]},[g,E]=await T();if(k)t.debug("claustrum","scoped 401 re-authorized",{site:k,credentialId:M.credentialId,servedVersion:M.recordVersion,currentVersion:E?.recordVersion??null,retry:g.retry,reason:g.retry?"rotated":g.reason});return g},publish(M,R){let k=uQ(R);return O(M,(v)=>pQ(v,k),NO(k)?"skip":"refuse")},resetBackoff(M,R="all"){return O(M,(k)=>{let v=Math.max($.now?.()??Date.now(),k.refreshErrorClearedAt??0,k.quotaErrorClearedAt??0,k.lastRefreshError?.checkedAt??0,k.lastQuotaRefreshError?.checkedAt??0),T={...k};if(R!=="quota")delete T.lastRefreshError,T.refreshErrorClearedAt=v;if(R!=="refresh")delete T.lastQuotaRefreshError,T.quotaErrorClearedAt=v,T.quotaErrorGeneration=(k.quotaErrorGeneration??0)+1;return T})},async getOrCreateAuthLineage(M){let R;return await O(M,(v)=>{return R=v.authLineageId??BO(),{...v,authLineageId:R}})?R:void 0},incrementPrimeUsage(M,R={}){let k=R.inputTokens??0,v=R.outputTokens??0;if(![k,v].every((T)=>Number.isSafeInteger(T)&&T>=0))throw new b("publication-refused");return O(M,(T)=>({...T,prime:{count:(T.prime?.count??0)+1,inputTokens:(T.prime?.inputTokens??0)+k,outputTokens:(T.prime?.outputTokens??0)+v,since:T.prime?.since??$.now?.()??Date.now()}}))},async fetchQuota(M,R=fetch,k,v){let T=await f(await s.read(),M),g=await c$(Z.runtime,Z.storageId),E=g.status==="ready"?g.state.accounts[T?.routeId??""]:void 0,h=(u)=>{let c=K.get(u),e=E?.binding;return c&&e?.kind==="custody"&&e.storageId===Z.storageId&&e.routeId===c.routeId&&e.credentialId===u.credentialId&&e.accountIdentity===u.assertedAccountIdentity&&e.recordVersion<=u.recordVersion?E:void 0},C=await P(M,R,k,(u,c)=>S4({accessToken:u.accessToken,fetchImpl:c,now:$.now}),async(u,c)=>{let e=h(c),H6=cQ(u,c.assertedAccountIdentity,Math.max($.now?.()??Date.now(),(e?.quotaErrorClearedAt??-1)+1),e?.lastQuotaRefreshError);if(H6)await s.publish(c,{lastQuotaRefreshError:H6})},v),y={...C.value,accountIdentity:C.receipt.assertedAccountIdentity},m=h(C.receipt);return await s.publish(C.receipt,{quota:y,quotaErrorClearedAt:Math.max(y.checkedAt??$.now?.()??Date.now(),m?.quotaErrorClearedAt??0,m?.lastQuotaRefreshError?.checkedAt??0)}),y},async fetchProfile(M,R=fetch,k){let v=await F(M,R,k);return await s.publish(v.receipt,{profile:v.value}),v.value},async fetchProfileForDisplay(M,R=fetch,k){let v=await F(M,R,k);return IK(v.value,()=>s.publish(v.receipt,{profile:v.value}),_(v.receipt))},async setEnabled(M,R){await w();let k=await l6(Z.roster),v=await f(k,M);if(!v)throw new n("route-unavailable");return O0(Z.roster,(T)=>{let g=T?.rows.find((E)=>E.routeId===v.routeId);if(!T||!g)throw new r("route-unavailable","Claustrum route is not in the roster");return{next:{...T,declined:R?BK(T.declined,[g.credentialId,...g.aliases??[]],g.accountIdentity):VK(T.declined,g.credentialId,g.accountIdentity),rows:T.rows.map((E)=>E===g?{...E,enabled:R}:E)},result:g.enabled!==R}})},close(){if(H.clear(),U(),G.signal.aborted)return;G.abort(new n("closed")),Q.close()}};function _(M){let{routeId:R,logicalId:k}=d(M),v={routeId:R,logicalId:k,credentialId:M.credentialId,accountIdentity:M.assertedAccountIdentity,recordVersion:M.recordVersion},T=JSON.stringify([R,v.credentialId,v.accountIdentity]);return async()=>{await w();let g=await f(await l6(Z.roster),v.logicalId);if(!g?.enabled||g.state!=="active"||g.routeId!==v.routeId||g.accountIdentity!==v.accountIdentity||g.credentialId!==v.credentialId&&!g.aliases?.includes(v.credentialId)||(V.get(T)??0)>v.recordVersion)return!1;let E=await c$(Z.runtime,Z.storageId);if(E.status==="missing")return!0;if(E.status!=="ready")return!1;let h=E.state.accounts[v.routeId]?.binding;return!h||h.kind==="custody"&&h.accountIdentity===v.accountIdentity&&h.credentialId===v.credentialId&&h.recordVersion<=v.recordVersion}}async function O(M,R,k="refuse"){let v=d(M);await w();let T=JSON.stringify([v.routeId,M.credentialId,M.assertedAccountIdentity]);if((V.get(T)??0)>M.recordVersion)return!1;return O0(Z.roster,async(g,E)=>{let h=await f(g,v.logicalId);if(!h?.accountIdentity||h.routeId!==v.routeId||h.accountIdentity!==M.assertedAccountIdentity||h.credentialId!==M.credentialId&&!h.aliases?.includes(M.credentialId))return{result:!1};let C=h.accountIdentity,y=!1;try{if((await zx(Z.runtime,Z.storageId,(u)=>{let c=u.accounts[v.routeId],e=c?.binding;if(e?.kind==="custody"&&e.credentialId===M.credentialId&&e.accountIdentity===M.assertedAccountIdentity&&e.recordVersion>M.recordVersion)throw new b("runtime-conflict");let H6=e?.kind==="custody"&&e.accountIdentity===M.assertedAccountIdentity;return u.accounts[v.routeId]=R({...H6?c:{},binding:{kind:"custody",storageId:Z.storageId,routeId:v.routeId,credentialId:M.credentialId,accountIdentity:C,recordVersion:M.recordVersion}}),y=!0,u},{beforeRename:async()=>{await w();let u=await f(g,v.logicalId);if(!u||u.routeId!==v.routeId||u.accountIdentity!==M.assertedAccountIdentity)throw new b("publication-refused");let c=(V.get(T)??0)>M.recordVersion;if(c&&k==="refuse")throw new b("runtime-conflict");return await E.assertOwned(),c?"skip":"publish"}})).status==="skipped")return{result:!1}}catch(m){if(m instanceof b&&m.code==="runtime-conflict")return{result:!1};throw m}return{result:y}})}async function P(M,R,k,v,T,g){let E=I(k),h=await s.authorize(M,E),C=(c,e)=>{let H6=()=>R(c,{...e,signal:E});if(!g)return H6();return g(H6,async()=>{await w(E);let V6=d(h),i6=await f(await l6(Z.roster),V6.logicalId),t8=JSON.stringify([V6.routeId,h.credentialId,h.assertedAccountIdentity]);if(!i6?.enabled||i6.state!=="active"||i6.routeId!==V6.routeId||i6.accountIdentity!==h.assertedAccountIdentity||i6.credentialId!==h.credentialId&&!i6.aliases?.includes(h.credentialId)||(V.get(t8)??h.recordVersion)>h.recordVersion)throw new n("identity-changed");await w(E)})},y,m=Object.assign(async(c,e)=>{y=void 0;let H6=await C(c,e);if(y=H6.status,H6.status===401&&!E.aborted){await H6.body?.cancel().catch(()=>{});let V6=(EZ)=>s.reportFailure(EZ,401,"direct").catch(()=>{A(E)}),i6=h,t8;try{t8=await s.prepareRetry(i6,E,"quota-profile")}catch(EZ){throw await V6(i6),EZ}if(!t8.retry)return await V6(i6),H6;h=t8.receipt;let w2=new Headers(e?.headers);if(w2.set("authorization",`Bearer ${h.accessToken}`),y=void 0,H6=await C(c,{...e,headers:w2}),y=H6.status,H6.status===401)await V6(h)}return H6},{preconnect:R.preconnect}),u;try{u=await v(h,m)}catch(c){A(E);let e=c instanceof n||c instanceof b?c:dQ(c,y);throw await T?.(e,h),e}return A(E),{value:u,receipt:h}}function F(M,R,k){return P(M,R,k,(v,T)=>gz({accessToken:v.accessToken,accountIdentity:v.assertedAccountIdentity,fetchImpl:T,now:$.now,signal:k}))}return s}function NO($){let Z=Object.keys($);return Z.length===1&&Z[0]==="lastUsed"&&typeof $.lastUsed==="number"}function UO($,Z){return new Promise((J,X)=>{let Y=()=>{G(),X(Z.reason)},G=()=>Z.removeEventListener("abort",Y);if(Z.addEventListener("abort",Y,{once:!0}),$.then((z)=>{G(),Z.aborted?X(Z.reason):J(z)},(z)=>{G(),X(z)}),Z.aborted)Y()})}var xO=new M2;function _K($){return JSON.stringify([XO($),$.identity?Object.entries($.identity).sort(([Z],[J])=>Z.localeCompare(J)):void 0,...[$.connect,$.discover,$.readToken,$.now].map(UK)])}function DO($){let{use:Z,close:J}=xO.acquire(_K($),()=>LO($));return PK(Z,J)}function PK($,Z){let J=new Set;return{watch:(X)=>{let Y=$().watch(X);return J.add(Y),{ready:Y.ready,close(){J.delete(Y),Y.close()}}},initializeSettings:()=>$().initializeSettings(),read:()=>$().read(),refresh:(X)=>$().refresh(X),authorize:(X,Y)=>$().authorize(X,Y),reportFailure:(X,Y,G)=>$().reportFailure(X,Y,G),prepareRetry:(X,Y,G)=>$().prepareRetry(X,Y,G),publish:(X,Y)=>$().publish(X,Y),fetchQuota:(X,Y,G,z)=>$().fetchQuota(X,Y,G,z),fetchProfile:(X,Y,G)=>$().fetchProfile(X,Y,G),fetchProfileForDisplay:(X,Y,G)=>$().fetchProfileForDisplay(X,Y,G),setEnabled:(X,Y)=>$().setEnabled(X,Y),resetBackoff:(X,Y)=>$().resetBackoff(X,Y),getOrCreateAuthLineage:(X)=>$().getOrCreateAuthLineage(X),incrementPrimeUsage:(X,Y)=>$().incrementPrimeUsage(X,Y),close(){for(let X of J)X.close();J.clear(),Z()}}}var RK="main",FO=900000,M3=604800000,CO=3600000,SO=1e4,kO=5000,vO=10,I3=4096,fO=0.000001;function CF($){let Z=$.modelId,J=Z?$.routeQuotas.map((q)=>o$(q,Z)).find(Boolean)?.modelName:void 0,X;if(T4($.mainRefreshError))X=J?`Main Claude OAuth account requires re-login, and no fallback OAuth account is currently routable for ${J}.`:"Main Claude OAuth account requires re-login, and no fallback OAuth account is currently routable.";else if($.fallbackReauthLabels?.length)X=`No OAuth account is currently routable${J?` for ${J}`:""}. Fallback Claude OAuth accounts require re-login: ${$.fallbackReauthLabels.join(", ")}.`;if(X)return new Response(JSON.stringify({type:"error",error:{type:"authentication_error",message:X}}),{status:401,headers:{"content-type":"application/json"}});let Y=Boolean(Z&&$.routeQuotas.length>0&&$.routeQuotas.every((q)=>!gG(q,Z))),[G,...z]=$.routeQuotas,Q=FB(G,z.map((q)=>({quota:q})),$.now??Date.now(),Y?Z:void 0),K=Math.floor(Q/60),W=Q%60,B=`${Y&&J?`${J} weekly limit reached, no routable OAuth accounts.`:"No OAuth account currently satisfies sticky-balanced quota policy."} Retry in ${K}m ${W}s.`;return new Response(JSON.stringify({type:"error",error:{type:"rate_limit_error",message:B}}),{status:429,headers:{"content-type":"application/json","retry-after":String(Q)}})}function M0($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function U9($){return typeof $==="number"&&Number.isFinite($)?$:void 0}function TK($){if(!M0($))return;if(typeof $.accountId!=="string"||!["fable","opus","general"].includes(String($.family)))return;let Z=U9($.assignedAt),J=U9($.lastSeenAt),X=U9($.initialInputBytes),Y=U9($.quotaCheckedAt);if(Z===void 0||J===void 0||X===void 0||Y===void 0)return;if(Object.hasOwn($,"affinityModelId")&&typeof $.affinityModelId!=="string")return;if(Object.hasOwn($,"accountIdentity")&&(typeof $.accountIdentity!=="string"||$.accountIdentity.length===0||$.accountIdentity.trim()!==$.accountIdentity))return;return{accountId:$.accountId,...typeof $.accountIdentity==="string"?{accountIdentity:$.accountIdentity}:{},family:$.family,affinityModelId:typeof $.affinityModelId==="string"?$.affinityModelId:void 0,assignedAt:Z,lastSeenAt:J,initialInputBytes:Math.max(0,X),quotaCheckedAt:Y}}function FK($){if(!M0($)||$.version!==1||!M0($.assignments))return;let Z={};for(let[J,X]of Object.entries($.assignments)){let Y=TK(X);if(Y)Z[J]=Y}return{version:1,updatedAt:U9($.updatedAt)??0,assignments:Z,...$.vaultLegacySeed==="pending"||$.vaultLegacySeed==="complete"?{vaultLegacySeed:$.vaultLegacySeed}:{}}}function EO($,Z){try{if(!M0($)||!M0($.assignments))throw Error();let J=Object.entries($.assignments),X=FK({...$,assignments:Object.fromEntries(J.map(([,G],z)=>[String(z),G]))});if(!X||Object.keys($).length!==3||!Object.hasOwn($,"version")||!Object.hasOwn($,"updatedAt")||!Object.hasOwn($,"assignments")||!Object.is($.updatedAt,X.updatedAt))throw Error();for(let G of Z.values())if(typeof G!=="string"||G.length===0||G.trim()!==G)throw Error();let Y=Object.create(null);for(let[G,[z,Q]]of J.entries()){let K=X.assignments[String(G)];if(!M0(Q)||!K)throw Error();let W=Object.keys(K).filter((B)=>B!=="affinityModelId"||Object.hasOwn(Q,"affinityModelId"));if(Object.keys(Q).length!==W.length||W.some((B)=>!Object.hasOwn(Q,B)||!Object.is(Q[B],Reflect.get(K,B))))throw Error();let V=Z.get(K.accountId);if(V===void 0)continue;Y[z]={...K,accountId:V}}return`${JSON.stringify({...X,assignments:Y},null,2)}
+`}catch{throw Error("invalid-source")}}function _3($){return{version:1,updatedAt:$,assignments:{}}}function P3($){return AK("sha256").update($).digest("hex")}function CK($,Z,J=Date.now(),X){let Y=M9(Z);if(!["five_hour","seven_day"].every((Q)=>{let K=$?.[Q];return Boolean(K&&J-K.checkedAt<Y)}))return!1;let z=o$($,X);return!z||J-z.checkedAt<Y}function A3($){return Math.max($.checkedAt??0,$.five_hour?.checkedAt??0,$.seven_day?.checkedAt??0,...($.scoped??[]).map((Z)=>Z.checkedAt??0))}function C8($){if(!$)return;if("kind"in $)return $.kind==="known"?$.quota:void 0;return $}function w3($,Z,J){let X=D5($),Y=J==="five_hour"?X.five_hour:J==="seven_day"?X.seven_day:0;if(!yG($))return Y;let G=hG($,Z===RK?void 0:Z);return Math.max(Y,G[J])}function R3($,Z,J,X){let Y=Math.max(0,$-Z);if(Y<=0)return 0;if(!J)return Y;let G=Date.parse(J);if(!Number.isFinite(G)||G<=X)return Y;let z=Math.max((G-X)/3600000,0.016666666666666666);return Y/z}function SF($){if(lL($))return"fable";return typeof $==="string"&&$.toLowerCase().includes("opus")?"opus":"general"}function T3($){let Z=$.now??Date.now(),{candidate:J,storage:X}=$,Y=C8(J.quota);if(!Y)return 0;if(!CK(Y,X,Z,$.modelId))return 0;let G=[];for(let z of["five_hour","seven_day"]){let Q=Y[z];if(!Q||!Number.isFinite(Q.remainingPercent))return 0;G.push(R3(Q.remainingPercent,w3(X,J.accountId,z),Q.resetsAt,Z))}if($.family==="fable"){let z=o$(Y,$.modelId);if(z&&Number.isFinite(z.remainingPercent))G.push(R3(z.remainingPercent,w3(X,J.accountId,"scoped"),z.resetsAt,Z))}return Math.min(...G)}function bO($,Z,J=Date.now()){let X=C8($.quota),Y=o$(X,"claude-fable-5");return Boolean(Y&&CK(X,Z,J,"claude-fable-5")&&Number.isFinite(Y.remainingPercent)&&Y.remainingPercent<=0)}function kF($){let Z=$.now??Date.now(),J=C8($.quota);if(!J)return{action:"retain",reason:"unknown"};let X=o$(J,$.modelId);if(X&&Number.isFinite(X.remainingPercent)&&X.remainingPercent<=0)return{action:"migrate",reason:"model-scoped"};let Y=J.seven_day;if(Y&&Number.isFinite(Y.remainingPercent)&&Y.remainingPercent<=0)return{action:"migrate",reason:"seven-day"};let G=J.five_hour;if(G&&Number.isFinite(G.remainingPercent)&&G.remainingPercent<=0){let z=G.resetsAt?Date.parse(G.resetsAt):NaN;if(Number.isFinite(z)&&z>Z&&z-Z<=FO)return{action:"hold",reason:"five-hour-short-reset",retryAfterSeconds:Math.max(1,Math.ceil((z-Z)/1000))};return{action:"migrate",reason:"five-hour"}}return{action:"retain",reason:"not-exhausted"}}function gO($){let Z=RO($),J=Z.endsWith(".json")?Z.slice(0,-5):Z;return TO(wK($),`${J}-routing-state.json`)}function vF($,Z){let J=AK("sha256").update($).digest().readUInt32BE(0);return Math.max(1,Math.ceil(Z))+J%21}class SK{options;loaded=!1;state;stateMtimeNs;touchChain=Promise.resolve();seedFinalized=!1;constructor($){this.options=$,this.state=_3(this.now())}now(){return this.options.now?.()??Date.now()}async readState(){try{let $=await IO(this.options.path,"utf8"),Z=FK(JSON.parse($));if(!Z)throw Error(`Invalid sticky routing state at ${this.options.path}`);return Z}catch($){if($.code==="ENOENT")return{..._3(this.now()),...this.options.vaultSeed?{vaultLegacySeed:"pending"}:{}};throw $}}async readStateMtimeNs(){try{return(await AO(this.options.path,{bigint:!0})).mtimeNs}catch($){if($.code==="ENOENT")return 0n;throw $}}async refreshStateIfChanged(){for(let $=0;$<3;$++){let Z=await this.readStateMtimeNs();if(this.loaded&&Z===this.stateMtimeNs)return;let J=await this.readState(),X=await this.readStateMtimeNs();if(Z!==X)continue;this.state=J,this.stateMtimeNs=X,this.loaded=!0;return}this.state=await this.readState(),this.stateMtimeNs=await this.readStateMtimeNs(),this.loaded=!0}async acquireLock(){await MO(wK(this.options.path),{recursive:!0,mode:448});let $=this.now()+kO;while(!0){let Z=await b9({name:"write",path:this.options.path,ttlMs:SO,renew:!0});if(Z)return Z;if(this.now()>=$)throw Error("Timed out acquiring sticky routing state lock");await new Promise((J)=>setTimeout(J,vO))}}assignmentIsActive($){return $.lastSeenAt>=this.now()-(this.options.assignmentTtlMs??M3)}prune($){let Z=this.now()-(this.options.assignmentTtlMs??M3);for(let[X,Y]of Object.entries($.assignments))if(Y.lastSeenAt<Z)delete $.assignments[X];let J=Object.entries($.assignments);if(J.length<=I3)return;J.sort((X,Y)=>Y[1].lastSeenAt-X[1].lastSeenAt).slice(I3).forEach(([X])=>{delete $.assignments[X]})}async writeState($,Z,J=!0){if(J)this.prune($);$.updatedAt=this.now();let X=`${this.options.path}.${OO()}.tmp`;try{await wO(X,`${JSON.stringify($)}
+`,{mode:384}),await Z(),await _O(X,this.options.path)}finally{await PO(X,{force:!0}).catch(()=>{})}this.state=$,this.stateMtimeNs=await this.readStateMtimeNs(),this.loaded=!0}async writeResolutionState($,Z,J){let X=!1;try{await this.writeState($,async()=>{try{await Z()}catch(Y){throw X=!0,Y}})}catch(Y){if(!X)throw Y;t.warn("sticky-routing","assignment write refused",{operation:J,reason:"ownership-lost"})}}async prepareLegacySeed($){let Z=this.options.vaultSeed;if(!Z||this.seedFinalized)return;try{await this.refreshStateIfChanged()}catch{this.seedFinalized=!0;return}if(this.state.vaultLegacySeed!=="pending"){this.seedFinalized=!0;return}let J=$===void 0?await l6(Z.roster):$;if(!J?.complete)return;let X=await this.acquireLock();try{let Y=await this.readState();if(Y.vaultLegacySeed!=="pending"){this.seedFinalized=!0;return}let G=await EJ(Z.legacyConfig),z=oU(G,J),Q=await EJ(gO(Z.legacyConfig));if(M0(Q)&&Q.version===1&&M0(Q.assignments))for(let[K,W]of Object.entries(Q.assignments)){if(!/^[0-9a-f]{64}$/.test(K)||Object.hasOwn(Y.assignments,K))continue;let V=TK(W),B=V&&z.get(V.accountId);if(V&&B)Y.assignments[K]={...V,accountId:B.routeId,accountIdentity:B.accountIdentity}}Y.vaultLegacySeed="complete",await this.writeState(Y,()=>X.assertOwned(),!1),this.seedFinalized=!0}finally{await X.release()}}logicalAccountId($){return $.accountId===this.options.vaultSeed?.mainRouteId?RK:$.accountId}setVaultSeed($){this.options.vaultSeed=$}scheduleTouch($){this.touchChain=this.touchChain.catch(()=>{}).then(async()=>{let Z=await this.acquireLock();try{let J=await this.readState(),X=J.assignments[$];if(!X)return;X.lastSeenAt=this.now(),await this.writeState(J,()=>Z.assertOwned())}finally{await Z.release()}}).catch(()=>{})}selectCandidate($){let Z=[...$.candidates];if($.family==="opus"){let Y=Z.filter((G)=>bO(G,$.storage,this.now()));if(Y.length>0)Z=Y}let J=Z.flatMap((Y)=>{let G=T3({candidate:Y,family:$.family,modelId:$.modelId,storage:$.storage,now:this.now()});return G>0?[{candidate:Y,weight:G}]:[]});if(J.length===0&&Z.every((Y)=>!C8(Y.quota)))return[...Z].sort((Y,G)=>Y.order-G.order||Y.accountId.localeCompare(G.accountId))[0];let X=new Map;for(let Y of Object.values($.state.assignments)){let G=J.find((Q)=>Q.candidate.accountId===this.logicalAccountId(Y))?.candidate;if(!G)continue;let z=C8(G.quota);if(z&&Y.quotaCheckedAt!==A3(z))continue;X.set(this.logicalAccountId(Y),(X.get(this.logicalAccountId(Y))??0)+Y.initialInputBytes)}return J.map(({candidate:Y,weight:G})=>({candidate:Y,score:((X.get(Y.accountId)??0)+$.inputBytes)/Math.max(G,fO)})).sort((Y,G)=>Y.score-G.score||Y.candidate.order-G.candidate.order||Y.candidate.accountId.localeCompare(G.candidate.accountId))[0]?.candidate}async resolve($){if(!$.sessionId)return null;await this.prepareLegacySeed(),await this.refreshStateIfChanged();let Z=P3($.sessionId),J=$.affinityModelId??$.modelId,X=(K)=>J!==void 0?K.affinityModelId===J:K.family===$.family,Y=(K)=>{let W=$.accountIdentities?.get(K);return typeof W==="string"&&W.length>0&&W.trim()===W?W:void 0},G=(K)=>{if(!$.accountIdentities)return!0;let W=Y(this.logicalAccountId(K));return W!==void 0&&K.accountIdentity===W},z=this.state.assignments[Z];if(z&&this.assignmentIsActive(z)&&X(z)&&G(z)&&$.retainAccountIds.has(this.logicalAccountId(z))&&!$.excludeAccountIds?.has(this.logicalAccountId(z))){if(this.now()-z.lastSeenAt>=CO)z.lastSeenAt=this.now(),this.scheduleTouch(Z);return{accountId:this.logicalAccountId(z),assignment:{...z},created:!1,migrated:!1}}let Q=await this.acquireLock();try{let K=await this.readState();this.prune(K);let W=K.assignments[Z];if(W&&X(W)&&G(W)&&$.retainAccountIds.has(this.logicalAccountId(W))&&!$.excludeAccountIds?.has(this.logicalAccountId(W)))return W.lastSeenAt=this.now(),await this.writeResolutionState(K,()=>Q.assertOwned(),"touch"),{accountId:this.logicalAccountId(W),assignment:{...W},created:!1,migrated:!1};let V=Boolean(W&&!X(W)),B=Boolean(W&&!G(W));if(V||B)delete K.assignments[Z];let q=$.candidates.filter((D)=>!$.excludeAccountIds?.has(D.accountId)&&(!$.accountIdentities||Y(D.accountId)!==void 0)),j=(!V&&!B&&$.preferredAccountId?q.find((D)=>D.accountId===$.preferredAccountId&&T3({candidate:D,family:$.family,modelId:$.modelId,storage:$.storage,now:this.now()})>0):void 0)??this.selectCandidate({...$,candidates:q,state:K});if(!j){if(W)delete K.assignments[Z],await this.writeResolutionState(K,()=>Q.assertOwned(),"delete");return null}let x=this.now(),N=C8(j.quota),U={accountId:j.accountId,...$.accountIdentities?{accountIdentity:Y(j.accountId)}:{},family:$.family,affinityModelId:J,assignedAt:x,lastSeenAt:x,initialInputBytes:Math.max(1,$.inputBytes),quotaCheckedAt:N?A3(N):0};return K.assignments[Z]=U,await this.writeResolutionState(K,()=>Q.assertOwned(),"assign"),{accountId:j.accountId,assignment:{...U},created:!W,migrated:Boolean(W&&(B||W.accountId!==j.accountId))}}finally{await Q.release()}}async clear($){if(!$)return;let Z=P3($),J=await this.acquireLock();try{let X=await this.readState();if(!(Z in X.assignments))return;delete X.assignments[Z],await this.writeState(X,()=>J.assertOwned())}finally{await J.release()}}}var yO=new M2;function fF($){let Z=JSON.stringify([_K({...$.vault,paths:$.paths,host:$.host}),...[$.beforePoolWrite,$.local?.refreshToken,$.local?.resolveIdentity,$.local?.failurePolicy,$.local?.now].map(UK)]),{use:J,close:X}=yO.acquire(Z,()=>hO($)),Y=PK(()=>J().vault,X);return{vault:Y,getRelayConfig:()=>J().getRelayConfig(),updateRelay:(G)=>J().updateRelay(G),read:()=>J().read(),authorizeLocal:(G,z)=>J().authorizeLocal(G,z),authorizeApi:(G,z)=>J().authorizeApi(G,z),authorizeVault:(G,z)=>J().authorizeVault(G,z),loginOAuth:(G)=>J().loginOAuth(G),putAccount:(G)=>J().putAccount(G),addApi:(G)=>J().addApi(G),updateSettings:(G)=>J().updateSettings(G),setLoggingLevel:(G)=>J().setLoggingLevel(G),setEnabled:(G,z)=>J().setEnabled(G,z),remove:(G)=>J().remove(G),reorder:(G,z)=>J().reorder(G,z),captureLocalSubject:(G)=>J().captureLocalSubject(G),publishLocal:(G,z)=>J().publishLocal(G,z),publishApi:(G,z)=>J().publishApi(G,z),resetBackoff:(G,z,Q)=>J().resetBackoff(G,z,Q),getOrCreateAuthLineage:(G,z)=>J().getOrCreateAuthLineage(G,z),incrementPrimeUsage:(G,z,Q)=>J().incrementPrimeUsage(G,z,Q),fetchQuota:(G,z,Q,K)=>J().fetchQuota(G,z,Q,K),fetchProfile:(G,z,Q)=>J().fetchProfile(G,z,Q),fetchProfileForDisplay:(G,z,Q)=>J().fetchProfileForDisplay(G,z,Q),close:()=>Y.close()}}function EF($,Z,J){if(!$.enabled)return{status:"blocked",reason:"account-disabled"};if(!TB($.quota,Z.policyStorage)||!gG($.quota,J)||!mG($.quota,Z.policyStorage,$.id==="main"?void 0:$.id,J))return{status:"blocked",reason:"quota-ineligible"};return{status:"allowed"}}function hO($){let Z=Object.freeze({...$.paths}),J=$.local?.now??$.vault?.now??Date.now,X={...$.vault?.env??process.env},Y=DK(Z),G={legacyConfig:Z.legacyConfig,roster:Y.roster},z=new SK({path:Y.routing,vaultSeed:G,now:J}),Q,K=x0({paths:Y,quota:d$,now:J,onStep:async(_)=>{if(_==="before-config-write"||_==="before-state-write")await j("claustrum")}}),W=new AbortController,V=x0({paths:Z,quota:d$,now:J,onStep:async(_)=>{if(_==="before-config-write"||_==="before-state-write"){if($.beforePoolWrite)await x(),await $.beforePoolWrite();await x()}}}),B=DO({...$.vault,paths:Z,host:$.host});function q(_){if(W.signal.aborted)throw new n("closed");_?.throwIfAborted()}async function H(_){q(_);let O=await O4($.host,X);if(O==="local")await sJ(Z),O=await O4($.host,X);return q(_),O}async function j(_,O){if(await H(O)!==_)throw new n("route-unavailable")}async function x(_){await j("local",_)}async function N(){let _=await H();return{mode:_,paths:_==="claustrum"?Y:Z,store:_==="claustrum"?K:V}}async function U(_){let O=await V.read();if(O.status!=="ready")throw new b("publication-refused");return O.rows.find((P)=>P.id===_)}async function D(_){if(_!=="main")return _;let O=await V.readSettings();if(O.status!=="ready"||typeof O.settings.mainAccountId!=="string")throw new n("route-unavailable");return O.settings.mainAccountId}async function A(_,O,P=!0){if(await H()!=="local")return!1;let F=_.binding,M=async()=>{let v=await U(F.rowId);if(!v||!U$(F,Z,v)||v.stamp!=="bound"||!v.credential)return!1;if(P==="binding")return v.credential.type===("kind"in _?"api":"oauth");if("kind"in _)return v.credential.type==="api"&&I6(v.credential)===_.credentialFingerprint&&v.credential.baseURL===_.baseURL&&v.credential.authHeader===_.authHeader;if(v.credential.type!=="oauth"||I6(v.credential)!==_.credentialFingerprint)return!1;return!P||c0(_,F,v.credential)},[R,k]=B1(Z);try{return await d6(R.path,{...y6,name:R.name},async(v)=>d6(k.path,{...y6,name:k.name},async(T)=>{if(!await M())return!1;return await gJ(Z.runtime,Z.storageId,(g)=>{let E=g.accounts[F.rowId],h=E?.binding,C=h?.kind==="local"&&h.rowId===F.rowId&&h.identity===F.identity&&h.credentialEpoch===F.credentialEpoch;return g.accounts[F.rowId]=O(C&&E?E:{binding:F},E),g},{beforeRename:async()=>{if(!await M())throw new b("publication-refused");await v.assertOwned(),await T.assertOwned(),await x()},beforePublish:()=>x()}),!0}))}catch(v){if(v instanceof b&&v.code==="runtime-conflict"||v instanceof n&&v.code==="route-unavailable")return!1;throw v}}async function I(_){let O=await U(_);if(!O?.credential||O.credentialEpoch===void 0)throw new b("publication-refused");let P={kind:"local",storageId:Z.storageId,rowId:O.id,credentialEpoch:O.credentialEpoch,...O.identity!==void 0?{identity:O.identity}:{}},F=O.credential.type==="api"?{kind:"api",binding:P,credentialFingerprint:I6(O.credential),baseURL:O.credential.baseURL,authHeader:O.credential.authHeader}:{binding:P,credentialFingerprint:I6(O.credential),version:{}};if(!await A(F,(R,k)=>{let v=k?.binding;if(v?.kind==="local"&&v.credentialEpoch===P.credentialEpoch&&v.identity===P.identity)return R;let T=v?.kind==="local"&&v.rowId===P.rowId&&P.identity!==void 0&&v.identity===P.identity,g={binding:P,...O.credential?.type==="oauth"?{authLineageId:s1()}:{}};if(T&&k){for(let E of["prime","profile","lastUsed","lastQuotaRefreshError","quotaErrorClearedAt","quotaErrorGeneration"])if(k[E]!==void 0)Object.assign(g,{[E]:k[E]})}return g},"binding"))throw new b("publication-refused")}async function L(){let _=await H();if(_==="claustrum")Q??=B.initializeSettings().catch((T)=>{throw Q=void 0,T}),await Q;let O=_==="claustrum"?Y:Z,P=_==="claustrum"?K:V,[F,M,R]=await Promise.all([P.read(),P.readSettings(),c$(O.runtime,O.storageId)]);if(F.status!=="ready"||M.status!=="ready")throw new b("publication-refused");let k=_==="claustrum"?await B.read():void 0;q();let v=xx({paths:{...Z,...O},rows:F.rows,settings:{...M.settings,claustrum:{...M.settings.claustrum,mode:_}},runtime:R.status==="ready"?R.state:void 0,roster:k});if(_==="claustrum")G.mainRouteId=typeof M.settings.mainAccountId==="string"?M.settings.mainAccountId:void 0,await z.prepareLegacySeed(k??null),v.routingPath=Y.routing,v.routingSeed={...G};return{snapshot:v,rows:F.rows,settings:M.settings,runtime:R.status==="ready"?R.state:void 0}}let w=new WeakMap;function S(_,O){let P=w.get(_);return P!==void 0&&Ux(Z,P.rows,P.settings,O,P.runtime)}let f={vault:B,async getRelayConfig(){let{mode:_,paths:O,store:P}=await N();return d6(O.config,{...y6,name:"native-relay"},async(F)=>{let M=await P.readSettings();if(M.status!=="ready")throw new b("publication-refused");let R=b7(M.settings.relay),k=await c$(O.runtime,O.storageId),v=k.status==="ready"?k.state.relay?.token:void 0;if(await j(_),await F.assertOwned(),!R.enabled||!R.url||!v)return null;return{...R,token:v}})},async updateRelay(_){let O=yJ(_);if(!O||typeof O!=="object"||Array.isArray(O)||Object.keys(O).some((R)=>!["enabled","url","token","fallbackToDirect","transport"].includes(R)))throw new b("publication-refused");for(let R of["enabled","fallbackToDirect"])if(O[R]!==void 0&&typeof O[R]!=="boolean")throw new b("publication-refused");if(O.url!==void 0&&typeof O.url!=="string")throw new b("publication-refused");if(O.transport!==void 0&&!["http","websocket"].includes(O.transport))throw new b("publication-refused");if(O.token!==void 0&&O.token!==null&&(typeof O.token!=="string"||!O.token.trim()||/\p{Cc}/u.test(O.token)))throw new b("publication-refused");let{mode:P,paths:F,store:M}=await N();await d6(F.config,{...y6,name:"native-relay"},async(R)=>{let k=await M.readSettings();if(k.status!=="ready")throw new b("publication-refused");let v=b7(k.settings.relay),T=await c$(F.runtime,F.storageId),g=O.token===void 0?T.status==="ready"?T.state.relay?.token:void 0:O.token?.trim(),E=b7({...v,...O,enabled:O.token===null?!1:O.enabled??v.enabled});if(E.enabled&&(!E.url||!g))throw new b("publication-refused");async function h(C){await M.updateSettings(async(y)=>{await j(P),await R.assertOwned(),y.relay=C})}if(await h({...v,enabled:!1}),O.token!==void 0)await gJ(F.runtime,F.storageId,(C)=>{if(g)C.relay={token:g};else delete C.relay;return C},{beforeRename:async()=>{await j(P),await R.assertOwned()}});await h(E)})},async read(){let _=await L();return w.set(_.snapshot,_),_.snapshot},async authorizeLocal(_,O={}){await H(O.signal);let P=await f.read(),F=P.accounts.find((E)=>E.id===_);if(P.mode!=="local")return{status:"refused",reason:"custody-mode",persisted:!1};if(!F?.binding&&S(P,_)){if(t.debug("native-auth","waiting for an account write to finish",{phase:"waiting"}),await GO(Z,O.signal?[W.signal,O.signal]:[W.signal],()=>q(O.signal),J)==="deadline")throw t.warn("native-auth","account write did not finish in time",{outcome:"deadline"}),new tJ;if(P=await f.read(),F=P.accounts.find((h)=>h.id===_),P.mode!=="local")return{status:"refused",reason:"custody-mode",persisted:!1};if(!F?.binding&&S(P,_))throw t.warn("native-auth","account write is still unfinished",{outcome:"still-torn"}),new tJ;t.debug("native-auth","account write finished",{outcome:"joined"})}if(!F?.binding||F.source!=="local"||F.type!=="oauth")return{status:"refused",reason:"row-ineligible",persisted:!1};if(F.state==="unsupported-access")return{status:"refused",reason:"unsupported-access",persisted:!1};let M=await c$(Z.runtime,Z.storageId),R=M.status==="ready"?M.state.accounts[F.binding.rowId]?.binding:void 0;if(R?.kind==="local"&&R.credentialEpoch<F.binding.credentialEpoch){if(await I(F.binding.rowId),P=await f.read(),F=P.accounts.find((E)=>E.id===_),!F?.binding)return{status:"refused",reason:"row-ineligible",persisted:!1}}let k=(E,h)=>{if(h.mode!=="local")return{status:"blocked",reason:"local-mode-unavailable"};if(!E?.enabled)return{status:"blocked",reason:"account-disabled"};return{status:"allowed"}},v=(E,h)=>{let C=k(E,h);return C.status==="allowed"&&E?O.policy?.(E,h)??C:C};if(v(F,P).status==="blocked")return{status:"refused",reason:"quota-ineligible",persisted:!1};let g=await ZO({paths:Z,...$.local,now:J,publicationGuard:async(E)=>{if(E.status==="persisted"||E.status==="failed"&&E.persisted&&E.committed!==void 0)return!0;try{return await O4($.host,X)==="local"}catch{return!1}},externalPolicy:()=>k(F,P),failurePolicy:$.local?.failurePolicy??((E)=>{let h=E.observation.status==="failed"?E.observation.failure:void 0,C=Object.assign(Error(h?.classification==="invalid-grant"?"invalid_grant":"Local refresh failed"),{status:h?.status,retryAfter:h?.retryAfter,...h?.classification==="transient"&&h.status===void 0?{code:"ECONNRESET"}:{}}),y=IB({error:C,now:J(),accountIdentity:E.attribution.subject.binding.identity,previous:{message:"Local refresh failed",checkedAt:J(),accountIdentity:E.attribution.subject.binding.identity,retryCount:Math.max(0,E.observation.attempt-1)}}),m=E.observation.status==="failed"&&h?.kind==="provider"&&h.classification==="transient"&&h.status!==429&&!E.observation.persisted&&!E.observation.committed&&E.observation.attempt<cJ;return{checkedAt:y.checkedAt,nextRetryAt:m?y.checkedAt:y.nextRetryAt,retryCount:y.retryCount}})}).authorize({intent:O.intent??"serve",mode:"local",binding:F.binding,rejectedAccessToken:O.rejectedAccessToken,signal:AbortSignal.any([W.signal,...O.signal?[O.signal]:[]])});if(q(O.signal),g.status==="usable"){let E=await f.read(),h=E.accounts.find((C)=>C.id===_);if(v(h,E).status==="blocked"||!h?.binding||h.binding.rowId!==g.binding.rowId||h.binding.credentialEpoch!==g.binding.credentialEpoch||h.binding.identity!==g.binding.identity)return{status:"refused",reason:"row-ineligible",persisted:!1}}return g},async authorizeApi(_,O){await x(O);let P=await U(await D(_));if(q(O),!P?.enabled||!P.candidate||P.stamp!=="bound"||P.credential?.type!=="api")throw new n("route-unavailable");return await x(O),{...P.credential,subject:{kind:"api",binding:mU(Z,P),credentialFingerprint:I6(P.credential),baseURL:P.credential.baseURL,authHeader:P.credential.authHeader}}},authorizeVault:(_,O)=>{return q(O),B.authorize(_,O)},async loginOAuth(_){if((await f.read()).mode!=="local")throw new n("route-unavailable");let P;try{if(!_.credential.access.startsWith("sk-ant-oat"))throw Error("Unsupported OAuth credential");if(P=(await($.local?.resolveIdentity??iG)(_.credential.access,void 0,void 0)).accountUuid,!P?.trim())throw Error("Missing account identity")}catch{throw Error("Claude account identity could not be verified; retry sign-in. No account changes were saved.")}return f.putAccount({..._,accountIdentity:P,replace:_.replace??!0,credential:{type:"oauth",..._.credential}})},async putAccount(_){await x();let O=await f.read();if(O.mode!=="local")throw new n("route-unavailable");let P=_.routeId==="main"?await D("main").catch(()=>s1()):_.routeId;if(_.credential.type==="api"&&(_.routeId==="main"||P===O.settings.mainAccountId))throw new n("route-unavailable");let F=await U(P),M=P,R=!1;if(_.replace&&F){if(!F.credentialEpoch)throw new b("publication-refused");await V.replace(P,_.credential,{identity:_.accountIdentity},{attribution:{credentialEpoch:F.credentialEpoch,identity:F.identity}})}else{let T=await V.add({id:P,credential:_.credential,identity:_.accountIdentity,label:_.label});M=T.id,R=T.outcome==="added"||T.outcome==="added-disabled"}if(_.routeId==="main")await V.updateSettings((T)=>{T.mainAccountId=M});await I(M);let v=(await f.read()).accounts.find((T)=>T.binding?.rowId===M);if(!v)throw new n("route-unavailable");if(R)Ix(v);return v},addApi:(_)=>f.putAccount({routeId:_.routeId??s1(),label:_.label,replace:_.replace,credential:{type:"api",apiKey:_.apiKey,baseURL:_.baseURL??"https://api.anthropic.com",authHeader:_.authHeader}}),async updateSettings(_){let O=await N(),P={},F=await O.store.updateSettings(async(M)=>{function R(g){let E=g.claustrum;return[g.mainAccountId,E?.mode,E?.primaryAccount,E?.scopedRoster,E?.rosterView,g.relay]}let k=JSON.stringify(R(M));P.before=aQ(M);let v=await _(M),T=yJ(v??M);if(JSON.stringify(R(T))!==k)throw new n("route-unavailable");return T});if(F.outcome==="updated"&&P.before)Mx(P.before,F.settings);return F},async setLoggingLevel(_){await f.updateSettings((O)=>({...O,logging:{...O.logging&&typeof O.logging==="object"&&!Array.isArray(O.logging)?O.logging:{},level:_}})),nQ(_)},async setEnabled(_,O){let P=await f.read(),F=P.accounts.find((E)=>E.id===_),M={id:_,label:F?.label},R=O?"account enabled":"account disabled";if(P.mode==="claustrum"){if(F?.source!=="vault")throw new n("route-unavailable");if(await B.setEnabled(_,O))r1(R,M);return}await x();let k=await D(_),v=O?"enable":"disable",T={},g=x0({paths:Z,quota:d$,now:J,onStep:async(E,h)=>{if(E==="before-config-write"||E==="before-state-write")await x();if(E!=="before-config-write"||h.operation!==v||h.rowId!==k)return;T.before=void 0;try{let C=await V.read();if(C.status==="ready")T.before=C.rows.find((y)=>y.id===k)?.enabled}catch{}await x()}});if(O)await g.enable(k);else await g.disable(k,"user-disabled");if(T.before!==void 0&&T.before!==O)r1(R,M)},async remove(_){await x();let O=await f.read();if(O.mode!=="local")throw new n("route-unavailable");let P=O.accounts.find((M)=>M.id===_);if((await V.remove(await D(_))).outcome==="removed")r1("account removed",{id:_,label:P?.label})},async reorder(_,O){await x();let P=await f.read();if(P.mode!=="local")throw new n("route-unavailable");let F=await V.read();if(F.status!=="ready")throw new b("publication-refused");let M=await Promise.all(_.map(D)),R=F.rows.find((k)=>k.id===P.settings.mainAccountId);if(R&&!M.includes(R.id))M.unshift(R.id);if((await V.reorder(M)).outcome==="reordered")r1("account reordered",P.accounts.find((k)=>k.id===O)??{id:O})},async captureLocalSubject(_){await x();let O=await U(await D(_));if(O?.credential?.type!=="oauth"||O.stamp!=="bound")throw new n("route-unavailable");let P=O.credential,F={kind:"local",storageId:Z.storageId,rowId:O.id,credentialEpoch:O.credentialEpoch??0,...O.identity!==void 0?{identity:O.identity}:{}};if(!U$(F,Z,O))throw new n("route-unavailable");return{binding:F,credentialFingerprint:I6(P),version:{...P.access?{accessFingerprint:S$(P.access)}:{},...P.expires!==void 0?{expires:P.expires}:{},...Object.hasOwn(P,"lastRefreshedAt")?{lastRefreshedAt:P.lastRefreshedAt}:{}}}},async publishLocal(_,O){let P=uQ(O);if(await H()!=="local")return!1;let{quota:F,...M}=P,R=F!==void 0&&Object.keys(M).length===0,k=await U(_.binding.rowId);if(k?.stamp!=="bound"||k.credential?.type!=="oauth"||!U$(_.binding,Z,k)||!R&&!c0(_,_.binding,k.credential))return!1;if(F){if(F.accountIdentity!==_.binding.identity)throw new b("publication-refused");await V.recordQuota(_.binding.rowId,{credentialEpoch:_.binding.credentialEpoch,identity:_.binding.identity},s0(F))}return A(_,(v)=>pQ(v,M),R?"binding":!0)},publishApi:(_,O)=>A(_,(P)=>({...P,lastUsed:Math.max(P.lastUsed??0,O.lastUsed)})),async resetBackoff(_,O,P="all"){if("accessToken"in O)return B.resetBackoff(O,P);if(await H()!=="local")return!1;if(await D(_)!==O.binding.rowId)return!1;return A(O,(F)=>{let M=Math.max(J(),F.refreshErrorClearedAt??0,F.quotaErrorClearedAt??0,F.lastRefreshError?.checkedAt??0,F.lastQuotaRefreshError?.checkedAt??0),R={...F};if(P!=="quota")delete R.lastRefreshError,delete R.validationRetry,R.refreshErrorClearedAt=M;if(P!=="refresh")delete R.lastQuotaRefreshError,R.quotaErrorClearedAt=M,R.quotaErrorGeneration=(F.quotaErrorGeneration??0)+1;return R},!1)},async getOrCreateAuthLineage(_,O){if("accessToken"in O)return B.getOrCreateAuthLineage(O);if(await H()!=="local")return;if(await D(_)!==O.binding.rowId)return;let P;return await A(O,(M)=>{return P=M.authLineageId??s1(),{...M,authLineageId:P}})?P:void 0},async incrementPrimeUsage(_,O,P={}){if("accessToken"in O)return B.incrementPrimeUsage(O,P);if(await H()!=="local")return!1;if(await D(_)!==O.binding.rowId)return!1;let F=mO(P);return A(O,(M)=>({...M,prime:{count:(M.prime?.count??0)+1,inputTokens:(M.prime?.inputTokens??0)+F.inputTokens,outputTokens:(M.prime?.outputTokens??0)+F.outputTokens,since:M.prime?.since??J()}}))},async fetchQuota(_,O=fetch,P,F){let M=await f.read();if(M.mode==="claustrum")return B.fetchQuota(_,O,P,F);let R=M.accounts.find((g)=>g.id===_),k=await s(_,O,P,(g,E)=>S4({accessToken:g.access,fetchImpl:E,now:J}),async(g,E)=>{let h=R?.binding&&R.binding.rowId===E.binding.rowId&&R.binding.credentialEpoch===E.binding.credentialEpoch&&R.binding.identity===E.binding.identity?R:void 0,C=cQ(g,E.binding.identity,Math.max(J(),(h?.quotaErrorClearedAt??-1)+1),h?.lastQuotaRefreshError);if(C)await f.publishLocal(E.subject,{lastQuotaRefreshError:C})},F),v={...k.value,accountIdentity:k.attempt.binding.identity},T=R?.binding&&R.binding.rowId===k.attempt.binding.rowId&&R.binding.credentialEpoch===k.attempt.binding.credentialEpoch&&R.binding.identity===k.attempt.binding.identity?R:void 0;return await f.publishLocal(k.attempt.subject,{quota:v,quotaErrorClearedAt:Math.max(v.checkedAt??J(),T?.quotaErrorClearedAt??0,T?.lastQuotaRefreshError?.checkedAt??0)}),v},async fetchProfile(_,O=fetch,P){if((await f.read()).mode==="claustrum")return B.fetchProfile(_,O,P);let F=await d(_,O,P);return await f.publishLocal(F.attempt.subject,{profile:F.value}),F.value},async fetchProfileForDisplay(_,O=fetch,P){if((await f.read()).mode==="claustrum")return B.fetchProfileForDisplay(_,O,P);let F=await d(_,O,P),M=structuredClone(F.attempt.subject),R=F.value;return IK(R,()=>f.publishLocal(M,{profile:R}),async()=>{if((await f.read()).mode!=="local"||await D(_)!==M.binding.rowId)return!1;let k=await U(M.binding.rowId);return k?.stamp==="bound"&&k.enabled!==!1&&k.credential?.type==="oauth"&&U$(M.binding,Z,k)&&c0(M,M.binding,k.credential)})},close(){if(!W.signal.aborted)W.abort(new n("closed")),B.close()}};function d(_,O,P){return s(_,O,P,(F,M)=>gz({accessToken:F.access,accountIdentity:F.binding.identity,fetchImpl:M,now:J,signal:P}))}async function s(_,O,P,F,M,R){let k=AbortSignal.any([W.signal,...P?[P]:[]]),v=await f.authorizeLocal(_,{signal:k});if(v.status!=="usable")throw new n("route-unavailable");let T=v,g=(y,m)=>{let u=()=>O(y,{...m,signal:k});if(!R)return u();return R(u,async()=>{await x(k);let c=await U(T.binding.rowId);if(!c?.enabled||c.stamp!=="bound"||c.credential?.type!=="oauth"||!U$(T.binding,Z,c)||!c0(T.subject,T.binding,c.credential)||await D(_)!==T.binding.rowId)throw new n("identity-changed");await x(k)})},E,h=Object.assign(async(y,m)=>{E=void 0;let u=await g(y,m);if(E=u.status,u.status===401&&!k.aborted){await u.body?.cancel().catch(()=>{}),q(k);let c=await f.authorizeLocal(_,{rejectedAccessToken:T.access,signal:k});if(c.status==="usable"&&c.binding.rowId===T.binding.rowId&&c.binding.credentialEpoch===T.binding.credentialEpoch&&c.binding.identity===T.binding.identity&&c.access!==T.access&&c.subject.version.lastRefreshedAt!==void 0&&(T.subject.version.lastRefreshedAt===void 0||c.subject.version.lastRefreshedAt>T.subject.version.lastRefreshedAt)){T=c;let e=new Headers(m?.headers);e.set("authorization",`Bearer ${T.access}`),E=void 0,u=await g(y,{...m,headers:e}),E=u.status}}return u},{preconnect:O.preconnect}),C;try{C=await F(T,h)}catch(y){q(k);let m=y instanceof n||y instanceof b?y:dQ(y,E);throw await M?.(m,T),m}return q(k),{value:C,attempt:T}}return f}function mO($){let Z=$.inputTokens??0,J=$.outputTokens??0;if(![Z,J].every((X)=>Number.isSafeInteger(X)&&X>=0))throw new b("publication-refused");return{inputTokens:Z,outputTokens:J}}function b7($){let Z=$&&typeof $==="object"?$:{},J=typeof Z.url==="string"?Z.url.trim():"",X=Z.transport==="http"?"http":"websocket";if(J)try{let Y=new URL(J);if(!["https:","http:","wss:","ws:"].includes(Y.protocol)||Y.username||Y.password||X==="http"&&!["https:","http:"].includes(Y.protocol))throw Error("invalid endpoint")}catch{throw new b("publication-refused")}return{enabled:Z.enabled===!0,url:J,transport:X,fallbackToDirect:Z.fallbackToDirect!==!1}}class F$ extends Error{code;effect;constructor($,Z=void 0){super(`Native host auth write: ${$}`);this.code=$,this.effect=Z,this.name="NativeHostAuthWriteError"}}function C3($){return typeof $==="string"&&($==="absent"||$.length===64&&/^[a-f0-9]{64}$/.test($))}async function W9($,Z,J){try{await $?.()}catch{throw new F$(Z,J)}}async function kK($,Z={}){let J,X,Y;try{let{host:G,authPath:z,sourceDigest:Q,expectedDigest:K,removePiAnthropicAuth:W,processFence:V}=$;SQ($.env);let{beforeRecheck:B,beforeRename:q,afterRename:H,afterUnlink:j}=Z;if(G!=="opencode"&&G!=="pi"||typeof z!=="string"||!iO(z)||/\p{Cc}/u.test(z)||!C3(Q)||!C3(K)||typeof V!=="function")throw new F$("invalid-source");let x=await T6("hostAuth",z);if(x.metadata&&process.getuid&&x.metadata.uid!==process.getuid())throw new F$("unsafe-source");let N=c6(G,x.data);if(N.digest!==Q)throw new F$("invalid-source");let U=Object.assign(Object.create(null),x.data);if(G==="opencode"){if(N.kind!=="api"&&N.kind!=="activation")U.anthropic=BZ("anthropic")}else delete U.anthropic;if(c6(G,U).digest!==K)throw new F$("invalid-source");if(G==="opencode"&&(N.kind==="api"||N.kind==="activation")||G==="pi"&&N.kind==="absent")return Object.freeze({status:"unchanged"});if(G==="pi"&&W!==!0)throw new F$("consent-required");let D=G==="pi"&&Object.keys(U).length===0,A=Object.freeze(G==="pi"?{status:"removed",file:D?"unlinked":"replaced"}:{status:x.data===void 0?"created":"replaced"});if(!D){J=sO(dO(z),`.native-host-auth-write.${uO()}.tmp`);let I=await cO(J,"wx",384);try{let L=await I.stat();X={dev:L.dev,ino:L.ino},await I.writeFile(`${JSON.stringify(U,null,2)}
+`,"utf8"),await I.chmod(x.metadata?x.metadata.mode&4095:384),await I.sync()}finally{await I.close()}}if(await W9(B,"hook-failed"),await q0(x),await W9(q,"hook-failed"),await W9(V,"process-fence-refused"),D)await F3(z),Y=A,await W9(j,"hook-failed",Y);else await lO(J,z),X=void 0,Y=A,await W9(H,"hook-failed",Y);return A}catch(G){if(G instanceof F$||G instanceof U0)throw G;if(G instanceof v6)throw new F$(G.code==="unsafe-source"?"unsafe-source":"invalid-source",Y);throw new F$("write-io",Y)}finally{if(J&&X)try{let G=await pO(J);if(G.dev===X.dev&&G.ino===X.ino)await F3(J)}catch{}}}async function b6($){let Z=JM($);try{return await ZM(Z)}catch(X){if(!(X instanceof Error)||!("code"in X)||X.code!=="ENOENT")throw X}let J=fK(Z);if(J===Z)return Z;return EK(await b6(J),vK(Z))}function V9($,Z,J,X){return vK($)===Z?EK(fK($),J):`${$}.${X}.json`}async function XM($=x5(),Z=LB($)){let[J,X]=await Promise.all([b6($),b6(Z)]),Y=await b6(V9(J,"anthropic-auth.json","anthropic-auth-pool.json","pool")),G=await b6(V9(X,"anthropic-auth-state.json","anthropic-auth-pool-state.json","pool")),z=await b6(V9(X,"anthropic-auth-state.json","anthropic-auth-native-state.json","native")),Q=await b6(V9(X,"anthropic-auth-state.json","anthropic-auth-migration.json","migration")),K=await b6(V9(X,"anthropic-auth-state.json","anthropic-auth-custody-roster.json","roster")),W=[J,X,Y,G,z,Q,K];if(new Set(W).size!==W.length)throw Error("Anthropic account storage paths overlap; migration requires separate files");let V=$M("sha256").update(JSON.stringify(["anthropic",Y,G])).digest("hex");return{legacyConfig:J,legacyState:X,config:Y,state:G,runtime:z,journal:Q,roster:K,storageId:V}}class I2 extends Error{code;constructor($){super($==="primary-unverified"?"Stop OpenCode and Pi, then run bunx @cortexkit/opencode-anthropic-auth setup --login --no-claustrum. Existing credentials have not been changed.":`Native migration: ${$}`);this.code=$,this.name="NativeMigrationError"}}var S3=new WeakMap;function a($="invalid-source"){throw new I2($)}function Z8($){if($.metadata&&process.getuid&&$.metadata.uid!==process.getuid())a("unsafe-source")}async function rJ($){try{return await aO($),!1}catch(Z){if(Z instanceof Error&&"code"in Z&&Z.code==="ENOENT")return!0;return a("unsafe-source")}}async function YM($){SQ($.env),await $.processFence();let Z=await XM($.paths.legacyConfig,$.paths.legacyState);for(let j of Object.keys(Z))if($.paths[j]!==Z[j])a();for(let j of[$.hostAuthPath,$.routingSourcePath,$.routingDestinationPath])if(!eO(j)||/\p{Cc}/u.test(j))a();let J=await j1($.paths),X=await T6("hostAuth",$.hostAuthPath);Z8(X);let Y=c6($.host,X.data);if($.host==="pi"&&Y.kind!=="absent"&&!$.removePiAnthropicAuth)a("consent-required");let G=await b6($.hostAuthPath),z=await b6($.routingSourcePath),Q=await b6($.routingDestinationPath),K=[$.paths.legacyConfig,$.paths.legacyState,$.paths.config,$.paths.state,$.paths.runtime,$.paths.roster,$.paths.journal,G,z];if(new Set(K).size!==K.length||Q!==z&&K.includes(Q))a();if(J&&(J.host!==$.host||J.hostAuthPath!==G||J.routingPaths.source!==z||J.routingPaths.destination!==Q))a();if(J?.phase==="committed"||J?.phase==="retired"){let j=(x,N)=>({role:x,path:N,digest:null,data:void 0,metadata:void 0});return{config:j("config",$.paths.legacyConfig),state:j("state",$.paths.legacyState),routing:j("routing",$.routingSourcePath),auth:X,journal:J,hostAuthPath:G,routingSourcePath:z,routingDestinationPath:Q}}if(!J){for(let j of[$.paths.config,$.paths.state,$.paths.runtime,$.paths.roster])if(!await rJ(j))a();if(z!==Q&&!await rJ($.routingDestinationPath))a()}let W=await T6("config",$.legacyConfigPath??$.paths.legacyConfig),V=await T6("state",$.legacyStatePath??$.paths.legacyState),B=await T6("routing",$.routingSourcePath);for(let j of[W,V,B])Z8(j);if(await b6(W.path)!==$.paths.legacyConfig||await b6(V.path)!==$.paths.legacyState)a();if(J&&(J.sources.config!==W.digest||J.sources.state!==V.digest||J.expectedRouting==="unprepared"&&J.sources.routing!==B.digest))a();if(J&&Y.digest!==J.sources.hostAuth&&Y.digest!==J.expectedHostAuth)a();let q,H;if(!J||J.expectedHostAuth==="unprepared"||Y.digest===J.sources.hostAuth){q=tU({host:$.host,storageId:$.paths.storageId,configDigest:W.digest,config:W.data,state:V.data,hostAuth:X.data});let j=q.mainRouteId,x=q.accounts.find((U)=>U.id===j);if(($.requestVaultActivation||J?.activation?.kind==="requested")&&x?.credential?.type==="oauth"&&!x.identity)a("primary-unverified");if(q.custodyPrimary){if(!$.custody)a();H={inventory:await $.custody.discover(),primary:q.custodyPrimary,primaryRouteId:q.mainRouteId,legacyRows:q.custodyRows,disabledAccountIdentities:q.disabledAccountIdentities,reservedRouteIds:q.accounts.filter((U)=>U.credential?.type==="api").map((U)=>U.id)},oJ(H)}let N=q.accounts.filter((U)=>U.credential).map((U)=>({id:U.id,type:U.credential?.type??"oauth",credential:U.credential,identity:U.identity,credentialEpoch:1,enabled:U.enabled,stamp:"bound",hasEntry:!0,needsFirstReading:!1,candidate:U.enabled}));fJ($.paths,q,N,H?oJ(H):void 0)}return{config:W,state:V,routing:B,auth:X,journal:J,projection:q,seedInput:H,hostAuthPath:G,routingSourcePath:z,routingDestinationPath:Q}}async function Y0($){let Z=await $.read();if(Z.status!=="ready")a();return Z.rows}async function I4($){let Z=await c$($.runtime,$.storageId);if(Z.status!=="ready")a();return Z.state}async function g7($,Z,J){let X=await Z.readSettings();if(X.status!=="ready")a();let Y=await T6("state",$.roster);Z8(Y);let G=Y.data?await l6($.roster):null;if(Y.data&&!G)a();return{runtime:await I4($),settings:X.settings,accounts:J.map((z)=>({id:z.id,type:z.type,enabled:z.enabled,label:z.label??null,addedAt:z.addedAt??null,disabledReason:z.disabledReason??null,quota:z.quota??null})),roster:G}}async function k3($,Z,J){let X=B1($);async function Y(G,z){let Q=X[G];if(!Q)return O0($.roster,async(K,W)=>{return{result:await d6($.runtime,{name:"native-runtime",...y6,renew:!0},(B)=>J(async()=>{await Z();for(let q of z)await q();await W.assertOwned(),await B.assertOwned()}))}});return d6(Q.path,{...y6,...Q,renew:!0},(K)=>Y(G+1,[...z,()=>K.assertOwned()]))}return Y(0,[])}function y7($){if(!$.routing.data)return;if(!$.projection)a();let Z=new Map($.projection.accounts.map((J)=>[J.id,J.id]));return Z.set("main",$.projection.mainRouteId),EO($.routing.data,Z)}function v3($){return $===void 0?null:tO("sha256").update($).digest("hex")}function bK($,Z){let J=c6($.host,Z.data);return $.host==="pi"?"absent":J.kind==="api"?J.digest:c6("opencode",{anthropic:BZ("anthropic")}).digest}async function G0($){await q0($.config),await q0($.state)}async function h7($,Z){if(await b6($.hostAuthPath)!==Z.hostAuthPath||await b6($.routingSourcePath)!==Z.routingSourcePath||await b6($.routingDestinationPath)!==Z.routingDestinationPath)a()}async function f3($,Z,J,X){let Y=[{role:"config",path:$.legacyConfigPath??$.paths.legacyConfig,digest:Z.sources.config},{role:"state",path:$.legacyStatePath??$.paths.legacyState,digest:Z.sources.state},...Z.routingPaths.source===Z.routingPaths.destination?[]:[{role:"routing",path:$.routingSourcePath,digest:Z.sources.routing}]],G=await Promise.all(Y.map(async(z)=>{let Q=await T6(z.role,z.path);if(Z8(Q),Q.data&&Q.digest!==z.digest)a("retirement-refused");return Q}));for(let z of G){if(!z.data)continue;await X.onStep?.(`before:retire:${z.role}`),await q0(z),await $.processFence(),await J(),await oO(z.path),await X.onStep?.(`after:retire:${z.role}`)}return M4($.paths,"committed","retired",{assertOwned:async()=>{for(let z of Y)if(!await rJ(z.path))a("retirement-refused");await $.processFence(),await J()},onWriteStep:async(z)=>X.onStep?.(`${z}:journal:retired`)})}async function E3($,Z,J){let X=await T6("hostAuth",$.hostAuthPath);Z8(X);let Y=c6($.host,X.data);await kK({host:$.host,authPath:$.hostAuthPath,sourceDigest:Y.digest,expectedDigest:bK($,X),env:$.env,removePiAnthropicAuth:$.removePiAnthropicAuth,processFence:async()=>{await $.processFence(),await Z()}},J.hostWrite)}async function dF($,Z={}){let J={...$.paths},X={...$,paths:J,env:{...$.env}};try{return await d6(J.journal,{name:"native-migration",ttlMs:30000,timeoutMs:15000,renew:!0},async(Y)=>{let G=async()=>{try{await Y.assertOwned()}catch{a("ownership-lost")}},z=await YM(X);if(X.preflight){let H=S3.get(X.preflight);if(!H||X.preflight.storageId!==J.storageId||X.preflight.host!==X.host||H.config.digest!==z.config.digest||H.state.digest!==z.state.digest||H.routing.digest!==z.routing.digest||c6(X.host,H.auth.data).digest!==c6(X.host,z.auth.data).digest||H.hostAuthPath!==z.hostAuthPath||H.routingSourcePath!==z.routingSourcePath||H.routingDestinationPath!==z.routingDestinationPath)a()}let Q=z.journal,K=async(H)=>Z.onStep?.(H),W={assertOwned:async()=>{await h7(X,z),await G0(z),await X.processFence(),await G()},onWriteStep:async(H,j)=>{await K(j.phase==="verified"&&j.preparedProof?`${H}:proof`:`${H}:journal:${j.phase}`)}};if(Q?.phase==="retired"){if(Q.activation===null)await E3(X,G,Z);return Q}if(Q?.phase==="committed"){if(Q=await f3(X,Q,G,Z),Q.activation===null)await E3(X,G,Z);return Q}if(!Q)await G(),Q=await aD(J,{host:X.host,sources:{config:z.config.digest,state:z.state.digest,hostAuth:c6(X.host,z.auth.data).digest,routing:z.routing.digest},hostAuthPath:z.hostAuthPath,routingPaths:{source:z.routingSourcePath,destination:z.routingDestinationPath},...X.requestVaultActivation?{activation:"requested"}:{}},W);let V=x0({paths:J,quota:d$,onLockStep:Z.store?.onLockStep,onStep:async(H,j)=>{if(await Z.store?.onStep?.(H,j),await K(`${H}:store:${j.operation}`),H.startsWith("before-"))await G0(z),await X.processFence(),await G()}}),B,q;if(Q.phase==="building"){let H=z.projection;if(!H)a();let j=async()=>{await h7(X,z),await G0(z),await X.processFence(),await G()};await j(),await V.initialize();for(let U of[...H.accounts].filter((D)=>D.credential).sort((D,A)=>Number(D.enabled)-Number(A.enabled))){let D=(await Y0(V)).find((A)=>A.id===U.id);if(D)G9({...H,accounts:[{...U,credential:U.credential,enabled:D.enabled}]},[D],!1);else{if(await j(),!U.credential)a();if((await V.add({id:U.id,credential:U.credential,...U.identity!==void 0?{identity:U.identity}:{},...U.label!==void 0?{label:U.label}:{}})).id!==U.id)a();await K(`after:add:${U.id}`)}if(await j(),!U.enabled)await V.disable(U.id,"user-disabled");else await V.enable(U.id);if(U.quota){let A=(await Y0(V)).find((I)=>I.id===U.id);if(!A?.credentialEpoch)a();await j(),await V.recordQuota(U.id,{credentialEpoch:A.credentialEpoch,...A.identity!==void 0?{identity:A.identity}:{}},U.quota)}}if(await j(),await V.reorder(H.accounts.filter((U)=>U.credential).map((U)=>U.id)),await j(),await V.updateSettings(()=>H.settings),z.seedInput){if(await j(),await K("before:roster"),!X.custody)a();q=await X.custody.publishSeed(J,z.seedInput,{assertOwned:j}),await G(),await K("after:roster")}let x=await Y0(V);G9(H,x);let N=fJ(J,H,x,q);if(await j(),await K("before:runtime"),z.seedInput){if(!X.custody)a();await X.custody.publishRuntimeSeed(J,N,{assertOwned:j})}else await gJ(J.runtime,J.storageId,(U)=>{if(Object.keys(U.accounts).length>0&&M6(U)!==M6(N))a();return N},{beforeRename:j});await K("after:runtime"),B=y7(z),await k3(J,G,async(U)=>{if(await G0(z),G9(H,await Y0(V)),M6(await I4(J))!==M6(N))a();Q=await M4(J,"building","verified",{...W,assertOwned:async()=>{if(await G0(z),G9(H,await Y0(V)),M6(await I4(J))!==M6(N))a();await X.processFence(),await U()}})})}return Q=await k3(J,G,async(H)=>{if(!Q)a();await G0(z);let j=await Y0(V),x=await g7(J,V,j);if(Q.expectedHostAuth==="unprepared"){if(!z.projection)a();G9(z.projection,j);let D=await V.readSettings();if(D.status!=="ready"||M6(D.settings)!==M6(z.projection.settings))a();if(z.seedInput&&!q){if(!X.custody)a();if(!(await T6("state",J.roster)).data)a();let L=await l6(J.roster);if(!L)a();HO(L,z.seedInput),q=oJ(z.seedInput)}if(M6(await I4(J))!==M6(fJ(J,z.projection,j,q)))a();await q0(z.routing),B??=y7(z);let A=kQ(j,x);Q=await nD(J,{expectedHostAuth:bK(X,z.auth),expectedRouting:v3(B),preparedProof:A},{...W,assertOwned:async()=>{await G0(z),await q0(z.routing);let I=await Y0(V);w7(A,I,await g7(J,V,I)),await X.processFence(),await H()}})}w7(Q.preparedProof,j,x);let N=Q,U=async()=>{await h7(X,z),await G0(z),j=await Y0(V),x=await g7(J,V,j),w7(N.preparedProof,j,x),await X.processFence(),await H()};return await d6(X.routingDestinationPath,{name:"write",ttlMs:30000,timeoutMs:15000,renew:!0},async(D)=>{let A=await T6("routing",X.routingDestinationPath);if(Z8(A),A.digest!==N.expectedRouting){if(N.phase!=="verified"||(z.routingSourcePath!==z.routingDestinationPath?A.digest!==null:A.digest!==N.sources.routing))a();if(await q0(z.routing),B??=y7(z),v3(B)!==N.expectedRouting||!B)a();await K("before:routing"),await c8(X.routingDestinationPath,JSON.parse(B),{beforeRename:async()=>{await q0(A),await U(),await D.assertOwned()}}),await K("after:routing")}let I=await T6("hostAuth",X.hostAuthPath);Z8(I);let L=c6(X.host,I.data);if(L.digest!==N.sources.hostAuth&&L.digest!==N.expectedHostAuth)a();if(N.phase==="activation-installed"&&L.digest!==N.expectedHostAuth)a();if(await K("before:host"),await U(),await nO(rO(X.hostAuthPath),{recursive:!0,mode:448}),L.digest!==N.expectedHostAuth)await kK({host:X.host,authPath:X.hostAuthPath,sourceDigest:N.sources.hostAuth,expectedDigest:N.expectedHostAuth,env:X.env,removePiAnthropicAuth:X.removePiAnthropicAuth,processFence:async()=>{await U(),await D.assertOwned()}},Z.hostWrite);await K("after:host"),await U();let w=await T6("hostAuth",X.hostAuthPath);if(c6(X.host,w.data).digest!==N.expectedHostAuth)a();if((await T6("routing",X.routingDestinationPath)).digest!==N.expectedRouting)a();let f={...W,assertOwned:async()=>{await U();let d=await T6("hostAuth",X.hostAuthPath),s=await T6("routing",X.routingDestinationPath);if(c6(X.host,d.data).digest!==N.expectedHostAuth||s.digest!==N.expectedRouting)a();await D.assertOwned()}};if(Q?.phase==="verified")Q=await M4(J,"verified","activation-installed",f);Q=await M4(J,"activation-installed","committed",f)}),Q}),await f3(X,Q,G,Z)})}catch(Y){if(Y instanceof v6)a(Y.code==="unsafe-source"?"unsafe-source":"invalid-source");if(Y instanceof z2)a();if(Y instanceof Y2||Y instanceof I2)throw Y;if(Y instanceof Error&&Y.name==="LockContentionError")a("migration-busy");throw Y}finally{if(X.preflight)S3.delete(X.preflight)}}var iF=c6("opencode",{anthropic:BZ("anthropic")}).digest;async function sF($,Z){try{if($!=="opencode"&&$!=="pi")throw new U0("invalid-source");let J=await T6("hostAuth",Z);if(J.metadata){let X=typeof process.getuid==="function"?process.getuid():void 0;if(X!==void 0&&J.metadata.uid!==X||(J.metadata.mode&63)!==0)throw new U0("invalid-source")}return c6($,J.data).kind}catch{throw new U0("invalid-source")}}var GM=Object.freeze(["Accounts","Quota","Routing","Limits","Cache","Diagnostics","Extras"]),X6={kind:"action",destructive:!1,interactive:!1},B9={id:"id",kind:"account-id",required:!0},b3={id:"label",kind:"text",required:!1,protectedEntry:!1};function zM($){for(let Z of $.parameters){if(Z.kind==="choice")Object.freeze(Z.choices);if(Z.kind==="limit-entries")Object.freeze(Z.fields);Object.freeze(Z)}if(Object.freeze($.parameters),$.kind==="setup-guidance")Object.freeze($.setupInstructions);return Object.freeze($)}var eJ=Object.freeze([{...X6,id:"enable",command:"account",group:"Accounts",label:"Enable account",parameters:[B9]},{...X6,id:"disable",command:"account",group:"Accounts",label:"Disable account",parameters:[B9]},{...X6,id:"remove",command:"account",group:"Accounts",label:"Remove account",parameters:[B9],destructive:!0,confirm:"Remove the selected account from this host?"},{...X6,id:"move-up",command:"account",group:"Accounts",label:"Move account up",parameters:[B9]},{...X6,id:"move-down",command:"account",group:"Accounts",label:"Move account down",parameters:[B9]},{...X6,id:"reset-backoff",command:"account",group:"Accounts",label:"Reset account backoff",parameters:[]},{...X6,id:"enrollment-reset",command:"account",group:"Accounts",label:"Reset host enrollment",parameters:[],destructive:!0,confirm:"Clear denied or blocked enrollment state for this host?"},{...X6,id:"add-apikey",command:"account",group:"Accounts",label:"Add API-key fallback",interactive:!0,headlessRefusal:"interactive-required",parameters:[{id:"apiKey",kind:"text",required:!0,protectedEntry:!0},b3,{id:"baseURL",kind:"text",required:!1,protectedEntry:!1},{id:"authHeader",kind:"choice",required:!1,choices:["authorization-bearer","x-api-key"]}]},{...X6,id:"add-oauth-start",command:"account",group:"Accounts",label:"Start OAuth sign-in",parameters:[],interactive:!0,headlessRefusal:"interactive-required"},{...X6,id:"add-oauth-finish",command:"account",group:"Accounts",label:"Finish OAuth sign-in",parameters:[{id:"code",kind:"text",required:!0,protectedEntry:!0},b3],interactive:!0,headlessRefusal:"interactive-required"},{id:"custody-mode",kind:"setup-guidance",command:"account",group:"Accounts",label:"Custody setup guidance",destructive:!1,interactive:!0,headlessRefusal:"offline-required",offlineRequired:!0,parameters:[{id:"mode",kind:"choice",required:!0,choices:["local","claustrum"]}],setupInstructions:["Stop all selected hosts before changing credential authority.","Use the explicit offline setup flow for the selected local or claustrum mode.","This menu only provides guidance; it does not change settings, propose enrollment, or report setup success."]},{id:"vault-disconnect",kind:"vault-disconnect",command:"account",group:"Accounts",label:"Disconnect from the vault",destructive:!0,confirm:"Disconnect this host from the vault and return to local accounts? The vault keeps this host's enrollment approved until an operator revokes it there.",interactive:!0,headlessRefusal:"interactive-required",parameters:[]},{...X6,id:"quota-refresh",command:"quota",group:"Quota",label:"Refresh quota",parameters:[]},{...X6,id:"routing-mode",command:"routing",group:"Routing",label:"Routing mode",parameters:[{id:"mode",kind:"choice",required:!0,choices:["main-first","fallback-first","sticky-balanced"]}]},{...X6,id:"routing-reset",command:"routing",group:"Routing",label:"Reset routing session",parameters:[]},{...X6,id:"killswitch-on",command:"killswitch",group:"Limits",label:"Enable killswitch",parameters:[]},{...X6,id:"killswitch-off",command:"killswitch",group:"Limits",label:"Disable killswitch",parameters:[]},{...X6,id:"killswitch-set",command:"killswitch",group:"Limits",label:"Set killswitch thresholds",parameters:[{id:"entries",kind:"limit-entries",required:!0,fields:["account","fh","sd","scoped?"]}]},{...X6,id:"cache-on",command:"cache",group:"Cache",label:"Enable cache",parameters:[]},{...X6,id:"cache-off",command:"cache",group:"Cache",label:"Disable cache",parameters:[]},{...X6,id:"cache-mode",command:"cache",group:"Cache",label:"Cache mode",parameters:[{id:"mode",kind:"choice",required:!0,choices:["explicit","automatic","hybrid"]}]},{...X6,id:"cachekeep-always",command:"cachekeep",group:"Cache",label:"Keep cache warm always",parameters:[]},{...X6,id:"cachekeep-off",command:"cachekeep",group:"Cache",label:"Disable cache keep",parameters:[]},{...X6,id:"cachekeep-window",command:"cachekeep",group:"Cache",label:"Cache keep window",parameters:[{id:"startHour",kind:"number",required:!0},{id:"endHour",kind:"number",required:!0}]},{...X6,id:"cachekeep-subagents",command:"cachekeep",group:"Cache",label:"Cache keep for subagents",parameters:[{id:"enabled",kind:"choice",required:!0,choices:["on","off"]}]},{...X6,id:"dump-on",command:"dump",group:"Diagnostics",label:"Enable request dumps",parameters:[]},{...X6,id:"dump-off",command:"dump",group:"Diagnostics",label:"Disable request dumps",parameters:[]},{...X6,id:"logging-level",command:"logging",group:"Diagnostics",label:"Logging level",parameters:[{id:"level",kind:"choice",required:!0,choices:["error","warn","info","debug","trace"]}]},{...X6,id:"fast-on",command:"fast",group:"Extras",label:"Enable fast mode",parameters:[]},{...X6,id:"fast-off",command:"fast",group:"Extras",label:"Disable fast mode",parameters:[]},{...X6,id:"prime-on",command:"prime",group:"Extras",label:"Enable Prime",parameters:[]},{...X6,id:"prime-off",command:"prime",group:"Extras",label:"Disable Prime",parameters:[]},{...X6,id:"start-fire",command:"start",group:"Extras",label:"Fire lane start",parameters:[]}].map(zM)),QM=Object.freeze([{kind:"status",id:"account-status",command:"account",group:"Accounts",label:"Account status and usage"},{kind:"status",id:"quota-status",command:"quota",group:"Quota",label:"Quota summary"},{kind:"status",id:"routing-status",command:"routing",group:"Routing",label:"Routing status"},{kind:"status",id:"killswitch-status",command:"killswitch",group:"Limits",label:"Killswitch status"},{kind:"status",id:"cache-status",command:"cache",group:"Cache",label:"Cache status"},{kind:"status",id:"cachekeep-status",command:"cachekeep",group:"Cache",label:"Cache keep status"},{kind:"status",id:"dump-status",command:"dump",group:"Diagnostics",label:"Dump status"},{kind:"status",id:"logging-status",command:"logging",group:"Diagnostics",label:"Logging status"},{kind:"status",id:"fast-status",command:"fast",group:"Extras",label:"Fast mode status"},{kind:"status",id:"prime-status",command:"prime",group:"Extras",label:"Prime quota window status"}].map(($)=>Object.freeze($))),KM=Object.freeze(["remove","move-up","move-down","enrollment-reset","add-apikey","add-oauth-start","add-oauth-finish","custody-mode"]),WM=new Set(KM);function _2($){return WM.has($)}var VM=Object.freeze(["vault-disconnect"]),BM=new Set(VM);function gK($){return BM.has($)}function qM($,Z){return $==="local"?!gK(Z):!_2(Z)}function $5($,Z){return $==="opencode"||!["quota","killswitch","prime","start"].includes(Z.command)}function Y4($,Z){return Object.freeze({host:$,groups:Object.freeze(GM.map((J)=>Object.freeze({id:J,actions:Object.freeze(eJ.filter((X)=>X.group===J&&$5($,X)&&qM(Z,X.id))),statuses:Object.freeze(QM.filter((X)=>X.group===J&&($==="opencode"||X.command!=="killswitch")))})))})}var jM=Object.freeze({opencode:Object.freeze({local:Y4("opencode","local"),claustrum:Y4("opencode","claustrum")}),pi:Object.freeze({local:Y4("pi","local"),claustrum:Y4("pi","claustrum")})}),HM=Object.freeze({opencode:Object.freeze(eJ.filter(($)=>$5("opencode",$))),pi:Object.freeze(eJ.filter(($)=>$5("pi",$)))});function yK($){return HM[$]}function LM($,Z){return jM[$][Z]}var NM=new Set(["routing-reset","start-fire","add-oauth-start","add-oauth-finish"]),UM=new Set(["opencode","pi"]),GZ=Object.getOwnPropertyDescriptor(AbortSignal.prototype,"aborted")?.get;function p6($,Z,J){return Object.freeze({status:"refused",code:$,...Z!==void 0?{action:Z}:{},...J!==void 0?{parameter:J}:{}})}function h8($,Z){if($===null||typeof $!=="object")return"malformed";if(i9.isProxy($))return"malformed";let J=Object.getPrototypeOf($);if(J!==Object.prototype&&J!==null)return"malformed";let X=new Map,Y=!1;for(let G of Reflect.ownKeys($)){if(typeof G!=="string")return"malformed";let z=Reflect.getOwnPropertyDescriptor($,G);if(!z||!Object.hasOwn(z,"value"))return"malformed";if(!Z.includes(G))Y=!0;else X.set(G,z.value)}return Y?"unknown-key":X}function xM($){if($===null||typeof $!=="object")return;if(i9.isProxy($))return;if(!Array.isArray($))return;if(Object.getPrototypeOf($)!==Array.prototype)return;let J=Reflect.getOwnPropertyDescriptor($,"length")?.value;if(typeof J!=="number")return;if(Reflect.ownKeys($).length!==J+1)return;let Y=[];for(let G=0;G<J;G++){let z=Reflect.getOwnPropertyDescriptor($,String(G));if(!z||!Object.hasOwn(z,"value"))return;Y.push(z.value)}return Y}function zZ($){return/\S/.test($)}function _4($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0&&!Object.is($,-0)}function DM($){return _4($)&&$<=23}function OM($){try{let Z=new URL($.trim());return(Z.protocol==="http:"||Z.protocol==="https:")&&!Z.username&&!Z.password}catch{return!1}}function MM($){return typeof $==="string"&&zZ($)}var IM=["account","fh","sd","scoped"];function _M($){let Z=xM($);if(!Z||Z.length===0)return;let J=[];for(let X of Z){let Y=h8(X,IM);if(!(Y instanceof Map))return;let G=Y.get("account"),z=Y.get("fh"),Q=Y.get("sd"),K=Y.get("scoped");if(!MM(G))return;if(!_4(z)||!_4(Q))return;if(K!==void 0&&!_4(K))return;J.push(Object.freeze(K===void 0?{account:G,fh:z,sd:Q}:{account:G,fh:z,sd:Q,scoped:K}))}return Object.freeze(J)}var v0={ok:!1,code:"missing-parameter"},z0={ok:!1,code:"invalid-parameter"},m7={ok:!0,present:!1};function q9($){return{ok:!0,present:!0,value:$}}function PM($,Z,J){let X=!Z||J===void 0||J===null;switch($.kind){case"account-id":if(X)return v0;if(typeof J!=="string")return z0;return zZ(J)?q9(J):v0;case"text":{if(X)return $.required?v0:m7;if(typeof J!=="string")return z0;if(!zZ(J))return $.required?v0:m7;if($.id==="apiKey"&&/\s/.test(J))return z0;if($.id==="baseURL"&&!OM(J))return z0;return q9(J)}case"choice":if(X)return $.required?v0:m7;if(typeof J!=="string")return z0;return $.choices.includes(J)?q9(J):z0;case"number":if(X)return v0;return DM(J)?q9(J):z0;case"limit-entries":{if(X)return v0;let Y=_M(J);return Y?q9(Y):z0}default:return $}}function AM($){if($===null||typeof $!=="object")return"malformed";if(i9.isProxy($)||!GZ)return"malformed";try{Reflect.apply(GZ,$,[])}catch{return"malformed"}return $}function wM($){return $!==void 0&&GZ!==void 0?Reflect.apply(GZ,$,[])===!0:!1}var RM=["interactive","custodyMode","confirmed","sessionId","signal"];function TM($){let Z=h8($,RM);if(!(Z instanceof Map))return;let J=Z.get("interactive"),X=Z.get("custodyMode"),Y=Z.get("confirmed"),G=Z.get("sessionId"),z=Z.get("signal");if(typeof J!=="boolean")return;if(X!=="local"&&X!=="claustrum")return;if(Y!==void 0&&typeof Y!=="boolean")return;if(G!==void 0&&typeof G!=="string")return;let Q;if(z!==void 0){let K=AM(z);if(K==="malformed")return;Q=K}return{interactive:J,custodyMode:X,confirmed:Y===!0,...G!==void 0&&zZ(G)?{sessionId:G}:{},...Q!==void 0?{signal:Q}:{}}}function u6($){return{kind:"done",result:$}}function FM($,Z,J){let X=h8(Z,["action","values"]);if(!(X instanceof Map))return u6(p6("invalid-request"));let Y=X.get("action");if(typeof Y!=="string")return u6(p6("invalid-request"));let G=$.get(Y);if(!G)return u6(p6("unsupported-action"));let z=TM(J);if(!z)return u6(p6("invalid-context",G.id));if(z.custodyMode==="claustrum"&&_2(G.id))return u6(p6("vault-managed",G.id));if(z.custodyMode==="local"&&gK(G.id))return u6(p6("vault-not-connected",G.id));if(G.interactive&&!z.interactive)return u6(p6(G.headlessRefusal,G.id));let Q=X.get("values"),K=G.parameters.map((j)=>j.id),W=Q===void 0?new Map:h8(Q,K);if(W==="malformed")return u6(p6("invalid-request",G.id));if(W==="unknown-key")return u6(p6("unknown-parameter",G.id));let V={};for(let j of G.parameters){let x=PM(j,W.has(j.id),W.get(j.id));if(!x.ok)return u6(p6(x.code,G.id,j.id));if(x.present)V[j.id]=x.value}if(G.id==="cachekeep-window"&&V.startHour===V.endHour)return u6(p6("invalid-parameter",G.id,"endHour"));if(G.destructive&&!z.confirmed)return u6(p6("confirmation-required",G.id));let B=NM.has(G.id);if(B&&z.sessionId===void 0)return u6(p6("session-required",G.id));if(wM(z.signal))return u6(p6("aborted",G.id));if(G.kind==="setup-guidance")return u6(Object.freeze({status:"guidance",action:G.id,mode:V.mode,instructions:G.setupInstructions}));let q=Object.freeze(z.signal!==void 0?{signal:z.signal}:{});if(G.kind==="vault-disconnect")return{kind:"disconnect",options:q};let H=Object.freeze({action:G.id,values:Object.freeze(V),...B?{sessionId:z.sessionId}:{}});return{kind:"dispatch",action:G.id,request:H,options:q}}var CM=new Set(["disconnected","idle","busy","conflict"]);function SM($,Z){let J=h8(Z,["ok","text"]),X=J instanceof Map?J.get("ok"):void 0,Y=J instanceof Map?J.get("text"):void 0;if(typeof X!=="boolean"||typeof Y!=="string")return Object.freeze({status:"failed",action:$,code:"invalid-outcome"});return Object.freeze({status:"executed",action:$,ok:X,text:Y})}function u7($){return TypeError(`Native menu executor option ${$} is invalid`)}function kM($){let Z=h8($,["host","dispatch","disconnectVault"]);if(!(Z instanceof Map))throw TypeError("Native menu executor options are invalid");let J=Z.get("host"),X=Z.get("dispatch"),Y=Z.get("disconnectVault");if(!UM.has(J))throw u7("host");if(typeof X!=="function"||i9.isProxy(X))throw u7("dispatch");if(Y!==void 0&&(typeof Y!=="function"||i9.isProxy(Y)))throw u7("disconnectVault");let G=new Map;for(let K of yK(J))if(K.kind!=="vault-disconnect"||Y!==void 0)G.set(K.id,K);let z=async(K)=>{let W;try{W=await Reflect.apply(Y,void 0,[K])}catch{return Object.freeze({status:"failed",action:"vault-disconnect",code:"execution-failed"})}if(!CM.has(W))return Object.freeze({status:"failed",action:"vault-disconnect",code:"invalid-outcome"});return Object.freeze({status:"disconnect",action:"vault-disconnect",result:W})};return Object.freeze({execute:Object.freeze(async(K,W)=>{let V;try{V=FM(G,K,W)}catch{return p6("invalid-request")}if(V.kind==="done")return V.result;if(V.kind==="disconnect")return z(V.options);let B;try{B=await Reflect.apply(X,void 0,[V.request,V.options])}catch{return Object.freeze({status:"failed",action:V.action,code:"execution-failed"})}return SM(V.action,B)})})}function hK($){return $&&typeof $==="object"&&!Array.isArray($)?$:{}}function aF($,Z,J){return{...$,[Z]:{...hK($[Z]),...J}}}function nF($){let{startHour:Z,endHour:J,...X}=hK($.cacheKeep);return{...$,cacheKeep:{...X,enabled:!0,always:!0}}}var vM=[/\b[\w-]*(?:secret|token|password|passwd|api[_-]?key|authorization|verifier)["']?\s*[:=]\s*["']?(?:(?:Bearer|Basic)\s+)?[^\s"'&,;}]+/gi,/\b[0-9a-fA-F]{32,}\b/g];function fM($={}){let{redactStrings:Z}=S9({...$,extraValuePatterns:[...vM,...$.extraValuePatterns??[]]});return(J)=>Z(J)}function EM($){return $===null||typeof $==="string"||typeof $==="boolean"||typeof $==="number"&&Number.isFinite($)}function bM($){if($===null||typeof $!=="object"||Array.isArray($))return;let Z=$;if(typeof Z.command!=="string"||typeof Z.sectionId!=="string"||typeof Z.actionId!=="string")return;if(Z.itemId!==void 0&&typeof Z.itemId!=="string")return;if(Z.sessionId!==void 0&&typeof Z.sessionId!=="string")return;if(Z.confirmed!==void 0&&typeof Z.confirmed!=="boolean")return;let J={};if(Z.values!==void 0){if(Z.values===null||typeof Z.values!=="object"||Array.isArray(Z.values))return;for(let[X,Y]of Object.entries(Z.values)){if(!EM(Y))return;Object.defineProperty(J,X,{value:Y,enumerable:!0,writable:!0,configurable:!0})}}return{command:Z.command,sectionId:Z.sectionId,actionId:Z.actionId,...typeof Z.itemId==="string"?{itemId:Z.itemId}:{},...Z.values!==void 0?{values:J}:{},...Z.confirmed===!0?{confirmed:!0}:{},...typeof Z.sessionId==="string"?{sessionId:Z.sessionId}:{}}}var uK="Accounts are managed in the vault. Disconnect from the vault to use local accounts.",g3="Account custody could not be read, so local account changes are unavailable.",gM={Accounts:"accounts",Quota:"quota",Routing:"routing",Limits:"limits",Cache:"cache",Diagnostics:"diagnostics",Extras:"extra"};function y3($,Z){if($===null||typeof $!=="object"||mK.isProxy($))return;try{let J=Object.getOwnPropertyDescriptor($,Z);return J&&"value"in J?J.value:void 0}catch{return}}function h3($){if($===null||typeof $!=="object"||mK.isProxy($))return!1;try{if(Array.isArray($))return!1;let Z=Object.getPrototypeOf($);if(Z!==Object.prototype&&Z!==null)return!1;return Reflect.ownKeys($).every((J)=>{let X=Object.getOwnPropertyDescriptor($,J);return X!==void 0&&"value"in X})}catch{return!1}}function yM($){switch($.kind){case"choice":return{kind:"choice",id:$.id,label:$.id,choices:[...!$.required?[{value:"",label:"Default"}]:[],...$.choices.map((Z)=>({value:Z,label:Z}))]};case"number":return{kind:"number",id:$.id,label:$.id,required:!0,min:0,max:23};case"account-id":return{kind:"text",id:$.id,label:"Account ID (copy the complete ID from status)",required:!0};case"text":return{kind:"text",id:$.id,label:$.id,required:$.required,masked:$.protectedEntry};case"limit-entries":return{kind:"text",id:$.id,label:"Threshold rows as JSON: account, fh, sd, optional scoped",required:!0,placeholder:'[{"account":"main","fh":5,"sd":10,"scoped":0}]'}}}var pK={code:"true",client_id:qZ,response_type:"code",redirect_uri:o7,scope:wG.join(" "),code_challenge_method:"S256"},m3=[...Object.keys(pK),"code_challenge","state"],hM=new Set(Object.values(_G)),mM=/^[A-Za-z0-9_-]{43}$/,uM=/^[0-9a-f]{32}$/;function pM($){let Z;try{Z=new URL($)}catch{return!1}if(Z.href!==$||$.includes("#")||Z.username!==""||Z.password!==""||!hM.has(`${Z.origin}${Z.pathname}`))return!1;let J=[...Z.searchParams.keys()];if(J.length!==m3.length||!m3.every((X)=>J.includes(X)))return!1;return Object.entries(pK).every(([X,Y])=>Z.searchParams.get(X)===Y)&&mM.test(Z.searchParams.get("code_challenge")??"")&&uM.test(Z.searchParams.get("state")??"")}function cM($,Z){let J=new Set(($.match(/https:\/\/\S+/g)??[]).filter(pM)),[X]=J;if(J.size!==1||X===void 0)return Z($);return $.split(X).map(Z).join(X)}var lM={disconnected:{ok:!0,text:"Disconnected from the vault. This host uses local accounts again."},idle:{ok:!0,text:"This host has no active vault enrollment."},busy:{ok:!1,code:"busy",text:"Vault disconnect could not finish because another process is changing this host's enrollment. Try again."},conflict:{ok:!1,code:"conflict",text:"Disconnect stopped: this host already has a different stored sign-in, so it and the sign-in saved when the host joined the vault were both kept, and the vault connection remains. Resolve the two sign-ins with offline setup."}};function dM($){switch($.status){case"executed":return{ok:$.ok,text:$.text,...!$.ok?{code:"refused"}:{}};case"guidance":return{ok:!0,text:`Offline ${$.mode} setup guidance (nothing changed):
+${$.instructions.join(`
+`)}`};case"disconnect":return lM[$.result];case"failed":return{ok:!1,code:$.code,text:"Action failed."};case"refused":if($.code==="vault-managed")return{ok:!1,code:$.code,text:`Action refused: ${uK}`};if($.code==="vault-not-connected")return{ok:!1,code:$.code,text:"Action refused: this host is not connected to the vault."};return{ok:!1,code:$.code,text:`Action refused: ${$.code}${$.parameter?` (${$.parameter})`:""}.`,...$.code==="confirmation-required"?{needsConfirmation:!0}:{}}}}function rF($){let{host:Z,dispatch:J,readStatus:X,readMode:Y,disconnectVault:G,interactive:z}=$;if(typeof Y!=="function")throw TypeError("Native UI requires a custody mode reader");if(typeof G!=="function")throw TypeError("Native UI requires a vault disconnect callback");let Q=yK(Z),K=kM({host:Z,dispatch:J,disconnectVault:G}),W=new Set(Q.flatMap((j)=>j.parameters.flatMap((x)=>x.kind==="text"&&x.protectedEntry?[x.id]:[]))),V=fM({extraValuePatterns:[/sk-ant-[A-Za-z0-9_-]+/g]});function B(j,x=V){let{sessionId:N,notify:U}=j;return{...N!==void 0?{sessionId:N}:{},notify:(D,A)=>U(x(D),A)}}async function q(){try{let j=await Y();return j==="local"||j==="claustrum"?j:void 0}catch{return}}async function H(j,x=V,N=!0){let U=B(j,x),D=await q(),A=LM(Z,D??"claustrum"),I=[];for(let L of A.groups){let w=[];if(L.id==="Accounts"&&D!=="local")w.push(D==="claustrum"?uK:g3);if(L.id==="Accounts"&&D==="claustrum"&&$.readAccounts)try{let S=await $.readAccounts();for(let f of S.accounts)if(f.source==="vault"&&f.state==="needs_reauth"&&f.credentialId)w.push(x(`${f.label||f.id} (${f.credentialId}) needs signing in again. Run: ck auth login --provider anthropic --id ${f.credentialId} --replace`))}catch{w.push("Vault sign-in status unavailable; reopen /claude to retry.")}for(let S of L.statuses){if(!N){w.push(`${S.label}: status unavailable.`);continue}try{w.push(x(await X(S.command,U)))}catch{w.push(`${S.label}: status unavailable.`)}}I.push({id:L.id,slot:gM[L.id],title:L.id,lines:w,items:[],actions:L.actions.map((S)=>({id:S.id,label:S.label,knobs:S.parameters.map(yM),...S.destructive?{confirm:{message:S.confirm,irreversible:S.kind!=="vault-disconnect"}}:{},...S.kind==="setup-guidance"?{description:"Offline guidance only; no settings are changed."}:{}}))})}return{command:"claude",title:"Claude",sections:I}}return{command:"claude",async open(j){return{command:"claude",menu:await H(B(j))}},async apply(j,x){let N=B(x),U,D=y3(j,"values"),A=h3(j)&&(D===void 0||h3(D));try{U=A?bM(j):void 0}catch{U=void 0}let I=Q.find((_)=>_.id===U?.actionId&&_.group===U?.sectionId),L={...U?.values},w=[];for(let _ of W)for(let O of[L,D]){let P=y3(O,_);if(typeof P==="string"&&P.length>0)w.push(P)}let S=(_)=>{let O=_;for(let P of w)O=O.split(P).join("[REDACTED]");return V(O)},f=async(_,O=!1)=>({command:"claude",..._,text:O?cM(_.text,S):S(_.text),menu:await H(N,S,A)});if(U?.command!=="claude"||!I||U.itemId!==void 0||U.sessionId!==void 0&&U.sessionId!==N.sessionId)return f({ok:!1,code:"invalid-request",text:"Invalid menu request."});for(let _ of I.parameters){if(_.kind==="choice"&&!_.required&&L[_.id]==="")L[_.id]=null;if(_.kind==="limit-entries"&&typeof L[_.id]==="string")try{let O=JSON.parse(String(L[_.id]));L[_.id]=O}catch{return f({ok:!1,code:"invalid-parameter",text:"Threshold rows must be valid JSON."})}}let d=await q();if(d===void 0&&_2(I.id))return f({ok:!1,code:"custody-unavailable",text:`Action refused: ${g3}`});let s=await K.execute({action:I.id,values:L},{interactive:z,custodyMode:d??"claustrum",confirmed:U.confirmed,sessionId:N.sessionId});return f(dM(s),s.status==="executed"&&s.action==="add-oauth-start"&&s.ok&&w.length===0)}}}function iM($){if(!($ instanceof Error))return!1;if($.name==="NativeCustodyError")return!0;if($.name!=="NativeRuntimeError")return!1;let Z=Reflect.get($,"code");return Z==="publication-refused"||Z==="unsafe-runtime"||Z==="invalid-runtime"}var sM=new Set(["Error","NativeCustodyError","NativeRuntimeError","LockContentionError"]),tM=new Set(["closed","not-enrolled","invalid-token","unavailable","identity-changed","identity-unasserted","insufficient-validity","invalid-material","not-active","route-unavailable","route-declined","no-receipt","unsafe-file","invalid-state","wrong-consumer","roster-busy","host-slot-login","host-slot-placeholder","placeholder-refresh","publication-refused","unsafe-runtime","invalid-runtime","runtime-io","runtime-conflict","EIO","ENOENT","EACCES","EPERM","ENOSPC"]);function aM($,Z){let J="warn",X="unknown",Y="unknown";try{if(iM(Z))J="error";if(Z instanceof Error){if(sM.has(Z.name))X=Z.name;let G=Reflect.get(Z,"code");if(typeof G==="string"&&tM.has(G))Y=G}}catch{}t[J]($,"Account usage publication unavailable",{name:X,code:Y})}function eF($){let Z=new Set,J=(X)=>{let Y=X.then(()=>{},(G)=>aM($,G));return Z.add(Y),Y.then(()=>Z.delete(Y),()=>Z.delete(Y)),Y};return{observe:J,publish(X){J(new Promise((Y)=>setTimeout(Y,0)).then(X))},async drain(){while(Z.size)await Promise.allSettled([...Z])}}}var nM="No vault account can serve this request. Open /claude to see which account needs signing in again.";class Z5 extends Error{constructor(){super(nM);this.name="NativeVaultNoAccountError"}}var p7=new WeakMap;function cK($){return $.accounts.some((Z)=>Z.source==="vault"&&Z.type==="oauth"&&Z.enabled&&Z.state==="active")}async function $C($,Z){Z?.throwIfAborted();let J=await $.read();if(Z?.throwIfAborted(),J.mode!=="claustrum")return J;let X=Boolean((await $.vault.read())?.view);if(Z?.throwIfAborted(),X&&cK(J))return J;let Y=p7.get($);if(!Y)Y=oM($,X).finally(()=>p7.delete($)),p7.set($,Y);return rM(Y,Z)}async function oM($,Z){let J=new AbortController,X=setTimeout(()=>J.abort(),2000),Y=J.signal;try{while(!Y.aborted){let G;try{G=await $.vault.refresh(Y)}catch{if(Z||Y.aborted)break}if(G?.view){let z=await $.read();if(z.mode!=="claustrum"||cK(z))return z;throw new Z5}if(Z)break;if(Y.aborted)break;await new Promise((z)=>{let Q=()=>{clearTimeout(K),Y.removeEventListener("abort",Q),z()},K=setTimeout(Q,25);if(Y.addEventListener("abort",Q,{once:!0}),Y.aborted)Q()})}throw new Z5}finally{clearTimeout(X)}}function rM($,Z){if(!Z)return $;return new Promise((J,X)=>{let Y=()=>X(Z.reason);if(Z.addEventListener("abort",Y,{once:!0}),$.then(J,X).finally(()=>Z.removeEventListener("abort",Y)),Z.aborted)Y()})}var JI="common-auth-placeholder";function XI($){return`${JI}.${$}`}var BI=30000,P4=1e4,qI=3000,J5,x9=new Map;process.once("exit",()=>{for(let[$,Z]of x9)try{if(Z.renewedAt+P4<Date.now())continue;let J=KI($);if(X5(J,Z)&&J.mtime.getTime()===Z.mtime)QI($)}catch{}});function X5($,Z){return $.dev===Z.dev&&$.ino===Z.ino}function s9($){return typeof $==="object"&&$!==null&&"code"in $?$.code:void 0}function l3(){return Object.assign(Error("Pi auth lock held"),{code:"ELOCKED"})}async function Y5($){try{await VI($)}catch(Z){if(s9(Z)!=="ENOENT")throw Z}}async function G5($,Z){try{await WI($)}catch(J){if(s9(J)!=="EEXIST")throw J;if(Z<=0)throw l3();let X;try{X=(await QZ($)).mtime.getTime()}catch(Y){if(s9(Y)==="ENOENT")return G5($,0);throw Y}if(!(X<Date.now()-Z))throw l3();return await Y5($),G5($,0)}try{if(!J5){let Y=new Date(Math.ceil(Date.now()/1000)*1000+5);await iK($,Y,Y)}let J=await QZ($),X=J.mtime.getTime();return J5??=X%1000===0?"s":"ms",{dev:J.dev,ino:J.ino,mtime:X}}catch(J){throw await Y5($).catch(()=>{}),J}}async function jI($,Z,J){let X=`${$}.lock`,Y=await G5(X,BI),G=Y.mtime,z=Date.now(),Q=!1,K;x9.set(X,{...Y,renewedAt:z});function W(){if(Q=!0,K)clearTimeout(K);x9.delete(X),Z()}function V(){if(!Q&&z+P4<Date.now())W()}function B(j=qI){if(Q)return;K=setTimeout(()=>{H()},j),K.unref()}function q(j){if(Q)return;if(s9(j)==="ENOENT"||z+P4<Date.now())W();else B(1000)}async function H(){if(V(),Q)return;let j;try{j=await QZ(X)}catch(N){q(N);return}if(V(),Q)return;if(!X5(j,Y)||j.mtime.getTime()!==G){W();return}let x=new Date(J5==="s"?Math.ceil(Date.now()/1000)*1000:Date.now());try{await iK(X,x,x)}catch(N){q(N);return}if(Q)return;G=x.getTime(),z=Date.now(),x9.set(X,{...Y,mtime:G,renewedAt:z}),B()}return J?.(async()=>{if(K)clearTimeout(K);await H()}),B(),{assertFresh:V,async release(){if(Q)return;if(Q=!0,K)clearTimeout(K);x9.delete(X);let j=()=>z+P4<Date.now();if(j()){W();return}let x;try{x=await QZ(X)}catch(N){if(s9(N)!=="ENOENT")throw N;W();return}if(j()||!X5(x,Y)||G!==x.mtime.getTime()){W();return}await Y5(X)}}}class D6 extends Error{code;constructor($){super(`Pi slot: ${$}`);this.code=$,this.name="PiSlotError"}}function HI($){let Z=$.indexOf("{")+1,J={offset:Z-1,children:[]},X=()=>{while(/\s/.test($[Z]??"")&&Z<$.length)Z++},Y=()=>{Z++;while(Z<$.length){if($[Z++]==='"')return;if($[Z-1]==="\\")Z++}};X();while($[Z]!=="}"){let G=Z;Y();let z=JSON.parse($.slice(G,Z));X(),Z++,X();let Q=Z,K=0;while(Z<$.length){let V=$[Z];if(V==='"'){Y();continue}if(V==="{"||V==="[")K++;if(V==="}"||V==="]"){if(K===0)break;K--}if(V===","&&K===0)break;Z++}let W=Z;while(/\s/.test($[W-1]??""))W--;if(J.children.push({key:z,offset:G,length:W-G,value:{offset:Q,length:W-Q}}),X(),$[Z]==="}")break;Z++,X()}return J}function t9($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function z5($){if(Array.isArray($))return`[${$.map(z5).join(",")}]`;if(t9($))return`{${Object.keys($).sort().map((Z)=>`${JSON.stringify(Z)}:${z5($[Z])}`).join(",")}}`;return JSON.stringify($)}function T$($){return YI("sha256").update(z5($)).digest("hex")}function D9($){return t9($)?$.code:void 0}async function d3($,Z=!1,J){if(o)try{await J?.($);let Y=await dz($,!0),G=Y.toString("utf8");if(!Y.equals(Buffer.from(G)))throw new D6(Z?"invalid-stash":"invalid-auth");return G}catch(Y){if(D9(Y)==="ENOENT")return;throw Y}let X;try{X=await dK($,u3.O_RDONLY|u3.O_NOFOLLOW);let Y=await X.stat();if(!Y.isFile()||Z&&(Y.mode&511)!==384)throw new D6("unsafe-path");await J?.($);let G=await lK($);if(!G.isFile()||G.dev!==Y.dev||G.ino!==Y.ino)throw new D6("unsafe-path");let z=await X.readFile(),Q=z.toString("utf8");if(!z.equals(Buffer.from(Q)))throw new D6(Z?"invalid-stash":"invalid-auth");return Q}catch(Y){if(D9(Y)==="ENOENT"&&!X)return;if(D9(Y)==="ELOOP"||D9(Y)==="ENOENT")throw new D6("unsafe-path");throw Y}finally{await X?.close()}}function LI($,Z){try{let J=JSON.parse($);if(!t9(J))throw Error();let X=HI($),Y=X.children,G=Y.map((K)=>K.key);if(new Set(G).size!==G.length)throw Error();let z=Y.find((K)=>K.key===Z),Q=z?J[Z]:null;if(Q!==null&&!t9(Q))throw Error();if(z&&Q===null)throw Error();return{text:$,root:X,property:z,entry:Q}}catch{throw new D6("invalid-auth")}}function NI($){let Z=$.property?.value;return Z?$.text.slice(Z.offset,Z.offset+Z.length):null}function i3($,Z,J){let{text:X,root:Y,property:G}=$,z=Y.children??[];if(G){let W=G.value;if(!W)throw new D6("invalid-auth");if(J!==null)return X.slice(0,W.offset)+J+X.slice(W.offset+W.length);let V=z.indexOf(G),B=z[V-1],q=z[V+1],H=B?B.offset+B.length:G.offset,j=!B&&q?q.offset:G.offset+G.length;return X.slice(0,H)+X.slice(j)}if(J===null)return X;let Q=z.at(-1),K=Q?Q.offset+Q.length:Y.offset+1;return`${X.slice(0,K)}${Q?",":""}${JSON.stringify(Z)}:${J}${X.slice(K)}`}async function UI($){if(o)return;let Z=await dK($,"r");try{await Z.sync()}finally{await Z.close()}}async function c7($,Z,J,X){await c8($,null,{serialize:()=>Z,durable:!0,durability:o?"file-only-on-windows":void 0,beforeRename:async()=>{await X?.($),J()}})}function xI($){return DI($)}function DI($,Z,J){let{provider:X,placeholderKey:Y}=$,G=$.lockTimeoutMs??30000;if(!X||!$.authPath||!$.stashPath||!Y||Y.startsWith("!")||Y.includes("$")||!Number.isFinite(G)||G<0)throw new D6("invalid-options");let z=c3($.authPath),Q=c3($.stashPath);if(z===Q||Q===`${z}.lock`)throw new D6("invalid-options");let K=T$(z),W=T$(Y),V={type:"api_key",key:Y},B=(N)=>T$(N)===T$(V);async function q(){let N=await d3(Q,!0,J?.afterReadCheck);if(N===void 0)return;try{let U=JSON.parse(N);if(U.version!==1||U.provider!==X||U.authIdentity!==K||U.placeholderIdentity!==W||U.entry!==null&&!t9(U.entry)||U.sha256!==T$(U.entry)||(U.entry===null?U.entryJson!==null:typeof U.entryJson!=="string"||T$(JSON.parse(U.entryJson))!==U.sha256))throw Error();return U}catch{throw new D6("invalid-stash")}}async function H(N){let U,D,A=!1,I=()=>{if(D?.(),A)throw new D6("lock-compromised")};try{if(o)await i$(L8(z));else await p3(L8(z),{recursive:!0,mode:448});let L=Date.now()+G,w=0;while(!U)try{let f=await jI(z,()=>{A=!0},J?.onRenew);U=f.release,D=f.assertFresh}catch(f){if(D9(f)!=="ELOCKED")throw f;let d=L-Date.now();if(d<=0)throw new D6("lock-timeout");await zI(Math.min(Math.round(Math.min(10*2**w++,1000)*(1+Math.random())),d))}I();let S=await N(I);return I(),S}catch(L){if(L instanceof D6||L instanceof g6)throw L;throw new D6("io")}finally{await U?.().catch(()=>{}),I()}}async function j(){let N=LI(await d3(z,!1,J?.afterReadCheck)??"{}",X),U=await q();return{auth:N,stash:U}}async function x(N){N(),await GI(Q),await UI(L8(Q)),Z?.("stash-deleted")}return{inspect:()=>H(async()=>{let{auth:N,stash:U}=await j();return{slot:B(N.entry)?"placeholder":N.entry===null?"empty":!U||T$(N.entry)===U.sha256?"original":"foreign",stash:U?"valid":"missing"}}),enterVault:()=>H(async(N)=>{let{auth:U,stash:D}=await j();if(B(U.entry)){if(!D)throw new D6("missing-stash");return}if(D&&T$(U.entry)!==D.sha256)throw new D6("conflict");if(!D){if(o)await i$(L8(Q));else{await p3(L8(Q),{recursive:!0,mode:448});let I=await lK(L8(Q));if(!I.isDirectory()||(I.mode&511)!==448)throw new D6("unsafe-path")}let A={version:1,provider:X,authIdentity:K,placeholderIdentity:W,entry:U.entry,entryJson:NI(U),sha256:T$(U.entry)};await c7(Q,JSON.stringify(A),N,J?.beforeRename),Z?.("stash-written")}await c7(z,i3(U,X,JSON.stringify(V)),N,J?.beforeRename),Z?.("auth-written")}),exitVault:()=>H(async(N)=>{let{auth:U,stash:D}=await j();if(!D){if(B(U.entry))throw new D6("missing-stash");return"nothing-to-do"}if(B(U.entry))await c7(z,i3(U,X,D.entryJson),N,J?.beforeRename),Z?.("auth-written");else if(T$(U.entry)!==D.sha256)return"conflict";return await x(N),"restored"})}}function OI($){return{authPath:ZI($.authPath),stashPath:$I(eM(X1("pi",$.env).tokenPath),"pi-auth-slot","anthropic.json"),provider:"anthropic",placeholderKey:XI("anthropic")}}function WC($){return xI(OI($))}async function VC($){if($.host==="pi"&&await $.slot.exitVault()==="conflict")return"conflict";return JD(X1($.host,$.env),`anthropic-auth-${$.host}`)}var RI=60000,sK=60000,TI=21600000,FI=90000,CI=300000;function SI($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="on")return{type:"enable"};if(Z.length===1&&Z[0]==="off")return{type:"disable"};return{type:"usage"}}function Q5($){if(!$)return 0;return($.inputTokens*VY.input+$.outputTokens*VY.output)/1e6}function kI($,Z,J){if(J?.label?.trim())return J.label;if($==="main")return"main";let X=Z?.accounts?.find((Y)=>Y.id===$);if(X?.label?.trim())return X.label;return $}function vI($,Z){let J=Z?.transient,X=$?.quota?.mainQuota,Y=$?.prime?.main,G={id:"main",label:"main",nextDueAt:a3(X?.five_hour),lastPrimedAt:J?.get("main")?.lastPrimedAt??null,lastResult:J?.get("main")?.lastResult,usage:Y,estimatedCostUsd:Q5(Y)},z=($?.accounts??[]).filter(n0).filter((Q)=>Q.id!=="main").filter((Q)=>Q.enabled!==!1).map((Q)=>({id:Q.id,label:kI(Q.id,$,Q),nextDueAt:a3(Q.quota?.five_hour),lastPrimedAt:J?.get(Q.id)?.lastPrimedAt??null,lastResult:J?.get(Q.id)?.lastResult,usage:Q.prime,estimatedCostUsd:Q5(Q.prime)}));return[G,...z]}function a3($){if(!$?.resetsAt)return;let Z=Date.parse($.resetsAt);if(!Number.isFinite(Z))return;return Z+sK}function z4($){let J=[$.enabled?"## Claude Prime Status":"## Claude Prime Disabled",""];J.push(`Status: ${$.enabled?"enabled":"disabled"}`),J.push(""),J.push("Accounts:");for(let X of $.accounts){let G=X.usage?.count??0,z=fI(X.nextDueAt),Q=EI(X.lastPrimedAt,X.lastResult),K=[`${X.label}`];if(z)K.push(`next prime ${z}`);if(Q)K.push(Q);if(G>0)K.push(`${G} ${G===1?"prime":"primes"} ≈ $${bI(X.estimatedCostUsd??0)}`);J.push(`- ${K.join(" · ")}`)}return J.push(""),J.push("Usage: `/claude-prime on`, `/claude-prime off`, or status."),J.join(`
+`)}function fI($){if(typeof $!=="number")return"";return new Date($).toLocaleTimeString([],{hour:"2-digit",minute:"2-digit"})}function EI($,Z){if(typeof $!=="number")return"";let J=new Date($).toLocaleTimeString([],{hour:"2-digit",minute:"2-digit"});if(Z==="error")return`primed ${J} err`;if(Z==="skipped")return`primed ${J} skipped`;return`primed ${J} ✓`}function bI($){if($===0)return"0";if($<0.0001)return $.toExponential(2);return $.toFixed(Math.min(6,Math.max(0,4)))}function NC($){let Z=SI($.argumentsText);if(Z.type==="status")return{text:z4({enabled:$.enabled,accounts:$.accounts})};if(Z.type==="enable")return{text:z4({enabled:!0,accounts:$.accounts}),updated:{enabled:!0}};if(Z.type==="disable")return{text:z4({enabled:!1,accounts:$.accounts}),updated:{enabled:!1}};return{text:["## Claude Prime Usage","","Usage: `/claude-prime`, `/claude-prime on`, or `/claude-prime off`.","",z4({enabled:$.enabled,accounts:$.accounts})].join(`
+`)}}var gI={"not-oauth":"API-key account",disabled:"disabled","needs-reauth":"needs re-login",killswitch:"killswitch"};function yI($){if(!$.isOAuth)return{eligible:!1,reason:"not-oauth"};if(!$.isEnabled)return{eligible:!1,reason:"disabled"};if($.hasPermanentRefreshError)return{eligible:!1,reason:"needs-reauth"};return{eligible:!0}}function n3($){return gI[$]}var hI={model:hz,max_tokens:1,system:"Reply with 1 when you receive 0.",messages:[{role:"user",content:"0"}]};function UC(){return JSON.parse(JSON.stringify(hI))}function o3(){return s8(AI(),"opencode-anthropic-auth","prime")}function mI($){let Z=wI($),J;try{J=II(Z)}catch(X){if(X.code!=="ENOENT")throw X;J=Z}return MI("sha256").update(J).digest("hex").slice(0,12)}function tK($,Z){return s8($,mI(Z))}function uI($,Z,J){if(!/^[a-f0-9]{12,}$/i.test(J))throw Error("Prime account fingerprint must be a hexadecimal digest");return s8(tK($,Z),J.toLowerCase().slice(0,12))}function r3($,Z,J){return s8($,`${encodeURIComponent(Z)}-${J}`)}function e3($,Z){return s8($,`${encodeURIComponent(Z)}-bootstrap`)}function l7($,Z){if($==="main")return"main";if(Z&&"label"in Z&&Z.label?.trim())return Z.label;return $}function pI($){let Z=[],J=$.refresh?.mainLastRefreshError;Z.push({id:"main",label:"main",isOAuth:!0,isEnabled:!0,hasPermanentRefreshError:T4(J),storedQuota:$.quota?.mainQuota,storedFiveHour:$.quota?.mainQuota?.five_hour});for(let X of $.accounts??[]){if(X.id==="main"){t.debug("prime","ineligible",{account:l7(X.id,X),reason:"reserved-id"});continue}if(!n0(X)){Z.push({id:X.id,label:l7(X.id,X),isOAuth:!1,isEnabled:X.enabled!==!1,hasPermanentRefreshError:!1});continue}Z.push({id:X.id,label:l7(X.id,X),isOAuth:!0,isEnabled:X.enabled!==!1,hasPermanentRefreshError:T4(X.lastRefreshError),storedQuota:X.quota,storedFiveHour:X.quota?.five_hour})}return Z}function $G($){if(!$?.resetsAt)return;let Z=Date.parse($.resetsAt);return Number.isFinite(Z)?Z:void 0}class cI{timer=null;setIntervalImpl;clearIntervalImpl;setTimeoutImpl;clearTimeoutImpl;postFireRefreshTimers=new Set;lastForcedCheck=new Map;stopped=!1;options;transient=new Map;counters=new Map;windowActive=new Map;constructor($){this.options=$,this.setIntervalImpl=$.setIntervalImpl??globalThis.setInterval,this.clearIntervalImpl=$.clearIntervalImpl??globalThis.clearInterval,this.setTimeoutImpl=$.setTimeoutImpl??globalThis.setTimeout,this.clearTimeoutImpl=$.clearTimeoutImpl??globalThis.clearTimeout}updateOptions($){this.options=$}start(){if(this.timer)return;if(this.stopped=!1,t.trace("prime","manager started"),this.timer=this.setIntervalImpl(()=>{this.tick().catch(()=>{t.warn("prime","tick failed")})},RI),typeof this.timer==="object"&&"unref"in this.timer)this.timer.unref?.()}stop(){let $=this.timer!==null,Z=this.postFireRefreshTimers.size>0;if(this.stopped=!0,this.timer)this.clearIntervalImpl(this.timer),this.timer=null;for(let J of this.postFireRefreshTimers)this.clearTimeoutImpl(J);if(this.postFireRefreshTimers.clear(),this.lastForcedCheck.clear(),!$&&!Z)return;t.trace("prime","manager stopped")}isStopped(){return this.stopped}async tick(){let $=this.options.now?.()??Date.now();if(t.trace("prime","tick start",{now:$}),await this.sweepMarkers($),this.stopped){t.trace("prime","tick: stopped, aborting");return}let Z=await this.options.loadStorage();if(!Z){t.trace("prime","tick: no storage, skipping");return}if(Z.prime?.enabled!==!0){t.trace("prime","tick: feature disabled, skipping");return}let J=pI(Z);await Promise.all(J.map((X)=>this.runForAccount(X,Z,$))),t.trace("prime","tick end")}stats($,Z){let J=vI($??null,{now:Z,transient:this.transient});if(this.counters.size===0)return J;return J.map((X)=>{let Y=this.counters.get(X.id);if(!Y)return X;return{...X,usage:Y,estimatedCostUsd:Q5(Y)}})}isWindowActive($){return this.windowActive.has($)}async runForAccount($,Z,J){try{if(this.stopped)return;let X=yI({storage:Z,accountId:$.id,isOAuth:$.isOAuth,isEnabled:$.isEnabled,hasPermanentRefreshError:$.hasPermanentRefreshError,quota:$.storedQuota});if(!X.eligible){t.debug("prime","ineligible",{account:$.label,reason:n3(X.reason)});return}let Y=$G($.storedFiveHour);if(Y!==void 0&&J<Y+sK){t.trace("prime","not due",{account:$.label});return}let G=await this.options.getAccountFingerprint($.id);if(!G){t.debug("prime","credential identity unavailable",{account:$.label});return}let z=`${$.id}:${G.toLowerCase().slice(0,12)}`,Q=this.markerDir(G),K=e3(Q,$.id),W=Y===void 0?K:r3(Q,$.id,Y);try{await t3(W);return}catch(D){if(D.code!=="ENOENT")throw D}if(Y===void 0&&await this.hasAnyClaimMarker($.id,G))return;if(this.stopped)return;let V=this.lastForcedCheck.get(z);if(V!==void 0&&V.resetEpoch===Y&&J<V.at+CI)return;this.lastForcedCheck.set(z,{at:J,resetEpoch:Y});let B;try{B=await this.options.refreshQuota($.id)}catch{t.warn("prime","refresh failed",{account:$.label});return}if(this.stopped)return;let q=await this.options.loadStorage();if(q?.prime?.enabled!==!0)return;let H=B.quota;if(!B.fresh){t.debug("prime","stale fresh-check",{account:$.label});return}if(!mG(H,q,$.id,hz)){t.debug("prime","ineligible",{account:$.label,reason:n3("killswitch")});return}let j=$G(H?.five_hour);if(j!==void 0&&j>J){t.debug("prime","window active",{account:$.label,resetsAt:H.five_hour?.resetsAt}),this.windowActive.set($.id,J);return}this.windowActive.delete($.id);let x=j??Y,N=x===void 0?await this.tryClaimBootstrap($.id,G):await this.tryClaim($.id,G,x);if(!N){t.debug("prime","claim lost",{account:$.label,marker:`${$.id}-${x??"bootstrap"}`});return}let U=await this.options.loadStorage();if(this.stopped||U?.prime?.enabled!==!0){await G4(N,{force:!0});return}if(x!==void 0){if(await G4(K,{force:!0}),this.stopped){await G4(N,{force:!0});return}}await this.fire($,J,U)}catch{t.warn("prime","account evaluation failed",{account:$.label})}}async tryClaim($,Z,J){let X=this.markerDir(Z),Y=r3(X,$,J);return this.tryClaimPath(X,Y)}async tryClaimBootstrap($,Z){let J=this.markerDir(Z),X=e3(J,$);return this.tryClaimPath(J,X)}async tryClaimPath($,Z){try{await _I($,{recursive:!0})}catch{}try{return await PI(Z,"",{encoding:"utf8",flag:"wx"}),Z}catch(J){if(J.code==="EEXIST")return null;throw J}}async hasAnyClaimMarker($,Z){let J=this.markerDir(Z),X=`${encodeURIComponent($)}-`;try{return(await s3(J)).some((Y)=>Y.startsWith(X))}catch(Y){if(Y.code==="ENOENT")return!1;throw Y}}async fire($,Z,J){let X;try{X=await this.options.sendPrime($.id)}catch{t.warn("prime","prime fire threw",{account:$.label}),this.transient.set($.id,{lastPrimedAt:Z,lastResult:"error"});return}if(this.stopped)return;if(!X.ok){if(X.reason==="token-refresh")t.warn("prime","prime token refresh failed",{account:$.label,reason:"token-refresh"});else if(X.reason==="vault-cold")t.debug("prime","prime vault credential cold",{account:$.label,reason:X.reason});else t.warn("prime","prime fire failed",{account:$.label,status:X.status,reason:"send"});this.transient.set($.id,{lastPrimedAt:Z,lastResult:X.reason==="vault-cold"?"skipped":"error"});return}let Y={inputTokens:X.usage?.inputTokens,outputTokens:X.usage?.outputTokens};try{let G=await this.options.recordSuccess($.id,Y);if(this.stopped){this.transient.delete($.id),this.counters.delete($.id);return}this.counters.set($.id,G),this.transient.set($.id,{lastPrimedAt:Z,lastResult:"ok"}),t.info("prime","prime fired",{account:$.label,status:X.status,ms:X.ms,usage:{inputTokens:G.inputTokens,outputTokens:G.outputTokens}}),this.schedulePostFireRefresh($)}catch{t.warn("prime","recordSuccess failed",{account:$.label}),this.transient.set($.id,{lastPrimedAt:Z,lastResult:"error"})}}schedulePostFireRefresh($){let Z=this.setTimeoutImpl(()=>{if(this.postFireRefreshTimers.delete(Z),this.stopped)return;(async()=>{let J=await this.options.loadStorage();if(this.stopped||J?.prime?.enabled!==!0)return;await this.options.refreshQuota($.id)})().catch(()=>{t.debug("prime","post-fire refresh failed",{account:$.label})})},FI);if(this.postFireRefreshTimers.add(Z),typeof Z==="object"&&"unref"in Z)Z.unref?.()}async sweepMarkers($){let Z=this.storageMarkerDir(),J=await this.sweepMarkerDirectory(Z,$);if(J>0)t.trace("prime","swept stale markers",{swept:J})}async sweepMarkerDirectory($,Z){let J;try{J=await s3($)}catch{return 0}let X=0;for(let Y of J)try{let G=s8($,Y),z=await t3(G);if(z.isDirectory()){X+=await this.sweepMarkerDirectory(G,Z);continue}if(Z-z.mtimeMs>TI)await G4(G,{force:!0}),X+=1}catch{}return X}storageMarkerDir(){return tK(this.options.markerDir??o3(),this.options.storagePath)}markerDir($){return uI(this.options.markerDir??o3(),this.options.storagePath,$)}}var O8=3,i7=180000;function s7(){return process.env.OPENCODE_ANTHROPIC_AUTH_QUOTA_FEED_DIR??A4(aI(),"opencode-anthropic-auth","quota-header-feed")}function IC($){return($.storage?.accounts.filter(n0).length??0)+($.mainOAuthConfigured?1:0)}function aK($){if($.schema_version!==O8||$.provider!=="anthropic")return!1;if(!Number.isFinite($.configured_account_count)||!Number.isFinite($.observed_at_ms))return!1;if(!$.quota||typeof $.quota!=="object")return!1;if(!Object.hasOwn($,"anthropic_account_uuid")||$.anthropic_account_uuid!==null&&typeof $.anthropic_account_uuid!=="string")return!1;if($.identity_source==="none")return!("credential_id"in $)&&!("account_ref"in $);if($.identity_source==="credential_id")return typeof $.credential_id==="string"&&$.credential_id.length>0&&$.credential_id!=="main"&&!("account_ref"in $);if($.identity_source==="account_ref")return typeof $.account_ref==="string"&&$.account_ref.length>0&&$.account_ref!=="main"&&!("credential_id"in $);return!1}function nI($){if($.schema_version!==O8||$.provider!=="anthropic"||!aK($))throw Error("Invalid quota header feed entry")}function S8($){return typeof $==="number"&&Number.isFinite($)}function K5($){if(!$||typeof $!=="object")return;let Z=$;if(!S8(Z.usedPercent)||!S8(Z.remainingPercent)||!S8(Z.checkedAt))return;return{usedPercent:Z.usedPercent,remainingPercent:Z.remainingPercent,...typeof Z.resetsAt==="string"&&{resetsAt:Z.resetsAt},checkedAt:Z.checkedAt}}function oI($){if(!$||typeof $!=="object")return;let Z=$,J=K5(Z);if(!J||typeof Z.id!=="string"||!Z.id.trim()||typeof Z.title!=="string"||!Z.title.trim()||typeof Z.modelName!=="string"||!Z.modelName.trim())return;return{...J,id:Z.id,title:Z.title,...typeof Z.modelId==="string"&&Z.modelId.trim()&&{modelId:Z.modelId},modelName:Z.modelName}}function GG($){if(!$||typeof $!=="object")return;let Z=$;if(!S8(Z.amountMinor)||typeof Z.currency!=="string"||!Z.currency.trim()||!S8(Z.exponent))return;return{amountMinor:Z.amountMinor,currency:Z.currency,exponent:Z.exponent}}function rI($){if(!$||typeof $!=="object")return;let Z=$,J=GG(Z.used),X=GG(Z.limit);if(!J||!X||typeof Z.exhausted!=="boolean")return;return{used:J,limit:X,...S8(Z.utilizationPercent)&&{utilizationPercent:Z.utilizationPercent},...typeof Z.severity==="string"&&{severity:Z.severity},exhausted:Z.exhausted}}function eI($,Z){if(!$||typeof $!=="object")return;let J=$,X={};for(let Y of jZ){if(!Z.has(Y))continue;let G=J[Y];if(G==="poll"||G==="headers")X[Y]=G}return Object.keys(X).length>0?X:void 0}function $_($){let Z=K5($.five_hour),J=K5($.seven_day),X=Array.isArray($.scoped)?$.scoped.map(oI).filter((Q)=>Q!=null):void 0,Y=rI($.extraUsage),G=new Set;if(Z)G.add("five_hour");if(J)G.add("seven_day");if(typeof $.bindingWindow==="string")G.add("bindingWindow");if(typeof $.fallbackAdvised==="boolean")G.add("fallbackAdvised");if(X)G.add("scoped");if(Y)G.add("extraUsage");let z=eI($.fieldSources,G);return{...Z&&{five_hour:Z},...J&&{seven_day:J},...typeof $.bindingWindow==="string"&&{bindingWindow:$.bindingWindow},...typeof $.fallbackAdvised==="boolean"&&{fallbackAdvised:$.fallbackAdvised},...X&&{scoped:X},...Y&&{extraUsage:Y},...z&&{provenance:z}}}class Z_{options;filePath;writeChain=Promise.resolve();constructor($={}){this.options=$;let Z=$.instanceId??`${process.pid}-${ZG()}`;this.filePath=A4($.directory??s7(),`${Z}.json`)}publish($){let{accountKey:Z,quota:J}=$;try{nI($)}catch(G){return Promise.reject(G)}let Y={...$.identity_source==="credential_id"?{identity_source:"credential_id",credential_id:$.credential_id}:$.identity_source==="account_ref"?{identity_source:"account_ref",account_ref:$.account_ref}:{identity_source:"none"},schema_version:$.schema_version,provider:$.provider,configured_account_count:$.configured_account_count,observed_at_ms:$.observed_at_ms,anthropic_account_uuid:$.anthropic_account_uuid,quota:$_(J)};if(!Z)return Promise.reject(Error("Invalid quota header feed account key"));return this.writeChain=this.writeChain.catch(()=>{}).then(async()=>{let G=this.options.directory??s7();await dI(G,{recursive:!0,mode:448}),await JG(G,448),await this.reapStaleSiblingLeases(G);let z={};try{let K=JSON.parse(await YG(this.filePath,"utf8"));if(K.version===O8&&K.entries&&typeof K.entries==="object")z=K.entries}catch{}z[Z]=Y;let Q=`${this.filePath}.${ZG()}.tmp`;try{await tI(Q,`${JSON.stringify({version:O8,lease_horizon_ms:this.options.leaseMs??i7,entries:z})}
+`,{mode:384}),await JG(Q,384),await iI(Q,this.filePath)}finally{await d7(Q,{force:!0})}}),this.writeChain}async reapStaleSiblingLeases($){let Z=this.options.now?.()??Date.now(),J=this.options.leaseMs??i7,X;try{X=await XG($)}catch{return}await Promise.all(X.filter((Y)=>/^\d+-[0-9a-f-]+\.json$/i.test(Y)).map(async(Y)=>{let G=A4($,Y);if(G===this.filePath)return;try{let z=await sI(G);if(z.mtimeMs>Z||Z-z.mtimeMs<J)return;await this.options.beforeRemoveFile?.(G);let Q=await lI(G);if(Q.ino!==z.ino||Q.mtimeMs!==z.mtimeMs)return;await(this.options.removeFile??((K)=>d7(K)))(G)}catch{}}))}async list(){await this.writeChain.catch(()=>{});let $=this.options.directory??s7(),Z=this.options.now?.()??Date.now(),J=this.options.leaseMs??i7,X;try{X=(await XG($)).filter((G)=>G.endsWith(".json"))}catch{return[]}let Y=new Map;return await Promise.all(X.map(async(G)=>{try{let z=JSON.parse(await YG(A4($,G),"utf8"));if(z.version!==O8||!z.entries||typeof z.entries!=="object")return;for(let[Q,K]of Object.entries(z.entries)){if(!K||typeof K!=="object"||K.schema_version!==O8||K.provider!=="anthropic"||!aK(K))continue;let W=K.observed_at_ms;if(W>Z||Z-W>=J)continue;let V=Y.get(Q);if(!V||W>V.observed_at_ms)Y.set(Q,K)}}catch{}})),[...Y.values()].sort((G,z)=>G.observed_at_ms-z.observed_at_ms)}async dispose(){await this.writeChain.catch(()=>{}),await d7(this.filePath,{force:!0})}}var a9="anthropic-ratelimit-unified-",nK={"5h":"five_hour","7d":"seven_day"};function _C($){return Object.keys(nK).some((Z)=>Number.isFinite(W5($,`${a9}${Z}-utilization`)))}function W5($,Z){let J=$.get(Z);if(J==null||J.trim()==="")return;let X=Number(J);return Number.isFinite(X)?X:void 0}function J_($,Z,J){let X=W5($,`${a9}${Z}-utilization`);if(X==null)return;let Y=Math.min(100,Math.max(0,Math.round(X*100))),G=W5($,`${a9}${Z}-reset`),z=G==null?void 0:new Date(G*1000),Q=z&&Number.isFinite(z.getTime())?z.toISOString():void 0;return{usedPercent:Y,remainingPercent:100-Y,...Q&&{resetsAt:Q},checkedAt:J}}function PC($,Z=Date.now()){let J={},X=$.get(`${a9}fallback`),Y={fallbackAdvised:X==="available",source:"headers",checkedAt:Z};for(let[z,Q]of Object.entries(nK)){let K=J_($,z,Z);if(K)Y[Q]=K,J[Q]="headers"}let G=$.get(`${a9}representative-claim`);if(G)Y.bindingWindow=G,Y.bindingWindowSource="headers",J.bindingWindow="headers";if(X!==null)J.fallbackAdvised="headers";return{...Y,fieldSources:J}}function w4($,Z){let{scoped:J,extraUsage:X,fieldSources:Y,...G}=$??{},{scoped:z,extraUsage:Q,fieldSources:K,...W}=Z,V={};for(let B of jZ){let q=B==="scoped"?J:B==="extraUsage"?X:B==="fallbackAdvised"?K?.fallbackAdvised!==void 0?Z.fallbackAdvised:$?.fallbackAdvised??Z.fallbackAdvised:B==="bindingWindow"?$?.bindingWindowSource==="poll"?$?.bindingWindow:Z.bindingWindow??$?.bindingWindow:Z[B]??$?.[B];if(q===void 0)continue;let H=B==="fallbackAdvised"?K?.fallbackAdvised??($?.fallbackAdvised!==void 0?Y?Y.fallbackAdvised:K0($,B):void 0):(B==="scoped"||B==="extraUsage")&&q!==void 0?"poll":B==="bindingWindow"&&$?.bindingWindowSource==="poll"&&$.bindingWindow!==void 0?"poll":Z[B]!==void 0?K?.[B]??K0(Z,B):Y?.[B]??K0($,B);if(H)V[B]=H}return{...G,...W,...Array.isArray(J)&&{scoped:J},...X!=null&&{extraUsage:X},fallbackAdvised:K?.fallbackAdvised!==void 0?Z.fallbackAdvised:$?.fallbackAdvised??Z.fallbackAdvised,bindingWindow:$?.bindingWindowSource==="poll"?$.bindingWindow:Z.bindingWindow??$?.bindingWindow,bindingWindowSource:$?.bindingWindowSource==="poll"?"poll":Z.bindingWindowSource??$?.bindingWindowSource,...Object.keys(V).length>0&&{fieldSources:V},source:"headers"}}var X_=globalThis.setTimeout;function zG($,Z){if($?.source!=="headers")return Z;let J=Boolean($.five_hour&&$.five_hour.checkedAt>(Z.five_hour?.checkedAt??0)),X=Boolean($.seven_day&&$.seven_day.checkedAt>(Z.seven_day?.checkedAt??0));if(!J&&!X)return Z;return w4(Z,{...J&&{five_hour:$.five_hour},...X&&{seven_day:$.seven_day},fallbackAdvised:$.fallbackAdvised,...$.bindingWindowSource==="headers"&&{bindingWindow:$.bindingWindow,bindingWindowSource:$.bindingWindowSource},source:"headers",checkedAt:Math.max(J?$.five_hour?.checkedAt??0:0,X?$.seven_day?.checkedAt??0:0)})}class E0{main=null;mainAccountId;mainQuotaIdentityKnown=!1;mainQuotaIdentityStrict=!1;mainGeneration=0;mainQuotaErrorGeneration=0;mainQuotaErrorClearedAt;fallbacks=new Map;fallbackAuthLineages=new Map;fallbackGenerations=new Map;inflightMain=null;lastMainPollAttempt;inflightMainAccountId;inflightMainAccessToken;inflightMainToken=0;inflightFallbacks=new Map;mainLastApiError=void 0;fallbackApiErrors=new Map;apiGate=Promise.resolve();lastApiCallAt;storage;fetchImpl;fetchQuotaSnapshot;now;onMainQuotaFetched;onApiError;onFallbackQuotaFetched;onFallbackApiError;constructor($){this.storage=$.storage,this.fetchImpl=$.fetchImpl??fetch,this.fetchQuotaSnapshot=$.fetchQuotaSnapshot,this.now=$.now??Date.now,this.onMainQuotaFetched=$.onMainQuotaFetched,this.onApiError=$.onApiError,this.onFallbackQuotaFetched=$.onFallbackQuotaFetched,this.onFallbackApiError=$.onFallbackApiError,this.seedMainFromStorage($.storage,$.storage?.mainAccountId),this.seedMainBackoffFromStorage($.storage)}getMain($){if(this.mainAccountId!==$)return null;if(this.mainQuotaIdentityKnown&&this.mainQuotaIdentityStrict&&($===void 0||this.main?.quota.accountIdentity!==$))return null;return this.main}getFallback($,Z){return this.bindFallbackLineage($,Z),this.fallbacks.get($)??null}canFetchWithoutAccessToken(){return Boolean(this.fetchQuotaSnapshot)}getAllFallbacks(){return this.fallbacks}setMain($,Z){this.mainAccountId=$,this.main=Z}clearMain(){this.mainAccountId=void 0,this.main=null}setMainQuotaAccountIdentity($,Z=!0,J=!1){let X=this.mainQuotaIdentityKnown,Y=this.mainAccountId,G=J||!X||this.mainAccountId!==$||this.mainQuotaIdentityStrict!==Z;if(this.mainQuotaIdentityKnown=!0,this.mainQuotaIdentityStrict=Z,!G)return;if(this.mainGeneration+=1,this.mainAccountId=$,J)this.main=null,this.mainLastApiError=void 0,this.mainQuotaErrorGeneration+=1,this.mainQuotaErrorClearedAt=J9(this.mainQuotaErrorClearedAt,this.now());else if($!==void 0&&this.main?.quota.accountIdentity!==$)this.main=null;if($!==void 0&&this.mainLastApiError&&(this.mainLastApiError.accountIdentity!==void 0?this.mainLastApiError.accountIdentity!==$:X&&Y!==void 0&&Y!==$))return this.mainLastApiError=void 0,this.mainQuotaErrorGeneration+=1,this.mainQuotaErrorClearedAt=J9(this.mainQuotaErrorClearedAt,this.now()),this.mainQuotaErrorGeneration;return}setFallback($,Z,J){this.bindFallbackLineage($,J),this.fallbacks.set($,Z)}clearFallback($){this.fallbackGenerations.set($,(this.fallbackGenerations.get($)??0)+1),this.fallbacks.delete($),this.fallbackApiErrors.delete($),this.inflightFallbacks.delete(E0.fallbackInflightKey($))}pushMainFromHeaders($,Z){let J=Z.checkedAt??this.now(),X=w4(this.mainAccountId===$&&(!this.mainQuotaIdentityKnown||!this.mainQuotaIdentityStrict||this.main?.quota.accountIdentity===$)?this.main?.quota:void 0,{...Z,...$!==void 0&&{accountIdentity:$}}),Y={quota:X,checkedAt:J,refreshAfter:B8(X,this.storage,J)};return this.setMain($,Y),Y}pushFallbackFromHeaders($,Z,J){if(!this.acceptFallbackQuotaObservation($,J))return null;let X=Z.checkedAt??this.now(),Y=w4(this.fallbacks.get($)?.quota,{...Z,accountIdentity:$}),G={quota:Y,checkedAt:X,refreshAfter:B8(Y,this.storage,X)};return this.fallbacks.set($,G),G}async refreshMain($,Z,J){let X=$,Y=Z??$;if(!Y&&!this.canFetchWithoutAccessToken())throw Error("Main OAuth access token is unavailable");return(await this.refreshMainWithMetadata(X,Y,J)).quota}async refreshMainWithMetadata($,Z,J){let X=$,Y=Z??$;if(!Y&&!this.canFetchWithoutAccessToken())throw Error("Main OAuth access token is unavailable");if(J!==void 0&&(this.mainGeneration!==J||this.mainAccountId!==X))throw Error("Main quota identity changed before refresh");if(this.mainAccountId!==X){if(this.main=null,this.mainAccountId=X,this.mainQuotaIdentityKnown)this.mainGeneration+=1}if(this.inflightMain&&this.inflightMainAccountId===X&&this.inflightMainAccessToken===Y)return this.inflightMain;if(this.isBackedOff()){if(this.main&&this.mainAccountId===X)return{quota:this.main.quota,fetched:!1};throw Error("Quota API rate-limited — try again later")}this.inflightMainAccountId=X,this.inflightMainAccessToken=Y;let G=this.mainGeneration,z=++this.inflightMainToken;return this.inflightMain=this._fetchMain(X,Y??"",G,z),this.inflightMain}async refreshFallback($,Z,J){return(await this.refreshFallbackWithMetadata($,Z,J)).quota}async refreshFallbackWithMetadata($,Z,J){if(!Z&&!this.canFetchWithoutAccessToken())throw Error("Fallback OAuth access token is unavailable");this.bindFallbackLineage($,J);let X=E0.fallbackInflightKey($),Y=this.inflightFallbacks.get(X);if(Y)return Y;if(this.isFallbackBackedOff($)){let Q=this.getFallback($);if(Q)return{quota:Q.quota,fetched:!1};throw Error("Quota API rate-limited — try again later")}let G=this.fallbackGenerations.get($)??0,z=this._fetchFallback($,Z,G,J);return this.inflightFallbacks.set(X,z),z.then(()=>{if(this.inflightFallbacks.get(X)===z)this.inflightFallbacks.delete(X)},()=>{if(this.inflightFallbacks.get(X)===z)this.inflightFallbacks.delete(X)}),z}async refreshAllFallbacks($,Z){let J=this.now();for(let X of $){if(X.enabled===!1)continue;let Y=Z!==void 0?Z(X):X.access&&X.expires!==void 0&&X.expires>J?X.access:void 0;if(!Y)continue;this.bindFallbackLineage(X.id,X);let G=this.getFallback(X.id);if(G&&J<G.refreshAfter)continue;try{await this.refreshFallback(X.id,Y,X)}catch{}}}refreshMainInBackground($){if(this.inflightMain)return;if(this.isBackedOff())return;this.refreshMain(this.mainAccountId,$).catch(()=>{})}scopedWindowIsStale($,Z){let J=o$($.quota,Z);return Boolean(J&&this.now()-J.checkedAt>=M9(this.storage))}isMainStale($){if(!this.main)return!0;if(this.mainQuotaIdentityKnown&&this.mainQuotaIdentityStrict&&(this.mainAccountId===void 0||this.main.quota.accountIdentity!==this.mainAccountId))return!0;return this.now()>=this.main.refreshAfter||this.scopedWindowIsStale(this.main,$)||this.main.quota.source==="headers"&&this.main.quota.scoped===void 0&&(this.lastMainPollAttempt===void 0||this.lastMainPollAttempt.accountId!==this.mainAccountId||this.now()-this.lastMainPollAttempt.at>=M9(this.storage))}isFallbackStale($,Z,J,X){let Y=this.getFallback($,X);if(!Y)return!0;return this.now()>=Y.refreshAfter||this.scopedWindowIsStale(Y,J)}shouldRefreshOnRequestCount($){let Z=AB(this.storage);if(Z<=0)return!1;return $>0&&$%Z===0}needsRefresh($,Z){return this.isMainStale(Z)||this.shouldRefreshOnRequestCount($)}updateStorage($){this.storage=$,this.seedMainFromStorage($,this.mainQuotaIdentityKnown?this.mainAccountId:$?.mainAccountId),this.seedMainBackoffFromStorage($)}seedMainFromStorage($,Z){let J=PB($);if(!J)return;let X={quota:{...J.quota,...(!this.mainQuotaIdentityKnown||!this.mainQuotaIdentityStrict)&&Z!==void 0&&J.accountIdentity===void 0&&{accountIdentity:Z}},refreshAfter:B8(J.quota,$,J.checkedAt),checkedAt:J.checkedAt},Y=this.main&&this.mainAccountId===Z&&(!this.mainQuotaIdentityKnown||!this.mainQuotaIdentityStrict||this.main.quota.accountIdentity===Z)?this.main:void 0;if(Y&&Y.checkedAt>=X.checkedAt&&Y.quota.source==="headers"&&X.quota.source==="poll"){let G=w4(X.quota,Y.quota);this.main={quota:G,refreshAfter:B8(G,$,Y.checkedAt),checkedAt:Y.checkedAt};return}if(this.main&&this.mainAccountId===Z&&this.main.checkedAt>=X.checkedAt)return;if(this.main=X,Z!==void 0)this.mainAccountId=Z}seedMainBackoffFromStorage($){let Z=$?.quota?.mainLastQuotaApiError,J=Z?.accountIdentity,X=typeof $?.quota?.mainQuotaErrorGeneration==="number"&&Number.isSafeInteger($.quota.mainQuotaErrorGeneration)&&$.quota.mainQuotaErrorGeneration>=0?$.quota.mainQuotaErrorGeneration:void 0,Y=typeof $?.quota?.mainQuotaErrorClearedAt==="number"&&Number.isFinite($.quota.mainQuotaErrorClearedAt)&&$.quota.mainQuotaErrorClearedAt>=0?$.quota.mainQuotaErrorClearedAt:void 0;if(Y!==void 0&&(this.mainQuotaErrorClearedAt===void 0||Y>this.mainQuotaErrorClearedAt)){if(this.mainQuotaErrorClearedAt=J9(this.mainQuotaErrorClearedAt,Y),(!Z||typeof Z.checkedAt==="number"&&Z.checkedAt<=Y)&&(this.mainLastApiError?.checkedAt===void 0||this.mainLastApiError.checkedAt<=Y))this.mainLastApiError=void 0}if(X!==void 0&&X>this.mainQuotaErrorGeneration){if(this.mainQuotaErrorGeneration=X,!Z&&(this.mainLastApiError?.checkedAt===void 0||this.mainQuotaErrorClearedAt===void 0||this.mainLastApiError.checkedAt<=this.mainQuotaErrorClearedAt))this.mainLastApiError=void 0}if(Z&&(!this.mainQuotaIdentityKnown||J===void 0||J===this.mainAccountId)&&(this.mainQuotaErrorClearedAt===void 0||typeof Z.checkedAt!=="number"||Z.checkedAt>this.mainQuotaErrorClearedAt)&&(this.mainLastApiError?.checkedAt===void 0||Z.checkedAt>=this.mainLastApiError.checkedAt)&&h1(Z,this.now())){if(this.mainLastApiError=Z,X!==void 0)this.mainQuotaErrorGeneration=X;return}if(this.mainAccountId!==void 0&&this.mainLastApiError?.accountIdentity!==void 0&&this.mainLastApiError.accountIdentity!==this.mainAccountId)this.mainLastApiError=void 0}seedFallbacksFromAccounts($){let Z=M9(this.storage),J=new Set($.map((X)=>X.id));for(let X of this.fallbackAuthLineages.keys())if(!J.has(X))this.clearFallback(X),this.fallbackAuthLineages.delete(X);for(let X of $){if(this.bindFallbackLineage(X.id,X))continue;if(X.enabled===!1)continue;let G=X.lastQuotaRefreshError,z=o0(X.quota),Q=this.fallbackApiErrors.get(X.id);if(G&&h1(G,this.now())&&z<=(G.checkedAt??0)&&(!Q||G.checkedAt>=Q.checkedAt))this.fallbackApiErrors.set(X.id,G);else if(Q&&z>=Q.checkedAt)this.fallbackApiErrors.delete(X.id);if(!X.quota)continue;let K=o0(X.quota);if(K<=0)continue;let W=this.getFallback(X.id);if(W&&W.checkedAt>=K)continue;this.setFallback(X.id,{quota:{...X.quota,accountIdentity:X.id},refreshAfter:K+Z,checkedAt:K},X)}}isBackedOff(){return h1(this.mainLastApiError,this.now())}isFallbackBackedOff($){return h1(this.fallbackApiErrors.get($),this.now())}getLastApiError(){return this.mainLastApiError}getMainQuotaErrorGeneration(){return this.mainQuotaErrorGeneration}getMainQuotaIdentityGeneration(){return this.mainGeneration}getMainQuotaErrorClearedAt(){return this.mainQuotaErrorClearedAt}clearMainBackoff(){if(!this.mainLastApiError)return;return this.mainLastApiError=void 0,this.mainQuotaErrorGeneration+=1,this.mainQuotaErrorClearedAt=J9(this.mainQuotaErrorClearedAt,this.now()),this.mainQuotaErrorGeneration}static API_CALL_GAP_MS=1000;static fallbackInflightKey($){return $}static quotaLockName($){return`opencode-fallback-quota-refresh-${$.replace(/[^a-zA-Z0-9._-]+/g,"-")||"account"}`}bindFallbackLineage($,Z){if(!Z)return!1;let J=this.fallbackAuthLineages.has($),X=this.fallbackAuthLineages.get($),Y=J&&Z.authLineageId!==void 0&&X!==Z.authLineageId;if(Y)this.clearFallback($);return this.fallbackAuthLineages.set($,Z.authLineageId),Y}acceptFallbackQuotaObservation($,Z){let J=this.fallbackAuthLineages.has($),X=this.fallbackAuthLineages.get($),Y=Z?.authLineageId;if(J&&X!==Y)return t.trace("quota","skipped stale fallback quota observation after lineage change",{accountId:$,storedLineage:X,servedLineage:Y}),!1;if(!J)this.fallbackAuthLineages.set($,Y);return!0}isClosed=!1;close(){this.isClosed=!0,this.inflightFallbacks.clear(),this.inflightMain=null}_enqueueApiFetch($){let Z=async()=>{if(this.isClosed)throw Error("QuotaManager is closed");return $()},J=this.apiGate.then(Z,Z);return this.apiGate=J.catch(()=>{}),J}_quotaDispatch($,Z){return async(J,X)=>{if(this.lastApiCallAt!==void 0){let G=E0.API_CALL_GAP_MS-(this.now()-this.lastApiCallAt);if(G>0)await new Promise((z)=>{let Q=X_(z,G);if(typeof Q==="object"&&"unref"in Q)Q.unref()})}if(this.isClosed)throw Error("QuotaManager is closed");if(await X(),await Z?.(),this.isClosed)throw Error("QuotaManager is closed");let Y=this.now();$?.(Y);try{return J()}finally{this.lastApiCallAt=this.now()}}}_quotaFetch($){return Object.assign((Z,J)=>$(()=>this.fetchImpl(Z,J),async()=>J?.signal?.throwIfAborted()),{preconnect:this.fetchImpl.preconnect})}async _fetchMain($,Z,J,X){return this._enqueueApiFetch(async()=>{try{if(this.isBackedOff()){if(this.main&&this.mainAccountId===$)return{quota:this.main.quota,fetched:!1};throw Error("Quota API rate-limited — try again later")}if(this.mainQuotaIdentityKnown&&this.mainQuotaIdentityStrict&&this.mainGeneration!==J)return{quota:{accountIdentity:$},fetched:!1};let Y=await b9({name:"opencode-main-quota-refresh",ttlMs:30000});if(!Y){let G=this.main;if(G&&this.mainAccountId===$&&this.now()<G.refreshAfter)return{quota:G.quota,fetched:!1};throw Error("Quota refresh is already in progress")}try{let G=this.lastMainPollAttempt,z,Q=this.now(),K=!1,W=this._quotaDispatch((H)=>{if(!K)Q=H;K=!0,z={accountId:$,at:H},this.lastMainPollAttempt=z},async()=>{if(await Y.assertOwned(),this.mainGeneration!==J)throw Error("Main quota identity changed before dispatch")}),V=this.fetchQuotaSnapshot?await this.fetchQuotaSnapshot({kind:"main",accountId:$,accessToken:Z},W):await S4({accessToken:Z,fetchImpl:this._quotaFetch(W),now:this.now});try{await Y.assertOwned()}catch{if(z&&this.lastMainPollAttempt===z)this.lastMainPollAttempt=G;return{quota:this.getMain($)?.quota??{accountIdentity:$},fetched:!1}}let B=this.now();if(this.mainQuotaIdentityKnown&&this.mainQuotaIdentityStrict&&this.mainGeneration!==J)return{quota:{...V,...$!==void 0&&{accountIdentity:$}},fetched:!0};let q=zG(this.mainAccountId===$&&(!this.mainQuotaIdentityKnown||!this.mainQuotaIdentityStrict||this.main?.quota.accountIdentity===$)?this.main?.quota:void 0,{...V,...$!==void 0&&{accountIdentity:$}});if(this.mainAccountId=$,this.main={quota:q,refreshAfter:B8(q,this.storage,B),checkedAt:q.checkedAt??B},this.mainLastApiError)this.mainLastApiError=void 0,this.mainQuotaErrorGeneration+=1,this.mainQuotaErrorClearedAt=J9(this.mainQuotaErrorClearedAt,B);return this.onMainQuotaFetched?.(q,B,S$(Z),Q,this.mainQuotaErrorGeneration,this.mainQuotaErrorClearedAt),{quota:q,fetched:!0}}catch(G){throw this._handleMainFetchError(G,J),G}finally{await Y.release()}}finally{if(this.inflightMainToken===X)this.inflightMain=null,this.inflightMainAccountId=void 0}})}async _fetchFallback($,Z,J,X){return this._enqueueApiFetch(async()=>{try{if((this.fallbackGenerations.get($)??0)!==J)return{quota:{accountIdentity:$},fetched:!1};if(this.isFallbackBackedOff($)){let G=this.getFallback($,X);if(G)return{quota:G.quota,fetched:!1};throw Error("Quota API rate-limited — try again later")}let Y=await b9({name:E0.quotaLockName($),ttlMs:30000});if(!Y){let G=this.getFallback($,X);if(G&&this.now()<G.refreshAfter)return{quota:G.quota,fetched:!1};throw Error("Quota refresh is already in progress")}try{let G=this.now(),z=!1,Q=this._quotaDispatch((B)=>{if(!z)G=B;z=!0},async()=>{if(await Y.assertOwned(),(this.fallbackGenerations.get($)??0)!==J)throw Error("Fallback quota identity changed before dispatch")}),K=this.fetchQuotaSnapshot?await this.fetchQuotaSnapshot({kind:"fallback",accountId:$,accessToken:Z},Q):await S4({accessToken:Z,fetchImpl:this._quotaFetch(Q),now:this.now});try{await Y.assertOwned()}catch{return{quota:this.getFallback($,X)?.quota??{accountIdentity:$},fetched:!1}}let W=this.now();if((this.fallbackGenerations.get($)??0)!==J)return{quota:{...K,accountIdentity:$},fetched:!0};let V=zG(this.getFallback($,X)?.quota,{...K,accountIdentity:$});return this.setFallback($,{quota:V,refreshAfter:B8(V,this.storage,W),checkedAt:V.checkedAt??W},X),this.fallbackApiErrors.delete($),this.onFallbackQuotaFetched?.($,V,W,G),{quota:V,fetched:!0}}finally{await Y.release()}}catch(Y){throw this._handleFallbackFetchError($,Y,J),Y}})}static isAuthError($){if($.status===401||_B($))return!0;let J=$ instanceof Error?$.message:String($);return/quota check failed: 401\b/.test(J)}_handleMainFetchError($,Z){if(this.mainGeneration!==Z)return;if(this.mainQuotaIdentityKnown&&this.mainQuotaIdentityStrict&&this.mainAccountId===void 0)return;if(E0.isAuthError($))return;this.mainLastApiError=e7({error:$,now:this.now(),accountIdentity:this.mainAccountId,previous:this.mainLastApiError}),this.mainQuotaErrorGeneration+=1,this.onApiError?.(this.mainLastApiError,this.mainQuotaErrorGeneration)}_handleFallbackFetchError($,Z,J){if((this.fallbackGenerations.get($)??0)!==J)return;if(E0.isAuthError(Z))return;let X=this.fallbackApiErrors.get($),Y=e7({error:Z,now:this.now(),previous:X,accountIdentity:$});this.fallbackApiErrors.set($,Y),this.onFallbackApiError?.($,Y)}}var QG={five_hour:"5h",seven_day:"1w"};function KZ($){return`${Math.round($*10)/10}%`}function WZ($,Z){let J=Math.max(0,Z-$),X=Math.floor(J/60000);if(X<1)return"just now";if(X===1)return"1m ago";if(X<60)return`${X}m ago`;let Y=Math.floor(X/60),G=X%60;if(G===0)return`${Y}h ago`;return`${Y}h ${G}m ago`}function Y_($,Z){let J=Date.parse($);if(!Number.isFinite(J))return $;let X=J-Z;if(X<=0)return"now";let Y=Math.max(1,Math.ceil(X/60000));if(Y<60)return`in ${Y}m`;let G=Math.floor(Y/60),z=Y%60;if(z===0)return`in ${G}h`;return`in ${G}h ${z}m`}function oK($,Z){if(!$)return"";return`, resets ${Y_($,Z)}`}function KG($,Z,J,X){if(!Z)return`  - ${QG[$]}: unknown`;let Y=[`  - ${QG[$]}: ${KZ(Z.remainingPercent)} remaining`,` (${KZ(Z.usedPercent)} used`,`${oK(Z.resetsAt,J)}, checked ${WZ(Z.checkedAt,J)})`].join("");return X===$?`${Y} •`:Y}function WG($){try{return new Intl.NumberFormat("en-US",{style:"currency",currency:$.currency,minimumFractionDigits:$.exponent,maximumFractionDigits:$.exponent}).format($.amountMinor/10**$.exponent)}catch{return`${$.amountMinor} ${$.currency}`}}function G_($,Z){return[`  - ${$.title}: ${KZ($.remainingPercent)} remaining`,` (${KZ($.usedPercent)} used`,`${oK($.resetsAt,Z)}, checked ${WZ($.checkedAt,Z)})`].join("")}function z_($){return $.label?.trim()||$.id}function Q_($){return $.lastQuotaRefreshError?.message??$.lastRefreshError?.message}function AC($,Z=new Map){if(!$?.accounts.length)return[];return $.accounts.filter(n0).map((J)=>{let X=Z.get(J.id)??Q_(J);return{name:z_(J),role:"fallback",enabled:J.enabled!==!1,quota:J.quota,...c4(J.profile)&&{tierLabel:c4(J.profile)},lastRefreshedAt:J.lastRefreshedAt,...X&&{error:X}}})}function wC($){let Z=$.now??Date.now(),J=["## Claude Quotas",""];if($.refreshedAt)J.push(`Refreshed: ${WZ($.refreshedAt,Z)}`,"");if(!$.accounts.length)return J.push("No Claude OAuth accounts found yet."),J.join(`
+`);for(let X of $.accounts){let Y=X.role==="main"?"main":"fallback",G=X.enabled===!1?" disabled":"";if(J.push(`### ${X.name} (${Y}${G})`),X.tierLabel)J.push(`  - Tier: ${X.tierLabel}`);if(X.lastRefreshedAt)J.push(`  - Last token refresh: ${WZ(X.lastRefreshedAt,Z)}`);if(X.error)J.push(`  - Error: ${X.error}`);J.push(KG("five_hour",X.quota?.five_hour,Z,X.quota?.bindingWindow)),J.push(KG("seven_day",X.quota?.seven_day,Z,X.quota?.bindingWindow));for(let Q of X.quota?.scoped??[]){let K=G_(Q,Z);J.push(X.quota?.bindingWindow===Q.id?`${K} •`:K)}let z=X.quota?.extraUsage;if(z){let Q=WG(z.used),K=WG(z.limit);J.push(`  - credits ${Q}/${K}${z.exhausted?" · exhausted":""}`)}if(X.quota?.fallbackAdvised===!0)J.push("  - → fallback advised");J.push("")}return J.join(`
+`).trimEnd()}class n9 extends Error{failure;constructor($){super("Relay request authorization failed");this.failure=$}}function B_($){let Z=[],J=$.authorization?.trim();if(J){Z.push(J);let Y=/^\S+\s+(\S.*)$/.exec(J)?.[1];if(Y)Z.push(Y)}let X=$["x-api-key"]?.trim();if(X)Z.push(X);return Z}async function R4($,Z,J,X){try{let Y=J?await J():void 0;if(Y)Z.upstream={...Z.upstream,headers:eK(Y.headers)};return{authorization:Y,scope:X([$.token,...B_(Z.upstream.headers),...Y?.errorSecrets??[]])}}catch(Y){throw new n9(Y)}}function j9($){return typeof $==="number"&&Number.isFinite($)?$:"unknown"}function q_($){let Z;try{Z=m8($)}catch{return"http"}if(Z===null||typeof Z!=="object"||Array.isArray(Z))return"http";return"stream"in Z&&Z.stream===!0?"event-stream":"http"}class V5 extends Error{}class VZ extends Error{}var j_="relay websocket response_start metadata is invalid",H_=new Set([101,103,204,205,304]);class B5 extends Error{code="ECONNRESET";syscall="websocket";closeCode;closeReason;wasClean;constructor($,Z){super($);this.name="RelayWebSocketConnectionResetError",this.closeCode=Z?.code,this.closeReason=Z?.reason,this.wasClean=Z?.wasClean}}var p$=new Map,m0=new Map;var L_=7200000,N_=1800000,U_=128,x_=32,VG=0;function t7(){return VG+=1,`req_${Date.now().toString(36)}_${VG.toString(36)}`}function FC(){return V_(32).toString("base64url")}function D_($){return`sha256:${W_("sha256").update($).digest("hex")}`}function BG($,Z){let J=0,X=Math.min($.length,Z.length);while(J<X&&$.charCodeAt(J)===Z.charCodeAt(J))J++;let Y=$.length,G=Z.length;while(Y>J&&G>J&&$.charCodeAt(Y-1)===Z.charCodeAt(G-1))Y--,G--;return{start:J,deleteCount:Y-J,insert:Z.slice(J,G)}}function O_($){return $.deleteCount===0&&$.insert.length===0}function qG($){let Z=$.match(/\bcch=([0-9a-f]{5});/),J=Z?.[1];if(!J||Z.index==null)return null;let X=Z.index+4;return{start:X,end:X+J.length,token:J}}function M_($,Z,J,X){return`${$.slice(0,Z)}${X}${$.slice(J)}`}function rK($,Z){let J=qG($),X=qG(Z);if(J&&X&&J.start===X.start&&J.end-J.start===X.end-X.start&&J.token!==X.token){let Y={start:J.start,deleteCount:J.end-J.start,insert:X.token},G=M_($,J.start,J.end,X.token),z=BG(G,Z);return O_(z)?Y:[Y,z]}return BG($,Z)}function I_($,Z){if(typeof Z!=="string")return!1;try{let J=$ instanceof Request?new URL($.url):new URL($.toString());return J.pathname==="/v1/messages"||J.pathname==="/messages"}catch{return!1}}function eK($){let Z={};for(let[J,X]of $.entries()){if(J==="x-session-affinity"||J==="x-opencode-session")continue;Z[J]=X}return Z}async function __($,Z,J){let X=U6(),Y=JSON.stringify(Z);return x8("http_payload_stringify",{session:j6(Z.affinity),ms:e6(U6()-X),relayBytes:Y.length,mode:Z.mode}),fetch($.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":$.token},body:Y,signal:J??void 0})}function j6($){return $.length>12?`${$.slice(0,12)}…`:$}function U6(){return performance.now()}function e6($){return Math.round($*10)/10}function P_(){return process.env.OPENCODE_ANTHROPIC_AUTH_PERF==="1"}function x8($,Z){if(!P_())return;q6(`[perf] relay ${$} ${JSON.stringify(Z)}`)}function A_($){let{input:Z,init:J,headers:X,bodyText:Y,affinity:G,previous:z,nextHash:Q}=$,K=Z instanceof Request?Z.url:Z.toString(),W={protocol:1,type:"request",affinity:G,upstream:{url:K,method:J?.method||(Z instanceof Request?Z.method:"POST"),headers:eK(X)},next_hash:Q};return z?{...W,mode:"patch",base_hash:z.hash,revision:z.revision+1,patch:rK(z.body,Y)}:{...W,mode:"full_sync",revision:1,body:Y}}function q5($,Z){return{protocol:$.protocol,type:"request",affinity:$.affinity,upstream:$.upstream,next_hash:$.next_hash,mode:"full_sync",revision:1,body:Z}}function $W($,Z,J,X){let Y=Date.now();p$.delete($),p$.set($,{body:Z,hash:J,revision:X,updatedAt:Y}),j5(Y)}async function jG($,Z,J,X,Y){let{authorization:G,scope:z}=await R4($,Z,X,(K)=>f5(K,Y)),Q;try{Q=await __($,Z,J)}catch(K){let W=z.redactError(K);throw z.dispose(),W}try{return{authorization:G,scope:z,response:z.redactResponse(Q)}}catch(K){throw z.dispose(),await Q.body?.cancel().catch(()=>{}),K}}async function a7($){$.scope.dispose(),await $.response.body?.cancel().catch(()=>{})}async function HG($){let{config:Z,payload:J,bodyText:X,requestMode:Y,fallback:G,signal:z,authorizeAttempt:Q}=$,K=Y(),W=J,V=await jG(Z,W,z,Q,K);if(V.response.status===409&&W.mode==="patch")q6(`state mismatch from relay session=${j6(W.affinity)}; retrying full_sync`),await a7(V),W=q5(W,X),V=await jG(Z,W,z,Q,K);let{response:B,authorization:q}=V,H=/^req_[A-Za-z0-9_-]+$/.test(B.headers.get("request-id")??"");if(B.status===401&&!H){if(await a7(V),Z.fallbackToDirect)return q6(`relay authentication rejected; falling back direct session=${j6(W.affinity)}`),{response:await G(),payload:W,transport:"http",protocol:W.protocol,usedRelay:!1};return{response:Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502}),payload:W,transport:"http",protocol:W.protocol,usedRelay:!1}}if(H)try{q?.onUpstreamStatus?.(B.status)}catch{}if(!B.ok&&B.status>=500&&Z.fallbackToDirect)return q6(`relay returned ${B.status}; falling back direct session=${j6(W.affinity)}`),await a7(V),{response:await G(),payload:W,transport:"http",protocol:W.protocol,usedRelay:!1};return{response:B,payload:W,transport:"http",protocol:W.protocol,usedRelay:!0}}function w_($,Z){let J=new URL($);return J.protocol=J.protocol==="http:"?"ws:":"wss:",J.pathname="/ws",J.searchParams.set("token",Z),J.toString()}function R_($){return new Uint8Array(K_.from($,"base64"))}function T_($){if($ instanceof Uint8Array)return $;if($ instanceof ArrayBuffer)return new Uint8Array($);if(ArrayBuffer.isView($))return new Uint8Array($.buffer,$.byteOffset,$.byteLength);throw TypeError("relay websocket binary frame must be an ArrayBuffer or byte view")}function F_($){return JSON.parse($)}function LG($){let Z=$;return[`code=${Z.code??"unknown"}`,`wasClean=${Z.wasClean??"unknown"}`].join(" ")}function C_($){let Z=$.message||"relay websocket error";return $.status?`relay websocket error ${$.status}: ${Z}`:Z}function NG($,Z){return{stream:IH($),response:f5($,Z)}}function UG($){$.stream.dispose(),$.response.dispose()}class ZW{config;affinity;timers;socket;connecting;queue=Promise.resolve();pending;serverState;lastUsedAt=Date.now();constructor($,Z,J){this.config=$,this.affinity=Z,this.timers=J}touch($=Date.now()){this.lastUsedAt=$}canEvict($=Date.now()){return!this.pending&&!this.connecting&&$-this.lastUsedAt>N_}dispose(){if(this.pending)this.retireAttempt(this.pending);this.socket?.close(),this.socket=void 0,this.serverState=void 0,this.connecting=void 0}send($,Z,J,X,Y,G){this.touch();let z=U6(),Q=this.queue.catch(()=>{}).then(()=>this.startQueued($,Z,z,J,X,Y,G)),K=Q.then(async({response:W,getPayload:V})=>({response:await W,payload:V(),transport:"websocket",protocol:2,usedRelay:!0}));return this.queue=Q.then(({done:W})=>W.catch(()=>{}),()=>{}),K}async startQueued($,Z,J,X,Y,G,z){let Q=(A)=>NG(A,z),K=U6();await this.ensureConnected();let W=U6(),V=p$.get(this.affinity),B=this.serverState?.hash,q={...$,protocol:2,id:t7()};if(q.mode==="patch"&&(!B||B!==q.base_hash))q.mode="full_sync",q.revision=(this.serverState?.revision??0)+1,delete q.base_hash,delete q.patch,q.body=Z;if(q.mode==="patch"&&V)q.patch=rK(V.body,Z);q6(`perf websocket send_start session=${j6(this.affinity)} request=${q.id} mode=${q.mode} queueMs=${e6(W-J)} connectMs=${e6(W-K)} bodyBytes=${Z.length} relayBytes=${JSON.stringify(q).length}`);let H=await R4(this.config,q,G,Q),j=q,x=this.sendPayload(q,Z,X,Y,G,H,z);x.done.catch(()=>{});let N=x.done,U=x.response.catch(async(A)=>{if(!(A instanceof V5)||q.mode!=="patch")throw A;let I=q5(q,Z);I.protocol=2,I.id=t7(),I.revision=(this.serverState?.revision??0)+1;let L=await R4(this.config,I,G,Q);j=I;let w=this.sendPayload(I,Z,X,Y,G,L,z);return w.done.catch(()=>{}),N=w.done,w.response}),D=U.then(()=>N,()=>N.catch(()=>{}));return{response:U,done:D,getPayload:()=>j}}async ensureConnected(){if(this.socket?.readyState===WebSocket.OPEN&&this.serverState!==void 0)return;if(this.connecting)return await this.connecting;this.connecting=new Promise(($,Z)=>{let J=w_(this.config.url,this.config.token),X=new URL(J);X.searchParams.set("affinity",this.affinity);let Y=new WebSocket(X.toString());Y.binaryType="arraybuffer",this.socket=Y,this.serverState=void 0;let G=this.timers.setTimeout(()=>{Y.close(),Z(Error("relay websocket ready timed out"))},15000);Y.addEventListener("message",(z)=>{try{if(typeof z.data!=="string"){this.handleBinaryChunk(z.data);return}let Q=F_(z.data);if(Q.type==="ready"){this.timers.clearTimeout(G),this.serverState=Q.state,$();return}this.handleMessage(Q)}catch(Q){this.timers.clearTimeout(G),Z(Q),this.failPending(Q),Y.close()}}),Y.addEventListener("error",()=>{this.timers.clearTimeout(G);let z=new B5("relay websocket error");Z(z),this.failPending(z)}),Y.addEventListener("close",(z)=>{if(this.timers.clearTimeout(G),this.socket===Y)this.socket=void 0,this.serverState=void 0,this.connecting=void 0;if(this.socket!==void 0)return;if(this.pending){if(this.pending.retryingBeforeResponse)return;let Q=this.pending.responseStartedAt!=null||this.pending.streamByteCount>0,K=Q?"closed after response_start before stream bytes":"closed before response";if(this.retryPendingBeforeResponse(this.pending,K,z))return;let W=Q?new B5("relay websocket closed during response stream",z):Error("relay websocket closed before response");q6(`websocket ${Q?"closed during response stream":"closed before response without retry"} session=${j6(this.affinity)} request=${this.pending.payload.id} chunks=${this.pending.streamChunkCount} bytes=${this.pending.streamByteCount} ${LG(z)}`),this.failPending(W)}})}).finally(()=>{this.connecting=void 0}),await this.connecting}sendPayload($,Z,J,X,Y,G,z){let Q=this.socket;if(!Q||Q.readyState!==WebSocket.OPEN)throw UG(G.scope),Error("relay websocket is not connected");let K=U6(),W,V,B=new Promise((H,j)=>{W=H,V=j});return{response:new Promise((H,j)=>{let x={payload:$,bodyText:Z,resolve:H,reject:j,streamDone:!1,accepted:!1,responseStarted:!1,resolveDone:W,rejectDone:V,sentAt:K,optimisticResponse:J,streamChunkCount:0,streamByteCount:0,retryAttempts:0,retryingBeforeResponse:!1,onResponseHeaders:X,authorizeAttempt:Y,authorization:G.authorization,scope:G.scope.stream,responseScope:G.scope.response,responseMode:z,rawBody:!1,retired:!1,stagedResponseHeaders:void 0,responseHeadersDelivered:!1};if(this.pending=x,this.resetPendingTimeout(x),Q.send(JSON.stringify($)),J)this.resolvePendingResponse(x,200,"OK",{"content-type":"text/event-stream","x-cortexkit-relay-optimistic":"true"})}),done:B}}resetPendingTimeout($){this.timers.clearTimeout($.timeout),$.timeout=this.timers.setTimeout(()=>{if(this.pending!==$)return;if(this.retryPendingBeforeResponse($,"response timed out"))return;this.failPending(Error("relay websocket response timed out")),this.socket?.close()},45000)}retryPendingBeforeResponse($,Z,J){if($.streamByteCount>0)return!1;if($.streamDone)return!1;if(!$.optimisticResponse&&$.responseStarted)return!1;if($.retired)return!1;if($.retryAttempts>=1)return!1;$.retryAttempts+=1,$.retryingBeforeResponse=!0,this.timers.clearTimeout($.timeout);let X=$.retryAttempts,Y=$.payload.id;return q6(`websocket ${Z}; reconnecting and retrying full_sync session=${j6(this.affinity)} request=${Y} retry=${X} chunks=${$.streamChunkCount} bytes=${$.streamByteCount}${J?` ${LG(J)}`:""}`),this.socket?.close(),this.socket=void 0,this.serverState=void 0,this.connecting=void 0,(async()=>{try{if(await this.ensureConnected(),this.pending!==$)return;if($.retired)return this.endCancelledRetry($);let G=q5($.payload,$.bodyText);G.protocol=2,G.id=t7(),G.revision=(this.serverState?.revision??0)+1;let z=await R4(this.config,G,$.authorizeAttempt,(K)=>NG(K,$.responseMode));if(this.pending!==$||$.streamDone||$.retired){if(UG(z.scope),this.pending===$&&$.retired)this.endCancelledRetry($);return}this.installAttempt($,z),$.payload=G,$.accepted=!1,$.acceptedAt=void 0,$.responseStartedAt=void 0,$.stagedResponseHeaders=void 0,$.responseHeadersDelivered=!1,$.sentAt=U6(),$.retryingBeforeResponse=!1;let Q=this.socket;if(!Q||Q.readyState!==WebSocket.OPEN)throw Error("relay websocket is not connected");this.resetPendingTimeout($),q6(`perf websocket retry_send session=${j6(this.affinity)} request=${G.id} previous=${Y} mode=full_sync retry=${X} bodyBytes=${$.bodyText.length} relayBytes=${JSON.stringify(G).length}`),Q.send(JSON.stringify(G))}catch(G){if($.retryingBeforeResponse=!1,this.pending!==$)return;if(G instanceof n9)this.failPending(G.failure,!1);else this.failPending(G)}})(),!0}endCancelledRetry($){$.retryingBeforeResponse=!1,this.failPending(Error("relay websocket response was cancelled"),!1)}installAttempt($,Z){$.scope?.dispose(),$.responseScope?.dispose(),$.authorization=Z.authorization,$.scope=Z.scope.stream,$.responseScope=Z.scope.response}retireAttempt($){$.retired=!0,$.scope?.dispose(),$.scope=void 0,$.responseScope?.dispose(),$.responseScope=void 0,$.errorBody=void 0,$.authorization=void 0}redactAttemptError($,Z){return $.scope?$.scope.redactError(Z):Error("relay websocket request ended")}enqueueStreamChunk($,Z){this.deliverResponseHeaders($),$.streamChunkCount+=1,$.streamByteCount+=Z.byteLength,this.forwardStreamBytes($,Z)}forwardStreamBytes($,Z){let{streamController:J,scope:X}=$;if(!J||!X)return;if($.rawBody){let G=$.errorBody;if(G){if(G.bytes+=Z.byteLength,G.bytes>T5){this.endOversizedErrorBody($,J,G.scope);return}}J.enqueue(Z);return}let Y;try{Y=X.push(Z)}catch(G){this.failPending(G,!(G instanceof A8)),this.socket?.close();return}for(let G of Y)J.enqueue(G)}endOversizedErrorBody($,Z,J){if(Z.error(new Az),J.dispose(),q6(`websocket error body exceeded the redaction bound; ending request session=${j6(this.affinity)} request=${$.payload.id} chunks=${$.streamChunkCount} bytes=${$.streamByteCount}`),this.timers.clearTimeout($.timeout),$.streamDone=!0,this.retireAttempt($),$.authorizeAttempt=void 0,$.onResponseHeaders=void 0,$.resolveDone(),this.pending===$)this.pending=void 0;let X=this.socket;this.socket=void 0,this.serverState=void 0,this.connecting=void 0,X?.close()}deliverResponseHeaders($){if($.responseHeadersDelivered||$.stagedResponseHeaders==null)return;$.responseHeadersDelivered=!0;try{$.onResponseHeaders?.($.stagedResponseHeaders)}catch{}}handleBinaryChunk($){let Z=this.pending;if(!Z?.responseStarted)return;this.enqueueStreamChunk(Z,T_($))}resolvePendingResponse($,Z,J,X){if($.responseStarted)return;let Y,G=H_.has(Z)?null:new ReadableStream({start:(V)=>{Y=V},cancel:()=>{this.retireAttempt($),this.socket?.close()}}),z;try{z=new Response(G,{status:Z,statusText:J,headers:X})}catch{this.failInvalidResponseStart();return}if($.responseStarted=!0,$.streamController=Y,$.optimisticResponse){$.resolve(z);return}let Q=$.responseScope;if($.responseScope=void 0,z.ok&&$.responseMode==="event-stream"||!Q){if(Q?.dispose(),X&&z.ok)$.stagedResponseHeaders=new Headers(z.headers);$.resolve(z);return}$.rawBody=!0;let W;try{W=Q.redactResponse(z)}catch(V){$.responseStarted=!1,this.failPending(V),this.socket?.close();return}if(X)$.stagedResponseHeaders=new Headers(W.headers);if(!z.ok&&G)$.errorBody={scope:Q,bytes:0};$.resolve(W)}stageOptimisticResponseHeaders($,Z){let J=$.responseScope;$.responseScope=void 0;let X;try{X=new Response(null,{status:Z.status,statusText:Z.statusText,headers:Z.headers})}catch{return J?.dispose(),this.failInvalidResponseStart(),!1}if(!Z.headers)return J?.dispose(),!0;if(X.ok)return J?.dispose(),$.stagedResponseHeaders=new Headers(X.headers),!0;if(!J)return!0;try{$.stagedResponseHeaders=new Headers(J.redactResponse(X).headers)}catch{}return!0}failInvalidResponseStart(){this.failPending(new VZ(j_),!1),this.socket?.close()}handleMessage($){if($.type==="keepalive"){if(this.pending)this.resetPendingTimeout(this.pending);return}let Z=this.pending;if(!Z)return;if("id"in $&&$.id&&$.id!==Z.payload.id)return;if($.type==="accepted"){let J=U6();Z.accepted=!0,Z.acceptedAt=J,q6(`perf websocket accepted session=${j6(this.affinity)} request=${Z.payload.id} sentMs=${e6(J-Z.sentAt)} mode=${Z.payload.mode}`),this.serverState={hash:$.hash,revision:$.revision},$W(this.affinity,Z.bodyText,$.hash,$.revision),this.resetPendingTimeout(Z);return}if($.type==="response_start"){if(Z.responseStartedAt!=null)return;let J=U6();Z.responseStartedAt=J;try{Z.authorization?.onUpstreamStatus?.($.status)}catch{}if(q6(`perf websocket response_start session=${j6(this.affinity)} request=${Z.payload.id} sentMs=${e6(J-Z.sentAt)} upstreamMs=${Z.acceptedAt==null?"unknown":e6(J-Z.acceptedAt)} status=${j9($.status)}`),this.timers.clearTimeout(Z.timeout),!Z.optimisticResponse){this.resolvePendingResponse(Z,$.status,$.statusText,$.headers);return}if(!this.stageOptimisticResponseHeaders(Z,$))return;if($.status>=400)this.deliverResponseHeaders(Z),this.forwardStreamBytes(Z,new TextEncoder().encode(`event: error
+data: ${JSON.stringify({type:"error",error:{type:"relay_upstream_error",message:`Relay upstream returned HTTP ${$.status}`}})}
+
+`)),this.finishPending();return}if($.type==="chunk"){this.enqueueStreamChunk(Z,R_($.base64));return}if($.type==="done"){this.finishPending($);return}if($.type==="error"){if(Z.optimisticResponse&&Z.responseStartedAt!=null){q6(`websocket relay error during optimistic response session=${j6(this.affinity)} request=${Z.payload.id} status=${Number.isFinite($.status)?$.status:"unknown"} code=relay_stream_error chunks=${Z.streamChunkCount} bytes=${Z.streamByteCount}`),this.deliverResponseHeaders(Z),this.forwardStreamBytes(Z,new TextEncoder().encode(`event: error
+data: ${JSON.stringify({type:"error",error:{type:"relay_error",message:$.message||"relay error"}})}
+
+`)),this.finishPending(),this.socket?.close();return}if($.status===409&&this.retryPendingBeforeResponse(Z,"state mismatch"))return;let J=$.status===409?new V5("state mismatch"):Error(C_($));this.failPending(J)}}finishPending($){let Z=this.pending;if(!Z)return;let J=U6(),X=$&&"frames"in $?` upstreamChunks=${j9($.upstreamChunks)} upstreamBytes=${j9($.upstreamBytes)} frames=${j9($.frames)} frameBytes=${j9($.frameBytes)}`:"";q6(`perf websocket done session=${j6(this.affinity)} request=${Z.payload.id} sentMs=${e6(J-Z.sentAt)} streamMs=${Z.responseStartedAt==null?"unknown":e6(J-Z.responseStartedAt)} chunks=${Z.streamChunkCount} bytes=${Z.streamByteCount}${X}`),this.timers.clearTimeout(Z.timeout);try{if(!Z.streamDone){this.deliverResponseHeaders(Z),Z.streamDone=!0;let Y=Z.rawBody?[]:Z.scope?.finish()??[];for(let G of Y)Z.streamController?.enqueue(G);Z.streamController?.close()}}finally{this.retireAttempt(Z),Z.authorizeAttempt=void 0,Z.onResponseHeaders=void 0}Z.resolveDone(),this.pending=void 0}failPending($,Z=!0){let J=this.pending;if(!J)return;let X=Z?this.redactAttemptError(J,$):$;if(this.timers.clearTimeout(J.timeout),this.pending=void 0,this.retireAttempt(J),J.authorizeAttempt=void 0,J.onResponseHeaders=void 0,J.responseStarted)J.streamController?.error(X);else J.reject(X);J.rejectDone(X)}}function j5($=Date.now()){for(let[Z,J]of p$)if($-J.updatedAt>L_)p$.delete(Z);while(p$.size>U_){let Z=p$.keys().next().value;if(Z===void 0)break;p$.delete(Z)}for(let[Z,J]of m0)if(J.canEvict($))J.dispose(),m0.delete(Z);while(m0.size>x_){let Z=!1;for(let[J,X]of m0){if(!X.canEvict($))continue;X.dispose(),m0.delete(J),Z=!0;break}if(!Z)break}}function S_($,Z,J){j5();let X=m0.get(Z);if(X)return X.touch(),X;let Y=new ZW($,Z,J);return m0.set(Z,Y),j5(),Y}async function CC($){let{config:Z,input:J,init:X,headers:Y,body:G,fallback:z,affinity:Q,optimisticResponse:K,authorizeAttempt:W,onResponseHeaders:V,dumpTag:B,onDumpCreated:q,setTimeoutImpl:H=globalThis.setTimeout,clearTimeoutImpl:j=globalThis.clearTimeout}=$;if(!Z||!I_(J,G))return z();let x=Q||Y.get("x-session-affinity")||Y.get("x-opencode-session");if(!x)return q6("skipping relay: missing x-session-affinity header"),z();let N=G,U=U6(),D=D_(N);x8("hash_body",{session:j6(x),ms:e6(U6()-U),bodyBytes:N.length});let A=p$.get(x),I=U6(),L=A_({input:J,init:X,headers:Y,bodyText:N,affinity:x,previous:A,nextHash:D});x8("create_payload",{session:j6(x),ms:e6(U6()-I),mode:L.mode,bodyBytes:N.length,previousBytes:A?.body.length});let w,S=()=>{return w??=q_(N),w};try{let f,d=U6();if(Z.transport==="websocket")try{let F=S_(Z,x,{setTimeout:H,clearTimeout:j}),M=K===!0&&S()==="event-stream";f=await F.send(L,N,M,V,W,S())}catch(F){if(F instanceof n9||F instanceof VZ)throw F;q6(`websocket relay failed session=${j6(x)}; trying http relay code=relay_transport_error`),f=await HG({config:Z,payload:L,bodyText:N,requestMode:S,fallback:z,signal:X?.signal,authorizeAttempt:W})}else f=await HG({config:Z,payload:L,bodyText:N,requestMode:S,fallback:z,signal:X?.signal,authorizeAttempt:W});if(x8("send",{session:j6(x),ms:e6(U6()-d),transport:f.transport,protocol:f.protocol,mode:f.payload.mode,status:f.response.status,usedRelay:f.usedRelay}),!f.usedRelay)return f.response;if(f.transport==="http")try{V?.(f.response.headers)}catch{}if(f.transport==="http")$W(x,N,f.payload.next_hash,f.payload.revision);let s=U6(),_=JSON.stringify(f.payload).length;x8("payload_stringify",{session:j6(x),ms:e6(U6()-s),relayBytes:_}),q6(`used relay transport=${f.transport} protocol=${f.protocol} mode=${f.payload.mode} status=${f.response.status} session=${j6(x)} bodyBytes=${N.length} relayBytes=${_}`);let O=U6(),P=await Uj({affinity:x,transport:f.transport,protocol:f.protocol,mode:f.payload.mode,status:f.response.status,bodyText:N,previousBodyText:A?.body,payload:f.payload,relayBytes:_,tag:B});try{if(P)q?.(P)}catch{}return x8("dump",{session:j6(x),ms:e6(U6()-O),enabled:!0}),f.response}catch(f){if(f instanceof n9)throw f.failure;if(f instanceof VZ)throw f;if(!Z.fallbackToDirect)throw q6(`relay failed session=${j6(x)} and fallbackToDirect=false code=relay_transport_error`),f;return q6(`relay failed; falling back direct session=${j6(x)} code=relay_transport_error`),z()}}var SC=`
+async function hashBody(body) {
+  const bytes = new TextEncoder().encode(body)
+  const digest = await crypto.subtle.digest('SHA-256', bytes)
+  const hex = [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('')
+  return 'sha256:' + hex
+}
+
+function applyPatch(base, patch) {
+  return base.slice(0, patch.start) + patch.insert + base.slice(patch.start + patch.deleteCount)
+}
+
+function applyPatchSet(base, patch) {
+  if (!Array.isArray(patch)) return applyPatch(base, patch)
+  if (patch.length === 0) return base
+
+  let result = ''
+  let cursor = 0
+  for (const item of patch) {
+    if (item.start < cursor) return { error: 'overlapping patch', status: 400 }
+    result += base.slice(cursor, item.start)
+    result += item.insert
+    cursor = item.start + item.deleteCount
+  }
+  return result + base.slice(cursor)
+}
+
+async function readState(env, affinity) {
+  const raw = await env.RELAY_STATE.get('session:' + affinity)
+  return raw ? JSON.parse(raw) : null
+}
+
+async function writeState(env, affinity, state) {
+  await env.RELAY_STATE.put('session:' + affinity, JSON.stringify(state), { expirationTtl: 86400 })
+}
+
+async function resolveBody(env, payload) {
+  if (payload.mode === 'full_sync') return payload.body
+  if (payload.mode === 'patch') {
+    const state = await readState(env, payload.affinity)
+    if (!state || state.hash !== payload.base_hash) {
+      return { error: 'state mismatch', status: 409 }
+    }
+    return applyPatchSet(state.body, payload.patch)
+  }
+  return { error: 'unknown mode', status: 400 }
+}
+
+async function prepareUpstream(env, payload) {
+  if ((payload.protocol !== 1 && payload.protocol !== 2) || payload.type !== 'request' || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {
+    return { error: 'invalid payload', status: 400 }
+  }
+
+  const body = await resolveBody(env, payload)
+  if (body && typeof body === 'object' && 'error' in body) return body
+
+  if (typeof body !== 'string' || (await hashBody(body)) !== payload.next_hash) {
+    return { error: 'hash mismatch', status: 409 }
+  }
+
+  const stateWrite = writeState(env, payload.affinity, { body, hash: payload.next_hash, revision: payload.revision }).catch(() => {})
+  console.log(JSON.stringify({
+    relay: 'opencode-anthropic-auth',
+    transport: 'relay',
+    mode: payload.mode,
+    revision: payload.revision,
+    affinity: String(payload.affinity).slice(0, 12),
+    bodyBytes: body.length,
+  }))
+
+  return { body, stateWrite }
+}
+
+function resolveBodyFromState(state, payload) {
+  if (payload.mode === 'full_sync') return payload.body
+  if (payload.mode === 'patch') {
+    if (!state || state.hash !== payload.base_hash) {
+      return { error: 'state mismatch', status: 409 }
+    }
+    return applyPatchSet(state.body, payload.patch)
+  }
+  return { error: 'unknown mode', status: 400 }
+}
+
+function deferWorkerTask(task) {
+  return new Promise((resolve) => setTimeout(resolve, 0)).then(task)
+}
+
+const WEBSOCKET_STREAM_FLUSH_BYTES = 1024
+const WEBSOCKET_STREAM_FLUSH_MS = 20
+
+function createWebSocketStreamCoalescer(socket, options = {}) {
+  const flushBytes = options.flushBytes || WEBSOCKET_STREAM_FLUSH_BYTES
+  const flushMs = options.flushMs ?? WEBSOCKET_STREAM_FLUSH_MS
+  let chunks = []
+  let byteLength = 0
+  let flushTimer = null
+  const stats = {
+    upstreamChunks: 0,
+    upstreamBytes: 0,
+    frames: 0,
+    frameBytes: 0,
+  }
+
+  const clearFlushTimer = () => {
+    if (flushTimer === null) return
+    clearTimeout(flushTimer)
+    flushTimer = null
+  }
+
+  const mergeChunks = () => {
+    if (chunks.length === 1) return chunks[0]
+    const frame = new Uint8Array(byteLength)
+    let offset = 0
+    for (const chunk of chunks) {
+      frame.set(chunk, offset)
+      offset += chunk.byteLength
+    }
+    return frame
+  }
+
+  const flush = () => {
+    clearFlushTimer()
+    if (byteLength === 0) return
+    const frame = mergeChunks()
+    chunks = []
+    byteLength = 0
+    socket.send(frame)
+    stats.frames += 1
+    stats.frameBytes += frame.byteLength
+  }
+
+  const scheduleFlush = () => {
+    if (flushTimer !== null) return
+    flushTimer = setTimeout(flush, flushMs)
+  }
+
+  return {
+    push(value) {
+      const chunk = value instanceof Uint8Array ? value : new Uint8Array(value)
+      if (chunk.byteLength === 0) return
+      stats.upstreamChunks += 1
+      stats.upstreamBytes += chunk.byteLength
+      chunks.push(chunk)
+      byteLength += chunk.byteLength
+      if (byteLength >= flushBytes) flush()
+      else scheduleFlush()
+    },
+    flush,
+    stats() {
+      return { ...stats, pendingBytes: byteLength }
+    },
+  }
+}
+
+function checkpointWebSocketState(env, payload, body, nextState) {
+  return deferWorkerTask(async () => {
+    try {
+      if ((await hashBody(body)) !== payload.next_hash) {
+        throw new Error('hash mismatch')
+      }
+      await writeState(env, payload.affinity, nextState)
+    } catch {
+      console.log(JSON.stringify({
+        relay: 'opencode-anthropic-auth',
+        transport: 'websocket',
+        event: 'checkpoint_write_failed',
+        affinity: String(payload.affinity).slice(0, 12),
+        code: 'checkpoint_write_error',
+      }))
+    }
+  })
+}
+
+async function prepareWebSocketUpstream(env, state, payload) {
+  if (payload.protocol !== 2 || payload.type !== 'request' || !payload.id || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {
+    return { error: 'invalid payload', status: 400 }
+  }
+
+  const body = resolveBodyFromState(state, payload)
+  if (body && typeof body === 'object' && 'error' in body) return body
+  if (typeof body !== 'string') return { error: 'invalid body', status: 400 }
+  if ((await hashBody(body)) !== payload.next_hash) {
+    return { error: 'hash mismatch', status: 409 }
+  }
+
+  const nextState = { body, hash: payload.next_hash, revision: payload.revision }
+  const checkpoint = checkpointWebSocketState(env, payload, body, nextState)
+  const logAccepted = () => console.log(JSON.stringify({
+    relay: 'opencode-anthropic-auth',
+    transport: 'websocket',
+    mode: payload.mode,
+    revision: payload.revision,
+    affinity: String(payload.affinity).slice(0, 12),
+    bodyBytes: body.length,
+  }))
+
+  return { body, state: nextState, checkpoint, logAccepted }
+}
+
+function headersToObject(headers) {
+  const result = {}
+  for (const [key, value] of headers.entries()) result[key] = value
+  return result
+}
+
+async function handleRelayPayload(env, payload) {
+  const prepared = await prepareUpstream(env, payload)
+  if (prepared.error) return prepared
+  const upstream = await fetch(payload.upstream.url, {
+    method: payload.upstream.method || 'POST',
+    headers: payload.upstream.headers,
+    body: prepared.body,
+  })
+  return { upstream, stateWrite: prepared.stateWrite }
+}
+
+async function handleWebSocket(socket, env, ctx, payload, getState, setState) {
+  const heartbeat = setInterval(() => {
+    try {
+      socket.send(JSON.stringify({ protocol: 2, type: 'keepalive' }))
+    } catch {
+      clearInterval(heartbeat)
+    }
+  }, 15000)
+  let streamCoalescer = null
+  try {
+    const result = await prepareWebSocketUpstream(env, getState(), payload)
+    if (result.error) {
+      socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: result.status, message: result.error }))
+      return
+    }
+
+    setState(result.state)
+    socket.send(JSON.stringify({ protocol: 2, type: 'accepted', id: payload.id, hash: result.state.hash, revision: result.state.revision }))
+    ctx?.waitUntil?.(deferWorkerTask(result.logAccepted))
+
+    const upstreamPromise = fetch(payload.upstream.url, {
+      method: payload.upstream.method || 'POST',
+      headers: payload.upstream.headers,
+      body: result.body,
+    })
+    ctx?.waitUntil?.(result.checkpoint)
+    const upstream = await upstreamPromise
+    socket.send(JSON.stringify({
+      protocol: 2,
+      type: 'response_start',
+      id: payload.id,
+      status: upstream.status,
+      statusText: upstream.statusText,
+      headers: headersToObject(upstream.headers),
+    }))
+
+    const reader = upstream.body?.getReader()
+    if (reader) {
+      streamCoalescer = createWebSocketStreamCoalescer(socket)
+      while (true) {
+        const { done, value } = await reader.read()
+        if (done) break
+        streamCoalescer.push(value)
+      }
+      streamCoalescer.flush()
+    }
+    const stats = streamCoalescer?.stats?.() || {}
+    socket.send(JSON.stringify({ protocol: 2, type: 'done', id: payload.id, ...stats }))
+  } catch (error) {
+    try {
+      streamCoalescer?.flush?.()
+    } catch {}
+    socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: 500, message: error instanceof Error ? error.message : String(error) }))
+  } finally {
+    clearInterval(heartbeat)
+  }
+}
+
+export default {
+  async fetch(request, env, ctx) {
+    if (request.headers.get('Upgrade') === 'websocket') {
+      const url = new URL(request.url)
+      const token = url.searchParams.get('token')
+      const affinity = url.searchParams.get('affinity')
+      if (token !== env.RELAY_TOKEN) return new Response('unauthorized', { status: 401 })
+      if (!affinity) return new Response('missing affinity', { status: 400 })
+      const pair = new WebSocketPair()
+      const client = pair[0]
+      const server = pair[1]
+      server.binaryType = 'arraybuffer'
+      let state = null
+      let ready = false
+      server.accept()
+      const loadState = readState(env, affinity).then((loadedState) => {
+        state = loadedState
+        ready = true
+        server.send(JSON.stringify({
+          protocol: 2,
+          type: 'ready',
+          state: state ? { hash: state.hash, revision: state.revision } : null,
+        }))
+      }).catch((error) => {
+        server.send(JSON.stringify({ protocol: 2, type: 'error', status: 500, message: error instanceof Error ? error.message : String(error) }))
+        server.close(1011, 'state load failed')
+      })
+      ctx?.waitUntil?.(loadState)
+      if (!ctx?.waitUntil) void loadState
+      let busy = false
+      server.addEventListener('message', (event) => {
+        if (!ready) {
+          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 425, message: 'relay state is not ready' }))
+          return
+        }
+        if (busy) {
+          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 429, message: 'request already in flight' }))
+          return
+        }
+        let payload
+        try {
+          payload = JSON.parse(event.data)
+        } catch {
+          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 400, message: 'invalid JSON payload' }))
+          return
+        }
+        payload.affinity = affinity
+        busy = true
+        const run = handleWebSocket(server, env, ctx, payload, () => state, (nextState) => { state = nextState }).finally(() => { busy = false })
+        ctx?.waitUntil?.(run)
+        if (!ctx?.waitUntil) void run
+      })
+      return new Response(null, { status: 101, webSocket: client })
+    }
+
+    if (request.method === 'GET') {
+      return Response.json({ status: 'ok', transports: ['http', 'websocket'] })
+    }
+    if (request.method !== 'POST') return new Response('method not allowed', { status: 405 })
+    if (request.headers.get('x-relay-token') !== env.RELAY_TOKEN) {
+      return new Response('unauthorized', { status: 401 })
+    }
+
+    try {
+      const payload = await request.json()
+      const result = await handleRelayPayload(env, payload)
+      if (result.error) return Response.json({ error: result.error }, { status: result.status })
+
+      if (result.stateWrite) ctx.waitUntil(result.stateWrite)
+
+      const upstream = result.upstream
+      return new Response(upstream.body, {
+        status: upstream.status,
+        statusText: upstream.statusText,
+        headers: upstream.headers,
+      })
+    } catch (error) {
+      return Response.json(
+        { error: error instanceof Error ? error.message : 'internal relay error' },
+        { status: 502 },
+      )
+    }
+  },
+}
+`,k_="Cannot send this request: the history ends on an assistant turn. Send a new message to continue; assistant content will not be discarded to replay the previous question.";class JW extends Error{details;check="meaningful_trailing_assistant";constructor($){super(k_);this.details=$,this.name="TrailingAssistantHistoryError"}}var v_=new Set(["text","thinking","redacted_thinking","tool_use","server_tool_use","image","document"]),f_=new Set(["type","text","cache_control"]);function P2($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function E_($){if(typeof $==="string")return $.trim()==="";if(!Array.isArray($))return!1;return $.every((Z)=>P2(Z)&&Z.type==="text"&&typeof Z.text==="string"&&Z.text.trim()===""&&Object.keys(Z).every((J)=>f_.has(J)))}function b_($){if(Array.isArray($))return{contentShape:"array",contentBlockCount:$.length,contentBlockTypes:$.map((Z)=>P2(Z)&&typeof Z.type==="string"&&v_.has(Z.type)?Z.type:"other")};if(typeof $==="string")return{contentShape:"string"};if($===void 0)return{contentShape:"missing"};return{contentShape:"other"}}function g_($){let Z=$.length;while(Z>0){let J=$[Z-1];if(!P2(J)||J.role!=="assistant")break;if(!E_(J.content))throw new JW({messageCount:$.length,trailingMessageIndex:Z-1,emptyMessagesAfter:$.length-Z,...b_(J.content)});Z--}return $.length-Z}function kC($){if(!Array.isArray($))return 0;let Z=g_($);if(Z)$.length-=Z;return Z}var H5=["main-first","fallback-first","sticky-balanced"],A2="main-first",XW="Usage: `/claude-routing`, `/claude-routing main-first`, `/claude-routing fallback-first`, `/claude-routing sticky-balanced`, or `/claude-routing reset`.";function y_($){return typeof $==="string"&&H5.includes($)?$:A2}function vC($){return y_($?.routing?.mode)}function h_($){let Z=$.trim().toLowerCase().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="reset")return{type:"reset"};if(Z.length===1&&H5.includes(Z[0]))return{type:"mode",mode:Z[0]};if(Z.length===2&&Z[0]==="mode"&&H5.includes(Z[1]))return{type:"mode",mode:Z[1]};return{type:"usage"}}function m_($){if($==="fallback-first")return"Try usable fallback accounts before the main account. If no fallback succeeds, try the main account.";if($==="sticky-balanced")return"Assign each session to a quota-weighted OAuth account, keep it sticky across transient failures, and migrate only for confirmed long-lived exhaustion or permanent account failure.";return"Try the main account first. Use fallback accounts only when quota policy or fallback errors require it."}function Q4($){let Z=$?.mode??A2;return["## Claude Routing Status","",`- Mode: \`${Z}\``,`- Behavior: ${m_(Z)}`,"",XW].join(`
+`)}function fC($){let Z=h_($.argumentsText),J=$.mode??A2;if(Z.type==="status")return Q4({mode:J});if(Z.type==="mode")return["## Claude Routing Updated","",`Mode updated to \`${Z.mode}\`.`,"",...Q4({mode:Z.mode}).split(`
+`).slice(2)].join(`
+`);if(Z.type==="reset")return["## Claude Routing Assignment Reset","","The current session will be assigned again on its next request.","",...Q4({mode:J}).split(`
+`).slice(2)].join(`
+`);return["## Claude Routing Usage","",XW,"",...Q4({mode:J}).split(`
+`).slice(2)].join(`
+`)}var u_="## Claude Lane Start Status",p_="## Claude Lane Start Queued",c_="## Claude Lane Start Usage",l_="Usage: `/claude-start`.";function d_($){if($.trim().split(/\s+/).filter(Boolean).length===0)return{type:"fire"};return{type:"usage"}}function EC($){let Z=d_($.argumentsText);if(Z.type==="fire")return{action:Z,text:[p_,"","- Queued an explicit lane-start request.","- This is a billed request: the one-token limit does not remove prompt-cache read or write charges."].join(`
+`)};return{action:Z,text:[c_,"",l_,"",u_].join(`
+`)}}var bC="thinking-binding-controls-2026-08-01";function o9($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function i_($){if(!o9($))return!1;if($.type==="thinking")return typeof $.signature==="string"&&$.signature.length>0;if($.type==="redacted_thinking")return typeof $.data==="string"&&$.data.length>0;return!1}function gC($){let Z=$?.thinkingBinding?.prefixMismatchBehavior;return Z==="error"||Z==="drop_block"?Z:"account-default"}function s_($){if(!Array.isArray($.messages))return!1;return $.messages.some((Z)=>{if(!o9(Z)||Z.role!=="assistant")return!1;return Array.isArray(Z.content)&&Z.content.some(i_)})}function yC($,Z="account-default"){if(Z==="account-default")return!1;if(!uz($.model)&&!m5($.model)&&!pz($.model)&&!sL($.model))return!1;if(!s_($))return!1;if(!o9($.thinking)||$.thinking.type!=="adaptive")return!1;return $.thinking.block_binding={prefix_mismatch_behavior:Z},!0}function hC($){if(!o9($.thinking))return!1;if(!o9($.thinking.block_binding))return!1;let Z=$.thinking.block_binding.prefix_mismatch_behavior;return Z==="error"||Z==="drop_block"}
+export{$9 as _,s6 as $,R$ as aa,DG as ba,Lw as ca,BZ as da,Nw as ea,U5 as fa,Uw as ga,iV as ha,xw as ia,Dw as ja,Ow as ka,Mw as la,Iw as ma,RG as na,_w as oa,Pw as pa,Aw as qa,ww as ra,SG as sa,GB as ta,Rw as ua,n0 as va,Tw as wa,kG as xa,Fw as ya,Cw as za,x5 as Aa,Sw as Ba,o0 as Ca,xB as Da,B7 as Ea,kw as Fa,vw as Ga,fw as Ha,Ew as Ia,bw as Ja,gw as Ka,yw as La,T4 as Ma,hw as Na,mw as Oa,uw as Pa,pw as Qa,M9 as Ra,cw as Sa,o$ as Ta,RB as Ua,gG as Va,TB as Wa,lw as Xa,yG as Ya,hG as Za,mG as _a,FB as $a,dw as ab,B8 as bb,iw as cb,sw as db,tw as eb,aw as fb,yB as gb,nw as hb,cB as ib,lB as jb,tB as kb,ew as lb,rB as mb,$R as nb,Zq as ob,H$ as pb,JR as qb,iG as rb,XR as sb,Hq as tb,YR as ub,xq as vb,Rq as wb,oG as xb,fq as yb,t as zb,WR as Ab,VR as Bb,Gj as Cb,BR as Db,Nj as Eb,xj as Fb,Oj as Gb,DZ as Hb,Pj as Ib,LR as Jb,f5 as Kb,NR as Lb,lH as Mb,p4 as Nb,MZ as Ob,Tz as Pb,dH as Qb,UR as Rb,aH as Sb,IR as Tb,GL as Ub,HL as Vb,FR as Wb,X1 as Xb,OL as Yb,IL as Zb,CR as _b,SR as $b,c4 as ac,AL as bc,wL as cc,RL as dc,kR as ec,vR as fc,fR as gc,ER as hc,gL as ic,bR as jc,gR as kc,mL as lc,yR as mc,jJ as nc,e0 as oc,hz as pc,w0 as qc,Y1 as rc,hR as sc,mR as tc,uR as uc,pR as vc,BY as wc,lL as xc,dL as yc,uz as zc,lR as Ac,dR as Bc,iR as Cc,jY as Dc,sR as Ec,tR as Fc,aR as Gc,nR as Hc,oR as Ic,pz as Jc,iL as Kc,rR as Lc,eR as Mc,$T as Nc,ZT as Oc,JT as Pc,XT as Qc,YT as Rc,sL as Sc,GT as Tc,tL as Uc,LY as Vc,zT as Wc,QT as Xc,KT as Yc,WT as Zc,VT as _c,m5 as $c,BT as ad,qT as bd,jT as cd,HT as dd,LT as ed,oL as fd,NT as gd,S$ as hd,SQ as id,c6 as jd,aT as kd,n as ld,O4 as md,j1 as nd,tD as od,OF as pd,wF as qd,RK as rd,CF as sd,CK as td,SF as ud,kF as vd,gO as wd,vF as xd,SK as yd,fF as zd,EF as Ad,hO as Bd,b6 as Cd,XM as Dd,I2 as Ed,dF as Fd,sF as Gd,hK as Hd,aF as Id,nF as Jd,bM as Kd,rF as Ld,eF as Md,Z5 as Nd,$C as Od,D6 as Pd,WC as Qd,VC as Rd,SI as Sd,vI as Td,z4 as Ud,NC as Vd,UC as Wd,mI as Xd,cI as Yd,O8 as Zd,IC as _d,Z_ as $d,_C as ae,PC as be,E0 as ce,AC as de,wC as ee,FC as fe,CC as ge,SC as he,JW as ie,kC as je,vC as ke,h_ as le,fC as me,d_ as ne,EC as oe,bC as pe,gC as qe,yC as re,hC as se};