@cortexkit/opencode-anthropic-auth 1.23.0 → 2.0.1

package/dist/v2/models.d.ts

@@ -0,0 +1,6 @@
+import type { Plugin } from '@opencode/plugin';
+/** Each model variant supplies request settings for adaptive thinking and its selected reasoning effort. */
+export declare function createNativeClaudeModelRules(): {
+    install: (ctx: Pick<Plugin.Context, 'model'>) => Promise<import("@opencode/plugin/promise/registration").Registration>;
+    modelId: (id: string) => string;
+};

package/dist/v2/ownership.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Read the credential OpenCode attached to this request: the bearer token, or
+ * else the API key. When a user signs in through this plugin (Claude pool
+ * login or vault activation), OpenCode stores a fixed, non-secret placeholder
+ * string instead of a real token: placeholderSecret('anthropic') from
+ * @cortexkit/common-auth. The request hooks that installOpenCode2Auth installs
+ * serve a request from the plugin's own accounts only when this value equals
+ * that placeholder exactly. Any real token or key, whether from OpenCode's own
+ * login, a configured API key or an environment variable, is left untouched.
+ */
+export declare function preparedAnthropicCredential(headers: Headers): string | undefined;

package/dist/v2/prime.d.ts

@@ -0,0 +1,12 @@
+import { type NativeAccountRuntime, type NativePoolPaths, PrimeManager } from '@cortexkit/anthropic-auth-core';
+import type { NativeSource } from './source';
+/** After the five-hour quota resets, send one minimal authenticated request to start its next window and record that request's token usage. */
+export declare function createNativePrime(options: {
+    runtime: NativeAccountRuntime;
+    paths: NativePoolPaths;
+    source: NativeSource;
+    fetch?: typeof fetch;
+}): {
+    manager: PrimeManager;
+    dispose(): Promise<void>;
+};

package/dist/v2/rpc.d.ts

@@ -0,0 +1,50 @@
+import type { CommandApplyRequest, CommandApplyResult, CommandDialogPayload, CommandMenu } from '@cortexkit/anthropic-auth-core';
+import type { Plugin } from '@opencode/plugin';
+import type { Registration } from '@opencode/plugin/promise/registration';
+import type { StandardSchemaV1 } from '@standard-schema/spec';
+import type { NativeMenuCapabilities } from './menu-contract';
+export declare const NATIVE_MENU_RPC: {
+    readonly id: 'cortexkit-anthropic-native';
+    readonly methods: {
+        readonly open: {
+            readonly input: StandardSchemaV1<Record<string, unknown> & {
+                sessionId: string;
+            }, Record<string, unknown> & {
+                sessionId: string;
+            }>;
+            readonly output: StandardSchemaV1<CommandDialogPayload, CommandDialogPayload>;
+        };
+        readonly apply: {
+            readonly input: StandardSchemaV1<CommandApplyRequest & {
+                sessionId: string;
+            }, CommandApplyRequest & {
+                sessionId: string;
+            }>;
+            readonly output: StandardSchemaV1<CommandApplyResult, CommandApplyResult>;
+        };
+    };
+    readonly events: {
+        readonly opened: {
+            readonly schema: StandardSchemaV1<{
+                sessionId: string;
+                payload: CommandDialogPayload;
+            }, {
+                sessionId: string;
+                payload: CommandDialogPayload;
+            }>;
+        };
+        readonly notification: {
+            readonly schema: StandardSchemaV1<{
+                sessionId: string;
+                message: string;
+                kind: 'info' | 'warning' | 'error';
+            }, {
+                sessionId: string;
+                message: string;
+                kind: 'info' | 'warning' | 'error';
+            }>;
+        };
+    };
+};
+/** OpenCode routes these RPC calls to the current project. No separate loopback server is started. */
+export declare function registerNativeMenu(ctx: Pick<Plugin.Context, 'rpc' | 'command' | 'event'>, command: CommandMenu, capabilities: NativeMenuCapabilities): Promise<Registration>;

package/dist/v2/server.d.ts

@@ -0,0 +1,8 @@
+export type { AnthropicAuthV2Options } from './setup';
+export { ANTHROPIC_AUTH_PLUGIN_ID, createAnthropicAuthPlugin, setupAnthropicAuth, } from './setup';
+declare const _default: {
+    id: string;
+    setup: (context: import("@opencode/plugin/promise/plugin").Context) => Promise<import("@opencode/plugin/promise/plugin").Cleanup | void> | import("@opencode/plugin/promise/plugin").Cleanup | void;
+    server: import("@opencode-ai/plugin").Plugin;
+};
+export default _default;

package/dist/v2/server.js

@@ -0,0 +1,4 @@
+import{a as O2,b as t$,c as $1,d as j$,e as B$,f as k2,g as M2,h as V$,i as K1,j as Q$,k as H$,l as U$,m as C$,n as L$,o as B1}from"../index-ynq181e8.js";import"../index-2arfb1y3.js";import"../index-rqync0pc.js";import{t as z1}from"../index-1jkyhgyr.js";import"../index-b3mxpp4w.js";import"../index-04syas8a.js";import{$b as T$,Ad as P2,Ca as S2,Da as l$,Dd as Y1,Jb as h2,Jc as w$,Kb as m2,La as u$,Ld as W1,Md as o$,Nd as n$,Od as r$,Ra as x2,Rd as J1,Sc as y$,Td as R$,Ud as q$,Vb as O$,Wd as p2,Xa as p$,Xb as E$,Yd as h$,Zb as S$,ac as x$,ad as I$,ae as s$,be as a$,ee as k$,fa as G$,fc as Y$,fd as X2,gd as W$,ia as X$,ie as J$,je as z$,kd as A$,ke as c2,md as G1,qa as R2,qb as _2,ra as q2,td as N2,ud as d$,wd as c$,yd as i$,zb as A2,zc as b$,zd as X1}from"../index-yxtdke11.js";import"../index-p4wvcwhh.js";import"../index-52r2e1h9.js";import"../index-3xqv3rw3.js";class U2 extends Error{kind;providerID;sessionID;requestKind;constructor(Z){super(Z.message??`${Z.providerID} ${Z.requestKind} request refused (${Z.kind})`);this.name="OpenCode2AuthError",this.kind=Z.kind,this.providerID=Z.providerID,this.sessionID=Z.sessionID,this.requestKind=Z.requestKind}}function W2(Z){return`common-auth-placeholder.${Z}`}function s2(Z){let K=W2(Z.integrationID);return{type:"oauth",methodID:Z.methodID,access:K,refresh:K,expires:Z.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function w2(Z,K){if(Z?.type!=="oauth")return!1;let L=K===void 0?void 0:W2(K),J=(N)=>L===void 0?N.startsWith("common-auth-placeholder."):N===L;return J(Z.access)&&J(Z.refresh)}var a2="No browser sign-in: this connects the plugin to the accounts in its vault.";async function y2(Z,K){let L=K.now??Date.now,{integrationID:J}=K,N=(F)=>s2({integrationID:J,methodID:F,now:L()}),M=async(F,V)=>{return await K.onLogin(F,{integrationID:J,methodID:V}),N(V)},T=(F)=>async(V)=>{let Y=F.method.id,H=await F.authorize(V),_={url:H.url,instructions:H.instructions,...H.expiresAt===void 0?{}:{expiresAt:H.expiresAt}};if(H.mode==="auto")return{..._,mode:"auto",callback:H.callback.then((x)=>M(x,Y))};let Q=H.callback;return{..._,mode:"code",callback:async(x)=>M(await Q(x),Y)}};return Z.integration.transform((F)=>{let V=K.label===void 0?{}:{label:()=>K.label};for(let _ of K.methods)F.method.update({integrationID:J,method:_.method,authorize:T(_),refresh:async(Q)=>{if(!w2(Q,J))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return N(Q.methodID)},...V});let Y=K.vault;if(Y===void 0)return;let H=Y.method.id;F.method.update({integrationID:J,method:Y.method,authorize:async()=>({url:"",instructions:Y.instructions??a2,mode:"auto",callback:Promise.resolve().then(()=>Y.activate({integrationID:J,methodID:H})).then(()=>N(H))}),refresh:async(_)=>{if(!w2(_,J)||_.methodID!==H)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return N(H)},...V})})}function V1(Z){let K=[],L;for(let J of Z.split(/\r?\n/))if(J.startsWith("data:"))K.push(J.slice(5).replace(/^ /,""));else if(J.startsWith("event:"))L=J.slice(6).trim();if(K.length===0)return;return L===void 0?{data:K.join(`
+`)}:{event:L,data:K.join(`
+`)}}function I2(Z,K){let L=new TextDecoder,J="",N=(T)=>{let F=V1(T);if(!F)return;try{Z(F)}catch(V){K(V)}},M=()=>{for(;;){let T=/\r?\n\r?\n/.exec(J);if(!T)return;let F=J.slice(0,T.index);J=J.slice(T.index+T[0].length),N(F)}};return new TransformStream({transform(T,F){F.enqueue(T),J+=L.decode(T,{stream:!0}),M()},flush(){if(J+=L.decode(),M(),J.trim()!=="")N(J);J=""}})}var t2=512,B2="x-common-auth-attempt",J2=(Z,K)=>JSON.stringify([Z,K]),G2=(Z)=>({providerID:Z.model.providerID,modelID:Z.model.id,sessionID:Z.sessionID,agent:Z.agent,kind:Z.kind});function Q1(Z){let K=Z.headers;return typeof K==="object"&&K!==null}function H1(Z,K){let L=Z.getReader();return new ReadableStream({async pull(J){let N;try{N=await L.read()}catch(M){K({reason:"failed",message:M instanceof Error?M.message:String(M)}),J.error(M);return}if(N.done)K(),J.close();else J.enqueue(N.value)},async cancel(J){K({reason:"cancelled",...J===void 0?{}:{message:String(J)}}),await L.cancel(J)}})}function g2(Z,K){for(let[L,J]of Object.entries(K)){let N=L.toLowerCase();for(let M of Object.keys(Z))if(M.toLowerCase()===N)delete Z[M];if(J!==null)Z[L]=J}}function U1(Z,K){for(let[L,J]of Object.entries(K))if(J===null)Z.delete(L);else Z.set(L,J)}async function f2(Z,K,L={}){let{providerID:J}=K,N=L.gateOnPlaceholder,M=($)=>N===void 0||N.credential($)===W2(J),T=L.logger,F=Math.max(1,L.maxRecords??t2),V=[...L.hostCredentials??[W2(J)],...N?[W2(J)]:[]].filter(($)=>$!==""),Y=new Map,H=new WeakMap,_=new Map,Q=new Set,x=new Map,y=!1,D=!1,v=new Map,i=0,r=!1,n=new Map,c=($,z)=>{try{T?.warn($,z)}catch{}},G=($)=>$ instanceof Error?$.message:String($),j=async($,z)=>{let C=v.get($);if(!C||C.size===0)return;await Promise.all([...C].map(async(P)=>{try{await P(z)}catch(b){c("opencode2 auth listener threw; the request is unaffected",{event:$,error:G(b)})}}))},B=async($,z)=>{try{await K.onAttemptEnd?.($,z)}catch(C){c("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:$.attemptId,error:G(C)})}},S=($,z)=>{if($.ended||!$.attempt)return;let C={...$.status===void 0?{}:{status:$.status},outputStarted:$.outputStarted,...$.limit?{limit:$.limit.signal}:{},...z?{error:z}:{}};if(z)$.endError=z;$.ended=B($.attempt,C)},E=($,z)=>S($,{reason:"abandoned",message:z}),g=($)=>[...Y.values()].filter((z)=>z.key===$),h=($)=>g($).at(-1),d=($)=>{if(Y.delete($.id),!g($.key).length)_.delete($.key)},p=($)=>{Y.set($.id,$);while(Y.size>F){let z=Y.values().next().value;if(z===void 0)break;E(z,"dropped to keep the record bound"),d(z)}},I=($)=>$.accountId===void 0?void 0:{...$.scope,accountId:$.accountId},X=($,z)=>new U2({kind:"no-account",providerID:J,sessionID:$.sessionID,requestKind:$.kind,...z===void 0?{}:{message:z}}),W=($)=>{n.get($)?.clear(),n.delete($)},U=async($,z)=>{let C=()=>X($,`${J} ${$.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(r)throw C();let P=n.get($.sessionID);if(!P)P=new Set,n.set($.sessionID,P);let b={};P.add(b);let f=()=>{if(!P.has(b))throw C()};try{return await z(f)}finally{if(P.delete(b),P.size===0&&n.get($.sessionID)===P)n.delete($.sessionID)}},A=($,z)=>{for(let[C,P]of z)if(V.some((b)=>P.includes(b)))throw new U2({kind:"host-credential-on-wire",providerID:J,sessionID:$.sessionID,requestKind:$.kind,message:`${J} ${$.kind} request still carries the host's placeholder credential in ${C}; the adapter's account headers must replace it`})},R=($)=>{for(let z of g($))if(z.ended||!z.attempt)d(z);else if(z.transport==="ws"||z.judged)E(z,"a newer attempt of its session and kind began"),d(z)},O=async($,z,C,P)=>{let b=J2($.sessionID,$.kind),f=_.get(b);_.delete(b);let k=f?.accountId??h(b)?.accountId;R(b);let w={...$,...k===void 0?{}:{previousAccountId:k},...f?.rerouteFrom===void 0?{}:{rerouteFrom:f.rerouteFrom}},m=await K.chooseAccount(w);C();let Z2={},n2;if(m!==void 0){let T2=await K.accountHeaders({...$,accountId:m});if(C(),Q1(T2))Z2=T2.headers,n2=T2.attempt;else Z2=T2}let r2=`attempt-${++i}`,H2={id:r2,key:b,scope:$,accountId:m,headers:Z2,attempt:m===void 0?void 0:{...$,accountId:m,attemptId:r2,transport:P,data:n2},...P===void 0?{}:{transport:P},outputStarted:!1};if(p(H2),H2.attempt)j("select",{...$,accountId:H2.attempt.accountId,hook:z,...w.previousAccountId===void 0?{}:{previousAccountId:w.previousAccountId},...w.rerouteFrom===void 0?{}:{rerouteFrom:w.rerouteFrom},handle:H2.attempt});return H2},q=async($,z,C,P,b)=>{let f=J2($.sessionID,$.kind),k=P===void 0?void 0:Y.get(P);if(k?.key!==f)k=void 0;if(!k){if(k=h(f),g(f).filter((m)=>m.transport===void 0&&!m.ended).length>1&&!D)D=!0,c("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:$.sessionID,kind:$.kind})}if(!k||k.transport!==void 0||k.ended)k=await O($,z,b,C);else if(k.transport=C,k.attempt)k.attempt.transport=C;if(C==="ws"){for(let w of g(f))if(w!==k&&w.transport==="ws")E(w,"a newer attempt of its session and kind went out over WebSocket")}return k},l=async($,z)=>{try{return await z()}catch(C){throw S($,{reason:"failed",message:G(C)}),C}},u=($,z)=>{let C=g(J2($,z)).filter((P)=>P.transport==="ws").at(-1);return C?.attempt!==void 0&&!C.ended?C:void 0},s=($,z,C)=>{let P=I($);if(!P||!$.attempt||$.limit)return;$.limit={signal:z,delivered:j("limit",{...P,via:C,limit:z,outputStarted:$.outputStarted,handle:$.attempt})}},$2=($,z,C,P)=>{let b=I($);if(!b||!$.attempt)return;j("quota",{...b,transport:z,...P===void 0?{}:{status:P},quota:C,handle:$.attempt})},K2=($,z,C,P)=>{let b=$.attempt;if(!b)return;let f=K.inspectEvent?.(P===void 0?{transport:z,data:C,attempt:b}:{transport:z,data:C,event:P,attempt:b});if(!f)return;if(f.quota!==void 0)$2($,z,f.quota);if(f.outputStarted)$.outputStarted=!0;if(f.limit)s($,f.limit,z);if(f.error!==void 0)S($,{reason:"failed",message:f.error});else if(f.done)S($)},e=($,z)=>{let C=$.attempt;if(!C||z.accountId===$.accountId)return;if(C.reboundFrom??=C.accountId,C.accountId=z.accountId,"data"in z)C.data=z.data;$.accountId=z.accountId},o=($)=>!$.attempt||$.endError!==void 0||$.status!==void 0&&$.status>=400,Y2=($)=>{let z=[...Y.values()].filter((w)=>w.scope.sessionID===$),C=z.filter((w)=>w.limit&&!w.rerouted).at(-1);if(C)return C;let P=z.filter((w)=>w.scope.kind==="primary"),b=P.length>0?P:z;if(b.length<=1)return b[0];let f=b.filter((w)=>!w.judged&&o(w)).at(-1);if(f)return f;let k=b.filter((w)=>w.attempt&&!w.ended);if(k.length>1)return"ambiguous";return k[0]??b.at(-1)},a={providerID:J},t=[];t.push(await Z.session.hook("model.request",($)=>{if(N)return;return U(G2($),async(z)=>{let C=await O(G2($),"model.request",z);if(z(),C.accountId===void 0)throw X(C.scope);g2($.headers,{...C.headers,[B2]:C.id})})},a)),t.push(await Z.session.hook("http.request",($)=>{if(N){let z=M($.request.headers);if(x.set($.sessionID,z),!z)return}return U(G2($),async(z)=>{let C=$.request.headers.get(B2)??void 0,P=N?await O(G2($),"http.request",z,"http"):await q(G2($),"http.request","http",C,z);z();let b=I(P),f=P.attempt;if(!b||!f)throw X(P.scope);await l(P,async()=>{let k=$.request;if(K.rewriteRequest){if(C!==void 0){let Z2=new Headers(k.headers);Z2.delete(B2),k=new Request(k,{headers:Z2})}k=await K.rewriteRequest({...b,request:k,attempt:f})??k,z()}let w=new Headers(k.headers);w.delete(B2),U1(w,P.headers),A(P.scope,w.entries());let m=new Request(k,{headers:w});H.set(m,P),$.request=m})})},a)),t.push(await Z.session.hook("http.response",async($)=>{let z=H.get($.request);if(!z){if(N)return;if(!y)y=!0,c("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:$.sessionID,kind:$.kind});return}let C=$.response;if(K.answeredBy&&z.attempt){let w=z.attempt,m=await l(z,async()=>K.answeredBy?.({request:$.request,response:C,attempt:w}));if(m)e(z,m)}let P=I(z),b=z.attempt;if(!P||!b)return;z.status=C.status;let f=K.quotaFromHeaders?.(C.headers,C.status,b);if(f!==void 0)$2(z,"http",f,C.status);if(!C.ok&&K.limitFromResponse){let w=await K.limitFromResponse({status:C.status,headers:C.headers,body:()=>C.clone().text(),attempt:b});if(w)s(z,w,"http")}if(!C.ok||!C.body)S(z);let k=C;if(C.body&&(K.inspectEvent||K.onAttemptEnd)){let w=C.body;if(K.inspectEvent)w=w.pipeThrough(I2((m)=>K2(z,"http",m.data,m.event),(m)=>c("opencode2 auth event inspection threw",{error:G(m)})));k=new Response(H1(w,(m)=>S(z,m)),{status:C.status,statusText:C.statusText,headers:C.headers})}if(K.rewriteResponse)k=await K.rewriteResponse({...P,request:$.request,response:k,attempt:b})??k;if(k!==C)$.response=k},a)),t.push(await Z.session.hook("experimental.ws.handshake",($)=>{if(N){let z=M(new Headers($.headers)),C=J2($.sessionID,$.kind);if(x.set($.sessionID,z),Q.delete(C),!z)return}return U(G2($),async(z)=>{let C;for(let k of Object.keys($.headers)){if(k.toLowerCase()!==B2)continue;C??=$.headers[k],delete $.headers[k]}let P=N?await O(G2($),"experimental.ws.handshake",z,"ws"):await q(G2($),"experimental.ws.handshake","ws",C,z);z();let b=I(P),f=P.attempt;if(!b||!f)throw X(P.scope);await l(P,async()=>{g2($.headers,P.headers);let k=K.rewriteHandshakeURL?.({...b,url:$.url,attempt:f});if(k!==void 0)$.url=k;if(A(P.scope,Object.entries($.headers)),N)Q.add(P.key)})})},a));let Q2=K.rewriteWebSocketFrame?.bind(K);if(Q2)t.push(await Z.session.hook("experimental.ws.send",async($)=>{let z=G2($);if(N&&!Q.has(J2(z.sessionID,z.kind)))return;let C=u(z.sessionID,z.kind),P=await Q2({...z,attempt:C?.attempt,frame:$.frame});if(P!==void 0)$.frame=P},a));t.push(await Z.session.hook("experimental.ws.receive",($)=>{if(N&&!Q.has(J2($.sessionID,$.kind)))return;let z=u($.sessionID,$.kind);if(!z)return;try{K2(z,"ws",$.frame)}catch(C){c("opencode2 auth frame inspection threw",{error:G(C)})}},a)),t.push(await Z.session.hook("retry",async($)=>{if(N&&x.get($.sessionID)!==!0)return;let z=Y2($.sessionID);if(!z)return;let C=$.decision;if(z==="ambiguous"){await j("retry",{sessionID:$.sessionID,attempt:$.attempt,reason:"host-decides",hostDecision:C,decision:C});return}let P=z;await U(P.scope,async(b)=>{P.judged=!0;let f=C,k,w,m=P.attempt;if(P.accountId===void 0||!m)f={retry:!1},k="no-account";else if(P.outputStarted)f={retry:!1},k="output-started";else{if(!P.limit){let Z2=K.limitFromError?.($.error,m);if(Z2)s(P,Z2,"error")}if(P.ended)await P.ended,b();if(P.limit)await P.limit.delivered,b(),P.rerouted=!0,w={accountId:P.accountId,limit:P.limit.signal},f={retry:!0,delay:0},k="reroute";else k="host-decides"}if($.decision=f,f.retry&&P.accountId!==void 0)_.set(P.key,{sessionID:P.scope.sessionID,accountId:P.accountId,...w===void 0?{}:{rerouteFrom:w}});await j("retry",{sessionID:$.sessionID,...P.accountId===void 0?{}:{accountId:P.accountId},kind:P.scope.kind,attempt:$.attempt,reason:k,hostDecision:C,decision:f,...m===void 0?{}:{handle:m}})})},a));let j2=($)=>{W($),x.delete($);for(let z of Q)if(JSON.parse(z)[0]===$)Q.delete(z);for(let z of[...Y.values()]){if(z.scope.sessionID!==$)continue;E(z,"its session was forgotten"),Y.delete(z.id)}for(let[z,C]of _)if(C.sessionID===$)_.delete(z)},b2=new AbortController,o2=Z.event;if(o2)(async()=>{try{for await(let $ of o2.subscribe({signal:b2.signal}))if($.type==="session.deleted")j2($.data.sessionID)}catch($){if(!b2.signal.aborted)c("opencode2 auth stopped listening for session deletion",{error:G($)})}})();return{on($,z){let C=v.get($);if(!C)C=new Set,v.set($,C);let P=z;return C.add(P),()=>{C.delete(P)}},accountFor($,z){return h(J2($,z))?.accountId},forgetSession:j2,get size(){return Y.size},async dispose(){if(r)return;r=!0;for(let $ of n.keys())W($);b2.abort();for(let $ of Y.values())E($,"the installation was disposed");Y.clear(),_.clear(),Q.clear(),x.clear(),v.clear(),await Promise.all(t.map(async($)=>{try{await $.dispose()}catch(z){c("opencode2 auth hook did not dispose cleanly",{error:G(z)})}}))}}}var e2="native-claude-oauth",$$="native-claude-vault";import{createHash as C1}from"node:crypto";var L2="anthropic",M$="x-common-auth-attempt",L1=["x-session-affinity","x-opencode-session","x-parent-session-id",j$,O2,M2,M$],F2=new Set(["authorization","x-api-key"]),M1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",_1=512,N1=5000,P1=500,K$=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class _$ extends Error{sessionID;requestKind;kind="no-account";providerID=L2;constructor(Z,K){super(M1);this.sessionID=Z;this.requestKind=K;this.name="NativeAnthropicNoAccountError"}}class l2 extends Error{sessionID;requestKind;kind="session-forgotten";providerID=L2;constructor(Z,K){super("request refused: its session was closed while it was being prepared");this.sessionID=Z;this.requestKind=K;this.name="NativeAnthropicRevokedError"}}class V2 extends Error{kind="unsupported-transport";providerID=L2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class N$ extends Error{kind="local-invalid-request";status=400;check;constructor(Z){super(Z.message,{cause:Z});this.name="NativeAnthropicLocalRefusal",this.check=Z.check}}var z2=(Z)=>typeof Z==="object"&&Z!==null&&!Array.isArray(Z);function C2(Z){try{return JSON.parse(Z)}catch{return}}function v2(Z){let K={};for(let[L,J]of Object.entries(Z??{}))K[L.toLowerCase()]=J;return K}function Z$(Z){let K={};for(let L of L1){let J=Z.get(L);if(J!==null&&L!==M$)K[L]=J;Z.delete(L)}return K}function T1(Z){try{return new URL(Z).pathname.endsWith("/messages")}catch{return!1}}function F1(Z){return Z instanceof J$||Z instanceof B$?new N$(Z):void 0}function O1(Z,K){let L=[];if(Z.oauth)L.push(Z.oauth.accessToken);for(let[J,N]of Object.entries(Z.apiHeaders??{})){if(N===null||!F2.has(J))continue;L.push(N.replace(/^Bearer\s+/i,""))}for(let J of F2){let N=K.get(J);if(N!==null)L.push(N.replace(/^Bearer\s+/i,""))}if(Z.dispatch?.kind==="http-relay")L.push(Z.dispatch.token);return[...new Set(L.filter(Boolean))]}var E1=new Set(["oauth-2025-04-20","claude-code-20250219",V$]);function S1(Z){let K=Z.split(",").map((L)=>L.trim()).filter((L)=>L&&!E1.has(L));return X$(null,K)}function x1(Z){let K=C2(Z);if(!z2(K))return Z;let L=z$(K.messages),J=Object.hasOwn(K,"fallbacks"),{droppedMarkers:N}=Q$(K,!1),M=J&&!Object.hasOwn(K,"fallbacks"),T=W$(K);return L>0||N>0||M||T?JSON.stringify(K):Z}async function A1(Z,K){if(!(Z instanceof Promise))return"settled";let L;try{return await Promise.race([Z.then(()=>"settled"),new Promise((J)=>{L=setTimeout(()=>J("timed-out"),K)})])}finally{if(L!==void 0)clearTimeout(L)}}function E2(Z){let{source:K,log:L}=Z,J=Math.max(1,Z.maxPendingSends??_1),N=Z.attemptEndTimeoutMs??N1,M=new Map,T=new WeakMap,F=new WeakMap,V=new Map,Y=new WeakMap,H=h2([]);H.dispose();let _=(X)=>(X&&V.get(X)?.redactor)??H,Q=(X)=>{let W=V.get(X);if(!W)return;V.delete(X),W.redactor.dispose(),W.scope.dispose()},x=(X,W,U,A)=>{let R=O1(W,A),O=m2(R,U);y.set(X,U),V.set(X,{sessionID:W.sessionID,redactor:h2(R),scope:O}),O.settled.then(()=>Q(X));while(V.size>J){let q=V.keys().next().value;if(q===void 0)break;Q(q)}},y=new WeakMap,D=(X,W)=>{let U=X?y.get(X):void 0;if(!U||!W.ok)return H.redactResponse(W);let A=m2([],U),R=A.redactResponse(W);return A.dispose(),R},v=(X,W)=>{let U=X?V.get(X)?.scope:void 0;if(!U)return D(X,W);try{return U.redactResponse(W)}catch{return D(X,W)}},i=!1,r=new WeakMap,n=(X,W)=>{if(X&&!W.ok)r.set(W.headers,X);return W},c=(X,W)=>{if(W.dispatch!=="http-relay")return!0;let U=/^req_[A-Za-z0-9_-]+$/.test(X.get("request-id")??"");return F.set(W,U),U},G=(X)=>new _$(X.sessionID,X.kind),j=new Map,B=async(X,W)=>{if(i)throw new l2(X.sessionID,X.kind);let U={revoked:!1},A=j.get(X.sessionID);if(!A)A=new Set,j.set(X.sessionID,A);A.add(U);let R=()=>{if(i||U.revoked)throw new l2(X.sessionID,X.kind)};try{let O=await W(R);return R(),O}finally{let O=j.get(X.sessionID);if(O?.delete(U)&&O.size===0)j.delete(X.sessionID)}},S=(X,W)=>{M.set(X,W);while(M.size>J){let U=M.keys().next().value;if(U===void 0)break;M.delete(U),L?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:J})}},E=(X,W)=>({providerID:X.providerID,modelID:X.modelID,sessionID:X.sessionID,agent:X.agent,kind:X.kind,accountId:X.accountId,attemptId:X.attemptId,transport:X.transport,route:W.route,provenance:W.provenance,dispatch:W.dispatch}),g=(X)=>B(X,async(W)=>{let{accountId:U,...A}=X,R=await K.authorizeAccount(A,U);return W(),h(A,R)}),h=(X,W)=>{if(!W)throw G(X);if(W.dispatch?.kind==="websocket-relay")throw new V2;let U=W.dispatch?.kind==="http-relay"?"http-relay":"direct",A=W.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":W.dispatch.token}:void 0;if(W.route==="oauth"){if(!W.accessToken)throw G(X);G$(W.accessToken,L2);let q=Object.freeze({route:"oauth",provenance:W.provenance,dispatch:U});S(q,{sessionID:X.sessionID,oauth:{accessToken:W.accessToken,...W.identity?{identity:W.identity}:{}},dispatch:W.dispatch,oauthHeaders:W.headers});let l=v2(W.headers);for(let u of F2)delete l[u];return delete l["anthropic-beta"],{headers:A??{...l,"x-api-key":null,authorization:`Bearer ${W.accessToken}`},attempt:q}}let R={authorization:null,"x-api-key":null,...v2(W.headers)};if(!R.authorization&&!R["x-api-key"])throw G(X);let O=Object.freeze({route:"api",provenance:W.provenance,dispatch:U});return S(O,{sessionID:X.sessionID,...W.baseURL?{baseURL:W.baseURL}:{},dispatch:W.dispatch,apiHeaders:R}),{headers:A??R,attempt:O}},d=(X)=>B(X,(W)=>p(X,W)),p=async(X,W)=>{let{request:U,attempt:A}=X,R=A.data,O=R?M.get(R):void 0;if(R)M.delete(R);if(!R||!O||R.route==="oauth"&&!O.oauth)throw G(X);let q=new Headers(U.headers);Y$(q);let l=Z$(q),u=U.body===null?void 0:await U.text();W();let s=u!==void 0&&T1(U.url);try{if(R.route==="oauth"&&O.oauth){let{accessToken:e,identity:o}=O.oauth;for(let[a,t]of Object.entries(v2(O.oauthHeaders))){if(F2.has(a))continue;if(t===null)q.delete(a);else q.set(a,t)}let Y2=null;if(u!==void 0&&s){let a={...E(A,R),modelID:(()=>{let j2=C2(u);return X2(z2(j2)&&typeof j2.model==="string"?j2.model:X.modelID)})(),route:"oauth",correlation:l},t=await K.requestOptions?.(a)??{};W(),u=await C$(u,{...t,...o?{identity:o}:{},sessionId:X.sessionID});let Q2=C2(u);Y2=z2(Q2)?Q2:null}H$(q,e,{body:Y2,...o?{identity:o}:{}})}else{if(u!==void 0&&s)u=x1(u);q.delete("authorization"),q.delete("x-api-key");for(let[o,Y2]of Object.entries(O.apiHeaders??{}))if(Y2===null)q.delete(o);else q.set(o,Y2);if(u!==void 0&&s&&!q.has("content-type"))q.set("content-type","application/json");let e=q.get("anthropic-beta");if(e!==null){let o=S1(e);if(o)q.set("anthropic-beta",o);else q.delete("anthropic-beta")}}}catch(e){let o=F1(e);if(!o)throw e;throw T.set(R,o.check),L?.warn("refused an Anthropic request locally; nothing was sent",{check:o.check}),o}let $2=u!==void 0?C2(u):void 0;if(await K.admitRequest?.({...E(A,R),modelID:X2(z2($2)&&typeof $2.model==="string"?$2.model:X.modelID)}),Z$(q),u!==void 0)q.delete("content-length");W(),x(R,O,z2($2)&&$2.stream===!0?"event-stream":"http",q);let K2=U$(U.url,O.baseURL!==void 0?{baseURL:O.baseURL}:{}).url?.toString()??U.url;if(O.dispatch?.kind==="http-relay"){let e=u??"";q.delete("x-relay-token");let o={protocol:1,type:"request",affinity:X.sessionID,upstream:{url:K2,method:U.method,headers:Object.fromEntries(q)},mode:"full_sync",revision:1,body:e,next_hash:`sha256:${C1("sha256").update(e).digest("hex")}`};return new Request(O.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":O.dispatch.token},redirect:"error",signal:U.signal,body:JSON.stringify(o)})}return new Request(K2,{method:U.method,headers:q,redirect:U.redirect,signal:U.signal,...u!==void 0?{body:u}:{}})};return{adapter:{providerID:L2,chooseAccount:(X)=>B(X,async()=>{let W=await K.chooseAccount(X);if(!W)throw G(X);return W}),accountHeaders:g,rewriteRequest:d,rewriteHandshakeURL(){throw new V2},rewriteResponse({response:X,attempt:W}){let U=W.data;if(U&&!c(X.headers,U)){if(X.status===401)return Q(U),X.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return v(U,X)}let A=v(U,X);if(U?.route!=="oauth"||!A.body)return n(U,A);let R={...E(W,U),status:X.status},O=K.responseOptions?.(R)??{},q=(X.headers.get("content-type")??"").includes("application/json");return n(U,L$(A,{...O,laneStartOAuthServed:!0,...q?{responseMode:"json"}:{}}))},quotaFromHeaders(X,W,U){let A=U.data;if(!A||!c(X,A))return;return K.quotaFromHeaders?.(X,{...E(U,A),status:W})},async limitFromResponse({status:X,headers:W,body:U,attempt:A}){let R=A.data;if(!R)return;if(!c(W,R))return K.limitFromRelayFailure?.({...E(A,R),status:X});if(Y.set(R,`provider responded with HTTP ${X}`),!K.limitFromResponse)return;let O=r.get(W)===R,q=_(R);return K.limitFromResponse({...E(A,R),status:X,headers:W,body:async()=>O?await U():q.redactText(await U())})},inspectEvent({data:X,event:W,attempt:U}){let A=C2(X);if(!z2(A))return;let R=typeof A.type==="string"?A.type:W;if(R==="content_block_start"||R==="content_block_delta")return{outputStarted:!0};if(R==="message_stop")return{done:!0};if(R!=="error")return;let O=U.data,q=_(O),l=z2(A.error)?A.error:{},u=typeof l.type!=="string"?void 0:K$.has(l.type)?l.type:q.redactText(l.type),s=typeof l.message==="string"?q.redactText(l.message):void 0;if(O?.dispatch==="http-relay"&&F.get(O)===!1)return;let $2=O?K.limitFromStreamError?.({...E(U,O),errorType:u,message:s}):void 0,K2={error:[u??"error",s].filter(Boolean).join(": ").slice(0,P1),...$2?{limit:$2}:{}};if(O&&K2.error)Y.set(O,K2.error);return K2},limitFromError(X,W){let U=W.data;if(!U||T.has(U))return;let A={type:K$.has(X.type)?X.type:"provider_error",message:Y.get(U)??"provider request failed",...X.status!==void 0?{status:X.status}:{}};if(Q(U),U.dispatch==="http-relay"&&F.get(U)===!1)return;return K.limitFromHostError?.(A,E(W,U))},async onAttemptEnd(X,W){let U=X.data;if(!U)return;M.delete(U);let A=W.error?.reason;if(A==="cancelled"||A==="abandoned"||A===void 0&&(W.status===void 0||W.status<400))Q(U);let R=T.get(U),{status:O,...q}=W,l=K.onAttemptEnd?.(E(X,U),{...q,...O!==void 0&&(U.dispatch!=="http-relay"||F.get(U)===!0)?{status:O}:{},...R!==void 0?{localRefusal:{check:R}}:{}});if(await A1(l,N)==="timed-out")L?.warn("the account source did not finish recording a send",{timeoutMs:N})}},dispose(){i=!0;for(let[X,W]of j){for(let U of W)U.revoked=!0;K.forgetSession?.(X)}j.clear(),M.clear();for(let X of[...V.keys()])Q(X)},forgetSession(X){for(let W of j.get(X)??[])W.revoked=!0;j.delete(X);for(let[W,U]of M)if(U.sessionID===X)M.delete(W);for(let[W,U]of[...V])if(U.sessionID===X)Q(W);K.forgetSession?.(X)},get pendingSendCount(){return M.size},get heldCredentialCount(){let X=0;for(let W of M.values())if(W.oauth)X++;return X},get heldRedactorCount(){return V.size},get operationsInProgress(){let X=0;for(let W of j.values())X+=W.size;return X}}}async function P$(Z,K,L){let J=E2(K),N=[],M=async(Q,x,y)=>{let D=await Z.session.hook(Q,x,y);return N.push(D),D},T=new AbortController,F;try{F=await f2({session:{hook:M},event:Z.event},J.adapter,{logger:K.log,gateOnPlaceholder:L})}catch(Q){throw J.dispose(),await Promise.allSettled(N.map((x)=>x.dispose())),Q}let V=(Q)=>{J.forgetSession(Q),F.forgetSession(Q)},Y=Z.event,H=Y?(async()=>{try{for await(let Q of Y.subscribe({signal:T.signal}))if(Q.type==="session.deleted")V(Q.data.sessionID)}catch(Q){if(!T.signal.aborted)K.log?.warn("stopped listening for session deletion",{error:Q instanceof Error?Q.name:"unknown"})}})():Promise.resolve(),_;return{installation:F,forgetSession:V,dispose(){if(_)return _;return J.dispose(),T.abort(),_=(async()=>{await F.dispose(),await H})(),_}}}function F$(Z,K){let L=new AbortController,J,N=!1,M=async()=>{let V=await Z.read();if(L.signal.throwIfAborted(),V.policyStorage.relay?.enabled===!0&&V.policyStorage.relay.transport!=="http")return;let Y=V,H=x2(Y.policyStorage);for(let _ of Y.accounts){if(L.signal.aborted)return;if(!_.enabled||_.type!=="oauth")continue;if(Y.policyStorage.quota?.enabled!==!1&&Date.now()-S2(_.quota)>=H)await Z.fetchQuota(_.id,K,L.signal).catch(()=>{});if(!T$(_.profile)&&!L.signal.aborted)await Z.fetchProfile(_.id,K,L.signal).catch(()=>{})}},T=()=>{if(N||J)return J;return J=M().catch(()=>{if(!L.signal.aborted)A2.debug("opencode2","native background readings did not complete")}).finally(()=>{J=void 0}),J},F=Z.vault.watch({intervalMs:60000,onRefresh:T,shouldRefresh:async()=>{let V=await Z.read();return V.policyStorage.relay?.enabled!==!0||V.policyStorage.relay.transport==="http"}});return F.ready.catch(()=>{}),{async dispose(){N=!0,F.close(),L.abort(),await J}}}var u2=(Z)=>Z!==null&&typeof Z==="object"&&!Array.isArray(Z)?Z:{};function D$(Z){let{runtime:K,source:L}=Z,J=new Map,N=!1,M=async(Y,H)=>{await K.updateSettings((_)=>({..._,[Y]:{...u2(_[Y]),...H}}))},T=()=>({ok:!0,text:"Native Claude settings updated."}),F=async(Y,H)=>{if(N)throw Error("Native menu is closed");switch(H.signal?.throwIfAborted(),Y.action){case"enable":case"disable":return await K.setEnabled(Y.values.id,Y.action==="enable"),T();case"remove":return await K.remove(Y.values.id),T();case"move-up":case"move-down":{let Q=(await K.read()).accounts.map((i)=>i.id),x=Q.indexOf(Y.values.id),y=x+(Y.action==="move-up"?-1:1);if(x<0||y<0||y>=Q.length)return{ok:!1,text:"Account cannot move in that direction."};let D=Q[x],v=Q[y];if(D===void 0||v===void 0)return{ok:!1,text:"Account order changed."};return Q[x]=v,Q[y]=D,await K.reorder(Q),T()}case"add-apikey":return await K.addApi(Y.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let _=new AbortController;J.get(Y.sessionId)?.active.abort();let Q={active:_,auth:void 0};J.set(Y.sessionId,Q);let x=await R2("max");if(N||_.signal.aborted||H.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return Q.auth=x,{ok:!0,text:`Open ${x.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let _=J.get(Y.sessionId);if(!_?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let Q=await q2(Y.values.code,_.auth.verifier,_.auth.redirectUri,_.auth.state);if(_.active.signal.throwIfAborted(),H.signal?.throwIfAborted(),N||Q.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await K.loginOAuth({routeId:crypto.randomUUID(),credential:Q,label:Y.values.label}),_.active.signal.throwIfAborted(),H.signal?.throwIfAborted(),N)return{ok:!1,text:"Sign-in cancelled."};return J.delete(Y.sessionId),{ok:!0,text:"OAuth account stored in the native account pool."}}case"reset-backoff":{let _=await K.read();for(let Q of _.accounts){if(H.signal?.throwIfAborted(),Q.type!=="oauth")continue;let x=Q.source==="vault"?await K.authorizeVault(Q.id,H.signal):await K.captureLocalSubject(Q.id);await K.resetBackoff(Q.id,x)}return T()}case"enrollment-reset":{let _=await S$(E$("opencode"),O$);return{ok:_==="reset",text:_==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let Q=(await K.read()).accounts.filter((D)=>D.type==="oauth"&&D.enabled),x=await Promise.allSettled(Q.map((D)=>K.fetchQuota(D.id,void 0,H.signal)));return{ok:x.every((D)=>D.status==="fulfilled"),text:`${x.filter((D)=>D.status==="fulfilled").length}/${Q.length} native quota readings refreshed.`}}case"routing-reset":return await L.resetRouting(Y.sessionId),T();case"routing-mode":return await M("routing",{mode:Y.values.mode}),T();case"killswitch-on":case"killswitch-off":return await M("killswitch",{enabled:Y.action==="killswitch-on"}),T();case"killswitch-set":return await K.updateSettings((_)=>{let Q=u2(_.killswitch),x={...u2(Q.accounts)},y=Q.main;for(let D of Y.values.entries){let v={five_hour:D.fh,seven_day:D.sd,...D.scoped!==void 0?{scoped:D.scoped}:{}};if(D.account==="main"||D.account==="all")y=v;if(D.account==="all")for(let i of Object.keys(x))x[i]=v;else if(D.account!=="main")x[D.account]=v}return{..._,killswitch:{...Q,main:y,accounts:x}}}),T();case"cache-on":case"cache-off":return await M("claudeCache",{enabled:Y.action==="cache-on"}),T();case"cache-mode":return await M("claudeCache",{mode:Y.values.mode}),T();case"cachekeep-always":return await M("cacheKeep",{enabled:!0,always:!0}),T();case"cachekeep-off":return await M("cacheKeep",{enabled:!1}),T();case"cachekeep-window":return await M("cacheKeep",{enabled:!0,always:!1,startHour:Y.values.startHour,endHour:Y.values.endHour}),T();case"cachekeep-subagents":return await M("cacheKeep",{subagents:Y.values.enabled==="on"}),T();case"dump-on":case"dump-off":return await M("dump",{enabled:Y.action==="dump-on"}),T();case"logging-level":return await M("logging",{level:Y.values.level}),T();case"fast-on":case"fast-off":return await M("claudeFast",{enabled:Y.action==="fast-on"}),T();case"prime-on":case"prime-off":return await M("prime",{enabled:Y.action==="prime-on"}),T();case"start-fire":return await V(Y.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},V=(Y)=>Z.start(Y,k2);return{dispatch:F,async readStatus(Y){let H=await K.read();if(Y==="account")return H.accounts.map((Q)=>`${Q.id}${Q.label?` (${Q.label})`:""}: ${Q.type}, ${Q.source}, ${Q.enabled?"enabled":"disabled"}${Q.state?`, ${A$(Q)}`:""}${Q.accountIdentity?`, ${Q.accountIdentity}`:""}`).join(`
+`)||"No native Claude accounts.";if(Y==="quota")return k$({accounts:H.accounts.filter((Q)=>Q.type==="oauth").map((Q)=>({name:Q.label??Q.id,role:Q.id==="main"?"main":"fallback",enabled:Q.enabled,quota:Q.quota,tierLabel:x$(Q.profile),lastRefreshedAt:Q.lastRefreshedAt,error:Q.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(Y==="prime")return q$({enabled:H.policyStorage.prime?.enabled===!0,accounts:R$(H.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");let _={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(H.settings[_[Y]]??{})},forgetSession(Y){J.get(Y)?.active.abort(),J.delete(Y)},close(){N=!0;for(let Y of J.values())Y.active.abort();J.clear()}}}function g$(){let Z=new Map;return{install:(L)=>L.model.transform((J)=>{Z.clear();for(let N of J.list("anthropic")){if(Z.set(String(N.id),String(N.modelID)),!(b$(N.modelID)||I$(N.modelID)||w$(N.modelID)||y$(N.modelID)))continue;J.update("anthropic",String(N.id),(M)=>{let T=["low","medium","high","xhigh","max"],F=M.variants.filter((V)=>!T.some((Y)=>Y===String(V.id)));M.variants=[...F,...T.map((V)=>({id:V,settings:{effort:V,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(L)=>Z.get(L)??L}}function f$(Z){return Z.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??Z.get("x-api-key")??void 0}var v$=(Z)=>Z!==null&&typeof Z==="object"&&!Array.isArray(Z)?Z:{};function m$(Z){let{runtime:K,source:L}=Z,J=new AbortController,N=new Set,M=(V)=>({providerID:"anthropic",modelID:p2().model,sessionID:`oc2-prime:${V}`,agent:"prime",kind:"generate"}),T=async(V)=>{let Y=M(V),H=E2({source:L}),_=performance.now();try{for(let Q=0;Q<3;Q++){if(J.signal.throwIfAborted(),(await K.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let y=await H.adapter.accountHeaders({...Y,accountId:V});if(!("headers"in y)||typeof y.headers!=="object"||y.headers===null||typeof y.attempt!=="object"||y.attempt===null)throw Error("Native Prime authorization refused");let D={...Y,accountId:V,attemptId:crypto.randomUUID(),transport:"http",data:y.attempt},v,i=!1,r=!1,n=(c)=>{r=!0,c.body?.cancel().catch(()=>{})};try{let c=await H.adapter.rewriteRequest?.({...Y,accountId:V,attempt:D,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(p2()),signal:J.signal})});if(!c)throw Error("Native Prime rewrite refused");let G=new Headers(c.headers);for(let[p,I]of Object.entries(y.headers))if(I===null)G.delete(p);else G.set(p,I);let j=new Request(c,{headers:G}),B=await(Z.fetch??fetch)(j),S=await H.adapter.rewriteResponse?.({...Y,accountId:V,request:j,response:B,attempt:D})??B;v=S.status,H.adapter.quotaFromHeaders?.(S.headers,S.status,D);let E=S.ok?void 0:await H.adapter.limitFromResponse?.({status:S.status,headers:S.headers,body:()=>S.clone().text(),attempt:D});if(E&&/^(vault-newer|local-newer|relay-direct):/.test(E.reason)&&Q<2){if(n(S),await L.chooseAccount({...Y,rerouteFrom:{accountId:V,limit:E}})!==V)throw Error("Native Prime retry changed account");continue}if(!S.ok)return n(S),{ok:!1,status:v,ms:performance.now()-_,error:"Native Prime upstream refused the request"};let g=v$(await S.json()),h=v$(g.usage),d={inputTokens:typeof h.input_tokens==="number"?h.input_tokens:void 0,outputTokens:typeof h.output_tokens==="number"?h.output_tokens:void 0};if(D.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(S.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(i=await L.recordPrime(y.attempt.provenance,d),!i)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:v,ms:performance.now()-_,usage:d}}finally{await H.adapter.onAttemptEnd?.(D,{status:v,outputStarted:!1,...i?{}:{error:{reason:r?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-_}}finally{H.dispose()}},F=new h$({storagePath:Z.paths.legacyConfig,loadStorage:async()=>(await K.read()).policyStorage,async getAccountFingerprint(V){let Y=await K.read(),H=Y.accounts.find((Q)=>Q.id===V);if(!H?.enabled||H.type!=="oauth")return;if(Y.policyStorage.relay?.enabled===!0&&Y.policyStorage.relay.transport!=="http")return;if(H.source==="vault"){let Q=await K.authorizeVault(V,J.signal);return K.getOrCreateAuthLineage(V,Q)}let _=await K.authorizeLocal(V,{signal:J.signal});return _.status==="usable"?K.getOrCreateAuthLineage(V,_.subject):void 0},async refreshQuota(V){let Y=await K.read();if(Y.policyStorage.relay?.enabled===!0&&Y.policyStorage.relay.transport!=="http")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await K.fetchQuota(V,Z.fetch,J.signal),fresh:!0}},sendPrime(V){let Y=T(V);return N.add(Y),Y.finally(()=>N.delete(Y)),Y},async recordSuccess(V){let Y=(await K.read()).accounts.find((H)=>H.id===V);if(!Y?.prime)throw Error("Native Prime counters are unavailable");return Y.prime}});return F.start(),{manager:F,async dispose(){F.stop(),J.abort(),await Promise.allSettled(N)}}}var d2=(Z)=>["five_hour","seven_day"].some((K)=>(Z?.[K]?.remainingPercent??1)<=0);function e$(Z){let{runtime:K}=Z,L=o$("native-auth"),J=new Map,N=(G)=>{let j=G.routingPath??c$(Z.paths.legacyConfig),B=J.get(j);if(!B)B=new i$({path:j,vaultSeed:G.routingSeed}),J.set(j,B);return B.setVaultSeed(G.routingSeed),B},M=new WeakMap,T=new Map,F=new Map,V=new Map,Y=new WeakSet,H=!1,_=()=>{while(T.size>512){let G=T.keys().next();if(!G.done)T.delete(G.value)}},Q=(G,j)=>JSON.stringify([G.sessionID,G.kind,G.modelID,j]),x=(G)=>{if(H)throw Error("Native Anthropic source is closed");let j=V.get(G.sessionID);if(!j){j=new AbortController,V.set(G.sessionID,j);while(V.size>512){let B=V.keys().next();if(!B.done)n.forgetSession?.(B.value)}}return j},y=(G,j,B)=>G.enabled&&(G.type==="api"||P2(G,j,X2(B)).status==="allowed"),D=async(G,j,B,S)=>{let E=await K.read();S.signal.throwIfAborted(),v(E);let g=E.accounts.find((h)=>h.id===G);if(!g||g.type!==B||!y(g,E,j))return!1;if(B==="api"){let h=E.accounts.find((d)=>d.id==="main"&&d.type==="oauth");return!!h&&N2(h.quota,E.policyStorage)&&d2(h.quota)}return!0},v=(G)=>{let j=G.policyStorage.relay;if(j?.enabled===!0&&j.transport!=="http")throw new V2},i=async(G,j)=>{if(v(G),j||G.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let B=await K.getRelayConfig();if(!B)throw Error("request refused: native HTTP relay configuration is unavailable");if(B.transport!=="http")throw new V2;return{dispatch:{kind:"http-relay",url:B.url,token:B.token},relayFallback:B.fallbackToDirect}};async function r(G,j,B){if(G.kind==="local")await K.publishLocal(G.subject,B);else if(G.kind==="vault"&&j.receipt)await K.vault.publish(j.receipt,B);else if(G.kind==="api"&&B.lastUsed!==void 0)await K.publishApi(G.subject,{lastUsed:B.lastUsed})}let n={async chooseAccount(G){let j=x(G);Z.onOwnedRequest?.();let B=await K.read();j.signal.throwIfAborted(),v(B);let S=X2(await Z.resolveModelId?.(G)??G.modelID);if(j.signal.throwIfAborted(),B.mode==="claustrum")B=await r$(K,j.signal),j.signal.throwIfAborted();if(B.policyStorage.quota?.enabled!==!1){let I=!1;for(let X of B.accounts){if(!X.enabled||X.type!=="oauth")continue;if(p$(X.quota)?N2(X.quota,B.policyStorage,Date.now(),S):Date.now()-S2(X.quota)<x2(B.policyStorage))continue;try{await K.fetchQuota(X.id,Z.fetch,j.signal),I=!0}catch{j.signal.throwIfAborted()}}if(I)B=await K.read();j.signal.throwIfAborted()}let E=G.rerouteFrom?T.get(G.rerouteFrom.limit.reason):void 0;if(G.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(G.rerouteFrom.limit.reason)&&!E)return;if(E&&G.rerouteFrom){T.delete(G.rerouteFrom.limit.reason);let I=B.accounts.find((U)=>U.id===E.accountId);if(!I||!y(I,B,S))return;let X=Q(G,E.accountId),W=F.get(X)??[];return W.push(E),F.set(X,W),E.accountId}let g=[];for(let I of B.accounts){if(I.type!=="oauth"||!y(I,B,S))continue;if(I.source==="local"){let X=await K.authorizeLocal(I.id,{signal:j.signal,policy:(W,U)=>P2(W,U,S)});if(j.signal.throwIfAborted(),X.status!=="usable")continue}g.push(I)}let h=g.filter((I)=>I.id!==G.rerouteFrom?.accountId);if(c2(B.policyStorage)==="sticky-balanced"){let I=h.map((W,U)=>({accountId:W.id,order:U,quota:W.quota??{kind:"unknown"}})),X=await N(B).resolve({sessionId:G.sessionID,family:d$(S),modelId:S,affinityModelId:G.modelID,candidates:I,retainAccountIds:new Set(h.map((W)=>W.id)),...B.mode==="claustrum"?{accountIdentities:new Map(B.accounts.flatMap((W)=>W.accountIdentity?[[W.id,W.accountIdentity]]:[]))}:{},storage:B.policyStorage,inputBytes:1,preferredAccountId:G.previousAccountId});if(j.signal.throwIfAborted(),X)return X.accountId}else{let X=c2(B.policyStorage)==="fallback-first"?[...h.filter((W)=>W.id!=="main"),...h.filter((W)=>W.id==="main")]:[...h.filter((W)=>W.id==="main"),...h.filter((W)=>W.id!=="main")];if(X[0])return X[0].id}if(B.mode==="claustrum")throw new n$;let d=B.accounts.find((I)=>I.id==="main"&&I.type==="oauth");if(!d)return;let p=d.quota;if(G.rerouteFrom?.limit.status===429||!N2(p,B.policyStorage))try{p=await K.fetchQuota("main",Z.fetch,j.signal)}catch{return}if(j.signal.throwIfAborted(),!d2(p))return;return B.accounts.find((I)=>I.type==="api"&&I.enabled&&I.id!==G.rerouteFrom?.accountId)?.id},async authorizeAccount(G,j){let B=x(G),S=await K.read();B.signal.throwIfAborted(),v(S);let E=X2(await Z.resolveModelId?.(G)??G.modelID);B.signal.throwIfAborted();let g=S.accounts.find((O)=>O.id===j);if(!g||!y(g,S,E))return;let h=Q(G,j),d=F.get(h),p=d?.shift();if(d?.length===0)F.delete(h);let{dispatch:I,relayFallback:X}=await i(S,p?.direct===!0);if(B.signal.throwIfAborted(),p?.auth){if(!await D(j,E,p.auth.route,B))return;let O=M.get(p.auth.provenance);if(O?.receipt?.expiresAtMs!==void 0&&O.receipt.expiresAtMs!==null&&O.receipt.expiresAtMs<Date.now()+300000)return;if(O)M.set(p.auth.provenance,{...O,scope:{...G,modelID:E},account:g,active:B,relayFallback:X});return{...p.auth,dispatch:I}}let W={scope:{...G,modelID:E},active:B,account:g,retry:p?.retry??!1,relayFallback:X,quota:g.quota};if(g.type==="api"){let O=S.accounts.find((s)=>s.id==="main"&&s.type==="oauth");if(!O||!N2(O.quota,S.policyStorage)||!d2(O.quota))return;let q=await K.authorizeApi(j,B.signal);if(B.signal.throwIfAborted(),!await D(j,E,"api",B))return;let l={kind:"api",subject:q.subject};return M.set(l,W),{route:"api",headers:q.authHeader==="authorization-bearer"?{authorization:`Bearer ${q.apiKey}`}:{"x-api-key":q.apiKey},baseURL:q.baseURL,provenance:l,dispatch:I}}if(g.source==="vault"){let O=await K.authorizeVault(j,B.signal);if(B.signal.throwIfAborted(),!await D(j,E,"oauth",B))return;let q={kind:"vault",credentialId:O.credentialId,recordVersion:O.recordVersion};M.set(q,{...W,receipt:O});let l=O.assertedAccountIdentity;if(!l)return;return{route:"oauth",accessToken:O.accessToken,provenance:q,dispatch:I,identity:_2(l,l)}}let U=await K.authorizeLocal(j,{signal:B.signal,policy:(O,q)=>P2(O,q,E)});if(B.signal.throwIfAborted(),U.status!=="usable")return;if(!await D(j,E,"oauth",B))return;let A={kind:"local",subject:U.subject};M.set(A,{...W,access:U.access});let R=U.subject.binding.identity;return{route:"oauth",accessToken:U.access,provenance:A,dispatch:I,identity:_2(R,R)}},async requestOptions(G){let j=x(G),B=await K.read();j.signal.throwIfAborted();let S=B.accounts.find((g)=>g.id===G.accountId);if(!S||!y(S,B,G.modelID))throw Error("request refused: native account is ineligible for this model");let E=M.get(G.provenance);if(E)M.set(G.provenance,{...E,scope:{...E.scope,modelID:G.modelID}});return Z.requestOptions(G,B)},async admitRequest(G){let j=M.get(G.provenance);if(!j||!await D(G.accountId,G.modelID,G.route,j.active))throw Error("request refused: native account policy changed before dispatch");M.set(G.provenance,{...j,scope:{...j.scope,modelID:G.modelID}})},responseOptions(G){return Z.responseOptions?.({...G,modelID:M.get(G.provenance)?.scope.modelID??G.modelID})},quotaFromHeaders(G,j){let B=M.get(j.provenance),S=t$(G);if(S)Z.onRequestId?.(j,S);if(!B||j.route!=="oauth"||!s$(G))return;let E=j.provenance.kind==="local"?j.provenance.subject.binding.identity:B.receipt?.assertedAccountIdentity,g={...a$(G),...E?{accountIdentity:E}:{}};B.quota=l$(B.quota,g);let h=L.observe(r(j.provenance,B,{quota:B.quota}));return c.set(j.provenance,h),g},async limitFromResponse(G){let j=M.get(G.provenance);if(!j)return;if(G.status===401&&j.receipt){if(!Y.has(j.receipt))Y.add(j.receipt),await K.vault.reportFailure(j.receipt,401,G.dispatch==="http-relay"?"relay_status_field":"direct");if(j.retry||j.active.signal.aborted)return;let S=j.active,E=await K.vault.prepareRetry(j.receipt,S.signal);if(S.signal.throwIfAborted(),!E.retry)return;let g=E.receipt,h=g.assertedAccountIdentity;if(!h)return;let d={kind:"vault",credentialId:g.credentialId,recordVersion:g.recordVersion};M.set(d,{...j,receipt:g,retry:!0});let p=`vault-newer:${G.attemptId}`;return T.set(p,{sessionID:G.sessionID,accountId:G.accountId,retry:!0,auth:{route:"oauth",accessToken:g.accessToken,provenance:d,identity:_2(h,h)}}),_(),{reason:p,status:401}}if(G.status===401&&G.provenance.kind==="local"&&j.access&&!j.retry){if(j.active.signal.aborted)return;let S=j.active,E=await K.authorizeLocal(G.accountId,{rejectedAccessToken:j.access,signal:S.signal,policy:(p,I)=>P2(p,I,j.scope.modelID)});if(S.signal.throwIfAborted(),E.status!=="usable"||E.access===j.access)return;let g={kind:"local",subject:E.subject};M.set(g,{...j,access:E.access,retry:!0});let h=E.subject.binding.identity,d=`local-newer:${G.attemptId}`;return T.set(d,{sessionID:G.sessionID,accountId:G.accountId,retry:!0,auth:{route:"oauth",accessToken:E.access,provenance:g,identity:_2(h,h)}}),_(),{reason:d,status:401}}let B=await K.read();if(u$(G.status,B.policyStorage))return{reason:`provider-${G.status}`,status:G.status};return},limitFromRelayFailure(G){let j=M.get(G.provenance);if(!j?.relayFallback||j.active.signal.aborted||!(G.status===401||G.status>=500))return;let B=`relay-direct:${G.attemptId}`;return T.set(B,{sessionID:G.sessionID,accountId:G.accountId,direct:!0,retry:!1}),_(),{reason:B}},limitFromStreamError(G){return G.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(G,j){let B=M.get(j.provenance);if(j.dispatch==="http-relay"&&B?.relayFallback&&!B.active.signal.aborted&&G.status===void 0){let S=`relay-direct:${j.attemptId}`;return T.set(S,{sessionID:j.sessionID,accountId:j.accountId,direct:!0,retry:!1}),_(),{reason:S}}return},async onAttemptEnd(G,j){let B=M.get(G.provenance);if(!B)return;try{if(await c.get(G.provenance),j.status===401&&B.receipt&&!Y.has(B.receipt))Y.add(B.receipt),await K.vault.reportFailure(B.receipt,401,G.dispatch==="http-relay"?"relay_status_field":"direct");if(!j.localRefusal&&j.status!==void 0)L.publish(()=>r(G.provenance,B,{lastUsed:Date.now()}))}finally{M.delete(G.provenance),c.delete(G.provenance)}},forgetSession(G){V.get(G)?.abort(),V.delete(G);for(let[j,B]of T)if(B.sessionID===G)T.delete(j);for(let[j,B]of F)if(B[0]?.sessionID===G)F.delete(j);Z.onForgetSession?.(G)},resetRouting:async(G)=>N(await K.read()).clear(G),async recordPrime(G,j){let B=M.get(G);if(!B||B.active.signal.aborted)return!1;if(G.kind==="local")return K.incrementPrimeUsage(B.account.id,G.subject,j);if(G.kind==="vault"&&B.receipt)return K.incrementPrimeUsage(B.account.id,B.receipt,j);return!1},close(){H=!0;for(let G of V.values())G.abort();return V.clear(),F.clear(),T.clear(),L.drain()}},c=new WeakMap;return n}function Z1(){let Z=new $1,K=new Map,L=new Map,J=new Map,N=new Set,M=new Set,T=new Map,F=(V)=>{while(V.size>512){let Y=V.keys().next();if(!Y.done)V.delete(Y.value)}};return{async install(V){let Y=[];try{Y.push(await V.session.hook("context",(H)=>{let _=H.messages.map((x)=>{return{info:{id:x.id,sessionID:H.sessionID,role:x.role,agent:H.agent,model:{providerID:H.model.providerID,modelID:H.model.id}},parts:x.content.map((y)=>({type:y.type,...y.type==="text"?{text:y.text}:{}}))}});Z.observeMessages(_);let Q=H.messages.findLast((x)=>x.role==="user"&&x.id);if(Q?.id)K.set(H.sessionID,Q.id);if(Q?.content.some((x)=>x.type==="text"&&x.text===k2))N.add(H.sessionID);else N.delete(H.sessionID);F(K)},{providerID:"anthropic"})),Y.push(await V.session.hook("model.request",(H)=>{if(H.kind!=="primary")return;let _=K.get(H.sessionID);if(!_)return;if(Z.markHeaders({sessionId:H.sessionID,messageId:_,agent:H.agent,headers:H.headers}),N.has(H.sessionID))H.headers[M2]="1"},{providerID:"anthropic"}))}catch(H){throw await Promise.allSettled(Y.map((_)=>_.dispose())),H}return{dispose:async()=>{await Promise.all(Y.map((H)=>H.dispose()))}}},requestOptions(V,Y){let H=Z.resolveHeader(V.correlation[O2]);if(H)L.set(V.attemptId,H),F(L);T.set(V.attemptId,V.sessionID),F(T);let _=V.correlation[M2]==="1";if(_)M.add(V.attemptId);return{cache1hEnabled:V.agent!=="compaction"&&V.agent!=="title"&&(Y.policyStorage.claudeCache?.enabled??!0),cache1hMode:Y.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:Y.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:Y.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,serverSideFallbackEnabled:K1(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:_,billingLineage:H?{promptId:H.promptId,previousRequestId:H.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:J.get(V.sessionID)}},responseOptions(V){return{serverSideFallbackModel:X2(V.modelID),laneStart:M.has(V.attemptId),onMessageStart(Y){if(V.kind==="primary"&&typeof Y.id==="string")J.set(V.sessionID,Y.id),F(J)},onStreamEnd(){L.delete(V.attemptId),M.delete(V.attemptId),T.delete(V.attemptId)}}},onRequestId(V,Y){Z.commit(L.get(V.attemptId),Y)},forgetSession(V){Z.clearSession(V),K.delete(V),J.delete(V),N.delete(V);for(let[Y,H]of T)if(H===V)L.delete(Y),M.delete(Y),T.delete(Y)}}}var D2="cortexkit-anthropic-auth",R1='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',q1="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",k1="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function D1(Z){let K=Z.authorize??R2,L=Z.exchange??q2,J=()=>{if(!Z.isActive())throw Error("Claude authentication setup is closed")},N=async()=>{let F;try{F=await Z.readMode()}catch{throw Error(k1)}return J(),F},M=async()=>{if(await N()!=="local")throw Error(R1)};return{integrationID:"anthropic",methods:[{method:{id:e2,type:"oauth",label:"Claude Pro / Max (native account pool)"},async authorize(){J(),await M();let F=await K("max");return J(),{mode:"code",url:F.url,instructions:"Paste the authorization code returned by Claude.",callback:async(V)=>{J();let Y=await L(V,F.verifier,F.redirectUri,F.state);if(!Z.isActive()||Y.type!=="success")throw Error("Claude sign-in did not complete");return{access:Y.access,refresh:Y.refresh,expires:Y.expires}}}}}],vault:{method:{id:$$,type:"oauth",label:"Claude vault accounts"},async activate(){if(J(),await N()!=="claustrum")throw Error(q1)}},async onLogin(F){J(),await M(),await Z.runtime.loginOAuth({routeId:"main",credential:F,replace:!0}),J()},label:"Claude native account pool"}}function b1(Z){return{readMode:()=>G1("opencode",Z),disconnectVault:()=>J1({host:"opencode",env:Z})}}function i2(Z={}){return{id:D2,setup:(K)=>j1(K,Z)}}async function j1(Z,K={}){let L=K.paths??await Y1(),J=X1({paths:L,host:"opencode",local:K.local,vault:K.vault}),N=b1(K.vault?.env??process.env),M=!0,T=Z1(),F=g$(),V,Y,H=e$({runtime:J,paths:L,fetch:K.fetch,requestOptions:T.requestOptions,responseOptions:T.responseOptions,onRequestId:T.onRequestId,onForgetSession:T.forgetSession,resolveModelId:async(v)=>F.modelId(v.modelID),onOwnedRequest:()=>{V??=F$(J,K.fetch),Y??=m$({runtime:J,paths:L,source:H,fetch:K.fetch})}}),_=D$({runtime:J,source:H,start:async(v,i)=>{await Z.session.synthetic({sessionID:v,text:i,description:"Claude lane start",resume:!0})}}),Q=[],x=await P$(Z,{source:H,log:{warn:(v,i)=>A2.warn("opencode2",v,i)}},{credential:f$}).catch((v)=>{throw _.close(),H.close(),J.close(),v}),y,D=()=>{if(y)return y;return M=!1,_.close(),H.close(),y=(async()=>{await Promise.allSettled([x.dispose(),V?.dispose(),Y?.dispose(),...Q.map((v)=>v.dispose())]),await H.close(),J.close()})(),y};try{Q.push(await T.install(Z)),Q.push(await F.install(Z)),Q.push(await y2(Z,D1({isActive:()=>M,readMode:N.readMode,runtime:J})));let v={host:"opencode",dispatch:_.dispatch,readStatus:(r)=>_.readStatus(r),readAccounts:()=>J.read(),readMode:N.readMode,disconnectVault:N.disconnectVault,interactive:!0},i=W1(v);return Q.push(await z1(Z,i,_)),D}catch(v){throw await D(),v}}var lK={id:D2,setup:i2().setup,server:B1};export{j1 as setupAnthropicAuth,lK as default,i2 as createAnthropicAuthPlugin,D2 as ANTHROPIC_AUTH_PLUGIN_ID};

package/dist/v2/setup.d.ts

@@ -0,0 +1,58 @@
+import { authorize, exchange, type NativeAccountRuntime, type NativeAccountRuntimeOptions, type NativePoolPaths } from '@cortexkit/anthropic-auth-core';
+import { type RegisterOpenCode2AuthMethodsOptions } from '@cortexkit/common-auth/opencode2';
+import type { Plugin } from '@opencode/plugin';
+export declare const ANTHROPIC_AUTH_PLUGIN_ID = "cortexkit-anthropic-auth";
+/**
+ * The account source vault enrollment selects: 'local' serves accounts stored
+ * in this machine's account pool, 'claustrum' serves accounts from the
+ * Claustrum vault this OpenCode is enrolled in.
+ */
+export type NativeEnrollmentMode = 'local' | 'claustrum';
+export interface AnthropicAuthV2Options {
+    readonly paths?: NativePoolPaths;
+    readonly local?: NativeAccountRuntimeOptions['local'];
+    readonly vault?: NativeAccountRuntimeOptions['vault'];
+    readonly fetch?: typeof fetch;
+}
+/** The OAuth result a completed Claude Pro / Max sign-in hands to the pool. */
+export interface ClaudeOAuthLogin {
+    readonly access: string;
+    readonly refresh: string;
+    readonly expires: number;
+}
+export declare const LOCAL_LOGIN_REFUSED_IN_VAULT = "This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose \"Claude vault accounts\" instead; no local account was changed.";
+export declare const VAULT_ACTIVATION_REFUSED_LOCALLY = "This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.";
+export declare const ENROLLMENT_UNREADABLE = "The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";
+export interface ClaudeLoginMethodsInput {
+    /** False once setup is disposed; every step refuses after that. */
+    readonly isActive: () => boolean;
+    readonly readMode: () => Promise<NativeEnrollmentMode>;
+    /** Verifies a completed sign-in's account and writes it to the local pool. */
+    readonly runtime: Pick<NativeAccountRuntime, 'loginOAuth'>;
+    readonly authorize?: typeof authorize;
+    readonly exchange?: typeof exchange;
+}
+/**
+ * Builds the two login methods OpenCode 2 offers for the anthropic provider:
+ * the Claude Pro / Max browser sign-in, which writes to the local account
+ * pool, and vault activation, which writes nothing locally. Vault enrollment
+ * alone decides which one works. When OpenCode is enrolled in the vault, the
+ * browser sign-in refuses before it opens a browser and again before it
+ * writes, and only vault activation succeeds. When it is not enrolled, vault
+ * activation refuses. An enrollment that cannot be read refuses both, since
+ * neither account source can then be shown to be the right one.
+ */
+export declare function claudeLoginMethods(input: ClaudeLoginMethodsInput): RegisterOpenCode2AuthMethodsOptions<ClaudeOAuthLogin>;
+/**
+ * OpenCode's vault enrollment callbacks for the login methods and the
+ * `claude` menu. Both use only the enrollment files that `env` names.
+ * Disconnecting ends this OpenCode's vault enrollment and never reads or
+ * changes OpenCode's own stored sign-ins.
+ */
+export declare function nativeEnrollmentCallbacks(env: NodeJS.ProcessEnv): {
+    readMode: () => Promise<NativeEnrollmentMode>;
+    disconnectVault: () => Promise<import("@cortexkit/anthropic-auth-core").NativeVaultDisconnectResult>;
+};
+export declare function createAnthropicAuthPlugin(options?: AnthropicAuthV2Options): Plugin.Plugin;
+/** Install request hooks before credential transfer to the shared pool finishes; requests must refuse until that transfer commits, never reuse old host tokens. */
+export declare function setupAnthropicAuth(ctx: Plugin.Context, options?: AnthropicAuthV2Options): Promise<Plugin.Cleanup>;

package/dist/v2/source.d.ts

@@ -0,0 +1,41 @@
+import { type NativeAccountRuntime, type NativeAccountSnapshot, type NativeApiSubject, type NativeLocalCredentialValidation as NativeKnownCredentialSubject, type NativePoolPaths, type OAuthQuotaSnapshot } from '@cortexkit/anthropic-auth-core';
+import type { RequestScope } from '@cortexkit/common-auth/opencode2';
+import { type NativeAnthropicBodyOptions, type NativeAnthropicRequestContext, type NativeAnthropicResponseContext, type NativeAnthropicResponseOptions, type NativeAnthropicSource } from './adapter';
+/**
+ * Identifies the account and credential version that served a send, so a
+ * later 401 or quota reading is recorded against that exact version. It never
+ * holds OAuth tokens, API keys or the private vault authorization receipt.
+ */
+export type NativeSourceProvenance = {
+    readonly kind: 'local';
+    readonly subject: NativeKnownCredentialSubject;
+} | {
+    readonly kind: 'vault';
+    readonly credentialId: string;
+    readonly recordVersion: number;
+} | {
+    readonly kind: 'api';
+    readonly subject: NativeApiSubject;
+};
+export interface NativeSourceOptions {
+    readonly runtime: NativeAccountRuntime;
+    readonly paths: NativePoolPaths;
+    readonly requestOptions: (scope: NativeAnthropicRequestContext<NativeSourceProvenance>, snapshot: NativeAccountSnapshot) => NativeAnthropicBodyOptions;
+    readonly responseOptions?: (scope: NativeAnthropicResponseContext<NativeSourceProvenance>) => NativeAnthropicResponseOptions;
+    readonly onRequestId?: (scope: NativeAnthropicResponseContext<NativeSourceProvenance>, requestId: string) => void;
+    readonly onForgetSession?: (sessionID: string) => void;
+    readonly onOwnedRequest?: () => void;
+    readonly fetch?: typeof fetch;
+    /** Resolve a host model alias to the upstream ID before request-local policy. */
+    readonly resolveModelId?: (scope: RequestScope) => Promise<string>;
+}
+export interface NativeSource extends NativeAnthropicSource<OAuthQuotaSnapshot, NativeSourceProvenance> {
+    readonly close: () => Promise<void>;
+    readonly resetRouting: (sessionID: string) => Promise<void>;
+    readonly recordPrime: (provenance: NativeSourceProvenance, usage: {
+        inputTokens?: number;
+        outputTokens?: number;
+    }) => Promise<boolean>;
+}
+/** The native account service supplies fresh credentials; existing quota and routing rules choose each OpenCode 2 request's route. */
+export declare function createNativeAnthropicSource(options: NativeSourceOptions): NativeSource;

package/dist/v2/tui.d.ts

@@ -0,0 +1,13 @@
+import type { Plugin as Tui } from '@opencode/plugin/tui';
+/**
+ * Shows the `claude` account menu in OpenCode 2 dialogs. The menu's sections,
+ * items and actions come from the plugin server over NATIVE_MENU_RPC, built by
+ * the same Core menu code that OpenCode 1 and Pi render, so every host shows
+ * the same menu.
+ */
+export declare function setupAnthropicTui(ctx: Tui.Context): Promise<() => void>;
+declare const _default: {
+    id: string;
+    setup: typeof setupAnthropicTui;
+};
+export default _default;

package/dist/v2/tui.js

@@ -0,0 +1,2 @@
+import{s as F}from"../index-1jkyhgyr.js";import"../index-3xqv3rw3.js";async function V(B){let Y=B.client.rpc(F),K=!0,$=!1,L=new AbortController,O=()=>{let w=B.ui.router.current();return w.type==="session"?w.sessionID:void 0};function M(w){return new Promise((J)=>{let j="",G=!1,Q=B.keymap.mode.push("cortexkit-protected-entry"),H=(z,D=!0)=>{if(G)return;G=!0,B.renderer.keyInput.off("keypress",X),B.renderer.keyInput.off("paste",Z),L.signal.removeEventListener("abort",W),Q();let q=z?j:void 0;if(j="",D)B.ui.dialog.clear();J(q)},W=()=>H(!1),X=(z)=>{if(z.preventDefault(),z.stopPropagation(),z.name==="escape"||z.ctrl&&z.name==="c")return H(!1);if(z.name==="return"||z.name==="enter")return H(!0);if(z.name==="backspace"){j=Array.from(j).slice(0,-1).join("");return}if(!z.ctrl&&!z.meta&&!z.option&&Array.from(z.sequence).every((D)=>D.charCodeAt(0)>=32&&D.charCodeAt(0)!==127))j=(j+z.sequence).slice(0,4096)},Z=(z)=>{z.preventDefault(),z.stopPropagation(),j=(j+Array.from(new TextDecoder().decode(z.bytes)).filter((D)=>D.charCodeAt(0)>=32&&D.charCodeAt(0)!==127).join("")).slice(0,4096)};if(B.renderer.keyInput.prependListener("keypress",X),B.renderer.keyInput.prependListener("paste",Z),L.signal.addEventListener("abort",W,{once:!0}),B.ui.dialog.alert({title:w,message:"Type or paste the value. Input is hidden. Enter accepts; Escape cancels."}).then(()=>H(!1,!1),()=>H(!1,!1)),L.signal.aborted)W()})}async function P(w){let J={};for(let j of w.knobs){if(!K)return;if(j.kind==="choice"){let G=await B.ui.dialog.select({title:j.label,options:j.choices.map((Q)=>({title:Q.label,value:Q.value})),current:j.value});if(G===void 0)return;J[j.id]=G}else if(j.kind==="toggle"){let G=await B.ui.dialog.select({title:j.label,options:[{title:"On",value:!0},{title:"Off",value:!1}],current:j.value});if(G===void 0)return;J[j.id]=G}else{let G=j.kind==="text"&&j.masked?await M(j.label):await B.ui.dialog.prompt({title:j.label,value:j.value===void 0?void 0:String(j.value),placeholder:j.kind==="text"?j.placeholder:void 0});if(G===void 0)return;J[j.id]=G===""&&!j.required?null:j.kind==="number"?Number(G):G}}return J}async function C(w,J){if(!K||$||O()!==w)return;$=!0;let j=J;try{while(K&&O()===w){let G=await B.ui.dialog.select({title:j.menu.title,options:j.menu.sections.map((D)=>({title:D.title,description:D.lines.join(`
+`),value:D}))});if(!G||!K||O()!==w)return;let Q=[...G.actions.map((D)=>({action:D,itemId:void 0})),...G.items.flatMap((D)=>D.actions.map((q)=>({action:q,itemId:D.id})))],H=await B.ui.dialog.select({title:G.title,options:Q.map((D)=>({title:D.action.label,description:D.action.description,value:D}))});if(!H)continue;let W=await P(H.action);if(!W||!K||O()!==w)return;let X=H.action.confirm?await B.ui.dialog.confirm({title:H.action.label,message:H.action.confirm.message}):void 0;if(H.action.confirm&&X!==!0)continue;if(!K||O()!==w)return;let Z={command:"claude",sectionId:G.id,itemId:H.itemId,actionId:H.action.id,sessionId:w,values:W,confirmed:X},z=await Y.apply(Z,{signal:L.signal,location:B.location});if(!K||O()!==w)return;await B.ui.dialog.alert({title:z.ok?"Claude":"Claude action refused",message:z.text}),j={command:z.command,menu:z.menu}}}finally{$=!1}}let R=Y.events.on("opened",(w)=>C(w.data.sessionId,w.data.payload),{signal:L.signal}),U=Y.events.on("notification",(w)=>{if(K&&O()===w.data.sessionId)B.ui.toast.show({title:"Claude",sessionID:w.data.sessionId,message:w.data.message,variant:w.data.kind})},{signal:L.signal});return B.keymap.layer(()=>({commands:[{id:"cortexkit.claude",title:"Claude",group:"Claude",palette:!0,slash:{name:"claude"},async run(){let w=O();if(!w){await B.ui.dialog.alert({title:"Claude",message:"Open a session before using the Claude menu."});return}let J=await Y.open({sessionId:w},{signal:L.signal,location:B.location});await C(w,J)}}]})),()=>{K=!1,L.abort(),R(),U()}}var T={id:"cortexkit-anthropic-auth",setup:V};export{V as setupAnthropicTui,T as default};

package/dist/v2/wire.d.ts

@@ -0,0 +1,36 @@
+import { type NativeAccountSnapshot } from '@cortexkit/anthropic-auth-core';
+import type { Plugin } from '@opencode/plugin';
+import type { Registration } from '@opencode/plugin/promise/registration';
+import type { NativeAnthropicRequestContext, NativeAnthropicResponseContext } from './adapter';
+import type { NativeSourceProvenance } from './source';
+/**
+ * Claude Code's billing header names the user prompt a request belongs to and
+ * the provider request-id of the previous request for that prompt. Track that
+ * chain per user turn with OpenCode's message IDs: one session spans many
+ * turns, so a session ID alone cannot tell which turn a request serves.
+ */
+export declare function createNativeWirePolicy(): {
+    install(ctx: Pick<Plugin.Context, 'session'>): Promise<Registration>;
+    requestOptions(input: NativeAnthropicRequestContext<NativeSourceProvenance>, snapshot: NativeAccountSnapshot): {
+        cache1hEnabled: boolean;
+        cache1hMode: "automatic" | "explicit" | "hybrid";
+        fastModeEnabled: boolean;
+        thinkingPrefixMismatchBehavior: "account-default" | "drop_block" | "error" | undefined;
+        midConversationEffortEnabled: boolean;
+        serverSideFallbackEnabled: boolean;
+        laneStart: boolean;
+        billingLineage: {
+            promptId: string;
+            previousRequestId: string | undefined;
+        } | undefined;
+        cacheDiagnosticsPreviousMessageId: string | undefined;
+    };
+    responseOptions(input: NativeAnthropicResponseContext<NativeSourceProvenance>): {
+        serverSideFallbackModel: string;
+        laneStart: boolean;
+        onMessageStart(message: Record<string, unknown>): void;
+        onStreamEnd(): void;
+    };
+    onRequestId(input: NativeAnthropicResponseContext<NativeSourceProvenance>, requestId: string): void;
+    forgetSession(sessionID: string): void;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/opencode-anthropic-auth",
-  "version": "1.23.0",
+  "version": "2.0.1",
   "type": "module",
   "repository": {
     "type": "git",
@@ -18,6 +18,14 @@
       "types": "./dist/tui.d.ts",
       "import": "./src/tui/entry.mjs"
     },
+    "./server": {
+      "types": "./dist/v2/server.d.ts",
+      "import": "./dist/v2/server.js"
+    },
+    "./rpc": {
+      "types": "./dist/rpc/rpc-client.d.ts",
+      "import": "./dist/rpc/rpc-client.js"
+    },
     "./tui-prefs": {
       "types": "./dist/tui-preferences.d.ts",
       "import": "./dist/tui-preferences.js"
@@ -45,7 +53,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "build": "rm -rf dist && bun build src/index.ts src/cli.ts src/sidebar-state.ts src/tui-preferences.ts src/rpc/rpc-client.ts src/rpc/port-file.ts src/rpc/protocol.ts src/rpc/rpc-dir.ts --outdir dist --target node --format esm --splitting --external @opencode-ai/plugin --minify && tsc -p tsconfig.build.json --emitDeclarationOnly && bun run build:tui && bun run check:bundle",
+    "build": "rm -rf dist && bun build src/index.ts src/v2/server.ts src/v2/tui.ts src/cli.ts src/sidebar-state.ts src/tui-preferences.ts src/rpc/rpc-client.ts src/rpc/port-file.ts src/rpc/protocol.ts src/rpc/rpc-dir.ts --outdir dist --root src --target node --format esm --splitting --external @opencode-ai/plugin --external @opencode/plugin --external jsonc-parser --minify && tsc -p tsconfig.build.json --emitDeclarationOnly && bun run build:tui && bun run check:bundle",
     "build:tui": "bun scripts/build-tui.ts",
     "smoke:tui": "bun scripts/smoke-tui-pack-install.ts",
     "check:bundle": "bun scripts/check-bundle-globals.ts",
@@ -59,17 +67,24 @@
     "prepublishOnly": "bun run build"
   },
   "peerDependencies": {
-    "@opencode-ai/plugin": "*"
+    "@opencode-ai/plugin": "*",
+    "@opencode/plugin": ">=2.0.21"
+  },
+  "peerDependenciesMeta": {
+    "@opencode/plugin": {
+      "optional": true
+    }
   },
   "dependencies": {
     "@clack/prompts": "^1.6.0",
-    "@cortexkit/anthropic-auth-core": "1.23.0",
+    "@cortexkit/anthropic-auth-core": "2.0.1",
     "@opentui/core": "0.5.11",
     "@opentui/solid": "0.5.11",
     "jsonc-parser": "^3.3.1",
     "solid-js": "1.9.12"
   },
   "devDependencies": {
-    "@ai-sdk/anthropic": "3.0.111"
+    "@ai-sdk/anthropic": "4.0.58",
+    "@opencode/plugin": "2.0.22"
   }
 }

package/src/rpc/notifications.ts

@@ -1,3 +1,4 @@
+import type { CommandDialogPayload } from '@cortexkit/anthropic-auth-core'
 import type { OpenDialogPayload, RpcNotification } from './protocol'
 
 const QUEUE_CAP = 100
@@ -18,11 +19,17 @@ function assertSessionId(sessionId: string): void {
 }
 
 export function pushNotification(
-  payload: OpenDialogPayload,
+  payload: OpenDialogPayload | CommandDialogPayload,
   sessionId: string,
 ): void {
   assertSessionId(sessionId)
-  queue.push({ id: nextId++, type: 'open-dialog', payload, sessionId })
+  if ('menu' in payload) {
+    if (payload.command !== 'claude' || payload.menu.command !== 'claude')
+      throw new TypeError('Only the claude menu is supported')
+    queue.push({ id: nextId++, type: 'open-menu', payload, sessionId })
+  } else {
+    queue.push({ id: nextId++, type: 'open-dialog', payload, sessionId })
+  }
   if (queue.length > QUEUE_CAP) queue = queue.slice(queue.length - QUEUE_CAP)
 }
 

package/src/rpc/protocol.ts

@@ -1,4 +1,7 @@
-import type { ClaustrumEnrollmentStatus } from '@cortexkit/anthropic-auth-core'
+import type {
+  ClaustrumEnrollmentStatus,
+  CommandDialogPayload,
+} from '@cortexkit/anthropic-auth-core'
 
 export const COMMAND_MODAL_NAMES = [
   'claude-account',
@@ -53,12 +56,10 @@ export interface OpenDialogPayload {
   knobs: Record<string, unknown>
 }
 
-export interface RpcNotification {
-  id: number
-  type: 'open-dialog'
-  payload: OpenDialogPayload
-  sessionId: string
-}
+export type RpcNotification = { id: number; sessionId: string } & (
+  | { type: 'open-dialog'; payload: OpenDialogPayload }
+  | { type: 'open-menu'; payload: CommandDialogPayload }
+)
 
 export interface ApplyRequest {
   command: CommandModalName

package/src/rpc/rpc-client.ts

@@ -1,3 +1,7 @@
+import type {
+  CommandApplyRequest,
+  CommandApplyResult,
+} from '@cortexkit/anthropic-auth-core'
 import { discoverPortFile } from './port-file'
 import type { ApplyRequest, ApplyResult, RpcNotification } from './protocol'
 
@@ -7,6 +11,7 @@ export interface RpcClient {
     sessionId: string,
   ) => Promise<RpcNotification[]>
   apply: (request: ApplyRequest) => Promise<ApplyResult>
+  applyMenu: (request: CommandApplyRequest) => Promise<CommandApplyResult>
 }
 
 async function call<T>(
@@ -58,5 +63,17 @@ export function createRpcClient(dir: string, expectedPid?: number): RpcClient {
       )
       return out ?? { text: 'apply failed', knobs: {} }
     },
+    async applyMenu(request) {
+      if (request.command !== 'claude' || !request.sessionId?.trim())
+        throw new TypeError('A claude menu sessionId is required')
+      const out = await call<CommandApplyResult>(
+        dir,
+        'apply-menu',
+        { ...request },
+        expectedPid,
+      )
+      if (!out) throw new Error('Menu apply unavailable; outcome unknown')
+      return out
+    },
   }
 }

package/src/rpc/rpc-server.ts

@@ -6,6 +6,11 @@ import {
   type ServerResponse,
 } from 'node:http'
 import { join } from 'node:path'
+import {
+  type CommandApplyRequest,
+  type CommandApplyResult,
+  parseApplyRequest,
+} from '@cortexkit/anthropic-auth-core'
 import type { drainNotifications } from './notifications'
 import { writePortFile } from './port-file'
 import type { ApplyRequest, ApplyResult } from './protocol'
@@ -19,7 +24,10 @@ export interface RpcServerHandle {
 export interface RpcServerOptions {
   dir: string
   drain: typeof drainNotifications
-  apply: (request: ApplyRequest) => Promise<ApplyResult>
+  /** Structured-menu hosts need no text parser; internal text consumers may still supply one. */
+  apply?: (request: ApplyRequest) => Promise<ApplyResult>
+  /** Run menu actions through the host's credential service, not legacy account-file writes. */
+  applyMenu?: (request: CommandApplyRequest) => Promise<CommandApplyResult>
 }
 
 function readBody(req: IncomingMessage): Promise<string> {
@@ -87,14 +95,23 @@ export async function startRpcServer(
         return json(200, { messages })
       }
       if (method === 'apply') {
+        if (!options.apply)
+          return json(501, { error: 'text apply unavailable' })
         const result = await options.apply(params as unknown as ApplyRequest)
         return json(200, result)
       }
+      if (method === 'apply-menu') {
+        const request = parseApplyRequest(params)
+        if (request?.command !== 'claude' || !request.sessionId?.trim())
+          return json(400, { error: 'invalid menu request' })
+        if (!options.applyMenu) return json(501, { error: 'menu unavailable' })
+        return json(200, await options.applyMenu(request))
+      }
       return json(404, { error: 'unknown method' })
-    } catch (error) {
+    } catch {
       if (!res.headersSent && !res.writableEnded && !res.destroyed) {
         json(500, {
-          error: error instanceof Error ? error.message : String(error),
+          error: 'RPC request failed',
         })
       }
     }