@cortexkit/opencode-anthropic-auth 2.0.1 → 2.0.3

package/dist/v2/server.js

@@ -1,4 +1,4 @@
-import{a as O2,b as t$,c as $1,d as j$,e as B$,f as k2,g as M2,h as V$,i as K1,j as Q$,k as H$,l as U$,m as C$,n as L$,o as B1}from"../index-ynq181e8.js";import"../index-2arfb1y3.js";import"../index-rqync0pc.js";import{t as z1}from"../index-1jkyhgyr.js";import"../index-b3mxpp4w.js";import"../index-04syas8a.js";import{$b as T$,Ad as P2,Ca as S2,Da as l$,Dd as Y1,Jb as h2,Jc as w$,Kb as m2,La as u$,Ld as W1,Md as o$,Nd as n$,Od as r$,Ra as x2,Rd as J1,Sc as y$,Td as R$,Ud as q$,Vb as O$,Wd as p2,Xa as p$,Xb as E$,Yd as h$,Zb as S$,ac as x$,ad as I$,ae as s$,be as a$,ee as k$,fa as G$,fc as Y$,fd as X2,gd as W$,ia as X$,ie as J$,je as z$,kd as A$,ke as c2,md as G1,qa as R2,qb as _2,ra as q2,td as N2,ud as d$,wd as c$,yd as i$,zb as A2,zc as b$,zd as X1}from"../index-yxtdke11.js";import"../index-p4wvcwhh.js";import"../index-52r2e1h9.js";import"../index-3xqv3rw3.js";class U2 extends Error{kind;providerID;sessionID;requestKind;constructor(Z){super(Z.message??`${Z.providerID} ${Z.requestKind} request refused (${Z.kind})`);this.name="OpenCode2AuthError",this.kind=Z.kind,this.providerID=Z.providerID,this.sessionID=Z.sessionID,this.requestKind=Z.requestKind}}function W2(Z){return`common-auth-placeholder.${Z}`}function s2(Z){let K=W2(Z.integrationID);return{type:"oauth",methodID:Z.methodID,access:K,refresh:K,expires:Z.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function w2(Z,K){if(Z?.type!=="oauth")return!1;let L=K===void 0?void 0:W2(K),J=(N)=>L===void 0?N.startsWith("common-auth-placeholder."):N===L;return J(Z.access)&&J(Z.refresh)}var a2="No browser sign-in: this connects the plugin to the accounts in its vault.";async function y2(Z,K){let L=K.now??Date.now,{integrationID:J}=K,N=(F)=>s2({integrationID:J,methodID:F,now:L()}),M=async(F,V)=>{return await K.onLogin(F,{integrationID:J,methodID:V}),N(V)},T=(F)=>async(V)=>{let Y=F.method.id,H=await F.authorize(V),_={url:H.url,instructions:H.instructions,...H.expiresAt===void 0?{}:{expiresAt:H.expiresAt}};if(H.mode==="auto")return{..._,mode:"auto",callback:H.callback.then((x)=>M(x,Y))};let Q=H.callback;return{..._,mode:"code",callback:async(x)=>M(await Q(x),Y)}};return Z.integration.transform((F)=>{let V=K.label===void 0?{}:{label:()=>K.label};for(let _ of K.methods)F.method.update({integrationID:J,method:_.method,authorize:T(_),refresh:async(Q)=>{if(!w2(Q,J))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return N(Q.methodID)},...V});let Y=K.vault;if(Y===void 0)return;let H=Y.method.id;F.method.update({integrationID:J,method:Y.method,authorize:async()=>({url:"",instructions:Y.instructions??a2,mode:"auto",callback:Promise.resolve().then(()=>Y.activate({integrationID:J,methodID:H})).then(()=>N(H))}),refresh:async(_)=>{if(!w2(_,J)||_.methodID!==H)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return N(H)},...V})})}function V1(Z){let K=[],L;for(let J of Z.split(/\r?\n/))if(J.startsWith("data:"))K.push(J.slice(5).replace(/^ /,""));else if(J.startsWith("event:"))L=J.slice(6).trim();if(K.length===0)return;return L===void 0?{data:K.join(`
-`)}:{event:L,data:K.join(`
-`)}}function I2(Z,K){let L=new TextDecoder,J="",N=(T)=>{let F=V1(T);if(!F)return;try{Z(F)}catch(V){K(V)}},M=()=>{for(;;){let T=/\r?\n\r?\n/.exec(J);if(!T)return;let F=J.slice(0,T.index);J=J.slice(T.index+T[0].length),N(F)}};return new TransformStream({transform(T,F){F.enqueue(T),J+=L.decode(T,{stream:!0}),M()},flush(){if(J+=L.decode(),M(),J.trim()!=="")N(J);J=""}})}var t2=512,B2="x-common-auth-attempt",J2=(Z,K)=>JSON.stringify([Z,K]),G2=(Z)=>({providerID:Z.model.providerID,modelID:Z.model.id,sessionID:Z.sessionID,agent:Z.agent,kind:Z.kind});function Q1(Z){let K=Z.headers;return typeof K==="object"&&K!==null}function H1(Z,K){let L=Z.getReader();return new ReadableStream({async pull(J){let N;try{N=await L.read()}catch(M){K({reason:"failed",message:M instanceof Error?M.message:String(M)}),J.error(M);return}if(N.done)K(),J.close();else J.enqueue(N.value)},async cancel(J){K({reason:"cancelled",...J===void 0?{}:{message:String(J)}}),await L.cancel(J)}})}function g2(Z,K){for(let[L,J]of Object.entries(K)){let N=L.toLowerCase();for(let M of Object.keys(Z))if(M.toLowerCase()===N)delete Z[M];if(J!==null)Z[L]=J}}function U1(Z,K){for(let[L,J]of Object.entries(K))if(J===null)Z.delete(L);else Z.set(L,J)}async function f2(Z,K,L={}){let{providerID:J}=K,N=L.gateOnPlaceholder,M=($)=>N===void 0||N.credential($)===W2(J),T=L.logger,F=Math.max(1,L.maxRecords??t2),V=[...L.hostCredentials??[W2(J)],...N?[W2(J)]:[]].filter(($)=>$!==""),Y=new Map,H=new WeakMap,_=new Map,Q=new Set,x=new Map,y=!1,D=!1,v=new Map,i=0,r=!1,n=new Map,c=($,z)=>{try{T?.warn($,z)}catch{}},G=($)=>$ instanceof Error?$.message:String($),j=async($,z)=>{let C=v.get($);if(!C||C.size===0)return;await Promise.all([...C].map(async(P)=>{try{await P(z)}catch(b){c("opencode2 auth listener threw; the request is unaffected",{event:$,error:G(b)})}}))},B=async($,z)=>{try{await K.onAttemptEnd?.($,z)}catch(C){c("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:$.attemptId,error:G(C)})}},S=($,z)=>{if($.ended||!$.attempt)return;let C={...$.status===void 0?{}:{status:$.status},outputStarted:$.outputStarted,...$.limit?{limit:$.limit.signal}:{},...z?{error:z}:{}};if(z)$.endError=z;$.ended=B($.attempt,C)},E=($,z)=>S($,{reason:"abandoned",message:z}),g=($)=>[...Y.values()].filter((z)=>z.key===$),h=($)=>g($).at(-1),d=($)=>{if(Y.delete($.id),!g($.key).length)_.delete($.key)},p=($)=>{Y.set($.id,$);while(Y.size>F){let z=Y.values().next().value;if(z===void 0)break;E(z,"dropped to keep the record bound"),d(z)}},I=($)=>$.accountId===void 0?void 0:{...$.scope,accountId:$.accountId},X=($,z)=>new U2({kind:"no-account",providerID:J,sessionID:$.sessionID,requestKind:$.kind,...z===void 0?{}:{message:z}}),W=($)=>{n.get($)?.clear(),n.delete($)},U=async($,z)=>{let C=()=>X($,`${J} ${$.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(r)throw C();let P=n.get($.sessionID);if(!P)P=new Set,n.set($.sessionID,P);let b={};P.add(b);let f=()=>{if(!P.has(b))throw C()};try{return await z(f)}finally{if(P.delete(b),P.size===0&&n.get($.sessionID)===P)n.delete($.sessionID)}},A=($,z)=>{for(let[C,P]of z)if(V.some((b)=>P.includes(b)))throw new U2({kind:"host-credential-on-wire",providerID:J,sessionID:$.sessionID,requestKind:$.kind,message:`${J} ${$.kind} request still carries the host's placeholder credential in ${C}; the adapter's account headers must replace it`})},R=($)=>{for(let z of g($))if(z.ended||!z.attempt)d(z);else if(z.transport==="ws"||z.judged)E(z,"a newer attempt of its session and kind began"),d(z)},O=async($,z,C,P)=>{let b=J2($.sessionID,$.kind),f=_.get(b);_.delete(b);let k=f?.accountId??h(b)?.accountId;R(b);let w={...$,...k===void 0?{}:{previousAccountId:k},...f?.rerouteFrom===void 0?{}:{rerouteFrom:f.rerouteFrom}},m=await K.chooseAccount(w);C();let Z2={},n2;if(m!==void 0){let T2=await K.accountHeaders({...$,accountId:m});if(C(),Q1(T2))Z2=T2.headers,n2=T2.attempt;else Z2=T2}let r2=`attempt-${++i}`,H2={id:r2,key:b,scope:$,accountId:m,headers:Z2,attempt:m===void 0?void 0:{...$,accountId:m,attemptId:r2,transport:P,data:n2},...P===void 0?{}:{transport:P},outputStarted:!1};if(p(H2),H2.attempt)j("select",{...$,accountId:H2.attempt.accountId,hook:z,...w.previousAccountId===void 0?{}:{previousAccountId:w.previousAccountId},...w.rerouteFrom===void 0?{}:{rerouteFrom:w.rerouteFrom},handle:H2.attempt});return H2},q=async($,z,C,P,b)=>{let f=J2($.sessionID,$.kind),k=P===void 0?void 0:Y.get(P);if(k?.key!==f)k=void 0;if(!k){if(k=h(f),g(f).filter((m)=>m.transport===void 0&&!m.ended).length>1&&!D)D=!0,c("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:$.sessionID,kind:$.kind})}if(!k||k.transport!==void 0||k.ended)k=await O($,z,b,C);else if(k.transport=C,k.attempt)k.attempt.transport=C;if(C==="ws"){for(let w of g(f))if(w!==k&&w.transport==="ws")E(w,"a newer attempt of its session and kind went out over WebSocket")}return k},l=async($,z)=>{try{return await z()}catch(C){throw S($,{reason:"failed",message:G(C)}),C}},u=($,z)=>{let C=g(J2($,z)).filter((P)=>P.transport==="ws").at(-1);return C?.attempt!==void 0&&!C.ended?C:void 0},s=($,z,C)=>{let P=I($);if(!P||!$.attempt||$.limit)return;$.limit={signal:z,delivered:j("limit",{...P,via:C,limit:z,outputStarted:$.outputStarted,handle:$.attempt})}},$2=($,z,C,P)=>{let b=I($);if(!b||!$.attempt)return;j("quota",{...b,transport:z,...P===void 0?{}:{status:P},quota:C,handle:$.attempt})},K2=($,z,C,P)=>{let b=$.attempt;if(!b)return;let f=K.inspectEvent?.(P===void 0?{transport:z,data:C,attempt:b}:{transport:z,data:C,event:P,attempt:b});if(!f)return;if(f.quota!==void 0)$2($,z,f.quota);if(f.outputStarted)$.outputStarted=!0;if(f.limit)s($,f.limit,z);if(f.error!==void 0)S($,{reason:"failed",message:f.error});else if(f.done)S($)},e=($,z)=>{let C=$.attempt;if(!C||z.accountId===$.accountId)return;if(C.reboundFrom??=C.accountId,C.accountId=z.accountId,"data"in z)C.data=z.data;$.accountId=z.accountId},o=($)=>!$.attempt||$.endError!==void 0||$.status!==void 0&&$.status>=400,Y2=($)=>{let z=[...Y.values()].filter((w)=>w.scope.sessionID===$),C=z.filter((w)=>w.limit&&!w.rerouted).at(-1);if(C)return C;let P=z.filter((w)=>w.scope.kind==="primary"),b=P.length>0?P:z;if(b.length<=1)return b[0];let f=b.filter((w)=>!w.judged&&o(w)).at(-1);if(f)return f;let k=b.filter((w)=>w.attempt&&!w.ended);if(k.length>1)return"ambiguous";return k[0]??b.at(-1)},a={providerID:J},t=[];t.push(await Z.session.hook("model.request",($)=>{if(N)return;return U(G2($),async(z)=>{let C=await O(G2($),"model.request",z);if(z(),C.accountId===void 0)throw X(C.scope);g2($.headers,{...C.headers,[B2]:C.id})})},a)),t.push(await Z.session.hook("http.request",($)=>{if(N){let z=M($.request.headers);if(x.set($.sessionID,z),!z)return}return U(G2($),async(z)=>{let C=$.request.headers.get(B2)??void 0,P=N?await O(G2($),"http.request",z,"http"):await q(G2($),"http.request","http",C,z);z();let b=I(P),f=P.attempt;if(!b||!f)throw X(P.scope);await l(P,async()=>{let k=$.request;if(K.rewriteRequest){if(C!==void 0){let Z2=new Headers(k.headers);Z2.delete(B2),k=new Request(k,{headers:Z2})}k=await K.rewriteRequest({...b,request:k,attempt:f})??k,z()}let w=new Headers(k.headers);w.delete(B2),U1(w,P.headers),A(P.scope,w.entries());let m=new Request(k,{headers:w});H.set(m,P),$.request=m})})},a)),t.push(await Z.session.hook("http.response",async($)=>{let z=H.get($.request);if(!z){if(N)return;if(!y)y=!0,c("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:$.sessionID,kind:$.kind});return}let C=$.response;if(K.answeredBy&&z.attempt){let w=z.attempt,m=await l(z,async()=>K.answeredBy?.({request:$.request,response:C,attempt:w}));if(m)e(z,m)}let P=I(z),b=z.attempt;if(!P||!b)return;z.status=C.status;let f=K.quotaFromHeaders?.(C.headers,C.status,b);if(f!==void 0)$2(z,"http",f,C.status);if(!C.ok&&K.limitFromResponse){let w=await K.limitFromResponse({status:C.status,headers:C.headers,body:()=>C.clone().text(),attempt:b});if(w)s(z,w,"http")}if(!C.ok||!C.body)S(z);let k=C;if(C.body&&(K.inspectEvent||K.onAttemptEnd)){let w=C.body;if(K.inspectEvent)w=w.pipeThrough(I2((m)=>K2(z,"http",m.data,m.event),(m)=>c("opencode2 auth event inspection threw",{error:G(m)})));k=new Response(H1(w,(m)=>S(z,m)),{status:C.status,statusText:C.statusText,headers:C.headers})}if(K.rewriteResponse)k=await K.rewriteResponse({...P,request:$.request,response:k,attempt:b})??k;if(k!==C)$.response=k},a)),t.push(await Z.session.hook("experimental.ws.handshake",($)=>{if(N){let z=M(new Headers($.headers)),C=J2($.sessionID,$.kind);if(x.set($.sessionID,z),Q.delete(C),!z)return}return U(G2($),async(z)=>{let C;for(let k of Object.keys($.headers)){if(k.toLowerCase()!==B2)continue;C??=$.headers[k],delete $.headers[k]}let P=N?await O(G2($),"experimental.ws.handshake",z,"ws"):await q(G2($),"experimental.ws.handshake","ws",C,z);z();let b=I(P),f=P.attempt;if(!b||!f)throw X(P.scope);await l(P,async()=>{g2($.headers,P.headers);let k=K.rewriteHandshakeURL?.({...b,url:$.url,attempt:f});if(k!==void 0)$.url=k;if(A(P.scope,Object.entries($.headers)),N)Q.add(P.key)})})},a));let Q2=K.rewriteWebSocketFrame?.bind(K);if(Q2)t.push(await Z.session.hook("experimental.ws.send",async($)=>{let z=G2($);if(N&&!Q.has(J2(z.sessionID,z.kind)))return;let C=u(z.sessionID,z.kind),P=await Q2({...z,attempt:C?.attempt,frame:$.frame});if(P!==void 0)$.frame=P},a));t.push(await Z.session.hook("experimental.ws.receive",($)=>{if(N&&!Q.has(J2($.sessionID,$.kind)))return;let z=u($.sessionID,$.kind);if(!z)return;try{K2(z,"ws",$.frame)}catch(C){c("opencode2 auth frame inspection threw",{error:G(C)})}},a)),t.push(await Z.session.hook("retry",async($)=>{if(N&&x.get($.sessionID)!==!0)return;let z=Y2($.sessionID);if(!z)return;let C=$.decision;if(z==="ambiguous"){await j("retry",{sessionID:$.sessionID,attempt:$.attempt,reason:"host-decides",hostDecision:C,decision:C});return}let P=z;await U(P.scope,async(b)=>{P.judged=!0;let f=C,k,w,m=P.attempt;if(P.accountId===void 0||!m)f={retry:!1},k="no-account";else if(P.outputStarted)f={retry:!1},k="output-started";else{if(!P.limit){let Z2=K.limitFromError?.($.error,m);if(Z2)s(P,Z2,"error")}if(P.ended)await P.ended,b();if(P.limit)await P.limit.delivered,b(),P.rerouted=!0,w={accountId:P.accountId,limit:P.limit.signal},f={retry:!0,delay:0},k="reroute";else k="host-decides"}if($.decision=f,f.retry&&P.accountId!==void 0)_.set(P.key,{sessionID:P.scope.sessionID,accountId:P.accountId,...w===void 0?{}:{rerouteFrom:w}});await j("retry",{sessionID:$.sessionID,...P.accountId===void 0?{}:{accountId:P.accountId},kind:P.scope.kind,attempt:$.attempt,reason:k,hostDecision:C,decision:f,...m===void 0?{}:{handle:m}})})},a));let j2=($)=>{W($),x.delete($);for(let z of Q)if(JSON.parse(z)[0]===$)Q.delete(z);for(let z of[...Y.values()]){if(z.scope.sessionID!==$)continue;E(z,"its session was forgotten"),Y.delete(z.id)}for(let[z,C]of _)if(C.sessionID===$)_.delete(z)},b2=new AbortController,o2=Z.event;if(o2)(async()=>{try{for await(let $ of o2.subscribe({signal:b2.signal}))if($.type==="session.deleted")j2($.data.sessionID)}catch($){if(!b2.signal.aborted)c("opencode2 auth stopped listening for session deletion",{error:G($)})}})();return{on($,z){let C=v.get($);if(!C)C=new Set,v.set($,C);let P=z;return C.add(P),()=>{C.delete(P)}},accountFor($,z){return h(J2($,z))?.accountId},forgetSession:j2,get size(){return Y.size},async dispose(){if(r)return;r=!0;for(let $ of n.keys())W($);b2.abort();for(let $ of Y.values())E($,"the installation was disposed");Y.clear(),_.clear(),Q.clear(),x.clear(),v.clear(),await Promise.all(t.map(async($)=>{try{await $.dispose()}catch(z){c("opencode2 auth hook did not dispose cleanly",{error:G(z)})}}))}}}var e2="native-claude-oauth",$$="native-claude-vault";import{createHash as C1}from"node:crypto";var L2="anthropic",M$="x-common-auth-attempt",L1=["x-session-affinity","x-opencode-session","x-parent-session-id",j$,O2,M2,M$],F2=new Set(["authorization","x-api-key"]),M1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",_1=512,N1=5000,P1=500,K$=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class _$ extends Error{sessionID;requestKind;kind="no-account";providerID=L2;constructor(Z,K){super(M1);this.sessionID=Z;this.requestKind=K;this.name="NativeAnthropicNoAccountError"}}class l2 extends Error{sessionID;requestKind;kind="session-forgotten";providerID=L2;constructor(Z,K){super("request refused: its session was closed while it was being prepared");this.sessionID=Z;this.requestKind=K;this.name="NativeAnthropicRevokedError"}}class V2 extends Error{kind="unsupported-transport";providerID=L2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class N$ extends Error{kind="local-invalid-request";status=400;check;constructor(Z){super(Z.message,{cause:Z});this.name="NativeAnthropicLocalRefusal",this.check=Z.check}}var z2=(Z)=>typeof Z==="object"&&Z!==null&&!Array.isArray(Z);function C2(Z){try{return JSON.parse(Z)}catch{return}}function v2(Z){let K={};for(let[L,J]of Object.entries(Z??{}))K[L.toLowerCase()]=J;return K}function Z$(Z){let K={};for(let L of L1){let J=Z.get(L);if(J!==null&&L!==M$)K[L]=J;Z.delete(L)}return K}function T1(Z){try{return new URL(Z).pathname.endsWith("/messages")}catch{return!1}}function F1(Z){return Z instanceof J$||Z instanceof B$?new N$(Z):void 0}function O1(Z,K){let L=[];if(Z.oauth)L.push(Z.oauth.accessToken);for(let[J,N]of Object.entries(Z.apiHeaders??{})){if(N===null||!F2.has(J))continue;L.push(N.replace(/^Bearer\s+/i,""))}for(let J of F2){let N=K.get(J);if(N!==null)L.push(N.replace(/^Bearer\s+/i,""))}if(Z.dispatch?.kind==="http-relay")L.push(Z.dispatch.token);return[...new Set(L.filter(Boolean))]}var E1=new Set(["oauth-2025-04-20","claude-code-20250219",V$]);function S1(Z){let K=Z.split(",").map((L)=>L.trim()).filter((L)=>L&&!E1.has(L));return X$(null,K)}function x1(Z){let K=C2(Z);if(!z2(K))return Z;let L=z$(K.messages),J=Object.hasOwn(K,"fallbacks"),{droppedMarkers:N}=Q$(K,!1),M=J&&!Object.hasOwn(K,"fallbacks"),T=W$(K);return L>0||N>0||M||T?JSON.stringify(K):Z}async function A1(Z,K){if(!(Z instanceof Promise))return"settled";let L;try{return await Promise.race([Z.then(()=>"settled"),new Promise((J)=>{L=setTimeout(()=>J("timed-out"),K)})])}finally{if(L!==void 0)clearTimeout(L)}}function E2(Z){let{source:K,log:L}=Z,J=Math.max(1,Z.maxPendingSends??_1),N=Z.attemptEndTimeoutMs??N1,M=new Map,T=new WeakMap,F=new WeakMap,V=new Map,Y=new WeakMap,H=h2([]);H.dispose();let _=(X)=>(X&&V.get(X)?.redactor)??H,Q=(X)=>{let W=V.get(X);if(!W)return;V.delete(X),W.redactor.dispose(),W.scope.dispose()},x=(X,W,U,A)=>{let R=O1(W,A),O=m2(R,U);y.set(X,U),V.set(X,{sessionID:W.sessionID,redactor:h2(R),scope:O}),O.settled.then(()=>Q(X));while(V.size>J){let q=V.keys().next().value;if(q===void 0)break;Q(q)}},y=new WeakMap,D=(X,W)=>{let U=X?y.get(X):void 0;if(!U||!W.ok)return H.redactResponse(W);let A=m2([],U),R=A.redactResponse(W);return A.dispose(),R},v=(X,W)=>{let U=X?V.get(X)?.scope:void 0;if(!U)return D(X,W);try{return U.redactResponse(W)}catch{return D(X,W)}},i=!1,r=new WeakMap,n=(X,W)=>{if(X&&!W.ok)r.set(W.headers,X);return W},c=(X,W)=>{if(W.dispatch!=="http-relay")return!0;let U=/^req_[A-Za-z0-9_-]+$/.test(X.get("request-id")??"");return F.set(W,U),U},G=(X)=>new _$(X.sessionID,X.kind),j=new Map,B=async(X,W)=>{if(i)throw new l2(X.sessionID,X.kind);let U={revoked:!1},A=j.get(X.sessionID);if(!A)A=new Set,j.set(X.sessionID,A);A.add(U);let R=()=>{if(i||U.revoked)throw new l2(X.sessionID,X.kind)};try{let O=await W(R);return R(),O}finally{let O=j.get(X.sessionID);if(O?.delete(U)&&O.size===0)j.delete(X.sessionID)}},S=(X,W)=>{M.set(X,W);while(M.size>J){let U=M.keys().next().value;if(U===void 0)break;M.delete(U),L?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:J})}},E=(X,W)=>({providerID:X.providerID,modelID:X.modelID,sessionID:X.sessionID,agent:X.agent,kind:X.kind,accountId:X.accountId,attemptId:X.attemptId,transport:X.transport,route:W.route,provenance:W.provenance,dispatch:W.dispatch}),g=(X)=>B(X,async(W)=>{let{accountId:U,...A}=X,R=await K.authorizeAccount(A,U);return W(),h(A,R)}),h=(X,W)=>{if(!W)throw G(X);if(W.dispatch?.kind==="websocket-relay")throw new V2;let U=W.dispatch?.kind==="http-relay"?"http-relay":"direct",A=W.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":W.dispatch.token}:void 0;if(W.route==="oauth"){if(!W.accessToken)throw G(X);G$(W.accessToken,L2);let q=Object.freeze({route:"oauth",provenance:W.provenance,dispatch:U});S(q,{sessionID:X.sessionID,oauth:{accessToken:W.accessToken,...W.identity?{identity:W.identity}:{}},dispatch:W.dispatch,oauthHeaders:W.headers});let l=v2(W.headers);for(let u of F2)delete l[u];return delete l["anthropic-beta"],{headers:A??{...l,"x-api-key":null,authorization:`Bearer ${W.accessToken}`},attempt:q}}let R={authorization:null,"x-api-key":null,...v2(W.headers)};if(!R.authorization&&!R["x-api-key"])throw G(X);let O=Object.freeze({route:"api",provenance:W.provenance,dispatch:U});return S(O,{sessionID:X.sessionID,...W.baseURL?{baseURL:W.baseURL}:{},dispatch:W.dispatch,apiHeaders:R}),{headers:A??R,attempt:O}},d=(X)=>B(X,(W)=>p(X,W)),p=async(X,W)=>{let{request:U,attempt:A}=X,R=A.data,O=R?M.get(R):void 0;if(R)M.delete(R);if(!R||!O||R.route==="oauth"&&!O.oauth)throw G(X);let q=new Headers(U.headers);Y$(q);let l=Z$(q),u=U.body===null?void 0:await U.text();W();let s=u!==void 0&&T1(U.url);try{if(R.route==="oauth"&&O.oauth){let{accessToken:e,identity:o}=O.oauth;for(let[a,t]of Object.entries(v2(O.oauthHeaders))){if(F2.has(a))continue;if(t===null)q.delete(a);else q.set(a,t)}let Y2=null;if(u!==void 0&&s){let a={...E(A,R),modelID:(()=>{let j2=C2(u);return X2(z2(j2)&&typeof j2.model==="string"?j2.model:X.modelID)})(),route:"oauth",correlation:l},t=await K.requestOptions?.(a)??{};W(),u=await C$(u,{...t,...o?{identity:o}:{},sessionId:X.sessionID});let Q2=C2(u);Y2=z2(Q2)?Q2:null}H$(q,e,{body:Y2,...o?{identity:o}:{}})}else{if(u!==void 0&&s)u=x1(u);q.delete("authorization"),q.delete("x-api-key");for(let[o,Y2]of Object.entries(O.apiHeaders??{}))if(Y2===null)q.delete(o);else q.set(o,Y2);if(u!==void 0&&s&&!q.has("content-type"))q.set("content-type","application/json");let e=q.get("anthropic-beta");if(e!==null){let o=S1(e);if(o)q.set("anthropic-beta",o);else q.delete("anthropic-beta")}}}catch(e){let o=F1(e);if(!o)throw e;throw T.set(R,o.check),L?.warn("refused an Anthropic request locally; nothing was sent",{check:o.check}),o}let $2=u!==void 0?C2(u):void 0;if(await K.admitRequest?.({...E(A,R),modelID:X2(z2($2)&&typeof $2.model==="string"?$2.model:X.modelID)}),Z$(q),u!==void 0)q.delete("content-length");W(),x(R,O,z2($2)&&$2.stream===!0?"event-stream":"http",q);let K2=U$(U.url,O.baseURL!==void 0?{baseURL:O.baseURL}:{}).url?.toString()??U.url;if(O.dispatch?.kind==="http-relay"){let e=u??"";q.delete("x-relay-token");let o={protocol:1,type:"request",affinity:X.sessionID,upstream:{url:K2,method:U.method,headers:Object.fromEntries(q)},mode:"full_sync",revision:1,body:e,next_hash:`sha256:${C1("sha256").update(e).digest("hex")}`};return new Request(O.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":O.dispatch.token},redirect:"error",signal:U.signal,body:JSON.stringify(o)})}return new Request(K2,{method:U.method,headers:q,redirect:U.redirect,signal:U.signal,...u!==void 0?{body:u}:{}})};return{adapter:{providerID:L2,chooseAccount:(X)=>B(X,async()=>{let W=await K.chooseAccount(X);if(!W)throw G(X);return W}),accountHeaders:g,rewriteRequest:d,rewriteHandshakeURL(){throw new V2},rewriteResponse({response:X,attempt:W}){let U=W.data;if(U&&!c(X.headers,U)){if(X.status===401)return Q(U),X.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return v(U,X)}let A=v(U,X);if(U?.route!=="oauth"||!A.body)return n(U,A);let R={...E(W,U),status:X.status},O=K.responseOptions?.(R)??{},q=(X.headers.get("content-type")??"").includes("application/json");return n(U,L$(A,{...O,laneStartOAuthServed:!0,...q?{responseMode:"json"}:{}}))},quotaFromHeaders(X,W,U){let A=U.data;if(!A||!c(X,A))return;return K.quotaFromHeaders?.(X,{...E(U,A),status:W})},async limitFromResponse({status:X,headers:W,body:U,attempt:A}){let R=A.data;if(!R)return;if(!c(W,R))return K.limitFromRelayFailure?.({...E(A,R),status:X});if(Y.set(R,`provider responded with HTTP ${X}`),!K.limitFromResponse)return;let O=r.get(W)===R,q=_(R);return K.limitFromResponse({...E(A,R),status:X,headers:W,body:async()=>O?await U():q.redactText(await U())})},inspectEvent({data:X,event:W,attempt:U}){let A=C2(X);if(!z2(A))return;let R=typeof A.type==="string"?A.type:W;if(R==="content_block_start"||R==="content_block_delta")return{outputStarted:!0};if(R==="message_stop")return{done:!0};if(R!=="error")return;let O=U.data,q=_(O),l=z2(A.error)?A.error:{},u=typeof l.type!=="string"?void 0:K$.has(l.type)?l.type:q.redactText(l.type),s=typeof l.message==="string"?q.redactText(l.message):void 0;if(O?.dispatch==="http-relay"&&F.get(O)===!1)return;let $2=O?K.limitFromStreamError?.({...E(U,O),errorType:u,message:s}):void 0,K2={error:[u??"error",s].filter(Boolean).join(": ").slice(0,P1),...$2?{limit:$2}:{}};if(O&&K2.error)Y.set(O,K2.error);return K2},limitFromError(X,W){let U=W.data;if(!U||T.has(U))return;let A={type:K$.has(X.type)?X.type:"provider_error",message:Y.get(U)??"provider request failed",...X.status!==void 0?{status:X.status}:{}};if(Q(U),U.dispatch==="http-relay"&&F.get(U)===!1)return;return K.limitFromHostError?.(A,E(W,U))},async onAttemptEnd(X,W){let U=X.data;if(!U)return;M.delete(U);let A=W.error?.reason;if(A==="cancelled"||A==="abandoned"||A===void 0&&(W.status===void 0||W.status<400))Q(U);let R=T.get(U),{status:O,...q}=W,l=K.onAttemptEnd?.(E(X,U),{...q,...O!==void 0&&(U.dispatch!=="http-relay"||F.get(U)===!0)?{status:O}:{},...R!==void 0?{localRefusal:{check:R}}:{}});if(await A1(l,N)==="timed-out")L?.warn("the account source did not finish recording a send",{timeoutMs:N})}},dispose(){i=!0;for(let[X,W]of j){for(let U of W)U.revoked=!0;K.forgetSession?.(X)}j.clear(),M.clear();for(let X of[...V.keys()])Q(X)},forgetSession(X){for(let W of j.get(X)??[])W.revoked=!0;j.delete(X);for(let[W,U]of M)if(U.sessionID===X)M.delete(W);for(let[W,U]of[...V])if(U.sessionID===X)Q(W);K.forgetSession?.(X)},get pendingSendCount(){return M.size},get heldCredentialCount(){let X=0;for(let W of M.values())if(W.oauth)X++;return X},get heldRedactorCount(){return V.size},get operationsInProgress(){let X=0;for(let W of j.values())X+=W.size;return X}}}async function P$(Z,K,L){let J=E2(K),N=[],M=async(Q,x,y)=>{let D=await Z.session.hook(Q,x,y);return N.push(D),D},T=new AbortController,F;try{F=await f2({session:{hook:M},event:Z.event},J.adapter,{logger:K.log,gateOnPlaceholder:L})}catch(Q){throw J.dispose(),await Promise.allSettled(N.map((x)=>x.dispose())),Q}let V=(Q)=>{J.forgetSession(Q),F.forgetSession(Q)},Y=Z.event,H=Y?(async()=>{try{for await(let Q of Y.subscribe({signal:T.signal}))if(Q.type==="session.deleted")V(Q.data.sessionID)}catch(Q){if(!T.signal.aborted)K.log?.warn("stopped listening for session deletion",{error:Q instanceof Error?Q.name:"unknown"})}})():Promise.resolve(),_;return{installation:F,forgetSession:V,dispose(){if(_)return _;return J.dispose(),T.abort(),_=(async()=>{await F.dispose(),await H})(),_}}}function F$(Z,K){let L=new AbortController,J,N=!1,M=async()=>{let V=await Z.read();if(L.signal.throwIfAborted(),V.policyStorage.relay?.enabled===!0&&V.policyStorage.relay.transport!=="http")return;let Y=V,H=x2(Y.policyStorage);for(let _ of Y.accounts){if(L.signal.aborted)return;if(!_.enabled||_.type!=="oauth")continue;if(Y.policyStorage.quota?.enabled!==!1&&Date.now()-S2(_.quota)>=H)await Z.fetchQuota(_.id,K,L.signal).catch(()=>{});if(!T$(_.profile)&&!L.signal.aborted)await Z.fetchProfile(_.id,K,L.signal).catch(()=>{})}},T=()=>{if(N||J)return J;return J=M().catch(()=>{if(!L.signal.aborted)A2.debug("opencode2","native background readings did not complete")}).finally(()=>{J=void 0}),J},F=Z.vault.watch({intervalMs:60000,onRefresh:T,shouldRefresh:async()=>{let V=await Z.read();return V.policyStorage.relay?.enabled!==!0||V.policyStorage.relay.transport==="http"}});return F.ready.catch(()=>{}),{async dispose(){N=!0,F.close(),L.abort(),await J}}}var u2=(Z)=>Z!==null&&typeof Z==="object"&&!Array.isArray(Z)?Z:{};function D$(Z){let{runtime:K,source:L}=Z,J=new Map,N=!1,M=async(Y,H)=>{await K.updateSettings((_)=>({..._,[Y]:{...u2(_[Y]),...H}}))},T=()=>({ok:!0,text:"Native Claude settings updated."}),F=async(Y,H)=>{if(N)throw Error("Native menu is closed");switch(H.signal?.throwIfAborted(),Y.action){case"enable":case"disable":return await K.setEnabled(Y.values.id,Y.action==="enable"),T();case"remove":return await K.remove(Y.values.id),T();case"move-up":case"move-down":{let Q=(await K.read()).accounts.map((i)=>i.id),x=Q.indexOf(Y.values.id),y=x+(Y.action==="move-up"?-1:1);if(x<0||y<0||y>=Q.length)return{ok:!1,text:"Account cannot move in that direction."};let D=Q[x],v=Q[y];if(D===void 0||v===void 0)return{ok:!1,text:"Account order changed."};return Q[x]=v,Q[y]=D,await K.reorder(Q),T()}case"add-apikey":return await K.addApi(Y.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let _=new AbortController;J.get(Y.sessionId)?.active.abort();let Q={active:_,auth:void 0};J.set(Y.sessionId,Q);let x=await R2("max");if(N||_.signal.aborted||H.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return Q.auth=x,{ok:!0,text:`Open ${x.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let _=J.get(Y.sessionId);if(!_?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let Q=await q2(Y.values.code,_.auth.verifier,_.auth.redirectUri,_.auth.state);if(_.active.signal.throwIfAborted(),H.signal?.throwIfAborted(),N||Q.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await K.loginOAuth({routeId:crypto.randomUUID(),credential:Q,label:Y.values.label}),_.active.signal.throwIfAborted(),H.signal?.throwIfAborted(),N)return{ok:!1,text:"Sign-in cancelled."};return J.delete(Y.sessionId),{ok:!0,text:"OAuth account stored in the native account pool."}}case"reset-backoff":{let _=await K.read();for(let Q of _.accounts){if(H.signal?.throwIfAborted(),Q.type!=="oauth")continue;let x=Q.source==="vault"?await K.authorizeVault(Q.id,H.signal):await K.captureLocalSubject(Q.id);await K.resetBackoff(Q.id,x)}return T()}case"enrollment-reset":{let _=await S$(E$("opencode"),O$);return{ok:_==="reset",text:_==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let Q=(await K.read()).accounts.filter((D)=>D.type==="oauth"&&D.enabled),x=await Promise.allSettled(Q.map((D)=>K.fetchQuota(D.id,void 0,H.signal)));return{ok:x.every((D)=>D.status==="fulfilled"),text:`${x.filter((D)=>D.status==="fulfilled").length}/${Q.length} native quota readings refreshed.`}}case"routing-reset":return await L.resetRouting(Y.sessionId),T();case"routing-mode":return await M("routing",{mode:Y.values.mode}),T();case"killswitch-on":case"killswitch-off":return await M("killswitch",{enabled:Y.action==="killswitch-on"}),T();case"killswitch-set":return await K.updateSettings((_)=>{let Q=u2(_.killswitch),x={...u2(Q.accounts)},y=Q.main;for(let D of Y.values.entries){let v={five_hour:D.fh,seven_day:D.sd,...D.scoped!==void 0?{scoped:D.scoped}:{}};if(D.account==="main"||D.account==="all")y=v;if(D.account==="all")for(let i of Object.keys(x))x[i]=v;else if(D.account!=="main")x[D.account]=v}return{..._,killswitch:{...Q,main:y,accounts:x}}}),T();case"cache-on":case"cache-off":return await M("claudeCache",{enabled:Y.action==="cache-on"}),T();case"cache-mode":return await M("claudeCache",{mode:Y.values.mode}),T();case"cachekeep-always":return await M("cacheKeep",{enabled:!0,always:!0}),T();case"cachekeep-off":return await M("cacheKeep",{enabled:!1}),T();case"cachekeep-window":return await M("cacheKeep",{enabled:!0,always:!1,startHour:Y.values.startHour,endHour:Y.values.endHour}),T();case"cachekeep-subagents":return await M("cacheKeep",{subagents:Y.values.enabled==="on"}),T();case"dump-on":case"dump-off":return await M("dump",{enabled:Y.action==="dump-on"}),T();case"logging-level":return await M("logging",{level:Y.values.level}),T();case"fast-on":case"fast-off":return await M("claudeFast",{enabled:Y.action==="fast-on"}),T();case"prime-on":case"prime-off":return await M("prime",{enabled:Y.action==="prime-on"}),T();case"start-fire":return await V(Y.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},V=(Y)=>Z.start(Y,k2);return{dispatch:F,async readStatus(Y){let H=await K.read();if(Y==="account")return H.accounts.map((Q)=>`${Q.id}${Q.label?` (${Q.label})`:""}: ${Q.type}, ${Q.source}, ${Q.enabled?"enabled":"disabled"}${Q.state?`, ${A$(Q)}`:""}${Q.accountIdentity?`, ${Q.accountIdentity}`:""}`).join(`
-`)||"No native Claude accounts.";if(Y==="quota")return k$({accounts:H.accounts.filter((Q)=>Q.type==="oauth").map((Q)=>({name:Q.label??Q.id,role:Q.id==="main"?"main":"fallback",enabled:Q.enabled,quota:Q.quota,tierLabel:x$(Q.profile),lastRefreshedAt:Q.lastRefreshedAt,error:Q.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(Y==="prime")return q$({enabled:H.policyStorage.prime?.enabled===!0,accounts:R$(H.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");let _={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(H.settings[_[Y]]??{})},forgetSession(Y){J.get(Y)?.active.abort(),J.delete(Y)},close(){N=!0;for(let Y of J.values())Y.active.abort();J.clear()}}}function g$(){let Z=new Map;return{install:(L)=>L.model.transform((J)=>{Z.clear();for(let N of J.list("anthropic")){if(Z.set(String(N.id),String(N.modelID)),!(b$(N.modelID)||I$(N.modelID)||w$(N.modelID)||y$(N.modelID)))continue;J.update("anthropic",String(N.id),(M)=>{let T=["low","medium","high","xhigh","max"],F=M.variants.filter((V)=>!T.some((Y)=>Y===String(V.id)));M.variants=[...F,...T.map((V)=>({id:V,settings:{effort:V,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(L)=>Z.get(L)??L}}function f$(Z){return Z.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??Z.get("x-api-key")??void 0}var v$=(Z)=>Z!==null&&typeof Z==="object"&&!Array.isArray(Z)?Z:{};function m$(Z){let{runtime:K,source:L}=Z,J=new AbortController,N=new Set,M=(V)=>({providerID:"anthropic",modelID:p2().model,sessionID:`oc2-prime:${V}`,agent:"prime",kind:"generate"}),T=async(V)=>{let Y=M(V),H=E2({source:L}),_=performance.now();try{for(let Q=0;Q<3;Q++){if(J.signal.throwIfAborted(),(await K.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let y=await H.adapter.accountHeaders({...Y,accountId:V});if(!("headers"in y)||typeof y.headers!=="object"||y.headers===null||typeof y.attempt!=="object"||y.attempt===null)throw Error("Native Prime authorization refused");let D={...Y,accountId:V,attemptId:crypto.randomUUID(),transport:"http",data:y.attempt},v,i=!1,r=!1,n=(c)=>{r=!0,c.body?.cancel().catch(()=>{})};try{let c=await H.adapter.rewriteRequest?.({...Y,accountId:V,attempt:D,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(p2()),signal:J.signal})});if(!c)throw Error("Native Prime rewrite refused");let G=new Headers(c.headers);for(let[p,I]of Object.entries(y.headers))if(I===null)G.delete(p);else G.set(p,I);let j=new Request(c,{headers:G}),B=await(Z.fetch??fetch)(j),S=await H.adapter.rewriteResponse?.({...Y,accountId:V,request:j,response:B,attempt:D})??B;v=S.status,H.adapter.quotaFromHeaders?.(S.headers,S.status,D);let E=S.ok?void 0:await H.adapter.limitFromResponse?.({status:S.status,headers:S.headers,body:()=>S.clone().text(),attempt:D});if(E&&/^(vault-newer|local-newer|relay-direct):/.test(E.reason)&&Q<2){if(n(S),await L.chooseAccount({...Y,rerouteFrom:{accountId:V,limit:E}})!==V)throw Error("Native Prime retry changed account");continue}if(!S.ok)return n(S),{ok:!1,status:v,ms:performance.now()-_,error:"Native Prime upstream refused the request"};let g=v$(await S.json()),h=v$(g.usage),d={inputTokens:typeof h.input_tokens==="number"?h.input_tokens:void 0,outputTokens:typeof h.output_tokens==="number"?h.output_tokens:void 0};if(D.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(S.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(i=await L.recordPrime(y.attempt.provenance,d),!i)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:v,ms:performance.now()-_,usage:d}}finally{await H.adapter.onAttemptEnd?.(D,{status:v,outputStarted:!1,...i?{}:{error:{reason:r?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-_}}finally{H.dispose()}},F=new h$({storagePath:Z.paths.legacyConfig,loadStorage:async()=>(await K.read()).policyStorage,async getAccountFingerprint(V){let Y=await K.read(),H=Y.accounts.find((Q)=>Q.id===V);if(!H?.enabled||H.type!=="oauth")return;if(Y.policyStorage.relay?.enabled===!0&&Y.policyStorage.relay.transport!=="http")return;if(H.source==="vault"){let Q=await K.authorizeVault(V,J.signal);return K.getOrCreateAuthLineage(V,Q)}let _=await K.authorizeLocal(V,{signal:J.signal});return _.status==="usable"?K.getOrCreateAuthLineage(V,_.subject):void 0},async refreshQuota(V){let Y=await K.read();if(Y.policyStorage.relay?.enabled===!0&&Y.policyStorage.relay.transport!=="http")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await K.fetchQuota(V,Z.fetch,J.signal),fresh:!0}},sendPrime(V){let Y=T(V);return N.add(Y),Y.finally(()=>N.delete(Y)),Y},async recordSuccess(V){let Y=(await K.read()).accounts.find((H)=>H.id===V);if(!Y?.prime)throw Error("Native Prime counters are unavailable");return Y.prime}});return F.start(),{manager:F,async dispose(){F.stop(),J.abort(),await Promise.allSettled(N)}}}var d2=(Z)=>["five_hour","seven_day"].some((K)=>(Z?.[K]?.remainingPercent??1)<=0);function e$(Z){let{runtime:K}=Z,L=o$("native-auth"),J=new Map,N=(G)=>{let j=G.routingPath??c$(Z.paths.legacyConfig),B=J.get(j);if(!B)B=new i$({path:j,vaultSeed:G.routingSeed}),J.set(j,B);return B.setVaultSeed(G.routingSeed),B},M=new WeakMap,T=new Map,F=new Map,V=new Map,Y=new WeakSet,H=!1,_=()=>{while(T.size>512){let G=T.keys().next();if(!G.done)T.delete(G.value)}},Q=(G,j)=>JSON.stringify([G.sessionID,G.kind,G.modelID,j]),x=(G)=>{if(H)throw Error("Native Anthropic source is closed");let j=V.get(G.sessionID);if(!j){j=new AbortController,V.set(G.sessionID,j);while(V.size>512){let B=V.keys().next();if(!B.done)n.forgetSession?.(B.value)}}return j},y=(G,j,B)=>G.enabled&&(G.type==="api"||P2(G,j,X2(B)).status==="allowed"),D=async(G,j,B,S)=>{let E=await K.read();S.signal.throwIfAborted(),v(E);let g=E.accounts.find((h)=>h.id===G);if(!g||g.type!==B||!y(g,E,j))return!1;if(B==="api"){let h=E.accounts.find((d)=>d.id==="main"&&d.type==="oauth");return!!h&&N2(h.quota,E.policyStorage)&&d2(h.quota)}return!0},v=(G)=>{let j=G.policyStorage.relay;if(j?.enabled===!0&&j.transport!=="http")throw new V2},i=async(G,j)=>{if(v(G),j||G.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let B=await K.getRelayConfig();if(!B)throw Error("request refused: native HTTP relay configuration is unavailable");if(B.transport!=="http")throw new V2;return{dispatch:{kind:"http-relay",url:B.url,token:B.token},relayFallback:B.fallbackToDirect}};async function r(G,j,B){if(G.kind==="local")await K.publishLocal(G.subject,B);else if(G.kind==="vault"&&j.receipt)await K.vault.publish(j.receipt,B);else if(G.kind==="api"&&B.lastUsed!==void 0)await K.publishApi(G.subject,{lastUsed:B.lastUsed})}let n={async chooseAccount(G){let j=x(G);Z.onOwnedRequest?.();let B=await K.read();j.signal.throwIfAborted(),v(B);let S=X2(await Z.resolveModelId?.(G)??G.modelID);if(j.signal.throwIfAborted(),B.mode==="claustrum")B=await r$(K,j.signal),j.signal.throwIfAborted();if(B.policyStorage.quota?.enabled!==!1){let I=!1;for(let X of B.accounts){if(!X.enabled||X.type!=="oauth")continue;if(p$(X.quota)?N2(X.quota,B.policyStorage,Date.now(),S):Date.now()-S2(X.quota)<x2(B.policyStorage))continue;try{await K.fetchQuota(X.id,Z.fetch,j.signal),I=!0}catch{j.signal.throwIfAborted()}}if(I)B=await K.read();j.signal.throwIfAborted()}let E=G.rerouteFrom?T.get(G.rerouteFrom.limit.reason):void 0;if(G.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(G.rerouteFrom.limit.reason)&&!E)return;if(E&&G.rerouteFrom){T.delete(G.rerouteFrom.limit.reason);let I=B.accounts.find((U)=>U.id===E.accountId);if(!I||!y(I,B,S))return;let X=Q(G,E.accountId),W=F.get(X)??[];return W.push(E),F.set(X,W),E.accountId}let g=[];for(let I of B.accounts){if(I.type!=="oauth"||!y(I,B,S))continue;if(I.source==="local"){let X=await K.authorizeLocal(I.id,{signal:j.signal,policy:(W,U)=>P2(W,U,S)});if(j.signal.throwIfAborted(),X.status!=="usable")continue}g.push(I)}let h=g.filter((I)=>I.id!==G.rerouteFrom?.accountId);if(c2(B.policyStorage)==="sticky-balanced"){let I=h.map((W,U)=>({accountId:W.id,order:U,quota:W.quota??{kind:"unknown"}})),X=await N(B).resolve({sessionId:G.sessionID,family:d$(S),modelId:S,affinityModelId:G.modelID,candidates:I,retainAccountIds:new Set(h.map((W)=>W.id)),...B.mode==="claustrum"?{accountIdentities:new Map(B.accounts.flatMap((W)=>W.accountIdentity?[[W.id,W.accountIdentity]]:[]))}:{},storage:B.policyStorage,inputBytes:1,preferredAccountId:G.previousAccountId});if(j.signal.throwIfAborted(),X)return X.accountId}else{let X=c2(B.policyStorage)==="fallback-first"?[...h.filter((W)=>W.id!=="main"),...h.filter((W)=>W.id==="main")]:[...h.filter((W)=>W.id==="main"),...h.filter((W)=>W.id!=="main")];if(X[0])return X[0].id}if(B.mode==="claustrum")throw new n$;let d=B.accounts.find((I)=>I.id==="main"&&I.type==="oauth");if(!d)return;let p=d.quota;if(G.rerouteFrom?.limit.status===429||!N2(p,B.policyStorage))try{p=await K.fetchQuota("main",Z.fetch,j.signal)}catch{return}if(j.signal.throwIfAborted(),!d2(p))return;return B.accounts.find((I)=>I.type==="api"&&I.enabled&&I.id!==G.rerouteFrom?.accountId)?.id},async authorizeAccount(G,j){let B=x(G),S=await K.read();B.signal.throwIfAborted(),v(S);let E=X2(await Z.resolveModelId?.(G)??G.modelID);B.signal.throwIfAborted();let g=S.accounts.find((O)=>O.id===j);if(!g||!y(g,S,E))return;let h=Q(G,j),d=F.get(h),p=d?.shift();if(d?.length===0)F.delete(h);let{dispatch:I,relayFallback:X}=await i(S,p?.direct===!0);if(B.signal.throwIfAborted(),p?.auth){if(!await D(j,E,p.auth.route,B))return;let O=M.get(p.auth.provenance);if(O?.receipt?.expiresAtMs!==void 0&&O.receipt.expiresAtMs!==null&&O.receipt.expiresAtMs<Date.now()+300000)return;if(O)M.set(p.auth.provenance,{...O,scope:{...G,modelID:E},account:g,active:B,relayFallback:X});return{...p.auth,dispatch:I}}let W={scope:{...G,modelID:E},active:B,account:g,retry:p?.retry??!1,relayFallback:X,quota:g.quota};if(g.type==="api"){let O=S.accounts.find((s)=>s.id==="main"&&s.type==="oauth");if(!O||!N2(O.quota,S.policyStorage)||!d2(O.quota))return;let q=await K.authorizeApi(j,B.signal);if(B.signal.throwIfAborted(),!await D(j,E,"api",B))return;let l={kind:"api",subject:q.subject};return M.set(l,W),{route:"api",headers:q.authHeader==="authorization-bearer"?{authorization:`Bearer ${q.apiKey}`}:{"x-api-key":q.apiKey},baseURL:q.baseURL,provenance:l,dispatch:I}}if(g.source==="vault"){let O=await K.authorizeVault(j,B.signal);if(B.signal.throwIfAborted(),!await D(j,E,"oauth",B))return;let q={kind:"vault",credentialId:O.credentialId,recordVersion:O.recordVersion};M.set(q,{...W,receipt:O});let l=O.assertedAccountIdentity;if(!l)return;return{route:"oauth",accessToken:O.accessToken,provenance:q,dispatch:I,identity:_2(l,l)}}let U=await K.authorizeLocal(j,{signal:B.signal,policy:(O,q)=>P2(O,q,E)});if(B.signal.throwIfAborted(),U.status!=="usable")return;if(!await D(j,E,"oauth",B))return;let A={kind:"local",subject:U.subject};M.set(A,{...W,access:U.access});let R=U.subject.binding.identity;return{route:"oauth",accessToken:U.access,provenance:A,dispatch:I,identity:_2(R,R)}},async requestOptions(G){let j=x(G),B=await K.read();j.signal.throwIfAborted();let S=B.accounts.find((g)=>g.id===G.accountId);if(!S||!y(S,B,G.modelID))throw Error("request refused: native account is ineligible for this model");let E=M.get(G.provenance);if(E)M.set(G.provenance,{...E,scope:{...E.scope,modelID:G.modelID}});return Z.requestOptions(G,B)},async admitRequest(G){let j=M.get(G.provenance);if(!j||!await D(G.accountId,G.modelID,G.route,j.active))throw Error("request refused: native account policy changed before dispatch");M.set(G.provenance,{...j,scope:{...j.scope,modelID:G.modelID}})},responseOptions(G){return Z.responseOptions?.({...G,modelID:M.get(G.provenance)?.scope.modelID??G.modelID})},quotaFromHeaders(G,j){let B=M.get(j.provenance),S=t$(G);if(S)Z.onRequestId?.(j,S);if(!B||j.route!=="oauth"||!s$(G))return;let E=j.provenance.kind==="local"?j.provenance.subject.binding.identity:B.receipt?.assertedAccountIdentity,g={...a$(G),...E?{accountIdentity:E}:{}};B.quota=l$(B.quota,g);let h=L.observe(r(j.provenance,B,{quota:B.quota}));return c.set(j.provenance,h),g},async limitFromResponse(G){let j=M.get(G.provenance);if(!j)return;if(G.status===401&&j.receipt){if(!Y.has(j.receipt))Y.add(j.receipt),await K.vault.reportFailure(j.receipt,401,G.dispatch==="http-relay"?"relay_status_field":"direct");if(j.retry||j.active.signal.aborted)return;let S=j.active,E=await K.vault.prepareRetry(j.receipt,S.signal);if(S.signal.throwIfAborted(),!E.retry)return;let g=E.receipt,h=g.assertedAccountIdentity;if(!h)return;let d={kind:"vault",credentialId:g.credentialId,recordVersion:g.recordVersion};M.set(d,{...j,receipt:g,retry:!0});let p=`vault-newer:${G.attemptId}`;return T.set(p,{sessionID:G.sessionID,accountId:G.accountId,retry:!0,auth:{route:"oauth",accessToken:g.accessToken,provenance:d,identity:_2(h,h)}}),_(),{reason:p,status:401}}if(G.status===401&&G.provenance.kind==="local"&&j.access&&!j.retry){if(j.active.signal.aborted)return;let S=j.active,E=await K.authorizeLocal(G.accountId,{rejectedAccessToken:j.access,signal:S.signal,policy:(p,I)=>P2(p,I,j.scope.modelID)});if(S.signal.throwIfAborted(),E.status!=="usable"||E.access===j.access)return;let g={kind:"local",subject:E.subject};M.set(g,{...j,access:E.access,retry:!0});let h=E.subject.binding.identity,d=`local-newer:${G.attemptId}`;return T.set(d,{sessionID:G.sessionID,accountId:G.accountId,retry:!0,auth:{route:"oauth",accessToken:E.access,provenance:g,identity:_2(h,h)}}),_(),{reason:d,status:401}}let B=await K.read();if(u$(G.status,B.policyStorage))return{reason:`provider-${G.status}`,status:G.status};return},limitFromRelayFailure(G){let j=M.get(G.provenance);if(!j?.relayFallback||j.active.signal.aborted||!(G.status===401||G.status>=500))return;let B=`relay-direct:${G.attemptId}`;return T.set(B,{sessionID:G.sessionID,accountId:G.accountId,direct:!0,retry:!1}),_(),{reason:B}},limitFromStreamError(G){return G.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(G,j){let B=M.get(j.provenance);if(j.dispatch==="http-relay"&&B?.relayFallback&&!B.active.signal.aborted&&G.status===void 0){let S=`relay-direct:${j.attemptId}`;return T.set(S,{sessionID:j.sessionID,accountId:j.accountId,direct:!0,retry:!1}),_(),{reason:S}}return},async onAttemptEnd(G,j){let B=M.get(G.provenance);if(!B)return;try{if(await c.get(G.provenance),j.status===401&&B.receipt&&!Y.has(B.receipt))Y.add(B.receipt),await K.vault.reportFailure(B.receipt,401,G.dispatch==="http-relay"?"relay_status_field":"direct");if(!j.localRefusal&&j.status!==void 0)L.publish(()=>r(G.provenance,B,{lastUsed:Date.now()}))}finally{M.delete(G.provenance),c.delete(G.provenance)}},forgetSession(G){V.get(G)?.abort(),V.delete(G);for(let[j,B]of T)if(B.sessionID===G)T.delete(j);for(let[j,B]of F)if(B[0]?.sessionID===G)F.delete(j);Z.onForgetSession?.(G)},resetRouting:async(G)=>N(await K.read()).clear(G),async recordPrime(G,j){let B=M.get(G);if(!B||B.active.signal.aborted)return!1;if(G.kind==="local")return K.incrementPrimeUsage(B.account.id,G.subject,j);if(G.kind==="vault"&&B.receipt)return K.incrementPrimeUsage(B.account.id,B.receipt,j);return!1},close(){H=!0;for(let G of V.values())G.abort();return V.clear(),F.clear(),T.clear(),L.drain()}},c=new WeakMap;return n}function Z1(){let Z=new $1,K=new Map,L=new Map,J=new Map,N=new Set,M=new Set,T=new Map,F=(V)=>{while(V.size>512){let Y=V.keys().next();if(!Y.done)V.delete(Y.value)}};return{async install(V){let Y=[];try{Y.push(await V.session.hook("context",(H)=>{let _=H.messages.map((x)=>{return{info:{id:x.id,sessionID:H.sessionID,role:x.role,agent:H.agent,model:{providerID:H.model.providerID,modelID:H.model.id}},parts:x.content.map((y)=>({type:y.type,...y.type==="text"?{text:y.text}:{}}))}});Z.observeMessages(_);let Q=H.messages.findLast((x)=>x.role==="user"&&x.id);if(Q?.id)K.set(H.sessionID,Q.id);if(Q?.content.some((x)=>x.type==="text"&&x.text===k2))N.add(H.sessionID);else N.delete(H.sessionID);F(K)},{providerID:"anthropic"})),Y.push(await V.session.hook("model.request",(H)=>{if(H.kind!=="primary")return;let _=K.get(H.sessionID);if(!_)return;if(Z.markHeaders({sessionId:H.sessionID,messageId:_,agent:H.agent,headers:H.headers}),N.has(H.sessionID))H.headers[M2]="1"},{providerID:"anthropic"}))}catch(H){throw await Promise.allSettled(Y.map((_)=>_.dispose())),H}return{dispose:async()=>{await Promise.all(Y.map((H)=>H.dispose()))}}},requestOptions(V,Y){let H=Z.resolveHeader(V.correlation[O2]);if(H)L.set(V.attemptId,H),F(L);T.set(V.attemptId,V.sessionID),F(T);let _=V.correlation[M2]==="1";if(_)M.add(V.attemptId);return{cache1hEnabled:V.agent!=="compaction"&&V.agent!=="title"&&(Y.policyStorage.claudeCache?.enabled??!0),cache1hMode:Y.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:Y.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:Y.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,serverSideFallbackEnabled:K1(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:_,billingLineage:H?{promptId:H.promptId,previousRequestId:H.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:J.get(V.sessionID)}},responseOptions(V){return{serverSideFallbackModel:X2(V.modelID),laneStart:M.has(V.attemptId),onMessageStart(Y){if(V.kind==="primary"&&typeof Y.id==="string")J.set(V.sessionID,Y.id),F(J)},onStreamEnd(){L.delete(V.attemptId),M.delete(V.attemptId),T.delete(V.attemptId)}}},onRequestId(V,Y){Z.commit(L.get(V.attemptId),Y)},forgetSession(V){Z.clearSession(V),K.delete(V),J.delete(V),N.delete(V);for(let[Y,H]of T)if(H===V)L.delete(Y),M.delete(Y),T.delete(Y)}}}var D2="cortexkit-anthropic-auth",R1='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',q1="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",k1="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function D1(Z){let K=Z.authorize??R2,L=Z.exchange??q2,J=()=>{if(!Z.isActive())throw Error("Claude authentication setup is closed")},N=async()=>{let F;try{F=await Z.readMode()}catch{throw Error(k1)}return J(),F},M=async()=>{if(await N()!=="local")throw Error(R1)};return{integrationID:"anthropic",methods:[{method:{id:e2,type:"oauth",label:"Claude Pro / Max (native account pool)"},async authorize(){J(),await M();let F=await K("max");return J(),{mode:"code",url:F.url,instructions:"Paste the authorization code returned by Claude.",callback:async(V)=>{J();let Y=await L(V,F.verifier,F.redirectUri,F.state);if(!Z.isActive()||Y.type!=="success")throw Error("Claude sign-in did not complete");return{access:Y.access,refresh:Y.refresh,expires:Y.expires}}}}}],vault:{method:{id:$$,type:"oauth",label:"Claude vault accounts"},async activate(){if(J(),await N()!=="claustrum")throw Error(q1)}},async onLogin(F){J(),await M(),await Z.runtime.loginOAuth({routeId:"main",credential:F,replace:!0}),J()},label:"Claude native account pool"}}function b1(Z){return{readMode:()=>G1("opencode",Z),disconnectVault:()=>J1({host:"opencode",env:Z})}}function i2(Z={}){return{id:D2,setup:(K)=>j1(K,Z)}}async function j1(Z,K={}){let L=K.paths??await Y1(),J=X1({paths:L,host:"opencode",local:K.local,vault:K.vault}),N=b1(K.vault?.env??process.env),M=!0,T=Z1(),F=g$(),V,Y,H=e$({runtime:J,paths:L,fetch:K.fetch,requestOptions:T.requestOptions,responseOptions:T.responseOptions,onRequestId:T.onRequestId,onForgetSession:T.forgetSession,resolveModelId:async(v)=>F.modelId(v.modelID),onOwnedRequest:()=>{V??=F$(J,K.fetch),Y??=m$({runtime:J,paths:L,source:H,fetch:K.fetch})}}),_=D$({runtime:J,source:H,start:async(v,i)=>{await Z.session.synthetic({sessionID:v,text:i,description:"Claude lane start",resume:!0})}}),Q=[],x=await P$(Z,{source:H,log:{warn:(v,i)=>A2.warn("opencode2",v,i)}},{credential:f$}).catch((v)=>{throw _.close(),H.close(),J.close(),v}),y,D=()=>{if(y)return y;return M=!1,_.close(),H.close(),y=(async()=>{await Promise.allSettled([x.dispose(),V?.dispose(),Y?.dispose(),...Q.map((v)=>v.dispose())]),await H.close(),J.close()})(),y};try{Q.push(await T.install(Z)),Q.push(await F.install(Z)),Q.push(await y2(Z,D1({isActive:()=>M,readMode:N.readMode,runtime:J})));let v={host:"opencode",dispatch:_.dispatch,readStatus:(r)=>_.readStatus(r),readAccounts:()=>J.read(),readMode:N.readMode,disconnectVault:N.disconnectVault,interactive:!0},i=W1(v);return Q.push(await z1(Z,i,_)),D}catch(v){throw await D(),v}}var lK={id:D2,setup:i2().setup,server:B1};export{j1 as setupAnthropicAuth,lK as default,i2 as createAnthropicAuthPlugin,D2 as ANTHROPIC_AUTH_PLUGIN_ID};
+import{a as k2,b as B1,c as K1,d as H$,e as U$,f as f2,g as O2,h as L$,i as z1,j as M$,k as _$,l as C$,m as N$,n as P$,o as E1}from"../index-nfcp0m1t.js";import"../index-2arfb1y3.js";import"../index-rqync0pc.js";import{t as T1}from"../index-1jkyhgyr.js";import{u as N1,v as P1,x as F1}from"../index-kd89hcr3.js";import"../index-jmjevtm1.js";import"../index-qttfa42y.js";import{$c as q$,Ad as X1,Ae as V1,Eb as p$,Ee as d$,Fa as w2,Fe as K$,Ga as e$,Gd as x2,Ge as z$,Hc as p2,Hd as Y1,He as a2,Ic as c2,Lc as D$,Ld as G1,Ma as D2,Mc as w$,Nc as b$,Oa as $1,Ob as c$,Oc as _2,Od as L1,Pc as o2,Pd as V2,Qc as y$,Sc as E$,Tc as S$,Ua as b2,Uc as x$,Ud as M1,Vc as I$,Vd as R2,Xb as i$,Xc as f$,Zc as g$,_a as Z1,ad as v$,fc as o$,fd as B$,ia as j$,ie as _1,je as W1,ke as J1,la as V$,nc as S2,nd as j2,od as Q$,oe as C1,qe as m$,re as l$,ta as y2,td as X2,te as r2,ua as I2,ud as h$,ve as a$,wc as H2,wd as U1,ze as j1}from"../index-mdpyfkv3.js";import"../index-fncp6r0j.js";import"../index-5hyennzm.js";import"../index-rftced5v.js";class P2 extends Error{kind;providerID;sessionID;requestKind;constructor($){super($.message??`${$.providerID} ${$.requestKind} request refused (${$.kind})`);this.name="OpenCode2AuthError",this.kind=$.kind,this.providerID=$.providerID,this.sessionID=$.sessionID,this.requestKind=$.requestKind}}function Q2($){return`common-auth-placeholder.${$}`}function X$($){let X=Q2($.integrationID);return{type:"oauth",methodID:$.methodID,access:X,refresh:X,expires:$.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function v2($,X){if($?.type!=="oauth")return!1;let L=X===void 0?void 0:Q2(X),V=(C)=>L===void 0?C.startsWith("common-auth-placeholder."):C===L;return V($.access)&&V($.refresh)}var Y$="No browser sign-in: this connects the plugin to the accounts in its vault.";async function h2($,X){let L=X.now??Date.now,{integrationID:V}=X,C=(E)=>X$({integrationID:V,methodID:E,now:L()}),_=async(E,H)=>{return await X.onLogin(E,{integrationID:V,methodID:H}),C(H)},P=(E)=>async(H)=>{let Y=E.method.id,U=await E.authorize(H),Q={url:U.url,instructions:U.instructions,...U.expiresAt===void 0?{}:{expiresAt:U.expiresAt}};if(U.mode==="auto")return{...Q,mode:"auto",callback:U.callback.then((T)=>_(T,Y))};let K=U.callback;return{...Q,mode:"code",callback:async(T)=>_(await K(T),Y)}};return $.integration.transform((E)=>{let H=X.label===void 0?{}:{label:()=>X.label};for(let Q of X.methods)E.method.update({integrationID:V,method:Q.method,authorize:P(Q),refresh:async(K)=>{if(!v2(K,V))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return C(K.methodID)},...H});let Y=X.vault;if(Y===void 0)return;let U=Y.method.id;E.method.update({integrationID:V,method:Y.method,authorize:async()=>({url:"",instructions:Y.instructions??Y$,mode:"auto",callback:Promise.resolve().then(()=>Y.activate({integrationID:V,methodID:U})).then(()=>C(U))}),refresh:async(Q)=>{if(!v2(Q,V)||Q.methodID!==U)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return C(U)},...H})})}function S1($){let X=[],L;for(let V of $.split(/\r?\n/))if(V.startsWith("data:"))X.push(V.slice(5).replace(/^ /,""));else if(V.startsWith("event:"))L=V.slice(6).trim();if(X.length===0)return;return L===void 0?{data:X.join(`
+`)}:{event:L,data:X.join(`
+`)}}function m2($,X){let L=new TextDecoder,V="",C=(P)=>{let E=S1(P);if(!E)return;try{$(E)}catch(H){X(H)}},_=()=>{for(;;){let P=/\r?\n\r?\n/.exec(V);if(!P)return;let E=V.slice(0,P.index);V=V.slice(P.index+P[0].length),C(E)}};return new TransformStream({transform(P,E){E.enqueue(P),V+=L.decode(P,{stream:!0}),_()},flush(){if(V+=L.decode(),_(),V.trim()!=="")C(V);V=""}})}var G$=512,U2="x-common-auth-attempt",K2=($,X)=>JSON.stringify([$,X]),J2=($)=>({providerID:$.model.providerID,modelID:$.model.id,sessionID:$.sessionID,agent:$.agent,kind:$.kind});function x1($){let X=$.headers;return typeof X==="object"&&X!==null}function R1($,X){let L=$.getReader();return new ReadableStream({async pull(V){let C;try{C=await L.read()}catch(_){X({reason:"failed",message:_ instanceof Error?_.message:String(_)}),V.error(_);return}if(C.done)X(),V.close();else V.enqueue(C.value)},async cancel(V){X({reason:"cancelled",...V===void 0?{}:{message:String(V)}}),await L.cancel(V)}})}function l2($,X){for(let[L,V]of Object.entries(X)){let C=L.toLowerCase();for(let _ of Object.keys($))if(_.toLowerCase()===C)delete $[_];if(V!==null)$[L]=V}}function A1($,X){for(let[L,V]of Object.entries(X))if(V===null)$.delete(L);else $.set(L,V)}async function d2($,X,L={}){let{providerID:V}=X,C=L.gateOnPlaceholder,_=(Z)=>C===void 0||C.credential(Z)===Q2(V),P=L.logger,E=Math.max(1,L.maxRecords??G$),H=[...L.hostCredentials??[Q2(V)],...C?[Q2(V)]:[]].filter((Z)=>Z!==""),Y=new Map,U=new WeakMap,Q=new Map,K=new Set,T=new Map,q=!1,A=!1,m=new Map,I=0,d=!1,n=new Map,i=(Z,B)=>{try{P?.warn(Z,B)}catch{}},G=(Z)=>Z instanceof Error?Z.message:String(Z),j=async(Z,B)=>{let M=m.get(Z);if(!M||M.size===0)return;await Promise.all([...M].map(async(F)=>{try{await F(B)}catch(y){i("opencode2 auth listener threw; the request is unaffected",{event:Z,error:G(y)})}}))},J=async(Z,B)=>{try{await X.onAttemptEnd?.(Z,B)}catch(M){i("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:Z.attemptId,error:G(M)})}},S=(Z,B)=>{if(Z.ended||!Z.attempt)return;let M={...Z.status===void 0?{}:{status:Z.status},outputStarted:Z.outputStarted,...Z.limit?{limit:Z.limit.signal}:{},...B?{error:B}:{}};if(B)Z.endError=B;Z.ended=J(Z.attempt,M)},R=(Z,B)=>S(Z,{reason:"abandoned",message:B}),x=(Z)=>[...Y.values()].filter((B)=>B.key===Z),v=(Z)=>x(Z).at(-1),c=(Z)=>{if(Y.delete(Z.id),!x(Z.key).length)Q.delete(Z.key)},o=(Z)=>{Y.set(Z.id,Z);while(Y.size>E){let B=Y.values().next().value;if(B===void 0)break;R(B,"dropped to keep the record bound"),c(B)}},f=(Z)=>Z.accountId===void 0?void 0:{...Z.scope,accountId:Z.accountId},u=(Z,B)=>new P2({kind:"no-account",providerID:V,sessionID:Z.sessionID,requestKind:Z.kind,...B===void 0?{}:{message:B}}),W=(Z)=>{n.get(Z)?.clear(),n.delete(Z)},z=async(Z,B)=>{let M=()=>u(Z,`${V} ${Z.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(d)throw M();let F=n.get(Z.sessionID);if(!F)F=new Set,n.set(Z.sessionID,F);let y={};F.add(y);let h=()=>{if(!F.has(y))throw M()};try{return await B(h)}finally{if(F.delete(y),F.size===0&&n.get(Z.sessionID)===F)n.delete(Z.sessionID)}},N=(Z,B)=>{for(let[M,F]of B)if(H.some((y)=>F.includes(y)))throw new P2({kind:"host-credential-on-wire",providerID:V,sessionID:Z.sessionID,requestKind:Z.kind,message:`${V} ${Z.kind} request still carries the host's placeholder credential in ${M}; the adapter's account headers must replace it`})},D=(Z)=>{for(let B of x(Z))if(B.ended||!B.attempt)c(B);else if(B.transport==="ws"||B.judged)R(B,"a newer attempt of its session and kind began"),c(B)},O=async(Z,B,M,F)=>{let y=K2(Z.sessionID,Z.kind),h=Q.get(y);Q.delete(y);let w=h?.accountId??v(y)?.accountId;D(y);let g={...Z,...w===void 0?{}:{previousAccountId:w},...h?.rerouteFrom===void 0?{}:{rerouteFrom:h.rerouteFrom}},p=await X.chooseAccount(g);M();let W2={},$$;if(p!==void 0){let A2=await X.accountHeaders({...Z,accountId:p});if(M(),x1(A2))W2=A2.headers,$$=A2.attempt;else W2=A2}let Z$=`attempt-${++I}`,N2={id:Z$,key:y,scope:Z,accountId:p,headers:W2,attempt:p===void 0?void 0:{...Z,accountId:p,attemptId:Z$,transport:F,data:$$},...F===void 0?{}:{transport:F},outputStarted:!1};if(o(N2),N2.attempt)j("select",{...Z,accountId:N2.attempt.accountId,hook:B,...g.previousAccountId===void 0?{}:{previousAccountId:g.previousAccountId},...g.rerouteFrom===void 0?{}:{rerouteFrom:g.rerouteFrom},handle:N2.attempt});return N2},k=async(Z,B,M,F,y)=>{let h=K2(Z.sessionID,Z.kind),w=F===void 0?void 0:Y.get(F);if(w?.key!==h)w=void 0;if(!w){if(w=v(h),x(h).filter((p)=>p.transport===void 0&&!p.ended).length>1&&!A)A=!0,i("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:Z.sessionID,kind:Z.kind})}if(!w||w.transport!==void 0||w.ended)w=await O(Z,B,y,M);else if(w.transport=M,w.attempt)w.attempt.transport=M;if(M==="ws"){for(let g of x(h))if(g!==w&&g.transport==="ws")R(g,"a newer attempt of its session and kind went out over WebSocket")}return w},b=async(Z,B)=>{try{return await B()}catch(M){throw S(Z,{reason:"failed",message:G(M)}),M}},s=(Z,B)=>{let M=x(K2(Z,B)).filter((F)=>F.transport==="ws").at(-1);return M?.attempt!==void 0&&!M.ended?M:void 0},l=(Z,B,M)=>{let F=f(Z);if(!F||!Z.attempt||Z.limit)return;Z.limit={signal:B,delivered:j("limit",{...F,via:M,limit:B,outputStarted:Z.outputStarted,handle:Z.attempt})}},Z2=(Z,B,M,F)=>{let y=f(Z);if(!y||!Z.attempt)return;j("quota",{...y,transport:B,...F===void 0?{}:{status:F},quota:M,handle:Z.attempt})},$2=(Z,B,M,F)=>{let y=Z.attempt;if(!y)return;let h=X.inspectEvent?.(F===void 0?{transport:B,data:M,attempt:y}:{transport:B,data:M,event:F,attempt:y});if(!h)return;if(h.quota!==void 0)Z2(Z,B,h.quota);if(h.outputStarted)Z.outputStarted=!0;if(h.limit)l(Z,h.limit,B);if(h.error!==void 0)S(Z,{reason:"failed",message:h.error});else if(h.done)S(Z)},Y2=(Z,B)=>{let M=Z.attempt;if(!M||B.accountId===Z.accountId)return;if(M.reboundFrom??=M.accountId,M.accountId=B.accountId,"data"in B)M.data=B.data;Z.accountId=B.accountId},e=(Z)=>!Z.attempt||Z.endError!==void 0||Z.status!==void 0&&Z.status>=400,r=(Z)=>{let B=[...Y.values()].filter((g)=>g.scope.sessionID===Z),M=B.filter((g)=>g.limit&&!g.rerouted).at(-1);if(M)return M;let F=B.filter((g)=>g.scope.kind==="primary"),y=F.length>0?F:B;if(y.length<=1)return y[0];let h=y.filter((g)=>!g.judged&&e(g)).at(-1);if(h)return h;let w=y.filter((g)=>g.attempt&&!g.ended);if(w.length>1)return"ambiguous";return w[0]??y.at(-1)},t={providerID:V},a=[];a.push(await $.session.hook("model.request",(Z)=>{if(C)return;return z(J2(Z),async(B)=>{let M=await O(J2(Z),"model.request",B);if(B(),M.accountId===void 0)throw u(M.scope);l2(Z.headers,{...M.headers,[U2]:M.id})})},t)),a.push(await $.session.hook("http.request",(Z)=>{if(C){let B=_(Z.request.headers);if(T.set(Z.sessionID,B),!B)return}return z(J2(Z),async(B)=>{let M=Z.request.headers.get(U2)??void 0,F=C?await O(J2(Z),"http.request",B,"http"):await k(J2(Z),"http.request","http",M,B);B();let y=f(F),h=F.attempt;if(!y||!h)throw u(F.scope);await b(F,async()=>{let w=Z.request;if(X.rewriteRequest){if(M!==void 0){let W2=new Headers(w.headers);W2.delete(U2),w=new Request(w,{headers:W2})}w=await X.rewriteRequest({...y,request:w,attempt:h})??w,B()}let g=new Headers(w.headers);g.delete(U2),A1(g,F.headers),N(F.scope,g.entries());let p=new Request(w,{headers:g});U.set(p,F),Z.request=p})})},t)),a.push(await $.session.hook("http.response",async(Z)=>{let B=U.get(Z.request);if(!B){if(C)return;if(!q)q=!0,i("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:Z.sessionID,kind:Z.kind});return}let M=Z.response;if(X.answeredBy&&B.attempt){let g=B.attempt,p=await b(B,async()=>X.answeredBy?.({request:Z.request,response:M,attempt:g}));if(p)Y2(B,p)}let F=f(B),y=B.attempt;if(!F||!y)return;B.status=M.status;let h=X.quotaFromHeaders?.(M.headers,M.status,y);if(h!==void 0)Z2(B,"http",h,M.status);if(!M.ok&&X.limitFromResponse){let g=await X.limitFromResponse({status:M.status,headers:M.headers,body:()=>M.clone().text(),attempt:y});if(g)l(B,g,"http")}if(!M.ok||!M.body)S(B);let w=M;if(M.body&&(X.inspectEvent||X.onAttemptEnd)){let g=M.body;if(X.inspectEvent)g=g.pipeThrough(m2((p)=>$2(B,"http",p.data,p.event),(p)=>i("opencode2 auth event inspection threw",{error:G(p)})));w=new Response(R1(g,(p)=>S(B,p)),{status:M.status,statusText:M.statusText,headers:M.headers})}if(X.rewriteResponse)w=await X.rewriteResponse({...F,request:Z.request,response:w,attempt:y})??w;if(w!==M)Z.response=w},t)),a.push(await $.session.hook("experimental.ws.handshake",(Z)=>{if(C){let B=_(new Headers(Z.headers)),M=K2(Z.sessionID,Z.kind);if(T.set(Z.sessionID,B),K.delete(M),!B)return}return z(J2(Z),async(B)=>{let M;for(let w of Object.keys(Z.headers)){if(w.toLowerCase()!==U2)continue;M??=Z.headers[w],delete Z.headers[w]}let F=C?await O(J2(Z),"experimental.ws.handshake",B,"ws"):await k(J2(Z),"experimental.ws.handshake","ws",M,B);B();let y=f(F),h=F.attempt;if(!y||!h)throw u(F.scope);await b(F,async()=>{l2(Z.headers,F.headers);let w=X.rewriteHandshakeURL?.({...y,url:Z.url,attempt:h});if(w!==void 0)Z.url=w;if(N(F.scope,Object.entries(Z.headers)),C)K.add(F.key)})})},t));let B2=X.rewriteWebSocketFrame?.bind(X);if(B2)a.push(await $.session.hook("experimental.ws.send",async(Z)=>{let B=J2(Z);if(C&&!K.has(K2(B.sessionID,B.kind)))return;let M=s(B.sessionID,B.kind),F=await B2({...B,attempt:M?.attempt,frame:Z.frame});if(F!==void 0)Z.frame=F},t));a.push(await $.session.hook("experimental.ws.receive",(Z)=>{if(C&&!K.has(K2(Z.sessionID,Z.kind)))return;let B=s(Z.sessionID,Z.kind);if(!B)return;try{$2(B,"ws",Z.frame)}catch(M){i("opencode2 auth frame inspection threw",{error:G(M)})}},t)),a.push(await $.session.hook("retry",async(Z)=>{if(C&&T.get(Z.sessionID)!==!0)return;let B=r(Z.sessionID);if(!B)return;let M=Z.decision;if(B==="ambiguous"){await j("retry",{sessionID:Z.sessionID,attempt:Z.attempt,reason:"host-decides",hostDecision:M,decision:M});return}let F=B;await z(F.scope,async(y)=>{F.judged=!0;let h=M,w,g,p=F.attempt;if(F.accountId===void 0||!p)h={retry:!1},w="no-account";else if(F.outputStarted)h={retry:!1},w="output-started";else{if(!F.limit){let W2=X.limitFromError?.(Z.error,p);if(W2)l(F,W2,"error")}if(F.ended)await F.ended,y();if(F.limit)await F.limit.delivered,y(),F.rerouted=!0,g={accountId:F.accountId,limit:F.limit.signal},h={retry:!0,delay:0},w="reroute";else w="host-decides"}if(Z.decision=h,h.retry&&F.accountId!==void 0)Q.set(F.key,{sessionID:F.scope.sessionID,accountId:F.accountId,...g===void 0?{}:{rerouteFrom:g}});await j("retry",{sessionID:Z.sessionID,...F.accountId===void 0?{}:{accountId:F.accountId},kind:F.scope.kind,attempt:Z.attempt,reason:w,hostDecision:M,decision:h,...p===void 0?{}:{handle:p}})})},t));let C2=(Z)=>{W(Z),T.delete(Z);for(let B of K)if(JSON.parse(B)[0]===Z)K.delete(B);for(let B of[...Y.values()]){if(B.scope.sessionID!==Z)continue;R(B,"its session was forgotten"),Y.delete(B.id)}for(let[B,M]of Q)if(M.sessionID===Z)Q.delete(B)},G2=new AbortController,e2=$.event;if(e2)(async()=>{try{for await(let Z of e2.subscribe({signal:G2.signal}))if(Z.type==="session.deleted")C2(Z.data.sessionID)}catch(Z){if(!G2.signal.aborted)i("opencode2 auth stopped listening for session deletion",{error:G(Z)})}})();return{on(Z,B){let M=m.get(Z);if(!M)M=new Set,m.set(Z,M);let F=B;return M.add(F),()=>{M.delete(F)}},accountFor(Z,B){return v(K2(Z,B))?.accountId},forgetSession:C2,get size(){return Y.size},async dispose(){if(d)return;d=!0;for(let Z of n.keys())W(Z);G2.abort();for(let Z of Y.values())R(Z,"the installation was disposed");Y.clear(),Q.clear(),K.clear(),T.clear(),m.clear(),await Promise.all(a.map(async(Z)=>{try{await Z.dispose()}catch(B){i("opencode2 auth hook did not dispose cleanly",{error:G(B)})}}))}}}import{createHash as q1}from"node:crypto";var T2="anthropic",F$="x-common-auth-attempt",k1=["x-session-affinity","x-opencode-session","x-parent-session-id",H$,k2,O2,F$],q2=new Set(["authorization","x-api-key"]),D1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",w1=512,b1=5000,y1=500,W$=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class T$ extends Error{sessionID;requestKind;kind="no-account";providerID=T2;constructor($,X){super(D1);this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicNoAccountError"}}class i2 extends Error{sessionID;requestKind;kind="session-forgotten";providerID=T2;constructor($,X){super("request refused: its session was closed while it was being prepared");this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicRevokedError"}}class L2 extends Error{kind="unsupported-transport";providerID=T2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class O$ extends Error{kind="local-invalid-request";status=400;check;constructor($){super($.message,{cause:$});this.name="NativeAnthropicLocalRefusal",this.check=$.check}}var z2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($);function F2($){try{return JSON.parse($)}catch{return}}function u2($){let X={};for(let[L,V]of Object.entries($??{}))X[L.toLowerCase()]=V;return X}function J$($){let X={};for(let L of k1){let V=$.get(L);if(V!==null&&L!==F$)X[L]=V;$.delete(L)}return X}function I1($){try{return new URL($).pathname.endsWith("/messages")}catch{return!1}}function f1($){return $ instanceof K$||$ instanceof U$?new O$($):void 0}function g1($,X){let L=[];if($.oauth)L.push($.oauth.accessToken);for(let[V,C]of Object.entries($.apiHeaders??{})){if(C===null||!q2.has(V))continue;L.push(C.replace(/^Bearer\s+/i,""))}for(let V of q2){let C=X.get(V);if(C!==null)L.push(C.replace(/^Bearer\s+/i,""))}if($.dispatch?.kind==="http-relay")L.push($.dispatch.token);return[...new Set(L.filter(Boolean))]}var v1=new Set(["oauth-2025-04-20","claude-code-20250219",L$]);function h1($){let X=$.split(",").map((L)=>L.trim()).filter((L)=>L&&!v1.has(L));return V$(null,X)}function m1($){let X=F2($);if(!z2(X))return $;let L=z$(X.messages),V=Object.hasOwn(X,"fallbacks"),{droppedMarkers:C}=M$(X,!1),_=V&&!Object.hasOwn(X,"fallbacks"),P=Q$(X);return L>0||C>0||_||P?JSON.stringify(X):$}async function l1($,X){if(!($ instanceof Promise))return"settled";let L;try{return await Promise.race([$.then(()=>"settled"),new Promise((V)=>{L=setTimeout(()=>V("timed-out"),X)})])}finally{if(L!==void 0)clearTimeout(L)}}function M2($){let{source:X,log:L}=$,V=Math.max(1,$.maxPendingSends??w1),C=$.attemptEndTimeoutMs??b1,_=new Map,P=new WeakMap,E=new WeakMap,H=new WeakMap,Y=new Map,U=new WeakMap,Q=p2([]);Q.dispose();let K=(W)=>(W&&Y.get(W)?.redactor)??Q,T=(W)=>{let z=Y.get(W);if(!z)return;Y.delete(W),z.redactor.dispose(),z.scope.dispose()},q=(W,z,N,D)=>{let O=g1(z,D),k=c2(O,N);A.set(W,N),Y.set(W,{sessionID:z.sessionID,redactor:p2(O),scope:k}),k.settled.then(()=>T(W));while(Y.size>V){let b=Y.keys().next().value;if(b===void 0)break;T(b)}},A=new WeakMap,m=(W,z)=>{let N=W?A.get(W):void 0;if(!N||!z.ok)return Q.redactResponse(z);let D=c2([],N),O=D.redactResponse(z);return D.dispose(),O},I=(W,z)=>{let N=W?Y.get(W)?.scope:void 0;if(!N)return m(W,z);try{return N.redactResponse(z)}catch{return m(W,z)}},d=!1,n=new WeakMap,i=(W,z)=>{if(W&&!z.ok)n.set(z.headers,W);return z},G=(W,z)=>{if(z.dispatch!=="http-relay")return!0;let N=/^req_[A-Za-z0-9_-]+$/.test(W.get("request-id")??"");return E.set(z,N),N},j=(W)=>new T$(W.sessionID,W.kind),J=new Map,S=async(W,z)=>{if(d)throw new i2(W.sessionID,W.kind);let N={revoked:!1},D=J.get(W.sessionID);if(!D)D=new Set,J.set(W.sessionID,D);D.add(N);let O=()=>{if(d||N.revoked)throw new i2(W.sessionID,W.kind)};try{let k=await z(O);return O(),k}finally{let k=J.get(W.sessionID);if(k?.delete(N)&&k.size===0)J.delete(W.sessionID)}},R=(W,z)=>{_.set(W,z);while(_.size>V){let N=_.keys().next().value;if(N===void 0)break;_.delete(N),L?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:V})}},x=(W,z)=>({providerID:W.providerID,modelID:W.modelID,sessionID:W.sessionID,agent:W.agent,kind:W.kind,accountId:W.accountId,attemptId:W.attemptId,transport:W.transport,route:z.route,provenance:z.provenance,dispatch:z.dispatch}),v=(W)=>S(W,async(z)=>{let{accountId:N,...D}=W,O=await X.authorizeAccount(D,N);return z(),c(D,O)}),c=(W,z)=>{if(!z)throw j(W);if(z.dispatch?.kind==="websocket-relay")throw new L2;let N=z.dispatch?.kind==="http-relay"?"http-relay":"direct",D=z.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":z.dispatch.token}:void 0;if(z.route==="oauth"){if(!z.accessToken)throw j(W);j$(z.accessToken,T2);let b=Object.freeze({route:"oauth",provenance:z.provenance,dispatch:N});R(b,{sessionID:W.sessionID,oauth:{accessToken:z.accessToken,...z.identity?{identity:z.identity}:{}},dispatch:z.dispatch,oauthHeaders:z.headers});let s=u2(z.headers);for(let l of q2)delete s[l];return delete s["anthropic-beta"],{headers:D??{...s,"x-api-key":null,authorization:`Bearer ${z.accessToken}`},attempt:b}}let O={authorization:null,"x-api-key":null,...u2(z.headers)};if(!O.authorization&&!O["x-api-key"])throw j(W);let k=Object.freeze({route:"api",provenance:z.provenance,dispatch:N});return R(k,{sessionID:W.sessionID,...z.baseURL?{baseURL:z.baseURL}:{},dispatch:z.dispatch,apiHeaders:O}),{headers:D??O,attempt:k}},o=(W)=>S(W,(z)=>f(W,z)),f=async(W,z)=>{let{request:N,attempt:D}=W,O=D.data,k=O?_.get(O):void 0;if(O)_.delete(O);if(!O||!k||O.route==="oauth"&&!k.oauth)throw j(W);let b=new Headers(N.headers);B$(b);let s=J$(b),l=N.body===null?void 0:await N.text();z();let Z2=l!==void 0&&I1(N.url);try{if(O.route==="oauth"&&k.oauth){let{accessToken:e,identity:r}=k.oauth;for(let[a,B2]of Object.entries(u2(k.oauthHeaders))){if(q2.has(a))continue;if(B2===null)b.delete(a);else b.set(a,B2)}let t=null;if(l!==void 0&&Z2){let a={...x(D,O),modelID:(()=>{let G2=F2(l);return j2(z2(G2)&&typeof G2.model==="string"?G2.model:W.modelID)})(),route:"oauth",correlation:s},B2=await X.requestOptions?.(a)??{};z(),l=await N$(l,{...B2,...r?{identity:r}:{},sessionId:W.sessionID,onToolNameMap:(G2)=>H.set(O,G2)});let C2=F2(l);t=z2(C2)?C2:null}_$(b,e,{body:t,...r?{identity:r}:{}})}else{if(l!==void 0&&Z2)l=m1(l);b.delete("authorization"),b.delete("x-api-key");for(let[r,t]of Object.entries(k.apiHeaders??{}))if(t===null)b.delete(r);else b.set(r,t);if(l!==void 0&&Z2&&!b.has("content-type"))b.set("content-type","application/json");let e=b.get("anthropic-beta");if(e!==null){let r=h1(e);if(r)b.set("anthropic-beta",r);else b.delete("anthropic-beta")}}}catch(e){let r=f1(e);if(!r)throw e;throw P.set(O,r.check),L?.warn("refused an Anthropic request locally; nothing was sent",{check:r.check}),r}let $2=l!==void 0?F2(l):void 0;if(await X.admitRequest?.({...x(D,O),modelID:j2(z2($2)&&typeof $2.model==="string"?$2.model:W.modelID)}),J$(b),l!==void 0)b.delete("content-length");z(),q(O,k,z2($2)&&$2.stream===!0?"event-stream":"http",b);let Y2=C$(N.url,k.baseURL!==void 0?{baseURL:k.baseURL}:{}).url?.toString()??N.url;if(O.route==="oauth"&&Z2&&l!==void 0)await X.onRequestPrepared?.({...x(D,O),url:Y2,bodyText:l}),z();if(k.dispatch?.kind==="http-relay"){let e=l??"";b.delete("x-relay-token");let r={protocol:1,type:"request",affinity:W.sessionID,upstream:{url:Y2,method:N.method,headers:Object.fromEntries(b)},mode:"full_sync",revision:1,body:e,next_hash:`sha256:${q1("sha256").update(e).digest("hex")}`};return new Request(k.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":k.dispatch.token},redirect:"error",signal:N.signal,body:JSON.stringify(r)})}return new Request(Y2,{method:N.method,headers:b,redirect:N.redirect,signal:N.signal,...l!==void 0?{body:l}:{}})};return{adapter:{providerID:T2,chooseAccount:(W)=>S(W,async()=>{let z=await X.chooseAccount(W);if(!z)throw j(W);return z}),accountHeaders:v,rewriteRequest:o,rewriteHandshakeURL(){throw new L2},rewriteResponse({response:W,attempt:z}){let N=z.data;if(N&&!G(W.headers,N)){if(W.status===401)return T(N),W.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return I(N,W)}let D=I(N,W);if(N?.route!=="oauth"||!D.body)return i(N,D);let O={...x(z,N),status:W.status},k=X.responseOptions?.(O)??{},b=(W.headers.get("content-type")??"").includes("application/json");return i(N,P$(D,{...k,toolNameMap:H.get(N),onToolNameRefusal:()=>{P.set(N,"response_tool_names"),T(N)},laneStartOAuthServed:!0,...b?{responseMode:"json"}:{}}))},quotaFromHeaders(W,z,N){let D=N.data;if(!D||!G(W,D))return;return X.quotaFromHeaders?.(W,{...x(N,D),status:z})},async limitFromResponse({status:W,headers:z,body:N,attempt:D}){let O=D.data;if(!O||P.get(O)==="response_tool_names")return;if(!G(z,O))return X.limitFromRelayFailure?.({...x(D,O),status:W});if(U.set(O,`provider responded with HTTP ${W}`),!X.limitFromResponse)return;let k=n.get(z)===O,b=K(O);return X.limitFromResponse({...x(D,O),status:W,headers:z,body:async()=>k?await N():b.redactText(await N())})},inspectEvent({data:W,event:z,attempt:N}){if(N.data&&P.get(N.data)==="response_tool_names")return;let D=F2(W);if(!z2(D))return;let O=typeof D.type==="string"?D.type:z;if(O==="content_block_start"||O==="content_block_delta")return{outputStarted:!0};if(O==="message_stop")return{done:!0};if(O!=="error")return;let k=N.data,b=K(k),s=z2(D.error)?D.error:{},l=typeof s.type!=="string"?void 0:W$.has(s.type)?s.type:b.redactText(s.type),Z2=typeof s.message==="string"?b.redactText(s.message):void 0;if(k?.dispatch==="http-relay"&&E.get(k)===!1)return;let $2=k?X.limitFromStreamError?.({...x(N,k),errorType:l,message:Z2}):void 0,Y2={error:[l??"error",Z2].filter(Boolean).join(": ").slice(0,y1),...$2?{limit:$2}:{}};if(k&&Y2.error)U.set(k,Y2.error);return Y2},limitFromError(W,z){let N=z.data;if(!N||P.has(N))return;let D={type:W$.has(W.type)?W.type:"provider_error",message:U.get(N)??"provider request failed",...W.status!==void 0?{status:W.status}:{}};if(T(N),N.dispatch==="http-relay"&&E.get(N)===!1)return;return X.limitFromHostError?.(D,x(z,N))},async onAttemptEnd(W,z){let N=W.data;if(!N)return;_.delete(N);let D=z.error?.reason;if(D==="cancelled"||D==="abandoned"||D===void 0&&(z.status===void 0||z.status<400))T(N);let O=P.get(N),{status:k,...b}=z,s=X.onAttemptEnd?.(x(W,N),{...b,...k!==void 0&&(N.dispatch!=="http-relay"||E.get(N)===!0)?{status:k}:{},...O!==void 0?{localRefusal:{check:O}}:{}});if(await l1(s,C)==="timed-out")L?.warn("the account source did not finish recording a send",{timeoutMs:C})}},dispose(){d=!0;for(let[W,z]of J){for(let N of z)N.revoked=!0;X.forgetSession?.(W)}J.clear(),_.clear();for(let W of[...Y.keys()])T(W)},forgetSession(W){for(let z of J.get(W)??[])z.revoked=!0;J.delete(W);for(let[z,N]of _)if(N.sessionID===W)_.delete(z);for(let[z,N]of[...Y])if(N.sessionID===W)T(z);X.forgetSession?.(W)},get pendingSendCount(){return _.size},get heldCredentialCount(){let W=0;for(let z of _.values())if(z.oauth)W++;return W},get heldRedactorCount(){return Y.size},get operationsInProgress(){let W=0;for(let z of J.values())W+=z.size;return W}}}function E2($){return JSON.stringify([$.source,$.accountIdentity,$.credentialId,$.binding?.storageId,$.binding?.rowId,$.binding?.credentialEpoch])}function R$($){let{runtime:X,source:L}=$,V=new AbortController,C=!1,_=new x$({directory:$.registryDirectory||process.env.OPENCODE_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR||S$("opencode"),now:$.now}),P=new Map,E=async(Q,K,T)=>{let q=T?AbortSignal.any([V.signal,T]):V.signal;q.throwIfAborted();let A=JSON.parse(await K.text()),m={providerID:"anthropic",modelID:A.model,sessionID:`oc2-cachekeep:${Q.id}`,agent:"cachekeep",kind:"generate"},I=M2({source:{...L,onRequestPrepared:void 0,responseOptions:void 0,async requestOptions(j){return{...await L.requestOptions?.(j),laneStart:!1,billingLineage:void 0,cacheDiagnosticsPreviousMessageId:void 0}},async authorizeAccount(j,J){let S=await X.read();q.throwIfAborted();let R=S.accounts.find((v)=>v.id===J);if(R?.type!=="oauth"||E2(R)!==Q.oauthAccountIdentity||Q.isSubagent&&!D2(S.policyStorage)||!_2(S.policyStorage)||!o2(S.policyStorage,new Date($.now?.()??Date.now())))return;let x=await L.authorizeAccount(j,J);if(x?.provenance.kind==="local"&&E2({...R,binding:x.provenance.subject.binding,accountIdentity:x.provenance.subject.binding.identity})!==Q.oauthAccountIdentity)return;if(x?.provenance.kind==="vault"&&x.provenance.credentialId!==R.credentialId)return;return x},async admitRequest(j){await L.admitRequest?.(j);let J=await X.read(),S=J.accounts.find((R)=>R.id===j.accountId);if(q.throwIfAborted(),!S||E2(S)!==Q.oauthAccountIdentity||Q.isSubagent&&!D2(J.policyStorage)||!_2(J.policyStorage)||!o2(J.policyStorage,new Date($.now?.()??Date.now())))throw Error("CacheKeep policy changed before dispatch")}}}),d,n,i=!1,G=()=>I.forgetSession(m.sessionID);q.addEventListener("abort",G,{once:!0});try{let j=(await X.read()).accounts.find((c)=>E2(c)===Q.oauthAccountIdentity)?.id;if(!j)throw Error("CacheKeep account is unavailable");let J=await I.adapter.accountHeaders({...m,accountId:j});if(!("headers"in J)||typeof J.headers!=="object"||J.headers===null||typeof J.attempt!=="object"||J.attempt===null||J.attempt.route!=="oauth")throw Error("CacheKeep authorization refused");d={...m,accountId:j,attemptId:crypto.randomUUID(),transport:"http",data:J.attempt};let S=await I.adapter.rewriteRequest?.({...m,accountId:j,attempt:d,request:new Request(Q.url,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(A),signal:q})});if(!S)throw Error("CacheKeep rewrite refused");q.throwIfAborted();let R=await($.fetch??fetch)(S),x=await I.adapter.rewriteResponse?.({...m,accountId:j,attempt:d,request:S,response:R});if(!x)throw Error("CacheKeep response rewrite refused");if(n=x.status,I.adapter.quotaFromHeaders?.(x.headers,x.status,d),!x.ok)await I.adapter.limitFromResponse?.({status:n,headers:x.headers,body:()=>x.clone().text(),attempt:d});let v=await x.arrayBuffer();return i=!0,new Response(v,{status:n,headers:x.headers})}catch{throw Error("Native CacheKeep was not completed")}finally{q.removeEventListener("abort",G);try{if(d)await I.adapter.onAttemptEnd?.(d,{status:n,outputStarted:!1,...i?{}:{error:{reason:"cancelled"}}})}finally{I.dispose(),L.forgetSession?.(m.sessionID)}}},H=$.setIntervalImpl??globalThis.setInterval,Y=new E$({loadStorage:async()=>C?null:(await X.read()).policyStorage,now:$.now,setIntervalImpl:(Q,K)=>H(()=>Y.tick().catch(()=>{H2.warn("cachekeep","tick failed")}),K),clearIntervalImpl:$.clearIntervalImpl,onTrackedSessionsChanged:(Q)=>_.publish(C?[]:Q),prepareHeaders(Q,K,T){if(C)return;return P.set(T.id,{target:K,attempt:T}),new Headers({"x-native-cachekeep-attempt":String(T.id)})},fetchImpl:async(Q,K)=>{let T=new Request(Q,K),q=Number(T.headers.get("x-native-cachekeep-attempt")),A=P.get(q);if(P.delete(q),!A)throw Error("CacheKeep attempt is unavailable");return E(A.target,T,A.attempt.signal)},onComplete:({attempt:Q})=>{P.delete(Q.id)}}),U;return{async track(Q){if(C||Q.route!=="oauth"||Q.agent==="cachekeep"||Q.agent==="prime"||Q.kind!=="primary")return;let K=await X.read();if(C||!_2(K.policyStorage))return;let T=!1;try{T=await $.isSubagent?.(Q.sessionID)??!1}catch{return}if(C||T&&!D2(K.policyStorage))return;let q=K.accounts.find((A)=>A.id===Q.accountId);if(!q?.accountIdentity)return;if(Q.provenance.kind==="local"&&JSON.stringify(q.binding)!==JSON.stringify(Q.provenance.subject.binding))return;if(Q.provenance.kind==="vault"&&q.credentialId!==Q.provenance.credentialId)return;Y.track({sessionId:Q.sessionID,url:Q.url,headers:new Headers,bodyText:Q.bodyText,storage:K.policyStorage,cacheMode:"hybrid",oauthAccountId:Q.accountId,oauthAccountIdentity:E2(q),isSubagent:T}),await _.publish(Y.trackedSessions())},registry:_,dispose(){if(U)return U;return C=!0,Y.stop(),V.abort(),U=(async()=>{try{await Y.tick()}finally{P.clear(),await _.dispose()}})(),U}}}async function A$($,X,L){let V=M2(X),C=[],_=async(K,T,q)=>{let A=await $.session.hook(K,T,q);return C.push(A),A},P=new AbortController,E;try{E=await d2({session:{hook:_},event:$.event},V.adapter,{logger:X.log,gateOnPlaceholder:L})}catch(K){throw V.dispose(),await Promise.allSettled(C.map((T)=>T.dispose())),K}let H=(K)=>{V.forgetSession(K),E.forgetSession(K)},Y=$.event,U=Y?(async()=>{try{for await(let K of Y.subscribe({signal:P.signal}))if(K.type==="session.deleted")H(K.data.sessionID)}catch(K){if(!P.signal.aborted)X.log?.warn("stopped listening for session deletion",{error:K instanceof Error?K.name:"unknown"})}})():Promise.resolve(),Q;return{installation:E,forgetSession:H,dispose(){if(Q)return Q;return V.dispose(),P.abort(),Q=(async()=>{await E.dispose(),await U})(),Q}}}function k$($,X){let L=new AbortController,V,C=!1,_=async()=>{let H=await $.read();if(L.signal.throwIfAborted(),H.policyStorage.relay?.enabled===!0&&V2(H.policyStorage.relay.transport,H.policyStorage.relay.url)==="websocket")return;let Y=H,U=b2(Y.policyStorage);for(let Q of Y.accounts){if(L.signal.aborted)return;if(!X2(Q)||Q.type!=="oauth")continue;if(Y.policyStorage.quota?.enabled!==!1&&Date.now()-w2(Q.quota)>=U)await $.fetchQuota(Q.id,X,L.signal).catch(()=>{});if(!q$(Q.profile)&&!L.signal.aborted)await $.fetchProfile(Q.id,X,L.signal).catch(()=>{})}},P=()=>{if(C||V)return V;return V=_().catch(()=>{if(!L.signal.aborted)H2.debug("opencode2","native background readings did not complete")}).finally(()=>{V=void 0}),V},E=$.vault.watch({intervalMs:60000,onRefresh:P,shouldRefresh:async()=>{let H=await $.read();return H.policyStorage.relay?.enabled!==!0||V2(H.policyStorage.relay.transport,H.policyStorage.relay.url)==="http"}});return E.ready.catch(()=>{}),{async dispose(){C=!0,E.close(),L.abort(),await V}}}var n2=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{};function u$($){let{runtime:X,source:L}=$,V=new Map,C=!1,_=async(Y,U)=>{await X.updateSettings((Q)=>({...Q,[Y]:{...n2(Q[Y]),...U}}))},P=()=>({ok:!0,text:"Native Claude settings updated."}),E=async(Y,U)=>{if(C)throw Error("Native menu is closed");switch(U.signal?.throwIfAborted(),Y.action){case"enable":case"disable":return await X.setEnabled(Y.values.id,Y.action==="enable"),P();case"remove":return await X.remove(Y.values.id),P();case"move-up":case"move-down":{let K=(await X.read()).accounts.map((I)=>I.id),T=K.indexOf(Y.values.id),q=T+(Y.action==="move-up"?-1:1);if(T<0||q<0||q>=K.length)return{ok:!1,text:"Account cannot move in that direction."};let A=K[T],m=K[q];if(A===void 0||m===void 0)return{ok:!1,text:"Account order changed."};return K[T]=m,K[q]=A,await X.reorder(K),P()}case"add-apikey":return await X.addApi(Y.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let Q=new AbortController;V.get(Y.sessionId)?.active.abort();let K={active:Q,auth:void 0};V.set(Y.sessionId,K);let T=await y2("max");if(C||Q.signal.aborted||U.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return K.auth=T,{ok:!0,text:`Open ${T.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let Q=V.get(Y.sessionId);if(!Q?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let K=await I2(Y.values.code,Q.auth.verifier,Q.auth.redirectUri,Q.auth.state);if(Q.active.signal.throwIfAborted(),U.signal?.throwIfAborted(),C||K.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await X.loginOAuth({routeId:crypto.randomUUID(),credential:K,label:Y.values.label}),Q.active.signal.throwIfAborted(),U.signal?.throwIfAborted(),C)return{ok:!1,text:"Sign-in cancelled."};return V.delete(Y.sessionId),{ok:!0,text:"OAuth account stored in the native account pool."}}case"reset-backoff":{let Q=await X.read();for(let K of Q.accounts){if(U.signal?.throwIfAborted(),K.type!=="oauth")continue;let T=K.source==="vault"?await X.authorizeVault(K.id,U.signal):await X.captureLocalSubject(K.id);await X.resetBackoff(K.id,T)}return P()}case"enrollment-reset":{let Q=await g$(f$("opencode"),I$);return{ok:Q==="reset",text:Q==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let K=(await X.read()).accounts.filter((A)=>A.type==="oauth"&&X2(A)),T=await Promise.allSettled(K.map((A)=>X.fetchQuota(A.id,void 0,U.signal)));return{ok:T.every((A)=>A.status==="fulfilled"),text:`${T.filter((A)=>A.status==="fulfilled").length}/${K.length} native quota readings refreshed.`}}case"routing-reset":return await L.resetRouting(Y.sessionId),P();case"routing-mode":return await _("routing",{mode:Y.values.mode}),P();case"killswitch-on":case"killswitch-off":return await _("killswitch",{enabled:Y.action==="killswitch-on"}),P();case"killswitch-set":return await X.updateSettings((Q)=>{let K=n2(Q.killswitch),T={...n2(K.accounts)},q=K.main;for(let A of Y.values.entries){let m={five_hour:A.fh,seven_day:A.sd,...A.scoped!==void 0?{scoped:A.scoped}:{}};if(A.account==="main"||A.account==="all")q=m;if(A.account==="all")for(let I of Object.keys(T))T[I]=m;else if(A.account!=="main")T[A.account]=m}return{...Q,killswitch:{...K,main:q,accounts:T}}}),P();case"cache-on":case"cache-off":return await _("claudeCache",{enabled:Y.action==="cache-on"}),P();case"cache-mode":return await _("claudeCache",{mode:Y.values.mode}),P();case"cachekeep-always":return await _("cacheKeep",{enabled:!0,always:!0}),P();case"cachekeep-off":return await _("cacheKeep",{enabled:!1}),P();case"cachekeep-window":return await _("cacheKeep",{enabled:!0,always:!1,startHour:Y.values.startHour,endHour:Y.values.endHour}),P();case"cachekeep-subagents":return await _("cacheKeep",{subagents:Y.values.enabled==="on"}),P();case"dump-on":case"dump-off":return await _("dump",{enabled:Y.action==="dump-on"}),P();case"logging-level":return await _("logging",{level:Y.values.level}),P();case"fast-on":case"fast-off":return await _("claudeFast",{enabled:Y.action==="fast-on"}),P();case"prime-on":case"prime-off":return await _("prime",{enabled:Y.action==="prime-on"}),P();case"start-fire":return await H(Y.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},H=(Y)=>$.start(Y,f2);return{dispatch:E,async readStatus(Y){let U=await X.read();if(Y==="account")return U.accounts.map((K)=>`${K.id}${K.label?` (${K.label})`:""}: ${K.type}, ${K.source}, ${K.enabled?"enabled":"disabled"}${K.state?`, ${h$(K)}`:""}${K.accountIdentity?`, ${K.accountIdentity}`:""}`).join(`
+`)||"No native Claude accounts.";if(Y==="quota")return d$({accounts:U.accounts.filter((K)=>K.type==="oauth").map((K)=>({name:K.label??K.id,role:K.id==="main"?"main":"fallback",enabled:K.enabled,quota:K.quota,tierLabel:v$(K.profile),lastRefreshedAt:K.lastRefreshedAt,error:K.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(Y==="prime")return l$({enabled:U.policyStorage.prime?.enabled===!0,accounts:m$(U.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");if(Y==="cachekeep"){let K=await $.cacheKeepRegistry?.list()??[];return y$({enabled:b$(U.policyStorage),always:w$(U.policyStorage),hybridActive:_2(U.policyStorage),trackedSessionDetails:K,window:D$(U.policyStorage),trackedSessions:K.length,nextPrewarmAt:K.length?Math.min(...K.map((T)=>T.nextPrewarmAt)):void 0})}let Q={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(U.settings[Q[Y]]??{})},forgetSession(Y){V.get(Y)?.active.abort(),V.delete(Y)},close(){C=!0;for(let Y of V.values())Y.active.abort();V.clear()}}}function n$(){let $=new Map;return{install:(L)=>L.model.transform((V)=>{$.clear();for(let C of V.list("anthropic")){if($.set(String(C.id),String(C.modelID)),!(p$(C.modelID)||o$(C.modelID)||c$(C.modelID)||i$(C.modelID)))continue;V.update("anthropic",String(C.id),(_)=>{let P=["low","medium","high","xhigh","max"],E=_.variants.filter((H)=>!P.some((Y)=>Y===String(H.id)));_.variants=[...E,...P.map((H)=>({id:H,settings:{effort:H,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(L)=>$.get(L)??L}}function r$($){return $.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??$.get("x-api-key")??void 0}var s$=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{};function t$($){let{runtime:X,source:L}=$,V=new AbortController,C=new Set,_=(H)=>({providerID:"anthropic",modelID:r2().model,sessionID:`oc2-prime:${H}`,agent:"prime",kind:"generate"}),P=async(H)=>{let Y=_(H),U=M2({source:L}),Q=performance.now();try{for(let K=0;K<3;K++){if(V.signal.throwIfAborted(),(await X.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let q=await U.adapter.accountHeaders({...Y,accountId:H});if(!("headers"in q)||typeof q.headers!=="object"||q.headers===null||typeof q.attempt!=="object"||q.attempt===null)throw Error("Native Prime authorization refused");let A={...Y,accountId:H,attemptId:crypto.randomUUID(),transport:"http",data:q.attempt},m,I=!1,d=!1,n=(i)=>{d=!0,i.body?.cancel().catch(()=>{})};try{let i=await U.adapter.rewriteRequest?.({...Y,accountId:H,attempt:A,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r2()),signal:V.signal})});if(!i)throw Error("Native Prime rewrite refused");let G=new Headers(i.headers);for(let[o,f]of Object.entries(q.headers))if(f===null)G.delete(o);else G.set(o,f);let j=new Request(i,{headers:G}),J=await($.fetch??fetch)(j),S=await U.adapter.rewriteResponse?.({...Y,accountId:H,request:j,response:J,attempt:A})??J;m=S.status,U.adapter.quotaFromHeaders?.(S.headers,S.status,A);let R=S.ok?void 0:await U.adapter.limitFromResponse?.({status:S.status,headers:S.headers,body:()=>S.clone().text(),attempt:A});if(R&&/^(vault-newer|local-newer|relay-direct):/.test(R.reason)&&K<2){if(n(S),await L.chooseAccount({...Y,rerouteFrom:{accountId:H,limit:R}})!==H)throw Error("Native Prime retry changed account");continue}if(!S.ok)return n(S),{ok:!1,status:m,ms:performance.now()-Q,error:"Native Prime upstream refused the request"};let x=s$(await S.json()),v=s$(x.usage),c={inputTokens:typeof v.input_tokens==="number"?v.input_tokens:void 0,outputTokens:typeof v.output_tokens==="number"?v.output_tokens:void 0};if(A.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(S.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(I=await L.recordPrime(q.attempt.provenance,c),!I)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:m,ms:performance.now()-Q,usage:c}}finally{await U.adapter.onAttemptEnd?.(A,{status:m,outputStarted:!1,...I?{}:{error:{reason:d?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-Q}}finally{U.dispose()}},E=new a$({storagePath:$.paths.legacyConfig,loadStorage:async()=>(await X.read()).policyStorage,async getAccountFingerprint(H){let Y=await X.read(),U=Y.accounts.find((K)=>K.id===H);if(!X2(U)||U?.type!=="oauth")return;if(Y.policyStorage.relay?.enabled===!0&&V2(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")return;if(U.source==="vault"){let K=await X.authorizeVault(H,V.signal);return X.getOrCreateAuthLineage(H,K)}let Q=await X.authorizeLocal(H,{signal:V.signal});return Q.status==="usable"?X.getOrCreateAuthLineage(H,Q.subject):void 0},async refreshQuota(H){let Y=await X.read();if(Y.policyStorage.relay?.enabled===!0&&V2(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await X.fetchQuota(H,$.fetch,V.signal),fresh:!0}},sendPrime(H){let Y=P(H);return C.add(Y),Y.finally(()=>C.delete(Y)),Y},async recordSuccess(H){let Y=(await X.read()).accounts.find((U)=>U.id===H);if(!Y?.prime)throw Error("Native Prime counters are unavailable");return Y.prime}});return E.start(),{manager:E,async dispose(){E.stop(),V.abort(),await Promise.allSettled(C)}}}var s2=($)=>["five_hour","seven_day"].some((X)=>($?.[X]?.remainingPercent??1)<=0);function Q1($){let{runtime:X}=$,L=X1("native-auth"),V=new Map,C=(G)=>{let j=G.routingPath;if(!j)throw Error("Native routing storage is unavailable");let J=V.get(j);if(!J)J=new G1({path:j,vaultSeed:G.routingSeed,localRecoveryPath:G.mode==="local"?G.routingRecoveryPath:void 0}),V.set(j,J);return J.setVaultSeed(G.routingSeed),J},_=new WeakMap,P=new Map,E=new Map,H=new Map,Y=new WeakSet,U=!1,Q=()=>{while(P.size>512){let G=P.keys().next();if(!G.done)P.delete(G.value)}},K=(G,j)=>JSON.stringify([G.sessionID,G.kind,G.modelID,j]),T=(G)=>{if(U)throw Error("Native Anthropic source is closed");let j=H.get(G.sessionID);if(!j){j=new AbortController,H.set(G.sessionID,j);while(H.size>512){let J=H.keys().next();if(!J.done)n.forgetSession?.(J.value)}}return j},q=(G,j,J)=>X2(G)&&(G.type==="api"||R2(G,j,j2(J)).status==="allowed"),A=async(G,j,J,S)=>{let R=await X.read();S.signal.throwIfAborted(),m(R);let x=R.accounts.find((v)=>v.id===G);if(!x||x.type!==J||!q(x,R,j))return!1;if(J==="api"){let v=R.accounts.find((c)=>c.id==="main"&&c.type==="oauth");return!!v&&x2(v.quota,R.policyStorage)&&s2(v.quota)}return!0},m=(G)=>{let j=G.policyStorage.relay;if(j?.enabled===!0&&V2(j.transport,j.url)==="websocket")throw new L2},I=async(G,j)=>{if(m(G),j||G.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let J=await X.getRelayConfig();if(!J)throw Error("request refused: native HTTP relay configuration is unavailable");if(J.transport!=="http")throw new L2;return{dispatch:{kind:"http-relay",url:J.url,token:J.token},relayFallback:J.fallbackToDirect}};async function d(G,j,J){if(G.kind==="local")await X.publishLocal(G.subject,J);else if(G.kind==="vault"&&j.receipt)await X.vault.publish(j.receipt,J);else if(G.kind==="api"&&J.lastUsed!==void 0)await X.publishApi(G.subject,{lastUsed:J.lastUsed})}let n={async chooseAccount(G){let j=T(G);$.onOwnedRequest?.();let J=await X.read();j.signal.throwIfAborted(),m(J);let S=j2(await $.resolveModelId?.(G)??G.modelID);if(j.signal.throwIfAborted(),J.mode==="claustrum")J=await J1(X,j.signal),j.signal.throwIfAborted();if(J.policyStorage.quota?.enabled!==!1){let f=!1;for(let u of J.accounts){if(!X2(u)||u.type!=="oauth")continue;if(Z1(u.quota)?x2(u.quota,J.policyStorage,Date.now(),S):Date.now()-w2(u.quota)<b2(J.policyStorage))continue;try{await X.fetchQuota(u.id,$.fetch,j.signal),f=!0}catch{j.signal.throwIfAborted()}}if(f)J=await X.read();j.signal.throwIfAborted()}let R=G.rerouteFrom?P.get(G.rerouteFrom.limit.reason):void 0;if(G.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(G.rerouteFrom.limit.reason)&&!R)return;if(R&&G.rerouteFrom){P.delete(G.rerouteFrom.limit.reason);let f=J.accounts.find((z)=>z.id===R.accountId);if(!f||!q(f,J,S))return;let u=K(G,R.accountId),W=E.get(u)??[];return W.push(R),E.set(u,W),R.accountId}let x=[];for(let f of J.accounts){if(f.type!=="oauth"||!q(f,J,S))continue;if(f.source==="local"){let u=await X.authorizeLocal(f.id,{signal:j.signal,policy:(W,z)=>R2(W,z,S)});if(j.signal.throwIfAborted(),u.status!=="usable")continue}x.push(f)}let v=x.filter((f)=>f.id!==G.rerouteFrom?.accountId);if(a2(J.policyStorage)==="sticky-balanced"){let f=v.map((W,z)=>({accountId:W.id,order:z,quota:W.quota??{kind:"unknown"}})),u=await C(J).resolve({sessionId:G.sessionID,family:Y1(S),modelId:S,affinityModelId:G.modelID,candidates:f,retainAccountIds:new Set(v.map((W)=>W.id)),...J.mode==="claustrum"?{accountIdentities:new Map(J.accounts.flatMap((W)=>W.accountIdentity?[[W.id,W.accountIdentity]]:[]))}:{},storage:J.policyStorage,inputBytes:1,preferredAccountId:G.previousAccountId});if(j.signal.throwIfAborted(),u)return u.accountId}else{let u=a2(J.policyStorage)==="fallback-first"?[...v.filter((W)=>W.id!=="main"),...v.filter((W)=>W.id==="main")]:[...v.filter((W)=>W.id==="main"),...v.filter((W)=>W.id!=="main")];if(u[0])return u[0].id}if(J.mode==="claustrum")throw new W1;let c=J.accounts.find((f)=>f.id==="main"&&f.type==="oauth");if(!c)return;let o=c.quota;if(G.rerouteFrom?.limit.status===429||!x2(o,J.policyStorage))try{o=await X.fetchQuota("main",$.fetch,j.signal)}catch{return}if(j.signal.throwIfAborted(),!s2(o))return;return J.accounts.find((f)=>f.type==="api"&&X2(f)&&f.id!==G.rerouteFrom?.accountId)?.id},async authorizeAccount(G,j){let J=T(G),S=await X.read();J.signal.throwIfAborted(),m(S);let R=j2(await $.resolveModelId?.(G)??G.modelID);J.signal.throwIfAborted();let x=S.accounts.find((O)=>O.id===j);if(!x||!q(x,S,R))return;let v=K(G,j),c=E.get(v),o=c?.shift();if(c?.length===0)E.delete(v);let{dispatch:f,relayFallback:u}=await I(S,o?.direct===!0);if(J.signal.throwIfAborted(),o?.auth){if(!await A(j,R,o.auth.route,J))return;let O=_.get(o.auth.provenance);if(O?.receipt?.expiresAtMs!==void 0&&O.receipt.expiresAtMs!==null&&O.receipt.expiresAtMs<Date.now()+300000)return;if(O)_.set(o.auth.provenance,{...O,scope:{...G,modelID:R},account:x,active:J,relayFallback:u});return{...o.auth,dispatch:f}}let W={scope:{...G,modelID:R},active:J,account:x,retry:o?.retry??!1,relayFallback:u,quota:x.quota};if(x.type==="api"){let O=S.accounts.find((l)=>l.id==="main"&&l.type==="oauth");if(!O||!x2(O.quota,S.policyStorage)||!s2(O.quota))return;let k=await X.authorizeApi(j,J.signal);if(J.signal.throwIfAborted(),!await A(j,R,"api",J))return;let b={kind:"api",subject:k.subject};return _.set(b,W),{route:"api",headers:k.authHeader==="authorization-bearer"?{authorization:`Bearer ${k.apiKey}`}:{"x-api-key":k.apiKey},baseURL:k.baseURL,provenance:b,dispatch:f}}if(x.source==="vault"){let O=await X.authorizeVault(j,J.signal);if(J.signal.throwIfAborted(),!await A(j,R,"oauth",J))return;let k={kind:"vault",credentialId:O.credentialId,recordVersion:O.recordVersion};_.set(k,{...W,receipt:O});let b=O.assertedAccountIdentity;if(!b)return;return{route:"oauth",accessToken:O.accessToken,provenance:k,dispatch:f,identity:S2(b,b)}}let z=await X.authorizeLocal(j,{signal:J.signal,policy:(O,k)=>R2(O,k,R)});if(J.signal.throwIfAborted(),z.status!=="usable")return;if(!await A(j,R,"oauth",J))return;let N={kind:"local",subject:z.subject};_.set(N,{...W,access:z.access});let D=z.subject.binding.identity;return{route:"oauth",accessToken:z.access,provenance:N,dispatch:f,identity:S2(D,D)}},async requestOptions(G){let j=T(G),J=await X.read();j.signal.throwIfAborted();let S=J.accounts.find((x)=>x.id===G.accountId);if(!S||!q(S,J,G.modelID))throw Error("request refused: native account is ineligible for this model");let R=_.get(G.provenance);if(R)_.set(G.provenance,{...R,scope:{...R.scope,modelID:G.modelID}});return $.requestOptions(G,J)},async admitRequest(G){let j=_.get(G.provenance);if(!j||!await A(G.accountId,G.modelID,G.route,j.active))throw Error("request refused: native account policy changed before dispatch");_.set(G.provenance,{...j,scope:{...j.scope,modelID:G.modelID}})},onRequestPrepared:(G)=>$.onRequestPrepared?.(G),responseOptions(G){return $.responseOptions?.({...G,modelID:_.get(G.provenance)?.scope.modelID??G.modelID})},quotaFromHeaders(G,j){let J=_.get(j.provenance),S=B1(G);if(S)$.onRequestId?.(j,S);if(!J||j.route!=="oauth"||!j1(G))return;let R=j.provenance.kind==="local"?j.provenance.subject.binding.identity:J.receipt?.assertedAccountIdentity,x={...V1(G),...R?{accountIdentity:R}:{}};J.quota=e$(J.quota,x);let v=L.observe(d(j.provenance,J,{quota:J.quota}));return i.set(j.provenance,v),x},async limitFromResponse(G){let j=_.get(G.provenance);if(!j)return;if(G.status===401&&j.receipt){if(!Y.has(j.receipt))Y.add(j.receipt),await X.vault.reportFailure(j.receipt,401,G.dispatch==="http-relay"?"relay_status_field":"direct");if(j.retry||j.active.signal.aborted)return;let S=j.active,R=await X.vault.prepareRetry(j.receipt,S.signal);if(S.signal.throwIfAborted(),!R.retry)return;let x=R.receipt,v=x.assertedAccountIdentity;if(!v)return;let c={kind:"vault",credentialId:x.credentialId,recordVersion:x.recordVersion};_.set(c,{...j,receipt:x,retry:!0});let o=`vault-newer:${G.attemptId}`;return P.set(o,{sessionID:G.sessionID,accountId:G.accountId,retry:!0,auth:{route:"oauth",accessToken:x.accessToken,provenance:c,identity:S2(v,v)}}),Q(),{reason:o,status:401}}if(G.status===401&&G.provenance.kind==="local"&&j.access&&!j.retry){if(j.active.signal.aborted)return;let S=j.active,R=await X.authorizeLocal(G.accountId,{rejectedAccessToken:j.access,signal:S.signal,policy:(o,f)=>R2(o,f,j.scope.modelID)});if(S.signal.throwIfAborted(),R.status!=="usable"||R.access===j.access)return;let x={kind:"local",subject:R.subject};_.set(x,{...j,access:R.access,retry:!0});let v=R.subject.binding.identity,c=`local-newer:${G.attemptId}`;return P.set(c,{sessionID:G.sessionID,accountId:G.accountId,retry:!0,auth:{route:"oauth",accessToken:R.access,provenance:x,identity:S2(v,v)}}),Q(),{reason:c,status:401}}let J=await X.read();if($1(G.status,J.policyStorage))return{reason:`provider-${G.status}`,status:G.status};return},limitFromRelayFailure(G){let j=_.get(G.provenance);if(!j?.relayFallback||j.active.signal.aborted||!(G.status===401||G.status>=500))return;let J=`relay-direct:${G.attemptId}`;return P.set(J,{sessionID:G.sessionID,accountId:G.accountId,direct:!0,retry:!1}),Q(),{reason:J}},limitFromStreamError(G){return G.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(G,j){let J=_.get(j.provenance);if(j.dispatch==="http-relay"&&J?.relayFallback&&!J.active.signal.aborted&&G.status===void 0){let S=`relay-direct:${j.attemptId}`;return P.set(S,{sessionID:j.sessionID,accountId:j.accountId,direct:!0,retry:!1}),Q(),{reason:S}}return},async onAttemptEnd(G,j){let J=_.get(G.provenance);if(!J)return;try{if(await i.get(G.provenance),j.status===401&&J.receipt&&!Y.has(J.receipt))Y.add(J.receipt),await X.vault.reportFailure(J.receipt,401,G.dispatch==="http-relay"?"relay_status_field":"direct");if(!j.localRefusal&&j.status!==void 0)L.publish(()=>d(G.provenance,J,{lastUsed:Date.now()}))}finally{_.delete(G.provenance),i.delete(G.provenance)}},forgetSession(G){H.get(G)?.abort(),H.delete(G);for(let[j,J]of P)if(J.sessionID===G)P.delete(j);for(let[j,J]of E)if(J[0]?.sessionID===G)E.delete(j);$.onForgetSession?.(G)},resetRouting:async(G)=>C(await X.read()).clear(G),async recordPrime(G,j){let J=_.get(G);if(!J||J.active.signal.aborted)return!1;if(G.kind==="local")return X.incrementPrimeUsage(J.account.id,G.subject,j);if(G.kind==="vault"&&J.receipt)return X.incrementPrimeUsage(J.account.id,J.receipt,j);return!1},close(){U=!0;for(let G of H.values())G.abort();return H.clear(),E.clear(),P.clear(),L.drain()}},i=new WeakMap;return n}function H1(){let $=new K1,X=new Map,L=new Map,V=new Map,C=new Set,_=new Set,P=new Map,E=(H)=>{while(H.size>512){let Y=H.keys().next();if(!Y.done)H.delete(Y.value)}};return{async install(H){let Y=[];try{Y.push(await H.session.hook("context",(U)=>{let Q=U.messages.map((T)=>{return{info:{id:T.id,sessionID:U.sessionID,role:T.role,agent:U.agent,model:{providerID:U.model.providerID,modelID:U.model.id}},parts:T.content.map((q)=>({type:q.type,...q.type==="text"?{text:q.text}:{}}))}});$.observeMessages(Q);let K=U.messages.findLast((T)=>T.role==="user"&&T.id);if(K?.id)X.set(U.sessionID,K.id);if(K?.content.some((T)=>T.type==="text"&&T.text===f2))C.add(U.sessionID);else C.delete(U.sessionID);E(X)},{providerID:"anthropic"})),Y.push(await H.session.hook("model.request",(U)=>{if(U.kind!=="primary")return;let Q=X.get(U.sessionID);if(!Q)return;if($.markHeaders({sessionId:U.sessionID,messageId:Q,agent:U.agent,headers:U.headers}),C.has(U.sessionID))U.headers[O2]="1"},{providerID:"anthropic"}))}catch(U){throw await Promise.allSettled(Y.map((Q)=>Q.dispose())),U}return{dispose:async()=>{await Promise.all(Y.map((U)=>U.dispose()))}}},requestOptions(H,Y){let U=$.resolveHeader(H.correlation[k2]);if(U)L.set(H.attemptId,U),E(L);P.set(H.attemptId,H.sessionID),E(P);let Q=H.correlation[O2]==="1";if(Q)_.add(H.attemptId);return{cache1hEnabled:H.agent!=="compaction"&&H.agent!=="title"&&(Y.policyStorage.claudeCache?.enabled??!0),cache1hMode:Y.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:Y.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:Y.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,serverSideFallbackEnabled:z1(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:Q,billingLineage:U?{promptId:U.promptId,previousRequestId:U.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:V.get(H.sessionID)}},responseOptions(H){return{serverSideFallbackModel:j2(H.modelID),laneStart:_.has(H.attemptId),onMessageStart(Y){if(H.kind==="primary"&&typeof Y.id==="string")V.set(H.sessionID,Y.id),E(V)},onStreamEnd(){L.delete(H.attemptId),_.delete(H.attemptId),P.delete(H.attemptId)}}},onRequestId(H,Y){$.commit(L.get(H.attemptId),Y)},forgetSession(H){$.clearSession(H),X.delete(H),V.delete(H),C.delete(H);for(let[Y,U]of P)if(U===H)L.delete(Y),_.delete(Y),P.delete(Y)}}}var g2="cortexkit-anthropic-auth",d1='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',u1="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",p1="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function c1($){let X=$.authorize??y2,L=$.exchange??I2,V=()=>{if(!$.isActive())throw Error("Claude authentication setup is closed")},C=async()=>{let E;try{E=await $.readMode()}catch{throw Error(p1)}return V(),E},_=async()=>{if(await C()!=="local")throw Error(d1)};return{integrationID:"anthropic",methods:[{method:{id:N1,type:"oauth",label:P1},async authorize(){V(),await _();let E=await X("max");return V(),{mode:"code",url:E.url,instructions:"Paste the authorization code returned by Claude.",callback:async(H)=>{V();let Y=await L(H,E.verifier,E.redirectUri,E.state);if(!$.isActive()||Y.type!=="success")throw Error("Claude sign-in did not complete");return{access:Y.access,refresh:Y.refresh,expires:Y.expires}}}}}],vault:{method:{id:F1,type:"oauth",label:"Claude vault accounts"},async activate(){if(V(),await C()!=="claustrum")throw Error(u1)}},async onLogin(E){V(),await _(),await $.runtime.loginOAuth({routeId:"main",credential:E,replace:!0}),V()},label:"Claude native account pool"}}function i1($){return{readMode:()=>U1("opencode",$),disconnectVault:()=>C1({host:"opencode",env:$})}}function t2($={}){return{id:g2,setup:(X)=>O1(X,$)}}async function O1($,X={}){let L=X.paths??await L1(),V=M1({paths:L,host:"opencode",local:X.local,vault:X.vault}),C=i1(X.vault?.env??process.env),_=!0,P=H1(),E=n$(),H,Y,U,Q=Q1({runtime:V,paths:L,fetch:X.fetch,requestOptions:P.requestOptions,responseOptions:P.responseOptions,onRequestId:P.onRequestId,onForgetSession:P.forgetSession,onRequestPrepared:async(I)=>{try{await U?.track(I)}catch{H2.warn("cachekeep","live request tracking failed")}},resolveModelId:async(I)=>E.modelId(I.modelID),onOwnedRequest:()=>{H??=k$(V,X.fetch),Y??=t$({runtime:V,paths:L,source:Q,fetch:X.fetch})}});U=R$({...X.cacheKeep,runtime:V,source:Q,fetch:X.fetch,isSubagent:async(I)=>Boolean((await $.session.get({sessionID:I})).parentID)});let K=u$({runtime:V,source:Q,cacheKeepRegistry:U.registry,start:async(I,d)=>{await $.session.synthetic({sessionID:I,text:d,description:"Claude lane start",resume:!0})}}),T=[],q=await A$($,{source:Q,log:{warn:(I,d)=>H2.warn("opencode2",I,d)}},{credential:r$}).catch(async(I)=>{throw K.close(),await U?.dispose(),await Q.close(),V.close(),I}),A,m=()=>{if(A)return A;return _=!1,K.close(),Q.close(),A=(async()=>{await Promise.allSettled([q.dispose(),H?.dispose(),Y?.dispose(),U?.dispose(),...T.map((I)=>I.dispose())]),await Q.close(),V.close()})(),A};try{T.push(await P.install($)),T.push(await E.install($)),T.push(await h2($,c1({isActive:()=>_,readMode:C.readMode,runtime:V})));let I={host:"opencode",dispatch:K.dispatch,readStatus:(n)=>K.readStatus(n),readAccounts:()=>V.read(),readMode:C.readMode,disconnectVault:C.disconnectVault,interactive:!0},d=_1(I);return T.push(await T1($,d,K)),m}catch(I){throw await m(),I}}var G0={id:g2,setup:t2().setup,server:E1};export{O1 as setupAnthropicAuth,G0 as default,t2 as createAnthropicAuthPlugin,g2 as ANTHROPIC_AUTH_PLUGIN_ID};

package/dist/v2/setup.d.ts

@@ -1,6 +1,7 @@
 import { authorize, exchange, type NativeAccountRuntime, type NativeAccountRuntimeOptions, type NativePoolPaths } from '@cortexkit/anthropic-auth-core';
 import { type RegisterOpenCode2AuthMethodsOptions } from '@cortexkit/common-auth/opencode2';
 import type { Plugin } from '@opencode/plugin';
+import { type NativeCacheKeepOptions } from './cachekeep';
 export declare const ANTHROPIC_AUTH_PLUGIN_ID = "cortexkit-anthropic-auth";
 /**
  * The account source vault enrollment selects: 'local' serves accounts stored
@@ -13,6 +14,7 @@ export interface AnthropicAuthV2Options {
     readonly local?: NativeAccountRuntimeOptions['local'];
     readonly vault?: NativeAccountRuntimeOptions['vault'];
     readonly fetch?: typeof fetch;
+    readonly cacheKeep?: NativeCacheKeepOptions;
 }
 /** The OAuth result a completed Claude Pro / Max sign-in hands to the pool. */
 export interface ClaudeOAuthLogin {

package/dist/v2/source.d.ts

@@ -25,6 +25,7 @@ export interface NativeSourceOptions {
     readonly onRequestId?: (scope: NativeAnthropicResponseContext<NativeSourceProvenance>, requestId: string) => void;
     readonly onForgetSession?: (sessionID: string) => void;
     readonly onOwnedRequest?: () => void;
+    readonly onRequestPrepared?: NativeSource['onRequestPrepared'];
     readonly fetch?: typeof fetch;
     /** Resolve a host model alias to the upstream ID before request-local policy. */
     readonly resolveModelId?: (scope: RequestScope) => Promise<string>;

package/dist/v2/tui.js

@@ -1,2 +1,2 @@
-import{s as F}from"../index-1jkyhgyr.js";import"../index-3xqv3rw3.js";async function V(B){let Y=B.client.rpc(F),K=!0,$=!1,L=new AbortController,O=()=>{let w=B.ui.router.current();return w.type==="session"?w.sessionID:void 0};function M(w){return new Promise((J)=>{let j="",G=!1,Q=B.keymap.mode.push("cortexkit-protected-entry"),H=(z,D=!0)=>{if(G)return;G=!0,B.renderer.keyInput.off("keypress",X),B.renderer.keyInput.off("paste",Z),L.signal.removeEventListener("abort",W),Q();let q=z?j:void 0;if(j="",D)B.ui.dialog.clear();J(q)},W=()=>H(!1),X=(z)=>{if(z.preventDefault(),z.stopPropagation(),z.name==="escape"||z.ctrl&&z.name==="c")return H(!1);if(z.name==="return"||z.name==="enter")return H(!0);if(z.name==="backspace"){j=Array.from(j).slice(0,-1).join("");return}if(!z.ctrl&&!z.meta&&!z.option&&Array.from(z.sequence).every((D)=>D.charCodeAt(0)>=32&&D.charCodeAt(0)!==127))j=(j+z.sequence).slice(0,4096)},Z=(z)=>{z.preventDefault(),z.stopPropagation(),j=(j+Array.from(new TextDecoder().decode(z.bytes)).filter((D)=>D.charCodeAt(0)>=32&&D.charCodeAt(0)!==127).join("")).slice(0,4096)};if(B.renderer.keyInput.prependListener("keypress",X),B.renderer.keyInput.prependListener("paste",Z),L.signal.addEventListener("abort",W,{once:!0}),B.ui.dialog.alert({title:w,message:"Type or paste the value. Input is hidden. Enter accepts; Escape cancels."}).then(()=>H(!1,!1),()=>H(!1,!1)),L.signal.aborted)W()})}async function P(w){let J={};for(let j of w.knobs){if(!K)return;if(j.kind==="choice"){let G=await B.ui.dialog.select({title:j.label,options:j.choices.map((Q)=>({title:Q.label,value:Q.value})),current:j.value});if(G===void 0)return;J[j.id]=G}else if(j.kind==="toggle"){let G=await B.ui.dialog.select({title:j.label,options:[{title:"On",value:!0},{title:"Off",value:!1}],current:j.value});if(G===void 0)return;J[j.id]=G}else{let G=j.kind==="text"&&j.masked?await M(j.label):await B.ui.dialog.prompt({title:j.label,value:j.value===void 0?void 0:String(j.value),placeholder:j.kind==="text"?j.placeholder:void 0});if(G===void 0)return;J[j.id]=G===""&&!j.required?null:j.kind==="number"?Number(G):G}}return J}async function C(w,J){if(!K||$||O()!==w)return;$=!0;let j=J;try{while(K&&O()===w){let G=await B.ui.dialog.select({title:j.menu.title,options:j.menu.sections.map((D)=>({title:D.title,description:D.lines.join(`
+import{s as F}from"../index-1jkyhgyr.js";import"../index-rftced5v.js";async function V(B){let Y=B.client.rpc(F),K=!0,$=!1,L=new AbortController,O=()=>{let w=B.ui.router.current();return w.type==="session"?w.sessionID:void 0};function M(w){return new Promise((J)=>{let j="",G=!1,Q=B.keymap.mode.push("cortexkit-protected-entry"),H=(z,D=!0)=>{if(G)return;G=!0,B.renderer.keyInput.off("keypress",X),B.renderer.keyInput.off("paste",Z),L.signal.removeEventListener("abort",W),Q();let q=z?j:void 0;if(j="",D)B.ui.dialog.clear();J(q)},W=()=>H(!1),X=(z)=>{if(z.preventDefault(),z.stopPropagation(),z.name==="escape"||z.ctrl&&z.name==="c")return H(!1);if(z.name==="return"||z.name==="enter")return H(!0);if(z.name==="backspace"){j=Array.from(j).slice(0,-1).join("");return}if(!z.ctrl&&!z.meta&&!z.option&&Array.from(z.sequence).every((D)=>D.charCodeAt(0)>=32&&D.charCodeAt(0)!==127))j=(j+z.sequence).slice(0,4096)},Z=(z)=>{z.preventDefault(),z.stopPropagation(),j=(j+Array.from(new TextDecoder().decode(z.bytes)).filter((D)=>D.charCodeAt(0)>=32&&D.charCodeAt(0)!==127).join("")).slice(0,4096)};if(B.renderer.keyInput.prependListener("keypress",X),B.renderer.keyInput.prependListener("paste",Z),L.signal.addEventListener("abort",W,{once:!0}),B.ui.dialog.alert({title:w,message:"Type or paste the value. Input is hidden. Enter accepts; Escape cancels."}).then(()=>H(!1,!1),()=>H(!1,!1)),L.signal.aborted)W()})}async function P(w){let J={};for(let j of w.knobs){if(!K)return;if(j.kind==="choice"){let G=await B.ui.dialog.select({title:j.label,options:j.choices.map((Q)=>({title:Q.label,value:Q.value})),current:j.value});if(G===void 0)return;J[j.id]=G}else if(j.kind==="toggle"){let G=await B.ui.dialog.select({title:j.label,options:[{title:"On",value:!0},{title:"Off",value:!1}],current:j.value});if(G===void 0)return;J[j.id]=G}else{let G=j.kind==="text"&&j.masked?await M(j.label):await B.ui.dialog.prompt({title:j.label,value:j.value===void 0?void 0:String(j.value),placeholder:j.kind==="text"?j.placeholder:void 0});if(G===void 0)return;J[j.id]=G===""&&!j.required?null:j.kind==="number"?Number(G):G}}return J}async function C(w,J){if(!K||$||O()!==w)return;$=!0;let j=J;try{while(K&&O()===w){let G=await B.ui.dialog.select({title:j.menu.title,options:j.menu.sections.map((D)=>({title:D.title,description:D.lines.join(`
 `),value:D}))});if(!G||!K||O()!==w)return;let Q=[...G.actions.map((D)=>({action:D,itemId:void 0})),...G.items.flatMap((D)=>D.actions.map((q)=>({action:q,itemId:D.id})))],H=await B.ui.dialog.select({title:G.title,options:Q.map((D)=>({title:D.action.label,description:D.action.description,value:D}))});if(!H)continue;let W=await P(H.action);if(!W||!K||O()!==w)return;let X=H.action.confirm?await B.ui.dialog.confirm({title:H.action.label,message:H.action.confirm.message}):void 0;if(H.action.confirm&&X!==!0)continue;if(!K||O()!==w)return;let Z={command:"claude",sectionId:G.id,itemId:H.itemId,actionId:H.action.id,sessionId:w,values:W,confirmed:X},z=await Y.apply(Z,{signal:L.signal,location:B.location});if(!K||O()!==w)return;await B.ui.dialog.alert({title:z.ok?"Claude":"Claude action refused",message:z.text}),j={command:z.command,menu:z.menu}}}finally{$=!1}}let R=Y.events.on("opened",(w)=>C(w.data.sessionId,w.data.payload),{signal:L.signal}),U=Y.events.on("notification",(w)=>{if(K&&O()===w.data.sessionId)B.ui.toast.show({title:"Claude",sessionID:w.data.sessionId,message:w.data.message,variant:w.data.kind})},{signal:L.signal});return B.keymap.layer(()=>({commands:[{id:"cortexkit.claude",title:"Claude",group:"Claude",palette:!0,slash:{name:"claude"},async run(){let w=O();if(!w){await B.ui.dialog.alert({title:"Claude",message:"Open a session before using the Claude menu."});return}let J=await Y.open({sessionId:w},{signal:L.signal,location:B.location});await C(w,J)}}]})),()=>{K=!1,L.abort(),R(),U()}}var T={id:"cortexkit-anthropic-auth",setup:V};export{V as setupAnthropicTui,T as default};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/opencode-anthropic-auth",
-  "version": "2.0.1",
+  "version": "2.0.3",
   "type": "module",
   "repository": {
     "type": "git",
@@ -77,14 +77,14 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.6.0",
-    "@cortexkit/anthropic-auth-core": "2.0.1",
-    "@opentui/core": "0.5.11",
-    "@opentui/solid": "0.5.11",
+    "@cortexkit/anthropic-auth-core": "2.0.3",
+    "@opentui/core": "0.6.0",
+    "@opentui/solid": "0.6.0",
     "jsonc-parser": "^3.3.1",
     "solid-js": "1.9.12"
   },
   "devDependencies": {
-    "@ai-sdk/anthropic": "4.0.58",
+    "@ai-sdk/anthropic": "4.0.77",
     "@opencode/plugin": "2.0.22"
   }
 }