@cortexkit/opencode-anthropic-auth 2.0.2 → 2.0.3

package/dist/v2/server.js

@@ -1,4 +1,4 @@
-import{a as E2,b as a$,c as e$,d as j$,e as B$,f as D2,g as _2,h as V$,i as $1,j as Q$,k as H$,l as U$,m as C$,n as L$,o as j1}from"../index-227rsmfv.js";import"../index-2arfb1y3.js";import"../index-rqync0pc.js";import{t as J1}from"../index-1jkyhgyr.js";import"../index-b3mxpp4w.js";import"../index-jc8p0tkv.js";import{Ac as b$,Ad as G1,Bd as T2,Ca as x2,Da as l$,Ed as X1,Kb as h2,Kc as w$,La as u$,Lb as m2,Md as Y1,Nd as i$,Od as o$,Pd as n$,Ra as A2,Sd as W1,Tc as y$,Ud as R$,Vd as q$,Wb as O$,Xa as p$,Xd as p2,Yb as E$,Zd as h$,_b as S$,ac as T$,bc as x$,bd as I$,be as r$,ce as s$,fa as G$,fe as k$,gc as Y$,gd as Y2,hd as W$,ia as X$,je as J$,ke as z$,ld as A$,le as c2,nd as Z1,qa as q2,qb as N2,ra as k2,ud as P2,vd as d$,zb as R2,zd as c$}from"../index-j0wsgy54.js";import"../index-fn0zqnnw.js";import"../index-1tbpt45x.js";import"../index-mge0rw54.js";class C2 extends Error{kind;providerID;sessionID;requestKind;constructor(Z){super(Z.message??`${Z.providerID} ${Z.requestKind} request refused (${Z.kind})`);this.name="OpenCode2AuthError",this.kind=Z.kind,this.providerID=Z.providerID,this.sessionID=Z.sessionID,this.requestKind=Z.requestKind}}function z2(Z){return`common-auth-placeholder.${Z}`}function s2(Z){let K=z2(Z.integrationID);return{type:"oauth",methodID:Z.methodID,access:K,refresh:K,expires:Z.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function w2(Z,K){if(Z?.type!=="oauth")return!1;let C=K===void 0?void 0:z2(K),W=(N)=>C===void 0?N.startsWith("common-auth-placeholder."):N===C;return W(Z.access)&&W(Z.refresh)}var a2="No browser sign-in: this connects the plugin to the accounts in its vault.";async function y2(Z,K){let C=K.now??Date.now,{integrationID:W}=K,N=(O)=>s2({integrationID:W,methodID:O,now:C()}),_=async(O,V)=>{return await K.onLogin(O,{integrationID:W,methodID:V}),N(V)},T=(O)=>async(V)=>{let X=O.method.id,H=await O.authorize(V),M={url:H.url,instructions:H.instructions,...H.expiresAt===void 0?{}:{expiresAt:H.expiresAt}};if(H.mode==="auto")return{...M,mode:"auto",callback:H.callback.then((E)=>_(E,X))};let Q=H.callback;return{...M,mode:"code",callback:async(E)=>_(await Q(E),X)}};return Z.integration.transform((O)=>{let V=K.label===void 0?{}:{label:()=>K.label};for(let M of K.methods)O.method.update({integrationID:W,method:M.method,authorize:T(M),refresh:async(Q)=>{if(!w2(Q,W))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return N(Q.methodID)},...V});let X=K.vault;if(X===void 0)return;let H=X.method.id;O.method.update({integrationID:W,method:X.method,authorize:async()=>({url:"",instructions:X.instructions??a2,mode:"auto",callback:Promise.resolve().then(()=>X.activate({integrationID:W,methodID:H})).then(()=>N(H))}),refresh:async(M)=>{if(!w2(M,W)||M.methodID!==H)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return N(H)},...V})})}function B1(Z){let K=[],C;for(let W of Z.split(/\r?\n/))if(W.startsWith("data:"))K.push(W.slice(5).replace(/^ /,""));else if(W.startsWith("event:"))C=W.slice(6).trim();if(K.length===0)return;return C===void 0?{data:K.join(`
-`)}:{event:C,data:K.join(`
-`)}}function I2(Z,K){let C=new TextDecoder,W="",N=(T)=>{let O=B1(T);if(!O)return;try{Z(O)}catch(V){K(V)}},_=()=>{for(;;){let T=/\r?\n\r?\n/.exec(W);if(!T)return;let O=W.slice(0,T.index);W=W.slice(T.index+T[0].length),N(O)}};return new TransformStream({transform(T,O){O.enqueue(T),W+=C.decode(T,{stream:!0}),_()},flush(){if(W+=C.decode(),_(),W.trim()!=="")N(W);W=""}})}var t2=512,V2="x-common-auth-attempt",j2=(Z,K)=>JSON.stringify([Z,K]),X2=(Z)=>({providerID:Z.model.providerID,modelID:Z.model.id,sessionID:Z.sessionID,agent:Z.agent,kind:Z.kind});function V1(Z){let K=Z.headers;return typeof K==="object"&&K!==null}function Q1(Z,K){let C=Z.getReader();return new ReadableStream({async pull(W){let N;try{N=await C.read()}catch(_){K({reason:"failed",message:_ instanceof Error?_.message:String(_)}),W.error(_);return}if(N.done)K(),W.close();else W.enqueue(N.value)},async cancel(W){K({reason:"cancelled",...W===void 0?{}:{message:String(W)}}),await C.cancel(W)}})}function g2(Z,K){for(let[C,W]of Object.entries(K)){let N=C.toLowerCase();for(let _ of Object.keys(Z))if(_.toLowerCase()===N)delete Z[_];if(W!==null)Z[C]=W}}function H1(Z,K){for(let[C,W]of Object.entries(K))if(W===null)Z.delete(C);else Z.set(C,W)}async function f2(Z,K,C={}){let{providerID:W}=K,N=C.gateOnPlaceholder,_=($)=>N===void 0||N.credential($)===z2(W),T=C.logger,O=Math.max(1,C.maxRecords??t2),V=[...C.hostCredentials??[z2(W)],...N?[z2(W)]:[]].filter(($)=>$!==""),X=new Map,H=new WeakMap,M=new Map,Q=new Set,E=new Map,g=!1,D=!1,v=new Map,i=0,s=!1,r=new Map,c=($,J)=>{try{T?.warn($,J)}catch{}},G=($)=>$ instanceof Error?$.message:String($),z=async($,J)=>{let U=v.get($);if(!U||U.size===0)return;await Promise.all([...U].map(async(P)=>{try{await P(J)}catch(w){c("opencode2 auth listener threw; the request is unaffected",{event:$,error:G(w)})}}))},j=async($,J)=>{try{await K.onAttemptEnd?.($,J)}catch(U){c("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:$.attemptId,error:G(U)})}},S=($,J)=>{if($.ended||!$.attempt)return;let U={...$.status===void 0?{}:{status:$.status},outputStarted:$.outputStarted,...$.limit?{limit:$.limit.signal}:{},...J?{error:J}:{}};if(J)$.endError=J;$.ended=j($.attempt,U)},A=($,J)=>S($,{reason:"abandoned",message:J}),k=($)=>[...X.values()].filter((J)=>J.key===$),h=($)=>k($).at(-1),d=($)=>{if(X.delete($.id),!k($.key).length)M.delete($.key)},p=($)=>{X.set($.id,$);while(X.size>O){let J=X.values().next().value;if(J===void 0)break;A(J,"dropped to keep the record bound"),d(J)}},y=($)=>$.accountId===void 0?void 0:{...$.scope,accountId:$.accountId},l=($,J)=>new C2({kind:"no-account",providerID:W,sessionID:$.sessionID,requestKind:$.kind,...J===void 0?{}:{message:J}}),Y=($)=>{r.get($)?.clear(),r.delete($)},B=async($,J)=>{let U=()=>l($,`${W} ${$.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(s)throw U();let P=r.get($.sessionID);if(!P)P=new Set,r.set($.sessionID,P);let w={};P.add(w);let f=()=>{if(!P.has(w))throw U()};try{return await J(f)}finally{if(P.delete(w),P.size===0&&r.get($.sessionID)===P)r.delete($.sessionID)}},L=($,J)=>{for(let[U,P]of J)if(V.some((w)=>P.includes(w)))throw new C2({kind:"host-credential-on-wire",providerID:W,sessionID:$.sessionID,requestKind:$.kind,message:`${W} ${$.kind} request still carries the host's placeholder credential in ${U}; the adapter's account headers must replace it`})},R=($)=>{for(let J of k($))if(J.ended||!J.attempt)d(J);else if(J.transport==="ws"||J.judged)A(J,"a newer attempt of its session and kind began"),d(J)},F=async($,J,U,P)=>{let w=j2($.sessionID,$.kind),f=M.get(w);M.delete(w);let q=f?.accountId??h(w)?.accountId;R(w);let I={...$,...q===void 0?{}:{previousAccountId:q},...f?.rerouteFrom===void 0?{}:{rerouteFrom:f.rerouteFrom}},u=await K.chooseAccount(I);U();let G2={},n2;if(u!==void 0){let F2=await K.accountHeaders({...$,accountId:u});if(U(),V1(F2))G2=F2.headers,n2=F2.attempt;else G2=F2}let r2=`attempt-${++i}`,U2={id:r2,key:w,scope:$,accountId:u,headers:G2,attempt:u===void 0?void 0:{...$,accountId:u,attemptId:r2,transport:P,data:n2},...P===void 0?{}:{transport:P},outputStarted:!1};if(p(U2),U2.attempt)z("select",{...$,accountId:U2.attempt.accountId,hook:J,...I.previousAccountId===void 0?{}:{previousAccountId:I.previousAccountId},...I.rerouteFrom===void 0?{}:{rerouteFrom:I.rerouteFrom},handle:U2.attempt});return U2},x=async($,J,U,P,w)=>{let f=j2($.sessionID,$.kind),q=P===void 0?void 0:X.get(P);if(q?.key!==f)q=void 0;if(!q){if(q=h(f),k(f).filter((u)=>u.transport===void 0&&!u.ended).length>1&&!D)D=!0,c("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:$.sessionID,kind:$.kind})}if(!q||q.transport!==void 0||q.ended)q=await F($,J,w,U);else if(q.transport=U,q.attempt)q.attempt.transport=U;if(U==="ws"){for(let I of k(f))if(I!==q&&I.transport==="ws")A(I,"a newer attempt of its session and kind went out over WebSocket")}return q},b=async($,J)=>{try{return await J()}catch(U){throw S($,{reason:"failed",message:G(U)}),U}},n=($,J)=>{let U=k(j2($,J)).filter((P)=>P.transport==="ws").at(-1);return U?.attempt!==void 0&&!U.ended?U:void 0},m=($,J,U)=>{let P=y($);if(!P||!$.attempt||$.limit)return;$.limit={signal:J,delivered:z("limit",{...P,via:U,limit:J,outputStarted:$.outputStarted,handle:$.attempt})}},K2=($,J,U,P)=>{let w=y($);if(!w||!$.attempt)return;z("quota",{...w,transport:J,...P===void 0?{}:{status:P},quota:U,handle:$.attempt})},$2=($,J,U,P)=>{let w=$.attempt;if(!w)return;let f=K.inspectEvent?.(P===void 0?{transport:J,data:U,attempt:w}:{transport:J,data:U,event:P,attempt:w});if(!f)return;if(f.quota!==void 0)K2($,J,f.quota);if(f.outputStarted)$.outputStarted=!0;if(f.limit)m($,f.limit,J);if(f.error!==void 0)S($,{reason:"failed",message:f.error});else if(f.done)S($)},W2=($,J)=>{let U=$.attempt;if(!U||J.accountId===$.accountId)return;if(U.reboundFrom??=U.accountId,U.accountId=J.accountId,"data"in J)U.data=J.data;$.accountId=J.accountId},e=($)=>!$.attempt||$.endError!==void 0||$.status!==void 0&&$.status>=400,o=($)=>{let J=[...X.values()].filter((I)=>I.scope.sessionID===$),U=J.filter((I)=>I.limit&&!I.rerouted).at(-1);if(U)return U;let P=J.filter((I)=>I.scope.kind==="primary"),w=P.length>0?P:J;if(w.length<=1)return w[0];let f=w.filter((I)=>!I.judged&&e(I)).at(-1);if(f)return f;let q=w.filter((I)=>I.attempt&&!I.ended);if(q.length>1)return"ambiguous";return q[0]??w.at(-1)},t={providerID:W},a=[];a.push(await Z.session.hook("model.request",($)=>{if(N)return;return B(X2($),async(J)=>{let U=await F(X2($),"model.request",J);if(J(),U.accountId===void 0)throw l(U.scope);g2($.headers,{...U.headers,[V2]:U.id})})},t)),a.push(await Z.session.hook("http.request",($)=>{if(N){let J=_($.request.headers);if(E.set($.sessionID,J),!J)return}return B(X2($),async(J)=>{let U=$.request.headers.get(V2)??void 0,P=N?await F(X2($),"http.request",J,"http"):await x(X2($),"http.request","http",U,J);J();let w=y(P),f=P.attempt;if(!w||!f)throw l(P.scope);await b(P,async()=>{let q=$.request;if(K.rewriteRequest){if(U!==void 0){let G2=new Headers(q.headers);G2.delete(V2),q=new Request(q,{headers:G2})}q=await K.rewriteRequest({...w,request:q,attempt:f})??q,J()}let I=new Headers(q.headers);I.delete(V2),H1(I,P.headers),L(P.scope,I.entries());let u=new Request(q,{headers:I});H.set(u,P),$.request=u})})},t)),a.push(await Z.session.hook("http.response",async($)=>{let J=H.get($.request);if(!J){if(N)return;if(!g)g=!0,c("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:$.sessionID,kind:$.kind});return}let U=$.response;if(K.answeredBy&&J.attempt){let I=J.attempt,u=await b(J,async()=>K.answeredBy?.({request:$.request,response:U,attempt:I}));if(u)W2(J,u)}let P=y(J),w=J.attempt;if(!P||!w)return;J.status=U.status;let f=K.quotaFromHeaders?.(U.headers,U.status,w);if(f!==void 0)K2(J,"http",f,U.status);if(!U.ok&&K.limitFromResponse){let I=await K.limitFromResponse({status:U.status,headers:U.headers,body:()=>U.clone().text(),attempt:w});if(I)m(J,I,"http")}if(!U.ok||!U.body)S(J);let q=U;if(U.body&&(K.inspectEvent||K.onAttemptEnd)){let I=U.body;if(K.inspectEvent)I=I.pipeThrough(I2((u)=>$2(J,"http",u.data,u.event),(u)=>c("opencode2 auth event inspection threw",{error:G(u)})));q=new Response(Q1(I,(u)=>S(J,u)),{status:U.status,statusText:U.statusText,headers:U.headers})}if(K.rewriteResponse)q=await K.rewriteResponse({...P,request:$.request,response:q,attempt:w})??q;if(q!==U)$.response=q},t)),a.push(await Z.session.hook("experimental.ws.handshake",($)=>{if(N){let J=_(new Headers($.headers)),U=j2($.sessionID,$.kind);if(E.set($.sessionID,J),Q.delete(U),!J)return}return B(X2($),async(J)=>{let U;for(let q of Object.keys($.headers)){if(q.toLowerCase()!==V2)continue;U??=$.headers[q],delete $.headers[q]}let P=N?await F(X2($),"experimental.ws.handshake",J,"ws"):await x(X2($),"experimental.ws.handshake","ws",U,J);J();let w=y(P),f=P.attempt;if(!w||!f)throw l(P.scope);await b(P,async()=>{g2($.headers,P.headers);let q=K.rewriteHandshakeURL?.({...w,url:$.url,attempt:f});if(q!==void 0)$.url=q;if(L(P.scope,Object.entries($.headers)),N)Q.add(P.key)})})},t));let J2=K.rewriteWebSocketFrame?.bind(K);if(J2)a.push(await Z.session.hook("experimental.ws.send",async($)=>{let J=X2($);if(N&&!Q.has(j2(J.sessionID,J.kind)))return;let U=n(J.sessionID,J.kind),P=await J2({...J,attempt:U?.attempt,frame:$.frame});if(P!==void 0)$.frame=P},t));a.push(await Z.session.hook("experimental.ws.receive",($)=>{if(N&&!Q.has(j2($.sessionID,$.kind)))return;let J=n($.sessionID,$.kind);if(!J)return;try{$2(J,"ws",$.frame)}catch(U){c("opencode2 auth frame inspection threw",{error:G(U)})}},t)),a.push(await Z.session.hook("retry",async($)=>{if(N&&E.get($.sessionID)!==!0)return;let J=o($.sessionID);if(!J)return;let U=$.decision;if(J==="ambiguous"){await z("retry",{sessionID:$.sessionID,attempt:$.attempt,reason:"host-decides",hostDecision:U,decision:U});return}let P=J;await B(P.scope,async(w)=>{P.judged=!0;let f=U,q,I,u=P.attempt;if(P.accountId===void 0||!u)f={retry:!1},q="no-account";else if(P.outputStarted)f={retry:!1},q="output-started";else{if(!P.limit){let G2=K.limitFromError?.($.error,u);if(G2)m(P,G2,"error")}if(P.ended)await P.ended,w();if(P.limit)await P.limit.delivered,w(),P.rerouted=!0,I={accountId:P.accountId,limit:P.limit.signal},f={retry:!0,delay:0},q="reroute";else q="host-decides"}if($.decision=f,f.retry&&P.accountId!==void 0)M.set(P.key,{sessionID:P.scope.sessionID,accountId:P.accountId,...I===void 0?{}:{rerouteFrom:I}});await z("retry",{sessionID:$.sessionID,...P.accountId===void 0?{}:{accountId:P.accountId},kind:P.scope.kind,attempt:$.attempt,reason:q,hostDecision:U,decision:f,...u===void 0?{}:{handle:u}})})},t));let H2=($)=>{Y($),E.delete($);for(let J of Q)if(JSON.parse(J)[0]===$)Q.delete(J);for(let J of[...X.values()]){if(J.scope.sessionID!==$)continue;A(J,"its session was forgotten"),X.delete(J.id)}for(let[J,U]of M)if(U.sessionID===$)M.delete(J)},Z2=new AbortController,o2=Z.event;if(o2)(async()=>{try{for await(let $ of o2.subscribe({signal:Z2.signal}))if($.type==="session.deleted")H2($.data.sessionID)}catch($){if(!Z2.signal.aborted)c("opencode2 auth stopped listening for session deletion",{error:G($)})}})();return{on($,J){let U=v.get($);if(!U)U=new Set,v.set($,U);let P=J;return U.add(P),()=>{U.delete(P)}},accountFor($,J){return h(j2($,J))?.accountId},forgetSession:H2,get size(){return X.size},async dispose(){if(s)return;s=!0;for(let $ of r.keys())Y($);Z2.abort();for(let $ of X.values())A($,"the installation was disposed");X.clear(),M.clear(),Q.clear(),E.clear(),v.clear(),await Promise.all(a.map(async($)=>{try{await $.dispose()}catch(J){c("opencode2 auth hook did not dispose cleanly",{error:G(J)})}}))}}}var e2="native-claude-oauth",$$="native-claude-vault";import{createHash as U1}from"node:crypto";var M2="anthropic",M$="x-common-auth-attempt",C1=["x-session-affinity","x-opencode-session","x-parent-session-id",j$,E2,_2,M$],O2=new Set(["authorization","x-api-key"]),L1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",M1=512,_1=5000,N1=500,K$=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class _$ extends Error{sessionID;requestKind;kind="no-account";providerID=M2;constructor(Z,K){super(L1);this.sessionID=Z;this.requestKind=K;this.name="NativeAnthropicNoAccountError"}}class l2 extends Error{sessionID;requestKind;kind="session-forgotten";providerID=M2;constructor(Z,K){super("request refused: its session was closed while it was being prepared");this.sessionID=Z;this.requestKind=K;this.name="NativeAnthropicRevokedError"}}class Q2 extends Error{kind="unsupported-transport";providerID=M2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class N$ extends Error{kind="local-invalid-request";status=400;check;constructor(Z){super(Z.message,{cause:Z});this.name="NativeAnthropicLocalRefusal",this.check=Z.check}}var B2=(Z)=>typeof Z==="object"&&Z!==null&&!Array.isArray(Z);function L2(Z){try{return JSON.parse(Z)}catch{return}}function v2(Z){let K={};for(let[C,W]of Object.entries(Z??{}))K[C.toLowerCase()]=W;return K}function Z$(Z){let K={};for(let C of C1){let W=Z.get(C);if(W!==null&&C!==M$)K[C]=W;Z.delete(C)}return K}function P1(Z){try{return new URL(Z).pathname.endsWith("/messages")}catch{return!1}}function T1(Z){return Z instanceof J$||Z instanceof B$?new N$(Z):void 0}function F1(Z,K){let C=[];if(Z.oauth)C.push(Z.oauth.accessToken);for(let[W,N]of Object.entries(Z.apiHeaders??{})){if(N===null||!O2.has(W))continue;C.push(N.replace(/^Bearer\s+/i,""))}for(let W of O2){let N=K.get(W);if(N!==null)C.push(N.replace(/^Bearer\s+/i,""))}if(Z.dispatch?.kind==="http-relay")C.push(Z.dispatch.token);return[...new Set(C.filter(Boolean))]}var O1=new Set(["oauth-2025-04-20","claude-code-20250219",V$]);function E1(Z){let K=Z.split(",").map((C)=>C.trim()).filter((C)=>C&&!O1.has(C));return X$(null,K)}function S1(Z){let K=L2(Z);if(!B2(K))return Z;let C=z$(K.messages),W=Object.hasOwn(K,"fallbacks"),{droppedMarkers:N}=Q$(K,!1),_=W&&!Object.hasOwn(K,"fallbacks"),T=W$(K);return C>0||N>0||_||T?JSON.stringify(K):Z}async function x1(Z,K){if(!(Z instanceof Promise))return"settled";let C;try{return await Promise.race([Z.then(()=>"settled"),new Promise((W)=>{C=setTimeout(()=>W("timed-out"),K)})])}finally{if(C!==void 0)clearTimeout(C)}}function S2(Z){let{source:K,log:C}=Z,W=Math.max(1,Z.maxPendingSends??M1),N=Z.attemptEndTimeoutMs??_1,_=new Map,T=new WeakMap,O=new WeakMap,V=new WeakMap,X=new Map,H=new WeakMap,M=h2([]);M.dispose();let Q=(Y)=>(Y&&X.get(Y)?.redactor)??M,E=(Y)=>{let B=X.get(Y);if(!B)return;X.delete(Y),B.redactor.dispose(),B.scope.dispose()},g=(Y,B,L,R)=>{let F=F1(B,R),x=m2(F,L);D.set(Y,L),X.set(Y,{sessionID:B.sessionID,redactor:h2(F),scope:x}),x.settled.then(()=>E(Y));while(X.size>W){let b=X.keys().next().value;if(b===void 0)break;E(b)}},D=new WeakMap,v=(Y,B)=>{let L=Y?D.get(Y):void 0;if(!L||!B.ok)return M.redactResponse(B);let R=m2([],L),F=R.redactResponse(B);return R.dispose(),F},i=(Y,B)=>{let L=Y?X.get(Y)?.scope:void 0;if(!L)return v(Y,B);try{return L.redactResponse(B)}catch{return v(Y,B)}},s=!1,r=new WeakMap,c=(Y,B)=>{if(Y&&!B.ok)r.set(B.headers,Y);return B},G=(Y,B)=>{if(B.dispatch!=="http-relay")return!0;let L=/^req_[A-Za-z0-9_-]+$/.test(Y.get("request-id")??"");return O.set(B,L),L},z=(Y)=>new _$(Y.sessionID,Y.kind),j=new Map,S=async(Y,B)=>{if(s)throw new l2(Y.sessionID,Y.kind);let L={revoked:!1},R=j.get(Y.sessionID);if(!R)R=new Set,j.set(Y.sessionID,R);R.add(L);let F=()=>{if(s||L.revoked)throw new l2(Y.sessionID,Y.kind)};try{let x=await B(F);return F(),x}finally{let x=j.get(Y.sessionID);if(x?.delete(L)&&x.size===0)j.delete(Y.sessionID)}},A=(Y,B)=>{_.set(Y,B);while(_.size>W){let L=_.keys().next().value;if(L===void 0)break;_.delete(L),C?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:W})}},k=(Y,B)=>({providerID:Y.providerID,modelID:Y.modelID,sessionID:Y.sessionID,agent:Y.agent,kind:Y.kind,accountId:Y.accountId,attemptId:Y.attemptId,transport:Y.transport,route:B.route,provenance:B.provenance,dispatch:B.dispatch}),h=(Y)=>S(Y,async(B)=>{let{accountId:L,...R}=Y,F=await K.authorizeAccount(R,L);return B(),d(R,F)}),d=(Y,B)=>{if(!B)throw z(Y);if(B.dispatch?.kind==="websocket-relay")throw new Q2;let L=B.dispatch?.kind==="http-relay"?"http-relay":"direct",R=B.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":B.dispatch.token}:void 0;if(B.route==="oauth"){if(!B.accessToken)throw z(Y);G$(B.accessToken,M2);let b=Object.freeze({route:"oauth",provenance:B.provenance,dispatch:L});A(b,{sessionID:Y.sessionID,oauth:{accessToken:B.accessToken,...B.identity?{identity:B.identity}:{}},dispatch:B.dispatch,oauthHeaders:B.headers});let n=v2(B.headers);for(let m of O2)delete n[m];return delete n["anthropic-beta"],{headers:R??{...n,"x-api-key":null,authorization:`Bearer ${B.accessToken}`},attempt:b}}let F={authorization:null,"x-api-key":null,...v2(B.headers)};if(!F.authorization&&!F["x-api-key"])throw z(Y);let x=Object.freeze({route:"api",provenance:B.provenance,dispatch:L});return A(x,{sessionID:Y.sessionID,...B.baseURL?{baseURL:B.baseURL}:{},dispatch:B.dispatch,apiHeaders:F}),{headers:R??F,attempt:x}},p=(Y)=>S(Y,(B)=>y(Y,B)),y=async(Y,B)=>{let{request:L,attempt:R}=Y,F=R.data,x=F?_.get(F):void 0;if(F)_.delete(F);if(!F||!x||F.route==="oauth"&&!x.oauth)throw z(Y);let b=new Headers(L.headers);Y$(b);let n=Z$(b),m=L.body===null?void 0:await L.text();B();let K2=m!==void 0&&P1(L.url);try{if(F.route==="oauth"&&x.oauth){let{accessToken:e,identity:o}=x.oauth;for(let[a,J2]of Object.entries(v2(x.oauthHeaders))){if(O2.has(a))continue;if(J2===null)b.delete(a);else b.set(a,J2)}let t=null;if(m!==void 0&&K2){let a={...k(R,F),modelID:(()=>{let Z2=L2(m);return Y2(B2(Z2)&&typeof Z2.model==="string"?Z2.model:Y.modelID)})(),route:"oauth",correlation:n},J2=await K.requestOptions?.(a)??{};B(),m=await C$(m,{...J2,...o?{identity:o}:{},sessionId:Y.sessionID,onToolNameMap:(Z2)=>V.set(F,Z2)});let H2=L2(m);t=B2(H2)?H2:null}H$(b,e,{body:t,...o?{identity:o}:{}})}else{if(m!==void 0&&K2)m=S1(m);b.delete("authorization"),b.delete("x-api-key");for(let[o,t]of Object.entries(x.apiHeaders??{}))if(t===null)b.delete(o);else b.set(o,t);if(m!==void 0&&K2&&!b.has("content-type"))b.set("content-type","application/json");let e=b.get("anthropic-beta");if(e!==null){let o=E1(e);if(o)b.set("anthropic-beta",o);else b.delete("anthropic-beta")}}}catch(e){let o=T1(e);if(!o)throw e;throw T.set(F,o.check),C?.warn("refused an Anthropic request locally; nothing was sent",{check:o.check}),o}let $2=m!==void 0?L2(m):void 0;if(await K.admitRequest?.({...k(R,F),modelID:Y2(B2($2)&&typeof $2.model==="string"?$2.model:Y.modelID)}),Z$(b),m!==void 0)b.delete("content-length");B(),g(F,x,B2($2)&&$2.stream===!0?"event-stream":"http",b);let W2=U$(L.url,x.baseURL!==void 0?{baseURL:x.baseURL}:{}).url?.toString()??L.url;if(x.dispatch?.kind==="http-relay"){let e=m??"";b.delete("x-relay-token");let o={protocol:1,type:"request",affinity:Y.sessionID,upstream:{url:W2,method:L.method,headers:Object.fromEntries(b)},mode:"full_sync",revision:1,body:e,next_hash:`sha256:${U1("sha256").update(e).digest("hex")}`};return new Request(x.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":x.dispatch.token},redirect:"error",signal:L.signal,body:JSON.stringify(o)})}return new Request(W2,{method:L.method,headers:b,redirect:L.redirect,signal:L.signal,...m!==void 0?{body:m}:{}})};return{adapter:{providerID:M2,chooseAccount:(Y)=>S(Y,async()=>{let B=await K.chooseAccount(Y);if(!B)throw z(Y);return B}),accountHeaders:h,rewriteRequest:p,rewriteHandshakeURL(){throw new Q2},rewriteResponse({response:Y,attempt:B}){let L=B.data;if(L&&!G(Y.headers,L)){if(Y.status===401)return E(L),Y.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return i(L,Y)}let R=i(L,Y);if(L?.route!=="oauth"||!R.body)return c(L,R);let F={...k(B,L),status:Y.status},x=K.responseOptions?.(F)??{},b=(Y.headers.get("content-type")??"").includes("application/json");return c(L,L$(R,{...x,toolNameMap:V.get(L),onToolNameRefusal:()=>{T.set(L,"response_tool_names"),E(L)},laneStartOAuthServed:!0,...b?{responseMode:"json"}:{}}))},quotaFromHeaders(Y,B,L){let R=L.data;if(!R||!G(Y,R))return;return K.quotaFromHeaders?.(Y,{...k(L,R),status:B})},async limitFromResponse({status:Y,headers:B,body:L,attempt:R}){let F=R.data;if(!F||T.get(F)==="response_tool_names")return;if(!G(B,F))return K.limitFromRelayFailure?.({...k(R,F),status:Y});if(H.set(F,`provider responded with HTTP ${Y}`),!K.limitFromResponse)return;let x=r.get(B)===F,b=Q(F);return K.limitFromResponse({...k(R,F),status:Y,headers:B,body:async()=>x?await L():b.redactText(await L())})},inspectEvent({data:Y,event:B,attempt:L}){if(L.data&&T.get(L.data)==="response_tool_names")return;let R=L2(Y);if(!B2(R))return;let F=typeof R.type==="string"?R.type:B;if(F==="content_block_start"||F==="content_block_delta")return{outputStarted:!0};if(F==="message_stop")return{done:!0};if(F!=="error")return;let x=L.data,b=Q(x),n=B2(R.error)?R.error:{},m=typeof n.type!=="string"?void 0:K$.has(n.type)?n.type:b.redactText(n.type),K2=typeof n.message==="string"?b.redactText(n.message):void 0;if(x?.dispatch==="http-relay"&&O.get(x)===!1)return;let $2=x?K.limitFromStreamError?.({...k(L,x),errorType:m,message:K2}):void 0,W2={error:[m??"error",K2].filter(Boolean).join(": ").slice(0,N1),...$2?{limit:$2}:{}};if(x&&W2.error)H.set(x,W2.error);return W2},limitFromError(Y,B){let L=B.data;if(!L||T.has(L))return;let R={type:K$.has(Y.type)?Y.type:"provider_error",message:H.get(L)??"provider request failed",...Y.status!==void 0?{status:Y.status}:{}};if(E(L),L.dispatch==="http-relay"&&O.get(L)===!1)return;return K.limitFromHostError?.(R,k(B,L))},async onAttemptEnd(Y,B){let L=Y.data;if(!L)return;_.delete(L);let R=B.error?.reason;if(R==="cancelled"||R==="abandoned"||R===void 0&&(B.status===void 0||B.status<400))E(L);let F=T.get(L),{status:x,...b}=B,n=K.onAttemptEnd?.(k(Y,L),{...b,...x!==void 0&&(L.dispatch!=="http-relay"||O.get(L)===!0)?{status:x}:{},...F!==void 0?{localRefusal:{check:F}}:{}});if(await x1(n,N)==="timed-out")C?.warn("the account source did not finish recording a send",{timeoutMs:N})}},dispose(){s=!0;for(let[Y,B]of j){for(let L of B)L.revoked=!0;K.forgetSession?.(Y)}j.clear(),_.clear();for(let Y of[...X.keys()])E(Y)},forgetSession(Y){for(let B of j.get(Y)??[])B.revoked=!0;j.delete(Y);for(let[B,L]of _)if(L.sessionID===Y)_.delete(B);for(let[B,L]of[...X])if(L.sessionID===Y)E(B);K.forgetSession?.(Y)},get pendingSendCount(){return _.size},get heldCredentialCount(){let Y=0;for(let B of _.values())if(B.oauth)Y++;return Y},get heldRedactorCount(){return X.size},get operationsInProgress(){let Y=0;for(let B of j.values())Y+=B.size;return Y}}}async function P$(Z,K,C){let W=S2(K),N=[],_=async(Q,E,g)=>{let D=await Z.session.hook(Q,E,g);return N.push(D),D},T=new AbortController,O;try{O=await f2({session:{hook:_},event:Z.event},W.adapter,{logger:K.log,gateOnPlaceholder:C})}catch(Q){throw W.dispose(),await Promise.allSettled(N.map((E)=>E.dispose())),Q}let V=(Q)=>{W.forgetSession(Q),O.forgetSession(Q)},X=Z.event,H=X?(async()=>{try{for await(let Q of X.subscribe({signal:T.signal}))if(Q.type==="session.deleted")V(Q.data.sessionID)}catch(Q){if(!T.signal.aborted)K.log?.warn("stopped listening for session deletion",{error:Q instanceof Error?Q.name:"unknown"})}})():Promise.resolve(),M;return{installation:O,forgetSession:V,dispose(){if(M)return M;return W.dispose(),T.abort(),M=(async()=>{await O.dispose(),await H})(),M}}}function F$(Z,K){let C=new AbortController,W,N=!1,_=async()=>{let V=await Z.read();if(C.signal.throwIfAborted(),V.policyStorage.relay?.enabled===!0&&V.policyStorage.relay.transport!=="http")return;let X=V,H=A2(X.policyStorage);for(let M of X.accounts){if(C.signal.aborted)return;if(!M.enabled||M.type!=="oauth")continue;if(X.policyStorage.quota?.enabled!==!1&&Date.now()-x2(M.quota)>=H)await Z.fetchQuota(M.id,K,C.signal).catch(()=>{});if(!T$(M.profile)&&!C.signal.aborted)await Z.fetchProfile(M.id,K,C.signal).catch(()=>{})}},T=()=>{if(N||W)return W;return W=_().catch(()=>{if(!C.signal.aborted)R2.debug("opencode2","native background readings did not complete")}).finally(()=>{W=void 0}),W},O=Z.vault.watch({intervalMs:60000,onRefresh:T,shouldRefresh:async()=>{let V=await Z.read();return V.policyStorage.relay?.enabled!==!0||V.policyStorage.relay.transport==="http"}});return O.ready.catch(()=>{}),{async dispose(){N=!0,O.close(),C.abort(),await W}}}var u2=(Z)=>Z!==null&&typeof Z==="object"&&!Array.isArray(Z)?Z:{};function D$(Z){let{runtime:K,source:C}=Z,W=new Map,N=!1,_=async(X,H)=>{await K.updateSettings((M)=>({...M,[X]:{...u2(M[X]),...H}}))},T=()=>({ok:!0,text:"Native Claude settings updated."}),O=async(X,H)=>{if(N)throw Error("Native menu is closed");switch(H.signal?.throwIfAborted(),X.action){case"enable":case"disable":return await K.setEnabled(X.values.id,X.action==="enable"),T();case"remove":return await K.remove(X.values.id),T();case"move-up":case"move-down":{let Q=(await K.read()).accounts.map((i)=>i.id),E=Q.indexOf(X.values.id),g=E+(X.action==="move-up"?-1:1);if(E<0||g<0||g>=Q.length)return{ok:!1,text:"Account cannot move in that direction."};let D=Q[E],v=Q[g];if(D===void 0||v===void 0)return{ok:!1,text:"Account order changed."};return Q[E]=v,Q[g]=D,await K.reorder(Q),T()}case"add-apikey":return await K.addApi(X.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let M=new AbortController;W.get(X.sessionId)?.active.abort();let Q={active:M,auth:void 0};W.set(X.sessionId,Q);let E=await q2("max");if(N||M.signal.aborted||H.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return Q.auth=E,{ok:!0,text:`Open ${E.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let M=W.get(X.sessionId);if(!M?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let Q=await k2(X.values.code,M.auth.verifier,M.auth.redirectUri,M.auth.state);if(M.active.signal.throwIfAborted(),H.signal?.throwIfAborted(),N||Q.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await K.loginOAuth({routeId:crypto.randomUUID(),credential:Q,label:X.values.label}),M.active.signal.throwIfAborted(),H.signal?.throwIfAborted(),N)return{ok:!1,text:"Sign-in cancelled."};return W.delete(X.sessionId),{ok:!0,text:"OAuth account stored in the native account pool."}}case"reset-backoff":{let M=await K.read();for(let Q of M.accounts){if(H.signal?.throwIfAborted(),Q.type!=="oauth")continue;let E=Q.source==="vault"?await K.authorizeVault(Q.id,H.signal):await K.captureLocalSubject(Q.id);await K.resetBackoff(Q.id,E)}return T()}case"enrollment-reset":{let M=await S$(E$("opencode"),O$);return{ok:M==="reset",text:M==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let Q=(await K.read()).accounts.filter((D)=>D.type==="oauth"&&D.enabled),E=await Promise.allSettled(Q.map((D)=>K.fetchQuota(D.id,void 0,H.signal)));return{ok:E.every((D)=>D.status==="fulfilled"),text:`${E.filter((D)=>D.status==="fulfilled").length}/${Q.length} native quota readings refreshed.`}}case"routing-reset":return await C.resetRouting(X.sessionId),T();case"routing-mode":return await _("routing",{mode:X.values.mode}),T();case"killswitch-on":case"killswitch-off":return await _("killswitch",{enabled:X.action==="killswitch-on"}),T();case"killswitch-set":return await K.updateSettings((M)=>{let Q=u2(M.killswitch),E={...u2(Q.accounts)},g=Q.main;for(let D of X.values.entries){let v={five_hour:D.fh,seven_day:D.sd,...D.scoped!==void 0?{scoped:D.scoped}:{}};if(D.account==="main"||D.account==="all")g=v;if(D.account==="all")for(let i of Object.keys(E))E[i]=v;else if(D.account!=="main")E[D.account]=v}return{...M,killswitch:{...Q,main:g,accounts:E}}}),T();case"cache-on":case"cache-off":return await _("claudeCache",{enabled:X.action==="cache-on"}),T();case"cache-mode":return await _("claudeCache",{mode:X.values.mode}),T();case"cachekeep-always":return await _("cacheKeep",{enabled:!0,always:!0}),T();case"cachekeep-off":return await _("cacheKeep",{enabled:!1}),T();case"cachekeep-window":return await _("cacheKeep",{enabled:!0,always:!1,startHour:X.values.startHour,endHour:X.values.endHour}),T();case"cachekeep-subagents":return await _("cacheKeep",{subagents:X.values.enabled==="on"}),T();case"dump-on":case"dump-off":return await _("dump",{enabled:X.action==="dump-on"}),T();case"logging-level":return await _("logging",{level:X.values.level}),T();case"fast-on":case"fast-off":return await _("claudeFast",{enabled:X.action==="fast-on"}),T();case"prime-on":case"prime-off":return await _("prime",{enabled:X.action==="prime-on"}),T();case"start-fire":return await V(X.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},V=(X)=>Z.start(X,D2);return{dispatch:O,async readStatus(X){let H=await K.read();if(X==="account")return H.accounts.map((Q)=>`${Q.id}${Q.label?` (${Q.label})`:""}: ${Q.type}, ${Q.source}, ${Q.enabled?"enabled":"disabled"}${Q.state?`, ${A$(Q)}`:""}${Q.accountIdentity?`, ${Q.accountIdentity}`:""}`).join(`
-`)||"No native Claude accounts.";if(X==="quota")return k$({accounts:H.accounts.filter((Q)=>Q.type==="oauth").map((Q)=>({name:Q.label??Q.id,role:Q.id==="main"?"main":"fallback",enabled:Q.enabled,quota:Q.quota,tierLabel:x$(Q.profile),lastRefreshedAt:Q.lastRefreshedAt,error:Q.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(X==="prime")return q$({enabled:H.policyStorage.prime?.enabled===!0,accounts:R$(H.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");let M={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(H.settings[M[X]]??{})},forgetSession(X){W.get(X)?.active.abort(),W.delete(X)},close(){N=!0;for(let X of W.values())X.active.abort();W.clear()}}}function g$(){let Z=new Map;return{install:(C)=>C.model.transform((W)=>{Z.clear();for(let N of W.list("anthropic")){if(Z.set(String(N.id),String(N.modelID)),!(b$(N.modelID)||I$(N.modelID)||w$(N.modelID)||y$(N.modelID)))continue;W.update("anthropic",String(N.id),(_)=>{let T=["low","medium","high","xhigh","max"],O=_.variants.filter((V)=>!T.some((X)=>X===String(V.id)));_.variants=[...O,...T.map((V)=>({id:V,settings:{effort:V,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(C)=>Z.get(C)??C}}function f$(Z){return Z.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??Z.get("x-api-key")??void 0}var v$=(Z)=>Z!==null&&typeof Z==="object"&&!Array.isArray(Z)?Z:{};function m$(Z){let{runtime:K,source:C}=Z,W=new AbortController,N=new Set,_=(V)=>({providerID:"anthropic",modelID:p2().model,sessionID:`oc2-prime:${V}`,agent:"prime",kind:"generate"}),T=async(V)=>{let X=_(V),H=S2({source:C}),M=performance.now();try{for(let Q=0;Q<3;Q++){if(W.signal.throwIfAborted(),(await K.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let g=await H.adapter.accountHeaders({...X,accountId:V});if(!("headers"in g)||typeof g.headers!=="object"||g.headers===null||typeof g.attempt!=="object"||g.attempt===null)throw Error("Native Prime authorization refused");let D={...X,accountId:V,attemptId:crypto.randomUUID(),transport:"http",data:g.attempt},v,i=!1,s=!1,r=(c)=>{s=!0,c.body?.cancel().catch(()=>{})};try{let c=await H.adapter.rewriteRequest?.({...X,accountId:V,attempt:D,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(p2()),signal:W.signal})});if(!c)throw Error("Native Prime rewrite refused");let G=new Headers(c.headers);for(let[p,y]of Object.entries(g.headers))if(y===null)G.delete(p);else G.set(p,y);let z=new Request(c,{headers:G}),j=await(Z.fetch??fetch)(z),S=await H.adapter.rewriteResponse?.({...X,accountId:V,request:z,response:j,attempt:D})??j;v=S.status,H.adapter.quotaFromHeaders?.(S.headers,S.status,D);let A=S.ok?void 0:await H.adapter.limitFromResponse?.({status:S.status,headers:S.headers,body:()=>S.clone().text(),attempt:D});if(A&&/^(vault-newer|local-newer|relay-direct):/.test(A.reason)&&Q<2){if(r(S),await C.chooseAccount({...X,rerouteFrom:{accountId:V,limit:A}})!==V)throw Error("Native Prime retry changed account");continue}if(!S.ok)return r(S),{ok:!1,status:v,ms:performance.now()-M,error:"Native Prime upstream refused the request"};let k=v$(await S.json()),h=v$(k.usage),d={inputTokens:typeof h.input_tokens==="number"?h.input_tokens:void 0,outputTokens:typeof h.output_tokens==="number"?h.output_tokens:void 0};if(D.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(S.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(i=await C.recordPrime(g.attempt.provenance,d),!i)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:v,ms:performance.now()-M,usage:d}}finally{await H.adapter.onAttemptEnd?.(D,{status:v,outputStarted:!1,...i?{}:{error:{reason:s?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-M}}finally{H.dispose()}},O=new h$({storagePath:Z.paths.legacyConfig,loadStorage:async()=>(await K.read()).policyStorage,async getAccountFingerprint(V){let X=await K.read(),H=X.accounts.find((Q)=>Q.id===V);if(!H?.enabled||H.type!=="oauth")return;if(X.policyStorage.relay?.enabled===!0&&X.policyStorage.relay.transport!=="http")return;if(H.source==="vault"){let Q=await K.authorizeVault(V,W.signal);return K.getOrCreateAuthLineage(V,Q)}let M=await K.authorizeLocal(V,{signal:W.signal});return M.status==="usable"?K.getOrCreateAuthLineage(V,M.subject):void 0},async refreshQuota(V){let X=await K.read();if(X.policyStorage.relay?.enabled===!0&&X.policyStorage.relay.transport!=="http")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await K.fetchQuota(V,Z.fetch,W.signal),fresh:!0}},sendPrime(V){let X=T(V);return N.add(X),X.finally(()=>N.delete(X)),X},async recordSuccess(V){let X=(await K.read()).accounts.find((H)=>H.id===V);if(!X?.prime)throw Error("Native Prime counters are unavailable");return X.prime}});return O.start(),{manager:O,async dispose(){O.stop(),W.abort(),await Promise.allSettled(N)}}}var d2=(Z)=>["five_hour","seven_day"].some((K)=>(Z?.[K]?.remainingPercent??1)<=0);function t$(Z){let{runtime:K}=Z,C=i$("native-auth"),W=new Map,N=(G)=>{let z=G.routingPath;if(!z)throw Error("Native routing storage is unavailable");let j=W.get(z);if(!j)j=new c$({path:z,vaultSeed:G.routingSeed,localRecoveryPath:G.mode==="local"?G.routingRecoveryPath:void 0}),W.set(z,j);return j.setVaultSeed(G.routingSeed),j},_=new WeakMap,T=new Map,O=new Map,V=new Map,X=new WeakSet,H=!1,M=()=>{while(T.size>512){let G=T.keys().next();if(!G.done)T.delete(G.value)}},Q=(G,z)=>JSON.stringify([G.sessionID,G.kind,G.modelID,z]),E=(G)=>{if(H)throw Error("Native Anthropic source is closed");let z=V.get(G.sessionID);if(!z){z=new AbortController,V.set(G.sessionID,z);while(V.size>512){let j=V.keys().next();if(!j.done)r.forgetSession?.(j.value)}}return z},g=(G,z,j)=>G.enabled&&(G.type==="api"||T2(G,z,Y2(j)).status==="allowed"),D=async(G,z,j,S)=>{let A=await K.read();S.signal.throwIfAborted(),v(A);let k=A.accounts.find((h)=>h.id===G);if(!k||k.type!==j||!g(k,A,z))return!1;if(j==="api"){let h=A.accounts.find((d)=>d.id==="main"&&d.type==="oauth");return!!h&&P2(h.quota,A.policyStorage)&&d2(h.quota)}return!0},v=(G)=>{let z=G.policyStorage.relay;if(z?.enabled===!0&&z.transport!=="http")throw new Q2},i=async(G,z)=>{if(v(G),z||G.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let j=await K.getRelayConfig();if(!j)throw Error("request refused: native HTTP relay configuration is unavailable");if(j.transport!=="http")throw new Q2;return{dispatch:{kind:"http-relay",url:j.url,token:j.token},relayFallback:j.fallbackToDirect}};async function s(G,z,j){if(G.kind==="local")await K.publishLocal(G.subject,j);else if(G.kind==="vault"&&z.receipt)await K.vault.publish(z.receipt,j);else if(G.kind==="api"&&j.lastUsed!==void 0)await K.publishApi(G.subject,{lastUsed:j.lastUsed})}let r={async chooseAccount(G){let z=E(G);Z.onOwnedRequest?.();let j=await K.read();z.signal.throwIfAborted(),v(j);let S=Y2(await Z.resolveModelId?.(G)??G.modelID);if(z.signal.throwIfAborted(),j.mode==="claustrum")j=await n$(K,z.signal),z.signal.throwIfAborted();if(j.policyStorage.quota?.enabled!==!1){let y=!1;for(let l of j.accounts){if(!l.enabled||l.type!=="oauth")continue;if(p$(l.quota)?P2(l.quota,j.policyStorage,Date.now(),S):Date.now()-x2(l.quota)<A2(j.policyStorage))continue;try{await K.fetchQuota(l.id,Z.fetch,z.signal),y=!0}catch{z.signal.throwIfAborted()}}if(y)j=await K.read();z.signal.throwIfAborted()}let A=G.rerouteFrom?T.get(G.rerouteFrom.limit.reason):void 0;if(G.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(G.rerouteFrom.limit.reason)&&!A)return;if(A&&G.rerouteFrom){T.delete(G.rerouteFrom.limit.reason);let y=j.accounts.find((B)=>B.id===A.accountId);if(!y||!g(y,j,S))return;let l=Q(G,A.accountId),Y=O.get(l)??[];return Y.push(A),O.set(l,Y),A.accountId}let k=[];for(let y of j.accounts){if(y.type!=="oauth"||!g(y,j,S))continue;if(y.source==="local"){let l=await K.authorizeLocal(y.id,{signal:z.signal,policy:(Y,B)=>T2(Y,B,S)});if(z.signal.throwIfAborted(),l.status!=="usable")continue}k.push(y)}let h=k.filter((y)=>y.id!==G.rerouteFrom?.accountId);if(c2(j.policyStorage)==="sticky-balanced"){let y=h.map((Y,B)=>({accountId:Y.id,order:B,quota:Y.quota??{kind:"unknown"}})),l=await N(j).resolve({sessionId:G.sessionID,family:d$(S),modelId:S,affinityModelId:G.modelID,candidates:y,retainAccountIds:new Set(h.map((Y)=>Y.id)),...j.mode==="claustrum"?{accountIdentities:new Map(j.accounts.flatMap((Y)=>Y.accountIdentity?[[Y.id,Y.accountIdentity]]:[]))}:{},storage:j.policyStorage,inputBytes:1,preferredAccountId:G.previousAccountId});if(z.signal.throwIfAborted(),l)return l.accountId}else{let l=c2(j.policyStorage)==="fallback-first"?[...h.filter((Y)=>Y.id!=="main"),...h.filter((Y)=>Y.id==="main")]:[...h.filter((Y)=>Y.id==="main"),...h.filter((Y)=>Y.id!=="main")];if(l[0])return l[0].id}if(j.mode==="claustrum")throw new o$;let d=j.accounts.find((y)=>y.id==="main"&&y.type==="oauth");if(!d)return;let p=d.quota;if(G.rerouteFrom?.limit.status===429||!P2(p,j.policyStorage))try{p=await K.fetchQuota("main",Z.fetch,z.signal)}catch{return}if(z.signal.throwIfAborted(),!d2(p))return;return j.accounts.find((y)=>y.type==="api"&&y.enabled&&y.id!==G.rerouteFrom?.accountId)?.id},async authorizeAccount(G,z){let j=E(G),S=await K.read();j.signal.throwIfAborted(),v(S);let A=Y2(await Z.resolveModelId?.(G)??G.modelID);j.signal.throwIfAborted();let k=S.accounts.find((F)=>F.id===z);if(!k||!g(k,S,A))return;let h=Q(G,z),d=O.get(h),p=d?.shift();if(d?.length===0)O.delete(h);let{dispatch:y,relayFallback:l}=await i(S,p?.direct===!0);if(j.signal.throwIfAborted(),p?.auth){if(!await D(z,A,p.auth.route,j))return;let F=_.get(p.auth.provenance);if(F?.receipt?.expiresAtMs!==void 0&&F.receipt.expiresAtMs!==null&&F.receipt.expiresAtMs<Date.now()+300000)return;if(F)_.set(p.auth.provenance,{...F,scope:{...G,modelID:A},account:k,active:j,relayFallback:l});return{...p.auth,dispatch:y}}let Y={scope:{...G,modelID:A},active:j,account:k,retry:p?.retry??!1,relayFallback:l,quota:k.quota};if(k.type==="api"){let F=S.accounts.find((m)=>m.id==="main"&&m.type==="oauth");if(!F||!P2(F.quota,S.policyStorage)||!d2(F.quota))return;let x=await K.authorizeApi(z,j.signal);if(j.signal.throwIfAborted(),!await D(z,A,"api",j))return;let b={kind:"api",subject:x.subject};return _.set(b,Y),{route:"api",headers:x.authHeader==="authorization-bearer"?{authorization:`Bearer ${x.apiKey}`}:{"x-api-key":x.apiKey},baseURL:x.baseURL,provenance:b,dispatch:y}}if(k.source==="vault"){let F=await K.authorizeVault(z,j.signal);if(j.signal.throwIfAborted(),!await D(z,A,"oauth",j))return;let x={kind:"vault",credentialId:F.credentialId,recordVersion:F.recordVersion};_.set(x,{...Y,receipt:F});let b=F.assertedAccountIdentity;if(!b)return;return{route:"oauth",accessToken:F.accessToken,provenance:x,dispatch:y,identity:N2(b,b)}}let B=await K.authorizeLocal(z,{signal:j.signal,policy:(F,x)=>T2(F,x,A)});if(j.signal.throwIfAborted(),B.status!=="usable")return;if(!await D(z,A,"oauth",j))return;let L={kind:"local",subject:B.subject};_.set(L,{...Y,access:B.access});let R=B.subject.binding.identity;return{route:"oauth",accessToken:B.access,provenance:L,dispatch:y,identity:N2(R,R)}},async requestOptions(G){let z=E(G),j=await K.read();z.signal.throwIfAborted();let S=j.accounts.find((k)=>k.id===G.accountId);if(!S||!g(S,j,G.modelID))throw Error("request refused: native account is ineligible for this model");let A=_.get(G.provenance);if(A)_.set(G.provenance,{...A,scope:{...A.scope,modelID:G.modelID}});return Z.requestOptions(G,j)},async admitRequest(G){let z=_.get(G.provenance);if(!z||!await D(G.accountId,G.modelID,G.route,z.active))throw Error("request refused: native account policy changed before dispatch");_.set(G.provenance,{...z,scope:{...z.scope,modelID:G.modelID}})},responseOptions(G){return Z.responseOptions?.({...G,modelID:_.get(G.provenance)?.scope.modelID??G.modelID})},quotaFromHeaders(G,z){let j=_.get(z.provenance),S=a$(G);if(S)Z.onRequestId?.(z,S);if(!j||z.route!=="oauth"||!r$(G))return;let A=z.provenance.kind==="local"?z.provenance.subject.binding.identity:j.receipt?.assertedAccountIdentity,k={...s$(G),...A?{accountIdentity:A}:{}};j.quota=l$(j.quota,k);let h=C.observe(s(z.provenance,j,{quota:j.quota}));return c.set(z.provenance,h),k},async limitFromResponse(G){let z=_.get(G.provenance);if(!z)return;if(G.status===401&&z.receipt){if(!X.has(z.receipt))X.add(z.receipt),await K.vault.reportFailure(z.receipt,401,G.dispatch==="http-relay"?"relay_status_field":"direct");if(z.retry||z.active.signal.aborted)return;let S=z.active,A=await K.vault.prepareRetry(z.receipt,S.signal);if(S.signal.throwIfAborted(),!A.retry)return;let k=A.receipt,h=k.assertedAccountIdentity;if(!h)return;let d={kind:"vault",credentialId:k.credentialId,recordVersion:k.recordVersion};_.set(d,{...z,receipt:k,retry:!0});let p=`vault-newer:${G.attemptId}`;return T.set(p,{sessionID:G.sessionID,accountId:G.accountId,retry:!0,auth:{route:"oauth",accessToken:k.accessToken,provenance:d,identity:N2(h,h)}}),M(),{reason:p,status:401}}if(G.status===401&&G.provenance.kind==="local"&&z.access&&!z.retry){if(z.active.signal.aborted)return;let S=z.active,A=await K.authorizeLocal(G.accountId,{rejectedAccessToken:z.access,signal:S.signal,policy:(p,y)=>T2(p,y,z.scope.modelID)});if(S.signal.throwIfAborted(),A.status!=="usable"||A.access===z.access)return;let k={kind:"local",subject:A.subject};_.set(k,{...z,access:A.access,retry:!0});let h=A.subject.binding.identity,d=`local-newer:${G.attemptId}`;return T.set(d,{sessionID:G.sessionID,accountId:G.accountId,retry:!0,auth:{route:"oauth",accessToken:A.access,provenance:k,identity:N2(h,h)}}),M(),{reason:d,status:401}}let j=await K.read();if(u$(G.status,j.policyStorage))return{reason:`provider-${G.status}`,status:G.status};return},limitFromRelayFailure(G){let z=_.get(G.provenance);if(!z?.relayFallback||z.active.signal.aborted||!(G.status===401||G.status>=500))return;let j=`relay-direct:${G.attemptId}`;return T.set(j,{sessionID:G.sessionID,accountId:G.accountId,direct:!0,retry:!1}),M(),{reason:j}},limitFromStreamError(G){return G.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(G,z){let j=_.get(z.provenance);if(z.dispatch==="http-relay"&&j?.relayFallback&&!j.active.signal.aborted&&G.status===void 0){let S=`relay-direct:${z.attemptId}`;return T.set(S,{sessionID:z.sessionID,accountId:z.accountId,direct:!0,retry:!1}),M(),{reason:S}}return},async onAttemptEnd(G,z){let j=_.get(G.provenance);if(!j)return;try{if(await c.get(G.provenance),z.status===401&&j.receipt&&!X.has(j.receipt))X.add(j.receipt),await K.vault.reportFailure(j.receipt,401,G.dispatch==="http-relay"?"relay_status_field":"direct");if(!z.localRefusal&&z.status!==void 0)C.publish(()=>s(G.provenance,j,{lastUsed:Date.now()}))}finally{_.delete(G.provenance),c.delete(G.provenance)}},forgetSession(G){V.get(G)?.abort(),V.delete(G);for(let[z,j]of T)if(j.sessionID===G)T.delete(z);for(let[z,j]of O)if(j[0]?.sessionID===G)O.delete(z);Z.onForgetSession?.(G)},resetRouting:async(G)=>N(await K.read()).clear(G),async recordPrime(G,z){let j=_.get(G);if(!j||j.active.signal.aborted)return!1;if(G.kind==="local")return K.incrementPrimeUsage(j.account.id,G.subject,z);if(G.kind==="vault"&&j.receipt)return K.incrementPrimeUsage(j.account.id,j.receipt,z);return!1},close(){H=!0;for(let G of V.values())G.abort();return V.clear(),O.clear(),T.clear(),C.drain()}},c=new WeakMap;return r}function K1(){let Z=new e$,K=new Map,C=new Map,W=new Map,N=new Set,_=new Set,T=new Map,O=(V)=>{while(V.size>512){let X=V.keys().next();if(!X.done)V.delete(X.value)}};return{async install(V){let X=[];try{X.push(await V.session.hook("context",(H)=>{let M=H.messages.map((E)=>{return{info:{id:E.id,sessionID:H.sessionID,role:E.role,agent:H.agent,model:{providerID:H.model.providerID,modelID:H.model.id}},parts:E.content.map((g)=>({type:g.type,...g.type==="text"?{text:g.text}:{}}))}});Z.observeMessages(M);let Q=H.messages.findLast((E)=>E.role==="user"&&E.id);if(Q?.id)K.set(H.sessionID,Q.id);if(Q?.content.some((E)=>E.type==="text"&&E.text===D2))N.add(H.sessionID);else N.delete(H.sessionID);O(K)},{providerID:"anthropic"})),X.push(await V.session.hook("model.request",(H)=>{if(H.kind!=="primary")return;let M=K.get(H.sessionID);if(!M)return;if(Z.markHeaders({sessionId:H.sessionID,messageId:M,agent:H.agent,headers:H.headers}),N.has(H.sessionID))H.headers[_2]="1"},{providerID:"anthropic"}))}catch(H){throw await Promise.allSettled(X.map((M)=>M.dispose())),H}return{dispose:async()=>{await Promise.all(X.map((H)=>H.dispose()))}}},requestOptions(V,X){let H=Z.resolveHeader(V.correlation[E2]);if(H)C.set(V.attemptId,H),O(C);T.set(V.attemptId,V.sessionID),O(T);let M=V.correlation[_2]==="1";if(M)_.add(V.attemptId);return{cache1hEnabled:V.agent!=="compaction"&&V.agent!=="title"&&(X.policyStorage.claudeCache?.enabled??!0),cache1hMode:X.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:X.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:X.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,serverSideFallbackEnabled:$1(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:M,billingLineage:H?{promptId:H.promptId,previousRequestId:H.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:W.get(V.sessionID)}},responseOptions(V){return{serverSideFallbackModel:Y2(V.modelID),laneStart:_.has(V.attemptId),onMessageStart(X){if(V.kind==="primary"&&typeof X.id==="string")W.set(V.sessionID,X.id),O(W)},onStreamEnd(){C.delete(V.attemptId),_.delete(V.attemptId),T.delete(V.attemptId)}}},onRequestId(V,X){Z.commit(C.get(V.attemptId),X)},forgetSession(V){Z.clearSession(V),K.delete(V),W.delete(V),N.delete(V);for(let[X,H]of T)if(H===V)C.delete(X),_.delete(X),T.delete(X)}}}var b2="cortexkit-anthropic-auth",A1='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',R1="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",q1="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function k1(Z){let K=Z.authorize??q2,C=Z.exchange??k2,W=()=>{if(!Z.isActive())throw Error("Claude authentication setup is closed")},N=async()=>{let O;try{O=await Z.readMode()}catch{throw Error(q1)}return W(),O},_=async()=>{if(await N()!=="local")throw Error(A1)};return{integrationID:"anthropic",methods:[{method:{id:e2,type:"oauth",label:"Claude Pro / Max (native account pool)"},async authorize(){W(),await _();let O=await K("max");return W(),{mode:"code",url:O.url,instructions:"Paste the authorization code returned by Claude.",callback:async(V)=>{W();let X=await C(V,O.verifier,O.redirectUri,O.state);if(!Z.isActive()||X.type!=="success")throw Error("Claude sign-in did not complete");return{access:X.access,refresh:X.refresh,expires:X.expires}}}}}],vault:{method:{id:$$,type:"oauth",label:"Claude vault accounts"},async activate(){if(W(),await N()!=="claustrum")throw Error(R1)}},async onLogin(O){W(),await _(),await Z.runtime.loginOAuth({routeId:"main",credential:O,replace:!0}),W()},label:"Claude native account pool"}}function D1(Z){return{readMode:()=>Z1("opencode",Z),disconnectVault:()=>W1({host:"opencode",env:Z})}}function i2(Z={}){return{id:b2,setup:(K)=>z1(K,Z)}}async function z1(Z,K={}){let C=K.paths??await X1(),W=G1({paths:C,host:"opencode",local:K.local,vault:K.vault}),N=D1(K.vault?.env??process.env),_=!0,T=K1(),O=g$(),V,X,H=t$({runtime:W,paths:C,fetch:K.fetch,requestOptions:T.requestOptions,responseOptions:T.responseOptions,onRequestId:T.onRequestId,onForgetSession:T.forgetSession,resolveModelId:async(v)=>O.modelId(v.modelID),onOwnedRequest:()=>{V??=F$(W,K.fetch),X??=m$({runtime:W,paths:C,source:H,fetch:K.fetch})}}),M=D$({runtime:W,source:H,start:async(v,i)=>{await Z.session.synthetic({sessionID:v,text:i,description:"Claude lane start",resume:!0})}}),Q=[],E=await P$(Z,{source:H,log:{warn:(v,i)=>R2.warn("opencode2",v,i)}},{credential:f$}).catch((v)=>{throw M.close(),H.close(),W.close(),v}),g,D=()=>{if(g)return g;return _=!1,M.close(),H.close(),g=(async()=>{await Promise.allSettled([E.dispose(),V?.dispose(),X?.dispose(),...Q.map((v)=>v.dispose())]),await H.close(),W.close()})(),g};try{Q.push(await T.install(Z)),Q.push(await O.install(Z)),Q.push(await y2(Z,k1({isActive:()=>_,readMode:N.readMode,runtime:W})));let v={host:"opencode",dispatch:M.dispatch,readStatus:(s)=>M.readStatus(s),readAccounts:()=>W.read(),readMode:N.readMode,disconnectVault:N.disconnectVault,interactive:!0},i=Y1(v);return Q.push(await J1(Z,i,M)),D}catch(v){throw await D(),v}}var mK={id:b2,setup:i2().setup,server:j1};export{z1 as setupAnthropicAuth,mK as default,i2 as createAnthropicAuthPlugin,b2 as ANTHROPIC_AUTH_PLUGIN_ID};
+import{a as k2,b as B1,c as K1,d as H$,e as U$,f as f2,g as O2,h as L$,i as z1,j as M$,k as _$,l as C$,m as N$,n as P$,o as E1}from"../index-nfcp0m1t.js";import"../index-2arfb1y3.js";import"../index-rqync0pc.js";import{t as T1}from"../index-1jkyhgyr.js";import{u as N1,v as P1,x as F1}from"../index-kd89hcr3.js";import"../index-jmjevtm1.js";import"../index-qttfa42y.js";import{$c as q$,Ad as X1,Ae as V1,Eb as p$,Ee as d$,Fa as w2,Fe as K$,Ga as e$,Gd as x2,Ge as z$,Hc as p2,Hd as Y1,He as a2,Ic as c2,Lc as D$,Ld as G1,Ma as D2,Mc as w$,Nc as b$,Oa as $1,Ob as c$,Oc as _2,Od as L1,Pc as o2,Pd as V2,Qc as y$,Sc as E$,Tc as S$,Ua as b2,Uc as x$,Ud as M1,Vc as I$,Vd as R2,Xb as i$,Xc as f$,Zc as g$,_a as Z1,ad as v$,fc as o$,fd as B$,ia as j$,ie as _1,je as W1,ke as J1,la as V$,nc as S2,nd as j2,od as Q$,oe as C1,qe as m$,re as l$,ta as y2,td as X2,te as r2,ua as I2,ud as h$,ve as a$,wc as H2,wd as U1,ze as j1}from"../index-mdpyfkv3.js";import"../index-fncp6r0j.js";import"../index-5hyennzm.js";import"../index-rftced5v.js";class P2 extends Error{kind;providerID;sessionID;requestKind;constructor($){super($.message??`${$.providerID} ${$.requestKind} request refused (${$.kind})`);this.name="OpenCode2AuthError",this.kind=$.kind,this.providerID=$.providerID,this.sessionID=$.sessionID,this.requestKind=$.requestKind}}function Q2($){return`common-auth-placeholder.${$}`}function X$($){let X=Q2($.integrationID);return{type:"oauth",methodID:$.methodID,access:X,refresh:X,expires:$.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function v2($,X){if($?.type!=="oauth")return!1;let L=X===void 0?void 0:Q2(X),V=(C)=>L===void 0?C.startsWith("common-auth-placeholder."):C===L;return V($.access)&&V($.refresh)}var Y$="No browser sign-in: this connects the plugin to the accounts in its vault.";async function h2($,X){let L=X.now??Date.now,{integrationID:V}=X,C=(E)=>X$({integrationID:V,methodID:E,now:L()}),_=async(E,H)=>{return await X.onLogin(E,{integrationID:V,methodID:H}),C(H)},P=(E)=>async(H)=>{let Y=E.method.id,U=await E.authorize(H),Q={url:U.url,instructions:U.instructions,...U.expiresAt===void 0?{}:{expiresAt:U.expiresAt}};if(U.mode==="auto")return{...Q,mode:"auto",callback:U.callback.then((T)=>_(T,Y))};let K=U.callback;return{...Q,mode:"code",callback:async(T)=>_(await K(T),Y)}};return $.integration.transform((E)=>{let H=X.label===void 0?{}:{label:()=>X.label};for(let Q of X.methods)E.method.update({integrationID:V,method:Q.method,authorize:P(Q),refresh:async(K)=>{if(!v2(K,V))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return C(K.methodID)},...H});let Y=X.vault;if(Y===void 0)return;let U=Y.method.id;E.method.update({integrationID:V,method:Y.method,authorize:async()=>({url:"",instructions:Y.instructions??Y$,mode:"auto",callback:Promise.resolve().then(()=>Y.activate({integrationID:V,methodID:U})).then(()=>C(U))}),refresh:async(Q)=>{if(!v2(Q,V)||Q.methodID!==U)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return C(U)},...H})})}function S1($){let X=[],L;for(let V of $.split(/\r?\n/))if(V.startsWith("data:"))X.push(V.slice(5).replace(/^ /,""));else if(V.startsWith("event:"))L=V.slice(6).trim();if(X.length===0)return;return L===void 0?{data:X.join(`
+`)}:{event:L,data:X.join(`
+`)}}function m2($,X){let L=new TextDecoder,V="",C=(P)=>{let E=S1(P);if(!E)return;try{$(E)}catch(H){X(H)}},_=()=>{for(;;){let P=/\r?\n\r?\n/.exec(V);if(!P)return;let E=V.slice(0,P.index);V=V.slice(P.index+P[0].length),C(E)}};return new TransformStream({transform(P,E){E.enqueue(P),V+=L.decode(P,{stream:!0}),_()},flush(){if(V+=L.decode(),_(),V.trim()!=="")C(V);V=""}})}var G$=512,U2="x-common-auth-attempt",K2=($,X)=>JSON.stringify([$,X]),J2=($)=>({providerID:$.model.providerID,modelID:$.model.id,sessionID:$.sessionID,agent:$.agent,kind:$.kind});function x1($){let X=$.headers;return typeof X==="object"&&X!==null}function R1($,X){let L=$.getReader();return new ReadableStream({async pull(V){let C;try{C=await L.read()}catch(_){X({reason:"failed",message:_ instanceof Error?_.message:String(_)}),V.error(_);return}if(C.done)X(),V.close();else V.enqueue(C.value)},async cancel(V){X({reason:"cancelled",...V===void 0?{}:{message:String(V)}}),await L.cancel(V)}})}function l2($,X){for(let[L,V]of Object.entries(X)){let C=L.toLowerCase();for(let _ of Object.keys($))if(_.toLowerCase()===C)delete $[_];if(V!==null)$[L]=V}}function A1($,X){for(let[L,V]of Object.entries(X))if(V===null)$.delete(L);else $.set(L,V)}async function d2($,X,L={}){let{providerID:V}=X,C=L.gateOnPlaceholder,_=(Z)=>C===void 0||C.credential(Z)===Q2(V),P=L.logger,E=Math.max(1,L.maxRecords??G$),H=[...L.hostCredentials??[Q2(V)],...C?[Q2(V)]:[]].filter((Z)=>Z!==""),Y=new Map,U=new WeakMap,Q=new Map,K=new Set,T=new Map,q=!1,A=!1,m=new Map,I=0,d=!1,n=new Map,i=(Z,B)=>{try{P?.warn(Z,B)}catch{}},G=(Z)=>Z instanceof Error?Z.message:String(Z),j=async(Z,B)=>{let M=m.get(Z);if(!M||M.size===0)return;await Promise.all([...M].map(async(F)=>{try{await F(B)}catch(y){i("opencode2 auth listener threw; the request is unaffected",{event:Z,error:G(y)})}}))},J=async(Z,B)=>{try{await X.onAttemptEnd?.(Z,B)}catch(M){i("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:Z.attemptId,error:G(M)})}},S=(Z,B)=>{if(Z.ended||!Z.attempt)return;let M={...Z.status===void 0?{}:{status:Z.status},outputStarted:Z.outputStarted,...Z.limit?{limit:Z.limit.signal}:{},...B?{error:B}:{}};if(B)Z.endError=B;Z.ended=J(Z.attempt,M)},R=(Z,B)=>S(Z,{reason:"abandoned",message:B}),x=(Z)=>[...Y.values()].filter((B)=>B.key===Z),v=(Z)=>x(Z).at(-1),c=(Z)=>{if(Y.delete(Z.id),!x(Z.key).length)Q.delete(Z.key)},o=(Z)=>{Y.set(Z.id,Z);while(Y.size>E){let B=Y.values().next().value;if(B===void 0)break;R(B,"dropped to keep the record bound"),c(B)}},f=(Z)=>Z.accountId===void 0?void 0:{...Z.scope,accountId:Z.accountId},u=(Z,B)=>new P2({kind:"no-account",providerID:V,sessionID:Z.sessionID,requestKind:Z.kind,...B===void 0?{}:{message:B}}),W=(Z)=>{n.get(Z)?.clear(),n.delete(Z)},z=async(Z,B)=>{let M=()=>u(Z,`${V} ${Z.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(d)throw M();let F=n.get(Z.sessionID);if(!F)F=new Set,n.set(Z.sessionID,F);let y={};F.add(y);let h=()=>{if(!F.has(y))throw M()};try{return await B(h)}finally{if(F.delete(y),F.size===0&&n.get(Z.sessionID)===F)n.delete(Z.sessionID)}},N=(Z,B)=>{for(let[M,F]of B)if(H.some((y)=>F.includes(y)))throw new P2({kind:"host-credential-on-wire",providerID:V,sessionID:Z.sessionID,requestKind:Z.kind,message:`${V} ${Z.kind} request still carries the host's placeholder credential in ${M}; the adapter's account headers must replace it`})},D=(Z)=>{for(let B of x(Z))if(B.ended||!B.attempt)c(B);else if(B.transport==="ws"||B.judged)R(B,"a newer attempt of its session and kind began"),c(B)},O=async(Z,B,M,F)=>{let y=K2(Z.sessionID,Z.kind),h=Q.get(y);Q.delete(y);let w=h?.accountId??v(y)?.accountId;D(y);let g={...Z,...w===void 0?{}:{previousAccountId:w},...h?.rerouteFrom===void 0?{}:{rerouteFrom:h.rerouteFrom}},p=await X.chooseAccount(g);M();let W2={},$$;if(p!==void 0){let A2=await X.accountHeaders({...Z,accountId:p});if(M(),x1(A2))W2=A2.headers,$$=A2.attempt;else W2=A2}let Z$=`attempt-${++I}`,N2={id:Z$,key:y,scope:Z,accountId:p,headers:W2,attempt:p===void 0?void 0:{...Z,accountId:p,attemptId:Z$,transport:F,data:$$},...F===void 0?{}:{transport:F},outputStarted:!1};if(o(N2),N2.attempt)j("select",{...Z,accountId:N2.attempt.accountId,hook:B,...g.previousAccountId===void 0?{}:{previousAccountId:g.previousAccountId},...g.rerouteFrom===void 0?{}:{rerouteFrom:g.rerouteFrom},handle:N2.attempt});return N2},k=async(Z,B,M,F,y)=>{let h=K2(Z.sessionID,Z.kind),w=F===void 0?void 0:Y.get(F);if(w?.key!==h)w=void 0;if(!w){if(w=v(h),x(h).filter((p)=>p.transport===void 0&&!p.ended).length>1&&!A)A=!0,i("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:Z.sessionID,kind:Z.kind})}if(!w||w.transport!==void 0||w.ended)w=await O(Z,B,y,M);else if(w.transport=M,w.attempt)w.attempt.transport=M;if(M==="ws"){for(let g of x(h))if(g!==w&&g.transport==="ws")R(g,"a newer attempt of its session and kind went out over WebSocket")}return w},b=async(Z,B)=>{try{return await B()}catch(M){throw S(Z,{reason:"failed",message:G(M)}),M}},s=(Z,B)=>{let M=x(K2(Z,B)).filter((F)=>F.transport==="ws").at(-1);return M?.attempt!==void 0&&!M.ended?M:void 0},l=(Z,B,M)=>{let F=f(Z);if(!F||!Z.attempt||Z.limit)return;Z.limit={signal:B,delivered:j("limit",{...F,via:M,limit:B,outputStarted:Z.outputStarted,handle:Z.attempt})}},Z2=(Z,B,M,F)=>{let y=f(Z);if(!y||!Z.attempt)return;j("quota",{...y,transport:B,...F===void 0?{}:{status:F},quota:M,handle:Z.attempt})},$2=(Z,B,M,F)=>{let y=Z.attempt;if(!y)return;let h=X.inspectEvent?.(F===void 0?{transport:B,data:M,attempt:y}:{transport:B,data:M,event:F,attempt:y});if(!h)return;if(h.quota!==void 0)Z2(Z,B,h.quota);if(h.outputStarted)Z.outputStarted=!0;if(h.limit)l(Z,h.limit,B);if(h.error!==void 0)S(Z,{reason:"failed",message:h.error});else if(h.done)S(Z)},Y2=(Z,B)=>{let M=Z.attempt;if(!M||B.accountId===Z.accountId)return;if(M.reboundFrom??=M.accountId,M.accountId=B.accountId,"data"in B)M.data=B.data;Z.accountId=B.accountId},e=(Z)=>!Z.attempt||Z.endError!==void 0||Z.status!==void 0&&Z.status>=400,r=(Z)=>{let B=[...Y.values()].filter((g)=>g.scope.sessionID===Z),M=B.filter((g)=>g.limit&&!g.rerouted).at(-1);if(M)return M;let F=B.filter((g)=>g.scope.kind==="primary"),y=F.length>0?F:B;if(y.length<=1)return y[0];let h=y.filter((g)=>!g.judged&&e(g)).at(-1);if(h)return h;let w=y.filter((g)=>g.attempt&&!g.ended);if(w.length>1)return"ambiguous";return w[0]??y.at(-1)},t={providerID:V},a=[];a.push(await $.session.hook("model.request",(Z)=>{if(C)return;return z(J2(Z),async(B)=>{let M=await O(J2(Z),"model.request",B);if(B(),M.accountId===void 0)throw u(M.scope);l2(Z.headers,{...M.headers,[U2]:M.id})})},t)),a.push(await $.session.hook("http.request",(Z)=>{if(C){let B=_(Z.request.headers);if(T.set(Z.sessionID,B),!B)return}return z(J2(Z),async(B)=>{let M=Z.request.headers.get(U2)??void 0,F=C?await O(J2(Z),"http.request",B,"http"):await k(J2(Z),"http.request","http",M,B);B();let y=f(F),h=F.attempt;if(!y||!h)throw u(F.scope);await b(F,async()=>{let w=Z.request;if(X.rewriteRequest){if(M!==void 0){let W2=new Headers(w.headers);W2.delete(U2),w=new Request(w,{headers:W2})}w=await X.rewriteRequest({...y,request:w,attempt:h})??w,B()}let g=new Headers(w.headers);g.delete(U2),A1(g,F.headers),N(F.scope,g.entries());let p=new Request(w,{headers:g});U.set(p,F),Z.request=p})})},t)),a.push(await $.session.hook("http.response",async(Z)=>{let B=U.get(Z.request);if(!B){if(C)return;if(!q)q=!0,i("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:Z.sessionID,kind:Z.kind});return}let M=Z.response;if(X.answeredBy&&B.attempt){let g=B.attempt,p=await b(B,async()=>X.answeredBy?.({request:Z.request,response:M,attempt:g}));if(p)Y2(B,p)}let F=f(B),y=B.attempt;if(!F||!y)return;B.status=M.status;let h=X.quotaFromHeaders?.(M.headers,M.status,y);if(h!==void 0)Z2(B,"http",h,M.status);if(!M.ok&&X.limitFromResponse){let g=await X.limitFromResponse({status:M.status,headers:M.headers,body:()=>M.clone().text(),attempt:y});if(g)l(B,g,"http")}if(!M.ok||!M.body)S(B);let w=M;if(M.body&&(X.inspectEvent||X.onAttemptEnd)){let g=M.body;if(X.inspectEvent)g=g.pipeThrough(m2((p)=>$2(B,"http",p.data,p.event),(p)=>i("opencode2 auth event inspection threw",{error:G(p)})));w=new Response(R1(g,(p)=>S(B,p)),{status:M.status,statusText:M.statusText,headers:M.headers})}if(X.rewriteResponse)w=await X.rewriteResponse({...F,request:Z.request,response:w,attempt:y})??w;if(w!==M)Z.response=w},t)),a.push(await $.session.hook("experimental.ws.handshake",(Z)=>{if(C){let B=_(new Headers(Z.headers)),M=K2(Z.sessionID,Z.kind);if(T.set(Z.sessionID,B),K.delete(M),!B)return}return z(J2(Z),async(B)=>{let M;for(let w of Object.keys(Z.headers)){if(w.toLowerCase()!==U2)continue;M??=Z.headers[w],delete Z.headers[w]}let F=C?await O(J2(Z),"experimental.ws.handshake",B,"ws"):await k(J2(Z),"experimental.ws.handshake","ws",M,B);B();let y=f(F),h=F.attempt;if(!y||!h)throw u(F.scope);await b(F,async()=>{l2(Z.headers,F.headers);let w=X.rewriteHandshakeURL?.({...y,url:Z.url,attempt:h});if(w!==void 0)Z.url=w;if(N(F.scope,Object.entries(Z.headers)),C)K.add(F.key)})})},t));let B2=X.rewriteWebSocketFrame?.bind(X);if(B2)a.push(await $.session.hook("experimental.ws.send",async(Z)=>{let B=J2(Z);if(C&&!K.has(K2(B.sessionID,B.kind)))return;let M=s(B.sessionID,B.kind),F=await B2({...B,attempt:M?.attempt,frame:Z.frame});if(F!==void 0)Z.frame=F},t));a.push(await $.session.hook("experimental.ws.receive",(Z)=>{if(C&&!K.has(K2(Z.sessionID,Z.kind)))return;let B=s(Z.sessionID,Z.kind);if(!B)return;try{$2(B,"ws",Z.frame)}catch(M){i("opencode2 auth frame inspection threw",{error:G(M)})}},t)),a.push(await $.session.hook("retry",async(Z)=>{if(C&&T.get(Z.sessionID)!==!0)return;let B=r(Z.sessionID);if(!B)return;let M=Z.decision;if(B==="ambiguous"){await j("retry",{sessionID:Z.sessionID,attempt:Z.attempt,reason:"host-decides",hostDecision:M,decision:M});return}let F=B;await z(F.scope,async(y)=>{F.judged=!0;let h=M,w,g,p=F.attempt;if(F.accountId===void 0||!p)h={retry:!1},w="no-account";else if(F.outputStarted)h={retry:!1},w="output-started";else{if(!F.limit){let W2=X.limitFromError?.(Z.error,p);if(W2)l(F,W2,"error")}if(F.ended)await F.ended,y();if(F.limit)await F.limit.delivered,y(),F.rerouted=!0,g={accountId:F.accountId,limit:F.limit.signal},h={retry:!0,delay:0},w="reroute";else w="host-decides"}if(Z.decision=h,h.retry&&F.accountId!==void 0)Q.set(F.key,{sessionID:F.scope.sessionID,accountId:F.accountId,...g===void 0?{}:{rerouteFrom:g}});await j("retry",{sessionID:Z.sessionID,...F.accountId===void 0?{}:{accountId:F.accountId},kind:F.scope.kind,attempt:Z.attempt,reason:w,hostDecision:M,decision:h,...p===void 0?{}:{handle:p}})})},t));let C2=(Z)=>{W(Z),T.delete(Z);for(let B of K)if(JSON.parse(B)[0]===Z)K.delete(B);for(let B of[...Y.values()]){if(B.scope.sessionID!==Z)continue;R(B,"its session was forgotten"),Y.delete(B.id)}for(let[B,M]of Q)if(M.sessionID===Z)Q.delete(B)},G2=new AbortController,e2=$.event;if(e2)(async()=>{try{for await(let Z of e2.subscribe({signal:G2.signal}))if(Z.type==="session.deleted")C2(Z.data.sessionID)}catch(Z){if(!G2.signal.aborted)i("opencode2 auth stopped listening for session deletion",{error:G(Z)})}})();return{on(Z,B){let M=m.get(Z);if(!M)M=new Set,m.set(Z,M);let F=B;return M.add(F),()=>{M.delete(F)}},accountFor(Z,B){return v(K2(Z,B))?.accountId},forgetSession:C2,get size(){return Y.size},async dispose(){if(d)return;d=!0;for(let Z of n.keys())W(Z);G2.abort();for(let Z of Y.values())R(Z,"the installation was disposed");Y.clear(),Q.clear(),K.clear(),T.clear(),m.clear(),await Promise.all(a.map(async(Z)=>{try{await Z.dispose()}catch(B){i("opencode2 auth hook did not dispose cleanly",{error:G(B)})}}))}}}import{createHash as q1}from"node:crypto";var T2="anthropic",F$="x-common-auth-attempt",k1=["x-session-affinity","x-opencode-session","x-parent-session-id",H$,k2,O2,F$],q2=new Set(["authorization","x-api-key"]),D1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",w1=512,b1=5000,y1=500,W$=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class T$ extends Error{sessionID;requestKind;kind="no-account";providerID=T2;constructor($,X){super(D1);this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicNoAccountError"}}class i2 extends Error{sessionID;requestKind;kind="session-forgotten";providerID=T2;constructor($,X){super("request refused: its session was closed while it was being prepared");this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicRevokedError"}}class L2 extends Error{kind="unsupported-transport";providerID=T2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class O$ extends Error{kind="local-invalid-request";status=400;check;constructor($){super($.message,{cause:$});this.name="NativeAnthropicLocalRefusal",this.check=$.check}}var z2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($);function F2($){try{return JSON.parse($)}catch{return}}function u2($){let X={};for(let[L,V]of Object.entries($??{}))X[L.toLowerCase()]=V;return X}function J$($){let X={};for(let L of k1){let V=$.get(L);if(V!==null&&L!==F$)X[L]=V;$.delete(L)}return X}function I1($){try{return new URL($).pathname.endsWith("/messages")}catch{return!1}}function f1($){return $ instanceof K$||$ instanceof U$?new O$($):void 0}function g1($,X){let L=[];if($.oauth)L.push($.oauth.accessToken);for(let[V,C]of Object.entries($.apiHeaders??{})){if(C===null||!q2.has(V))continue;L.push(C.replace(/^Bearer\s+/i,""))}for(let V of q2){let C=X.get(V);if(C!==null)L.push(C.replace(/^Bearer\s+/i,""))}if($.dispatch?.kind==="http-relay")L.push($.dispatch.token);return[...new Set(L.filter(Boolean))]}var v1=new Set(["oauth-2025-04-20","claude-code-20250219",L$]);function h1($){let X=$.split(",").map((L)=>L.trim()).filter((L)=>L&&!v1.has(L));return V$(null,X)}function m1($){let X=F2($);if(!z2(X))return $;let L=z$(X.messages),V=Object.hasOwn(X,"fallbacks"),{droppedMarkers:C}=M$(X,!1),_=V&&!Object.hasOwn(X,"fallbacks"),P=Q$(X);return L>0||C>0||_||P?JSON.stringify(X):$}async function l1($,X){if(!($ instanceof Promise))return"settled";let L;try{return await Promise.race([$.then(()=>"settled"),new Promise((V)=>{L=setTimeout(()=>V("timed-out"),X)})])}finally{if(L!==void 0)clearTimeout(L)}}function M2($){let{source:X,log:L}=$,V=Math.max(1,$.maxPendingSends??w1),C=$.attemptEndTimeoutMs??b1,_=new Map,P=new WeakMap,E=new WeakMap,H=new WeakMap,Y=new Map,U=new WeakMap,Q=p2([]);Q.dispose();let K=(W)=>(W&&Y.get(W)?.redactor)??Q,T=(W)=>{let z=Y.get(W);if(!z)return;Y.delete(W),z.redactor.dispose(),z.scope.dispose()},q=(W,z,N,D)=>{let O=g1(z,D),k=c2(O,N);A.set(W,N),Y.set(W,{sessionID:z.sessionID,redactor:p2(O),scope:k}),k.settled.then(()=>T(W));while(Y.size>V){let b=Y.keys().next().value;if(b===void 0)break;T(b)}},A=new WeakMap,m=(W,z)=>{let N=W?A.get(W):void 0;if(!N||!z.ok)return Q.redactResponse(z);let D=c2([],N),O=D.redactResponse(z);return D.dispose(),O},I=(W,z)=>{let N=W?Y.get(W)?.scope:void 0;if(!N)return m(W,z);try{return N.redactResponse(z)}catch{return m(W,z)}},d=!1,n=new WeakMap,i=(W,z)=>{if(W&&!z.ok)n.set(z.headers,W);return z},G=(W,z)=>{if(z.dispatch!=="http-relay")return!0;let N=/^req_[A-Za-z0-9_-]+$/.test(W.get("request-id")??"");return E.set(z,N),N},j=(W)=>new T$(W.sessionID,W.kind),J=new Map,S=async(W,z)=>{if(d)throw new i2(W.sessionID,W.kind);let N={revoked:!1},D=J.get(W.sessionID);if(!D)D=new Set,J.set(W.sessionID,D);D.add(N);let O=()=>{if(d||N.revoked)throw new i2(W.sessionID,W.kind)};try{let k=await z(O);return O(),k}finally{let k=J.get(W.sessionID);if(k?.delete(N)&&k.size===0)J.delete(W.sessionID)}},R=(W,z)=>{_.set(W,z);while(_.size>V){let N=_.keys().next().value;if(N===void 0)break;_.delete(N),L?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:V})}},x=(W,z)=>({providerID:W.providerID,modelID:W.modelID,sessionID:W.sessionID,agent:W.agent,kind:W.kind,accountId:W.accountId,attemptId:W.attemptId,transport:W.transport,route:z.route,provenance:z.provenance,dispatch:z.dispatch}),v=(W)=>S(W,async(z)=>{let{accountId:N,...D}=W,O=await X.authorizeAccount(D,N);return z(),c(D,O)}),c=(W,z)=>{if(!z)throw j(W);if(z.dispatch?.kind==="websocket-relay")throw new L2;let N=z.dispatch?.kind==="http-relay"?"http-relay":"direct",D=z.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":z.dispatch.token}:void 0;if(z.route==="oauth"){if(!z.accessToken)throw j(W);j$(z.accessToken,T2);let b=Object.freeze({route:"oauth",provenance:z.provenance,dispatch:N});R(b,{sessionID:W.sessionID,oauth:{accessToken:z.accessToken,...z.identity?{identity:z.identity}:{}},dispatch:z.dispatch,oauthHeaders:z.headers});let s=u2(z.headers);for(let l of q2)delete s[l];return delete s["anthropic-beta"],{headers:D??{...s,"x-api-key":null,authorization:`Bearer ${z.accessToken}`},attempt:b}}let O={authorization:null,"x-api-key":null,...u2(z.headers)};if(!O.authorization&&!O["x-api-key"])throw j(W);let k=Object.freeze({route:"api",provenance:z.provenance,dispatch:N});return R(k,{sessionID:W.sessionID,...z.baseURL?{baseURL:z.baseURL}:{},dispatch:z.dispatch,apiHeaders:O}),{headers:D??O,attempt:k}},o=(W)=>S(W,(z)=>f(W,z)),f=async(W,z)=>{let{request:N,attempt:D}=W,O=D.data,k=O?_.get(O):void 0;if(O)_.delete(O);if(!O||!k||O.route==="oauth"&&!k.oauth)throw j(W);let b=new Headers(N.headers);B$(b);let s=J$(b),l=N.body===null?void 0:await N.text();z();let Z2=l!==void 0&&I1(N.url);try{if(O.route==="oauth"&&k.oauth){let{accessToken:e,identity:r}=k.oauth;for(let[a,B2]of Object.entries(u2(k.oauthHeaders))){if(q2.has(a))continue;if(B2===null)b.delete(a);else b.set(a,B2)}let t=null;if(l!==void 0&&Z2){let a={...x(D,O),modelID:(()=>{let G2=F2(l);return j2(z2(G2)&&typeof G2.model==="string"?G2.model:W.modelID)})(),route:"oauth",correlation:s},B2=await X.requestOptions?.(a)??{};z(),l=await N$(l,{...B2,...r?{identity:r}:{},sessionId:W.sessionID,onToolNameMap:(G2)=>H.set(O,G2)});let C2=F2(l);t=z2(C2)?C2:null}_$(b,e,{body:t,...r?{identity:r}:{}})}else{if(l!==void 0&&Z2)l=m1(l);b.delete("authorization"),b.delete("x-api-key");for(let[r,t]of Object.entries(k.apiHeaders??{}))if(t===null)b.delete(r);else b.set(r,t);if(l!==void 0&&Z2&&!b.has("content-type"))b.set("content-type","application/json");let e=b.get("anthropic-beta");if(e!==null){let r=h1(e);if(r)b.set("anthropic-beta",r);else b.delete("anthropic-beta")}}}catch(e){let r=f1(e);if(!r)throw e;throw P.set(O,r.check),L?.warn("refused an Anthropic request locally; nothing was sent",{check:r.check}),r}let $2=l!==void 0?F2(l):void 0;if(await X.admitRequest?.({...x(D,O),modelID:j2(z2($2)&&typeof $2.model==="string"?$2.model:W.modelID)}),J$(b),l!==void 0)b.delete("content-length");z(),q(O,k,z2($2)&&$2.stream===!0?"event-stream":"http",b);let Y2=C$(N.url,k.baseURL!==void 0?{baseURL:k.baseURL}:{}).url?.toString()??N.url;if(O.route==="oauth"&&Z2&&l!==void 0)await X.onRequestPrepared?.({...x(D,O),url:Y2,bodyText:l}),z();if(k.dispatch?.kind==="http-relay"){let e=l??"";b.delete("x-relay-token");let r={protocol:1,type:"request",affinity:W.sessionID,upstream:{url:Y2,method:N.method,headers:Object.fromEntries(b)},mode:"full_sync",revision:1,body:e,next_hash:`sha256:${q1("sha256").update(e).digest("hex")}`};return new Request(k.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":k.dispatch.token},redirect:"error",signal:N.signal,body:JSON.stringify(r)})}return new Request(Y2,{method:N.method,headers:b,redirect:N.redirect,signal:N.signal,...l!==void 0?{body:l}:{}})};return{adapter:{providerID:T2,chooseAccount:(W)=>S(W,async()=>{let z=await X.chooseAccount(W);if(!z)throw j(W);return z}),accountHeaders:v,rewriteRequest:o,rewriteHandshakeURL(){throw new L2},rewriteResponse({response:W,attempt:z}){let N=z.data;if(N&&!G(W.headers,N)){if(W.status===401)return T(N),W.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return I(N,W)}let D=I(N,W);if(N?.route!=="oauth"||!D.body)return i(N,D);let O={...x(z,N),status:W.status},k=X.responseOptions?.(O)??{},b=(W.headers.get("content-type")??"").includes("application/json");return i(N,P$(D,{...k,toolNameMap:H.get(N),onToolNameRefusal:()=>{P.set(N,"response_tool_names"),T(N)},laneStartOAuthServed:!0,...b?{responseMode:"json"}:{}}))},quotaFromHeaders(W,z,N){let D=N.data;if(!D||!G(W,D))return;return X.quotaFromHeaders?.(W,{...x(N,D),status:z})},async limitFromResponse({status:W,headers:z,body:N,attempt:D}){let O=D.data;if(!O||P.get(O)==="response_tool_names")return;if(!G(z,O))return X.limitFromRelayFailure?.({...x(D,O),status:W});if(U.set(O,`provider responded with HTTP ${W}`),!X.limitFromResponse)return;let k=n.get(z)===O,b=K(O);return X.limitFromResponse({...x(D,O),status:W,headers:z,body:async()=>k?await N():b.redactText(await N())})},inspectEvent({data:W,event:z,attempt:N}){if(N.data&&P.get(N.data)==="response_tool_names")return;let D=F2(W);if(!z2(D))return;let O=typeof D.type==="string"?D.type:z;if(O==="content_block_start"||O==="content_block_delta")return{outputStarted:!0};if(O==="message_stop")return{done:!0};if(O!=="error")return;let k=N.data,b=K(k),s=z2(D.error)?D.error:{},l=typeof s.type!=="string"?void 0:W$.has(s.type)?s.type:b.redactText(s.type),Z2=typeof s.message==="string"?b.redactText(s.message):void 0;if(k?.dispatch==="http-relay"&&E.get(k)===!1)return;let $2=k?X.limitFromStreamError?.({...x(N,k),errorType:l,message:Z2}):void 0,Y2={error:[l??"error",Z2].filter(Boolean).join(": ").slice(0,y1),...$2?{limit:$2}:{}};if(k&&Y2.error)U.set(k,Y2.error);return Y2},limitFromError(W,z){let N=z.data;if(!N||P.has(N))return;let D={type:W$.has(W.type)?W.type:"provider_error",message:U.get(N)??"provider request failed",...W.status!==void 0?{status:W.status}:{}};if(T(N),N.dispatch==="http-relay"&&E.get(N)===!1)return;return X.limitFromHostError?.(D,x(z,N))},async onAttemptEnd(W,z){let N=W.data;if(!N)return;_.delete(N);let D=z.error?.reason;if(D==="cancelled"||D==="abandoned"||D===void 0&&(z.status===void 0||z.status<400))T(N);let O=P.get(N),{status:k,...b}=z,s=X.onAttemptEnd?.(x(W,N),{...b,...k!==void 0&&(N.dispatch!=="http-relay"||E.get(N)===!0)?{status:k}:{},...O!==void 0?{localRefusal:{check:O}}:{}});if(await l1(s,C)==="timed-out")L?.warn("the account source did not finish recording a send",{timeoutMs:C})}},dispose(){d=!0;for(let[W,z]of J){for(let N of z)N.revoked=!0;X.forgetSession?.(W)}J.clear(),_.clear();for(let W of[...Y.keys()])T(W)},forgetSession(W){for(let z of J.get(W)??[])z.revoked=!0;J.delete(W);for(let[z,N]of _)if(N.sessionID===W)_.delete(z);for(let[z,N]of[...Y])if(N.sessionID===W)T(z);X.forgetSession?.(W)},get pendingSendCount(){return _.size},get heldCredentialCount(){let W=0;for(let z of _.values())if(z.oauth)W++;return W},get heldRedactorCount(){return Y.size},get operationsInProgress(){let W=0;for(let z of J.values())W+=z.size;return W}}}function E2($){return JSON.stringify([$.source,$.accountIdentity,$.credentialId,$.binding?.storageId,$.binding?.rowId,$.binding?.credentialEpoch])}function R$($){let{runtime:X,source:L}=$,V=new AbortController,C=!1,_=new x$({directory:$.registryDirectory||process.env.OPENCODE_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR||S$("opencode"),now:$.now}),P=new Map,E=async(Q,K,T)=>{let q=T?AbortSignal.any([V.signal,T]):V.signal;q.throwIfAborted();let A=JSON.parse(await K.text()),m={providerID:"anthropic",modelID:A.model,sessionID:`oc2-cachekeep:${Q.id}`,agent:"cachekeep",kind:"generate"},I=M2({source:{...L,onRequestPrepared:void 0,responseOptions:void 0,async requestOptions(j){return{...await L.requestOptions?.(j),laneStart:!1,billingLineage:void 0,cacheDiagnosticsPreviousMessageId:void 0}},async authorizeAccount(j,J){let S=await X.read();q.throwIfAborted();let R=S.accounts.find((v)=>v.id===J);if(R?.type!=="oauth"||E2(R)!==Q.oauthAccountIdentity||Q.isSubagent&&!D2(S.policyStorage)||!_2(S.policyStorage)||!o2(S.policyStorage,new Date($.now?.()??Date.now())))return;let x=await L.authorizeAccount(j,J);if(x?.provenance.kind==="local"&&E2({...R,binding:x.provenance.subject.binding,accountIdentity:x.provenance.subject.binding.identity})!==Q.oauthAccountIdentity)return;if(x?.provenance.kind==="vault"&&x.provenance.credentialId!==R.credentialId)return;return x},async admitRequest(j){await L.admitRequest?.(j);let J=await X.read(),S=J.accounts.find((R)=>R.id===j.accountId);if(q.throwIfAborted(),!S||E2(S)!==Q.oauthAccountIdentity||Q.isSubagent&&!D2(J.policyStorage)||!_2(J.policyStorage)||!o2(J.policyStorage,new Date($.now?.()??Date.now())))throw Error("CacheKeep policy changed before dispatch")}}}),d,n,i=!1,G=()=>I.forgetSession(m.sessionID);q.addEventListener("abort",G,{once:!0});try{let j=(await X.read()).accounts.find((c)=>E2(c)===Q.oauthAccountIdentity)?.id;if(!j)throw Error("CacheKeep account is unavailable");let J=await I.adapter.accountHeaders({...m,accountId:j});if(!("headers"in J)||typeof J.headers!=="object"||J.headers===null||typeof J.attempt!=="object"||J.attempt===null||J.attempt.route!=="oauth")throw Error("CacheKeep authorization refused");d={...m,accountId:j,attemptId:crypto.randomUUID(),transport:"http",data:J.attempt};let S=await I.adapter.rewriteRequest?.({...m,accountId:j,attempt:d,request:new Request(Q.url,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(A),signal:q})});if(!S)throw Error("CacheKeep rewrite refused");q.throwIfAborted();let R=await($.fetch??fetch)(S),x=await I.adapter.rewriteResponse?.({...m,accountId:j,attempt:d,request:S,response:R});if(!x)throw Error("CacheKeep response rewrite refused");if(n=x.status,I.adapter.quotaFromHeaders?.(x.headers,x.status,d),!x.ok)await I.adapter.limitFromResponse?.({status:n,headers:x.headers,body:()=>x.clone().text(),attempt:d});let v=await x.arrayBuffer();return i=!0,new Response(v,{status:n,headers:x.headers})}catch{throw Error("Native CacheKeep was not completed")}finally{q.removeEventListener("abort",G);try{if(d)await I.adapter.onAttemptEnd?.(d,{status:n,outputStarted:!1,...i?{}:{error:{reason:"cancelled"}}})}finally{I.dispose(),L.forgetSession?.(m.sessionID)}}},H=$.setIntervalImpl??globalThis.setInterval,Y=new E$({loadStorage:async()=>C?null:(await X.read()).policyStorage,now:$.now,setIntervalImpl:(Q,K)=>H(()=>Y.tick().catch(()=>{H2.warn("cachekeep","tick failed")}),K),clearIntervalImpl:$.clearIntervalImpl,onTrackedSessionsChanged:(Q)=>_.publish(C?[]:Q),prepareHeaders(Q,K,T){if(C)return;return P.set(T.id,{target:K,attempt:T}),new Headers({"x-native-cachekeep-attempt":String(T.id)})},fetchImpl:async(Q,K)=>{let T=new Request(Q,K),q=Number(T.headers.get("x-native-cachekeep-attempt")),A=P.get(q);if(P.delete(q),!A)throw Error("CacheKeep attempt is unavailable");return E(A.target,T,A.attempt.signal)},onComplete:({attempt:Q})=>{P.delete(Q.id)}}),U;return{async track(Q){if(C||Q.route!=="oauth"||Q.agent==="cachekeep"||Q.agent==="prime"||Q.kind!=="primary")return;let K=await X.read();if(C||!_2(K.policyStorage))return;let T=!1;try{T=await $.isSubagent?.(Q.sessionID)??!1}catch{return}if(C||T&&!D2(K.policyStorage))return;let q=K.accounts.find((A)=>A.id===Q.accountId);if(!q?.accountIdentity)return;if(Q.provenance.kind==="local"&&JSON.stringify(q.binding)!==JSON.stringify(Q.provenance.subject.binding))return;if(Q.provenance.kind==="vault"&&q.credentialId!==Q.provenance.credentialId)return;Y.track({sessionId:Q.sessionID,url:Q.url,headers:new Headers,bodyText:Q.bodyText,storage:K.policyStorage,cacheMode:"hybrid",oauthAccountId:Q.accountId,oauthAccountIdentity:E2(q),isSubagent:T}),await _.publish(Y.trackedSessions())},registry:_,dispose(){if(U)return U;return C=!0,Y.stop(),V.abort(),U=(async()=>{try{await Y.tick()}finally{P.clear(),await _.dispose()}})(),U}}}async function A$($,X,L){let V=M2(X),C=[],_=async(K,T,q)=>{let A=await $.session.hook(K,T,q);return C.push(A),A},P=new AbortController,E;try{E=await d2({session:{hook:_},event:$.event},V.adapter,{logger:X.log,gateOnPlaceholder:L})}catch(K){throw V.dispose(),await Promise.allSettled(C.map((T)=>T.dispose())),K}let H=(K)=>{V.forgetSession(K),E.forgetSession(K)},Y=$.event,U=Y?(async()=>{try{for await(let K of Y.subscribe({signal:P.signal}))if(K.type==="session.deleted")H(K.data.sessionID)}catch(K){if(!P.signal.aborted)X.log?.warn("stopped listening for session deletion",{error:K instanceof Error?K.name:"unknown"})}})():Promise.resolve(),Q;return{installation:E,forgetSession:H,dispose(){if(Q)return Q;return V.dispose(),P.abort(),Q=(async()=>{await E.dispose(),await U})(),Q}}}function k$($,X){let L=new AbortController,V,C=!1,_=async()=>{let H=await $.read();if(L.signal.throwIfAborted(),H.policyStorage.relay?.enabled===!0&&V2(H.policyStorage.relay.transport,H.policyStorage.relay.url)==="websocket")return;let Y=H,U=b2(Y.policyStorage);for(let Q of Y.accounts){if(L.signal.aborted)return;if(!X2(Q)||Q.type!=="oauth")continue;if(Y.policyStorage.quota?.enabled!==!1&&Date.now()-w2(Q.quota)>=U)await $.fetchQuota(Q.id,X,L.signal).catch(()=>{});if(!q$(Q.profile)&&!L.signal.aborted)await $.fetchProfile(Q.id,X,L.signal).catch(()=>{})}},P=()=>{if(C||V)return V;return V=_().catch(()=>{if(!L.signal.aborted)H2.debug("opencode2","native background readings did not complete")}).finally(()=>{V=void 0}),V},E=$.vault.watch({intervalMs:60000,onRefresh:P,shouldRefresh:async()=>{let H=await $.read();return H.policyStorage.relay?.enabled!==!0||V2(H.policyStorage.relay.transport,H.policyStorage.relay.url)==="http"}});return E.ready.catch(()=>{}),{async dispose(){C=!0,E.close(),L.abort(),await V}}}var n2=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{};function u$($){let{runtime:X,source:L}=$,V=new Map,C=!1,_=async(Y,U)=>{await X.updateSettings((Q)=>({...Q,[Y]:{...n2(Q[Y]),...U}}))},P=()=>({ok:!0,text:"Native Claude settings updated."}),E=async(Y,U)=>{if(C)throw Error("Native menu is closed");switch(U.signal?.throwIfAborted(),Y.action){case"enable":case"disable":return await X.setEnabled(Y.values.id,Y.action==="enable"),P();case"remove":return await X.remove(Y.values.id),P();case"move-up":case"move-down":{let K=(await X.read()).accounts.map((I)=>I.id),T=K.indexOf(Y.values.id),q=T+(Y.action==="move-up"?-1:1);if(T<0||q<0||q>=K.length)return{ok:!1,text:"Account cannot move in that direction."};let A=K[T],m=K[q];if(A===void 0||m===void 0)return{ok:!1,text:"Account order changed."};return K[T]=m,K[q]=A,await X.reorder(K),P()}case"add-apikey":return await X.addApi(Y.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let Q=new AbortController;V.get(Y.sessionId)?.active.abort();let K={active:Q,auth:void 0};V.set(Y.sessionId,K);let T=await y2("max");if(C||Q.signal.aborted||U.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return K.auth=T,{ok:!0,text:`Open ${T.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let Q=V.get(Y.sessionId);if(!Q?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let K=await I2(Y.values.code,Q.auth.verifier,Q.auth.redirectUri,Q.auth.state);if(Q.active.signal.throwIfAborted(),U.signal?.throwIfAborted(),C||K.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await X.loginOAuth({routeId:crypto.randomUUID(),credential:K,label:Y.values.label}),Q.active.signal.throwIfAborted(),U.signal?.throwIfAborted(),C)return{ok:!1,text:"Sign-in cancelled."};return V.delete(Y.sessionId),{ok:!0,text:"OAuth account stored in the native account pool."}}case"reset-backoff":{let Q=await X.read();for(let K of Q.accounts){if(U.signal?.throwIfAborted(),K.type!=="oauth")continue;let T=K.source==="vault"?await X.authorizeVault(K.id,U.signal):await X.captureLocalSubject(K.id);await X.resetBackoff(K.id,T)}return P()}case"enrollment-reset":{let Q=await g$(f$("opencode"),I$);return{ok:Q==="reset",text:Q==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let K=(await X.read()).accounts.filter((A)=>A.type==="oauth"&&X2(A)),T=await Promise.allSettled(K.map((A)=>X.fetchQuota(A.id,void 0,U.signal)));return{ok:T.every((A)=>A.status==="fulfilled"),text:`${T.filter((A)=>A.status==="fulfilled").length}/${K.length} native quota readings refreshed.`}}case"routing-reset":return await L.resetRouting(Y.sessionId),P();case"routing-mode":return await _("routing",{mode:Y.values.mode}),P();case"killswitch-on":case"killswitch-off":return await _("killswitch",{enabled:Y.action==="killswitch-on"}),P();case"killswitch-set":return await X.updateSettings((Q)=>{let K=n2(Q.killswitch),T={...n2(K.accounts)},q=K.main;for(let A of Y.values.entries){let m={five_hour:A.fh,seven_day:A.sd,...A.scoped!==void 0?{scoped:A.scoped}:{}};if(A.account==="main"||A.account==="all")q=m;if(A.account==="all")for(let I of Object.keys(T))T[I]=m;else if(A.account!=="main")T[A.account]=m}return{...Q,killswitch:{...K,main:q,accounts:T}}}),P();case"cache-on":case"cache-off":return await _("claudeCache",{enabled:Y.action==="cache-on"}),P();case"cache-mode":return await _("claudeCache",{mode:Y.values.mode}),P();case"cachekeep-always":return await _("cacheKeep",{enabled:!0,always:!0}),P();case"cachekeep-off":return await _("cacheKeep",{enabled:!1}),P();case"cachekeep-window":return await _("cacheKeep",{enabled:!0,always:!1,startHour:Y.values.startHour,endHour:Y.values.endHour}),P();case"cachekeep-subagents":return await _("cacheKeep",{subagents:Y.values.enabled==="on"}),P();case"dump-on":case"dump-off":return await _("dump",{enabled:Y.action==="dump-on"}),P();case"logging-level":return await _("logging",{level:Y.values.level}),P();case"fast-on":case"fast-off":return await _("claudeFast",{enabled:Y.action==="fast-on"}),P();case"prime-on":case"prime-off":return await _("prime",{enabled:Y.action==="prime-on"}),P();case"start-fire":return await H(Y.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},H=(Y)=>$.start(Y,f2);return{dispatch:E,async readStatus(Y){let U=await X.read();if(Y==="account")return U.accounts.map((K)=>`${K.id}${K.label?` (${K.label})`:""}: ${K.type}, ${K.source}, ${K.enabled?"enabled":"disabled"}${K.state?`, ${h$(K)}`:""}${K.accountIdentity?`, ${K.accountIdentity}`:""}`).join(`
+`)||"No native Claude accounts.";if(Y==="quota")return d$({accounts:U.accounts.filter((K)=>K.type==="oauth").map((K)=>({name:K.label??K.id,role:K.id==="main"?"main":"fallback",enabled:K.enabled,quota:K.quota,tierLabel:v$(K.profile),lastRefreshedAt:K.lastRefreshedAt,error:K.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(Y==="prime")return l$({enabled:U.policyStorage.prime?.enabled===!0,accounts:m$(U.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");if(Y==="cachekeep"){let K=await $.cacheKeepRegistry?.list()??[];return y$({enabled:b$(U.policyStorage),always:w$(U.policyStorage),hybridActive:_2(U.policyStorage),trackedSessionDetails:K,window:D$(U.policyStorage),trackedSessions:K.length,nextPrewarmAt:K.length?Math.min(...K.map((T)=>T.nextPrewarmAt)):void 0})}let Q={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(U.settings[Q[Y]]??{})},forgetSession(Y){V.get(Y)?.active.abort(),V.delete(Y)},close(){C=!0;for(let Y of V.values())Y.active.abort();V.clear()}}}function n$(){let $=new Map;return{install:(L)=>L.model.transform((V)=>{$.clear();for(let C of V.list("anthropic")){if($.set(String(C.id),String(C.modelID)),!(p$(C.modelID)||o$(C.modelID)||c$(C.modelID)||i$(C.modelID)))continue;V.update("anthropic",String(C.id),(_)=>{let P=["low","medium","high","xhigh","max"],E=_.variants.filter((H)=>!P.some((Y)=>Y===String(H.id)));_.variants=[...E,...P.map((H)=>({id:H,settings:{effort:H,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(L)=>$.get(L)??L}}function r$($){return $.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??$.get("x-api-key")??void 0}var s$=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{};function t$($){let{runtime:X,source:L}=$,V=new AbortController,C=new Set,_=(H)=>({providerID:"anthropic",modelID:r2().model,sessionID:`oc2-prime:${H}`,agent:"prime",kind:"generate"}),P=async(H)=>{let Y=_(H),U=M2({source:L}),Q=performance.now();try{for(let K=0;K<3;K++){if(V.signal.throwIfAborted(),(await X.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let q=await U.adapter.accountHeaders({...Y,accountId:H});if(!("headers"in q)||typeof q.headers!=="object"||q.headers===null||typeof q.attempt!=="object"||q.attempt===null)throw Error("Native Prime authorization refused");let A={...Y,accountId:H,attemptId:crypto.randomUUID(),transport:"http",data:q.attempt},m,I=!1,d=!1,n=(i)=>{d=!0,i.body?.cancel().catch(()=>{})};try{let i=await U.adapter.rewriteRequest?.({...Y,accountId:H,attempt:A,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r2()),signal:V.signal})});if(!i)throw Error("Native Prime rewrite refused");let G=new Headers(i.headers);for(let[o,f]of Object.entries(q.headers))if(f===null)G.delete(o);else G.set(o,f);let j=new Request(i,{headers:G}),J=await($.fetch??fetch)(j),S=await U.adapter.rewriteResponse?.({...Y,accountId:H,request:j,response:J,attempt:A})??J;m=S.status,U.adapter.quotaFromHeaders?.(S.headers,S.status,A);let R=S.ok?void 0:await U.adapter.limitFromResponse?.({status:S.status,headers:S.headers,body:()=>S.clone().text(),attempt:A});if(R&&/^(vault-newer|local-newer|relay-direct):/.test(R.reason)&&K<2){if(n(S),await L.chooseAccount({...Y,rerouteFrom:{accountId:H,limit:R}})!==H)throw Error("Native Prime retry changed account");continue}if(!S.ok)return n(S),{ok:!1,status:m,ms:performance.now()-Q,error:"Native Prime upstream refused the request"};let x=s$(await S.json()),v=s$(x.usage),c={inputTokens:typeof v.input_tokens==="number"?v.input_tokens:void 0,outputTokens:typeof v.output_tokens==="number"?v.output_tokens:void 0};if(A.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(S.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(I=await L.recordPrime(q.attempt.provenance,c),!I)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:m,ms:performance.now()-Q,usage:c}}finally{await U.adapter.onAttemptEnd?.(A,{status:m,outputStarted:!1,...I?{}:{error:{reason:d?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-Q}}finally{U.dispose()}},E=new a$({storagePath:$.paths.legacyConfig,loadStorage:async()=>(await X.read()).policyStorage,async getAccountFingerprint(H){let Y=await X.read(),U=Y.accounts.find((K)=>K.id===H);if(!X2(U)||U?.type!=="oauth")return;if(Y.policyStorage.relay?.enabled===!0&&V2(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")return;if(U.source==="vault"){let K=await X.authorizeVault(H,V.signal);return X.getOrCreateAuthLineage(H,K)}let Q=await X.authorizeLocal(H,{signal:V.signal});return Q.status==="usable"?X.getOrCreateAuthLineage(H,Q.subject):void 0},async refreshQuota(H){let Y=await X.read();if(Y.policyStorage.relay?.enabled===!0&&V2(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await X.fetchQuota(H,$.fetch,V.signal),fresh:!0}},sendPrime(H){let Y=P(H);return C.add(Y),Y.finally(()=>C.delete(Y)),Y},async recordSuccess(H){let Y=(await X.read()).accounts.find((U)=>U.id===H);if(!Y?.prime)throw Error("Native Prime counters are unavailable");return Y.prime}});return E.start(),{manager:E,async dispose(){E.stop(),V.abort(),await Promise.allSettled(C)}}}var s2=($)=>["five_hour","seven_day"].some((X)=>($?.[X]?.remainingPercent??1)<=0);function Q1($){let{runtime:X}=$,L=X1("native-auth"),V=new Map,C=(G)=>{let j=G.routingPath;if(!j)throw Error("Native routing storage is unavailable");let J=V.get(j);if(!J)J=new G1({path:j,vaultSeed:G.routingSeed,localRecoveryPath:G.mode==="local"?G.routingRecoveryPath:void 0}),V.set(j,J);return J.setVaultSeed(G.routingSeed),J},_=new WeakMap,P=new Map,E=new Map,H=new Map,Y=new WeakSet,U=!1,Q=()=>{while(P.size>512){let G=P.keys().next();if(!G.done)P.delete(G.value)}},K=(G,j)=>JSON.stringify([G.sessionID,G.kind,G.modelID,j]),T=(G)=>{if(U)throw Error("Native Anthropic source is closed");let j=H.get(G.sessionID);if(!j){j=new AbortController,H.set(G.sessionID,j);while(H.size>512){let J=H.keys().next();if(!J.done)n.forgetSession?.(J.value)}}return j},q=(G,j,J)=>X2(G)&&(G.type==="api"||R2(G,j,j2(J)).status==="allowed"),A=async(G,j,J,S)=>{let R=await X.read();S.signal.throwIfAborted(),m(R);let x=R.accounts.find((v)=>v.id===G);if(!x||x.type!==J||!q(x,R,j))return!1;if(J==="api"){let v=R.accounts.find((c)=>c.id==="main"&&c.type==="oauth");return!!v&&x2(v.quota,R.policyStorage)&&s2(v.quota)}return!0},m=(G)=>{let j=G.policyStorage.relay;if(j?.enabled===!0&&V2(j.transport,j.url)==="websocket")throw new L2},I=async(G,j)=>{if(m(G),j||G.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let J=await X.getRelayConfig();if(!J)throw Error("request refused: native HTTP relay configuration is unavailable");if(J.transport!=="http")throw new L2;return{dispatch:{kind:"http-relay",url:J.url,token:J.token},relayFallback:J.fallbackToDirect}};async function d(G,j,J){if(G.kind==="local")await X.publishLocal(G.subject,J);else if(G.kind==="vault"&&j.receipt)await X.vault.publish(j.receipt,J);else if(G.kind==="api"&&J.lastUsed!==void 0)await X.publishApi(G.subject,{lastUsed:J.lastUsed})}let n={async chooseAccount(G){let j=T(G);$.onOwnedRequest?.();let J=await X.read();j.signal.throwIfAborted(),m(J);let S=j2(await $.resolveModelId?.(G)??G.modelID);if(j.signal.throwIfAborted(),J.mode==="claustrum")J=await J1(X,j.signal),j.signal.throwIfAborted();if(J.policyStorage.quota?.enabled!==!1){let f=!1;for(let u of J.accounts){if(!X2(u)||u.type!=="oauth")continue;if(Z1(u.quota)?x2(u.quota,J.policyStorage,Date.now(),S):Date.now()-w2(u.quota)<b2(J.policyStorage))continue;try{await X.fetchQuota(u.id,$.fetch,j.signal),f=!0}catch{j.signal.throwIfAborted()}}if(f)J=await X.read();j.signal.throwIfAborted()}let R=G.rerouteFrom?P.get(G.rerouteFrom.limit.reason):void 0;if(G.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(G.rerouteFrom.limit.reason)&&!R)return;if(R&&G.rerouteFrom){P.delete(G.rerouteFrom.limit.reason);let f=J.accounts.find((z)=>z.id===R.accountId);if(!f||!q(f,J,S))return;let u=K(G,R.accountId),W=E.get(u)??[];return W.push(R),E.set(u,W),R.accountId}let x=[];for(let f of J.accounts){if(f.type!=="oauth"||!q(f,J,S))continue;if(f.source==="local"){let u=await X.authorizeLocal(f.id,{signal:j.signal,policy:(W,z)=>R2(W,z,S)});if(j.signal.throwIfAborted(),u.status!=="usable")continue}x.push(f)}let v=x.filter((f)=>f.id!==G.rerouteFrom?.accountId);if(a2(J.policyStorage)==="sticky-balanced"){let f=v.map((W,z)=>({accountId:W.id,order:z,quota:W.quota??{kind:"unknown"}})),u=await C(J).resolve({sessionId:G.sessionID,family:Y1(S),modelId:S,affinityModelId:G.modelID,candidates:f,retainAccountIds:new Set(v.map((W)=>W.id)),...J.mode==="claustrum"?{accountIdentities:new Map(J.accounts.flatMap((W)=>W.accountIdentity?[[W.id,W.accountIdentity]]:[]))}:{},storage:J.policyStorage,inputBytes:1,preferredAccountId:G.previousAccountId});if(j.signal.throwIfAborted(),u)return u.accountId}else{let u=a2(J.policyStorage)==="fallback-first"?[...v.filter((W)=>W.id!=="main"),...v.filter((W)=>W.id==="main")]:[...v.filter((W)=>W.id==="main"),...v.filter((W)=>W.id!=="main")];if(u[0])return u[0].id}if(J.mode==="claustrum")throw new W1;let c=J.accounts.find((f)=>f.id==="main"&&f.type==="oauth");if(!c)return;let o=c.quota;if(G.rerouteFrom?.limit.status===429||!x2(o,J.policyStorage))try{o=await X.fetchQuota("main",$.fetch,j.signal)}catch{return}if(j.signal.throwIfAborted(),!s2(o))return;return J.accounts.find((f)=>f.type==="api"&&X2(f)&&f.id!==G.rerouteFrom?.accountId)?.id},async authorizeAccount(G,j){let J=T(G),S=await X.read();J.signal.throwIfAborted(),m(S);let R=j2(await $.resolveModelId?.(G)??G.modelID);J.signal.throwIfAborted();let x=S.accounts.find((O)=>O.id===j);if(!x||!q(x,S,R))return;let v=K(G,j),c=E.get(v),o=c?.shift();if(c?.length===0)E.delete(v);let{dispatch:f,relayFallback:u}=await I(S,o?.direct===!0);if(J.signal.throwIfAborted(),o?.auth){if(!await A(j,R,o.auth.route,J))return;let O=_.get(o.auth.provenance);if(O?.receipt?.expiresAtMs!==void 0&&O.receipt.expiresAtMs!==null&&O.receipt.expiresAtMs<Date.now()+300000)return;if(O)_.set(o.auth.provenance,{...O,scope:{...G,modelID:R},account:x,active:J,relayFallback:u});return{...o.auth,dispatch:f}}let W={scope:{...G,modelID:R},active:J,account:x,retry:o?.retry??!1,relayFallback:u,quota:x.quota};if(x.type==="api"){let O=S.accounts.find((l)=>l.id==="main"&&l.type==="oauth");if(!O||!x2(O.quota,S.policyStorage)||!s2(O.quota))return;let k=await X.authorizeApi(j,J.signal);if(J.signal.throwIfAborted(),!await A(j,R,"api",J))return;let b={kind:"api",subject:k.subject};return _.set(b,W),{route:"api",headers:k.authHeader==="authorization-bearer"?{authorization:`Bearer ${k.apiKey}`}:{"x-api-key":k.apiKey},baseURL:k.baseURL,provenance:b,dispatch:f}}if(x.source==="vault"){let O=await X.authorizeVault(j,J.signal);if(J.signal.throwIfAborted(),!await A(j,R,"oauth",J))return;let k={kind:"vault",credentialId:O.credentialId,recordVersion:O.recordVersion};_.set(k,{...W,receipt:O});let b=O.assertedAccountIdentity;if(!b)return;return{route:"oauth",accessToken:O.accessToken,provenance:k,dispatch:f,identity:S2(b,b)}}let z=await X.authorizeLocal(j,{signal:J.signal,policy:(O,k)=>R2(O,k,R)});if(J.signal.throwIfAborted(),z.status!=="usable")return;if(!await A(j,R,"oauth",J))return;let N={kind:"local",subject:z.subject};_.set(N,{...W,access:z.access});let D=z.subject.binding.identity;return{route:"oauth",accessToken:z.access,provenance:N,dispatch:f,identity:S2(D,D)}},async requestOptions(G){let j=T(G),J=await X.read();j.signal.throwIfAborted();let S=J.accounts.find((x)=>x.id===G.accountId);if(!S||!q(S,J,G.modelID))throw Error("request refused: native account is ineligible for this model");let R=_.get(G.provenance);if(R)_.set(G.provenance,{...R,scope:{...R.scope,modelID:G.modelID}});return $.requestOptions(G,J)},async admitRequest(G){let j=_.get(G.provenance);if(!j||!await A(G.accountId,G.modelID,G.route,j.active))throw Error("request refused: native account policy changed before dispatch");_.set(G.provenance,{...j,scope:{...j.scope,modelID:G.modelID}})},onRequestPrepared:(G)=>$.onRequestPrepared?.(G),responseOptions(G){return $.responseOptions?.({...G,modelID:_.get(G.provenance)?.scope.modelID??G.modelID})},quotaFromHeaders(G,j){let J=_.get(j.provenance),S=B1(G);if(S)$.onRequestId?.(j,S);if(!J||j.route!=="oauth"||!j1(G))return;let R=j.provenance.kind==="local"?j.provenance.subject.binding.identity:J.receipt?.assertedAccountIdentity,x={...V1(G),...R?{accountIdentity:R}:{}};J.quota=e$(J.quota,x);let v=L.observe(d(j.provenance,J,{quota:J.quota}));return i.set(j.provenance,v),x},async limitFromResponse(G){let j=_.get(G.provenance);if(!j)return;if(G.status===401&&j.receipt){if(!Y.has(j.receipt))Y.add(j.receipt),await X.vault.reportFailure(j.receipt,401,G.dispatch==="http-relay"?"relay_status_field":"direct");if(j.retry||j.active.signal.aborted)return;let S=j.active,R=await X.vault.prepareRetry(j.receipt,S.signal);if(S.signal.throwIfAborted(),!R.retry)return;let x=R.receipt,v=x.assertedAccountIdentity;if(!v)return;let c={kind:"vault",credentialId:x.credentialId,recordVersion:x.recordVersion};_.set(c,{...j,receipt:x,retry:!0});let o=`vault-newer:${G.attemptId}`;return P.set(o,{sessionID:G.sessionID,accountId:G.accountId,retry:!0,auth:{route:"oauth",accessToken:x.accessToken,provenance:c,identity:S2(v,v)}}),Q(),{reason:o,status:401}}if(G.status===401&&G.provenance.kind==="local"&&j.access&&!j.retry){if(j.active.signal.aborted)return;let S=j.active,R=await X.authorizeLocal(G.accountId,{rejectedAccessToken:j.access,signal:S.signal,policy:(o,f)=>R2(o,f,j.scope.modelID)});if(S.signal.throwIfAborted(),R.status!=="usable"||R.access===j.access)return;let x={kind:"local",subject:R.subject};_.set(x,{...j,access:R.access,retry:!0});let v=R.subject.binding.identity,c=`local-newer:${G.attemptId}`;return P.set(c,{sessionID:G.sessionID,accountId:G.accountId,retry:!0,auth:{route:"oauth",accessToken:R.access,provenance:x,identity:S2(v,v)}}),Q(),{reason:c,status:401}}let J=await X.read();if($1(G.status,J.policyStorage))return{reason:`provider-${G.status}`,status:G.status};return},limitFromRelayFailure(G){let j=_.get(G.provenance);if(!j?.relayFallback||j.active.signal.aborted||!(G.status===401||G.status>=500))return;let J=`relay-direct:${G.attemptId}`;return P.set(J,{sessionID:G.sessionID,accountId:G.accountId,direct:!0,retry:!1}),Q(),{reason:J}},limitFromStreamError(G){return G.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(G,j){let J=_.get(j.provenance);if(j.dispatch==="http-relay"&&J?.relayFallback&&!J.active.signal.aborted&&G.status===void 0){let S=`relay-direct:${j.attemptId}`;return P.set(S,{sessionID:j.sessionID,accountId:j.accountId,direct:!0,retry:!1}),Q(),{reason:S}}return},async onAttemptEnd(G,j){let J=_.get(G.provenance);if(!J)return;try{if(await i.get(G.provenance),j.status===401&&J.receipt&&!Y.has(J.receipt))Y.add(J.receipt),await X.vault.reportFailure(J.receipt,401,G.dispatch==="http-relay"?"relay_status_field":"direct");if(!j.localRefusal&&j.status!==void 0)L.publish(()=>d(G.provenance,J,{lastUsed:Date.now()}))}finally{_.delete(G.provenance),i.delete(G.provenance)}},forgetSession(G){H.get(G)?.abort(),H.delete(G);for(let[j,J]of P)if(J.sessionID===G)P.delete(j);for(let[j,J]of E)if(J[0]?.sessionID===G)E.delete(j);$.onForgetSession?.(G)},resetRouting:async(G)=>C(await X.read()).clear(G),async recordPrime(G,j){let J=_.get(G);if(!J||J.active.signal.aborted)return!1;if(G.kind==="local")return X.incrementPrimeUsage(J.account.id,G.subject,j);if(G.kind==="vault"&&J.receipt)return X.incrementPrimeUsage(J.account.id,J.receipt,j);return!1},close(){U=!0;for(let G of H.values())G.abort();return H.clear(),E.clear(),P.clear(),L.drain()}},i=new WeakMap;return n}function H1(){let $=new K1,X=new Map,L=new Map,V=new Map,C=new Set,_=new Set,P=new Map,E=(H)=>{while(H.size>512){let Y=H.keys().next();if(!Y.done)H.delete(Y.value)}};return{async install(H){let Y=[];try{Y.push(await H.session.hook("context",(U)=>{let Q=U.messages.map((T)=>{return{info:{id:T.id,sessionID:U.sessionID,role:T.role,agent:U.agent,model:{providerID:U.model.providerID,modelID:U.model.id}},parts:T.content.map((q)=>({type:q.type,...q.type==="text"?{text:q.text}:{}}))}});$.observeMessages(Q);let K=U.messages.findLast((T)=>T.role==="user"&&T.id);if(K?.id)X.set(U.sessionID,K.id);if(K?.content.some((T)=>T.type==="text"&&T.text===f2))C.add(U.sessionID);else C.delete(U.sessionID);E(X)},{providerID:"anthropic"})),Y.push(await H.session.hook("model.request",(U)=>{if(U.kind!=="primary")return;let Q=X.get(U.sessionID);if(!Q)return;if($.markHeaders({sessionId:U.sessionID,messageId:Q,agent:U.agent,headers:U.headers}),C.has(U.sessionID))U.headers[O2]="1"},{providerID:"anthropic"}))}catch(U){throw await Promise.allSettled(Y.map((Q)=>Q.dispose())),U}return{dispose:async()=>{await Promise.all(Y.map((U)=>U.dispose()))}}},requestOptions(H,Y){let U=$.resolveHeader(H.correlation[k2]);if(U)L.set(H.attemptId,U),E(L);P.set(H.attemptId,H.sessionID),E(P);let Q=H.correlation[O2]==="1";if(Q)_.add(H.attemptId);return{cache1hEnabled:H.agent!=="compaction"&&H.agent!=="title"&&(Y.policyStorage.claudeCache?.enabled??!0),cache1hMode:Y.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:Y.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:Y.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,serverSideFallbackEnabled:z1(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:Q,billingLineage:U?{promptId:U.promptId,previousRequestId:U.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:V.get(H.sessionID)}},responseOptions(H){return{serverSideFallbackModel:j2(H.modelID),laneStart:_.has(H.attemptId),onMessageStart(Y){if(H.kind==="primary"&&typeof Y.id==="string")V.set(H.sessionID,Y.id),E(V)},onStreamEnd(){L.delete(H.attemptId),_.delete(H.attemptId),P.delete(H.attemptId)}}},onRequestId(H,Y){$.commit(L.get(H.attemptId),Y)},forgetSession(H){$.clearSession(H),X.delete(H),V.delete(H),C.delete(H);for(let[Y,U]of P)if(U===H)L.delete(Y),_.delete(Y),P.delete(Y)}}}var g2="cortexkit-anthropic-auth",d1='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',u1="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",p1="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function c1($){let X=$.authorize??y2,L=$.exchange??I2,V=()=>{if(!$.isActive())throw Error("Claude authentication setup is closed")},C=async()=>{let E;try{E=await $.readMode()}catch{throw Error(p1)}return V(),E},_=async()=>{if(await C()!=="local")throw Error(d1)};return{integrationID:"anthropic",methods:[{method:{id:N1,type:"oauth",label:P1},async authorize(){V(),await _();let E=await X("max");return V(),{mode:"code",url:E.url,instructions:"Paste the authorization code returned by Claude.",callback:async(H)=>{V();let Y=await L(H,E.verifier,E.redirectUri,E.state);if(!$.isActive()||Y.type!=="success")throw Error("Claude sign-in did not complete");return{access:Y.access,refresh:Y.refresh,expires:Y.expires}}}}}],vault:{method:{id:F1,type:"oauth",label:"Claude vault accounts"},async activate(){if(V(),await C()!=="claustrum")throw Error(u1)}},async onLogin(E){V(),await _(),await $.runtime.loginOAuth({routeId:"main",credential:E,replace:!0}),V()},label:"Claude native account pool"}}function i1($){return{readMode:()=>U1("opencode",$),disconnectVault:()=>C1({host:"opencode",env:$})}}function t2($={}){return{id:g2,setup:(X)=>O1(X,$)}}async function O1($,X={}){let L=X.paths??await L1(),V=M1({paths:L,host:"opencode",local:X.local,vault:X.vault}),C=i1(X.vault?.env??process.env),_=!0,P=H1(),E=n$(),H,Y,U,Q=Q1({runtime:V,paths:L,fetch:X.fetch,requestOptions:P.requestOptions,responseOptions:P.responseOptions,onRequestId:P.onRequestId,onForgetSession:P.forgetSession,onRequestPrepared:async(I)=>{try{await U?.track(I)}catch{H2.warn("cachekeep","live request tracking failed")}},resolveModelId:async(I)=>E.modelId(I.modelID),onOwnedRequest:()=>{H??=k$(V,X.fetch),Y??=t$({runtime:V,paths:L,source:Q,fetch:X.fetch})}});U=R$({...X.cacheKeep,runtime:V,source:Q,fetch:X.fetch,isSubagent:async(I)=>Boolean((await $.session.get({sessionID:I})).parentID)});let K=u$({runtime:V,source:Q,cacheKeepRegistry:U.registry,start:async(I,d)=>{await $.session.synthetic({sessionID:I,text:d,description:"Claude lane start",resume:!0})}}),T=[],q=await A$($,{source:Q,log:{warn:(I,d)=>H2.warn("opencode2",I,d)}},{credential:r$}).catch(async(I)=>{throw K.close(),await U?.dispose(),await Q.close(),V.close(),I}),A,m=()=>{if(A)return A;return _=!1,K.close(),Q.close(),A=(async()=>{await Promise.allSettled([q.dispose(),H?.dispose(),Y?.dispose(),U?.dispose(),...T.map((I)=>I.dispose())]),await Q.close(),V.close()})(),A};try{T.push(await P.install($)),T.push(await E.install($)),T.push(await h2($,c1({isActive:()=>_,readMode:C.readMode,runtime:V})));let I={host:"opencode",dispatch:K.dispatch,readStatus:(n)=>K.readStatus(n),readAccounts:()=>V.read(),readMode:C.readMode,disconnectVault:C.disconnectVault,interactive:!0},d=_1(I);return T.push(await T1($,d,K)),m}catch(I){throw await m(),I}}var G0={id:g2,setup:t2().setup,server:E1};export{O1 as setupAnthropicAuth,G0 as default,t2 as createAnthropicAuthPlugin,g2 as ANTHROPIC_AUTH_PLUGIN_ID};

package/dist/v2/setup.d.ts

@@ -1,6 +1,7 @@
 import { authorize, exchange, type NativeAccountRuntime, type NativeAccountRuntimeOptions, type NativePoolPaths } from '@cortexkit/anthropic-auth-core';
 import { type RegisterOpenCode2AuthMethodsOptions } from '@cortexkit/common-auth/opencode2';
 import type { Plugin } from '@opencode/plugin';
+import { type NativeCacheKeepOptions } from './cachekeep';
 export declare const ANTHROPIC_AUTH_PLUGIN_ID = "cortexkit-anthropic-auth";
 /**
  * The account source vault enrollment selects: 'local' serves accounts stored
@@ -13,6 +14,7 @@ export interface AnthropicAuthV2Options {
     readonly local?: NativeAccountRuntimeOptions['local'];
     readonly vault?: NativeAccountRuntimeOptions['vault'];
     readonly fetch?: typeof fetch;
+    readonly cacheKeep?: NativeCacheKeepOptions;
 }
 /** The OAuth result a completed Claude Pro / Max sign-in hands to the pool. */
 export interface ClaudeOAuthLogin {

package/dist/v2/source.d.ts

@@ -25,6 +25,7 @@ export interface NativeSourceOptions {
     readonly onRequestId?: (scope: NativeAnthropicResponseContext<NativeSourceProvenance>, requestId: string) => void;
     readonly onForgetSession?: (sessionID: string) => void;
     readonly onOwnedRequest?: () => void;
+    readonly onRequestPrepared?: NativeSource['onRequestPrepared'];
     readonly fetch?: typeof fetch;
     /** Resolve a host model alias to the upstream ID before request-local policy. */
     readonly resolveModelId?: (scope: RequestScope) => Promise<string>;

package/dist/v2/tui.js

@@ -1,2 +1,2 @@
-import{s as F}from"../index-1jkyhgyr.js";import"../index-mge0rw54.js";async function V(B){let Y=B.client.rpc(F),K=!0,$=!1,L=new AbortController,O=()=>{let w=B.ui.router.current();return w.type==="session"?w.sessionID:void 0};function M(w){return new Promise((J)=>{let j="",G=!1,Q=B.keymap.mode.push("cortexkit-protected-entry"),H=(z,D=!0)=>{if(G)return;G=!0,B.renderer.keyInput.off("keypress",X),B.renderer.keyInput.off("paste",Z),L.signal.removeEventListener("abort",W),Q();let q=z?j:void 0;if(j="",D)B.ui.dialog.clear();J(q)},W=()=>H(!1),X=(z)=>{if(z.preventDefault(),z.stopPropagation(),z.name==="escape"||z.ctrl&&z.name==="c")return H(!1);if(z.name==="return"||z.name==="enter")return H(!0);if(z.name==="backspace"){j=Array.from(j).slice(0,-1).join("");return}if(!z.ctrl&&!z.meta&&!z.option&&Array.from(z.sequence).every((D)=>D.charCodeAt(0)>=32&&D.charCodeAt(0)!==127))j=(j+z.sequence).slice(0,4096)},Z=(z)=>{z.preventDefault(),z.stopPropagation(),j=(j+Array.from(new TextDecoder().decode(z.bytes)).filter((D)=>D.charCodeAt(0)>=32&&D.charCodeAt(0)!==127).join("")).slice(0,4096)};if(B.renderer.keyInput.prependListener("keypress",X),B.renderer.keyInput.prependListener("paste",Z),L.signal.addEventListener("abort",W,{once:!0}),B.ui.dialog.alert({title:w,message:"Type or paste the value. Input is hidden. Enter accepts; Escape cancels."}).then(()=>H(!1,!1),()=>H(!1,!1)),L.signal.aborted)W()})}async function P(w){let J={};for(let j of w.knobs){if(!K)return;if(j.kind==="choice"){let G=await B.ui.dialog.select({title:j.label,options:j.choices.map((Q)=>({title:Q.label,value:Q.value})),current:j.value});if(G===void 0)return;J[j.id]=G}else if(j.kind==="toggle"){let G=await B.ui.dialog.select({title:j.label,options:[{title:"On",value:!0},{title:"Off",value:!1}],current:j.value});if(G===void 0)return;J[j.id]=G}else{let G=j.kind==="text"&&j.masked?await M(j.label):await B.ui.dialog.prompt({title:j.label,value:j.value===void 0?void 0:String(j.value),placeholder:j.kind==="text"?j.placeholder:void 0});if(G===void 0)return;J[j.id]=G===""&&!j.required?null:j.kind==="number"?Number(G):G}}return J}async function C(w,J){if(!K||$||O()!==w)return;$=!0;let j=J;try{while(K&&O()===w){let G=await B.ui.dialog.select({title:j.menu.title,options:j.menu.sections.map((D)=>({title:D.title,description:D.lines.join(`
+import{s as F}from"../index-1jkyhgyr.js";import"../index-rftced5v.js";async function V(B){let Y=B.client.rpc(F),K=!0,$=!1,L=new AbortController,O=()=>{let w=B.ui.router.current();return w.type==="session"?w.sessionID:void 0};function M(w){return new Promise((J)=>{let j="",G=!1,Q=B.keymap.mode.push("cortexkit-protected-entry"),H=(z,D=!0)=>{if(G)return;G=!0,B.renderer.keyInput.off("keypress",X),B.renderer.keyInput.off("paste",Z),L.signal.removeEventListener("abort",W),Q();let q=z?j:void 0;if(j="",D)B.ui.dialog.clear();J(q)},W=()=>H(!1),X=(z)=>{if(z.preventDefault(),z.stopPropagation(),z.name==="escape"||z.ctrl&&z.name==="c")return H(!1);if(z.name==="return"||z.name==="enter")return H(!0);if(z.name==="backspace"){j=Array.from(j).slice(0,-1).join("");return}if(!z.ctrl&&!z.meta&&!z.option&&Array.from(z.sequence).every((D)=>D.charCodeAt(0)>=32&&D.charCodeAt(0)!==127))j=(j+z.sequence).slice(0,4096)},Z=(z)=>{z.preventDefault(),z.stopPropagation(),j=(j+Array.from(new TextDecoder().decode(z.bytes)).filter((D)=>D.charCodeAt(0)>=32&&D.charCodeAt(0)!==127).join("")).slice(0,4096)};if(B.renderer.keyInput.prependListener("keypress",X),B.renderer.keyInput.prependListener("paste",Z),L.signal.addEventListener("abort",W,{once:!0}),B.ui.dialog.alert({title:w,message:"Type or paste the value. Input is hidden. Enter accepts; Escape cancels."}).then(()=>H(!1,!1),()=>H(!1,!1)),L.signal.aborted)W()})}async function P(w){let J={};for(let j of w.knobs){if(!K)return;if(j.kind==="choice"){let G=await B.ui.dialog.select({title:j.label,options:j.choices.map((Q)=>({title:Q.label,value:Q.value})),current:j.value});if(G===void 0)return;J[j.id]=G}else if(j.kind==="toggle"){let G=await B.ui.dialog.select({title:j.label,options:[{title:"On",value:!0},{title:"Off",value:!1}],current:j.value});if(G===void 0)return;J[j.id]=G}else{let G=j.kind==="text"&&j.masked?await M(j.label):await B.ui.dialog.prompt({title:j.label,value:j.value===void 0?void 0:String(j.value),placeholder:j.kind==="text"?j.placeholder:void 0});if(G===void 0)return;J[j.id]=G===""&&!j.required?null:j.kind==="number"?Number(G):G}}return J}async function C(w,J){if(!K||$||O()!==w)return;$=!0;let j=J;try{while(K&&O()===w){let G=await B.ui.dialog.select({title:j.menu.title,options:j.menu.sections.map((D)=>({title:D.title,description:D.lines.join(`
 `),value:D}))});if(!G||!K||O()!==w)return;let Q=[...G.actions.map((D)=>({action:D,itemId:void 0})),...G.items.flatMap((D)=>D.actions.map((q)=>({action:q,itemId:D.id})))],H=await B.ui.dialog.select({title:G.title,options:Q.map((D)=>({title:D.action.label,description:D.action.description,value:D}))});if(!H)continue;let W=await P(H.action);if(!W||!K||O()!==w)return;let X=H.action.confirm?await B.ui.dialog.confirm({title:H.action.label,message:H.action.confirm.message}):void 0;if(H.action.confirm&&X!==!0)continue;if(!K||O()!==w)return;let Z={command:"claude",sectionId:G.id,itemId:H.itemId,actionId:H.action.id,sessionId:w,values:W,confirmed:X},z=await Y.apply(Z,{signal:L.signal,location:B.location});if(!K||O()!==w)return;await B.ui.dialog.alert({title:z.ok?"Claude":"Claude action refused",message:z.text}),j={command:z.command,menu:z.menu}}}finally{$=!1}}let R=Y.events.on("opened",(w)=>C(w.data.sessionId,w.data.payload),{signal:L.signal}),U=Y.events.on("notification",(w)=>{if(K&&O()===w.data.sessionId)B.ui.toast.show({title:"Claude",sessionID:w.data.sessionId,message:w.data.message,variant:w.data.kind})},{signal:L.signal});return B.keymap.layer(()=>({commands:[{id:"cortexkit.claude",title:"Claude",group:"Claude",palette:!0,slash:{name:"claude"},async run(){let w=O();if(!w){await B.ui.dialog.alert({title:"Claude",message:"Open a session before using the Claude menu."});return}let J=await Y.open({sessionId:w},{signal:L.signal,location:B.location});await C(w,J)}}]})),()=>{K=!1,L.abort(),R(),U()}}var T={id:"cortexkit-anthropic-auth",setup:V};export{V as setupAnthropicTui,T as default};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/opencode-anthropic-auth",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "type": "module",
   "repository": {
     "type": "git",
@@ -77,7 +77,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.6.0",
-    "@cortexkit/anthropic-auth-core": "2.0.2",
+    "@cortexkit/anthropic-auth-core": "2.0.3",
     "@opentui/core": "0.6.0",
     "@opentui/solid": "0.6.0",
     "jsonc-parser": "^3.3.1",