@cortexkit/opencode-anthropic-auth 2.0.2 → 2.1.0

package/dist/index-j0wsgy54.js

@@ -1,449 +0,0 @@
-import{we as _X}from"./index-fn0zqnnw.js";import{Ve as MX}from"./index-mge0rw54.js";import{createHash as _w,randomUUID as B2}from"node:crypto";import{mkdir as pV,readFile as q2,rename as cV,rm as J9,stat as CX,writeFile as j2}from"node:fs/promises";import{homedir as lV}from"node:os";import{dirname as dV,join as v8}from"node:path";import{readdirSync as iV,statSync as sV}from"node:fs";import*as Fz from"node:fs/promises";import{tmpdir as tV,userInfo as Z7}from"node:os";import{join as E9}from"node:path";import{createHash as oB}from"node:crypto";var NW=new Uint8Array([0,97,115,109,1,0,0,0,1,48,8,96,3,127,127,127,1,127,96,3,127,127,127,0,96,2,127,127,0,96,1,127,1,127,96,3,127,127,126,1,126,96,3,126,127,127,1,126,96,2,127,126,0,96,1,127,1,126,3,11,10,0,0,2,1,3,4,5,6,1,7,5,3,1,0,1,7,85,9,3,109,101,109,2,0,5,120,120,104,51,50,0,0,6,105,110,105,116,51,50,0,2,8,117,112,100,97,116,101,51,50,0,3,8,100,105,103,101,115,116,51,50,0,4,5,120,120,104,54,52,0,5,6,105,110,105,116,54,52,0,7,8,117,112,100,97,116,101,54,52,0,8,8,100,105,103,101,115,116,54,52,0,9,10,251,22,10,242,1,1,4,127,32,0,32,1,106,33,3,32,1,65,16,79,4,127,32,3,65,16,107,33,6,32,2,65,168,136,141,161,2,106,33,3,32,2,65,137,235,208,208,7,107,33,4,32,2,65,207,140,162,142,6,106,33,5,3,64,32,3,32,0,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,3,32,4,32,0,65,4,106,34,0,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,4,32,2,32,0,65,4,106,34,0,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,2,32,5,32,0,65,4,106,34,0,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,5,32,6,32,0,65,4,106,34,0,79,13,0,11,32,2,65,12,119,32,5,65,18,119,106,32,4,65,7,119,106,32,3,65,1,119,106,5,32,2,65,177,207,217,178,1,106,11,32,1,106,32,0,32,1,65,15,113,16,1,11,146,1,0,32,1,32,2,106,33,2,3,64,32,1,65,4,106,32,2,75,69,4,64,32,0,32,1,40,2,0,65,189,220,202,149,124,108,106,65,17,119,65,175,214,211,190,2,108,33,0,32,1,65,4,106,33,1,12,1,11,11,3,64,32,1,32,2,79,69,4,64,32,0,32,1,45,0,0,65,177,207,217,178,1,108,106,65,11,119,65,177,243,221,241,121,108,33,0,32,1,65,1,106,33,1,12,1,11,11,32,0,32,0,65,15,118,115,65,247,148,175,175,120,108,34,0,65,13,118,32,0,115,65,189,220,202,149,124,108,34,0,65,16,118,32,0,115,11,63,0,32,0,65,8,106,32,1,65,168,136,141,161,2,106,54,2,0,32,0,65,12,106,32,1,65,137,235,208,208,7,107,54,2,0,32,0,65,16,106,32,1,54,2,0,32,0,65,20,106,32,1,65,207,140,162,142,6,106,54,2,0,11,195,4,1,6,127,32,1,32,2,106,33,6,32,0,65,24,106,33,4,32,0,65,40,106,40,2,0,33,3,32,0,32,0,40,2,0,32,2,106,54,2,0,32,0,65,4,106,34,5,32,5,40,2,0,32,2,65,16,79,32,0,40,2,0,65,16,79,114,114,54,2,0,32,2,32,3,106,65,16,73,4,64,32,3,32,4,106,32,1,32,2,252,10,0,0,32,0,65,40,106,32,2,32,3,106,54,2,0,15,11,32,3,4,64,32,3,32,4,106,32,1,65,16,32,3,107,34,2,252,10,0,0,32,0,65,8,106,34,3,32,3,40,2,0,32,4,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,54,2,0,32,0,65,12,106,34,3,32,3,40,2,0,32,4,65,4,106,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,54,2,0,32,0,65,16,106,34,3,32,3,40,2,0,32,4,65,8,106,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,54,2,0,32,0,65,20,106,34,3,32,3,40,2,0,32,4,65,12,106,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,54,2,0,32,0,65,40,106,65,0,54,2,0,32,1,32,2,106,33,1,11,32,1,32,6,65,16,107,77,4,64,32,6,65,16,107,33,8,32,0,65,8,106,40,2,0,33,2,32,0,65,12,106,40,2,0,33,3,32,0,65,16,106,40,2,0,33,5,32,0,65,20,106,40,2,0,33,7,3,64,32,2,32,1,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,2,32,3,32,1,65,4,106,34,1,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,3,32,5,32,1,65,4,106,34,1,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,5,32,7,32,1,65,4,106,34,1,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,7,32,8,32,1,65,4,106,34,1,79,13,0,11,32,0,65,8,106,32,2,54,2,0,32,0,65,12,106,32,3,54,2,0,32,0,65,16,106,32,5,54,2,0,32,0,65,20,106,32,7,54,2,0,11,32,1,32,6,73,4,64,32,4,32,1,32,6,32,1,107,34,1,252,10,0,0,32,0,65,40,106,32,1,54,2,0,11,11,97,1,1,127,32,0,65,16,106,40,2,0,33,1,32,0,65,4,106,40,2,0,4,127,32,1,65,12,119,32,0,65,20,106,40,2,0,65,18,119,106,32,0,65,12,106,40,2,0,65,7,119,106,32,0,65,8,106,40,2,0,65,1,119,106,5,32,1,65,177,207,217,178,1,106,11,32,0,40,2,0,106,32,0,65,24,106,32,0,65,40,106,40,2,0,16,1,11,255,3,2,3,126,1,127,32,0,32,1,106,33,6,32,1,65,32,79,4,126,32,6,65,32,107,33,6,32,2,66,214,235,130,238,234,253,137,245,224,0,124,33,3,32,2,66,177,169,172,193,173,184,212,166,61,125,33,4,32,2,66,249,234,208,208,231,201,161,228,225,0,124,33,5,3,64,32,3,32,0,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,3,32,4,32,0,65,8,106,34,0,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,4,32,2,32,0,65,8,106,34,0,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,2,32,5,32,0,65,8,106,34,0,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,5,32,6,32,0,65,8,106,34,0,79,13,0,11,32,2,66,12,137,32,5,66,18,137,124,32,4,66,7,137,124,32,3,66,1,137,124,32,3,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,4,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,2,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,5,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,5,32,2,66,197,207,217,178,241,229,186,234,39,124,11,32,1,173,124,32,0,32,1,65,31,113,16,6,11,134,2,0,32,1,32,2,106,33,2,3,64,32,2,32,1,65,8,106,79,4,64,32,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,32,0,133,66,27,137,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,33,0,32,1,65,8,106,33,1,12,1,11,11,32,1,65,4,106,32,2,77,4,64,32,0,32,1,53,2,0,66,135,149,175,175,152,182,222,155,158,127,126,133,66,23,137,66,207,214,211,190,210,199,171,217,66,126,66,249,243,221,241,153,246,153,171,22,124,33,0,32,1,65,4,106,33,1,11,3,64,32,1,32,2,73,4,64,32,0,32,1,49,0,0,66,197,207,217,178,241,229,186,234,39,126,133,66,11,137,66,135,149,175,175,152,182,222,155,158,127,126,33,0,32,1,65,1,106,33,1,12,1,11,11,32,0,32,0,66,33,136,133,66,207,214,211,190,210,199,171,217,66,126,34,0,32,0,66,29,136,133,66,249,243,221,241,153,246,153,171,22,126,34,0,32,0,66,32,136,133,11,77,0,32,0,65,8,106,32,1,66,214,235,130,238,234,253,137,245,224,0,124,55,3,0,32,0,65,16,106,32,1,66,177,169,172,193,173,184,212,166,61,125,55,3,0,32,0,65,24,106,32,1,55,3,0,32,0,65,32,106,32,1,66,249,234,208,208,231,201,161,228,225,0,124,55,3,0,11,244,4,2,3,127,4,126,32,1,32,2,106,33,5,32,0,65,40,106,33,4,32,0,65,200,0,106,40,2,0,33,3,32,0,32,0,41,3,0,32,2,173,124,55,3,0,32,2,32,3,106,65,32,73,4,64,32,3,32,4,106,32,1,32,2,252,10,0,0,32,0,65,200,0,106,32,2,32,3,106,54,2,0,15,11,32,3,4,64,32,3,32,4,106,32,1,65,32,32,3,107,34,2,252,10,0,0,32,0,65,8,106,34,3,32,3,41,3,0,32,4,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,55,3,0,32,0,65,16,106,34,3,32,3,41,3,0,32,4,65,8,106,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,55,3,0,32,0,65,24,106,34,3,32,3,41,3,0,32,4,65,16,106,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,55,3,0,32,0,65,32,106,34,3,32,3,41,3,0,32,4,65,24,106,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,55,3,0,32,0,65,200,0,106,65,0,54,2,0,32,1,32,2,106,33,1,11,32,1,65,32,106,32,5,77,4,64,32,5,65,32,107,33,2,32,0,65,8,106,41,3,0,33,6,32,0,65,16,106,41,3,0,33,7,32,0,65,24,106,41,3,0,33,8,32,0,65,32,106,41,3,0,33,9,3,64,32,6,32,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,6,32,7,32,1,65,8,106,34,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,7,32,8,32,1,65,8,106,34,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,8,32,9,32,1,65,8,106,34,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,9,32,2,32,1,65,8,106,34,1,79,13,0,11,32,0,65,8,106,32,6,55,3,0,32,0,65,16,106,32,7,55,3,0,32,0,65,24,106,32,8,55,3,0,32,0,65,32,106,32,9,55,3,0,11,32,1,32,5,73,4,64,32,4,32,1,32,5,32,1,107,34,1,252,10,0,0,32,0,65,200,0,106,32,1,54,2,0,11,11,188,2,1,5,126,32,0,65,24,106,41,3,0,33,1,32,0,41,3,0,34,2,66,32,90,4,126,32,0,65,8,106,41,3,0,34,3,66,1,137,32,0,65,16,106,41,3,0,34,4,66,7,137,124,32,1,66,12,137,32,0,65,32,106,41,3,0,34,5,66,18,137,124,124,32,3,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,4,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,1,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,5,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,5,32,1,66,197,207,217,178,241,229,186,234,39,124,11,32,2,124,32,0,65,40,106,32,2,66,31,131,167,16,6,11]);async function E5(){return function($){let{exports:{mem:Z,xxh32:J,xxh64:X,init32:Y,update32:G,digest32:z,init64:Q,update64:K,digest64:W}}=$,V=new Uint8Array(Z.buffer);function B(N,R){if(Z.buffer.byteLength<N+R){let S=Math.ceil((N+R-Z.buffer.byteLength)/65536);Z.grow(S),V=new Uint8Array(Z.buffer)}}function q(N,R,S,E,m,s){B(N);let c=new Uint8Array(N);return V.set(c),S(0,R),c.set(V.subarray(0,N)),{update(I){let O;return V.set(c),typeof I=="string"?(B(3*I.length,N),O=L.encodeInto(I,V.subarray(N)).written):(B(I.byteLength,N),V.set(I,N),O=I.byteLength),E(0,N,O),c.set(V.subarray(0,N)),this},digest:()=>(V.set(c),s(m(0)))}}function H(N){return N>>>0}let j=2n**64n-1n;function x(N){return N&j}let L=new TextEncoder,U=0,M=0n;function A(N,R=U){return B(3*N.length,0),H(J(0,L.encodeInto(N,V).written,R))}function _(N,R=M){return B(3*N.length,0),x(X(0,L.encodeInto(N,V).written,R))}return{h32:A,h32ToString:(N,R=U)=>A(N,R).toString(16).padStart(8,"0"),h32Raw:(N,R=U)=>(B(N.byteLength,0),V.set(N),H(J(0,N.byteLength,R))),create32:(N=U)=>q(48,N,Y,G,z,H),h64:_,h64ToString:(N,R=M)=>_(N,R).toString(16).padStart(16,"0"),h64Raw:(N,R=M)=>(B(N.byteLength,0),V.set(N),x(X(0,N.byteLength,R))),create64:(N=M)=>q(88,N,Q,K,W,x)}}((await WebAssembly.instantiate(NW)).instance)}import{randomBytes as Hq,randomUUID as J3}from"node:crypto";import{createHash as Sq,randomBytes as kq}from"node:crypto";import{lstat as z7,mkdir as vq,readdir as Y3,readFile as uX,rename as fq,unlink as G3,writeFile as Eq}from"node:fs/promises";import{tmpdir as bq}from"node:os";import{join as MZ,resolve as _9}from"node:path";import*as O$ from"node:fs";import*as z3 from"node:os";import*as Q3 from"node:path";import{Buffer as y9}from"node:buffer";import{types as J8}from"node:util";import{types as fJ}from"node:util";import{randomUUID as WY}from"node:crypto";import{mkdir as KL,readdir as WL,readFile as VL,rename as BL,rm as VY,writeFile as qL}from"node:fs/promises";import{tmpdir as jL}from"node:os";import{join as L7}from"node:path";import{createHash as xL,randomBytes as DL,randomUUID as u3}from"node:crypto";import{constants as BY}from"node:fs";import{chmod as OL,mkdir as pJ,open as p3,realpath as ML,rename as c3,stat as IL,unlink as cJ}from"node:fs/promises";import{homedir as _L}from"node:os";import{basename as lJ,dirname as p8,extname as qY,isAbsolute as PL,join as m9,resolve as AL}from"node:path";import{readdirSync as ZV,statSync as JV}from"node:fs";import{tmpdir as HX,userInfo as XV}from"node:os";import{join as V8}from"node:path";import{debuglog as TW}from"node:util";import{createHmac as OW,randomBytes as MW,timingSafeEqual as IW}from"node:crypto";import DW from"node:net";var a6=2,N1=21,U1=5,mZ=67108864,i;(function($){$[$.Request=0]="Request",$[$.Response=1]="Response",$[$.Push=2]="Push",$[$.StreamData=3]="StreamData",$[$.StreamEnd=4]="StreamEnd",$[$.Error=5]="Error",$[$.Cancel=6]="Cancel",$[$.Ping=7]="Ping",$[$.Pong=8]="Pong",$[$.Hello=9]="Hello",$[$.HelloAck=10]="HelloAck",$[$.Goodbye=11]="Goodbye"})(i||(i={}));var b5=i.Goodbye;function g5($){return $===i.Cancel||$===i.Ping||$===i.Pong||$===i.Goodbye}var w6;(function($){$[$.Passive=0]="Passive",$[$.Interactive=1]="Interactive",$[$.Background=2]="Background"})(w6||(w6={}));var E6;(function($){$[$.Normal=0]="Normal",$[$.Expedite=1]="Expedite",$[$.Sheddable=2]="Sheddable"})(E6||(E6={}));var y5=1,h5=6,uZ=1,UW=8,m5=48,pZ=4;var u5=0;function m6($,Z,J,X=E6.Normal){let Y=0;if($)Y|=y5;if(Y|=Z<<uZ,J)Y|=UW;return Y|=X<<pZ,Y}function cZ($){return($&y5)!==0}function p5($){let Z=new Uint8Array(21),J=new DataView(Z.buffer);return J.setUint32(0,$.len,!0),Z[4]=$.ver,Z[5]=$.ty,Z[6]=$.flags,J.setUint16(7,$.channel,!0),J.setUint32(9,$.epoch,!0),J.setBigUint64(13,$.corr,!0),Z}class Q6 extends Error{code;constructor($,Z){super($);this.code=Z,this.name="DecodeError"}}function xW($){let Z=$.len>>>0,J=$.ver>>>0&255,X=$.ty>>>0&255,Y=$.flags>>>0&255,G=$.channel>>>0&65535,z=$.epoch>>>0;if(BigInt.asUintN(64,$.corr),J!==2)throw new Q6(`unsupported envelope version ${J}`,"unsupported_version");if(X>b5)throw new Q6(`unknown frame type byte ${X}`,"unknown_frame_type");let Q=X;if((Y&u5)!==0)throw new Q6(`reserved flag bits set in flags 0b${Y.toString(2).padStart(8,"0")}`,"reserved_flag_bits");if((Y&h5)>>uZ===3)throw new Q6(`reserved priority bits set in flags 0b${Y.toString(2).padStart(8,"0")}`,"reserved_priority_bits");let K=(Y&m5)>>pZ;if(K===3)throw new Q6(`reserved admission class set in flags 0b${Y.toString(2).padStart(8,"0")}`,"reserved_admission_class");if(K===E6.Sheddable&&Q!==i.Push&&Q!==i.StreamData)throw new Q6(`SHEDDABLE admission class is illegal on ${i[Q]} in flags 0b${Y.toString(2).padStart(8,"0")}`,"sheddable_illegal_frame_type");if(G===0&&z!==0)throw new Q6(`control channel carried nonzero epoch ${z}`,"nonzero_epoch_on_control_channel");if(g5(Q)&&Z!==0)throw new Q6(`pure-header frame ${i[Q]} declared non-zero body length ${Z}`,"pure_header_frame_with_body")}function lZ($){if($.length<5)throw new Q6(`header shorter than frozen prefix: have ${$.length} bytes`,"too_short_for_prefix");let Z=$[4];if(Z!==2)throw new Q6(`unsupported envelope version ${Z}`,"unsupported_version");if($.length<21)throw new Q6(`header too short for version: have ${$.length} bytes, need 21`,"too_short_for_header");let J=new DataView($.buffer,$.byteOffset,$.byteLength),X=J.getUint32(0,!0),Y=$[5];if(Y>b5)throw new Q6(`unknown frame type byte ${Y}`,"unknown_frame_type");let G=Y,z=$[6];if((z&u5)!==0)throw new Q6(`reserved flag bits set in flags 0b${z.toString(2).padStart(8,"0")}`,"reserved_flag_bits");if((z&h5)>>uZ===3)throw new Q6(`reserved priority bits set in flags 0b${z.toString(2).padStart(8,"0")}`,"reserved_priority_bits");let Q=(z&m5)>>pZ;if(Q===3)throw new Q6(`reserved admission class set in flags 0b${z.toString(2).padStart(8,"0")}`,"reserved_admission_class");if(Q===E6.Sheddable&&G!==i.Push&&G!==i.StreamData)throw new Q6(`SHEDDABLE admission class is illegal on ${i[G]} in flags 0b${z.toString(2).padStart(8,"0")}`,"sheddable_illegal_frame_type");let K=J.getUint16(7,!0),W=J.getUint32(9,!0);if(K===0&&W!==0)throw new Q6(`control channel carried nonzero epoch ${W}`,"nonzero_epoch_on_control_channel");if(g5(G)&&X!==0)throw new Q6(`pure-header frame ${i[G]} declared non-zero body length ${X}`,"pure_header_frame_with_body");return{len:X,ver:Z,ty:G,flags:z,channel:K,epoch:W,corr:J.getBigUint64(13,!0)}}function b6($,Z,J,X,Y,G){return P$(2,$,Z,J,X,Y,G)}function P$($,Z,J,X,Y,G,z){if(z.length>67108864)throw new Q6(`frame body ${z.length} exceeds max 67108864`,"frame_body_too_large");let Q={len:z.length,ver:$,ty:Z,flags:J,channel:X,epoch:Y,corr:G};return xW(Q),{header:Q,body:z}}function q$($){if($.header.len!==$.body.length)throw new Q6(`frame header length ${$.header.len} does not match body length ${$.body.length}`,"frame_length_mismatch");let Z=p5($.header),J=new Uint8Array(Z.length+$.body.length);return J.set(Z,0),J.set($.body,Z.length),J}class y$ extends Error{}class j$ extends Error{}class A$ extends Error{cause;constructor($,Z){super($);this.cause=Z}}class $0 extends Error{cause;constructor($,Z){super($);this.cause=Z}}function c5($){return Buffer.from($.buffer,$.byteOffset,$.byteLength)}var l5=Symbol("subc.socket.writeBorrowed"),d5=Symbol("subc.socket.writeTrackedBorrowed");function H$($,Z,J){let X=$[l5];return X?X.call($,Z,J):$.write(Z,J)}function dZ($,Z,J){let X=$[d5];return X?X.call($,Z,J):$.writeTracked(Z,J)}class F0{sock;chunks=[];buffered=0;waiter=null;closedErr=null;bufferedBytes(){return this.buffered}constructor($){this.sock=$,$.on("data",(J)=>{this.chunks.push(J),this.buffered+=J.length,this.tryServe()});let Z=(J)=>{if(!this.closedErr)this.closedErr=J;this.tryServe()};$.on("error",(J)=>Z(J instanceof Error?J:Error(String(J)))),$.on("end",()=>Z(new y$("subc closed the connection"))),$.on("close",()=>Z(new y$("subc connection closed")))}localPort(){return this.sock.localPort??null}static connect($,Z,J){return new Promise((X,Y)=>{let G=DW.connect({host:$,port:Z});G.setNoDelay(!0);let z=setTimeout(()=>{G.destroy(),Y(new j$(`timed out connecting to ${$}:${Z}`))},Math.max(0,J-Date.now()));G.once("connect",()=>{clearTimeout(z),X(new F0(G))}),G.once("error",(Q)=>{clearTimeout(z),Y(Q)})})}async readFrame($,Z,J){let X=await this.readExact(U1,$),Y=X[4];if(Y!==a6)throw new Q6(`unsupported envelope version ${Y}`,"unsupported_version");let G=await this.readExact(N1-U1,$),z=new Uint8Array(N1);z.set(X),z.set(G,U1);let Q=lZ(z);if(Q.len>mZ)throw new Q6(`frame body ${Q.len} exceeds max ${mZ}`,"frame_body_too_large");J?.();let K=typeof Z==="number"?Z:Date.now()+Z.afterHeaderMs,W=Q.len===0?new Uint8Array(0):await this.readExact(Q.len,K);return{header:Q,body:W}}readExact($,Z){if(this.waiter)return Promise.reject(Error("concurrent readExact is not supported"));if($===0)return Promise.resolve(new Uint8Array(0));return new Promise((J,X)=>{let Y=null;if(Number.isFinite(Z)){let G=Z-Date.now();if(G<=0){X(new j$(`timed out waiting for ${$} bytes`));return}Y=setTimeout(()=>{this.waiter=null,X(new j$(`timed out waiting for ${$} bytes`))},G)}this.waiter={need:$,resolve:J,reject:X,timer:Y},this.tryServe()})}async write($,Z){await this.writeBuffer(Buffer.from($),Z)}writeTracked($,Z){return this.writeTrackedBuffer(Buffer.from($),Z)}async[l5]($,Z){await this.writeBuffer(c5($),Z)}[d5]($,Z){return this.writeTrackedBuffer(c5($),Z)}async writeBuffer($,Z){try{await this.writeTrackedBuffer($,Z).completed}catch(J){if(J instanceof A$||J instanceof $0)throw J.cause??J;throw J}}writeTrackedBuffer($,Z){if(this.closedErr)return{queued:!1,completed:Promise.reject(new A$("subc socket was closed before bytes could be queued",this.closedErr))};let J=!1,X=!1,Y=null,G=new Promise((z,Q)=>{let K=(V)=>{if(X)return;if(X=!0,Y)clearTimeout(Y);V()},W=Z-Date.now();if(W<=0){K(()=>Q(new A$("timed out before bytes could be queued to subc",new j$("timed out writing to subc"))));return}Y=setTimeout(()=>{let V=new j$("timed out writing to subc");K(()=>Q(J?new $0("timed out after bytes were handed to the subc socket",V):new A$("timed out before bytes could be queued to subc",V)))},W);try{this.sock.write($,(V)=>{K(()=>{if(V)Q(new $0("subc socket reported a write error after bytes were handed to the socket",V instanceof Error?V:Error(String(V))));else z()})}),J=!0}catch(V){K(()=>Q(new A$("subc socket write threw before bytes could be queued",V instanceof Error?V:Error(String(V)))))}});return{queued:J,completed:G}}close(){this.sock.destroy()}tryServe(){let $=this.waiter;if(!$)return;if(this.buffered>=$.need){let Z=this.take($.need);if(this.waiter=null,$.timer)clearTimeout($.timer);$.resolve(Z);return}if(this.closedErr){if(this.waiter=null,$.timer)clearTimeout($.timer);$.reject(this.closedErr)}}take($){let Z=Buffer.allocUnsafe($),J=0;while(J<$){let X=this.chunks[0],Y=$-J;if(X.length<=Y)X.copy(Z,J),J+=X.length,this.chunks.shift();else X.copy(Z,J,0,Y),this.chunks[0]=X.subarray(Y),J+=Y}return this.buffered-=$,Z}}var t5=32;var x1=4096,a5="subc-server-v1",n5="subc-client-v1",_W="client";class u6 extends Error{}function sZ($,Z,J,X,Y){let G=OW("sha256",Buffer.from($));return G.update(Buffer.from(Z,"utf8")),G.update(Buffer.from(J)),G.update(Buffer.from(X)),G.update(Buffer.from(Y)),new Uint8Array(G.digest())}function i5($,Z){if($.length!==Z.length)return!1;return IW(Buffer.from($),Buffer.from(Z))}async function s5($,Z,J){let X=Buffer.from(JSON.stringify(Z),"utf8");if(X.length>x1)throw new u6(`auth message too large: ${X.length} > ${x1}`);let Y=new Uint8Array(4);new DataView(Y.buffer).setUint32(0,X.length,!0),await H$($,Y,J),await H$($,X,J)}async function PW($,Z){let J=await $.readExact(4,Z),X=new DataView(J.buffer,J.byteOffset,4).getUint32(0,!0);if(X>x1)throw new u6(`auth message too large: ${X} > ${x1}`);let Y=X===0?new Uint8Array(0):await $.readExact(X,Z);try{return JSON.parse(Buffer.from(Y).toString("utf8"))}catch(G){throw new u6(`auth message JSON decode failed: ${String(G)}`)}}function iZ($,Z){if(!Array.isArray($))throw new u6(`auth field '${Z}' must be a byte array`);for(let J of $)if(typeof J!=="number"||!Number.isInteger(J)||J<0||J>255)throw new u6(`auth field '${Z}' has invalid byte ${String(J)}`);return Uint8Array.from($)}async function n8($,Z,J){let X=new Uint8Array(MW(t5));await s5($,{client_nonce:Array.from(X),role:_W},J);let Y=await PW($,J),G=iZ(Y.server_nonce,"server_nonce"),z=iZ(Y.daemon_id,"daemon_id"),Q=iZ(Y.server_proof,"server_proof"),K=sZ(Z.key,a5,X,G,z);if(!i5(K,Q))throw new u6("server proof mismatch — wrong key or impostor daemon");if(!i5(z,Z.daemonId))throw new u6("daemon id mismatch — connection file points at a different daemon");let W=sZ(Z.key,n5,X,G,z);await s5($,{client_auth:Array.from(W)},J)}import{promises as tZ}from"node:fs";var o5=1,r5=32,e5=16;class C6 extends Error{}function $X($,Z){if(!Array.isArray($))throw new C6(`connection file field '${Z}' must be a JSON array of bytes`);for(let J of $)if(typeof J!=="number"||!Number.isInteger(J)||J<0||J>255)throw new C6(`connection file field '${Z}' has invalid byte ${String(J)}`);return Uint8Array.from($)}function AW($){if($.schema!==o5)throw new C6(`unsupported connection file schema ${$.schema}; expected ${o5}`);if($.endpoints.length===0)throw new C6("connection file must include at least one endpoint");if($.key.length<r5)throw new C6(`connection file key is too short: ${$.key.length} bytes, need at least ${r5}`);if($.daemonId.length!==e5)throw new C6(`connection file daemon_id must be ${e5} bytes, got ${$.daemonId.length}`)}async function wW($){if(process.platform==="win32")return;let J=(await tZ.stat($)).mode&511;if((J&63)!==0)throw new C6(`connection file ${$} has insecure permissions 0o${J.toString(8)}; expected owner-only 0600`)}async function Q8($){await wW($);let Z=await tZ.readFile($,"utf8"),J;try{J=JSON.parse(Z)}catch(Q){throw new C6(`connection file JSON read failed for ${$}: ${String(Q)}`)}let X=J.wire_version;if(X!==void 0&&X!==a6)throw new C6(`connection file wire_version ${String(X)} but this client speaks ${a6}; the client library must be upgraded`);let Y=J.endpoints;if(!Array.isArray(Y))throw new C6("connection file 'endpoints' must be an array");let G=Y.map((Q)=>{let K=Q;if(typeof K.host!=="string"||typeof K.port!=="number")throw new C6("connection file endpoint must be { host: string, port: number }");return{host:K.host,port:K.port}}),z={schema:J.schema,endpoints:G,key:$X(J.key,"key"),daemonId:$X(J.daemon_id,"daemon_id"),pid:J.pid,daemonVer:J.daemon_ver??""};return AW(z),z}var ZX=new WeakMap,aZ=new WeakMap;class nZ extends Error{methodFamily;code="reverse_request_capability_not_declared";constructor($){super(`reverse-request capability ${JSON.stringify($)} was not registered before route.open`);this.methodFamily=$,this.name="ReverseRequestRegistrationError"}}class Z0{handlers=new Map;declaredFamilies=null;onRequest($,Z){if(!RW($))throw TypeError(`reverse-request method family must be a capability identifier, got ${JSON.stringify($)}`);if(typeof Z!=="function")throw TypeError("reverse-request handler must be a function");if(this.declaredFamilies&&!this.declaredFamilies.has($))throw new nZ($);this.handlers.set($,Z)}capabilities(){return[...this.handlers.keys()].sort()}handler($){return this.handlers.get($)}seal(){this.declaredFamilies??=new Set(this.handlers.keys())}}class D1{channel;epoch;constructor($,Z,J,X){if(!Number.isInteger($)||$<=0||$>65535)throw RangeError(`route channel must be an integer in 1..65535, got ${$}`);if(!Number.isInteger(Z)||Z<=0||Z>4294967295)throw RangeError(`route epoch must be an integer in 1..4294967295, got ${Z}`);this.channel=$,this.epoch=Z,X.seal(),ZX.set(this,J),aZ.set(this,X),Object.freeze(this)}onRequest($,Z){aZ.get(this).onRequest($,Z)}static create($,Z,J,X){return new D1($,Z,J,X)}}function O1($,Z,J,X=new Z0){return D1.create($,Z,J,X)}function JX($,Z){return aZ.get($)?.handler(Z)}function RW($){return/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/.test($)}class h$ extends Error{handle;code="stale_route_handle";constructor($){super(`route handle (${$.channel}, ${$.epoch}) is not live on the current connection`);this.handle=$,this.name="StaleRouteHandleError"}}function K8(){return Object.freeze({})}function o8($,Z){return ZX.get($)===Z}function M1($,Z){return $===Z}var XX=TW("subc-client"),FW=1e4,W8=30000,CW=50,SW=2000,YX="request_deadline",oZ="deadline_exceeded_no_drop_observed",kW=30000,vW=30000,GX=new Uint8Array(0),fW="management_surface",A1="SUBC_MODULE_ID",w1="SUBC_LAUNCH_NONCE",R1={baseMs:100,capMs:2000,maxAttempts:6};class S6 extends Error{kind;code;cause;constructor($,Z,J,X){super(Z);this.kind=$,this.code=J,this.cause=X,this.name="SubcCallError"}get detail(){return this.cause instanceof Z6?this.cause.detail:void 0}}class Z6 extends Error{code;detail;constructor($,Z,J){super($);this.code=Z,this.detail=J}}var zX=new WeakMap;function rZ($){if($ instanceof Uint8Array)return $;let Z=$===null?"null":Array.isArray($)?"array":typeof $;throw new Z6(`binary request body must be a Uint8Array; got ${Z}`,"binary_body_required")}class J0{sock;currentConn;opts;nextCorr=1n;pending=new Map;lateResponses=new Map;routes=new Map;liveRoutes=new Map;connectionToken=K8();ingressEpochDropCount=0;closedErr=null;closeStarted=!1;reconnecting=null;generation=1;readerActive=!1;constructor($,Z,J){this.sock=$,this.currentConn=Z,this.opts=J,this.readLoop($,this.generation)}get conn(){return this.currentConn}static async connect($){let Z=gW($),J=await J0.openConnection(Z);return new J0(J.sock,J.conn,Z)}async catalogList($){let Z=this.encode($===void 0?{op:"catalog.list"}:{op:"catalog.list",module_id:$}),J=await this.controlRpc(Z);return this.parseJson(J).modules??[]}async resolveProvider($){let Z=await this.resolveProviders($);if(Z.length===0)throw new Z6(`no catalog claimant for capability ${$}`,"capability_unprovided");if(Z.length>1)throw new Z6(`multiple catalog claimants for capability ${$}: ${Z.join(", ")}`,"capability_ambiguous");return Z[0]}async resolveProviders($){if(!VX($))throw new Z6(`malformed capability identifier ${JSON.stringify($)}`,"invalid_capability_identifier");return(await this.catalogList()).filter((J)=>J.capabilities?.provides.includes($)??!1).map((J)=>J.module_id).sort()}async routeOpen($,Z,J={}){let X=eZ(J),Y=J.reverseRequests??new Z0;Y.seal();let G=Y.capabilities(),z=this.encode({op:"route.open",target:$,identity:Z,...X?{consumer_identity:X}:{},...G.length>0?{consumer_capabilities:G}:{}}),Q=null,K=(V)=>{if(V.header.ty!==i.Response)return!0;let B=this.parseJson(V);if(typeof B.route_channel!=="number"||typeof B.route_epoch!=="number")throw new Z6(`route.open returned no route handle: ${JSON.stringify(B)}`);return Q=this.installRoute(B.route_channel,B.route_epoch,Y),!0},W=(V)=>{if(V.header.ty!==i.Response)return;try{let B=this.parseJson(V);if(typeof B.route_channel!=="number"||typeof B.route_epoch!=="number")return;let q=this.installRoute(B.route_channel,B.route_epoch);this.failHandle(q,new Z6("late route.open was closed","route_closed")),this.liveRoutes.delete(q.channel),this.sendRouteGoodbye(q,!0)}catch{this.closeConnectionAfterCleanupFailure()}};if(await this.controlRpc(z,K,W),!Q)throw new Z6("route.open response was not installed");return Q}async request($,Z,J={}){this.assertLiveHandle($);let X=J.binary??!1,Y=X?rZ(Z):Z instanceof Uint8Array?Z:this.encode(Z),G=J.priority??w6.Interactive,z=J.admissionClass??E6.Normal,Q=await this.send($,Y,G,z,J.timeoutMs,J.onProgress,void 0,void 0,X,J.signal);return this.decodeReply(Q)}async call($,Z,J,X={}){if(X.binary)throw new Z6("call() builds a JSON body and cannot send a binary request; use callBinary(moduleId, body, opts) with a Uint8Array","binary_call_requires_call_binary");let Y=J===void 0?{method:Z}:{method:Z,params:J};return await this.managedCall($,Y,X)}async callBinary($,Z,J={}){let X=rZ(Z);return this.managedCall($,X,{...J,binary:!0})}async managedCall($,Z,J){let X=!1;for(;;){let Y=await this.cachedRouteHandle($,J);try{return await this.managedRequest(Y,Z,J)}catch(G){if(!(G instanceof S6))throw this.terminalCallError("managed call failed",G);let z=T1(G.cause instanceof Z6?zX.get(G.cause)??0:0,G.code);if(z&&!X&&!this.closeStarted){X=!0,this.evictRouteHandle(Y);continue}if(z&&X)this.evictRouteHandle(Y);if(G.code==="route_closed")throw this.evictRouteHandle(Y),G;if(G.kind==="not_sent"){if(!this.closedErr)throw G;try{await this.reconnectAfterDrop(G)}catch(Q){throw this.notSentRecoveryError("managed call was not sent",Q)}continue}if(G.kind==="outcome_unknown"&&G.code!==oZ){if(this.closedErr)this.scheduleReconnectAfterDrop(G)}else if(G.kind==="outcome_unknown"&&G.code===oZ)this.probeLivenessAfterDeadline();throw G}}}subscribe($,Z,J,X={}){this.assertLiveHandle($);let Y=Z instanceof Uint8Array?Z:this.encode(Z),G=X.priority??w6.Interactive,z=X.admissionClass??E6.Normal,Q=this.allocateCorr(),K=I1($,Q),W=null,V=null,B=new Promise((j,x)=>{if(this.closedErr){x(this.closedErr);return}V=j,W={handle:$,resolve:()=>j(),reject:x,onProgress:J,timer:null,subscription:!0},this.pending.set(K,W);let L=b6(i.Request,m6(!1,G,!1,z),$.channel,$.epoch,Q,Y);H$(this.sock,q$(L),Date.now()+W8).catch((U)=>{let M=this.pending.get(K);if(M)this.rejectPending(K,M,U instanceof Error?U:new Z6(String(U)))})}),q=!1;return{unsubscribe:()=>{if(q)return;if(q=!0,W&&V)this.settle(K,W,V);if(this.isLiveHandle($))this.cancel($,Q,G)},closed:B}}attachCancelSignal($,Z,J,X,Y){if(!J)return;let G=()=>{if(!this.pending.has(Z))return;try{this.cancel(J,X,Y)}catch{}};if($.aborted){G();return}$.addEventListener("abort",G,{once:!0});let z=this.pending.get(Z);if(z){let Q=z.onSettle;z.onSettle=()=>{Q?.(),$.removeEventListener("abort",G)}}}cancel($,Z,J=w6.Interactive){this.assertLiveHandle($);let X=b6(i.Cancel,m6(!1,J,!1),$.channel,$.epoch,Z,GX);H$(this.sock,q$(X),Date.now()+W8).catch(()=>{return})}async routePoll($,Z){this.assertLiveHandle($);let J=this.encode({op:"route.poll",route_channel:$.channel,route_epoch:$.epoch,kind:Z}),X=await this.controlRpc(J,(Y)=>{if(Y.header.ty!==i.Response)return!0;let G=this.parseJson(Y);return G.route_channel===$.channel&&G.route_epoch===$.epoch});return this.parseJson(X)}async closeRoute($,Z={}){this.assertLiveHandle($);for(let[J,X]of this.routes)if(X.handle&&M1(X.handle,$))X.closed=!0,X.handle=null,this.routes.delete(J);if(Z.drain)await this.drainUnaryOnHandle($);if(this.failHandle($,new Z6("route closed by closeRoute","route_closed")),this.liveRoutes.get($.channel)===$)this.liveRoutes.delete($.channel);this.sendRouteGoodbye($)}async closeManagedRoute($,Z,J={}){let X=QX($,Z,eZ(J),(J.reverseRequests??new Z0).capabilities()),Y=this.routes.get(X);if(!Y)return;Y.closed=!0,this.routes.delete(X);let G=Y.handle;if(Y.handle=null,G)await this.closeRoute(G,J)}async closeRouteChannel($,Z={}){await this.closeRoute($,Z)}close(){this.closeStarted=!0,this.fail(new Z6("client closed")),this.sock.close()}drainUnaryOnHandle($){let Z=[];for(let J of this.pending.values())if(J.handle===$&&!J.subscription)Z.push(new Promise((X)=>{let Y=J.onSettle;J.onSettle=()=>{Y?.(),X()}}));return Promise.all(Z).then(()=>{return})}sendRouteGoodbye($,Z=!1){if(this.assertLiveConnection($),this.closedErr){if(Z)this.closeConnectionAfterCleanupFailure();return}let J=b6(i.Goodbye,m6(!1,w6.Interactive,!1),$.channel,$.epoch,0n,GX),X=dZ(this.sock,q$(J),Date.now()+W8);if(!X.queued&&Z)this.closeConnectionAfterCleanupFailure();X.completed.catch(()=>{if(Z&&!X.queued)this.closeConnectionAfterCleanupFailure()})}static async openConnection($){let Z=await Q8($.connectionFile),J=Date.now()+($.handshakeTimeoutMs??FW),X=Z.endpoints[0],Y=await F0.connect(X.host,X.port,J);try{await n8(Y,Z,J)}catch(G){throw Y.close(),G}return{sock:Y,conn:Z}}async controlRpc($,Z,J){return this.send(null,$,w6.Interactive,E6.Normal,void 0,void 0,Z,J)}send($,Z,J,X,Y,G,z,Q,K=!1,W){if($)this.assertLiveHandle($);if(this.closedErr)return Promise.reject(this.closedErr);let V;try{V=this.allocateCorr()}catch(x){return Promise.reject(x)}let B=I1($,V),q=$?.channel??0,H=$?.epoch??0,j=b6(i.Request,m6(K,J,!1,X),q,H,V,Z);return new Promise((x,L)=>{let U=Y??W8,M={handle:$,resolve:x,reject:L,onProgress:G,timer:null,acceptFrame:z,onLateResponse:Q};if(M.timer=setTimeout(()=>this.arbitrateTimeout(B,M,q,V,U),U),this.pending.set(B,M),W)this.attachCancelSignal(W,B,$,V,J);H$(this.sock,q$(j),Date.now()+U).catch((A)=>{let _=this.pending.get(B);if(_)this.rejectPending(B,_,A instanceof Error?A:new Z6(String(A)))})})}arbitrateTimeout($,Z,J,X,Y){let G=()=>{if(Z.onLateResponse)this.lateResponses.set($,Z.onLateResponse);this.rejectPending($,Z,new Z6(this.timeoutMessage(J,X,Y),YX))},z=Date.now()+this.opts.timeoutArbitrationGraceMs,Q=()=>{if(this.pending.get($)!==Z)return;if((this.readerActive||this.sock.bufferedBytes()>0)&&Date.now()<z){setImmediate(Q);return}G()};setImmediate(Q)}async managedRequest($,Z,J){let X=J.binary??!1,Y=X?rZ(Z):Z instanceof Uint8Array?Z:this.encode(Z),G=J.priority??w6.Interactive,z=J.admissionClass??E6.Normal;try{let Q=await this.sendManaged($,Y,G,z,J.timeoutMs,J.onProgress,X,J.signal);return this.decodeReply(Q)}catch(Q){if(Q instanceof S6)throw Q;throw this.terminalCallError("managed call failed",Q)}}sendManaged($,Z,J,X,Y,G,z=!1,Q){try{this.assertLiveHandle($)}catch(H){return Promise.reject(this.notSentCallError("request used a stale route handle",H))}if(this.closedErr)return Promise.reject(this.notSentCallError("request was not sent because the subc connection was already closed",this.closedErr));let K;try{K=this.allocateCorr()}catch(H){return Promise.reject(this.notSentCallError("request correlation allocator was exhausted",H))}let W=I1($,K),V=b6(i.Request,m6(z,J,!1,X),$.channel,$.epoch,K,Z),B=!1,q=(H)=>{if(!B)return this.notSentCallError("request bytes were not queued to the subc socket",H);if(H instanceof Z6&&H.code===YX)return new S6("outcome_unknown",`managed call deadline exceeded after request bytes were queued to the local socket; no terminal response was observed; outcome unknown${r8(H)}`,oZ,H);return this.outcomeUnknownCallError("connection dropped before the managed call returned a response",H)};return new Promise((H,j)=>{let x=Y??W8,L={handle:$,resolve:H,reject:j,onProgress:G,timer:null,classifyFailure:q};if(L.timer=setTimeout(()=>this.arbitrateTimeout(W,L,$.channel,K,x),x),this.pending.set(W,L),Q)this.attachCancelSignal(Q,W,$,K,J);let U=dZ(this.sock,q$(V),Date.now()+x);B=U.queued,U.completed.catch((M)=>{let A=this.pending.get(W);if(A)this.rejectPending(W,A,M instanceof Error?M:new Z6(String(M)))})})}async cachedRouteHandle($,Z){let J=Z.identity??this.opts.identity;if(!J)throw new S6("terminal","managed call requires a BindIdentity in SubcClient.connect({ identity }) or call(..., { identity })","missing_identity");let X={kind:Z.targetKind??this.opts.targetKind,module_id:$},Y=eZ(Z),G=Z.reverseRequests??new Z0;G.seal();let z=QX(X,J,Y,G.capabilities()),Q=this.routes.get(z);if(!Q)Q={key:z,moduleId:$,target:X,identity:J,consumerIdentity:Y,reverseRequests:G,handle:null,opening:null},this.routes.set(z,Q);if(Q.handle&&this.isLiveHandle(Q.handle))return Q.handle;if(!Q.opening)Q.opening=this.openCachedRoute(Q).finally(()=>{Q.opening=null});return Q.opening}async openCachedRoute($){let Z=Date.now()+this.opts.routeOpenRetryDeadlineMs,J=this.opts.reconnectBackoff.baseMs,X=0;for(;;){if($.closed)throw this.routeClosedDuringOpen();try{await this.ensureConnectedForManaged()}catch(Y){throw this.notSentRecoveryError("route.open could not run because reconnect failed",Y)}if($.handle&&this.isLiveHandle($.handle))return $.handle;try{let Y=await this.routeOpen($.target,$.identity,{consumerIdentity:$.consumerIdentity??null,reverseRequests:$.reverseRequests});if($.closed)throw this.liveRoutes.delete(Y.channel),this.sendRouteGoodbye(Y),this.routeClosedDuringOpen();return $.handle=Y,Y}catch(Y){if(Y instanceof S6&&Y.code==="route_closed")throw Y;if(!this.closeStarted&&_1(Y)){try{await this.reconnectAfterDrop(Y)}catch(G){throw this.notSentRecoveryError("route.open was not sent and reconnect failed",G)}continue}if(!this.closeStarted&&Y instanceof Z6&&bW(Y.code)){if(X+=1,Date.now()<Z){await this.opts.sleep(J),J=Math.min(J*2,this.opts.reconnectBackoff.capMs);continue}throw this.notSentCallError(`route.open failed for module ${$.moduleId}: ${Y.code} (retry deadline exhausted after ${X} attempts)`,Y)}throw this.terminalCallError(`route.open failed for module ${$.moduleId}`,Y)}}}lastInboundAtMs=0;livenessProbe=null;hasControlPending(){for(let $ of this.pending.values())if($.handle===null)return!0;return!1}probeLivenessAfterDeadline(){if(this.livenessProbe||this.closeStarted||this.closedErr)return;if(this.hasControlPending())return;let $=this.sock,Z=this.generation,J;try{J=this.allocateCorr()}catch{return}let X=Date.now(),Y=b6(i.Ping,m6(!1,w6.Interactive,!1,E6.Normal),0,0,J,new Uint8Array),G=(async()=>{if(await H$($,q$(Y),X+this.opts.livenessProbeWindowMs).catch(()=>{}),await this.opts.sleep(this.opts.livenessProbeWindowMs),this.sock!==$||this.generation!==Z||this.closeStarted)return;if(this.lastInboundAtMs>=X)return;if(this.hasControlPending())return;this.fail(new y$(`liveness probe convicted a half-open socket: no inbound frame for ${this.opts.livenessProbeWindowMs}ms after a channel-0 Ping (deadline-no-drop settles preceded this); closing so the next call reconnects`)),$.close()})().finally(()=>{this.livenessProbe=null});this.livenessProbe=G}async ensureConnectedForManaged(){if(this.closeStarted)throw new Z6("client closed");if(this.reconnecting)await this.reconnecting;if(this.closedErr)await this.reconnectAfterDrop(this.closedErr)}scheduleReconnectAfterDrop($){if(this.closeStarted||this.reconnecting)return;this.reconnectAfterDrop($).catch(()=>{})}reconnectAfterDrop($){if(this.closeStarted)return Promise.reject(new Z6("client closed"));if(this.reconnecting)return this.reconnecting;let Z=this.reconnectWithRetry($).finally(()=>{if(this.reconnecting===Z)this.reconnecting=null});return this.reconnecting=Z,Z}async reconnectWithRetry($){let Z=0,J=this.opts.reconnectBackoff.baseMs;for(;;){if(this.closeStarted)throw new Z6("client closed");Z+=1;try{let X=await J0.openConnection(this.opts);if(this.closeStarted)throw X.sock.close(),new Z6("client closed");this.replaceConnection(X),await this.reopenCachedRoutes();return}catch(X){if(!_1(X)||Z>=this.opts.reconnectBackoff.maxAttempts){if(X instanceof u6&&Z>1)throw new u6(`reconnect gave up after ${Z} attempts: ${X.message} — the connection file and the daemon's key disagree persistently `+"(daemon restarting in a loop, split connection-file paths, or a genuinely foreign daemon on this port); check the daemon, then restart this host app");throw X}await this.opts.sleep(J),J=Math.min(J*2,this.opts.reconnectBackoff.capMs)}}}replaceConnection($){this.fail(new Z6("subc connection replaced")),this.sock.close(),this.sock=$.sock,this.currentConn=$.conn,this.closedErr=null,this.generation+=1,this.connectionToken=K8(),this.liveRoutes.clear(),this.lateResponses.clear(),this.nextCorr=1n,this.readLoop($.sock,this.generation)}async reopenCachedRoutes(){let $=[...this.routes.keys()];for(let Z of $){let J=this.routes.get(Z);if(J)J.handle=null}for(let Z of $){let J=this.routes.get(Z);if(!J||J.closed)continue;try{let X=await this.routeOpen(J.target,J.identity,{consumerIdentity:J.consumerIdentity??null,reverseRequests:J.reverseRequests});if(J.closed){this.liveRoutes.delete(X.channel),this.sendRouteGoodbye(X);continue}J.handle=X}catch(X){if(EW(X)){this.routes.delete(Z);continue}throw X}}}timeoutMessage($,Z,J){let X=this.sock.localPort();return`request on ${X===null?"channel":`local_port=${X} channel`} ${$} corr ${Z} timed out after ${J}ms`}routeClosedDuringOpen(){return new S6("not_sent","route was closed before route.open completed","route_closed")}async readLoop($,Z){try{for(;;){this.readerActive=!1;let J=await $.readFrame(Number.POSITIVE_INFINITY,{afterHeaderMs:vW},()=>{this.readerActive=!0});try{if(this.sock===$&&this.generation===Z)this.dispatch(J)}finally{this.readerActive=!1}}}catch(J){if(this.sock===$&&this.generation===Z)this.fail(J instanceof Error?J:new Z6(String(J)))}}dispatch($){if(this.lastInboundAtMs=Date.now(),$.header.channel===0&&$.header.ty===i.Push){let G=this.opts.onControlPush;if(G){let z=null;try{let Q=this.parseJson($);if(Q&&typeof Q.op==="string")z={op:Q.op,body:Q}}catch{}if(z)try{G(z)}catch{}}return}let Z=null;if($.header.channel!==0){if(Z=this.liveRoutes.get($.header.channel)??null,!Z||Z.epoch!==$.header.epoch){this.ingressEpochDropCount+=1;return}}if($.header.ty===i.Request&&Z){this.dispatchReverseRequest($,Z);return}let J=I1(Z,$.header.corr),X=this.pending.get(J);if(X){if(X.acceptFrame&&!X.acceptFrame($))return;switch($.header.ty){case i.Push:case i.StreamData:try{X.onProgress?.($.body)}catch{}return;case i.Response:case i.StreamEnd:this.settle(J,X,()=>X.resolve($));return;case i.Error:this.settle(J,X,()=>X.reject(this.errorFromFrame($)));return;default:return}}let Y=this.lateResponses.get(J);if(Y&&($.header.ty===i.Response||$.header.ty===i.Error)){this.lateResponses.delete(J),Y($);return}if($.header.ty===i.Goodbye&&Z){if(this.failHandle(Z,new Z6("route closed by subc (GOODBYE)","route_closed")),this.liveRoutes.get(Z.channel)===Z)this.liveRoutes.delete(Z.channel);this.evictRouteHandle(Z);return}if($.header.ty===i.Response||$.header.ty===i.Error||$.header.ty===i.StreamEnd)XX("dropped terminal frame with no waiter: type=%d channel=%d epoch=%d corr=%s port=%s",$.header.ty,$.header.channel,$.header.epoch,$.header.corr,this.sock.localPort()??"?")}settle($,Z,J){if(this.pending.get($)!==Z)return!1;if(this.pending.delete($),Z.timer)clearTimeout(Z.timer);return J(),Z.onSettle?.(),!0}rejectPending($,Z,J){this.settle($,Z,()=>Z.reject(Z.classifyFailure?.(J)??J))}dispatchReverseRequest($,Z){let J=yW($.body),X=J?.split("/",1)[0],Y=X?JX(Z,X):void 0,G=this.sock,z=this.generation;(async()=>{if(!Y||!J){await this.sendReverseError($,Z,"reverse_request_unhandled",X?`no reverse-request handler is registered for ${X}`:"reverse request has no valid method",G,z);return}let K;try{if(K=await Y($.body,{corr:$.header.corr,method:J}),!(K instanceof Uint8Array))throw TypeError("reverse-request handler must return a Uint8Array")}catch(W){await this.sendReverseError($,Z,"reverse_request_unhandled",W instanceof Error?W.message:String(W),G,z);return}await this.sendReverseReply($,Z,i.Response,K,G,z)})().catch((K)=>{if(this.sock===G&&this.generation===z&&!this.closeStarted)XX("failed to answer reverse request: %s",r8(K))})}async sendReverseError($,Z,J,X,Y,G){await this.sendReverseReply($,Z,i.Error,this.encode({code:J,message:X}),Y,G)}async sendReverseReply($,Z,J,X,Y,G){if(this.sock!==Y||this.generation!==G||!this.isLiveHandle(Z)||this.closeStarted||this.closedErr)return;let z=b6(J,m6(!1,w6.Interactive,!1),Z.channel,Z.epoch,$.header.corr,X);await H$(Y,q$(z),Date.now()+W8)}errorFromFrame($){try{let Z=JSON.parse(Buffer.from($.body).toString("utf8")),J=new Z6(Z.message??"subc error",Z.code,Z.detail);return zX.set(J,$.header.flags),J}catch{return new Z6(Buffer.from($.body).toString("utf8")||"subc error")}}evictRouteHandle($){for(let Z of this.routes.values())if(Z.handle&&M1(Z.handle,$))Z.handle=null}failHandle($,Z){for(let[J,X]of this.pending)if(X.handle&&M1(X.handle,$))this.rejectPending(J,X,Z)}fail($){if(!this.closedErr)this.closedErr=$;for(let[Z,J]of this.pending)this.rejectPending(Z,J,$)}notSentCallError($,Z){return new S6("not_sent",`${$}${r8(Z)}`,P1(Z),Z)}outcomeUnknownCallError($,Z){return new S6("outcome_unknown",`${$}${r8(Z)}`,P1(Z),Z)}terminalCallError($,Z){if(Z instanceof S6)return Z;return new S6("terminal",`${$}${r8(Z)}`,P1(Z),Z)}notSentRecoveryError($,Z){if(Z instanceof S6)return Z;if(_1(Z))return this.notSentCallError($,Z);return this.terminalCallError($,Z)}get droppedIngressFrames(){return this.ingressEpochDropCount}installRoute($,Z,J=new Z0){let X=O1($,Z,this.connectionToken,J);return this.liveRoutes.set($,X),X}isLiveHandle($){return o8($,this.connectionToken)&&this.liveRoutes.get($.channel)===$}assertLiveConnection($){if(!o8($,this.connectionToken))throw new h$($)}assertLiveHandle($){if(!this.isLiveHandle($))throw new h$($)}allocateCorr(){let $=0xffffffffffffffffn;if(this.nextCorr>$){let J=new Z6("channel-0 correlation id allocator exhausted","corr_exhausted");throw this.fail(J),this.sock.close(),this.scheduleReconnectAfterDrop(J),J}let Z=this.nextCorr;return this.nextCorr+=1n,Z}closeConnectionAfterCleanupFailure(){let $=new Z6("late route cleanup could not be queued","late_route_cleanup_failed");this.fail($),this.sock.close(),this.scheduleReconnectAfterDrop($)}encode($){return Buffer.from(JSON.stringify($),"utf8")}decodeReply($){return cZ($.header.flags)?$.body:this.parseJson($)}parseJson($){let Z=$.body;return JSON.parse(Buffer.from(Z.buffer,Z.byteOffset,Z.byteLength).toString("utf8"))}}function _1($){if($ instanceof y$||$ instanceof j$)return!0;if($ instanceof A$||$ instanceof $0)return!0;if($ instanceof S6)return $.kind==="not_sent"||$.kind==="outcome_unknown";if($ instanceof u6)return!0;if($ instanceof Z6||$ instanceof C6)return!1;let Z=P1($);return Z==="ECONNREFUSED"||Z==="ECONNRESET"||Z==="EPIPE"||Z==="ETIMEDOUT"||Z==="ENOENT"}function EW($){return $ instanceof Z6&&typeof $.code==="string"}function bW($){if($==="capability_forbidden")return!1;return $==="module_reloading"||$==="module_warming"||$==="target_unavailable"||$==="module_timeout"}var KX="unknown_channel",WX="stale_route_epoch";function T1($,Z){return Z===KX||Z===WX}function gW($){return{connectionFile:$.connectionFile,handshakeTimeoutMs:$.handshakeTimeoutMs,identity:$.identity,targetKind:$.targetKind??fW,reconnectBackoff:$.reconnectBackoff??R1,sleep:$.sleep??((Z)=>new Promise((J)=>setTimeout(J,Z))),routeOpenRetryDeadlineMs:$.routeOpenRetryDeadlineMs??kW,timeoutArbitrationGraceMs:$.timeoutArbitrationGraceMs??CW,livenessProbeWindowMs:$.livenessProbeWindowMs??SW,onControlPush:$.onControlPush}}function VX($){if(/\s/u.test($))return!1;let Z=$.indexOf("/v");if(Z<=0||$.indexOf("/v",Z+1)!==-1)return!1;let J=$.slice(0,Z),X=$.slice(Z+2);if(new TextEncoder().encode(J).byteLength>64||X.length===0)return!1;if(!/^[a-z][a-z0-9-]*[a-z0-9]$/u.test(J)&&!/^[a-z]$/u.test(J))return!1;if(J.includes("--"))return!1;if(!/^\d+$/u.test(X)||X.length>1&&X.startsWith("0"))return!1;let Y=Number(X);return Number.isSafeInteger(Y)&&Y>=1&&Y<=4294967295}function QX($,Z,J,X){let Y=J?`${J.module_id}\x00${J.launch_nonce}`:"",G=[...X].sort().join("\x00");return`${$.kind}\x00${$.module_id}\x00${Z.project_root}\x00${Z.harness}\x00${Z.session}\x00${Y}\x00${G}`}function eZ($={}){if($.consumerIdentity!==void 0)return $.consumerIdentity??void 0;let Z=process.env[A1],J=process.env[w1];if(!Z||!J)return;return{module_id:Z,launch_nonce:J}}function P1($){if(typeof $==="object"&&$!==null&&"code"in $){let Z=$.code;if(typeof Z==="string")return Z}return}function r8($){if($===void 0)return"";return`: ${$ instanceof Error?$.message:String($)}`}function I1($,Z){return $?`${$.channel}:${$.epoch}:${Z}`:`0:0:${Z}`}function yW($){try{let Z=JSON.parse(Buffer.from($).toString("utf8"));return typeof Z.method==="string"&&Z.method.length>0?Z.method:void 0}catch{return}}import{Buffer as G2}from"node:buffer";var hW=1e4,mW=30000,qX=30000,uW=250,$2=64,X2="health.check",jX=1n,pW=/^[0-9a-f]{32}$/;function Y2($){let Z=$.machine_id;return typeof Z==="string"&&pW.test(Z)?Z:void 0}class C1{available;waiters=[];constructor($){if(!Number.isInteger($)||$<=0)throw new V6("provider handler capacity must be a positive integer","invalid_handler_capacity");this.available=$}async acquire(){if(this.available>0)return this.available-=1,this.releaseOnce();return await new Promise(($)=>{this.waiters.push($)}),this.releaseOnce()}releaseOnce(){let $=!1;return()=>{if($)return;$=!0;let Z=this.waiters.shift();if(Z)Z();else this.available+=1}}}class V6 extends Error{code;kind;detail;constructor($,Z,J="terminal",X){super($);this.code=Z,this.kind=J,this.detail=X}}class e8{sock;currentConn;opts;closed;resolveClosed=()=>{return};closeStarted=!1;closedErr=null;inflight=new Map;pending=new Map;liveRoutes=new Map;connectionToken=K8();nextCorr=1n;ingressEpochDropCount=0;requestGate=new C1($2);reconnecting=null;generation=1;connectionEpoch=1;stateQueue=[];drainingStateQueue=!1;restoredDebounceToken=0;storage;machineId;constructor($,Z,J,X){this.sock=$,this.currentConn=Z,this.opts=J,this.storage=X.storage,this.machineId=Y2(X),this.closed=new Promise((Y)=>{this.resolveClosed=Y}),this.readLoop($,this.generation),this.enqueueConnectionState({state:"connected",epoch:this.connectionEpoch})}get droppedIngressFrames(){return this.ingressEpochDropCount}get conn(){return this.currentConn}currentEpoch(){return this.connectionEpoch}async request($,Z,J={}){this.assertLiveHandle($);let X=this.allocateCorr(),Y=F1($,X),G=J.timeoutMs??qX,z=b6(i.Request,m6(!1,J.priority??w6.Interactive,!1,J.admissionClass??E6.Normal),$.channel,$.epoch,X,Z);return await new Promise((Q,K)=>{let W=setTimeout(()=>{if(this.pending.delete(Y))K(new V6("reverse request timed out","request_timeout"))},G);this.pending.set(Y,{resolve:(V)=>Q(V.body),reject:K,timer:W}),this.sendOn(this.sock,this.generation,z).catch((V)=>{let B=this.pending.get(Y);if(!B)return;this.pending.delete(Y),clearTimeout(B.timer),K(V instanceof Error?V:new V6(String(V)))})})}async push($,Z,J={}){this.assertLiveHandle($),await this.sendOn(this.sock,this.generation,b6(i.Push,m6(!1,J.priority??w6.Interactive,!1,J.admissionClass??E6.Normal),$.channel,$.epoch,0n,Z))}cancel($,Z){this.assertLiveHandle($),this.sendOn(this.sock,this.generation,b6(i.Cancel,w$(),$.channel,$.epoch,Z,new Uint8Array(0))).catch(()=>{return})}closeRoute($){this.assertLiveHandle($),this.liveRoutes.delete($.channel),this.abortHandle($),this.sendOn(this.sock,this.generation,b6(i.Goodbye,w$(),$.channel,$.epoch,0n,new Uint8Array(0))).catch(()=>{return})}static async connect($){if($.manifest.protocol_ver!==a6)throw new V6(`manifest protocol_ver ${$.manifest.protocol_ver} does not match client protocol ${a6}`,"invalid_manifest");let Z=lW($),J=await e8.openConnection(Z);return new e8(J.sock,J.conn,Z,J.ack)}async close(){if(!this.closeStarted){this.closeStarted=!0,this.cancelRestoredDebounce();let $=this.sock;try{await J2($,b6(i.Goodbye,w$(),0,0,0n,new Uint8Array(0)))}catch{}finally{$.close(),this.finishClosed()}}await this.closed}static async openConnection($,Z){let J=await Q8($.connectionFile),X=Date.now()+($.handshakeTimeoutMs??hW),Y=J.endpoints[0],G=await F0.connect(Y.host,Y.port,X);try{Z?.(G),await n8(G,J,X),await J2(G,iW($));let z=await nW(G,X);return{sock:G,conn:J,ack:z}}catch(z){throw G.close(),z}}async readLoop($,Z){try{for(;;){let J=await $.readFrame(Number.POSITIVE_INFINITY,{afterHeaderMs:mW});if(!await this.dispatch(J,$,Z)){if(this.sock===$&&this.generation===Z)this.closeStarted=!0;break}}}catch(J){if(this.sock===$&&this.generation===Z&&!this.closeStarted){this.handleUnexpectedDrop($,Z,J instanceof Error?J:new V6(String(J)));return}}finally{if(this.sock===$&&this.generation===Z){if($.close(),this.closeStarted)this.finishClosed()}}}async dispatch($,Z,J){let X=null;if($.header.channel!==0){if(X=this.liveRoutes.get($.header.channel)??null,!X||X.epoch!==$.header.epoch)return this.ingressEpochDropCount+=1,!0}if(X){let Y=F1(X,$.header.corr),G=this.pending.get(Y);if(G){if($.header.ty===i.Push||$.header.ty===i.StreamData)return!0;if($.header.ty===i.Response||$.header.ty===i.StreamEnd)return this.pending.delete(Y),clearTimeout(G.timer),G.resolve($),!0;if($.header.ty===i.Error)return this.pending.delete(Y),clearTimeout(G.timer),G.reject(cW($)),!0}}switch($.header.ty){case i.Ping:if($.header.channel===0)await this.sendOn(Z,J,P$($.header.ver,i.Pong,$.header.flags,0,0,$.header.corr,new Uint8Array(0)));return!0;case i.Goodbye:if(!X)return!1;return this.liveRoutes.delete(X.channel),this.abortHandle(X),await this.reportRouteGone(X),!0;case i.Cancel:if(X)this.inflight.get(F1(X,$.header.corr))?.abort();return!0;case i.Request:if($.header.channel===0)await this.handleControlRequest($,Z,J);else if(X)this.handleDataRequest($,X,Z,J).catch((Y)=>{if(!this.closeStarted&&this.sock===Z&&this.generation===J)console.warn("SubcProvider handler failed after its request was dispatched",Y)});return!0;default:return!0}}async reportRouteBound($){if(!this.opts.onBound)return;try{await this.opts.onBound($)}catch(Z){console.warn("SubcProvider bound callback failed",Z)}}async reportRouteGone($){if(!this.opts.onRouteGone)return;try{await this.opts.onRouteGone($)}catch(Z){console.warn("SubcProvider route-gone callback failed",Z)}}abortHandle($){let Z=`${$.channel}:${$.epoch}:`;for(let[J,X]of this.inflight)if(J.startsWith(Z))X.abort();for(let[J,X]of this.pending){if(!J.startsWith(Z))continue;this.pending.delete(J),clearTimeout(X.timer),X.reject(new h$($))}}abortGeneration($){this.abortAllInflight();for(let[Z,J]of this.pending)this.pending.delete(Z),clearTimeout(J.timer),J.reject(new V6("provider connection dropped","connection_dropped"));this.liveRoutes.clear()}abortAllInflight(){for(let $ of this.inflight.values())$.abort()}async handleControlRequest($,Z,J){let X=k1($.body);if(X.op===X2){this.handleHealthRequest($,Z,J).catch((B)=>{if(!this.closeStarted&&this.sock===Z&&this.generation===J)console.warn("SubcProvider health handler failed after its request was dispatched",B)});return}if(X.op!=="route.bind")throw new V6(`unsupported module control request ${X.op??"<missing op>"}`);let Y=BX(X.route_channel,"route_channel"),G=BX(X.epoch,"epoch"),z=this.liveRoutes.get(Y);if(z){if(G<=z.epoch){await this.sendError($,"route_rejected",`route.bind epoch ${G} does not supersede installed epoch ${z.epoch} on channel ${Y}`,w$(),Z,J);return}this.liveRoutes.delete(z.channel),this.abortHandle(z),await this.reportRouteGone(z)}let Q=O1(Y,G,this.connectionToken),K={handle:Q,target:X.target,identity:X.identity,principal:X.principal,consumer_capabilities:X.consumer_capabilities},W;try{W=await this.opts.onBind?.(K)}catch(B){try{await this.sendError($,"route_rejected",B instanceof Error?B.message:String(B),w$(),Z,J)}finally{await this.reportRouteGone(Q)}return}let V=oW(W);if(V){try{await this.sendError($,V.code,V.message,w$(),Z,J)}finally{await this.reportRouteGone(Q)}return}try{await this.sendOn(Z,J,P$($.header.ver,i.Response,w$(),0,0,$.header.corr,S1({op:"route.bind"})))}catch(B){throw await this.reportRouteGone(Q),B}if(this.sock!==Z||this.generation!==J||this.closeStarted||this.closedErr){await this.reportRouteGone(Q);return}this.liveRoutes.set(Q.channel,Q),await this.reportRouteBound(Q)}async handleDataRequest($,Z,J,X){let{corr:Y,ver:G}=$.header,z=F1(Z,Y),Q=new AbortController;this.inflight.set(z,Q);let K={handle:Z,signal:Q.signal,currentEpoch:()=>this.connectionEpoch,emit:async(B,q={})=>{if(this.assertLiveHandle(Z),Q.signal.aborted)return;await this.sendOn(J,X,P$(G,i.StreamData,m6(!1,q.priority??w6.Interactive,!1,q.admissionClass??E6.Normal),Z.channel,Z.epoch,Y,B))}},W=await(this.requestGate??new C1($2)).acquire(),V=m6(!1,w6.Interactive,!1);try{if(Q.signal.aborted){await this.sendError($,"cancelled","request cancelled",V,J,X);return}let B=await this.opts.handler(Z,$.body,K);if(Q.signal.aborted){await this.sendError($,"cancelled","request cancelled",V,J,X);return}if(this.assertLiveHandle(Z),B===void 0)await this.sendOn(J,X,P$(G,i.StreamEnd,V,Z.channel,Z.epoch,Y,new Uint8Array(0)));else if(B instanceof Uint8Array)await this.sendOn(J,X,P$(G,i.Response,V,Z.channel,Z.epoch,Y,B));else throw new V6("provider handler must return a Uint8Array or void","invalid_handler_response")}catch(B){if(B instanceof h$)return;if(Q.signal.aborted){await this.sendError($,"cancelled","request cancelled",V,J,X);return}await this.sendError($,B instanceof V6&&B.code?B.code:"handler_error",B instanceof Error?B.message:String(B),V,J,X)}finally{if(W(),this.inflight.get(z)===Q)this.inflight.delete(z)}}async handleHealthRequest($,Z,J){let{corr:X,ver:Y}=$.header,G=`control:${J}:${X}`,z=new AbortController;this.inflight.set(G,z);let Q=await(this.requestGate??new C1($2)).acquire();try{if(z.signal.aborted)return;let K=await this.opts.health();await this.sendOn(Z,J,P$(Y,i.Response,w$(),0,0,X,S1({op:X2,status:K.status,...K.detail===void 0?{}:{detail:K.detail},...K.metrics===void 0?{}:{metrics:K.metrics}})))}catch(K){await this.sendError($,K instanceof V6&&K.code?K.code:"health_error",K instanceof Error?K.message:String(K),w$(),Z,J)}finally{if(Q(),this.inflight.get(G)===z)this.inflight.delete(G)}}async sendError($,Z,J,X,Y,G){if($.header.channel!==0){let z=this.liveRoutes.get($.header.channel);if(!z||z.epoch!==$.header.epoch||!this.isLiveHandle(z))return}await this.sendOn(Y,G,P$($.header.ver,i.Error,X,$.header.channel,$.header.epoch,$.header.corr,S1({code:Z,message:J})))}async sendOn($,Z,J){if(this.sock!==$||this.generation!==Z||this.closeStarted||this.closedErr)return;await J2($,J)}handleUnexpectedDrop($,Z,J){if(this.closeStarted||this.sock!==$||this.generation!==Z)return;if(!this.opts.reconnectOnDrop){this.failFatal(J);return}this.cancelRestoredDebounce(),this.abortGeneration(Z),this.generation+=1,$.close(),this.scheduleReconnectAfterDrop(J,this.generation,$)}scheduleReconnectAfterDrop($,Z,J){if(this.closeStarted)return;let X=this.reconnecting;if(X){if(!this.shouldSupersedeReconnect(X,Z,J))return;X.superseded=!0,X.socket?.close()}let Y={generation:Z,socket:null,socketDied:!1,superseded:!1};this.reconnecting=Y,this.enqueueConnectionState({state:"down",cause:$}),this.reconnectWithRetry(Y).catch((G)=>{if(this.isCurrentReconnect(Y)&&!this.closeStarted)this.failFatal(G instanceof Error?G:new V6(String(G)))}).finally(()=>{if(this.isCurrentReconnect(Y))this.reconnecting=null})}async reconnectWithRetry($){let Z=0,J=this.opts.reconnectBackoff.baseMs;for(;;){if(!this.isCurrentReconnect($))return;if(this.closeStarted)throw new V6("provider closed");$.socket=null,$.socketDied=!1,Z+=1,this.enqueueReconnectState($,Z);try{let X=await e8.openConnection(this.opts,(G)=>{if(!this.isCurrentReconnect($)){G.close();return}$.socket=G});if(!this.isCurrentReconnect($)||this.closeStarted){if(X.sock.close(),this.closeStarted)throw new V6("provider closed");return}let Y=this.replaceConnection(X,$.generation);if(this.reconnecting=null,this.reconnecting!==null)throw new V6("reconnect state must clear before restored","reconnect_state");this.scheduleRestored($.generation,Y);return}catch(X){if(!this.isCurrentReconnect($))return;if($.socket)$.socketDied=!0;if(this.closeStarted)throw X;if(!sW(X))throw X;await this.opts.sleep(J),J=Math.min(J*2,this.opts.reconnectBackoff.capMs)}}}isCurrentReconnect($){return!$.superseded&&this.reconnecting===$&&this.generation===$.generation}shouldSupersedeReconnect($,Z,J){return $.generation<Z||$.socketDied||$.socket===J}enqueueReconnectState($,Z){if(!this.isCurrentReconnect($))return;this.enqueueConnectionState({state:"reconnecting",attempt:Z},$.generation,$)}replaceConnection($,Z){return this.sock.close(),this.sock=$.sock,this.currentConn=$.conn,this.storage=$.ack.storage,this.machineId=Y2($.ack),this.closedErr=null,this.connectionEpoch+=1,this.connectionToken=K8(),this.liveRoutes.clear(),this.nextCorr=1n,this.readLoop($.sock,Z),this.connectionEpoch}scheduleRestored($,Z){if(!this.opts.onConnectionState)return;let J=++this.restoredDebounceToken;this.opts.sleep(this.opts.restoredDebounceMs).then(()=>{if(J===this.restoredDebounceToken&&!this.closeStarted&&this.sock&&this.generation===$&&this.connectionEpoch===Z)this.enqueueConnectionState({state:"restored",epoch:Z},$)}).catch((X)=>{if(J===this.restoredDebounceToken&&!this.closeStarted)console.warn("SubcProvider restored debounce timer failed",X)})}cancelRestoredDebounce(){this.restoredDebounceToken+=1}enqueueConnectionState($,Z,J){if(!this.opts.onConnectionState)return;if(this.stateQueue.push({event:$,generation:Z,reconnect:J}),!this.drainingStateQueue)this.drainConnectionStateQueue()}async drainConnectionStateQueue(){if(this.drainingStateQueue)return;this.drainingStateQueue=!0;try{while(this.stateQueue.length>0){let $=this.stateQueue[0];if(this.closeStarted||$.generation!==void 0&&$.generation!==this.generation||$.reconnect?.superseded){this.stateQueue.shift();continue}let{event:Z}=$;try{await this.opts.onConnectionState?.(Z),this.stateQueue.shift()}catch(J){if(Z.state==="restored"){console.warn("SubcProvider restored callback failed; retrying delivery",J),await aW();continue}console.warn("SubcProvider connection-state callback failed",J),this.stateQueue.shift()}}}finally{if(this.drainingStateQueue=!1,this.stateQueue.length>0)this.drainConnectionStateQueue()}}isLiveHandle($){return o8($,this.connectionToken)&&this.liveRoutes.get($.channel)===$}assertLiveHandle($){if(!this.isLiveHandle($))throw new h$($)}allocateCorr(){let $=0xffffffffffffffffn;if(this.nextCorr>$){let J=new V6("channel-0 correlation id allocator exhausted","corr_exhausted");throw this.handleUnexpectedDrop(this.sock,this.generation,J),J}let Z=this.nextCorr;return this.nextCorr+=1n,Z}failFatal($){if(!this.closedErr)this.closedErr=$;this.closeStarted=!0,this.cancelRestoredDebounce(),this.abortAllInflight(),this.sock.close(),this.finishClosed()}finishClosed(){this.resolveClosed()}}function F1($,Z){return`${$.channel}:${$.epoch}:${Z}`}function cW($){try{let Z=k1($.body);return new V6(Z.message??"subc error",Z.code,T1($.header.flags,Z.code)?"not_sent":"terminal",Z.detail)}catch{return new V6(G2.from($.body).toString("utf8")||"subc error")}}function Z2($){return $&&$.length>0?$:void 0}function lW($){let Z=Z2(process.env[A1]),J=Z2(process.env[w1]),X=Z!==void 0&&J!==void 0;return{connectionFile:$.connectionFile,manifest:$.manifest,handler:$.handler,health:$.health??(()=>({status:"ok"})),handshakeTimeoutMs:$.handshakeTimeoutMs,controlOps:$.controlOps,onBind:$.onBind,onBound:$.onBound,onRouteGone:$.onRouteGone,reconnectBackoff:$.reconnectBackoff??R1,sleep:$.sleep??((Y)=>new Promise((G)=>setTimeout(G,Y))),restoredDebounceMs:$.restoredDebounceMs??uW,onConnectionState:$.onConnectionState,launchNonce:Z2($.launchNonce??J),reconnectOnDrop:$.reconnectOnDrop??!X}}function dW($){if($===null)return null;let Z=new Set($??[]);return Z.add(X2),[...Z]}function iW($){let Z=$.launchNonce;return b6(i.Hello,w$(),0,0,jX,S1({manifest:rW($.manifest),protocol_ver:a6,control_ops:dW($.controlOps),...Z?{launch_nonce:Z}:{}}))}function sW($){if($ instanceof V6)return $.code==="duplicate_module_id";if($ instanceof y$||$ instanceof j$)return!0;if($ instanceof A$||$ instanceof $0)return!0;if($ instanceof u6)return!0;if($ instanceof C6)return!1;let Z=tW($);return Z==="ECONNREFUSED"||Z==="ECONNRESET"||Z==="EPIPE"||Z==="ETIMEDOUT"||Z==="ENOENT"}function tW($){if(typeof $==="object"&&$!==null&&"code"in $){let Z=$.code;if(typeof Z==="string")return Z}return}async function aW(){await new Promise(($)=>setTimeout($,0))}function w$(){return m6(!1,w6.Passive,!1)}async function J2($,Z){await H$($,q$(Z),Date.now()+qX)}async function nW($,Z){let J=await $.readFrame(Z,Z);switch(J.header.ty){case i.HelloAck:{let X=k1(J.body);if(X.negotiated_ver!==a6)throw new V6(`subc negotiated protocol ${X.negotiated_ver}; expected exactly ${a6}`,"unsupported_version");return X}case i.Error:{let X=k1(J.body);throw new V6(`subc rejected HELLO: ${X.code??"unknown"} — ${X.message??"subc error"}`,X.code)}default:throw new V6(`unexpected frame ${i[J.header.ty]} awaiting HELLO_ACK`)}}function S1($){return new Uint8Array(G2.from(JSON.stringify($),"utf8"))}function k1($){return JSON.parse(G2.from($).toString("utf8"))}function BX($,Z){if(typeof $!=="number"||!Number.isInteger($))throw new V6(`route.bind ${Z} must be an integer`);return $}function oW($){if($===void 0||$===!0)return null;if($===!1)return{code:"route_rejected",message:"route.bind rejected by provider"};if($.accept)return null;return{code:$.code??"route_rejected",message:$.message??"route.bind rejected by provider"}}function rW($){return{module_id:$.module_id,module_version:$.module_version,protocol_ver:$.protocol_ver,trust_tier:$.trust_tier,provides:$.provides.map(eW),consumes:$.consumes.map($V),bindings:{storage:{kind:$.bindings.storage.kind,scope:$.bindings.storage.scope,owns_schema:$.bindings.storage.owns_schema},vault_grants:$.bindings.vault_grants.map((Z)=>({secret:Z.secret,reason:Z.reason})),identity:{requires:[...$.bindings.identity.requires],optional:[...$.bindings.identity.optional]}}}}function eW($){switch($.role){case"tool_provider":return{role:"tool_provider",tools:$.tools.map((Z)=>({name:Z.name,...Z.description===void 0?{}:{description:Z.description},execution_mode:Z.execution_mode,schema:Z.schema})),identity_scope:[...$.identity_scope],concurrency:$.concurrency,emits_push:$.emits_push,sub_supervises:$.sub_supervises};case"pipeline_stage":return{role:"pipeline_stage",stage:$.stage,applies_to:{provider:$.applies_to.provider,model:$.applies_to.model},interface:$.interface,declares_frozen_floor:$.declares_frozen_floor,needs_signals:[...$.needs_signals],conformance_class:$.conformance_class};case"management_surface":return{role:"management_surface",operations:$.operations.map((Z)=>({name:Z.name,kind:Z.kind})),config_schema:$.config_schema,observability:$.observability.map((Z)=>({name:Z.name,kind:Z.kind})),identity_scope:[...$.identity_scope],concurrency:$.concurrency};case"internal_service":return{role:"internal_service",service_id:$.service_id,transport:$.transport,agent_facing:$.agent_facing,operations:[...$.operations]}}}function $V($){switch($.role){case"tool_client":return{role:"tool_client",of:[...$.of]};case"llm_client":return{role:"llm_client",via:$.via,auth:$.auth};case"service_client":return{role:"service_client",of:[...$.of]}}}var f1="subc-connection.json",LX="subc-",NX=".connection.json";function UX(){let $=process.env.HOME;return $?V8($,".local","share","cortexkit","run",f1):void 0}function YV(){let $=process.env.XDG_RUNTIME_DIR;if($)return V8($,f1);let Z=UX();if(Z)return Z;return V8(XV().homedir,".local","share","cortexkit","run",f1)}function GV(){if(process.env.SUBC_CONNECTION_FILE)return process.env.SUBC_CONNECTION_FILE;let $=process.env.XDG_RUNTIME_DIR;if($){let Y=V8($,f1);if(v1(Y))return Y}let Z=UX();if(Z&&v1(Z))return Z;let J=V8(HX(),`${LX}${zV()}${NX}`);if(v1(J))return J;let X=QV(HX());return X.length===1?X[0]:void 0}function zV($=process.getuid??null,Z=process.env){if($)return String($());for(let J of["USER","USERNAME","HOME","USERPROFILE"]){let X=Z[J];if(X)return Array.from(X,(Y)=>/^[a-zA-Z0-9_-]$/.test(Y)?Y:"_").join("")}return"unknown"}function xX(){return GV()??YV()}function z2($){return $?.trim()||process.env.SUBC_CONNECTION_FILE||process.env.CLAUSTRUM_SUBC_CONNECTION?.trim()||xX()}function v1($){try{return JV($).isFile()}catch{return!1}}function QV($){let Z;try{Z=ZV($)}catch{return[]}let J=[];for(let X of Z){if(typeof X!=="string")continue;if(!X.startsWith(LX)||!X.endsWith(NX))continue;let Y=V8($,X);if(v1(Y))J.push(Y)}return J.sort(),J}import{createHash as KV}from"node:crypto";import{existsSync as WV,realpathSync as DX}from"node:fs";import{dirname as VV,relative as BV,resolve as qV}from"node:path";function OX($){let Z=$,J;try{J=DX(Z)}catch(X){if(X.code!=="ENOENT")throw X;let Y=Z;while(!WV(Y)){let G=VV(Y);if(G===Y)break;Y=G}J=qV(DX(Y),BV(Y,Z))}return KV("sha256").update(J).digest("hex")}function E1($,Z){return{project_root:$,harness:"opencode",session:`store-${OX(Z)}`}}import*as X0 from"node:fs/promises";import{win32 as IX}from"node:path";async function $9($){let Z;try{Z=await import("./index-74r84r5f.js")}catch(J){throw Error("@cortexkit/private-files is unavailable; refusing the Windows private operation",{cause:J})}try{return await $(Z)}catch(J){if(J instanceof Z.PrivateFilesUnavailableError)throw Error(`@cortexkit/private-files native addon is unavailable; refusing the Windows private operation: ${J.message}`,{cause:J});throw J}}function jV($,Z){return{ok:!1,reason:Z,path:$}}function HV($){return $?.code==="ENOENT"}async function LV($,Z){let J=$,X=!1;try{if(!$||$.includes("\x00")||!IX.isAbsolute($))throw Error("expected an absolute Windows path");for(;;){let Y;try{Y=await Z.lstat(J)}catch(G){if(!HV(G))throw G;let z=IX.dirname(J);if(z===J)throw G;J=z,X=!0;continue}if(X&&!Y.isDirectory())throw Error("nearest existing ancestor is not a directory");return await $9((G)=>G.verifyPrivatePath(J,Y.isDirectory()?"directory":"file")),{ok:!0}}}catch(Y){return jV(J,`Windows private-path verification refused: ${Y instanceof Error?Y.message:String(Y)}`)}}async function C0($,Z={}){let J={realpath:X0.realpath,lstat:X0.lstat,stat:X0.stat,readFile:X0.readFile,...Z.fs};if((Z.platform??process.platform)==="win32")return LV($,J);return _X($,Z)}import{mkdir as NV,open as UV,realpath as xV,rmdir as DV}from"node:fs/promises";import{dirname as Q2}from"node:path";var OV="sticky ancestor without an owner-only child";function K2($){return Error(`Private creation refused: ${$.reason}: ${$.path}`)}async function MV($){let Z=await C0(Q2($));if(!Z.ok)throw K2(Z)}async function b1($,Z=""){if(process.platform==="win32")return $9((X)=>X.createPrivateFile($,Z));await MV($);let J=await UV($,"wx",384);try{await J.writeFile(Z)}finally{await J.close()}}async function g1($){if(process.platform==="win32")return $9((Y)=>Y.createPrivateDirectory($));let Z=await C0(Q2($)),J=!1;if(!Z.ok){if(J=Z.reason===OV&&Z.path===await xV(Q2($)).catch(()=>{return}),!J)throw K2(Z)}if(await NV($,{mode:448}),!J)return;let X=await C0($);if(!X.ok)throw await DV($).catch(()=>{return}),K2(X)}import{AsyncLocalStorage as IV}from"node:async_hooks";import{stat as PX}from"node:fs/promises";import{dirname as _V,resolve as PV}from"node:path";var AV=new IV,y1=($,Z)=>C0(PV($),AV.getStore()??Z);function h1($,Z){return`${$} ${Z.path} is not private: ${Z.reason}`}function m1($){let Z=$;if(Z?.code==="ERR_PRIVATE_FILES_SECURITY"&&Z.reason==="io-error"){if(Z.win32Code===80||Z.win32Code===183)return"EEXIST";if(Z.win32Code===2||Z.win32Code===3)return"ENOENT"}return Z?.code}async function u1($){try{await PX($);return}catch(J){if(J.code!=="ENOENT")throw J}let Z=_V($);if(Z!==$)await u1(Z);try{await g1($)}catch(J){if(m1(J)!=="EEXIST")throw J;if(!(await PX($)).isDirectory())throw J}}import{randomBytes as wV}from"node:crypto";import{open as RV,rename as TV,unlink as FV}from"node:fs/promises";import{basename as CV,dirname as SV,join as kV,resolve as vV}from"node:path";var fV=/^[0-9a-f]{64}$/;function EV($){if(!fV.test($.token))throw Error("enrollment token must be exactly 64 lowercase hex characters");if(!Number.isSafeInteger($.token_generation)||$.token_generation<1)throw Error("enrollment token generation must be a positive safe integer")}async function AX($){let Z=await y1($);if(!Z.ok)throw Error(h1("enrollment token folder",Z))}async function Z9($,Z){EV(Z),$=vV($);let J=SV($);if(process.platform!=="win32")await AX(J);await u1(J),await AX(J);let X=kV(J,`.${CV($)}.${process.pid}.${wV(12).toString("hex")}.tmp`),Y=!1;try{Y=!0;try{await b1(X,`${JSON.stringify(Z)}
-`)}catch(z){if(m1(z)==="EEXIST")Y=!1;throw z}let G=await RV(X,"r+");try{await G.sync()}finally{await G.close()}await TV(X,$),Y=!1}finally{if(Y)await FV(X).catch(()=>{return})}}var wX=["transient","permanent","auth_required","context_overflow"];class s6 extends Error{code;action;["class"];constructor($,Z,J){super(`Claustrum credential request failed: ${$}`);this.code=$,this.action=J,this.name="ClaustrumCredentialError",this.class=Z}}function B8($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function RX($){switch($){case"permanent":return"gone";case"auth_required":return"reauth";case"context_overflow":return"reduce_and_retry";case"transient":return"retry"}}function J6($,Z="invalid_response",J=(X)=>console.warn(X)){let X=B8($)&&B8($.result)?$.result:void 0,Y=X&&B8(X.error)?X.error:void 0,G=Y?.class,z=Y?.code,Q=typeof G==="string"&&wX.includes(G),K=typeof z==="string",V=Q&&K?G:"transient";if(typeof G!=="string")J("unknown");else if(!Q)J(G);return new s6(K?z:Z,V,RX(V))}function S0($){return B8($)&&B8($.result)&&B8($.result.error)}var TX="claustrum",yV=60000;function n6($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function V2($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0?$:void 0}function R$($){return $===void 0||typeof $==="string"}function FX($,Z){if(S0($))throw J6($,"invalid_response",Z);let J=n6($)&&n6($.result)?$.result:void 0,X=J?.payload;if(!Array.isArray(X)||X.length===0||!X.every((H)=>typeof H==="number"&&Number.isInteger(H)&&H>=0&&H<=255))throw J6($,"invalid_response",Z);let Y=V2(J?.record_version);if(Y===void 0)throw J6($,"invalid_record_version",Z);let G=J?.expires_at_ms,z=G===void 0||G===null?null:typeof G==="number"&&Number.isFinite(G)?G:void 0;if(z===void 0)throw J6($,"invalid_expiry",Z);let Q=J?.credential_id,K=J?.project_id,W=J?.account_id,V=J?.email,B=J?.org_name;if(!R$(Q)||!R$(K)||!R$(W)||!R$(V)||!R$(B))throw J6($,"invalid_response",Z);let q;try{q=new TextDecoder("utf-8",{fatal:!0}).decode(Uint8Array.from(X))}catch{throw J6($,"invalid_response",Z)}return{material:q,recordVersion:Y,expiresAtMs:z,credentialId:Q,projectId:K,accountId:W,email:V,orgName:B}}function hV($,Z){if(S0($))throw J6($,"invalid_response",Z);let J=n6($)&&n6($.result)?$.result:void 0,X=J?.record_version,Y=X===void 0?void 0:V2(X),G=J?.credential_id;if(typeof J?.ready!=="boolean"||J?.last_error_code!==void 0&&J?.last_error_code!==null&&typeof J?.last_error_code!=="string"||typeof J?.lease_held!=="boolean"||X!==void 0&&Y===void 0||!R$(G)||J?.stale_pending!==void 0&&typeof J.stale_pending!=="boolean")throw J6($,"invalid_status",Z);return{ready:J.ready,lastErrorCode:J.last_error_code??null,leaseHeld:J.lease_held,...G===void 0?{}:{credentialId:G},...Y===void 0?{}:{recordVersion:Y},...J.stale_pending===void 0?{}:{stalePending:J.stale_pending}}}class T${#$;#Z;#G;#J;#K;#Y;#X=null;#W=0;#V=!1;constructor($,Z,J,X,Y,G){this.#$=$,this.#Z=Z,this.#G=J,this.#J=X,this.#K=Y,this.#Y=G}static async connect($={}){let Z=z2($.connectionFile),J=$.connector??((G)=>J0.connect(G)),X=$.identity??E1($.projectRoot??process.cwd(),$.storagePath??process.cwd()),Y=await J({connectionFile:Z,handshakeTimeoutMs:$.handshakeTimeoutMs});return new T$(Y,J,Z,$.handshakeTimeoutMs,X,$.logger??((G)=>console.warn(G)))}async getCredential($,Z){let J=await this.#Q("credential.get",{handle:$,min_ttl_ms:Z,force_refresh:!1});return FX(J,this.#Y)}async statusCredential($){let Z=await this.#Q("credential.status",{handle:$});return hV(Z,this.#Y)}async reportAuthFailure($){let Z=await this.#Q("credential.report_auth_failure",{handle:$.handle,provider_status:$.providerStatus,record_version:$.recordVersion,reporter_source:$.reporterSource});if(S0(Z))throw J6(Z,"invalid_response",this.#Y);if((n6(Z)&&n6(Z.result)?Z.result:void 0)?.accepted!==!0)throw J6(Z,"invalid_response",this.#Y)}async listScoped($){let Z=await this.#Q("credential.list_scoped",$===void 0?{}:{enrollment_token:$});return mV(Z,this.#Y)}async getScoped($){let Z=await this.#Q("credential.get_scoped",{credential_id:$.credentialId,enrollment_token:$.enrollmentToken,min_ttl_ms:$.minTtlMs});return FX(Z,this.#Y)}async reportAuthFailureScoped($){let Z=await this.#Q("credential.report_auth_failure",{credential_id:$.credentialId,enrollment_token:$.enrollmentToken,provider_status:$.providerStatus,record_version:$.recordVersion,reporter_source:$.reporterSource});if(S0(Z))throw J6(Z,"invalid_response",this.#Y);if((n6(Z)&&n6(Z.result)?Z.result:void 0)?.accepted!==!0)throw J6(Z,"invalid_response",this.#Y)}async enrollPropose($){let Z=await this.#Q("auth.enroll_propose",{proposed_name:$.name,request_secret_hash:$.requestSecretHash}),X=W2(Z,this.#Y).request_id;if(typeof X!=="string"||X.length===0)throw J6(Z,"invalid_response",this.#Y);return{requestId:X}}async enrollPoll($){let Z=await this.#Q("auth.enroll_poll",{request_id:$.requestId,request_secret:$.requestSecret});return uV(Z,this.#Y)}async enrollRotate($){let Z=await this.#Q("auth.enroll_rotate",{token:$.token,expected_token_generation:$.expectedTokenGeneration}),J=W2(Z,this.#Y),X=J.token,Y=J.token_generation;if(typeof X!=="string"||X.length===0||typeof Y!=="number"||!Number.isInteger(Y)||Y<0)throw J6(Z,"invalid_response",this.#Y);return{token:X,tokenGeneration:Y}}close(){this.#V=!0,this.#$.close()}async#Q($,Z){let J=this.#$;try{return await J.call(TX,$,Z,{identity:this.#K,consumerIdentity:null})}catch(X){if(this.#B(X)){try{if(this.#$===J)await this.#q()}catch(Y){throw this.#z(Y)}try{return await this.#$.call(TX,$,Z,{identity:this.#K,consumerIdentity:null})}catch(Y){throw this.#z(Y)}}throw this.#z(X)}}#z($){if($ instanceof s6)return $;let Z=$ instanceof S6&&$.code?$.code:"transport_error";return new s6(Z,"transient","retry")}#B($){return!this.#V&&$ instanceof S6&&$.kind==="terminal"&&$.code!=="missing_identity"&&$.code!=="invalid_control_body"&&$.code!=="unknown_module"}async#q(){if(this.#V)throw Error("Claustrum client is closed");if(this.#X){await this.#X;return}let $=Date.now();if($<this.#W)throw Error("Claustrum client reconnect is backed off");this.#W=$+yV,this.#X=this.#Z({connectionFile:this.#G,handshakeTimeoutMs:this.#J}).then((Z)=>{if(this.#V)throw Z.close(),Error("Claustrum client is closed");let J=this.#$;this.#$=Z,J.close()}).finally(()=>{this.#X=null}),await this.#X}}function mV($,Z){if(S0($))throw J6($,"invalid_response",Z);let J=n6($)&&n6($.result)?$.result:void 0,X=J?.credentials;if(!Array.isArray(X))throw J6($,"invalid_response",Z);let Y=J?.view;if(typeof Y!=="string"||Y.length===0)throw J6($,"invalid_response",Z);return{rows:X.map((z)=>{if(!n6(z))throw J6($,"invalid_response",Z);let Q=V2(z.record_version);if(Q===void 0)throw J6($,"invalid_record_version",Z);let K=(H)=>{if(!Array.isArray(H)||!H.every((j)=>typeof j==="string"))throw J6($,"invalid_response",Z);return H};if(typeof z.id!=="string"||typeof z.type!=="string"||typeof z.state!=="string")throw J6($,"invalid_response",Z);let W=z.created_at_ms===void 0||z.created_at_ms===null?null:typeof z.created_at_ms==="number"&&Number.isFinite(z.created_at_ms)?z.created_at_ms:void 0;if(W===void 0)throw J6($,"invalid_response",Z);let V=z.plan_tier;if(V!==void 0&&(typeof V!=="string"||!/^[a-z][a-z0-9_]{0,31}(?![\s\S])/.test(V)))throw J6($,"invalid_response",Z);let{auth_method:B,plan_tier_source:q}=z;if(q!==void 0&&q!=="operator"&&q!=="detected")throw J6($,"invalid_response",Z);if(B!==void 0&&B!=="apikey"&&B!=="chatgpt"&&B!=="antigravity"&&B!=="oauth")throw J6($,"invalid_response",Z);if(!R$(z.refresh_adapter))throw J6($,"invalid_response",Z);if(!R$(z.account_id)||!R$(z.email)||!R$(z.org_name))throw J6($,"invalid_response",Z);return{id:z.id,categories:K(z.categories),credentialType:z.type,serves:K(z.serves),providerIds:z.provider_ids===void 0?[]:K(z.provider_ids),authMethod:B,planTier:V,planTierSource:q,state:z.state,refreshAdapter:z.refresh_adapter,recordVersion:Q,operations:K(z.operations),createdAtMs:W,accountId:z.account_id,email:z.email,orgName:z.org_name}}),view:Y}}function W2($,Z){if(S0($))throw J6($,"invalid_response",Z);let J=n6($)&&n6($.result)?$.result:void 0;if(J===void 0)throw J6($,"invalid_response",Z);return J}function uV($,Z){let J=W2($,Z),X=J.status;if(X==="pending")return{status:"pending"};if(X==="denied")return{status:"denied"};if(X!=="approved")throw J6($,"invalid_response",Z);let{name:Y,token:G,token_generation:z}=J;if(typeof Y!=="string"||typeof G!=="string"||G.length===0||typeof z!=="number"||!Number.isInteger(z))throw J6($,"invalid_response",Z);return{status:"approved",name:Y,token:G,tokenGeneration:z}}import{randomUUID as n1}from"node:crypto";import{randomUUID as AY}from"node:crypto";import{mkdir as VN,open as a4,rename as BN,rm as qN}from"node:fs/promises";import{dirname as O7}from"node:path";import{randomUUID as jN}from"node:crypto";import{lstat as $Q,readFile as ZQ,rename as HN,unlink as wY}from"node:fs/promises";import{dirname as N0,resolve as W$}from"node:path";import{randomUUID as o1}from"node:crypto";import{mkdir as CY,open as UN,readFile as SY,rename as kY,rm as r1,stat as vY,writeFile as fY}from"node:fs/promises";import{dirname as A2,join as EY}from"node:path";import{setTimeout as IN}from"node:timers/promises";import{AsyncLocalStorage as _N}from"node:async_hooks";import{createHash as W1}from"node:crypto";import{randomUUID as yY}from"node:crypto";import{randomUUID as DU}from"node:crypto";import{isDeepStrictEqual as MU}from"node:util";import{types as z5}from"node:util";import{randomUUID as lU}from"node:crypto";import{constants as sY}from"node:fs";import{lstat as dU,mkdir as iU,open as hQ,rename as sU,rm as tU}from"node:fs/promises";import{basename as aU,dirname as tY,isAbsolute as nU,join as oU}from"node:path";import{types as rU}from"node:util";import{createHash as eU}from"node:crypto";import{createHash as Zx}from"node:crypto";import{lstat as Jx,readFile as Xx}from"node:fs/promises";import{createHash as pQ}from"node:crypto";import{createHash as Yx}from"node:crypto";import{createHash as zx}from"node:crypto";import{types as B5}from"node:util";import{resolve as QG}from"node:path";import{appendFileSync as hx,chmodSync as mx,existsSync as i7,renameSync as KG,statSync as ux}from"node:fs";import{open as px}from"node:fs/promises";import{dirname as cx,resolve as lx}from"node:path";import{createHash as $D,randomBytes as ZD,randomUUID as JD}from"node:crypto";import{constants as qG}from"node:fs";import{chmod as XD,mkdir as YD,open as HK,readFile as t7,realpath as GD,rename as zD,stat as LK,unlink as x5}from"node:fs/promises";import{basename as QD,dirname as M0,extname as wF,isAbsolute as RF,join as KD,resolve as TF}from"node:path";import{createHash as PD}from"node:crypto";import{types as cD}from"node:util";import{createHash as dD}from"node:crypto";import{isAbsolute as rD,normalize as eD,parse as $O,sep as Q4}from"node:path";import{createHash as ZO}from"node:crypto";import{constants as g2}from"node:fs";import{lstat as _G,open as JO}from"node:fs/promises";import{resolve as U9}from"node:path";import{createHash as _O}from"node:crypto";import{basename as PO,dirname as AO,join as wO}from"node:path";import{randomUUID as RO}from"node:crypto";import{types as TO}from"node:util";import{createHash as yK,randomUUID as bO}from"node:crypto";import{mkdir as gO,readFile as CG,rename as yO,rm as hO,stat as mO,writeFile as uO}from"node:fs/promises";import{basename as pO,dirname as hK,join as cO}from"node:path";import{randomUUID as JM}from"node:crypto";import{lstat as XM,open as YM,rename as GM,unlink as mG}from"node:fs/promises";import{dirname as zM,isAbsolute as QM,join as KM}from"node:path";import{createHash as WM}from"node:crypto";import{lstat as VM,mkdir as BM,unlink as qM}from"node:fs/promises";import{dirname as jM,isAbsolute as HM}from"node:path";import{createHash as LM}from"node:crypto";import{realpath as NM}from"node:fs/promises";import{basename as dK,dirname as iK,join as sK,resolve as UM}from"node:path";import{types as a9}from"node:util";import{types as rK}from"node:util";import{dirname as HI,join as LI,resolve as NI}from"node:path";import{createHash as DI}from"node:crypto";import{constants as rG}from"node:fs";import{lstat as JW,mkdir as eG,open as XW,unlink as OI}from"node:fs/promises";import{dirname as N8,resolve as $z}from"node:path";import{setTimeout as MI}from"node:timers/promises";import{rmdirSync as II,statSync as _I}from"node:fs";import{mkdir as PI,rmdir as AI,stat as BZ,utimes as YW}from"node:fs/promises";import{createHash as bI}from"node:crypto";import{realpathSync as gI}from"node:fs";import{mkdir as yI,readdir as Yz,rm as W4,stat as Gz,writeFile as hI}from"node:fs/promises";import{tmpdir as mI}from"node:os";import{join as t8,resolve as uI}from"node:path";import{randomUUID as qz}from"node:crypto";import{chmod as jz,lstat as G_,mkdir as z_,readdir as Hz,readFile as Lz,rename as Q_,rm as n2,stat as K_,writeFile as W_}from"node:fs/promises";import{tmpdir as V_}from"node:os";import{join as C4}from"node:path";import{Buffer as __}from"node:buffer";import{createHash as P_,randomBytes as A_}from"node:crypto";function aV($){return $&&typeof $==="object"&&"code"in $&&typeof $.code==="string"?$.code:"unknown"}var I8="subc-connection.json",nV="subc-",oV=".connection.json";function M9($){try{return sV($).isFile()}catch{return!1}}function rV($){let Z;try{Z=iV($)}catch{return[]}let J=[];for(let X of Z){if(typeof X!=="string")continue;if(!X.startsWith(nV)||!X.endsWith(oV))continue;let Y=E9($,X);if(M9(Y))J.push(Y)}return J.sort(),J}function eV($=process.env){let Z=$.XDG_RUNTIME_DIR?.trim();if(Z){let z=E9(Z,I8);if(M9(z))return z}let J=$.HOME?.trim();if(J){let z=E9(J,".local","share","cortexkit","run",I8);if(M9(z))return z}let Y=`/run/user/${process.getuid?.()??Z7().uid}/${I8}`;if(M9(Y))return Y;let G=rV(tV());if(G.length===1)return G[0];return}function $B($=process.env){let Z=eV($);if(Z)return Z;let J=$.XDG_RUNTIME_DIR?.trim();if(J&&(process.platform!=="darwin"||M9(J)))return E9(J,I8);if(process.platform==="darwin"){let Y=$.HOME?.trim()||Z7().homedir;return E9(Y,".local","share","cortexkit","run",I8)}return`/run/user/${process.getuid?.()??Z7().uid}/${I8}`}function Cz($,Z=process.env){return $?.trim()||Z.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE?.trim()||Z.CLAUSTRUM_SUBC_CONNECTION?.trim()||$B(Z)}function IJ($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function ZB($){return IJ($)&&typeof $.host==="string"&&$.host.trim().length>0&&typeof $.port==="number"&&Number.isInteger($.port)&&$.port>0&&$.port<=65535}async function Cw($){let Z=Cz($),J;try{J=await Fz.readFile(Z,"utf8")}catch(Y){let G=aV(Y);if(G==="ENOENT")return{status:"absent",path:Z};return{status:"malformed",path:Z,reason:`unreadable (${G})`}}let X;try{X=JSON.parse(J)}catch{return{status:"malformed",path:Z,reason:"invalid JSON"}}if(!IJ(X)||typeof X.schema!=="number"||!Number.isFinite(X.schema)||typeof X.wire_version!=="number"||!Number.isFinite(X.wire_version)||!Array.isArray(X.endpoints)||X.endpoints.length===0||!X.endpoints.every(ZB))return{status:"malformed",path:Z,reason:"connection file has an invalid schema, wire_version, or endpoints"};return{status:"available",schema:X.schema,wireVersion:X.wire_version,endpoints:X.endpoints.map((Y)=>({host:Y.host,port:Y.port}))}}var Sz="claustrum-tombstone:v1:";function kz($){return`${Sz}${$}`}function LZ($){return{type:"oauth",access:"",refresh:kz($),expires:0}}function vz($){return typeof $==="string"&&$.startsWith(Sz)}function Sw($,Z){if(!IJ($)||$.type!=="oauth")return!1;return $.refresh===kz(Z)}class _J extends Error{provider;code="custody_tombstone_refresh";constructor($){super(`${$} OAuth credentials are vault-custodied; local token refresh is forbidden`);this.provider=$,this.name="CustodyTombstoneRefreshError"}}function PJ($,Z){if(vz($))throw new _J(Z)}var NZ="9d1c250a-e61b-44d9-88ed-5944d1962f5e",fz={console:"https://platform.claude.com/oauth/authorize",max:"https://claude.com/cai/oauth/authorize"},J7="https://platform.claude.com/oauth/code/callback",Ez="https://platform.claude.com/v1/oauth/token",JB=/^ckh_[A-Za-z0-9_-]{43}$/,bz="axios/1.15.2",gz=["org:create_api_key","user:profile","user:inference","user:sessions:claude_code","user:mcp_servers","user:file_upload"],XB="user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload",kw="mcp_";var YB="fast-mode-2026-02-01";function vw($,Z){let J=($??"").split(",").map((X)=>X.trim()).filter(Boolean);return[...new Set([...J,...Z])].join(",")}function fw($){return typeof $==="string"&&($.startsWith("claude-opus-4-8")||$.startsWith("claude-opus-5"))}var Ew="You are OpenCode",bw="You are Claude Code, Anthropic's official CLI for Claude.",gw=["<use_parallel_tool_calls>","For maximum efficiency, whenever you perform multiple independent operations, invoke all relevant tools simultaneously rather than sequentially. Prioritize calling independent tools in parallel whenever possible. For example, when reading 3 known files, run 3 tool calls in parallel to read all 3 files into context at the same time. When running multiple independent read-only commands like `ls` or `list_dir`, run all of those commands in parallel. Err on the side of maximizing parallel tool calls for independent work rather than running too many tools sequentially.","","Do not parallelize tool calls when one call depends on the output of another call. If a tool call needs an ID, filename, search result, or any other value returned by a previous tool call, run the first call, wait for its result, then run the dependent call using the real returned value. Never invent placeholder IDs, guessed task IDs, or other guessed values for dependent tool calls just to place them in the same parallel block.","</use_parallel_tool_calls>"].join(`
-`),GB="59cf53e54c78",zB=[4,7,20],Z1="2.1.280",yz="cli",QB="0.112.1",KB="v26.3.0",WB=`claude-cli/${Z1} (external, ${yz})`,hz=["explicit","automatic","hybrid"],mz="explicit",yw=["github.com/anomalyco/opencode","opencode.ai/docs"],hw=[{match:"if OpenCode honestly",replacement:"if the assistant honestly"},{match:"Here is some useful information about the environment you are running in:",replacement:"Environment context you are running in:"}],SX=new Set(["EAI_AGAIN","ECONNREFUSED","ECONNRESET","EHOSTUNREACH","ENETUNREACH","ENOTFOUND","ETIMEDOUT","UND_ERR_CONNECT_TIMEOUT"]);function kX($,Z){if(!$||typeof $!=="object")return;let J=$[Z];return typeof J==="string"?J:void 0}function g$($){let Z=kX($,"code");if(Z&&SX.has(Z))return!0;let J=$ instanceof Error?$.message:kX($,"message")??String($);if(J.includes("fetch failed"))return!0;return[...SX].some((X)=>J.includes(X))}function vX($){let Z="";for(let J of $)Z+=String.fromCharCode(J);return btoa(Z).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async function VB(){let $=new Uint8Array(64);crypto.getRandomValues($);let Z=vX($),J=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(Z));return{verifier:Z,challenge:vX(new Uint8Array(J)),method:"S256"}}function uz($){if(!$)return;let Z=Number($);if(Number.isFinite(Z)&&Z>0)return Math.ceil(Z);let J=Date.parse($);if(Number.isFinite(J)){let X=Math.ceil((J-Date.now())/1000);return X>0?X:void 0}return}class b9 extends Error{status;body;retryAfter;isRefreshError=!0;constructor($,Z,J){super(`Claude OAuth refresh failed: ${$} — ${Z}`);this.status=$,this.body=Z,this.name="ClaudeOAuthRefreshError",this.retryAfter=uz(J??void 0)}}async function BB($){if(PJ($.refreshToken,"anthropic"),typeof $.refreshToken!=="string"||!$.refreshToken.trim())throw Error("Local OAuth refresh credential is unavailable");let Z=$.fetchImpl??fetch,J=$.maxRetries??2,X=$.baseDelayMs??500,Y=$.setTimeoutImpl??globalThis.setTimeout;for(let G=0;G<=J;G++)try{if(G>0){let W=X*2**(G-1);await new Promise((V)=>Y(V,W))}let z=await Z(Ez,{method:"POST",redirect:"error",headers:{"Content-Type":"application/json",Accept:"application/json, text/plain, */*","User-Agent":bz},body:JSON.stringify({grant_type:"refresh_token",refresh_token:$.refreshToken,client_id:NZ,scope:XB})});if(!z.ok){if(z.status>=500&&G<J){await z.body?.cancel().catch(()=>{});continue}let W=await z.text().catch(()=>"");throw new b9(z.status,W,z.headers.get("retry-after"))}let Q=await z.json(),K=$.now?.()??Date.now();return{access:Q.access_token,refresh:Q.refresh_token??$.refreshToken,expires:K+Q.expires_in*1000,expiresIn:Q.expires_in,authLineageId:$.authLineageId}}catch(z){if(z instanceof b9)throw z;if(G<J&&g$(z))continue;throw z}throw Error("Token refresh exhausted all retries")}function qB(){return crypto.randomUUID().replace(/-/g,"")}function jB($){let Z=$.trim();try{let z=new URL(Z),Q=z.searchParams.get("code"),K=z.searchParams.get("state");if(Q&&K)return{code:Q,state:K}}catch{}let J=Z.split("#");if(J.length===2&&J[0]&&J[1])return{code:J[0],state:J[1]};let X=new URLSearchParams(Z),Y=X.get("code"),G=X.get("state");if(Y&&G)return{code:Y,state:G};return null}async function HB($,Z,J){let X=await fetch(Ez,{method:"POST",redirect:"error",headers:{"Content-Type":"application/json",Accept:"application/json, text/plain, */*","User-Agent":bz},body:JSON.stringify({code:$.code,state:$.state,grant_type:"authorization_code",client_id:NZ,redirect_uri:J,code_verifier:Z})});if(!X.ok)return{type:"failed"};let Y=await X.json();return{type:"success",refresh:Y.refresh_token,access:Y.access_token,expires:Date.now()+Y.expires_in*1000}}async function mw($){let Z=await VB(),J=qB(),X=new URL(fz[$],import.meta.url);return X.searchParams.set("code","true"),X.searchParams.set("client_id",NZ),X.searchParams.set("response_type","code"),X.searchParams.set("redirect_uri",J7),X.searchParams.set("scope",gz.join(" ")),X.searchParams.set("code_challenge",Z.challenge),X.searchParams.set("code_challenge_method","S256"),X.searchParams.set("state",J),{url:X.toString(),redirectUri:J7,state:J,verifier:Z.verifier}}async function uw($,Z,J,X){let Y=jB($);if(!Y)return{type:"failed"};if(X&&Y.state!==X)return{type:"failed"};return HB(Y,Z,J)}var LB=globalThis.setTimeout.bind(globalThis),NB=globalThis.clearTimeout.bind(globalThis),pz="anthropic-auth.json",UB="anthropic-auth-state.json",xB="https://api.anthropic.com/api/oauth/usage",UZ=["five_hour","seven_day","scoped","extraUsage","bindingWindow","fallbackAdvised"];function pw($){return $.access==null&&($.refresh==null||$.refresh==="")}function n0($){return $.type==="oauth"}function cw($){return $.type==="api"}function cz($){let Z=$?.trim();if(!Z)return!1;try{let J=new URL(Z);return(J.protocol==="http:"||J.protocol==="https:")&&!J.username&&!J.password}catch{return!1}}function lw($){return $.costZeroing?.enabled!==!1}var DB=[401,403,429];var X7=300000,OB=3600000,lz=86400000,MB=60000,IB=900000,_B=300000,PB=5,fX={five_hour:0,seven_day:0},AB=!0,dw=60000;function wB(){if(process.env.OPENCODE_CONFIG_DIR?.trim())return process.env.OPENCODE_CONFIG_DIR.trim();return v8(process.env.XDG_CONFIG_HOME||v8(lV(),".config"),"opencode")}function AJ(){return process.env.OPENCODE_ANTHROPIC_AUTH_FILE?.trim()||v8(wB(),pz)}function RB($=AJ()){let Z=process.env.OPENCODE_ANTHROPIC_AUTH_STATE_FILE?.trim();if(Z)return Z;return $.endsWith(pz)?v8(dV($),UB):`${$}.state.json`}function iw(){return{version:1,main:{type:"opencode",provider:"anthropic"},accounts:[]}}function X9($,Z){if(Z===void 0||!Number.isFinite(Z))return $;if($===void 0||!Number.isFinite($))return Z;return Math.max($,Z)}function o0($){return Math.max($?.five_hour?.checkedAt??0,$?.seven_day?.checkedAt??0,...$?.scoped?.map((Z)=>Z.checkedAt)??[],$?.checkedAt??0)}function EX($){if($?.source==="poll")return 2;if($?.source==="headers")return 1;return 0}function TB($,Z){if(!("scoped"in $))return Z.scoped;if(!Array.isArray($.scoped)||$.scoped.length===0)return $.scoped;if(!Array.isArray(Z.scoped)||Z.scoped.length===0)return $.scoped;let J=new Map(Z.scoped.map((X)=>[X.id,X]));for(let X of $.scoped){let Y=J.get(X.id);if(!Y||X.checkedAt>=Y.checkedAt)J.set(X.id,X)}return[...J.values()]}function bX($,Z,J){let X=$[J],Y=Z[J];if(!Y)return X;if(!X)return Y;if(Y.checkedAt>X.checkedAt)return Y;if(Y.checkedAt<X.checkedAt)return X;return EX($)>EX(Z)?X:Y}function V0($,Z){if(!$||$[Z]===void 0)return;return $.fieldSources?.[Z]??($.source==="poll"||$.source==="headers"?$.source:void 0)}function FB($,Z,J){let X={};for(let Y of UZ){if(J[Y]===void 0)continue;if(Y==="scoped"||Y==="extraUsage"){X[Y]="poll";continue}if(Y==="bindingWindow"&&$.bindingWindowSource==="poll"&&$.bindingWindow===J.bindingWindow){X[Y]="poll";continue}if(Y==="fallbackAdvised"&&Z.fieldSources?.fallbackAdvised===void 0){let z=V0($,Y);if(z)X[Y]=z;continue}let G=Z[Y]===J[Y]?V0(Z,Y):$[Y]===J[Y]?V0($,Y):V0($,Y)??V0(Z,Y);if(G)X[Y]=G}return Object.keys(X).length>0?X:void 0}function CB($,Z){if(!$||Z.source!=="headers")return Z;let J=$.bindingWindowSource==="poll",X={...$,...Z,five_hour:bX($,Z,"five_hour"),seven_day:bX($,Z,"seven_day"),scoped:TB($,Z),extraUsage:$.extraUsage??Z.extraUsage,fallbackAdvised:Z.fieldSources?.fallbackAdvised!==void 0?Z.fallbackAdvised:$.fallbackAdvised??Z.fallbackAdvised,bindingWindow:J?$.bindingWindow:Z.bindingWindow??$.bindingWindow,bindingWindowSource:J?"poll":Z.bindingWindowSource??$.bindingWindowSource},Y=FB($,Z,X);return{...X,...Y&&{fieldSources:Y}}}function H2($){return $?.claustrum?.mode==="claustrum"?"claustrum":"local"}async function g9($){let J=`${$.path??AJ()}.${$.name}.lock`,X=v8(J,"owner.json"),Y=B2(),G=$.now??Date.now,z=null,Q=!1;async function K(){try{return JSON.parse(await q2(J,"utf8"))}catch(H){if(H.code!=="EISDIR")throw H;return JSON.parse(await q2(X,"utf8"))}}async function W(){await j2(J,`${JSON.stringify({ownerId:Y,expiresAt:G()+$.ttlMs})}
-`,{encoding:"utf8",mode:384})}async function V(){try{return await j2(J,`${JSON.stringify({ownerId:Y,expiresAt:G()+$.ttlMs})}
-`,{encoding:"utf8",mode:384,flag:"wx"}),!0}catch(H){let j=H.code;if(j==="EEXIST"||j==="EISDIR")return!1;throw H}}function B(){if(!$.renew||Q)return;let H=$.renewIntervalMs??Math.max(1000,Math.floor($.ttlMs/3));if(z=LB(()=>{(async()=>{try{let j=await K(),x=G();if(Q||j?.ownerId!==Y||Number(j?.expiresAt)<=x)return;await W(),B()}catch{}})()},H),"unref"in z)z.unref()}let q=await V();if(!q){let H=`${J}.evicting`,j=v8(H,"owner.json"),x=B2(),L=5000,U=8;async function M(){await new Promise((S)=>setTimeout(S,Math.floor(Math.random()*4)))}async function A(){try{let S=await K();return Number(S?.expiresAt)>G()}catch{try{return(await CX(J)).mtimeMs+$.ttlMs>G()}catch{return!1}}}async function _(){try{return JSON.parse(await q2(j,"utf8"))?.ownerId===x}catch{return!1}}async function N(){await pV(H);try{await j2(j,`${JSON.stringify({ownerId:x,createdAt:G()})}
-`,{encoding:"utf8",mode:384,flag:"wx"})}catch(S){let E=S.code;if(E==="ENOENT"||E==="EINVAL")return!1;throw await R(),S}return await $.onStep?.("eviction-marker-acquired"),!0}async function R(){if(await _())await J9(H,{recursive:!0,force:!0}).catch(()=>{})}for(let S=0;S<8;S++){if(q=await V(),q)break;if(await A())return null;try{if(!await N()){await M();continue}}catch(E){if(E.code!=="EEXIST")throw E;let s;try{s=await CX(H)}catch(I){if(I.code==="ENOENT"){await M();continue}throw I}if(s.mtimeMs+5000>G())return null;await $.onStep?.("stale-marker-stat");let c=`${H}.${B2()}`;try{await cV(H,c)}catch(I){if(I.code==="ENOENT"){await M();continue}throw I}await $.onStep?.("stale-marker-claimed"),await J9(c,{recursive:!0,force:!0}).catch(()=>{}),await M();continue}try{if(await A())return null;if(!await _())return null;if(await $.onStep?.("stale-lock-confirmed"),!await _())return null;if(await J9(J,{recursive:!0,force:!0}).catch(()=>{}),!await _())return null;if(q=await V(),!q)return null;if(!await _())return await J9(J,{recursive:!0,force:!0}).catch(()=>{}),q=!1,null;break}finally{await R()}}}if(!q)return null;return B(),{assertOwned:async()=>{let H=await K().catch(()=>{return});if(Q||H?.ownerId!==Y)throw Error("Account file lock ownership was lost")},release:async()=>{if(Q=!0,z)NB(z),z=null;try{if((await K())?.ownerId!==Y)return}catch{return}await J9(J,{recursive:!0,force:!0}).catch(()=>{})}}}function sw($){return $?.claudeCache?.enabled===!0}function SB($){return typeof $==="string"&&hz.includes($)?$:mz}function tw($){return SB($?.claudeCache?.mode)}function aw($){return $?.dump?.enabled===!0}function nw($){return $?.claudeFast?.enabled===!0}function ow($){return $?.cacheKeep?.subagents===!0}function rw($){return $?.prime?.enabled===!0}function kB($){return $?.fallbackOn?.length?$.fallbackOn:DB}function ew($,Z){return kB(Z).includes($)}function wJ($){let Z=$?.quota?.minimumRemaining||{};return{five_hour:Z.five_hour??Z["5h"]??fX.five_hour,seven_day:Z.seven_day??Z["1w"]??fX.seven_day}}function dz($){return $?.quota?.enabled!==!1}function vB($){let Z=$.status;if(typeof Z==="number"&&Number.isFinite(Z))return Z===429||Z>=500;return g$($)}function fB($){let J=($.previous?.accountIdentity===$.accountIdentity&&$.previous?.refreshTokenFingerprint===$.refreshTokenFingerprint?$.previous?.retryCount??0:0)+1,X=$.error.retryAfter,Y;if(typeof X==="number"&&X>0)Y=X*1000;else if(g$($.error))Y=X7;else if(vB($.error))Y=Math.min(OB,X7*2**Math.min(J-1,6));else Y=lz;let G=$.error.status,z=typeof G==="number"&&Number.isFinite(G)?G:void 0,Q=xZ($.error),W=(typeof $.error.body==="string"?$.error.body:"").includes("invalid_grant")||Q.includes("invalid_grant");return{message:Q,checkedAt:$.now,nextRetryAt:$.now+Y,retryCount:J,accountIdentity:$.accountIdentity,refreshTokenFingerprint:$.refreshTokenFingerprint,status:z,permanent:z===400&&W}}function v4($){if(!$)return!1;if(typeof $.permanent==="boolean")return $.permanent;if(typeof $.status==="number")return $.status===400;if(g$($))return!1;if(typeof $.nextRetryAt==="number")return $.nextRetryAt-$.checkedAt>=lz;return!1}function iz($){let Z=$.nextRetryAt;if(!Z||!g$($))return Z;return Math.min(Z,$.checkedAt+X7)}function $R($,Z,J,X){if(!$)return!1;let Y=iz($);if(!Y||Y<=J)return!1;if($.refreshTokenFingerprint&&X&&$.refreshTokenFingerprint!==X)return!1;if(!$.accountIdentity)return!0;if(!Z)return!0;return $.accountIdentity===Z}function ZR($,Z){return`Claude OAuth refresh is backed off for ${Math.max(1,Math.ceil(((iz($)??Z)-Z)/1000))}s after: ${$.message}`}function JR($){if(!$)return[];return $.accounts.filter((Z)=>Z.enabled!==!1&&n0(Z)&&v4(Z.lastRefreshError)).map((Z)=>Z.label?.trim()||Z.id)}function EB($){if($.status===403)return!0;return/Claude quota check failed: 403\b/.test(xZ($))}function Y7($){let J=($.previous?.accountIdentity===$.accountIdentity?$.previous?.retryCount??0:0)+1,X=dB($.error)?Math.min(IB,MB*2**Math.min(J-1,6)):_B;return{message:xZ($.error),checkedAt:$.now,nextRetryAt:$.now+X,retryCount:J,...$.accountIdentity!==void 0&&{accountIdentity:$.accountIdentity}}}function p1($,Z){if(!$?.nextRetryAt||$.nextRetryAt<=Z)return!1;return!0}function XR($,Z){return`Quota API backed off for ${Math.max(1,Math.ceil((($.nextRetryAt??Z)-Z)/1000))}s after: ${$.message}`}function I9($){let Z=$?.quota?.checkIntervalMinutes??PB;return Math.max(1,Z)*60000}function YR($){return $?.logging?.level}function bB($){let Z=$?.quota?.mainQuota;if(!Z)return null;return{quota:Z,checkedAt:o0(Z),tokenFingerprint:$.quota?.mainQuotaToken,accountIdentity:Z.accountIdentity}}function gB($){let Z=$?.quota?.refreshEveryNRequests;return typeof Z==="number"&&Number.isFinite(Z)&&Z>0?Math.floor(Z):0}function G7($){return $?.quota?.failClosedOnUnknownQuota??AB}function sz($){return $.toLowerCase().replace(/[^a-z0-9]/g,"")}function yB($){if(typeof $!=="string")return null;let Z=sz($);if(Z.includes("fable"))return"fable";if(Z.includes("mythos"))return"mythos";return Z}function r$($,Z){let J=yB(Z);if(!J)return;return $?.scoped?.find((X)=>{return[X.modelId,X.modelName,X.title].filter((G)=>typeof G==="string").map(sz).join(" ").includes(J)})}function hB($,Z){let J=r$($,Z);return Boolean(J&&Number.isFinite(J.remainingPercent)&&J.remainingPercent<=0)}function tz($,Z){return!hB($,Z)}function mB($,Z){if(!dz(Z))return!0;let J=wJ(Z);for(let X of["five_hour","seven_day"]){let Y=$?.[X];if(!Y)return!G7(Z);if(!Number.isFinite(Y.remainingPercent))return!G7(Z);if(Y.remainingPercent<J[X])return!1}return!0}function GR($){return Boolean($?.five_hour&&$.seven_day)}var _8={five_hour:5,seven_day:10,scoped:0};function f4($){let Z=$?.five_hour??$?.["5h"],J=$?.seven_day??$?.["1w"],X=$?.scoped;return{five_hour:typeof Z==="number"&&Number.isFinite(Z)?Z:_8.five_hour,seven_day:typeof J==="number"&&Number.isFinite(J)?J:_8.seven_day,scoped:typeof X==="number"&&Number.isFinite(X)?X:_8.scoped}}function az($){return $?.killswitch?.enabled===!0}function nz($,Z){if(!$?.killswitch)return _8;if(Z&&$.killswitch.accounts?.[Z])return f4($.killswitch.accounts[Z]);return f4($.killswitch.main)}function oz($,Z,J,X){if(!az(Z))return!0;let Y=nz(Z,J),G=!1;for(let z of["five_hour","seven_day"]){let Q=$?.[z];if(!Q||!Number.isFinite(Q.remainingPercent)){if(Y[z]>0)return!1;G=!0;continue}if(Q.remainingPercent<Y[z])return!1}if(X){if(Y.scoped>0&&$?.scoped===void 0)return!1;let z=r$($,X);if(z&&(!Number.isFinite(z.remainingPercent)&&Y.scoped>0||z.remainingPercent<=Y.scoped))return!1}if(G)return!G7(Z);return!0}function uB($,Z,J,X){let Y=[],G=[$,...Z.map((z)=>z.quota)];for(let z of G)if(X){let K=r$(z,X)?.resetsAt;if(!K)continue;let W=Date.parse(K);if(Number.isFinite(W)&&W>J)Y.push(W)}else for(let Q of["five_hour","seven_day"]){let K=z?.[Q]?.resetsAt;if(!K)continue;let W=Date.parse(K);if(Number.isFinite(W)&&W>J)Y.push(W)}if(!Y.length)return 300;return Math.max(1,Math.ceil((Math.min(...Y)-J)/1000))+60}function zR($){return $?.killswitch??{enabled:!1}}function q8($,Z,J){let X=I9(Z);if(!dz(Z))return J+X;let Y=Math.min(...[...["five_hour","seven_day"].map((K)=>$?.[K]?.checkedAt),...($?.scoped??[]).map((K)=>K.checkedAt)].filter((K)=>Number.isFinite(K)).map((K)=>K+X)),G=(K)=>Number.isFinite(Y)?Math.min(K,Y):K,z=wJ(Z),Q=[];for(let K of["five_hour","seven_day"]){let W=$?.[K];if(!W)return G(J+X);if(W.remainingPercent>=z[K])continue;let V=W.resetsAt?Date.parse(W.resetsAt):Number.NaN;if(!Number.isFinite(V)||V<=J)return G(J+X);Q.push(V)}if(!Q.length)return G(J+X);return G(Math.min(...Q)+60000)}function E4($){if(!Number.isFinite($))return 0;if($<0)return 0;if($>100)return 100;return $}function L0($){return typeof $==="string"&&$.trim()?$.trim():void 0}function rz($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}function pB($,Z){if(!Array.isArray($))return[];let J=new Set,X=[];for(let Y of $){if(Y?.kind!=="weekly_scoped"||Y.group!=="weekly")continue;if(typeof Y.percent!=="number"||!Number.isFinite(Y.percent))continue;let G=L0(Y.scope?.model?.display_name);if(!G)continue;let z=L0(Y.scope?.model?.id)??G,Q=rz(z);if(!Q)continue;let K=`claude-weekly-scoped-${Q}`;if(J.has(K))continue;J.add(K);let W=E4(Y.percent),V=L0(Y.scope?.model?.id);X.push({id:K,title:`${G} only`,...V&&{modelId:V},modelName:G,usedPercent:W,remainingPercent:E4(100-W),resetsAt:Y.resets_at??void 0,checkedAt:Z})}return X}function cB($){if($.extra_usage?.is_enabled!==!0)return;let Z=$.extra_usage.used_credits,J=$.extra_usage.monthly_limit;if(typeof Z!=="number"||!Number.isFinite(Z)||typeof J!=="number"||!Number.isFinite(J))return;let X=$.spend?.limit?.currency,Y=X==null?"USD":L0(X),G=$.spend?.limit?.exponent,z=G==null?2:G;if(!Y||!/^[A-Za-z]{3}$/.test(Y)||!Number.isInteger(z)||z<0||z>20)return;return{used:{amountMinor:Z,currency:Y,exponent:z},limit:{amountMinor:J,currency:Y,exponent:z},...typeof $.extra_usage.utilization==="number"&&Number.isFinite($.extra_usage.utilization)&&{utilizationPercent:$.extra_usage.utilization},...L0($.spend?.severity)&&{severity:L0($.spend?.severity)},exhausted:Z>=J}}function lB($){if(!Array.isArray($))return;let Z=$.find((G)=>G?.is_active===!0);if(!Z)return;if(Z.kind==="session")return"five_hour";if(Z.kind==="weekly_all")return"seven_day";if(Z.kind!=="weekly_scoped"||Z.group!=="weekly")return;let J=L0(Z.scope?.model?.display_name);if(!J)return;let X=L0(Z.scope?.model?.id)??J,Y=rz(X);return Y?`claude-weekly-scoped-${Y}`:void 0}function gX($,Z){if(typeof $?.utilization!=="number")return;if(!Number.isFinite($.utilization))return;let J=E4($.utilization);return{usedPercent:J,remainingPercent:E4(100-J),resetsAt:$.resets_at??void 0,checkedAt:Z}}async function b4($){PJ($.accessToken,"anthropic");let J=await($.fetchImpl??fetch)(xB,{method:"GET",headers:{Authorization:`Bearer ${$.accessToken}`,Accept:"application/json","Content-Type":"application/json","anthropic-beta":"oauth-2025-04-20","User-Agent":`claude-code/${Z1}`}});if(!J.ok){let K=await J.text().catch(()=>"");throw Object.assign(Error(`Claude quota check failed: ${J.status} — ${K}`),{status:J.status,retryAfter:uz(J.headers.get("Retry-After"))})}let X=$.now?.()??Date.now(),Y=await J.json(),G=lB(Y.limits),z={five_hour:gX(Y.five_hour,X),seven_day:gX(Y.seven_day,X),scoped:pB(Y.limits,X),extraUsage:cB(Y),...G&&{bindingWindow:G,bindingWindowSource:"poll"},source:"poll",checkedAt:X},Q={...z.five_hour&&{five_hour:"poll"},...z.seven_day&&{seven_day:"poll"},...z.scoped&&{scoped:"poll"},...z.extraUsage&&{extraUsage:"poll"},...z.bindingWindow&&{bindingWindow:"poll"}};return{...z,...Object.keys(Q).length>0&&{fieldSources:Q}}}function QR($,Z){if(!$||$.authLineageId!==Z)return null;return $.anthropicAccountUuid??null}function xZ($){return $ instanceof Error?$.message:String($)}function dB($){let Z=$.status;if(typeof Z==="number"&&Number.isFinite(Z)){if(Z===429||Z>=500)return!0}let J=xZ($);if(/Claude quota check failed: (429|5\d\d)\b/.test(J))return!0;if(J.includes("Quota refresh is already in progress"))return!0;return g$($)}var ez="## Claude Cache Status",iB="## Claude Cache Enabled",sB="## Claude Cache Disabled",tB="## Claude Cache Usage",aB="Usage: `/claude-cache`, `/claude-cache on`, `/claude-cache off`, or `/claude-cache mode explicit|automatic|hybrid`.",DZ=!1,OZ=mz;function KR(){return DZ}function WR(){return OZ}function VR($){DZ=$.enabled,OZ=$.mode}function nB($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="on")return{type:"enable"};if(Z.length===1&&Z[0]==="off")return{type:"disable"};if(Z.length===2&&Z[0]==="mode"&&(Z[1]==="explicit"||Z[1]==="automatic"||Z[1]==="hybrid"))return{type:"mode",mode:Z[1]};return{type:"usage"}}function Y9($){let Z=$?.enabled??DZ,J=$?.mode??OZ;return[ez,"",`- Enabled: ${Z?"enabled":"disabled"}`,`- Mode: ${J}`,"- Persisted: ~/.config/opencode/anthropic-auth.json","- Scope: main sessions only; subagent sessions keep default ephemeral cache behavior","- Modes: explicit = existing OpenCode breakpoints; automatic = top-level cache_control only; hybrid = system + messages[0] + top-level cache_control","- TTL: 1h when enabled for main sessions; default ephemeral cache behavior otherwise"].join(`
-`)}function BR($){let Z=nB($.argumentsText),J=$.enabled??DZ,X=$.mode??OZ;if(Z.type==="status")return Y9({enabled:J,mode:X});if(Z.type==="enable")return[iB,"",Y9({enabled:!0,mode:X})].join(`
-`);if(Z.type==="disable")return[sB,"",Y9({enabled:!1,mode:X})].join(`
-`);if(Z.type==="mode")return[ez,"",`Mode updated to \`${Z.mode}\`.`,"",Y9({enabled:J,mode:Z.mode})].join(`
-`);return[tB,"",aB,"",Y9({enabled:J,mode:X})].join(`
-`)}var rB=/^req_[A-Za-z0-9_-]{8,128}$/,eB=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,$q=/ cc_(?:prev_req|prompt_id)=[^;\r\n]*;/g;function Zq($){return rB.test($)}function Jq($){return eB.test($)}var Xq=0x4d659218e32a3268n,Yq="cch=00000;";var RJ=/("system":\[\{"type":"text","text":"x-anthropic-billing-header: cc_version=[^;"]+; cc_entrypoint=[^;"]+; )cch=([0-9a-f]{5});/,Gq=/("system":\[\{"type":"text","text":"x-anthropic-billing-header: cc_version=[^;"]+; cc_entrypoint=[^;"]+; )cch=00000;/,yX=null,g4=null;async function $3(){if(g4)return;yX??=(async()=>{g4=(await E5()).h64Raw})(),await yX}function Z3($){let Z=$.find((X)=>X.role==="user");if(!Z)return"";let{content:J}=Z;if(typeof J==="string")return J;if(Array.isArray(J)){let X=J.filter((z)=>z.type==="text"),Y=X.find((z)=>z.text?.includes("<command-name>"));if(Y?.text)return Y.text.slice(Y.text.indexOf("<command-name>"));let G=X.findLast((z)=>typeof z.text==="string"&&z.text.length>0);if(G?.text)return G.text}return""}class zq{limit;#$=new Map;constructor($=1000){this.limit=$}resolve($,Z,J=!0){let X=this.#$.get($);if(X!==void 0)return this.#$.delete($),this.#$.set($,X),X;let Y=Z3(Z);if(J){if(!this.#$.has($)&&this.#$.size>=this.limit){let G=this.#$.keys().next().value;if(G!==void 0)this.#$.delete(G)}this.#$.set($,Y)}return Y}has($){return this.#$.has($)}clear(){this.#$.clear()}}async function Qq($){return await $3(),((g4?.($,Xq)??0n)&0xfffffn).toString(16).padStart(5,"0")}async function HR($){return await $3(),(g4?.(new TextEncoder().encode($),0n)??0n).toString(16).padStart(16,"0").slice(0,16)}function Kq($){return $.replace(RJ,`$1${Yq}`)}function Wq($){return RJ.exec($)?.[2]??null}async function Vq($){if(!RJ.test($))return $;let Z=Kq($),J=JSON.parse(Z);if("model"in J)J.model="";delete J.max_tokens;let X=await Qq(new TextEncoder().encode(JSON.stringify(J)));return Z.replace(Gq,`$1cch=${X};`)}function Bq($,Z=Z1){let J=zB.map((X)=>$[X]??"0").join("");return oB("sha256").update(`${GB}${J}${Z}`).digest("hex").slice(0,3)}function LR($,Z=Z1,J,X,Y){let G=Bq(X??Z3($),Z),z=`x-anthropic-billing-header: cc_version=${Z}.${G}; cc_entrypoint=${J}; cch=00000;`;if(Y?.previousRequestId&&Zq(Y.previousRequestId))z+=` cc_prev_req=${Y.previousRequestId};`;if(Y?.promptId&&Jq(Y.promptId))z+=` cc_prompt_id=${Y.promptId};`;return z}function qq($){return $.replace($q,"")}function jq($){if(!$||typeof $!=="object")return 0;let Z=$.system;if(!Array.isArray(Z))return 0;let J=0;for(let X of Z){if(!X||typeof X!=="object")continue;let Y=X.text;if(typeof Y!=="string"||!Y.startsWith("x-anthropic-billing-header:"))continue;let G=qq(Y);if(G===Y)continue;X.text=G,J+=1}return J}var Lq=1000,N6=new Map;function L$($,Z,J,X=Lq){if(!$.has(Z)&&$.size>=X){let Y=$.keys().next().value;if(Y!==void 0)$.delete(Y)}$.set(Z,J)}function L2($,Z){if(!Z.accountUuid)return Z;if(N6.get($)!==Z)return{...Z,accountUuid:void 0};let J={...Z,accountUuid:void 0};return L$(N6,$,J),J}function y4($){let Z=$||"anonymous",J=N6.get(Z);if(J)return J;let X={deviceId:Hq(32).toString("hex"),sessionId:J3()};return L$(N6,Z,X),X}var Nq=86400000,Uq=300000,c1=new Map,hX=new Map;function xq($){return`compat:${$||"anonymous"}`}function TJ($){return`identity:${$}`}function h4($,Z){return`account:${$}:${Z}`}function l1($,Z,J){if(!$)return;if($.accountIdentity!==void 0&&$.accountIdentity!==Z)return;if(J!==void 0&&$.accountUuid!==void 0&&$.accountUuid!==J)return;if($.accountIdentity===Z&&(J===void 0||$.accountUuid===J))return $;return{...$,accountIdentity:Z,...J!==void 0&&{accountUuid:J}}}function L9($,Z,J){L$(N6,TJ(Z),$),L$(N6,h4(J,Z),$)}async function Dq($,Z){if(!$.startsWith("sk-ant-oat"))return null;let J=new AbortController,X=setTimeout(()=>J.abort(),5000);try{let Y=new URL("https://api.anthropic.com/api/claude_cli/bootstrap");if(Y.searchParams.set("entrypoint",yz),Z)Y.searchParams.set("model",Z);let G=await fetch(Y,{method:"GET",redirect:"error",headers:{accept:"application/json, text/plain, */*",authorization:`Bearer ${$}`,"content-type":"application/json","anthropic-beta":"oauth-2025-04-20","user-agent":`claude-code/${Z1}`},signal:J.signal});if(!G.ok)return null;let Q=(await G.json().catch(()=>null))?.oauth_account?.account_uuid;return typeof Q==="string"&&Q?Q:null}catch{return null}finally{clearTimeout(X)}}function UR($,Z){if(!$.trim()||!Z.trim())throw Error("A verified provider account identity is required");let X={...N6.get(h4(Z,$))??y4(TJ($)),accountIdentity:$,accountUuid:Z};return L9(X,$,Z),X}async function X3($,Z,J){let X=J?.trim()||void 0,Y=X?TJ(X):xq($),G;if(X)G=l1(N6.get(Y)??N6.get($),X)??y4(Y),G=l1(G,X)??G,L$(N6,Y,G);else G=N6.get(Y)??N6.get($)??y4(Y),L$(N6,Y,G),L$(N6,$,G);if(!$.startsWith("sk-ant-oat"))return L2(Y,G);let z=Date.now(),Q=`${Y}:${$}`,K=hX.get(Q);if(K&&K.expiresAt>z){if(!K.accountUuid)return G=L2(Y,G),G;if(!X){if(G.accountUuid===K.accountUuid)return G;return G={...G,accountUuid:K.accountUuid},L$(N6,Q,G),G}let q=l1(N6.get(h4(K.accountUuid,X))??N6.get(`account:${K.accountUuid}`),X,K.accountUuid);if(q)return G=q,L9(G,X,K.accountUuid),G;if(G.accountUuid===K.accountUuid)return G;return G={...G,accountIdentity:X,accountUuid:K.accountUuid},L9(G,X,K.accountUuid),G}let W=c1.get(Q);if(!W)W=Dq($,Z),L$(c1,Q,W);let V=await W.finally(()=>{if(c1.get(Q)===W)c1.delete(Q)});if(L$(hX,Q,{accountUuid:V,expiresAt:z+(V?Nq:Uq)}),!V)return G=L2(Y,G),G;if(!X)return G={...G,accountUuid:V},L$(N6,Q,G),G;let B=l1(N6.get(h4(V,X))??N6.get(`account:${V}`),X,V);if(B)return G=B,L9(G,X,V),G;return G={...G,accountIdentity:X,accountUuid:V},L9(G,X,V),G}class FJ extends Error{code="unsupported-access";constructor(){super("Claude OAuth access credential is not supported; sign in to this account again");this.name="ClaudeUnsupportedAccessError"}}async function Oq($,Z,J){if(typeof $!=="string"||!$.startsWith("sk-ant-oat"))throw new FJ;return X3($,Z,J)}function u0($){return $!=null&&typeof $==="object"&&!Array.isArray($)}function Mq($){if(!$.accountUuid)return null;return JSON.stringify({device_id:$.deviceId,account_uuid:$.accountUuid,session_id:$.sessionId})}function xR($,Z){let J=Mq(Z);if(!J){if(u0($.metadata))delete $.metadata.user_id;return!1}if(!u0($.metadata))$.metadata={};let X=$.metadata;if(u0(X))X.user_id=J;return!0}var Iq=["oauth-2025-04-20","interleaved-thinking-2025-05-14","thinking-token-count-2026-05-13","context-management-2025-06-27","prompt-caching-scope-2026-01-05","claude-code-20250219","advisor-tool-2026-03-01","advanced-tool-use-2025-11-20","mid-conversation-system-2026-04-07","effort-2025-11-24","fallback-credit-2026-06-01","extended-cache-ttl-2025-04-11","cache-diagnosis-2026-04-07"],_q=["oauth-2025-04-20","interleaved-thinking-2025-05-14","thinking-token-count-2026-05-13","context-management-2025-06-27","prompt-caching-scope-2026-01-05","advisor-tool-2026-03-01","structured-outputs-2025-12-15","cache-diagnosis-2026-04-07"],mX=["oauth-2025-04-20","interleaved-thinking-2025-05-14","thinking-token-count-2026-05-13","context-management-2025-06-27","prompt-caching-scope-2026-01-05","advisor-tool-2026-03-01","advanced-tool-use-2025-11-20","extended-cache-ttl-2025-04-11","cache-diagnosis-2026-04-07"];function Pq($){return $.output_config?.format?.type==="json_schema"}function Aq($){return Array.isArray($.tools)&&$.tools.length>0&&Array.isArray($.system)&&u0($.thinking)&&u0($.context_management)&&u0($.output_config)&&u0($.diagnostics)}function wq($,Z=[]){let J=$?Aq($)?[...Iq]:Pq($)?[..._q]:[...mX]:[...mX];if($?.speed==="fast")J.push(YB);for(let X of Z){let Y=X.trim();if(Y)J.push(Y)}return[...new Set(J)].join(",")}function Rq(){switch(process.platform){case"darwin":return"MacOS";case"win32":return"Windows";case"linux":return"Linux";case"freebsd":return"FreeBSD";default:return"Unknown"}}function Tq(){switch(process.arch){case"arm64":return"arm64";case"x64":return"x64";case"ia32":return"x32";default:return process.arch}}function DR($,Z,J={}){let X=J.identity??y4(Z),G=[...($.get("anthropic-beta")??"").split(",").map((z)=>z.trim()).filter(Boolean),...J.extraBetas??[]];return $.set("accept","application/json"),$.set("authorization",`Bearer ${Z}`),$.set("content-type","application/json"),$.set("user-agent",WB),$.set("anthropic-beta",wq(J.body,G)),$.set("anthropic-dangerous-direct-browser-access","true"),$.set("anthropic-version","2023-06-01"),$.set("x-app","cli"),$.set("x-client-request-id",J3()),$.set("x-claude-code-session-id",X.sessionId),$.set("x-stainless-arch",Tq()),$.set("x-stainless-lang","js"),$.set("x-stainless-os",Rq()),$.set("x-stainless-package-version",QB),$.set("x-stainless-retry-count","0"),$.set("x-stainless-runtime","node"),$.set("x-stainless-runtime-version",KB),$.set("x-stainless-timeout","600"),$.delete("x-api-key"),$}var Fq=["model","messages","system","tools","tool_choice","metadata","max_tokens","temperature","thinking","context_management","output_config","diagnostics","stream","speed"];function Cq($){let Z={};for(let J of Fq)if(Object.hasOwn($,J))Z[J]=$[J];for(let[J,X]of Object.entries($))if(!Object.hasOwn(Z,J))Z[J]=X;return Z}function u8($){try{return JSON.parse($)}catch(Z){if(Z instanceof SyntaxError)throw SyntaxError("invalid JSON");throw Z}}var Q7={error:0,warn:1,info:2,debug:3,trace:4},gq=new Set(Object.keys(Q7));function K7($){if(!$)return null;let Z=$.trim().toLowerCase();return gq.has(Z)?Z:null}var yq=K7(process.env.OPENCODE_ANTHROPIC_AUTH_LOG_LEVEL),CJ=yq??"info";function hq($){CJ=$}function mq(){return CJ}function SJ($){return Q7[$]<=Q7[CJ]}var U8=process.env.OPENCODE_ANTHROPIC_AUTH_LOG_FILE??Q3.join(z3.tmpdir(),"opencode-anthropic-auth.log");var uq=5242880,pX=3;function pq(){try{if(!O$.existsSync(U8))return;if(O$.statSync(U8).size<uq)return}catch{return}try{for(let $=pX;$>=1;$--){let Z=$===1?U8:`${U8}.${$-1}`,J=`${U8}.${$}`;try{if($===pX)try{O$.unlinkSync(J)}catch{}if(O$.existsSync(Z))O$.renameSync(Z,J)}catch{}}}catch{}}var cq=/^(authorization|x-api-key|cookie|set-cookie|refresh|access|token|handle)$/i;function K3($){if(cq.test($))return!0;let Z=$.toLowerCase().replace(/[-_]/g,"");if(Z.includes("apikey"))return!0;if(Z.endsWith("secret")||Z.endsWith("password"))return!0;if(Z.endsWith("token")&&!Z.endsWith("tokens"))return!0;return!1}var lq=[/Bearer\s+\S+/,/sk-[A-Za-z0-9-]+/,/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/,JB];function dq($){if(typeof $!=="string")return!1;return lq.some((Z)=>Z.test($))}function W3($){if($==null||Object.keys($).length===0)return;let Z=new WeakSet;function J(X){if(X==null||typeof X!=="object"){if(dq(X))return"***REDACTED***";return X}if(Z.has(X))return"[Circular]";Z.add(X);try{if(Array.isArray(X))return X.map(J);let Y=X,G={};for(let[z,Q]of Object.entries(Y)){if(K3(z)){G[z]="***REDACTED***";continue}G[z]=J(Q)}return G}finally{Z.delete(X)}}return J($)}function iq($,Z,J,X){let Y=new Date().toISOString(),G=$.toUpperCase().padEnd(5),z=Z?` [${Z}]`:"",Q=(()=>{try{let K=W3(X),W=K?{...K,pid:process.pid}:{pid:process.pid};return` ${JSON.stringify(W)}`}catch{return` {"pid":${process.pid},"payload":"[unserializable]"}`}})();return`[${Y}] ${G}${z} ${J}${Q}`}var cX=null;function b0($,Z,J,X){if(!SJ($))return;if(cX)try{cX({level:$,channel:Z,message:J,payload:W3(X)})}catch{}if(IZ)return;try{let Y=`${iq($,Z,J,X)}
-`;if(P9.push(Y),P9.length>=tq)kJ();else aq()}catch{}}var a={error($,Z,J){b0("error",$,Z,J)},warn($,Z,J){b0("warn",$,Z,J)},info($,Z,J){b0("info",$,Z,J)},debug($,Z,J){b0("debug",$,Z,J)},trace($,Z,J){b0("trace",$,Z,J)}},IZ=!1,sq=500,tq=50,P9=[],P8=null;function kJ(){if(P8)clearTimeout(P8),P8=null;if(P9.length===0)return;let $=P9.join("");P9=[];try{pq(),O$.appendFileSync(U8,$)}catch{}}function aq(){if(P8)return;P8=setTimeout(()=>{P8=null,kJ()},sq)}var nq=/^\[([\w-]+)\]\s*/;function PR($,Z){if(!SJ("debug"))return;if(IZ)return;try{let J="",X=$,Y=$.match(nq);if(Y)J=Y[1]??"",X=$.slice(Y[0].length);let G;if(Z!=null){if(Z instanceof Error)G={error:`${Z.message}${Z.stack?`
-${Z.stack}`:""}`};else if(typeof Z==="object")G=Z}b0("debug",J,X,G)}catch{}}function j6($,Z){if(!SJ("debug"))return;if(IZ)return;try{let J;if(Z!=null){if(typeof Z==="object"&&!(Z instanceof Error))J=Z}b0("debug","relay",$,J)}catch{}}if(!IZ)process.on("exit",kJ);var oq="## Claude Dump Status",rq="## Claude Dump Enabled",eq="## Claude Dump Disabled",$j="## Claude Dump Usage",Zj="Usage: `/claude-dump`, `/claude-dump on`, or `/claude-dump off`.",Jj="OPENCODE_ANTHROPIC_AUTH_DUMP_DIR",Xj="OPENCODE_ANTHROPIC_AUTH_DUMP_MAX_BYTES",Yj=MZ(bq(),"opencode-anthropic-auth-dumps"),Gj=536870912,zj=300000,Qj=60000,Kj=600000,vJ=/\.(body|meta|relay|request|response)\.json$/,V3=/^\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z-\d{5,}-(.+)$/,m4="[a-zA-Z0-9._-]",B3=new RegExp(`^${m4}{1,80}-direct(?:-${m4}{1,80})?$`),q3=new RegExp(`^${m4}{1,80}-(?:http|websocket)-p[12]-(?:full_sync|patch)$`),Wj=new RegExp(`^-direct(?:-${m4}{1,80})?$`),Vj=/^-(?:http|websocket)-p[12]-(?:full_sync|patch)$/,J1=!1,lX=0,dX=0,Bj=100,x8=new Map;function AR($){J1=$}function X1(){return process.env[Jj]||Yj}function qj(){let $=Number(process.env[Xj]);return Number.isFinite($)&&$>=0?Math.floor($):Gj}function jj($){return _9($)===_9(X1())}function W7($){let Z=$.replace(vJ,"");if(Z===$)return!1;let X=V3.exec(Z)?.[1];if(!X)return!1;return B3.test(X)||q3.test(X)}function Hj($){if(!$.endsWith(".partial"))return!1;let Z=$.slice(0,-8);if(W7(Z))return!0;let J=Z.lastIndexOf(".");if(J<0)return!1;let X=Z.slice(J+1);return/^[a-f0-9]{24}$/.test(X)&&W7(Z.slice(0,J))}async function N9($,Z){for(let J=0;J<2;J+=1){let X=kq(12).toString("hex"),Y=`${$}.${X}.partial`,G=!1;try{return await Eq(Y,Z,{encoding:"utf8",flag:"wx"}),G=!0,await fq(Y,$),!0}catch(z){if(z.code==="EEXIST")continue;if(G)await G3(Y).catch(()=>{});throw z}}return!1}async function Lj($){let Z=$.dumpDir??X1(),J=$.maxBytes??qj(),X=$.now??Date.now(),Y=$.minAgeMs??Qj,G=$.partialStaleMs??Kj,z={removed:0,freedBytes:0};if(!jj(Z)||J<=0)return z;try{if((await z7(Z)).isSymbolicLink())return z;let K=new Set(($.protectedPaths??[]).map((M)=>_9(M))),W=await Y3(Z,{withFileTypes:!0}),V=[];await Promise.all(W.map(async(M)=>{if(!M.isFile())return;let A=Hj(M.name);if(!A&&!W7(M.name))return;let _=MZ(Z,M.name);try{let N=await z7(_);if(!N.isFile()||N.isSymbolicLink())return;V.push({path:_,size:N.size,mtimeMs:N.mtimeMs,partial:A,...!A&&{artifactGroup:M.name.replace(vJ,"")}})}catch{}}));let B=V.reduce((M,A)=>M+A.size,0),q=0,H=0,j=async(M)=>{try{await G3(M.path),B-=M.size,H+=M.size,q+=1}catch{}},x=V.filter((M)=>M.partial).sort((M,A)=>M.mtimeMs-A.mtimeMs||M.path.localeCompare(A.path));for(let M of x){if(K.has(_9(M.path)))continue;if(X-M.mtimeMs<G)continue;await j(M)}let L=new Map;for(let M of V){if(M.partial||!M.artifactGroup)continue;let A=L.get(M.artifactGroup)??{files:[],newestMtimeMs:0};A.files.push(M),A.newestMtimeMs=Math.max(A.newestMtimeMs,M.mtimeMs),L.set(M.artifactGroup,A)}let U=[...L.entries()].sort(([M,A],[_,N])=>A.newestMtimeMs-N.newestMtimeMs||M.localeCompare(_));for(let[,M]of U){if(B<=J)break;if(X-M.newestMtimeMs<Y)continue;if(M.files.some((A)=>K.has(_9(A.path))))continue;for(let A of M.files)await j(A)}if(q>0)a.debug("dump","removed old dump files",{removed:q,freedBytes:H});return{removed:q,freedBytes:H}}catch{return z}}function Nj($,Z){let J=Date.now();if(J-dX<zj)return;dX=J,Lj({dumpDir:$,protectedPaths:Z}).catch(()=>{})}function Uj($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="on")return{type:"enable"};if(Z.length===1&&Z[0]==="off")return{type:"disable"};return{type:"usage"}}function d1($){let Z=$?.enabled??J1;return[oq,"",`- Enabled: ${Z?"enabled":"disabled"}`,`- Directory: ${X1()}`,"- Persisted: ~/.config/opencode/anthropic-auth.json","- Captures: final rewritten Anthropic body in direct and relay modes; request/relay metadata is redacted","- Warning: body dumps may contain prompt/session content; turn this off after debugging"].join(`
-`)}function wR($){let Z=Uj($.argumentsText),J=$.enabled??J1;if(Z.type==="status")return d1({enabled:J});if(Z.type==="enable")return[rq,"",d1({enabled:!0})].join(`
-`);if(Z.type==="disable")return[eq,"",d1({enabled:!1})].join(`
-`);return[$j,"",Zj,"",d1({enabled:J})].join(`
-`)}function q4($){return $.length<=16?$:`${$.slice(0,12)}…`}function u4($,Z=80){let J=$.trim().replace(/[^a-zA-Z0-9._-]+/g,"-").replace(/^-+|-+$/g,"");if(!J)return"session-unknown";return J.length<=Z?J:J.slice(0,Z)}function xj($){if($.transport!=="direct")return`${$.transport}-p${$.protocol}-${$.mode}`;return`direct${$.route?`-${u4($.route)}`:""}`}function j3($){if($==="cachekeep")return"-prewarm-cachekeep";if($==="start")return"-start";return""}function Dj($){let Z=$.affinity?.trim();if(Z)return`session:${Z}`;return`request:${$.route??"direct"}:${$.url??""}`}function Oj($,Z){if(!$.endsWith(".body.json"))return;let J=$.replace(vJ,""),X=V3.exec(J)?.[1];if(!X||!B3.test(X)&&!q3.test(X))return;let Y=j3("cachekeep"),G=[{prefix:u4(Z),tag:null},{prefix:`${u4(Z,80-Y.length)}${Y}`,tag:"cachekeep"}];for(let z of G){if(!X.startsWith(`${z.prefix}-`))continue;let Q=X.slice(z.prefix.length);if(Wj.test(Q)||Vj.test(Q))return z.tag}return}async function Mj($){let Z=$.affinity?.trim();if(!Z)return;let J=X1(),X;try{X=await Y3(J)}catch{return}let Y=X.map((G)=>({name:G,tag:Oj(G,Z)})).filter((G)=>G.tag!==void 0).sort((G,z)=>z.name.localeCompare(G.name));for(let G of Y)try{let z=MZ(J,G.name),Q=z.replace(/\.body\.json$/,".meta.json");if(!(await z7(z)).isFile())continue;let K=JSON.parse(await uX(Q,"utf8"));if(K.session!==q4(Z)||(G.tag===null?K.tag!=null:K.tag!==G.tag))continue;return await uX(z,"utf8")}catch{}return}function Ij($,Z){if(!x8.has($))while(x8.size>=Bj){let J=x8.keys().next().value;if(J===void 0)break;x8.delete(J)}x8.set($,Z)}function _j($){if($==null)return;return Object.fromEntries(new Headers($).entries())}function H3($){return Sq("sha256").update($).digest("hex")}function Pj($){return Wq($)}function Aj($,Z){if($==null)return null;if($===Z)return{changed:!1,firstByte:-1,lastPreviousByte:-1,lastCurrentByte:-1,previousBytes:$.length,currentBytes:Z.length};let J=0;while(J<$.length&&J<Z.length&&$[J]===Z[J])J+=1;let X=$.length-1,Y=Z.length-1;while(X>=J&&Y>=J&&$[X]===Z[Y])X-=1,Y-=1;return{changed:!0,firstByte:J,lastPreviousByte:X,lastCurrentByte:Y,changedPreviousBytes:X-J+1,changedCurrentBytes:Y-J+1,previousBytes:$.length,currentBytes:Z.length}}function wj($){try{let Z=u8($);return Z!=null&&typeof Z==="object"&&!Array.isArray(Z)?Z:null}catch{return j6("dump body parse failed"),null}}function N2($){return H3(JSON.stringify($))}function Rj($){let Z=wj($);if(!Z)return{parseable:!1};let J=Array.isArray(Z.messages)?Z.messages:[],X=Array.isArray(Z.system)?Z.system:[],Y=J[0],G=J.slice(1);return{parseable:!0,model:typeof Z.model==="string"?Z.model:void 0,stream:Z.stream,systemCount:X.length,messagesCount:J.length,systemHash:N2(X),message0Hash:Y===void 0?null:N2(Y),message0Bytes:Y===void 0?0:JSON.stringify(Y).length,messagesAfter0Hash:N2(G),messagesAfter0Bytes:JSON.stringify(G).length,cch:Pj($)}}function p4($){if(Array.isArray($))return $.map(p4);if($==null||typeof $!=="object")return $;let Z={};for(let[J,X]of Object.entries($)){let Y=J.toLowerCase();if(Y==="authorization"||Y==="x-api-key"||Y==="cookie"||Y==="set-cookie"||K3(J)){Z[J]="[redacted]";continue}Z[J]=p4(X)}return Z}async function L3($){if(!J1)return null;lX+=1;let Z=$.affinity?.trim()||"session-unknown",J=j3($.tag),X=`${new Date().toISOString().replace(/[:.]/g,"-")}-${String(lX).padStart(6,"0")}-${u4(Z,80-J.length)}${J}-${xj($)}`,Y=X1(),G=MZ(Y,X),z={body:`${G}.body.json`,metadata:`${G}.meta.json`,response:`${G}.response.json`};if($.payload!==void 0)z.relay=`${G}.relay.json`;if($.request!==void 0)z.request=`${G}.request.json`;try{await vq(Y,{recursive:!0});let Q=$.previousBodyText??await Mj($),K={id:X,createdAt:new Date().toISOString(),session:q4(Z),transport:$.transport,protocol:$.protocol,mode:$.mode,route:$.route,status:$.status,error:$.error,tag:$.tag,bodyBytes:$.bodyText.length,relayBytes:$.relayBytes,bodyHash:H3($.bodyText),diff:Aj(Q,$.bodyText),body:Rj($.bodyText),files:z},W=[N9(z.body,$.bodyText),N9(z.metadata,`${JSON.stringify(K,null,2)}
-`)];if($.payload!==void 0&&z.relay)W.push(N9(z.relay,`${JSON.stringify(p4($.payload),null,2)}
-`));if($.request!==void 0&&z.request)W.push(N9(z.request,`${JSON.stringify(p4({...$.request,headers:_j($.request.headers)}),null,2)}
-`));await Promise.all(W),Nj(Y,Object.values(z)),j6(`dumped request id=${X} session=${q4(Z)} body=${z.body} meta=${z.metadata}`)}catch{return j6(`dump failed session=${q4(Z)}`),null}return{responsePath:z.response,...$.tag?{tag:$.tag}:{}}}async function Tj($){if(!J1)return null;let Z=Dj($),J=x8.get(Z),X=await L3({affinity:$.affinity,transport:"direct",route:$.route,status:$.status,error:$.error,bodyText:$.bodyText,previousBodyText:J,request:{url:$.url,method:$.method,headers:$.headers},tag:$.tag});return Ij(Z,$.bodyText),X}async function Fj($){return L3({affinity:$.affinity,transport:$.transport,protocol:$.protocol,mode:$.mode,status:$.status,bodyText:$.bodyText,previousBodyText:$.previousBodyText,payload:$.payload,relayBytes:$.relayBytes,tag:$.tag})}async function Cj($,Z){if(!$)return;let J=Z.message!=null&&typeof Z.message==="object"&&!Array.isArray(Z.message)?Z.message:{},X={status:Z.status,stream_complete:Z.complete??!0};if(typeof J.id==="string"&&J.id.length>0)X.message_id=J.id;if(typeof J.model==="string"&&J.model.length>0)X.model=J.model;if(Object.hasOwn(J,"usage"))X.usage=J.usage;if(Object.hasOwn(J,"diagnostics"))X.diagnostics=J.diagnostics;if(typeof J.stop_reason==="string"&&J.stop_reason.length>0)X.stop_reason=J.stop_reason;try{await N9($.responsePath,`${JSON.stringify(X,null,2)}
-`)}catch{j6(`dump response failed status=${Z.status}`)}}var j4=8388608,A8=10,A9=13;class w8 extends Error{code="SSE_FRAME_TOO_LARGE";maxFrameBytes;constructor($){super(`SSE frame exceeded ${$} bytes without a terminator`);this.name="SseFrameTooLargeError",this.maxFrameBytes=$}}function Sj($){if($===void 0)return j4;if($===null||typeof $!=="object"||fJ.isProxy($))throw TypeError("SSE framer options must be an object");let Z=Object.getOwnPropertyDescriptor($,"maxFrameBytes");if(Z===void 0)return j4;if(!("value"in Z))throw TypeError("SSE framer maxFrameBytes must be a data property");let J=Z.value;if(J===void 0)return j4;if(typeof J!=="number"||!Number.isSafeInteger(J)||J<1)throw TypeError("SSE framer maxFrameBytes must be a positive integer");return J}function kj($){let Z=Sj($),J=new Uint8Array(0),X=0,Y=!0,G=!1,z=!1,Q=!1,K=()=>{throw Q=!0,J=new Uint8Array(0),X=0,new w8(Z)},W=(q,H)=>{let j=(H?X:0)+q.length;if(j>Z)K();if(J.length<j){let x=new Uint8Array(Math.min(Z,Math.max(j,J.length*2,1024)));if(H)x.set(J.subarray(0,X),0);J=x}J.set(q,H?X:0),X=j};return Object.freeze({push:(q)=>{if(Q)throw new w8(Z);if(!fJ.isUint8Array(q))throw TypeError("SSE framer input must be a Uint8Array");let H=q.length;if(H===0)return[];let j=[],x=0,L=0,U=Y?0:-1,M=(N)=>{if(X>0){let R=X+N;if(R>Z)K();let S=new Uint8Array(R);S.set(J.subarray(0,X),0),S.set(q.subarray(0,N),X),X=0,j.push(S)}else{if(N-x>Z)K();j.push(q.subarray(x,N))}x=N};if(G){if(G=!1,q[0]===A8)L=1;if(z)z=!1,M(L);U=L}let A=-2,_=-2;while(L<H){if(A!==-1&&A<L)A=q.indexOf(A8,L);if(_!==-1&&_<L)_=q.indexOf(A9,L);let N;if(A===-1)N=_;else if(_===-1)N=A;else N=Math.min(A,_);if(N===-1)break;let R=N+1;if(q[N]===A9){if(R===H){G=!0,z=N===U,U=H;break}if(q[R]===A8)R+=1}if(N===U)M(R);U=R,L=R}if(x<H)W(q.subarray(x,H),X>0),Y=U===H;else Y=!0;return j},finish:()=>{if(Q)throw new w8(Z);let q=X>0?J.slice(0,X):void 0;return J=new Uint8Array(0),X=0,Y=!0,G=!1,z=!1,q},get bufferedBytes(){return X}})}var vj=new TextDecoder("utf-8",{ignoreBOM:!0}),fj=65279;function Ej($){if($===null||typeof $!=="object"||fJ.isProxy($))return!1;let Z=Object.getOwnPropertyDescriptor($,"streamStart");return Z!==void 0&&"value"in Z&&Z.value===!0}function _Z($,Z){let J=vj.decode($);return J.charCodeAt(0)===fj&&Ej(Z)?J.slice(1):J}function bj($){let Z=typeof $==="string"?$:_Z($),J={},X;for(let Y of Z.split(/\r\n|\r|\n/)){if(Y===""||Y.charCodeAt(0)===58)continue;let G=Y.indexOf(":"),z=G===-1?Y:Y.slice(0,G),Q=G===-1?"":Y.slice(G+1);if(Q.charCodeAt(0)===32)Q=Q.slice(1);switch(z){case"event":J.event=Q;break;case"data":if(X)X.push(Q);else X=[Q];break;case"id":if(!Q.includes("\x00"))J.id=Q;break;case"retry":if(/^[0-9]+$/.test(Q))J.retry=Number(Q);break}}if(X)J.data=X.join(`
-`);return J}function gj($){let Z=$.length;if(Z===0)return!1;let J=$[Z-1];if(J!==A8&&J!==A9)return!1;let X=Z-1;if(J===A8&&X>0&&$[X-1]===A9)X-=1;if(X===0)return!0;let Y=$[X-1];return Y===A8||Y===A9}var yj=Buffer.from("error"),hj=Buffer.from("\\u");function mj($){let Z=Buffer.from($.buffer,$.byteOffset,$.byteLength);return Z.indexOf(yj)!==-1||Z.indexOf(hj)!==-1}var r0="[REDACTED]",f8="Provider error details were withheld because the request attempt has ended",N3="Provider error body exceeded the redaction size limit and was withheld",EJ=1048576,uj=j4,U3=32,pj=2000,bJ=1000,cj=/\bBearer\s+([A-Za-z0-9._~+/=-]{16,})/gi,lj=/(?<![A-Za-z0-9_-])sk-[A-Za-z0-9_-]{16,}/g,V7=/\\(?:u([0-9a-fA-F]{4})|(["\\/bfnrt]))/g,dj={'"':'"',"\\":"\\","/":"/",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t"},ij=new Set(["api_error","authentication_error","billing_error","invalid_request_error","not_found_error","overloaded_error","permission_error","rate_limit_error","relay_upstream_error","request_too_large","timeout_error"]),c4=new TextEncoder;function B0($,Z){$.onTerminal?.(Z)}function gJ($){if(!Array.isArray($)||J8.isProxy($))throw TypeError("Provider error redactor secrets must be an array");let J=Object.getOwnPropertyDescriptor($,"length")?.value;if(typeof J!=="number")throw TypeError("Provider error redactor secrets must be an array");let X=new Set;for(let Y=0;Y<J;Y+=1){let G=Object.getOwnPropertyDescriptor($,String(Y));if(G===void 0||!("value"in G))throw TypeError(`Provider error redactor secret ${Y} must be a data property`);let z=G.value;if(typeof z!=="string")throw TypeError(`Provider error redactor secret ${Y} must be a string`);if(z!=="")X.add(z)}return[...X].sort((Y,G)=>G.length-Y.length)}var iX=46;function x3($){return $>=48&&$<=57||$>=65&&$<=90||$>=97&&$<=122||$===95}function U2($,Z){let J=Z;for(;J<$.length;J+=1){let X=$.charCodeAt(J);if(!x3(X)&&X!==45)break}return J}function sj($,Z){let J=$.indexOf("eyJ");while(J!==-1){let X=U2($,J),Y=J;while(Y!==-1&&Y<X&&!(Y+3<X&&(Y===0||!x3($.charCodeAt(Y-1)))))Y=$.indexOf("eyJ",Y+1);if(Y===-1)return;if(Y>=X){J=Y;continue}let G=X;if($.charCodeAt(X)===iX){let z=U2($,X+1);if(z>X+1&&$.charCodeAt(z)===iX){let Q=U2($,z+1);if(Q>z+1)Z.push(Y,Q),G=Q}}J=$.indexOf("eyJ",G)}}function sX($,Z,J){Z.lastIndex=0;for(let X=Z.exec($);X!==null;X=Z.exec($)){let Y=X.index+X[0].length,G=X[1];J.push(G===void 0?X.index:Y-G.length,Y)}}function tX($,Z,J){for(let X of Z)for(let Y=$.indexOf(X);Y!==-1;Y=$.indexOf(X,Y+X.length))J.push(Y,Y+X.length);sX($,cj,J),sX($,lj,J),sj($,J)}function tj($,Z,J){if(Z!==void 0)return String.fromCharCode(Number.parseInt(Z,16));return J===void 0?"":dj[J]??J}function aj($,Z){let J=[...Z.keys()].sort((Q,K)=>(Z[Q]??0)-(Z[K]??0)),X=Array(Z.length).fill($.length),Y=0,G=0,z=0;V7.lastIndex=0;for(;;){let Q=V7.exec($),K=Q?Q.index:$.length;for(;Y<J.length;Y+=1){let W=J[Y]??0,V=Z[W]??0;if(V>z+(K-G))break;X[W]=G+(V-z)}if(!Q||Y===J.length)return X;z+=K-G+1,G=Q.index+Q[0].length}}function nj($,Z){let J=[];for(let Q=0;Q+1<Z.length;Q+=2)J.push([Z[Q]??0,Z[Q+1]??0]);J.sort((Q,K)=>Q[0]-K[0]||K[1]-Q[1]);let X="",Y=0,G=-1,z=-1;for(let[Q,K]of J){if(G!==-1&&Q<z){z=Math.max(z,K);continue}if(G!==-1)X+=$.slice(Y,G)+r0,Y=z;G=Q,z=K}if(G!==-1)X+=$.slice(Y,G)+r0,Y=z;return X+$.slice(Y)}function _6($,Z){let J=[];if(tX($,Z,J),$.includes("\\")){let X=$.replace(V7,tj);if(X!==$){let Y=[];tX(X,Z,Y);for(let G of aj($,Y))J.push(G)}}if(J.length===0)return $;return nj($,J)}function w0($,Z){let J=Object.getOwnPropertyDescriptor($,Z)?.get;if(typeof J!=="function")throw Error(`Platform accessor ${Z} is unavailable`);return J}var D3=w0(Response.prototype,"status"),O3=w0(Response.prototype,"statusText"),oj=w0(Response.prototype,"ok"),M3=w0(Response.prototype,"headers"),rj=w0(Response.prototype,"body"),ej=w0(Response.prototype,"url"),I3=Headers.prototype.forEach,$H=w0(DOMException.prototype,"name"),ZH=w0(DOMException.prototype,"message");function U$($,Z){return Reflect.apply($,Z,[])}function B7($){try{return $()}catch(Z){if(Z instanceof TypeError)return;throw Z}}function JH($){let Z=[];return Reflect.apply(I3,$,[(J,X)=>{if(typeof X==="string"&&typeof J==="string")Z.push([X,J])}]),Z}function XH($){return $ instanceof ReadableStream}function _3($){if($===null||typeof $!=="object"||J8.isProxy($))return;let Z=B7(()=>U$(D3,$));if(typeof Z!=="number")return;let J=U$(O3,$),X=U$(oj,$),Y=U$(ej,$);if(typeof J!=="string"||typeof X!=="boolean"||typeof Y!=="string")throw TypeError("Response slots could not be read");return{status:Z,statusText:J,ok:X,headers:JH(U$(M3,$)),url:Y,body(){let G=U$(rj,$);if(G===null||XH(G))return G;throw TypeError("Response body slot could not be read")}}}function YH($,Z){if(Object.getPrototypeOf($)!==Z)return!1;return Reflect.ownKeys($).every((J)=>!(J in Z))}function GH($){for(let[Z,J]of $)if(Z.toLowerCase()==="content-type")return J;return""}function q7($,Z,J=0){if(typeof $==="string")return _6($,Z);if($===null||typeof $!=="object")return w9($,Z)?$:r0;if(J>=U3)return r0;if(Array.isArray($)){let z;for(let Q=0;Q<$.length;Q+=1){let K=$[Q],W=q7(K,Z,J+1);if(W!==K)z??=$.slice(),z[Q]=W}return z??$}if(!l4($))return $;let X=!1,Y=[];for(let z of Object.keys($)){let Q=$[z],K=_6(z,Z),W=q7(Q,Z,J+1);if(K!==z||W!==Q)X=!0;Y.push([K,W])}if(!X)return $;let G={};for(let[z,Q]of Y)Object.defineProperty(G,z,{value:Q,enumerable:!0,writable:!0,configurable:!0});return G}function w9($,Z){let J=JSON.stringify($);return typeof J!=="string"||_6(J,Z)===J}function l4($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function zH($){if(!l4($))return!1;return $.type==="error"||Object.hasOwn($,"error")}function PZ($){if(!l4($))return;let Z=$.error;if(!l4(Z))return;let J=Z.type;return typeof J==="string"&&ij.has(J)?J:void 0}function Y1($,Z){return JSON.stringify({type:"error",error:Z===void 0?{message:$}:{type:Z,message:$}})}function yJ($){try{return{ok:!0,value:JSON.parse($)}}catch{return}}function P3($,Z){let J=_6($,Z);if(J===$)return $;let X=yJ($);if(!X)return J;let Y=JSON.stringify(q7(X.value,Z));return _6(Y,Z)===Y?Y:Y1(d4,PZ(X.value))}var QH=[["name","text"],["message","text"],["type","text"],["status","status"],["statusCode","status"],["code","code"],["retryAfter","retry"],["isRetryable","boolean"],["request_id","requestId"],["requestID","requestId"],["syscall","syscall"],["closeCode","closeCode"],["wasClean","boolean"],["error","nested"],["cause","nested"],["response","nested"],["headers","headers"],["responseHeaders","headers"],["errors","list"]],KH=new Set(["websocket","anthropic-sse"]),WH=[Symbol.for("vercel.ai.error"),Symbol.for("vercel.ai.error.AI_APICallError")],VH=new Map([["Error",Error],["TypeError",TypeError],["RangeError",RangeError],["SyntaxError",SyntaxError],["ReferenceError",ReferenceError],["EvalError",EvalError],["URIError",URIError]]),BH=/^[A-Za-z0-9_-]{1,128}$/,qH=64,aX="Provider error details exceeded the redaction size limit and were withheld",jH=24;function t6($,Z){if(Z>$.bytes)return!1;return $.bytes-=Z,!0}function A3($){return typeof $==="string"||typeof $==="object"&&$?0:jH}function w3($,Z,J){if(!t6($,Z))return!1;let X=J()-Z;return X<=0||t6($,X)}function hJ($,Z){if($.length>Z.bytes)return;let J=_6($,Z.secrets);return w3(Z,$.length,()=>y9.byteLength(J,"utf8"))?J:void 0}function R9($,Z){let J=hJ($,Z);if(J!==void 0)return J;return t6(Z,aX.length)?aX:void 0}function R3($){let Z=$;for(let J=0;Z!==null;J+=1){if(J>qH||J8.isProxy(Z))return!1;Z=Object.getPrototypeOf(Z)}return!0}function _0($,Z){let J=Object.getOwnPropertyDescriptor($,Z);return J!==void 0&&"value"in J?J.value:void 0}function HH($){for(let Z=$;Z!==null;Z=Object.getPrototypeOf(Z)){let J=Object.getOwnPropertyDescriptor(Z,"name");if(J!==void 0)return"value"in J?J.value:void 0}return}function mJ($,Z,J){Object.defineProperty($,Z,{value:J,enumerable:!0,writable:!0,configurable:!0})}function p0($,Z,J,X){let Y=typeof Z==="string"?Z.length:0;if(J!==void 0&&t6(X,Y+A3(J)))mJ($,Z,J)}function T3($){return Number.isInteger($)&&Number($)>=0&&Number($)<=999}function F3($,Z,J,X){let Y=Z.length+J.length;if(Y>X.bytes)return;if(_6(Z,X.secrets)!==Z){t6(X,Y);return}let G=_6(J,X.secrets);if(w3(X,Y,()=>y9.byteLength(Z,"utf8")+y9.byteLength(G,"utf8")))mJ($,Z,G)}var nX=Object.freeze({});function C3($,Z){let J={},X=0;try{Reflect.apply(I3,$,[(Y,G)=>{if(X>=bJ||Z.bytes===0)throw nX;if(X+=1,typeof G==="string"&&typeof Y==="string")F3(J,G,Y,Z)}])}catch(Y){if(Y===nX)return J;if(Y instanceof TypeError)return;throw Y}return J}function LH($,Z){if($===null||typeof $!=="object"||!R3($))return;let J=C3($,Z);if(J)return J;let X=Reflect.ownKeys($);if(X.length>bJ)return;let Y={};for(let G of X){let z=typeof G==="string"?_0($,G):void 0;if(typeof G==="string"&&typeof z==="string")F3(Y,G,z,Z)}return Y}function oX($,Z,J,X){switch($){case"text":return typeof Z==="string"?R9(Z,J):void 0;case"status":return T3(Z)&&w9(Z,J.secrets)?Z:void 0;case"code":case"retry":if(typeof Z==="string")return hJ(Z,J);return Number.isFinite(Z)&&w9(Z,J.secrets)?Z:void 0;case"boolean":return typeof Z==="boolean"?Z:void 0;case"syscall":return typeof Z==="string"&&KH.has(Z)&&t6(J,Z.length)?Z:void 0;case"closeCode":return Number.isInteger(Z)&&Number(Z)>=1000&&Number(Z)<=4999&&w9(Z,J.secrets)?Z:void 0;case"requestId":return typeof Z==="string"&&BH.test(Z)&&_6(Z,J.secrets)===Z&&t6(J,Z.length)?Z:void 0;case"nested":return Z===void 0?void 0:h9(Z,J,X);case"headers":return LH(Z,J);case"list":return Array.isArray(Z)?h9(Z,J,X):void 0}}var NH=128;function UH($,Z){if($==="nested"||$==="headers"||$==="list")return!1;return typeof Z!=="string"||Z.length<=NH}function S3($,Z,J,X,Y,G){for(let Q of WH)if(_0($,Q)===!0)p0(Z,Q,!0,J);let z=[];for(let[Q,K]of QH){if(Y.has(Q))continue;let W=_0($,Q);if(!UH(K,W))z.push([Q,K,W]);else p0(Z,Q,oX(K,W,J,X+1),J)}G?.();for(let[Q,K,W]of z)p0(Z,Q,oX(K,W,J,X+1),J)}var xH=new Set(["message"]),DH=new Set(["message","errors"]),OH=new Set,k3=12;function v3($,Z,J,X){if(J===void 0){Reflect.deleteProperty($,"stack");return}let Y=y9.byteLength(Z,"utf8"),G=J===""?0:2+y9.byteLength(J,"utf8"),z="";if(t6(X,Y+G))z=J===""?Z:`${Z}: ${J}`;else if(t6(X,Y))z=Z;Object.defineProperty($,"stack",{value:z,writable:!0,enumerable:!1,configurable:!0})}function MH($,Z,J){let X=HH($),Y=X==="AggregateError",G=typeof X==="string"?VH.get(X):void 0,z=t6(Z,k3+(Y?6:0)),Q=Y?AggregateError([]):new(G??Error);if(Y&&!z)Reflect.deleteProperty(Q,"errors");if(Z.memo.set($,Q),S3($,Q,Z,J,Y?DH:xH,()=>{let W=_0($,"message"),V=!z?void 0:typeof W==="string"?R9(W,Z)??"":"";if(V!==void 0)Object.defineProperty(Q,"message",{value:V,writable:!0,enumerable:!1,configurable:!0});v3(Q,Y?"AggregateError":G&&typeof X==="string"?X:"Error",V,Z)}),Y&&z){let W=_0($,"errors"),V=Array.isArray(W)?h9(W,Z,J+1):void 0;Object.defineProperty(Q,"errors",{value:Array.isArray(V)?V:[],writable:!0,configurable:!0})}return Q}function IH($,Z,J){let X=_0($,"length");if(typeof X!=="number"||X>bJ)return H4(Z);let Y=[];Z.memo.set($,Y);for(let G=0;G<X;G+=1){let z=_0($,String(G));if(!t6(Z,1))break;let Q=h9(z,Z,J+1);if(!t6(Z,A3(Q)))break;Y.push(Q)}return Y}function H4($){return t6($,r0.length)?r0:void 0}function h9($,Z,J){if(typeof $==="string")return R9($,Z)??"";if(typeof $==="symbol"||typeof $==="function")return H4(Z);if($===null||typeof $!=="object")return $;if(Z.memo.has($))return Z.memo.get($);if(!R3($))return H4(Z);if(Z.budget-=1,Z.budget<0||J>=U3)return H4(Z);let X=B7(()=>U$(D3,$));if(typeof X==="number"){let z=U$(O3,$);if(typeof z!=="string")throw TypeError("Response slots could not be read");let Q={};Z.memo.set($,Q),p0(Q,"status",X,Z),p0(Q,"statusText",hJ(z,Z)??"",Z);let K=U$(M3,$);return p0(Q,"headers",C3(K,Z)??{},Z),Q}let Y=B7(()=>U$(ZH,$));if(typeof Y==="string"){let z=t6(Z,k3)?R9(Y,Z)??"":void 0,Q=Error(z);v3(Q,"Error",z,Z);let K=U$($H,$);if(typeof K==="string")p0(Q,"name",R9(K,Z),Z);return Z.memo.set($,Q),Q}if(J8.isNativeError($))return MH($,Z,J);if(Array.isArray($))return IH($,Z,J);let G={};return Z.memo.set($,G),S3($,G,Z,J,OH),G}function x2($,Z){let J=Error(Z);try{if($!==null&&typeof $==="object"&&!J8.isProxy($)){let X=_0($,"status");if(T3(X))mJ(J,"status",X)}}catch{}return J}var d4="Provider error could not be inspected safely";function G1($,Z){let J=Z.secrets,X=$!==null&&typeof $==="object"||typeof $==="function"||typeof $==="symbol";if(J===null){if(typeof $==="string")return f8;return X?x2($,f8):$}try{let Y=h9($,{secrets:J,memo:new Map,budget:pj,bytes:EJ},0);return X&&Y===r0?x2(void 0,d4):Y}catch{return x2(void 0,d4)}}function _H($,Z){let J=_Z($,{streamStart:!0}),X=Z.secrets;if(X===null)return c4.encode(Y1(f8,PZ(yJ(J)?.value)));let Y=P3(J,X);return Y===J?$:c4.encode(Y)}function PH($,Z){if($.length===1&&$[0])return $[0];let J=new Uint8Array(Z),X=0;for(let Y of $)J.set(Y,X),X+=Y.byteLength;return J}function D2($,Z,J){try{if(Z)$.enqueue(Z);if(J)$.close()}catch{}}function f3($,Z){return $.cancel(Z).then(()=>{return},()=>{throw Error(f8)})}var E3=new WeakSet;class b3 extends Error{constructor(){super(N3);this.name="ProviderErrorSourceOversizedError",E3.add(this)}}function AH($){return typeof $==="object"&&$!==null&&E3.has($)}function rX(){return c4.encode(Y1(N3))}function wH($,Z){Z.wrappedBodies+=1;let J=()=>$.getReader(),X;return new ReadableStream({async pull(Y){let G=[],z=0,Q,K;try{Q=J(),X=Q;for(;;){let{done:W,value:V}=await Q.read();if(W)break;if(!J8.isUint8Array(V))throw TypeError("Provider error body chunk must be bytes");if(V.byteLength===0)continue;if(z+=V.byteLength,z>EJ){D2(Y,rX(),!0),B0(Z,"eof"),await Q.cancel().catch(()=>{});return}G.push(V)}K=_H(PH(G,z),Z)}catch(W){if(AH(W)){if(D2(Y,rX(),!0),B0(Z,"eof"),Q)await Q.cancel().catch(()=>{});return}let V=G1(W,Z);B0(Z,"error");try{Y.error(V)}catch{}if(Q)await Q.cancel(V).catch(()=>{});return}D2(Y,K,!0),B0(Z,"eof")},cancel(Y){return B0(Z,"cancel"),f3(X??$,Y)}},{highWaterMark:0})}function RH($){let Z=/\r\n|\r|\n/.exec($);return Z?Z[0]:`
-`}function j7($,Z,J){let X=[];if(J.event!==void 0)X.push(`event: ${J.event}`);if(J.id!==void 0)X.push(`id: ${J.id}`);if(J.retry!==void 0)X.push(`retry: ${J.retry}`);if(J.data!==void 0)for(let Y of J.data.split(/\r\n|\r|\n/))X.push(`data: ${Y}`);return TH($,Z,X)}function TH($,Z,J){let X=RH(Z),Y="";if(gj($))Y=X+X;else if(/[\r\n]$/.test(Z))Y=X;return c4.encode(J.join(X)+Y)}function FH($,Z,J){if(!mj($))return $;let X=_Z($,{streamStart:J}),Y=bj(X),G=Y.data===void 0?void 0:yJ(Y.data);if(!(Y.event==="error"||G!==void 0&&zH(G.value)))return $;let Q=Z.secrets,K=Q===null?j7($,X,{event:Y.event===void 0?void 0:"error",data:Y.data===void 0?void 0:Y1(f8,PZ(G?.value))}):_6(X,Q)===X&&(Y.data===void 0||_6(Y.data,Q)===Y.data)?$:j7($,X,{event:Y.event===void 0?void 0:_6(Y.event,Q),id:Y.id===void 0?void 0:_6(Y.id,Q),retry:Y.retry!==void 0&&Number.isSafeInteger(Y.retry)&&w9(Y.retry,Q)?Y.retry:void 0,data:Y.data===void 0?void 0:P3(Y.data,Q)}),W=K===$||Q===null?K:CH(K,$,X,Y,G,Q);if(W===$||!J||!SH($))return W;let V=new Uint8Array(R8.length+W.length);return V.set(R8,0),V.set(W,R8.length),V}function CH($,Z,J,X,Y,G){let z=_Z($);if(_6(z,G)===z)return $;return j7(Z,J,{event:X.event===void 0?void 0:"error",data:X.data===void 0?void 0:Y1(d4,PZ(Y?.value))})}var R8=Uint8Array.of(239,187,191);function SH($){return $[0]===R8[0]&&$[1]===R8[1]&&$[2]===R8[2]}function kH($,Z){Z.wrappedBodies+=1;let J=g3(Z),X=()=>$.getReader(),Y,G=(z,Q)=>{for(let K of Q)z.enqueue(K)};return new ReadableStream({async pull(z){let Q=Y,K=!1;try{Q??=X(),Y=Q;for(;;){let{done:W,value:V}=await Q.read();if(W){K=!0;let q=J.finish();K=!1,G(z,q),z.close(),B0(Z,"eof");return}if(!J8.isUint8Array(V))throw TypeError("Provider event-stream chunk must be bytes");K=!0;let B=J.push(V);if(K=!1,B.length>0){G(z,B);return}}}catch(W){let V=K&&W instanceof w8?W:G1(W,Z);B0(Z,"error");try{z.error(V)}catch{}if(Q)await Q.cancel(V).catch(()=>{})}},cancel(z){return B0(Z,"cancel"),f3(Y??$,z)}},{highWaterMark:0})}function g3($){let Z=kj({maxFrameBytes:uj}),J=!0,X=(Y)=>{let G=[],z;for(let Q of Y){let K=FH(Q,$,J);if(J=!1,K===Q&&z!==void 0&&z.buffer===Q.buffer&&z.byteOffset+z.byteLength===Q.byteOffset){z=new Uint8Array(z.buffer,z.byteOffset,z.byteLength+Q.byteLength);continue}if(z)G.push(z);if(z=void 0,K===Q)z=Q;else G.push(K)}if(z)G.push(z);return G};return{push:(Y)=>X(Z.push(Y)),finish:()=>{let Y=Z.finish();return Y?X([Y]):[]}}}var vH="Provider error stream scope is closed";function fH($){let Z={secrets:gJ($),wrappedBodies:0},J=g3(Z),X=()=>{Z.secrets=null,J=null},Y=()=>{if(J===null)throw Error(vH);return J};return Object.freeze({push(G){let z=Y();try{return z.push(G)}catch(Q){throw X(),Q}},finish(){let G=Y();try{return G.finish()}finally{X()}},redactError(G){return G1(G,Z)},dispose:X})}var EH=new Set([101,103,204,205,304]),m$="anthropic-ratelimit-unified-",bH=new Set(["allowed","allowed_warning","rejected"]),gH=new Set(["five_hour","seven_day","seven_day_opus","seven_day_sonnet","overage"]),yH=new Set(["available","unavailable"]),hH=/^[0-9]{1,15}(\.[0-9]{1,15})?$/,mH=/^[0-9]{1,10}$/,uH=/^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), [0-9]{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) [0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} GMT$/,pH=($)=>mH.test($)||uH.test($),O2=($)=>bH.has($),i1=($)=>hH.test($),cH=new Map([["retry-after",pH],["x-should-retry",($)=>$==="true"||$==="false"],[`${m$}status`,O2],[`${m$}representative-claim`,($)=>gH.has($)],[`${m$}fallback`,($)=>yH.has($)],[`${m$}5h-status`,O2],[`${m$}5h-utilization`,i1],[`${m$}5h-reset`,i1],[`${m$}7d-status`,O2],[`${m$}7d-utilization`,i1],[`${m$}7d-reset`,i1]]);function lH($,Z){return cH.get($.toLowerCase())?.(Z)===!0}function M2($,Z,J){let X=new Headers;for(let[Y,G]of $){if(Z==="verified-only"&&!lH(Y,G))continue;if(Z==="scrub"&&_6(Y,J)!==Y)continue;X.append(Y,Z==="scrub"?_6(G,J):G)}return X.delete("content-length"),X}function eX($,Z,J){if(Z!==""&&J!==null)Object.defineProperty($,"url",{value:_6(Z,J),enumerable:!0});return $}function y3($,Z,J,X){let Y=J.secrets,G=YH($,Response.prototype);if(Z.ok){let K=X==="content-type"?/text\/event-stream/i.test(GH(Z.headers)):X==="event-stream";if(G&&!K)return $;let W=Z.body();if(G&&W===null)return $;let V=W===null||!K?W:kH(W,J);return eX(new Response(V,{status:Z.status,statusText:Z.statusText,headers:M2(Z.headers,"keep",[])}),Z.url,Y)}if(Z.status===0)return G?$:Response.error();let z=EH.has(Z.status)?null:Z.body(),Q=z===null?null:wH(z,J);if(Y===null){let K=M2(Z.headers,"verified-only",[]);if(Q!==null)K.set("content-type","application/json");return new Response(Q,{status:Z.status,headers:K})}return eX(new Response(Q,{status:Z.status,statusText:_6(Z.statusText,Y),headers:M2(Z.headers,"scrub",Y)}),Z.url,Y)}function dH($,Z){let J=_3($);if(!J)throw TypeError("Provider error redactor expects a Response");let X=y3($,J,Z,"content-type");if(!(X instanceof Response))throw TypeError("Provider error redactor expects a Response");return X}function CR($){let Z={secrets:gJ($),wrappedBodies:0};return Object.freeze({redactText(J){if(typeof J!=="string")throw TypeError("Provider error redactor expects text");let X=Z.secrets;return X===null?f8:_6(J,X)},redactError(J){return G1(J,Z)},redactResponse(J){return dH(J,Z)},dispose(){Z.secrets=null}})}var iH="Provider error response scope accepts one response while live";function uJ($,Z){if(Z!=="event-stream"&&Z!=="http")throw TypeError("Provider error response scope mode must be 'event-stream' or 'http'");let J=Z,X={secrets:gJ($),wrappedBodies:0},Y=()=>{},G=new Promise((V)=>{Y=V}),z=!1,Q=!1,K=(V)=>{if(z)return;z=!0,X.secrets=null,X.onTerminal=void 0,Y(V)};X.onTerminal=K;let W={get settled(){return G},redactResponse(V){if(Q||z)throw TypeError(iH);let B=_3(V);if(!B)throw TypeError("Provider error redactor expects a Response");Q=!0;let q;try{q=y3(V,B,X,J)}catch(H){throw K("disposed"),H}if(X.wrappedBodies===0)K("untouched");if(!(q instanceof Response))throw TypeError("Provider error redactor expects a Response");return q},redactError(V){return G1(V,X)},dispose(){K("disposed")}};return Object.defineProperty(W,"settled",{enumerable:!1}),Object.freeze(W)}var I2=3600000,$Y=300000,sH=60000,SR="extended-cache-ttl-2025-04-11",tH=32,ZY=16777216,aH=30000,nH=60000,oH=900000,rH=30000,JY="OAuth cache prewarm credential is unavailable",XY="## Claude Cache Keep Status",YY="## Claude Cache Keep Enabled",eH="## Claude Cache Keep Disabled",$L="## Claude Cache Keep Usage",ZL="Usage: `/claude-cachekeep`, `/claude-cachekeep always`, `/claude-cachekeep off`, or `/claude-cachekeep HH-HH`.";function i4($){return String($).padStart(2,"0")}function JL($){let Z=$.trim();if(!Z)return{type:"status"};if(Z==="off")return{type:"disable"};if(Z==="always")return{type:"always"};if(Z==="subagents on")return{type:"subagents",enabled:!0};if(Z==="subagents off")return{type:"subagents",enabled:!1};let J=/^(\d{1,2})-(\d{1,2})$/.exec(Z);if(!J)return{type:"usage"};let X=Number(J[1]),Y=Number(J[2]);if(!Number.isInteger(X)||!Number.isInteger(Y)||X<0||X>23||Y<0||Y>23||X===Y)return{type:"usage"};return{type:"window",startHour:X,endHour:Y}}function s4($){let Z=Number($?.cacheKeep?.startHour),J=Number($?.cacheKeep?.endHour);if(!Number.isInteger(Z)||!Number.isInteger(J)||Z<0||Z>23||J<0||J>23||Z===J)return;return{startHour:Z,endHour:J}}function AZ($){return $?.cacheKeep?.enabled===!0&&$.cacheKeep.always===!0}function h3($){return $?.cacheKeep?.enabled===!0&&(AZ($)||!!s4($))}function XL($){return h3($)&&$?.claudeCache?.enabled===!0&&$.claudeCache.mode==="hybrid"}function YL($,Z=new Date){if(!$)return!1;let J=Z.getHours();if($.startHour<$.endHour)return J>=$.startHour&&J<$.endHour;return J>=$.startHour||J<$.endHour}function GY($,Z=new Date){if($?.cacheKeep?.enabled!==!0)return!1;return AZ($)||YL(s4($),Z)}function zY($=new Date){return`${$.getFullYear()}-${i4($.getMonth()+1)}-${i4($.getDate())}`}function m3($,Z=new Date){if($&&$.startHour>$.endHour&&Z.getHours()<$.endHour){let J=new Date(Z);return J.setDate(J.getDate()-1),zY(J)}return zY(Z)}function QY($,Z,J=new Date){return AZ($)?"always":m3(Z,J)}function j8($){let Z=$.always?"always (while this process is running)":$.window?`${i4($.window.startHour)}-${i4($.window.endHour)}`:"not configured",J=[`Cache keep: ${$.enabled?"enabled":"disabled"}`,`Schedule: ${Z}`,"Mode requirement: `/claude-cache mode hybrid` must be active."];if(typeof $.hybridActive==="boolean")J.push(`Hybrid active: ${$.hybridActive?"yes":"no"}`);if(typeof $.trackedSessions==="number")J.push(`Tracked sessions: ${$.trackedSessions}`);if($.trackedSessionDetails?.length){J.push("Sessions:");for(let X of $.trackedSessionDetails)J.push(`- ${X.id}`)}if($.nextPrewarmAt)J.push(`Next prewarm: ${new Date($.nextPrewarmAt).toLocaleString()}`);return J.join(`
-`)}function kR($){let Z=JL($.argumentsText),J={enabled:$.enabled??!1,always:$.always,window:$.window,trackedSessions:$.trackedSessions,trackedSessionDetails:$.trackedSessionDetails,nextPrewarmAt:$.nextPrewarmAt,hybridActive:$.hybridActive};if(Z.type==="status")return[XY,"",j8(J)].join(`
-`);if(Z.type==="disable")return[eH,"",j8({...J,enabled:!1})].join(`
-`);if(Z.type==="always")return[YY,"",j8({...J,enabled:!0,always:!0,window:void 0})].join(`
-`);if(Z.type==="window")return[YY,"",j8({...J,enabled:!0,always:!1,window:{startHour:Z.startHour,endHour:Z.endHour}})].join(`
-`);if(Z.type==="subagents")return[XY,"",j8(J),"",`Subagent tracking: ${Z.enabled?"enabled":"disabled"}`].join(`
-`);return[$L,"",ZL,"",j8(J)].join(`
-`)}function H7($){if(!$||typeof $!=="object")return!1;if(Array.isArray($))return $.some(H7);let Z=$,J=Z.cache_control;if(J&&typeof J==="object"&&J.type==="ephemeral")return!0;return Object.values(Z).some(H7)}async function GL($){let Z;try{Z=JSON.parse($)}catch{return{ok:!1,reason:"body is not valid JSON"}}if(!H7(Z))return{ok:!1,reason:"body has no explicit cache breakpoints"};let J=structuredClone(Z);if(jq(J),J.max_tokens=0,delete J.stream,J.thinking?.type==="enabled")delete J.thinking;if(J.output_config?.format)delete J.output_config;let G=J.tool_choice;if(G?.type==="tool"||G?.type==="any")delete J.tool_choice;return{ok:!0,bodyText:await Vq(JSON.stringify(Cq(J)))}}function KY($,Z){let J=Math.min(oH,nH*2**Math.min(Math.max(Z-1,0),8)),X=2166136261;for(let G of`${$}:${Z}`)X^=G.charCodeAt(0),X=Math.imul(X,16777619);let Y=(X>>>0)%(Math.min(rH,J/4)+1);return J+Y}function zL($){let Z=[],J=$.get("authorization");if(J){Z.push(J);let Y=/^Bearer\s+(.+)$/i.exec(J)?.[1]?.trim();if(Y)Z.push(Y)}let X=$.get("x-api-key");if(X)Z.push(X);return Z}class QL{options;targets=new Map;timer=null;tickPromise=null;nextPrewarmAttemptId=0;constructor($){this.options=$}start(){if(this.timer)return;if(a.debug("cachekeep","started"),this.timer=(this.options.setIntervalImpl??globalThis.setInterval)(()=>{this.tick().catch(()=>{a.warn("cachekeep","tick failed")})},sH),"unref"in this.timer)this.timer.unref()}stop(){if(!this.timer)return;a.debug("cachekeep","stopped"),(this.options.clearIntervalImpl??globalThis.clearInterval)(this.timer),this.timer=null}stats($,Z=this.options.now?.()??Date.now(),J=!1){let X=J?"always":m3($,new Date(Z)),Y=[...this.targets.values()].filter((z)=>z.dayKey===X),G=Y.length?Math.min(...Y.map((z)=>z.nextPrewarmAt)):void 0;return{trackedSessions:Y.length,nextPrewarmAt:G}}trackedSessions(){return[...this.targets.values()].map(($)=>({id:$.id,cacheExpiresAt:$.cacheExpiresAt,nextPrewarmAt:$.nextPrewarmAt})).sort(($,Z)=>$.id.localeCompare(Z.id))}trackedOAuthRoute($){let Z=this.targets.get($);return Z?{oauthAccountId:Z.oauthAccountId}:void 0}trackedCount(){return this.targets.size}publishTrackedSessions(){let $=this.options.onTrackedSessionsChanged;if(!$)return;try{Promise.resolve($(this.trackedSessions())).catch(()=>{a.warn("cachekeep","failed to publish tracked sessions")})}catch{a.warn("cachekeep","failed to publish tracked sessions")}}totalBodyBytes(){return[...this.targets.values()].reduce(($,Z)=>$+Z.bodyText.length,0)}evictOldestTarget(){let $=this.targets.keys().next().value;if($!==void 0)this.targets.delete($)}pruneTargets($,Z){for(let[J,X]of this.targets){if(Z&&X.dayKey!==Z){this.targets.delete(J);continue}if($>=X.cacheExpiresAt)this.targets.delete(J)}while(this.targets.size>tH)this.evictOldestTarget();while(this.totalBodyBytes()>ZY){let J=this.targets.size;if(this.evictOldestTarget(),this.targets.size===J)break}}track($){if(!$.sessionId)return{tracked:!1,reason:"missing session id"};if(!h3($.storage))return{tracked:!1,reason:"cachekeep disabled"};if($.cacheMode!=="hybrid")return{tracked:!1,reason:"cache mode is not hybrid"};if($.bodyText.length>ZY)return{tracked:!1,reason:"body exceeds cachekeep memory budget"};let Z=this.options.now?.()??Date.now(),J=s4($.storage);if(!GY($.storage,new Date(Z)))return{tracked:!1,reason:"outside configured schedule"};let X=QY($.storage,J,new Date(Z));if(this.pruneTargets(Z,X),this.targets.has($.sessionId))this.targets.delete($.sessionId);let Y={};return $.headers.forEach((G,z)=>{Y[z]=G}),this.targets.set($.sessionId,{id:$.sessionId,url:$.url,headers:Y,bodyText:$.bodyText,cacheExpiresAt:Z+I2,nextPrewarmAt:Z+I2-$Y,consecutiveFailures:0,dayKey:X,oauthAccountId:$.oauthAccountId,oauthAccountIdentity:$.oauthAccountIdentity,accountStoragePath:$.accountStoragePath,isSubagent:$.isSubagent??!1}),this.pruneTargets(Z,X),this.publishTrackedSessions(),this.start(),{tracked:!0}}async prewarmNow($){let Z={};$.headers.forEach((X,Y)=>{Z[Y]=X});let J={id:$.sessionId,url:$.url,headers:Z,bodyText:$.bodyText,cacheExpiresAt:this.options.now?.()??Date.now(),nextPrewarmAt:this.options.now?.()??Date.now(),consecutiveFailures:0,dayKey:"",oauthAccountId:$.oauthAccountId,oauthAccountIdentity:$.oauthAccountIdentity,accountStoragePath:$.accountStoragePath,isSubagent:$.isSubagent??!1};return this.sendPrewarm(J)}tick(){if(this.tickPromise)return this.tickPromise;let $;return $=this.runTick().finally(()=>{if(this.tickPromise===$)this.tickPromise=null}),this.tickPromise=$,$}async runTick(){let $=await this.options.loadStorage(),Z=s4($),J=this.options.now?.()??Date.now(),X=QY($,Z,new Date(J));if(AZ($))for(let Y of this.targets.values())Y.dayKey="always";if(this.pruneTargets(J,X),!this.targets.size){this.publishTrackedSessions(),this.stop();return}if(!XL($)){this.publishTrackedSessions();return}if(!GY($,new Date(J))){this.publishTrackedSessions();return}a.debug("cachekeep","fired",{targets:this.targets.size});for(let Y of this.targets.values()){if(Y.nextPrewarmAt>J)continue;try{await this.prewarm(Y,J)}catch{a.warn("cachekeep","prewarm failed",{session:Y.id}),Y.consecutiveFailures+=1,Y.nextPrewarmAt=J+KY(Y.id,Y.consecutiveFailures)}}this.publishTrackedSessions()}async sendPrewarm($){let Z={id:++this.nextPrewarmAttemptId,signal:AbortSignal.timeout(this.options.prewarmTimeoutMs??aH)};try{let J=$.bodyText;if(this.options.prepareBody)try{J=await this.options.prepareBody(J,$)}catch{a.warn("cachekeep","prepare body failed",{session:$.id})}let X={...$,bodyText:J},Y=await GL(J);if(!Y.ok)return Y;let G=this.options.fetchImpl??fetch,z={...X,bodyText:Y.bodyText},Q=this.options.prepareHeaders?await this.options.prepareHeaders(new Headers($.headers),z,Z):new Headers($.headers);if(!Q)return{ok:!1,reason:JY,transient:!0};Q.delete("content-length"),Q.delete("transfer-encoding");let K,W=async(x)=>{let L=uJ(zL(x),"http");try{let U=await G($.url,{method:"POST",headers:x,body:Y.bodyText,signal:Z.signal});return L.redactResponse(U)}catch(U){let M=L.redactError(U);throw L.dispose(),M}};try{if(K=await W(Q),K.status===401&&!Z.signal?.aborted&&this.options.retryOnUnauthorized){let x;try{x=await this.options.retryOnUnauthorized({target:z,headers:Q,bodyText:Y.bodyText,attempt:Z})}catch{}if(x&&!Z.signal?.aborted)x.delete("content-length"),x.delete("transfer-encoding"),await K.body?.cancel().catch(()=>{}),Q=x,K=await W(Q)}}catch(x){return{ok:!1,reason:x instanceof Error?x.message:String(x),transient:!0}}let V=this.options.now?.()??Date.now(),B=await K.text().catch(()=>""),q=null;try{q=B?JSON.parse(B):null}catch{}try{await this.options.onResponse?.({target:$,bodyText:Y.bodyText,status:K.status,data:q,receivedAt:V,attempt:Z})}catch{}try{let x=await Tj({affinity:$.id,route:"cachekeep",status:K.status,bodyText:Y.bodyText,url:$.url,method:"POST",headers:Q,tag:"cachekeep"});await Cj(x,{status:K.status,message:q})}catch{a.debug("cachekeep","dump failed",{session:$.id})}if(!K.ok)return{ok:!1,reason:B||`HTTP ${K.status}`,status:K.status};let j=(q&&typeof q==="object"&&!Array.isArray(q)?q:null)?.usage;return{ok:!0,...j&&{usage:j}}}finally{try{await this.options.onComplete?.({target:$,attempt:Z})}catch{}}}async prewarm($,Z){let J=await this.sendPrewarm($);if(!J.ok){if(J.status==null&&!J.transient)a.debug("cachekeep","prewarm skipped",{session:$.id,reason:J.reason}),this.targets.delete($.id);else a.warn("cachekeep","prewarm failed",{session:$.id,status:J.status,...J.transient&&{transient:!0},...J.reason===JY&&{reason:J.reason}}),$.consecutiveFailures+=1,$.nextPrewarmAt=Z+KY($.id,$.consecutiveFailures);return}$.cacheExpiresAt=Z+I2,$.nextPrewarmAt=$.cacheExpiresAt-$Y,$.consecutiveFailures=0,a.debug("cachekeep","prewarm succeeded",{session:$.id,...J.usage&&{usage:J.usage}})}}var HL=180000;function LL($){if(!$||typeof $!=="object"||Array.isArray($))return;let Z=$;if(typeof Z.id!=="string"||Z.id.length===0||typeof Z.cacheExpiresAt!=="number"||!Number.isFinite(Z.cacheExpiresAt)||typeof Z.nextPrewarmAt!=="number"||!Number.isFinite(Z.nextPrewarmAt))return;return{id:Z.id,cacheExpiresAt:Z.cacheExpiresAt,nextPrewarmAt:Z.nextPrewarmAt}}function NL($){if(!$||typeof $!=="object"||Array.isArray($))return;let Z=$;if(Z.version!==1||typeof Z.updatedAt!=="number"||!Number.isFinite(Z.updatedAt)||!Array.isArray(Z.sessions))return;return{version:1,updatedAt:Z.updatedAt,sessions:Z.sessions.flatMap((J)=>{let X=LL(J);return X?[X]:[]})}}function gR($){return L7(jL(),"opencode-anthropic-auth","cachekeep-sessions",$)}class UL{options;filePath;writeChain=Promise.resolve();constructor($){this.options=$;let Z=$.instanceId??`${process.pid}-${WY()}`;this.filePath=L7($.directory,`${Z}.json`)}publish($){let Z=$.map((J)=>({...J}));return this.writeChain=this.writeChain.catch(()=>{}).then(async()=>{if(Z.length===0){await VY(this.filePath,{force:!0});return}await KL(this.options.directory,{recursive:!0,mode:448});let J=`${this.filePath}.${WY()}.tmp`,X={version:1,updatedAt:this.options.now?.()??Date.now(),sessions:Z};await qL(J,`${JSON.stringify(X)}
-`,{mode:384}),await BL(J,this.filePath)}),this.writeChain}async list($=[]){await this.writeChain.catch(()=>{});let Z=this.options.now?.()??Date.now(),J=this.options.leaseMs??HL,X;try{X=(await WL(this.options.directory)).filter((z)=>z.endsWith(".json"))}catch{X=[]}let Y=await Promise.all(X.map(async(z)=>{try{let Q=await VL(L7(this.options.directory,z),"utf8");return NL(JSON.parse(Q))}catch{return}})),G=new Map;for(let z of Y){if(!z||Z-z.updatedAt>J||z.updatedAt>Z)continue;for(let Q of z.sessions){let K=G.get(Q.id);if(!K||Q.cacheExpiresAt>K.cacheExpiresAt)G.set(Q.id,Q)}}for(let z of $){let Q=G.get(z.id);if(!Q||z.cacheExpiresAt>Q.cacheExpiresAt)G.set(z.id,{...z})}return[...G.values()].sort((z,Q)=>z.id.localeCompare(Q.id))}async dispose(){await this.writeChain.catch(()=>{}),await VY(this.filePath,{force:!0})}}var wL="anthropic-auth-opencode";var RL=1,N7=16384,l3=30000,dJ=/^[0-9a-f]{64}$/,jY=new Set(["invalid_params","pending_exists","not_found","already_consumed","superseded","stale_generation"]);function lR($={}){return T$.connect($)}function TL($){let Z=qY($)||".json",J=lJ($,qY($));return{statePath:m9(p8($),`${J}-state${Z}`),tokenPath:$}}function z1($,Z=process.env,J=process.cwd()){let X=Z[`${$.toUpperCase()}_ANTHROPIC_AUTH_CLAUSTRUM_ENROLLMENT_FILE`]?.trim(),Y=X?PL(X)?X:AL(J,X):m9(Z.XDG_STATE_HOME||m9(_L(),".local","state"),"cortexkit","anthropic-auth",`${$}-enrollment.json`);return TL(Y)}function d3($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function s1($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0}function i3($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=1}function iJ($){if(!d3($)||$.version!==RL||typeof $.proposedName!=="string"||$.proposedName.length===0)throw Error("invalid Claustrum enrollment state");if($.phase==="pending"){if(!dJ.test(String($.requestSecret??""))||$.requestId!==void 0&&(typeof $.requestId!=="string"||$.requestId.length===0)||!s1($.createdAt)||!s1($.updatedAt))throw Error("invalid Claustrum enrollment state");return{version:1,phase:"pending",proposedName:$.proposedName,requestSecret:$.requestSecret,...$.requestId!==void 0&&{requestId:$.requestId},createdAt:$.createdAt,updatedAt:$.updatedAt}}if($.phase==="approved"){if($.approvedName!==void 0&&(typeof $.approvedName!=="string"||$.approvedName.length===0)||!i3($.tokenGeneration)||!s1($.updatedAt))throw Error("invalid Claustrum enrollment state");return{version:1,phase:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration,updatedAt:$.updatedAt}}if($.phase==="denied"||$.phase==="blocked"){if($.errorCode!==void 0&&typeof $.errorCode!=="string"||!s1($.updatedAt))throw Error("invalid Claustrum enrollment state");return{version:1,phase:$.phase,proposedName:$.proposedName,...$.errorCode!==void 0&&{errorCode:$.errorCode},updatedAt:$.updatedAt}}throw Error("invalid Claustrum enrollment state")}function s3($){if(!d3($)||!dJ.test(String($.token??""))||!i3($.token_generation))throw Error("invalid Claustrum enrollment token file");return{token:$.token,token_generation:$.token_generation}}function FL($){if(!$.isFile())throw Error("Claustrum enrollment file must be a regular file");if(($.mode&63)!==0)throw Error("Claustrum enrollment file must be owner-only");let Z=process.getuid?.();if(Z!==void 0&&$.uid!==Z)throw Error("Claustrum enrollment file must be owned by the current user")}async function E8($){let Z;try{Z=await p3($,BY.O_RDONLY|BY.O_NOFOLLOW)}catch(J){if(J.code==="ENOENT")return;throw Error("Claustrum enrollment file could not be opened safely")}try{FL(await Z.stat());let J=Buffer.alloc(N7+1),{bytesRead:X}=await Z.read(J,0,J.byteLength,0);if(X>N7)throw Error("Claustrum enrollment file is too large");return u8(J.subarray(0,X).toString("utf8"))}finally{await Z.close()}}async function CL($){let Z;try{Z=await ML($)}catch{return}for(;;){let J=await IL(Z).catch(()=>{return});if(J&&(J.mode&18)!==0&&(J.mode&512)===0)throw Error("Claustrum enrollment path has an unsafe writable ancestor");let X=p8(Z);if(X===Z)return;Z=X}}async function Y0($,Z,J){let X=p8($);await pJ(X,{recursive:!0,mode:448}),await CL(X);let Y=`${JSON.stringify(Z)}
-`;if(Buffer.byteLength(Y)>N7)throw Error("Claustrum enrollment state is too large");let G=m9(X,`.${lJ($)}.${process.pid}.${u3()}.tmp`),z;try{z=await p3(G,"wx",384),await z.writeFile(Y,"utf8"),await z.sync(),await z.close(),z=void 0,await OL(G,384),await J(),await c3(G,$)}finally{await z?.close().catch(()=>{}),await cJ(G).catch(()=>{})}}async function SL($,Z,J,X){let Y=m9(p8($),`.${lJ($)}.${process.pid}.${u3()}.tmp`);try{await J(Y,Z),await X(),await c3(Y,$)}finally{await cJ(Y).catch(()=>{})}}async function kL($,Z=wL){let J=await E8($.tokenPath),X=J===void 0?void 0:s3(J),Y=await E8($.statePath),G=Y===void 0?void 0:iJ(Y);if(X)return{state:"approved",proposedName:G?.proposedName??Z,...G?.phase==="approved"&&G.approvedName!==void 0&&{approvedName:G.approvedName},tokenGeneration:X.token_generation};if(!G)return{state:"idle"};if(G.phase==="pending")return{state:"pending",proposedName:G.proposedName,...G.requestId!==void 0&&{requestId:G.requestId}};if(G.phase==="approved")return{state:"blocked",proposedName:G.proposedName,code:"missing_token"};if(G.phase==="denied")return{state:"denied",proposedName:G.proposedName};return{state:"blocked",proposedName:G.proposedName,code:G.errorCode??"unknown"}}function G0($){if($.phase==="pending")return{state:"pending",proposedName:$.proposedName,...$.requestId!==void 0&&{requestId:$.requestId}};if($.phase==="approved")return{state:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration};if($.phase==="denied")return{state:"denied",proposedName:$.proposedName};return{state:"blocked",proposedName:$.proposedName,code:$.errorCode??"unknown"}}class vL{#$;#Z;#G;#J;#K;#Y;constructor($){this.#$=$.client,this.#Z=$.paths,this.#G=$.proposedName,this.#J=$.now??Date.now,this.#K=$.mintSecret??(()=>DL(32).toString("hex")),this.#Y=$.writeTokenFile??Z9}async status(){return kL(this.#Z,this.#G)}async resetTerminal(){return fL(this.#Z,this.#G)}async reconcile(){await pJ(p8(this.#Z.statePath),{recursive:!0,mode:448});let $=await g9({name:"ceremony",path:this.#Z.statePath,ttlMs:l3,renew:!0});if(!$)return{state:"busy"};try{let Z=await E8(this.#Z.tokenPath),J=Z===void 0?void 0:s3(Z),X=await E8(this.#Z.statePath),Y=X===void 0?void 0:iJ(X);if(Y&&Y.proposedName!==this.#G)throw Error("Claustrum enrollment state belongs to a different consumer");if(J){if(!Y||Y.phase==="pending"){let z={version:1,phase:"approved",proposedName:Y?.proposedName??this.#G,tokenGeneration:J.token_generation,updatedAt:this.#J()};await Y0(this.#Z.statePath,z,()=>$.assertOwned()),Y=z}return{state:"approved",proposedName:Y.proposedName,...Y.phase==="approved"&&Y.approvedName!==void 0&&{approvedName:Y.approvedName},tokenGeneration:J.token_generation}}if(Y?.phase==="approved"){let z={version:1,phase:"blocked",proposedName:Y.proposedName,errorCode:"missing_token",updatedAt:this.#J()};return await Y0(this.#Z.statePath,z,()=>$.assertOwned()),G0(z)}if(Y&&Y.phase!=="pending")return G0(Y);if(!Y){let z=this.#J();if(Y={version:1,phase:"pending",proposedName:this.#G,requestSecret:this.#K(),createdAt:z,updatedAt:z},!dJ.test(Y.requestSecret))throw Error("invalid minted Claustrum enrollment secret");await Y0(this.#Z.statePath,Y,()=>$.assertOwned())}if(!Y.requestId)try{let z=xL("sha256").update(Buffer.from(Y.requestSecret,"hex")).digest("hex"),Q=await this.#$.enrollPropose({name:Y.proposedName,requestSecretHash:z});Y={...Y,requestId:Q.requestId,updatedAt:this.#J()},await Y0(this.#Z.statePath,Y,()=>$.assertOwned())}catch(z){if(z instanceof s6){if(!jY.has(z.code)&&(z.code==="pending_queue_full"||z.action==="retry"))return{state:"pending",proposedName:Y.proposedName,retryCode:z.code};let Q={version:1,phase:"blocked",proposedName:Y.proposedName,errorCode:z.code,updatedAt:this.#J()};return await Y0(this.#Z.statePath,Q,()=>$.assertOwned()),G0(Q)}throw z}let G=Y.requestId;if(!G)return G0(Y);try{let z=await this.#$.enrollPoll({requestId:G,requestSecret:Y.requestSecret});if(z.status==="pending")return G0(Y);if(z.status==="denied"){let K={version:1,phase:"denied",proposedName:Y.proposedName,updatedAt:this.#J()};return await Y0(this.#Z.statePath,K,()=>$.assertOwned()),G0(K)}await SL(this.#Z.tokenPath,{token:z.token,token_generation:z.tokenGeneration},this.#Y,()=>$.assertOwned());let Q={version:1,phase:"approved",proposedName:Y.proposedName,approvedName:z.name,tokenGeneration:z.tokenGeneration,updatedAt:this.#J()};return await Y0(this.#Z.statePath,Q,()=>$.assertOwned()),G0(Q)}catch(z){if(!(z instanceof s6))throw z;if(!jY.has(z.code)&&z.action==="retry")return{state:"pending",proposedName:Y.proposedName,requestId:G,retryCode:z.code};let Q={version:1,phase:"blocked",proposedName:Y.proposedName,errorCode:z.code,updatedAt:this.#J()};return await Y0(this.#Z.statePath,Q,()=>$.assertOwned()),G0(Q)}}finally{await $.release()}}}async function fL($,Z){await pJ(p8($.statePath),{recursive:!0,mode:448});let J=await g9({name:"ceremony",path:$.statePath,ttlMs:l3,renew:!0});if(!J)return"busy";try{if(await E8($.tokenPath)!==void 0)return"refused-approved";let X=await E8($.statePath);if(X===void 0)return"idle";let Y=iJ(X);if(Y.proposedName!==Z)throw Error("Claustrum enrollment state belongs to a different consumer");if(Y.phase==="pending")return"refused-pending";return await J.assertOwned(),await cJ($.statePath),"reset"}finally{await J.release()}}var EL="https://api.anthropic.com/api/oauth/profile",bL=604800000;async function t3($){PJ($.accessToken,"anthropic");let Z=await($.fetchImpl??fetch)(EL,{method:"GET",signal:$.signal,headers:{Authorization:`Bearer ${$.accessToken}`,Accept:"application/json","anthropic-beta":"oauth-2025-04-20"}});if(!Z.ok)throw Error(`Claude profile check failed: ${Z.status}`);let J=await Z.json(),X=J.organization?.rate_limit_tier,Y=J.organization?.organization_type;if(typeof X!=="string"||X.trim()===""||typeof Y!=="string"||Y.trim()==="")throw Error("Claude profile response is missing account metadata");return{tier:X,orgType:Y,checkedAt:$.now?.()??Date.now(),...$.accountIdentity!==void 0&&{accountIdentity:$.accountIdentity},...$.providerAccountUuid!==void 0&&{providerAccountUuid:$.providerAccountUuid}}}function dR($,Z){if(!$)return!1;if(Z===void 0)return!0;return $.accountIdentity===void 0||$.accountIdentity===Z}function iR($,Z=Date.now()){return Boolean($&&Number.isFinite($.checkedAt)&&Z>=$.checkedAt&&Z-$.checkedAt<bL)}function t4($){let Z=$?.tier.match(/^default_claude_max_(\d+)x$/);if(!Z)return;let J=`Max ${Z[1]}x`;return $?.orgType==="claude_team"?`Team · ${J}`:J}function gL($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};let J=Z[0],X=Z.slice(1).join(" ");if(J==="enable"&&X)return{type:"enable",id:X};if(J==="disable"&&X)return{type:"disable",id:X};if(J==="remove"&&X)return{type:"remove",id:X};if(J==="move-up"&&X)return{type:"move-up",id:X};if(J==="move-down"&&X)return{type:"move-down",id:X};if(J==="reset-backoff"&&!X)return{type:"reset-backoff"};if(J==="enrollment-reset"&&!X)return{type:"enrollment-reset"};if(J==="claustrum"&&!X)return{type:"claustrum-mode",mode:"claustrum"};if(J==="local"&&!X)return{type:"claustrum-mode",mode:"local"};if(J==="add-apikey"&&X){let Y=X,G,z,Q=Y.match(/--base-url\s+(\S+)/);if(Q)G=Q[1],Y=Y.replace(Q[0],"").trim();let K=Y.match(/--auth-header\s+(authorization-bearer|x-api-key)/);if(K)z=K[1],Y=Y.replace(K[0],"").trim();let W,V=Y.match(/--label\s+(.+)/);if(V)W=V[1]?.trim()||void 0,Y=Y.replace(V[0],"").trim();let B=Y.indexOf(" ");if(B===-1){if(!Y)return{type:"usage"};return{type:"add-apikey",apiKey:Y,baseURL:G,authHeader:z,label:W}}let q=Y.slice(0,B),H=Y.slice(B+1).trim();return{type:"add-apikey",apiKey:q,label:W??(H||void 0),baseURL:G,authHeader:z}}if(J==="add-oauth-start")return{type:"add-oauth-start"};if(J==="add-oauth-finish"&&X){let Y=X,G,z=Y.match(/--label\s+(.+)/);if(z)G=z[1]?.trim()||void 0,Y=Y.replace(z[0],"").trim();if(!Y)return{type:"usage"};return{type:"add-oauth-finish",code:Y,label:G}}return{type:"usage"}}function HY($){switch($){case"na":return"n/a (OpenCode-managed)";case"off":return"not enrolled";case"on-vault-served":return"vault-served";case"on-vault-reauth":return"vault reauth";case"on-cold":return"vault cold";case"unknown-identity":return"unknown identity";case"on-identity-mismatch":return"identity mismatch";case"on-corrupt-binding":return"corrupt binding"}}function yL($,Z=!1){switch($.state){case"idle":return["- Enrollment: not enrolled"];case"busy":return["- Enrollment: setup is busy"];case"unavailable":return["- Enrollment: temporarily unavailable"];case"pending":return $.requestId&&/^[A-Za-z0-9_-]{1,128}$/.test($.requestId)?[`- Enrollment: pending approval (${$.requestId})`,"- Next: Quit the host and run `bunx @cortexkit/opencode-anthropic-auth setup`"]:[$.requestId?"- Enrollment: pending approval":"- Enrollment: request not sent","- Next: Quit the host and run `bunx @cortexkit/opencode-anthropic-auth setup`"];case"approved":{let X=$.approvedName??$.proposedName;return/^[A-Za-z0-9_-]{1,128}$/.test(X)?[`- Enrollment: approved as enrolled:${X} (generation ${$.tokenGeneration}${Z?"":"; scoped serving not active yet"})`,...Z?[]:["- Next: Quit the host and run `bunx @cortexkit/opencode-anthropic-auth setup`"]]:[`- Enrollment: approved (generation ${$.tokenGeneration}${Z?"":"; scoped serving not active yet"})`,...Z?[]:["- Next: Quit the host and run `bunx @cortexkit/opencode-anthropic-auth setup`"]]}case"denied":return["- Enrollment: denied by operator"];case"blocked":return[`- Enrollment: blocked (${$.code})`]}}function hL($){let Z=[],J=$.quota?.mainQuota?.five_hour;Z.push({id:"main",label:$.main?.provider==="anthropic"?"OpenCode anthropic":"Main",role:"main",enabled:!0,quotaPercent:J?.usedPercent??null,tierLabel:t4($.main?.profile)});for(let X of $.accounts){let Y=X.quota?.five_hour;Z.push({id:X.id,label:X.label??X.id,role:"fallback",enabled:X.enabled!==!1,quotaPercent:Y?.usedPercent??null,tierLabel:X.type==="oauth"?t4(X.profile):void 0})}return Z}var _2=["Usage:","  /claude-account                       Show account list","  /claude-account enable <id>           Enable a fallback account","  /claude-account disable <id>          Disable a fallback account","  /claude-account remove <id>           Remove a fallback account","  /claude-account claustrum             Enable Claustrum mode","  /claude-account local                 Enable local mode","  /claude-account move-up <id>          Move a fallback account up","  /claude-account move-down <id>        Move a fallback account down","  /claude-account reset-backoff          Clear main OAuth refresh and quota backoff","  /claude-account enrollment-reset       Clear denied/blocked state; rerun setup","  /claude-account add-apikey <key>      Add an API key fallback account","  /claude-account add-oauth-start       Start OAuth device flow","  /claude-account add-oauth-finish <code>  Complete OAuth flow"].join(`
-`);async function sR($){let Z=gL($.argumentsText),J=$.storage.accounts,X="main";if(Z.type==="status"){let G=$.statusProjection?.accounts??hL($.storage),z=$.statusProjection?.claustrumDetection??$.claustrum?.status??"unknown",Q=["## Claude Accounts","",`- Custody mode: ${H2($.storage)}`,`- Claustrum: ${z}`,...$.statusProjection?.claustrumEnrollment?yL($.statusProjection.claustrumEnrollment,$.statusProjection.accounts.some((K)=>K.role==="main"&&K.vaultServed)):[],""];for(let K of G){let W=K.quotaPercent!=null?` ${Math.round(K.quotaPercent)}%`:"",V=!K.enabled?" (disabled)":"",B=K.tierLabel?` · ${K.tierLabel}`:"",q=$.statusProjection?.accounts.find((x)=>x.id===K.id),H=$.storage.accounts.find((x)=>x.id===K.id),j=q?HY(q.custodyState):K.id!=="main"&&H&&H2($.storage)==="claustrum"&&n0(H)&&H.claustrumScopedCredentialId?HY("on-cold"):"local";Q.push(`- **${K.label}** [${K.role}]${B}${V}${W} · ${j}`)}return Q.push("",_2),{text:Q.join(`
-`)}}if(Z.type==="usage")return{text:_2};if(Z.type==="claustrum-mode"){if(!$.transition)return{text:"Claustrum mode transition is unavailable."};return $.transition(Z.mode)}if(Z.type==="enrollment-reset"){if(!$.resetEnrollment)return{text:"Claustrum enrollment reset is unavailable."};return $.resetEnrollment()}if(Z.type==="add-apikey")return{text:"add-apikey"};if(Z.type==="add-oauth-start")return{text:"add-oauth-start"};if(Z.type==="add-oauth-finish")return{text:"add-oauth-finish"};if(Z.type==="reset-backoff")return{text:"Main OAuth refresh and quota backoff cleared.",updated:{id:"main",action:"reset-backoff"}};let Y=Z.id;if(Y==="main")return{text:`Cannot ${Z.type} the main account (OpenCode managed).`};if(Z.type==="enable"||Z.type==="disable"){let G=J.find((z)=>z.id===Y);if(!G)return{text:`Account "${Y}" not found.`};return{text:`Account "${G.label??Y}" ${Z.type}d.`,updated:{id:Y,action:Z.type,enabled:Z.type==="enable"}}}if(Z.type==="remove"){let G=J.find((z)=>z.id===Y);if(!G)return{text:`Account "${Y}" not found.`};if(H2($.storage)==="claustrum"&&n0(G)&&G.claustrumScopedCredentialId)return{text:`Account "${G.label??Y}" is managed by Claustrum. Disable it to stop routing, or remove it from the vault.`};return{text:`Account "${G.label??Y}" removed.`,updated:{id:Y,action:"remove"}}}if(Z.type==="move-up"){let G=J.findIndex((W)=>W.id===Y);if(G<0)return{text:`Account "${Y}" not found.`};if(G===0)return{text:`Account "${J[G]?.label??Y}" is already first.`};let z=J.map((W)=>W.id),Q=[...J];[Q[G-1],Q[G]]=[Q[G],Q[G-1]];let K=Q.map((W)=>W.id);return{text:`Account "${J[G]?.label??Y}" moved up.`,updated:{id:Y,action:"reorder",previousOrder:z,newOrder:K}}}if(Z.type==="move-down"){let G=J.findIndex((W)=>W.id===Y);if(G<0)return{text:`Account "${Y}" not found.`};if(G===J.length-1)return{text:`Account "${J[G]?.label??Y}" is already last.`};let z=J.map((W)=>W.id),Q=[...J];[Q[G],Q[G+1]]=[Q[G+1],Q[G]];let K=Q.map((W)=>W.id);return{text:`Account "${J[G]?.label??Y}" moved down.`,updated:{id:Y,action:"reorder",previousOrder:z,newOrder:K}}}return{text:_2}}var mL="ANTHROPIC_CUSTOM_HEADERS",uL=64,g0=new Map,U7=new Set,pL=new Set(["authorization","proxy-authorization","x-api-key","host","content-length","content-type","connection","transfer-encoding","upgrade","keep-alive","te","trailer","anthropic-version","anthropic-beta","x-parent-session-id","x-session-affinity","x-opencode-session","x-anthropic-effort-plan","x-cortexkit-billing-lineage"]);function LY($,Z){g0.delete($),g0.set($,Z);while(g0.size>uL){let J=g0.keys().next().value;if(J===void 0)break;g0.delete(J),U7.delete(J)}}function NY($,Z,J){if(pL.has(Z.trim().toLowerCase()))throw TypeError("protected header");$.set(Z,J)}function cL($){if(!$?.trim())return new Headers;let Z=g0.get($);if(Z!==void 0||g0.has($))return new Headers(Z??[]);try{let J=new Headers,X=$.trim();if(!X.startsWith("{")&&!X.startsWith("["))for(let G of X.split(/\r?\n|,\s*(?=[^,\s:]+:)/).map((z)=>z.trim()).filter(Boolean)){let z=G.indexOf(":");if(z<=0)throw TypeError("invalid header entry");NY(J,G.slice(0,z).trim(),G.slice(z+1).trim())}else{let G=u8(X);if(G==null||typeof G!=="object"||Array.isArray(G))throw TypeError("invalid header object");for(let[z,Q]of Object.entries(G)){if(Q==null)continue;NY(J,z,Array.isArray(Q)?Q.map(String).join(", "):String(Q))}}let Y=[...J.entries()];return LY($,Y),new Headers(Y)}catch{if(LY($,null),!U7.has($))U7.add($),a.warn("custom-headers","ignoring malformed ANTHROPIC_CUSTOM_HEADERS",{reason:"invalid or protected header configuration"});return new Headers}}function tR($,Z=process.env[mL]){return cL(Z).forEach((X,Y)=>{$.set(Y,X)}),$}var lL="## Claude Fast Mode Status",dL="## Claude Fast Mode Enabled",iL="## Claude Fast Mode Disabled",sL="## Claude Fast Mode Usage",tL="Usage: `/claude-fast`, `/claude-fast on`, or `/claude-fast off`.",wZ=!1;function aR(){return wZ}function nR($){wZ=$}function aL($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="on")return{type:"enable"};if(Z.length===1&&Z[0]==="off")return{type:"disable"};return{type:"usage"}}function t1($){let Z=$?.enabled??wZ;return[lL,"",`- Enabled: ${Z?"enabled":"disabled"}`,"- Persisted: ~/.config/opencode/anthropic-auth.json","- Scope: adds Anthropic fast mode to supported Opus requests","- Supported models: claude-opus-4-8, claude-opus-5, and claude-opus-5-5",'- Request changes: adds `speed: "fast"` and the `fast-mode-2026-02-01` beta header',"- Note: fast and standard speeds do not share prompt-cache prefixes"].join(`
-`)}function oR($){let Z=aL($.argumentsText),J=$.enabled??wZ;if(Z.type==="status")return t1({enabled:J});if(Z.type==="enable")return[dL,"",t1({enabled:!0})].join(`
-`);if(Z.type==="disable")return[iL,"",t1({enabled:!1})].join(`
-`);return[sL,"",tL,"",t1({enabled:J})].join(`
-`)}var H8="claude-killswitch";function nL($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="on")return{type:"on"};if(Z.length===1&&Z[0]==="off")return{type:"off"};if(Z[0]==="set"){let J=[];for(let X=1;X<Z.length;X++){let Y=Z[X]?.match(/^([^:]+):(\d+),(\d+)(?:,(\d+))?$/);if(!Y)return{type:"usage"};let[,G,z,Q,K]=Y,W=typeof K==="string"&&K.length>0?Number.parseInt(K,10):void 0,V={account:G,fh:Number.parseInt(z,10),sd:Number.parseInt(Q,10)};if(W!==void 0)V.scoped=W;J.push(V)}if(J.length===0)return{type:"usage"};return{type:"set",entries:J}}return{type:"usage"}}function a1($,Z){let J=$.enabled===!0,X=["## Killswitch","",`Status: **${J?"ON":"OFF"}**`];if(J){X.push(""),X.push("| Account | 5h threshold | 1w threshold | Scoped |"),X.push("| ------- | ------------ | ------------ | ------ |");let Y=f4($.main);X.push(`| main | ≥ ${Y.five_hour}% | ≥ ${Y.seven_day}% | ≤ ${Y.scoped}% |`);for(let G of Z){let z=f4($.accounts?.[G]??$.main);X.push(`| ${G} | ≥ ${z.five_hour}% | ≥ ${z.seven_day}% | ≤ ${z.scoped}% |`)}}return X.join(`
-`)}var UY=["## Killswitch Commands","","```",`/${H8}              — show status`,`/${H8} on           — enable with current or default thresholds`,`/${H8} off          — disable`,`/${H8} set all:5,10 — set all accounts to 5h≥5%, 1w≥10%`,`/${H8} set main:3,8,0 — set 5h≥3%, 1w≥8%, scoped≤0%`,`/${H8} set main:3,8 work-alt:5,10 — per-account`,"```"].join(`
-`);function rR($){let Z=nL($.argumentsText);if(Z.type==="status")return{text:`${a1($.config,$.accountIds)}
-
-${UY}`};if(Z.type==="on"){let X={...$.config,enabled:!0,main:$.config.main??{five_hour:_8.five_hour,seven_day:_8.seven_day}};return{text:`## Killswitch Enabled
-
-${a1(X,$.accountIds)}`,updatedConfig:X}}if(Z.type==="off")return{text:"## Killswitch Disabled",updatedConfig:{...$.config,enabled:!1}};if(Z.type==="set"){let X={...$.config.accounts??{}},Y={...$.config,enabled:!0,accounts:X};for(let z of Z.entries){let Q={five_hour:z.fh,seven_day:z.sd};if(z.scoped!==void 0)Q.scoped=z.scoped;if(z.account==="main")Y.main=Q;else if(z.account==="all"){Y.main=Q;for(let K of $.accountIds)X[K]=Q}else X[z.account]=Q}return{text:`## Killswitch Updated
-
-${a1(Y,$.accountIds)}`,updatedConfig:Y}}return{text:`${a1($.config,$.accountIds)}
-
-${UY}`}}var oL=["error","warn","info","debug","trace"],a3="Usage: `/claude-logging`, `/claude-logging error|warn|info|debug|trace`.";function rL($){let Z=$.trim().toLowerCase().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&oL.includes(Z[0]))return{type:"level",level:Z[0]};return{type:"usage"}}function P2($){return["## Claude Log Level","",`Current log level: \`${$?.level??"info"}\``,"- Persisted: ~/.config/opencode/anthropic-auth.json","- Valid levels: error, warn, info, debug, trace","",a3].join(`
-`)}function eR($){let Z=rL($.argumentsText),J=$.level??"info";if(Z.type==="status")return P2({level:J});if(Z.type==="level")return["## Claude Log Level Updated","",`Level set to \`${Z.level}\`.`,"",...P2({level:Z.level}).split(`
-`).slice(2)].join(`
-`);return["## Claude Log Level Usage","",a3,"",...P2({level:J}).split(`
-`).slice(2)].join(`
-`)}var x7="claude-fable-5",D7="claude-mythos-5",e0="claude-fable-5-1",u9="claude-mythos-5-1",n3="claude-haiku-4-5";function R0($){return $.endsWith("[1m]")?$.slice(0,-4):$}var xY={input:1,output:5},o3=[e0,u9],eL=[x7,D7,...o3],Q1={type:"adaptive",display:"summarized"},$T={input:10,output:50,cacheRead:1,cacheWrite5m:12.5,cacheWrite1h:20},ZT={input:10,output:50,cacheRead:0.25,cacheWrite5m:12.5,cacheWrite1h:20},JT=1e6,XT=128000,$N="2026-06-09",ZN="2026-09-01",DY={[x7]:{id:x7,name:"Claude Fable 5"},[D7]:{id:D7,name:"Claude Mythos 5",limited:!0},[e0]:{id:e0,name:"Claude Fable 5.1"},[u9]:{id:u9,name:"Claude Mythos 5.1",limited:!0}},YT={[e0]:DY[e0],[u9]:DY[u9]};function JN($){if(typeof $!=="string")return!1;let Z=R0($);return eL.some((J)=>Z===J||Z.startsWith(`${J}-`))}function XN($){if(typeof $!=="string")return!1;let Z=R0($);return o3.some((J)=>Z===J||Z.startsWith(`${J}-`))}function r3($){if(typeof $!=="string")return!1;let Z=R0($);return Z===e0||Z.startsWith(`${e0}-`)}function GT($){return XN($)?ZN:$N}var OY="claude-sonnet-5",zT=Q1;function QT($){if(typeof $!=="string")return!1;let Z=R0($);return!e3(Z)&&(Z===OY||Z.startsWith(`${OY}-`))}var MY="claude-sonnet-5-5",KT="2026-09-28",WT=1e6,VT=128000,BT={input:2,output:10,cacheRead:0.2,cacheWrite5m:2.5,cacheWrite1h:4},qT=Q1;function e3($){if(typeof $!=="string")return!1;let Z=R0($);return Z===MY||Z.startsWith(`${MY}-`)}var YN="claude-haiku-5-5",jT="2026-10-07",HT=1e6,LT=128000,NT=1e5,UT={input:0.1,output:0.5,cacheRead:0.01,cacheWrite5m:0.125,cacheWrite1h:0.2},xT={input:0.5,output:2.5,cacheRead:0.05,cacheWrite5m:0.625,cacheWrite1h:1},DT=Q1;function GN($){if(typeof $!=="string")return!1;let Z=R0($);return Z===YN||/^claude-haiku-5-5-\d{8}$/.test(Z)}var IY="claude-opus-5",OT=Q1;function zN($){if(typeof $!=="string")return!1;let Z=R0($);return!sJ(Z)&&(Z===IY||Z.startsWith(`${IY}-`))}var _Y="claude-opus-5-5",MT="2026-09-18",IT=1e6,_T=128000,PT={input:4,output:20,cacheRead:0.2,cacheWrite5m:5,cacheWrite1h:8},AT=Q1;function sJ($){if(typeof $!=="string")return!1;let Z=R0($);return Z===_Y||Z.startsWith(`${_Y}-`)}function wT($){return zN($)||sJ($)}function RT($){if(typeof $!=="string")return!1;if($.startsWith("gAAAA"))return!0;if(!$.startsWith("{"))return!1;try{let Z=JSON.parse($);return Z.type==="reasoning"&&typeof Z.id==="string"&&Z.id.startsWith("rs_")&&typeof Z.encrypted_content==="string"&&Z.encrypted_content.startsWith("gAAAA")}catch{return!1}}var TT="mid-conversation-output-config-2026-07-01";function FT($){if($==="minimal")return"low";if($==="low"||$==="medium"||$==="high"||$==="xhigh"||$==="max")return $;return}function CT($){return r3($.model)}function PY($){return process.env[$]?.trim()||void 0}function QN($){if(/^claude-sonnet(?:-|$)/.test($))return"sonnet";if(/^claude-opus(?:-|$)/.test($))return"opus";if(/^claude-haiku(?:-|$)/.test($))return"haiku";if(/^claude-(?:fable|mythos)(?:-|$)/.test($))return"fable";return null}var KN={sonnet:"ANTHROPIC_DEFAULT_SONNET_MODEL",opus:"ANTHROPIC_DEFAULT_OPUS_MODEL",haiku:"ANTHROPIC_DEFAULT_HAIKU_MODEL",fable:"ANTHROPIC_DEFAULT_FABLE_MODEL"};function WN($){if(typeof $!=="string"||!$)return $;let Z=QN($);if(Z){let J=PY(KN[Z]);if(J)return J}if($.startsWith("claude-")){let J=PY("ANTHROPIC_MODEL");if(J)return J}return $}function ST($){if(typeof $.model!=="string")return!1;let Z=WN($.model);if(Z===$.model)return!1;return $.model=Z,!0}var r=process.platform==="win32",RY=new Set;function M7($){if($?.reason==="io-error"){if($.win32Code===2||$.win32Code===3)return"ENOENT";if($.win32Code===80||$.win32Code===183)return"EEXIST"}return $?.code??"ERR_PRIVATE_FILE"}var TY;function c8(){return TY??=import("./index-74r84r5f.js"),TY}class y6 extends Error{path;stage;code;win32Code;reason;published=!1;durabilityConfirmed=!1;fileDurable=!1;attempts=0;elapsedMs=0;orphanPath;constructor($,Z,J){let X=J;super(`Private file refused at ${Z}: ${$} (${X?.reason??X?.code??"io-error"}). Use a safe parent directory. Repair only a named secret file in safe ancestry whose owner the published policy trusts, without changing its owner or any existing directory. Previously exposed credentials may need rotation. Windows requires the private-files native prebuild and an ACL-persisting local filesystem such as NTFS.`,{cause:J});this.path=$,this.stage=Z,this.name="PrivateFileError",this.code=M7(X),this.win32Code=X?.win32Code,this.reason=X?.reason}}async function M$($,Z,J){try{return await J()}catch(X){if(X instanceof y6)throw X;throw new y6($,Z,X)}}var LN;async function P0($,Z){$=W$($),Z??=LN,await M$($,"safe-parent",async()=>{let J=await(await c8()).verifySafeParent($,Z);if(J.ok===!1){if(J.reason==="io-error"||J.reason==="wrong-kind")await $Q($);throw new y6(J.level??J.path,"safe-parent",{...J,code:"ERR_PRIVATE_FILES_SECURITY"})}})}async function Z$($,Z,J=!1){if($=W$($),Z==="directory")return P0($);await M$($,"verify",async()=>{let X=await c8(),Y=await X.verifyOwnerOnly($),G=!1;if(!Y.ok){let{reason:z}=Y.refusal;if(z==="io-error")await X.verifyPrivatePath($,Z);if(J&&[X.EXTRA_ACE,X.NOT_PROTECTED,X.NULL_DACL,X.EMPTY_DACL].includes(z))await P0(N0($)),await X.securePrivatePath($,Z),G=!0;else throw Object.assign(Error("Owner-only verification refused"),{reason:z,code:"ERR_PRIVATE_FILES_SECURITY"})}if(await X.verifyPrivatePath($,Z),G&&!RY.has($))RY.add($),process.emitWarning(`Private permissions tightened: ${$}. This object may have been readable before; rotate credentials if needed.`,"PrivateFileMigration")})}async function s$($,Z=!1,J){$=W$($),await M$($,"directory",async()=>{let X=await c8();try{return await $Q($),await P0($,J)}catch(G){if(M7(G)!=="ENOENT")throw G}let Y=N0($);if(Y===$)throw Object.assign(Error("Missing root"),{code:"ENOENT"});await s$(Y,!1,J);try{await X.createOwnerOnly($,{kind:"dir"})}catch(G){if(M7(G)!=="EEXIST")throw G}await P0($,J)})}async function q0($,Z=!1){if(!r)return ZQ($,"utf8");return(await JQ($,Z)).toString("utf8")}async function JQ($,Z=!1){if(!r)return ZQ($);if($=W$($),Z)await P0(N0($)),await Z$($,"file",!0);return M$($,"read",async()=>(await c8()).readOwnerOnly($))}async function n4($,Z){await P0(N0(W$($))),await M$($,"create",async()=>{await(await c8()).createPrivateFile(W$($),Z)})}async function NN($){await P0(N0(W$($))),await M$($,"directory-create",async()=>{await(await c8()).createOwnerOnly(W$($),{kind:"dir"})})}async function XQ($,Z,J={}){$=W$($),Z=W$(Z);let X=J.now??(()=>performance.now()),Y=X(),G=Math.min(Y+500,J.deadline??1/0),z=[0,10,20,40,80,100],Q,K=0;for(let V of z){if(X()>=G)break;if(V)await(J.sleep??((B)=>new Promise((q)=>setTimeout(q,B))))(Math.min(V,Math.max(0,G-X())));if(X()>=G)break;if(await J.beforeRename?.(),X()>=G)break;K++;try{return await(J.rename??HN)($,Z),{attempts:K,elapsedMs:X()-Y}}catch(B){Q??=B;let q=B;if(!(q.win32Code!==void 0?q.win32Code===32||q.win32Code===33:["EBUSY","EPERM","EACCES"].includes(q.code??"")&&!q.reason))break}}let W=new y6(Z,"rename",Q??Object.assign(Error("Publication deadline expired"),{code:"ETIMEDOUT"}));throw W.attempts=K,W.elapsedMs=X()-Y,W}async function tJ($,Z,J={}){$=W$($),await s$(N0($));try{await Z$($,"file",!0)}catch(W){if(W.code!=="ENOENT")throw W}let X=W$(J.stagePath??`${$}.${jN()}.tmp`);if(N0(X)!==N0($))throw new y6($,"stage-directory",{code:"EXDEV"});let Y=!1,G=!1,z={attempts:0,elapsedMs:0},Q="stage-create",K=(W)=>{try{J.onOutcome?.({path:$,stage:W?.stage??"published",published:G,fileDurable:G,durabilityConfirmed:!1,attempts:W?.attempts??z.attempts,elapsedMs:W?.elapsedMs??z.elapsedMs,...W&&{code:W.code,win32Code:W.win32Code}})}catch{}};try{if(await n4(X,Z),Y=!0,Q="before-rename",z=await XQ(X,$,J),Y=!1,G=!0,Q="published-callback",J.onRenamed?.(),Q="published-verify",await Z$($,"file"),J.durable&&J.durability!=="file-only-on-windows")throw new y6($,"directory-sync-unsupported",{code:"ENOTSUP"});K()}catch(W){let V=W instanceof y6?W:new y6($,Q,W);if(V.published=G,V.fileDurable=G,G)Object.assign(V,z);if(Y){try{await wY(X)}catch{V.orphanPath=X}Y=!1}throw K(V),V}finally{if(Y)await wY(X).catch(()=>{})}}class o4 extends Error{constructor($){super("file or directory sync failed",{cause:$});this.name="AtomicSyncError"}}async function l8($,Z,J={}){await YQ($,Z,J)}async function YQ($,Z,J,X){if(r)return tJ($,J.serialize?J.serialize(Z):`${JSON.stringify(Z,null,2)}
-`,{beforeRename:J.beforeRename,stagePath:`${$}.${(J.stageName??AY)()}.tmp`,onRenamed:X,durable:J.durable,durability:J.durability,onOutcome:J.onOutcome});await VN(O7($),{recursive:!0});let Y=`${$}.${(J.stageName??AY)()}.tmp`,G,z=!1;try{if(G=await a4(Y,"wx",384),z=!0,await G.writeFile(J.serialize?J.serialize(Z):`${JSON.stringify(Z,null,2)}
-`,"utf8"),await G.chmod(384),J.durable)try{await G.sync()}catch(Q){throw new o4(Q)}if(await G.close(),G=void 0,await J.beforeRename?.(),await BN(Y,$),z=!1,X?.(),J.durable){let Q=await a4(O7($),"r");try{await Q.sync()}catch(K){throw new o4(K)}finally{await Q.close()}}}finally{if(await G?.close().catch(()=>{}),z)await qN(Y,{force:!0}).catch(()=>{})}}async function FY($){if(r){await Z$($,"file");let X=new y6($,"directory-sync-unsupported",{code:"ENOTSUP"});throw X.published=!0,X}let Z=await a4($,"r");try{await Z.sync()}finally{await Z.close()}let J=await a4(O7($),"r");try{await J.sync()}finally{await J.close()}}var hT=Object.freeze({sidebar:Object.freeze({name:"sidebar-write",ttlMs:1e4,timeoutMs:15000,renew:!0}),preferences:Object.freeze({name:"preferences",ttlMs:1e4,timeoutMs:2000,renew:!0})});function xN($,Z){return`${$}.${Z}.lock`}class b8 extends Error{details;constructor($){super(`Timed out acquiring ${$.name} lock for ${$.target}`);this.name="LockContentionError",this.details=$}}class T9 extends Error{details;constructor($){super(`Lost ${$.name} lock for ${$.target}`);this.name="LockOwnershipError",this.details=$}}async function d6($,Z,J){let X=performance.now();for(;;){let Y=await T0({path:$,name:Z.name,ttlMs:Z.ttlMs,renew:Z.renew??!1,...Z.onStep?{onStep:Z.onStep}:{},...Z.onRenewalTimer?{onRenewalTimer:Z.onRenewalTimer}:{}});if(Y)try{return await J(Y)}finally{await Y.release()}let G=Z.timeoutMs-(performance.now()-X);if(G<=0)throw new b8({target:$,name:Z.name,timeoutMs:Z.timeoutMs});await new Promise((z)=>setTimeout(z,Math.min(25,Math.ceil(G))))}}var DN=globalThis.setTimeout.bind(globalThis),ON=globalThis.clearTimeout.bind(globalThis);function MN($){let Z=$?.code;return Z==="ENOENT"||!r&&(Z==="EINVAL"||Z==="ENOTDIR")}async function T0($){let Z=xN($.path,$.name),J=EY(Z,"owner.json"),X=o1(),Y=$.now??Date.now,G=null,z=!1,Q=!1,K,W,V=new Promise((F)=>{W=F});function B(F){try{let b=$.onRenewalTimer?.(F);if(b&&(typeof b==="object"||typeof b==="function")&&"then"in b&&typeof b.then==="function")Promise.resolve(b).catch(()=>{})}catch{}}function q(){if(!G)return;ON(G),G=null,B("cancelled")}function H(F,b){if(K||z)return;K=Object.freeze({reason:F,expectedOwnerId:X,...typeof b?.ownerId==="string"?{observedOwnerId:b.ownerId}:{},...typeof b?.expiresAt==="number"?{observedExpiresAt:b.expiresAt}:{}}),q(),W(K)}let j,x=null,L=`${Z}.evicting`,U=EY(L,"owner.json"),M=o1(),A=5000,_=8;async function N(){if(r)try{return JSON.parse(await q0(Z,!0))}catch(F){if(F.code!=="EISDIR"&&F.reason!=="wrong-kind")throw F;return await Z$(Z,"directory",!0),JSON.parse(await q0(J,!0))}try{return JSON.parse(await SY(Z,"utf8"))}catch(F){if(F.code!=="EISDIR")throw F;return JSON.parse(await SY(J,"utf8"))}}async function R(){if(r){let u=await N(),l=Number(u?.expiresAt)-Y();await tJ(Z,`${JSON.stringify({ownerId:X,expiresAt:Y()+$.ttlMs})}
-`,{deadline:performance.now()+Math.max(0,l),beforeRename:async()=>{let t=await N();if(t?.ownerId!==X||!(Number(t?.expiresAt)>Y())||!await O())throw new T9({target:$.path,name:$.name})}});return}let F=`${Z}.${o1()}.tmp`,b,y=!1;try{b=await UN(F,"wx",384),y=!0,await b.writeFile(`${JSON.stringify({ownerId:X,expiresAt:Y()+$.ttlMs})}
-`,"utf8"),await b.chmod(384),await b.close(),b=void 0;let u=await N();if(u?.ownerId!==X||!(Number(u?.expiresAt)>Y())||!await O())throw new T9({target:$.path,name:$.name});await kY(F,Z),y=!1}finally{if(await b?.close().catch(()=>{}),y)await r1(F,{force:!0}).catch(()=>{})}}async function S(){let F=`${JSON.stringify({ownerId:X,expiresAt:Y()+$.ttlMs})}
-`;if(r)await n4(Z,F);else await fY(Z,F,{encoding:"utf8",mode:384,flag:"wx"})}async function E(F){let b=F.code;if(b==="EEXIST"){if(r)await N();return!0}if(b==="EISDIR"){if(r)await Z$(Z,"directory",!0),await q0(J,!0);return!0}return!1}async function m(){if(r)await s$(A2(Z));try{return await S(),!0}catch(F){let b=F.code;if(await E(F))return!1;if(b==="ENOENT"){if(r)await s$(A2(Z));else await CY(A2(Z),{recursive:!0});try{return await S(),!0}catch(y){if(await E(y))return!1;throw y}}throw F}}async function s(){await new Promise((F)=>setTimeout(F,Math.floor(Math.random()*4)))}async function c(F=!0){if(F&&$.onStep)await $.onStep("lock-read-ready");let b;try{b=await N()}catch(u){if(r&&u.code!=="ENOENT")throw u}let y=Number(b?.expiresAt);if(Number.isFinite(y)&&y>Y())return{status:"live"};if(typeof b?.ownerId==="string"&&Number.isFinite(y))return{status:"stale",identity:{kind:"owner",ownerId:b.ownerId,expiresAt:y}};try{let u=await vY(Z),l=Number.isFinite(y)?y:u.mtimeMs+$.ttlMs;if(l>Y())return{status:"live"};return{status:"stale",identity:{kind:"stat",dev:u.dev,ino:u.ino,mtimeMs:u.mtimeMs,expiresAt:l}}}catch(u){if(u.code==="ENOENT"){if($.onStep)await $.onStep("lock-missing");return{status:"missing"}}throw u}}function I(F,b){if(b.status!=="stale")return!1;let y=b.identity;if(F.kind==="owner"&&y.kind==="owner")return F.ownerId===y.ownerId&&F.expiresAt===y.expiresAt;return F.kind==="stat"&&y.kind==="stat"&&F.dev===y.dev&&F.ino===y.ino&&F.mtimeMs===y.mtimeMs&&F.expiresAt===y.expiresAt}async function O(){try{return JSON.parse(await q0(U,r))?.ownerId===M}catch(F){if(r&&F.code!=="ENOENT")throw F;return!1}}async function P(F){if(r)await M$(F,"remove",()=>r1(F,{recursive:!0,force:!0}));else await r1(F,{recursive:!0,force:!0}).catch(()=>{})}async function D(){if(await O())await P(L)}async function T(){if(r)await NN(L);else await CY(L);try{let F=`${JSON.stringify({ownerId:M,createdAt:Y()})}
-`;if(r)await n4(U,F);else await fY(U,F,{encoding:"utf8",mode:384,flag:"wx"})}catch(F){if(MN(F))return!1;throw await D(),F}if($.onStep)await $.onStep("eviction-marker-acquired");return!0}async function C(){let F;try{F=await vY(L)}catch(y){if(y.code==="ENOENT")return"missing";throw y}if(r)await Z$(L,"directory",!0);if(F.mtimeMs+A>Y())return"fresh";if($.onStep)await $.onStep("stale-marker-stat");let b=`${L}.${o1()}`;try{await kY(L,b)}catch(y){if(y.code==="ENOENT")return"missing";throw y}if($.onStep)await $.onStep("stale-marker-claimed");return await P(b),"recovered"}async function k(F){try{if(!await T())return!1}catch(b){if(b.code==="EEXIST"){if(r){await Z$(L,"directory",!0);try{await q0(U,!0)}catch(y){if(y.code!=="ENOENT")throw y}}return!1}throw b}try{await F()}finally{await D()}return!0}async function w(){for(let F=0;F<_;F++){if($.onStep)await $.onStep("relinquish-read");let b;try{b=await N()}catch(y){if(r)throw y;return}if(b?.ownerId!==X)return;try{await r1(Z,{recursive:!0,force:!0});return}catch(y){if(r)throw y;await s()}}}function f(){if(!$.renew||z||K)return;let F=$.renewIntervalMs??Math.max(1000,Math.floor($.ttlMs/3));if(G=DN(()=>{G=null;let b=(async()=>{let y=!z;try{if(!await k(async()=>{let l=await N(),t=Y();if(z||K){y=!1;return}if(l?.ownerId!==X){H("taken-over",l),y=!1;return}if(!(Number(l?.expiresAt)>t)){H("expired",l),y=!1;return}if($.onStep)await $.onStep("renewal-owner-confirmed");if(z||K){y=!1;return}if(!await O())return;if($.onStep)await $.onStep("renewal-write-fenced");if(z||K){y=!1;return}if(!await O())return;if($.onStep)await $.onStep("renewal-write-ready");if(z||K){y=!1;return}if(await R(),$.onStep)await $.onStep("renewal-write-finished");if(!await O()){H("marker-lost"),y=!1,await w();return}})&&$.onStep)await $.onStep("renewal-marker-unavailable")}catch(u){if(r&&u instanceof y6)j=u,H("renewal-failed"),y=!1;try{let l=await N();if(l?.ownerId!==X)H("taken-over",l);else if(!(Number(l?.expiresAt)>Y()))H("expired",l)}catch{H("renewal-failed")}}finally{if($.onStep)try{await $.onStep("renewal-finished")}catch{}if(y&&!z&&!K)f()}})();x=b,b.finally(()=>{if(x===b)x=null})},F),"unref"in G)G.unref();B("scheduled")}function h(){try{let F=$.onContended?.();if(F&&(typeof F==="object"||typeof F==="function")&&"then"in F&&typeof F.then==="function")Promise.resolve(F).catch(()=>{})}catch{}return null}let v=await m();if(!v)for(let F=0;F<_;F++){if(v=await m(),v)break;let b=await c();if(b.status==="live")return h();if(b.status==="missing")continue;if($.onStep)await $.onStep("stale-lock-observed");try{if(!await T()){await s();continue}}catch(y){if(y.code!=="EEXIST")throw y;if(await C()==="fresh")return null;await s();continue}try{let y=await c();if(y.status==="live")return h();if(!I(b.identity,y))continue;if(!await O())return null;if($.onStep)await $.onStep("stale-lock-confirmed");if(!await O())return null;let u=await c(!1);if(!I(b.identity,u))continue;if(await P(Z),!await O())return null;if($.onStep)await $.onStep("stale-lock-removed");if(v=await m(),!v)return null;if($.onStep)await $.onStep("stale-lock-recreated");if(!await O())return await w(),v=!1,null;break}finally{await D()}}if(!v)return null;return f(),{ownerId:X,whenLost:()=>V,hasLost:()=>K!==void 0,assertOwned:async()=>{if(j)throw j;let F;try{let b=await N();if(F=b,!z&&!K&&b?.ownerId===X&&Number(b?.expiresAt)>Y())return;H(b?.ownerId!==X?"taken-over":"expired",b)}catch(b){if(H("unreadable"),r&&b instanceof y6)throw b}throw new T9({target:$.path,name:$.name,expectedOwnerId:X,...typeof F?.ownerId==="string"?{observedOwnerId:F.ownerId}:{},...typeof F?.expiresAt==="number"?{observedExpiresAt:F.expiresAt}:{}})},release:async()=>{if(r&&Q)return;z=!0,q(),await x;for(let F=0;F<_;F++){try{let b=!1;if(await k(async()=>{let u;try{u=await N()}catch(l){if(r&&l.code==="ENOENT"){b=!0;return}throw l}if(u?.ownerId!==X){b=!0;return}if($.onStep)await $.onStep("release-owner-confirmed");if(!await O())return;await P(Z),b=!0})){if(r&&!b)throw new y6(Z,"release-not-confirmed",{code:"EIO"});Q=b;return}await C()}catch(b){if(r)throw b;return}await s()}if(r)throw new y6(Z,"release-not-confirmed",{code:"ETIMEDOUT"})}}}class G6 extends Error{operation;rowId;phase;retryable;kind;committed;constructor($){super($.message??`${$.operation} failed (${$.kind}, ${$.phase})`,$.cause===void 0?void 0:{cause:$.cause});this.name="PoolOperationError",this.operation=$.operation,this.rowId=$.rowId,this.phase=$.phase,this.retryable=$.retryable,this.kind=$.kind,this.committed=$.committed}}class GQ extends Error{operation;constructor($){super(`${$} was called from inside a store hook; hand it to the caller's continuation instead`);this.name="PoolReentryError",this.operation=$}}var RZ="identity-contradicted: ",zQ="duplicate-identity";function g8($,Z,J){let X=$.rosterRow(Z);if(!X)return;X.enabled=!1;let Y=$.entry(Z)??{credentialEpoch:1,needsFirstReading:!0},G=typeof Y.disabledReason==="string"&&Y.disabledReason.startsWith(RZ);$.setEntry(Z,{...Y,disabledReason:G?Y.disabledReason:J})}function I7($,Z){let J=$.rosterRow(Z);if(!J)return;J.enabled=!0;let X=$.entry(Z);if(X&&"disabledReason"in X){let Y={...X};delete Y.disabledReason,$.setEntry(Z,Y)}}function TZ($,Z){let J=$.rows().filter((Y)=>Y.invalid===void 0&&!Y.staged&&Y.type==="oauth"&&Y.enabled&&Y.identity===Z),X=[];for(let Y of J.slice(1))g8($,Y.id,zQ),X.push(Y.id);return X}function FZ($,Z,J){let X=$.rosterRow(Z);if(!X)return[];return X.accountId=J,TZ($,J)}var QQ=new _N;function I$($){if(QQ.getStore()!==void 0)throw new GQ($)}function d8($,Z){return QQ.run($,async()=>await Z())}async function PN($,Z,J,X,Y){if(!Z)return;try{await d8($,()=>Z(J,X))}catch(G){Y?.warn("store failure hook threw; the original failure stands",{operation:$,rowId:J,error:G instanceof Error?G.message:String(G)})}}var h6=Object.freeze({ttlMs:1e4,timeoutMs:15000,retryMs:50,renew:!0});async function AN($,Z,J){let X=(z)=>{try{let Q=J.onLockEvent?.({type:z,name:$.name,path:$.path});if(Q&&(typeof Q==="object"||typeof Q==="function")&&"then"in Q&&typeof Q.then==="function")Promise.resolve(Q).catch(()=>{})}catch{}},Y={...Z,...wN($)},G=performance.now();for(;;){let z=await T0({name:$.name,path:$.path,ttlMs:Y.ttlMs,now:J.now,renew:Y.renew,onContended:()=>X("contended"),...J.onRenewalTimer?{onRenewalTimer:(W)=>J.onRenewalTimer?.({name:$.name,path:$.path},W)}:{},...Y.renewIntervalMs!==void 0?{renewIntervalMs:Y.renewIntervalMs}:{},...J.onLockStep?{onStep:(W)=>J.onLockStep?.({name:$.name,path:$.path},W)}:{}});if(z){X("acquired");let W={name:$.name,path:$.path,assertOwned:()=>z.assertOwned(),release:async()=>{await z.release(),X("released")}};try{await W.assertOwned()}catch(V){throw await W.release(),V}return W}let Q=Y.timeoutMs-(performance.now()-G);if(Q<=0)throw new b8({target:$.path,name:$.name,timeoutMs:Y.timeoutMs});let K=Math.floor(Math.random()*(Y.retryMs+1));await new Promise((W)=>setTimeout(W,Math.min(Y.retryMs+K,Q)))}}function wN($){let Z={};if($.ttlMs!==void 0)Z.ttlMs=$.ttlMs;if($.timeoutMs!==void 0)Z.timeoutMs=$.timeoutMs;if($.retryMs!==void 0)Z.retryMs=$.retryMs;if($.renew!==void 0)Z.renew=$.renew;if($.renewIntervalMs!==void 0)Z.renewIntervalMs=$.renewIntervalMs;return Z}class K1{defaults;env;held=[];constructor($,Z){this.defaults=$,this.env=Z}async acquire($){let Z=await AN($,this.defaults,this.env);return this.held.push(Z),await this.assertAll(),Z}async assertAll(){for(let $ of this.held)await $.assertOwned()}async releaseTo($){while(this.held.length>$)await this.held.pop()?.release().catch(()=>{})}async releaseAll(){await this.releaseTo(0)}}function r4($,Z,J){if(J!==void 0)throw new G6({operation:$,rowId:Z,kind:"row-staged",phase:$==="pull"?"pull":"before-first-write",retryable:!1,message:`row ${Z} is reserved for roster publication`})}var L6="commonAuthPool",p9=1,l$="rows",L4="retiredEpochs",_7=1,KQ=300000,q6=L6;function RN($){let Z=JSON.parse(JSON.stringify($)),J=(X)=>{if(Array.isArray(X))return`[${X.map(J).join(",")}]`;if(d(X))return`{${Object.keys(X).sort().map((Y)=>`${JSON.stringify(Y)}:${J(X[Y])}`).join(",")}}`;return JSON.stringify(X)};return J(Z)}function c9($){return W1("sha256").update(RN($)).digest("hex")}function WQ($){if(!d($)||Object.keys($).length!==1||typeof $.reservation!=="string"||!$.reservation)return;return{reservation:$.reservation}}function TN($){if(!d($)||typeof $.reservation!=="string"||!$.reservation||typeof $.disabledReason!=="string")return;if(Object.keys($).some((Z)=>!["reservation","label","disabledReason","providerState"].includes(Z)))return;if("label"in $&&typeof $.label!=="string")return;if("providerState"in $&&(typeof $.providerState!=="string"||!/^[a-f0-9]{64}$/.test($.providerState)))return;return $}var D$="commonAuthProviderState";function d($){return $!=null&&typeof $==="object"&&!Array.isArray($)}var FN=new Set(["__proto__","constructor","prototype"]);function e4($){if(typeof $!=="string"||$.length===0)return"id must be non-empty";if($.trim()!==$)return"id must not carry surrounding whitespace";if(FN.has($))return"id is a reserved object key";return}function aJ($){let Z=typeof $==="string"?$.trim():"";if(!Z)return!1;try{let J=new URL(Z);return(J.protocol==="http:"||J.protocol==="https:")&&!J.username&&!J.password}catch{return!1}}function VQ($){return $.type==="oauth"?`oauth\x00${$.refresh}`:`api\x00${$.apiKey}`}function I6($){return W1("sha256").update(VQ($)).digest("hex")}function X8($){return W1("sha256").update(`credential-stamp\x00${VQ($)}`).digest("hex")}function i0($){let Z=$.type==="oauth"?["oauth",typeof $.access==="string"?$.access:null,$.refresh,typeof $.expires==="number"&&Number.isFinite($.expires)?$.expires:null]:["api",$.apiKey,$.baseURL.trim(),$.authHeader??"authorization-bearer"];return W1("sha256").update(`credential-dispatch\x00${JSON.stringify(Z)}`).digest("hex")}function BQ($,Z,J,X={}){return{credentialEpoch:Z,digest:X8($),dispatch:i0($),binding:{...J},...X.replace?{replace:!0}:{},...X.providerState!==void 0?{providerState:X.providerState}:{}}}function CZ($,Z){let J=$?.credentialBound?$.credentialBound(Z):Z;return W1("sha256").update(`provider-state\x00${JSON.stringify(J??null)}`).digest("hex")}function nJ($,Z,J,X){if(!Z||J===void 0)return;if(!d($)||!Object.hasOwn($,D$))return;let Y=v$($[q6]);if(!Y||Y.providerState===void 0||Y.digest!==X8(Z)||Y.credentialEpoch!==J||Y.binding?.identity!==X)return;return Y.providerState}function Y$($){return Number.isSafeInteger($)&&$>=1}function v$($){if(!d($))return;let Z=$.credentialEpoch;if(!Y$(Z))return;if(typeof $.digest!=="string")return;if("dispatch"in $&&typeof $.dispatch!=="string")return;if("replace"in $&&$.replace!==!0)return;if("providerState"in $&&typeof $.providerState!=="string")return;let J="staged"in $?TN($.staged):void 0;if("staged"in $&&!J)return;let X={...J?{staged:J}:{},...typeof $.dispatch==="string"?{dispatch:$.dispatch}:{},...$.replace===!0?{replace:!0}:{},...typeof $.providerState==="string"?{providerState:$.providerState}:{}};if(!("binding"in $))return"dispatch"in $||"replace"in $||"providerState"in $||"staged"in $?void 0:{credentialEpoch:Z,digest:$.digest};let Y=$.binding;if(!d(Y))return;if("identity"in Y&&(typeof Y.identity!=="string"||!Y.identity))return;if("baseURL"in Y&&!aJ(Y.baseURL))return;if("authHeader"in Y&&Y.authHeader!=="authorization-bearer"&&Y.authHeader!=="x-api-key")return;return{credentialEpoch:Z,digest:$.digest,...X,binding:{...typeof Y.identity==="string"?{identity:Y.identity}:{},...typeof Y.baseURL==="string"?{baseURL:Y.baseURL.trim()}:{},...Y.authHeader==="authorization-bearer"||Y.authHeader==="x-api-key"?{authHeader:Y.authHeader}:{}}}}function CN($,Z,J){if($.identity!==J)return!1;if($.baseURL!==void 0&&(Z.type!=="api"||Z.baseURL!==$.baseURL))return!1;if($.authHeader!==void 0&&(Z.type!=="api"||Z.authHeader!==$.authHeader))return!1;return!0}function SN($,Z,J,X){if(!$)return"none";if(!d(X)||!Object.hasOwn(X,q6))return"missing";let Y=v$(X[q6]);if(!Y)return"malformed";if(Y.digest!==X8($))return"mismatched";if(Y.dispatch===void 0)return"legacy";if(Y.credentialEpoch!==Z)return"mismatched";if(!Y.binding||!CN(Y.binding,$,J))return"mismatched";if(Y.dispatch!==i0($))return"mismatched";return"bound"}function kN($){if(!$.exists)return{status:"ready",exists:!1,config:{}};if("parseError"in $)return{status:"error",reason:"config file is not valid JSON"};let Z=$.value;if(!d(Z))return{status:"error",reason:"config root is not an object"};if("accounts"in Z&&!Array.isArray(Z.accounts))return{status:"error",reason:"config accounts is not an array"};if(!(L6 in Z))return Array.isArray(Z.accounts)?{status:"pending-migration",config:Z}:{status:"ready",exists:!0,config:Z};let J=Z[L6];if(!d(J))return{status:"error",reason:`${L6} is not an object`};let X=J.schemaVersion;if(typeof X!=="number"||!Number.isInteger(X)||X<1)return{status:"error",reason:`${L6}.schemaVersion is invalid`};if(X>p9)return{status:"error",reason:`${L6}.schemaVersion ${X} is newer than ${p9}`};if(l$ in J&&!d(J[l$]))return{status:"error",reason:`${L6}.${l$} is not an object`};return{status:"ready",exists:!0,config:Z}}function vN($){if(!$.exists)return{status:"ready",exists:!1,state:{}};if("parseError"in $)return{status:"error",reason:"state file is not valid JSON"};if(!d($.value))return{status:"error",reason:"state root is not an object"};if("accounts"in $.value&&!d($.value.accounts))return{status:"error",reason:"state accounts is not an object"};return{status:"ready",exists:!0,state:$.value}}function SZ($){return Array.isArray($.accounts)?$.accounts:[]}function qQ($){let Z=$[L6];if(!d(Z))return{};let J=Z[l$];return d(J)?J:{}}function fN($){return d($.accounts)?$.accounts:{}}function EN($){if(!d($))return"not an object";let Z=e4($.id);if(Z)return Z;if($.type==="api")return aJ($.baseURL)?void 0:"invalid baseURL";if($.type==="oauth")return;return"unknown type"}function bN($,Z){if(!d($))return;let J=$.credentialEpoch;if(!Y$(J))return;if("needsFirstReading"in $&&typeof $.needsFirstReading!=="boolean")return;if("disabledReason"in $&&typeof $.disabledReason!=="string")return;let X="quota"in $&&Z.decode?Z.decode($.quota):$.quota;if("quota"in $&&!Z.validate(X))return;if("staged"in $&&!WQ($.staged))return;return{credentialEpoch:J,needsFirstReading:$.needsFirstReading===!0,...typeof $.disabledReason==="string"?{disabledReason:$.disabledReason}:{},..."quota"in $?{quota:X}:{}}}function gN($,Z){if(!d(Z))return;if($.type==="api"){let X=typeof Z.apiKey==="string"?Z.apiKey.trim():"";if(!X)return;return{type:"api",apiKey:X,baseURL:String($.baseURL).trim(),authHeader:$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer"}}if($.corrupt===!0)return;let J=Z.refresh;if(typeof J!=="string"||!J.trim())return;return{type:"oauth",refresh:J,...typeof Z.access==="string"?{access:Z.access}:{},...typeof Z.expires==="number"?{expires:Z.expires}:{},...typeof Z.lastRefreshedAt==="number"?{lastRefreshedAt:Z.lastRefreshedAt}:{}}}function jQ($,Z){return SZ($).find((J)=>d(J)&&J.id===Z)}function HQ($){if(!d($[L6]))$[L6]={};return $[L6]}function LQ($){let Z=HQ($);if(!d(Z[l$]))Z[l$]={};return Z[l$]}function V1($,Z){let J=qQ($),X=Object.hasOwn(J,Z)?J[Z]:void 0;return d(X)?X:void 0}function NQ($,Z,J){Object.defineProperty(LQ($),Z,{value:J,enumerable:!0,writable:!0,configurable:!0})}function UQ($,Z){let J=$[L6];if(!d(J))return;let X=J[L4];if(!d(X)||!Object.hasOwn(X,Z))return;let Y=X[Z];return Y$(Y)?Y:void 0}function xQ($,Z){let J=V1($,Z)?.credentialEpoch;return Y$(J)?J:void 0}function oJ($,Z){return Math.max(UQ($,Z)??0,xQ($,Z)??0)+1}function yN($,Z){let J=[...Z];if(J.length===0)return;let X=HQ($),Y=d(X[L4])?X[L4]:{},G={},z=(Q,K)=>Object.defineProperty(G,Q,{value:K,enumerable:!0,writable:!0,configurable:!0});for(let[Q,K]of Object.entries(Y))if(Y$(K))z(Q,K);for(let Q of J)z(Q,Math.max(UQ($,Q)??0,xQ($,Q)??1));X[L4]=G}function i8($,Z,J,X){let Y=qQ($),G=fN(Z),z=new Set,Q=[];for(let K of SZ($)){let W=EN(K),V=d(K)&&typeof K.id==="string"?K.id:void 0,B=V===void 0?void 0:Y[V],q=d(B)&&Object.hasOwn(B,"staged"),H=q?WQ(B.staged):void 0;if(W||!d(K)||V===void 0||z.has(V)){if(V!==void 0&&!z.has(V))z.add(V);if(V!==void 0)Q.push({id:V,type:d(K)&&K.type==="api"?"api":"oauth",enabled:!1,needsFirstReading:!0,hasEntry:Object.hasOwn(Y,V),candidate:!1,invalid:"roster",stamp:"none",...H?{staged:H}:{}});continue}z.add(V);let j=K.type==="api"?"api":"oauth",x=Object.hasOwn(Y,V),L=x?bN(Y[V],J):void 0,U=gN(K,G[V]),M=K.enabled!==!1,A=L?L.credentialEpoch:x?void 0:1,_=typeof K.accountId==="string"&&K.accountId?K.accountId:void 0,N={id:V,type:j,enabled:M,needsFirstReading:L?L.needsFirstReading:j==="oauth",hasEntry:x,candidate:!1,...typeof K.label==="string"?{label:K.label}:{},...typeof K.addedAt==="number"?{addedAt:K.addedAt}:{},..._!==void 0?{identity:_}:{},...U?{credential:U,fingerprint:I6(U)}:{},...L?{credentialEpoch:L.credentialEpoch}:{},...H?{staged:H}:{},...L?.disabledReason!==void 0?{disabledReason:L.disabledReason}:{},...L&&"quota"in L?{quota:L.quota}:{},...hN(G[V],U,A,_,X),stamp:SN(U,A,_,G[V])};if(x&&!L)N.invalid="entry";else N.candidate=M&&U!==void 0&&!q;Q.push(N)}return Q}function hN($,Z,J,X,Y){if(!d($)||!Object.hasOwn($,D$))return{};let G=nJ($,Z,J,X);if(G===void 0)return{providerStateDropped:"uncovered"};let z=$[D$];if(!Y?.validate(z))return{providerStateDropped:"invalid"};if(CZ(Y,z)!==G)return{providerStateDropped:"uncovered"};return{providerState:z}}function F6($){return $.identity??$.id}function rJ($,Z){if($===void 0||$>Z+KQ)return Z;return Math.max(Z,$+1)}function bY($,Z){return rJ($,Z)>Z+KQ}function l9($){let{id:Z,credential:J,identity:X,label:Y,addedAt:G}=$;return{id:Z,...Y!==void 0?{label:Y}:{},type:J.type,addedAt:G,...X!==void 0?{accountId:X}:{},...J.type==="api"?{baseURL:J.baseURL.trim(),authHeader:J.authHeader??"authorization-bearer"}:{}}}function mN($,Z){if($.type==="api")return{apiKey:$.apiKey};return{...$.access!==void 0?{access:$.access}:{},refresh:$.refresh,...$.expires!==void 0?{expires:$.expires}:{},...Z!==void 0?{lastRefreshedAt:Z}:{}}}function uN($,Z){if($.type==="api")return{...$,baseURL:$.baseURL.trim(),authHeader:$.authHeader??"authorization-bearer"};return{...$,...Z!==void 0?{lastRefreshedAt:Z}:{}}}function pN($,Z={}){if(!d($))return"credential must be an object";if($.type==="oauth"){if(typeof $.refresh!=="string"||!$.refresh.trim())return"oauth credential needs a refresh token";return}if($.type==="api"){if(typeof $.apiKey!=="string"||!$.apiKey.trim())return"api credential needs an api key";if($.apiKey.trim()!==$.apiKey)return"api key must not carry surrounding whitespace";if(!(Z.baseURLOptional&&$.baseURL===void 0)&&!aJ($.baseURL))return"api credential needs a valid baseURL";return}return"credential type must be oauth or api"}var eJ="transition",DQ="transitionMark";function cN($){if(!d($))return;let Z=$[eJ];if(!d(Z))return;if(typeof Z.mark!=="string"||Z.mark.length===0)return;if(Z.enabled===!0)return{mark:Z.mark,enabled:!0};if(Z.enabled===!1&&typeof Z.reason==="string")return{mark:Z.mark,enabled:!1,reason:Z.reason};return}function $5($,Z,J){if(J.enabled)I7($,Z);else g8($,Z,J.reason??"");if(!$.rosterRow(Z))return;let X=$.entry(Z)??{credentialEpoch:1,needsFirstReading:!0};if($.setEntry(Z,{...X,[DQ]:J.mark}),!J.enabled)return;let Y=$.rows().find((G)=>G.id===Z);if(Y?.type==="oauth"&&Y.identity!==void 0)TZ($,Y.identity)}function lN($,Z){if($.type!=="api")return $;return{...$,...Z.baseURL!==void 0?{baseURL:Z.baseURL}:{},...Z.authHeader!==void 0?{authHeader:Z.authHeader}:{}}}function dN($){if(!$.binding)return!1;return $.replace===!0||$.dispatch===void 0}function iN($,Z,J,X={}){let Y=d(Z.accounts)?Z.accounts:{},G=new Map;for(let z of i8($,Z,J)){if(z.invalid||z.staged||!z.credential)continue;let Q=Object.hasOwn(Y,z.id)?Y[z.id]:void 0;if(!d(Q))continue;let K=v$(Q[q6]);if(!K?.binding)continue;if(K.digest!==X8(z.credential))continue;let W=z.credentialEpoch??1;if(K.credentialEpoch>W){if(!dN(K))continue;if(X.requireCredentialStamps){if(K.dispatch===void 0)continue;if(K.dispatch!==i0(lN(z.credential,K.binding)))continue}G.set(z.id,{kind:"replace",stamp:{...K,binding:K.binding}})}else if(K.credentialEpoch===W&&K.dispatch!==void 0&&K.dispatch===i0(z.credential)&&K.binding.identity!==void 0&&z.identity===void 0)G.set(z.id,{kind:"identity",identity:K.binding.identity});else if(K.credentialEpoch===W&&K.binding.identity===z.identity){if(X.requireCredentialStamps&&K.dispatch!==i0(z.credential))continue;let V=cN(Q[q6]);if(V&&V1($,z.id)?.[DQ]!==V.mark)G.set(z.id,{kind:"transition",transition:V})}}return G}function OQ($,Z,J,X){let G={...$.entry(Z)??{},credentialEpoch:J,needsFirstReading:!0};if(delete G.quota,X.identity!==void 0&&typeof G.disabledReason==="string"&&G.disabledReason.startsWith(RZ))delete G.disabledReason;$.setEntry(Z,G);let z=$.rosterRow(Z);if(!z)return;if(X.identity!==void 0)z.accountId=X.identity;else delete z.accountId;if(X.baseURL!==void 0)z.baseURL=X.baseURL;if(X.authHeader!==void 0)z.authHeader=X.authHeader}function MQ($,Z,J,X={}){let Y=iN($,Z,J,X);if(Y.size===0)return{config:$,torn:[]};let G=structuredClone($),z={rows:()=>i8(G,Z,J),rosterRow:(Q)=>jQ(G,Q),entry:(Q)=>V1(G,Q),setEntry:(Q,K)=>NQ(G,Q,K)};for(let[Q,K]of Y)if(K.kind==="replace")OQ(z,Q,K.stamp.credentialEpoch,K.stamp.binding);for(let[Q,K]of Y)if(K.kind==="identity")FZ(z,Q,K.identity);else if(K.kind==="transition")$5(z,Q,K.transition);else if(K.stamp.binding.identity!==void 0)TZ(z,K.stamp.binding.identity);return{config:G,torn:[...Y.keys()]}}function IQ($,Z,J,X={}){let{config:Y,torn:G}=MQ($,Z,J,X),z=i8(Y,Z,J,X.providerState);for(let Q of z){if(G.includes(Q.id))Q.torn=!0,Q.candidate=!1;if(X.requireCredentialStamps&&Q.stamp!=="bound")Q.unbound=!0,Q.candidate=!1}return z}async function w2($){try{return await q0($,r)}catch(Z){if(Z.code==="ENOENT")return;throw Z}}function gY($){if($===void 0)return{exists:!1};try{return{exists:!0,value:JSON.parse($)}}catch(Z){return{exists:!0,parseError:Z}}}async function f$($){for(let Z=0;Z<3;Z++){let J=await w2($.configPath),X=await w2($.statePath),Y=await w2($.configPath);if(J!==Y){if(Z<2)await IN(2+Math.floor(Math.random()*4));continue}let G=kN(gY(J));if(G.status==="error")return{status:"error",file:"config",reason:G.reason};let z=vN(gY(X));if(z.status==="error")return{status:"error",file:"state",reason:z.reason};if(G.status==="pending-migration")return{status:"pending-migration",config:G.config};return{status:"ready",configExists:G.exists,stateExists:z.exists,config:G.config,state:z.state,rows:IQ(G.config,z.state,$.codec,{requireCredentialStamps:$.requireCredentialStamps===!0,...$.providerState?{providerState:$.providerState}:{}})}}return{status:"error",file:"config",kind:"snapshot-contended",retryable:!0,reason:"The store was changing; retry the operation once writes settle."}}function Y8($,Z,J,X="before-first-write"){if($.status==="error"&&$.kind==="snapshot-contended")return new G6({operation:Z,...J!==void 0?{rowId:J}:{},phase:X,kind:"snapshot-contended",retryable:!0,message:$.reason});return new G6({operation:Z,...J!==void 0?{rowId:J}:{},phase:X,retryable:!1,kind:$.status==="pending-migration"?"pending-migration":"load-error",message:$.status==="pending-migration"?"the config holds a legacy roster that has not been migrated into the pool":`${$.file} file cannot be loaded: ${$.reason}`})}class _Q{ctx;snapshot;locks;progress;info;config;state;constructor($,Z,J,X,Y){this.ctx=$,this.snapshot=Z,this.locks=J,this.progress=X,this.info=Y,this.config=structuredClone(Z.config),this.state=structuredClone(Z.state)}rows(){return IQ(this.config,this.state,this.ctx.codec,{requireCredentialStamps:this.ctx.requireCredentialStamps===!0,...this.ctx.providerState?{providerState:this.ctx.providerState}:{}})}row($){return this.rows().find((Z)=>Z.id===$)}reservation($){if(this.rosterRow($)){let J=this.entry($);return J&&Object.hasOwn(J,"staged")?J.staged:void 0}let Z=this.stateAccount($)?.[q6];return d(Z)&&Object.hasOwn(Z,"staged")?Z.staged:void 0}assertNotStaged($){r4(this.info.operation,$,this.reservation($))}roster(){if(!Array.isArray(this.config.accounts))this.config.accounts=[];return this.config.accounts}rosterRow($){return this.roster(),jQ(this.config,$)}dropRosterRows($){let Z=this.roster(),J=Z.filter((X)=>!(d(X)&&X.id===$));return this.config.accounts=J,Z.length-J.length}entries(){return LQ(this.config)}entry($){return this.entries(),V1(this.config,$)}setEntry($,Z){NQ(this.config,$,Z)}async completeTorn(){let{config:$,torn:Z}=MQ(this.config,this.state,this.ctx.codec,{requireCredentialStamps:this.ctx.requireCredentialStamps===!0});if(Z.length===0)return;this.config=$,await this.commitConfig({counted:!1})}stateAccount($){let Z=d(this.state.accounts)?this.state.accounts:{},J=Object.hasOwn(Z,$)?Z[$]:void 0;return d(J)?J:void 0}dropStateAccount($){if(d(this.state.accounts)&&Object.hasOwn(this.state.accounts,$))delete this.state.accounts[$]}setStateAccount($,Z){if(!d(this.state.accounts))this.state.accounts={};Object.defineProperty(this.state.accounts,$,{value:Z,enumerable:!0,writable:!0,configurable:!0})}async commitConfig($={}){let Z=this.roster(),J=new Set;for(let K of Z)if(d(K)&&typeof K.id==="string")J.add(K.id);let X=new Set;for(let K of SZ(this.snapshot.config))if(d(K)&&typeof K.id==="string"&&!J.has(K.id))X.add(K.id);for(let K of Object.keys(this.entries()))if(!J.has(K))X.add(K);yN(this.config,X);let Y=this.entries(),G={};for(let[K,W]of Object.entries(Y))if(J.has(K))Object.defineProperty(G,K,{value:W,enumerable:!0,writable:!0,configurable:!0});let z=this.config[L6],Q={...this.config,version:_7,accounts:Z,[L6]:{...z,schemaVersion:p9,[l$]:G}};await this.write(this.ctx.configPath,Q,"config",$.counted??!0,$.durable??!1,()=>{if($.publicationDecision)this.markPublicationDecision();for(let K of X)this.ctx.removedIds.add(K);this.config=Q}),this.config=Q}async commitState($,Z={}){let J={...this.state,version:_7,accounts:d(this.state.accounts)?this.state.accounts:{}};if(await this.write(this.ctx.statePath,J,"state",!0,Z.durable??!1),this.state=J,$)this.progress.committed=$}async assertAll(){await this.locks.assertAll()}async syncState(){await this.assertAll();try{if(this.snapshot.stateExists)await FY(this.ctx.statePath)}catch($){throw new G6({operation:this.info.operation,rowId:this.info.rowId,phase:"before-first-write",kind:"publication-sync",retryable:!0,message:"Publication sync failed before the decision; nothing was written. Retry the same plan.",cause:$})}}markPublicationDecision(){this.progress.publicationDecided=!0}async syncConfig(){await this.assertAll(),await FY(this.ctx.configPath)}async write($,Z,J,X=!0,Y=!1,G){await YQ($,Z,{durable:Y,beforeRename:async()=>{await this.ctx.onStep?.(`before-${J}-write`,this.info),await this.locks.assertAll()}},()=>{if(X)this.progress.writes++;G?.()}),await this.ctx.onStep?.(`after-${J}-write`,this.info)}}async function sN($,Z){let J=new K1($.lockDefaults,$.lockEnv),X={writes:0};try{for(let Q of $.storeLocks)await J.acquire(Q);let Y=await f$($);if(Y.status==="error")throw Y8(Y,"initialize",void 0);if(Y.status==="ready")return"already-ready";let G={};for(let[Q,K]of Object.entries(Y.config))if(!Z.includes(Q))G[Q]=K;G.version=_7,G[L6]={schemaVersion:p9,[l$]:{}};let z={operation:"initialize",rowId:void 0};return await l8($.configPath,G,{beforeRename:async()=>{await $.onStep?.("before-config-write",z),await J.assertAll()}}),X.writes++,await $.onStep?.("after-config-write",z),"initialized"}catch(Y){throw kZ(Y,"initialize",void 0,X)}finally{await J.releaseAll()}}async function G$($,Z,J,X,Y,G={}){let z=Z.held.length;try{for(let W of $.storeLocks)await Z.acquire(W);let Q=await f$($);if(Q.status!=="ready")throw Y8(Q,X.operation,X.rowId,J.writes>0?"after-first-write":"before-first-write");let K=new _Q($,Q,Z,J,X);if(X.rowId!==void 0&&!["add","remove","pull","publishRoster","enable","disable"].includes(X.operation))K.assertNotStaged(X.rowId);if(G.completeTorn??!0)await K.completeTorn();return await Y(K)}finally{await Z.releaseTo(z)}}function kZ($,Z,J,X){let Y=Z==="pull"?"pull":X.writes>0?"after-first-write":"before-first-write",G=Y==="after-first-write"?X.committed:void 0;if(Z==="publishRoster"&&X.publicationDecided)return new G6({operation:Z,...J!==void 0?{rowId:J}:{},phase:Y,kind:"publication-incomplete",retryable:!0,message:"The publication may already be decided. Replay the same plan or check publication(operationId).",cause:$});if(Z==="publishRoster"&&$ instanceof o4)return new G6({operation:Z,...J!==void 0?{rowId:J}:{},phase:Y,kind:"publication-sync",retryable:!0,message:"Publication sync failed before the decision; nothing was written. Retry the same plan.",cause:$});if($ instanceof G6){if($.phase===Y&&$.rowId===J&&$.operation===Z&&$.committed===G)return $;return new G6({operation:Z,...J!==void 0?{rowId:J}:{},phase:$.kind==="after-persist-hook"?$.phase:Y,retryable:$.retryable,kind:$.kind,...$.committed??G?{committed:$.committed??G}:{},message:$.message,...$.cause!==void 0?{cause:$.cause}:{}})}let z={operation:Z,...J!==void 0?{rowId:J}:{},phase:Y,...G?{committed:G}:{},cause:$};if($ instanceof T9)return new G6({...z,retryable:!0,kind:"lock-ownership",message:Y==="after-first-write"?`${Z} lost a lease after its first write; the intermediate stays on disk`:`${Z} lost a lease before writing; nothing was written`});if($ instanceof b8)return new G6({...z,retryable:!0,kind:"lock-contention",message:$.message});return new G6({...z,retryable:!1,kind:"unexpected",message:$ instanceof Error?$.message:String($)})}async function _$($,Z,J,X,Y){let G=new K1($.lockDefaults,$.lockEnv),z={writes:0};try{return await Y(G,z)}catch(Q){let K=kZ(Q,Z,J,z);if(K.kind!=="after-persist-hook")await PN(Z,X,J,K,$.logger);throw K}finally{await G.releaseAll()}}function e$($,Z){return{...$.rowLockOptions,name:`row-${encodeURIComponent(F6(Z))}`,path:$.ctx.statePath}}async function s8($,Z,J){let X=await f$($.ctx);if(X.status!=="ready")throw Y8(X,Z,J);let Y=X.rows.find((W)=>W.id===J),G=V1(X.config,J),z=X.state.accounts,Q=d(z)&&Object.hasOwn(z,J)?z[J]:void 0,K=d(Q)?Q[q6]:void 0;if(Y&&!["enable","disable"].includes(Z)&&G&&Object.hasOwn(G,"staged"))r4(Z,J,G.staged);if(!Y&&d(K)&&Object.hasOwn(K,"staged"))r4(Z,J,K.staged);if(!Y)throw A0(Z,J);return{result:X,row:Y}}function A0($,Z){return new G6({operation:$,rowId:Z,phase:$==="pull"?"pull":"before-first-write",retryable:!1,kind:"unknown-row",message:`no row ${Z} in the pool`})}function E$($,Z){if(Z.unbound)throw p($,Z.id,"unbound-credential",`row ${Z.id}'s credential is not the one this store stamped for it (stamp ${Z.stamp}); replace it with fresh material`)}function p($,Z,J,X,Y=!1){return new G6({operation:$,rowId:Z,phase:$==="pull"?"pull":"before-first-write",retryable:Y,kind:J,message:X})}async function PQ($,Z,J,X){let{ctx:Y}=$,G=new K1(Y.lockDefaults,Y.lockEnv),z={writes:0};try{if(!Y$(J?.credentialEpoch))throw p("pull",Z,"invalid-input","the credential epoch the reading was issued for must be a positive safe integer");await G$(Y,G,z,{operation:"pull",rowId:Z},async(Q)=>{Q.assertNotStaged(Z);let K=Q.row(Z);if(!K)throw A0("pull",Z);if(K.invalid)throw p("pull",Z,"invalid-row",`row ${Z} is invalid`);if(!K.credential)throw p("pull",Z,"no-credential",`row ${Z} holds no credential`);E$("pull",K);let W=Q.entry(Z);if(K.torn||!W||W.credentialEpoch!==J.credentialEpoch||K.identity!==J.identity)throw new G6({operation:"pull",rowId:Z,phase:"pull",retryable:!0,kind:"attribution",message:`quota for ${Z} was issued for a credential the row no longer holds`});let V=Y.codec.merge(W.quota,X);if(!Y.codec.validate(V))throw p("pull",Z,"invalid-quota","the quota codec rejected the merged map");Q.setEntry(Z,{...W,quota:V,needsFirstReading:!1}),await Q.commitConfig()},{completeTorn:!1})}catch(Q){throw kZ(Q,"pull",Z,z)}finally{await G.releaseAll()}}function G8($,Z,J,X,Y="the provider state"){if(!$)throw p(Z,J,"invalid-input","the store was opened without a provider-state codec");let G;try{let z=JSON.stringify(X);G=z===void 0?void 0:JSON.parse(z)}catch{G=void 0}if(G===void 0)throw p(Z,J,"invalid-provider-state",`${Y} cannot be stored as JSON`);if(!$.validate(G))throw p(Z,J,"invalid-provider-state",`the provider-state codec rejected ${Y}`);return G}function Z5($,Z,J,X,Y){if(X===void 0||!$?.merge)return{kind:"set",value:Y};return{kind:"set",value:G8($,Z,J,$.merge(structuredClone(X),structuredClone(Y)),"the merged provider state")}}function tN($,Z,J,X,Y){let G=$?.onReplace,z=G?G(Z.providerState===void 0?void 0:structuredClone(Z.providerState),{id:Z.id,credentialEpoch:J,...Z.identity!==void 0?{previousIdentity:Z.identity}:{},...X!==void 0?{identity:X}:{},...Y!==void 0?{incoming:structuredClone(Y)}:{}}):Y;if(z===void 0)return{kind:"clear"};if(!G)return{kind:"set",value:z};return{kind:"set",value:G8($,"replace",Z.id,z,"the provider state onReplace returned")}}function aN($,Z,J,X,Y){if(Z.kind==="set")return CZ($,Z.value);if(Z.kind==="clear")return;return nJ(J,X?.credential,Y,X?.identity)}async function nN($,Z,J,X,Y={}){I$("updateProviderState");let{ctx:G}=$,z="updateProviderState";return _$(G,z,Z,Y.onFailure,async(Q,K)=>{let W=G.providerState;if(!W)throw p(z,Z,"invalid-input","the store was opened without a provider-state codec");if(typeof X!=="function")throw p(z,Z,"invalid-input","a mutator is required");let V=d(J)?J.credentialEpoch:void 0;if(!Y$(V))throw p(z,Z,"invalid-input","the credential epoch the provider state was read at is required");let{row:B}=await s8($,z,Z);await Q.acquire(e$($,B));for(let q of Y.extraLocks??[])await Q.acquire(q);return G$(G,Q,K,{operation:z,rowId:Z},async(q)=>{let H=q.row(Z);if(!H)throw A0(z,Z);if(F6(H)!==F6(B))throw p(z,Z,"row-key-changed",`row ${Z}'s wire identity changed while its lock was being taken`,!0);if(H.invalid)throw p(z,Z,"invalid-row",`row ${Z} failed validation`);if(!H.credential)throw p(z,Z,"no-credential",`row ${Z} holds no credential`);if(E$(z,H),(H.credentialEpoch??1)!==V||H.identity!==J.identity)throw p(z,Z,"attribution",`the provider state for ${Z} was read for a credential or account the row no longer holds`,!0);let x=await AQ(q,W,z,H,X);if(x.kind!=="changed")return{id:Z,outcome:"unchanged",...x.kind==="unchanged"&&x.value!==void 0?{providerState:x.value}:{}};return q.setStateAccount(Z,x.account),await q.commitState(),x.value===void 0?{id:Z,outcome:"cleared"}:{id:Z,outcome:"updated",providerState:x.value}})})}var oN=Symbol.for("@cortexkit/common-auth/store/decline-transition");async function AQ($,Z,J,X,Y,G=!1){let{id:z,credential:Q}=X;if(!Q)throw p(J,z,"no-credential",`row ${z} holds no credential`);let K=X.credentialEpoch??1,W=$.stateAccount(z),V=W?.[q6],B=v$(V);if(!d(V)||!B?.binding||B.digest!==X8(Q)||B.credentialEpoch!==K||B.binding.identity!==X.identity)throw p(J,z,"unbound-credential",`row ${z}'s credential carries no stamp of this store to bind a provider state to (stamp ${X.stamp}); rotate or replace it first`);let q=X.providerState===void 0?void 0:structuredClone(X.providerState),H=await d8(J,()=>Y(q,X));if(G&&H===oN)return{kind:"declined"};let j=H===void 0?void 0:G8(Z,J,z,H,"the provider state the mutator returned"),x=W!==void 0&&Object.hasOwn(W,D$);if(j===void 0?!x:X.providerState!==void 0&&JSON.stringify(X.providerState)===JSON.stringify(j))return{kind:"unchanged",...j!==void 0?{value:j}:{}};let L={...W};if(j===void 0){delete L[D$];let U={...V};delete U.providerState,L[q6]=U}else{L[D$]=j;let U=CZ(Z,j);if(B.providerState!==U)L[q6]={...V,providerState:U}}return{kind:"changed",...j!==void 0?{value:j}:{},account:L}}async function J5($,Z,J){if(!J)return;let X=$.rows().map((G)=>{let{id:z,type:Q,label:K,enabled:W,disabledReason:V,identity:B,credentialEpoch:q,stamp:H,staged:j,torn:x,invalid:L}=G;return{id:z,type:Q,label:K,enabled:W,disabledReason:V,identity:B,credentialEpoch:q,stamp:H,staged:j,torn:x,invalid:L}}),Y=await d8($.info.operation,()=>J({id:Z,row:X.find((G)=>G.id===Z),rows:X,config:structuredClone($.snapshot.config)}));if(Y!==void 0)throw p($.info.operation,Z,"row-protected",Y)}var rN=["access","refresh","expires","lastRefreshedAt","apiKey"];function eN($){return{baseURL:String($.baseURL).trim(),authHeader:$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer"}}function $U($,Z,J){if(J.type!=="api")return J;let X=$.rosterRow(Z);if(!d(X)){if(J.baseURL===void 0)throw p($.info.operation,Z,"invalid-input","api credential needs a valid baseURL");return{...J,baseURL:J.baseURL}}let Y=$.row(Z)?.credential,G=Y?.type==="api"?{baseURL:Y.baseURL.trim(),authHeader:Y.authHeader??"authorization-bearer"}:eN(X),z=J.baseURL?.trim()??G.baseURL,Q=J.authHeader??G.authHeader;if(z!==G.baseURL||Q!==G.authHeader)throw p($.info.operation,Z,"endpoint-mismatch",`row ${Z} sends its key to another endpoint or header; a key for another endpoint is a replacement`);return{...J,baseURL:z,authHeader:Q}}function wQ($,Z,J,X){let Y=$.rosterRow(Z),G=$.row(Z),z=X??(G?G.identity:d(Y)&&typeof Y.accountId==="string"&&Y.accountId?Y.accountId:void 0);return{...z!==void 0?{identity:z}:{},...J.type==="api"?{baseURL:J.baseURL,authHeader:J.authHeader??"authorization-bearer"}:{}}}function N4($,Z,J,X,Y={}){let G=$U(Z,J,X),z=Z.stateAccount(J),Q=Y.providerState??{kind:"keep"},K=Z.row(J)?.credentialEpoch??Z.entry(J)?.credentialEpoch,W=typeof K==="number"?K:1,V=aN($.ctx.providerState,Q,z,z&&Object.hasOwn(z,D$)?Z.row(J):void 0,W),B=typeof z?.lastRefreshedAt==="number"?z.lastRefreshedAt:void 0,q=G.type==="oauth"?Y.stamp??rJ(B,$.ctx.now()):void 0,H={...z??{}};for(let L of rN)delete H[L];if(Y.clearErrors)delete H.lastRefreshError,delete H.lastQuotaRefreshError,delete H.quota;if(Q.kind==="clear")delete H[D$];else if(Q.kind==="set")H[D$]=Q.value;let j=uN(G,q),x={...H,...mN(G,q),[q6]:{...Y.staged?{staged:Y.staged}:{},...Y.transition!==void 0?{[eJ]:Y.transition}:{},...BQ(j,W,Y.binding??wQ(Z,J,j,Y.identity),{replace:Y.binding!==void 0,...V!==void 0?{providerState:V}:{}})}};return{stored:j,account:x}}async function U4($,Z,J){return $.setStateAccount(Z,J.account),await $.commitState(J.stored),J.stored}async function X5($,Z,J,X,Y={}){return U4(Z,J,N4($,Z,J,X,Y))}async function ZU($,Z,J){if(!Z.credential||Z.stamp!=="bound")return;let X=$.stateAccount(Z.id),Y=nJ(X,Z.credential,Z.credentialEpoch??1,Z.identity);$.setStateAccount(Z.id,{...X??{},[q6]:BQ(Z.credential,Z.credentialEpoch??1,wQ($,Z.id,Z.credential,J),Y!==void 0?{providerState:Y}:{})}),await $.commitState()}function Y5($,Z,J){let X=$==="add"?e4(Z):void 0;if(X)throw p($,Z,"invalid-input",X);let Y=pN(J,{baseURLOptional:$==="rotate"});if(Y)throw p($,Z,"invalid-input",Y)}function vZ($,Z,J,X){if(!J)throw A0($,Z);if(J.invalid)throw p($,Z,"invalid-row",`row ${Z} failed validation`);if(X&&X.type!==J.type)throw p($,Z,"type-mismatch",`row ${Z} holds a ${J.type} credential`);return J}function B1($,Z,J){if(J!==void 0&&!Y$(d(J)?J.credentialEpoch:void 0))throw p($,Z,"invalid-input","the attribution must name a credential epoch that is a positive safe integer")}function fZ($,Z,J,X){if(!J)throw A0($,Z);if(J.invalid)throw p($,Z,"invalid-row",`row ${Z} failed validation`);if((J.credentialEpoch??1)!==X.credentialEpoch||J.identity!==X.identity)throw p($,Z,"attribution",`the ${$} of ${Z} was issued for a credential or account the row no longer holds`,!0)}function $Z($,Z){return p($,Z,"identity-mismatch",`row ${Z} is recorded for another account; a credential of a different account is a replacement`)}function q1($,Z){return p($,Z,"row-key-changed",`row ${Z}'s wire identity changed while its lock was being taken`,!0)}function JU($,Z,J,X){let{id:Y,credential:G,identity:z}=J;if(!$.ctx.requireCredentialStamps||Z.rosterRow(Y)||!T8(Z.state,Y))return;let Q=()=>{throw p("add",Y,"unbound-credential",`orphan ${Y} cannot be bound to this add's material; remove it explicitly before adding different material`)},K=Z.stateAccount(Y),W=v$(K?.[q6]);if(!W?.binding||W.dispatch===void 0||W.replace)return Q();if(G.type==="api"&&(W.binding.baseURL===void 0||W.binding.authHeader===void 0))return Q();let V=G.type==="api"?{...G,baseURL:W.binding.baseURL,authHeader:W.binding.authHeader}:G,[B]=i8({accounts:[l9({id:Y,credential:V,identity:W.binding.identity,addedAt:0})],[L6]:{rows:{[Y]:{credentialEpoch:oJ(Z.config,Y)}}}},Z.state,$.ctx.codec,$.ctx.providerState);if(!B?.credential||B.invalid||B.stamp!=="bound")return Q();if(z!==void 0&&z!==B.identity)return Q();if(X8(G)!==W.digest)return Q();if(G.type==="api"){if(G.baseURL.trim()!==W.binding.baseURL)return Q();if((G.authHeader??"authorization-bearer")!==W.binding.authHeader)return Q()}else if(i0(G)!==W.dispatch)return Q();if(W.providerState!==void 0&&B.providerState===void 0)return Q();if(X!==void 0&&CZ($.ctx.providerState,X)!==W.providerState)return Q();return B}function XU($,Z,J,X){let{id:Y,credential:G,identity:z,label:Q}=J,K=Z.rosterRow(Y),W=()=>{throw p("add",Y,K?"id-exists":"unbound-credential",`row ${Y} does not match this staged add`)},V=Z.stateAccount(Y),B=v$(V?.[q6]),q=B?.staged;if(!B?.binding||!q||B.replace||B.dispatch===void 0)return W();if(K&&(K.type!==G.type||K.label!==Q||K.accountId!==z))return W();if(q.reservation!==J.stage?.reservation||q.label!==Q||q.disabledReason!==J.disabled?.reason||B.binding.identity!==z)return W();let H=X===void 0?void 0:c9(X),j=V?.[D$],x=j===void 0?void 0:c9(j);if(q.providerState!==H||q.providerState!==x)return W();if(X8(G)!==B.digest||i0(G)!==B.dispatch)return W();let L=K?Z.config:{accounts:[{...l9({id:Y,credential:G.type==="api"?{...G,baseURL:B.binding.baseURL??"",authHeader:B.binding.authHeader}:G,identity:B.binding.identity,label:q.label,addedAt:0}),enabled:!1}],[L6]:{rows:{[Y]:{credentialEpoch:B.credentialEpoch,disabledReason:q.disabledReason,staged:{reservation:q.reservation}}}}},U=i8(L,Z.state,$.ctx.codec,$.ctx.providerState).find((M)=>M.id===Y);if(!U?.credential||U.invalid||U.stamp!=="bound"||U.type!==G.type||U.enabled||U.label!==q.label||U.identity!==B.binding.identity||U.disabledReason!==q.disabledReason||U.staged?.reservation!==q.reservation)return W();if(K)return{id:Y,outcome:"exists",credential:U.credential,credentialEpoch:B.credentialEpoch};if(oJ(Z.config,Y)!==B.credentialEpoch)return W();return Z.roster().push({...l9({id:Y,credential:G,identity:z,label:Q,addedAt:$.ctx.now()}),enabled:!1}),Z.setEntry(Y,{credentialEpoch:B.credentialEpoch,needsFirstReading:G.type==="oauth",disabledReason:q.disabledReason,staged:{reservation:q.reservation}}),Z.commitConfig().then(()=>({id:Y,outcome:"completed",credential:U.credential,credentialEpoch:B.credentialEpoch}))}async function YU($,Z,J={}){I$("add");let{ctx:X}=$,{id:Y,credential:G,identity:z,label:Q}=Z,K=Z.stage!==void 0||Z.disabled!==void 0,W=await _$(X,"add",Y,J.onFailure,async(V,B)=>{Y5("add",Y,G);let q=J.onExisting??"rotate";if(Z.stage!==void 0&&q==="rotate")throw p("add",Y,"invalid-input","a staged add needs onExisting: 'refuse' or 'stage-duplicate'");if(!["rotate","refuse","stage-duplicate"].includes(q)||Z.stage!==void 0&&(Q!==void 0&&typeof Q!=="string"||z!==void 0&&(typeof z!=="string"||!z))||Z.disabled!==void 0&&(!d(Z.disabled)||typeof Z.disabled.reason!=="string")||Z.stage!==void 0&&(!d(Z.stage)||typeof Z.stage.reservation!=="string"||!Z.stage.reservation||!Z.disabled)||q==="stage-duplicate"&&(!Z.disabled||!Z.stage))throw p("add",Y,"invalid-input","staging requires a reservation and a disabled reason");let H=Z.providerState===void 0?void 0:G8(X.providerState,"add",Y,Z.providerState);if(await V.acquire(e$($,{id:Y,identity:z})),G.type==="oauth")await V.acquire(J.providerLock??$.providerLock);for(let j of J.extraLocks??[])await V.acquire(j);return G$(X,V,B,{operation:"add",rowId:Y},async(j)=>{await J5(j,Y,J.protect);let x=d(j.state.accounts)?j.state.accounts:{},L=Object.entries(x).find(([c,I])=>{if(c===Y||j.rosterRow(c)||!d(I))return!1;let O=I[q6];if(!d(O)||!Object.hasOwn(O,"staged"))return!1;return G.type==="oauth"?I.refresh===G.refresh:typeof I.apiKey==="string"&&I.apiKey.trim()===G.apiKey.trim()});if(L)throw p("add",L[0],"row-staged",`orphan ${L[0]} reserves this secret until its staged add is replayed or removed`);if(X.removedIds.has(Y))throw p("add",Y,"id-removed",`id ${Y} was removed from the roster in this process and is not reused`);if(Z.stage&&q!=="rotate"&&(j.rosterRow(Y)||T8(j.state,Y)))return XU($,j,Z,H);if(q==="rotate"){j.assertNotStaged(Y);let c=j.rows().find((I)=>I.fingerprint===I6(G));if(c)j.assertNotStaged(c.id)}if(q==="refuse"){let c=j.rows().find((D)=>D.fingerprint===I6(G)||D.id===Y&&D.credential),I=d(j.state.accounts)?j.state.accounts:{},O=Object.entries(I).find(([,D])=>{if(!d(D))return!1;if(G.type==="oauth")return D.refresh===G.refresh;return typeof D.apiKey==="string"&&D.apiKey.trim()===G.apiKey.trim()})?.[0],P=c?.id??O??Y;if(c||O!==void 0||T8(j.state,Y))throw p("add",P,"credential-exists",`row ${P} already holds this secret or id`)}if(q==="stage-duplicate"&&(j.rosterRow(Y)||T8(j.state,Y)))throw p("add",Y,"id-exists",`row ${Y} already exists`);let U=JU($,j,Z,H),M=j.rows(),A=I6(G),_=q==="rotate"&&!U&&M.find((c)=>c.invalid===void 0&&c.fingerprint===A);if(_){if(j.assertNotStaged(_.id),E$("add",_),z!==void 0&&_.identity!==void 0&&z!==_.identity)throw $Z("add",_.id);let c=N4($,j,_.id,G,{...H!==void 0?{providerState:Z5(X.providerState,"add",_.id,_.providerState,H)}:{}});await j.completeTorn(),j.assertNotStaged(_.id);let I=await U4(j,_.id,c);return{id:_.id,outcome:"rotated",credential:I,credentialEpoch:_.credentialEpoch??1}}let N=M.find((c)=>c.id===Y);if(N){if(N.invalid)throw p("add",Y,"invalid-row",`row ${Y} is invalid`);if(N.credential)throw p("add",Y,"id-exists",`row ${Y} already holds a credential`);if(E$("add",N),N.type!==G.type)throw p("add",Y,"type-mismatch",`row ${Y} is a ${N.type} row`);if(z!==void 0&&N.identity!==void 0&&z!==N.identity)throw $Z("add",Y);if(!N.hasEntry)j.setEntry(Y,{credentialEpoch:1,needsFirstReading:G.type==="oauth"});let c=N4($,j,Y,G,{clearErrors:!0,...H!==void 0?{providerState:{kind:"set",value:H}}:{}});await j.completeTorn();let I=await U4(j,Y,c);if(!N.hasEntry)await j.commitConfig();return{id:Y,outcome:"completed",credential:I,credentialEpoch:N.credentialEpoch??1}}let R=oJ(j.config,Y);if(!Y$(R))throw p("add",Y,"id-removed",`id ${Y} has held every credential epoch and is not reused; add the credential under another id`);let S=U?.identity??z;j.roster().push(l9({id:Y,credential:G,...S!==void 0?{identity:S}:{},...Q!==void 0?{label:Q}:{},addedAt:X.now()})),j.setEntry(Y,{credentialEpoch:R,needsFirstReading:G.type==="oauth",...Z.stage?{staged:{reservation:Z.stage.reservation}}:{}});let E="added";if(Z.disabled)g8(j,Y,Z.disabled.reason),E="added-disabled";if(!Z.disabled&&S!==void 0&&G.type==="oauth"){if(M.find((I)=>I.invalid===void 0&&I.type==="oauth"&&I.enabled&&I.identity===S))g8(j,Y,zQ),E="added-disabled"}if(U?.credential)return await j.commitConfig(),{id:Y,outcome:E,credential:U.credential,credentialEpoch:U.credentialEpoch??R};j.dropStateAccount(Y);let m=N4($,j,Y,G,{...Z.stage&&Z.disabled?{staged:{reservation:Z.stage.reservation,disabledReason:Z.disabled.reason,...Q!==void 0?{label:Q}:{},...H!==void 0?{providerState:c9(H)}:{}}}:{},...H!==void 0?{providerState:{kind:"set",value:H}}:{}});if(q==="rotate")await j.completeTorn();let s=await U4(j,Y,m);return await j.commitConfig(),{id:Y,outcome:E,credential:s,credentialEpoch:R}},{completeTorn:!1})});if(!K&&G.type==="oauth"&&(W.outcome==="added"||W.outcome==="completed"))$.firePull(W.id,"add");return W}async function GU($,Z,J,X={},Y={}){I$("replace");let{ctx:G}=$,z=await _$(G,"replace",Z,Y.onFailure,async(Q,K)=>{Y5("replace",Z,J),B1("replace",Z,Y.attribution);let W=X.providerState===void 0?void 0:G8(G.providerState,"replace",Z,X.providerState),{row:V}=await s8($,"replace",Z);if(await Q.acquire(e$($,V)),J.type==="oauth")await Q.acquire(Y.providerLock??$.providerLock);for(let B of Y.extraLocks??[])await Q.acquire(B);return G$(G,Q,K,{operation:"replace",rowId:Z},async(B)=>{if(Y.attribution!==void 0)fZ("replace",Z,B.row(Z),Y.attribution),await B.completeTorn();let q=vZ("replace",Z,B.row(Z),J);if(F6(q)!==F6(V))throw q1("replace",Z);let H=B.entry(Z)?.credentialEpoch,j=(typeof H==="number"?H:1)+1;if(!Y$(j))throw p("replace",Z,"invalid-row",`row ${Z}'s credential epoch cannot advance past ${Number.MAX_SAFE_INTEGER}; remove the row and add the new credential as a new row`);let x=tN(G.providerState,q,j,X.identity,W),L={...X.identity!==void 0?{identity:X.identity}:{},...J.type==="api"?{baseURL:J.baseURL.trim(),authHeader:J.authHeader??"authorization-bearer"}:{}};if(OQ(B,Z,j,L),X.identity!==void 0)TZ(B,X.identity);let U=await X5($,B,Z,J,{clearErrors:!0,binding:L,providerState:x});return await B.commitConfig(),{id:Z,credential:U,credentialEpoch:j}},{completeTorn:Y.attribution===void 0})});if(J.type==="oauth")$.firePull(Z,"replace");return z}async function zU($,Z,J,X={},Y={}){I$("rotate");let{ctx:G}=$;return _$(G,"rotate",Z,Y.onFailure,async(z,Q)=>{Y5("rotate",Z,J),B1("rotate",Z,Y.attribution);let K=X.providerState===void 0?void 0:G8(G.providerState,"rotate",Z,X.providerState),{row:W}=await s8($,"rotate",Z);if(await z.acquire(e$($,W)),X.identity!==void 0&&J.type==="oauth")await z.acquire(Y.providerLock??$.providerLock);for(let V of Y.extraLocks??[])await z.acquire(V);return G$(G,z,Q,{operation:"rotate",rowId:Z},async(V)=>{if(Y.attribution!==void 0)fZ("rotate",Z,V.row(Z),Y.attribution),await V.completeTorn();let B=vZ("rotate",Z,V.row(Z),J);if(F6(B)!==F6(W))throw q1("rotate",Z);if(E$("rotate",B),X.identity!==void 0&&B.identity!==void 0&&X.identity!==B.identity)throw $Z("rotate",Z);let q=X.identity!==void 0&&B.identity===void 0?X.identity:void 0,H=await X5($,V,Z,J,{identity:q,...K!==void 0?{providerState:Z5(G.providerState,"rotate",Z,B.providerState,K)}:{}}),j=!1;if(!B.hasEntry)V.setEntry(Z,{credentialEpoch:1,needsFirstReading:B.type==="oauth"}),j=!0;if(X.identity!==void 0&&B.identity!==X.identity)FZ(V,Z,X.identity),j=!0;if(j)await V.commitConfig();return{id:Z,credential:H}},{completeTorn:Y.attribution===void 0})})}async function RQ($,Z,J,X,Y){I$(Z);let{ctx:G}=$,z=G.providerState,Q=Y.attribution,K=Y.providerState;return _$(G,Z,J,Y.onFailure,async(W,V)=>{if(B1(Z,J,Q),K!==void 0){if(typeof K!=="function")throw p(Z,J,"invalid-input","the provider-state mutator must be a function");if(Q===void 0)throw p(Z,J,"invalid-input","a provider-state change needs the attribution of the credential it is for");if(!z)throw p(Z,J,"invalid-input","the store was opened without a provider-state codec")}let{row:B}=await s8($,Z,J);await W.acquire(e$($,B));for(let q of Y.extraLocks??[])await W.acquire(q);return G$(G,W,V,{operation:Z,rowId:J},async(q)=>{await J5(q,J,Y.protect),q.assertNotStaged(J);let H=q.row(J),j=X.enabled?vZ("enable",J,H):H;if(!j||!q.rosterRow(J))throw A0(Z,J);if(F6(j)!==F6(B))throw q1(Z,J);if(Q!==void 0)fZ(Z,J,j,Q);if(X.enabled&&j.disabledReason?.startsWith(RZ))throw p("enable",J,"identity-contradicted",`row ${J} needs an identity-validated credential replacement before it can be enabled`);let x=!X.enabled||!j.enabled||j.disabledReason!==void 0;if(X.enabled&&x&&j.type==="oauth"){let _=j.identity===void 0?void 0:q.rows().find((N)=>N.id!==J&&N.invalid===void 0&&N.type==="oauth"&&N.enabled&&N.identity===j.identity);if(_)throw p("enable",J,"duplicate-identity",`row ${_.id} is enabled with the same identity as row ${J}`)}if(K===void 0||z===void 0){if(await q.completeTorn(),!x)return{id:J};if(X.enabled)I7(q,J);else g8(q,J,X.reason);return await q.commitConfig(),{id:J}}if(!j.credential)throw p(Z,J,"no-credential",`row ${J} holds no credential`);E$(Z,j);let L=await AQ(q,z,Z,j,K,!0);if(L.kind==="declined")return{id:J,declined:!0};await q.completeTorn();let U={id:J,providerStateOutcome:L.kind==="unchanged"?"unchanged":L.value===void 0?"cleared":"updated",...L.value!==void 0?{providerState:L.value}:{}};if(L.kind==="unchanged"){if(x){if(X.enabled)I7(q,J);else g8(q,J,X.reason);await q.commitConfig()}return U}if(!x)return q.setStateAccount(J,L.account),await q.commitState(),U;let M=X.enabled?{mark:yY(),enabled:!0}:{mark:yY(),enabled:!1,reason:X.reason},A=L.account[q6];return q.setStateAccount(J,{...L.account,[q6]:{...A,[eJ]:M}}),await q.commitState(),$5(q,J,M),await q.commitConfig(),U},{completeTorn:!1})})}function QU($,Z,J,X={}){return RQ($,"disable",Z,{enabled:!1,reason:J},X)}function KU($,Z,J={}){return RQ($,"enable",Z,{enabled:!0},J)}async function WU($,Z,J={}){I$("remove");let{ctx:X}=$;return _$(X,"remove",Z,J.onFailure,async(Y,G)=>{if(typeof Z!=="string"||Z.length===0)throw p("remove",Z,"invalid-input","id must be non-empty");let z=J.attribution;if(B1("remove",Z,z),J.staged!==void 0&&(!d(J.staged)||typeof J.staged.reservation!=="string"||!J.staged.reservation))throw p("remove",Z,"invalid-input","a staged removal needs a reservation");let Q=await f$(X);if(Q.status!=="ready")throw Y8(Q,"remove",Z);let K=Q.rows.find((V)=>V.id===Z);if(!K&&!T8(Q.state,Z))throw A0("remove",Z);let W=F6(K??{id:Z});await Y.acquire(e$($,K??{id:Z}));for(let V of J.extraLocks??[])await Y.acquire(V);return G$(X,Y,G,{operation:"remove",rowId:Z},async(V)=>{let B=V.reservation(Z);if(B!==void 0){if(!d(B)||!J.staged||B.reservation!==J.staged.reservation)throw p("remove",Z,"row-staged",`row ${Z} is reserved for roster publication`)}else if(J.staged)throw p("remove",Z,"attribution",`row ${Z} is no longer reserved`);let q=V.row(Z),H=T8(V.state,Z);if(!q&&!H)throw A0("remove",Z);if(F6(q??{id:Z})!==W)throw q1("remove",Z);if(z!==void 0)if(q)P7(Z,q,z);else VU($,V,Z,z);let j=J.protect;if(j){let x={row:q,config:V.snapshot.config,state:V.snapshot.state},L=await d8("remove",()=>j(Z,x));if(L!==void 0)throw p("remove",Z,"row-protected",L)}if(q){if(z===void 0)await V.completeTorn();V.dropRosterRows(Z),await V.commitConfig()}if(H)V.dropStateAccount(Z),await V.commitState();return{id:Z,outcome:q?"removed":"completed"}},{completeTorn:!1})})}function P7($,Z,J,X="remove"){if(fZ(X,$,Z,J),Z.torn)throw p(X,$,"attribution",`row ${$} is between the writes of another operation; retry once it completes`,!0);if(Z.stamp!=="bound")throw p(X,$,"unbound-credential",`row ${$}'s credential is not bound to its stamp, so the removal cannot be attributed to it`)}function VU($,Z,J,X){let Y=()=>p("remove",J,"unbound-credential",`orphan ${J} has no credential stamp this store can bind, so the removal cannot be attributed to it`),G=Z.stateAccount(J),z=v$(G?.[q6]);if(!G||!z?.binding||z.dispatch===void 0||z.replace)throw Y();let Q;if(typeof G.apiKey==="string"){if(z.binding.baseURL===void 0||z.binding.authHeader===void 0)throw Y();Q={type:"api",apiKey:G.apiKey,baseURL:z.binding.baseURL,authHeader:z.binding.authHeader}}else if(typeof G.refresh==="string")Q={type:"oauth",refresh:G.refresh};else throw Y();let[K]=i8({accounts:[l9({id:J,credential:Q,identity:z.binding.identity,addedAt:0})],[L6]:{rows:{[J]:{credentialEpoch:z.credentialEpoch}}}},Z.state,$.ctx.codec,$.ctx.providerState);if(!K?.credential||K.invalid||K.stamp!=="bound")throw Y();if(z.credentialEpoch!==X.credentialEpoch||z.binding.identity!==X.identity)throw p("remove",J,"attribution",`orphan ${J} was written for a credential or account other than the one this removal was decided for`,!0)}function T8($,Z){let J=$.accounts;return d(J)&&Object.hasOwn(J,Z)}function A7($){return d($)&&typeof $.id==="string"?$.id:void 0}function BU($,Z){if(!Array.isArray(Z))return"ids must be an array of roster ids";let J=new Set;for(let G of $){let z=A7(G);if(z!==void 0)J.add(z)}let X=new Set;for(let G of Z){if(typeof G!=="string")return"ids must be an array of roster ids";if(X.has(G))return`id ${G} appears more than once`;if(!J.has(G))return`id ${G} is not in the roster`;X.add(G)}let Y=[...J].filter((G)=>!X.has(G));if(Y.length>0)return`the order leaves out roster id(s) ${Y.join(", ")}`;return}function qU($,Z){let J=new Map;for(let G of $){let z=A7(G);if(z===void 0)continue;let Q=J.get(z);if(Q)Q.push(G);else J.set(z,[G])}let X=Z.flatMap((G)=>J.get(G)??[]),Y=0;return $.map((G)=>A7(G)===void 0?G:X[Y++])}async function jU($,Z,J={}){I$("reorder");let{ctx:X}=$,Y=J.onFailure;return _$(X,"reorder",void 0,Y&&((G,z)=>Y(z)),async(G,z)=>{for(let Q of J.extraLocks??[])await G.acquire(Q);return G$(X,G,z,{operation:"reorder",rowId:void 0},async(Q)=>{let K=Q.roster(),W=BU(K,Z);if(W)throw new G6({operation:"reorder",phase:"before-first-write",retryable:!1,kind:"invalid-order",message:W});let V=[...Z],B=qU(K,V);if(B.every((q,H)=>q===K[H]))return{ids:V,outcome:"unchanged"};return Q.config.accounts=B,await Q.commitConfig(),{ids:V,outcome:"reordered"}},{completeTorn:!1})})}async function HU($,Z,J,X,Y={}){return I$("recordIdentity"),_$($.ctx,"recordIdentity",Z,Y.onFailure,async(G,z)=>{if(typeof J!=="string"||J.length===0)throw p("recordIdentity",Z,"invalid-input","identity must be non-empty");let Q=d(X)?X.credentialEpoch:void 0;if(!Y$(Q))throw p("recordIdentity",Z,"invalid-input","the credential epoch the identity lookup was issued for is required");let{row:K}=await s8($,"recordIdentity",Z);await G.acquire(e$($,K)),await G.acquire(Y.providerLock??$.providerLock);for(let W of Y.extraLocks??[])await G.acquire(W);return G$($.ctx,G,z,{operation:"recordIdentity",rowId:Z},async(W)=>{let V=vZ("recordIdentity",Z,W.row(Z));if(F6(V)!==F6(K))throw q1("recordIdentity",Z);if(E$("recordIdentity",V),(V.credentialEpoch??1)!==Q)throw p("recordIdentity",Z,"attribution",`the identity for ${Z} was looked up for a credential the row no longer holds`,!0);if(V.identity!==void 0&&V.identity!==J)throw $Z("recordIdentity",Z);if(V.identity===void 0)await ZU(W,V,J);let B=FZ(W,Z,J);return await W.commitConfig(),{id:Z,disabled:B}})})}function TQ($){let Z=$[L6];return d(Z)&&d(Z.publications)?Z.publications:{}}function FQ($,Z){let J=TQ($);if(!Object.hasOwn(J,Z))return;let X=J[Z];if(!d(X)||X.operationId!==Z||typeof X.planDigest!=="string"||!/^[a-f0-9]{64}$/.test(X.planDigest)||!["committed","cleaned"].includes(String(X.phase))||!Array.isArray(X.removed)||!Array.isArray(X.finalized)||X.removed.some((Y)=>!d(Y)||typeof Y.id!=="string"||!Y$(Y.credentialEpoch))||X.finalized.some((Y)=>!d(Y)||typeof Y.id!=="string"||!Y$(Y.credentialEpoch)||typeof Y.reservation!=="string"||!Y.reservation||typeof Y.enabled!=="boolean"))throw p("publishRoster",Z,"invalid-input","the stored publication receipt is malformed");return structuredClone(X)}async function LU($,Z){let J=await f$($.ctx);if(J.status!=="ready")throw Y8(J,"publishRoster",Z);return FQ(J.config,Z)}function NU($,Z){let J=()=>{throw p("publishRoster",Z?.operationId??"","invalid-input","the publication plan is invalid")};if(!d(Z)||typeof Z.operationId!=="string"||!Z.operationId||!Array.isArray(Z.remove)||!Array.isArray(Z.finalize)||!Array.isArray(Z.order))J();let X=new Set;for(let Y of[...Z.remove,...Z.finalize]){if(!d(Y)||typeof Y.id!=="string"||e4(Y.id)||X.has(Y.id)||!Y.attribution)J();if(X.add(Y.id),B1("publishRoster",Y.id,Y.attribution),Y.attribution.identity!==void 0&&(typeof Y.attribution.identity!=="string"||!Y.attribution.identity))J()}for(let Y of Z.remove)if($.ctx.requireRemovedFingerprint&&!Y.fingerprint||Y.fingerprint!==void 0&&typeof Y.fingerprint!=="string")J();for(let Y of Z.finalize)if(typeof Y.reservation!=="string"||!Y.reservation||typeof Y.enabled!=="boolean"||(Y.enabled?Y.disabledReason!==void 0:typeof Y.disabledReason!=="string"))J();if(Z.order.some((Y)=>typeof Y!=="string"||e4(Y))||new Set(Z.order).size!==Z.order.length)J()}function CQ($,Z){$.entries();let J=$.config[L6],X={...TQ($.config)};Object.defineProperty(X,Z.operationId,{value:Z,enumerable:!0,writable:!0,configurable:!0}),J.publications=X,delete J.publicationOrder}function UU($,Z,J){let X=new Set;for(let z of SZ($.config)){if(!d(z)||typeof z.id!=="string")continue;if(X.has(z.id))throw p("publishRoster",Z.operationId,"invalid-input","publication needs a roster of unique named rows");X.add(z.id)}let Y=new Set(Z.remove.map((z)=>z.id)),G=J.filter((z)=>z.invalid!=="roster"&&!Y.has(z.id));if(G.length!==Z.order.length||Z.order.some((z)=>!G.some((Q)=>Q.id===z))||G.some((z)=>!Z.order.includes(z.id)))throw p("publishRoster",Z.operationId,"invalid-input","order must name exactly the surviving roster");return G}async function hY($,Z){await $.assertAll();for(let X of Z.removed)if(v$($.stateAccount(X.id)?.[q6])?.credentialEpoch===X.credentialEpoch&&!$.rosterRow(X.id))$.dropStateAccount(X.id);for(let X of Z.finalized){let Y=$.stateAccount(X.id),G=v$(Y?.[q6]);if(Y&&G?.credentialEpoch===X.credentialEpoch&&G.staged?.reservation===X.reservation){let z={...Y[q6]};delete z.staged,$.setStateAccount(X.id,{...Y,[q6]:z})}}await $.commitState(void 0,{durable:!0});let J={...Z,phase:"cleaned"};return CQ($,J),await $.commitConfig({durable:!0}),J}async function xU($,Z,J={}){return I$("publishRoster"),_$($.ctx,"publishRoster",Z?.operationId??"",J.onFailure,async(X,Y)=>{if(!d(Z)||typeof Z.operationId!=="string"||!Z.operationId)throw p("publishRoster",Z?.operationId??"","invalid-input","the publication needs an operation id");Z=structuredClone(Z);let G=c9(Z),z=[...Array.isArray(Z.remove)?Z.remove:[],...Array.isArray(Z.finalize)?Z.finalize:[]].filter((Q)=>d(Q)&&typeof Q.id==="string");for(let Q=0;;Q++){let K=await f$($.ctx);if(K.status!=="ready")throw Y8(K,"publishRoster",Z.operationId);let W=new Map(z.map(({id:B})=>[B,F6(K.rows.find((q)=>q.id===B)??{id:B})]));for(let B of[...new Set(W.values())].sort())await X.acquire(e$($,{id:B}));await X.acquire(J.providerLock??$.providerLock);for(let B of J.extraLocks??[])await X.acquire(B);let V=await G$($.ctx,X,Y,{operation:"publishRoster",rowId:Z.operationId},async(B)=>{let q=B.rows();if(z.some(({id:N})=>F6(q.find((R)=>R.id===N)??{id:N})!==W.get(N)))return;let H=FQ(B.config,Z.operationId);if(H){if(H.planDigest!==G)throw p("publishRoster",Z.operationId,"publication-mismatch","the operation id belongs to a different publication plan");if(H.phase==="cleaned")return{outcome:"already-cleaned",receipt:H};return B.markPublicationDecision(),await B.syncConfig(),{outcome:"cleaned",receipt:await hY(B,H)}}NU($,Z);let j=UU(B,Z,q),x=[];for(let N of Z.remove){B.assertNotStaged(N.id);let R=q.find((S)=>S.id===N.id);if(!R)throw p("publishRoster",N.id,"attribution","the removed row no longer exists");if(P7(N.id,R,N.attribution,"publishRoster"),!R.credential||N.fingerprint!==void 0&&I6(R.credential)!==N.fingerprint)throw p("publishRoster",N.id,"attribution","the removed secret no longer matches");x.push(R)}let L=[];for(let N of Z.finalize){let R=q.find((I)=>I.id===N.id),S=v$(B.stateAccount(N.id)?.[q6]);if(!R||R.staged?.reservation!==N.reservation||S?.staged?.reservation!==N.reservation||R.enabled)throw p("publishRoster",N.id,"row-staged","the finalized row is not disabled under this reservation");let E=B.stateAccount(N.id),m=B.rosterRow(N.id),s=E?.[D$],c=s===void 0?void 0:c9(s);if(!S?.staged||S.staged.label!==m?.label||S.staged.disabledReason!==R.disabledReason||S.staged.providerState!==c)throw p("publishRoster",N.id,"row-staged","the staged label, disabled reason or full provider state no longer matches its stamp");P7(N.id,R,N.attribution,"publishRoster"),L.push(R)}let U=j.find((N)=>N.torn);if(U)throw p("publishRoster",Z.operationId,"attribution",`Row ${U.id} has an interrupted write; complete it with a normal store operation before publishing.`,!1);let M=new Set;for(let N of j){if(!(Z.finalize.find((S)=>S.id===N.id)?.enabled??N.enabled)||N.type!=="oauth"||N.identity===void 0)continue;if(M.has(N.identity))throw p("publishRoster",N.id,"invalid-input","the final enabled roster repeats a known identity");M.add(N.identity)}for(let N of j)if(N.identity!==void 0&&N.fingerprint!==void 0&&j.some((R)=>R.id!==N.id&&R.identity!==void 0&&R.identity!==N.identity&&R.fingerprint===N.fingerprint))throw p("publishRoster",N.id,"attribution","the resulting pool gives the same secret different known identities");for(let N of L)if(N.identity!==void 0&&x.some((R)=>R.identity!==void 0&&R.identity!==N.identity&&R.fingerprint===N.fingerprint))throw p("publishRoster",N.id,"attribution","the staged secret belonged to a different known identity");await J5(B,Z.operationId,J.protect);let A={operationId:Z.operationId,planDigest:G,phase:"committed",removed:x.map((N)=>({id:N.id,credentialEpoch:N.credentialEpoch??1})),finalized:Z.finalize.map((N,R)=>({id:N.id,credentialEpoch:L[R]?.credentialEpoch??1,reservation:N.reservation,enabled:N.enabled}))};for(let N of Z.remove)B.dropRosterRows(N.id);for(let N of Z.finalize){let R=B.rosterRow(N.id);R.enabled=N.enabled;let S={...B.entry(N.id)};if(delete S.staged,N.enabled)delete S.disabledReason;else S.disabledReason=N.disabledReason;B.setEntry(N.id,S)}let _=B.roster().filter((N)=>!d(N)||typeof N.id!=="string"||q.find((R)=>R.id===N.id)?.invalid==="roster");return B.config.accounts=[...Z.order.map((N)=>B.rosterRow(N)),..._],CQ(B,A),await B.syncState(),await B.commitConfig({durable:!0,publicationDecision:!0}),{outcome:"published",receipt:await hY(B,A)}},{completeTorn:!1});if(V)return V;if(await X.releaseAll(),Q>=1)throw p("publishRoster",Z.operationId,"row-key-changed","a named row changed lock key twice during publication",!0)}})}class SQ{rt;hook;onFailure;firedAtLoad;logger;inflight=new Set;constructor($,Z,J,X,Y){this.rt=$,this.hook=Z,this.onFailure=J,this.firedAtLoad=X,this.logger=Y}fire($,Z){if(!this.hook)return;if(Z==="load"){if(this.firedAtLoad.has($))return;this.firedAtLoad.add($)}let J=this.run($,Z);this.inflight.add(J),J.finally(()=>this.inflight.delete(J))}async settled(){while(this.inflight.size>0)await Promise.allSettled([...this.inflight])}async run($,Z){let J=this.rt(),{ctx:X}=J,Y=new K1(X.lockDefaults,X.lockEnv),G={writes:0};try{let z=await G$(X,Y,G,{operation:"pull",rowId:$},async(K)=>{if(K.reservation($)!==void 0)return;await K.completeTorn();let W=K.row($);if(W?.unbound&&W.enabled&&W.type==="oauth"&&W.credential&&!W.invalid)E$("pull",W);if(!W?.candidate||W.type!=="oauth")return;if(!W.hasEntry)K.setEntry($,{credentialEpoch:1,needsFirstReading:!0}),await K.commitConfig();let V=K.row($);if(!V?.credential||V.credentialEpoch===void 0)return;return{id:$,credential:V.credential,credentialEpoch:V.credentialEpoch,...V.identity!==void 0?{identity:V.identity}:{},reason:Z}},{completeTorn:!1});if(await Y.releaseAll(),!z){this.firedAtLoad.delete($);return}await X.hold?.("pull-before-request",$);let Q;try{Q=await this.hook?.(z)}catch(K){throw new G6({operation:"pull",rowId:$,phase:"pull",retryable:!0,kind:"pull",message:"the quota pull rejected",cause:K})}await PQ(J,$,{credentialEpoch:z.credentialEpoch,...z.identity!==void 0?{identity:z.identity}:{}},Q)}catch(z){this.firedAtLoad.delete($);let Q=kZ(z,"pull",$,G);if(this.onFailure)try{await this.onFailure($,Q)}catch(K){this.logger?.warn("pull failure hook threw",{rowId:$,error:K instanceof Error?K.message:String(K)})}else this.logger?.warn("quota pull failed",{rowId:$,kind:Q.kind})}finally{await Y.releaseAll()}}}function R2($,Z){if(r4("refresh",$,Z?.staged),!Z)throw p("refresh",$,"unknown-row",`no row ${$} in the pool`);if(Z.invalid)throw p("refresh",$,"invalid-row",`row ${$} is invalid`);if(Z.type!=="oauth"||Z.credential?.type!=="oauth")throw p("refresh",$,"no-credential",`row ${$} holds no OAuth credential`);if(!Z.enabled)throw p("refresh",$,"row-disabled",`row ${$} is disabled`);return Z}function mY($){return p("refresh",$,"refresh-stamp-ahead",`row ${$}'s stored refresh stamp is ahead of the clock; a rotation now could not be stamped newer within the trust bound`,!0)}async function OU($,Z,J,X={}){I$("refresh");let{ctx:Y}=$;return _$(Y,"refresh",Z,X.onFailure,async(G,z)=>{let{row:Q}=await s8($,"refresh",Z);R2(Z,Q);let K=await X.refuse?.(Q);if(K!==void 0)return{status:"refused",rowId:Z,reason:K};let W=F6(Q),V;for(let j=0;;j++){await G.acquire(e$($,{id:Z,identity:W===Z?void 0:W})),await G.acquire(X.providerLock??$.providerLock);for(let U of X.extraLocks??[])await G.acquire(U);let L=await G$(Y,G,{writes:0},{operation:"refresh",rowId:Z},async(U)=>{let M=R2(Z,U.row(Z));if(E$("refresh",M),!M.hasEntry)U.setEntry(Z,{credentialEpoch:1,needsFirstReading:!0}),await U.commitConfig(),M=R2(Z,U.row(Z));if(F6(M)!==W)return{keyNow:F6(M)};let A=await X.refuse?.(M);if(A!==void 0)return{refused:A};return{row:M,credential:M.credential,credentialEpoch:M.credentialEpoch,identity:M.identity}});if("refused"in L)return{status:"refused",rowId:Z,reason:L.refused};if("keyNow"in L){if(await G.releaseAll(),j>=1)throw p("refresh",Z,"row-key-changed",`row ${Z}'s wire identity changed twice while its lock was held`,!0);W=L.keyNow;continue}V=L;break}if(bY(V.credential.lastRefreshedAt,Y.now()))throw mY(Z);await Y.hold?.("refresh-before-provider",Z),await G.assertAll();let B;try{B=await J(V.credential,V.row)}catch(j){throw new G6({operation:"refresh",rowId:Z,phase:"before-first-write",retryable:!0,kind:"provider",message:"the provider refresh failed",cause:j})}if(typeof B?.refresh!=="string"||!B.refresh.trim())throw p("refresh",Z,"provider","the provider returned no refresh token",!0);let q=B.providerState===void 0?void 0:G8(Y.providerState,"refresh",Z,B.providerState,"the provider state the provider returned"),H=await G$(Y,G,z,{operation:"refresh",rowId:Z},async(j)=>{let x=j.row(Z),L=j.entry(Z);if(!x||x.invalid||!L||L.credentialEpoch!==V.credentialEpoch||x.identity!==V.identity)throw new G6({operation:"refresh",rowId:Z,phase:"before-first-write",retryable:!0,kind:"attribution",message:`row ${Z} changed credential while its refresh was in flight; the rotation is discarded`});E$("refresh",x);let U=await X.refuse?.(x);if(U!==void 0)return{refused:U};let M=Y.now(),A=x.credential?.type==="oauth"?x.credential.lastRefreshedAt:void 0;if(bY(A,M))throw mY(Z);let _={type:"oauth",access:B.access,refresh:B.refresh,expires:B.expires},N=x.identity!==void 0&&B.identity!==void 0&&x.identity!==B.identity?{expectedIdentity:x.identity,returnedIdentity:B.identity}:void 0,R=N?{mark:DU(),enabled:!1,reason:`${RZ}${JSON.stringify(N)}`}:void 0,S=x.identity===void 0&&B.identity?B.identity:void 0,E=await X5($,j,Z,_,{stamp:rJ(A,M),transition:R,identity:S,...q!==void 0?{providerState:Z5(Y.providerState,"refresh",Z,x.providerState,q)}:{}});if(R!==void 0)$5(j,Z,R),await j.commitConfig();let m=x.identity;if(S!==void 0)FZ(j,Z,S),m=S,await j.commitConfig();return{stored:E,identity:m,contradiction:N,refused:void 0}});if(H.refused!==void 0)return{status:"refused",rowId:Z,reason:H.refused};if(H.contradiction!==void 0)return{status:"identity-contradicted",rowId:Z,...H.contradiction,credential:H.stored};if(X.onPersisted)try{let j=X.onPersisted;await d8("refresh",()=>j(Z,H.stored))}catch(j){throw new G6({operation:"refresh",rowId:Z,phase:"after-first-write",retryable:!1,kind:"after-persist-hook",committed:H.stored,message:"the after-persist hook threw; the rotation stays committed",cause:j})}return{status:"rotated",rowId:Z,credential:H.stored,...H.identity!==void 0?{identity:H.identity}:{}}})}var G5=Object.freeze(["version","accounts",L6]);function w7($){let Z={};for(let[J,X]of Object.entries($))if(!G5.includes(J))x4(Z,J,X);return Z}function x4($,Z,J){Object.defineProperty($,Z,{value:J,enumerable:!0,writable:!0,configurable:!0})}function IU($,Z){let J={};for(let[X,Y]of Object.entries($))if(G5.includes(X))x4(J,X,Y);else if(Object.hasOwn(Z,X))x4(J,X,Z[X]);for(let[X,Y]of Object.entries(Z))if(!Object.hasOwn($,X))x4(J,X,Y);return J}function uY($){return new G6({operation:"updateSettings",phase:"before-first-write",retryable:!1,kind:"invalid-input",message:$})}async function _U($){let Z=await f$($.ctx);if(Z.status==="error")return Z;return{status:Z.status,settings:w7(Z.config)}}async function PU($,Z,J={}){I$("updateSettings");let{ctx:X}=$,Y=J.onFailure;return _$(X,"updateSettings",void 0,Y&&((G,z)=>Y(z)),async(G,z)=>{for(let K of J.extraLocks??[])await G.acquire(K);let Q=G.held.length;try{for(let L of X.storeLocks)await G.acquire(L);let K=await f$(X);if(K.status!=="ready")throw Y8(K,"updateSettings",void 0);let W=w7(K.config),V=structuredClone(W),B=await d8("updateSettings",()=>Z(V)),q=B===void 0?V:B;if(!d(q))throw uY("the settings mutator must produce an object");let H=G5.filter((L)=>Object.hasOwn(q,L));if(H.length>0)throw uY(`settings cannot set the pool-owned key(s) ${H.join(", ")}`);if(MU(q,W))return{settings:W,outcome:"unchanged"};let j=IU(K.config,q),x={operation:"updateSettings",rowId:void 0};return await l8(X.configPath,j,{beforeRename:async()=>{await X.onStep?.("before-config-write",x),await G.assertAll()}}),z.writes++,await X.onStep?.("after-config-write",x),{settings:w7(j),outcome:"updated"}}finally{await G.releaseTo(Q)}})}var pY=new Map;function AU($){let Z=pY.get($);if(!Z)Z={removedIds:new Set,firedAtLoad:new Set},pY.set($,Z);return Z}function cY($){if($.status==="ready")return{status:"ready",schemaVersion:p9,rows:$.rows};if($.status==="pending-migration")return{status:"pending-migration",roster:Array.isArray($.config.accounts)?$.config.accounts:[]};return $}function wU($){let Z=AU($.configPath),J={...h6,...$.lockOptions},X={provider:$.provider,configPath:$.configPath,statePath:$.statePath,codec:$.quota,...$.providerState?{providerState:$.providerState}:{},now:$.now??Date.now,storeLocks:$.storeLocks??[{name:"save",path:$.configPath},{name:"save",path:$.statePath}],lockDefaults:J,lockEnv:{now:$.now??Date.now,...$.onLockEvent?{onLockEvent:$.onLockEvent}:{},...$.onLockStep?{onLockStep:$.onLockStep}:{},...$.onRenewalTimer?{onRenewalTimer:$.onRenewalTimer}:{}},removedIds:Z.removedIds,requireCredentialStamps:$.requireCredentialStamps===!0,requireRemovedFingerprint:$.requireRemovedFingerprint===!0,...$.logger?{logger:$.logger}:{},...$.onStep?{onStep:$.onStep}:{},...$.hold?{hold:$.hold}:{}},Y=new SQ(()=>G,$.pull,$.onPullFailure,Z.firedAtLoad,$.logger),G={ctx:X,providerLock:$.providerLock??{name:`provider-${encodeURIComponent($.provider)}`,path:$.statePath},rowLockOptions:$.rowLockOptions??{},firePull:(z,Q)=>Y.fire(z,Q)};return{async load(){let z=await f$(X);if(z.status==="ready"){for(let Q of z.rows)if((Q.candidate||Q.torn&&Q.enabled)&&Q.type==="oauth"&&Q.needsFirstReading)Y.fire(Q.id,"load")}return cY(z)},async read(){return cY(await f$(X))},async initialize(z={}){return{status:await sN(X,z.dropKeys??[])}},add:(z,Q)=>YU(G,z,Q),publishRoster:(z,Q)=>xU(G,z,Q),publication:(z)=>LU(G,z),replace:(z,Q,K,W)=>GU(G,z,Q,K,W),rotate:(z,Q,K,W)=>zU(G,z,Q,K,W),updateProviderState:(z,Q,K,W)=>nN(G,z,Q,K,W),disable:(z,Q,K)=>QU(G,z,Q,K),enable:(z,Q)=>KU(G,z,Q),remove:(z,Q)=>WU(G,z,Q),reorder:(z,Q)=>jU(G,z,Q),readSettings:()=>_U(G),updateSettings:(z,Q)=>PU(G,z,Q),recordIdentity:(z,Q,K,W)=>HU(G,z,Q,K,W),refresh:(z,Q,K)=>OU(G,z,Q,K),recordQuota:(z,Q,K)=>PQ(G,z,Q,K),requestReading:(z)=>Y.fire(z,"admission"),pullsSettled:()=>Y.settled()}}var R7="all",nT=Object.freeze(["primary"]);function RU($){return $.kind==="retired"?$.retiredAt:$.checkedAt}function F9($,Z){return JSON.stringify([$,Z])}function z8($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function $$($){return typeof $==="number"&&Number.isFinite($)}function lY($){return typeof $==="string"&&$.length>0}function N$($,Z,J){return $[Z]===void 0||J($[Z])}function TU($){return $$($)&&$>0}function T7($){return typeof $==="string"}function FU($){if(!z8($)||!lY($.scope)||!lY($.label))return!1;switch($.kind){case"reading":return $$($.checkedAt)&&$$($.usedPercent)&&N$($,"resetsAt",T7)&&N$($,"windowMinutes",TU);case"retired":return $$($.retiredAt);case"absent":return $$($.checkedAt);default:return!1}}function CU($){if(!z8($)||!$$($.checkedAt))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&N$($,"remainingPercent",$$)&&N$($,"usedPercent",$$)&&N$($,"resetsAt",T7)&&N$($,"limit",$$)&&N$($,"used",$$)&&N$($,"remaining",$$)&&N$($,"unit",T7)}function kQ($){return z8($)&&$$($.value)&&Number.isInteger($.value)&&$.value>=0&&$$($.checkedAt)}function vQ($){return z8($)&&Object.values($).every(kQ)}function SU($){if(!z8($))return;let Z=Object.entries($).filter(([,J])=>kQ(J));return Z.length===0?void 0:Object.fromEntries(Z)}function Q5($){if(d9($))return $;if(!z8($))return;let{counters:Z,...J}=$;if(!d9(J))return;let X=SU(Z);return{...J,...X===void 0?{}:{counters:X}}}function d9($){if(!z8($)||!Array.isArray($.limits))return!1;let Z=new Set;for(let J of $.limits){if(!FU(J))return!1;let X=F9(J.scope,J.label);if(Z.has(X))return!1;Z.add(X)}return N$($,"budget",CU)&&N$($,"counters",vQ)}class F7 extends TypeError{constructor($){super($);this.name="QuotaCodecError"}}function EZ($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function ZZ($){return typeof $==="number"&&Number.isFinite($)}function fQ($){return $===void 0||typeof $==="string"&&$!==""}function EQ($){return typeof $==="string"&&$!==""}function G9($,Z){return $[Z]===void 0||ZZ($[Z])}function C7($,Z){return $[Z]===void 0||typeof $[Z]==="string"}function kU($){return EZ($)&&fQ($.scope)&&EQ($.label)&&ZZ($.usedPercent)&&C7($,"resetsAt")&&($.windowMinutes===void 0||ZZ($.windowMinutes)&&$.windowMinutes>0)}function vU($){return EZ($)&&fQ($.scope)&&EQ($.label)}function fU($){if(!EZ($))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&G9($,"remainingPercent")&&G9($,"usedPercent")&&C7($,"resetsAt")&&G9($,"limit")&&G9($,"used")&&G9($,"remaining")&&C7($,"unit")}function EU($){if(!EZ($)||!ZZ($.checkedAt))return!1;let Z=$.readings??[],J=$.coverage??[];if(!Array.isArray(Z)||!Array.isArray(J))return!1;let X=new Set;for(let Y of Z){if(!kU(Y))return!1;let G=F9(Y.scope??R7,Y.label);if(X.has(G))return!1;X.add(G)}if(!J.every(vU))return!1;return($.budget===void 0||fU($.budget))&&($.counters===void 0||vQ($.counters))}function bU($,Z){if($.scope!==Z.scope)return $.scope<Z.scope?-1:1;if($.label!==Z.label)return $.label<Z.label?-1:1;return 0}function gU($,Z,J){if(Z===void 0)return $;if($!==void 0&&J<$.checkedAt)return $;return{...Z,checkedAt:J}}function yU($,Z){let J=new Map(Object.entries($??{}));for(let[X,Y]of Object.entries(Z??{})){let G=J.get(X);if(G===void 0||Y.checkedAt>=G.checkedAt)J.set(X,Y)}return J.size===0?void 0:Object.fromEntries(J)}function K5($,Z){let J=$===void 0?void 0:Q5($);if($!==void 0&&J===void 0)throw new F7("stored quota map is malformed");if(!EU(Z))throw new F7("quota observation is malformed");let X=J??{limits:[]},Y=Z.checkedAt,G=new Map;for(let j of X.limits)G.set(F9(j.scope,j.label),j);let z=(j)=>{let x=G.get(j);return x===void 0||Y>=RU(x)},Q=new Set;for(let j of Z.readings??[]){let x=j.scope??R7,L=F9(x,j.label);if(Q.add(L),!z(L))continue;G.set(L,{scope:x,label:j.label,kind:"reading",checkedAt:Y,usedPercent:j.usedPercent,...j.resetsAt===void 0?{}:{resetsAt:j.resetsAt},...j.windowMinutes===void 0?{}:{windowMinutes:j.windowMinutes}})}for(let j of Z.coverage??[]){let x=j.scope??R7,L=F9(x,j.label);if(Q.has(L)||!z(L))continue;let U=G.get(L);G.set(L,U===void 0||U.kind==="absent"?{scope:x,label:j.label,kind:"absent",checkedAt:Y}:{scope:x,label:j.label,kind:"retired",retiredAt:Y})}let{limits:K,budget:W,counters:V,...B}=X,q=gU(X.budget,Z.budget,Y),H=yU(X.counters,Z.counters);return{...B,limits:[...G.values()].sort(bU),...q===void 0?{}:{budget:q},...H===void 0?{}:{counters:H}}}var oT=Object.freeze({validate:d9,decode:Q5,merge:K5});class U0 extends Error{constructor(){super("Anthropic quota observation is invalid");this.name="NativeQuotaCodecError"}}function V$($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function b$($,Z,J=[]){return Z.every((X)=>Object.hasOwn($,X))&&Object.keys($).every((X)=>Z.includes(X)||J.includes(X))}function t$($){return typeof $==="number"&&Number.isFinite($)}function W5($){return t$($)&&$>=0}function J$($){return typeof $==="string"&&$.length>0&&$.trim()===$}function R6($,Z,J){return $[Z]===void 0||J($[Z])}function S7($){return $==="poll"||$==="headers"}function dY($){return V$($)&&b$($,["amountMinor","currency","exponent"])&&t$($.amountMinor)&&J$($.currency)&&/^[A-Za-z]{3}$/.test($.currency)&&t$($.exponent)&&Number.isInteger($.exponent)&&$.exponent>=0&&$.exponent<=20}function hU($){return V$($)&&b$($,["used","limit","exhausted"],["utilizationPercent","severity"])&&dY($.used)&&dY($.limit)&&typeof $.exhausted==="boolean"&&R6($,"utilizationPercent",t$)&&R6($,"severity",(Z)=>typeof Z==="string")}function mU($){return V$($)&&b$($,[],UZ)&&Object.values($).every(S7)}var bQ=["checkedAt","accountIdentity","extraUsage","bindingWindow","bindingWindowSource","fieldSources","fallbackAdvised","source"];function gQ($){return R6($,"checkedAt",W5)&&R6($,"accountIdentity",J$)&&R6($,"extraUsage",hU)&&R6($,"bindingWindow",J$)&&R6($,"bindingWindowSource",S7)&&R6($,"fieldSources",mU)&&R6($,"fallbackAdvised",(Z)=>typeof Z==="boolean")&&R6($,"source",S7)}function T2($,Z){if(!V$($)||!b$($,Z?["usedPercent","remainingPercent","checkedAt","id","title","modelName"]:["usedPercent","remainingPercent","checkedAt"],Z?["resetsAt","modelId"]:["resetsAt"]))return!1;return t$($.usedPercent)&&t$($.remainingPercent)&&W5($.checkedAt)&&R6($,"resetsAt",(J)=>typeof J==="string")&&(!Z||J$($.id)&&J$($.title)&&J$($.modelName)&&R6($,"modelId",J$))}function k7($){return V$($)&&b$($,[],["five_hour","seven_day","scoped",...bQ])&&gQ($)&&R6($,"five_hour",(Z)=>T2(Z,!1))&&R6($,"seven_day",(Z)=>T2(Z,!1))&&R6($,"scoped",(Z)=>Array.isArray(Z)&&Z.every((J)=>T2(J,!0))&&new Set(Z.map((J)=>J.id)).size===Z.length)}function uU($){return V$($)&&b$($,["id","title","modelName","remainingPercent"],["modelId"])&&J$($.id)&&J$($.title)&&J$($.modelName)&&R6($,"modelId",J$)&&t$($.remainingPercent)}function pU($){return V$($)&&b$($,["version","remainingPercent"],["scoped",...bQ])&&$.version===1&&gQ($)&&V$($.remainingPercent)&&b$($.remainingPercent,[],["five_hour","seven_day"])&&Object.values($.remainingPercent).every(t$)&&R6($,"scoped",(Z)=>Array.isArray(Z)&&Z.every(uU))}function iY($){let Z=$.toLowerCase().replace(/[^a-z0-9]/g,"");if(Z.includes("fable"))return"fable";if(Z.includes("mythos"))return"mythos";return`model:${Z}`}function yQ($){let Z=iY([$.modelId,$.modelName,$.title].join(" "));return{scope:Z==="fable"||Z==="mythos"?Z:iY($.modelId??$.modelName),label:`seven_day:${$.id}`}}function s0($){if(!k7($))throw new U0;let Z=JSON.parse(JSON.stringify($));if(!k7(Z))throw new U0;let{five_hour:J,seven_day:X,scoped:Y,...G}=Z,z=[],Q={};if(J){let{remainingPercent:V,...B}=J;Q.five_hour=V,z.push({scope:"all",label:"five_hour",kind:"reading",...B})}if(X){let{remainingPercent:V,...B}=X;Q.seven_day=V,z.push({scope:"all",label:"seven_day",kind:"reading",...B})}let K=Y?.map((V)=>{let{usedPercent:B,checkedAt:q,resetsAt:H,...j}=V;return z.push({...yQ(j),kind:"reading",usedPercent:B,checkedAt:q,...H!==void 0?{resetsAt:H}:{}}),j}),W={limits:z,anthropic:{version:1,remainingPercent:Q,...G,...K!==void 0?{scoped:K}:{}}};if(G.extraUsage&&G.checkedAt!==void 0)W.budget={kind:"reading",checkedAt:G.checkedAt,reached:G.extraUsage.exhausted,...G.extraUsage.utilizationPercent!==void 0?{usedPercent:G.extraUsage.utilizationPercent}:{}};if(!d9(W))throw new U0;return W}function cU($){return V$($)&&b$($,["scope","label","kind","checkedAt","usedPercent"],["resetsAt"])&&J$($.scope)&&J$($.label)&&$.kind==="reading"&&W5($.checkedAt)&&t$($.usedPercent)&&R6($,"resetsAt",(Z)=>typeof Z==="string")}function v7($,Z){if(Array.isArray($)&&Array.isArray(Z))return $.length===Z.length&&$.every((J,X)=>v7(J,Z[X]));if(V$($)&&V$(Z))return Object.keys($).length===Object.keys(Z).length&&Object.keys($).every((J)=>Object.hasOwn(Z,J)&&v7($[J],Z[J]));return $===Z}function x0($){if(!V$($)||!b$($,["limits","anthropic"],["budget"])||!d9($)||!$.limits.every(cU)||!pU($.anthropic))throw new U0;let{version:Z,remainingPercent:J,scoped:X,...Y}=$.anthropic,G=structuredClone(Y);for(let z of["five_hour","seven_day"]){let Q=$.limits.find((V)=>V.scope==="all"&&V.label===z),K=z==="five_hour"?J.five_hour:J.seven_day;if(Q?.kind!=="reading"||K===void 0)continue;let W={usedPercent:Q.usedPercent,remainingPercent:K,checkedAt:Q.checkedAt,...Q.resetsAt!==void 0?{resetsAt:Q.resetsAt}:{}};if(z==="five_hour")G.five_hour=W;else G.seven_day=W}if(X!==void 0)G.scoped=X.map((z)=>{let Q=yQ(z),K=$.limits.find((W)=>W.scope===Q.scope&&W.label===Q.label);if(K?.kind!=="reading")throw new U0;return{...structuredClone(z),usedPercent:K.usedPercent,checkedAt:K.checkedAt,...K.resetsAt!==void 0?{resetsAt:K.resetsAt}:{}}});if(!v7(s0(G),$))throw new U0;return G}var d$={validate($){try{return x0($),!0}catch{return!1}},merge($,Z){let J=x0(Z);if($===void 0)return s0(J);let X=x0($);if(X.accountIdentity!==J.accountIdentity)throw new U0;if(J.source==="headers")return s0(CB(X,J));let Y=o0(X),G=o0(J);return s0(Y>G||Y===G&&X.source==="poll"&&J.source!=="poll"?X:J)}};class JZ extends Error{constructor(){super("Anthropic account binding is unavailable or changed");this.name="NativePoolBindingError"}}function XZ($){return typeof $==="string"&&$.length>0&&$.trim()===$}function V5($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function x6($){if(!$||typeof $!=="object"||Array.isArray($))return!1;let Z=$;return Z.kind==="local"&&typeof Z.storageId==="string"&&/^[a-f0-9]{64}$/.test(Z.storageId)&&XZ(Z.rowId)&&V5(Z.credentialEpoch)&&(Z.identity===void 0||XZ(Z.identity))&&["kind","storageId","rowId","credentialEpoch"].every((J)=>Object.hasOwn(Z,J))&&(Z.identity===void 0||Object.hasOwn(Z,"identity"))&&Object.keys(Z).every((J)=>["kind","storageId","rowId","credentialEpoch","identity"].includes(J))}function mQ($){return $.stamp==="bound"&&!$.invalid&&!$.torn&&!$.unbound&&XZ($.id)&&V5($.credentialEpoch)&&($.identity===void 0||XZ($.identity))}function $x($,Z){let J=Z.credentialEpoch;if(!Z.candidate||!mQ(Z)||!V5(J))throw new JZ;let X={kind:"local",storageId:$.storageId,rowId:Z.id,credentialEpoch:J,...Z.identity!==void 0?{identity:Z.identity}:{}};if(!x6(X))throw new JZ;return Object.freeze(X)}function x$($,Z,J){return x6($)&&mQ(J)&&$.storageId===Z.storageId&&$.rowId===J.id&&$.credentialEpoch===J.credentialEpoch&&$.identity===J.identity}function aY($){if(!x6($))throw new JZ;return eU("sha256").update(JSON.stringify(["anthropic-local-refresh",$.storageId,$.credentialEpoch,$.identity===void 0?["row",$.rowId]:["account",$.identity]])).digest("hex")}function S$($){return Zx("sha256").update($).digest("hex").slice(0,16)}function f7($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function nY($,Z,J=[]){return Z.every((X)=>Object.hasOwn($,X))&&Object.keys($).every((X)=>Z.includes(X)||J.includes(X))}function YZ($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0}function oY($){return typeof $==="string"&&$.length>0&&$.trim()===$}function $8($){if(!f7($)||!nY($,["binding","credentialFingerprint","version"])||!x6($.binding)||$.binding.identity===void 0||typeof $.credentialFingerprint!=="string"||!/^[a-f0-9]{64}$/.test($.credentialFingerprint)||!f7($.version)||!nY($.version,["accessFingerprint","expires"],["lastRefreshedAt"]))return!1;return typeof $.version.accessFingerprint==="string"&&/^[a-f0-9]{16}$/.test($.version.accessFingerprint)&&YZ($.version.expires)&&$.version.expires>0&&(!Object.hasOwn($.version,"lastRefreshedAt")||YZ($.version.lastRefreshedAt))}function c0($,Z,J){if(!$8($)||!x6(Z)||Z.identity===void 0||!f7(J)||J.type!=="oauth"||!oY(J.access)||!oY(J.refresh)||!YZ(J.expires)||J.expires<=0||Object.hasOwn(J,"lastRefreshedAt")&&!YZ(J.lastRefreshedAt))return!1;return $.binding.storageId===Z.storageId&&$.binding.rowId===Z.rowId&&$.binding.credentialEpoch===Z.credentialEpoch&&$.binding.identity===Z.identity&&$.credentialFingerprint===I6({type:"oauth",refresh:J.refresh})&&$.version.accessFingerprint===S$(J.access)&&$.version.expires===J.expires&&Object.hasOwn($.version,"lastRefreshedAt")===Object.hasOwn(J,"lastRefreshedAt")&&$.version.lastRefreshedAt===J.lastRefreshedAt}function uQ($){if(!$)return;return(Z)=>{try{let J=$(Z);if(J!==null&&(typeof J==="object"||typeof J==="function")&&"then"in J&&typeof J.then==="function")Promise.resolve(J).catch(()=>{})}catch{}}}class D0 extends Error{code;constructor($){super($==="supervised-auth-snapshot"?"Local login cannot be verified while OPENCODE_AUTH_CONTENT is set. Run setup without OPENCODE_AUTH_CONTENT in the environment.":"Invalid native host auth source.");this.name="NativeHostAuthError",this.code=$==="supervised-auth-snapshot"?$:"invalid-source"}}function Gx($){return $.OPENCODE_AUTH_CONTENT!==void 0}function cQ($){if(Gx($))throw new D0("supervised-auth-snapshot")}function O6(){throw new D0("invalid-source")}function D4($){if($===null||typeof $!=="object"||Array.isArray($))return!1;let Z=Object.getPrototypeOf($);return Z===Object.prototype||Z===null}function C9($){let Z=new Map;for(let J of Reflect.ownKeys($)){if(typeof J!=="string")O6();let X=Object.getOwnPropertyDescriptor($,J);if(!X||!Object.hasOwn(X,"value"))O6();Z.set(J,X.value)}return Z}function E7($,Z=new Set){if($===null||typeof $==="string"||typeof $==="boolean")return JSON.stringify($);if(typeof $==="number"){if(!Number.isFinite($))O6();return JSON.stringify($)}if(typeof $!=="object")O6();if(Z.has($))O6();Z.add($);try{if(Array.isArray($)){if(Object.getPrototypeOf($)!==Array.prototype)O6();let X=C9($),Y=X.get("length");if(X.size!==Y+1)O6();let G=[];for(let z=0;z<Y;z++){let Q=String(z);if(!X.has(Q))O6();G.push(E7(X.get(Q),Z))}return`[${G.join(",")}]`}if(!D4($))O6();let J=C9($);return`{${[...J.keys()].sort().map((X)=>`${JSON.stringify(X)}:${E7(J.get(X),Z)}`).join(",")}}`}finally{Z.delete($)}}function l6($,Z){try{if($!=="opencode"&&$!=="pi")O6();if(Z===void 0)return Object.freeze({kind:"absent",digest:"absent"});if(!D4(Z))O6();let J=C9(Z);if(!J.has("anthropic"))return Object.freeze({kind:"absent",digest:"absent"});let X=J.get("anthropic");if(!D4(X))O6();let Y=C9(X),G=E7(X),z,Q=Y.get("type");if(Q==="oauth"){if(typeof Y.get("access")!=="string"||typeof Y.get("refresh")!=="string"||typeof Y.get("expires")!=="number"||!Number.isFinite(Y.get("expires")))O6();let K=LZ("anthropic");z=Y.size===4&&Object.entries(K).every(([W,V])=>Y.get(W)===V)?"activation":"oauth"}else if($==="opencode"&&Q==="api"){if(typeof Y.get("key")!=="string")O6();z="api"}else if($==="pi"&&Q==="api_key"){if(Y.has("key")&&typeof Y.get("key")!=="string")O6();if(Y.has("env")){let K=Y.get("env");if(!D4(K))O6();for(let W of C9(K).values())if(typeof W!=="string")O6()}z="api_key"}else O6();if(z!=="activation")for(let K of["access","refresh","key"]){let W=Y.get(K);if(typeof W==="string"&&W.startsWith("claustrum-tombstone:"))O6()}return Object.freeze({kind:z,digest:Yx("sha256").update(G,"utf8").digest("hex")})}catch{throw new D0("invalid-source")}}class q5 extends Error{code="prepared-proof-refused";constructor(){super("Native migration prepared proof is unavailable or changed");this.name="NativeMigrationProofError"}}function K6(){throw new q5}function j5($){if(!$||typeof $!=="object"||Array.isArray($)||B5.isProxy($))K6();let Z=Object.getPrototypeOf($);if(Z!==Object.prototype&&Z!==null)K6();for(let J of Reflect.ownKeys($)){if(typeof J!=="string")K6();let X=Object.getOwnPropertyDescriptor($,J);if(!X||!Object.hasOwn(X,"value"))K6()}}function t0($){let Z=new Set;function J(X){if(X===null||typeof X==="string"||typeof X==="boolean")return X;if(typeof X==="number"&&Number.isFinite(X))return X;if(typeof X!=="object"||B5.isProxy(X)||Z.has(X))K6();let Y=Object.getPrototypeOf(X);if(Y!==(Array.isArray(X)?Array.prototype:Object.prototype)&&!(Y===null&&!Array.isArray(X)))K6();Z.add(X);try{let G=new Map;for(let Q of Reflect.ownKeys(X)){if(typeof Q!=="string")K6();let K=Object.getOwnPropertyDescriptor(X,Q);if(!K||!Object.hasOwn(K,"value"))K6();G.set(Q,K.value)}if(Array.isArray(X)){let Q=G.get("length");if(typeof Q!=="number"||G.size!==Q+1)K6();return Array.from({length:Q},(K,W)=>{if(!G.has(String(W)))K6();return J(G.get(String(W)))})}let z=Object.create(null);for(let Q of[...G.keys()].sort())z[Q]=J(G.get(Q));return z}finally{Z.delete(X)}}return J($)}function M6($){return JSON.stringify(t0($))}function b7($){return zx("sha256").update(M6($)).digest("hex")}function g7($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function e1($,Z,J){if(!Object.hasOwn($,Z))return["absent"];if(typeof $[Z]!==J)K6();return["present",$[Z]]}function Qx($){let Z=t0($);if(!g7(Z))K6();if(Z.type==="oauth"&&typeof Z.refresh==="string"){if(Object.keys(Z).some((J)=>!["type","access","refresh","expires","lastRefreshedAt"].includes(J)))K6();return b7(["anthropic-prepared-credential-v1","oauth",e1(Z,"access","string"),Z.refresh,e1(Z,"expires","number"),e1(Z,"lastRefreshedAt","number")])}if(Z.type==="api"&&typeof Z.apiKey==="string"&&typeof Z.baseURL==="string"){if(Object.keys(Z).some((J)=>!["type","apiKey","baseURL","authHeader"].includes(J)))K6();if(Object.hasOwn(Z,"authHeader")&&Z.authHeader!=="x-api-key"&&Z.authHeader!=="authorization-bearer")K6();return b7(["anthropic-prepared-credential-v1","api",Z.apiKey,Z.baseURL,e1(Z,"authHeader","string")])}return K6()}function lQ($,Z){if(B5.isProxy($)||!Array.isArray($)||Object.getPrototypeOf($)!==Array.prototype)K6();let J=Object.getOwnPropertyDescriptors($);if(Reflect.ownKeys(J).length!==$.length+1)K6();let X=Array.from({length:$.length},(Y,G)=>{let z=J[String(G)];if(!z||!Object.hasOwn(z,"value"))K6();let Q=z.value;if(j5(Q),Q.stamp!=="bound"||Q.invalid||Q.torn||Q.unbound||!Q.credential||typeof Q.credentialEpoch!=="number"||!Number.isSafeInteger(Q.credentialEpoch)||Q.credentialEpoch<=0||typeof Q.id!=="string"||!Q.id||Q.identity!==void 0&&(typeof Q.identity!=="string"||!Q.identity))K6();return{id:Q.id,credentialEpoch:Q.credentialEpoch,identity:Q.identity??null,stamp:"bound",credentialDigest:Qx(Q.credential)}}).sort((Y,G)=>Y.id<G.id?-1:Y.id>G.id?1:0);if(new Set(X.map((Y)=>Y.id)).size!==X.length)K6();return{version:1,rows:X,runtimeDigest:b7(Z)}}function dQ($){let Z=t0($),J=(Y)=>typeof Y==="string"&&/^[a-f0-9]{64}$/.test(Y);if(!g7(Z)||Object.keys(Z).length!==3||Z.version!==1||!Array.isArray(Z.rows)||!J(Z.runtimeDigest))K6();let X=Z.rows.map((Y)=>{if(!g7(Y)||Object.keys(Y).length!==5||typeof Y.id!=="string"||!Y.id||typeof Y.credentialEpoch!=="number"||!Number.isSafeInteger(Y.credentialEpoch)||Y.credentialEpoch<=0||!(Y.identity===null||typeof Y.identity==="string"&&Y.identity.length>0)||Y.stamp!=="bound"||typeof Y.credentialDigest!=="string"||!J(Y.credentialDigest))K6();return{id:Y.id,credentialEpoch:Y.credentialEpoch,identity:Y.identity,stamp:"bound",credentialDigest:Y.credentialDigest}});if(new Set(X.map((Y)=>Y.id)).size!==X.length)K6();return{version:1,rows:X,runtimeDigest:Z.runtimeDigest}}function F2($,Z,J){if(!$||M6(dQ($))!==M6(lQ(Z,J)))K6()}class H5 extends Error{code="invalid-migration-source";constructor(){super("Native migration source cannot be imported safely");this.name="NativeMigrationProjectionError"}}function $6(){throw new H5}function y8($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function k6($){if($===void 0)return Object.create(null);if(!y8($))$6();return $}function r6($){return typeof $==="string"&&$.length>0&&$.trim()===$}function rY($){if(!r6($)||["__proto__","constructor","prototype"].includes($))$6();return $}function f0($){return typeof $==="number"&&Number.isFinite($)&&$>=0?$:0}function eY($){if($===void 0)return;if(!r6($))$6();return $}function F8($,Z){return Object.fromEntries(Z.filter((J)=>Object.hasOwn($,J)).map((J)=>[J,$[J]]))}var iQ={routing:["mode"],refresh:["enabled","intervalMinutes","refreshBeforeExpiryMinutes"],quota:["enabled","checkIntervalMinutes","refreshEveryNRequests","minimumRemaining","failClosedOnUnknownQuota","showToasts"],quotaHeaderFeed:["enabled"],claudeCache:["enabled","mode"],dump:["enabled"],logging:["level"],claudeFast:["enabled"],thinkingBinding:["prefixMismatchBehavior"],costZeroing:["enabled"],cacheKeep:["enabled","always","startHour","endHour","subagents"],prime:["enabled"],relay:["enabled","url","fallbackToDirect","transport"],killswitch:["enabled","main","accounts"]};function y7($){let Z=(X)=>y8(X)&&Object.entries(X).every(([Y,G])=>["five_hour","seven_day","5h","1w","scoped"].includes(Y)&&typeof G==="number"&&Number.isFinite(G)&&G>=0&&G<=100),J={"routing.mode":["main-first","fallback-first","sticky-balanced"],"claudeCache.mode":hz,"logging.level":["debug","info","warn","error","trace"],"thinkingBinding.prefixMismatchBehavior":["account-default","error","drop_block"],"relay.transport":["http","websocket"]};for(let[X,Y]of Object.entries(iQ)){if($[X]===void 0)continue;let G=k6($[X]);for(let z of Y){if(G[z]===void 0)continue;let Q=J[`${X}.${z}`];if(Q){if(typeof G[z]!=="string"||!Q.includes(G[z]))$6();continue}if(["enabled","always","subagents","failClosedOnUnknownQuota","showToasts","fallbackToDirect"].includes(z)){if(typeof G[z]!=="boolean")$6()}else if(z==="url"){if(typeof G[z]!=="string"||!cz(G[z]))$6()}else if(z==="minimumRemaining"||z==="main"){if(!Z(G[z]))$6()}else if(z==="accounts"){if(!y8(G[z])||!Object.entries(G[z]).every(([K,W])=>r6(K)&&Z(W)))$6()}else if(typeof G[z]!=="number"||!Number.isFinite(G[z])||G[z]<0)$6()}}}function C2($){if($.type==="oauth"&&r6($.refresh)){if($.access!==void 0&&typeof $.access!=="string"||$.expires!==void 0&&(typeof $.expires!=="number"||!Number.isFinite($.expires)))$6();return{type:"oauth",refresh:$.refresh,...typeof $.access==="string"?{access:$.access}:{},...typeof $.expires==="number"?{expires:$.expires}:{}}}if($.type==="api"&&r6($.apiKey)&&typeof $.baseURL==="string"&&cz($.baseURL)){if($.authHeader!==void 0&&$.authHeader!=="authorization-bearer"&&$.authHeader!=="x-api-key")$6();return{type:"api",apiKey:$.apiKey,baseURL:$.baseURL,authHeader:$.authHeader??"authorization-bearer"}}return $6()}function $G($,Z,J){let X=F8($,["lastUsed","lastRefreshedAt","refreshErrorClearedAt","quotaErrorClearedAt","quotaErrorGeneration","prime","authLineageId","primeAuthLineageRefreshTokenFingerprint"]),Y=J?.type==="oauth"?S$(J.access??""):Z;if($.quotaToken!==void 0&&$.quotaToken===Y){if(X.quotaToken=$.quotaToken,$.quotaCheckedAt!==void 0)X.quotaCheckedAt=$.quotaCheckedAt}if(y8($.profile)&&Z!==void 0&&($.profile.providerAccountUuid===Z||$.profile.accountIdentity===Z))X.profile=F8($.profile,["tier","orgType","checkedAt","accountIdentity","providerAccountUuid","tokenFingerprint"]);for(let G of["lastRefreshError","lastQuotaRefreshError"]){let z=$[G],Q=X[G==="lastRefreshError"?"refreshErrorClearedAt":"quotaErrorClearedAt"];if(!y8(z)||typeof Q==="number"&&f0(z.checkedAt)<=Q||z.accountIdentity!==void 0&&z.accountIdentity!==Z)continue;let K=F8(z,["checkedAt","nextRetryAt","retryCount","accountIdentity","status","permanent"]);if(K.message=G==="lastRefreshError"?"Imported refresh failure":"Imported quota failure",G==="lastRefreshError"&&J?.type==="oauth"&&z.tokenHash===pQ("sha256").update(J.refresh).digest("hex"))K.credentialFingerprint=I6(J);X[G]=K}return X}function ZG($,Z){if($===void 0)return;if(!k7($))return;if(Z===void 0||$.accountIdentity!==Z)return;return s0($)}function Kx($){try{j5($);let Z=k6($.config===void 0?void 0:t0($.config)),J=k6($.state===void 0?void 0:t0($.state)),X=k6($.hostAuth===void 0?void 0:t0($.hostAuth)),Y=l6($.host,X);if(Z.version!==void 0&&Z.version!==1||J.version!==void 0&&J.version!==1)$6();let G=pQ("sha256").update(JSON.stringify([$.storageId,$.configDigest,"former-main"])).digest("hex"),z=Z.mainAccountId===void 0?`${G.slice(0,8)}-${G.slice(8,12)}-${G.slice(12,16)}-${G.slice(16,20)}-${G.slice(20,32)}`:rY(Z.mainAccountId),Q={mainAccountId:z,formerMainRowId:z};for(let[_,N]of Object.entries(iQ))if(Z[_]!==void 0)Q[_]=F8(k6(Z[_]),N);if(Z.fallbackOn!==void 0){if(!Array.isArray(Z.fallbackOn)||Z.fallbackOn.some((_)=>typeof _!=="number"||!Number.isInteger(_)))$6();Q.fallbackOn=Z.fallbackOn}let K=k6(Z.claustrum),W=K.primaryAccount,V;if(W!==void 0){let _=k6(W);if(!r6(_.credentialId)||!r6(_.accountId))$6();V={credentialId:_.credentialId,accountIdentity:_.accountId}}let B=K.disabledAccountIdentities??[];if(!Array.isArray(B)||B.some((_)=>!r6(_)))$6();let q=[];for(let _ of B){if(!r6(_))$6();q.push(_)}if(K.mode==="claustrum"&&!V)$6();Q.claustrum={mode:V?"claustrum":"local",...W?{primaryAccount:W}:{},disabledAccountIdentities:B};let H=[],j=[],x={...k6(Z.main),...k6(J.main)};if(V||Y.kind==="oauth"){let _;if(!V){let O=k6(X.anthropic);_=Y.kind==="oauth"?C2(O):C2({type:"api",apiKey:O.key,baseURL:"https://api.anthropic.com",authHeader:"x-api-key"})}let N=V?.accountIdentity??(y8(x.profile)&&_?.type==="oauth"&&(x.profileToken===S$(_.access??"")||x.profile.tokenFingerprint===S$(_.access??""))?eY(x.profile.providerAccountUuid):void 0),R=k6(Z.quota),S=k6(Z.refresh),E=k6(Z.prime),m={...F8(S,[]),...x};for(let[O,P]of Object.entries({lastRefreshError:"mainLastRefreshError",refreshErrorClearedAt:"mainRefreshErrorClearedAt"}))if(!Object.hasOwn(m,O)&&S[P]!==void 0)m[O]=S[P];for(let[O,P]of Object.entries({lastQuotaRefreshError:"mainLastQuotaApiError",quotaErrorClearedAt:"mainQuotaErrorClearedAt",quotaErrorGeneration:"mainQuotaErrorGeneration"}))if(!Object.hasOwn(m,O)&&R[P]!==void 0)m[O]=R[P];if(x.lastQuotaApiError!==void 0)m.lastQuotaRefreshError=x.lastQuotaApiError;if(m.authLineageId=x.primeAuthLineageId??E.mainAuthLineageId,m.primeAuthLineageRefreshTokenFingerprint=x.primeAuthLineageRefreshTokenFingerprint??E.mainAuthLineageRefreshTokenFingerprint,m.prime===void 0&&E.main!==void 0)m.prime=E.main;let s={id:z,enabled:!0,runtime:$G(m,N,_),...N!==void 0?{identity:N}:{},..._?{credential:_}:{}},c=x.quota??R.mainQuota,I=x.quotaToken??R.mainQuotaToken;if(V||_?.type==="oauth"&&I===S$(_.access??""))s.quota=ZG(c,N);H.push(s)}if(Z.accounts!==void 0&&!Array.isArray(Z.accounts))$6();let L=k6(J.accounts);for(let _ of Array.isArray(Z.accounts)?Z.accounts:[]){let N=k6(_),R=rY(N.id);if(N.enabled!==void 0&&typeof N.enabled!=="boolean")$6();let S=F8(k6(L[R]),["access","refresh","expires","apiKey","lastUsed","lastRefreshedAt","anthropicAccountUuid","claustrumScopedCredentialId","claustrumScopedState","authLineageId","lastRefreshError","lastQuotaRefreshError","quota","profile","prime","refreshErrorClearedAt","quotaErrorClearedAt","quotaErrorGeneration"]),E=N.claustrumScopedCredentialId!==void 0,m=E&&S.claustrumScopedCredentialId===N.claustrumScopedCredentialId&&S.anthropicAccountUuid===N.anthropicAccountUuid,s=Math.max(f0(N.lastRefreshedAt),f0(N.lastUsed),f0(N.addedAt)),c=Math.max(f0(S.lastRefreshedAt),f0(S.lastUsed),f0(S.addedAt)),I=["access","refresh","apiKey"].some((w)=>N[w]!==void 0&&S[w]!==void 0&&N[w]!==S[w]),O=I&&s>c;if(I&&s===c)$6();let P=E?{...m?S:{},...N}:O?{...S,...N}:{...N,...S};if(O)delete P.quota,delete P.lastRefreshError,delete P.lastQuotaRefreshError;let D=eY(N.anthropicAccountUuid??P.anthropicAccountUuid);if(N.anthropicAccountUuid!==void 0&&S.anthropicAccountUuid!==void 0&&N.anthropicAccountUuid!==S.anthropicAccountUuid)$6();if(V&&N.type==="oauth"&&!E)$6();let T=E?void 0:C2(P);if(E){if(N.type!=="oauth"||!r6(N.claustrumScopedCredentialId)||!D||r6(N.refresh)||N.access!==void 0)$6();j.push({routeId:R,scopedCredentialId:N.claustrumScopedCredentialId,anthropicAccountUuid:D,enabled:N.enabled!==!1,...r6(N.label)?{label:N.label}:{},...typeof N.addedAt==="number"?{addedAt:N.addedAt}:{}})}let C={id:R,enabled:N.enabled!==!1,runtime:$G(P,D,T),...D!==void 0?{identity:D}:{},...r6(N.label)?{label:N.label}:{},...T?{credential:T}:{}},k=ZG(P.quota,D);if(k)C.quota=k;H.push(C)}if(new Set(H.map((_)=>_.id)).size!==H.length)$6();let U=new Set,M=new Set;for(let _ of H){if(_.enabled&&_.identity){if(U.has(_.identity))$6();U.add(_.identity)}if(_.credential){let N=I6(_.credential);if(M.has(N))$6();M.add(N),Object.defineProperty(_,"credential",{enumerable:!1})}for(let N of Object.keys(_.runtime))if(_.runtime[N]===void 0)delete _.runtime[N];if(_.quota===void 0)delete _.quota}y7(Q);let A=k6(Z.relay);return{accounts:H,settings:Q,mainRouteId:z,custodyRows:j,disabledAccountIdentities:q,...V?{custodyPrimary:V}:{},...typeof A.token==="string"?{relay:{token:A.token}}:{}}}catch{return $6()}}function z9($,Z,J=!0){let X=$.accounts.filter((Y)=>Y.credential!==void 0);if(Z.length!==X.length)$6();for(let Y of X){let G=Z.find((Q)=>Q.id===Y.id);if(G?.stamp!=="bound"||G.invalid||G.torn||G.unbound||G.identity!==Y.identity||G.enabled!==Y.enabled||!G.credential)$6();let z;if(G.credential.type==="oauth"){let{lastRefreshedAt:Q,...K}=G.credential;z=K}else z=G.credential;if(M6(z)!==M6(Y.credential))$6();if(J&&M6(G.quota??null)!==M6(Y.quota??null))$6()}}function h7($,Z,J,X){let Y=Object.create(null);for(let G of Z.accounts.filter((z)=>z.credential)){let z=J.find((Q)=>Q.id===G.id);if(z?.stamp!=="bound"||z.credentialEpoch===void 0)$6();Y[G.id]={binding:{kind:"local",storageId:$.storageId,rowId:z.id,credentialEpoch:z.credentialEpoch,...z.identity!==void 0?{identity:z.identity}:{}},...G.runtime}}if(X)for(let G of Z.accounts.filter((z)=>!z.credential)){let z=X.rows.find((Q)=>Q.routeId===G.id);if(!z?.accountIdentity||z.accountIdentity!==G.identity)$6();Y[G.id]={binding:{kind:"custody",storageId:$.storageId,routeId:z.routeId,credentialId:z.credentialId,accountIdentity:z.accountIdentity,recordVersion:0},...G.runtime,...G.quota?{quota:G.quota}:{}}}return L5({version:1,storageId:$.storageId,accounts:Y,...Z.relay?{relay:Z.relay}:{}},$.storageId)}function l0($){return $!==null&&typeof $==="object"&&!Array.isArray($)}async function m7($){try{return JSON.parse(await Xx($,"utf8"))}catch{return}}async function O4($){try{return await Jx($),!1}catch(Z){if(Z instanceof Error&&"code"in Z&&Z.code==="ENOENT")return!0;throw Z}}var Wx={routing:["mode"],claudeCache:["enabled","mode"],cacheKeep:["enabled","always","startHour","endHour","subagents"],quota:["enabled","checkIntervalMinutes","minimumRemaining","failClosedOnUnknownQuota"],killswitch:["enabled","main"],claudeFast:["enabled"],prime:["enabled"],logging:["level"],dump:["enabled"]};async function Vx($){let Z=await m7($),J={};if(!l0(Z)||Z.version!==void 0&&Z.version!==1)return J;for(let[X,Y]of Object.entries(Wx)){let G=Z[X];if(!l0(G))continue;let z={};for(let Q of Y){let K=G[Q];if(K===void 0)continue;if((Q==="minimumRemaining"||X==="killswitch"&&Q==="main")&&l0(K)){let W={};for(let V of["five_hour","seven_day","5h","1w","scoped"]){if(K[V]===void 0)continue;try{y7({[X]:{[Q]:{[V]:K[V]}}}),W[V]=K[V]}catch{}}if(Object.keys(W).length)z[Q]=W;continue}try{y7({[X]:{[Q]:K}}),z[Q]=K}catch{}}if(Object.keys(z).length)J[X]=z}if(Array.isArray(Z.fallbackOn))J.fallbackOn=Z.fallbackOn.filter((X)=>typeof X==="number"&&Number.isInteger(X));return J}function S2($){return typeof $==="string"&&/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test($)}function Bx($,Z){let J=new Map;if(!l0($)||$.version!==void 0&&$.version!==1)return J;let X=new Map,Y=new Set;for(let W of Z.rows){if(W.credentialType!=="oauth"||W.state!=="active"||W.stale||W.unclaimed||!S2(W.accountIdentity))continue;if(X.has(W.accountIdentity))Y.add(W.accountIdentity);X.set(W.accountIdentity,W.routeId)}function G(W,V){if(typeof W!=="string"||!S2(V)||Y.has(V))return;let B=X.get(V);if(B)J.set(W,{routeId:B,accountIdentity:V})}let z=l0($.claustrum)?$.claustrum:void 0,Q=l0(z?.primaryAccount)?z.primaryAccount:void 0,K=S2(Q?.accountId)?Q.accountId:$.mainAccountId;G("main",K),G($.mainAccountId,K);for(let W of Array.isArray($.accounts)?$.accounts:[])if(l0(W)&&W.type==="oauth")G(W.id,W.anthropicAccountUuid);return J}function j1($){return[{path:$.config,name:"pool-config"},{path:$.state,name:"pool-state"}]}function O0($){let Z=wU({provider:"anthropic",configPath:$.paths.config,statePath:$.paths.state,storeLocks:j1($.paths),requireCredentialStamps:!0,quota:$.quota,now:$.now,onStep:$.onStep,hold:$.hold,logger:$.logger,onLockEvent:uQ($.onLockEvent),onLockStep:$.onLockStep}),J=$.paths.legacySeedConfig;if(!J)return Z;return{...Z,updateSettings:(X,Y)=>Z.updateSettings(async(G)=>{if(await O4($.paths.config))Object.assign(G,await Vx(J));return X(G)},Y)}}class g extends Error{code;constructor($){super({"invalid-runtime":"Anthropic runtime state is invalid","unsafe-runtime":"Anthropic runtime file is not owner-only regular storage","runtime-io":"Anthropic runtime storage is unavailable","runtime-conflict":"Anthropic runtime observation is older than persisted state","publication-refused":"Anthropic runtime publication was refused"}[$]);this.code=$,this.name="NativeRuntimeError"}}function P6($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function B$($,Z,J=[]){return Z.every((X)=>Object.hasOwn($,X))&&Object.keys($).every((X)=>Z.includes(X)||J.includes(X))}function X$($){return typeof $==="string"&&$.length>0&&$.trim()===$}function a$($){return typeof $==="number"&&Number.isFinite($)&&$>=0}function A6($){return a$($)&&Number.isSafeInteger($)}function z6($,Z,J){return!Object.hasOwn($,Z)||J($[Z])}function n$($){return typeof $==="string"&&/^[a-f0-9]{64}$/.test($)}function h8($){return typeof $==="string"&&/^[a-f0-9]{16}$/.test($)}function sQ($){return typeof $==="string"&&/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test($)}function qx($){return x6($)||P6($)&&B$($,["kind","storageId","routeId","credentialId","accountIdentity","recordVersion"])&&$.kind==="custody"&&n$($.storageId)&&X$($.routeId)&&X$($.credentialId)&&X$($.accountIdentity)&&A6($.recordVersion)}function S9($,Z=[]){return P6($)&&B$($,["message","checkedAt"],["nextRetryAt","retryCount","accountIdentity","tokenHash","refreshTokenFingerprint","status","permanent",...Z])&&typeof $.message==="string"&&a$($.checkedAt)&&z6($,"nextRetryAt",a$)&&z6($,"retryCount",A6)&&z6($,"accountIdentity",X$)&&z6($,"tokenHash",n$)&&z6($,"refreshTokenFingerprint",h8)&&z6($,"status",(J)=>A6(J)&&J>=100&&J<=599)&&z6($,"permanent",(J)=>typeof J==="boolean")}function u7($){return S9($,["credentialFingerprint"])&&P6($)&&z6($,"credentialFingerprint",n$)}function jx($,Z){return P6($)&&B$($,["subject","checkedAt","nextRetryAt"])&&Z.kind==="local"&&Z.identity!==void 0&&$8($.subject)&&$.subject.binding.storageId===Z.storageId&&$.subject.binding.rowId===Z.rowId&&$.subject.binding.credentialEpoch===Z.credentialEpoch&&$.subject.binding.identity===Z.identity&&A6($.checkedAt)&&A6($.nextRetryAt)&&$.nextRetryAt>=$.checkedAt}function Hx($){return P6($)&&B$($,["tier","orgType","checkedAt"],["accountIdentity","providerAccountUuid","tokenFingerprint"])&&X$($.tier)&&X$($.orgType)&&a$($.checkedAt)&&z6($,"accountIdentity",X$)&&z6($,"providerAccountUuid",X$)&&z6($,"tokenFingerprint",h8)}function Lx($){return P6($)&&B$($,["count","inputTokens","outputTokens","since"])&&A6($.count)&&A6($.inputTokens)&&A6($.outputTokens)&&a$($.since)}var Nx=["credentialValidation","validationRetry","lastUsed","lastRefreshedAt","lastRefreshError","refreshErrorClearedAt","refreshLeaseId","refreshLeaseUntil","refreshLeaseTokenHash","lastQuotaRefreshError","quotaErrorGeneration","quotaErrorClearedAt","quota","quotaCheckedAt","quotaToken","profile","profileToken","prime","authLineageId","primeAuthLineageRefreshTokenFingerprint"];function Ux($,Z,J){if(!P6($)||!B$($,["binding"],Nx)||!qx($.binding)||$.binding.storageId!==J||($.binding.kind==="local"?$.binding.rowId:$.binding.routeId)!==Z)return!1;let X=$.binding;if(!z6($,"validationRetry",(z)=>jx(z,X)))return!1;if(Object.hasOwn($,"credentialValidation")){let z=$.credentialValidation;if(X.kind!=="local"||X.identity===void 0||!$8(z)||z.binding.storageId!==X.storageId||z.binding.rowId!==X.rowId||z.binding.credentialEpoch!==X.credentialEpoch||z.binding.identity!==X.identity)return!1}for(let z of["lastUsed","lastRefreshedAt","refreshErrorClearedAt","refreshLeaseUntil","quotaErrorClearedAt","quotaCheckedAt"])if(!z6($,z,a$))return!1;for(let z of["refreshLeaseId","authLineageId"])if(!z6($,z,X$))return!1;if(Object.hasOwn($,"profileToken")||!z6($,"refreshLeaseTokenHash",n$)||!z6($,"primeAuthLineageRefreshTokenFingerprint",h8)||!z6($,"quotaToken",(z)=>X.kind==="local"?h8(z):sQ(z)&&z===X.accountIdentity)||!z6($,"quotaErrorGeneration",A6)||!z6($,"profile",Hx)||!z6($,"prime",Lx)||!z6($,"lastRefreshError",X.kind==="local"?u7:S9)||!z6($,"lastQuotaRefreshError",S9))return!1;let Y=$.binding.kind==="local"?$.binding.identity:$.binding.accountIdentity;for(let z of[$.profile,$.lastRefreshError,$.lastQuotaRefreshError])if(P6(z)&&(z.accountIdentity!==void 0&&z.accountIdentity!==Y||z.providerAccountUuid!==void 0&&z.providerAccountUuid!==Y))return!1;if(Object.hasOwn($,"quota")){if($.binding.kind!=="custody")return!1;try{if(x0($.quota).accountIdentity!==Y)return!1}catch{return!1}}let G=[["lastRefreshError","refreshErrorClearedAt"],["lastQuotaRefreshError","quotaErrorClearedAt"]];for(let[z,Q]of G){let K=$[z],W=$[Q];if((z==="lastRefreshError"&&X.kind==="local"?u7:S9)(K)&&a$(W)&&K.checkedAt<=W)return!1}return!0}function L5($,Z){if(!P6($)||!B$($,["version","storageId","accounts"],["relay"])||$.version!==1||!n$(Z)||$.storageId!==Z||!P6($.accounts)||!z6($,"relay",(X)=>P6(X)&&B$(X,["token"])&&typeof X.token==="string"))throw new g("invalid-runtime");let J=Object.create(null);for(let[X,Y]of Object.entries($.accounts)){if(!X$(X)||!Ux(Y,X,Z))throw new g("invalid-runtime");J[X]=structuredClone(Y)}return{version:1,storageId:Z,accounts:J,...P6($.relay)&&typeof $.relay.token==="string"?{relay:{token:$.relay.token}}:{}}}function xx($){return $ instanceof Error&&"code"in $&&$.code==="ENOENT"}function tQ($){if(!nU($))throw new g("unsafe-runtime")}async function c$($,Z){if(tQ($),!n$(Z))throw new g("invalid-runtime");let J=sY.O_NOFOLLOW??0;try{for(let X=0;X<2;X++){let Y=await dU($);if(!Y.isFile()||(Y.mode&511)!==384||typeof process.geteuid==="function"&&Y.uid!==process.geteuid())throw new g("unsafe-runtime");let G=await hQ($,sY.O_RDONLY|J);try{let z=await G.stat();if(!z.isFile()||(z.mode&511)!==384||typeof process.geteuid==="function"&&z.uid!==process.geteuid())throw new g("unsafe-runtime");if(!J&&(z.dev!==Y.dev||z.ino!==Y.ino)){if(X===0)continue;throw new g("unsafe-runtime")}let Q;try{Q=new TextDecoder("utf-8",{fatal:!0}).decode(await G.readFile())}catch(K){if(K instanceof TypeError)throw new g("invalid-runtime");throw K}return{status:"ready",state:L5(u8(Q),Z)}}finally{await G.close()}}throw new g("unsafe-runtime")}catch(X){if(xx(X))return{status:"missing"};if(X instanceof g)throw X;if(X instanceof SyntaxError)throw new g("invalid-runtime");throw new g("runtime-io")}}function K$($,Z){return $.storageId===Z.storageId&&$.rowId===Z.rowId&&$.credentialEpoch===Z.credentialEpoch&&$.identity===Z.identity}function Dx($,Z,J){let X=!1;for(let[Y,G]of Object.entries(Z.accounts)){let z=$.accounts[Y];if(!z)continue;if(z.binding.kind!==G.binding.kind)continue;if(z.binding.kind==="local"&&G.binding.kind==="local"){if(G.binding.credentialEpoch<z.binding.credentialEpoch)throw new g("runtime-conflict");if(G.binding.credentialEpoch>z.binding.credentialEpoch)continue;if(z.binding.identity!==G.binding.identity){if(!J||X||Y!==J.predecessor.rowId||z.binding.identity!==void 0||!K$(z.binding,J.predecessor)||!K$(G.binding,J.proof.binding))throw new g("runtime-conflict");X=!0}}else if(z.binding.kind==="custody"&&G.binding.kind==="custody"){if(z.binding.credentialId!==G.binding.credentialId||z.binding.accountIdentity!==G.binding.accountIdentity)continue;if(G.binding.recordVersion<z.binding.recordVersion)throw new g("runtime-conflict")}let Q=["quotaErrorGeneration","quotaErrorClearedAt","refreshErrorClearedAt"];for(let K of Q){let W=z[K],V=G[K];if(W!==void 0&&(V===void 0||V<W))throw new g("runtime-conflict")}if(z.profile&&G.profile&&G.profile.checkedAt<z.profile.checkedAt)throw new g("runtime-conflict");if(z.quota&&G.quota&&o0(x0(G.quota))<o0(x0(z.quota)))throw new g("runtime-conflict");for(let[K,W]of[["lastRefreshError","refreshErrorClearedAt"],["lastQuotaRefreshError","quotaErrorClearedAt"]]){let V=z[K],B=G[K],q=G[W],H=K==="lastRefreshError"&&G.binding.kind==="local"?u7:S9;if(H(V)&&(!H(B)?!a$(q)||q<V.checkedAt:B.checkedAt<V.checkedAt))throw new g("runtime-conflict")}}if(J&&!X)throw new g("publication-refused")}async function p7($,Z,J,X={}){return aQ($,Z,J,X)}async function Ox($,Z,J,X){return nQ($,Z,J,{beforeRename:X.beforeRename})}async function aQ($,Z,J,X,Y){let G=await nQ($,Z,J,{beforeRename:async()=>{return await X.beforeRename?.(),"publish"},beforePublish:X.beforePublish,afterRename:X.afterRename},Y);if(G.status!=="published")throw new g("publication-refused");return G.state}async function nQ($,Z,J,X,Y){tQ($);try{return await iU(tY($),{recursive:!0,mode:448}),await d6($,{name:"native-runtime",ttlMs:1e4,timeoutMs:15000,renew:!0},async(G)=>{let z=await c$($,Z),Q=z.status==="ready"?z.state:{version:1,storageId:Z,accounts:{}},K=L5(await J(structuredClone(Q)),Z);Dx(Q,K,Y);let W=`${JSON.stringify(K,null,2)}
-`,V=oU(tY($),`${aU($)}.native-runtime.${lU()}.partial`),B=!1;try{let q=await hQ(V,"wx",384);B=!0;try{await q.writeFile(W,"utf8"),await q.sync()}finally{await q.close()}let H;try{H=await X.beforeRename()}catch{throw new g("publication-refused")}try{await G.assertOwned()}catch{throw new g("publication-refused")}if(H==="skip")return{status:"skipped"};try{if(await X.beforePublish?.(),X.beforePublish)await G.assertOwned()}catch{throw new g("publication-refused")}await sU(V,$),B=!1;try{await X.afterRename?.()}catch{throw new g("publication-refused")}return{status:"published",state:K}}finally{if(B)await tU(V,{force:!0})}})}catch(G){if(G instanceof g)throw G;throw new g("runtime-io")}}function a0($){return P6($)&&B$($,[],["accessFingerprint","expires","lastRefreshedAt"])&&z6($,"accessFingerprint",(Z)=>Z===void 0||h8(Z))&&z6($,"expires",(Z)=>Z===void 0||A6(Z))&&z6($,"lastRefreshedAt",A6)}function i9($,Z){return["accessFingerprint","expires","lastRefreshedAt"].every((J)=>Object.hasOwn($,J)===Object.hasOwn(Z,J)&&$[J]===Z[J])}function oQ($,Z){let J=()=>new g("publication-refused"),X=structuredClone(Z),Y=X.context;if(!["persisted","validation-observed"].includes(X.status)||X.bootstrap!=="resolved"||!("identity"in X)||!sQ(X.identity)||!x6(X.binding)||X.binding.storageId!==$.storageId||X.binding.identity!==void 0&&X.binding.identity!==X.identity||!n$(X.credentialFingerprint)||!a0(X.credentialVersion)||!Y||!P6(Y.subject)||!x6(Y.subject.binding)||!K$(Y.subject.binding,X.binding)||Y.subject.credentialFingerprint!==X.credentialFingerprint||!a0(Y.subject.version)||!i9(Y.subject.version,X.credentialVersion)||![Y.refreshErrorClearedAt,Y.quotaErrorClearedAt,Y.quotaErrorGeneration].every((Q)=>Q===null||A6(Q)))throw J();let G={...X.binding,identity:X.identity},z;if(X.status==="persisted"){if(z={binding:G,credentialFingerprint:X.successorFingerprint,version:X.successorVersion},!$8(z)||!P6(X.committed)||!B$(X.committed,["credentialFingerprint","version"])||X.committed.credentialFingerprint!==z.credentialFingerprint||!a0(X.committed.version)||!i9(X.committed.version,{...z.version}))throw J()}else if(X.status==="validation-observed"){if(X.binding.identity!==X.identity)throw J();z={binding:G,credentialFingerprint:X.credentialFingerprint,version:X.credentialVersion}}if(!$8(z))throw J();return{context:Y,proof:z}}function Mx($,Z){let J=oQ($,Z),X=J.context.runtimeBinding;if(!x6(X)||X.identity!==void 0||!K$(X,{...J.proof.binding,identity:void 0}))throw new g("publication-refused");return{...J,predecessor:X}}function N5($,Z){return($?.refreshErrorClearedAt??null)===Z.refreshErrorClearedAt&&($?.quotaErrorClearedAt??null)===Z.quotaErrorClearedAt&&($?.quotaErrorGeneration??null)===Z.quotaErrorGeneration}function Ix($,Z){let{predecessor:J,context:X,proof:Y}=Z;if($?.binding.kind!=="local"||!K$($.binding,J)||!N5($,X))throw new g("publication-refused");let G=(K,W)=>{let V=K===void 0?W?.checkedAt:Math.max(K,W?.checkedAt??K);if(V!==void 0&&!A6(V))throw new g("publication-refused");return V},z=G($.refreshErrorClearedAt,$.lastRefreshError),Q=G($.quotaErrorClearedAt,$.lastQuotaRefreshError);return{binding:Y.binding,credentialValidation:Y,...z!==void 0?{refreshErrorClearedAt:z}:{},...Q!==void 0?{quotaErrorClearedAt:Q}:{},...$.quotaErrorGeneration!==void 0?{quotaErrorGeneration:$.quotaErrorGeneration}:{}}}async function _x($,Z,J={}){try{$={...$};let X=Mx($,Z);return await U5($,X.proof,(Y)=>c0(X.proof,X.proof.binding,Y),(Y)=>Ix(Y,X),X,void 0,J)}catch(X){if(X instanceof g)throw X;throw new g("publication-refused")}}function Px($,Z){let{context:J,proof:X}=Z;if(!N5($,J))throw new g("publication-refused");if(!$){if(J.runtimeBinding!==null)throw new g("publication-refused");return{binding:X.binding,credentialValidation:X}}if($.binding.kind!=="local"||!x6(J.runtimeBinding)||!K$($.binding,J.runtimeBinding)||!K$($.binding,X.binding))throw new g("publication-refused");return{...$,credentialValidation:X}}async function Ax($,Z,J={}){try{$={...$};let X=oQ($,Z),{context:Y,proof:G}=X;if(Y.subject.binding.identity!==G.binding.identity||Y.runtimeBinding!==null&&(!x6(Y.runtimeBinding)||!K$(Y.runtimeBinding,G.binding)))throw new g("publication-refused");return await U5($,G,(z)=>c0(G,G.binding,z),(z)=>Px(z,X),void 0,void 0,J)}catch(X){if(X instanceof g)throw X;throw new g("publication-refused")}}function wx($){return a0($)&&h8($.accessFingerprint)&&A6($.expires)&&$.expires>0}function M4($){let Z=new WeakSet,J=(X,Y)=>{if(X===null||X===void 0||["string","number","boolean"].includes(typeof X))return X;if(typeof X!=="object"||rU.isProxy(X)||Y>32||Z.has(X))throw new g("publication-refused");let G=Object.getPrototypeOf(X);if(G!==Object.prototype&&G!==null)throw new g("publication-refused");Z.add(X);try{let z=Object.getOwnPropertyDescriptors(X),Q=Object.create(null);for(let K of Reflect.ownKeys(z)){if(typeof K!=="string")throw new g("publication-refused");let W=z[K];if(!W||!Object.hasOwn(W,"value"))throw new g("publication-refused");Object.defineProperty(Q,K,{value:J(W.value,Y+1),enumerable:!0,writable:!0,configurable:!0})}return Q}finally{Z.delete(X)}};try{return J($,0)}catch{throw new g("publication-refused")}}function rQ($){try{return Rx(M4($))}catch{throw new g("publication-refused")}}function Rx($){if($.status!=="failed"&&$.status!=="persisted")return{kind:"none",reason:"not-a-failure"};if($.context===void 0)return{kind:"none",reason:"no-context"};if(!P6($.context))throw new g("publication-refused");if($.status==="failed"&&(!P6($.failure)||!B$($.failure,["kind","classification"],["status","retryAfter"])||!X$($.failure.kind)||!["transient","invalid-grant","permanent"].includes($.failure.classification)||$.failure.status!==void 0&&(!A6($.failure.status)||$.failure.status<100||$.failure.status>599)||$.failure.retryAfter!==void 0&&!a$($.failure.retryAfter)||typeof $.persisted!=="boolean"))throw new g("publication-refused");if($.status==="failed"&&$.persisted&&!$.committed)return{kind:"none",reason:"missing-committed"};if($.bootstrap==="resolved"||$.status==="failed"&&($.failure.kind==="caller-hook"||!$.persisted&&!["provider","validation"].includes($.failure.kind)))return{kind:"none",reason:"not-attributable"};let Z=$.context;if(!x6($.binding)||!n$($.credentialFingerprint)||!a0($.credentialVersion)||!P6(Z.subject)||!x6(Z.subject.binding)||!K$(Z.subject.binding,$.binding)||Z.subject.credentialFingerprint!==$.credentialFingerprint||!a0(Z.subject.version)||!i9(Z.subject.version,$.credentialVersion)||Z.runtimeBinding!==null&&!x6(Z.runtimeBinding)||![Z.refreshErrorClearedAt,Z.quotaErrorClearedAt,Z.quotaErrorGeneration].every((K)=>K===null||A6(K)))throw new g("publication-refused");let J=$.status==="persisted"||$.persisted,X=$.committed;if(J&&(!P6(X)||!B$(X,["credentialFingerprint","version"])||!n$(X.credentialFingerprint)||!wx(X.version)))throw new g("publication-refused");if($.status==="persisted"&&(!a0($.successorVersion)||$.successorFingerprint!==X?.credentialFingerprint||!i9($.successorVersion,{...X?.version})))throw new g("publication-refused");if($.status==="failed"&&!J&&$.committed!==void 0)throw new g("publication-refused");let Y=J?X:{credentialFingerprint:$.credentialFingerprint,version:$.credentialVersion};if(!Y)throw new g("publication-refused");let G={binding:{...$.binding},credentialFingerprint:Y.credentialFingerprint,version:{...Y.version}},z=J?"committed":"captured";if(J&&$.bootstrap==="unsupported-credential")return{kind:"unsupported-successor",target:"committed",subject:G};if(J&&G.binding.identity!==void 0||$.status==="failed"&&$.failure.kind==="validation"){if(!$8(G))throw new g("publication-refused");return{kind:"validation-retry",target:z,subject:G}}if(J)return{kind:"refresh-error",target:z,subject:G,permanent:!1,message:"Local account-check recovery required"};if($.status!=="failed")throw new g("publication-refused");let Q=$.failure.status;if(Q!==void 0&&(!Number.isInteger(Q)||Q<100||Q>599))throw new g("publication-refused");return{kind:"refresh-error",target:z,subject:G,permanent:$.failure.classification==="invalid-grant"&&Q===400,message:"Local refresh failed",...Q!==void 0?{status:Q}:{}}}function Tx($,Z){if(Z?.type!=="oauth"||!X$(Z.refresh))return!1;let J=$.version;return $.credentialFingerprint===I6({type:"oauth",refresh:Z.refresh})&&(J.accessFingerprint===void 0?!Object.hasOwn(Z,"access"):X$(Z.access)&&J.accessFingerprint===S$(Z.access))&&(J.expires===void 0?!Object.hasOwn(Z,"expires"):J.expires===Z.expires)&&Object.hasOwn(J,"lastRefreshedAt")===Object.hasOwn(Z,"lastRefreshedAt")&&J.lastRefreshedAt===Z.lastRefreshedAt}async function Fx($,Z,J,X={}){let Y,G=(z)=>{throw Y=z,new g("publication-refused")};try{$=M4($);let z=M4(Z);J=M4(J);let Q=rQ(z);if(Q.kind==="none")return{status:"skipped",reason:Q.reason};let{subject:K}=Q,W=z.context;if(!W||K.binding.storageId!==$.storageId||!A6(J.checkedAt)||J.nextRetryAt!==void 0&&(!A6(J.nextRetryAt)||J.nextRetryAt<J.checkedAt)||J.retryCount!==void 0&&!A6(J.retryCount)||(Q.kind==="validation-retry"||Q.kind==="refresh-error"&&!Q.permanent)&&J.nextRetryAt===void 0)throw new g("publication-refused");let V=await U5($,K,(B)=>Tx(K,B),(B)=>{if(!B&&W.runtimeBinding!==null||B&&(B.binding.kind!=="local"||!x6(W.runtimeBinding)||!K$(B.binding,W.runtimeBinding)||!K$(B.binding,K.binding)))G("entry-binding");if(!N5(B,W))G("reset-context");if(B?.refreshErrorClearedAt!==void 0&&J.checkedAt<=B.refreshErrorClearedAt)throw new g("publication-refused");let q=B?{...B}:{binding:K.binding};if(Q.kind==="unsupported-successor"){let H=!1;if(q.lastRefreshError&&q.lastRefreshError.checkedAt<=J.checkedAt)delete q.lastRefreshError,H=!0;if(q.validationRetry&&q.validationRetry.checkedAt<=J.checkedAt)delete q.validationRetry,H=!0;if(H)q.refreshErrorClearedAt=Math.max(q.refreshErrorClearedAt??0,J.checkedAt)}else if(Q.kind==="validation-retry"){let H=J.nextRetryAt;if(H===void 0)throw new g("publication-refused");let j=(x)=>K$(x.binding,K.binding)&&x.credentialFingerprint===K.credentialFingerprint&&i9({...x.version},{...K.version});if(B?.credentialValidation&&j(B.credentialValidation))G("already-proven");if(B?.validationRetry&&j(B.validationRetry.subject)&&(B.validationRetry.checkedAt>J.checkedAt||B.validationRetry.checkedAt===J.checkedAt&&B.validationRetry.nextRetryAt!==J.nextRetryAt))G("older-than-stored");q.validationRetry={subject:Q.subject,checkedAt:J.checkedAt,nextRetryAt:H}}else{if(B?.lastRefreshError&&J.checkedAt<B.lastRefreshError.checkedAt)G("older-than-stored");q.lastRefreshError={message:Q.message,credentialFingerprint:K.credentialFingerprint,permanent:Q.permanent,checkedAt:J.checkedAt,...K.binding.identity!==void 0?{accountIdentity:K.binding.identity}:{},...Q.status!==void 0?{status:Q.status}:{},...J.nextRetryAt!==void 0?{nextRetryAt:J.nextRetryAt}:{},...J.retryCount!==void 0?{retryCount:J.retryCount}:{}}}return q},void 0,G,X);return{status:"published",attribution:Q,state:V}}catch(z){if(Y&&z instanceof g&&z.code==="publication-refused")return{status:"superseded",reason:Y};if(z instanceof g)throw z;throw new g("publication-refused")}}async function U5($,Z,J,X,Y,G,z={}){try{let Q=O0({paths:$,quota:d$}),[K,W]=j1($),V=async()=>{let B=await Q.read();if(B.status!=="ready")throw new g("publication-refused");let q=B.rows.find((H)=>H.id===Z.binding.rowId);if(!q||!x$(Z.binding,$,q))throw G?.("row-binding"),new g("publication-refused");if(!J(q.credential))throw G?.("row-credential"),new g("publication-refused")};return await d6(K.path,{...h6,name:K.name},async(B)=>d6(W.path,{...h6,name:W.name},async(q)=>{return await V(),aQ($.runtime,$.storageId,(H)=>{let j=Z.binding.rowId;return H.accounts[j]=X(H.accounts[j]),H},{beforeRename:async()=>{await V(),await B.assertOwned(),await q.assertOwned()},beforePublish:z.beforePublish},Y)}))}catch(Q){if(Q instanceof g)throw Q;throw new g("publication-refused")}}function VF($){let Z=$.state;if(Z===void 0||Z==="")return"";if(Z==="unsupported-access")return"unsupported credential: the saved access token is not a Claude OAuth token; sign in to this account again";return Z}function c7($){let Z=new Set;function J(X){if(X===null||typeof X==="string"||typeof X==="boolean"||X===void 0)return X;if(typeof X==="number"&&Number.isFinite(X))return X;if(!X||typeof X!=="object"||z5.isProxy(X)||Z.has(X))throw new g("publication-refused");Z.add(X);try{if(Array.isArray(X)){if(Reflect.ownKeys(X).some((G)=>typeof G!=="string"||G!=="length"&&!/^(0|[1-9][0-9]*)$/.test(G)))throw new g("publication-refused");return Array.from({length:X.length},(G,z)=>{let Q=Object.getOwnPropertyDescriptor(X,String(z));if(!Q||!("value"in Q))throw new g("publication-refused");return J(Q.value)})}if(Object.getPrototypeOf(X)!==Object.prototype&&Object.getPrototypeOf(X)!==null)throw new g("publication-refused");let Y={};for(let G of Reflect.ownKeys(X)){let z=Object.getOwnPropertyDescriptor(X,G);if(typeof G!=="string"||!z||!("value"in z)||G==="__proto__")throw new g("publication-refused");Y[G]=J(z.value)}return Y}finally{Z.delete(X)}}return J($)}function eQ($){let Z=c7($);if(!Z||Object.keys(Z).some((J)=>!["quota","profile","lastUsed","lastQuotaRefreshError","quotaErrorClearedAt","quotaErrorGeneration","prime","authLineageId"].includes(J)))throw new g("publication-refused");return Z}function $K($,Z){let{quota:J,...X}=Z,Y={...$,...X};if(Z.lastUsed!==void 0){if(!Number.isFinite(Z.lastUsed)||Z.lastUsed<0)throw new g("publication-refused");Y.lastUsed=Math.max($.lastUsed??0,Z.lastUsed)}if(J){let G=s0(J);Y.quota=d$.merge($.quota,G),Y.quotaCheckedAt=J.checkedAt}if(Z.quotaErrorClearedAt!==void 0)Y.quotaErrorClearedAt=Math.max($.quotaErrorClearedAt??0,Z.quotaErrorClearedAt);if(Z.quotaErrorGeneration!==void 0)Y.quotaErrorGeneration=Math.max($.quotaErrorGeneration??0,Z.quotaErrorGeneration);if($.lastQuotaRefreshError&&Z.lastQuotaRefreshError&&Z.lastQuotaRefreshError.checkedAt<$.lastQuotaRefreshError.checkedAt)Y.lastQuotaRefreshError=$.lastQuotaRefreshError;if(Y.lastQuotaRefreshError&&Y.lastQuotaRefreshError.checkedAt<=(Y.quotaErrorClearedAt??-1))delete Y.lastQuotaRefreshError;return Y}function ZK($,Z,J,X){let Y=Error("OAuth quota check failed");if($&&typeof $==="object"&&!z5.isProxy($)){for(let W of["status","retryAfter"]){let V=Object.getOwnPropertyDescriptor($,W)?.value;if(typeof V==="number"&&Number.isFinite(V))Object.assign(Y,{[W]:V})}let Q=Object.getOwnPropertyDescriptor($,"code")?.value,K=Object.getOwnPropertyDescriptor($,"message")?.value;if(g$({code:typeof Q==="string"?Q:"",message:typeof K==="string"?K:""}))Object.assign(Y,{code:"ECONNRESET"})}let G=Object.getOwnPropertyDescriptor(Y,"status")?.value;if(G===401||G===403)return;return{...Y7({error:Y,accountIdentity:Z,now:J,previous:X}),...typeof G==="number"&&Number.isFinite(G)?{status:G}:{}}}class JK extends Error{status;retryAfter;code;constructor($,Z,J){super(`OAuth metadata read failed${$!==void 0?`: ${$}`:""}`);this.status=$,this.retryAfter=Z,this.code=J,this.name="NativeAccountReadError"}}function XK($,Z){let J={};if($&&typeof $==="object"&&!z5.isProxy($))for(let z of["status","retryAfter","code","message"])J[z]=Object.getOwnPropertyDescriptor($,z)?.value;let X=typeof J.status==="number"&&Number.isFinite(J.status)?J.status:void 0,Y=J.retryAfter,G=X===void 0&&g$({code:typeof J.code==="string"?J.code:"",message:typeof J.message==="string"?J.message:""})?"ECONNRESET":void 0;return new JK(Z??X,typeof Y==="number"&&Number.isFinite(Y)?Y:void 0,G)}var $4="oauth:anthropic";function GZ($){let J=$.claustrum?.primaryAccount;if(typeof $.mainAccountId!=="string"||!$.mainAccountId||typeof J?.credentialId!=="string"||!J.credentialId||typeof J.accountId!=="string"||!J.accountId)return;return{routeId:$.mainAccountId,credentialId:J.credentialId,accountIdentity:J.accountId}}function l7($,Z){if(!Z)return;return $?.rows.find((J)=>J.routeId===Z.routeId&&J.accountIdentity===Z.accountIdentity&&(J.credentialId===Z.credentialId||J.aliases?.includes(Z.credentialId)))}var Cx={routing:["mode"],refresh:["enabled","intervalMinutes","refreshBeforeExpiryMinutes"],quota:["enabled","checkIntervalMinutes","refreshEveryNRequests","minimumRemaining","failClosedOnUnknownQuota","showToasts"],quotaHeaderFeed:["enabled"],claudeCache:["enabled","mode"],dump:["enabled"],logging:["level"],claudeFast:["enabled"],thinkingBinding:["prefixMismatchBehavior"],costZeroing:["enabled"],cacheKeep:["enabled","always","startHour","endHour","subagents"],prime:["enabled"],relay:["enabled","url","fallbackToDirect","transport"],claustrum:["mode","disabledAccountIdentities"],killswitch:["enabled","main","accounts"]};function YK($){let Z={};if(typeof $.mainAccountId==="string")Z.mainAccountId=$.mainAccountId;if(Array.isArray($.nativeAccountOrder))Z.nativeAccountOrder=$.nativeAccountOrder.filter((X)=>typeof X==="string");if(Array.isArray($.fallbackOn))Z.fallbackOn=$.fallbackOn.filter((X)=>Number.isInteger(X));for(let[X,Y]of Object.entries(Cx)){let G=$[X];if(!G||typeof G!=="object"||Array.isArray(G))continue;let z={};for(let Q of Y){let K=Object.getOwnPropertyDescriptor(G,Q)?.value;if(K!==void 0)z[Q]=structuredClone(K)}Z[X]=z}let J=$.claustrum;if(J?.primaryAccount){let X=Z.claustrum;X.primaryAccount={credentialId:J.primaryAccount.credentialId,accountId:J.primaryAccount.accountId,state:J.primaryAccount.state}}return Z}function JG($,Z){let J=$?.binding;return J?.kind==="local"&&J.storageId===Z.storageId&&J.rowId===Z.rowId&&J.identity===Z.identity&&J.credentialEpoch===Z.credentialEpoch}function XG($,Z){let J=$.runtime?.accounts[Z.routeId],X=J?.binding;return X?.kind==="custody"&&X.storageId===$.paths.storageId&&X.routeId===Z.routeId&&X.accountIdentity===Z.accountIdentity&&(X.credentialId===Z.credentialId||Z.aliases?.includes(X.credentialId))?J:void 0}function YG($){if(!$)return;return{message:"OAuth operation failed",checkedAt:$.checkedAt,nextRetryAt:$.nextRetryAt,retryCount:$.retryCount,accountIdentity:$.accountIdentity,status:$.status,permanent:$.permanent}}function GG($){return{lastUsed:$?.lastUsed,lastRefreshedAt:$?.lastRefreshedAt,lastRefreshError:YG($?.lastRefreshError),lastQuotaRefreshError:YG($?.lastQuotaRefreshError),quotaErrorClearedAt:$?.quotaErrorClearedAt,quotaErrorGeneration:$?.quotaErrorGeneration,refreshErrorClearedAt:$?.refreshErrorClearedAt,profile:$?.profile&&{tier:$.profile.tier,orgType:$.profile.orgType,checkedAt:$.profile.checkedAt,accountIdentity:$.profile.accountIdentity,providerAccountUuid:$.profile.providerAccountUuid},prime:$?.prime&&{...$.prime}}}function GK($,Z,J){let X=J?.binding;if(X?.kind==="local"&&X.credentialEpoch!==Z.credentialEpoch||Z.type!=="oauth"||Z.torn!==!0||Z.enabled!==!0||Z.disabledReason!==void 0||Z.credential===void 0||Z.staged!==void 0||Z.invalid!==void 0||Z.unbound===!0||Z.stamp!=="bound"||Z.credentialEpoch===void 0)return!1;let{torn:Y,...G}=Z;return x$({kind:"local",storageId:$.storageId,rowId:Z.id,credentialEpoch:Z.credentialEpoch,...Z.identity!==void 0?{identity:Z.identity}:{}},$,G)}function Sx($,Z,J,X,Y){let G=YK(J).mainAccountId,z=Z.find((Q)=>(Q.id===G?"main":Q.id)===X);return z!==void 0&&GK($,z,Y?.accounts[z.id])}function kx($){let Z=YK($.settings),J=Z.claustrum?.mode==="claustrum"?"claustrum":"local",X=[];for(let V of $.rows){if(J==="claustrum")continue;let B=V.credentialEpoch!==void 0?{kind:"local",storageId:$.paths.storageId,rowId:V.id,credentialEpoch:V.credentialEpoch,...V.identity!==void 0?{identity:V.identity}:{}}:void 0,q=B&&x$(B,$.paths,V)?B:void 0,H=$.runtime?.accounts[V.id],j=q&&JG(H,q)?H:void 0,x=V.id===Z.mainAccountId?"main":V.id,L=V.type==="oauth"&&V.quota!==void 0?x0(V.quota):void 0,U=V.identity!==void 0&&L?.accountIdentity===V.identity?L:void 0,M=GG(j);if(j?.lastRefreshError?.credentialFingerprint&&(!V.credential||j.lastRefreshError.credentialFingerprint!==I6(V.credential)))delete M.lastRefreshError;X.push({id:x,type:V.type,source:"local",...V.credential?.type==="oauth"&&V.credential.access&&!V.credential.access.startsWith("sk-ant-oat")?{state:"unsupported-access"}:{},enabled:V.enabled&&(V.candidate||GK($.paths,V,$.runtime?.accounts[V.id])),label:V.label,addedAt:V.addedAt,accountIdentity:V.identity,binding:q,...M,...U?{quota:U}:{},...V.credential?.type==="api"?{baseURL:V.credential.baseURL,authHeader:V.credential.authHeader}:{}})}if(J==="claustrum"){let V=l7($.roster,GZ(Z));for(let B of $.roster?.rows??[]){if(B.credentialType!=="oauth")continue;let q=XG($,B);X.push({id:B===V?"main":B.routeId,type:"oauth",source:"vault",enabled:B.enabled&&B.state==="active",label:B.label,addedAt:B.addedAt,accountIdentity:B.accountIdentity,credentialId:B.credentialId,state:B.state,...GG(q),...q?.quota?{quota:x0(q.quota)}:{}})}}if(Array.isArray(Z.nativeAccountOrder)){let V=Z.nativeAccountOrder;X.sort((B,q)=>{let H=V.indexOf(B.id),j=V.indexOf(q.id);return(H<0?V.length:H)-(j<0?V.length:j)})}let Y=X.filter((V)=>V.id!=="main").map((V)=>V.type==="oauth"?{id:V.id,type:"oauth",refresh:"",label:V.label,enabled:V.enabled,addedAt:V.addedAt,anthropicAccountUuid:V.accountIdentity,claustrumScopedCredentialId:V.credentialId,claustrumScopedState:V.state,authLineageId:V.binding?JSON.stringify(V.binding):V.credentialId?JSON.stringify([V.credentialId,V.accountIdentity]):void 0,quota:V.quota,profile:V.profile,prime:V.prime,lastUsed:V.lastUsed,lastRefreshedAt:V.lastRefreshedAt,lastRefreshError:V.lastRefreshError,lastQuotaRefreshError:V.lastQuotaRefreshError}:{id:V.id,type:"api",label:V.label,enabled:V.enabled,addedAt:V.addedAt,baseURL:V.baseURL??"",authHeader:V.authHeader,lastUsed:V.lastUsed}),G={version:1,...Z,accounts:Y},z=X.find((V)=>V.id==="main"),Q=l7($.roster,GZ(Z)),K=z?.source==="local"&&z.binding?$.runtime?.accounts[z.binding.rowId]:Q?XG($,Q):void 0,W=z?.source==="local"&&z.binding&&!JG(K,z.binding)?void 0:K;if(z)G.mainAccountId=z.accountIdentity??z.binding?.rowId,G.main={type:"opencode",provider:"anthropic",profile:z.profile},G.quota={...G.quota,mainQuota:z.quota,mainQuotaCheckedAt:W?.quotaCheckedAt??z.quota?.checkedAt,mainQuotaToken:z.accountIdentity,mainLastQuotaApiError:z.lastQuotaRefreshError,mainQuotaErrorClearedAt:W?.quotaErrorClearedAt,mainQuotaErrorGeneration:W?.quotaErrorGeneration},G.refresh={...G.refresh,mainLastRefreshError:z.lastRefreshError,mainRefreshErrorClearedAt:W?.refreshErrorClearedAt},G.prime={...G.prime,main:z.prime,mainAuthLineageId:W?.authLineageId};return structuredClone({mode:J,settings:Z,accounts:X,policyStorage:G})}function zG($,Z){let J=$[Z];return J&&typeof J==="object"&&!Array.isArray(J)?J:{}}var vx=["five_hour","seven_day","5h","1w","scoped"];function zK($){if(!$||typeof $!=="object"||Array.isArray($))return;let Z=$,J={};for(let X of vx){let Y=Z[X];if(typeof Y==="number"&&Number.isFinite(Y))J[X]=Y}return J}function fx($){if(!$||typeof $!=="object"||Array.isArray($))return;let Z={};for(let[J,X]of Object.entries($)){let Y=zK(X);if(Y)Z[J]=Y}return Z}function QK($){let Z=zG($,"killswitch"),J=zG($,"logging").level;return{killswitchEnabled:Z.enabled===!0,killswitchMain:zK(Z.main),killswitchAccounts:fx(Z.accounts),logLevel:typeof J==="string"?J:void 0}}function Ex($,Z){let J=QK(Z);if(J.killswitchEnabled!==$.killswitchEnabled)a.info("commands","killswitch changed",{enabled:J.killswitchEnabled});if(JSON.stringify(J.killswitchMain)!==JSON.stringify($.killswitchMain)||JSON.stringify(J.killswitchAccounts)!==JSON.stringify($.killswitchAccounts))a.info("commands","killswitch thresholds changed",{thresholds:J.killswitchMain??J.killswitchAccounts});let X=K7(J.logLevel);if(X&&X!==K7($.logLevel))KK(X)}function KK($){if(mq()===$)return!1;return a.info("commands","log level changed",{level:$}),hq($),!0}function Z4($,Z){a.info("commands",$,{id:Z.id,label:Z.label,...$==="account enabled"||$==="account disabled"?{enabled:$==="account enabled"}:{}})}function bx($){a.info("commands","account added",{id:$.id,label:$.label,type:$.type==="api"?"apikey":"oauth"})}var d7=60000,gx=4*d7,k2=new Map,J4=new Map;function v2($){return typeof $==="object"&&$!==null&&!Array.isArray($)}class WK{transport;key;#$=[];#Z;constructor($,Z){this.transport=$,this.key=Z}refresh($){if(this.#Z)return this.#Z;for(let[J,X]of J4)if($-X>=d7)J4.delete(J);let Z=J4.get(this.key);if(Z!==void 0&&$-Z<d7)return Promise.resolve();return J4.set(this.key,$),this.#Z=(async()=>{try{let J=await this.transport.getUsage();if(!v2(J)||!Array.isArray(J.result)||J.error!==void 0)throw Error("unavailable insula usage");this.#$=J.result.filter((X)=>v2(X)&&typeof X.provider==="string")}catch{this.#$=[]}})().finally(()=>{this.#Z=void 0}),this.#Z}current($,Z,J){for(let X of this.#$){if(X.provider!==$||typeof X.account!=="string"||X.account.trim()!==Z)continue;if(X.stale!==void 0||X.errorClass!==void 0||!v2(X.usage))continue;let Y=typeof X.fetchedAt==="string"?Date.parse(X.fetchedAt):Number.NaN;if(!Number.isFinite(Y)||J-Y>=gx)continue;return{entry:X,context:{fetchedAt:Y,...typeof X.source==="string"&&{source:X.source}}}}return}}function yx($,Z){let J=JSON.stringify([QG($.connectionFile),QG(Z)]),X=k2.get(J);if(!X)X={source:new WK($,J),refs:0},k2.set(J,X);X.refs++;let Y=!1;return{source:X.source,release(){if(Y)return;if(Y=!0,--X.refs===0)k2.delete(J)}}}var dx=/^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i,ix=/\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g,WG="***REDACTED***",sx=8;function tx($){return $ instanceof Error||Object.prototype.toString.call($)==="[object Error]"}function k9($={}){let Z=[ix,...$.extraValuePatterns??[]].map((G)=>new RegExp(G.source,G.flags.includes("g")?G.flags:`${G.flags}g`));function J(G){let z=G.toLowerCase().replace(/[-_]/g,"");return dx.test(G)||z.includes("apikey")||z.endsWith("secret")||z.endsWith("password")||z.endsWith("token")&&!z.endsWith("tokens")||!!$.extraSecretKeys?.(z)}function X(G){let z=G,Q=[["name",G.name],["message",G.message],["stack",G.stack]];for(let W of["code","status","cause"])if(z[W]!==void 0)Q.push([W,z[W]]);let K=new Set(Q.map(([W])=>W));for(let W of Object.entries(G))if(!K.has(W[0]))Q.push(W);return Q}function Y(G,z,Q,K=0){if(typeof G==="string")return Z.reduce((W,V)=>W.replace(V,WG),G);if(!G||typeof G!=="object")return G;if(Q.has(G))return"[Circular]";Q.add(G);try{if(Array.isArray(G))return G.map((B)=>Y(B,z,Q,K));let W=tx(G);if(W&&K>=sx)return"[Truncated]";let V=W?K+1:K;return Object.fromEntries((W?X(G):Object.entries(G)).map(([B,q])=>[B,z&&J(B)?WG:Y(q,z,Q,V)]))}finally{Q.delete(G)}}return{redact:(G)=>Y(G,!0,new WeakSet),redactStrings:(G)=>Y(G,!1,new WeakSet)}}var VK=k9(),DF=VK.redact,OF=VK.redactStrings,X4={error:0,warn:1,info:2,debug:3,trace:4},BK=5242880,qK=3;function s7($){try{mx($,384)}catch{}}function ax($){try{if(!(i7($)&&ux($).size>=BK))return;for(let J=qK-1;J>=1;J--)if(i7(`${$}.${J}`)){let X=`${$}.${J+1}`;KG(`${$}.${J}`,X),s7(X)}let Z=`${$}.1`;KG($,Z),s7(Z)}catch{}}async function u$($){let{file:Z,handle:J}=$;if($.file=void 0,$.handle=void 0,Z&&J)await M$(Z,"log-close",()=>J.close())}async function VG($,Z){await s$(cx(Z));try{await Z$(Z,"file",!0)}catch(J){if(J.code!=="ENOENT")throw J;try{await n4(Z,"")}catch(X){if(X.code!=="EEXIST")throw X;await Z$(Z,"file",!0)}}return $.handle=await M$(Z,"log-open",()=>px(Z,"a")),$.file=Z,$.handle}async function nx($,Z,J){Z=lx(Z);try{if($.file!==Z)await u$($);let X=$.handle??await VG($,Z);if((await M$(Z,"log-stat",()=>X.stat())).size>=BK){await u$($);for(let G=qK-1;G>=0;G--){let z=G===0?Z:`${Z}.${G}`,Q=`${Z}.${G+1}`;try{await Z$(z,"file",!0)}catch(K){if(K.code==="ENOENT")continue;throw K}try{await Z$(Q,"file",!0)}catch(K){if(K.code!=="ENOENT")throw K}await XQ(z,Q),await Z$(Q,"file")}X=await VG($,Z)}await M$(Z,"log-append",()=>X.appendFile(J,"utf8"))}catch(X){throw await u$($).catch(()=>{}),X}}function ox($){try{return` ${JSON.stringify($)}`}catch{return" [unserializable]"}}function rx($){let Z,J,X,Y=k9(),G,z=[],Q,K=Promise.resolve(),W,V={};function B(N){let R=K.then(N);return K=R.catch((S)=>{W=S}),R}function q(N){if(r&&N.file!==Z)B(()=>u$(V)).catch(()=>{});Z=N.file,J=N.level,Y=k9(N),G=N.captureSink}function H(N){if(N===void 0||N in X4)X=N}function j(){if(Z===void 0)return;return(typeof Z==="function"?Z():Z)||void 0}function x(){if(X)return X;let N=typeof J==="function"?J():J;if(N&&N in X4)return N;return"info"}function L(N=!0){if(Q)clearTimeout(Q),Q=void 0;if(!z.length){if(r)return B(async()=>{if(N)await u$(V);if(W)throw W});return}let R;try{R=j()}catch{if(z=[],r&&N)return B(()=>u$(V));return}let S=z.join("");if(z=[],!R){if(r&&N)return B(()=>u$(V));return}if(r)return B(async()=>{try{await nx(V,R,S)}finally{if(N)await u$(V)}});try{if(ax(R),i7(R))s7(R);hx(R,S,{encoding:"utf8",mode:384})}catch{}}function U(){if(!Q)Q=setTimeout(()=>{Q=void 0;let N=L(!1);if(N instanceof Promise)N.catch(()=>{})},500)}function M(N,R,S,E){if(Z===void 0&&G===void 0)return;try{if(X4[R]>X4[x()])return;let m=Y.redactStrings(S),s;try{s=Y.redact(E)}catch{s="[unserializable]"}let c=`[${new Date().toISOString()}] ${R.toUpperCase()} [${N}] ${m}`+(E===void 0?"":ox(s))+`
-`;try{G?.({channel:N,level:R,message:m,data:s})}catch{}if(Z===void 0)return;if(z.push(c),z.length>=50){let I=L(!1);if(I instanceof Promise)I.catch(()=>{})}else U()}catch{}}function A(N){return{error:(R,S)=>M(N,"error",R,S),warn:(R,S)=>M(N,"warn",R,S),info:(R,S)=>M(N,"info",R,S),debug:(R,S)=>M(N,"debug",R,S),trace:(R,S)=>M(N,"trace",R,S)}}function _(){if(r)B(()=>u$(V)).catch(()=>{});if(W=void 0,z=[],Q)clearTimeout(Q),Q=void 0;Z=void 0,J=void 0,X=void 0,Y=k9(),G=void 0}if($)q($);return{configure:q,createLogger:A,setLogLevel:H,flushLogs:L,reset:_}}var ex=rx();function jK($){return ex.createLogger($)}function BG($){let Z=new AbortController,J=[],X=!1,Y=()=>{if(X)return;X=!0;for(let{source:Q,listener:K}of J)Q.removeEventListener("abort",K);J.length=0},G=(Q)=>{if(X||Z.signal.aborted)return;Z.abort(Q),Y()},z=$.find((Q)=>Q.aborted);if(z)return Z.abort(z.reason),{signal:Z.signal,dispose:Y};for(let Q of $){if(Z.signal.aborted)break;let K=()=>G(Q.reason);if(J.push({source:Q,listener:K}),Q.addEventListener("abort",K,{once:!0}),Q.aborted)G(Q.reason)}return{signal:Z.signal,dispose:Y}}class e extends Error{kind;constructor($,Z){super(Z);this.name="ClaustrumConsumerError",this.kind=$}}var WD=1,I4=16384,D5=30000,O5=/^[0-9a-f]{64}$/,VD=new Set(["invalid_params","pending_exists","not_found","already_consumed","superseded","stale_generation"]),BD=new Set(["pending_queue_full"]);function jG($){if(!($ instanceof s6))return;if(VD.has($.code))return{code:$.code,disposition:"terminal"};if(BD.has($.code))return{code:$.code,disposition:"retry"};return{code:$.code,disposition:$.action==="retry"?"retry":"terminal"}}function NK($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function Y4($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0}function UK($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=1}function Q9(){return new e("invalid-state","invalid Claustrum enrollment state")}function H1($){if(!NK($)||$.version!==WD||typeof $.proposedName!=="string"||$.proposedName.length===0)throw Q9();if($.phase==="pending"){if(!O5.test(String($.requestSecret??""))||$.requestId!==void 0&&(typeof $.requestId!=="string"||$.requestId.length===0)||!Y4($.createdAt)||!Y4($.updatedAt))throw Q9();return{version:1,phase:"pending",proposedName:$.proposedName,requestSecret:$.requestSecret,...$.requestId!==void 0&&{requestId:$.requestId},createdAt:$.createdAt,updatedAt:$.updatedAt}}if($.phase==="approved"){if($.approvedName!==void 0&&(typeof $.approvedName!=="string"||$.approvedName.length===0)||!UK($.tokenGeneration)||!Y4($.updatedAt))throw Q9();return{version:1,phase:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration,updatedAt:$.updatedAt}}if($.phase==="denied"||$.phase==="blocked"){if($.errorCode!==void 0&&typeof $.errorCode!=="string"||!Y4($.updatedAt))throw Q9();return{version:1,phase:$.phase,proposedName:$.proposedName,...$.errorCode!==void 0&&{errorCode:$.errorCode},updatedAt:$.updatedAt}}throw Q9()}function M5($){if(!NK($)||!O5.test(String($.token??""))||!UK($.token_generation))throw new e("invalid-token","invalid Claustrum enrollment token file");return{token:$.token,token_generation:$.token_generation}}function qD($){if(!$.isFile())throw new e("unsafe-file","Claustrum enrollment file must be a regular file");if(($.mode&63)!==0)throw new e("unsafe-file","Claustrum enrollment file must be owner-only");let Z=process.geteuid?.();if(Z!==void 0&&$.uid!==Z)throw new e("unsafe-file","Claustrum enrollment file must be owned by the current user")}function HG($){try{return JSON.parse($)}catch{throw new e("invalid-state","Claustrum enrollment file is not valid JSON")}}async function o$($){if(r)try{await s$(M0($));let J=await q0($,!0);if(Buffer.byteLength(J)>I4)throw new e("unsafe-file","Claustrum enrollment file is too large");return HG(J)}catch(J){if(J.code==="ENOENT")return;throw J}let Z;try{Z=await HK($,qG.O_RDONLY|qG.O_NOFOLLOW)}catch(J){if(J.code==="ENOENT")return;throw new e("unsafe-file","Claustrum enrollment file could not be opened safely")}try{qD(await Z.stat());let J=Buffer.alloc(I4+1),{bytesRead:X}=await Z.read(J,0,J.byteLength,0);if(X>I4)throw new e("unsafe-file","Claustrum enrollment file is too large");return HG(J.subarray(0,X).toString("utf8"))}finally{await Z.close()}}function LG($,Z){let J=[];for(let X of $.split(`
-`)){if(X.trim()===""||X.startsWith("#"))continue;let Y=X.split(":");if(Y.length!==Z||!/^[^\s:,]+$/.test(Y[0]??"")||!/^\d+$/.test(Y[2]??"")||!Number.isSafeInteger(Number(Y[2]))||Z===7&&(!/^\d+$/.test(Y[3]??"")||!Number.isSafeInteger(Number(Y[3])))||Z===4&&Y[3]!==""&&!/^[^\s:,]+(?:,[^\s:,]+)*$/.test(Y[3]??""))return;J.push(Y)}return J}async function jD($,Z,J){try{let[X,Y]=await Promise.all([t7(J.passwdPath??"/etc/passwd","utf8"),t7(J.groupPath??"/etc/group","utf8")]),G=LG(X,7),z=LG(Y,4);if(!G||!z)return!1;let Q=G.filter((B)=>Number(B[2])===$),K=z.filter((B)=>Number(B[2])===Z);if(Q.length!==1||K.length!==1)return!1;let W=Q[0]?.[0],V=K[0]?.[3]??"";return(V===""||V.split(",").every((B)=>B===W))&&!G.some((B)=>Number(B[2])!==$&&Number(B[3])===Z)}catch{return!1}}function xK($){if(!$.passwdPath&&!$.groupPath)return;return{fs:{readFile:(Z)=>t7(Z==="/etc/passwd"?$.passwdPath??Z:Z==="/etc/group"?$.groupPath??Z:Z)}}}async function DK($,Z={}){if(!r){let J=process.geteuid?.();if(J===void 0)return;let X=process.getegid?.(),Y;try{Y=await GD($)}catch{return}let G;for(;;){let z=await LK(Y).catch(()=>{return});if(z&&(z.mode&18)!==0&&(z.mode&512)===0){if(G===void 0)G=X!==void 0&&await jD(J,X,Z);if((z.mode&2)!==0||z.uid!==J||z.gid!==X||!G)throw new e("unsafe-file",`Claustrum enrollment path has a writable ancestor: ${Y}. Another user could replace it. Run: chmod g-w,o-w ${Y}`)}let Q=M0(Y);if(Q===Y)return;Y=Q}}try{await P0($,xK(Z))}catch(J){if(!(J instanceof y6))throw J;throw new e("unsafe-file",`Claustrum enrollment parent refused: ${J.path} (${J.reason??J.code}). Use a folder that other users cannot write or replace.`)}}async function s9($,Z={}){if(r){await s$($,!1,xK(Z));return}await YD($,{recursive:!0,mode:448});let J=await LK($),X=process.geteuid?.();if(X!==void 0&&J.uid!==X)throw new e("unsafe-file","Claustrum enrollment directory must be owned by the current user");if((J.mode&63)!==0)await XD($,448)}async function k0($,Z,J={}){let X=M0($);await s9(X,J),await DK(X,J);let Y=`${JSON.stringify(Z)}
-`;if(Buffer.byteLength(Y)>I4)throw new e("invalid-state","Claustrum enrollment state is too large");if(r)return tJ($,Y);let G=KD(X,`.${QD($)}.${process.pid}.${JD()}.tmp`),z,Q=!1;try{z=await HK(G,"wx",384),Q=!0,await z.writeFile(Y,"utf8"),await z.chmod(384),await z.sync(),await z.close(),z=void 0,await zD(G,$),Q=!1}finally{if(await z?.close().catch(()=>{}),Q)await x5(G).catch(()=>{})}}async function OK($,Z){let J=await o$($.tokenPath),X=J===void 0?void 0:M5(J),Y=await o$($.statePath),G=Y===void 0?void 0:H1(Y);if(X)return{state:"approved",proposedName:G?.proposedName??Z,...G?.phase==="approved"&&G.approvedName!==void 0&&{approvedName:G.approvedName},tokenGeneration:X.token_generation};if(!G)return{state:"idle"};if(G.phase==="approved")return{state:"blocked",proposedName:G.proposedName,code:"missing_token"};return W0(G)}async function HD($,Z){let J;try{J=await OK($,Z)}catch(X){if(!(X instanceof e)||X.kind!=="invalid-state"&&X.kind!=="invalid-token")return"unreadable";try{let Y=await o$($.statePath);if(Y===void 0)return"unreadable";let G=H1(Y);return G.phase==="approved"&&G.proposedName===Z?"vault":"unreadable"}catch{return"unreadable"}}if("proposedName"in J&&J.proposedName!==Z)return"unreadable";if(J.state==="approved"||J.state==="blocked"&&J.code==="missing_token")return"vault";return"local"}async function _4($){let Z=await o$($);if(Z===void 0)throw new e("not-enrolled","Claustrum enrollment is not configured");return M5(Z)}function W0($){if($.phase==="pending")return{state:"pending",proposedName:$.proposedName,...$.requestId!==void 0&&{requestId:$.requestId}};if($.phase==="approved")return{state:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration};if($.phase==="denied")return{state:"denied",proposedName:$.proposedName};return{state:"blocked",proposedName:$.proposedName,code:$.errorCode??"unknown"}}function I5(){return new e("wrong-consumer","Claustrum enrollment state belongs to a different consumer")}class LD{#$;#Z;#G;#J;#K;#Y;#X;constructor($){this.#X=$.ancestorOptions??{},this.#$=$.client,this.#Z=$.paths,this.#G=$.proposedName,this.#J=$.now??Date.now,this.#K=$.mintSecret??(()=>ZD(32).toString("hex")),this.#Y=$.writeTokenFile??Z9}async status(){return OK(this.#Z,this.#G)}async resetTerminal(){return ND(this.#Z,this.#G)}async#W($,Z){let J={version:1,phase:"blocked",proposedName:$.proposedName,errorCode:Z,updatedAt:this.#J()};return await k0(this.#Z.statePath,J,this.#X),W0(J)}async reconcile(){await s9(M0(this.#Z.statePath),this.#X);let $=await T0({name:"ceremony",path:this.#Z.statePath,ttlMs:D5,renew:!0});if(!$)return{state:"busy"};try{let Z=await o$(this.#Z.tokenPath),J=Z===void 0?void 0:M5(Z),X=await o$(this.#Z.statePath),Y=X===void 0?void 0:H1(X);if(Y&&Y.proposedName!==this.#G)throw I5();if(J){if(!Y||Y.phase==="pending"){let z={version:1,phase:"approved",proposedName:Y?.proposedName??this.#G,tokenGeneration:J.token_generation,updatedAt:this.#J()};await k0(this.#Z.statePath,z,this.#X),Y=z}return{state:"approved",proposedName:Y.proposedName,...Y.phase==="approved"&&Y.approvedName!==void 0&&{approvedName:Y.approvedName},tokenGeneration:J.token_generation}}if(Y?.phase==="approved"){let z={version:1,phase:"blocked",proposedName:Y.proposedName,errorCode:"missing_token",updatedAt:this.#J()};return await k0(this.#Z.statePath,z,this.#X),W0(z)}if(Y&&Y.phase!=="pending")return W0(Y);if(!Y){let z=this.#J();if(Y={version:1,phase:"pending",proposedName:this.#G,requestSecret:this.#K(),createdAt:z,updatedAt:z},!O5.test(Y.requestSecret))throw new e("invalid-state","invalid minted Claustrum enrollment secret");await k0(this.#Z.statePath,Y,this.#X)}if(!Y.requestId)try{let z=$D("sha256").update(Buffer.from(Y.requestSecret,"hex")).digest("hex"),Q=await this.#$.enrollPropose({name:Y.proposedName,requestSecretHash:z});Y={...Y,requestId:Q.requestId,updatedAt:this.#J()},await k0(this.#Z.statePath,Y,this.#X)}catch(z){let Q=jG(z);if(!Q)throw z;if(Q.disposition==="retry")return{state:"pending",proposedName:Y.proposedName,retryCode:Q.code};return this.#W(Y,Q.code)}let G=Y.requestId;if(!G)return W0(Y);try{let z=await this.#$.enrollPoll({requestId:G,requestSecret:Y.requestSecret});if(z.status==="pending")return W0(Y);if(z.status==="denied"){let K={version:1,phase:"denied",proposedName:Y.proposedName,updatedAt:this.#J()};return await k0(this.#Z.statePath,K,this.#X),W0(K)}await s9(M0(this.#Z.tokenPath),this.#X),await DK(M0(this.#Z.tokenPath),this.#X),await this.#Y(this.#Z.tokenPath,{token:z.token,token_generation:z.tokenGeneration});let Q={version:1,phase:"approved",proposedName:Y.proposedName,approvedName:z.name,tokenGeneration:z.tokenGeneration,updatedAt:this.#J()};return await k0(this.#Z.statePath,Q,this.#X),W0(Q)}catch(z){let Q=jG(z);if(!Q)throw z;if(Q.disposition==="retry")return{state:"pending",proposedName:Y.proposedName,requestId:G,retryCode:Q.code};return this.#W(Y,Q.code)}}finally{await $.release()}}}async function ND($,Z){await s9(M0($.statePath));let J=await T0({name:"ceremony",path:$.statePath,ttlMs:D5,renew:!0});if(!J)return"busy";try{if(await o$($.tokenPath)!==void 0)return"refused-approved";let X=await o$($.statePath);if(X===void 0)return"idle";let Y=H1(X);if(Y.proposedName!==Z)throw I5();if(Y.phase==="pending")return"refused-pending";return await J.assertOwned(),await x5($.statePath),"reset"}finally{await J.release()}}async function NG($){try{return await x5($),!0}catch(Z){if(Z.code==="ENOENT")return!1;throw Z}}async function UD($,Z){await s9(M0($.statePath));let J=await T0({name:"ceremony",path:$.statePath,ttlMs:D5,renew:!0});if(!J)return"busy";try{let X;try{let z=await o$($.statePath);X=z===void 0?void 0:H1(z)}catch(z){if(!(z instanceof e)||z.kind!=="invalid-state")throw z}if(X&&X.proposedName!==Z)throw I5();await J.assertOwned();let Y=await NG($.tokenPath);await J.assertOwned();let G=await NG($.statePath);return Y||G?"disconnected":"idle"}finally{await J.release()}}var xD="claustrum-tombstone:v1:";function DD($,Z){return Z!==void 0&&Z.credentialId===$.credentialId&&Z.accountIdentity===$.accountIdentity&&Z.recordVersion!==$.recordVersion}function OD($,Z){if(Z===void 0)return"reauthorize-failed";if(Z.credentialId!==$.credentialId)return"credential-changed";if(Z.accountIdentity!==$.accountIdentity)return"account-changed";if(Z.recordVersion===$.recordVersion)return"version-unchanged";return"rotated"}var MK=jK("claustrum");function MD($,Z,J,X=MK){let Y=DD(Z,J);return X.debug("scoped 401 re-authorized",{site:$,credentialId:Z.credentialId,servedVersion:Z.recordVersion,currentVersion:J?.recordVersion??null,retry:Y,reason:OD(Z,J)}),Y}var UG=300000;function f2(){return new e("invalid-material","Claustrum returned invalid credential material")}function ID($){let Z=$.trim();if(Z.startsWith("{")){let J;try{J=JSON.parse(Z)}catch{throw f2()}if(!J||typeof J!=="object")throw f2();let X=J,Y=X.access_token??X.access;Z=typeof Y==="string"?Y:""}if(!/^[\x21-\x7e]+$/.test(Z)||Z.startsWith(xD))throw f2();return Z}function _D($,Z){if(!$.operations.includes("read"))return;if(!$.categories.includes(Z.category))return;if($.credentialType==="oauth")return $.refreshAdapter===Z.refreshAdapter?"oauth":void 0;if($.credentialType==="api_key"&&Z.apiKeys)return $.refreshAdapter===void 0?"api_key":void 0;return}class _5{#$;#Z;#G;#J;#K;#Y;#X;#W=new WeakMap;#V=new WeakMap;#Q=!1;constructor($){let Z=$.tokenPath;if($.readToken)this.#Z=$.readToken;else if(Z)this.#Z=()=>_4(Z);else throw new e("not-enrolled","Claustrum enrollment token path is required");this.#$=$.client,this.#J=$.family,this.#K=$.parseIdentity,this.#Y=$.requireAssertion??!1,this.#G=$.now??Date.now,this.#X=$.logger??MK}#z($){if(this.#Q)throw new e("closed","Claustrum scoped custody is closed");$?.throwIfAborted()}async#B($){this.#z($);let Z=await this.#Z();if(this.#z($),!/^[0-9a-f]{64}$/.test(Z.token)||!Number.isSafeInteger(Z.token_generation)||Z.token_generation<1)throw new e("invalid-token","Invalid Claustrum enrollment token");return Z.token}async#q($,Z){this.#z(Z);let J,X;try{let Y=$();J=Z?await Promise.race([Y,new Promise((G,z)=>{let Q=()=>z(Z.reason);if(Z.addEventListener("abort",Q,{once:!0}),X=()=>Z.removeEventListener("abort",Q),Z.aborted)Q()})]):await Y}catch(Y){if(this.#z(Z),Y instanceof s6)throw Y;throw new e("unavailable","Claustrum scoped operation unavailable")}finally{X?.()}return this.#z(Z),J}async discover($){let Z=await this.#B($),J=await this.#q(()=>this.#$.listScoped(Z),$),X=[],Y=[],G=new Map;for(let Q of J.rows){let K=_D(Q,this.#J);if(!K)continue;Y.push({row:Q,type:K}),G.set(Q.id,(G.get(Q.id)??0)+1)}let z=[];for(let{row:Q,type:K}of Y){let W;if(!Q.id.trim())W="empty credential id";else if((G.get(Q.id)??0)>1)W="duplicate credential id";else if(Q.accountId!==void 0&&!Q.accountId.trim())W="blank account identity";else if(!Q.state.trim())W="empty state";if(W){X.push({...Q.id.trim()&&{credentialId:Q.id},reason:W});continue}z.push(Object.freeze({credentialId:Q.id,credentialType:K,...Q.accountId!==void 0&&{accountIdentity:Q.accountId},state:Q.state,...Q.email!==void 0&&{email:Q.email},...Q.orgName!==void 0&&{orgName:Q.orgName}}))}for(let Q of X)this.#X.warn("skipped malformed vault record",Q);return{view:J.view,credentials:Object.freeze(z),skipped:Object.freeze(X)}}async authorize($,Z){if(!$.credentialId)throw new e("route-unavailable","Claustrum dispatch requires a credential id");let{credentialId:J,credentialType:X,accountIdentity:Y}=$;if(this.#Y&&Y===void 0)throw new e("identity-unasserted","Claustrum dispatch requires a known account identity");let G=await this.#B(Z),z=await this.#q(()=>this.#$.getScoped({credentialId:J,enrollmentToken:G,...X==="oauth"&&{minTtlMs:UG}}),Z);if(z.credentialId!==void 0&&z.credentialId!==J)throw new e("identity-changed","Claustrum served credential identity changed");let Q=z.expiresAtMs;if(!Number.isSafeInteger(z.recordVersion)||z.recordVersion<0||Q===null&&X==="oauth"||Q!==null&&(!Number.isFinite(Q)||Q-this.#G()<UG))throw new e("insufficient-validity","Claustrum served credential has insufficient validity");let K=ID(z.material),W=z.accountId?.trim()?z.accountId:void 0;if(this.#Y&&(z.credentialId===void 0||W===void 0))throw new e("identity-unasserted","Claustrum served credential did not assert its identity");let V=W===void 0?this.#K?.(K):void 0,B=W??V;if(Y!==void 0&&B!==void 0&&B!==Y)throw new e("identity-changed","Claustrum served credential identity changed");let q=B??Y,j=Object.freeze(Object.defineProperty({credentialId:J,credentialType:X,...q!==void 0&&{accountIdentity:q},accountIdentitySource:W!==void 0?"asserted":V!==void 0?"parsed":Y!==void 0?"expected":"none",...Y!==void 0&&{expectedAccountIdentity:Y},...z.credentialId!==void 0&&{assertedCredentialId:z.credentialId},...W!==void 0&&{assertedAccountIdentity:W},...z.projectId!==void 0&&{projectId:z.projectId},recordVersion:z.recordVersion,expiresAtMs:Q},"accessToken",{value:K,enumerable:!1}));return this.#W.set(j,G),j}async reportFailure($,Z,J){if(Z!==401)return;this.#z();let X=this.#W.get($);if(!X)throw new e("no-receipt","Claustrum failure report requires an original dispatch receipt");let Y=this.#V.get($);if(Y)return Y;let G=this.#q(()=>this.#$.reportAuthFailureScoped({credentialId:$.credentialId,enrollmentToken:X,providerStatus:401,recordVersion:$.recordVersion,reporterSource:J}));this.#V.set($,G);try{await G,this.#X.debug("scoped 401 reported",{credentialId:$.credentialId,recordVersion:$.recordVersion,reporterSource:J})}catch(z){throw this.#V.delete($),z}}close(){if(this.#Q)return;this.#Q=!0,this.#$.close()}}function IK($,Z,J){if($.accountIdentity!==void 0&&J!==void 0)return $.accountIdentity===J;return $.credentialId===Z}function AD($,Z,J){return $.some((X)=>IK(X,Z,J))}function _K($,Z,J){let X={credentialId:Z,...J!==void 0&&{accountIdentity:J}};return[...$.filter((Y)=>Y.credentialId!==Z||Y.accountIdentity!==J),X]}function PK($,Z,J){return $.filter((X)=>!Z.some((Y)=>IK(X,Y,J)))}var wD="vault:";function RD($){return PD("sha256").update($).digest("hex")}function TD($){let Z=$.credentialId.split(":");return(Z.length>=3?Z.slice(2).join(":").trim():void 0)||$.email||$.credentialId}function FD($){return $.identity!==void 0?`identity:${$.identity}`:`credential:${$.credential.credentialId}`}function j0($){return[$.credentialId,...$.aliases??[]]}function CD($,Z,J={}){let X=J.now??Date.now(),Y=J.routePrefix??wD,G=J.reservedRouteIds??new Set,z=$?.rows??[],Q=[...$?.declined??[]],K=Z.skipped.length===0,W=new Set(Z.credentials.map((_)=>_.credentialId)),V=new Set(Z.skipped.flatMap((_)=>_.credentialId===void 0?[]:[_.credentialId])),B=Z.skipped.some((_)=>_.credentialId===void 0),q=(_)=>!W.has(_)&&(V.has(_)||B),H=new Map;for(let _ of z){if(_.accountIdentity===void 0)continue;for(let N of j0(_))if(!H.has(N))H.set(N,_.accountIdentity)}let j=new Map;for(let _ of Z.credentials){let N=_.accountIdentity!==void 0?{credential:_,identity:_.accountIdentity,claimed:!0}:{credential:_,identity:H.get(_.credentialId),claimed:!1},R=FD(N),S=j.get(R)??[];S.push(N),j.set(R,S)}let x=new Set,L=new Set(G),U=[],M=(_,N)=>_.credential.credentialId.localeCompare(N.credential.credentialId),A=[...j.values()].map((_)=>_.toSorted(M)).sort((_,N)=>_[0]&&N[0]?M(_[0],N[0]):0);for(let _ of A){let N=_[0]?.identity,R=_.filter((w)=>w.credential.state==="active"),S=R.length?R:_,E=S.filter((w)=>w.claimed),m=E.length?E:S,s=new Set(_.map((w)=>w.credential.credentialId)),c=z.find((w)=>!x.has(w)&&j0(w).some((f)=>s.has(f))&&(w.accountIdentity===void 0||w.accountIdentity===N)),I=m.find((w)=>w.credential.credentialId===c?.credentialId)??m[0];if(!I)continue;let O=I.credential,P=c??(N===void 0?void 0:z.find((w)=>!x.has(w)&&w.accountIdentity===N));if(P)x.add(P);let D=P?.routeId;if(!D||G.has(D)){let w=`${Y}${O.credentialId}${N===void 0?"":`~${RD(N).slice(0,10)}`}`;D=w;for(let f=2;L.has(D);f++)D=`${w}~${f}`}L.add(D);let T=P?j0(P).filter(q):[],C=[...new Set([..._.map((w)=>w.credential.credentialId),...T])].filter((w)=>w!==O.credentialId).sort((w,f)=>w.localeCompare(f)),k=J.mapAccount?.(O)??{};U.push({previousIndex:P?z.indexOf(P):1/0,row:{routeId:D,credentialId:O.credentialId,credentialType:O.credentialType,...N!==void 0&&{accountIdentity:N},...C.length&&{aliases:C},state:O.state,label:k.label?.trim()||TD(O),...O.email!==void 0&&{email:O.email},...O.orgName!==void 0&&{orgName:O.orgName},enabled:![O.credentialId,...C].some((w)=>AD(Q,w,N)),addedAt:P?.addedAt??X,...P?.quota!==void 0&&{quota:P.quota},...!I.claimed&&N!==void 0&&{unclaimed:!0}}})}return z.forEach((_,N)=>{if(x.has(_)||!j0(_).some(q))return;if(L.has(_.routeId))return;let[R,...S]=j0(_).filter((s)=>!W.has(s));if(R===void 0)return;L.add(_.routeId);let{aliases:E,...m}=_;U.push({previousIndex:N,row:{...m,credentialId:R,...S.length&&{aliases:S},stale:!0}})}),U.sort((_,N)=>_.previousIndex===N.previousIndex?_.row.credentialId.localeCompare(N.row.credentialId):_.previousIndex-N.previousIndex),{version:1,view:Z.view,complete:K,...!K&&{rejected:Z.skipped.map((_)=>({..._.credentialId!==void 0&&{credentialId:_.credentialId},reason:_.reason}))},rows:U.map((_)=>_.row),declined:Q}}function SD($){return($?.rows??[]).filter((Z)=>Z.enabled&&Z.state==="active").map((Z)=>({id:Z.routeId,kind:Z.credentialType==="oauth"?"oauth":"api-key",...Z.quota!==void 0&&{quota:Z.quota}}))}function t9($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function C8($){return $===void 0||typeof $==="string"}function kD($){let Z=t9($)?Q5($.quota):void 0;if(!t9($)||typeof $.routeId!=="string"||typeof $.credentialId!=="string"||$.credentialType!=="oauth"&&$.credentialType!=="api_key"||typeof $.state!=="string"||typeof $.label!=="string"||typeof $.enabled!=="boolean"||typeof $.addedAt!=="number"||!C8($.accountIdentity)||!C8($.email)||!C8($.orgName)||$.aliases!==void 0&&(!Array.isArray($.aliases)||!$.aliases.every((J)=>typeof J==="string"))||$.quota!==void 0&&Z===void 0||$.stale!==void 0&&$.stale!==!0||$.unclaimed!==void 0&&$.unclaimed!==!0)return;return{...$,...Z===void 0?{}:{quota:Z}}}var vD=new Set(["empty credential id","duplicate credential id","blank account identity","empty state"]);function xG($){if(!Array.isArray($))return;let Z=[];for(let J of $){if(!t9(J)||!C8(J.credentialId)||typeof J.reason!=="string"||!vD.has(J.reason))return;Z.push(J)}return Z}function fD($){if(!t9($)||$.version!==1||!C8($.view)||!Array.isArray($.rows)||!Array.isArray($.declined)||$.complete!==void 0&&typeof $.complete!=="boolean"||$.rejected!==void 0&&!xG($.rejected))throw new e("invalid-state","Claustrum roster file is not valid");let Z=[];for(let Y of $.rows){let G=kD(Y);if(!G)throw new e("invalid-state","Claustrum roster file is not valid");Z.push(G)}let J=[];for(let Y of $.declined){if(!t9(Y)||typeof Y.credentialId!=="string"||!C8(Y.accountIdentity))throw new e("invalid-state","Claustrum roster file is not valid");J.push(Y)}let X=xG($.rejected);return{version:1,...typeof $.view==="string"&&{view:$.view},complete:$.complete!==!1,...X&&{rejected:X},rows:Z,declined:J}}async function f6($){let Z;try{Z=await q0($,r)}catch(X){if(X.code==="ENOENT")return;throw X}let J;try{J=JSON.parse(Z)}catch{throw new e("invalid-state","Claustrum roster file is not valid")}return fD(J)}var ED={name:"claustrum-roster-write",ttlMs:1e4,timeoutMs:5000},bD={name:"claustrum-roster",ttlMs:30000};async function i$($,Z,J={}){return d6($,ED,async(X)=>{let Y=await f6($),{next:G,result:z}=await Z(Y,{assertOwned:()=>X.assertOwned()});if(G)await X.assertOwned(),await l8($,G,{beforeRename:async()=>{await J.beforePublish?.(),await X.assertOwned()}});return z})}function gD($,Z){return i$($,(J)=>{let X=J?.rows.find((G)=>G.routeId===Z);if(!J||!X)throw new e("route-unavailable","Claustrum route is not in the roster");let Y=_K(J.declined,X.credentialId,X.accountIdentity);return{next:{...J,declined:Y,rows:J.rows.map((G)=>G===X?{...G,enabled:!1}:G)},result:void 0}})}function yD($,Z){return i$($,(J)=>{let X=J?.rows.find((Y)=>Y.routeId===Z);if(!J||!X)throw new e("route-unavailable","Claustrum route is not in the roster");return{next:{...J,declined:PK(J.declined,j0(X),X.accountIdentity),rows:J.rows.map((Y)=>Y===X?{...Y,enabled:!0}:Y)},result:void 0}})}function hD($,Z){if(!j0($).includes(Z.credentialId))return"refuse";if($.unclaimed&&(Z.accountIdentitySource==="expected"||Z.accountIdentitySource==="none"))return"refuse";if($.accountIdentity===Z.accountIdentity)return"hold";if($.accountIdentity===void 0&&Z.expectedAccountIdentity===void 0&&Z.accountIdentity!==void 0&&(Z.accountIdentitySource==="asserted"||Z.accountIdentitySource==="parsed")&&j0($).length===1)return"bind";return"refuse"}function mD($,Z){return i$($,(J)=>{let X=J?.rows.find((Q)=>Q.routeId===Z.routeId),Y=!J||!X?"refuse":hD(X,Z);if(!J||!X||Y==="refuse")return{result:!1};let G=K5(X.quota,Z.observation),z=Y==="bind"?{accountIdentity:Z.accountIdentity,unclaimed:!0}:{};return{next:{...J,rows:J.rows.map((Q)=>Q===X?{...Q,...z,quota:G}:Q)},result:!0}})}function uD($,Z){return i$($,(J)=>{let X=J?.rows.find((G)=>G.routeId===Z.routeId);if(!J||!X||X.accountIdentity===void 0||X.accountIdentity!==Z.accountIdentity)return{result:!1};let Y=K5(X.quota,Z.observation);return{next:{...J,rows:J.rows.map((G)=>G===X?{...G,quota:Y}:G)},result:!0}})}async function AK($){$.signal?.throwIfAborted();let Z=async()=>await $.isActive?.()??!0;if(!await Z())return;let J=await T0({...bD,path:$.path,renew:!0});if(!J){let X=await f6($.path);if($.signal?.throwIfAborted(),!X?.view)throw new e("roster-busy","Claustrum account discovery is already in progress");return X}try{let X=await $.custody.discover($.signal);return $.signal?.throwIfAborted(),await i$($.path,async(Y)=>{if(!await Z())return{result:void 0};$.signal?.throwIfAborted(),await J.assertOwned();let G=typeof $.projection==="function"?$.projection():$.projection,z=CD(Y,X,G);return{...JSON.stringify(Y)!==JSON.stringify(z)&&{next:z},result:z}})}finally{await J.release()}}class pD{#$;#Z=new AbortController;#G;#J;#K;#Y;#X;#W;#V=!1;#Q;constructor($){this.#$=$,this.#G=$.logger??jK("claustrum")}#z($){this.#Z.signal.throwIfAborted(),$?.throwIfAborted()}async#B(){return await this.#$.isCustodyActive?.()??!0}#q($,Z){let J=BG([this.#Z.signal,...Z?[Z]:[]]);return new Promise((X,Y)=>{let G=()=>{J.signal.removeEventListener("abort",z),J.dispose()},z=()=>{G(),Y(J.signal.reason)};if(J.signal.addEventListener("abort",z,{once:!0}),$.then((Q)=>{if(G(),J.signal.aborted)Y(J.signal.reason);else X(Q)},(Q)=>{G(),Y(Q)}),J.signal.aborted)z()})}async#j(){if(this.#z(),this.#J)return this.#J;if(!this.#K)this.#K=this.#$.connect().then(($)=>{if(this.#Z.signal.aborted)$.close(),this.#z();if(this.#J=new _5({client:$,family:this.#$.family,tokenPath:this.#$.tokenPath,parseIdentity:this.#$.parseIdentity,requireAssertion:this.#$.requireAssertion,now:this.#$.now,logger:this.#G}),this.#$.insula&&$.insula)this.#Q=yx($.insula,this.#$.tokenPath);return this.#J}).finally(()=>{this.#K=void 0});return this.#q(this.#K)}snapshot(){return this.#X}routingRows(){return SD(this.#X)}refresh(){if(this.#z(),this.#Y)return this.#Y;return this.#Y=(async()=>{if(!await this.#B()){this.#X=void 0,this.#J?.close(),this.#J=void 0,this.#Q?.release(),this.#Q=void 0;return}let $=await this.#j(),Z=await AK({path:this.#$.rosterPath,custody:$,isActive:()=>this.#B(),signal:this.#Z.signal,projection:()=>({reservedRouteIds:new Set(this.#$.reservedRouteIds?.()??[]),routePrefix:this.#$.routePrefix,mapAccount:this.#$.mapAccount,now:(this.#$.now??Date.now)()})});this.#z();let J=Z?.view!==this.#X?.view;if(this.#X=Z,Z&&J)this.#$.onRoster?.(Z);return Z})().finally(()=>{this.#Y=void 0}),this.#Y}start(){if(this.#V)return;this.#z(),this.#V=!0;let $=async()=>{try{await this.refresh(),await this.refreshInsulaQuota()}catch(J){if(!this.#Z.signal.aborted)this.#$.onError?.(J)}if(this.#Z.signal.aborted)return;let Z=this.#$.pollIntervalMs??5000;if(Z<=0)return;this.#W=(this.#$.setTimeoutImpl??setTimeout)(()=>{this.#W=void 0,$()},Z),this.#W.unref?.()};$()}async refreshInsulaQuota(){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#B())return;try{await _4(this.#$.tokenPath),await this.#j(),await this.#Q?.source.refresh((this.#$.now??Date.now)())}catch{}}async cachedInsulaQuota($){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#B())return;try{return await _4(this.#$.tokenPath),this.#H($.assertedAccountIdentity)}catch{return}}async cachedInsulaQuotaForRoute($){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#B())return;try{await _4(this.#$.tokenPath);let J=(await f6(this.#$.rosterPath))?.rows.find((X)=>X.routeId===$);return this.#H(J?.accountIdentity)}catch{return}}#H($){if(!this.#$.insula||!$)return;let Z=this.#Q?.source.current(this.#$.insula.provider,$,(this.#$.now??Date.now)());return Z?this.#$.insula.normalize(Z.entry,Z.context):void 0}async authorize($,Z){this.#z(Z);let J=this.#X??await this.#q(this.refresh(),Z);if(!J||!await this.#B())throw new e("not-active","Claustrum scoped custody is not active");let X=await f6(this.#$.rosterPath);this.#z(Z);let Y=J.rows.find((K)=>K.routeId===$),G=X?.rows.find((K)=>K.routeId===$);if(G&&!G.enabled)throw new e("route-declined","Claustrum route is disabled");if(!Y||!G||G.state!=="active"||G.credentialId!==Y.credentialId||G.accountIdentity!==Y.accountIdentity)throw new e("route-unavailable","Claustrum route is disabled, removed or changed");let z=await this.#q(this.#j(),Z),Q=BG([this.#Z.signal,...Z?[Z]:[]]);try{return await z.authorize({credentialId:G.credentialId,credentialType:G.credentialType,...G.accountIdentity!==void 0&&{accountIdentity:G.accountIdentity}},Q.signal)}finally{Q.dispose()}}async reportFailure($,Z,J){if(this.#z(),!this.#J)throw new e("no-receipt","Claustrum dispatch receipt has no active owner");await this.#J.reportFailure($,Z,J)}async send($,Z,J){let X=J.signal,Y=await this.authorize($,X),G=await Z(Y,X);if(G.status===401&&!X?.aborted){let z;try{z=await this.authorize($,X)}catch{}if(MD(J.site,Y,z,this.#G))await G.body?.cancel().catch(()=>{}),Y=z,G=await Z(z,X)}if(G.status===401)await this.reportFailure(Y,401,J.reporterSource??"direct").catch((z)=>this.#$.onError?.(z)),Promise.resolve().then(()=>this.refresh()).catch((z)=>{if(!this.#Z.signal.aborted)this.#$.onError?.(z)});return G}async decline($){this.#z(),await gD(this.#$.rosterPath,$),this.#X=await f6(this.#$.rosterPath)}async accept($){this.#z(),await yD(this.#$.rosterPath,$),this.#X=await f6(this.#$.rosterPath)}async recordQuota($,Z,J){this.#z();let X=await mD(this.#$.rosterPath,{routeId:$,observation:Z,credentialId:J.credentialId,accountIdentitySource:J.accountIdentitySource,...J.accountIdentity!==void 0&&{accountIdentity:J.accountIdentity},...J.expectedAccountIdentity!==void 0&&{expectedAccountIdentity:J.expectedAccountIdentity}});if(X)this.#X=await f6(this.#$.rosterPath);return X}async recordAccountQuota($,Z,J){this.#z();let X=await uD(this.#$.rosterPath,{routeId:$,accountIdentity:Z,observation:J});if(X)this.#X=await f6(this.#$.rosterPath);return X}close(){if(this.#Z.signal.aborted)return;if(this.#Z.abort(new e("closed","Claustrum consumer is closed")),this.#W)(this.#$.clearTimeoutImpl??clearTimeout)(this.#W);this.#W=void 0,this.#J?.close(),this.#Q?.release(),this.#Q=void 0,this.#X=void 0}}function P4($){switch($){case"closed":case"not-enrolled":case"invalid-token":case"unavailable":case"identity-changed":case"identity-unasserted":case"insufficient-validity":case"invalid-material":case"not-active":case"route-unavailable":case"route-declined":case"no-receipt":case"unsafe-file":case"invalid-state":case"wrong-consumer":case"roster-busy":case"host-slot-login":case"host-slot-placeholder":case"placeholder-refresh":return $;default:return"unavailable"}}class o extends Error{code;constructor($){let Z=P4($);super(`Native custody refused: ${Z}`);this.name="NativeCustodyError",this.code=Z}}function wK($){let Z={...$.env??process.env},J=$.connect,X=$.logger,Y=!1,G,z,Q=new Set,K=new WeakSet;function W(L){if(Y)throw new o("closed");L?.throwIfAborted()}function V(){return W(),z??=Promise.resolve().then(J).then((L)=>{if(Y)throw L.close(),new o("closed");return G=L,L}).catch((L)=>{throw z=void 0,L}),z}async function B(L){let U=await V();return W(),L(U)}let q=new _5({client:{listScoped:(L)=>B((U)=>U.listScoped(L)),getScoped:(L)=>B((U)=>U.getScoped(L)),reportAuthFailureScoped:(L)=>B((U)=>U.reportAuthFailureScoped(L)),close:()=>G?.close()},family:{refreshAdapter:"anthropic",category:"anthropic-native",apiKeys:!1},requireAssertion:!0,...$.readToken?{readToken:$.readToken}:{tokenPath:z1($.host,Z).tokenPath},now:$.now,logger:{warn:()=>X?.warn("Native custody inventory record skipped"),debug:()=>X?.debug("Native custody failure reported")}});async function H(L,U){W(U);let M=()=>{},A=()=>{},_=new Promise((N,R)=>{M=()=>R(new o("closed")),A=()=>R(U?.reason),Q.add(M),U?.addEventListener("abort",A,{once:!0})});try{let N=await Promise.race([L(),_]);return W(U),N}catch(N){throw W(U),new o(N instanceof e?P4(N.kind):N instanceof o?P4(N.code):"unavailable")}finally{Q.delete(M),U?.removeEventListener("abort",A)}}function j(L){if(!K.has(L))throw new o("no-receipt")}let x={discover:(L)=>H(()=>q.discover(L),L),authorize:(L,U)=>H(async()=>{let{credentialId:M,accountIdentity:A}=L;if(typeof M!=="string")throw new o("unavailable");if(A!==void 0&&typeof A!=="string")throw new o("unavailable");if(!A?.trim())throw new o("identity-unasserted");let _=await q.authorize({credentialId:M,accountIdentity:A,credentialType:"oauth"},U);return W(U),K.add(_),_},U),reportFailure:(L,U,M)=>H(async()=>{j(L),await q.reportFailure(L,U,M)}),prepareRetry:async(L,U)=>{if(W(U),j(L),L.assertedAccountIdentity===void 0)throw new o("no-receipt");let M;try{M=await x.authorize({credentialId:L.credentialId,accountIdentity:L.assertedAccountIdentity},U)}catch(A){if(W(U),A instanceof o&&A.code==="closed")throw A;return{retry:!1,reason:"reauthorize-failed",code:A instanceof o?P4(A.code):"unavailable"}}if(W(U),M.credentialId!==L.credentialId)return{retry:!1,reason:"credential-changed"};if(M.assertedAccountIdentity!==L.assertedAccountIdentity)return{retry:!1,reason:"account-changed"};if(!(M.recordVersion>L.recordVersion))return{retry:!1,reason:"version-not-newer"};return{retry:!0,receipt:M}},close:()=>{if(Y)return;Y=!0;for(let L of Q)L();q.close()}};return x}async function A4($,Z=process.env){let J=await HD(z1($,Z),`anthropic-auth-${$}`);if(J==="unreadable")throw new o("invalid-token");return J==="vault"?"claustrum":"local"}function RK($,Z){return $.kind===Z.kind&&$.storageId===Z.storageId&&$.rowId===Z.rowId&&$.credentialEpoch===Z.credentialEpoch&&$.identity===Z.identity}function DG($,Z){return RK($.binding,Z.binding)&&$.credentialFingerprint===Z.credentialFingerprint&&$.version.accessFingerprint===Z.version.accessFingerprint&&$.version.expires===Z.version.expires&&Object.hasOwn($.version,"lastRefreshedAt")===Object.hasOwn(Z.version,"lastRefreshedAt")&&$.version.lastRefreshedAt===Z.version.lastRefreshedAt}function OG($,Z,J){let X=$?.lastRefreshError;if($?.binding.kind==="local"&&RK($.binding,Z.binding)&&X?.credentialFingerprint===Z.credentialFingerprint){if(X.permanent===!0)return{status:"blocked",reason:"invalid-grant",credentialFingerprint:Z.credentialFingerprint};if(X.nextRetryAt!==void 0&&X.nextRetryAt>J)return{status:"blocked",reason:"refresh-backoff",credentialFingerprint:Z.credentialFingerprint}}return{status:"allowed"}}function lD($){let{paths:Z,externalPolicy:J}=$,X=$.now??Date.now;if(typeof J!=="function")throw TypeError("Native local external policy gate is required");function Y(z){let Q=J(z);if(Q?.status==="allowed"&&Object.keys(Q).length===1)return{status:"allowed"};if(Q?.status==="blocked"&&Object.keys(Q).length===2&&["quota-ineligible","account-disabled","local-mode-unavailable"].includes(Q.reason))return{status:"blocked",reason:Q.reason};throw TypeError("Native local external policy result is invalid")}async function G(z){if(!x6(z.binding))throw new g("invalid-runtime");let Q=await c$(Z.runtime,Z.storageId),K=Q.status==="ready"?Q.state.accounts[z.binding.rowId]:void 0;if(K&&K.binding.kind!=="local")throw new g("invalid-runtime");return K}return{async readRestrictions(z){let Q=await G(z),K=Y(z);return{restriction:K.status==="blocked"?K:OG(Q,z,X()),context:{subject:z,runtimeBinding:Q?.binding.kind==="local"?Q.binding:null,refreshErrorClearedAt:Q?.refreshErrorClearedAt??null,quotaErrorClearedAt:Q?.quotaErrorClearedAt??null,quotaErrorGeneration:Q?.quotaErrorGeneration??null}}},async readAdmission(z){let Q=await G(z),K=Y(z);if(K.status==="blocked")return K;let W=X(),V=OG(Q,z,W);if(V.status==="blocked")return{status:"blocked",reason:V.reason};if(!$8(z))throw new g("invalid-runtime");let B=Q?.credentialValidation;if(B&&DG(B,z))return{status:"proven",validation:B};let q=Q?.validationRetry;if(q&&z.version.expires>W&&q.nextRetryAt>W&&DG(q.subject,z))return{status:"blocked",reason:"validation-backoff"};return{status:"unproven"}}}}var a7=3;function E2($,Z){let J=dD("sha256").update(JSON.stringify([$.storageId,Z])).digest("hex");return{path:$.state,name:`native-account-provider-${J}`,...h6}}function MG($){return $ instanceof FJ||$ instanceof _J}var y0=new Map;function L8($,Z){if(y0.get(Z)===$)y0.delete(Z);$.keys.delete(Z)}function K9($){let Z=$ instanceof G6?$.cause:$,J=$ instanceof G6?$.kind:"caller-hook";if(J==="provider"&&Z instanceof b9){let X=Z.status===400&&/\binvalid_grant\b/.test(Z.body);return{kind:J,classification:X?"invalid-grant":Z.status===429||Z.status>=500?"transient":"permanent",status:Z.status,...Z.retryAfter!==void 0?{retryAfter:Z.retryAfter}:{}}}return{kind:J,classification:J==="provider"&&g$(Z)?"transient":"permanent"}}function G4($){return $ instanceof Error?$:Error("Native refresh callback failed",{cause:$})}function O8($){if($.type!=="oauth")throw Error("Local refresh requires an OAuth credential");return Object.freeze({accessFingerprint:$.access?S$($.access):void 0,expires:$.expires,...Object.hasOwn($,"lastRefreshedAt")?{lastRefreshedAt:$.lastRefreshedAt}:{}})}class v9 extends Error{reason;constructor($){super("Local refresh policy refused the exchange");this.reason=$}}function b2($,Z){if($.status==="allowed")return;if($.reason!=="refresh-backoff"&&$.reason!=="invalid-grant")return $.reason;return $.credentialFingerprint===Z?$.reason:void 0}function iD($,Z){let J=$.credential,X=Z.credential;return J?.type==="oauth"&&X?.type==="oauth"&&J.access===X.access&&J.refresh===X.refresh&&J.expires===X.expires&&Object.hasOwn(J,"lastRefreshedAt")===Object.hasOwn(X,"lastRefreshedAt")&&J.lastRefreshedAt===X.lastRefreshedAt}function sD($){throw Error(`Unsupported refresh outcome: ${String($)}`)}function tD($,Z){return x6($)&&x6(Z)&&$.storageId===Z.storageId&&$.rowId===Z.rowId&&$.credentialEpoch===Z.credentialEpoch&&$.identity===Z.identity}function aD($,Z){return tD($.binding,Z.binding)&&$.credentialFingerprint===Z.credentialFingerprint&&$.version.accessFingerprint===Z.version.accessFingerprint&&$.version.expires===Z.version.expires&&Object.hasOwn($.version,"lastRefreshedAt")===Object.hasOwn(Z.version,"lastRefreshedAt")&&$.version.lastRefreshedAt===Z.version.lastRefreshedAt}function zZ($){return Object.freeze({...$,binding:Object.freeze({...$.binding}),version:Object.freeze({...$.version})})}function IG($,Z){if(Z.credential?.type!=="oauth"||!Z.fingerprint)throw new v9("access-unavailable");return zZ({binding:$,credentialFingerprint:Z.fingerprint,version:O8(Z.credential)})}function z4($){return Object.freeze({credentialFingerprint:I6($),version:O8($)})}function nD($,Z){if(!aD($.subject,Z)||$.runtimeBinding!==null&&!x6($.runtimeBinding)||![$.refreshErrorClearedAt,$.quotaErrorClearedAt,$.quotaErrorGeneration].every((J)=>J===null||Number.isSafeInteger(J)&&Number(J)>=0))throw Error("Native policy context does not match the captured subject");return Object.freeze({subject:zZ(Z),runtimeBinding:$.runtimeBinding===null?null:Object.freeze({...$.runtimeBinding}),refreshErrorClearedAt:$.refreshErrorClearedAt,quotaErrorClearedAt:$.quotaErrorClearedAt,quotaErrorGeneration:$.quotaErrorGeneration})}function oD($){let Z=O0($),J=$.now??Date.now,X=$.refreshToken??BB,Y=$.resolveIdentity??Oq,G=uQ($.onLockEvent);async function z(q){let H=await Z.read();return H.status==="ready"?H.rows.find((j)=>j.id===q.rowId):void 0}async function Q(q){let H;try{H=await $.readRestrictions(q)}catch(j){throw Error("Native policy callback failed",{cause:j})}return Object.freeze({restriction:Object.freeze({...H.restriction}),context:nD(H.context,q)})}async function K(q,H,j,x,L){let U=(N)=>({status:"refused",reason:N,persisted:L});if(!j||!x$(H,$.paths,j)||!j.enabled||!j.candidate)return U("row-ineligible");if(H.identity===void 0)return U("identity-unproven");let M=j.credential;if(M?.type!=="oauth"||!M.access||typeof M.expires!=="number"||M.expires<=J())return U("access-unavailable");if(M.access===q.rejectedAccessToken)return U("rejected-access-unchanged");let A=zZ({binding:{...H,identity:H.identity},credentialFingerprint:I6(M),version:{...O8(M),accessFingerprint:S$(M.access),expires:M.expires}}),_;try{_=await $.readAdmission(A)}catch(N){throw Error("Native admission callback failed",{cause:N})}if(_.status==="blocked")return U(_.reason);if(_.status!=="proven")return U("proof-missing");if(!c0(_.validation,H,M))return U("proof-mismatch");if(q.signal?.aborted)return U("cancelled");if(M.expires<=J())return U("access-unavailable");return Object.freeze({status:"usable",source:x,binding:A.binding,access:M.access,expires:M.expires,subject:A,validation:zZ(_.validation)})}async function W(q){let H=E2($.paths,q),j=performance.now();for(;;){let x=await T0({name:H.name,path:H.path,ttlMs:h6.ttlMs,renew:!0,now:J,onContended:G?()=>G({type:"contended",name:H.name,path:H.path}):void 0,onStep:$.onLockStep?(U)=>$.onLockStep?.(H,U):void 0});if(x){try{await x.assertOwned()}catch(U){throw await x.release().catch(()=>{}),G?.({type:"released",name:H.name,path:H.path}),U}return G?.({type:"acquired",name:H.name,path:H.path}),x}let L=h6.timeoutMs-(performance.now()-j);if(L<=0)throw new b8({target:H.path,name:H.name,timeoutMs:h6.timeoutMs});await new Promise((U)=>setTimeout(U,Math.min(h6.retryMs,L)))}}async function V(q,H){let j=H.binding,x=0,L=!1,U=!1,M,A="unavailable",_="not-needed",N,R,S,E,m,s,c,I,O=!1;function P(){return A==="unsupported-credential"}function D(){return{binding:j,attempt:x,credentialFingerprint:N,credentialVersion:R,context:E,bootstrap:A,handoff:_}}async function T(w){try{await $.reconcile(w)}catch(f){throw O=!0,Error("Native reconciliation callback failed",{cause:f})}}async function C(){let w=m;if(m=void 0,c?.(),c=void 0,w)s=(async()=>{if(await w.release().catch(()=>{}),M){let f=E2($.paths,M);G?.({type:"released",name:f.name,path:f.path})}})();await s}async function k(){if(_="skipped-loss",I)L8(q,I);await C()}try{for(x=1;x<=a7;x++){L=!1;let w=!1;M=void 0,N=void 0,R=void 0,S=void 0,E=void 0,I=void 0,A="unavailable",_="not-needed";let f,h=await z(j);N=h?.fingerprint,R=h?.credential?.type==="oauth"?O8(h.credential):void 0;let v,F=!h||!x$(j,$.paths,h)?"binding-changed":H.signal?.aborted?"cancelled":!h.candidate||!h.enabled?"row-ineligible":void 0;if(F)return await T({...D(),status:"refused",reason:F,consumed:!1}),{status:"refused",reason:F,persisted:!1};if(!h)throw Error("Captured row unavailable");v=await Q(IG(j,h));let b=b2(v.restriction,h.fingerprint);if(b)return await T({...D(),status:"refused",reason:b,consumed:!1}),{status:"refused",reason:b,persisted:!1};if(j.identity!==void 0&&(H.intent==="serve"||H.rejectedAccessToken!==void 0)&&h?.credential?.type==="oauth"&&h.credential.access&&h.credential.access!==H.rejectedAccessToken&&(h.credential.expires??0)>J()){let y=await K(H,j,h,"adopted",!1);if(y.status==="usable")await T({...D(),status:"adopted",successorFingerprint:I6(h.credential),successorVersion:O8(h.credential)});else if(y.status==="refused"&&y.reason==="proof-missing"){E=v.context;let u,l;try{if(u=(await Y(h.credential.access,void 0,void 0)).accountUuid,A=u?"resolved":"unavailable",!u)l={kind:"validation",classification:"transient"}}catch(t){if(MG(t))return A="unsupported-credential",await T({...D(),status:"refused",reason:"unsupported-access",consumed:!1}),{status:"refused",reason:"unsupported-access",persisted:!1};A="failed",l={kind:"validation",classification:g$(t)||t instanceof b9&&(t.status===429||t.status>=500)?"transient":"permanent"}}if(l){Object.freeze(l);try{await T({...D(),status:"failed",failure:l,persisted:!1})}catch{}return{status:"failed",failure:l,persisted:!1,reconciliationFailed:O}}if(u!==j.identity)return await T({...D(),status:"refused",reason:"validation-contradicted",consumed:!1}),{status:"refused",reason:"validation-contradicted",persisted:!1};await T({...D(),status:"validation-observed",identity:j.identity,context:E})}else return y;return{status:"completed",source:y.status==="usable"?H.rejectedAccessToken?"adopted":"current":"validated",identity:j.identity,persisted:!1}}try{let y=await Z.refresh(j.rowId,async(u,l)=>{if(f=l,N=l.fingerprint,R=O8(u),vz(u.refresh))throw new v9("custody-tombstone");v=await Q(IG(j,l)),E=v.context;let t=H.signal?.aborted?"cancelled":b2(v.restriction,N);if(t)throw new v9(t);w=!0;let W6=await X({refreshToken:u.refresh,maxRetries:0,now:J});L=!0;try{let B6=(await Y(W6.access,void 0,void 0)).accountUuid;M=typeof B6==="string"&&B6.length>0&&B6.trim()===B6?B6:void 0,A=M?"resolved":"unavailable"}catch(B6){A=MG(B6)?"unsupported-credential":"failed"}if(j.identity===void 0&&M){if(I=aY({...j,identity:M}),!y0.has(I))y0.set(I,q),q.keys.add(I);if(H.signal?.aborted)_="skipped-cancelled",L8(q,I);else try{m=await W(M),_="acquired";let B6=m,i6=()=>{if(m!==B6)return;if(_="skipped-cancelled",I)L8(q,I);C()};if(H.signal?.addEventListener("abort",i6,{once:!0}),c=()=>H.signal?.removeEventListener("abort",i6),H.signal?.aborted)i6();if(B6.whenLost().then(async()=>{if(m===B6)await k()}).catch(()=>{}),m===B6)await B6.assertOwned()}catch(B6){_=B6 instanceof b8?"skipped-contention":"skipped-loss",L8(q,I),await C()}}return{access:W6.access,refresh:W6.refresh,expires:W6.expires,...M?{identity:M}:{}}},{...j.identity!==void 0?{providerLock:E2($.paths,j.identity)}:{},refuse:async(u)=>{if(!x$(j,$.paths,u))return"binding-changed";if(f&&!iD(f,u))return"dispatch-changed";if(m)try{await m.assertOwned()}catch{await k()}if(L)return;if(H.signal?.aborted)return"cancelled";if(!u.candidate||!u.enabled)return"row-ineligible";return v?b2(v.restriction,u.fingerprint):void 0},onPersisted:async(u,l)=>{U=!0,S=z4(l);try{if(m)try{await m.assertOwned()}catch{await k()}await T({...D(),status:"persisted",identity:M,successorFingerprint:S.credentialFingerprint,successorVersion:S.version,committed:S})}finally{await C()}}});switch(y.status){case"rotated":if(P())return{status:"refused",reason:"unsupported-access",persisted:!0};return{status:"completed",source:"rotated",identity:y.identity,persisted:!0};case"refused":return await T({...D(),status:"refused",reason:y.reason,consumed:L}),{status:"refused",reason:y.reason,persisted:!1};case"identity-contradicted":return U=!0,S=z4(y.credential),await T({...D(),status:"identity-contradicted",expectedIdentity:y.expectedIdentity,returnedIdentity:y.returnedIdentity,successorFingerprint:S.credentialFingerprint,successorVersion:S.version,committed:S}),{status:"identity-contradicted",expectedIdentity:y.expectedIdentity,returnedIdentity:y.returnedIdentity,persisted:!0};default:return sD(y)}}catch(y){let u=G4(y);if(U||=u instanceof G6&&(u.committed!==void 0||u.phase==="after-first-write"),u instanceof G6&&u.committed?.type==="oauth")S=z4(u.committed);if(!w&&u instanceof G6&&u.cause instanceof v9)return await T({...D(),status:"refused",reason:u.cause.reason,consumed:!1}),{status:"refused",reason:u.cause.reason,persisted:!1};let l=K9(u);if(!w&&l.kind==="provider")l.kind="caller-hook",l.classification="permanent";Object.freeze(l);try{await T({...D(),status:"failed",failure:l,persisted:U,committed:S})}catch{}if(w&&!L&&!U&&!O&&!H.signal?.aborted&&l.kind==="provider"&&l.classification==="transient"&&l.status!==429&&x<a7){if(await C(),I)L8(q,I);continue}return{status:"failed",failure:l,persisted:U,reconciliationFailed:O}}finally{await C()}}throw Error("Unreachable refresh attempt budget")}catch(w){let f=G4(w);if(U||=f instanceof G6&&(f.committed!==void 0||f.phase==="after-first-write"),f instanceof G6&&f.committed?.type==="oauth")S=z4(f.committed);try{await T({...D(),status:"failed",failure:K9(f),persisted:U,committed:S})}catch{}return{status:"failed",failure:K9(f),persisted:U,reconciliationFailed:O}}finally{await C()}}async function B(q){if(q.mode!=="local")return{status:"refused",reason:"custody-mode",persisted:!1};if(q.intent!=="serve"&&q.intent!=="refresh")return{status:"refused",reason:"invalid-intent",persisted:!1};if(!x6(q.binding)||q.binding.storageId!==$.paths.storageId)return{status:"refused",reason:"binding-changed",persisted:!1};if(q={...q,binding:Object.freeze({...q.binding})},q.signal?.aborted)return{status:"refused",reason:"cancelled",persisted:!1};let H=aY(q.binding),j=y0.get(H);if(!j&&q.intent==="serve"){try{let L=await K(q,q.binding,await z(q.binding),"current",!1);if(L.status!=="refused"||!["proof-missing","identity-unproven","access-unavailable","rejected-access-unchanged"].includes(L.reason))return L}catch(L){return{status:"failed",failure:K9(G4(L)),persisted:!1,reconciliationFailed:!1}}j=y0.get(H)}if(!j){j={keys:new Set([H]),promise:Promise.resolve({status:"refused",reason:"initializing",persisted:!1})},y0.set(H,j);let L=j;j.promise=V(L,q).finally(()=>{for(let U of L.keys)L8(L,U)})}let x=await j.promise;if(q.signal?.aborted)return{status:"refused",reason:"cancelled",persisted:x.persisted};if(x.status!=="completed")return x;try{let L=q.binding.identity===void 0&&x.source==="rotated"?{...q.binding,...x.identity?{identity:x.identity}:{}}:q.binding,U=await z(q.binding);return await K(q,L,U,x.source,x.persisted)}catch(L){return{status:"failed",failure:K9(G4(L)),persisted:x.persisted,reconciliationFailed:!1}}}return{authorize:B}}class v6 extends Error{role;code;constructor($,Z){super(`Anthropic migration ${$} input: ${Z}`);this.role=$,this.code=Z,this.name="NativeMigrationSourceError"}}var PG=4194304;function XO($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function YO($){let Z=[$];while(Z.length){let J=Z.pop();if(!J)continue;for(let X of Object.values(J))if(X!==null&&typeof X==="object")Z.push(X);Object.freeze(J)}return $}function AG($){return Object.defineProperty($,"data",{enumerable:!1}),Object.freeze($)}async function T6($,Z,J={}){let X=AG({role:$,path:Z,digest:null,data:void 0,metadata:void 0}),Y;try{Y=await _G(Z,{bigint:!0})}catch(z){if(z instanceof Error&&"code"in z&&z.code==="ENOENT")return X;throw new v6($,"source-io")}if(!Y.isFile()||Y.isSymbolicLink())throw new v6($,"unsafe-source");let G;try{G=await JO(Z,g2.O_RDONLY|(g2.O_NOFOLLOW??0)|(g2.O_NONBLOCK??0));let z=await G.stat({bigint:!0});if(!z.isFile()||z.dev!==Y.dev||z.ino!==Y.ino)throw new v6($,"source-changed");if(z.size>PG)throw new v6($,"source-too-large");await J.onOpened?.();let Q=[],K=0;for(;;){let H=Buffer.alloc(65536),j=await G.read(H);if(!j.bytesRead)break;if(K+=j.bytesRead,K>PG)throw new v6($,"source-too-large");Q.push(H.subarray(0,j.bytesRead))}let W=await G.stat({bigint:!0}),V=await _G(Z,{bigint:!0});if(z.uid!==W.uid||z.gid!==W.gid||z.mode!==W.mode||V.uid!==z.uid||V.gid!==z.gid||V.mode!==z.mode||z.dev!==W.dev||z.ino!==W.ino||z.mtimeNs!==W.mtimeNs||z.ctimeNs!==W.ctimeNs||z.size!==W.size||V.dev!==z.dev||V.ino!==z.ino||V.isSymbolicLink()||V.mtimeNs!==z.mtimeNs||V.ctimeNs!==z.ctimeNs||V.size!==z.size||BigInt(K)!==z.size)throw new v6($,"source-changed");let B=Buffer.concat(Q,K),q;try{q=u8(new TextDecoder("utf-8",{fatal:!0}).decode(B))}catch{throw new v6($,"invalid-source")}if(!XO(q))throw new v6($,"invalid-source");return AG({role:$,path:Z,digest:ZO("sha256").update(B).digest("hex"),data:YO(q),metadata:Object.freeze({uid:Number(z.uid),mode:Number(z.mode),device:z.dev.toString(),inode:z.ino.toString(),modified:z.mtimeNs.toString(),changed:z.ctimeNs.toString()})})}catch(z){if(z instanceof v6)throw z;if(z instanceof Error&&"code"in z){if(z.code==="ENOENT")throw new v6($,"source-changed");if(z.code==="ELOOP")throw new v6($,"unsafe-source")}if(z instanceof SyntaxError)throw new v6($,"invalid-source");throw new v6($,"source-io")}finally{await G?.close()}}async function H0($){let Z=await T6($.role,$.path);if(Z.digest!==$.digest||JSON.stringify(Z.metadata)!==JSON.stringify($.metadata))throw new v6($.role,"source-changed")}var n7=["building","verified","activation-installed","committed","retired"];class Y6 extends Error{code;constructor($){super({"migration-required":"Anthropic account migration is required. Stop OpenCode, LiteCode and Pi, then run bunx @cortexkit/opencode-anthropic-auth@2.0.0 setup","migration-incomplete":"Anthropic account migration is incomplete; resume setup","invalid-journal":"Anthropic account migration journal is invalid","journal-conflict":"Anthropic account migration journal changed"}[$]);this.code=$,this.name="NativeAuthorityError"}}function k$($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function TK($){try{return t0($)}catch{throw new Y6("invalid-journal")}}function P5($){try{return dQ($)}catch{throw new Y6("invalid-journal")}}function o7($){return n7.some((Z)=>Z===$)}function Q$($,Z){return Object.keys($).length===Z.length&&Z.every((J)=>Object.hasOwn($,J))}function QZ($){return typeof $==="string"&&$.length===64&&/^[a-f0-9]{64}$/.test($)}function f9($){return $===null||QZ($)}function bZ($){return $==="absent"||QZ($)}function r7($){return typeof $==="string"&&rD($)&&!/\p{Cc}/u.test($)&&!$.endsWith(Q4)&&eD($)===$&&(Q4!=="\\"||$O($).root!==Q4)&&!$.split(Q4).some((Z)=>Z==="."||Z==="..")}function GO($){return k$($)&&Q$($,["config","state","hostAuth","routing"])&&f9($.config)&&f9($.state)&&bZ($.hostAuth)&&f9($.routing)}function zO($){return k$($)&&Q$($,["source","destination"])&&r7($.source)&&r7($.destination)}function z$($){return typeof $==="string"&&$.length>0}function QO($){if(!k$($)||!Q$($,["version","view","complete","rows","declined"])||$.version!==1||!z$($.view)||$.complete!==!0||!Array.isArray($.rows)||!Array.isArray($.declined))throw new Y6("invalid-journal");let Z=$.rows.map((X)=>{if(!k$(X)||!Q$(X,["routeId","credentialId","credentialType","accountIdentity","state","label","enabled","addedAt"])||!z$(X.routeId)||!z$(X.credentialId)||X.credentialType!=="oauth"||!z$(X.accountIdentity)||!z$(X.state)||typeof X.label!=="string"||typeof X.enabled!=="boolean"||typeof X.addedAt!=="number"||!Number.isFinite(X.addedAt))throw new Y6("invalid-journal");return{routeId:X.routeId,credentialId:X.credentialId,credentialType:"oauth",accountIdentity:X.accountIdentity,state:X.state,label:X.label,enabled:X.enabled,addedAt:X.addedAt}}),J=$.declined.map((X)=>{if(!k$(X)||!z$(X.credentialId)||!(Q$(X,["credentialId"])||Q$(X,["credentialId","accountIdentity"])&&z$(X.accountIdentity)))throw new Y6("invalid-journal");return z$(X.accountIdentity)?{credentialId:X.credentialId,accountIdentity:X.accountIdentity}:{credentialId:X.credentialId}});if(new Set(Z.map((X)=>X.routeId)).size!==Z.length)throw new Y6("invalid-journal");return{version:1,view:$.view,complete:!0,rows:Z,declined:J}}function y2($,Z,J){if(!k$($)||!Q$($,[...Z])||!Z.every((X)=>J($[X])))throw new Y6("invalid-journal");return Object.fromEntries(Z.map((X)=>[X,$[X]]))}var KO=["prepared","published","committed"];function WO($,Z){if($===null)return null;if(!k$($))throw new Y6("invalid-journal");if($.kind==="requested"&&Q$($,["kind"]))return{kind:"requested"};if($.kind!=="activation"||Z!=="retired"||!Q$($,["kind","phase","primary","roster","localProof","removeIds","settings","runtime","hostAuth"])||!KO.some((Q)=>Q===$.phase)||!k$($.primary)||!Q$($.primary,["routeId","credentialId","accountIdentity"])||!z$($.primary.routeId)||!z$($.primary.credentialId)||!z$($.primary.accountIdentity)||!Array.isArray($.removeIds)||!$.removeIds.every(z$))throw new Y6("invalid-journal");let J={routeId:$.primary.routeId,credentialId:$.primary.credentialId,accountIdentity:$.primary.accountIdentity},X=QO($.roster),Y=P5($.localProof),G=[...$.removeIds],z=new Set(Y.rows.map((Q)=>Q.id));if(G.some((Q,K)=>!z.has(Q)||K>0&&(G[K-1]??"")>=Q)||!X.rows.some((Q)=>Q.routeId===J.routeId&&Q.credentialId===J.credentialId&&Q.accountIdentity===J.accountIdentity))throw new Y6("invalid-journal");return{kind:"activation",phase:$.phase,primary:J,roster:X,localProof:Y,removeIds:G,settings:y2($.settings,["source","target"],QZ),runtime:y2($.runtime,["source","target"],QZ),hostAuth:y2($.hostAuth,["source","expected"],bZ)}}function A5($,Z){let J=TK($);if(!k$(J)||!Q$(J,["version","storageId","host","phase","sources","routingPaths","hostAuthPath","expectedHostAuth","expectedRouting","preparedProof","activation"])||J.version!==4||J.storageId!==Z||J.host!=="opencode"&&J.host!=="pi"||!o7(J.phase)||!GO(J.sources)||!zO(J.routingPaths)||!r7(J.hostAuthPath)||J.expectedHostAuth!=="unprepared"&&!bZ(J.expectedHostAuth)||J.expectedRouting!=="unprepared"&&!f9(J.expectedRouting))throw new Y6("invalid-journal");let X=J.expectedHostAuth==="unprepared",Y=J.preparedProof===null?null:P5(J.preparedProof);if(X!==(J.expectedRouting==="unprepared")||X!==(Y===null)||J.phase==="building"&&!X||J.phase!=="building"&&J.phase!=="verified"&&X||!X&&J.sources.routing===null!==(J.expectedRouting===null))throw new Y6("invalid-journal");return{version:4,storageId:Z,host:J.host,phase:J.phase,sources:{config:J.sources.config,state:J.sources.state,hostAuth:J.sources.hostAuth,routing:J.sources.routing},routingPaths:{source:J.routingPaths.source,destination:J.routingPaths.destination},hostAuthPath:J.hostAuthPath,expectedHostAuth:J.expectedHostAuth,expectedRouting:J.expectedRouting,preparedProof:Y,activation:WO(J.activation,J.phase)}}async function L1($){try{let Z=await T6("journal",$.journal);if(!Z.data)return;if(!Z.metadata||(Z.metadata.mode&511)!==384||process.getuid&&Z.metadata.uid!==process.getuid())throw new Y6("invalid-journal");return A5(Z.data,$.storageId)}catch{throw new Y6("invalid-journal")}}function VO($){if(!$)return;if($.phase!=="committed"&&$.phase!=="retired")return;if($.activation!==null&&($.activation.kind!=="activation"||$.activation.phase!=="committed"))return;return $.phase}async function e7($){let Z=await L1($);if(!Z)throw new Y6("migration-required");if(!VO(Z))throw new Y6("migration-incomplete");return Z}function FK($){if($===null||typeof $!=="object")return;for(let Z of Object.values($))FK(Z);Object.freeze($)}async function w5($,Z,J,X){let Y=A5(Z,$.storageId);if(Y.preparedProof){for(let G of Y.preparedProof.rows)Object.freeze(G);Object.freeze(Y.preparedProof.rows),Object.freeze(Y.preparedProof)}Object.freeze(Y.sources),Object.freeze(Y.routingPaths),FK(Y.activation),Object.freeze(Y),await l8($.journal,Y,{beforeRename:async()=>{await X.onWriteStep?.("before-write",Y),await X.assertOwned?.(),await J()}}),await X.onWriteStep?.("after-write",Y)}async function BO($,Z,J={}){try{j5(Z)}catch{throw new Y6("invalid-journal")}let X=A5({version:4,storageId:$.storageId,host:Z.host,phase:"building",sources:Z.sources,routingPaths:Z.routingPaths,hostAuthPath:Z.hostAuthPath,expectedHostAuth:"unprepared",expectedRouting:"unprepared",preparedProof:null,activation:Z.activation===void 0?null:Z.activation==="requested"?{kind:"requested"}:"invalid"},$.storageId);return d6($.journal,{name:"migration-journal",ttlMs:30000,timeoutMs:15000,...J.lockOptions,renew:!0},async(Y)=>{let G=await L1($);if(G){if(G.host!==X.host||G.sources.config!==X.sources.config||G.sources.state!==X.sources.state||G.sources.hostAuth!==X.sources.hostAuth||G.sources.routing!==X.sources.routing||G.routingPaths.source!==X.routingPaths.source||G.routingPaths.destination!==X.routingPaths.destination||G.hostAuthPath!==X.hostAuthPath||G.activation===null!==(X.activation===null))throw new Y6("journal-conflict");return G}return await w5($,X,()=>Y.assertOwned(),J),X})}async function qO($,Z,J={}){let X=TK(Z);if(!k$(X)||!Q$(X,["expectedHostAuth","expectedRouting","preparedProof"])||!bZ(X.expectedHostAuth)||!f9(X.expectedRouting))throw new Y6("invalid-journal");let{expectedHostAuth:Y,expectedRouting:G}=X,z=P5(X.preparedProof);return d6($.journal,{name:"migration-journal",ttlMs:30000,timeoutMs:15000,...J.lockOptions,renew:!0},async(Q)=>{let K=await L1($);if(!K)throw new Y6("migration-required");if(K.phase!=="verified"||K.sources.routing===null!==(G===null))throw new Y6("journal-conflict");if(K.expectedHostAuth!=="unprepared"){if(K.expectedHostAuth!==Y||K.expectedRouting!==G||M6(K.preparedProof)!==M6(z))throw new Y6("journal-conflict");return K}let W={...K,expectedHostAuth:Y,expectedRouting:G,preparedProof:z};return await w5($,W,()=>Q.assertOwned(),J),W})}async function w4($,Z,J,X={}){if(!o7(Z)||!o7(J)||n7.indexOf(J)!==n7.indexOf(Z)+1)throw new Y6("journal-conflict");return d6($.journal,{name:"migration-journal",ttlMs:30000,timeoutMs:15000,...X.lockOptions,renew:!0},async(Y)=>{let G=await L1($);if(!G)throw new Y6("migration-required");if(G.phase===J)return G;if(G.phase!==Z)throw new Y6("journal-conflict");if(J==="activation-installed"&&G.expectedHostAuth==="unprepared")throw new Y6("journal-conflict");let z={...G,phase:J};return await w5($,z,()=>Y.assertOwned(),X),z})}var jO=["paths","publicationGuard","externalPolicy","failurePolicy","now","refreshToken","resolveIdentity"],wG=["legacyConfig","legacyState","config","state","runtime","journal","roster","storageId"],HO=["checkedAt","nextRetryAt","retryCount"];function KZ($){return TypeError(`Native local credential service option ${$} is invalid`)}function R5($,Z){if($===null||typeof $!=="object"||cD.isProxy($)||Object.getPrototypeOf($)!==Object.prototype&&Object.getPrototypeOf($)!==null)return;let J=Object.getOwnPropertyDescriptors($);for(let X of Reflect.ownKeys(J)){let Y=J[X];if(typeof X!=="string"||!Z.includes(X)||!Y||!Object.hasOwn(Y,"value"))return}return J}function h2($,Z){let J=$[Z]?.value;if(typeof J!=="function")throw KZ(Z);return J}function m2($,Z){let J=$[Z]?.value;if(J===void 0)return;if(typeof J!=="function")throw KZ(Z);return J}function LO($){let Z=R5($,wG);if(!Z)throw KZ("paths");let J={};for(let X of wG){let Y=Z[X]?.value;if(typeof Y!=="string"||Y.length===0)throw KZ("paths");J[X]=Y}return Object.freeze(J)}function RG($){let Z=structuredClone($),J=(X)=>{if(X===null||typeof X!=="object")return;for(let Y of Object.values(X))J(Y);Object.freeze(X)};return J(Z),Z}function NO($){let Z=R5($,HO);if(!Z||!Object.hasOwn(Z,"checkedAt"))throw TypeError("Native local failure policy result is invalid");let J=(G)=>Z[G]?.value,X=J("nextRetryAt"),Y=J("retryCount");return Object.freeze({checkedAt:J("checkedAt"),...X!==void 0?{nextRetryAt:X}:{},...Y!==void 0?{retryCount:Y}:{}})}function UO($){let Z=R5($,jO);if(!Z)throw TypeError("Native local credential service options are invalid");let J=LO(Z.paths?.value),X=h2(Z,"publicationGuard"),Y=h2(Z,"externalPolicy"),G=h2(Z,"failurePolicy"),z=m2(Z,"now"),Q=m2(Z,"refreshToken"),K=m2(Z,"resolveIdentity");async function W(j,x){if(await X(j)!==!0)return;let L={beforePublish:async()=>{if(await X(j)!==!0)throw new g("publication-refused")}};try{await x(L)}catch(U){if(U instanceof g&&U.code==="publication-refused"&&await X(j)!==!0)return;throw U}}async function V(j){let x=RG(j);if((x.status==="persisted"||x.status==="validation-observed")&&x.bootstrap==="resolved"){let M=x.context?.runtimeBinding;await W(x,(A)=>M&&M.identity===void 0?_x(J,x,A):Ax(J,x,A));return}if(x.status!=="failed"&&x.status!=="persisted")return;let L=rQ(x);if(L.kind==="none")return;let U=NO(G(Object.freeze({observation:x,attribution:RG(L)})));await W(x,(M)=>Fx(J,x,U,M))}let B=oD({paths:J,quota:d$,...z?{now:z}:{},...Q?{refreshToken:Q}:{},...K?{resolveIdentity:K}:{},...lD({paths:J,externalPolicy:Y,...z?{now:z}:{}}),reconcile:V});function q(j,x){return{status:"refused",reason:j instanceof Y6?j.code:"authority-unavailable",persisted:x}}async function H(j){try{await e7(J)}catch(L){return q(L,!1)}let x=await B.authorize(j);if(x.status!=="usable")return x;return e7(J).then(()=>x,(L)=>q(L,x.source==="rotated"))}return Object.freeze({authorize:H})}var TG=new WeakMap,xO=0;function CK($){if(!$)return;let Z=TG.get($);if(Z===void 0)Z=++xO,TG.set($,Z);return Z}function DO($){let Z=$.env??process.env,J=z1($.host,Z),X=T5($.host,Z),Y=$.paths;return JSON.stringify([$.host,Y.storageId,...["legacyConfig","legacyState","config","state","runtime","journal","roster"].map((G)=>U9(Y[G])),U9(J.tokenPath),U9(J.statePath),U9(X)])}function T5($,Z){return U9(Cz($==="pi"?Z.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE:void 0,$==="pi"?{...Z,OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE:void 0}:Z))}class F5{entries=new Map;acquire($,Z){let J=this.entries.get($);if(!J)J={runtime:Z(),users:0},this.entries.set($,J);let X=J;X.users++;let Y=!1;return{use:()=>{if(Y)throw new o("closed");return X.runtime},close:()=>{if(Y)return;if(Y=!0,--X.users!==0)return;if(this.entries.get($)===X)this.entries.delete($);X.runtime.close()}}}}var FG="Anthropic account update in progress; retry the request",SK=new WeakSet;class $J extends Error{constructor(){super(FG);let $={name:"NativeTransientAccountError",message:FG,code:"ECONNRESET",syscall:"native-account-update"};for(let[Z,J]of Object.entries($))Object.defineProperty(this,Z,{value:J,enumerable:Z==="code"||Z==="syscall",writable:!1,configurable:!1});SK.add(this)}}function yF($){return typeof $==="object"&&$!==null&&SK.has($)}var OO=2000;async function MO($,Z,J,X=Date.now){let Y=performance.now(),G=()=>OO-(performance.now()-Y),z=[],Q="joined",K;try{for(let V of j1($)){for(;;){if(J(),G()<=0){Q="deadline";break}let B=await T0({path:V.path,name:V.name,ttlMs:h6.ttlMs,renew:!1,now:X});if(B)z.push(B);if(G()<=0){Q="deadline";break}if(B)break;await IO(Math.min(h6.retryMs,G()),Z)}if(Q==="deadline")break}}catch(V){K={error:V}}let W;for(let V of z.reverse()){let[B]=await Promise.allSettled([V.release()]);if(B.status==="rejected")W??={error:B.reason}}if(K)throw K.error;if(W)throw W.error;return J(),Q}function IO($,Z){if(Z.some((J)=>J.aborted))return Promise.resolve();return new Promise((J)=>{let X=()=>{clearTimeout(Y);for(let G of Z)G.removeEventListener("abort",X);J()},Y=setTimeout(X,$);for(let G of Z)G.addEventListener("abort",X,{once:!0})})}function W9($,Z,J,X){return PO($)===Z?wO(AO($),J):$.replace(/(?:\.json)?$/,`.${X}.json`)}function kK($){let Z=W9($.legacyConfig,"anthropic-auth.json","anthropic-auth-vault-settings.json","vault-settings"),J=W9($.legacyState,"anthropic-auth-state.json","anthropic-auth-vault-store-state.json","vault-store"),X=W9($.legacyState,"anthropic-auth-state.json","anthropic-auth-vault-state.json","vault-native"),Y=W9($.legacyState,"anthropic-auth-state.json","anthropic-auth-vault-roster.json","vault-roster"),G=W9($.legacyState,"anthropic-auth-state.json","anthropic-auth-vault-routing-state.json","vault-routing"),z=[Z,J,X,Y,G],Q=[$.legacyConfig,$.legacyState,$.config,$.state,$.runtime,$.journal,$.roster];if(new Set([...Q,...z]).size!==Q.length+z.length)throw Error("Vault storage overlaps local account storage");return{legacySeedConfig:$.legacyConfig,config:Z,state:J,runtime:X,roster:Y,routing:G,storageId:_O("sha256").update(JSON.stringify(["anthropic-vault",Z,J])).digest("hex")}}function FO($){switch($){case"roster-incomplete":case"unenrolled-local-row":case"roster-route-conflict":case"seed-conflict":return $;default:return"seed-conflict"}}class ZJ extends Error{code;constructor($){let Z=FO($);super(`Native roster seed refused: ${Z}`);this.name="NativeRosterSeedError",this.code=Z}}function vK($){let Z={fallback:"seed-conflict"},J=(X)=>{throw Z.refused=X,new ZJ(X)};try{return $(Z,J)}catch{throw new ZJ(Z.refused??Z.fallback)}}function o6($){return typeof $==="string"&&$.trim()!==""}function gZ($,Z,J){if(typeof $!=="object"||$===null||TO.isProxy($))J(Z);return $}function yZ($,Z,J,X){let Y=Object.getOwnPropertyDescriptor($,Z);if(Y===void 0)return;if(Object.hasOwn(Y,"get")||Object.hasOwn(Y,"set"))X(J);return Y.value}function d0($,Z,J,X){let Y=gZ($,J,X),G={};for(let z of Z)G[z]=yZ(Y,z,J,X);return G}function JJ($,Z,J){let X=gZ($,Z,J);if(!Array.isArray(X))J(Z);let Y=yZ(X,"length",Z,J);if(typeof Y!=="number")J(Z);return Y}function h0($,Z,J){let X=gZ($,Z,J),Y=JJ(X,Z,J),G=[];for(let z=0;z<Y;z++)G.push(yZ(X,String(z),Z,J));return G}function fK($,Z,J){let X=gZ($,"seed-conflict",J),Y=(O,P)=>yZ(X,O,P,J);Z.fallback="roster-incomplete";let G=d0(Y("inventory","roster-incomplete"),["view","credentials","skipped"],"roster-incomplete",J),z=G.view,Q=h0(G.skipped,"roster-incomplete",J),K=h0(G.credentials,"roster-incomplete",J).map((O)=>d0(O,["credentialId","credentialType","accountIdentity","state"],"roster-incomplete",J));if(!o6(z)||Q.length>0)J("roster-incomplete");let W=new Map;for(let O of K){let{credentialId:P,credentialType:D,accountIdentity:T,state:C}=O;if(!o6(P)||!o6(T)||!o6(C)||W.has(P))J("roster-incomplete");W.set(P,{credentialType:D,accountIdentity:T,state:C})}let V=d0(Y("primary","roster-incomplete"),["credentialId","accountIdentity"],"roster-incomplete",J),B=V.credentialId,q=V.accountIdentity;Z.fallback="seed-conflict";let H=Y("primaryRouteId","seed-conflict"),j=h0(Y("legacyRows","seed-conflict"),"seed-conflict",J).map((O)=>d0(O,["routeId","scopedCredentialId","anthropicAccountUuid","label","addedAt","enabled"],"seed-conflict",J)),x=h0(Y("disabledAccountIdentities","seed-conflict"),"seed-conflict",J),L=h0(Y("reservedRouteIds","seed-conflict"),"seed-conflict",J);for(let O of[...x,...L])if(typeof O!=="string")J("seed-conflict");let U=new Set(x),M=new Set(L);function A(O,P){let D=W.get(O);if(D?.credentialType!=="oauth"||D.accountIdentity!==P)J("roster-incomplete");return D.state}if(!o6(B)||!o6(q))J("roster-incomplete");let _=A(B,q);for(let O of j)if(!o6(O.scopedCredentialId))J("unenrolled-local-row");let N=j.map((O)=>{let{scopedCredentialId:P,anthropicAccountUuid:D}=O;if(!o6(P)||!o6(D))J("roster-incomplete");return{row:O,credentialId:P,identity:D,state:A(P,D)}}),R=new Set;for(let O of[H,...j.map((P)=>P.routeId)]){if(!o6(O)||O==="main"||M.has(O)||R.has(O))J("roster-route-conflict");R.add(O)}if(!o6(H))J("roster-route-conflict");let S=new Set([B]),E=new Set([q]),m=N.map(({row:O,credentialId:P,identity:D,state:T})=>{if(S.has(P)||E.has(D))J("seed-conflict");S.add(P),E.add(D);let{routeId:C,label:k,addedAt:w,enabled:f}=O;if(!o6(C)||typeof f!=="boolean"||w!==void 0&&(typeof w!=="number"||!Number.isFinite(w))||k!==void 0&&typeof k!=="string")J("seed-conflict");return{routeId:C,credentialId:P,credentialType:"oauth",accountIdentity:D,state:T,label:o6(k)?k:C,enabled:f,addedAt:w??0}}),s=[{routeId:H,credentialId:B,credentialType:"oauth",accountIdentity:q,state:_,label:H,enabled:!U.has(q),addedAt:0},...m],c=s.filter((O)=>!O.enabled).map((O)=>({credentialId:O.credentialId,accountIdentity:O.accountIdentity,exactCredential:!0})),I=[...U].filter((O)=>!E.has(O)).sort();for(let O of I){let P=[...W].filter(([,D])=>D.accountIdentity===O).map(([D])=>D).sort()[0];if(P!==void 0)c.push({credentialId:P,accountIdentity:O,exactCredential:!1})}return{view:z,rows:s,declined:c,unseeded:new Set(I)}}function XJ($){return vK((Z,J)=>{let X=fK($,Z,J);return{version:1,view:X.view,complete:!0,rows:X.rows.map((Y)=>({...Y})),declined:X.declined.map(({credentialId:Y,accountIdentity:G})=>({credentialId:Y,accountIdentity:G}))}})}function CO($,Z){vK((J,X)=>{let Y=fK(Z,J,X);J.fallback="seed-conflict";let G=d0($,["version","complete","view","rejected","rows","declined"],"seed-conflict",X),{version:z,complete:Q,view:K,rejected:W}=G,V=h0(G.rows,"seed-conflict",X).map((L)=>d0(L,["routeId","credentialId","credentialType","accountIdentity","aliases","label","addedAt","enabled","stale","unclaimed"],"seed-conflict",X)),B=h0(G.declined,"seed-conflict",X).map((L)=>d0(L,["credentialId","accountIdentity"],"seed-conflict",X));if(z!==1||Q!==!0||typeof K!=="string"||W!==void 0&&JJ(W,"seed-conflict",X)>0||V.length!==Y.rows.length)X("seed-conflict");let q=new Map(Y.rows.map((L)=>[L.routeId,L])),H=new Set;for(let L of V){let U=typeof L.routeId==="string"?q.get(L.routeId):void 0;if(!U||H.has(U.routeId)||L.credentialId!==U.credentialId||L.credentialType!=="oauth"||L.accountIdentity!==U.accountIdentity||L.aliases!==void 0&&JJ(L.aliases,"seed-conflict",X)>0||L.label!==U.label||L.addedAt!==U.addedAt||L.enabled!==U.enabled||L.stale!==void 0||L.unclaimed!==void 0)X("seed-conflict");H.add(U.routeId)}let j=new Map(Y.declined.map((L)=>[L.accountIdentity,L])),x=new Set;for(let{credentialId:L,accountIdentity:U}of B){if(typeof L!=="string"||typeof U!=="string"||x.has(U))X("seed-conflict");let M=j.get(U);if(M?M.exactCredential&&L!==M.credentialId:!Y.unseeded.has(U))X("seed-conflict");x.add(U)}for(let L of j.keys())if(!x.has(L))X("seed-conflict")})}function EK($,Z,J){return{profile:{tier:$.tier,orgType:$.orgType,checkedAt:$.checkedAt,...$.accountIdentity!==void 0&&{accountIdentity:$.accountIdentity},...$.providerAccountUuid!==void 0&&{providerAccountUuid:$.providerAccountUuid}},persisted:Promise.resolve().then(Z).then((X)=>X?"saved":"refused",(X)=>X instanceof o||X instanceof Y6||X instanceof g&&X.code!=="runtime-io"?"refused":"failed"),isCurrent:()=>Promise.resolve().then(J).then((X)=>X,()=>!1)}}async function lF($,Z){let J={...$.env??process.env},X=T5($.host,J),Y=wK({host:$.host,readToken:$.readToken,now:$.now,env:J,connect:$.connect??(()=>T$.connect({connectionFile:X,identity:$.identity}))});try{return await Y.discover(Z)}finally{Y.close()}}function SO($){let Z=Object.freeze(kK($.paths)),J={...$.env??process.env},X=T5($.host,J),Y=$.identity?{...$.identity}:void 0,G=new AbortController,z=O0({paths:Z,quota:d$}),Q=wK({host:$.host,readToken:$.readToken,now:$.now,connect:$.connect??(()=>T$.connect({connectionFile:X,identity:Y})),env:J}),K=new WeakMap,W=new WeakSet,V=new Map,B=new Set(["main"]),q,H=new Set,j,x,L;function U(){let D=[...H].filter((C)=>C.intervalMs>0).sort((C,k)=>C.intervalMs-k.intervalMs)[0];if(L?.ms===D?.intervalMs)return;if(L)L.clear(L.handle);if(L=void 0,!D)return;let T=(D.setInterval??setInterval)(()=>{M().catch(()=>{})},D.intervalMs);T.unref?.(),L={handle:T,clear:D.clearInterval??clearInterval,ms:D.intervalMs}}function M(){if(x)return x;return x=(async()=>{let D=await Promise.all([...H].map(async(T)=>!T.shouldRefresh||await T.shouldRefresh()));if(G.signal.aborted||!D.some(Boolean))return;if(await s.refresh(G.signal),G.signal.aborted)return;for(let T of H)Promise.resolve().then(()=>{if(H.has(T))return T.onRefresh?.()}).catch(()=>{})})().finally(()=>{x=void 0}),x}function A(D){if(G.signal.aborted)throw new o("closed");D?.throwIfAborted()}function _(D){return A(D),AbortSignal.any([G.signal,...D?[D]:[]])}async function N(){A();let D=await A4($.host,J);return A(),D==="claustrum"}async function R(D){if(A(D),!await N())throw new o("route-unavailable");A(D)}async function S(D,T=!1){if(await R(D),T&&!await O4(Z.config))return;await i$(Z.roster,async(C,k)=>{if(T&&!await O4(Z.config))return{result:void 0};let w=C?.rows.find((F)=>(F.credentialId===$4||F.aliases?.includes($4))&&F.credentialType==="oauth"&&F.state==="active"&&!F.stale&&!F.unclaimed&&typeof F.accountIdentity==="string"&&F.accountIdentity.length>0),f=await z.readSettings();if(f.status!=="ready")throw new o("invalid-state");let h=GZ(f.settings);if(!T&&(!w&&!h||w&&h?.routeId===w.routeId&&h.credentialId===$4&&h.accountIdentity===w.accountIdentity))return{result:void 0};return await O0({paths:Z,quota:d$,onStep:async(F)=>{if(F==="before-config-write"||F==="before-state-write")await R(D),await k.assertOwned()}}).updateSettings(async(F)=>{if(T&&!await O4(Z.config))return F;if(w)F.mainAccountId=w.routeId,F.claustrum={primaryAccount:{credentialId:$4,accountId:w.accountIdentity}};else delete F.mainAccountId,delete F.claustrum;return F}),{result:void 0}})}async function E(D,T){let C=await z.readSettings();if(C.status!=="ready")throw new o("invalid-state");let k=GZ(C.settings);return T==="main"||T===k?.routeId?l7(D,k):D?.rows.find((w)=>w.routeId===T)}function m(D){A();let T=K.get(D);if(!T)throw new o("no-receipt");return T}let s={watch(D){if(A(),!Number.isFinite(D.intervalMs)||D.intervalMs<0)throw RangeError("Invalid native vault poll interval");let T={...D};H.add(T),U(),j??=M();let C=!1;return{ready:j,close(){if(C)return;if(C=!0,H.delete(T),U(),!H.size)j=void 0}}},initializeSettings:()=>S(void 0,!0),async read(){await R();let D=await f6(Z.roster);return A(),D},async refresh(D){if(A(D),!await N())return;return A(D),q??=AK({path:Z.roster,custody:$.discover?{discover:$.discover}:Q,signal:G.signal,isActive:N,projection:()=>({reservedRouteIds:B})}).then(async(T)=>{return await S(G.signal),T}).finally(()=>{q=void 0}),vO(q,_(D))},async authorize(D,T){let C=_(T);await R(C);let k=await f6(Z.roster)??await s.refresh(C),w=await E(k,D);if(w?.credentialType!=="oauth"||!w.accountIdentity)throw new o("route-unavailable");if(!w.enabled)throw new o("route-declined");if(w.state!=="active")throw new o("not-active");let f=await Q.authorize({credentialId:w.credentialId,accountIdentity:w.accountIdentity},C);await R(C);let h=await E(await f6(Z.roster),D);if(!h?.enabled||h.routeId!==w.routeId||h.accountIdentity!==w.accountIdentity||h.credentialId!==f.credentialId&&!h.aliases?.includes(f.credentialId))throw new o("identity-changed");if(h.state!=="active")throw new o("not-active");A(C),K.set(f,{routeId:w.routeId,logicalId:D});let v=JSON.stringify([w.routeId,f.credentialId,f.assertedAccountIdentity]);return V.set(v,Math.max(V.get(v)??0,f.recordVersion)),f},async reportFailure(D,T,C){m(D),await Q.reportFailure(D,T,C)},async prepareRetry(D,T,C){let k=m(D),w=async()=>{if(W.has(D))return[{retry:!1,reason:"version-not-newer"},void 0];W.add(D);let v;try{v=await s.authorize(k.logicalId,T)}catch(F){return A(T),[{retry:!1,reason:"reauthorize-failed",code:F instanceof o?F.code:"unavailable"},void 0]}if(v.credentialId!==D.credentialId)return[{retry:!1,reason:"credential-changed"},v];if(v.assertedAccountIdentity!==D.assertedAccountIdentity)return[{retry:!1,reason:"account-changed"},v];if(!(v.recordVersion>D.recordVersion))return[{retry:!1,reason:"version-not-newer"},v];return W.add(v),[{retry:!0,receipt:v},v]},[f,h]=await w();if(C)a.debug("claustrum","scoped 401 re-authorized",{site:C,credentialId:D.credentialId,servedVersion:D.recordVersion,currentVersion:h?.recordVersion??null,retry:f.retry,reason:f.retry?"rotated":f.reason});return f},publish(D,T){let C=eQ(T);return I(D,(k)=>$K(k,C),kO(C)?"skip":"refuse")},resetBackoff(D,T="all"){return I(D,(C)=>{let k=Math.max($.now?.()??Date.now(),C.refreshErrorClearedAt??0,C.quotaErrorClearedAt??0,C.lastRefreshError?.checkedAt??0,C.lastQuotaRefreshError?.checkedAt??0),w={...C};if(T!=="quota")delete w.lastRefreshError,w.refreshErrorClearedAt=k;if(T!=="refresh")delete w.lastQuotaRefreshError,w.quotaErrorClearedAt=k,w.quotaErrorGeneration=(C.quotaErrorGeneration??0)+1;return w})},async getOrCreateAuthLineage(D){let T;return await I(D,(k)=>{return T=k.authLineageId??RO(),{...k,authLineageId:T}})?T:void 0},incrementPrimeUsage(D,T={}){let C=T.inputTokens??0,k=T.outputTokens??0;if(![C,k].every((w)=>Number.isSafeInteger(w)&&w>=0))throw new g("publication-refused");return I(D,(w)=>({...w,prime:{count:(w.prime?.count??0)+1,inputTokens:(w.prime?.inputTokens??0)+C,outputTokens:(w.prime?.outputTokens??0)+k,since:w.prime?.since??$.now?.()??Date.now()}}))},async fetchQuota(D,T=fetch,C,k){let w=await E(await s.read(),D),f=await c$(Z.runtime,Z.storageId),h=f.status==="ready"?f.state.accounts[w?.routeId??""]:void 0,v=(u)=>{let l=K.get(u),t=h?.binding;return l&&t?.kind==="custody"&&t.storageId===Z.storageId&&t.routeId===l.routeId&&t.credentialId===u.credentialId&&t.accountIdentity===u.assertedAccountIdentity&&t.recordVersion<=u.recordVersion?h:void 0},F=await O(D,T,C,(u,l)=>b4({accessToken:u.accessToken,fetchImpl:l,now:$.now}),async(u,l)=>{let t=v(l),W6=ZK(u,l.assertedAccountIdentity,Math.max($.now?.()??Date.now(),(t?.quotaErrorClearedAt??-1)+1),t?.lastQuotaRefreshError);if(W6)await s.publish(l,{lastQuotaRefreshError:W6})},k),b={...F.value,accountIdentity:F.receipt.assertedAccountIdentity},y=v(F.receipt);return await s.publish(F.receipt,{quota:b,quotaErrorClearedAt:Math.max(b.checkedAt??$.now?.()??Date.now(),y?.quotaErrorClearedAt??0,y?.lastQuotaRefreshError?.checkedAt??0)}),b},async fetchProfile(D,T=fetch,C){let k=await P(D,T,C);return await s.publish(k.receipt,{profile:k.value}),k.value},async fetchProfileForDisplay(D,T=fetch,C){let k=await P(D,T,C);return EK(k.value,()=>s.publish(k.receipt,{profile:k.value}),c(k.receipt))},async setEnabled(D,T){await R();let C=await f6(Z.roster),k=await E(C,D);if(!k)throw new o("route-unavailable");return i$(Z.roster,(w)=>{let f=w?.rows.find((h)=>h.routeId===k.routeId);if(!w||!f)throw new e("route-unavailable","Claustrum route is not in the roster");return{next:{...w,declined:T?PK(w.declined,[f.credentialId,...f.aliases??[]],f.accountIdentity):_K(w.declined,f.credentialId,f.accountIdentity),rows:w.rows.map((h)=>h===f?{...h,enabled:T}:h)},result:f.enabled!==T}})},close(){if(H.clear(),U(),G.signal.aborted)return;G.abort(new o("closed")),Q.close()}};function c(D){let{routeId:T,logicalId:C}=m(D),k={routeId:T,logicalId:C,credentialId:D.credentialId,accountIdentity:D.assertedAccountIdentity,recordVersion:D.recordVersion},w=JSON.stringify([T,k.credentialId,k.accountIdentity]);return async()=>{await R();let f=await E(await f6(Z.roster),k.logicalId);if(!f?.enabled||f.state!=="active"||f.routeId!==k.routeId||f.accountIdentity!==k.accountIdentity||f.credentialId!==k.credentialId&&!f.aliases?.includes(k.credentialId)||(V.get(w)??0)>k.recordVersion)return!1;let h=await c$(Z.runtime,Z.storageId);if(h.status==="missing")return!0;if(h.status!=="ready")return!1;let v=h.state.accounts[k.routeId]?.binding;return!v||v.kind==="custody"&&v.accountIdentity===k.accountIdentity&&v.credentialId===k.credentialId&&v.recordVersion<=k.recordVersion}}async function I(D,T,C="refuse"){let k=m(D);await R();let w=JSON.stringify([k.routeId,D.credentialId,D.assertedAccountIdentity]);if((V.get(w)??0)>D.recordVersion)return!1;return i$(Z.roster,async(f,h)=>{let v=await E(f,k.logicalId);if(!v?.accountIdentity||v.routeId!==k.routeId||v.accountIdentity!==D.assertedAccountIdentity||v.credentialId!==D.credentialId&&!v.aliases?.includes(D.credentialId))return{result:!1};let F=v.accountIdentity,b=!1;try{if((await Ox(Z.runtime,Z.storageId,(u)=>{let l=u.accounts[k.routeId],t=l?.binding;if(t?.kind==="custody"&&t.credentialId===D.credentialId&&t.accountIdentity===D.assertedAccountIdentity&&t.recordVersion>D.recordVersion)throw new g("runtime-conflict");let W6=t?.kind==="custody"&&t.accountIdentity===D.assertedAccountIdentity;return u.accounts[k.routeId]=T({...W6?l:{},binding:{kind:"custody",storageId:Z.storageId,routeId:k.routeId,credentialId:D.credentialId,accountIdentity:F,recordVersion:D.recordVersion}}),b=!0,u},{beforeRename:async()=>{await R();let u=await E(f,k.logicalId);if(!u||u.routeId!==k.routeId||u.accountIdentity!==D.assertedAccountIdentity)throw new g("publication-refused");let l=(V.get(w)??0)>D.recordVersion;if(l&&C==="refuse")throw new g("runtime-conflict");return await h.assertOwned(),l?"skip":"publish"}})).status==="skipped")return{result:!1}}catch(y){if(y instanceof g&&y.code==="runtime-conflict")return{result:!1};throw y}return{result:b}})}async function O(D,T,C,k,w,f){let h=_(C),v=await s.authorize(D,h),F=(l,t)=>{let W6=()=>T(l,{...t,signal:h});if(!f)return W6();return f(W6,async()=>{await R(h);let B6=m(v),i6=await E(await f6(Z.roster),B6.logicalId),a8=JSON.stringify([B6.routeId,v.credentialId,v.assertedAccountIdentity]);if(!i6?.enabled||i6.state!=="active"||i6.routeId!==B6.routeId||i6.accountIdentity!==v.assertedAccountIdentity||i6.credentialId!==v.credentialId&&!i6.aliases?.includes(v.credentialId)||(V.get(a8)??v.recordVersion)>v.recordVersion)throw new o("identity-changed");await R(h)})},b,y=Object.assign(async(l,t)=>{b=void 0;let W6=await F(l,t);if(b=W6.status,W6.status===401&&!h.aborted){await W6.body?.cancel().catch(()=>{});let B6=(hZ)=>s.reportFailure(hZ,401,"direct").catch(()=>{A(h)}),i6=v,a8;try{a8=await s.prepareRetry(i6,h,"quota-profile")}catch(hZ){throw await B6(i6),hZ}if(!a8.retry)return await B6(i6),W6;v=a8.receipt;let f5=new Headers(t?.headers);if(f5.set("authorization",`Bearer ${v.accessToken}`),b=void 0,W6=await F(l,{...t,headers:f5}),b=W6.status,W6.status===401)await B6(v)}return W6},{preconnect:T.preconnect}),u;try{u=await k(v,y)}catch(l){A(h);let t=l instanceof o||l instanceof g?l:XK(l,b);throw await w?.(t,v),t}return A(h),{value:u,receipt:v}}function P(D,T,C){return O(D,T,C,(k,w)=>t3({accessToken:k.accessToken,accountIdentity:k.assertedAccountIdentity,fetchImpl:w,now:$.now,signal:C}))}return s}function kO($){let Z=Object.keys($);return Z.length===1&&Z[0]==="lastUsed"&&typeof $.lastUsed==="number"}function vO($,Z){return new Promise((J,X)=>{let Y=()=>{G(),X(Z.reason)},G=()=>Z.removeEventListener("abort",Y);if(Z.addEventListener("abort",Y,{once:!0}),$.then((z)=>{G(),Z.aborted?X(Z.reason):J(z)},(z)=>{G(),X(z)}),Z.aborted)Y()})}var fO=new F5;function bK($){return JSON.stringify([DO($),$.identity?Object.entries($.identity).sort(([Z],[J])=>Z.localeCompare(J)):void 0,...[$.connect,$.discover,$.readToken,$.now].map(CK)])}function EO($){let{use:Z,close:J}=fO.acquire(bK($),()=>SO($));return gK(Z,J)}function gK($,Z){let J=new Set;return{watch:(X)=>{let Y=$().watch(X);return J.add(Y),{ready:Y.ready,close(){J.delete(Y),Y.close()}}},initializeSettings:()=>$().initializeSettings(),read:()=>$().read(),refresh:(X)=>$().refresh(X),authorize:(X,Y)=>$().authorize(X,Y),reportFailure:(X,Y,G)=>$().reportFailure(X,Y,G),prepareRetry:(X,Y,G)=>$().prepareRetry(X,Y,G),publish:(X,Y)=>$().publish(X,Y),fetchQuota:(X,Y,G,z)=>$().fetchQuota(X,Y,G,z),fetchProfile:(X,Y,G)=>$().fetchProfile(X,Y,G),fetchProfileForDisplay:(X,Y,G)=>$().fetchProfileForDisplay(X,Y,G),setEnabled:(X,Y)=>$().setEnabled(X,Y),resetBackoff:(X,Y)=>$().resetBackoff(X,Y),getOrCreateAuthLineage:(X)=>$().getOrCreateAuthLineage(X),incrementPrimeUsage:(X,Y)=>$().incrementPrimeUsage(X,Y),close(){for(let X of J)X.close();J.clear(),Z()}}}var mK="main",lO=900000,SG=604800000,dO=3600000,iO=1e4,sO=5000,tO=10,kG=4096,aO=0.000001;function tF($){let Z=$.modelId,J=Z?$.routeQuotas.map((q)=>r$(q,Z)).find(Boolean)?.modelName:void 0,X;if(v4($.mainRefreshError))X=J?`Main Claude OAuth account requires re-login, and no fallback OAuth account is currently routable for ${J}.`:"Main Claude OAuth account requires re-login, and no fallback OAuth account is currently routable.";else if($.fallbackReauthLabels?.length)X=`No OAuth account is currently routable${J?` for ${J}`:""}. Fallback Claude OAuth accounts require re-login: ${$.fallbackReauthLabels.join(", ")}.`;if(X)return new Response(JSON.stringify({type:"error",error:{type:"authentication_error",message:X}}),{status:401,headers:{"content-type":"application/json"}});let Y=Boolean(Z&&$.routeQuotas.length>0&&$.routeQuotas.every((q)=>!tz(q,Z))),[G,...z]=$.routeQuotas,Q=uB(G,z.map((q)=>({quota:q})),$.now??Date.now(),Y?Z:void 0),K=Math.floor(Q/60),W=Q%60,B=`${Y&&J?`${J} weekly limit reached, no routable OAuth accounts.`:"No OAuth account currently satisfies sticky-balanced quota policy."} Retry in ${K}m ${W}s.`;return new Response(JSON.stringify({type:"error",error:{type:"rate_limit_error",message:B}}),{status:429,headers:{"content-type":"application/json","retry-after":String(Q)}})}function I0($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function x9($){return typeof $==="number"&&Number.isFinite($)?$:void 0}function uK($){if(!I0($))return;if(typeof $.accountId!=="string"||!["fable","opus","general"].includes(String($.family)))return;let Z=x9($.assignedAt),J=x9($.lastSeenAt),X=x9($.initialInputBytes),Y=x9($.quotaCheckedAt);if(Z===void 0||J===void 0||X===void 0||Y===void 0)return;if(Object.hasOwn($,"affinityModelId")&&typeof $.affinityModelId!=="string")return;if(Object.hasOwn($,"accountIdentity")&&(typeof $.accountIdentity!=="string"||$.accountIdentity.length===0||$.accountIdentity.trim()!==$.accountIdentity))return;return{accountId:$.accountId,...typeof $.accountIdentity==="string"?{accountIdentity:$.accountIdentity}:{},family:$.family,affinityModelId:typeof $.affinityModelId==="string"?$.affinityModelId:void 0,assignedAt:Z,lastSeenAt:J,initialInputBytes:Math.max(0,X),quotaCheckedAt:Y}}function YJ($){if(!I0($)||$.version!==1||!I0($.assignments))return;let Z={};for(let[J,X]of Object.entries($.assignments)){let Y=uK(X);if(Y)Z[J]=Y}return{version:1,updatedAt:x9($.updatedAt)??0,assignments:Z,...$.vaultLegacySeed==="pending"||$.vaultLegacySeed==="complete"?{vaultLegacySeed:$.vaultLegacySeed}:{}}}function nO($,Z){try{if(!I0($)||!I0($.assignments))throw Error();let J=Object.entries($.assignments),X=YJ({...$,assignments:Object.fromEntries(J.map(([,G],z)=>[String(z),G]))});if(!X||Object.keys($).length!==3||!Object.hasOwn($,"version")||!Object.hasOwn($,"updatedAt")||!Object.hasOwn($,"assignments")||!Object.is($.updatedAt,X.updatedAt))throw Error();for(let G of Z.values())if(typeof G!=="string"||G.length===0||G.trim()!==G)throw Error();let Y=Object.create(null);for(let[G,[z,Q]]of J.entries()){let K=X.assignments[String(G)];if(!I0(Q)||!K)throw Error();let W=Object.keys(K).filter((B)=>B!=="affinityModelId"||Object.hasOwn(Q,"affinityModelId"));if(Object.keys(Q).length!==W.length||W.some((B)=>!Object.hasOwn(Q,B)||!Object.is(Q[B],Reflect.get(K,B))))throw Error();let V=Z.get(K.accountId);if(V===void 0)continue;Y[z]={...K,accountId:V}}return`${JSON.stringify({...X,assignments:Y},null,2)}
-`}catch{throw Error("invalid-source")}}function vG($){return{version:1,updatedAt:$,assignments:{}}}function fG($){return yK("sha256").update($).digest("hex")}function pK($,Z,J=Date.now(),X){let Y=I9(Z);if(!["five_hour","seven_day"].every((Q)=>{let K=$?.[Q];return Boolean(K&&J-K.checkedAt<Y)}))return!1;let z=r$($,X);return!z||J-z.checkedAt<Y}function EG($){return Math.max($.checkedAt??0,$.five_hour?.checkedAt??0,$.seven_day?.checkedAt??0,...($.scoped??[]).map((Z)=>Z.checkedAt??0))}function S8($){if(!$)return;if("kind"in $)return $.kind==="known"?$.quota:void 0;return $}function bG($,Z,J){let X=wJ($),Y=J==="five_hour"?X.five_hour:J==="seven_day"?X.seven_day:0;if(!az($))return Y;let G=nz($,Z===mK?void 0:Z);return Math.max(Y,G[J])}function gG($,Z,J,X){let Y=Math.max(0,$-Z);if(Y<=0)return 0;if(!J)return Y;let G=Date.parse(J);if(!Number.isFinite(G)||G<=X)return Y;let z=Math.max((G-X)/3600000,0.016666666666666666);return Y/z}function aF($){if(JN($))return"fable";return typeof $==="string"&&$.toLowerCase().includes("opus")?"opus":"general"}function yG($){let Z=$.now??Date.now(),{candidate:J,storage:X}=$,Y=S8(J.quota);if(!Y)return 0;if(!pK(Y,X,Z,$.modelId))return 0;let G=[];for(let z of["five_hour","seven_day"]){let Q=Y[z];if(!Q||!Number.isFinite(Q.remainingPercent))return 0;G.push(gG(Q.remainingPercent,bG(X,J.accountId,z),Q.resetsAt,Z))}if($.family==="fable"){let z=r$(Y,$.modelId);if(z&&Number.isFinite(z.remainingPercent))G.push(gG(z.remainingPercent,bG(X,J.accountId,"scoped"),z.resetsAt,Z))}return Math.min(...G)}function oO($,Z,J=Date.now()){let X=S8($.quota),Y=r$(X,"claude-fable-5");return Boolean(Y&&pK(X,Z,J,"claude-fable-5")&&Number.isFinite(Y.remainingPercent)&&Y.remainingPercent<=0)}function nF($){let Z=$.now??Date.now(),J=S8($.quota);if(!J)return{action:"retain",reason:"unknown"};let X=r$(J,$.modelId);if(X&&Number.isFinite(X.remainingPercent)&&X.remainingPercent<=0)return{action:"migrate",reason:"model-scoped"};let Y=J.seven_day;if(Y&&Number.isFinite(Y.remainingPercent)&&Y.remainingPercent<=0)return{action:"migrate",reason:"seven-day"};let G=J.five_hour;if(G&&Number.isFinite(G.remainingPercent)&&G.remainingPercent<=0){let z=G.resetsAt?Date.parse(G.resetsAt):NaN;if(Number.isFinite(z)&&z>Z&&z-Z<=lO)return{action:"hold",reason:"five-hour-short-reset",retryAfterSeconds:Math.max(1,Math.ceil((z-Z)/1000))};return{action:"migrate",reason:"five-hour"}}return{action:"retain",reason:"not-exhausted"}}function rO($){let Z=pO($),J=Z.endsWith(".json")?Z.slice(0,-5):Z;return cO(hK($),`${J}-routing-state.json`)}function oF($,Z){let J=yK("sha256").update($).digest().readUInt32BE(0);return Math.max(1,Math.ceil(Z))+J%21}var hG=new Map;class cK{options;loaded=!1;state;stateMtimeNs;touchChain=Promise.resolve();seedFinalized=!1;constructor($){this.options=$,this.state=vG(this.now())}now(){return this.options.now?.()??Date.now()}async readState(){try{let $=await CG(this.options.path,"utf8"),Z=YJ(JSON.parse($));if(!Z)throw Error(`Invalid sticky routing state at ${this.options.path}`);return Z}catch($){if($.code==="ENOENT")return{...vG(this.now()),...this.options.vaultSeed?{vaultLegacySeed:"pending"}:{}};throw $}}async readStateMtimeNs(){try{return(await mO(this.options.path,{bigint:!0})).mtimeNs}catch($){if($.code==="ENOENT")return 0n;throw $}}async refreshStateIfChanged(){for(let $=0;$<3;$++){let Z=await this.readStateMtimeNs();if(this.loaded&&Z===this.stateMtimeNs)return;let J=await this.readState(),X=await this.readStateMtimeNs();if(Z!==X)continue;this.state=J,this.stateMtimeNs=X,this.loaded=!0;return}this.state=await this.readState(),this.stateMtimeNs=await this.readStateMtimeNs(),this.loaded=!0}async acquireLock($=!0){await gO(hK(this.options.path),{recursive:!0,mode:448});let Z=this.now()+sO;while(!0){let J=await g9({name:"write",path:this.options.path,ttlMs:iO,renew:!0});if(J)return J;if(!$||this.now()>=Z)throw Error("Timed out acquiring sticky routing state lock");await new Promise((X)=>setTimeout(X,tO))}}async recoverLocalPins(){let $=this.options.localRecoveryPath;if(!$||$===this.options.path)return;let Z=JSON.stringify([this.options.path,$]),J=hG.get(Z);if(!J)J=this.fillLocalPins($).catch(()=>{a.warn("sticky-routing","local pin recovery unavailable",{reason:"recovery-failed"})}),hG.set(Z,J);await J}async fillLocalPins($){let Z=await this.acquireLock(!1);try{let J;try{J=YJ(JSON.parse(await CG($,"utf8")))}catch(G){if(G.code==="ENOENT")return;throw G}if(!J)return;let X=await this.readState(),Y=!1;for(let[G,z]of Object.entries(J.assignments)){if(!/^[0-9a-f]{64}$/.test(G)||Object.hasOwn(X.assignments,G))continue;X.assignments[G]=z,Y=!0}if(Y)await this.writeState(X,()=>Z.assertOwned(),!1)}finally{await Z.release()}}assignmentIsActive($){return $.lastSeenAt>=this.now()-(this.options.assignmentTtlMs??SG)}prune($){let Z=this.now()-(this.options.assignmentTtlMs??SG);for(let[X,Y]of Object.entries($.assignments))if(Y.lastSeenAt<Z)delete $.assignments[X];let J=Object.entries($.assignments);if(J.length<=kG)return;J.sort((X,Y)=>Y[1].lastSeenAt-X[1].lastSeenAt).slice(kG).forEach(([X])=>{delete $.assignments[X]})}async writeState($,Z,J=!0){if(J)this.prune($);$.updatedAt=this.now();let X=`${this.options.path}.${bO()}.tmp`;try{await uO(X,`${JSON.stringify($)}
-`,{mode:384}),await Z(),await yO(X,this.options.path)}finally{await hO(X,{force:!0}).catch(()=>{})}this.state=$,this.stateMtimeNs=await this.readStateMtimeNs(),this.loaded=!0}async writeResolutionState($,Z,J){let X=!1;try{await this.writeState($,async()=>{try{await Z()}catch(Y){throw X=!0,Y}})}catch(Y){if(!X)throw Y;a.warn("sticky-routing","assignment write refused",{operation:J,reason:"ownership-lost"})}}async prepareLegacySeed($){let Z=this.options.vaultSeed;if(!Z||this.seedFinalized)return;try{await this.refreshStateIfChanged()}catch{this.seedFinalized=!0;return}if(this.state.vaultLegacySeed!=="pending"){this.seedFinalized=!0;return}let J=$===void 0?await f6(Z.roster):$;if(!J?.complete)return;let X=await this.acquireLock();try{let Y=await this.readState();if(Y.vaultLegacySeed!=="pending"){this.seedFinalized=!0;return}let G=await m7(Z.legacyConfig),z=Bx(G,J),Q=await m7(rO(Z.legacyConfig));if(I0(Q)&&Q.version===1&&I0(Q.assignments))for(let[K,W]of Object.entries(Q.assignments)){if(!/^[0-9a-f]{64}$/.test(K)||Object.hasOwn(Y.assignments,K))continue;let V=uK(W),B=V&&z.get(V.accountId);if(V&&B)Y.assignments[K]={...V,accountId:B.routeId,accountIdentity:B.accountIdentity}}Y.vaultLegacySeed="complete",await this.writeState(Y,()=>X.assertOwned(),!1),this.seedFinalized=!0}finally{await X.release()}}logicalAccountId($){return $.accountId===this.options.vaultSeed?.mainRouteId?mK:$.accountId}setVaultSeed($){this.options.vaultSeed=$}scheduleTouch($){this.touchChain=this.touchChain.catch(()=>{}).then(async()=>{let Z=await this.acquireLock();try{let J=await this.readState(),X=J.assignments[$];if(!X)return;X.lastSeenAt=this.now(),await this.writeState(J,()=>Z.assertOwned())}finally{await Z.release()}}).catch(()=>{})}selectCandidate($){let Z=[...$.candidates];if($.family==="opus"){let Y=Z.filter((G)=>oO(G,$.storage,this.now()));if(Y.length>0)Z=Y}let J=Z.flatMap((Y)=>{let G=yG({candidate:Y,family:$.family,modelId:$.modelId,storage:$.storage,now:this.now()});return G>0?[{candidate:Y,weight:G}]:[]});if(J.length===0&&Z.every((Y)=>!S8(Y.quota)))return[...Z].sort((Y,G)=>Y.order-G.order||Y.accountId.localeCompare(G.accountId))[0];let X=new Map;for(let Y of Object.values($.state.assignments)){let G=J.find((Q)=>Q.candidate.accountId===this.logicalAccountId(Y))?.candidate;if(!G)continue;let z=S8(G.quota);if(z&&Y.quotaCheckedAt!==EG(z))continue;X.set(this.logicalAccountId(Y),(X.get(this.logicalAccountId(Y))??0)+Y.initialInputBytes)}return J.map(({candidate:Y,weight:G})=>({candidate:Y,score:((X.get(Y.accountId)??0)+$.inputBytes)/Math.max(G,aO)})).sort((Y,G)=>Y.score-G.score||Y.candidate.order-G.candidate.order||Y.candidate.accountId.localeCompare(G.candidate.accountId))[0]?.candidate}async resolve($){if(!$.sessionId)return null;await this.recoverLocalPins(),await this.prepareLegacySeed(),await this.refreshStateIfChanged();let Z=fG($.sessionId),J=$.affinityModelId??$.modelId,X=(K)=>J!==void 0?K.affinityModelId===J:K.family===$.family,Y=(K)=>{let W=$.accountIdentities?.get(K);return typeof W==="string"&&W.length>0&&W.trim()===W?W:void 0},G=(K)=>{if(!$.accountIdentities)return!0;let W=Y(this.logicalAccountId(K));return W!==void 0&&K.accountIdentity===W},z=this.state.assignments[Z];if(z&&this.assignmentIsActive(z)&&X(z)&&G(z)&&$.retainAccountIds.has(this.logicalAccountId(z))&&!$.excludeAccountIds?.has(this.logicalAccountId(z))){if(this.now()-z.lastSeenAt>=dO)z.lastSeenAt=this.now(),this.scheduleTouch(Z);return{accountId:this.logicalAccountId(z),assignment:{...z},created:!1,migrated:!1}}let Q=await this.acquireLock();try{let K=await this.readState();this.prune(K);let W=K.assignments[Z];if(W&&X(W)&&G(W)&&$.retainAccountIds.has(this.logicalAccountId(W))&&!$.excludeAccountIds?.has(this.logicalAccountId(W)))return W.lastSeenAt=this.now(),await this.writeResolutionState(K,()=>Q.assertOwned(),"touch"),{accountId:this.logicalAccountId(W),assignment:{...W},created:!1,migrated:!1};let V=Boolean(W&&!X(W)),B=Boolean(W&&!G(W));if(V||B)delete K.assignments[Z];let q=$.candidates.filter((M)=>!$.excludeAccountIds?.has(M.accountId)&&(!$.accountIdentities||Y(M.accountId)!==void 0)),j=(!V&&!B&&$.preferredAccountId?q.find((M)=>M.accountId===$.preferredAccountId&&yG({candidate:M,family:$.family,modelId:$.modelId,storage:$.storage,now:this.now()})>0):void 0)??this.selectCandidate({...$,candidates:q,state:K});if(!j){if(W)delete K.assignments[Z],await this.writeResolutionState(K,()=>Q.assertOwned(),"delete");return null}let x=this.now(),L=S8(j.quota),U={accountId:j.accountId,...$.accountIdentities?{accountIdentity:Y(j.accountId)}:{},family:$.family,affinityModelId:J,assignedAt:x,lastSeenAt:x,initialInputBytes:Math.max(1,$.inputBytes),quotaCheckedAt:L?EG(L):0};return K.assignments[Z]=U,await this.writeResolutionState(K,()=>Q.assertOwned(),"assign"),{accountId:j.accountId,assignment:{...U},created:!W,migrated:Boolean(W&&(B||W.accountId!==j.accountId))}}finally{await Q.release()}}async clear($){if(!$)return;await this.recoverLocalPins();let Z=fG($),J=await this.acquireLock();try{let X=await this.readState();if(!(Z in X.assignments))return;delete X.assignments[Z],await this.writeState(X,()=>J.assertOwned())}finally{await J.release()}}}var eO=new F5;function rF($){let Z=JSON.stringify([bK({...$.vault,paths:$.paths,host:$.host}),...[$.beforePoolWrite,$.local?.refreshToken,$.local?.resolveIdentity,$.local?.failurePolicy,$.local?.now].map(CK)]),{use:J,close:X}=eO.acquire(Z,()=>$M($)),Y=gK(()=>J().vault,X);return{vault:Y,getRelayConfig:()=>J().getRelayConfig(),updateRelay:(G)=>J().updateRelay(G),read:()=>J().read(),authorizeLocal:(G,z)=>J().authorizeLocal(G,z),authorizeApi:(G,z)=>J().authorizeApi(G,z),authorizeVault:(G,z)=>J().authorizeVault(G,z),loginOAuth:(G)=>J().loginOAuth(G),putAccount:(G)=>J().putAccount(G),addApi:(G)=>J().addApi(G),updateSettings:(G)=>J().updateSettings(G),setLoggingLevel:(G)=>J().setLoggingLevel(G),setEnabled:(G,z)=>J().setEnabled(G,z),remove:(G)=>J().remove(G),reorder:(G,z)=>J().reorder(G,z),captureLocalSubject:(G)=>J().captureLocalSubject(G),publishLocal:(G,z)=>J().publishLocal(G,z),publishApi:(G,z)=>J().publishApi(G,z),resetBackoff:(G,z,Q)=>J().resetBackoff(G,z,Q),getOrCreateAuthLineage:(G,z)=>J().getOrCreateAuthLineage(G,z),incrementPrimeUsage:(G,z,Q)=>J().incrementPrimeUsage(G,z,Q),fetchQuota:(G,z,Q,K)=>J().fetchQuota(G,z,Q,K),fetchProfile:(G,z,Q)=>J().fetchProfile(G,z,Q),fetchProfileForDisplay:(G,z,Q)=>J().fetchProfileForDisplay(G,z,Q),close:()=>Y.close()}}function eF($,Z,J){if(!$.enabled)return{status:"blocked",reason:"account-disabled"};if(!mB($.quota,Z.policyStorage)||!tz($.quota,J)||!oz($.quota,Z.policyStorage,$.id==="main"?void 0:$.id,J))return{status:"blocked",reason:"quota-ineligible"};return{status:"allowed"}}function $M($){let Z=Object.freeze({...$.paths}),J=$.local?.now??$.vault?.now??Date.now,X={...$.vault?.env??process.env},Y=kK(Z),G={legacyConfig:Z.legacyConfig,roster:Y.roster},z=new cK({path:Y.routing,vaultSeed:G,now:J}),Q,K=O0({paths:Y,quota:d$,now:J,onStep:async(I)=>{if(I==="before-config-write"||I==="before-state-write")await x("claustrum")}}),W=new AbortController,V=O0({paths:Z,quota:d$,now:J,onStep:async(I)=>{if(I==="before-config-write"||I==="before-state-write"){if($.beforePoolWrite)await L(),await $.beforePoolWrite();await L()}}}),B=EO({...$.vault,paths:Z,host:$.host});function q(I){if(W.signal.aborted)throw new o("closed");I?.throwIfAborted()}let H;async function j(I){q(I);let O=await A4($.host,X);if(O==="local")H=(await e7(Z)).routingPaths,O=await A4($.host,X);return q(I),O}async function x(I,O){if(await j(O)!==I)throw new o("route-unavailable")}async function L(I){await x("local",I)}async function U(){let I=await j();return{mode:I,paths:I==="claustrum"?Y:Z,store:I==="claustrum"?K:V}}async function M(I){let O=await V.read();if(O.status!=="ready")throw new g("publication-refused");return O.rows.find((P)=>P.id===I)}async function A(I){if(I!=="main")return I;let O=await V.readSettings();if(O.status!=="ready"||typeof O.settings.mainAccountId!=="string")throw new o("route-unavailable");return O.settings.mainAccountId}async function _(I,O,P=!0){if(await j()!=="local")return!1;let D=I.binding,T=async()=>{let w=await M(D.rowId);if(!w||!x$(D,Z,w)||w.stamp!=="bound"||!w.credential)return!1;if(P==="binding")return w.credential.type===("kind"in I?"api":"oauth");if("kind"in I)return w.credential.type==="api"&&I6(w.credential)===I.credentialFingerprint&&w.credential.baseURL===I.baseURL&&w.credential.authHeader===I.authHeader;if(w.credential.type!=="oauth"||I6(w.credential)!==I.credentialFingerprint)return!1;return!P||c0(I,D,w.credential)},[C,k]=j1(Z);try{return await d6(C.path,{...h6,name:C.name},async(w)=>d6(k.path,{...h6,name:k.name},async(f)=>{if(!await T())return!1;return await p7(Z.runtime,Z.storageId,(h)=>{let v=h.accounts[D.rowId],F=v?.binding,b=F?.kind==="local"&&F.rowId===D.rowId&&F.identity===D.identity&&F.credentialEpoch===D.credentialEpoch;return h.accounts[D.rowId]=O(b&&v?v:{binding:D},v),h},{beforeRename:async()=>{if(!await T())throw new g("publication-refused");await w.assertOwned(),await f.assertOwned(),await L()},beforePublish:()=>L()}),!0}))}catch(w){if(w instanceof g&&w.code==="runtime-conflict"||w instanceof o&&w.code==="route-unavailable")return!1;throw w}}async function N(I){let O=await M(I);if(!O?.credential||O.credentialEpoch===void 0)throw new g("publication-refused");let P={kind:"local",storageId:Z.storageId,rowId:O.id,credentialEpoch:O.credentialEpoch,...O.identity!==void 0?{identity:O.identity}:{}},D=O.credential.type==="api"?{kind:"api",binding:P,credentialFingerprint:I6(O.credential),baseURL:O.credential.baseURL,authHeader:O.credential.authHeader}:{binding:P,credentialFingerprint:I6(O.credential),version:{}};if(!await _(D,(C,k)=>{let w=k?.binding;if(w?.kind==="local"&&w.credentialEpoch===P.credentialEpoch&&w.identity===P.identity)return C;let f=w?.kind==="local"&&w.rowId===P.rowId&&P.identity!==void 0&&w.identity===P.identity,h={binding:P,...O.credential?.type==="oauth"?{authLineageId:n1()}:{}};if(f&&k){for(let v of["prime","profile","lastUsed","lastQuotaRefreshError","quotaErrorClearedAt","quotaErrorGeneration"])if(k[v]!==void 0)Object.assign(h,{[v]:k[v]})}return h},"binding"))throw new g("publication-refused")}async function R(){let I=await j();if(I==="claustrum")Q??=B.initializeSettings().catch((f)=>{throw Q=void 0,f}),await Q;let O=I==="claustrum"?Y:Z,P=I==="claustrum"?K:V,[D,T,C]=await Promise.all([P.read(),P.readSettings(),c$(O.runtime,O.storageId)]);if(D.status!=="ready"||T.status!=="ready")throw new g("publication-refused");let k=I==="claustrum"?await B.read():void 0;q();let w=kx({paths:{...Z,...O},rows:D.rows,settings:{...T.settings,claustrum:{...T.settings.claustrum,mode:I}},runtime:C.status==="ready"?C.state:void 0,roster:k});if(I==="claustrum")G.mainRouteId=typeof T.settings.mainAccountId==="string"?T.settings.mainAccountId:void 0,await z.prepareLegacySeed(k??null),w.routingPath=Y.routing,w.routingSeed={...G};else if(H){if(w.routingPath=H.destination,H.source!==H.destination)w.routingRecoveryPath=H.source}return{snapshot:w,rows:D.rows,settings:T.settings,runtime:C.status==="ready"?C.state:void 0}}let S=new WeakMap;function E(I,O){let P=S.get(I);return P!==void 0&&Sx(Z,P.rows,P.settings,O,P.runtime)}let m={vault:B,async getRelayConfig(){let{mode:I,paths:O,store:P}=await U();return d6(O.config,{...h6,name:"native-relay"},async(D)=>{let T=await P.readSettings();if(T.status!=="ready")throw new g("publication-refused");let C=u2(T.settings.relay),k=await c$(O.runtime,O.storageId),w=k.status==="ready"?k.state.relay?.token:void 0;if(await x(I),await D.assertOwned(),!C.enabled||!C.url||!w)return null;return{...C,token:w}})},async updateRelay(I){let O=c7(I);if(!O||typeof O!=="object"||Array.isArray(O)||Object.keys(O).some((C)=>!["enabled","url","token","fallbackToDirect","transport"].includes(C)))throw new g("publication-refused");for(let C of["enabled","fallbackToDirect"])if(O[C]!==void 0&&typeof O[C]!=="boolean")throw new g("publication-refused");if(O.url!==void 0&&typeof O.url!=="string")throw new g("publication-refused");if(O.transport!==void 0&&!["http","websocket"].includes(O.transport))throw new g("publication-refused");if(O.token!==void 0&&O.token!==null&&(typeof O.token!=="string"||!O.token.trim()||/\p{Cc}/u.test(O.token)))throw new g("publication-refused");let{mode:P,paths:D,store:T}=await U();await d6(D.config,{...h6,name:"native-relay"},async(C)=>{let k=await T.readSettings();if(k.status!=="ready")throw new g("publication-refused");let w=u2(k.settings.relay),f=await c$(D.runtime,D.storageId),h=O.token===void 0?f.status==="ready"?f.state.relay?.token:void 0:O.token?.trim(),v=u2({...w,...O,enabled:O.token===null?!1:O.enabled??w.enabled});if(v.enabled&&(!v.url||!h))throw new g("publication-refused");async function F(b){await T.updateSettings(async(y)=>{await x(P),await C.assertOwned(),y.relay=b})}if(await F({...w,enabled:!1}),O.token!==void 0)await p7(D.runtime,D.storageId,(b)=>{if(h)b.relay={token:h};else delete b.relay;return b},{beforeRename:async()=>{await x(P),await C.assertOwned()}});await F(v)})},async read(){let I=await R();return S.set(I.snapshot,I),I.snapshot},async authorizeLocal(I,O={}){await j(O.signal);let P=await m.read(),D=P.accounts.find((v)=>v.id===I);if(P.mode!=="local")return{status:"refused",reason:"custody-mode",persisted:!1};if(!D?.binding&&E(P,I)){if(a.debug("native-auth","waiting for an account write to finish",{phase:"waiting"}),await MO(Z,O.signal?[W.signal,O.signal]:[W.signal],()=>q(O.signal),J)==="deadline")throw a.warn("native-auth","account write did not finish in time",{outcome:"deadline"}),new $J;if(P=await m.read(),D=P.accounts.find((F)=>F.id===I),P.mode!=="local")return{status:"refused",reason:"custody-mode",persisted:!1};if(!D?.binding&&E(P,I))throw a.warn("native-auth","account write is still unfinished",{outcome:"still-torn"}),new $J;a.debug("native-auth","account write finished",{outcome:"joined"})}if(!D?.binding||D.source!=="local"||D.type!=="oauth")return{status:"refused",reason:"row-ineligible",persisted:!1};if(D.state==="unsupported-access")return{status:"refused",reason:"unsupported-access",persisted:!1};let T=await c$(Z.runtime,Z.storageId),C=T.status==="ready"?T.state.accounts[D.binding.rowId]?.binding:void 0;if(C?.kind==="local"&&C.credentialEpoch<D.binding.credentialEpoch){if(await N(D.binding.rowId),P=await m.read(),D=P.accounts.find((v)=>v.id===I),!D?.binding)return{status:"refused",reason:"row-ineligible",persisted:!1}}let k=(v,F)=>{if(F.mode!=="local")return{status:"blocked",reason:"local-mode-unavailable"};if(!v?.enabled)return{status:"blocked",reason:"account-disabled"};return{status:"allowed"}},w=(v,F)=>{let b=k(v,F);return b.status==="allowed"&&v?O.policy?.(v,F)??b:b};if(w(D,P).status==="blocked")return{status:"refused",reason:"quota-ineligible",persisted:!1};let h=await UO({paths:Z,...$.local,now:J,publicationGuard:async(v)=>{if(v.status==="persisted"||v.status==="failed"&&v.persisted&&v.committed!==void 0)return!0;try{return await A4($.host,X)==="local"}catch{return!1}},externalPolicy:()=>k(D,P),failurePolicy:$.local?.failurePolicy??((v)=>{let F=v.observation.status==="failed"?v.observation.failure:void 0,b=Object.assign(Error(F?.classification==="invalid-grant"?"invalid_grant":"Local refresh failed"),{status:F?.status,retryAfter:F?.retryAfter,...F?.classification==="transient"&&F.status===void 0?{code:"ECONNRESET"}:{}}),y=fB({error:b,now:J(),accountIdentity:v.attribution.subject.binding.identity,previous:{message:"Local refresh failed",checkedAt:J(),accountIdentity:v.attribution.subject.binding.identity,retryCount:Math.max(0,v.observation.attempt-1)}}),u=v.observation.status==="failed"&&F?.kind==="provider"&&F.classification==="transient"&&F.status!==429&&!v.observation.persisted&&!v.observation.committed&&v.observation.attempt<a7;return{checkedAt:y.checkedAt,nextRetryAt:u?y.checkedAt:y.nextRetryAt,retryCount:y.retryCount}})}).authorize({intent:O.intent??"serve",mode:"local",binding:D.binding,rejectedAccessToken:O.rejectedAccessToken,signal:AbortSignal.any([W.signal,...O.signal?[O.signal]:[]])});if(q(O.signal),h.status==="usable"){let v=await m.read(),F=v.accounts.find((b)=>b.id===I);if(w(F,v).status==="blocked"||!F?.binding||F.binding.rowId!==h.binding.rowId||F.binding.credentialEpoch!==h.binding.credentialEpoch||F.binding.identity!==h.binding.identity)return{status:"refused",reason:"row-ineligible",persisted:!1}}return h},async authorizeApi(I,O){await L(O);let P=await M(await A(I));if(q(O),!P?.enabled||!P.candidate||P.stamp!=="bound"||P.credential?.type!=="api")throw new o("route-unavailable");return await L(O),{...P.credential,subject:{kind:"api",binding:$x(Z,P),credentialFingerprint:I6(P.credential),baseURL:P.credential.baseURL,authHeader:P.credential.authHeader}}},authorizeVault:(I,O)=>{return q(O),B.authorize(I,O)},async loginOAuth(I){if((await m.read()).mode!=="local")throw new o("route-unavailable");let P;try{if(!I.credential.access.startsWith("sk-ant-oat"))throw Error("Unsupported OAuth credential");if(P=(await($.local?.resolveIdentity??X3)(I.credential.access,void 0,void 0)).accountUuid,!P?.trim())throw Error("Missing account identity")}catch{throw Error("Claude account identity could not be verified; retry sign-in. No account changes were saved.")}return m.putAccount({...I,accountIdentity:P,replace:I.replace??!0,credential:{type:"oauth",...I.credential}})},async putAccount(I){await L();let O=await m.read();if(O.mode!=="local")throw new o("route-unavailable");let P=I.routeId==="main"?await A("main").catch(()=>n1()):I.routeId;if(I.credential.type==="api"&&(I.routeId==="main"||P===O.settings.mainAccountId))throw new o("route-unavailable");let D=await M(P),T=P,C=!1;if(I.replace&&D){if(!D.credentialEpoch)throw new g("publication-refused");await V.replace(P,I.credential,{identity:I.accountIdentity},{attribution:{credentialEpoch:D.credentialEpoch,identity:D.identity}})}else{let f=await V.add({id:P,credential:I.credential,identity:I.accountIdentity,label:I.label});T=f.id,C=f.outcome==="added"||f.outcome==="added-disabled"}if(I.routeId==="main")await V.updateSettings((f)=>{f.mainAccountId=T});await N(T);let w=(await m.read()).accounts.find((f)=>f.binding?.rowId===T);if(!w)throw new o("route-unavailable");if(C)bx(w);return w},addApi:(I)=>m.putAccount({routeId:I.routeId??n1(),label:I.label,replace:I.replace,credential:{type:"api",apiKey:I.apiKey,baseURL:I.baseURL??"https://api.anthropic.com",authHeader:I.authHeader}}),async updateSettings(I){let O=await U(),P={},D=await O.store.updateSettings(async(T)=>{function C(h){let v=h.claustrum;return[h.mainAccountId,v?.mode,v?.primaryAccount,v?.scopedRoster,v?.rosterView,h.relay]}let k=JSON.stringify(C(T));P.before=QK(T);let w=await I(T),f=c7(w??T);if(JSON.stringify(C(f))!==k)throw new o("route-unavailable");return f});if(D.outcome==="updated"&&P.before)Ex(P.before,D.settings);return D},async setLoggingLevel(I){await m.updateSettings((O)=>({...O,logging:{...O.logging&&typeof O.logging==="object"&&!Array.isArray(O.logging)?O.logging:{},level:I}})),KK(I)},async setEnabled(I,O){let P=await m.read(),D=P.accounts.find((v)=>v.id===I),T={id:I,label:D?.label},C=O?"account enabled":"account disabled";if(P.mode==="claustrum"){if(D?.source!=="vault")throw new o("route-unavailable");if(await B.setEnabled(I,O))Z4(C,T);return}await L();let k=await A(I),w=O?"enable":"disable",f={},h=O0({paths:Z,quota:d$,now:J,onStep:async(v,F)=>{if(v==="before-config-write"||v==="before-state-write")await L();if(v!=="before-config-write"||F.operation!==w||F.rowId!==k)return;f.before=void 0;try{let b=await V.read();if(b.status==="ready")f.before=b.rows.find((y)=>y.id===k)?.enabled}catch{}await L()}});if(O)await h.enable(k);else await h.disable(k,"user-disabled");if(f.before!==void 0&&f.before!==O)Z4(C,T)},async remove(I){await L();let O=await m.read();if(O.mode!=="local")throw new o("route-unavailable");let P=O.accounts.find((T)=>T.id===I);if((await V.remove(await A(I))).outcome==="removed")Z4("account removed",{id:I,label:P?.label})},async reorder(I,O){await L();let P=await m.read();if(P.mode!=="local")throw new o("route-unavailable");let D=await V.read();if(D.status!=="ready")throw new g("publication-refused");let T=await Promise.all(I.map(A)),C=D.rows.find((k)=>k.id===P.settings.mainAccountId);if(C&&!T.includes(C.id))T.unshift(C.id);if((await V.reorder(T)).outcome==="reordered")Z4("account reordered",P.accounts.find((k)=>k.id===O)??{id:O})},async captureLocalSubject(I){await L();let O=await M(await A(I));if(O?.credential?.type!=="oauth"||O.stamp!=="bound")throw new o("route-unavailable");let P=O.credential,D={kind:"local",storageId:Z.storageId,rowId:O.id,credentialEpoch:O.credentialEpoch??0,...O.identity!==void 0?{identity:O.identity}:{}};if(!x$(D,Z,O))throw new o("route-unavailable");return{binding:D,credentialFingerprint:I6(P),version:{...P.access?{accessFingerprint:S$(P.access)}:{},...P.expires!==void 0?{expires:P.expires}:{},...Object.hasOwn(P,"lastRefreshedAt")?{lastRefreshedAt:P.lastRefreshedAt}:{}}}},async publishLocal(I,O){let P=eQ(O);if(await j()!=="local")return!1;let{quota:D,...T}=P,C=D!==void 0&&Object.keys(T).length===0,k=await M(I.binding.rowId);if(k?.stamp!=="bound"||k.credential?.type!=="oauth"||!x$(I.binding,Z,k)||!C&&!c0(I,I.binding,k.credential))return!1;if(D){if(D.accountIdentity!==I.binding.identity)throw new g("publication-refused");await V.recordQuota(I.binding.rowId,{credentialEpoch:I.binding.credentialEpoch,identity:I.binding.identity},s0(D))}return _(I,(w)=>$K(w,T),C?"binding":!0)},publishApi:(I,O)=>_(I,(P)=>({...P,lastUsed:Math.max(P.lastUsed??0,O.lastUsed)})),async resetBackoff(I,O,P="all"){if("accessToken"in O)return B.resetBackoff(O,P);if(await j()!=="local")return!1;if(await A(I)!==O.binding.rowId)return!1;return _(O,(D)=>{let T=Math.max(J(),D.refreshErrorClearedAt??0,D.quotaErrorClearedAt??0,D.lastRefreshError?.checkedAt??0,D.lastQuotaRefreshError?.checkedAt??0),C={...D};if(P!=="quota")delete C.lastRefreshError,delete C.validationRetry,C.refreshErrorClearedAt=T;if(P!=="refresh")delete C.lastQuotaRefreshError,C.quotaErrorClearedAt=T,C.quotaErrorGeneration=(D.quotaErrorGeneration??0)+1;return C},!1)},async getOrCreateAuthLineage(I,O){if("accessToken"in O)return B.getOrCreateAuthLineage(O);if(await j()!=="local")return;if(await A(I)!==O.binding.rowId)return;let P;return await _(O,(T)=>{return P=T.authLineageId??n1(),{...T,authLineageId:P}})?P:void 0},async incrementPrimeUsage(I,O,P={}){if("accessToken"in O)return B.incrementPrimeUsage(O,P);if(await j()!=="local")return!1;if(await A(I)!==O.binding.rowId)return!1;let D=ZM(P);return _(O,(T)=>({...T,prime:{count:(T.prime?.count??0)+1,inputTokens:(T.prime?.inputTokens??0)+D.inputTokens,outputTokens:(T.prime?.outputTokens??0)+D.outputTokens,since:T.prime?.since??J()}}))},async fetchQuota(I,O=fetch,P,D){let T=await m.read();if(T.mode==="claustrum")return B.fetchQuota(I,O,P,D);let C=T.accounts.find((h)=>h.id===I),k=await c(I,O,P,(h,v)=>b4({accessToken:h.access,fetchImpl:v,now:J}),async(h,v)=>{let F=C?.binding&&C.binding.rowId===v.binding.rowId&&C.binding.credentialEpoch===v.binding.credentialEpoch&&C.binding.identity===v.binding.identity?C:void 0,b=ZK(h,v.binding.identity,Math.max(J(),(F?.quotaErrorClearedAt??-1)+1),F?.lastQuotaRefreshError);if(b)await m.publishLocal(v.subject,{lastQuotaRefreshError:b})},D),w={...k.value,accountIdentity:k.attempt.binding.identity},f=C?.binding&&C.binding.rowId===k.attempt.binding.rowId&&C.binding.credentialEpoch===k.attempt.binding.credentialEpoch&&C.binding.identity===k.attempt.binding.identity?C:void 0;return await m.publishLocal(k.attempt.subject,{quota:w,quotaErrorClearedAt:Math.max(w.checkedAt??J(),f?.quotaErrorClearedAt??0,f?.lastQuotaRefreshError?.checkedAt??0)}),w},async fetchProfile(I,O=fetch,P){if((await m.read()).mode==="claustrum")return B.fetchProfile(I,O,P);let D=await s(I,O,P);return await m.publishLocal(D.attempt.subject,{profile:D.value}),D.value},async fetchProfileForDisplay(I,O=fetch,P){if((await m.read()).mode==="claustrum")return B.fetchProfileForDisplay(I,O,P);let D=await s(I,O,P),T=structuredClone(D.attempt.subject),C=D.value;return EK(C,()=>m.publishLocal(T,{profile:C}),async()=>{if((await m.read()).mode!=="local"||await A(I)!==T.binding.rowId)return!1;let k=await M(T.binding.rowId);return k?.stamp==="bound"&&k.enabled!==!1&&k.credential?.type==="oauth"&&x$(T.binding,Z,k)&&c0(T,T.binding,k.credential)})},close(){if(!W.signal.aborted)W.abort(new o("closed")),B.close()}};function s(I,O,P){return c(I,O,P,(D,T)=>t3({accessToken:D.access,accountIdentity:D.binding.identity,fetchImpl:T,now:J,signal:P}))}async function c(I,O,P,D,T,C){let k=AbortSignal.any([W.signal,...P?[P]:[]]),w=await m.authorizeLocal(I,{signal:k});if(w.status!=="usable")throw new o("route-unavailable");let f=w,h=(y,u)=>{let l=()=>O(y,{...u,signal:k});if(!C)return l();return C(l,async()=>{await L(k);let t=await M(f.binding.rowId);if(!t?.enabled||t.stamp!=="bound"||t.credential?.type!=="oauth"||!x$(f.binding,Z,t)||!c0(f.subject,f.binding,t.credential)||await A(I)!==f.binding.rowId)throw new o("identity-changed");await L(k)})},v,F=Object.assign(async(y,u)=>{v=void 0;let l=await h(y,u);if(v=l.status,l.status===401&&!k.aborted){await l.body?.cancel().catch(()=>{}),q(k);let t=await m.authorizeLocal(I,{rejectedAccessToken:f.access,signal:k});if(t.status==="usable"&&t.binding.rowId===f.binding.rowId&&t.binding.credentialEpoch===f.binding.credentialEpoch&&t.binding.identity===f.binding.identity&&t.access!==f.access&&t.subject.version.lastRefreshedAt!==void 0&&(f.subject.version.lastRefreshedAt===void 0||t.subject.version.lastRefreshedAt>f.subject.version.lastRefreshedAt)){f=t;let W6=new Headers(u?.headers);W6.set("authorization",`Bearer ${f.access}`),v=void 0,l=await h(y,{...u,headers:W6}),v=l.status}}return l},{preconnect:O.preconnect}),b;try{b=await D(f,F)}catch(y){q(k);let u=y instanceof o||y instanceof g?y:XK(y,v);throw await T?.(u,f),u}return q(k),{value:b,attempt:f}}return m}function ZM($){let Z=$.inputTokens??0,J=$.outputTokens??0;if(![Z,J].every((X)=>Number.isSafeInteger(X)&&X>=0))throw new g("publication-refused");return{inputTokens:Z,outputTokens:J}}function u2($){let Z=$&&typeof $==="object"?$:{},J=typeof Z.url==="string"?Z.url.trim():"",X=Z.transport==="http"?"http":"websocket";if(J)try{let Y=new URL(J);if(!["https:","http:","wss:","ws:"].includes(Y.protocol)||Y.username||Y.password||X==="http"&&!["https:","http:"].includes(Y.protocol))throw Error("invalid endpoint")}catch{throw new g("publication-refused")}return{enabled:Z.enabled===!0,url:J,transport:X,fallbackToDirect:Z.fallbackToDirect!==!1}}class C$ extends Error{code;effect;constructor($,Z=void 0){super(`Native host auth write: ${$}`);this.code=$,this.effect=Z,this.name="NativeHostAuthWriteError"}}function uG($){return typeof $==="string"&&($==="absent"||$.length===64&&/^[a-f0-9]{64}$/.test($))}async function V9($,Z,J){try{await $?.()}catch{throw new C$(Z,J)}}async function lK($,Z={}){let J,X,Y;try{let{host:G,authPath:z,sourceDigest:Q,expectedDigest:K,removePiAnthropicAuth:W,processFence:V}=$;cQ($.env);let{beforeRecheck:B,beforeRename:q,afterRename:H,afterUnlink:j}=Z;if(G!=="opencode"&&G!=="pi"||typeof z!=="string"||!QM(z)||/\p{Cc}/u.test(z)||!uG(Q)||!uG(K)||typeof V!=="function")throw new C$("invalid-source");let x=await T6("hostAuth",z);if(x.metadata&&process.getuid&&x.metadata.uid!==process.getuid())throw new C$("unsafe-source");let L=l6(G,x.data);if(L.digest!==Q)throw new C$("invalid-source");let U=Object.assign(Object.create(null),x.data);if(G==="opencode"){if(L.kind!=="api"&&L.kind!=="activation")U.anthropic=LZ("anthropic")}else delete U.anthropic;if(l6(G,U).digest!==K)throw new C$("invalid-source");if(G==="opencode"&&(L.kind==="api"||L.kind==="activation")||G==="pi"&&L.kind==="absent")return Object.freeze({status:"unchanged"});if(G==="pi"&&W!==!0)throw new C$("consent-required");let M=G==="pi"&&Object.keys(U).length===0,A=Object.freeze(G==="pi"?{status:"removed",file:M?"unlinked":"replaced"}:{status:x.data===void 0?"created":"replaced"});if(!M){J=KM(zM(z),`.native-host-auth-write.${JM()}.tmp`);let _=await YM(J,"wx",384);try{let N=await _.stat();X={dev:N.dev,ino:N.ino},await _.writeFile(`${JSON.stringify(U,null,2)}
-`,"utf8"),await _.chmod(x.metadata?x.metadata.mode&4095:384),await _.sync()}finally{await _.close()}}if(await V9(B,"hook-failed"),await H0(x),await V9(q,"hook-failed"),await V9(V,"process-fence-refused"),M)await mG(z),Y=A,await V9(j,"hook-failed",Y);else await GM(J,z),X=void 0,Y=A,await V9(H,"hook-failed",Y);return A}catch(G){if(G instanceof C$||G instanceof D0)throw G;if(G instanceof v6)throw new C$(G.code==="unsafe-source"?"unsafe-source":"invalid-source",Y);throw new C$("write-io",Y)}finally{if(J&&X)try{let G=await XM(J);if(G.dev===X.dev&&G.ino===X.ino)await mG(J)}catch{}}}async function g6($){let Z=UM($);try{return await NM(Z)}catch(X){if(!(X instanceof Error)||!("code"in X)||X.code!=="ENOENT")throw X}let J=iK(Z);if(J===Z)return Z;return sK(await g6(J),dK(Z))}function B9($,Z,J,X){return dK($)===Z?sK(iK($),J):`${$}.${X}.json`}async function xM($=AJ(),Z=RB($)){let[J,X]=await Promise.all([g6($),g6(Z)]),Y=await g6(B9(J,"anthropic-auth.json","anthropic-auth-pool.json","pool")),G=await g6(B9(X,"anthropic-auth-state.json","anthropic-auth-pool-state.json","pool")),z=await g6(B9(X,"anthropic-auth-state.json","anthropic-auth-native-state.json","native")),Q=await g6(B9(X,"anthropic-auth-state.json","anthropic-auth-migration.json","migration")),K=await g6(B9(X,"anthropic-auth-state.json","anthropic-auth-custody-roster.json","roster")),W=[J,X,Y,G,z,Q,K];if(new Set(W).size!==W.length)throw Error("Anthropic account storage paths overlap; migration requires separate files");let V=LM("sha256").update(JSON.stringify(["anthropic",Y,G])).digest("hex");return{legacyConfig:J,legacyState:X,config:Y,state:G,runtime:z,journal:Q,roster:K,storageId:V}}class C5 extends Error{code;constructor($){super($==="primary-unverified"?"Stop OpenCode and Pi, then run bunx @cortexkit/opencode-anthropic-auth setup --login --no-claustrum. Existing credentials have not been changed.":`Native migration: ${$}`);this.code=$,this.name="NativeMigrationError"}}var pG=new WeakMap;function n($="invalid-source"){throw new C5($)}function Z8($){if($.metadata&&process.getuid&&$.metadata.uid!==process.getuid())n("unsafe-source")}async function GJ($){try{return await VM($),!1}catch(Z){if(Z instanceof Error&&"code"in Z&&Z.code==="ENOENT")return!0;return n("unsafe-source")}}async function DM($){cQ($.env),await $.processFence();let Z=await xM($.paths.legacyConfig,$.paths.legacyState);for(let j of Object.keys(Z))if($.paths[j]!==Z[j])n();for(let j of[$.hostAuthPath,$.routingSourcePath,$.routingDestinationPath])if(!HM(j)||/\p{Cc}/u.test(j))n();let J=await L1($.paths),X=await T6("hostAuth",$.hostAuthPath);Z8(X);let Y=l6($.host,X.data);if($.host==="pi"&&Y.kind!=="absent"&&!$.removePiAnthropicAuth)n("consent-required");let G=await g6($.hostAuthPath),z=await g6($.routingSourcePath),Q=await g6($.routingDestinationPath),K=[$.paths.legacyConfig,$.paths.legacyState,$.paths.config,$.paths.state,$.paths.runtime,$.paths.roster,$.paths.journal,G,z];if(new Set(K).size!==K.length||Q!==z&&K.includes(Q))n();if(J&&(J.host!==$.host||J.hostAuthPath!==G||J.routingPaths.source!==z||J.routingPaths.destination!==Q))n();if(J?.phase==="committed"||J?.phase==="retired"){let j=(x,L)=>({role:x,path:L,digest:null,data:void 0,metadata:void 0});return{config:j("config",$.paths.legacyConfig),state:j("state",$.paths.legacyState),routing:j("routing",$.routingSourcePath),auth:X,journal:J,hostAuthPath:G,routingSourcePath:z,routingDestinationPath:Q}}if(!J){for(let j of[$.paths.config,$.paths.state,$.paths.runtime,$.paths.roster])if(!await GJ(j))n();if(z!==Q&&!await GJ($.routingDestinationPath))n()}let W=await T6("config",$.legacyConfigPath??$.paths.legacyConfig),V=await T6("state",$.legacyStatePath??$.paths.legacyState),B=await T6("routing",$.routingSourcePath);for(let j of[W,V,B])Z8(j);if(await g6(W.path)!==$.paths.legacyConfig||await g6(V.path)!==$.paths.legacyState)n();if(J&&(J.sources.config!==W.digest||J.sources.state!==V.digest||J.expectedRouting==="unprepared"&&J.sources.routing!==B.digest))n();if(J&&Y.digest!==J.sources.hostAuth&&Y.digest!==J.expectedHostAuth)n();let q,H;if(!J||J.expectedHostAuth==="unprepared"||Y.digest===J.sources.hostAuth){q=Kx({host:$.host,storageId:$.paths.storageId,configDigest:W.digest,config:W.data,state:V.data,hostAuth:X.data});let j=q.mainRouteId,x=q.accounts.find((U)=>U.id===j);if(($.requestVaultActivation||J?.activation?.kind==="requested")&&x?.credential?.type==="oauth"&&!x.identity)n("primary-unverified");if(q.custodyPrimary){if(!$.custody)n();H={inventory:await $.custody.discover(),primary:q.custodyPrimary,primaryRouteId:q.mainRouteId,legacyRows:q.custodyRows,disabledAccountIdentities:q.disabledAccountIdentities,reservedRouteIds:q.accounts.filter((U)=>U.credential?.type==="api").map((U)=>U.id)},XJ(H)}let L=q.accounts.filter((U)=>U.credential).map((U)=>({id:U.id,type:U.credential?.type??"oauth",credential:U.credential,identity:U.identity,credentialEpoch:1,enabled:U.enabled,stamp:"bound",hasEntry:!0,needsFirstReading:!1,candidate:U.enabled}));h7($.paths,q,L,H?XJ(H):void 0)}return{config:W,state:V,routing:B,auth:X,journal:J,projection:q,seedInput:H,hostAuthPath:G,routingSourcePath:z,routingDestinationPath:Q}}async function z0($){let Z=await $.read();if(Z.status!=="ready")n();return Z.rows}async function R4($){let Z=await c$($.runtime,$.storageId);if(Z.status!=="ready")n();return Z.state}async function p2($,Z,J){let X=await Z.readSettings();if(X.status!=="ready")n();let Y=await T6("state",$.roster);Z8(Y);let G=Y.data?await f6($.roster):null;if(Y.data&&!G)n();return{runtime:await R4($),settings:X.settings,accounts:J.map((z)=>({id:z.id,type:z.type,enabled:z.enabled,label:z.label??null,addedAt:z.addedAt??null,disabledReason:z.disabledReason??null,quota:z.quota??null})),roster:G}}async function cG($,Z,J){let X=j1($);async function Y(G,z){let Q=X[G];if(!Q)return i$($.roster,async(K,W)=>{return{result:await d6($.runtime,{name:"native-runtime",...h6,renew:!0},(B)=>J(async()=>{await Z();for(let q of z)await q();await W.assertOwned(),await B.assertOwned()}))}});return d6(Q.path,{...h6,...Q,renew:!0},(K)=>Y(G+1,[...z,()=>K.assertOwned()]))}return Y(0,[])}function c2($){if(!$.routing.data)return;if(!$.projection)n();let Z=new Map($.projection.accounts.map((J)=>[J.id,J.id]));return Z.set("main",$.projection.mainRouteId),nO($.routing.data,Z)}function lG($){return $===void 0?null:WM("sha256").update($).digest("hex")}function tK($,Z){let J=l6($.host,Z.data);return $.host==="pi"?"absent":J.kind==="api"?J.digest:l6("opencode",{anthropic:LZ("anthropic")}).digest}async function Q0($){await H0($.config),await H0($.state)}async function l2($,Z){if(await g6($.hostAuthPath)!==Z.hostAuthPath||await g6($.routingSourcePath)!==Z.routingSourcePath||await g6($.routingDestinationPath)!==Z.routingDestinationPath)n()}async function dG($,Z,J,X){let Y=[{role:"config",path:$.legacyConfigPath??$.paths.legacyConfig,digest:Z.sources.config},{role:"state",path:$.legacyStatePath??$.paths.legacyState,digest:Z.sources.state},...Z.routingPaths.source===Z.routingPaths.destination?[]:[{role:"routing",path:$.routingSourcePath,digest:Z.sources.routing}]],G=await Promise.all(Y.map(async(z)=>{let Q=await T6(z.role,z.path);if(Z8(Q),Q.data&&Q.digest!==z.digest)n("retirement-refused");return Q}));for(let z of G){if(!z.data)continue;await X.onStep?.(`before:retire:${z.role}`),await H0(z),await $.processFence(),await J(),await qM(z.path),await X.onStep?.(`after:retire:${z.role}`)}return w4($.paths,"committed","retired",{assertOwned:async()=>{for(let z of Y)if(!await GJ(z.path))n("retirement-refused");await $.processFence(),await J()},onWriteStep:async(z)=>X.onStep?.(`${z}:journal:retired`)})}async function iG($,Z,J){let X=await T6("hostAuth",$.hostAuthPath);Z8(X);let Y=l6($.host,X.data);await lK({host:$.host,authPath:$.hostAuthPath,sourceDigest:Y.digest,expectedDigest:tK($,X),env:$.env,removePiAnthropicAuth:$.removePiAnthropicAuth,processFence:async()=>{await $.processFence(),await Z()}},J.hostWrite)}async function WC($,Z={}){let J={...$.paths},X={...$,paths:J,env:{...$.env}};try{return await d6(J.journal,{name:"native-migration",ttlMs:30000,timeoutMs:15000,renew:!0},async(Y)=>{let G=async()=>{try{await Y.assertOwned()}catch{n("ownership-lost")}},z=await DM(X);if(X.preflight){let H=pG.get(X.preflight);if(!H||X.preflight.storageId!==J.storageId||X.preflight.host!==X.host||H.config.digest!==z.config.digest||H.state.digest!==z.state.digest||H.routing.digest!==z.routing.digest||l6(X.host,H.auth.data).digest!==l6(X.host,z.auth.data).digest||H.hostAuthPath!==z.hostAuthPath||H.routingSourcePath!==z.routingSourcePath||H.routingDestinationPath!==z.routingDestinationPath)n()}let Q=z.journal,K=async(H)=>Z.onStep?.(H),W={assertOwned:async()=>{await l2(X,z),await Q0(z),await X.processFence(),await G()},onWriteStep:async(H,j)=>{await K(j.phase==="verified"&&j.preparedProof?`${H}:proof`:`${H}:journal:${j.phase}`)}};if(Q?.phase==="retired"){if(Q.activation===null)await iG(X,G,Z);return Q}if(Q?.phase==="committed"){if(Q=await dG(X,Q,G,Z),Q.activation===null)await iG(X,G,Z);return Q}if(!Q)await G(),Q=await BO(J,{host:X.host,sources:{config:z.config.digest,state:z.state.digest,hostAuth:l6(X.host,z.auth.data).digest,routing:z.routing.digest},hostAuthPath:z.hostAuthPath,routingPaths:{source:z.routingSourcePath,destination:z.routingDestinationPath},...X.requestVaultActivation?{activation:"requested"}:{}},W);let V=O0({paths:J,quota:d$,onLockStep:Z.store?.onLockStep,onStep:async(H,j)=>{if(await Z.store?.onStep?.(H,j),await K(`${H}:store:${j.operation}`),H.startsWith("before-"))await Q0(z),await X.processFence(),await G()}}),B,q;if(Q.phase==="building"){let H=z.projection;if(!H)n();let j=async()=>{await l2(X,z),await Q0(z),await X.processFence(),await G()};await j(),await V.initialize();for(let U of[...H.accounts].filter((M)=>M.credential).sort((M,A)=>Number(M.enabled)-Number(A.enabled))){let M=(await z0(V)).find((A)=>A.id===U.id);if(M)z9({...H,accounts:[{...U,credential:U.credential,enabled:M.enabled}]},[M],!1);else{if(await j(),!U.credential)n();if((await V.add({id:U.id,credential:U.credential,...U.identity!==void 0?{identity:U.identity}:{},...U.label!==void 0?{label:U.label}:{}})).id!==U.id)n();await K(`after:add:${U.id}`)}if(await j(),!U.enabled)await V.disable(U.id,"user-disabled");else await V.enable(U.id);if(U.quota){let A=(await z0(V)).find((_)=>_.id===U.id);if(!A?.credentialEpoch)n();await j(),await V.recordQuota(U.id,{credentialEpoch:A.credentialEpoch,...A.identity!==void 0?{identity:A.identity}:{}},U.quota)}}if(await j(),await V.reorder(H.accounts.filter((U)=>U.credential).map((U)=>U.id)),await j(),await V.updateSettings(()=>H.settings),z.seedInput){if(await j(),await K("before:roster"),!X.custody)n();q=await X.custody.publishSeed(J,z.seedInput,{assertOwned:j}),await G(),await K("after:roster")}let x=await z0(V);z9(H,x);let L=h7(J,H,x,q);if(await j(),await K("before:runtime"),z.seedInput){if(!X.custody)n();await X.custody.publishRuntimeSeed(J,L,{assertOwned:j})}else await p7(J.runtime,J.storageId,(U)=>{if(Object.keys(U.accounts).length>0&&M6(U)!==M6(L))n();return L},{beforeRename:j});await K("after:runtime"),B=c2(z),await cG(J,G,async(U)=>{if(await Q0(z),z9(H,await z0(V)),M6(await R4(J))!==M6(L))n();Q=await w4(J,"building","verified",{...W,assertOwned:async()=>{if(await Q0(z),z9(H,await z0(V)),M6(await R4(J))!==M6(L))n();await X.processFence(),await U()}})})}return Q=await cG(J,G,async(H)=>{if(!Q)n();await Q0(z);let j=await z0(V),x=await p2(J,V,j);if(Q.expectedHostAuth==="unprepared"){if(!z.projection)n();z9(z.projection,j);let M=await V.readSettings();if(M.status!=="ready"||M6(M.settings)!==M6(z.projection.settings))n();if(z.seedInput&&!q){if(!X.custody)n();if(!(await T6("state",J.roster)).data)n();let N=await f6(J.roster);if(!N)n();CO(N,z.seedInput),q=XJ(z.seedInput)}if(M6(await R4(J))!==M6(h7(J,z.projection,j,q)))n();await H0(z.routing),B??=c2(z);let A=lQ(j,x);Q=await qO(J,{expectedHostAuth:tK(X,z.auth),expectedRouting:lG(B),preparedProof:A},{...W,assertOwned:async()=>{await Q0(z),await H0(z.routing);let _=await z0(V);F2(A,_,await p2(J,V,_)),await X.processFence(),await H()}})}F2(Q.preparedProof,j,x);let L=Q,U=async()=>{await l2(X,z),await Q0(z),j=await z0(V),x=await p2(J,V,j),F2(L.preparedProof,j,x),await X.processFence(),await H()};return await d6(X.routingDestinationPath,{name:"write",ttlMs:30000,timeoutMs:15000,renew:!0},async(M)=>{let A=await T6("routing",X.routingDestinationPath);if(Z8(A),A.digest!==L.expectedRouting){if(L.phase!=="verified"||(z.routingSourcePath!==z.routingDestinationPath?A.digest!==null:A.digest!==L.sources.routing))n();if(await H0(z.routing),B??=c2(z),lG(B)!==L.expectedRouting||!B)n();await K("before:routing"),await l8(X.routingDestinationPath,JSON.parse(B),{beforeRename:async()=>{await H0(A),await U(),await M.assertOwned()}}),await K("after:routing")}let _=await T6("hostAuth",X.hostAuthPath);Z8(_);let N=l6(X.host,_.data);if(N.digest!==L.sources.hostAuth&&N.digest!==L.expectedHostAuth)n();if(L.phase==="activation-installed"&&N.digest!==L.expectedHostAuth)n();if(await K("before:host"),await U(),await BM(jM(X.hostAuthPath),{recursive:!0,mode:448}),N.digest!==L.expectedHostAuth)await lK({host:X.host,authPath:X.hostAuthPath,sourceDigest:L.sources.hostAuth,expectedDigest:L.expectedHostAuth,env:X.env,removePiAnthropicAuth:X.removePiAnthropicAuth,processFence:async()=>{await U(),await M.assertOwned()}},Z.hostWrite);await K("after:host"),await U();let R=await T6("hostAuth",X.hostAuthPath);if(l6(X.host,R.data).digest!==L.expectedHostAuth)n();if((await T6("routing",X.routingDestinationPath)).digest!==L.expectedRouting)n();let E={...W,assertOwned:async()=>{await U();let m=await T6("hostAuth",X.hostAuthPath),s=await T6("routing",X.routingDestinationPath);if(l6(X.host,m.data).digest!==L.expectedHostAuth||s.digest!==L.expectedRouting)n();await M.assertOwned()}};if(Q?.phase==="verified")Q=await w4(J,"verified","activation-installed",E);Q=await w4(J,"activation-installed","committed",E)}),Q}),await dG(X,Q,G,Z)})}catch(Y){if(Y instanceof v6)n(Y.code==="unsafe-source"?"unsafe-source":"invalid-source");if(Y instanceof H5)n();if(Y instanceof q5||Y instanceof C5)throw Y;if(Y instanceof Error&&Y.name==="LockContentionError")n("migration-busy");throw Y}finally{if(X.preflight)pG.delete(X.preflight)}}var VC=l6("opencode",{anthropic:LZ("anthropic")}).digest;async function BC($,Z){try{if($!=="opencode"&&$!=="pi")throw new D0("invalid-source");let J=await T6("hostAuth",Z);if(J.metadata){let X=typeof process.getuid==="function"?process.getuid():void 0;if(X!==void 0&&J.metadata.uid!==X||(J.metadata.mode&63)!==0)throw new D0("invalid-source")}return l6($,J.data).kind}catch{throw new D0("invalid-source")}}var OM=Object.freeze(["Accounts","Quota","Routing","Limits","Cache","Diagnostics","Extras"]),X6={kind:"action",destructive:!1,interactive:!1},q9={id:"id",kind:"account-id",required:!0},sG={id:"label",kind:"text",required:!1,protectedEntry:!1};function MM($){for(let Z of $.parameters){if(Z.kind==="choice")Object.freeze(Z.choices);if(Z.kind==="limit-entries")Object.freeze(Z.fields);Object.freeze(Z)}if(Object.freeze($.parameters),$.kind==="setup-guidance")Object.freeze($.setupInstructions);return Object.freeze($)}var zJ=Object.freeze([{...X6,id:"enable",command:"account",group:"Accounts",label:"Enable account",parameters:[q9]},{...X6,id:"disable",command:"account",group:"Accounts",label:"Disable account",parameters:[q9]},{...X6,id:"remove",command:"account",group:"Accounts",label:"Remove account",parameters:[q9],destructive:!0,confirm:"Remove the selected account from this host?"},{...X6,id:"move-up",command:"account",group:"Accounts",label:"Move account up",parameters:[q9]},{...X6,id:"move-down",command:"account",group:"Accounts",label:"Move account down",parameters:[q9]},{...X6,id:"reset-backoff",command:"account",group:"Accounts",label:"Reset account backoff",parameters:[]},{...X6,id:"enrollment-reset",command:"account",group:"Accounts",label:"Reset host enrollment",parameters:[],destructive:!0,confirm:"Clear denied or blocked enrollment state for this host?"},{...X6,id:"add-apikey",command:"account",group:"Accounts",label:"Add API-key fallback",interactive:!0,headlessRefusal:"interactive-required",parameters:[{id:"apiKey",kind:"text",required:!0,protectedEntry:!0},sG,{id:"baseURL",kind:"text",required:!1,protectedEntry:!1},{id:"authHeader",kind:"choice",required:!1,choices:["authorization-bearer","x-api-key"]}]},{...X6,id:"add-oauth-start",command:"account",group:"Accounts",label:"Start OAuth sign-in",parameters:[],interactive:!0,headlessRefusal:"interactive-required"},{...X6,id:"add-oauth-finish",command:"account",group:"Accounts",label:"Finish OAuth sign-in",parameters:[{id:"code",kind:"text",required:!0,protectedEntry:!0},sG],interactive:!0,headlessRefusal:"interactive-required"},{id:"custody-mode",kind:"setup-guidance",command:"account",group:"Accounts",label:"Custody setup guidance",destructive:!1,interactive:!0,headlessRefusal:"offline-required",offlineRequired:!0,parameters:[{id:"mode",kind:"choice",required:!0,choices:["local","claustrum"]}],setupInstructions:["Stop all selected hosts before changing credential authority.","Use the explicit offline setup flow for the selected local or claustrum mode.","This menu only provides guidance; it does not change settings, propose enrollment, or report setup success."]},{id:"vault-disconnect",kind:"vault-disconnect",command:"account",group:"Accounts",label:"Disconnect from the vault",destructive:!0,confirm:"Disconnect this host from the vault and return to local accounts? The vault keeps this host's enrollment approved until an operator revokes it there.",interactive:!0,headlessRefusal:"interactive-required",parameters:[]},{...X6,id:"quota-refresh",command:"quota",group:"Quota",label:"Refresh quota",parameters:[]},{...X6,id:"routing-mode",command:"routing",group:"Routing",label:"Routing mode",parameters:[{id:"mode",kind:"choice",required:!0,choices:["main-first","fallback-first","sticky-balanced"]}]},{...X6,id:"routing-reset",command:"routing",group:"Routing",label:"Reset routing session",parameters:[]},{...X6,id:"killswitch-on",command:"killswitch",group:"Limits",label:"Enable killswitch",parameters:[]},{...X6,id:"killswitch-off",command:"killswitch",group:"Limits",label:"Disable killswitch",parameters:[]},{...X6,id:"killswitch-set",command:"killswitch",group:"Limits",label:"Set killswitch thresholds",parameters:[{id:"entries",kind:"limit-entries",required:!0,fields:["account","fh","sd","scoped?"]}]},{...X6,id:"cache-on",command:"cache",group:"Cache",label:"Enable cache",parameters:[]},{...X6,id:"cache-off",command:"cache",group:"Cache",label:"Disable cache",parameters:[]},{...X6,id:"cache-mode",command:"cache",group:"Cache",label:"Cache mode",parameters:[{id:"mode",kind:"choice",required:!0,choices:["explicit","automatic","hybrid"]}]},{...X6,id:"cachekeep-always",command:"cachekeep",group:"Cache",label:"Keep cache warm always",parameters:[]},{...X6,id:"cachekeep-off",command:"cachekeep",group:"Cache",label:"Disable cache keep",parameters:[]},{...X6,id:"cachekeep-window",command:"cachekeep",group:"Cache",label:"Cache keep window",parameters:[{id:"startHour",kind:"number",required:!0},{id:"endHour",kind:"number",required:!0}]},{...X6,id:"cachekeep-subagents",command:"cachekeep",group:"Cache",label:"Cache keep for subagents",parameters:[{id:"enabled",kind:"choice",required:!0,choices:["on","off"]}]},{...X6,id:"dump-on",command:"dump",group:"Diagnostics",label:"Enable request dumps",parameters:[]},{...X6,id:"dump-off",command:"dump",group:"Diagnostics",label:"Disable request dumps",parameters:[]},{...X6,id:"logging-level",command:"logging",group:"Diagnostics",label:"Logging level",parameters:[{id:"level",kind:"choice",required:!0,choices:["error","warn","info","debug","trace"]}]},{...X6,id:"fast-on",command:"fast",group:"Extras",label:"Enable fast mode",parameters:[]},{...X6,id:"fast-off",command:"fast",group:"Extras",label:"Disable fast mode",parameters:[]},{...X6,id:"prime-on",command:"prime",group:"Extras",label:"Enable Prime",parameters:[]},{...X6,id:"prime-off",command:"prime",group:"Extras",label:"Disable Prime",parameters:[]},{...X6,id:"start-fire",command:"start",group:"Extras",label:"Fire lane start",parameters:[]}].map(MM)),IM=Object.freeze([{kind:"status",id:"account-status",command:"account",group:"Accounts",label:"Account status and usage"},{kind:"status",id:"quota-status",command:"quota",group:"Quota",label:"Quota summary"},{kind:"status",id:"routing-status",command:"routing",group:"Routing",label:"Routing status"},{kind:"status",id:"killswitch-status",command:"killswitch",group:"Limits",label:"Killswitch status"},{kind:"status",id:"cache-status",command:"cache",group:"Cache",label:"Cache status"},{kind:"status",id:"cachekeep-status",command:"cachekeep",group:"Cache",label:"Cache keep status"},{kind:"status",id:"dump-status",command:"dump",group:"Diagnostics",label:"Dump status"},{kind:"status",id:"logging-status",command:"logging",group:"Diagnostics",label:"Logging status"},{kind:"status",id:"fast-status",command:"fast",group:"Extras",label:"Fast mode status"},{kind:"status",id:"prime-status",command:"prime",group:"Extras",label:"Prime quota window status"}].map(($)=>Object.freeze($))),_M=Object.freeze(["remove","move-up","move-down","enrollment-reset","add-apikey","add-oauth-start","add-oauth-finish","custody-mode"]),PM=new Set(_M);function S5($){return PM.has($)}var AM=Object.freeze(["vault-disconnect"]),wM=new Set(AM);function aK($){return wM.has($)}function RM($,Z){return $==="local"?!aK(Z):!S5(Z)}function QJ($,Z){return $==="opencode"||!["quota","killswitch","prime","start"].includes(Z.command)}function K4($,Z){return Object.freeze({host:$,groups:Object.freeze(OM.map((J)=>Object.freeze({id:J,actions:Object.freeze(zJ.filter((X)=>X.group===J&&QJ($,X)&&RM(Z,X.id))),statuses:Object.freeze(IM.filter((X)=>X.group===J&&($==="opencode"||X.command!=="killswitch")))})))})}var TM=Object.freeze({opencode:Object.freeze({local:K4("opencode","local"),claustrum:K4("opencode","claustrum")}),pi:Object.freeze({local:K4("pi","local"),claustrum:K4("pi","claustrum")})}),FM=Object.freeze({opencode:Object.freeze(zJ.filter(($)=>QJ("opencode",$))),pi:Object.freeze(zJ.filter(($)=>QJ("pi",$)))});function nK($){return FM[$]}function CM($,Z){return TM[$][Z]}var SM=new Set(["routing-reset","start-fire","add-oauth-start","add-oauth-finish"]),kM=new Set(["opencode","pi"]),WZ=Object.getOwnPropertyDescriptor(AbortSignal.prototype,"aborted")?.get;function c6($,Z,J){return Object.freeze({status:"refused",code:$,...Z!==void 0?{action:Z}:{},...J!==void 0?{parameter:J}:{}})}function m8($,Z){if($===null||typeof $!=="object")return"malformed";if(a9.isProxy($))return"malformed";let J=Object.getPrototypeOf($);if(J!==Object.prototype&&J!==null)return"malformed";let X=new Map,Y=!1;for(let G of Reflect.ownKeys($)){if(typeof G!=="string")return"malformed";let z=Reflect.getOwnPropertyDescriptor($,G);if(!z||!Object.hasOwn(z,"value"))return"malformed";if(!Z.includes(G))Y=!0;else X.set(G,z.value)}return Y?"unknown-key":X}function vM($){if($===null||typeof $!=="object")return;if(a9.isProxy($))return;if(!Array.isArray($))return;if(Object.getPrototypeOf($)!==Array.prototype)return;let J=Reflect.getOwnPropertyDescriptor($,"length")?.value;if(typeof J!=="number")return;if(Reflect.ownKeys($).length!==J+1)return;let Y=[];for(let G=0;G<J;G++){let z=Reflect.getOwnPropertyDescriptor($,String(G));if(!z||!Object.hasOwn(z,"value"))return;Y.push(z.value)}return Y}function VZ($){return/\S/.test($)}function T4($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0&&!Object.is($,-0)}function fM($){return T4($)&&$<=23}function EM($){try{let Z=new URL($.trim());return(Z.protocol==="http:"||Z.protocol==="https:")&&!Z.username&&!Z.password}catch{return!1}}function bM($){return typeof $==="string"&&VZ($)}var gM=["account","fh","sd","scoped"];function yM($){let Z=vM($);if(!Z||Z.length===0)return;let J=[];for(let X of Z){let Y=m8(X,gM);if(!(Y instanceof Map))return;let G=Y.get("account"),z=Y.get("fh"),Q=Y.get("sd"),K=Y.get("scoped");if(!bM(G))return;if(!T4(z)||!T4(Q))return;if(K!==void 0&&!T4(K))return;J.push(Object.freeze(K===void 0?{account:G,fh:z,sd:Q}:{account:G,fh:z,sd:Q,scoped:K}))}return Object.freeze(J)}var v0={ok:!1,code:"missing-parameter"},K0={ok:!1,code:"invalid-parameter"},d2={ok:!0,present:!1};function j9($){return{ok:!0,present:!0,value:$}}function hM($,Z,J){let X=!Z||J===void 0||J===null;switch($.kind){case"account-id":if(X)return v0;if(typeof J!=="string")return K0;return VZ(J)?j9(J):v0;case"text":{if(X)return $.required?v0:d2;if(typeof J!=="string")return K0;if(!VZ(J))return $.required?v0:d2;if($.id==="apiKey"&&/\s/.test(J))return K0;if($.id==="baseURL"&&!EM(J))return K0;return j9(J)}case"choice":if(X)return $.required?v0:d2;if(typeof J!=="string")return K0;return $.choices.includes(J)?j9(J):K0;case"number":if(X)return v0;return fM(J)?j9(J):K0;case"limit-entries":{if(X)return v0;let Y=yM(J);return Y?j9(Y):K0}default:return $}}function mM($){if($===null||typeof $!=="object")return"malformed";if(a9.isProxy($)||!WZ)return"malformed";try{Reflect.apply(WZ,$,[])}catch{return"malformed"}return $}function uM($){return $!==void 0&&WZ!==void 0?Reflect.apply(WZ,$,[])===!0:!1}var pM=["interactive","custodyMode","confirmed","sessionId","signal"];function cM($){let Z=m8($,pM);if(!(Z instanceof Map))return;let J=Z.get("interactive"),X=Z.get("custodyMode"),Y=Z.get("confirmed"),G=Z.get("sessionId"),z=Z.get("signal");if(typeof J!=="boolean")return;if(X!=="local"&&X!=="claustrum")return;if(Y!==void 0&&typeof Y!=="boolean")return;if(G!==void 0&&typeof G!=="string")return;let Q;if(z!==void 0){let K=mM(z);if(K==="malformed")return;Q=K}return{interactive:J,custodyMode:X,confirmed:Y===!0,...G!==void 0&&VZ(G)?{sessionId:G}:{},...Q!==void 0?{signal:Q}:{}}}function p6($){return{kind:"done",result:$}}function lM($,Z,J){let X=m8(Z,["action","values"]);if(!(X instanceof Map))return p6(c6("invalid-request"));let Y=X.get("action");if(typeof Y!=="string")return p6(c6("invalid-request"));let G=$.get(Y);if(!G)return p6(c6("unsupported-action"));let z=cM(J);if(!z)return p6(c6("invalid-context",G.id));if(z.custodyMode==="claustrum"&&S5(G.id))return p6(c6("vault-managed",G.id));if(z.custodyMode==="local"&&aK(G.id))return p6(c6("vault-not-connected",G.id));if(G.interactive&&!z.interactive)return p6(c6(G.headlessRefusal,G.id));let Q=X.get("values"),K=G.parameters.map((j)=>j.id),W=Q===void 0?new Map:m8(Q,K);if(W==="malformed")return p6(c6("invalid-request",G.id));if(W==="unknown-key")return p6(c6("unknown-parameter",G.id));let V={};for(let j of G.parameters){let x=hM(j,W.has(j.id),W.get(j.id));if(!x.ok)return p6(c6(x.code,G.id,j.id));if(x.present)V[j.id]=x.value}if(G.id==="cachekeep-window"&&V.startHour===V.endHour)return p6(c6("invalid-parameter",G.id,"endHour"));if(G.destructive&&!z.confirmed)return p6(c6("confirmation-required",G.id));let B=SM.has(G.id);if(B&&z.sessionId===void 0)return p6(c6("session-required",G.id));if(uM(z.signal))return p6(c6("aborted",G.id));if(G.kind==="setup-guidance")return p6(Object.freeze({status:"guidance",action:G.id,mode:V.mode,instructions:G.setupInstructions}));let q=Object.freeze(z.signal!==void 0?{signal:z.signal}:{});if(G.kind==="vault-disconnect")return{kind:"disconnect",options:q};let H=Object.freeze({action:G.id,values:Object.freeze(V),...B?{sessionId:z.sessionId}:{}});return{kind:"dispatch",action:G.id,request:H,options:q}}var dM=new Set(["disconnected","idle","busy","conflict"]);function iM($,Z){let J=m8(Z,["ok","text"]),X=J instanceof Map?J.get("ok"):void 0,Y=J instanceof Map?J.get("text"):void 0;if(typeof X!=="boolean"||typeof Y!=="string")return Object.freeze({status:"failed",action:$,code:"invalid-outcome"});return Object.freeze({status:"executed",action:$,ok:X,text:Y})}function i2($){return TypeError(`Native menu executor option ${$} is invalid`)}function sM($){let Z=m8($,["host","dispatch","disconnectVault"]);if(!(Z instanceof Map))throw TypeError("Native menu executor options are invalid");let J=Z.get("host"),X=Z.get("dispatch"),Y=Z.get("disconnectVault");if(!kM.has(J))throw i2("host");if(typeof X!=="function"||a9.isProxy(X))throw i2("dispatch");if(Y!==void 0&&(typeof Y!=="function"||a9.isProxy(Y)))throw i2("disconnectVault");let G=new Map;for(let K of nK(J))if(K.kind!=="vault-disconnect"||Y!==void 0)G.set(K.id,K);let z=async(K)=>{let W;try{W=await Reflect.apply(Y,void 0,[K])}catch{return Object.freeze({status:"failed",action:"vault-disconnect",code:"execution-failed"})}if(!dM.has(W))return Object.freeze({status:"failed",action:"vault-disconnect",code:"invalid-outcome"});return Object.freeze({status:"disconnect",action:"vault-disconnect",result:W})};return Object.freeze({execute:Object.freeze(async(K,W)=>{let V;try{V=lM(G,K,W)}catch{return c6("invalid-request")}if(V.kind==="done")return V.result;if(V.kind==="disconnect")return z(V.options);let B;try{B=await Reflect.apply(X,void 0,[V.request,V.options])}catch{return Object.freeze({status:"failed",action:V.action,code:"execution-failed"})}return iM(V.action,B)})})}function oK($){return $&&typeof $==="object"&&!Array.isArray($)?$:{}}function jC($,Z,J){return{...$,[Z]:{...oK($[Z]),...J}}}function HC($){let{startHour:Z,endHour:J,...X}=oK($.cacheKeep);return{...$,cacheKeep:{...X,enabled:!0,always:!0}}}var tM=[/\b[\w-]*(?:secret|token|password|passwd|api[_-]?key|authorization|verifier)["']?\s*[:=]\s*["']?(?:(?:Bearer|Basic)\s+)?[^\s"'&,;}]+/gi,/\b[0-9a-fA-F]{32,}\b/g];function aM($={}){let{redactStrings:Z}=k9({...$,extraValuePatterns:[...tM,...$.extraValuePatterns??[]]});return(J)=>Z(J)}function nM($){return $===null||typeof $==="string"||typeof $==="boolean"||typeof $==="number"&&Number.isFinite($)}function oM($){if($===null||typeof $!=="object"||Array.isArray($))return;let Z=$;if(typeof Z.command!=="string"||typeof Z.sectionId!=="string"||typeof Z.actionId!=="string")return;if(Z.itemId!==void 0&&typeof Z.itemId!=="string")return;if(Z.sessionId!==void 0&&typeof Z.sessionId!=="string")return;if(Z.confirmed!==void 0&&typeof Z.confirmed!=="boolean")return;let J={};if(Z.values!==void 0){if(Z.values===null||typeof Z.values!=="object"||Array.isArray(Z.values))return;for(let[X,Y]of Object.entries(Z.values)){if(!nM(Y))return;Object.defineProperty(J,X,{value:Y,enumerable:!0,writable:!0,configurable:!0})}}return{command:Z.command,sectionId:Z.sectionId,actionId:Z.actionId,...typeof Z.itemId==="string"?{itemId:Z.itemId}:{},...Z.values!==void 0?{values:J}:{},...Z.confirmed===!0?{confirmed:!0}:{},...typeof Z.sessionId==="string"?{sessionId:Z.sessionId}:{}}}var eK="Accounts are managed in the vault. Disconnect from the vault to use local accounts.",tG="Account custody could not be read, so local account changes are unavailable.",rM={Accounts:"accounts",Quota:"quota",Routing:"routing",Limits:"limits",Cache:"cache",Diagnostics:"diagnostics",Extras:"extra"};function aG($,Z){if($===null||typeof $!=="object"||rK.isProxy($))return;try{let J=Object.getOwnPropertyDescriptor($,Z);return J&&"value"in J?J.value:void 0}catch{return}}function nG($){if($===null||typeof $!=="object"||rK.isProxy($))return!1;try{if(Array.isArray($))return!1;let Z=Object.getPrototypeOf($);if(Z!==Object.prototype&&Z!==null)return!1;return Reflect.ownKeys($).every((J)=>{let X=Object.getOwnPropertyDescriptor($,J);return X!==void 0&&"value"in X})}catch{return!1}}function eM($){switch($.kind){case"choice":return{kind:"choice",id:$.id,label:$.id,choices:[...!$.required?[{value:"",label:"Default"}]:[],...$.choices.map((Z)=>({value:Z,label:Z}))]};case"number":return{kind:"number",id:$.id,label:$.id,required:!0,min:0,max:23};case"account-id":return{kind:"text",id:$.id,label:"Account ID (copy the complete ID from status)",required:!0};case"text":return{kind:"text",id:$.id,label:$.id,required:$.required,masked:$.protectedEntry};case"limit-entries":return{kind:"text",id:$.id,label:"Threshold rows as JSON: account, fh, sd, optional scoped",required:!0,placeholder:'[{"account":"main","fh":5,"sd":10,"scoped":0}]'}}}var $W={code:"true",client_id:NZ,response_type:"code",redirect_uri:J7,scope:gz.join(" "),code_challenge_method:"S256"},oG=[...Object.keys($W),"code_challenge","state"],$I=new Set(Object.values(fz)),ZI=/^[A-Za-z0-9_-]{43}$/,JI=/^[0-9a-f]{32}$/;function XI($){let Z;try{Z=new URL($)}catch{return!1}if(Z.href!==$||$.includes("#")||Z.username!==""||Z.password!==""||!$I.has(`${Z.origin}${Z.pathname}`))return!1;let J=[...Z.searchParams.keys()];if(J.length!==oG.length||!oG.every((X)=>J.includes(X)))return!1;return Object.entries($W).every(([X,Y])=>Z.searchParams.get(X)===Y)&&ZI.test(Z.searchParams.get("code_challenge")??"")&&JI.test(Z.searchParams.get("state")??"")}function YI($,Z){let J=new Set(($.match(/https:\/\/\S+/g)??[]).filter(XI)),[X]=J;if(J.size!==1||X===void 0)return Z($);return $.split(X).map(Z).join(X)}var GI={disconnected:{ok:!0,text:"Disconnected from the vault. This host uses local accounts again."},idle:{ok:!0,text:"This host has no active vault enrollment."},busy:{ok:!1,code:"busy",text:"Vault disconnect could not finish because another process is changing this host's enrollment. Try again."},conflict:{ok:!1,code:"conflict",text:"Disconnect stopped: this host already has a different stored sign-in, so it and the sign-in saved when the host joined the vault were both kept, and the vault connection remains. Resolve the two sign-ins with offline setup."}};function zI($){switch($.status){case"executed":return{ok:$.ok,text:$.text,...!$.ok?{code:"refused"}:{}};case"guidance":return{ok:!0,text:`Offline ${$.mode} setup guidance (nothing changed):
-${$.instructions.join(`
-`)}`};case"disconnect":return GI[$.result];case"failed":return{ok:!1,code:$.code,text:"Action failed."};case"refused":if($.code==="vault-managed")return{ok:!1,code:$.code,text:`Action refused: ${eK}`};if($.code==="vault-not-connected")return{ok:!1,code:$.code,text:"Action refused: this host is not connected to the vault."};return{ok:!1,code:$.code,text:`Action refused: ${$.code}${$.parameter?` (${$.parameter})`:""}.`,...$.code==="confirmation-required"?{needsConfirmation:!0}:{}}}}function NC($){let{host:Z,dispatch:J,readStatus:X,readMode:Y,disconnectVault:G,interactive:z}=$;if(typeof Y!=="function")throw TypeError("Native UI requires a custody mode reader");if(typeof G!=="function")throw TypeError("Native UI requires a vault disconnect callback");let Q=nK(Z),K=sM({host:Z,dispatch:J,disconnectVault:G}),W=new Set(Q.flatMap((j)=>j.parameters.flatMap((x)=>x.kind==="text"&&x.protectedEntry?[x.id]:[]))),V=aM({extraValuePatterns:[/sk-ant-[A-Za-z0-9_-]+/g]});function B(j,x=V){let{sessionId:L,notify:U}=j;return{...L!==void 0?{sessionId:L}:{},notify:(M,A)=>U(x(M),A)}}async function q(){try{let j=await Y();return j==="local"||j==="claustrum"?j:void 0}catch{return}}async function H(j,x=V,L=!0){let U=B(j,x),M=await q(),A=CM(Z,M??"claustrum"),_=[];for(let N of A.groups){let R=[];if(N.id==="Accounts"&&M!=="local")R.push(M==="claustrum"?eK:tG);if(N.id==="Accounts"&&M==="claustrum"&&$.readAccounts)try{let S=await $.readAccounts();for(let E of S.accounts)if(E.source==="vault"&&E.state==="needs_reauth"&&E.credentialId)R.push(x(`${E.label||E.id} (${E.credentialId}) needs signing in again. Run: ck auth login --provider anthropic --id ${E.credentialId} --replace`))}catch{R.push("Vault sign-in status unavailable; reopen /claude to retry.")}for(let S of N.statuses){if(!L){R.push(`${S.label}: status unavailable.`);continue}try{R.push(x(await X(S.command,U)))}catch{R.push(`${S.label}: status unavailable.`)}}_.push({id:N.id,slot:rM[N.id],title:N.id,lines:R,items:[],actions:N.actions.map((S)=>({id:S.id,label:S.label,knobs:S.parameters.map(eM),...S.destructive?{confirm:{message:S.confirm,irreversible:S.kind!=="vault-disconnect"}}:{},...S.kind==="setup-guidance"?{description:"Offline guidance only; no settings are changed."}:{}}))})}return{command:"claude",title:"Claude",sections:_}}return{command:"claude",async open(j){return{command:"claude",menu:await H(B(j))}},async apply(j,x){let L=B(x),U,M=aG(j,"values"),A=nG(j)&&(M===void 0||nG(M));try{U=A?oM(j):void 0}catch{U=void 0}let _=Q.find((c)=>c.id===U?.actionId&&c.group===U?.sectionId),N={...U?.values},R=[];for(let c of W)for(let I of[N,M]){let O=aG(I,c);if(typeof O==="string"&&O.length>0)R.push(O)}let S=(c)=>{let I=c;for(let O of R)I=I.split(O).join("[REDACTED]");return V(I)},E=async(c,I=!1)=>({command:"claude",...c,text:I?YI(c.text,S):S(c.text),menu:await H(L,S,A)});if(U?.command!=="claude"||!_||U.itemId!==void 0||U.sessionId!==void 0&&U.sessionId!==L.sessionId)return E({ok:!1,code:"invalid-request",text:"Invalid menu request."});for(let c of _.parameters){if(c.kind==="choice"&&!c.required&&N[c.id]==="")N[c.id]=null;if(c.kind==="limit-entries"&&typeof N[c.id]==="string")try{let I=JSON.parse(String(N[c.id]));N[c.id]=I}catch{return E({ok:!1,code:"invalid-parameter",text:"Threshold rows must be valid JSON."})}}let m=await q();if(m===void 0&&S5(_.id))return E({ok:!1,code:"custody-unavailable",text:`Action refused: ${tG}`});let s=await K.execute({action:_.id,values:N},{interactive:z,custodyMode:m??"claustrum",confirmed:U.confirmed,sessionId:L.sessionId});return E(zI(s),s.status==="executed"&&s.action==="add-oauth-start"&&s.ok&&R.length===0)}}}function QI($){if(!($ instanceof Error))return!1;if($.name==="NativeCustodyError")return!0;if($.name!=="NativeRuntimeError")return!1;let Z=Reflect.get($,"code");return Z==="publication-refused"||Z==="unsafe-runtime"||Z==="invalid-runtime"}var KI=new Set(["Error","NativeCustodyError","NativeRuntimeError","LockContentionError"]),WI=new Set(["closed","not-enrolled","invalid-token","unavailable","identity-changed","identity-unasserted","insufficient-validity","invalid-material","not-active","route-unavailable","route-declined","no-receipt","unsafe-file","invalid-state","wrong-consumer","roster-busy","host-slot-login","host-slot-placeholder","placeholder-refresh","publication-refused","unsafe-runtime","invalid-runtime","runtime-io","runtime-conflict","EIO","ENOENT","EACCES","EPERM","ENOSPC"]);function VI($,Z){let J="warn",X="unknown",Y="unknown";try{if(QI(Z))J="error";if(Z instanceof Error){if(KI.has(Z.name))X=Z.name;let G=Reflect.get(Z,"code");if(typeof G==="string"&&WI.has(G))Y=G}}catch{}a[J]($,"Account usage publication unavailable",{name:X,code:Y})}function UC($){let Z=new Set,J=(X)=>{let Y=X.then(()=>{},(G)=>VI($,G));return Z.add(Y),Y.then(()=>Z.delete(Y),()=>Z.delete(Y)),Y};return{observe:J,publish(X){J(new Promise((Y)=>setTimeout(Y,0)).then(X))},async drain(){while(Z.size)await Promise.allSettled([...Z])}}}var BI="No vault account can serve this request. Open /claude to see which account needs signing in again.";class KJ extends Error{constructor(){super(BI);this.name="NativeVaultNoAccountError"}}var s2=new WeakMap;function ZW($){return $.accounts.some((Z)=>Z.source==="vault"&&Z.type==="oauth"&&Z.enabled&&Z.state==="active")}async function xC($,Z){Z?.throwIfAborted();let J=await $.read();if(Z?.throwIfAborted(),J.mode!=="claustrum")return J;let X=Boolean((await $.vault.read())?.view);if(Z?.throwIfAborted(),X&&ZW(J))return J;let Y=s2.get($);if(!Y)Y=qI($,X).finally(()=>s2.delete($)),s2.set($,Y);return jI(Y,Z)}async function qI($,Z){let J=new AbortController,X=setTimeout(()=>J.abort(),2000),Y=J.signal;try{while(!Y.aborted){let G;try{G=await $.vault.refresh(Y)}catch{if(Z||Y.aborted)break}if(G?.view){let z=await $.read();if(z.mode!=="claustrum"||ZW(z))return z;throw new KJ}if(Z)break;if(Y.aborted)break;await new Promise((z)=>{let Q=()=>{clearTimeout(K),Y.removeEventListener("abort",Q),z()},K=setTimeout(Q,25);if(Y.addEventListener("abort",Q,{once:!0}),Y.aborted)Q()})}throw new KJ}finally{clearTimeout(X)}}function jI($,Z){if(!Z)return $;return new Promise((J,X)=>{let Y=()=>X(Z.reason);if(Z.addEventListener("abort",Y,{once:!0}),$.then(J,X).finally(()=>Z.removeEventListener("abort",Y)),Z.aborted)Y()})}var UI="common-auth-placeholder";function xI($){return`${UI}.${$}`}var wI=30000,F4=1e4,RI=3000,WJ,D9=new Map;process.once("exit",()=>{for(let[$,Z]of D9)try{if(Z.renewedAt+F4<Date.now())continue;let J=_I($);if(VJ(J,Z)&&J.mtime.getTime()===Z.mtime)II($)}catch{}});function VJ($,Z){return $.dev===Z.dev&&$.ino===Z.ino}function n9($){return typeof $==="object"&&$!==null&&"code"in $?$.code:void 0}function Zz(){return Object.assign(Error("Pi auth lock held"),{code:"ELOCKED"})}async function BJ($){try{await AI($)}catch(Z){if(n9(Z)!=="ENOENT")throw Z}}async function qJ($,Z){try{await PI($)}catch(J){if(n9(J)!=="EEXIST")throw J;if(Z<=0)throw Zz();let X;try{X=(await BZ($)).mtime.getTime()}catch(Y){if(n9(Y)==="ENOENT")return qJ($,0);throw Y}if(!(X<Date.now()-Z))throw Zz();return await BJ($),qJ($,0)}try{if(!WJ){let Y=new Date(Math.ceil(Date.now()/1000)*1000+5);await YW($,Y,Y)}let J=await BZ($),X=J.mtime.getTime();return WJ??=X%1000===0?"s":"ms",{dev:J.dev,ino:J.ino,mtime:X}}catch(J){throw await BJ($).catch(()=>{}),J}}async function TI($,Z,J){let X=`${$}.lock`,Y=await qJ(X,wI),G=Y.mtime,z=Date.now(),Q=!1,K;D9.set(X,{...Y,renewedAt:z});function W(){if(Q=!0,K)clearTimeout(K);D9.delete(X),Z()}function V(){if(!Q&&z+F4<Date.now())W()}function B(j=RI){if(Q)return;K=setTimeout(()=>{H()},j),K.unref()}function q(j){if(Q)return;if(n9(j)==="ENOENT"||z+F4<Date.now())W();else B(1000)}async function H(){if(V(),Q)return;let j;try{j=await BZ(X)}catch(L){q(L);return}if(V(),Q)return;if(!VJ(j,Y)||j.mtime.getTime()!==G){W();return}let x=new Date(WJ==="s"?Math.ceil(Date.now()/1000)*1000:Date.now());try{await YW(X,x,x)}catch(L){q(L);return}if(Q)return;G=x.getTime(),z=Date.now(),D9.set(X,{...Y,mtime:G,renewedAt:z}),B()}return J?.(async()=>{if(K)clearTimeout(K);await H()}),B(),{assertFresh:V,async release(){if(Q)return;if(Q=!0,K)clearTimeout(K);D9.delete(X);let j=()=>z+F4<Date.now();if(j()){W();return}let x;try{x=await BZ(X)}catch(L){if(n9(L)!=="ENOENT")throw L;W();return}if(j()||!VJ(x,Y)||G!==x.mtime.getTime()){W();return}await BJ(X)}}}class D6 extends Error{code;constructor($){super(`Pi slot: ${$}`);this.code=$,this.name="PiSlotError"}}function FI($){let Z=$.indexOf("{")+1,J={offset:Z-1,children:[]},X=()=>{while(/\s/.test($[Z]??"")&&Z<$.length)Z++},Y=()=>{Z++;while(Z<$.length){if($[Z++]==='"')return;if($[Z-1]==="\\")Z++}};X();while($[Z]!=="}"){let G=Z;Y();let z=JSON.parse($.slice(G,Z));X(),Z++,X();let Q=Z,K=0;while(Z<$.length){let V=$[Z];if(V==='"'){Y();continue}if(V==="{"||V==="[")K++;if(V==="}"||V==="]"){if(K===0)break;K--}if(V===","&&K===0)break;Z++}let W=Z;while(/\s/.test($[W-1]??""))W--;if(J.children.push({key:z,offset:G,length:W-G,value:{offset:Q,length:W-Q}}),X(),$[Z]==="}")break;Z++,X()}return J}function o9($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function jJ($){if(Array.isArray($))return`[${$.map(jJ).join(",")}]`;if(o9($))return`{${Object.keys($).sort().map((Z)=>`${JSON.stringify(Z)}:${jJ($[Z])}`).join(",")}}`;return JSON.stringify($)}function F$($){return DI("sha256").update(jJ($)).digest("hex")}function O9($){return o9($)?$.code:void 0}async function Jz($,Z=!1,J){if(r)try{await J?.($);let Y=await JQ($,!0),G=Y.toString("utf8");if(!Y.equals(Buffer.from(G)))throw new D6(Z?"invalid-stash":"invalid-auth");return G}catch(Y){if(O9(Y)==="ENOENT")return;throw Y}let X;try{X=await XW($,rG.O_RDONLY|rG.O_NOFOLLOW);let Y=await X.stat();if(!Y.isFile()||Z&&(Y.mode&511)!==384)throw new D6("unsafe-path");await J?.($);let G=await JW($);if(!G.isFile()||G.dev!==Y.dev||G.ino!==Y.ino)throw new D6("unsafe-path");let z=await X.readFile(),Q=z.toString("utf8");if(!z.equals(Buffer.from(Q)))throw new D6(Z?"invalid-stash":"invalid-auth");return Q}catch(Y){if(O9(Y)==="ENOENT"&&!X)return;if(O9(Y)==="ELOOP"||O9(Y)==="ENOENT")throw new D6("unsafe-path");throw Y}finally{await X?.close()}}function CI($,Z){try{let J=JSON.parse($);if(!o9(J))throw Error();let X=FI($),Y=X.children,G=Y.map((K)=>K.key);if(new Set(G).size!==G.length)throw Error();let z=Y.find((K)=>K.key===Z),Q=z?J[Z]:null;if(Q!==null&&!o9(Q))throw Error();if(z&&Q===null)throw Error();return{text:$,root:X,property:z,entry:Q}}catch{throw new D6("invalid-auth")}}function SI($){let Z=$.property?.value;return Z?$.text.slice(Z.offset,Z.offset+Z.length):null}function Xz($,Z,J){let{text:X,root:Y,property:G}=$,z=Y.children??[];if(G){let W=G.value;if(!W)throw new D6("invalid-auth");if(J!==null)return X.slice(0,W.offset)+J+X.slice(W.offset+W.length);let V=z.indexOf(G),B=z[V-1],q=z[V+1],H=B?B.offset+B.length:G.offset,j=!B&&q?q.offset:G.offset+G.length;return X.slice(0,H)+X.slice(j)}if(J===null)return X;let Q=z.at(-1),K=Q?Q.offset+Q.length:Y.offset+1;return`${X.slice(0,K)}${Q?",":""}${JSON.stringify(Z)}:${J}${X.slice(K)}`}async function kI($){if(r)return;let Z=await XW($,"r");try{await Z.sync()}finally{await Z.close()}}async function t2($,Z,J,X){await l8($,null,{serialize:()=>Z,durable:!0,durability:r?"file-only-on-windows":void 0,beforeRename:async()=>{await X?.($),J()}})}function vI($){return fI($)}function fI($,Z,J){let{provider:X,placeholderKey:Y}=$,G=$.lockTimeoutMs??30000;if(!X||!$.authPath||!$.stashPath||!Y||Y.startsWith("!")||Y.includes("$")||!Number.isFinite(G)||G<0)throw new D6("invalid-options");let z=$z($.authPath),Q=$z($.stashPath);if(z===Q||Q===`${z}.lock`)throw new D6("invalid-options");let K=F$(z),W=F$(Y),V={type:"api_key",key:Y},B=(L)=>F$(L)===F$(V);async function q(){let L=await Jz(Q,!0,J?.afterReadCheck);if(L===void 0)return;try{let U=JSON.parse(L);if(U.version!==1||U.provider!==X||U.authIdentity!==K||U.placeholderIdentity!==W||U.entry!==null&&!o9(U.entry)||U.sha256!==F$(U.entry)||(U.entry===null?U.entryJson!==null:typeof U.entryJson!=="string"||F$(JSON.parse(U.entryJson))!==U.sha256))throw Error();return U}catch{throw new D6("invalid-stash")}}async function H(L){let U,M,A=!1,_=()=>{if(M?.(),A)throw new D6("lock-compromised")};try{if(r)await s$(N8(z));else await eG(N8(z),{recursive:!0,mode:448});let N=Date.now()+G,R=0;while(!U)try{let E=await TI(z,()=>{A=!0},J?.onRenew);U=E.release,M=E.assertFresh}catch(E){if(O9(E)!=="ELOCKED")throw E;let m=N-Date.now();if(m<=0)throw new D6("lock-timeout");await MI(Math.min(Math.round(Math.min(10*2**R++,1000)*(1+Math.random())),m))}_();let S=await L(_);return _(),S}catch(N){if(N instanceof D6||N instanceof y6)throw N;throw new D6("io")}finally{await U?.().catch(()=>{}),_()}}async function j(){let L=CI(await Jz(z,!1,J?.afterReadCheck)??"{}",X),U=await q();return{auth:L,stash:U}}async function x(L){L(),await OI(Q),await kI(N8(Q)),Z?.("stash-deleted")}return{inspect:()=>H(async()=>{let{auth:L,stash:U}=await j();return{slot:B(L.entry)?"placeholder":L.entry===null?"empty":!U||F$(L.entry)===U.sha256?"original":"foreign",stash:U?"valid":"missing"}}),enterVault:()=>H(async(L)=>{let{auth:U,stash:M}=await j();if(B(U.entry)){if(!M)throw new D6("missing-stash");return}if(M&&F$(U.entry)!==M.sha256)throw new D6("conflict");if(!M){if(r)await s$(N8(Q));else{await eG(N8(Q),{recursive:!0,mode:448});let _=await JW(N8(Q));if(!_.isDirectory()||(_.mode&511)!==448)throw new D6("unsafe-path")}let A={version:1,provider:X,authIdentity:K,placeholderIdentity:W,entry:U.entry,entryJson:SI(U),sha256:F$(U.entry)};await t2(Q,JSON.stringify(A),L,J?.beforeRename),Z?.("stash-written")}await t2(z,Xz(U,X,JSON.stringify(V)),L,J?.beforeRename),Z?.("auth-written")}),exitVault:()=>H(async(L)=>{let{auth:U,stash:M}=await j();if(!M){if(B(U.entry))throw new D6("missing-stash");return"nothing-to-do"}if(B(U.entry))await t2(z,Xz(U,X,M.entryJson),L,J?.beforeRename),Z?.("auth-written");else if(F$(U.entry)!==M.sha256)return"conflict";return await x(L),"restored"})}}function EI($){return{authPath:NI($.authPath),stashPath:LI(HI(z1("pi",$.env).tokenPath),"pi-auth-slot","anthropic.json"),provider:"anthropic",placeholderKey:xI("anthropic")}}function RC($){return vI(EI($))}async function TC($){if($.host==="pi"&&await $.slot.exitVault()==="conflict")return"conflict";return UD(z1($.host,$.env),`anthropic-auth-${$.host}`)}var pI=60000,GW=60000,cI=21600000,lI=90000,dI=300000;function iI($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="on")return{type:"enable"};if(Z.length===1&&Z[0]==="off")return{type:"disable"};return{type:"usage"}}function HJ($){if(!$)return 0;return($.inputTokens*xY.input+$.outputTokens*xY.output)/1e6}function sI($,Z,J){if(J?.label?.trim())return J.label;if($==="main")return"main";let X=Z?.accounts?.find((Y)=>Y.id===$);if(X?.label?.trim())return X.label;return $}function tI($,Z){let J=Z?.transient,X=$?.quota?.mainQuota,Y=$?.prime?.main,G={id:"main",label:"main",nextDueAt:zz(X?.five_hour),lastPrimedAt:J?.get("main")?.lastPrimedAt??null,lastResult:J?.get("main")?.lastResult,usage:Y,estimatedCostUsd:HJ(Y)},z=($?.accounts??[]).filter(n0).filter((Q)=>Q.id!=="main").filter((Q)=>Q.enabled!==!1).map((Q)=>({id:Q.id,label:sI(Q.id,$,Q),nextDueAt:zz(Q.quota?.five_hour),lastPrimedAt:J?.get(Q.id)?.lastPrimedAt??null,lastResult:J?.get(Q.id)?.lastResult,usage:Q.prime,estimatedCostUsd:HJ(Q.prime)}));return[G,...z]}function zz($){if(!$?.resetsAt)return;let Z=Date.parse($.resetsAt);if(!Number.isFinite(Z))return;return Z+GW}function V4($){let J=[$.enabled?"## Claude Prime Status":"## Claude Prime Disabled",""];J.push(`Status: ${$.enabled?"enabled":"disabled"}`),J.push(""),J.push("Accounts:");for(let X of $.accounts){let G=X.usage?.count??0,z=aI(X.nextDueAt),Q=nI(X.lastPrimedAt,X.lastResult),K=[`${X.label}`];if(z)K.push(`next prime ${z}`);if(Q)K.push(Q);if(G>0)K.push(`${G} ${G===1?"prime":"primes"} ≈ $${oI(X.estimatedCostUsd??0)}`);J.push(`- ${K.join(" · ")}`)}return J.push(""),J.push("Usage: `/claude-prime on`, `/claude-prime off`, or status."),J.join(`
-`)}function aI($){if(typeof $!=="number")return"";return new Date($).toLocaleTimeString([],{hour:"2-digit",minute:"2-digit"})}function nI($,Z){if(typeof $!=="number")return"";let J=new Date($).toLocaleTimeString([],{hour:"2-digit",minute:"2-digit"});if(Z==="error")return`primed ${J} err`;if(Z==="skipped")return`primed ${J} skipped`;return`primed ${J} ✓`}function oI($){if($===0)return"0";if($<0.0001)return $.toExponential(2);return $.toFixed(Math.min(6,Math.max(0,4)))}function fC($){let Z=iI($.argumentsText);if(Z.type==="status")return{text:V4({enabled:$.enabled,accounts:$.accounts})};if(Z.type==="enable")return{text:V4({enabled:!0,accounts:$.accounts}),updated:{enabled:!0}};if(Z.type==="disable")return{text:V4({enabled:!1,accounts:$.accounts}),updated:{enabled:!1}};return{text:["## Claude Prime Usage","","Usage: `/claude-prime`, `/claude-prime on`, or `/claude-prime off`.","",V4({enabled:$.enabled,accounts:$.accounts})].join(`
-`)}}var rI={"not-oauth":"API-key account",disabled:"disabled","needs-reauth":"needs re-login",killswitch:"killswitch"};function eI($){if(!$.isOAuth)return{eligible:!1,reason:"not-oauth"};if(!$.isEnabled)return{eligible:!1,reason:"disabled"};if($.hasPermanentRefreshError)return{eligible:!1,reason:"needs-reauth"};return{eligible:!0}}function Qz($){return rI[$]}var $_={model:n3,max_tokens:1,system:"Reply with 1 when you receive 0.",messages:[{role:"user",content:"0"}]};function EC(){return JSON.parse(JSON.stringify($_))}function Kz(){return t8(mI(),"opencode-anthropic-auth","prime")}function Z_($){let Z=uI($),J;try{J=gI(Z)}catch(X){if(X.code!=="ENOENT")throw X;J=Z}return bI("sha256").update(J).digest("hex").slice(0,12)}function zW($,Z){return t8($,Z_(Z))}function J_($,Z,J){if(!/^[a-f0-9]{12,}$/i.test(J))throw Error("Prime account fingerprint must be a hexadecimal digest");return t8(zW($,Z),J.toLowerCase().slice(0,12))}function Wz($,Z,J){return t8($,`${encodeURIComponent(Z)}-${J}`)}function Vz($,Z){return t8($,`${encodeURIComponent(Z)}-bootstrap`)}function a2($,Z){if($==="main")return"main";if(Z&&"label"in Z&&Z.label?.trim())return Z.label;return $}function X_($){let Z=[],J=$.refresh?.mainLastRefreshError;Z.push({id:"main",label:"main",isOAuth:!0,isEnabled:!0,hasPermanentRefreshError:v4(J),storedQuota:$.quota?.mainQuota,storedFiveHour:$.quota?.mainQuota?.five_hour});for(let X of $.accounts??[]){if(X.id==="main"){a.debug("prime","ineligible",{account:a2(X.id,X),reason:"reserved-id"});continue}if(!n0(X)){Z.push({id:X.id,label:a2(X.id,X),isOAuth:!1,isEnabled:X.enabled!==!1,hasPermanentRefreshError:!1});continue}Z.push({id:X.id,label:a2(X.id,X),isOAuth:!0,isEnabled:X.enabled!==!1,hasPermanentRefreshError:v4(X.lastRefreshError),storedQuota:X.quota,storedFiveHour:X.quota?.five_hour})}return Z}function Bz($){if(!$?.resetsAt)return;let Z=Date.parse($.resetsAt);return Number.isFinite(Z)?Z:void 0}class Y_{timer=null;setIntervalImpl;clearIntervalImpl;setTimeoutImpl;clearTimeoutImpl;postFireRefreshTimers=new Set;lastForcedCheck=new Map;stopped=!1;options;transient=new Map;counters=new Map;windowActive=new Map;constructor($){this.options=$,this.setIntervalImpl=$.setIntervalImpl??globalThis.setInterval,this.clearIntervalImpl=$.clearIntervalImpl??globalThis.clearInterval,this.setTimeoutImpl=$.setTimeoutImpl??globalThis.setTimeout,this.clearTimeoutImpl=$.clearTimeoutImpl??globalThis.clearTimeout}updateOptions($){this.options=$}start(){if(this.timer)return;if(this.stopped=!1,a.trace("prime","manager started"),this.timer=this.setIntervalImpl(()=>{this.tick().catch(()=>{a.warn("prime","tick failed")})},pI),typeof this.timer==="object"&&"unref"in this.timer)this.timer.unref?.()}stop(){let $=this.timer!==null,Z=this.postFireRefreshTimers.size>0;if(this.stopped=!0,this.timer)this.clearIntervalImpl(this.timer),this.timer=null;for(let J of this.postFireRefreshTimers)this.clearTimeoutImpl(J);if(this.postFireRefreshTimers.clear(),this.lastForcedCheck.clear(),!$&&!Z)return;a.trace("prime","manager stopped")}isStopped(){return this.stopped}async tick(){let $=this.options.now?.()??Date.now();if(a.trace("prime","tick start",{now:$}),await this.sweepMarkers($),this.stopped){a.trace("prime","tick: stopped, aborting");return}let Z=await this.options.loadStorage();if(!Z){a.trace("prime","tick: no storage, skipping");return}if(Z.prime?.enabled!==!0){a.trace("prime","tick: feature disabled, skipping");return}let J=X_(Z);await Promise.all(J.map((X)=>this.runForAccount(X,Z,$))),a.trace("prime","tick end")}stats($,Z){let J=tI($??null,{now:Z,transient:this.transient});if(this.counters.size===0)return J;return J.map((X)=>{let Y=this.counters.get(X.id);if(!Y)return X;return{...X,usage:Y,estimatedCostUsd:HJ(Y)}})}isWindowActive($){return this.windowActive.has($)}async runForAccount($,Z,J){try{if(this.stopped)return;let X=eI({storage:Z,accountId:$.id,isOAuth:$.isOAuth,isEnabled:$.isEnabled,hasPermanentRefreshError:$.hasPermanentRefreshError,quota:$.storedQuota});if(!X.eligible){a.debug("prime","ineligible",{account:$.label,reason:Qz(X.reason)});return}let Y=Bz($.storedFiveHour);if(Y!==void 0&&J<Y+GW){a.trace("prime","not due",{account:$.label});return}let G=await this.options.getAccountFingerprint($.id);if(!G){a.debug("prime","credential identity unavailable",{account:$.label});return}let z=`${$.id}:${G.toLowerCase().slice(0,12)}`,Q=this.markerDir(G),K=Vz(Q,$.id),W=Y===void 0?K:Wz(Q,$.id,Y);try{await Gz(W);return}catch(M){if(M.code!=="ENOENT")throw M}if(Y===void 0&&await this.hasAnyClaimMarker($.id,G))return;if(this.stopped)return;let V=this.lastForcedCheck.get(z);if(V!==void 0&&V.resetEpoch===Y&&J<V.at+dI)return;this.lastForcedCheck.set(z,{at:J,resetEpoch:Y});let B;try{B=await this.options.refreshQuota($.id)}catch{a.warn("prime","refresh failed",{account:$.label});return}if(this.stopped)return;let q=await this.options.loadStorage();if(q?.prime?.enabled!==!0)return;let H=B.quota;if(!B.fresh){a.debug("prime","stale fresh-check",{account:$.label});return}if(!oz(H,q,$.id,n3)){a.debug("prime","ineligible",{account:$.label,reason:Qz("killswitch")});return}let j=Bz(H?.five_hour);if(j!==void 0&&j>J){a.debug("prime","window active",{account:$.label,resetsAt:H.five_hour?.resetsAt}),this.windowActive.set($.id,J);return}this.windowActive.delete($.id);let x=j??Y,L=x===void 0?await this.tryClaimBootstrap($.id,G):await this.tryClaim($.id,G,x);if(!L){a.debug("prime","claim lost",{account:$.label,marker:`${$.id}-${x??"bootstrap"}`});return}let U=await this.options.loadStorage();if(this.stopped||U?.prime?.enabled!==!0){await W4(L,{force:!0});return}if(x!==void 0){if(await W4(K,{force:!0}),this.stopped){await W4(L,{force:!0});return}}await this.fire($,J,U)}catch{a.warn("prime","account evaluation failed",{account:$.label})}}async tryClaim($,Z,J){let X=this.markerDir(Z),Y=Wz(X,$,J);return this.tryClaimPath(X,Y)}async tryClaimBootstrap($,Z){let J=this.markerDir(Z),X=Vz(J,$);return this.tryClaimPath(J,X)}async tryClaimPath($,Z){try{await yI($,{recursive:!0})}catch{}try{return await hI(Z,"",{encoding:"utf8",flag:"wx"}),Z}catch(J){if(J.code==="EEXIST")return null;throw J}}async hasAnyClaimMarker($,Z){let J=this.markerDir(Z),X=`${encodeURIComponent($)}-`;try{return(await Yz(J)).some((Y)=>Y.startsWith(X))}catch(Y){if(Y.code==="ENOENT")return!1;throw Y}}async fire($,Z,J){let X;try{X=await this.options.sendPrime($.id)}catch{a.warn("prime","prime fire threw",{account:$.label}),this.transient.set($.id,{lastPrimedAt:Z,lastResult:"error"});return}if(this.stopped)return;if(!X.ok){if(X.reason==="token-refresh")a.warn("prime","prime token refresh failed",{account:$.label,reason:"token-refresh"});else if(X.reason==="vault-cold")a.debug("prime","prime vault credential cold",{account:$.label,reason:X.reason});else a.warn("prime","prime fire failed",{account:$.label,status:X.status,reason:"send"});this.transient.set($.id,{lastPrimedAt:Z,lastResult:X.reason==="vault-cold"?"skipped":"error"});return}let Y={inputTokens:X.usage?.inputTokens,outputTokens:X.usage?.outputTokens};try{let G=await this.options.recordSuccess($.id,Y);if(this.stopped){this.transient.delete($.id),this.counters.delete($.id);return}this.counters.set($.id,G),this.transient.set($.id,{lastPrimedAt:Z,lastResult:"ok"}),a.info("prime","prime fired",{account:$.label,status:X.status,ms:X.ms,usage:{inputTokens:G.inputTokens,outputTokens:G.outputTokens}}),this.schedulePostFireRefresh($)}catch{a.warn("prime","recordSuccess failed",{account:$.label}),this.transient.set($.id,{lastPrimedAt:Z,lastResult:"error"})}}schedulePostFireRefresh($){let Z=this.setTimeoutImpl(()=>{if(this.postFireRefreshTimers.delete(Z),this.stopped)return;(async()=>{let J=await this.options.loadStorage();if(this.stopped||J?.prime?.enabled!==!0)return;await this.options.refreshQuota($.id)})().catch(()=>{a.debug("prime","post-fire refresh failed",{account:$.label})})},lI);if(this.postFireRefreshTimers.add(Z),typeof Z==="object"&&"unref"in Z)Z.unref?.()}async sweepMarkers($){let Z=this.storageMarkerDir(),J=await this.sweepMarkerDirectory(Z,$);if(J>0)a.trace("prime","swept stale markers",{swept:J})}async sweepMarkerDirectory($,Z){let J;try{J=await Yz($)}catch{return 0}let X=0;for(let Y of J)try{let G=t8($,Y),z=await Gz(G);if(z.isDirectory()){X+=await this.sweepMarkerDirectory(G,Z);continue}if(Z-z.mtimeMs>cI)await W4(G,{force:!0}),X+=1}catch{}return X}storageMarkerDir(){return zW(this.options.markerDir??Kz(),this.options.storagePath)}markerDir($){return J_(this.options.markerDir??Kz(),this.options.storagePath,$)}}var M8=3,o2=180000;function r2(){return process.env.OPENCODE_ANTHROPIC_AUTH_QUOTA_FEED_DIR??C4(V_(),"opencode-anthropic-auth","quota-header-feed")}function mC($){return($.storage?.accounts.filter(n0).length??0)+($.mainOAuthConfigured?1:0)}function QW($){if($.schema_version!==M8||$.provider!=="anthropic")return!1;if(!Number.isFinite($.configured_account_count)||!Number.isFinite($.observed_at_ms))return!1;if(!$.quota||typeof $.quota!=="object")return!1;if(!Object.hasOwn($,"anthropic_account_uuid")||$.anthropic_account_uuid!==null&&typeof $.anthropic_account_uuid!=="string")return!1;if($.identity_source==="none")return!("credential_id"in $)&&!("account_ref"in $);if($.identity_source==="credential_id")return typeof $.credential_id==="string"&&$.credential_id.length>0&&$.credential_id!=="main"&&!("account_ref"in $);if($.identity_source==="account_ref")return typeof $.account_ref==="string"&&$.account_ref.length>0&&$.account_ref!=="main"&&!("credential_id"in $);return!1}function B_($){if($.schema_version!==M8||$.provider!=="anthropic"||!QW($))throw Error("Invalid quota header feed entry")}function k8($){return typeof $==="number"&&Number.isFinite($)}function LJ($){if(!$||typeof $!=="object")return;let Z=$;if(!k8(Z.usedPercent)||!k8(Z.remainingPercent)||!k8(Z.checkedAt))return;return{usedPercent:Z.usedPercent,remainingPercent:Z.remainingPercent,...typeof Z.resetsAt==="string"&&{resetsAt:Z.resetsAt},checkedAt:Z.checkedAt}}function q_($){if(!$||typeof $!=="object")return;let Z=$,J=LJ(Z);if(!J||typeof Z.id!=="string"||!Z.id.trim()||typeof Z.title!=="string"||!Z.title.trim()||typeof Z.modelName!=="string"||!Z.modelName.trim())return;return{...J,id:Z.id,title:Z.title,...typeof Z.modelId==="string"&&Z.modelId.trim()&&{modelId:Z.modelId},modelName:Z.modelName}}function Nz($){if(!$||typeof $!=="object")return;let Z=$;if(!k8(Z.amountMinor)||typeof Z.currency!=="string"||!Z.currency.trim()||!k8(Z.exponent))return;return{amountMinor:Z.amountMinor,currency:Z.currency,exponent:Z.exponent}}function j_($){if(!$||typeof $!=="object")return;let Z=$,J=Nz(Z.used),X=Nz(Z.limit);if(!J||!X||typeof Z.exhausted!=="boolean")return;return{used:J,limit:X,...k8(Z.utilizationPercent)&&{utilizationPercent:Z.utilizationPercent},...typeof Z.severity==="string"&&{severity:Z.severity},exhausted:Z.exhausted}}function H_($,Z){if(!$||typeof $!=="object")return;let J=$,X={};for(let Y of UZ){if(!Z.has(Y))continue;let G=J[Y];if(G==="poll"||G==="headers")X[Y]=G}return Object.keys(X).length>0?X:void 0}function L_($){let Z=LJ($.five_hour),J=LJ($.seven_day),X=Array.isArray($.scoped)?$.scoped.map(q_).filter((Q)=>Q!=null):void 0,Y=j_($.extraUsage),G=new Set;if(Z)G.add("five_hour");if(J)G.add("seven_day");if(typeof $.bindingWindow==="string")G.add("bindingWindow");if(typeof $.fallbackAdvised==="boolean")G.add("fallbackAdvised");if(X)G.add("scoped");if(Y)G.add("extraUsage");let z=H_($.fieldSources,G);return{...Z&&{five_hour:Z},...J&&{seven_day:J},...typeof $.bindingWindow==="string"&&{bindingWindow:$.bindingWindow},...typeof $.fallbackAdvised==="boolean"&&{fallbackAdvised:$.fallbackAdvised},...X&&{scoped:X},...Y&&{extraUsage:Y},...z&&{provenance:z}}}class N_{options;filePath;writeChain=Promise.resolve();constructor($={}){this.options=$;let Z=$.instanceId??`${process.pid}-${qz()}`;this.filePath=C4($.directory??r2(),`${Z}.json`)}publish($){let{accountKey:Z,quota:J}=$;try{B_($)}catch(G){return Promise.reject(G)}let Y={...$.identity_source==="credential_id"?{identity_source:"credential_id",credential_id:$.credential_id}:$.identity_source==="account_ref"?{identity_source:"account_ref",account_ref:$.account_ref}:{identity_source:"none"},schema_version:$.schema_version,provider:$.provider,configured_account_count:$.configured_account_count,observed_at_ms:$.observed_at_ms,anthropic_account_uuid:$.anthropic_account_uuid,quota:L_(J)};if(!Z)return Promise.reject(Error("Invalid quota header feed account key"));return this.writeChain=this.writeChain.catch(()=>{}).then(async()=>{let G=this.options.directory??r2();await z_(G,{recursive:!0,mode:448}),await jz(G,448),await this.reapStaleSiblingLeases(G);let z={};try{let K=JSON.parse(await Lz(this.filePath,"utf8"));if(K.version===M8&&K.entries&&typeof K.entries==="object")z=K.entries}catch{}z[Z]=Y;let Q=`${this.filePath}.${qz()}.tmp`;try{await W_(Q,`${JSON.stringify({version:M8,lease_horizon_ms:this.options.leaseMs??o2,entries:z})}
-`,{mode:384}),await jz(Q,384),await Q_(Q,this.filePath)}finally{await n2(Q,{force:!0})}}),this.writeChain}async reapStaleSiblingLeases($){let Z=this.options.now?.()??Date.now(),J=this.options.leaseMs??o2,X;try{X=await Hz($)}catch{return}await Promise.all(X.filter((Y)=>/^\d+-[0-9a-f-]+\.json$/i.test(Y)).map(async(Y)=>{let G=C4($,Y);if(G===this.filePath)return;try{let z=await K_(G);if(z.mtimeMs>Z||Z-z.mtimeMs<J)return;await this.options.beforeRemoveFile?.(G);let Q=await G_(G);if(Q.ino!==z.ino||Q.mtimeMs!==z.mtimeMs)return;await(this.options.removeFile??((K)=>n2(K)))(G)}catch{}}))}async list(){await this.writeChain.catch(()=>{});let $=this.options.directory??r2(),Z=this.options.now?.()??Date.now(),J=this.options.leaseMs??o2,X;try{X=(await Hz($)).filter((G)=>G.endsWith(".json"))}catch{return[]}let Y=new Map;return await Promise.all(X.map(async(G)=>{try{let z=JSON.parse(await Lz(C4($,G),"utf8"));if(z.version!==M8||!z.entries||typeof z.entries!=="object")return;for(let[Q,K]of Object.entries(z.entries)){if(!K||typeof K!=="object"||K.schema_version!==M8||K.provider!=="anthropic"||!QW(K))continue;let W=K.observed_at_ms;if(W>Z||Z-W>=J)continue;let V=Y.get(Q);if(!V||W>V.observed_at_ms)Y.set(Q,K)}}catch{}})),[...Y.values()].sort((G,z)=>G.observed_at_ms-z.observed_at_ms)}async dispose(){await this.writeChain.catch(()=>{}),await n2(this.filePath,{force:!0})}}var r9="anthropic-ratelimit-unified-",KW={"5h":"five_hour","7d":"seven_day"};function uC($){return Object.keys(KW).some((Z)=>Number.isFinite(NJ($,`${r9}${Z}-utilization`)))}function NJ($,Z){let J=$.get(Z);if(J==null||J.trim()==="")return;let X=Number(J);return Number.isFinite(X)?X:void 0}function U_($,Z,J){let X=NJ($,`${r9}${Z}-utilization`);if(X==null)return;let Y=Math.min(100,Math.max(0,Math.round(X*100))),G=NJ($,`${r9}${Z}-reset`),z=G==null?void 0:new Date(G*1000),Q=z&&Number.isFinite(z.getTime())?z.toISOString():void 0;return{usedPercent:Y,remainingPercent:100-Y,...Q&&{resetsAt:Q},checkedAt:J}}function pC($,Z=Date.now()){let J={},X=$.get(`${r9}fallback`),Y={fallbackAdvised:X==="available",source:"headers",checkedAt:Z};for(let[z,Q]of Object.entries(KW)){let K=U_($,z,Z);if(K)Y[Q]=K,J[Q]="headers"}let G=$.get(`${r9}representative-claim`);if(G)Y.bindingWindow=G,Y.bindingWindowSource="headers",J.bindingWindow="headers";if(X!==null)J.fallbackAdvised="headers";return{...Y,fieldSources:J}}function S4($,Z){let{scoped:J,extraUsage:X,fieldSources:Y,...G}=$??{},{scoped:z,extraUsage:Q,fieldSources:K,...W}=Z,V={};for(let B of UZ){let q=B==="scoped"?J:B==="extraUsage"?X:B==="fallbackAdvised"?K?.fallbackAdvised!==void 0?Z.fallbackAdvised:$?.fallbackAdvised??Z.fallbackAdvised:B==="bindingWindow"?$?.bindingWindowSource==="poll"?$?.bindingWindow:Z.bindingWindow??$?.bindingWindow:Z[B]??$?.[B];if(q===void 0)continue;let H=B==="fallbackAdvised"?K?.fallbackAdvised??($?.fallbackAdvised!==void 0?Y?Y.fallbackAdvised:V0($,B):void 0):(B==="scoped"||B==="extraUsage")&&q!==void 0?"poll":B==="bindingWindow"&&$?.bindingWindowSource==="poll"&&$.bindingWindow!==void 0?"poll":Z[B]!==void 0?K?.[B]??V0(Z,B):Y?.[B]??V0($,B);if(H)V[B]=H}return{...G,...W,...Array.isArray(J)&&{scoped:J},...X!=null&&{extraUsage:X},fallbackAdvised:K?.fallbackAdvised!==void 0?Z.fallbackAdvised:$?.fallbackAdvised??Z.fallbackAdvised,bindingWindow:$?.bindingWindowSource==="poll"?$.bindingWindow:Z.bindingWindow??$?.bindingWindow,bindingWindowSource:$?.bindingWindowSource==="poll"?"poll":Z.bindingWindowSource??$?.bindingWindowSource,...Object.keys(V).length>0&&{fieldSources:V},source:"headers"}}var x_=globalThis.setTimeout;function Uz($,Z){if($?.source!=="headers")return Z;let J=Boolean($.five_hour&&$.five_hour.checkedAt>(Z.five_hour?.checkedAt??0)),X=Boolean($.seven_day&&$.seven_day.checkedAt>(Z.seven_day?.checkedAt??0));if(!J&&!X)return Z;return S4(Z,{...J&&{five_hour:$.five_hour},...X&&{seven_day:$.seven_day},fallbackAdvised:$.fallbackAdvised,...$.bindingWindowSource==="headers"&&{bindingWindow:$.bindingWindow,bindingWindowSource:$.bindingWindowSource},source:"headers",checkedAt:Math.max(J?$.five_hour?.checkedAt??0:0,X?$.seven_day?.checkedAt??0:0)})}class E0{main=null;mainAccountId;mainQuotaIdentityKnown=!1;mainQuotaIdentityStrict=!1;mainGeneration=0;mainQuotaErrorGeneration=0;mainQuotaErrorClearedAt;fallbacks=new Map;fallbackAuthLineages=new Map;fallbackGenerations=new Map;inflightMain=null;lastMainPollAttempt;inflightMainAccountId;inflightMainAccessToken;inflightMainToken=0;inflightFallbacks=new Map;mainLastApiError=void 0;fallbackApiErrors=new Map;apiGate=Promise.resolve();lastApiCallAt;storage;fetchImpl;fetchQuotaSnapshot;now;onMainQuotaFetched;onApiError;onFallbackQuotaFetched;onFallbackApiError;constructor($){this.storage=$.storage,this.fetchImpl=$.fetchImpl??fetch,this.fetchQuotaSnapshot=$.fetchQuotaSnapshot,this.now=$.now??Date.now,this.onMainQuotaFetched=$.onMainQuotaFetched,this.onApiError=$.onApiError,this.onFallbackQuotaFetched=$.onFallbackQuotaFetched,this.onFallbackApiError=$.onFallbackApiError,this.seedMainFromStorage($.storage,$.storage?.mainAccountId),this.seedMainBackoffFromStorage($.storage)}getMain($){if(this.mainAccountId!==$)return null;if(this.mainQuotaIdentityKnown&&this.mainQuotaIdentityStrict&&($===void 0||this.main?.quota.accountIdentity!==$))return null;return this.main}getFallback($,Z){return this.bindFallbackLineage($,Z),this.fallbacks.get($)??null}canFetchWithoutAccessToken(){return Boolean(this.fetchQuotaSnapshot)}getAllFallbacks(){return this.fallbacks}setMain($,Z){this.mainAccountId=$,this.main=Z}clearMain(){this.mainAccountId=void 0,this.main=null}setMainQuotaAccountIdentity($,Z=!0,J=!1){let X=this.mainQuotaIdentityKnown,Y=this.mainAccountId,G=J||!X||this.mainAccountId!==$||this.mainQuotaIdentityStrict!==Z;if(this.mainQuotaIdentityKnown=!0,this.mainQuotaIdentityStrict=Z,!G)return;if(this.mainGeneration+=1,this.mainAccountId=$,J)this.main=null,this.mainLastApiError=void 0,this.mainQuotaErrorGeneration+=1,this.mainQuotaErrorClearedAt=X9(this.mainQuotaErrorClearedAt,this.now());else if($!==void 0&&this.main?.quota.accountIdentity!==$)this.main=null;if($!==void 0&&this.mainLastApiError&&(this.mainLastApiError.accountIdentity!==void 0?this.mainLastApiError.accountIdentity!==$:X&&Y!==void 0&&Y!==$))return this.mainLastApiError=void 0,this.mainQuotaErrorGeneration+=1,this.mainQuotaErrorClearedAt=X9(this.mainQuotaErrorClearedAt,this.now()),this.mainQuotaErrorGeneration;return}setFallback($,Z,J){this.bindFallbackLineage($,J),this.fallbacks.set($,Z)}clearFallback($){this.fallbackGenerations.set($,(this.fallbackGenerations.get($)??0)+1),this.fallbacks.delete($),this.fallbackApiErrors.delete($),this.inflightFallbacks.delete(E0.fallbackInflightKey($))}pushMainFromHeaders($,Z){let J=Z.checkedAt??this.now(),X=S4(this.mainAccountId===$&&(!this.mainQuotaIdentityKnown||!this.mainQuotaIdentityStrict||this.main?.quota.accountIdentity===$)?this.main?.quota:void 0,{...Z,...$!==void 0&&{accountIdentity:$}}),Y={quota:X,checkedAt:J,refreshAfter:q8(X,this.storage,J)};return this.setMain($,Y),Y}pushFallbackFromHeaders($,Z,J){if(!this.acceptFallbackQuotaObservation($,J))return null;let X=Z.checkedAt??this.now(),Y=S4(this.fallbacks.get($)?.quota,{...Z,accountIdentity:$}),G={quota:Y,checkedAt:X,refreshAfter:q8(Y,this.storage,X)};return this.fallbacks.set($,G),G}async refreshMain($,Z,J){let X=$,Y=Z??$;if(!Y&&!this.canFetchWithoutAccessToken())throw Error("Main OAuth access token is unavailable");return(await this.refreshMainWithMetadata(X,Y,J)).quota}async refreshMainWithMetadata($,Z,J){let X=$,Y=Z??$;if(!Y&&!this.canFetchWithoutAccessToken())throw Error("Main OAuth access token is unavailable");if(J!==void 0&&(this.mainGeneration!==J||this.mainAccountId!==X))throw Error("Main quota identity changed before refresh");if(this.mainAccountId!==X){if(this.main=null,this.mainAccountId=X,this.mainQuotaIdentityKnown)this.mainGeneration+=1}if(this.inflightMain&&this.inflightMainAccountId===X&&this.inflightMainAccessToken===Y)return this.inflightMain;if(this.isBackedOff()){if(this.main&&this.mainAccountId===X)return{quota:this.main.quota,fetched:!1};throw Error("Quota API rate-limited — try again later")}this.inflightMainAccountId=X,this.inflightMainAccessToken=Y;let G=this.mainGeneration,z=++this.inflightMainToken;return this.inflightMain=this._fetchMain(X,Y??"",G,z),this.inflightMain}async refreshFallback($,Z,J){return(await this.refreshFallbackWithMetadata($,Z,J)).quota}async refreshFallbackWithMetadata($,Z,J){if(!Z&&!this.canFetchWithoutAccessToken())throw Error("Fallback OAuth access token is unavailable");this.bindFallbackLineage($,J);let X=E0.fallbackInflightKey($),Y=this.inflightFallbacks.get(X);if(Y)return Y;if(this.isFallbackBackedOff($)){let Q=this.getFallback($);if(Q)return{quota:Q.quota,fetched:!1};throw Error("Quota API rate-limited — try again later")}let G=this.fallbackGenerations.get($)??0,z=this._fetchFallback($,Z,G,J);return this.inflightFallbacks.set(X,z),z.then(()=>{if(this.inflightFallbacks.get(X)===z)this.inflightFallbacks.delete(X)},()=>{if(this.inflightFallbacks.get(X)===z)this.inflightFallbacks.delete(X)}),z}async refreshAllFallbacks($,Z){let J=this.now();for(let X of $){if(X.enabled===!1)continue;let Y=Z!==void 0?Z(X):X.access&&X.expires!==void 0&&X.expires>J?X.access:void 0;if(!Y)continue;this.bindFallbackLineage(X.id,X);let G=this.getFallback(X.id);if(G&&J<G.refreshAfter)continue;try{await this.refreshFallback(X.id,Y,X)}catch{}}}refreshMainInBackground($){if(this.inflightMain)return;if(this.isBackedOff())return;this.refreshMain(this.mainAccountId,$).catch(()=>{})}scopedWindowIsStale($,Z){let J=r$($.quota,Z);return Boolean(J&&this.now()-J.checkedAt>=I9(this.storage))}isMainStale($){if(!this.main)return!0;if(this.mainQuotaIdentityKnown&&this.mainQuotaIdentityStrict&&(this.mainAccountId===void 0||this.main.quota.accountIdentity!==this.mainAccountId))return!0;return this.now()>=this.main.refreshAfter||this.scopedWindowIsStale(this.main,$)||this.main.quota.source==="headers"&&this.main.quota.scoped===void 0&&(this.lastMainPollAttempt===void 0||this.lastMainPollAttempt.accountId!==this.mainAccountId||this.now()-this.lastMainPollAttempt.at>=I9(this.storage))}isFallbackStale($,Z,J,X){let Y=this.getFallback($,X);if(!Y)return!0;return this.now()>=Y.refreshAfter||this.scopedWindowIsStale(Y,J)}shouldRefreshOnRequestCount($){let Z=gB(this.storage);if(Z<=0)return!1;return $>0&&$%Z===0}needsRefresh($,Z){return this.isMainStale(Z)||this.shouldRefreshOnRequestCount($)}updateStorage($){this.storage=$,this.seedMainFromStorage($,this.mainQuotaIdentityKnown?this.mainAccountId:$?.mainAccountId),this.seedMainBackoffFromStorage($)}seedMainFromStorage($,Z){let J=bB($);if(!J)return;let X={quota:{...J.quota,...(!this.mainQuotaIdentityKnown||!this.mainQuotaIdentityStrict)&&Z!==void 0&&J.accountIdentity===void 0&&{accountIdentity:Z}},refreshAfter:q8(J.quota,$,J.checkedAt),checkedAt:J.checkedAt},Y=this.main&&this.mainAccountId===Z&&(!this.mainQuotaIdentityKnown||!this.mainQuotaIdentityStrict||this.main.quota.accountIdentity===Z)?this.main:void 0;if(Y&&Y.checkedAt>=X.checkedAt&&Y.quota.source==="headers"&&X.quota.source==="poll"){let G=S4(X.quota,Y.quota);this.main={quota:G,refreshAfter:q8(G,$,Y.checkedAt),checkedAt:Y.checkedAt};return}if(this.main&&this.mainAccountId===Z&&this.main.checkedAt>=X.checkedAt)return;if(this.main=X,Z!==void 0)this.mainAccountId=Z}seedMainBackoffFromStorage($){let Z=$?.quota?.mainLastQuotaApiError,J=Z?.accountIdentity,X=typeof $?.quota?.mainQuotaErrorGeneration==="number"&&Number.isSafeInteger($.quota.mainQuotaErrorGeneration)&&$.quota.mainQuotaErrorGeneration>=0?$.quota.mainQuotaErrorGeneration:void 0,Y=typeof $?.quota?.mainQuotaErrorClearedAt==="number"&&Number.isFinite($.quota.mainQuotaErrorClearedAt)&&$.quota.mainQuotaErrorClearedAt>=0?$.quota.mainQuotaErrorClearedAt:void 0;if(Y!==void 0&&(this.mainQuotaErrorClearedAt===void 0||Y>this.mainQuotaErrorClearedAt)){if(this.mainQuotaErrorClearedAt=X9(this.mainQuotaErrorClearedAt,Y),(!Z||typeof Z.checkedAt==="number"&&Z.checkedAt<=Y)&&(this.mainLastApiError?.checkedAt===void 0||this.mainLastApiError.checkedAt<=Y))this.mainLastApiError=void 0}if(X!==void 0&&X>this.mainQuotaErrorGeneration){if(this.mainQuotaErrorGeneration=X,!Z&&(this.mainLastApiError?.checkedAt===void 0||this.mainQuotaErrorClearedAt===void 0||this.mainLastApiError.checkedAt<=this.mainQuotaErrorClearedAt))this.mainLastApiError=void 0}if(Z&&(!this.mainQuotaIdentityKnown||J===void 0||J===this.mainAccountId)&&(this.mainQuotaErrorClearedAt===void 0||typeof Z.checkedAt!=="number"||Z.checkedAt>this.mainQuotaErrorClearedAt)&&(this.mainLastApiError?.checkedAt===void 0||Z.checkedAt>=this.mainLastApiError.checkedAt)&&p1(Z,this.now())){if(this.mainLastApiError=Z,X!==void 0)this.mainQuotaErrorGeneration=X;return}if(this.mainAccountId!==void 0&&this.mainLastApiError?.accountIdentity!==void 0&&this.mainLastApiError.accountIdentity!==this.mainAccountId)this.mainLastApiError=void 0}seedFallbacksFromAccounts($){let Z=I9(this.storage),J=new Set($.map((X)=>X.id));for(let X of this.fallbackAuthLineages.keys())if(!J.has(X))this.clearFallback(X),this.fallbackAuthLineages.delete(X);for(let X of $){if(this.bindFallbackLineage(X.id,X))continue;if(X.enabled===!1)continue;let G=X.lastQuotaRefreshError,z=o0(X.quota),Q=this.fallbackApiErrors.get(X.id);if(G&&p1(G,this.now())&&z<=(G.checkedAt??0)&&(!Q||G.checkedAt>=Q.checkedAt))this.fallbackApiErrors.set(X.id,G);else if(Q&&z>=Q.checkedAt)this.fallbackApiErrors.delete(X.id);if(!X.quota)continue;let K=o0(X.quota);if(K<=0)continue;let W=this.getFallback(X.id);if(W&&W.checkedAt>=K)continue;this.setFallback(X.id,{quota:{...X.quota,accountIdentity:X.id},refreshAfter:K+Z,checkedAt:K},X)}}isBackedOff(){return p1(this.mainLastApiError,this.now())}isFallbackBackedOff($){return p1(this.fallbackApiErrors.get($),this.now())}getLastApiError(){return this.mainLastApiError}getMainQuotaErrorGeneration(){return this.mainQuotaErrorGeneration}getMainQuotaIdentityGeneration(){return this.mainGeneration}getMainQuotaErrorClearedAt(){return this.mainQuotaErrorClearedAt}clearMainBackoff(){if(!this.mainLastApiError)return;return this.mainLastApiError=void 0,this.mainQuotaErrorGeneration+=1,this.mainQuotaErrorClearedAt=X9(this.mainQuotaErrorClearedAt,this.now()),this.mainQuotaErrorGeneration}static API_CALL_GAP_MS=1000;static fallbackInflightKey($){return $}static quotaLockName($){return`opencode-fallback-quota-refresh-${$.replace(/[^a-zA-Z0-9._-]+/g,"-")||"account"}`}bindFallbackLineage($,Z){if(!Z)return!1;let J=this.fallbackAuthLineages.has($),X=this.fallbackAuthLineages.get($),Y=J&&Z.authLineageId!==void 0&&X!==Z.authLineageId;if(Y)this.clearFallback($);return this.fallbackAuthLineages.set($,Z.authLineageId),Y}acceptFallbackQuotaObservation($,Z){let J=this.fallbackAuthLineages.has($),X=this.fallbackAuthLineages.get($),Y=Z?.authLineageId;if(J&&X!==Y)return a.trace("quota","skipped stale fallback quota observation after lineage change",{accountId:$,storedLineage:X,servedLineage:Y}),!1;if(!J)this.fallbackAuthLineages.set($,Y);return!0}isClosed=!1;close(){this.isClosed=!0,this.inflightFallbacks.clear(),this.inflightMain=null}_enqueueApiFetch($){let Z=async()=>{if(this.isClosed)throw Error("QuotaManager is closed");return $()},J=this.apiGate.then(Z,Z);return this.apiGate=J.catch(()=>{}),J}_quotaDispatch($,Z){return async(J,X)=>{if(this.lastApiCallAt!==void 0){let G=E0.API_CALL_GAP_MS-(this.now()-this.lastApiCallAt);if(G>0)await new Promise((z)=>{let Q=x_(z,G);if(typeof Q==="object"&&"unref"in Q)Q.unref()})}if(this.isClosed)throw Error("QuotaManager is closed");if(await X(),await Z?.(),this.isClosed)throw Error("QuotaManager is closed");let Y=this.now();$?.(Y);try{return J()}finally{this.lastApiCallAt=this.now()}}}_quotaFetch($){return Object.assign((Z,J)=>$(()=>this.fetchImpl(Z,J),async()=>J?.signal?.throwIfAborted()),{preconnect:this.fetchImpl.preconnect})}async _fetchMain($,Z,J,X){return this._enqueueApiFetch(async()=>{try{if(this.isBackedOff()){if(this.main&&this.mainAccountId===$)return{quota:this.main.quota,fetched:!1};throw Error("Quota API rate-limited — try again later")}if(this.mainQuotaIdentityKnown&&this.mainQuotaIdentityStrict&&this.mainGeneration!==J)return{quota:{accountIdentity:$},fetched:!1};let Y=await g9({name:"opencode-main-quota-refresh",ttlMs:30000});if(!Y){let G=this.main;if(G&&this.mainAccountId===$&&this.now()<G.refreshAfter)return{quota:G.quota,fetched:!1};throw Error("Quota refresh is already in progress")}try{let G=this.lastMainPollAttempt,z,Q=this.now(),K=!1,W=this._quotaDispatch((H)=>{if(!K)Q=H;K=!0,z={accountId:$,at:H},this.lastMainPollAttempt=z},async()=>{if(await Y.assertOwned(),this.mainGeneration!==J)throw Error("Main quota identity changed before dispatch")}),V=this.fetchQuotaSnapshot?await this.fetchQuotaSnapshot({kind:"main",accountId:$,accessToken:Z},W):await b4({accessToken:Z,fetchImpl:this._quotaFetch(W),now:this.now});try{await Y.assertOwned()}catch{if(z&&this.lastMainPollAttempt===z)this.lastMainPollAttempt=G;return{quota:this.getMain($)?.quota??{accountIdentity:$},fetched:!1}}let B=this.now();if(this.mainQuotaIdentityKnown&&this.mainQuotaIdentityStrict&&this.mainGeneration!==J)return{quota:{...V,...$!==void 0&&{accountIdentity:$}},fetched:!0};let q=Uz(this.mainAccountId===$&&(!this.mainQuotaIdentityKnown||!this.mainQuotaIdentityStrict||this.main?.quota.accountIdentity===$)?this.main?.quota:void 0,{...V,...$!==void 0&&{accountIdentity:$}});if(this.mainAccountId=$,this.main={quota:q,refreshAfter:q8(q,this.storage,B),checkedAt:q.checkedAt??B},this.mainLastApiError)this.mainLastApiError=void 0,this.mainQuotaErrorGeneration+=1,this.mainQuotaErrorClearedAt=X9(this.mainQuotaErrorClearedAt,B);return this.onMainQuotaFetched?.(q,B,S$(Z),Q,this.mainQuotaErrorGeneration,this.mainQuotaErrorClearedAt),{quota:q,fetched:!0}}catch(G){throw this._handleMainFetchError(G,J),G}finally{await Y.release()}}finally{if(this.inflightMainToken===X)this.inflightMain=null,this.inflightMainAccountId=void 0}})}async _fetchFallback($,Z,J,X){return this._enqueueApiFetch(async()=>{try{if((this.fallbackGenerations.get($)??0)!==J)return{quota:{accountIdentity:$},fetched:!1};if(this.isFallbackBackedOff($)){let G=this.getFallback($,X);if(G)return{quota:G.quota,fetched:!1};throw Error("Quota API rate-limited — try again later")}let Y=await g9({name:E0.quotaLockName($),ttlMs:30000});if(!Y){let G=this.getFallback($,X);if(G&&this.now()<G.refreshAfter)return{quota:G.quota,fetched:!1};throw Error("Quota refresh is already in progress")}try{let G=this.now(),z=!1,Q=this._quotaDispatch((B)=>{if(!z)G=B;z=!0},async()=>{if(await Y.assertOwned(),(this.fallbackGenerations.get($)??0)!==J)throw Error("Fallback quota identity changed before dispatch")}),K=this.fetchQuotaSnapshot?await this.fetchQuotaSnapshot({kind:"fallback",accountId:$,accessToken:Z},Q):await b4({accessToken:Z,fetchImpl:this._quotaFetch(Q),now:this.now});try{await Y.assertOwned()}catch{return{quota:this.getFallback($,X)?.quota??{accountIdentity:$},fetched:!1}}let W=this.now();if((this.fallbackGenerations.get($)??0)!==J)return{quota:{...K,accountIdentity:$},fetched:!0};let V=Uz(this.getFallback($,X)?.quota,{...K,accountIdentity:$});return this.setFallback($,{quota:V,refreshAfter:q8(V,this.storage,W),checkedAt:V.checkedAt??W},X),this.fallbackApiErrors.delete($),this.onFallbackQuotaFetched?.($,V,W,G),{quota:V,fetched:!0}}finally{await Y.release()}}catch(Y){throw this._handleFallbackFetchError($,Y,J),Y}})}static isAuthError($){if($.status===401||EB($))return!0;let J=$ instanceof Error?$.message:String($);return/quota check failed: 401\b/.test(J)}_handleMainFetchError($,Z){if(this.mainGeneration!==Z)return;if(this.mainQuotaIdentityKnown&&this.mainQuotaIdentityStrict&&this.mainAccountId===void 0)return;if(E0.isAuthError($))return;this.mainLastApiError=Y7({error:$,now:this.now(),accountIdentity:this.mainAccountId,previous:this.mainLastApiError}),this.mainQuotaErrorGeneration+=1,this.onApiError?.(this.mainLastApiError,this.mainQuotaErrorGeneration)}_handleFallbackFetchError($,Z,J){if((this.fallbackGenerations.get($)??0)!==J)return;if(E0.isAuthError(Z))return;let X=this.fallbackApiErrors.get($),Y=Y7({error:Z,now:this.now(),previous:X,accountIdentity:$});this.fallbackApiErrors.set($,Y),this.onFallbackApiError?.($,Y)}}var xz={five_hour:"5h",seven_day:"1w"};function qZ($){return`${Math.round($*10)/10}%`}function jZ($,Z){let J=Math.max(0,Z-$),X=Math.floor(J/60000);if(X<1)return"just now";if(X===1)return"1m ago";if(X<60)return`${X}m ago`;let Y=Math.floor(X/60),G=X%60;if(G===0)return`${Y}h ago`;return`${Y}h ${G}m ago`}function D_($,Z){let J=Date.parse($);if(!Number.isFinite(J))return $;let X=J-Z;if(X<=0)return"now";let Y=Math.max(1,Math.ceil(X/60000));if(Y<60)return`in ${Y}m`;let G=Math.floor(Y/60),z=Y%60;if(z===0)return`in ${G}h`;return`in ${G}h ${z}m`}function WW($,Z){if(!$)return"";return`, resets ${D_($,Z)}`}function Dz($,Z,J,X){if(!Z)return`  - ${xz[$]}: unknown`;let Y=[`  - ${xz[$]}: ${qZ(Z.remainingPercent)} remaining`,` (${qZ(Z.usedPercent)} used`,`${WW(Z.resetsAt,J)}, checked ${jZ(Z.checkedAt,J)})`].join("");return X===$?`${Y} •`:Y}function Oz($){try{return new Intl.NumberFormat("en-US",{style:"currency",currency:$.currency,minimumFractionDigits:$.exponent,maximumFractionDigits:$.exponent}).format($.amountMinor/10**$.exponent)}catch{return`${$.amountMinor} ${$.currency}`}}function O_($,Z){return[`  - ${$.title}: ${qZ($.remainingPercent)} remaining`,` (${qZ($.usedPercent)} used`,`${WW($.resetsAt,Z)}, checked ${jZ($.checkedAt,Z)})`].join("")}function M_($){return $.label?.trim()||$.id}function I_($){return $.lastQuotaRefreshError?.message??$.lastRefreshError?.message}function cC($,Z=new Map){if(!$?.accounts.length)return[];return $.accounts.filter(n0).map((J)=>{let X=Z.get(J.id)??I_(J);return{name:M_(J),role:"fallback",enabled:J.enabled!==!1,quota:J.quota,...t4(J.profile)&&{tierLabel:t4(J.profile)},lastRefreshedAt:J.lastRefreshedAt,...X&&{error:X}}})}function lC($){let Z=$.now??Date.now(),J=["## Claude Quotas",""];if($.refreshedAt)J.push(`Refreshed: ${jZ($.refreshedAt,Z)}`,"");if(!$.accounts.length)return J.push("No Claude OAuth accounts found yet."),J.join(`
-`);for(let X of $.accounts){let Y=X.role==="main"?"main":"fallback",G=X.enabled===!1?" disabled":"";if(J.push(`### ${X.name} (${Y}${G})`),X.tierLabel)J.push(`  - Tier: ${X.tierLabel}`);if(X.lastRefreshedAt)J.push(`  - Last token refresh: ${jZ(X.lastRefreshedAt,Z)}`);if(X.error)J.push(`  - Error: ${X.error}`);J.push(Dz("five_hour",X.quota?.five_hour,Z,X.quota?.bindingWindow)),J.push(Dz("seven_day",X.quota?.seven_day,Z,X.quota?.bindingWindow));for(let Q of X.quota?.scoped??[]){let K=O_(Q,Z);J.push(X.quota?.bindingWindow===Q.id?`${K} •`:K)}let z=X.quota?.extraUsage;if(z){let Q=Oz(z.used),K=Oz(z.limit);J.push(`  - credits ${Q}/${K}${z.exhausted?" · exhausted":""}`)}if(X.quota?.fallbackAdvised===!0)J.push("  - → fallback advised");J.push("")}return J.join(`
-`).trimEnd()}class e9 extends Error{failure;constructor($){super("Relay request authorization failed");this.failure=$}}function w_($){let Z=[],J=$.authorization?.trim();if(J){Z.push(J);let Y=/^\S+\s+(\S.*)$/.exec(J)?.[1];if(Y)Z.push(Y)}let X=$["x-api-key"]?.trim();if(X)Z.push(X);return Z}async function k4($,Z,J,X){try{let Y=J?await J():void 0;if(Y)Z.upstream={...Z.upstream,headers:BW(Y.headers)};return{authorization:Y,scope:X([$.token,...w_(Z.upstream.headers),...Y?.errorSecrets??[]])}}catch(Y){throw new e9(Y)}}function H9($){return typeof $==="number"&&Number.isFinite($)?$:"unknown"}function R_($){let Z;try{Z=u8($)}catch{return"http"}if(Z===null||typeof Z!=="object"||Array.isArray(Z))return"http";return"stream"in Z&&Z.stream===!0?"event-stream":"http"}class UJ extends Error{}class HZ extends Error{}var T_="relay websocket response_start metadata is invalid",F_=new Set([101,103,204,205,304]);class xJ extends Error{code="ECONNRESET";syscall="websocket";closeCode;closeReason;wasClean;constructor($,Z){super($);this.name="RelayWebSocketConnectionResetError",this.closeCode=Z?.code,this.closeReason=Z?.reason,this.wasClean=Z?.wasClean}}var p$=new Map,m0=new Map;var C_=7200000,S_=1800000,k_=128,v_=32,Mz=0;function e2(){return Mz+=1,`req_${Date.now().toString(36)}_${Mz.toString(36)}`}function sC(){return A_(32).toString("base64url")}function f_($){return`sha256:${P_("sha256").update($).digest("hex")}`}function Iz($,Z){let J=0,X=Math.min($.length,Z.length);while(J<X&&$.charCodeAt(J)===Z.charCodeAt(J))J++;let Y=$.length,G=Z.length;while(Y>J&&G>J&&$.charCodeAt(Y-1)===Z.charCodeAt(G-1))Y--,G--;return{start:J,deleteCount:Y-J,insert:Z.slice(J,G)}}function E_($){return $.deleteCount===0&&$.insert.length===0}function _z($){let Z=$.match(/\bcch=([0-9a-f]{5});/),J=Z?.[1];if(!J||Z.index==null)return null;let X=Z.index+4;return{start:X,end:X+J.length,token:J}}function b_($,Z,J,X){return`${$.slice(0,Z)}${X}${$.slice(J)}`}function VW($,Z){let J=_z($),X=_z(Z);if(J&&X&&J.start===X.start&&J.end-J.start===X.end-X.start&&J.token!==X.token){let Y={start:J.start,deleteCount:J.end-J.start,insert:X.token},G=b_($,J.start,J.end,X.token),z=Iz(G,Z);return E_(z)?Y:[Y,z]}return Iz($,Z)}function g_($,Z){if(typeof Z!=="string")return!1;try{let J=$ instanceof Request?new URL($.url):new URL($.toString());return J.pathname==="/v1/messages"||J.pathname==="/messages"}catch{return!1}}function BW($){let Z={};for(let[J,X]of $.entries()){if(J==="x-session-affinity"||J==="x-opencode-session")continue;Z[J]=X}return Z}async function y_($,Z,J){let X=U6(),Y=JSON.stringify(Z);return D8("http_payload_stringify",{session:H6(Z.affinity),ms:e6(U6()-X),relayBytes:Y.length,mode:Z.mode}),fetch($.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":$.token},body:Y,signal:J??void 0})}function H6($){return $.length>12?`${$.slice(0,12)}…`:$}function U6(){return performance.now()}function e6($){return Math.round($*10)/10}function h_(){return process.env.OPENCODE_ANTHROPIC_AUTH_PERF==="1"}function D8($,Z){if(!h_())return;j6(`[perf] relay ${$} ${JSON.stringify(Z)}`)}function m_($){let{input:Z,init:J,headers:X,bodyText:Y,affinity:G,previous:z,nextHash:Q}=$,K=Z instanceof Request?Z.url:Z.toString(),W={protocol:1,type:"request",affinity:G,upstream:{url:K,method:J?.method||(Z instanceof Request?Z.method:"POST"),headers:BW(X)},next_hash:Q};return z?{...W,mode:"patch",base_hash:z.hash,revision:z.revision+1,patch:VW(z.body,Y)}:{...W,mode:"full_sync",revision:1,body:Y}}function DJ($,Z){return{protocol:$.protocol,type:"request",affinity:$.affinity,upstream:$.upstream,next_hash:$.next_hash,mode:"full_sync",revision:1,body:Z}}function qW($,Z,J,X){let Y=Date.now();p$.delete($),p$.set($,{body:Z,hash:J,revision:X,updatedAt:Y}),OJ(Y)}async function Pz($,Z,J,X,Y){let{authorization:G,scope:z}=await k4($,Z,X,(K)=>uJ(K,Y)),Q;try{Q=await y_($,Z,J)}catch(K){let W=z.redactError(K);throw z.dispose(),W}try{return{authorization:G,scope:z,response:z.redactResponse(Q)}}catch(K){throw z.dispose(),await Q.body?.cancel().catch(()=>{}),K}}async function $7($){$.scope.dispose(),await $.response.body?.cancel().catch(()=>{})}async function Az($){let{config:Z,payload:J,bodyText:X,requestMode:Y,fallback:G,signal:z,authorizeAttempt:Q}=$,K=Y(),W=J,V=await Pz(Z,W,z,Q,K);if(V.response.status===409&&W.mode==="patch")j6(`state mismatch from relay session=${H6(W.affinity)}; retrying full_sync`),await $7(V),W=DJ(W,X),V=await Pz(Z,W,z,Q,K);let{response:B,authorization:q}=V,H=/^req_[A-Za-z0-9_-]+$/.test(B.headers.get("request-id")??"");if(B.status===401&&!H){if(await $7(V),Z.fallbackToDirect)return j6(`relay authentication rejected; falling back direct session=${H6(W.affinity)}`),{response:await G(),payload:W,transport:"http",protocol:W.protocol,usedRelay:!1};return{response:Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502}),payload:W,transport:"http",protocol:W.protocol,usedRelay:!1}}if(H)try{q?.onUpstreamStatus?.(B.status)}catch{}if(!B.ok&&B.status>=500&&Z.fallbackToDirect)return j6(`relay returned ${B.status}; falling back direct session=${H6(W.affinity)}`),await $7(V),{response:await G(),payload:W,transport:"http",protocol:W.protocol,usedRelay:!1};return{response:B,payload:W,transport:"http",protocol:W.protocol,usedRelay:!0}}function u_($,Z){let J=new URL($);return J.protocol=J.protocol==="http:"?"ws:":"wss:",J.pathname="/ws",J.searchParams.set("token",Z),J.toString()}function p_($){return new Uint8Array(__.from($,"base64"))}function c_($){if($ instanceof Uint8Array)return $;if($ instanceof ArrayBuffer)return new Uint8Array($);if(ArrayBuffer.isView($))return new Uint8Array($.buffer,$.byteOffset,$.byteLength);throw TypeError("relay websocket binary frame must be an ArrayBuffer or byte view")}function l_($){return JSON.parse($)}function wz($){let Z=$;return[`code=${Z.code??"unknown"}`,`wasClean=${Z.wasClean??"unknown"}`].join(" ")}function d_($){let Z=$.message||"relay websocket error";return $.status?`relay websocket error ${$.status}: ${Z}`:Z}function Rz($,Z){return{stream:fH($),response:uJ($,Z)}}function Tz($){$.stream.dispose(),$.response.dispose()}class jW{config;affinity;timers;socket;connecting;queue=Promise.resolve();pending;serverState;lastUsedAt=Date.now();constructor($,Z,J){this.config=$,this.affinity=Z,this.timers=J}touch($=Date.now()){this.lastUsedAt=$}canEvict($=Date.now()){return!this.pending&&!this.connecting&&$-this.lastUsedAt>S_}dispose(){if(this.pending)this.retireAttempt(this.pending);this.socket?.close(),this.socket=void 0,this.serverState=void 0,this.connecting=void 0}send($,Z,J,X,Y,G){this.touch();let z=U6(),Q=this.queue.catch(()=>{}).then(()=>this.startQueued($,Z,z,J,X,Y,G)),K=Q.then(async({response:W,getPayload:V})=>({response:await W,payload:V(),transport:"websocket",protocol:2,usedRelay:!0}));return this.queue=Q.then(({done:W})=>W.catch(()=>{}),()=>{}),K}async startQueued($,Z,J,X,Y,G,z){let Q=(A)=>Rz(A,z),K=U6();await this.ensureConnected();let W=U6(),V=p$.get(this.affinity),B=this.serverState?.hash,q={...$,protocol:2,id:e2()};if(q.mode==="patch"&&(!B||B!==q.base_hash))q.mode="full_sync",q.revision=(this.serverState?.revision??0)+1,delete q.base_hash,delete q.patch,q.body=Z;if(q.mode==="patch"&&V)q.patch=VW(V.body,Z);j6(`perf websocket send_start session=${H6(this.affinity)} request=${q.id} mode=${q.mode} queueMs=${e6(W-J)} connectMs=${e6(W-K)} bodyBytes=${Z.length} relayBytes=${JSON.stringify(q).length}`);let H=await k4(this.config,q,G,Q),j=q,x=this.sendPayload(q,Z,X,Y,G,H,z);x.done.catch(()=>{});let L=x.done,U=x.response.catch(async(A)=>{if(!(A instanceof UJ)||q.mode!=="patch")throw A;let _=DJ(q,Z);_.protocol=2,_.id=e2(),_.revision=(this.serverState?.revision??0)+1;let N=await k4(this.config,_,G,Q);j=_;let R=this.sendPayload(_,Z,X,Y,G,N,z);return R.done.catch(()=>{}),L=R.done,R.response}),M=U.then(()=>L,()=>L.catch(()=>{}));return{response:U,done:M,getPayload:()=>j}}async ensureConnected(){if(this.socket?.readyState===WebSocket.OPEN&&this.serverState!==void 0)return;if(this.connecting)return await this.connecting;this.connecting=new Promise(($,Z)=>{let J=u_(this.config.url,this.config.token),X=new URL(J);X.searchParams.set("affinity",this.affinity);let Y=new WebSocket(X.toString());Y.binaryType="arraybuffer",this.socket=Y,this.serverState=void 0;let G=this.timers.setTimeout(()=>{Y.close(),Z(Error("relay websocket ready timed out"))},15000);Y.addEventListener("message",(z)=>{try{if(typeof z.data!=="string"){this.handleBinaryChunk(z.data);return}let Q=l_(z.data);if(Q.type==="ready"){this.timers.clearTimeout(G),this.serverState=Q.state,$();return}this.handleMessage(Q)}catch(Q){this.timers.clearTimeout(G),Z(Q),this.failPending(Q),Y.close()}}),Y.addEventListener("error",()=>{this.timers.clearTimeout(G);let z=new xJ("relay websocket error");Z(z),this.failPending(z)}),Y.addEventListener("close",(z)=>{if(this.timers.clearTimeout(G),this.socket===Y)this.socket=void 0,this.serverState=void 0,this.connecting=void 0;if(this.socket!==void 0)return;if(this.pending){if(this.pending.retryingBeforeResponse)return;let Q=this.pending.responseStartedAt!=null||this.pending.streamByteCount>0,K=Q?"closed after response_start before stream bytes":"closed before response";if(this.retryPendingBeforeResponse(this.pending,K,z))return;let W=Q?new xJ("relay websocket closed during response stream",z):Error("relay websocket closed before response");j6(`websocket ${Q?"closed during response stream":"closed before response without retry"} session=${H6(this.affinity)} request=${this.pending.payload.id} chunks=${this.pending.streamChunkCount} bytes=${this.pending.streamByteCount} ${wz(z)}`),this.failPending(W)}})}).finally(()=>{this.connecting=void 0}),await this.connecting}sendPayload($,Z,J,X,Y,G,z){let Q=this.socket;if(!Q||Q.readyState!==WebSocket.OPEN)throw Tz(G.scope),Error("relay websocket is not connected");let K=U6(),W,V,B=new Promise((H,j)=>{W=H,V=j});return{response:new Promise((H,j)=>{let x={payload:$,bodyText:Z,resolve:H,reject:j,streamDone:!1,accepted:!1,responseStarted:!1,resolveDone:W,rejectDone:V,sentAt:K,optimisticResponse:J,streamChunkCount:0,streamByteCount:0,retryAttempts:0,retryingBeforeResponse:!1,onResponseHeaders:X,authorizeAttempt:Y,authorization:G.authorization,scope:G.scope.stream,responseScope:G.scope.response,responseMode:z,rawBody:!1,retired:!1,stagedResponseHeaders:void 0,responseHeadersDelivered:!1};if(this.pending=x,this.resetPendingTimeout(x),Q.send(JSON.stringify($)),J)this.resolvePendingResponse(x,200,"OK",{"content-type":"text/event-stream","x-cortexkit-relay-optimistic":"true"})}),done:B}}resetPendingTimeout($){this.timers.clearTimeout($.timeout),$.timeout=this.timers.setTimeout(()=>{if(this.pending!==$)return;if(this.retryPendingBeforeResponse($,"response timed out"))return;this.failPending(Error("relay websocket response timed out")),this.socket?.close()},45000)}retryPendingBeforeResponse($,Z,J){if($.streamByteCount>0)return!1;if($.streamDone)return!1;if(!$.optimisticResponse&&$.responseStarted)return!1;if($.retired)return!1;if($.retryAttempts>=1)return!1;$.retryAttempts+=1,$.retryingBeforeResponse=!0,this.timers.clearTimeout($.timeout);let X=$.retryAttempts,Y=$.payload.id;return j6(`websocket ${Z}; reconnecting and retrying full_sync session=${H6(this.affinity)} request=${Y} retry=${X} chunks=${$.streamChunkCount} bytes=${$.streamByteCount}${J?` ${wz(J)}`:""}`),this.socket?.close(),this.socket=void 0,this.serverState=void 0,this.connecting=void 0,(async()=>{try{if(await this.ensureConnected(),this.pending!==$)return;if($.retired)return this.endCancelledRetry($);let G=DJ($.payload,$.bodyText);G.protocol=2,G.id=e2(),G.revision=(this.serverState?.revision??0)+1;let z=await k4(this.config,G,$.authorizeAttempt,(K)=>Rz(K,$.responseMode));if(this.pending!==$||$.streamDone||$.retired){if(Tz(z.scope),this.pending===$&&$.retired)this.endCancelledRetry($);return}this.installAttempt($,z),$.payload=G,$.accepted=!1,$.acceptedAt=void 0,$.responseStartedAt=void 0,$.stagedResponseHeaders=void 0,$.responseHeadersDelivered=!1,$.sentAt=U6(),$.retryingBeforeResponse=!1;let Q=this.socket;if(!Q||Q.readyState!==WebSocket.OPEN)throw Error("relay websocket is not connected");this.resetPendingTimeout($),j6(`perf websocket retry_send session=${H6(this.affinity)} request=${G.id} previous=${Y} mode=full_sync retry=${X} bodyBytes=${$.bodyText.length} relayBytes=${JSON.stringify(G).length}`),Q.send(JSON.stringify(G))}catch(G){if($.retryingBeforeResponse=!1,this.pending!==$)return;if(G instanceof e9)this.failPending(G.failure,!1);else this.failPending(G)}})(),!0}endCancelledRetry($){$.retryingBeforeResponse=!1,this.failPending(Error("relay websocket response was cancelled"),!1)}installAttempt($,Z){$.scope?.dispose(),$.responseScope?.dispose(),$.authorization=Z.authorization,$.scope=Z.scope.stream,$.responseScope=Z.scope.response}retireAttempt($){$.retired=!0,$.scope?.dispose(),$.scope=void 0,$.responseScope?.dispose(),$.responseScope=void 0,$.errorBody=void 0,$.authorization=void 0}redactAttemptError($,Z){return $.scope?$.scope.redactError(Z):Error("relay websocket request ended")}enqueueStreamChunk($,Z){this.deliverResponseHeaders($),$.streamChunkCount+=1,$.streamByteCount+=Z.byteLength,this.forwardStreamBytes($,Z)}forwardStreamBytes($,Z){let{streamController:J,scope:X}=$;if(!J||!X)return;if($.rawBody){let G=$.errorBody;if(G){if(G.bytes+=Z.byteLength,G.bytes>EJ){this.endOversizedErrorBody($,J,G.scope);return}}J.enqueue(Z);return}let Y;try{Y=X.push(Z)}catch(G){this.failPending(G,!(G instanceof w8)),this.socket?.close();return}for(let G of Y)J.enqueue(G)}endOversizedErrorBody($,Z,J){if(Z.error(new b3),J.dispose(),j6(`websocket error body exceeded the redaction bound; ending request session=${H6(this.affinity)} request=${$.payload.id} chunks=${$.streamChunkCount} bytes=${$.streamByteCount}`),this.timers.clearTimeout($.timeout),$.streamDone=!0,this.retireAttempt($),$.authorizeAttempt=void 0,$.onResponseHeaders=void 0,$.resolveDone(),this.pending===$)this.pending=void 0;let X=this.socket;this.socket=void 0,this.serverState=void 0,this.connecting=void 0,X?.close()}deliverResponseHeaders($){if($.responseHeadersDelivered||$.stagedResponseHeaders==null)return;$.responseHeadersDelivered=!0;try{$.onResponseHeaders?.($.stagedResponseHeaders)}catch{}}handleBinaryChunk($){let Z=this.pending;if(!Z?.responseStarted)return;this.enqueueStreamChunk(Z,c_($))}resolvePendingResponse($,Z,J,X){if($.responseStarted)return;let Y,G=F_.has(Z)?null:new ReadableStream({start:(V)=>{Y=V},cancel:()=>{this.retireAttempt($),this.socket?.close()}}),z;try{z=new Response(G,{status:Z,statusText:J,headers:X})}catch{this.failInvalidResponseStart();return}if($.responseStarted=!0,$.streamController=Y,$.optimisticResponse){$.resolve(z);return}let Q=$.responseScope;if($.responseScope=void 0,z.ok&&$.responseMode==="event-stream"||!Q){if(Q?.dispose(),X&&z.ok)$.stagedResponseHeaders=new Headers(z.headers);$.resolve(z);return}$.rawBody=!0;let W;try{W=Q.redactResponse(z)}catch(V){$.responseStarted=!1,this.failPending(V),this.socket?.close();return}if(X)$.stagedResponseHeaders=new Headers(W.headers);if(!z.ok&&G)$.errorBody={scope:Q,bytes:0};$.resolve(W)}stageOptimisticResponseHeaders($,Z){let J=$.responseScope;$.responseScope=void 0;let X;try{X=new Response(null,{status:Z.status,statusText:Z.statusText,headers:Z.headers})}catch{return J?.dispose(),this.failInvalidResponseStart(),!1}if(!Z.headers)return J?.dispose(),!0;if(X.ok)return J?.dispose(),$.stagedResponseHeaders=new Headers(X.headers),!0;if(!J)return!0;try{$.stagedResponseHeaders=new Headers(J.redactResponse(X).headers)}catch{}return!0}failInvalidResponseStart(){this.failPending(new HZ(T_),!1),this.socket?.close()}handleMessage($){if($.type==="keepalive"){if(this.pending)this.resetPendingTimeout(this.pending);return}let Z=this.pending;if(!Z)return;if("id"in $&&$.id&&$.id!==Z.payload.id)return;if($.type==="accepted"){let J=U6();Z.accepted=!0,Z.acceptedAt=J,j6(`perf websocket accepted session=${H6(this.affinity)} request=${Z.payload.id} sentMs=${e6(J-Z.sentAt)} mode=${Z.payload.mode}`),this.serverState={hash:$.hash,revision:$.revision},qW(this.affinity,Z.bodyText,$.hash,$.revision),this.resetPendingTimeout(Z);return}if($.type==="response_start"){if(Z.responseStartedAt!=null)return;let J=U6();Z.responseStartedAt=J;try{Z.authorization?.onUpstreamStatus?.($.status)}catch{}if(j6(`perf websocket response_start session=${H6(this.affinity)} request=${Z.payload.id} sentMs=${e6(J-Z.sentAt)} upstreamMs=${Z.acceptedAt==null?"unknown":e6(J-Z.acceptedAt)} status=${H9($.status)}`),this.timers.clearTimeout(Z.timeout),!Z.optimisticResponse){this.resolvePendingResponse(Z,$.status,$.statusText,$.headers);return}if(!this.stageOptimisticResponseHeaders(Z,$))return;if($.status>=400)this.deliverResponseHeaders(Z),this.forwardStreamBytes(Z,new TextEncoder().encode(`event: error
-data: ${JSON.stringify({type:"error",error:{type:"relay_upstream_error",message:`Relay upstream returned HTTP ${$.status}`}})}
-
-`)),this.finishPending();return}if($.type==="chunk"){this.enqueueStreamChunk(Z,p_($.base64));return}if($.type==="done"){this.finishPending($);return}if($.type==="error"){if(Z.optimisticResponse&&Z.responseStartedAt!=null){j6(`websocket relay error during optimistic response session=${H6(this.affinity)} request=${Z.payload.id} status=${Number.isFinite($.status)?$.status:"unknown"} code=relay_stream_error chunks=${Z.streamChunkCount} bytes=${Z.streamByteCount}`),this.deliverResponseHeaders(Z),this.forwardStreamBytes(Z,new TextEncoder().encode(`event: error
-data: ${JSON.stringify({type:"error",error:{type:"relay_error",message:$.message||"relay error"}})}
-
-`)),this.finishPending(),this.socket?.close();return}if($.status===409&&this.retryPendingBeforeResponse(Z,"state mismatch"))return;let J=$.status===409?new UJ("state mismatch"):Error(d_($));this.failPending(J)}}finishPending($){let Z=this.pending;if(!Z)return;let J=U6(),X=$&&"frames"in $?` upstreamChunks=${H9($.upstreamChunks)} upstreamBytes=${H9($.upstreamBytes)} frames=${H9($.frames)} frameBytes=${H9($.frameBytes)}`:"";j6(`perf websocket done session=${H6(this.affinity)} request=${Z.payload.id} sentMs=${e6(J-Z.sentAt)} streamMs=${Z.responseStartedAt==null?"unknown":e6(J-Z.responseStartedAt)} chunks=${Z.streamChunkCount} bytes=${Z.streamByteCount}${X}`),this.timers.clearTimeout(Z.timeout);try{if(!Z.streamDone){this.deliverResponseHeaders(Z),Z.streamDone=!0;let Y=Z.rawBody?[]:Z.scope?.finish()??[];for(let G of Y)Z.streamController?.enqueue(G);Z.streamController?.close()}}finally{this.retireAttempt(Z),Z.authorizeAttempt=void 0,Z.onResponseHeaders=void 0}Z.resolveDone(),this.pending=void 0}failPending($,Z=!0){let J=this.pending;if(!J)return;let X=Z?this.redactAttemptError(J,$):$;if(this.timers.clearTimeout(J.timeout),this.pending=void 0,this.retireAttempt(J),J.authorizeAttempt=void 0,J.onResponseHeaders=void 0,J.responseStarted)J.streamController?.error(X);else J.reject(X);J.rejectDone(X)}}function OJ($=Date.now()){for(let[Z,J]of p$)if($-J.updatedAt>C_)p$.delete(Z);while(p$.size>k_){let Z=p$.keys().next().value;if(Z===void 0)break;p$.delete(Z)}for(let[Z,J]of m0)if(J.canEvict($))J.dispose(),m0.delete(Z);while(m0.size>v_){let Z=!1;for(let[J,X]of m0){if(!X.canEvict($))continue;X.dispose(),m0.delete(J),Z=!0;break}if(!Z)break}}function i_($,Z,J){OJ();let X=m0.get(Z);if(X)return X.touch(),X;let Y=new jW($,Z,J);return m0.set(Z,Y),OJ(),Y}async function tC($){let{config:Z,input:J,init:X,headers:Y,body:G,fallback:z,affinity:Q,optimisticResponse:K,authorizeAttempt:W,onResponseHeaders:V,dumpTag:B,onDumpCreated:q,setTimeoutImpl:H=globalThis.setTimeout,clearTimeoutImpl:j=globalThis.clearTimeout}=$;if(!Z||!g_(J,G))return z();let x=Q||Y.get("x-session-affinity")||Y.get("x-opencode-session");if(!x)return j6("skipping relay: missing x-session-affinity header"),z();let L=G,U=U6(),M=f_(L);D8("hash_body",{session:H6(x),ms:e6(U6()-U),bodyBytes:L.length});let A=p$.get(x),_=U6(),N=m_({input:J,init:X,headers:Y,bodyText:L,affinity:x,previous:A,nextHash:M});D8("create_payload",{session:H6(x),ms:e6(U6()-_),mode:N.mode,bodyBytes:L.length,previousBytes:A?.body.length});let R,S=()=>{return R??=R_(L),R};try{let E,m=U6();if(Z.transport==="websocket")try{let P=i_(Z,x,{setTimeout:H,clearTimeout:j}),D=K===!0&&S()==="event-stream";E=await P.send(N,L,D,V,W,S())}catch(P){if(P instanceof e9||P instanceof HZ)throw P;j6(`websocket relay failed session=${H6(x)}; trying http relay code=relay_transport_error`),E=await Az({config:Z,payload:N,bodyText:L,requestMode:S,fallback:z,signal:X?.signal,authorizeAttempt:W})}else E=await Az({config:Z,payload:N,bodyText:L,requestMode:S,fallback:z,signal:X?.signal,authorizeAttempt:W});if(D8("send",{session:H6(x),ms:e6(U6()-m),transport:E.transport,protocol:E.protocol,mode:E.payload.mode,status:E.response.status,usedRelay:E.usedRelay}),!E.usedRelay)return E.response;if(E.transport==="http")try{V?.(E.response.headers)}catch{}if(E.transport==="http")qW(x,L,E.payload.next_hash,E.payload.revision);let s=U6(),c=JSON.stringify(E.payload).length;D8("payload_stringify",{session:H6(x),ms:e6(U6()-s),relayBytes:c}),j6(`used relay transport=${E.transport} protocol=${E.protocol} mode=${E.payload.mode} status=${E.response.status} session=${H6(x)} bodyBytes=${L.length} relayBytes=${c}`);let I=U6(),O=await Fj({affinity:x,transport:E.transport,protocol:E.protocol,mode:E.payload.mode,status:E.response.status,bodyText:L,previousBodyText:A?.body,payload:E.payload,relayBytes:c,tag:B});try{if(O)q?.(O)}catch{}return D8("dump",{session:H6(x),ms:e6(U6()-I),enabled:!0}),E.response}catch(E){if(E instanceof e9)throw E.failure;if(E instanceof HZ)throw E;if(!Z.fallbackToDirect)throw j6(`relay failed session=${H6(x)} and fallbackToDirect=false code=relay_transport_error`),E;return j6(`relay failed; falling back direct session=${H6(x)} code=relay_transport_error`),z()}}var aC=`
-async function hashBody(body) {
-  const bytes = new TextEncoder().encode(body)
-  const digest = await crypto.subtle.digest('SHA-256', bytes)
-  const hex = [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('')
-  return 'sha256:' + hex
-}
-
-function applyPatch(base, patch) {
-  return base.slice(0, patch.start) + patch.insert + base.slice(patch.start + patch.deleteCount)
-}
-
-function applyPatchSet(base, patch) {
-  if (!Array.isArray(patch)) return applyPatch(base, patch)
-  if (patch.length === 0) return base
-
-  let result = ''
-  let cursor = 0
-  for (const item of patch) {
-    if (item.start < cursor) return { error: 'overlapping patch', status: 400 }
-    result += base.slice(cursor, item.start)
-    result += item.insert
-    cursor = item.start + item.deleteCount
-  }
-  return result + base.slice(cursor)
-}
-
-async function readState(env, affinity) {
-  const raw = await env.RELAY_STATE.get('session:' + affinity)
-  return raw ? JSON.parse(raw) : null
-}
-
-async function writeState(env, affinity, state) {
-  await env.RELAY_STATE.put('session:' + affinity, JSON.stringify(state), { expirationTtl: 86400 })
-}
-
-async function resolveBody(env, payload) {
-  if (payload.mode === 'full_sync') return payload.body
-  if (payload.mode === 'patch') {
-    const state = await readState(env, payload.affinity)
-    if (!state || state.hash !== payload.base_hash) {
-      return { error: 'state mismatch', status: 409 }
-    }
-    return applyPatchSet(state.body, payload.patch)
-  }
-  return { error: 'unknown mode', status: 400 }
-}
-
-async function prepareUpstream(env, payload) {
-  if ((payload.protocol !== 1 && payload.protocol !== 2) || payload.type !== 'request' || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {
-    return { error: 'invalid payload', status: 400 }
-  }
-
-  const body = await resolveBody(env, payload)
-  if (body && typeof body === 'object' && 'error' in body) return body
-
-  if (typeof body !== 'string' || (await hashBody(body)) !== payload.next_hash) {
-    return { error: 'hash mismatch', status: 409 }
-  }
-
-  const stateWrite = writeState(env, payload.affinity, { body, hash: payload.next_hash, revision: payload.revision }).catch(() => {})
-  console.log(JSON.stringify({
-    relay: 'opencode-anthropic-auth',
-    transport: 'relay',
-    mode: payload.mode,
-    revision: payload.revision,
-    affinity: String(payload.affinity).slice(0, 12),
-    bodyBytes: body.length,
-  }))
-
-  return { body, stateWrite }
-}
-
-function resolveBodyFromState(state, payload) {
-  if (payload.mode === 'full_sync') return payload.body
-  if (payload.mode === 'patch') {
-    if (!state || state.hash !== payload.base_hash) {
-      return { error: 'state mismatch', status: 409 }
-    }
-    return applyPatchSet(state.body, payload.patch)
-  }
-  return { error: 'unknown mode', status: 400 }
-}
-
-function deferWorkerTask(task) {
-  return new Promise((resolve) => setTimeout(resolve, 0)).then(task)
-}
-
-const WEBSOCKET_STREAM_FLUSH_BYTES = 1024
-const WEBSOCKET_STREAM_FLUSH_MS = 20
-
-function createWebSocketStreamCoalescer(socket, options = {}) {
-  const flushBytes = options.flushBytes || WEBSOCKET_STREAM_FLUSH_BYTES
-  const flushMs = options.flushMs ?? WEBSOCKET_STREAM_FLUSH_MS
-  let chunks = []
-  let byteLength = 0
-  let flushTimer = null
-  const stats = {
-    upstreamChunks: 0,
-    upstreamBytes: 0,
-    frames: 0,
-    frameBytes: 0,
-  }
-
-  const clearFlushTimer = () => {
-    if (flushTimer === null) return
-    clearTimeout(flushTimer)
-    flushTimer = null
-  }
-
-  const mergeChunks = () => {
-    if (chunks.length === 1) return chunks[0]
-    const frame = new Uint8Array(byteLength)
-    let offset = 0
-    for (const chunk of chunks) {
-      frame.set(chunk, offset)
-      offset += chunk.byteLength
-    }
-    return frame
-  }
-
-  const flush = () => {
-    clearFlushTimer()
-    if (byteLength === 0) return
-    const frame = mergeChunks()
-    chunks = []
-    byteLength = 0
-    socket.send(frame)
-    stats.frames += 1
-    stats.frameBytes += frame.byteLength
-  }
-
-  const scheduleFlush = () => {
-    if (flushTimer !== null) return
-    flushTimer = setTimeout(flush, flushMs)
-  }
-
-  return {
-    push(value) {
-      const chunk = value instanceof Uint8Array ? value : new Uint8Array(value)
-      if (chunk.byteLength === 0) return
-      stats.upstreamChunks += 1
-      stats.upstreamBytes += chunk.byteLength
-      chunks.push(chunk)
-      byteLength += chunk.byteLength
-      if (byteLength >= flushBytes) flush()
-      else scheduleFlush()
-    },
-    flush,
-    stats() {
-      return { ...stats, pendingBytes: byteLength }
-    },
-  }
-}
-
-function checkpointWebSocketState(env, payload, body, nextState) {
-  return deferWorkerTask(async () => {
-    try {
-      if ((await hashBody(body)) !== payload.next_hash) {
-        throw new Error('hash mismatch')
-      }
-      await writeState(env, payload.affinity, nextState)
-    } catch {
-      console.log(JSON.stringify({
-        relay: 'opencode-anthropic-auth',
-        transport: 'websocket',
-        event: 'checkpoint_write_failed',
-        affinity: String(payload.affinity).slice(0, 12),
-        code: 'checkpoint_write_error',
-      }))
-    }
-  })
-}
-
-async function prepareWebSocketUpstream(env, state, payload) {
-  if (payload.protocol !== 2 || payload.type !== 'request' || !payload.id || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {
-    return { error: 'invalid payload', status: 400 }
-  }
-
-  const body = resolveBodyFromState(state, payload)
-  if (body && typeof body === 'object' && 'error' in body) return body
-  if (typeof body !== 'string') return { error: 'invalid body', status: 400 }
-  if ((await hashBody(body)) !== payload.next_hash) {
-    return { error: 'hash mismatch', status: 409 }
-  }
-
-  const nextState = { body, hash: payload.next_hash, revision: payload.revision }
-  const checkpoint = checkpointWebSocketState(env, payload, body, nextState)
-  const logAccepted = () => console.log(JSON.stringify({
-    relay: 'opencode-anthropic-auth',
-    transport: 'websocket',
-    mode: payload.mode,
-    revision: payload.revision,
-    affinity: String(payload.affinity).slice(0, 12),
-    bodyBytes: body.length,
-  }))
-
-  return { body, state: nextState, checkpoint, logAccepted }
-}
-
-function headersToObject(headers) {
-  const result = {}
-  for (const [key, value] of headers.entries()) result[key] = value
-  return result
-}
-
-async function handleRelayPayload(env, payload) {
-  const prepared = await prepareUpstream(env, payload)
-  if (prepared.error) return prepared
-  const upstream = await fetch(payload.upstream.url, {
-    method: payload.upstream.method || 'POST',
-    headers: payload.upstream.headers,
-    body: prepared.body,
-  })
-  return { upstream, stateWrite: prepared.stateWrite }
-}
-
-async function handleWebSocket(socket, env, ctx, payload, getState, setState) {
-  const heartbeat = setInterval(() => {
-    try {
-      socket.send(JSON.stringify({ protocol: 2, type: 'keepalive' }))
-    } catch {
-      clearInterval(heartbeat)
-    }
-  }, 15000)
-  let streamCoalescer = null
-  try {
-    const result = await prepareWebSocketUpstream(env, getState(), payload)
-    if (result.error) {
-      socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: result.status, message: result.error }))
-      return
-    }
-
-    setState(result.state)
-    socket.send(JSON.stringify({ protocol: 2, type: 'accepted', id: payload.id, hash: result.state.hash, revision: result.state.revision }))
-    ctx?.waitUntil?.(deferWorkerTask(result.logAccepted))
-
-    const upstreamPromise = fetch(payload.upstream.url, {
-      method: payload.upstream.method || 'POST',
-      headers: payload.upstream.headers,
-      body: result.body,
-    })
-    ctx?.waitUntil?.(result.checkpoint)
-    const upstream = await upstreamPromise
-    socket.send(JSON.stringify({
-      protocol: 2,
-      type: 'response_start',
-      id: payload.id,
-      status: upstream.status,
-      statusText: upstream.statusText,
-      headers: headersToObject(upstream.headers),
-    }))
-
-    const reader = upstream.body?.getReader()
-    if (reader) {
-      streamCoalescer = createWebSocketStreamCoalescer(socket)
-      while (true) {
-        const { done, value } = await reader.read()
-        if (done) break
-        streamCoalescer.push(value)
-      }
-      streamCoalescer.flush()
-    }
-    const stats = streamCoalescer?.stats?.() || {}
-    socket.send(JSON.stringify({ protocol: 2, type: 'done', id: payload.id, ...stats }))
-  } catch (error) {
-    try {
-      streamCoalescer?.flush?.()
-    } catch {}
-    socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: 500, message: error instanceof Error ? error.message : String(error) }))
-  } finally {
-    clearInterval(heartbeat)
-  }
-}
-
-export default {
-  async fetch(request, env, ctx) {
-    if (request.headers.get('Upgrade') === 'websocket') {
-      const url = new URL(request.url)
-      const token = url.searchParams.get('token')
-      const affinity = url.searchParams.get('affinity')
-      if (token !== env.RELAY_TOKEN) return new Response('unauthorized', { status: 401 })
-      if (!affinity) return new Response('missing affinity', { status: 400 })
-      const pair = new WebSocketPair()
-      const client = pair[0]
-      const server = pair[1]
-      server.binaryType = 'arraybuffer'
-      let state = null
-      let ready = false
-      server.accept()
-      const loadState = readState(env, affinity).then((loadedState) => {
-        state = loadedState
-        ready = true
-        server.send(JSON.stringify({
-          protocol: 2,
-          type: 'ready',
-          state: state ? { hash: state.hash, revision: state.revision } : null,
-        }))
-      }).catch((error) => {
-        server.send(JSON.stringify({ protocol: 2, type: 'error', status: 500, message: error instanceof Error ? error.message : String(error) }))
-        server.close(1011, 'state load failed')
-      })
-      ctx?.waitUntil?.(loadState)
-      if (!ctx?.waitUntil) void loadState
-      let busy = false
-      server.addEventListener('message', (event) => {
-        if (!ready) {
-          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 425, message: 'relay state is not ready' }))
-          return
-        }
-        if (busy) {
-          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 429, message: 'request already in flight' }))
-          return
-        }
-        let payload
-        try {
-          payload = JSON.parse(event.data)
-        } catch {
-          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 400, message: 'invalid JSON payload' }))
-          return
-        }
-        payload.affinity = affinity
-        busy = true
-        const run = handleWebSocket(server, env, ctx, payload, () => state, (nextState) => { state = nextState }).finally(() => { busy = false })
-        ctx?.waitUntil?.(run)
-        if (!ctx?.waitUntil) void run
-      })
-      return new Response(null, { status: 101, webSocket: client })
-    }
-
-    if (request.method === 'GET') {
-      return Response.json({ status: 'ok', transports: ['http', 'websocket'] })
-    }
-    if (request.method !== 'POST') return new Response('method not allowed', { status: 405 })
-    if (request.headers.get('x-relay-token') !== env.RELAY_TOKEN) {
-      return new Response('unauthorized', { status: 401 })
-    }
-
-    try {
-      const payload = await request.json()
-      const result = await handleRelayPayload(env, payload)
-      if (result.error) return Response.json({ error: result.error }, { status: result.status })
-
-      if (result.stateWrite) ctx.waitUntil(result.stateWrite)
-
-      const upstream = result.upstream
-      return new Response(upstream.body, {
-        status: upstream.status,
-        statusText: upstream.statusText,
-        headers: upstream.headers,
-      })
-    } catch (error) {
-      return Response.json(
-        { error: error instanceof Error ? error.message : 'internal relay error' },
-        { status: 502 },
-      )
-    }
-  },
-}
-`,s_="Cannot send this request: the history ends on an assistant turn. Send a new message to continue; assistant content will not be discarded to replay the previous question.";class HW extends Error{details;check="meaningful_trailing_assistant";constructor($){super(s_);this.details=$,this.name="TrailingAssistantHistoryError"}}var t_=new Set(["text","thinking","redacted_thinking","tool_use","server_tool_use","image","document"]),a_=new Set(["type","text","cache_control"]);function k5($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function n_($){if(typeof $==="string")return $.trim()==="";if(!Array.isArray($))return!1;return $.every((Z)=>k5(Z)&&Z.type==="text"&&typeof Z.text==="string"&&Z.text.trim()===""&&Object.keys(Z).every((J)=>a_.has(J)))}function o_($){if(Array.isArray($))return{contentShape:"array",contentBlockCount:$.length,contentBlockTypes:$.map((Z)=>k5(Z)&&typeof Z.type==="string"&&t_.has(Z.type)?Z.type:"other")};if(typeof $==="string")return{contentShape:"string"};if($===void 0)return{contentShape:"missing"};return{contentShape:"other"}}function r_($){let Z=$.length;while(Z>0){let J=$[Z-1];if(!k5(J)||J.role!=="assistant")break;if(!n_(J.content))throw new HW({messageCount:$.length,trailingMessageIndex:Z-1,emptyMessagesAfter:$.length-Z,...o_(J.content)});Z--}return $.length-Z}function nC($){if(!Array.isArray($))return 0;let Z=r_($);if(Z)$.length-=Z;return Z}var MJ=["main-first","fallback-first","sticky-balanced"],v5="main-first",LW="Usage: `/claude-routing`, `/claude-routing main-first`, `/claude-routing fallback-first`, `/claude-routing sticky-balanced`, or `/claude-routing reset`.";function e_($){return typeof $==="string"&&MJ.includes($)?$:v5}function oC($){return e_($?.routing?.mode)}function $P($){let Z=$.trim().toLowerCase().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="reset")return{type:"reset"};if(Z.length===1&&MJ.includes(Z[0]))return{type:"mode",mode:Z[0]};if(Z.length===2&&Z[0]==="mode"&&MJ.includes(Z[1]))return{type:"mode",mode:Z[1]};return{type:"usage"}}function ZP($){if($==="fallback-first")return"Try usable fallback accounts before the main account. If no fallback succeeds, try the main account.";if($==="sticky-balanced")return"Assign each session to a quota-weighted OAuth account, keep it sticky across transient failures, and migrate only for confirmed long-lived exhaustion or permanent account failure.";return"Try the main account first. Use fallback accounts only when quota policy or fallback errors require it."}function B4($){let Z=$?.mode??v5;return["## Claude Routing Status","",`- Mode: \`${Z}\``,`- Behavior: ${ZP(Z)}`,"",LW].join(`
-`)}function rC($){let Z=$P($.argumentsText),J=$.mode??v5;if(Z.type==="status")return B4({mode:J});if(Z.type==="mode")return["## Claude Routing Updated","",`Mode updated to \`${Z.mode}\`.`,"",...B4({mode:Z.mode}).split(`
-`).slice(2)].join(`
-`);if(Z.type==="reset")return["## Claude Routing Assignment Reset","","The current session will be assigned again on its next request.","",...B4({mode:J}).split(`
-`).slice(2)].join(`
-`);return["## Claude Routing Usage","",LW,"",...B4({mode:J}).split(`
-`).slice(2)].join(`
-`)}var JP="## Claude Lane Start Status",XP="## Claude Lane Start Queued",YP="## Claude Lane Start Usage",GP="Usage: `/claude-start`.";function zP($){if($.trim().split(/\s+/).filter(Boolean).length===0)return{type:"fire"};return{type:"usage"}}function eC($){let Z=zP($.argumentsText);if(Z.type==="fire")return{action:Z,text:[XP,"","- Queued an explicit lane-start request.","- This is a billed request: the one-token limit does not remove prompt-cache read or write charges."].join(`
-`)};return{action:Z,text:[YP,"",GP,"",JP].join(`
-`)}}var $S="thinking-binding-controls-2026-08-01";function $1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function QP($){if(!$1($))return!1;if($.type==="thinking")return typeof $.signature==="string"&&$.signature.length>0;if($.type==="redacted_thinking")return typeof $.data==="string"&&$.data.length>0;return!1}function ZS($){let Z=$?.thinkingBinding?.prefixMismatchBehavior;return Z==="error"||Z==="drop_block"?Z:"account-default"}function KP($){if(!Array.isArray($.messages))return!1;return $.messages.some((Z)=>{if(!$1(Z)||Z.role!=="assistant")return!1;return Array.isArray(Z.content)&&Z.content.some(QP)})}function JS($,Z="account-default"){if(Z==="account-default")return!1;if(!r3($.model)&&!sJ($.model)&&!e3($.model)&&!GN($.model))return!1;if(!KP($))return!1;if(!$1($.thinking)||$.thinking.type!=="adaptive")return!1;return $.thinking.block_binding={prefix_mismatch_behavior:Z},!0}function XS($){if(!$1($.thinking))return!1;if(!$1($.thinking.block_binding))return!1;let Z=$.thinking.block_binding.prefix_mismatch_behavior;return Z==="error"||Z==="drop_block"}
-export{Z9 as _,s6 as $,T$ as aa,Cz as ba,Cw as ca,LZ as da,Sw as ea,PJ as fa,kw as ga,YB as ha,vw as ia,fw as ja,Ew as ka,bw as la,gw as ma,yz as na,yw as oa,hw as pa,mw as qa,uw as ra,pz as sa,UB as ta,pw as ua,n0 as va,cw as wa,cz as xa,lw as ya,dw as za,AJ as Aa,iw as Ba,o0 as Ca,CB as Da,H2 as Ea,sw as Fa,tw as Ga,aw as Ha,nw as Ia,ow as Ja,rw as Ka,ew as La,v4 as Ma,$R as Na,ZR as Oa,JR as Pa,XR as Qa,I9 as Ra,YR as Sa,r$ as Ta,hB as Ua,tz as Va,mB as Wa,GR as Xa,az as Ya,nz as Za,oz as _a,uB as $a,zR as ab,q8 as bb,QR as cb,KR as db,WR as eb,VR as fb,nB as gb,BR as hb,Zq as ib,Jq as jb,zq as kb,HR as lb,Vq as mb,LR as nb,jq as ob,L$ as pb,UR as qb,X3 as rb,xR as sb,wq as tb,DR as ub,Cq as vb,hq as wb,K3 as xb,iq as yb,a as zb,PR as Ab,AR as Bb,Uj as Cb,wR as Db,Tj as Eb,Cj as Fb,w8 as Gb,kj as Hb,_Z as Ib,bj as Jb,CR as Kb,uJ as Lb,SR as Mb,JL as Nb,s4 as Ob,AZ as Pb,h3 as Qb,XL as Rb,kR as Sb,QL as Tb,gR as Ub,UL as Vb,wL as Wb,lR as Xb,z1 as Yb,kL as Zb,fL as _b,dR as $b,iR as ac,t4 as bc,gL as cc,yL as dc,hL as ec,sR as fc,tR as gc,aR as hc,nR as ic,aL as jc,oR as kc,rR as lc,rL as mc,eR as nc,x7 as oc,e0 as pc,n3 as qc,R0 as rc,Q1 as sc,$T as tc,ZT as uc,JT as vc,XT as wc,DY as xc,JN as yc,XN as zc,r3 as Ac,GT as Bc,zT as Cc,QT as Dc,MY as Ec,KT as Fc,WT as Gc,VT as Hc,BT as Ic,qT as Jc,e3 as Kc,YN as Lc,jT as Mc,HT as Nc,LT as Oc,NT as Pc,UT as Qc,xT as Rc,DT as Sc,GN as Tc,OT as Uc,zN as Vc,_Y as Wc,MT as Xc,IT as Yc,_T as Zc,PT as _c,AT as $c,sJ as ad,wT as bd,RT as cd,TT as dd,FT as ed,CT as fd,WN as gd,ST as hd,S$ as id,cQ as jd,l6 as kd,VF as ld,o as md,A4 as nd,L1 as od,VO as pd,yF as qd,lF as rd,mK as sd,tF as td,pK as ud,aF as vd,nF as wd,rO as xd,oF as yd,cK as zd,rF as Ad,eF as Bd,$M as Cd,g6 as Dd,xM as Ed,C5 as Fd,WC as Gd,BC as Hd,oK as Id,jC as Jd,HC as Kd,oM as Ld,NC as Md,UC as Nd,KJ as Od,xC as Pd,D6 as Qd,RC as Rd,TC as Sd,iI as Td,tI as Ud,V4 as Vd,fC as Wd,EC as Xd,Z_ as Yd,Y_ as Zd,M8 as _d,mC as $d,N_ as ae,uC as be,pC as ce,E0 as de,cC as ee,lC as fe,sC as ge,tC as he,aC as ie,HW as je,nC as ke,oC as le,$P as me,rC as ne,zP as oe,eC as pe,$S as qe,ZS as re,JS as se,XS as te};