@cortexkit/opencode-anthropic-auth 2.0.2 → 2.1.0

package/dist/cli.js

@@ -1,120 +1,68 @@
 #!/usr/bin/env node
-import{A as S1,B as C9,C as R9,D as f9,E as p9,u as s0,v as U1,w as g9,x as x0,y as L2,z as u0}from"./index-b3mxpp4w.js";import{$ as $1,Aa as i9,Cd as a0,Dd as F2,Ed as E1,Fd as f2,Gd as y9,Kb as _2,Qd as T1,Rd as p3,Xb as T9,Yb as q2,_ as I1,aa as L3,ba as _1,ge as n9,ie as s9,jd as w1,kd as O2,ld as a9,nd as B0,qa as o1,ra as r1,rb as v9,rd as I2,sa as m3,ta as D2,xa as l9,xb as A2,xd as v3,yb as k2}from"./index-j0wsgy54.js";import"./index-fn0zqnnw.js";import{Te as $9,Ue as J8,Ve as M1}from"./index-mge0rw54.js";var r3=J8((AJ,o2)=>{var o3={to($,Z){if(!Z)return`\x1B[${$+1}G`;return`\x1B[${Z+1};${$+1}H`},move($,Z){let J="";if($<0)J+=`\x1B[${-$}D`;else if($>0)J+=`\x1B[${$}C`;if(Z<0)J+=`\x1B[${-Z}A`;else if(Z>0)J+=`\x1B[${Z}B`;return J},up:($=1)=>`\x1B[${$}A`,down:($=1)=>`\x1B[${$}B`,forward:($=1)=>`\x1B[${$}C`,backward:($=1)=>`\x1B[${$}D`,nextLine:($=1)=>"\x1B[E".repeat($),prevLine:($=1)=>"\x1B[F".repeat($),left:"\x1B[G",hide:"\x1B[?25l",show:"\x1B[?25h",save:"\x1B7",restore:"\x1B8"},z8={up:($=1)=>"\x1B[S".repeat($),down:($=1)=>"\x1B[T".repeat($)},Y8={screen:"\x1B[2J",up:($=1)=>"\x1B[1J".repeat($),down:($=1)=>"\x1B[J".repeat($),line:"\x1B[2K",lineEnd:"\x1B[K",lineStart:"\x1B[1K",lines($){let Z="";for(let J=0;J<$;J++)Z+=this.line+(J<$-1?o3.up():"");if($)Z+=o3.left;return Z}};o2.exports={cursor:o3,scroll:z8,erase:Y8,beep:"\x07"}});import{stdin as $6,stdout as Z6}from"node:process";import{createInterface as J6}from"node:readline/promises";import{randomUUID as V4}from"node:crypto";import{constants as g1}from"node:fs";import{lstat as M4,mkdir as D4,open as F4}from"node:fs/promises";import{homedir as L4}from"node:os";import{isAbsolute as C2,join as u3}from"node:path";import{types as l3}from"node:util";import{readFile as U4}from"node:fs/promises";import{resolve as V$}from"node:path";var Y3=60000,o9=4*Y3,J3=new Map,V1=new Map;function z3($){return typeof $==="object"&&$!==null&&!Array.isArray($)}class M${transport;key;#$=[];#Z;constructor($,Z){this.transport=$,this.key=Z}refresh($){if(this.#Z)return this.#Z;for(let[J,z]of V1)if($-z>=Y3)V1.delete(J);let Z=V1.get(this.key);if(Z!==void 0&&$-Z<Y3)return Promise.resolve();return V1.set(this.key,$),this.#Z=(async()=>{try{let J=await this.transport.getUsage();if(!z3(J)||!Array.isArray(J.result)||J.error!==void 0)throw Error("unavailable insula usage");this.#$=J.result.filter((z)=>z3(z)&&typeof z.provider==="string")}catch{this.#$=[]}})().finally(()=>{this.#Z=void 0}),this.#Z}current($,Z,J){for(let z of this.#$){if(z.provider!==$||typeof z.account!=="string"||z.account.trim()!==Z)continue;if(z.stale!==void 0||z.errorClass!==void 0||!z3(z.usage))continue;let Y=typeof z.fetchedAt==="string"?Date.parse(z.fetchedAt):Number.NaN;if(!Number.isFinite(Y)||J-Y>=o9)continue;return{entry:z,context:{fetchedAt:Y,...typeof z.source==="string"&&{source:z.source}}}}return}}function D$($,Z){let J=JSON.stringify([V$($.connectionFile),V$(Z)]),z=J3.get(J);if(!z)z={source:new M$($,J),refs:0},J3.set(J,z);z.refs++;let Y=!1;return{source:z.source,release(){if(Y)return;if(Y=!0,--z.refs===0)J3.delete(J)}}}import{appendFileSync as G7,chmodSync as W7,existsSync as W3,renameSync as C$,statSync as X7}from"node:fs";import{open as K7}from"node:fs/promises";import{dirname as H7,resolve as j7}from"node:path";import{randomUUID as r9}from"node:crypto";import{lstat as N$,readFile as O$,rename as t9,unlink as F$}from"node:fs/promises";import{dirname as V0,resolve as e}from"node:path";var A=process.platform==="win32",L$=new Set;function Q3($){if($?.reason==="io-error"){if($.win32Code===2||$.win32Code===3)return"ENOENT";if($.win32Code===80||$.win32Code===183)return"EEXIST"}return $?.code??"ERR_PRIVATE_FILE"}var B$;function T0(){return B$??=import("./index-74r84r5f.js"),B$}class l extends Error{path;stage;code;win32Code;reason;published=!1;durabilityConfirmed=!1;fileDurable=!1;attempts=0;elapsedMs=0;orphanPath;constructor($,Z,J){let z=J;super(`Private file refused at ${Z}: ${$} (${z?.reason??z?.code??"io-error"}). Use a safe parent directory. Repair only a named secret file in safe ancestry whose owner the published policy trusts, without changing its owner or any existing directory. Previously exposed credentials may need rotation. Windows requires the private-files native prebuild and an ACL-persisting local filesystem such as NTFS.`,{cause:J});this.path=$,this.stage=Z,this.name="PrivateFileError",this.code=Q3(z),this.win32Code=z?.win32Code,this.reason=z?.reason}}async function r($,Z,J){try{return await J()}catch(z){if(z instanceof l)throw z;throw new l($,Z,z)}}var e9;async function U0($,Z){$=e($),Z??=e9,await r($,"safe-parent",async()=>{let J=await(await T0()).verifySafeParent($,Z);if(J.ok===!1){if(J.reason==="io-error"||J.reason==="wrong-kind")await N$($);throw new l(J.level??J.path,"safe-parent",{...J,code:"ERR_PRIVATE_FILES_SECURITY"})}})}async function n($,Z,J=!1){if($=e($),Z==="directory")return U0($);await r($,"verify",async()=>{let z=await T0(),Y=await z.verifyOwnerOnly($),Q=!1;if(!Y.ok){let{reason:G}=Y.refusal;if(G==="io-error")await z.verifyPrivatePath($,Z);if(J&&[z.EXTRA_ACE,z.NOT_PROTECTED,z.NULL_DACL,z.EMPTY_DACL].includes(G))await U0(V0($)),await z.securePrivatePath($,Z),Q=!0;else throw Object.assign(Error("Owner-only verification refused"),{reason:G,code:"ERR_PRIVATE_FILES_SECURITY"})}if(await z.verifyPrivatePath($,Z),Q&&!L$.has($))L$.add($),process.emitWarning(`Private permissions tightened: ${$}. This object may have been readable before; rotate credentials if needed.`,"PrivateFileMigration")})}async function Q0($,Z=!1,J){$=e($),await r($,"directory",async()=>{let z=await T0();try{return await N$($),await U0($,J)}catch(Q){if(Q3(Q)!=="ENOENT")throw Q}let Y=V0($);if(Y===$)throw Object.assign(Error("Missing root"),{code:"ENOENT"});await Q0(Y,!1,J);try{await z.createOwnerOnly($,{kind:"dir"})}catch(Q){if(Q3(Q)!=="EEXIST")throw Q}await U0($,J)})}async function G0($,Z=!1){if(!A)return O$($,"utf8");return(await $7($,Z)).toString("utf8")}async function $7($,Z=!1){if(!A)return O$($);if($=e($),Z)await U0(V0($)),await n($,"file",!0);return r($,"read",async()=>(await T0()).readOwnerOnly($))}async function g0($,Z){await U0(V0(e($))),await r($,"create",async()=>{await(await T0()).createPrivateFile(e($),Z)})}async function I$($){await U0(V0(e($))),await r($,"directory-create",async()=>{await(await T0()).createOwnerOnly(e($),{kind:"dir"})})}async function G3($,Z,J={}){$=e($),Z=e(Z);let z=J.now??(()=>performance.now()),Y=z(),Q=Math.min(Y+500,J.deadline??1/0),G=[0,10,20,40,80,100],W,X=0;for(let j of G){if(z()>=Q)break;if(j)await(J.sleep??((H)=>new Promise((M)=>setTimeout(M,H))))(Math.min(j,Math.max(0,Q-z())));if(z()>=Q)break;if(await J.beforeRename?.(),z()>=Q)break;X++;try{return await(J.rename??t9)($,Z),{attempts:X,elapsedMs:z()-Y}}catch(H){W??=H;let M=H;if(!(M.win32Code!==void 0?M.win32Code===32||M.win32Code===33:["EBUSY","EPERM","EACCES"].includes(M.code??"")&&!M.reason))break}}let K=new l(Z,"rename",W??Object.assign(Error("Publication deadline expired"),{code:"ETIMEDOUT"}));throw K.attempts=X,K.elapsedMs=z()-Y,K}async function h0($,Z,J={}){$=e($),await Q0(V0($));try{await n($,"file",!0)}catch(K){if(K.code!=="ENOENT")throw K}let z=e(J.stagePath??`${$}.${r9()}.tmp`);if(V0(z)!==V0($))throw new l($,"stage-directory",{code:"EXDEV"});let Y=!1,Q=!1,G={attempts:0,elapsedMs:0},W="stage-create",X=(K)=>{try{J.onOutcome?.({path:$,stage:K?.stage??"published",published:Q,fileDurable:Q,durabilityConfirmed:!1,attempts:K?.attempts??G.attempts,elapsedMs:K?.elapsedMs??G.elapsedMs,...K&&{code:K.code,win32Code:K.win32Code}})}catch{}};try{if(await g0(z,Z),Y=!0,W="before-rename",G=await G3(z,$,J),Y=!1,Q=!0,W="published-callback",J.onRenamed?.(),W="published-verify",await n($,"file"),J.durable&&J.durability!=="file-only-on-windows")throw new l($,"directory-sync-unsupported",{code:"ENOTSUP"});X()}catch(K){let j=K instanceof l?K:new l($,W,K);if(j.published=Q,j.fileDurable=Q,Q)Object.assign(j,G);if(Y){try{await F$(z)}catch{j.orphanPath=z}Y=!1}throw X(j),j}finally{if(Y)await F$(z).catch(()=>{})}}var Z7=/^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i,J7=/\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g;function z7($){return $ instanceof Error||Object.prototype.toString.call($)==="[object Error]"}function y0($={}){let Z=[J7,...$.extraValuePatterns??[]].map((Q)=>new RegExp(Q.source,Q.flags.includes("g")?Q.flags:`${Q.flags}g`));function J(Q){let G=Q.toLowerCase().replace(/[-_]/g,"");return Z7.test(Q)||G.includes("apikey")||G.endsWith("secret")||G.endsWith("password")||G.endsWith("token")&&!G.endsWith("tokens")||!!$.extraSecretKeys?.(G)}function z(Q){let G=Q,W=[["name",Q.name],["message",Q.message],["stack",Q.stack]];for(let K of["code","status","cause"])if(G[K]!==void 0)W.push([K,G[K]]);let X=new Set(W.map(([K])=>K));for(let K of Object.entries(Q))if(!X.has(K[0]))W.push(K);return W}function Y(Q,G,W,X=0){if(typeof Q==="string")return Z.reduce((K,j)=>K.replace(j,"***REDACTED***"),Q);if(!Q||typeof Q!=="object")return Q;if(W.has(Q))return"[Circular]";W.add(Q);try{if(Array.isArray(Q))return Q.map((H)=>Y(H,G,W,X));let K=z7(Q);if(K&&X>=8)return"[Truncated]";let j=K?X+1:X;return Object.fromEntries((K?z(Q):Object.entries(Q)).map(([H,M])=>[H,G&&J(H)?"***REDACTED***":Y(M,G,W,j)]))}finally{W.delete(Q)}}return{redact:(Q)=>Y(Q,!0,new WeakSet),redactStrings:(Q)=>Y(Q,!1,new WeakSet)}}var P$=y0(),Y7=P$.redact,Q7=P$.redactStrings;var D1={error:0,warn:1,info:2,debug:3,trace:4},b$=5242880,A$=3;function X3($){try{W7($,384)}catch{}}function U7($){try{if(!(W3($)&&X7($).size>=b$))return;for(let J=A$-1;J>=1;J--)if(W3(`${$}.${J}`)){let z=`${$}.${J+1}`;C$(`${$}.${J}`,z),X3(z)}let Z=`${$}.1`;C$($,Z),X3(Z)}catch{}}async function q0($){let{file:Z,handle:J}=$;if($.file=void 0,$.handle=void 0,Z&&J)await r(Z,"log-close",()=>J.close())}async function R$($,Z){await Q0(H7(Z));try{await n(Z,"file",!0)}catch(J){if(J.code!=="ENOENT")throw J;try{await g0(Z,"")}catch(z){if(z.code!=="EEXIST")throw z;await n(Z,"file",!0)}}return $.handle=await r(Z,"log-open",()=>K7(Z,"a")),$.file=Z,$.handle}async function q7($,Z,J){Z=j7(Z);try{if($.file!==Z)await q0($);let z=$.handle??await R$($,Z);if((await r(Z,"log-stat",()=>z.stat())).size>=b$){await q0($);for(let Q=A$-1;Q>=0;Q--){let G=Q===0?Z:`${Z}.${Q}`,W=`${Z}.${Q+1}`;try{await n(G,"file",!0)}catch(X){if(X.code==="ENOENT")continue;throw X}try{await n(W,"file",!0)}catch(X){if(X.code!=="ENOENT")throw X}await G3(G,W),await n(W,"file")}z=await R$($,Z)}await r(Z,"log-append",()=>z.appendFile(J,"utf8"))}catch(z){throw await q0($).catch(()=>{}),z}}function V7($){try{return` ${JSON.stringify($)}`}catch{return" [unserializable]"}}function M7($){let Z,J,z,Y=y0(),Q,G=[],W,X=Promise.resolve(),K,j={};function H(U){let P=X.then(U);return X=P.catch((I)=>{K=I}),P}function M(U){if(A&&U.file!==Z)H(()=>q0(j)).catch(()=>{});Z=U.file,J=U.level,Y=y0(U),Q=U.captureSink}function D(U){if(U===void 0||U in D1)z=U}function q(){if(Z===void 0)return;return(typeof Z==="function"?Z():Z)||void 0}function B(){if(z)return z;let U=typeof J==="function"?J():J;if(U&&U in D1)return U;return"info"}function N(U=!0){if(W)clearTimeout(W),W=void 0;if(!G.length){if(A)return H(async()=>{if(U)await q0(j);if(K)throw K});return}let P;try{P=q()}catch{if(G=[],A&&U)return H(()=>q0(j));return}let I=G.join("");if(G=[],!P){if(A&&U)return H(()=>q0(j));return}if(A)return H(async()=>{try{await q7(j,P,I)}finally{if(U)await q0(j)}});try{if(U7(P),W3(P))X3(P);G7(P,I,{encoding:"utf8",mode:384})}catch{}}function x(){if(!W)W=setTimeout(()=>{W=void 0;let U=N(!1);if(U instanceof Promise)U.catch(()=>{})},500)}function m(U,P,I,E){if(Z===void 0&&Q===void 0)return;try{if(D1[P]>D1[B()])return;let S=Y.redactStrings(I),h;try{h=Y.redact(E)}catch{h="[unserializable]"}let T=`[${new Date().toISOString()}] ${P.toUpperCase()} [${U}] ${S}`+(E===void 0?"":V7(h))+`
-`;try{Q?.({channel:U,level:P,message:S,data:h})}catch{}if(Z===void 0)return;if(G.push(T),G.length>=50){let k=N(!1);if(k instanceof Promise)k.catch(()=>{})}else x()}catch{}}function p(U){return{error:(P,I)=>m(U,"error",P,I),warn:(P,I)=>m(U,"warn",P,I),info:(P,I)=>m(U,"info",P,I),debug:(P,I)=>m(U,"debug",P,I),trace:(P,I)=>m(U,"trace",P,I)}}function F(){if(A)H(()=>q0(j)).catch(()=>{});if(K=void 0,G=[],W)clearTimeout(W),W=void 0;Z=void 0,J=void 0,z=void 0,Y=y0(),Q=void 0}if($)M($);return{configure:M,createLogger:p,setLogLevel:D,flushLogs:N,reset:F}}var D7=M7();function t0($){return D7.createLogger($)}function K3($){let Z=new AbortController,J=[],z=!1,Y=()=>{if(z)return;z=!0;for(let{source:W,listener:X}of J)W.removeEventListener("abort",X);J.length=0},Q=(W)=>{if(z||Z.signal.aborted)return;Z.abort(W),Y()},G=$.find((W)=>W.aborted);if(G)return Z.abort(G.reason),{signal:Z.signal,dispose:Y};for(let W of $){if(Z.signal.aborted)break;let X=()=>Q(W.reason);if(J.push({source:W,listener:X}),W.addEventListener("abort",X,{once:!0}),W.aborted)Q(W.reason)}return{signal:Z.signal,dispose:Y}}import{createHash as R7,randomBytes as b7,randomUUID as A7}from"node:crypto";import{constants as y$}from"node:fs";import{chmod as k7,mkdir as _7,open as c$,readFile as D3,realpath as f7,rename as E7,stat as p$,unlink as d$}from"node:fs/promises";import{basename as S7,dirname as A0,extname as V5,isAbsolute as M5,join as x7,resolve as D5}from"node:path";import{randomUUID as k$}from"node:crypto";import{mkdir as F7,open as _$,rename as L7,rm as B7}from"node:fs/promises";import{dirname as f$}from"node:path";class H3 extends Error{constructor($){super("file or directory sync failed",{cause:$});this.name="AtomicSyncError"}}async function j3($,Z,J={}){await N7($,Z,J)}async function N7($,Z,J,z){if(A)return h0($,J.serialize?J.serialize(Z):`${JSON.stringify(Z,null,2)}
-`,{beforeRename:J.beforeRename,stagePath:`${$}.${(J.stageName??k$)()}.tmp`,onRenamed:z,durable:J.durable,durability:J.durability,onOutcome:J.onOutcome});await F7(f$($),{recursive:!0});let Y=`${$}.${(J.stageName??k$)()}.tmp`,Q,G=!1;try{if(Q=await _$(Y,"wx",384),G=!0,await Q.writeFile(J.serialize?J.serialize(Z):`${JSON.stringify(Z,null,2)}
-`,"utf8"),await Q.chmod(384),J.durable)try{await Q.sync()}catch(W){throw new H3(W)}if(await Q.close(),Q=void 0,await J.beforeRename?.(),await L7(Y,$),G=!1,z?.(),J.durable){let W=await _$(f$($),"r");try{await W.sync()}catch(X){throw new H3(X)}finally{await W.close()}}}finally{if(await Q?.close().catch(()=>{}),G)await B7(Y,{force:!0}).catch(()=>{})}}var O7=Object.freeze({sidebar:Object.freeze({name:"sidebar-write",ttlMs:1e4,timeoutMs:15000,renew:!0}),preferences:Object.freeze({name:"preferences",ttlMs:1e4,timeoutMs:2000,renew:!0})});import{randomUUID as F1}from"node:crypto";import{mkdir as E$,open as I7,readFile as S$,rename as x$,rm as L1,stat as w$,writeFile as T$}from"node:fs/promises";import{dirname as M3,join as g$}from"node:path";function U3($,Z){return`${$}.${Z}.lock`}class q3 extends Error{details;constructor($){super(`Timed out acquiring ${$.name} lock for ${$.target}`);this.name="LockContentionError",this.details=$}}class m0 extends Error{details;constructor($){super(`Lost ${$.name} lock for ${$.target}`);this.name="LockOwnershipError",this.details=$}}async function V3($,Z,J){let z=performance.now();for(;;){let Y=await M0({path:$,name:Z.name,ttlMs:Z.ttlMs,renew:Z.renew??!1,...Z.onStep?{onStep:Z.onStep}:{},...Z.onRenewalTimer?{onRenewalTimer:Z.onRenewalTimer}:{}});if(Y)try{return await J(Y)}finally{await Y.release()}let Q=Z.timeoutMs-(performance.now()-z);if(Q<=0)throw new q3({target:$,name:Z.name,timeoutMs:Z.timeoutMs});await new Promise((G)=>setTimeout(G,Math.min(25,Math.ceil(Q))))}}var P7=globalThis.setTimeout.bind(globalThis),C7=globalThis.clearTimeout.bind(globalThis);function h$($){let Z=$?.code;return Z==="ENOENT"||!A&&(Z==="EINVAL"||Z==="ENOTDIR")}async function M0($){let Z=U3($.path,$.name),J=g$(Z,"owner.json"),z=F1(),Y=$.now??Date.now,Q=null,G=!1,W=!1,X,K,j=new Promise((L)=>{K=L});function H(L){try{let O=$.onRenewalTimer?.(L);if(O&&(typeof O==="object"||typeof O==="function")&&"then"in O&&typeof O.then==="function")Promise.resolve(O).catch(()=>{})}catch{}}function M(){if(!Q)return;C7(Q),Q=null,H("cancelled")}function D(L,O){if(X||G)return;X=Object.freeze({reason:L,expectedOwnerId:z,...typeof O?.ownerId==="string"?{observedOwnerId:O.ownerId}:{},...typeof O?.expiresAt==="number"?{observedExpiresAt:O.expiresAt}:{}}),M(),K(X)}let q,B=null,N=`${Z}.evicting`,x=g$(N,"owner.json"),m=F1(),p=5000,F=8;async function U(){if(A)try{return JSON.parse(await G0(Z,!0))}catch(L){if(L.code!=="EISDIR"&&L.reason!=="wrong-kind")throw L;return await n(Z,"directory",!0),JSON.parse(await G0(J,!0))}try{return JSON.parse(await S$(Z,"utf8"))}catch(L){if(L.code!=="EISDIR")throw L;return JSON.parse(await S$(J,"utf8"))}}async function P(){if(A){let v=await U(),u=Number(v?.expiresAt)-Y();await h0(Z,`${JSON.stringify({ownerId:z,expiresAt:Y()+$.ttlMs})}
-`,{deadline:performance.now()+Math.max(0,u),beforeRename:async()=>{let q1=await U();if(q1?.ownerId!==z||!(Number(q1?.expiresAt)>Y())||!await _())throw new m0({target:$.path,name:$.name})}});return}let L=`${Z}.${F1()}.tmp`,O,C=!1;try{O=await I7(L,"wx",384),C=!0,await O.writeFile(`${JSON.stringify({ownerId:z,expiresAt:Y()+$.ttlMs})}
-`,"utf8"),await O.chmod(384),await O.close(),O=void 0;let v=await U();if(v?.ownerId!==z||!(Number(v?.expiresAt)>Y())||!await _())throw new m0({target:$.path,name:$.name});await x$(L,Z),C=!1}finally{if(await O?.close().catch(()=>{}),C)await L1(L,{force:!0}).catch(()=>{})}}async function I(){let L=`${JSON.stringify({ownerId:z,expiresAt:Y()+$.ttlMs})}
-`;if(A)await g0(Z,L);else await T$(Z,L,{encoding:"utf8",mode:384,flag:"wx"})}async function E(L){let O=L.code;if(O==="EEXIST"){if(A)await U();return!0}if(O==="EISDIR"){if(A)await n(Z,"directory",!0),await G0(J,!0);return!0}return!1}async function S(){if(A)await Q0(M3(Z));try{return await I(),!0}catch(L){let O=L.code;if(await E(L))return!1;if(O==="ENOENT"){if(A)await Q0(M3(Z));else await E$(M3(Z),{recursive:!0});try{return await I(),!0}catch(C){if(await E(C))return!1;throw C}}throw L}}async function h(){await new Promise((L)=>setTimeout(L,Math.floor(Math.random()*4)))}async function T(L=!0){if(L&&$.onStep)await $.onStep("lock-read-ready");let O;try{O=await U()}catch(v){if(A&&v.code!=="ENOENT")throw v}let C=Number(O?.expiresAt);if(Number.isFinite(C)&&C>Y())return{status:"live"};if(typeof O?.ownerId==="string"&&Number.isFinite(C))return{status:"stale",identity:{kind:"owner",ownerId:O.ownerId,expiresAt:C}};try{let v=await w$(Z),u=Number.isFinite(C)?C:v.mtimeMs+$.ttlMs;if(u>Y())return{status:"live"};return{status:"stale",identity:{kind:"stat",dev:v.dev,ino:v.ino,mtimeMs:v.mtimeMs,expiresAt:u}}}catch(v){if(v.code==="ENOENT"){if($.onStep)await $.onStep("lock-missing");return{status:"missing"}}throw v}}function k(L,O){if(O.status!=="stale")return!1;let C=O.identity;if(L.kind==="owner"&&C.kind==="owner")return L.ownerId===C.ownerId&&L.expiresAt===C.expiresAt;return L.kind==="stat"&&C.kind==="stat"&&L.dev===C.dev&&L.ino===C.ino&&L.mtimeMs===C.mtimeMs&&L.expiresAt===C.expiresAt}async function _(){try{return JSON.parse(await G0(x,A))?.ownerId===m}catch(L){if(A&&L.code!=="ENOENT")throw L;return!1}}async function b(L){if(A)await r(L,"remove",()=>L1(L,{recursive:!0,force:!0}));else await L1(L,{recursive:!0,force:!0}).catch(()=>{})}async function c(){if(await _())await b(N)}async function o(){if(A)await I$(N);else await E$(N);try{let L=`${JSON.stringify({ownerId:m,createdAt:Y()})}
-`;if(A)await g0(x,L);else await T$(x,L,{encoding:"utf8",mode:384,flag:"wx"})}catch(L){if(h$(L))return!1;throw await c(),L}if($.onStep)await $.onStep("eviction-marker-acquired");return!0}async function i(){let L;try{L=await w$(N)}catch(C){if(C.code==="ENOENT")return"missing";throw C}if(A)await n(N,"directory",!0);if(L.mtimeMs+p>Y())return"fresh";if($.onStep)await $.onStep("stale-marker-stat");let O=`${N}.${F1()}`;try{await x$(N,O)}catch(C){if(C.code==="ENOENT")return"missing";throw C}if($.onStep)await $.onStep("stale-marker-claimed");return await b(O),"recovered"}async function j0(L){try{if(!await o())return!1}catch(O){if(O.code==="EEXIST"){if(A){await n(N,"directory",!0);try{await G0(x,!0)}catch(C){if(C.code!=="ENOENT")throw C}}return!1}throw O}try{await L()}finally{await c()}return!0}async function w(){for(let L=0;L<F;L++){if($.onStep)await $.onStep("relinquish-read");let O;try{O=await U()}catch(C){if(A)throw C;return}if(O?.ownerId!==z)return;try{await L1(Z,{recursive:!0,force:!0});return}catch(C){if(A)throw C;await h()}}}function z0(){if(!$.renew||G||X)return;let L=$.renewIntervalMs??Math.max(1000,Math.floor($.ttlMs/3));if(Q=P7(()=>{Q=null;let O=(async()=>{let C=!G;try{if(!await j0(async()=>{let u=await U(),q1=Y();if(G||X){C=!1;return}if(u?.ownerId!==z){D("taken-over",u),C=!1;return}if(!(Number(u?.expiresAt)>q1)){D("expired",u),C=!1;return}if($.onStep)await $.onStep("renewal-owner-confirmed");if(G||X){C=!1;return}if(!await _())return;if($.onStep)await $.onStep("renewal-write-fenced");if(G||X){C=!1;return}if(!await _())return;if($.onStep)await $.onStep("renewal-write-ready");if(G||X){C=!1;return}if(await P(),$.onStep)await $.onStep("renewal-write-finished");if(!await _()){D("marker-lost"),C=!1,await w();return}})&&$.onStep)await $.onStep("renewal-marker-unavailable")}catch(v){if(A&&v instanceof l)q=v,D("renewal-failed"),C=!1;try{let u=await U();if(u?.ownerId!==z)D("taken-over",u);else if(!(Number(u?.expiresAt)>Y()))D("expired",u)}catch{D("renewal-failed")}}finally{if($.onStep)try{await $.onStep("renewal-finished")}catch{}if(C&&!G&&!X)z0()}})();B=O,O.finally(()=>{if(B===O)B=null})},L),"unref"in Q)Q.unref();H("scheduled")}function q$(){try{let L=$.onContended?.();if(L&&(typeof L==="object"||typeof L==="function")&&"then"in L&&typeof L.then==="function")Promise.resolve(L).catch(()=>{})}catch{}return null}let R0=await S();if(!R0)for(let L=0;L<F;L++){if(R0=await S(),R0)break;let O=await T();if(O.status==="live")return q$();if(O.status==="missing")continue;if($.onStep)await $.onStep("stale-lock-observed");try{if(!await o()){await h();continue}}catch(C){if(C.code!=="EEXIST")throw C;if(await i()==="fresh")return null;await h();continue}try{let C=await T();if(C.status==="live")return q$();if(!k(O.identity,C))continue;if(!await _())return null;if($.onStep)await $.onStep("stale-lock-confirmed");if(!await _())return null;let v=await T(!1);if(!k(O.identity,v))continue;if(await b(Z),!await _())return null;if($.onStep)await $.onStep("stale-lock-removed");if(R0=await S(),!R0)return null;if($.onStep)await $.onStep("stale-lock-recreated");if(!await _())return await w(),R0=!1,null;break}finally{await c()}}if(!R0)return null;return z0(),{ownerId:z,whenLost:()=>j,hasLost:()=>X!==void 0,assertOwned:async()=>{if(q)throw q;let L;try{let O=await U();if(L=O,!G&&!X&&O?.ownerId===z&&Number(O?.expiresAt)>Y())return;D(O?.ownerId!==z?"taken-over":"expired",O)}catch(O){if(D("unreadable"),A&&O instanceof l)throw O}throw new m0({target:$.path,name:$.name,expectedOwnerId:z,...typeof L?.ownerId==="string"?{observedOwnerId:L.ownerId}:{},...typeof L?.expiresAt==="number"?{observedExpiresAt:L.expiresAt}:{}})},release:async()=>{if(A&&W)return;G=!0,M(),await B;for(let L=0;L<F;L++){try{let O=!1;if(await j0(async()=>{let v;try{v=await U()}catch(u){if(A&&u.code==="ENOENT"){O=!0;return}throw u}if(v?.ownerId!==z){O=!0;return}if($.onStep)await $.onStep("release-owner-confirmed");if(!await _())return;await b(Z),O=!0})){if(A&&!O)throw new l(Z,"release-not-confirmed",{code:"EIO"});W=O;return}await i()}catch(O){if(A)throw O;return}await h()}if(A)throw new l(Z,"release-not-confirmed",{code:"ETIMEDOUT"})}}}class R extends Error{kind;constructor($,Z){super(Z);this.name="ClaustrumConsumerError",this.kind=$}}var w7=1,N1=16384,u$=30000,B3=/^[0-9a-f]{64}$/,l$=new Set(["invalid_params","pending_exists","not_found","already_consumed","superseded","stale_generation"]),i$=new Set(["pending_queue_full"]);function F3($){if(!($ instanceof $1))return;if(l$.has($.code))return{code:$.code,disposition:"terminal"};if(i$.has($.code))return{code:$.code,disposition:"retry"};return{code:$.code,disposition:$.action==="retry"?"retry":"terminal"}}function N3($){return L3.connect($)}function a$($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function B1($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0}function n$($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=1}function e0(){return new R("invalid-state","invalid Claustrum enrollment state")}function O3($){if(!a$($)||$.version!==w7||typeof $.proposedName!=="string"||$.proposedName.length===0)throw e0();if($.phase==="pending"){if(!B3.test(String($.requestSecret??""))||$.requestId!==void 0&&(typeof $.requestId!=="string"||$.requestId.length===0)||!B1($.createdAt)||!B1($.updatedAt))throw e0();return{version:1,phase:"pending",proposedName:$.proposedName,requestSecret:$.requestSecret,...$.requestId!==void 0&&{requestId:$.requestId},createdAt:$.createdAt,updatedAt:$.updatedAt}}if($.phase==="approved"){if($.approvedName!==void 0&&(typeof $.approvedName!=="string"||$.approvedName.length===0)||!n$($.tokenGeneration)||!B1($.updatedAt))throw e0();return{version:1,phase:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration,updatedAt:$.updatedAt}}if($.phase==="denied"||$.phase==="blocked"){if($.errorCode!==void 0&&typeof $.errorCode!=="string"||!B1($.updatedAt))throw e0();return{version:1,phase:$.phase,proposedName:$.proposedName,...$.errorCode!==void 0&&{errorCode:$.errorCode},updatedAt:$.updatedAt}}throw e0()}function I3($){if(!a$($)||!B3.test(String($.token??""))||!n$($.token_generation))throw new R("invalid-token","invalid Claustrum enrollment token file");return{token:$.token,token_generation:$.token_generation}}function T7($){if(!$.isFile())throw new R("unsafe-file","Claustrum enrollment file must be a regular file");if(($.mode&63)!==0)throw new R("unsafe-file","Claustrum enrollment file must be owner-only");let Z=process.geteuid?.();if(Z!==void 0&&$.uid!==Z)throw new R("unsafe-file","Claustrum enrollment file must be owned by the current user")}function m$($){try{return JSON.parse($)}catch{throw new R("invalid-state","Claustrum enrollment file is not valid JSON")}}async function k0($){if(A)try{await Q0(A0($));let J=await G0($,!0);if(Buffer.byteLength(J)>N1)throw new R("unsafe-file","Claustrum enrollment file is too large");return m$(J)}catch(J){if(J.code==="ENOENT")return;throw J}let Z;try{Z=await c$($,y$.O_RDONLY|y$.O_NOFOLLOW)}catch(J){if(J.code==="ENOENT")return;throw new R("unsafe-file","Claustrum enrollment file could not be opened safely")}try{T7(await Z.stat());let J=Buffer.alloc(N1+1),{bytesRead:z}=await Z.read(J,0,J.byteLength,0);if(z>N1)throw new R("unsafe-file","Claustrum enrollment file is too large");return m$(J.subarray(0,z).toString("utf8"))}finally{await Z.close()}}function v$($,Z){let J=[];for(let z of $.split(`
-`)){if(z.trim()===""||z.startsWith("#"))continue;let Y=z.split(":");if(Y.length!==Z||!/^[^\s:,]+$/.test(Y[0]??"")||!/^\d+$/.test(Y[2]??"")||!Number.isSafeInteger(Number(Y[2]))||Z===7&&(!/^\d+$/.test(Y[3]??"")||!Number.isSafeInteger(Number(Y[3])))||Z===4&&Y[3]!==""&&!/^[^\s:,]+(?:,[^\s:,]+)*$/.test(Y[3]??""))return;J.push(Y)}return J}async function g7($,Z,J){try{let[z,Y]=await Promise.all([D3(J.passwdPath??"/etc/passwd","utf8"),D3(J.groupPath??"/etc/group","utf8")]),Q=v$(z,7),G=v$(Y,4);if(!Q||!G)return!1;let W=Q.filter((H)=>Number(H[2])===$),X=G.filter((H)=>Number(H[2])===Z);if(W.length!==1||X.length!==1)return!1;let K=W[0]?.[0],j=X[0]?.[3]??"";return(j===""||j.split(",").every((H)=>H===K))&&!Q.some((H)=>Number(H[2])!==$&&Number(H[3])===Z)}catch{return!1}}function s$($){if(!$.passwdPath&&!$.groupPath)return;return{fs:{readFile:(Z)=>D3(Z==="/etc/passwd"?$.passwdPath??Z:Z==="/etc/group"?$.groupPath??Z:Z)}}}async function o$($,Z={}){if(!A){let J=process.geteuid?.();if(J===void 0)return;let z=process.getegid?.(),Y;try{Y=await f7($)}catch{return}let Q;for(;;){let G=await p$(Y).catch(()=>{return});if(G&&(G.mode&18)!==0&&(G.mode&512)===0){if(Q===void 0)Q=z!==void 0&&await g7(J,z,Z);if((G.mode&2)!==0||G.uid!==J||G.gid!==z||!Q)throw new R("unsafe-file",`Claustrum enrollment path has a writable ancestor: ${Y}. Another user could replace it. Run: chmod g-w,o-w ${Y}`)}let W=A0(Y);if(W===Y)return;Y=W}}try{await U0($,s$(Z))}catch(J){if(!(J instanceof l))throw J;throw new R("unsafe-file",`Claustrum enrollment parent refused: ${J.path} (${J.reason??J.code}). Use a folder that other users cannot write or replace.`)}}async function O1($,Z={}){if(A){await Q0($,!1,s$(Z));return}await _7($,{recursive:!0,mode:448});let J=await p$($),z=process.geteuid?.();if(z!==void 0&&J.uid!==z)throw new R("unsafe-file","Claustrum enrollment directory must be owned by the current user");if((J.mode&63)!==0)await k7($,448)}async function b0($,Z,J={}){let z=A0($);await O1(z,J),await o$(z,J);let Y=`${JSON.stringify(Z)}
-`;if(Buffer.byteLength(Y)>N1)throw new R("invalid-state","Claustrum enrollment state is too large");if(A)return h0($,Y);let Q=x7(z,`.${S7($)}.${process.pid}.${A7()}.tmp`),G,W=!1;try{G=await c$(Q,"wx",384),W=!0,await G.writeFile(Y,"utf8"),await G.chmod(384),await G.sync(),await G.close(),G=void 0,await E7(Q,$),W=!1}finally{if(await G?.close().catch(()=>{}),W)await d$(Q).catch(()=>{})}}async function P1($,Z){let J=await k0($.tokenPath),z=J===void 0?void 0:I3(J),Y=await k0($.statePath),Q=Y===void 0?void 0:O3(Y);if(z)return{state:"approved",proposedName:Q?.proposedName??Z,...Q?.phase==="approved"&&Q.approvedName!==void 0&&{approvedName:Q.approvedName},tokenGeneration:z.token_generation};if(!Q)return{state:"idle"};if(Q.phase==="approved")return{state:"blocked",proposedName:Q.proposedName,code:"missing_token"};return D0(Q)}async function _0($){let Z=await k0($);if(Z===void 0)throw new R("not-enrolled","Claustrum enrollment is not configured");return I3(Z)}function D0($){if($.phase==="pending")return{state:"pending",proposedName:$.proposedName,...$.requestId!==void 0&&{requestId:$.requestId}};if($.phase==="approved")return{state:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration};if($.phase==="denied")return{state:"denied",proposedName:$.proposedName};return{state:"blocked",proposedName:$.proposedName,code:$.errorCode??"unknown"}}function r$(){return new R("wrong-consumer","Claustrum enrollment state belongs to a different consumer")}class C1{#$;#Z;#J;#Q;#K;#Y;#z;constructor($){this.#z=$.ancestorOptions??{},this.#$=$.client,this.#Z=$.paths,this.#J=$.proposedName,this.#Q=$.now??Date.now,this.#K=$.mintSecret??(()=>b7(32).toString("hex")),this.#Y=$.writeTokenFile??I1}async status(){return P1(this.#Z,this.#J)}async resetTerminal(){return t$(this.#Z,this.#J)}async#W($,Z){let J={version:1,phase:"blocked",proposedName:$.proposedName,errorCode:Z,updatedAt:this.#Q()};return await b0(this.#Z.statePath,J,this.#z),D0(J)}async reconcile(){await O1(A0(this.#Z.statePath),this.#z);let $=await M0({name:"ceremony",path:this.#Z.statePath,ttlMs:u$,renew:!0});if(!$)return{state:"busy"};try{let Z=await k0(this.#Z.tokenPath),J=Z===void 0?void 0:I3(Z),z=await k0(this.#Z.statePath),Y=z===void 0?void 0:O3(z);if(Y&&Y.proposedName!==this.#J)throw r$();if(J){if(!Y||Y.phase==="pending"){let G={version:1,phase:"approved",proposedName:Y?.proposedName??this.#J,tokenGeneration:J.token_generation,updatedAt:this.#Q()};await b0(this.#Z.statePath,G,this.#z),Y=G}return{state:"approved",proposedName:Y.proposedName,...Y.phase==="approved"&&Y.approvedName!==void 0&&{approvedName:Y.approvedName},tokenGeneration:J.token_generation}}if(Y?.phase==="approved"){let G={version:1,phase:"blocked",proposedName:Y.proposedName,errorCode:"missing_token",updatedAt:this.#Q()};return await b0(this.#Z.statePath,G,this.#z),D0(G)}if(Y&&Y.phase!=="pending")return D0(Y);if(!Y){let G=this.#Q();if(Y={version:1,phase:"pending",proposedName:this.#J,requestSecret:this.#K(),createdAt:G,updatedAt:G},!B3.test(Y.requestSecret))throw new R("invalid-state","invalid minted Claustrum enrollment secret");await b0(this.#Z.statePath,Y,this.#z)}if(!Y.requestId)try{let G=R7("sha256").update(Buffer.from(Y.requestSecret,"hex")).digest("hex"),W=await this.#$.enrollPropose({name:Y.proposedName,requestSecretHash:G});Y={...Y,requestId:W.requestId,updatedAt:this.#Q()},await b0(this.#Z.statePath,Y,this.#z)}catch(G){let W=F3(G);if(!W)throw G;if(W.disposition==="retry")return{state:"pending",proposedName:Y.proposedName,retryCode:W.code};return this.#W(Y,W.code)}let Q=Y.requestId;if(!Q)return D0(Y);try{let G=await this.#$.enrollPoll({requestId:Q,requestSecret:Y.requestSecret});if(G.status==="pending")return D0(Y);if(G.status==="denied"){let X={version:1,phase:"denied",proposedName:Y.proposedName,updatedAt:this.#Q()};return await b0(this.#Z.statePath,X,this.#z),D0(X)}await O1(A0(this.#Z.tokenPath),this.#z),await o$(A0(this.#Z.tokenPath),this.#z),await this.#Y(this.#Z.tokenPath,{token:G.token,token_generation:G.tokenGeneration});let W={version:1,phase:"approved",proposedName:Y.proposedName,approvedName:G.name,tokenGeneration:G.tokenGeneration,updatedAt:this.#Q()};return await b0(this.#Z.statePath,W,this.#z),D0(W)}catch(G){let W=F3(G);if(!W)throw G;if(W.disposition==="retry")return{state:"pending",proposedName:Y.proposedName,requestId:Q,retryCode:W.code};return this.#W(Y,W.code)}}finally{await $.release()}}}async function t$($,Z){await O1(A0($.statePath));let J=await M0({name:"ceremony",path:$.statePath,ttlMs:u$,renew:!0});if(!J)return"busy";try{if(await k0($.tokenPath)!==void 0)return"refused-approved";let z=await k0($.statePath);if(z===void 0)return"idle";let Y=O3(z);if(Y.proposedName!==Z)throw r$();if(Y.phase==="pending")return"refused-pending";return await J.assertOwned(),await d$($.statePath),"reset"}finally{await J.release()}}var P3="claustrum-tombstone:v1:";function e$($,Z){return Z!==void 0&&Z.credentialId===$.credentialId&&Z.accountIdentity===$.accountIdentity&&Z.recordVersion!==$.recordVersion}function h7($,Z){if(Z===void 0)return"reauthorize-failed";if(Z.credentialId!==$.credentialId)return"credential-changed";if(Z.accountIdentity!==$.accountIdentity)return"account-changed";if(Z.recordVersion===$.recordVersion)return"version-unchanged";return"rotated"}var $2=t0("claustrum");function b3($,Z,J,z=$2){let Y=e$(Z,J);return z.debug("scoped 401 re-authorized",{site:$,credentialId:Z.credentialId,servedVersion:Z.recordVersion,currentVersion:J?.recordVersion??null,retry:Y,reason:h7(Z,J)}),Y}var R3=300000;function C3(){return new R("invalid-material","Claustrum returned invalid credential material")}function y7($){let Z=$.trim();if(Z.startsWith("{")){let J;try{J=JSON.parse(Z)}catch{throw C3()}if(!J||typeof J!=="object")throw C3();let z=J,Y=z.access_token??z.access;Z=typeof Y==="string"?Y:""}if(!/^[\x21-\x7e]+$/.test(Z)||Z.startsWith(P3))throw C3();return Z}function m7($,Z){if(!$.operations.includes("read"))return;if(!$.categories.includes(Z.category))return;if($.credentialType==="oauth")return $.refreshAdapter===Z.refreshAdapter?"oauth":void 0;if($.credentialType==="api_key"&&Z.apiKeys)return $.refreshAdapter===void 0?"api_key":void 0;return}class R1{#$;#Z;#J;#Q;#K;#Y;#z;#W=new WeakMap;#U=new WeakMap;#X=!1;constructor($){let Z=$.tokenPath;if($.readToken)this.#Z=$.readToken;else if(Z)this.#Z=()=>_0(Z);else throw new R("not-enrolled","Claustrum enrollment token path is required");this.#$=$.client,this.#Q=$.family,this.#K=$.parseIdentity,this.#Y=$.requireAssertion??!1,this.#J=$.now??Date.now,this.#z=$.logger??$2}#G($){if(this.#X)throw new R("closed","Claustrum scoped custody is closed");$?.throwIfAborted()}async#H($){this.#G($);let Z=await this.#Z();if(this.#G($),!/^[0-9a-f]{64}$/.test(Z.token)||!Number.isSafeInteger(Z.token_generation)||Z.token_generation<1)throw new R("invalid-token","Invalid Claustrum enrollment token");return Z.token}async#j($,Z){this.#G(Z);let J,z;try{let Y=$();J=Z?await Promise.race([Y,new Promise((Q,G)=>{let W=()=>G(Z.reason);if(Z.addEventListener("abort",W,{once:!0}),z=()=>Z.removeEventListener("abort",W),Z.aborted)W()})]):await Y}catch(Y){if(this.#G(Z),Y instanceof $1)throw Y;throw new R("unavailable","Claustrum scoped operation unavailable")}finally{z?.()}return this.#G(Z),J}async discover($){let Z=await this.#H($),J=await this.#j(()=>this.#$.listScoped(Z),$),z=[],Y=[],Q=new Map;for(let W of J.rows){let X=m7(W,this.#Q);if(!X)continue;Y.push({row:W,type:X}),Q.set(W.id,(Q.get(W.id)??0)+1)}let G=[];for(let{row:W,type:X}of Y){let K;if(!W.id.trim())K="empty credential id";else if((Q.get(W.id)??0)>1)K="duplicate credential id";else if(W.accountId!==void 0&&!W.accountId.trim())K="blank account identity";else if(!W.state.trim())K="empty state";if(K){z.push({...W.id.trim()&&{credentialId:W.id},reason:K});continue}G.push(Object.freeze({credentialId:W.id,credentialType:X,...W.accountId!==void 0&&{accountIdentity:W.accountId},state:W.state,...W.email!==void 0&&{email:W.email},...W.orgName!==void 0&&{orgName:W.orgName}}))}for(let W of z)this.#z.warn("skipped malformed vault record",W);return{view:J.view,credentials:Object.freeze(G),skipped:Object.freeze(z)}}async authorize($,Z){if(!$.credentialId)throw new R("route-unavailable","Claustrum dispatch requires a credential id");let{credentialId:J,credentialType:z,accountIdentity:Y}=$;if(this.#Y&&Y===void 0)throw new R("identity-unasserted","Claustrum dispatch requires a known account identity");let Q=await this.#H(Z),G=await this.#j(()=>this.#$.getScoped({credentialId:J,enrollmentToken:Q,...z==="oauth"&&{minTtlMs:R3}}),Z);if(G.credentialId!==void 0&&G.credentialId!==J)throw new R("identity-changed","Claustrum served credential identity changed");let W=G.expiresAtMs;if(!Number.isSafeInteger(G.recordVersion)||G.recordVersion<0||W===null&&z==="oauth"||W!==null&&(!Number.isFinite(W)||W-this.#J()<R3))throw new R("insufficient-validity","Claustrum served credential has insufficient validity");let X=y7(G.material),K=G.accountId?.trim()?G.accountId:void 0;if(this.#Y&&(G.credentialId===void 0||K===void 0))throw new R("identity-unasserted","Claustrum served credential did not assert its identity");let j=K===void 0?this.#K?.(X):void 0,H=K??j;if(Y!==void 0&&H!==void 0&&H!==Y)throw new R("identity-changed","Claustrum served credential identity changed");let M=H??Y,q=Object.freeze(Object.defineProperty({credentialId:J,credentialType:z,...M!==void 0&&{accountIdentity:M},accountIdentitySource:K!==void 0?"asserted":j!==void 0?"parsed":Y!==void 0?"expected":"none",...Y!==void 0&&{expectedAccountIdentity:Y},...G.credentialId!==void 0&&{assertedCredentialId:G.credentialId},...K!==void 0&&{assertedAccountIdentity:K},...G.projectId!==void 0&&{projectId:G.projectId},recordVersion:G.recordVersion,expiresAtMs:W},"accessToken",{value:X,enumerable:!1}));return this.#W.set(q,Q),q}async reportFailure($,Z,J){if(Z!==401)return;this.#G();let z=this.#W.get($);if(!z)throw new R("no-receipt","Claustrum failure report requires an original dispatch receipt");let Y=this.#U.get($);if(Y)return Y;let Q=this.#j(()=>this.#$.reportAuthFailureScoped({credentialId:$.credentialId,enrollmentToken:z,providerStatus:401,recordVersion:$.recordVersion,reporterSource:J}));this.#U.set($,Q);try{await Q,this.#z.debug("scoped 401 reported",{credentialId:$.credentialId,recordVersion:$.recordVersion,reporterSource:J})}catch(G){throw this.#U.delete($),G}}close(){if(this.#X)return;this.#X=!0,this.#$.close()}}import{createHash as r7}from"node:crypto";var f0="all",v7=Object.freeze(["primary"]);function J2($){return $.kind==="retired"?$.retiredAt:$.checkedAt}function v0($,Z){return JSON.stringify([$,Z])}function E0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function t($){return typeof $==="number"&&Number.isFinite($)}function Z2($){return typeof $==="string"&&$.length>0}function Y0($,Z,J){return $[Z]===void 0||J($[Z])}function c7($){return t($)&&$>0}function A3($){return typeof $==="string"}function p7($){if(!E0($)||!Z2($.scope)||!Z2($.label))return!1;switch($.kind){case"reading":return t($.checkedAt)&&t($.usedPercent)&&Y0($,"resetsAt",A3)&&Y0($,"windowMinutes",c7);case"retired":return t($.retiredAt);case"absent":return t($.checkedAt);default:return!1}}function d7($){if(!E0($)||!t($.checkedAt))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&Y0($,"remainingPercent",t)&&Y0($,"usedPercent",t)&&Y0($,"resetsAt",A3)&&Y0($,"limit",t)&&Y0($,"used",t)&&Y0($,"remaining",t)&&Y0($,"unit",A3)}function z2($){return E0($)&&t($.value)&&Number.isInteger($.value)&&$.value>=0&&t($.checkedAt)}function k3($){return E0($)&&Object.values($).every(z2)}function Y2($){if(!E0($))return;let Z=Object.entries($).filter(([,J])=>z2(J));return Z.length===0?void 0:Object.fromEntries(Z)}function S0($){if(Z1($))return $;if(!E0($))return;let{counters:Z,...J}=$;if(!Z1(J))return;let z=Y2(Z);return{...J,...z===void 0?{}:{counters:z}}}function Z1($){if(!E0($)||!Array.isArray($.limits))return!1;let Z=new Set;for(let J of $.limits){if(!p7(J))return!1;let z=v0(J.scope,J.label);if(Z.has(z))return!1;Z.add(z)}return Y0($,"budget",d7)&&Y0($,"counters",k3)}class b1 extends TypeError{constructor($){super($);this.name="QuotaCodecError"}}function k1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function A1($){return typeof $==="number"&&Number.isFinite($)}function Q2($){return $===void 0||typeof $==="string"&&$!==""}function G2($){return typeof $==="string"&&$!==""}function J1($,Z){return $[Z]===void 0||A1($[Z])}function _3($,Z){return $[Z]===void 0||typeof $[Z]==="string"}function u7($){return k1($)&&Q2($.scope)&&G2($.label)&&A1($.usedPercent)&&_3($,"resetsAt")&&($.windowMinutes===void 0||A1($.windowMinutes)&&$.windowMinutes>0)}function l7($){return k1($)&&Q2($.scope)&&G2($.label)}function i7($){if(!k1($))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&J1($,"remainingPercent")&&J1($,"usedPercent")&&_3($,"resetsAt")&&J1($,"limit")&&J1($,"used")&&J1($,"remaining")&&_3($,"unit")}function W2($){if(!k1($)||!A1($.checkedAt))return!1;let Z=$.readings??[],J=$.coverage??[];if(!Array.isArray(Z)||!Array.isArray(J))return!1;let z=new Set;for(let Y of Z){if(!u7(Y))return!1;let Q=v0(Y.scope??f0,Y.label);if(z.has(Q))return!1;z.add(Q)}if(!J.every(l7))return!1;return($.budget===void 0||i7($.budget))&&($.counters===void 0||k3($.counters))}function a7($,Z){if($.scope!==Z.scope)return $.scope<Z.scope?-1:1;if($.label!==Z.label)return $.label<Z.label?-1:1;return 0}function n7($,Z,J){if(Z===void 0)return $;if($!==void 0&&J<$.checkedAt)return $;return{...Z,checkedAt:J}}function s7($,Z){let J=new Map(Object.entries($??{}));for(let[z,Y]of Object.entries(Z??{})){let Q=J.get(z);if(Q===void 0||Y.checkedAt>=Q.checkedAt)J.set(z,Y)}return J.size===0?void 0:Object.fromEntries(J)}function c0($,Z){let J=$===void 0?void 0:S0($);if($!==void 0&&J===void 0)throw new b1("stored quota map is malformed");if(!W2(Z))throw new b1("quota observation is malformed");let z=J??{limits:[]},Y=Z.checkedAt,Q=new Map;for(let q of z.limits)Q.set(v0(q.scope,q.label),q);let G=(q)=>{let B=Q.get(q);return B===void 0||Y>=J2(B)},W=new Set;for(let q of Z.readings??[]){let B=q.scope??f0,N=v0(B,q.label);if(W.add(N),!G(N))continue;Q.set(N,{scope:B,label:q.label,kind:"reading",checkedAt:Y,usedPercent:q.usedPercent,...q.resetsAt===void 0?{}:{resetsAt:q.resetsAt},...q.windowMinutes===void 0?{}:{windowMinutes:q.windowMinutes}})}for(let q of Z.coverage??[]){let B=q.scope??f0,N=v0(B,q.label);if(W.has(N)||!G(N))continue;let x=Q.get(N);Q.set(N,x===void 0||x.kind==="absent"?{scope:B,label:q.label,kind:"absent",checkedAt:Y}:{scope:B,label:q.label,kind:"retired",retiredAt:Y})}let{limits:X,budget:K,counters:j,...H}=z,M=n7(z.budget,Z.budget,Y),D=s7(z.counters,Z.counters);return{...H,limits:[...Q.values()].sort(a7),...M===void 0?{}:{budget:M},...D===void 0?{}:{counters:D}}}var o7=Object.freeze({validate:Z1,decode:S0,merge:c0});function X2($,Z,J){if($.accountIdentity!==void 0&&J!==void 0)return $.accountIdentity===J;return $.credentialId===Z}function f3($,Z,J){return $.some((z)=>X2(z,Z,J))}function E3($,Z,J){let z={credentialId:Z,...J!==void 0&&{accountIdentity:J}};return[...$.filter((Y)=>Y.credentialId!==Z||Y.accountIdentity!==J),z]}function S3($,Z,J){return $.filter((z)=>!Z.some((Y)=>X2(z,Y,J)))}var H2="vault:";function t7($){return r7("sha256").update($).digest("hex")}function e7($){let Z=$.credentialId.split(":");return(Z.length>=3?Z.slice(2).join(":").trim():void 0)||$.email||$.credentialId}function $4($){return $.identity!==void 0?`identity:${$.identity}`:`credential:${$.credential.credentialId}`}function F0($){return[$.credentialId,...$.aliases??[]]}function j2($,Z,J={}){let z=J.now??Date.now(),Y=J.routePrefix??H2,Q=J.reservedRouteIds??new Set,G=$?.rows??[],W=[...$?.declined??[]],X=Z.skipped.length===0,K=new Set(Z.credentials.map((F)=>F.credentialId)),j=new Set(Z.skipped.flatMap((F)=>F.credentialId===void 0?[]:[F.credentialId])),H=Z.skipped.some((F)=>F.credentialId===void 0),M=(F)=>!K.has(F)&&(j.has(F)||H),D=new Map;for(let F of G){if(F.accountIdentity===void 0)continue;for(let U of F0(F))if(!D.has(U))D.set(U,F.accountIdentity)}let q=new Map;for(let F of Z.credentials){let U=F.accountIdentity!==void 0?{credential:F,identity:F.accountIdentity,claimed:!0}:{credential:F,identity:D.get(F.credentialId),claimed:!1},P=$4(U),I=q.get(P)??[];I.push(U),q.set(P,I)}let B=new Set,N=new Set(Q),x=[],m=(F,U)=>F.credential.credentialId.localeCompare(U.credential.credentialId),p=[...q.values()].map((F)=>F.toSorted(m)).sort((F,U)=>F[0]&&U[0]?m(F[0],U[0]):0);for(let F of p){let U=F[0]?.identity,P=F.filter((w)=>w.credential.state==="active"),I=P.length?P:F,E=I.filter((w)=>w.claimed),S=E.length?E:I,h=new Set(F.map((w)=>w.credential.credentialId)),T=G.find((w)=>!B.has(w)&&F0(w).some((z0)=>h.has(z0))&&(w.accountIdentity===void 0||w.accountIdentity===U)),k=S.find((w)=>w.credential.credentialId===T?.credentialId)??S[0];if(!k)continue;let _=k.credential,b=T??(U===void 0?void 0:G.find((w)=>!B.has(w)&&w.accountIdentity===U));if(b)B.add(b);let c=b?.routeId;if(!c||Q.has(c)){let w=`${Y}${_.credentialId}${U===void 0?"":`~${t7(U).slice(0,10)}`}`;c=w;for(let z0=2;N.has(c);z0++)c=`${w}~${z0}`}N.add(c);let o=b?F0(b).filter(M):[],i=[...new Set([...F.map((w)=>w.credential.credentialId),...o])].filter((w)=>w!==_.credentialId).sort((w,z0)=>w.localeCompare(z0)),j0=J.mapAccount?.(_)??{};x.push({previousIndex:b?G.indexOf(b):1/0,row:{routeId:c,credentialId:_.credentialId,credentialType:_.credentialType,...U!==void 0&&{accountIdentity:U},...i.length&&{aliases:i},state:_.state,label:j0.label?.trim()||e7(_),..._.email!==void 0&&{email:_.email},..._.orgName!==void 0&&{orgName:_.orgName},enabled:![_.credentialId,...i].some((w)=>f3(W,w,U)),addedAt:b?.addedAt??z,...b?.quota!==void 0&&{quota:b.quota},...!k.claimed&&U!==void 0&&{unclaimed:!0}}})}return G.forEach((F,U)=>{if(B.has(F)||!F0(F).some(M))return;if(N.has(F.routeId))return;let[P,...I]=F0(F).filter((h)=>!K.has(h));if(P===void 0)return;N.add(F.routeId);let{aliases:E,...S}=F;x.push({previousIndex:U,row:{...S,credentialId:P,...I.length&&{aliases:I},stale:!0}})}),x.sort((F,U)=>F.previousIndex===U.previousIndex?F.row.credentialId.localeCompare(U.row.credentialId):F.previousIndex-U.previousIndex),{version:1,view:Z.view,complete:X,...!X&&{rejected:Z.skipped.map((F)=>({...F.credentialId!==void 0&&{credentialId:F.credentialId},reason:F.reason}))},rows:x.map((F)=>F.row),declined:W}}function x3($){return($?.rows??[]).filter((Z)=>Z.enabled&&Z.state==="active").map((Z)=>({id:Z.routeId,kind:Z.credentialType==="oauth"?"oauth":"api-key",...Z.quota!==void 0&&{quota:Z.quota}}))}function z1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function p0($){return $===void 0||typeof $==="string"}function Z4($){let Z=z1($)?S0($.quota):void 0;if(!z1($)||typeof $.routeId!=="string"||typeof $.credentialId!=="string"||$.credentialType!=="oauth"&&$.credentialType!=="api_key"||typeof $.state!=="string"||typeof $.label!=="string"||typeof $.enabled!=="boolean"||typeof $.addedAt!=="number"||!p0($.accountIdentity)||!p0($.email)||!p0($.orgName)||$.aliases!==void 0&&(!Array.isArray($.aliases)||!$.aliases.every((J)=>typeof J==="string"))||$.quota!==void 0&&Z===void 0||$.stale!==void 0&&$.stale!==!0||$.unclaimed!==void 0&&$.unclaimed!==!0)return;return{...$,...Z===void 0?{}:{quota:Z}}}var J4=new Set(["empty credential id","duplicate credential id","blank account identity","empty state"]);function K2($){if(!Array.isArray($))return;let Z=[];for(let J of $){if(!z1(J)||!p0(J.credentialId)||typeof J.reason!=="string"||!J4.has(J.reason))return;Z.push(J)}return Z}function z4($){if(!z1($)||$.version!==1||!p0($.view)||!Array.isArray($.rows)||!Array.isArray($.declined)||$.complete!==void 0&&typeof $.complete!=="boolean"||$.rejected!==void 0&&!K2($.rejected))throw new R("invalid-state","Claustrum roster file is not valid");let Z=[];for(let Y of $.rows){let Q=Z4(Y);if(!Q)throw new R("invalid-state","Claustrum roster file is not valid");Z.push(Q)}let J=[];for(let Y of $.declined){if(!z1(Y)||typeof Y.credentialId!=="string"||!p0(Y.accountIdentity))throw new R("invalid-state","Claustrum roster file is not valid");J.push(Y)}let z=K2($.rejected);return{version:1,...typeof $.view==="string"&&{view:$.view},complete:$.complete!==!1,...z&&{rejected:z},rows:Z,declined:J}}async function W0($){let Z;try{Z=await G0($,A)}catch(z){if(z.code==="ENOENT")return;throw z}let J;try{J=JSON.parse(Z)}catch{throw new R("invalid-state","Claustrum roster file is not valid")}return z4(J)}var Y4={name:"claustrum-roster-write",ttlMs:1e4,timeoutMs:5000},Q4={name:"claustrum-roster",ttlMs:30000};async function d0($,Z,J={}){return V3($,Y4,async(z)=>{let Y=await W0($),{next:Q,result:G}=await Z(Y,{assertOwned:()=>z.assertOwned()});if(Q)await z.assertOwned(),await j3($,Q,{beforeRename:async()=>{await J.beforePublish?.(),await z.assertOwned()}});return G})}function w3($,Z){return d0($,(J)=>{let z=J?.rows.find((Q)=>Q.routeId===Z);if(!J||!z)throw new R("route-unavailable","Claustrum route is not in the roster");let Y=E3(J.declined,z.credentialId,z.accountIdentity);return{next:{...J,declined:Y,rows:J.rows.map((Q)=>Q===z?{...Q,enabled:!1}:Q)},result:void 0}})}function T3($,Z){return d0($,(J)=>{let z=J?.rows.find((Y)=>Y.routeId===Z);if(!J||!z)throw new R("route-unavailable","Claustrum route is not in the roster");return{next:{...J,declined:S3(J.declined,F0(z),z.accountIdentity),rows:J.rows.map((Y)=>Y===z?{...Y,enabled:!0}:Y)},result:void 0}})}function G4($,Z){if(!F0($).includes(Z.credentialId))return"refuse";if($.unclaimed&&(Z.accountIdentitySource==="expected"||Z.accountIdentitySource==="none"))return"refuse";if($.accountIdentity===Z.accountIdentity)return"hold";if($.accountIdentity===void 0&&Z.expectedAccountIdentity===void 0&&Z.accountIdentity!==void 0&&(Z.accountIdentitySource==="asserted"||Z.accountIdentitySource==="parsed")&&F0($).length===1)return"bind";return"refuse"}function g3($,Z){return d0($,(J)=>{let z=J?.rows.find((W)=>W.routeId===Z.routeId),Y=!J||!z?"refuse":G4(z,Z);if(!J||!z||Y==="refuse")return{result:!1};let Q=c0(z.quota,Z.observation),G=Y==="bind"?{accountIdentity:Z.accountIdentity,unclaimed:!0}:{};return{next:{...J,rows:J.rows.map((W)=>W===z?{...W,...G,quota:Q}:W)},result:!0}})}function h3($,Z){return d0($,(J)=>{let z=J?.rows.find((Q)=>Q.routeId===Z.routeId);if(!J||!z||z.accountIdentity===void 0||z.accountIdentity!==Z.accountIdentity)return{result:!1};let Y=c0(z.quota,Z.observation);return{next:{...J,rows:J.rows.map((Q)=>Q===z?{...Q,quota:Y}:Q)},result:!0}})}async function y3($){$.signal?.throwIfAborted();let Z=async()=>await $.isActive?.()??!0;if(!await Z())return;let J=await M0({...Q4,path:$.path,renew:!0});if(!J){let z=await W0($.path);if($.signal?.throwIfAborted(),!z?.view)throw new R("roster-busy","Claustrum account discovery is already in progress");return z}try{let z=await $.custody.discover($.signal);return $.signal?.throwIfAborted(),await d0($.path,async(Y)=>{if(!await Z())return{result:void 0};$.signal?.throwIfAborted(),await J.assertOwned();let Q=typeof $.projection==="function"?$.projection():$.projection,G=j2(Y,z,Q);return{...JSON.stringify(Y)!==JSON.stringify(G)&&{next:G},result:G}})}finally{await J.release()}}class U2{#$;#Z=new AbortController;#J;#Q;#K;#Y;#z;#W;#U=!1;#X;constructor($){this.#$=$,this.#J=$.logger??t0("claustrum")}#G($){this.#Z.signal.throwIfAborted(),$?.throwIfAborted()}async#H(){return await this.#$.isCustodyActive?.()??!0}#j($,Z){let J=K3([this.#Z.signal,...Z?[Z]:[]]);return new Promise((z,Y)=>{let Q=()=>{J.signal.removeEventListener("abort",G),J.dispose()},G=()=>{Q(),Y(J.signal.reason)};if(J.signal.addEventListener("abort",G,{once:!0}),$.then((W)=>{if(Q(),J.signal.aborted)Y(J.signal.reason);else z(W)},(W)=>{Q(),Y(W)}),J.signal.aborted)G()})}async#q(){if(this.#G(),this.#Q)return this.#Q;if(!this.#K)this.#K=this.#$.connect().then(($)=>{if(this.#Z.signal.aborted)$.close(),this.#G();if(this.#Q=new R1({client:$,family:this.#$.family,tokenPath:this.#$.tokenPath,parseIdentity:this.#$.parseIdentity,requireAssertion:this.#$.requireAssertion,now:this.#$.now,logger:this.#J}),this.#$.insula&&$.insula)this.#X=D$($.insula,this.#$.tokenPath);return this.#Q}).finally(()=>{this.#K=void 0});return this.#j(this.#K)}snapshot(){return this.#z}routingRows(){return x3(this.#z)}refresh(){if(this.#G(),this.#Y)return this.#Y;return this.#Y=(async()=>{if(!await this.#H()){this.#z=void 0,this.#Q?.close(),this.#Q=void 0,this.#X?.release(),this.#X=void 0;return}let $=await this.#q(),Z=await y3({path:this.#$.rosterPath,custody:$,isActive:()=>this.#H(),signal:this.#Z.signal,projection:()=>({reservedRouteIds:new Set(this.#$.reservedRouteIds?.()??[]),routePrefix:this.#$.routePrefix,mapAccount:this.#$.mapAccount,now:(this.#$.now??Date.now)()})});this.#G();let J=Z?.view!==this.#z?.view;if(this.#z=Z,Z&&J)this.#$.onRoster?.(Z);return Z})().finally(()=>{this.#Y=void 0}),this.#Y}start(){if(this.#U)return;this.#G(),this.#U=!0;let $=async()=>{try{await this.refresh(),await this.refreshInsulaQuota()}catch(J){if(!this.#Z.signal.aborted)this.#$.onError?.(J)}if(this.#Z.signal.aborted)return;let Z=this.#$.pollIntervalMs??5000;if(Z<=0)return;this.#W=(this.#$.setTimeoutImpl??setTimeout)(()=>{this.#W=void 0,$()},Z),this.#W.unref?.()};$()}async refreshInsulaQuota(){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#H())return;try{await _0(this.#$.tokenPath),await this.#q(),await this.#X?.source.refresh((this.#$.now??Date.now)())}catch{}}async cachedInsulaQuota($){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#H())return;try{return await _0(this.#$.tokenPath),this.#V($.assertedAccountIdentity)}catch{return}}async cachedInsulaQuotaForRoute($){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#H())return;try{await _0(this.#$.tokenPath);let J=(await W0(this.#$.rosterPath))?.rows.find((z)=>z.routeId===$);return this.#V(J?.accountIdentity)}catch{return}}#V($){if(!this.#$.insula||!$)return;let Z=this.#X?.source.current(this.#$.insula.provider,$,(this.#$.now??Date.now)());return Z?this.#$.insula.normalize(Z.entry,Z.context):void 0}async authorize($,Z){this.#G(Z);let J=this.#z??await this.#j(this.refresh(),Z);if(!J||!await this.#H())throw new R("not-active","Claustrum scoped custody is not active");let z=await W0(this.#$.rosterPath);this.#G(Z);let Y=J.rows.find((X)=>X.routeId===$),Q=z?.rows.find((X)=>X.routeId===$);if(Q&&!Q.enabled)throw new R("route-declined","Claustrum route is disabled");if(!Y||!Q||Q.state!=="active"||Q.credentialId!==Y.credentialId||Q.accountIdentity!==Y.accountIdentity)throw new R("route-unavailable","Claustrum route is disabled, removed or changed");let G=await this.#j(this.#q(),Z),W=K3([this.#Z.signal,...Z?[Z]:[]]);try{return await G.authorize({credentialId:Q.credentialId,credentialType:Q.credentialType,...Q.accountIdentity!==void 0&&{accountIdentity:Q.accountIdentity}},W.signal)}finally{W.dispose()}}async reportFailure($,Z,J){if(this.#G(),!this.#Q)throw new R("no-receipt","Claustrum dispatch receipt has no active owner");await this.#Q.reportFailure($,Z,J)}async send($,Z,J){let z=J.signal,Y=await this.authorize($,z),Q=await Z(Y,z);if(Q.status===401&&!z?.aborted){let G;try{G=await this.authorize($,z)}catch{}if(b3(J.site,Y,G,this.#J))await Q.body?.cancel().catch(()=>{}),Y=G,Q=await Z(G,z)}if(Q.status===401)await this.reportFailure(Y,401,J.reporterSource??"direct").catch((G)=>this.#$.onError?.(G)),Promise.resolve().then(()=>this.refresh()).catch((G)=>{if(!this.#Z.signal.aborted)this.#$.onError?.(G)});return Q}async decline($){this.#G(),await w3(this.#$.rosterPath,$),this.#z=await W0(this.#$.rosterPath)}async accept($){this.#G(),await T3(this.#$.rosterPath,$),this.#z=await W0(this.#$.rosterPath)}async recordQuota($,Z,J){this.#G();let z=await g3(this.#$.rosterPath,{routeId:$,observation:Z,credentialId:J.credentialId,accountIdentitySource:J.accountIdentitySource,...J.accountIdentity!==void 0&&{accountIdentity:J.accountIdentity},...J.expectedAccountIdentity!==void 0&&{expectedAccountIdentity:J.expectedAccountIdentity}});if(z)this.#z=await W0(this.#$.rosterPath);return z}async recordAccountQuota($,Z,J){this.#G();let z=await h3(this.#$.rosterPath,{routeId:$,accountIdentity:Z,observation:J});if(z)this.#z=await W0(this.#$.rosterPath);return z}close(){if(this.#Z.signal.aborted)return;if(this.#Z.abort(new R("closed","Claustrum consumer is closed")),this.#W)(this.#$.clearTimeoutImpl??clearTimeout)(this.#W);this.#W=void 0,this.#Q?.close(),this.#X?.release(),this.#X=void 0,this.#z=void 0}}class X0 extends Error{code;constructor($){super(`Native vault setup: ${$}`);this.code=$;this.name="NativeVaultEnrollmentError"}}async function V2($,Z){let J={...Z.env},z=Z.paths??q2($,J),Y=`anthropic-auth-${$}`,Q=Z.processFence,G=Z.runner,W=Z.ckBinary??"ck",X,K=Z.client;try{await Q();let j=await P1(z,Y),H=new Set(["superseded","not_found","already_consumed"]);if(j.state==="idle"||j.state==="pending"||j.state==="blocked"&&H.has(j.code)){if(!K)X=await N3({connectionFile:_1(Z.connectionFile??($==="pi"?J.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE:void 0),$==="pi"?{...J,OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE:void 0}:J)}),K=X;let D=K,q=new C1({paths:z,proposedName:Y,client:{enrollPropose:async(B)=>{return await Q(),D.enrollPropose(B)},enrollPoll:async(B)=>{return await Q(),D.enrollPoll(B)}},writeTokenFile:async(B,N)=>{await Q(),await I1(B,N)}});if(j.state==="blocked"){if(await Q(),await q.resetTerminal()!=="reset")throw new X0("enrollment-refused");throw new X0("enrollment-reset")}if(await Q(),j=await q.reconcile(),j.state==="pending"&&j.requestId){if(await Q(),(await G.run(W,["auth","enroll","approve","--request-id",j.requestId,"--name",Y],{env:J})).exitCode!==0)throw new X0("approval-refused");await Q(),j=await q.reconcile()}}if(j.state!=="approved")throw new X0("enrollment-refused");if(await Q(),(await G.run(W,["auth","grant","--principal",`enrolled:${Y}`,"--selector-kind","category","--selector","anthropic-native","--operation","read"],{env:J})).exitCode!==0)throw new X0("permission-refused")}catch(j){if(j instanceof X0)throw j;throw new X0("enrollment-refused")}finally{X?.close()}}import{dirname as W4,join as M2,resolve as f1}from"node:path";async function l0($,Z){let J=$==="pi"?u0(Z):x0(Z),z=$==="pi"?Z.PI_ANTHROPIC_AUTH_FILE?.trim():Z.OPENCODE_ANTHROPIC_AUTH_FILE?.trim(),Y=f1(z||M2(J,m3)),Q=f1(Z.OPENCODE_ANTHROPIC_AUTH_STATE_FILE?.trim()||(Y.endsWith(m3)?M2(W4(Y),D2):`${Y}.state.json`)),G=await E1(Y,Q),W=$==="pi"?Z.PI_ANTHROPIC_AUTH_ROUTING_STATE_FILE?.trim():Z.OPENCODE_ANTHROPIC_AUTH_ROUTING_STATE_FILE?.trim();return{host:$,paths:G,legacyConfigPath:Y,legacyStatePath:Q,hostAuthPath:$==="pi"?S1(Z):L2(Z),routingSourcePath:f1(W||v3(Y)),routingDestinationPath:f1(W||v3(G.config))}}async function B2($){let Z=new Map;for(let J of $)for(let z of[J.paths.legacyConfig,J.paths.legacyState,J.paths.config,J.paths.state,J.paths.runtime,J.paths.roster,J.paths.journal,J.hostAuthPath,J.routingSourcePath,J.routingDestinationPath]){let Y=await F2(z),Q=Z.get(Y);if(Q!==void 0&&Q!==J.host)throw Error("Native setup storage paths overlap between selected hosts");Z.set(Y,J.host)}}import{execFile as X4}from"node:child_process";import{promisify as K4}from"node:util";var H4=K4(X4),$0={async run($,Z,J={}){try{let z=J.env?{...process.env,...J.env}:process.env,{stdout:Y,stderr:Q}=await H4($,Z,{env:z,timeout:J.timeoutMs??15000,maxBuffer:10485760});return{exitCode:0,stdout:typeof Y==="string"?Y:String(Y),stderr:typeof Q==="string"?Q:String(Q)}}catch(z){let Y=z;return{exitCode:typeof Y?.code==="number"?Y.code:1,stdout:typeof Y?.stdout==="string"?Y.stdout:Y?.stdout!=null?String(Y.stdout):"",stderr:typeof Y?.stderr==="string"?Y.stderr:Y?.stderr!=null?String(Y.stderr):String(Y?.message??z)}}}};var N2=/(?:^|[/\\])(opencode|litecode|opencode2|pi)(?:\.exe)?(?=$|\s|")/i;class L0 extends Error{code="process-inspection-failed";constructor(){super("Process inspection failed; setup cannot prove hosts are stopped.");this.name="ProcessInspectionError"}}class x1 extends Error{activeHosts;constructor($){let Z=$.map((z)=>({pid:z.pid,command:N2.exec(z.command)?.[1]??"host"})),J=Z.map((z)=>`  - PID ${z.pid}: ${z.command}`).join(`
+import{x as a1}from"./index-0kxy8k2c.js";import{A as s9,B as b2,C as R2,D as S2,E as k2,F as n9,z as a9}from"./index-b1dvkp15.js";import{ca as g9,da as E8,ea as Q3}from"./index-f2ne65w4.js";var j$=E8((JH,E9)=>{var K$={to($,Z){if(!Z)return`\x1B[${$+1}G`;return`\x1B[${Z+1};${$+1}H`},move($,Z){let J="";if($<0)J+=`\x1B[${-$}D`;else if($>0)J+=`\x1B[${$}C`;if(Z<0)J+=`\x1B[${-Z}A`;else if(Z>0)J+=`\x1B[${Z}B`;return J},up:($=1)=>`\x1B[${$}A`,down:($=1)=>`\x1B[${$}B`,forward:($=1)=>`\x1B[${$}C`,backward:($=1)=>`\x1B[${$}D`,nextLine:($=1)=>"\x1B[E".repeat($),prevLine:($=1)=>"\x1B[F".repeat($),left:"\x1B[G",hide:"\x1B[?25l",show:"\x1B[?25h",save:"\x1B7",restore:"\x1B8"},T8={up:($=1)=>"\x1B[S".repeat($),down:($=1)=>"\x1B[T".repeat($)},f8={screen:"\x1B[2J",up:($=1)=>"\x1B[1J".repeat($),down:($=1)=>"\x1B[J".repeat($),line:"\x1B[2K",lineEnd:"\x1B[K",lineStart:"\x1B[1K",lines($){let Z="";for(let J=0;J<$;J++)Z+=this.line+(J<$-1?K$.up():"");if($)Z+=K$.left;return Z}};E9.exports={cursor:K$,scroll:T8,erase:f8,beep:"\x07"}});import{stdin as K5,stdout as j5}from"node:process";import{createInterface as M5}from"node:readline/promises";import{authorize as F5,createNativeAccountRuntime as B5,exchange as D5,formatNativeAccountState as L5,generateRelayToken as N5,getAccountStoragePath as C5,isValidApiBaseURL as P5,readNativeEnrollmentMode as O5,resolveNativePoolPaths as I5,WORKER_SCRIPT as _5}from"@cortexkit/anthropic-auth-core";import{randomUUID as J6}from"node:crypto";import{constants as k1}from"node:fs";import{lstat as z6,mkdir as Q6,open as G6}from"node:fs/promises";import{homedir as X6}from"node:os";import{isAbsolute as p2,join as o3}from"node:path";import{types as e3}from"node:util";import{createProviderErrorRedactor as s2,createWindowsOwnerOnly as W6,ensureWindowsOwnerOnlyDirectory as H6,formatLogLine as U6,isOwnerOnly as Y6,isSecretKey as q6,NativeMigrationError as V6,NativePiAuthSlotError as K6,setupEnrollment as j6}from"@cortexkit/anthropic-auth-core";import{readFile as l7}from"node:fs/promises";import{assertHostsStopped as a7,createNativeAccountRuntime as s7,discoverNativeVaultInventory as n7,inspectNativeHostAuthEntry as a3,NativePiAuthSlotError as i7,nativePiAuthSlotPaths as r7,openNativePiAuthSlot as n3,readNativeEnrollmentMode as o7,requireNoSupervisedAuthContentSnapshot as t7}from"@cortexkit/anthropic-auth-core";import{dirname as N7}from"node:path";import{CLAUSTRUM_OPENCODE_ENROLLMENT_NAME as C7,CLAUSTRUM_PI_ENROLLMENT_NAME as P7,getHostClaustrumEnrollmentPaths as O7,resolveClaustrumConnectionPath as I7}from"@cortexkit/anthropic-auth-core";import{writeEnrollmentTokenFile as Ez}from"@cortexkit/claustrum-client";import{ClaustrumClient as Kz}from"@cortexkit/claustrum-client";import{resolve as P$}from"node:path";import{storeIdentity as d5}from"@cortexkit/claustrum-client";import{SubcClient as a5}from"@cortexkit/subc-client";import{ClaustrumCredentialError as o9}from"@cortexkit/claustrum-client";import{SocketClosedError as t9,SocketTimeoutError as e9,SubcCallError as $4}from"@cortexkit/subc-client";class I extends Error{kind;constructor($,Z){super(Z);this.name="ClaustrumConsumerError",this.kind=$}}var o1=Object.freeze({ECONNREFUSED:"unreachable",ENOENT:"unreachable",ECONNRESET:"unreachable",EPIPE:"unreachable",ETIMEDOUT:"unreachable",transport_error:"unreachable",unavailable:"unreachable",timeout:"unreachable",route_closed:"unreachable",daemon_draining:"unreachable",connection_closed:"unreachable",connection_dropped:"unreachable",request_deadline:"unreachable",deadline_exceeded_no_drop_observed:"unreachable",module_reloading:"unreachable",module_warming:"unreachable",target_unavailable:"unreachable",module_timeout:"unreachable",invalid_response:"answered",invalid_record_version:"answered",invalid_expiry:"answered",invalid_status:"answered",invalid_params:"answered",ttl_unsatisfiable:"answered",not_found:"answered",enrollment_revoked:"answered",enrollment_invalid:"answered",grant_denied:"answered",credential_unavailable:"answered",needs_reauth:"answered",declined:"answered",disabled:"answered",identity_changed:"answered",closed:"answered",client_closed:"answered",pending_exists:"answered",pending_queue_full:"answered",already_consumed:"answered",superseded:"answered",stale_generation:"answered",missing_identity:"answered",invalid_control_body:"answered",unknown_module:"answered",module_removed:"answered",capability_denied:"answered",unknown_channel:"unreachable",stale_route_epoch:"unreachable",capability_forbidden:"answered",capability_unprovided:"answered",capability_ambiguous:"answered",invalid_capability_identifier:"answered",binary_body_required:"answered",binary_call_requires_call_binary:"answered",corr_exhausted:"answered",late_route_cleanup_failed:"answered",reverse_request_capability_not_declared:"answered",stale_route_handle:"answered",reverse_request_unhandled:"answered",handler_error:"answered",health_error:"answered",duplicate_module_id:"answered",route_rejected:"answered",lock_busy:"answered",owner_invalid:"answered",renewal_failed:"answered",unsupported_platform:"answered",EACCES:"answered",EPERM:"answered",ERR_PRIVATE_FILES_SECURITY:"answered"});class D0 extends I{constructor(){super("unavailable","Claustrum scoped operation unavailable");this.name="ClaustrumUnreachableError"}}function K0($){if($ instanceof D0||$ instanceof t9||$ instanceof e9)return"unreachable";let Z=$ instanceof o9||$ instanceof $4?$.code:$ instanceof Error&&("code"in $)?$.code:void 0;if(typeof Z!=="string"||!Object.hasOwn(o1,Z))return"answered";return o1[Z]}var t1=300000,q1=300000,e1=1000;class s0{#$;#z=0;restart(){this.#z=0}continuous($){let Z=$.kind==="changed"&&$.seq===this.#z+1&&(this.#$===void 0||$.epoch===this.#$);return this.#$=$.epoch,this.#z=$.seq,Z}}class V1{#$;#z;#Z;#Q=!1;constructor($,Z){this.#$=$,this.#z=Z}get running(){return this.#Z}request(){if(this.#Z)return this.#Q=!0,this.#Z;return this.#Z=(async()=>{do{this.#Q=!1;try{await this.#$()}catch($){this.#z($)}}while(this.#Q)})().finally(()=>{this.#Z=void 0}),this.#Z}}class K1{#$;#z=new s0;#Z;#Q="polling";#H;#G;#J=!1;#X;#Y=!1;#U=0;constructor($){this.#$=$,this.#Z=new V1(async()=>{let Z=this.#Y;if(this.#Y=!1,Z||this.#X!==this.#$.view())await this.#$.discover(this.#X??"")},(Z)=>{if(!this.#J)this.#$.onError?.(Z)})}get mode(){return this.#Q}start(){if(this.#J||this.#H||this.#G)return;if(typeof this.#$.client.watchScoped!=="function"){this.#W("fallback","client-without-watch");return}this.#j(!1)}stop(){if(this.#J)return;if(this.#J=!0,this.#G)(this.#$.clearTimeoutImpl??clearTimeout)(this.#G);this.#G=void 0;let $=this.#H;this.#H=void 0,$?.handle.stop()}#W($,Z){if(this.#Q===$)return;this.#Q=$,this.#$.logger?.debug("claustrum vault watch",{mode:$,reason:Z}),this.#$.onMode?.($)}#M($,Z){this.#G=(this.#$.setTimeoutImpl??setTimeout)(()=>{if(this.#G=void 0,!this.#J)Z()},$),this.#G.unref?.()}async#j($){let Z;try{Z=await this.#$.enrollmentToken()}catch(X){if(this.#J)return;this.#$.onError?.(X),this.#V("token-unreadable");return}let J=this.#$.client.watchScoped;if(this.#J||this.#H||!J)return;this.#z.restart(),this.#Y=$;let z,Q;try{Q=J.call(this.#$.client,(X)=>{if(this.#J||!z||this.#H!==z)return;if(z.notices++,z.notices===1)this.#$.onReachable?.(),z.acceptedAt=(this.#$.now??Date.now)(),this.#W("watching","accepted");if(!this.#z.continuous(X))this.#Y=!0;this.#X=X.view,this.#Z.request()},{enrollmentToken:Z})}catch(X){this.#$.onError?.(X),this.#V("watch-failed");return}z={handle:Q,notices:0},this.#H=z,this.#W("polling",$?"resubscribing":"opening");let G=z;Q.closed.then((X)=>this.#K(G,X),(X)=>this.#K(G,{kind:"transport_lost",error:X}))}#K($,Z){if(this.#J||this.#H!==$)return;if(this.#H=void 0,Z.kind==="stopped")return;if(Z.kind==="transport_lost")this.#$.onTransportLost?.();if(Z.kind==="unsupported"){this.#W("fallback","vault-without-watch");return}if(Z.kind==="refused"){this.#V("refused");try{this.#$.onRefused(Z.error)}catch(J){this.#$.onError?.(J)}return}if($.notices>0){let J=(this.#$.now??Date.now)();if($.acceptedAt!==void 0&&J-$.acceptedAt>=300000)this.#U=0;let z=Math.min(1000*2**Math.min(this.#U,16),300000);this.#U++,this.#W("polling","resubscribing"),this.#M(z,()=>void this.#j(!0));return}this.#V(Z.kind)}#V($){this.#W("fallback",$),this.#M(300000,()=>void this.#j(!1))}}var Z3=60000,Z4=4*Z3,$3=new Map,j1=new Map;function M1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function J4($){let Z;try{Z=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode($))}catch{return}if(!M1(Z)||typeof Z.kind!=="string"||typeof Z.epoch!=="string"||Z.epoch.length===0||typeof Z.seq!=="number"||!Number.isSafeInteger(Z.seq)||Z.seq<1||Z.provider!==void 0&&typeof Z.provider!=="string")return;return{kind:Z.kind,epoch:Z.epoch,seq:Z.seq,...typeof Z.provider==="string"&&{provider:Z.provider}}}function z4($){return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:void 0}class O${transport;key;#$=[];#z=new V1(async()=>{try{let $=await this.transport.getUsage();if(!M1($)||!Array.isArray($.result)||$.error!==void 0)throw Error("unavailable insula usage");this.#$=$.result.filter((Z)=>M1(Z)&&typeof Z.provider==="string")}catch{this.#$=[]}},()=>{});#Z=new s0;#Q="polling";#H=0;#G=0;#J=new Map;#X;#Y;#U={};#W=0;constructor($,Z){this.transport=$,this.key=Z}refresh($){if(this.#z.running)return this.#z.running;if(this.#Q==="watching")return Promise.resolve();for(let[J,z]of j1)if($-z>=Z3)j1.delete(J);let Z=j1.get(this.key);if(Z!==void 0&&$-Z<Z3)return Promise.resolve();return j1.set(this.key,$),this.#z.request()}watchMode(){return this.#Q}watch($={}){this.#H++;let Z=$.provider;if(Z===void 0)this.#G++;else this.#J.set(Z,(this.#J.get(Z)??0)+1);if(this.#H===1)this.#U=$,this.#K();let J=!1;return()=>{if(J)return;if(J=!0,Z===void 0)this.#G--;else{let z=(this.#J.get(Z)??1)-1;if(z>0)this.#J.set(Z,z);else this.#J.delete(Z)}if(--this.#H===0)this.#M()}}#M(){if(this.#Y)(this.#U.clearTimeoutImpl??clearTimeout)(this.#Y);this.#Y=void 0;let $=this.#X;this.#X=void 0,$?.handle?.stop(),this.#Q="polling"}#j($){this.#Y=(this.#U.setTimeoutImpl??setTimeout)(()=>{if(this.#Y=void 0,this.#H>0&&!this.#X)this.#K()},$),this.#Y.unref?.()}#K(){let $=this.transport.watchUsage;if(!$){this.#Q="fallback";return}this.#Q="polling",this.#Z.restart();let Z={notices:0};this.#X=Z;let J;try{J=$.call(this.transport,(z)=>this.#V(Z,z))}catch(z){this.#q(Z,z);return}Z.handle=J,J.closed.then(()=>this.#q(Z,void 0),(z)=>this.#q(Z,z))}#V($,Z){if(this.#X!==$)return;if($.notices++,$.notices===1)this.#Q="watching";if($.notices===2)this.#W=0;let J=J4(Z);if(!J)this.#Z.restart();if(!(J?this.#Z.continuous(J):!1)||J?.provider===void 0||this.#G>0||this.#J.has(J.provider))this.#z.request()}#q($,Z){if(this.#X!==$)return;this.#X=void 0;let J=z4(Z);if(J==="unknown_method"||J==="usage_watch_limit"){this.#Q="fallback";return}if($.notices>0){let z=Math.min(e1*2**Math.min(this.#W,16),q1);this.#W++,this.#Q="polling",this.#j(z);return}if(this.#Q="fallback",this.#z.request(),Z===void 0||K0(Z)==="unreachable")this.#j(q1)}current($,Z,J){for(let z of this.#$){if(z.provider!==$||typeof z.account!=="string"||z.account.trim()!==Z)continue;if(z.stale!==void 0||z.errorClass!==void 0||!M1(z.usage))continue;let Q=typeof z.fetchedAt==="string"?Date.parse(z.fetchedAt):Number.NaN;if(!Number.isFinite(Q)||J-Q>=Z4)continue;return{entry:z,context:{fetchedAt:Q,...typeof z.source==="string"&&{source:z.source}}}}return}}function J3($,Z){let J=JSON.stringify([P$($.connectionFile),P$(Z)]),z=$3.get(J);if(!z)z={source:new O$($,J),refs:0},$3.set(J,z);z.refs++;let Q=!1;return{source:z.source,release(){if(Q)return;if(Q=!0,--z.refs===0)$3.delete(J)}}}import{ClaustrumCredentialError as Bz}from"@cortexkit/claustrum-client";import{appendFileSync as K4,chmodSync as j4,existsSync as X3,renameSync as E$,statSync as M4}from"node:fs";import{open as F4}from"node:fs/promises";import{dirname as B4,resolve as D4}from"node:path";import{randomUUID as Q4}from"node:crypto";import{lstat as b$,readFile as R$,rename as G4,unlink as I$}from"node:fs/promises";import{dirname as j0,resolve as n}from"node:path";var _=process.platform==="win32",_$=new Set;function z3($){if($?.reason==="io-error"){if($.win32Code===2||$.win32Code===3)return"ENOENT";if($.win32Code===80||$.win32Code===183)return"EEXIST"}return $?.code??"ERR_PRIVATE_FILE"}var A$;function T0(){return A$??=import("@cortexkit/private-files"),A$}class u extends Error{path;stage;code;win32Code;reason;published=!1;durabilityConfirmed=!1;fileDurable=!1;attempts=0;elapsedMs=0;orphanPath;constructor($,Z,J){let z=J;super(`Private file refused at ${Z}: ${$} (${z?.reason??z?.code??"io-error"}). Use a safe parent directory. Repair only a named secret file in safe ancestry whose owner the published policy trusts, without changing its owner or any existing directory. Previously exposed credentials may need rotation. Windows requires the private-files native prebuild and an ACL-persisting local filesystem such as NTFS.`,{cause:J});this.path=$,this.stage=Z,this.name="PrivateFileError",this.code=z3(z),this.win32Code=z?.win32Code,this.reason=z?.reason}}async function l($,Z,J){try{return await J()}catch(z){if(z instanceof u)throw z;throw new u($,Z,z)}}var X4;async function X0($,Z){$=n($),Z??=X4,await l($,"safe-parent",async()=>{let J=await(await T0()).verifySafeParent($,Z);if(J.ok===!1){if(J.reason==="io-error"||J.reason==="wrong-kind")await b$($);throw new u(J.level??J.path,"safe-parent",{...J,code:"ERR_PRIVATE_FILES_SECURITY"})}})}async function p($,Z,J=!1){if($=n($),Z==="directory")return X0($);await l($,"verify",async()=>{let z=await T0(),Q=await z.verifyOwnerOnly($),G=!1;if(!Q.ok){let{reason:X}=Q.refusal;if(X==="io-error")await z.verifyPrivatePath($,Z);if(J&&[z.EXTRA_ACE,z.NOT_PROTECTED,z.NULL_DACL,z.EMPTY_DACL].includes(X))await X0(j0($)),await z.securePrivatePath($,Z),G=!0;else throw Object.assign(Error("Owner-only verification refused"),{reason:X,code:"ERR_PRIVATE_FILES_SECURITY"})}if(await z.verifyPrivatePath($,Z),G&&!_$.has($))_$.add($),process.emitWarning(`Private permissions tightened: ${$}. This object may have been readable before; rotate credentials if needed.`,"PrivateFileMigration")})}async function Z0($,Z=!1,J){$=n($),await l($,"directory",async()=>{let z=await T0();try{return await b$($),await X0($,J)}catch(G){if(z3(G)!=="ENOENT")throw G}let Q=j0($);if(Q===$)throw Object.assign(Error("Missing root"),{code:"ENOENT"});await Z0(Q,!1,J);try{await z.createOwnerOnly($,{kind:"dir"})}catch(G){if(z3(G)!=="EEXIST")throw G}await X0($,J)})}async function o($,Z=!1){if(!_)return R$($,"utf8");return(await W4($,Z)).toString("utf8")}async function W4($,Z=!1){if(!_)return R$($);if($=n($),Z)await X0(j0($)),await p($,"file",!0);return l($,"read",async()=>(await T0()).readOwnerOnly($))}async function f0($,Z){await X0(j0(n($))),await l($,"create",async()=>{await(await T0()).createPrivateFile(n($),Z)})}async function S$($){await X0(j0(n($))),await l($,"directory-create",async()=>{await(await T0()).createOwnerOnly(n($),{kind:"dir"})})}async function G3($,Z,J={}){$=n($),Z=n(Z);let z=J.now??(()=>performance.now()),Q=z(),G=J.deadline??1/0,X,W=[0,10,20,40,80,100],H,Y=0;for(let V of W){let B=Math.min(X??1/0,G);if(z()>=B)break;if(V)await(J.sleep??((F)=>new Promise((D)=>setTimeout(D,F))))(Math.min(V,Math.max(0,B-z())));if(z()>=B)break;let L=z();if(await J.beforeRename?.(),X!==void 0)X+=z()-L;if(z()>=G)break;Y++;try{return await(J.rename??G4)($,Z),{attempts:Y,elapsedMs:z()-Q}}catch(F){H??=F;let D=F;if(!(D.win32Code!==void 0?D.win32Code===32||D.win32Code===33:["EBUSY","EPERM","EACCES"].includes(D.code??"")&&!D.reason))break;X??=z()+500}}let q=new u(Z,"rename",H??Object.assign(Error("Publication deadline expired"),{code:"ETIMEDOUT"}));throw q.attempts=Y,q.elapsedMs=z()-Q,q}async function g0($,Z,J={}){$=n($),await Z0(j0($));try{await p($,"file",!0)}catch(Y){if(Y.code!=="ENOENT")throw Y}let z=n(J.stagePath??`${$}.${Q4()}.tmp`);if(j0(z)!==j0($))throw new u($,"stage-directory",{code:"EXDEV"});let Q=!1,G=!1,X={attempts:0,elapsedMs:0},W="stage-create",H=(Y)=>{try{J.onOutcome?.({path:$,stage:Y?.stage??"published",published:G,fileDurable:G,durabilityConfirmed:!1,attempts:Y?.attempts??X.attempts,elapsedMs:Y?.elapsedMs??X.elapsedMs,...Y&&{code:Y.code,win32Code:Y.win32Code}})}catch{}};try{if(await f0(z,Z),Q=!0,W="before-rename",X=await G3(z,$,J),Q=!1,G=!0,W="published-callback",J.onRenamed?.(),W="published-verify",await p($,"file"),J.durable&&J.durability!=="file-only-on-windows")throw new u($,"directory-sync-unsupported",{code:"ENOTSUP"});H()}catch(Y){let q=Y instanceof u?Y:new u($,W,Y);if(q.published=G,q.fileDurable=G,G)Object.assign(q,X);if(Q){try{await I$(z)}catch{q.orphanPath=z}Q=!1}throw H(q),q}finally{if(Q)await I$(z).catch(()=>{})}}var H4=/^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i,U4=/\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g;function Y4($){return $ instanceof Error||Object.prototype.toString.call($)==="[object Error]"}function y0($={}){let Z=[U4,...$.extraValuePatterns??[]].map((G)=>new RegExp(G.source,G.flags.includes("g")?G.flags:`${G.flags}g`));function J(G){let X=G.toLowerCase().replace(/[-_]/g,"");return H4.test(G)||X.includes("apikey")||X.endsWith("secret")||X.endsWith("password")||X.endsWith("token")&&!X.endsWith("tokens")||!!$.extraSecretKeys?.(X)}function z(G){let X=G,W=[["name",G.name],["message",G.message],["stack",G.stack]];for(let Y of["code","status","cause"])if(X[Y]!==void 0)W.push([Y,X[Y]]);let H=new Set(W.map(([Y])=>Y));for(let Y of Object.entries(G))if(!H.has(Y[0]))W.push(Y);return W}function Q(G,X,W,H=0){if(typeof G==="string")return Z.reduce((Y,q)=>Y.replace(q,"***REDACTED***"),G);if(!G||typeof G!=="object")return G;if(W.has(G))return"[Circular]";W.add(G);try{if(Array.isArray(G))return G.map((V)=>Q(V,X,W,H));let Y=Y4(G);if(Y&&H>=8)return"[Truncated]";let q=Y?H+1:H;return Object.fromEntries((Y?z(G):Object.entries(G)).map(([V,B])=>[V,X&&J(V)?"***REDACTED***":Q(B,X,W,q)]))}finally{W.delete(G)}}return{redact:(G)=>Q(G,!0,new WeakSet),redactStrings:(G)=>Q(G,!1,new WeakSet)}}var k$=y0(),q4=k$.redact,V4=k$.redactStrings;var F1={error:0,warn:1,info:2,debug:3,trace:4},f$=5242880,g$=3;function W3($){try{j4($,384)}catch{}}function L4($){try{if(!(X3($)&&M4($).size>=f$))return;for(let J=g$-1;J>=1;J--)if(X3(`${$}.${J}`)){let z=`${$}.${J+1}`;E$(`${$}.${J}`,z),W3(z)}let Z=`${$}.1`;E$($,Z),W3(Z)}catch{}}async function W0($){let{file:Z,handle:J}=$;if($.file=void 0,$.handle=void 0,Z&&J)await l(Z,"log-close",()=>J.close())}async function T$($,Z){await Z0(B4(Z));try{await p(Z,"file",!0)}catch(J){if(J.code!=="ENOENT")throw J;try{await f0(Z,"")}catch(z){if(z.code!=="EEXIST")throw z;await p(Z,"file",!0)}}return $.handle=await l(Z,"log-open",()=>F4(Z,"a")),$.file=Z,$.handle}async function N4($,Z,J){Z=D4(Z);try{if($.file!==Z)await W0($);let z=$.handle??await T$($,Z);if((await l(Z,"log-stat",()=>z.stat())).size>=f$){await W0($);for(let G=g$-1;G>=0;G--){let X=G===0?Z:`${Z}.${G}`,W=`${Z}.${G+1}`;try{await p(X,"file",!0)}catch(H){if(H.code==="ENOENT")continue;throw H}try{await p(W,"file",!0)}catch(H){if(H.code!=="ENOENT")throw H}await G3(X,W),await p(W,"file")}z=await T$($,Z)}await l(Z,"log-append",()=>z.appendFile(J,"utf8"))}catch(z){throw await W0($).catch(()=>{}),z}}function C4($){try{return` ${JSON.stringify($)}`}catch{return" [unserializable]"}}function P4($){let Z,J,z,Q=y0(),G,X=[],W,H=Promise.resolve(),Y,q={};function V(U){let K=H.then(U);return H=K.catch((j)=>{Y=j}),K}function B(U){if(_&&U.file!==Z)V(()=>W0(q)).catch(()=>{});Z=U.file,J=U.level,Q=y0(U),G=U.captureSink}function L(U){if(U===void 0||U in F1)z=U}function F(){if(Z===void 0)return;return(typeof Z==="function"?Z():Z)||void 0}function D(){if(z)return z;let U=typeof J==="function"?J():J;if(U&&U in F1)return U;return"info"}function P(U=!0){if(W)clearTimeout(W),W=void 0;if(!X.length){if(_)return V(async()=>{if(U)await W0(q);if(Y)throw Y});return}let K;try{K=F()}catch{if(X=[],_&&U)return V(()=>W0(q));return}let j=X.join("");if(X=[],!K){if(_&&U)return V(()=>W0(q));return}if(_)return V(async()=>{try{await N4(q,K,j)}finally{if(U)await W0(q)}});try{if(L4(K),X3(K))W3(K);K4(K,j,{encoding:"utf8",mode:384})}catch{}}function R(){if(!W)W=setTimeout(()=>{W=void 0;let U=P(!1);if(U instanceof Promise)U.catch(()=>{})},500)}function f(U,K,j,b){if(Z===void 0&&G===void 0)return;try{if(F1[K]>F1[D()])return;let g=Q.redactStrings(j),S;try{S=Q.redact(b)}catch{S="[unserializable]"}let m=`[${new Date().toISOString()}] ${K.toUpperCase()} [${U}] ${g}`+(b===void 0?"":C4(S))+`
+`;try{G?.({channel:U,level:K,message:g,data:S})}catch{}if(Z===void 0)return;if(X.push(m),X.length>=50){let s=P(!1);if(s instanceof Promise)s.catch(()=>{})}else R()}catch{}}function v(U){return{error:(K,j)=>f(U,"error",K,j),warn:(K,j)=>f(U,"warn",K,j),info:(K,j)=>f(U,"info",K,j),debug:(K,j)=>f(U,"debug",K,j),trace:(K,j)=>f(U,"trace",K,j)}}function N(){if(_)V(()=>W0(q)).catch(()=>{});if(Y=void 0,X=[],W)clearTimeout(W),W=void 0;Z=void 0,J=void 0,z=void 0,Q=y0(),G=void 0}if($)B($);return{configure:B,createLogger:v,setLogLevel:L,flushLogs:P,reset:N}}var O4=P4();function n0($){return O4.createLogger($)}function H3($){let Z=new AbortController,J=[],z=!1,Q=()=>{if(z)return;z=!0;for(let{source:W,listener:H}of J)W.removeEventListener("abort",H);J.length=0},G=(W)=>{if(z||Z.signal.aborted)return;Z.abort(W),Q()},X=$.find((W)=>W.aborted);if(X)return Z.abort(X.reason),{signal:Z.signal,dispose:Q};for(let W of $){if(Z.signal.aborted)break;let H=()=>G(W.reason);if(J.push({source:W,listener:H}),W.addEventListener("abort",H,{once:!0}),W.aborted)G(W.reason)}return{signal:Z.signal,dispose:Q}}import{ClaustrumCredentialError as H2}from"@cortexkit/claustrum-client";import{createHash as E4,randomBytes as T4,randomUUID as f4}from"node:crypto";import{constants as s$}from"node:fs";import{chmod as g4,mkdir as y4,open as r$,readFile as V3,realpath as x4,rename as v4,stat as o$,unlink as t$}from"node:fs/promises";import{basename as h4,dirname as C0,extname as dZ,isAbsolute as lZ,join as m4,resolve as aZ}from"node:path";import{ClaustrumCredentialError as w4,ClaustrumClient as nZ,writeEnrollmentTokenFile as u4}from"@cortexkit/claustrum-client";import{randomUUID as y$}from"node:crypto";import{mkdir as I4,open as x$,rename as _4,rm as A4}from"node:fs/promises";import{dirname as v$}from"node:path";class B1 extends Error{constructor($){super("file or directory sync failed",{cause:$});this.name="AtomicSyncError"}}async function i0($,Z,J={}){await h$($,Z,J)}async function h$($,Z,J,z){if(_)return g0($,J.serialize?J.serialize(Z):`${JSON.stringify(Z,null,2)}
+`,{beforeRename:J.beforeRename,stagePath:`${$}.${(J.stageName??y$)()}.tmp`,onRenamed:z,durable:J.durable,durability:J.durability,onOutcome:J.onOutcome});await I4(v$($),{recursive:!0});let Q=`${$}.${(J.stageName??y$)()}.tmp`,G,X=!1;try{if(G=await x$(Q,"wx",384),X=!0,await G.writeFile(J.serialize?J.serialize(Z):`${JSON.stringify(Z,null,2)}
+`,"utf8"),await G.chmod(384),J.durable)try{await G.sync()}catch(W){throw new B1(W)}if(await G.close(),G=void 0,await J.beforeRename?.(),await _4(Q,$),X=!1,z?.(),J.durable){let W=await x$(v$($),"r");try{await W.sync()}catch(H){throw new B1(H)}finally{await W.close()}}}finally{if(await G?.close().catch(()=>{}),X)await A4(Q,{force:!0}).catch(()=>{})}}var b4=Object.freeze({sidebar:Object.freeze({name:"sidebar-write",ttlMs:1e4,timeoutMs:15000,renew:!0}),preferences:Object.freeze({name:"preferences",ttlMs:1e4,timeoutMs:2000,renew:!0})});import{randomUUID as D1}from"node:crypto";import{mkdir as m$,open as l$,readFile as w$,rename as u$,rm as L1,stat as c$}from"node:fs/promises";import{dirname as q3,join as p$}from"node:path";function U3($,Z){return`${$}.${Z}.lock`}class r0 extends Error{details;constructor($){super(`Timed out acquiring ${$.name} lock for ${$.target}`);this.name="LockContentionError",this.details=$}}class L0 extends Error{details;constructor($){super(`Lost ${$.name} lock for ${$.target}`);this.name="LockOwnershipError",this.details=$}}async function Y3($,Z,J){let z=performance.now();for(;;){let Q=await H0({path:$,name:Z.name,ttlMs:Z.ttlMs,renew:Z.renew??!1,...Z.onStep?{onStep:Z.onStep}:{},...Z.onRenewalTimer?{onRenewalTimer:Z.onRenewalTimer}:{}});if(Q)try{return await J(Q)}finally{await Q.release()}let G=Z.timeoutMs-(performance.now()-z);if(G<=0)throw new r0({target:$,name:Z.name,timeoutMs:Z.timeoutMs});await new Promise((X)=>setTimeout(X,Math.min(25,Math.ceil(G))))}}async function d$($,Z){let J=await l$($,"wx",384);try{await J.writeFile(Z,"utf8")}finally{await J.close()}}var R4=globalThis.setTimeout.bind(globalThis),S4=globalThis.clearTimeout.bind(globalThis);function a$($){let Z=$?.code;return Z==="ENOENT"||!_&&(Z==="EINVAL"||Z==="ENOTDIR")}function H0($){return k4({...$,now:Date.now})}async function k4($){let Z=U3($.path,$.name),J=p$(Z,"owner.json"),z=D1(),Q=$.now??Date.now,G=null,X=!1,W=!1,H,Y,q=new Promise((M)=>{Y=M});function V(M){try{let C=$.onRenewalTimer?.(M);if(C&&(typeof C==="object"||typeof C==="function")&&"then"in C&&typeof C.then==="function")Promise.resolve(C).catch(()=>{})}catch{}}function B(){if(!G)return;S4(G),G=null,V("cancelled")}function L(M,C){if(H||X)return;H=Object.freeze({reason:M,expectedOwnerId:z,...typeof C?.ownerId==="string"?{observedOwnerId:C.ownerId}:{},...typeof C?.expiresAt==="number"?{observedExpiresAt:C.expiresAt}:{}}),B(),Y(H)}let F,D=null,P=`${Z}.evicting`,R=p$(P,"owner.json"),f=D1(),v=5000,N=8;async function U(){if(_)try{return JSON.parse(await o(Z,!0))}catch(M){if(M.code!=="EISDIR"&&M.reason!=="wrong-kind")throw M;return await p(Z,"directory",!0),JSON.parse(await o(J,!0))}try{return JSON.parse(await w$(Z,"utf8"))}catch(M){if(M.code!=="EISDIR")throw M;return JSON.parse(await w$(J,"utf8"))}}async function K(){if(_){let y=await U(),w=Number(y?.expiresAt)-Q();await g0(Z,`${JSON.stringify({ownerId:z,expiresAt:Q()+$.ttlMs})}
+`,{deadline:performance.now()+Math.max(0,w),beforeRename:async()=>{let Y1=await U();if(Y1?.ownerId!==z||!(Number(Y1?.expiresAt)>Q())||!await x())throw new L0({target:$.path,name:$.name})}});return}let M=`${Z}.${D1()}.tmp`,C,O=!1;try{C=await l$(M,"wx",384),O=!0,await C.writeFile(`${JSON.stringify({ownerId:z,expiresAt:Q()+$.ttlMs})}
+`,"utf8"),await C.chmod(384),await C.close(),C=void 0;let y=await U();if(y?.ownerId!==z||!(Number(y?.expiresAt)>Q())||!await x())throw new L0({target:$.path,name:$.name});await u$(M,Z),O=!1}finally{if(await C?.close().catch(()=>{}),O)await L1(M,{force:!0}).catch(()=>{})}}async function j(){let M=`${JSON.stringify({ownerId:z,expiresAt:Q()+$.ttlMs})}
+`;if(_)await f0(Z,M);else await d$(Z,M)}async function b(M){let C=M.code;if(C==="EEXIST"){if(_)await U();return!0}if(C==="EISDIR"){if(_)await p(Z,"directory",!0),await o(J,!0);return!0}return!1}async function g(){if(_)await Z0(q3(Z));try{return await j(),!0}catch(M){let C=M.code;if(await b(M))return!1;if(C==="ENOENT"){if(_)await Z0(q3(Z));else await m$(q3(Z),{recursive:!0});try{return await j(),!0}catch(O){if(await b(O))return!1;throw O}}throw M}}async function S(){await new Promise((M)=>setTimeout(M,Math.floor(Math.random()*4)))}async function m(M=!0){if(M&&$.onStep)await $.onStep("lock-read-ready");let C;try{C=await U()}catch(y){if(_&&y.code!=="ENOENT")throw y}let O=Number(C?.expiresAt);if(Number.isFinite(O)&&O>Q())return{status:"live"};if(typeof C?.ownerId==="string"&&Number.isFinite(O))return{status:"stale",identity:{kind:"owner",ownerId:C.ownerId,expiresAt:O}};try{let y=await c$(Z),w=Number.isFinite(O)?O:y.mtimeMs+$.ttlMs;if(w>Q())return{status:"live"};return{status:"stale",identity:{kind:"stat",dev:y.dev,ino:y.ino,mtimeMs:y.mtimeMs,expiresAt:w}}}catch(y){if(y.code==="ENOENT"){if($.onStep)await $.onStep("lock-missing");return{status:"missing"}}throw y}}function s(M,C){if(C.status!=="stale")return!1;let O=C.identity;if(M.kind==="owner"&&O.kind==="owner")return M.ownerId===O.ownerId&&M.expiresAt===O.expiresAt;return M.kind==="stat"&&O.kind==="stat"&&M.dev===O.dev&&M.ino===O.ino&&M.mtimeMs===O.mtimeMs&&M.expiresAt===O.expiresAt}async function x(){try{return JSON.parse(await o(R,_))?.ownerId===f}catch(M){if(_&&M.code!=="ENOENT")throw M;return!1}}async function c(M){if(_)await l(M,"remove",()=>L1(M,{recursive:!0,force:!0}));else await L1(M,{recursive:!0,force:!0}).catch(()=>{})}async function r(){if(await x())await c(P)}async function H1(){if(_)await S$(P);else await m$(P);try{let M=`${JSON.stringify({ownerId:f,createdAt:Q()})}
+`;if(_)await f0(R,M);else await d$(R,M)}catch(M){if(a$(M))return!1;throw await r(),M}if($.onStep)await $.onStep("eviction-marker-acquired");return!0}async function E0(){let M;try{M=await c$(P)}catch(O){if(O.code==="ENOENT")return"missing";throw O}if(_)await p(P,"directory",!0);if(M.mtimeMs+v>Q())return"fresh";if($.onStep)await $.onStep("stale-marker-stat");let C=`${P}.${D1()}`;try{await u$(P,C)}catch(O){if(O.code==="ENOENT")return"missing";throw O}if($.onStep)await $.onStep("stale-marker-claimed");return await c(C),"recovered"}async function U1(M){try{if(!await H1())return!1}catch(C){if(C.code==="EEXIST"){if(_){await p(P,"directory",!0);try{await o(R,!0)}catch(O){if(O.code!=="ENOENT")throw O}}return!1}throw C}try{await M()}finally{await r()}return!0}async function k(){for(let M=0;M<N;M++){if($.onStep)await $.onStep("relinquish-read");let C;try{C=await U()}catch(O){if(_)throw O;return}if(C?.ownerId!==z)return;try{await L1(Z,{recursive:!0,force:!0});return}catch(O){if(_)throw O;await S()}}}function G0(){if(!$.renew||X||H)return;let M=$.renewIntervalMs??Math.max(1000,Math.floor($.ttlMs/3));if(G=R4(()=>{G=null;let C=(async()=>{let O=!X;try{if(!await U1(async()=>{let w=await U(),Y1=Q();if(X||H){O=!1;return}if(w?.ownerId!==z){L("taken-over",w),O=!1;return}if(!(Number(w?.expiresAt)>Y1)){L("expired",w),O=!1;return}if($.onStep)await $.onStep("renewal-owner-confirmed");if(X||H){O=!1;return}if(!await x())return;if($.onStep)await $.onStep("renewal-write-fenced");if(X||H){O=!1;return}if(!await x())return;if($.onStep)await $.onStep("renewal-write-ready");if(X||H){O=!1;return}if(await K(),$.onStep)await $.onStep("renewal-write-finished");if(!await x()){L("marker-lost"),O=!1,await k();return}})&&$.onStep)await $.onStep("renewal-marker-unavailable")}catch(y){if(_&&y instanceof u)F=y,L("renewal-failed"),O=!1;try{let w=await U();if(w?.ownerId!==z)L("taken-over",w);else if(!(Number(w?.expiresAt)>Q()))L("expired",w)}catch{L("renewal-failed")}}finally{if($.onStep)try{await $.onStep("renewal-finished")}catch{}if(O&&!X&&!H)G0()}})();D=C,C.finally(()=>{if(D===C)D=null})},M),"unref"in G)G.unref();V("scheduled")}function C$(){try{let M=$.onContended?.();if(M&&(typeof M==="object"||typeof M==="function")&&"then"in M&&typeof M.then==="function")Promise.resolve(M).catch(()=>{})}catch{}return null}let B0=await g();if(!B0)for(let M=0;M<N;M++){if(B0=await g(),B0)break;let C=await m();if(C.status==="live")return C$();if(C.status==="missing")continue;if($.onStep)await $.onStep("stale-lock-observed");try{if(!await H1()){await S();continue}}catch(O){if(O.code!=="EEXIST")throw O;if(await E0()==="fresh")return null;await S();continue}try{let O=await m();if(O.status==="live")return C$();if(!s(C.identity,O))continue;if(!await x())return null;if($.onStep)await $.onStep("stale-lock-confirmed");if(!await x())return null;let y=await m(!1);if(!s(C.identity,y))continue;if(await c(Z),!await x())return null;if($.onStep)await $.onStep("stale-lock-removed");if(B0=await g(),!B0)return null;if($.onStep)await $.onStep("stale-lock-recreated");if(!await x())return await k(),B0=!1,null;break}finally{await r()}}if(!B0)return null;return G0(),{ownerId:z,whenLost:()=>q,hasLost:()=>H!==void 0,assertOwned:async()=>{if(F)throw F;let M;try{let C=await U();if(M=C,!X&&!H&&C?.ownerId===z&&Number(C?.expiresAt)>Q())return;L(C?.ownerId!==z?"taken-over":"expired",C)}catch(C){if(L("unreadable"),_&&C instanceof u)throw C}throw new L0({target:$.path,name:$.name,expectedOwnerId:z,...typeof M?.ownerId==="string"?{observedOwnerId:M.ownerId}:{},...typeof M?.expiresAt==="number"?{observedExpiresAt:M.expiresAt}:{}})},release:async()=>{if(_&&W)return;X=!0,B(),await D;for(let M=0;M<N;M++){try{let C=!1;if(await U1(async()=>{let y;try{y=await U()}catch(w){if(_&&w.code==="ENOENT"){C=!0;return}throw w}if(y?.ownerId!==z){C=!0;return}if($.onStep)await $.onStep("release-owner-confirmed");if(!await x())return;await c(Z),C=!0})){if(_&&!C)throw new u(Z,"release-not-confirmed",{code:"EIO"});W=C;return}await E0()}catch(C){if(_)throw C;return}await S()}if(_)throw new u(Z,"release-not-confirmed",{code:"ETIMEDOUT"})}}}var c4=1,C1=16384,e$=30000,j3=/^[0-9a-f]{64}$/,$2=new Set(["invalid_params","pending_exists","not_found","already_consumed","superseded","stale_generation"]),Z2=new Set(["pending_queue_full"]);function K3($){if(!($ instanceof w4))return;if($2.has($.code))return{code:$.code,disposition:"terminal"};if(Z2.has($.code))return{code:$.code,disposition:"retry"};return{code:$.code,disposition:$.action==="retry"?"retry":"terminal"}}function J2($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function N1($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0}function z2($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=1}function o0(){return new I("invalid-state","invalid Claustrum enrollment state")}function M3($){if(!J2($)||$.version!==c4||typeof $.proposedName!=="string"||$.proposedName.length===0)throw o0();if($.phase==="pending"){if(!j3.test(String($.requestSecret??""))||$.requestId!==void 0&&(typeof $.requestId!=="string"||$.requestId.length===0)||!N1($.createdAt)||!N1($.updatedAt))throw o0();return{version:1,phase:"pending",proposedName:$.proposedName,requestSecret:$.requestSecret,...$.requestId!==void 0&&{requestId:$.requestId},createdAt:$.createdAt,updatedAt:$.updatedAt}}if($.phase==="approved"){if($.approvedName!==void 0&&(typeof $.approvedName!=="string"||$.approvedName.length===0)||!z2($.tokenGeneration)||!N1($.updatedAt))throw o0();return{version:1,phase:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration,updatedAt:$.updatedAt}}if($.phase==="denied"||$.phase==="blocked"){if($.errorCode!==void 0&&typeof $.errorCode!=="string"||!N1($.updatedAt))throw o0();return{version:1,phase:$.phase,proposedName:$.proposedName,...$.errorCode!==void 0&&{errorCode:$.errorCode},updatedAt:$.updatedAt}}throw o0()}function F3($){if(!J2($)||!j3.test(String($.token??""))||!z2($.token_generation))throw new I("invalid-token","invalid Claustrum enrollment token file");return{token:$.token,token_generation:$.token_generation}}function p4($){if(!$.isFile())throw new I("unsafe-file","Claustrum enrollment file must be a regular file");if(($.mode&63)!==0)throw new I("unsafe-file","Claustrum enrollment file must be owner-only");let Z=process.geteuid?.();if(Z!==void 0&&$.uid!==Z)throw new I("unsafe-file","Claustrum enrollment file must be owned by the current user")}function n$($){try{return JSON.parse($)}catch{throw new I("invalid-state","Claustrum enrollment file is not valid JSON")}}async function P0($){if(_)try{await Z0(C0($));let J=await o($,!0);if(Buffer.byteLength(J)>C1)throw new I("unsafe-file","Claustrum enrollment file is too large");return n$(J)}catch(J){if(J.code==="ENOENT")return;throw J}let Z;try{Z=await r$($,s$.O_RDONLY|s$.O_NOFOLLOW)}catch(J){if(J.code==="ENOENT")return;throw new I("unsafe-file","Claustrum enrollment file could not be opened safely")}try{p4(await Z.stat());let J=Buffer.alloc(C1+1),{bytesRead:z}=await Z.read(J,0,J.byteLength,0);if(z>C1)throw new I("unsafe-file","Claustrum enrollment file is too large");return n$(J.subarray(0,z).toString("utf8"))}finally{await Z.close()}}function i$($,Z){let J=[];for(let z of $.split(`
+`)){if(z.trim()===""||z.startsWith("#"))continue;let Q=z.split(":");if(Q.length!==Z||!/^[^\s:,]+$/.test(Q[0]??"")||!/^\d+$/.test(Q[2]??"")||!Number.isSafeInteger(Number(Q[2]))||Z===7&&(!/^\d+$/.test(Q[3]??"")||!Number.isSafeInteger(Number(Q[3])))||Z===4&&Q[3]!==""&&!/^[^\s:,]+(?:,[^\s:,]+)*$/.test(Q[3]??""))return;J.push(Q)}return J}async function d4($,Z,J){try{let[z,Q]=await Promise.all([V3(J.passwdPath??"/etc/passwd","utf8"),V3(J.groupPath??"/etc/group","utf8")]),G=i$(z,7),X=i$(Q,4);if(!G||!X)return!1;let W=G.filter((V)=>Number(V[2])===$),H=X.filter((V)=>Number(V[2])===Z);if(W.length!==1||H.length!==1)return!1;let Y=W[0]?.[0],q=H[0]?.[3]??"";return(q===""||q.split(",").every((V)=>V===Y))&&!G.some((V)=>Number(V[2])!==$&&Number(V[3])===Z)}catch{return!1}}function Q2($){if(!$.passwdPath&&!$.groupPath)return;return{fs:{readFile:(Z)=>V3(Z==="/etc/passwd"?$.passwdPath??Z:Z==="/etc/group"?$.groupPath??Z:Z)}}}async function G2($,Z={}){if(!_){let J=process.geteuid?.();if(J===void 0)return;let z=process.getegid?.(),Q;try{Q=await x4($)}catch{return}let G;for(;;){let X=await o$(Q).catch(()=>{return});if(X&&(X.mode&18)!==0&&(X.mode&512)===0){if(G===void 0)G=z!==void 0&&await d4(J,z,Z);if((X.mode&2)!==0||X.uid!==J||X.gid!==z||!G)throw new I("unsafe-file",`Claustrum enrollment path has a writable ancestor: ${Q}. Another user could replace it. Run: chmod g-w,o-w ${Q}`)}let W=C0(Q);if(W===Q)return;Q=W}}try{await X0($,Q2(Z))}catch(J){if(!(J instanceof u))throw J;throw new I("unsafe-file",`Claustrum enrollment parent refused: ${J.path} (${J.reason??J.code}). Use a folder that other users cannot write or replace.`)}}async function P1($,Z={}){if(_){await Z0($,!1,Q2(Z));return}await y4($,{recursive:!0,mode:448});let J=await o$($),z=process.geteuid?.();if(z!==void 0&&J.uid!==z)throw new I("unsafe-file","Claustrum enrollment directory must be owned by the current user");if((J.mode&63)!==0)await g4($,448)}async function N0($,Z,J={}){let z=C0($);await P1(z,J),await G2(z,J);let Q=`${JSON.stringify(Z)}
+`;if(Buffer.byteLength(Q)>C1)throw new I("invalid-state","Claustrum enrollment state is too large");if(_)return g0($,Q);let G=m4(z,`.${h4($)}.${process.pid}.${f4()}.tmp`),X,W=!1;try{X=await r$(G,"wx",384),W=!0,await X.writeFile(Q,"utf8"),await X.chmod(384),await X.sync(),await X.close(),X=void 0,await v4(G,$),W=!1}finally{if(await X?.close().catch(()=>{}),W)await t$(G).catch(()=>{})}}async function B3($,Z){let J=await P0($.tokenPath),z=J===void 0?void 0:F3(J),Q=await P0($.statePath),G=Q===void 0?void 0:M3(Q);if(z)return{state:"approved",proposedName:G?.proposedName??Z,...G?.phase==="approved"&&G.approvedName!==void 0&&{approvedName:G.approvedName},tokenGeneration:z.token_generation};if(!G)return{state:"idle"};if(G.phase==="approved")return{state:"blocked",proposedName:G.proposedName,code:"missing_token"};return M0(G)}async function O0($){let Z=await P0($);if(Z===void 0)throw new I("not-enrolled","Claustrum enrollment is not configured");return F3(Z)}function M0($){if($.phase==="pending")return{state:"pending",proposedName:$.proposedName,...$.requestId!==void 0&&{requestId:$.requestId}};if($.phase==="approved")return{state:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration};if($.phase==="denied")return{state:"denied",proposedName:$.proposedName};return{state:"blocked",proposedName:$.proposedName,code:$.errorCode??"unknown"}}function X2(){return new I("wrong-consumer","Claustrum enrollment state belongs to a different consumer")}class D3{#$;#z;#Z;#Q;#H;#G;#J;constructor($){this.#J=$.ancestorOptions??{},this.#$=$.client,this.#z=$.paths,this.#Z=$.proposedName,this.#Q=$.now??Date.now,this.#H=$.mintSecret??(()=>T4(32).toString("hex")),this.#G=$.writeTokenFile??u4}async status(){return B3(this.#z,this.#Z)}async resetTerminal(){return W2(this.#z,this.#Z)}async#X($,Z){let J={version:1,phase:"blocked",proposedName:$.proposedName,errorCode:Z,updatedAt:this.#Q()};return await N0(this.#z.statePath,J,this.#J),M0(J)}async reconcile(){await P1(C0(this.#z.statePath),this.#J);let $=await H0({name:"ceremony",path:this.#z.statePath,ttlMs:e$,renew:!0});if(!$)return{state:"busy"};try{let Z=await P0(this.#z.tokenPath),J=Z===void 0?void 0:F3(Z),z=await P0(this.#z.statePath),Q=z===void 0?void 0:M3(z);if(Q&&Q.proposedName!==this.#Z)throw X2();if(J){if(!Q||Q.phase==="pending"){let X={version:1,phase:"approved",proposedName:Q?.proposedName??this.#Z,tokenGeneration:J.token_generation,updatedAt:this.#Q()};await N0(this.#z.statePath,X,this.#J),Q=X}return{state:"approved",proposedName:Q.proposedName,...Q.phase==="approved"&&Q.approvedName!==void 0&&{approvedName:Q.approvedName},tokenGeneration:J.token_generation}}if(Q?.phase==="approved"){let X={version:1,phase:"blocked",proposedName:Q.proposedName,errorCode:"missing_token",updatedAt:this.#Q()};return await N0(this.#z.statePath,X,this.#J),M0(X)}if(Q&&Q.phase!=="pending")return M0(Q);if(!Q){let X=this.#Q();if(Q={version:1,phase:"pending",proposedName:this.#Z,requestSecret:this.#H(),createdAt:X,updatedAt:X},!j3.test(Q.requestSecret))throw new I("invalid-state","invalid minted Claustrum enrollment secret");await N0(this.#z.statePath,Q,this.#J)}if(!Q.requestId)try{let X=E4("sha256").update(Buffer.from(Q.requestSecret,"hex")).digest("hex"),W=await this.#$.enrollPropose({name:Q.proposedName,requestSecretHash:X});Q={...Q,requestId:W.requestId,updatedAt:this.#Q()},await N0(this.#z.statePath,Q,this.#J)}catch(X){let W=K3(X);if(!W)throw X;if(W.disposition==="retry")return{state:"pending",proposedName:Q.proposedName,retryCode:W.code};return this.#X(Q,W.code)}let G=Q.requestId;if(!G)return M0(Q);try{let X=await this.#$.enrollPoll({requestId:G,requestSecret:Q.requestSecret});if(X.status==="pending")return M0(Q);if(X.status==="denied"){let H={version:1,phase:"denied",proposedName:Q.proposedName,updatedAt:this.#Q()};return await N0(this.#z.statePath,H,this.#J),M0(H)}await P1(C0(this.#z.tokenPath),this.#J),await G2(C0(this.#z.tokenPath),this.#J),await this.#G(this.#z.tokenPath,{token:X.token,token_generation:X.tokenGeneration});let W={version:1,phase:"approved",proposedName:Q.proposedName,approvedName:X.name,tokenGeneration:X.tokenGeneration,updatedAt:this.#Q()};return await N0(this.#z.statePath,W,this.#J),M0(W)}catch(X){let W=K3(X);if(!W)throw X;if(W.disposition==="retry")return{state:"pending",proposedName:Q.proposedName,requestId:G,retryCode:W.code};return this.#X(Q,W.code)}}finally{await $.release()}}}async function W2($,Z){await P1(C0($.statePath));let J=await H0({name:"ceremony",path:$.statePath,ttlMs:e$,renew:!0});if(!J)return"busy";try{if(await P0($.tokenPath)!==void 0)return"refused-approved";let z=await P0($.statePath);if(z===void 0)return"idle";let Q=M3(z);if(Q.proposedName!==Z)throw X2();if(Q.phase==="pending")return"refused-pending";return await J.assertOwned(),await t$($.statePath),"reset"}finally{await J.release()}}var L3="claustrum-tombstone:v1:";function U2($,Z){return Z!==void 0&&!Z.fromKeptReceipt&&!$.fromKeptReceipt&&Z.credentialId===$.credentialId&&Z.accountIdentity===$.accountIdentity&&Z.recordVersion!==$.recordVersion}function l4($,Z){if(Z===void 0)return"reauthorize-failed";if(Z.credentialId!==$.credentialId)return"credential-changed";if(Z.accountIdentity!==$.accountIdentity)return"account-changed";if(Z.recordVersion===$.recordVersion)return"version-unchanged";return"rotated"}var C3=n0("claustrum");function O3($,Z,J,z=C3){let Q=U2(Z,J);return z.debug("scoped 401 re-authorized",{site:$,credentialId:Z.credentialId,servedVersion:Z.recordVersion,currentVersion:J?.recordVersion??null,retry:Q,reason:l4(Z,J)}),Q}var P3=300000,Y2=60000;function N3(){return new I("invalid-material","Claustrum returned invalid credential material")}function a4($){let Z=$.trim();if(Z.startsWith("{")){let J;try{J=JSON.parse(Z)}catch{throw N3()}if(!J||typeof J!=="object")throw N3();let z=J,Q=z.access_token??z.access;Z=typeof Q==="string"?Q:""}if(!/^[\x21-\x7e]+$/.test(Z)||Z.startsWith(L3))throw N3();return Z}function s4($,Z){if(!$.operations.includes("read"))return;if(!$.categories.includes(Z.category))return;if($.credentialType==="oauth")return $.refreshAdapter===Z.refreshAdapter?"oauth":void 0;if($.credentialType==="api_key"&&Z.apiKeys)return $.refreshAdapter===void 0?"api_key":void 0;return}function n4($){let{grants:Z,grantTuples:J}=$;if(Z===void 0||J===void 0)return;return Object.freeze({grants:Z,tuples:Object.freeze(J.map(({selectorKind:z,selector:Q,operation:G})=>Object.freeze({selectorKind:z,selector:Q,operation:G})))})}class O1{#$;#z;#Z;#Q;#H;#G;#J;#X=new WeakMap;#Y=new WeakMap;#U=new Map;#W=new WeakMap;#M;#j;#K=!1;#V=new D0;#q;#F=!1;#C=-1/0;#L=2000;#B=!1;#P;#N=new Set;constructor($){let Z=$.tokenPath;if($.readToken)this.#z=$.readToken;else if(Z)this.#z=()=>O0(Z);else throw new I("not-enrolled","Claustrum enrollment token path is required");this.#$=$.client,this.#Q=$.family,this.#H=$.parseIdentity,this.#G=$.requireAssertion??!1,this.#Z=$.now??Date.now,this.#J=$.logger??C3,this.#M=$.setTimeoutImpl??setTimeout,this.#j=$.clearTimeoutImpl??clearTimeout}transportLost($){if(this.#B||this.#K)return;this.#K=!0,this.#V=$ instanceof H2?$:new D0,this.#J.warn("serving kept vault receipt",{reason:"unreachable"}),this.#O()}reachable(){if(this.#B||!this.#K)return;if(this.#K=!1,this.#q)this.#j(this.#q);this.#q=void 0,this.#L=2000;for(let $ of this.#U.values())$.since=null;(this.#J.info??C3.info)("vault receipt serving resumed",{reason:"reachable"})}#O(){if(this.#B||!this.#K||this.#q||this.#F)return;this.#q=this.#M(()=>{this.#q=void 0,this.#A(!0)},this.#L),this.#q.unref?.()}#A($=!1){if(this.#B||!this.#K||this.#F)return;if(this.#Z()-this.#C<1000){this.#O();return}this.#C=this.#Z(),this.#F=!0,this.#b().catch(()=>{if($&&this.#K)this.#L=Math.min(this.#L*2,30000)}).finally(()=>{this.#F=!1,this.#O()})}#D($){if(this.#B)throw new I("closed","Claustrum scoped custody is closed");$?.throwIfAborted()}async#I($){this.#D($);let Z=await this.#z();if(this.#D($),!/^[0-9a-f]{64}$/.test(Z.token)||!Number.isSafeInteger(Z.token_generation)||Z.token_generation<1)throw new I("invalid-token","Invalid Claustrum enrollment token");return Z.token}async#_($,Z){this.#D(Z);let J,z;try{let Q=$();J=Z?await Promise.race([Q,new Promise((G,X)=>{let W=()=>X(Z.reason);if(Z.addEventListener("abort",W,{once:!0}),z=()=>Z.removeEventListener("abort",W),Z.aborted)W()})]):await Q}catch(Q){if(this.#D(Z),K0(Q)==="unreachable")this.transportLost(Q);else this.reachable();if(Q instanceof H2)throw Q;if(K0(Q)==="unreachable")throw new D0;throw new I("unavailable","Claustrum scoped operation unavailable")}finally{z?.()}return this.#D(Z),this.reachable(),J}async discover($){let Z=await this.#b($);return this.#P=Z.view,Z}async#b($){let Z,J;try{J=await this.#I($)}catch(H){throw this.#U.clear(),H}try{Z=await this.#_(()=>this.#$.listScoped(J),$)}catch(H){throw this.listFailed(H),H}let z=[],Q=[],G=new Map;for(let H of Z.rows){let Y=s4(H,this.#Q);if(!Y)continue;Q.push({row:H,type:Y}),G.set(H.id,(G.get(H.id)??0)+1)}let X=[];for(let{row:H,type:Y}of Q){let q;if(!H.id.trim())q="empty credential id";else if((G.get(H.id)??0)>1)q="duplicate credential id";else if(H.accountId!==void 0&&!H.accountId.trim())q="blank account identity";else if(!H.state.trim())q="empty state";if(q){z.push({...H.id.trim()&&{credentialId:H.id},reason:q});continue}X.push(Object.freeze({credentialId:H.id,credentialType:Y,...H.accountId!==void 0&&{accountIdentity:H.accountId},state:H.state,...H.email!==void 0&&{email:H.email},...H.orgName!==void 0&&{orgName:H.orgName}}))}for(let H of z)this.#J.warn("skipped malformed vault record",H);let W=n4(Z);return{view:Z.view,credentials:Object.freeze(X),skipped:Object.freeze(z),...W&&{grantReach:W}}}listFailed($){if(K0($)==="unreachable")this.transportLost($);else this.reachable(),this.#U.clear()}forget($){this.#U.delete($)}retain($){let Z=new Map($.map((J)=>[J.credentialId,J]));for(let[J,z]of this.#U){let Q=Z.get(J);if(!Q?.enabled||Q.state!=="active"||Q.credentialType!==z.attempt.credentialType||Q.accountIdentity!==z.attempt.expectedAccountIdentity)this.forget(J)}}keptReceiptState(){let $=null;for(let[Z,J]of this.#U){if(!this.#R(J.attempt)){this.forget(Z);continue}if(J.since!==null)$=Math.min($??J.since,J.since)}return Object.freeze({active:$!==null,since:$})}#R($){return $.expiresAtMs===null?$.credentialType==="api_key":$.expiresAtMs-this.#Z()>Y2}async authorize($,Z,J="vault"){this.#D(Z);let{credentialId:z,credentialType:Q,accountIdentity:G}=$,X=this.#U.get(z);if(X&&(X.attempt.credentialType!==Q||X.attempt.expectedAccountIdentity!==G))this.forget(z),X=void 0;let W;try{W=await this.#I(Z)}catch(H){throw this.#U.clear(),H}if(this.#K&&X)return this.#A(),this.#S(z,X,W,J);try{let H=await this.#k({credentialId:z,credentialType:Q,accountIdentity:G},W,Z);return this.#U.set(z,{attempt:H,routeId:J,since:null}),H}catch(H){if(this.#D(Z),K0(H)!=="unreachable")throw this.forget(z),H;return this.#S(z,X,W,J,H)}}#S($,Z,J,z,Q=this.#V){if(!Z||this.#U.get($)!==Z||!this.#R(Z.attempt))throw this.forget($),Q;if(Z.since===null)Z.since=this.#Z();let G=Object.freeze(Object.defineProperty({...Z.attempt,fromKeptReceipt:!0},"accessToken",{value:Z.attempt.accessToken,enumerable:!1}));return this.#X.set(G,J),this.#W.set(G,z),G}async#k($,Z,J){if(!$.credentialId)throw new I("route-unavailable","Claustrum dispatch requires a credential id");let{credentialId:z,credentialType:Q,accountIdentity:G}=$;if(this.#G&&G===void 0)throw new I("identity-unasserted","Claustrum dispatch requires a known account identity");let X=await this.#_(()=>this.#$.getScoped({credentialId:z,enrollmentToken:Z,...Q==="oauth"&&{minTtlMs:P3}}),J);if(X.credentialId!==void 0&&X.credentialId!==z)throw new I("identity-changed","Claustrum served credential identity changed");let W=X.expiresAtMs;if(!Number.isSafeInteger(X.recordVersion)||X.recordVersion<0||W===null&&Q==="oauth"||W!==null&&(!Number.isFinite(W)||W-this.#Z()<P3))throw new I("insufficient-validity","Claustrum served credential has insufficient validity");let H=a4(X.material),Y=X.accountId?.trim()?X.accountId:void 0;if(this.#G&&(X.credentialId===void 0||Y===void 0))throw new I("identity-unasserted","Claustrum served credential did not assert its identity");let q=Y===void 0?this.#H?.(H):void 0,V=Y??q;if(G!==void 0&&V!==void 0&&V!==G)throw new I("identity-changed","Claustrum served credential identity changed");let B=V??G,F=Object.freeze(Object.defineProperty({credentialId:z,credentialType:Q,...B!==void 0&&{accountIdentity:B},accountIdentitySource:Y!==void 0?"asserted":q!==void 0?"parsed":G!==void 0?"expected":"none",...G!==void 0&&{expectedAccountIdentity:G},...X.credentialId!==void 0&&{assertedCredentialId:X.credentialId},...Y!==void 0&&{assertedAccountIdentity:Y},...X.projectId!==void 0&&{projectId:X.projectId},recordVersion:X.recordVersion,expiresAtMs:W},"accessToken",{value:H,enumerable:!1}));return this.#X.set(F,Z),F}async reportFailure($,Z,J){if(Z!==401)return;this.#D();let z=this.#X.get($);if(!z)throw new I("no-receipt","Claustrum failure report requires an original dispatch receipt");let Q=this.#W.get($);if(Q!==void 0){this.forget($.credentialId),this.#J.debug("scoped 401 not reported",{routeId:Q,reason:"kept-receipt"});return}let G=this.#U.get($.credentialId);if(G&&G.attempt.recordVersion===$.recordVersion)this.forget($.credentialId);let X=this.#Y.get($);if(X)return X;let W=this.#_(()=>this.#$.reportAuthFailureScoped({credentialId:$.credentialId,enrollmentToken:z,providerStatus:401,recordVersion:$.recordVersion,reporterSource:J}));this.#Y.set($,W);try{await W,this.#J.debug("scoped 401 reported",{credentialId:$.credentialId,recordVersion:$.recordVersion,reporterSource:J})}catch(H){throw this.#Y.delete($),H}}watchRoster($){this.#D();let Z=new K1({client:this.#$,enrollmentToken:()=>this.#I(),view:$.view??(()=>this.#P),discover:async(J)=>{await $.onView(J)},onRefused:(J)=>{this.listFailed(J),$.onRefused?.(J)},onTransportLost:()=>this.transportLost(),onReachable:()=>this.reachable(),onError:$.onError,onMode:$.onMode,logger:this.#J,now:this.#Z,setTimeoutImpl:this.#M,clearTimeoutImpl:this.#j});return this.#N.add(Z),Z.start(),{get mode(){return Z.mode},close:()=>{this.#N.delete(Z),Z.stop()}}}close(){if(this.#B)return;if(this.#B=!0,this.#q)this.#j(this.#q);this.#q=void 0;for(let $ of this.#N)$.stop();this.#N.clear(),this.#U.clear(),this.#$.close()}}import{createHash as U7}from"node:crypto";var I0="all",i4=Object.freeze(["primary"]);function V2($){return $.kind==="retired"?$.retiredAt:$.checkedAt}function v0($,Z){return JSON.stringify([$,Z])}function _0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function a($){return typeof $==="number"&&Number.isFinite($)}function q2($){return typeof $==="string"&&$.length>0}function t($,Z,J){return $[Z]===void 0||J($[Z])}function r4($){return a($)&&$>0}function I3($){return typeof $==="string"}function o4($){if(!_0($)||!q2($.scope)||!q2($.label))return!1;switch($.kind){case"reading":return a($.checkedAt)&&a($.usedPercent)&&t($,"resetsAt",I3)&&t($,"windowMinutes",r4);case"retired":return a($.retiredAt);case"absent":return a($.checkedAt);default:return!1}}function t4($){if(!_0($)||!a($.checkedAt))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&t($,"remainingPercent",a)&&t($,"usedPercent",a)&&t($,"resetsAt",I3)&&t($,"limit",a)&&t($,"used",a)&&t($,"remaining",a)&&t($,"unit",I3)}function K2($){return _0($)&&a($.value)&&Number.isInteger($.value)&&$.value>=0&&a($.checkedAt)}function _3($){return _0($)&&Object.values($).every(K2)}function j2($){if(!_0($))return;let Z=Object.entries($).filter(([,J])=>K2(J));return Z.length===0?void 0:Object.fromEntries(Z)}function A0($){if(x0($))return $;if(!_0($))return;let{counters:Z,...J}=$;if(!x0(J))return;let z=j2(Z);return{...J,...z===void 0?{}:{counters:z}}}function x0($){if(!_0($)||!Array.isArray($.limits))return!1;let Z=new Set;for(let J of $.limits){if(!o4(J))return!1;let z=v0(J.scope,J.label);if(Z.has(z))return!1;Z.add(z)}return t($,"budget",t4)&&t($,"counters",_3)}class I1 extends TypeError{constructor($){super($);this.name="QuotaCodecError"}}function A1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function _1($){return typeof $==="number"&&Number.isFinite($)}function M2($){return $===void 0||typeof $==="string"&&$!==""}function F2($){return typeof $==="string"&&$!==""}function t0($,Z){return $[Z]===void 0||_1($[Z])}function A3($,Z){return $[Z]===void 0||typeof $[Z]==="string"}function e4($){return A1($)&&M2($.scope)&&F2($.label)&&_1($.usedPercent)&&A3($,"resetsAt")&&($.windowMinutes===void 0||_1($.windowMinutes)&&$.windowMinutes>0)}function $7($){return A1($)&&M2($.scope)&&F2($.label)}function Z7($){if(!A1($))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&t0($,"remainingPercent")&&t0($,"usedPercent")&&A3($,"resetsAt")&&t0($,"limit")&&t0($,"used")&&t0($,"remaining")&&A3($,"unit")}function B2($){if(!A1($)||!_1($.checkedAt))return!1;let Z=$.readings??[],J=$.coverage??[];if(!Array.isArray(Z)||!Array.isArray(J))return!1;let z=new Set;for(let Q of Z){if(!e4(Q))return!1;let G=v0(Q.scope??I0,Q.label);if(z.has(G))return!1;z.add(G)}if(!J.every($7))return!1;return($.budget===void 0||Z7($.budget))&&($.counters===void 0||_3($.counters))}function J7($,Z){if($.scope!==Z.scope)return $.scope<Z.scope?-1:1;if($.label!==Z.label)return $.label<Z.label?-1:1;return 0}function z7($,Z,J){if(Z===void 0)return $;if($!==void 0&&J<$.checkedAt)return $;return{...Z,checkedAt:J}}function Q7($,Z){let J=new Map(Object.entries($??{}));for(let[z,Q]of Object.entries(Z??{})){let G=J.get(z);if(G===void 0||Q.checkedAt>=G.checkedAt)J.set(z,Q)}return J.size===0?void 0:Object.fromEntries(J)}function h0($,Z){let J=$===void 0?void 0:A0($);if($!==void 0&&J===void 0)throw new I1("stored quota map is malformed");if(!B2(Z))throw new I1("quota observation is malformed");let z=J??{limits:[]},Q=Z.checkedAt,G=new Map;for(let F of z.limits)G.set(v0(F.scope,F.label),F);let X=(F)=>{let D=G.get(F);return D===void 0||Q>=V2(D)},W=new Set;for(let F of Z.readings??[]){let D=F.scope??I0,P=v0(D,F.label);if(W.add(P),!X(P))continue;G.set(P,{scope:D,label:F.label,kind:"reading",checkedAt:Q,usedPercent:F.usedPercent,...F.resetsAt===void 0?{}:{resetsAt:F.resetsAt},...F.windowMinutes===void 0?{}:{windowMinutes:F.windowMinutes}})}for(let F of Z.coverage??[]){let D=F.scope??I0,P=v0(D,F.label);if(W.has(P)||!X(P))continue;let R=G.get(P);G.set(P,R===void 0||R.kind==="absent"?{scope:D,label:F.label,kind:"absent",checkedAt:Q}:{scope:D,label:F.label,kind:"retired",retiredAt:Q})}let{limits:H,budget:Y,counters:q,...V}=z,B=z7(z.budget,Z.budget,Q),L=Q7(z.counters,Z.counters);return{...V,limits:[...G.values()].sort(J7),...B===void 0?{}:{budget:B},...L===void 0?{}:{counters:L}}}var G7=Object.freeze({validate:x0,decode:A0,merge:h0});function D2($,Z,J){if($.accountIdentity!==void 0&&J!==void 0)return $.accountIdentity===J;return $.credentialId===Z}function b3($,Z,J){return $.some((z)=>D2(z,Z,J))}function R3($,Z,J){let z={credentialId:Z,...J!==void 0&&{accountIdentity:J}};return[...$.filter((Q)=>Q.credentialId!==Z||Q.accountIdentity!==J),z]}function S3($,Z,J){return $.filter((z)=>!Z.some((Q)=>D2(z,Q,J)))}var N2="vault:";function Y7($){return U7("sha256").update($).digest("hex")}function q7($){let Z=$.credentialId.split(":");return(Z.length>=3?Z.slice(2).join(":").trim():void 0)||$.email||$.credentialId}function V7($){return $.identity!==void 0?`identity:${$.identity}`:`credential:${$.credential.credentialId}`}function F0($){return[$.credentialId,...$.aliases??[]]}function C2($,Z,J={}){let z=J.now??Date.now(),Q=J.routePrefix??N2,G=J.reservedRouteIds??new Set,X=$?.rows??[],W=[...$?.declined??[]],H=Z.skipped.length===0,Y=new Set(Z.credentials.map((N)=>N.credentialId)),q=new Set(Z.skipped.flatMap((N)=>N.credentialId===void 0?[]:[N.credentialId])),V=Z.skipped.some((N)=>N.credentialId===void 0),B=(N)=>!Y.has(N)&&(q.has(N)||V),L=new Map;for(let N of X){if(N.accountIdentity===void 0)continue;for(let U of F0(N))if(!L.has(U))L.set(U,N.accountIdentity)}let F=new Map;for(let N of Z.credentials){let U=N.accountIdentity!==void 0?{credential:N,identity:N.accountIdentity,claimed:!0}:{credential:N,identity:L.get(N.credentialId),claimed:!1},K=V7(U),j=F.get(K)??[];j.push(U),F.set(K,j)}let D=new Set,P=new Set(G),R=[],f=(N,U)=>N.credential.credentialId.localeCompare(U.credential.credentialId),v=[...F.values()].map((N)=>N.toSorted(f)).sort((N,U)=>N[0]&&U[0]?f(N[0],U[0]):0);for(let N of v){let U=N[0]?.identity,K=N.filter((k)=>k.credential.state==="active"),j=K.length?K:N,b=j.filter((k)=>k.claimed),g=b.length?b:j,S=new Set(N.map((k)=>k.credential.credentialId)),m=X.find((k)=>!D.has(k)&&F0(k).some((G0)=>S.has(G0))&&(k.accountIdentity===void 0||k.accountIdentity===U)),s=g.find((k)=>k.credential.credentialId===m?.credentialId)??g[0];if(!s)continue;let x=s.credential,c=m??(U===void 0?void 0:X.find((k)=>!D.has(k)&&k.accountIdentity===U));if(c)D.add(c);let r=c?.routeId;if(!r||G.has(r)){let k=`${Q}${x.credentialId}${U===void 0?"":`~${Y7(U).slice(0,10)}`}`;r=k;for(let G0=2;P.has(r);G0++)r=`${k}~${G0}`}P.add(r);let H1=c?F0(c).filter(B):[],E0=[...new Set([...N.map((k)=>k.credential.credentialId),...H1])].filter((k)=>k!==x.credentialId).sort((k,G0)=>k.localeCompare(G0)),U1=J.mapAccount?.(x)??{};R.push({previousIndex:c?X.indexOf(c):1/0,row:{routeId:r,credentialId:x.credentialId,credentialType:x.credentialType,...U!==void 0&&{accountIdentity:U},...E0.length&&{aliases:E0},state:x.state,label:U1.label?.trim()||q7(x),...x.email!==void 0&&{email:x.email},...x.orgName!==void 0&&{orgName:x.orgName},enabled:![x.credentialId,...E0].some((k)=>b3(W,k,U)),addedAt:c?.addedAt??z,...c?.quota!==void 0&&{quota:c.quota},...!s.claimed&&U!==void 0&&{unclaimed:!0}}})}return X.forEach((N,U)=>{if(D.has(N)||!F0(N).some(B))return;if(P.has(N.routeId))return;let[K,...j]=F0(N).filter((S)=>!Y.has(S));if(K===void 0)return;P.add(N.routeId);let{aliases:b,...g}=N;R.push({previousIndex:U,row:{...g,credentialId:K,...j.length&&{aliases:j},stale:!0}})}),R.sort((N,U)=>N.previousIndex===U.previousIndex?N.row.credentialId.localeCompare(U.row.credentialId):N.previousIndex-U.previousIndex),{version:1,view:Z.view,complete:H,...!H&&{rejected:Z.skipped.map((N)=>({...N.credentialId!==void 0&&{credentialId:N.credentialId},reason:N.reason}))},rows:R.map((N)=>N.row),declined:W}}function k3($){return($?.rows??[]).filter((Z)=>Z.enabled&&Z.state==="active").map((Z)=>({id:Z.routeId,kind:Z.credentialType==="oauth"?"oauth":"api-key",...Z.quota!==void 0&&{quota:Z.quota}}))}function e0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function m0($){return $===void 0||typeof $==="string"}function K7($){let Z=e0($)?A0($.quota):void 0;if(!e0($)||typeof $.routeId!=="string"||typeof $.credentialId!=="string"||$.credentialType!=="oauth"&&$.credentialType!=="api_key"||typeof $.state!=="string"||typeof $.label!=="string"||typeof $.enabled!=="boolean"||typeof $.addedAt!=="number"||!m0($.accountIdentity)||!m0($.email)||!m0($.orgName)||$.aliases!==void 0&&(!Array.isArray($.aliases)||!$.aliases.every((J)=>typeof J==="string"))||$.quota!==void 0&&Z===void 0||$.stale!==void 0&&$.stale!==!0||$.unclaimed!==void 0&&$.unclaimed!==!0)return;return{...$,...Z===void 0?{}:{quota:Z}}}var j7=new Set(["empty credential id","duplicate credential id","blank account identity","empty state"]);function L2($){if(!Array.isArray($))return;let Z=[];for(let J of $){if(!e0(J)||!m0(J.credentialId)||typeof J.reason!=="string"||!j7.has(J.reason))return;Z.push(J)}return Z}function M7($){if(!e0($)||$.version!==1||!m0($.view)||!Array.isArray($.rows)||!Array.isArray($.declined)||$.complete!==void 0&&typeof $.complete!=="boolean"||$.rejected!==void 0&&!L2($.rejected))throw new I("invalid-state","Claustrum roster file is not valid");let Z=[];for(let Q of $.rows){let G=K7(Q);if(!G)throw new I("invalid-state","Claustrum roster file is not valid");Z.push(G)}let J=[];for(let Q of $.declined){if(!e0(Q)||typeof Q.credentialId!=="string"||!m0(Q.accountIdentity))throw new I("invalid-state","Claustrum roster file is not valid");J.push(Q)}let z=L2($.rejected);return{version:1,...typeof $.view==="string"&&{view:$.view},complete:$.complete!==!1,...z&&{rejected:z},rows:Z,declined:J}}async function J0($){let Z;try{Z=await o($,_)}catch(z){if(z.code==="ENOENT")return;throw z}let J;try{J=JSON.parse(Z)}catch{throw new I("invalid-state","Claustrum roster file is not valid")}return M7(J)}var F7={name:"claustrum-roster-write",ttlMs:1e4,timeoutMs:5000},B7={name:"claustrum-roster",ttlMs:30000};async function w0($,Z,J={}){return Y3($,F7,async(z)=>{let Q=await J0($),{next:G,result:X}=await Z(Q,{assertOwned:()=>z.assertOwned()});if(G)await z.assertOwned(),await i0($,G,{beforeRename:async()=>{await J.beforePublish?.(),await z.assertOwned()}});return X})}function E3($,Z){return w0($,(J)=>{let z=J?.rows.find((G)=>G.routeId===Z);if(!J||!z)throw new I("route-unavailable","Claustrum route is not in the roster");let Q=R3(J.declined,z.credentialId,z.accountIdentity);return{next:{...J,declined:Q,rows:J.rows.map((G)=>G===z?{...G,enabled:!1}:G)},result:void 0}})}function T3($,Z){return w0($,(J)=>{let z=J?.rows.find((Q)=>Q.routeId===Z);if(!J||!z)throw new I("route-unavailable","Claustrum route is not in the roster");return{next:{...J,declined:S3(J.declined,F0(z),z.accountIdentity),rows:J.rows.map((Q)=>Q===z?{...Q,enabled:!0}:Q)},result:void 0}})}function D7($,Z){if(!F0($).includes(Z.credentialId))return"refuse";if($.unclaimed&&(Z.accountIdentitySource==="expected"||Z.accountIdentitySource==="none"))return"refuse";if($.accountIdentity===Z.accountIdentity)return"hold";if($.accountIdentity===void 0&&Z.expectedAccountIdentity===void 0&&Z.accountIdentity!==void 0&&(Z.accountIdentitySource==="asserted"||Z.accountIdentitySource==="parsed")&&F0($).length===1)return"bind";return"refuse"}function f3($,Z){return w0($,(J)=>{let z=J?.rows.find((W)=>W.routeId===Z.routeId),Q=!J||!z?"refuse":D7(z,Z);if(!J||!z||Q==="refuse")return{result:!1};let G=h0(z.quota,Z.observation),X=Q==="bind"?{accountIdentity:Z.accountIdentity,unclaimed:!0}:{};return{next:{...J,rows:J.rows.map((W)=>W===z?{...W,...X,quota:G}:W)},result:!0}})}function g3($,Z){return w0($,(J)=>{let z=J?.rows.find((G)=>G.routeId===Z.routeId);if(!J||!z||z.accountIdentity===void 0||z.accountIdentity!==Z.accountIdentity)return{result:!1};let Q=h0(z.quota,Z.observation);return{next:{...J,rows:J.rows.map((G)=>G===z?{...G,quota:Q}:G)},result:!0}})}async function y3($){$.signal?.throwIfAborted();let Z=async()=>await $.isActive?.()??!0;if(!await Z())return;let J=await H0({...B7,path:$.path,renew:!0});if(!J){let z=await J0($.path);if($.signal?.throwIfAborted(),!z?.view)throw new I("roster-busy","Claustrum account discovery is already in progress");return z}try{let z=await $.custody.discover($.signal);return $.signal?.throwIfAborted(),await w0($.path,async(Q)=>{if(!await Z())return{result:void 0};$.signal?.throwIfAborted(),await J.assertOwned();let G=typeof $.projection==="function"?$.projection():$.projection,X=C2(Q,z,G);return{...JSON.stringify(Q)!==JSON.stringify(X)&&{next:X},result:X}})}finally{await J.release()}}class P2{#$;#z=new AbortController;#Z;#Q;#H;#G;#J;#X;#Y;#U=!1;#W;#M;#j;#K;constructor($){this.#$=$,this.#Z=$.logger??n0("claustrum")}#V($){this.#z.signal.throwIfAborted(),$?.throwIfAborted()}async#q(){return await this.#$.isCustodyActive?.()??!0}#F($,Z){let J=H3([this.#z.signal,...Z?[Z]:[]]);return new Promise((z,Q)=>{let G=()=>{J.signal.removeEventListener("abort",X),J.dispose()},X=()=>{G(),Q(J.signal.reason)};if(J.signal.addEventListener("abort",X,{once:!0}),$.then((W)=>{if(G(),J.signal.aborted)Q(J.signal.reason);else z(W)},(W)=>{G(),Q(W)}),J.signal.aborted)X()})}async#C(){if(this.#V(),this.#Q)return this.#Q;if(!this.#H)this.#H=this.#$.connect().then(($)=>{if(this.#z.signal.aborted)$.close(),this.#V();if(this.#Q=new O1({client:$,family:this.#$.family,tokenPath:this.#$.tokenPath,parseIdentity:this.#$.parseIdentity,requireAssertion:this.#$.requireAssertion,now:this.#$.now,logger:this.#Z,setTimeoutImpl:this.#$.setTimeoutImpl,clearTimeoutImpl:this.#$.clearTimeoutImpl}),this.#$.insula&&$.insula)this.#W=J3($.insula,this.#$.tokenPath);return this.#Q}).finally(()=>{this.#H=void 0});return this.#F(this.#H)}snapshot(){return this.#J}grantReach(){let $=this.#X;return $&&this.#J?.view===$.view?$.reach:void 0}watchState(){return Object.freeze({vault:this.#M?.mode??"polling",...this.#$.insula&&{insula:this.#W?.source.watchMode()??"polling"}})}#L(){this.#M?.close(),this.#M=void 0,this.#j?.(),this.#j=void 0}keptReceiptState(){return this.#Q?.keptReceiptState()??Object.freeze({active:!1,since:null})}routingRows(){return k3(this.#J)}refresh(){if(this.#V(),this.#G)return this.#G;return this.#G=(async()=>{if(!await this.#q()){this.#J=void 0,this.#X=void 0,this.#L(),this.#Q?.close(),this.#Q=void 0,this.#W?.release(),this.#W=void 0;return}let $=await this.#C(),Z,J=await y3({path:this.#$.rosterPath,custody:{discover:async(Q)=>{return Z=await $.discover(Q),Z}},isActive:()=>this.#q(),signal:this.#z.signal,projection:()=>({reservedRouteIds:new Set(this.#$.reservedRouteIds?.()??[]),routePrefix:this.#$.routePrefix,mapAccount:this.#$.mapAccount,now:(this.#$.now??Date.now)()})});this.#V();let z=J?.view!==this.#J?.view;if(this.#J=J,$.retain(J?.rows??[]),Z&&J?.view!==void 0)this.#X=Z.grantReach?{view:J.view,reach:Z.grantReach}:void 0;if(J&&z)this.#$.onRoster?.(J);return this.#K=(this.#$.now??Date.now)(),J})().finally(()=>{this.#G=void 0}),this.#G}start(){if(this.#U)return;this.#V(),this.#U=!0;let $=async()=>{try{if(await this.#B())await this.refresh();await this.refreshInsulaQuota(),this.#P()}catch(J){if(!this.#z.signal.aborted)this.#$.onError?.(J)}if(this.#z.signal.aborted)return;let Z=this.#$.pollIntervalMs??5000;if(Z<=0)return;this.#Y=(this.#$.setTimeoutImpl??setTimeout)(()=>{this.#Y=void 0,$()},Z),this.#Y.unref?.()};$()}async#B(){if(this.#M?.mode!=="watching")return!0;let $=(this.#$.now??Date.now)();if(this.#K===void 0||$-this.#K>=t1)return!0;return!await this.#q()}#P(){let $=this.#Q;if(this.#z.signal.aborted||!$)return;if(this.#M??=$.watchRoster({view:()=>this.#J?.view,onView:async()=>{while(this.#G)await this.#G.catch(()=>{});await this.refresh()},onRefused:(Z)=>this.#$.onError?.(Z),onError:(Z)=>{if(!this.#z.signal.aborted)this.#$.onError?.(Z)}}),this.#$.insula&&this.#W&&!this.#j)this.#j=this.#W.source.watch({provider:this.#$.insula.provider,setTimeoutImpl:this.#$.setTimeoutImpl,clearTimeoutImpl:this.#$.clearTimeoutImpl})}async refreshInsulaQuota(){if(!this.#$.insula||this.#z.signal.aborted||!await this.#q())return;try{await O0(this.#$.tokenPath),await this.#C(),await this.#W?.source.refresh((this.#$.now??Date.now)())}catch{}}async cachedInsulaQuota($){if(!this.#$.insula||this.#z.signal.aborted||!await this.#q())return;try{return await O0(this.#$.tokenPath),this.#N($.assertedAccountIdentity)}catch{return}}async cachedInsulaQuotaForRoute($){if(!this.#$.insula||this.#z.signal.aborted||!await this.#q())return;try{await O0(this.#$.tokenPath);let J=(await J0(this.#$.rosterPath))?.rows.find((z)=>z.routeId===$);return this.#N(J?.accountIdentity)}catch{return}}#N($){if(!this.#$.insula||!$)return;let Z=this.#W?.source.current(this.#$.insula.provider,$,(this.#$.now??Date.now)());return Z?this.#$.insula.normalize(Z.entry,Z.context):void 0}async authorize($,Z){this.#V(Z);let J=this.#J??await this.#F(this.refresh(),Z);if(!J||!await this.#q())throw this.#Q?.close(),this.#Q=void 0,this.#L(),this.#W?.release(),this.#W=void 0,new I("not-active","Claustrum scoped custody is not active");let z=await J0(this.#$.rosterPath);this.#V(Z);let Q=J.rows.find((H)=>H.routeId===$),G=z?.rows.find((H)=>H.routeId===$);if(G&&!G.enabled){if(Q)this.#Q?.forget(Q.credentialId);throw new I("route-declined","Claustrum route is disabled")}if(!Q||!G||G.state!=="active"||G.credentialId!==Q.credentialId||G.accountIdentity!==Q.accountIdentity||G.credentialType!==Q.credentialType){if(Q)this.#Q?.forget(Q.credentialId);throw new I("route-unavailable","Claustrum route is disabled, removed or changed")}let X=await this.#F(this.#C(),Z),W=H3([this.#z.signal,...Z?[Z]:[]]);try{return await X.authorize({credentialId:G.credentialId,credentialType:G.credentialType,...G.accountIdentity!==void 0&&{accountIdentity:G.accountIdentity}},W.signal,$)}finally{W.dispose()}}async reportFailure($,Z,J){if(this.#V(),!this.#Q)throw new I("no-receipt","Claustrum dispatch receipt has no active owner");await this.#Q.reportFailure($,Z,J)}async send($,Z,J){let z=J.signal,Q=await this.authorize($,z),G=await Z(Q,z);if(G.status===401&&Q.fromKeptReceipt)return await this.reportFailure(Q,401,J.reporterSource??"direct"),G;if(G.status===401&&!z?.aborted){let X;try{X=await this.authorize($,z)}catch{}if(O3(J.site,Q,X,this.#Z))await G.body?.cancel().catch(()=>{}),Q=X,G=await Z(X,z)}if(G.status===401)await this.reportFailure(Q,401,J.reporterSource??"direct").catch((X)=>this.#$.onError?.(X)),Promise.resolve().then(()=>this.refresh()).catch((X)=>{if(!this.#z.signal.aborted)this.#$.onError?.(X)});return G}async decline($){this.#V(),await E3(this.#$.rosterPath,$),this.#J=await J0(this.#$.rosterPath),this.#Q?.retain(this.#J?.rows??[])}async accept($){this.#V(),await T3(this.#$.rosterPath,$),this.#J=await J0(this.#$.rosterPath)}async recordQuota($,Z,J){this.#V();let z=await f3(this.#$.rosterPath,{routeId:$,observation:Z,credentialId:J.credentialId,accountIdentitySource:J.accountIdentitySource,...J.accountIdentity!==void 0&&{accountIdentity:J.accountIdentity},...J.expectedAccountIdentity!==void 0&&{expectedAccountIdentity:J.expectedAccountIdentity}});if(z)this.#J=await J0(this.#$.rosterPath);return z}async recordAccountQuota($,Z,J){this.#V();let z=await g3(this.#$.rosterPath,{routeId:$,accountIdentity:Z,observation:J});if(z)this.#J=await J0(this.#$.rosterPath);return z}close(){if(this.#z.signal.aborted)return;if(this.#z.abort(new I("closed","Claustrum consumer is closed")),this.#Y)(this.#$.clearTimeoutImpl??clearTimeout)(this.#Y);this.#Y=void 0,this.#L(),this.#Q?.close(),this.#W?.release(),this.#W=void 0,this.#J=void 0,this.#X=void 0}}var b1={opencode:C7,pi:P7};function x3($,Z){let{tokenPath:J}=O7($,Z);return{stateDir:N7(J),host:$,override:J}}function v3($,Z){return I7($==="pi"?Z.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE:void 0,$==="pi"?{...Z,OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE:void 0}:Z)}class $1 extends Error{code;constructor($){super($==="permission-refused"?"Native vault setup: permission-refused. Could not grant this host read access to native Claude accounts. An older ck may refuse a grant that already exists. Update CortexKit tools and run setup again.":`Native vault setup: ${$}`);this.code=$;this.name="NativeVaultEnrollmentError"}}function h3($){return["auth","grant","--principal",`enrolled:${b1[$]}`,"--selector-kind","category","--selector","anthropic-native","--operation","read"]}async function O2($,Z){try{if(await Z.processFence(),(await Z.runner.run(Z.ckBinary??"ck",h3($),{env:Z.env})).exitCode!==0)throw new $1("permission-refused")}catch{throw new $1("permission-refused")}}import{createHash as E7}from"node:crypto";import{lstat as T7,mkdir as f7,readFile as g2}from"node:fs/promises";import{dirname as g7}from"node:path";import{assertHostsStopped as y7,canonicalPath as w3,createNativeAccountRuntime as x7,custodyTombstoneOAuth as v7,inspectNativeHostAuthEntry as y2,NativeMigrationError as b0,nativePoolHoldsAccountData as h7,prepareNativeMigration as m7,readNativeEnrollmentMode as x2,readNativeMigrationJournal as w7,releaseNativeMigrationPreflight as u7,requireNoSupervisedAuthContentSnapshot as c7,runNativeMigration as p7,writeNativeHostAuth as d7}from"@cortexkit/anthropic-auth-core";import{dirname as _7,join as I2,resolve as m3}from"node:path";import{ACCOUNT_FILE_NAME as _2,ACCOUNT_STATE_FILE_NAME as A7,canonicalPath as A2,getStickyRoutingStatePath as b7,resolveLocalRoutingDestination as R7,resolveNativePoolPaths as S7}from"@cortexkit/anthropic-auth-core";async function U0($,Z){let J=$==="pi"?S2(Z):b2(Z),z=$==="pi"?Z.PI_ANTHROPIC_AUTH_FILE?.trim():Z.OPENCODE_ANTHROPIC_AUTH_FILE?.trim(),Q=m3(z||I2(J,_2)),G=m3(Z.OPENCODE_ANTHROPIC_AUTH_STATE_FILE?.trim()||(Q.endsWith(_2)?I2(_7(Q),A7):`${Q}.state.json`)),X=await S7(Q,G),W=$==="pi"?Z.PI_ANTHROPIC_AUTH_ROUTING_STATE_FILE?.trim():Z.OPENCODE_ANTHROPIC_AUTH_ROUTING_STATE_FILE?.trim();return{host:$,paths:X,legacyConfigPath:Q,legacyStatePath:G,hostAuthPath:$==="pi"?k2(Z):R2(Z),routingSourcePath:m3(W||b7(Q)),routingDestinationPath:R7($,X,Z)}}async function E2($){let Z=new Map;for(let J of $){let z=new Set;for(let[Q,G]of[J.paths.legacyConfig,J.paths.legacyState,J.paths.config,J.paths.state,J.paths.runtime,J.paths.roster,J.paths.journal,J.hostAuthPath,J.routingSourcePath,J.routingDestinationPath].entries()){let X=await A2(G);if(z.has(X)&&!(Q===9&&X===await A2(J.routingSourcePath)))throw Error("Native setup storage paths overlap");let W=Z.get(X);if(W!==void 0&&W!==J.host)throw Error("Native setup storage paths overlap between selected hosts");Z.set(X,J.host),z.add(X)}}}import{types as k7}from"node:util";var T2=new WeakMap;function f2($){return typeof $==="object"&&$!==null?T2.get($):void 0}function R1($){if(!$||typeof $!=="object"||k7.isProxy($))return;if(Object.getOwnPropertyDescriptor($,"name")?.value==="ProcessInspectionError"&&Object.getOwnPropertyDescriptor($,"code")?.value==="process-inspection-failed")return"Process inspection failed; setup cannot prove hosts are stopped.";return}class d extends Error{constructor($){super($);this.name="SetupRefusal",T2.set(this,$)}}var u3="OpenCode's separate Anthropic login is not used. Add that account through /claude Accounts if needed, or remove the separate login from OpenCode.";function v2($){let Z=$==="opencode"?"OpenCode":"Pi";return`${Z} is still connected to the vault. Old local settings do not disconnect it. In ${Z}, run /claude → Accounts → Disconnect from the vault. Then run local setup again.`}async function c3($,Z){let J=[];for(let z of $)if(await x2(z,Z)!=="local")J.push(v2(z));if(J.length)throw new d(J.join(`
+`))}function R0($,Z){return async()=>{c7(Z.env);try{await y7(Z.fence,Z.env)}catch(J){let z=R1(J);if(z)throw new d(z);throw J}await c3([$],Z.env)}}async function p3($){try{return E7("sha256").update(await g2($)).digest("hex")}catch(Z){if(Z.code==="ENOENT")return"absent";throw new b0("unsafe-source")}}async function Z1($,Z){let J;try{J=JSON.parse(await g2(Z,"utf8"))}catch(G){if(G.code!=="ENOENT")throw new b0("unsafe-source")}let z=y2($,J),Q=J?.anthropic;return{...z,realLogin:z.kind==="oauth"&&Boolean(Q?.access&&Q.refresh)}}async function S1($,Z){let{paths:J}=$,z=$.generation2?void 0:await Z1(J.host,J.hostAuthPath),Q=await Promise.all([J.paths.config,J.paths.state,J.paths.runtime,J.paths.roster,J.paths.journal,J.routingDestinationPath].map(p3));return JSON.stringify([await x2(J.host,Z),z?.digest,...Q])}async function d3($,Z,J){let z=Z.paths??await U0($,Z.env),Q=R0($,Z);await Q();let G=await w7(z.paths);if(G&&G.host!==$)throw new b0("invalid-source");let X=G?.phase==="committed"||G?.phase==="retired";if(G&&G.kind!=="empty-init"&&(G.hostAuthPath!==await w3(z.hostAuthPath)||G.routingPaths.source!==await w3(z.routingSourcePath)||G.routingPaths.destination!==await w3(z.routingDestinationPath)))throw new b0("invalid-source");let W={paths:z,generation2:J,action:"migration",notice:!1,fingerprint:"",authorityPhase:G?.phase??"absent",poolPopulation:"not-evaluated"};if(J){if(G&&!X)throw new b0("invalid-source");if(W.action=G?"reuse":"empty-init",!G){let H=[z.paths.config,z.paths.state,z.paths.runtime,z.paths.roster];if(!Z.env.OPENCODE_ANTHROPIC_AUTH_ROUTING_STATE_FILE)H.push(z.routingDestinationPath);for(let Y of H){try{await T7(Y)}catch(q){if(q.code==="ENOENT")continue;throw new b0("unsafe-source")}throw new b0("invalid-source")}}}else{W.slot=await Z1($,z.hostAuthPath),W.poolPopulation=G?.kind==="empty-init"?await h7({paths:z.paths}):"not-evaluated";let H=W.poolPopulation===!0;if($==="opencode"&&(H||X&&G?.kind!=="empty-init"&&W.slot.kind==="oauth"))W.action="skip",W.notice=W.slot.realLogin;else W.preflight=await m7({...z,env:Z.env,processFence:Q,removePiAnthropicAuth:Z.removePiAnthropicAuth})}return W.fingerprint=await S1(W,Z.env),W}async function u0($,Z){await R0($.paths.host,Z)();let J=await d3($.paths.host,{...Z,paths:$.paths},$.generation2);try{if(J.fingerprint!==$.fingerprint||J.action!==$.action)throw new d("Setup inputs changed. Rerun setup with all hosts stopped.")}finally{if(J.preflight)u7(J.preflight)}}async function l3($,Z){if($.paths.host!=="opencode"||$.slot?.kind!=="absent")return;let J=R0("opencode",Z);await J(),await f7(g7($.paths.hostAuthPath),{recursive:!0,mode:448}),await d7({host:"opencode",authPath:$.paths.hostAuthPath,sourceDigest:"absent",expectedDigest:y2("opencode",{anthropic:v7("anthropic")}).digest,env:Z.env,removePiAnthropicAuth:!1,processFence:J})}async function h2($,Z){let J={...Z.env},z=R0($,{...Z,env:J});await z();let Q=Z.paths??await U0($,J),G=await Z.login?.($);if(G&&!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(G.accountIdentity))throw Error("Claude sign-in did not establish an account UUID");if(await z(),await Z.beforeCommit?.(),!Z.skipMigration)await p7({paths:Q.paths,legacyConfigPath:Q.legacyConfigPath,legacyStatePath:Q.legacyStatePath,host:$,hostAuthPath:Q.hostAuthPath,routingSourcePath:Q.routingSourcePath,routingDestinationPath:Q.routingDestinationPath,env:J,processFence:z,removePiAnthropicAuth:Z.removePiAnthropicAuth,preflight:Z.preflight});if(G){let X=x7({paths:Q.paths,host:$,vault:{env:J},beforePoolWrite:z});try{if((await X.read()).mode!=="local")throw new d(v2($));await z(),await X.loginOAuth({routeId:"main",replace:!0,...G})}finally{X.close()}}if(Z.skipMigration){let X=await Z1($,Q.hostAuthPath);await l3({paths:Q,slot:X},Z)}}var m2={opencode:"OpenCode",pi:"Pi"};function e7($,Z){switch($){case"auth-content-refused":return"Run setup without OPENCODE_AUTH_CONTENT in the environment.";case"host-auth-invalid":return"The host auth file could not be read safely.";case"primary-conflict":return"Pi has a stored Anthropic API key, which would take precedence over the vault account. Remove it in Pi, then rerun setup.";case"consent-required":return"Pi has stored Anthropic authentication. Explicit consent is required to move it aside for vault use.";case"primary-unverified":return"The vault has no verified default Claude account. Sign in through the vault and rerun setup.";case"no-read-grant":return`${m2[Z]} has no read grant in the vault, so setup cannot see any Claude login. Run ${["ck",...h3(Z)].join(" ")}, then rerun setup.`;case"grant-reaches-nothing":return`${m2[Z]}'s vault read grant reaches no Claude login: no vault login carries the anthropic-native category, which logins saved before vault categories existed lack. Run ck auth reclassify --from-registry, check the logins with ck auth status, then rerun setup.`}}class z0 extends Error{code;constructor($,Z="opencode"){super(e7($,Z));this.name="NativeVaultActivationError",this.code=$}}function $6($){let Z=$?.grantReach;if(!Z||$.credentials.length>0||$.skipped.length>0)return"primary-unverified";return Z.grants===0?"no-read-grant":"grant-reaches-nothing"}async function s3($){try{return JSON.parse(await l7($,"utf8"))}catch(Z){if(Z.code==="ENOENT")return;throw new z0("host-auth-invalid")}}async function J1($,Z){if($==="opencode")return"opencode";let J=Z.paths??await U0($,Z.env),z=a3($,await s3(J.hostAuthPath)),Q=n3({env:Z.env,authPath:J.hostAuthPath}),{stashPath:G}=r7({env:Z.env,authPath:J.hostAuthPath});return JSON.stringify([z.digest,await Q.inspect(),await p3(G)])}async function w2($){try{t7($.env)}catch{throw new z0("auth-content-refused")}try{await a7($.fence,$.env)}catch(Z){let J=R1(Z);if(J)throw new d(J);throw Z}}async function u2($,Z){let J={...Z.env};await(()=>w2({...Z,env:J}))();let Q=Z.paths??await U0($,J),G=$==="opencode"&&Z.inspectOpenCodeAuth!==!1&&a3("opencode",await s3(Q.hostAuthPath)).kind==="oauth";if($==="pi"){let X=a3("pi",await s3(Q.hostAuthPath)),W=await n3({env:J,authPath:Q.hostAuthPath}).inspect();if(W.slot==="placeholder"&&W.stash==="missing")throw new i7("missing-stash");if(X.kind!=="absent"&&W.slot!=="placeholder"&&!Z.removePiAnthropicAuth)throw new z0("consent-required")}return{priorMode:await o7($,J),fingerprint:await J1($,{...Z,env:J}),separateOpenCodeLogin:G}}async function c2($,Z,J){let z={...Z.env},Q=()=>w2({...Z,env:z});await Q();let G=Z.paths??await U0($,z);if(await J1($,Z)!==J.fingerprint)throw new z0("host-auth-invalid");await O2($,{env:z,runner:Z.runner,processFence:Q,ckBinary:Z.enrollment?.ckBinary});let X=Z.discover??(()=>n7({paths:G.paths,host:$,env:$==="pi"?{...z,OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE:z.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE}:z})),W,H=async()=>{return W=await X(),W},Y=s7({paths:G.paths,host:$,vault:{env:z,discover:H}});try{await Q(),await Y.vault.refresh();let q=await Y.read(),V=q.accounts.find((B)=>B.id==="main");if(q.mode!=="claustrum"||!V?.accountIdentity||V.source!=="vault"){let B=$6(W);throw B==="primary-unverified"?new z0(B):new z0(B,$)}if(await Q(),$==="pi")await n3({env:z,authPath:G.hostAuthPath}).enterVault();return J.priorMode==="claustrum"?"already-vault":"committed"}finally{Y.close()}}var Z6=/(?:^|[/\\])(opencode|litecode|opencode2|pi)(?:\.exe)?(?=$|\s|")/i;class i3 extends Error{activeHosts;constructor($){let Z=$.map((z)=>({pid:z.pid,command:Z6.exec(z.command)?.[1]??"host"})),J=Z.map((z)=>`  - PID ${z.pid}: ${z.command}`).join(`
 `);super(`OpenCode or Pi processes are currently running:
 ${J}
 
-Please quit all OpenCode, LiteCode, and Pi processes before running setup.`);this.activeHosts=Z,this.name="ProcessFenceViolationError"}}function j4($=$0,Z={}){let J=(Z.platform??process.platform)==="win32";return{async listRunningHosts(z){let Y=J?"tasklist":"ps",Q=J?["/fo","csv","/nh"]:["-eo","pid,command"],G;try{G=await $.run(Y,Q,{env:z})}catch{throw new L0}if(G.exitCode!==0)throw new L0;let W=G.stdout.split(/\r?\n/),X=[],K=process.pid;for(let j of W){let H=j.trim();if(!H)continue;let M,D;if(J){let q=H.split(",").map((B)=>B.replace(/^"|"$/g,""));if(q.length<2)throw new L0;D=q[0]??"",M=Number(q[1])}else{let q=/^(\d+)\s+(.+)$/.exec(H);if(!q){if(/^PID\s+COMMAND$/i.test(H))continue;throw new L0}M=Number(q[1]),D=q[2]??""}if(!Number.isInteger(M)||M<0)throw new L0;if(M===K)continue;if(N2.test(D))X.push({pid:M,command:D})}return X}}}var c3=j4($0);async function i0($=c3){let Z=await $.listRunningHosts();if(Z.length>0)throw new x1(Z)}class w0 extends Error{code;constructor($){super({"auth-content-refused":"Run setup without OPENCODE_AUTH_CONTENT in the environment.","host-auth-invalid":"The host auth file could not be read safely.","primary-conflict":"Pi has a stored Anthropic API key, which would take precedence over the vault account. Remove it in Pi, then rerun setup.","consent-required":"Pi has stored Anthropic authentication. Explicit consent is required to move it aside for vault use.","primary-unverified":"The vault has no verified default Claude account. Sign in through the vault and rerun setup."}[$]);this.code=$;this.name="NativeVaultActivationError"}}async function q4($){try{return JSON.parse(await U4($,"utf8"))}catch(Z){if(Z.code==="ENOENT")return;throw new w0("host-auth-invalid")}}async function P2($,Z){let J={...Z.env},z=async()=>{try{w1(J)}catch{throw new w0("auth-content-refused")}await i0(Z.fence)};await z();let Y=Z.paths??await l0($,J);if($==="pi"){let X=O2("pi",await q4(Y.hostAuthPath)),K=await p3({env:J,authPath:Y.hostAuthPath}).inspect();if(K.slot==="placeholder"&&K.stash==="missing")throw new T1("missing-stash");if(X.kind!=="absent"&&K.slot!=="placeholder"&&!Z.removePiAnthropicAuth)throw new w0("consent-required")}let Q=await B0($,J);await V2($,{env:J,runner:Z.runner,processFence:z,...Z.enrollment});let G=Z.discover??(()=>I2({paths:Y.paths,host:$,env:$==="pi"?{...J,OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE:J.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE}:J})),W=a0({paths:Y.paths,host:$,vault:{env:J,discover:G}});try{await z(),await W.vault.refresh();let X=await W.read(),K=X.accounts.find((j)=>j.id==="main");if(X.mode!=="claustrum"||!K?.accountIdentity||K.source!=="vault")throw new w0("primary-unverified");if(await z(),$==="pi")await p3({env:J,authPath:Y.hostAuthPath}).enterVault();return Q==="claustrum"?"already-vault":"committed"}finally{W.close()}}var B4={"setup-activation":"Vault custody setup","setup-opencode-config":"OpenCode configuration","setup-pi-install":"Pi extension installation","setup-pi":"Pi setup","setup-process-check":"Host process check","cli-setup":"Setup","cli-login":"Login","cli-api-add":"API route setup","cli-list":"Account listing","cli-relay-setup":"Relay setup","cli-relay-workers-dev":"Workers.dev enablement","cli-command":"Command"};function Y1(){return($)=>$}var N4=Y1()(["auth-content-refused","host-auth-invalid","primary-conflict","consent-required","primary-unverified"]),O4=Y1()(["enrollment-refused","enrollment-reset","approval-refused","permission-refused"]),I4=Y1()(["invalid-source","unsafe-source","consent-required","primary-unverified","migration-busy","ownership-lost","retirement-refused"]),P4=Y1()(["invalid-options","invalid-auth","invalid-stash","unsafe-path","missing-stash","conflict","lock-timeout","lock-compromised","io"]),C4=Y1()(["closed","not-enrolled","invalid-token","unavailable","identity-changed","identity-unasserted","insufficient-validity","invalid-material","not-active","route-unavailable","route-declined","no-receipt","unsafe-file","invalid-state","wrong-consumer","roster-busy","host-slot-login","host-slot-placeholder","placeholder-refresh"]),R4=new Set([new L0().message,...N4.map(($)=>new w0($).message),...O4.map(($)=>new X0($).message),...I4.map(($)=>new f2($).message),...P4.map(($)=>new T1($).message),...C4.map(($)=>`Native custody refused: ${$}`),"Disconnect from the vault first.","Native account changes require offline setup without OPENCODE_AUTH_CONTENT","Local login cannot be verified while OPENCODE_AUTH_CONTENT is set","Authentication failed","API fallback base URL must be an http(s) URL without embedded credentials","API key is required","Vault routes cannot be replaced with a local API key","Cloudflare API token is required","Cloudflare account ID is required","Relay Worker URL is required","Claude sign-in did not establish an account UUID","Native setup storage paths overlap between selected hosts","Anthropic account storage paths overlap; migration requires separate files","Anthropic account migration is required. Stop OpenCode, LiteCode and Pi, then run bunx @cortexkit/opencode-anthropic-auth@2.0.0 setup","Anthropic account migration is incomplete; resume setup","Anthropic account migration journal is invalid","Anthropic account migration journal changed","Anthropic runtime state is invalid","Anthropic runtime file is not owner-only regular storage","Anthropic runtime storage is unavailable","Anthropic runtime observation is older than persisted state","Anthropic runtime publication was refused","OAuth metadata read failed"]),b4=new Set(["opencode","litecode","opencode2","pi","host"]),A4=64,k4=256,_4=4096,d3=65536,f4=4096,E4=3,R2="[output beyond the diagnostic limit omitted]",S4="[output withheld: no line break within the inspected window]",x4="[detail withheld: the known credentials could not be read safely]",i3=new TextEncoder,E2=new TextDecoder;function Z0($,Z){let J=Object.getOwnPropertyDescriptor($,Z);return J!==void 0&&"value"in J?J.value:void 0}function Q1($){return $!==null&&(typeof $==="object"||typeof $==="function")&&!l3.isProxy($)}function S2($,Z){if(!Q1($)||!Array.isArray($))return;let J=Z0($,"length");if(typeof J!=="number"||J>Z)return;let z=[];for(let Y=0;Y<J;Y+=1){let Q=Object.getOwnPropertyDescriptor($,String(Y));if(Q===void 0||!("value"in Q))return;z.push(Q.value)}return z}function w4($){let Z=S2($,A4);if(Z===void 0||Z.length===0)return;let J=[];for(let z of Z){if(!Q1(z))return;let Y=Z0(z,"pid"),Q=Z0(z,"command");if(typeof Y!=="number"||!Number.isSafeInteger(Y)||Y<0)return;if(typeof Q!=="string"||!b4.has(Q.toLowerCase()))return;J.push({pid:Y,command:Q})}return J}function T4($){try{if(!Q1($))return;let Z=Z0($,"message");if(typeof Z!=="string")return;if(R4.has(Z))return Z;let J=Z0($,"status");if(typeof J==="number"&&Number.isInteger(J)&&J>=100&&J<=599&&Z===`OAuth metadata read failed: ${J}`)return Z;let z=w4(Z0($,"activeHosts"));if(z&&Z===new x1(z).message)return Z}catch{}return}function g4($,Z=[]){try{let J=new Set,z=S2(Z,k4);if(z===void 0)return;for(let Q of z){if(typeof Q!=="string")return;if(Q!=="")J.add(Q)}if(!Q1($))return;let Y=Reflect.ownKeys($);if(Y.length>_4)return;for(let Q of Y){if(typeof Q!=="string"||!A2(Q))continue;let G=Object.getOwnPropertyDescriptor($,Q);if(G===void 0)continue;if(!("value"in G))return;if(G.value===void 0||G.value==="")continue;if(typeof G.value!=="string")return;J.add(G.value)}return[...J]}catch{return}}function h4($,Z){let J=i3.encode($);if(J.length<=Z)return $;let z=Math.max(0,Z);while(z>0&&((J[z]??0)&192)===128)z-=1;return E2.decode(J.subarray(0,z))}function y4($,Z){let J=i3.encode($);if(J.length<=Z)return $;let z=J.length-Math.max(0,Z);while(z<J.length&&((J[z]??0)&192)===128)z+=1;return E2.decode(J.subarray(z))}function m4($,Z,J){let z=$,Y=!1;if($.length>d3){if(Y=!0,J==="tail"){let X=$.indexOf(`
-`,$.length-d3);z=X===-1?"":$.slice(X+1)}else{let X=$.lastIndexOf(`
-`,d3);z=X===-1?"":$.slice(0,X)}if(z==="")return[S4]}let Q=Z.redactText(z).split(/\r?\n/);if(Q.length>1&&Q[Q.length-1]==="")Q.pop();if(J==="tail")Q.reverse();let G=[],W=f4;for(let X of Q){let K=i3.encode(X).length+1;if(K<=W){G.push(X),W-=K;continue}if(G.length===0)G.push(J==="tail"?y4(X,W-1):h4(X,W-1));Y=!0;break}if(J==="tail")G.reverse();if(Y)if(J==="tail")G.unshift(R2);else G.push(R2);return G}function v4($){let Z=$;for(let J=0;Z!==null&&J<8;J+=1){if(l3.isProxy(Z))break;let z=Z0(Z,"name");if(typeof z==="string")return z;Z=Object.getPrototypeOf(Z)}return"object"}function x2($,Z){if($===null||typeof $!=="object"&&typeof $!=="function")return[`thrown ${typeof $}: ${String($)}`];if(l3.isProxy($))return["thrown proxy (not inspected)"];let J=[],z=v4($),Y=Z0($,"message");J.push(typeof Y==="string"?`${z}: ${Y}`:`${z} (no message)`);let Q=Z0($,"code");if(typeof Q==="string"||typeof Q==="number")J.push(`code: ${Q}`);let G=Z0($,"stack");if(typeof G==="string")J.push(G);let W=Z0($,"cause");if(W!==void 0)if(Z>=E4)J.push("caused by: [not described]");else J.push("caused by:",...x2(W,Z+1));return J}function b2($,Z){let J=Z0($,Z);return typeof J==="string"&&J!==""?J:void 0}function c4($){if(!Q1($))return;let Z=b2($,"XDG_STATE_HOME"),J=b2($,"HOME"),z=Z&&C2(Z)?Z:u3(J&&C2(J)?J:L4(),".local","state");return u3(z,"cortexkit","anthropic-auth","diagnostics")}async function p4($,Z,J){try{let z=c4($);if(z===void 0)return;await D4(z,{recursive:!0,mode:448});let Y=await M4(z);if(!Y.isDirectory())return;if(process.platform!=="win32"){if((Y.mode&63)!==0)return;if(Y.uid!==process.getuid?.())return}let Q=u3(z,`${Z}-${Date.now()}-${process.pid}-${V4()}.log`),G=await F4(Q,g1.O_WRONLY|g1.O_CREAT|g1.O_EXCL|(g1.O_NOFOLLOW??0),384);try{await G.writeFile(J,"utf8")}finally{await G.close()}return Q}catch{return}}async function w2($,Z,J,z,Y,Q){let G,W=g4(J,z);if(W===void 0)G=[x4];else try{let H=_2(W);try{let{text:M,keep:D}=Q();G=m4(M,H,D)}finally{H.dispose()}}catch{G=["[failure detail could not be recorded]"]}let X=B4[$],K=k2("error","cli",`${X} failed`,{stage:$,code:Z,...Y}),j=await p4(J,$,`${[K,...G].join(`
+Please quit all OpenCode, LiteCode, and Pi processes before running setup.`);this.activeHosts=Z,this.name="ProcessFenceViolationError"}}var M6={"setup-activation":"Vault custody setup","setup-opencode-config":"OpenCode configuration","setup-pi-install":"Pi extension installation","setup-pi":"Pi setup","setup-process-check":"Host process check","cli-setup":"Setup","cli-login":"Login","cli-api-add":"API route setup","cli-list":"Account listing","cli-relay-setup":"Relay setup","cli-relay-workers-dev":"Workers.dev enablement","cli-command":"Command"};function z1(){return($)=>$}var t3=["opencode","pi"],F6=new Set(["enrolled","not-enrolled","unknown"]),n2=z1()(["auth-content-refused","host-auth-invalid","primary-conflict","consent-required","primary-unverified","no-read-grant","grant-reaches-nothing"]),i2=z1()(["enrollment-refused","enrollment-reset","approval-refused","permission-refused"]),r2=z1()(["invalid-source","unsafe-source","consent-required","primary-unverified","migration-busy","ownership-lost","retirement-refused","pool-populated","host-login-present","settings-changed"]),o2=z1()(["invalid-options","invalid-auth","invalid-stash","unsafe-path","missing-stash","conflict","lock-timeout","lock-compromised","io"]),t2=z1()(["closed","not-enrolled","invalid-token","unavailable","identity-changed","identity-unasserted","insufficient-validity","invalid-material","not-active","route-unavailable","route-declined","no-receipt","unsafe-file","invalid-state","wrong-consumer","roster-busy","host-slot-login","host-slot-placeholder","placeholder-refresh"]),B6={name:new Set(["Error","TypeError","SyntaxError","RangeError","AggregateError","AbortError","PrivateFileError","PrivateFilesUnavailableError","DiagnosticFileError","NativeRuntimeError","NativeAuthorityError","NativeMigrationError","NativeMigrationSourceError","NativeHostAuthError","NativeHostAuthWriteError","NativePiAuthSlotError","NativeCustodyError","NativeVaultActivationError","NativeVaultEnrollmentError","SetupCommandError","ProcessFenceViolationError","ProcessInspectionError","LockOwnershipError","LockContentionError","ClaustrumConsumerError","ClaustrumCredentialError"]),code:new Set([...n2,...i2,...r2,...o2,...t2,"EACCES","EPERM","ENOENT","EEXIST","ENOTDIR","EISDIR","ENOTEMPTY","EBUSY","ETIMEDOUT","ECONNREFUSED","ECONNRESET","ECANCELED","EIO","EINVAL","ENOTSUP","ENOSYS","ENOMEM","EMFILE","ENFILE","ELOOP","EROFS","EXDEV","ENAMETOOLONG","EBADF","EPIPE","ENOSPC","EINTR","ERR_INVALID_ARG_TYPE","ERR_INVALID_ARG_VALUE","ERR_OUT_OF_RANGE","ERR_FEATURE_UNAVAILABLE_ON_PLATFORM","ERR_PRIVATE_FILES_SECURITY","ERR_PRIVATE_FILES_UNAVAILABLE","ERR_PRIVATE_FILE","ERR_DIAGNOSTICS_DIRECTORY_UNAVAILABLE","ERR_DIAGNOSTICS_NOT_DIRECTORY","ERR_DIAGNOSTICS_NOT_OWNER_ONLY","unsafe-runtime","invalid-runtime","runtime-io","runtime-conflict","publication-refused","invalid-journal","source-io","source-changed","source-too-large","write-io"]),stage:new Set(["safe-parent","verify","directory","read","create","directory-create","rename","stage-directory","stage-create","before-rename","published-callback","published-verify","directory-sync-unsupported"]),reason:new Set(["wrong-owner","extra-ace","not-protected","null-dacl","empty-dacl","reparse-point","unsupported-filesystem","unsafe-ancestor","wrong-kind","io-error","mode","writable-by-others"])},D6=new Set([...n2.flatMap(($)=>$==="no-read-grant"||$==="grant-reaches-nothing"?t3.map((Z)=>new z0($,Z).message):[new z0($).message]),...i2.map(($)=>new $1($).message),...r2.map(($)=>new V6($).message),...o2.map(($)=>new K6($).message),...t2.map(($)=>`Native custody refused: ${$}`),"Disconnect from the vault first.","Native account changes require offline setup without OPENCODE_AUTH_CONTENT","Local login cannot be verified while OPENCODE_AUTH_CONTENT is set","Authentication failed","API fallback base URL must be an http(s) URL without embedded credentials","API key is required","Vault routes cannot be replaced with a local API key","Cloudflare API token is required","Cloudflare account ID is required","Relay Worker URL is required","--claustrum and --no-claustrum cannot be used together.","Setup requires a TTY or --yes.","Multiple OpenCode generations found. Choose --opencode=1|2|both before running noninteractive setup.","Claustrum is not available. Start ck or use --no-claustrum for local sign-in.","Claude sign-in did not establish an account UUID","Native setup storage paths overlap between selected hosts","Anthropic account storage paths overlap; migration requires separate files","Anthropic account migration is required. Stop OpenCode, LiteCode and Pi, then run npx @cortexkit/opencode-anthropic-auth@2.0.0 setup","Anthropic account migration is incomplete; resume setup","Anthropic account migration journal is invalid","Anthropic account migration journal changed","Anthropic runtime state is invalid","Anthropic runtime file is not owner-only regular storage","Anthropic runtime storage is unavailable","Anthropic runtime observation is older than persisted state","Anthropic runtime publication was refused","OAuth metadata read failed"]),L6=new Set(["opencode","litecode","opencode2","pi","host"]),N6=64,C6=256,P6=4096,r3=65536,O6=4096,I6=3,d2="[output beyond the diagnostic limit omitted]",_6="[output withheld: no line break within the inspected window]",A6="[detail withheld: the known credentials could not be read safely]",$$=new TextEncoder,e2=new TextDecoder;function h($,Z){let J=Object.getOwnPropertyDescriptor($,Z);return J!==void 0&&"value"in J?J.value:void 0}function Y0($){return $!==null&&(typeof $==="object"||typeof $==="function")&&!e3.isProxy($)}function Z$($,Z){if(!Y0($)||!Array.isArray($))return;let J=h($,"length");if(typeof J!=="number"||J>Z)return;let z=[];for(let Q=0;Q<J;Q+=1){let G=Object.getOwnPropertyDescriptor($,String(Q));if(G===void 0||!("value"in G))return;z.push(G.value)}return z}function b6($){let Z=Z$($,N6);if(Z===void 0||Z.length===0)return;let J=[];for(let z of Z){if(!Y0(z))return;let Q=h(z,"pid"),G=h(z,"command");if(typeof Q!=="number"||!Number.isSafeInteger(Q)||Q<0)return;if(typeof G!=="string"||!L6.has(G.toLowerCase()))return;J.push({pid:Q,command:G})}return J}function J$($){try{if(!Y0($))return;if(h($,"name")==="ProcessInspectionError")return"";let Z=h($,"message");if(typeof Z!=="string")return;if(D6.has(Z))return Z;if(Z.startsWith("Unknown setup argument: "))return Z;let J=h($,"status");if(typeof J==="number"&&Number.isInteger(J)&&J>=100&&J<=599&&Z===`OAuth metadata read failed: ${J}`)return Z;let z=b6(h($,"activeHosts"));if(z){let Q=new i3(z).message;if(Z===Q)return Q}}catch{}return}function $9($){try{if(!Y0($))return;let Z=Z$(j6($),t3.length);if(Z===void 0)return;let J=[];for(let z of Z){if(!Y0(z))return;let Q=t3.find((X)=>X===h(z,"host")),G=h(z,"outcome");if(Q===void 0||!F6.has(G))return;J.push({host:Q,outcome:G})}return J}catch{return}}function R6($,Z=[]){try{let J=new Set,z=Z$(Z,C6);if(z===void 0)return;for(let G of z){if(typeof G!=="string")return;if(G!=="")J.add(G)}if(!Y0($))return;let Q=Reflect.ownKeys($);if(Q.length>P6)return;for(let G of Q){if(typeof G!=="string"||!q6(G))continue;let X=Object.getOwnPropertyDescriptor($,G);if(X===void 0)continue;if(!("value"in X))return;if(X.value===void 0||X.value==="")continue;if(typeof X.value!=="string")return;J.add(X.value)}return[...J]}catch{return}}function S6($,Z){let J=$$.encode($);if(J.length<=Z)return $;let z=Math.max(0,Z);while(z>0&&((J[z]??0)&192)===128)z-=1;return e2.decode(J.subarray(0,z))}function k6($,Z){let J=$$.encode($);if(J.length<=Z)return $;let z=J.length-Math.max(0,Z);while(z<J.length&&((J[z]??0)&192)===128)z+=1;return e2.decode(J.subarray(z))}function E6($,Z,J){let z=$,Q=!1;if($.length>r3){if(Q=!0,J==="tail"){let H=$.indexOf(`
+`,$.length-r3);z=H===-1?"":$.slice(H+1)}else{let H=$.lastIndexOf(`
+`,r3);z=H===-1?"":$.slice(0,H)}if(z==="")return[_6]}let G=Z.redactText(z).split(/\r?\n/);if(G.length>1&&G[G.length-1]==="")G.pop();if(J==="tail")G.reverse();let X=[],W=O6;for(let H of G){let Y=$$.encode(H).length+1;if(Y<=W){X.push(H),W-=Y;continue}if(X.length===0)X.push(J==="tail"?k6(H,W-1):S6(H,W-1));Q=!0;break}if(J==="tail")X.reverse();if(Q)if(J==="tail")X.unshift(d2);else X.push(d2);return X}function Z9($){let Z=$;for(let J=0;Z!==null&&J<8;J+=1){if(e3.isProxy(Z))break;let z=h(Z,"name");if(typeof z==="string")return z;Z=Object.getPrototypeOf(Z)}return"object"}function l2($,Z){let J={};if(Z===void 0)return J;try{if(!Y0($))return J;let z=s2(Z);try{for(let Q of["name","code","stage","reason"]){let G=Q==="name"?Z9($):h($,Q);if(typeof G==="string"&&B6[Q].has(G)&&z.redactText(G)===G)J[Q]=G}}finally{z.dispose()}}catch{return{}}return J}function T6($){if(!Y0($))return;let Z=h($,"step"),J=h($,"exitCode"),z=h($,"signal"),Q=h($,"stderrTail");if(typeof Z!=="string"||Z.length===0||!(J===null||typeof J==="number"&&Number.isInteger(J))||!(z===null||typeof z==="string")||typeof Q!=="string")return;return{step:Z,exitCode:J,signal:z,stderrTail:Q}}function J9($,Z){if($===null||typeof $!=="object"&&typeof $!=="function")return[`thrown ${typeof $}: ${String($)}`];if(e3.isProxy($))return["thrown proxy (not inspected)"];let J=[],z=Z9($),Q=h($,"message");J.push(typeof Q==="string"?`${z}: ${Q}`:`${z} (no message)`);let G=h($,"code");if(typeof G==="string"||typeof G==="number")J.push(`code: ${G}`);let X=h($,"stack");if(typeof X==="string")J.push(X);let W=h($,"cause");if(W!==void 0)if(Z>=I6)J.push("caused by: [not described]");else J.push("caused by:",...J9(W,Z+1));return J}function a2($,Z){let J=h($,Z);return typeof J==="string"&&J!==""?J:void 0}function f6($){if(!Y0($))return;let Z=a2($,"XDG_STATE_HOME"),J=a2($,"HOME"),z=Z&&p2(Z)?Z:o3(J&&p2(J)?J:X6(),".local","state");return o3(z,"cortexkit","anthropic-auth","diagnostics")}async function g6($,Z,J,z={}){let Q=(G)=>({error:{name:"DiagnosticFileError",code:G}});try{let G=f6($);if(G===void 0)return Q("ERR_DIAGNOSTICS_DIRECTORY_UNAVAILABLE");if(!await H6(G,z)){await Q6(G,{recursive:!0,mode:448});let H=await z6(G);if(!H.isDirectory())return Q("ERR_DIAGNOSTICS_NOT_DIRECTORY");if(!await Y6(G,()=>(H.mode&63)===0&&H.uid===process.getuid?.(),z))return Q("ERR_DIAGNOSTICS_NOT_OWNER_ONLY")}let X=o3(G,`${Z}-${Date.now()}-${process.pid}-${J6()}.log`);if(await W6(X,J,z))return{path:X};let W=await G6(X,k1.O_WRONLY|k1.O_CREAT|k1.O_EXCL|(k1.O_NOFOLLOW??0),384);try{await W.writeFile(J,"utf8")}finally{await W.close()}return{path:X}}catch(G){return{error:G}}}async function y6($,Z,J,z,Q,G,X,W={}){let H,Y=R6(J,z);if(Y===void 0)H=[A6];else try{let F=s2(Y);try{let{text:D,keep:P}=G();H=E6(D,F,P)}finally{F.dispose()}}catch{H=["[failure detail could not be recorded]"]}let q=M6[$],V=U6("error","cli",`${q} failed`,{stage:$,code:Z,...Q}),B=await g6(J,$,`${[V,...H].join(`
 `)}
-`);return j===void 0?`${X} failed (${Z}). Details could not be saved to a private diagnostics file.`:`${X} failed (${Z}). Details were written to ${j}`}async function N0($,Z,J,z=[]){let Y=T4(Z);if(Y!==void 0)return Y;return w2($,`${$}/unexpected-error`,J,z,{},()=>({text:x2(Z,0).join(`
-`),keep:"head"}))}async function T2($,Z,J){return w2($,`${$}/installer-exit`,J,[],{exitCode:Number.isInteger(Z.exitCode)?Z.exitCode:null},()=>({text:typeof Z.stderr==="string"?Z.stderr:"",keep:"tail"}))}import{styleText as c1}from"node:util";import{stdout as $$,stdin as Z9}from"node:process";import*as O0 from"node:readline";import Q8 from"node:readline";var g2=(()=>{let $=/[\uD800-\uDBFF][\uDC00-\uDFFF]/g;return(Z)=>{let J=0;$.lastIndex=0;while($.test(Z))J+=1;return Z.length-J}})(),h2=($)=>{return $===12288||$>=65281&&$<=65376||$>=65504&&$<=65510},y2=($)=>{return $===8987||$===9001||$>=12272&&$<=12287||$>=12289&&$<=12350||$>=12441&&$<=12543||$>=12549&&$<=12591||$>=12593&&$<=12686||$>=12688&&$<=12771||$>=12783&&$<=12830||$>=12832&&$<=12871||$>=12880&&$<=19903||$>=65040&&$<=65049||$>=65072&&$<=65106||$>=65108&&$<=65126||$>=65128&&$<=65131||$>=127488&&$<=127490||$>=127504&&$<=127547||$>=127552&&$<=127560||$>=131072&&$<=196605||$>=196608&&$<=262141};var d4=/[\u001b\u009b][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]|\u001b\]8;[^;]*;.*?(?:\u0007|\u001b\u005c)/y,u4=/[\x00-\x08\x0A-\x1F\x7F-\x9F]{1,1000}/y,m2=/(?:(?![\uFF61-\uFF9F\uFF00-\uFFEF])[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}\p{Script=Tangut}]){1,1000}/yu,l4=/\t{1,1000}/y,v2=/[\u{1F1E6}-\u{1F1FF}]{2}|\u{1F3F4}[\u{E0061}-\u{E007A}]{2}[\u{E0030}-\u{E0039}\u{E0061}-\u{E007A}]{1,3}\u{E007F}|(?:\p{Emoji}\uFE0F\u20E3?|\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation})(?:\u200D(?:\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation}|\p{Emoji}\uFE0F\u20E3?))*/yu,i4=/(?:[\x20-\x7E\xA0-\xFF](?!\uFE0F)){1,1000}/y,a4=/\p{M}+/gu,n4={limit:1/0,ellipsis:""},c2=($,Z={},J={})=>{let z=Z.limit??1/0,Y=Z.ellipsis??"",Q=Z?.ellipsisWidth??(Y?c2(Y,n4,J).width:0),G=0,W=J.controlWidth??0,X=J.tabWidth??8,K=J.emojiWidth??2,j=2,H=J.regularWidth??1,M=J.wideWidth??2,D=[[i4,H],[d4,0],[u4,W],[l4,X],[v2,K],[m2,M]],q=0,B=0,N=$.length,x=0,m=!1,p=N,F=Math.max(0,z-Q),U=0,P=0,I=0,E=0;$:while(!0){if(P>U||B>=N&&B>q){let S=$.slice(U,P)||$.slice(q,B);x=0;for(let h of S.replaceAll(a4,"")){let T=h.codePointAt(0)||0;if(h2(T))E=2;else if(y2(T))E=M;else E=H;if(I+E>F)p=Math.min(p,Math.max(U,q)+x);if(I+E>z){m=!0;break $}x+=h.length,I+=E}U=P=0}if(B>=N)break $;for(let S=0,h=D.length;S<h;S++){let[T,k]=D[S];if(T.lastIndex=B,T.test($)){if(x=T===m2?g2($.slice(B,T.lastIndex)):T===v2?1:T.lastIndex-B,E=x*k,I+E>F)p=Math.min(p,B+Math.floor((F-I)/k));if(I+E>z){m=!0;break $}I+=E,U=q,P=B,B=q=T.lastIndex;continue $}}B+=1}return{width:m?F:I,index:m?p:N,truncated:m,ellipsed:m&&z>=Q}},p2=c2;var s4={limit:1/0,ellipsis:"",ellipsisWidth:0},o4=($,Z={})=>{return p2($,s4,Z).width},s=o4;var h1="\x1B",a2="›",r4=39,n3="\x07",n2="[",t4="]",s2="m",s3=`${t4}8;;`,d2=new RegExp(`(?:\\${n2}(?<code>\\d+)m|\\${s3}(?<uri>.*)${n3})`,"y"),u2=($)=>{if($>=30&&$<=37)return 39;if($>=90&&$<=97)return 39;if($>=40&&$<=47)return 49;if($>=100&&$<=107)return 49;if($===1||$===2)return 22;if($===3)return 23;if($===4)return 24;if($===7)return 27;if($===8)return 28;if($===9)return 29;if($===0)return 0;return},l2=($)=>`${h1}${n2}${$}${s2}`,i2=($)=>`${h1}${s3}${$}${n3}`,a3=($,Z,J)=>{let z=Z[Symbol.iterator](),Y=!1,Q=!1,G=$.at(-1),W=G===void 0?0:s(G),X=z.next(),K=z.next(),j=0;while(!X.done){let H=X.value,M=s(H);if(W+M<=J)$[$.length-1]+=H;else $.push(H),W=0;if(H===h1||H===a2)Y=!0,Q=Z.startsWith(s3,j+1);if(Y){if(Q){if(H===n3)Y=!1,Q=!1}else if(H===s2)Y=!1}else if(W+=M,W===J&&!K.done)$.push(""),W=0;X=K,K=z.next(),j+=H.length}if(G=$.at(-1),!W&&G!==void 0&&G.length&&$.length>1)$[$.length-2]+=$.pop()},e4=($)=>{let Z=$.split(" "),J=Z.length;while(J){if(s(Z[J-1]))break;J--}if(J===Z.length)return $;return Z.slice(0,J).join(" ")+Z.slice(J).join("")},$8=($,Z,J={})=>{if(J.trim!==!1&&$.trim()==="")return"";let z="",Y,Q,G=$.split(" "),W=[""],X=0;for(let H=0;H<G.length;H++){let M=G[H];if(J.trim!==!1){let q=W.at(-1)??"",B=q.trimStart();if(q.length!==B.length)W[W.length-1]=B,X=s(B)}if(H!==0){if(X>=Z&&(J.wordWrap===!1||J.trim===!1))W.push(""),X=0;if(X||J.trim===!1)W[W.length-1]+=" ",X++}let D=s(M);if(J.hard&&D>Z){let q=Z-X,B=1+Math.floor((D-q-1)/Z);if(Math.floor((D-1)/Z)<B)W.push("");a3(W,M,Z),X=s(W.at(-1)??"");continue}if(X+D>Z&&X&&D){if(J.wordWrap===!1&&X<Z){a3(W,M,Z),X=s(W.at(-1)??"");continue}W.push(""),X=0}if(X+D>Z&&J.wordWrap===!1){a3(W,M,Z),X=s(W.at(-1)??"");continue}W[W.length-1]+=M,X+=D}if(J.trim!==!1)W=W.map((H)=>e4(H));let K=W.join(`
-`),j=!1;for(let H=0;H<K.length;H++){let M=K[H];if(z+=M,!j){if(j=M>="\uD800"&&M<="\uDBFF",j)continue}else j=!1;if(M===h1||M===a2){d2.lastIndex=H+1;let q=d2.exec(K)?.groups;if(q?.code!==void 0){let B=Number.parseFloat(q.code);Y=B===r4?void 0:B}else if(q?.uri!==void 0)Q=q.uri.length===0?void 0:q.uri}if(K[H+1]===`
-`){if(Q)z+=i2("");let D=Y?u2(Y):void 0;if(Y&&D)z+=l2(D)}else if(M===`
-`){if(Y&&u2(Y))z+=l2(Y);if(Q)z+=i2(Q)}}return z},Z8=/\r?\n/;function K0($,Z,J){return String($).normalize().split(Z8).map((z)=>$8(z,Z,J)).join(`
-`)}var a=$9(r3(),1);import{ReadStream as r2}from"node:tty";function n0($,Z,J){if(!J.some((G)=>!G.disabled))return $;let z=$+Z,Y=Math.max(J.length-1,0),Q=z<0?Y:z>Y?0:z;return J[Q]?.disabled?n0(Q,Z<0?-1:1,J):Q}function y1($,Z,J,z){let Y=z.split(`
-`),Q=0,G=$;for(let X of Y){if(G<=X.length)break;G-=X.length+1,Q++}for(Q=Math.max(0,Math.min(Y.length-1,Q+J)),G=Math.min(G,Y[Q].length)+Z;G<0&&Q>0;)Q--,G+=Y[Q].length+1;for(;G>Y[Q].length&&Q<Y.length-1;)G-=Y[Q].length+1,Q++;G=Math.max(0,Math.min(Y[Q].length,G));let W=0;for(let X=0;X<Q;X++)W+=Y[X].length+1;return W+G}var G8=["up","down","left","right","space","enter","cancel"],W8=["January","February","March","April","May","June","July","August","September","October","November","December"],d={actions:new Set(G8),aliases:new Map([["k","up"],["j","down"],["h","left"],["l","right"],["\x03","cancel"],["escape","cancel"]]),messages:{cancel:"Canceled",error:"Something went wrong"},withGuide:!0,accessible:void 0,date:{monthNames:[...W8],messages:{required:"Please enter a valid date",invalidMonth:"There are only 12 months in a year",invalidDay:($,Z)=>`There are only ${$} days in ${Z}`,afterMin:($)=>`Date must be on or after ${$.toISOString().slice(0,10)}`,beforeMax:($)=>`Date must be on or before ${$.toISOString().slice(0,10)}`}}};function X8($){if($!==void 0)return $;if(d.accessible!==void 0)return d.accessible;let Z=process.env.ACCESSIBLE;return Z!==void 0&&Z!==""&&Z!=="0"&&Z!=="false"}function Z$($,Z){if(typeof $=="string")return d.aliases.get($)===Z;for(let J of $)if(J!==void 0&&Z$(J,Z))return!0;return!1}function K8($,Z){if($===Z)return;let J=$.split(`
+`,W.ownership),L=B.path;if(L===void 0){let F={error:l2(X,Y),saveError:l2(B.error,Y)};try{(W.stderr??((P)=>process.stderr.write(P)))(`CLI failure metadata: ${JSON.stringify(F)}
+`)}catch{}}return L===void 0?`${q} failed (${Z}). Details could not be saved to a private diagnostics file.`:`${q} failed (${Z}). Details were written to ${L}`}async function Q1($,Z,J,z=[],Q={}){let G=J$(Z);if(G!==void 0)return G;let X=T6(Z);return y6($,`${$}/unexpected-error`,J,z,{},()=>({text:[...X?[`step: ${X.step}`,`exitCode: ${X.exitCode}`,`signal: ${X.signal}`]:[],...J9(Z,0),...X?[`stderrTail:
+${X.stderrTail}`]:[]].join(`
+`),keep:"head"}),Z,Q)}import{createProcessFence as G5,NativePiAuthSlotError as X5,openNativePiAuthSlot as W5,publishNativeEmptyInit as H5,readNativeEnrollmentMode as U5,releaseNativeMigrationPreflight as Y5,requireNoSupervisedAuthContentSnapshot as q5,runSetup as V5}from"@cortexkit/anthropic-auth-core";import{AsyncLocalStorage as v6}from"node:async_hooks";var BQ=new v6;var z9=Object.freeze({ttlMs:1e4,timeoutMs:15000,retryMs:50,renew:!0});var c0="commonAuthPool";var G8=Object.freeze(["version","accounts",c0]);var A={hide:"\x1B[?25l",show:"\x1B[?25h",up:($=1)=>`\x1B[${$}A`,clearLine:"\x1B[2K",clearScreen:"\x1B[2J",moveTo:($,Z)=>`\x1B[${$};${Z}H`,cyan:"\x1B[36m",green:"\x1B[32m",red:"\x1B[31m",dim:"\x1B[2m",reset:"\x1B[0m"};function U$($){let Z=$.toString(),J=[];for(let z=0;z<Z.length;){let Q=Z[z];if(Q==="\x1B"){let G=Z.slice(z,z+3),X=G[1]==="["||G[1]==="O"?G[2]:void 0;if(X&&"ABCD".includes(X)){let H={A:"up",B:"down",C:"right",D:"left"}[X];if(H)J.push(H);z+=3}else if(z+1===Z.length){if(z===0)J.push("escape-start");z+=1}else if((Z[z+1]==="["||Z[z+1]==="O")&&z+2>=Z.length)break;else z+=1;continue}if(Q==="\r"||Q===`
+`)J.push("enter");else if(Q==="\x03")J.push("escape");else if(Q&&Q>=" ")J.push("char");z+=1}return J}var j9=`${String.fromCharCode(27)}\\[[0-9;]*m`,X8=new RegExp(j9,"g"),W8=new RegExp(`^${j9}`);function M9($){return $.replace(X8,"")}function S0($,Z){if(Z<=0)return"";if(M9($).length<=Z)return $;let J=Z>=3?"...":".".repeat(Z),z=Math.max(0,Z-J.length),Q="",G=0,X=0;while(G<$.length&&X<z){if($[G]==="\x1B"){let W=$.slice(G).match(W8);if(W){Q+=W[0],G+=W[0].length;continue}}Q+=$[G],G+=1,X+=1}return Q.includes("\x1B[")?`${Q}${A.reset}${J}`:Q+J}function d0($){return $.input.isTTY===!0}var H8=50;function U8($){if($==="red")return A.red;if($==="cyan")return A.cyan;return""}async function x1($,Z,J){if(!d0($))throw Error("Interactive select requires a TTY terminal");if(Z.length===0)throw Error("No menu items provided");let{input:z,output:Q,signals:G}=$,X=0,W=null,H=!1,Y=0,q=()=>{let V=Q.columns??80,B=Q.rows??24,L=Y;if(J.clearScreen)Q.write(A.clearScreen+A.moveTo(1,1));else if(L>0)Q.write(A.up(L));let F=0,D=(K)=>{Q.write(`${A.clearLine}${K}
+`),F+=1},P=J.lines??[],R=1+(J.subtitle?3:0)+P.length+(P.length?1:0),f=Math.max(1,Math.min(Z.length,B-R-2-1)),v=Math.max(0,Math.min(X-Math.floor(f/2),Math.max(0,Z.length-f))),N=Z.slice(v,v+f);if(D(`${A.dim}┌  ${A.reset}${S0(J.message,Math.max(1,V-4))}`),J.subtitle)D(`${A.dim}│${A.reset}`),D(`${A.cyan}◆${A.reset}  ${S0(J.subtitle,Math.max(1,V-4))}`),D("");for(let K of P)D(`${A.cyan}│${A.reset}  ${S0(K,Math.max(1,V-4))}`);if(P.length)D(`${A.cyan}│${A.reset}`);for(let K=0;K<N.length;K++){let j=N[K];if(!j)continue;let b=v+K===X,g=U8(j.color),S=g?`${b?"":A.dim}${g}${j.label}${A.reset}`:b?j.label:`${A.dim}${j.label}${A.reset}`;if(j.hint)S+=` ${A.dim}${j.hint}${A.reset}`;S=S0(S,Math.max(1,V-8)),D(b?`${A.cyan}│${A.reset}  ${A.green}●${A.reset} ${S}`:`${A.cyan}│${A.reset}  ${A.dim}○${A.reset} ${S}`)}let U=N.length<Z.length?` (${v+1}-${v+N.length}/${Z.length})`:"";D(`${A.cyan}│${A.reset}  ${A.dim}${S0(`Up/Down to select | Enter: confirm | Esc: back${U}`,Math.max(1,V-6))}${A.reset}`),D(`${A.cyan}└${A.reset}`);for(let K=F;K<L;K++)D("");Y=F};return new Promise((V)=>{let B=z.isRaw??!1,L=()=>{if(H)return;if(H=!0,W)clearTimeout(W);z.removeListener("data",P);try{z.setRawMode(B),z.pause(),Q.write(A.show)}catch{}G?.removeListener("SIGINT",D),G?.removeListener("SIGTERM",D)},F=(R)=>{L(),V(R)},D=()=>F(null),P=(R)=>{for(let f of U$(R)){if(H)break;if(W)clearTimeout(W),W=null;switch(f){case"up":X=(X-1+Z.length)%Z.length,q();break;case"down":X=(X+1)%Z.length,q();break;case"enter":F(Z[X]?.value??null);break;case"escape":F(null);break;case"escape-start":W=setTimeout(()=>F(null),H8);break;default:break}}};G?.once("SIGINT",D),G?.once("SIGTERM",D);try{z.setRawMode(!0)}catch{L(),V(null);return}z.resume(),Q.write(A.hide),q(),z.on("data",P)})}async function v1($,Z,J=!1){if(!d0($))return!1;return await x1($,J?[{label:"Yes",value:!0},{label:"No",value:!1}]:[{label:"No",value:!1},{label:"Yes",value:!0}],{message:Z})??!1}import{execFile as M8}from"node:child_process";import{promisify as F8}from"node:util";var B8=F8(M8),F9={async run($,Z,J={}){try{let z=J.env?{...process.env,...J.env}:process.env,{stdout:Q,stderr:G}=await B8($,Z,{env:z,timeout:J.timeoutMs??15000,maxBuffer:10485760});return{exitCode:0,stdout:typeof Q==="string"?Q:String(Q),stderr:typeof G==="string"?G:String(G)}}catch(z){let Q=z;return{exitCode:typeof Q?.code==="number"?Q.code:1,signal:typeof Q?.signal==="string"?Q.signal:null,...typeof Q?.syscall==="string"&&(Q.syscall==="spawn"||Q.syscall.startsWith("spawn "))?{spawnError:!0}:{},stdout:typeof Q?.stdout==="string"?Q.stdout:Q?.stdout!=null?String(Q.stdout):"",stderr:typeof Q?.stderr==="string"?Q.stderr:Q?.stderr!=null?String(Q.stderr):String(Q?.message??z)}}}};import{styleText as p1}from"node:util";import{stdout as g8,stdin as y8}from"node:process";import x8 from"node:readline";var B9=(()=>{let $=/[\uD800-\uDBFF][\uDC00-\uDFFF]/g;return(Z)=>{let J=0;$.lastIndex=0;while($.test(Z))J+=1;return Z.length-J}})(),D9=($)=>{return $===12288||$>=65281&&$<=65376||$>=65504&&$<=65510},L9=($)=>{return $===8987||$===9001||$>=12272&&$<=12287||$>=12289&&$<=12350||$>=12441&&$<=12543||$>=12549&&$<=12591||$>=12593&&$<=12686||$>=12688&&$<=12771||$>=12783&&$<=12830||$>=12832&&$<=12871||$>=12880&&$<=19903||$>=65040&&$<=65049||$>=65072&&$<=65106||$>=65108&&$<=65126||$>=65128&&$<=65131||$>=127488&&$<=127490||$>=127504&&$<=127547||$>=127552&&$<=127560||$>=131072&&$<=196605||$>=196608&&$<=262141};var D8=/[\u001b\u009b][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]|\u001b\]8;[^;]*;.*?(?:\u0007|\u001b\u005c)/y,L8=/[\x00-\x08\x0A-\x1F\x7F-\x9F]{1,1000}/y,N9=/(?:(?![\uFF61-\uFF9F\uFF00-\uFFEF])[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}\p{Script=Tangut}]){1,1000}/yu,N8=/\t{1,1000}/y,C9=/[\u{1F1E6}-\u{1F1FF}]{2}|\u{1F3F4}[\u{E0061}-\u{E007A}]{2}[\u{E0030}-\u{E0039}\u{E0061}-\u{E007A}]{1,3}\u{E007F}|(?:\p{Emoji}\uFE0F\u20E3?|\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation})(?:\u200D(?:\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation}|\p{Emoji}\uFE0F\u20E3?))*/yu,C8=/(?:[\x20-\x7E\xA0-\xFF](?!\uFE0F)){1,1000}/y,P8=/\p{M}+/gu,O8={limit:1/0,ellipsis:""},P9=($,Z={},J={})=>{let z=Z.limit??1/0,Q=Z.ellipsis??"",G=Z?.ellipsisWidth??(Q?P9(Q,O8,J).width:0),X=0,W=J.controlWidth??0,H=J.tabWidth??8,Y=J.emojiWidth??2,q=2,V=J.regularWidth??1,B=J.wideWidth??2,L=[[C8,V],[D8,0],[L8,W],[N8,H],[C9,Y],[N9,B]],F=0,D=0,P=$.length,R=0,f=!1,v=P,N=Math.max(0,z-G),U=0,K=0,j=0,b=0;$:while(!0){if(K>U||D>=P&&D>F){let g=$.slice(U,K)||$.slice(F,D);R=0;for(let S of g.replaceAll(P8,"")){let m=S.codePointAt(0)||0;if(D9(m))b=2;else if(L9(m))b=B;else b=V;if(j+b>N)v=Math.min(v,Math.max(U,F)+R);if(j+b>z){f=!0;break $}R+=S.length,j+=b}U=K=0}if(D>=P)break $;for(let g=0,S=L.length;g<S;g++){let[m,s]=L[g];if(m.lastIndex=D,m.test($)){if(R=m===N9?B9($.slice(D,m.lastIndex)):m===C9?1:m.lastIndex-D,b=R*s,j+b>N)v=Math.min(v,D+Math.floor((N-j)/s));if(j+b>z){f=!0;break $}j+=b,U=F,K=D,D=F=m.lastIndex;continue $}}D+=1}return{width:f?N:j,index:f?v:P,truncated:f,ellipsed:f&&z>=G}},O9=P9;var I8={limit:1/0,ellipsis:"",ellipsisWidth:0},_8=($,Z={})=>{return O9($,I8,Z).width},Q0=_8;var h1="\x1B",R9="›",A8=39,q$="\x07",S9="[",b8="]",k9="m",V$=`${b8}8;;`,I9=new RegExp(`(?:\\${S9}(?<code>\\d+)m|\\${V$}(?<uri>.*)${q$})`,"y"),_9=($)=>{if($>=30&&$<=37)return 39;if($>=90&&$<=97)return 39;if($>=40&&$<=47)return 49;if($>=100&&$<=107)return 49;if($===1||$===2)return 22;if($===3)return 23;if($===4)return 24;if($===7)return 27;if($===8)return 28;if($===9)return 29;if($===0)return 0;return},A9=($)=>`${h1}${S9}${$}${k9}`,b9=($)=>`${h1}${V$}${$}${q$}`,Y$=($,Z,J)=>{let z=Z[Symbol.iterator](),Q=!1,G=!1,X=$.at(-1),W=X===void 0?0:Q0(X),H=z.next(),Y=z.next(),q=0;while(!H.done){let V=H.value,B=Q0(V);if(W+B<=J)$[$.length-1]+=V;else $.push(V),W=0;if(V===h1||V===R9)Q=!0,G=Z.startsWith(V$,q+1);if(Q){if(G){if(V===q$)Q=!1,G=!1}else if(V===k9)Q=!1}else if(W+=B,W===J&&!Y.done)$.push(""),W=0;H=Y,Y=z.next(),q+=V.length}if(X=$.at(-1),!W&&X!==void 0&&X.length&&$.length>1)$[$.length-2]+=$.pop()},R8=($)=>{let Z=$.split(" "),J=Z.length;while(J){if(Q0(Z[J-1]))break;J--}if(J===Z.length)return $;return Z.slice(0,J).join(" ")+Z.slice(J).join("")},S8=($,Z,J={})=>{if(J.trim!==!1&&$.trim()==="")return"";let z="",Q,G,X=$.split(" "),W=[""],H=0;for(let V=0;V<X.length;V++){let B=X[V];if(J.trim!==!1){let F=W.at(-1)??"",D=F.trimStart();if(F.length!==D.length)W[W.length-1]=D,H=Q0(D)}if(V!==0){if(H>=Z&&(J.wordWrap===!1||J.trim===!1))W.push(""),H=0;if(H||J.trim===!1)W[W.length-1]+=" ",H++}let L=Q0(B);if(J.hard&&L>Z){let F=Z-H,D=1+Math.floor((L-F-1)/Z);if(Math.floor((L-1)/Z)<D)W.push("");Y$(W,B,Z),H=Q0(W.at(-1)??"");continue}if(H+L>Z&&H&&L){if(J.wordWrap===!1&&H<Z){Y$(W,B,Z),H=Q0(W.at(-1)??"");continue}W.push(""),H=0}if(H+L>Z&&J.wordWrap===!1){Y$(W,B,Z),H=Q0(W.at(-1)??"");continue}W[W.length-1]+=B,H+=L}if(J.trim!==!1)W=W.map((V)=>R8(V));let Y=W.join(`
+`),q=!1;for(let V=0;V<Y.length;V++){let B=Y[V];if(z+=B,!q){if(q=B>="\uD800"&&B<="\uDBFF",q)continue}else q=!1;if(B===h1||B===R9){I9.lastIndex=V+1;let F=I9.exec(Y)?.groups;if(F?.code!==void 0){let D=Number.parseFloat(F.code);Q=D===A8?void 0:D}else if(F?.uri!==void 0)G=F.uri.length===0?void 0:F.uri}if(Y[V+1]===`
+`){if(G)z+=b9("");let L=Q?_9(Q):void 0;if(Q&&L)z+=A9(L)}else if(B===`
+`){if(Q&&_9(Q))z+=A9(Q);if(G)z+=b9(G)}}return z},k8=/\r?\n/;function m1($,Z,J){return String($).normalize().split(k8).map((z)=>S8(z,Z,J)).join(`
+`)}var i=g9(j$(),1);function F$($,Z,J){if(!J.some((X)=>!X.disabled))return $;let z=$+Z,Q=Math.max(J.length-1,0),G=z<0?Q:z>Q?0:z;return J[G]?.disabled?F$(G,Z<0?-1:1,J):G}function w1($,Z,J,z){let Q=z.split(`
+`),G=0,X=$;for(let H of Q){if(X<=H.length)break;X-=H.length+1,G++}for(G=Math.max(0,Math.min(Q.length-1,G+J)),X=Math.min(X,Q[G].length)+Z;X<0&&G>0;)G--,X+=Q[G].length+1;for(;X>Q[G].length&&G<Q.length-1;)X-=Q[G].length+1,G++;X=Math.max(0,Math.min(Q[G].length,X));let W=0;for(let H=0;H<G;H++)W+=Q[H].length+1;return W+X}var v8=["up","down","left","right","space","enter","cancel"],h8=["January","February","March","April","May","June","July","August","September","October","November","December"],e={actions:new Set(v8),aliases:new Map([["k","up"],["j","down"],["h","left"],["l","right"],["\x03","cancel"],["escape","cancel"]]),messages:{cancel:"Canceled",error:"Something went wrong"},withGuide:!0,accessible:void 0,date:{monthNames:[...h8],messages:{required:"Please enter a valid date",invalidMonth:"There are only 12 months in a year",invalidDay:($,Z)=>`There are only ${$} days in ${Z}`,afterMin:($)=>`Date must be on or after ${$.toISOString().slice(0,10)}`,beforeMax:($)=>`Date must be on or before ${$.toISOString().slice(0,10)}`}}};function m8($){if($!==void 0)return $;if(e.accessible!==void 0)return e.accessible;let Z=process.env.ACCESSIBLE;return Z!==void 0&&Z!==""&&Z!=="0"&&Z!=="false"}function y9($,Z){if(typeof $=="string")return e.aliases.get($)===Z;for(let J of $)if(J!==void 0&&y9(J,Z))return!0;return!1}function w8($,Z){if($===Z)return;let J=$.split(`
 `),z=Z.split(`
-`),Y=Math.max(J.length,z.length),Q=[];for(let G=0;G<Y;G++)J[G]!==z[G]&&Q.push(G);return{lines:Q,numLinesBefore:J.length,numLinesAfter:z.length,numLines:Y}}var H8=globalThis.process.platform.startsWith("win"),p1=Symbol("clack:cancel");function I0($){return $===p1}function m1($,Z){let J=$;J.isTTY&&J.setRawMode(Z)}function J9({input:$=Z9,output:Z=$$,overwrite:J=!0,hideCursor:z=!0}={}){let Y=O0.createInterface({input:$,output:Z,prompt:"",tabSize:1});O0.emitKeypressEvents($,Y),$ instanceof r2&&$.isTTY&&$.setRawMode(!0);let Q=(G,{name:W,sequence:X})=>{let K=String(G);if(Z$([K,W,X],"cancel")){z&&Z.write(a.cursor.show),process.exit(0);return}if(!J)return;O0.moveCursor(Z,W==="return"?0:-1,W==="return"?-1:0,()=>{O0.clearLine(Z,1,()=>{$.once("keypress",Q)})})};return z&&Z.write(a.cursor.hide),$.once("keypress",Q),()=>{$.off("keypress",Q),z&&Z.write(a.cursor.show),$ instanceof r2&&$.isTTY&&!H8&&$.setRawMode(!1),Y.terminal=!1,Y.close()}}var G1=($)=>("columns"in $)&&typeof $.columns=="number"?$.columns:80,J$=($)=>("rows"in $)&&typeof $.rows=="number"?$.rows:20;function W1($,Z,J,z=J,Y=J,Q){let G=G1($??$$);return K0(Z,G-J.length,{hard:!0,trim:!1}).split(`
-`).map((W,X,K)=>{let j=Q?Q(W,X):W;return X===0?`${z}${j}`:X===K.length-1?`${Y}${j}`:`${J}${j}`}).join(`
-`)}function z9($,Z){if("~standard"in $){let J=$["~standard"].validate(Z);return J instanceof Promise?J.then((z)=>z.issues?.at(0)?.message):J.issues?.at(0)?.message}return $(Z)}class P0{input;output;_abortSignal;rl;opts;_render;_track=!1;_prevFrame="";_subscribers=new Map;_cursor=0;state="initial";error="";value;userInput="";get accessible(){return X8(this.opts.accessible)}constructor($,Z=!0){let{input:J=Z9,output:z=$$,render:Y,signal:Q,...G}=$;this.opts=G,this.onKeypress=this.onKeypress.bind(this),this.close=this.close.bind(this),this.render=this.render.bind(this),this._render=Y.bind(this),this._track=Z,this._abortSignal=Q,this.input=J,this.output=z}unsubscribe(){this._subscribers.clear()}setSubscriber($,Z){let J=this._subscribers.get($)??[];J.push(Z),this._subscribers.set($,J)}on($,Z){this.setSubscriber($,{cb:Z})}once($,Z){this.setSubscriber($,{cb:Z,once:!0})}emit($,...Z){let J=this._subscribers.get($)??[],z=[];for(let Y of J)Y.cb(...Z),Y.once&&z.push(()=>J.splice(J.indexOf(Y),1));for(let Y of z)Y()}prompt(){return new Promise(($)=>{if(this._abortSignal){if(this._abortSignal.aborted)return this.state="cancel",this.close(),$(p1);this._abortSignal.addEventListener("abort",()=>{this.state="cancel",this.close()},{once:!0})}this.rl=Q8.createInterface({input:this.input,tabSize:2,prompt:"",escapeCodeTimeout:50,terminal:!0}),this.rl.prompt(),this.opts.initialUserInput!==void 0&&this._setUserInput(this.opts.initialUserInput,!0),this.input.on("keypress",this.onKeypress),m1(this.input,!0),this.output.on("resize",this.render),this.render(),this.once("submit",()=>{this.output.write(a.cursor.show),this.output.off("resize",this.render),m1(this.input,!1),$(this.value)}),this.once("cancel",()=>{this.output.write(a.cursor.show),this.output.off("resize",this.render),m1(this.input,!1),$(p1)})})}_isActionKey($,Z){return $==="\t"}_shouldSubmit($,Z){return!0}_setValue($){this.value=$,this.emit("value",this.value)}_setUserInput($,Z){this.userInput=$??"",this.emit("userInput",this.userInput),Z&&this._track&&this.rl&&(this.rl.write(this.userInput),this._cursor=this.rl.cursor)}_clearUserInput(){this.rl?.write(null,{ctrl:!0,name:"u"}),this._setUserInput("")}async onKeypress($,Z){if(this.state!=="validating"){if(this._track&&Z.name!=="return"&&(Z.name&&this._isActionKey($,Z)&&this.rl?.write(null,{ctrl:!0,name:"h"}),this._cursor=this.rl?.cursor??0,this._setUserInput(this.rl?.line)),this.state==="error"&&(this.state="active"),Z?.name&&(!this._track&&d.aliases.has(Z.name)&&this.emit("cursor",d.aliases.get(Z.name)),d.actions.has(Z.name)&&this.emit("cursor",Z.name)),$&&($.toLowerCase()==="y"||$.toLowerCase()==="n")&&this.emit("confirm",$.toLowerCase()==="y"),this.emit("key",$,Z),Z?.name==="return"&&this._shouldSubmit($,Z)){if(this.opts.validate){let J=z9(this.opts.validate,this.value),z;J instanceof Promise?(this.state="validating",this.render(),z=await J):z=J,z&&(this.error=z instanceof Error?z.message:z,this.state="error",this.rl?.write(this.userInput))}this.state!=="error"&&(this.state="submit")}Z$([$,Z?.name,Z?.sequence],"cancel")&&(this.state="cancel"),(this.state==="submit"||this.state==="cancel")&&this.emit("finalize"),this.render(),(this.state==="submit"||this.state==="cancel")&&this.close()}}close(){this.input.unpipe(),this.input.removeListener("keypress",this.onKeypress),this.output.write(`
-`),m1(this.input,!1),this.rl?.close(),this.rl=void 0,this.emit(`${this.state}`,this.value),this.unsubscribe()}restoreCursor(){let $=K0(this._prevFrame,process.stdout.columns,{hard:!0,trim:!1}).split(`
-`).length-1;this.output.write(a.cursor.move(-999,$*-1))}render(){let $=K0(this._render(this)??"",process.stdout.columns,{hard:!0,trim:!1});if($!==this._prevFrame){if(this.state==="initial")this.output.write(a.cursor.hide);else{let Z=K8(this._prevFrame,$),J=J$(this.output);if(this.restoreCursor(),Z){let z=Math.max(0,Z.numLinesAfter-J),Y=Math.max(0,Z.numLinesBefore-J),Q=Z.lines.find((G)=>G>=z);if(Q===void 0){this._prevFrame=$;return}if(Z.lines.length===1){this.output.write(a.cursor.move(0,Q-Y)),this.output.write(a.erase.lines(1));let G=$.split(`
-`);this.output.write(G[Q]),this._prevFrame=$,this.output.write(a.cursor.move(0,G.length-Q-1));return}else if(Z.lines.length>1){if(z<Y)Q=z;else{let W=Q-Y;W>0&&this.output.write(a.cursor.move(0,W))}this.output.write(a.erase.down());let G=$.split(`
-`).slice(Q);this.output.write(G.join(`
-`)),this._prevFrame=$;return}}this.output.write(a.erase.down())}this.output.write($),this.state==="initial"&&(this.state="active"),this._prevFrame=$}}}function j8($,Z){if($===void 0||Z.length===0)return 0;let J=Z.findIndex((z)=>z.value===$);return J!==-1?J:0}function U8($,Z){return(Z.label??String(Z.value)).toLowerCase().includes($.toLowerCase())}function q8($,Z){if(Z)return $?Z:Z[0]}var V8=class extends P0{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#$=0;#Z="";#J;#Q;#K;#Y;get cursor(){return this.#$}get userInputWithCursor(){if(!this.userInput)return c1(["inverse","hidden"],"_");if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let Z=this.userInput.slice(0,this.cursor),J=this.userInput.slice(this.cursor,this.cursor+1),z=this.userInput.slice(this.cursor+1);return`${Z}${c1("inverse",J)}${z}`}get options(){return typeof this.#Q=="function"?this.#Q():this.#Q}constructor(Z){super(Z),this.#Q=Z.options,this.#K=Z.placeholder,this.#Y=Z.completeOnTab===!0;let J=this.options;this.filteredOptions=[...J],this.multiple=Z.multiple===!0,this.#J=typeof Z.options=="function"?Z.filter:Z.filter??U8;let z;if(Z.initialValue&&Array.isArray(Z.initialValue)?this.multiple?z=Z.initialValue:z=Z.initialValue.slice(0,1):!this.multiple&&this.options.length>0&&(z=[this.options[0]?.value]),z)for(let Y of z){let Q=J.findIndex((G)=>G.value===Y);Q!==-1&&(this.toggleSelected(Y),this.#$=Q)}this.focusedValue=this.options[this.#$]?.value,this.on("key",(Y,Q)=>this.#z(Y,Q)),this.on("userInput",(Y)=>this.#W(Y))}_isActionKey(Z,J){return Z==="\t"||this.multiple&&this.isNavigating&&J.name==="space"&&Z!==void 0&&Z!==""}#z(Z,J){let z=J.name==="up",Y=J.name==="down",Q=J.name==="return",G=this.userInput===""||this.userInput==="\t",W=this.#K,X=this.options,K=W!==void 0&&W!==""&&X.some((j)=>!j.disabled&&(this.#J?this.#J(W,j):!0));if(J.name==="tab"&&G&&K){this.userInput==="\t"&&this._clearUserInput(),this._setUserInput(W,!0),this.isNavigating=!1;return}if(J.name==="tab"&&this.#Y&&!this.multiple&&this.focusedValue!==void 0){let j=String(this.focusedValue);this._clearUserInput(),this._setUserInput(j,!0),this.isNavigating=!1;return}z||Y?(this.#$=n0(this.#$,z?-1:1,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#$]?.value,this.multiple||(this.selectedValues=[this.focusedValue]),this.isNavigating=!0):Q?this.value=q8(this.multiple,this.selectedValues):this.multiple?this.focusedValue!==void 0&&(J.name==="tab"||this.isNavigating&&J.name==="space")?this.toggleSelected(this.focusedValue):this.isNavigating=!1:(this.focusedValue&&(this.selectedValues=[this.focusedValue]),this.isNavigating=!1)}deselectAll(){this.selectedValues=[]}toggleSelected(Z){this.filteredOptions.length!==0&&(this.multiple?this.selectedValues.includes(Z)?this.selectedValues=this.selectedValues.filter((J)=>J!==Z):this.selectedValues=[...this.selectedValues,Z]:this.selectedValues=[Z])}#W(Z){if(Z!==this.#Z){this.#Z=Z;let J=this.options;Z&&this.#J?this.filteredOptions=J.filter((Q)=>this.#J?.(Z,Q)):this.filteredOptions=[...J];let z=j8(this.focusedValue,this.filteredOptions);this.#$=n0(z,0,this.filteredOptions);let Y=this.filteredOptions[this.#$];Y&&!Y.disabled?this.focusedValue=Y.value:this.focusedValue=void 0,this.multiple||(this.focusedValue!==void 0?this.toggleSelected(this.focusedValue):this.deselectAll())}}};class z$ extends P0{get cursor(){return this.value?0:1}get _value(){return this.cursor===0}constructor($){super($,!1),this.value=!!$.initialValue,this.on("userInput",()=>{this.value=this._value}),this.on("confirm",(Z)=>{this.output.write(a.cursor.move(0,-1)),this.value=Z,this.state="submit",this.close()}),this.on("cursor",()=>{this.value=!this.value})}}var M8={Y:{type:"year",len:4},M:{type:"month",len:2},D:{type:"day",len:2}};function t2($){return[...$].map((Z)=>M8[Z])}function D8($){let Z=new Intl.DateTimeFormat($,{year:"numeric",month:"2-digit",day:"2-digit"}).formatToParts(new Date(2000,0,15)),J=[],z="/";for(let Y of Z)Y.type==="literal"?z=Y.value.trim()||Y.value:(Y.type==="year"||Y.type==="month"||Y.type==="day")&&J.push({type:Y.type,len:Y.type==="year"?4:2});return{segments:J,separator:z}}function t3($){return Number.parseInt(($||"0").replace(/_/g,"0"),10)||0}function v1($){return{year:t3($.year),month:t3($.month),day:t3($.day)}}function e3($,Z){return new Date($||2001,Z||1,0).getDate()}function Y9($){let{year:Z,month:J,day:z}=v1($);if(!Z||Z<0||Z>9999||!J||J<1||J>12||!z||z<1)return;let Y=new Date(Date.UTC(Z,J-1,z));if(!(Y.getUTCFullYear()!==Z||Y.getUTCMonth()!==J-1||Y.getUTCDate()!==z))return{year:Z,month:J,day:z}}function e2($){let Z=Y9($);return Z?new Date(Date.UTC(Z.year,Z.month-1,Z.day)):void 0}function F8($,Z,J,z){let Y=J?{year:J.getUTCFullYear(),month:J.getUTCMonth()+1,day:J.getUTCDate()}:null,Q=z?{year:z.getUTCFullYear(),month:z.getUTCMonth()+1,day:z.getUTCDate()}:null;return $==="year"?{min:Y?.year??1,max:Q?.year??9999}:$==="month"?{min:Y&&Z.year===Y.year?Y.month:1,max:Q&&Z.year===Q.year?Q.month:12}:{min:Y&&Z.year===Y.year&&Z.month===Y.month?Y.day:1,max:Q&&Z.year===Q.year&&Z.month===Q.month?Q.day:e3(Z.year,Z.month)}}class Q9 extends P0{#$;#Z;#J;#Q;#K;#Y={segmentIndex:0,positionInSegment:0};#z=!0;#W=null;inlineError="";get segmentCursor(){return{...this.#Y}}get segmentValues(){return{...this.#J}}get segments(){return this.#$}get separator(){return this.#Z}get formattedValue(){return this.#U(this.#J)}#U($){return this.#$.map((Z)=>$[Z.type]).join(this.#Z)}#X(){this._setUserInput(this.#U(this.#J)),this._setValue(e2(this.#J)??void 0)}constructor($){let Z=$.format?{segments:t2($.format),separator:$.separator??"/"}:D8($.locale),J=$.separator??Z.separator,z=$.format?t2($.format):Z.segments,Y=$.initialValue??$.defaultValue,Q=Y?{year:String(Y.getUTCFullYear()).padStart(4,"0"),month:String(Y.getUTCMonth()+1).padStart(2,"0"),day:String(Y.getUTCDate()).padStart(2,"0")}:{year:"____",month:"__",day:"__"},G=z.map((W)=>Q[W.type]).join(J);super({...$,initialUserInput:G},!1),this.#$=z,this.#Z=J,this.#J=Q,this.#Q=$.minDate,this.#K=$.maxDate,this.#X(),this.on("cursor",(W)=>this.#q(W)),this.on("key",(W,X)=>this.#V(W,X)),this.on("finalize",()=>this.#D($))}#G(){let $=Math.max(0,Math.min(this.#Y.segmentIndex,this.#$.length-1)),Z=this.#$[$];if(Z)return this.#Y.positionInSegment=Math.max(0,Math.min(this.#Y.positionInSegment,Z.len-1)),{segment:Z,index:$}}#H($){this.inlineError="",this.#W=null;let Z=this.#G();Z&&(this.#Y.segmentIndex=Math.max(0,Math.min(this.#$.length-1,Z.index+$)),this.#Y.positionInSegment=0,this.#z=!0)}#j($){let Z=this.#G();if(!Z)return;let{segment:J}=Z,z=this.#J[J.type],Y=!z||z.replace(/_/g,"")==="",Q=Number.parseInt((z||"0").replace(/_/g,"0"),10)||0,G=F8(J.type,v1(this.#J),this.#Q,this.#K),W;Y?W=$===1?G.min:G.max:W=Math.max(Math.min(G.max,Q+$),G.min),this.#J={...this.#J,[J.type]:W.toString().padStart(J.len,"0")},this.#z=!0,this.#W=null,this.#X()}#q($){if($)switch($){case"right":return this.#H(1);case"left":return this.#H(-1);case"up":return this.#j(1);case"down":return this.#j(-1)}}#V($,Z){if(Z?.name==="backspace"||Z?.sequence===""||Z?.sequence==="\b"||$===""||$==="\b"){this.inlineError="";let J=this.#G();if(!J)return;if(!this.#J[J.segment.type].replace(/_/g,"")){this.#H(-1);return}this.#J[J.segment.type]="_".repeat(J.segment.len),this.#z=!0,this.#Y.positionInSegment=0,this.#X();return}if(Z?.name==="tab"){this.inlineError="";let J=this.#G();if(!J)return;let z=Z.shift?-1:1,Y=J.index+z;Y>=0&&Y<this.#$.length&&(this.#Y.segmentIndex=Y,this.#Y.positionInSegment=0,this.#z=!0);return}if($&&/^[0-9]$/.test($)){let J=this.#G();if(!J)return;let{segment:z}=J,Y=!this.#J[z.type].replace(/_/g,"");if(this.#z&&this.#W!==null&&!Y){let M=this.#W+$,D={...this.#J,[z.type]:M},q=this.#M(D,z);if(q){this.inlineError=q,this.#W=null,this.#z=!1;return}this.inlineError="",this.#J[z.type]=M,this.#W=null,this.#z=!1,this.#X(),J.index<this.#$.length-1&&(this.#Y.segmentIndex=J.index+1,this.#Y.positionInSegment=0,this.#z=!0);return}this.#z&&!Y&&(this.#J[z.type]="_".repeat(z.len),this.#Y.positionInSegment=0),this.#z=!1,this.#W=null;let Q=this.#J[z.type],G=Q.indexOf("_"),W=G>=0?G:Math.min(this.#Y.positionInSegment,z.len-1);if(W<0||W>=z.len)return;let X=Q.slice(0,W)+$+Q.slice(W+1),K=!1;if(W===0&&Q==="__"&&(z.type==="month"||z.type==="day")){let M=Number.parseInt($,10);X=`0${$}`,K=M<=(z.type==="month"?1:2)}if(z.type==="year"&&(X=(Q.replace(/_/g,"")+$).padStart(z.len,"_")),!X.includes("_")){let M={...this.#J,[z.type]:X},D=this.#M(M,z);if(D){this.inlineError=D;return}}this.inlineError="",this.#J[z.type]=X;let j=X.includes("_")?void 0:Y9(this.#J);if(j){let{year:M,month:D}=j,q=e3(M,D);this.#J={year:String(Math.max(0,Math.min(9999,M))).padStart(4,"0"),month:String(Math.max(1,Math.min(12,D))).padStart(2,"0"),day:String(Math.max(1,Math.min(q,j.day))).padStart(2,"0")}}this.#X();let H=X.indexOf("_");K?(this.#z=!0,this.#W=$):H>=0?this.#Y.positionInSegment=H:G>=0&&J.index<this.#$.length-1?(this.#Y.segmentIndex=J.index+1,this.#Y.positionInSegment=0,this.#z=!0):this.#Y.positionInSegment=Math.min(W+1,z.len-1)}}#M($,Z){let{month:J,day:z}=v1($);if(Z.type==="month"&&(J<0||J>12))return d.date.messages.invalidMonth;if(Z.type==="day"&&(z<0||z>31))return d.date.messages.invalidDay(31,"any month")}#D($){let{year:Z,month:J,day:z}=v1(this.#J);if(Z&&J&&z){let Y=e3(Z,J);this.#J={...this.#J,day:String(Math.min(z,Y)).padStart(2,"0")}}this.value=e2(this.#J)??$.defaultValue??void 0}}var L8=class extends P0{options;cursor=0;#$;getGroupItems(Z){return this.options.filter((J)=>J.group===Z)}isGroupSelected(Z){let J=this.getGroupItems(Z),z=this.value;return z===void 0?!1:J.every((Y)=>z.includes(Y.value))}toggleValue(){let Z=this.options[this.cursor];if(Z!==void 0)if(this.value===void 0&&(this.value=[]),Z.group===!0){let J=Z.value,z=this.getGroupItems(J);this.isGroupSelected(J)?this.value=this.value.filter((Y)=>z.findIndex((Q)=>Q.value===Y)===-1):this.value=[...this.value,...z.map((Y)=>Y.value)],this.value=Array.from(new Set(this.value))}else{let J=this.value.includes(Z.value);this.value=J?this.value.filter((z)=>z!==Z.value):[...this.value,Z.value]}}constructor(Z){super(Z,!1);let{options:J}=Z;this.#$=Z.selectableGroups!==!1,this.options=Object.entries(J).flatMap(([z,Y])=>[{value:z,group:!0,label:z},...Y.map((Q)=>({...Q,group:z}))]),this.value=[...Z.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:z})=>z===Z.cursorAt),this.#$?0:1),this.on("cursor",(z)=>{switch(z){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let Y=this.options[this.cursor]?.group===!0;!this.#$&&Y&&(this.cursor=this.cursor===0?this.options.length-1:this.cursor-1);break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let Y=this.options[this.cursor]?.group===!0;!this.#$&&Y&&(this.cursor=this.cursor===this.options.length-1?0:this.cursor+1);break}case"space":this.toggleValue();break}})}},B8=new Set(["up","down","left","right"]);class G9 extends P0{#$=!1;#Z;focused="editor";get userInputWithCursor(){if(this.state==="submit")return this.userInput;let $=this.userInput;if(this.cursor>=$.length)return`${$}█`;let Z=$.slice(0,this.cursor),J=$.slice(this.cursor,this.cursor+1),z=$.slice(this.cursor+1);return J===`
+`),Q=Math.max(J.length,z.length),G=[];for(let X=0;X<Q;X++)J[X]!==z[X]&&G.push(X);return{lines:G,numLinesBefore:J.length,numLinesAfter:z.length,numLines:Q}}var WH=globalThis.process.platform.startsWith("win"),d1=Symbol("clack:cancel");function l1($){return $===d1}function u1($,Z){let J=$;J.isTTY&&J.setRawMode(Z)}var x9=($)=>("rows"in $)&&typeof $.rows=="number"?$.rows:20;function v9($,Z){if("~standard"in $){let J=$["~standard"].validate(Z);return J instanceof Promise?J.then((z)=>z.issues?.at(0)?.message):J.issues?.at(0)?.message}return $(Z)}class l0{input;output;_abortSignal;rl;opts;_render;_track=!1;_prevFrame="";_subscribers=new Map;_cursor=0;state="initial";error="";value;userInput="";get accessible(){return m8(this.opts.accessible)}constructor($,Z=!0){let{input:J=y8,output:z=g8,render:Q,signal:G,...X}=$;this.opts=X,this.onKeypress=this.onKeypress.bind(this),this.close=this.close.bind(this),this.render=this.render.bind(this),this._render=Q.bind(this),this._track=Z,this._abortSignal=G,this.input=J,this.output=z}unsubscribe(){this._subscribers.clear()}setSubscriber($,Z){let J=this._subscribers.get($)??[];J.push(Z),this._subscribers.set($,J)}on($,Z){this.setSubscriber($,{cb:Z})}once($,Z){this.setSubscriber($,{cb:Z,once:!0})}emit($,...Z){let J=this._subscribers.get($)??[],z=[];for(let Q of J)Q.cb(...Z),Q.once&&z.push(()=>J.splice(J.indexOf(Q),1));for(let Q of z)Q()}prompt(){return new Promise(($)=>{if(this._abortSignal){if(this._abortSignal.aborted)return this.state="cancel",this.close(),$(d1);this._abortSignal.addEventListener("abort",()=>{this.state="cancel",this.close()},{once:!0})}this.rl=x8.createInterface({input:this.input,tabSize:2,prompt:"",escapeCodeTimeout:50,terminal:!0}),this.rl.prompt(),this.opts.initialUserInput!==void 0&&this._setUserInput(this.opts.initialUserInput,!0),this.input.on("keypress",this.onKeypress),u1(this.input,!0),this.output.on("resize",this.render),this.render(),this.once("submit",()=>{this.output.write(i.cursor.show),this.output.off("resize",this.render),u1(this.input,!1),$(this.value)}),this.once("cancel",()=>{this.output.write(i.cursor.show),this.output.off("resize",this.render),u1(this.input,!1),$(d1)})})}_isActionKey($,Z){return $==="\t"}_shouldSubmit($,Z){return!0}_setValue($){this.value=$,this.emit("value",this.value)}_setUserInput($,Z){this.userInput=$??"",this.emit("userInput",this.userInput),Z&&this._track&&this.rl&&(this.rl.write(this.userInput),this._cursor=this.rl.cursor)}_clearUserInput(){this.rl?.write(null,{ctrl:!0,name:"u"}),this._setUserInput("")}async onKeypress($,Z){if(this.state!=="validating"){if(this._track&&Z.name!=="return"&&(Z.name&&this._isActionKey($,Z)&&this.rl?.write(null,{ctrl:!0,name:"h"}),this._cursor=this.rl?.cursor??0,this._setUserInput(this.rl?.line)),this.state==="error"&&(this.state="active"),Z?.name&&(!this._track&&e.aliases.has(Z.name)&&this.emit("cursor",e.aliases.get(Z.name)),e.actions.has(Z.name)&&this.emit("cursor",Z.name)),$&&($.toLowerCase()==="y"||$.toLowerCase()==="n")&&this.emit("confirm",$.toLowerCase()==="y"),this.emit("key",$,Z),Z?.name==="return"&&this._shouldSubmit($,Z)){if(this.opts.validate){let J=v9(this.opts.validate,this.value),z;J instanceof Promise?(this.state="validating",this.render(),z=await J):z=J,z&&(this.error=z instanceof Error?z.message:z,this.state="error",this.rl?.write(this.userInput))}this.state!=="error"&&(this.state="submit")}y9([$,Z?.name,Z?.sequence],"cancel")&&(this.state="cancel"),(this.state==="submit"||this.state==="cancel")&&this.emit("finalize"),this.render(),(this.state==="submit"||this.state==="cancel")&&this.close()}}close(){this.input.unpipe(),this.input.removeListener("keypress",this.onKeypress),this.output.write(`
+`),u1(this.input,!1),this.rl?.close(),this.rl=void 0,this.emit(`${this.state}`,this.value),this.unsubscribe()}restoreCursor(){let $=m1(this._prevFrame,process.stdout.columns,{hard:!0,trim:!1}).split(`
+`).length-1;this.output.write(i.cursor.move(-999,$*-1))}render(){let $=m1(this._render(this)??"",process.stdout.columns,{hard:!0,trim:!1});if($!==this._prevFrame){if(this.state==="initial")this.output.write(i.cursor.hide);else{let Z=w8(this._prevFrame,$),J=x9(this.output);if(this.restoreCursor(),Z){let z=Math.max(0,Z.numLinesAfter-J),Q=Math.max(0,Z.numLinesBefore-J),G=Z.lines.find((X)=>X>=z);if(G===void 0){this._prevFrame=$;return}if(Z.lines.length===1){this.output.write(i.cursor.move(0,G-Q)),this.output.write(i.erase.lines(1));let X=$.split(`
+`);this.output.write(X[G]),this._prevFrame=$,this.output.write(i.cursor.move(0,X.length-G-1));return}else if(Z.lines.length>1){if(z<Q)G=z;else{let W=G-Q;W>0&&this.output.write(i.cursor.move(0,W))}this.output.write(i.erase.down());let X=$.split(`
+`).slice(G);this.output.write(X.join(`
+`)),this._prevFrame=$;return}}this.output.write(i.erase.down())}this.output.write($),this.state==="initial"&&(this.state="active"),this._prevFrame=$}}}function u8($,Z){if($===void 0||Z.length===0)return 0;let J=Z.findIndex((z)=>z.value===$);return J!==-1?J:0}function c8($,Z){return(Z.label??String(Z.value)).toLowerCase().includes($.toLowerCase())}function p8($,Z){if(Z)return $?Z:Z[0]}var d8=class extends l0{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#$=0;#z="";#Z;#Q;#H;#G;get cursor(){return this.#$}get userInputWithCursor(){if(!this.userInput)return p1(["inverse","hidden"],"_");if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let Z=this.userInput.slice(0,this.cursor),J=this.userInput.slice(this.cursor,this.cursor+1),z=this.userInput.slice(this.cursor+1);return`${Z}${p1("inverse",J)}${z}`}get options(){return typeof this.#Q=="function"?this.#Q():this.#Q}constructor(Z){super(Z),this.#Q=Z.options,this.#H=Z.placeholder,this.#G=Z.completeOnTab===!0;let J=this.options;this.filteredOptions=[...J],this.multiple=Z.multiple===!0,this.#Z=typeof Z.options=="function"?Z.filter:Z.filter??c8;let z;if(Z.initialValue&&Array.isArray(Z.initialValue)?this.multiple?z=Z.initialValue:z=Z.initialValue.slice(0,1):!this.multiple&&this.options.length>0&&(z=[this.options[0]?.value]),z)for(let Q of z){let G=J.findIndex((X)=>X.value===Q);G!==-1&&(this.toggleSelected(Q),this.#$=G)}this.focusedValue=this.options[this.#$]?.value,this.on("key",(Q,G)=>this.#J(Q,G)),this.on("userInput",(Q)=>this.#X(Q))}_isActionKey(Z,J){return Z==="\t"||this.multiple&&this.isNavigating&&J.name==="space"&&Z!==void 0&&Z!==""}#J(Z,J){let z=J.name==="up",Q=J.name==="down",G=J.name==="return",X=this.userInput===""||this.userInput==="\t",W=this.#H,H=this.options,Y=W!==void 0&&W!==""&&H.some((q)=>!q.disabled&&(this.#Z?this.#Z(W,q):!0));if(J.name==="tab"&&X&&Y){this.userInput==="\t"&&this._clearUserInput(),this._setUserInput(W,!0),this.isNavigating=!1;return}if(J.name==="tab"&&this.#G&&!this.multiple&&this.focusedValue!==void 0){let q=String(this.focusedValue);this._clearUserInput(),this._setUserInput(q,!0),this.isNavigating=!1;return}z||Q?(this.#$=F$(this.#$,z?-1:1,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#$]?.value,this.multiple||(this.selectedValues=[this.focusedValue]),this.isNavigating=!0):G?this.value=p8(this.multiple,this.selectedValues):this.multiple?this.focusedValue!==void 0&&(J.name==="tab"||this.isNavigating&&J.name==="space")?this.toggleSelected(this.focusedValue):this.isNavigating=!1:(this.focusedValue&&(this.selectedValues=[this.focusedValue]),this.isNavigating=!1)}deselectAll(){this.selectedValues=[]}toggleSelected(Z){this.filteredOptions.length!==0&&(this.multiple?this.selectedValues.includes(Z)?this.selectedValues=this.selectedValues.filter((J)=>J!==Z):this.selectedValues=[...this.selectedValues,Z]:this.selectedValues=[Z])}#X(Z){if(Z!==this.#z){this.#z=Z;let J=this.options;Z&&this.#Z?this.filteredOptions=J.filter((G)=>this.#Z?.(Z,G)):this.filteredOptions=[...J];let z=u8(this.focusedValue,this.filteredOptions);this.#$=F$(z,0,this.filteredOptions);let Q=this.filteredOptions[this.#$];Q&&!Q.disabled?this.focusedValue=Q.value:this.focusedValue=void 0,this.multiple||(this.focusedValue!==void 0?this.toggleSelected(this.focusedValue):this.deselectAll())}}};var l8={Y:{type:"year",len:4},M:{type:"month",len:2},D:{type:"day",len:2}};function T9($){return[...$].map((Z)=>l8[Z])}function a8($){let Z=new Intl.DateTimeFormat($,{year:"numeric",month:"2-digit",day:"2-digit"}).formatToParts(new Date(2000,0,15)),J=[],z="/";for(let Q of Z)Q.type==="literal"?z=Q.value.trim()||Q.value:(Q.type==="year"||Q.type==="month"||Q.type==="day")&&J.push({type:Q.type,len:Q.type==="year"?4:2});return{segments:J,separator:z}}function M$($){return Number.parseInt(($||"0").replace(/_/g,"0"),10)||0}function c1($){return{year:M$($.year),month:M$($.month),day:M$($.day)}}function B$($,Z){return new Date($||2001,Z||1,0).getDate()}function h9($){let{year:Z,month:J,day:z}=c1($);if(!Z||Z<0||Z>9999||!J||J<1||J>12||!z||z<1)return;let Q=new Date(Date.UTC(Z,J-1,z));if(!(Q.getUTCFullYear()!==Z||Q.getUTCMonth()!==J-1||Q.getUTCDate()!==z))return{year:Z,month:J,day:z}}function f9($){let Z=h9($);return Z?new Date(Date.UTC(Z.year,Z.month-1,Z.day)):void 0}function s8($,Z,J,z){let Q=J?{year:J.getUTCFullYear(),month:J.getUTCMonth()+1,day:J.getUTCDate()}:null,G=z?{year:z.getUTCFullYear(),month:z.getUTCMonth()+1,day:z.getUTCDate()}:null;return $==="year"?{min:Q?.year??1,max:G?.year??9999}:$==="month"?{min:Q&&Z.year===Q.year?Q.month:1,max:G&&Z.year===G.year?G.month:12}:{min:Q&&Z.year===Q.year&&Z.month===Q.month?Q.day:1,max:G&&Z.year===G.year&&Z.month===G.month?G.day:B$(Z.year,Z.month)}}class m9 extends l0{#$;#z;#Z;#Q;#H;#G={segmentIndex:0,positionInSegment:0};#J=!0;#X=null;inlineError="";get segmentCursor(){return{...this.#G}}get segmentValues(){return{...this.#Z}}get segments(){return this.#$}get separator(){return this.#z}get formattedValue(){return this.#Y(this.#Z)}#Y($){return this.#$.map((Z)=>$[Z.type]).join(this.#z)}#U(){this._setUserInput(this.#Y(this.#Z)),this._setValue(f9(this.#Z)??void 0)}constructor($){let Z=$.format?{segments:T9($.format),separator:$.separator??"/"}:a8($.locale),J=$.separator??Z.separator,z=$.format?T9($.format):Z.segments,Q=$.initialValue??$.defaultValue,G=Q?{year:String(Q.getUTCFullYear()).padStart(4,"0"),month:String(Q.getUTCMonth()+1).padStart(2,"0"),day:String(Q.getUTCDate()).padStart(2,"0")}:{year:"____",month:"__",day:"__"},X=z.map((W)=>G[W.type]).join(J);super({...$,initialUserInput:X},!1),this.#$=z,this.#z=J,this.#Z=G,this.#Q=$.minDate,this.#H=$.maxDate,this.#U(),this.on("cursor",(W)=>this.#K(W)),this.on("key",(W,H)=>this.#V(W,H)),this.on("finalize",()=>this.#F($))}#W(){let $=Math.max(0,Math.min(this.#G.segmentIndex,this.#$.length-1)),Z=this.#$[$];if(Z)return this.#G.positionInSegment=Math.max(0,Math.min(this.#G.positionInSegment,Z.len-1)),{segment:Z,index:$}}#M($){this.inlineError="",this.#X=null;let Z=this.#W();Z&&(this.#G.segmentIndex=Math.max(0,Math.min(this.#$.length-1,Z.index+$)),this.#G.positionInSegment=0,this.#J=!0)}#j($){let Z=this.#W();if(!Z)return;let{segment:J}=Z,z=this.#Z[J.type],Q=!z||z.replace(/_/g,"")==="",G=Number.parseInt((z||"0").replace(/_/g,"0"),10)||0,X=s8(J.type,c1(this.#Z),this.#Q,this.#H),W;Q?W=$===1?X.min:X.max:W=Math.max(Math.min(X.max,G+$),X.min),this.#Z={...this.#Z,[J.type]:W.toString().padStart(J.len,"0")},this.#J=!0,this.#X=null,this.#U()}#K($){if($)switch($){case"right":return this.#M(1);case"left":return this.#M(-1);case"up":return this.#j(1);case"down":return this.#j(-1)}}#V($,Z){if(Z?.name==="backspace"||Z?.sequence===""||Z?.sequence==="\b"||$===""||$==="\b"){this.inlineError="";let J=this.#W();if(!J)return;if(!this.#Z[J.segment.type].replace(/_/g,"")){this.#M(-1);return}this.#Z[J.segment.type]="_".repeat(J.segment.len),this.#J=!0,this.#G.positionInSegment=0,this.#U();return}if(Z?.name==="tab"){this.inlineError="";let J=this.#W();if(!J)return;let z=Z.shift?-1:1,Q=J.index+z;Q>=0&&Q<this.#$.length&&(this.#G.segmentIndex=Q,this.#G.positionInSegment=0,this.#J=!0);return}if($&&/^[0-9]$/.test($)){let J=this.#W();if(!J)return;let{segment:z}=J,Q=!this.#Z[z.type].replace(/_/g,"");if(this.#J&&this.#X!==null&&!Q){let B=this.#X+$,L={...this.#Z,[z.type]:B},F=this.#q(L,z);if(F){this.inlineError=F,this.#X=null,this.#J=!1;return}this.inlineError="",this.#Z[z.type]=B,this.#X=null,this.#J=!1,this.#U(),J.index<this.#$.length-1&&(this.#G.segmentIndex=J.index+1,this.#G.positionInSegment=0,this.#J=!0);return}this.#J&&!Q&&(this.#Z[z.type]="_".repeat(z.len),this.#G.positionInSegment=0),this.#J=!1,this.#X=null;let G=this.#Z[z.type],X=G.indexOf("_"),W=X>=0?X:Math.min(this.#G.positionInSegment,z.len-1);if(W<0||W>=z.len)return;let H=G.slice(0,W)+$+G.slice(W+1),Y=!1;if(W===0&&G==="__"&&(z.type==="month"||z.type==="day")){let B=Number.parseInt($,10);H=`0${$}`,Y=B<=(z.type==="month"?1:2)}if(z.type==="year"&&(H=(G.replace(/_/g,"")+$).padStart(z.len,"_")),!H.includes("_")){let B={...this.#Z,[z.type]:H},L=this.#q(B,z);if(L){this.inlineError=L;return}}this.inlineError="",this.#Z[z.type]=H;let q=H.includes("_")?void 0:h9(this.#Z);if(q){let{year:B,month:L}=q,F=B$(B,L);this.#Z={year:String(Math.max(0,Math.min(9999,B))).padStart(4,"0"),month:String(Math.max(1,Math.min(12,L))).padStart(2,"0"),day:String(Math.max(1,Math.min(F,q.day))).padStart(2,"0")}}this.#U();let V=H.indexOf("_");Y?(this.#J=!0,this.#X=$):V>=0?this.#G.positionInSegment=V:X>=0&&J.index<this.#$.length-1?(this.#G.segmentIndex=J.index+1,this.#G.positionInSegment=0,this.#J=!0):this.#G.positionInSegment=Math.min(W+1,z.len-1)}}#q($,Z){let{month:J,day:z}=c1($);if(Z.type==="month"&&(J<0||J>12))return e.date.messages.invalidMonth;if(Z.type==="day"&&(z<0||z>31))return e.date.messages.invalidDay(31,"any month")}#F($){let{year:Z,month:J,day:z}=c1(this.#Z);if(Z&&J&&z){let Q=B$(Z,J);this.#Z={...this.#Z,day:String(Math.min(z,Q)).padStart(2,"0")}}this.value=f9(this.#Z)??$.defaultValue??void 0}}var n8=class extends l0{options;cursor=0;#$;getGroupItems(Z){return this.options.filter((J)=>J.group===Z)}isGroupSelected(Z){let J=this.getGroupItems(Z),z=this.value;return z===void 0?!1:J.every((Q)=>z.includes(Q.value))}toggleValue(){let Z=this.options[this.cursor];if(Z!==void 0)if(this.value===void 0&&(this.value=[]),Z.group===!0){let J=Z.value,z=this.getGroupItems(J);this.isGroupSelected(J)?this.value=this.value.filter((Q)=>z.findIndex((G)=>G.value===Q)===-1):this.value=[...this.value,...z.map((Q)=>Q.value)],this.value=Array.from(new Set(this.value))}else{let J=this.value.includes(Z.value);this.value=J?this.value.filter((z)=>z!==Z.value):[...this.value,Z.value]}}constructor(Z){super(Z,!1);let{options:J}=Z;this.#$=Z.selectableGroups!==!1,this.options=Object.entries(J).flatMap(([z,Q])=>[{value:z,group:!0,label:z},...Q.map((G)=>({...G,group:z}))]),this.value=[...Z.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:z})=>z===Z.cursorAt),this.#$?0:1),this.on("cursor",(z)=>{switch(z){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let Q=this.options[this.cursor]?.group===!0;!this.#$&&Q&&(this.cursor=this.cursor===0?this.options.length-1:this.cursor-1);break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let Q=this.options[this.cursor]?.group===!0;!this.#$&&Q&&(this.cursor=this.cursor===this.options.length-1?0:this.cursor+1);break}case"space":this.toggleValue();break}})}},i8=new Set(["up","down","left","right"]);class w9 extends l0{#$=!1;#z;focused="editor";get userInputWithCursor(){if(this.state==="submit")return this.userInput;let $=this.userInput;if(this.cursor>=$.length)return`${$}█`;let Z=$.slice(0,this.cursor),J=$.slice(this.cursor,this.cursor+1),z=$.slice(this.cursor+1);return J===`
 `?`${Z}█
-${z}`:`${Z}${c1("inverse",J)}${z}`}get cursor(){return this._cursor}#J($){if(this.userInput.length===0){this._setUserInput($);return}this._setUserInput(this.userInput.slice(0,this.cursor)+$+this.userInput.slice(this.cursor))}#Q($){let Z=this.value??"";switch($){case"up":this._cursor=y1(this._cursor,0,-1,Z);return;case"down":this._cursor=y1(this._cursor,0,1,Z);return;case"left":this._cursor=y1(this._cursor,-1,0,Z);return;case"right":this._cursor=y1(this._cursor,1,0,Z);return}}_shouldSubmit($,Z){if(this.#Z)return this.focused==="submit"?!0:(this.#J(`
+${z}`:`${Z}${p1("inverse",J)}${z}`}get cursor(){return this._cursor}#Z($){if(this.userInput.length===0){this._setUserInput($);return}this._setUserInput(this.userInput.slice(0,this.cursor)+$+this.userInput.slice(this.cursor))}#Q($){let Z=this.value??"";switch($){case"up":this._cursor=w1(this._cursor,0,-1,Z);return;case"down":this._cursor=w1(this._cursor,0,1,Z);return;case"left":this._cursor=w1(this._cursor,-1,0,Z);return;case"right":this._cursor=w1(this._cursor,1,0,Z);return}}_shouldSubmit($,Z){if(this.#z)return this.focused==="submit"?!0:(this.#Z(`
 `),this._cursor++,!1);let J=this.#$;return this.#$=!0,J&&this.cursor===this.userInput.length?(this.userInput[this.cursor-1]===`
-`&&(this._setUserInput(this.userInput.slice(0,this.cursor-1)+this.userInput.slice(this.cursor)),this._cursor--),!0):(this.#J(`
-`),this._cursor++,!1)}constructor($){let Z=$.initialUserInput??$.initialValue;super({...$,initialUserInput:Z},!1),Z!==void 0&&(this._cursor=Z.length),this.#Z=$.showSubmit??!1,this.on("key",(J,z)=>{if(z?.name&&B8.has(z.name)){this.#$=!1,this.#Q(z.name);return}if(J==="\t"&&this.#Z){this.focused=this.focused==="editor"?"submit":"editor";return}if(z?.name!=="return"){if(this.#$=!1,z?.name==="backspace"&&this.cursor>0){this._setUserInput(this.userInput.slice(0,this.cursor-1)+this.userInput.slice(this.cursor)),this._cursor--;return}if(z?.name==="delete"&&this.cursor<this.userInput.length){this._setUserInput(this.userInput.slice(0,this.cursor)+this.userInput.slice(this.cursor+1));return}J&&(this.#Z&&this.focused==="submit"&&(this.focused="editor"),this.#J(J??""),this._cursor++)}}),this.on("userInput",(J)=>{this._setValue(J)}),this.on("finalize",()=>{this.value||(this.value=$.defaultValue),this.value===void 0&&(this.value="")})}}class Y$ extends P0{options;cursor=0;get _value(){return this.options[this.cursor]?.value}get _enabledOptions(){return this.options.filter(($)=>$.disabled!==!0)}toggleAll(){let $=this._enabledOptions,Z=this.value!==void 0&&this.value.length===$.length;this.value=Z?[]:$.map((J)=>J.value)}toggleInvert(){let $=this.value;if(!$)return;let Z=this._enabledOptions.filter((J)=>!$.includes(J.value));this.value=Z.map((J)=>J.value)}toggleValue(){this.value===void 0&&(this.value=[]);let $=this.value.includes(this._value);this.value=$?this.value.filter((Z)=>Z!==this._value):[...this.value,this._value]}constructor($){super($,!1),this.options=$.options,this.value=[...$.initialValues??[]];let Z=Math.max(this.options.findIndex(({value:J})=>J===$.cursorAt),0);this.cursor=this.options[Z]?.disabled?n0(Z,1,this.options):Z,this.on("key",(J,z)=>{z.name==="a"&&this.toggleAll(),z.name==="i"&&this.toggleInvert()}),this.on("cursor",(J)=>{switch(J){case"left":case"up":this.cursor=n0(this.cursor,-1,this.options);break;case"down":case"right":this.cursor=n0(this.cursor,1,this.options);break;case"space":this.toggleValue();break}})}}class Q$ extends P0{get userInputWithCursor(){if(this.state==="submit")return this.userInput;let $=this.userInput;if(this.cursor>=$.length)return`${this.userInput}█`;let Z=$.slice(0,this.cursor),J=$.slice(this.cursor,this.cursor+1),z=$.slice(this.cursor+1);return`${Z}${c1("inverse",J)}${z}`}get cursor(){return this._cursor}constructor($){super({...$,initialUserInput:$.initialUserInput??$.initialValue}),this.on("userInput",(Z)=>{this._setValue(Z)}),this.on("finalize",()=>{this.value||(this.value=$.defaultValue),this.value===void 0&&(this.value="")})}}import{styleText as V,stripVTControlCharacters as vJ}from"node:util";import J0 from"node:process";var K1=$9(r3(),1);function N8(){if(J0.platform!=="win32")return J0.env.TERM!=="linux";return Boolean(J0.env.CI)||Boolean(J0.env.WT_SESSION)||Boolean(J0.env.TERMINUS_SUBLIME)||J0.env.ConEmuTask==="{cmd::Cmder}"||J0.env.TERM_PROGRAM==="Terminus-Sublime"||J0.env.TERM_PROGRAM==="vscode"||J0.env.TERM==="xterm-256color"||J0.env.TERM==="alacritty"||J0.env.TERMINAL_EMULATOR==="JetBrains-JediTerm"}var G$=N8(),O8=()=>process.env.CI==="true";var g=($,Z)=>G$?$:Z,W9=g("◆","*"),M9=g("■","x"),D9=g("▲","x"),d1=g("◇","o"),I8=g("┌","T"),f=g("│","|"),C0=g("└","—"),uJ=g("┐","T"),lJ=g("┘","—"),X9=g("●",">"),K9=g("○"," "),P8=g("◻","[•]"),H9=g("◼","[+]"),j9=g("◻","[ ]"),iJ=g("▪","•"),U9=g("─","-"),C8=g("╮","+"),R8=g("├","+"),b8=g("╯","+"),A8=g("╰","+"),aJ=g("╭","+"),k8=g("●","•"),_8=g("◆","*"),f8=g("▲","!"),E8=g("■","x"),W$=($)=>{switch($){case"initial":case"active":return V("cyan",W9);case"cancel":return V("red",M9);case"error":return V("yellow",D9);case"submit":return V("green",d1);case"validating":return V("dim",W9)}},S8=($)=>{switch($){case"initial":case"active":return V("cyan",f);case"cancel":return V("red",f);case"error":return V("yellow",f);case"submit":return V("green",f)}};function x8($,Z){let J=[`${Z?`${V("cyan",f)}  `:""}${$.join(" • ")}`];return Z&&J.push(V("cyan",C0)),J}var q9=($,Z,J,z,Y,Q=!1)=>{let G=Z,W=0;if(Q)for(let X=z-1;X>=J;X--){let K=$[X];if(K&&(G-=K.length),W++,G<=Y)break}else for(let X=J;X<z;X++){let K=$[X];if(K&&(G-=K.length),W++,G<=Y)break}return{lineCount:G,removals:W}},V9=({cursor:$,options:Z,style:J,output:z=process.stdout,maxItems:Y=Number.POSITIVE_INFINITY,columnPadding:Q=0,rowPadding:G=4})=>{let W=G1(z)-Q,X=J$(z),K=V("dim","..."),j=Math.max(X-G,0),H=Math.max(Math.min(Y,j),5),M=0;$>=H-3&&(M=Math.max(Math.min($-H+3,Z.length-H),0));let D=H<Z.length&&M>0,q=H<Z.length&&M+H<Z.length,B=Math.min(M+H,Z.length),N=[],x=0;D&&x++,q&&x++;let m=M+(D?1:0),p=B-(q?1:0);for(let U=m;U<p;U++){let P=Z[U],I=P?J(P,U===$):"",E=K0(I,W,{hard:!0,trim:!1}).split(`
-`);N.push(E),x+=E.length}if(x>j){let U=0,P=0,I=x,E=$-m,S=j,h=()=>q9(N,I,0,E,S),T=()=>q9(N,I,E+1,N.length,S,!0);D?({lineCount:I,removals:U}=h(),I>S&&(q||(S-=1),{lineCount:I,removals:P}=T())):(q||(S-=1),{lineCount:I,removals:P}=T(),I>S&&(S-=1,{lineCount:I,removals:U}=h())),U>0&&(D=!0,N.splice(0,U)),P>0&&(q=!0,N.splice(N.length-P,P))}let F=[];D&&F.push(K);for(let U of N)for(let P of U)F.push(P);return q&&F.push(K),F};var X$=($)=>{let Z=$.active??"Yes",J=$.inactive??"No";return new z$({active:Z,inactive:J,signal:$.signal,input:$.input,output:$.output,initialValue:$.initialValue??!0,render(){let z=$.withGuide??d.withGuide,Y=`${W$(this.state)}  `,Q=z?`${V("gray",f)}  `:"",G=W1($.output,$.message,Q,Y),W=`${z?`${V("gray",f)}
-`:""}${G}
-`,X=this.value?Z:J;switch(this.state){case"submit":{let K=z?`${V("gray",f)}  `:"";return`${W}${K}${V("dim",X)}`}case"cancel":{let K=z?`${V("gray",f)}  `:"";return`${W}${K}${V(["strikethrough","dim"],X)}${z?`
-${V("gray",f)}`:""}`}default:{let K=z?`${V("cyan",f)}  `:"",j=z?V("cyan",C0):"";return`${W}${K}${this.value?`${V("green",X9)} ${Z}`:`${V("dim",K9)} ${V("dim",Z)}`}${$.vertical?z?`
-${V("cyan",f)}  `:`
-`:` ${V("dim","/")} `}${this.value?`${V("dim",K9)} ${V("dim",J)}`:`${V("green",X9)} ${J}`}
-${j}
-`}}}}).prompt()};var w8=[`${V("dim","↑/↓")} to navigate`,`${V("dim","Space:")} select`,`${V("dim","Enter:")} confirm`],X1=($,Z)=>$.split(`
-`).map((J)=>Z(J)).join(`
-`),F9=($)=>{let Z=(Y,Q)=>{let G=Y.label??String(Y.value);return Q==="disabled"?`${V("gray",j9)} ${X1(G,(W)=>V(["strikethrough","gray"],W))}${Y.hint?` ${V("dim",`(${Y.hint??"disabled"})`)}`:""}`:Q==="active"?`${V("cyan",P8)} ${G}${Y.hint?` ${V("dim",`(${Y.hint})`)}`:""}`:Q==="selected"?`${V("green",H9)} ${X1(G,(W)=>V("dim",W))}${Y.hint?` ${V("dim",`(${Y.hint})`)}`:""}`:Q==="cancelled"?`${X1(G,(W)=>V(["strikethrough","dim"],W))}`:Q==="active-selected"?`${V("green",H9)} ${G}${Y.hint?` ${V("dim",`(${Y.hint})`)}`:""}`:Q==="submitted"?`${X1(G,(W)=>V("dim",W))}`:`${V("dim",j9)} ${X1(G,(W)=>V("dim",W))}`},J=$.required??!0,z=$.showInstructions??!0;return new Y$({options:$.options,signal:$.signal,input:$.input,output:$.output,initialValues:$.initialValues,required:J,cursorAt:$.cursorAt,validate(Y){if(J&&(Y===void 0||Y.length===0))return`Please select at least one option.
-${V("reset",V("dim",`Press ${V(["gray","bgWhite","inverse"]," space ")} to select, ${V("gray",V("bgWhite",V("inverse"," enter ")))} to submit`))}`},render(){let Y=$.withGuide??d.withGuide,Q=W1($.output,$.message,Y?`${S8(this.state)}  `:"",`${W$(this.state)}  `),G=`${Y?`${V("gray",f)}
-`:""}${Q}
-`,W=this.value??[],X=(K,j)=>{if(K.disabled)return Z(K,"disabled");let H=W.includes(K.value);return j&&H?Z(K,"active-selected"):H?Z(K,"selected"):Z(K,j?"active":"inactive")};switch(this.state){case"submit":{let K=this.options.filter(({value:H})=>W.includes(H)).map((H)=>Z(H,"submitted")).join(V("dim",", "))||V("dim","none"),j=W1($.output,K,Y?`${V("gray",f)}  `:"");return`${G}${j}`}case"cancel":{let K=this.options.filter(({value:H})=>W.includes(H)).map((H)=>Z(H,"cancelled")).join(V("dim",", "));if(K.trim()==="")return`${G}${V("gray",f)}`;let j=W1($.output,K,Y?`${V("gray",f)}  `:"");return`${G}${j}${Y?`
-${V("gray",f)}`:""}`}case"error":{let K=Y?`${V("yellow",f)}  `:"",j=this.error.split(`
-`).map((D,q)=>q===0?`${Y?`${V("yellow",C0)}  `:""}${V("yellow",D)}`:`   ${D}`).join(`
-`),H=G.split(`
-`).length,M=j.split(`
-`).length+1;return`${G}${K}${V9({output:$.output,options:this.options,cursor:this.cursor,maxItems:$.maxItems,columnPadding:K.length,rowPadding:H+M,style:X}).join(`
-${K}`)}
-${j}
-`}default:{let K=Y?`${V("cyan",f)}  `:"",j=G.split(`
-`).length,H=z?x8(w8,Y):Y?[V("cyan",C0)]:[],M=H.join(`
-`),D=H.length+1;return`${G}${K}${V9({output:$.output,options:this.options,cursor:this.cursor,maxItems:$.maxItems,columnPadding:K.length,rowPadding:j+D,style:X}).join(`
-${K}`)}
-${M}
-`}}}}).prompt()};var y={message:($=[],{symbol:Z=V("gray",f),secondarySymbol:J=V("gray",f),output:z=process.stdout,spacing:Y=1,withGuide:Q}={})=>{let G=[],W=Q??d.withGuide,X=W?J:"",K=W?`${Z}  `:"",j=W?`${J}  `:"";for(let M=0;M<Y;M++)G.push(X);let H=Array.isArray($)?$:$.split(`
-`);if(H.length>0){let[M,...D]=H;M.length>0?G.push(`${K}${M}`):G.push(W?Z:"");for(let q of D)q.length>0?G.push(`${j}${q}`):G.push(W?J:"")}z.write(`${G.join(`
-`)}
-`)},info:($,Z)=>{y.message($,{...Z,symbol:V("blue",k8)})},success:($,Z)=>{y.message($,{...Z,symbol:V("green",_8)})},step:($,Z)=>{y.message($,{...Z,symbol:V("green",d1)})},warn:($,Z)=>{y.message($,{...Z,symbol:V("yellow",f8)})},warning:($,Z)=>{y.warn($,Z)},error:($,Z)=>{y.message($,{...Z,symbol:V("red",E8)})}};var L9=($="",Z)=>{let J=Z?.output??process.stdout,z=Z?.withGuide??d.withGuide?`${V("gray",I8)}  `:"";J.write(`${z}${$}
-`)},H0=($="",Z)=>{let J=Z?.output??process.stdout,z=Z?.withGuide??d.withGuide?`${V("gray",f)}
-${V("gray",C0)}  `:"";J.write(`${z}${$}
-
-`)};var T8=($)=>$,g8=($,Z,J)=>{let z={hard:!0,trim:!1},Y=K0($,Z,z).split(`
-`),Q=Y.reduce((X,K)=>Math.max(s(K),X),0),G=Y.map(J).reduce((X,K)=>Math.max(s(K),X),0),W=Z-(G-Q);return K0($,W,z)},u1=($="",Z="",J)=>{let z=J?.output??J0.stdout,Y=J?.withGuide??d.withGuide,Q=J?.format??T8,G=["",...g8($,G1(z)-6,Q).split(`
-`).map(Q),""],W=s(Z),X=Math.max(G.reduce((M,D)=>{let q=s(D);return q>M?q:M},0),W)+2,K=G.map((M)=>`${V("gray",f)}  ${M}${" ".repeat(X-s(M))}${V("gray",f)}`).join(`
-`),j=Y?`${V("gray",f)}
-`:"",H=Y?R8:A8;z.write(`${j}${V("green",d1)}  ${V("reset",Z)} ${V("gray",U9.repeat(Math.max(X-W-1,1))+C8)}
-${K}
-${V("gray",H+U9.repeat(X+2)+b8)}
-`)};var h8=($)=>V("magenta",$),B9=({indicator:$="dots",onCancel:Z,output:J=process.stdout,cancelMessage:z,errorMessage:Y,frames:Q=G$?["◒","◐","◓","◑"]:["•","o","O","0"],delay:G=G$?80:120,signal:W,...X}={})=>{let K=O8(),j,H,M=!1,D=!1,q="",B,N=performance.now(),x=G1(J),m=X?.styleFrame??h8,p=(b)=>{let c=b>1?Y??d.messages.error:z??d.messages.cancel;D=b===1,M&&(_(c,b),D&&typeof Z=="function"&&Z())},F=()=>p(2),U=()=>p(1),P=()=>{process.on("uncaughtExceptionMonitor",F),process.on("unhandledRejection",F),process.on("SIGINT",U),process.on("SIGTERM",U),process.on("exit",p),W&&W.addEventListener("abort",U)},I=()=>{process.removeListener("uncaughtExceptionMonitor",F),process.removeListener("unhandledRejection",F),process.removeListener("SIGINT",U),process.removeListener("SIGTERM",U),process.removeListener("exit",p),W&&W.removeEventListener("abort",U)},E=()=>{if(B===void 0)return;K&&J.write(`
-`);let b=K0(B,x,{hard:!0,trim:!1}).split(`
-`);b.length>1&&J.write(K1.cursor.up(b.length-1)),J.write(K1.cursor.to(0)),J.write(K1.erase.down())},S=(b)=>b.replace(/\.+$/,""),h=(b)=>{let c=(performance.now()-b)/1000,o=Math.floor(c/60),i=Math.floor(c%60);return o>0?`[${o}m ${i}s]`:`[${i}s]`},T=X.withGuide??d.withGuide,k=(b="")=>{M=!0,j=J9({output:J}),q=S(b),N=performance.now(),T&&J.write(`${V("gray",f)}
-`);let c=0,o=0;P(),H=setInterval(()=>{if(K&&q===B)return;E(),B=q;let i=m(Q[c]),j0;if(K)j0=`${i}  ${q}...`;else if($==="timer")j0=`${i}  ${q} ${h(N)}`;else{let z0=".".repeat(Math.floor(o)).slice(0,3);j0=`${i}  ${q}${z0}`}let w=K0(j0,x,{hard:!0,trim:!1});J.write(w),c=c+1<Q.length?c+1:0,o=o<4?o+0.125:0},G)},_=(b="",c=0,o=!1)=>{if(!M)return;M=!1,clearInterval(H),E();let i=c===0?V("green",d1):c===1?V("red",M9):V("red",D9);q=b??q,o||($==="timer"?J.write(`${i}  ${q} ${h(N)}
-`):J.write(`${i}  ${q}
-`)),I(),j()};return{start:k,stop:(b="")=>_(b,0),message:(b="")=>{q=S(b??q)},cancel:(b="")=>_(b,1),error:(b="")=>_(b,2),clear:()=>_("",0,!0),get isCancelled(){return D}}},nJ={light:g("─","-"),heavy:g("━","="),block:g("█","#")};var sJ=[`${V("dim","↑/↓")} to navigate`,`${V("dim","Enter:")} confirm`];var oJ=`${V("gray",f)}  `;var N9=($)=>new Q$({validate:$.validate,placeholder:$.placeholder,defaultValue:$.defaultValue,initialValue:$.initialValue,output:$.output,signal:$.signal,input:$.input,render(){let Z=$?.withGuide??d.withGuide,J=`${`${Z?`${V("gray",f)}
-`:""}${W$(this.state)}  `}${$.message}
-`,z=$.placeholder&&$.placeholder.length>0?V("inverse",$.placeholder[0])+V("dim",$.placeholder.slice(1)):V(["inverse","hidden"],"_"),Y=this.userInput?this.userInputWithCursor:z,Q=this.value??"";switch(this.state){case"validating":{let G=Z?`${V("cyan",f)}  `:"",W=Z?V("cyan",C0):"",X=V("dim",Y),K=V("dim","Validating...");return`${J}${G}${X}
-${W}  ${K}
-`}case"error":{let G=this.error?`  ${V("yellow",this.error)}`:"",W=Z?`${V("yellow",f)}  `:"",X=Z?V("yellow",C0):"";return`${J.trim()}
-${W}${Y}
-${X}${G}
-`}case"submit":{let G=Q?`${Z?"  ":""}${V("dim",Q)}`:"",W=Z?V("gray",f):"";return`${J}${W}${G}`}case"cancel":{let G=Q?`  ${V(["strikethrough","dim"],Q)}`:"",W=Z?V("gray",f):"";return`${J}${W}${G}${Q.trim()?`
-${W}`:""}`}default:{let G=Z?`${V("cyan",f)}  `:"",W=Z?V("cyan",C0):"";return`${J}${G}${Y}
+`&&(this._setUserInput(this.userInput.slice(0,this.cursor-1)+this.userInput.slice(this.cursor)),this._cursor--),!0):(this.#Z(`
+`),this._cursor++,!1)}constructor($){let Z=$.initialUserInput??$.initialValue;super({...$,initialUserInput:Z},!1),Z!==void 0&&(this._cursor=Z.length),this.#z=$.showSubmit??!1,this.on("key",(J,z)=>{if(z?.name&&i8.has(z.name)){this.#$=!1,this.#Q(z.name);return}if(J==="\t"&&this.#z){this.focused=this.focused==="editor"?"submit":"editor";return}if(z?.name!=="return"){if(this.#$=!1,z?.name==="backspace"&&this.cursor>0){this._setUserInput(this.userInput.slice(0,this.cursor-1)+this.userInput.slice(this.cursor)),this._cursor--;return}if(z?.name==="delete"&&this.cursor<this.userInput.length){this._setUserInput(this.userInput.slice(0,this.cursor)+this.userInput.slice(this.cursor+1));return}J&&(this.#z&&this.focused==="submit"&&(this.focused="editor"),this.#Z(J??""),this._cursor++)}}),this.on("userInput",(J)=>{this._setValue(J)}),this.on("finalize",()=>{this.value||(this.value=$.defaultValue),this.value===void 0&&(this.value="")})}}class D$ extends l0{get userInputWithCursor(){if(this.state==="submit")return this.userInput;let $=this.userInput;if(this.cursor>=$.length)return`${this.userInput}█`;let Z=$.slice(0,this.cursor),J=$.slice(this.cursor,this.cursor+1),z=$.slice(this.cursor+1);return`${Z}${p1("inverse",J)}${z}`}get cursor(){return this._cursor}constructor($){super({...$,initialUserInput:$.initialUserInput??$.initialValue}),this.on("userInput",(Z)=>{this._setValue(Z)}),this.on("finalize",()=>{this.value||(this.value=$.defaultValue),this.value===void 0&&(this.value="")})}}import{styleText as E,stripVTControlCharacters as NH}from"node:util";import $0 from"node:process";var c9=g9(j$(),1);function r8(){if($0.platform!=="win32")return $0.env.TERM!=="linux";return Boolean($0.env.CI)||Boolean($0.env.WT_SESSION)||Boolean($0.env.TERMINUS_SUBLIME)||$0.env.ConEmuTask==="{cmd::Cmder}"||$0.env.TERM_PROGRAM==="Terminus-Sublime"||$0.env.TERM_PROGRAM==="vscode"||$0.env.TERM==="xterm-256color"||$0.env.TERM==="alacritty"||$0.env.TERMINAL_EMULATOR==="JetBrains-JediTerm"}var o8=r8();var T=($,Z)=>o8?$:Z,u9=T("◆","*"),t8=T("■","x"),e8=T("▲","x"),$5=T("◇","o"),IH=T("┌","T"),k0=T("│","|"),L$=T("└","—"),_H=T("┐","T"),AH=T("┘","—"),bH=T("●",">"),RH=T("○"," "),SH=T("◻","[•]"),kH=T("◼","[+]"),EH=T("◻","[ ]"),TH=T("▪","•"),fH=T("─","-"),gH=T("╮","+"),yH=T("├","+"),xH=T("╯","+"),vH=T("╰","+"),hH=T("╭","+"),mH=T("●","•"),wH=T("◆","*"),uH=T("▲","!"),cH=T("■","x"),Z5=($)=>{switch($){case"initial":case"active":return E("cyan",u9);case"cancel":return E("red",t8);case"error":return E("yellow",e8);case"submit":return E("green",$5);case"validating":return E("dim",u9)}};var pH=[`${E("dim","↑/↓")} to navigate`,`${E("dim","Space:")} select`,`${E("dim","Enter:")} confirm`];var dH={light:T("─","-"),heavy:T("━","="),block:T("█","#")};var lH=[`${E("dim","↑/↓")} to navigate`,`${E("dim","Enter:")} confirm`];var aH=`${E("gray",k0)}  `;var p9=($)=>new D$({validate:$.validate,placeholder:$.placeholder,defaultValue:$.defaultValue,initialValue:$.initialValue,output:$.output,signal:$.signal,input:$.input,render(){let Z=$?.withGuide??e.withGuide,J=`${`${Z?`${E("gray",k0)}
+`:""}${Z5(this.state)}  `}${$.message}
+`,z=$.placeholder&&$.placeholder.length>0?E("inverse",$.placeholder[0])+E("dim",$.placeholder.slice(1)):E(["inverse","hidden"],"_"),Q=this.userInput?this.userInputWithCursor:z,G=this.value??"";switch(this.state){case"validating":{let X=Z?`${E("cyan",k0)}  `:"",W=Z?E("cyan",L$):"",H=E("dim",Q),Y=E("dim","Validating...");return`${J}${X}${H}
+${W}  ${Y}
+`}case"error":{let X=this.error?`  ${E("yellow",this.error)}`:"",W=Z?`${E("yellow",k0)}  `:"",H=Z?E("yellow",L$):"";return`${J.trim()}
+${W}${Q}
+${H}${X}
+`}case"submit":{let X=G?`${Z?"  ":""}${E("dim",G)}`:"",W=Z?E("gray",k0):"";return`${J}${W}${X}`}case"cancel":{let X=G?`  ${E(["strikethrough","dim"],G)}`:"",W=Z?E("gray",k0):"";return`${J}${W}${X}${G.trim()?`
+${W}`:""}`}default:{let X=Z?`${E("cyan",k0)}  `:"",W=Z?E("cyan",L$):"";return`${J}${X}${Q}
 ${W}
-`}}}}).prompt();import{existsSync as s1}from"node:fs";import{join as o0}from"node:path";import{accessSync as y8,constants as O9,statSync as m8}from"node:fs";import{delimiter as v8,extname as c8,resolve as p8}from"node:path";function H1($,Z,J){let z=J==="win32",Y=z?[`${$}.exe`,`${$}.cmd`,`${$}.bat`,$]:[$];for(let Q of(Z.PATH??"").split(z?";":v8)){if(!Q)continue;for(let G of Y){let W=p8(Q,G);try{if(y8(W,z?O9.F_OK:O9.X_OK),m8(W).isFile())return W}catch{}}}return null}async function l1($,Z,J,z){if(!$)return null;let Y=c8($).toLowerCase(),Q=z==="win32"&&(Y===".cmd"||Y===".bat");try{return await J.run(Q?Z.ComSpec||Z.COMSPEC||"cmd.exe":$,Q?["/d","/s","/c",$,"--version"]:["--version"],{env:Z})}catch{return null}}import{existsSync as d8,readFileSync as u8}from"node:fs";import{applyEdits as I9,format as l8,modify as K$,parse as P9}from"jsonc-parser";function j1($){if(!d8($))return{value:null,text:"",exists:!1};let Z=u8($,"utf8"),J=[],z=P9(Z,J,{allowTrailingComma:!0});return{value:J.length===0?z:null,text:Z,exists:!0}}function H$($,Z,J,z){let Q=P9($,[],{allowTrailingComma:!0})??{};for(let H of Z)if(typeof Q==="object"&&Q!==null)Q=Q[H];else{Q=void 0;break}let G=Array.isArray(Q)?Q:[],W=G.findIndex((H)=>typeof H==="string"&&z(H));if(W!==-1&&G[W]===J)return{text:$,changed:!1};let X;if(W!==-1)X=K$($,[...Z,W],J,{formattingOptions:{insertSpaces:!0,tabSize:2}});else if(!Array.isArray(Q))X=K$($,Z,[J],{formattingOptions:{insertSpaces:!0,tabSize:2}});else X=K$($,[...Z,G.length],J,{formattingOptions:{insertSpaces:!0,tabSize:2}});let K=I9($,X);return{text:I9(K,l8(K,void 0,{insertSpaces:!0,tabSize:2})),changed:!0}}import{existsSync as i1}from"node:fs";import{mkdir as b9,writeFile as a1}from"node:fs/promises";import{join as n1}from"node:path";function A9($){return $===s0||$.startsWith(`${s0}@`)}function j$($){let Z=n1($,"opencode.jsonc");if(i1(Z))return{path:Z,exists:!0};let J=n1($,"opencode.json");if(i1(J))return{path:J,exists:!0};return{path:Z,exists:!1}}function i8($){let Z=n1($,"tui.jsonc");if(i1(Z))return{path:Z,exists:!0};let J=n1($,"tui.json");if(i1(J))return{path:J,exists:!0};return{path:Z,exists:!1}}async function k9($,Z=process.env){let J=x0(Z);await b9(J,{recursive:!0});let{path:z,exists:Y}=j$(J),Q=C9($);if(!Y){let K=`{
-  "$schema": "https://opencode.ai/config.json",
-  "plugin": [
-    "${Q}"
-  ]
-}
-`;return await a1(z,K,"utf8"),{configPath:z,changed:!0,created:!0}}let{text:G}=j1(z),{text:W,changed:X}=H$(G,["plugin"],Q,A9);if(X)await a1(z,W,"utf8");return{configPath:z,changed:X,created:!1}}async function _9($,Z=process.env){let J=x0(Z);await b9(J,{recursive:!0});let{path:z,exists:Y}=i8(J),Q=R9($);if(!Y){let K=`{
-  "plugin": [
-    "${Q}"
-  ]
-}
-`;return await a1(z,K,"utf8"),{configPath:z,changed:!0,created:!0}}let{text:G}=j1(z),{text:W,changed:X}=H$(G,["plugin"],Q,A9);if(X)await a1(z,W,"utf8");return{configPath:z,changed:X,created:!1}}import{existsSync as E9}from"node:fs";import{readFile as a8,writeFile as qz}from"node:fs/promises";import{join as n8}from"node:path";function S9($=process.env,Z=u0($)){let J=n8(Z,"settings.json");if(!E9(J))return!1;try{let Y=JSON.parse(s8(J))?.packages;if(!Array.isArray(Y))return!1;return Y.some((Q)=>{let G=typeof Q==="string"?Q:typeof Q==="object"&&Q!==null?Q.source:"";if(typeof G!=="string")return!1;return G===U1||G.startsWith(`${U1}@`)||G===`npm:${U1}`||G.startsWith(`npm:${U1}@`)})}catch{return!1}}function s8($){return M1("node:fs").readFileSync($,"utf8")}async function x9($=process.env){let Z=S1($);if(!E9(Z))return!1;try{let J=await a8(Z,"utf8"),z=JSON.parse(J);return Boolean(z?.anthropic&&typeof z.anthropic==="object")}catch{return!1}}async function w9($,Z=$0,J=process.env){let z=f9($),Y=await Z.run("pi",["install",z],{env:J});if(Y.exitCode!==0)return{ok:!1,exitCode:Y.exitCode,stderr:Y.stderr};return{ok:!0,message:`Installed ${z}`}}function o8($,Z){let J=g9($,Z),z;switch(Z){case"darwin":z=["/Applications/OpenCode.app","/Applications/OpenCode Beta.app",o0(J,"Applications","OpenCode.app"),o0(J,"Applications","OpenCode Beta.app")];break;case"win32":{let Y=$.LOCALAPPDATA??o0(J,"AppData","Local");z=[o0(Y,"Programs","opencode"),o0(Y,"opencode")];break}case"linux":z=["/opt/OpenCode","/usr/lib/opencode",o0(J,".local","share","applications","opencode.desktop")];break;default:z=[]}return z.some((Y)=>s1(Y))}async function r8($=process.env,Z=$0,J={}){let z=J.platform??process.platform,Y=x0($,z),Q=s1(Y)||o8($,z),G=H1("opencode",$,z)??H1("opencode2",$,z),W=Q||G!==null,X=await l1(G,$,Z,z),K=X?.exitCode===0?X.stdout.trim()||null:null,{path:j,exists:H}=j$(Y),M=!1;if(H){let{value:D}=j1(j);if(Array.isArray(D?.plugin))M=D.plugin.some((q)=>typeof q==="string"&&(q===s0||q.startsWith(`${s0}@`)))}return{kind:"opencode",installed:W,version:K,configPath:j,pluginInstalled:M}}async function t8($=process.env,Z=$0,J={}){let z=J.platform??process.platform,Y=u0($,z),Q=s1(Y),G=H1("pi",$,z),W=Q||G!==null,X=await l1(G,$,Z,z),K=null;if(X?.exitCode===0){let M=X.stdout.trim()||X.stderr.trim();K=M.split(/\r?\n/).find((q)=>/^\d+\.\d+\.\d+/.test(q.trim()))?.trim()||M||null}let j=S9($,Y),H=await x9($);return{kind:"pi",installed:W,version:K,configPath:Y,pluginInstalled:j,hasLocalAuth:H}}async function e8($=process.env,Z=$0,J={}){let z=J.platform??process.platform,Y=H1("ck",$,z),Q=Y!==null,G=await l1(Y,$,Z,z),W=G?.exitCode===0?G.stdout.trim()||null:null,X=null,K=!1;try{if(X=_1(void 0,$),X&&s1(X)){let j=await T9({connectionFile:X,handshakeTimeoutMs:2000});K=!0,j.close()}}catch{K=!1}return{ckInstalled:Q,ckVersion:W,daemonRunning:K,connectionPath:X}}async function h9($=process.env,Z=$0,J={}){let[z,Y,Q]=await Promise.all([r8($,Z,J),t8($,Z,J),e8($,Z,J)]);return{opencode:z,pi:Y,claustrum:Q}}async function m9($,Z){let J={...Z.env},z=async()=>{if(w1(J),await i0(Z.fence),await B0($,J)!=="local")throw Error("Disconnect from the vault first.")};await z();let Y=Z.paths??await l0($,J),Q=await Z.login?.($);if(Q&&!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(Q.accountIdentity))throw Error("Claude sign-in did not establish an account UUID");if(await z(),await y9({paths:Y.paths,legacyConfigPath:Y.legacyConfigPath,legacyStatePath:Y.legacyStatePath,host:$,hostAuthPath:Y.hostAuthPath,routingSourcePath:Y.routingSourcePath,routingDestinationPath:Y.routingDestinationPath,env:J,processFence:z,removePiAnthropicAuth:Z.removePiAnthropicAuth}),Q){let G=a0({paths:Y.paths,host:$,vault:{env:J},beforePoolWrite:z});try{if((await G.read()).mode!=="local")throw Error("Disconnect from the vault first.");await z(),await G.loginOAuth({routeId:"main",replace:!0,...Q})}finally{G.close()}}}async function c9($){let Z=await o1("max");u1(Z.url,`Claude sign-in for ${$==="pi"?"Pi":"OpenCode"}`);let J=await N9({message:"Paste the Claude callback URL or authorization code:"});if(I0(J))throw Error("Claude sign-in cancelled");let z=await r1(J,Z.verifier,Z.redirectUri,Z.state);if(z.type!=="success")throw Error("Claude sign-in failed");let Y=await v9(z.access,void 0,void 0);if(!Y.accountUuid)throw Error("Claude sign-in did not establish an account UUID");return{accountIdentity:Y.accountUuid,credential:{type:"oauth",access:z.access,refresh:z.refresh,expires:z.expires}}}async function d9($=[],Z={}){let J=Z.env??process.env,z=Z.runner??$0,Y=Z.fence??c3,Q=Z.activate??P2,G=Z.migrateLocal??m9,W={output:Z.output},X=$.includes("--yes")||$.includes("-y"),K=$.includes("--dry-run"),j=$.includes("--no-claustrum"),H=$.includes("--claustrum"),M=$.includes("--remove-pi-auth"),D=$.includes("--login"),q=D?Z.localLogin??c9:void 0;if(D&&H)return y.error("Local sign-in and vault setup are two separate choices. Use --login or --claustrum, not both.",W),1;L9("CortexKit Anthropic Auth Setup",W);let B=B9(W);B.start("Detecting installed environments…");let N=await(Z.detect??h9)(J,z);B.stop("Environment detection complete.");let x=N.opencode.installed?`detected (${N.opencode.version??"version unknown"}, ${N.opencode.pluginInstalled?"plugin already configured":"plugin not configured"})`:"not found",m=N.pi.installed?`detected (${N.pi.version??"version unknown"}, ${N.pi.pluginInstalled?"extension already installed":"extension not installed"})`:"not found",p=N.claustrum.daemonRunning?`daemon running (${N.claustrum.ckVersion??"ck ready"})`:N.claustrum.ckInstalled?"ck installed, daemon not running":"not installed";if(y.info(`OpenCode:   ${x}`,W),y.info(`Pi:         ${m}`,W),y.info(`Claustrum:  ${p}`,W),!N.opencode.installed&&!N.pi.installed)return y.error("Neither OpenCode nor Pi was detected on this system.",W),H0("Install OpenCode (https://opencode.ai) or Pi (https://github.com/badlogic/pi-mono) first.",W),1;let F=[];if(X){if(N.opencode.installed)F.push("opencode");if(N.pi.installed)F.push("pi")}else{let k=[];if(N.opencode.installed)k.push({value:"opencode",label:"OpenCode",hint:N.opencode.pluginInstalled?"already configured":"configure plugin + TUI sidebar"});if(N.pi.installed)k.push({value:"pi",label:"Pi",hint:N.pi.pluginInstalled?"already installed":"install provider extension"});let _=await F9({message:"Select integrations to configure:",options:k,initialValues:k.map((b)=>b.value),required:!0,...W});if(I0(_))return H0("Setup cancelled.",W),0;F=_}if(F.length===0)return H0("No integrations selected.",W),0;let U=!1;if(N.claustrum.daemonRunning&&N.claustrum.ckInstalled&&!j){if(H)U=!0;else if(!X){let k=await X$({message:"Use Claude accounts from the Claustrum vault? Local account files stay unchanged and are not used while connected.",initialValue:!1,...W});if(I0(k))return H0("Setup cancelled.",W),0;U=k}}if(q&&U)return y.error("Local sign-in and vault setup are two separate choices. Use --login or --claustrum, not both.",W),1;if(q||!U){for(let k of F)if(await B0(k,J)!=="local")return y.error("Disconnect from the vault first.",W),1}let I=!1;if(F.includes("pi")&&N.pi.hasLocalAuth)if(X){if(!M)return y.error(U?"Pi has stored Anthropic authentication. Rerun with --remove-pi-auth to preserve it privately during vault use and restore it on disconnect.":"Pi has a stored Anthropic login. Rerun with --remove-pi-auth to move it into the native account pool.",W),H0("Setup aborted.",W),1;I=!0}else{y.warn(U?"Pi has stored Anthropic authentication. Vault setup must preserve it privately and restore it on disconnect.":"Pi has a stored Anthropic OAuth token. Native account-pool setup moves credentials out of the host auth store.",W);let k=await X$({message:U?"Move Pi authentication aside privately for vault use, then restore it on disconnect?":"Move the Pi Anthropic OAuth login into the native account pool and remove its stored copy?",initialValue:!1,...W});if(I0(k)||!k)return y.error("Native account-pool setup cannot finish while the stored Pi OAuth token takes precedence.",W),H0("Setup aborted.",W),1;I=!0}try{await i0(Y)}catch(k){return y.error(await N0("setup-process-check",k,J),W),H0("Setup aborted — quit active hosts and rerun setup.",W),1}let E=[];for(let k of F)E.push(await l0(k,J));if(await B2(E),K){if(y.info("[dry-run] Planned actions:",W),y.info(`  - Target integrations: ${F.join(", ")}`,W),y.info(`  - Claustrum custody: ${U?"enabled":"disabled"}`,W),I)y.info("  - Pi local OAuth token will be removed",W);return H0("Dry run complete. No changes were made.",W),0}let S=await p9(),h=async(k,_)=>{B.start(`Switching ${_} to Claustrum vault custody…`);try{let b=await Q(k,{env:J,runner:z,fence:Y,removePiAnthropicAuth:k==="pi"&&I});return B.stop(b==="already-vault"?`${_} already uses Claustrum vault custody.`:`${_} now uses Claustrum vault custody.`),!0}catch(b){return B.stop(`${_} vault custody setup failed.`),y.error(await N0("setup-activation",b,J),W),!1}};if(F.includes("opencode")){B.start("Configuring OpenCode plugin and TUI sidebar…");try{await k9(S,J),await _9(S,J),B.stop("OpenCode configuration updated.")}catch(k){return B.stop("OpenCode setup failed."),y.error(await N0("setup-opencode-config",k,J),W),1}if(q||!U)await G("opencode",{env:J,fence:Y,removePiAnthropicAuth:!1,login:q});if(U&&!await h("opencode","OpenCode"))return 1}if(F.includes("pi")){B.start("Installing Pi Anthropic extension…");try{let k=await w9(S,z,J);if(!k.ok)return B.stop("Pi extension installation failed."),y.error(await T2("setup-pi-install",k,J),W),1;B.stop("Pi Anthropic extension installed.")}catch(k){return B.stop("Pi setup failed."),y.error(await N0("setup-pi",k,J),W),1}if(q||!U)await G("pi",{env:J,fence:Y,removePiAnthropicAuth:I,login:q});if(U&&!await h("pi","Pi"))return 1}let T=[];if(F.includes("opencode"))T.push("• Start OpenCode normally (opencode).");if(F.includes("pi"))T.push("• Start Pi normally (pi).");if(U)T.push("• Manage accounts in Claustrum with: ck auth login --provider anthropic"),T.push("  Newly added accounts will be discovered automatically without restarting.");return u1(T.join(`
-`),"Next Steps",W),H0("Setup complete!",W),0}async function r0($){if(process.env.OPENCODE_AUTH_CONTENT!==void 0)throw Error("Native account changes require offline setup without OPENCODE_AUTH_CONTENT");let Z=await E1(),J=a0({paths:Z,host:"opencode"});try{return await J.read(),await $(J)}finally{J.close()}}async function t1(){if(await B0("opencode",process.env)!=="local")throw Error("Disconnect from the vault first.")}function u9(){console.log(`Usage:
+`}}}}).prompt();import{authorize as J5,exchange as z5,resolveClaudeCodeIdentity as Q5}from"@cortexkit/anthropic-auth-core";async function d9($,Z={authorize:J5,exchange:z5,resolveClaudeCodeIdentity:Q5,text:p9,isCancel:l1,print:console.log}){let J=await Z.authorize("max");Z.print(`Claude sign-in for ${$==="pi"?"Pi":"OpenCode"}`),Z.print(J.url);let z=await Z.text({message:"Paste the Claude callback URL or authorization code:"});if(Z.isCancel(z))throw Error("Claude sign-in cancelled");let Q=await Z.exchange(z,J.verifier,J.redirectUri,J.state);if(Q.type!=="success")throw Error("Claude sign-in failed");let G=await Z.resolveClaudeCodeIdentity(Q.access,void 0,void 0);if(!G.accountUuid)throw Error("Claude sign-in did not establish an account UUID");return{accountIdentity:G.accountUuid,credential:{type:"oauth",access:Q.access,refresh:Q.refresh,expires:Q.expires}}}var l9='Warning: OpenCode holds a separate Anthropic OAuth login. Remove the separate OpenCode Anthropic login, then choose "Claude via credential vault". Setup has left that login unchanged.';function V0($,Z){let J=$.get(Z);if(!J)throw Error("Missing setup plan");return J}async function i9($=[],Z={}){let J={...Z.env??process.env},z=Z.terminal??{input:process.stdin,output:process.stdout,signals:process},Q=(U)=>z.output.write(`${U}
+`),G=$.filter((U)=>U!=="--remove-pi-auth").map((U)=>U==="-y"?"--yes":U),X=G.includes("--login");if(X&&G.includes("--claustrum"))return Q("Local sign-in and vault setup are two separate choices. Use --login or --claustrum, not both."),1;if(X&&G.includes("--opencode=2"))return Q(a1),1;let W=Z.runner??F9,H=Z.fence??G5(W,{platform:Z.platform}),Y=Z.migrateLocal??h2,q=new Map,V=new Map,B=new Map,L=new Map,F=!1,D="setup-process-check",P=(U)=>({env:J,fence:H,paths:B.get(U),removePiAnthropicAuth:L.get(U)??!1}),R=(U)=>({...P(U),runner:W});async function f(U){if(!U.hosts.includes("pi"))return;let K=V0(B,"pi");if((await Z1("pi",K.hostAuthPath)).kind==="absent")return;{let S=await W5({env:J,authPath:K.hostAuthPath}).inspect();if(S.slot==="placeholder"&&S.stash==="missing")throw new X5("missing-stash");if(U.mode==="claustrum"){if(S.slot==="placeholder")return}}if($.includes("--remove-pi-auth")){L.set("pi",!0);return}let b=U.mode==="claustrum"?"Pi has stored Anthropic authentication. Rerun with --remove-pi-auth to preserve it privately during vault use and restore it on disconnect.":"Pi has a stored Anthropic login. Rerun with --remove-pi-auth to move it into the native account pool.";if(G.includes("--yes")||!z.input.isTTY)throw new d(b);if(!await v1(z,U.mode==="claustrum"?"Move Pi authentication aside privately for vault use, then restore it on disconnect?":"Move the Pi Anthropic OAuth login into the native account pool and remove its stored copy?"))throw new d("Native account-pool setup cannot finish while the stored Pi OAuth token takes precedence.");L.set("pi",!0)}async function v(U,K){let j=V0(V,U);if(await U5(U,J)!==(K?"claustrum":j.priorMode)||await J1(U,R(U))!==j.fingerprint)throw new d("Setup inputs changed. Rerun setup with all hosts stopped.")}let N={packages:{opencode:a9,pi:s9},version:await n9(),displayName:"CortexKit Anthropic Auth",slashCommand:"/claude",vault:{connectionFile:v3(J.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE&&!J.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE?"pi":"opencode",J),hosts:{opencode:{name:b1.opencode,paths:x3("opencode",J)},pi:{name:b1.pi,paths:x3("pi",J)}}},async beforeSignIn(U,K){if(D=K.mode==="claustrum"?"setup-activation":"cli-setup",!F){q5(J);for(let j of K.hosts)B.set(j,await U0(j,J));if(await E2([...B.values()]),K.mode==="claustrum"){let j=K.hosts.map((g)=>v3(g,J)),b=j[0];if(new Set(j).size!==1||!b)throw new d("Selected hosts use different vault connection files.");N.vault.connectionFile=b}if(K.mode==="local"&&X&&K.hosts.includes("opencode")&&K.opencodeGeneration==="2")throw new d(a1);if(K.mode==="local"){await c3(K.hosts,J);for(let j of K.hosts)await R0(j,P(j))()}await f(K);for(let j of K.hosts)if(K.mode==="claustrum"){if(V.set(j,await(Z.vaultPreflight??u2)(j,{...R(j),inspectOpenCodeAuth:K.opencodeGeneration!=="2"})),V0(V,j).separateOpenCodeLogin)Q(l9)}else q.set(j,await d3(j,P(j),j==="opencode"&&K.opencodeGeneration==="2"));F=!0}else if(K.mode==="claustrum")await v(U,!1);else await u0(V0(q,U),P(U))},async signInLocal(U){let K=V0(q,U);if(!X){if(K.generation2)Q(a1);return}if(await u0(K,P(U)),await Y(U,{...P(U),login:Z.localLogin??d9,preflight:K.preflight,skipMigration:K.action==="skip",beforeCommit:()=>u0(K,P(U))}),K.fingerprint=await S1(K,J),K.notice)Q(u3)},async beforeRegister(U,K){if(K==="local")await u0(V0(q,U),P(U));else await v(U,!0),await(Z.vaultActivate??c2)(U,R(U),V0(V,U)),V0(V,U).fingerprint=await J1(U,R(U))},async migrate(U,K){if(K.mode==="claustrum"){if(await v(U,!0),U===K.hosts.at(-1)&&V.get("opencode")?.separateOpenCodeLogin)Q(l9);return}let j=V0(q,U);if(await u0(j,P(U)),X)return;if(j.action==="migration")await Y(U,{...P(U),preflight:j.preflight});else if(j.action==="empty-init")await H5({paths:j.paths.paths,routingDestinationPath:j.paths.routingDestinationPath,env:J,processFence:R0(U,P(U))});else if(j.action==="skip"){if(await l3(j,P(U)),j.notice)Q(u3)}j.fingerprint=await S1(j,J)}};try{return await V5(N,G,{...Z,env:J,terminal:z,runner:W,fence:H}),0}catch(U){let j=f2(U)??J$(U)??await Q1(D,U,J);if(j)Q(j);for(let{host:b,outcome:g}of $9(U)??[]){if(g!=="enrolled")continue;let S=b==="opencode"?"OpenCode":"Pi";Q(`${S} stays connected to the vault. In ${S}, run /claude → Accounts → Disconnect from the vault to undo it. Or run setup again to finish connecting.`)}return 1}finally{for(let U of q.values())if(U.preflight)Y5(U.preflight)}}async function a0($){if(process.env.OPENCODE_AUTH_CONTENT!==void 0)throw Error("Native account changes require offline setup without OPENCODE_AUTH_CONTENT");let Z=await I5(),J=B5({paths:Z,host:"opencode"});try{return await J.read(),await $(J)}finally{J.close()}}async function s1(){if(await O5("opencode",process.env)!=="local")throw Error("Disconnect from the vault first.")}function r9(){console.log(`Usage:
   opencode-anthropic-auth setup [--yes] [--dry-run]
   opencode-anthropic-auth login [label]
   opencode-anthropic-auth api add [label]
   opencode-anthropic-auth list
   opencode-anthropic-auth relay setup
 
+Setup --yes selects every found host, including Pi. Run setup without --yes to choose hosts.
 Native credentials are managed by the offline setup migration.
 Legacy import source:
-  ${i9()}`)}function U$($,Z){let J=$?.trim();if(!J)throw Error(`${Z} is required`);return J}async function Z3($){let J=await($.fetchImpl??fetch)(`https://api.cloudflare.com/client/v4${$.path}`,{method:$.method,headers:{authorization:`Bearer ${$.token}`,...$.body instanceof FormData?{}:{"content-type":"application/json"},...$.headers},body:$.body}),z=await J.text(),Y;try{Y=JSON.parse(z)}catch{throw Error(`Cloudflare API returned ${J.status}: ${z}`)}if(!J.ok||Y.success===!1){let Q=Y.errors?.map((G)=>G.message).filter(Boolean).join("; ");throw Error(Q||`Cloudflare API returned ${J.status}`)}return Y.result}async function z6($,Z,J,z){return Z3({token:$,method:"POST",path:`/accounts/${Z}/storage/kv/namespaces`,body:JSON.stringify({title:J}),fetchImpl:z})}async function Y6($){let Z={main_module:"worker.js",compatibility_date:"2026-04-28",bindings:[{type:"kv_namespace",name:"RELAY_STATE",namespace_id:$.kvNamespaceId},{type:"secret_text",name:"RELAY_TOKEN",text:$.relayToken}]},J=new FormData;return J.set("metadata",JSON.stringify(Z)),J.set("worker.js",new Blob([s9],{type:"application/javascript+module"}),"worker.js"),Z3({token:$.token,method:"PUT",path:`/accounts/${$.accountId}/workers/scripts/${$.scriptName}`,body:J,fetchImpl:$.fetchImpl})}async function Q6($,Z,J,z){await Z3({token:$,method:"POST",path:`/accounts/${Z}/workers/scripts/${J}/subdomain`,body:JSON.stringify({enabled:!0,previews_enabled:!1}),fetchImpl:z})}async function G6($,Z,J){return Z3({token:$,method:"GET",path:`/accounts/${Z}/workers/subdomain`,fetchImpl:J}).catch(()=>null)}async function W6($={}){await r0((D)=>D.read());let Z=$.fetchImpl??fetch,J=$.prompt??$3,z=$.warn??((D)=>console.warn(D)),Y=U$(process.env.CLOUDFLARE_API_TOKEN?.trim()||await J("Cloudflare API token: "),"Cloudflare API token");$.secrets?.push(Y);let Q=U$(process.env.CLOUDFLARE_ACCOUNT_ID||await J("Cloudflare account ID: "),"Cloudflare account ID"),G=await J("Worker name [opencode-anthropic-relay]: ")||"opencode-anthropic-relay",W=`${G}-state`,X=n9();$.secrets?.push(X),console.log("Creating Cloudflare KV namespace...");let K=await z6(Y,Q,W,Z);console.log("Uploading relay Worker..."),await Y6({token:Y,accountId:Q,scriptName:G,kvNamespaceId:K.id,relayToken:X,fetchImpl:Z}),await Q6(Y,Q,G,Z).catch(async(D)=>{z(await N0("cli-relay-workers-dev",D,process.env,[Y,X]))});let j=await G6(Y,Q,Z),M=(j?.subdomain?`https://${G}.${j.subdomain}.workers.dev`:"")||U$(await $3("Relay Worker URL: "),"Relay Worker URL");await r0((D)=>D.updateRelay({enabled:!0,url:M,token:X,fallbackToDirect:!0,transport:"http"})),console.log(`Relay enabled at ${M}`),console.log("Relay settings saved to the native account store.")}var e1=null;async function $3($){return e1??=J6({input:$6,output:Z6}),(await e1.question($)).trim()}function X6(){e1?.close(),e1=null}async function K6($,Z={}){if(process.env.OPENCODE_AUTH_CONTENT!==void 0)throw Error("Local login cannot be verified while OPENCODE_AUTH_CONTENT is set");let J=Z.prompt??$3,z=Z.authorize??o1,Y=Z.exchange??r1;await t1(),await r0(async(Q)=>{let G=await Q.read(),W=$?.trim()||await J("Fallback account label (optional): "),X=await z("max");console.log(`
+  ${C5()}`)}function N$($,Z){let J=$?.trim();if(!J)throw Error(`${Z} is required`);return J}async function r1($){let J=await($.fetchImpl??fetch)(`https://api.cloudflare.com/client/v4${$.path}`,{method:$.method,headers:{authorization:`Bearer ${$.token}`,...$.body instanceof FormData?{}:{"content-type":"application/json"},...$.headers},body:$.body}),z=await J.text(),Q;try{Q=JSON.parse(z)}catch{throw Error(`Cloudflare API returned ${J.status}: ${z}`)}if(!J.ok||Q.success===!1){let G=Q.errors?.map((X)=>X.message).filter(Boolean).join("; ");throw Error(G||`Cloudflare API returned ${J.status}`)}return Q.result}async function A5($,Z,J,z){return r1({token:$,method:"POST",path:`/accounts/${Z}/storage/kv/namespaces`,body:JSON.stringify({title:J}),fetchImpl:z})}async function b5($){let Z={main_module:"worker.js",compatibility_date:"2026-04-28",bindings:[{type:"kv_namespace",name:"RELAY_STATE",namespace_id:$.kvNamespaceId},{type:"secret_text",name:"RELAY_TOKEN",text:$.relayToken}]},J=new FormData;return J.set("metadata",JSON.stringify(Z)),J.set("worker.js",new Blob([_5],{type:"application/javascript+module"}),"worker.js"),r1({token:$.token,method:"PUT",path:`/accounts/${$.accountId}/workers/scripts/${$.scriptName}`,body:J,fetchImpl:$.fetchImpl})}async function R5($,Z,J,z){await r1({token:$,method:"POST",path:`/accounts/${Z}/workers/scripts/${J}/subdomain`,body:JSON.stringify({enabled:!0,previews_enabled:!1}),fetchImpl:z})}async function S5($,Z,J){return r1({token:$,method:"GET",path:`/accounts/${Z}/workers/subdomain`,fetchImpl:J}).catch(()=>null)}async function k5($={}){await a0((L)=>L.read());let Z=$.fetchImpl??fetch,J=$.prompt??i1,z=$.warn??((L)=>console.warn(L)),Q=N$(process.env.CLOUDFLARE_API_TOKEN?.trim()||await J("Cloudflare API token: "),"Cloudflare API token");$.secrets?.push(Q);let G=N$(process.env.CLOUDFLARE_ACCOUNT_ID||await J("Cloudflare account ID: "),"Cloudflare account ID"),X=await J("Worker name [opencode-anthropic-relay]: ")||"opencode-anthropic-relay",W=`${X}-state`,H=N5();$.secrets?.push(H),console.log("Creating Cloudflare KV namespace...");let Y=await A5(Q,G,W,Z);console.log("Uploading relay Worker..."),await b5({token:Q,accountId:G,scriptName:X,kvNamespaceId:Y.id,relayToken:H,fetchImpl:Z}),await R5(Q,G,X,Z).catch(async(L)=>{z(await Q1("cli-relay-workers-dev",L,process.env,[Q,H]))});let q=await S5(Q,G,Z),B=(q?.subdomain?`https://${X}.${q.subdomain}.workers.dev`:"")||N$(await i1("Relay Worker URL: "),"Relay Worker URL");await a0((L)=>L.updateRelay({enabled:!0,url:B,token:H,fallbackToDirect:!0,transport:"http"})),console.log(`Relay enabled at ${B}`),console.log("Relay settings saved to the native account store.")}var n1=null;async function i1($){return n1??=M5({input:K5,output:j5}),(await n1.question($)).trim()}function E5(){n1?.close(),n1=null}async function T5($,Z={}){if(process.env.OPENCODE_AUTH_CONTENT!==void 0)throw Error("Local login cannot be verified while OPENCODE_AUTH_CONTENT is set");let J=Z.prompt??i1,z=Z.authorize??F5,Q=Z.exchange??D5;await s1(),await a0(async(G)=>{let X=await G.read(),W=$?.trim()||await J("Fallback account label (optional): "),H=await z("max");console.log(`
 Open this URL in your browser and complete Claude sign-in:
-`),console.log(`${X.url}
-`);let K=await J("Paste the full callback URL or authorization code here: ");Z.secrets?.push(K);let j=await Y(K,X.verifier,X.redirectUri,X.state);if(j.type==="failed")throw Error("Authentication failed");if(Z.secrets?.push(j.access,j.refresh),process.env.OPENCODE_AUTH_CONTENT!==void 0)throw Error("Local login cannot be verified while OPENCODE_AUTH_CONTENT is set");await t1();let H=W&&W!=="main"?W:crypto.randomUUID(),M=G.accounts.some((D)=>D.id===H&&D.source==="local");await Q.loginOAuth({routeId:H,replace:M,label:W||void 0,credential:{access:j.access,refresh:j.refresh,expires:j.expires}}),console.log(`
-Saved native fallback account${W?` "${W}"`:""}.`)})}async function H6($,Z={}){await t1(),await r0((X)=>X.read());let J=Z.prompt??$3,z=$?.trim()||await J("API fallback label (optional): "),Y=process.env.OPENCODE_ANTHROPIC_AUTH_API_BASE_URL?.trim()||(await J("Anthropic-compatible base URL [https://api.kie.ai/claude]: ")).trim()||"https://api.kie.ai/claude";if(!l9(Y))throw Error("API fallback base URL must be an http(s) URL without embedded credentials");let Q=process.env.OPENCODE_ANTHROPIC_AUTH_API_KEY?.trim()||await J("API key: ");if(!Q.trim())throw Error("API key is required");Z.secrets?.push(Q.trim());let W=(process.env.OPENCODE_ANTHROPIC_AUTH_API_AUTH_HEADER?.trim()||await J("Auth header [authorization-bearer|x-api-key] (default authorization-bearer): ")).trim().toLowerCase()==="x-api-key"?"x-api-key":"authorization-bearer";await r0(async(X)=>{await t1();let K=await X.read(),j=z&&z!=="main"?z:crypto.randomUUID(),H=K.accounts.find((M)=>M.id===j);if(H?.source==="vault")throw Error("Vault routes cannot be replaced with a local API key");await X.addApi({routeId:j,replace:Boolean(H),label:z||void 0,apiKey:Q.trim(),baseURL:Y,authHeader:W})}),console.log(`
-Saved API fallback route${z?` "${z}"`:""} (${Y}).`)}async function j6(){await r0(async($)=>{let Z=(await $.read()).accounts.filter((J)=>J.id!=="main");if(!Z.length){console.log("No native fallback accounts found.");return}for(let[J,z]of Z.entries()){let Y=z.label||z.id,Q=z.enabled?"enabled":"disabled";if(z.type==="api"){console.log(`${J+1}. ${Y} (${Q}) — API route ${z.baseURL}`);continue}let G=z.quota?.five_hour?.remainingPercent,W=z.quota?.seven_day?.remainingPercent,X=G===void 0&&W===void 0?"quota unknown":`5h ${G??"?"}%, 1w ${W??"?"}% remaining`;console.log(`${J+1}. ${Y} (${Q}) — ${X}${z.state?` — ${a9(z)}`:""}`)}})}async function U6($){let[Z,J,z]=process.argv.slice(2);if(!Z||Z==="help"||Z==="--help"||Z==="-h"){u9();return}if(Z==="setup"){$.stage="cli-setup";let Y=await d9(process.argv.slice(3));if(Y!==0)process.exitCode=Y;return}if(Z==="login"){$.stage="cli-login",await K6(J,{secrets:$.secrets});return}if(Z==="api"&&J==="add"){$.stage="cli-api-add",await H6(z,{secrets:$.secrets});return}if(Z==="list"){$.stage="cli-list",await j6();return}if(Z==="relay"&&J==="setup"){$.stage="cli-relay-setup",await W6({secrets:$.secrets});return}u9(),process.exitCode=1}if(M1.main==M1.module){let $={stage:"cli-command",secrets:[]};try{await U6($)}catch(Z){console.error(await N0($.stage,Z,process.env,$.secrets)),process.exitCode=1}finally{X6()}}export{d9 as runSetupCommand,W6 as relaySetup,K6 as login,H6 as addApiRoute};
+`),console.log(`${H.url}
+`);let Y=await J("Paste the full callback URL or authorization code here: ");Z.secrets?.push(Y);let q=await Q(Y,H.verifier,H.redirectUri,H.state);if(q.type==="failed")throw Error("Authentication failed");if(Z.secrets?.push(q.access,q.refresh),process.env.OPENCODE_AUTH_CONTENT!==void 0)throw Error("Local login cannot be verified while OPENCODE_AUTH_CONTENT is set");await s1();let V=W&&W!=="main"?W:crypto.randomUUID(),B=X.accounts.some((L)=>L.id===V&&L.source==="local");await G.loginOAuth({routeId:V,replace:B,label:W||void 0,credential:{access:q.access,refresh:q.refresh,expires:q.expires}}),console.log(`
+Saved native fallback account${W?` "${W}"`:""}.`)})}async function f5($,Z={}){await s1(),await a0((H)=>H.read());let J=Z.prompt??i1,z=$?.trim()||await J("API fallback label (optional): "),Q=process.env.OPENCODE_ANTHROPIC_AUTH_API_BASE_URL?.trim()||(await J("Anthropic-compatible base URL [https://api.kie.ai/claude]: ")).trim()||"https://api.kie.ai/claude";if(!P5(Q))throw Error("API fallback base URL must be an http(s) URL without embedded credentials");let G=process.env.OPENCODE_ANTHROPIC_AUTH_API_KEY?.trim()||await J("API key: ");if(!G.trim())throw Error("API key is required");Z.secrets?.push(G.trim());let W=(process.env.OPENCODE_ANTHROPIC_AUTH_API_AUTH_HEADER?.trim()||await J("Auth header [authorization-bearer|x-api-key] (default authorization-bearer): ")).trim().toLowerCase()==="x-api-key"?"x-api-key":"authorization-bearer";await a0(async(H)=>{await s1();let Y=await H.read(),q=z&&z!=="main"?z:crypto.randomUUID(),V=Y.accounts.find((B)=>B.id===q);if(V?.source==="vault")throw Error("Vault routes cannot be replaced with a local API key");await H.addApi({routeId:q,replace:Boolean(V),label:z||void 0,apiKey:G.trim(),baseURL:Q,authHeader:W})}),console.log(`
+Saved API fallback route${z?` "${z}"`:""} (${Q}).`)}async function g5(){await a0(async($)=>{let Z=(await $.read()).accounts.filter((J)=>J.id!=="main");if(!Z.length){console.log("No native fallback accounts found.");return}for(let[J,z]of Z.entries()){let Q=z.label||z.id,G=z.enabled?"enabled":"disabled";if(z.type==="api"){console.log(`${J+1}. ${Q} (${G}) — API route ${z.baseURL}`);continue}let X=z.quota?.five_hour?.remainingPercent,W=z.quota?.seven_day?.remainingPercent,H=X===void 0&&W===void 0?"quota unknown":`5h ${X??"?"}%, 1w ${W??"?"}% remaining`;console.log(`${J+1}. ${Q} (${G}) — ${H}${z.state?` — ${L5(z)}`:""}`)}})}async function y5($){let[Z,J,z]=process.argv.slice(2);if(!Z||Z==="help"||Z==="--help"||Z==="-h"){r9();return}if(Z==="setup"){$.stage="cli-setup";let Q=await i9(process.argv.slice(3));if(Q!==0)process.exitCode=Q;return}if(Z==="login"){$.stage="cli-login",await T5(J,{secrets:$.secrets});return}if(Z==="api"&&J==="add"){$.stage="cli-api-add",await f5(z,{secrets:$.secrets});return}if(Z==="list"){$.stage="cli-list",await g5();return}if(Z==="relay"&&J==="setup"){$.stage="cli-relay-setup",await k5({secrets:$.secrets});return}r9(),process.exitCode=1}if(Q3.main==Q3.module){let $={stage:"cli-command",secrets:[]};try{await y5($)}catch(Z){console.error(await Q1($.stage,Z,process.env,$.secrets)),process.exitCode=1}finally{E5()}}export{i9 as runSetupCommand,k5 as relaySetup,T5 as login,f5 as addApiRoute};