@cortexkit/opencode-anthropic-auth 2.0.3 → 2.1.1

package/dist/index-mdpyfkv3.js

@@ -1,464 +0,0 @@
-import{Se as aY}from"./index-fncp6r0j.js";import{pf as iY}from"./index-rftced5v.js";import{createHash as $U,randomBytes as ZU,randomUUID as JU}from"node:crypto";import{constants as Jz}from"node:fs";import{chmod as XU,mkdir as YU,open as LK,readFile as P9,realpath as zU,rename as GU,stat as qK,unlink as cJ}from"node:fs/promises";import{basename as OK,dirname as e$,extname as Xz,isAbsolute as Yz,join as iJ,resolve as QU}from"node:path";import{readdirSync as zH,statSync as GH}from"node:fs";import{tmpdir as mY,userInfo as QH}from"node:os";import{join as j8}from"node:path";import{debuglog as w5}from"node:util";import{createHmac as P5,randomBytes as C5,timingSafeEqual as F5}from"node:crypto";import T5 from"node:net";var Z$=2,f2=21,v2=5,z4=67108864,i;(function($){$[$.Request=0]="Request",$[$.Response=1]="Response",$[$.Push=2]="Push",$[$.StreamData=3]="StreamData",$[$.StreamEnd=4]="StreamEnd",$[$.Error=5]="Error",$[$.Cancel=6]="Cancel",$[$.Ping=7]="Ping",$[$.Pong=8]="Pong",$[$.Hello=9]="Hello",$[$.HelloAck=10]="HelloAck",$[$.Goodbye=11]="Goodbye"})(i||(i={}));var QY=i.Goodbye;function KY($){return $===i.Cancel||$===i.Ping||$===i.Pong||$===i.Goodbye}var w6;(function($){$[$.Passive=0]="Passive",$[$.Interactive=1]="Interactive",$[$.Background=2]="Background"})(w6||(w6={}));var l6;(function($){$[$.Normal=0]="Normal",$[$.Expedite=1]="Expedite",$[$.Sheddable=2]="Sheddable"})(l6||(l6={}));var WY=1,VY=6,G4=1,j5=8,BY=48,Q4=4;var HY=0;function s6($,Z,J,X=l6.Normal){let Y=0;if($)Y|=WY;if(Y|=Z<<G4,J)Y|=j5;return Y|=X<<Q4,Y}function K4($){return($&WY)!==0}function UY($){let Z=new Uint8Array(21),J=new DataView(Z.buffer);return J.setUint32(0,$.len,!0),Z[4]=$.ver,Z[5]=$.ty,Z[6]=$.flags,J.setUint16(7,$.channel,!0),J.setUint32(9,$.epoch,!0),J.setBigUint64(13,$.corr,!0),Z}class B6 extends Error{code;constructor($,Z){super($);this.code=Z,this.name="DecodeError"}}function R5($){let Z=$.len>>>0,J=$.ver>>>0&255,X=$.ty>>>0&255,Y=$.flags>>>0&255,z=$.channel>>>0&65535,G=$.epoch>>>0;if(BigInt.asUintN(64,$.corr),J!==2)throw new B6(`unsupported envelope version ${J}`,"unsupported_version");if(X>QY)throw new B6(`unknown frame type byte ${X}`,"unknown_frame_type");let Q=X;if((Y&HY)!==0)throw new B6(`reserved flag bits set in flags 0b${Y.toString(2).padStart(8,"0")}`,"reserved_flag_bits");if((Y&VY)>>G4===3)throw new B6(`reserved priority bits set in flags 0b${Y.toString(2).padStart(8,"0")}`,"reserved_priority_bits");let K=(Y&BY)>>Q4;if(K===3)throw new B6(`reserved admission class set in flags 0b${Y.toString(2).padStart(8,"0")}`,"reserved_admission_class");if(K===l6.Sheddable&&Q!==i.Push&&Q!==i.StreamData)throw new B6(`SHEDDABLE admission class is illegal on ${i[Q]} in flags 0b${Y.toString(2).padStart(8,"0")}`,"sheddable_illegal_frame_type");if(z===0&&G!==0)throw new B6(`control channel carried nonzero epoch ${G}`,"nonzero_epoch_on_control_channel");if(KY(Q)&&Z!==0)throw new B6(`pure-header frame ${i[Q]} declared non-zero body length ${Z}`,"pure_header_frame_with_body")}function W4($){if($.length<5)throw new B6(`header shorter than frozen prefix: have ${$.length} bytes`,"too_short_for_prefix");let Z=$[4];if(Z!==2)throw new B6(`unsupported envelope version ${Z}`,"unsupported_version");if($.length<21)throw new B6(`header too short for version: have ${$.length} bytes, need 21`,"too_short_for_header");let J=new DataView($.buffer,$.byteOffset,$.byteLength),X=J.getUint32(0,!0),Y=$[5];if(Y>QY)throw new B6(`unknown frame type byte ${Y}`,"unknown_frame_type");let z=Y,G=$[6];if((G&HY)!==0)throw new B6(`reserved flag bits set in flags 0b${G.toString(2).padStart(8,"0")}`,"reserved_flag_bits");if((G&VY)>>G4===3)throw new B6(`reserved priority bits set in flags 0b${G.toString(2).padStart(8,"0")}`,"reserved_priority_bits");let Q=(G&BY)>>Q4;if(Q===3)throw new B6(`reserved admission class set in flags 0b${G.toString(2).padStart(8,"0")}`,"reserved_admission_class");if(Q===l6.Sheddable&&z!==i.Push&&z!==i.StreamData)throw new B6(`SHEDDABLE admission class is illegal on ${i[z]} in flags 0b${G.toString(2).padStart(8,"0")}`,"sheddable_illegal_frame_type");let K=J.getUint16(7,!0),W=J.getUint32(9,!0);if(K===0&&W!==0)throw new B6(`control channel carried nonzero epoch ${W}`,"nonzero_epoch_on_control_channel");if(KY(z)&&X!==0)throw new B6(`pure-header frame ${i[z]} declared non-zero body length ${X}`,"pure_header_frame_with_body");return{len:X,ver:Z,ty:z,flags:G,channel:K,epoch:W,corr:J.getBigUint64(13,!0)}}function u6($,Z,J,X,Y,z){return k$(2,$,Z,J,X,Y,z)}function k$($,Z,J,X,Y,z,G){if(G.length>67108864)throw new B6(`frame body ${G.length} exceeds max 67108864`,"frame_body_too_large");let Q={len:G.length,ver:$,ty:Z,flags:J,channel:X,epoch:Y,corr:z};return R5(Q),{header:Q,body:G}}function _$($){if($.header.len!==$.body.length)throw new B6(`frame header length ${$.header.len} does not match body length ${$.body.length}`,"frame_length_mismatch");let Z=UY($.header),J=new Uint8Array(Z.length+$.body.length);return J.set(Z,0),J.set($.body,Z.length),J}class a$ extends Error{}class M$ extends Error{}class b$ extends Error{cause;constructor($,Z){super($);this.cause=Z}}class L0 extends Error{cause;constructor($,Z){super($);this.cause=Z}}function NY($){return Buffer.from($.buffer,$.byteOffset,$.byteLength)}var LY=Symbol("subc.socket.writeBorrowed"),qY=Symbol("subc.socket.writeTrackedBorrowed");function j$($,Z,J){let X=$[LY];return X?X.call($,Z,J):$.write(Z,J)}function V4($,Z,J){let X=$[qY];return X?X.call($,Z,J):$.writeTracked(Z,J)}class p0{sock;chunks=[];buffered=0;waiter=null;closedErr=null;bufferedBytes(){return this.buffered}constructor($){this.sock=$,$.on("data",(J)=>{this.chunks.push(J),this.buffered+=J.length,this.tryServe()});let Z=(J)=>{if(!this.closedErr)this.closedErr=J;this.tryServe()};$.on("error",(J)=>Z(J instanceof Error?J:Error(String(J)))),$.on("end",()=>Z(new a$("subc closed the connection"))),$.on("close",()=>Z(new a$("subc connection closed")))}localPort(){return this.sock.localPort??null}static connect($,Z,J){return new Promise((X,Y)=>{let z=T5.connect({host:$,port:Z});z.setNoDelay(!0);let G=setTimeout(()=>{z.destroy(),Y(new M$(`timed out connecting to ${$}:${Z}`))},Math.max(0,J-Date.now()));z.once("connect",()=>{clearTimeout(G),X(new p0(z))}),z.once("error",(Q)=>{clearTimeout(G),Y(Q)})})}async readFrame($,Z,J){let X=await this.readExact(v2,$),Y=X[4];if(Y!==Z$)throw new B6(`unsupported envelope version ${Y}`,"unsupported_version");let z=await this.readExact(f2-v2,$),G=new Uint8Array(f2);G.set(X),G.set(z,v2);let Q=W4(G);if(Q.len>z4)throw new B6(`frame body ${Q.len} exceeds max ${z4}`,"frame_body_too_large");J?.();let K=typeof Z==="number"?Z:Date.now()+Z.afterHeaderMs,W=Q.len===0?new Uint8Array(0):await this.readExact(Q.len,K);return{header:Q,body:W}}readExact($,Z){if(this.waiter)return Promise.reject(Error("concurrent readExact is not supported"));if($===0)return Promise.resolve(new Uint8Array(0));return new Promise((J,X)=>{let Y=null;if(Number.isFinite(Z)){let z=Z-Date.now();if(z<=0){X(new M$(`timed out waiting for ${$} bytes`));return}Y=setTimeout(()=>{this.waiter=null,X(new M$(`timed out waiting for ${$} bytes`))},z)}this.waiter={need:$,resolve:J,reject:X,timer:Y},this.tryServe()})}async write($,Z){await this.writeBuffer(Buffer.from($),Z)}writeTracked($,Z){return this.writeTrackedBuffer(Buffer.from($),Z)}async[LY]($,Z){await this.writeBuffer(NY($),Z)}[qY]($,Z){return this.writeTrackedBuffer(NY($),Z)}async writeBuffer($,Z){try{await this.writeTrackedBuffer($,Z).completed}catch(J){if(J instanceof b$||J instanceof L0)throw J.cause??J;throw J}}writeTrackedBuffer($,Z){if(this.closedErr)return{queued:!1,completed:Promise.reject(new b$("subc socket was closed before bytes could be queued",this.closedErr))};let J=!1,X=!1,Y=null,z=new Promise((G,Q)=>{let K=(V)=>{if(X)return;if(X=!0,Y)clearTimeout(Y);V()},W=Z-Date.now();if(W<=0){K(()=>Q(new b$("timed out before bytes could be queued to subc",new M$("timed out writing to subc"))));return}Y=setTimeout(()=>{let V=new M$("timed out writing to subc");K(()=>Q(J?new L0("timed out after bytes were handed to the subc socket",V):new b$("timed out before bytes could be queued to subc",V)))},W);try{this.sock.write($,(V)=>{K(()=>{if(V)Q(new L0("subc socket reported a write error after bytes were handed to the socket",V instanceof Error?V:Error(String(V))));else G()})}),J=!0}catch(V){K(()=>Q(new b$("subc socket write threw before bytes could be queued",V instanceof Error?V:Error(String(V)))))}});return{queued:J,completed:z}}close(){this.sock.destroy()}tryServe(){let $=this.waiter;if(!$)return;if(this.buffered>=$.need){let Z=this.take($.need);if(this.waiter=null,$.timer)clearTimeout($.timer);$.resolve(Z);return}if(this.closedErr){if(this.waiter=null,$.timer)clearTimeout($.timer);$.reject(this.closedErr)}}take($){let Z=Buffer.allocUnsafe($),J=0;while(J<$){let X=this.chunks[0],Y=$-J;if(X.length<=Y)X.copy(Z,J),J+=X.length,this.chunks.shift();else X.copy(Z,J,0,Y),this.chunks[0]=X.subarray(Y),J+=Y}return this.buffered-=$,Z}}var _Y=32;var y2=4096,MY="subc-server-v1",jY="subc-client-v1",x5="client";class a6 extends Error{}function H4($,Z,J,X,Y){let z=P5("sha256",Buffer.from($));return z.update(Buffer.from(Z,"utf8")),z.update(Buffer.from(J)),z.update(Buffer.from(X)),z.update(Buffer.from(Y)),new Uint8Array(z.digest())}function OY($,Z){if($.length!==Z.length)return!1;return F5(Buffer.from($),Buffer.from(Z))}async function DY($,Z,J){let X=Buffer.from(JSON.stringify(Z),"utf8");if(X.length>y2)throw new a6(`auth message too large: ${X.length} > ${y2}`);let Y=new Uint8Array(4);new DataView(Y.buffer).setUint32(0,X.length,!0),await j$($,Y,J),await j$($,X,J)}async function A5($,Z){let J=await $.readExact(4,Z),X=new DataView(J.buffer,J.byteOffset,4).getUint32(0,!0);if(X>y2)throw new a6(`auth message too large: ${X} > ${y2}`);let Y=X===0?new Uint8Array(0):await $.readExact(X,Z);try{return JSON.parse(Buffer.from(Y).toString("utf8"))}catch(z){throw new a6(`auth message JSON decode failed: ${String(z)}`)}}function B4($,Z){if(!Array.isArray($))throw new a6(`auth field '${Z}' must be a byte array`);for(let J of $)if(typeof J!=="number"||!Number.isInteger(J)||J<0||J>255)throw new a6(`auth field '${Z}' has invalid byte ${String(J)}`);return Uint8Array.from($)}async function W1($,Z,J){let X=new Uint8Array(C5(_Y));await DY($,{client_nonce:Array.from(X),role:x5},J);let Y=await A5($,J),z=B4(Y.server_nonce,"server_nonce"),G=B4(Y.daemon_id,"daemon_id"),Q=B4(Y.server_proof,"server_proof"),K=H4(Z.key,MY,X,z,G);if(!OY(K,Q))throw new a6("server proof mismatch — wrong key or impostor daemon");if(!OY(G,Z.daemonId))throw new a6("daemon id mismatch — connection file points at a different daemon");let W=H4(Z.key,jY,X,z,G);await DY($,{client_auth:Array.from(W)},J)}import{promises as U4}from"node:fs";var RY=1,TY=32,PY=16;class v6 extends Error{}function CY($,Z){if(!Array.isArray($))throw new v6(`connection file field '${Z}' must be a JSON array of bytes`);for(let J of $)if(typeof J!=="number"||!Number.isInteger(J)||J<0||J>255)throw new v6(`connection file field '${Z}' has invalid byte ${String(J)}`);return Uint8Array.from($)}function S5($){if($.schema!==RY)throw new v6(`unsupported connection file schema ${$.schema}; expected ${RY}`);if($.endpoints.length===0)throw new v6("connection file must include at least one endpoint");if($.key.length<TY)throw new v6(`connection file key is too short: ${$.key.length} bytes, need at least ${TY}`);if($.daemonId.length!==PY)throw new v6(`connection file daemon_id must be ${PY} bytes, got ${$.daemonId.length}`)}async function I5($){if(process.platform==="win32")return;let J=(await U4.stat($)).mode&511;if((J&63)!==0)throw new v6(`connection file ${$} has insecure permissions 0o${J.toString(8)}; expected owner-only 0600`)}async function D8($){await I5($);let Z=await U4.readFile($,"utf8"),J;try{J=JSON.parse(Z)}catch(Q){throw new v6(`connection file JSON read failed for ${$}: ${String(Q)}`)}let X=J.wire_version;if(X!==void 0&&X!==Z$)throw new v6(`connection file wire_version ${String(X)} but this client speaks ${Z$}; the client library must be upgraded`);let Y=J.endpoints;if(!Array.isArray(Y))throw new v6("connection file 'endpoints' must be an array");let z=Y.map((Q)=>{let K=Q;if(typeof K.host!=="string"||typeof K.port!=="number")throw new v6("connection file endpoint must be { host: string, port: number }");return{host:K.host,port:K.port}}),G={schema:J.schema,endpoints:z,key:CY(J.key,"key"),daemonId:CY(J.daemon_id,"daemon_id"),pid:J.pid,daemonVer:J.daemon_ver??""};return S5(G),G}var FY=new WeakMap,N4=new WeakMap;class L4 extends Error{methodFamily;code="reverse_request_capability_not_declared";constructor($){super(`reverse-request capability ${JSON.stringify($)} was not registered before route.open`);this.methodFamily=$,this.name="ReverseRequestRegistrationError"}}class q0{handlers=new Map;declaredFamilies=null;onRequest($,Z){if(!E5($))throw TypeError(`reverse-request method family must be a capability identifier, got ${JSON.stringify($)}`);if(typeof Z!=="function")throw TypeError("reverse-request handler must be a function");if(this.declaredFamilies&&!this.declaredFamilies.has($))throw new L4($);this.handlers.set($,Z)}capabilities(){return[...this.handlers.keys()].sort()}handler($){return this.handlers.get($)}seal(){this.declaredFamilies??=new Set(this.handlers.keys())}}class g2{channel;epoch;constructor($,Z,J,X){if(!Number.isInteger($)||$<=0||$>65535)throw RangeError(`route channel must be an integer in 1..65535, got ${$}`);if(!Number.isInteger(Z)||Z<=0||Z>4294967295)throw RangeError(`route epoch must be an integer in 1..4294967295, got ${Z}`);this.channel=$,this.epoch=Z,X.seal(),FY.set(this,J),N4.set(this,X),Object.freeze(this)}onRequest($,Z){N4.get(this).onRequest($,Z)}static create($,Z,J,X){return new g2($,Z,J,X)}}function m2($,Z,J,X=new q0){return g2.create($,Z,J,X)}function xY($,Z){return N4.get($)?.handler(Z)}function E5($){return/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/.test($)}class n$ extends Error{handle;code="stale_route_handle";constructor($){super(`route handle (${$.channel}, ${$.epoch}) is not live on the current connection`);this.handle=$,this.name="StaleRouteHandleError"}}function _8(){return Object.freeze({})}function V1($,Z){return FY.get($)===Z}function h2($,Z){return $===Z}var AY=w5("subc-client"),k5=1e4,M8=30000,b5=50,f5=2000,SY="request_deadline",q4="deadline_exceeded_no_drop_observed",v5=30000,y5=30000,IY=new Uint8Array(0),g5="management_surface",d2="SUBC_MODULE_ID",c2="SUBC_LAUNCH_NONCE",i2={baseMs:100,capMs:2000,maxAttempts:6};class y6 extends Error{kind;code;cause;constructor($,Z,J,X){super(Z);this.kind=$,this.code=J,this.cause=X,this.name="SubcCallError"}get detail(){return this.cause instanceof Y6?this.cause.detail:void 0}}class Y6 extends Error{code;detail;constructor($,Z,J){super($);this.code=Z,this.detail=J}}var EY=new WeakMap;function O4($){if($ instanceof Uint8Array)return $;let Z=$===null?"null":Array.isArray($)?"array":typeof $;throw new Y6(`binary request body must be a Uint8Array; got ${Z}`,"binary_body_required")}class O0{sock;currentConn;opts;nextCorr=1n;pending=new Map;lateResponses=new Map;routes=new Map;liveRoutes=new Map;connectionToken=_8();ingressEpochDropCount=0;closedErr=null;closeStarted=!1;reconnecting=null;generation=1;readerActive=!1;constructor($,Z,J){this.sock=$,this.currentConn=Z,this.opts=J,this.readLoop($,this.generation)}get conn(){return this.currentConn}static async connect($){let Z=p5($),J=await O0.openConnection(Z);return new O0(J.sock,J.conn,Z)}async catalogList($){let Z=this.encode($===void 0?{op:"catalog.list"}:{op:"catalog.list",module_id:$}),J=await this.controlRpc(Z);return this.parseJson(J).modules??[]}async resolveProvider($){let Z=await this.resolveProviders($);if(Z.length===0)throw new Y6(`no catalog claimant for capability ${$}`,"capability_unprovided");if(Z.length>1)throw new Y6(`multiple catalog claimants for capability ${$}: ${Z.join(", ")}`,"capability_ambiguous");return Z[0]}async resolveProviders($){if(!fY($))throw new Y6(`malformed capability identifier ${JSON.stringify($)}`,"invalid_capability_identifier");return(await this.catalogList()).filter((J)=>J.capabilities?.provides.includes($)??!1).map((J)=>J.module_id).sort()}async routeOpen($,Z,J={}){let X=D4(J),Y=J.reverseRequests??new q0;Y.seal();let z=Y.capabilities(),G=this.encode({op:"route.open",target:$,identity:Z,...X?{consumer_identity:X}:{},...z.length>0?{consumer_capabilities:z}:{}}),Q=null,K=(V)=>{if(V.header.ty!==i.Response)return!0;let B=this.parseJson(V);if(typeof B.route_channel!=="number"||typeof B.route_epoch!=="number")throw new Y6(`route.open returned no route handle: ${JSON.stringify(B)}`);return Q=this.installRoute(B.route_channel,B.route_epoch,Y),!0},W=(V)=>{if(V.header.ty!==i.Response)return;try{let B=this.parseJson(V);if(typeof B.route_channel!=="number"||typeof B.route_epoch!=="number")return;let H=this.installRoute(B.route_channel,B.route_epoch);this.failHandle(H,new Y6("late route.open was closed","route_closed")),this.liveRoutes.delete(H.channel),this.sendRouteGoodbye(H,!0)}catch{this.closeConnectionAfterCleanupFailure()}};if(await this.controlRpc(G,K,W),!Q)throw new Y6("route.open response was not installed");return Q}async request($,Z,J={}){this.assertLiveHandle($);let X=J.binary??!1,Y=X?O4(Z):Z instanceof Uint8Array?Z:this.encode(Z),z=J.priority??w6.Interactive,G=J.admissionClass??l6.Normal,Q=await this.send($,Y,z,G,J.timeoutMs,J.onProgress,void 0,void 0,X,J.signal);return this.decodeReply(Q)}async call($,Z,J,X={}){if(X.binary)throw new Y6("call() builds a JSON body and cannot send a binary request; use callBinary(moduleId, body, opts) with a Uint8Array","binary_call_requires_call_binary");let Y=J===void 0?{method:Z}:{method:Z,params:J};return await this.managedCall($,Y,X)}async callBinary($,Z,J={}){let X=O4(Z);return this.managedCall($,X,{...J,binary:!0})}async managedCall($,Z,J){let X=!1;for(;;){let Y=await this.cachedRouteHandle($,J);try{return await this.managedRequest(Y,Z,J)}catch(z){if(!(z instanceof y6))throw this.terminalCallError("managed call failed",z);let G=s2(z.cause instanceof Y6?EY.get(z.cause)??0:0,z.code);if(G&&!X&&!this.closeStarted){X=!0,this.evictRouteHandle(Y);continue}if(G&&X)this.evictRouteHandle(Y);if(z.code==="route_closed")throw this.evictRouteHandle(Y),z;if(z.kind==="not_sent"){if(!this.closedErr)throw z;try{await this.reconnectAfterDrop(z)}catch(Q){throw this.notSentRecoveryError("managed call was not sent",Q)}continue}if(z.kind==="outcome_unknown"&&z.code!==q4){if(this.closedErr)this.scheduleReconnectAfterDrop(z)}else if(z.kind==="outcome_unknown"&&z.code===q4)this.probeLivenessAfterDeadline();throw z}}}subscribe($,Z,J,X={}){this.assertLiveHandle($);let Y=Z instanceof Uint8Array?Z:this.encode(Z),z=X.priority??w6.Interactive,G=X.admissionClass??l6.Normal,Q=this.allocateCorr(),K=p2($,Q),W=null,V=null,B=new Promise((N,O)=>{if(this.closedErr){O(this.closedErr);return}V=N,W={handle:$,resolve:()=>N(),reject:O,onProgress:J,timer:null,subscription:!0},this.pending.set(K,W);let U=u6(i.Request,s6(!1,z,!1,G),$.channel,$.epoch,Q,Y);j$(this.sock,_$(U),Date.now()+M8).catch((D)=>{let _=this.pending.get(K);if(_)this.rejectPending(K,_,D instanceof Error?D:new Y6(String(D)))})}),H=!1;return{unsubscribe:()=>{if(H)return;if(H=!0,W&&V)this.settle(K,W,V);if(this.isLiveHandle($))this.cancel($,Q,z)},closed:B}}attachCancelSignal($,Z,J,X,Y){if(!J)return;let z=()=>{if(!this.pending.has(Z))return;try{this.cancel(J,X,Y)}catch{}};if($.aborted){z();return}$.addEventListener("abort",z,{once:!0});let G=this.pending.get(Z);if(G){let Q=G.onSettle;G.onSettle=()=>{Q?.(),$.removeEventListener("abort",z)}}}cancel($,Z,J=w6.Interactive){this.assertLiveHandle($);let X=u6(i.Cancel,s6(!1,J,!1),$.channel,$.epoch,Z,IY);j$(this.sock,_$(X),Date.now()+M8).catch(()=>{return})}async routePoll($,Z){this.assertLiveHandle($);let J=this.encode({op:"route.poll",route_channel:$.channel,route_epoch:$.epoch,kind:Z}),X=await this.controlRpc(J,(Y)=>{if(Y.header.ty!==i.Response)return!0;let z=this.parseJson(Y);return z.route_channel===$.channel&&z.route_epoch===$.epoch});return this.parseJson(X)}async closeRoute($,Z={}){this.assertLiveHandle($);for(let[J,X]of this.routes)if(X.handle&&h2(X.handle,$))X.closed=!0,X.handle=null,this.routes.delete(J);if(Z.drain)await this.drainUnaryOnHandle($);if(this.failHandle($,new Y6("route closed by closeRoute","route_closed")),this.liveRoutes.get($.channel)===$)this.liveRoutes.delete($.channel);this.sendRouteGoodbye($)}async closeManagedRoute($,Z,J={}){let X=wY($,Z,D4(J),(J.reverseRequests??new q0).capabilities()),Y=this.routes.get(X);if(!Y)return;Y.closed=!0,this.routes.delete(X);let z=Y.handle;if(Y.handle=null,z)await this.closeRoute(z,J)}async closeRouteChannel($,Z={}){await this.closeRoute($,Z)}close(){this.closeStarted=!0,this.fail(new Y6("client closed")),this.sock.close()}drainUnaryOnHandle($){let Z=[];for(let J of this.pending.values())if(J.handle===$&&!J.subscription)Z.push(new Promise((X)=>{let Y=J.onSettle;J.onSettle=()=>{Y?.(),X()}}));return Promise.all(Z).then(()=>{return})}sendRouteGoodbye($,Z=!1){if(this.assertLiveConnection($),this.closedErr){if(Z)this.closeConnectionAfterCleanupFailure();return}let J=u6(i.Goodbye,s6(!1,w6.Interactive,!1),$.channel,$.epoch,0n,IY),X=V4(this.sock,_$(J),Date.now()+M8);if(!X.queued&&Z)this.closeConnectionAfterCleanupFailure();X.completed.catch(()=>{if(Z&&!X.queued)this.closeConnectionAfterCleanupFailure()})}static async openConnection($){let Z=await D8($.connectionFile),J=Date.now()+($.handshakeTimeoutMs??k5),X=Z.endpoints[0],Y=await p0.connect(X.host,X.port,J);try{await W1(Y,Z,J)}catch(z){throw Y.close(),z}return{sock:Y,conn:Z}}async controlRpc($,Z,J){return this.send(null,$,w6.Interactive,l6.Normal,void 0,void 0,Z,J)}send($,Z,J,X,Y,z,G,Q,K=!1,W){if($)this.assertLiveHandle($);if(this.closedErr)return Promise.reject(this.closedErr);let V;try{V=this.allocateCorr()}catch(O){return Promise.reject(O)}let B=p2($,V),H=$?.channel??0,q=$?.epoch??0,N=u6(i.Request,s6(K,J,!1,X),H,q,V,Z);return new Promise((O,U)=>{let D=Y??M8,_={handle:$,resolve:O,reject:U,onProgress:z,timer:null,acceptFrame:G,onLateResponse:Q};if(_.timer=setTimeout(()=>this.arbitrateTimeout(B,_,H,V,D),D),this.pending.set(B,_),W)this.attachCancelSignal(W,B,$,V,J);j$(this.sock,_$(N),Date.now()+D).catch((T)=>{let M=this.pending.get(B);if(M)this.rejectPending(B,M,T instanceof Error?T:new Y6(String(T)))})})}arbitrateTimeout($,Z,J,X,Y){let z=()=>{if(Z.onLateResponse)this.lateResponses.set($,Z.onLateResponse);this.rejectPending($,Z,new Y6(this.timeoutMessage(J,X,Y),SY))},G=Date.now()+this.opts.timeoutArbitrationGraceMs,Q=()=>{if(this.pending.get($)!==Z)return;if((this.readerActive||this.sock.bufferedBytes()>0)&&Date.now()<G){setImmediate(Q);return}z()};setImmediate(Q)}async managedRequest($,Z,J){let X=J.binary??!1,Y=X?O4(Z):Z instanceof Uint8Array?Z:this.encode(Z),z=J.priority??w6.Interactive,G=J.admissionClass??l6.Normal;try{let Q=await this.sendManaged($,Y,z,G,J.timeoutMs,J.onProgress,X,J.signal);return this.decodeReply(Q)}catch(Q){if(Q instanceof y6)throw Q;throw this.terminalCallError("managed call failed",Q)}}sendManaged($,Z,J,X,Y,z,G=!1,Q){try{this.assertLiveHandle($)}catch(q){return Promise.reject(this.notSentCallError("request used a stale route handle",q))}if(this.closedErr)return Promise.reject(this.notSentCallError("request was not sent because the subc connection was already closed",this.closedErr));let K;try{K=this.allocateCorr()}catch(q){return Promise.reject(this.notSentCallError("request correlation allocator was exhausted",q))}let W=p2($,K),V=u6(i.Request,s6(G,J,!1,X),$.channel,$.epoch,K,Z),B=!1,H=(q)=>{if(!B)return this.notSentCallError("request bytes were not queued to the subc socket",q);if(q instanceof Y6&&q.code===SY)return new y6("outcome_unknown",`managed call deadline exceeded after request bytes were queued to the local socket; no terminal response was observed; outcome unknown${B1(q)}`,q4,q);return this.outcomeUnknownCallError("connection dropped before the managed call returned a response",q)};return new Promise((q,N)=>{let O=Y??M8,U={handle:$,resolve:q,reject:N,onProgress:z,timer:null,classifyFailure:H};if(U.timer=setTimeout(()=>this.arbitrateTimeout(W,U,$.channel,K,O),O),this.pending.set(W,U),Q)this.attachCancelSignal(Q,W,$,K,J);let D=V4(this.sock,_$(V),Date.now()+O);B=D.queued,D.completed.catch((_)=>{let T=this.pending.get(W);if(T)this.rejectPending(W,T,_ instanceof Error?_:new Y6(String(_)))})})}async cachedRouteHandle($,Z){let J=Z.identity??this.opts.identity;if(!J)throw new y6("terminal","managed call requires a BindIdentity in SubcClient.connect({ identity }) or call(..., { identity })","missing_identity");let X={kind:Z.targetKind??this.opts.targetKind,module_id:$},Y=D4(Z),z=Z.reverseRequests??new q0;z.seal();let G=wY(X,J,Y,z.capabilities()),Q=this.routes.get(G);if(!Q)Q={key:G,moduleId:$,target:X,identity:J,consumerIdentity:Y,reverseRequests:z,handle:null,opening:null},this.routes.set(G,Q);if(Q.handle&&this.isLiveHandle(Q.handle))return Q.handle;if(!Q.opening)Q.opening=this.openCachedRoute(Q).finally(()=>{Q.opening=null});return Q.opening}async openCachedRoute($){let Z=Date.now()+this.opts.routeOpenRetryDeadlineMs,J=this.opts.reconnectBackoff.baseMs,X=0;for(;;){if($.closed)throw this.routeClosedDuringOpen();try{await this.ensureConnectedForManaged()}catch(Y){throw this.notSentRecoveryError("route.open could not run because reconnect failed",Y)}if($.handle&&this.isLiveHandle($.handle))return $.handle;try{let Y=await this.routeOpen($.target,$.identity,{consumerIdentity:$.consumerIdentity??null,reverseRequests:$.reverseRequests});if($.closed)throw this.liveRoutes.delete(Y.channel),this.sendRouteGoodbye(Y),this.routeClosedDuringOpen();return $.handle=Y,Y}catch(Y){if(Y instanceof y6&&Y.code==="route_closed")throw Y;if(!this.closeStarted&&l2(Y)){try{await this.reconnectAfterDrop(Y)}catch(z){throw this.notSentRecoveryError("route.open was not sent and reconnect failed",z)}continue}if(!this.closeStarted&&Y instanceof Y6&&h5(Y.code)){if(X+=1,Date.now()<Z){await this.opts.sleep(J),J=Math.min(J*2,this.opts.reconnectBackoff.capMs);continue}throw this.notSentCallError(`route.open failed for module ${$.moduleId}: ${Y.code} (retry deadline exhausted after ${X} attempts)`,Y)}throw this.terminalCallError(`route.open failed for module ${$.moduleId}`,Y)}}}lastInboundAtMs=0;livenessProbe=null;hasControlPending(){for(let $ of this.pending.values())if($.handle===null)return!0;return!1}probeLivenessAfterDeadline(){if(this.livenessProbe||this.closeStarted||this.closedErr)return;if(this.hasControlPending())return;let $=this.sock,Z=this.generation,J;try{J=this.allocateCorr()}catch{return}let X=Date.now(),Y=u6(i.Ping,s6(!1,w6.Interactive,!1,l6.Normal),0,0,J,new Uint8Array),z=(async()=>{if(await j$($,_$(Y),X+this.opts.livenessProbeWindowMs).catch(()=>{}),await this.opts.sleep(this.opts.livenessProbeWindowMs),this.sock!==$||this.generation!==Z||this.closeStarted)return;if(this.lastInboundAtMs>=X)return;if(this.hasControlPending())return;this.fail(new a$(`liveness probe convicted a half-open socket: no inbound frame for ${this.opts.livenessProbeWindowMs}ms after a channel-0 Ping (deadline-no-drop settles preceded this); closing so the next call reconnects`)),$.close()})().finally(()=>{this.livenessProbe=null});this.livenessProbe=z}async ensureConnectedForManaged(){if(this.closeStarted)throw new Y6("client closed");if(this.reconnecting)await this.reconnecting;if(this.closedErr)await this.reconnectAfterDrop(this.closedErr)}scheduleReconnectAfterDrop($){if(this.closeStarted||this.reconnecting)return;this.reconnectAfterDrop($).catch(()=>{})}reconnectAfterDrop($){if(this.closeStarted)return Promise.reject(new Y6("client closed"));if(this.reconnecting)return this.reconnecting;let Z=this.reconnectWithRetry($).finally(()=>{if(this.reconnecting===Z)this.reconnecting=null});return this.reconnecting=Z,Z}async reconnectWithRetry($){let Z=0,J=this.opts.reconnectBackoff.baseMs;for(;;){if(this.closeStarted)throw new Y6("client closed");Z+=1;try{let X=await O0.openConnection(this.opts);if(this.closeStarted)throw X.sock.close(),new Y6("client closed");this.replaceConnection(X),await this.reopenCachedRoutes();return}catch(X){if(!l2(X)||Z>=this.opts.reconnectBackoff.maxAttempts){if(X instanceof a6&&Z>1)throw new a6(`reconnect gave up after ${Z} attempts: ${X.message} — the connection file and the daemon's key disagree persistently `+"(daemon restarting in a loop, split connection-file paths, or a genuinely foreign daemon on this port); check the daemon, then restart this host app");throw X}await this.opts.sleep(J),J=Math.min(J*2,this.opts.reconnectBackoff.capMs)}}}replaceConnection($){this.fail(new Y6("subc connection replaced")),this.sock.close(),this.sock=$.sock,this.currentConn=$.conn,this.closedErr=null,this.generation+=1,this.connectionToken=_8(),this.liveRoutes.clear(),this.lateResponses.clear(),this.nextCorr=1n,this.readLoop($.sock,this.generation)}async reopenCachedRoutes(){let $=[...this.routes.keys()];for(let Z of $){let J=this.routes.get(Z);if(J)J.handle=null}for(let Z of $){let J=this.routes.get(Z);if(!J||J.closed)continue;try{let X=await this.routeOpen(J.target,J.identity,{consumerIdentity:J.consumerIdentity??null,reverseRequests:J.reverseRequests});if(J.closed){this.liveRoutes.delete(X.channel),this.sendRouteGoodbye(X);continue}J.handle=X}catch(X){if(m5(X)){this.routes.delete(Z);continue}throw X}}}timeoutMessage($,Z,J){let X=this.sock.localPort();return`request on ${X===null?"channel":`local_port=${X} channel`} ${$} corr ${Z} timed out after ${J}ms`}routeClosedDuringOpen(){return new y6("not_sent","route was closed before route.open completed","route_closed")}async readLoop($,Z){try{for(;;){this.readerActive=!1;let J=await $.readFrame(Number.POSITIVE_INFINITY,{afterHeaderMs:y5},()=>{this.readerActive=!0});try{if(this.sock===$&&this.generation===Z)this.dispatch(J)}finally{this.readerActive=!1}}}catch(J){if(this.sock===$&&this.generation===Z)this.fail(J instanceof Error?J:new Y6(String(J)))}}dispatch($){if(this.lastInboundAtMs=Date.now(),$.header.channel===0&&$.header.ty===i.Push){let z=this.opts.onControlPush;if(z){let G=null;try{let Q=this.parseJson($);if(Q&&typeof Q.op==="string")G={op:Q.op,body:Q}}catch{}if(G)try{z(G)}catch{}}return}let Z=null;if($.header.channel!==0){if(Z=this.liveRoutes.get($.header.channel)??null,!Z||Z.epoch!==$.header.epoch){this.ingressEpochDropCount+=1;return}}if($.header.ty===i.Request&&Z){this.dispatchReverseRequest($,Z);return}let J=p2(Z,$.header.corr),X=this.pending.get(J);if(X){if(X.acceptFrame&&!X.acceptFrame($))return;switch($.header.ty){case i.Push:case i.StreamData:try{X.onProgress?.($.body)}catch{}return;case i.Response:case i.StreamEnd:this.settle(J,X,()=>X.resolve($));return;case i.Error:this.settle(J,X,()=>X.reject(this.errorFromFrame($)));return;default:return}}let Y=this.lateResponses.get(J);if(Y&&($.header.ty===i.Response||$.header.ty===i.Error)){this.lateResponses.delete(J),Y($);return}if($.header.ty===i.Goodbye&&Z){if(this.failHandle(Z,new Y6("route closed by subc (GOODBYE)","route_closed")),this.liveRoutes.get(Z.channel)===Z)this.liveRoutes.delete(Z.channel);this.evictRouteHandle(Z);return}if($.header.ty===i.Response||$.header.ty===i.Error||$.header.ty===i.StreamEnd)AY("dropped terminal frame with no waiter: type=%d channel=%d epoch=%d corr=%s port=%s",$.header.ty,$.header.channel,$.header.epoch,$.header.corr,this.sock.localPort()??"?")}settle($,Z,J){if(this.pending.get($)!==Z)return!1;if(this.pending.delete($),Z.timer)clearTimeout(Z.timer);return J(),Z.onSettle?.(),!0}rejectPending($,Z,J){this.settle($,Z,()=>Z.reject(Z.classifyFailure?.(J)??J))}dispatchReverseRequest($,Z){let J=l5($.body),X=J?.split("/",1)[0],Y=X?xY(Z,X):void 0,z=this.sock,G=this.generation;(async()=>{if(!Y||!J){await this.sendReverseError($,Z,"reverse_request_unhandled",X?`no reverse-request handler is registered for ${X}`:"reverse request has no valid method",z,G);return}let K;try{if(K=await Y($.body,{corr:$.header.corr,method:J}),!(K instanceof Uint8Array))throw TypeError("reverse-request handler must return a Uint8Array")}catch(W){await this.sendReverseError($,Z,"reverse_request_unhandled",W instanceof Error?W.message:String(W),z,G);return}await this.sendReverseReply($,Z,i.Response,K,z,G)})().catch((K)=>{if(this.sock===z&&this.generation===G&&!this.closeStarted)AY("failed to answer reverse request: %s",B1(K))})}async sendReverseError($,Z,J,X,Y,z){await this.sendReverseReply($,Z,i.Error,this.encode({code:J,message:X}),Y,z)}async sendReverseReply($,Z,J,X,Y,z){if(this.sock!==Y||this.generation!==z||!this.isLiveHandle(Z)||this.closeStarted||this.closedErr)return;let G=u6(J,s6(!1,w6.Interactive,!1),Z.channel,Z.epoch,$.header.corr,X);await j$(Y,_$(G),Date.now()+M8)}errorFromFrame($){try{let Z=JSON.parse(Buffer.from($.body).toString("utf8")),J=new Y6(Z.message??"subc error",Z.code,Z.detail);return EY.set(J,$.header.flags),J}catch{return new Y6(Buffer.from($.body).toString("utf8")||"subc error")}}evictRouteHandle($){for(let Z of this.routes.values())if(Z.handle&&h2(Z.handle,$))Z.handle=null}failHandle($,Z){for(let[J,X]of this.pending)if(X.handle&&h2(X.handle,$))this.rejectPending(J,X,Z)}fail($){if(!this.closedErr)this.closedErr=$;for(let[Z,J]of this.pending)this.rejectPending(Z,J,$)}notSentCallError($,Z){return new y6("not_sent",`${$}${B1(Z)}`,u2(Z),Z)}outcomeUnknownCallError($,Z){return new y6("outcome_unknown",`${$}${B1(Z)}`,u2(Z),Z)}terminalCallError($,Z){if(Z instanceof y6)return Z;return new y6("terminal",`${$}${B1(Z)}`,u2(Z),Z)}notSentRecoveryError($,Z){if(Z instanceof y6)return Z;if(l2(Z))return this.notSentCallError($,Z);return this.terminalCallError($,Z)}get droppedIngressFrames(){return this.ingressEpochDropCount}installRoute($,Z,J=new q0){let X=m2($,Z,this.connectionToken,J);return this.liveRoutes.set($,X),X}isLiveHandle($){return V1($,this.connectionToken)&&this.liveRoutes.get($.channel)===$}assertLiveConnection($){if(!V1($,this.connectionToken))throw new n$($)}assertLiveHandle($){if(!this.isLiveHandle($))throw new n$($)}allocateCorr(){let $=0xffffffffffffffffn;if(this.nextCorr>$){let J=new Y6("channel-0 correlation id allocator exhausted","corr_exhausted");throw this.fail(J),this.sock.close(),this.scheduleReconnectAfterDrop(J),J}let Z=this.nextCorr;return this.nextCorr+=1n,Z}closeConnectionAfterCleanupFailure(){let $=new Y6("late route cleanup could not be queued","late_route_cleanup_failed");this.fail($),this.sock.close(),this.scheduleReconnectAfterDrop($)}encode($){return Buffer.from(JSON.stringify($),"utf8")}decodeReply($){return K4($.header.flags)?$.body:this.parseJson($)}parseJson($){let Z=$.body;return JSON.parse(Buffer.from(Z.buffer,Z.byteOffset,Z.byteLength).toString("utf8"))}}function l2($){if($ instanceof a$||$ instanceof M$)return!0;if($ instanceof b$||$ instanceof L0)return!0;if($ instanceof y6)return $.kind==="not_sent"||$.kind==="outcome_unknown";if($ instanceof a6)return!0;if($ instanceof Y6||$ instanceof v6)return!1;let Z=u2($);return Z==="ECONNREFUSED"||Z==="ECONNRESET"||Z==="EPIPE"||Z==="ETIMEDOUT"||Z==="ENOENT"}function m5($){return $ instanceof Y6&&typeof $.code==="string"}function h5($){if($==="capability_forbidden")return!1;return $==="module_reloading"||$==="module_warming"||$==="target_unavailable"||$==="module_timeout"}var kY="unknown_channel",bY="stale_route_epoch";function s2($,Z){return Z===kY||Z===bY}function p5($){return{connectionFile:$.connectionFile,handshakeTimeoutMs:$.handshakeTimeoutMs,identity:$.identity,targetKind:$.targetKind??g5,reconnectBackoff:$.reconnectBackoff??i2,sleep:$.sleep??((Z)=>new Promise((J)=>setTimeout(J,Z))),routeOpenRetryDeadlineMs:$.routeOpenRetryDeadlineMs??v5,timeoutArbitrationGraceMs:$.timeoutArbitrationGraceMs??b5,livenessProbeWindowMs:$.livenessProbeWindowMs??f5,onControlPush:$.onControlPush}}function fY($){if(/\s/u.test($))return!1;let Z=$.indexOf("/v");if(Z<=0||$.indexOf("/v",Z+1)!==-1)return!1;let J=$.slice(0,Z),X=$.slice(Z+2);if(new TextEncoder().encode(J).byteLength>64||X.length===0)return!1;if(!/^[a-z][a-z0-9-]*[a-z0-9]$/u.test(J)&&!/^[a-z]$/u.test(J))return!1;if(J.includes("--"))return!1;if(!/^\d+$/u.test(X)||X.length>1&&X.startsWith("0"))return!1;let Y=Number(X);return Number.isSafeInteger(Y)&&Y>=1&&Y<=4294967295}function wY($,Z,J,X){let Y=J?`${J.module_id}\x00${J.launch_nonce}`:"",z=[...X].sort().join("\x00");return`${$.kind}\x00${$.module_id}\x00${Z.project_root}\x00${Z.harness}\x00${Z.session}\x00${Y}\x00${z}`}function D4($={}){if($.consumerIdentity!==void 0)return $.consumerIdentity??void 0;let Z=process.env[d2],J=process.env[c2];if(!Z||!J)return;return{module_id:Z,launch_nonce:J}}function u2($){if(typeof $==="object"&&$!==null&&"code"in $){let Z=$.code;if(typeof Z==="string")return Z}return}function B1($){if($===void 0)return"";return`: ${$ instanceof Error?$.message:String($)}`}function p2($,Z){return $?`${$.channel}:${$.epoch}:${Z}`:`0:0:${Z}`}function l5($){try{let Z=JSON.parse(Buffer.from($).toString("utf8"));return typeof Z.method==="string"&&Z.method.length>0?Z.method:void 0}catch{return}}import{Buffer as P4}from"node:buffer";var u5=1e4,d5=30000,yY=30000,c5=250,_4=64,R4="health.check",gY=1n,i5=/^[0-9a-f]{32}$/;function T4($){let Z=$.machine_id;return typeof Z==="string"&&i5.test(Z)?Z:void 0}class n2{available;waiters=[];constructor($){if(!Number.isInteger($)||$<=0)throw new U6("provider handler capacity must be a positive integer","invalid_handler_capacity");this.available=$}async acquire(){if(this.available>0)return this.available-=1,this.releaseOnce();return await new Promise(($)=>{this.waiters.push($)}),this.releaseOnce()}releaseOnce(){let $=!1;return()=>{if($)return;$=!0;let Z=this.waiters.shift();if(Z)Z();else this.available+=1}}}class U6 extends Error{code;kind;detail;constructor($,Z,J="terminal",X){super($);this.code=Z,this.kind=J,this.detail=X}}class H1{sock;currentConn;opts;closed;resolveClosed=()=>{return};closeStarted=!1;closedErr=null;inflight=new Map;pending=new Map;liveRoutes=new Map;connectionToken=_8();nextCorr=1n;ingressEpochDropCount=0;requestGate=new n2(_4);reconnecting=null;generation=1;connectionEpoch=1;stateQueue=[];drainingStateQueue=!1;restoredDebounceToken=0;storage;machineId;constructor($,Z,J,X){this.sock=$,this.currentConn=Z,this.opts=J,this.storage=X.storage,this.machineId=T4(X),this.closed=new Promise((Y)=>{this.resolveClosed=Y}),this.readLoop($,this.generation),this.enqueueConnectionState({state:"connected",epoch:this.connectionEpoch})}get droppedIngressFrames(){return this.ingressEpochDropCount}get conn(){return this.currentConn}currentEpoch(){return this.connectionEpoch}async request($,Z,J={}){this.assertLiveHandle($);let X=this.allocateCorr(),Y=a2($,X),z=J.timeoutMs??yY,G=u6(i.Request,s6(!1,J.priority??w6.Interactive,!1,J.admissionClass??l6.Normal),$.channel,$.epoch,X,Z);return await new Promise((Q,K)=>{let W=setTimeout(()=>{if(this.pending.delete(Y))K(new U6("reverse request timed out","request_timeout"))},z);this.pending.set(Y,{resolve:(V)=>Q(V.body),reject:K,timer:W}),this.sendOn(this.sock,this.generation,G).catch((V)=>{let B=this.pending.get(Y);if(!B)return;this.pending.delete(Y),clearTimeout(B.timer),K(V instanceof Error?V:new U6(String(V)))})})}async push($,Z,J={}){this.assertLiveHandle($),await this.sendOn(this.sock,this.generation,u6(i.Push,s6(!1,J.priority??w6.Interactive,!1,J.admissionClass??l6.Normal),$.channel,$.epoch,0n,Z))}cancel($,Z){this.assertLiveHandle($),this.sendOn(this.sock,this.generation,u6(i.Cancel,f$(),$.channel,$.epoch,Z,new Uint8Array(0))).catch(()=>{return})}closeRoute($){this.assertLiveHandle($),this.liveRoutes.delete($.channel),this.abortHandle($),this.sendOn(this.sock,this.generation,u6(i.Goodbye,f$(),$.channel,$.epoch,0n,new Uint8Array(0))).catch(()=>{return})}static async connect($){if($.manifest.protocol_ver!==Z$)throw new U6(`manifest protocol_ver ${$.manifest.protocol_ver} does not match client protocol ${Z$}`,"invalid_manifest");let Z=a5($),J=await H1.openConnection(Z);return new H1(J.sock,J.conn,Z,J.ack)}async close(){if(!this.closeStarted){this.closeStarted=!0,this.cancelRestoredDebounce();let $=this.sock;try{await j4($,u6(i.Goodbye,f$(),0,0,0n,new Uint8Array(0)))}catch{}finally{$.close(),this.finishClosed()}}await this.closed}static async openConnection($,Z){let J=await D8($.connectionFile),X=Date.now()+($.handshakeTimeoutMs??u5),Y=J.endpoints[0],z=await p0.connect(Y.host,Y.port,X);try{Z?.(z),await W1(z,J,X),await j4(z,o5($));let G=await $H(z,X);return{sock:z,conn:J,ack:G}}catch(G){throw z.close(),G}}async readLoop($,Z){try{for(;;){let J=await $.readFrame(Number.POSITIVE_INFINITY,{afterHeaderMs:d5});if(!await this.dispatch(J,$,Z)){if(this.sock===$&&this.generation===Z)this.closeStarted=!0;break}}}catch(J){if(this.sock===$&&this.generation===Z&&!this.closeStarted){this.handleUnexpectedDrop($,Z,J instanceof Error?J:new U6(String(J)));return}}finally{if(this.sock===$&&this.generation===Z){if($.close(),this.closeStarted)this.finishClosed()}}}async dispatch($,Z,J){let X=null;if($.header.channel!==0){if(X=this.liveRoutes.get($.header.channel)??null,!X||X.epoch!==$.header.epoch)return this.ingressEpochDropCount+=1,!0}if(X){let Y=a2(X,$.header.corr),z=this.pending.get(Y);if(z){if($.header.ty===i.Push||$.header.ty===i.StreamData)return!0;if($.header.ty===i.Response||$.header.ty===i.StreamEnd)return this.pending.delete(Y),clearTimeout(z.timer),z.resolve($),!0;if($.header.ty===i.Error)return this.pending.delete(Y),clearTimeout(z.timer),z.reject(s5($)),!0}}switch($.header.ty){case i.Ping:if($.header.channel===0)await this.sendOn(Z,J,k$($.header.ver,i.Pong,$.header.flags,0,0,$.header.corr,new Uint8Array(0)));return!0;case i.Goodbye:if(!X)return!1;return this.liveRoutes.delete(X.channel),this.abortHandle(X),await this.reportRouteGone(X),!0;case i.Cancel:if(X)this.inflight.get(a2(X,$.header.corr))?.abort();return!0;case i.Request:if($.header.channel===0)await this.handleControlRequest($,Z,J);else if(X)this.handleDataRequest($,X,Z,J).catch((Y)=>{if(!this.closeStarted&&this.sock===Z&&this.generation===J)console.warn("SubcProvider handler failed after its request was dispatched",Y)});return!0;default:return!0}}async reportRouteBound($){if(!this.opts.onBound)return;try{await this.opts.onBound($)}catch(Z){console.warn("SubcProvider bound callback failed",Z)}}async reportRouteGone($){if(!this.opts.onRouteGone)return;try{await this.opts.onRouteGone($)}catch(Z){console.warn("SubcProvider route-gone callback failed",Z)}}abortHandle($){let Z=`${$.channel}:${$.epoch}:`;for(let[J,X]of this.inflight)if(J.startsWith(Z))X.abort();for(let[J,X]of this.pending){if(!J.startsWith(Z))continue;this.pending.delete(J),clearTimeout(X.timer),X.reject(new n$($))}}abortGeneration($){this.abortAllInflight();for(let[Z,J]of this.pending)this.pending.delete(Z),clearTimeout(J.timer),J.reject(new U6("provider connection dropped","connection_dropped"));this.liveRoutes.clear()}abortAllInflight(){for(let $ of this.inflight.values())$.abort()}async handleControlRequest($,Z,J){let X=r2($.body);if(X.op===R4){this.handleHealthRequest($,Z,J).catch((B)=>{if(!this.closeStarted&&this.sock===Z&&this.generation===J)console.warn("SubcProvider health handler failed after its request was dispatched",B)});return}if(X.op!=="route.bind")throw new U6(`unsupported module control request ${X.op??"<missing op>"}`);let Y=vY(X.route_channel,"route_channel"),z=vY(X.epoch,"epoch"),G=this.liveRoutes.get(Y);if(G){if(z<=G.epoch){await this.sendError($,"route_rejected",`route.bind epoch ${z} does not supersede installed epoch ${G.epoch} on channel ${Y}`,f$(),Z,J);return}this.liveRoutes.delete(G.channel),this.abortHandle(G),await this.reportRouteGone(G)}let Q=m2(Y,z,this.connectionToken),K={handle:Q,target:X.target,identity:X.identity,principal:X.principal,consumer_capabilities:X.consumer_capabilities},W;try{W=await this.opts.onBind?.(K)}catch(B){try{await this.sendError($,"route_rejected",B instanceof Error?B.message:String(B),f$(),Z,J)}finally{await this.reportRouteGone(Q)}return}let V=ZH(W);if(V){try{await this.sendError($,V.code,V.message,f$(),Z,J)}finally{await this.reportRouteGone(Q)}return}try{await this.sendOn(Z,J,k$($.header.ver,i.Response,f$(),0,0,$.header.corr,o2({op:"route.bind"})))}catch(B){throw await this.reportRouteGone(Q),B}if(this.sock!==Z||this.generation!==J||this.closeStarted||this.closedErr){await this.reportRouteGone(Q);return}this.liveRoutes.set(Q.channel,Q),await this.reportRouteBound(Q)}async handleDataRequest($,Z,J,X){let{corr:Y,ver:z}=$.header,G=a2(Z,Y),Q=new AbortController;this.inflight.set(G,Q);let K={handle:Z,signal:Q.signal,currentEpoch:()=>this.connectionEpoch,emit:async(B,H={})=>{if(this.assertLiveHandle(Z),Q.signal.aborted)return;await this.sendOn(J,X,k$(z,i.StreamData,s6(!1,H.priority??w6.Interactive,!1,H.admissionClass??l6.Normal),Z.channel,Z.epoch,Y,B))}},W=await(this.requestGate??new n2(_4)).acquire(),V=s6(!1,w6.Interactive,!1);try{if(Q.signal.aborted){await this.sendError($,"cancelled","request cancelled",V,J,X);return}let B=await this.opts.handler(Z,$.body,K);if(Q.signal.aborted){await this.sendError($,"cancelled","request cancelled",V,J,X);return}if(this.assertLiveHandle(Z),B===void 0)await this.sendOn(J,X,k$(z,i.StreamEnd,V,Z.channel,Z.epoch,Y,new Uint8Array(0)));else if(B instanceof Uint8Array)await this.sendOn(J,X,k$(z,i.Response,V,Z.channel,Z.epoch,Y,B));else throw new U6("provider handler must return a Uint8Array or void","invalid_handler_response")}catch(B){if(B instanceof n$)return;if(Q.signal.aborted){await this.sendError($,"cancelled","request cancelled",V,J,X);return}await this.sendError($,B instanceof U6&&B.code?B.code:"handler_error",B instanceof Error?B.message:String(B),V,J,X)}finally{if(W(),this.inflight.get(G)===Q)this.inflight.delete(G)}}async handleHealthRequest($,Z,J){let{corr:X,ver:Y}=$.header,z=`control:${J}:${X}`,G=new AbortController;this.inflight.set(z,G);let Q=await(this.requestGate??new n2(_4)).acquire();try{if(G.signal.aborted)return;let K=await this.opts.health();await this.sendOn(Z,J,k$(Y,i.Response,f$(),0,0,X,o2({op:R4,status:K.status,...K.detail===void 0?{}:{detail:K.detail},...K.metrics===void 0?{}:{metrics:K.metrics}})))}catch(K){await this.sendError($,K instanceof U6&&K.code?K.code:"health_error",K instanceof Error?K.message:String(K),f$(),Z,J)}finally{if(Q(),this.inflight.get(z)===G)this.inflight.delete(z)}}async sendError($,Z,J,X,Y,z){if($.header.channel!==0){let G=this.liveRoutes.get($.header.channel);if(!G||G.epoch!==$.header.epoch||!this.isLiveHandle(G))return}await this.sendOn(Y,z,k$($.header.ver,i.Error,X,$.header.channel,$.header.epoch,$.header.corr,o2({code:Z,message:J})))}async sendOn($,Z,J){if(this.sock!==$||this.generation!==Z||this.closeStarted||this.closedErr)return;await j4($,J)}handleUnexpectedDrop($,Z,J){if(this.closeStarted||this.sock!==$||this.generation!==Z)return;if(!this.opts.reconnectOnDrop){this.failFatal(J);return}this.cancelRestoredDebounce(),this.abortGeneration(Z),this.generation+=1,$.close(),this.scheduleReconnectAfterDrop(J,this.generation,$)}scheduleReconnectAfterDrop($,Z,J){if(this.closeStarted)return;let X=this.reconnecting;if(X){if(!this.shouldSupersedeReconnect(X,Z,J))return;X.superseded=!0,X.socket?.close()}let Y={generation:Z,socket:null,socketDied:!1,superseded:!1};this.reconnecting=Y,this.enqueueConnectionState({state:"down",cause:$}),this.reconnectWithRetry(Y).catch((z)=>{if(this.isCurrentReconnect(Y)&&!this.closeStarted)this.failFatal(z instanceof Error?z:new U6(String(z)))}).finally(()=>{if(this.isCurrentReconnect(Y))this.reconnecting=null})}async reconnectWithRetry($){let Z=0,J=this.opts.reconnectBackoff.baseMs;for(;;){if(!this.isCurrentReconnect($))return;if(this.closeStarted)throw new U6("provider closed");$.socket=null,$.socketDied=!1,Z+=1,this.enqueueReconnectState($,Z);try{let X=await H1.openConnection(this.opts,(z)=>{if(!this.isCurrentReconnect($)){z.close();return}$.socket=z});if(!this.isCurrentReconnect($)||this.closeStarted){if(X.sock.close(),this.closeStarted)throw new U6("provider closed");return}let Y=this.replaceConnection(X,$.generation);if(this.reconnecting=null,this.reconnecting!==null)throw new U6("reconnect state must clear before restored","reconnect_state");this.scheduleRestored($.generation,Y);return}catch(X){if(!this.isCurrentReconnect($))return;if($.socket)$.socketDied=!0;if(this.closeStarted)throw X;if(!r5(X))throw X;await this.opts.sleep(J),J=Math.min(J*2,this.opts.reconnectBackoff.capMs)}}}isCurrentReconnect($){return!$.superseded&&this.reconnecting===$&&this.generation===$.generation}shouldSupersedeReconnect($,Z,J){return $.generation<Z||$.socketDied||$.socket===J}enqueueReconnectState($,Z){if(!this.isCurrentReconnect($))return;this.enqueueConnectionState({state:"reconnecting",attempt:Z},$.generation,$)}replaceConnection($,Z){return this.sock.close(),this.sock=$.sock,this.currentConn=$.conn,this.storage=$.ack.storage,this.machineId=T4($.ack),this.closedErr=null,this.connectionEpoch+=1,this.connectionToken=_8(),this.liveRoutes.clear(),this.nextCorr=1n,this.readLoop($.sock,Z),this.connectionEpoch}scheduleRestored($,Z){if(!this.opts.onConnectionState)return;let J=++this.restoredDebounceToken;this.opts.sleep(this.opts.restoredDebounceMs).then(()=>{if(J===this.restoredDebounceToken&&!this.closeStarted&&this.sock&&this.generation===$&&this.connectionEpoch===Z)this.enqueueConnectionState({state:"restored",epoch:Z},$)}).catch((X)=>{if(J===this.restoredDebounceToken&&!this.closeStarted)console.warn("SubcProvider restored debounce timer failed",X)})}cancelRestoredDebounce(){this.restoredDebounceToken+=1}enqueueConnectionState($,Z,J){if(!this.opts.onConnectionState)return;if(this.stateQueue.push({event:$,generation:Z,reconnect:J}),!this.drainingStateQueue)this.drainConnectionStateQueue()}async drainConnectionStateQueue(){if(this.drainingStateQueue)return;this.drainingStateQueue=!0;try{while(this.stateQueue.length>0){let $=this.stateQueue[0];if(this.closeStarted||$.generation!==void 0&&$.generation!==this.generation||$.reconnect?.superseded){this.stateQueue.shift();continue}let{event:Z}=$;try{await this.opts.onConnectionState?.(Z),this.stateQueue.shift()}catch(J){if(Z.state==="restored"){console.warn("SubcProvider restored callback failed; retrying delivery",J),await e5();continue}console.warn("SubcProvider connection-state callback failed",J),this.stateQueue.shift()}}}finally{if(this.drainingStateQueue=!1,this.stateQueue.length>0)this.drainConnectionStateQueue()}}isLiveHandle($){return V1($,this.connectionToken)&&this.liveRoutes.get($.channel)===$}assertLiveHandle($){if(!this.isLiveHandle($))throw new n$($)}allocateCorr(){let $=0xffffffffffffffffn;if(this.nextCorr>$){let J=new U6("channel-0 correlation id allocator exhausted","corr_exhausted");throw this.handleUnexpectedDrop(this.sock,this.generation,J),J}let Z=this.nextCorr;return this.nextCorr+=1n,Z}failFatal($){if(!this.closedErr)this.closedErr=$;this.closeStarted=!0,this.cancelRestoredDebounce(),this.abortAllInflight(),this.sock.close(),this.finishClosed()}finishClosed(){this.resolveClosed()}}function a2($,Z){return`${$.channel}:${$.epoch}:${Z}`}function s5($){try{let Z=r2($.body);return new U6(Z.message??"subc error",Z.code,s2($.header.flags,Z.code)?"not_sent":"terminal",Z.detail)}catch{return new U6(P4.from($.body).toString("utf8")||"subc error")}}function M4($){return $&&$.length>0?$:void 0}function a5($){let Z=M4(process.env[d2]),J=M4(process.env[c2]),X=Z!==void 0&&J!==void 0;return{connectionFile:$.connectionFile,manifest:$.manifest,handler:$.handler,health:$.health??(()=>({status:"ok"})),handshakeTimeoutMs:$.handshakeTimeoutMs,controlOps:$.controlOps,onBind:$.onBind,onBound:$.onBound,onRouteGone:$.onRouteGone,reconnectBackoff:$.reconnectBackoff??i2,sleep:$.sleep??((Y)=>new Promise((z)=>setTimeout(z,Y))),restoredDebounceMs:$.restoredDebounceMs??c5,onConnectionState:$.onConnectionState,launchNonce:M4($.launchNonce??J),reconnectOnDrop:$.reconnectOnDrop??!X}}function n5($){if($===null)return null;let Z=new Set($??[]);return Z.add(R4),[...Z]}function o5($){let Z=$.launchNonce;return u6(i.Hello,f$(),0,0,gY,o2({manifest:JH($.manifest),protocol_ver:Z$,control_ops:n5($.controlOps),...Z?{launch_nonce:Z}:{}}))}function r5($){if($ instanceof U6)return $.code==="duplicate_module_id";if($ instanceof a$||$ instanceof M$)return!0;if($ instanceof b$||$ instanceof L0)return!0;if($ instanceof a6)return!0;if($ instanceof v6)return!1;let Z=t5($);return Z==="ECONNREFUSED"||Z==="ECONNRESET"||Z==="EPIPE"||Z==="ETIMEDOUT"||Z==="ENOENT"}function t5($){if(typeof $==="object"&&$!==null&&"code"in $){let Z=$.code;if(typeof Z==="string")return Z}return}async function e5(){await new Promise(($)=>setTimeout($,0))}function f$(){return s6(!1,w6.Passive,!1)}async function j4($,Z){await j$($,_$(Z),Date.now()+yY)}async function $H($,Z){let J=await $.readFrame(Z,Z);switch(J.header.ty){case i.HelloAck:{let X=r2(J.body);if(X.negotiated_ver!==Z$)throw new U6(`subc negotiated protocol ${X.negotiated_ver}; expected exactly ${Z$}`,"unsupported_version");return X}case i.Error:{let X=r2(J.body);throw new U6(`subc rejected HELLO: ${X.code??"unknown"} — ${X.message??"subc error"}`,X.code)}default:throw new U6(`unexpected frame ${i[J.header.ty]} awaiting HELLO_ACK`)}}function o2($){return new Uint8Array(P4.from(JSON.stringify($),"utf8"))}function r2($){return JSON.parse(P4.from($).toString("utf8"))}function vY($,Z){if(typeof $!=="number"||!Number.isInteger($))throw new U6(`route.bind ${Z} must be an integer`);return $}function ZH($){if($===void 0||$===!0)return null;if($===!1)return{code:"route_rejected",message:"route.bind rejected by provider"};if($.accept)return null;return{code:$.code??"route_rejected",message:$.message??"route.bind rejected by provider"}}function JH($){return{module_id:$.module_id,module_version:$.module_version,protocol_ver:$.protocol_ver,trust_tier:$.trust_tier,provides:$.provides.map(XH),consumes:$.consumes.map(YH),bindings:{storage:{kind:$.bindings.storage.kind,scope:$.bindings.storage.scope,owns_schema:$.bindings.storage.owns_schema},vault_grants:$.bindings.vault_grants.map((Z)=>({secret:Z.secret,reason:Z.reason})),identity:{requires:[...$.bindings.identity.requires],optional:[...$.bindings.identity.optional]}}}}function XH($){switch($.role){case"tool_provider":return{role:"tool_provider",tools:$.tools.map((Z)=>({name:Z.name,...Z.description===void 0?{}:{description:Z.description},execution_mode:Z.execution_mode,schema:Z.schema})),identity_scope:[...$.identity_scope],concurrency:$.concurrency,emits_push:$.emits_push,sub_supervises:$.sub_supervises};case"pipeline_stage":return{role:"pipeline_stage",stage:$.stage,applies_to:{provider:$.applies_to.provider,model:$.applies_to.model},interface:$.interface,declares_frozen_floor:$.declares_frozen_floor,needs_signals:[...$.needs_signals],conformance_class:$.conformance_class};case"management_surface":return{role:"management_surface",operations:$.operations.map((Z)=>({name:Z.name,kind:Z.kind})),config_schema:$.config_schema,observability:$.observability.map((Z)=>({name:Z.name,kind:Z.kind})),identity_scope:[...$.identity_scope],concurrency:$.concurrency};case"internal_service":return{role:"internal_service",service_id:$.service_id,transport:$.transport,agent_facing:$.agent_facing,operations:[...$.operations]}}}function YH($){switch($.role){case"tool_client":return{role:"tool_client",of:[...$.of]};case"llm_client":return{role:"llm_client",via:$.via,auth:$.auth};case"service_client":return{role:"service_client",of:[...$.of]}}}var e2="subc-connection.json",hY="subc-",pY=".connection.json";function lY(){let $=process.env.HOME;return $?j8($,".local","share","cortexkit","run",e2):void 0}function KH(){let $=process.env.XDG_RUNTIME_DIR;if($)return j8($,e2);let Z=lY();if(Z)return Z;return j8(QH().homedir,".local","share","cortexkit","run",e2)}function WH(){if(process.env.SUBC_CONNECTION_FILE)return process.env.SUBC_CONNECTION_FILE;let $=process.env.XDG_RUNTIME_DIR;if($){let Y=j8($,e2);if(t2(Y))return Y}let Z=lY();if(Z&&t2(Z))return Z;let J=j8(mY(),`${hY}${VH()}${pY}`);if(t2(J))return J;let X=BH(mY());return X.length===1?X[0]:void 0}function VH($=process.getuid??null,Z=process.env){if($)return String($());for(let J of["USER","USERNAME","HOME","USERPROFILE"]){let X=Z[J];if(X)return Array.from(X,(Y)=>/^[a-zA-Z0-9_-]$/.test(Y)?Y:"_").join("")}return"unknown"}function uY(){return WH()??KH()}function C4($){return $?.trim()||process.env.SUBC_CONNECTION_FILE||process.env.CLAUSTRUM_SUBC_CONNECTION?.trim()||uY()}function t2($){try{return GH($).isFile()}catch{return!1}}function BH($){let Z;try{Z=zH($)}catch{return[]}let J=[];for(let X of Z){if(typeof X!=="string")continue;if(!X.startsWith(hY)||!X.endsWith(pY))continue;let Y=j8($,X);if(t2(Y))J.push(Y)}return J.sort(),J}import{createHash as HH}from"node:crypto";import{existsSync as UH,realpathSync as dY}from"node:fs";import{dirname as NH,relative as LH,resolve as qH}from"node:path";function cY($){let Z=$,J;try{J=dY(Z)}catch(X){if(X.code!=="ENOENT")throw X;let Y=Z;while(!UH(Y)){let z=NH(Y);if(z===Y)break;Y=z}J=qH(dY(Y),LH(Y,Z))}return HH("sha256").update(J).digest("hex")}function $Z($,Z){return{project_root:$,harness:"opencode",session:`store-${cY(Z)}`}}import*as D0 from"node:fs/promises";import{win32 as sY}from"node:path";async function U1($){let Z;try{Z=await import("./index-vjehtqnb.js")}catch(J){throw Error("@cortexkit/private-files is unavailable; refusing the Windows private operation",{cause:J})}try{return await $(Z)}catch(J){if(J instanceof Z.PrivateFilesUnavailableError)throw Error(`@cortexkit/private-files native addon is unavailable; refusing the Windows private operation: ${J.message}`,{cause:J});throw J}}function OH($,Z){return{ok:!1,reason:Z,path:$}}function DH($){return $?.code==="ENOENT"}async function _H($,Z){let J=$,X=!1;try{if(!$||$.includes("\x00")||!sY.isAbsolute($))throw Error("expected an absolute Windows path");for(;;){let Y;try{Y=await Z.lstat(J)}catch(z){if(!DH(z))throw z;let G=sY.dirname(J);if(G===J)throw z;J=G,X=!0;continue}if(X&&!Y.isDirectory())throw Error("nearest existing ancestor is not a directory");return await U1((z)=>z.verifyPrivatePath(J,Y.isDirectory()?"directory":"file")),{ok:!0}}}catch(Y){return OH(J,`Windows private-path verification refused: ${Y instanceof Error?Y.message:String(Y)}`)}}async function l0($,Z={}){let J={realpath:D0.realpath,lstat:D0.lstat,stat:D0.stat,readFile:D0.readFile,...Z.fs};if((Z.platform??process.platform)==="win32")return _H($,J);return aY($,Z)}import{mkdir as MH,open as jH,realpath as RH,rmdir as TH}from"node:fs/promises";import{dirname as F4}from"node:path";var PH="sticky ancestor without an owner-only child";function x4($){return Error(`Private creation refused: ${$.reason}: ${$.path}`)}async function CH($){let Z=await l0(F4($));if(!Z.ok)throw x4(Z)}async function ZZ($,Z=""){if(process.platform==="win32")return U1((X)=>X.createPrivateFile($,Z));await CH($);let J=await jH($,"wx",384);try{await J.writeFile(Z)}finally{await J.close()}}async function JZ($){if(process.platform==="win32")return U1((Y)=>Y.createPrivateDirectory($));let Z=await l0(F4($)),J=!1;if(!Z.ok){if(J=Z.reason===PH&&Z.path===await RH(F4($)).catch(()=>{return}),!J)throw x4(Z)}if(await MH($,{mode:448}),!J)return;let X=await l0($);if(!X.ok)throw await TH($).catch(()=>{return}),x4(X)}import{AsyncLocalStorage as FH}from"node:async_hooks";import{stat as nY}from"node:fs/promises";import{dirname as xH,resolve as AH}from"node:path";var SH=new FH,XZ=($,Z)=>l0(AH($),SH.getStore()??Z);function YZ($,Z){return`${$} ${Z.path} is not private: ${Z.reason}`}function zZ($){let Z=$;if(Z?.code==="ERR_PRIVATE_FILES_SECURITY"&&Z.reason==="io-error"){if(Z.win32Code===80||Z.win32Code===183)return"EEXIST";if(Z.win32Code===2||Z.win32Code===3)return"ENOENT"}return Z?.code}async function GZ($){try{await nY($);return}catch(J){if(J.code!=="ENOENT")throw J}let Z=xH($);if(Z!==$)await GZ(Z);try{await JZ($)}catch(J){if(zZ(J)!=="EEXIST")throw J;if(!(await nY($)).isDirectory())throw J}}import{randomBytes as IH}from"node:crypto";import{open as EH,rename as wH,unlink as kH}from"node:fs/promises";import{basename as bH,dirname as fH,join as vH,resolve as yH}from"node:path";var gH=/^[0-9a-f]{64}$/;function mH($){if(!gH.test($.token))throw Error("enrollment token must be exactly 64 lowercase hex characters");if(!Number.isSafeInteger($.token_generation)||$.token_generation<1)throw Error("enrollment token generation must be a positive safe integer")}async function oY($){let Z=await XZ($);if(!Z.ok)throw Error(YZ("enrollment token folder",Z))}async function u0($,Z){mH(Z),$=yH($);let J=fH($);if(process.platform!=="win32")await oY(J);await GZ(J),await oY(J);let X=vH(J,`.${bH($)}.${process.pid}.${IH(12).toString("hex")}.tmp`),Y=!1;try{Y=!0;try{await ZZ(X,`${JSON.stringify(Z)}
-`)}catch(G){if(zZ(G)==="EEXIST")Y=!1;throw G}let z=await EH(X,"r+");try{await z.sync()}finally{await z.close()}await wH(X,$),Y=!1}finally{if(Y)await kH(X).catch(()=>{return})}}var rY=["transient","permanent","auth_required","context_overflow"];class t6 extends Error{code;action;["class"];constructor($,Z,J){super(`Claustrum credential request failed: ${$}`);this.code=$,this.action=J,this.name="ClaustrumCredentialError",this.class=Z}}function R8($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function tY($){switch($){case"permanent":return"gone";case"auth_required":return"reauth";case"context_overflow":return"reduce_and_retry";case"transient":return"retry"}}function z6($,Z="invalid_response",J=(X)=>console.warn(X)){let X=R8($)&&R8($.result)?$.result:void 0,Y=X&&R8(X.error)?X.error:void 0,z=Y?.class,G=Y?.code,Q=typeof z==="string"&&rY.includes(z),K=typeof G==="string",V=Q&&K?z:"transient";if(typeof z!=="string")J("unknown");else if(!Q)J(z);return new t6(K?G:Z,V,tY(V))}function d0($){return R8($)&&R8($.result)&&R8($.result.error)}var eY="claustrum",lH=60000;function J$($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function S4($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0?$:void 0}function v$($){return $===void 0||typeof $==="string"}function $z($,Z){if(d0($))throw z6($,"invalid_response",Z);let J=J$($)&&J$($.result)?$.result:void 0,X=J?.payload;if(!Array.isArray(X)||X.length===0||!X.every((q)=>typeof q==="number"&&Number.isInteger(q)&&q>=0&&q<=255))throw z6($,"invalid_response",Z);let Y=S4(J?.record_version);if(Y===void 0)throw z6($,"invalid_record_version",Z);let z=J?.expires_at_ms,G=z===void 0||z===null?null:typeof z==="number"&&Number.isFinite(z)?z:void 0;if(G===void 0)throw z6($,"invalid_expiry",Z);let Q=J?.credential_id,K=J?.project_id,W=J?.account_id,V=J?.email,B=J?.org_name;if(!v$(Q)||!v$(K)||!v$(W)||!v$(V)||!v$(B))throw z6($,"invalid_response",Z);let H;try{H=new TextDecoder("utf-8",{fatal:!0}).decode(Uint8Array.from(X))}catch{throw z6($,"invalid_response",Z)}return{material:H,recordVersion:Y,expiresAtMs:G,credentialId:Q,projectId:K,accountId:W,email:V,orgName:B}}function uH($,Z){if(d0($))throw z6($,"invalid_response",Z);let J=J$($)&&J$($.result)?$.result:void 0,X=J?.record_version,Y=X===void 0?void 0:S4(X),z=J?.credential_id;if(typeof J?.ready!=="boolean"||J?.last_error_code!==void 0&&J?.last_error_code!==null&&typeof J?.last_error_code!=="string"||typeof J?.lease_held!=="boolean"||X!==void 0&&Y===void 0||!v$(z)||J?.stale_pending!==void 0&&typeof J.stale_pending!=="boolean")throw z6($,"invalid_status",Z);return{ready:J.ready,lastErrorCode:J.last_error_code??null,leaseHeld:J.lease_held,...z===void 0?{}:{credentialId:z},...Y===void 0?{}:{recordVersion:Y},...J.stale_pending===void 0?{}:{stalePending:J.stale_pending}}}class y${#$;#Z;#z;#J;#K;#Y;#X=null;#W=0;#V=!1;constructor($,Z,J,X,Y,z){this.#$=$,this.#Z=Z,this.#z=J,this.#J=X,this.#K=Y,this.#Y=z}static async connect($={}){let Z=C4($.connectionFile),J=$.connector??((z)=>O0.connect(z)),X=$.identity??$Z($.projectRoot??process.cwd(),$.storagePath??process.cwd()),Y=await J({connectionFile:Z,handshakeTimeoutMs:$.handshakeTimeoutMs});return new y$(Y,J,Z,$.handshakeTimeoutMs,X,$.logger??((z)=>console.warn(z)))}async getCredential($,Z){let J=await this.#Q("credential.get",{handle:$,min_ttl_ms:Z,force_refresh:!1});return $z(J,this.#Y)}async statusCredential($){let Z=await this.#Q("credential.status",{handle:$});return uH(Z,this.#Y)}async reportAuthFailure($){let Z=await this.#Q("credential.report_auth_failure",{handle:$.handle,provider_status:$.providerStatus,record_version:$.recordVersion,reporter_source:$.reporterSource});if(d0(Z))throw z6(Z,"invalid_response",this.#Y);if((J$(Z)&&J$(Z.result)?Z.result:void 0)?.accepted!==!0)throw z6(Z,"invalid_response",this.#Y)}async listScoped($){let Z=await this.#Q("credential.list_scoped",$===void 0?{}:{enrollment_token:$});return dH(Z,this.#Y)}async getScoped($){let Z=await this.#Q("credential.get_scoped",{credential_id:$.credentialId,enrollment_token:$.enrollmentToken,min_ttl_ms:$.minTtlMs});return $z(Z,this.#Y)}async reportAuthFailureScoped($){let Z=await this.#Q("credential.report_auth_failure",{credential_id:$.credentialId,enrollment_token:$.enrollmentToken,provider_status:$.providerStatus,record_version:$.recordVersion,reporter_source:$.reporterSource});if(d0(Z))throw z6(Z,"invalid_response",this.#Y);if((J$(Z)&&J$(Z.result)?Z.result:void 0)?.accepted!==!0)throw z6(Z,"invalid_response",this.#Y)}async enrollPropose($){let Z=await this.#Q("auth.enroll_propose",{proposed_name:$.name,request_secret_hash:$.requestSecretHash}),X=A4(Z,this.#Y).request_id;if(typeof X!=="string"||X.length===0)throw z6(Z,"invalid_response",this.#Y);return{requestId:X}}async enrollPoll($){let Z=await this.#Q("auth.enroll_poll",{request_id:$.requestId,request_secret:$.requestSecret});return cH(Z,this.#Y)}async enrollRotate($){let Z=await this.#Q("auth.enroll_rotate",{token:$.token,expected_token_generation:$.expectedTokenGeneration}),J=A4(Z,this.#Y),X=J.token,Y=J.token_generation;if(typeof X!=="string"||X.length===0||typeof Y!=="number"||!Number.isInteger(Y)||Y<0)throw z6(Z,"invalid_response",this.#Y);return{token:X,tokenGeneration:Y}}close(){this.#V=!0,this.#$.close()}async#Q($,Z){let J=this.#$;try{return await J.call(eY,$,Z,{identity:this.#K,consumerIdentity:null})}catch(X){if(this.#B(X)){try{if(this.#$===J)await this.#H()}catch(Y){throw this.#G(Y)}try{return await this.#$.call(eY,$,Z,{identity:this.#K,consumerIdentity:null})}catch(Y){throw this.#G(Y)}}throw this.#G(X)}}#G($){if($ instanceof t6)return $;let Z=$ instanceof y6&&$.code?$.code:"transport_error";return new t6(Z,"transient","retry")}#B($){return!this.#V&&$ instanceof y6&&$.kind==="terminal"&&$.code!=="missing_identity"&&$.code!=="invalid_control_body"&&$.code!=="unknown_module"}async#H(){if(this.#V)throw Error("Claustrum client is closed");if(this.#X){await this.#X;return}let $=Date.now();if($<this.#W)throw Error("Claustrum client reconnect is backed off");this.#W=$+lH,this.#X=this.#Z({connectionFile:this.#z,handshakeTimeoutMs:this.#J}).then((Z)=>{if(this.#V)throw Z.close(),Error("Claustrum client is closed");let J=this.#$;this.#$=Z,J.close()}).finally(()=>{this.#X=null}),await this.#X}}function dH($,Z){if(d0($))throw z6($,"invalid_response",Z);let J=J$($)&&J$($.result)?$.result:void 0,X=J?.credentials;if(!Array.isArray(X))throw z6($,"invalid_response",Z);let Y=J?.view;if(typeof Y!=="string"||Y.length===0)throw z6($,"invalid_response",Z);return{rows:X.map((G)=>{if(!J$(G))throw z6($,"invalid_response",Z);let Q=S4(G.record_version);if(Q===void 0)throw z6($,"invalid_record_version",Z);let K=(q)=>{if(!Array.isArray(q)||!q.every((N)=>typeof N==="string"))throw z6($,"invalid_response",Z);return q};if(typeof G.id!=="string"||typeof G.type!=="string"||typeof G.state!=="string")throw z6($,"invalid_response",Z);let W=G.created_at_ms===void 0||G.created_at_ms===null?null:typeof G.created_at_ms==="number"&&Number.isFinite(G.created_at_ms)?G.created_at_ms:void 0;if(W===void 0)throw z6($,"invalid_response",Z);let V=G.plan_tier;if(V!==void 0&&(typeof V!=="string"||!/^[a-z][a-z0-9_]{0,31}(?![\s\S])/.test(V)))throw z6($,"invalid_response",Z);let{auth_method:B,plan_tier_source:H}=G;if(H!==void 0&&H!=="operator"&&H!=="detected")throw z6($,"invalid_response",Z);if(B!==void 0&&B!=="apikey"&&B!=="chatgpt"&&B!=="antigravity"&&B!=="oauth")throw z6($,"invalid_response",Z);if(!v$(G.refresh_adapter))throw z6($,"invalid_response",Z);if(!v$(G.account_id)||!v$(G.email)||!v$(G.org_name))throw z6($,"invalid_response",Z);return{id:G.id,categories:K(G.categories),credentialType:G.type,serves:K(G.serves),providerIds:G.provider_ids===void 0?[]:K(G.provider_ids),authMethod:B,planTier:V,planTierSource:H,state:G.state,refreshAdapter:G.refresh_adapter,recordVersion:Q,operations:K(G.operations),createdAtMs:W,accountId:G.account_id,email:G.email,orgName:G.org_name}}),view:Y}}function A4($,Z){if(d0($))throw z6($,"invalid_response",Z);let J=J$($)&&J$($.result)?$.result:void 0;if(J===void 0)throw z6($,"invalid_response",Z);return J}function cH($,Z){let J=A4($,Z),X=J.status;if(X==="pending")return{status:"pending"};if(X==="denied")return{status:"denied"};if(X!=="approved")throw z6($,"invalid_response",Z);let{name:Y,token:z,token_generation:G}=J;if(typeof Y!=="string"||typeof z!=="string"||z.length===0||typeof G!=="number"||!Number.isInteger(G))throw z6($,"invalid_response",Z);return{status:"approved",name:Y,token:z,tokenGeneration:G}}import{randomUUID as zz}from"node:crypto";import{mkdir as KU,open as $7,rename as WU,rm as VU}from"node:fs/promises";import{dirname as C9}from"node:path";import{randomUUID as BU}from"node:crypto";import{lstat as DK,readFile as _K,rename as HU,unlink as Gz}from"node:fs/promises";import{dirname as I0,resolve as q$}from"node:path";import{randomUUID as QZ}from"node:crypto";import{mkdir as Vz,open as TK,readFile as Bz,rename as Hz,rm as KZ,stat as Uz}from"node:fs/promises";import{dirname as I4,join as Nz}from"node:path";import{spawn as SU}from"node:child_process";import{accessSync as EU,constants as wU,existsSync as kU,readFileSync as bU,realpathSync as fU,statSync as vU}from"node:fs";import{mkdtemp as yU,rm as gU}from"node:fs/promises";import{tmpdir as mU}from"node:os";import{join as hU}from"node:path";import{parse as pU}from"jsonc-parser";import{homedir as lU}from"node:os";import{posix as uU,win32 as dU}from"node:path";import{fileURLToPath as cU}from"node:url";import{setTimeout as oU}from"node:timers/promises";import{applyEdits as A9,createScanner as KN,findNodeAtLocation as WN,modify as Tz,parse as VN,parseTree as BN}from"jsonc-parser";import{randomUUID as MN}from"node:crypto";import{mkdir as jN,open as RN,rename as TN,stat as PN,unlink as CN}from"node:fs/promises";import{basename as FN,dirname as xN,join as AN}from"node:path";import{setTimeout as SN}from"node:timers/promises";import{createHash as PI,randomUUID as w4}from"node:crypto";import{mkdir as gN,readFile as k4,rename as mN,rm as q1,stat as xz,writeFile as b4}from"node:fs/promises";import{homedir as hN}from"node:os";import{dirname as pN,join as c8}from"node:path";import{readdirSync as lN,statSync as uN}from"node:fs";import*as yK from"node:fs/promises";import{tmpdir as dN,userInfo as S9}from"node:os";import{join as r1}from"node:path";import{createHash as sL}from"node:crypto";var iH=new Uint8Array([0,97,115,109,1,0,0,0,1,48,8,96,3,127,127,127,1,127,96,3,127,127,127,0,96,2,127,127,0,96,1,127,1,127,96,3,127,127,126,1,126,96,3,126,127,127,1,126,96,2,127,126,0,96,1,127,1,126,3,11,10,0,0,2,1,3,4,5,6,1,7,5,3,1,0,1,7,85,9,3,109,101,109,2,0,5,120,120,104,51,50,0,0,6,105,110,105,116,51,50,0,2,8,117,112,100,97,116,101,51,50,0,3,8,100,105,103,101,115,116,51,50,0,4,5,120,120,104,54,52,0,5,6,105,110,105,116,54,52,0,7,8,117,112,100,97,116,101,54,52,0,8,8,100,105,103,101,115,116,54,52,0,9,10,251,22,10,242,1,1,4,127,32,0,32,1,106,33,3,32,1,65,16,79,4,127,32,3,65,16,107,33,6,32,2,65,168,136,141,161,2,106,33,3,32,2,65,137,235,208,208,7,107,33,4,32,2,65,207,140,162,142,6,106,33,5,3,64,32,3,32,0,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,3,32,4,32,0,65,4,106,34,0,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,4,32,2,32,0,65,4,106,34,0,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,2,32,5,32,0,65,4,106,34,0,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,5,32,6,32,0,65,4,106,34,0,79,13,0,11,32,2,65,12,119,32,5,65,18,119,106,32,4,65,7,119,106,32,3,65,1,119,106,5,32,2,65,177,207,217,178,1,106,11,32,1,106,32,0,32,1,65,15,113,16,1,11,146,1,0,32,1,32,2,106,33,2,3,64,32,1,65,4,106,32,2,75,69,4,64,32,0,32,1,40,2,0,65,189,220,202,149,124,108,106,65,17,119,65,175,214,211,190,2,108,33,0,32,1,65,4,106,33,1,12,1,11,11,3,64,32,1,32,2,79,69,4,64,32,0,32,1,45,0,0,65,177,207,217,178,1,108,106,65,11,119,65,177,243,221,241,121,108,33,0,32,1,65,1,106,33,1,12,1,11,11,32,0,32,0,65,15,118,115,65,247,148,175,175,120,108,34,0,65,13,118,32,0,115,65,189,220,202,149,124,108,34,0,65,16,118,32,0,115,11,63,0,32,0,65,8,106,32,1,65,168,136,141,161,2,106,54,2,0,32,0,65,12,106,32,1,65,137,235,208,208,7,107,54,2,0,32,0,65,16,106,32,1,54,2,0,32,0,65,20,106,32,1,65,207,140,162,142,6,106,54,2,0,11,195,4,1,6,127,32,1,32,2,106,33,6,32,0,65,24,106,33,4,32,0,65,40,106,40,2,0,33,3,32,0,32,0,40,2,0,32,2,106,54,2,0,32,0,65,4,106,34,5,32,5,40,2,0,32,2,65,16,79,32,0,40,2,0,65,16,79,114,114,54,2,0,32,2,32,3,106,65,16,73,4,64,32,3,32,4,106,32,1,32,2,252,10,0,0,32,0,65,40,106,32,2,32,3,106,54,2,0,15,11,32,3,4,64,32,3,32,4,106,32,1,65,16,32,3,107,34,2,252,10,0,0,32,0,65,8,106,34,3,32,3,40,2,0,32,4,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,54,2,0,32,0,65,12,106,34,3,32,3,40,2,0,32,4,65,4,106,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,54,2,0,32,0,65,16,106,34,3,32,3,40,2,0,32,4,65,8,106,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,54,2,0,32,0,65,20,106,34,3,32,3,40,2,0,32,4,65,12,106,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,54,2,0,32,0,65,40,106,65,0,54,2,0,32,1,32,2,106,33,1,11,32,1,32,6,65,16,107,77,4,64,32,6,65,16,107,33,8,32,0,65,8,106,40,2,0,33,2,32,0,65,12,106,40,2,0,33,3,32,0,65,16,106,40,2,0,33,5,32,0,65,20,106,40,2,0,33,7,3,64,32,2,32,1,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,2,32,3,32,1,65,4,106,34,1,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,3,32,5,32,1,65,4,106,34,1,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,5,32,7,32,1,65,4,106,34,1,40,2,0,65,247,148,175,175,120,108,106,65,13,119,65,177,243,221,241,121,108,33,7,32,8,32,1,65,4,106,34,1,79,13,0,11,32,0,65,8,106,32,2,54,2,0,32,0,65,12,106,32,3,54,2,0,32,0,65,16,106,32,5,54,2,0,32,0,65,20,106,32,7,54,2,0,11,32,1,32,6,73,4,64,32,4,32,1,32,6,32,1,107,34,1,252,10,0,0,32,0,65,40,106,32,1,54,2,0,11,11,97,1,1,127,32,0,65,16,106,40,2,0,33,1,32,0,65,4,106,40,2,0,4,127,32,1,65,12,119,32,0,65,20,106,40,2,0,65,18,119,106,32,0,65,12,106,40,2,0,65,7,119,106,32,0,65,8,106,40,2,0,65,1,119,106,5,32,1,65,177,207,217,178,1,106,11,32,0,40,2,0,106,32,0,65,24,106,32,0,65,40,106,40,2,0,16,1,11,255,3,2,3,126,1,127,32,0,32,1,106,33,6,32,1,65,32,79,4,126,32,6,65,32,107,33,6,32,2,66,214,235,130,238,234,253,137,245,224,0,124,33,3,32,2,66,177,169,172,193,173,184,212,166,61,125,33,4,32,2,66,249,234,208,208,231,201,161,228,225,0,124,33,5,3,64,32,3,32,0,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,3,32,4,32,0,65,8,106,34,0,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,4,32,2,32,0,65,8,106,34,0,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,2,32,5,32,0,65,8,106,34,0,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,5,32,6,32,0,65,8,106,34,0,79,13,0,11,32,2,66,12,137,32,5,66,18,137,124,32,4,66,7,137,124,32,3,66,1,137,124,32,3,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,4,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,2,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,5,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,5,32,2,66,197,207,217,178,241,229,186,234,39,124,11,32,1,173,124,32,0,32,1,65,31,113,16,6,11,134,2,0,32,1,32,2,106,33,2,3,64,32,2,32,1,65,8,106,79,4,64,32,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,32,0,133,66,27,137,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,33,0,32,1,65,8,106,33,1,12,1,11,11,32,1,65,4,106,32,2,77,4,64,32,0,32,1,53,2,0,66,135,149,175,175,152,182,222,155,158,127,126,133,66,23,137,66,207,214,211,190,210,199,171,217,66,126,66,249,243,221,241,153,246,153,171,22,124,33,0,32,1,65,4,106,33,1,11,3,64,32,1,32,2,73,4,64,32,0,32,1,49,0,0,66,197,207,217,178,241,229,186,234,39,126,133,66,11,137,66,135,149,175,175,152,182,222,155,158,127,126,33,0,32,1,65,1,106,33,1,12,1,11,11,32,0,32,0,66,33,136,133,66,207,214,211,190,210,199,171,217,66,126,34,0,32,0,66,29,136,133,66,249,243,221,241,153,246,153,171,22,126,34,0,32,0,66,32,136,133,11,77,0,32,0,65,8,106,32,1,66,214,235,130,238,234,253,137,245,224,0,124,55,3,0,32,0,65,16,106,32,1,66,177,169,172,193,173,184,212,166,61,125,55,3,0,32,0,65,24,106,32,1,55,3,0,32,0,65,32,106,32,1,66,249,234,208,208,231,201,161,228,225,0,124,55,3,0,11,244,4,2,3,127,4,126,32,1,32,2,106,33,5,32,0,65,40,106,33,4,32,0,65,200,0,106,40,2,0,33,3,32,0,32,0,41,3,0,32,2,173,124,55,3,0,32,2,32,3,106,65,32,73,4,64,32,3,32,4,106,32,1,32,2,252,10,0,0,32,0,65,200,0,106,32,2,32,3,106,54,2,0,15,11,32,3,4,64,32,3,32,4,106,32,1,65,32,32,3,107,34,2,252,10,0,0,32,0,65,8,106,34,3,32,3,41,3,0,32,4,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,55,3,0,32,0,65,16,106,34,3,32,3,41,3,0,32,4,65,8,106,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,55,3,0,32,0,65,24,106,34,3,32,3,41,3,0,32,4,65,16,106,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,55,3,0,32,0,65,32,106,34,3,32,3,41,3,0,32,4,65,24,106,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,55,3,0,32,0,65,200,0,106,65,0,54,2,0,32,1,32,2,106,33,1,11,32,1,65,32,106,32,5,77,4,64,32,5,65,32,107,33,2,32,0,65,8,106,41,3,0,33,6,32,0,65,16,106,41,3,0,33,7,32,0,65,24,106,41,3,0,33,8,32,0,65,32,106,41,3,0,33,9,3,64,32,6,32,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,6,32,7,32,1,65,8,106,34,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,7,32,8,32,1,65,8,106,34,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,8,32,9,32,1,65,8,106,34,1,41,3,0,66,207,214,211,190,210,199,171,217,66,126,124,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,33,9,32,2,32,1,65,8,106,34,1,79,13,0,11,32,0,65,8,106,32,6,55,3,0,32,0,65,16,106,32,7,55,3,0,32,0,65,24,106,32,8,55,3,0,32,0,65,32,106,32,9,55,3,0,11,32,1,32,5,73,4,64,32,4,32,1,32,5,32,1,107,34,1,252,10,0,0,32,0,65,200,0,106,32,1,54,2,0,11,11,188,2,1,5,126,32,0,65,24,106,41,3,0,33,1,32,0,41,3,0,34,2,66,32,90,4,126,32,0,65,8,106,41,3,0,34,3,66,1,137,32,0,65,16,106,41,3,0,34,4,66,7,137,124,32,1,66,12,137,32,0,65,32,106,41,3,0,34,5,66,18,137,124,124,32,3,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,4,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,1,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,32,5,66,207,214,211,190,210,199,171,217,66,126,66,31,137,66,135,149,175,175,152,182,222,155,158,127,126,133,66,135,149,175,175,152,182,222,155,158,127,126,66,157,163,181,234,131,177,141,138,250,0,125,5,32,1,66,197,207,217,178,241,229,186,234,39,124,11,32,2,124,32,0,65,40,106,32,2,66,31,131,167,16,6,11]);async function Zz(){return function($){let{exports:{mem:Z,xxh32:J,xxh64:X,init32:Y,update32:z,digest32:G,init64:Q,update64:K,digest64:W}}=$,V=new Uint8Array(Z.buffer);function B(L,C){if(Z.buffer.byteLength<L+C){let w=Math.ceil((L+C-Z.buffer.byteLength)/65536);Z.grow(w),V=new Uint8Array(Z.buffer)}}function H(L,C,w,v,h,a){B(L);let p=new Uint8Array(L);return V.set(p),w(0,C),p.set(V.subarray(0,L)),{update(R){let j;return V.set(p),typeof R=="string"?(B(3*R.length,L),j=U.encodeInto(R,V.subarray(L)).written):(B(R.byteLength,L),V.set(R,L),j=R.byteLength),v(0,L,j),p.set(V.subarray(0,L)),this},digest:()=>(V.set(p),a(h(0)))}}function q(L){return L>>>0}let N=2n**64n-1n;function O(L){return L&N}let U=new TextEncoder,D=0,_=0n;function T(L,C=D){return B(3*L.length,0),q(J(0,U.encodeInto(L,V).written,C))}function M(L,C=_){return B(3*L.length,0),O(X(0,U.encodeInto(L,V).written,C))}return{h32:T,h32ToString:(L,C=D)=>T(L,C).toString(16).padStart(8,"0"),h32Raw:(L,C=D)=>(B(L.byteLength,0),V.set(L),q(J(0,L.byteLength,C))),create32:(L=D)=>H(48,L,Y,z,G,q),h64:M,h64ToString:(L,C=_)=>M(L,C).toString(16).padStart(16,"0"),h64Raw:(L,C=_)=>(B(L.byteLength,0),V.set(L),O(X(0,L.byteLength,C))),create64:(L=_)=>H(88,L,Q,K,W,O)}}((await WebAssembly.instantiate(iH)).instance)}import{randomBytes as Vq,randomUUID as BW}from"node:crypto";import{createHash as fq,randomBytes as vq}from"node:crypto";import{lstat as v9,mkdir as yq,readdir as OW,readFile as cz,rename as gq,unlink as DW,writeFile as mq}from"node:fs/promises";import{tmpdir as hq}from"node:os";import{join as h7,resolve as h1}from"node:path";import*as I$ from"node:fs";import*as _W from"node:os";import*as MW from"node:path";import{Buffer as Z2}from"node:buffer";import{types as U8}from"node:util";import{types as HX}from"node:util";import{randomUUID as u4}from"node:crypto";import{link as H_,mkdir as U_,readdir as UG,readFile as d4,rename as NG,rm as _1,writeFile as LG}from"node:fs/promises";import{tmpdir as N_}from"node:os";import{join as yZ}from"node:path";import{createHash as O_,randomBytes as D_,randomUUID as $V}from"node:crypto";import{constants as DG}from"node:fs";import{chmod as __,mkdir as MX,open as ZV,realpath as M_,rename as JV,stat as j_,unlink as jX}from"node:fs/promises";import{homedir as R_}from"node:os";import{basename as RX,dirname as X1,extname as _G,isAbsolute as T_,join as X2,resolve as P_}from"node:path";import{randomUUID as DZ}from"node:crypto";import{setTimeout as ZM}from"node:timers/promises";import{AsyncLocalStorage as JM}from"node:async_hooks";import{createHash as I2}from"node:crypto";import{randomUUID as AG}from"node:crypto";import{randomUUID as tM}from"node:crypto";import{isDeepStrictEqual as $j}from"node:util";import{types as vX}from"node:util";import{randomUUID as Ij}from"node:crypto";import{constants as mG}from"node:fs";import{lstat as Ej,mkdir as wj,open as iV,rename as kj,rm as bj}from"node:fs/promises";import{basename as fj,dirname as hG,isAbsolute as vj,join as yj}from"node:path";import{types as gj}from"node:util";import{createHash as mj}from"node:crypto";import{createHash as pj}from"node:crypto";import{lstat as lj,readFile as uj}from"node:fs/promises";import{createHash as nV}from"node:crypto";import{createHash as dj}from"node:crypto";import{createHash as ij}from"node:crypto";import{types as lX}from"node:util";import{resolve as eG}from"node:path";import{appendFileSync as CR,chmodSync as FR,existsSync as qJ,renameSync as $Q,statSync as xR}from"node:fs";import{open as AR}from"node:fs/promises";import{dirname as SR,resolve as IR}from"node:path";import{createHash as lR}from"node:crypto";import{types as QT}from"node:util";import{createHash as WT}from"node:crypto";import{isAbsolute as qT,normalize as OT,parse as DT,sep as FZ}from"node:path";import{createHash as _T}from"node:crypto";import{constants as z9}from"node:fs";import{lstat as WQ,open as MT}from"node:fs/promises";import{types as gT}from"node:util";import{resolve as w1}from"node:path";import{createHash as oT}from"node:crypto";import{basename as rT,dirname as tT,join as eT}from"node:path";import{randomUUID as $P}from"node:crypto";import{types as ZP}from"node:util";import{createHash as WP}from"node:crypto";import{realpath as VP}from"node:fs/promises";import{basename as gB,dirname as mB,join as hB,resolve as BP}from"node:path";import{createHash as pB,randomUUID as HP}from"node:crypto";import{mkdir as UP,readFile as OQ,rename as NP,rm as LP,stat as qP,writeFile as OP}from"node:fs/promises";import{basename as DP,dirname as lB,join as _P}from"node:path";import{Buffer as xP}from"node:buffer";import{createHash as AP,randomBytes as SP}from"node:crypto";import{randomUUID as ZC}from"node:crypto";import{lstat as JC,open as XC,rename as YC,unlink as vQ}from"node:fs/promises";import{dirname as zC,isAbsolute as GC,join as QC}from"node:path";import{createHash as KC}from"node:crypto";import{lstat as WC,mkdir as VC,unlink as BC}from"node:fs/promises";import{dirname as HC,isAbsolute as Z5}from"node:path";import{types as r8}from"node:util";import{types as K5}from"node:util";import{dirname as zF,join as GF,resolve as QF}from"node:path";import{createHash as VF}from"node:crypto";import{constants as sQ}from"node:fs";import{lstat as H5,mkdir as aQ,open as U5,unlink as BF}from"node:fs/promises";import{dirname as F8,resolve as nQ}from"node:path";import{setTimeout as HF}from"node:timers/promises";import{rmdirSync as UF,statSync as N5,utimesSync as NF}from"node:fs";import{mkdir as LF,rmdir as qF,stat as fJ,utimes as OF}from"node:fs/promises";import{createHash as AF}from"node:crypto";import{realpathSync as SF}from"node:fs";import{mkdir as IF,readdir as eQ,rm as AZ,stat as $K,writeFile as EF}from"node:fs/promises";import{tmpdir as wF}from"node:os";import{join as K1,resolve as kF}from"node:path";import{randomUUID as QK}from"node:crypto";import{chmod as KK,lstat as rF,mkdir as tF,readdir as WK,readFile as VK,rename as eF,rm as M9,stat as $x,writeFile as Zx}from"node:fs/promises";import{tmpdir as Jx}from"node:os";import{join as tZ}from"node:path";var $6={hide:"\x1B[?25l",show:"\x1B[?25h",up:($=1)=>`\x1B[${$}A`,clearLine:"\x1B[2K",clearScreen:"\x1B[2J",moveTo:($,Z)=>`\x1B[${$};${Z}H`,cyan:"\x1B[36m",green:"\x1B[32m",red:"\x1B[31m",dim:"\x1B[2m",reset:"\x1B[0m"};function sH($){let Z=$.toString(),J=[];for(let X=0;X<Z.length;){let Y=Z[X];if(Y==="\x1B"){let z=Z.slice(X,X+3),G=z[1]==="["||z[1]==="O"?z[2]:void 0;if(G&&"ABCD".includes(G)){let K={A:"up",B:"down",C:"right",D:"left"}[G];if(K)J.push(K);X+=3}else if(X+1===Z.length){if(X===0)J.push("escape-start");X+=1}else if((Z[X+1]==="["||Z[X+1]==="O")&&X+2>=Z.length)break;else X+=1;continue}if(Y==="\r"||Y===`
-`)J.push("enter");else if(Y==="\x03")J.push("escape");else if(Y&&Y>=" ")J.push("char");X+=1}return J}var NK=`${String.fromCharCode(27)}\\[[0-9;]*m`,aH=new RegExp(NK,"g"),nH=new RegExp(`^${NK}`);function oH($){return $.replace(aH,"")}function N1($,Z){if(Z<=0)return"";if(oH($).length<=Z)return $;let J=Z>=3?"...":".".repeat(Z),X=Math.max(0,Z-J.length),Y="",z=0,G=0;while(z<$.length&&G<X){if($[z]==="\x1B"){let Q=$.slice(z).match(nH);if(Q){Y+=Q[0],z+=Q[0].length;continue}}Y+=$[z],z+=1,G+=1}return Y.includes("\x1B[")?`${Y}${$6.reset}${J}`:Y+J}function rH(){return{input:process.stdin,output:process.stdout,signals:process}}function S1($){return $.input.isTTY===!0}function W6($,Z=""){$.output.write(`${Z}
-`)}var tH=50;function eH($){if($==="red")return $6.red;if($==="cyan")return $6.cyan;return""}async function T9($,Z,J){if(!S1($))throw Error("Interactive select requires a TTY terminal");if(Z.length===0)throw Error("No menu items provided");let{input:X,output:Y,signals:z}=$,G=0,Q=null,K=!1,W=0,V=()=>{let B=Y.columns??80,H=Y.rows??24,q=W;if(J.clearScreen)Y.write($6.clearScreen+$6.moveTo(1,1));else if(q>0)Y.write($6.up(q));let N=0,O=(C)=>{Y.write(`${$6.clearLine}${C}
-`),N+=1},U=J.lines??[],D=1+(J.subtitle?3:0)+U.length+(U.length?1:0),_=Math.max(1,Math.min(Z.length,H-D-2-1)),T=Math.max(0,Math.min(G-Math.floor(_/2),Math.max(0,Z.length-_))),M=Z.slice(T,T+_);if(O(`${$6.dim}┌  ${$6.reset}${N1(J.message,Math.max(1,B-4))}`),J.subtitle)O(`${$6.dim}│${$6.reset}`),O(`${$6.cyan}◆${$6.reset}  ${N1(J.subtitle,Math.max(1,B-4))}`),O("");for(let C of U)O(`${$6.cyan}│${$6.reset}  ${N1(C,Math.max(1,B-4))}`);if(U.length)O(`${$6.cyan}│${$6.reset}`);for(let C=0;C<M.length;C++){let w=M[C];if(!w)continue;let v=T+C===G,h=eH(w.color),a=h?`${v?"":$6.dim}${h}${w.label}${$6.reset}`:v?w.label:`${$6.dim}${w.label}${$6.reset}`;if(w.hint)a+=` ${$6.dim}${w.hint}${$6.reset}`;a=N1(a,Math.max(1,B-8)),O(v?`${$6.cyan}│${$6.reset}  ${$6.green}●${$6.reset} ${a}`:`${$6.cyan}│${$6.reset}  ${$6.dim}○${$6.reset} ${a}`)}let L=M.length<Z.length?` (${T+1}-${T+M.length}/${Z.length})`:"";O(`${$6.cyan}│${$6.reset}  ${$6.dim}${N1(`Up/Down to select | Enter: confirm | Esc: back${L}`,Math.max(1,B-6))}${$6.reset}`),O(`${$6.cyan}└${$6.reset}`);for(let C=N;C<q;C++)O("");W=N};return new Promise((B)=>{let H=X.isRaw??!1,q=()=>{if(K)return;if(K=!0,Q)clearTimeout(Q);X.removeListener("data",U);try{X.setRawMode(H),X.pause(),Y.write($6.show)}catch{}z?.removeListener("SIGINT",O),z?.removeListener("SIGTERM",O)},N=(D)=>{q(),B(D)},O=()=>N(null),U=(D)=>{for(let _ of sH(D)){if(K)break;if(Q)clearTimeout(Q),Q=null;switch(_){case"up":G=(G-1+Z.length)%Z.length,V();break;case"down":G=(G+1)%Z.length,V();break;case"enter":N(Z[G]?.value??null);break;case"escape":N(null);break;case"escape-start":Q=setTimeout(()=>N(null),tH);break;default:break}}};z?.once("SIGINT",O),z?.once("SIGTERM",O);try{X.setRawMode(!0)}catch{q(),B(null);return}X.resume(),Y.write($6.hide),V(),X.on("data",U)})}var t=process.platform==="win32",Qz=new Set;function F9($){if($?.reason==="io-error"){if($.win32Code===2||$.win32Code===3)return"ENOENT";if($.win32Code===80||$.win32Code===183)return"EEXIST"}return $?.code??"ERR_PRIVATE_FILE"}var Kz;function e8(){return Kz??=import("./index-vjehtqnb.js"),Kz}class c6 extends Error{path;stage;code;win32Code;reason;published=!1;durabilityConfirmed=!1;fileDurable=!1;attempts=0;elapsedMs=0;orphanPath;constructor($,Z,J){let X=J;super(`Private file refused at ${Z}: ${$} (${X?.reason??X?.code??"io-error"}). Use a safe parent directory. Repair only a named secret file in safe ancestry whose owner the published policy trusts, without changing its owner or any existing directory. Previously exposed credentials may need rotation. Windows requires the private-files native prebuild and an ACL-persisting local filesystem such as NTFS.`,{cause:J});this.path=$,this.stage=Z,this.name="PrivateFileError",this.code=F9(X),this.win32Code=X?.win32Code,this.reason=X?.reason}}async function S$($,Z,J){try{return await J()}catch(X){if(X instanceof c6)throw X;throw new c6($,Z,X)}}var UU;async function f0($,Z){$=q$($),Z??=UU,await S$($,"safe-parent",async()=>{let J=await(await e8()).verifySafeParent($,Z);if(J.ok===!1){if(J.reason==="io-error"||J.reason==="wrong-kind")await DK($);throw new c6(J.level??J.path,"safe-parent",{...J,code:"ERR_PRIVATE_FILES_SECURITY"})}})}async function Q$($,Z,J=!1){if($=q$($),Z==="directory")return f0($);await S$($,"verify",async()=>{let X=await e8(),Y=await X.verifyOwnerOnly($),z=!1;if(!Y.ok){let{reason:G}=Y.refusal;if(G==="io-error")await X.verifyPrivatePath($,Z);if(J&&[X.EXTRA_ACE,X.NOT_PROTECTED,X.NULL_DACL,X.EMPTY_DACL].includes(G))await f0(I0($)),await X.securePrivatePath($,Z),z=!0;else throw Object.assign(Error("Owner-only verification refused"),{reason:G,code:"ERR_PRIVATE_FILES_SECURITY"})}if(await X.verifyPrivatePath($,Z),z&&!Qz.has($))Qz.add($),process.emitWarning(`Private permissions tightened: ${$}. This object may have been readable before; rotate credentials if needed.`,"PrivateFileMigration")})}async function G0($,Z=!1,J){$=q$($),await S$($,"directory",async()=>{let X=await e8();try{return await DK($),await f0($,J)}catch(z){if(F9(z)!=="ENOENT")throw z}let Y=I0($);if(Y===$)throw Object.assign(Error("Missing root"),{code:"ENOENT"});await G0(Y,!1,J);try{await X.createOwnerOnly($,{kind:"dir"})}catch(z){if(F9(z)!=="EEXIST")throw z}await f0($,J)})}async function C0($,Z=!1){if(!t)return _K($,"utf8");return(await MK($,Z)).toString("utf8")}async function MK($,Z=!1){if(!t)return _K($);if($=q$($),Z)await f0(I0($)),await Q$($,"file",!0);return S$($,"read",async()=>(await e8()).readOwnerOnly($))}async function Z7($,Z){await f0(I0(q$($))),await S$($,"create",async()=>{await(await e8()).createPrivateFile(q$($),Z)})}async function NU($){await f0(I0(q$($))),await S$($,"directory-create",async()=>{await(await e8()).createOwnerOnly(q$($),{kind:"dir"})})}async function jK($,Z,J={}){$=q$($),Z=q$(Z);let X=J.now??(()=>performance.now()),Y=X(),z=Math.min(Y+500,J.deadline??1/0),G=[0,10,20,40,80,100],Q,K=0;for(let V of G){if(X()>=z)break;if(V)await(J.sleep??((B)=>new Promise((H)=>setTimeout(H,B))))(Math.min(V,Math.max(0,z-X())));if(X()>=z)break;if(await J.beforeRename?.(),X()>=z)break;K++;try{return await(J.rename??HU)($,Z),{attempts:K,elapsedMs:X()-Y}}catch(B){Q??=B;let H=B;if(!(H.win32Code!==void 0?H.win32Code===32||H.win32Code===33:["EBUSY","EPERM","EACCES"].includes(H.code??"")&&!H.reason))break}}let W=new c6(Z,"rename",Q??Object.assign(Error("Publication deadline expired"),{code:"ETIMEDOUT"}));throw W.attempts=K,W.elapsedMs=X()-Y,W}async function sJ($,Z,J={}){$=q$($),await G0(I0($));try{await Q$($,"file",!0)}catch(W){if(W.code!=="ENOENT")throw W}let X=q$(J.stagePath??`${$}.${BU()}.tmp`);if(I0(X)!==I0($))throw new c6($,"stage-directory",{code:"EXDEV"});let Y=!1,z=!1,G={attempts:0,elapsedMs:0},Q="stage-create",K=(W)=>{try{J.onOutcome?.({path:$,stage:W?.stage??"published",published:z,fileDurable:z,durabilityConfirmed:!1,attempts:W?.attempts??G.attempts,elapsedMs:W?.elapsedMs??G.elapsedMs,...W&&{code:W.code,win32Code:W.win32Code}})}catch{}};try{if(await Z7(X,Z),Y=!0,Q="before-rename",G=await jK(X,$,J),Y=!1,z=!0,Q="published-callback",J.onRenamed?.(),Q="published-verify",await Q$($,"file"),J.durable&&J.durability!=="file-only-on-windows")throw new c6($,"directory-sync-unsupported",{code:"ENOTSUP"});K()}catch(W){let V=W instanceof c6?W:new c6($,Q,W);if(V.published=z,V.fileDurable=z,z)Object.assign(V,G);if(Y){try{await Gz(X)}catch{V.orphanPath=X}Y=!1}throw K(V),V}finally{if(Y)await Gz(X).catch(()=>{})}}class J7 extends Error{constructor($){super("file or directory sync failed",{cause:$});this.name="AtomicSyncError"}}async function $1($,Z,J={}){await RK($,Z,J)}async function RK($,Z,J,X){if(t)return sJ($,J.serialize?J.serialize(Z):`${JSON.stringify(Z,null,2)}
-`,{beforeRename:J.beforeRename,stagePath:`${$}.${(J.stageName??zz)()}.tmp`,onRenamed:X,durable:J.durable,durability:J.durability,onOutcome:J.onOutcome});await KU(C9($),{recursive:!0});let Y=`${$}.${(J.stageName??zz)()}.tmp`,z,G=!1;try{if(z=await $7(Y,"wx",384),G=!0,await z.writeFile(J.serialize?J.serialize(Z):`${JSON.stringify(Z,null,2)}
-`,"utf8"),await z.chmod(384),J.durable)try{await z.sync()}catch(Q){throw new J7(Q)}if(await z.close(),z=void 0,await J.beforeRename?.(),await WU(Y,$),G=!1,X?.(),J.durable){let Q=await $7(C9($),"r");try{await Q.sync()}catch(K){throw new J7(K)}finally{await Q.close()}}}finally{if(await z?.close().catch(()=>{}),G)await VU(Y,{force:!0}).catch(()=>{})}}async function Wz($){if(t){await Q$($,"file");let X=new c6($,"directory-sync-unsupported",{code:"ENOTSUP"});throw X.published=!0,X}let Z=await $7($,"r");try{await Z.sync()}finally{await Z.close()}let J=await $7(C9($),"r");try{await J.sync()}finally{await J.close()}}var ZI=Object.freeze({sidebar:Object.freeze({name:"sidebar-write",ttlMs:1e4,timeoutMs:15000,renew:!0}),preferences:Object.freeze({name:"preferences",ttlMs:1e4,timeoutMs:2000,renew:!0})});function LU($,Z){return`${$}.${Z}.lock`}class d8 extends Error{details;constructor($){super(`Timed out acquiring ${$.name} lock for ${$.target}`);this.name="LockContentionError",this.details=$}}class v1 extends Error{details;constructor($){super(`Lost ${$.name} lock for ${$.target}`);this.name="LockOwnershipError",this.details=$}}async function p6($,Z,J){let X=performance.now();for(;;){let Y=await g0({path:$,name:Z.name,ttlMs:Z.ttlMs,renew:Z.renew??!1,...Z.onStep?{onStep:Z.onStep}:{},...Z.onRenewalTimer?{onRenewalTimer:Z.onRenewalTimer}:{}});if(Y)try{return await J(Y)}finally{await Y.release()}let z=Z.timeoutMs-(performance.now()-X);if(z<=0)throw new d8({target:$,name:Z.name,timeoutMs:Z.timeoutMs});await new Promise((G)=>setTimeout(G,Math.min(25,Math.ceil(z))))}}async function Lz($,Z){let J=await TK($,"wx",384);try{await J.writeFile(Z,"utf8")}finally{await J.close()}}var qU=globalThis.setTimeout.bind(globalThis),OU=globalThis.clearTimeout.bind(globalThis);function DU($){let Z=$?.code;return Z==="ENOENT"||!t&&(Z==="EINVAL"||Z==="ENOTDIR")}function g0($){return _U({...$,now:Date.now})}async function _U($){let Z=LU($.path,$.name),J=Nz(Z,"owner.json"),X=QZ(),Y=$.now??Date.now,z=null,G=!1,Q=!1,K,W,V=new Promise((x)=>{W=x});function B(x){try{let b=$.onRenewalTimer?.(x);if(b&&(typeof b==="object"||typeof b==="function")&&"then"in b&&typeof b.then==="function")Promise.resolve(b).catch(()=>{})}catch{}}function H(){if(!z)return;OU(z),z=null,B("cancelled")}function q(x,b){if(K||G)return;K=Object.freeze({reason:x,expectedOwnerId:X,...typeof b?.ownerId==="string"?{observedOwnerId:b.ownerId}:{},...typeof b?.expiresAt==="number"?{observedExpiresAt:b.expiresAt}:{}}),H(),W(K)}let N,O=null,U=`${Z}.evicting`,D=Nz(U,"owner.json"),_=QZ(),T=5000,M=8;async function L(){if(t)try{return JSON.parse(await C0(Z,!0))}catch(x){if(x.code!=="EISDIR"&&x.reason!=="wrong-kind")throw x;return await Q$(Z,"directory",!0),JSON.parse(await C0(J,!0))}try{return JSON.parse(await Bz(Z,"utf8"))}catch(x){if(x.code!=="EISDIR")throw x;return JSON.parse(await Bz(J,"utf8"))}}async function C(){if(t){let d=await L(),s=Number(d?.expiresAt)-Y();await sJ(Z,`${JSON.stringify({ownerId:X,expiresAt:Y()+$.ttlMs})}
-`,{deadline:performance.now()+Math.max(0,s),beforeRename:async()=>{let r=await L();if(r?.ownerId!==X||!(Number(r?.expiresAt)>Y())||!await j())throw new v1({target:$.path,name:$.name})}});return}let x=`${Z}.${QZ()}.tmp`,b,y=!1;try{b=await TK(x,"wx",384),y=!0,await b.writeFile(`${JSON.stringify({ownerId:X,expiresAt:Y()+$.ttlMs})}
-`,"utf8"),await b.chmod(384),await b.close(),b=void 0;let d=await L();if(d?.ownerId!==X||!(Number(d?.expiresAt)>Y())||!await j())throw new v1({target:$.path,name:$.name});await Hz(x,Z),y=!1}finally{if(await b?.close().catch(()=>{}),y)await KZ(x,{force:!0}).catch(()=>{})}}async function w(){let x=`${JSON.stringify({ownerId:X,expiresAt:Y()+$.ttlMs})}
-`;if(t)await Z7(Z,x);else await Lz(Z,x)}async function v(x){let b=x.code;if(b==="EEXIST"){if(t)await L();return!0}if(b==="EISDIR"){if(t)await Q$(Z,"directory",!0),await C0(J,!0);return!0}return!1}async function h(){if(t)await G0(I4(Z));try{return await w(),!0}catch(x){let b=x.code;if(await v(x))return!1;if(b==="ENOENT"){if(t)await G0(I4(Z));else await Vz(I4(Z),{recursive:!0});try{return await w(),!0}catch(y){if(await v(y))return!1;throw y}}throw x}}async function a(){await new Promise((x)=>setTimeout(x,Math.floor(Math.random()*4)))}async function p(x=!0){if(x&&$.onStep)await $.onStep("lock-read-ready");let b;try{b=await L()}catch(d){if(t&&d.code!=="ENOENT")throw d}let y=Number(b?.expiresAt);if(Number.isFinite(y)&&y>Y())return{status:"live"};if(typeof b?.ownerId==="string"&&Number.isFinite(y))return{status:"stale",identity:{kind:"owner",ownerId:b.ownerId,expiresAt:y}};try{let d=await Uz(Z),s=Number.isFinite(y)?y:d.mtimeMs+$.ttlMs;if(s>Y())return{status:"live"};return{status:"stale",identity:{kind:"stat",dev:d.dev,ino:d.ino,mtimeMs:d.mtimeMs,expiresAt:s}}}catch(d){if(d.code==="ENOENT"){if($.onStep)await $.onStep("lock-missing");return{status:"missing"}}throw d}}function R(x,b){if(b.status!=="stale")return!1;let y=b.identity;if(x.kind==="owner"&&y.kind==="owner")return x.ownerId===y.ownerId&&x.expiresAt===y.expiresAt;return x.kind==="stat"&&y.kind==="stat"&&x.dev===y.dev&&x.ino===y.ino&&x.mtimeMs===y.mtimeMs&&x.expiresAt===y.expiresAt}async function j(){try{return JSON.parse(await C0(D,t))?.ownerId===_}catch(x){if(t&&x.code!=="ENOENT")throw x;return!1}}async function A(x){if(t)await S$(x,"remove",()=>KZ(x,{recursive:!0,force:!0}));else await KZ(x,{recursive:!0,force:!0}).catch(()=>{})}async function E(){if(await j())await A(U)}async function P(){if(t)await NU(U);else await Vz(U);try{let x=`${JSON.stringify({ownerId:_,createdAt:Y()})}
-`;if(t)await Z7(D,x);else await Lz(D,x)}catch(x){if(DU(x))return!1;throw await E(),x}if($.onStep)await $.onStep("eviction-marker-acquired");return!0}async function I(){let x;try{x=await Uz(U)}catch(y){if(y.code==="ENOENT")return"missing";throw y}if(t)await Q$(U,"directory",!0);if(x.mtimeMs+T>Y())return"fresh";if($.onStep)await $.onStep("stale-marker-stat");let b=`${U}.${QZ()}`;try{await Hz(U,b)}catch(y){if(y.code==="ENOENT")return"missing";throw y}if($.onStep)await $.onStep("stale-marker-claimed");return await A(b),"recovered"}async function k(x){try{if(!await P())return!1}catch(b){if(b.code==="EEXIST"){if(t){await Q$(U,"directory",!0);try{await C0(D,!0)}catch(y){if(y.code!=="ENOENT")throw y}}return!1}throw b}try{await x()}finally{await E()}return!0}async function F(){for(let x=0;x<M;x++){if($.onStep)await $.onStep("relinquish-read");let b;try{b=await L()}catch(y){if(t)throw y;return}if(b?.ownerId!==X)return;try{await KZ(Z,{recursive:!0,force:!0});return}catch(y){if(t)throw y;await a()}}}function S(){if(!$.renew||G||K)return;let x=$.renewIntervalMs??Math.max(1000,Math.floor($.ttlMs/3));if(z=qU(()=>{z=null;let b=(async()=>{let y=!G;try{if(!await k(async()=>{let s=await L(),r=Y();if(G||K){y=!1;return}if(s?.ownerId!==X){q("taken-over",s),y=!1;return}if(!(Number(s?.expiresAt)>r)){q("expired",s),y=!1;return}if($.onStep)await $.onStep("renewal-owner-confirmed");if(G||K){y=!1;return}if(!await j())return;if($.onStep)await $.onStep("renewal-write-fenced");if(G||K){y=!1;return}if(!await j())return;if($.onStep)await $.onStep("renewal-write-ready");if(G||K){y=!1;return}if(await C(),$.onStep)await $.onStep("renewal-write-finished");if(!await j()){q("marker-lost"),y=!1,await F();return}})&&$.onStep)await $.onStep("renewal-marker-unavailable")}catch(d){if(t&&d instanceof c6)N=d,q("renewal-failed"),y=!1;try{let s=await L();if(s?.ownerId!==X)q("taken-over",s);else if(!(Number(s?.expiresAt)>Y()))q("expired",s)}catch{q("renewal-failed")}}finally{if($.onStep)try{await $.onStep("renewal-finished")}catch{}if(y&&!G&&!K)S()}})();O=b,b.finally(()=>{if(O===b)O=null})},x),"unref"in z)z.unref();B("scheduled")}function m(){try{let x=$.onContended?.();if(x&&(typeof x==="object"||typeof x==="function")&&"then"in x&&typeof x.then==="function")Promise.resolve(x).catch(()=>{})}catch{}return null}let f=await h();if(!f)for(let x=0;x<M;x++){if(f=await h(),f)break;let b=await p();if(b.status==="live")return m();if(b.status==="missing")continue;if($.onStep)await $.onStep("stale-lock-observed");try{if(!await P()){await a();continue}}catch(y){if(y.code!=="EEXIST")throw y;if(await I()==="fresh")return null;await a();continue}try{let y=await p();if(y.status==="live")return m();if(!R(b.identity,y))continue;if(!await j())return null;if($.onStep)await $.onStep("stale-lock-confirmed");if(!await j())return null;let d=await p(!1);if(!R(b.identity,d))continue;if(await A(Z),!await j())return null;if($.onStep)await $.onStep("stale-lock-removed");if(f=await h(),!f)return null;if($.onStep)await $.onStep("stale-lock-recreated");if(!await j())return await F(),f=!1,null;break}finally{await E()}}if(!f)return null;return S(),{ownerId:X,whenLost:()=>V,hasLost:()=>K!==void 0,assertOwned:async()=>{if(N)throw N;let x;try{let b=await L();if(x=b,!G&&!K&&b?.ownerId===X&&Number(b?.expiresAt)>Y())return;q(b?.ownerId!==X?"taken-over":"expired",b)}catch(b){if(q("unreadable"),t&&b instanceof c6)throw b}throw new v1({target:$.path,name:$.name,expectedOwnerId:X,...typeof x?.ownerId==="string"?{observedOwnerId:x.ownerId}:{},...typeof x?.expiresAt==="number"?{observedExpiresAt:x.expiresAt}:{}})},release:async()=>{if(t&&Q)return;G=!0,H(),await O;for(let x=0;x<M;x++){try{let b=!1;if(await k(async()=>{let d;try{d=await L()}catch(s){if(t&&s.code==="ENOENT"){b=!0;return}throw s}if(d?.ownerId!==X){b=!0;return}if($.onStep)await $.onStep("release-owner-confirmed");if(!await j())return;await A(Z),b=!0})){if(t&&!b)throw new c6(Z,"release-not-confirmed",{code:"EIO"});Q=b;return}await I()}catch(b){if(t)throw b;return}await a()}if(t)throw new c6(Z,"release-not-confirmed",{code:"ETIMEDOUT"})}}}class e extends Error{kind;constructor($,Z){super(Z);this.name="ClaustrumConsumerError",this.kind=$}}var MU=1,EZ=16384,aJ=30000,nJ=/^[0-9a-f]{64}$/,jU=new Set(["invalid_params","pending_exists","not_found","already_consumed","superseded","stale_generation"]),RU=new Set(["pending_queue_full"]);function qz($){if(!($ instanceof t6))return;if(jU.has($.code))return{code:$.code,disposition:"terminal"};if(RU.has($.code))return{code:$.code,disposition:"retry"};return{code:$.code,disposition:$.action==="retry"?"retry":"terminal"}}function PK($){return y$.connect($)}function TU($){let Z=Xz($)||".json",J=OK($,Xz($));return{statePath:iJ(e$($),`${J}-state${Z}`),tokenPath:$}}function CK($){let Z=$.override?.trim();if(Z&&!Yz(Z)&&!$.cwd)throw new e("invalid-state","A relative Claustrum enrollment override needs a base directory");let J=Z?Yz(Z)?Z:QU($.cwd,Z):iJ($.stateDir,`${$.host}-enrollment.json`);return TU(J)}function FK($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function WZ($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0}function xK($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=1}function L1(){return new e("invalid-state","invalid Claustrum enrollment state")}function _2($){if(!FK($)||$.version!==MU||typeof $.proposedName!=="string"||$.proposedName.length===0)throw L1();if($.phase==="pending"){if(!nJ.test(String($.requestSecret??""))||$.requestId!==void 0&&(typeof $.requestId!=="string"||$.requestId.length===0)||!WZ($.createdAt)||!WZ($.updatedAt))throw L1();return{version:1,phase:"pending",proposedName:$.proposedName,requestSecret:$.requestSecret,...$.requestId!==void 0&&{requestId:$.requestId},createdAt:$.createdAt,updatedAt:$.updatedAt}}if($.phase==="approved"){if($.approvedName!==void 0&&(typeof $.approvedName!=="string"||$.approvedName.length===0)||!xK($.tokenGeneration)||!WZ($.updatedAt))throw L1();return{version:1,phase:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration,updatedAt:$.updatedAt}}if($.phase==="denied"||$.phase==="blocked"){if($.errorCode!==void 0&&typeof $.errorCode!=="string"||!WZ($.updatedAt))throw L1();return{version:1,phase:$.phase,proposedName:$.proposedName,...$.errorCode!==void 0&&{errorCode:$.errorCode},updatedAt:$.updatedAt}}throw L1()}function oJ($){if(!FK($)||!nJ.test(String($.token??""))||!xK($.token_generation))throw new e("invalid-token","invalid Claustrum enrollment token file");return{token:$.token,token_generation:$.token_generation}}function PU($){if(!$.isFile())throw new e("unsafe-file","Claustrum enrollment file must be a regular file");if(($.mode&63)!==0)throw new e("unsafe-file","Claustrum enrollment file must be owner-only");let Z=process.geteuid?.();if(Z!==void 0&&$.uid!==Z)throw new e("unsafe-file","Claustrum enrollment file must be owned by the current user")}function Oz($){try{return JSON.parse($)}catch{throw new e("invalid-state","Claustrum enrollment file is not valid JSON")}}async function Q0($){if(t)try{await G0(e$($));let J=await C0($,!0);if(Buffer.byteLength(J)>EZ)throw new e("unsafe-file","Claustrum enrollment file is too large");return Oz(J)}catch(J){if(J.code==="ENOENT")return;throw J}let Z;try{Z=await LK($,Jz.O_RDONLY|Jz.O_NOFOLLOW)}catch(J){if(J.code==="ENOENT")return;throw new e("unsafe-file","Claustrum enrollment file could not be opened safely")}try{PU(await Z.stat());let J=Buffer.alloc(EZ+1),{bytesRead:X}=await Z.read(J,0,J.byteLength,0);if(X>EZ)throw new e("unsafe-file","Claustrum enrollment file is too large");return Oz(J.subarray(0,X).toString("utf8"))}finally{await Z.close()}}function Dz($,Z){let J=[];for(let X of $.split(`
-`)){if(X.trim()===""||X.startsWith("#"))continue;let Y=X.split(":");if(Y.length!==Z||!/^[^\s:,]+$/.test(Y[0]??"")||!/^\d+$/.test(Y[2]??"")||!Number.isSafeInteger(Number(Y[2]))||Z===7&&(!/^\d+$/.test(Y[3]??"")||!Number.isSafeInteger(Number(Y[3])))||Z===4&&Y[3]!==""&&!/^[^\s:,]+(?:,[^\s:,]+)*$/.test(Y[3]??""))return;J.push(Y)}return J}async function CU($,Z,J){try{let[X,Y]=await Promise.all([P9(J.passwdPath??"/etc/passwd","utf8"),P9(J.groupPath??"/etc/group","utf8")]),z=Dz(X,7),G=Dz(Y,4);if(!z||!G)return!1;let Q=z.filter((B)=>Number(B[2])===$),K=G.filter((B)=>Number(B[2])===Z);if(Q.length!==1||K.length!==1)return!1;let W=Q[0]?.[0],V=K[0]?.[3]??"";return(V===""||V.split(",").every((B)=>B===W))&&!z.some((B)=>Number(B[2])!==$&&Number(B[3])===Z)}catch{return!1}}function AK($){if(!$.passwdPath&&!$.groupPath)return;return{fs:{readFile:(Z)=>P9(Z==="/etc/passwd"?$.passwdPath??Z:Z==="/etc/group"?$.groupPath??Z:Z)}}}async function SK($,Z={}){if(!t){let J=process.geteuid?.();if(J===void 0)return;let X=process.getegid?.(),Y;try{Y=await zU($)}catch{return}let z;for(;;){let G=await qK(Y).catch(()=>{return});if(G&&(G.mode&18)!==0&&(G.mode&512)===0){if(z===void 0)z=X!==void 0&&await CU(J,X,Z);if((G.mode&2)!==0||G.uid!==J||G.gid!==X||!z)throw new e("unsafe-file",`Claustrum enrollment path has a writable ancestor: ${Y}. Another user could replace it. Run: chmod g-w,o-w ${Y}`)}let Q=e$(Y);if(Q===Y)return;Y=Q}}try{await f0($,AK(Z))}catch(J){if(!(J instanceof c6))throw J;throw new e("unsafe-file",`Claustrum enrollment parent refused: ${J.path} (${J.reason??J.code}). Use a folder that other users cannot write or replace.`)}}async function o1($,Z={}){if(t){await G0($,!1,AK(Z));return}await YU($,{recursive:!0,mode:448});let J=await qK($),X=process.geteuid?.();if(X!==void 0&&J.uid!==X)throw new e("unsafe-file","Claustrum enrollment directory must be owned by the current user");if((J.mode&63)!==0)await XU($,448)}async function c0($,Z,J={}){let X=e$($);await o1(X,J),await SK(X,J);let Y=`${JSON.stringify(Z)}
-`;if(Buffer.byteLength(Y)>EZ)throw new e("invalid-state","Claustrum enrollment state is too large");if(t)return sJ($,Y);let z=iJ(X,`.${OK($)}.${process.pid}.${JU()}.tmp`),G,Q=!1;try{G=await LK(z,"wx",384),Q=!0,await G.writeFile(Y,"utf8"),await G.chmod(384),await G.sync(),await G.close(),G=void 0,await GU(z,$),Q=!1}finally{if(await G?.close().catch(()=>{}),Q)await cJ(z).catch(()=>{})}}async function IK($,Z){let J=await Q0($.tokenPath),X=J===void 0?void 0:oJ(J),Y=await Q0($.statePath),z=Y===void 0?void 0:_2(Y);if(X)return{state:"approved",proposedName:z?.proposedName??Z,...z?.phase==="approved"&&z.approvedName!==void 0&&{approvedName:z.approvedName},tokenGeneration:X.token_generation};if(!z)return{state:"idle"};if(z.phase==="approved")return{state:"blocked",proposedName:z.proposedName,code:"missing_token"};return P0(z)}async function FU($,Z){let J;try{J=await IK($,Z)}catch(X){if(!(X instanceof e)||X.kind!=="invalid-state"&&X.kind!=="invalid-token")return"unreadable";try{let Y=await Q0($.statePath);if(Y===void 0)return"unreadable";let z=_2(Y);return z.phase==="approved"&&z.proposedName===Z?"vault":"unreadable"}catch{return"unreadable"}}if("proposedName"in J&&J.proposedName!==Z)return"unreadable";if(J.state==="approved"||J.state==="blocked"&&J.code==="missing_token")return"vault";return"local"}async function wZ($){let Z=await Q0($);if(Z===void 0)throw new e("not-enrolled","Claustrum enrollment is not configured");return oJ(Z)}function P0($){if($.phase==="pending")return{state:"pending",proposedName:$.proposedName,...$.requestId!==void 0&&{requestId:$.requestId}};if($.phase==="approved")return{state:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration};if($.phase==="denied")return{state:"denied",proposedName:$.proposedName};return{state:"blocked",proposedName:$.proposedName,code:$.errorCode??"unknown"}}function rJ(){return new e("wrong-consumer","Claustrum enrollment state belongs to a different consumer")}class EK{#$;#Z;#z;#J;#K;#Y;#X;constructor($){this.#X=$.ancestorOptions??{},this.#$=$.client,this.#Z=$.paths,this.#z=$.proposedName,this.#J=$.now??Date.now,this.#K=$.mintSecret??(()=>ZU(32).toString("hex")),this.#Y=$.writeTokenFile??u0}async status(){return IK(this.#Z,this.#z)}async resetTerminal(){return xU(this.#Z,this.#z)}async#W($,Z){let J={version:1,phase:"blocked",proposedName:$.proposedName,errorCode:Z,updatedAt:this.#J()};return await c0(this.#Z.statePath,J,this.#X),P0(J)}async reconcile(){await o1(e$(this.#Z.statePath),this.#X);let $=await g0({name:"ceremony",path:this.#Z.statePath,ttlMs:aJ,renew:!0});if(!$)return{state:"busy"};try{let Z=await Q0(this.#Z.tokenPath),J=Z===void 0?void 0:oJ(Z),X=await Q0(this.#Z.statePath),Y=X===void 0?void 0:_2(X);if(Y&&Y.proposedName!==this.#z)throw rJ();if(J){if(!Y||Y.phase==="pending"){let G={version:1,phase:"approved",proposedName:Y?.proposedName??this.#z,tokenGeneration:J.token_generation,updatedAt:this.#J()};await c0(this.#Z.statePath,G,this.#X),Y=G}return{state:"approved",proposedName:Y.proposedName,...Y.phase==="approved"&&Y.approvedName!==void 0&&{approvedName:Y.approvedName},tokenGeneration:J.token_generation}}if(Y?.phase==="approved"){let G={version:1,phase:"blocked",proposedName:Y.proposedName,errorCode:"missing_token",updatedAt:this.#J()};return await c0(this.#Z.statePath,G,this.#X),P0(G)}if(Y&&Y.phase!=="pending")return P0(Y);if(!Y){let G=this.#J();if(Y={version:1,phase:"pending",proposedName:this.#z,requestSecret:this.#K(),createdAt:G,updatedAt:G},!nJ.test(Y.requestSecret))throw new e("invalid-state","invalid minted Claustrum enrollment secret");await c0(this.#Z.statePath,Y,this.#X)}if(!Y.requestId)try{let G=$U("sha256").update(Buffer.from(Y.requestSecret,"hex")).digest("hex"),Q=await this.#$.enrollPropose({name:Y.proposedName,requestSecretHash:G});Y={...Y,requestId:Q.requestId,updatedAt:this.#J()},await c0(this.#Z.statePath,Y,this.#X)}catch(G){let Q=qz(G);if(!Q)throw G;if(Q.disposition==="retry")return{state:"pending",proposedName:Y.proposedName,retryCode:Q.code};return this.#W(Y,Q.code)}let z=Y.requestId;if(!z)return P0(Y);try{let G=await this.#$.enrollPoll({requestId:z,requestSecret:Y.requestSecret});if(G.status==="pending")return P0(Y);if(G.status==="denied"){let K={version:1,phase:"denied",proposedName:Y.proposedName,updatedAt:this.#J()};return await c0(this.#Z.statePath,K,this.#X),P0(K)}await o1(e$(this.#Z.tokenPath),this.#X),await SK(e$(this.#Z.tokenPath),this.#X),await this.#Y(this.#Z.tokenPath,{token:G.token,token_generation:G.tokenGeneration});let Q={version:1,phase:"approved",proposedName:Y.proposedName,approvedName:G.name,tokenGeneration:G.tokenGeneration,updatedAt:this.#J()};return await c0(this.#Z.statePath,Q,this.#X),P0(Q)}catch(G){let Q=qz(G);if(!Q)throw G;if(Q.disposition==="retry")return{state:"pending",proposedName:Y.proposedName,requestId:z,retryCode:Q.code};return this.#W(Y,Q.code)}}finally{await $.release()}}}async function xU($,Z){await o1(e$($.statePath));let J=await g0({name:"ceremony",path:$.statePath,ttlMs:aJ,renew:!0});if(!J)return"busy";try{if(await Q0($.tokenPath)!==void 0)return"refused-approved";let X=await Q0($.statePath);if(X===void 0)return"idle";let Y=_2(X);if(Y.proposedName!==Z)throw rJ();if(Y.phase==="pending")return"refused-pending";return await J.assertOwned(),await cJ($.statePath),"reset"}finally{await J.release()}}async function _z($){try{return await cJ($),!0}catch(Z){if(Z.code==="ENOENT")return!1;throw Z}}async function AU($,Z){await o1(e$($.statePath));let J=await g0({name:"ceremony",path:$.statePath,ttlMs:aJ,renew:!0});if(!J)return"busy";try{let X;try{let G=await Q0($.statePath);X=G===void 0?void 0:_2(G)}catch(G){if(!(G instanceof e)||G.kind!=="invalid-state")throw G}if(X&&X.proposedName!==Z)throw rJ();await J.assertOwned();let Y=await _z($.tokenPath);await J.assertOwned();let z=await _z($.statePath);return Y||z?"disconnected":"idle"}finally{await J.release()}}var U$=4096,IU=1048576;class wK{buffer=Buffer.alloc(U$);start=0;length=0;truncated=!1;get didTruncate(){return this.truncated}push($){if($.length>=U$){if($.length>U$||this.length>0)this.truncated=!0;$.copy(this.buffer,0,$.length-U$),this.start=0,this.length=U$;return}let Z=Math.max(0,this.length+$.length-U$);if(Z>0)this.truncated=!0;this.start=(this.start+Z)%U$,this.length-=Z;let J=(this.start+this.length)%U$,X=Math.min($.length,U$-J);if($.copy(this.buffer,J,0,X),X<$.length)$.copy(this.buffer,0,X);this.length+=$.length}toString(){let $=Buffer.alloc(this.length),Z=Math.min(this.length,U$-this.start);if(this.buffer.copy($,0,this.start,this.start+Z),Z<this.length)this.buffer.copy($,Z,0,this.length-Z);let J=0;while(J<$.length){let X=$[J];if(X===void 0||(X&192)!==128)break;J++}return $.subarray(J).toString("utf8")}}var M2={run($,Z,J={}){return new Promise((X)=>{let Y=performance.now(),z=J.timeoutMs??15000,G=new wK,Q=[],K=0,W=!1,V=!1,B=!1,H;try{H=SU($,[...Z],{env:J.env??process.env,windowsHide:!0,windowsVerbatimArguments:J.windowsVerbatimArguments,stdio:["ignore","pipe","pipe"]})}catch{X({exitCode:1,stdout:"",stderr:"",spawnError:!0,signal:null,timedOut:!1,durationMs:performance.now()-Y});return}let q=z>0?setTimeout(()=>{B=!0,H.kill("SIGTERM")},z):void 0;H.stdout?.on("data",(U)=>{let D=IU-K,_=Math.min(D,U.length);if(_>0)Q.push(U.subarray(0,_)),K+=_;if(U.length>D)W=!0,H.kill("SIGTERM")}),H.stderr?.on("data",(U)=>G.push(U));let N=!1,O=(U,D)=>{if(N)return;if(N=!0,q)clearTimeout(q);X({exitCode:V?1:W?1:U??1,stdout:Buffer.concat(Q,K).toString("utf8"),stderr:G.toString(),stderrTruncated:G.didTruncate,...V?{spawnError:!0}:{},signal:D??null,timedOut:B,durationMs:performance.now()-Y})};H.once("error",()=>{if(V=!0,H.pid===void 0)O(null,null)}),H.once("close",(U,D)=>O(U,D))})}};function kK($,Z,J,X,Y,z=15000){if(Z==="win32"&&/\.(cmd|bat)$/i.test(J)){if(/["%!\r\n]/.test(J)||X.some((G)=>!/^[a-zA-Z0-9@:/._+-]+$/.test(G)))throw Error("Unsafe batch launcher or argument; use an executable instead.");return $.run("cmd.exe",["/d","/s","/c",`""${J}" ${X.join(" ")}"`],{env:Y,timeoutMs:z,windowsVerbatimArguments:!0})}return $.run(J,X,{env:Y,timeoutMs:z})}function B0($={}){let Z=$.env??process.env,J=$.platform??process.platform,X=J==="win32"?dU:uU,Y=$.home??(J==="win32"?Z.USERPROFILE:Z.HOME)??lU(),z=$.cwd??process.cwd(),G=(V)=>X.resolve(z,V),Q=Z.OPENCODE_CONFIG_DIR?.trim(),K=Z.XDG_CONFIG_HOME?.trim(),W=Z.PI_CODING_AGENT_DIR?.trim()||X.join(Y,".pi","agent");if(W==="~")W=Y;else if(/^~[/\\]/.test(W))W=X.join(Y,W.slice(2));if(W.startsWith("file://"))W=cU(W);return{env:Z,platform:J,path:X,home:Y,cwd:z,opencode:Q?G(Q):K?X.join(G(K),"opencode"):X.join(Y,".config","opencode"),pi:G(W)}}function E4($,Z){try{return vU($)[Z]()}catch{return!1}}var Z1={exists:kU,isFile:($)=>E4($,"isFile"),isDirectory:($)=>E4($,"isDirectory"),isExecutable($){try{return EU($,wU.X_OK),E4($,"isFile")}catch{return!1}},readText:($)=>bU($,"utf8"),realpath:fU};function I8($,Z={}){let{env:J,platform:X,path:Y,cwd:z}=B0(Z),G=Z.fs??Z1,Q=Object.entries(J).find(([W])=>X==="win32"?W.toUpperCase()==="PATH":W==="PATH")?.[1]??"",K=X==="win32"?[".exe",".cmd",".bat",""]:[""];for(let W of Q.split(X==="win32"?";":":")){let V=W.trim().replace(/^"|"$/g,"");if(!V)continue;for(let B of K){let H=Y.resolve(z,V,$+B);if(X==="win32"?G.isFile(H):G.isExecutable(H))return H}}return null}function iU($={}){let{platform:Z,home:J,env:X,path:Y}=B0($);if(Z==="darwin")return["/Applications/OpenCode.app","/Applications/OpenCode Beta.app",Y.join(J,"Applications","OpenCode.app"),Y.join(J,"Applications","OpenCode Beta.app")];if(Z==="win32"){let z=X.LOCALAPPDATA||Y.join(J,"AppData","Local");return[Y.join(z,"Programs","opencode"),Y.join(z,"opencode")]}return["/opt/OpenCode","/usr/lib/opencode",Y.join(J,".local","share","applications","opencode.desktop")]}function x9($,Z){let J=Z.fs??Z1,{path:X}=B0(Z);try{let Y=J.readText($);if(Y.length>65536)return $;let z=[...Y.matchAll(/"%~?dp0%?\\([^"%\r\n]+)"/g)];if(!z.length)z.push(...Y.matchAll(/"\$basedir\/([^"$\r\n]+)"/g));let G=z.at(-1)?.[1];if(G){let Q=X.join(X.dirname($),...G.split(/[/\\]+/));if(J.isFile(Q))return J.realpath(Q)}return J.realpath($)}catch{return $}}function sU($,Z){let J=Z.fs??Z1,{path:X}=B0(Z),Y=X.dirname(x9($,Z));for(;;){try{let G=JSON.parse(J.readText(X.join(Y,"package.json")));if(["@opencode/cli","@opencode-ai/cli"].includes(G.name))return"2";if(G.name==="opencode-ai")return/^(?:[2-9]\d*|1\d+)\.|^0\.0\.0-(?:beta|dev)-/.test(G.version??"")?"2":"1"}catch{}let z=X.dirname(Y);if(z===Y)return null;Y=z}}function aU($={}){let Z=I8("opencode",$),J=I8("opencode2",$),X=Z&&J&&x9(Z,$)===x9(J,$),Y=$.fs??Z1,{path:z,opencode:G}=B0($),Q="1";for(let W of["jsonc","json"]){let V=z.join(G,`opencode.${W}`);if(!Y.exists(V))continue;try{if(Object.hasOwn(pU(Y.readText(V))??{},"plugins"))Q="2"}catch{}break}let K=Z?sU(Z,$)??(X?"2":Q):null;if(J&&K==="1"&&!X)return"ambiguous";return J||X?"2":K??Q}async function nU($,Z={}){let J=Z.fs??Z1,{env:X,platform:Y,opencode:z,pi:G}=B0(Z),Q=Z.runner??M2,K=I8("opencode",Z)??I8("opencode2",Z),W=I8("pi",Z),V=I8("ck",Z),B=async(O)=>{if(!O)return null;let U;try{U=await yU(hU(mU(),"common-auth-setup-version-"));let D={...X,HOME:U,USERPROFILE:U,XDG_CONFIG_HOME:U,XDG_DATA_HOME:U,XDG_STATE_HOME:U,XDG_CACHE_HOME:U,OPENCODE_CONFIG_DIR:U,OPENCODE_CONFIG:void 0,OPENCODE_CONFIG_CONTENT:void 0,OPENCODE_AUTH_CONTENT:void 0,PI_CODING_AGENT_DIR:U},_=await kK(Q,Y,O,["--version"],D,2000);return _.exitCode===0?/\b\d+\.\d+\.\d+(?:-[\w.-]+)?/.exec(_.stdout)?.[0]??null:null}catch{return null}finally{if(U)await gU(U,{recursive:!0,force:!0}).catch(()=>{})}},H=!1;if(V&&J.exists($.vault.connectionFile))try{(await(Z.connect??PK)({connectionFile:$.vault.connectionFile,handshakeTimeoutMs:2000})).close(),H=!0}catch{H=!1}let[q,N]=await Promise.all([B(K),B(W)]);return{opencode:{installed:J.isDirectory(z)||iU(Z).some((O)=>J.exists(O))||K!==null,executable:K,version:q,directory:z,generation:aU(Z)},pi:{installed:W!==null||J.isDirectory(G),executable:W,version:N,directory:G},claustrum:{available:H,executable:V}}}var rU=45000,Mz=new Set(["opencode","litecode","opencode2","pi"]),tU=new Set(["node","bun"]),eU=/(?:^|[/\\])pi-coding-agent[/\\]dist[/\\](?:(?:bundle|bun)[/\\])?cli\.m?js$/i;function $N($){return[...$.matchAll(/"([^"]*)"|(\S+)/g)].map((Z)=>Z[1]??Z[2]??"")}function jz($){return($.split(/[/\\]/).pop()??"").toLowerCase().replace(/\.(?:exe|cmd|bat|m?js)$/,"")}var ZN=new Set(["-r","--require","--import","--loader","--experimental-loader","-C","--conditions","--env-file","--title","--input-type","--preload","--cwd","-c","--config","--tsconfig-override","-d","--define","-l","--main-fields"]),JN=new Set(["-e","--eval","-p","--print"]);function XN($,Z){for(let J=0;J<Z.length;J++){let X=Z[J]??"";if(X==="--")return Z[J+1];if(JN.has(X))return;if(X.startsWith("-")){if(!X.includes("=")&&ZN.has(X))J++;continue}if($==="bun"&&X==="run")continue;return X}return}function bK($){let[Z,...J]=$N($);if(Z===void 0)return null;let X=jz(Z);if(Mz.has(X))return X;if(!tU.has(X))return null;let Y=XN(X,J);if(Y===void 0)return null;let z=jz(Y);if(Mz.has(z))return z;return eU.test(Y)?"pi":null}class e6 extends Error{code="process-inspection-failed";step;exitCode;signal;timedOut;durationMs;constructor($){super("Process inspection failed; setup cannot prove hosts are stopped.");this.name="ProcessInspectionError",this.step=$.step,this.exitCode=$.exitCode,this.signal=$.signal,this.timedOut=$.timedOut,this.durationMs=$.durationMs}get refusalText(){let $=this.timedOut?"timed out":this.signal?`signal ${this.signal}`:this.exitCode===null?"could not start or complete":this.exitCode===0?"invalid output (exit code 0)":`exit code ${this.exitCode}`;return`${this.message} ${this.step}: ${$} after ${Math.round(this.durationMs)} ms.`}}class k7 extends Error{activeHosts;constructor($){let Z=$.map((J)=>({pid:J.pid,command:bK(J.command)??"host"}));super(`OpenCode or Pi processes are currently running:
-${Z.map((J)=>`  - PID ${J.pid}: ${J.command}`).join(`
-`)}
-
-Please quit all OpenCode, LiteCode, and Pi processes before running setup.`);this.activeHosts=Z,this.name="ProcessFenceViolationError"}}async function Rz($=M2,Z={}){let J=(Z.platform??process.platform)==="win32",X={step:J?"tasklist":"ps",exitCode:null,signal:null,timedOut:!1,durationMs:0},Y=async(z,G,Q,K)=>{let W=performance.now();X={step:z,exitCode:null,signal:null,timedOut:!1,durationMs:0};try{let V=await $.run(G,Q,{env:Z.env,timeoutMs:K});return X={step:z,exitCode:V.exitCode,signal:V.signal??null,timedOut:V.timedOut??!1,durationMs:V.durationMs??performance.now()-W},V}finally{if(X.exitCode===null)X.durationMs=performance.now()-W;Z.onStep?.({...X})}};try{let z=await Y(J?"tasklist":"ps",J?"tasklist.exe":"ps",J?["/fo","csv","/nh"]:["-eo","pid,command"]);if(z.exitCode!==0)throw new e6(X);let G=[];for(let K of z.stdout.split(/\r?\n/)){let W=K.trim();if(!W)continue;let V,B;if(J){let H=/^"([^"]+)","(\d+)"(?:,|$)/.exec(W);if(!H)throw new e6(X);B=H[1]??"",V=Number(H[2])}else{let H=/^(\d+)\s+(.+)$/.exec(W);if(!H){if(/^PID\s+COMMAND$/i.test(W))continue;throw new e6(X)}V=Number(H[1]),B=H[2]??""}if(!Number.isSafeInteger(V)||V<0)throw new e6(X);G.push({pid:V,command:B})}if(!G.length)throw new e6(X);let Q=G.filter((K)=>K.pid!==process.pid&&/^(?:node|bun)\.exe$/i.test(K.command));if(J&&Q.length&&Z.inspectRuntimes!==!1){let K=await Y("CIM","powershell.exe",["-NoProfile","-NonInteractive","-Command",`$ErrorActionPreference = 'Stop'; Get-CimInstance Win32_Process -Filter "Name = 'node.exe' OR Name = 'bun.exe'" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress`],rU);if(K.exitCode!==0)throw new e6(X);let W=JSON.parse(K.stdout||"null"),V=W===null?[]:Array.isArray(W)?W:[W],B=new Map;for(let H of V){if(!H||typeof H!=="object"||!("ProcessId"in H)||!("CommandLine"in H)||!Number.isSafeInteger(H.ProcessId))throw new e6(X);if(typeof H.CommandLine==="string")B.set(Number(H.ProcessId),H.CommandLine);else if(Q.some((q)=>q.pid===H.ProcessId))throw new e6(X)}for(let H of Q)H.command=B.get(H.pid)??""}return G}catch(z){if(z instanceof e6)throw z;throw new e6(X)}}function YN($=M2,Z={}){let J=(X)=>X.pid!==process.pid&&bK(X.command)!==null;return{async listRunningHosts(X){return(await Rz($,{...Z,env:X})).filter(J)},async previewRunningHosts(X){let Y=await Rz($,{...Z,env:X,inspectRuntimes:!1}),z=(Z.platform??process.platform)==="win32";return{hosts:Y.filter(J),uncheckedRuntimes:z?Y.filter((G)=>G.pid!==process.pid&&/^(?:node|bun)\.exe$/i.test(G.command)).length:0}}}}async function zN($,Z){let J=await $.listRunningHosts(Z);if(J.length)throw new k7(J)}async function GN($,Z,J,X,Y){let{name:z,paths:G}=$.vault.hosts[Z],Q=CK(G);await Y();let K=await(J.connect??PK)({connectionFile:$.vault.connectionFile,handshakeTimeoutMs:2000}).catch(()=>{throw Error("Claustrum connection failed; start ck and rerun setup.")});try{let W=new EK({proposedName:z,paths:Q,client:{enrollPropose:async(B)=>{return await Y(),K.enrollPropose(B)},enrollPoll:async(B)=>{return await Y(),K.enrollPoll(B)}},writeTokenFile:async(B,H)=>{await Y(),await u0(B,H)}}),V;for(let B=0;B<300;B++){await Y();let H=await W.reconcile();if(H.state==="approved"){W6(X,`Connected ${Z} to Claustrum.`);return}if(H.state!=="pending"&&H.state!=="busy")throw Error("Claustrum enrollment refused; inspect its status with ck before rerunning setup.");if(H.state==="pending"&&H.requestId&&H.requestId!==V){if(!/^[a-zA-Z0-9_-]+$/.test(H.requestId))throw Error("Invalid enrollment request id.");V=H.requestId,W6(X,"Waiting for approval. In another terminal, run:"),W6(X,`  ck auth enroll approve --request-id ${H.requestId} --name ${z}`),W6(X,`Enrollment files: ${Q.statePath}, ${Q.tokenPath}`)}await(J.wait??oU)(1000)}throw Error("Claustrum approval is still pending; approve with ck and rerun setup.")}catch(W){if(W instanceof k7||W instanceof e6)throw W;throw Error("Claustrum enrollment did not complete. Inspect and approve with ck, then rerun setup.")}finally{K.close()}}async function QN($,Z){let J=new Set(Z);for(;;){let X=await T9($,[...["opencode","pi"].map((Y)=>({value:Y,label:`[${J.has(Y)?"x":" "}] ${Y==="opencode"?"OpenCode":"Pi"}`,hint:Z.includes(Y)?"found":"not found"})),{value:"done",label:"Continue with selected hosts"}],{message:"Select hosts to set up",subtitle:"Enter toggles a host; choose Continue when ready."});if(X===null)return null;if(X==="done")return[...J];if(J.has(X))J.delete(X);else J.add(X)}}var HN=/^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i,UN=/\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g,Pz="***REDACTED***",NN=8;function LN($){return $ instanceof Error||Object.prototype.toString.call($)==="[object Error]"}function y1($={}){let Z=[UN,...$.extraValuePatterns??[]].map((z)=>new RegExp(z.source,z.flags.includes("g")?z.flags:`${z.flags}g`));function J(z){let G=z.toLowerCase().replace(/[-_]/g,"");return HN.test(z)||G.includes("apikey")||G.endsWith("secret")||G.endsWith("password")||G.endsWith("token")&&!G.endsWith("tokens")||!!$.extraSecretKeys?.(G)}function X(z){let G=z,Q=[["name",z.name],["message",z.message],["stack",z.stack]];for(let W of["code","status","cause"])if(G[W]!==void 0)Q.push([W,G[W]]);let K=new Set(Q.map(([W])=>W));for(let W of Object.entries(z))if(!K.has(W[0]))Q.push(W);return Q}function Y(z,G,Q,K=0){if(typeof z==="string")return Z.reduce((W,V)=>W.replace(V,Pz),z);if(!z||typeof z!=="object")return z;if(Q.has(z))return"[Circular]";Q.add(z);try{if(Array.isArray(z))return z.map((B)=>Y(B,G,Q,K));let W=LN(z);if(W&&K>=NN)return"[Truncated]";let V=W?K+1:K;return Object.fromEntries((W?X(z):Object.entries(z)).map(([B,H])=>[B,G&&J(B)?Pz:Y(H,G,Q,V)]))}finally{Q.delete(z)}}return{redact:(z)=>Y(z,!0,new WeakSet),redactStrings:(z)=>Y(z,!1,new WeakSet)}}var fK=y1(),qN=fK.redact,OI=fK.redactStrings,ON="Pi install failed; run pi install after checking your npm connection.";function DN($){let Z=Buffer.from($,"utf8");if(Z.length<=U$)return $;let J=Z.length-U$;while(J<Z.length){let X=Z[J];if(X===void 0||(X&192)!==128)break;J++}return Z.subarray(J).toString("utf8")}function _N($){let Z=$.indexOf(`
-`);return Z<0?"":$.slice(Z+1)}class vK extends Error{step="pi-install";exitCode;signal;stderrTail;constructor($){super(ON);this.name="SetupCommandError",this.exitCode=$.exitCode,this.signal=$.signal;let Z=$.stderrTruncated?_N($.stderrTail):$.stderrTail,J=qN(Z);this.stderrTail=DN(typeof J==="string"?J:"")}}async function IN($,Z,J={}){let X=(J.platform??process.platform)==="win32",Y=xN($);await jN(Y,{recursive:!0});let z;if(!X)try{z=(await PN($)).mode&4095}catch(K){if(K.code!=="ENOENT")throw K}let G=AN(Y,`.${FN($)}.${(J.stageName??MN)()}.tmp`),Q=!1;try{let K=await RN(G,"wx",z??438);Q=!0;try{if(await K.writeFile(Z,"utf8"),z!==void 0)await K.chmod(z)}finally{await K.close()}let W=J.now??(()=>performance.now()),V=W();for(let B=0;;B++){await J.beforeRename?.();try{await(J.rename??TN)(G,$),Q=!1;return}catch(H){let q=H.code,N=2000-(W()-V);if(!X||!["EPERM","EBUSY","EACCES"].includes(q??"")||N<=0||B>=40)throw Error(`Unable to replace host config ${$}. Close editors or other programs using the file, then rerun setup.`);await(J.wait??SN)(Math.min(N,25*2**Math.min(B,2)))}}}finally{if(Q)await CN(G).catch(()=>{})}}function Cz($){let Z=typeof $==="string"?$:Array.isArray($)?$[0]:$&&typeof $==="object"&&("package"in $)?$.package:null;if(typeof Z!=="string")return null;let J=Z.indexOf("@",Z.startsWith("@")?1:0);return J<0?Z:Z.slice(0,J)}function Fz($,Z,J){let X=BN($),Y=X&&WN(X,[Z]),z=Y?.children??[],G=z[J];if(!G||!Y)throw Error("Invalid plugin array edit.");let Q=[{offset:G.offset,length:G.length,content:""}],K=(W,V)=>{let B=KN($.slice(W,V),!0);if(B.scan(),$[W+B.getTokenOffset()]===",")Q.push({offset:W+B.getTokenOffset(),length:1,content:""})};if(J===z.length-1){let W=z[J-1];if(W)K(W.offset+W.length,G.offset);K(G.offset+G.length,Y.offset+Y.length-1)}else K(G.offset+G.length,z[J+1]?.offset??G.offset+G.length);return A9($,Q)}function EN($,Z,J,X){let Y=[],z=VN($,Y,{allowTrailingComma:!0});if(Y.length||!z||typeof z!=="object"||Array.isArray(z))throw Error("Invalid OpenCode config; refusing to overwrite it.");let G={formattingOptions:{insertSpaces:!/^\t+/m.test($),tabSize:/^([ ]+)"/m.exec($)?.[1]?.length??2,eol:$.includes(`\r
-`)?`\r
-`:`
-`}},Q=$,K=z[Z];if(K!==void 0&&!Array.isArray(K))throw Error(`OpenCode ${Z} must be an array.`);let W=Array.isArray(K)?[...K]:[],V=W.flatMap((q,N)=>Cz(q)===J?[N]:[]),B=`${J}@${X}`;if(!V.length)Q=A9(Q,Tz(Q,K===void 0?[Z]:[Z,W.length],K===void 0?[B]:B,G));else{let q=V[0],N=W[q],O=Array.isArray(N)?[B,...N.slice(1)]:N&&typeof N==="object"?{...N,package:B}:B;if(JSON.stringify(N)!==JSON.stringify(O))Q=A9(Q,Tz(Q,[Z,q],O,G));for(let U of V.slice(1).reverse())Q=Fz(Q,Z,U)}let H=Z==="plugin"?"plugins":"plugin";if(Array.isArray(z[H])){let q=z[H];for(let N=q.length-1;N>=0;N--)if(Cz(q[N])===J)Q=Fz(Q,H,N)}return Q}function wN($,Z,J={}){let X=J.fs??Z1,{path:Y,opencode:z}=B0(J),G=Z==="2"?"plugins":"plugin";return(Z==="2"?["opencode"]:["opencode","tui"]).map((K)=>{let W=Y.join(z,`${K}.jsonc`),V=Y.join(z,`${K}.json`),B=X.exists(W)?W:X.exists(V)?V:W,H=X.exists(B),q=H?X.readText(B):`${JSON.stringify({$schema:`https://opencode.ai/${K==="tui"?"tui":"config"}.json`},null,2)}
-`,N=EN(q,G,$.packages.opencode,$.version);return{path:B,content:N,changed:!H||N!==q}})}async function kN($,Z){for(let J of $){if(!J.changed)continue;await Z?.(),await IN(J.path,J.content,{beforeRename:Z})}}async function bN($,Z,J={}){let{platform:X,env:Y}=B0(J),z=await kK(J.runner??M2,X,Z,["install",`npm:${$.packages.pi}@${$.version}`],Y);if(z.exitCode!==0||z.timedOut)throw new vK({exitCode:z.spawnError?null:z.exitCode,signal:z.signal??null,stderrTail:z.stderr,stderrTruncated:z.stderrTruncated??!1})}var fN="Multiple OpenCode generations found. Choose --opencode=1|2|both before running noninteractive setup.";function vN($){let Z={yes:!1,dryRun:!1,claustrum:!1,noClaustrum:!1,login:!1,opencode:void 0};for(let J of $)if(J==="--yes")Z.yes=!0;else if(J==="--dry-run")Z.dryRun=!0;else if(J==="--claustrum")Z.claustrum=!0;else if(J==="--no-claustrum")Z.noClaustrum=!0;else if(J==="--login")Z.login=!0;else if(/^--opencode=(1|2|both)$/.test(J))Z.opencode=J.slice(11);else throw Error(`Unknown setup argument: ${J}`);if(Z.claustrum&&Z.noClaustrum)throw Error("--claustrum and --no-claustrum cannot be used together.");if(Z.login&&Z.claustrum)throw Error("--login and --claustrum cannot be used together.");return Z}function yN($){for(let Z of Object.values($.packages))if(!/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/.test(Z))throw Error("Setup requires npm package names.");if(!/^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?(?:\+[a-zA-Z0-9.-]+)?$/.test($.version))throw Error("Setup requires a concrete package version.");for(let Z of Object.values($.vault.hosts))if(!/^[a-z0-9][a-z0-9-]*$/.test(Z.name))throw Error("Setup requires lowercase vault names containing only letters, digits and dashes.")}async function RI($,Z=[],J={}){let X=vN(Z);yN($);let Y=J.terminal??rH(),z=await nU($,J);W6(Y,`${$.displayName} setup`);for(let[_,T]of[["OpenCode",z.opencode],["Pi",z.pi]])W6(Y,`${_}: ${T.installed?`found (version ${T.version??"unknown"})`:"not found"} — ${T.directory}`);W6(Y,`Claustrum: ${z.claustrum.available?"available":"not available"}`);let G=z.pi.installed&&!z.pi.executable;if(G)W6(Y,"Pi: skipped, because its folder exists but pi is not on PATH. Install the Pi CLI and rerun setup to add it.");let Q=["opencode","pi"].filter((_)=>z[_].installed&&!(_==="pi"&&G)),K=X.yes||X.dryRun&&!S1(Y);if(!K&&!S1(Y))throw Error("Setup requires a TTY or --yes.");let W=K?Q:await QN(Y,Q)??[],V=X.opencode??(z.opencode.generation==="ambiguous"?"1":z.opencode.generation);if(W.includes("opencode")&&!X.opencode&&z.opencode.generation==="ambiguous"){if(K||!S1(Y))throw Error(fN);let _=await T9(Y,[{value:"1",label:"OpenCode 1"},{value:"2",label:"OpenCode 2"},{value:"both",label:"Both (one compatible registration)"}],{message:"Which OpenCode generation should be registered?"});if(_===null)return{hosts:[],dryRun:X.dryRun,mode:"local",detection:z};V=_}if(!W.length)return W6(Y,"No hosts selected. Install OpenCode or Pi and rerun setup."),{hosts:W,dryRun:X.dryRun,mode:"local",detection:z};let{env:B,platform:H}=B0(J),q=J.fence??YN(J.runner??M2,{platform:H}),N=async()=>{try{await zN(q,B)}catch(_){if(_ instanceof e6)W6(Y,_.refusalText);throw _}};if(W6(Y,"Checking that OpenCode and Pi are not running…"),X.dryRun)try{let _=q.previewRunningHosts?await q.previewRunningHosts(B):{hosts:await q.listRunningHosts(B),uncheckedRuntimes:0},T=_.hosts;if(_.uncheckedRuntimes>0)W6(Y,"Node or Bun programs are running; a real run checks whether any of them is OpenCode or Pi.");let M=new Set(new k7(T).activeHosts.map((L)=>L.command.toLowerCase()==="pi"?"Pi":"OpenCode"));for(let L of M)W6(Y,`${L} is running; setup will ask you to quit it.`)}catch(_){if(W6(Y,"Process inspection failed; real setup will require successful inspection and stopped OpenCode/Pi hosts."),_ instanceof e6)W6(Y,_.refusalText)}else await N();if(X.claustrum&&!z.claustrum.available)throw Error("Claustrum is not available. Start ck or use --no-claustrum for local sign-in.");let O=Boolean(X.claustrum);if(!O&&!X.login&&!X.noClaustrum&&!K&&z.claustrum.available&&S1(Y)){let _=await T9(Y,[{label:"No",value:!1},{label:"Yes",value:!0}],{message:"Connect these hosts to the Claustrum vault?"});if(_===null)return W6(Y,"Setup cancelled. Nothing was changed."),{hosts:[],dryRun:X.dryRun,mode:"local",detection:z};O=_===!0}let U=O?"claustrum":"local",D=W.includes("opencode")?wN($,V,J):[];if(X.dryRun){W6(Y,"Dry run: no registrations, enrollment, sign-in or migration will be performed.");for(let _ of W){if($.beforeSignIn)W6(Y,`Would run beforeSignIn(${_}, ${U}).`);if(O){let T=CK($.vault.hosts[_].paths);W6(Y,`Would Connect ${_}: write ${T.statePath} and ${T.tokenPath}; wait for ck auth enroll approve.`)}else W6(Y,`Would sign in locally for ${_}.`);if($.beforeRegister)W6(Y,`Would run beforeRegister(${_}, ${U}).`)}for(let _ of D)W6(Y,`${_.changed?"Would write":"Unchanged"} ${_.path}:
-${_.content}`);if(W.includes("pi"))W6(Y,`Would run ${z.pi.executable} install npm:${$.packages.pi}@${$.version}`);for(let _ of W)W6(Y,`Would migrate ${_} using the plugin callback (provider-specific writes).`)}else{let _={opencodeGeneration:V,mode:U,hosts:Object.freeze([...W]),piAgentDir:z.pi.directory};for(let T of W){if(await N(),await $.beforeSignIn?.(T,_),await N(),O)await GN($,T,J,Y,N);else await $.signInLocal(T,_);if(await N(),await $.beforeRegister?.(T,U,_),await N(),T==="opencode")await kN(D,N);else await bN($,z.pi.executable,J);await N(),await $.migrate(T,_)}}return W6(Y,`${X.dryRun?"Planned":"Configured"} ${$.displayName} for ${W.join(", ")} (${U}).`),W6(Y,`Next: ${W.includes("opencode")?"start OpenCode":"start Pi"} and run ${$.slashCommand}.`),{hosts:W,dryRun:X.dryRun,mode:U,detection:z}}function cN($){return $&&typeof $==="object"&&"code"in $&&typeof $.code==="string"?$.code:"unknown"}var k8="subc-connection.json",iN="subc-",sN=".connection.json";function g1($){try{return uN($).isFile()}catch{return!1}}function aN($){let Z;try{Z=lN($)}catch{return[]}let J=[];for(let X of Z){if(typeof X!=="string")continue;if(!X.startsWith(iN)||!X.endsWith(sN))continue;let Y=r1($,X);if(g1(Y))J.push(Y)}return J.sort(),J}function nN($=process.env){let Z=$.XDG_RUNTIME_DIR?.trim();if(Z){let G=r1(Z,k8);if(g1(G))return G}let J=$.HOME?.trim();if(J){let G=r1(J,".local","share","cortexkit","run",k8);if(g1(G))return G}let Y=`/run/user/${process.getuid?.()??S9().uid}/${k8}`;if(g1(Y))return Y;let z=aN(dN());if(z.length===1)return z[0];return}function oN($=process.env){let Z=nN($);if(Z)return Z;let J=$.XDG_RUNTIME_DIR?.trim();if(J&&(process.platform!=="darwin"||g1(J)))return r1(J,k8);if(process.platform==="darwin"){let Y=$.HOME?.trim()||S9().homedir;return r1(Y,".local","share","cortexkit","run",k8)}return`/run/user/${process.getuid?.()??S9().uid}/${k8}`}function gK($,Z=process.env){return $?.trim()||Z.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE?.trim()||Z.CLAUSTRUM_SUBC_CONNECTION?.trim()||oN(Z)}function tJ($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function rN($){return tJ($)&&typeof $.host==="string"&&$.host.trim().length>0&&typeof $.port==="number"&&Number.isInteger($.port)&&$.port>0&&$.port<=65535}async function EI($){let Z=gK($),J;try{J=await yK.readFile(Z,"utf8")}catch(Y){let z=cN(Y);if(z==="ENOENT")return{status:"absent",path:Z};return{status:"malformed",path:Z,reason:`unreadable (${z})`}}let X;try{X=JSON.parse(J)}catch{return{status:"malformed",path:Z,reason:"invalid JSON"}}if(!tJ(X)||typeof X.schema!=="number"||!Number.isFinite(X.schema)||typeof X.wire_version!=="number"||!Number.isFinite(X.wire_version)||!Array.isArray(X.endpoints)||X.endpoints.length===0||!X.endpoints.every(rN))return{status:"malformed",path:Z,reason:"connection file has an invalid schema, wire_version, or endpoints"};return{status:"available",schema:X.schema,wireVersion:X.wire_version,endpoints:X.endpoints.map((Y)=>({host:Y.host,port:Y.port}))}}var mK="claustrum-tombstone:v1:";function hK($){return`${mK}${$}`}function b7($){return{type:"oauth",access:"",refresh:hK($),expires:0}}function pK($){return typeof $==="string"&&$.startsWith(mK)}function wI($,Z){if(!tJ($)||$.type!=="oauth")return!1;return $.refresh===hK(Z)}class eJ extends Error{provider;code="custody_tombstone_refresh";constructor($){super(`${$} OAuth credentials are vault-custodied; local token refresh is forbidden`);this.provider=$,this.name="CustodyTombstoneRefreshError"}}function $X($,Z){if(pK($))throw new eJ(Z)}var f7="9d1c250a-e61b-44d9-88ed-5944d1962f5e",lK={console:"https://platform.claude.com/oauth/authorize",max:"https://claude.com/cai/oauth/authorize"},I9="https://platform.claude.com/oauth/code/callback",uK="https://platform.claude.com/v1/oauth/token",tN=/^ckh_[A-Za-z0-9_-]{43}$/,dK="axios/1.15.2",cK=["org:create_api_key","user:profile","user:inference","user:sessions:claude_code","user:mcp_servers","user:file_upload"],eN="user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload",kI="mcp_";var $L="fast-mode-2026-02-01";function bI($,Z){let J=($??"").split(",").map((X)=>X.trim()).filter(Boolean);return[...new Set([...J,...Z])].join(",")}function fI($){return typeof $==="string"&&($.startsWith("claude-opus-4-8")||$.startsWith("claude-opus-5"))}var vI="You are OpenCode",yI="You are Claude Code, Anthropic's official CLI for Claude.",gI=["<use_parallel_tool_calls>","For maximum efficiency, whenever you perform multiple independent operations, invoke all relevant tools simultaneously rather than sequentially. Prioritize calling independent tools in parallel whenever possible. For example, when reading 3 known files, run 3 tool calls in parallel to read all 3 files into context at the same time. When running multiple independent read-only commands like `ls` or `list_dir`, run all of those commands in parallel. Err on the side of maximizing parallel tool calls for independent work rather than running too many tools sequentially.","","Do not parallelize tool calls when one call depends on the output of another call. If a tool call needs an ID, filename, search result, or any other value returned by a previous tool call, run the first call, wait for its result, then run the dependent call using the real returned value. Never invent placeholder IDs, guessed task IDs, or other guessed values for dependent tool calls just to place them in the same parallel block.","</use_parallel_tool_calls>"].join(`
-`),ZL="59cf53e54c78",JL=[4,7,20],j2="2.1.280",iK="cli",XL="0.112.1",YL="v26.3.0",zL=`claude-cli/${j2} (external, ${iK})`,sK=["explicit","automatic","hybrid"],aK="explicit",mI=["github.com/anomalyco/opencode","opencode.ai/docs"],hI=[{match:"if OpenCode honestly",replacement:"if the assistant honestly"},{match:"Here is some useful information about the environment you are running in:",replacement:"Environment context you are running in:"}],Az=new Set(["EAI_AGAIN","ECONNREFUSED","ECONNRESET","EHOSTUNREACH","ENETUNREACH","ENOTFOUND","ETIMEDOUT","UND_ERR_CONNECT_TIMEOUT"]);function Sz($,Z){if(!$||typeof $!=="object")return;let J=$[Z];return typeof J==="string"?J:void 0}function nK($){let Z=Sz($,"code");if(Z&&Az.has(Z))return Z;let J=$ instanceof Error?$.message:Sz($,"message")??String($);if(J.includes("fetch failed"))return"ECONNRESET";return[...Az].find((X)=>J.includes(X))}function s$($){return nK($)!==void 0}function Iz($){let Z="";for(let J of $)Z+=String.fromCharCode(J);return btoa(Z).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async function GL(){let $=new Uint8Array(64);crypto.getRandomValues($);let Z=Iz($),J=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(Z));return{verifier:Z,challenge:Iz(new Uint8Array(J)),method:"S256"}}function oK($){if(!$)return;let Z=Number($);if(Number.isFinite(Z)&&Z>0)return Math.ceil(Z);let J=Date.parse($);if(Number.isFinite(J)){let X=Math.ceil((J-Date.now())/1000);return X>0?X:void 0}return}class t1 extends Error{status;body;retryAfter;isRefreshError=!0;constructor($,Z,J){super(`Claude OAuth refresh failed: ${$} — ${Z}`);this.status=$,this.body=Z,this.name="ClaudeOAuthRefreshError",this.retryAfter=oK(J??void 0)}}async function QL($){if($X($.refreshToken,"anthropic"),typeof $.refreshToken!=="string"||!$.refreshToken.trim())throw Error("Local OAuth refresh credential is unavailable");let Z=$.fetchImpl??fetch,J=$.maxRetries??2,X=$.baseDelayMs??500,Y=$.setTimeoutImpl??globalThis.setTimeout;for(let z=0;z<=J;z++)try{if(z>0){let W=X*2**(z-1);await new Promise((V)=>Y(V,W))}let G=await Z(uK,{method:"POST",redirect:"error",headers:{"Content-Type":"application/json",Accept:"application/json, text/plain, */*","User-Agent":dK},body:JSON.stringify({grant_type:"refresh_token",refresh_token:$.refreshToken,client_id:f7,scope:eN})});if(!G.ok){if(G.status>=500&&z<J){await G.body?.cancel().catch(()=>{});continue}let W=await G.text().catch(()=>"");throw new t1(G.status,W,G.headers.get("retry-after"))}let Q=await G.json(),K=$.now?.()??Date.now();return{access:Q.access_token,refresh:Q.refresh_token??$.refreshToken,expires:K+Q.expires_in*1000,expiresIn:Q.expires_in,authLineageId:$.authLineageId}}catch(G){if(G instanceof t1)throw G;if(z<J&&s$(G))continue;throw G}throw Error("Token refresh exhausted all retries")}function KL(){return crypto.randomUUID().replace(/-/g,"")}function WL($){let Z=$.trim();try{let G=new URL(Z),Q=G.searchParams.get("code"),K=G.searchParams.get("state");if(Q&&K)return{code:Q,state:K}}catch{}let J=Z.split("#");if(J.length===2&&J[0]&&J[1])return{code:J[0],state:J[1]};let X=new URLSearchParams(Z),Y=X.get("code"),z=X.get("state");if(Y&&z)return{code:Y,state:z};return null}async function VL($,Z,J){let X=await fetch(uK,{method:"POST",redirect:"error",headers:{"Content-Type":"application/json",Accept:"application/json, text/plain, */*","User-Agent":dK},body:JSON.stringify({code:$.code,state:$.state,grant_type:"authorization_code",client_id:f7,redirect_uri:J,code_verifier:Z})});if(!X.ok)return{type:"failed"};let Y=await X.json();return{type:"success",refresh:Y.refresh_token,access:Y.access_token,expires:Date.now()+Y.expires_in*1000}}async function pI($){let Z=await GL(),J=KL(),X=new URL(lK[$],import.meta.url);return X.searchParams.set("code","true"),X.searchParams.set("client_id",f7),X.searchParams.set("response_type","code"),X.searchParams.set("redirect_uri",I9),X.searchParams.set("scope",cK.join(" ")),X.searchParams.set("code_challenge",Z.challenge),X.searchParams.set("code_challenge_method","S256"),X.searchParams.set("state",J),{url:X.toString(),redirectUri:I9,state:J,verifier:Z.verifier}}async function lI($,Z,J,X){let Y=WL($);if(!Y)return{type:"failed"};if(X&&Y.state!==X)return{type:"failed"};return VL(Y,Z,J)}var BL=globalThis.setTimeout.bind(globalThis),HL=globalThis.clearTimeout.bind(globalThis),rK="anthropic-auth.json",UL="anthropic-auth-state.json",NL="https://api.anthropic.com/api/oauth/usage",v7=["five_hour","seven_day","scoped","extraUsage","bindingWindow","fallbackAdvised"];function uI($){return $.access==null&&($.refresh==null||$.refresh==="")}function W8($){return $.type==="oauth"}function dI($){return $.type==="api"}function tK($){let Z=$?.trim();if(!Z)return!1;try{let J=new URL(Z);return(J.protocol==="http:"||J.protocol==="https:")&&!J.username&&!J.password}catch{return!1}}function cI($){return $.costZeroing?.enabled!==!1}var LL=[401,403,429];var E9=300000,qL=3600000,eK=86400000,OL=60000,DL=900000,_L=300000,ML=5,Ez={five_hour:0,seven_day:0},jL=!0,iI=60000;function RL(){if(process.env.OPENCODE_CONFIG_DIR?.trim())return process.env.OPENCODE_CONFIG_DIR.trim();return c8(process.env.XDG_CONFIG_HOME||c8(hN(),".config"),"opencode")}function ZX(){return process.env.OPENCODE_ANTHROPIC_AUTH_FILE?.trim()||c8(RL(),rK)}function TL($=ZX()){let Z=process.env.OPENCODE_ANTHROPIC_AUTH_STATE_FILE?.trim();if(Z)return Z;return $.endsWith(rK)?c8(pN($),UL):`${$}.state.json`}function sI(){return{version:1,main:{type:"opencode",provider:"anthropic"},accounts:[]}}function O1($,Z){if(Z===void 0||!Number.isFinite(Z))return $;if($===void 0||!Number.isFinite($))return Z;return Math.max($,Z)}function r6($){return Math.max($?.five_hour?.checkedAt??0,$?.seven_day?.checkedAt??0,...$?.scoped?.map((Z)=>Z.checkedAt)??[],$?.checkedAt??0)}function wz($){if($?.source==="poll")return 2;if($?.source==="headers")return 1;return 0}function PL($,Z){if(!("scoped"in $))return Z.scoped;if(!Array.isArray($.scoped)||$.scoped.length===0)return $.scoped;if(!Array.isArray(Z.scoped)||Z.scoped.length===0)return $.scoped;let J=new Map(Z.scoped.map((X)=>[X.id,X]));for(let X of $.scoped){let Y=J.get(X.id);if(!Y||X.checkedAt>=Y.checkedAt)J.set(X.id,X)}return[...J.values()]}function kz($,Z,J){let X=$[J],Y=Z[J];if(!Y)return X;if(!X)return Y;if(Y.checkedAt>X.checkedAt)return Y;if(Y.checkedAt<X.checkedAt)return X;return wz($)>wz(Z)?X:Y}function F0($,Z){if(!$||$[Z]===void 0)return;return $.fieldSources?.[Z]??($.source==="poll"||$.source==="headers"?$.source:void 0)}function CL($,Z,J){let X={};for(let Y of v7){if(J[Y]===void 0)continue;if(Y==="scoped"||Y==="extraUsage"){X[Y]="poll";continue}if(Y==="bindingWindow"&&$.bindingWindowSource==="poll"&&$.bindingWindow===J.bindingWindow){X[Y]="poll";continue}if(Y==="fallbackAdvised"&&Z.fieldSources?.fallbackAdvised===void 0){let G=F0($,Y);if(G)X[Y]=G;continue}let z=Z[Y]===J[Y]?F0(Z,Y):$[Y]===J[Y]?F0($,Y):F0($,Y)??F0(Z,Y);if(z)X[Y]=z}return Object.keys(X).length>0?X:void 0}function FL($,Z){if(!$||Z.source!=="headers")return Z;let J=$.bindingWindowSource==="poll",X={...$,...Z,five_hour:kz($,Z,"five_hour"),seven_day:kz($,Z,"seven_day"),scoped:PL($,Z),extraUsage:$.extraUsage??Z.extraUsage,fallbackAdvised:Z.fieldSources?.fallbackAdvised!==void 0?Z.fallbackAdvised:$.fallbackAdvised??Z.fallbackAdvised,bindingWindow:J?$.bindingWindow:Z.bindingWindow??$.bindingWindow,bindingWindowSource:J?"poll":Z.bindingWindowSource??$.bindingWindowSource},Y=CL($,Z,X);return{...X,...Y&&{fieldSources:Y}}}function kZ($){return $?.claustrum?.mode==="claustrum"?"claustrum":"local"}async function e1($){let J=`${$.path??ZX()}.${$.name}.lock`,X=c8(J,"owner.json"),Y=w4(),z=Date.now,G=null,Q=!1;async function K(){try{return JSON.parse(await k4(J,"utf8"))}catch(q){if(q.code!=="EISDIR")throw q;return JSON.parse(await k4(X,"utf8"))}}async function W(){await b4(J,`${JSON.stringify({ownerId:Y,expiresAt:z()+$.ttlMs})}
-`,{encoding:"utf8",mode:384})}async function V(){try{return await b4(J,`${JSON.stringify({ownerId:Y,expiresAt:z()+$.ttlMs})}
-`,{encoding:"utf8",mode:384,flag:"wx"}),!0}catch(q){let N=q.code;if(N==="EEXIST"||N==="EISDIR")return!1;throw q}}function B(){if(!$.renew||Q)return;let q=$.renewIntervalMs??Math.max(1000,Math.floor($.ttlMs/3));if(G=BL(()=>{(async()=>{try{let N=await K(),O=z();if(Q||N?.ownerId!==Y||Number(N?.expiresAt)<=O)return;await W(),B()}catch{}})()},q),"unref"in G)G.unref()}let H=await V();if(!H){let q=`${J}.evicting`,N=c8(q,"owner.json"),O=w4(),U=5000,D=8;async function _(){await new Promise((w)=>setTimeout(w,Math.floor(Math.random()*4)))}async function T(){try{let w=await K();return Number(w?.expiresAt)>z()}catch{try{return(await xz(J)).mtimeMs+$.ttlMs>z()}catch{return!1}}}async function M(){try{return JSON.parse(await k4(N,"utf8"))?.ownerId===O}catch{return!1}}async function L(){await gN(q);try{await b4(N,`${JSON.stringify({ownerId:O,createdAt:z()})}
-`,{encoding:"utf8",mode:384,flag:"wx"})}catch(w){let v=w.code;if(v==="ENOENT"||v==="EINVAL")return!1;throw await C(),w}return await $.onStep?.("eviction-marker-acquired"),!0}async function C(){if(await M())await q1(q,{recursive:!0,force:!0}).catch(()=>{})}for(let w=0;w<8;w++){if(H=await V(),H)break;if(await T())return null;try{if(!await L()){await _();continue}}catch(v){if(v.code!=="EEXIST")throw v;let a;try{a=await xz(q)}catch(R){if(R.code==="ENOENT"){await _();continue}throw R}if(a.mtimeMs+5000>z())return null;await $.onStep?.("stale-marker-stat");let p=`${q}.${w4()}`;try{await mN(q,p)}catch(R){if(R.code==="ENOENT"){await _();continue}throw R}await $.onStep?.("stale-marker-claimed"),await q1(p,{recursive:!0,force:!0}).catch(()=>{}),await _();continue}try{if(await T())return null;if(!await M())return null;if(await $.onStep?.("stale-lock-confirmed"),!await M())return null;if(await q1(J,{recursive:!0,force:!0}).catch(()=>{}),!await M())return null;if(H=await V(),!H)return null;if(!await M())return await q1(J,{recursive:!0,force:!0}).catch(()=>{}),H=!1,null;break}finally{await C()}}}if(!H)return null;return B(),{assertOwned:async()=>{let q=await K().catch(()=>{return});if(Q||q?.ownerId!==Y)throw Error("Account file lock ownership was lost")},release:async()=>{if(Q=!0,G)HL(G),G=null;try{if((await K())?.ownerId!==Y)return}catch{return}await q1(J,{recursive:!0,force:!0}).catch(()=>{})}}}function aI($){return $?.claudeCache?.enabled===!0}function xL($){return typeof $==="string"&&sK.includes($)?$:aK}function nI($){return xL($?.claudeCache?.mode)}function oI($){return $?.dump?.enabled===!0}function rI($){return $?.claudeFast?.enabled===!0}function tI($){return $?.cacheKeep?.subagents===!0}function eI($){return $?.prime?.enabled===!0}function AL($){return $?.fallbackOn?.length?$.fallbackOn:LL}function $E($,Z){return AL(Z).includes($)}function JX($){let Z=$?.quota?.minimumRemaining||{};return{five_hour:Z.five_hour??Z["5h"]??Ez.five_hour,seven_day:Z.seven_day??Z["1w"]??Ez.seven_day}}function $W($){return $?.quota?.enabled!==!1}function SL($){let Z=$.status;if(typeof Z==="number"&&Number.isFinite(Z))return Z===429||Z>=500;return s$($)}function IL($){let J=($.previous?.accountIdentity===$.accountIdentity&&$.previous?.refreshTokenFingerprint===$.refreshTokenFingerprint?$.previous?.retryCount??0:0)+1,X=$.error.retryAfter,Y;if(typeof X==="number"&&X>0)Y=X*1000;else if(s$($.error))Y=E9;else if(SL($.error))Y=Math.min(qL,E9*2**Math.min(J-1,6));else Y=eK;let z=$.error.status,G=typeof z==="number"&&Number.isFinite(z)?z:void 0,Q=y7($.error),W=(typeof $.error.body==="string"?$.error.body:"").includes("invalid_grant")||Q.includes("invalid_grant");return{message:Q,checkedAt:$.now,nextRetryAt:$.now+Y,retryCount:J,accountIdentity:$.accountIdentity,refreshTokenFingerprint:$.refreshTokenFingerprint,status:G,permanent:G===400&&W}}function X7($){if(!$)return!1;if(typeof $.permanent==="boolean")return $.permanent;if(typeof $.status==="number")return $.status===400;if(s$($))return!1;if(typeof $.nextRetryAt==="number")return $.nextRetryAt-$.checkedAt>=eK;return!1}function ZW($){let Z=$.nextRetryAt;if(!Z||!s$($))return Z;return Math.min(Z,$.checkedAt+E9)}function ZE($,Z,J,X){if(!$)return!1;let Y=ZW($);if(!Y||Y<=J)return!1;if($.refreshTokenFingerprint&&X&&$.refreshTokenFingerprint!==X)return!1;if(!$.accountIdentity)return!0;if(!Z)return!0;return $.accountIdentity===Z}function JE($,Z){return`Claude OAuth refresh is backed off for ${Math.max(1,Math.ceil(((ZW($)??Z)-Z)/1000))}s after: ${$.message}`}function XE($){if(!$)return[];return $.accounts.filter((Z)=>Z.enabled!==!1&&W8(Z)&&X7(Z.lastRefreshError)).map((Z)=>Z.label?.trim()||Z.id)}function EL($){if($.status===403)return!0;return/Claude quota check failed: 403\b/.test(y7($))}function w9($){let J=($.previous?.accountIdentity===$.accountIdentity?$.previous?.retryCount??0:0)+1,X=pL($.error)?Math.min(DL,OL*2**Math.min(J-1,6)):_L;return{message:y7($.error),checkedAt:$.now,nextRetryAt:$.now+X,retryCount:J,...$.accountIdentity!==void 0&&{accountIdentity:$.accountIdentity}}}function VZ($,Z){if(!$?.nextRetryAt||$.nextRetryAt<=Z)return!1;return!0}function YE($,Z){return`Quota API backed off for ${Math.max(1,Math.ceil((($.nextRetryAt??Z)-Z)/1000))}s after: ${$.message}`}function m1($){let Z=$?.quota?.checkIntervalMinutes??ML;return Math.max(1,Z)*60000}function zE($){return $?.logging?.level}function wL($){let Z=$?.quota?.mainQuota;if(!Z)return null;return{quota:Z,checkedAt:r6(Z),tokenFingerprint:$.quota?.mainQuotaToken,accountIdentity:Z.accountIdentity}}function kL($){let Z=$?.quota?.refreshEveryNRequests;return typeof Z==="number"&&Number.isFinite(Z)&&Z>0?Math.floor(Z):0}function k9($){return $?.quota?.failClosedOnUnknownQuota??jL}function JW($){return $.toLowerCase().replace(/[^a-z0-9]/g,"")}function bL($){if(typeof $!=="string")return null;let Z=JW($);if(Z.includes("fable"))return"fable";if(Z.includes("mythos"))return"mythos";return Z}function H0($,Z){let J=bL(Z);if(!J)return;return $?.scoped?.find((X)=>{return[X.modelId,X.modelName,X.title].filter((z)=>typeof z==="string").map(JW).join(" ").includes(J)})}function fL($,Z){let J=H0($,Z);return Boolean(J&&Number.isFinite(J.remainingPercent)&&J.remainingPercent<=0)}function XW($,Z){return!fL($,Z)}function vL($,Z){if(!$W(Z))return!0;let J=JX(Z);for(let X of["five_hour","seven_day"]){let Y=$?.[X];if(!Y)return!k9(Z);if(!Number.isFinite(Y.remainingPercent))return!k9(Z);if(Y.remainingPercent<J[X])return!1}return!0}function GE($){return Boolean($?.five_hour&&$.seven_day)}var b8={five_hour:5,seven_day:10,scoped:0};function Y7($){let Z=$?.five_hour??$?.["5h"],J=$?.seven_day??$?.["1w"],X=$?.scoped;return{five_hour:typeof Z==="number"&&Number.isFinite(Z)?Z:b8.five_hour,seven_day:typeof J==="number"&&Number.isFinite(J)?J:b8.seven_day,scoped:typeof X==="number"&&Number.isFinite(X)?X:b8.scoped}}function YW($){return $?.killswitch?.enabled===!0}function zW($,Z){if(!$?.killswitch)return b8;if(Z&&$.killswitch.accounts?.[Z])return Y7($.killswitch.accounts[Z]);return Y7($.killswitch.main)}function GW($,Z,J,X){if(!YW(Z))return!0;let Y=zW(Z,J),z=!1;for(let G of["five_hour","seven_day"]){let Q=$?.[G];if(!Q||!Number.isFinite(Q.remainingPercent)){if(Y[G]>0)return!1;z=!0;continue}if(Q.remainingPercent<Y[G])return!1}if(X){if(Y.scoped>0&&$?.scoped===void 0)return!1;let G=H0($,X);if(G&&(!Number.isFinite(G.remainingPercent)&&Y.scoped>0||G.remainingPercent<=Y.scoped))return!1}if(z)return!k9(Z);return!0}function yL($,Z,J,X){let Y=[],z=[$,...Z.map((G)=>G.quota)];for(let G of z)if(X){let K=H0(G,X)?.resetsAt;if(!K)continue;let W=Date.parse(K);if(Number.isFinite(W)&&W>J)Y.push(W)}else for(let Q of["five_hour","seven_day"]){let K=G?.[Q]?.resetsAt;if(!K)continue;let W=Date.parse(K);if(Number.isFinite(W)&&W>J)Y.push(W)}if(!Y.length)return 300;return Math.max(1,Math.ceil((Math.min(...Y)-J)/1000))+60}function QE($){return $?.killswitch??{enabled:!1}}function s0($,Z,J){let X=m1(Z);if(!$W(Z))return J+X;let Y=Math.min(...[...["five_hour","seven_day"].map((K)=>$?.[K]?.checkedAt),...($?.scoped??[]).map((K)=>K.checkedAt)].filter((K)=>Number.isFinite(K)).map((K)=>K+X)),z=(K)=>Number.isFinite(Y)?Math.min(K,Y):K,G=JX(Z),Q=[];for(let K of["five_hour","seven_day"]){let W=$?.[K];if(!W)return z(J+X);if(W.remainingPercent>=G[K])continue;let V=W.resetsAt?Date.parse(W.resetsAt):Number.NaN;if(!Number.isFinite(V)||V<=J)return z(J+X);Q.push(V)}if(!Q.length)return z(J+X);return z(Math.min(...Q)+60000)}function z7($){if(!Number.isFinite($))return 0;if($<0)return 0;if($>100)return 100;return $}function E0($){return typeof $==="string"&&$.trim()?$.trim():void 0}function QW($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")}function gL($,Z){if(!Array.isArray($))return[];let J=new Set,X=[];for(let Y of $){if(Y?.kind!=="weekly_scoped"||Y.group!=="weekly")continue;if(typeof Y.percent!=="number"||!Number.isFinite(Y.percent))continue;let z=E0(Y.scope?.model?.display_name);if(!z)continue;let G=E0(Y.scope?.model?.id)??z,Q=QW(G);if(!Q)continue;let K=`claude-weekly-scoped-${Q}`;if(J.has(K))continue;J.add(K);let W=z7(Y.percent),V=E0(Y.scope?.model?.id);X.push({id:K,title:`${z} only`,...V&&{modelId:V},modelName:z,usedPercent:W,remainingPercent:z7(100-W),resetsAt:Y.resets_at??void 0,checkedAt:Z})}return X}function mL($){if($.extra_usage?.is_enabled!==!0)return;let Z=$.extra_usage.used_credits,J=$.extra_usage.monthly_limit;if(typeof Z!=="number"||!Number.isFinite(Z)||typeof J!=="number"||!Number.isFinite(J))return;let X=$.spend?.limit?.currency,Y=X==null?"USD":E0(X),z=$.spend?.limit?.exponent,G=z==null?2:z;if(!Y||!/^[A-Za-z]{3}$/.test(Y)||!Number.isInteger(G)||G<0||G>20)return;return{used:{amountMinor:Z,currency:Y,exponent:G},limit:{amountMinor:J,currency:Y,exponent:G},...typeof $.extra_usage.utilization==="number"&&Number.isFinite($.extra_usage.utilization)&&{utilizationPercent:$.extra_usage.utilization},...E0($.spend?.severity)&&{severity:E0($.spend?.severity)},exhausted:Z>=J}}function hL($){if(!Array.isArray($))return;let Z=$.find((z)=>z?.is_active===!0);if(!Z)return;if(Z.kind==="session")return"five_hour";if(Z.kind==="weekly_all")return"seven_day";if(Z.kind!=="weekly_scoped"||Z.group!=="weekly")return;let J=E0(Z.scope?.model?.display_name);if(!J)return;let X=E0(Z.scope?.model?.id)??J,Y=QW(X);return Y?`claude-weekly-scoped-${Y}`:void 0}function bz($,Z){if(typeof $?.utilization!=="number")return;if(!Number.isFinite($.utilization))return;let J=z7($.utilization);return{usedPercent:J,remainingPercent:z7(100-J),resetsAt:$.resets_at??void 0,checkedAt:Z}}async function G7($){$X($.accessToken,"anthropic");let J=await($.fetchImpl??fetch)(NL,{method:"GET",headers:{Authorization:`Bearer ${$.accessToken}`,Accept:"application/json","Content-Type":"application/json","anthropic-beta":"oauth-2025-04-20","User-Agent":`claude-code/${j2}`}});if(!J.ok){let K=await J.text().catch(()=>"");throw Object.assign(Error(`Claude quota check failed: ${J.status} — ${K}`),{status:J.status,retryAfter:oK(J.headers.get("Retry-After"))})}let X=$.now?.()??Date.now(),Y=await J.json(),z=hL(Y.limits),G={five_hour:bz(Y.five_hour,X),seven_day:bz(Y.seven_day,X),scoped:gL(Y.limits,X),extraUsage:mL(Y),...z&&{bindingWindow:z,bindingWindowSource:"poll"},source:"poll",checkedAt:X},Q={...G.five_hour&&{five_hour:"poll"},...G.seven_day&&{seven_day:"poll"},...G.scoped&&{scoped:"poll"},...G.extraUsage&&{extraUsage:"poll"},...G.bindingWindow&&{bindingWindow:"poll"}};return{...G,...Object.keys(Q).length>0&&{fieldSources:Q}}}function KE($,Z){if(!$||$.authLineageId!==Z)return null;return $.anthropicAccountUuid??null}function y7($){return $ instanceof Error?$.message:String($)}function pL($){let Z=$.status;if(typeof Z==="number"&&Number.isFinite(Z)){if(Z===429||Z>=500)return!0}let J=y7($);if(/Claude quota check failed: (429|5\d\d)\b/.test(J))return!0;if(J.includes("Quota refresh is already in progress"))return!0;return s$($)}var KW="## Claude Cache Status",lL="## Claude Cache Enabled",uL="## Claude Cache Disabled",dL="## Claude Cache Usage",cL="Usage: `/claude-cache`, `/claude-cache on`, `/claude-cache off`, or `/claude-cache mode explicit|automatic|hybrid`.",g7=!1,m7=aK;function WE(){return g7}function VE(){return m7}function BE($){g7=$.enabled,m7=$.mode}function iL($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="on")return{type:"enable"};if(Z.length===1&&Z[0]==="off")return{type:"disable"};if(Z.length===2&&Z[0]==="mode"&&(Z[1]==="explicit"||Z[1]==="automatic"||Z[1]==="hybrid"))return{type:"mode",mode:Z[1]};return{type:"usage"}}function D1($){let Z=$?.enabled??g7,J=$?.mode??m7;return[KW,"",`- Enabled: ${Z?"enabled":"disabled"}`,`- Mode: ${J}`,...$?.settingsPath?[`- Persisted: ${$.settingsPath}`]:[],"- Scope: main sessions only; subagent sessions keep default ephemeral cache behavior","- Modes: explicit = existing OpenCode breakpoints; automatic = top-level cache_control only; hybrid = system + messages[0] + top-level cache_control","- TTL: 1h when enabled for main sessions; default ephemeral cache behavior otherwise"].join(`
-`)}function HE($){let Z=iL($.argumentsText),J=$.enabled??g7,X=$.mode??m7;if(Z.type==="status")return D1({enabled:J,mode:X,settingsPath:$.settingsPath});if(Z.type==="enable")return[lL,"",D1({enabled:!0,mode:X,settingsPath:$.settingsPath})].join(`
-`);if(Z.type==="disable")return[uL,"",D1({enabled:!1,mode:X,settingsPath:$.settingsPath})].join(`
-`);if(Z.type==="mode")return[KW,"",`Mode updated to \`${Z.mode}\`.`,"",D1({enabled:J,mode:Z.mode,settingsPath:$.settingsPath})].join(`
-`);return[dL,"",cL,"",D1({enabled:J,mode:X,settingsPath:$.settingsPath})].join(`
-`)}var aL=/^req_[A-Za-z0-9_-]{8,128}$/,nL=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,oL=/ cc_(?:prev_req|prompt_id)=[^;\r\n]*;/g;function rL($){return aL.test($)}function tL($){return nL.test($)}var eL=0x4d659218e32a3268n,$q="cch=00000;";var XX=/("system":\[\{"type":"text","text":"x-anthropic-billing-header: cc_version=[^;"]+; cc_entrypoint=[^;"]+; )cch=([0-9a-f]{5});/,Zq=/("system":\[\{"type":"text","text":"x-anthropic-billing-header: cc_version=[^;"]+; cc_entrypoint=[^;"]+; )cch=00000;/,fz=null,Q7=null;async function WW(){if(Q7)return;fz??=(async()=>{Q7=(await Zz()).h64Raw})(),await fz}function VW($){let Z=$.find((X)=>X.role==="user");if(!Z)return"";let{content:J}=Z;if(typeof J==="string")return J;if(Array.isArray(J)){let X=J.filter((G)=>G.type==="text"),Y=X.find((G)=>G.text?.includes("<command-name>"));if(Y?.text)return Y.text.slice(Y.text.indexOf("<command-name>"));let z=X.findLast((G)=>typeof G.text==="string"&&G.text.length>0);if(z?.text)return z.text}return""}class Jq{limit;#$=new Map;constructor($=1000){this.limit=$}resolve($,Z,J=!0){let X=this.#$.get($);if(X!==void 0)return this.#$.delete($),this.#$.set($,X),X;let Y=VW(Z);if(J){if(!this.#$.has($)&&this.#$.size>=this.limit){let z=this.#$.keys().next().value;if(z!==void 0)this.#$.delete(z)}this.#$.set($,Y)}return Y}has($){return this.#$.has($)}clear(){this.#$.clear()}}async function Xq($){return await WW(),((Q7?.($,eL)??0n)&0xfffffn).toString(16).padStart(5,"0")}async function LE($){return await WW(),(Q7?.(new TextEncoder().encode($),0n)??0n).toString(16).padStart(16,"0").slice(0,16)}function Yq($){return $.replace(XX,`$1${$q}`)}function zq($){return XX.exec($)?.[2]??null}async function Gq($){if(!XX.test($))return $;let Z=Yq($),J=JSON.parse(Z);if("model"in J)J.model="";delete J.max_tokens;let X=await Xq(new TextEncoder().encode(JSON.stringify(J)));return Z.replace(Zq,`$1cch=${X};`)}function Qq($,Z=j2){let J=JL.map((X)=>$[X]??"0").join("");return sL("sha256").update(`${ZL}${J}${Z}`).digest("hex").slice(0,3)}function qE($,Z=j2,J,X,Y){let z=Qq(X??VW($),Z),G=`x-anthropic-billing-header: cc_version=${Z}.${z}; cc_entrypoint=${J}; cch=00000;`;if(Y?.previousRequestId&&rL(Y.previousRequestId))G+=` cc_prev_req=${Y.previousRequestId};`;if(Y?.promptId&&tL(Y.promptId))G+=` cc_prompt_id=${Y.promptId};`;return G}function Kq($){return $.replace(oL,"")}function Wq($){if(!$||typeof $!=="object")return 0;let Z=$.system;if(!Array.isArray(Z))return 0;let J=0;for(let X of Z){if(!X||typeof X!=="object")continue;let Y=X.text;if(typeof Y!=="string"||!Y.startsWith("x-anthropic-billing-header:"))continue;let z=Kq(Y);if(z===Y)continue;X.text=z,J+=1}return J}var b9="claude-fable-5",f9="claude-mythos-5",V8="claude-fable-5-1",$2="claude-mythos-5-1",HW="claude-haiku-4-5";function m0($){return $.endsWith("[1m]")?$.slice(0,-4):$}var vz={input:1,output:5},UW=[V8,$2],Bq=[b9,f9,...UW],R2={type:"adaptive",display:"summarized"},DE={input:10,output:50,cacheRead:1,cacheWrite5m:12.5,cacheWrite1h:20},_E={input:10,output:50,cacheRead:0.25,cacheWrite5m:12.5,cacheWrite1h:20},ME=1e6,jE=128000,Hq="2026-06-09",Uq="2026-09-01",yz={[b9]:{id:b9,name:"Claude Fable 5"},[f9]:{id:f9,name:"Claude Mythos 5",limited:!0},[V8]:{id:V8,name:"Claude Fable 5.1"},[$2]:{id:$2,name:"Claude Mythos 5.1",limited:!0}},RE={[V8]:yz[V8],[$2]:yz[$2]};function Nq($){if(typeof $!=="string")return!1;let Z=m0($);return Bq.some((J)=>Z===J||Z.startsWith(`${J}-`))}function Lq($){if(typeof $!=="string")return!1;let Z=m0($);return UW.some((J)=>Z===J||Z.startsWith(`${J}-`))}function YX($){if(typeof $!=="string")return!1;let Z=m0($);return Z===V8||Z.startsWith(`${V8}-`)}function TE($){return Lq($)?Uq:Hq}var gz="claude-sonnet-5",PE=R2;function CE($){if(typeof $!=="string")return!1;let Z=m0($);return!zX(Z)&&(Z===gz||Z.startsWith(`${gz}-`))}var mz="claude-sonnet-5-5",FE="2026-09-28",xE=1e6,AE=128000,SE={input:2,output:10,cacheRead:0.2,cacheWrite5m:2.5,cacheWrite1h:4},IE=R2;function zX($){if(typeof $!=="string")return!1;let Z=m0($);return Z===mz||Z.startsWith(`${mz}-`)}var qq="claude-haiku-5-5",EE="2026-10-07",wE=1e6,kE=128000,bE=1e5,fE={input:0.1,output:0.5,cacheRead:0.01,cacheWrite5m:0.125,cacheWrite1h:0.2},vE={input:0.5,output:2.5,cacheRead:0.05,cacheWrite5m:0.625,cacheWrite1h:1},yE=R2;function NW($){if(typeof $!=="string")return!1;let Z=m0($);return Z===qq||/^claude-haiku-5-5-\d{8}$/.test(Z)}var hz="claude-opus-5",gE=R2;function Oq($){if(typeof $!=="string")return!1;let Z=m0($);return!T2(Z)&&(Z===hz||Z.startsWith(`${hz}-`))}var pz="claude-opus-5-5",mE="2026-09-18",hE=1e6,pE=128000,lE={input:4,output:20,cacheRead:0.2,cacheWrite5m:5,cacheWrite1h:8},uE=R2;function T2($){if(typeof $!=="string")return!1;let Z=m0($);return Z===pz||Z.startsWith(`${pz}-`)}function dE($){return Oq($)||T2($)}function cE($){if(typeof $!=="string")return!1;if($.startsWith("gAAAA"))return!0;if(!$.startsWith("{"))return!1;try{let Z=JSON.parse($);return Z.type==="reasoning"&&typeof Z.id==="string"&&Z.id.startsWith("rs_")&&typeof Z.encrypted_content==="string"&&Z.encrypted_content.startsWith("gAAAA")}catch{return!1}}var iE="mid-conversation-output-config-2026-07-01",lz="per-turn-control-2026-07-01";function Dq($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function sE($){if($==="minimal")return"low";if($==="low"||$==="medium"||$==="high"||$==="xhigh"||$==="max")return $;return}function aE($){return YX($.model)}function LW($){return T2($)||zX($)}function nE($){if(YX($.model))return!0;return LW($.model)&&Dq($.thinking)&&$.thinking.type==="adaptive"}function oE($){return T2($)||NW($)?"medium":"high"}var _q=1000,R6=new Map;function R$($,Z,J,X=_q){if(!$.has(Z)&&$.size>=X){let Y=$.keys().next().value;if(Y!==void 0)$.delete(Y)}$.set(Z,J)}function f4($,Z){if(!Z.accountUuid)return Z;if(R6.get($)!==Z)return{...Z,accountUuid:void 0};let J={...Z,accountUuid:void 0};return R$(R6,$,J),J}function K7($){let Z=$||"anonymous",J=R6.get(Z);if(J)return J;let X={deviceId:Vq(32).toString("hex"),sessionId:BW()};return R$(R6,Z,X),X}var Mq=86400000,jq=300000,BZ=new Map,uz=new Map;function Rq($){return`compat:${$||"anonymous"}`}function GX($){return`identity:${$}`}function W7($,Z){return`account:${$}:${Z}`}function HZ($,Z,J){if(!$)return;if($.accountIdentity!==void 0&&$.accountIdentity!==Z)return;if(J!==void 0&&$.accountUuid!==void 0&&$.accountUuid!==J)return;if($.accountIdentity===Z&&(J===void 0||$.accountUuid===J))return $;return{...$,accountIdentity:Z,...J!==void 0&&{accountUuid:J}}}function I1($,Z,J){R$(R6,GX(Z),$),R$(R6,W7(J,Z),$)}async function Tq($,Z){if(!$.startsWith("sk-ant-oat"))return null;let J=new AbortController,X=setTimeout(()=>J.abort(),5000);try{let Y=new URL("https://api.anthropic.com/api/claude_cli/bootstrap");if(Y.searchParams.set("entrypoint",iK),Z)Y.searchParams.set("model",Z);let z=await fetch(Y,{method:"GET",redirect:"error",headers:{accept:"application/json, text/plain, */*",authorization:`Bearer ${$}`,"content-type":"application/json","anthropic-beta":"oauth-2025-04-20","user-agent":`claude-code/${j2}`},signal:J.signal});if(!z.ok)return null;let Q=(await z.json().catch(()=>null))?.oauth_account?.account_uuid;return typeof Q==="string"&&Q?Q:null}catch{return null}finally{clearTimeout(X)}}function rE($,Z){if(!$.trim()||!Z.trim())throw Error("A verified provider account identity is required");let X={...R6.get(W7(Z,$))??K7(GX($)),accountIdentity:$,accountUuid:Z};return I1(X,$,Z),X}async function qW($,Z,J){let X=J?.trim()||void 0,Y=X?GX(X):Rq($),z;if(X)z=HZ(R6.get(Y)??R6.get($),X)??K7(Y),z=HZ(z,X)??z,R$(R6,Y,z);else z=R6.get(Y)??R6.get($)??K7(Y),R$(R6,Y,z),R$(R6,$,z);if(!$.startsWith("sk-ant-oat"))return f4(Y,z);let G=Date.now(),Q=`${Y}:${$}`,K=uz.get(Q);if(K&&K.expiresAt>G){if(!K.accountUuid)return z=f4(Y,z),z;if(!X){if(z.accountUuid===K.accountUuid)return z;return z={...z,accountUuid:K.accountUuid},R$(R6,Q,z),z}let H=HZ(R6.get(W7(K.accountUuid,X))??R6.get(`account:${K.accountUuid}`),X,K.accountUuid);if(H)return z=H,I1(z,X,K.accountUuid),z;if(z.accountUuid===K.accountUuid)return z;return z={...z,accountIdentity:X,accountUuid:K.accountUuid},I1(z,X,K.accountUuid),z}let W=BZ.get(Q);if(!W)W=Tq($,Z),R$(BZ,Q,W);let V=await W.finally(()=>{if(BZ.get(Q)===W)BZ.delete(Q)});if(R$(uz,Q,{accountUuid:V,expiresAt:G+(V?Mq:jq)}),!V)return z=f4(Y,z),z;if(!X)return z={...z,accountUuid:V},R$(R6,Q,z),z;let B=HZ(R6.get(W7(V,X))??R6.get(`account:${V}`),X,V);if(B)return z=B,I1(z,X,V),z;return z={...z,accountIdentity:X,accountUuid:V},I1(z,X,V),z}class QX extends Error{code="unsupported-access";constructor(){super("Claude OAuth access credential is not supported; sign in to this account again");this.name="ClaudeUnsupportedAccessError"}}async function Pq($,Z,J){if(typeof $!=="string"||!$.startsWith("sk-ant-oat"))throw new QX;return qW($,Z,J)}function Z8($){return $!=null&&typeof $==="object"&&!Array.isArray($)}function Cq($){if(!$.accountUuid)return null;return JSON.stringify({device_id:$.deviceId,account_uuid:$.accountUuid,session_id:$.sessionId})}function tE($,Z){let J=Cq(Z);if(!J){if(Z8($.metadata))delete $.metadata.user_id;return!1}if(!Z8($.metadata))$.metadata={};let X=$.metadata;if(Z8(X))X.user_id=J;return!0}var Fq=["oauth-2025-04-20","interleaved-thinking-2025-05-14","thinking-token-count-2026-05-13","context-management-2025-06-27","prompt-caching-scope-2026-01-05","claude-code-20250219","advisor-tool-2026-03-01","advanced-tool-use-2025-11-20","mid-conversation-system-2026-04-07","effort-2025-11-24","fallback-credit-2026-06-01","extended-cache-ttl-2025-04-11","cache-diagnosis-2026-04-07"],xq=["oauth-2025-04-20","interleaved-thinking-2025-05-14","thinking-token-count-2026-05-13","context-management-2025-06-27","prompt-caching-scope-2026-01-05","advisor-tool-2026-03-01","structured-outputs-2025-12-15","cache-diagnosis-2026-04-07"],dz=["oauth-2025-04-20","interleaved-thinking-2025-05-14","thinking-token-count-2026-05-13","context-management-2025-06-27","prompt-caching-scope-2026-01-05","advisor-tool-2026-03-01","advanced-tool-use-2025-11-20","extended-cache-ttl-2025-04-11","cache-diagnosis-2026-04-07"];function Aq($){return $.output_config?.format?.type==="json_schema"}function Sq($){return Array.isArray($.tools)&&$.tools.length>0&&Array.isArray($.system)&&Z8($.thinking)&&Z8($.context_management)&&Z8($.output_config)&&Z8($.diagnostics)}function Iq($,Z=[]){let J=$?Sq($)?[...Fq]:Aq($)?[...xq]:[...dz]:[...dz];if($&&LW($.model)){let X=J.indexOf("mid-conversation-system-2026-04-07");if(X>=0)J.splice(X+1,0,lz);else J.push(lz)}if($?.speed==="fast")J.push($L);for(let X of Z){let Y=X.trim();if(Y)J.push(Y)}return[...new Set(J)].join(",")}function Eq(){switch(process.platform){case"darwin":return"MacOS";case"win32":return"Windows";case"linux":return"Linux";case"freebsd":return"FreeBSD";default:return"Unknown"}}function wq(){switch(process.arch){case"arm64":return"arm64";case"x64":return"x64";case"ia32":return"x32";default:return process.arch}}function eE($,Z,J={}){let X=J.identity??K7(Z),z=[...($.get("anthropic-beta")??"").split(",").map((G)=>G.trim()).filter(Boolean),...J.extraBetas??[]];return $.set("accept","application/json"),$.set("authorization",`Bearer ${Z}`),$.set("content-type","application/json"),$.set("user-agent",zL),$.set("anthropic-beta",Iq(J.body,z)),$.set("anthropic-dangerous-direct-browser-access","true"),$.set("anthropic-version","2023-06-01"),$.set("x-app","cli"),$.set("x-client-request-id",BW()),$.set("x-claude-code-session-id",X.sessionId),$.set("x-stainless-arch",wq()),$.set("x-stainless-lang","js"),$.set("x-stainless-os",Eq()),$.set("x-stainless-package-version",XL),$.set("x-stainless-retry-count","0"),$.set("x-stainless-runtime","node"),$.set("x-stainless-runtime-version",YL),$.set("x-stainless-timeout","600"),$.delete("x-api-key"),$}var kq=["model","messages","system","tools","tool_choice","metadata","max_tokens","temperature","thinking","context_management","output_config","diagnostics","stream","speed"];function bq($){let Z={};for(let J of kq)if(Object.hasOwn($,J))Z[J]=$[J];for(let[J,X]of Object.entries($))if(!Object.hasOwn(Z,J))Z[J]=X;return Z}function J1($){try{return JSON.parse($)}catch(Z){if(Z instanceof SyntaxError)throw SyntaxError("invalid JSON");throw Z}}var y9={error:0,warn:1,info:2,debug:3,trace:4},pq=new Set(Object.keys(y9));function g9($){if(!$)return null;let Z=$.trim().toLowerCase();return pq.has(Z)?Z:null}var lq=g9(process.env.OPENCODE_ANTHROPIC_AUTH_LOG_LEVEL),KX=lq??"info";function uq($){KX=$}function dq(){return KX}function WX($){return y9[$]<=y9[KX]}var x8=process.env.OPENCODE_ANTHROPIC_AUTH_LOG_FILE??MW.join(_W.tmpdir(),"opencode-anthropic-auth.log");var cq=5242880,iz=3;function iq(){try{if(!I$.existsSync(x8))return;if(I$.statSync(x8).size<cq)return}catch{return}try{for(let $=iz;$>=1;$--){let Z=$===1?x8:`${x8}.${$-1}`,J=`${x8}.${$}`;try{if($===iz)try{I$.unlinkSync(J)}catch{}if(I$.existsSync(Z))I$.renameSync(Z,J)}catch{}}}catch{}}var sq=/^(authorization|x-api-key|cookie|set-cookie|refresh|access|token|handle)$/i;function jW($){if(sq.test($))return!0;let Z=$.toLowerCase().replace(/[-_]/g,"");if(Z.includes("apikey"))return!0;if(Z.endsWith("secret")||Z.endsWith("password"))return!0;if(Z.endsWith("token")&&!Z.endsWith("tokens"))return!0;return!1}var aq=[/Bearer\s+\S+/,/sk-[A-Za-z0-9-]+/,/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/,tN];function nq($){if(typeof $!=="string")return!1;return aq.some((Z)=>Z.test($))}function RW($){if($==null||Object.keys($).length===0)return;let Z=new WeakSet;function J(X){if(X==null||typeof X!=="object"){if(nq(X))return"***REDACTED***";return X}if(Z.has(X))return"[Circular]";Z.add(X);try{if(Array.isArray(X))return X.map(J);let Y=X,z={};for(let[G,Q]of Object.entries(Y)){if(jW(G)){z[G]="***REDACTED***";continue}z[G]=J(Q)}return z}finally{Z.delete(X)}}return J($)}function oq($,Z,J,X){let Y=new Date().toISOString(),z=$.toUpperCase().padEnd(5),G=Z?` [${Z}]`:"",Q=(()=>{try{let K=RW(X),W=K?{...K,pid:process.pid}:{pid:process.pid};return` ${JSON.stringify(W)}`}catch{return` {"pid":${process.pid},"payload":"[unserializable]"}`}})();return`[${Y}] ${z}${G} ${J}${Q}`}var sz=null;function o0($,Z,J,X){if(!WX($))return;if(sz)try{sz({level:$,channel:Z,message:J,payload:RW(X)})}catch{}if(p7)return;try{let Y=`${oq($,Z,J,X)}
-`;if(p1.push(Y),p1.length>=tq)VX();else eq()}catch{}}var n={error($,Z,J){o0("error",$,Z,J)},warn($,Z,J){o0("warn",$,Z,J)},info($,Z,J){o0("info",$,Z,J)},debug($,Z,J){o0("debug",$,Z,J)},trace($,Z,J){o0("trace",$,Z,J)}},p7=!1,rq=500,tq=50,p1=[],f8=null;function VX(){if(f8)clearTimeout(f8),f8=null;if(p1.length===0)return;let $=p1.join("");p1=[];try{iq(),I$.appendFileSync(x8,$)}catch{}}function eq(){if(f8)return;f8=setTimeout(()=>{f8=null,VX()},rq)}var $O=/^\[([\w-]+)\]\s*/;function Yw($,Z){if(!WX("debug"))return;if(p7)return;try{let J="",X=$,Y=$.match($O);if(Y)J=Y[1]??"",X=$.slice(Y[0].length);let z;if(Z!=null){if(Z instanceof Error)z={error:`${Z.message}${Z.stack?`
-${Z.stack}`:""}`};else if(typeof Z==="object")z=Z}o0("debug",J,X,z)}catch{}}function L6($,Z){if(!WX("debug"))return;if(p7)return;try{let J;if(Z!=null){if(typeof Z==="object"&&!(Z instanceof Error))J=Z}o0("debug","relay",$,J)}catch{}}if(!p7)process.on("exit",VX);var ZO="## Claude Dump Status",JO="## Claude Dump Enabled",XO="## Claude Dump Disabled",YO="## Claude Dump Usage",zO="Usage: `/claude-dump`, `/claude-dump on`, or `/claude-dump off`.",GO="OPENCODE_ANTHROPIC_AUTH_DUMP_DIR",QO="OPENCODE_ANTHROPIC_AUTH_DUMP_MAX_BYTES",KO=h7(hq(),"opencode-anthropic-auth-dumps"),WO=536870912,VO=300000,BO=60000,HO=600000,BX=/\.(body|meta|relay|request|response)\.json$/,TW=/^\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z-\d{5,}-(.+)$/,V7="[a-zA-Z0-9._-]",PW=new RegExp(`^${V7}{1,80}-direct(?:-${V7}{1,80})?$`),CW=new RegExp(`^${V7}{1,80}-(?:http|websocket)-p[12]-(?:full_sync|patch)$`),UO=new RegExp(`^-direct(?:-${V7}{1,80})?$`),NO=/^-(?:http|websocket)-p[12]-(?:full_sync|patch)$/,P2=!1,az=0,nz=0,LO=100,A8=new Map;function zw($){P2=$}function C2(){return process.env[GO]||KO}function qO(){let $=Number(process.env[QO]);return Number.isFinite($)&&$>=0?Math.floor($):WO}function OO($){return h1($)===h1(C2())}function m9($){let Z=$.replace(BX,"");if(Z===$)return!1;let X=TW.exec(Z)?.[1];if(!X)return!1;return PW.test(X)||CW.test(X)}function DO($){if(!$.endsWith(".partial"))return!1;let Z=$.slice(0,-8);if(m9(Z))return!0;let J=Z.lastIndexOf(".");if(J<0)return!1;let X=Z.slice(J+1);return/^[a-f0-9]{24}$/.test(X)&&m9(Z.slice(0,J))}async function E1($,Z){for(let J=0;J<2;J+=1){let X=vq(12).toString("hex"),Y=`${$}.${X}.partial`,z=!1;try{return await mq(Y,Z,{encoding:"utf8",flag:"wx"}),z=!0,await gq(Y,$),!0}catch(G){if(G.code==="EEXIST")continue;if(z)await DW(Y).catch(()=>{});throw G}}return!1}async function _O($){let Z=$.dumpDir??C2(),J=$.maxBytes??qO(),X=$.now??Date.now(),Y=$.minAgeMs??BO,z=$.partialStaleMs??HO,G={removed:0,freedBytes:0};if(!OO(Z)||J<=0)return G;try{if((await v9(Z)).isSymbolicLink())return G;let K=new Set(($.protectedPaths??[]).map((_)=>h1(_))),W=await OW(Z,{withFileTypes:!0}),V=[];await Promise.all(W.map(async(_)=>{if(!_.isFile())return;let T=DO(_.name);if(!T&&!m9(_.name))return;let M=h7(Z,_.name);try{let L=await v9(M);if(!L.isFile()||L.isSymbolicLink())return;V.push({path:M,size:L.size,mtimeMs:L.mtimeMs,partial:T,...!T&&{artifactGroup:_.name.replace(BX,"")}})}catch{}}));let B=V.reduce((_,T)=>_+T.size,0),H=0,q=0,N=async(_)=>{try{await DW(_.path),B-=_.size,q+=_.size,H+=1}catch{}},O=V.filter((_)=>_.partial).sort((_,T)=>_.mtimeMs-T.mtimeMs||_.path.localeCompare(T.path));for(let _ of O){if(K.has(h1(_.path)))continue;if(X-_.mtimeMs<z)continue;await N(_)}let U=new Map;for(let _ of V){if(_.partial||!_.artifactGroup)continue;let T=U.get(_.artifactGroup)??{files:[],newestMtimeMs:0};T.files.push(_),T.newestMtimeMs=Math.max(T.newestMtimeMs,_.mtimeMs),U.set(_.artifactGroup,T)}let D=[...U.entries()].sort(([_,T],[M,L])=>T.newestMtimeMs-L.newestMtimeMs||_.localeCompare(M));for(let[,_]of D){if(B<=J)break;if(X-_.newestMtimeMs<Y)continue;if(_.files.some((T)=>K.has(h1(T.path))))continue;for(let T of _.files)await N(T)}if(H>0)n.debug("dump","removed old dump files",{removed:H,freedBytes:q});return{removed:H,freedBytes:q}}catch{return G}}function MO($,Z){let J=Date.now();if(J-nz<VO)return;nz=J,_O({dumpDir:$,protectedPaths:Z}).catch(()=>{})}function jO($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="on")return{type:"enable"};if(Z.length===1&&Z[0]==="off")return{type:"disable"};return{type:"usage"}}function UZ($){let Z=$?.enabled??P2;return[ZO,"",`- Enabled: ${Z?"enabled":"disabled"}`,`- Directory: ${C2()}`,...$?.settingsPath?[`- Persisted: ${$.settingsPath}`]:[],"- Captures: final rewritten Anthropic body in direct and relay modes; request/relay metadata is redacted","- Warning: body dumps may contain prompt/session content; turn this off after debugging"].join(`
-`)}function Gw($){let Z=jO($.argumentsText),J=$.enabled??P2;if(Z.type==="status")return UZ({enabled:J,settingsPath:$.settingsPath});if(Z.type==="enable")return[JO,"",UZ({enabled:!0,settingsPath:$.settingsPath})].join(`
-`);if(Z.type==="disable")return[XO,"",UZ({enabled:!1,settingsPath:$.settingsPath})].join(`
-`);return[YO,"",zO,"",UZ({enabled:J,settingsPath:$.settingsPath})].join(`
-`)}function bZ($){return $.length<=16?$:`${$.slice(0,12)}…`}function B7($,Z=80){let J=$.trim().replace(/[^a-zA-Z0-9._-]+/g,"-").replace(/^-+|-+$/g,"");if(!J)return"session-unknown";return J.length<=Z?J:J.slice(0,Z)}function RO($){if($.transport!=="direct")return`${$.transport}-p${$.protocol}-${$.mode}`;return`direct${$.route?`-${B7($.route)}`:""}`}function FW($){if($==="cachekeep")return"-prewarm-cachekeep";if($==="start")return"-start";return""}function TO($){let Z=$.affinity?.trim();if(Z)return`session:${Z}`;return`request:${$.route??"direct"}:${$.url??""}`}function PO($,Z){if(!$.endsWith(".body.json"))return;let J=$.replace(BX,""),X=TW.exec(J)?.[1];if(!X||!PW.test(X)&&!CW.test(X))return;let Y=FW("cachekeep"),z=[{prefix:B7(Z),tag:null},{prefix:`${B7(Z,80-Y.length)}${Y}`,tag:"cachekeep"}];for(let G of z){if(!X.startsWith(`${G.prefix}-`))continue;let Q=X.slice(G.prefix.length);if(UO.test(Q)||NO.test(Q))return G.tag}return}async function CO($){let Z=$.affinity?.trim();if(!Z)return;let J=C2(),X;try{X=await OW(J)}catch{return}let Y=X.map((z)=>({name:z,tag:PO(z,Z)})).filter((z)=>z.tag!==void 0).sort((z,G)=>G.name.localeCompare(z.name));for(let z of Y)try{let G=h7(J,z.name),Q=G.replace(/\.body\.json$/,".meta.json");if(!(await v9(G)).isFile())continue;let K=JSON.parse(await cz(Q,"utf8"));if(K.session!==bZ(Z)||(z.tag===null?K.tag!=null:K.tag!==z.tag))continue;return await cz(G,"utf8")}catch{}return}function FO($,Z){if(!A8.has($))while(A8.size>=LO){let J=A8.keys().next().value;if(J===void 0)break;A8.delete(J)}A8.set($,Z)}function xO($){if($==null)return;return Object.fromEntries(new Headers($).entries())}function xW($){return fq("sha256").update($).digest("hex")}function AO($){return zq($)}function SO($,Z){if($==null)return null;if($===Z)return{changed:!1,firstByte:-1,lastPreviousByte:-1,lastCurrentByte:-1,previousBytes:$.length,currentBytes:Z.length};let J=0;while(J<$.length&&J<Z.length&&$[J]===Z[J])J+=1;let X=$.length-1,Y=Z.length-1;while(X>=J&&Y>=J&&$[X]===Z[Y])X-=1,Y-=1;return{changed:!0,firstByte:J,lastPreviousByte:X,lastCurrentByte:Y,changedPreviousBytes:X-J+1,changedCurrentBytes:Y-J+1,previousBytes:$.length,currentBytes:Z.length}}function IO($){try{let Z=J1($);return Z!=null&&typeof Z==="object"&&!Array.isArray(Z)?Z:null}catch{return L6("dump body parse failed"),null}}function v4($){return xW(JSON.stringify($))}function EO($){let Z=IO($);if(!Z)return{parseable:!1};let J=Array.isArray(Z.messages)?Z.messages:[],X=Array.isArray(Z.system)?Z.system:[],Y=J[0],z=J.slice(1);return{parseable:!0,model:typeof Z.model==="string"?Z.model:void 0,stream:Z.stream,systemCount:X.length,messagesCount:J.length,systemHash:v4(X),message0Hash:Y===void 0?null:v4(Y),message0Bytes:Y===void 0?0:JSON.stringify(Y).length,messagesAfter0Hash:v4(z),messagesAfter0Bytes:JSON.stringify(z).length,cch:AO($)}}function H7($){if(Array.isArray($))return $.map(H7);if($==null||typeof $!=="object")return $;let Z={};for(let[J,X]of Object.entries($)){let Y=J.toLowerCase();if(Y==="authorization"||Y==="x-api-key"||Y==="cookie"||Y==="set-cookie"||jW(J)){Z[J]="[redacted]";continue}Z[J]=H7(X)}return Z}async function AW($){if(!P2)return null;az+=1;let Z=$.affinity?.trim()||"session-unknown",J=FW($.tag),X=`${new Date().toISOString().replace(/[:.]/g,"-")}-${String(az).padStart(6,"0")}-${B7(Z,80-J.length)}${J}-${RO($)}`,Y=C2(),z=h7(Y,X),G={body:`${z}.body.json`,metadata:`${z}.meta.json`,response:`${z}.response.json`};if($.payload!==void 0)G.relay=`${z}.relay.json`;if($.request!==void 0)G.request=`${z}.request.json`;try{await yq(Y,{recursive:!0});let Q=$.previousBodyText??await CO($),K={id:X,createdAt:new Date().toISOString(),session:bZ(Z),transport:$.transport,protocol:$.protocol,mode:$.mode,route:$.route,status:$.status,error:$.error,tag:$.tag,bodyBytes:$.bodyText.length,relayBytes:$.relayBytes,bodyHash:xW($.bodyText),diff:SO(Q,$.bodyText),body:EO($.bodyText),files:G},W=[E1(G.body,$.bodyText),E1(G.metadata,`${JSON.stringify(K,null,2)}
-`)];if($.payload!==void 0&&G.relay)W.push(E1(G.relay,`${JSON.stringify(H7($.payload),null,2)}
-`));if($.request!==void 0&&G.request)W.push(E1(G.request,`${JSON.stringify(H7({...$.request,headers:xO($.request.headers)}),null,2)}
-`));await Promise.all(W),MO(Y,Object.values(G)),L6(`dumped request id=${X} session=${bZ(Z)} body=${G.body} meta=${G.metadata}`)}catch{return L6(`dump failed session=${bZ(Z)}`),null}return{responsePath:G.response,...$.tag?{tag:$.tag}:{}}}async function wO($){if(!P2)return null;let Z=TO($),J=A8.get(Z),X=await AW({affinity:$.affinity,transport:"direct",route:$.route,status:$.status,error:$.error,bodyText:$.bodyText,previousBodyText:J,request:{url:$.url,method:$.method,headers:$.headers},tag:$.tag});return FO(Z,$.bodyText),X}async function kO($){return AW({affinity:$.affinity,transport:$.transport,protocol:$.protocol,mode:$.mode,status:$.status,bodyText:$.bodyText,previousBodyText:$.previousBodyText,payload:$.payload,relayBytes:$.relayBytes,tag:$.tag})}async function bO($,Z){if(!$)return;let J=Z.message!=null&&typeof Z.message==="object"&&!Array.isArray(Z.message)?Z.message:{},X={status:Z.status,stream_complete:Z.complete??!0};if(typeof J.id==="string"&&J.id.length>0)X.message_id=J.id;if(typeof J.model==="string"&&J.model.length>0)X.model=J.model;if(Object.hasOwn(J,"usage"))X.usage=J.usage;if(Object.hasOwn(J,"diagnostics"))X.diagnostics=J.diagnostics;if(typeof J.stop_reason==="string"&&J.stop_reason.length>0)X.stop_reason=J.stop_reason;try{await E1($.responsePath,`${JSON.stringify(X,null,2)}
-`)}catch{L6(`dump response failed status=${Z.status}`)}}var fZ=8388608,v8=10,l1=13;class y8 extends Error{code="SSE_FRAME_TOO_LARGE";maxFrameBytes;constructor($){super(`SSE frame exceeded ${$} bytes without a terminator`);this.name="SseFrameTooLargeError",this.maxFrameBytes=$}}function fO($){if($===void 0)return fZ;if($===null||typeof $!=="object"||HX.isProxy($))throw TypeError("SSE framer options must be an object");let Z=Object.getOwnPropertyDescriptor($,"maxFrameBytes");if(Z===void 0)return fZ;if(!("value"in Z))throw TypeError("SSE framer maxFrameBytes must be a data property");let J=Z.value;if(J===void 0)return fZ;if(typeof J!=="number"||!Number.isSafeInteger(J)||J<1)throw TypeError("SSE framer maxFrameBytes must be a positive integer");return J}function vO($){let Z=fO($),J=new Uint8Array(0),X=0,Y=!0,z=!1,G=!1,Q=!1,K=()=>{throw Q=!0,J=new Uint8Array(0),X=0,new y8(Z)},W=(H,q)=>{let N=(q?X:0)+H.length;if(N>Z)K();if(J.length<N){let O=new Uint8Array(Math.min(Z,Math.max(N,J.length*2,1024)));if(q)O.set(J.subarray(0,X),0);J=O}J.set(H,q?X:0),X=N};return Object.freeze({push:(H)=>{if(Q)throw new y8(Z);if(!HX.isUint8Array(H))throw TypeError("SSE framer input must be a Uint8Array");let q=H.length;if(q===0)return[];let N=[],O=0,U=0,D=Y?0:-1,_=(L)=>{if(X>0){let C=X+L;if(C>Z)K();let w=new Uint8Array(C);w.set(J.subarray(0,X),0),w.set(H.subarray(0,L),X),X=0,N.push(w)}else{if(L-O>Z)K();N.push(H.subarray(O,L))}O=L};if(z){if(z=!1,H[0]===v8)U=1;if(G)G=!1,_(U);D=U}let T=-2,M=-2;while(U<q){if(T!==-1&&T<U)T=H.indexOf(v8,U);if(M!==-1&&M<U)M=H.indexOf(l1,U);let L;if(T===-1)L=M;else if(M===-1)L=T;else L=Math.min(T,M);if(L===-1)break;let C=L+1;if(H[L]===l1){if(C===q){z=!0,G=L===D,D=q;break}if(H[C]===v8)C+=1}if(L===D)_(C);D=C,U=C}if(O<q)W(H.subarray(O,q),X>0),Y=D===q;else Y=!0;return N},finish:()=>{if(Q)throw new y8(Z);let H=X>0?J.slice(0,X):void 0;return J=new Uint8Array(0),X=0,Y=!0,z=!1,G=!1,H},get bufferedBytes(){return X}})}var yO=new TextDecoder("utf-8",{ignoreBOM:!0}),gO=65279;function mO($){if($===null||typeof $!=="object"||HX.isProxy($))return!1;let Z=Object.getOwnPropertyDescriptor($,"streamStart");return Z!==void 0&&"value"in Z&&Z.value===!0}function l7($,Z){let J=yO.decode($);return J.charCodeAt(0)===gO&&mO(Z)?J.slice(1):J}function hO($){let Z=typeof $==="string"?$:l7($),J={},X;for(let Y of Z.split(/\r\n|\r|\n/)){if(Y===""||Y.charCodeAt(0)===58)continue;let z=Y.indexOf(":"),G=z===-1?Y:Y.slice(0,z),Q=z===-1?"":Y.slice(z+1);if(Q.charCodeAt(0)===32)Q=Q.slice(1);switch(G){case"event":J.event=Q;break;case"data":if(X)X.push(Q);else X=[Q];break;case"id":if(!Q.includes("\x00"))J.id=Q;break;case"retry":if(/^[0-9]+$/.test(Q))J.retry=Number(Q);break}}if(X)J.data=X.join(`
-`);return J}function pO($){let Z=$.length;if(Z===0)return!1;let J=$[Z-1];if(J!==v8&&J!==l1)return!1;let X=Z-1;if(J===v8&&X>0&&$[X-1]===l1)X-=1;if(X===0)return!0;let Y=$[X-1];return Y===v8||Y===l1}var lO=Buffer.from("error"),uO=Buffer.from("\\u");function dO($){let Z=Buffer.from($.buffer,$.byteOffset,$.byteLength);return Z.indexOf(lO)!==-1||Z.indexOf(uO)!==-1}var B8="[REDACTED]",i8="Provider error details were withheld because the request attempt has ended",SW="Provider error body exceeded the redaction size limit and was withheld",UX=1048576,cO=fZ,IW=32,iO=2000,NX=1000,sO=/\bBearer\s+([A-Za-z0-9._~+/=-]{16,})/gi,aO=/(?<![A-Za-z0-9_-])sk-[A-Za-z0-9_-]{16,}/g,h9=/\\(?:u([0-9a-fA-F]{4})|(["\\/bfnrt]))/g,nO={'"':'"',"\\":"\\","/":"/",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t"},oO=new Set(["api_error","authentication_error","billing_error","invalid_request_error","not_found_error","overloaded_error","permission_error","rate_limit_error","relay_upstream_error","request_too_large","timeout_error"]),U7=new TextEncoder;function x0($,Z){$.onTerminal?.(Z)}function LX($){if(!Array.isArray($)||U8.isProxy($))throw TypeError("Provider error redactor secrets must be an array");let J=Object.getOwnPropertyDescriptor($,"length")?.value;if(typeof J!=="number")throw TypeError("Provider error redactor secrets must be an array");let X=new Set;for(let Y=0;Y<J;Y+=1){let z=Object.getOwnPropertyDescriptor($,String(Y));if(z===void 0||!("value"in z))throw TypeError(`Provider error redactor secret ${Y} must be a data property`);let G=z.value;if(typeof G!=="string")throw TypeError(`Provider error redactor secret ${Y} must be a string`);if(G!=="")X.add(G)}return[...X].sort((Y,z)=>z.length-Y.length)}var oz=46;function EW($){return $>=48&&$<=57||$>=65&&$<=90||$>=97&&$<=122||$===95}function y4($,Z){let J=Z;for(;J<$.length;J+=1){let X=$.charCodeAt(J);if(!EW(X)&&X!==45)break}return J}function rO($,Z){let J=$.indexOf("eyJ");while(J!==-1){let X=y4($,J),Y=J;while(Y!==-1&&Y<X&&!(Y+3<X&&(Y===0||!EW($.charCodeAt(Y-1)))))Y=$.indexOf("eyJ",Y+1);if(Y===-1)return;if(Y>=X){J=Y;continue}let z=X;if($.charCodeAt(X)===oz){let G=y4($,X+1);if(G>X+1&&$.charCodeAt(G)===oz){let Q=y4($,G+1);if(Q>G+1)Z.push(Y,Q),z=Q}}J=$.indexOf("eyJ",z)}}function rz($,Z,J){Z.lastIndex=0;for(let X=Z.exec($);X!==null;X=Z.exec($)){let Y=X.index+X[0].length,z=X[1];J.push(z===void 0?X.index:Y-z.length,Y)}}function tz($,Z,J){for(let X of Z)for(let Y=$.indexOf(X);Y!==-1;Y=$.indexOf(X,Y+X.length))J.push(Y,Y+X.length);rz($,sO,J),rz($,aO,J),rO($,J)}function tO($,Z,J){if(Z!==void 0)return String.fromCharCode(Number.parseInt(Z,16));return J===void 0?"":nO[J]??J}function eO($,Z){let J=[...Z.keys()].sort((Q,K)=>(Z[Q]??0)-(Z[K]??0)),X=Array(Z.length).fill($.length),Y=0,z=0,G=0;h9.lastIndex=0;for(;;){let Q=h9.exec($),K=Q?Q.index:$.length;for(;Y<J.length;Y+=1){let W=J[Y]??0,V=Z[W]??0;if(V>G+(K-z))break;X[W]=z+(V-G)}if(!Q||Y===J.length)return X;G+=K-z+1,z=Q.index+Q[0].length}}function $D($,Z){let J=[];for(let Q=0;Q+1<Z.length;Q+=2)J.push([Z[Q]??0,Z[Q+1]??0]);J.sort((Q,K)=>Q[0]-K[0]||K[1]-Q[1]);let X="",Y=0,z=-1,G=-1;for(let[Q,K]of J){if(z!==-1&&Q<G){G=Math.max(G,K);continue}if(z!==-1)X+=$.slice(Y,z)+B8,Y=G;z=Q,G=K}if(z!==-1)X+=$.slice(Y,z)+B8,Y=G;return X+$.slice(Y)}function S6($,Z){let J=[];if(tz($,Z,J),$.includes("\\")){let X=$.replace(h9,tO);if(X!==$){let Y=[];tz(X,Z,Y);for(let z of eO($,Y))J.push(z)}}if(J.length===0)return $;return $D($,J)}function h0($,Z){let J=Object.getOwnPropertyDescriptor($,Z)?.get;if(typeof J!=="function")throw Error(`Platform accessor ${Z} is unavailable`);return J}var wW=h0(Response.prototype,"status"),kW=h0(Response.prototype,"statusText"),ZD=h0(Response.prototype,"ok"),bW=h0(Response.prototype,"headers"),JD=h0(Response.prototype,"body"),XD=h0(Response.prototype,"url"),fW=Headers.prototype.forEach,YD=h0(DOMException.prototype,"name"),zD=h0(DOMException.prototype,"message");function P$($,Z){return Reflect.apply($,Z,[])}function p9($){try{return $()}catch(Z){if(Z instanceof TypeError)return;throw Z}}function GD($){let Z=[];return Reflect.apply(fW,$,[(J,X)=>{if(typeof X==="string"&&typeof J==="string")Z.push([X,J])}]),Z}function QD($){return $ instanceof ReadableStream}function vW($){if($===null||typeof $!=="object"||U8.isProxy($))return;let Z=p9(()=>P$(wW,$));if(typeof Z!=="number")return;let J=P$(kW,$),X=P$(ZD,$),Y=P$(XD,$);if(typeof J!=="string"||typeof X!=="boolean"||typeof Y!=="string")throw TypeError("Response slots could not be read");return{status:Z,statusText:J,ok:X,headers:GD(P$(bW,$)),url:Y,body(){let z=P$(JD,$);if(z===null||QD(z))return z;throw TypeError("Response body slot could not be read")}}}function KD($,Z){if(Object.getPrototypeOf($)!==Z)return!1;return Reflect.ownKeys($).every((J)=>!(J in Z))}function WD($){for(let[Z,J]of $)if(Z.toLowerCase()==="content-type")return J;return""}function l9($,Z,J=0){if(typeof $==="string")return S6($,Z);if($===null||typeof $!=="object")return u1($,Z)?$:B8;if(J>=IW)return B8;if(Array.isArray($)){let G;for(let Q=0;Q<$.length;Q+=1){let K=$[Q],W=l9(K,Z,J+1);if(W!==K)G??=$.slice(),G[Q]=W}return G??$}if(!N7($))return $;let X=!1,Y=[];for(let G of Object.keys($)){let Q=$[G],K=S6(G,Z),W=l9(Q,Z,J+1);if(K!==G||W!==Q)X=!0;Y.push([K,W])}if(!X)return $;let z={};for(let[G,Q]of Y)Object.defineProperty(z,G,{value:Q,enumerable:!0,writable:!0,configurable:!0});return z}function u1($,Z){let J=JSON.stringify($);return typeof J!=="string"||S6(J,Z)===J}function N7($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function VD($){if(!N7($))return!1;return $.type==="error"||Object.hasOwn($,"error")}function u7($){if(!N7($))return;let Z=$.error;if(!N7(Z))return;let J=Z.type;return typeof J==="string"&&oO.has(J)?J:void 0}function F2($,Z){return JSON.stringify({type:"error",error:Z===void 0?{message:$}:{type:Z,message:$}})}function qX($){try{return{ok:!0,value:JSON.parse($)}}catch{return}}function yW($,Z){let J=S6($,Z);if(J===$)return $;let X=qX($);if(!X)return J;let Y=JSON.stringify(l9(X.value,Z));return S6(Y,Z)===Y?Y:F2(L7,u7(X.value))}var BD=[["name","text"],["message","text"],["type","text"],["status","status"],["statusCode","status"],["code","code"],["retryAfter","retry"],["isRetryable","boolean"],["request_id","requestId"],["requestID","requestId"],["syscall","syscall"],["closeCode","closeCode"],["wasClean","boolean"],["error","nested"],["cause","nested"],["response","nested"],["headers","headers"],["responseHeaders","headers"],["errors","list"]],HD=new Set(["websocket","anthropic-sse"]),UD=[Symbol.for("vercel.ai.error"),Symbol.for("vercel.ai.error.AI_APICallError")],ND=new Map([["Error",Error],["TypeError",TypeError],["RangeError",RangeError],["SyntaxError",SyntaxError],["ReferenceError",ReferenceError],["EvalError",EvalError],["URIError",URIError]]),LD=/^[A-Za-z0-9_-]{1,128}$/,qD=64,ez="Provider error details exceeded the redaction size limit and were withheld",OD=24;function $$($,Z){if(Z>$.bytes)return!1;return $.bytes-=Z,!0}function gW($){return typeof $==="string"||typeof $==="object"&&$?0:OD}function mW($,Z,J){if(!$$($,Z))return!1;let X=J()-Z;return X<=0||$$($,X)}function OX($,Z){if($.length>Z.bytes)return;let J=S6($,Z.secrets);return mW(Z,$.length,()=>Z2.byteLength(J,"utf8"))?J:void 0}function d1($,Z){let J=OX($,Z);if(J!==void 0)return J;return $$(Z,ez.length)?ez:void 0}function hW($){let Z=$;for(let J=0;Z!==null;J+=1){if(J>qD||U8.isProxy(Z))return!1;Z=Object.getPrototypeOf(Z)}return!0}function v0($,Z){let J=Object.getOwnPropertyDescriptor($,Z);return J!==void 0&&"value"in J?J.value:void 0}function DD($){for(let Z=$;Z!==null;Z=Object.getPrototypeOf(Z)){let J=Object.getOwnPropertyDescriptor(Z,"name");if(J!==void 0)return"value"in J?J.value:void 0}return}function DX($,Z,J){Object.defineProperty($,Z,{value:J,enumerable:!0,writable:!0,configurable:!0})}function J8($,Z,J,X){let Y=typeof Z==="string"?Z.length:0;if(J!==void 0&&$$(X,Y+gW(J)))DX($,Z,J)}function pW($){return Number.isInteger($)&&Number($)>=0&&Number($)<=999}function lW($,Z,J,X){let Y=Z.length+J.length;if(Y>X.bytes)return;if(S6(Z,X.secrets)!==Z){$$(X,Y);return}let z=S6(J,X.secrets);if(mW(X,Y,()=>Z2.byteLength(Z,"utf8")+Z2.byteLength(z,"utf8")))DX($,Z,z)}var $G=Object.freeze({});function uW($,Z){let J={},X=0;try{Reflect.apply(fW,$,[(Y,z)=>{if(X>=NX||Z.bytes===0)throw $G;if(X+=1,typeof z==="string"&&typeof Y==="string")lW(J,z,Y,Z)}])}catch(Y){if(Y===$G)return J;if(Y instanceof TypeError)return;throw Y}return J}function _D($,Z){if($===null||typeof $!=="object"||!hW($))return;let J=uW($,Z);if(J)return J;let X=Reflect.ownKeys($);if(X.length>NX)return;let Y={};for(let z of X){let G=typeof z==="string"?v0($,z):void 0;if(typeof z==="string"&&typeof G==="string")lW(Y,z,G,Z)}return Y}function ZG($,Z,J,X){switch($){case"text":return typeof Z==="string"?d1(Z,J):void 0;case"status":return pW(Z)&&u1(Z,J.secrets)?Z:void 0;case"code":case"retry":if(typeof Z==="string")return OX(Z,J);return Number.isFinite(Z)&&u1(Z,J.secrets)?Z:void 0;case"boolean":return typeof Z==="boolean"?Z:void 0;case"syscall":return typeof Z==="string"&&HD.has(Z)&&$$(J,Z.length)?Z:void 0;case"closeCode":return Number.isInteger(Z)&&Number(Z)>=1000&&Number(Z)<=4999&&u1(Z,J.secrets)?Z:void 0;case"requestId":return typeof Z==="string"&&LD.test(Z)&&S6(Z,J.secrets)===Z&&$$(J,Z.length)?Z:void 0;case"nested":return Z===void 0?void 0:J2(Z,J,X);case"headers":return _D(Z,J);case"list":return Array.isArray(Z)?J2(Z,J,X):void 0}}var MD=128;function jD($,Z){if($==="nested"||$==="headers"||$==="list")return!1;return typeof Z!=="string"||Z.length<=MD}function dW($,Z,J,X,Y,z){for(let Q of UD)if(v0($,Q)===!0)J8(Z,Q,!0,J);let G=[];for(let[Q,K]of BD){if(Y.has(Q))continue;let W=v0($,Q);if(!jD(K,W))G.push([Q,K,W]);else J8(Z,Q,ZG(K,W,J,X+1),J)}z?.();for(let[Q,K,W]of G)J8(Z,Q,ZG(K,W,J,X+1),J)}var RD=new Set(["message"]),TD=new Set(["message","errors"]),PD=new Set,cW=12;function iW($,Z,J,X){if(J===void 0){Reflect.deleteProperty($,"stack");return}let Y=Z2.byteLength(Z,"utf8"),z=J===""?0:2+Z2.byteLength(J,"utf8"),G="";if($$(X,Y+z))G=J===""?Z:`${Z}: ${J}`;else if($$(X,Y))G=Z;Object.defineProperty($,"stack",{value:G,writable:!0,enumerable:!1,configurable:!0})}function CD($,Z,J){let X=DD($),Y=X==="AggregateError",z=typeof X==="string"?ND.get(X):void 0,G=$$(Z,cW+(Y?6:0)),Q=Y?AggregateError([]):new(z??Error);if(Y&&!G)Reflect.deleteProperty(Q,"errors");if(Z.memo.set($,Q),dW($,Q,Z,J,Y?TD:RD,()=>{let W=v0($,"message"),V=!G?void 0:typeof W==="string"?d1(W,Z)??"":"";if(V!==void 0)Object.defineProperty(Q,"message",{value:V,writable:!0,enumerable:!1,configurable:!0});iW(Q,Y?"AggregateError":z&&typeof X==="string"?X:"Error",V,Z)}),Y&&G){let W=v0($,"errors"),V=Array.isArray(W)?J2(W,Z,J+1):void 0;Object.defineProperty(Q,"errors",{value:Array.isArray(V)?V:[],writable:!0,configurable:!0})}return Q}function FD($,Z,J){let X=v0($,"length");if(typeof X!=="number"||X>NX)return vZ(Z);let Y=[];Z.memo.set($,Y);for(let z=0;z<X;z+=1){let G=v0($,String(z));if(!$$(Z,1))break;let Q=J2(G,Z,J+1);if(!$$(Z,gW(Q)))break;Y.push(Q)}return Y}function vZ($){return $$($,B8.length)?B8:void 0}function J2($,Z,J){if(typeof $==="string")return d1($,Z)??"";if(typeof $==="symbol"||typeof $==="function")return vZ(Z);if($===null||typeof $!=="object")return $;if(Z.memo.has($))return Z.memo.get($);if(!hW($))return vZ(Z);if(Z.budget-=1,Z.budget<0||J>=IW)return vZ(Z);let X=p9(()=>P$(wW,$));if(typeof X==="number"){let G=P$(kW,$);if(typeof G!=="string")throw TypeError("Response slots could not be read");let Q={};Z.memo.set($,Q),J8(Q,"status",X,Z),J8(Q,"statusText",OX(G,Z)??"",Z);let K=P$(bW,$);return J8(Q,"headers",uW(K,Z)??{},Z),Q}let Y=p9(()=>P$(zD,$));if(typeof Y==="string"){let G=$$(Z,cW)?d1(Y,Z)??"":void 0,Q=Error(G);iW(Q,"Error",G,Z);let K=P$(YD,$);if(typeof K==="string")J8(Q,"name",d1(K,Z),Z);return Z.memo.set($,Q),Q}if(U8.isNativeError($))return CD($,Z,J);if(Array.isArray($))return FD($,Z,J);let z={};return Z.memo.set($,z),dW($,z,Z,J,PD),z}function g4($,Z){let J=Error(Z);try{if($!==null&&typeof $==="object"&&!U8.isProxy($)){let X=v0($,"status");if(pW(X))DX(J,"status",X)}}catch{}return J}var L7="Provider error could not be inspected safely";function x2($,Z){let J=Z.secrets,X=$!==null&&typeof $==="object"||typeof $==="function"||typeof $==="symbol";if(J===null){if(typeof $==="string")return i8;return X?g4($,i8):$}try{let Y=J2($,{secrets:J,memo:new Map,budget:iO,bytes:UX},0);return X&&Y===B8?g4(void 0,L7):Y}catch{return g4(void 0,L7)}}function xD($,Z){let J=l7($,{streamStart:!0}),X=Z.secrets;if(X===null)return U7.encode(F2(i8,u7(qX(J)?.value)));let Y=yW(J,X);return Y===J?$:U7.encode(Y)}function AD($,Z){if($.length===1&&$[0])return $[0];let J=new Uint8Array(Z),X=0;for(let Y of $)J.set(Y,X),X+=Y.byteLength;return J}function m4($,Z,J){try{if(Z)$.enqueue(Z);if(J)$.close()}catch{}}function sW($,Z){return $.cancel(Z).then(()=>{return},()=>{throw Error(i8)})}var aW=new WeakSet;class nW extends Error{constructor(){super(SW);this.name="ProviderErrorSourceOversizedError",aW.add(this)}}function SD($){return typeof $==="object"&&$!==null&&aW.has($)}function JG(){return U7.encode(F2(SW))}function ID($,Z){Z.wrappedBodies+=1;let J=()=>$.getReader(),X;return new ReadableStream({async pull(Y){let z=[],G=0,Q,K;try{Q=J(),X=Q;for(;;){let{done:W,value:V}=await Q.read();if(W)break;if(!U8.isUint8Array(V))throw TypeError("Provider error body chunk must be bytes");if(V.byteLength===0)continue;if(G+=V.byteLength,G>UX){m4(Y,JG(),!0),x0(Z,"eof"),await Q.cancel().catch(()=>{});return}z.push(V)}K=xD(AD(z,G),Z)}catch(W){if(SD(W)){if(m4(Y,JG(),!0),x0(Z,"eof"),Q)await Q.cancel().catch(()=>{});return}let V=x2(W,Z);x0(Z,"error");try{Y.error(V)}catch{}if(Q)await Q.cancel(V).catch(()=>{});return}m4(Y,K,!0),x0(Z,"eof")},cancel(Y){return x0(Z,"cancel"),sW(X??$,Y)}},{highWaterMark:0})}function ED($){let Z=/\r\n|\r|\n/.exec($);return Z?Z[0]:`
-`}function u9($,Z,J){let X=[];if(J.event!==void 0)X.push(`event: ${J.event}`);if(J.id!==void 0)X.push(`id: ${J.id}`);if(J.retry!==void 0)X.push(`retry: ${J.retry}`);if(J.data!==void 0)for(let Y of J.data.split(/\r\n|\r|\n/))X.push(`data: ${Y}`);return wD($,Z,X)}function wD($,Z,J){let X=ED(Z),Y="";if(pO($))Y=X+X;else if(/[\r\n]$/.test(Z))Y=X;return U7.encode(J.join(X)+Y)}function kD($,Z,J){if(!dO($))return $;let X=l7($,{streamStart:J}),Y=hO(X),z=Y.data===void 0?void 0:qX(Y.data);if(!(Y.event==="error"||z!==void 0&&VD(z.value)))return $;let Q=Z.secrets,K=Q===null?u9($,X,{event:Y.event===void 0?void 0:"error",data:Y.data===void 0?void 0:F2(i8,u7(z?.value))}):S6(X,Q)===X&&(Y.data===void 0||S6(Y.data,Q)===Y.data)?$:u9($,X,{event:Y.event===void 0?void 0:S6(Y.event,Q),id:Y.id===void 0?void 0:S6(Y.id,Q),retry:Y.retry!==void 0&&Number.isSafeInteger(Y.retry)&&u1(Y.retry,Q)?Y.retry:void 0,data:Y.data===void 0?void 0:yW(Y.data,Q)}),W=K===$||Q===null?K:bD(K,$,X,Y,z,Q);if(W===$||!J||!fD($))return W;let V=new Uint8Array(g8.length+W.length);return V.set(g8,0),V.set(W,g8.length),V}function bD($,Z,J,X,Y,z){let G=l7($);if(S6(G,z)===G)return $;return u9(Z,J,{event:X.event===void 0?void 0:"error",data:X.data===void 0?void 0:F2(L7,u7(Y?.value))})}var g8=Uint8Array.of(239,187,191);function fD($){return $[0]===g8[0]&&$[1]===g8[1]&&$[2]===g8[2]}function vD($,Z){Z.wrappedBodies+=1;let J=oW(Z),X=()=>$.getReader(),Y,z=(G,Q)=>{for(let K of Q)G.enqueue(K)};return new ReadableStream({async pull(G){let Q=Y,K=!1;try{Q??=X(),Y=Q;for(;;){let{done:W,value:V}=await Q.read();if(W){K=!0;let H=J.finish();K=!1,z(G,H),G.close(),x0(Z,"eof");return}if(!U8.isUint8Array(V))throw TypeError("Provider event-stream chunk must be bytes");K=!0;let B=J.push(V);if(K=!1,B.length>0){z(G,B);return}}}catch(W){let V=K&&W instanceof y8?W:x2(W,Z);x0(Z,"error");try{G.error(V)}catch{}if(Q)await Q.cancel(V).catch(()=>{})}},cancel(G){return x0(Z,"cancel"),sW(Y??$,G)}},{highWaterMark:0})}function oW($){let Z=vO({maxFrameBytes:cO}),J=!0,X=(Y)=>{let z=[],G;for(let Q of Y){let K=kD(Q,$,J);if(J=!1,K===Q&&G!==void 0&&G.buffer===Q.buffer&&G.byteOffset+G.byteLength===Q.byteOffset){G=new Uint8Array(G.buffer,G.byteOffset,G.byteLength+Q.byteLength);continue}if(G)z.push(G);if(G=void 0,K===Q)G=Q;else z.push(K)}if(G)z.push(G);return z};return{push:(Y)=>X(Z.push(Y)),finish:()=>{let Y=Z.finish();return Y?X([Y]):[]}}}var yD="Provider error stream scope is closed";function gD($){let Z={secrets:LX($),wrappedBodies:0},J=oW(Z),X=()=>{Z.secrets=null,J=null},Y=()=>{if(J===null)throw Error(yD);return J};return Object.freeze({push(z){let G=Y();try{return G.push(z)}catch(Q){throw X(),Q}},finish(){let z=Y();try{return z.finish()}finally{X()}},redactError(z){return x2(z,Z)},dispose:X})}var mD=new Set([101,103,204,205,304]),o$="anthropic-ratelimit-unified-",hD=new Set(["allowed","allowed_warning","rejected"]),pD=new Set(["five_hour","seven_day","seven_day_opus","seven_day_sonnet","overage"]),lD=new Set(["available","unavailable"]),uD=/^[0-9]{1,15}(\.[0-9]{1,15})?$/,dD=/^[0-9]{1,10}$/,cD=/^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), [0-9]{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) [0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} GMT$/,iD=($)=>dD.test($)||cD.test($),h4=($)=>hD.has($),NZ=($)=>uD.test($),sD=new Map([["retry-after",iD],["x-should-retry",($)=>$==="true"||$==="false"],[`${o$}status`,h4],[`${o$}representative-claim`,($)=>pD.has($)],[`${o$}fallback`,($)=>lD.has($)],[`${o$}5h-status`,h4],[`${o$}5h-utilization`,NZ],[`${o$}5h-reset`,NZ],[`${o$}7d-status`,h4],[`${o$}7d-utilization`,NZ],[`${o$}7d-reset`,NZ]]);function aD($,Z){return sD.get($.toLowerCase())?.(Z)===!0}function p4($,Z,J){let X=new Headers;for(let[Y,z]of $){if(Z==="verified-only"&&!aD(Y,z))continue;if(Z==="scrub"&&S6(Y,J)!==Y)continue;X.append(Y,Z==="scrub"?S6(z,J):z)}return X.delete("content-length"),X}function XG($,Z,J){if(Z!==""&&J!==null)Object.defineProperty($,"url",{value:S6(Z,J),enumerable:!0});return $}function rW($,Z,J,X){let Y=J.secrets,z=KD($,Response.prototype);if(Z.ok){let K=X==="content-type"?/text\/event-stream/i.test(WD(Z.headers)):X==="event-stream";if(z&&!K)return $;let W=Z.body();if(z&&W===null)return $;let V=W===null||!K?W:vD(W,J);return XG(new Response(V,{status:Z.status,statusText:Z.statusText,headers:p4(Z.headers,"keep",[])}),Z.url,Y)}if(Z.status===0)return z?$:Response.error();let G=mD.has(Z.status)?null:Z.body(),Q=G===null?null:ID(G,J);if(Y===null){let K=p4(Z.headers,"verified-only",[]);if(Q!==null)K.set("content-type","application/json");return new Response(Q,{status:Z.status,headers:K})}return XG(new Response(Q,{status:Z.status,statusText:S6(Z.statusText,Y),headers:p4(Z.headers,"scrub",Y)}),Z.url,Y)}function nD($,Z){let J=vW($);if(!J)throw TypeError("Provider error redactor expects a Response");let X=rW($,J,Z,"content-type");if(!(X instanceof Response))throw TypeError("Provider error redactor expects a Response");return X}function Vw($){let Z={secrets:LX($),wrappedBodies:0};return Object.freeze({redactText(J){if(typeof J!=="string")throw TypeError("Provider error redactor expects text");let X=Z.secrets;return X===null?i8:S6(J,X)},redactError(J){return x2(J,Z)},redactResponse(J){return nD(J,Z)},dispose(){Z.secrets=null}})}var oD="Provider error response scope accepts one response while live";function _X($,Z){if(Z!=="event-stream"&&Z!=="http")throw TypeError("Provider error response scope mode must be 'event-stream' or 'http'");let J=Z,X={secrets:LX($),wrappedBodies:0},Y=()=>{},z=new Promise((V)=>{Y=V}),G=!1,Q=!1,K=(V)=>{if(G)return;G=!0,X.secrets=null,X.onTerminal=void 0,Y(V)};X.onTerminal=K;let W={get settled(){return z},redactResponse(V){if(Q||G)throw TypeError(oD);let B=vW(V);if(!B)throw TypeError("Provider error redactor expects a Response");Q=!0;let H;try{H=rW(V,B,X,J)}catch(q){throw K("disposed"),q}if(X.wrappedBodies===0)K("untouched");if(!(H instanceof Response))throw TypeError("Provider error redactor expects a Response");return H},redactError(V){return x2(V,X)},dispose(){K("disposed")}};return Object.defineProperty(W,"settled",{enumerable:!1}),Object.freeze(W)}var l4=3600000,YG=300000,rD=60000,Bw="extended-cache-ttl-2025-04-11",tD=32,zG=16777216,eD=30000,$_=60000,Z_=900000,J_=30000,GG="OAuth cache prewarm credential is unavailable",QG="## Claude Cache Keep Status",KG="## Claude Cache Keep Enabled",X_="## Claude Cache Keep Disabled",Y_="## Claude Cache Keep Usage",z_="Usage: `/claude-cachekeep`, `/claude-cachekeep always`, `/claude-cachekeep off`, or `/claude-cachekeep HH-HH`.";function q7($){return String($).padStart(2,"0")}function G_($){let Z=$.trim();if(!Z)return{type:"status"};if(Z==="off")return{type:"disable"};if(Z==="always")return{type:"always"};if(Z==="subagents on")return{type:"subagents",enabled:!0};if(Z==="subagents off")return{type:"subagents",enabled:!1};let J=/^(\d{1,2})-(\d{1,2})$/.exec(Z);if(!J)return{type:"usage"};let X=Number(J[1]),Y=Number(J[2]);if(!Number.isInteger(X)||!Number.isInteger(Y)||X<0||X>23||Y<0||Y>23||X===Y)return{type:"usage"};return{type:"window",startHour:X,endHour:Y}}function O7($){let Z=Number($?.cacheKeep?.startHour),J=Number($?.cacheKeep?.endHour);if(!Number.isInteger(Z)||!Number.isInteger(J)||Z<0||Z>23||J<0||J>23||Z===J)return;return{startHour:Z,endHour:J}}function d7($){return $?.cacheKeep?.enabled===!0&&$.cacheKeep.always===!0}function tW($){return $?.cacheKeep?.enabled===!0&&(d7($)||!!O7($))}function Q_($){return tW($)&&$?.claudeCache?.enabled===!0&&$.claudeCache.mode==="hybrid"}function K_($,Z=new Date){if(!$)return!1;let J=Z.getHours();if($.startHour<$.endHour)return J>=$.startHour&&J<$.endHour;return J>=$.startHour||J<$.endHour}function WG($,Z=new Date){if($?.cacheKeep?.enabled!==!0)return!1;return d7($)||K_(O7($),Z)}function VG($=new Date){return`${$.getFullYear()}-${q7($.getMonth()+1)}-${q7($.getDate())}`}function eW($,Z=new Date){if($&&$.startHour>$.endHour&&Z.getHours()<$.endHour){let J=new Date(Z);return J.setDate(J.getDate()-1),VG(J)}return VG(Z)}function BG($,Z,J=new Date){return d7($)?"always":eW(Z,J)}function T8($){let Z=$.always?"always (while this process is running)":$.window?`${q7($.window.startHour)}-${q7($.window.endHour)}`:"not configured",J=[`Cache keep: ${$.enabled?"enabled":"disabled"}`,`Schedule: ${Z}`,"Mode requirement: `/claude-cache mode hybrid` must be active."];if(typeof $.hybridActive==="boolean")J.push(`Hybrid active: ${$.hybridActive?"yes":"no"}`);if(typeof $.trackedSessions==="number")J.push(`Tracked sessions: ${$.trackedSessions}`);if($.trackedSessionDetails?.length){J.push("Sessions:");for(let X of $.trackedSessionDetails)J.push(`- ${X.id}`)}if($.nextPrewarmAt)J.push(`Next prewarm: ${new Date($.nextPrewarmAt).toLocaleString()}`);return J.join(`
-`)}function Hw($){let Z=G_($.argumentsText),J={enabled:$.enabled??!1,always:$.always,window:$.window,trackedSessions:$.trackedSessions,trackedSessionDetails:$.trackedSessionDetails,nextPrewarmAt:$.nextPrewarmAt,hybridActive:$.hybridActive};if(Z.type==="status")return[QG,"",T8(J)].join(`
-`);if(Z.type==="disable")return[X_,"",T8({...J,enabled:!1})].join(`
-`);if(Z.type==="always")return[KG,"",T8({...J,enabled:!0,always:!0,window:void 0})].join(`
-`);if(Z.type==="window")return[KG,"",T8({...J,enabled:!0,always:!1,window:{startHour:Z.startHour,endHour:Z.endHour}})].join(`
-`);if(Z.type==="subagents")return[QG,"",T8(J),"",`Subagent tracking: ${Z.enabled?"enabled":"disabled"}`].join(`
-`);return[Y_,"",z_,"",T8(J)].join(`
-`)}function d9($){if(!$||typeof $!=="object")return!1;if(Array.isArray($))return $.some(d9);let Z=$,J=Z.cache_control;if(J&&typeof J==="object"&&J.type==="ephemeral")return!0;return Object.values(Z).some(d9)}async function W_($){let Z;try{Z=JSON.parse($)}catch{return{ok:!1,reason:"body is not valid JSON"}}if(!d9(Z))return{ok:!1,reason:"body has no explicit cache breakpoints"};let J=structuredClone(Z);if(Wq(J),J.max_tokens=0,delete J.stream,J.thinking?.type==="enabled")delete J.thinking;if(J.output_config?.format)delete J.output_config;let z=J.tool_choice;if(z?.type==="tool"||z?.type==="any")delete J.tool_choice;return{ok:!0,bodyText:await Gq(JSON.stringify(bq(J)))}}function HG($,Z){let J=Math.min(Z_,$_*2**Math.min(Math.max(Z-1,0),8)),X=2166136261;for(let z of`${$}:${Z}`)X^=z.charCodeAt(0),X=Math.imul(X,16777619);let Y=(X>>>0)%(Math.min(J_,J/4)+1);return J+Y}function V_($){let Z=[],J=$.get("authorization");if(J){Z.push(J);let Y=/^Bearer\s+(.+)$/i.exec(J)?.[1]?.trim();if(Y)Z.push(Y)}let X=$.get("x-api-key");if(X)Z.push(X);return Z}class B_{options;targets=new Map;timer=null;tickPromise=null;nextPrewarmAttemptId=0;constructor($){this.options=$}start(){if(this.timer)return;if(n.debug("cachekeep","started"),this.timer=(this.options.setIntervalImpl??globalThis.setInterval)(()=>{this.tick().catch(()=>{n.warn("cachekeep","tick failed")})},rD),"unref"in this.timer)this.timer.unref()}stop(){if(!this.timer)return;n.debug("cachekeep","stopped"),(this.options.clearIntervalImpl??globalThis.clearInterval)(this.timer),this.timer=null}stats($,Z=this.options.now?.()??Date.now(),J=!1){let X=J?"always":eW($,new Date(Z)),Y=[...this.targets.values()].filter((G)=>G.dayKey===X),z=Y.length?Math.min(...Y.map((G)=>G.nextPrewarmAt)):void 0;return{trackedSessions:Y.length,nextPrewarmAt:z}}trackedSessions(){return[...this.targets.values()].map(($)=>({id:$.id,cacheExpiresAt:$.cacheExpiresAt,nextPrewarmAt:$.nextPrewarmAt})).sort(($,Z)=>$.id.localeCompare(Z.id))}trackedOAuthRoute($){let Z=this.targets.get($);return Z?{oauthAccountId:Z.oauthAccountId}:void 0}trackedCount(){return this.targets.size}publishTrackedSessions(){let $=this.options.onTrackedSessionsChanged;if(!$)return;try{Promise.resolve($(this.trackedSessions())).catch(()=>{n.warn("cachekeep","failed to publish tracked sessions")})}catch{n.warn("cachekeep","failed to publish tracked sessions")}}totalBodyBytes(){return[...this.targets.values()].reduce(($,Z)=>$+Z.bodyText.length,0)}evictOldestTarget(){let $=this.targets.keys().next().value;if($!==void 0)this.targets.delete($)}pruneTargets($,Z){for(let[J,X]of this.targets){if(Z&&X.dayKey!==Z){this.targets.delete(J);continue}if($>=X.cacheExpiresAt)this.targets.delete(J)}while(this.targets.size>tD)this.evictOldestTarget();while(this.totalBodyBytes()>zG){let J=this.targets.size;if(this.evictOldestTarget(),this.targets.size===J)break}}track($){if(!$.sessionId)return{tracked:!1,reason:"missing session id"};if(!tW($.storage))return{tracked:!1,reason:"cachekeep disabled"};if($.cacheMode!=="hybrid")return{tracked:!1,reason:"cache mode is not hybrid"};if($.bodyText.length>zG)return{tracked:!1,reason:"body exceeds cachekeep memory budget"};let Z=this.options.now?.()??Date.now(),J=O7($.storage);if(!WG($.storage,new Date(Z)))return{tracked:!1,reason:"outside configured schedule"};let X=BG($.storage,J,new Date(Z));if(this.pruneTargets(Z,X),this.targets.has($.sessionId))this.targets.delete($.sessionId);let Y={};return $.headers.forEach((z,G)=>{Y[G]=z}),this.targets.set($.sessionId,{id:$.sessionId,url:$.url,headers:Y,bodyText:$.bodyText,cacheExpiresAt:Z+l4,nextPrewarmAt:Z+l4-YG,consecutiveFailures:0,dayKey:X,oauthAccountId:$.oauthAccountId,oauthAccountIdentity:$.oauthAccountIdentity,accountStoragePath:$.accountStoragePath,isSubagent:$.isSubagent??!1}),this.pruneTargets(Z,X),this.publishTrackedSessions(),this.start(),{tracked:!0}}async prewarmNow($){let Z={};$.headers.forEach((X,Y)=>{Z[Y]=X});let J={id:$.sessionId,url:$.url,headers:Z,bodyText:$.bodyText,cacheExpiresAt:this.options.now?.()??Date.now(),nextPrewarmAt:this.options.now?.()??Date.now(),consecutiveFailures:0,dayKey:"",oauthAccountId:$.oauthAccountId,oauthAccountIdentity:$.oauthAccountIdentity,accountStoragePath:$.accountStoragePath,isSubagent:$.isSubagent??!1};return this.sendPrewarm(J)}tick(){if(this.tickPromise)return this.tickPromise;let $;return $=this.runTick().finally(()=>{if(this.tickPromise===$)this.tickPromise=null}),this.tickPromise=$,$}async runTick(){let $=await this.options.loadStorage(),Z=O7($),J=this.options.now?.()??Date.now(),X=BG($,Z,new Date(J));if(d7($))for(let Y of this.targets.values())Y.dayKey="always";if(this.pruneTargets(J,X),!this.targets.size){this.publishTrackedSessions(),this.stop();return}if(!Q_($)){this.publishTrackedSessions();return}if(!WG($,new Date(J))){this.publishTrackedSessions();return}n.debug("cachekeep","fired",{targets:this.targets.size});for(let Y of this.targets.values()){if(Y.nextPrewarmAt>J)continue;try{await this.prewarm(Y,J)}catch{n.warn("cachekeep","prewarm failed",{session:Y.id}),Y.consecutiveFailures+=1,Y.nextPrewarmAt=J+HG(Y.id,Y.consecutiveFailures)}}this.publishTrackedSessions()}async sendPrewarm($){let Z={id:++this.nextPrewarmAttemptId,signal:AbortSignal.timeout(this.options.prewarmTimeoutMs??eD)};try{let J=$.bodyText;if(this.options.prepareBody)try{J=await this.options.prepareBody(J,$)}catch{n.warn("cachekeep","prepare body failed",{session:$.id})}let X={...$,bodyText:J},Y=await W_(J);if(!Y.ok)return Y;let z=this.options.fetchImpl??fetch,G={...X,bodyText:Y.bodyText},Q=this.options.prepareHeaders?await this.options.prepareHeaders(new Headers($.headers),G,Z):new Headers($.headers);if(!Q)return{ok:!1,reason:GG,transient:!0};Q.delete("content-length"),Q.delete("transfer-encoding");let K,W=async(O)=>{let U=_X(V_(O),"http");try{let D=await z($.url,{method:"POST",headers:O,body:Y.bodyText,signal:Z.signal});return U.redactResponse(D)}catch(D){let _=U.redactError(D);throw U.dispose(),_}};try{if(K=await W(Q),K.status===401&&!Z.signal?.aborted&&this.options.retryOnUnauthorized){let O;try{O=await this.options.retryOnUnauthorized({target:G,headers:Q,bodyText:Y.bodyText,attempt:Z})}catch{}if(O&&!Z.signal?.aborted)O.delete("content-length"),O.delete("transfer-encoding"),await K.body?.cancel().catch(()=>{}),Q=O,K=await W(Q)}}catch(O){return{ok:!1,reason:O instanceof Error?O.message:String(O),transient:!0}}let V=this.options.now?.()??Date.now(),B=await K.text().catch(()=>""),H=null;try{H=B?JSON.parse(B):null}catch{}try{await this.options.onResponse?.({target:$,bodyText:Y.bodyText,status:K.status,data:H,receivedAt:V,attempt:Z})}catch{}try{let O=await wO({affinity:$.id,route:"cachekeep",status:K.status,bodyText:Y.bodyText,url:$.url,method:"POST",headers:Q,tag:"cachekeep"});await bO(O,{status:K.status,message:H})}catch{n.debug("cachekeep","dump failed",{session:$.id})}if(!K.ok)return{ok:!1,reason:B||`HTTP ${K.status}`,status:K.status};let N=(H&&typeof H==="object"&&!Array.isArray(H)?H:null)?.usage;return{ok:!0,...N&&{usage:N}}}finally{try{await this.options.onComplete?.({target:$,attempt:Z})}catch{}}}async prewarm($,Z){let J=await this.sendPrewarm($);if(!J.ok){if(J.status==null&&!J.transient)n.debug("cachekeep","prewarm skipped",{session:$.id,reason:J.reason}),this.targets.delete($.id);else n.warn("cachekeep","prewarm failed",{session:$.id,status:J.status,...J.transient&&{transient:!0},...J.reason===GG&&{reason:J.reason}}),$.consecutiveFailures+=1,$.nextPrewarmAt=Z+HG($.id,$.consecutiveFailures);return}$.cacheExpiresAt=Z+l4,$.nextPrewarmAt=$.cacheExpiresAt-YG,$.consecutiveFailures=0,n.debug("cachekeep","prewarm succeeded",{session:$.id,...J.usage&&{usage:J.usage}})}}var qG=180000;function L_($){if(!$||typeof $!=="object"||Array.isArray($))return;let Z=$;if(typeof Z.id!=="string"||Z.id.length===0||typeof Z.cacheExpiresAt!=="number"||!Number.isFinite(Z.cacheExpiresAt)||typeof Z.nextPrewarmAt!=="number"||!Number.isFinite(Z.nextPrewarmAt))return;return{id:Z.id,cacheExpiresAt:Z.cacheExpiresAt,nextPrewarmAt:Z.nextPrewarmAt}}function c4($){if(!$||typeof $!=="object"||Array.isArray($))return;let Z=$;if(Z.version!==1||typeof Z.updatedAt!=="number"||!Number.isFinite(Z.updatedAt)||!Array.isArray(Z.sessions))return;return{version:1,updatedAt:Z.updatedAt,sessions:Z.sessions.flatMap((J)=>{let X=L_(J);return X?[X]:[]})}}function OG($,Z,J){return $.updatedAt<=Z&&Z-$.updatedAt>J}function Ow($){return yZ(N_(),"opencode-anthropic-auth","cachekeep-sessions",$)}class q_{options;filePath;writeChain=Promise.resolve();lastSweepAt;constructor($){this.options=$;let Z=$.instanceId??`${process.pid}-${u4()}`;this.filePath=yZ($.directory,`${Z}.json`)}publish($){let Z=$.map((J)=>({...J}));return this.writeChain=this.writeChain.catch(()=>{}).then(async()=>{let J=this.options.now?.()??Date.now(),X=this.options.leaseMs??qG;if(Z.length===0)await _1(this.filePath,{force:!0});else{await U_(this.options.directory,{recursive:!0,mode:448});let Y=`${this.filePath}.${u4()}.tmp`;await LG(Y,`${JSON.stringify({version:1,updatedAt:J,sessions:Z})}
-`,{mode:384}),await NG(Y,this.filePath)}await this.sweepExpiredRecords(J,X)}),this.writeChain}async list($=[]){await this.writeChain.catch(()=>{});let Z=this.options.now?.()??Date.now(),J=this.options.leaseMs??qG;await this.sweepExpiredRecords(Z,J);let X;try{X=(await UG(this.options.directory)).filter((G)=>G.endsWith(".json"))}catch{X=[]}let Y=await Promise.all(X.map(async(G)=>{try{let Q=await d4(yZ(this.options.directory,G),"utf8");return c4(JSON.parse(Q))}catch{return}})),z=new Map;for(let G of Y){if(!G||Z-G.updatedAt>J||G.updatedAt>Z)continue;for(let Q of G.sessions){let K=z.get(Q.id);if(!K||Q.cacheExpiresAt>K.cacheExpiresAt)z.set(Q.id,Q)}}for(let G of $){let Q=z.get(G.id);if(!Q||G.cacheExpiresAt>Q.cacheExpiresAt)z.set(G.id,{...G})}return[...z.values()].sort((G,Q)=>G.id.localeCompare(Q.id))}async dispose(){await this.writeChain.catch(()=>{}),await _1(this.filePath,{force:!0})}async sweepExpiredRecords($,Z){if(this.lastSweepAt!==void 0&&$-this.lastSweepAt<Z)return;this.lastSweepAt=$;let J;try{J=(await UG(this.options.directory)).filter((X)=>X.endsWith(".json"))}catch{return}await Promise.all(J.map(async(X)=>{let Y=yZ(this.options.directory,X);if(Y===this.filePath)return;let z;try{z=c4(JSON.parse(await d4(Y,"utf8")))}catch{return}if(!z||!OG(z,$,Z))return;let G=`${Y}.${u4()}.sweep`;try{await NG(Y,G)}catch{return}let Q,K;try{Q=await d4(G,"utf8"),K=c4(JSON.parse(Q))}catch{}if(K&&OG(K,$,Z)){try{await _1(G,{force:!0})}catch{}return}await this.restoreSweptRecord(Y,G,Q)}))}async restoreSweptRecord($,Z,J){try{await H_(Z,$)}catch(X){if((X&&typeof X==="object"&&"code"in X?X.code:void 0)==="EEXIST"){try{await _1(Z,{force:!0})}catch{}return}if(J===void 0)return;try{await LG($,J,{encoding:"utf8",flag:"wx",mode:384})}catch(z){if((z&&typeof z==="object"&&"code"in z?z.code:void 0)!=="EEXIST")return}}try{await _1(Z,{force:!0})}catch{}}}var C_="anthropic-auth-opencode",Pw="anthropic-auth-pi",F_=1,c9=16384,XV=30000,TX=/^[0-9a-f]{64}$/,MG=new Set(["invalid_params","pending_exists","not_found","already_consumed","superseded","stale_generation"]);function x_($){let Z=_G($)||".json",J=RX($,_G($));return{statePath:X2(X1($),`${J}-state${Z}`),tokenPath:$}}function A2($,Z=process.env,J=process.cwd()){let X=Z[`${$.toUpperCase()}_ANTHROPIC_AUTH_CLAUSTRUM_ENROLLMENT_FILE`]?.trim(),Y=X?T_(X)?X:P_(J,X):X2(Z.XDG_STATE_HOME||X2(R_(),".local","state"),"cortexkit","anthropic-auth",`${$}-enrollment.json`);return x_(Y)}function YV($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function LZ($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0}function zV($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=1}function PX($){if(!YV($)||$.version!==F_||typeof $.proposedName!=="string"||$.proposedName.length===0)throw Error("invalid Claustrum enrollment state");if($.phase==="pending"){if(!TX.test(String($.requestSecret??""))||$.requestId!==void 0&&(typeof $.requestId!=="string"||$.requestId.length===0)||!LZ($.createdAt)||!LZ($.updatedAt))throw Error("invalid Claustrum enrollment state");return{version:1,phase:"pending",proposedName:$.proposedName,requestSecret:$.requestSecret,...$.requestId!==void 0&&{requestId:$.requestId},createdAt:$.createdAt,updatedAt:$.updatedAt}}if($.phase==="approved"){if($.approvedName!==void 0&&(typeof $.approvedName!=="string"||$.approvedName.length===0)||!zV($.tokenGeneration)||!LZ($.updatedAt))throw Error("invalid Claustrum enrollment state");return{version:1,phase:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration,updatedAt:$.updatedAt}}if($.phase==="denied"||$.phase==="blocked"){if($.errorCode!==void 0&&typeof $.errorCode!=="string"||!LZ($.updatedAt))throw Error("invalid Claustrum enrollment state");return{version:1,phase:$.phase,proposedName:$.proposedName,...$.errorCode!==void 0&&{errorCode:$.errorCode},updatedAt:$.updatedAt}}throw Error("invalid Claustrum enrollment state")}function GV($){if(!YV($)||!TX.test(String($.token??""))||!zV($.token_generation))throw Error("invalid Claustrum enrollment token file");return{token:$.token,token_generation:$.token_generation}}function A_($){if(!$.isFile())throw Error("Claustrum enrollment file must be a regular file");if(($.mode&63)!==0)throw Error("Claustrum enrollment file must be owner-only");let Z=process.getuid?.();if(Z!==void 0&&$.uid!==Z)throw Error("Claustrum enrollment file must be owned by the current user")}async function s8($){let Z;try{Z=await ZV($,DG.O_RDONLY|DG.O_NOFOLLOW)}catch(J){if(J.code==="ENOENT")return;throw Error("Claustrum enrollment file could not be opened safely")}try{A_(await Z.stat());let J=Buffer.alloc(c9+1),{bytesRead:X}=await Z.read(J,0,J.byteLength,0);if(X>c9)throw Error("Claustrum enrollment file is too large");return J1(J.subarray(0,X).toString("utf8"))}finally{await Z.close()}}async function S_($){let Z;try{Z=await M_($)}catch{return}for(;;){let J=await j_(Z).catch(()=>{return});if(J&&(J.mode&18)!==0&&(J.mode&512)===0)throw Error("Claustrum enrollment path has an unsafe writable ancestor");let X=X1(Z);if(X===Z)return;Z=X}}async function _0($,Z,J){let X=X1($);await MX(X,{recursive:!0,mode:448}),await S_(X);let Y=`${JSON.stringify(Z)}
-`;if(Buffer.byteLength(Y)>c9)throw Error("Claustrum enrollment state is too large");let z=X2(X,`.${RX($)}.${process.pid}.${$V()}.tmp`),G;try{G=await ZV(z,"wx",384),await G.writeFile(Y,"utf8"),await G.sync(),await G.close(),G=void 0,await __(z,384),await J(),await JV(z,$)}finally{await G?.close().catch(()=>{}),await jX(z).catch(()=>{})}}async function I_($,Z,J,X){let Y=X2(X1($),`.${RX($)}.${process.pid}.${$V()}.tmp`);try{await J(Y,Z),await X(),await JV(Y,$)}finally{await jX(Y).catch(()=>{})}}async function E_($,Z=C_){let J=await s8($.tokenPath),X=J===void 0?void 0:GV(J),Y=await s8($.statePath),z=Y===void 0?void 0:PX(Y);if(X)return{state:"approved",proposedName:z?.proposedName??Z,...z?.phase==="approved"&&z.approvedName!==void 0&&{approvedName:z.approvedName},tokenGeneration:X.token_generation};if(!z)return{state:"idle"};if(z.phase==="pending")return{state:"pending",proposedName:z.proposedName,...z.requestId!==void 0&&{requestId:z.requestId}};if(z.phase==="approved")return{state:"blocked",proposedName:z.proposedName,code:"missing_token"};if(z.phase==="denied")return{state:"denied",proposedName:z.proposedName};return{state:"blocked",proposedName:z.proposedName,code:z.errorCode??"unknown"}}function M0($){if($.phase==="pending")return{state:"pending",proposedName:$.proposedName,...$.requestId!==void 0&&{requestId:$.requestId}};if($.phase==="approved")return{state:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration};if($.phase==="denied")return{state:"denied",proposedName:$.proposedName};return{state:"blocked",proposedName:$.proposedName,code:$.errorCode??"unknown"}}class w_{#$;#Z;#z;#J;#K;#Y;constructor($){this.#$=$.client,this.#Z=$.paths,this.#z=$.proposedName,this.#J=$.now??Date.now,this.#K=$.mintSecret??(()=>D_(32).toString("hex")),this.#Y=$.writeTokenFile??u0}async status(){return E_(this.#Z,this.#z)}async resetTerminal(){return k_(this.#Z,this.#z)}async reconcile(){await MX(X1(this.#Z.statePath),{recursive:!0,mode:448});let $=await e1({name:"ceremony",path:this.#Z.statePath,ttlMs:XV,renew:!0});if(!$)return{state:"busy"};try{let Z=await s8(this.#Z.tokenPath),J=Z===void 0?void 0:GV(Z),X=await s8(this.#Z.statePath),Y=X===void 0?void 0:PX(X);if(Y&&Y.proposedName!==this.#z)throw Error("Claustrum enrollment state belongs to a different consumer");if(J){if(!Y||Y.phase==="pending"){let G={version:1,phase:"approved",proposedName:Y?.proposedName??this.#z,tokenGeneration:J.token_generation,updatedAt:this.#J()};await _0(this.#Z.statePath,G,()=>$.assertOwned()),Y=G}return{state:"approved",proposedName:Y.proposedName,...Y.phase==="approved"&&Y.approvedName!==void 0&&{approvedName:Y.approvedName},tokenGeneration:J.token_generation}}if(Y?.phase==="approved"){let G={version:1,phase:"blocked",proposedName:Y.proposedName,errorCode:"missing_token",updatedAt:this.#J()};return await _0(this.#Z.statePath,G,()=>$.assertOwned()),M0(G)}if(Y&&Y.phase!=="pending")return M0(Y);if(!Y){let G=this.#J();if(Y={version:1,phase:"pending",proposedName:this.#z,requestSecret:this.#K(),createdAt:G,updatedAt:G},!TX.test(Y.requestSecret))throw Error("invalid minted Claustrum enrollment secret");await _0(this.#Z.statePath,Y,()=>$.assertOwned())}if(!Y.requestId)try{let G=O_("sha256").update(Buffer.from(Y.requestSecret,"hex")).digest("hex"),Q=await this.#$.enrollPropose({name:Y.proposedName,requestSecretHash:G});Y={...Y,requestId:Q.requestId,updatedAt:this.#J()},await _0(this.#Z.statePath,Y,()=>$.assertOwned())}catch(G){if(G instanceof t6){if(!MG.has(G.code)&&(G.code==="pending_queue_full"||G.action==="retry"))return{state:"pending",proposedName:Y.proposedName,retryCode:G.code};let Q={version:1,phase:"blocked",proposedName:Y.proposedName,errorCode:G.code,updatedAt:this.#J()};return await _0(this.#Z.statePath,Q,()=>$.assertOwned()),M0(Q)}throw G}let z=Y.requestId;if(!z)return M0(Y);try{let G=await this.#$.enrollPoll({requestId:z,requestSecret:Y.requestSecret});if(G.status==="pending")return M0(Y);if(G.status==="denied"){let K={version:1,phase:"denied",proposedName:Y.proposedName,updatedAt:this.#J()};return await _0(this.#Z.statePath,K,()=>$.assertOwned()),M0(K)}await I_(this.#Z.tokenPath,{token:G.token,token_generation:G.tokenGeneration},this.#Y,()=>$.assertOwned());let Q={version:1,phase:"approved",proposedName:Y.proposedName,approvedName:G.name,tokenGeneration:G.tokenGeneration,updatedAt:this.#J()};return await _0(this.#Z.statePath,Q,()=>$.assertOwned()),M0(Q)}catch(G){if(!(G instanceof t6))throw G;if(!MG.has(G.code)&&G.action==="retry")return{state:"pending",proposedName:Y.proposedName,requestId:z,retryCode:G.code};let Q={version:1,phase:"blocked",proposedName:Y.proposedName,errorCode:G.code,updatedAt:this.#J()};return await _0(this.#Z.statePath,Q,()=>$.assertOwned()),M0(Q)}}finally{await $.release()}}}async function k_($,Z){await MX(X1($.statePath),{recursive:!0,mode:448});let J=await e1({name:"ceremony",path:$.statePath,ttlMs:XV,renew:!0});if(!J)return"busy";try{if(await s8($.tokenPath)!==void 0)return"refused-approved";let X=await s8($.statePath);if(X===void 0)return"idle";let Y=PX(X);if(Y.proposedName!==Z)throw Error("Claustrum enrollment state belongs to a different consumer");if(Y.phase==="pending")return"refused-pending";return await J.assertOwned(),await jX($.statePath),"reset"}finally{await J.release()}}var b_="https://api.anthropic.com/api/oauth/profile",f_=604800000;async function QV($){$X($.accessToken,"anthropic");let Z=await($.fetchImpl??fetch)(b_,{method:"GET",signal:$.signal,headers:{Authorization:`Bearer ${$.accessToken}`,Accept:"application/json","anthropic-beta":"oauth-2025-04-20"}});if(!Z.ok)throw Error(`Claude profile check failed: ${Z.status}`);let J=await Z.json(),X=J.organization?.rate_limit_tier,Y=J.organization?.organization_type;if(typeof X!=="string"||X.trim()===""||typeof Y!=="string"||Y.trim()==="")throw Error("Claude profile response is missing account metadata");return{tier:X,orgType:Y,checkedAt:$.now?.()??Date.now(),...$.accountIdentity!==void 0&&{accountIdentity:$.accountIdentity},...$.providerAccountUuid!==void 0&&{providerAccountUuid:$.providerAccountUuid}}}function Cw($,Z){if(!$)return!1;if(Z===void 0)return!0;return $.accountIdentity===void 0||$.accountIdentity===Z}function Fw($,Z=Date.now()){return Boolean($&&Number.isFinite($.checkedAt)&&Z>=$.checkedAt&&Z-$.checkedAt<f_)}function D7($){let Z=$?.tier.match(/^default_claude_max_(\d+)x$/);if(!Z)return;let J=`Max ${Z[1]}x`;return $?.orgType==="claude_team"?`Team · ${J}`:J}function v_($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};let J=Z[0],X=Z.slice(1).join(" ");if(J==="enable"&&X)return{type:"enable",id:X};if(J==="disable"&&X)return{type:"disable",id:X};if(J==="remove"&&X)return{type:"remove",id:X};if(J==="move-up"&&X)return{type:"move-up",id:X};if(J==="move-down"&&X)return{type:"move-down",id:X};if(J==="reset-backoff"&&!X)return{type:"reset-backoff"};if(J==="enrollment-reset"&&!X)return{type:"enrollment-reset"};if(J==="claustrum"&&!X)return{type:"claustrum-mode",mode:"claustrum"};if(J==="local"&&!X)return{type:"claustrum-mode",mode:"local"};if(J==="add-apikey"&&X){let Y=X,z,G,Q=Y.match(/--base-url\s+(\S+)/);if(Q)z=Q[1],Y=Y.replace(Q[0],"").trim();let K=Y.match(/--auth-header\s+(authorization-bearer|x-api-key)/);if(K)G=K[1],Y=Y.replace(K[0],"").trim();let W,V=Y.match(/--label\s+(.+)/);if(V)W=V[1]?.trim()||void 0,Y=Y.replace(V[0],"").trim();let B=Y.indexOf(" ");if(B===-1){if(!Y)return{type:"usage"};return{type:"add-apikey",apiKey:Y,baseURL:z,authHeader:G,label:W}}let H=Y.slice(0,B),q=Y.slice(B+1).trim();return{type:"add-apikey",apiKey:H,label:W??(q||void 0),baseURL:z,authHeader:G}}if(J==="add-oauth-start")return{type:"add-oauth-start"};if(J==="add-oauth-finish"&&X){let Y=X,z,G=Y.match(/--label\s+(.+)/);if(G)z=G[1]?.trim()||void 0,Y=Y.replace(G[0],"").trim();if(!Y)return{type:"usage"};return{type:"add-oauth-finish",code:Y,label:z}}return{type:"usage"}}function jG($){switch($){case"na":return"n/a (OpenCode-managed)";case"off":return"not enrolled";case"on-vault-served":return"vault-served";case"on-vault-reauth":return"vault reauth";case"on-cold":return"vault cold";case"unknown-identity":return"unknown identity";case"on-identity-mismatch":return"identity mismatch";case"on-corrupt-binding":return"corrupt binding"}}function y_($,Z=!1){switch($.state){case"idle":return["- Enrollment: not enrolled"];case"busy":return["- Enrollment: setup is busy"];case"unavailable":return["- Enrollment: temporarily unavailable"];case"pending":return $.requestId&&/^[A-Za-z0-9_-]{1,128}$/.test($.requestId)?[`- Enrollment: pending approval (${$.requestId})`,"- Next: Quit the host and run `bunx @cortexkit/opencode-anthropic-auth setup`"]:[$.requestId?"- Enrollment: pending approval":"- Enrollment: request not sent","- Next: Quit the host and run `bunx @cortexkit/opencode-anthropic-auth setup`"];case"approved":{let X=$.approvedName??$.proposedName;return/^[A-Za-z0-9_-]{1,128}$/.test(X)?[`- Enrollment: approved as enrolled:${X} (generation ${$.tokenGeneration}${Z?"":"; scoped serving not active yet"})`,...Z?[]:["- Next: Quit the host and run `bunx @cortexkit/opencode-anthropic-auth setup`"]]:[`- Enrollment: approved (generation ${$.tokenGeneration}${Z?"":"; scoped serving not active yet"})`,...Z?[]:["- Next: Quit the host and run `bunx @cortexkit/opencode-anthropic-auth setup`"]]}case"denied":return["- Enrollment: denied by operator"];case"blocked":return[`- Enrollment: blocked (${$.code})`]}}function g_($){let Z=[],J=$.quota?.mainQuota?.five_hour;Z.push({id:"main",label:$.main?.provider==="anthropic"?"OpenCode anthropic":"Main",role:"main",enabled:!0,quotaPercent:J?.usedPercent??null,tierLabel:D7($.main?.profile)});for(let X of $.accounts){let Y=X.quota?.five_hour;Z.push({id:X.id,label:X.label??X.id,role:"fallback",enabled:X.enabled!==!1,quotaPercent:Y?.usedPercent??null,tierLabel:X.type==="oauth"?D7(X.profile):void 0})}return Z}var i4=["Usage:","  /claude-account                       Show account list","  /claude-account enable <id>           Enable a fallback account","  /claude-account disable <id>          Disable a fallback account","  /claude-account remove <id>           Remove a fallback account","  /claude-account claustrum             Enable Claustrum mode","  /claude-account local                 Enable local mode","  /claude-account move-up <id>          Move a fallback account up","  /claude-account move-down <id>        Move a fallback account down","  /claude-account reset-backoff          Clear main OAuth refresh and quota backoff","  /claude-account enrollment-reset       Clear denied/blocked state; rerun setup","  /claude-account add-apikey <key>      Add an API key fallback account","  /claude-account add-oauth-start       Start OAuth device flow","  /claude-account add-oauth-finish <code>  Complete OAuth flow"].join(`
-`);async function xw($){let Z=v_($.argumentsText),J=$.storage.accounts,X="main";if(Z.type==="status"){let z=$.statusProjection?.accounts??g_($.storage),G=$.statusProjection?.claustrumDetection??$.claustrum?.status??"unknown",Q=["## Claude Accounts","",`- Custody mode: ${kZ($.storage)}`,`- Claustrum: ${G}`,...$.statusProjection?.claustrumEnrollment?y_($.statusProjection.claustrumEnrollment,$.statusProjection.accounts.some((K)=>K.role==="main"&&K.vaultServed)):[],""];for(let K of z){let W=K.quotaPercent!=null?` ${Math.round(K.quotaPercent)}%`:"",V=!K.enabled?" (disabled)":"",B=K.tierLabel?` · ${K.tierLabel}`:"",H=$.statusProjection?.accounts.find((O)=>O.id===K.id),q=$.storage.accounts.find((O)=>O.id===K.id),N=H?jG(H.custodyState):K.id!=="main"&&q&&kZ($.storage)==="claustrum"&&W8(q)&&q.claustrumScopedCredentialId?jG("on-cold"):"local";Q.push(`- **${K.label}** [${K.role}]${B}${V}${W} · ${N}`)}return Q.push("",i4),{text:Q.join(`
-`)}}if(Z.type==="usage")return{text:i4};if(Z.type==="claustrum-mode"){if(!$.transition)return{text:"Claustrum mode transition is unavailable."};return $.transition(Z.mode)}if(Z.type==="enrollment-reset"){if(!$.resetEnrollment)return{text:"Claustrum enrollment reset is unavailable."};return $.resetEnrollment()}if(Z.type==="add-apikey")return{text:"add-apikey"};if(Z.type==="add-oauth-start")return{text:"add-oauth-start"};if(Z.type==="add-oauth-finish")return{text:"add-oauth-finish"};if(Z.type==="reset-backoff")return{text:"Main OAuth refresh and quota backoff cleared.",updated:{id:"main",action:"reset-backoff"}};let Y=Z.id;if(Y==="main")return{text:`Cannot ${Z.type} the main account (OpenCode managed).`};if(Z.type==="enable"||Z.type==="disable"){let z=J.find((G)=>G.id===Y);if(!z)return{text:`Account "${Y}" not found.`};return{text:`Account "${z.label??Y}" ${Z.type}d.`,updated:{id:Y,action:Z.type,enabled:Z.type==="enable"}}}if(Z.type==="remove"){let z=J.find((G)=>G.id===Y);if(!z)return{text:`Account "${Y}" not found.`};if(kZ($.storage)==="claustrum"&&W8(z)&&z.claustrumScopedCredentialId)return{text:`Account "${z.label??Y}" is managed by Claustrum. Disable it to stop routing, or remove it from the vault.`};return{text:`Account "${z.label??Y}" removed.`,updated:{id:Y,action:"remove"}}}if(Z.type==="move-up"){let z=J.findIndex((W)=>W.id===Y);if(z<0)return{text:`Account "${Y}" not found.`};if(z===0)return{text:`Account "${J[z]?.label??Y}" is already first.`};let G=J.map((W)=>W.id),Q=[...J];[Q[z-1],Q[z]]=[Q[z],Q[z-1]];let K=Q.map((W)=>W.id);return{text:`Account "${J[z]?.label??Y}" moved up.`,updated:{id:Y,action:"reorder",previousOrder:G,newOrder:K}}}if(Z.type==="move-down"){let z=J.findIndex((W)=>W.id===Y);if(z<0)return{text:`Account "${Y}" not found.`};if(z===J.length-1)return{text:`Account "${J[z]?.label??Y}" is already last.`};let G=J.map((W)=>W.id),Q=[...J];[Q[z],Q[z+1]]=[Q[z+1],Q[z]];let K=Q.map((W)=>W.id);return{text:`Account "${J[z]?.label??Y}" moved down.`,updated:{id:Y,action:"reorder",previousOrder:G,newOrder:K}}}return{text:i4}}var m_="ANTHROPIC_CUSTOM_HEADERS",h_=64,r0=new Map,i9=new Set,p_=new Set(["authorization","proxy-authorization","x-api-key","host","content-length","content-type","connection","transfer-encoding","upgrade","keep-alive","te","trailer","anthropic-version","anthropic-beta","x-parent-session-id","x-session-affinity","x-opencode-session","x-anthropic-effort-plan","x-cortexkit-billing-lineage"]);function RG($,Z){r0.delete($),r0.set($,Z);while(r0.size>h_){let J=r0.keys().next().value;if(J===void 0)break;r0.delete(J),i9.delete(J)}}function TG($,Z,J){if(p_.has(Z.trim().toLowerCase()))throw TypeError("protected header");$.set(Z,J)}function l_($){if(!$?.trim())return new Headers;let Z=r0.get($);if(Z!==void 0||r0.has($))return new Headers(Z??[]);try{let J=new Headers,X=$.trim();if(!X.startsWith("{")&&!X.startsWith("["))for(let z of X.split(/\r?\n|,\s*(?=[^,\s:]+:)/).map((G)=>G.trim()).filter(Boolean)){let G=z.indexOf(":");if(G<=0)throw TypeError("invalid header entry");TG(J,z.slice(0,G).trim(),z.slice(G+1).trim())}else{let z=J1(X);if(z==null||typeof z!=="object"||Array.isArray(z))throw TypeError("invalid header object");for(let[G,Q]of Object.entries(z)){if(Q==null)continue;TG(J,G,Array.isArray(Q)?Q.map(String).join(", "):String(Q))}}let Y=[...J.entries()];return RG($,Y),new Headers(Y)}catch{if(RG($,null),!i9.has($))i9.add($),n.warn("custom-headers","ignoring malformed ANTHROPIC_CUSTOM_HEADERS",{reason:"invalid or protected header configuration"});return new Headers}}function Aw($,Z=process.env[m_]){return l_(Z).forEach((X,Y)=>{$.set(Y,X)}),$}var u_="## Claude Fast Mode Status",d_="## Claude Fast Mode Enabled",c_="## Claude Fast Mode Disabled",i_="## Claude Fast Mode Usage",s_="Usage: `/claude-fast`, `/claude-fast on`, or `/claude-fast off`.",c7=!1;function Sw(){return c7}function Iw($){c7=$}function a_($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="on")return{type:"enable"};if(Z.length===1&&Z[0]==="off")return{type:"disable"};return{type:"usage"}}function qZ($){let Z=$?.enabled??c7;return[u_,"",`- Enabled: ${Z?"enabled":"disabled"}`,...$?.settingsPath?[`- Persisted: ${$.settingsPath}`]:[],"- Scope: adds Anthropic fast mode to supported Opus requests","- Supported models: claude-opus-4-8, claude-opus-5, and claude-opus-5-5",'- Request changes: adds `speed: "fast"` and the `fast-mode-2026-02-01` beta header',"- Note: fast and standard speeds do not share prompt-cache prefixes"].join(`
-`)}function Ew($){let Z=a_($.argumentsText),J=$.enabled??c7;if(Z.type==="status")return qZ({enabled:J,settingsPath:$.settingsPath});if(Z.type==="enable")return[d_,"",qZ({enabled:!0,settingsPath:$.settingsPath})].join(`
-`);if(Z.type==="disable")return[c_,"",qZ({enabled:!1,settingsPath:$.settingsPath})].join(`
-`);return[i_,"",s_,"",qZ({enabled:J,settingsPath:$.settingsPath})].join(`
-`)}var P8="claude-killswitch";function n_($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="on")return{type:"on"};if(Z.length===1&&Z[0]==="off")return{type:"off"};if(Z[0]==="set"){let J=[];for(let X=1;X<Z.length;X++){let Y=Z[X]?.match(/^([^:]+):(\d+),(\d+)(?:,(\d+))?$/);if(!Y)return{type:"usage"};let[,z,G,Q,K]=Y,W=typeof K==="string"&&K.length>0?Number.parseInt(K,10):void 0,V={account:z,fh:Number.parseInt(G,10),sd:Number.parseInt(Q,10)};if(W!==void 0)V.scoped=W;J.push(V)}if(J.length===0)return{type:"usage"};return{type:"set",entries:J}}return{type:"usage"}}function OZ($,Z){let J=$.enabled===!0,X=["## Killswitch","",`Status: **${J?"ON":"OFF"}**`];if(J){X.push(""),X.push("| Account | 5h threshold | 1w threshold | Scoped |"),X.push("| ------- | ------------ | ------------ | ------ |");let Y=Y7($.main);X.push(`| main | ≥ ${Y.five_hour}% | ≥ ${Y.seven_day}% | ≤ ${Y.scoped}% |`);for(let z of Z){let G=Y7($.accounts?.[z]??$.main);X.push(`| ${z} | ≥ ${G.five_hour}% | ≥ ${G.seven_day}% | ≤ ${G.scoped}% |`)}}return X.join(`
-`)}var PG=["## Killswitch Commands","","```",`/${P8}              — show status`,`/${P8} on           — enable with current or default thresholds`,`/${P8} off          — disable`,`/${P8} set all:5,10 — set all accounts to 5h≥5%, 1w≥10%`,`/${P8} set main:3,8,0 — set 5h≥3%, 1w≥8%, scoped≤0%`,`/${P8} set main:3,8 work-alt:5,10 — per-account`,"```"].join(`
-`);function ww($){let Z=n_($.argumentsText);if(Z.type==="status")return{text:`${OZ($.config,$.accountIds)}
-
-${PG}`};if(Z.type==="on"){let X={...$.config,enabled:!0,main:$.config.main??{five_hour:b8.five_hour,seven_day:b8.seven_day}};return{text:`## Killswitch Enabled
-
-${OZ(X,$.accountIds)}`,updatedConfig:X}}if(Z.type==="off")return{text:"## Killswitch Disabled",updatedConfig:{...$.config,enabled:!1}};if(Z.type==="set"){let X={...$.config.accounts??{}},Y={...$.config,enabled:!0,accounts:X};for(let G of Z.entries){let Q={five_hour:G.fh,seven_day:G.sd};if(G.scoped!==void 0)Q.scoped=G.scoped;if(G.account==="main")Y.main=Q;else if(G.account==="all"){Y.main=Q;for(let K of $.accountIds)X[K]=Q}else X[G.account]=Q}return{text:`## Killswitch Updated
-
-${OZ(Y,$.accountIds)}`,updatedConfig:Y}}return{text:`${OZ($.config,$.accountIds)}
-
-${PG}`}}var o_=["error","warn","info","debug","trace"],KV="Usage: `/claude-logging`, `/claude-logging error|warn|info|debug|trace`.";function r_($){let Z=$.trim().toLowerCase().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&o_.includes(Z[0]))return{type:"level",level:Z[0]};return{type:"usage"}}function s4($){return["## Claude Log Level","",`Current log level: \`${$?.level??"info"}\``,...$?.settingsPath?[`- Persisted: ${$.settingsPath}`]:[],"- Valid levels: error, warn, info, debug, trace","",KV].join(`
-`)}function kw($){let Z=r_($.argumentsText),J=$.level??"info";if(Z.type==="status")return s4({level:J,settingsPath:$.settingsPath});if(Z.type==="level")return["## Claude Log Level Updated","",`Level set to \`${Z.level}\`.`,"",...s4({level:Z.level,settingsPath:$.settingsPath}).split(`
-`).slice(2)].join(`
-`);return["## Claude Log Level Usage","",KV,"",...s4({level:J,settingsPath:$.settingsPath}).split(`
-`).slice(2)].join(`
-`)}function CG($){return process.env[$]?.trim()||void 0}function t_($){if(/^claude-sonnet(?:-|$)/.test($))return"sonnet";if(/^claude-opus(?:-|$)/.test($))return"opus";if(/^claude-haiku(?:-|$)/.test($))return"haiku";if(/^claude-(?:fable|mythos)(?:-|$)/.test($))return"fable";return null}var e_={sonnet:"ANTHROPIC_DEFAULT_SONNET_MODEL",opus:"ANTHROPIC_DEFAULT_OPUS_MODEL",haiku:"ANTHROPIC_DEFAULT_HAIKU_MODEL",fable:"ANTHROPIC_DEFAULT_FABLE_MODEL"};function $M($){if(typeof $!=="string"||!$)return $;let Z=t_($);if(Z){let J=CG(e_[Z]);if(J)return J}if($.startsWith("claude-")){let J=CG("ANTHROPIC_MODEL");if(J)return J}return $}function bw($){if(typeof $.model!=="string")return!1;let Z=$M($.model);if(Z===$.model)return!1;return $.model=Z,!0}class Q6 extends Error{operation;rowId;phase;retryable;kind;committed;constructor($){super($.message??`${$.operation} failed (${$.kind}, ${$.phase})`,$.cause===void 0?void 0:{cause:$.cause});this.name="PoolOperationError",this.operation=$.operation,this.rowId=$.rowId,this.phase=$.phase,this.retryable=$.retryable,this.kind=$.kind,this.committed=$.committed}}class WV extends Error{operation;constructor($){super(`${$} was called from inside a store hook; hand it to the caller's continuation instead`);this.name="PoolReentryError",this.operation=$}}var i7="identity-contradicted: ",VV="duplicate-identity";function a8($,Z,J){let X=$.rosterRow(Z);if(!X)return;X.enabled=!1;let Y=$.entry(Z)??{credentialEpoch:1,needsFirstReading:!0},z=typeof Y.disabledReason==="string"&&Y.disabledReason.startsWith(i7);$.setEntry(Z,{...Y,disabledReason:z?Y.disabledReason:J})}function s9($,Z){let J=$.rosterRow(Z);if(!J)return;J.enabled=!0;let X=$.entry(Z);if(X&&"disabledReason"in X){let Y={...X};delete Y.disabledReason,$.setEntry(Z,Y)}}function s7($,Z){let J=$.rows().filter((Y)=>Y.invalid===void 0&&!Y.staged&&Y.type==="oauth"&&Y.enabled&&Y.identity===Z),X=[];for(let Y of J.slice(1))a8($,Y.id,VV),X.push(Y.id);return X}function a7($,Z,J){let X=$.rosterRow(Z);if(!X)return[];return X.accountId=J,s7($,J)}var BV=new JM;function E$($){if(BV.getStore()!==void 0)throw new WV($)}function Y1($,Z){return BV.run($,async()=>await Z())}async function XM($,Z,J,X,Y){if(!Z)return;try{await Y1($,()=>Z(J,X))}catch(z){Y?.warn("store failure hook threw; the original failure stands",{operation:$,rowId:J,error:z instanceof Error?z.message:String(z)})}}var i6=Object.freeze({ttlMs:1e4,timeoutMs:15000,retryMs:50,renew:!0});async function YM($,Z,J){let X=(G)=>{try{let Q=J.onLockEvent?.({type:G,name:$.name,path:$.path});if(Q&&(typeof Q==="object"||typeof Q==="function")&&"then"in Q&&typeof Q.then==="function")Promise.resolve(Q).catch(()=>{})}catch{}},Y={...Z,...zM($)},z=performance.now();for(;;){let G=await g0({name:$.name,path:$.path,ttlMs:Y.ttlMs,renew:Y.renew,onContended:()=>X("contended"),...J.onRenewalTimer?{onRenewalTimer:(W)=>J.onRenewalTimer?.({name:$.name,path:$.path},W)}:{},...Y.renewIntervalMs!==void 0?{renewIntervalMs:Y.renewIntervalMs}:{},...J.onLockStep?{onStep:(W)=>J.onLockStep?.({name:$.name,path:$.path},W)}:{}});if(G){X("acquired");let W={name:$.name,path:$.path,assertOwned:()=>G.assertOwned(),release:async()=>{await G.release(),X("released")}};try{await W.assertOwned()}catch(V){throw await W.release(),V}return W}let Q=Y.timeoutMs-(performance.now()-z);if(Q<=0)throw new d8({target:$.path,name:$.name,timeoutMs:Y.timeoutMs});let K=Math.floor(Math.random()*(Y.retryMs+1));await new Promise((W)=>setTimeout(W,Math.min(Y.retryMs+K,Q)))}}function zM($){let Z={};if($.ttlMs!==void 0)Z.ttlMs=$.ttlMs;if($.timeoutMs!==void 0)Z.timeoutMs=$.timeoutMs;if($.retryMs!==void 0)Z.retryMs=$.retryMs;if($.renew!==void 0)Z.renew=$.renew;if($.renewIntervalMs!==void 0)Z.renewIntervalMs=$.renewIntervalMs;return Z}class S2{defaults;env;held=[];constructor($,Z){this.defaults=$,this.env=Z}async acquire($){let Z=await YM($,this.defaults,this.env);return this.held.push(Z),await this.assertAll(),Z}async assertAll(){for(let $ of this.held)await $.assertOwned()}async releaseTo($){while(this.held.length>$)await this.held.pop()?.release().catch(()=>{})}async releaseAll(){await this.releaseTo(0)}}function _7($,Z,J){if(J!==void 0)throw new Q6({operation:$,rowId:Z,kind:"row-staged",phase:$==="pull"?"pull":"before-first-write",retryable:!1,message:`row ${Z} is reserved for roster publication`})}var D6="commonAuthPool",Y2=1,$0="rows",gZ="retiredEpochs",a9=1,HV=300000,N6=D6;function GM($){let Z=JSON.parse(JSON.stringify($)),J=(X)=>{if(Array.isArray(X))return`[${X.map(J).join(",")}]`;if(u(X))return`{${Object.keys(X).sort().map((Y)=>`${JSON.stringify(Y)}:${J(X[Y])}`).join(",")}}`;return JSON.stringify(X)};return J(Z)}function z2($){return I2("sha256").update(GM($)).digest("hex")}function UV($){if(!u($)||Object.keys($).length!==1||typeof $.reservation!=="string"||!$.reservation)return;return{reservation:$.reservation}}function QM($){if(!u($)||typeof $.reservation!=="string"||!$.reservation||typeof $.disabledReason!=="string")return;if(Object.keys($).some((Z)=>!["reservation","label","disabledReason","providerState"].includes(Z)))return;if("label"in $&&typeof $.label!=="string")return;if("providerState"in $&&(typeof $.providerState!=="string"||!/^[a-f0-9]{64}$/.test($.providerState)))return;return $}var F$="commonAuthProviderState";function u($){return $!=null&&typeof $==="object"&&!Array.isArray($)}var KM=new Set(["__proto__","constructor","prototype"]);function M7($){if(typeof $!=="string"||$.length===0)return"id must be non-empty";if($.trim()!==$)return"id must not carry surrounding whitespace";if(KM.has($))return"id is a reserved object key";return}function CX($){let Z=typeof $==="string"?$.trim():"";if(!Z)return!1;try{let J=new URL(Z);return(J.protocol==="http:"||J.protocol==="https:")&&!J.username&&!J.password}catch{return!1}}function NV($){return $.type==="oauth"?`oauth\x00${$.refresh}`:`api\x00${$.apiKey}`}function A6($){return I2("sha256").update(NV($)).digest("hex")}function N8($){return I2("sha256").update(`credential-stamp\x00${NV($)}`).digest("hex")}function G8($){let Z=$.type==="oauth"?["oauth",typeof $.access==="string"?$.access:null,$.refresh,typeof $.expires==="number"&&Number.isFinite($.expires)?$.expires:null]:["api",$.apiKey,$.baseURL.trim(),$.authHeader??"authorization-bearer"];return I2("sha256").update(`credential-dispatch\x00${JSON.stringify(Z)}`).digest("hex")}function LV($,Z,J,X={}){return{credentialEpoch:Z,digest:N8($),dispatch:G8($),binding:{...J},...X.replace?{replace:!0}:{},...X.providerState!==void 0?{providerState:X.providerState}:{}}}function n7($,Z){let J=$?.credentialBound?$.credentialBound(Z):Z;return I2("sha256").update(`provider-state\x00${JSON.stringify(J??null)}`).digest("hex")}function FX($,Z,J,X){if(!Z||J===void 0)return;if(!u($)||!Object.hasOwn($,F$))return;let Y=u$($[N6]);if(!Y||Y.providerState===void 0||Y.digest!==N8(Z)||Y.credentialEpoch!==J||Y.binding?.identity!==X)return;return Y.providerState}function B$($){return Number.isSafeInteger($)&&$>=1}function u$($){if(!u($))return;let Z=$.credentialEpoch;if(!B$(Z))return;if(typeof $.digest!=="string")return;if("dispatch"in $&&typeof $.dispatch!=="string")return;if("replace"in $&&$.replace!==!0)return;if("providerState"in $&&typeof $.providerState!=="string")return;let J="staged"in $?QM($.staged):void 0;if("staged"in $&&!J)return;let X={...J?{staged:J}:{},...typeof $.dispatch==="string"?{dispatch:$.dispatch}:{},...$.replace===!0?{replace:!0}:{},...typeof $.providerState==="string"?{providerState:$.providerState}:{}};if(!("binding"in $))return"dispatch"in $||"replace"in $||"providerState"in $||"staged"in $?void 0:{credentialEpoch:Z,digest:$.digest};let Y=$.binding;if(!u(Y))return;if("identity"in Y&&(typeof Y.identity!=="string"||!Y.identity))return;if("baseURL"in Y&&!CX(Y.baseURL))return;if("authHeader"in Y&&Y.authHeader!=="authorization-bearer"&&Y.authHeader!=="x-api-key")return;return{credentialEpoch:Z,digest:$.digest,...X,binding:{...typeof Y.identity==="string"?{identity:Y.identity}:{},...typeof Y.baseURL==="string"?{baseURL:Y.baseURL.trim()}:{},...Y.authHeader==="authorization-bearer"||Y.authHeader==="x-api-key"?{authHeader:Y.authHeader}:{}}}}function WM($,Z,J){if($.identity!==J)return!1;if($.baseURL!==void 0&&(Z.type!=="api"||Z.baseURL!==$.baseURL))return!1;if($.authHeader!==void 0&&(Z.type!=="api"||Z.authHeader!==$.authHeader))return!1;return!0}function VM($,Z,J,X){if(!$)return"none";if(!u(X)||!Object.hasOwn(X,N6))return"missing";let Y=u$(X[N6]);if(!Y)return"malformed";if(Y.digest!==N8($))return"mismatched";if(Y.dispatch===void 0)return"legacy";if(Y.credentialEpoch!==Z)return"mismatched";if(!Y.binding||!WM(Y.binding,$,J))return"mismatched";if(Y.dispatch!==G8($))return"mismatched";return"bound"}function BM($){if(!$.exists)return{status:"ready",exists:!1,config:{}};if("parseError"in $)return{status:"error",reason:"config file is not valid JSON"};let Z=$.value;if(!u(Z))return{status:"error",reason:"config root is not an object"};if("accounts"in Z&&!Array.isArray(Z.accounts))return{status:"error",reason:"config accounts is not an array"};if(!(D6 in Z))return Array.isArray(Z.accounts)?{status:"pending-migration",config:Z}:{status:"ready",exists:!0,config:Z};let J=Z[D6];if(!u(J))return{status:"error",reason:`${D6} is not an object`};let X=J.schemaVersion;if(typeof X!=="number"||!Number.isInteger(X)||X<1)return{status:"error",reason:`${D6}.schemaVersion is invalid`};if(X>Y2)return{status:"error",reason:`${D6}.schemaVersion ${X} is newer than ${Y2}`};if($0 in J&&!u(J[$0]))return{status:"error",reason:`${D6}.${$0} is not an object`};return{status:"ready",exists:!0,config:Z}}function HM($){if(!$.exists)return{status:"ready",exists:!1,state:{}};if("parseError"in $)return{status:"error",reason:"state file is not valid JSON"};if(!u($.value))return{status:"error",reason:"state root is not an object"};if("accounts"in $.value&&!u($.value.accounts))return{status:"error",reason:"state accounts is not an object"};return{status:"ready",exists:!0,state:$.value}}function o7($){return Array.isArray($.accounts)?$.accounts:[]}function qV($){let Z=$[D6];if(!u(Z))return{};let J=Z[$0];return u(J)?J:{}}function UM($){return u($.accounts)?$.accounts:{}}function NM($){if(!u($))return"not an object";let Z=M7($.id);if(Z)return Z;if($.type==="api")return CX($.baseURL)?void 0:"invalid baseURL";if($.type==="oauth")return;return"unknown type"}function LM($,Z){if(!u($))return;let J=$.credentialEpoch;if(!B$(J))return;if("needsFirstReading"in $&&typeof $.needsFirstReading!=="boolean")return;if("disabledReason"in $&&typeof $.disabledReason!=="string")return;let X="quota"in $&&Z.decode?Z.decode($.quota):$.quota;if("quota"in $&&!Z.validate(X))return;if("staged"in $&&!UV($.staged))return;return{credentialEpoch:J,needsFirstReading:$.needsFirstReading===!0,...typeof $.disabledReason==="string"?{disabledReason:$.disabledReason}:{},..."quota"in $?{quota:X}:{}}}function qM($,Z){if(!u(Z))return;if($.type==="api"){let X=typeof Z.apiKey==="string"?Z.apiKey.trim():"";if(!X)return;return{type:"api",apiKey:X,baseURL:String($.baseURL).trim(),authHeader:$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer"}}if($.corrupt===!0)return;let J=Z.refresh;if(typeof J!=="string"||!J.trim())return;return{type:"oauth",refresh:J,...typeof Z.access==="string"?{access:Z.access}:{},...typeof Z.expires==="number"?{expires:Z.expires}:{},...typeof Z.lastRefreshedAt==="number"?{lastRefreshedAt:Z.lastRefreshedAt}:{}}}function OV($,Z){return o7($).find((J)=>u(J)&&J.id===Z)}function DV($){if(!u($[D6]))$[D6]={};return $[D6]}function _V($){let Z=DV($);if(!u(Z[$0]))Z[$0]={};return Z[$0]}function E2($,Z){let J=qV($),X=Object.hasOwn(J,Z)?J[Z]:void 0;return u(X)?X:void 0}function MV($,Z,J){Object.defineProperty(_V($),Z,{value:J,enumerable:!0,writable:!0,configurable:!0})}function jV($,Z){let J=$[D6];if(!u(J))return;let X=J[gZ];if(!u(X)||!Object.hasOwn(X,Z))return;let Y=X[Z];return B$(Y)?Y:void 0}function RV($,Z){let J=E2($,Z)?.credentialEpoch;return B$(J)?J:void 0}function xX($,Z){return Math.max(jV($,Z)??0,RV($,Z)??0)+1}function OM($,Z){let J=[...Z];if(J.length===0)return;let X=DV($),Y=u(X[gZ])?X[gZ]:{},z={},G=(Q,K)=>Object.defineProperty(z,Q,{value:K,enumerable:!0,writable:!0,configurable:!0});for(let[Q,K]of Object.entries(Y))if(B$(K))G(Q,K);for(let Q of J)G(Q,Math.max(jV($,Q)??0,RV($,Q)??1));X[gZ]=z}function z1($,Z,J,X){let Y=qV($),z=UM(Z),G=new Set,Q=[];for(let K of o7($)){let W=NM(K),V=u(K)&&typeof K.id==="string"?K.id:void 0,B=V===void 0?void 0:Y[V],H=u(B)&&Object.hasOwn(B,"staged"),q=H?UV(B.staged):void 0;if(W||!u(K)||V===void 0||G.has(V)){if(V!==void 0&&!G.has(V))G.add(V);if(V!==void 0)Q.push({id:V,type:u(K)&&K.type==="api"?"api":"oauth",enabled:!1,needsFirstReading:!0,hasEntry:Object.hasOwn(Y,V),candidate:!1,invalid:"roster",stamp:"none",...q?{staged:q}:{}});continue}G.add(V);let N=K.type==="api"?"api":"oauth",O=Object.hasOwn(Y,V),U=O?LM(Y[V],J):void 0,D=qM(K,z[V]),_=K.enabled!==!1,T=U?U.credentialEpoch:O?void 0:1,M=typeof K.accountId==="string"&&K.accountId?K.accountId:void 0,L={id:V,type:N,enabled:_,needsFirstReading:U?U.needsFirstReading:N==="oauth",hasEntry:O,candidate:!1,...typeof K.label==="string"?{label:K.label}:{},...typeof K.addedAt==="number"?{addedAt:K.addedAt}:{},...M!==void 0?{identity:M}:{},...D?{credential:D,fingerprint:A6(D)}:{},...U?{credentialEpoch:U.credentialEpoch}:{},...q?{staged:q}:{},...U?.disabledReason!==void 0?{disabledReason:U.disabledReason}:{},...U&&"quota"in U?{quota:U.quota}:{},...DM(z[V],D,T,M,X),stamp:VM(D,T,M,z[V])};if(O&&!U)L.invalid="entry";else L.candidate=_&&D!==void 0&&!H;Q.push(L)}return Q}function DM($,Z,J,X,Y){if(!u($)||!Object.hasOwn($,F$))return{};let z=FX($,Z,J,X);if(z===void 0)return{providerStateDropped:"uncovered"};let G=$[F$];if(!Y?.validate(G))return{providerStateDropped:"invalid"};if(n7(Y,G)!==z)return{providerStateDropped:"uncovered"};return{providerState:G}}function f6($){return $.identity??$.id}function AX($,Z){if($===void 0||$>Z+HV)return Z;return Math.max(Z,$+1)}function FG($,Z){return AX($,Z)>Z+HV}function G2($){let{id:Z,credential:J,identity:X,label:Y,addedAt:z}=$;return{id:Z,...Y!==void 0?{label:Y}:{},type:J.type,addedAt:z,...X!==void 0?{accountId:X}:{},...J.type==="api"?{baseURL:J.baseURL.trim(),authHeader:J.authHeader??"authorization-bearer"}:{}}}function _M($,Z){if($.type==="api")return{apiKey:$.apiKey};return{...$.access!==void 0?{access:$.access}:{},refresh:$.refresh,...$.expires!==void 0?{expires:$.expires}:{},...Z!==void 0?{lastRefreshedAt:Z}:{}}}function MM($,Z){if($.type==="api")return{...$,baseURL:$.baseURL.trim(),authHeader:$.authHeader??"authorization-bearer"};return{...$,...Z!==void 0?{lastRefreshedAt:Z}:{}}}function jM($,Z={}){if(!u($))return"credential must be an object";if($.type==="oauth"){if(typeof $.refresh!=="string"||!$.refresh.trim())return"oauth credential needs a refresh token";return}if($.type==="api"){if(typeof $.apiKey!=="string"||!$.apiKey.trim())return"api credential needs an api key";if($.apiKey.trim()!==$.apiKey)return"api key must not carry surrounding whitespace";if(!(Z.baseURLOptional&&$.baseURL===void 0)&&!CX($.baseURL))return"api credential needs a valid baseURL";return}return"credential type must be oauth or api"}var SX="transition",TV="transitionMark";function RM($){if(!u($))return;let Z=$[SX];if(!u(Z))return;if(typeof Z.mark!=="string"||Z.mark.length===0)return;if(Z.enabled===!0)return{mark:Z.mark,enabled:!0};if(Z.enabled===!1&&typeof Z.reason==="string")return{mark:Z.mark,enabled:!1,reason:Z.reason};return}function IX($,Z,J){if(J.enabled)s9($,Z);else a8($,Z,J.reason??"");if(!$.rosterRow(Z))return;let X=$.entry(Z)??{credentialEpoch:1,needsFirstReading:!0};if($.setEntry(Z,{...X,[TV]:J.mark}),!J.enabled)return;let Y=$.rows().find((z)=>z.id===Z);if(Y?.type==="oauth"&&Y.identity!==void 0)s7($,Y.identity)}function TM($,Z){if($.type!=="api")return $;return{...$,...Z.baseURL!==void 0?{baseURL:Z.baseURL}:{},...Z.authHeader!==void 0?{authHeader:Z.authHeader}:{}}}function PM($){if(!$.binding)return!1;return $.replace===!0||$.dispatch===void 0}function CM($,Z,J,X={}){let Y=u(Z.accounts)?Z.accounts:{},z=new Map;for(let G of z1($,Z,J)){if(G.invalid||G.staged||!G.credential)continue;let Q=Object.hasOwn(Y,G.id)?Y[G.id]:void 0;if(!u(Q))continue;let K=u$(Q[N6]);if(!K?.binding)continue;if(K.digest!==N8(G.credential))continue;let W=G.credentialEpoch??1;if(K.credentialEpoch>W){if(!PM(K))continue;if(X.requireCredentialStamps){if(K.dispatch===void 0)continue;if(K.dispatch!==G8(TM(G.credential,K.binding)))continue}z.set(G.id,{kind:"replace",stamp:{...K,binding:K.binding}})}else if(K.credentialEpoch===W&&K.dispatch!==void 0&&K.dispatch===G8(G.credential)&&K.binding.identity!==void 0&&G.identity===void 0)z.set(G.id,{kind:"identity",identity:K.binding.identity});else if(K.credentialEpoch===W&&K.binding.identity===G.identity){if(X.requireCredentialStamps&&K.dispatch!==G8(G.credential))continue;let V=RM(Q[N6]);if(V&&E2($,G.id)?.[TV]!==V.mark)z.set(G.id,{kind:"transition",transition:V})}}return z}function PV($,Z,J,X){let z={...$.entry(Z)??{},credentialEpoch:J,needsFirstReading:!0};if(delete z.quota,X.identity!==void 0&&typeof z.disabledReason==="string"&&z.disabledReason.startsWith(i7))delete z.disabledReason;$.setEntry(Z,z);let G=$.rosterRow(Z);if(!G)return;if(X.identity!==void 0)G.accountId=X.identity;else delete G.accountId;if(X.baseURL!==void 0)G.baseURL=X.baseURL;if(X.authHeader!==void 0)G.authHeader=X.authHeader}function CV($,Z,J,X={}){let Y=CM($,Z,J,X);if(Y.size===0)return{config:$,torn:[]};let z=structuredClone($),G={rows:()=>z1(z,Z,J),rosterRow:(Q)=>OV(z,Q),entry:(Q)=>E2(z,Q),setEntry:(Q,K)=>MV(z,Q,K)};for(let[Q,K]of Y)if(K.kind==="replace")PV(G,Q,K.stamp.credentialEpoch,K.stamp.binding);for(let[Q,K]of Y)if(K.kind==="identity")a7(G,Q,K.identity);else if(K.kind==="transition")IX(G,Q,K.transition);else if(K.stamp.binding.identity!==void 0)s7(G,K.stamp.binding.identity);return{config:z,torn:[...Y.keys()]}}function FV($,Z,J,X={}){let{config:Y,torn:z}=CV($,Z,J,X),G=z1(Y,Z,J,X.providerState);for(let Q of G){if(z.includes(Q.id))Q.torn=!0,Q.candidate=!1;if(X.requireCredentialStamps&&Q.stamp!=="bound")Q.unbound=!0,Q.candidate=!1}return G}async function a4($){try{return await C0($,t)}catch(Z){if(Z.code==="ENOENT")return;throw Z}}function xG($){if($===void 0)return{exists:!1};try{return{exists:!0,value:JSON.parse($)}}catch(Z){return{exists:!0,parseError:Z}}}async function d$($){for(let Z=0;Z<3;Z++){let J=await a4($.configPath),X=await a4($.statePath),Y=await a4($.configPath);if(J!==Y){if(Z<2)await ZM(2+Math.floor(Math.random()*4));continue}let z=BM(xG(J));if(z.status==="error")return{status:"error",file:"config",reason:z.reason};let G=HM(xG(X));if(G.status==="error")return{status:"error",file:"state",reason:G.reason};if(z.status==="pending-migration")return{status:"pending-migration",config:z.config};return{status:"ready",configExists:z.exists,stateExists:G.exists,config:z.config,state:G.state,rows:FV(z.config,G.state,$.codec,{requireCredentialStamps:$.requireCredentialStamps===!0,...$.providerState?{providerState:$.providerState}:{}})}}return{status:"error",file:"config",kind:"snapshot-contended",retryable:!0,reason:"The store was changing; retry the operation once writes settle."}}function L8($,Z,J,X="before-first-write"){if($.status==="error"&&$.kind==="snapshot-contended")return new Q6({operation:Z,...J!==void 0?{rowId:J}:{},phase:X,kind:"snapshot-contended",retryable:!0,message:$.reason});return new Q6({operation:Z,...J!==void 0?{rowId:J}:{},phase:X,retryable:!1,kind:$.status==="pending-migration"?"pending-migration":"load-error",message:$.status==="pending-migration"?"the config holds a legacy roster that has not been migrated into the pool":`${$.file} file cannot be loaded: ${$.reason}`})}class xV{ctx;snapshot;locks;progress;info;config;state;constructor($,Z,J,X,Y){this.ctx=$,this.snapshot=Z,this.locks=J,this.progress=X,this.info=Y,this.config=structuredClone(Z.config),this.state=structuredClone(Z.state)}rows(){return FV(this.config,this.state,this.ctx.codec,{requireCredentialStamps:this.ctx.requireCredentialStamps===!0,...this.ctx.providerState?{providerState:this.ctx.providerState}:{}})}row($){return this.rows().find((Z)=>Z.id===$)}reservation($){if(this.rosterRow($)){let J=this.entry($);return J&&Object.hasOwn(J,"staged")?J.staged:void 0}let Z=this.stateAccount($)?.[N6];return u(Z)&&Object.hasOwn(Z,"staged")?Z.staged:void 0}assertNotStaged($){_7(this.info.operation,$,this.reservation($))}roster(){if(!Array.isArray(this.config.accounts))this.config.accounts=[];return this.config.accounts}rosterRow($){return this.roster(),OV(this.config,$)}dropRosterRows($){let Z=this.roster(),J=Z.filter((X)=>!(u(X)&&X.id===$));return this.config.accounts=J,Z.length-J.length}entries(){return _V(this.config)}entry($){return this.entries(),E2(this.config,$)}setEntry($,Z){MV(this.config,$,Z)}async completeTorn(){let{config:$,torn:Z}=CV(this.config,this.state,this.ctx.codec,{requireCredentialStamps:this.ctx.requireCredentialStamps===!0});if(Z.length===0)return;this.config=$,await this.commitConfig({counted:!1})}stateAccount($){let Z=u(this.state.accounts)?this.state.accounts:{},J=Object.hasOwn(Z,$)?Z[$]:void 0;return u(J)?J:void 0}dropStateAccount($){if(u(this.state.accounts)&&Object.hasOwn(this.state.accounts,$))delete this.state.accounts[$]}setStateAccount($,Z){if(!u(this.state.accounts))this.state.accounts={};Object.defineProperty(this.state.accounts,$,{value:Z,enumerable:!0,writable:!0,configurable:!0})}async commitConfig($={}){let Z=this.roster(),J=new Set;for(let K of Z)if(u(K)&&typeof K.id==="string")J.add(K.id);let X=new Set;for(let K of o7(this.snapshot.config))if(u(K)&&typeof K.id==="string"&&!J.has(K.id))X.add(K.id);for(let K of Object.keys(this.entries()))if(!J.has(K))X.add(K);OM(this.config,X);let Y=this.entries(),z={};for(let[K,W]of Object.entries(Y))if(J.has(K))Object.defineProperty(z,K,{value:W,enumerable:!0,writable:!0,configurable:!0});let G=this.config[D6],Q={...this.config,version:a9,accounts:Z,[D6]:{...G,schemaVersion:Y2,[$0]:z}};await this.write(this.ctx.configPath,Q,"config",$.counted??!0,$.durable??!1,()=>{if($.publicationDecision)this.markPublicationDecision();for(let K of X)this.ctx.removedIds.add(K);this.config=Q}),this.config=Q}async commitState($,Z={}){let J={...this.state,version:a9,accounts:u(this.state.accounts)?this.state.accounts:{}};if(await this.write(this.ctx.statePath,J,"state",!0,Z.durable??!1),this.state=J,$)this.progress.committed=$}async assertAll(){await this.locks.assertAll()}async syncState(){await this.assertAll();try{if(this.snapshot.stateExists)await Wz(this.ctx.statePath)}catch($){throw new Q6({operation:this.info.operation,rowId:this.info.rowId,phase:"before-first-write",kind:"publication-sync",retryable:!0,message:"Publication sync failed before the decision; nothing was written. Retry the same plan.",cause:$})}}markPublicationDecision(){this.progress.publicationDecided=!0}async syncConfig(){await this.assertAll(),await Wz(this.ctx.configPath)}async write($,Z,J,X=!0,Y=!1,z){await RK($,Z,{durable:Y,beforeRename:async()=>{await this.ctx.onStep?.(`before-${J}-write`,this.info),await this.locks.assertAll()}},()=>{if(X)this.progress.writes++;z?.()}),await this.ctx.onStep?.(`after-${J}-write`,this.info)}}async function FM($,Z){let J=new S2($.lockDefaults,$.lockEnv),X={writes:0};try{for(let Q of $.storeLocks)await J.acquire(Q);let Y=await d$($);if(Y.status==="error")throw L8(Y,"initialize",void 0);if(Y.status==="ready")return"already-ready";let z={};for(let[Q,K]of Object.entries(Y.config))if(!Z.includes(Q))z[Q]=K;z.version=a9,z[D6]={schemaVersion:Y2,[$0]:{}};let G={operation:"initialize",rowId:void 0};return await $1($.configPath,z,{beforeRename:async()=>{await $.onStep?.("before-config-write",G),await J.assertAll()}}),X.writes++,await $.onStep?.("after-config-write",G),"initialized"}catch(Y){throw r7(Y,"initialize",void 0,X)}finally{await J.releaseAll()}}async function H$($,Z,J,X,Y,z={}){let G=Z.held.length;try{for(let W of $.storeLocks)await Z.acquire(W);let Q=await d$($);if(Q.status!=="ready")throw L8(Q,X.operation,X.rowId,J.writes>0?"after-first-write":"before-first-write");let K=new xV($,Q,Z,J,X);if(X.rowId!==void 0&&!["add","remove","pull","publishRoster","enable","disable"].includes(X.operation))K.assertNotStaged(X.rowId);if(z.completeTorn??!0)await K.completeTorn();return await Y(K)}finally{await Z.releaseTo(G)}}function r7($,Z,J,X){let Y=Z==="pull"?"pull":X.writes>0?"after-first-write":"before-first-write",z=Y==="after-first-write"?X.committed:void 0;if(Z==="publishRoster"&&X.publicationDecided)return new Q6({operation:Z,...J!==void 0?{rowId:J}:{},phase:Y,kind:"publication-incomplete",retryable:!0,message:"The publication may already be decided. Replay the same plan or check publication(operationId).",cause:$});if(Z==="publishRoster"&&$ instanceof J7)return new Q6({operation:Z,...J!==void 0?{rowId:J}:{},phase:Y,kind:"publication-sync",retryable:!0,message:"Publication sync failed before the decision; nothing was written. Retry the same plan.",cause:$});if($ instanceof Q6){if($.phase===Y&&$.rowId===J&&$.operation===Z&&$.committed===z)return $;return new Q6({operation:Z,...J!==void 0?{rowId:J}:{},phase:$.kind==="after-persist-hook"?$.phase:Y,retryable:$.retryable,kind:$.kind,...$.committed??z?{committed:$.committed??z}:{},message:$.message,...$.cause!==void 0?{cause:$.cause}:{}})}let G={operation:Z,...J!==void 0?{rowId:J}:{},phase:Y,...z?{committed:z}:{},cause:$};if($ instanceof v1)return new Q6({...G,retryable:!0,kind:"lock-ownership",message:Y==="after-first-write"?`${Z} lost a lease after its first write; the intermediate stays on disk`:`${Z} lost a lease before writing; nothing was written`});if($ instanceof d8)return new Q6({...G,retryable:!0,kind:"lock-contention",message:$.message});return new Q6({...G,retryable:!1,kind:"unexpected",message:$ instanceof Error?$.message:String($)})}async function w$($,Z,J,X,Y){let z=new S2($.lockDefaults,$.lockEnv),G={writes:0};try{return await Y(z,G)}catch(Q){let K=r7(Q,Z,J,G);if(K.kind!=="after-persist-hook")await XM(Z,X,J,K,$.logger);throw K}finally{await z.releaseAll()}}function U0($,Z){return{...$.rowLockOptions,name:`row-${encodeURIComponent(f6(Z))}`,path:$.ctx.statePath}}async function G1($,Z,J){let X=await d$($.ctx);if(X.status!=="ready")throw L8(X,Z,J);let Y=X.rows.find((W)=>W.id===J),z=E2(X.config,J),G=X.state.accounts,Q=u(G)&&Object.hasOwn(G,J)?G[J]:void 0,K=u(Q)?Q[N6]:void 0;if(Y&&!["enable","disable"].includes(Z)&&z&&Object.hasOwn(z,"staged"))_7(Z,J,z.staged);if(!Y&&u(K)&&Object.hasOwn(K,"staged"))_7(Z,J,K.staged);if(!Y)throw y0(Z,J);return{result:X,row:Y}}function y0($,Z){return new Q6({operation:$,rowId:Z,phase:$==="pull"?"pull":"before-first-write",retryable:!1,kind:"unknown-row",message:`no row ${Z} in the pool`})}function c$($,Z){if(Z.unbound)throw l($,Z.id,"unbound-credential",`row ${Z.id}'s credential is not the one this store stamped for it (stamp ${Z.stamp}); replace it with fresh material`)}function l($,Z,J,X,Y=!1){return new Q6({operation:$,rowId:Z,phase:$==="pull"?"pull":"before-first-write",retryable:Y,kind:J,message:X})}async function AV($,Z,J,X){let{ctx:Y}=$,z=new S2(Y.lockDefaults,Y.lockEnv),G={writes:0};try{if(!B$(J?.credentialEpoch))throw l("pull",Z,"invalid-input","the credential epoch the reading was issued for must be a positive safe integer");await H$(Y,z,G,{operation:"pull",rowId:Z},async(Q)=>{Q.assertNotStaged(Z);let K=Q.row(Z);if(!K)throw y0("pull",Z);if(K.invalid)throw l("pull",Z,"invalid-row",`row ${Z} is invalid`);if(!K.credential)throw l("pull",Z,"no-credential",`row ${Z} holds no credential`);c$("pull",K);let W=Q.entry(Z);if(K.torn||!W||W.credentialEpoch!==J.credentialEpoch||K.identity!==J.identity)throw new Q6({operation:"pull",rowId:Z,phase:"pull",retryable:!0,kind:"attribution",message:`quota for ${Z} was issued for a credential the row no longer holds`});let V=Y.codec.merge(W.quota,X);if(!Y.codec.validate(V))throw l("pull",Z,"invalid-quota","the quota codec rejected the merged map");Q.setEntry(Z,{...W,quota:V,needsFirstReading:!1}),await Q.commitConfig()},{completeTorn:!1})}catch(Q){throw r7(Q,"pull",Z,G)}finally{await z.releaseAll()}}function q8($,Z,J,X,Y="the provider state"){if(!$)throw l(Z,J,"invalid-input","the store was opened without a provider-state codec");let z;try{let G=JSON.stringify(X);z=G===void 0?void 0:JSON.parse(G)}catch{z=void 0}if(z===void 0)throw l(Z,J,"invalid-provider-state",`${Y} cannot be stored as JSON`);if(!$.validate(z))throw l(Z,J,"invalid-provider-state",`the provider-state codec rejected ${Y}`);return z}function EX($,Z,J,X,Y){if(X===void 0||!$?.merge)return{kind:"set",value:Y};return{kind:"set",value:q8($,Z,J,$.merge(structuredClone(X),structuredClone(Y)),"the merged provider state")}}function xM($,Z,J,X,Y){let z=$?.onReplace,G=z?z(Z.providerState===void 0?void 0:structuredClone(Z.providerState),{id:Z.id,credentialEpoch:J,...Z.identity!==void 0?{previousIdentity:Z.identity}:{},...X!==void 0?{identity:X}:{},...Y!==void 0?{incoming:structuredClone(Y)}:{}}):Y;if(G===void 0)return{kind:"clear"};if(!z)return{kind:"set",value:G};return{kind:"set",value:q8($,"replace",Z.id,G,"the provider state onReplace returned")}}function AM($,Z,J,X,Y){if(Z.kind==="set")return n7($,Z.value);if(Z.kind==="clear")return;return FX(J,X?.credential,Y,X?.identity)}async function SM($,Z,J,X,Y={}){E$("updateProviderState");let{ctx:z}=$,G="updateProviderState";return w$(z,G,Z,Y.onFailure,async(Q,K)=>{let W=z.providerState;if(!W)throw l(G,Z,"invalid-input","the store was opened without a provider-state codec");if(typeof X!=="function")throw l(G,Z,"invalid-input","a mutator is required");let V=u(J)?J.credentialEpoch:void 0;if(!B$(V))throw l(G,Z,"invalid-input","the credential epoch the provider state was read at is required");let{row:B}=await G1($,G,Z);await Q.acquire(U0($,B));for(let H of Y.extraLocks??[])await Q.acquire(H);return H$(z,Q,K,{operation:G,rowId:Z},async(H)=>{let q=H.row(Z);if(!q)throw y0(G,Z);if(f6(q)!==f6(B))throw l(G,Z,"row-key-changed",`row ${Z}'s wire identity changed while its lock was being taken`,!0);if(q.invalid)throw l(G,Z,"invalid-row",`row ${Z} failed validation`);if(!q.credential)throw l(G,Z,"no-credential",`row ${Z} holds no credential`);if(c$(G,q),(q.credentialEpoch??1)!==V||q.identity!==J.identity)throw l(G,Z,"attribution",`the provider state for ${Z} was read for a credential or account the row no longer holds`,!0);let O=await SV(H,W,G,q,X);if(O.kind!=="changed")return{id:Z,outcome:"unchanged",...O.kind==="unchanged"&&O.value!==void 0?{providerState:O.value}:{}};return H.setStateAccount(Z,O.account),await H.commitState(),O.value===void 0?{id:Z,outcome:"cleared"}:{id:Z,outcome:"updated",providerState:O.value}})})}var IM=Symbol.for("@cortexkit/common-auth/store/decline-transition");async function SV($,Z,J,X,Y,z=!1){let{id:G,credential:Q}=X;if(!Q)throw l(J,G,"no-credential",`row ${G} holds no credential`);let K=X.credentialEpoch??1,W=$.stateAccount(G),V=W?.[N6],B=u$(V);if(!u(V)||!B?.binding||B.digest!==N8(Q)||B.credentialEpoch!==K||B.binding.identity!==X.identity)throw l(J,G,"unbound-credential",`row ${G}'s credential carries no stamp of this store to bind a provider state to (stamp ${X.stamp}); rotate or replace it first`);let H=X.providerState===void 0?void 0:structuredClone(X.providerState),q=await Y1(J,()=>Y(H,X));if(z&&q===IM)return{kind:"declined"};let N=q===void 0?void 0:q8(Z,J,G,q,"the provider state the mutator returned"),O=W!==void 0&&Object.hasOwn(W,F$);if(N===void 0?!O:X.providerState!==void 0&&JSON.stringify(X.providerState)===JSON.stringify(N))return{kind:"unchanged",...N!==void 0?{value:N}:{}};let U={...W};if(N===void 0){delete U[F$];let D={...V};delete D.providerState,U[N6]=D}else{U[F$]=N;let D=n7(Z,N);if(B.providerState!==D)U[N6]={...V,providerState:D}}return{kind:"changed",...N!==void 0?{value:N}:{},account:U}}async function wX($,Z,J){if(!J)return;let X=$.rows().map((z)=>{let{id:G,type:Q,label:K,enabled:W,disabledReason:V,identity:B,credentialEpoch:H,stamp:q,staged:N,torn:O,invalid:U}=z;return{id:G,type:Q,label:K,enabled:W,disabledReason:V,identity:B,credentialEpoch:H,stamp:q,staged:N,torn:O,invalid:U}}),Y=await Y1($.info.operation,()=>J({id:Z,row:X.find((z)=>z.id===Z),rows:X,config:structuredClone($.snapshot.config)}));if(Y!==void 0)throw l($.info.operation,Z,"row-protected",Y)}var EM=["access","refresh","expires","lastRefreshedAt","apiKey"];function wM($){return{baseURL:String($.baseURL).trim(),authHeader:$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer"}}function kM($,Z,J){if(J.type!=="api")return J;let X=$.rosterRow(Z);if(!u(X)){if(J.baseURL===void 0)throw l($.info.operation,Z,"invalid-input","api credential needs a valid baseURL");return{...J,baseURL:J.baseURL}}let Y=$.row(Z)?.credential,z=Y?.type==="api"?{baseURL:Y.baseURL.trim(),authHeader:Y.authHeader??"authorization-bearer"}:wM(X),G=J.baseURL?.trim()??z.baseURL,Q=J.authHeader??z.authHeader;if(G!==z.baseURL||Q!==z.authHeader)throw l($.info.operation,Z,"endpoint-mismatch",`row ${Z} sends its key to another endpoint or header; a key for another endpoint is a replacement`);return{...J,baseURL:G,authHeader:Q}}function IV($,Z,J,X){let Y=$.rosterRow(Z),z=$.row(Z),G=X??(z?z.identity:u(Y)&&typeof Y.accountId==="string"&&Y.accountId?Y.accountId:void 0);return{...G!==void 0?{identity:G}:{},...J.type==="api"?{baseURL:J.baseURL,authHeader:J.authHeader??"authorization-bearer"}:{}}}function mZ($,Z,J,X,Y={}){let z=kM(Z,J,X),G=Z.stateAccount(J),Q=Y.providerState??{kind:"keep"},K=Z.row(J)?.credentialEpoch??Z.entry(J)?.credentialEpoch,W=typeof K==="number"?K:1,V=AM($.ctx.providerState,Q,G,G&&Object.hasOwn(G,F$)?Z.row(J):void 0,W),B=typeof G?.lastRefreshedAt==="number"?G.lastRefreshedAt:void 0,H=z.type==="oauth"?Y.stamp??AX(B,$.ctx.now()):void 0,q={...G??{}};for(let U of EM)delete q[U];if(Y.clearErrors)delete q.lastRefreshError,delete q.lastQuotaRefreshError,delete q.quota;if(Q.kind==="clear")delete q[F$];else if(Q.kind==="set")q[F$]=Q.value;let N=MM(z,H),O={...q,..._M(z,H),[N6]:{...Y.staged?{staged:Y.staged}:{},...Y.transition!==void 0?{[SX]:Y.transition}:{},...LV(N,W,Y.binding??IV(Z,J,N,Y.identity),{replace:Y.binding!==void 0,...V!==void 0?{providerState:V}:{}})}};return{stored:N,account:O}}async function hZ($,Z,J){return $.setStateAccount(Z,J.account),await $.commitState(J.stored),J.stored}async function kX($,Z,J,X,Y={}){return hZ(Z,J,mZ($,Z,J,X,Y))}async function bM($,Z,J){if(!Z.credential||Z.stamp!=="bound")return;let X=$.stateAccount(Z.id),Y=FX(X,Z.credential,Z.credentialEpoch??1,Z.identity);$.setStateAccount(Z.id,{...X??{},[N6]:LV(Z.credential,Z.credentialEpoch??1,IV($,Z.id,Z.credential,J),Y!==void 0?{providerState:Y}:{})}),await $.commitState()}function bX($,Z,J){let X=$==="add"?M7(Z):void 0;if(X)throw l($,Z,"invalid-input",X);let Y=jM(J,{baseURLOptional:$==="rotate"});if(Y)throw l($,Z,"invalid-input",Y)}function t7($,Z,J,X){if(!J)throw y0($,Z);if(J.invalid)throw l($,Z,"invalid-row",`row ${Z} failed validation`);if(X&&X.type!==J.type)throw l($,Z,"type-mismatch",`row ${Z} holds a ${J.type} credential`);return J}function w2($,Z,J){if(J!==void 0&&!B$(u(J)?J.credentialEpoch:void 0))throw l($,Z,"invalid-input","the attribution must name a credential epoch that is a positive safe integer")}function e7($,Z,J,X){if(!J)throw y0($,Z);if(J.invalid)throw l($,Z,"invalid-row",`row ${Z} failed validation`);if((J.credentialEpoch??1)!==X.credentialEpoch||J.identity!==X.identity)throw l($,Z,"attribution",`the ${$} of ${Z} was issued for a credential or account the row no longer holds`,!0)}function j7($,Z){return l($,Z,"identity-mismatch",`row ${Z} is recorded for another account; a credential of a different account is a replacement`)}function k2($,Z){return l($,Z,"row-key-changed",`row ${Z}'s wire identity changed while its lock was being taken`,!0)}function fM($,Z,J,X){let{id:Y,credential:z,identity:G}=J;if(!$.ctx.requireCredentialStamps||Z.rosterRow(Y)||!m8(Z.state,Y))return;let Q=()=>{throw l("add",Y,"unbound-credential",`orphan ${Y} cannot be bound to this add's material; remove it explicitly before adding different material`)},K=Z.stateAccount(Y),W=u$(K?.[N6]);if(!W?.binding||W.dispatch===void 0||W.replace)return Q();if(z.type==="api"&&(W.binding.baseURL===void 0||W.binding.authHeader===void 0))return Q();let V=z.type==="api"?{...z,baseURL:W.binding.baseURL,authHeader:W.binding.authHeader}:z,[B]=z1({accounts:[G2({id:Y,credential:V,identity:W.binding.identity,addedAt:0})],[D6]:{rows:{[Y]:{credentialEpoch:xX(Z.config,Y)}}}},Z.state,$.ctx.codec,$.ctx.providerState);if(!B?.credential||B.invalid||B.stamp!=="bound")return Q();if(G!==void 0&&G!==B.identity)return Q();if(N8(z)!==W.digest)return Q();if(z.type==="api"){if(z.baseURL.trim()!==W.binding.baseURL)return Q();if((z.authHeader??"authorization-bearer")!==W.binding.authHeader)return Q()}else if(G8(z)!==W.dispatch)return Q();if(W.providerState!==void 0&&B.providerState===void 0)return Q();if(X!==void 0&&n7($.ctx.providerState,X)!==W.providerState)return Q();return B}function vM($,Z,J,X){let{id:Y,credential:z,identity:G,label:Q}=J,K=Z.rosterRow(Y),W=()=>{throw l("add",Y,K?"id-exists":"unbound-credential",`row ${Y} does not match this staged add`)},V=Z.stateAccount(Y),B=u$(V?.[N6]),H=B?.staged;if(!B?.binding||!H||B.replace||B.dispatch===void 0)return W();if(K&&(K.type!==z.type||K.label!==Q||K.accountId!==G))return W();if(H.reservation!==J.stage?.reservation||H.label!==Q||H.disabledReason!==J.disabled?.reason||B.binding.identity!==G)return W();let q=X===void 0?void 0:z2(X),N=V?.[F$],O=N===void 0?void 0:z2(N);if(H.providerState!==q||H.providerState!==O)return W();if(N8(z)!==B.digest||G8(z)!==B.dispatch)return W();let U=K?Z.config:{accounts:[{...G2({id:Y,credential:z.type==="api"?{...z,baseURL:B.binding.baseURL??"",authHeader:B.binding.authHeader}:z,identity:B.binding.identity,label:H.label,addedAt:0}),enabled:!1}],[D6]:{rows:{[Y]:{credentialEpoch:B.credentialEpoch,disabledReason:H.disabledReason,staged:{reservation:H.reservation}}}}},D=z1(U,Z.state,$.ctx.codec,$.ctx.providerState).find((_)=>_.id===Y);if(!D?.credential||D.invalid||D.stamp!=="bound"||D.type!==z.type||D.enabled||D.label!==H.label||D.identity!==B.binding.identity||D.disabledReason!==H.disabledReason||D.staged?.reservation!==H.reservation)return W();if(K)return{id:Y,outcome:"exists",credential:D.credential,credentialEpoch:B.credentialEpoch};if(xX(Z.config,Y)!==B.credentialEpoch)return W();return Z.roster().push({...G2({id:Y,credential:z,identity:G,label:Q,addedAt:$.ctx.now()}),enabled:!1}),Z.setEntry(Y,{credentialEpoch:B.credentialEpoch,needsFirstReading:z.type==="oauth",disabledReason:H.disabledReason,staged:{reservation:H.reservation}}),Z.commitConfig().then(()=>({id:Y,outcome:"completed",credential:D.credential,credentialEpoch:B.credentialEpoch}))}async function yM($,Z,J={}){E$("add");let{ctx:X}=$,{id:Y,credential:z,identity:G,label:Q}=Z,K=Z.stage!==void 0||Z.disabled!==void 0,W=await w$(X,"add",Y,J.onFailure,async(V,B)=>{bX("add",Y,z);let H=J.onExisting??"rotate";if(Z.stage!==void 0&&H==="rotate")throw l("add",Y,"invalid-input","a staged add needs onExisting: 'refuse' or 'stage-duplicate'");if(!["rotate","refuse","stage-duplicate"].includes(H)||Z.stage!==void 0&&(Q!==void 0&&typeof Q!=="string"||G!==void 0&&(typeof G!=="string"||!G))||Z.disabled!==void 0&&(!u(Z.disabled)||typeof Z.disabled.reason!=="string")||Z.stage!==void 0&&(!u(Z.stage)||typeof Z.stage.reservation!=="string"||!Z.stage.reservation||!Z.disabled)||H==="stage-duplicate"&&(!Z.disabled||!Z.stage))throw l("add",Y,"invalid-input","staging requires a reservation and a disabled reason");let q=Z.providerState===void 0?void 0:q8(X.providerState,"add",Y,Z.providerState);if(await V.acquire(U0($,{id:Y,identity:G})),z.type==="oauth")await V.acquire(J.providerLock??$.providerLock);for(let N of J.extraLocks??[])await V.acquire(N);return H$(X,V,B,{operation:"add",rowId:Y},async(N)=>{await wX(N,Y,J.protect);let O=u(N.state.accounts)?N.state.accounts:{},U=Object.entries(O).find(([p,R])=>{if(p===Y||N.rosterRow(p)||!u(R))return!1;let j=R[N6];if(!u(j)||!Object.hasOwn(j,"staged"))return!1;return z.type==="oauth"?R.refresh===z.refresh:typeof R.apiKey==="string"&&R.apiKey.trim()===z.apiKey.trim()});if(U)throw l("add",U[0],"row-staged",`orphan ${U[0]} reserves this secret until its staged add is replayed or removed`);if(X.removedIds.has(Y))throw l("add",Y,"id-removed",`id ${Y} was removed from the roster in this process and is not reused`);if(Z.stage&&H!=="rotate"&&(N.rosterRow(Y)||m8(N.state,Y)))return vM($,N,Z,q);if(H==="rotate"){N.assertNotStaged(Y);let p=N.rows().find((R)=>R.fingerprint===A6(z));if(p)N.assertNotStaged(p.id)}if(H==="refuse"){let p=N.rows().find((E)=>E.fingerprint===A6(z)||E.id===Y&&E.credential),R=u(N.state.accounts)?N.state.accounts:{},j=Object.entries(R).find(([,E])=>{if(!u(E))return!1;if(z.type==="oauth")return E.refresh===z.refresh;return typeof E.apiKey==="string"&&E.apiKey.trim()===z.apiKey.trim()})?.[0],A=p?.id??j??Y;if(p||j!==void 0||m8(N.state,Y))throw l("add",A,"credential-exists",`row ${A} already holds this secret or id`)}if(H==="stage-duplicate"&&(N.rosterRow(Y)||m8(N.state,Y)))throw l("add",Y,"id-exists",`row ${Y} already exists`);let D=fM($,N,Z,q),_=N.rows(),T=A6(z),M=H==="rotate"&&!D&&_.find((p)=>p.invalid===void 0&&p.fingerprint===T);if(M){if(N.assertNotStaged(M.id),c$("add",M),G!==void 0&&M.identity!==void 0&&G!==M.identity)throw j7("add",M.id);let p=mZ($,N,M.id,z,{...q!==void 0?{providerState:EX(X.providerState,"add",M.id,M.providerState,q)}:{}});await N.completeTorn(),N.assertNotStaged(M.id);let R=await hZ(N,M.id,p);return{id:M.id,outcome:"rotated",credential:R,credentialEpoch:M.credentialEpoch??1}}let L=_.find((p)=>p.id===Y);if(L){if(L.invalid)throw l("add",Y,"invalid-row",`row ${Y} is invalid`);if(L.credential)throw l("add",Y,"id-exists",`row ${Y} already holds a credential`);if(c$("add",L),L.type!==z.type)throw l("add",Y,"type-mismatch",`row ${Y} is a ${L.type} row`);if(G!==void 0&&L.identity!==void 0&&G!==L.identity)throw j7("add",Y);if(!L.hasEntry)N.setEntry(Y,{credentialEpoch:1,needsFirstReading:z.type==="oauth"});let p=mZ($,N,Y,z,{clearErrors:!0,...q!==void 0?{providerState:{kind:"set",value:q}}:{}});await N.completeTorn();let R=await hZ(N,Y,p);if(!L.hasEntry)await N.commitConfig();return{id:Y,outcome:"completed",credential:R,credentialEpoch:L.credentialEpoch??1}}let C=xX(N.config,Y);if(!B$(C))throw l("add",Y,"id-removed",`id ${Y} has held every credential epoch and is not reused; add the credential under another id`);let w=D?.identity??G;N.roster().push(G2({id:Y,credential:z,...w!==void 0?{identity:w}:{},...Q!==void 0?{label:Q}:{},addedAt:X.now()})),N.setEntry(Y,{credentialEpoch:C,needsFirstReading:z.type==="oauth",...Z.stage?{staged:{reservation:Z.stage.reservation}}:{}});let v="added";if(Z.disabled)a8(N,Y,Z.disabled.reason),v="added-disabled";if(!Z.disabled&&w!==void 0&&z.type==="oauth"){if(_.find((R)=>R.invalid===void 0&&R.type==="oauth"&&R.enabled&&R.identity===w))a8(N,Y,VV),v="added-disabled"}if(D?.credential)return await N.commitConfig(),{id:Y,outcome:v,credential:D.credential,credentialEpoch:D.credentialEpoch??C};N.dropStateAccount(Y);let h=mZ($,N,Y,z,{...Z.stage&&Z.disabled?{staged:{reservation:Z.stage.reservation,disabledReason:Z.disabled.reason,...Q!==void 0?{label:Q}:{},...q!==void 0?{providerState:z2(q)}:{}}}:{},...q!==void 0?{providerState:{kind:"set",value:q}}:{}});if(H==="rotate")await N.completeTorn();let a=await hZ(N,Y,h);return await N.commitConfig(),{id:Y,outcome:v,credential:a,credentialEpoch:C}},{completeTorn:!1})});if(!K&&z.type==="oauth"&&(W.outcome==="added"||W.outcome==="completed"))$.firePull(W.id,"add");return W}async function gM($,Z,J,X={},Y={}){E$("replace");let{ctx:z}=$,G=await w$(z,"replace",Z,Y.onFailure,async(Q,K)=>{bX("replace",Z,J),w2("replace",Z,Y.attribution);let W=X.providerState===void 0?void 0:q8(z.providerState,"replace",Z,X.providerState),{row:V}=await G1($,"replace",Z);if(await Q.acquire(U0($,V)),J.type==="oauth")await Q.acquire(Y.providerLock??$.providerLock);for(let B of Y.extraLocks??[])await Q.acquire(B);return H$(z,Q,K,{operation:"replace",rowId:Z},async(B)=>{if(Y.attribution!==void 0)e7("replace",Z,B.row(Z),Y.attribution),await B.completeTorn();let H=t7("replace",Z,B.row(Z),J);if(f6(H)!==f6(V))throw k2("replace",Z);let q=B.entry(Z)?.credentialEpoch,N=(typeof q==="number"?q:1)+1;if(!B$(N))throw l("replace",Z,"invalid-row",`row ${Z}'s credential epoch cannot advance past ${Number.MAX_SAFE_INTEGER}; remove the row and add the new credential as a new row`);let O=xM(z.providerState,H,N,X.identity,W),U={...X.identity!==void 0?{identity:X.identity}:{},...J.type==="api"?{baseURL:J.baseURL.trim(),authHeader:J.authHeader??"authorization-bearer"}:{}};if(PV(B,Z,N,U),X.identity!==void 0)s7(B,X.identity);let D=await kX($,B,Z,J,{clearErrors:!0,binding:U,providerState:O});return await B.commitConfig(),{id:Z,credential:D,credentialEpoch:N}},{completeTorn:Y.attribution===void 0})});if(J.type==="oauth")$.firePull(Z,"replace");return G}async function mM($,Z,J,X={},Y={}){E$("rotate");let{ctx:z}=$;return w$(z,"rotate",Z,Y.onFailure,async(G,Q)=>{bX("rotate",Z,J),w2("rotate",Z,Y.attribution);let K=X.providerState===void 0?void 0:q8(z.providerState,"rotate",Z,X.providerState),{row:W}=await G1($,"rotate",Z);if(await G.acquire(U0($,W)),X.identity!==void 0&&J.type==="oauth")await G.acquire(Y.providerLock??$.providerLock);for(let V of Y.extraLocks??[])await G.acquire(V);return H$(z,G,Q,{operation:"rotate",rowId:Z},async(V)=>{if(Y.attribution!==void 0)e7("rotate",Z,V.row(Z),Y.attribution),await V.completeTorn();let B=t7("rotate",Z,V.row(Z),J);if(f6(B)!==f6(W))throw k2("rotate",Z);if(c$("rotate",B),X.identity!==void 0&&B.identity!==void 0&&X.identity!==B.identity)throw j7("rotate",Z);let H=X.identity!==void 0&&B.identity===void 0?X.identity:void 0,q=await kX($,V,Z,J,{identity:H,...K!==void 0?{providerState:EX(z.providerState,"rotate",Z,B.providerState,K)}:{}}),N=!1;if(!B.hasEntry)V.setEntry(Z,{credentialEpoch:1,needsFirstReading:B.type==="oauth"}),N=!0;if(X.identity!==void 0&&B.identity!==X.identity)a7(V,Z,X.identity),N=!0;if(N)await V.commitConfig();return{id:Z,credential:q}},{completeTorn:Y.attribution===void 0})})}async function EV($,Z,J,X,Y){E$(Z);let{ctx:z}=$,G=z.providerState,Q=Y.attribution,K=Y.providerState;return w$(z,Z,J,Y.onFailure,async(W,V)=>{if(w2(Z,J,Q),K!==void 0){if(typeof K!=="function")throw l(Z,J,"invalid-input","the provider-state mutator must be a function");if(Q===void 0)throw l(Z,J,"invalid-input","a provider-state change needs the attribution of the credential it is for");if(!G)throw l(Z,J,"invalid-input","the store was opened without a provider-state codec")}let{row:B}=await G1($,Z,J);await W.acquire(U0($,B));for(let H of Y.extraLocks??[])await W.acquire(H);return H$(z,W,V,{operation:Z,rowId:J},async(H)=>{await wX(H,J,Y.protect),H.assertNotStaged(J);let q=H.row(J),N=X.enabled?t7("enable",J,q):q;if(!N||!H.rosterRow(J))throw y0(Z,J);if(f6(N)!==f6(B))throw k2(Z,J);if(Q!==void 0)e7(Z,J,N,Q);if(X.enabled&&N.disabledReason?.startsWith(i7))throw l("enable",J,"identity-contradicted",`row ${J} needs an identity-validated credential replacement before it can be enabled`);let O=!X.enabled||!N.enabled||N.disabledReason!==void 0;if(X.enabled&&O&&N.type==="oauth"){let M=N.identity===void 0?void 0:H.rows().find((L)=>L.id!==J&&L.invalid===void 0&&L.type==="oauth"&&L.enabled&&L.identity===N.identity);if(M)throw l("enable",J,"duplicate-identity",`row ${M.id} is enabled with the same identity as row ${J}`)}if(K===void 0||G===void 0){if(await H.completeTorn(),!O)return{id:J};if(X.enabled)s9(H,J);else a8(H,J,X.reason);return await H.commitConfig(),{id:J}}if(!N.credential)throw l(Z,J,"no-credential",`row ${J} holds no credential`);c$(Z,N);let U=await SV(H,G,Z,N,K,!0);if(U.kind==="declined")return{id:J,declined:!0};await H.completeTorn();let D={id:J,providerStateOutcome:U.kind==="unchanged"?"unchanged":U.value===void 0?"cleared":"updated",...U.value!==void 0?{providerState:U.value}:{}};if(U.kind==="unchanged"){if(O){if(X.enabled)s9(H,J);else a8(H,J,X.reason);await H.commitConfig()}return D}if(!O)return H.setStateAccount(J,U.account),await H.commitState(),D;let _=X.enabled?{mark:AG(),enabled:!0}:{mark:AG(),enabled:!1,reason:X.reason},T=U.account[N6];return H.setStateAccount(J,{...U.account,[N6]:{...T,[SX]:_}}),await H.commitState(),IX(H,J,_),await H.commitConfig(),D},{completeTorn:!1})})}function hM($,Z,J,X={}){return EV($,"disable",Z,{enabled:!1,reason:J},X)}function pM($,Z,J={}){return EV($,"enable",Z,{enabled:!0},J)}async function lM($,Z,J={}){E$("remove");let{ctx:X}=$;return w$(X,"remove",Z,J.onFailure,async(Y,z)=>{if(typeof Z!=="string"||Z.length===0)throw l("remove",Z,"invalid-input","id must be non-empty");let G=J.attribution;if(w2("remove",Z,G),J.staged!==void 0&&(!u(J.staged)||typeof J.staged.reservation!=="string"||!J.staged.reservation))throw l("remove",Z,"invalid-input","a staged removal needs a reservation");let Q=await d$(X);if(Q.status!=="ready")throw L8(Q,"remove",Z);let K=Q.rows.find((V)=>V.id===Z);if(!K&&!m8(Q.state,Z))throw y0("remove",Z);let W=f6(K??{id:Z});await Y.acquire(U0($,K??{id:Z}));for(let V of J.extraLocks??[])await Y.acquire(V);return H$(X,Y,z,{operation:"remove",rowId:Z},async(V)=>{let B=V.reservation(Z);if(B!==void 0){if(!u(B)||!J.staged||B.reservation!==J.staged.reservation)throw l("remove",Z,"row-staged",`row ${Z} is reserved for roster publication`)}else if(J.staged)throw l("remove",Z,"attribution",`row ${Z} is no longer reserved`);let H=V.row(Z),q=m8(V.state,Z);if(!H&&!q)throw y0("remove",Z);if(f6(H??{id:Z})!==W)throw k2("remove",Z);if(G!==void 0)if(H)n9(Z,H,G);else uM($,V,Z,G);let N=J.protect;if(N){let O={row:H,config:V.snapshot.config,state:V.snapshot.state},U=await Y1("remove",()=>N(Z,O));if(U!==void 0)throw l("remove",Z,"row-protected",U)}if(H){if(G===void 0)await V.completeTorn();V.dropRosterRows(Z),await V.commitConfig()}if(q)V.dropStateAccount(Z),await V.commitState();return{id:Z,outcome:H?"removed":"completed"}},{completeTorn:!1})})}function n9($,Z,J,X="remove"){if(e7(X,$,Z,J),Z.torn)throw l(X,$,"attribution",`row ${$} is between the writes of another operation; retry once it completes`,!0);if(Z.stamp!=="bound")throw l(X,$,"unbound-credential",`row ${$}'s credential is not bound to its stamp, so the removal cannot be attributed to it`)}function uM($,Z,J,X){let Y=()=>l("remove",J,"unbound-credential",`orphan ${J} has no credential stamp this store can bind, so the removal cannot be attributed to it`),z=Z.stateAccount(J),G=u$(z?.[N6]);if(!z||!G?.binding||G.dispatch===void 0||G.replace)throw Y();let Q;if(typeof z.apiKey==="string"){if(G.binding.baseURL===void 0||G.binding.authHeader===void 0)throw Y();Q={type:"api",apiKey:z.apiKey,baseURL:G.binding.baseURL,authHeader:G.binding.authHeader}}else if(typeof z.refresh==="string")Q={type:"oauth",refresh:z.refresh};else throw Y();let[K]=z1({accounts:[G2({id:J,credential:Q,identity:G.binding.identity,addedAt:0})],[D6]:{rows:{[J]:{credentialEpoch:G.credentialEpoch}}}},Z.state,$.ctx.codec,$.ctx.providerState);if(!K?.credential||K.invalid||K.stamp!=="bound")throw Y();if(G.credentialEpoch!==X.credentialEpoch||G.binding.identity!==X.identity)throw l("remove",J,"attribution",`orphan ${J} was written for a credential or account other than the one this removal was decided for`,!0)}function m8($,Z){let J=$.accounts;return u(J)&&Object.hasOwn(J,Z)}function o9($){return u($)&&typeof $.id==="string"?$.id:void 0}function dM($,Z){if(!Array.isArray(Z))return"ids must be an array of roster ids";let J=new Set;for(let z of $){let G=o9(z);if(G!==void 0)J.add(G)}let X=new Set;for(let z of Z){if(typeof z!=="string")return"ids must be an array of roster ids";if(X.has(z))return`id ${z} appears more than once`;if(!J.has(z))return`id ${z} is not in the roster`;X.add(z)}let Y=[...J].filter((z)=>!X.has(z));if(Y.length>0)return`the order leaves out roster id(s) ${Y.join(", ")}`;return}function cM($,Z){let J=new Map;for(let z of $){let G=o9(z);if(G===void 0)continue;let Q=J.get(G);if(Q)Q.push(z);else J.set(G,[z])}let X=Z.flatMap((z)=>J.get(z)??[]),Y=0;return $.map((z)=>o9(z)===void 0?z:X[Y++])}async function iM($,Z,J={}){E$("reorder");let{ctx:X}=$,Y=J.onFailure;return w$(X,"reorder",void 0,Y&&((z,G)=>Y(G)),async(z,G)=>{for(let Q of J.extraLocks??[])await z.acquire(Q);return H$(X,z,G,{operation:"reorder",rowId:void 0},async(Q)=>{let K=Q.roster(),W=dM(K,Z);if(W)throw new Q6({operation:"reorder",phase:"before-first-write",retryable:!1,kind:"invalid-order",message:W});let V=[...Z],B=cM(K,V);if(B.every((H,q)=>H===K[q]))return{ids:V,outcome:"unchanged"};return Q.config.accounts=B,await Q.commitConfig(),{ids:V,outcome:"reordered"}},{completeTorn:!1})})}async function sM($,Z,J,X,Y={}){return E$("recordIdentity"),w$($.ctx,"recordIdentity",Z,Y.onFailure,async(z,G)=>{if(typeof J!=="string"||J.length===0)throw l("recordIdentity",Z,"invalid-input","identity must be non-empty");let Q=u(X)?X.credentialEpoch:void 0;if(!B$(Q))throw l("recordIdentity",Z,"invalid-input","the credential epoch the identity lookup was issued for is required");let{row:K}=await G1($,"recordIdentity",Z);await z.acquire(U0($,K)),await z.acquire(Y.providerLock??$.providerLock);for(let W of Y.extraLocks??[])await z.acquire(W);return H$($.ctx,z,G,{operation:"recordIdentity",rowId:Z},async(W)=>{let V=t7("recordIdentity",Z,W.row(Z));if(f6(V)!==f6(K))throw k2("recordIdentity",Z);if(c$("recordIdentity",V),(V.credentialEpoch??1)!==Q)throw l("recordIdentity",Z,"attribution",`the identity for ${Z} was looked up for a credential the row no longer holds`,!0);if(V.identity!==void 0&&V.identity!==J)throw j7("recordIdentity",Z);if(V.identity===void 0)await bM(W,V,J);let B=a7(W,Z,J);return await W.commitConfig(),{id:Z,disabled:B}})})}function wV($){let Z=$[D6];return u(Z)&&u(Z.publications)?Z.publications:{}}function kV($,Z){let J=wV($);if(!Object.hasOwn(J,Z))return;let X=J[Z];if(!u(X)||X.operationId!==Z||typeof X.planDigest!=="string"||!/^[a-f0-9]{64}$/.test(X.planDigest)||!["committed","cleaned"].includes(String(X.phase))||!Array.isArray(X.removed)||!Array.isArray(X.finalized)||X.removed.some((Y)=>!u(Y)||typeof Y.id!=="string"||!B$(Y.credentialEpoch))||X.finalized.some((Y)=>!u(Y)||typeof Y.id!=="string"||!B$(Y.credentialEpoch)||typeof Y.reservation!=="string"||!Y.reservation||typeof Y.enabled!=="boolean"))throw l("publishRoster",Z,"invalid-input","the stored publication receipt is malformed");return structuredClone(X)}async function aM($,Z){let J=await d$($.ctx);if(J.status!=="ready")throw L8(J,"publishRoster",Z);return kV(J.config,Z)}function nM($,Z){let J=()=>{throw l("publishRoster",Z?.operationId??"","invalid-input","the publication plan is invalid")};if(!u(Z)||typeof Z.operationId!=="string"||!Z.operationId||!Array.isArray(Z.remove)||!Array.isArray(Z.finalize)||!Array.isArray(Z.order))J();let X=new Set;for(let Y of[...Z.remove,...Z.finalize]){if(!u(Y)||typeof Y.id!=="string"||M7(Y.id)||X.has(Y.id)||!Y.attribution)J();if(X.add(Y.id),w2("publishRoster",Y.id,Y.attribution),Y.attribution.identity!==void 0&&(typeof Y.attribution.identity!=="string"||!Y.attribution.identity))J()}for(let Y of Z.remove)if($.ctx.requireRemovedFingerprint&&!Y.fingerprint||Y.fingerprint!==void 0&&typeof Y.fingerprint!=="string")J();for(let Y of Z.finalize)if(typeof Y.reservation!=="string"||!Y.reservation||typeof Y.enabled!=="boolean"||(Y.enabled?Y.disabledReason!==void 0:typeof Y.disabledReason!=="string"))J();if(Z.order.some((Y)=>typeof Y!=="string"||M7(Y))||new Set(Z.order).size!==Z.order.length)J()}function bV($,Z){$.entries();let J=$.config[D6],X={...wV($.config)};Object.defineProperty(X,Z.operationId,{value:Z,enumerable:!0,writable:!0,configurable:!0}),J.publications=X,delete J.publicationOrder}function oM($,Z,J){let X=new Set;for(let G of o7($.config)){if(!u(G)||typeof G.id!=="string")continue;if(X.has(G.id))throw l("publishRoster",Z.operationId,"invalid-input","publication needs a roster of unique named rows");X.add(G.id)}let Y=new Set(Z.remove.map((G)=>G.id)),z=J.filter((G)=>G.invalid!=="roster"&&!Y.has(G.id));if(z.length!==Z.order.length||Z.order.some((G)=>!z.some((Q)=>Q.id===G))||z.some((G)=>!Z.order.includes(G.id)))throw l("publishRoster",Z.operationId,"invalid-input","order must name exactly the surviving roster");return z}async function SG($,Z){await $.assertAll();for(let X of Z.removed)if(u$($.stateAccount(X.id)?.[N6])?.credentialEpoch===X.credentialEpoch&&!$.rosterRow(X.id))$.dropStateAccount(X.id);for(let X of Z.finalized){let Y=$.stateAccount(X.id),z=u$(Y?.[N6]);if(Y&&z?.credentialEpoch===X.credentialEpoch&&z.staged?.reservation===X.reservation){let G={...Y[N6]};delete G.staged,$.setStateAccount(X.id,{...Y,[N6]:G})}}await $.commitState(void 0,{durable:!0});let J={...Z,phase:"cleaned"};return bV($,J),await $.commitConfig({durable:!0}),J}async function rM($,Z,J={}){return E$("publishRoster"),w$($.ctx,"publishRoster",Z?.operationId??"",J.onFailure,async(X,Y)=>{if(!u(Z)||typeof Z.operationId!=="string"||!Z.operationId)throw l("publishRoster",Z?.operationId??"","invalid-input","the publication needs an operation id");Z=structuredClone(Z);let z=z2(Z),G=[...Array.isArray(Z.remove)?Z.remove:[],...Array.isArray(Z.finalize)?Z.finalize:[]].filter((Q)=>u(Q)&&typeof Q.id==="string");for(let Q=0;;Q++){let K=await d$($.ctx);if(K.status!=="ready")throw L8(K,"publishRoster",Z.operationId);let W=new Map(G.map(({id:B})=>[B,f6(K.rows.find((H)=>H.id===B)??{id:B})]));for(let B of[...new Set(W.values())].sort())await X.acquire(U0($,{id:B}));await X.acquire(J.providerLock??$.providerLock);for(let B of J.extraLocks??[])await X.acquire(B);let V=await H$($.ctx,X,Y,{operation:"publishRoster",rowId:Z.operationId},async(B)=>{let H=B.rows();if(G.some(({id:L})=>f6(H.find((C)=>C.id===L)??{id:L})!==W.get(L)))return;let q=kV(B.config,Z.operationId);if(q){if(q.planDigest!==z)throw l("publishRoster",Z.operationId,"publication-mismatch","the operation id belongs to a different publication plan");if(q.phase==="cleaned")return{outcome:"already-cleaned",receipt:q};return B.markPublicationDecision(),await B.syncConfig(),{outcome:"cleaned",receipt:await SG(B,q)}}nM($,Z);let N=oM(B,Z,H),O=[];for(let L of Z.remove){B.assertNotStaged(L.id);let C=H.find((w)=>w.id===L.id);if(!C)throw l("publishRoster",L.id,"attribution","the removed row no longer exists");if(n9(L.id,C,L.attribution,"publishRoster"),!C.credential||L.fingerprint!==void 0&&A6(C.credential)!==L.fingerprint)throw l("publishRoster",L.id,"attribution","the removed secret no longer matches");O.push(C)}let U=[];for(let L of Z.finalize){let C=H.find((R)=>R.id===L.id),w=u$(B.stateAccount(L.id)?.[N6]);if(!C||C.staged?.reservation!==L.reservation||w?.staged?.reservation!==L.reservation||C.enabled)throw l("publishRoster",L.id,"row-staged","the finalized row is not disabled under this reservation");let v=B.stateAccount(L.id),h=B.rosterRow(L.id),a=v?.[F$],p=a===void 0?void 0:z2(a);if(!w?.staged||w.staged.label!==h?.label||w.staged.disabledReason!==C.disabledReason||w.staged.providerState!==p)throw l("publishRoster",L.id,"row-staged","the staged label, disabled reason or full provider state no longer matches its stamp");n9(L.id,C,L.attribution,"publishRoster"),U.push(C)}let D=N.find((L)=>L.torn);if(D)throw l("publishRoster",Z.operationId,"attribution",`Row ${D.id} has an interrupted write; complete it with a normal store operation before publishing.`,!1);let _=new Set;for(let L of N){if(!(Z.finalize.find((w)=>w.id===L.id)?.enabled??L.enabled)||L.type!=="oauth"||L.identity===void 0)continue;if(_.has(L.identity))throw l("publishRoster",L.id,"invalid-input","the final enabled roster repeats a known identity");_.add(L.identity)}for(let L of N)if(L.identity!==void 0&&L.fingerprint!==void 0&&N.some((C)=>C.id!==L.id&&C.identity!==void 0&&C.identity!==L.identity&&C.fingerprint===L.fingerprint))throw l("publishRoster",L.id,"attribution","the resulting pool gives the same secret different known identities");for(let L of U)if(L.identity!==void 0&&O.some((C)=>C.identity!==void 0&&C.identity!==L.identity&&C.fingerprint===L.fingerprint))throw l("publishRoster",L.id,"attribution","the staged secret belonged to a different known identity");await wX(B,Z.operationId,J.protect);let T={operationId:Z.operationId,planDigest:z,phase:"committed",removed:O.map((L)=>({id:L.id,credentialEpoch:L.credentialEpoch??1})),finalized:Z.finalize.map((L,C)=>({id:L.id,credentialEpoch:U[C]?.credentialEpoch??1,reservation:L.reservation,enabled:L.enabled}))};for(let L of Z.remove)B.dropRosterRows(L.id);for(let L of Z.finalize){let C=B.rosterRow(L.id);C.enabled=L.enabled;let w={...B.entry(L.id)};if(delete w.staged,L.enabled)delete w.disabledReason;else w.disabledReason=L.disabledReason;B.setEntry(L.id,w)}let M=B.roster().filter((L)=>!u(L)||typeof L.id!=="string"||H.find((C)=>C.id===L.id)?.invalid==="roster");return B.config.accounts=[...Z.order.map((L)=>B.rosterRow(L)),...M],bV(B,T),await B.syncState(),await B.commitConfig({durable:!0,publicationDecision:!0}),{outcome:"published",receipt:await SG(B,T)}},{completeTorn:!1});if(V)return V;if(await X.releaseAll(),Q>=1)throw l("publishRoster",Z.operationId,"row-key-changed","a named row changed lock key twice during publication",!0)}})}class fV{rt;hook;onFailure;firedAtLoad;logger;inflight=new Set;constructor($,Z,J,X,Y){this.rt=$,this.hook=Z,this.onFailure=J,this.firedAtLoad=X,this.logger=Y}fire($,Z){if(!this.hook)return;if(Z==="load"){if(this.firedAtLoad.has($))return;this.firedAtLoad.add($)}let J=this.run($,Z);this.inflight.add(J),J.finally(()=>this.inflight.delete(J))}async settled(){while(this.inflight.size>0)await Promise.allSettled([...this.inflight])}async run($,Z){let J=this.rt(),{ctx:X}=J,Y=new S2(X.lockDefaults,X.lockEnv),z={writes:0};try{let G=await H$(X,Y,z,{operation:"pull",rowId:$},async(K)=>{if(K.reservation($)!==void 0)return;await K.completeTorn();let W=K.row($);if(W?.unbound&&W.enabled&&W.type==="oauth"&&W.credential&&!W.invalid)c$("pull",W);if(!W?.candidate||W.type!=="oauth")return;if(!W.hasEntry)K.setEntry($,{credentialEpoch:1,needsFirstReading:!0}),await K.commitConfig();let V=K.row($);if(!V?.credential||V.credentialEpoch===void 0)return;return{id:$,credential:V.credential,credentialEpoch:V.credentialEpoch,...V.identity!==void 0?{identity:V.identity}:{},reason:Z}},{completeTorn:!1});if(await Y.releaseAll(),!G){this.firedAtLoad.delete($);return}await X.hold?.("pull-before-request",$);let Q;try{Q=await this.hook?.(G)}catch(K){throw new Q6({operation:"pull",rowId:$,phase:"pull",retryable:!0,kind:"pull",message:"the quota pull rejected",cause:K})}await AV(J,$,{credentialEpoch:G.credentialEpoch,...G.identity!==void 0?{identity:G.identity}:{}},Q)}catch(G){this.firedAtLoad.delete($);let Q=r7(G,"pull",$,z);if(this.onFailure)try{await this.onFailure($,Q)}catch(K){this.logger?.warn("pull failure hook threw",{rowId:$,error:K instanceof Error?K.message:String(K)})}else this.logger?.warn("quota pull failed",{rowId:$,kind:Q.kind})}finally{await Y.releaseAll()}}}function n4($,Z){if(_7("refresh",$,Z?.staged),!Z)throw l("refresh",$,"unknown-row",`no row ${$} in the pool`);if(Z.invalid)throw l("refresh",$,"invalid-row",`row ${$} is invalid`);if(Z.type!=="oauth"||Z.credential?.type!=="oauth")throw l("refresh",$,"no-credential",`row ${$} holds no OAuth credential`);if(!Z.enabled)throw l("refresh",$,"row-disabled",`row ${$} is disabled`);return Z}function IG($){return l("refresh",$,"refresh-stamp-ahead",`row ${$}'s stored refresh stamp is ahead of the clock; a rotation now could not be stamped newer within the trust bound`,!0)}async function eM($,Z,J,X={}){E$("refresh");let{ctx:Y}=$;return w$(Y,"refresh",Z,X.onFailure,async(z,G)=>{let{row:Q}=await G1($,"refresh",Z);n4(Z,Q);let K=await X.refuse?.(Q);if(K!==void 0)return{status:"refused",rowId:Z,reason:K};let W=f6(Q),V;for(let N=0;;N++){await z.acquire(U0($,{id:Z,identity:W===Z?void 0:W})),await z.acquire(X.providerLock??$.providerLock);for(let D of X.extraLocks??[])await z.acquire(D);let U=await H$(Y,z,{writes:0},{operation:"refresh",rowId:Z},async(D)=>{let _=n4(Z,D.row(Z));if(c$("refresh",_),!_.hasEntry)D.setEntry(Z,{credentialEpoch:1,needsFirstReading:!0}),await D.commitConfig(),_=n4(Z,D.row(Z));if(f6(_)!==W)return{keyNow:f6(_)};let T=await X.refuse?.(_);if(T!==void 0)return{refused:T};return{row:_,credential:_.credential,credentialEpoch:_.credentialEpoch,identity:_.identity}});if("refused"in U)return{status:"refused",rowId:Z,reason:U.refused};if("keyNow"in U){if(await z.releaseAll(),N>=1)throw l("refresh",Z,"row-key-changed",`row ${Z}'s wire identity changed twice while its lock was held`,!0);W=U.keyNow;continue}V=U;break}if(FG(V.credential.lastRefreshedAt,Y.now()))throw IG(Z);await Y.hold?.("refresh-before-provider",Z),await z.assertAll();let B;try{B=await J(V.credential,V.row)}catch(N){throw new Q6({operation:"refresh",rowId:Z,phase:"before-first-write",retryable:!0,kind:"provider",message:"the provider refresh failed",cause:N})}if(typeof B?.refresh!=="string"||!B.refresh.trim())throw l("refresh",Z,"provider","the provider returned no refresh token",!0);let H=B.providerState===void 0?void 0:q8(Y.providerState,"refresh",Z,B.providerState,"the provider state the provider returned"),q=await H$(Y,z,G,{operation:"refresh",rowId:Z},async(N)=>{let O=N.row(Z),U=N.entry(Z);if(!O||O.invalid||!U||U.credentialEpoch!==V.credentialEpoch||O.identity!==V.identity)throw new Q6({operation:"refresh",rowId:Z,phase:"before-first-write",retryable:!0,kind:"attribution",message:`row ${Z} changed credential while its refresh was in flight; the rotation is discarded`});c$("refresh",O);let D=await X.refuse?.(O);if(D!==void 0)return{refused:D};let _=Y.now(),T=O.credential?.type==="oauth"?O.credential.lastRefreshedAt:void 0;if(FG(T,_))throw IG(Z);let M={type:"oauth",access:B.access,refresh:B.refresh,expires:B.expires},L=O.identity!==void 0&&B.identity!==void 0&&O.identity!==B.identity?{expectedIdentity:O.identity,returnedIdentity:B.identity}:void 0,C=L?{mark:tM(),enabled:!1,reason:`${i7}${JSON.stringify(L)}`}:void 0,w=O.identity===void 0&&B.identity?B.identity:void 0,v=await kX($,N,Z,M,{stamp:AX(T,_),transition:C,identity:w,...H!==void 0?{providerState:EX(Y.providerState,"refresh",Z,O.providerState,H)}:{}});if(C!==void 0)IX(N,Z,C),await N.commitConfig();let h=O.identity;if(w!==void 0)a7(N,Z,w),h=w,await N.commitConfig();return{stored:v,identity:h,contradiction:L,refused:void 0}});if(q.refused!==void 0)return{status:"refused",rowId:Z,reason:q.refused};if(q.contradiction!==void 0)return{status:"identity-contradicted",rowId:Z,...q.contradiction,credential:q.stored};if(X.onPersisted)try{let N=X.onPersisted;await Y1("refresh",()=>N(Z,q.stored))}catch(N){throw new Q6({operation:"refresh",rowId:Z,phase:"after-first-write",retryable:!1,kind:"after-persist-hook",committed:q.stored,message:"the after-persist hook threw; the rotation stays committed",cause:N})}return{status:"rotated",rowId:Z,credential:q.stored,...q.identity!==void 0?{identity:q.identity}:{}}})}var fX=Object.freeze(["version","accounts",D6]);function r9($){let Z={};for(let[J,X]of Object.entries($))if(!fX.includes(J))pZ(Z,J,X);return Z}function pZ($,Z,J){Object.defineProperty($,Z,{value:J,enumerable:!0,writable:!0,configurable:!0})}function Zj($,Z){let J={};for(let[X,Y]of Object.entries($))if(fX.includes(X))pZ(J,X,Y);else if(Object.hasOwn(Z,X))pZ(J,X,Z[X]);for(let[X,Y]of Object.entries(Z))if(!Object.hasOwn($,X))pZ(J,X,Y);return J}function EG($){return new Q6({operation:"updateSettings",phase:"before-first-write",retryable:!1,kind:"invalid-input",message:$})}async function Jj($){let Z=await d$($.ctx);if(Z.status==="error")return Z;return{status:Z.status,settings:r9(Z.config)}}async function Xj($,Z,J={}){E$("updateSettings");let{ctx:X}=$,Y=J.onFailure;return w$(X,"updateSettings",void 0,Y&&((z,G)=>Y(G)),async(z,G)=>{for(let K of J.extraLocks??[])await z.acquire(K);let Q=z.held.length;try{for(let U of X.storeLocks)await z.acquire(U);let K=await d$(X);if(K.status!=="ready")throw L8(K,"updateSettings",void 0);let W=r9(K.config),V=structuredClone(W),B=await Y1("updateSettings",()=>Z(V)),H=B===void 0?V:B;if(!u(H))throw EG("the settings mutator must produce an object");let q=fX.filter((U)=>Object.hasOwn(H,U));if(q.length>0)throw EG(`settings cannot set the pool-owned key(s) ${q.join(", ")}`);if($j(H,W))return{settings:W,outcome:"unchanged"};let N=Zj(K.config,H),O={operation:"updateSettings",rowId:void 0};return await $1(X.configPath,N,{beforeRename:async()=>{await X.onStep?.("before-config-write",O),await z.assertAll()}}),G.writes++,await X.onStep?.("after-config-write",O),{settings:r9(N),outcome:"updated"}}finally{await z.releaseTo(Q)}})}var wG=new Map;function Yj($){let Z=wG.get($);if(!Z)Z={removedIds:new Set,firedAtLoad:new Set},wG.set($,Z);return Z}function kG($){if($.status==="ready")return{status:"ready",schemaVersion:Y2,rows:$.rows};if($.status==="pending-migration")return{status:"pending-migration",roster:Array.isArray($.config.accounts)?$.config.accounts:[]};return $}function zj($){let Z=Yj($.configPath),J={...i6,...$.lockOptions},X={provider:$.provider,configPath:$.configPath,statePath:$.statePath,codec:$.quota,...$.providerState?{providerState:$.providerState}:{},now:$.now??Date.now,storeLocks:$.storeLocks??[{name:"save",path:$.configPath},{name:"save",path:$.statePath}],lockDefaults:J,lockEnv:{...$.onLockEvent?{onLockEvent:$.onLockEvent}:{},...$.onLockStep?{onLockStep:$.onLockStep}:{},...$.onRenewalTimer?{onRenewalTimer:$.onRenewalTimer}:{}},removedIds:Z.removedIds,requireCredentialStamps:$.requireCredentialStamps===!0,requireRemovedFingerprint:$.requireRemovedFingerprint===!0,...$.logger?{logger:$.logger}:{},...$.onStep?{onStep:$.onStep}:{},...$.hold?{hold:$.hold}:{}},Y=new fV(()=>z,$.pull,$.onPullFailure,Z.firedAtLoad,$.logger),z={ctx:X,providerLock:$.providerLock??{name:`provider-${encodeURIComponent($.provider)}`,path:$.statePath},rowLockOptions:$.rowLockOptions??{},firePull:(G,Q)=>Y.fire(G,Q)};return{async load(){let G=await d$(X);if(G.status==="ready"){for(let Q of G.rows)if((Q.candidate||Q.torn&&Q.enabled)&&Q.type==="oauth"&&Q.needsFirstReading)Y.fire(Q.id,"load")}return kG(G)},async read(){return kG(await d$(X))},async initialize(G={}){return{status:await FM(X,G.dropKeys??[])}},add:(G,Q)=>yM(z,G,Q),publishRoster:(G,Q)=>rM(z,G,Q),publication:(G)=>aM(z,G),replace:(G,Q,K,W)=>gM(z,G,Q,K,W),rotate:(G,Q,K,W)=>mM(z,G,Q,K,W),updateProviderState:(G,Q,K,W)=>SM(z,G,Q,K,W),disable:(G,Q,K)=>hM(z,G,Q,K),enable:(G,Q)=>pM(z,G,Q),remove:(G,Q)=>lM(z,G,Q),reorder:(G,Q)=>iM(z,G,Q),readSettings:()=>Jj(z),updateSettings:(G,Q)=>Xj(z,G,Q),recordIdentity:(G,Q,K,W)=>sM(z,G,Q,K,W),refresh:(G,Q,K)=>eM(z,G,Q,K),recordQuota:(G,Q,K)=>AV(z,G,Q,K),requestReading:(G)=>Y.fire(G,"admission"),pullsSettled:()=>Y.settled()}}var Z0="all",uw=Object.freeze(["primary"]);function Gj($){return $.kind==="retired"?$.retiredAt:$.checkedAt}function c1($,Z){return JSON.stringify([$,Z])}function O8($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function G$($){return typeof $==="number"&&Number.isFinite($)}function bG($){return typeof $==="string"&&$.length>0}function T$($,Z,J){return $[Z]===void 0||J($[Z])}function Qj($){return G$($)&&$>0}function t9($){return typeof $==="string"}function Kj($){if(!O8($)||!bG($.scope)||!bG($.label))return!1;switch($.kind){case"reading":return G$($.checkedAt)&&G$($.usedPercent)&&T$($,"resetsAt",t9)&&T$($,"windowMinutes",Qj);case"retired":return G$($.retiredAt);case"absent":return G$($.checkedAt);default:return!1}}function Wj($){if(!O8($)||!G$($.checkedAt))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&T$($,"remainingPercent",G$)&&T$($,"usedPercent",G$)&&T$($,"resetsAt",t9)&&T$($,"limit",G$)&&T$($,"used",G$)&&T$($,"remaining",G$)&&T$($,"unit",t9)}function vV($){return O8($)&&G$($.value)&&Number.isInteger($.value)&&$.value>=0&&G$($.checkedAt)}function yV($){return O8($)&&Object.values($).every(vV)}function Vj($){if(!O8($))return;let Z=Object.entries($).filter(([,J])=>vV(J));return Z.length===0?void 0:Object.fromEntries(Z)}function yX($){if(Q2($))return $;if(!O8($))return;let{counters:Z,...J}=$;if(!Q2(J))return;let X=Vj(Z);return{...J,...X===void 0?{}:{counters:X}}}function Q2($){if(!O8($)||!Array.isArray($.limits))return!1;let Z=new Set;for(let J of $.limits){if(!Kj(J))return!1;let X=c1(J.scope,J.label);if(Z.has(X))return!1;Z.add(X)}return T$($,"budget",Wj)&&T$($,"counters",yV)}class e9 extends TypeError{constructor($){super($);this.name="QuotaCodecError"}}function $4($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function R7($){return typeof $==="number"&&Number.isFinite($)}function gV($){return $===void 0||typeof $==="string"&&$!==""}function mV($){return typeof $==="string"&&$!==""}function M1($,Z){return $[Z]===void 0||R7($[Z])}function $J($,Z){return $[Z]===void 0||typeof $[Z]==="string"}function Bj($){return $4($)&&gV($.scope)&&mV($.label)&&R7($.usedPercent)&&$J($,"resetsAt")&&($.windowMinutes===void 0||R7($.windowMinutes)&&$.windowMinutes>0)}function Hj($){return $4($)&&gV($.scope)&&mV($.label)}function Uj($){if(!$4($))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&M1($,"remainingPercent")&&M1($,"usedPercent")&&$J($,"resetsAt")&&M1($,"limit")&&M1($,"used")&&M1($,"remaining")&&$J($,"unit")}function Nj($){if(!$4($)||!R7($.checkedAt))return!1;let Z=$.readings??[],J=$.coverage??[];if(!Array.isArray(Z)||!Array.isArray(J))return!1;let X=new Set;for(let Y of Z){if(!Bj(Y))return!1;let z=c1(Y.scope??Z0,Y.label);if(X.has(z))return!1;X.add(z)}if(!J.every(Hj))return!1;return($.budget===void 0||Uj($.budget))&&($.counters===void 0||yV($.counters))}function Lj($,Z){if($.scope!==Z.scope)return $.scope<Z.scope?-1:1;if($.label!==Z.label)return $.label<Z.label?-1:1;return 0}function qj($,Z,J){if(Z===void 0)return $;if($!==void 0&&J<$.checkedAt)return $;return{...Z,checkedAt:J}}function Oj($,Z){let J=new Map(Object.entries($??{}));for(let[X,Y]of Object.entries(Z??{})){let z=J.get(X);if(z===void 0||Y.checkedAt>=z.checkedAt)J.set(X,Y)}return J.size===0?void 0:Object.fromEntries(J)}function gX($,Z){let J=$===void 0?void 0:yX($);if($!==void 0&&J===void 0)throw new e9("stored quota map is malformed");if(!Nj(Z))throw new e9("quota observation is malformed");let X=J??{limits:[]},Y=Z.checkedAt,z=new Map;for(let N of X.limits)z.set(c1(N.scope,N.label),N);let G=(N)=>{let O=z.get(N);return O===void 0||Y>=Gj(O)},Q=new Set;for(let N of Z.readings??[]){let O=N.scope??Z0,U=c1(O,N.label);if(Q.add(U),!G(U))continue;z.set(U,{scope:O,label:N.label,kind:"reading",checkedAt:Y,usedPercent:N.usedPercent,...N.resetsAt===void 0?{}:{resetsAt:N.resetsAt},...N.windowMinutes===void 0?{}:{windowMinutes:N.windowMinutes}})}for(let N of Z.coverage??[]){let O=N.scope??Z0,U=c1(O,N.label);if(Q.has(U)||!G(U))continue;let D=z.get(U);z.set(U,D===void 0||D.kind==="absent"?{scope:O,label:N.label,kind:"absent",checkedAt:Y}:{scope:O,label:N.label,kind:"retired",retiredAt:Y})}let{limits:K,budget:W,counters:V,...B}=X,H=qj(X.budget,Z.budget,Y),q=Oj(X.counters,Z.counters);return{...B,limits:[...z.values()].sort(Lj),...H===void 0?{}:{budget:H},...q===void 0?{}:{counters:q}}}var dw=Object.freeze({validate:Q2,decode:yX,merge:gX}),Dj=900000,_j="no quota reading yet",Mj="no limits reported";function hV($){let Z=Math.max(1,Math.floor($/60000));if(Z<60)return`${Z}m`;if(Z<1440){let Y=Math.floor(Z/60),z=Z%60;return z===0?`${Y}h`:`${Y}h${z}m`}let J=Math.floor(Z/1440),X=Math.floor(Z%1440/60);return X===0?`${J}d`:`${J}d${X}h`}function jj($){if($%1440===0)return`${$/1440}d`;if($%60===0)return`${$/60}h`;return`${$}m`}function Rj($){if($.scope!==Z0||$.windowMinutes===void 0)return $.label;return jj($.windowMinutes)}function ZJ($){return Math.min(100,Math.max(0,$))}function fG($){return`${Math.round(ZJ($))}% left`}function vG($,Z,J){let X=$===void 0?Number.NaN:Date.parse($);return{...Number.isFinite(X)&&X>J?{resetIn:hV(X-J)}:{},resetSinceReading:Number.isFinite(X)&&X>Z&&X<=J}}function Tj($,Z){let J=$.windowMinutes,X=Z.windowMinutes;if(J!==void 0&&X!==void 0&&J!==X)return J-X;if(J===void 0!==(X===void 0))return J===void 0?1:-1;if($.scope!==Z.scope){if($.scope===Z0)return-1;if(Z.scope===Z0)return 1;return $.scope<Z.scope?-1:1}return $.label<Z.label?-1:$.label>Z.label?1:0}function pV($,Z){if(!$)return{windows:[]};let{now:J}=Z,Y=$.limits.filter((G)=>G.kind==="reading"&&G.remainingPercent!==void 0).sort(Tj).map((G)=>{let Q=ZJ(G.remainingPercent??0);return{kind:"window",name:Rj(G),figure:fG(G.remainingPercent??0),remainingPercent:Q,checkedAt:G.checkedAt,...vG(G.resetsAt,G.checkedAt,J)}}),z=$.budget;if(z){let G=z.remainingPercent,Q=z.reached?"credits spent":G!==void 0?`credits ${fG(G)}`:"credits available";Y.push({kind:"budget",name:"credits",figure:Q,...G===void 0?{}:{remainingPercent:ZJ(G)},checkedAt:z.checkedAt,...vG(z.resetsAt,z.checkedAt,J)})}if(Y.length>0){let G=J-Math.min(...Y.map((Q)=>Q.checkedAt));if(G>(Z.staleAfterMs??Dj))return{windows:Y,age:`checked ${hV(G)} ago`}}return{windows:Y}}function lV($,Z){let J=pV($,Z),X=(Z.form??"full")==="full",Y=J.windows.map((z)=>{let G=X&&z.resetIn?`, resets ${z.resetIn}`:"";return`${z.kind==="budget"?"":`${z.name} `}${z.figure}${G}`});return J.age===void 0?Y:[...Y,J.age]}function Pj($,Z){let J=lV($,Z);if(J.length>0)return J.join(" · ");return $&&$.limits.length>0?Mj:_j}class w0 extends Error{constructor(){super("Anthropic quota observation is invalid");this.name="NativeQuotaCodecError"}}function O$($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function i$($,Z,J=[]){return Z.every((X)=>Object.hasOwn($,X))&&Object.keys($).every((X)=>Z.includes(X)||J.includes(X))}function K0($){return typeof $==="number"&&Number.isFinite($)}function mX($){return K0($)&&$>=0}function K$($){return typeof $==="string"&&$.length>0&&$.trim()===$}function k6($,Z,J){return $[Z]===void 0||J($[Z])}function JJ($){return $==="poll"||$==="headers"}function yG($){return O$($)&&i$($,["amountMinor","currency","exponent"])&&K0($.amountMinor)&&K$($.currency)&&/^[A-Za-z]{3}$/.test($.currency)&&K0($.exponent)&&Number.isInteger($.exponent)&&$.exponent>=0&&$.exponent<=20}function Cj($){return O$($)&&i$($,["used","limit","exhausted"],["utilizationPercent","severity"])&&yG($.used)&&yG($.limit)&&typeof $.exhausted==="boolean"&&k6($,"utilizationPercent",K0)&&k6($,"severity",(Z)=>typeof Z==="string")}function Fj($){return O$($)&&i$($,[],v7)&&Object.values($).every(JJ)}var uV=["checkedAt","accountIdentity","extraUsage","bindingWindow","bindingWindowSource","fieldSources","fallbackAdvised","source"];function dV($){return k6($,"checkedAt",mX)&&k6($,"accountIdentity",K$)&&k6($,"extraUsage",Cj)&&k6($,"bindingWindow",K$)&&k6($,"bindingWindowSource",JJ)&&k6($,"fieldSources",Fj)&&k6($,"fallbackAdvised",(Z)=>typeof Z==="boolean")&&k6($,"source",JJ)}function o4($,Z){if(!O$($)||!i$($,Z?["usedPercent","remainingPercent","checkedAt","id","title","modelName"]:["usedPercent","remainingPercent","checkedAt"],Z?["resetsAt","modelId"]:["resetsAt"]))return!1;return K0($.usedPercent)&&K0($.remainingPercent)&&mX($.checkedAt)&&k6($,"resetsAt",(J)=>typeof J==="string")&&(!Z||K$($.id)&&K$($.title)&&K$($.modelName)&&k6($,"modelId",K$))}function XJ($){return O$($)&&i$($,[],["five_hour","seven_day","scoped",...uV])&&dV($)&&k6($,"five_hour",(Z)=>o4(Z,!1))&&k6($,"seven_day",(Z)=>o4(Z,!1))&&k6($,"scoped",(Z)=>Array.isArray(Z)&&Z.every((J)=>o4(J,!0))&&new Set(Z.map((J)=>J.id)).size===Z.length)}function xj($){return O$($)&&i$($,["id","title","modelName","remainingPercent"],["modelId"])&&K$($.id)&&K$($.title)&&K$($.modelName)&&k6($,"modelId",K$)&&K0($.remainingPercent)}function Aj($){return O$($)&&i$($,["version","remainingPercent"],["scoped",...uV])&&$.version===1&&dV($)&&O$($.remainingPercent)&&i$($.remainingPercent,[],["five_hour","seven_day"])&&Object.values($.remainingPercent).every(K0)&&k6($,"scoped",(Z)=>Array.isArray(Z)&&Z.every(xj))}function gG($){let Z=$.toLowerCase().replace(/[^a-z0-9]/g,"");if(Z.includes("fable"))return"fable";if(Z.includes("mythos"))return"mythos";return`model:${Z}`}function cV($){let Z=gG([$.modelId,$.modelName,$.title].join(" "));return{scope:Z==="fable"||Z==="mythos"?Z:gG($.modelId??$.modelName),label:`seven_day:${$.id}`}}function J0($){if(!XJ($))throw new w0;let Z=JSON.parse(JSON.stringify($));if(!XJ(Z))throw new w0;let{five_hour:J,seven_day:X,scoped:Y,...z}=Z,G=[],Q={};if(J){let{remainingPercent:V,...B}=J;Q.five_hour=V,G.push({scope:"all",label:"five_hour",kind:"reading",...B})}if(X){let{remainingPercent:V,...B}=X;Q.seven_day=V,G.push({scope:"all",label:"seven_day",kind:"reading",...B})}let K=Y?.map((V)=>{let{usedPercent:B,checkedAt:H,resetsAt:q,...N}=V;return G.push({...cV(N),kind:"reading",usedPercent:B,checkedAt:H,...q!==void 0?{resetsAt:q}:{}}),N}),W={limits:G,anthropic:{version:1,remainingPercent:Q,...z,...K!==void 0?{scoped:K}:{}}};if(z.extraUsage&&z.checkedAt!==void 0)W.budget={kind:"reading",checkedAt:z.checkedAt,reached:z.extraUsage.exhausted,...z.extraUsage.utilizationPercent!==void 0?{usedPercent:z.extraUsage.utilizationPercent}:{}};if(!Q2(W))throw new w0;return W}function Sj($){return O$($)&&i$($,["scope","label","kind","checkedAt","usedPercent"],["resetsAt"])&&K$($.scope)&&K$($.label)&&$.kind==="reading"&&mX($.checkedAt)&&K0($.usedPercent)&&k6($,"resetsAt",(Z)=>typeof Z==="string")}function YJ($,Z){if(Array.isArray($)&&Array.isArray(Z))return $.length===Z.length&&$.every((J,X)=>YJ(J,Z[X]));if(O$($)&&O$(Z))return Object.keys($).length===Object.keys(Z).length&&Object.keys($).every((J)=>Object.hasOwn(Z,J)&&YJ($[J],Z[J]));return $===Z}function x$($){if(!O$($)||!i$($,["limits","anthropic"],["budget"])||!Q2($)||!$.limits.every(Sj)||!Aj($.anthropic))throw new w0;let{version:Z,remainingPercent:J,scoped:X,...Y}=$.anthropic,z=structuredClone(Y);for(let G of["five_hour","seven_day"]){let Q=$.limits.find((V)=>V.scope==="all"&&V.label===G),K=G==="five_hour"?J.five_hour:J.seven_day;if(Q?.kind!=="reading"||K===void 0)continue;let W={usedPercent:Q.usedPercent,remainingPercent:K,checkedAt:Q.checkedAt,...Q.resetsAt!==void 0?{resetsAt:Q.resetsAt}:{}};if(G==="five_hour")z.five_hour=W;else z.seven_day=W}if(X!==void 0)z.scoped=X.map((G)=>{let Q=cV(G),K=$.limits.find((W)=>W.scope===Q.scope&&W.label===Q.label);if(K?.kind!=="reading")throw new w0;return{...structuredClone(G),usedPercent:K.usedPercent,checkedAt:K.checkedAt,...K.resetsAt!==void 0?{resetsAt:K.resetsAt}:{}}});if(!YJ(J0(z),$))throw new w0;return z}var A$={validate($){try{return x$($),!0}catch{return!1}},merge($,Z){let J=x$(Z);if($===void 0)return J0(J);let X=x$($);if(X.accountIdentity!==J.accountIdentity)throw new w0;if(J.source==="headers")return J0(FL(X,J));let Y=r6(X),z=r6(J);return J0(Y>z||Y===z&&X.source==="poll"&&J.source!=="poll"?X:J)}};class T7 extends Error{constructor(){super("Anthropic account binding is unavailable or changed");this.name="NativePoolBindingError"}}function P7($){return typeof $==="string"&&$.length>0&&$.trim()===$}function hX($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function P6($){if(!$||typeof $!=="object"||Array.isArray($))return!1;let Z=$;return Z.kind==="local"&&typeof Z.storageId==="string"&&/^[a-f0-9]{64}$/.test(Z.storageId)&&P7(Z.rowId)&&hX(Z.credentialEpoch)&&(Z.identity===void 0||P7(Z.identity))&&["kind","storageId","rowId","credentialEpoch"].every((J)=>Object.hasOwn(Z,J))&&(Z.identity===void 0||Object.hasOwn(Z,"identity"))&&Object.keys(Z).every((J)=>["kind","storageId","rowId","credentialEpoch","identity"].includes(J))}function sV($){return $.stamp==="bound"&&!$.invalid&&!$.torn&&!$.unbound&&P7($.id)&&hX($.credentialEpoch)&&($.identity===void 0||P7($.identity))}function hj($,Z){let J=Z.credentialEpoch;if(!Z.candidate||!sV(Z)||!hX(J))throw new T7;let X={kind:"local",storageId:$.storageId,rowId:Z.id,credentialEpoch:J,...Z.identity!==void 0?{identity:Z.identity}:{}};if(!P6(X))throw new T7;return Object.freeze(X)}function C$($,Z,J){return P6($)&&sV(J)&&$.storageId===Z.storageId&&$.rowId===J.id&&$.credentialEpoch===J.credentialEpoch&&$.identity===J.identity}function pG($){if(!P6($))throw new T7;return mj("sha256").update(JSON.stringify(["anthropic-local-refresh",$.storageId,$.credentialEpoch,$.identity===void 0?["row",$.rowId]:["account",$.identity]])).digest("hex")}function p$($){return pj("sha256").update($).digest("hex").slice(0,16)}function zJ($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function lG($,Z,J=[]){return Z.every((X)=>Object.hasOwn($,X))&&Object.keys($).every((X)=>Z.includes(X)||J.includes(X))}function C7($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0}function uG($){return typeof $==="string"&&$.length>0&&$.trim()===$}function H8($){if(!zJ($)||!lG($,["binding","credentialFingerprint","version"])||!P6($.binding)||$.binding.identity===void 0||typeof $.credentialFingerprint!=="string"||!/^[a-f0-9]{64}$/.test($.credentialFingerprint)||!zJ($.version)||!lG($.version,["accessFingerprint","expires"],["lastRefreshedAt"]))return!1;return typeof $.version.accessFingerprint==="string"&&/^[a-f0-9]{16}$/.test($.version.accessFingerprint)&&C7($.version.expires)&&$.version.expires>0&&(!Object.hasOwn($.version,"lastRefreshedAt")||C7($.version.lastRefreshedAt))}function X8($,Z,J){if(!H8($)||!P6(Z)||Z.identity===void 0||!zJ(J)||J.type!=="oauth"||!uG(J.access)||!uG(J.refresh)||!C7(J.expires)||J.expires<=0||Object.hasOwn(J,"lastRefreshedAt")&&!C7(J.lastRefreshedAt))return!1;return $.binding.storageId===Z.storageId&&$.binding.rowId===Z.rowId&&$.binding.credentialEpoch===Z.credentialEpoch&&$.binding.identity===Z.identity&&$.credentialFingerprint===A6({type:"oauth",refresh:J.refresh})&&$.version.accessFingerprint===p$(J.access)&&$.version.expires===J.expires&&Object.hasOwn($.version,"lastRefreshedAt")===Object.hasOwn(J,"lastRefreshedAt")&&$.version.lastRefreshedAt===J.lastRefreshedAt}function aV($){if(!$)return;return(Z)=>{try{let J=$(Z);if(J!==null&&(typeof J==="object"||typeof J==="function")&&"then"in J&&typeof J.then==="function")Promise.resolve(J).catch(()=>{})}catch{}}}class k0 extends Error{code;constructor($){super($==="supervised-auth-snapshot"?"Local login cannot be verified while OPENCODE_AUTH_CONTENT is set. Run setup without OPENCODE_AUTH_CONTENT in the environment.":"Invalid native host auth source.");this.name="NativeHostAuthError",this.code=$==="supervised-auth-snapshot"?$:"invalid-source"}}function cj($){return $.OPENCODE_AUTH_CONTENT!==void 0}function pX($){if(cj($))throw new k0("supervised-auth-snapshot")}function F6(){throw new k0("invalid-source")}function lZ($){if($===null||typeof $!=="object"||Array.isArray($))return!1;let Z=Object.getPrototypeOf($);return Z===Object.prototype||Z===null}function i1($){let Z=new Map;for(let J of Reflect.ownKeys($)){if(typeof J!=="string")F6();let X=Object.getOwnPropertyDescriptor($,J);if(!X||!Object.hasOwn(X,"value"))F6();Z.set(J,X.value)}return Z}function GJ($,Z=new Set){if($===null||typeof $==="string"||typeof $==="boolean")return JSON.stringify($);if(typeof $==="number"){if(!Number.isFinite($))F6();return JSON.stringify($)}if(typeof $!=="object")F6();if(Z.has($))F6();Z.add($);try{if(Array.isArray($)){if(Object.getPrototypeOf($)!==Array.prototype)F6();let X=i1($),Y=X.get("length");if(X.size!==Y+1)F6();let z=[];for(let G=0;G<Y;G++){let Q=String(G);if(!X.has(Q))F6();z.push(GJ(X.get(Q),Z))}return`[${z.join(",")}]`}if(!lZ($))F6();let J=i1($);return`{${[...J.keys()].sort().map((X)=>`${JSON.stringify(X)}:${GJ(J.get(X),Z)}`).join(",")}}`}finally{Z.delete($)}}function d6($,Z){try{if($!=="opencode"&&$!=="pi")F6();if(Z===void 0)return Object.freeze({kind:"absent",digest:"absent"});if(!lZ(Z))F6();let J=i1(Z);if(!J.has("anthropic"))return Object.freeze({kind:"absent",digest:"absent"});let X=J.get("anthropic");if(!lZ(X))F6();let Y=i1(X),z=GJ(X),G,Q=Y.get("type");if(Q==="oauth"){if(typeof Y.get("access")!=="string"||typeof Y.get("refresh")!=="string"||typeof Y.get("expires")!=="number"||!Number.isFinite(Y.get("expires")))F6();let K=b7("anthropic");G=Y.size===4&&Object.entries(K).every(([W,V])=>Y.get(W)===V)?"activation":"oauth"}else if($==="opencode"&&Q==="api"){if(typeof Y.get("key")!=="string")F6();G="api"}else if($==="pi"&&Q==="api_key"){if(Y.has("key")&&typeof Y.get("key")!=="string")F6();if(Y.has("env")){let K=Y.get("env");if(!lZ(K))F6();for(let W of i1(K).values())if(typeof W!=="string")F6()}G="api_key"}else F6();if(G!=="activation")for(let K of["access","refresh","key"]){let W=Y.get(K);if(typeof W==="string"&&W.startsWith("claustrum-tombstone:"))F6()}return Object.freeze({kind:G,digest:dj("sha256").update(z,"utf8").digest("hex")})}catch{throw new k0("invalid-source")}}class uX extends Error{code="prepared-proof-refused";constructor(){super("Native migration prepared proof is unavailable or changed");this.name="NativeMigrationProofError"}}function H6(){throw new uX}function dX($){if(!$||typeof $!=="object"||Array.isArray($)||lX.isProxy($))H6();let Z=Object.getPrototypeOf($);if(Z!==Object.prototype&&Z!==null)H6();for(let J of Reflect.ownKeys($)){if(typeof J!=="string")H6();let X=Object.getOwnPropertyDescriptor($,J);if(!X||!Object.hasOwn(X,"value"))H6()}}function Q8($){let Z=new Set;function J(X){if(X===null||typeof X==="string"||typeof X==="boolean")return X;if(typeof X==="number"&&Number.isFinite(X))return X;if(typeof X!=="object"||lX.isProxy(X)||Z.has(X))H6();let Y=Object.getPrototypeOf(X);if(Y!==(Array.isArray(X)?Array.prototype:Object.prototype)&&!(Y===null&&!Array.isArray(X)))H6();Z.add(X);try{let z=new Map;for(let Q of Reflect.ownKeys(X)){if(typeof Q!=="string")H6();let K=Object.getOwnPropertyDescriptor(X,Q);if(!K||!Object.hasOwn(K,"value"))H6();z.set(Q,K.value)}if(Array.isArray(X)){let Q=z.get("length");if(typeof Q!=="number"||z.size!==Q+1)H6();return Array.from({length:Q},(K,W)=>{if(!z.has(String(W)))H6();return J(z.get(String(W)))})}let G=Object.create(null);for(let Q of[...z.keys()].sort())G[Q]=J(z.get(Q));return G}finally{Z.delete(X)}}return J($)}function x6($){return JSON.stringify(Q8($))}function K2($){return ij("sha256").update(x6($)).digest("hex")}function QJ($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function _Z($,Z,J){if(!Object.hasOwn($,Z))return["absent"];if(typeof $[Z]!==J)H6();return["present",$[Z]]}function sj($){let Z=Q8($);if(!QJ(Z))H6();if(Z.type==="oauth"&&typeof Z.refresh==="string"){if(Object.keys(Z).some((J)=>!["type","access","refresh","expires","lastRefreshedAt"].includes(J)))H6();return K2(["anthropic-prepared-credential-v1","oauth",_Z(Z,"access","string"),Z.refresh,_Z(Z,"expires","number"),_Z(Z,"lastRefreshedAt","number")])}if(Z.type==="api"&&typeof Z.apiKey==="string"&&typeof Z.baseURL==="string"){if(Object.keys(Z).some((J)=>!["type","apiKey","baseURL","authHeader"].includes(J)))H6();if(Object.hasOwn(Z,"authHeader")&&Z.authHeader!=="x-api-key"&&Z.authHeader!=="authorization-bearer")H6();return K2(["anthropic-prepared-credential-v1","api",Z.apiKey,Z.baseURL,_Z(Z,"authHeader","string")])}return H6()}function oV($,Z){if(lX.isProxy($)||!Array.isArray($)||Object.getPrototypeOf($)!==Array.prototype)H6();let J=Object.getOwnPropertyDescriptors($);if(Reflect.ownKeys(J).length!==$.length+1)H6();let X=Array.from({length:$.length},(Y,z)=>{let G=J[String(z)];if(!G||!Object.hasOwn(G,"value"))H6();let Q=G.value;if(dX(Q),Q.stamp!=="bound"||Q.invalid||Q.torn||Q.unbound||!Q.credential||typeof Q.credentialEpoch!=="number"||!Number.isSafeInteger(Q.credentialEpoch)||Q.credentialEpoch<=0||typeof Q.id!=="string"||!Q.id||Q.identity!==void 0&&(typeof Q.identity!=="string"||!Q.identity))H6();return{id:Q.id,credentialEpoch:Q.credentialEpoch,identity:Q.identity??null,stamp:"bound",credentialDigest:sj(Q.credential)}}).sort((Y,z)=>Y.id<z.id?-1:Y.id>z.id?1:0);if(new Set(X.map((Y)=>Y.id)).size!==X.length)H6();return{version:1,rows:X,runtimeDigest:K2(Z)}}function rV($){let Z=Q8($),J=(Y)=>typeof Y==="string"&&/^[a-f0-9]{64}$/.test(Y);if(!QJ(Z)||Object.keys(Z).length!==3||Z.version!==1||!Array.isArray(Z.rows)||!J(Z.runtimeDigest))H6();let X=Z.rows.map((Y)=>{if(!QJ(Y)||Object.keys(Y).length!==5||typeof Y.id!=="string"||!Y.id||typeof Y.credentialEpoch!=="number"||!Number.isSafeInteger(Y.credentialEpoch)||Y.credentialEpoch<=0||!(Y.identity===null||typeof Y.identity==="string"&&Y.identity.length>0)||Y.stamp!=="bound"||typeof Y.credentialDigest!=="string"||!J(Y.credentialDigest))H6();return{id:Y.id,credentialEpoch:Y.credentialEpoch,identity:Y.identity,stamp:"bound",credentialDigest:Y.credentialDigest}});if(new Set(X.map((Y)=>Y.id)).size!==X.length)H6();return{version:1,rows:X,runtimeDigest:Z.runtimeDigest}}function r4($,Z,J){if(!$||x6(rV($))!==x6(oV(Z,J)))H6()}class cX extends Error{code="invalid-migration-source";constructor(){super("Native migration source cannot be imported safely");this.name="NativeMigrationProjectionError"}}function X6(){throw new cX}function n8($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function g6($){if($===void 0)return Object.create(null);if(!n8($))X6();return $}function Y$($){return typeof $==="string"&&$.length>0&&$.trim()===$}function dG($){if(!Y$($)||["__proto__","constructor","prototype"].includes($))X6();return $}function a0($){return typeof $==="number"&&Number.isFinite($)&&$>=0?$:0}function cG($){if($===void 0)return;if(!Y$($))X6();return $}function h8($,Z){return Object.fromEntries(Z.filter((J)=>Object.hasOwn($,J)).map((J)=>[J,$[J]]))}var tV={routing:["mode"],refresh:["enabled","intervalMinutes","refreshBeforeExpiryMinutes"],quota:["enabled","checkIntervalMinutes","refreshEveryNRequests","minimumRemaining","failClosedOnUnknownQuota","showToasts"],quotaHeaderFeed:["enabled"],claudeCache:["enabled","mode"],dump:["enabled"],logging:["level"],claudeFast:["enabled"],thinkingBinding:["prefixMismatchBehavior"],costZeroing:["enabled"],cacheKeep:["enabled","always","startHour","endHour","subagents"],prime:["enabled"],relay:["enabled","url","fallbackToDirect","transport"],killswitch:["enabled","main","accounts"]};function KJ($){let Z=(X)=>n8(X)&&Object.entries(X).every(([Y,z])=>["five_hour","seven_day","5h","1w","scoped"].includes(Y)&&typeof z==="number"&&Number.isFinite(z)&&z>=0&&z<=100),J={"routing.mode":["main-first","fallback-first","sticky-balanced"],"claudeCache.mode":sK,"logging.level":["debug","info","warn","error","trace"],"thinkingBinding.prefixMismatchBehavior":["account-default","error","drop_block"],"relay.transport":["http","websocket"]};for(let[X,Y]of Object.entries(tV)){if($[X]===void 0)continue;let z=g6($[X]);for(let G of Y){if(z[G]===void 0)continue;let Q=J[`${X}.${G}`];if(Q){if(typeof z[G]!=="string"||!Q.includes(z[G]))X6();continue}if(["enabled","always","subagents","failClosedOnUnknownQuota","showToasts","fallbackToDirect"].includes(G)){if(typeof z[G]!=="boolean")X6()}else if(G==="url"){if(typeof z[G]!=="string"||!tK(z[G]))X6()}else if(G==="minimumRemaining"||G==="main"){if(!Z(z[G]))X6()}else if(G==="accounts"){if(!n8(z[G])||!Object.entries(z[G]).every(([K,W])=>Y$(K)&&Z(W)))X6()}else if(typeof z[G]!=="number"||!Number.isFinite(z[G])||z[G]<0)X6()}}}function t4($){if($.type==="oauth"&&Y$($.refresh)){if($.access!==void 0&&typeof $.access!=="string"||$.expires!==void 0&&(typeof $.expires!=="number"||!Number.isFinite($.expires)))X6();return{type:"oauth",refresh:$.refresh,...typeof $.access==="string"?{access:$.access}:{},...typeof $.expires==="number"?{expires:$.expires}:{}}}if($.type==="api"&&Y$($.apiKey)&&typeof $.baseURL==="string"&&tK($.baseURL)){if($.authHeader!==void 0&&$.authHeader!=="authorization-bearer"&&$.authHeader!=="x-api-key")X6();return{type:"api",apiKey:$.apiKey,baseURL:$.baseURL,authHeader:$.authHeader??"authorization-bearer"}}return X6()}function iG($,Z,J){let X=h8($,["lastUsed","lastRefreshedAt","refreshErrorClearedAt","quotaErrorClearedAt","quotaErrorGeneration","prime","authLineageId","primeAuthLineageRefreshTokenFingerprint"]),Y=J?.type==="oauth"?p$(J.access??""):Z;if($.quotaToken!==void 0&&$.quotaToken===Y){if(X.quotaToken=$.quotaToken,$.quotaCheckedAt!==void 0)X.quotaCheckedAt=$.quotaCheckedAt}if(n8($.profile)&&Z!==void 0&&($.profile.providerAccountUuid===Z||$.profile.accountIdentity===Z))X.profile=h8($.profile,["tier","orgType","checkedAt","accountIdentity","providerAccountUuid","tokenFingerprint"]);for(let z of["lastRefreshError","lastQuotaRefreshError"]){let G=$[z],Q=X[z==="lastRefreshError"?"refreshErrorClearedAt":"quotaErrorClearedAt"];if(!n8(G)||typeof Q==="number"&&a0(G.checkedAt)<=Q||G.accountIdentity!==void 0&&G.accountIdentity!==Z)continue;let K=h8(G,["checkedAt","nextRetryAt","retryCount","accountIdentity","status","permanent"]);if(K.message=z==="lastRefreshError"?"Imported refresh failure":"Imported quota failure",z==="lastRefreshError"&&J?.type==="oauth"&&G.tokenHash===nV("sha256").update(J.refresh).digest("hex"))K.credentialFingerprint=A6(J);X[z]=K}return X}function sG($,Z){if($===void 0)return;if(!XJ($))return;if(Z===void 0||$.accountIdentity!==Z)return;return J0($)}function aj($){try{dX($);let Z=g6($.config===void 0?void 0:Q8($.config)),J=g6($.state===void 0?void 0:Q8($.state)),X=g6($.hostAuth===void 0?void 0:Q8($.hostAuth)),Y=d6($.host,X);if(Z.version!==void 0&&Z.version!==1||J.version!==void 0&&J.version!==1)X6();let z=nV("sha256").update(JSON.stringify([$.storageId,$.configDigest,"former-main"])).digest("hex"),G=Z.mainAccountId===void 0?`${z.slice(0,8)}-${z.slice(8,12)}-${z.slice(12,16)}-${z.slice(16,20)}-${z.slice(20,32)}`:dG(Z.mainAccountId),Q={mainAccountId:G,formerMainRowId:G};for(let[M,L]of Object.entries(tV))if(Z[M]!==void 0)Q[M]=h8(g6(Z[M]),L);if(Z.fallbackOn!==void 0){if(!Array.isArray(Z.fallbackOn)||Z.fallbackOn.some((M)=>typeof M!=="number"||!Number.isInteger(M)))X6();Q.fallbackOn=Z.fallbackOn}let K=g6(Z.claustrum),W=K.primaryAccount,V;if(W!==void 0){let M=g6(W);if(!Y$(M.credentialId)||!Y$(M.accountId))X6();V={credentialId:M.credentialId,accountIdentity:M.accountId}}let B=K.disabledAccountIdentities??[];if(!Array.isArray(B)||B.some((M)=>!Y$(M)))X6();let H=[];for(let M of B){if(!Y$(M))X6();H.push(M)}if(K.mode==="claustrum"&&!V)X6();Q.claustrum={mode:V?"claustrum":"local",...W?{primaryAccount:W}:{},disabledAccountIdentities:B};let q=[],N=[],O={...g6(Z.main),...g6(J.main)};if(V||Y.kind==="oauth"){let M;if(!V){let j=g6(X.anthropic);M=Y.kind==="oauth"?t4(j):t4({type:"api",apiKey:j.key,baseURL:"https://api.anthropic.com",authHeader:"x-api-key"})}let L=V?.accountIdentity??(n8(O.profile)&&M?.type==="oauth"&&(O.profileToken===p$(M.access??"")||O.profile.tokenFingerprint===p$(M.access??""))?cG(O.profile.providerAccountUuid):void 0),C=g6(Z.quota),w=g6(Z.refresh),v=g6(Z.prime),h={...h8(w,[]),...O};for(let[j,A]of Object.entries({lastRefreshError:"mainLastRefreshError",refreshErrorClearedAt:"mainRefreshErrorClearedAt"}))if(!Object.hasOwn(h,j)&&w[A]!==void 0)h[j]=w[A];for(let[j,A]of Object.entries({lastQuotaRefreshError:"mainLastQuotaApiError",quotaErrorClearedAt:"mainQuotaErrorClearedAt",quotaErrorGeneration:"mainQuotaErrorGeneration"}))if(!Object.hasOwn(h,j)&&C[A]!==void 0)h[j]=C[A];if(O.lastQuotaApiError!==void 0)h.lastQuotaRefreshError=O.lastQuotaApiError;if(h.authLineageId=O.primeAuthLineageId??v.mainAuthLineageId,h.primeAuthLineageRefreshTokenFingerprint=O.primeAuthLineageRefreshTokenFingerprint??v.mainAuthLineageRefreshTokenFingerprint,h.prime===void 0&&v.main!==void 0)h.prime=v.main;let a={id:G,enabled:!0,runtime:iG(h,L,M),...L!==void 0?{identity:L}:{},...M?{credential:M}:{}},p=O.quota??C.mainQuota,R=O.quotaToken??C.mainQuotaToken;if(V||M?.type==="oauth"&&R===p$(M.access??""))a.quota=sG(p,L);q.push(a)}if(Z.accounts!==void 0&&!Array.isArray(Z.accounts))X6();let U=g6(J.accounts);for(let M of Array.isArray(Z.accounts)?Z.accounts:[]){let L=g6(M),C=dG(L.id);if(L.enabled!==void 0&&typeof L.enabled!=="boolean")X6();let w=h8(g6(U[C]),["access","refresh","expires","apiKey","lastUsed","lastRefreshedAt","anthropicAccountUuid","claustrumScopedCredentialId","claustrumScopedState","authLineageId","lastRefreshError","lastQuotaRefreshError","quota","profile","prime","refreshErrorClearedAt","quotaErrorClearedAt","quotaErrorGeneration"]),v=L.claustrumScopedCredentialId!==void 0,h=v&&w.claustrumScopedCredentialId===L.claustrumScopedCredentialId&&w.anthropicAccountUuid===L.anthropicAccountUuid,a=Math.max(a0(L.lastRefreshedAt),a0(L.lastUsed),a0(L.addedAt)),p=Math.max(a0(w.lastRefreshedAt),a0(w.lastUsed),a0(w.addedAt)),R=["access","refresh","apiKey"].some((F)=>L[F]!==void 0&&w[F]!==void 0&&L[F]!==w[F]),j=R&&a>p;if(R&&a===p)X6();let A=v?{...h?w:{},...L}:j?{...w,...L}:{...L,...w};if(j)delete A.quota,delete A.lastRefreshError,delete A.lastQuotaRefreshError;let E=cG(L.anthropicAccountUuid??A.anthropicAccountUuid);if(L.anthropicAccountUuid!==void 0&&w.anthropicAccountUuid!==void 0&&L.anthropicAccountUuid!==w.anthropicAccountUuid)X6();if(V&&L.type==="oauth"&&!v)X6();let P=v?void 0:t4(A);if(v){if(L.type!=="oauth"||!Y$(L.claustrumScopedCredentialId)||!E||Y$(L.refresh)||L.access!==void 0)X6();N.push({routeId:C,scopedCredentialId:L.claustrumScopedCredentialId,anthropicAccountUuid:E,enabled:L.enabled!==!1,...Y$(L.label)?{label:L.label}:{},...typeof L.addedAt==="number"?{addedAt:L.addedAt}:{}})}let I={id:C,enabled:L.enabled!==!1,runtime:iG(A,E,P),...E!==void 0?{identity:E}:{},...Y$(L.label)?{label:L.label}:{},...P?{credential:P}:{}},k=sG(A.quota,E);if(k)I.quota=k;q.push(I)}if(new Set(q.map((M)=>M.id)).size!==q.length)X6();let D=new Set,_=new Set;for(let M of q){if(M.enabled&&M.identity){if(D.has(M.identity))X6();D.add(M.identity)}if(M.credential){let L=A6(M.credential);if(_.has(L))X6();_.add(L),Object.defineProperty(M,"credential",{enumerable:!1})}for(let L of Object.keys(M.runtime))if(M.runtime[L]===void 0)delete M.runtime[L];if(M.quota===void 0)delete M.quota}KJ(Q);let T=g6(Z.relay);return{accounts:q,settings:Q,mainRouteId:G,custodyRows:N,disabledAccountIdentities:H,...V?{custodyPrimary:V}:{},...typeof T.token==="string"?{relay:{token:T.token}}:{}}}catch{return X6()}}function j1($,Z,J=!0){let X=$.accounts.filter((Y)=>Y.credential!==void 0);if(Z.length!==X.length)X6();for(let Y of X){let z=Z.find((Q)=>Q.id===Y.id);if(z?.stamp!=="bound"||z.invalid||z.torn||z.unbound||z.identity!==Y.identity||z.enabled!==Y.enabled||!z.credential)X6();let G;if(z.credential.type==="oauth"){let{lastRefreshedAt:Q,...K}=z.credential;G=K}else G=z.credential;if(x6(G)!==x6(Y.credential))X6();if(J&&x6(z.quota??null)!==x6(Y.quota??null))X6()}}function WJ($,Z,J,X){let Y=Object.create(null);for(let z of Z.accounts.filter((G)=>G.credential)){let G=J.find((Q)=>Q.id===z.id);if(G?.stamp!=="bound"||G.credentialEpoch===void 0)X6();Y[z.id]={binding:{kind:"local",storageId:$.storageId,rowId:G.id,credentialEpoch:G.credentialEpoch,...G.identity!==void 0?{identity:G.identity}:{}},...z.runtime}}if(X)for(let z of Z.accounts.filter((G)=>!G.credential)){let G=X.rows.find((Q)=>Q.routeId===z.id);if(!G?.accountIdentity||G.accountIdentity!==z.identity)X6();Y[z.id]={binding:{kind:"custody",storageId:$.storageId,routeId:G.routeId,credentialId:G.credentialId,accountIdentity:G.accountIdentity,recordVersion:0},...z.runtime,...z.quota?{quota:z.quota}:{}}}return iX({version:1,storageId:$.storageId,accounts:Y,...Z.relay?{relay:Z.relay}:{}},$.storageId)}function Y8($){return $!==null&&typeof $==="object"&&!Array.isArray($)}async function VJ($){try{return JSON.parse(await uj($,"utf8"))}catch{return}}async function uZ($){try{return await lj($),!1}catch(Z){if(Z instanceof Error&&"code"in Z&&Z.code==="ENOENT")return!0;throw Z}}var nj={routing:["mode"],claudeCache:["enabled","mode"],cacheKeep:["enabled","always","startHour","endHour","subagents"],quota:["enabled","checkIntervalMinutes","minimumRemaining","failClosedOnUnknownQuota"],killswitch:["enabled","main"],claudeFast:["enabled"],prime:["enabled"],logging:["level"],dump:["enabled"]};async function oj($){let Z=await VJ($),J={};if(!Y8(Z)||Z.version!==void 0&&Z.version!==1)return J;for(let[X,Y]of Object.entries(nj)){let z=Z[X];if(!Y8(z))continue;let G={};for(let Q of Y){let K=z[Q];if(K===void 0)continue;if((Q==="minimumRemaining"||X==="killswitch"&&Q==="main")&&Y8(K)){let W={};for(let V of["five_hour","seven_day","5h","1w","scoped"]){if(K[V]===void 0)continue;try{KJ({[X]:{[Q]:{[V]:K[V]}}}),W[V]=K[V]}catch{}}if(Object.keys(W).length)G[Q]=W;continue}try{KJ({[X]:{[Q]:K}}),G[Q]=K}catch{}}if(Object.keys(G).length)J[X]=G}if(Array.isArray(Z.fallbackOn))J.fallbackOn=Z.fallbackOn.filter((X)=>typeof X==="number"&&Number.isInteger(X));return J}function e4($){return typeof $==="string"&&/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test($)}function rj($,Z){let J=new Map;if(!Y8($)||$.version!==void 0&&$.version!==1)return J;let X=new Map,Y=new Set;for(let W of Z.rows){if(W.credentialType!=="oauth"||W.state!=="active"||W.stale||W.unclaimed||!e4(W.accountIdentity))continue;if(X.has(W.accountIdentity))Y.add(W.accountIdentity);X.set(W.accountIdentity,W.routeId)}function z(W,V){if(typeof W!=="string"||!e4(V)||Y.has(V))return;let B=X.get(V);if(B)J.set(W,{routeId:B,accountIdentity:V})}let G=Y8($.claustrum)?$.claustrum:void 0,Q=Y8(G?.primaryAccount)?G.primaryAccount:void 0,K=e4(Q?.accountId)?Q.accountId:$.mainAccountId;z("main",K),z($.mainAccountId,K);for(let W of Array.isArray($.accounts)?$.accounts:[])if(Y8(W)&&W.type==="oauth")z(W.id,W.anthropicAccountUuid);return J}function b2($){return[{path:$.config,name:"pool-config"},{path:$.state,name:"pool-state"}]}function X0($){let Z=zj({provider:"anthropic",configPath:$.paths.config,statePath:$.paths.state,storeLocks:b2($.paths),requireCredentialStamps:!0,quota:$.quota,now:$.now,onStep:$.onStep,hold:$.hold,logger:$.logger,onLockEvent:aV($.onLockEvent),onLockStep:$.onLockStep}),J=$.paths.legacySeedConfig;if(!J)return Z;return{...Z,updateSettings:(X,Y)=>Z.updateSettings(async(z)=>{if(await uZ($.paths.config))Object.assign(z,await oj(J));return X(z)},Y)}}class g extends Error{code;constructor($){super({"invalid-runtime":"Anthropic runtime state is invalid","unsafe-runtime":"Anthropic runtime file is not owner-only regular storage","runtime-io":"Anthropic runtime storage is unavailable","runtime-conflict":"Anthropic runtime observation is older than persisted state","publication-refused":"Anthropic runtime publication was refused"}[$]);this.code=$,this.name="NativeRuntimeError"}}function I6($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function D$($,Z,J=[]){return Z.every((X)=>Object.hasOwn($,X))&&Object.keys($).every((X)=>Z.includes(X)||J.includes(X))}function W$($){return typeof $==="string"&&$.length>0&&$.trim()===$}function W0($){return typeof $==="number"&&Number.isFinite($)&&$>=0}function E6($){return W0($)&&Number.isSafeInteger($)}function V6($,Z,J){return!Object.hasOwn($,Z)||J($[Z])}function V0($){return typeof $==="string"&&/^[a-f0-9]{64}$/.test($)}function o8($){return typeof $==="string"&&/^[a-f0-9]{16}$/.test($)}function eV($){return typeof $==="string"&&/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test($)}function tj($){return P6($)||I6($)&&D$($,["kind","storageId","routeId","credentialId","accountIdentity","recordVersion"])&&$.kind==="custody"&&V0($.storageId)&&W$($.routeId)&&W$($.credentialId)&&W$($.accountIdentity)&&E6($.recordVersion)}function s1($,Z=[]){return I6($)&&D$($,["message","checkedAt"],["nextRetryAt","retryCount","accountIdentity","tokenHash","refreshTokenFingerprint","status","permanent",...Z])&&typeof $.message==="string"&&W0($.checkedAt)&&V6($,"nextRetryAt",W0)&&V6($,"retryCount",E6)&&V6($,"accountIdentity",W$)&&V6($,"tokenHash",V0)&&V6($,"refreshTokenFingerprint",o8)&&V6($,"status",(J)=>E6(J)&&J>=100&&J<=599)&&V6($,"permanent",(J)=>typeof J==="boolean")}function BJ($){return s1($,["credentialFingerprint"])&&I6($)&&V6($,"credentialFingerprint",V0)}function ej($,Z){return I6($)&&D$($,["subject","checkedAt","nextRetryAt"])&&Z.kind==="local"&&Z.identity!==void 0&&H8($.subject)&&$.subject.binding.storageId===Z.storageId&&$.subject.binding.rowId===Z.rowId&&$.subject.binding.credentialEpoch===Z.credentialEpoch&&$.subject.binding.identity===Z.identity&&E6($.checkedAt)&&E6($.nextRetryAt)&&$.nextRetryAt>=$.checkedAt}function $R($){return I6($)&&D$($,["tier","orgType","checkedAt"],["accountIdentity","providerAccountUuid","tokenFingerprint"])&&W$($.tier)&&W$($.orgType)&&W0($.checkedAt)&&V6($,"accountIdentity",W$)&&V6($,"providerAccountUuid",W$)&&V6($,"tokenFingerprint",o8)}function ZR($){return I6($)&&D$($,["count","inputTokens","outputTokens","since"])&&E6($.count)&&E6($.inputTokens)&&E6($.outputTokens)&&W0($.since)}var JR=["credentialValidation","validationRetry","lastUsed","lastRefreshedAt","lastRefreshError","refreshErrorClearedAt","refreshLeaseId","refreshLeaseUntil","refreshLeaseTokenHash","lastQuotaRefreshError","quotaErrorGeneration","quotaErrorClearedAt","quota","quotaCheckedAt","quotaToken","profile","profileToken","prime","authLineageId","primeAuthLineageRefreshTokenFingerprint"];function XR($,Z,J){if(!I6($)||!D$($,["binding"],JR)||!tj($.binding)||$.binding.storageId!==J||($.binding.kind==="local"?$.binding.rowId:$.binding.routeId)!==Z)return!1;let X=$.binding;if(!V6($,"validationRetry",(G)=>ej(G,X)))return!1;if(Object.hasOwn($,"credentialValidation")){let G=$.credentialValidation;if(X.kind!=="local"||X.identity===void 0||!H8(G)||G.binding.storageId!==X.storageId||G.binding.rowId!==X.rowId||G.binding.credentialEpoch!==X.credentialEpoch||G.binding.identity!==X.identity)return!1}for(let G of["lastUsed","lastRefreshedAt","refreshErrorClearedAt","refreshLeaseUntil","quotaErrorClearedAt","quotaCheckedAt"])if(!V6($,G,W0))return!1;for(let G of["refreshLeaseId","authLineageId"])if(!V6($,G,W$))return!1;if(Object.hasOwn($,"profileToken")||!V6($,"refreshLeaseTokenHash",V0)||!V6($,"primeAuthLineageRefreshTokenFingerprint",o8)||!V6($,"quotaToken",(G)=>X.kind==="local"?o8(G):eV(G)&&G===X.accountIdentity)||!V6($,"quotaErrorGeneration",E6)||!V6($,"profile",$R)||!V6($,"prime",ZR)||!V6($,"lastRefreshError",X.kind==="local"?BJ:s1)||!V6($,"lastQuotaRefreshError",s1))return!1;let Y=$.binding.kind==="local"?$.binding.identity:$.binding.accountIdentity;for(let G of[$.profile,$.lastRefreshError,$.lastQuotaRefreshError])if(I6(G)&&(G.accountIdentity!==void 0&&G.accountIdentity!==Y||G.providerAccountUuid!==void 0&&G.providerAccountUuid!==Y))return!1;if(Object.hasOwn($,"quota")){if($.binding.kind!=="custody")return!1;try{if(x$($.quota).accountIdentity!==Y)return!1}catch{return!1}}let z=[["lastRefreshError","refreshErrorClearedAt"],["lastQuotaRefreshError","quotaErrorClearedAt"]];for(let[G,Q]of z){let K=$[G],W=$[Q];if((G==="lastRefreshError"&&X.kind==="local"?BJ:s1)(K)&&W0(W)&&K.checkedAt<=W)return!1}return!0}function iX($,Z){if(!I6($)||!D$($,["version","storageId","accounts"],["relay"])||$.version!==1||!V0(Z)||$.storageId!==Z||!I6($.accounts)||!V6($,"relay",(X)=>I6(X)&&D$(X,["token"])&&typeof X.token==="string"))throw new g("invalid-runtime");let J=Object.create(null);for(let[X,Y]of Object.entries($.accounts)){if(!W$(X)||!XR(Y,X,Z))throw new g("invalid-runtime");J[X]=structuredClone(Y)}return{version:1,storageId:Z,accounts:J,...I6($.relay)&&typeof $.relay.token==="string"?{relay:{token:$.relay.token}}:{}}}function YR($){return $ instanceof Error&&"code"in $&&$.code==="ENOENT"}function $B($){if(!vj($))throw new g("unsafe-runtime")}async function h$($,Z){if($B($),!V0(Z))throw new g("invalid-runtime");let J=mG.O_NOFOLLOW??0;try{for(let X=0;X<2;X++){let Y=await Ej($);if(!Y.isFile()||(Y.mode&511)!==384||typeof process.geteuid==="function"&&Y.uid!==process.geteuid())throw new g("unsafe-runtime");let z=await iV($,mG.O_RDONLY|J);try{let G=await z.stat();if(!G.isFile()||(G.mode&511)!==384||typeof process.geteuid==="function"&&G.uid!==process.geteuid())throw new g("unsafe-runtime");if(!J&&(G.dev!==Y.dev||G.ino!==Y.ino)){if(X===0)continue;throw new g("unsafe-runtime")}let Q;try{Q=new TextDecoder("utf-8",{fatal:!0}).decode(await z.readFile())}catch(K){if(K instanceof TypeError)throw new g("invalid-runtime");throw K}return{status:"ready",state:iX(J1(Q),Z)}}finally{await z.close()}}throw new g("unsafe-runtime")}catch(X){if(YR(X))return{status:"missing"};if(X instanceof g)throw X;if(X instanceof SyntaxError)throw new g("invalid-runtime");throw new g("runtime-io")}}function L$($,Z){return $.storageId===Z.storageId&&$.rowId===Z.rowId&&$.credentialEpoch===Z.credentialEpoch&&$.identity===Z.identity}function zR($,Z,J){let X=!1;for(let[Y,z]of Object.entries(Z.accounts)){let G=$.accounts[Y];if(!G)continue;if(G.binding.kind!==z.binding.kind)continue;if(G.binding.kind==="local"&&z.binding.kind==="local"){if(z.binding.credentialEpoch<G.binding.credentialEpoch)throw new g("runtime-conflict");if(z.binding.credentialEpoch>G.binding.credentialEpoch)continue;if(G.binding.identity!==z.binding.identity){if(!J||X||Y!==J.predecessor.rowId||G.binding.identity!==void 0||!L$(G.binding,J.predecessor)||!L$(z.binding,J.proof.binding))throw new g("runtime-conflict");X=!0}}else if(G.binding.kind==="custody"&&z.binding.kind==="custody"){if(G.binding.credentialId!==z.binding.credentialId||G.binding.accountIdentity!==z.binding.accountIdentity)continue;if(z.binding.recordVersion<G.binding.recordVersion)throw new g("runtime-conflict")}let Q=["quotaErrorGeneration","quotaErrorClearedAt","refreshErrorClearedAt"];for(let K of Q){let W=G[K],V=z[K];if(W!==void 0&&(V===void 0||V<W))throw new g("runtime-conflict")}if(G.profile&&z.profile&&z.profile.checkedAt<G.profile.checkedAt)throw new g("runtime-conflict");if(G.quota&&z.quota&&r6(x$(z.quota))<r6(x$(G.quota)))throw new g("runtime-conflict");for(let[K,W]of[["lastRefreshError","refreshErrorClearedAt"],["lastQuotaRefreshError","quotaErrorClearedAt"]]){let V=G[K],B=z[K],H=z[W],q=K==="lastRefreshError"&&z.binding.kind==="local"?BJ:s1;if(q(V)&&(!q(B)?!W0(H)||H<V.checkedAt:B.checkedAt<V.checkedAt))throw new g("runtime-conflict")}}if(J&&!X)throw new g("publication-refused")}async function HJ($,Z,J,X={}){return ZB($,Z,J,X)}async function GR($,Z,J,X){return JB($,Z,J,{beforeRename:X.beforeRename})}async function ZB($,Z,J,X,Y){let z=await JB($,Z,J,{beforeRename:async()=>{return await X.beforeRename?.(),"publish"},beforePublish:X.beforePublish,afterRename:X.afterRename},Y);if(z.status!=="published")throw new g("publication-refused");return z.state}async function JB($,Z,J,X,Y){$B($);try{return await wj(hG($),{recursive:!0,mode:448}),await p6($,{name:"native-runtime",ttlMs:1e4,timeoutMs:15000,renew:!0},async(z)=>{let G=await h$($,Z),Q=G.status==="ready"?G.state:{version:1,storageId:Z,accounts:{}},K=iX(await J(structuredClone(Q)),Z);zR(Q,K,Y);let W=`${JSON.stringify(K,null,2)}
-`,V=yj(hG($),`${fj($)}.native-runtime.${Ij()}.partial`),B=!1;try{let H=await iV(V,"wx",384);B=!0;try{await H.writeFile(W,"utf8"),await H.sync()}finally{await H.close()}let q;try{q=await X.beforeRename()}catch{throw new g("publication-refused")}try{await z.assertOwned()}catch{throw new g("publication-refused")}if(q==="skip")return{status:"skipped"};try{if(await X.beforePublish?.(),X.beforePublish)await z.assertOwned()}catch{throw new g("publication-refused")}await kj(V,$),B=!1;try{await X.afterRename?.()}catch{throw new g("publication-refused")}return{status:"published",state:K}}finally{if(B)await bj(V,{force:!0})}})}catch(z){if(z instanceof g)throw z;throw new g("runtime-io")}}function K8($){return I6($)&&D$($,[],["accessFingerprint","expires","lastRefreshedAt"])&&V6($,"accessFingerprint",(Z)=>Z===void 0||o8(Z))&&V6($,"expires",(Z)=>Z===void 0||E6(Z))&&V6($,"lastRefreshedAt",E6)}function W2($,Z){return["accessFingerprint","expires","lastRefreshedAt"].every((J)=>Object.hasOwn($,J)===Object.hasOwn(Z,J)&&$[J]===Z[J])}function XB($,Z){let J=()=>new g("publication-refused"),X=structuredClone(Z),Y=X.context;if(!["persisted","validation-observed"].includes(X.status)||X.bootstrap!=="resolved"||!("identity"in X)||!eV(X.identity)||!P6(X.binding)||X.binding.storageId!==$.storageId||X.binding.identity!==void 0&&X.binding.identity!==X.identity||!V0(X.credentialFingerprint)||!K8(X.credentialVersion)||!Y||!I6(Y.subject)||!P6(Y.subject.binding)||!L$(Y.subject.binding,X.binding)||Y.subject.credentialFingerprint!==X.credentialFingerprint||!K8(Y.subject.version)||!W2(Y.subject.version,X.credentialVersion)||![Y.refreshErrorClearedAt,Y.quotaErrorClearedAt,Y.quotaErrorGeneration].every((Q)=>Q===null||E6(Q)))throw J();let z={...X.binding,identity:X.identity},G;if(X.status==="persisted"){if(G={binding:z,credentialFingerprint:X.successorFingerprint,version:X.successorVersion},!H8(G)||!I6(X.committed)||!D$(X.committed,["credentialFingerprint","version"])||X.committed.credentialFingerprint!==G.credentialFingerprint||!K8(X.committed.version)||!W2(X.committed.version,{...G.version}))throw J()}else if(X.status==="validation-observed"){if(X.binding.identity!==X.identity)throw J();G={binding:z,credentialFingerprint:X.credentialFingerprint,version:X.credentialVersion}}if(!H8(G))throw J();return{context:Y,proof:G}}function QR($,Z){let J=XB($,Z),X=J.context.runtimeBinding;if(!P6(X)||X.identity!==void 0||!L$(X,{...J.proof.binding,identity:void 0}))throw new g("publication-refused");return{...J,predecessor:X}}function sX($,Z){return($?.refreshErrorClearedAt??null)===Z.refreshErrorClearedAt&&($?.quotaErrorClearedAt??null)===Z.quotaErrorClearedAt&&($?.quotaErrorGeneration??null)===Z.quotaErrorGeneration}function KR($,Z){let{predecessor:J,context:X,proof:Y}=Z;if($?.binding.kind!=="local"||!L$($.binding,J)||!sX($,X))throw new g("publication-refused");let z=(K,W)=>{let V=K===void 0?W?.checkedAt:Math.max(K,W?.checkedAt??K);if(V!==void 0&&!E6(V))throw new g("publication-refused");return V},G=z($.refreshErrorClearedAt,$.lastRefreshError),Q=z($.quotaErrorClearedAt,$.lastQuotaRefreshError);return{binding:Y.binding,credentialValidation:Y,...G!==void 0?{refreshErrorClearedAt:G}:{},...Q!==void 0?{quotaErrorClearedAt:Q}:{},...$.quotaErrorGeneration!==void 0?{quotaErrorGeneration:$.quotaErrorGeneration}:{}}}async function WR($,Z,J={}){try{$={...$};let X=QR($,Z);return await aX($,X.proof,(Y)=>X8(X.proof,X.proof.binding,Y),(Y)=>KR(Y,X),X,void 0,J)}catch(X){if(X instanceof g)throw X;throw new g("publication-refused")}}function VR($,Z){let{context:J,proof:X}=Z;if(!sX($,J))throw new g("publication-refused");if(!$){if(J.runtimeBinding!==null)throw new g("publication-refused");return{binding:X.binding,credentialValidation:X}}if($.binding.kind!=="local"||!P6(J.runtimeBinding)||!L$($.binding,J.runtimeBinding)||!L$($.binding,X.binding))throw new g("publication-refused");return{...$,credentialValidation:X}}async function BR($,Z,J={}){try{$={...$};let X=XB($,Z),{context:Y,proof:z}=X;if(Y.subject.binding.identity!==z.binding.identity||Y.runtimeBinding!==null&&(!P6(Y.runtimeBinding)||!L$(Y.runtimeBinding,z.binding)))throw new g("publication-refused");return await aX($,z,(G)=>X8(z,z.binding,G),(G)=>VR(G,X),void 0,void 0,J)}catch(X){if(X instanceof g)throw X;throw new g("publication-refused")}}function HR($){return K8($)&&o8($.accessFingerprint)&&E6($.expires)&&$.expires>0}function dZ($){let Z=new WeakSet,J=(X,Y)=>{if(X===null||X===void 0||["string","number","boolean"].includes(typeof X))return X;if(typeof X!=="object"||gj.isProxy(X)||Y>32||Z.has(X))throw new g("publication-refused");let z=Object.getPrototypeOf(X);if(z!==Object.prototype&&z!==null)throw new g("publication-refused");Z.add(X);try{let G=Object.getOwnPropertyDescriptors(X),Q=Object.create(null);for(let K of Reflect.ownKeys(G)){if(typeof K!=="string")throw new g("publication-refused");let W=G[K];if(!W||!Object.hasOwn(W,"value"))throw new g("publication-refused");Object.defineProperty(Q,K,{value:J(W.value,Y+1),enumerable:!0,writable:!0,configurable:!0})}return Q}finally{Z.delete(X)}};try{return J($,0)}catch{throw new g("publication-refused")}}function YB($){try{return UR(dZ($))}catch{throw new g("publication-refused")}}function UR($){if($.status!=="failed"&&$.status!=="persisted")return{kind:"none",reason:"not-a-failure"};if($.context===void 0)return{kind:"none",reason:"no-context"};if(!I6($.context))throw new g("publication-refused");if($.status==="failed"&&(!I6($.failure)||!D$($.failure,["kind","classification"],["status","retryAfter"])||!W$($.failure.kind)||!["transient","invalid-grant","permanent"].includes($.failure.classification)||$.failure.status!==void 0&&(!E6($.failure.status)||$.failure.status<100||$.failure.status>599)||$.failure.retryAfter!==void 0&&!W0($.failure.retryAfter)||typeof $.persisted!=="boolean"))throw new g("publication-refused");if($.status==="failed"&&$.persisted&&!$.committed)return{kind:"none",reason:"missing-committed"};if($.bootstrap==="resolved"||$.status==="failed"&&($.failure.kind==="caller-hook"||!$.persisted&&!["provider","validation"].includes($.failure.kind)))return{kind:"none",reason:"not-attributable"};let Z=$.context;if(!P6($.binding)||!V0($.credentialFingerprint)||!K8($.credentialVersion)||!I6(Z.subject)||!P6(Z.subject.binding)||!L$(Z.subject.binding,$.binding)||Z.subject.credentialFingerprint!==$.credentialFingerprint||!K8(Z.subject.version)||!W2(Z.subject.version,$.credentialVersion)||Z.runtimeBinding!==null&&!P6(Z.runtimeBinding)||![Z.refreshErrorClearedAt,Z.quotaErrorClearedAt,Z.quotaErrorGeneration].every((K)=>K===null||E6(K)))throw new g("publication-refused");let J=$.status==="persisted"||$.persisted,X=$.committed;if(J&&(!I6(X)||!D$(X,["credentialFingerprint","version"])||!V0(X.credentialFingerprint)||!HR(X.version)))throw new g("publication-refused");if($.status==="persisted"&&(!K8($.successorVersion)||$.successorFingerprint!==X?.credentialFingerprint||!W2($.successorVersion,{...X?.version})))throw new g("publication-refused");if($.status==="failed"&&!J&&$.committed!==void 0)throw new g("publication-refused");let Y=J?X:{credentialFingerprint:$.credentialFingerprint,version:$.credentialVersion};if(!Y)throw new g("publication-refused");let z={binding:{...$.binding},credentialFingerprint:Y.credentialFingerprint,version:{...Y.version}},G=J?"committed":"captured";if(J&&$.bootstrap==="unsupported-credential")return{kind:"unsupported-successor",target:"committed",subject:z};if(J&&z.binding.identity!==void 0||$.status==="failed"&&$.failure.kind==="validation"){if(!H8(z))throw new g("publication-refused");return{kind:"validation-retry",target:G,subject:z}}if(J)return{kind:"refresh-error",target:G,subject:z,permanent:!1,message:"Local account-check recovery required"};if($.status!=="failed")throw new g("publication-refused");let Q=$.failure.status;if(Q!==void 0&&(!Number.isInteger(Q)||Q<100||Q>599))throw new g("publication-refused");return{kind:"refresh-error",target:G,subject:z,permanent:$.failure.classification==="invalid-grant"&&Q===400,message:"Local refresh failed",...Q!==void 0?{status:Q}:{}}}function NR($,Z){if(Z?.type!=="oauth"||!W$(Z.refresh))return!1;let J=$.version;return $.credentialFingerprint===A6({type:"oauth",refresh:Z.refresh})&&(J.accessFingerprint===void 0?!Object.hasOwn(Z,"access"):W$(Z.access)&&J.accessFingerprint===p$(Z.access))&&(J.expires===void 0?!Object.hasOwn(Z,"expires"):J.expires===Z.expires)&&Object.hasOwn(J,"lastRefreshedAt")===Object.hasOwn(Z,"lastRefreshedAt")&&J.lastRefreshedAt===Z.lastRefreshedAt}async function LR($,Z,J,X={}){let Y,z=(G)=>{throw Y=G,new g("publication-refused")};try{$=dZ($);let G=dZ(Z);J=dZ(J);let Q=YB(G);if(Q.kind==="none")return{status:"skipped",reason:Q.reason};let{subject:K}=Q,W=G.context;if(!W||K.binding.storageId!==$.storageId||!E6(J.checkedAt)||J.nextRetryAt!==void 0&&(!E6(J.nextRetryAt)||J.nextRetryAt<J.checkedAt)||J.retryCount!==void 0&&!E6(J.retryCount)||(Q.kind==="validation-retry"||Q.kind==="refresh-error"&&!Q.permanent)&&J.nextRetryAt===void 0)throw new g("publication-refused");let V=await aX($,K,(B)=>NR(K,B),(B)=>{if(!B&&W.runtimeBinding!==null||B&&(B.binding.kind!=="local"||!P6(W.runtimeBinding)||!L$(B.binding,W.runtimeBinding)||!L$(B.binding,K.binding)))z("entry-binding");if(!sX(B,W))z("reset-context");if(B?.refreshErrorClearedAt!==void 0&&J.checkedAt<=B.refreshErrorClearedAt)throw new g("publication-refused");let H=B?{...B}:{binding:K.binding};if(Q.kind==="unsupported-successor"){let q=!1;if(H.lastRefreshError&&H.lastRefreshError.checkedAt<=J.checkedAt)delete H.lastRefreshError,q=!0;if(H.validationRetry&&H.validationRetry.checkedAt<=J.checkedAt)delete H.validationRetry,q=!0;if(q)H.refreshErrorClearedAt=Math.max(H.refreshErrorClearedAt??0,J.checkedAt)}else if(Q.kind==="validation-retry"){let q=J.nextRetryAt;if(q===void 0)throw new g("publication-refused");let N=(O)=>L$(O.binding,K.binding)&&O.credentialFingerprint===K.credentialFingerprint&&W2({...O.version},{...K.version});if(B?.credentialValidation&&N(B.credentialValidation))z("already-proven");if(B?.validationRetry&&N(B.validationRetry.subject)&&(B.validationRetry.checkedAt>J.checkedAt||B.validationRetry.checkedAt===J.checkedAt&&B.validationRetry.nextRetryAt!==J.nextRetryAt))z("older-than-stored");H.validationRetry={subject:Q.subject,checkedAt:J.checkedAt,nextRetryAt:q}}else{if(B?.lastRefreshError&&J.checkedAt<B.lastRefreshError.checkedAt)z("older-than-stored");H.lastRefreshError={message:Q.message,credentialFingerprint:K.credentialFingerprint,permanent:Q.permanent,checkedAt:J.checkedAt,...K.binding.identity!==void 0?{accountIdentity:K.binding.identity}:{},...Q.status!==void 0?{status:Q.status}:{},...J.nextRetryAt!==void 0?{nextRetryAt:J.nextRetryAt}:{},...J.retryCount!==void 0?{retryCount:J.retryCount}:{}}}return H},void 0,z,X);return{status:"published",attribution:Q,state:V}}catch(G){if(Y&&G instanceof g&&G.code==="publication-refused")return{status:"superseded",reason:Y};if(G instanceof g)throw G;throw new g("publication-refused")}}async function aX($,Z,J,X,Y,z,G={}){try{let Q=X0({paths:$,quota:A$}),[K,W]=b2($),V=async()=>{let B=await Q.read();if(B.status!=="ready")throw new g("publication-refused");let H=B.rows.find((q)=>q.id===Z.binding.rowId);if(!H||!C$(Z.binding,$,H))throw z?.("row-binding"),new g("publication-refused");if(!J(H.credential))throw z?.("row-credential"),new g("publication-refused")};return await p6(K.path,{...i6,name:K.name},async(B)=>p6(W.path,{...i6,name:W.name},async(H)=>{return await V(),ZB($.runtime,$.storageId,(q)=>{let N=Z.binding.rowId;return q.accounts[N]=X(q.accounts[N]),q},{beforeRename:async()=>{await V(),await B.assertOwned(),await H.assertOwned()},beforePublish:G.beforePublish},Y)}))}catch(Q){if(Q instanceof g)throw Q;throw new g("publication-refused")}}function _6($){if(!$||$.enabled===!1)return!1;if($.source==="vault"||$.credentialId)return $.state==="active";if($.claustrumScopedCredentialId)return $.claustrumScopedState==="active";return!0}function X3($){let Z=$.state;if($.source==="vault"){if($.enabled===!1)return"turned off";if(Z==="needs_reauth")return"needs sign-in in the vault";if(Z!=="active")return"unavailable in the vault"}if(Z===void 0||Z==="")return"";if(Z==="unsupported-access")return"unsupported credential: the saved access token is not a Claude OAuth token; sign in to this account again";return Z}function UJ($){let Z=new Set;function J(X){if(X===null||typeof X==="string"||typeof X==="boolean"||X===void 0)return X;if(typeof X==="number"&&Number.isFinite(X))return X;if(!X||typeof X!=="object"||vX.isProxy(X)||Z.has(X))throw new g("publication-refused");Z.add(X);try{if(Array.isArray(X)){if(Reflect.ownKeys(X).some((z)=>typeof z!=="string"||z!=="length"&&!/^(0|[1-9][0-9]*)$/.test(z)))throw new g("publication-refused");return Array.from({length:X.length},(z,G)=>{let Q=Object.getOwnPropertyDescriptor(X,String(G));if(!Q||!("value"in Q))throw new g("publication-refused");return J(Q.value)})}if(Object.getPrototypeOf(X)!==Object.prototype&&Object.getPrototypeOf(X)!==null)throw new g("publication-refused");let Y={};for(let z of Reflect.ownKeys(X)){let G=Object.getOwnPropertyDescriptor(X,z);if(typeof z!=="string"||!G||!("value"in G)||z==="__proto__")throw new g("publication-refused");Y[z]=J(G.value)}return Y}finally{Z.delete(X)}}return J($)}function zB($){let Z=UJ($);if(!Z||Object.keys(Z).some((J)=>!["quota","profile","lastUsed","lastQuotaRefreshError","quotaErrorClearedAt","quotaErrorGeneration","prime","authLineageId"].includes(J)))throw new g("publication-refused");return Z}function GB($,Z){let{quota:J,...X}=Z,Y={...$,...X};if(Z.lastUsed!==void 0){if(!Number.isFinite(Z.lastUsed)||Z.lastUsed<0)throw new g("publication-refused");Y.lastUsed=Math.max($.lastUsed??0,Z.lastUsed)}if(J){let z=J0(J);Y.quota=A$.merge($.quota,z),Y.quotaCheckedAt=J.checkedAt}if(Z.quotaErrorClearedAt!==void 0)Y.quotaErrorClearedAt=Math.max($.quotaErrorClearedAt??0,Z.quotaErrorClearedAt);if(Z.quotaErrorGeneration!==void 0)Y.quotaErrorGeneration=Math.max($.quotaErrorGeneration??0,Z.quotaErrorGeneration);if($.lastQuotaRefreshError&&Z.lastQuotaRefreshError&&Z.lastQuotaRefreshError.checkedAt<$.lastQuotaRefreshError.checkedAt)Y.lastQuotaRefreshError=$.lastQuotaRefreshError;if(Y.lastQuotaRefreshError&&Y.lastQuotaRefreshError.checkedAt<=(Y.quotaErrorClearedAt??-1))delete Y.lastQuotaRefreshError;return Y}function QB($,Z,J,X){let Y=Error("OAuth quota check failed");if($&&typeof $==="object"&&!vX.isProxy($)){for(let W of["status","retryAfter"]){let V=Object.getOwnPropertyDescriptor($,W)?.value;if(typeof V==="number"&&Number.isFinite(V))Object.assign(Y,{[W]:V})}let Q=Object.getOwnPropertyDescriptor($,"code")?.value,K=Object.getOwnPropertyDescriptor($,"message")?.value;if(s$({code:typeof Q==="string"?Q:"",message:typeof K==="string"?K:""}))Object.assign(Y,{code:"ECONNRESET"})}let z=Object.getOwnPropertyDescriptor(Y,"status")?.value;if(z===401||z===403)return;return{...w9({error:Y,accountIdentity:Z,now:J,previous:X}),...typeof z==="number"&&Number.isFinite(z)?{status:z}:{}}}class KB extends Error{status;retryAfter;code;constructor($,Z,J){super(`OAuth metadata read failed${$!==void 0?`: ${$}`:""}`);this.status=$,this.retryAfter=Z,this.code=J,this.name="NativeAccountReadError"}}function WB($,Z){let J={};if($&&typeof $==="object"&&!vX.isProxy($))for(let G of["status","retryAfter","code","message"])J[G]=Object.getOwnPropertyDescriptor($,G)?.value;let X=typeof J.status==="number"&&Number.isFinite(J.status)?J.status:void 0,Y=J.retryAfter,z=X===void 0&&s$({code:typeof J.code==="string"?J.code:"",message:typeof J.message==="string"?J.message:""})?"ECONNRESET":void 0;return new KB(Z??X,typeof Y==="number"&&Number.isFinite(Y)?Y:void 0,z)}var MZ="oauth:anthropic";function F7($){let J=$.claustrum?.primaryAccount;if(typeof $.mainAccountId!=="string"||!$.mainAccountId||typeof J?.credentialId!=="string"||!J.credentialId||typeof J.accountId!=="string"||!J.accountId)return;return{routeId:$.mainAccountId,credentialId:J.credentialId,accountIdentity:J.accountId}}function NJ($,Z){if(!Z)return;return $?.rows.find((J)=>J.routeId===Z.routeId&&J.accountIdentity===Z.accountIdentity&&(J.credentialId===Z.credentialId||J.aliases?.includes(Z.credentialId)))}var qR={routing:["mode"],refresh:["enabled","intervalMinutes","refreshBeforeExpiryMinutes"],quota:["enabled","checkIntervalMinutes","refreshEveryNRequests","minimumRemaining","failClosedOnUnknownQuota","showToasts"],quotaHeaderFeed:["enabled"],claudeCache:["enabled","mode"],dump:["enabled"],logging:["level"],claudeFast:["enabled"],thinkingBinding:["prefixMismatchBehavior"],costZeroing:["enabled"],cacheKeep:["enabled","always","startHour","endHour","subagents"],prime:["enabled"],relay:["enabled","url","fallbackToDirect","transport"],claustrum:["mode","disabledAccountIdentities"],killswitch:["enabled","main","accounts"]};function VB($){let Z={};if(typeof $.mainAccountId==="string")Z.mainAccountId=$.mainAccountId;if(Array.isArray($.nativeAccountOrder))Z.nativeAccountOrder=$.nativeAccountOrder.filter((X)=>typeof X==="string");if(Array.isArray($.fallbackOn))Z.fallbackOn=$.fallbackOn.filter((X)=>Number.isInteger(X));for(let[X,Y]of Object.entries(qR)){let z=$[X];if(!z||typeof z!=="object"||Array.isArray(z))continue;let G={};for(let Q of Y){let K=Object.getOwnPropertyDescriptor(z,Q)?.value;if(K!==void 0)G[Q]=structuredClone(K)}Z[X]=G}let J=$.claustrum;if(J?.primaryAccount){let X=Z.claustrum;X.primaryAccount={credentialId:J.primaryAccount.credentialId,accountId:J.primaryAccount.accountId,state:J.primaryAccount.state}}return Z}function aG($,Z){let J=$?.binding;return J?.kind==="local"&&J.storageId===Z.storageId&&J.rowId===Z.rowId&&J.identity===Z.identity&&J.credentialEpoch===Z.credentialEpoch}function nG($,Z){let J=$.runtime?.accounts[Z.routeId],X=J?.binding;return X?.kind==="custody"&&X.storageId===$.paths.storageId&&X.routeId===Z.routeId&&X.accountIdentity===Z.accountIdentity&&(X.credentialId===Z.credentialId||Z.aliases?.includes(X.credentialId))?J:void 0}function oG($){if(!$)return;return{message:"OAuth operation failed",checkedAt:$.checkedAt,nextRetryAt:$.nextRetryAt,retryCount:$.retryCount,accountIdentity:$.accountIdentity,status:$.status,permanent:$.permanent}}function rG($){return{lastUsed:$?.lastUsed,lastRefreshedAt:$?.lastRefreshedAt,lastRefreshError:oG($?.lastRefreshError),lastQuotaRefreshError:oG($?.lastQuotaRefreshError),quotaErrorClearedAt:$?.quotaErrorClearedAt,quotaErrorGeneration:$?.quotaErrorGeneration,refreshErrorClearedAt:$?.refreshErrorClearedAt,profile:$?.profile&&{tier:$.profile.tier,orgType:$.profile.orgType,checkedAt:$.profile.checkedAt,accountIdentity:$.profile.accountIdentity,providerAccountUuid:$.profile.providerAccountUuid},prime:$?.prime&&{...$.prime}}}function BB($,Z,J){let X=J?.binding;if(X?.kind==="local"&&X.credentialEpoch!==Z.credentialEpoch||Z.type!=="oauth"||Z.torn!==!0||!_6(Z)||Z.disabledReason!==void 0||Z.credential===void 0||Z.staged!==void 0||Z.invalid!==void 0||Z.unbound===!0||Z.stamp!=="bound"||Z.credentialEpoch===void 0)return!1;let{torn:Y,...z}=Z;return C$({kind:"local",storageId:$.storageId,rowId:Z.id,credentialEpoch:Z.credentialEpoch,...Z.identity!==void 0?{identity:Z.identity}:{}},$,z)}function OR($,Z,J,X,Y){let z=VB(J).mainAccountId,G=Z.find((Q)=>(Q.id===z?"main":Q.id)===X);return G!==void 0&&BB($,G,Y?.accounts[G.id])}function DR($){let Z=VB($.settings),J=Z.claustrum?.mode==="claustrum"?"claustrum":"local",X=[];for(let V of $.rows){if(J==="claustrum")continue;let B=V.credentialEpoch!==void 0?{kind:"local",storageId:$.paths.storageId,rowId:V.id,credentialEpoch:V.credentialEpoch,...V.identity!==void 0?{identity:V.identity}:{}}:void 0,H=B&&C$(B,$.paths,V)?B:void 0,q=$.runtime?.accounts[V.id],N=H&&aG(q,H)?q:void 0,O=V.id===Z.mainAccountId?"main":V.id,U=V.type==="oauth"&&V.quota!==void 0?x$(V.quota):void 0,D=V.identity!==void 0&&U?.accountIdentity===V.identity?U:void 0,_=rG(N);if(N?.lastRefreshError?.credentialFingerprint&&(!V.credential||N.lastRefreshError.credentialFingerprint!==A6(V.credential)))delete _.lastRefreshError;X.push({id:O,type:V.type,source:"local",...V.credential?.type==="oauth"&&V.credential.access&&!V.credential.access.startsWith("sk-ant-oat")?{state:"unsupported-access"}:{},enabled:V.enabled&&(V.candidate||BB($.paths,V,$.runtime?.accounts[V.id])),label:V.label,addedAt:V.addedAt,accountIdentity:V.identity,binding:H,..._,...D?{quota:D}:{},...V.credential?.type==="api"?{baseURL:V.credential.baseURL,authHeader:V.credential.authHeader}:{}})}if(J==="claustrum"){let V=NJ($.roster,F7(Z));for(let B of $.roster?.rows??[]){if(B.credentialType!=="oauth")continue;let H=nG($,B);X.push({id:B===V?"main":B.routeId,type:"oauth",source:"vault",enabled:B.enabled,label:B.label,addedAt:B.addedAt,accountIdentity:B.accountIdentity,credentialId:B.credentialId,state:B.state,...rG(H),...H?.quota?{quota:x$(H.quota)}:{}})}}if(Array.isArray(Z.nativeAccountOrder)){let V=Z.nativeAccountOrder;X.sort((B,H)=>{let q=V.indexOf(B.id),N=V.indexOf(H.id);return(q<0?V.length:q)-(N<0?V.length:N)})}let Y=X.filter((V)=>V.id!=="main").map((V)=>V.type==="oauth"?{id:V.id,type:"oauth",refresh:"",label:V.label,enabled:V.enabled,addedAt:V.addedAt,anthropicAccountUuid:V.accountIdentity,claustrumScopedCredentialId:V.credentialId,claustrumScopedState:V.state,authLineageId:V.binding?JSON.stringify(V.binding):V.credentialId?JSON.stringify([V.credentialId,V.accountIdentity]):void 0,quota:V.quota,profile:V.profile,prime:V.prime,lastUsed:V.lastUsed,lastRefreshedAt:V.lastRefreshedAt,lastRefreshError:V.lastRefreshError,lastQuotaRefreshError:V.lastQuotaRefreshError}:{id:V.id,type:"api",label:V.label,enabled:V.enabled,addedAt:V.addedAt,baseURL:V.baseURL??"",authHeader:V.authHeader,lastUsed:V.lastUsed}),z={version:1,...Z,accounts:Y};if(z.relay)z.relay={...z.relay,tokenConfigured:Boolean($.runtime?.relay?.token)};let G=X.find((V)=>V.id==="main"),Q=NJ($.roster,F7(Z)),K=G?.source==="local"&&G.binding?$.runtime?.accounts[G.binding.rowId]:Q?nG($,Q):void 0,W=G?.source==="local"&&G.binding&&!aG(K,G.binding)?void 0:K;if(G){if(G.source==="vault"&&G.credentialId&&G.accountIdentity)z.claustrum={...z.claustrum,primaryAccount:{credentialId:G.credentialId,accountId:G.accountIdentity,state:G.state??"cold",enabled:G.enabled}};z.mainAccountId=G.accountIdentity??G.binding?.rowId,z.main={type:"opencode",provider:"anthropic",profile:G.profile},z.quota={...z.quota,mainQuota:G.quota,mainQuotaCheckedAt:W?.quotaCheckedAt??G.quota?.checkedAt,mainQuotaToken:G.accountIdentity,mainLastQuotaApiError:G.lastQuotaRefreshError,mainQuotaErrorClearedAt:W?.quotaErrorClearedAt,mainQuotaErrorGeneration:W?.quotaErrorGeneration},z.refresh={...z.refresh,mainLastRefreshError:G.lastRefreshError,mainRefreshErrorClearedAt:W?.refreshErrorClearedAt},z.prime={...z.prime,main:G.prime,mainAuthLineageId:W?.authLineageId}}return structuredClone({mode:J,settings:Z,accounts:X,policyStorage:z})}function tG($,Z){let J=$[Z];return J&&typeof J==="object"&&!Array.isArray(J)?J:{}}var _R=["five_hour","seven_day","5h","1w","scoped"];function HB($){if(!$||typeof $!=="object"||Array.isArray($))return;let Z=$,J={};for(let X of _R){let Y=Z[X];if(typeof Y==="number"&&Number.isFinite(Y))J[X]=Y}return J}function MR($){if(!$||typeof $!=="object"||Array.isArray($))return;let Z={};for(let[J,X]of Object.entries($)){let Y=HB(X);if(Y)Z[J]=Y}return Z}function UB($){let Z=tG($,"killswitch"),J=tG($,"logging").level;return{killswitchEnabled:Z.enabled===!0,killswitchMain:HB(Z.main),killswitchAccounts:MR(Z.accounts),logLevel:typeof J==="string"?J:void 0}}function jR($,Z){let J=UB(Z);if(J.killswitchEnabled!==$.killswitchEnabled)n.info("commands","killswitch changed",{enabled:J.killswitchEnabled});if(JSON.stringify(J.killswitchMain)!==JSON.stringify($.killswitchMain)||JSON.stringify(J.killswitchAccounts)!==JSON.stringify($.killswitchAccounts))n.info("commands","killswitch thresholds changed",{thresholds:J.killswitchMain??J.killswitchAccounts});let X=g9(J.logLevel);if(X&&X!==g9($.logLevel))NB(X)}function NB($){if(dq()===$)return!1;return n.info("commands","log level changed",{level:$}),uq($),!0}function jZ($,Z){n.info("commands",$,{id:Z.id,label:Z.label,...$==="account enabled"||$==="account disabled"?{enabled:$==="account enabled"}:{}})}function RR($){n.info("commands","account added",{id:$.id,label:$.label,type:$.type==="api"?"apikey":"oauth"})}var LJ=60000,TR=4*LJ,$9=new Map,RZ=new Map;function Z9($){return typeof $==="object"&&$!==null&&!Array.isArray($)}class LB{transport;key;#$=[];#Z;constructor($,Z){this.transport=$,this.key=Z}refresh($){if(this.#Z)return this.#Z;for(let[J,X]of RZ)if($-X>=LJ)RZ.delete(J);let Z=RZ.get(this.key);if(Z!==void 0&&$-Z<LJ)return Promise.resolve();return RZ.set(this.key,$),this.#Z=(async()=>{try{let J=await this.transport.getUsage();if(!Z9(J)||!Array.isArray(J.result)||J.error!==void 0)throw Error("unavailable insula usage");this.#$=J.result.filter((X)=>Z9(X)&&typeof X.provider==="string")}catch{this.#$=[]}})().finally(()=>{this.#Z=void 0}),this.#Z}current($,Z,J){for(let X of this.#$){if(X.provider!==$||typeof X.account!=="string"||X.account.trim()!==Z)continue;if(X.stale!==void 0||X.errorClass!==void 0||!Z9(X.usage))continue;let Y=typeof X.fetchedAt==="string"?Date.parse(X.fetchedAt):Number.NaN;if(!Number.isFinite(Y)||J-Y>=TR)continue;return{entry:X,context:{fetchedAt:Y,...typeof X.source==="string"&&{source:X.source}}}}return}}function PR($,Z){let J=JSON.stringify([eG($.connectionFile),eG(Z)]),X=$9.get(J);if(!X)X={source:new LB($,J),refs:0},$9.set(J,X);X.refs++;let Y=!1;return{source:X.source,release(){if(Y)return;if(Y=!0,--X.refs===0)$9.delete(J)}}}var TZ={error:0,warn:1,info:2,debug:3,trace:4},qB=5242880,OB=3;function OJ($){try{FR($,384)}catch{}}function ER($){try{if(!(qJ($)&&xR($).size>=qB))return;for(let J=OB-1;J>=1;J--)if(qJ(`${$}.${J}`)){let X=`${$}.${J+1}`;$Q(`${$}.${J}`,X),OJ(X)}let Z=`${$}.1`;$Q($,Z),OJ(Z)}catch{}}async function r$($){let{file:Z,handle:J}=$;if($.file=void 0,$.handle=void 0,Z&&J)await S$(Z,"log-close",()=>J.close())}async function ZQ($,Z){await G0(SR(Z));try{await Q$(Z,"file",!0)}catch(J){if(J.code!=="ENOENT")throw J;try{await Z7(Z,"")}catch(X){if(X.code!=="EEXIST")throw X;await Q$(Z,"file",!0)}}return $.handle=await S$(Z,"log-open",()=>AR(Z,"a")),$.file=Z,$.handle}async function wR($,Z,J){Z=IR(Z);try{if($.file!==Z)await r$($);let X=$.handle??await ZQ($,Z);if((await S$(Z,"log-stat",()=>X.stat())).size>=qB){await r$($);for(let z=OB-1;z>=0;z--){let G=z===0?Z:`${Z}.${z}`,Q=`${Z}.${z+1}`;try{await Q$(G,"file",!0)}catch(K){if(K.code==="ENOENT")continue;throw K}try{await Q$(Q,"file",!0)}catch(K){if(K.code!=="ENOENT")throw K}await jK(G,Q),await Q$(Q,"file")}X=await ZQ($,Z)}await S$(Z,"log-append",()=>X.appendFile(J,"utf8"))}catch(X){throw await r$($).catch(()=>{}),X}}function kR($){try{return` ${JSON.stringify($)}`}catch{return" [unserializable]"}}function bR($){let Z,J,X,Y=y1(),z,G=[],Q,K=Promise.resolve(),W,V={};function B(L){let C=K.then(L);return K=C.catch((w)=>{W=w}),C}function H(L){if(t&&L.file!==Z)B(()=>r$(V)).catch(()=>{});Z=L.file,J=L.level,Y=y1(L),z=L.captureSink}function q(L){if(L===void 0||L in TZ)X=L}function N(){if(Z===void 0)return;return(typeof Z==="function"?Z():Z)||void 0}function O(){if(X)return X;let L=typeof J==="function"?J():J;if(L&&L in TZ)return L;return"info"}function U(L=!0){if(Q)clearTimeout(Q),Q=void 0;if(!G.length){if(t)return B(async()=>{if(L)await r$(V);if(W)throw W});return}let C;try{C=N()}catch{if(G=[],t&&L)return B(()=>r$(V));return}let w=G.join("");if(G=[],!C){if(t&&L)return B(()=>r$(V));return}if(t)return B(async()=>{try{await wR(V,C,w)}finally{if(L)await r$(V)}});try{if(ER(C),qJ(C))OJ(C);CR(C,w,{encoding:"utf8",mode:384})}catch{}}function D(){if(!Q)Q=setTimeout(()=>{Q=void 0;let L=U(!1);if(L instanceof Promise)L.catch(()=>{})},500)}function _(L,C,w,v){if(Z===void 0&&z===void 0)return;try{if(TZ[C]>TZ[O()])return;let h=Y.redactStrings(w),a;try{a=Y.redact(v)}catch{a="[unserializable]"}let p=`[${new Date().toISOString()}] ${C.toUpperCase()} [${L}] ${h}`+(v===void 0?"":kR(a))+`
-`;try{z?.({channel:L,level:C,message:h,data:a})}catch{}if(Z===void 0)return;if(G.push(p),G.length>=50){let R=U(!1);if(R instanceof Promise)R.catch(()=>{})}else D()}catch{}}function T(L){return{error:(C,w)=>_(L,"error",C,w),warn:(C,w)=>_(L,"warn",C,w),info:(C,w)=>_(L,"info",C,w),debug:(C,w)=>_(L,"debug",C,w),trace:(C,w)=>_(L,"trace",C,w)}}function M(){if(t)B(()=>r$(V)).catch(()=>{});if(W=void 0,G=[],Q)clearTimeout(Q),Q=void 0;Z=void 0,J=void 0,X=void 0,Y=y1(),z=void 0}if($)H($);return{configure:H,createLogger:T,setLogLevel:q,flushLogs:U,reset:M}}var fR=bR();function DB($){return fR.createLogger($)}function JQ($){let Z=new AbortController,J=[],X=!1,Y=()=>{if(X)return;X=!0;for(let{source:Q,listener:K}of J)Q.removeEventListener("abort",K);J.length=0},z=(Q)=>{if(X||Z.signal.aborted)return;Z.abort(Q),Y()},G=$.find((Q)=>Q.aborted);if(G)return Z.abort(G.reason),{signal:Z.signal,dispose:Y};for(let Q of $){if(Z.signal.aborted)break;let K=()=>z(Q.reason);if(J.push({source:Q,listener:K}),Q.addEventListener("abort",K,{once:!0}),Q.aborted)z(Q.reason)}return{signal:Z.signal,dispose:Y}}var vR="claustrum-tombstone:v1:";function yR($,Z){return Z!==void 0&&Z.credentialId===$.credentialId&&Z.accountIdentity===$.accountIdentity&&Z.recordVersion!==$.recordVersion}function gR($,Z){if(Z===void 0)return"reauthorize-failed";if(Z.credentialId!==$.credentialId)return"credential-changed";if(Z.accountIdentity!==$.accountIdentity)return"account-changed";if(Z.recordVersion===$.recordVersion)return"version-unchanged";return"rotated"}var _B=DB("claustrum");function mR($,Z,J,X=_B){let Y=yR(Z,J);return X.debug("scoped 401 re-authorized",{site:$,credentialId:Z.credentialId,servedVersion:Z.recordVersion,currentVersion:J?.recordVersion??null,retry:Y,reason:gR(Z,J)}),Y}var XQ=300000;function J9(){return new e("invalid-material","Claustrum returned invalid credential material")}function hR($){let Z=$.trim();if(Z.startsWith("{")){let J;try{J=JSON.parse(Z)}catch{throw J9()}if(!J||typeof J!=="object")throw J9();let X=J,Y=X.access_token??X.access;Z=typeof Y==="string"?Y:""}if(!/^[\x21-\x7e]+$/.test(Z)||Z.startsWith(vR))throw J9();return Z}function pR($,Z){if(!$.operations.includes("read"))return;if(!$.categories.includes(Z.category))return;if($.credentialType==="oauth")return $.refreshAdapter===Z.refreshAdapter?"oauth":void 0;if($.credentialType==="api_key"&&Z.apiKeys)return $.refreshAdapter===void 0?"api_key":void 0;return}class nX{#$;#Z;#z;#J;#K;#Y;#X;#W=new WeakMap;#V=new WeakMap;#Q=!1;constructor($){let Z=$.tokenPath;if($.readToken)this.#Z=$.readToken;else if(Z)this.#Z=()=>wZ(Z);else throw new e("not-enrolled","Claustrum enrollment token path is required");this.#$=$.client,this.#J=$.family,this.#K=$.parseIdentity,this.#Y=$.requireAssertion??!1,this.#z=$.now??Date.now,this.#X=$.logger??_B}#G($){if(this.#Q)throw new e("closed","Claustrum scoped custody is closed");$?.throwIfAborted()}async#B($){this.#G($);let Z=await this.#Z();if(this.#G($),!/^[0-9a-f]{64}$/.test(Z.token)||!Number.isSafeInteger(Z.token_generation)||Z.token_generation<1)throw new e("invalid-token","Invalid Claustrum enrollment token");return Z.token}async#H($,Z){this.#G(Z);let J,X;try{let Y=$();J=Z?await Promise.race([Y,new Promise((z,G)=>{let Q=()=>G(Z.reason);if(Z.addEventListener("abort",Q,{once:!0}),X=()=>Z.removeEventListener("abort",Q),Z.aborted)Q()})]):await Y}catch(Y){if(this.#G(Z),Y instanceof t6)throw Y;throw new e("unavailable","Claustrum scoped operation unavailable")}finally{X?.()}return this.#G(Z),J}async discover($){let Z=await this.#B($),J=await this.#H(()=>this.#$.listScoped(Z),$),X=[],Y=[],z=new Map;for(let Q of J.rows){let K=pR(Q,this.#J);if(!K)continue;Y.push({row:Q,type:K}),z.set(Q.id,(z.get(Q.id)??0)+1)}let G=[];for(let{row:Q,type:K}of Y){let W;if(!Q.id.trim())W="empty credential id";else if((z.get(Q.id)??0)>1)W="duplicate credential id";else if(Q.accountId!==void 0&&!Q.accountId.trim())W="blank account identity";else if(!Q.state.trim())W="empty state";if(W){X.push({...Q.id.trim()&&{credentialId:Q.id},reason:W});continue}G.push(Object.freeze({credentialId:Q.id,credentialType:K,...Q.accountId!==void 0&&{accountIdentity:Q.accountId},state:Q.state,...Q.email!==void 0&&{email:Q.email},...Q.orgName!==void 0&&{orgName:Q.orgName}}))}for(let Q of X)this.#X.warn("skipped malformed vault record",Q);return{view:J.view,credentials:Object.freeze(G),skipped:Object.freeze(X)}}async authorize($,Z){if(!$.credentialId)throw new e("route-unavailable","Claustrum dispatch requires a credential id");let{credentialId:J,credentialType:X,accountIdentity:Y}=$;if(this.#Y&&Y===void 0)throw new e("identity-unasserted","Claustrum dispatch requires a known account identity");let z=await this.#B(Z),G=await this.#H(()=>this.#$.getScoped({credentialId:J,enrollmentToken:z,...X==="oauth"&&{minTtlMs:XQ}}),Z);if(G.credentialId!==void 0&&G.credentialId!==J)throw new e("identity-changed","Claustrum served credential identity changed");let Q=G.expiresAtMs;if(!Number.isSafeInteger(G.recordVersion)||G.recordVersion<0||Q===null&&X==="oauth"||Q!==null&&(!Number.isFinite(Q)||Q-this.#z()<XQ))throw new e("insufficient-validity","Claustrum served credential has insufficient validity");let K=hR(G.material),W=G.accountId?.trim()?G.accountId:void 0;if(this.#Y&&(G.credentialId===void 0||W===void 0))throw new e("identity-unasserted","Claustrum served credential did not assert its identity");let V=W===void 0?this.#K?.(K):void 0,B=W??V;if(Y!==void 0&&B!==void 0&&B!==Y)throw new e("identity-changed","Claustrum served credential identity changed");let H=B??Y,N=Object.freeze(Object.defineProperty({credentialId:J,credentialType:X,...H!==void 0&&{accountIdentity:H},accountIdentitySource:W!==void 0?"asserted":V!==void 0?"parsed":Y!==void 0?"expected":"none",...Y!==void 0&&{expectedAccountIdentity:Y},...G.credentialId!==void 0&&{assertedCredentialId:G.credentialId},...W!==void 0&&{assertedAccountIdentity:W},...G.projectId!==void 0&&{projectId:G.projectId},recordVersion:G.recordVersion,expiresAtMs:Q},"accessToken",{value:K,enumerable:!1}));return this.#W.set(N,z),N}async reportFailure($,Z,J){if(Z!==401)return;this.#G();let X=this.#W.get($);if(!X)throw new e("no-receipt","Claustrum failure report requires an original dispatch receipt");let Y=this.#V.get($);if(Y)return Y;let z=this.#H(()=>this.#$.reportAuthFailureScoped({credentialId:$.credentialId,enrollmentToken:X,providerStatus:401,recordVersion:$.recordVersion,reporterSource:J}));this.#V.set($,z);try{await z,this.#X.debug("scoped 401 reported",{credentialId:$.credentialId,recordVersion:$.recordVersion,reporterSource:J})}catch(G){throw this.#V.delete($),G}}close(){if(this.#Q)return;this.#Q=!0,this.#$.close()}}function MB($,Z,J){if($.accountIdentity!==void 0&&J!==void 0)return $.accountIdentity===J;return $.credentialId===Z}function uR($,Z,J){return $.some((X)=>MB(X,Z,J))}function jB($,Z,J){let X={credentialId:Z,...J!==void 0&&{accountIdentity:J}};return[...$.filter((Y)=>Y.credentialId!==Z||Y.accountIdentity!==J),X]}function RB($,Z,J){return $.filter((X)=>!Z.some((Y)=>MB(X,Y,J)))}var dR="vault:";function cR($){return lR("sha256").update($).digest("hex")}function iR($){let Z=$.credentialId.split(":");return(Z.length>=3?Z.slice(2).join(":").trim():void 0)||$.email||$.credentialId}function sR($){return $.identity!==void 0?`identity:${$.identity}`:`credential:${$.credential.credentialId}`}function A0($){return[$.credentialId,...$.aliases??[]]}function aR($,Z,J={}){let X=J.now??Date.now(),Y=J.routePrefix??dR,z=J.reservedRouteIds??new Set,G=$?.rows??[],Q=[...$?.declined??[]],K=Z.skipped.length===0,W=new Set(Z.credentials.map((M)=>M.credentialId)),V=new Set(Z.skipped.flatMap((M)=>M.credentialId===void 0?[]:[M.credentialId])),B=Z.skipped.some((M)=>M.credentialId===void 0),H=(M)=>!W.has(M)&&(V.has(M)||B),q=new Map;for(let M of G){if(M.accountIdentity===void 0)continue;for(let L of A0(M))if(!q.has(L))q.set(L,M.accountIdentity)}let N=new Map;for(let M of Z.credentials){let L=M.accountIdentity!==void 0?{credential:M,identity:M.accountIdentity,claimed:!0}:{credential:M,identity:q.get(M.credentialId),claimed:!1},C=sR(L),w=N.get(C)??[];w.push(L),N.set(C,w)}let O=new Set,U=new Set(z),D=[],_=(M,L)=>M.credential.credentialId.localeCompare(L.credential.credentialId),T=[...N.values()].map((M)=>M.toSorted(_)).sort((M,L)=>M[0]&&L[0]?_(M[0],L[0]):0);for(let M of T){let L=M[0]?.identity,C=M.filter((F)=>F.credential.state==="active"),w=C.length?C:M,v=w.filter((F)=>F.claimed),h=v.length?v:w,a=new Set(M.map((F)=>F.credential.credentialId)),p=G.find((F)=>!O.has(F)&&A0(F).some((S)=>a.has(S))&&(F.accountIdentity===void 0||F.accountIdentity===L)),R=h.find((F)=>F.credential.credentialId===p?.credentialId)??h[0];if(!R)continue;let j=R.credential,A=p??(L===void 0?void 0:G.find((F)=>!O.has(F)&&F.accountIdentity===L));if(A)O.add(A);let E=A?.routeId;if(!E||z.has(E)){let F=`${Y}${j.credentialId}${L===void 0?"":`~${cR(L).slice(0,10)}`}`;E=F;for(let S=2;U.has(E);S++)E=`${F}~${S}`}U.add(E);let P=A?A0(A).filter(H):[],I=[...new Set([...M.map((F)=>F.credential.credentialId),...P])].filter((F)=>F!==j.credentialId).sort((F,S)=>F.localeCompare(S)),k=J.mapAccount?.(j)??{};D.push({previousIndex:A?G.indexOf(A):1/0,row:{routeId:E,credentialId:j.credentialId,credentialType:j.credentialType,...L!==void 0&&{accountIdentity:L},...I.length&&{aliases:I},state:j.state,label:k.label?.trim()||iR(j),...j.email!==void 0&&{email:j.email},...j.orgName!==void 0&&{orgName:j.orgName},enabled:![j.credentialId,...I].some((F)=>uR(Q,F,L)),addedAt:A?.addedAt??X,...A?.quota!==void 0&&{quota:A.quota},...!R.claimed&&L!==void 0&&{unclaimed:!0}}})}return G.forEach((M,L)=>{if(O.has(M)||!A0(M).some(H))return;if(U.has(M.routeId))return;let[C,...w]=A0(M).filter((a)=>!W.has(a));if(C===void 0)return;U.add(M.routeId);let{aliases:v,...h}=M;D.push({previousIndex:L,row:{...h,credentialId:C,...w.length&&{aliases:w},stale:!0}})}),D.sort((M,L)=>M.previousIndex===L.previousIndex?M.row.credentialId.localeCompare(L.row.credentialId):M.previousIndex-L.previousIndex),{version:1,view:Z.view,complete:K,...!K&&{rejected:Z.skipped.map((M)=>({...M.credentialId!==void 0&&{credentialId:M.credentialId},reason:M.reason}))},rows:D.map((M)=>M.row),declined:Q}}function nR($){return($?.rows??[]).filter((Z)=>Z.enabled&&Z.state==="active").map((Z)=>({id:Z.routeId,kind:Z.credentialType==="oauth"?"oauth":"api-key",...Z.quota!==void 0&&{quota:Z.quota}}))}function V2($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function p8($){return $===void 0||typeof $==="string"}function oR($){let Z=V2($)?yX($.quota):void 0;if(!V2($)||typeof $.routeId!=="string"||typeof $.credentialId!=="string"||$.credentialType!=="oauth"&&$.credentialType!=="api_key"||typeof $.state!=="string"||typeof $.label!=="string"||typeof $.enabled!=="boolean"||typeof $.addedAt!=="number"||!p8($.accountIdentity)||!p8($.email)||!p8($.orgName)||$.aliases!==void 0&&(!Array.isArray($.aliases)||!$.aliases.every((J)=>typeof J==="string"))||$.quota!==void 0&&Z===void 0||$.stale!==void 0&&$.stale!==!0||$.unclaimed!==void 0&&$.unclaimed!==!0)return;return{...$,...Z===void 0?{}:{quota:Z}}}var rR=new Set(["empty credential id","duplicate credential id","blank account identity","empty state"]);function YQ($){if(!Array.isArray($))return;let Z=[];for(let J of $){if(!V2(J)||!p8(J.credentialId)||typeof J.reason!=="string"||!rR.has(J.reason))return;Z.push(J)}return Z}function tR($){if(!V2($)||$.version!==1||!p8($.view)||!Array.isArray($.rows)||!Array.isArray($.declined)||$.complete!==void 0&&typeof $.complete!=="boolean"||$.rejected!==void 0&&!YQ($.rejected))throw new e("invalid-state","Claustrum roster file is not valid");let Z=[];for(let Y of $.rows){let z=oR(Y);if(!z)throw new e("invalid-state","Claustrum roster file is not valid");Z.push(z)}let J=[];for(let Y of $.declined){if(!V2(Y)||typeof Y.credentialId!=="string"||!p8(Y.accountIdentity))throw new e("invalid-state","Claustrum roster file is not valid");J.push(Y)}let X=YQ($.rejected);return{version:1,...typeof $.view==="string"&&{view:$.view},complete:$.complete!==!1,...X&&{rejected:X},rows:Z,declined:J}}async function h6($){let Z;try{Z=await C0($,t)}catch(X){if(X.code==="ENOENT")return;throw X}let J;try{J=JSON.parse(Z)}catch{throw new e("invalid-state","Claustrum roster file is not valid")}return tR(J)}var eR={name:"claustrum-roster-write",ttlMs:1e4,timeoutMs:5000},$T={name:"claustrum-roster",ttlMs:30000};async function Y0($,Z,J={}){return p6($,eR,async(X)=>{let Y=await h6($),{next:z,result:G}=await Z(Y,{assertOwned:()=>X.assertOwned()});if(z)await X.assertOwned(),await $1($,z,{beforeRename:async()=>{await J.beforePublish?.(),await X.assertOwned()}});return G})}function ZT($,Z){return Y0($,(J)=>{let X=J?.rows.find((z)=>z.routeId===Z);if(!J||!X)throw new e("route-unavailable","Claustrum route is not in the roster");let Y=jB(J.declined,X.credentialId,X.accountIdentity);return{next:{...J,declined:Y,rows:J.rows.map((z)=>z===X?{...z,enabled:!1}:z)},result:void 0}})}function JT($,Z){return Y0($,(J)=>{let X=J?.rows.find((Y)=>Y.routeId===Z);if(!J||!X)throw new e("route-unavailable","Claustrum route is not in the roster");return{next:{...J,declined:RB(J.declined,A0(X),X.accountIdentity),rows:J.rows.map((Y)=>Y===X?{...Y,enabled:!0}:Y)},result:void 0}})}function XT($,Z){if(!A0($).includes(Z.credentialId))return"refuse";if($.unclaimed&&(Z.accountIdentitySource==="expected"||Z.accountIdentitySource==="none"))return"refuse";if($.accountIdentity===Z.accountIdentity)return"hold";if($.accountIdentity===void 0&&Z.expectedAccountIdentity===void 0&&Z.accountIdentity!==void 0&&(Z.accountIdentitySource==="asserted"||Z.accountIdentitySource==="parsed")&&A0($).length===1)return"bind";return"refuse"}function YT($,Z){return Y0($,(J)=>{let X=J?.rows.find((Q)=>Q.routeId===Z.routeId),Y=!J||!X?"refuse":XT(X,Z);if(!J||!X||Y==="refuse")return{result:!1};let z=gX(X.quota,Z.observation),G=Y==="bind"?{accountIdentity:Z.accountIdentity,unclaimed:!0}:{};return{next:{...J,rows:J.rows.map((Q)=>Q===X?{...Q,...G,quota:z}:Q)},result:!0}})}function zT($,Z){return Y0($,(J)=>{let X=J?.rows.find((z)=>z.routeId===Z.routeId);if(!J||!X||X.accountIdentity===void 0||X.accountIdentity!==Z.accountIdentity)return{result:!1};let Y=gX(X.quota,Z.observation);return{next:{...J,rows:J.rows.map((z)=>z===X?{...z,quota:Y}:z)},result:!0}})}async function TB($){$.signal?.throwIfAborted();let Z=async()=>await $.isActive?.()??!0;if(!await Z())return;let J=await g0({...$T,path:$.path,renew:!0});if(!J){let X=await h6($.path);if($.signal?.throwIfAborted(),!X?.view)throw new e("roster-busy","Claustrum account discovery is already in progress");return X}try{let X=await $.custody.discover($.signal);return $.signal?.throwIfAborted(),await Y0($.path,async(Y)=>{if(!await Z())return{result:void 0};$.signal?.throwIfAborted(),await J.assertOwned();let z=typeof $.projection==="function"?$.projection():$.projection,G=aR(Y,X,z);return{...JSON.stringify(Y)!==JSON.stringify(G)&&{next:G},result:G}})}finally{await J.release()}}class GT{#$;#Z=new AbortController;#z;#J;#K;#Y;#X;#W;#V=!1;#Q;constructor($){this.#$=$,this.#z=$.logger??DB("claustrum")}#G($){this.#Z.signal.throwIfAborted(),$?.throwIfAborted()}async#B(){return await this.#$.isCustodyActive?.()??!0}#H($,Z){let J=JQ([this.#Z.signal,...Z?[Z]:[]]);return new Promise((X,Y)=>{let z=()=>{J.signal.removeEventListener("abort",G),J.dispose()},G=()=>{z(),Y(J.signal.reason)};if(J.signal.addEventListener("abort",G,{once:!0}),$.then((Q)=>{if(z(),J.signal.aborted)Y(J.signal.reason);else X(Q)},(Q)=>{z(),Y(Q)}),J.signal.aborted)G()})}async#U(){if(this.#G(),this.#J)return this.#J;if(!this.#K)this.#K=this.#$.connect().then(($)=>{if(this.#Z.signal.aborted)$.close(),this.#G();if(this.#J=new nX({client:$,family:this.#$.family,tokenPath:this.#$.tokenPath,parseIdentity:this.#$.parseIdentity,requireAssertion:this.#$.requireAssertion,now:this.#$.now,logger:this.#z}),this.#$.insula&&$.insula)this.#Q=PR($.insula,this.#$.tokenPath);return this.#J}).finally(()=>{this.#K=void 0});return this.#H(this.#K)}snapshot(){return this.#X}routingRows(){return nR(this.#X)}refresh(){if(this.#G(),this.#Y)return this.#Y;return this.#Y=(async()=>{if(!await this.#B()){this.#X=void 0,this.#J?.close(),this.#J=void 0,this.#Q?.release(),this.#Q=void 0;return}let $=await this.#U(),Z=await TB({path:this.#$.rosterPath,custody:$,isActive:()=>this.#B(),signal:this.#Z.signal,projection:()=>({reservedRouteIds:new Set(this.#$.reservedRouteIds?.()??[]),routePrefix:this.#$.routePrefix,mapAccount:this.#$.mapAccount,now:(this.#$.now??Date.now)()})});this.#G();let J=Z?.view!==this.#X?.view;if(this.#X=Z,Z&&J)this.#$.onRoster?.(Z);return Z})().finally(()=>{this.#Y=void 0}),this.#Y}start(){if(this.#V)return;this.#G(),this.#V=!0;let $=async()=>{try{await this.refresh(),await this.refreshInsulaQuota()}catch(J){if(!this.#Z.signal.aborted)this.#$.onError?.(J)}if(this.#Z.signal.aborted)return;let Z=this.#$.pollIntervalMs??5000;if(Z<=0)return;this.#W=(this.#$.setTimeoutImpl??setTimeout)(()=>{this.#W=void 0,$()},Z),this.#W.unref?.()};$()}async refreshInsulaQuota(){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#B())return;try{await wZ(this.#$.tokenPath),await this.#U(),await this.#Q?.source.refresh((this.#$.now??Date.now)())}catch{}}async cachedInsulaQuota($){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#B())return;try{return await wZ(this.#$.tokenPath),this.#N($.assertedAccountIdentity)}catch{return}}async cachedInsulaQuotaForRoute($){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#B())return;try{await wZ(this.#$.tokenPath);let J=(await h6(this.#$.rosterPath))?.rows.find((X)=>X.routeId===$);return this.#N(J?.accountIdentity)}catch{return}}#N($){if(!this.#$.insula||!$)return;let Z=this.#Q?.source.current(this.#$.insula.provider,$,(this.#$.now??Date.now)());return Z?this.#$.insula.normalize(Z.entry,Z.context):void 0}async authorize($,Z){this.#G(Z);let J=this.#X??await this.#H(this.refresh(),Z);if(!J||!await this.#B())throw new e("not-active","Claustrum scoped custody is not active");let X=await h6(this.#$.rosterPath);this.#G(Z);let Y=J.rows.find((K)=>K.routeId===$),z=X?.rows.find((K)=>K.routeId===$);if(z&&!z.enabled)throw new e("route-declined","Claustrum route is disabled");if(!Y||!z||z.state!=="active"||z.credentialId!==Y.credentialId||z.accountIdentity!==Y.accountIdentity)throw new e("route-unavailable","Claustrum route is disabled, removed or changed");let G=await this.#H(this.#U(),Z),Q=JQ([this.#Z.signal,...Z?[Z]:[]]);try{return await G.authorize({credentialId:z.credentialId,credentialType:z.credentialType,...z.accountIdentity!==void 0&&{accountIdentity:z.accountIdentity}},Q.signal)}finally{Q.dispose()}}async reportFailure($,Z,J){if(this.#G(),!this.#J)throw new e("no-receipt","Claustrum dispatch receipt has no active owner");await this.#J.reportFailure($,Z,J)}async send($,Z,J){let X=J.signal,Y=await this.authorize($,X),z=await Z(Y,X);if(z.status===401&&!X?.aborted){let G;try{G=await this.authorize($,X)}catch{}if(mR(J.site,Y,G,this.#z))await z.body?.cancel().catch(()=>{}),Y=G,z=await Z(G,X)}if(z.status===401)await this.reportFailure(Y,401,J.reporterSource??"direct").catch((G)=>this.#$.onError?.(G)),Promise.resolve().then(()=>this.refresh()).catch((G)=>{if(!this.#Z.signal.aborted)this.#$.onError?.(G)});return z}async decline($){this.#G(),await ZT(this.#$.rosterPath,$),this.#X=await h6(this.#$.rosterPath)}async accept($){this.#G(),await JT(this.#$.rosterPath,$),this.#X=await h6(this.#$.rosterPath)}async recordQuota($,Z,J){this.#G();let X=await YT(this.#$.rosterPath,{routeId:$,observation:Z,credentialId:J.credentialId,accountIdentitySource:J.accountIdentitySource,...J.accountIdentity!==void 0&&{accountIdentity:J.accountIdentity},...J.expectedAccountIdentity!==void 0&&{expectedAccountIdentity:J.expectedAccountIdentity}});if(X)this.#X=await h6(this.#$.rosterPath);return X}async recordAccountQuota($,Z,J){this.#G();let X=await zT(this.#$.rosterPath,{routeId:$,accountIdentity:Z,observation:J});if(X)this.#X=await h6(this.#$.rosterPath);return X}close(){if(this.#Z.signal.aborted)return;if(this.#Z.abort(new e("closed","Claustrum consumer is closed")),this.#W)(this.#$.clearTimeoutImpl??clearTimeout)(this.#W);this.#W=void 0,this.#J?.close(),this.#Q?.release(),this.#Q=void 0,this.#X=void 0}}function cZ($){switch($){case"closed":case"not-enrolled":case"invalid-token":case"unavailable":case"identity-changed":case"identity-unasserted":case"insufficient-validity":case"invalid-material":case"not-active":case"route-unavailable":case"route-declined":case"no-receipt":case"unsafe-file":case"invalid-state":case"wrong-consumer":case"roster-busy":case"host-slot-login":case"host-slot-placeholder":case"placeholder-refresh":return $;default:return"unavailable"}}class o extends Error{code;constructor($){let Z=cZ($);super(`Native custody refused: ${Z}`);this.name="NativeCustodyError",this.code=Z}}function PB($){let Z={...$.env??process.env},J=$.connect,X=$.logger,Y=!1,z,G,Q=new Set,K=new WeakSet;function W(U){if(Y)throw new o("closed");U?.throwIfAborted()}function V(){return W(),G??=Promise.resolve().then(J).then((U)=>{if(Y)throw U.close(),new o("closed");return z=U,U}).catch((U)=>{throw G=void 0,U}),G}async function B(U){let D=await V();return W(),U(D)}let H=new nX({client:{listScoped:(U)=>B((D)=>D.listScoped(U)),getScoped:(U)=>B((D)=>D.getScoped(U)),reportAuthFailureScoped:(U)=>B((D)=>D.reportAuthFailureScoped(U)),close:()=>z?.close()},family:{refreshAdapter:"anthropic",category:"anthropic-native",apiKeys:!1},requireAssertion:!0,...$.readToken?{readToken:$.readToken}:{tokenPath:A2($.host,Z).tokenPath},now:$.now,logger:{warn:()=>X?.warn("Native custody inventory record skipped"),debug:()=>X?.debug("Native custody failure reported")}});async function q(U,D){W(D);let _=()=>{},T=()=>{},M=new Promise((L,C)=>{_=()=>C(new o("closed")),T=()=>C(D?.reason),Q.add(_),D?.addEventListener("abort",T,{once:!0})});try{let L=await Promise.race([U(),M]);return W(D),L}catch(L){throw W(D),new o(L instanceof e?cZ(L.kind):L instanceof o?cZ(L.code):"unavailable")}finally{Q.delete(_),D?.removeEventListener("abort",T)}}function N(U){if(!K.has(U))throw new o("no-receipt")}let O={discover:(U)=>q(()=>H.discover(U),U),authorize:(U,D)=>q(async()=>{let{credentialId:_,accountIdentity:T}=U;if(typeof _!=="string")throw new o("unavailable");if(T!==void 0&&typeof T!=="string")throw new o("unavailable");if(!T?.trim())throw new o("identity-unasserted");let M=await H.authorize({credentialId:_,accountIdentity:T,credentialType:"oauth"},D);return W(D),K.add(M),M},D),reportFailure:(U,D,_)=>q(async()=>{N(U),await H.reportFailure(U,D,_)}),prepareRetry:async(U,D)=>{if(W(D),N(U),U.assertedAccountIdentity===void 0)throw new o("no-receipt");let _;try{_=await O.authorize({credentialId:U.credentialId,accountIdentity:U.assertedAccountIdentity},D)}catch(T){if(W(D),T instanceof o&&T.code==="closed")throw T;return{retry:!1,reason:"reauthorize-failed",code:T instanceof o?cZ(T.code):"unavailable"}}if(W(D),_.credentialId!==U.credentialId)return{retry:!1,reason:"credential-changed"};if(_.assertedAccountIdentity!==U.assertedAccountIdentity)return{retry:!1,reason:"account-changed"};if(!(_.recordVersion>U.recordVersion))return{retry:!1,reason:"version-not-newer"};return{retry:!0,receipt:_}},close:()=>{if(Y)return;Y=!0;for(let U of Q)U();H.close()}};return O}async function iZ($,Z=process.env){let J=await FU(A2($,Z),`anthropic-auth-${$}`);if(J==="unreadable")throw new o("invalid-token");return J==="vault"?"claustrum":"local"}function CB($,Z){return $.kind===Z.kind&&$.storageId===Z.storageId&&$.rowId===Z.rowId&&$.credentialEpoch===Z.credentialEpoch&&$.identity===Z.identity}function zQ($,Z){return CB($.binding,Z.binding)&&$.credentialFingerprint===Z.credentialFingerprint&&$.version.accessFingerprint===Z.version.accessFingerprint&&$.version.expires===Z.version.expires&&Object.hasOwn($.version,"lastRefreshedAt")===Object.hasOwn(Z.version,"lastRefreshedAt")&&$.version.lastRefreshedAt===Z.version.lastRefreshedAt}function GQ($,Z,J){let X=$?.lastRefreshError;if($?.binding.kind==="local"&&CB($.binding,Z.binding)&&X?.credentialFingerprint===Z.credentialFingerprint){if(X.permanent===!0)return{status:"blocked",reason:"invalid-grant",credentialFingerprint:Z.credentialFingerprint};if(X.nextRetryAt!==void 0&&X.nextRetryAt>J)return{status:"blocked",reason:"refresh-backoff",credentialFingerprint:Z.credentialFingerprint}}return{status:"allowed"}}function KT($){let{paths:Z,externalPolicy:J}=$,X=$.now??Date.now;if(typeof J!=="function")throw TypeError("Native local external policy gate is required");function Y(G){let Q=J(G);if(Q?.status==="allowed"&&Object.keys(Q).length===1)return{status:"allowed"};if(Q?.status==="blocked"&&Object.keys(Q).length===2&&["quota-ineligible","account-disabled","local-mode-unavailable"].includes(Q.reason))return{status:"blocked",reason:Q.reason};throw TypeError("Native local external policy result is invalid")}async function z(G){if(!P6(G.binding))throw new g("invalid-runtime");let Q=await h$(Z.runtime,Z.storageId),K=Q.status==="ready"?Q.state.accounts[G.binding.rowId]:void 0;if(K&&K.binding.kind!=="local")throw new g("invalid-runtime");return K}return{async readRestrictions(G){let Q=await z(G),K=Y(G);return{restriction:K.status==="blocked"?K:GQ(Q,G,X()),context:{subject:G,runtimeBinding:Q?.binding.kind==="local"?Q.binding:null,refreshErrorClearedAt:Q?.refreshErrorClearedAt??null,quotaErrorClearedAt:Q?.quotaErrorClearedAt??null,quotaErrorGeneration:Q?.quotaErrorGeneration??null}}},async readAdmission(G){let Q=await z(G),K=Y(G);if(K.status==="blocked")return K;let W=X(),V=GQ(Q,G,W);if(V.status==="blocked")return{status:"blocked",reason:V.reason};if(!H8(G))throw new g("invalid-runtime");let B=Q?.credentialValidation;if(B&&zQ(B,G))return{status:"proven",validation:B};let H=Q?.validationRetry;if(H&&G.version.expires>W&&H.nextRetryAt>W&&zQ(H.subject,G))return{status:"blocked",reason:"validation-backoff"};return{status:"unproven"}}}}var DJ=3;function X9($,Z){let J=WT("sha256").update(JSON.stringify([$.storageId,Z])).digest("hex");return{path:$.state,name:`native-account-provider-${J}`,...i6}}function QQ($){return $ instanceof QX||$ instanceof eJ}var t0=new Map;function C8($,Z){if(t0.get(Z)===$)t0.delete(Z);$.keys.delete(Z)}function R1($){let Z=$ instanceof Q6?$.cause:$,J=$ instanceof Q6?$.kind:"caller-hook";if(J==="provider"&&Z instanceof t1){let X=Z.status===400&&/\binvalid_grant\b/.test(Z.body);return{kind:J,classification:X?"invalid-grant":Z.status===429||Z.status>=500?"transient":"permanent",status:Z.status,...Z.retryAfter!==void 0?{retryAfter:Z.retryAfter}:{}}}return{kind:J,classification:J==="provider"&&s$(Z)?"transient":"permanent"}}function PZ($){return $ instanceof Error?$:Error("Native refresh callback failed",{cause:$})}function E8($){if($.type!=="oauth")throw Error("Local refresh requires an OAuth credential");return Object.freeze({accessFingerprint:$.access?p$($.access):void 0,expires:$.expires,...Object.hasOwn($,"lastRefreshedAt")?{lastRefreshedAt:$.lastRefreshedAt}:{}})}class a1 extends Error{reason;constructor($){super("Local refresh policy refused the exchange");this.reason=$}}function Y9($,Z){if($.status==="allowed")return;if($.reason!=="refresh-backoff"&&$.reason!=="invalid-grant")return $.reason;return $.credentialFingerprint===Z?$.reason:void 0}function VT($,Z){let J=$.credential,X=Z.credential;return J?.type==="oauth"&&X?.type==="oauth"&&J.access===X.access&&J.refresh===X.refresh&&J.expires===X.expires&&Object.hasOwn(J,"lastRefreshedAt")===Object.hasOwn(X,"lastRefreshedAt")&&J.lastRefreshedAt===X.lastRefreshedAt}function BT($){throw Error(`Unsupported refresh outcome: ${String($)}`)}function HT($,Z){return P6($)&&P6(Z)&&$.storageId===Z.storageId&&$.rowId===Z.rowId&&$.credentialEpoch===Z.credentialEpoch&&$.identity===Z.identity}function UT($,Z){return HT($.binding,Z.binding)&&$.credentialFingerprint===Z.credentialFingerprint&&$.version.accessFingerprint===Z.version.accessFingerprint&&$.version.expires===Z.version.expires&&Object.hasOwn($.version,"lastRefreshedAt")===Object.hasOwn(Z.version,"lastRefreshedAt")&&$.version.lastRefreshedAt===Z.version.lastRefreshedAt}function x7($){return Object.freeze({...$,binding:Object.freeze({...$.binding}),version:Object.freeze({...$.version})})}function KQ($,Z){if(Z.credential?.type!=="oauth"||!Z.fingerprint)throw new a1("access-unavailable");return x7({binding:$,credentialFingerprint:Z.fingerprint,version:E8(Z.credential)})}function CZ($){return Object.freeze({credentialFingerprint:A6($),version:E8($)})}function NT($,Z){if(!UT($.subject,Z)||$.runtimeBinding!==null&&!P6($.runtimeBinding)||![$.refreshErrorClearedAt,$.quotaErrorClearedAt,$.quotaErrorGeneration].every((J)=>J===null||Number.isSafeInteger(J)&&Number(J)>=0))throw Error("Native policy context does not match the captured subject");return Object.freeze({subject:x7(Z),runtimeBinding:$.runtimeBinding===null?null:Object.freeze({...$.runtimeBinding}),refreshErrorClearedAt:$.refreshErrorClearedAt,quotaErrorClearedAt:$.quotaErrorClearedAt,quotaErrorGeneration:$.quotaErrorGeneration})}function LT($){let Z=X0($),J=$.now??Date.now,X=$.refreshToken??QL,Y=$.resolveIdentity??Pq,z=aV($.onLockEvent);async function G(H){let q=await Z.read();return q.status==="ready"?q.rows.find((N)=>N.id===H.rowId):void 0}async function Q(H){let q;try{q=await $.readRestrictions(H)}catch(N){throw Error("Native policy callback failed",{cause:N})}return Object.freeze({restriction:Object.freeze({...q.restriction}),context:NT(q.context,H)})}async function K(H,q,N,O,U){let D=(L)=>({status:"refused",reason:L,persisted:U});if(!N||!C$(q,$.paths,N)||!_6(N)||!N.candidate)return D("row-ineligible");if(q.identity===void 0)return D("identity-unproven");let _=N.credential;if(_?.type!=="oauth"||!_.access||typeof _.expires!=="number"||_.expires<=J())return D("access-unavailable");if(_.access===H.rejectedAccessToken)return D("rejected-access-unchanged");let T=x7({binding:{...q,identity:q.identity},credentialFingerprint:A6(_),version:{...E8(_),accessFingerprint:p$(_.access),expires:_.expires}}),M;try{M=await $.readAdmission(T)}catch(L){throw Error("Native admission callback failed",{cause:L})}if(M.status==="blocked")return D(M.reason);if(M.status!=="proven")return D("proof-missing");if(!X8(M.validation,q,_))return D("proof-mismatch");if(H.signal?.aborted)return D("cancelled");if(_.expires<=J())return D("access-unavailable");return Object.freeze({status:"usable",source:O,binding:T.binding,access:_.access,expires:_.expires,subject:T,validation:x7(M.validation)})}async function W(H){let q=X9($.paths,H),N=performance.now();for(;;){let O=await g0({name:q.name,path:q.path,ttlMs:i6.ttlMs,renew:!0,onContended:z?()=>z({type:"contended",name:q.name,path:q.path}):void 0,onStep:$.onLockStep?(D)=>$.onLockStep?.(q,D):void 0});if(O){try{await O.assertOwned()}catch(D){throw await O.release().catch(()=>{}),z?.({type:"released",name:q.name,path:q.path}),D}return z?.({type:"acquired",name:q.name,path:q.path}),O}let U=i6.timeoutMs-(performance.now()-N);if(U<=0)throw new d8({target:q.path,name:q.name,timeoutMs:i6.timeoutMs});await new Promise((D)=>setTimeout(D,Math.min(i6.retryMs,U)))}}async function V(H,q){let N=q.binding,O=0,U=!1,D=!1,_,T="unavailable",M="not-needed",L,C,w,v,h,a,p,R,j=!1;function A(){return T==="unsupported-credential"}function E(){return{binding:N,attempt:O,credentialFingerprint:L,credentialVersion:C,context:v,bootstrap:T,handoff:M}}async function P(F){try{await $.reconcile(F)}catch(S){throw j=!0,Error("Native reconciliation callback failed",{cause:S})}}async function I(){let F=h;if(h=void 0,p?.(),p=void 0,F)a=(async()=>{if(await F.release().catch(()=>{}),_){let S=X9($.paths,_);z?.({type:"released",name:S.name,path:S.path})}})();await a}async function k(){if(M="skipped-loss",R)C8(H,R);await I()}try{for(O=1;O<=DJ;O++){U=!1;let F=!1;_=void 0,L=void 0,C=void 0,w=void 0,v=void 0,R=void 0,T="unavailable",M="not-needed";let S,m=await G(N);L=m?.fingerprint,C=m?.credential?.type==="oauth"?E8(m.credential):void 0;let f,x=!m||!C$(N,$.paths,m)?"binding-changed":q.signal?.aborted?"cancelled":!m.candidate||!_6(m)?"row-ineligible":void 0;if(x)return await P({...E(),status:"refused",reason:x,consumed:!1}),{status:"refused",reason:x,persisted:!1};if(!m)throw Error("Captured row unavailable");f=await Q(KQ(N,m));let b=Y9(f.restriction,m.fingerprint);if(b)return await P({...E(),status:"refused",reason:b,consumed:!1}),{status:"refused",reason:b,persisted:!1};if(N.identity!==void 0&&(q.intent==="serve"||q.rejectedAccessToken!==void 0)&&m?.credential?.type==="oauth"&&m.credential.access&&m.credential.access!==q.rejectedAccessToken&&(m.credential.expires??0)>J()){let y=await K(q,N,m,"adopted",!1);if(y.status==="usable")await P({...E(),status:"adopted",successorFingerprint:A6(m.credential),successorVersion:E8(m.credential)});else if(y.status==="refused"&&y.reason==="proof-missing"){v=f.context;let d,s;try{if(d=(await Y(m.credential.access,void 0,void 0)).accountUuid,T=d?"resolved":"unavailable",!d)s={kind:"validation",classification:"transient"}}catch(r){if(QQ(r))return T="unsupported-credential",await P({...E(),status:"refused",reason:"unsupported-access",consumed:!1}),{status:"refused",reason:"unsupported-access",persisted:!1};T="failed",s={kind:"validation",classification:s$(r)||r instanceof t1&&(r.status===429||r.status>=500)?"transient":"permanent"}}if(s){Object.freeze(s);try{await P({...E(),status:"failed",failure:s,persisted:!1})}catch{}return{status:"failed",failure:s,persisted:!1,reconciliationFailed:j}}if(d!==N.identity)return await P({...E(),status:"refused",reason:"validation-contradicted",consumed:!1}),{status:"refused",reason:"validation-contradicted",persisted:!1};await P({...E(),status:"validation-observed",identity:N.identity,context:v})}else return y;return{status:"completed",source:y.status==="usable"?q.rejectedAccessToken?"adopted":"current":"validated",identity:N.identity,persisted:!1}}try{let y=await Z.refresh(N.rowId,async(d,s)=>{if(S=s,L=s.fingerprint,C=E8(d),pK(d.refresh))throw new a1("custody-tombstone");f=await Q(KQ(N,s)),v=f.context;let r=q.signal?.aborted?"cancelled":Y9(f.restriction,L);if(r)throw new a1(r);F=!0;let K6=await X({refreshToken:d.refresh,maxRetries:0,now:J});U=!0;try{let Z6=(await Y(K6.access,void 0,void 0)).accountUuid;_=typeof Z6==="string"&&Z6.length>0&&Z6.trim()===Z6?Z6:void 0,T=_?"resolved":"unavailable"}catch(Z6){T=QQ(Z6)?"unsupported-credential":"failed"}if(N.identity===void 0&&_){if(R=pG({...N,identity:_}),!t0.has(R))t0.set(R,H),H.keys.add(R);if(q.signal?.aborted)M="skipped-cancelled",C8(H,R);else try{h=await W(_),M="acquired";let Z6=h,M6=()=>{if(h!==Z6)return;if(M="skipped-cancelled",R)C8(H,R);I()};if(q.signal?.addEventListener("abort",M6,{once:!0}),p=()=>q.signal?.removeEventListener("abort",M6),q.signal?.aborted)M6();if(Z6.whenLost().then(async()=>{if(h===Z6)await k()}).catch(()=>{}),h===Z6)await Z6.assertOwned()}catch(Z6){M=Z6 instanceof d8?"skipped-contention":"skipped-loss",C8(H,R),await I()}}return{access:K6.access,refresh:K6.refresh,expires:K6.expires,..._?{identity:_}:{}}},{...N.identity!==void 0?{providerLock:X9($.paths,N.identity)}:{},refuse:async(d)=>{if(!C$(N,$.paths,d))return"binding-changed";if(S&&!VT(S,d))return"dispatch-changed";if(h)try{await h.assertOwned()}catch{await k()}if(U)return;if(q.signal?.aborted)return"cancelled";if(!d.candidate||!_6(d))return"row-ineligible";return f?Y9(f.restriction,d.fingerprint):void 0},onPersisted:async(d,s)=>{D=!0,w=CZ(s);try{if(h)try{await h.assertOwned()}catch{await k()}await P({...E(),status:"persisted",identity:_,successorFingerprint:w.credentialFingerprint,successorVersion:w.version,committed:w})}finally{await I()}}});switch(y.status){case"rotated":if(A())return{status:"refused",reason:"unsupported-access",persisted:!0};return{status:"completed",source:"rotated",identity:y.identity,persisted:!0};case"refused":return await P({...E(),status:"refused",reason:y.reason,consumed:U}),{status:"refused",reason:y.reason,persisted:!1};case"identity-contradicted":return D=!0,w=CZ(y.credential),await P({...E(),status:"identity-contradicted",expectedIdentity:y.expectedIdentity,returnedIdentity:y.returnedIdentity,successorFingerprint:w.credentialFingerprint,successorVersion:w.version,committed:w}),{status:"identity-contradicted",expectedIdentity:y.expectedIdentity,returnedIdentity:y.returnedIdentity,persisted:!0};default:return BT(y)}}catch(y){let d=PZ(y);if(D||=d instanceof Q6&&(d.committed!==void 0||d.phase==="after-first-write"),d instanceof Q6&&d.committed?.type==="oauth")w=CZ(d.committed);if(!F&&d instanceof Q6&&d.cause instanceof a1)return await P({...E(),status:"refused",reason:d.cause.reason,consumed:!1}),{status:"refused",reason:d.cause.reason,persisted:!1};let s=R1(d);if(!F&&s.kind==="provider")s.kind="caller-hook",s.classification="permanent";Object.freeze(s);try{await P({...E(),status:"failed",failure:s,persisted:D,committed:w})}catch{}if(F&&!U&&!D&&!j&&!q.signal?.aborted&&s.kind==="provider"&&s.classification==="transient"&&s.status!==429&&O<DJ){if(await I(),R)C8(H,R);continue}return{status:"failed",failure:s,persisted:D,reconciliationFailed:j}}finally{await I()}}throw Error("Unreachable refresh attempt budget")}catch(F){let S=PZ(F);if(D||=S instanceof Q6&&(S.committed!==void 0||S.phase==="after-first-write"),S instanceof Q6&&S.committed?.type==="oauth")w=CZ(S.committed);try{await P({...E(),status:"failed",failure:R1(S),persisted:D,committed:w})}catch{}return{status:"failed",failure:R1(S),persisted:D,reconciliationFailed:j}}finally{await I()}}async function B(H){if(H.mode!=="local")return{status:"refused",reason:"custody-mode",persisted:!1};if(H.intent!=="serve"&&H.intent!=="refresh")return{status:"refused",reason:"invalid-intent",persisted:!1};if(!P6(H.binding)||H.binding.storageId!==$.paths.storageId)return{status:"refused",reason:"binding-changed",persisted:!1};if(H={...H,binding:Object.freeze({...H.binding})},H.signal?.aborted)return{status:"refused",reason:"cancelled",persisted:!1};let q=pG(H.binding),N=t0.get(q);if(!N&&H.intent==="serve"){try{let U=await K(H,H.binding,await G(H.binding),"current",!1);if(U.status!=="refused"||!["proof-missing","identity-unproven","access-unavailable","rejected-access-unchanged"].includes(U.reason))return U}catch(U){return{status:"failed",failure:R1(PZ(U)),persisted:!1,reconciliationFailed:!1}}N=t0.get(q)}if(!N){N={keys:new Set([q]),promise:Promise.resolve({status:"refused",reason:"initializing",persisted:!1})},t0.set(q,N);let U=N;N.promise=V(U,H).finally(()=>{for(let D of U.keys)C8(U,D)})}let O=await N.promise;if(H.signal?.aborted)return{status:"refused",reason:"cancelled",persisted:O.persisted};if(O.status!=="completed")return O;try{let U=H.binding.identity===void 0&&O.source==="rotated"?{...H.binding,...O.identity?{identity:O.identity}:{}}:H.binding,D=await G(H.binding);return await K(H,U,D,O.source,O.persisted)}catch(U){return{status:"failed",failure:R1(PZ(U)),persisted:O.persisted,reconciliationFailed:!1}}}return{authorize:B}}class m6 extends Error{role;code;constructor($,Z){super(`Anthropic migration ${$} input: ${Z}`);this.role=$,this.code=Z,this.name="NativeMigrationSourceError"}}var VQ=4194304;function jT($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function RT($){let Z=[$];while(Z.length){let J=Z.pop();if(!J)continue;for(let X of Object.values(J))if(X!==null&&typeof X==="object")Z.push(X);Object.freeze(J)}return $}function BQ($){return Object.defineProperty($,"data",{enumerable:!1}),Object.freeze($)}async function O6($,Z,J={}){let X=BQ({role:$,path:Z,digest:null,data:void 0,metadata:void 0}),Y;try{Y=await WQ(Z,{bigint:!0})}catch(G){if(G instanceof Error&&"code"in G&&G.code==="ENOENT")return X;throw new m6($,"source-io")}if(!Y.isFile()||Y.isSymbolicLink())throw new m6($,"unsafe-source");let z;try{z=await MT(Z,z9.O_RDONLY|(z9.O_NOFOLLOW??0)|(z9.O_NONBLOCK??0));let G=await z.stat({bigint:!0});if(!G.isFile()||G.dev!==Y.dev||G.ino!==Y.ino)throw new m6($,"source-changed");if(G.size>VQ)throw new m6($,"source-too-large");await J.onOpened?.();let Q=[],K=0;for(;;){let q=Buffer.alloc(65536),N=await z.read(q);if(!N.bytesRead)break;if(K+=N.bytesRead,K>VQ)throw new m6($,"source-too-large");Q.push(q.subarray(0,N.bytesRead))}let W=await z.stat({bigint:!0}),V=await WQ(Z,{bigint:!0});if(G.uid!==W.uid||G.gid!==W.gid||G.mode!==W.mode||V.uid!==G.uid||V.gid!==G.gid||V.mode!==G.mode||G.dev!==W.dev||G.ino!==W.ino||G.mtimeNs!==W.mtimeNs||G.ctimeNs!==W.ctimeNs||G.size!==W.size||V.dev!==G.dev||V.ino!==G.ino||V.isSymbolicLink()||V.mtimeNs!==G.mtimeNs||V.ctimeNs!==G.ctimeNs||V.size!==G.size||BigInt(K)!==G.size)throw new m6($,"source-changed");let B=Buffer.concat(Q,K),H;try{H=J1(new TextDecoder("utf-8",{fatal:!0}).decode(B))}catch{throw new m6($,"invalid-source")}if(!jT(H))throw new m6($,"invalid-source");return BQ({role:$,path:Z,digest:_T("sha256").update(B).digest("hex"),data:RT(H),metadata:Object.freeze({uid:Number(G.uid),mode:Number(G.mode),device:G.dev.toString(),inode:G.ino.toString(),modified:G.mtimeNs.toString(),changed:G.ctimeNs.toString()})})}catch(G){if(G instanceof m6)throw G;if(G instanceof Error&&"code"in G){if(G.code==="ENOENT")throw new m6($,"source-changed");if(G.code==="ELOOP")throw new m6($,"unsafe-source")}if(G instanceof SyntaxError)throw new m6($,"invalid-source");throw new m6($,"source-io")}finally{await z?.close()}}async function S0($){let Z=await O6($.role,$.path);if(Z.digest!==$.digest||JSON.stringify(Z.metadata)!==JSON.stringify($.metadata))throw new m6($.role,"source-changed")}var _J=["building","verified","activation-installed","committed","retired"];class J6 extends Error{code;constructor($){super({"migration-required":"Anthropic account migration is required. Stop OpenCode, LiteCode and Pi, then run bunx @cortexkit/opencode-anthropic-auth@2.0.0 setup","migration-incomplete":"Anthropic account migration is incomplete; resume setup","invalid-journal":"Anthropic account migration journal is invalid","journal-conflict":"Anthropic account migration journal changed"}[$]);this.code=$,this.name="NativeAuthorityError"}}function l$($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function FB($){try{return Q8($)}catch{throw new J6("invalid-journal")}}function oX($){try{return rV($)}catch{throw new J6("invalid-journal")}}function MJ($){return _J.some((Z)=>Z===$)}function V$($,Z){return Object.keys($).length===Z.length&&Z.every((J)=>Object.hasOwn($,J))}function B2($){return typeof $==="string"&&$.length===64&&/^[a-f0-9]{64}$/.test($)}function n1($){return $===null||B2($)}function Z4($){return $==="absent"||B2($)}function jJ($){return typeof $==="string"&&qT($)&&!/\p{Cc}/u.test($)&&!$.endsWith(FZ)&&OT($)===$&&(FZ!=="\\"||DT($).root!==FZ)&&!$.split(FZ).some((Z)=>Z==="."||Z==="..")}function TT($){return l$($)&&V$($,["config","state","hostAuth","routing"])&&n1($.config)&&n1($.state)&&Z4($.hostAuth)&&n1($.routing)}function PT($){return l$($)&&V$($,["source","destination"])&&jJ($.source)&&jJ($.destination)}function N$($){return typeof $==="string"&&$.length>0}function CT($){if(!l$($)||!V$($,["version","view","complete","rows","declined"])||$.version!==1||!N$($.view)||$.complete!==!0||!Array.isArray($.rows)||!Array.isArray($.declined))throw new J6("invalid-journal");let Z=$.rows.map((X)=>{if(!l$(X)||!V$(X,["routeId","credentialId","credentialType","accountIdentity","state","label","enabled","addedAt"])||!N$(X.routeId)||!N$(X.credentialId)||X.credentialType!=="oauth"||!N$(X.accountIdentity)||!N$(X.state)||typeof X.label!=="string"||typeof X.enabled!=="boolean"||typeof X.addedAt!=="number"||!Number.isFinite(X.addedAt))throw new J6("invalid-journal");return{routeId:X.routeId,credentialId:X.credentialId,credentialType:"oauth",accountIdentity:X.accountIdentity,state:X.state,label:X.label,enabled:X.enabled,addedAt:X.addedAt}}),J=$.declined.map((X)=>{if(!l$(X)||!N$(X.credentialId)||!(V$(X,["credentialId"])||V$(X,["credentialId","accountIdentity"])&&N$(X.accountIdentity)))throw new J6("invalid-journal");return N$(X.accountIdentity)?{credentialId:X.credentialId,accountIdentity:X.accountIdentity}:{credentialId:X.credentialId}});if(new Set(Z.map((X)=>X.routeId)).size!==Z.length)throw new J6("invalid-journal");return{version:1,view:$.view,complete:!0,rows:Z,declined:J}}function G9($,Z,J){if(!l$($)||!V$($,[...Z])||!Z.every((X)=>J($[X])))throw new J6("invalid-journal");return Object.fromEntries(Z.map((X)=>[X,$[X]]))}var FT=["prepared","published","committed"];function xT($,Z){if($===null)return null;if(!l$($))throw new J6("invalid-journal");if($.kind==="requested"&&V$($,["kind"]))return{kind:"requested"};if($.kind!=="activation"||Z!=="retired"||!V$($,["kind","phase","primary","roster","localProof","removeIds","settings","runtime","hostAuth"])||!FT.some((Q)=>Q===$.phase)||!l$($.primary)||!V$($.primary,["routeId","credentialId","accountIdentity"])||!N$($.primary.routeId)||!N$($.primary.credentialId)||!N$($.primary.accountIdentity)||!Array.isArray($.removeIds)||!$.removeIds.every(N$))throw new J6("invalid-journal");let J={routeId:$.primary.routeId,credentialId:$.primary.credentialId,accountIdentity:$.primary.accountIdentity},X=CT($.roster),Y=oX($.localProof),z=[...$.removeIds],G=new Set(Y.rows.map((Q)=>Q.id));if(z.some((Q,K)=>!G.has(Q)||K>0&&(z[K-1]??"")>=Q)||!X.rows.some((Q)=>Q.routeId===J.routeId&&Q.credentialId===J.credentialId&&Q.accountIdentity===J.accountIdentity))throw new J6("invalid-journal");return{kind:"activation",phase:$.phase,primary:J,roster:X,localProof:Y,removeIds:z,settings:G9($.settings,["source","target"],B2),runtime:G9($.runtime,["source","target"],B2),hostAuth:G9($.hostAuth,["source","expected"],Z4)}}function rX($,Z){let J=FB($);if(!l$(J)||J.storageId!==Z)throw new J6("invalid-journal");if(J.version===5&&J.kind==="empty-init"){if(!V$(J,["version","kind","storageId","host","phase"])||J.host!=="opencode"||J.phase!=="committed")throw new J6("invalid-journal");return{version:5,kind:"empty-init",storageId:Z,host:J.host,phase:J.phase}}let X=["version","storageId","host","phase","sources","routingPaths","hostAuthPath","expectedHostAuth","expectedRouting","preparedProof","activation"],Y=J.version===4?{version:4}:J.version===5&&J.kind==="legacy-import"&&B2(J.nativeSettingsDigest)?{version:5,kind:"legacy-import",nativeSettingsDigest:J.nativeSettingsDigest}:void 0;if(!Y||!V$(J,J.version===4?X:[...X,"kind","nativeSettingsDigest"])||J.host!=="opencode"&&J.host!=="pi"||!MJ(J.phase)||!TT(J.sources)||!PT(J.routingPaths)||!jJ(J.hostAuthPath)||J.expectedHostAuth!=="unprepared"&&!Z4(J.expectedHostAuth)||J.expectedRouting!=="unprepared"&&!n1(J.expectedRouting))throw new J6("invalid-journal");let z=J.expectedHostAuth==="unprepared",G=J.preparedProof===null?null:oX(J.preparedProof);if(z!==(J.expectedRouting==="unprepared")||z!==(G===null)||J.phase==="building"&&!z||J.phase!=="building"&&J.phase!=="verified"&&z||Y.version===4&&!z&&J.sources.routing===null!==(J.expectedRouting===null))throw new J6("invalid-journal");return{...Y,storageId:Z,host:J.host,phase:J.phase,sources:{config:J.sources.config,state:J.sources.state,hostAuth:J.sources.hostAuth,routing:J.sources.routing},routingPaths:{source:J.routingPaths.source,destination:J.routingPaths.destination},hostAuthPath:J.hostAuthPath,expectedHostAuth:J.expectedHostAuth,expectedRouting:J.expectedRouting,preparedProof:G,activation:xT(J.activation,J.phase)}}async function Q1($){try{let Z=await O6("journal",$.journal);if(!Z.data)return;if(!Z.metadata||(Z.metadata.mode&511)!==384||process.getuid&&Z.metadata.uid!==process.getuid())throw new J6("invalid-journal");return rX(Z.data,$.storageId)}catch{throw new J6("invalid-journal")}}function AT($){if(!$)return;if($.kind==="empty-init")return"committed";if($.phase!=="committed"&&$.phase!=="retired")return;if($.activation!==null&&($.activation.kind!=="activation"||$.activation.phase!=="committed"))return;return $.phase}async function RJ($){let Z=await Q1($);if(!Z)throw new J6("migration-required");if(!AT(Z))throw new J6("migration-incomplete");return Z}function xB($){if($===null||typeof $!=="object")return;for(let Z of Object.values($))xB(Z);Object.freeze($)}async function H2($,Z,J,X){let Y=rX(Z,$.storageId);if(Y.kind!=="empty-init"){if(Y.preparedProof){for(let z of Y.preparedProof.rows)Object.freeze(z);Object.freeze(Y.preparedProof.rows),Object.freeze(Y.preparedProof)}Object.freeze(Y.sources),Object.freeze(Y.routingPaths),xB(Y.activation)}Object.freeze(Y),await $1($.journal,Y,{beforeRename:async()=>{await X.onWriteStep?.("before-write",Y),await X.assertOwned?.(),await J()}}),await X.onWriteStep?.("after-write",Y)}async function ST($,Z,J={}){try{dX(Z)}catch{throw new J6("invalid-journal")}let X=rX({...Z.nativeSettingsDigest===void 0?{version:4}:{version:5,kind:"legacy-import",nativeSettingsDigest:Z.nativeSettingsDigest},storageId:$.storageId,host:Z.host,phase:"building",sources:Z.sources,routingPaths:Z.routingPaths,hostAuthPath:Z.hostAuthPath,expectedHostAuth:"unprepared",expectedRouting:"unprepared",preparedProof:null,activation:Z.activation===void 0?null:Z.activation==="requested"?{kind:"requested"}:"invalid"},$.storageId);if(X.kind==="empty-init")throw new J6("invalid-journal");return p6($.journal,{name:"migration-journal",ttlMs:30000,timeoutMs:15000,...J.lockOptions,renew:!0},async(Y)=>{let z=await Q1($);if(z?.kind==="empty-init"){if(z.host!==X.host)throw new J6("journal-conflict");return await H2($,X,()=>Y.assertOwned(),J),X}if(z){if(z.version!==X.version||z.version===5&&X.version===5&&z.nativeSettingsDigest!==X.nativeSettingsDigest||z.host!==X.host||z.sources.config!==X.sources.config||z.sources.state!==X.sources.state||z.sources.hostAuth!==X.sources.hostAuth||z.sources.routing!==X.sources.routing||z.routingPaths.source!==X.routingPaths.source||z.routingPaths.destination!==X.routingPaths.destination||z.hostAuthPath!==X.hostAuthPath||z.activation===null!==(X.activation===null))throw new J6("journal-conflict");return z}return await H2($,X,()=>Y.assertOwned(),J),X})}async function IT($,Z,J={}){let X=FB(Z);if(!l$(X)||!V$(X,["expectedHostAuth","expectedRouting","preparedProof"])||!Z4(X.expectedHostAuth)||!n1(X.expectedRouting))throw new J6("invalid-journal");let{expectedHostAuth:Y,expectedRouting:z}=X,G=oX(X.preparedProof);return p6($.journal,{name:"migration-journal",ttlMs:30000,timeoutMs:15000,...J.lockOptions,renew:!0},async(Q)=>{let K=await Q1($);if(!K)throw new J6("migration-required");if(K.kind==="empty-init"||K.phase!=="verified"||K.version===4&&K.sources.routing===null!==(z===null))throw new J6("journal-conflict");if(K.expectedHostAuth!=="unprepared"){if(K.expectedHostAuth!==Y||K.expectedRouting!==z||x6(K.preparedProof)!==x6(G))throw new J6("journal-conflict");return K}let W={...K,expectedHostAuth:Y,expectedRouting:z,preparedProof:G};return await H2($,W,()=>Q.assertOwned(),J),W})}async function sZ($,Z,J,X={}){if(!MJ(Z)||!MJ(J)||_J.indexOf(J)!==_J.indexOf(Z)+1)throw new J6("journal-conflict");return p6($.journal,{name:"migration-journal",ttlMs:30000,timeoutMs:15000,...X.lockOptions,renew:!0},async(Y)=>{let z=await Q1($);if(!z)throw new J6("migration-required");if(z.kind==="empty-init")throw new J6("journal-conflict");if(z.phase===J)return z;if(z.phase!==Z)throw new J6("journal-conflict");if(J==="activation-installed"&&z.expectedHostAuth==="unprepared")throw new J6("journal-conflict");let G={...z,phase:J};return await H2($,G,()=>Y.assertOwned(),X),G})}function ET($){return{name:"migration-journal",ttlMs:30000,timeoutMs:15000,...$.lockOptions,renew:!0}}async function wT($,Z={}){return p6($.journal,ET(Z),async(J)=>{let X;try{X=await Q1($)}catch(z){if(z instanceof J6&&z.code==="invalid-journal")throw new J6("journal-conflict");throw z}if(X){if(X.kind==="empty-init")return X;throw new J6("journal-conflict")}let Y={version:5,kind:"empty-init",storageId:$.storageId,host:"opencode",phase:"committed"};return await Z.assertOwned?.(),await H2($,Y,()=>J.assertOwned(),Z),Y})}var kT=["paths","publicationGuard","externalPolicy","failurePolicy","now","refreshToken","resolveIdentity"],HQ=["legacyConfig","legacyState","config","state","runtime","journal","roster","storageId"],bT=["checkedAt","nextRetryAt","retryCount"];function A7($){return TypeError(`Native local credential service option ${$} is invalid`)}function tX($,Z){if($===null||typeof $!=="object"||QT.isProxy($)||Object.getPrototypeOf($)!==Object.prototype&&Object.getPrototypeOf($)!==null)return;let J=Object.getOwnPropertyDescriptors($);for(let X of Reflect.ownKeys(J)){let Y=J[X];if(typeof X!=="string"||!Z.includes(X)||!Y||!Object.hasOwn(Y,"value"))return}return J}function Q9($,Z){let J=$[Z]?.value;if(typeof J!=="function")throw A7(Z);return J}function K9($,Z){let J=$[Z]?.value;if(J===void 0)return;if(typeof J!=="function")throw A7(Z);return J}function fT($){let Z=tX($,HQ);if(!Z)throw A7("paths");let J={};for(let X of HQ){let Y=Z[X]?.value;if(typeof Y!=="string"||Y.length===0)throw A7("paths");J[X]=Y}return Object.freeze(J)}function UQ($){let Z=structuredClone($),J=(X)=>{if(X===null||typeof X!=="object")return;for(let Y of Object.values(X))J(Y);Object.freeze(X)};return J(Z),Z}function vT($){let Z=tX($,bT);if(!Z||!Object.hasOwn(Z,"checkedAt"))throw TypeError("Native local failure policy result is invalid");let J=(z)=>Z[z]?.value,X=J("nextRetryAt"),Y=J("retryCount");return Object.freeze({checkedAt:J("checkedAt"),...X!==void 0?{nextRetryAt:X}:{},...Y!==void 0?{retryCount:Y}:{}})}function yT($){let Z=tX($,kT);if(!Z)throw TypeError("Native local credential service options are invalid");let J=fT(Z.paths?.value),X=Q9(Z,"publicationGuard"),Y=Q9(Z,"externalPolicy"),z=Q9(Z,"failurePolicy"),G=K9(Z,"now"),Q=K9(Z,"refreshToken"),K=K9(Z,"resolveIdentity");async function W(N,O){if(await X(N)!==!0)return;let U={beforePublish:async()=>{if(await X(N)!==!0)throw new g("publication-refused")}};try{await O(U)}catch(D){if(D instanceof g&&D.code==="publication-refused"&&await X(N)!==!0)return;throw D}}async function V(N){let O=UQ(N);if((O.status==="persisted"||O.status==="validation-observed")&&O.bootstrap==="resolved"){let _=O.context?.runtimeBinding;await W(O,(T)=>_&&_.identity===void 0?WR(J,O,T):BR(J,O,T));return}if(O.status!=="failed"&&O.status!=="persisted")return;let U=YB(O);if(U.kind==="none")return;let D=vT(z(Object.freeze({observation:O,attribution:UQ(U)})));await W(O,(_)=>LR(J,O,D,_))}let B=LT({paths:J,quota:A$,...G?{now:G}:{},...Q?{refreshToken:Q}:{},...K?{resolveIdentity:K}:{},...KT({paths:J,externalPolicy:Y,...G?{now:G}:{}}),reconcile:V});function H(N,O){return{status:"refused",reason:N instanceof J6?N.code:"authority-unavailable",persisted:O}}async function q(N){try{await RJ(J)}catch(U){return H(U,!1)}let O=await B.authorize(N);if(O.status!=="usable")return O;return RJ(J).then(()=>O,(U)=>H(U,O.source==="rotated"))}return Object.freeze({authorize:q})}function mT($){if(!($ instanceof Error))return!1;if($.name==="NativeCustodyError")return!0;if($.name!=="NativeRuntimeError")return!1;let Z=Reflect.get($,"code");return Z==="publication-refused"||Z==="unsafe-runtime"||Z==="invalid-runtime"}var hT=new Set(["Error","TypeError","AbortError","NativeCustodyError","NativeRuntimeError","NativeAccountReadError","LockContentionError"]),pT=new Set(["closed","not-enrolled","invalid-token","unavailable","identity-changed","identity-unasserted","insufficient-validity","invalid-material","not-active","route-unavailable","route-declined","no-receipt","unsafe-file","invalid-state","wrong-consumer","roster-busy","host-slot-login","host-slot-placeholder","placeholder-refresh","publication-refused","unsafe-runtime","invalid-runtime","runtime-io","runtime-conflict","EIO","ENOENT","EACCES","EPERM","ENOSPC","EAI_AGAIN","ECONNREFUSED","ECONNRESET","EHOSTUNREACH","ENETUNREACH","ENOTFOUND","ETIMEDOUT","UND_ERR_CONNECT_TIMEOUT"]);function lT($){let Z="unknown",J="unknown";try{if($ instanceof Error&&hT.has($.name))Z=$.name;if(!$||typeof $!=="object"||gT.isProxy($))return{name:Z,code:J};let X=(z)=>Object.getOwnPropertyDescriptor($,z)?.value,Y=X("code");if(typeof Y==="string"&&pT.has(Y))J=Y;else{let z=X("status");if(typeof z==="number"&&Number.isInteger(z)&&z>=100&&z<=599)J=`HTTP_${z}`;else J=nK({code:Y,message:X("message")})??"unknown"}}catch{}return{name:Z,code:J}}function uT($,Z){let J="warn";try{if(mT(Z))J="error"}catch{}n[J]($,"Account usage publication unavailable",lT(Z))}function dT($){let Z=new Set,J=(X)=>{let Y=X.then(()=>{},(z)=>uT($,z));return Z.add(Y),Y.then(()=>Z.delete(Y),()=>Z.delete(Y)),Y};return{observe:J,publish(X){J(new Promise((Y)=>setTimeout(Y,0)).then(X))},async drain(){while(Z.size)await Promise.allSettled([...Z])}}}function AB($){return["five_hour","seven_day"].some((Z)=>($[Z]?.remainingPercent??1)<=0)}function NQ($){return $?.identity?JSON.stringify([$.storageId,$.rowId,$.credentialEpoch,$.identity]):void 0}class SB extends Map{publications=dT("quota");set($,Z){if(this.delete($),this.size>=1000){let J=this.keys().next().value;if(J!==void 0)this.delete(J)}return super.set($,Z)}quota($,Z,J,X,Y=Date.now()){if(!$||!Z)return;let z=J,G,Q=!1;for(let K of this.values()){if(K.entry.quota.source==="headers")continue;if(K.lineage!==$||K.accountUuid!==Z||s0(K.entry.quota,X,K.entry.checkedAt)<=Y)continue;Q=!0,z=x$(A$.merge(z?J0(z):void 0,J0(K.entry.quota))),G=Math.max(G??0,K.quotaErrorClearedAt??0)}return Q&&z?{quota:z,clearAt:G}:void 0}publish($,Z,J){let X=this.get($);if(!X||X.lineage!==Z.lineage||r6(X.entry.quota)<=r6(Z.entry.quota))this.set($,Z);return this.publications.observe(Promise.resolve().then(async()=>{let Y=!1;try{let z=this.get($);if(z&&z.lineage===Z.lineage&&r6(z.entry.quota)>r6(Z.entry.quota))return;Y=await J()}catch{}finally{if(!Y){if(this.get($)===Z)this.delete($);n.warn("quota","Quota publication discarded")}}}))}drain(){return this.publications.drain()}}var LQ=new WeakMap,cT=0;function IB($){if(!$)return;let Z=LQ.get($);if(Z===void 0)Z=++cT,LQ.set($,Z);return Z}function iT($){let Z=$.env??process.env,J=A2($.host,Z),X=eX($.host,Z),Y=$.paths;return JSON.stringify([$.host,Y.storageId,...["legacyConfig","legacyState","config","state","runtime","journal","roster"].map((z)=>w1(Y[z])),w1(J.tokenPath),w1(J.statePath),w1(X)])}function eX($,Z){return w1(gK($==="pi"?Z.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE:void 0,$==="pi"?{...Z,OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE:void 0}:Z))}class $Y{entries=new Map;acquire($,Z){let J=this.entries.get($);if(!J)J={runtime:Z(),users:0},this.entries.set($,J);let X=J;X.users++;let Y=!1;return{use:()=>{if(Y)throw new o("closed");return X.runtime},close:()=>{if(Y)return;if(Y=!0,--X.users!==0)return;if(this.entries.get($)===X)this.entries.delete($);X.runtime.close()}}}}var qQ="Anthropic account update in progress; retry the request",EB=new WeakSet;class TJ extends Error{constructor(){super(qQ);let $={name:"NativeTransientAccountError",message:qQ,code:"ECONNRESET",syscall:"native-account-update"};for(let[Z,J]of Object.entries($))Object.defineProperty(this,Z,{value:J,enumerable:Z==="code"||Z==="syscall",writable:!1,configurable:!1});EB.add(this)}}function R3($){return typeof $==="object"&&$!==null&&EB.has($)}var sT=2000;async function aT($,Z,J){let X=performance.now(),Y=()=>sT-(performance.now()-X),z=[],G="joined",Q;try{for(let W of b2($)){for(;;){if(J(),Y()<=0){G="deadline";break}let V=await g0({path:W.path,name:W.name,ttlMs:i6.ttlMs,renew:!1});if(V)z.push(V);if(Y()<=0){G="deadline";break}if(V)break;await nT(Math.min(i6.retryMs,Y()),Z)}if(G==="deadline")break}}catch(W){Q={error:W}}let K;for(let W of z.reverse()){let[V]=await Promise.allSettled([W.release()]);if(V.status==="rejected")K??={error:V.reason}}if(Q)throw Q.error;if(K)throw K.error;return J(),G}function nT($,Z){if(Z.some((J)=>J.aborted))return Promise.resolve();return new Promise((J)=>{let X=()=>{clearTimeout(Y);for(let z of Z)z.removeEventListener("abort",X);J()},Y=setTimeout(X,$);for(let z of Z)z.addEventListener("abort",X,{once:!0})})}function T1($,Z,J,X){return rT($)===Z?eT(tT($),J):$.replace(/(?:\.json)?$/,`.${X}.json`)}function wB($){let Z=T1($.legacyConfig,"anthropic-auth.json","anthropic-auth-vault-settings.json","vault-settings"),J=T1($.legacyState,"anthropic-auth-state.json","anthropic-auth-vault-store-state.json","vault-store"),X=T1($.legacyState,"anthropic-auth-state.json","anthropic-auth-vault-state.json","vault-native"),Y=T1($.legacyState,"anthropic-auth-state.json","anthropic-auth-vault-roster.json","vault-roster"),z=T1($.legacyState,"anthropic-auth-state.json","anthropic-auth-vault-routing-state.json","vault-routing"),G=[Z,J,X,Y,z],Q=[$.legacyConfig,$.legacyState,$.config,$.state,$.runtime,$.journal,$.roster];if(new Set([...Q,...G]).size!==Q.length+G.length)throw Error("Vault storage overlaps local account storage");return{legacySeedConfig:$.legacyConfig,config:Z,state:J,runtime:X,roster:Y,routing:z,storageId:oT("sha256").update(JSON.stringify(["anthropic-vault",Z,J])).digest("hex")}}function JP($){switch($){case"roster-incomplete":case"unenrolled-local-row":case"roster-route-conflict":case"seed-conflict":return $;default:return"seed-conflict"}}class PJ extends Error{code;constructor($){let Z=JP($);super(`Native roster seed refused: ${Z}`);this.name="NativeRosterSeedError",this.code=Z}}function kB($){let Z={fallback:"seed-conflict"},J=(X)=>{throw Z.refused=X,new PJ(X)};try{return $(Z,J)}catch{throw new PJ(Z.refused??Z.fallback)}}function X$($){return typeof $==="string"&&$.trim()!==""}function J4($,Z,J){if(typeof $!=="object"||$===null||ZP.isProxy($))J(Z);return $}function X4($,Z,J,X){let Y=Object.getOwnPropertyDescriptor($,Z);if(Y===void 0)return;if(Object.hasOwn(Y,"get")||Object.hasOwn(Y,"set"))X(J);return Y.value}function z8($,Z,J,X){let Y=J4($,J,X),z={};for(let G of Z)z[G]=X4(Y,G,J,X);return z}function CJ($,Z,J){let X=J4($,Z,J);if(!Array.isArray(X))J(Z);let Y=X4(X,"length",Z,J);if(typeof Y!=="number")J(Z);return Y}function e0($,Z,J){let X=J4($,Z,J),Y=CJ(X,Z,J),z=[];for(let G=0;G<Y;G++)z.push(X4(X,String(G),Z,J));return z}function bB($,Z,J){let X=J4($,"seed-conflict",J),Y=(j,A)=>X4(X,j,A,J);Z.fallback="roster-incomplete";let z=z8(Y("inventory","roster-incomplete"),["view","credentials","skipped"],"roster-incomplete",J),G=z.view,Q=e0(z.skipped,"roster-incomplete",J),K=e0(z.credentials,"roster-incomplete",J).map((j)=>z8(j,["credentialId","credentialType","accountIdentity","state"],"roster-incomplete",J));if(!X$(G)||Q.length>0)J("roster-incomplete");let W=new Map;for(let j of K){let{credentialId:A,credentialType:E,accountIdentity:P,state:I}=j;if(!X$(A)||!X$(P)||!X$(I)||W.has(A))J("roster-incomplete");W.set(A,{credentialType:E,accountIdentity:P,state:I})}let V=z8(Y("primary","roster-incomplete"),["credentialId","accountIdentity"],"roster-incomplete",J),B=V.credentialId,H=V.accountIdentity;Z.fallback="seed-conflict";let q=Y("primaryRouteId","seed-conflict"),N=e0(Y("legacyRows","seed-conflict"),"seed-conflict",J).map((j)=>z8(j,["routeId","scopedCredentialId","anthropicAccountUuid","label","addedAt","enabled"],"seed-conflict",J)),O=e0(Y("disabledAccountIdentities","seed-conflict"),"seed-conflict",J),U=e0(Y("reservedRouteIds","seed-conflict"),"seed-conflict",J);for(let j of[...O,...U])if(typeof j!=="string")J("seed-conflict");let D=new Set(O),_=new Set(U);function T(j,A){let E=W.get(j);if(E?.credentialType!=="oauth"||E.accountIdentity!==A)J("roster-incomplete");return E.state}if(!X$(B)||!X$(H))J("roster-incomplete");let M=T(B,H);for(let j of N)if(!X$(j.scopedCredentialId))J("unenrolled-local-row");let L=N.map((j)=>{let{scopedCredentialId:A,anthropicAccountUuid:E}=j;if(!X$(A)||!X$(E))J("roster-incomplete");return{row:j,credentialId:A,identity:E,state:T(A,E)}}),C=new Set;for(let j of[q,...N.map((A)=>A.routeId)]){if(!X$(j)||j==="main"||_.has(j)||C.has(j))J("roster-route-conflict");C.add(j)}if(!X$(q))J("roster-route-conflict");let w=new Set([B]),v=new Set([H]),h=L.map(({row:j,credentialId:A,identity:E,state:P})=>{if(w.has(A)||v.has(E))J("seed-conflict");w.add(A),v.add(E);let{routeId:I,label:k,addedAt:F,enabled:S}=j;if(!X$(I)||typeof S!=="boolean"||F!==void 0&&(typeof F!=="number"||!Number.isFinite(F))||k!==void 0&&typeof k!=="string")J("seed-conflict");return{routeId:I,credentialId:A,credentialType:"oauth",accountIdentity:E,state:P,label:X$(k)?k:I,enabled:S,addedAt:F??0}}),a=[{routeId:q,credentialId:B,credentialType:"oauth",accountIdentity:H,state:M,label:q,enabled:!D.has(H),addedAt:0},...h],p=a.filter((j)=>!j.enabled).map((j)=>({credentialId:j.credentialId,accountIdentity:j.accountIdentity,exactCredential:!0})),R=[...D].filter((j)=>!v.has(j)).sort();for(let j of R){let A=[...W].filter(([,E])=>E.accountIdentity===j).map(([E])=>E).sort()[0];if(A!==void 0)p.push({credentialId:A,accountIdentity:j,exactCredential:!1})}return{view:G,rows:a,declined:p,unseeded:new Set(R)}}function FJ($){return kB((Z,J)=>{let X=bB($,Z,J);return{version:1,view:X.view,complete:!0,rows:X.rows.map((Y)=>({...Y})),declined:X.declined.map(({credentialId:Y,accountIdentity:z})=>({credentialId:Y,accountIdentity:z}))}})}function XP($,Z){kB((J,X)=>{let Y=bB(Z,J,X);J.fallback="seed-conflict";let z=z8($,["version","complete","view","rejected","rows","declined"],"seed-conflict",X),{version:G,complete:Q,view:K,rejected:W}=z,V=e0(z.rows,"seed-conflict",X).map((U)=>z8(U,["routeId","credentialId","credentialType","accountIdentity","aliases","label","addedAt","enabled","stale","unclaimed"],"seed-conflict",X)),B=e0(z.declined,"seed-conflict",X).map((U)=>z8(U,["credentialId","accountIdentity"],"seed-conflict",X));if(G!==1||Q!==!0||typeof K!=="string"||W!==void 0&&CJ(W,"seed-conflict",X)>0||V.length!==Y.rows.length)X("seed-conflict");let H=new Map(Y.rows.map((U)=>[U.routeId,U])),q=new Set;for(let U of V){let D=typeof U.routeId==="string"?H.get(U.routeId):void 0;if(!D||q.has(D.routeId)||U.credentialId!==D.credentialId||U.credentialType!=="oauth"||U.accountIdentity!==D.accountIdentity||U.aliases!==void 0&&CJ(U.aliases,"seed-conflict",X)>0||U.label!==D.label||U.addedAt!==D.addedAt||U.enabled!==D.enabled||U.stale!==void 0||U.unclaimed!==void 0)X("seed-conflict");q.add(D.routeId)}let N=new Map(Y.declined.map((U)=>[U.accountIdentity,U])),O=new Set;for(let{credentialId:U,accountIdentity:D}of B){if(typeof U!=="string"||typeof D!=="string"||O.has(D))X("seed-conflict");let _=N.get(D);if(_?_.exactCredential&&U!==_.credentialId:!Y.unseeded.has(D))X("seed-conflict");O.add(D)}for(let U of N.keys())if(!O.has(U))X("seed-conflict")})}function fB($,Z,J){return{profile:{tier:$.tier,orgType:$.orgType,checkedAt:$.checkedAt,...$.accountIdentity!==void 0&&{accountIdentity:$.accountIdentity},...$.providerAccountUuid!==void 0&&{providerAccountUuid:$.providerAccountUuid}},persisted:Promise.resolve().then(Z).then((X)=>X?"saved":"refused",(X)=>X instanceof o||X instanceof J6||X instanceof g&&X.code!=="runtime-io"?"refused":"failed"),isCurrent:()=>Promise.resolve().then(J).then((X)=>X,()=>!1)}}async function A3($,Z){let J={...$.env??process.env},X=eX($.host,J),Y=PB({host:$.host,readToken:$.readToken,now:$.now,env:J,connect:$.connect??(()=>y$.connect({connectionFile:X,identity:$.identity}))});try{return await Y.discover(Z)}finally{Y.close()}}function YP($){let Z=Object.freeze(wB($.paths)),J={...$.env??process.env},X=eX($.host,J),Y=$.identity?{...$.identity}:void 0,z=new AbortController,G=X0({paths:Z,quota:A$}),Q=PB({host:$.host,readToken:$.readToken,now:$.now,connect:$.connect??(()=>y$.connect({connectionFile:X,identity:Y})),env:J}),K=new WeakMap,W=new WeakSet,V=new Map,B=new Set(["main"]),H,q=new Set,N,O,U;function D(){let P=[...q].filter((k)=>k.intervalMs>0).sort((k,F)=>k.intervalMs-F.intervalMs)[0];if(U?.ms===P?.intervalMs)return;if(U)U.clear(U.handle);if(U=void 0,!P)return;let I=(P.setInterval??setInterval)(()=>{_().catch(()=>{})},P.intervalMs);I.unref?.(),U={handle:I,clear:P.clearInterval??clearInterval,ms:P.intervalMs}}function _(){if(O)return O;return O=(async()=>{let P=await Promise.all([...q].map(async(I)=>!I.shouldRefresh||await I.shouldRefresh()));if(z.signal.aborted||!P.some(Boolean))return;if(await p.refresh(z.signal),z.signal.aborted)return;for(let I of q)Promise.resolve().then(()=>{if(q.has(I))return I.onRefresh?.()}).catch(()=>{})})().finally(()=>{O=void 0}),O}function T(P){if(z.signal.aborted)throw new o("closed");P?.throwIfAborted()}function M(P){return T(P),AbortSignal.any([z.signal,...P?[P]:[]])}async function L(){T();let P=await iZ($.host,J);return T(),P==="claustrum"}async function C(P){if(T(P),!await L())throw new o("route-unavailable");T(P)}async function w(P,I=!1){if(await C(P),I&&!await uZ(Z.config))return;await Y0(Z.roster,async(k,F)=>{if(I&&!await uZ(Z.config))return{result:void 0};let S=k?.rows.find((b)=>(b.credentialId===MZ||b.aliases?.includes(MZ))&&b.credentialType==="oauth"&&b.state==="active"&&!b.stale&&!b.unclaimed&&typeof b.accountIdentity==="string"&&b.accountIdentity.length>0),m=await G.readSettings();if(m.status!=="ready")throw new o("invalid-state");let f=F7(m.settings);if(!I&&(!S&&!f||S&&f?.routeId===S.routeId&&f.credentialId===MZ&&f.accountIdentity===S.accountIdentity))return{result:void 0};return await X0({paths:Z,quota:A$,onStep:async(b)=>{if(b==="before-config-write"||b==="before-state-write")await C(P),await F.assertOwned()}}).updateSettings(async(b)=>{if(I&&!await uZ(Z.config))return b;if(S)b.mainAccountId=S.routeId,b.claustrum={primaryAccount:{credentialId:MZ,accountId:S.accountIdentity}};else delete b.mainAccountId,delete b.claustrum;return b}),{result:void 0}})}async function v(P,I){let k=await G.readSettings();if(k.status!=="ready")throw new o("invalid-state");let F=F7(k.settings);return I==="main"||I===F?.routeId?NJ(P,F):P?.rows.find((S)=>S.routeId===I)}function h(P){T();let I=K.get(P);if(!I)throw new o("no-receipt");return I}let a=new SB,p={quotaObservations:a,drainQuotaPublications:()=>a.drain(),quotaLineage(P,I,k){if(!I||!k)return;let F=JSON.stringify([P,I,k]),S=V.get(F);if(S===void 0&&P==="main")for(let[m,f]of V){let[,x,b]=JSON.parse(m);if(x===I&&b===k)S=Math.max(S??0,f)}return S===void 0?void 0:JSON.stringify([I,k,S])},watch(P){if(T(),!Number.isFinite(P.intervalMs)||P.intervalMs<0)throw RangeError("Invalid native vault poll interval");let I={...P};q.add(I),D(),N??=_();let k=!1;return{ready:N,close(){if(k)return;if(k=!0,q.delete(I),D(),!q.size)N=void 0}}},initializeSettings:()=>w(void 0,!0),async read(){await C();let P=await h6(Z.roster);return T(),P},async refresh(P){if(T(P),!await L())return;return T(P),H??=TB({path:Z.roster,custody:$.discover?{discover:$.discover}:Q,signal:z.signal,isActive:L,projection:()=>({reservedRouteIds:B})}).then(async(I)=>{return await w(z.signal),I}).finally(()=>{H=void 0}),GP(H,M(P))},async authorize(P,I){let k=M(I);await C(k);let F=await h6(Z.roster)??await p.refresh(k),S=await v(F,P);if(S?.credentialType!=="oauth"||!S.accountIdentity)throw new o("route-unavailable");if(!S.enabled)throw new o("route-declined");if(!_6(S))throw new o("not-active");let m=await Q.authorize({credentialId:S.credentialId,accountIdentity:S.accountIdentity},k);await C(k);let f=await v(await h6(Z.roster),P);if(!f?.enabled||f.routeId!==S.routeId||f.accountIdentity!==S.accountIdentity||f.credentialId!==m.credentialId&&!f.aliases?.includes(m.credentialId))throw new o("identity-changed");if(!_6(f))throw new o("not-active");T(k),K.set(m,{routeId:S.routeId,logicalId:P});let x=JSON.stringify([S.routeId,m.credentialId,m.assertedAccountIdentity]);return V.set(x,Math.max(V.get(x)??0,m.recordVersion)),m},async reportFailure(P,I,k){h(P),await Q.reportFailure(P,I,k)},async prepareRetry(P,I,k){let F=h(P),S=async()=>{if(W.has(P))return[{retry:!1,reason:"version-not-newer"},void 0];W.add(P);let x;try{x=await p.authorize(F.logicalId,I)}catch(b){return T(I),[{retry:!1,reason:"reauthorize-failed",code:b instanceof o?b.code:"unavailable"},void 0]}if(x.credentialId!==P.credentialId)return[{retry:!1,reason:"credential-changed"},x];if(x.assertedAccountIdentity!==P.assertedAccountIdentity)return[{retry:!1,reason:"account-changed"},x];if(!(x.recordVersion>P.recordVersion))return[{retry:!1,reason:"version-not-newer"},x];return W.add(x),[{retry:!0,receipt:x},x]},[m,f]=await S();if(k)n.debug("claustrum","scoped 401 re-authorized",{site:k,credentialId:P.credentialId,servedVersion:P.recordVersion,currentVersion:f?.recordVersion??null,retry:m.retry,reason:m.retry?"rotated":m.reason});return m},publish(P,I){let k=zB(I);return j(P,(F)=>{if(k.quota&&k.quota.source!=="headers"&&F.quota&&r6(x$(F.quota))>r6(k.quota))throw new g("runtime-conflict");return GB(F,k)},zP(k)?"skip":"refuse")},resetBackoff(P,I="all"){return j(P,(k)=>{let F=Math.max($.now?.()??Date.now(),k.refreshErrorClearedAt??0,k.quotaErrorClearedAt??0,k.lastRefreshError?.checkedAt??0,k.lastQuotaRefreshError?.checkedAt??0),S={...k};if(I!=="quota")delete S.lastRefreshError,S.refreshErrorClearedAt=F;if(I!=="refresh")delete S.lastQuotaRefreshError,S.quotaErrorClearedAt=F,S.quotaErrorGeneration=(k.quotaErrorGeneration??0)+1;return S})},async getOrCreateAuthLineage(P){let I;return await j(P,(F)=>{return I=F.authLineageId??$P(),{...F,authLineageId:I}})?I:void 0},incrementPrimeUsage(P,I={}){let k=I.inputTokens??0,F=I.outputTokens??0;if(![k,F].every((S)=>Number.isSafeInteger(S)&&S>=0))throw new g("publication-refused");return j(P,(S)=>({...S,prime:{count:(S.prime?.count??0)+1,inputTokens:(S.prime?.inputTokens??0)+k,outputTokens:(S.prime?.outputTokens??0)+F,since:S.prime?.since??$.now?.()??Date.now()}}))},async fetchQuota(P,I=fetch,k,F){let S=await v(await p.read(),P),m=await h$(Z.runtime,Z.storageId),f=m.status==="ready"?m.state.accounts[S?.routeId??""]:void 0,x=(Z6)=>{let M6=K.get(Z6),j6=f?.binding;return M6&&j6?.kind==="custody"&&j6.storageId===Z.storageId&&j6.routeId===M6.routeId&&j6.credentialId===Z6.credentialId&&j6.accountIdentity===Z6.assertedAccountIdentity&&j6.recordVersion<=Z6.recordVersion?f:void 0},b=await A(P,I,k,(Z6,M6)=>G7({accessToken:Z6.accessToken,fetchImpl:M6,now:$.now}),async(Z6,M6)=>{let j6=x(M6),N0=QB(Z6,M6.assertedAccountIdentity,Math.max($.now?.()??Date.now(),(j6?.quotaErrorClearedAt??-1)+1),j6?.lastQuotaRefreshError);if(N0)await p.publish(M6,{lastQuotaRefreshError:N0})},F),y={...b.value,accountIdentity:b.receipt.assertedAccountIdentity},d=b.receipt.assertedAccountIdentity;if(!d)throw new o("identity-unasserted");let s=x(b.receipt),r=y.checkedAt??$.now?.()??Date.now(),K6=Math.max(r,s?.quotaErrorClearedAt??0,s?.lastQuotaRefreshError?.checkedAt??0);return a.publish(P,{lineage:JSON.stringify([b.receipt.credentialId,b.receipt.accountIdentity,b.receipt.recordVersion]),accountUuid:d,entry:{quota:y,checkedAt:r,refreshAfter:r},generalExhausted:AB(y),quotaErrorClearedAt:K6},()=>p.publish(b.receipt,{quota:y,quotaErrorClearedAt:K6})),y},async fetchProfile(P,I=fetch,k){let F=await E(P,I,k);return await p.publish(F.receipt,{profile:F.value}),F.value},async fetchProfileForDisplay(P,I=fetch,k){let F=await E(P,I,k);return fB(F.value,()=>p.publish(F.receipt,{profile:F.value}),R(F.receipt))},async setEnabled(P,I){await C();let k=await h6(Z.roster),F=await v(k,P);if(!F)throw new o("route-unavailable");return Y0(Z.roster,(S)=>{let m=S?.rows.find((f)=>f.routeId===F.routeId);if(!S||!m)throw new e("route-unavailable","Claustrum route is not in the roster");return{next:{...S,declined:I?RB(S.declined,[m.credentialId,...m.aliases??[]],m.accountIdentity):jB(S.declined,m.credentialId,m.accountIdentity),rows:S.rows.map((f)=>f===m?{...f,enabled:I}:f)},result:m.enabled!==I}})},close(){if(q.clear(),D(),z.signal.aborted)return;z.abort(new o("closed")),Q.close()}};function R(P){let{routeId:I,logicalId:k}=h(P),F={routeId:I,logicalId:k,credentialId:P.credentialId,accountIdentity:P.assertedAccountIdentity,recordVersion:P.recordVersion},S=JSON.stringify([I,F.credentialId,F.accountIdentity]);return async()=>{await C();let m=await v(await h6(Z.roster),F.logicalId);if(!m||!_6(m)||m.routeId!==F.routeId||m.accountIdentity!==F.accountIdentity||m.credentialId!==F.credentialId&&!m.aliases?.includes(F.credentialId)||(V.get(S)??0)>F.recordVersion)return!1;let f=await h$(Z.runtime,Z.storageId);if(f.status==="missing")return!0;if(f.status!=="ready")return!1;let x=f.state.accounts[F.routeId]?.binding;return!x||x.kind==="custody"&&x.accountIdentity===F.accountIdentity&&x.credentialId===F.credentialId&&x.recordVersion<=F.recordVersion}}async function j(P,I,k="refuse"){let F=h(P);await C();let S=JSON.stringify([F.routeId,P.credentialId,P.assertedAccountIdentity]);if((V.get(S)??0)>P.recordVersion)return!1;return Y0(Z.roster,async(m,f)=>{let x=await v(m,F.logicalId);if(!x?.accountIdentity||x.routeId!==F.routeId||x.accountIdentity!==P.assertedAccountIdentity||x.credentialId!==P.credentialId&&!x.aliases?.includes(P.credentialId))return{result:!1};let b=x.accountIdentity,y=!1;try{if((await GR(Z.runtime,Z.storageId,(s)=>{let r=s.accounts[F.routeId],K6=r?.binding;if(K6?.kind==="custody"&&K6.credentialId===P.credentialId&&K6.accountIdentity===P.assertedAccountIdentity&&K6.recordVersion>P.recordVersion)throw new g("runtime-conflict");let Z6=K6?.kind==="custody"&&K6.accountIdentity===P.assertedAccountIdentity;return s.accounts[F.routeId]=I({...Z6?r:{},binding:{kind:"custody",storageId:Z.storageId,routeId:F.routeId,credentialId:P.credentialId,accountIdentity:b,recordVersion:P.recordVersion}}),y=!0,s},{beforeRename:async()=>{await C();let s=await v(m,F.logicalId);if(!s||s.routeId!==F.routeId||s.accountIdentity!==P.assertedAccountIdentity)throw new g("publication-refused");let r=(V.get(S)??0)>P.recordVersion;if(r&&k==="refuse")throw new g("runtime-conflict");return await f.assertOwned(),r?"skip":"publish"}})).status==="skipped")return{result:!1}}catch(d){if(d instanceof g&&d.code==="runtime-conflict")return{result:!1};throw d}return{result:y}})}async function A(P,I,k,F,S,m){let f=M(k),x=await p.authorize(P,f),b=(r,K6)=>{let Z6=()=>I(r,{...K6,signal:f});if(!m)return Z6();return m(Z6,async()=>{await C(f);let M6=h(x),j6=await v(await h6(Z.roster),M6.logicalId),N0=JSON.stringify([M6.routeId,x.credentialId,x.assertedAccountIdentity]);if(!j6||!_6(j6)||j6.routeId!==M6.routeId||j6.accountIdentity!==x.assertedAccountIdentity||j6.credentialId!==x.credentialId&&!j6.aliases?.includes(x.credentialId)||(V.get(N0)??x.recordVersion)>x.recordVersion)throw new o("identity-changed");await C(f)})},y,d=Object.assign(async(r,K6)=>{y=void 0;let Z6=await b(r,K6);if(y=Z6.status,Z6.status===401&&!f.aborted){await Z6.body?.cancel().catch(()=>{});let M6=(Y4)=>p.reportFailure(Y4,401,"direct").catch(()=>{T(f)}),j6=x,N0;try{N0=await p.prepareRetry(j6,f,"quota-profile")}catch(Y4){throw await M6(j6),Y4}if(!N0.retry)return await M6(j6),Z6;x=N0.receipt;let GY=new Headers(K6?.headers);if(GY.set("authorization",`Bearer ${x.accessToken}`),y=void 0,Z6=await b(r,{...K6,headers:GY}),y=Z6.status,Z6.status===401)await M6(x)}return Z6},{preconnect:I.preconnect}),s;try{s=await F(x,d)}catch(r){T(f);let K6=r instanceof o||r instanceof g?r:WB(r,y);throw await S?.(K6,x),K6}return T(f),{value:s,receipt:x}}function E(P,I,k){return A(P,I,k,(F,S)=>QV({accessToken:F.accessToken,accountIdentity:F.assertedAccountIdentity,fetchImpl:S,now:$.now,signal:k}))}return p}function zP($){let Z=Object.keys($);return Z.length===1&&Z[0]==="lastUsed"&&typeof $.lastUsed==="number"}function GP($,Z){return new Promise((J,X)=>{let Y=()=>{z(),X(Z.reason)},z=()=>Z.removeEventListener("abort",Y);if(Z.addEventListener("abort",Y,{once:!0}),$.then((G)=>{z(),Z.aborted?X(Z.reason):J(G)},(G)=>{z(),X(G)}),Z.aborted)Y()})}var QP=new $Y;function vB($){return JSON.stringify([iT($),$.identity?Object.entries($.identity).sort(([Z],[J])=>Z.localeCompare(J)):void 0,...[$.connect,$.discover,$.readToken,$.now].map(IB)])}function KP($){let{use:Z,close:J}=QP.acquire(vB($),()=>YP($));return yB(Z,J)}function yB($,Z){let J=new Set,X=$().quotaObservations;return{quotaObservations:X,drainQuotaPublications:()=>X.drain(),quotaLineage:(Y,z,G)=>$().quotaLineage(Y,z,G),watch:(Y)=>{let z=$().watch(Y);return J.add(z),{ready:z.ready,close(){J.delete(z),z.close()}}},initializeSettings:()=>$().initializeSettings(),read:()=>$().read(),refresh:(Y)=>$().refresh(Y),authorize:(Y,z)=>$().authorize(Y,z),reportFailure:(Y,z,G)=>$().reportFailure(Y,z,G),prepareRetry:(Y,z,G)=>$().prepareRetry(Y,z,G),publish:(Y,z)=>$().publish(Y,z),fetchQuota:(Y,z,G,Q)=>$().fetchQuota(Y,z,G,Q),fetchProfile:(Y,z,G)=>$().fetchProfile(Y,z,G),fetchProfileForDisplay:(Y,z,G)=>$().fetchProfileForDisplay(Y,z,G),setEnabled:(Y,z)=>$().setEnabled(Y,z),resetBackoff:(Y,z)=>$().resetBackoff(Y,z),getOrCreateAuthLineage:(Y)=>$().getOrCreateAuthLineage(Y),incrementPrimeUsage:(Y,z)=>$().incrementPrimeUsage(Y,z),close(){for(let Y of J)Y.close();J.clear(),Z()}}}var uB="main",MP=900000,DQ=604800000,jP=3600000,RP=1e4,TP=5000,PP=10,_Q=4096,CP=0.000001;function f3($){let Z=$.modelId,J=Z?$.routeQuotas.map((H)=>H0(H,Z)).find(Boolean)?.modelName:void 0,X;if(X7($.mainRefreshError))X=J?`Main Claude OAuth account requires re-login, and no fallback OAuth account is currently routable for ${J}.`:"Main Claude OAuth account requires re-login, and no fallback OAuth account is currently routable.";else if($.fallbackReauthLabels?.length)X=`No OAuth account is currently routable${J?` for ${J}`:""}. Fallback Claude OAuth accounts require re-login: ${$.fallbackReauthLabels.join(", ")}.`;if(X)return new Response(JSON.stringify({type:"error",error:{type:"authentication_error",message:X}}),{status:401,headers:{"content-type":"application/json"}});let Y=Boolean(Z&&$.routeQuotas.length>0&&$.routeQuotas.every((H)=>!XW(H,Z))),[z,...G]=$.routeQuotas,Q=yL(z,G.map((H)=>({quota:H})),$.now??Date.now(),Y?Z:void 0),K=Math.floor(Q/60),W=Q%60,B=`${Y&&J?`${J} weekly limit reached, no routable OAuth accounts.`:"No OAuth account currently satisfies sticky-balanced quota policy."} Retry in ${K}m ${W}s.`;return new Response(JSON.stringify({type:"error",error:{type:"rate_limit_error",message:B}}),{status:429,headers:{"content-type":"application/json","retry-after":String(Q)}})}function b0($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function k1($){return typeof $==="number"&&Number.isFinite($)?$:void 0}function dB($){if(!b0($))return;if(typeof $.accountId!=="string"||!["fable","opus","general"].includes(String($.family)))return;let Z=k1($.assignedAt),J=k1($.lastSeenAt),X=k1($.initialInputBytes),Y=k1($.quotaCheckedAt);if(Z===void 0||J===void 0||X===void 0||Y===void 0)return;if(Object.hasOwn($,"affinityModelId")&&typeof $.affinityModelId!=="string")return;if(Object.hasOwn($,"accountIdentity")&&(typeof $.accountIdentity!=="string"||$.accountIdentity.length===0||$.accountIdentity.trim()!==$.accountIdentity))return;return{accountId:$.accountId,...typeof $.accountIdentity==="string"?{accountIdentity:$.accountIdentity}:{},family:$.family,affinityModelId:typeof $.affinityModelId==="string"?$.affinityModelId:void 0,assignedAt:Z,lastSeenAt:J,initialInputBytes:Math.max(0,X),quotaCheckedAt:Y}}function xJ($){if(!b0($)||$.version!==1||!b0($.assignments))return;let Z={};for(let[J,X]of Object.entries($.assignments)){let Y=dB(X);if(Y)Z[J]=Y}return{version:1,updatedAt:k1($.updatedAt)??0,assignments:Z,...$.vaultLegacySeed==="pending"||$.vaultLegacySeed==="complete"?{vaultLegacySeed:$.vaultLegacySeed}:{}}}function MQ($,Z){try{if(!b0($)||!b0($.assignments))throw Error();let J=Object.entries($.assignments),X=xJ({...$,assignments:Object.fromEntries(J.map(([,z],G)=>[String(G),z]))});if(!X||Object.keys($).length!==3||!Object.hasOwn($,"version")||!Object.hasOwn($,"updatedAt")||!Object.hasOwn($,"assignments")||!Object.is($.updatedAt,X.updatedAt))throw Error();for(let z of Z.values())if(typeof z!=="string"||z.length===0||z.trim()!==z)throw Error();let Y=Object.create(null);for(let[z,[G,Q]]of J.entries()){let K=X.assignments[String(z)];if(!b0(Q)||!K)throw Error();let W=Object.keys(K).filter((B)=>B!=="affinityModelId"||Object.hasOwn(Q,"affinityModelId"));if(Object.keys(Q).length!==W.length||W.some((B)=>!Object.hasOwn(Q,B)||!Object.is(Q[B],Reflect.get(K,B))))throw Error();let V=Z.get(K.accountId);if(V===void 0)continue;Y[G]={...K,accountId:V}}return`${JSON.stringify({...X,assignments:Y},null,2)}
-`}catch{throw Error("invalid-source")}}function jQ($){return{version:1,updatedAt:$,assignments:{}}}function RQ($){return pB("sha256").update($).digest("hex")}function cB($,Z,J=Date.now(),X){let Y=m1(Z);if(!["five_hour","seven_day"].every((Q)=>{let K=$?.[Q];return Boolean(K&&J-K.checkedAt<Y)}))return!1;let G=H0($,X);return!G||J-G.checkedAt<Y}function TQ($){return Math.max($.checkedAt??0,$.five_hour?.checkedAt??0,$.seven_day?.checkedAt??0,...($.scoped??[]).map((Z)=>Z.checkedAt??0))}function l8($){if(!$)return;if("kind"in $)return $.kind==="known"?$.quota:void 0;return $}function PQ($,Z,J){let X=JX($),Y=J==="five_hour"?X.five_hour:J==="seven_day"?X.seven_day:0;if(!YW($))return Y;let z=zW($,Z===uB?void 0:Z);return Math.max(Y,z[J])}function CQ($,Z,J,X){let Y=Math.max(0,$-Z);if(Y<=0)return 0;if(!J)return Y;let z=Date.parse(J);if(!Number.isFinite(z)||z<=X)return Y;let G=Math.max((z-X)/3600000,0.016666666666666666);return Y/G}function v3($){if(Nq($))return"fable";return typeof $==="string"&&$.toLowerCase().includes("opus")?"opus":"general"}function FQ($){let Z=$.now??Date.now(),{candidate:J,storage:X}=$,Y=l8(J.quota);if(!Y)return 0;if(!cB(Y,X,Z,$.modelId))return 0;let z=[];for(let G of["five_hour","seven_day"]){let Q=Y[G];if(!Q||!Number.isFinite(Q.remainingPercent))return 0;z.push(CQ(Q.remainingPercent,PQ(X,J.accountId,G),Q.resetsAt,Z))}if($.family==="fable"){let G=H0(Y,$.modelId);if(G&&Number.isFinite(G.remainingPercent))z.push(CQ(G.remainingPercent,PQ(X,J.accountId,"scoped"),G.resetsAt,Z))}return Math.min(...z)}function FP($,Z,J=Date.now()){let X=l8($.quota),Y=H0(X,"claude-fable-5");return Boolean(Y&&cB(X,Z,J,"claude-fable-5")&&Number.isFinite(Y.remainingPercent)&&Y.remainingPercent<=0)}function y3($){let Z=$.now??Date.now(),J=l8($.quota);if(!J)return{action:"retain",reason:"unknown"};let X=H0(J,$.modelId);if(X&&Number.isFinite(X.remainingPercent)&&X.remainingPercent<=0)return{action:"migrate",reason:"model-scoped"};let Y=J.seven_day;if(Y&&Number.isFinite(Y.remainingPercent)&&Y.remainingPercent<=0)return{action:"migrate",reason:"seven-day"};let z=J.five_hour;if(z&&Number.isFinite(z.remainingPercent)&&z.remainingPercent<=0){let G=z.resetsAt?Date.parse(z.resetsAt):NaN;if(Number.isFinite(G)&&G>Z&&G-Z<=MP)return{action:"hold",reason:"five-hour-short-reset",retryAfterSeconds:Math.max(1,Math.ceil((G-Z)/1000))};return{action:"migrate",reason:"five-hour"}}return{action:"retain",reason:"not-exhausted"}}function iB($){let Z=DP($),J=Z.endsWith(".json")?Z.slice(0,-5):Z;return _P(lB($),`${J}-routing-state.json`)}function g3($,Z){let J=pB("sha256").update($).digest().readUInt32BE(0);return Math.max(1,Math.ceil(Z))+J%21}var xQ=new Map;class sB{options;loaded=!1;state;stateMtimeNs;touchChain=Promise.resolve();seedFinalized=!1;constructor($){this.options=$,this.state=jQ(this.now())}now(){return this.options.now?.()??Date.now()}async readState(){try{let $=await OQ(this.options.path,"utf8"),Z=xJ(JSON.parse($));if(!Z)throw Error(`Invalid sticky routing state at ${this.options.path}`);return Z}catch($){if($.code==="ENOENT")return{...jQ(this.now()),...this.options.vaultSeed?{vaultLegacySeed:"pending"}:{}};throw $}}async readStateMtimeNs(){try{return(await qP(this.options.path,{bigint:!0})).mtimeNs}catch($){if($.code==="ENOENT")return 0n;throw $}}async refreshStateIfChanged(){for(let $=0;$<3;$++){let Z=await this.readStateMtimeNs();if(this.loaded&&Z===this.stateMtimeNs)return;let J=await this.readState(),X=await this.readStateMtimeNs();if(Z!==X)continue;this.state=J,this.stateMtimeNs=X,this.loaded=!0;return}this.state=await this.readState(),this.stateMtimeNs=await this.readStateMtimeNs(),this.loaded=!0}async acquireLock($=!0){await UP(lB(this.options.path),{recursive:!0,mode:448});let Z=this.now()+TP;while(!0){let J=await e1({name:"write",path:this.options.path,ttlMs:RP,renew:!0});if(J)return J;if(!$||this.now()>=Z)throw Error("Timed out acquiring sticky routing state lock");await new Promise((X)=>setTimeout(X,PP))}}async recoverLocalPins(){let $=this.options.localRecoveryPath;if(!$||$===this.options.path)return;let Z=JSON.stringify([this.options.path,$]),J=xQ.get(Z);if(!J)J=this.fillLocalPins($).catch(()=>{n.warn("sticky-routing","local pin recovery unavailable",{reason:"recovery-failed"})}),xQ.set(Z,J);await J}async fillLocalPins($){let Z=await this.acquireLock(!1);try{let J;try{J=xJ(JSON.parse(await OQ($,"utf8")))}catch(z){if(z.code==="ENOENT")return;throw z}if(!J)return;let X=await this.readState(),Y=!1;for(let[z,G]of Object.entries(J.assignments)){if(!/^[0-9a-f]{64}$/.test(z)||Object.hasOwn(X.assignments,z))continue;X.assignments[z]=G,Y=!0}if(Y)await this.writeState(X,()=>Z.assertOwned(),!1)}finally{await Z.release()}}assignmentIsActive($){return $.lastSeenAt>=this.now()-(this.options.assignmentTtlMs??DQ)}prune($){let Z=this.now()-(this.options.assignmentTtlMs??DQ);for(let[X,Y]of Object.entries($.assignments))if(Y.lastSeenAt<Z)delete $.assignments[X];let J=Object.entries($.assignments);if(J.length<=_Q)return;J.sort((X,Y)=>Y[1].lastSeenAt-X[1].lastSeenAt).slice(_Q).forEach(([X])=>{delete $.assignments[X]})}async writeState($,Z,J=!0){if(J)this.prune($);$.updatedAt=this.now();let X=`${this.options.path}.${HP()}.tmp`;try{await OP(X,`${JSON.stringify($)}
-`,{mode:384}),await Z(),await NP(X,this.options.path)}finally{await LP(X,{force:!0}).catch(()=>{})}this.state=$,this.stateMtimeNs=await this.readStateMtimeNs(),this.loaded=!0}async writeResolutionState($,Z,J){let X=!1;try{await this.writeState($,async()=>{try{await Z()}catch(Y){throw X=!0,Y}})}catch(Y){if(!X)throw Y;n.warn("sticky-routing","assignment write refused",{operation:J,reason:"ownership-lost"})}}async prepareLegacySeed($){let Z=this.options.vaultSeed;if(!Z||this.seedFinalized)return;try{await this.refreshStateIfChanged()}catch{this.seedFinalized=!0;return}if(this.state.vaultLegacySeed!=="pending"){this.seedFinalized=!0;return}let J=$===void 0?await h6(Z.roster):$;if(!J?.complete)return;let X=await this.acquireLock();try{let Y=await this.readState();if(Y.vaultLegacySeed!=="pending"){this.seedFinalized=!0;return}let z=await VJ(Z.legacyConfig),G=rj(z,J),Q=await VJ(iB(Z.legacyConfig));if(b0(Q)&&Q.version===1&&b0(Q.assignments))for(let[K,W]of Object.entries(Q.assignments)){if(!/^[0-9a-f]{64}$/.test(K)||Object.hasOwn(Y.assignments,K))continue;let V=dB(W),B=V&&G.get(V.accountId);if(V&&B)Y.assignments[K]={...V,accountId:B.routeId,accountIdentity:B.accountIdentity}}Y.vaultLegacySeed="complete",await this.writeState(Y,()=>X.assertOwned(),!1),this.seedFinalized=!0}finally{await X.release()}}logicalAccountId($){return $.accountId===this.options.vaultSeed?.mainRouteId?uB:$.accountId}setVaultSeed($){this.options.vaultSeed=$}scheduleTouch($){this.touchChain=this.touchChain.catch(()=>{}).then(async()=>{let Z=await this.acquireLock();try{let J=await this.readState(),X=J.assignments[$];if(!X)return;X.lastSeenAt=this.now(),await this.writeState(J,()=>Z.assertOwned())}finally{await Z.release()}}).catch(()=>{})}selectCandidate($){let Z=[...$.candidates];if($.family==="opus"){let Y=Z.filter((z)=>FP(z,$.storage,this.now()));if(Y.length>0)Z=Y}let J=Z.flatMap((Y)=>{let z=FQ({candidate:Y,family:$.family,modelId:$.modelId,storage:$.storage,now:this.now()});return z>0?[{candidate:Y,weight:z}]:[]});if(J.length===0&&Z.every((Y)=>!l8(Y.quota)))return[...Z].sort((Y,z)=>Y.order-z.order||Y.accountId.localeCompare(z.accountId))[0];let X=new Map;for(let Y of Object.values($.state.assignments)){let z=J.find((Q)=>Q.candidate.accountId===this.logicalAccountId(Y))?.candidate;if(!z)continue;let G=l8(z.quota);if(G&&Y.quotaCheckedAt!==TQ(G))continue;X.set(this.logicalAccountId(Y),(X.get(this.logicalAccountId(Y))??0)+Y.initialInputBytes)}return J.map(({candidate:Y,weight:z})=>({candidate:Y,score:((X.get(Y.accountId)??0)+$.inputBytes)/Math.max(z,CP)})).sort((Y,z)=>Y.score-z.score||Y.candidate.order-z.candidate.order||Y.candidate.accountId.localeCompare(z.candidate.accountId))[0]?.candidate}async resolve($){if(!$.sessionId)return null;await this.recoverLocalPins(),await this.prepareLegacySeed(),await this.refreshStateIfChanged();let Z=RQ($.sessionId),J=$.affinityModelId??$.modelId,X=(K)=>J!==void 0?K.affinityModelId===J:K.family===$.family,Y=(K)=>{let W=$.accountIdentities?.get(K);return typeof W==="string"&&W.length>0&&W.trim()===W?W:void 0},z=(K)=>{if(!$.accountIdentities)return!0;let W=Y(this.logicalAccountId(K));return W!==void 0&&K.accountIdentity===W},G=this.state.assignments[Z];if(G&&this.assignmentIsActive(G)&&X(G)&&z(G)&&$.retainAccountIds.has(this.logicalAccountId(G))&&!$.excludeAccountIds?.has(this.logicalAccountId(G))){if(this.now()-G.lastSeenAt>=jP)G.lastSeenAt=this.now(),this.scheduleTouch(Z);return{accountId:this.logicalAccountId(G),assignment:{...G},created:!1,migrated:!1}}let Q=await this.acquireLock();try{let K=await this.readState();this.prune(K);let W=K.assignments[Z];if(W&&X(W)&&z(W)&&$.retainAccountIds.has(this.logicalAccountId(W))&&!$.excludeAccountIds?.has(this.logicalAccountId(W)))return W.lastSeenAt=this.now(),await this.writeResolutionState(K,()=>Q.assertOwned(),"touch"),{accountId:this.logicalAccountId(W),assignment:{...W},created:!1,migrated:!1};let V=Boolean(W&&!X(W)),B=Boolean(W&&!z(W));if(V||B)delete K.assignments[Z];let H=$.candidates.filter((_)=>!$.excludeAccountIds?.has(_.accountId)&&(!$.accountIdentities||Y(_.accountId)!==void 0)),N=(!V&&!B&&$.preferredAccountId?H.find((_)=>_.accountId===$.preferredAccountId&&FQ({candidate:_,family:$.family,modelId:$.modelId,storage:$.storage,now:this.now()})>0):void 0)??this.selectCandidate({...$,candidates:H,state:K});if(!N){if(W)delete K.assignments[Z],await this.writeResolutionState(K,()=>Q.assertOwned(),"delete");return null}let O=this.now(),U=l8(N.quota),D={accountId:N.accountId,...$.accountIdentities?{accountIdentity:Y(N.accountId)}:{},family:$.family,affinityModelId:J,assignedAt:O,lastSeenAt:O,initialInputBytes:Math.max(1,$.inputBytes),quotaCheckedAt:U?TQ(U):0};return K.assignments[Z]=D,await this.writeResolutionState(K,()=>Q.assertOwned(),"assign"),{accountId:N.accountId,assignment:{...D},created:!W,migrated:Boolean(W&&(B||W.accountId!==N.accountId))}}finally{await Q.release()}}async clear($){if(!$)return;await this.recoverLocalPins();let Z=RQ($),J=await this.acquireLock();try{let X=await this.readState();if(!(Z in X.assignments))return;delete X.assignments[Z],await this.writeState(X,()=>J.assertOwned())}finally{await J.release()}}}function ZY($,Z,J){return($==="opencode"?J.OPENCODE_ANTHROPIC_AUTH_ROUTING_STATE_FILE:J.PI_ANTHROPIC_AUTH_ROUTING_STATE_FILE)||iB(Z.config)}async function b6($){let Z=BP($);try{return await VP(Z)}catch(X){if(!(X instanceof Error)||!("code"in X)||X.code!=="ENOENT")throw X}let J=mB(Z);if(J===Z)return Z;return hB(await b6(J),gB(Z))}function P1($,Z,J,X){return gB($)===Z?hB(mB($),J):`${$}.${X}.json`}async function aB($=ZX(),Z=TL($)){let[J,X]=await Promise.all([b6($),b6(Z)]),Y=await b6(P1(J,"anthropic-auth.json","anthropic-auth-pool.json","pool")),z=await b6(P1(X,"anthropic-auth-state.json","anthropic-auth-pool-state.json","pool")),G=await b6(P1(X,"anthropic-auth-state.json","anthropic-auth-native-state.json","native")),Q=await b6(P1(X,"anthropic-auth-state.json","anthropic-auth-migration.json","migration")),K=await b6(P1(X,"anthropic-auth-state.json","anthropic-auth-custody-roster.json","roster")),W=[J,X,Y,z,G,Q,K];if(new Set(W).size!==W.length)throw Error("Anthropic account storage paths overlap; migration requires separate files");let V=WP("sha256").update(JSON.stringify(["anthropic",Y,z])).digest("hex");return{legacyConfig:J,legacyState:X,config:Y,state:z,runtime:G,journal:Q,roster:K,storageId:V}}var IP=/^wss?:\/\//i;function nB($,Z){if($==="http"||$==="websocket")return $;return typeof Z==="string"&&IP.test(Z.trim())?"websocket":"http"}function p3($){if($?.enabled!==!0)return null;if(typeof $.url!=="string"||!$.url.trim())return null;if(!($.tokenConfigured===!0||typeof $.token==="string"&&$.token.trim()!==""))return null;return{enabled:!0,transport:nB($.transport,$.url)}}class U2 extends Error{failure;constructor($){super("Relay request authorization failed");this.failure=$}}function EP($){let Z=[],J=$.authorization?.trim();if(J){Z.push(J);let Y=/^\S+\s+(\S.*)$/.exec(J)?.[1];if(Y)Z.push(Y)}let X=$["x-api-key"]?.trim();if(X)Z.push(X);return Z}async function aZ($,Z,J,X){try{let Y=J?await J():void 0;if(Y)Z.upstream={...Z.upstream,headers:rB(Y.headers)};return{authorization:Y,scope:X([$.token,...EP(Z.upstream.headers),...Y?.errorSecrets??[]])}}catch(Y){throw new U2(Y)}}function C1($){return typeof $==="number"&&Number.isFinite($)?$:"unknown"}function wP($){let Z;try{Z=J1($)}catch{return"http"}if(Z===null||typeof Z!=="object"||Array.isArray(Z))return"http";return"stream"in Z&&Z.stream===!0?"event-stream":"http"}class AJ extends Error{}class S7 extends Error{}var kP="relay websocket response_start metadata is invalid",bP=new Set([101,103,204,205,304]);class SJ extends Error{code="ECONNRESET";syscall="websocket";closeCode;closeReason;wasClean;constructor($,Z){super($);this.name="RelayWebSocketConnectionResetError",this.closeCode=Z?.code,this.closeReason=Z?.reason,this.wasClean=Z?.wasClean}}var t$=new Map,$8=new Map;var fP=7200000,vP=1800000,yP=128,gP=32,AQ=0;function W9(){return AQ+=1,`req_${Date.now().toString(36)}_${AQ.toString(36)}`}function l3(){return SP(32).toString("base64url")}function mP($){return`sha256:${AP("sha256").update($).digest("hex")}`}function SQ($,Z){let J=0,X=Math.min($.length,Z.length);while(J<X&&$.charCodeAt(J)===Z.charCodeAt(J))J++;let Y=$.length,z=Z.length;while(Y>J&&z>J&&$.charCodeAt(Y-1)===Z.charCodeAt(z-1))Y--,z--;return{start:J,deleteCount:Y-J,insert:Z.slice(J,z)}}function hP($){return $.deleteCount===0&&$.insert.length===0}function IQ($){let Z=$.match(/\bcch=([0-9a-f]{5});/),J=Z?.[1];if(!J||Z.index==null)return null;let X=Z.index+4;return{start:X,end:X+J.length,token:J}}function pP($,Z,J,X){return`${$.slice(0,Z)}${X}${$.slice(J)}`}function oB($,Z){let J=IQ($),X=IQ(Z);if(J&&X&&J.start===X.start&&J.end-J.start===X.end-X.start&&J.token!==X.token){let Y={start:J.start,deleteCount:J.end-J.start,insert:X.token},z=pP($,J.start,J.end,X.token),G=SQ(z,Z);return hP(G)?Y:[Y,G]}return SQ($,Z)}function lP($,Z){if(typeof Z!=="string")return!1;try{let J=$ instanceof Request?new URL($.url):new URL($.toString());return J.pathname==="/v1/messages"||J.pathname==="/messages"}catch{return!1}}function rB($){let Z={};for(let[J,X]of $.entries()){if(J==="x-session-affinity"||J==="x-opencode-session")continue;Z[J]=X}return Z}async function uP($,Z,J){let X=T6(),Y=JSON.stringify(Z);return S8("http_payload_stringify",{session:q6(Z.affinity),ms:z$(T6()-X),relayBytes:Y.length,mode:Z.mode}),fetch($.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":$.token},body:Y,signal:J??void 0})}function q6($){return $.length>12?`${$.slice(0,12)}…`:$}function T6(){return performance.now()}function z$($){return Math.round($*10)/10}function dP(){return process.env.OPENCODE_ANTHROPIC_AUTH_PERF==="1"}function S8($,Z){if(!dP())return;L6(`[perf] relay ${$} ${JSON.stringify(Z)}`)}function cP($){let{input:Z,init:J,headers:X,bodyText:Y,affinity:z,previous:G,nextHash:Q}=$,K=Z instanceof Request?Z.url:Z.toString(),W={protocol:1,type:"request",affinity:z,upstream:{url:K,method:J?.method||(Z instanceof Request?Z.method:"POST"),headers:rB(X)},next_hash:Q};return G?{...W,mode:"patch",base_hash:G.hash,revision:G.revision+1,patch:oB(G.body,Y)}:{...W,mode:"full_sync",revision:1,body:Y}}function IJ($,Z){return{protocol:$.protocol,type:"request",affinity:$.affinity,upstream:$.upstream,next_hash:$.next_hash,mode:"full_sync",revision:1,body:Z}}function tB($,Z,J,X){let Y=Date.now();t$.delete($),t$.set($,{body:Z,hash:J,revision:X,updatedAt:Y}),EJ(Y)}async function EQ($,Z,J,X,Y){let{authorization:z,scope:G}=await aZ($,Z,X,(K)=>_X(K,Y)),Q;try{Q=await uP($,Z,J)}catch(K){let W=G.redactError(K);throw G.dispose(),W}try{return{authorization:z,scope:G,response:G.redactResponse(Q)}}catch(K){throw G.dispose(),await Q.body?.cancel().catch(()=>{}),K}}async function V9($){$.scope.dispose(),await $.response.body?.cancel().catch(()=>{})}async function wQ($){let{config:Z,payload:J,bodyText:X,requestMode:Y,fallback:z,signal:G,authorizeAttempt:Q}=$,K=Y(),W=J,V=await EQ(Z,W,G,Q,K);if(V.response.status===409&&W.mode==="patch")L6(`state mismatch from relay session=${q6(W.affinity)}; retrying full_sync`),await V9(V),W=IJ(W,X),V=await EQ(Z,W,G,Q,K);let{response:B,authorization:H}=V,q=/^req_[A-Za-z0-9_-]+$/.test(B.headers.get("request-id")??"");if(B.status===401&&!q){if(await V9(V),Z.fallbackToDirect)return L6(`relay authentication rejected; falling back direct session=${q6(W.affinity)}`),{response:await z(),payload:W,transport:"http",protocol:W.protocol,usedRelay:!1};return{response:Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502}),payload:W,transport:"http",protocol:W.protocol,usedRelay:!1}}if(q)try{H?.onUpstreamStatus?.(B.status)}catch{}if(!B.ok&&B.status>=500&&Z.fallbackToDirect)return L6(`relay returned ${B.status}; falling back direct session=${q6(W.affinity)}`),await V9(V),{response:await z(),payload:W,transport:"http",protocol:W.protocol,usedRelay:!1};return{response:B,payload:W,transport:"http",protocol:W.protocol,usedRelay:!0}}function iP($,Z){let J=new URL($);return J.protocol=J.protocol==="http:"?"ws:":"wss:",J.pathname="/ws",J.searchParams.set("token",Z),J.toString()}function sP($){return new Uint8Array(xP.from($,"base64"))}function aP($){if($ instanceof Uint8Array)return $;if($ instanceof ArrayBuffer)return new Uint8Array($);if(ArrayBuffer.isView($))return new Uint8Array($.buffer,$.byteOffset,$.byteLength);throw TypeError("relay websocket binary frame must be an ArrayBuffer or byte view")}function nP($){return JSON.parse($)}function kQ($){let Z=$;return[`code=${Z.code??"unknown"}`,`wasClean=${Z.wasClean??"unknown"}`].join(" ")}function oP($){let Z=$.message||"relay websocket error";return $.status?`relay websocket error ${$.status}: ${Z}`:Z}function bQ($,Z){return{stream:gD($),response:_X($,Z)}}function fQ($){$.stream.dispose(),$.response.dispose()}class eB{config;affinity;timers;socket;connecting;queue=Promise.resolve();pending;serverState;lastUsedAt=Date.now();constructor($,Z,J){this.config=$,this.affinity=Z,this.timers=J}touch($=Date.now()){this.lastUsedAt=$}canEvict($=Date.now()){return!this.pending&&!this.connecting&&$-this.lastUsedAt>vP}dispose(){if(this.pending)this.retireAttempt(this.pending);this.socket?.close(),this.socket=void 0,this.serverState=void 0,this.connecting=void 0}send($,Z,J,X,Y,z){this.touch();let G=T6(),Q=this.queue.catch(()=>{}).then(()=>this.startQueued($,Z,G,J,X,Y,z)),K=Q.then(async({response:W,getPayload:V})=>({response:await W,payload:V(),transport:"websocket",protocol:2,usedRelay:!0}));return this.queue=Q.then(({done:W})=>W.catch(()=>{}),()=>{}),K}async startQueued($,Z,J,X,Y,z,G){let Q=(T)=>bQ(T,G),K=T6();await this.ensureConnected();let W=T6(),V=t$.get(this.affinity),B=this.serverState?.hash,H={...$,protocol:2,id:W9()};if(H.mode==="patch"&&(!B||B!==H.base_hash))H.mode="full_sync",H.revision=(this.serverState?.revision??0)+1,delete H.base_hash,delete H.patch,H.body=Z;if(H.mode==="patch"&&V)H.patch=oB(V.body,Z);L6(`perf websocket send_start session=${q6(this.affinity)} request=${H.id} mode=${H.mode} queueMs=${z$(W-J)} connectMs=${z$(W-K)} bodyBytes=${Z.length} relayBytes=${JSON.stringify(H).length}`);let q=await aZ(this.config,H,z,Q),N=H,O=this.sendPayload(H,Z,X,Y,z,q,G);O.done.catch(()=>{});let U=O.done,D=O.response.catch(async(T)=>{if(!(T instanceof AJ)||H.mode!=="patch")throw T;let M=IJ(H,Z);M.protocol=2,M.id=W9(),M.revision=(this.serverState?.revision??0)+1;let L=await aZ(this.config,M,z,Q);N=M;let C=this.sendPayload(M,Z,X,Y,z,L,G);return C.done.catch(()=>{}),U=C.done,C.response}),_=D.then(()=>U,()=>U.catch(()=>{}));return{response:D,done:_,getPayload:()=>N}}async ensureConnected(){if(this.socket?.readyState===WebSocket.OPEN&&this.serverState!==void 0)return;if(this.connecting)return await this.connecting;this.connecting=new Promise(($,Z)=>{let J=iP(this.config.url,this.config.token),X=new URL(J);X.searchParams.set("affinity",this.affinity);let Y=new WebSocket(X.toString());Y.binaryType="arraybuffer",this.socket=Y,this.serverState=void 0;let z=this.timers.setTimeout(()=>{Y.close(),Z(Error("relay websocket ready timed out"))},15000);Y.addEventListener("message",(G)=>{try{if(typeof G.data!=="string"){this.handleBinaryChunk(G.data);return}let Q=nP(G.data);if(Q.type==="ready"){this.timers.clearTimeout(z),this.serverState=Q.state,$();return}this.handleMessage(Q)}catch(Q){this.timers.clearTimeout(z),Z(Q),this.failPending(Q),Y.close()}}),Y.addEventListener("error",()=>{this.timers.clearTimeout(z);let G=new SJ("relay websocket error");Z(G),this.failPending(G)}),Y.addEventListener("close",(G)=>{if(this.timers.clearTimeout(z),this.socket===Y)this.socket=void 0,this.serverState=void 0,this.connecting=void 0;if(this.socket!==void 0)return;if(this.pending){if(this.pending.retryingBeforeResponse)return;let Q=this.pending.responseStartedAt!=null||this.pending.streamByteCount>0,K=Q?"closed after response_start before stream bytes":"closed before response";if(this.retryPendingBeforeResponse(this.pending,K,G))return;let W=Q?new SJ("relay websocket closed during response stream",G):Error("relay websocket closed before response");L6(`websocket ${Q?"closed during response stream":"closed before response without retry"} session=${q6(this.affinity)} request=${this.pending.payload.id} chunks=${this.pending.streamChunkCount} bytes=${this.pending.streamByteCount} ${kQ(G)}`),this.failPending(W)}})}).finally(()=>{this.connecting=void 0}),await this.connecting}sendPayload($,Z,J,X,Y,z,G){let Q=this.socket;if(!Q||Q.readyState!==WebSocket.OPEN)throw fQ(z.scope),Error("relay websocket is not connected");let K=T6(),W,V,B=new Promise((q,N)=>{W=q,V=N});return{response:new Promise((q,N)=>{let O={payload:$,bodyText:Z,resolve:q,reject:N,streamDone:!1,accepted:!1,responseStarted:!1,resolveDone:W,rejectDone:V,sentAt:K,optimisticResponse:J,streamChunkCount:0,streamByteCount:0,retryAttempts:0,retryingBeforeResponse:!1,onResponseHeaders:X,authorizeAttempt:Y,authorization:z.authorization,scope:z.scope.stream,responseScope:z.scope.response,responseMode:G,rawBody:!1,retired:!1,stagedResponseHeaders:void 0,responseHeadersDelivered:!1};if(this.pending=O,this.resetPendingTimeout(O),Q.send(JSON.stringify($)),J)this.resolvePendingResponse(O,200,"OK",{"content-type":"text/event-stream","x-cortexkit-relay-optimistic":"true"})}),done:B}}resetPendingTimeout($){this.timers.clearTimeout($.timeout),$.timeout=this.timers.setTimeout(()=>{if(this.pending!==$)return;if(this.retryPendingBeforeResponse($,"response timed out"))return;this.failPending(Error("relay websocket response timed out")),this.socket?.close()},45000)}retryPendingBeforeResponse($,Z,J){if($.streamByteCount>0)return!1;if($.streamDone)return!1;if(!$.optimisticResponse&&$.responseStarted)return!1;if($.retired)return!1;if($.retryAttempts>=1)return!1;$.retryAttempts+=1,$.retryingBeforeResponse=!0,this.timers.clearTimeout($.timeout);let X=$.retryAttempts,Y=$.payload.id;return L6(`websocket ${Z}; reconnecting and retrying full_sync session=${q6(this.affinity)} request=${Y} retry=${X} chunks=${$.streamChunkCount} bytes=${$.streamByteCount}${J?` ${kQ(J)}`:""}`),this.socket?.close(),this.socket=void 0,this.serverState=void 0,this.connecting=void 0,(async()=>{try{if(await this.ensureConnected(),this.pending!==$)return;if($.retired)return this.endCancelledRetry($);let z=IJ($.payload,$.bodyText);z.protocol=2,z.id=W9(),z.revision=(this.serverState?.revision??0)+1;let G=await aZ(this.config,z,$.authorizeAttempt,(K)=>bQ(K,$.responseMode));if(this.pending!==$||$.streamDone||$.retired){if(fQ(G.scope),this.pending===$&&$.retired)this.endCancelledRetry($);return}this.installAttempt($,G),$.payload=z,$.accepted=!1,$.acceptedAt=void 0,$.responseStartedAt=void 0,$.stagedResponseHeaders=void 0,$.responseHeadersDelivered=!1,$.sentAt=T6(),$.retryingBeforeResponse=!1;let Q=this.socket;if(!Q||Q.readyState!==WebSocket.OPEN)throw Error("relay websocket is not connected");this.resetPendingTimeout($),L6(`perf websocket retry_send session=${q6(this.affinity)} request=${z.id} previous=${Y} mode=full_sync retry=${X} bodyBytes=${$.bodyText.length} relayBytes=${JSON.stringify(z).length}`),Q.send(JSON.stringify(z))}catch(z){if($.retryingBeforeResponse=!1,this.pending!==$)return;if(z instanceof U2)this.failPending(z.failure,!1);else this.failPending(z)}})(),!0}endCancelledRetry($){$.retryingBeforeResponse=!1,this.failPending(Error("relay websocket response was cancelled"),!1)}installAttempt($,Z){$.scope?.dispose(),$.responseScope?.dispose(),$.authorization=Z.authorization,$.scope=Z.scope.stream,$.responseScope=Z.scope.response}retireAttempt($){$.retired=!0,$.scope?.dispose(),$.scope=void 0,$.responseScope?.dispose(),$.responseScope=void 0,$.errorBody=void 0,$.authorization=void 0}redactAttemptError($,Z){return $.scope?$.scope.redactError(Z):Error("relay websocket request ended")}enqueueStreamChunk($,Z){this.deliverResponseHeaders($),$.streamChunkCount+=1,$.streamByteCount+=Z.byteLength,this.forwardStreamBytes($,Z)}forwardStreamBytes($,Z){let{streamController:J,scope:X}=$;if(!J||!X)return;if($.rawBody){let z=$.errorBody;if(z){if(z.bytes+=Z.byteLength,z.bytes>UX){this.endOversizedErrorBody($,J,z.scope);return}}J.enqueue(Z);return}let Y;try{Y=X.push(Z)}catch(z){this.failPending(z,!(z instanceof y8)),this.socket?.close();return}for(let z of Y)J.enqueue(z)}endOversizedErrorBody($,Z,J){if(Z.error(new nW),J.dispose(),L6(`websocket error body exceeded the redaction bound; ending request session=${q6(this.affinity)} request=${$.payload.id} chunks=${$.streamChunkCount} bytes=${$.streamByteCount}`),this.timers.clearTimeout($.timeout),$.streamDone=!0,this.retireAttempt($),$.authorizeAttempt=void 0,$.onResponseHeaders=void 0,$.resolveDone(),this.pending===$)this.pending=void 0;let X=this.socket;this.socket=void 0,this.serverState=void 0,this.connecting=void 0,X?.close()}deliverResponseHeaders($){if($.responseHeadersDelivered||$.stagedResponseHeaders==null)return;$.responseHeadersDelivered=!0;try{$.onResponseHeaders?.($.stagedResponseHeaders)}catch{}}handleBinaryChunk($){let Z=this.pending;if(!Z?.responseStarted)return;this.enqueueStreamChunk(Z,aP($))}resolvePendingResponse($,Z,J,X){if($.responseStarted)return;let Y,z=bP.has(Z)?null:new ReadableStream({start:(V)=>{Y=V},cancel:()=>{this.retireAttempt($),this.socket?.close()}}),G;try{G=new Response(z,{status:Z,statusText:J,headers:X})}catch{this.failInvalidResponseStart();return}if($.responseStarted=!0,$.streamController=Y,$.optimisticResponse){$.resolve(G);return}let Q=$.responseScope;if($.responseScope=void 0,G.ok&&$.responseMode==="event-stream"||!Q){if(Q?.dispose(),X&&G.ok)$.stagedResponseHeaders=new Headers(G.headers);$.resolve(G);return}$.rawBody=!0;let W;try{W=Q.redactResponse(G)}catch(V){$.responseStarted=!1,this.failPending(V),this.socket?.close();return}if(X)$.stagedResponseHeaders=new Headers(W.headers);if(!G.ok&&z)$.errorBody={scope:Q,bytes:0};$.resolve(W)}stageOptimisticResponseHeaders($,Z){let J=$.responseScope;$.responseScope=void 0;let X;try{X=new Response(null,{status:Z.status,statusText:Z.statusText,headers:Z.headers})}catch{return J?.dispose(),this.failInvalidResponseStart(),!1}if(!Z.headers)return J?.dispose(),!0;if(X.ok)return J?.dispose(),$.stagedResponseHeaders=new Headers(X.headers),!0;if(!J)return!0;try{$.stagedResponseHeaders=new Headers(J.redactResponse(X).headers)}catch{}return!0}failInvalidResponseStart(){this.failPending(new S7(kP),!1),this.socket?.close()}handleMessage($){if($.type==="keepalive"){if(this.pending)this.resetPendingTimeout(this.pending);return}let Z=this.pending;if(!Z)return;if("id"in $&&$.id&&$.id!==Z.payload.id)return;if($.type==="accepted"){let J=T6();Z.accepted=!0,Z.acceptedAt=J,L6(`perf websocket accepted session=${q6(this.affinity)} request=${Z.payload.id} sentMs=${z$(J-Z.sentAt)} mode=${Z.payload.mode}`),this.serverState={hash:$.hash,revision:$.revision},tB(this.affinity,Z.bodyText,$.hash,$.revision),this.resetPendingTimeout(Z);return}if($.type==="response_start"){if(Z.responseStartedAt!=null)return;let J=T6();Z.responseStartedAt=J;try{Z.authorization?.onUpstreamStatus?.($.status)}catch{}if(L6(`perf websocket response_start session=${q6(this.affinity)} request=${Z.payload.id} sentMs=${z$(J-Z.sentAt)} upstreamMs=${Z.acceptedAt==null?"unknown":z$(J-Z.acceptedAt)} status=${C1($.status)}`),this.timers.clearTimeout(Z.timeout),!Z.optimisticResponse){this.resolvePendingResponse(Z,$.status,$.statusText,$.headers);return}if(!this.stageOptimisticResponseHeaders(Z,$))return;if($.status>=400)this.deliverResponseHeaders(Z),this.forwardStreamBytes(Z,new TextEncoder().encode(`event: error
-data: ${JSON.stringify({type:"error",error:{type:"relay_upstream_error",message:`Relay upstream returned HTTP ${$.status}`}})}
-
-`)),this.finishPending();return}if($.type==="chunk"){this.enqueueStreamChunk(Z,sP($.base64));return}if($.type==="done"){this.finishPending($);return}if($.type==="error"){if(Z.optimisticResponse&&Z.responseStartedAt!=null){L6(`websocket relay error during optimistic response session=${q6(this.affinity)} request=${Z.payload.id} status=${Number.isFinite($.status)?$.status:"unknown"} code=relay_stream_error chunks=${Z.streamChunkCount} bytes=${Z.streamByteCount}`),this.deliverResponseHeaders(Z),this.forwardStreamBytes(Z,new TextEncoder().encode(`event: error
-data: ${JSON.stringify({type:"error",error:{type:"relay_error",message:$.message||"relay error"}})}
-
-`)),this.finishPending(),this.socket?.close();return}if($.status===409&&this.retryPendingBeforeResponse(Z,"state mismatch"))return;let J=$.status===409?new AJ("state mismatch"):Error(oP($));this.failPending(J)}}finishPending($){let Z=this.pending;if(!Z)return;let J=T6(),X=$&&"frames"in $?` upstreamChunks=${C1($.upstreamChunks)} upstreamBytes=${C1($.upstreamBytes)} frames=${C1($.frames)} frameBytes=${C1($.frameBytes)}`:"";L6(`perf websocket done session=${q6(this.affinity)} request=${Z.payload.id} sentMs=${z$(J-Z.sentAt)} streamMs=${Z.responseStartedAt==null?"unknown":z$(J-Z.responseStartedAt)} chunks=${Z.streamChunkCount} bytes=${Z.streamByteCount}${X}`),this.timers.clearTimeout(Z.timeout);try{if(!Z.streamDone){this.deliverResponseHeaders(Z),Z.streamDone=!0;let Y=Z.rawBody?[]:Z.scope?.finish()??[];for(let z of Y)Z.streamController?.enqueue(z);Z.streamController?.close()}}finally{this.retireAttempt(Z),Z.authorizeAttempt=void 0,Z.onResponseHeaders=void 0}Z.resolveDone(),this.pending=void 0}failPending($,Z=!0){let J=this.pending;if(!J)return;let X=Z?this.redactAttemptError(J,$):$;if(this.timers.clearTimeout(J.timeout),this.pending=void 0,this.retireAttempt(J),J.authorizeAttempt=void 0,J.onResponseHeaders=void 0,J.responseStarted)J.streamController?.error(X);else J.reject(X);J.rejectDone(X)}}function EJ($=Date.now()){for(let[Z,J]of t$)if($-J.updatedAt>fP)t$.delete(Z);while(t$.size>yP){let Z=t$.keys().next().value;if(Z===void 0)break;t$.delete(Z)}for(let[Z,J]of $8)if(J.canEvict($))J.dispose(),$8.delete(Z);while($8.size>gP){let Z=!1;for(let[J,X]of $8){if(!X.canEvict($))continue;X.dispose(),$8.delete(J),Z=!0;break}if(!Z)break}}function rP($,Z,J){EJ();let X=$8.get(Z);if(X)return X.touch(),X;let Y=new eB($,Z,J);return $8.set(Z,Y),EJ(),Y}async function u3($){let{config:Z,input:J,init:X,headers:Y,body:z,fallback:G,affinity:Q,optimisticResponse:K,authorizeAttempt:W,onResponseHeaders:V,dumpTag:B,onDumpCreated:H,setTimeoutImpl:q=globalThis.setTimeout,clearTimeoutImpl:N=globalThis.clearTimeout}=$;if(!Z||!lP(J,z))return G();let O=Q||Y.get("x-session-affinity")||Y.get("x-opencode-session");if(!O)return L6("skipping relay: missing x-session-affinity header"),G();let U=z,D=T6(),_=mP(U);S8("hash_body",{session:q6(O),ms:z$(T6()-D),bodyBytes:U.length});let T=t$.get(O),M=T6(),L=cP({input:J,init:X,headers:Y,bodyText:U,affinity:O,previous:T,nextHash:_});S8("create_payload",{session:q6(O),ms:z$(T6()-M),mode:L.mode,bodyBytes:U.length,previousBytes:T?.body.length});let C,w=()=>{return C??=wP(U),C};try{let v,h=T6();if(Z.transport==="websocket")try{let A=rP(Z,O,{setTimeout:q,clearTimeout:N}),E=K===!0&&w()==="event-stream";v=await A.send(L,U,E,V,W,w())}catch(A){if(A instanceof U2||A instanceof S7)throw A;L6(`websocket relay failed session=${q6(O)}; trying http relay code=relay_transport_error`),v=await wQ({config:Z,payload:L,bodyText:U,requestMode:w,fallback:G,signal:X?.signal,authorizeAttempt:W})}else v=await wQ({config:Z,payload:L,bodyText:U,requestMode:w,fallback:G,signal:X?.signal,authorizeAttempt:W});if(S8("send",{session:q6(O),ms:z$(T6()-h),transport:v.transport,protocol:v.protocol,mode:v.payload.mode,status:v.response.status,usedRelay:v.usedRelay}),!v.usedRelay)return v.response;if(v.transport==="http")try{V?.(v.response.headers)}catch{}if(v.transport==="http")tB(O,U,v.payload.next_hash,v.payload.revision);let a=T6(),p=JSON.stringify(v.payload).length;S8("payload_stringify",{session:q6(O),ms:z$(T6()-a),relayBytes:p}),L6(`used relay transport=${v.transport} protocol=${v.protocol} mode=${v.payload.mode} status=${v.response.status} session=${q6(O)} bodyBytes=${U.length} relayBytes=${p}`);let R=T6(),j=await kO({affinity:O,transport:v.transport,protocol:v.protocol,mode:v.payload.mode,status:v.response.status,bodyText:U,previousBodyText:T?.body,payload:v.payload,relayBytes:p,tag:B});try{if(j)H?.(j)}catch{}return S8("dump",{session:q6(O),ms:z$(T6()-R),enabled:!0}),v.response}catch(v){if(v instanceof U2)throw v.failure;if(v instanceof S7)throw v;if(!Z.fallbackToDirect)throw L6(`relay failed session=${q6(O)} and fallbackToDirect=false code=relay_transport_error`),v;return L6(`relay failed; falling back direct session=${q6(O)} code=relay_transport_error`),G()}}var d3=`
-async function hashBody(body) {
-  const bytes = new TextEncoder().encode(body)
-  const digest = await crypto.subtle.digest('SHA-256', bytes)
-  const hex = [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('')
-  return 'sha256:' + hex
-}
-
-function applyPatch(base, patch) {
-  return base.slice(0, patch.start) + patch.insert + base.slice(patch.start + patch.deleteCount)
-}
-
-function applyPatchSet(base, patch) {
-  if (!Array.isArray(patch)) return applyPatch(base, patch)
-  if (patch.length === 0) return base
-
-  let result = ''
-  let cursor = 0
-  for (const item of patch) {
-    if (item.start < cursor) return { error: 'overlapping patch', status: 400 }
-    result += base.slice(cursor, item.start)
-    result += item.insert
-    cursor = item.start + item.deleteCount
-  }
-  return result + base.slice(cursor)
-}
-
-async function readState(env, affinity) {
-  const raw = await env.RELAY_STATE.get('session:' + affinity)
-  return raw ? JSON.parse(raw) : null
-}
-
-async function writeState(env, affinity, state) {
-  await env.RELAY_STATE.put('session:' + affinity, JSON.stringify(state), { expirationTtl: 86400 })
-}
-
-async function resolveBody(env, payload) {
-  if (payload.mode === 'full_sync') return payload.body
-  if (payload.mode === 'patch') {
-    const state = await readState(env, payload.affinity)
-    if (!state || state.hash !== payload.base_hash) {
-      return { error: 'state mismatch', status: 409 }
-    }
-    return applyPatchSet(state.body, payload.patch)
-  }
-  return { error: 'unknown mode', status: 400 }
-}
-
-async function prepareUpstream(env, payload) {
-  if ((payload.protocol !== 1 && payload.protocol !== 2) || payload.type !== 'request' || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {
-    return { error: 'invalid payload', status: 400 }
-  }
-
-  const body = await resolveBody(env, payload)
-  if (body && typeof body === 'object' && 'error' in body) return body
-
-  if (typeof body !== 'string' || (await hashBody(body)) !== payload.next_hash) {
-    return { error: 'hash mismatch', status: 409 }
-  }
-
-  const stateWrite = writeState(env, payload.affinity, { body, hash: payload.next_hash, revision: payload.revision }).catch(() => {})
-  console.log(JSON.stringify({
-    relay: 'opencode-anthropic-auth',
-    transport: 'relay',
-    mode: payload.mode,
-    revision: payload.revision,
-    affinity: String(payload.affinity).slice(0, 12),
-    bodyBytes: body.length,
-  }))
-
-  return { body, stateWrite }
-}
-
-function resolveBodyFromState(state, payload) {
-  if (payload.mode === 'full_sync') return payload.body
-  if (payload.mode === 'patch') {
-    if (!state || state.hash !== payload.base_hash) {
-      return { error: 'state mismatch', status: 409 }
-    }
-    return applyPatchSet(state.body, payload.patch)
-  }
-  return { error: 'unknown mode', status: 400 }
-}
-
-function deferWorkerTask(task) {
-  return new Promise((resolve) => setTimeout(resolve, 0)).then(task)
-}
-
-const WEBSOCKET_STREAM_FLUSH_BYTES = 1024
-const WEBSOCKET_STREAM_FLUSH_MS = 20
-
-function createWebSocketStreamCoalescer(socket, options = {}) {
-  const flushBytes = options.flushBytes || WEBSOCKET_STREAM_FLUSH_BYTES
-  const flushMs = options.flushMs ?? WEBSOCKET_STREAM_FLUSH_MS
-  let chunks = []
-  let byteLength = 0
-  let flushTimer = null
-  const stats = {
-    upstreamChunks: 0,
-    upstreamBytes: 0,
-    frames: 0,
-    frameBytes: 0,
-  }
-
-  const clearFlushTimer = () => {
-    if (flushTimer === null) return
-    clearTimeout(flushTimer)
-    flushTimer = null
-  }
-
-  const mergeChunks = () => {
-    if (chunks.length === 1) return chunks[0]
-    const frame = new Uint8Array(byteLength)
-    let offset = 0
-    for (const chunk of chunks) {
-      frame.set(chunk, offset)
-      offset += chunk.byteLength
-    }
-    return frame
-  }
-
-  const flush = () => {
-    clearFlushTimer()
-    if (byteLength === 0) return
-    const frame = mergeChunks()
-    chunks = []
-    byteLength = 0
-    socket.send(frame)
-    stats.frames += 1
-    stats.frameBytes += frame.byteLength
-  }
-
-  const scheduleFlush = () => {
-    if (flushTimer !== null) return
-    flushTimer = setTimeout(flush, flushMs)
-  }
-
-  return {
-    push(value) {
-      const chunk = value instanceof Uint8Array ? value : new Uint8Array(value)
-      if (chunk.byteLength === 0) return
-      stats.upstreamChunks += 1
-      stats.upstreamBytes += chunk.byteLength
-      chunks.push(chunk)
-      byteLength += chunk.byteLength
-      if (byteLength >= flushBytes) flush()
-      else scheduleFlush()
-    },
-    flush,
-    stats() {
-      return { ...stats, pendingBytes: byteLength }
-    },
-  }
-}
-
-function checkpointWebSocketState(env, payload, body, nextState) {
-  return deferWorkerTask(async () => {
-    try {
-      if ((await hashBody(body)) !== payload.next_hash) {
-        throw new Error('hash mismatch')
-      }
-      await writeState(env, payload.affinity, nextState)
-    } catch {
-      console.log(JSON.stringify({
-        relay: 'opencode-anthropic-auth',
-        transport: 'websocket',
-        event: 'checkpoint_write_failed',
-        affinity: String(payload.affinity).slice(0, 12),
-        code: 'checkpoint_write_error',
-      }))
-    }
-  })
-}
-
-async function prepareWebSocketUpstream(env, state, payload) {
-  if (payload.protocol !== 2 || payload.type !== 'request' || !payload.id || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {
-    return { error: 'invalid payload', status: 400 }
-  }
-
-  const body = resolveBodyFromState(state, payload)
-  if (body && typeof body === 'object' && 'error' in body) return body
-  if (typeof body !== 'string') return { error: 'invalid body', status: 400 }
-  if ((await hashBody(body)) !== payload.next_hash) {
-    return { error: 'hash mismatch', status: 409 }
-  }
-
-  const nextState = { body, hash: payload.next_hash, revision: payload.revision }
-  const checkpoint = checkpointWebSocketState(env, payload, body, nextState)
-  const logAccepted = () => console.log(JSON.stringify({
-    relay: 'opencode-anthropic-auth',
-    transport: 'websocket',
-    mode: payload.mode,
-    revision: payload.revision,
-    affinity: String(payload.affinity).slice(0, 12),
-    bodyBytes: body.length,
-  }))
-
-  return { body, state: nextState, checkpoint, logAccepted }
-}
-
-function headersToObject(headers) {
-  const result = {}
-  for (const [key, value] of headers.entries()) result[key] = value
-  return result
-}
-
-async function handleRelayPayload(env, payload) {
-  const prepared = await prepareUpstream(env, payload)
-  if (prepared.error) return prepared
-  const upstream = await fetch(payload.upstream.url, {
-    method: payload.upstream.method || 'POST',
-    headers: payload.upstream.headers,
-    body: prepared.body,
-  })
-  return { upstream, stateWrite: prepared.stateWrite }
-}
-
-async function handleWebSocket(socket, env, ctx, payload, getState, setState) {
-  const heartbeat = setInterval(() => {
-    try {
-      socket.send(JSON.stringify({ protocol: 2, type: 'keepalive' }))
-    } catch {
-      clearInterval(heartbeat)
-    }
-  }, 15000)
-  let streamCoalescer = null
-  try {
-    const result = await prepareWebSocketUpstream(env, getState(), payload)
-    if (result.error) {
-      socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: result.status, message: result.error }))
-      return
-    }
-
-    setState(result.state)
-    socket.send(JSON.stringify({ protocol: 2, type: 'accepted', id: payload.id, hash: result.state.hash, revision: result.state.revision }))
-    ctx?.waitUntil?.(deferWorkerTask(result.logAccepted))
-
-    const upstreamPromise = fetch(payload.upstream.url, {
-      method: payload.upstream.method || 'POST',
-      headers: payload.upstream.headers,
-      body: result.body,
-    })
-    ctx?.waitUntil?.(result.checkpoint)
-    const upstream = await upstreamPromise
-    socket.send(JSON.stringify({
-      protocol: 2,
-      type: 'response_start',
-      id: payload.id,
-      status: upstream.status,
-      statusText: upstream.statusText,
-      headers: headersToObject(upstream.headers),
-    }))
-
-    const reader = upstream.body?.getReader()
-    if (reader) {
-      streamCoalescer = createWebSocketStreamCoalescer(socket)
-      while (true) {
-        const { done, value } = await reader.read()
-        if (done) break
-        streamCoalescer.push(value)
-      }
-      streamCoalescer.flush()
-    }
-    const stats = streamCoalescer?.stats?.() || {}
-    socket.send(JSON.stringify({ protocol: 2, type: 'done', id: payload.id, ...stats }))
-  } catch (error) {
-    try {
-      streamCoalescer?.flush?.()
-    } catch {}
-    socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: 500, message: error instanceof Error ? error.message : String(error) }))
-  } finally {
-    clearInterval(heartbeat)
-  }
-}
-
-export default {
-  async fetch(request, env, ctx) {
-    if (request.headers.get('Upgrade') === 'websocket') {
-      const url = new URL(request.url)
-      const token = url.searchParams.get('token')
-      const affinity = url.searchParams.get('affinity')
-      if (token !== env.RELAY_TOKEN) return new Response('unauthorized', { status: 401 })
-      if (!affinity) return new Response('missing affinity', { status: 400 })
-      const pair = new WebSocketPair()
-      const client = pair[0]
-      const server = pair[1]
-      server.binaryType = 'arraybuffer'
-      let state = null
-      let ready = false
-      server.accept()
-      const loadState = readState(env, affinity).then((loadedState) => {
-        state = loadedState
-        ready = true
-        server.send(JSON.stringify({
-          protocol: 2,
-          type: 'ready',
-          state: state ? { hash: state.hash, revision: state.revision } : null,
-        }))
-      }).catch((error) => {
-        server.send(JSON.stringify({ protocol: 2, type: 'error', status: 500, message: error instanceof Error ? error.message : String(error) }))
-        server.close(1011, 'state load failed')
-      })
-      ctx?.waitUntil?.(loadState)
-      if (!ctx?.waitUntil) void loadState
-      let busy = false
-      server.addEventListener('message', (event) => {
-        if (!ready) {
-          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 425, message: 'relay state is not ready' }))
-          return
-        }
-        if (busy) {
-          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 429, message: 'request already in flight' }))
-          return
-        }
-        let payload
-        try {
-          payload = JSON.parse(event.data)
-        } catch {
-          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 400, message: 'invalid JSON payload' }))
-          return
-        }
-        payload.affinity = affinity
-        busy = true
-        const run = handleWebSocket(server, env, ctx, payload, () => state, (nextState) => { state = nextState }).finally(() => { busy = false })
-        ctx?.waitUntil?.(run)
-        if (!ctx?.waitUntil) void run
-      })
-      return new Response(null, { status: 101, webSocket: client })
-    }
-
-    if (request.method === 'GET') {
-      return Response.json({ status: 'ok', transports: ['http', 'websocket'] })
-    }
-    if (request.method !== 'POST') return new Response('method not allowed', { status: 405 })
-    if (request.headers.get('x-relay-token') !== env.RELAY_TOKEN) {
-      return new Response('unauthorized', { status: 401 })
-    }
-
-    try {
-      const payload = await request.json()
-      const result = await handleRelayPayload(env, payload)
-      if (result.error) return Response.json({ error: result.error }, { status: result.status })
-
-      if (result.stateWrite) ctx.waitUntil(result.stateWrite)
-
-      const upstream = result.upstream
-      return new Response(upstream.body, {
-        status: upstream.status,
-        statusText: upstream.statusText,
-        headers: upstream.headers,
-      })
-    } catch (error) {
-      return Response.json(
-        { error: error instanceof Error ? error.message : 'internal relay error' },
-        { status: 502 },
-      )
-    }
-  },
-}
-`,tP=new $Y;function c3($){let Z=JSON.stringify([vB({...$.vault,paths:$.paths,host:$.host}),...[$.beforePoolWrite,$.local?.refreshToken,$.local?.resolveIdentity,$.local?.failurePolicy,$.local?.now].map(IB)]),{use:J,close:X}=tP.acquire(Z,()=>eP($)),Y=yB(()=>J().vault,X),z=J().quotaObservations;return{vault:Y,quotaObservations:z,drainQuotaPublications:()=>z.drain(),getRelayConfig:()=>J().getRelayConfig(),getSettingsPath:()=>J().getSettingsPath(),updateRelay:(G)=>J().updateRelay(G),read:()=>J().read(),authorizeLocal:(G,Q)=>J().authorizeLocal(G,Q),authorizeApi:(G,Q)=>J().authorizeApi(G,Q),authorizeVault:(G,Q)=>J().authorizeVault(G,Q),loginOAuth:(G)=>J().loginOAuth(G),putAccount:(G)=>J().putAccount(G),addApi:(G)=>J().addApi(G),updateSettings:(G)=>J().updateSettings(G),setLoggingLevel:(G)=>J().setLoggingLevel(G),setEnabled:(G,Q)=>J().setEnabled(G,Q),remove:(G)=>J().remove(G),reorder:(G,Q)=>J().reorder(G,Q),captureLocalSubject:(G)=>J().captureLocalSubject(G),publishLocal:(G,Q)=>J().publishLocal(G,Q),publishApi:(G,Q)=>J().publishApi(G,Q),resetBackoff:(G,Q,K)=>J().resetBackoff(G,Q,K),getOrCreateAuthLineage:(G,Q)=>J().getOrCreateAuthLineage(G,Q),incrementPrimeUsage:(G,Q,K)=>J().incrementPrimeUsage(G,Q,K),fetchQuota:(G,Q,K,W)=>J().fetchQuota(G,Q,K,W),fetchProfile:(G,Q,K)=>J().fetchProfile(G,Q,K),fetchProfileForDisplay:(G,Q,K)=>J().fetchProfileForDisplay(G,Q,K),close:()=>Y.close()}}function i3($,Z,J){if(!_6($))return{status:"blocked",reason:"account-disabled"};if(!vL($.quota,Z.policyStorage)||!XW($.quota,J)||!GW($.quota,Z.policyStorage,$.id==="main"?void 0:$.id,J))return{status:"blocked",reason:"quota-ineligible"};return{status:"allowed"}}function eP($){let Z=Object.freeze({...$.paths}),J=$.local?.now??$.vault?.now??Date.now,X={...$.vault?.env??process.env},Y=wB(Z),z={legacyConfig:Z.legacyConfig,roster:Y.roster},G=new sB({path:Y.routing,vaultSeed:z,now:J}),Q,K=X0({paths:Y,quota:A$,now:J,onStep:async(R)=>{if(R==="before-config-write"||R==="before-state-write")await O("claustrum")}}),W=new AbortController,V=X0({paths:Z,quota:A$,now:J,onStep:async(R)=>{if(R==="before-config-write"||R==="before-state-write"){if($.beforePoolWrite)await U(),await $.beforePoolWrite();await U()}}}),B=KP({...$.vault,paths:Z,host:$.host});function H(R){if(W.signal.aborted)throw new o("closed");R?.throwIfAborted()}let q;async function N(R){H(R);let j=await iZ($.host,X);if(j==="local"){let A=await RJ(Z),E=ZY($.host,Z,X);q=A.kind==="empty-init"?{source:E,destination:E}:A.routingPaths,j=await iZ($.host,X)}return H(R),j}async function O(R,j){if(await N(j)!==R)throw new o("route-unavailable")}async function U(R){await O("local",R)}async function D(){let R=await N();return{mode:R,paths:R==="claustrum"?Y:Z,store:R==="claustrum"?K:V}}async function _(R){let j=await V.read();if(j.status!=="ready")throw new g("publication-refused");return j.rows.find((A)=>A.id===R)}async function T(R){if(R!=="main")return R;let j=await V.readSettings();if(j.status!=="ready"||typeof j.settings.mainAccountId!=="string")throw new o("route-unavailable");return j.settings.mainAccountId}async function M(R,j,A=!0){if(await N()!=="local")return!1;let E=R.binding,P=async()=>{let F=await _(E.rowId);if(!F||!C$(E,Z,F)||F.stamp!=="bound"||!F.credential)return!1;if(A==="binding")return F.credential.type===("kind"in R?"api":"oauth");if("kind"in R)return F.credential.type==="api"&&A6(F.credential)===R.credentialFingerprint&&F.credential.baseURL===R.baseURL&&F.credential.authHeader===R.authHeader;if(F.credential.type!=="oauth"||A6(F.credential)!==R.credentialFingerprint)return!1;return!A||X8(R,E,F.credential)},[I,k]=b2(Z);try{return await p6(I.path,{...i6,name:I.name},async(F)=>p6(k.path,{...i6,name:k.name},async(S)=>{if(!await P())return!1;return await HJ(Z.runtime,Z.storageId,(m)=>{let f=m.accounts[E.rowId],x=f?.binding,b=x?.kind==="local"&&x.rowId===E.rowId&&x.identity===E.identity&&x.credentialEpoch===E.credentialEpoch;return m.accounts[E.rowId]=j(b&&f?f:{binding:E},f),m},{beforeRename:async()=>{if(!await P())throw new g("publication-refused");await F.assertOwned(),await S.assertOwned(),await U()},beforePublish:()=>U()}),!0}))}catch(F){if(F instanceof g&&F.code==="runtime-conflict"||F instanceof o&&F.code==="route-unavailable")return!1;throw F}}async function L(R){let j=await _(R);if(!j?.credential||j.credentialEpoch===void 0)throw new g("publication-refused");let A={kind:"local",storageId:Z.storageId,rowId:j.id,credentialEpoch:j.credentialEpoch,...j.identity!==void 0?{identity:j.identity}:{}},E=j.credential.type==="api"?{kind:"api",binding:A,credentialFingerprint:A6(j.credential),baseURL:j.credential.baseURL,authHeader:j.credential.authHeader}:{binding:A,credentialFingerprint:A6(j.credential),version:{}};if(!await M(E,(I,k)=>{let F=k?.binding;if(F?.kind==="local"&&F.credentialEpoch===A.credentialEpoch&&F.identity===A.identity)return I;let S=F?.kind==="local"&&F.rowId===A.rowId&&A.identity!==void 0&&F.identity===A.identity,m={binding:A,...j.credential?.type==="oauth"?{authLineageId:DZ()}:{}};if(S&&k){for(let f of["prime","profile","lastUsed","lastQuotaRefreshError","quotaErrorClearedAt","quotaErrorGeneration"])if(k[f]!==void 0)Object.assign(m,{[f]:k[f]})}return m},"binding"))throw new g("publication-refused")}async function C(){let R=await N();if(R==="claustrum")Q??=B.initializeSettings().catch((S)=>{throw Q=void 0,S}),await Q;let j=R==="claustrum"?Y:Z,A=R==="claustrum"?K:V,[E,P,I]=await Promise.all([A.read(),A.readSettings(),h$(j.runtime,j.storageId)]);if(E.status!=="ready"||P.status!=="ready")throw new g("publication-refused");let k=R==="claustrum"?await B.read():void 0;H();let F=DR({paths:{...Z,...j},rows:E.rows,settings:{...P.settings,claustrum:{...P.settings.claustrum,mode:R}},runtime:I.status==="ready"?I.state:void 0,roster:k});for(let S of F.accounts){let m=R==="local"?NQ(S.binding):B.quotaLineage(S.id,S.credentialId,S.accountIdentity),f=B.quotaObservations.quota(m,S.accountIdentity,S.quota,F.policyStorage,J());if(!f)continue;if(S.quota=f.quota,f.clearAt){if(S.quotaErrorClearedAt=Math.max(S.quotaErrorClearedAt??0,f.clearAt),(S.lastQuotaRefreshError?.checkedAt??1/0)<=S.quotaErrorClearedAt)delete S.lastQuotaRefreshError}if(S.id==="main")F.policyStorage.quota={...F.policyStorage.quota,mainQuota:S.quota,mainQuotaCheckedAt:S.quota.checkedAt,mainQuotaErrorClearedAt:S.quotaErrorClearedAt,mainLastQuotaApiError:S.lastQuotaRefreshError};else{let x=F.policyStorage.accounts.find((b)=>b.id===S.id);if(x?.type==="oauth")x.quota=S.quota,x.lastQuotaRefreshError=S.lastQuotaRefreshError}}if(R==="claustrum")z.mainRouteId=typeof P.settings.mainAccountId==="string"?P.settings.mainAccountId:void 0,await G.prepareLegacySeed(k??null),F.routingPath=Y.routing,F.routingSeed={...z};else if(q){if(F.routingPath=q.destination,q.source!==q.destination)F.routingRecoveryPath=q.source}return{snapshot:F,rows:E.rows,settings:P.settings,runtime:I.status==="ready"?I.state:void 0}}let w=new WeakMap;function v(R,j){let A=w.get(R);return A!==void 0&&OR(Z,A.rows,A.settings,j,A.runtime)}let h={vault:B,quotaObservations:B.quotaObservations,drainQuotaPublications:()=>B.quotaObservations.drain(),async getRelayConfig(){let{mode:R,paths:j,store:A}=await D();return p6(j.config,{...i6,name:"native-relay"},async(E)=>{let P=await A.readSettings();if(P.status!=="ready")throw new g("publication-refused");let I=B9(P.settings.relay),k=await h$(j.runtime,j.storageId),F=k.status==="ready"?k.state.relay?.token:void 0;if(await O(R),await E.assertOwned(),!I.enabled||!I.url||!F)return null;return{...I,token:F}})},async updateRelay(R){let j=UJ(R);if(!j||typeof j!=="object"||Array.isArray(j)||Object.keys(j).some((I)=>!["enabled","url","token","fallbackToDirect","transport"].includes(I)))throw new g("publication-refused");for(let I of["enabled","fallbackToDirect"])if(j[I]!==void 0&&typeof j[I]!=="boolean")throw new g("publication-refused");if(j.url!==void 0&&typeof j.url!=="string")throw new g("publication-refused");if(j.transport!==void 0&&!["http","websocket"].includes(j.transport))throw new g("publication-refused");if(j.token!==void 0&&j.token!==null&&(typeof j.token!=="string"||!j.token.trim()||/\p{Cc}/u.test(j.token)))throw new g("publication-refused");let{mode:A,paths:E,store:P}=await D();await p6(E.config,{...i6,name:"native-relay"},async(I)=>{let k=await P.readSettings();if(k.status!=="ready")throw new g("publication-refused");let F=B9(k.settings.relay),S=await h$(E.runtime,E.storageId),m=j.token===void 0?S.status==="ready"?S.state.relay?.token:void 0:j.token?.trim(),f=B9({...F,...j,enabled:j.token===null?!1:j.enabled??F.enabled});if(f.enabled&&(!f.url||!m))throw new g("publication-refused");async function x(b){await P.updateSettings(async(y)=>{await O(A),await I.assertOwned(),y.relay=b})}if(await x({...F,enabled:!1}),j.token!==void 0)await HJ(E.runtime,E.storageId,(b)=>{if(m)b.relay={token:m};else delete b.relay;return b},{beforeRename:async()=>{await O(A),await I.assertOwned()}});await x(f)})},async getSettingsPath(){return(await D()).paths.config},async read(){let R=await C();return w.set(R.snapshot,R),R.snapshot},async authorizeLocal(R,j={}){await N(j.signal);let A=await h.read(),E=A.accounts.find((f)=>f.id===R);if(A.mode!=="local")return{status:"refused",reason:"custody-mode",persisted:!1};if(!E?.binding&&v(A,R)){if(n.debug("native-auth","waiting for an account write to finish",{phase:"waiting"}),await aT(Z,j.signal?[W.signal,j.signal]:[W.signal],()=>H(j.signal))==="deadline")throw n.warn("native-auth","account write did not finish in time",{outcome:"deadline"}),new TJ;if(A=await h.read(),E=A.accounts.find((x)=>x.id===R),A.mode!=="local")return{status:"refused",reason:"custody-mode",persisted:!1};if(!E?.binding&&v(A,R))throw n.warn("native-auth","account write is still unfinished",{outcome:"still-torn"}),new TJ;n.debug("native-auth","account write finished",{outcome:"joined"})}if(!E?.binding||E.source!=="local"||E.type!=="oauth")return{status:"refused",reason:"row-ineligible",persisted:!1};if(E.state==="unsupported-access")return{status:"refused",reason:"unsupported-access",persisted:!1};let P=await h$(Z.runtime,Z.storageId),I=P.status==="ready"?P.state.accounts[E.binding.rowId]?.binding:void 0;if(I?.kind==="local"&&I.credentialEpoch<E.binding.credentialEpoch){if(await L(E.binding.rowId),A=await h.read(),E=A.accounts.find((f)=>f.id===R),!E?.binding)return{status:"refused",reason:"row-ineligible",persisted:!1}}let k=(f,x)=>{if(x.mode!=="local")return{status:"blocked",reason:"local-mode-unavailable"};if(!f||!_6(f))return{status:"blocked",reason:"account-disabled"};return{status:"allowed"}},F=(f,x)=>{let b=k(f,x);return b.status==="allowed"&&f?j.policy?.(f,x)??b:b};if(F(E,A).status==="blocked")return{status:"refused",reason:"quota-ineligible",persisted:!1};let m=await yT({paths:Z,...$.local,now:J,publicationGuard:async(f)=>{if(f.status==="persisted"||f.status==="failed"&&f.persisted&&f.committed!==void 0)return!0;try{return await iZ($.host,X)==="local"}catch{return!1}},externalPolicy:()=>k(E,A),failurePolicy:$.local?.failurePolicy??((f)=>{let x=f.observation.status==="failed"?f.observation.failure:void 0,b=Object.assign(Error(x?.classification==="invalid-grant"?"invalid_grant":"Local refresh failed"),{status:x?.status,retryAfter:x?.retryAfter,...x?.classification==="transient"&&x.status===void 0?{code:"ECONNRESET"}:{}}),y=IL({error:b,now:J(),accountIdentity:f.attribution.subject.binding.identity,previous:{message:"Local refresh failed",checkedAt:J(),accountIdentity:f.attribution.subject.binding.identity,retryCount:Math.max(0,f.observation.attempt-1)}}),d=f.observation.status==="failed"&&x?.kind==="provider"&&x.classification==="transient"&&x.status!==429&&!f.observation.persisted&&!f.observation.committed&&f.observation.attempt<DJ;return{checkedAt:y.checkedAt,nextRetryAt:d?y.checkedAt:y.nextRetryAt,retryCount:y.retryCount}})}).authorize({intent:j.intent??"serve",mode:"local",binding:E.binding,rejectedAccessToken:j.rejectedAccessToken,signal:AbortSignal.any([W.signal,...j.signal?[j.signal]:[]])});if(H(j.signal),m.status==="usable"){let f=await h.read(),x=f.accounts.find((b)=>b.id===R);if(F(x,f).status==="blocked"||!x?.binding||x.binding.rowId!==m.binding.rowId||x.binding.credentialEpoch!==m.binding.credentialEpoch||x.binding.identity!==m.binding.identity)return{status:"refused",reason:"row-ineligible",persisted:!1}}return m},async authorizeApi(R,j){await U(j);let A=await _(await T(R));if(H(j),!A||!_6(A)||!A.candidate||A.stamp!=="bound"||A.credential?.type!=="api")throw new o("route-unavailable");return await U(j),{...A.credential,subject:{kind:"api",binding:hj(Z,A),credentialFingerprint:A6(A.credential),baseURL:A.credential.baseURL,authHeader:A.credential.authHeader}}},authorizeVault:(R,j)=>{return H(j),B.authorize(R,j)},async loginOAuth(R){if((await h.read()).mode!=="local")throw new o("route-unavailable");let A;try{if(!R.credential.access.startsWith("sk-ant-oat"))throw Error("Unsupported OAuth credential");if(A=(await($.local?.resolveIdentity??qW)(R.credential.access,void 0,void 0)).accountUuid,!A?.trim())throw Error("Missing account identity")}catch{throw Error("Claude account identity could not be verified; retry sign-in. No account changes were saved.")}return h.putAccount({...R,accountIdentity:A,replace:R.replace??!0,credential:{type:"oauth",...R.credential}})},async putAccount(R){await U();let j=await h.read();if(j.mode!=="local")throw new o("route-unavailable");let A=R.routeId==="main"?await T("main").catch(()=>DZ()):R.routeId;if(R.credential.type==="api"&&(R.routeId==="main"||A===j.settings.mainAccountId))throw new o("route-unavailable");let E=await _(A),P=A,I=!1;if(R.replace&&E){if(!E.credentialEpoch)throw new g("publication-refused");await V.replace(A,R.credential,{identity:R.accountIdentity},{attribution:{credentialEpoch:E.credentialEpoch,identity:E.identity}})}else{let S=await V.add({id:A,credential:R.credential,identity:R.accountIdentity,label:R.label});P=S.id,I=S.outcome==="added"||S.outcome==="added-disabled"}if(R.routeId==="main")await V.updateSettings((S)=>{S.mainAccountId=P});await L(P);let F=(await h.read()).accounts.find((S)=>S.binding?.rowId===P);if(!F)throw new o("route-unavailable");if(I)RR(F);return F},addApi:(R)=>h.putAccount({routeId:R.routeId??DZ(),label:R.label,replace:R.replace,credential:{type:"api",apiKey:R.apiKey,baseURL:R.baseURL??"https://api.anthropic.com",authHeader:R.authHeader}}),async updateSettings(R){let j=await D(),A={},E=await j.store.updateSettings(async(P)=>{function I(m){let f=m.claustrum;return[m.mainAccountId,f?.mode,f?.primaryAccount,f?.scopedRoster,f?.rosterView,m.relay]}let k=JSON.stringify(I(P));A.before=UB(P);let F=await R(P),S=UJ(F??P);if(JSON.stringify(I(S))!==k)throw new o("route-unavailable");return S});if(E.outcome==="updated"&&A.before)jR(A.before,E.settings);return E},async setLoggingLevel(R){await h.updateSettings((j)=>({...j,logging:{...j.logging&&typeof j.logging==="object"&&!Array.isArray(j.logging)?j.logging:{},level:R}})),NB(R)},async setEnabled(R,j){let A=await h.read(),E=A.accounts.find((f)=>f.id===R),P={id:R,label:E?.label},I=j?"account enabled":"account disabled";if(A.mode==="claustrum"){if(E?.source!=="vault")throw new o("route-unavailable");if(await B.setEnabled(R,j))jZ(I,P);return}await U();let k=await T(R),F=j?"enable":"disable",S={},m=X0({paths:Z,quota:A$,now:J,onStep:async(f,x)=>{if(f==="before-config-write"||f==="before-state-write")await U();if(f!=="before-config-write"||x.operation!==F||x.rowId!==k)return;S.before=void 0;try{let b=await V.read();if(b.status==="ready")S.before=b.rows.find((y)=>y.id===k)?.enabled}catch{}await U()}});if(j)await m.enable(k);else await m.disable(k,"user-disabled");if(S.before!==void 0&&S.before!==j)jZ(I,P)},async remove(R){await U();let j=await h.read();if(j.mode!=="local")throw new o("route-unavailable");let A=j.accounts.find((P)=>P.id===R);if((await V.remove(await T(R))).outcome==="removed")jZ("account removed",{id:R,label:A?.label})},async reorder(R,j){await U();let A=await h.read();if(A.mode!=="local")throw new o("route-unavailable");let E=await V.read();if(E.status!=="ready")throw new g("publication-refused");let P=await Promise.all(R.map(T)),I=E.rows.find((k)=>k.id===A.settings.mainAccountId);if(I&&!P.includes(I.id))P.unshift(I.id);if((await V.reorder(P)).outcome==="reordered")jZ("account reordered",A.accounts.find((k)=>k.id===j)??{id:j})},async captureLocalSubject(R){await U();let j=await _(await T(R));if(j?.credential?.type!=="oauth"||j.stamp!=="bound")throw new o("route-unavailable");let A=j.credential,E={kind:"local",storageId:Z.storageId,rowId:j.id,credentialEpoch:j.credentialEpoch??0,...j.identity!==void 0?{identity:j.identity}:{}};if(!C$(E,Z,j))throw new o("route-unavailable");return{binding:E,credentialFingerprint:A6(A),version:{...A.access?{accessFingerprint:p$(A.access)}:{},...A.expires!==void 0?{expires:A.expires}:{},...Object.hasOwn(A,"lastRefreshedAt")?{lastRefreshedAt:A.lastRefreshedAt}:{}}}},async publishLocal(R,j){let A=zB(j);if(await N()!=="local")return!1;let{quota:E,...P}=A,I=E!==void 0&&Object.keys(P).length===0,k=await _(R.binding.rowId);if(k?.stamp!=="bound"||k.credential?.type!=="oauth"||!C$(R.binding,Z,k)||!I&&!X8(R,R.binding,k.credential))return!1;if(E){if(E.source!=="headers"&&k.quota&&r6(x$(k.quota))>r6(E))return!1;if(E.accountIdentity!==R.binding.identity)throw new g("publication-refused");await V.recordQuota(R.binding.rowId,{credentialEpoch:R.binding.credentialEpoch,identity:R.binding.identity},J0(E))}return M(R,(F)=>GB(F,P),I?"binding":!0)},publishApi:(R,j)=>M(R,(A)=>({...A,lastUsed:Math.max(A.lastUsed??0,j.lastUsed)})),async resetBackoff(R,j,A="all"){if("accessToken"in j)return B.resetBackoff(j,A);if(await N()!=="local")return!1;if(await T(R)!==j.binding.rowId)return!1;return M(j,(E)=>{let P=Math.max(J(),E.refreshErrorClearedAt??0,E.quotaErrorClearedAt??0,E.lastRefreshError?.checkedAt??0,E.lastQuotaRefreshError?.checkedAt??0),I={...E};if(A!=="quota")delete I.lastRefreshError,delete I.validationRetry,I.refreshErrorClearedAt=P;if(A!=="refresh")delete I.lastQuotaRefreshError,I.quotaErrorClearedAt=P,I.quotaErrorGeneration=(E.quotaErrorGeneration??0)+1;return I},!1)},async getOrCreateAuthLineage(R,j){if("accessToken"in j)return B.getOrCreateAuthLineage(j);if(await N()!=="local")return;if(await T(R)!==j.binding.rowId)return;let A;return await M(j,(P)=>{return A=P.authLineageId??DZ(),{...P,authLineageId:A}})?A:void 0},async incrementPrimeUsage(R,j,A={}){if("accessToken"in j)return B.incrementPrimeUsage(j,A);if(await N()!=="local")return!1;if(await T(R)!==j.binding.rowId)return!1;let E=$C(A);return M(j,(P)=>({...P,prime:{count:(P.prime?.count??0)+1,inputTokens:(P.prime?.inputTokens??0)+E.inputTokens,outputTokens:(P.prime?.outputTokens??0)+E.outputTokens,since:P.prime?.since??J()}}))},async fetchQuota(R,j=fetch,A,E){let P=await h.read();if(P.mode==="claustrum")return B.fetchQuota(R,j,A,E);let I=P.accounts.find((f)=>f.id===R),k=await p(R,j,A,(f,x)=>G7({accessToken:f.access,fetchImpl:x,now:J}),async(f,x)=>{let b=I?.binding&&I.binding.rowId===x.binding.rowId&&I.binding.credentialEpoch===x.binding.credentialEpoch&&I.binding.identity===x.binding.identity?I:void 0,y=QB(f,x.binding.identity,Math.max(J(),(b?.quotaErrorClearedAt??-1)+1),b?.lastQuotaRefreshError);if(y)await h.publishLocal(x.subject,{lastQuotaRefreshError:y})},E),F={...k.value,accountIdentity:k.attempt.binding.identity},S=I?.binding&&I.binding.rowId===k.attempt.binding.rowId&&I.binding.credentialEpoch===k.attempt.binding.credentialEpoch&&I.binding.identity===k.attempt.binding.identity?I:void 0,m=Math.max(F.checkedAt??J(),S?.quotaErrorClearedAt??0,S?.lastQuotaRefreshError?.checkedAt??0);return h.quotaObservations.publish(R,{lineage:NQ(k.attempt.subject.binding),accountUuid:k.attempt.subject.binding.identity,entry:{quota:F,checkedAt:F.checkedAt??J(),refreshAfter:F.checkedAt??J()},generalExhausted:AB(F),quotaErrorClearedAt:m},()=>h.publishLocal(k.attempt.subject,{quota:F,quotaErrorClearedAt:m})),F},async fetchProfile(R,j=fetch,A){if((await h.read()).mode==="claustrum")return B.fetchProfile(R,j,A);let E=await a(R,j,A);return await h.publishLocal(E.attempt.subject,{profile:E.value}),E.value},async fetchProfileForDisplay(R,j=fetch,A){if((await h.read()).mode==="claustrum")return B.fetchProfileForDisplay(R,j,A);let E=await a(R,j,A),P=structuredClone(E.attempt.subject),I=E.value;return fB(I,()=>h.publishLocal(P,{profile:I}),async()=>{if((await h.read()).mode!=="local"||await T(R)!==P.binding.rowId)return!1;let k=await _(P.binding.rowId);return k?.stamp==="bound"&&_6(k)&&k.credential?.type==="oauth"&&C$(P.binding,Z,k)&&X8(P,P.binding,k.credential)})},close(){if(!W.signal.aborted)W.abort(new o("closed")),B.close()}};function a(R,j,A){return p(R,j,A,(E,P)=>QV({accessToken:E.access,accountIdentity:E.binding.identity,fetchImpl:P,now:J,signal:A}))}async function p(R,j,A,E,P,I){let k=AbortSignal.any([W.signal,...A?[A]:[]]),F=await h.authorizeLocal(R,{signal:k});if(F.status!=="usable")throw new o("route-unavailable");let S=F,m=(y,d)=>{let s=()=>j(y,{...d,signal:k});if(!I)return s();return I(s,async()=>{await U(k);let r=await _(S.binding.rowId);if(!r||!_6(r)||r.stamp!=="bound"||r.credential?.type!=="oauth"||!C$(S.binding,Z,r)||!X8(S.subject,S.binding,r.credential)||await T(R)!==S.binding.rowId)throw new o("identity-changed");await U(k)})},f,x=Object.assign(async(y,d)=>{f=void 0;let s=await m(y,d);if(f=s.status,s.status===401&&!k.aborted){await s.body?.cancel().catch(()=>{}),H(k);let r=await h.authorizeLocal(R,{rejectedAccessToken:S.access,signal:k});if(r.status==="usable"&&r.binding.rowId===S.binding.rowId&&r.binding.credentialEpoch===S.binding.credentialEpoch&&r.binding.identity===S.binding.identity&&r.access!==S.access&&r.subject.version.lastRefreshedAt!==void 0&&(S.subject.version.lastRefreshedAt===void 0||r.subject.version.lastRefreshedAt>S.subject.version.lastRefreshedAt)){S=r;let K6=new Headers(d?.headers);K6.set("authorization",`Bearer ${S.access}`),f=void 0,s=await m(y,{...d,headers:K6}),f=s.status}}return s},{preconnect:j.preconnect}),b;try{b=await E(S,x)}catch(y){H(k);let d=y instanceof o||y instanceof g?y:WB(y,f);throw await P?.(d,S),d}return H(k),{value:b,attempt:S}}return h}function $C($){let Z=$.inputTokens??0,J=$.outputTokens??0;if(![Z,J].every((X)=>Number.isSafeInteger(X)&&X>=0))throw new g("publication-refused");return{inputTokens:Z,outputTokens:J}}function B9($){let Z=$&&typeof $==="object"?$:{},J=typeof Z.url==="string"?Z.url.trim():"",X=nB(Z.transport,J);if(J)try{let Y=new URL(J);if(!["https:","http:","wss:","ws:"].includes(Y.protocol)||Y.username||Y.password||X==="http"&&!["https:","http:"].includes(Y.protocol))throw Error("invalid endpoint")}catch{throw new g("publication-refused")}return{enabled:Z.enabled===!0,url:J,transport:X,fallbackToDirect:Z.fallbackToDirect!==!1}}class m$ extends Error{code;effect;constructor($,Z=void 0){super(`Native host auth write: ${$}`);this.code=$,this.effect=Z,this.name="NativeHostAuthWriteError"}}function yQ($){return typeof $==="string"&&($==="absent"||$.length===64&&/^[a-f0-9]{64}$/.test($))}async function F1($,Z,J){try{await $?.()}catch{throw new m$(Z,J)}}async function $5($,Z={}){let J,X,Y;try{let{host:z,authPath:G,sourceDigest:Q,expectedDigest:K,removePiAnthropicAuth:W,processFence:V}=$;pX($.env);let{beforeRecheck:B,beforeRename:H,afterRename:q,afterUnlink:N}=Z;if(z!=="opencode"&&z!=="pi"||typeof G!=="string"||!GC(G)||/\p{Cc}/u.test(G)||!yQ(Q)||!yQ(K)||typeof V!=="function")throw new m$("invalid-source");let O=await O6("hostAuth",G);if(O.metadata&&process.getuid&&O.metadata.uid!==process.getuid())throw new m$("unsafe-source");let U=d6(z,O.data);if(U.digest!==Q)throw new m$("invalid-source");let D=Object.assign(Object.create(null),O.data);if(z==="opencode"){if(U.kind!=="api"&&U.kind!=="activation")D.anthropic=b7("anthropic")}else delete D.anthropic;if(d6(z,D).digest!==K)throw new m$("invalid-source");if(z==="opencode"&&(U.kind==="api"||U.kind==="activation")||z==="pi"&&U.kind==="absent")return Object.freeze({status:"unchanged"});if(z==="pi"&&W!==!0)throw new m$("consent-required");let _=z==="pi"&&Object.keys(D).length===0,T=Object.freeze(z==="pi"?{status:"removed",file:_?"unlinked":"replaced"}:{status:O.data===void 0?"created":"replaced"});if(!_){J=QC(zC(G),`.native-host-auth-write.${ZC()}.tmp`);let M=await XC(J,"wx",384);try{let L=await M.stat();X={dev:L.dev,ino:L.ino},await M.writeFile(`${JSON.stringify(D,null,2)}
-`,"utf8"),await M.chmod(O.metadata?O.metadata.mode&4095:384),await M.sync()}finally{await M.close()}}if(await F1(B,"hook-failed"),await S0(O),await F1(H,"hook-failed"),await F1(V,"process-fence-refused"),_)await vQ(G),Y=T,await F1(N,"hook-failed",Y);else await YC(J,G),X=void 0,Y=T,await F1(q,"hook-failed",Y);return T}catch(z){if(z instanceof m$||z instanceof k0)throw z;if(z instanceof m6)throw new m$(z.code==="unsafe-source"?"unsafe-source":"invalid-source",Y);throw new m$("write-io",Y)}finally{if(J&&X)try{let z=await JC(J);if(z.dev===X.dev&&z.ino===X.ino)await vQ(J)}catch{}}}class JY extends Error{code;constructor($){super($==="primary-unverified"?"Stop OpenCode and Pi, then run bunx @cortexkit/opencode-anthropic-auth setup --login --no-claustrum. Existing credentials have not been changed.":`Native migration: ${$}`);this.code=$,this.name="NativeMigrationError"}}var I7=new WeakMap;async function J5({paths:$}){let Z=X0({paths:$,quota:A$}),[J,X,Y,z]=await Promise.all([Z.read(),O6("config",$.config),O6("state",$.state),h$($.runtime,$.storageId)]);if(J.status!=="ready")c();for(let W of[X,Y])z0(W);let G=(W)=>{if(W===void 0)return 0;if(!W||typeof W!=="object"||Array.isArray(W))c();return Object.keys(W).length},Q=X.data?.commonAuthPool;if(Q!==void 0&&(!Q||typeof Q!=="object"||Array.isArray(Q)))c();let K=G(Q&&"rows"in Q?Q.rows:void 0)+G(Y.data?.accounts);return J.rows.length>0||K>0||z.status==="ready"&&Object.keys(z.state.accounts).length>0}function e3($){return $.accounts.some((Z)=>Z.source==="local"&&Z.type==="oauth"&&_6(Z)&&Z.state!=="unsupported-access")}function c($="invalid-source"){throw new JY($)}function z0($){if($.metadata&&process.getuid&&$.metadata.uid!==process.getuid())c("unsafe-source")}async function N2($){try{return await WC($),!1}catch(Z){if(Z instanceof Error&&"code"in Z&&Z.code==="ENOENT")return!0;return c("unsafe-source")}}async function $k($,Z={}){let J={...$.paths},X={...$.env},Y=$.routingDestinationPath,z=$.processFence;return await z(),pX(X),p6(J.journal,{name:"native-migration",ttlMs:30000,timeoutMs:15000,...Z.lockOptions,renew:!0},async(G)=>{await z();let Q=async()=>{await z();try{await G.assertOwned()}catch{c("ownership-lost")}for(let H of[J.config,J.state,J.runtime,J.roster])if(!await N2(H))c();if(!X.OPENCODE_ANTHROPIC_AUTH_ROUTING_STATE_FILE&&!await N2(Y))c();let K=await aB(J.legacyConfig,J.legacyState);for(let H of Object.keys(K))if(J[H]!==K[H])c();if(!Z5(Y)||/\p{Cc}/u.test(Y))c();let W=await b6(Y),V=[J.legacyConfig,J.legacyState,J.config,J.state,J.runtime,J.roster,J.journal];if(new Set(V).size!==V.length||V.includes(W))c();let B=ZY("opencode",J,X);if(W!==await b6(B))c()};return wT(J,{lockOptions:Z.lockOptions,assertOwned:Q,onWriteStep:async(K)=>Z.onStep?.(`${K}:journal:committed`)})})}async function Zk($){let Z=await X5($),J=Object.freeze({storageId:$.paths.storageId,host:$.host});return I7.set(J,Z),J}function Jk($){I7.delete($)}async function X5($,Z=!1){pX($.env),await $.processFence();let J=await aB($.paths.legacyConfig,$.paths.legacyState);for(let _ of Object.keys(J))if($.paths[_]!==J[_])c();for(let _ of[$.hostAuthPath,$.routingSourcePath,$.routingDestinationPath])if(!Z5(_)||/\p{Cc}/u.test(_))c();let X=await Q1($.paths),Y=X?.kind==="empty-init",z=X?.kind==="empty-init"?void 0:X;if(Y){if(X.host!==$.host||$.routingDestinationPath!==ZY($.host,$.paths,$.env))c();if(Z&&await J5({paths:$.paths}))c("pool-populated")}let G=await O6("hostAuth",$.hostAuthPath);z0(G);let Q=d6($.host,G.data);if($.host==="pi"&&Q.kind!=="absent"&&!$.removePiAnthropicAuth)c("consent-required");let K=await b6($.hostAuthPath),W=await b6($.routingSourcePath),V=await b6($.routingDestinationPath),B=[$.paths.legacyConfig,$.paths.legacyState,$.paths.config,$.paths.state,$.paths.runtime,$.paths.roster,$.paths.journal,K,W];if(new Set(B).size!==B.length||V!==W&&B.includes(V))c();if(z&&(z.host!==$.host||z.hostAuthPath!==K||z.routingPaths.source!==W||z.routingPaths.destination!==V))c();if(z?.phase==="committed"||z?.phase==="retired"){let _=(T,M)=>({role:T,path:M,digest:null,data:void 0,metadata:void 0});return{config:_("config",$.paths.legacyConfig),state:_("state",$.paths.legacyState),routing:_("routing",$.routingSourcePath),auth:G,journal:z,hostAuthPath:K,routingSourcePath:W,routingDestinationPath:V}}if(!X){for(let _ of[$.paths.config,$.paths.state,$.paths.runtime,$.paths.roster])if(!await N2(_))c();if(W!==V&&!await N2($.routingDestinationPath))c()}let H=await O6("config",$.legacyConfigPath??$.paths.legacyConfig),q=await O6("state",$.legacyStatePath??$.paths.legacyState),N=await O6("routing",$.routingSourcePath),O=Y||z?.kind==="legacy-import"?await O6("routing",$.routingDestinationPath):void 0;if(O)z0(O);for(let _ of[H,q,N])z0(_);if(await b6(H.path)!==$.paths.legacyConfig||await b6(q.path)!==$.paths.legacyState)c();if(z&&(z.sources.config!==H.digest||z.sources.state!==q.digest||z.expectedRouting==="unprepared"&&z.sources.routing!==N.digest))c();if(z&&Q.digest!==z.sources.hostAuth&&Q.digest!==z.expectedHostAuth)c();let U,D;if(!z||z.expectedHostAuth==="unprepared"||Q.digest===z.sources.hostAuth){U=aj({host:$.host,storageId:$.paths.storageId,configDigest:H.digest,config:H.data,state:q.data,hostAuth:G.data});let _=U.mainRouteId,T=U.accounts.find((L)=>L.id===_);if(($.requestVaultActivation||z?.activation?.kind==="requested")&&T?.credential?.type==="oauth"&&!T.identity)c("primary-unverified");if(U.custodyPrimary){if(!$.custody)c();D={inventory:await $.custody.discover(),primary:U.custodyPrimary,primaryRouteId:U.mainRouteId,legacyRows:U.custodyRows,disabledAccountIdentities:U.disabledAccountIdentities,reservedRouteIds:U.accounts.filter((L)=>L.credential?.type==="api").map((L)=>L.id)},FJ(D)}let M=U.accounts.filter((L)=>L.credential).map((L)=>({id:L.id,type:L.credential?.type??"oauth",credential:L.credential,identity:L.identity,credentialEpoch:1,enabled:L.enabled,stamp:"bound",hasEntry:!0,needsFirstReading:!1,candidate:L.enabled}));WJ($.paths,U,M,D?FJ(D):void 0)}return{config:H,state:q,routing:N,auth:G,journal:X,routingDestination:O,projection:U,seedInput:D,hostAuthPath:K,routingSourcePath:W,routingDestinationPath:V}}async function j0($){let Z=await $.read();if(Z.status!=="ready")c();return Z.rows}async function nZ($){let Z=await h$($.runtime,$.storageId);if(Z.status!=="ready")c();return Z.state}async function H9($,Z,J){let X=await Z.readSettings();if(X.status!=="ready")c();let Y=await O6("state",$.roster);z0(Y);let z=Y.data?await h6($.roster):null;if(Y.data&&!z)c();return{runtime:await nZ($),settings:X.settings,accounts:J.map((G)=>({id:G.id,type:G.type,enabled:G.enabled,label:G.label??null,addedAt:G.addedAt??null,disabledReason:G.disabledReason??null,quota:G.quota??null})),roster:z}}async function gQ($,Z,J){let X=b2($);async function Y(z,G){let Q=X[z];if(!Q)return Y0($.roster,async(K,W)=>{return{result:await p6($.runtime,{name:"native-runtime",...i6,renew:!0},(B)=>J(async()=>{await Z();for(let H of G)await H();await W.assertOwned(),await B.assertOwned()}))}});return p6(Q.path,{...i6,...Q,renew:!0},(K)=>Y(z+1,[...G,()=>K.assertOwned()]))}return Y(0,[])}function U9($){let Z=$.routingDestination?.data,J={};if(Z){let G=new Map;if(!Z.assignments||typeof Z.assignments!=="object")c();J=Z.assignments;for(let Q of Object.values(Z.assignments)){if(!Q||typeof Q!=="object"||!("accountId"in Q)||typeof Q.accountId!=="string")c();G.set(Q.accountId,Q.accountId)}MQ({version:Z.version,updatedAt:Z.updatedAt,assignments:Z.assignments},G)}if(!$.routing.data)return Z?`${JSON.stringify(Z,null,2)}
-`:void 0;if(!$.projection)c();let X=new Map($.projection.accounts.map((G)=>[G.id,G.id]));X.set("main",$.projection.mainRouteId);let Y=MQ($.routing.data,X);if(!Z)return Y;let z=JSON.parse(Y);return`${JSON.stringify({...Z,assignments:{...z.assignments,...J}},null,2)}
-`}function mQ($){return $===void 0?null:KC("sha256").update($).digest("hex")}function Y5($,Z){let J=d6($.host,Z.data);return $.host==="pi"?"absent":J.kind==="api"?J.digest:d6("opencode",{anthropic:b7("anthropic")}).digest}async function R0($){await S0($.config),await S0($.state)}async function N9($,Z){if(await b6($.hostAuthPath)!==Z.hostAuthPath||await b6($.routingSourcePath)!==Z.routingSourcePath||await b6($.routingDestinationPath)!==Z.routingDestinationPath)c()}async function hQ($,Z,J,X){let Y=[{role:"config",path:$.legacyConfigPath??$.paths.legacyConfig,digest:Z.sources.config},{role:"state",path:$.legacyStatePath??$.paths.legacyState,digest:Z.sources.state},...Z.routingPaths.source===Z.routingPaths.destination?[]:[{role:"routing",path:$.routingSourcePath,digest:Z.sources.routing}]],z=await Promise.all(Y.map(async(G)=>{let Q=await O6(G.role,G.path);if(z0(Q),Q.data&&Q.digest!==G.digest)c("retirement-refused");return Q}));for(let G of z){if(!G.data)continue;await X.onStep?.(`before:retire:${G.role}`),await S0(G),await $.processFence(),await J(),await BC(G.path),await X.onStep?.(`after:retire:${G.role}`)}return sZ($.paths,"committed","retired",{assertOwned:async()=>{for(let G of Y)if(!await N2(G.path))c("retirement-refused");await $.processFence(),await J()},onWriteStep:async(G)=>X.onStep?.(`${G}:journal:retired`)})}async function pQ($,Z,J){let X=await O6("hostAuth",$.hostAuthPath);z0(X);let Y=d6($.host,X.data);await $5({host:$.host,authPath:$.hostAuthPath,sourceDigest:Y.digest,expectedDigest:Y5($,X),env:$.env,removePiAnthropicAuth:$.removePiAnthropicAuth,processFence:async()=>{await $.processFence(),await Z()}},J.hostWrite)}async function Xk($,Z={}){let J={...$.paths},X={...$,paths:J,env:{...$.env}};try{return await p6(J.journal,{name:"native-migration",ttlMs:30000,timeoutMs:15000,renew:!0},async(Y)=>{let z=async()=>{try{await Y.assertOwned()}catch{c("ownership-lost")}},G=await X5(X,!0);if(X.preflight){let U=I7.get(X.preflight);if(!U||X.preflight.storageId!==J.storageId||X.preflight.host!==X.host||U.config.digest!==G.config.digest||U.state.digest!==G.state.digest||U.routing.digest!==G.routing.digest||U.routingDestination?.digest!==G.routingDestination?.digest||d6(X.host,U.auth.data).digest!==d6(X.host,G.auth.data).digest||U.hostAuthPath!==G.hostAuthPath||U.routingSourcePath!==G.routingSourcePath||U.routingDestinationPath!==G.routingDestinationPath)c()}let Q=G.journal?.kind==="empty-init",K=G.journal?.kind==="empty-init"?void 0:G.journal,W=X0({paths:J,quota:A$,onLockStep:Z.store?.onLockStep,onStep:async(U,D)=>{if(await Z.store?.onStep?.(U,D),await H(`${U}:store:${D.operation}`),U.startsWith("before-"))await R0(G),await X.processFence(),await z()}}),V=async()=>{let U=await W.readSettings();if(U.status!=="ready")c("settings-changed");return K2(U.settings)},B=Q?await V():K?.kind==="legacy-import"&&K.phase!=="committed"&&K.phase!=="retired"?K.nativeSettingsDigest:void 0;if(B!==void 0&&await V()!==B)c("settings-changed");let H=async(U)=>Z.onStep?.(U),q={assertOwned:async()=>{if(await N9(X,G),await R0(G),await X.processFence(),await z(),Q&&!K&&await J5({paths:J}))c("pool-populated")},onWriteStep:async(U,D)=>{await H(D.kind!=="empty-init"&&D.phase==="verified"&&D.preparedProof?`${U}:proof`:`${U}:journal:${D.phase}`)}};if(X.host==="opencode"&&(K?.phase==="committed"||K?.phase==="retired")&&d6("opencode",G.auth.data).kind==="oauth")c("host-login-present");if(K?.phase==="retired"){if(K.activation===null)await pQ(X,z,Z);return K}if(K?.phase==="committed"){if(K=await hQ(X,K,z,Z),K.activation===null)await pQ(X,z,Z);return K}if(!K)await z(),K=await ST(J,{host:X.host,...B===void 0?{}:{nativeSettingsDigest:B},sources:{config:G.config.digest,state:G.state.digest,hostAuth:d6(X.host,G.auth.data).digest,routing:G.routing.digest},hostAuthPath:G.hostAuthPath,routingPaths:{source:G.routingSourcePath,destination:G.routingDestinationPath},...X.requestVaultActivation?{activation:"requested"}:{}},q);let N,O;if(K.phase==="building"){let U=G.projection;if(!U)c();let D=async()=>{await N9(X,G),await R0(G),await X.processFence(),await z()};await D(),await W.initialize();for(let M of[...U.accounts].filter((L)=>L.credential).sort((L,C)=>Number(L.enabled)-Number(C.enabled))){let L=(await j0(W)).find((C)=>C.id===M.id);if(L)j1({...U,accounts:[{...M,credential:M.credential,enabled:L.enabled}]},[L],!1);else{if(await D(),!M.credential)c();if((await W.add({id:M.id,credential:M.credential,...M.identity!==void 0?{identity:M.identity}:{},...M.label!==void 0?{label:M.label}:{}})).id!==M.id)c();await H(`after:add:${M.id}`)}if(await D(),!M.enabled)await W.disable(M.id,"user-disabled");else await W.enable(M.id);if(M.quota){let C=(await j0(W)).find((w)=>w.id===M.id);if(!C?.credentialEpoch)c();await D(),await W.recordQuota(M.id,{credentialEpoch:C.credentialEpoch,...C.identity!==void 0?{identity:C.identity}:{}},M.quota)}}if(await D(),await W.reorder(U.accounts.filter((M)=>M.credential).map((M)=>M.id)),K.kind!=="legacy-import")await D(),await W.updateSettings(()=>U.settings);if(G.seedInput){if(await D(),await H("before:roster"),!X.custody)c();O=await X.custody.publishSeed(J,G.seedInput,{assertOwned:D}),await z(),await H("after:roster")}let _=await j0(W);j1(U,_);let T=WJ(J,U,_,O);if(await D(),await H("before:runtime"),G.seedInput){if(!X.custody)c();await X.custody.publishRuntimeSeed(J,T,{assertOwned:D})}else await HJ(J.runtime,J.storageId,(M)=>{if(Object.keys(M.accounts).length>0&&x6(M)!==x6(T))c();return T},{beforeRename:D});await H("after:runtime"),N=U9(G),await gQ(J,z,async(M)=>{if(await R0(G),j1(U,await j0(W)),x6(await nZ(J))!==x6(T))c();K=await sZ(J,"building","verified",{...q,assertOwned:async()=>{if(await R0(G),j1(U,await j0(W)),x6(await nZ(J))!==x6(T))c();await X.processFence(),await M()}})})}return K=await gQ(J,z,async(U)=>{if(!K)c();await R0(G);let D=await j0(W),_=await H9(J,W,D);if(K.expectedHostAuth==="unprepared"){if(!G.projection)c();j1(G.projection,D);let L=await W.readSettings();if(L.status!=="ready"||(K.kind==="legacy-import"?K2(L.settings)!==K.nativeSettingsDigest:x6(L.settings)!==x6(G.projection.settings)))c();if(G.seedInput&&!O){if(!X.custody)c();if(!(await O6("state",J.roster)).data)c();let v=await h6(J.roster);if(!v)c();XP(v,G.seedInput),O=FJ(G.seedInput)}if(x6(await nZ(J))!==x6(WJ(J,G.projection,D,O)))c();await S0(G.routing),N??=U9(G);let C=oV(D,_);K=await IT(J,{expectedHostAuth:Y5(X,G.auth),expectedRouting:mQ(N),preparedProof:C},{...q,assertOwned:async()=>{await R0(G),await S0(G.routing);let w=await j0(W);r4(C,w,await H9(J,W,w)),await X.processFence(),await U()}})}r4(K.preparedProof,D,_);let T=K,M=async()=>{await N9(X,G),await R0(G),D=await j0(W),_=await H9(J,W,D),r4(T.preparedProof,D,_),await X.processFence(),await U()};return await p6(X.routingDestinationPath,{name:"write",ttlMs:30000,timeoutMs:15000,renew:!0},async(L)=>{let C=await O6("routing",X.routingDestinationPath);if(z0(C),C.digest!==T.expectedRouting){if(T.phase!=="verified"||(T.kind==="legacy-import"?C.digest!==G.routingDestination?.digest:G.routingSourcePath!==G.routingDestinationPath?C.digest!==null:C.digest!==T.sources.routing))c();if(await S0(G.routing),N??=U9(G),mQ(N)!==T.expectedRouting||!N)c();await H("before:routing"),await $1(X.routingDestinationPath,JSON.parse(N),{beforeRename:async()=>{await S0(C),await M(),await L.assertOwned()}}),await H("after:routing")}let w=await O6("hostAuth",X.hostAuthPath);z0(w);let v=d6(X.host,w.data);if(v.digest!==T.sources.hostAuth&&v.digest!==T.expectedHostAuth)c();if(T.phase==="activation-installed"&&v.digest!==T.expectedHostAuth)c();if(await H("before:host"),await M(),await VC(HC(X.hostAuthPath),{recursive:!0,mode:448}),v.digest!==T.expectedHostAuth)await $5({host:X.host,authPath:X.hostAuthPath,sourceDigest:T.sources.hostAuth,expectedDigest:T.expectedHostAuth,env:X.env,removePiAnthropicAuth:X.removePiAnthropicAuth,processFence:async()=>{await M(),await L.assertOwned()}},Z.hostWrite);await H("after:host"),await M();let h=await O6("hostAuth",X.hostAuthPath);if(d6(X.host,h.data).digest!==T.expectedHostAuth)c();if((await O6("routing",X.routingDestinationPath)).digest!==T.expectedRouting)c();let p={...q,assertOwned:async()=>{await M();let R=await O6("hostAuth",X.hostAuthPath),j=await O6("routing",X.routingDestinationPath);if(d6(X.host,R.data).digest!==T.expectedHostAuth||j.digest!==T.expectedRouting)c();await L.assertOwned()}};if(K?.phase==="verified")K=await sZ(J,"verified","activation-installed",p);K=await sZ(J,"activation-installed","committed",p)}),K}),await hQ(X,K,z,Z)})}catch(Y){if(Y instanceof m6)c(Y.code==="unsafe-source"?"unsafe-source":"invalid-source");if(Y instanceof cX)c();if(Y instanceof uX||Y instanceof JY)throw Y;if(Y instanceof Error&&Y.name==="LockContentionError")c("migration-busy");throw Y}finally{if(X.preflight)I7.delete(X.preflight)}}var Yk=d6("opencode",{anthropic:b7("anthropic")}).digest;async function zk($,Z){try{if($!=="opencode"&&$!=="pi")throw new k0("invalid-source");let J=await O6("hostAuth",Z);if(J.metadata){let X=typeof process.getuid==="function"?process.getuid():void 0;if(X!==void 0&&J.metadata.uid!==X||(J.metadata.mode&63)!==0)throw new k0("invalid-source")}return d6($,J.data).kind}catch{throw new k0("invalid-source")}}var UC=Object.freeze(["Accounts","Quota","Routing","Limits","Cache","Diagnostics","Extras"]),G6={kind:"action",destructive:!1,interactive:!1},x1={id:"id",kind:"account-id",required:!0},lQ={id:"label",kind:"text",required:!1,protectedEntry:!1};function NC($){for(let Z of $.parameters){if(Z.kind==="choice")Object.freeze(Z.choices);if(Z.kind==="limit-entries")Object.freeze(Z.fields);Object.freeze(Z)}if(Object.freeze($.parameters),$.kind==="setup-guidance")Object.freeze($.setupInstructions);return Object.freeze($)}var wJ=Object.freeze([{...G6,id:"enable",command:"account",group:"Accounts",label:"Enable account",parameters:[x1]},{...G6,id:"disable",command:"account",group:"Accounts",label:"Disable account",parameters:[x1]},{...G6,id:"remove",command:"account",group:"Accounts",label:"Remove account",parameters:[x1],destructive:!0,confirm:"Remove the selected account from this host?"},{...G6,id:"move-up",command:"account",group:"Accounts",label:"Move account up",parameters:[x1]},{...G6,id:"move-down",command:"account",group:"Accounts",label:"Move account down",parameters:[x1]},{...G6,id:"reset-backoff",command:"account",group:"Accounts",label:"Reset account backoff",parameters:[]},{...G6,id:"enrollment-reset",command:"account",group:"Accounts",label:"Reset host enrollment",parameters:[],destructive:!0,confirm:"Clear denied or blocked enrollment state for this host?"},{...G6,id:"add-apikey",command:"account",group:"Accounts",label:"Add API-key fallback",interactive:!0,headlessRefusal:"interactive-required",parameters:[{id:"apiKey",kind:"text",required:!0,protectedEntry:!0},lQ,{id:"baseURL",kind:"text",required:!1,protectedEntry:!1},{id:"authHeader",kind:"choice",required:!1,choices:["authorization-bearer","x-api-key"]}]},{...G6,id:"add-oauth-start",command:"account",group:"Accounts",label:"Start OAuth sign-in",parameters:[],interactive:!0,headlessRefusal:"interactive-required"},{...G6,id:"add-oauth-finish",command:"account",group:"Accounts",label:"Finish OAuth sign-in",parameters:[{id:"code",kind:"text",required:!0,protectedEntry:!0},lQ],interactive:!0,headlessRefusal:"interactive-required"},{id:"custody-mode",kind:"setup-guidance",command:"account",group:"Accounts",label:"Custody setup guidance",destructive:!1,interactive:!0,headlessRefusal:"offline-required",offlineRequired:!0,parameters:[{id:"mode",kind:"choice",required:!0,choices:["local","claustrum"]}],setupInstructions:["Stop all selected hosts before changing credential authority.","Use the explicit offline setup flow for the selected local or claustrum mode.","This menu only provides guidance; it does not change settings, propose enrollment, or report setup success."]},{id:"vault-disconnect",kind:"vault-disconnect",command:"account",group:"Accounts",label:"Disconnect from the vault",destructive:!0,confirm:"Disconnect this host from the vault and return to local accounts? The vault keeps this host's enrollment approved until an operator revokes it there.",interactive:!0,headlessRefusal:"interactive-required",parameters:[]},{...G6,id:"quota-refresh",command:"quota",group:"Quota",label:"Refresh quota",parameters:[]},{...G6,id:"routing-mode",command:"routing",group:"Routing",label:"Routing mode",parameters:[{id:"mode",kind:"choice",required:!0,choices:["main-first","fallback-first","sticky-balanced"]}]},{...G6,id:"routing-reset",command:"routing",group:"Routing",label:"Reset routing session",parameters:[]},{...G6,id:"killswitch-on",command:"killswitch",group:"Limits",label:"Enable killswitch",parameters:[]},{...G6,id:"killswitch-off",command:"killswitch",group:"Limits",label:"Disable killswitch",parameters:[]},{...G6,id:"killswitch-set",command:"killswitch",group:"Limits",label:"Set killswitch thresholds",parameters:[{id:"entries",kind:"limit-entries",required:!0,fields:["account","fh","sd","scoped?"]}]},{...G6,id:"cache-on",command:"cache",group:"Cache",label:"Enable cache",parameters:[]},{...G6,id:"cache-off",command:"cache",group:"Cache",label:"Disable cache",parameters:[]},{...G6,id:"cache-mode",command:"cache",group:"Cache",label:"Cache mode",parameters:[{id:"mode",kind:"choice",required:!0,choices:["explicit","automatic","hybrid"]}]},{...G6,id:"cachekeep-always",command:"cachekeep",group:"Cache",label:"Keep cache warm always",parameters:[]},{...G6,id:"cachekeep-off",command:"cachekeep",group:"Cache",label:"Disable cache keep",parameters:[]},{...G6,id:"cachekeep-window",command:"cachekeep",group:"Cache",label:"Cache keep window",parameters:[{id:"startHour",kind:"number",required:!0},{id:"endHour",kind:"number",required:!0}]},{...G6,id:"cachekeep-subagents",command:"cachekeep",group:"Cache",label:"Cache keep for subagents",parameters:[{id:"enabled",kind:"choice",required:!0,choices:["on","off"]}]},{...G6,id:"dump-on",command:"dump",group:"Diagnostics",label:"Enable request dumps",parameters:[]},{...G6,id:"dump-off",command:"dump",group:"Diagnostics",label:"Disable request dumps",parameters:[]},{...G6,id:"logging-level",command:"logging",group:"Diagnostics",label:"Logging level",parameters:[{id:"level",kind:"choice",required:!0,choices:["error","warn","info","debug","trace"]}]},{...G6,id:"fast-on",command:"fast",group:"Extras",label:"Enable fast mode",parameters:[]},{...G6,id:"fast-off",command:"fast",group:"Extras",label:"Disable fast mode",parameters:[]},{...G6,id:"prime-on",command:"prime",group:"Extras",label:"Enable Prime",parameters:[]},{...G6,id:"prime-off",command:"prime",group:"Extras",label:"Disable Prime",parameters:[]},{...G6,id:"start-fire",command:"start",group:"Extras",label:"Fire lane start",parameters:[]}].map(NC)),LC=Object.freeze([{kind:"status",id:"account-status",command:"account",group:"Accounts",label:"Account status and usage"},{kind:"status",id:"quota-status",command:"quota",group:"Quota",label:"Quota summary"},{kind:"status",id:"routing-status",command:"routing",group:"Routing",label:"Routing status"},{kind:"status",id:"killswitch-status",command:"killswitch",group:"Limits",label:"Killswitch status"},{kind:"status",id:"cache-status",command:"cache",group:"Cache",label:"Cache status"},{kind:"status",id:"cachekeep-status",command:"cachekeep",group:"Cache",label:"Cache keep status"},{kind:"status",id:"dump-status",command:"dump",group:"Diagnostics",label:"Dump status"},{kind:"status",id:"logging-status",command:"logging",group:"Diagnostics",label:"Logging status"},{kind:"status",id:"fast-status",command:"fast",group:"Extras",label:"Fast mode status"},{kind:"status",id:"prime-status",command:"prime",group:"Extras",label:"Prime quota window status"}].map(($)=>Object.freeze($))),qC=Object.freeze(["remove","move-up","move-down","enrollment-reset","add-apikey","add-oauth-start","add-oauth-finish","custody-mode"]),OC=new Set(qC);function XY($){return OC.has($)}var DC=Object.freeze(["vault-disconnect"]),_C=new Set(DC);function z5($){return _C.has($)}function MC($,Z){return $==="local"?!z5(Z):!XY(Z)}function kJ($,Z){return $==="opencode"||!["quota","killswitch","prime","start"].includes(Z.command)}function xZ($,Z){return Object.freeze({host:$,groups:Object.freeze(UC.map((J)=>Object.freeze({id:J,actions:Object.freeze(wJ.filter((X)=>X.group===J&&kJ($,X)&&MC(Z,X.id))),statuses:Object.freeze(LC.filter((X)=>X.group===J&&($==="opencode"||X.command!=="killswitch")))})))})}var jC=Object.freeze({opencode:Object.freeze({local:xZ("opencode","local"),claustrum:xZ("opencode","claustrum")}),pi:Object.freeze({local:xZ("pi","local"),claustrum:xZ("pi","claustrum")})}),RC=Object.freeze({opencode:Object.freeze(wJ.filter(($)=>kJ("opencode",$))),pi:Object.freeze(wJ.filter(($)=>kJ("pi",$)))});function G5($){return RC[$]}function TC($,Z){return jC[$][Z]}var PC=new Set(["routing-reset","start-fire","add-oauth-start","add-oauth-finish"]),CC=new Set(["opencode","pi"]),E7=Object.getOwnPropertyDescriptor(AbortSignal.prototype,"aborted")?.get;function o6($,Z,J){return Object.freeze({status:"refused",code:$,...Z!==void 0?{action:Z}:{},...J!==void 0?{parameter:J}:{}})}function t8($,Z){if($===null||typeof $!=="object")return"malformed";if(r8.isProxy($))return"malformed";let J=Object.getPrototypeOf($);if(J!==Object.prototype&&J!==null)return"malformed";let X=new Map,Y=!1;for(let z of Reflect.ownKeys($)){if(typeof z!=="string")return"malformed";let G=Reflect.getOwnPropertyDescriptor($,z);if(!G||!Object.hasOwn(G,"value"))return"malformed";if(!Z.includes(z))Y=!0;else X.set(z,G.value)}return Y?"unknown-key":X}function FC($){if($===null||typeof $!=="object")return;if(r8.isProxy($))return;if(!Array.isArray($))return;if(Object.getPrototypeOf($)!==Array.prototype)return;let J=Reflect.getOwnPropertyDescriptor($,"length")?.value;if(typeof J!=="number")return;if(Reflect.ownKeys($).length!==J+1)return;let Y=[];for(let z=0;z<J;z++){let G=Reflect.getOwnPropertyDescriptor($,String(z));if(!G||!Object.hasOwn(G,"value"))return;Y.push(G.value)}return Y}function w7($){return/\S/.test($)}function oZ($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0&&!Object.is($,-0)}function xC($){return oZ($)&&$<=23}function AC($){try{let Z=new URL($.trim());return(Z.protocol==="http:"||Z.protocol==="https:")&&!Z.username&&!Z.password}catch{return!1}}function SC($){return typeof $==="string"&&w7($)}var IC=["account","fh","sd","scoped"];function EC($){let Z=FC($);if(!Z||Z.length===0)return;let J=[];for(let X of Z){let Y=t8(X,IC);if(!(Y instanceof Map))return;let z=Y.get("account"),G=Y.get("fh"),Q=Y.get("sd"),K=Y.get("scoped");if(!SC(z))return;if(!oZ(G)||!oZ(Q))return;if(K!==void 0&&!oZ(K))return;J.push(Object.freeze(K===void 0?{account:z,fh:G,sd:Q}:{account:z,fh:G,sd:Q,scoped:K}))}return Object.freeze(J)}var i0={ok:!1,code:"missing-parameter"},T0={ok:!1,code:"invalid-parameter"},L9={ok:!0,present:!1};function A1($){return{ok:!0,present:!0,value:$}}function wC($,Z,J){let X=!Z||J===void 0||J===null;switch($.kind){case"account-id":if(X)return i0;if(typeof J!=="string")return T0;return w7(J)?A1(J):i0;case"text":{if(X)return $.required?i0:L9;if(typeof J!=="string")return T0;if(!w7(J))return $.required?i0:L9;if($.id==="apiKey"&&/\s/.test(J))return T0;if($.id==="baseURL"&&!AC(J))return T0;return A1(J)}case"choice":if(X)return $.required?i0:L9;if(typeof J!=="string")return T0;return $.choices.includes(J)?A1(J):T0;case"number":if(X)return i0;return xC(J)?A1(J):T0;case"limit-entries":{if(X)return i0;let Y=EC(J);return Y?A1(Y):T0}default:return $}}function kC($){if($===null||typeof $!=="object")return"malformed";if(r8.isProxy($)||!E7)return"malformed";try{Reflect.apply(E7,$,[])}catch{return"malformed"}return $}function bC($){return $!==void 0&&E7!==void 0?Reflect.apply(E7,$,[])===!0:!1}var fC=["interactive","custodyMode","confirmed","sessionId","signal"];function vC($){let Z=t8($,fC);if(!(Z instanceof Map))return;let J=Z.get("interactive"),X=Z.get("custodyMode"),Y=Z.get("confirmed"),z=Z.get("sessionId"),G=Z.get("signal");if(typeof J!=="boolean")return;if(X!=="local"&&X!=="claustrum")return;if(Y!==void 0&&typeof Y!=="boolean")return;if(z!==void 0&&typeof z!=="string")return;let Q;if(G!==void 0){let K=kC(G);if(K==="malformed")return;Q=K}return{interactive:J,custodyMode:X,confirmed:Y===!0,...z!==void 0&&w7(z)?{sessionId:z}:{},...Q!==void 0?{signal:Q}:{}}}function n6($){return{kind:"done",result:$}}function yC($,Z,J){let X=t8(Z,["action","values"]);if(!(X instanceof Map))return n6(o6("invalid-request"));let Y=X.get("action");if(typeof Y!=="string")return n6(o6("invalid-request"));let z=$.get(Y);if(!z)return n6(o6("unsupported-action"));let G=vC(J);if(!G)return n6(o6("invalid-context",z.id));if(G.custodyMode==="claustrum"&&XY(z.id))return n6(o6("vault-managed",z.id));if(G.custodyMode==="local"&&z5(z.id))return n6(o6("vault-not-connected",z.id));if(z.interactive&&!G.interactive)return n6(o6(z.headlessRefusal,z.id));let Q=X.get("values"),K=z.parameters.map((N)=>N.id),W=Q===void 0?new Map:t8(Q,K);if(W==="malformed")return n6(o6("invalid-request",z.id));if(W==="unknown-key")return n6(o6("unknown-parameter",z.id));let V={};for(let N of z.parameters){let O=wC(N,W.has(N.id),W.get(N.id));if(!O.ok)return n6(o6(O.code,z.id,N.id));if(O.present)V[N.id]=O.value}if(z.id==="cachekeep-window"&&V.startHour===V.endHour)return n6(o6("invalid-parameter",z.id,"endHour"));if(z.destructive&&!G.confirmed)return n6(o6("confirmation-required",z.id));let B=PC.has(z.id);if(B&&G.sessionId===void 0)return n6(o6("session-required",z.id));if(bC(G.signal))return n6(o6("aborted",z.id));if(z.kind==="setup-guidance")return n6(Object.freeze({status:"guidance",action:z.id,mode:V.mode,instructions:z.setupInstructions}));let H=Object.freeze(G.signal!==void 0?{signal:G.signal}:{});if(z.kind==="vault-disconnect")return{kind:"disconnect",options:H};let q=Object.freeze({action:z.id,values:Object.freeze(V),...B?{sessionId:G.sessionId}:{}});return{kind:"dispatch",action:z.id,request:q,options:H}}var gC=new Set(["disconnected","idle","busy","conflict"]);function mC($,Z){let J=t8(Z,["ok","text"]),X=J instanceof Map?J.get("ok"):void 0,Y=J instanceof Map?J.get("text"):void 0;if(typeof X!=="boolean"||typeof Y!=="string")return Object.freeze({status:"failed",action:$,code:"invalid-outcome"});return Object.freeze({status:"executed",action:$,ok:X,text:Y})}function q9($){return TypeError(`Native menu executor option ${$} is invalid`)}function hC($){if(!$||typeof $!=="object"||r8.isProxy($))return"execution-failed";let Z=(X)=>{let Y=Object.getOwnPropertyDescriptor($,X);return Y&&"value"in Y?Y.value:void 0},J=Z("name");if(J==="ClaustrumConsumerError"){let X=Z("kind");if(X==="unsafe-file")return"disconnect-unsafe-file";if(X==="wrong-consumer")return"disconnect-wrong-consumer"}if(J==="PiSlotError")switch(Z("code")){case"unsafe-path":return"disconnect-unsafe-file";case"invalid-auth":case"invalid-stash":case"missing-stash":return"disconnect-pi-recovery";case"conflict":return"disconnect-conflict";case"lock-timeout":case"lock-compromised":return"disconnect-busy";case"io":return"disconnect-io"}return"execution-failed"}function pC($){let Z=t8($,["host","dispatch","disconnectVault"]);if(!(Z instanceof Map))throw TypeError("Native menu executor options are invalid");let J=Z.get("host"),X=Z.get("dispatch"),Y=Z.get("disconnectVault");if(!CC.has(J))throw q9("host");if(typeof X!=="function"||r8.isProxy(X))throw q9("dispatch");if(Y!==void 0&&(typeof Y!=="function"||r8.isProxy(Y)))throw q9("disconnectVault");let z=new Map;for(let K of G5(J))if(K.kind!=="vault-disconnect"||Y!==void 0)z.set(K.id,K);let G=async(K)=>{let W;try{W=await Reflect.apply(Y,void 0,[K])}catch(V){return Object.freeze({status:"failed",action:"vault-disconnect",code:hC(V)})}if(!gC.has(W))return Object.freeze({status:"failed",action:"vault-disconnect",code:"invalid-outcome"});return Object.freeze({status:"disconnect",action:"vault-disconnect",result:W})};return Object.freeze({execute:Object.freeze(async(K,W)=>{let V;try{V=yC(z,K,W)}catch{return o6("invalid-request")}if(V.kind==="done")return V.result;if(V.kind==="disconnect")return G(V.options);let B;try{B=await Reflect.apply(X,void 0,[V.request,V.options])}catch{return Object.freeze({status:"failed",action:V.action,code:"execution-failed"})}return mC(V.action,B)})})}function Q5($){return $&&typeof $==="object"&&!Array.isArray($)?$:{}}function Qk($,Z,J){return{...$,[Z]:{...Q5($[Z]),...J}}}function Kk($){let{startHour:Z,endHour:J,...X}=Q5($.cacheKeep);return{...$,cacheKeep:{...X,enabled:!0,always:!0}}}var lC=[/\b[\w-]*(?:secret|token|password|passwd|api[_-]?key|authorization|verifier)["']?\s*[:=]\s*["']?(?:(?:Bearer|Basic)\s+)?[^\s"'&,;}]+/gi,/\b[0-9a-fA-F]{32,}\b/g];function uC($={}){let{redactStrings:Z}=y1({...$,extraValuePatterns:[...lC,...$.extraValuePatterns??[]]});return(J)=>Z(J)}function dC($){return $===null||typeof $==="string"||typeof $==="boolean"||typeof $==="number"&&Number.isFinite($)}function cC($){if($===null||typeof $!=="object"||Array.isArray($))return;let Z=$;if(typeof Z.command!=="string"||typeof Z.sectionId!=="string"||typeof Z.actionId!=="string")return;if(Z.itemId!==void 0&&typeof Z.itemId!=="string")return;if(Z.sessionId!==void 0&&typeof Z.sessionId!=="string")return;if(Z.confirmed!==void 0&&typeof Z.confirmed!=="boolean")return;let J={};if(Z.values!==void 0){if(Z.values===null||typeof Z.values!=="object"||Array.isArray(Z.values))return;for(let[X,Y]of Object.entries(Z.values)){if(!dC(Y))return;Object.defineProperty(J,X,{value:Y,enumerable:!0,writable:!0,configurable:!0})}}return{command:Z.command,sectionId:Z.sectionId,actionId:Z.actionId,...typeof Z.itemId==="string"?{itemId:Z.itemId}:{},...Z.values!==void 0?{values:J}:{},...Z.confirmed===!0?{confirmed:!0}:{},...typeof Z.sessionId==="string"?{sessionId:Z.sessionId}:{}}}var W5="Accounts are managed in the vault. Disconnect from the vault to use local accounts.",uQ="Account custody could not be read, so local account changes are unavailable.",iC={Accounts:"accounts",Quota:"quota",Routing:"routing",Limits:"limits",Cache:"cache",Diagnostics:"diagnostics",Extras:"extra"};function dQ($,Z){if($===null||typeof $!=="object"||K5.isProxy($))return;try{let J=Object.getOwnPropertyDescriptor($,Z);return J&&"value"in J?J.value:void 0}catch{return}}function cQ($){if($===null||typeof $!=="object"||K5.isProxy($))return!1;try{if(Array.isArray($))return!1;let Z=Object.getPrototypeOf($);if(Z!==Object.prototype&&Z!==null)return!1;return Reflect.ownKeys($).every((J)=>{let X=Object.getOwnPropertyDescriptor($,J);return X!==void 0&&"value"in X})}catch{return!1}}function sC($){switch($.kind){case"choice":return{kind:"choice",id:$.id,label:$.id,choices:[...!$.required?[{value:"",label:"Default"}]:[],...$.choices.map((Z)=>({value:Z,label:Z}))]};case"number":return{kind:"number",id:$.id,label:$.id,required:!0,min:0,max:23};case"account-id":return{kind:"text",id:$.id,label:"Account ID (copy the complete ID from status)",required:!0};case"text":return{kind:"text",id:$.id,label:$.id,required:$.required,masked:$.protectedEntry};case"limit-entries":return{kind:"text",id:$.id,label:"Threshold rows as JSON: account, fh, sd, optional scoped",required:!0,placeholder:'[{"account":"main","fh":5,"sd":10,"scoped":0}]'}}}var V5={code:"true",client_id:f7,response_type:"code",redirect_uri:I9,scope:cK.join(" "),code_challenge_method:"S256"},iQ=[...Object.keys(V5),"code_challenge","state"],aC=new Set(Object.values(lK)),nC=/^[A-Za-z0-9_-]{43}$/,oC=/^[0-9a-f]{32}$/;function rC($){let Z;try{Z=new URL($)}catch{return!1}if(Z.href!==$||$.includes("#")||Z.username!==""||Z.password!==""||!aC.has(`${Z.origin}${Z.pathname}`))return!1;let J=[...Z.searchParams.keys()];if(J.length!==iQ.length||!iQ.every((X)=>J.includes(X)))return!1;return Object.entries(V5).every(([X,Y])=>Z.searchParams.get(X)===Y)&&nC.test(Z.searchParams.get("code_challenge")??"")&&oC.test(Z.searchParams.get("state")??"")}function tC($,Z){let J=new Set(($.match(/https:\/\/\S+/g)??[]).filter(rC)),[X]=J;if(J.size!==1||X===void 0)return Z($);return $.split(X).map(Z).join(X)}var eC={disconnected:{ok:!0,text:"Disconnected from the vault. This host uses local accounts again."},idle:{ok:!0,text:"This host has no active vault enrollment."},busy:{ok:!1,code:"busy",text:"Vault disconnect could not finish because another process is changing this host's enrollment. Try again."},conflict:{ok:!1,code:"conflict",text:"Disconnect stopped: this host already has a different stored sign-in, so it and the sign-in saved when the host joined the vault were both kept, and the vault connection remains. Resolve the two sign-ins with offline setup."}},$F={"disconnect-unsafe-file":"Check file ownership, private permissions, and safe storage. Then try Disconnect again. Do not delete enrollment files by hand.","disconnect-wrong-consumer":"The enrollment belongs to another host or plugin. Check this host’s enrollment path. Then try Disconnect again. Do not delete another host’s enrollment.","disconnect-pi-recovery":"Repair the Pi sign-in and its private recovery copy with offline setup. Keep both files. Then try Disconnect again.","disconnect-conflict":"Resolve the stored Pi sign-in and its private recovery copy with offline setup. Keep both sign-ins. Then try Disconnect again.","disconnect-busy":"Stop other setup or disconnect attempts. Then try Disconnect again.","disconnect-io":"Check file access and free disk space. Then try Disconnect again.","execution-failed":"Check this host’s vault connection and file access. Then try Disconnect again.","invalid-outcome":"Check this host’s vault connection and file access. Then try Disconnect again."};function ZF($,Z){switch($.status){case"executed":return{ok:$.ok,text:$.text,...!$.ok?{code:"refused"}:{}};case"guidance":return{ok:!0,text:`Offline ${$.mode} setup guidance (nothing changed):
-${$.instructions.join(`
-`)}`};case"disconnect":return eC[$.result];case"failed":if($.action==="vault-disconnect")return{ok:!1,code:$.code,text:`${Z==="opencode"?"OpenCode":"Pi"} could not disconnect from the vault. ${$F[$.code]}`};return{ok:!1,code:$.code,text:"Action failed."};case"refused":if($.code==="vault-managed")return{ok:!1,code:$.code,text:`Action refused: ${W5}`};if($.code==="vault-not-connected")return{ok:!1,code:$.code,text:"Action refused: this host is not connected to the vault."};return{ok:!1,code:$.code,text:`Action refused: ${$.code}${$.parameter?` (${$.parameter})`:""}.`,...$.code==="confirmation-required"?{needsConfirmation:!0}:{}}}}function Vk($){let{host:Z,dispatch:J,readStatus:X,readMode:Y,disconnectVault:z,interactive:G}=$;if(typeof Y!=="function")throw TypeError("Native UI requires a custody mode reader");if(typeof z!=="function")throw TypeError("Native UI requires a vault disconnect callback");let Q=G5(Z),K=pC({host:Z,dispatch:J,disconnectVault:z}),W=new Set(Q.flatMap((N)=>N.parameters.flatMap((O)=>O.kind==="text"&&O.protectedEntry?[O.id]:[]))),V=uC({extraValuePatterns:[/sk-ant-[A-Za-z0-9_-]+/g]});function B(N,O=V){let{sessionId:U,notify:D}=N;return{...U!==void 0?{sessionId:U}:{},notify:(_,T)=>D(O(_),T)}}async function H(){try{let N=await Y();return N==="local"||N==="claustrum"?N:void 0}catch{return}}async function q(N,O=V,U=!0){let D=B(N,O),_=await H(),T=TC(Z,_??"claustrum"),M=[];for(let L of T.groups){let C=[];if(L.id==="Accounts"&&_==="local")try{if(await $.readSeparateHostLoginNotice?.()===!0)C.push("OpenCode's separate Anthropic login is not used. Add that account through /claude Accounts if needed, or remove the separate login from OpenCode.")}catch{}if(L.id==="Accounts"&&_!=="local")C.push(_==="claustrum"?W5:uQ);if(L.id==="Accounts"&&_==="claustrum"&&$.readAccounts)try{let w=await $.readAccounts();for(let v of w.accounts)if(v.source==="vault"&&v.state==="needs_reauth"&&v.credentialId)C.push(O(`${v.label||v.id} (${v.credentialId}) needs signing in again. Run: ck auth login --provider anthropic --id ${v.credentialId} --replace`))}catch{C.push("Vault sign-in status unavailable; reopen /claude to retry.")}for(let w of L.statuses){if(!U){C.push(`${w.label}: status unavailable.`);continue}try{C.push(O(await X(w.command,D)))}catch{C.push(`${w.label}: status unavailable.`)}}M.push({id:L.id,slot:iC[L.id],title:L.id,lines:C,items:[],actions:L.actions.map((w)=>({id:w.id,label:w.label,knobs:w.parameters.map(sC),...w.destructive?{confirm:{message:w.confirm,irreversible:w.kind!=="vault-disconnect"}}:{},...w.kind==="setup-guidance"?{description:"Offline guidance only; no settings are changed."}:{}}))})}return{command:"claude",title:"Claude",sections:M}}return{command:"claude",async open(N){return{command:"claude",menu:await q(B(N))}},async apply(N,O){let U=B(O),D,_=dQ(N,"values"),T=cQ(N)&&(_===void 0||cQ(_));try{D=T?cC(N):void 0}catch{D=void 0}let M=Q.find((p)=>p.id===D?.actionId&&p.group===D?.sectionId),L={...D?.values},C=[];for(let p of W)for(let R of[L,_]){let j=dQ(R,p);if(typeof j==="string"&&j.length>0)C.push(j)}let w=(p)=>{let R=p;for(let j of C)R=R.split(j).join("[REDACTED]");return V(R)},v=async(p,R=!1)=>({command:"claude",...p,text:R?tC(p.text,w):w(p.text),menu:await q(U,w,T)});if(D?.command!=="claude"||!M||D.itemId!==void 0||D.sessionId!==void 0&&D.sessionId!==U.sessionId)return v({ok:!1,code:"invalid-request",text:"Invalid menu request."});for(let p of M.parameters){if(p.kind==="choice"&&!p.required&&L[p.id]==="")L[p.id]=null;if(p.kind==="limit-entries"&&typeof L[p.id]==="string")try{let R=JSON.parse(String(L[p.id]));L[p.id]=R}catch{return v({ok:!1,code:"invalid-parameter",text:"Threshold rows must be valid JSON."})}}let h=await H();if(h===void 0&&XY(M.id))return v({ok:!1,code:"custody-unavailable",text:`Action refused: ${uQ}`});let a=await K.execute({action:M.id,values:L},{interactive:G,custodyMode:h??"claustrum",confirmed:D.confirmed,sessionId:U.sessionId});return v(ZF(a,Z),a.status==="executed"&&a.action==="add-oauth-start"&&a.ok&&C.length===0)}}}var JF="No vault account can serve this request. Open /claude to see which account needs signing in again.";class bJ extends Error{constructor(){super(JF);this.name="NativeVaultNoAccountError"}}var O9=new WeakMap;function B5($){return $.accounts.some((Z)=>Z.source==="vault"&&Z.type==="oauth"&&_6(Z))}async function Bk($,Z){Z?.throwIfAborted();let J=await $.read();if(Z?.throwIfAborted(),J.mode!=="claustrum")return J;let X=Boolean((await $.vault.read())?.view);if(Z?.throwIfAborted(),X&&B5(J))return J;let Y=O9.get($);if(!Y)Y=XF($,X).finally(()=>O9.delete($)),O9.set($,Y);return YF(Y,Z)}async function XF($,Z){let J=new AbortController,X=setTimeout(()=>J.abort(),2000),Y=J.signal;try{while(!Y.aborted){let z;try{z=await $.vault.refresh(Y)}catch{if(Z||Y.aborted)break}if(z?.view){let G=await $.read();if(G.mode!=="claustrum"||B5(G))return G;throw new bJ}if(Z)break;if(Y.aborted)break;await new Promise((G)=>{let Q=()=>{clearTimeout(K),Y.removeEventListener("abort",Q),G()},K=setTimeout(Q,25);if(Y.addEventListener("abort",Q,{once:!0}),Y.aborted)Q()})}throw new bJ}finally{clearTimeout(X)}}function YF($,Z){if(!Z)return $;return new Promise((J,X)=>{let Y=()=>X(Z.reason);if(Z.addEventListener("abort",Y,{once:!0}),$.then(J,X).finally(()=>Z.removeEventListener("abort",Y)),Z.aborted)Y()})}var KF="common-auth-placeholder";function WF($){return`${KF}.${$}`}var DF=30000,rZ=1e4,_F=3000,vJ,b1=new Map;process.once("exit",()=>{for(let[$,Z]of b1)try{if(Z.renewedAt+rZ<Date.now())continue;let J=N5($);if(yJ(J,Z)&&J.mtime.getTime()===Z.mtime)UF($)}catch{}});function yJ($,Z){return $.dev===Z.dev&&$.ino===Z.ino}function L2($){return typeof $==="object"&&$!==null&&"code"in $?$.code:void 0}function oQ(){return Object.assign(Error("Pi auth lock held"),{code:"ELOCKED"})}async function gJ($){try{await qF($)}catch(Z){if(L2(Z)!=="ENOENT")throw Z}}async function mJ($,Z){try{await LF($)}catch(J){if(L2(J)!=="EEXIST")throw J;if(Z<=0)throw oQ();let X;try{X=(await fJ($)).mtime.getTime()}catch(Y){if(L2(Y)==="ENOENT")return mJ($,0);throw Y}if(!(X<Date.now()-Z))throw oQ();return await gJ($),mJ($,0)}try{if(!vJ){let Y=new Date(Math.ceil(Date.now()/1000)*1000+5);await OF($,Y,Y)}let J=await fJ($),X=J.mtime.getTime();return vJ??=X%1000===0?"s":"ms",{dev:J.dev,ino:J.ino,mtime:X}}catch(J){throw await gJ($).catch(()=>{}),J}}async function MF($,Z,J){let X=`${$}.lock`,Y=await mJ(X,DF),z=Y.mtime,G=Date.now(),Q=!1,K;b1.set(X,{...Y,renewedAt:G});function W(){if(Q=!0,K)clearTimeout(K);b1.delete(X),Z()}function V(){if(!Q&&G+rZ<Date.now())W()}function B(N=_F){if(Q)return;K=setTimeout(()=>{q()},N),K.unref()}function H(N){if(Q)return;if(L2(N)==="ENOENT"||G+rZ<Date.now())W();else B(1000)}async function q(){if(V(),Q)return;let N;try{N=N5(X)}catch(U){H(U);return}if(V(),Q)return;if(!yJ(N,Y)||N.mtime.getTime()!==z){W();return}let O=new Date(vJ==="s"?Math.ceil(Date.now()/1000)*1000:Date.now());try{NF(X,O,O)}catch(U){H(U);return}if(V(),Q)return;z=O.getTime(),G=Date.now(),b1.set(X,{...Y,mtime:z,renewedAt:G}),B()}return J?.(async()=>{if(K)clearTimeout(K);await q()}),B(),{assertFresh:V,async release(){if(Q)return;if(Q=!0,K)clearTimeout(K);b1.delete(X);let N=()=>G+rZ<Date.now();if(N()){W();return}let O;try{O=await fJ(X)}catch(U){if(L2(U)!=="ENOENT")throw U;W();return}if(N()||!yJ(O,Y)||z!==O.mtime.getTime()){W();return}await gJ(X)}}}class C6 extends Error{code;constructor($){super(`Pi slot: ${$}`);this.code=$,this.name="PiSlotError"}}function jF($){let Z=$.indexOf("{")+1,J={offset:Z-1,children:[]},X=()=>{while(/\s/.test($[Z]??"")&&Z<$.length)Z++},Y=()=>{Z++;while(Z<$.length){if($[Z++]==='"')return;if($[Z-1]==="\\")Z++}};X();while($[Z]!=="}"){let z=Z;Y();let G=JSON.parse($.slice(z,Z));X(),Z++,X();let Q=Z,K=0;while(Z<$.length){let V=$[Z];if(V==='"'){Y();continue}if(V==="{"||V==="[")K++;if(V==="}"||V==="]"){if(K===0)break;K--}if(V===","&&K===0)break;Z++}let W=Z;while(/\s/.test($[W-1]??""))W--;if(J.children.push({key:G,offset:z,length:W-z,value:{offset:Q,length:W-Q}}),X(),$[Z]==="}")break;Z++,X()}return J}function q2($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function hJ($){if(Array.isArray($))return`[${$.map(hJ).join(",")}]`;if(q2($))return`{${Object.keys($).sort().map((Z)=>`${JSON.stringify(Z)}:${hJ($[Z])}`).join(",")}}`;return JSON.stringify($)}function g$($){return VF("sha256").update(hJ($)).digest("hex")}function f1($){return q2($)?$.code:void 0}async function rQ($,Z=!1,J){if(t)try{await J?.($);let Y=await MK($,!0),z=Y.toString("utf8");if(!Y.equals(Buffer.from(z)))throw new C6(Z?"invalid-stash":"invalid-auth");return z}catch(Y){if(f1(Y)==="ENOENT")return;throw Y}let X;try{X=await U5($,sQ.O_RDONLY|sQ.O_NOFOLLOW);let Y=await X.stat();if(!Y.isFile()||Z&&(Y.mode&511)!==384)throw new C6("unsafe-path");await J?.($);let z=await H5($);if(!z.isFile()||z.dev!==Y.dev||z.ino!==Y.ino)throw new C6("unsafe-path");let G=await X.readFile(),Q=G.toString("utf8");if(!G.equals(Buffer.from(Q)))throw new C6(Z?"invalid-stash":"invalid-auth");return Q}catch(Y){if(f1(Y)==="ENOENT"&&!X)return;if(f1(Y)==="ELOOP"||f1(Y)==="ENOENT")throw new C6("unsafe-path");throw Y}finally{await X?.close()}}function RF($,Z){try{let J=JSON.parse($);if(!q2(J))throw Error();let X=jF($),Y=X.children,z=Y.map((K)=>K.key);if(new Set(z).size!==z.length)throw Error();let G=Y.find((K)=>K.key===Z),Q=G?J[Z]:null;if(Q!==null&&!q2(Q))throw Error();if(G&&Q===null)throw Error();return{text:$,root:X,property:G,entry:Q}}catch{throw new C6("invalid-auth")}}function TF($){let Z=$.property?.value;return Z?$.text.slice(Z.offset,Z.offset+Z.length):null}function tQ($,Z,J){let{text:X,root:Y,property:z}=$,G=Y.children??[];if(z){let W=z.value;if(!W)throw new C6("invalid-auth");if(J!==null)return X.slice(0,W.offset)+J+X.slice(W.offset+W.length);let V=G.indexOf(z),B=G[V-1],H=G[V+1],q=B?B.offset+B.length:z.offset,N=!B&&H?H.offset:z.offset+z.length;return X.slice(0,q)+X.slice(N)}if(J===null)return X;let Q=G.at(-1),K=Q?Q.offset+Q.length:Y.offset+1;return`${X.slice(0,K)}${Q?",":""}${JSON.stringify(Z)}:${J}${X.slice(K)}`}async function PF($){if(t)return;let Z=await U5($,"r");try{await Z.sync()}finally{await Z.close()}}async function D9($,Z,J,X){await $1($,null,{serialize:()=>Z,durable:!0,durability:t?"file-only-on-windows":void 0,beforeRename:async()=>{await X?.($),J()}})}function CF($){return FF($)}function FF($,Z,J){let{provider:X,placeholderKey:Y}=$,z=$.lockTimeoutMs??30000;if(!X||!$.authPath||!$.stashPath||!Y||Y.startsWith("!")||Y.includes("$")||!Number.isFinite(z)||z<0)throw new C6("invalid-options");let G=nQ($.authPath),Q=nQ($.stashPath);if(G===Q||Q===`${G}.lock`)throw new C6("invalid-options");let K=g$(G),W=g$(Y),V={type:"api_key",key:Y},B=(U)=>g$(U)===g$(V);async function H(){let U=await rQ(Q,!0,J?.afterReadCheck);if(U===void 0)return;try{let D=JSON.parse(U);if(D.version!==1||D.provider!==X||D.authIdentity!==K||D.placeholderIdentity!==W||D.entry!==null&&!q2(D.entry)||D.sha256!==g$(D.entry)||(D.entry===null?D.entryJson!==null:typeof D.entryJson!=="string"||g$(JSON.parse(D.entryJson))!==D.sha256))throw Error();return D}catch{throw new C6("invalid-stash")}}async function q(U){let D,_,T=!1,M=()=>{if(_?.(),T)throw new C6("lock-compromised")};try{if(t)await G0(F8(G));else await aQ(F8(G),{recursive:!0,mode:448});let L=Date.now()+z,C=0;while(!D)try{let v=await MF(G,()=>{T=!0},J?.onRenew);D=v.release,_=v.assertFresh}catch(v){if(f1(v)!=="ELOCKED")throw v;let h=L-Date.now();if(h<=0)throw new C6("lock-timeout");await HF(Math.min(Math.round(Math.min(10*2**C++,1000)*(1+Math.random())),h))}M();let w=await U(M);return M(),w}catch(L){if(L instanceof C6||L instanceof c6)throw L;throw new C6("io")}finally{await D?.().catch(()=>{}),M()}}async function N(){let U=RF(await rQ(G,!1,J?.afterReadCheck)??"{}",X),D=await H();return{auth:U,stash:D}}async function O(U){U(),await BF(Q),await PF(F8(Q)),Z?.("stash-deleted")}return{inspect:()=>q(async()=>{let{auth:U,stash:D}=await N();return{slot:B(U.entry)?"placeholder":U.entry===null?"empty":!D||g$(U.entry)===D.sha256?"original":"foreign",stash:D?"valid":"missing"}}),enterVault:()=>q(async(U)=>{let{auth:D,stash:_}=await N();if(B(D.entry)){if(!_)throw new C6("missing-stash");return}if(_&&g$(D.entry)!==_.sha256)throw new C6("conflict");if(!_){if(t)await G0(F8(Q));else{await aQ(F8(Q),{recursive:!0,mode:448});let M=await H5(F8(Q));if(!M.isDirectory()||(M.mode&511)!==448)throw new C6("unsafe-path")}let T={version:1,provider:X,authIdentity:K,placeholderIdentity:W,entry:D.entry,entryJson:TF(D),sha256:g$(D.entry)};await D9(Q,JSON.stringify(T),U,J?.beforeRename),Z?.("stash-written")}await D9(G,tQ(D,X,JSON.stringify(V)),U,J?.beforeRename),Z?.("auth-written")}),exitVault:()=>q(async(U)=>{let{auth:D,stash:_}=await N();if(!_){if(B(D.entry))throw new C6("missing-stash");return"nothing-to-do"}if(B(D.entry))await D9(G,tQ(D,X,_.entryJson),U,J?.beforeRename),Z?.("auth-written");else if(g$(D.entry)!==_.sha256)return"conflict";return await O(U),"restored"})}}function xF($){return{authPath:QF($.authPath),stashPath:GF(zF(A2("pi",$.env).tokenPath),"pi-auth-slot","anthropic.json"),provider:"anthropic",placeholderKey:WF("anthropic")}}function Mk($){return CF(xF($))}async function jk($){if($.host==="pi"&&await $.slot.exitVault()==="conflict")return"conflict";return AU(A2($.host,$.env),`anthropic-auth-${$.host}`)}var bF=60000,L5=60000,fF=21600000,vF=90000,yF=300000;function gF($){let Z=$.trim().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="on")return{type:"enable"};if(Z.length===1&&Z[0]==="off")return{type:"disable"};return{type:"usage"}}function pJ($){if(!$)return 0;return($.inputTokens*vz.input+$.outputTokens*vz.output)/1e6}function mF($,Z,J){if(J?.label?.trim())return J.label;if($==="main")return"main";let X=Z?.accounts?.find((Y)=>Y.id===$);if(X?.label?.trim())return X.label;return $}function hF($,Z){let J=Z?.transient,X=$?.quota?.mainQuota,Y=$?.prime?.main,z={id:"main",label:"main",nextDueAt:ZK(X?.five_hour),lastPrimedAt:J?.get("main")?.lastPrimedAt??null,lastResult:J?.get("main")?.lastResult,usage:Y,estimatedCostUsd:pJ(Y)},G=($?.accounts??[]).filter(W8).filter((Q)=>Q.id!=="main").filter(_6).map((Q)=>({id:Q.id,label:mF(Q.id,$,Q),nextDueAt:ZK(Q.quota?.five_hour),lastPrimedAt:J?.get(Q.id)?.lastPrimedAt??null,lastResult:J?.get(Q.id)?.lastResult,usage:Q.prime,estimatedCostUsd:pJ(Q.prime)}));return[z,...G]}function ZK($){if(!$?.resetsAt)return;let Z=Date.parse($.resetsAt);if(!Number.isFinite(Z))return;return Z+L5}function SZ($){let J=[$.enabled?"## Claude Prime Status":"## Claude Prime Disabled",""];J.push(`Status: ${$.enabled?"enabled":"disabled"}`),J.push(""),J.push("Accounts:");for(let X of $.accounts){let z=X.usage?.count??0,G=pF(X.nextDueAt),Q=lF(X.lastPrimedAt,X.lastResult),K=[`${X.label}`];if(G)K.push(`next prime ${G}`);if(Q)K.push(Q);if(z>0)K.push(`${z} ${z===1?"prime":"primes"} ≈ $${uF(X.estimatedCostUsd??0)}`);J.push(`- ${K.join(" · ")}`)}return J.push(""),J.push("Usage: `/claude-prime on`, `/claude-prime off`, or status."),J.join(`
-`)}function pF($){if(typeof $!=="number")return"";return new Date($).toLocaleTimeString([],{hour:"2-digit",minute:"2-digit"})}function lF($,Z){if(typeof $!=="number")return"";let J=new Date($).toLocaleTimeString([],{hour:"2-digit",minute:"2-digit"});if(Z==="error")return`primed ${J} err`;if(Z==="skipped")return`primed ${J} skipped`;return`primed ${J} ✓`}function uF($){if($===0)return"0";if($<0.0001)return $.toExponential(2);return $.toFixed(Math.min(6,Math.max(0,4)))}function xk($){let Z=gF($.argumentsText);if(Z.type==="status")return{text:SZ({enabled:$.enabled,accounts:$.accounts})};if(Z.type==="enable")return{text:SZ({enabled:!0,accounts:$.accounts}),updated:{enabled:!0}};if(Z.type==="disable")return{text:SZ({enabled:!1,accounts:$.accounts}),updated:{enabled:!1}};return{text:["## Claude Prime Usage","","Usage: `/claude-prime`, `/claude-prime on`, or `/claude-prime off`.","",SZ({enabled:$.enabled,accounts:$.accounts})].join(`
-`)}}var dF={"not-oauth":"API-key account",disabled:"disabled","needs-reauth":"needs re-login",killswitch:"killswitch"};function cF($){if(!$.isOAuth)return{eligible:!1,reason:"not-oauth"};if(!$.isEnabled)return{eligible:!1,reason:"disabled"};if($.hasPermanentRefreshError)return{eligible:!1,reason:"needs-reauth"};return{eligible:!0}}function JK($){return dF[$]}var iF={model:HW,max_tokens:1,system:"Reply with 1 when you receive 0.",messages:[{role:"user",content:"0"}]};function Ak(){return JSON.parse(JSON.stringify(iF))}function XK(){return K1(wF(),"opencode-anthropic-auth","prime")}function sF($){let Z=kF($),J;try{J=SF(Z)}catch(X){if(X.code!=="ENOENT")throw X;J=Z}return AF("sha256").update(J).digest("hex").slice(0,12)}function q5($,Z){return K1($,sF(Z))}function aF($,Z,J){if(!/^[a-f0-9]{12,}$/i.test(J))throw Error("Prime account fingerprint must be a hexadecimal digest");return K1(q5($,Z),J.toLowerCase().slice(0,12))}function YK($,Z,J){return K1($,`${encodeURIComponent(Z)}-${J}`)}function zK($,Z){return K1($,`${encodeURIComponent(Z)}-bootstrap`)}function _9($,Z){if($==="main")return"main";if(Z&&"label"in Z&&Z.label?.trim())return Z.label;return $}function nF($){let Z=[],J=$.refresh?.mainLastRefreshError;Z.push({id:"main",label:"main",isOAuth:!0,isEnabled:kZ($)!=="claustrum"||_6($.claustrum?.primaryAccount),hasPermanentRefreshError:X7(J),storedQuota:$.quota?.mainQuota,storedFiveHour:$.quota?.mainQuota?.five_hour});for(let X of $.accounts??[]){if(X.id==="main"){n.debug("prime","ineligible",{account:_9(X.id,X),reason:"reserved-id"});continue}if(!W8(X)){Z.push({id:X.id,label:_9(X.id,X),isOAuth:!1,isEnabled:_6(X),hasPermanentRefreshError:!1});continue}Z.push({id:X.id,label:_9(X.id,X),isOAuth:!0,isEnabled:_6(X),hasPermanentRefreshError:X7(X.lastRefreshError),storedQuota:X.quota,storedFiveHour:X.quota?.five_hour})}return Z}function GK($){if(!$?.resetsAt)return;let Z=Date.parse($.resetsAt);return Number.isFinite(Z)?Z:void 0}class oF{timer=null;setIntervalImpl;clearIntervalImpl;setTimeoutImpl;clearTimeoutImpl;postFireRefreshTimers=new Set;lastForcedCheck=new Map;stopped=!1;options;transient=new Map;counters=new Map;windowActive=new Map;constructor($){this.options=$,this.setIntervalImpl=$.setIntervalImpl??globalThis.setInterval,this.clearIntervalImpl=$.clearIntervalImpl??globalThis.clearInterval,this.setTimeoutImpl=$.setTimeoutImpl??globalThis.setTimeout,this.clearTimeoutImpl=$.clearTimeoutImpl??globalThis.clearTimeout}updateOptions($){this.options=$}start(){if(this.timer)return;if(this.stopped=!1,n.trace("prime","manager started"),this.timer=this.setIntervalImpl(()=>{this.tick().catch(()=>{n.warn("prime","tick failed")})},bF),typeof this.timer==="object"&&"unref"in this.timer)this.timer.unref?.()}stop(){let $=this.timer!==null,Z=this.postFireRefreshTimers.size>0;if(this.stopped=!0,this.timer)this.clearIntervalImpl(this.timer),this.timer=null;for(let J of this.postFireRefreshTimers)this.clearTimeoutImpl(J);if(this.postFireRefreshTimers.clear(),this.lastForcedCheck.clear(),!$&&!Z)return;n.trace("prime","manager stopped")}isStopped(){return this.stopped}async tick(){let $=this.options.now?.()??Date.now();if(n.trace("prime","tick start",{now:$}),await this.sweepMarkers($),this.stopped){n.trace("prime","tick: stopped, aborting");return}let Z=await this.options.loadStorage();if(!Z){n.trace("prime","tick: no storage, skipping");return}if(Z.prime?.enabled!==!0){n.trace("prime","tick: feature disabled, skipping");return}let J=nF(Z);await Promise.all(J.map((X)=>this.runForAccount(X,Z,$))),n.trace("prime","tick end")}stats($,Z){let J=hF($??null,{now:Z,transient:this.transient});if(this.counters.size===0)return J;return J.map((X)=>{let Y=this.counters.get(X.id);if(!Y)return X;return{...X,usage:Y,estimatedCostUsd:pJ(Y)}})}isWindowActive($){return this.windowActive.has($)}async runForAccount($,Z,J){try{if(this.stopped)return;let X=cF({storage:Z,accountId:$.id,isOAuth:$.isOAuth,isEnabled:$.isEnabled,hasPermanentRefreshError:$.hasPermanentRefreshError,quota:$.storedQuota});if(!X.eligible){n.debug("prime","ineligible",{account:$.label,reason:JK(X.reason)});return}let Y=GK($.storedFiveHour);if(Y!==void 0&&J<Y+L5){n.trace("prime","not due",{account:$.label});return}let z=await this.options.getAccountFingerprint($.id);if(!z){n.debug("prime","credential identity unavailable",{account:$.label});return}let G=`${$.id}:${z.toLowerCase().slice(0,12)}`,Q=this.markerDir(z),K=zK(Q,$.id),W=Y===void 0?K:YK(Q,$.id,Y);try{await $K(W);return}catch(_){if(_.code!=="ENOENT")throw _}if(Y===void 0&&await this.hasAnyClaimMarker($.id,z))return;if(this.stopped)return;let V=this.lastForcedCheck.get(G);if(V!==void 0&&V.resetEpoch===Y&&J<V.at+yF)return;this.lastForcedCheck.set(G,{at:J,resetEpoch:Y});let B;try{B=await this.options.refreshQuota($.id)}catch{n.warn("prime","refresh failed",{account:$.label});return}if(this.stopped)return;let H=await this.options.loadStorage();if(H?.prime?.enabled!==!0)return;let q=B.quota;if(!B.fresh){n.debug("prime","stale fresh-check",{account:$.label});return}if(!GW(q,H,$.id,HW)){n.debug("prime","ineligible",{account:$.label,reason:JK("killswitch")});return}let N=GK(q?.five_hour);if(N!==void 0&&N>J){n.debug("prime","window active",{account:$.label,resetsAt:q.five_hour?.resetsAt}),this.windowActive.set($.id,J);return}this.windowActive.delete($.id);let O=N??Y,U=O===void 0?await this.tryClaimBootstrap($.id,z):await this.tryClaim($.id,z,O);if(!U){n.debug("prime","claim lost",{account:$.label,marker:`${$.id}-${O??"bootstrap"}`});return}let D=await this.options.loadStorage();if(this.stopped||D?.prime?.enabled!==!0){await AZ(U,{force:!0});return}if(O!==void 0){if(await AZ(K,{force:!0}),this.stopped){await AZ(U,{force:!0});return}}await this.fire($,J,D)}catch{n.warn("prime","account evaluation failed",{account:$.label})}}async tryClaim($,Z,J){let X=this.markerDir(Z),Y=YK(X,$,J);return this.tryClaimPath(X,Y)}async tryClaimBootstrap($,Z){let J=this.markerDir(Z),X=zK(J,$);return this.tryClaimPath(J,X)}async tryClaimPath($,Z){try{await IF($,{recursive:!0})}catch{}try{return await EF(Z,"",{encoding:"utf8",flag:"wx"}),Z}catch(J){if(J.code==="EEXIST")return null;throw J}}async hasAnyClaimMarker($,Z){let J=this.markerDir(Z),X=`${encodeURIComponent($)}-`;try{return(await eQ(J)).some((Y)=>Y.startsWith(X))}catch(Y){if(Y.code==="ENOENT")return!1;throw Y}}async fire($,Z,J){let X;try{X=await this.options.sendPrime($.id)}catch{n.warn("prime","prime fire threw",{account:$.label}),this.transient.set($.id,{lastPrimedAt:Z,lastResult:"error"});return}if(this.stopped)return;if(!X.ok){if(X.reason==="token-refresh")n.warn("prime","prime token refresh failed",{account:$.label,reason:"token-refresh"});else if(X.reason==="vault-cold")n.debug("prime","prime vault credential cold",{account:$.label,reason:X.reason});else n.warn("prime","prime fire failed",{account:$.label,status:X.status,reason:"send"});this.transient.set($.id,{lastPrimedAt:Z,lastResult:X.reason==="vault-cold"?"skipped":"error"});return}let Y={inputTokens:X.usage?.inputTokens,outputTokens:X.usage?.outputTokens};try{let z=await this.options.recordSuccess($.id,Y);if(this.stopped){this.transient.delete($.id),this.counters.delete($.id);return}this.counters.set($.id,z),this.transient.set($.id,{lastPrimedAt:Z,lastResult:"ok"}),n.info("prime","prime fired",{account:$.label,status:X.status,ms:X.ms,usage:{inputTokens:z.inputTokens,outputTokens:z.outputTokens}}),this.schedulePostFireRefresh($)}catch{n.warn("prime","recordSuccess failed",{account:$.label}),this.transient.set($.id,{lastPrimedAt:Z,lastResult:"error"})}}schedulePostFireRefresh($){let Z=this.setTimeoutImpl(()=>{if(this.postFireRefreshTimers.delete(Z),this.stopped)return;(async()=>{let J=await this.options.loadStorage();if(this.stopped||J?.prime?.enabled!==!0)return;await this.options.refreshQuota($.id)})().catch(()=>{n.debug("prime","post-fire refresh failed",{account:$.label})})},vF);if(this.postFireRefreshTimers.add(Z),typeof Z==="object"&&"unref"in Z)Z.unref?.()}async sweepMarkers($){let Z=this.storageMarkerDir(),J=await this.sweepMarkerDirectory(Z,$);if(J>0)n.trace("prime","swept stale markers",{swept:J})}async sweepMarkerDirectory($,Z){let J;try{J=await eQ($)}catch{return 0}let X=0;for(let Y of J)try{let z=K1($,Y),G=await $K(z);if(G.isDirectory()){X+=await this.sweepMarkerDirectory(z,Z);continue}if(Z-G.mtimeMs>fF)await AZ(z,{force:!0}),X+=1}catch{}return X}storageMarkerDir(){return q5(this.options.markerDir??XK(),this.options.storagePath)}markerDir($){return aF(this.options.markerDir??XK(),this.options.storagePath,$)}}var w8=3,j9=180000;function R9(){return process.env.OPENCODE_ANTHROPIC_AUTH_QUOTA_FEED_DIR??tZ(Jx(),"opencode-anthropic-auth","quota-header-feed")}function kk($){return($.storage?.accounts.filter(W8).length??0)+($.mainOAuthConfigured?1:0)}function O5($){if($.schema_version!==w8||$.provider!=="anthropic")return!1;if(!Number.isFinite($.configured_account_count)||!Number.isFinite($.observed_at_ms))return!1;if(!$.quota||typeof $.quota!=="object")return!1;if(!Object.hasOwn($,"anthropic_account_uuid")||$.anthropic_account_uuid!==null&&typeof $.anthropic_account_uuid!=="string")return!1;if($.identity_source==="none")return!("credential_id"in $)&&!("account_ref"in $);if($.identity_source==="credential_id")return typeof $.credential_id==="string"&&$.credential_id.length>0&&$.credential_id!=="main"&&!("account_ref"in $);if($.identity_source==="account_ref")return typeof $.account_ref==="string"&&$.account_ref.length>0&&$.account_ref!=="main"&&!("credential_id"in $);return!1}function Xx($){if($.schema_version!==w8||$.provider!=="anthropic"||!O5($))throw Error("Invalid quota header feed entry")}function u8($){return typeof $==="number"&&Number.isFinite($)}function lJ($){if(!$||typeof $!=="object")return;let Z=$;if(!u8(Z.usedPercent)||!u8(Z.remainingPercent)||!u8(Z.checkedAt))return;return{usedPercent:Z.usedPercent,remainingPercent:Z.remainingPercent,...typeof Z.resetsAt==="string"&&{resetsAt:Z.resetsAt},checkedAt:Z.checkedAt}}function Yx($){if(!$||typeof $!=="object")return;let Z=$,J=lJ(Z);if(!J||typeof Z.id!=="string"||!Z.id.trim()||typeof Z.title!=="string"||!Z.title.trim()||typeof Z.modelName!=="string"||!Z.modelName.trim())return;return{...J,id:Z.id,title:Z.title,...typeof Z.modelId==="string"&&Z.modelId.trim()&&{modelId:Z.modelId},modelName:Z.modelName}}function BK($){if(!$||typeof $!=="object")return;let Z=$;if(!u8(Z.amountMinor)||typeof Z.currency!=="string"||!Z.currency.trim()||!u8(Z.exponent))return;return{amountMinor:Z.amountMinor,currency:Z.currency,exponent:Z.exponent}}function zx($){if(!$||typeof $!=="object")return;let Z=$,J=BK(Z.used),X=BK(Z.limit);if(!J||!X||typeof Z.exhausted!=="boolean")return;return{used:J,limit:X,...u8(Z.utilizationPercent)&&{utilizationPercent:Z.utilizationPercent},...typeof Z.severity==="string"&&{severity:Z.severity},exhausted:Z.exhausted}}function Gx($,Z){if(!$||typeof $!=="object")return;let J=$,X={};for(let Y of v7){if(!Z.has(Y))continue;let z=J[Y];if(z==="poll"||z==="headers")X[Y]=z}return Object.keys(X).length>0?X:void 0}function Qx($){let Z=lJ($.five_hour),J=lJ($.seven_day),X=Array.isArray($.scoped)?$.scoped.map(Yx).filter((Q)=>Q!=null):void 0,Y=zx($.extraUsage),z=new Set;if(Z)z.add("five_hour");if(J)z.add("seven_day");if(typeof $.bindingWindow==="string")z.add("bindingWindow");if(typeof $.fallbackAdvised==="boolean")z.add("fallbackAdvised");if(X)z.add("scoped");if(Y)z.add("extraUsage");let G=Gx($.fieldSources,z);return{...Z&&{five_hour:Z},...J&&{seven_day:J},...typeof $.bindingWindow==="string"&&{bindingWindow:$.bindingWindow},...typeof $.fallbackAdvised==="boolean"&&{fallbackAdvised:$.fallbackAdvised},...X&&{scoped:X},...Y&&{extraUsage:Y},...G&&{provenance:G}}}class Kx{options;filePath;writeChain=Promise.resolve();constructor($={}){this.options=$;let Z=$.instanceId??`${process.pid}-${QK()}`;this.filePath=tZ($.directory??R9(),`${Z}.json`)}publish($){let{accountKey:Z,quota:J}=$;try{Xx($)}catch(z){return Promise.reject(z)}let Y={...$.identity_source==="credential_id"?{identity_source:"credential_id",credential_id:$.credential_id}:$.identity_source==="account_ref"?{identity_source:"account_ref",account_ref:$.account_ref}:{identity_source:"none"},schema_version:$.schema_version,provider:$.provider,configured_account_count:$.configured_account_count,observed_at_ms:$.observed_at_ms,anthropic_account_uuid:$.anthropic_account_uuid,quota:Qx(J)};if(!Z)return Promise.reject(Error("Invalid quota header feed account key"));return this.writeChain=this.writeChain.catch(()=>{}).then(async()=>{let z=this.options.directory??R9();await tF(z,{recursive:!0,mode:448}),await KK(z,448),await this.reapStaleSiblingLeases(z);let G={};try{let K=JSON.parse(await VK(this.filePath,"utf8"));if(K.version===w8&&K.entries&&typeof K.entries==="object")G=K.entries}catch{}G[Z]=Y;let Q=`${this.filePath}.${QK()}.tmp`;try{await Zx(Q,`${JSON.stringify({version:w8,lease_horizon_ms:this.options.leaseMs??j9,entries:G})}
-`,{mode:384}),await KK(Q,384),await eF(Q,this.filePath)}finally{await M9(Q,{force:!0})}}),this.writeChain}async reapStaleSiblingLeases($){let Z=this.options.now?.()??Date.now(),J=this.options.leaseMs??j9,X;try{X=await WK($)}catch{return}await Promise.all(X.filter((Y)=>/^\d+-[0-9a-f-]+\.json$/i.test(Y)).map(async(Y)=>{let z=tZ($,Y);if(z===this.filePath)return;try{let G=await $x(z);if(G.mtimeMs>Z||Z-G.mtimeMs<J)return;await this.options.beforeRemoveFile?.(z);let Q=await rF(z);if(Q.ino!==G.ino||Q.mtimeMs!==G.mtimeMs)return;await(this.options.removeFile??((K)=>M9(K)))(z)}catch{}}))}async list(){await this.writeChain.catch(()=>{});let $=this.options.directory??R9(),Z=this.options.now?.()??Date.now(),J=this.options.leaseMs??j9,X;try{X=(await WK($)).filter((z)=>z.endsWith(".json"))}catch{return[]}let Y=new Map;return await Promise.all(X.map(async(z)=>{try{let G=JSON.parse(await VK(tZ($,z),"utf8"));if(G.version!==w8||!G.entries||typeof G.entries!=="object")return;for(let[Q,K]of Object.entries(G.entries)){if(!K||typeof K!=="object"||K.schema_version!==w8||K.provider!=="anthropic"||!O5(K))continue;let W=K.observed_at_ms;if(W>Z||Z-W>=J)continue;let V=Y.get(Q);if(!V||W>V.observed_at_ms)Y.set(Q,K)}}catch{}})),[...Y.values()].sort((z,G)=>z.observed_at_ms-G.observed_at_ms)}async dispose(){await this.writeChain.catch(()=>{}),await M9(this.filePath,{force:!0})}}var O2="anthropic-ratelimit-unified-",D5={"5h":"five_hour","7d":"seven_day"};function bk($){return Object.keys(D5).some((Z)=>Number.isFinite(uJ($,`${O2}${Z}-utilization`)))}function uJ($,Z){let J=$.get(Z);if(J==null||J.trim()==="")return;let X=Number(J);return Number.isFinite(X)?X:void 0}function Wx($,Z,J){let X=uJ($,`${O2}${Z}-utilization`);if(X==null)return;let Y=Math.min(100,Math.max(0,Math.round(X*100))),z=uJ($,`${O2}${Z}-reset`),G=z==null?void 0:new Date(z*1000),Q=G&&Number.isFinite(G.getTime())?G.toISOString():void 0;return{usedPercent:Y,remainingPercent:100-Y,...Q&&{resetsAt:Q},checkedAt:J}}function fk($,Z=Date.now()){let J={},X=$.get(`${O2}fallback`),Y={fallbackAdvised:X==="available",source:"headers",checkedAt:Z};for(let[G,Q]of Object.entries(D5)){let K=Wx($,G,Z);if(K)Y[Q]=K,J[Q]="headers"}let z=$.get(`${O2}representative-claim`);if(z)Y.bindingWindow=z,Y.bindingWindowSource="headers",J.bindingWindow="headers";if(X!==null)J.fallbackAdvised="headers";return{...Y,fieldSources:J}}function eZ($,Z){let{scoped:J,extraUsage:X,fieldSources:Y,...z}=$??{},{scoped:G,extraUsage:Q,fieldSources:K,...W}=Z,V={};for(let B of v7){let H=B==="scoped"?J:B==="extraUsage"?X:B==="fallbackAdvised"?K?.fallbackAdvised!==void 0?Z.fallbackAdvised:$?.fallbackAdvised??Z.fallbackAdvised:B==="bindingWindow"?$?.bindingWindowSource==="poll"?$?.bindingWindow:Z.bindingWindow??$?.bindingWindow:Z[B]??$?.[B];if(H===void 0)continue;let q=B==="fallbackAdvised"?K?.fallbackAdvised??($?.fallbackAdvised!==void 0?Y?Y.fallbackAdvised:F0($,B):void 0):(B==="scoped"||B==="extraUsage")&&H!==void 0?"poll":B==="bindingWindow"&&$?.bindingWindowSource==="poll"&&$.bindingWindow!==void 0?"poll":Z[B]!==void 0?K?.[B]??F0(Z,B):Y?.[B]??F0($,B);if(q)V[B]=q}return{...z,...W,...Array.isArray(J)&&{scoped:J},...X!=null&&{extraUsage:X},fallbackAdvised:K?.fallbackAdvised!==void 0?Z.fallbackAdvised:$?.fallbackAdvised??Z.fallbackAdvised,bindingWindow:$?.bindingWindowSource==="poll"?$.bindingWindow:Z.bindingWindow??$?.bindingWindow,bindingWindowSource:$?.bindingWindowSource==="poll"?"poll":Z.bindingWindowSource??$?.bindingWindowSource,...Object.keys(V).length>0&&{fieldSources:V},source:"headers"}}var Vx=globalThis.setTimeout;function HK($,Z){if($?.source!=="headers")return Z;let J=Boolean($.five_hour&&$.five_hour.checkedAt>(Z.five_hour?.checkedAt??0)),X=Boolean($.seven_day&&$.seven_day.checkedAt>(Z.seven_day?.checkedAt??0));if(!J&&!X)return Z;return eZ(Z,{...J&&{five_hour:$.five_hour},...X&&{seven_day:$.seven_day},fallbackAdvised:$.fallbackAdvised,...$.bindingWindowSource==="headers"&&{bindingWindow:$.bindingWindow,bindingWindowSource:$.bindingWindowSource},source:"headers",checkedAt:Math.max(J?$.five_hour?.checkedAt??0:0,X?$.seven_day?.checkedAt??0:0)})}class n0{main=null;mainAccountId;mainQuotaIdentityKnown=!1;mainQuotaIdentityStrict=!1;mainGeneration=0;mainQuotaErrorGeneration=0;mainQuotaErrorClearedAt;fallbacks=new Map;fallbackAuthLineages=new Map;fallbackGenerations=new Map;inflightMain=null;lastMainPollAttempt;inflightMainAccountId;inflightMainAccessToken;inflightMainToken=0;inflightFallbacks=new Map;mainLastApiError=void 0;fallbackApiErrors=new Map;apiGate=Promise.resolve();lastApiCallAt;storage;fetchImpl;fetchQuotaSnapshot;now;onMainQuotaFetched;onApiError;onFallbackQuotaFetched;onFallbackApiError;constructor($){this.storage=$.storage,this.fetchImpl=$.fetchImpl??fetch,this.fetchQuotaSnapshot=$.fetchQuotaSnapshot,this.now=$.now??Date.now,this.onMainQuotaFetched=$.onMainQuotaFetched,this.onApiError=$.onApiError,this.onFallbackQuotaFetched=$.onFallbackQuotaFetched,this.onFallbackApiError=$.onFallbackApiError,this.seedMainFromStorage($.storage,$.storage?.mainAccountId),this.seedMainBackoffFromStorage($.storage)}getMain($){if(this.mainAccountId!==$)return null;if(this.mainQuotaIdentityKnown&&this.mainQuotaIdentityStrict&&($===void 0||this.main?.quota.accountIdentity!==$))return null;return this.main}getFallback($,Z){return this.bindFallbackLineage($,Z),this.fallbacks.get($)??null}canFetchWithoutAccessToken(){return Boolean(this.fetchQuotaSnapshot)}getAllFallbacks(){return this.fallbacks}setMain($,Z){this.mainAccountId=$,this.main=Z}clearMain(){this.mainAccountId=void 0,this.main=null}setMainQuotaAccountIdentity($,Z=!0,J=!1){let X=this.mainQuotaIdentityKnown,Y=this.mainAccountId,z=J||!X||this.mainAccountId!==$||this.mainQuotaIdentityStrict!==Z;if(this.mainQuotaIdentityKnown=!0,this.mainQuotaIdentityStrict=Z,!z)return;if(this.mainGeneration+=1,this.mainAccountId=$,J)this.main=null,this.mainLastApiError=void 0,this.mainQuotaErrorGeneration+=1,this.mainQuotaErrorClearedAt=O1(this.mainQuotaErrorClearedAt,this.now());else if($!==void 0&&this.main?.quota.accountIdentity!==$)this.main=null;if($!==void 0&&this.mainLastApiError&&(this.mainLastApiError.accountIdentity!==void 0?this.mainLastApiError.accountIdentity!==$:X&&Y!==void 0&&Y!==$))return this.mainLastApiError=void 0,this.mainQuotaErrorGeneration+=1,this.mainQuotaErrorClearedAt=O1(this.mainQuotaErrorClearedAt,this.now()),this.mainQuotaErrorGeneration;return}setFallback($,Z,J){this.bindFallbackLineage($,J),this.fallbacks.set($,Z)}clearFallback($){this.fallbackGenerations.set($,(this.fallbackGenerations.get($)??0)+1),this.fallbacks.delete($),this.fallbackApiErrors.delete($),this.inflightFallbacks.delete(n0.fallbackInflightKey($))}pushMainFromHeaders($,Z){let J=Z.checkedAt??this.now(),X=eZ(this.mainAccountId===$&&(!this.mainQuotaIdentityKnown||!this.mainQuotaIdentityStrict||this.main?.quota.accountIdentity===$)?this.main?.quota:void 0,{...Z,...$!==void 0&&{accountIdentity:$}}),Y={quota:X,checkedAt:J,refreshAfter:s0(X,this.storage,J)};return this.setMain($,Y),Y}pushFallbackFromHeaders($,Z,J){if(!this.acceptFallbackQuotaObservation($,J))return null;let X=Z.checkedAt??this.now(),Y=eZ(this.fallbacks.get($)?.quota,{...Z,accountIdentity:$}),z={quota:Y,checkedAt:X,refreshAfter:s0(Y,this.storage,X)};return this.fallbacks.set($,z),z}async refreshMain($,Z,J){let X=$,Y=Z??$;if(!Y&&!this.canFetchWithoutAccessToken())throw Error("Main OAuth access token is unavailable");return(await this.refreshMainWithMetadata(X,Y,J)).quota}async refreshMainWithMetadata($,Z,J){let X=$,Y=Z??$;if(!Y&&!this.canFetchWithoutAccessToken())throw Error("Main OAuth access token is unavailable");if(J!==void 0&&(this.mainGeneration!==J||this.mainAccountId!==X))throw Error("Main quota identity changed before refresh");if(this.mainAccountId!==X){if(this.main=null,this.mainAccountId=X,this.mainQuotaIdentityKnown)this.mainGeneration+=1}if(this.inflightMain&&this.inflightMainAccountId===X&&this.inflightMainAccessToken===Y)return this.inflightMain;if(this.isBackedOff()){if(this.main&&this.mainAccountId===X)return{quota:this.main.quota,fetched:!1};throw Error("Quota API rate-limited — try again later")}this.inflightMainAccountId=X,this.inflightMainAccessToken=Y;let z=this.mainGeneration,G=++this.inflightMainToken;return this.inflightMain=this._fetchMain(X,Y??"",z,G),this.inflightMain}async refreshFallback($,Z,J){return(await this.refreshFallbackWithMetadata($,Z,J)).quota}async refreshFallbackWithMetadata($,Z,J){if(!Z&&!this.canFetchWithoutAccessToken())throw Error("Fallback OAuth access token is unavailable");this.bindFallbackLineage($,J);let X=n0.fallbackInflightKey($),Y=this.inflightFallbacks.get(X);if(Y)return Y;if(this.isFallbackBackedOff($)){let Q=this.getFallback($);if(Q)return{quota:Q.quota,fetched:!1};throw Error("Quota API rate-limited — try again later")}let z=this.fallbackGenerations.get($)??0,G=this._fetchFallback($,Z,z,J);return this.inflightFallbacks.set(X,G),G.then(()=>{if(this.inflightFallbacks.get(X)===G)this.inflightFallbacks.delete(X)},()=>{if(this.inflightFallbacks.get(X)===G)this.inflightFallbacks.delete(X)}),G}async refreshAllFallbacks($,Z){let J=this.now();for(let X of $){if(!_6(X))continue;let Y=Z!==void 0?Z(X):X.access&&X.expires!==void 0&&X.expires>J?X.access:void 0;if(!Y)continue;this.bindFallbackLineage(X.id,X);let z=this.getFallback(X.id);if(z&&J<z.refreshAfter)continue;try{await this.refreshFallback(X.id,Y,X)}catch{}}}refreshMainInBackground($){if(this.inflightMain)return;if(this.isBackedOff())return;this.refreshMain(this.mainAccountId,$).catch(()=>{})}scopedWindowIsStale($,Z){let J=H0($.quota,Z);return Boolean(J&&this.now()-J.checkedAt>=m1(this.storage))}isMainStale($){if(!this.main)return!0;if(this.mainQuotaIdentityKnown&&this.mainQuotaIdentityStrict&&(this.mainAccountId===void 0||this.main.quota.accountIdentity!==this.mainAccountId))return!0;return this.now()>=this.main.refreshAfter||this.scopedWindowIsStale(this.main,$)||this.main.quota.source==="headers"&&this.main.quota.scoped===void 0&&(this.lastMainPollAttempt===void 0||this.lastMainPollAttempt.accountId!==this.mainAccountId||this.now()-this.lastMainPollAttempt.at>=m1(this.storage))}isFallbackStale($,Z,J,X){let Y=this.getFallback($,X);if(!Y)return!0;return this.now()>=Y.refreshAfter||this.scopedWindowIsStale(Y,J)}shouldRefreshOnRequestCount($){let Z=kL(this.storage);if(Z<=0)return!1;return $>0&&$%Z===0}needsRefresh($,Z){return this.isMainStale(Z)||this.shouldRefreshOnRequestCount($)}updateStorage($){this.storage=$,this.seedMainFromStorage($,this.mainQuotaIdentityKnown?this.mainAccountId:$?.mainAccountId),this.seedMainBackoffFromStorage($)}seedMainFromStorage($,Z){let J=wL($);if(!J)return;let X={quota:{...J.quota,...(!this.mainQuotaIdentityKnown||!this.mainQuotaIdentityStrict)&&Z!==void 0&&J.accountIdentity===void 0&&{accountIdentity:Z}},refreshAfter:s0(J.quota,$,J.checkedAt),checkedAt:J.checkedAt},Y=this.main&&this.mainAccountId===Z&&(!this.mainQuotaIdentityKnown||!this.mainQuotaIdentityStrict||this.main.quota.accountIdentity===Z)?this.main:void 0;if(Y&&Y.checkedAt>=X.checkedAt&&Y.quota.source==="headers"&&X.quota.source==="poll"){let z=eZ(X.quota,Y.quota);this.main={quota:z,refreshAfter:s0(z,$,Y.checkedAt),checkedAt:Y.checkedAt};return}if(this.main&&this.mainAccountId===Z&&this.main.checkedAt>=X.checkedAt)return;if(this.main=X,Z!==void 0)this.mainAccountId=Z}seedMainBackoffFromStorage($){let Z=$?.quota?.mainLastQuotaApiError,J=Z?.accountIdentity,X=typeof $?.quota?.mainQuotaErrorGeneration==="number"&&Number.isSafeInteger($.quota.mainQuotaErrorGeneration)&&$.quota.mainQuotaErrorGeneration>=0?$.quota.mainQuotaErrorGeneration:void 0,Y=typeof $?.quota?.mainQuotaErrorClearedAt==="number"&&Number.isFinite($.quota.mainQuotaErrorClearedAt)&&$.quota.mainQuotaErrorClearedAt>=0?$.quota.mainQuotaErrorClearedAt:void 0;if(Y!==void 0&&(this.mainQuotaErrorClearedAt===void 0||Y>this.mainQuotaErrorClearedAt)){if(this.mainQuotaErrorClearedAt=O1(this.mainQuotaErrorClearedAt,Y),(!Z||typeof Z.checkedAt==="number"&&Z.checkedAt<=Y)&&(this.mainLastApiError?.checkedAt===void 0||this.mainLastApiError.checkedAt<=Y))this.mainLastApiError=void 0}if(X!==void 0&&X>this.mainQuotaErrorGeneration){if(this.mainQuotaErrorGeneration=X,!Z&&(this.mainLastApiError?.checkedAt===void 0||this.mainQuotaErrorClearedAt===void 0||this.mainLastApiError.checkedAt<=this.mainQuotaErrorClearedAt))this.mainLastApiError=void 0}if(Z&&(!this.mainQuotaIdentityKnown||J===void 0||J===this.mainAccountId)&&(this.mainQuotaErrorClearedAt===void 0||typeof Z.checkedAt!=="number"||Z.checkedAt>this.mainQuotaErrorClearedAt)&&(this.mainLastApiError?.checkedAt===void 0||Z.checkedAt>=this.mainLastApiError.checkedAt)&&VZ(Z,this.now())){if(this.mainLastApiError=Z,X!==void 0)this.mainQuotaErrorGeneration=X;return}if(this.mainAccountId!==void 0&&this.mainLastApiError?.accountIdentity!==void 0&&this.mainLastApiError.accountIdentity!==this.mainAccountId)this.mainLastApiError=void 0}seedFallbacksFromAccounts($){let Z=m1(this.storage),J=new Set($.map((X)=>X.id));for(let X of this.fallbackAuthLineages.keys())if(!J.has(X))this.clearFallback(X),this.fallbackAuthLineages.delete(X);for(let X of $){if(this.bindFallbackLineage(X.id,X))continue;if(!_6(X))continue;let z=X.lastQuotaRefreshError,G=r6(X.quota),Q=this.fallbackApiErrors.get(X.id);if(z&&VZ(z,this.now())&&G<=(z.checkedAt??0)&&(!Q||z.checkedAt>=Q.checkedAt))this.fallbackApiErrors.set(X.id,z);else if(Q&&G>=Q.checkedAt)this.fallbackApiErrors.delete(X.id);if(!X.quota)continue;let K=r6(X.quota);if(K<=0)continue;let W=this.getFallback(X.id);if(W&&W.checkedAt>=K)continue;this.setFallback(X.id,{quota:{...X.quota,accountIdentity:X.id},refreshAfter:K+Z,checkedAt:K},X)}}isBackedOff(){return VZ(this.mainLastApiError,this.now())}isFallbackBackedOff($){return VZ(this.fallbackApiErrors.get($),this.now())}getLastApiError(){return this.mainLastApiError}getMainQuotaErrorGeneration(){return this.mainQuotaErrorGeneration}getMainQuotaIdentityGeneration(){return this.mainGeneration}getMainQuotaErrorClearedAt(){return this.mainQuotaErrorClearedAt}clearMainBackoff(){if(!this.mainLastApiError)return;return this.mainLastApiError=void 0,this.mainQuotaErrorGeneration+=1,this.mainQuotaErrorClearedAt=O1(this.mainQuotaErrorClearedAt,this.now()),this.mainQuotaErrorGeneration}static API_CALL_GAP_MS=1000;static fallbackInflightKey($){return $}static quotaLockName($){return`opencode-fallback-quota-refresh-${$.replace(/[^a-zA-Z0-9._-]+/g,"-")||"account"}`}bindFallbackLineage($,Z){if(!Z)return!1;let J=this.fallbackAuthLineages.has($),X=this.fallbackAuthLineages.get($),Y=J&&Z.authLineageId!==void 0&&X!==Z.authLineageId;if(Y)this.clearFallback($);return this.fallbackAuthLineages.set($,Z.authLineageId),Y}acceptFallbackQuotaObservation($,Z){let J=this.fallbackAuthLineages.has($),X=this.fallbackAuthLineages.get($),Y=Z?.authLineageId;if(J&&X!==Y)return n.trace("quota","skipped stale fallback quota observation after lineage change",{accountId:$,storedLineage:X,servedLineage:Y}),!1;if(!J)this.fallbackAuthLineages.set($,Y);return!0}isClosed=!1;close(){this.isClosed=!0,this.inflightFallbacks.clear(),this.inflightMain=null}_enqueueApiFetch($){let Z=async()=>{if(this.isClosed)throw Error("QuotaManager is closed");return $()},J=this.apiGate.then(Z,Z);return this.apiGate=J.catch(()=>{}),J}_quotaDispatch($,Z){return async(J,X)=>{if(this.lastApiCallAt!==void 0){let z=n0.API_CALL_GAP_MS-(this.now()-this.lastApiCallAt);if(z>0)await new Promise((G)=>{let Q=Vx(G,z);if(typeof Q==="object"&&"unref"in Q)Q.unref()})}if(this.isClosed)throw Error("QuotaManager is closed");if(await X(),await Z?.(),this.isClosed)throw Error("QuotaManager is closed");let Y=this.now();$?.(Y);try{return J()}finally{this.lastApiCallAt=this.now()}}}_quotaFetch($){return Object.assign((Z,J)=>$(()=>this.fetchImpl(Z,J),async()=>J?.signal?.throwIfAborted()),{preconnect:this.fetchImpl.preconnect})}async _fetchMain($,Z,J,X){return this._enqueueApiFetch(async()=>{try{if(this.isBackedOff()){if(this.main&&this.mainAccountId===$)return{quota:this.main.quota,fetched:!1};throw Error("Quota API rate-limited — try again later")}if(this.mainQuotaIdentityKnown&&this.mainQuotaIdentityStrict&&this.mainGeneration!==J)return{quota:{accountIdentity:$},fetched:!1};let Y=await e1({name:"opencode-main-quota-refresh",ttlMs:30000});if(!Y){let z=this.main;if(z&&this.mainAccountId===$&&this.now()<z.refreshAfter)return{quota:z.quota,fetched:!1};throw Error("Quota refresh is already in progress")}try{let z=this.lastMainPollAttempt,G,Q=this.now(),K=!1,W=this._quotaDispatch((q)=>{if(!K)Q=q;K=!0,G={accountId:$,at:q},this.lastMainPollAttempt=G},async()=>{if(await Y.assertOwned(),this.mainGeneration!==J)throw Error("Main quota identity changed before dispatch")}),V=this.fetchQuotaSnapshot?await this.fetchQuotaSnapshot({kind:"main",accountId:$,accessToken:Z},W):await G7({accessToken:Z,fetchImpl:this._quotaFetch(W),now:this.now});try{await Y.assertOwned()}catch{if(G&&this.lastMainPollAttempt===G)this.lastMainPollAttempt=z;return{quota:this.getMain($)?.quota??{accountIdentity:$},fetched:!1}}let B=this.now();if(this.mainQuotaIdentityKnown&&this.mainQuotaIdentityStrict&&this.mainGeneration!==J)return{quota:{...V,...$!==void 0&&{accountIdentity:$}},fetched:!0};let H=HK(this.mainAccountId===$&&(!this.mainQuotaIdentityKnown||!this.mainQuotaIdentityStrict||this.main?.quota.accountIdentity===$)?this.main?.quota:void 0,{...V,...$!==void 0&&{accountIdentity:$}});if(this.mainAccountId=$,this.main={quota:H,refreshAfter:s0(H,this.storage,B),checkedAt:H.checkedAt??B},this.mainLastApiError)this.mainLastApiError=void 0,this.mainQuotaErrorGeneration+=1,this.mainQuotaErrorClearedAt=O1(this.mainQuotaErrorClearedAt,B);return this.onMainQuotaFetched?.(H,B,p$(Z),Q,this.mainQuotaErrorGeneration,this.mainQuotaErrorClearedAt),{quota:H,fetched:!0}}catch(z){throw this._handleMainFetchError(z,J),z}finally{await Y.release()}}finally{if(this.inflightMainToken===X)this.inflightMain=null,this.inflightMainAccountId=void 0}})}async _fetchFallback($,Z,J,X){return this._enqueueApiFetch(async()=>{try{if((this.fallbackGenerations.get($)??0)!==J)return{quota:{accountIdentity:$},fetched:!1};if(this.isFallbackBackedOff($)){let z=this.getFallback($,X);if(z)return{quota:z.quota,fetched:!1};throw Error("Quota API rate-limited — try again later")}let Y=await e1({name:n0.quotaLockName($),ttlMs:30000});if(!Y){let z=this.getFallback($,X);if(z&&this.now()<z.refreshAfter)return{quota:z.quota,fetched:!1};throw Error("Quota refresh is already in progress")}try{let z=this.now(),G=!1,Q=this._quotaDispatch((B)=>{if(!G)z=B;G=!0},async()=>{if(await Y.assertOwned(),(this.fallbackGenerations.get($)??0)!==J)throw Error("Fallback quota identity changed before dispatch")}),K=this.fetchQuotaSnapshot?await this.fetchQuotaSnapshot({kind:"fallback",accountId:$,accessToken:Z},Q):await G7({accessToken:Z,fetchImpl:this._quotaFetch(Q),now:this.now});try{await Y.assertOwned()}catch{return{quota:this.getFallback($,X)?.quota??{accountIdentity:$},fetched:!1}}let W=this.now();if((this.fallbackGenerations.get($)??0)!==J)return{quota:{...K,accountIdentity:$},fetched:!0};let V=HK(this.getFallback($,X)?.quota,{...K,accountIdentity:$});return this.setFallback($,{quota:V,refreshAfter:s0(V,this.storage,W),checkedAt:V.checkedAt??W},X),this.fallbackApiErrors.delete($),this.onFallbackQuotaFetched?.($,V,W,z),{quota:V,fetched:!0}}finally{await Y.release()}}catch(Y){throw this._handleFallbackFetchError($,Y,J),Y}})}static isAuthError($){if($.status===401||EL($))return!0;let J=$ instanceof Error?$.message:String($);return/quota check failed: 401\b/.test(J)}_handleMainFetchError($,Z){if(this.mainGeneration!==Z)return;if(this.mainQuotaIdentityKnown&&this.mainQuotaIdentityStrict&&this.mainAccountId===void 0)return;if(n0.isAuthError($))return;this.mainLastApiError=w9({error:$,now:this.now(),accountIdentity:this.mainAccountId,previous:this.mainLastApiError}),this.mainQuotaErrorGeneration+=1,this.onApiError?.(this.mainLastApiError,this.mainQuotaErrorGeneration)}_handleFallbackFetchError($,Z,J){if((this.fallbackGenerations.get($)??0)!==J)return;if(n0.isAuthError(Z))return;let X=this.fallbackApiErrors.get($),Y=w9({error:Z,now:this.now(),previous:X,accountIdentity:$});this.fallbackApiErrors.set($,Y),this.onFallbackApiError?.($,Y)}}function Bx($,Z){if(!$)return;let J=[],X=(G,Q,K,W)=>{if(!G)return;J.push({scope:Q,label:K,kind:"reading",windowMinutes:W,usedPercent:G.usedPercent,remainingPercent:G.remainingPercent,resetsAt:G.resetsAt,checkedAt:G.checkedAt??$.checkedAt??Z})};X($.five_hour,Z0,"five_hour",300),X($.seven_day,Z0,"seven_day",10080);for(let G of $.scoped??[])X(G,G.modelId??G.modelName,G.title,10080);let Y=$.checkedAt??(J.length?Math.min(...J.map((G)=>G.checkedAt)):Z),z=$.extraUsage;return{scope:Z0,limits:J,checkedAt:Y,...z&&{budget:{checkedAt:Y,reached:z.exhausted,remainingPercent:z.utilizationPercent!==void 0?100-z.utilizationPercent:z.limit.amountMinor>0?100*(1-z.used.amountMinor/z.limit.amountMinor):void 0}}}}function Hx($){let Z=$?.bindingWindow;if(Z==="five_hour")return"5h";if(Z==="seven_day")return"7d";return $?.scoped?.find((J)=>J.id===Z)?.title}function UK($,Z){let J=Math.max(0,Z-$),X=Math.floor(J/60000);if(X<1)return"just now";if(X===1)return"1m ago";if(X<60)return`${X}m ago`;let Y=Math.floor(X/60),z=X%60;if(z===0)return`${Y}h ago`;return`${Y}h ${z}m ago`}function Ux($){return $.label?.trim()||$.id}function Nx($){return $.lastQuotaRefreshError?.message??$.lastRefreshError?.message}function vk($,Z=new Map){if(!$?.accounts.length)return[];return $.accounts.filter(W8).map((J)=>{let X=Z.get(J.id)??Nx(J);return{name:Ux(J),role:"fallback",enabled:J.enabled!==!1,quota:J.quota,...D7(J.profile)&&{tierLabel:D7(J.profile)},lastRefreshedAt:J.lastRefreshedAt,...X&&{error:X}}})}function yk($){let Z=$.now??Date.now(),J=["## Claude Quotas",""];if($.refreshedAt)J.push(`Refreshed: ${UK($.refreshedAt,Z)}`,"");if(!$.accounts.length)return J.push("No Claude OAuth accounts found yet."),J.join(`
-`);for(let X of $.accounts){let Y=X.role==="main"?"main":"fallback",z=X.enabled===!1?" disabled":"";if(J.push(`### ${X.name} (${Y}${z})`),X.tierLabel)J.push(`  - Tier: ${X.tierLabel}`);if(X.lastRefreshedAt)J.push(`  - Last token refresh: ${UK(X.lastRefreshedAt,Z)}`);if(X.error)J.push(`  - Error: ${X.error}`);let G=Bx(X.quota,Z),Q=lV(G,{now:Z}),K=pV(G,{now:Z}).windows,W=Hx(X.quota);for(let[V,B]of Q.entries()){let H=W!==void 0&&K[V]?.name===W;J.push(`  - ${B}${H?" •":""}`)}if(!Q.length)J.push(`  - ${Pj(G,{now:Z})}`);if(X.quota?.fallbackAdvised===!0)J.push("  - → fallback advised");J.push("")}return J.join(`
-`).trimEnd()}var Lx="Cannot send this request: the history ends on an assistant turn. Send a new message to continue; assistant content will not be discarded to replay the previous question.";class _5 extends Error{details;check="meaningful_trailing_assistant";constructor($){super(Lx);this.details=$,this.name="TrailingAssistantHistoryError"}}var qx=new Set(["text","thinking","redacted_thinking","tool_use","server_tool_use","image","document"]),Ox=new Set(["type","text","cache_control"]);function YY($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function Dx($){if(typeof $==="string")return $.trim()==="";if(!Array.isArray($))return!1;return $.every((Z)=>YY(Z)&&Z.type==="text"&&typeof Z.text==="string"&&Z.text.trim()===""&&Object.keys(Z).every((J)=>Ox.has(J)))}function _x($){if(Array.isArray($))return{contentShape:"array",contentBlockCount:$.length,contentBlockTypes:$.map((Z)=>YY(Z)&&typeof Z.type==="string"&&qx.has(Z.type)?Z.type:"other")};if(typeof $==="string")return{contentShape:"string"};if($===void 0)return{contentShape:"missing"};return{contentShape:"other"}}function Mx($){let Z=$.length;while(Z>0){let J=$[Z-1];if(!YY(J)||J.role!=="assistant")break;if(!Dx(J.content))throw new _5({messageCount:$.length,trailingMessageIndex:Z-1,emptyMessagesAfter:$.length-Z,..._x(J.content)});Z--}return $.length-Z}function gk($){if(!Array.isArray($))return 0;let Z=Mx($);if(Z)$.length-=Z;return Z}var dJ=["main-first","fallback-first","sticky-balanced"],zY="main-first",M5="Usage: `/claude-routing`, `/claude-routing main-first`, `/claude-routing fallback-first`, `/claude-routing sticky-balanced`, or `/claude-routing reset`.";function jx($){return typeof $==="string"&&dJ.includes($)?$:zY}function mk($){return jx($?.routing?.mode)}function Rx($){let Z=$.trim().toLowerCase().split(/\s+/).filter(Boolean);if(Z.length===0)return{type:"status"};if(Z.length===1&&Z[0]==="reset")return{type:"reset"};if(Z.length===1&&dJ.includes(Z[0]))return{type:"mode",mode:Z[0]};if(Z.length===2&&Z[0]==="mode"&&dJ.includes(Z[1]))return{type:"mode",mode:Z[1]};return{type:"usage"}}function Tx($){if($==="fallback-first")return"Try usable fallback accounts before the main account. If no fallback succeeds, try the main account.";if($==="sticky-balanced")return"Assign each session to a quota-weighted OAuth account, keep it sticky across transient failures, and migrate only for confirmed long-lived exhaustion or permanent account failure.";return"Try the main account first. Use fallback accounts only when quota policy or fallback errors require it."}function IZ($){let Z=$?.mode??zY;return["## Claude Routing Status","",`- Mode: \`${Z}\``,`- Behavior: ${Tx(Z)}`,"",M5].join(`
-`)}function hk($){let Z=Rx($.argumentsText),J=$.mode??zY;if(Z.type==="status")return IZ({mode:J});if(Z.type==="mode")return["## Claude Routing Updated","",`Mode updated to \`${Z.mode}\`.`,"",...IZ({mode:Z.mode}).split(`
-`).slice(2)].join(`
-`);if(Z.type==="reset")return["## Claude Routing Assignment Reset","","The current session will be assigned again on its next request.","",...IZ({mode:J}).split(`
-`).slice(2)].join(`
-`);return["## Claude Routing Usage","",M5,"",...IZ({mode:J}).split(`
-`).slice(2)].join(`
-`)}var Px="## Claude Lane Start Status",Cx="## Claude Lane Start Queued",Fx="## Claude Lane Start Usage",xx="Usage: `/claude-start`.";function Ax($){if($.trim().split(/\s+/).filter(Boolean).length===0)return{type:"fire"};return{type:"usage"}}function pk($){let Z=Ax($.argumentsText);if(Z.type==="fire")return{action:Z,text:[Cx,"","- Queued an explicit lane-start request.","- This is a billed request: the one-token limit does not remove prompt-cache read or write charges."].join(`
-`)};return{action:Z,text:[Fx,"",xx,"",Px].join(`
-`)}}var lk="thinking-binding-controls-2026-08-01";function D2($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function Sx($){if(!D2($))return!1;if($.type==="thinking")return typeof $.signature==="string"&&$.signature.length>0;if($.type==="redacted_thinking")return typeof $.data==="string"&&$.data.length>0;return!1}function uk($){let Z=$?.thinkingBinding?.prefixMismatchBehavior;return Z==="error"||Z==="drop_block"?Z:"account-default"}function Ix($){if(!Array.isArray($.messages))return!1;return $.messages.some((Z)=>{if(!D2(Z)||Z.role!=="assistant")return!1;return Array.isArray(Z.content)&&Z.content.some(Sx)})}function dk($,Z="account-default"){if(Z==="account-default")return!1;if(!YX($.model)&&!T2($.model)&&!zX($.model)&&!NW($.model))return!1;if(!Ix($))return!1;if(!D2($.thinking)||$.thinking.type!=="adaptive")return!1;return $.thinking.block_binding={prefix_mismatch_behavior:Z},!0}function ck($){if(!D2($.thinking))return!1;if(!D2($.thinking.block_binding))return!1;let Z=$.thinking.block_binding.prefix_mismatch_behavior;return Z==="error"||Z==="drop_block"}
-export{u0 as $,t6 as aa,YN as ba,zN as ca,RI as da,gK as ea,EI as fa,b7 as ga,wI as ha,$X as ia,kI as ja,$L as ka,bI as la,fI as ma,vI as na,yI as oa,gI as pa,iK as qa,mI as ra,hI as sa,pI as ta,lI as ua,rK as va,UL as wa,uI as xa,W8 as ya,dI as za,tK as Aa,cI as Ba,iI as Ca,ZX as Da,sI as Ea,r6 as Fa,FL as Ga,kZ as Ha,aI as Ia,nI as Ja,oI as Ka,rI as La,tI as Ma,eI as Na,$E as Oa,X7 as Pa,ZE as Qa,JE as Ra,XE as Sa,YE as Ta,m1 as Ua,zE as Va,H0 as Wa,fL as Xa,XW as Ya,vL as Za,GE as _a,YW as $a,zW as ab,GW as bb,yL as cb,QE as db,s0 as eb,KE as fb,WE as gb,VE as hb,BE as ib,iL as jb,HE as kb,rL as lb,tL as mb,Jq as nb,LE as ob,Gq as pb,qE as qb,Wq as rb,b9 as sb,V8 as tb,HW as ub,m0 as vb,R2 as wb,DE as xb,_E as yb,ME as zb,jE as Ab,yz as Bb,Nq as Cb,Lq as Db,YX as Eb,TE as Fb,PE as Gb,CE as Hb,mz as Ib,FE as Jb,xE as Kb,AE as Lb,SE as Mb,IE as Nb,zX as Ob,qq as Pb,EE as Qb,wE as Rb,kE as Sb,bE as Tb,fE as Ub,vE as Vb,yE as Wb,NW as Xb,gE as Yb,Oq as Zb,pz as _b,mE as $b,hE as ac,pE as bc,lE as cc,uE as dc,T2 as ec,dE as fc,cE as gc,iE as hc,sE as ic,aE as jc,nE as kc,oE as lc,R$ as mc,rE as nc,qW as oc,tE as pc,Iq as qc,eE as rc,bq as sc,uq as tc,jW as uc,oq as vc,n as wc,Yw as xc,zw as yc,jO as zc,Gw as Ac,wO as Bc,bO as Cc,y8 as Dc,vO as Ec,l7 as Fc,hO as Gc,Vw as Hc,_X as Ic,Bw as Jc,G_ as Kc,O7 as Lc,d7 as Mc,tW as Nc,Q_ as Oc,WG as Pc,T8 as Qc,Hw as Rc,B_ as Sc,Ow as Tc,q_ as Uc,C_ as Vc,Pw as Wc,A2 as Xc,E_ as Yc,k_ as Zc,Cw as _c,Fw as $c,D7 as ad,v_ as bd,y_ as cd,g_ as dd,xw as ed,Aw as fd,Sw as gd,Iw as hd,a_ as id,Ew as jd,ww as kd,r_ as ld,kw as md,$M as nd,bw as od,pV as pd,p$ as qd,pX as rd,d6 as sd,_6 as td,X3 as ud,o as vd,iZ as wd,Q1 as xd,AT as yd,lT as zd,dT as Ad,NQ as Bd,R3 as Cd,A3 as Dd,uB as Ed,f3 as Fd,cB as Gd,v3 as Hd,y3 as Id,iB as Jd,g3 as Kd,sB as Ld,ZY as Md,b6 as Nd,aB as Od,nB as Pd,p3 as Qd,l3 as Rd,u3 as Sd,d3 as Td,c3 as Ud,i3 as Vd,eP as Wd,$5 as Xd,JY as Yd,J5 as Zd,e3 as _d,$k as $d,Zk as ae,Jk as be,Xk as ce,zk as de,Q5 as ee,Qk as fe,Kk as ge,cC as he,Vk as ie,bJ as je,Bk as ke,C6 as le,xF as me,Mk as ne,jk as oe,gF as pe,hF as qe,SZ as re,xk as se,Ak as te,sF as ue,oF as ve,w8 as we,kk as xe,Kx as ye,bk as ze,fk as Ae,n0 as Be,Bx as Ce,vk as De,yk as Ee,_5 as Fe,gk as Ge,mk as He,Rx as Ie,hk as Je,Ax as Ke,pk as Le,lk as Me,uk as Ne,dk as Oe,ck as Pe};