@cortexkit/opencode-anthropic-auth 2.1.2 → 2.2.0

package/dist/{index-53nnxq39.js → index-czyrqpxc.js}

@@ -1,2 +1,2 @@
-import{randomUUID as h}from"node:crypto";import{mkdir as T,readFile as F,rename as b,rm as N,rmdir as w,stat as _,unlink as y,writeFile as I}from"node:fs/promises";import{tmpdir as m}from"node:os";import{dirname as d,join as P}from"node:path";import{formatQuota as v,isQuotaStale as c,logger as O,quotaDisplayProjection as u}from"@cortexkit/anthropic-auth-core";var n="OPENCODE_ANTHROPIC_AUTH_SIDEBAR_STATE_FILE",s=P(m(),"opencode-anthropic-auth"),i=P(s,"sidebar-state.json");function E(){return process.env[n]||i}var W={main:{quota:null},fallbacks:[],activeId:void 0,route:"main",relay:null,fastMode:!1,lastUpdated:0};function j(J){return J!==null&&typeof J==="object"&&!Array.isArray(J)}function z(J){return typeof J==="number"&&Number.isFinite(J)}function l(J){if(!j(J))return;let Z=Number(J.count),V=Number(J.inputTokens),X=Number(J.outputTokens),Y=Number(J.since);if(![Z,V,X,Y].every(Number.isFinite)||Z<0||V<0||X<0||Y<0)return;return{count:Math.floor(Z),inputTokens:Math.floor(V),outputTokens:Math.floor(X),since:Math.floor(Y)}}function o(J){if(!j(J))return;if(typeof J.id!=="string"||!J.id.trim())return;if(typeof J.label!=="string"||!J.label.trim())return;let Z={id:J.id.trim(),label:J.label.trim()};if(J.nextDueAt===null)Z.nextDueAt=null;else if(z(J.nextDueAt))Z.nextDueAt=J.nextDueAt;if(J.lastPrimedAt===null)Z.lastPrimedAt=null;else if(z(J.lastPrimedAt))Z.lastPrimedAt=J.lastPrimedAt;if(J.lastResult==="ok"||J.lastResult==="error"||J.lastResult==="skipped")Z.lastResult=J.lastResult;let V=l(J.usage);if(V)Z.usage=V;if(z(J.estimatedCostUsd))Z.estimatedCostUsd=J.estimatedCostUsd;return Z}function r(J){if(!j(J))return;if(typeof J.enabled!=="boolean")return;let Z=Array.isArray(J.accounts)?J.accounts.map(o).filter((V)=>V!=null):[];return{enabled:J.enabled,accounts:Z}}function q(J){if(!j(J))return;let Z=Number(J.usedPercent),V=Number(J.remainingPercent);if(!Number.isFinite(Z)||!Number.isFinite(V))return;return{usedPercent:Z,remainingPercent:V,resetsAt:typeof J.resetsAt==="string"?J.resetsAt:void 0,...z(J.checkedAt)&&{checkedAt:J.checkedAt}}}function R(J){if(!j(J))return null;let Z={};if(z(J.checkedAt))Z.checkedAt=J.checkedAt;let V=q(J.five_hour),X=q(J.seven_day);if(V)Z.five_hour=V;if(X)Z.seven_day=X;if(Array.isArray(J.scoped)){let Y=J.scoped.map((x)=>{if(!j(x))return;let $=q(x);if(!$)return;if(typeof x.id!=="string"||!x.id.trim())return;if(typeof x.title!=="string"||!x.title.trim())return;if(typeof x.modelName!=="string"||!x.modelName.trim())return;let K=typeof x.modelId==="string"&&x.modelId.trim()?x.modelId.trim():void 0;return{...$,id:x.id.trim(),title:x.title.trim(),...K&&{modelId:K},modelName:x.modelName.trim()}}).filter((x)=>x!=null);Z.scoped=Y}if(j(J.extraUsage)){let Y=D(J.extraUsage.used),x=D(J.extraUsage.limit);if(Y&&x&&typeof J.extraUsage.exhausted==="boolean")Z.extraUsage={used:Y,limit:x,...typeof J.extraUsage.utilizationPercent==="number"&&Number.isFinite(J.extraUsage.utilizationPercent)&&{utilizationPercent:J.extraUsage.utilizationPercent},...typeof J.extraUsage.severity==="string"&&{severity:J.extraUsage.severity},exhausted:J.extraUsage.exhausted}}if(typeof J.bindingWindow==="string"&&J.bindingWindow.trim())Z.bindingWindow=J.bindingWindow.trim();if(typeof J.fallbackAdvised==="boolean")Z.fallbackAdvised=J.fallbackAdvised;return Object.keys(Z).length?Z:null}function D(J){if(!j(J))return;if(!Number.isInteger(J.amountMinor)||typeof J.currency!=="string"||!/^[A-Za-z]{3}$/.test(J.currency.trim())||!Number.isInteger(J.exponent)||J.exponent<0||J.exponent>20)return;return{amountMinor:J.amountMinor,currency:J.currency.trim(),exponent:J.exponent}}function p(J){if(!j(J))return{...W};let Z={quota:null};if(j(J.main)){let $=J.main;if(Z.quota=R($.quota),typeof $.enabled==="boolean")Z.enabled=$.enabled;if(typeof $.stateLine==="string")Z.stateLine=$.stateLine;if($.quotaDated===!0)Z.quotaDated=!0;if(typeof $.tierLabel==="string"&&$.tierLabel.trim())Z.tierLabel=$.tierLabel.trim();if(typeof $.quotaBackedOff==="boolean")Z.quotaBackedOff=$.quotaBackedOff;if(typeof $.quotaBackoffUntil==="number")Z.quotaBackoffUntil=$.quotaBackoffUntil;if(typeof $.refreshBackedOff==="boolean")Z.refreshBackedOff=$.refreshBackedOff;if(typeof $.refreshBackoffUntil==="number")Z.refreshBackoffUntil=$.refreshBackoffUntil}let V=Array.isArray(J.fallbacks)?J.fallbacks.filter(j).filter(($)=>typeof $.id==="string").map(($)=>({id:$.id,label:typeof $.label==="string"?$.label:void 0,quota:R($.quota),enabled:typeof $.enabled==="boolean"?$.enabled:!1,...typeof $.stateLine==="string"&&{stateLine:$.stateLine},...$.quotaDated===!0&&{quotaDated:!0},needsReauth:typeof $.needsReauth==="boolean"?$.needsReauth:!1,...$.vaultReauth===!0&&{vaultReauth:!0},...$.vaultServed===!0&&{vaultServed:!0},...typeof $.custodyState==="string"&&{custodyState:$.custodyState},tierLabel:typeof $.tierLabel==="string"&&$.tierLabel.trim()?$.tierLabel.trim():void 0})):[],X=null;if(j(J.relay)){let $=J.relay;if(typeof $.enabled==="boolean"&&typeof $.transport==="string")X={enabled:$.enabled,transport:$.transport}}let Y;if(j(J.cacheKeep)){let $=J.cacheKeep;if(typeof $.enabled==="boolean")Y={enabled:$.enabled,window:typeof $.window==="string"?$.window:void 0,trackedSessions:typeof $.trackedSessions==="number"?$.trackedSessions:void 0}}let x=Array.isArray(J.fableRecoveries)?J.fableRecoveries.filter(j).flatMap(($)=>{if(typeof $.sessionId!=="string"||$.mode!=="opus"&&$.mode!=="fable"&&$.mode!=="server"||typeof $.remaining!=="number"||!Number.isFinite($.remaining)||typeof $.changedAt!=="number"||!Number.isFinite($.changedAt))return[];return[{sessionId:$.sessionId,mode:$.mode,remaining:Math.max(0,Math.floor($.remaining)),changedAt:$.changedAt,requestedModelId:typeof $.requestedModelId==="string"?$.requestedModelId:void 0,targetModelId:typeof $.targetModelId==="string"?$.targetModelId:void 0}]}):[];return{main:Z,fallbacks:V,activeId:typeof J.activeId==="string"?J.activeId:void 0,route:typeof J.route==="string"?J.route:W.route,relay:X,fastMode:typeof J.fastMode==="boolean"?J.fastMode:W.fastMode,cacheKeep:Y,prime:r(J.prime),fableRecoveries:x.length>0?x:void 0,lastUpdated:typeof J.lastUpdated==="number"?J.lastUpdated:0}}var H=Promise.resolve(),a=1000,t=2000,e=5,JJ=15,L=new Map;function zJ(J,Z=E()){if(J)L.set(Z,J);else L.delete(Z)}function U(J){return L.get(J)}var S=null;function CJ(J){S=J}function NJ(){return S}function ZJ(J){return new Promise((Z)=>setTimeout(Z,J))}async function k(J){let Z=`${J}.lock`,V=U(J),X=V?.lockBudgetMs??a,Y=V?.lockRetryMinMs??e,x=V?.lockRetryMaxMs??JJ,$=Date.now()+X;while(!0){try{await T(Z);let G=h(),B=P(Z,G);return await I(B,"",{encoding:"utf8",mode:384,flag:"wx"}),await V?.onLockAcquired?.(Z),{ownsLock:async()=>{try{return await _(B),!0}catch{return!1}},release:async()=>{try{await y(B)}catch{return}await V?.beforeReleaseDirectoryRemoval?.(Z),await w(Z).catch(()=>{})}}}catch(G){if(G.code!=="EEXIST")return O.trace("sidebar","state lock unavailable; write skipped",{stateFile:J,error:G instanceof Error?G.message:String(G)}),null}try{let G=await _(Z);if(Date.now()-G.mtimeMs>t){await V?.afterStaleLockStat?.(Z);let B=`${Z}.evict-${process.pid}-${h()}`;try{await b(Z,B)}catch(C){if(C.code==="ENOENT")continue;throw C}await V?.onStaleLockClaimed?.(Z),await N(B,{recursive:!0,force:!0}).catch(()=>{});continue}}catch(G){if(G.code==="ENOENT")continue;return O.trace("sidebar","state lock inspection failed; write skipped",{stateFile:J,error:G instanceof Error?G.message:String(G)}),null}let K=$-Date.now();if(K<=0)return O.warn("sidebar","lock budget exhausted, write skipped",{stateFile:J,budgetMs:X}),null;let Q=Y+Math.floor(Math.random()*(x-Y+1));await ZJ(Math.min(Q,K))}}async function WJ(J){return(await k(J))?.release??null}async function $J(J,Z,V){let X=U(J),Y=`${J}.${process.pid}.${h()}.tmp`;await I(Y,JSON.stringify(Z),{encoding:"utf8",mode:384});try{if(!await V())return O.trace("sidebar","state lock lost before rename; write aborted",{stateFile:J}),await N(Y,{force:!0}).catch(()=>{}),"lock-lost-before-rename";if(await X?.beforeRename?.(J,Y),!await V())return O.trace("sidebar","state lock lost before rename; write aborted",{stateFile:J}),await N(Y,{force:!0}).catch(()=>{}),"lock-lost-before-rename";if(await b(Y,J),await U(J)?.afterRename?.(J),!await V())return"lock-lost-after-rename";return"written"}catch(x){throw await N(Y,{force:!0}).catch(()=>{}),x}}async function g(J=E()){try{let Z=await F(J,"utf8");return p(JSON.parse(Z))}catch{return W}}async function HJ(J,Z=E(),V={}){return H=H.then(async()=>{await T(d(Z),{recursive:!0});for(let X=0;X<2;X++){let Y=X===1,x=await k(Z);if(!x){if(Y)O.warn("sidebar","post-rename repair lock unavailable; write skipped",{stateFile:Z});return}let $=J,K;try{if(V.routingAuthoritative===!1){let Q=await g(Z),G=await V.resolvePreservedRouting?.(Q);if(G){let B=G.state??J;$={...B,activeId:G.activeId,route:G.route,lastUpdated:Math.max(B.lastUpdated,Q.lastUpdated)}}await U(Z)?.afterMergeRead?.(Z)}else if(Y){let Q=await g(Z);$={...Q,activeId:J.activeId,route:J.route,relay:J.relay,fastMode:J.fastMode,cacheKeep:J.cacheKeep,lastUpdated:Math.max(Q.lastUpdated,J.lastUpdated)}}$=p($),K=await $J(Z,$,x.ownsLock)}finally{await x.release()}if(K==="lock-lost-after-rename"){if(Y){O.warn("sidebar","post-rename repair lost lock; write skipped",{stateFile:Z});return}O.warn("sidebar","state lock lost after rename; repairing write",{stateFile:Z});continue}if(K==="lock-lost-before-rename")return;V.onRoutingResolved?.({activeId:$.activeId,route:$.route});return}}).catch(()=>{}),H}async function UJ(){return H}function VJ(J){let Z=J.activeId;if(Z&&Z!=="main"){let V=J.fallbacks?.find((X)=>X.enabled&&X.id===Z);if(V)return{id:V.id,name:V.label??V.id,quota:V.quota,...V.stateLine&&{stateLine:V.stateLine,quotaDated:V.quotaDated}}}return{id:"main",name:"main",quota:J.main?.quota??null,...J.main?.stateLine&&{stateLine:J.main.stateLine,quotaDated:J.main.quotaDated}}}function f(J){if(J==="claude-mythos-5-1"||J?.startsWith("claude-mythos-5-1-"))return"Mythos 5.1";if(J==="claude-fable-5-1"||J?.startsWith("claude-fable-5-1-"))return"Fable 5.1";if(J==="claude-fable-5"||J?.startsWith("claude-fable-5-"))return"Fable 5";if(J==="claude-opus-5-5"||J?.startsWith("claude-opus-5-5-"))return"Opus 5.5";if(J==="claude-opus-5"||J?.startsWith("claude-opus-5-"))return"Opus 5";if(J==="claude-opus-4-8"||J?.startsWith("claude-opus-4-8-"))return"Opus 4.8";return J??"Fable 5"}function A(J){return new Date(J).toLocaleTimeString([],{hour:"2-digit",minute:"2-digit"})}function XJ(J){if(J===0)return"0";if(J<0.0001)return J.toExponential(2);return J.toFixed(Math.min(6,Math.max(0,4)))}function qJ(J){if(J.lastResult==="error")return{text:"err",hasError:!0};if(J.lastResult==="skipped")return{text:"skip",hasError:!1};if(J.nextDueAt&&J.nextDueAt>Date.now())return{text:A(J.nextDueAt),hasError:!1};if(J.lastPrimedAt)return{text:`primed ${A(J.lastPrimedAt)} ✓`,hasError:!1};if(J.usage?.count)return{text:`✓ ${J.usage.count} ≈ $${XJ(J.estimatedCostUsd??0)}`,hasError:!1};return{text:"—",hasError:!1}}function fJ(J,Z){let V=J.fableRecoveries?.find((X)=>X.sessionId===Z);if(!V)return;if(V.mode==="fable")return`${f(V.requestedModelId)} · restored`;if(V.mode==="server")return`${f(V.requestedModelId)}→${f(V.targetModelId)} · safety`;return`Opus 4.8 · ${V.remaining} left`}function hJ(J,Z=10){if(Z<=0)return"";let V=J;if(Bun.stringWidth(V)>Z){V="";for(let X of J){if(Bun.stringWidth(V+X)>Z-1)break;V+=X}V+="…"}return V+" ".repeat(Math.max(0,Z-Bun.stringWidth(V)))}function LJ(J,Z=Date.now()){let V=J?.five_hour?.usedPercent??null,X=J?.seven_day?.usedPercent??null,Y=J?.scoped??[],x=Y.map((K)=>K.usedPercent);if(!J||V==null&&X==null&&Y.length===0&&!J.extraUsage)return{fiveHourUsedPercent:V,sevenDayUsedPercent:X,scopedUsedPercents:x,text:null,stale:!1};let $=u(J,Z);return{fiveHourUsedPercent:V,sevenDayUsedPercent:X,scopedUsedPercents:x,text:v($,{now:Z,form:"narrow"}),stale:c($,{now:Z})}}function PJ(J,Z=!0){let V=VJ(J).id;return[{id:"main",name:"main",quota:J.main?.quota??null,quotaDated:J.main?.quotaDated,active:V==="main"},...Z?(J.fallbacks??[]).filter((X)=>X.enabled||X.custodyState&&X.custodyState!=="off").map((X)=>({id:X.id,name:X.label??X.id,quota:X.quota,quotaDated:X.quotaDated,active:V===X.id})):[]]}var EJ=18000000,MJ=604800000,xJ=300000,YJ=0.01,GJ=1;function _J(J,Z,V){if(!J.resetsAt)return null;let X=new Date(J.resetsAt).getTime();if(!Number.isFinite(X))return null;let Y=X-Z,x=V-Y;if(x<xJ)return null;if(x<Z*YJ)return null;if(x>=Z)return null;let $=J.usedPercent,K=Math.min(Math.max(x/Z*100,0),100),Q=$-K,G=Math.abs(Q)<GJ?"on-pace":Q>0?"deficit":"reserve",B=null;if($>0){let C=x*100/$,M=Y+C;if(M<X)B=new Date(M).toISOString()}return{pacePercent:K,deltaPercent:Q,state:G,runsOutAt:B}}
+import{randomUUID as h}from"node:crypto";import{mkdir as T,readFile as F,rename as b,rm as N,rmdir as w,stat as _,unlink as y,writeFile as I}from"node:fs/promises";import{tmpdir as m}from"node:os";import{dirname as d,join as P}from"node:path";import{formatQuota as v,isQuotaStale as c,logger as O,quotaDisplayProjection as u}from"@cortexkit/anthropic-auth-core";var n="OPENCODE_ANTHROPIC_AUTH_SIDEBAR_STATE_FILE",s=P(m(),"opencode-anthropic-auth"),i=P(s,"sidebar-state.json");function E(){return process.env[n]||i}var W={main:{quota:null},fallbacks:[],activeId:void 0,route:"main",relay:null,fastMode:!1,lastUpdated:0};function j(J){return J!==null&&typeof J==="object"&&!Array.isArray(J)}function z(J){return typeof J==="number"&&Number.isFinite(J)}function l(J){if(!j(J))return;let Z=Number(J.count),V=Number(J.inputTokens),X=Number(J.outputTokens),Y=Number(J.since);if(![Z,V,X,Y].every(Number.isFinite)||Z<0||V<0||X<0||Y<0)return;return{count:Math.floor(Z),inputTokens:Math.floor(V),outputTokens:Math.floor(X),since:Math.floor(Y)}}function o(J){if(!j(J))return;if(typeof J.id!=="string"||!J.id.trim())return;if(typeof J.label!=="string"||!J.label.trim())return;let Z={id:J.id.trim(),label:J.label.trim()};if(J.nextDueAt===null)Z.nextDueAt=null;else if(z(J.nextDueAt))Z.nextDueAt=J.nextDueAt;if(J.lastPrimedAt===null)Z.lastPrimedAt=null;else if(z(J.lastPrimedAt))Z.lastPrimedAt=J.lastPrimedAt;if(J.lastResult==="ok"||J.lastResult==="error"||J.lastResult==="skipped")Z.lastResult=J.lastResult;let V=l(J.usage);if(V)Z.usage=V;if(z(J.estimatedCostUsd))Z.estimatedCostUsd=J.estimatedCostUsd;return Z}function r(J){if(!j(J))return;if(typeof J.enabled!=="boolean")return;let Z=Array.isArray(J.accounts)?J.accounts.map(o).filter((V)=>V!=null):[];return{enabled:J.enabled,accounts:Z}}function q(J){if(!j(J))return;let Z=Number(J.usedPercent),V=Number(J.remainingPercent);if(!Number.isFinite(Z)||!Number.isFinite(V))return;return{usedPercent:Z,remainingPercent:V,resetsAt:typeof J.resetsAt==="string"?J.resetsAt:void 0,...z(J.checkedAt)&&{checkedAt:J.checkedAt}}}function R(J){if(!j(J))return null;let Z={};if(z(J.checkedAt))Z.checkedAt=J.checkedAt;let V=q(J.five_hour),X=q(J.seven_day);if(V)Z.five_hour=V;if(X)Z.seven_day=X;if(Array.isArray(J.scoped)){let Y=J.scoped.map((x)=>{if(!j(x))return;let $=q(x);if(!$)return;if(typeof x.id!=="string"||!x.id.trim())return;if(typeof x.title!=="string"||!x.title.trim())return;if(typeof x.modelName!=="string"||!x.modelName.trim())return;let K=typeof x.modelId==="string"&&x.modelId.trim()?x.modelId.trim():void 0;return{...$,id:x.id.trim(),title:x.title.trim(),...K&&{modelId:K},modelName:x.modelName.trim()}}).filter((x)=>x!=null);Z.scoped=Y}if(j(J.extraUsage)){let Y=D(J.extraUsage.used),x=D(J.extraUsage.limit);if(Y&&x&&typeof J.extraUsage.exhausted==="boolean")Z.extraUsage={used:Y,limit:x,...typeof J.extraUsage.utilizationPercent==="number"&&Number.isFinite(J.extraUsage.utilizationPercent)&&{utilizationPercent:J.extraUsage.utilizationPercent},...typeof J.extraUsage.severity==="string"&&{severity:J.extraUsage.severity},exhausted:J.extraUsage.exhausted}}if(typeof J.bindingWindow==="string"&&J.bindingWindow.trim())Z.bindingWindow=J.bindingWindow.trim();if(typeof J.fallbackAdvised==="boolean")Z.fallbackAdvised=J.fallbackAdvised;return Object.keys(Z).length?Z:null}function D(J){if(!j(J))return;if(!Number.isInteger(J.amountMinor)||typeof J.currency!=="string"||!/^[A-Za-z]{3}$/.test(J.currency.trim())||!Number.isInteger(J.exponent)||J.exponent<0||J.exponent>20)return;return{amountMinor:J.amountMinor,currency:J.currency.trim(),exponent:J.exponent}}function p(J){if(!j(J))return{...W};let Z={quota:null};if(j(J.main)){let $=J.main;if(Z.quota=R($.quota),typeof $.enabled==="boolean")Z.enabled=$.enabled;if(typeof $.stateLine==="string")Z.stateLine=$.stateLine;if($.quotaDated===!0)Z.quotaDated=!0;if(typeof $.tierLabel==="string"&&$.tierLabel.trim())Z.tierLabel=$.tierLabel.trim();if(typeof $.quotaBackedOff==="boolean")Z.quotaBackedOff=$.quotaBackedOff;if(typeof $.quotaBackoffUntil==="number")Z.quotaBackoffUntil=$.quotaBackoffUntil;if(typeof $.refreshBackedOff==="boolean")Z.refreshBackedOff=$.refreshBackedOff;if(typeof $.refreshBackoffUntil==="number")Z.refreshBackoffUntil=$.refreshBackoffUntil}let V=Array.isArray(J.fallbacks)?J.fallbacks.filter(j).filter(($)=>typeof $.id==="string").map(($)=>({id:$.id,label:typeof $.label==="string"?$.label:void 0,quota:R($.quota),enabled:typeof $.enabled==="boolean"?$.enabled:!1,...typeof $.stateLine==="string"&&{stateLine:$.stateLine},...$.quotaDated===!0&&{quotaDated:!0},needsReauth:typeof $.needsReauth==="boolean"?$.needsReauth:!1,...$.vaultReauth===!0&&{vaultReauth:!0},...$.vaultServed===!0&&{vaultServed:!0},...typeof $.custodyState==="string"&&{custodyState:$.custodyState},tierLabel:typeof $.tierLabel==="string"&&$.tierLabel.trim()?$.tierLabel.trim():void 0})):[],X=null;if(j(J.relay)){let $=J.relay;if(typeof $.enabled==="boolean"&&typeof $.transport==="string")X={enabled:$.enabled,transport:$.transport}}let Y;if(j(J.cacheKeep)){let $=J.cacheKeep;if(typeof $.enabled==="boolean")Y={enabled:$.enabled,window:typeof $.window==="string"?$.window:void 0,trackedSessions:typeof $.trackedSessions==="number"?$.trackedSessions:void 0}}let x=Array.isArray(J.fableRecoveries)?J.fableRecoveries.filter(j).flatMap(($)=>{if(typeof $.sessionId!=="string"||$.mode!=="opus"&&$.mode!=="fable"&&$.mode!=="server"||typeof $.remaining!=="number"||!Number.isFinite($.remaining)||typeof $.changedAt!=="number"||!Number.isFinite($.changedAt))return[];return[{sessionId:$.sessionId,mode:$.mode,remaining:Math.max(0,Math.floor($.remaining)),changedAt:$.changedAt,requestedModelId:typeof $.requestedModelId==="string"?$.requestedModelId:void 0,targetModelId:typeof $.targetModelId==="string"?$.targetModelId:void 0}]}):[];return{main:Z,fallbacks:V,activeId:typeof J.activeId==="string"?J.activeId:void 0,route:typeof J.route==="string"?J.route:W.route,relay:X,fastMode:typeof J.fastMode==="boolean"?J.fastMode:W.fastMode,cacheKeep:Y,prime:r(J.prime),fableRecoveries:x.length>0?x:void 0,lastUpdated:typeof J.lastUpdated==="number"?J.lastUpdated:0}}var H=Promise.resolve(),a=1000,t=2000,e=5,JJ=15,L=new Map;function zJ(J,Z=E()){if(J)L.set(Z,J);else L.delete(Z)}function U(J){return L.get(J)}var S=null;function CJ(J){S=J}function NJ(){return S}function ZJ(J){return new Promise((Z)=>setTimeout(Z,J))}async function k(J){let Z=`${J}.lock`,V=U(J),X=V?.lockBudgetMs??a,Y=V?.lockRetryMinMs??e,x=V?.lockRetryMaxMs??JJ,$=Date.now()+X;while(!0){try{await T(Z);let G=h(),B=P(Z,G);return await I(B,"",{encoding:"utf8",mode:384,flag:"wx"}),await V?.onLockAcquired?.(Z),{ownsLock:async()=>{try{return await _(B),!0}catch{return!1}},release:async()=>{try{await y(B)}catch{return}await V?.beforeReleaseDirectoryRemoval?.(Z),await w(Z).catch(()=>{})}}}catch(G){if(G.code!=="EEXIST")return O.trace("sidebar","state lock unavailable; write skipped",{stateFile:J,error:G instanceof Error?G.message:String(G)}),null}try{let G=await _(Z);if(Date.now()-G.mtimeMs>t){await V?.afterStaleLockStat?.(Z);let B=`${Z}.evict-${process.pid}-${h()}`;try{await b(Z,B)}catch(C){if(C.code==="ENOENT")continue;throw C}await V?.onStaleLockClaimed?.(Z),await N(B,{recursive:!0,force:!0}).catch(()=>{});continue}}catch(G){if(G.code==="ENOENT")continue;return O.trace("sidebar","state lock inspection failed; write skipped",{stateFile:J,error:G instanceof Error?G.message:String(G)}),null}let K=$-Date.now();if(K<=0)return O.warn("sidebar","lock budget exhausted, write skipped",{stateFile:J,budgetMs:X}),null;let Q=Y+Math.floor(Math.random()*(x-Y+1));await ZJ(Math.min(Q,K))}}async function WJ(J){return(await k(J))?.release??null}async function $J(J,Z,V){let X=U(J),Y=`${J}.${process.pid}.${h()}.tmp`;await I(Y,JSON.stringify(Z),{encoding:"utf8",mode:384});try{if(!await V())return O.trace("sidebar","state lock lost before rename; write aborted",{stateFile:J}),await N(Y,{force:!0}).catch(()=>{}),"lock-lost-before-rename";if(await X?.beforeRename?.(J,Y),!await V())return O.trace("sidebar","state lock lost before rename; write aborted",{stateFile:J}),await N(Y,{force:!0}).catch(()=>{}),"lock-lost-before-rename";if(await b(Y,J),await U(J)?.afterRename?.(J),!await V())return"lock-lost-after-rename";return"written"}catch(x){throw await N(Y,{force:!0}).catch(()=>{}),x}}async function g(J=E()){try{let Z=await F(J,"utf8");return p(JSON.parse(Z))}catch{return W}}async function HJ(J,Z=E(),V={}){return H=H.then(async()=>{await T(d(Z),{recursive:!0});for(let X=0;X<2;X++){let Y=X===1,x=await k(Z);if(!x){if(Y)O.warn("sidebar","post-rename repair lock unavailable; write skipped",{stateFile:Z});return}let $=J,K;try{if(V.routingAuthoritative===!1){let Q=await g(Z),G=await V.resolvePreservedRouting?.(Q);if(G){let B=G.state??J;$={...B,activeId:G.activeId,route:G.route,lastUpdated:Math.max(B.lastUpdated,Q.lastUpdated)}}await U(Z)?.afterMergeRead?.(Z)}else if(Y){let Q=await g(Z);$={...Q,activeId:J.activeId,route:J.route,relay:J.relay,fastMode:J.fastMode,cacheKeep:J.cacheKeep,lastUpdated:Math.max(Q.lastUpdated,J.lastUpdated)}}$=p($),K=await $J(Z,$,x.ownsLock)}finally{await x.release()}if(K==="lock-lost-after-rename"){if(Y){O.warn("sidebar","post-rename repair lost lock; write skipped",{stateFile:Z});return}O.warn("sidebar","state lock lost after rename; repairing write",{stateFile:Z});continue}if(K==="lock-lost-before-rename")return;V.onRoutingResolved?.({activeId:$.activeId,route:$.route});return}}).catch(()=>{}),H}async function UJ(){return H}function VJ(J){let Z=J.activeId;if(Z&&Z!=="main"){let V=J.fallbacks?.find((X)=>X.enabled&&X.id===Z);if(V)return{id:V.id,name:V.label??V.id,quota:V.quota,...V.stateLine&&{stateLine:V.stateLine,quotaDated:V.quotaDated}}}return{id:"main",name:"main",quota:J.main?.quota??null,...J.main?.stateLine&&{stateLine:J.main.stateLine,quotaDated:J.main.quotaDated}}}function f(J){if(J==="claude-mythos-5-1"||J?.startsWith("claude-mythos-5-1-"))return"Mythos 5.1";if(J==="claude-fable-5-1"||J?.startsWith("claude-fable-5-1-"))return"Fable 5.1";if(J==="claude-fable-5"||J?.startsWith("claude-fable-5-"))return"Fable 5";if(J==="claude-opus-5-5"||J?.startsWith("claude-opus-5-5-"))return"Opus 5.5";if(J==="claude-opus-5"||J?.startsWith("claude-opus-5-"))return"Opus 5";if(J==="claude-opus-4-8"||J?.startsWith("claude-opus-4-8-"))return"Opus 4.8";return J??"Fable 5"}function A(J){return new Date(J).toLocaleTimeString([],{hour:"2-digit",minute:"2-digit"})}function XJ(J){if(J===0)return"0";if(J<0.0001)return J.toExponential(2);return J.toFixed(Math.min(6,Math.max(0,4)))}function qJ(J,Z=Date.now()){if(J.lastResult==="error")return{text:"err",hasError:!0};if(J.lastResult==="skipped")return{text:"skip",hasError:!1};if(J.nextDueAt&&J.nextDueAt>Z)return{text:A(J.nextDueAt),hasError:!1};if(J.lastPrimedAt)return{text:`primed ${A(J.lastPrimedAt)} ✓`,hasError:!1};if(J.usage?.count)return{text:`✓ ${J.usage.count} ≈ $${XJ(J.estimatedCostUsd??0)}`,hasError:!1};return{text:"—",hasError:!1}}function fJ(J,Z){let V=J.fableRecoveries?.find((X)=>X.sessionId===Z);if(!V)return;if(V.mode==="fable")return`${f(V.requestedModelId)} · restored`;if(V.mode==="server")return`${f(V.requestedModelId)}→${f(V.targetModelId)} · safety`;return`Opus 4.8 · ${V.remaining} left`}function hJ(J,Z=10){if(Z<=0)return"";let V=J;if(Bun.stringWidth(V)>Z){V="";for(let X of J){if(Bun.stringWidth(V+X)>Z-1)break;V+=X}V+="…"}return V+" ".repeat(Math.max(0,Z-Bun.stringWidth(V)))}function LJ(J,Z=Date.now()){let V=J?.five_hour?.usedPercent??null,X=J?.seven_day?.usedPercent??null,Y=J?.scoped??[],x=Y.map((K)=>K.usedPercent);if(!J||V==null&&X==null&&Y.length===0&&!J.extraUsage)return{fiveHourUsedPercent:V,sevenDayUsedPercent:X,scopedUsedPercents:x,text:null,stale:!1};let $=u(J,Z);return{fiveHourUsedPercent:V,sevenDayUsedPercent:X,scopedUsedPercents:x,text:v($,{now:Z,form:"narrow"}),stale:c($,{now:Z})}}function PJ(J,Z=!0){let V=J.activeId===void 0?void 0:VJ(J).id;return[{id:"main",name:"main",quota:J.main?.quota??null,quotaDated:J.main?.quotaDated,active:V==="main"},...Z?(J.fallbacks??[]).filter((X)=>X.enabled||X.custodyState&&X.custodyState!=="off").map((X)=>({id:X.id,name:X.label??X.id,quota:X.quota,quotaDated:X.quotaDated,active:V===X.id})):[]]}var EJ=18000000,MJ=604800000,xJ=300000,YJ=0.01,GJ=1;function _J(J,Z,V){if(!J.resetsAt)return null;let X=new Date(J.resetsAt).getTime();if(!Number.isFinite(X))return null;let Y=X-Z,x=V-Y;if(x<xJ)return null;if(x<Z*YJ)return null;if(x>=Z)return null;let $=J.usedPercent,K=Math.min(Math.max(x/Z*100,0),100),Q=$-K,G=Math.abs(Q)<GJ?"on-pace":Q>0?"deficit":"reserve",B=null;if($>0){let C=x*100/$,M=Y+C;if(M<X)B=new Date(M).toISOString()}return{pacePercent:K,deltaPercent:Q,state:G,runsOutAt:B}}
 export{E as G,W as H,p as I,zJ as J,CJ as K,NJ as L,WJ as M,g as N,HJ as O,UJ as P,VJ as Q,f as R,A as S,XJ as T,qJ as U,fJ as V,hJ as W,LJ as X,PJ as Y,EJ as Z,MJ as _,_J as $};

package/dist/index-pden7a7y.js

@@ -0,0 +1,2 @@
+import{I as $}from"./index-czyrqpxc.js";var D=(f)=>f!==null&&typeof f==="object"&&!Array.isArray(f),F=(f)=>D(f)&&typeof f.sessionId==="string"&&f.sessionId.length>0,A=(f)=>{if(!F(f)||!D(f)||f.command!=="claude"||typeof f.sectionId!=="string"||typeof f.actionId!=="string")return!1;if(f.itemId!==void 0&&typeof f.itemId!=="string")return!1;if(f.confirmed!==void 0&&typeof f.confirmed!=="boolean")return!1;if(f.values!==void 0&&(!D(f.values)||!Object.values(f.values).every((q)=>q===null||typeof q==="string"||typeof q==="boolean"||typeof q==="number"&&Number.isFinite(q))))return!1;return!0};function B(f){return{"~standard":{version:1,vendor:"cortexkit-native",validate:(q)=>f(q)?{value:q}:{issues:[{message:"Invalid native menu payload"}]}}}}var Z=(f)=>D(f)&&f.command==="claude"&&D(f.menu)&&f.menu.command==="claude"&&typeof f.menu.title==="string"&&Array.isArray(f.menu.sections),L=(f)=>D(f)&&f.command==="claude"&&typeof f.ok==="boolean"&&typeof f.text==="string"&&D(f.menu)&&Array.isArray(f.menu.sections),M={"~standard":{version:1,vendor:"cortexkit-native",validate:(f)=>({value:$(f)})}},P={id:"cortexkit-anthropic-native",methods:{open:{input:B(F),output:B(Z)},apply:{input:B(A),output:B(L)},sidebar:{input:B(F),output:M}},events:{opened:{schema:B((f)=>F(f)&&Z(f.payload))},notification:{schema:B((f)=>F(f)&&typeof f.message==="string"&&["info","warning","error"].includes(String(f.kind)))}}};async function U(f,q,Q){let W=new AbortController,J=(j)=>({sessionId:j,notify(H,K="info"){G.events.emit("notification",{sessionId:j,message:H,kind:K}).catch(()=>{})}}),G=await f.rpc.register(P,{open:(j)=>q.open(J(j.sessionId)),apply:(j)=>q.apply(j,J(j.sessionId)),sidebar:(j)=>Q.readSidebar(j.sessionId)}),X;try{X=await f.command.transform((j)=>j.add({name:"claude",description:"Native Claude accounts and settings",async execute(H){let K=await q.open(J(H.sessionID));await G.events.emit("opened",{sessionId:H.sessionID,payload:K})}}))}catch(j){throw await G.dispose(),j}let z=(async()=>{try{for await(let j of f.event.subscribe({signal:W.signal}))if(j.type==="session.deleted")Q.forgetSession(j.data.sessionID)}catch{}})(),Y=!1;return{async dispose(){if(Y)return;Y=!0,W.abort(),await Promise.all([G.dispose(),X.dispose(),z])}}}
+export{P as t,U as u};

package/dist/index.js

@@ -1 +1 @@
-import{p as a}from"./index-x325vp4e.js";import"./index-6chd6jnr.js";import"./index-hazrk5c3.js";import"./index-b1dvkp15.js";import"./index-53nnxq39.js";import"./index-ah5s0bew.js";import"./index-f2ne65w4.js";export{a as AnthropicAuthPlugin};
+import{p as a}from"./index-ccrq4mra.js";import"./index-6chd6jnr.js";import"./index-hazrk5c3.js";import"./index-b1dvkp15.js";import"./index-czyrqpxc.js";import"./index-ah5s0bew.js";import"./index-f2ne65w4.js";export{a as AnthropicAuthPlugin};

package/dist/sidebar-state.d.ts

@@ -158,7 +158,7 @@ export declare function resolveActiveAccount(state: SidebarState): {
 export declare function formatFallbackModelLabel(modelId: string | undefined): string;
 export declare function formatPrimeTime(epochMs: number): string;
 export declare function formatPrimeCost(value: number): string;
-export declare function formatPrimeAccountValue(account: PrimeSidebarAccountState): {
+export declare function formatPrimeAccountValue(account: PrimeSidebarAccountState, now?: number): {
     text: string;
     hasError: boolean;
 };

package/dist/sidebar-state.js

@@ -1 +1 @@
-import{$ as v,G as a,H as b,I as c,J as d,K as e,L as f,M as g,N as h,O as i,P as j,Q as k,R as l,S as m,T as n,U as o,V as p,W as q,X as r,Y as s,Z as t,_ as u}from"./index-53nnxq39.js";import"./index-f2ne65w4.js";export{i as setSidebarState,k as resolveActiveAccount,c as normalizeSidebarState,a as getSidebarStateFile,h as getSidebarState,f as getInitialSidebarRoutingTestHooks,p as getFableRecoverySummary,r as getCollapsedQuotaSummary,s as getCollapsedAccounts,q as formatQuotaRowLabel,m as formatPrimeTime,n as formatPrimeCost,o as formatPrimeAccountValue,l as formatFallbackModelLabel,j as drainSidebarWrites,v as computeQuotaPacing,d as __setSidebarStateWriteTestHooks,e as __setInitialSidebarRoutingTestHooks,g as __acquireSidebarStateLockForTest,u as SEVEN_DAY_MS,t as FIVE_HOUR_MS,b as DEFAULT_SIDEBAR_STATE};
+import{$ as v,G as a,H as b,I as c,J as d,K as e,L as f,M as g,N as h,O as i,P as j,Q as k,R as l,S as m,T as n,U as o,V as p,W as q,X as r,Y as s,Z as t,_ as u}from"./index-czyrqpxc.js";import"./index-f2ne65w4.js";export{i as setSidebarState,k as resolveActiveAccount,c as normalizeSidebarState,a as getSidebarStateFile,h as getSidebarState,f as getInitialSidebarRoutingTestHooks,p as getFableRecoverySummary,r as getCollapsedQuotaSummary,s as getCollapsedAccounts,q as formatQuotaRowLabel,m as formatPrimeTime,n as formatPrimeCost,o as formatPrimeAccountValue,l as formatFallbackModelLabel,j as drainSidebarWrites,v as computeQuotaPacing,d as __setSidebarStateWriteTestHooks,e as __setInitialSidebarRoutingTestHooks,g as __acquireSidebarStateLockForTest,u as SEVEN_DAY_MS,t as FIVE_HOUR_MS,b as DEFAULT_SIDEBAR_STATE};

package/dist/transform.d.ts

@@ -99,6 +99,10 @@ export declare function rewriteRequestBody(body: string, options?: {
     midConversationEffortEnabled?: boolean;
     midConversationEffortPlan?: string;
     midConversationEffortResolvedPlan?: OpenCodeEffortMarkerPlan;
+    turnEndNoteEnabled?: boolean;
+    turnEndNote?: {
+        tools: string[];
+    };
     perf?: RewritePerfCallback;
     hybridStandbyAnchor?: HybridMessageCacheAnchor;
     serverSideFallbackEnabled?: boolean;

package/dist/tui/claude-sidebar.d.ts

@@ -0,0 +1,94 @@
+/** @jsxImportSource @opentui/solid */
+import { type RGBA } from '@opentui/core';
+import { type JSX } from 'solid-js';
+import { type AccountQuota, type SidebarState } from '../sidebar-state.js';
+import { type AnthropicAuthTuiPrefs, type AppearancePrefs } from '../tui-preferences.js';
+export type SidebarColor = RGBA | string;
+/** The flat theme tokens the sidebar draws with; OpenCode 1's `theme.current` has them all. */
+export interface SidebarTheme {
+    readonly text: SidebarColor;
+    readonly textMuted: SidebarColor;
+    readonly success: SidebarColor;
+    readonly warning: SidebarColor;
+    readonly error: SidebarColor;
+    readonly accent: SidebarColor;
+    readonly background: SidebarColor;
+    readonly borderActive: SidebarColor;
+}
+export declare function AccountBlock(props: {
+    theme: SidebarTheme;
+    appearance: AppearancePrefs;
+    name: string;
+    quota: AccountQuota | null;
+    active: boolean;
+    pacingEnabled: boolean;
+    needsReauth?: boolean;
+    vaultReauth?: boolean;
+    stateLine?: string;
+    quotaDated?: boolean;
+    tierLabel?: string;
+    marginTop?: number;
+    now: number;
+}): any;
+export interface SidebarController {
+    prefs: () => AnthropicAuthTuiPrefs;
+    collapsed: () => boolean;
+    toggleCollapsed: () => void;
+    /** Stops the preference watcher; OpenCode 1 keeps it for the process. */
+    dispose: () => void;
+}
+export declare function createSidebarController(initialPrefs: AnthropicAuthTuiPrefs): SidebarController;
+/** The sidebar panel for one session; the host owns polling and the theme. */
+export declare function ClaudeSidebar(props: {
+    state: () => SidebarState;
+    theme: () => SidebarTheme;
+    controller: SidebarController;
+    sessionId: string;
+}): any;
+/** The OpenCode 2 theme tokens the sidebar reads (`ResolvedTheme` subset). */
+export interface HostTheme {
+    readonly text: {
+        readonly base: SidebarColor;
+        readonly muted: SidebarColor;
+        readonly action: {
+            readonly primary: {
+                readonly base: SidebarColor;
+            };
+        };
+        readonly feedback: {
+            readonly success: {
+                readonly base: SidebarColor;
+            };
+            readonly warning: {
+                readonly base: SidebarColor;
+            };
+            readonly error: {
+                readonly base: SidebarColor;
+            };
+        };
+    };
+    readonly background: {
+        readonly base: SidebarColor;
+    };
+    readonly border: {
+        readonly base: SidebarColor;
+    };
+}
+/** OpenCode 2's semantic theme as the flat tokens OpenCode 1 provides. */
+export declare function sidebarThemeFromHost(theme: HostTheme): SidebarTheme;
+/** The OpenCode 2 TUI context members the sidebar uses. */
+export interface ClaudeSidebarHost {
+    readonly theme: HostTheme;
+    readonly ui: {
+        slot(claim: {
+            readonly append: 'sidebar.content';
+            readonly render: (input: {
+                readonly sessionID: string;
+            }) => JSX.Element;
+        }): () => void;
+    };
+}
+/** Reads one session's sidebar state from the location's server. */
+export type ReadSidebarState = (sessionID: string, signal: AbortSignal) => Promise<SidebarState>;
+/** Claims the OpenCode 2 session sidebar; the returned function releases it. */
+export declare function mountClaudeSidebar(host: ClaudeSidebarHost, read: ReadSidebarState): Promise<() => void>;

package/dist/v2/menu-contract.d.ts

@@ -1,8 +1,11 @@
 import type { NativeMenuCommandId, NativeMenuDispatch } from '@cortexkit/anthropic-auth-core';
+import type { SidebarState } from '../sidebar-state';
 /** Account, setting and session actions exposed through the server's menu RPC. */
 export interface NativeMenuCapabilities {
     readonly dispatch: NativeMenuDispatch;
     readonly readStatus: (command: Exclude<NativeMenuCommandId, 'start'>) => Promise<string>;
+    /** The quota sidebar's state for one session; carries no secrets. */
+    readonly readSidebar: (sessionID: string) => Promise<SidebarState>;
     readonly forgetSession: (sessionID: string) => void;
     readonly close: () => void;
 }

package/dist/v2/rpc.d.ts

@@ -2,6 +2,7 @@ import type { CommandApplyRequest, CommandApplyResult, CommandDialogPayload, Com
 import type { Plugin } from '@opencode/plugin';
 import type { Registration } from '@opencode/plugin/promise/registration';
 import type { StandardSchemaV1 } from '@standard-schema/spec';
+import { type SidebarState } from '../sidebar-state';
 import type { NativeMenuCapabilities } from './menu-contract';
 export declare const NATIVE_MENU_RPC: {
     readonly id: 'cortexkit-anthropic-native';
@@ -22,6 +23,14 @@ export declare const NATIVE_MENU_RPC: {
             }>;
             readonly output: StandardSchemaV1<CommandApplyResult, CommandApplyResult>;
         };
+        readonly sidebar: {
+            readonly input: StandardSchemaV1<Record<string, unknown> & {
+                sessionId: string;
+            }, Record<string, unknown> & {
+                sessionId: string;
+            }>;
+            readonly output: StandardSchemaV1<unknown, SidebarState>;
+        };
     };
     readonly events: {
         readonly opened: {

package/dist/v2/server.js

@@ -1,4 +1,4 @@
-import{a as O2,b as E$,c as x$,d as e2,e as $$,f as E2,g as N2,h as X$,i as J$,j as R$,k as Z$,l as Y$,m as W$,n as G$,o as j$,p as I$}from"../index-x325vp4e.js";import"../index-6chd6jnr.js";import"../index-hazrk5c3.js";import{u as b$}from"../index-jexctf5w.js";import{v as k$,w as D$,y as w$}from"../index-0kxy8k2c.js";import"../index-b1dvkp15.js";import"../index-53nnxq39.js";import"../index-ah5s0bew.js";import"../index-f2ne65w4.js";import{acquireNativeAccountRuntime as JX,authorize as ZX,createNativeUi as YX,disconnectNativeVaultForHost as WX,exchange as GX,logger as q$,readNativeEnrollmentMode as jX,resolveNativePoolPaths as VX}from"@cortexkit/anthropic-auth-core";class _2 extends Error{kind;providerID;sessionID;requestKind;constructor(X){super(X.message??`${X.providerID} ${X.requestKind} request refused (${X.kind})`);this.name="OpenCode2AuthError",this.kind=X.kind,this.providerID=X.providerID,this.sessionID=X.sessionID,this.requestKind=X.requestKind}}function B2(X){return`common-auth-placeholder.${X}`}function c2(X){let J=B2(X.integrationID);return{type:"oauth",methodID:X.methodID,access:J,refresh:J,expires:X.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function q2(X,J){if(X?.type!=="oauth")return!1;let _=J===void 0?void 0:B2(J),W=(L)=>_===void 0?L.startsWith("common-auth-placeholder."):L===_;return W(X.access)&&W(X.refresh)}var i2="No browser sign-in: this connects the plugin to the accounts in its vault.";async function k2(X,J){let _=J.now??Date.now,{integrationID:W}=J,L=(F)=>c2({integrationID:W,methodID:F,now:_()}),T=async(F,U)=>{return await J.onLogin(F,{integrationID:W,methodID:U}),L(U)},N=(F)=>async(U)=>{let Y=F.method.id,M=await F.authorize(U),j={url:M.url,instructions:M.instructions,...M.expiresAt===void 0?{}:{expiresAt:M.expiresAt}};if(M.mode==="auto")return{...j,mode:"auto",callback:M.callback.then((O)=>T(O,Y))};let Q=M.callback;return{...j,mode:"code",callback:async(O)=>T(await Q(O),Y)}};return X.integration.transform((F)=>{let U=J.label===void 0?{}:{label:()=>J.label};for(let j of J.methods)F.method.update({integrationID:W,method:j.method,authorize:N(j),refresh:async(Q)=>{if(!q2(Q,W))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return L(Q.methodID)},...U});let Y=J.vault;if(Y===void 0)return;let M=Y.method.id;F.method.update({integrationID:W,method:Y.method,authorize:async()=>({url:"",instructions:Y.instructions??i2,mode:"auto",callback:Promise.resolve().then(()=>Y.activate({integrationID:W,methodID:M})).then(()=>L(M))}),refresh:async(j)=>{if(!q2(j,W)||j.methodID!==M)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return L(M)},...U})})}function f$(X){let J=[],_;for(let W of X.split(/\r?\n/))if(W.startsWith("data:"))J.push(W.slice(5).replace(/^ /,""));else if(W.startsWith("event:"))_=W.slice(6).trim();if(J.length===0)return;return _===void 0?{data:J.join(`
-`)}:{event:_,data:J.join(`
-`)}}function D2(X,J){let _=new TextDecoder,W="",L=(N)=>{let F=f$(N);if(!F)return;try{X(F)}catch(U){J(U)}},T=()=>{for(;;){let N=/\r?\n\r?\n/.exec(W);if(!N)return;let F=W.slice(0,N.index);W=W.slice(N.index+N[0].length),L(F)}};return new TransformStream({transform(N,F){F.enqueue(N),W+=_.decode(N,{stream:!0}),T()},flush(){if(W+=_.decode(),T(),W.trim()!=="")L(W);W=""}})}var o2=512,H2="x-common-auth-attempt",Q2=(X,J)=>JSON.stringify([X,J]),G2=(X)=>({providerID:X.model.providerID,modelID:X.model.id,sessionID:X.sessionID,agent:X.agent,kind:X.kind});function v$(X){let J=X.headers;return typeof J==="object"&&J!==null}function g$(X,J){let _=X.getReader();return new ReadableStream({async pull(W){let L;try{L=await _.read()}catch(T){J({reason:"failed",message:T instanceof Error?T.message:String(T)}),W.error(T);return}if(L.done)J(),W.close();else W.enqueue(L.value)},async cancel(W){J({reason:"cancelled",...W===void 0?{}:{message:String(W)}}),await _.cancel(W)}})}function w2(X,J){for(let[_,W]of Object.entries(J)){let L=_.toLowerCase();for(let T of Object.keys(X))if(T.toLowerCase()===L)delete X[T];if(W!==null)X[_]=W}}function h$(X,J){for(let[_,W]of Object.entries(J))if(W===null)X.delete(_);else X.set(_,W)}async function b2(X,J,_={}){let{providerID:W}=J,L=_.gateOnPlaceholder,T=($)=>L===void 0||L.credential($)===B2(W),N=_.logger,F=Math.max(1,_.maxRecords??o2),U=[..._.hostCredentials??[B2(W)],...L?[B2(W)]:[]].filter(($)=>$!==""),Y=new Map,M=new WeakMap,j=new Map,Q=new Set,O=new Map,k=!1,x=!1,l=new Map,I=0,c=!1,n=new Map,o=($,G)=>{try{N?.warn($,G)}catch{}},Z=($)=>$ instanceof Error?$.message:String($),V=async($,G)=>{let C=l.get($);if(!C||C.size===0)return;await Promise.all([...C].map(async(P)=>{try{await P(G)}catch(y){o("opencode2 auth listener threw; the request is unaffected",{event:$,error:Z(y)})}}))},B=async($,G)=>{try{await J.onAttemptEnd?.($,G)}catch(C){o("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:$.attemptId,error:Z(C)})}},E=($,G)=>{if($.ended||!$.attempt)return;let C={...$.status===void 0?{}:{status:$.status},outputStarted:$.outputStarted,...$.limit?{limit:$.limit.signal}:{},...G?{error:G}:{}};if(G)$.endError=G;$.ended=B($.attempt,C)},S=($,G)=>E($,{reason:"abandoned",message:G}),q=($)=>[...Y.values()].filter((G)=>G.key===$),g=($)=>q($).at(-1),m=($)=>{if(Y.delete($.id),!q($.key).length)j.delete($.key)},r=($)=>{Y.set($.id,$);while(Y.size>F){let G=Y.values().next().value;if(G===void 0)break;S(G,"dropped to keep the record bound"),m(G)}},f=($)=>$.accountId===void 0?void 0:{...$.scope,accountId:$.accountId},p=($,G)=>new _2({kind:"no-account",providerID:W,sessionID:$.sessionID,requestKind:$.kind,...G===void 0?{}:{message:G}}),d=($)=>{n.get($)?.clear(),n.delete($)},e=async($,G)=>{let C=()=>p($,`${W} ${$.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(c)throw C();let P=n.get($.sessionID);if(!P)P=new Set,n.set($.sessionID,P);let y={};P.add(y);let h=()=>{if(!P.has(y))throw C()};try{return await G(h)}finally{if(P.delete(y),P.size===0&&n.get($.sessionID)===P)n.delete($.sessionID)}},K=($,G)=>{for(let[C,P]of G)if(U.some((y)=>P.includes(y)))throw new _2({kind:"host-credential-on-wire",providerID:W,sessionID:$.sessionID,requestKind:$.kind,message:`${W} ${$.kind} request still carries the host's placeholder credential in ${C}; the adapter's account headers must replace it`})},z=($)=>{for(let G of q($))if(G.ended||!G.attempt)m(G);else if(G.transport==="ws"||G.judged)S(G,"a newer attempt of its session and kind began"),m(G)},H=async($,G,C,P)=>{let y=Q2($.sessionID,$.kind),h=j.get(y);j.delete(y);let D=h?.accountId??g(y)?.accountId;z(y);let v={...$,...D===void 0?{}:{previousAccountId:D},...h?.rerouteFrom===void 0?{}:{rerouteFrom:h.rerouteFrom}},i=await J.chooseAccount(v);C();let W2={},u2;if(i!==void 0){let T2=await J.accountHeaders({...$,accountId:i});if(C(),v$(T2))W2=T2.headers,u2=T2.attempt;else W2=T2}let p2=`attempt-${++I}`,M2={id:p2,key:y,scope:$,accountId:i,headers:W2,attempt:i===void 0?void 0:{...$,accountId:i,attemptId:p2,transport:P,data:u2},...P===void 0?{}:{transport:P},outputStarted:!1};if(r(M2),M2.attempt)V("select",{...$,accountId:M2.attempt.accountId,hook:G,...v.previousAccountId===void 0?{}:{previousAccountId:v.previousAccountId},...v.rerouteFrom===void 0?{}:{rerouteFrom:v.rerouteFrom},handle:M2.attempt});return M2},A=async($,G,C,P,y)=>{let h=Q2($.sessionID,$.kind),D=P===void 0?void 0:Y.get(P);if(D?.key!==h)D=void 0;if(!D){if(D=g(h),q(h).filter((i)=>i.transport===void 0&&!i.ended).length>1&&!x)x=!0,o("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:$.sessionID,kind:$.kind})}if(!D||D.transport!==void 0||D.ended)D=await H($,G,y,C);else if(D.transport=C,D.attempt)D.attempt.transport=C;if(C==="ws"){for(let v of q(h))if(v!==D&&v.transport==="ws")S(v,"a newer attempt of its session and kind went out over WebSocket")}return D},R=async($,G)=>{try{return await G()}catch(C){throw E($,{reason:"failed",message:Z(C)}),C}},b=($,G)=>{let C=q(Q2($,G)).filter((P)=>P.transport==="ws").at(-1);return C?.attempt!==void 0&&!C.ended?C:void 0},w=($,G,C)=>{let P=f($);if(!P||!$.attempt||$.limit)return;$.limit={signal:G,delivered:V("limit",{...P,via:C,limit:G,outputStarted:$.outputStarted,handle:$.attempt})}},a=($,G,C,P)=>{let y=f($);if(!y||!$.attempt)return;V("quota",{...y,transport:G,...P===void 0?{}:{status:P},quota:C,handle:$.attempt})},u=($,G,C,P)=>{let y=$.attempt;if(!y)return;let h=J.inspectEvent?.(P===void 0?{transport:G,data:C,attempt:y}:{transport:G,data:C,event:P,attempt:y});if(!h)return;if(h.quota!==void 0)a($,G,h.quota);if(h.outputStarted)$.outputStarted=!0;if(h.limit)w($,h.limit,G);if(h.error!==void 0)E($,{reason:"failed",message:h.error});else if(h.done)E($)},X2=($,G)=>{let C=$.attempt;if(!C||G.accountId===$.accountId)return;if(C.reboundFrom??=C.accountId,C.accountId=G.accountId,"data"in G)C.data=G.data;$.accountId=G.accountId},J2=($)=>!$.attempt||$.endError!==void 0||$.status!==void 0&&$.status>=400,Z2=($)=>{let G=[...Y.values()].filter((v)=>v.scope.sessionID===$),C=G.filter((v)=>v.limit&&!v.rerouted).at(-1);if(C)return C;let P=G.filter((v)=>v.scope.kind==="primary"),y=P.length>0?P:G;if(y.length<=1)return y[0];let h=y.filter((v)=>!v.judged&&J2(v)).at(-1);if(h)return h;let D=y.filter((v)=>v.attempt&&!v.ended);if(D.length>1)return"ambiguous";return D[0]??y.at(-1)},$2={providerID:W},s=[];s.push(await X.session.hook("model.request",($)=>{if(L)return;return e(G2($),async(G)=>{let C=await H(G2($),"model.request",G);if(G(),C.accountId===void 0)throw p(C.scope);w2($.headers,{...C.headers,[H2]:C.id})})},$2)),s.push(await X.session.hook("http.request",($)=>{if(L){let G=T($.request.headers);if(O.set($.sessionID,G),!G)return}return e(G2($),async(G)=>{let C=$.request.headers.get(H2)??void 0,P=L?await H(G2($),"http.request",G,"http"):await A(G2($),"http.request","http",C,G);G();let y=f(P),h=P.attempt;if(!y||!h)throw p(P.scope);await R(P,async()=>{let D=$.request;if(J.rewriteRequest){if(C!==void 0){let W2=new Headers(D.headers);W2.delete(H2),D=new Request(D,{headers:W2})}D=await J.rewriteRequest({...y,request:D,attempt:h})??D,G()}let v=new Headers(D.headers);v.delete(H2),h$(v,P.headers),K(P.scope,v.entries());let i=new Request(D,{headers:v});M.set(i,P),$.request=i})})},$2)),s.push(await X.session.hook("http.response",async($)=>{let G=M.get($.request);if(!G){if(L)return;if(!k)k=!0,o("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:$.sessionID,kind:$.kind});return}let C=$.response;if(J.answeredBy&&G.attempt){let v=G.attempt,i=await R(G,async()=>J.answeredBy?.({request:$.request,response:C,attempt:v}));if(i)X2(G,i)}let P=f(G),y=G.attempt;if(!P||!y)return;G.status=C.status;let h=J.quotaFromHeaders?.(C.headers,C.status,y);if(h!==void 0)a(G,"http",h,C.status);if(!C.ok&&J.limitFromResponse){let v=await J.limitFromResponse({status:C.status,headers:C.headers,body:()=>C.clone().text(),attempt:y});if(v)w(G,v,"http")}if(!C.ok||!C.body)E(G);let D=C;if(C.body&&(J.inspectEvent||J.onAttemptEnd)){let v=C.body;if(J.inspectEvent)v=v.pipeThrough(D2((i)=>u(G,"http",i.data,i.event),(i)=>o("opencode2 auth event inspection threw",{error:Z(i)})));D=new Response(g$(v,(i)=>E(G,i)),{status:C.status,statusText:C.statusText,headers:C.headers})}if(J.rewriteResponse)D=await J.rewriteResponse({...P,request:$.request,response:D,attempt:y})??D;if(D!==C)$.response=D},$2)),s.push(await X.session.hook("experimental.ws.handshake",($)=>{if(L){let G=T(new Headers($.headers)),C=Q2($.sessionID,$.kind);if(O.set($.sessionID,G),Q.delete(C),!G)return}return e(G2($),async(G)=>{let C;for(let D of Object.keys($.headers)){if(D.toLowerCase()!==H2)continue;C??=$.headers[D],delete $.headers[D]}let P=L?await H(G2($),"experimental.ws.handshake",G,"ws"):await A(G2($),"experimental.ws.handshake","ws",C,G);G();let y=f(P),h=P.attempt;if(!y||!h)throw p(P.scope);await R(P,async()=>{w2($.headers,P.headers);let D=J.rewriteHandshakeURL?.({...y,url:$.url,attempt:h});if(D!==void 0)$.url=D;if(K(P.scope,Object.entries($.headers)),L)Q.add(P.key)})})},$2));let t=J.rewriteWebSocketFrame?.bind(J);if(t)s.push(await X.session.hook("experimental.ws.send",async($)=>{let G=G2($);if(L&&!Q.has(Q2(G.sessionID,G.kind)))return;let C=b(G.sessionID,G.kind),P=await t({...G,attempt:C?.attempt,frame:$.frame});if(P!==void 0)$.frame=P},$2));s.push(await X.session.hook("experimental.ws.receive",($)=>{if(L&&!Q.has(Q2($.sessionID,$.kind)))return;let G=b($.sessionID,$.kind);if(!G)return;try{u(G,"ws",$.frame)}catch(C){o("opencode2 auth frame inspection threw",{error:Z(C)})}},$2)),s.push(await X.session.hook("retry",async($)=>{if(L&&O.get($.sessionID)!==!0)return;let G=Z2($.sessionID);if(!G)return;let C=$.decision;if(G==="ambiguous"){await V("retry",{sessionID:$.sessionID,attempt:$.attempt,reason:"host-decides",hostDecision:C,decision:C});return}let P=G;await e(P.scope,async(y)=>{P.judged=!0;let h=C,D,v,i=P.attempt;if(P.accountId===void 0||!i)h={retry:!1},D="no-account";else if(P.outputStarted)h={retry:!1},D="output-started";else{if(!P.limit){let W2=J.limitFromError?.($.error,i);if(W2)w(P,W2,"error")}if(P.ended)await P.ended,y();if(P.limit)await P.limit.delivered,y(),P.rerouted=!0,v={accountId:P.accountId,limit:P.limit.signal},h={retry:!0,delay:0},D="reroute";else D="host-decides"}if($.decision=h,h.retry&&P.accountId!==void 0)j.set(P.key,{sessionID:P.scope.sessionID,accountId:P.accountId,...v===void 0?{}:{rerouteFrom:v}});await V("retry",{sessionID:$.sessionID,...P.accountId===void 0?{}:{accountId:P.accountId},kind:P.scope.kind,attempt:$.attempt,reason:D,hostDecision:C,decision:h,...i===void 0?{}:{handle:i}})})},$2));let j2=($)=>{d($),O.delete($);for(let G of Q)if(JSON.parse(G)[0]===$)Q.delete(G);for(let G of[...Y.values()]){if(G.scope.sessionID!==$)continue;S(G,"its session was forgotten"),Y.delete(G.id)}for(let[G,C]of j)if(C.sessionID===$)j.delete(G)},Y2=new AbortController,V2=X.event;if(V2)(async()=>{try{for await(let $ of V2.subscribe({signal:Y2.signal}))if($.type==="session.deleted")j2($.data.sessionID)}catch($){if(!Y2.signal.aborted)o("opencode2 auth stopped listening for session deletion",{error:Z($)})}})();return{on($,G){let C=l.get($);if(!C)C=new Set,l.set($,C);let P=G;return C.add(P),()=>{C.delete(P)}},accountFor($,G){return g(Q2($,G))?.accountId},forgetSession:j2,get size(){return Y.size},async dispose(){if(c)return;c=!0;for(let $ of n.keys())d($);Y2.abort();for(let $ of Y.values())S($,"the installation was disposed");Y.clear(),j.clear(),Q.clear(),O.clear(),l.clear(),await Promise.all(s.map(async($)=>{try{await $.dispose()}catch(G){o("opencode2 auth hook did not dispose cleanly",{error:Z(G)})}}))}}}import{CacheKeepManager as K1,CacheKeepSessionRegistry as H1,getDefaultCacheKeepRegistryDirectory as U1,isCacheKeepActiveNow as K$,isCacheKeepHybridActive as f2,isCacheKeepSubagentsEnabled as v2,logger as z1}from"@cortexkit/anthropic-auth-core";import{createHash as m$}from"node:crypto";import{applyCustomHeaders as l$,assertNotCustodyTombstone as d$,classifyGzipRejection as u$,createProviderErrorRedactor as n2,createProviderErrorResponseScope as r2,decideRequestGzip as p$,encodeGzipRequestBody as c$,getAccountStoragePath as i$,getRequestGzipLatch as o$,getRequestGzipLatchPath as n$,mergeAnthropicBetas as r$,remapModelId as s2,remapRequestBodyModel as s$,stripEmptyTrailingAssistantMessages as a$,TrailingAssistantHistoryError as t$}from"@cortexkit/anthropic-auth-core";var L2="anthropic",V$="x-common-auth-attempt",e$=["x-session-affinity","x-opencode-session","x-parent-session-id",e2,O2,N2,V$],F2=new Set(["authorization","x-api-key"]),$1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",X1=512,J1=5000,Z1=500,a2=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class B$ extends Error{sessionID;requestKind;kind="no-account";providerID=L2;constructor(X,J){super($1);this.sessionID=X;this.requestKind=J;this.name="NativeAnthropicNoAccountError"}}class I2 extends Error{sessionID;requestKind;kind="session-forgotten";providerID=L2;constructor(X,J){super("request refused: its session was closed while it was being prepared");this.sessionID=X;this.requestKind=J;this.name="NativeAnthropicRevokedError"}}class U2 extends Error{kind="unsupported-transport";providerID=L2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class Q$ extends Error{kind="local-invalid-request";status=400;check;constructor(X){super(X.message,{cause:X});this.name="NativeAnthropicLocalRefusal",this.check=X.check}}var K2=(X)=>typeof X==="object"&&X!==null&&!Array.isArray(X);function C2(X){try{return JSON.parse(X)}catch{return}}function y2(X){let J={};for(let[_,W]of Object.entries(X??{}))J[_.toLowerCase()]=W;return J}function t2(X){let J={};for(let _ of e$){let W=X.get(_);if(W!==null&&_!==V$)J[_]=W;X.delete(_)}return J}function Y1(X){try{return new URL(X).pathname.endsWith("/messages")}catch{return!1}}function W1(X){return X instanceof t$||X instanceof $$?new Q$(X):void 0}function G1(X,J){let _=[];if(X.oauth)_.push(X.oauth.accessToken);for(let[W,L]of Object.entries(X.apiHeaders??{})){if(L===null||!F2.has(W))continue;_.push(L.replace(/^Bearer\s+/i,""))}for(let W of F2){let L=J.get(W);if(L!==null)_.push(L.replace(/^Bearer\s+/i,""))}if(X.dispatch?.kind==="http-relay")_.push(X.dispatch.token);return[...new Set(_.filter(Boolean))]}var j1=new Set(["oauth-2025-04-20","claude-code-20250219",J$]);function V1(X){let J=X.split(",").map((_)=>_.trim()).filter((_)=>_&&!j1.has(_));return r$(null,J)}function B1(X){let J=C2(X);if(!K2(J))return X;let _=a$(J.messages),W=Object.hasOwn(J,"fallbacks"),{droppedMarkers:L}=Z$(J,!1),T=W&&!Object.hasOwn(J,"fallbacks"),N=s$(J);return _>0||L>0||T||N?JSON.stringify(J):X}async function Q1(X,J){if(!(X instanceof Promise))return"settled";let _;try{return await Promise.race([X.then(()=>"settled"),new Promise((W)=>{_=setTimeout(()=>W("timed-out"),J)})])}finally{if(_!==void 0)clearTimeout(_)}}function z2(X){let{source:J,log:_}=X,W=Math.max(1,X.maxPendingSends??X1),L=X.attemptEndTimeoutMs??J1,T=X.requestGzipLatch??o$(n$(i$())),N=new WeakSet,F=new Map,U=new WeakMap,Y=new WeakMap,M=new WeakMap,j=new Map,Q=new WeakMap,O=n2([]);O.dispose();let k=(K)=>(K&&j.get(K)?.redactor)??O,x=(K)=>{let z=j.get(K);if(!z)return;j.delete(K),z.redactor.dispose(),z.scope.dispose()},l=(K,z,H,A)=>{let R=G1(z,A),b=r2(R,H);I.set(K,H),j.set(K,{sessionID:z.sessionID,redactor:n2(R),scope:b}),b.settled.then(()=>x(K));while(j.size>W){let w=j.keys().next().value;if(w===void 0)break;x(w)}},I=new WeakMap,c=(K,z)=>{let H=K?I.get(K):void 0;if(!H||!z.ok)return O.redactResponse(z);let A=r2([],H),R=A.redactResponse(z);return A.dispose(),R},n=(K,z)=>{let H=K?j.get(K)?.scope:void 0;if(!H)return c(K,z);try{return H.redactResponse(z)}catch{return c(K,z)}},o=!1,Z=new WeakMap,V=(K,z)=>{if(K&&!z.ok)Z.set(z.headers,K);return z},B=(K,z)=>{if(z.dispatch!=="http-relay")return!0;let H=/^req_[A-Za-z0-9_-]+$/.test(K.get("request-id")??"");return Y.set(z,H),H},E=(K)=>new B$(K.sessionID,K.kind),S=new Map,q=async(K,z)=>{if(o)throw new I2(K.sessionID,K.kind);let H={revoked:!1},A=S.get(K.sessionID);if(!A)A=new Set,S.set(K.sessionID,A);A.add(H);let R=()=>{if(o||H.revoked)throw new I2(K.sessionID,K.kind)};try{let b=await z(R);return R(),b}finally{let b=S.get(K.sessionID);if(b?.delete(H)&&b.size===0)S.delete(K.sessionID)}},g=(K,z)=>{F.set(K,z);while(F.size>W){let H=F.keys().next().value;if(H===void 0)break;F.delete(H),_?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:W})}},m=(K,z)=>({providerID:K.providerID,modelID:K.modelID,sessionID:K.sessionID,agent:K.agent,kind:K.kind,accountId:K.accountId,attemptId:K.attemptId,transport:K.transport,route:z.route,provenance:z.provenance,dispatch:z.dispatch}),r=(K)=>q(K,async(z)=>{let{accountId:H,...A}=K,R=await J.authorizeAccount(A,H);return z(),f(A,R)}),f=(K,z)=>{if(!z)throw E(K);if(z.dispatch?.kind==="websocket-relay")throw new U2;let H=z.dispatch?.kind==="http-relay"?"http-relay":"direct",A=z.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":z.dispatch.token}:void 0;if(z.route==="oauth"){if(!z.accessToken)throw E(K);d$(z.accessToken,L2);let w=Object.freeze({route:"oauth",provenance:z.provenance,dispatch:H});g(w,{sessionID:K.sessionID,oauth:{accessToken:z.accessToken,...z.identity?{identity:z.identity}:{}},dispatch:z.dispatch,oauthHeaders:z.headers});let a=y2(z.headers);for(let u of F2)delete a[u];return delete a["anthropic-beta"],{headers:A??{...a,"x-api-key":null,authorization:`Bearer ${z.accessToken}`},attempt:w}}let R={authorization:null,"x-api-key":null,...y2(z.headers)};if(!R.authorization&&!R["x-api-key"])throw E(K);let b=Object.freeze({route:"api",provenance:z.provenance,dispatch:H});return g(b,{sessionID:K.sessionID,...z.baseURL?{baseURL:z.baseURL}:{},dispatch:z.dispatch,apiHeaders:R}),{headers:A??R,attempt:b}},p=(K)=>q(K,(z)=>d(K,z)),d=async(K,z)=>{let{request:H,attempt:A}=K,R=A.data,b=R?F.get(R):void 0;if(R)F.delete(R);if(!R||!b||R.route==="oauth"&&!b.oauth)throw E(K);let w=new Headers(H.headers);l$(w);let a=t2(w),u=H.body===null?void 0:await H.text();z();let X2=u!==void 0&&Y1(H.url);try{if(R.route==="oauth"&&b.oauth){let{accessToken:s,identity:t}=b.oauth;for(let[Y2,V2]of Object.entries(y2(b.oauthHeaders))){if(F2.has(Y2))continue;if(V2===null)w.delete(Y2);else w.set(Y2,V2)}let j2=null;if(u!==void 0&&X2){let Y2={...m(A,R),modelID:(()=>{let G=C2(u);return s2(K2(G)&&typeof G.model==="string"?G.model:K.modelID)})(),route:"oauth",correlation:a},V2=await J.requestOptions?.(Y2)??{};z(),u=await G$(u,{...V2,...t?{identity:t}:{},sessionId:K.sessionID,onToolNameMap:(G)=>M.set(R,G)});let $=C2(u);j2=K2($)?$:null}Y$(w,s,{body:j2,...t?{identity:t}:{},requestClass:X$(A.agent)?"auxiliary":"main"})}else{if(u!==void 0&&X2)u=B1(u);w.delete("authorization"),w.delete("x-api-key");for(let[t,j2]of Object.entries(b.apiHeaders??{}))if(j2===null)w.delete(t);else w.set(t,j2);if(u!==void 0&&X2&&!w.has("content-type"))w.set("content-type","application/json");let s=w.get("anthropic-beta");if(s!==null){let t=V1(s);if(t)w.set("anthropic-beta",t);else w.delete("anthropic-beta")}}}catch(s){let t=W1(s);if(!t)throw s;throw U.set(R,t.check),_?.warn("refused an Anthropic request locally; nothing was sent",{check:t.check}),t}let J2=u!==void 0?C2(u):void 0;if(await J.admitRequest?.({...m(A,R),modelID:s2(K2(J2)&&typeof J2.model==="string"?J2.model:K.modelID)}),t2(w),u!==void 0)w.delete("content-length");z(),l(R,b,K2(J2)&&J2.stream===!0?"event-stream":"http",w);let Z2=W$(H.url,b.baseURL!==void 0?{baseURL:b.baseURL}:{}).url?.toString()??H.url;if(R.route==="oauth"&&X2&&u!==void 0)await J.onRequestPrepared?.({...m(A,R),url:Z2,bodyText:u}),z();if(b.dispatch?.kind==="http-relay"){let s=u??"";w.delete("x-relay-token");let t={protocol:1,type:"request",affinity:K.sessionID,upstream:{url:Z2,method:H.method,headers:Object.fromEntries(w)},mode:"full_sync",revision:1,body:s,next_hash:`sha256:${m$("sha256").update(s).digest("hex")}`};return new Request(b.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":b.dispatch.token},redirect:"error",signal:H.signal,body:JSON.stringify(t)})}let $2=u;if(R.route==="oauth"&&X2&&u!==void 0){let s=await p$({url:Z2,body:u,latch:T});if(z(),s.gzip)$2=await c$(u),w.set("content-encoding","gzip"),N.add(R),z()}return new Request(Z2,{method:H.method,headers:w,redirect:H.redirect,signal:H.signal,...$2!==void 0?{body:$2}:{}})};return{adapter:{providerID:L2,chooseAccount:(K)=>q(K,async()=>{let z=await J.chooseAccount(K);if(!z)throw E(K);return z}),accountHeaders:r,rewriteRequest:p,rewriteHandshakeURL(){throw new U2},rewriteResponse({response:K,attempt:z}){let H=z.data;if(H&&!B(K.headers,H)){if(K.status===401)return x(H),K.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return n(H,K)}if(H&&N.has(H))N.delete(H),u$(K).then((a)=>{if(!a)return;T.latchProcess(),_?.warn("gzipped request body rejected; later requests go uncompressed",{kind:a,status:K.status})},()=>{});let A=n(H,K);if(H?.route!=="oauth"||!A.body)return V(H,A);let R={...m(z,H),status:K.status},b=J.responseOptions?.(R)??{},w=(K.headers.get("content-type")??"").includes("application/json");return V(H,j$(A,{...b,toolNameMap:M.get(H),onToolNameRefusal:()=>{U.set(H,"response_tool_names"),x(H)},laneStartOAuthServed:!0,...w?{responseMode:"json"}:{}}))},quotaFromHeaders(K,z,H){let A=H.data;if(!A||!B(K,A))return;return J.quotaFromHeaders?.(K,{...m(H,A),status:z})},async limitFromResponse({status:K,headers:z,body:H,attempt:A}){let R=A.data;if(!R||U.get(R)==="response_tool_names")return;if(!B(z,R))return J.limitFromRelayFailure?.({...m(A,R),status:K});if(Q.set(R,`provider responded with HTTP ${K}`),!J.limitFromResponse)return;let b=Z.get(z)===R,w=k(R);return J.limitFromResponse({...m(A,R),status:K,headers:z,body:async()=>b?await H():w.redactText(await H())})},inspectEvent({data:K,event:z,attempt:H}){if(H.data&&U.get(H.data)==="response_tool_names")return;let A=C2(K);if(!K2(A))return;let R=typeof A.type==="string"?A.type:z;if(R==="content_block_start"||R==="content_block_delta")return{outputStarted:!0};if(R==="message_stop")return{done:!0};if(R!=="error")return;let b=H.data,w=k(b),a=K2(A.error)?A.error:{},u=typeof a.type!=="string"?void 0:a2.has(a.type)?a.type:w.redactText(a.type),X2=typeof a.message==="string"?w.redactText(a.message):void 0;if(b?.dispatch==="http-relay"&&Y.get(b)===!1)return;let J2=b?J.limitFromStreamError?.({...m(H,b),errorType:u,message:X2}):void 0,Z2={error:[u??"error",X2].filter(Boolean).join(": ").slice(0,Z1),...J2?{limit:J2}:{}};if(b&&Z2.error)Q.set(b,Z2.error);return Z2},limitFromError(K,z){let H=z.data;if(!H||U.has(H))return;let A={type:a2.has(K.type)?K.type:"provider_error",message:Q.get(H)??"provider request failed",...K.status!==void 0?{status:K.status}:{}};if(x(H),H.dispatch==="http-relay"&&Y.get(H)===!1)return;return J.limitFromHostError?.(A,m(z,H))},async onAttemptEnd(K,z){let H=K.data;if(!H)return;F.delete(H);let A=z.error?.reason;if(A==="cancelled"||A==="abandoned"||A===void 0&&(z.status===void 0||z.status<400))x(H);let R=U.get(H),{status:b,...w}=z,a=J.onAttemptEnd?.(m(K,H),{...w,...b!==void 0&&(H.dispatch!=="http-relay"||Y.get(H)===!0)?{status:b}:{},...R!==void 0?{localRefusal:{check:R}}:{}});if(await Q1(a,L)==="timed-out")_?.warn("the account source did not finish recording a send",{timeoutMs:L})}},dispose(){o=!0;for(let[K,z]of S){for(let H of z)H.revoked=!0;J.forgetSession?.(K)}S.clear(),F.clear();for(let K of[...j.keys()])x(K)},forgetSession(K){for(let z of S.get(K)??[])z.revoked=!0;S.delete(K);for(let[z,H]of F)if(H.sessionID===K)F.delete(z);for(let[z,H]of[...j])if(H.sessionID===K)x(z);J.forgetSession?.(K)},get pendingSendCount(){return F.size},get heldCredentialCount(){let K=0;for(let z of F.values())if(z.oauth)K++;return K},get heldRedactorCount(){return j.size},get operationsInProgress(){let K=0;for(let z of S.values())K+=z.size;return K}}}function P2(X){return JSON.stringify([X.source,X.accountIdentity,X.credentialId,X.binding?.storageId,X.binding?.rowId,X.binding?.credentialEpoch])}function H$(X){let{runtime:J,source:_}=X,W=new AbortController,L=!1,T=new H1({directory:X.registryDirectory||process.env.OPENCODE_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR||U1("opencode"),now:X.now}),N=new Map,F=async(j,Q,O)=>{let k=O?AbortSignal.any([W.signal,O]):W.signal;k.throwIfAborted();let x=JSON.parse(await Q.text()),l={providerID:"anthropic",modelID:x.model,sessionID:`oc2-cachekeep:${j.id}`,agent:"cachekeep",kind:"generate"},I=z2({source:{..._,onRequestPrepared:void 0,responseOptions:void 0,async requestOptions(V){return{...await _.requestOptions?.(V),laneStart:!1,billingLineage:void 0,cacheDiagnosticsPreviousMessageId:void 0}},async authorizeAccount(V,B){let E=await J.read();k.throwIfAborted();let S=E.accounts.find((g)=>g.id===B);if(S?.type!=="oauth"||P2(S)!==j.oauthAccountIdentity||j.isSubagent&&!v2(E.policyStorage)||!f2(E.policyStorage)||!K$(E.policyStorage,new Date(X.now?.()??Date.now())))return;let q=await _.authorizeAccount(V,B);if(q?.provenance.kind==="local"&&P2({...S,binding:q.provenance.subject.binding,accountIdentity:q.provenance.subject.binding.identity})!==j.oauthAccountIdentity)return;if(q?.provenance.kind==="vault"&&q.provenance.credentialId!==S.credentialId)return;return q},async admitRequest(V){await _.admitRequest?.(V);let B=await J.read(),E=B.accounts.find((S)=>S.id===V.accountId);if(k.throwIfAborted(),!E||P2(E)!==j.oauthAccountIdentity||j.isSubagent&&!v2(B.policyStorage)||!f2(B.policyStorage)||!K$(B.policyStorage,new Date(X.now?.()??Date.now())))throw Error("CacheKeep policy changed before dispatch")}}}),c,n,o=!1,Z=()=>I.forgetSession(l.sessionID);k.addEventListener("abort",Z,{once:!0});try{let V=(await J.read()).accounts.find((m)=>P2(m)===j.oauthAccountIdentity)?.id;if(!V)throw Error("CacheKeep account is unavailable");let B=await I.adapter.accountHeaders({...l,accountId:V});if(!("headers"in B)||typeof B.headers!=="object"||B.headers===null||typeof B.attempt!=="object"||B.attempt===null||B.attempt.route!=="oauth")throw Error("CacheKeep authorization refused");c={...l,accountId:V,attemptId:crypto.randomUUID(),transport:"http",data:B.attempt};let E=await I.adapter.rewriteRequest?.({...l,accountId:V,attempt:c,request:new Request(j.url,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(x),signal:k})});if(!E)throw Error("CacheKeep rewrite refused");k.throwIfAborted();let S=await(X.fetch??fetch)(E),q=await I.adapter.rewriteResponse?.({...l,accountId:V,attempt:c,request:E,response:S});if(!q)throw Error("CacheKeep response rewrite refused");if(n=q.status,I.adapter.quotaFromHeaders?.(q.headers,q.status,c),!q.ok)await I.adapter.limitFromResponse?.({status:n,headers:q.headers,body:()=>q.clone().text(),attempt:c});let g=await q.arrayBuffer();return o=!0,new Response(g,{status:n,headers:q.headers})}catch{throw Error("Native CacheKeep was not completed")}finally{k.removeEventListener("abort",Z);try{if(c)await I.adapter.onAttemptEnd?.(c,{status:n,outputStarted:!1,...o?{}:{error:{reason:"cancelled"}}})}finally{I.dispose(),_.forgetSession?.(l.sessionID)}}},U=X.setIntervalImpl??globalThis.setInterval,Y=new K1({loadStorage:async()=>L?null:(await J.read()).policyStorage,now:X.now,setIntervalImpl:(j,Q)=>U(()=>Y.tick().catch(()=>{z1.warn("cachekeep","tick failed")}),Q),clearIntervalImpl:X.clearIntervalImpl,onTrackedSessionsChanged:(j)=>T.publish(L?[]:j),prepareHeaders(j,Q,O){if(L)return;return N.set(O.id,{target:Q,attempt:O}),new Headers({"x-native-cachekeep-attempt":String(O.id)})},fetchImpl:async(j,Q)=>{let O=new Request(j,Q),k=Number(O.headers.get("x-native-cachekeep-attempt")),x=N.get(k);if(N.delete(k),!x)throw Error("CacheKeep attempt is unavailable");return F(x.target,O,x.attempt.signal)},onComplete:({attempt:j})=>{N.delete(j.id)}}),M;return{async track(j){if(L||j.route!=="oauth"||j.agent==="cachekeep"||j.agent==="prime"||j.kind!=="primary")return;let Q=await J.read();if(L||!f2(Q.policyStorage))return;let O=!1;try{O=await X.isSubagent?.(j.sessionID)??!1}catch{return}if(L||O&&!v2(Q.policyStorage))return;let k=Q.accounts.find((x)=>x.id===j.accountId);if(!k?.accountIdentity)return;if(j.provenance.kind==="local"&&JSON.stringify(k.binding)!==JSON.stringify(j.provenance.subject.binding))return;if(j.provenance.kind==="vault"&&k.credentialId!==j.provenance.credentialId)return;Y.track({sessionId:j.sessionID,url:j.url,headers:new Headers,bodyText:j.bodyText,storage:Q.policyStorage,cacheMode:"hybrid",oauthAccountId:j.accountId,oauthAccountIdentity:P2(k),isSubagent:O}),await T.publish(Y.trackedSessions())},registry:T,dispose(){if(M)return M;return L=!0,Y.stop(),W.abort(),M=(async()=>{try{await Y.tick()}finally{N.clear(),await T.dispose()}})(),M}}}async function U$(X,J,_){let W=z2(J),L=[],T=async(Q,O,k)=>{let x=await X.session.hook(Q,O,k);return L.push(x),x},N=new AbortController,F;try{F=await b2({session:{hook:T},event:X.event},W.adapter,{logger:J.log,gateOnPlaceholder:_})}catch(Q){throw W.dispose(),await Promise.allSettled(L.map((O)=>O.dispose())),Q}let U=(Q)=>{W.forgetSession(Q),F.forgetSession(Q)},Y=X.event,M=Y?(async()=>{try{for await(let Q of Y.subscribe({signal:N.signal}))if(Q.type==="session.deleted")U(Q.data.sessionID)}catch(Q){if(!N.signal.aborted)J.log?.warn("stopped listening for session deletion",{error:Q instanceof Error?Q.name:"unknown"})}})():Promise.resolve(),j;return{installation:F,forgetSession:U,dispose(){if(j)return j;return W.dispose(),N.abort(),j=(async()=>{await F.dispose(),await M})(),j}}}import{effectiveRelayTransport as z$,getQuotaCheckIntervalMs as M1,logger as _1,nativeAccountCanServe as C1,oauthProfileIsFresh as L1,quotaSnapshotCheckedAt as N1}from"@cortexkit/anthropic-auth-core";function M$(X,J){let _=new AbortController,W,L=!1,T=async()=>{let U=await X.read();if(_.signal.throwIfAborted(),U.policyStorage.relay?.enabled===!0&&z$(U.policyStorage.relay.transport,U.policyStorage.relay.url)==="websocket")return;let Y=U,M=M1(Y.policyStorage);for(let j of Y.accounts){if(_.signal.aborted)return;if(!C1(j)||j.type!=="oauth")continue;if(Y.policyStorage.quota?.enabled!==!1&&Date.now()-N1(j.quota)>=M)await X.fetchQuota(j.id,J,_.signal,void 0,"background").catch(()=>{});if(!L1(j.profile)&&!_.signal.aborted)await X.fetchProfile(j.id,J,_.signal).catch(()=>{})}},N=()=>{if(L||W)return W;return W=T().catch(()=>{if(!_.signal.aborted)_1.debug("opencode2","native background readings did not complete")}).finally(()=>{W=void 0}),W},F=X.vault.watch({intervalMs:60000,onRefresh:N,shouldRefresh:async()=>{let U=await X.read();return U.policyStorage.relay?.enabled!==!0||z$(U.policyStorage.relay.transport,U.policyStorage.relay.url)==="http"}});return F.ready.catch(()=>{}),{async dispose(){L=!0,F.close(),_.abort(),await W}}}import{authorize as P1,buildCacheKeepStatusSummary as T1,buildClaudeQuotaSummary as F1,buildPrimeAccountStatuses as O1,buildPrimeStatusSummary as E1,CLAUSTRUM_OPENCODE_ENROLLMENT_NAME as S1,exchange as x1,formatNativeAccountState as R1,formatOAuthAccountTier as A1,getCacheKeepWindow as q1,getHostClaustrumEnrollmentPaths as k1,isCacheKeepAlways as D1,isCacheKeepHybridActive as w1,isCacheKeepPersistentlyEnabled as b1,nativeAccountCanServe as y1,resetClaustrumEnrollmentState as I1}from"@cortexkit/anthropic-auth-core";var g2=(X)=>X!==null&&typeof X==="object"&&!Array.isArray(X)?X:{};function _$(X){let{runtime:J,source:_}=X,W=new Map,L=!1,T=async(Y,M)=>{await J.updateSettings((j)=>({...j,[Y]:{...g2(j[Y]),...M}}))},N=()=>({ok:!0,text:"Native Claude settings updated."}),F=async(Y,M)=>{if(L)throw Error("Native menu is closed");switch(M.signal?.throwIfAborted(),Y.action){case"enable":case"disable":return await J.setEnabled(Y.values.id,Y.action==="enable"),N();case"remove":return await J.remove(Y.values.id),N();case"move-up":case"move-down":{let Q=(await J.read()).accounts.map((I)=>I.id),O=Q.indexOf(Y.values.id),k=O+(Y.action==="move-up"?-1:1);if(O<0||k<0||k>=Q.length)return{ok:!1,text:"Account cannot move in that direction."};let x=Q[O],l=Q[k];if(x===void 0||l===void 0)return{ok:!1,text:"Account order changed."};return Q[O]=l,Q[k]=x,await J.reorder(Q),N()}case"add-apikey":return await J.addApi(Y.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let j=new AbortController;W.get(Y.sessionId)?.active.abort();let Q={active:j,auth:void 0};W.set(Y.sessionId,Q);let O=await P1("max");if(L||j.signal.aborted||M.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return Q.auth=O,{ok:!0,text:`Open ${O.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let j=W.get(Y.sessionId);if(!j?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let Q=await x1(Y.values.code,j.auth.verifier,j.auth.redirectUri,j.auth.state);if(j.active.signal.throwIfAborted(),M.signal?.throwIfAborted(),L||Q.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await J.loginOAuth({routeId:crypto.randomUUID(),credential:Q,label:Y.values.label}),j.active.signal.throwIfAborted(),M.signal?.throwIfAborted(),L)return{ok:!1,text:"Sign-in cancelled."};return W.delete(Y.sessionId),{ok:!0,text:"OAuth account stored in the native account pool."}}case"reset-backoff":{let j=await J.read();for(let Q of j.accounts){if(M.signal?.throwIfAborted(),Q.type!=="oauth")continue;let O=Q.source==="vault"?await J.authorizeVault(Q.id,M.signal):await J.captureLocalSubject(Q.id);await J.resetBackoff(Q.id,O)}return N()}case"enrollment-reset":{let j=await I1(k1("opencode"),S1);return{ok:j==="reset",text:j==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let Q=(await J.read()).accounts.filter((x)=>x.type==="oauth"&&y1(x)),O=await Promise.allSettled(Q.map((x)=>J.fetchQuota(x.id,void 0,M.signal)));return{ok:O.every((x)=>x.status==="fulfilled"),text:`${O.filter((x)=>x.status==="fulfilled").length}/${Q.length} native quota readings refreshed.`}}case"routing-reset":return await _.resetRouting(Y.sessionId),N();case"routing-mode":return await T("routing",{mode:Y.values.mode}),N();case"killswitch-on":case"killswitch-off":return await T("killswitch",{enabled:Y.action==="killswitch-on"}),N();case"killswitch-set":return await J.updateSettings((j)=>{let Q=g2(j.killswitch),O={...g2(Q.accounts)},k=Q.main;for(let x of Y.values.entries){let l={five_hour:x.fh,seven_day:x.sd,...x.scoped!==void 0?{scoped:x.scoped}:{}};if(x.account==="main"||x.account==="all")k=l;if(x.account==="all")for(let I of Object.keys(O))O[I]=l;else if(x.account!=="main")O[x.account]=l}return{...j,killswitch:{...Q,main:k,accounts:O}}}),N();case"cache-on":case"cache-off":return await T("claudeCache",{enabled:Y.action==="cache-on"}),N();case"cache-mode":return await T("claudeCache",{mode:Y.values.mode}),N();case"cachekeep-always":return await T("cacheKeep",{enabled:!0,always:!0}),N();case"cachekeep-off":return await T("cacheKeep",{enabled:!1}),N();case"cachekeep-window":return await T("cacheKeep",{enabled:!0,always:!1,startHour:Y.values.startHour,endHour:Y.values.endHour}),N();case"cachekeep-subagents":return await T("cacheKeep",{subagents:Y.values.enabled==="on"}),N();case"dump-on":case"dump-off":return await T("dump",{enabled:Y.action==="dump-on"}),N();case"logging-level":return await T("logging",{level:Y.values.level}),N();case"fast-on":case"fast-off":return await T("claudeFast",{enabled:Y.action==="fast-on"}),N();case"prime-on":case"prime-off":return await T("prime",{enabled:Y.action==="prime-on"}),N();case"start-fire":return await U(Y.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},U=(Y)=>X.start(Y,E2);return{dispatch:F,async readStatus(Y){let M=await J.read();if(Y==="account")return M.accounts.map((Q)=>`${Q.id}${Q.label?` (${Q.label})`:""}: ${Q.type}, ${Q.source}, ${Q.enabled?"enabled":"disabled"}${Q.state?`, ${R1(Q)}`:""}${Q.accountIdentity?`, ${Q.accountIdentity}`:""}`).join(`
-`)||"No native Claude accounts.";if(Y==="quota")return F1({accounts:M.accounts.filter((Q)=>Q.type==="oauth").map((Q)=>({name:Q.label??Q.id,role:Q.id==="main"?"main":"fallback",enabled:Q.enabled,quota:Q.quota,tierLabel:A1(Q.profile),lastRefreshedAt:Q.lastRefreshedAt,error:Q.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(Y==="prime")return E1({enabled:M.policyStorage.prime?.enabled===!0,accounts:O1(M.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");if(Y==="cachekeep"){let Q=await X.cacheKeepRegistry?.list()??[];return T1({enabled:b1(M.policyStorage),always:D1(M.policyStorage),hybridActive:w1(M.policyStorage),trackedSessionDetails:Q,window:q1(M.policyStorage),trackedSessions:Q.length,nextPrewarmAt:Q.length?Math.min(...Q.map((O)=>O.nextPrewarmAt)):void 0})}let j={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(M.settings[j[Y]]??{})},forgetSession(Y){W.get(Y)?.active.abort(),W.delete(Y)},close(){L=!0;for(let Y of W.values())Y.active.abort();W.clear()}}}import{isClaudeFable51Model as f1,isClaudeHaiku55Model as v1,isClaudeOpus5FamilyModel as g1,isClaudeSonnet55Model as h1}from"@cortexkit/anthropic-auth-core";function C$(){let X=new Map;return{install:(_)=>_.model.transform((W)=>{X.clear();for(let L of W.list("anthropic")){if(X.set(String(L.id),String(L.modelID)),!(f1(L.modelID)||g1(L.modelID)||h1(L.modelID)||v1(L.modelID)))continue;W.update("anthropic",String(L.id),(T)=>{let N=["low","medium","high","xhigh","max"],F=T.variants.filter((U)=>!N.some((Y)=>Y===String(U.id)));T.variants=[...F,...N.map((U)=>({id:U,settings:{effort:U,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(_)=>X.get(_)??_}}function L$(X){return X.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??X.get("x-api-key")??void 0}import{buildPrimeRequestBody as N$,effectiveRelayTransport as P$,nativeAccountCanServe as m1,PrimeManager as l1}from"@cortexkit/anthropic-auth-core";var T$=(X)=>X!==null&&typeof X==="object"&&!Array.isArray(X)?X:{};function F$(X){let{runtime:J,source:_}=X,W=new AbortController,L=new Set,T=(U)=>({providerID:"anthropic",modelID:N$().model,sessionID:`oc2-prime:${U}`,agent:"prime",kind:"generate"}),N=async(U)=>{let Y=T(U),M=z2({source:_}),j=performance.now();try{for(let Q=0;Q<3;Q++){if(W.signal.throwIfAborted(),(await J.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let k=await M.adapter.accountHeaders({...Y,accountId:U});if(!("headers"in k)||typeof k.headers!=="object"||k.headers===null||typeof k.attempt!=="object"||k.attempt===null)throw Error("Native Prime authorization refused");let x={...Y,accountId:U,attemptId:crypto.randomUUID(),transport:"http",data:k.attempt},l,I=!1,c=!1,n=(o)=>{c=!0,o.body?.cancel().catch(()=>{})};try{let o=await M.adapter.rewriteRequest?.({...Y,accountId:U,attempt:x,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(N$()),signal:W.signal})});if(!o)throw Error("Native Prime rewrite refused");let Z=new Headers(o.headers);for(let[r,f]of Object.entries(k.headers))if(f===null)Z.delete(r);else Z.set(r,f);let V=new Request(o,{headers:Z}),B=await(X.fetch??fetch)(V),E=await M.adapter.rewriteResponse?.({...Y,accountId:U,request:V,response:B,attempt:x})??B;l=E.status,M.adapter.quotaFromHeaders?.(E.headers,E.status,x);let S=E.ok?void 0:await M.adapter.limitFromResponse?.({status:E.status,headers:E.headers,body:()=>E.clone().text(),attempt:x});if(S&&/^(vault-newer|local-newer|relay-direct):/.test(S.reason)&&Q<2){if(n(E),await _.chooseAccount({...Y,rerouteFrom:{accountId:U,limit:S}})!==U)throw Error("Native Prime retry changed account");continue}if(!E.ok)return n(E),{ok:!1,status:l,ms:performance.now()-j,error:"Native Prime upstream refused the request"};let q=T$(await E.json()),g=T$(q.usage),m={inputTokens:typeof g.input_tokens==="number"?g.input_tokens:void 0,outputTokens:typeof g.output_tokens==="number"?g.output_tokens:void 0};if(x.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(E.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(I=await _.recordPrime(k.attempt.provenance,m),!I)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:l,ms:performance.now()-j,usage:m}}finally{await M.adapter.onAttemptEnd?.(x,{status:l,outputStarted:!1,...I?{}:{error:{reason:c?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-j}}finally{M.dispose()}},F=new l1({storagePath:X.paths.legacyConfig,loadStorage:async()=>(await J.read()).policyStorage,async getAccountFingerprint(U){let Y=await J.read(),M=Y.accounts.find((Q)=>Q.id===U);if(!m1(M)||M?.type!=="oauth")return;if(Y.policyStorage.relay?.enabled===!0&&P$(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")return;if(M.source==="vault"){let Q=await J.authorizeVault(U,W.signal);return J.getOrCreateAuthLineage(U,Q)}let j=await J.authorizeLocal(U,{signal:W.signal});return j.status==="usable"?J.getOrCreateAuthLineage(U,j.subject):void 0},async refreshQuota(U){let Y=await J.read();if(Y.policyStorage.relay?.enabled===!0&&P$(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await J.fetchQuota(U,X.fetch,W.signal),fresh:!0}},sendPrime(U){let Y=N(U);return L.add(Y),Y.finally(()=>L.delete(Y)),Y},async recordSuccess(U){let Y=(await J.read()).accounts.find((M)=>M.id===U);if(!Y?.prime)throw Error("Native Prime counters are unavailable");return Y.prime}});return F.start(),{manager:F,async dispose(){F.stop(),W.abort(),await Promise.allSettled(L)}}}import{createNativeUsagePublisher as d1,effectiveRelayTransport as u1,getClaudeCodeIdentityForVerifiedAccount as S2,getQuotaCheckIntervalMs as p1,getRoutingMode as O$,isQuotaBearingHeaderFrame as c1,mergeHeaderQuotaForPersistence as i1,NativeVaultNoAccountError as o1,nativeAccountCanServe as h2,nativeAccountPolicy as x2,normalizeQuotaHeaders as n1,quotaSnapshotCheckedAt as r1,quotaSnapshotHasStandardWindows as s1,readNativeAccountsForRequest as a1,remapModelId as m2,StickySessionRouter as t1,shouldFallbackStatus as e1,stickyQuotaSnapshotIsFresh as R2,stickyRouteFamilyForModel as $X}from"@cortexkit/anthropic-auth-core";var l2=(X)=>["five_hour","seven_day"].some((J)=>(X?.[J]?.remainingPercent??1)<=0);function S$(X){let{runtime:J}=X,_=d1("native-auth"),W=new Map,L=(Z)=>{let V=Z.routingPath;if(!V)throw Error("Native routing storage is unavailable");let B=W.get(V);if(!B)B=new t1({path:V,vaultSeed:Z.routingSeed,onLockEvent:J.onLockEvent,localRecoveryPath:Z.mode==="local"?Z.routingRecoveryPath:void 0}),W.set(V,B);return B.setVaultSeed(Z.routingSeed),B},T=new WeakMap,N=new Map,F=new Map,U=new Map,Y=new WeakSet,M=!1,j=()=>{while(N.size>512){let Z=N.keys().next();if(!Z.done)N.delete(Z.value)}},Q=(Z,V)=>JSON.stringify([Z.sessionID,Z.kind,Z.modelID,V]),O=(Z)=>{if(M)throw Error("Native Anthropic source is closed");let V=U.get(Z.sessionID);if(!V){V=new AbortController,U.set(Z.sessionID,V);while(U.size>512){let B=U.keys().next();if(!B.done)n.forgetSession?.(B.value)}}return V},k=(Z,V,B)=>h2(Z)&&(Z.type==="api"||x2(Z,V,m2(B)).status==="allowed"),x=async(Z,V,B,E)=>{let S=await J.read();E.signal.throwIfAborted(),l(S);let q=S.accounts.find((g)=>g.id===Z);if(!q||q.type!==B||!k(q,S,V))return!1;if(B==="api"){let g=S.accounts.find((m)=>m.id==="main"&&m.type==="oauth");return!!g&&R2(g.quota,S.policyStorage)&&l2(g.quota)}return!0},l=(Z)=>{let V=Z.policyStorage.relay;if(V?.enabled===!0&&u1(V.transport,V.url)==="websocket")throw new U2},I=async(Z,V)=>{if(l(Z),V||Z.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let B=await J.getRelayConfig();if(!B)throw Error("request refused: native HTTP relay configuration is unavailable");if(B.transport!=="http")throw new U2;return{dispatch:{kind:"http-relay",url:B.url,token:B.token},relayFallback:B.fallbackToDirect}};async function c(Z,V,B){if(Z.kind==="local")await J.publishLocal(Z.subject,B);else if(Z.kind==="vault"&&V.receipt)await J.vault.publish(V.receipt,B);else if(Z.kind==="api"&&B.lastUsed!==void 0)await J.publishApi(Z.subject,{lastUsed:B.lastUsed})}let n={async chooseAccount(Z){let V=O(Z);X.onOwnedRequest?.();let B=await J.read();V.signal.throwIfAborted(),l(B);let E=m2(await X.resolveModelId?.(Z)??Z.modelID);if(V.signal.throwIfAborted(),B.mode==="claustrum")B=await a1(J,V.signal),V.signal.throwIfAborted();if(B.policyStorage.quota?.enabled!==!1){let f=!1;for(let p of B.accounts){if(!h2(p)||p.type!=="oauth")continue;if(s1(p.quota)?R2(p.quota,B.policyStorage,Date.now(),E):Date.now()-r1(p.quota)<p1(B.policyStorage))continue;try{await J.fetchQuota(p.id,X.fetch,V.signal,void 0,"admission"),f=!0}catch{V.signal.throwIfAborted()}}if(f)B=await J.read();V.signal.throwIfAborted()}let S=Z.rerouteFrom?N.get(Z.rerouteFrom.limit.reason):void 0;if(Z.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(Z.rerouteFrom.limit.reason)&&!S)return;if(S&&Z.rerouteFrom){N.delete(Z.rerouteFrom.limit.reason);let f=B.accounts.find((e)=>e.id===S.accountId);if(!f||!k(f,B,E))return;let p=Q(Z,S.accountId),d=F.get(p)??[];return d.push(S),F.set(p,d),S.accountId}let q=[];for(let f of B.accounts){if(f.type!=="oauth"||!k(f,B,E))continue;if(f.source==="local"){let p=await J.authorizeLocal(f.id,{signal:V.signal,policy:(d,e)=>x2(d,e,E)});if(V.signal.throwIfAborted(),p.status!=="usable")continue}q.push(f)}let g=q.filter((f)=>f.id!==Z.rerouteFrom?.accountId);if(O$(B.policyStorage)==="sticky-balanced"){let f=g.map((d,e)=>({accountId:d.id,order:e,quota:d.quota??{kind:"unknown"}})),p=await L(B).resolve({sessionId:Z.sessionID,family:$X(E),modelId:E,affinityModelId:Z.modelID,candidates:f,retainAccountIds:new Set(g.map((d)=>d.id)),...B.mode==="claustrum"?{accountIdentities:new Map(B.accounts.flatMap((d)=>d.accountIdentity?[[d.id,d.accountIdentity]]:[]))}:{},storage:B.policyStorage,inputBytes:1,preferredAccountId:Z.previousAccountId});if(V.signal.throwIfAborted(),p)return p.accountId}else{let p=O$(B.policyStorage)==="fallback-first"?[...g.filter((d)=>d.id!=="main"),...g.filter((d)=>d.id==="main")]:[...g.filter((d)=>d.id==="main"),...g.filter((d)=>d.id!=="main")];if(p[0])return p[0].id}if(B.mode==="claustrum")throw new o1;let m=B.accounts.find((f)=>f.id==="main"&&f.type==="oauth");if(!m)return;let r=m.quota;if(Z.rerouteFrom?.limit.status===429||!R2(r,B.policyStorage))try{r=await J.fetchQuota("main",X.fetch,V.signal)}catch{return}if(V.signal.throwIfAborted(),!l2(r))return;return B.accounts.find((f)=>f.type==="api"&&h2(f)&&f.id!==Z.rerouteFrom?.accountId)?.id},async authorizeAccount(Z,V){let B=O(Z),E=await J.read();B.signal.throwIfAborted(),l(E);let S=m2(await X.resolveModelId?.(Z)??Z.modelID);B.signal.throwIfAborted();let q=E.accounts.find((H)=>H.id===V);if(!q||!k(q,E,S))return;let g=Q(Z,V),m=F.get(g),r=m?.shift();if(m?.length===0)F.delete(g);let{dispatch:f,relayFallback:p}=await I(E,r?.direct===!0);if(B.signal.throwIfAborted(),r?.auth){if(!await x(V,S,r.auth.route,B))return;let H=T.get(r.auth.provenance);if(H?.receipt?.expiresAtMs!==void 0&&H.receipt.expiresAtMs!==null&&H.receipt.expiresAtMs<Date.now()+300000)return;if(H)T.set(r.auth.provenance,{...H,scope:{...Z,modelID:S},account:q,active:B,relayFallback:p});return{...r.auth,dispatch:f}}let d={scope:{...Z,modelID:S},active:B,account:q,retry:r?.retry??!1,relayFallback:p,quota:q.quota};if(q.type==="api"){let H=E.accounts.find((w)=>w.id==="main"&&w.type==="oauth");if(!H||!R2(H.quota,E.policyStorage)||!l2(H.quota))return;let A=await J.authorizeApi(V,B.signal);if(B.signal.throwIfAborted(),!await x(V,S,"api",B))return;let R={kind:"api",subject:A.subject};return T.set(R,d),{route:"api",headers:A.authHeader==="authorization-bearer"?{authorization:`Bearer ${A.apiKey}`}:{"x-api-key":A.apiKey},baseURL:A.baseURL,provenance:R,dispatch:f}}if(q.source==="vault"){let H=await J.authorizeVault(V,B.signal);if(B.signal.throwIfAborted(),!await x(V,S,"oauth",B))return;let A={kind:"vault",credentialId:H.credentialId,recordVersion:H.recordVersion};T.set(A,{...d,receipt:H});let R=H.assertedAccountIdentity;if(!R)return;return{route:"oauth",accessToken:H.accessToken,provenance:A,dispatch:f,identity:S2(R,R)}}let e=await J.authorizeLocal(V,{signal:B.signal,policy:(H,A)=>x2(H,A,S)});if(B.signal.throwIfAborted(),e.status!=="usable")return;if(!await x(V,S,"oauth",B))return;let K={kind:"local",subject:e.subject};T.set(K,{...d,access:e.access});let z=e.subject.binding.identity;return{route:"oauth",accessToken:e.access,provenance:K,dispatch:f,identity:S2(z,z)}},async requestOptions(Z){let V=O(Z),B=await J.read();V.signal.throwIfAborted();let E=B.accounts.find((q)=>q.id===Z.accountId);if(!E||!k(E,B,Z.modelID))throw Error("request refused: native account is ineligible for this model");let S=T.get(Z.provenance);if(S)T.set(Z.provenance,{...S,scope:{...S.scope,modelID:Z.modelID}});return X.requestOptions(Z,B)},async admitRequest(Z){let V=T.get(Z.provenance);if(!V||!await x(Z.accountId,Z.modelID,Z.route,V.active))throw Error("request refused: native account policy changed before dispatch");T.set(Z.provenance,{...V,scope:{...V.scope,modelID:Z.modelID}})},onRequestPrepared:(Z)=>X.onRequestPrepared?.(Z),responseOptions(Z){return X.responseOptions?.({...Z,modelID:T.get(Z.provenance)?.scope.modelID??Z.modelID})},quotaFromHeaders(Z,V){let B=T.get(V.provenance),E=E$(Z);if(E)X.onRequestId?.(V,E);if(!B||V.route!=="oauth"||!c1(Z))return;let S=V.provenance.kind==="local"?V.provenance.subject.binding.identity:B.receipt?.assertedAccountIdentity,q={...n1(Z),...S?{accountIdentity:S}:{}};B.quota=i1(B.quota,q);let g=_.observe(c(V.provenance,B,{quota:B.quota}));return o.set(V.provenance,g),q},async limitFromResponse(Z){let V=T.get(Z.provenance);if(!V)return;if(Z.status===401&&V.receipt){if(!Y.has(V.receipt))Y.add(V.receipt),await J.vault.reportFailure(V.receipt,401,Z.dispatch==="http-relay"?"relay_status_field":"direct");if(V.retry||V.active.signal.aborted)return;let E=V.active,S=await J.vault.prepareRetry(V.receipt,E.signal);if(E.signal.throwIfAborted(),!S.retry)return;let q=S.receipt,g=q.assertedAccountIdentity;if(!g)return;let m={kind:"vault",credentialId:q.credentialId,recordVersion:q.recordVersion};T.set(m,{...V,receipt:q,retry:!0});let r=`vault-newer:${Z.attemptId}`;return N.set(r,{sessionID:Z.sessionID,accountId:Z.accountId,retry:!0,auth:{route:"oauth",accessToken:q.accessToken,provenance:m,identity:S2(g,g)}}),j(),{reason:r,status:401}}if(Z.status===401&&Z.provenance.kind==="local"&&V.access&&!V.retry){if(V.active.signal.aborted)return;let E=V.active,S=await J.authorizeLocal(Z.accountId,{rejectedAccessToken:V.access,signal:E.signal,policy:(r,f)=>x2(r,f,V.scope.modelID)});if(E.signal.throwIfAborted(),S.status!=="usable"||S.access===V.access)return;let q={kind:"local",subject:S.subject};T.set(q,{...V,access:S.access,retry:!0});let g=S.subject.binding.identity,m=`local-newer:${Z.attemptId}`;return N.set(m,{sessionID:Z.sessionID,accountId:Z.accountId,retry:!0,auth:{route:"oauth",accessToken:S.access,provenance:q,identity:S2(g,g)}}),j(),{reason:m,status:401}}let B=await J.read();if(e1(Z.status,B.policyStorage))return{reason:`provider-${Z.status}`,status:Z.status};return},limitFromRelayFailure(Z){let V=T.get(Z.provenance);if(!V?.relayFallback||V.active.signal.aborted||!(Z.status===401||Z.status>=500))return;let B=`relay-direct:${Z.attemptId}`;return N.set(B,{sessionID:Z.sessionID,accountId:Z.accountId,direct:!0,retry:!1}),j(),{reason:B}},limitFromStreamError(Z){return Z.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(Z,V){let B=T.get(V.provenance);if(V.dispatch==="http-relay"&&B?.relayFallback&&!B.active.signal.aborted&&Z.status===void 0){let E=`relay-direct:${V.attemptId}`;return N.set(E,{sessionID:V.sessionID,accountId:V.accountId,direct:!0,retry:!1}),j(),{reason:E}}return},async onAttemptEnd(Z,V){let B=T.get(Z.provenance);if(!B)return;try{if(await o.get(Z.provenance),V.status===401&&B.receipt&&!Y.has(B.receipt))Y.add(B.receipt),await J.vault.reportFailure(B.receipt,401,Z.dispatch==="http-relay"?"relay_status_field":"direct");if(!V.localRefusal&&V.status!==void 0)_.publish(()=>c(Z.provenance,B,{lastUsed:Date.now()}))}finally{T.delete(Z.provenance),o.delete(Z.provenance)}},forgetSession(Z){U.get(Z)?.abort(),U.delete(Z);for(let[V,B]of N)if(B.sessionID===Z)N.delete(V);for(let[V,B]of F)if(B[0]?.sessionID===Z)F.delete(V);X.onForgetSession?.(Z)},resetRouting:async(Z)=>L(await J.read()).clear(Z),async recordPrime(Z,V){let B=T.get(Z);if(!B||B.active.signal.aborted)return!1;if(Z.kind==="local")return J.incrementPrimeUsage(B.account.id,Z.subject,V);if(Z.kind==="vault"&&B.receipt)return J.incrementPrimeUsage(B.account.id,B.receipt,V);return!1},drainRoutingPublications:()=>Promise.all([J.drainRoutingPublications(),...[...W.values()].map((Z)=>Z.drain())]).then(()=>{}),close(){M=!0;for(let Z of U.values())Z.abort();return U.clear(),F.clear(),N.clear(),Promise.all([_.drain(),n.drainRoutingPublications()]).then(()=>{})}},o=new WeakMap;return n}import{remapModelId as XX}from"@cortexkit/anthropic-auth-core";function A$(){let X=new x$,J=new Map,_=new Map,W=new Map,L=new Set,T=new Set,N=new Map,F=(U)=>{while(U.size>512){let Y=U.keys().next();if(!Y.done)U.delete(Y.value)}};return{async install(U){let Y=[];try{Y.push(await U.session.hook("context",(M)=>{let j=M.messages.map((O)=>{return{info:{id:O.id,sessionID:M.sessionID,role:O.role,agent:M.agent,model:{providerID:M.model.providerID,modelID:M.model.id}},parts:O.content.map((k)=>({type:k.type,...k.type==="text"?{text:k.text}:{}}))}});X.observeMessages(j);let Q=M.messages.findLast((O)=>O.role==="user"&&O.id);if(Q?.id)J.set(M.sessionID,Q.id);if(Q?.content.some((O)=>O.type==="text"&&O.text===E2))L.add(M.sessionID);else L.delete(M.sessionID);F(J)},{providerID:"anthropic"})),Y.push(await U.session.hook("model.request",(M)=>{if(M.kind!=="primary")return;let j=J.get(M.sessionID);if(!j)return;if(X.markHeaders({sessionId:M.sessionID,messageId:j,agent:M.agent,headers:M.headers}),L.has(M.sessionID))M.headers[N2]="1"},{providerID:"anthropic"}))}catch(M){throw await Promise.allSettled(Y.map((j)=>j.dispose())),M}return{dispose:async()=>{await Promise.all(Y.map((M)=>M.dispose()))}}},requestOptions(U,Y){let M=X.resolveHeader(U.correlation[O2]);if(M)_.set(U.attemptId,M),F(_);N.set(U.attemptId,U.sessionID),F(N);let j=U.correlation[N2]==="1";if(j)T.add(U.attemptId);return{cache1hEnabled:U.agent!=="compaction"&&U.agent!=="title"&&(Y.policyStorage.claudeCache?.enabled??!0),cache1hMode:Y.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:Y.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:Y.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,serverSideFallbackEnabled:R$(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:j,billingLineage:M?{promptId:M.promptId,previousRequestId:M.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:W.get(U.sessionID)}},responseOptions(U){return{serverSideFallbackModel:XX(U.modelID),laneStart:T.has(U.attemptId),onMessageStart(Y){if(U.kind==="primary"&&typeof Y.id==="string")W.set(U.sessionID,Y.id),F(W)},onStreamEnd(){_.delete(U.attemptId),T.delete(U.attemptId),N.delete(U.attemptId)}}},onRequestId(U,Y){X.commit(_.get(U.attemptId),Y)},forgetSession(U){X.clearSession(U),J.delete(U),W.delete(U),L.delete(U);for(let[Y,M]of N)if(M===U)_.delete(Y),T.delete(Y),N.delete(Y)}}}var A2="cortexkit-anthropic-auth",BX='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',QX="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",KX="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function HX(X){let J=X.authorize??ZX,_=X.exchange??GX,W=()=>{if(!X.isActive())throw Error("Claude authentication setup is closed")},L=async()=>{let F;try{F=await X.readMode()}catch{throw Error(KX)}return W(),F},T=async()=>{if(await L()!=="local")throw Error(BX)};return{integrationID:"anthropic",methods:[{method:{id:k$,type:"oauth",label:D$},async authorize(){W(),await T();let F=await J("max");return W(),{mode:"code",url:F.url,instructions:"Paste the authorization code returned by Claude.",callback:async(U)=>{W();let Y=await _(U,F.verifier,F.redirectUri,F.state);if(!X.isActive()||Y.type!=="success")throw Error("Claude sign-in did not complete");return{access:Y.access,refresh:Y.refresh,expires:Y.expires}}}}}],vault:{method:{id:w$,type:"oauth",label:"Claude vault accounts"},async activate(){if(W(),await L()!=="claustrum")throw Error(QX)}},async onLogin(F){W(),await T(),await X.runtime.loginOAuth({routeId:"main",credential:F,replace:!0}),W()},label:"Claude native account pool"}}function UX(X){return{readMode:()=>jX("opencode",X),disconnectVault:()=>WX({host:"opencode",env:X})}}function d2(X={}){return{id:A2,setup:(J)=>y$(J,X)}}async function y$(X,J={}){let _=J.paths??await VX(),W=JX({paths:_,host:"opencode",local:J.local,vault:J.vault}),L=UX(J.vault?.env??process.env),T=!0,N=A$(),F=C$(),U,Y,M,j=S$({runtime:W,paths:_,fetch:J.fetch,requestOptions:N.requestOptions,responseOptions:N.responseOptions,onRequestId:N.onRequestId,onForgetSession:N.forgetSession,onRequestPrepared:async(I)=>{try{await M?.track(I)}catch{q$.warn("cachekeep","live request tracking failed")}},resolveModelId:async(I)=>F.modelId(I.modelID),onOwnedRequest:()=>{U??=M$(W,J.fetch),Y??=F$({runtime:W,paths:_,source:j,fetch:J.fetch})}});M=H$({...J.cacheKeep,runtime:W,source:j,fetch:J.fetch,isSubagent:async(I)=>Boolean((await X.session.get({sessionID:I})).parentID)});let Q=_$({runtime:W,source:j,cacheKeepRegistry:M.registry,start:async(I,c)=>{await X.session.synthetic({sessionID:I,text:c,description:"Claude lane start",resume:!0})}}),O=[],k=await U$(X,{source:j,log:{warn:(I,c)=>q$.warn("opencode2",I,c)}},{credential:L$}).catch(async(I)=>{throw Q.close(),await M?.dispose(),await j.close(),W.close(),I}),x,l=()=>{if(x)return x;return T=!1,Q.close(),j.close(),x=(async()=>{await Promise.allSettled([k.dispose(),U?.dispose(),Y?.dispose(),M?.dispose(),...O.map((I)=>I.dispose())]),await j.close(),W.close()})(),x};try{O.push(await N.install(X)),O.push(await F.install(X)),O.push(await k2(X,HX({isActive:()=>T,readMode:L.readMode,runtime:W})));let I={host:"opencode",dispatch:Q.dispatch,readStatus:(n)=>Q.readStatus(n),readAccounts:()=>W.read(),readMode:L.readMode,disconnectVault:L.disconnectVault,interactive:!0},c=YX(I);return O.push(await b$(X,c,Q)),l}catch(I){throw await l(),I}}var xJ={id:A2,setup:d2().setup,server:I$};export{y$ as setupAnthropicAuth,xJ as default,d2 as createAnthropicAuthPlugin,A2 as ANTHROPIC_AUTH_PLUGIN_ID};
+import{a as O2,b as q$,c as D$,d as e2,e as $$,f as E2,g as L2,h as X$,i as J$,j as b$,k as Z$,l as Y$,m as W$,n as G$,o as j$,p as m$}from"../index-ccrq4mra.js";import"../index-6chd6jnr.js";import"../index-hazrk5c3.js";import{u as v$}from"../index-pden7a7y.js";import{v as I$,w as f$,y as g$}from"../index-0kxy8k2c.js";import"../index-b1dvkp15.js";import"../index-czyrqpxc.js";import"../index-ah5s0bew.js";import"../index-f2ne65w4.js";import{acquireNativeAccountRuntime as NX,authorize as LX,createNativeUi as PX,disconnectNativeVaultForHost as FX,exchange as TX,logger as y$,readNativeEnrollmentMode as OX,resolveNativePoolPaths as EX}from"@cortexkit/anthropic-auth-core";class _2 extends Error{kind;providerID;sessionID;requestKind;constructor($){super($.message??`${$.providerID} ${$.requestKind} request refused (${$.kind})`);this.name="OpenCode2AuthError",this.kind=$.kind,this.providerID=$.providerID,this.sessionID=$.sessionID,this.requestKind=$.requestKind}}function Q2($){return`common-auth-placeholder.${$}`}function i2($){let X=Q2($.integrationID);return{type:"oauth",methodID:$.methodID,access:X,refresh:X,expires:$.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function q2($,X){if($?.type!=="oauth")return!1;let z=X===void 0?void 0:Q2(X),G=(N)=>z===void 0?N.startsWith("common-auth-placeholder."):N===z;return G($.access)&&G($.refresh)}var c2="No browser sign-in: this connects the plugin to the accounts in its vault.";async function k2($,X){let z=X.now??Date.now,{integrationID:G}=X,N=(T)=>i2({integrationID:G,methodID:T,now:z()}),L=async(T,K)=>{return await X.onLogin(T,{integrationID:G,methodID:K}),N(K)},P=(T)=>async(K)=>{let Y=T.method.id,H=await T.authorize(K),V={url:H.url,instructions:H.instructions,...H.expiresAt===void 0?{}:{expiresAt:H.expiresAt}};if(H.mode==="auto")return{...V,mode:"auto",callback:H.callback.then((O)=>L(O,Y))};let B=H.callback;return{...V,mode:"code",callback:async(O)=>L(await B(O),Y)}};return $.integration.transform((T)=>{let K=X.label===void 0?{}:{label:()=>X.label};for(let V of X.methods)T.method.update({integrationID:G,method:V.method,authorize:P(V),refresh:async(B)=>{if(!q2(B,G))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return N(B.methodID)},...K});let Y=X.vault;if(Y===void 0)return;let H=Y.method.id;T.method.update({integrationID:G,method:Y.method,authorize:async()=>({url:"",instructions:Y.instructions??c2,mode:"auto",callback:Promise.resolve().then(()=>Y.activate({integrationID:G,methodID:H})).then(()=>N(H))}),refresh:async(V)=>{if(!q2(V,G)||V.methodID!==H)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return N(H)},...K})})}function l$($){let X=[],z;for(let G of $.split(/\r?\n/))if(G.startsWith("data:"))X.push(G.slice(5).replace(/^ /,""));else if(G.startsWith("event:"))z=G.slice(6).trim();if(X.length===0)return;return z===void 0?{data:X.join(`
+`)}:{event:z,data:X.join(`
+`)}}function D2($,X){let z=new TextDecoder,G="",N=(P)=>{let T=l$(P);if(!T)return;try{$(T)}catch(K){X(K)}},L=()=>{for(;;){let P=/\r?\n\r?\n/.exec(G);if(!P)return;let T=G.slice(0,P.index);G=G.slice(P.index+P[0].length),N(T)}};return new TransformStream({transform(P,T){T.enqueue(P),G+=z.decode(P,{stream:!0}),L()},flush(){if(G+=z.decode(),L(),G.trim()!=="")N(G);G=""}})}var o2=512,H2="x-common-auth-attempt",U2=($,X)=>JSON.stringify([$,X]),G2=($)=>({providerID:$.model.providerID,modelID:$.model.id,sessionID:$.sessionID,agent:$.agent,kind:$.kind});function d$($){let X=$.headers;return typeof X==="object"&&X!==null}function p$($,X){let z=$.getReader();return new ReadableStream({async pull(G){let N;try{N=await z.read()}catch(L){X({reason:"failed",message:L instanceof Error?L.message:String(L)}),G.error(L);return}if(N.done)X(),G.close();else G.enqueue(N.value)},async cancel(G){X({reason:"cancelled",...G===void 0?{}:{message:String(G)}}),await z.cancel(G)}})}function b2($,X){for(let[z,G]of Object.entries(X)){let N=z.toLowerCase();for(let L of Object.keys($))if(L.toLowerCase()===N)delete $[L];if(G!==null)$[z]=G}}function u$($,X){for(let[z,G]of Object.entries(X))if(G===null)$.delete(z);else $.set(z,G)}async function w2($,X,z={}){let{providerID:G}=X,N=z.gateOnPlaceholder,L=(J)=>N===void 0||N.credential(J)===Q2(G),P=z.logger,T=Math.max(1,z.maxRecords??o2),K=[...z.hostCredentials??[Q2(G)],...N?[Q2(G)]:[]].filter((J)=>J!==""),Y=new Map,H=new WeakMap,V=new Map,B=new Set,O=new Map,q=!1,R=!1,m=new Map,b=0,i=!1,n=new Map,c=(J,Q)=>{try{P?.warn(J,Q)}catch{}},a=(J)=>J instanceof Error?J.message:String(J),Z=async(J,Q)=>{let C=m.get(J);if(!C||C.size===0)return;await Promise.all([...C].map(async(F)=>{try{await F(Q)}catch(I){c("opencode2 auth listener threw; the request is unaffected",{event:J,error:a(I)})}}))},j=async(J,Q)=>{try{await X.onAttemptEnd?.(J,Q)}catch(C){c("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:J.attemptId,error:a(C)})}},W=(J,Q)=>{if(J.ended||!J.attempt)return;let C={...J.status===void 0?{}:{status:J.status},outputStarted:J.outputStarted,...J.limit?{limit:J.limit.signal}:{},...Q?{error:Q}:{}};if(Q)J.endError=Q;J.ended=j(J.attempt,C)},A=(J,Q)=>W(J,{reason:"abandoned",message:Q}),E=(J)=>[...Y.values()].filter((Q)=>Q.key===J),w=(J)=>E(J).at(-1),y=(J)=>{if(Y.delete(J.id),!E(J.key).length)V.delete(J.key)},s=(J)=>{Y.set(J.id,J);while(Y.size>T){let Q=Y.values().next().value;if(Q===void 0)break;A(Q,"dropped to keep the record bound"),y(Q)}},p=(J)=>J.accountId===void 0?void 0:{...J.scope,accountId:J.accountId},h=(J,Q)=>new _2({kind:"no-account",providerID:G,sessionID:J.sessionID,requestKind:J.kind,...Q===void 0?{}:{message:Q}}),o=(J)=>{n.get(J)?.clear(),n.delete(J)},l=async(J,Q)=>{let C=()=>h(J,`${G} ${J.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(i)throw C();let F=n.get(J.sessionID);if(!F)F=new Set,n.set(J.sessionID,F);let I={};F.add(I);let v=()=>{if(!F.has(I))throw C()};try{return await Q(v)}finally{if(F.delete(I),F.size===0&&n.get(J.sessionID)===F)n.delete(J.sessionID)}},U=(J,Q)=>{for(let[C,F]of Q)if(K.some((I)=>F.includes(I)))throw new _2({kind:"host-credential-on-wire",providerID:G,sessionID:J.sessionID,requestKind:J.kind,message:`${G} ${J.kind} request still carries the host's placeholder credential in ${C}; the adapter's account headers must replace it`})},M=(J)=>{for(let Q of E(J))if(Q.ended||!Q.attempt)y(Q);else if(Q.transport==="ws"||Q.judged)A(Q,"a newer attempt of its session and kind began"),y(Q)},_=async(J,Q,C,F)=>{let I=U2(J.sessionID,J.kind),v=V.get(I);V.delete(I);let D=v?.accountId??w(I)?.accountId;M(I);let g={...J,...D===void 0?{}:{previousAccountId:D},...v?.rerouteFrom===void 0?{}:{rerouteFrom:v.rerouteFrom}},u=await X.chooseAccount(g);C();let W2={},p2;if(u!==void 0){let F2=await X.accountHeaders({...J,accountId:u});if(C(),d$(F2))W2=F2.headers,p2=F2.attempt;else W2=F2}let u2=`attempt-${++b}`,M2={id:u2,key:I,scope:J,accountId:u,headers:W2,attempt:u===void 0?void 0:{...J,accountId:u,attemptId:u2,transport:F,data:p2},...F===void 0?{}:{transport:F},outputStarted:!1};if(s(M2),M2.attempt)Z("select",{...J,accountId:M2.attempt.accountId,hook:Q,...g.previousAccountId===void 0?{}:{previousAccountId:g.previousAccountId},...g.rerouteFrom===void 0?{}:{rerouteFrom:g.rerouteFrom},handle:M2.attempt});return M2},S=async(J,Q,C,F,I)=>{let v=U2(J.sessionID,J.kind),D=F===void 0?void 0:Y.get(F);if(D?.key!==v)D=void 0;if(!D){if(D=w(v),E(v).filter((u)=>u.transport===void 0&&!u.ended).length>1&&!R)R=!0,c("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:J.sessionID,kind:J.kind})}if(!D||D.transport!==void 0||D.ended)D=await _(J,Q,I,C);else if(D.transport=C,D.attempt)D.attempt.transport=C;if(C==="ws"){for(let g of E(v))if(g!==D&&g.transport==="ws")A(g,"a newer attempt of its session and kind went out over WebSocket")}return D},x=async(J,Q)=>{try{return await Q()}catch(C){throw W(J,{reason:"failed",message:a(C)}),C}},k=(J,Q)=>{let C=E(U2(J,Q)).filter((F)=>F.transport==="ws").at(-1);return C?.attempt!==void 0&&!C.ended?C:void 0},f=(J,Q,C)=>{let F=p(J);if(!F||!J.attempt||J.limit)return;J.limit={signal:Q,delivered:Z("limit",{...F,via:C,limit:Q,outputStarted:J.outputStarted,handle:J.attempt})}},r=(J,Q,C,F)=>{let I=p(J);if(!I||!J.attempt)return;Z("quota",{...I,transport:Q,...F===void 0?{}:{status:F},quota:C,handle:J.attempt})},d=(J,Q,C,F)=>{let I=J.attempt;if(!I)return;let v=X.inspectEvent?.(F===void 0?{transport:Q,data:C,attempt:I}:{transport:Q,data:C,event:F,attempt:I});if(!v)return;if(v.quota!==void 0)r(J,Q,v.quota);if(v.outputStarted)J.outputStarted=!0;if(v.limit)f(J,v.limit,Q);if(v.error!==void 0)W(J,{reason:"failed",message:v.error});else if(v.done)W(J)},X2=(J,Q)=>{let C=J.attempt;if(!C||Q.accountId===J.accountId)return;if(C.reboundFrom??=C.accountId,C.accountId=Q.accountId,"data"in Q)C.data=Q.data;J.accountId=Q.accountId},J2=(J)=>!J.attempt||J.endError!==void 0||J.status!==void 0&&J.status>=400,Z2=(J)=>{let Q=[...Y.values()].filter((g)=>g.scope.sessionID===J),C=Q.filter((g)=>g.limit&&!g.rerouted).at(-1);if(C)return C;let F=Q.filter((g)=>g.scope.kind==="primary"),I=F.length>0?F:Q;if(I.length<=1)return I[0];let v=I.filter((g)=>!g.judged&&J2(g)).at(-1);if(v)return v;let D=I.filter((g)=>g.attempt&&!g.ended);if(D.length>1)return"ambiguous";return D[0]??I.at(-1)},$2={providerID:G},t=[];t.push(await $.session.hook("model.request",(J)=>{if(N)return;return l(G2(J),async(Q)=>{let C=await _(G2(J),"model.request",Q);if(Q(),C.accountId===void 0)throw h(C.scope);b2(J.headers,{...C.headers,[H2]:C.id})})},$2)),t.push(await $.session.hook("http.request",(J)=>{if(N){let Q=L(J.request.headers);if(O.set(J.sessionID,Q),!Q)return}return l(G2(J),async(Q)=>{let C=J.request.headers.get(H2)??void 0,F=N?await _(G2(J),"http.request",Q,"http"):await S(G2(J),"http.request","http",C,Q);Q();let I=p(F),v=F.attempt;if(!I||!v)throw h(F.scope);await x(F,async()=>{let D=J.request;if(X.rewriteRequest){if(C!==void 0){let W2=new Headers(D.headers);W2.delete(H2),D=new Request(D,{headers:W2})}D=await X.rewriteRequest({...I,request:D,attempt:v})??D,Q()}let g=new Headers(D.headers);g.delete(H2),u$(g,F.headers),U(F.scope,g.entries());let u=new Request(D,{headers:g});H.set(u,F),J.request=u})})},$2)),t.push(await $.session.hook("http.response",async(J)=>{let Q=H.get(J.request);if(!Q){if(N)return;if(!q)q=!0,c("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:J.sessionID,kind:J.kind});return}let C=J.response;if(X.answeredBy&&Q.attempt){let g=Q.attempt,u=await x(Q,async()=>X.answeredBy?.({request:J.request,response:C,attempt:g}));if(u)X2(Q,u)}let F=p(Q),I=Q.attempt;if(!F||!I)return;Q.status=C.status;let v=X.quotaFromHeaders?.(C.headers,C.status,I);if(v!==void 0)r(Q,"http",v,C.status);if(!C.ok&&X.limitFromResponse){let g=await X.limitFromResponse({status:C.status,headers:C.headers,body:()=>C.clone().text(),attempt:I});if(g)f(Q,g,"http")}if(!C.ok||!C.body)W(Q);let D=C;if(C.body&&(X.inspectEvent||X.onAttemptEnd)){let g=C.body;if(X.inspectEvent)g=g.pipeThrough(D2((u)=>d(Q,"http",u.data,u.event),(u)=>c("opencode2 auth event inspection threw",{error:a(u)})));D=new Response(p$(g,(u)=>W(Q,u)),{status:C.status,statusText:C.statusText,headers:C.headers})}if(X.rewriteResponse)D=await X.rewriteResponse({...F,request:J.request,response:D,attempt:I})??D;if(D!==C)J.response=D},$2)),t.push(await $.session.hook("experimental.ws.handshake",(J)=>{if(N){let Q=L(new Headers(J.headers)),C=U2(J.sessionID,J.kind);if(O.set(J.sessionID,Q),B.delete(C),!Q)return}return l(G2(J),async(Q)=>{let C;for(let D of Object.keys(J.headers)){if(D.toLowerCase()!==H2)continue;C??=J.headers[D],delete J.headers[D]}let F=N?await _(G2(J),"experimental.ws.handshake",Q,"ws"):await S(G2(J),"experimental.ws.handshake","ws",C,Q);Q();let I=p(F),v=F.attempt;if(!I||!v)throw h(F.scope);await x(F,async()=>{b2(J.headers,F.headers);let D=X.rewriteHandshakeURL?.({...I,url:J.url,attempt:v});if(D!==void 0)J.url=D;if(U(F.scope,Object.entries(J.headers)),N)B.add(F.key)})})},$2));let e=X.rewriteWebSocketFrame?.bind(X);if(e)t.push(await $.session.hook("experimental.ws.send",async(J)=>{let Q=G2(J);if(N&&!B.has(U2(Q.sessionID,Q.kind)))return;let C=k(Q.sessionID,Q.kind),F=await e({...Q,attempt:C?.attempt,frame:J.frame});if(F!==void 0)J.frame=F},$2));t.push(await $.session.hook("experimental.ws.receive",(J)=>{if(N&&!B.has(U2(J.sessionID,J.kind)))return;let Q=k(J.sessionID,J.kind);if(!Q)return;try{d(Q,"ws",J.frame)}catch(C){c("opencode2 auth frame inspection threw",{error:a(C)})}},$2)),t.push(await $.session.hook("retry",async(J)=>{if(N&&O.get(J.sessionID)!==!0)return;let Q=Z2(J.sessionID);if(!Q)return;let C=J.decision;if(Q==="ambiguous"){await Z("retry",{sessionID:J.sessionID,attempt:J.attempt,reason:"host-decides",hostDecision:C,decision:C});return}let F=Q;await l(F.scope,async(I)=>{F.judged=!0;let v=C,D,g,u=F.attempt;if(F.accountId===void 0||!u)v={retry:!1},D="no-account";else if(F.outputStarted)v={retry:!1},D="output-started";else{if(!F.limit){let W2=X.limitFromError?.(J.error,u);if(W2)f(F,W2,"error")}if(F.ended)await F.ended,I();if(F.limit)await F.limit.delivered,I(),F.rerouted=!0,g={accountId:F.accountId,limit:F.limit.signal},v={retry:!0,delay:0},D="reroute";else D="host-decides"}if(J.decision=v,v.retry&&F.accountId!==void 0)V.set(F.key,{sessionID:F.scope.sessionID,accountId:F.accountId,...g===void 0?{}:{rerouteFrom:g}});await Z("retry",{sessionID:J.sessionID,...F.accountId===void 0?{}:{accountId:F.accountId},kind:F.scope.kind,attempt:J.attempt,reason:D,hostDecision:C,decision:v,...u===void 0?{}:{handle:u}})})},$2));let j2=(J)=>{o(J),O.delete(J);for(let Q of B)if(JSON.parse(Q)[0]===J)B.delete(Q);for(let Q of[...Y.values()]){if(Q.scope.sessionID!==J)continue;A(Q,"its session was forgotten"),Y.delete(Q.id)}for(let[Q,C]of V)if(C.sessionID===J)V.delete(Q)},Y2=new AbortController,V2=$.event;if(V2)(async()=>{try{for await(let J of V2.subscribe({signal:Y2.signal}))if(J.type==="session.deleted")j2(J.data.sessionID)}catch(J){if(!Y2.signal.aborted)c("opencode2 auth stopped listening for session deletion",{error:a(J)})}})();return{on(J,Q){let C=m.get(J);if(!C)C=new Set,m.set(J,C);let F=Q;return C.add(F),()=>{C.delete(F)}},accountFor(J,Q){return w(U2(J,Q))?.accountId},forgetSession:j2,get size(){return Y.size},async dispose(){if(i)return;i=!0;for(let J of n.keys())o(J);Y2.abort();for(let J of Y.values())A(J,"the installation was disposed");Y.clear(),V.clear(),B.clear(),O.clear(),m.clear(),await Promise.all(t.map(async(J)=>{try{await J.dispose()}catch(Q){c("opencode2 auth hook did not dispose cleanly",{error:a(Q)})}}))}}}import{CacheKeepManager as _1,CacheKeepSessionRegistry as C1,getDefaultCacheKeepRegistryDirectory as N1,isCacheKeepActiveNow as B$,isCacheKeepHybridActive as f2,isCacheKeepSubagentsEnabled as g2,logger as L1}from"@cortexkit/anthropic-auth-core";import{createHash as i$}from"node:crypto";import{applyCustomHeaders as c$,assertNotCustodyTombstone as o$,classifyGzipRejection as n$,createProviderErrorRedactor as n2,createProviderErrorResponseScope as r2,decideRequestGzip as r$,encodeGzipRequestBody as s$,getAccountStoragePath as a$,getRequestGzipLatch as t$,getRequestGzipLatchPath as e$,mergeAnthropicBetas as $1,remapModelId as s2,remapRequestBodyModel as X1,stripEmptyTrailingAssistantMessages as J1,TrailingAssistantHistoryError as Z1}from"@cortexkit/anthropic-auth-core";var N2="anthropic",V$="x-common-auth-attempt",Y1=["x-session-affinity","x-opencode-session","x-parent-session-id",e2,O2,L2,V$],T2=new Set(["authorization","x-api-key"]),W1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",G1=512,j1=5000,V1=500,a2=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class Q$ extends Error{sessionID;requestKind;kind="no-account";providerID=N2;constructor($,X){super(W1);this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicNoAccountError"}}class I2 extends Error{sessionID;requestKind;kind="session-forgotten";providerID=N2;constructor($,X){super("request refused: its session was closed while it was being prepared");this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicRevokedError"}}class K2 extends Error{kind="unsupported-transport";providerID=N2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class U$ extends Error{kind="local-invalid-request";status=400;check;constructor($){super($.message,{cause:$});this.name="NativeAnthropicLocalRefusal",this.check=$.check}}var B2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($);function C2($){try{return JSON.parse($)}catch{return}}function y2($){let X={};for(let[z,G]of Object.entries($??{}))X[z.toLowerCase()]=G;return X}function t2($){let X={};for(let z of Y1){let G=$.get(z);if(G!==null&&z!==V$)X[z]=G;$.delete(z)}return X}function Q1($){try{return new URL($).pathname.endsWith("/messages")}catch{return!1}}function U1($){return $ instanceof Z1||$ instanceof $$?new U$($):void 0}function B1($,X){let z=[];if($.oauth)z.push($.oauth.accessToken);for(let[G,N]of Object.entries($.apiHeaders??{})){if(N===null||!T2.has(G))continue;z.push(N.replace(/^Bearer\s+/i,""))}for(let G of T2){let N=X.get(G);if(N!==null)z.push(N.replace(/^Bearer\s+/i,""))}if($.dispatch?.kind==="http-relay")z.push($.dispatch.token);return[...new Set(z.filter(Boolean))]}var H1=new Set(["oauth-2025-04-20","claude-code-20250219",J$]);function K1($){let X=$.split(",").map((z)=>z.trim()).filter((z)=>z&&!H1.has(z));return $1(null,X)}function z1($){let X=C2($);if(!B2(X))return $;let z=J1(X.messages),G=Object.hasOwn(X,"fallbacks"),{droppedMarkers:N}=Z$(X,!1),L=G&&!Object.hasOwn(X,"fallbacks"),P=X1(X);return z>0||N>0||L||P?JSON.stringify(X):$}async function M1($,X){if(!($ instanceof Promise))return"settled";let z;try{return await Promise.race([$.then(()=>"settled"),new Promise((G)=>{z=setTimeout(()=>G("timed-out"),X)})])}finally{if(z!==void 0)clearTimeout(z)}}function z2($){let{source:X,log:z}=$,G=Math.max(1,$.maxPendingSends??G1),N=$.attemptEndTimeoutMs??j1,L=$.requestGzipLatch??t$(e$(a$())),P=new WeakSet,T=new Map,K=new WeakMap,Y=new WeakMap,H=new WeakMap,V=new Map,B=new WeakMap,O=n2([]);O.dispose();let q=(U)=>(U&&V.get(U)?.redactor)??O,R=(U)=>{let M=V.get(U);if(!M)return;V.delete(U),M.redactor.dispose(),M.scope.dispose()},m=(U,M,_,S)=>{let x=B1(M,S),k=r2(x,_);b.set(U,_),V.set(U,{sessionID:M.sessionID,redactor:n2(x),scope:k}),k.settled.then(()=>R(U));while(V.size>G){let f=V.keys().next().value;if(f===void 0)break;R(f)}},b=new WeakMap,i=(U,M)=>{let _=U?b.get(U):void 0;if(!_||!M.ok)return O.redactResponse(M);let S=r2([],_),x=S.redactResponse(M);return S.dispose(),x},n=(U,M)=>{let _=U?V.get(U)?.scope:void 0;if(!_)return i(U,M);try{return _.redactResponse(M)}catch{return i(U,M)}},c=!1,a=new WeakMap,Z=(U,M)=>{if(U&&!M.ok)a.set(M.headers,U);return M},j=(U,M)=>{if(M.dispatch!=="http-relay")return!0;let _=/^req_[A-Za-z0-9_-]+$/.test(U.get("request-id")??"");return Y.set(M,_),_},W=(U)=>new Q$(U.sessionID,U.kind),A=new Map,E=async(U,M)=>{if(c)throw new I2(U.sessionID,U.kind);let _={revoked:!1},S=A.get(U.sessionID);if(!S)S=new Set,A.set(U.sessionID,S);S.add(_);let x=()=>{if(c||_.revoked)throw new I2(U.sessionID,U.kind)};try{let k=await M(x);return x(),k}finally{let k=A.get(U.sessionID);if(k?.delete(_)&&k.size===0)A.delete(U.sessionID)}},w=(U,M)=>{T.set(U,M);while(T.size>G){let _=T.keys().next().value;if(_===void 0)break;T.delete(_),z?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:G})}},y=(U,M)=>({providerID:U.providerID,modelID:U.modelID,sessionID:U.sessionID,agent:U.agent,kind:U.kind,accountId:U.accountId,attemptId:U.attemptId,transport:U.transport,route:M.route,provenance:M.provenance,dispatch:M.dispatch}),s=(U)=>E(U,async(M)=>{let{accountId:_,...S}=U,x=await X.authorizeAccount(S,_);return M(),p(S,x)}),p=(U,M)=>{if(!M)throw W(U);if(M.dispatch?.kind==="websocket-relay")throw new K2;let _=M.dispatch?.kind==="http-relay"?"http-relay":"direct",S=M.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":M.dispatch.token}:void 0;if(M.route==="oauth"){if(!M.accessToken)throw W(U);o$(M.accessToken,N2);let f=Object.freeze({route:"oauth",provenance:M.provenance,dispatch:_});w(f,{sessionID:U.sessionID,oauth:{accessToken:M.accessToken,...M.identity?{identity:M.identity}:{}},dispatch:M.dispatch,oauthHeaders:M.headers});let r=y2(M.headers);for(let d of T2)delete r[d];return delete r["anthropic-beta"],{headers:S??{...r,"x-api-key":null,authorization:`Bearer ${M.accessToken}`},attempt:f}}let x={authorization:null,"x-api-key":null,...y2(M.headers)};if(!x.authorization&&!x["x-api-key"])throw W(U);let k=Object.freeze({route:"api",provenance:M.provenance,dispatch:_});return w(k,{sessionID:U.sessionID,...M.baseURL?{baseURL:M.baseURL}:{},dispatch:M.dispatch,apiHeaders:x}),{headers:S??x,attempt:k}},h=(U)=>E(U,(M)=>o(U,M)),o=async(U,M)=>{let{request:_,attempt:S}=U,x=S.data,k=x?T.get(x):void 0;if(x)T.delete(x);if(!x||!k||x.route==="oauth"&&!k.oauth)throw W(U);let f=new Headers(_.headers);c$(f);let r=t2(f),d=_.body===null?void 0:await _.text();M();let X2=d!==void 0&&Q1(_.url);try{if(x.route==="oauth"&&k.oauth){let{accessToken:t,identity:e}=k.oauth;for(let[Y2,V2]of Object.entries(y2(k.oauthHeaders))){if(T2.has(Y2))continue;if(V2===null)f.delete(Y2);else f.set(Y2,V2)}let j2=null;if(d!==void 0&&X2){let Y2={...y(S,x),modelID:(()=>{let Q=C2(d);return s2(B2(Q)&&typeof Q.model==="string"?Q.model:U.modelID)})(),route:"oauth",correlation:r},V2=await X.requestOptions?.(Y2)??{};M(),d=await G$(d,{...V2,...e?{identity:e}:{},sessionId:U.sessionID,onToolNameMap:(Q)=>H.set(x,Q)});let J=C2(d);j2=B2(J)?J:null}Y$(f,t,{body:j2,...e?{identity:e}:{},requestClass:X$(S.agent)?"auxiliary":"main"})}else{if(d!==void 0&&X2)d=z1(d);f.delete("authorization"),f.delete("x-api-key");for(let[e,j2]of Object.entries(k.apiHeaders??{}))if(j2===null)f.delete(e);else f.set(e,j2);if(d!==void 0&&X2&&!f.has("content-type"))f.set("content-type","application/json");let t=f.get("anthropic-beta");if(t!==null){let e=K1(t);if(e)f.set("anthropic-beta",e);else f.delete("anthropic-beta")}}}catch(t){let e=U1(t);if(!e)throw t;throw K.set(x,e.check),z?.warn("refused an Anthropic request locally; nothing was sent",{check:e.check}),e}let J2=d!==void 0?C2(d):void 0;if(await X.admitRequest?.({...y(S,x),modelID:s2(B2(J2)&&typeof J2.model==="string"?J2.model:U.modelID)}),t2(f),d!==void 0)f.delete("content-length");M(),m(x,k,B2(J2)&&J2.stream===!0?"event-stream":"http",f);let Z2=W$(_.url,k.baseURL!==void 0?{baseURL:k.baseURL}:{}).url?.toString()??_.url;if(x.route==="oauth"&&X2&&d!==void 0)await X.onRequestPrepared?.({...y(S,x),url:Z2,bodyText:d}),M();if(k.dispatch?.kind==="http-relay"){let t=d??"";f.delete("x-relay-token");let e={protocol:1,type:"request",affinity:U.sessionID,upstream:{url:Z2,method:_.method,headers:Object.fromEntries(f)},mode:"full_sync",revision:1,body:t,next_hash:`sha256:${i$("sha256").update(t).digest("hex")}`};return new Request(k.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":k.dispatch.token},redirect:"error",signal:_.signal,body:JSON.stringify(e)})}let $2=d;if(x.route==="oauth"&&X2&&d!==void 0){let t=await r$({url:Z2,body:d,latch:L});if(M(),t.gzip)$2=await s$(d),f.set("content-encoding","gzip"),P.add(x),M()}return new Request(Z2,{method:_.method,headers:f,redirect:_.redirect,signal:_.signal,...$2!==void 0?{body:$2}:{}})};return{adapter:{providerID:N2,chooseAccount:(U)=>E(U,async()=>{let M=await X.chooseAccount(U);if(!M)throw W(U);return M}),accountHeaders:s,rewriteRequest:h,rewriteHandshakeURL(){throw new K2},rewriteResponse({response:U,attempt:M}){let _=M.data;if(_&&!j(U.headers,_)){if(U.status===401)return R(_),U.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return n(_,U)}if(_&&P.has(_))P.delete(_),n$(U).then((r)=>{if(!r)return;L.latchProcess(),z?.warn("gzipped request body rejected; later requests go uncompressed",{kind:r,status:U.status})},()=>{});let S=n(_,U);if(_?.route!=="oauth"||!S.body)return Z(_,S);let x={...y(M,_),status:U.status},k=X.responseOptions?.(x)??{},f=(U.headers.get("content-type")??"").includes("application/json");return Z(_,j$(S,{...k,toolNameMap:H.get(_),onToolNameRefusal:()=>{K.set(_,"response_tool_names"),R(_)},laneStartOAuthServed:!0,...f?{responseMode:"json"}:{}}))},quotaFromHeaders(U,M,_){let S=_.data;if(!S||!j(U,S))return;return X.quotaFromHeaders?.(U,{...y(_,S),status:M})},async limitFromResponse({status:U,headers:M,body:_,attempt:S}){let x=S.data;if(!x||K.get(x)==="response_tool_names")return;if(!j(M,x))return X.limitFromRelayFailure?.({...y(S,x),status:U});if(B.set(x,`provider responded with HTTP ${U}`),!X.limitFromResponse)return;let k=a.get(M)===x,f=q(x);return X.limitFromResponse({...y(S,x),status:U,headers:M,body:async()=>k?await _():f.redactText(await _())})},inspectEvent({data:U,event:M,attempt:_}){if(_.data&&K.get(_.data)==="response_tool_names")return;let S=C2(U);if(!B2(S))return;let x=typeof S.type==="string"?S.type:M;if(x==="content_block_start"||x==="content_block_delta")return{outputStarted:!0};if(x==="message_stop")return{done:!0};if(x!=="error")return;let k=_.data,f=q(k),r=B2(S.error)?S.error:{},d=typeof r.type!=="string"?void 0:a2.has(r.type)?r.type:f.redactText(r.type),X2=typeof r.message==="string"?f.redactText(r.message):void 0;if(k?.dispatch==="http-relay"&&Y.get(k)===!1)return;let J2=k?X.limitFromStreamError?.({...y(_,k),errorType:d,message:X2}):void 0,Z2={error:[d??"error",X2].filter(Boolean).join(": ").slice(0,V1),...J2?{limit:J2}:{}};if(k&&Z2.error)B.set(k,Z2.error);return Z2},limitFromError(U,M){let _=M.data;if(!_||K.has(_))return;let S={type:a2.has(U.type)?U.type:"provider_error",message:B.get(_)??"provider request failed",...U.status!==void 0?{status:U.status}:{}};if(R(_),_.dispatch==="http-relay"&&Y.get(_)===!1)return;return X.limitFromHostError?.(S,y(M,_))},async onAttemptEnd(U,M){let _=U.data;if(!_)return;T.delete(_);let S=M.error?.reason;if(S==="cancelled"||S==="abandoned"||S===void 0&&(M.status===void 0||M.status<400))R(_);let x=K.get(_),{status:k,...f}=M,r=X.onAttemptEnd?.(y(U,_),{...f,...k!==void 0&&(_.dispatch!=="http-relay"||Y.get(_)===!0)?{status:k}:{},...x!==void 0?{localRefusal:{check:x}}:{}});if(await M1(r,N)==="timed-out")z?.warn("the account source did not finish recording a send",{timeoutMs:N})}},dispose(){c=!0;for(let[U,M]of A){for(let _ of M)_.revoked=!0;X.forgetSession?.(U)}A.clear(),T.clear();for(let U of[...V.keys()])R(U)},forgetSession(U){for(let M of A.get(U)??[])M.revoked=!0;A.delete(U);for(let[M,_]of T)if(_.sessionID===U)T.delete(M);for(let[M,_]of[...V])if(_.sessionID===U)R(M);X.forgetSession?.(U)},get pendingSendCount(){return T.size},get heldCredentialCount(){let U=0;for(let M of T.values())if(M.oauth)U++;return U},get heldRedactorCount(){return V.size},get operationsInProgress(){let U=0;for(let M of A.values())U+=M.size;return U}}}function P2($){return JSON.stringify([$.source,$.accountIdentity,$.credentialId,$.binding?.storageId,$.binding?.rowId,$.binding?.credentialEpoch])}function H$($){let{runtime:X,source:z}=$,G=new AbortController,N=!1,L=new C1({directory:$.registryDirectory||process.env.OPENCODE_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR||N1("opencode"),now:$.now}),P=new Map,T=async(V,B,O)=>{let q=O?AbortSignal.any([G.signal,O]):G.signal;q.throwIfAborted();let R=JSON.parse(await B.text()),m={providerID:"anthropic",modelID:R.model,sessionID:`oc2-cachekeep:${V.id}`,agent:"cachekeep",kind:"generate"},b=z2({source:{...z,onRequestPrepared:void 0,responseOptions:void 0,async requestOptions(Z){return{...await z.requestOptions?.(Z),laneStart:!1,billingLineage:void 0,cacheDiagnosticsPreviousMessageId:void 0}},async authorizeAccount(Z,j){let W=await X.read();q.throwIfAborted();let A=W.accounts.find((w)=>w.id===j);if(A?.type!=="oauth"||P2(A)!==V.oauthAccountIdentity||V.isSubagent&&!g2(W.policyStorage)||!f2(W.policyStorage)||!B$(W.policyStorage,new Date($.now?.()??Date.now())))return;let E=await z.authorizeAccount(Z,j);if(E?.provenance.kind==="local"&&P2({...A,binding:E.provenance.subject.binding,accountIdentity:E.provenance.subject.binding.identity})!==V.oauthAccountIdentity)return;if(E?.provenance.kind==="vault"&&E.provenance.credentialId!==A.credentialId)return;return E},async admitRequest(Z){await z.admitRequest?.(Z);let j=await X.read(),W=j.accounts.find((A)=>A.id===Z.accountId);if(q.throwIfAborted(),!W||P2(W)!==V.oauthAccountIdentity||V.isSubagent&&!g2(j.policyStorage)||!f2(j.policyStorage)||!B$(j.policyStorage,new Date($.now?.()??Date.now())))throw Error("CacheKeep policy changed before dispatch")}}}),i,n,c=!1,a=()=>b.forgetSession(m.sessionID);q.addEventListener("abort",a,{once:!0});try{let Z=(await X.read()).accounts.find((y)=>P2(y)===V.oauthAccountIdentity)?.id;if(!Z)throw Error("CacheKeep account is unavailable");let j=await b.adapter.accountHeaders({...m,accountId:Z});if(!("headers"in j)||typeof j.headers!=="object"||j.headers===null||typeof j.attempt!=="object"||j.attempt===null||j.attempt.route!=="oauth")throw Error("CacheKeep authorization refused");i={...m,accountId:Z,attemptId:crypto.randomUUID(),transport:"http",data:j.attempt};let W=await b.adapter.rewriteRequest?.({...m,accountId:Z,attempt:i,request:new Request(V.url,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(R),signal:q})});if(!W)throw Error("CacheKeep rewrite refused");q.throwIfAborted();let A=await($.fetch??fetch)(W),E=await b.adapter.rewriteResponse?.({...m,accountId:Z,attempt:i,request:W,response:A});if(!E)throw Error("CacheKeep response rewrite refused");if(n=E.status,b.adapter.quotaFromHeaders?.(E.headers,E.status,i),!E.ok)await b.adapter.limitFromResponse?.({status:n,headers:E.headers,body:()=>E.clone().text(),attempt:i});let w=await E.arrayBuffer();return c=!0,new Response(w,{status:n,headers:E.headers})}catch{throw Error("Native CacheKeep was not completed")}finally{q.removeEventListener("abort",a);try{if(i)await b.adapter.onAttemptEnd?.(i,{status:n,outputStarted:!1,...c?{}:{error:{reason:"cancelled"}}})}finally{b.dispose(),z.forgetSession?.(m.sessionID)}}},K=$.setIntervalImpl??globalThis.setInterval,Y=new _1({loadStorage:async()=>N?null:(await X.read()).policyStorage,now:$.now,setIntervalImpl:(V,B)=>K(()=>Y.tick().catch(()=>{L1.warn("cachekeep","tick failed")}),B),clearIntervalImpl:$.clearIntervalImpl,onTrackedSessionsChanged:(V)=>L.publish(N?[]:V),prepareHeaders(V,B,O){if(N)return;return P.set(O.id,{target:B,attempt:O}),new Headers({"x-native-cachekeep-attempt":String(O.id)})},fetchImpl:async(V,B)=>{let O=new Request(V,B),q=Number(O.headers.get("x-native-cachekeep-attempt")),R=P.get(q);if(P.delete(q),!R)throw Error("CacheKeep attempt is unavailable");return T(R.target,O,R.attempt.signal)},onComplete:({attempt:V})=>{P.delete(V.id)}}),H;return{async track(V){if(N||V.route!=="oauth"||V.agent==="cachekeep"||V.agent==="prime"||V.kind!=="primary")return;let B=await X.read();if(N||!f2(B.policyStorage))return;let O=!1;try{O=await $.isSubagent?.(V.sessionID)??!1}catch{return}if(N||O&&!g2(B.policyStorage))return;let q=B.accounts.find((R)=>R.id===V.accountId);if(!q?.accountIdentity)return;if(V.provenance.kind==="local"&&JSON.stringify(q.binding)!==JSON.stringify(V.provenance.subject.binding))return;if(V.provenance.kind==="vault"&&q.credentialId!==V.provenance.credentialId)return;Y.track({sessionId:V.sessionID,url:V.url,headers:new Headers,bodyText:V.bodyText,storage:B.policyStorage,cacheMode:"hybrid",oauthAccountId:V.accountId,oauthAccountIdentity:P2(q),isSubagent:O}),await L.publish(Y.trackedSessions())},registry:L,dispose(){if(H)return H;return N=!0,Y.stop(),G.abort(),H=(async()=>{try{await Y.tick()}finally{P.clear(),await L.dispose()}})(),H}}}async function K$($,X,z){let G=z2(X),N=[],L=async(B,O,q)=>{let R=await $.session.hook(B,O,q);return N.push(R),R},P=new AbortController,T;try{T=await w2({session:{hook:L},event:$.event},G.adapter,{logger:X.log,gateOnPlaceholder:z})}catch(B){throw G.dispose(),await Promise.allSettled(N.map((O)=>O.dispose())),B}let K=(B)=>{G.forgetSession(B),T.forgetSession(B)},Y=$.event,H=Y?(async()=>{try{for await(let B of Y.subscribe({signal:P.signal}))if(B.type==="session.deleted")K(B.data.sessionID)}catch(B){if(!P.signal.aborted)X.log?.warn("stopped listening for session deletion",{error:B instanceof Error?B.name:"unknown"})}})():Promise.resolve(),V;return{installation:T,forgetSession:K,dispose(){if(V)return V;return G.dispose(),P.abort(),V=(async()=>{await T.dispose(),await H})(),V}}}import{effectiveRelayTransport as z$,getQuotaCheckIntervalMs as P1,logger as F1,nativeAccountCanServe as T1,oauthProfileIsFresh as O1,quotaSnapshotCheckedAt as E1}from"@cortexkit/anthropic-auth-core";function M$($,X){let z=new AbortController,G,N=!1,L=async()=>{let K=await $.read();if(z.signal.throwIfAborted(),K.policyStorage.relay?.enabled===!0&&z$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="websocket")return;let Y=K,H=P1(Y.policyStorage);for(let V of Y.accounts){if(z.signal.aborted)return;if(!T1(V)||V.type!=="oauth")continue;if(Y.policyStorage.quota?.enabled!==!1&&Date.now()-E1(V.quota)>=H)await $.fetchQuota(V.id,X,z.signal,void 0,"background").catch(()=>{});if(!O1(V.profile)&&!z.signal.aborted)await $.fetchProfile(V.id,X,z.signal).catch(()=>{})}},P=()=>{if(N||G)return G;return G=L().catch(()=>{if(!z.signal.aborted)F1.debug("opencode2","native background readings did not complete")}).finally(()=>{G=void 0}),G},T=$.vault.watch({intervalMs:60000,onRefresh:P,shouldRefresh:async()=>{let K=await $.read();return K.policyStorage.relay?.enabled!==!0||z$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="http"}});return T.ready.catch(()=>{}),{async dispose(){N=!0,T.close(),z.abort(),await G}}}import{authorize as f1,buildCacheKeepStatusSummary as g1,buildClaudeQuotaSummary as v1,buildPrimeAccountStatuses as h1,buildPrimeStatusSummary as m1,CLAUSTRUM_OPENCODE_ENROLLMENT_NAME as l1,exchange as d1,formatNativeAccountState as p1,formatOAuthAccountTier as u1,getCacheKeepWindow as i1,getHostClaustrumEnrollmentPaths as c1,isCacheKeepAlways as o1,isCacheKeepHybridActive as n1,isCacheKeepPersistentlyEnabled as r1,nativeAccountCanServe as s1,resetClaustrumEnrollmentState as a1}from"@cortexkit/anthropic-auth-core";import{buildPrimeAccountStatuses as S1,effectiveRelayStatus as x1,formatNativeAccountState as R1,formatOAuthAccountTier as _$,getCacheKeepWindow as A1,getRoutingMode as q1,isCacheKeepAlways as k1,isCacheKeepHybridActive as D1,isPermanentRefreshError as b1,isPrimePersistentlyEnabled as w1,nativeAccountCanServe as L$,refreshBackoffActive as C$}from"@cortexkit/anthropic-auth-core";var N$=($)=>L$($)&&$.state!=="unsupported-access"?void 0:R1($)||void 0,y1=($)=>{if($.source!=="vault")return"off";if($.state==="needs_reauth")return"on-vault-reauth";return L$($)?"on-vault-served":"on-cold"},I1=($,X)=>typeof $==="number"&&$>X;function P$($,X){let{now:z}=X,G=$.policyStorage,N=$.accounts.filter((H)=>H.type==="oauth"),L=N.find((H)=>H.id==="main"),P=L?N$(L):void 0,T=L?.lastQuotaRefreshError?.nextRetryAt,K=L?.lastRefreshError,Y=A1(G);return{main:{quota:L?.quota??null,enabled:L?.enabled,tierLabel:_$(L?.profile),quotaBackedOff:I1(T,z),quotaBackoffUntil:T,refreshBackedOff:C$(K,L?.accountIdentity,z,void 0),refreshBackoffUntil:K?.nextRetryAt,stateLine:P,quotaDated:Boolean(P)},fallbacks:N.filter((H)=>H.id!=="main"&&(H.enabled||H.source==="vault")).map((H)=>{let V=N$(H),B=y1(H);return{id:H.id,label:H.label,quota:H.quota??null,enabled:H.enabled,tierLabel:_$(H.profile),needsReauth:b1(H.lastRefreshError)&&C$(H.lastRefreshError,H.accountIdentity,z,void 0),...B==="on-vault-reauth"?{vaultReauth:!0}:{},...B==="on-vault-served"?{vaultServed:!0}:{},...B!=="off"?{custodyState:B}:{},stateLine:V,quotaDated:Boolean(V)}}),activeId:X.activeId,route:q1(G),relay:x1(G.relay),fastMode:G.claudeFast?.enabled===!0,cacheKeep:{enabled:D1(G),window:k1(G)?"always":Y?`${Y.startHour}-${Y.endHour}`:void 0,trackedSessions:X.trackedSessions},prime:w1(G)?{enabled:!0,accounts:S1(G,{now:z})}:void 0,lastUpdated:z}}var v2=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{};function F$($){let{runtime:X,source:z}=$,G=new Map,N=!1,L=async(Y,H)=>{await X.updateSettings((V)=>({...V,[Y]:{...v2(V[Y]),...H}}))},P=()=>({ok:!0,text:"Native Claude settings updated."}),T=async(Y,H)=>{if(N)throw Error("Native menu is closed");switch(H.signal?.throwIfAborted(),Y.action){case"enable":case"disable":return await X.setEnabled(Y.values.id,Y.action==="enable"),P();case"remove":return await X.remove(Y.values.id),P();case"move-up":case"move-down":{let B=(await X.read()).accounts.map((b)=>b.id),O=B.indexOf(Y.values.id),q=O+(Y.action==="move-up"?-1:1);if(O<0||q<0||q>=B.length)return{ok:!1,text:"Account cannot move in that direction."};let R=B[O],m=B[q];if(R===void 0||m===void 0)return{ok:!1,text:"Account order changed."};return B[O]=m,B[q]=R,await X.reorder(B),P()}case"add-apikey":return await X.addApi(Y.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let V=new AbortController;G.get(Y.sessionId)?.active.abort();let B={active:V,auth:void 0};G.set(Y.sessionId,B);let O=await f1("max");if(N||V.signal.aborted||H.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return B.auth=O,{ok:!0,text:`Open ${O.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let V=G.get(Y.sessionId);if(!V?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let B=await d1(Y.values.code,V.auth.verifier,V.auth.redirectUri,V.auth.state);if(V.active.signal.throwIfAborted(),H.signal?.throwIfAborted(),N||B.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await X.loginOAuth({routeId:crypto.randomUUID(),credential:B,label:Y.values.label}),V.active.signal.throwIfAborted(),H.signal?.throwIfAborted(),N)return{ok:!1,text:"Sign-in cancelled."};return G.delete(Y.sessionId),{ok:!0,text:"OAuth account stored in the native account pool."}}case"reset-backoff":{let V=await X.read();for(let B of V.accounts){if(H.signal?.throwIfAborted(),B.type!=="oauth")continue;let O=B.source==="vault"?await X.authorizeVault(B.id,H.signal):await X.captureLocalSubject(B.id);await X.resetBackoff(B.id,O)}return P()}case"enrollment-reset":{let V=await a1(c1("opencode"),l1);return{ok:V==="reset",text:V==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let B=(await X.read()).accounts.filter((R)=>R.type==="oauth"&&s1(R)),O=await Promise.allSettled(B.map((R)=>X.fetchQuota(R.id,void 0,H.signal)));return{ok:O.every((R)=>R.status==="fulfilled"),text:`${O.filter((R)=>R.status==="fulfilled").length}/${B.length} native quota readings refreshed.`}}case"routing-reset":return await z.resetRouting(Y.sessionId),P();case"routing-mode":return await L("routing",{mode:Y.values.mode}),P();case"killswitch-on":case"killswitch-off":return await L("killswitch",{enabled:Y.action==="killswitch-on"}),P();case"killswitch-set":return await X.updateSettings((V)=>{let B=v2(V.killswitch),O={...v2(B.accounts)},q=B.main;for(let R of Y.values.entries){let m={five_hour:R.fh,seven_day:R.sd,...R.scoped!==void 0?{scoped:R.scoped}:{}};if(R.account==="main"||R.account==="all")q=m;if(R.account==="all")for(let b of Object.keys(O))O[b]=m;else if(R.account!=="main")O[R.account]=m}return{...V,killswitch:{...B,main:q,accounts:O}}}),P();case"cache-on":case"cache-off":return await L("claudeCache",{enabled:Y.action==="cache-on"}),P();case"cache-mode":return await L("claudeCache",{mode:Y.values.mode}),P();case"cachekeep-always":return await L("cacheKeep",{enabled:!0,always:!0}),P();case"cachekeep-off":return await L("cacheKeep",{enabled:!1}),P();case"cachekeep-window":return await L("cacheKeep",{enabled:!0,always:!1,startHour:Y.values.startHour,endHour:Y.values.endHour}),P();case"cachekeep-subagents":return await L("cacheKeep",{subagents:Y.values.enabled==="on"}),P();case"dump-on":case"dump-off":return await L("dump",{enabled:Y.action==="dump-on"}),P();case"logging-level":return await L("logging",{level:Y.values.level}),P();case"fast-on":case"fast-off":return await L("claudeFast",{enabled:Y.action==="fast-on"}),P();case"prime-on":case"prime-off":return await L("prime",{enabled:Y.action==="prime-on"}),P();case"start-fire":return await K(Y.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},K=(Y)=>$.start(Y,E2);return{dispatch:T,async readStatus(Y){let H=await X.read();if(Y==="account")return H.accounts.map((B)=>`${B.id}${B.label?` (${B.label})`:""}: ${B.type}, ${B.source}, ${B.enabled?"enabled":"disabled"}${B.state?`, ${p1(B)}`:""}${B.accountIdentity?`, ${B.accountIdentity}`:""}`).join(`
+`)||"No native Claude accounts.";if(Y==="quota")return v1({accounts:H.accounts.filter((B)=>B.type==="oauth").map((B)=>({name:B.label??B.id,role:B.id==="main"?"main":"fallback",enabled:B.enabled,quota:B.quota,tierLabel:u1(B.profile),lastRefreshedAt:B.lastRefreshedAt,error:B.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(Y==="prime")return m1({enabled:H.policyStorage.prime?.enabled===!0,accounts:h1(H.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");if(Y==="cachekeep"){let B=await $.cacheKeepRegistry?.list()??[];return g1({enabled:r1(H.policyStorage),always:o1(H.policyStorage),hybridActive:n1(H.policyStorage),trackedSessionDetails:B,window:i1(H.policyStorage),trackedSessions:B.length,nextPrewarmAt:B.length?Math.min(...B.map((O)=>O.nextPrewarmAt)):void 0})}let V={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(H.settings[V[Y]]??{})},async readSidebar(Y){let[H,V]=await Promise.all([X.read(),$.cacheKeepRegistry?.list()??[]]);return P$(H,{activeId:z.servedAccount(Y),trackedSessions:V.length,now:Date.now()})},forgetSession(Y){G.get(Y)?.active.abort(),G.delete(Y)},close(){N=!0;for(let Y of G.values())Y.active.abort();G.clear()}}}import{isClaudeFable51Model as t1,isClaudeHaiku55Model as e1,isClaudeOpus5FamilyModel as $X,isClaudeSonnet55Model as XX}from"@cortexkit/anthropic-auth-core";function T$(){let $=new Map;return{install:(z)=>z.model.transform((G)=>{$.clear();for(let N of G.list("anthropic")){if($.set(String(N.id),String(N.modelID)),!(t1(N.modelID)||$X(N.modelID)||XX(N.modelID)||e1(N.modelID)))continue;G.update("anthropic",String(N.id),(L)=>{let P=["low","medium","high","xhigh","max"],T=L.variants.filter((K)=>!P.some((Y)=>Y===String(K.id)));L.variants=[...T,...P.map((K)=>({id:K,settings:{effort:K,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(z)=>$.get(z)??z}}function O$($){return $.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??$.get("x-api-key")??void 0}import{buildPrimeRequestBody as E$,effectiveRelayTransport as S$,nativeAccountCanServe as JX,PrimeManager as ZX}from"@cortexkit/anthropic-auth-core";var x$=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{};function R$($){let{runtime:X,source:z}=$,G=new AbortController,N=new Set,L=(K)=>({providerID:"anthropic",modelID:E$().model,sessionID:`oc2-prime:${K}`,agent:"prime",kind:"generate"}),P=async(K)=>{let Y=L(K),H=z2({source:z}),V=performance.now();try{for(let B=0;B<3;B++){if(G.signal.throwIfAborted(),(await X.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let q=await H.adapter.accountHeaders({...Y,accountId:K});if(!("headers"in q)||typeof q.headers!=="object"||q.headers===null||typeof q.attempt!=="object"||q.attempt===null)throw Error("Native Prime authorization refused");let R={...Y,accountId:K,attemptId:crypto.randomUUID(),transport:"http",data:q.attempt},m,b=!1,i=!1,n=(c)=>{i=!0,c.body?.cancel().catch(()=>{})};try{let c=await H.adapter.rewriteRequest?.({...Y,accountId:K,attempt:R,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E$()),signal:G.signal})});if(!c)throw Error("Native Prime rewrite refused");let a=new Headers(c.headers);for(let[s,p]of Object.entries(q.headers))if(p===null)a.delete(s);else a.set(s,p);let Z=new Request(c,{headers:a}),j=await($.fetch??fetch)(Z),W=await H.adapter.rewriteResponse?.({...Y,accountId:K,request:Z,response:j,attempt:R})??j;m=W.status,H.adapter.quotaFromHeaders?.(W.headers,W.status,R);let A=W.ok?void 0:await H.adapter.limitFromResponse?.({status:W.status,headers:W.headers,body:()=>W.clone().text(),attempt:R});if(A&&/^(vault-newer|local-newer|relay-direct):/.test(A.reason)&&B<2){if(n(W),await z.chooseAccount({...Y,rerouteFrom:{accountId:K,limit:A}})!==K)throw Error("Native Prime retry changed account");continue}if(!W.ok)return n(W),{ok:!1,status:m,ms:performance.now()-V,error:"Native Prime upstream refused the request"};let E=x$(await W.json()),w=x$(E.usage),y={inputTokens:typeof w.input_tokens==="number"?w.input_tokens:void 0,outputTokens:typeof w.output_tokens==="number"?w.output_tokens:void 0};if(R.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(W.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(b=await z.recordPrime(q.attempt.provenance,y),!b)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:m,ms:performance.now()-V,usage:y}}finally{await H.adapter.onAttemptEnd?.(R,{status:m,outputStarted:!1,...b?{}:{error:{reason:i?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-V}}finally{H.dispose()}},T=new ZX({storagePath:$.paths.legacyConfig,loadStorage:async()=>(await X.read()).policyStorage,async getAccountFingerprint(K){let Y=await X.read(),H=Y.accounts.find((B)=>B.id===K);if(!JX(H)||H?.type!=="oauth")return;if(Y.policyStorage.relay?.enabled===!0&&S$(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")return;if(H.source==="vault"){let B=await X.authorizeVault(K,G.signal);return X.getOrCreateAuthLineage(K,B)}let V=await X.authorizeLocal(K,{signal:G.signal});return V.status==="usable"?X.getOrCreateAuthLineage(K,V.subject):void 0},async refreshQuota(K){let Y=await X.read();if(Y.policyStorage.relay?.enabled===!0&&S$(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await X.fetchQuota(K,$.fetch,G.signal),fresh:!0}},sendPrime(K){let Y=P(K);return N.add(Y),Y.finally(()=>N.delete(Y)),Y},async recordSuccess(K){let Y=(await X.read()).accounts.find((H)=>H.id===K);if(!Y?.prime)throw Error("Native Prime counters are unavailable");return Y.prime}});return T.start(),{manager:T,async dispose(){T.stop(),G.abort(),await Promise.allSettled(N)}}}import{createNativeUsagePublisher as YX,effectiveRelayTransport as WX,getClaudeCodeIdentityForVerifiedAccount as S2,getQuotaCheckIntervalMs as GX,getRoutingMode as A$,isQuotaBearingHeaderFrame as jX,mergeHeaderQuotaForPersistence as VX,NativeVaultNoAccountError as QX,nativeAccountCanServe as h2,nativeAccountPolicy as x2,normalizeQuotaHeaders as UX,quotaSnapshotCheckedAt as BX,quotaSnapshotHasStandardWindows as HX,readNativeAccountsForRequest as KX,remapModelId as m2,StickySessionRouter as zX,shouldFallbackStatus as MX,stickyQuotaSnapshotIsFresh as R2,stickyRouteFamilyForModel as _X}from"@cortexkit/anthropic-auth-core";var l2=($)=>["five_hour","seven_day"].some((X)=>($?.[X]?.remainingPercent??1)<=0);function k$($){let{runtime:X}=$,z=YX("native-auth"),G=new Map,N=(Z)=>{let j=Z.routingPath;if(!j)throw Error("Native routing storage is unavailable");let W=G.get(j);if(!W)W=new zX({path:j,vaultSeed:Z.routingSeed,onLockEvent:X.onLockEvent,localRecoveryPath:Z.mode==="local"?Z.routingRecoveryPath:void 0}),G.set(j,W);return W.setVaultSeed(Z.routingSeed),W},L=new WeakMap,P=new Map,T=new Map,K=new Map,Y=new Map,H=new WeakSet,V=!1,B=()=>{while(P.size>512){let Z=P.keys().next();if(!Z.done)P.delete(Z.value)}},O=(Z,j)=>JSON.stringify([Z.sessionID,Z.kind,Z.modelID,j]),q=(Z)=>{if(V)throw Error("Native Anthropic source is closed");let j=K.get(Z.sessionID);if(!j){j=new AbortController,K.set(Z.sessionID,j);while(K.size>512){let W=K.keys().next();if(!W.done)c.forgetSession?.(W.value)}}return j},R=(Z,j,W)=>h2(Z)&&(Z.type==="api"||x2(Z,j,m2(W)).status==="allowed"),m=async(Z,j,W,A)=>{let E=await X.read();A.signal.throwIfAborted(),b(E);let w=E.accounts.find((y)=>y.id===Z);if(!w||w.type!==W||!R(w,E,j))return!1;if(W==="api"){let y=E.accounts.find((s)=>s.id==="main"&&s.type==="oauth");return!!y&&R2(y.quota,E.policyStorage)&&l2(y.quota)}return!0},b=(Z)=>{let j=Z.policyStorage.relay;if(j?.enabled===!0&&WX(j.transport,j.url)==="websocket")throw new K2},i=async(Z,j)=>{if(b(Z),j||Z.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let W=await X.getRelayConfig();if(!W)throw Error("request refused: native HTTP relay configuration is unavailable");if(W.transport!=="http")throw new K2;return{dispatch:{kind:"http-relay",url:W.url,token:W.token},relayFallback:W.fallbackToDirect}};async function n(Z,j,W){if(Z.kind==="local")await X.publishLocal(Z.subject,W);else if(Z.kind==="vault"&&j.receipt)await X.vault.publish(j.receipt,W);else if(Z.kind==="api"&&W.lastUsed!==void 0)await X.publishApi(Z.subject,{lastUsed:W.lastUsed})}let c={async chooseAccount(Z){let j=q(Z);$.onOwnedRequest?.();let W=await X.read();j.signal.throwIfAborted(),b(W);let A=m2(await $.resolveModelId?.(Z)??Z.modelID);if(j.signal.throwIfAborted(),W.mode==="claustrum")W=await KX(X,j.signal),j.signal.throwIfAborted();if(W.policyStorage.quota?.enabled!==!1){let h=!1;for(let o of W.accounts){if(!h2(o)||o.type!=="oauth")continue;if(HX(o.quota)?R2(o.quota,W.policyStorage,Date.now(),A):Date.now()-BX(o.quota)<GX(W.policyStorage))continue;try{await X.fetchQuota(o.id,$.fetch,j.signal,void 0,"admission"),h=!0}catch{j.signal.throwIfAborted()}}if(h)W=await X.read();j.signal.throwIfAborted()}let E=Z.rerouteFrom?P.get(Z.rerouteFrom.limit.reason):void 0;if(Z.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(Z.rerouteFrom.limit.reason)&&!E)return;if(E&&Z.rerouteFrom){P.delete(Z.rerouteFrom.limit.reason);let h=W.accounts.find((U)=>U.id===E.accountId);if(!h||!R(h,W,A))return;let o=O(Z,E.accountId),l=T.get(o)??[];return l.push(E),T.set(o,l),E.accountId}let w=[];for(let h of W.accounts){if(h.type!=="oauth"||!R(h,W,A))continue;if(h.source==="local"){let o=await X.authorizeLocal(h.id,{signal:j.signal,policy:(l,U)=>x2(l,U,A)});if(j.signal.throwIfAborted(),o.status!=="usable")continue}w.push(h)}let y=w.filter((h)=>h.id!==Z.rerouteFrom?.accountId);if(A$(W.policyStorage)==="sticky-balanced"){let h=y.map((l,U)=>({accountId:l.id,order:U,quota:l.quota??{kind:"unknown"}})),o=await N(W).resolve({sessionId:Z.sessionID,family:_X(A),modelId:A,affinityModelId:Z.modelID,candidates:h,retainAccountIds:new Set(y.map((l)=>l.id)),...W.mode==="claustrum"?{accountIdentities:new Map(W.accounts.flatMap((l)=>l.accountIdentity?[[l.id,l.accountIdentity]]:[]))}:{},storage:W.policyStorage,inputBytes:1,preferredAccountId:Z.previousAccountId});if(j.signal.throwIfAborted(),o)return o.accountId}else{let o=A$(W.policyStorage)==="fallback-first"?[...y.filter((l)=>l.id!=="main"),...y.filter((l)=>l.id==="main")]:[...y.filter((l)=>l.id==="main"),...y.filter((l)=>l.id!=="main")];if(o[0])return o[0].id}if(W.mode==="claustrum")throw new QX;let s=W.accounts.find((h)=>h.id==="main"&&h.type==="oauth");if(!s)return;let p=s.quota;if(Z.rerouteFrom?.limit.status===429||!R2(p,W.policyStorage))try{p=await X.fetchQuota("main",$.fetch,j.signal)}catch{return}if(j.signal.throwIfAborted(),!l2(p))return;return W.accounts.find((h)=>h.type==="api"&&h2(h)&&h.id!==Z.rerouteFrom?.accountId)?.id},async authorizeAccount(Z,j){let W=q(Z),A=await X.read();W.signal.throwIfAborted(),b(A);let E=m2(await $.resolveModelId?.(Z)??Z.modelID);W.signal.throwIfAborted();let w=A.accounts.find((S)=>S.id===j);if(!w||!R(w,A,E))return;let y=O(Z,j),s=T.get(y),p=s?.shift();if(s?.length===0)T.delete(y);let{dispatch:h,relayFallback:o}=await i(A,p?.direct===!0);if(W.signal.throwIfAborted(),p?.auth){if(!await m(j,E,p.auth.route,W))return;let S=L.get(p.auth.provenance);if(S?.receipt?.expiresAtMs!==void 0&&S.receipt.expiresAtMs!==null&&S.receipt.expiresAtMs<Date.now()+300000)return;if(S)L.set(p.auth.provenance,{...S,scope:{...Z,modelID:E},account:w,active:W,relayFallback:o});return Y.set(Z.sessionID,j),{...p.auth,dispatch:h}}let l={scope:{...Z,modelID:E},active:W,account:w,retry:p?.retry??!1,relayFallback:o,quota:w.quota};if(w.type==="api"){let S=A.accounts.find((r)=>r.id==="main"&&r.type==="oauth");if(!S||!R2(S.quota,A.policyStorage)||!l2(S.quota))return;let x=await X.authorizeApi(j,W.signal);if(W.signal.throwIfAborted(),!await m(j,E,"api",W))return;let k={kind:"api",subject:x.subject};return L.set(k,l),Y.set(Z.sessionID,j),{route:"api",headers:x.authHeader==="authorization-bearer"?{authorization:`Bearer ${x.apiKey}`}:{"x-api-key":x.apiKey},baseURL:x.baseURL,provenance:k,dispatch:h}}if(w.source==="vault"){let S=await X.authorizeVault(j,W.signal);if(W.signal.throwIfAborted(),!await m(j,E,"oauth",W))return;let x={kind:"vault",credentialId:S.credentialId,recordVersion:S.recordVersion};L.set(x,{...l,receipt:S});let k=S.assertedAccountIdentity;if(!k)return;return Y.set(Z.sessionID,j),{route:"oauth",accessToken:S.accessToken,provenance:x,dispatch:h,identity:S2(k,k)}}let U=await X.authorizeLocal(j,{signal:W.signal,policy:(S,x)=>x2(S,x,E)});if(W.signal.throwIfAborted(),U.status!=="usable")return;if(!await m(j,E,"oauth",W))return;let M={kind:"local",subject:U.subject};L.set(M,{...l,access:U.access}),Y.set(Z.sessionID,j);let _=U.subject.binding.identity;return{route:"oauth",accessToken:U.access,provenance:M,dispatch:h,identity:S2(_,_)}},async requestOptions(Z){let j=q(Z),W=await X.read();j.signal.throwIfAborted();let A=W.accounts.find((w)=>w.id===Z.accountId);if(!A||!R(A,W,Z.modelID))throw Error("request refused: native account is ineligible for this model");let E=L.get(Z.provenance);if(E)L.set(Z.provenance,{...E,scope:{...E.scope,modelID:Z.modelID}});return $.requestOptions(Z,W)},async admitRequest(Z){let j=L.get(Z.provenance);if(!j||!await m(Z.accountId,Z.modelID,Z.route,j.active))throw Error("request refused: native account policy changed before dispatch");L.set(Z.provenance,{...j,scope:{...j.scope,modelID:Z.modelID}})},onRequestPrepared:(Z)=>$.onRequestPrepared?.(Z),responseOptions(Z){return $.responseOptions?.({...Z,modelID:L.get(Z.provenance)?.scope.modelID??Z.modelID})},quotaFromHeaders(Z,j){let W=L.get(j.provenance),A=q$(Z);if(A)$.onRequestId?.(j,A);if(!W||j.route!=="oauth"||!jX(Z))return;let E=j.provenance.kind==="local"?j.provenance.subject.binding.identity:W.receipt?.assertedAccountIdentity,w={...UX(Z),...E?{accountIdentity:E}:{}};W.quota=VX(W.quota,w);let y=z.observe(n(j.provenance,W,{quota:W.quota}));return a.set(j.provenance,y),w},async limitFromResponse(Z){let j=L.get(Z.provenance);if(!j)return;if(Z.status===401&&j.receipt){if(!H.has(j.receipt))H.add(j.receipt),await X.vault.reportFailure(j.receipt,401,Z.dispatch==="http-relay"?"relay_status_field":"direct");if(j.retry||j.active.signal.aborted)return;let A=j.active,E=await X.vault.prepareRetry(j.receipt,A.signal);if(A.signal.throwIfAborted(),!E.retry)return;let w=E.receipt,y=w.assertedAccountIdentity;if(!y)return;let s={kind:"vault",credentialId:w.credentialId,recordVersion:w.recordVersion};L.set(s,{...j,receipt:w,retry:!0});let p=`vault-newer:${Z.attemptId}`;return P.set(p,{sessionID:Z.sessionID,accountId:Z.accountId,retry:!0,auth:{route:"oauth",accessToken:w.accessToken,provenance:s,identity:S2(y,y)}}),B(),{reason:p,status:401}}if(Z.status===401&&Z.provenance.kind==="local"&&j.access&&!j.retry){if(j.active.signal.aborted)return;let A=j.active,E=await X.authorizeLocal(Z.accountId,{rejectedAccessToken:j.access,signal:A.signal,policy:(p,h)=>x2(p,h,j.scope.modelID)});if(A.signal.throwIfAborted(),E.status!=="usable"||E.access===j.access)return;let w={kind:"local",subject:E.subject};L.set(w,{...j,access:E.access,retry:!0});let y=E.subject.binding.identity,s=`local-newer:${Z.attemptId}`;return P.set(s,{sessionID:Z.sessionID,accountId:Z.accountId,retry:!0,auth:{route:"oauth",accessToken:E.access,provenance:w,identity:S2(y,y)}}),B(),{reason:s,status:401}}let W=await X.read();if(MX(Z.status,W.policyStorage))return{reason:`provider-${Z.status}`,status:Z.status};return},limitFromRelayFailure(Z){let j=L.get(Z.provenance);if(!j?.relayFallback||j.active.signal.aborted||!(Z.status===401||Z.status>=500))return;let W=`relay-direct:${Z.attemptId}`;return P.set(W,{sessionID:Z.sessionID,accountId:Z.accountId,direct:!0,retry:!1}),B(),{reason:W}},limitFromStreamError(Z){return Z.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(Z,j){let W=L.get(j.provenance);if(j.dispatch==="http-relay"&&W?.relayFallback&&!W.active.signal.aborted&&Z.status===void 0){let A=`relay-direct:${j.attemptId}`;return P.set(A,{sessionID:j.sessionID,accountId:j.accountId,direct:!0,retry:!1}),B(),{reason:A}}return},async onAttemptEnd(Z,j){let W=L.get(Z.provenance);if(!W)return;try{if(await a.get(Z.provenance),j.status===401&&W.receipt&&!H.has(W.receipt))H.add(W.receipt),await X.vault.reportFailure(W.receipt,401,Z.dispatch==="http-relay"?"relay_status_field":"direct");if(!j.localRefusal&&j.status!==void 0)z.publish(()=>n(Z.provenance,W,{lastUsed:Date.now()}))}finally{L.delete(Z.provenance),a.delete(Z.provenance)}},forgetSession(Z){K.get(Z)?.abort(),K.delete(Z),Y.delete(Z);for(let[j,W]of P)if(W.sessionID===Z)P.delete(j);for(let[j,W]of T)if(W[0]?.sessionID===Z)T.delete(j);$.onForgetSession?.(Z)},servedAccount:(Z)=>Y.get(Z),resetRouting:async(Z)=>N(await X.read()).clear(Z),async recordPrime(Z,j){let W=L.get(Z);if(!W||W.active.signal.aborted)return!1;if(Z.kind==="local")return X.incrementPrimeUsage(W.account.id,Z.subject,j);if(Z.kind==="vault"&&W.receipt)return X.incrementPrimeUsage(W.account.id,W.receipt,j);return!1},drainRoutingPublications:()=>Promise.all([X.drainRoutingPublications(),...[...G.values()].map((Z)=>Z.drain())]).then(()=>{}),close(){V=!0;for(let Z of K.values())Z.abort();return K.clear(),T.clear(),P.clear(),Promise.all([z.drain(),c.drainRoutingPublications()]).then(()=>{})}},a=new WeakMap;return c}import{remapModelId as CX}from"@cortexkit/anthropic-auth-core";function w$(){let $=new D$,X=new Map,z=new Map,G=new Map,N=new Set,L=new Set,P=new Map,T=(K)=>{while(K.size>512){let Y=K.keys().next();if(!Y.done)K.delete(Y.value)}};return{async install(K){let Y=[];try{Y.push(await K.session.hook("context",(H)=>{let V=H.messages.map((O)=>{return{info:{id:O.id,sessionID:H.sessionID,role:O.role,agent:H.agent,model:{providerID:H.model.providerID,modelID:H.model.id}},parts:O.content.map((q)=>({type:q.type,...q.type==="text"?{text:q.text}:{}}))}});$.observeMessages(V);let B=H.messages.findLast((O)=>O.role==="user"&&O.id);if(B?.id)X.set(H.sessionID,B.id);if(B?.content.some((O)=>O.type==="text"&&O.text===E2))N.add(H.sessionID);else N.delete(H.sessionID);T(X)},{providerID:"anthropic"})),Y.push(await K.session.hook("model.request",(H)=>{if(H.kind!=="primary")return;let V=X.get(H.sessionID);if(!V)return;if($.markHeaders({sessionId:H.sessionID,messageId:V,agent:H.agent,headers:H.headers}),N.has(H.sessionID))H.headers[L2]="1"},{providerID:"anthropic"}))}catch(H){throw await Promise.allSettled(Y.map((V)=>V.dispose())),H}return{dispose:async()=>{await Promise.all(Y.map((H)=>H.dispose()))}}},requestOptions(K,Y){let H=$.resolveHeader(K.correlation[O2]);if(H)z.set(K.attemptId,H),T(z);P.set(K.attemptId,K.sessionID),T(P);let V=K.correlation[L2]==="1";if(V)L.add(K.attemptId);return{cache1hEnabled:K.agent!=="compaction"&&K.agent!=="title"&&(Y.policyStorage.claudeCache?.enabled??!0),cache1hMode:Y.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:Y.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:Y.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,turnEndNoteEnabled:!0,turnEndNote:Y.policyStorage.turnEndNote,serverSideFallbackEnabled:b$(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:V,billingLineage:H?{promptId:H.promptId,previousRequestId:H.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:G.get(K.sessionID)}},responseOptions(K){return{serverSideFallbackModel:CX(K.modelID),laneStart:L.has(K.attemptId),onMessageStart(Y){if(K.kind==="primary"&&typeof Y.id==="string")G.set(K.sessionID,Y.id),T(G)},onStreamEnd(){z.delete(K.attemptId),L.delete(K.attemptId),P.delete(K.attemptId)}}},onRequestId(K,Y){$.commit(z.get(K.attemptId),Y)},forgetSession(K){$.clearSession(K),X.delete(K),G.delete(K),N.delete(K);for(let[Y,H]of P)if(H===K)z.delete(Y),L.delete(Y),P.delete(Y)}}}var A2="cortexkit-anthropic-auth",SX='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',xX="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",RX="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function AX($){let X=$.authorize??LX,z=$.exchange??TX,G=()=>{if(!$.isActive())throw Error("Claude authentication setup is closed")},N=async()=>{let T;try{T=await $.readMode()}catch{throw Error(RX)}return G(),T},L=async()=>{if(await N()!=="local")throw Error(SX)};return{integrationID:"anthropic",methods:[{method:{id:I$,type:"oauth",label:f$},async authorize(){G(),await L();let T=await X("max");return G(),{mode:"code",url:T.url,instructions:"Paste the authorization code returned by Claude.",callback:async(K)=>{G();let Y=await z(K,T.verifier,T.redirectUri,T.state);if(!$.isActive()||Y.type!=="success")throw Error("Claude sign-in did not complete");return{access:Y.access,refresh:Y.refresh,expires:Y.expires}}}}}],vault:{method:{id:g$,type:"oauth",label:"Claude vault accounts"},async activate(){if(G(),await N()!=="claustrum")throw Error(xX)}},async onLogin(T){G(),await L(),await $.runtime.loginOAuth({routeId:"main",credential:T,replace:!0}),G()},label:"Claude native account pool"}}function qX($){return{readMode:()=>OX("opencode",$),disconnectVault:()=>FX({host:"opencode",env:$})}}function d2($={}){return{id:A2,setup:(X)=>h$(X,$)}}async function h$($,X={}){let z=X.paths??await EX(),G=NX({paths:z,host:"opencode",local:X.local,vault:X.vault}),N=qX(X.vault?.env??process.env),L=!0,P=w$(),T=T$(),K,Y,H,V=k$({runtime:G,paths:z,fetch:X.fetch,requestOptions:P.requestOptions,responseOptions:P.responseOptions,onRequestId:P.onRequestId,onForgetSession:P.forgetSession,onRequestPrepared:async(b)=>{try{await H?.track(b)}catch{y$.warn("cachekeep","live request tracking failed")}},resolveModelId:async(b)=>T.modelId(b.modelID),onOwnedRequest:()=>{K??=M$(G,X.fetch),Y??=R$({runtime:G,paths:z,source:V,fetch:X.fetch})}});H=H$({...X.cacheKeep,runtime:G,source:V,fetch:X.fetch,isSubagent:async(b)=>Boolean((await $.session.get({sessionID:b})).parentID)});let B=F$({runtime:G,source:V,cacheKeepRegistry:H.registry,start:async(b,i)=>{await $.session.synthetic({sessionID:b,text:i,description:"Claude lane start",resume:!0})}}),O=[],q=await K$($,{source:V,log:{warn:(b,i)=>y$.warn("opencode2",b,i)}},{credential:O$}).catch(async(b)=>{throw B.close(),await H?.dispose(),await V.close(),G.close(),b}),R,m=()=>{if(R)return R;return L=!1,B.close(),V.close(),R=(async()=>{await Promise.allSettled([q.dispose(),K?.dispose(),Y?.dispose(),H?.dispose(),...O.map((b)=>b.dispose())]),await V.close(),G.close()})(),R};try{O.push(await P.install($)),O.push(await T.install($)),O.push(await k2($,AX({isActive:()=>L,readMode:N.readMode,runtime:G})));let b={host:"opencode",dispatch:B.dispatch,readStatus:(n)=>B.readStatus(n),readAccounts:()=>G.read(),readMode:N.readMode,disconnectVault:N.disconnectVault,interactive:!0},i=PX(b);return O.push(await v$($,i,B)),m}catch(b){throw await m(),b}}var iJ={id:A2,setup:d2().setup,server:m$};export{h$ as setupAnthropicAuth,iJ as default,d2 as createAnthropicAuthPlugin,A2 as ANTHROPIC_AUTH_PLUGIN_ID};

package/dist/v2/sidebar.d.ts

@@ -0,0 +1,13 @@
+import { type NativeAccountSnapshot } from '@cortexkit/anthropic-auth-core';
+import type { SidebarState } from '../sidebar-state';
+export interface NativeSidebarExtras {
+    /** The account that served the requested session, if any. */
+    readonly activeId: string | undefined;
+    readonly trackedSessions: number;
+    readonly now: number;
+}
+/**
+ * The OpenCode 1 sidebar state, projected from the native account snapshot.
+ * The snapshot carries no tokens, keys or receipts, and neither does this.
+ */
+export declare function buildNativeSidebarState(snapshot: NativeAccountSnapshot, extras: NativeSidebarExtras): SidebarState;

package/dist/v2/source.d.ts

@@ -34,6 +34,8 @@ export interface NativeSource extends NativeAnthropicSource<OAuthQuotaSnapshot,
     readonly close: () => Promise<void>;
     readonly drainRoutingPublications: () => Promise<void>;
     readonly resetRouting: (sessionID: string) => Promise<void>;
+    /** The account that served the session's latest authorization, if any. */
+    readonly servedAccount: (sessionID: string) => string | undefined;
     readonly recordPrime: (provenance: NativeSourceProvenance, usage: {
         inputTokens?: number;
         outputTokens?: number;