@cortexkit/opencode-anthropic-auth 2.2.3 → 2.2.5

package/dist/v2/adapter.d.ts

@@ -152,6 +152,8 @@ export interface NativeAnthropicAttemptOutcome extends AttemptOutcome {
 export interface NativeAnthropicSource<Q, P> {
     /** Picks the account for one request; `undefined` refuses it. */
     readonly chooseAccount: (input: ChooseAccountInput) => Promise<string | undefined> | string | undefined;
+    /** Discards one queued choice that the installer will not authorize. */
+    readonly dropChoice?: (input: AccountRequest) => Promise<void> | void;
     /**
      * The credential for one send with the chosen account; `undefined` refuses
      * the request before anything is sent.
@@ -218,7 +220,9 @@ export interface NativeAnthropicAdapterDeps<Q, P> {
     readonly requestGzipLatch?: RequestGzipLatch;
 }
 export interface NativeAnthropicAdapter<Q, P> {
-    readonly adapter: OpenCode2AuthAdapter<Q, NativeAnthropicAttemptData<P>>;
+    readonly adapter: OpenCode2AuthAdapter<Q, NativeAnthropicAttemptData<P>> & {
+        readonly dropChoice: (input: AccountRequest) => Promise<void> | void;
+    };
     /**
      * Drops the session's authorized sends that have not been rewritten yet,
      * revokes its choices, authorizations and rewrites still in progress so

package/dist/v2/server.js

@@ -1,4 +1,4 @@
-import{a as O2,b as q$,c as D$,d as e2,e as $$,f as E2,g as L2,h as X$,i as J$,j as b$,k as Z$,l as Y$,m as W$,n as G$,o as j$,p as m$}from"../index-79frmfve.js";import"../index-6chd6jnr.js";import"../index-hazrk5c3.js";import{u as v$}from"../index-jvhs8sxv.js";import{v as I$,w as f$,y as g$}from"../index-0kxy8k2c.js";import"../index-b1dvkp15.js";import"../index-20d6rmjj.js";import"../index-ppdrzs41.js";import"../index-62x1p34p.js";import{acquireNativeAccountRuntime as zX,authorize as _X,createNativeUi as CX,disconnectNativeVaultForHost as NX,exchange as LX,logger as y$,readNativeEnrollmentMode as PX,resolveNativePoolPaths as FX}from"@cortexkit/anthropic-auth-core";class _2 extends Error{kind;providerID;sessionID;requestKind;constructor($){super($.message??`${$.providerID} ${$.requestKind} request refused (${$.kind})`);this.name="OpenCode2AuthError",this.kind=$.kind,this.providerID=$.providerID,this.sessionID=$.sessionID,this.requestKind=$.requestKind}}function Q2($){return`common-auth-placeholder.${$}`}function i2($){let X=Q2($.integrationID);return{type:"oauth",methodID:$.methodID,access:X,refresh:X,expires:$.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function q2($,X){if($?.type!=="oauth")return!1;let M=X===void 0?void 0:Q2(X),W=(L)=>M===void 0?L.startsWith("common-auth-placeholder."):L===M;return W($.access)&&W($.refresh)}var c2="No browser sign-in: this connects the plugin to the accounts in its vault.";async function k2($,X){let M=X.now??Date.now,{integrationID:W}=X,L=(T)=>i2({integrationID:W,methodID:T,now:M()}),N=async(T,K)=>{return await X.onLogin(T,{integrationID:W,methodID:K}),L(K)},P=(T)=>async(K)=>{let Y=T.method.id,B=await T.authorize(K),V={url:B.url,instructions:B.instructions,...B.expiresAt===void 0?{}:{expiresAt:B.expiresAt}};if(B.mode==="auto")return{...V,mode:"auto",callback:B.callback.then((O)=>N(O,Y))};let U=B.callback;return{...V,mode:"code",callback:async(O)=>N(await U(O),Y)}};return $.integration.transform((T)=>{let K=X.label===void 0?{}:{label:()=>X.label};for(let V of X.methods)T.method.update({integrationID:W,method:V.method,authorize:P(V),refresh:async(U)=>{if(!q2(U,W))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return L(U.methodID)},...K});let Y=X.vault;if(Y===void 0)return;let B=Y.method.id;T.method.update({integrationID:W,method:Y.method,authorize:async()=>({url:"",instructions:Y.instructions??c2,mode:"auto",callback:Promise.resolve().then(()=>Y.activate({integrationID:W,methodID:B})).then(()=>L(B))}),refresh:async(V)=>{if(!q2(V,W)||V.methodID!==B)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return L(B)},...K})})}function l$($){let X=[],M;for(let W of $.split(/\r?\n/))if(W.startsWith("data:"))X.push(W.slice(5).replace(/^ /,""));else if(W.startsWith("event:"))M=W.slice(6).trim();if(X.length===0)return;return M===void 0?{data:X.join(`
-`)}:{event:M,data:X.join(`
-`)}}function D2($,X){let M=new TextDecoder,W="",L=(P)=>{let T=l$(P);if(!T)return;try{$(T)}catch(K){X(K)}},N=()=>{for(;;){let P=/\r?\n\r?\n/.exec(W);if(!P)return;let T=W.slice(0,P.index);W=W.slice(P.index+P[0].length),L(T)}};return new TransformStream({transform(P,T){T.enqueue(P),W+=M.decode(P,{stream:!0}),N()},flush(){if(W+=M.decode(),N(),W.trim()!=="")L(W);W=""}})}var o2=512,B2="x-common-auth-attempt",H2=($,X)=>JSON.stringify([$,X]),G2=($)=>({providerID:$.model.providerID,modelID:$.model.id,sessionID:$.sessionID,agent:$.agent,kind:$.kind});function d$($){let X=$.headers;return typeof X==="object"&&X!==null}function p$($,X){let M=$.getReader();return new ReadableStream({async pull(W){let L;try{L=await M.read()}catch(N){X({reason:"failed",message:N instanceof Error?N.message:String(N)}),W.error(N);return}if(L.done)X(),W.close();else W.enqueue(L.value)},async cancel(W){X({reason:"cancelled",...W===void 0?{}:{message:String(W)}}),await M.cancel(W)}})}function b2($,X){for(let[M,W]of Object.entries(X)){let L=M.toLowerCase();for(let N of Object.keys($))if(N.toLowerCase()===L)delete $[N];if(W!==null)$[M]=W}}function u$($,X){for(let[M,W]of Object.entries(X))if(W===null)$.delete(M);else $.set(M,W)}async function w2($,X,M={}){let{providerID:W}=X,L=M.gateOnPlaceholder,N=(J)=>L===void 0||L.credential(J)===Q2(W),P=M.logger,T=Math.max(1,M.maxRecords??o2),K=[...M.hostCredentials??[Q2(W)],...L?[Q2(W)]:[]].filter((J)=>J!==""),Y=new Map,B=new WeakMap,V=new Map,U=new Set,O=new Map,q=!1,R=!1,m=new Map,b=0,i=!1,n=new Map,c=(J,Q)=>{try{P?.warn(J,Q)}catch{}},a=(J)=>J instanceof Error?J.message:String(J),Z=async(J,Q)=>{let C=m.get(J);if(!C||C.size===0)return;await Promise.all([...C].map(async(F)=>{try{await F(Q)}catch(I){c("opencode2 auth listener threw; the request is unaffected",{event:J,error:a(I)})}}))},j=async(J,Q)=>{try{await X.onAttemptEnd?.(J,Q)}catch(C){c("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:J.attemptId,error:a(C)})}},G=(J,Q)=>{if(J.ended||!J.attempt)return;let C={...J.status===void 0?{}:{status:J.status},outputStarted:J.outputStarted,...J.limit?{limit:J.limit.signal}:{},...Q?{error:Q}:{}};if(Q)J.endError=Q;J.ended=j(J.attempt,C)},A=(J,Q)=>G(J,{reason:"abandoned",message:Q}),E=(J)=>[...Y.values()].filter((Q)=>Q.key===J),w=(J)=>E(J).at(-1),y=(J)=>{if(Y.delete(J.id),!E(J.key).length)V.delete(J.key)},s=(J)=>{Y.set(J.id,J);while(Y.size>T){let Q=Y.values().next().value;if(Q===void 0)break;A(Q,"dropped to keep the record bound"),y(Q)}},p=(J)=>J.accountId===void 0?void 0:{...J.scope,accountId:J.accountId},h=(J,Q)=>new _2({kind:"no-account",providerID:W,sessionID:J.sessionID,requestKind:J.kind,...Q===void 0?{}:{message:Q}}),o=(J)=>{n.get(J)?.clear(),n.delete(J)},l=async(J,Q)=>{let C=()=>h(J,`${W} ${J.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(i)throw C();let F=n.get(J.sessionID);if(!F)F=new Set,n.set(J.sessionID,F);let I={};F.add(I);let v=()=>{if(!F.has(I))throw C()};try{return await Q(v)}finally{if(F.delete(I),F.size===0&&n.get(J.sessionID)===F)n.delete(J.sessionID)}},H=(J,Q)=>{for(let[C,F]of Q)if(K.some((I)=>F.includes(I)))throw new _2({kind:"host-credential-on-wire",providerID:W,sessionID:J.sessionID,requestKind:J.kind,message:`${W} ${J.kind} request still carries the host's placeholder credential in ${C}; the adapter's account headers must replace it`})},z=(J)=>{for(let Q of E(J))if(Q.ended||!Q.attempt)y(Q);else if(Q.transport==="ws"||Q.judged)A(Q,"a newer attempt of its session and kind began"),y(Q)},_=async(J,Q,C,F)=>{let I=H2(J.sessionID,J.kind),v=V.get(I);V.delete(I);let D=v?.accountId??w(I)?.accountId;z(I);let g={...J,...D===void 0?{}:{previousAccountId:D},...v?.rerouteFrom===void 0?{}:{rerouteFrom:v.rerouteFrom}},u=await X.chooseAccount(g);C();let W2={},p2;if(u!==void 0){let F2=await X.accountHeaders({...J,accountId:u});if(C(),d$(F2))W2=F2.headers,p2=F2.attempt;else W2=F2}let u2=`attempt-${++b}`,z2={id:u2,key:I,scope:J,accountId:u,headers:W2,attempt:u===void 0?void 0:{...J,accountId:u,attemptId:u2,transport:F,data:p2},...F===void 0?{}:{transport:F},outputStarted:!1};if(s(z2),z2.attempt)Z("select",{...J,accountId:z2.attempt.accountId,hook:Q,...g.previousAccountId===void 0?{}:{previousAccountId:g.previousAccountId},...g.rerouteFrom===void 0?{}:{rerouteFrom:g.rerouteFrom},handle:z2.attempt});return z2},S=async(J,Q,C,F,I)=>{let v=H2(J.sessionID,J.kind),D=F===void 0?void 0:Y.get(F);if(D?.key!==v)D=void 0;if(!D){if(D=w(v),E(v).filter((u)=>u.transport===void 0&&!u.ended).length>1&&!R)R=!0,c("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:J.sessionID,kind:J.kind})}if(!D||D.transport!==void 0||D.ended)D=await _(J,Q,I,C);else if(D.transport=C,D.attempt)D.attempt.transport=C;if(C==="ws"){for(let g of E(v))if(g!==D&&g.transport==="ws")A(g,"a newer attempt of its session and kind went out over WebSocket")}return D},x=async(J,Q)=>{try{return await Q()}catch(C){throw G(J,{reason:"failed",message:a(C)}),C}},k=(J,Q)=>{let C=E(H2(J,Q)).filter((F)=>F.transport==="ws").at(-1);return C?.attempt!==void 0&&!C.ended?C:void 0},f=(J,Q,C)=>{let F=p(J);if(!F||!J.attempt||J.limit)return;J.limit={signal:Q,delivered:Z("limit",{...F,via:C,limit:Q,outputStarted:J.outputStarted,handle:J.attempt})}},r=(J,Q,C,F)=>{let I=p(J);if(!I||!J.attempt)return;Z("quota",{...I,transport:Q,...F===void 0?{}:{status:F},quota:C,handle:J.attempt})},d=(J,Q,C,F)=>{let I=J.attempt;if(!I)return;let v=X.inspectEvent?.(F===void 0?{transport:Q,data:C,attempt:I}:{transport:Q,data:C,event:F,attempt:I});if(!v)return;if(v.quota!==void 0)r(J,Q,v.quota);if(v.outputStarted)J.outputStarted=!0;if(v.limit)f(J,v.limit,Q);if(v.error!==void 0)G(J,{reason:"failed",message:v.error});else if(v.done)G(J)},X2=(J,Q)=>{let C=J.attempt;if(!C||Q.accountId===J.accountId)return;if(C.reboundFrom??=C.accountId,C.accountId=Q.accountId,"data"in Q)C.data=Q.data;J.accountId=Q.accountId},J2=(J)=>!J.attempt||J.endError!==void 0||J.status!==void 0&&J.status>=400,Z2=(J)=>{let Q=[...Y.values()].filter((g)=>g.scope.sessionID===J),C=Q.filter((g)=>g.limit&&!g.rerouted).at(-1);if(C)return C;let F=Q.filter((g)=>g.scope.kind==="primary"),I=F.length>0?F:Q;if(I.length<=1)return I[0];let v=I.filter((g)=>!g.judged&&J2(g)).at(-1);if(v)return v;let D=I.filter((g)=>g.attempt&&!g.ended);if(D.length>1)return"ambiguous";return D[0]??I.at(-1)},$2={providerID:W},t=[];t.push(await $.session.hook("model.request",(J)=>{if(L)return;return l(G2(J),async(Q)=>{let C=await _(G2(J),"model.request",Q);if(Q(),C.accountId===void 0)throw h(C.scope);b2(J.headers,{...C.headers,[B2]:C.id})})},$2)),t.push(await $.session.hook("http.request",(J)=>{if(L){let Q=N(J.request.headers);if(O.set(J.sessionID,Q),!Q)return}return l(G2(J),async(Q)=>{let C=J.request.headers.get(B2)??void 0,F=L?await _(G2(J),"http.request",Q,"http"):await S(G2(J),"http.request","http",C,Q);Q();let I=p(F),v=F.attempt;if(!I||!v)throw h(F.scope);await x(F,async()=>{let D=J.request;if(X.rewriteRequest){if(C!==void 0){let W2=new Headers(D.headers);W2.delete(B2),D=new Request(D,{headers:W2})}D=await X.rewriteRequest({...I,request:D,attempt:v})??D,Q()}let g=new Headers(D.headers);g.delete(B2),u$(g,F.headers),H(F.scope,g.entries());let u=new Request(D,{headers:g});B.set(u,F),J.request=u})})},$2)),t.push(await $.session.hook("http.response",async(J)=>{let Q=B.get(J.request);if(!Q){if(L)return;if(!q)q=!0,c("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:J.sessionID,kind:J.kind});return}let C=J.response;if(X.answeredBy&&Q.attempt){let g=Q.attempt,u=await x(Q,async()=>X.answeredBy?.({request:J.request,response:C,attempt:g}));if(u)X2(Q,u)}let F=p(Q),I=Q.attempt;if(!F||!I)return;Q.status=C.status;let v=X.quotaFromHeaders?.(C.headers,C.status,I);if(v!==void 0)r(Q,"http",v,C.status);if(!C.ok&&X.limitFromResponse){let g=await X.limitFromResponse({status:C.status,headers:C.headers,body:()=>C.clone().text(),attempt:I});if(g)f(Q,g,"http")}if(!C.ok||!C.body)G(Q);let D=C;if(C.body&&(X.inspectEvent||X.onAttemptEnd)){let g=C.body;if(X.inspectEvent)g=g.pipeThrough(D2((u)=>d(Q,"http",u.data,u.event),(u)=>c("opencode2 auth event inspection threw",{error:a(u)})));D=new Response(p$(g,(u)=>G(Q,u)),{status:C.status,statusText:C.statusText,headers:C.headers})}if(X.rewriteResponse)D=await X.rewriteResponse({...F,request:J.request,response:D,attempt:I})??D;if(D!==C)J.response=D},$2)),t.push(await $.session.hook("experimental.ws.handshake",(J)=>{if(L){let Q=N(new Headers(J.headers)),C=H2(J.sessionID,J.kind);if(O.set(J.sessionID,Q),U.delete(C),!Q)return}return l(G2(J),async(Q)=>{let C;for(let D of Object.keys(J.headers)){if(D.toLowerCase()!==B2)continue;C??=J.headers[D],delete J.headers[D]}let F=L?await _(G2(J),"experimental.ws.handshake",Q,"ws"):await S(G2(J),"experimental.ws.handshake","ws",C,Q);Q();let I=p(F),v=F.attempt;if(!I||!v)throw h(F.scope);await x(F,async()=>{b2(J.headers,F.headers);let D=X.rewriteHandshakeURL?.({...I,url:J.url,attempt:v});if(D!==void 0)J.url=D;if(H(F.scope,Object.entries(J.headers)),L)U.add(F.key)})})},$2));let e=X.rewriteWebSocketFrame?.bind(X);if(e)t.push(await $.session.hook("experimental.ws.send",async(J)=>{let Q=G2(J);if(L&&!U.has(H2(Q.sessionID,Q.kind)))return;let C=k(Q.sessionID,Q.kind),F=await e({...Q,attempt:C?.attempt,frame:J.frame});if(F!==void 0)J.frame=F},$2));t.push(await $.session.hook("experimental.ws.receive",(J)=>{if(L&&!U.has(H2(J.sessionID,J.kind)))return;let Q=k(J.sessionID,J.kind);if(!Q)return;try{d(Q,"ws",J.frame)}catch(C){c("opencode2 auth frame inspection threw",{error:a(C)})}},$2)),t.push(await $.session.hook("retry",async(J)=>{if(L&&O.get(J.sessionID)!==!0)return;let Q=Z2(J.sessionID);if(!Q)return;let C=J.decision;if(Q==="ambiguous"){await Z("retry",{sessionID:J.sessionID,attempt:J.attempt,reason:"host-decides",hostDecision:C,decision:C});return}let F=Q;await l(F.scope,async(I)=>{F.judged=!0;let v=C,D,g,u=F.attempt;if(F.accountId===void 0||!u)v={retry:!1},D="no-account";else if(F.outputStarted)v={retry:!1},D="output-started";else{if(!F.limit){let W2=X.limitFromError?.(J.error,u);if(W2)f(F,W2,"error")}if(F.ended)await F.ended,I();if(F.limit)await F.limit.delivered,I(),F.rerouted=!0,g={accountId:F.accountId,limit:F.limit.signal},v={retry:!0,delay:0},D="reroute";else D="host-decides"}if(J.decision=v,v.retry&&F.accountId!==void 0)V.set(F.key,{sessionID:F.scope.sessionID,accountId:F.accountId,...g===void 0?{}:{rerouteFrom:g}});await Z("retry",{sessionID:J.sessionID,...F.accountId===void 0?{}:{accountId:F.accountId},kind:F.scope.kind,attempt:J.attempt,reason:D,hostDecision:C,decision:v,...u===void 0?{}:{handle:u}})})},$2));let j2=(J)=>{o(J),O.delete(J);for(let Q of U)if(JSON.parse(Q)[0]===J)U.delete(Q);for(let Q of[...Y.values()]){if(Q.scope.sessionID!==J)continue;A(Q,"its session was forgotten"),Y.delete(Q.id)}for(let[Q,C]of V)if(C.sessionID===J)V.delete(Q)},Y2=new AbortController,V2=$.event;if(V2)(async()=>{try{for await(let J of V2.subscribe({signal:Y2.signal}))if(J.type==="session.deleted")j2(J.data.sessionID)}catch(J){if(!Y2.signal.aborted)c("opencode2 auth stopped listening for session deletion",{error:a(J)})}})();return{on(J,Q){let C=m.get(J);if(!C)C=new Set,m.set(J,C);let F=Q;return C.add(F),()=>{C.delete(F)}},accountFor(J,Q){return w(H2(J,Q))?.accountId},forgetSession:j2,get size(){return Y.size},async dispose(){if(i)return;i=!0;for(let J of n.keys())o(J);Y2.abort();for(let J of Y.values())A(J,"the installation was disposed");Y.clear(),V.clear(),U.clear(),O.clear(),m.clear(),await Promise.all(t.map(async(J)=>{try{await J.dispose()}catch(Q){c("opencode2 auth hook did not dispose cleanly",{error:a(Q)})}}))}}}import{CacheKeepManager as _1,CacheKeepSessionRegistry as C1,getDefaultCacheKeepRegistryDirectory as N1,isCacheKeepActiveNow as U$,isCacheKeepHybridActive as f2,isCacheKeepSubagentsEnabled as g2,logger as L1}from"@cortexkit/anthropic-auth-core";import{createHash as i$}from"node:crypto";import{applyCustomHeaders as c$,assertNotCustodyTombstone as o$,classifyGzipRejection as n$,createProviderErrorRedactor as n2,createProviderErrorResponseScope as r2,decideRequestGzip as r$,encodeGzipRequestBody as s$,getAccountStoragePath as a$,getRequestGzipLatch as t$,getRequestGzipLatchPath as e$,mergeAnthropicBetas as $1,remapModelId as s2,remapRequestBodyModel as X1,stripEmptyTrailingAssistantMessages as J1,TrailingAssistantHistoryError as Z1}from"@cortexkit/anthropic-auth-core";var N2="anthropic",V$="x-common-auth-attempt",Y1=["x-session-affinity","x-opencode-session","x-parent-session-id",e2,O2,L2,V$],T2=new Set(["authorization","x-api-key"]),W1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",G1=512,j1=5000,V1=500,a2=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class Q$ extends Error{sessionID;requestKind;kind="no-account";providerID=N2;constructor($,X){super(W1);this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicNoAccountError"}}class I2 extends Error{sessionID;requestKind;kind="session-forgotten";providerID=N2;constructor($,X){super("request refused: its session was closed while it was being prepared");this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicRevokedError"}}class K2 extends Error{kind="unsupported-transport";providerID=N2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class H$ extends Error{kind="local-invalid-request";status=400;check;constructor($){super($.message,{cause:$});this.name="NativeAnthropicLocalRefusal",this.check=$.check}}var U2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($);function C2($){try{return JSON.parse($)}catch{return}}function y2($){let X={};for(let[M,W]of Object.entries($??{}))X[M.toLowerCase()]=W;return X}function t2($){let X={};for(let M of Y1){let W=$.get(M);if(W!==null&&M!==V$)X[M]=W;$.delete(M)}return X}function Q1($){try{return new URL($).pathname.endsWith("/messages")}catch{return!1}}function H1($){return $ instanceof Z1||$ instanceof $$?new H$($):void 0}function U1($,X){let M=[];if($.oauth)M.push($.oauth.accessToken);for(let[W,L]of Object.entries($.apiHeaders??{})){if(L===null||!T2.has(W))continue;M.push(L.replace(/^Bearer\s+/i,""))}for(let W of T2){let L=X.get(W);if(L!==null)M.push(L.replace(/^Bearer\s+/i,""))}if($.dispatch?.kind==="http-relay")M.push($.dispatch.token);return[...new Set(M.filter(Boolean))]}var B1=new Set(["oauth-2025-04-20","claude-code-20250219",J$]);function K1($){let X=$.split(",").map((M)=>M.trim()).filter((M)=>M&&!B1.has(M));return $1(null,X)}function M1($){let X=C2($);if(!U2(X))return $;let M=J1(X.messages),W=Object.hasOwn(X,"fallbacks"),{droppedMarkers:L}=Z$(X,!1),N=W&&!Object.hasOwn(X,"fallbacks"),P=X1(X);return M>0||L>0||N||P?JSON.stringify(X):$}async function z1($,X){if(!($ instanceof Promise))return"settled";let M;try{return await Promise.race([$.then(()=>"settled"),new Promise((W)=>{M=setTimeout(()=>W("timed-out"),X)})])}finally{if(M!==void 0)clearTimeout(M)}}function M2($){let{source:X,log:M}=$,W=Math.max(1,$.maxPendingSends??G1),L=$.attemptEndTimeoutMs??j1,N=$.requestGzipLatch??t$(e$(a$())),P=new WeakSet,T=new Map,K=new WeakMap,Y=new WeakMap,B=new WeakMap,V=new Map,U=new WeakMap,O=n2([]);O.dispose();let q=(H)=>(H&&V.get(H)?.redactor)??O,R=(H)=>{let z=V.get(H);if(!z)return;V.delete(H),z.redactor.dispose(),z.scope.dispose()},m=(H,z,_,S)=>{let x=U1(z,S),k=r2(x,_);b.set(H,_),V.set(H,{sessionID:z.sessionID,redactor:n2(x),scope:k}),k.settled.then(()=>R(H));while(V.size>W){let f=V.keys().next().value;if(f===void 0)break;R(f)}},b=new WeakMap,i=(H,z)=>{let _=H?b.get(H):void 0;if(!_||!z.ok)return O.redactResponse(z);let S=r2([],_),x=S.redactResponse(z);return S.dispose(),x},n=(H,z)=>{let _=H?V.get(H)?.scope:void 0;if(!_)return i(H,z);try{return _.redactResponse(z)}catch{return i(H,z)}},c=!1,a=new WeakMap,Z=(H,z)=>{if(H&&!z.ok)a.set(z.headers,H);return z},j=(H,z)=>{if(z.dispatch!=="http-relay")return!0;let _=/^req_[A-Za-z0-9_-]+$/.test(H.get("request-id")??"");return Y.set(z,_),_},G=(H)=>new Q$(H.sessionID,H.kind),A=new Map,E=async(H,z)=>{if(c)throw new I2(H.sessionID,H.kind);let _={revoked:!1},S=A.get(H.sessionID);if(!S)S=new Set,A.set(H.sessionID,S);S.add(_);let x=()=>{if(c||_.revoked)throw new I2(H.sessionID,H.kind)};try{let k=await z(x);return x(),k}finally{let k=A.get(H.sessionID);if(k?.delete(_)&&k.size===0)A.delete(H.sessionID)}},w=(H,z)=>{T.set(H,z);while(T.size>W){let _=T.keys().next().value;if(_===void 0)break;T.delete(_),M?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:W})}},y=(H,z)=>({providerID:H.providerID,modelID:H.modelID,sessionID:H.sessionID,agent:H.agent,kind:H.kind,accountId:H.accountId,attemptId:H.attemptId,transport:H.transport,route:z.route,provenance:z.provenance,dispatch:z.dispatch}),s=(H)=>E(H,async(z)=>{let{accountId:_,...S}=H,x=await X.authorizeAccount(S,_);return z(),p(S,x)}),p=(H,z)=>{if(!z)throw G(H);if(z.dispatch?.kind==="websocket-relay")throw new K2;let _=z.dispatch?.kind==="http-relay"?"http-relay":"direct",S=z.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":z.dispatch.token}:void 0;if(z.route==="oauth"){if(!z.accessToken)throw G(H);o$(z.accessToken,N2);let f=Object.freeze({route:"oauth",provenance:z.provenance,dispatch:_});w(f,{sessionID:H.sessionID,oauth:{accessToken:z.accessToken,...z.identity?{identity:z.identity}:{}},dispatch:z.dispatch,oauthHeaders:z.headers});let r=y2(z.headers);for(let d of T2)delete r[d];return delete r["anthropic-beta"],{headers:S??{...r,"x-api-key":null,authorization:`Bearer ${z.accessToken}`},attempt:f}}let x={authorization:null,"x-api-key":null,...y2(z.headers)};if(!x.authorization&&!x["x-api-key"])throw G(H);let k=Object.freeze({route:"api",provenance:z.provenance,dispatch:_});return w(k,{sessionID:H.sessionID,...z.baseURL?{baseURL:z.baseURL}:{},dispatch:z.dispatch,apiHeaders:x}),{headers:S??x,attempt:k}},h=(H)=>E(H,(z)=>o(H,z)),o=async(H,z)=>{let{request:_,attempt:S}=H,x=S.data,k=x?T.get(x):void 0;if(x)T.delete(x);if(!x||!k||x.route==="oauth"&&!k.oauth)throw G(H);let f=new Headers(_.headers);c$(f);let r=t2(f),d=_.body===null?void 0:await _.text();z();let X2=d!==void 0&&Q1(_.url);try{if(x.route==="oauth"&&k.oauth){let{accessToken:t,identity:e}=k.oauth;for(let[Y2,V2]of Object.entries(y2(k.oauthHeaders))){if(T2.has(Y2))continue;if(V2===null)f.delete(Y2);else f.set(Y2,V2)}let j2=null;if(d!==void 0&&X2){let Y2={...y(S,x),modelID:(()=>{let Q=C2(d);return s2(U2(Q)&&typeof Q.model==="string"?Q.model:H.modelID)})(),route:"oauth",correlation:r},V2=await X.requestOptions?.(Y2)??{};z(),d=await G$(d,{...V2,...e?{identity:e}:{},sessionId:H.sessionID,onToolNameMap:(Q)=>B.set(x,Q)});let J=C2(d);j2=U2(J)?J:null}Y$(f,t,{body:j2,...e?{identity:e}:{},requestClass:X$(S.agent)?"auxiliary":"main"})}else{if(d!==void 0&&X2)d=M1(d);f.delete("authorization"),f.delete("x-api-key");for(let[e,j2]of Object.entries(k.apiHeaders??{}))if(j2===null)f.delete(e);else f.set(e,j2);if(d!==void 0&&X2&&!f.has("content-type"))f.set("content-type","application/json");let t=f.get("anthropic-beta");if(t!==null){let e=K1(t);if(e)f.set("anthropic-beta",e);else f.delete("anthropic-beta")}}}catch(t){let e=H1(t);if(!e)throw t;throw K.set(x,e.check),M?.warn("refused an Anthropic request locally; nothing was sent",{check:e.check}),e}let J2=d!==void 0?C2(d):void 0;if(await X.admitRequest?.({...y(S,x),modelID:s2(U2(J2)&&typeof J2.model==="string"?J2.model:H.modelID)}),t2(f),d!==void 0)f.delete("content-length");z(),m(x,k,U2(J2)&&J2.stream===!0?"event-stream":"http",f);let Z2=W$(_.url,k.baseURL!==void 0?{baseURL:k.baseURL}:{}).url?.toString()??_.url;if(x.route==="oauth"&&X2&&d!==void 0)await X.onRequestPrepared?.({...y(S,x),url:Z2,bodyText:d}),z();if(k.dispatch?.kind==="http-relay"){let t=d??"";f.delete("x-relay-token");let e={protocol:1,type:"request",affinity:H.sessionID,upstream:{url:Z2,method:_.method,headers:Object.fromEntries(f)},mode:"full_sync",revision:1,body:t,next_hash:`sha256:${i$("sha256").update(t).digest("hex")}`};return new Request(k.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":k.dispatch.token},redirect:"error",signal:_.signal,body:JSON.stringify(e)})}let $2=d;if(x.route==="oauth"&&X2&&d!==void 0){let t=await r$({url:Z2,body:d,latch:N});if(z(),t.gzip)$2=await s$(d),f.set("content-encoding","gzip"),P.add(x),z()}return new Request(Z2,{method:_.method,headers:f,redirect:_.redirect,signal:_.signal,...$2!==void 0?{body:$2}:{}})};return{adapter:{providerID:N2,chooseAccount:(H)=>E(H,async()=>{let z=await X.chooseAccount(H);if(!z)throw G(H);return z}),accountHeaders:s,rewriteRequest:h,rewriteHandshakeURL(){throw new K2},rewriteResponse({response:H,attempt:z}){let _=z.data;if(_&&!j(H.headers,_)){if(H.status===401)return R(_),H.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return n(_,H)}if(_&&P.has(_))P.delete(_),n$(H).then((r)=>{if(!r)return;N.latchProcess(),M?.warn("gzipped request body rejected; later requests go uncompressed",{kind:r,status:H.status})},()=>{});let S=n(_,H);if(_?.route!=="oauth"||!S.body)return Z(_,S);let x={...y(z,_),status:H.status},k=X.responseOptions?.(x)??{},f=(H.headers.get("content-type")??"").includes("application/json");return Z(_,j$(S,{...k,toolNameMap:B.get(_),onToolNameRefusal:()=>{K.set(_,"response_tool_names"),R(_)},laneStartOAuthServed:!0,...f?{responseMode:"json"}:{}}))},quotaFromHeaders(H,z,_){let S=_.data;if(!S||!j(H,S))return;return X.quotaFromHeaders?.(H,{...y(_,S),status:z})},async limitFromResponse({status:H,headers:z,body:_,attempt:S}){let x=S.data;if(!x||K.get(x)==="response_tool_names")return;if(!j(z,x))return X.limitFromRelayFailure?.({...y(S,x),status:H});if(U.set(x,`provider responded with HTTP ${H}`),!X.limitFromResponse)return;let k=a.get(z)===x,f=q(x);return X.limitFromResponse({...y(S,x),status:H,headers:z,body:async()=>k?await _():f.redactText(await _())})},inspectEvent({data:H,event:z,attempt:_}){if(_.data&&K.get(_.data)==="response_tool_names")return;let S=C2(H);if(!U2(S))return;let x=typeof S.type==="string"?S.type:z;if(x==="content_block_start"||x==="content_block_delta")return{outputStarted:!0};if(x==="message_stop")return{done:!0};if(x!=="error")return;let k=_.data,f=q(k),r=U2(S.error)?S.error:{},d=typeof r.type!=="string"?void 0:a2.has(r.type)?r.type:f.redactText(r.type),X2=typeof r.message==="string"?f.redactText(r.message):void 0;if(k?.dispatch==="http-relay"&&Y.get(k)===!1)return;let J2=k?X.limitFromStreamError?.({...y(_,k),errorType:d,message:X2}):void 0,Z2={error:[d??"error",X2].filter(Boolean).join(": ").slice(0,V1),...J2?{limit:J2}:{}};if(k&&Z2.error)U.set(k,Z2.error);return Z2},limitFromError(H,z){let _=z.data;if(!_||K.has(_))return;let S={type:a2.has(H.type)?H.type:"provider_error",message:U.get(_)??"provider request failed",...H.status!==void 0?{status:H.status}:{}};if(R(_),_.dispatch==="http-relay"&&Y.get(_)===!1)return;return X.limitFromHostError?.(S,y(z,_))},async onAttemptEnd(H,z){let _=H.data;if(!_)return;T.delete(_);let S=z.error?.reason;if(S==="cancelled"||S==="abandoned"||S===void 0&&(z.status===void 0||z.status<400))R(_);let x=K.get(_),{status:k,...f}=z,r=X.onAttemptEnd?.(y(H,_),{...f,...k!==void 0&&(_.dispatch!=="http-relay"||Y.get(_)===!0)?{status:k}:{},...x!==void 0?{localRefusal:{check:x}}:{}});if(await z1(r,L)==="timed-out")M?.warn("the account source did not finish recording a send",{timeoutMs:L})}},dispose(){c=!0;for(let[H,z]of A){for(let _ of z)_.revoked=!0;X.forgetSession?.(H)}A.clear(),T.clear();for(let H of[...V.keys()])R(H)},forgetSession(H){for(let z of A.get(H)??[])z.revoked=!0;A.delete(H);for(let[z,_]of T)if(_.sessionID===H)T.delete(z);for(let[z,_]of[...V])if(_.sessionID===H)R(z);X.forgetSession?.(H)},get pendingSendCount(){return T.size},get heldCredentialCount(){let H=0;for(let z of T.values())if(z.oauth)H++;return H},get heldRedactorCount(){return V.size},get operationsInProgress(){let H=0;for(let z of A.values())H+=z.size;return H}}}function P2($){return JSON.stringify([$.source,$.accountIdentity,$.credentialId,$.binding?.storageId,$.binding?.rowId,$.binding?.credentialEpoch])}function B$($){let{runtime:X,source:M}=$,W=new AbortController,L=!1,N=new C1({directory:$.registryDirectory||process.env.OPENCODE_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR||N1("opencode"),now:$.now}),P=new Map,T=async(V,U,O)=>{let q=O?AbortSignal.any([W.signal,O]):W.signal;q.throwIfAborted();let R=JSON.parse(await U.text()),m={providerID:"anthropic",modelID:R.model,sessionID:`oc2-cachekeep:${V.id}`,agent:"cachekeep",kind:"generate"},b=M2({source:{...M,onRequestPrepared:void 0,responseOptions:void 0,async requestOptions(Z){return{...await M.requestOptions?.(Z),laneStart:!1,billingLineage:void 0,cacheDiagnosticsPreviousMessageId:void 0}},async authorizeAccount(Z,j){let G=await X.read();q.throwIfAborted();let A=G.accounts.find((w)=>w.id===j);if(A?.type!=="oauth"||P2(A)!==V.oauthAccountIdentity||V.isSubagent&&!g2(G.policyStorage)||!f2(G.policyStorage)||!U$(G.policyStorage,new Date($.now?.()??Date.now())))return;let E=await M.authorizeAccount(Z,j);if(E?.provenance.kind==="local"&&P2({...A,binding:E.provenance.subject.binding,accountIdentity:E.provenance.subject.binding.identity})!==V.oauthAccountIdentity)return;if(E?.provenance.kind==="vault"&&E.provenance.credentialId!==A.credentialId)return;return E},async admitRequest(Z){await M.admitRequest?.(Z);let j=await X.read(),G=j.accounts.find((A)=>A.id===Z.accountId);if(q.throwIfAborted(),!G||P2(G)!==V.oauthAccountIdentity||V.isSubagent&&!g2(j.policyStorage)||!f2(j.policyStorage)||!U$(j.policyStorage,new Date($.now?.()??Date.now())))throw Error("CacheKeep policy changed before dispatch")}}}),i,n,c=!1,a=()=>b.forgetSession(m.sessionID);q.addEventListener("abort",a,{once:!0});try{let Z=(await X.read()).accounts.find((y)=>P2(y)===V.oauthAccountIdentity)?.id;if(!Z)throw Error("CacheKeep account is unavailable");let j=await b.adapter.accountHeaders({...m,accountId:Z});if(!("headers"in j)||typeof j.headers!=="object"||j.headers===null||typeof j.attempt!=="object"||j.attempt===null||j.attempt.route!=="oauth")throw Error("CacheKeep authorization refused");i={...m,accountId:Z,attemptId:crypto.randomUUID(),transport:"http",data:j.attempt};let G=await b.adapter.rewriteRequest?.({...m,accountId:Z,attempt:i,request:new Request(V.url,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(R),signal:q})});if(!G)throw Error("CacheKeep rewrite refused");q.throwIfAborted();let A=await($.fetch??fetch)(G),E=await b.adapter.rewriteResponse?.({...m,accountId:Z,attempt:i,request:G,response:A});if(!E)throw Error("CacheKeep response rewrite refused");if(n=E.status,b.adapter.quotaFromHeaders?.(E.headers,E.status,i),!E.ok)await b.adapter.limitFromResponse?.({status:n,headers:E.headers,body:()=>E.clone().text(),attempt:i});let w=await E.arrayBuffer();return c=!0,new Response(w,{status:n,headers:E.headers})}catch{throw Error("Native CacheKeep was not completed")}finally{q.removeEventListener("abort",a);try{if(i)await b.adapter.onAttemptEnd?.(i,{status:n,outputStarted:!1,...c?{}:{error:{reason:"cancelled"}}})}finally{b.dispose(),M.forgetSession?.(m.sessionID)}}},K=$.setIntervalImpl??globalThis.setInterval,Y=new _1({loadStorage:async()=>L?null:(await X.read()).policyStorage,now:$.now,setIntervalImpl:(V,U)=>K(()=>Y.tick().catch(()=>{L1.warn("cachekeep","tick failed")}),U),clearIntervalImpl:$.clearIntervalImpl,onTrackedSessionsChanged:(V)=>N.publish(L?[]:V),prepareHeaders(V,U,O){if(L)return;return P.set(O.id,{target:U,attempt:O}),new Headers({"x-native-cachekeep-attempt":String(O.id)})},fetchImpl:async(V,U)=>{let O=new Request(V,U),q=Number(O.headers.get("x-native-cachekeep-attempt")),R=P.get(q);if(P.delete(q),!R)throw Error("CacheKeep attempt is unavailable");return T(R.target,O,R.attempt.signal)},onComplete:({attempt:V})=>{P.delete(V.id)}}),B;return{async track(V){if(L||V.route!=="oauth"||V.agent==="cachekeep"||V.agent==="prime"||V.kind!=="primary")return;let U=await X.read();if(L||!f2(U.policyStorage))return;let O=!1;try{O=await $.isSubagent?.(V.sessionID)??!1}catch{return}if(L||O&&!g2(U.policyStorage))return;let q=U.accounts.find((R)=>R.id===V.accountId);if(!q?.accountIdentity)return;if(V.provenance.kind==="local"&&JSON.stringify(q.binding)!==JSON.stringify(V.provenance.subject.binding))return;if(V.provenance.kind==="vault"&&q.credentialId!==V.provenance.credentialId)return;Y.track({sessionId:V.sessionID,url:V.url,headers:new Headers,bodyText:V.bodyText,storage:U.policyStorage,cacheMode:"hybrid",oauthAccountId:V.accountId,oauthAccountIdentity:P2(q),isSubagent:O}),await N.publish(Y.trackedSessions())},registry:N,dispose(){if(B)return B;return L=!0,Y.stop(),W.abort(),B=(async()=>{try{await Y.tick()}finally{P.clear(),await N.dispose()}})(),B}}}async function K$($,X,M){let W=M2(X),L=[],N=async(U,O,q)=>{let R=await $.session.hook(U,O,q);return L.push(R),R},P=new AbortController,T;try{T=await w2({session:{hook:N},event:$.event},W.adapter,{logger:X.log,gateOnPlaceholder:M})}catch(U){throw W.dispose(),await Promise.allSettled(L.map((O)=>O.dispose())),U}let K=(U)=>{W.forgetSession(U),T.forgetSession(U)},Y=$.event,B=Y?(async()=>{try{for await(let U of Y.subscribe({signal:P.signal}))if(U.type==="session.deleted")K(U.data.sessionID)}catch(U){if(!P.signal.aborted)X.log?.warn("stopped listening for session deletion",{error:U instanceof Error?U.name:"unknown"})}})():Promise.resolve(),V;return{installation:T,forgetSession:K,dispose(){if(V)return V;return W.dispose(),P.abort(),V=(async()=>{await T.dispose(),await B})(),V}}}import{effectiveRelayTransport as M$,getQuotaCheckIntervalMs as P1,logger as F1,nativeAccountCanServe as T1,oauthProfileIsFresh as O1,quotaSnapshotCheckedAt as E1}from"@cortexkit/anthropic-auth-core";function z$($,X){let M=new AbortController,W,L=!1,N=async()=>{let K=await $.read();if(M.signal.throwIfAborted(),K.policyStorage.relay?.enabled===!0&&M$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="websocket")return;let Y=K,B=P1(Y.policyStorage);for(let V of Y.accounts){if(M.signal.aborted)return;if(!T1(V)||V.type!=="oauth")continue;if(Y.policyStorage.quota?.enabled!==!1&&Date.now()-E1(V.quota)>=B)await $.fetchQuota(V.id,X,M.signal,void 0,"background").catch(()=>{});if(!O1(V.profile)&&!M.signal.aborted)await $.fetchProfile(V.id,X,M.signal).catch(()=>{})}},P=()=>{if(L||W)return W;return W=N().catch(()=>{if(!M.signal.aborted)F1.debug("opencode2","native background readings did not complete")}).finally(()=>{W=void 0}),W},T=$.vault.watch({intervalMs:60000,onRefresh:P,shouldRefresh:async()=>{let K=await $.read();return K.policyStorage.relay?.enabled!==!0||M$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="http"}});return T.ready.catch(()=>{}),{async dispose(){L=!0,T.close(),M.abort(),await W}}}import{authorize as f1,buildCacheKeepStatusSummary as g1,buildClaudeQuotaSummary as v1,buildPrimeAccountStatuses as h1,buildPrimeStatusSummary as m1,CLAUSTRUM_OPENCODE_ENROLLMENT_NAME as l1,exchange as d1,formatNativeAccountState as p1,formatOAuthAccountTier as u1,getCacheKeepWindow as i1,getHostClaustrumEnrollmentPaths as c1,isCacheKeepAlways as o1,isCacheKeepHybridActive as n1,isCacheKeepPersistentlyEnabled as r1,nativeAccountCanServe as s1,resetClaustrumEnrollmentState as a1}from"@cortexkit/anthropic-auth-core";import{buildPrimeAccountStatuses as S1,effectiveRelayStatus as x1,formatNativeAccountState as R1,formatOAuthAccountTier as _$,getCacheKeepWindow as A1,getRoutingMode as q1,isCacheKeepAlways as k1,isCacheKeepHybridActive as D1,isPermanentRefreshError as b1,isPrimePersistentlyEnabled as w1,nativeAccountCanServe as L$,refreshBackoffActive as C$}from"@cortexkit/anthropic-auth-core";var N$=($)=>L$($)&&$.state!=="unsupported-access"?void 0:R1($)||void 0,y1=($)=>{if($.source!=="vault")return"off";if($.state==="needs_reauth")return"on-vault-reauth";return L$($)?"on-vault-served":"on-cold"},I1=($,X)=>typeof $==="number"&&$>X;function P$($,X){let{now:M}=X,W=$.policyStorage,L=$.accounts.filter((B)=>B.type==="oauth"),N=L.find((B)=>B.id==="main"),P=N?N$(N):void 0,T=N?.lastQuotaRefreshError?.nextRetryAt,K=N?.lastRefreshError,Y=A1(W);return{main:{quota:N?.quota??null,enabled:N?.enabled,tierLabel:_$(N?.profile),quotaBackedOff:I1(T,M),quotaBackoffUntil:T,refreshBackedOff:C$(K,N?.accountIdentity,M,void 0),refreshBackoffUntil:K?.nextRetryAt,stateLine:P,quotaDated:Boolean(P)},fallbacks:L.filter((B)=>B.id!=="main"&&(B.enabled||B.source==="vault")).map((B)=>{let V=N$(B),U=y1(B);return{id:B.id,label:B.label,quota:B.quota??null,enabled:B.enabled,tierLabel:_$(B.profile),needsReauth:b1(B.lastRefreshError)&&C$(B.lastRefreshError,B.accountIdentity,M,void 0),...U==="on-vault-reauth"?{vaultReauth:!0}:{},...U==="on-vault-served"?{vaultServed:!0}:{},...U!=="off"?{custodyState:U}:{},stateLine:V,quotaDated:Boolean(V)}}),activeId:X.activeId,route:q1(W),relay:x1(W.relay),fastMode:W.claudeFast?.enabled===!0,cacheKeep:{enabled:D1(W),window:k1(W)?"always":Y?`${Y.startHour}-${Y.endHour}`:void 0,trackedSessions:X.trackedSessions},prime:w1(W)?{enabled:!0,accounts:S1(W,{now:M})}:void 0,lastUpdated:M}}var v2=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{};function F$($){let{runtime:X,source:M}=$,W=new Map,L=!1,N=async(Y,B)=>{await X.updateSettings((V)=>({...V,[Y]:{...v2(V[Y]),...B}}))},P=()=>({ok:!0,text:"Native Claude settings updated."}),T=async(Y,B)=>{if(L)throw Error("Native menu is closed");switch(B.signal?.throwIfAborted(),Y.action){case"enable":case"disable":return await X.setEnabled(Y.values.id,Y.action==="enable"),P();case"remove":return await X.remove(Y.values.id),P();case"move-up":case"move-down":{let U=(await X.read()).accounts.map((b)=>b.id),O=U.indexOf(Y.values.id),q=O+(Y.action==="move-up"?-1:1);if(O<0||q<0||q>=U.length)return{ok:!1,text:"Account cannot move in that direction."};let R=U[O],m=U[q];if(R===void 0||m===void 0)return{ok:!1,text:"Account order changed."};return U[O]=m,U[q]=R,await X.reorder(U),P()}case"add-apikey":return await X.addApi(Y.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let V=new AbortController;W.get(Y.sessionId)?.active.abort();let U={active:V,auth:void 0};W.set(Y.sessionId,U);let O=await f1("max");if(L||V.signal.aborted||B.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return U.auth=O,{ok:!0,text:`Open ${O.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let V=W.get(Y.sessionId);if(!V?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let U=await d1(Y.values.code,V.auth.verifier,V.auth.redirectUri,V.auth.state);if(V.active.signal.throwIfAborted(),B.signal?.throwIfAborted(),L||U.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await X.loginOAuth({routeId:crypto.randomUUID(),credential:U,label:Y.values.label}),V.active.signal.throwIfAborted(),B.signal?.throwIfAborted(),L)return{ok:!1,text:"Sign-in cancelled."};return W.delete(Y.sessionId),{ok:!0,text:"OAuth account stored in the native account pool."}}case"reset-backoff":{let V=await X.read();for(let U of V.accounts){if(B.signal?.throwIfAborted(),U.type!=="oauth")continue;let O=U.source==="vault"?await X.authorizeVault(U.id,B.signal):await X.captureLocalSubject(U.id);await X.resetBackoff(U.id,O)}return P()}case"enrollment-reset":{let V=await a1(c1("opencode"),l1);return{ok:V==="reset",text:V==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":V==="refused-pending"?"An enrollment request may still be in progress. Quit OpenCode and run setup again; it picks up the same request.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let U=(await X.read()).accounts.filter((R)=>R.type==="oauth"&&s1(R)),O=await Promise.allSettled(U.map((R)=>X.fetchQuota(R.id,void 0,B.signal)));return{ok:O.every((R)=>R.status==="fulfilled"),text:`${O.filter((R)=>R.status==="fulfilled").length}/${U.length} native quota readings refreshed.`}}case"routing-reset":return await M.resetRouting(Y.sessionId),P();case"routing-mode":return await N("routing",{mode:Y.values.mode}),P();case"killswitch-on":case"killswitch-off":return await N("killswitch",{enabled:Y.action==="killswitch-on"}),P();case"killswitch-set":return await X.updateSettings((V)=>{let U=v2(V.killswitch),O={...v2(U.accounts)},q=U.main;for(let R of Y.values.entries){let m={five_hour:R.fh,seven_day:R.sd,...R.scoped!==void 0?{scoped:R.scoped}:{}};if(R.account==="main"||R.account==="all")q=m;if(R.account==="all")for(let b of Object.keys(O))O[b]=m;else if(R.account!=="main")O[R.account]=m}return{...V,killswitch:{...U,main:q,accounts:O}}}),P();case"cache-on":case"cache-off":return await N("claudeCache",{enabled:Y.action==="cache-on"}),P();case"cache-mode":return await N("claudeCache",{mode:Y.values.mode}),P();case"cachekeep-always":return await N("cacheKeep",{enabled:!0,always:!0}),P();case"cachekeep-off":return await N("cacheKeep",{enabled:!1}),P();case"cachekeep-window":return await N("cacheKeep",{enabled:!0,always:!1,startHour:Y.values.startHour,endHour:Y.values.endHour}),P();case"cachekeep-subagents":return await N("cacheKeep",{subagents:Y.values.enabled==="on"}),P();case"dump-on":case"dump-off":return await N("dump",{enabled:Y.action==="dump-on"}),P();case"logging-level":return await N("logging",{level:Y.values.level}),P();case"fast-on":case"fast-off":return await N("claudeFast",{enabled:Y.action==="fast-on"}),P();case"prime-on":case"prime-off":return await N("prime",{enabled:Y.action==="prime-on"}),P();case"start-fire":return await K(Y.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},K=(Y)=>$.start(Y,E2);return{dispatch:T,async readStatus(Y){let B=await X.read();if(Y==="account")return B.accounts.map((U)=>`${U.id}${U.label?` (${U.label})`:""}: ${U.type}, ${U.source}, ${U.enabled?"enabled":"disabled"}${U.state?`, ${p1(U)}`:""}${U.accountIdentity?`, ${U.accountIdentity}`:""}`).join(`
-`)||"No native Claude accounts.";if(Y==="quota")return v1({accounts:B.accounts.filter((U)=>U.type==="oauth").map((U)=>({name:U.label??U.id,role:U.id==="main"?"main":"fallback",enabled:U.enabled,quota:U.quota,tierLabel:u1(U.profile),lastRefreshedAt:U.lastRefreshedAt,error:U.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(Y==="prime")return m1({enabled:B.policyStorage.prime?.enabled===!0,accounts:h1(B.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");if(Y==="cachekeep"){let U=await $.cacheKeepRegistry?.list()??[];return g1({enabled:r1(B.policyStorage),always:o1(B.policyStorage),hybridActive:n1(B.policyStorage),trackedSessionDetails:U,window:i1(B.policyStorage),trackedSessions:U.length,nextPrewarmAt:U.length?Math.min(...U.map((O)=>O.nextPrewarmAt)):void 0})}let V={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(B.settings[V[Y]]??{})},async readSidebar(Y){let[B,V]=await Promise.all([X.read(),$.cacheKeepRegistry?.list()??[]]);return P$(B,{activeId:M.servedAccount(Y),trackedSessions:V.length,now:Date.now()})},forgetSession(Y){W.get(Y)?.active.abort(),W.delete(Y)},close(){L=!0;for(let Y of W.values())Y.active.abort();W.clear()}}}import{resolveClaudeModelCapabilities as t1}from"@cortexkit/anthropic-auth-core";function T$(){let $=new Map;return{install:(M)=>M.model.transform((W)=>{$.clear();for(let L of W.list("anthropic")){$.set(String(L.id),String(L.modelID));let N=t1(L.modelID)?.efforts.variants;if(!N)continue;W.update("anthropic",String(L.id),(P)=>{let T=P.variants.filter((K)=>!N.some((Y)=>Y===String(K.id)));P.variants=[...T,...N.map((K)=>({id:K,settings:{effort:K,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(M)=>$.get(M)??M}}function O$($){return $.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??$.get("x-api-key")??void 0}import{buildPrimeRequestBody as E$,effectiveRelayTransport as S$,nativeAccountCanServe as e1,PrimeManager as $X}from"@cortexkit/anthropic-auth-core";var x$=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{};function R$($){let{runtime:X,source:M}=$,W=new AbortController,L=new Set,N=(K)=>({providerID:"anthropic",modelID:E$().model,sessionID:`oc2-prime:${K}`,agent:"prime",kind:"generate"}),P=async(K)=>{let Y=N(K),B=M2({source:M}),V=performance.now();try{for(let U=0;U<3;U++){if(W.signal.throwIfAborted(),(await X.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let q=await B.adapter.accountHeaders({...Y,accountId:K});if(!("headers"in q)||typeof q.headers!=="object"||q.headers===null||typeof q.attempt!=="object"||q.attempt===null)throw Error("Native Prime authorization refused");let R={...Y,accountId:K,attemptId:crypto.randomUUID(),transport:"http",data:q.attempt},m,b=!1,i=!1,n=(c)=>{i=!0,c.body?.cancel().catch(()=>{})};try{let c=await B.adapter.rewriteRequest?.({...Y,accountId:K,attempt:R,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E$()),signal:W.signal})});if(!c)throw Error("Native Prime rewrite refused");let a=new Headers(c.headers);for(let[s,p]of Object.entries(q.headers))if(p===null)a.delete(s);else a.set(s,p);let Z=new Request(c,{headers:a}),j=await($.fetch??fetch)(Z),G=await B.adapter.rewriteResponse?.({...Y,accountId:K,request:Z,response:j,attempt:R})??j;m=G.status,B.adapter.quotaFromHeaders?.(G.headers,G.status,R);let A=G.ok?void 0:await B.adapter.limitFromResponse?.({status:G.status,headers:G.headers,body:()=>G.clone().text(),attempt:R});if(A&&/^(vault-newer|local-newer|relay-direct):/.test(A.reason)&&U<2){if(n(G),await M.chooseAccount({...Y,rerouteFrom:{accountId:K,limit:A}})!==K)throw Error("Native Prime retry changed account");continue}if(!G.ok)return n(G),{ok:!1,status:m,ms:performance.now()-V,error:"Native Prime upstream refused the request"};let E=x$(await G.json()),w=x$(E.usage),y={inputTokens:typeof w.input_tokens==="number"?w.input_tokens:void 0,outputTokens:typeof w.output_tokens==="number"?w.output_tokens:void 0};if(R.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(G.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(b=await M.recordPrime(q.attempt.provenance,y),!b)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:m,ms:performance.now()-V,usage:y}}finally{await B.adapter.onAttemptEnd?.(R,{status:m,outputStarted:!1,...b?{}:{error:{reason:i?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-V}}finally{B.dispose()}},T=new $X({storagePath:$.paths.legacyConfig,loadStorage:async()=>(await X.read()).policyStorage,async getAccountFingerprint(K){let Y=await X.read(),B=Y.accounts.find((U)=>U.id===K);if(!e1(B)||B?.type!=="oauth")return;if(Y.policyStorage.relay?.enabled===!0&&S$(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")return;if(B.source==="vault"){let U=await X.authorizeVault(K,W.signal);return X.getOrCreateAuthLineage(K,U)}let V=await X.authorizeLocal(K,{signal:W.signal});return V.status==="usable"?X.getOrCreateAuthLineage(K,V.subject):void 0},async refreshQuota(K){let Y=await X.read();if(Y.policyStorage.relay?.enabled===!0&&S$(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await X.fetchQuota(K,$.fetch,W.signal),fresh:!0}},sendPrime(K){let Y=P(K);return L.add(Y),Y.finally(()=>L.delete(Y)),Y},async recordSuccess(K){let Y=(await X.read()).accounts.find((B)=>B.id===K);if(!Y?.prime)throw Error("Native Prime counters are unavailable");return Y.prime}});return T.start(),{manager:T,async dispose(){T.stop(),W.abort(),await Promise.allSettled(L)}}}import{createNativeUsagePublisher as XX,effectiveRelayTransport as JX,getClaudeCodeIdentityForVerifiedAccount as S2,getQuotaCheckIntervalMs as ZX,getRoutingMode as A$,isQuotaBearingHeaderFrame as YX,mergeHeaderQuotaForPersistence as WX,NativeVaultNoAccountError as GX,nativeAccountCanServe as h2,nativeAccountPolicy as x2,normalizeQuotaHeaders as jX,quotaSnapshotCheckedAt as VX,quotaSnapshotHasStandardWindows as QX,readNativeAccountsForRequest as HX,remapModelId as m2,StickySessionRouter as UX,shouldFallbackStatus as BX,stickyQuotaSnapshotIsFresh as R2,stickyRouteFamilyForModel as KX}from"@cortexkit/anthropic-auth-core";var l2=($)=>["five_hour","seven_day"].some((X)=>($?.[X]?.remainingPercent??1)<=0);function k$($){let{runtime:X}=$,M=XX("native-auth"),W=new Map,L=(Z)=>{let j=Z.routingPath;if(!j)throw Error("Native routing storage is unavailable");let G=W.get(j);if(!G)G=new UX({path:j,vaultSeed:Z.routingSeed,onLockEvent:X.onLockEvent,localRecoveryPath:Z.mode==="local"?Z.routingRecoveryPath:void 0}),W.set(j,G);return G.setVaultSeed(Z.routingSeed),G},N=new WeakMap,P=new Map,T=new Map,K=new Map,Y=new Map,B=new WeakSet,V=!1,U=()=>{while(P.size>512){let Z=P.keys().next();if(!Z.done)P.delete(Z.value)}},O=(Z,j)=>JSON.stringify([Z.sessionID,Z.kind,Z.modelID,j]),q=(Z)=>{if(V)throw Error("Native Anthropic source is closed");let j=K.get(Z.sessionID);if(!j){j=new AbortController,K.set(Z.sessionID,j);while(K.size>512){let G=K.keys().next();if(!G.done)c.forgetSession?.(G.value)}}return j},R=(Z,j,G)=>h2(Z)&&(Z.type==="api"||x2(Z,j,m2(G)).status==="allowed"),m=async(Z,j,G,A)=>{let E=await X.read();A.signal.throwIfAborted(),b(E);let w=E.accounts.find((y)=>y.id===Z);if(!w||w.type!==G||!R(w,E,j))return!1;if(G==="api"){let y=E.accounts.find((s)=>s.id==="main"&&s.type==="oauth");return!!y&&R2(y.quota,E.policyStorage)&&l2(y.quota)}return!0},b=(Z)=>{let j=Z.policyStorage.relay;if(j?.enabled===!0&&JX(j.transport,j.url)==="websocket")throw new K2},i=async(Z,j)=>{if(b(Z),j||Z.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let G=await X.getRelayConfig();if(!G)throw Error("request refused: native HTTP relay configuration is unavailable");if(G.transport!=="http")throw new K2;return{dispatch:{kind:"http-relay",url:G.url,token:G.token},relayFallback:G.fallbackToDirect}};async function n(Z,j,G){if(Z.kind==="local")await X.publishLocal(Z.subject,G);else if(Z.kind==="vault"&&j.receipt)await X.vault.publish(j.receipt,G);else if(Z.kind==="api"&&G.lastUsed!==void 0)await X.publishApi(Z.subject,{lastUsed:G.lastUsed})}let c={async chooseAccount(Z){let j=q(Z);$.onOwnedRequest?.();let G=await X.read();j.signal.throwIfAborted(),b(G);let A=m2(await $.resolveModelId?.(Z)??Z.modelID);if(j.signal.throwIfAborted(),G.mode==="claustrum")G=await HX(X,j.signal),j.signal.throwIfAborted();if(G.policyStorage.quota?.enabled!==!1){let h=!1;for(let o of G.accounts){if(!h2(o)||o.type!=="oauth")continue;if(QX(o.quota)?R2(o.quota,G.policyStorage,Date.now(),A):Date.now()-VX(o.quota)<ZX(G.policyStorage))continue;try{await X.fetchQuota(o.id,$.fetch,j.signal,void 0,"admission"),h=!0}catch{j.signal.throwIfAborted()}}if(h)G=await X.read();j.signal.throwIfAborted()}let E=Z.rerouteFrom?P.get(Z.rerouteFrom.limit.reason):void 0;if(Z.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(Z.rerouteFrom.limit.reason)&&!E)return;if(E&&Z.rerouteFrom){P.delete(Z.rerouteFrom.limit.reason);let h=G.accounts.find((H)=>H.id===E.accountId);if(!h||!R(h,G,A))return;let o=O(Z,E.accountId),l=T.get(o)??[];return l.push(E),T.set(o,l),E.accountId}let w=[];for(let h of G.accounts){if(h.type!=="oauth"||!R(h,G,A))continue;if(h.source==="local"){let o=await X.authorizeLocal(h.id,{signal:j.signal,policy:(l,H)=>x2(l,H,A)});if(j.signal.throwIfAborted(),o.status!=="usable")continue}w.push(h)}let y=w.filter((h)=>h.id!==Z.rerouteFrom?.accountId);if(A$(G.policyStorage)==="sticky-balanced"){let h=y.map((l,H)=>({accountId:l.id,order:H,quota:l.quota??{kind:"unknown"}})),o=await L(G).resolve({sessionId:Z.sessionID,family:KX(A),modelId:A,affinityModelId:Z.modelID,candidates:h,retainAccountIds:new Set(y.map((l)=>l.id)),...G.mode==="claustrum"?{accountIdentities:new Map(G.accounts.flatMap((l)=>l.accountIdentity?[[l.id,l.accountIdentity]]:[]))}:{},storage:G.policyStorage,inputBytes:1,preferredAccountId:Z.previousAccountId});if(j.signal.throwIfAborted(),o)return o.accountId}else{let o=A$(G.policyStorage)==="fallback-first"?[...y.filter((l)=>l.id!=="main"),...y.filter((l)=>l.id==="main")]:[...y.filter((l)=>l.id==="main"),...y.filter((l)=>l.id!=="main")];if(o[0])return o[0].id}if(G.mode==="claustrum")throw new GX;let s=G.accounts.find((h)=>h.id==="main"&&h.type==="oauth");if(!s)return;let p=s.quota;if(Z.rerouteFrom?.limit.status===429||!R2(p,G.policyStorage))try{p=await X.fetchQuota("main",$.fetch,j.signal)}catch{return}if(j.signal.throwIfAborted(),!l2(p))return;return G.accounts.find((h)=>h.type==="api"&&h2(h)&&h.id!==Z.rerouteFrom?.accountId)?.id},async authorizeAccount(Z,j){let G=q(Z),A=await X.read();G.signal.throwIfAborted(),b(A);let E=m2(await $.resolveModelId?.(Z)??Z.modelID);G.signal.throwIfAborted();let w=A.accounts.find((S)=>S.id===j);if(!w||!R(w,A,E))return;let y=O(Z,j),s=T.get(y),p=s?.shift();if(s?.length===0)T.delete(y);let{dispatch:h,relayFallback:o}=await i(A,p?.direct===!0);if(G.signal.throwIfAborted(),p?.auth){if(!await m(j,E,p.auth.route,G))return;let S=N.get(p.auth.provenance);if(S?.receipt?.expiresAtMs!==void 0&&S.receipt.expiresAtMs!==null&&S.receipt.expiresAtMs<Date.now()+300000)return;if(S)N.set(p.auth.provenance,{...S,scope:{...Z,modelID:E},account:w,active:G,relayFallback:o});return Y.set(Z.sessionID,j),{...p.auth,dispatch:h}}let l={scope:{...Z,modelID:E},active:G,account:w,retry:p?.retry??!1,relayFallback:o,quota:w.quota};if(w.type==="api"){let S=A.accounts.find((r)=>r.id==="main"&&r.type==="oauth");if(!S||!R2(S.quota,A.policyStorage)||!l2(S.quota))return;let x=await X.authorizeApi(j,G.signal);if(G.signal.throwIfAborted(),!await m(j,E,"api",G))return;let k={kind:"api",subject:x.subject};return N.set(k,l),Y.set(Z.sessionID,j),{route:"api",headers:x.authHeader==="authorization-bearer"?{authorization:`Bearer ${x.apiKey}`}:{"x-api-key":x.apiKey},baseURL:x.baseURL,provenance:k,dispatch:h}}if(w.source==="vault"){let S=await X.authorizeVault(j,G.signal);if(G.signal.throwIfAborted(),!await m(j,E,"oauth",G))return;let x={kind:"vault",credentialId:S.credentialId,recordVersion:S.recordVersion};N.set(x,{...l,receipt:S});let k=S.assertedAccountIdentity;if(!k)return;return Y.set(Z.sessionID,j),{route:"oauth",accessToken:S.accessToken,provenance:x,dispatch:h,identity:S2(k,k)}}let H=await X.authorizeLocal(j,{signal:G.signal,policy:(S,x)=>x2(S,x,E)});if(G.signal.throwIfAborted(),H.status!=="usable")return;if(!await m(j,E,"oauth",G))return;let z={kind:"local",subject:H.subject};N.set(z,{...l,access:H.access}),Y.set(Z.sessionID,j);let _=H.subject.binding.identity;return{route:"oauth",accessToken:H.access,provenance:z,dispatch:h,identity:S2(_,_)}},async requestOptions(Z){let j=q(Z),G=await X.read();j.signal.throwIfAborted();let A=G.accounts.find((w)=>w.id===Z.accountId);if(!A||!R(A,G,Z.modelID))throw Error("request refused: native account is ineligible for this model");let E=N.get(Z.provenance);if(E)N.set(Z.provenance,{...E,scope:{...E.scope,modelID:Z.modelID}});return $.requestOptions(Z,G)},async admitRequest(Z){let j=N.get(Z.provenance);if(!j||!await m(Z.accountId,Z.modelID,Z.route,j.active))throw Error("request refused: native account policy changed before dispatch");N.set(Z.provenance,{...j,scope:{...j.scope,modelID:Z.modelID}})},onRequestPrepared:(Z)=>$.onRequestPrepared?.(Z),responseOptions(Z){return $.responseOptions?.({...Z,modelID:N.get(Z.provenance)?.scope.modelID??Z.modelID})},quotaFromHeaders(Z,j){let G=N.get(j.provenance),A=q$(Z);if(A)$.onRequestId?.(j,A);if(!G||j.route!=="oauth"||!YX(Z))return;let E=j.provenance.kind==="local"?j.provenance.subject.binding.identity:G.receipt?.assertedAccountIdentity,w={...jX(Z),...E?{accountIdentity:E}:{}};G.quota=WX(G.quota,w);let y=M.observe(n(j.provenance,G,{quota:G.quota}));return a.set(j.provenance,y),w},async limitFromResponse(Z){let j=N.get(Z.provenance);if(!j)return;if(Z.status===401&&j.receipt){if(!B.has(j.receipt))B.add(j.receipt),await X.vault.reportFailure(j.receipt,401,Z.dispatch==="http-relay"?"relay_status_field":"direct");if(j.retry||j.active.signal.aborted)return;let A=j.active,E=await X.vault.prepareRetry(j.receipt,A.signal);if(A.signal.throwIfAborted(),!E.retry)return;let w=E.receipt,y=w.assertedAccountIdentity;if(!y)return;let s={kind:"vault",credentialId:w.credentialId,recordVersion:w.recordVersion};N.set(s,{...j,receipt:w,retry:!0});let p=`vault-newer:${Z.attemptId}`;return P.set(p,{sessionID:Z.sessionID,accountId:Z.accountId,retry:!0,auth:{route:"oauth",accessToken:w.accessToken,provenance:s,identity:S2(y,y)}}),U(),{reason:p,status:401}}if(Z.status===401&&Z.provenance.kind==="local"&&j.access&&!j.retry){if(j.active.signal.aborted)return;let A=j.active,E=await X.authorizeLocal(Z.accountId,{rejectedAccessToken:j.access,signal:A.signal,policy:(p,h)=>x2(p,h,j.scope.modelID)});if(A.signal.throwIfAborted(),E.status!=="usable"||E.access===j.access)return;let w={kind:"local",subject:E.subject};N.set(w,{...j,access:E.access,retry:!0});let y=E.subject.binding.identity,s=`local-newer:${Z.attemptId}`;return P.set(s,{sessionID:Z.sessionID,accountId:Z.accountId,retry:!0,auth:{route:"oauth",accessToken:E.access,provenance:w,identity:S2(y,y)}}),U(),{reason:s,status:401}}let G=await X.read();if(BX(Z.status,G.policyStorage))return{reason:`provider-${Z.status}`,status:Z.status};return},limitFromRelayFailure(Z){let j=N.get(Z.provenance);if(!j?.relayFallback||j.active.signal.aborted||!(Z.status===401||Z.status>=500))return;let G=`relay-direct:${Z.attemptId}`;return P.set(G,{sessionID:Z.sessionID,accountId:Z.accountId,direct:!0,retry:!1}),U(),{reason:G}},limitFromStreamError(Z){return Z.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(Z,j){let G=N.get(j.provenance);if(j.dispatch==="http-relay"&&G?.relayFallback&&!G.active.signal.aborted&&Z.status===void 0){let A=`relay-direct:${j.attemptId}`;return P.set(A,{sessionID:j.sessionID,accountId:j.accountId,direct:!0,retry:!1}),U(),{reason:A}}return},async onAttemptEnd(Z,j){let G=N.get(Z.provenance);if(!G)return;try{if(await a.get(Z.provenance),j.status===401&&G.receipt&&!B.has(G.receipt))B.add(G.receipt),await X.vault.reportFailure(G.receipt,401,Z.dispatch==="http-relay"?"relay_status_field":"direct");if(!j.localRefusal&&j.status!==void 0)M.publish(()=>n(Z.provenance,G,{lastUsed:Date.now()}))}finally{N.delete(Z.provenance),a.delete(Z.provenance)}},forgetSession(Z){K.get(Z)?.abort(),K.delete(Z),Y.delete(Z);for(let[j,G]of P)if(G.sessionID===Z)P.delete(j);for(let[j,G]of T)if(G[0]?.sessionID===Z)T.delete(j);$.onForgetSession?.(Z)},servedAccount:(Z)=>Y.get(Z),resetRouting:async(Z)=>L(await X.read()).clear(Z),async recordPrime(Z,j){let G=N.get(Z);if(!G||G.active.signal.aborted)return!1;if(Z.kind==="local")return X.incrementPrimeUsage(G.account.id,Z.subject,j);if(Z.kind==="vault"&&G.receipt)return X.incrementPrimeUsage(G.account.id,G.receipt,j);return!1},drainRoutingPublications:()=>Promise.all([X.drainRoutingPublications(),...[...W.values()].map((Z)=>Z.drain())]).then(()=>{}),close(){V=!0;for(let Z of K.values())Z.abort();return K.clear(),T.clear(),P.clear(),Promise.all([M.drain(),c.drainRoutingPublications()]).then(()=>{})}},a=new WeakMap;return c}import{remapModelId as MX}from"@cortexkit/anthropic-auth-core";function w$(){let $=new D$,X=new Map,M=new Map,W=new Map,L=new Set,N=new Set,P=new Map,T=(K)=>{while(K.size>512){let Y=K.keys().next();if(!Y.done)K.delete(Y.value)}};return{async install(K){let Y=[];try{Y.push(await K.session.hook("context",(B)=>{let V=B.messages.map((O)=>{return{info:{id:O.id,sessionID:B.sessionID,role:O.role,agent:B.agent,model:{providerID:B.model.providerID,modelID:B.model.id}},parts:O.content.map((q)=>({type:q.type,...q.type==="text"?{text:q.text}:{}}))}});$.observeMessages(V);let U=B.messages.findLast((O)=>O.role==="user"&&O.id);if(U?.id)X.set(B.sessionID,U.id);if(U?.content.some((O)=>O.type==="text"&&O.text===E2))L.add(B.sessionID);else L.delete(B.sessionID);T(X)},{providerID:"anthropic"})),Y.push(await K.session.hook("model.request",(B)=>{if(B.kind!=="primary")return;let V=X.get(B.sessionID);if(!V)return;if($.markHeaders({sessionId:B.sessionID,messageId:V,agent:B.agent,headers:B.headers}),L.has(B.sessionID))B.headers[L2]="1"},{providerID:"anthropic"}))}catch(B){throw await Promise.allSettled(Y.map((V)=>V.dispose())),B}return{dispose:async()=>{await Promise.all(Y.map((B)=>B.dispose()))}}},requestOptions(K,Y){let B=$.resolveHeader(K.correlation[O2]);if(B)M.set(K.attemptId,B),T(M);P.set(K.attemptId,K.sessionID),T(P);let V=K.correlation[L2]==="1";if(V)N.add(K.attemptId);return{cache1hEnabled:K.agent!=="compaction"&&K.agent!=="title"&&(Y.policyStorage.claudeCache?.enabled??!0),cache1hMode:Y.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:Y.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:Y.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,turnEndNoteEnabled:!0,turnEndNote:Y.policyStorage.turnEndNote,serverSideFallbackEnabled:b$(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:V,billingLineage:B?{promptId:B.promptId,previousRequestId:B.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:W.get(K.sessionID)}},responseOptions(K){return{serverSideFallbackModel:MX(K.modelID),laneStart:N.has(K.attemptId),onMessageStart(Y){if(K.kind==="primary"&&typeof Y.id==="string")W.set(K.sessionID,Y.id),T(W)},onStreamEnd(){M.delete(K.attemptId),N.delete(K.attemptId),P.delete(K.attemptId)}}},onRequestId(K,Y){$.commit(M.get(K.attemptId),Y)},forgetSession(K){$.clearSession(K),X.delete(K),W.delete(K),L.delete(K);for(let[Y,B]of P)if(B===K)M.delete(Y),N.delete(Y),P.delete(Y)}}}var A2="cortexkit-anthropic-auth",TX='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',OX="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",EX="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function SX($){let X=$.authorize??_X,M=$.exchange??LX,W=()=>{if(!$.isActive())throw Error("Claude authentication setup is closed")},L=async()=>{let T;try{T=await $.readMode()}catch{throw Error(EX)}return W(),T},N=async()=>{if(await L()!=="local")throw Error(TX)};return{integrationID:"anthropic",methods:[{method:{id:I$,type:"oauth",label:f$},async authorize(){W(),await N();let T=await X("max");return W(),{mode:"code",url:T.url,instructions:"Paste the authorization code returned by Claude.",callback:async(K)=>{W();let Y=await M(K,T.verifier,T.redirectUri,T.state);if(!$.isActive()||Y.type!=="success")throw Error("Claude sign-in did not complete");return{access:Y.access,refresh:Y.refresh,expires:Y.expires}}}}}],vault:{method:{id:g$,type:"oauth",label:"Claude vault accounts"},async activate(){if(W(),await L()!=="claustrum")throw Error(OX)}},async onLogin(T){W(),await N(),await $.runtime.loginOAuth({routeId:"main",credential:T,replace:!0}),W()},label:"Claude native account pool"}}function xX($){return{readMode:()=>PX("opencode",$),disconnectVault:()=>NX({host:"opencode",env:$})}}function d2($={}){return{id:A2,setup:(X)=>h$(X,$)}}async function h$($,X={}){let M=X.paths??await FX(),W=zX({paths:M,host:"opencode",local:X.local,vault:X.vault}),L=xX(X.vault?.env??process.env),N=!0,P=w$(),T=T$(),K,Y,B,V=k$({runtime:W,paths:M,fetch:X.fetch,requestOptions:P.requestOptions,responseOptions:P.responseOptions,onRequestId:P.onRequestId,onForgetSession:P.forgetSession,onRequestPrepared:async(b)=>{try{await B?.track(b)}catch{y$.warn("cachekeep","live request tracking failed")}},resolveModelId:async(b)=>T.modelId(b.modelID),onOwnedRequest:()=>{K??=z$(W,X.fetch),Y??=R$({runtime:W,paths:M,source:V,fetch:X.fetch})}});B=B$({...X.cacheKeep,runtime:W,source:V,fetch:X.fetch,isSubagent:async(b)=>Boolean((await $.session.get({sessionID:b})).parentID)});let U=F$({runtime:W,source:V,cacheKeepRegistry:B.registry,start:async(b,i)=>{await $.session.synthetic({sessionID:b,text:i,description:"Claude lane start",resume:!0})}}),O=[],q=await K$($,{source:V,log:{warn:(b,i)=>y$.warn("opencode2",b,i)}},{credential:O$}).catch(async(b)=>{throw U.close(),await B?.dispose(),await V.close(),await W.drainQuotaPublications(),W.close(),b}),R,m=()=>{if(R)return R;return N=!1,U.close(),V.close(),R=(async()=>{await Promise.allSettled([q.dispose(),K?.dispose(),Y?.dispose(),B?.dispose(),...O.map((b)=>b.dispose())]),await V.close(),await W.drainQuotaPublications(),W.close()})(),R};try{O.push(await P.install($)),O.push(await T.install($)),O.push(await k2($,SX({isActive:()=>N,readMode:L.readMode,runtime:W})));let b={host:"opencode",dispatch:U.dispatch,readStatus:(n)=>U.readStatus(n),readAccounts:()=>W.read(),readMode:L.readMode,disconnectVault:L.disconnectVault,interactive:!0},i=CX(b);return O.push(await v$($,i,U)),m}catch(b){throw await m(),b}}var dJ={id:A2,setup:d2().setup,server:m$};export{h$ as setupAnthropicAuth,dJ as default,d2 as createAnthropicAuthPlugin,A2 as ANTHROPIC_AUTH_PLUGIN_ID};
+import{a as k2,b as v$,c as m$,d as V$,e as Q$,f as D2,g as R2,h as H$,i as U$,j as l$,k as B$,l as K$,m as M$,n as z$,o as _$,p as r$}from"../index-79frmfve.js";import"../index-6chd6jnr.js";import"../index-hazrk5c3.js";import{u as o$}from"../index-jvhs8sxv.js";import{v as u$,w as i$,y as c$}from"../index-0kxy8k2c.js";import"../index-b1dvkp15.js";import"../index-20d6rmjj.js";import"../index-ppdrzs41.js";import"../index-62x1p34p.js";import{acquireNativeAccountRuntime as EX,authorize as SX,createNativeUi as RX,disconnectNativeVaultForHost as xX,exchange as AX,logger as p$,readNativeEnrollmentMode as qX,resolveNativePoolPaths as kX}from"@cortexkit/anthropic-auth-core";class O2 extends Error{kind;providerID;sessionID;requestKind;constructor(X){super(X.message??`${X.providerID} ${X.requestKind} request refused (${X.kind})`);this.name="OpenCode2AuthError",this.kind=X.kind,this.providerID=X.providerID,this.sessionID=X.sessionID,this.requestKind=X.requestKind}}function M2(X){return`common-auth-placeholder.${X}`}function $$(X){let J=M2(X.integrationID);return{type:"oauth",methodID:X.methodID,access:J,refresh:J,expires:X.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function v2(X,J){if(X?.type!=="oauth")return!1;let M=J===void 0?void 0:M2(J),G=(F)=>M===void 0?F.startsWith("common-auth-placeholder."):F===M;return G(X.access)&&G(X.refresh)}var X$="No browser sign-in: this connects the plugin to the accounts in its vault.";async function h2(X,J){let M=J.now??Date.now,{integrationID:G}=J,F=(T)=>$$({integrationID:G,methodID:T,now:M()}),C=async(T,K)=>{return await J.onLogin(T,{integrationID:G,methodID:K}),F(K)},P=(T)=>async(K)=>{let Y=T.method.id,B=await T.authorize(K),V={url:B.url,instructions:B.instructions,...B.expiresAt===void 0?{}:{expiresAt:B.expiresAt}};if(B.mode==="auto")return{...V,mode:"auto",callback:B.callback.then((O)=>C(O,Y))};let U=B.callback;return{...V,mode:"code",callback:async(O)=>C(await U(O),Y)}};return X.integration.transform((T)=>{let K=J.label===void 0?{}:{label:()=>J.label};for(let V of J.methods)T.method.update({integrationID:G,method:V.method,authorize:P(V),refresh:async(U)=>{if(!v2(U,G))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return F(U.methodID)},...K});let Y=J.vault;if(Y===void 0)return;let B=Y.method.id;T.method.update({integrationID:G,method:Y.method,authorize:async()=>({url:"",instructions:Y.instructions??X$,mode:"auto",callback:Promise.resolve().then(()=>Y.activate({integrationID:G,methodID:B})).then(()=>F(B))}),refresh:async(V)=>{if(!v2(V,G)||V.methodID!==B)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return F(B)},...K})})}function s$(X){let J=[],M;for(let G of X.split(/\r?\n/))if(G.startsWith("data:"))J.push(G.slice(5).replace(/^ /,""));else if(G.startsWith("event:"))M=G.slice(6).trim();if(J.length===0)return;return M===void 0?{data:J.join(`
+`)}:{event:M,data:J.join(`
+`)}}function m2(X,J){let M=new TextDecoder,G="",F=(P)=>{let T=s$(P);if(!T)return;try{X(T)}catch(K){J(K)}},C=()=>{for(;;){let P=/\r?\n\r?\n/.exec(G);if(!P)return;let T=G.slice(0,P.index);G=G.slice(P.index+P[0].length),F(T)}};return new TransformStream({transform(P,T){T.enqueue(P),G+=M.decode(P,{stream:!0}),C()},flush(){if(G+=M.decode(),C(),G.trim()!=="")F(G);G=""}})}var J$=512,C2="x-common-auth-attempt",z2=(X,J)=>JSON.stringify([X,J]),Q2=(X)=>({providerID:X.model.providerID,modelID:X.model.id,sessionID:X.sessionID,agent:X.agent,kind:X.kind});function a$(X){let J=X.headers;return typeof J==="object"&&J!==null}function t$(X,J){let M=X.getReader();return new ReadableStream({async pull(G){let F;try{F=await M.read()}catch(C){J({reason:"failed",message:C instanceof Error?C.message:String(C)}),G.error(C);return}if(F.done)J(),G.close();else G.enqueue(F.value)},async cancel(G){J({reason:"cancelled",...G===void 0?{}:{message:String(G)}}),await M.cancel(G)}})}function l2(X,J){for(let[M,G]of Object.entries(J)){let F=M.toLowerCase();for(let C of Object.keys(X))if(C.toLowerCase()===F)delete X[C];if(G!==null)X[M]=G}}function e$(X,J){for(let[M,G]of Object.entries(J))if(G===null)X.delete(M);else X.set(M,G)}async function d2(X,J,M={}){let{providerID:G}=J,F=M.gateOnPlaceholder,C=($)=>F===void 0||F.credential($)===M2(G),P=M.logger,T=Math.max(1,M.maxRecords??J$),K=[...M.hostCredentials??[M2(G)],...F?[M2(G)]:[]].filter(($)=>$!==""),Y=new Map,B=new WeakMap,V=new Map,U=new Set,O=new Map,q=!1,x=!1,m=new Map,w=0,o=!1,r=new Map,i=($,Q)=>{try{P?.warn($,Q)}catch{}},s=($)=>$ instanceof Error?$.message:String($),Z=new Map,W=($,Q)=>{let _=(Z.get($)??Promise.resolve()).then(Q),N=_.then(()=>{},()=>{});return Z.set($,N),N.then(()=>{if(Z.get($)===N)Z.delete($)}),_},j=($,Q)=>{let _=Z.get($);return _?_.then(()=>j($,Q)):Q()},A=async($)=>{try{await J.dropChoice?.({...$.input,accountId:$.accountId})}catch(Q){i("opencode2 auth dropChoice threw; the request is unaffected",{sessionID:$.input.sessionID,error:s(Q)})}},R=($)=>{let Q=V.get($);if(V.delete($),Q?.next){let _=Q.next;W(Q.sessionID,()=>A(_))}},b=async($,Q)=>{let _=m.get($);if(!_||_.size===0)return;await Promise.all([..._].map(async(N)=>{try{await N(Q)}catch(I){i("opencode2 auth listener threw; the request is unaffected",{event:$,error:s(I)})}}))},y=async($,Q)=>{try{await J.onAttemptEnd?.($,Q)}catch(_){i("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:$.attemptId,error:s(_)})}},d=($,Q)=>{if($.ended||!$.attempt)return;let _={...$.status===void 0?{}:{status:$.status},outputStarted:$.outputStarted,...$.limit?{limit:$.limit.signal}:{},...Q?{error:Q}:{}};if(Q)$.endError=Q;$.ended=y($.attempt,_)},p=($,Q)=>d($,{reason:"abandoned",message:Q}),f=($)=>[...Y.values()].filter((Q)=>Q.key===$),c=($)=>f($).at(-1),l=($)=>{if(Y.delete($.id),V.get($.key)?.attemptId===$.id||!f($.key).length)R($.key)},H=($)=>{Y.set($.id,$);while(Y.size>T){let Q=Y.values().next().value;if(Q===void 0)break;p(Q,"dropped to keep the record bound"),l(Q)}},z=($)=>$.accountId===void 0?void 0:{...$.scope,accountId:$.accountId},L=($,Q)=>new O2({kind:"no-account",providerID:G,sessionID:$.sessionID,requestKind:$.kind,...Q===void 0?{}:{message:Q}}),E=($)=>{r.get($)?.clear(),r.delete($)},S=async($,Q)=>{let _=()=>L($,`${G} ${$.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(o)throw _();let N=r.get($.sessionID);if(!N)N=new Set,r.set($.sessionID,N);let I={};N.add(I);let v=()=>{if(!N.has(I))throw _()};try{return await Q(v)}finally{if(N.delete(I),N.size===0&&r.get($.sessionID)===N)r.delete($.sessionID)}},D=($,Q)=>{for(let[_,N]of Q)if(K.some((I)=>N.includes(I)))throw new O2({kind:"host-credential-on-wire",providerID:G,sessionID:$.sessionID,requestKind:$.kind,message:`${G} ${$.kind} request still carries the host's placeholder credential in ${_}; the adapter's account headers must replace it`})},g=($)=>{for(let Q of f($))if(Q.ended||!Q.attempt)l(Q);else if(Q.transport==="ws"||Q.judged)p(Q,"a newer attempt of its session and kind began"),l(Q)},n=async($,Q,_,N)=>{let I=z2($.sessionID,$.kind),{input:v,accountId:k}=await j($.sessionID,async()=>{_();let e=V.get(I);V.delete(I);let L2=e?.accountId??c(I)?.accountId;g(I);let X2=e?.next,T2=X2!==void 0&&X2.input.modelID===$.modelID&&X2.input.agent===$.agent,U2={...$,phase:"request",...L2===void 0?{}:{previousAccountId:L2},...e?.rerouteFrom?{rerouteFrom:e.rerouteFrom}:{}};if(X2&&!T2)await W($.sessionID,()=>A(X2)),_();let A2=T2?X2.accountId:await J.chooseAccount(U2);return{input:U2,accountId:A2}});_();let h={},a;if(k!==void 0){let e=await J.accountHeaders({...$,accountId:k});if(_(),a$(e))h=e.headers,a=e.attempt;else h=e}let V2=`attempt-${++w}`,G2={id:V2,key:I,scope:$,accountId:k,headers:h,attempt:k===void 0?void 0:{...$,accountId:k,attemptId:V2,transport:N,data:a},...N===void 0?{}:{transport:N},outputStarted:!1};if(H(G2),G2.attempt)b("select",{...$,accountId:G2.attempt.accountId,hook:Q,...v.previousAccountId===void 0?{}:{previousAccountId:v.previousAccountId},...v.rerouteFrom===void 0?{}:{rerouteFrom:v.rerouteFrom},handle:G2.attempt});return G2},u=async($,Q,_,N,I)=>{let v=z2($.sessionID,$.kind),k=N===void 0?void 0:Y.get(N);if(k?.key!==v)k=void 0;if(!k){if(k=c(v),f(v).filter((a)=>a.transport===void 0&&!a.ended).length>1&&!x)x=!0,i("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:$.sessionID,kind:$.kind})}if(!k||k.transport!==void 0||k.ended)k=await n($,Q,I,_);else if(k.transport=_,k.attempt)k.attempt.transport=_;if(_==="ws"){for(let h of f(v))if(h!==k&&h.transport==="ws")p(h,"a newer attempt of its session and kind went out over WebSocket")}return k},J2=async($,Q)=>{try{return await Q()}catch(_){throw d($,{reason:"failed",message:s(_)}),_}},j2=($,Q)=>{let _=f(z2($,Q)).filter((N)=>N.transport==="ws").at(-1);return _?.attempt!==void 0&&!_.ended?_:void 0},Z2=($,Q,_)=>{let N=z($);if(!N||!$.attempt||$.limit)return;$.limit={signal:Q,delivered:b("limit",{...N,via:_,limit:Q,outputStarted:$.outputStarted,handle:$.attempt})}},N2=($,Q,_,N)=>{let I=z($);if(!I||!$.attempt)return;b("quota",{...I,transport:Q,...N===void 0?{}:{status:N},quota:_,handle:$.attempt})},$2=($,Q,_,N)=>{let I=$.attempt;if(!I)return;let v=J.inspectEvent?.(N===void 0?{transport:Q,data:_,attempt:I}:{transport:Q,data:_,event:N,attempt:I});if(!v)return;if(v.quota!==void 0)N2($,Q,v.quota);if(v.outputStarted)$.outputStarted=!0;if(v.limit)Z2($,v.limit,Q);if(v.error!==void 0)d($,{reason:"failed",message:v.error});else if(v.done)d($)},t=($,Q)=>{let _=$.attempt;if(!_||Q.accountId===$.accountId)return;if(_.reboundFrom??=_.accountId,_.accountId=Q.accountId,"data"in Q)_.data=Q.data;$.accountId=Q.accountId},B2=($)=>!$.attempt||$.endError!==void 0||$.status!==void 0&&$.status>=400,K2=($)=>{let Q=[...Y.values()].filter((h)=>h.scope.sessionID===$),_=Q.filter((h)=>h.limit&&!h.rerouted).at(-1);if(_)return _;let N=Q.filter((h)=>h.scope.kind==="primary"),I=N.length>0?N:Q;if(I.length<=1)return I[0];let v=I.filter((h)=>!h.judged&&B2(h)).at(-1);if(v)return v;let k=I.filter((h)=>h.attempt&&!h.ended);if(k.length>1)return"ambiguous";return k[0]??I.at(-1)},Y2={providerID:G},W2=[];W2.push(await X.session.hook("model.request",($)=>{if(F)return;return S(Q2($),async(Q)=>{let _=await n(Q2($),"model.request",Q);if(Q(),_.accountId===void 0)throw L(_.scope);l2($.headers,{..._.headers,[C2]:_.id})})},Y2)),W2.push(await X.session.hook("http.request",($)=>{if(F){let Q=C($.request.headers);if(O.set($.sessionID,Q),!Q)return}return S(Q2($),async(Q)=>{let _=$.request.headers.get(C2)??void 0,N=F?await n(Q2($),"http.request",Q,"http"):await u(Q2($),"http.request","http",_,Q);Q();let I=z(N),v=N.attempt;if(!I||!v)throw L(N.scope);await J2(N,async()=>{let k=$.request;if(J.rewriteRequest){if(_!==void 0){let V2=new Headers(k.headers);V2.delete(C2),k=new Request(k,{headers:V2})}k=await J.rewriteRequest({...I,request:k,attempt:v})??k,Q()}let h=new Headers(k.headers);h.delete(C2),e$(h,N.headers),D(N.scope,h.entries());let a=new Request(k,{headers:h});B.set(a,N),$.request=a})})},Y2)),W2.push(await X.session.hook("http.response",async($)=>{let Q=B.get($.request);if(!Q){if(F)return;if(!q)q=!0,i("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:$.sessionID,kind:$.kind});return}let _=$.response;if(J.answeredBy&&Q.attempt){let h=Q.attempt,a=await J2(Q,async()=>J.answeredBy?.({request:$.request,response:_,attempt:h}));if(a)t(Q,a)}let N=z(Q),I=Q.attempt;if(!N||!I)return;Q.status=_.status;let v=J.quotaFromHeaders?.(_.headers,_.status,I);if(v!==void 0)N2(Q,"http",v,_.status);if(!_.ok&&J.limitFromResponse){let h=await J.limitFromResponse({status:_.status,headers:_.headers,body:()=>_.clone().text(),attempt:I});if(h)Z2(Q,h,"http")}if(!_.ok||!_.body)d(Q);let k=_;if(_.body&&(J.inspectEvent||J.onAttemptEnd)){let h=_.body;if(J.inspectEvent)h=h.pipeThrough(m2((a)=>$2(Q,"http",a.data,a.event),(a)=>i("opencode2 auth event inspection threw",{error:s(a)})));k=new Response(t$(h,(a)=>d(Q,a)),{status:_.status,statusText:_.statusText,headers:_.headers})}if(J.rewriteResponse)k=await J.rewriteResponse({...N,request:$.request,response:k,attempt:I})??k;if(k!==_)$.response=k},Y2)),W2.push(await X.session.hook("experimental.ws.handshake",($)=>{if(F){let Q=C(new Headers($.headers)),_=z2($.sessionID,$.kind);if(O.set($.sessionID,Q),U.delete(_),!Q)return}return S(Q2($),async(Q)=>{let _;for(let k of Object.keys($.headers)){if(k.toLowerCase()!==C2)continue;_??=$.headers[k],delete $.headers[k]}let N=F?await n(Q2($),"experimental.ws.handshake",Q,"ws"):await u(Q2($),"experimental.ws.handshake","ws",_,Q);Q();let I=z(N),v=N.attempt;if(!I||!v)throw L(N.scope);await J2(N,async()=>{l2($.headers,N.headers);let k=J.rewriteHandshakeURL?.({...I,url:$.url,attempt:v});if(k!==void 0)$.url=k;if(D(N.scope,Object.entries($.headers)),F)U.add(N.key)})})},Y2));let H2=J.rewriteWebSocketFrame?.bind(J);if(H2)W2.push(await X.session.hook("experimental.ws.send",async($)=>{let Q=Q2($);if(F&&!U.has(z2(Q.sessionID,Q.kind)))return;let _=j2(Q.sessionID,Q.kind),N=await H2({...Q,attempt:_?.attempt,frame:$.frame});if(N!==void 0)$.frame=N},Y2));W2.push(await X.session.hook("experimental.ws.receive",($)=>{if(F&&!U.has(z2($.sessionID,$.kind)))return;let Q=j2($.sessionID,$.kind);if(!Q)return;try{$2(Q,"ws",$.frame)}catch(_){i("opencode2 auth frame inspection threw",{error:s(_)})}},Y2)),W2.push(await X.session.hook("retry",async($)=>{if(F&&O.get($.sessionID)!==!0)return;let Q=K2($.sessionID);if(!Q)return;let _=$.decision;if(Q==="ambiguous"){await b("retry",{sessionID:$.sessionID,attempt:$.attempt,reason:"host-decides",hostDecision:_,decision:_});return}let N=Q;await S(N.scope,async(I)=>{let v=I;N.judged=!0;let k=N.attempt;if(k&&!N.outputStarted){if(!N.limit){let V2=J.limitFromError?.($.error,k);if(V2)Z2(N,V2,"error")}if(N.ended)await N.ended;if(N.limit)await N.limit.delivered}v();let{decision:h,reason:a}=await W(N.scope.sessionID,async()=>{v();let V2=V.get(N.key);if(V.delete(N.key),V2?.next)await A(V2.next);v();let G2=_,e,L2,X2;if(N.accountId===void 0||!k)G2={retry:!1},e="no-account";else if(N.outputStarted)G2={retry:!1},e="output-started";else if(N.limit){let T2={accountId:N.accountId,limit:N.limit.signal},U2,A2={...N.scope,phase:"retry",previousAccountId:N.accountId,rerouteFrom:T2};try{U2=await J.chooseAccount(A2)}catch(g2){i("opencode2 auth chooseAccount threw while the retry hook looked for another account; the host decides the retry",{sessionID:N.scope.sessionID,error:s(g2)})}if(U2!==void 0)X2={accountId:U2,input:A2};try{v()}catch(g2){if(X2)await A(X2);throw g2}if(U2!==void 0&&U2!==N.accountId)N.rerouted=!0,L2=T2,G2={retry:!0,delay:0},e="reroute";else e="host-decides-last-account"}else e="host-decides";if($.decision=G2,G2.retry&&N.accountId!==void 0&&Y.has(N.id))V.set(N.key,{attemptId:N.id,sessionID:N.scope.sessionID,accountId:N.accountId,...L2===void 0?{}:{rerouteFrom:L2},...X2===void 0?{}:{next:X2}});else if(X2)await A(X2);return{decision:G2,reason:e}});v(),await b("retry",{sessionID:$.sessionID,...N.accountId===void 0?{}:{accountId:N.accountId},kind:N.scope.kind,attempt:$.attempt,reason:a,hostDecision:_,decision:h,...k===void 0?{}:{handle:k}})})},Y2));let t2=($)=>{E($),O.delete($);for(let Q of U)if(JSON.parse(Q)[0]===$)U.delete(Q);for(let Q of[...Y.values()]){if(Q.scope.sessionID!==$)continue;p(Q,"its session was forgotten"),Y.delete(Q.id)}for(let[Q,_]of V)if(_.sessionID===$)R(Q)},f2=new AbortController,e2=X.event;if(e2)(async()=>{try{for await(let $ of e2.subscribe({signal:f2.signal}))if($.type==="session.deleted")t2($.data.sessionID)}catch($){if(!f2.signal.aborted)i("opencode2 auth stopped listening for session deletion",{error:s($)})}})();return{on($,Q){let _=m.get($);if(!_)_=new Set,m.set($,_);let N=Q;return _.add(N),()=>{_.delete(N)}},accountFor($,Q){return c(z2($,Q))?.accountId},forgetSession:t2,get size(){return Y.size},async dispose(){if(o)return;o=!0;for(let $ of r.keys())E($);f2.abort();for(let $ of Y.values())p($,"the installation was disposed");Y.clear();for(let $ of V.keys())R($);U.clear(),O.clear(),m.clear(),await Promise.all(Z.values()),await Promise.all(W2.map(async($)=>{try{await $.dispose()}catch(Q){i("opencode2 auth hook did not dispose cleanly",{error:s(Q)})}}))}}}import{CacheKeepManager as S1,CacheKeepSessionRegistry as R1,getDefaultCacheKeepRegistryDirectory as x1,isCacheKeepActiveNow as F$,isCacheKeepHybridActive as i2,isCacheKeepSubagentsEnabled as c2,logger as A1}from"@cortexkit/anthropic-auth-core";import{createHash as $1}from"node:crypto";import{applyCustomHeaders as X1,assertNotCustodyTombstone as J1,classifyGzipRejection as Z1,createProviderErrorRedactor as Z$,createProviderErrorResponseScope as Y$,decideRequestGzip as Y1,encodeGzipRequestBody as G1,getAccountStoragePath as j1,getRequestGzipLatch as W1,getRequestGzipLatchPath as V1,mergeAnthropicBetas as Q1,remapModelId as G$,remapRequestBodyModel as H1,stripEmptyTrailingAssistantMessages as U1,TrailingAssistantHistoryError as B1}from"@cortexkit/anthropic-auth-core";var S2="anthropic",N$="x-common-auth-attempt",K1=["x-session-affinity","x-opencode-session","x-parent-session-id",V$,k2,R2,N$],q2=new Set(["authorization","x-api-key"]),M1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",z1=512,_1=5000,N1=500,j$=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class L$ extends Error{sessionID;requestKind;kind="no-account";providerID=S2;constructor(X,J){super(M1);this.sessionID=X;this.requestKind=J;this.name="NativeAnthropicNoAccountError"}}class u2 extends Error{sessionID;requestKind;kind="session-forgotten";providerID=S2;constructor(X,J){super("request refused: its session was closed while it was being prepared");this.sessionID=X;this.requestKind=J;this.name="NativeAnthropicRevokedError"}}class F2 extends Error{kind="unsupported-transport";providerID=S2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class C$ extends Error{kind="local-invalid-request";status=400;check;constructor(X){super(X.message,{cause:X});this.name="NativeAnthropicLocalRefusal",this.check=X.check}}var _2=(X)=>typeof X==="object"&&X!==null&&!Array.isArray(X);function E2(X){try{return JSON.parse(X)}catch{return}}function p2(X){let J={};for(let[M,G]of Object.entries(X??{}))J[M.toLowerCase()]=G;return J}function W$(X){let J={};for(let M of K1){let G=X.get(M);if(G!==null&&M!==N$)J[M]=G;X.delete(M)}return J}function L1(X){try{return new URL(X).pathname.endsWith("/messages")}catch{return!1}}function C1(X){return X instanceof B1||X instanceof Q$?new C$(X):void 0}function F1(X,J){let M=[];if(X.oauth)M.push(X.oauth.accessToken);for(let[G,F]of Object.entries(X.apiHeaders??{})){if(F===null||!q2.has(G))continue;M.push(F.replace(/^Bearer\s+/i,""))}for(let G of q2){let F=J.get(G);if(F!==null)M.push(F.replace(/^Bearer\s+/i,""))}if(X.dispatch?.kind==="http-relay")M.push(X.dispatch.token);return[...new Set(M.filter(Boolean))]}var P1=new Set(["oauth-2025-04-20","claude-code-20250219",U$]);function T1(X){let J=X.split(",").map((M)=>M.trim()).filter((M)=>M&&!P1.has(M));return Q1(null,J)}function O1(X){let J=E2(X);if(!_2(J))return X;let M=U1(J.messages),G=Object.hasOwn(J,"fallbacks"),{droppedMarkers:F}=B$(J,!1),C=G&&!Object.hasOwn(J,"fallbacks"),P=H1(J);return M>0||F>0||C||P?JSON.stringify(J):X}async function E1(X,J){if(!(X instanceof Promise))return"settled";let M;try{return await Promise.race([X.then(()=>"settled"),new Promise((G)=>{M=setTimeout(()=>G("timed-out"),J)})])}finally{if(M!==void 0)clearTimeout(M)}}function P2(X){let{source:J,log:M}=X,G=Math.max(1,X.maxPendingSends??z1),F=X.attemptEndTimeoutMs??_1,C=X.requestGzipLatch??W1(V1(j1())),P=new WeakSet,T=new Map,K=new WeakMap,Y=new WeakMap,B=new WeakMap,V=new Map,U=new WeakMap,O=Z$([]);O.dispose();let q=(H)=>(H&&V.get(H)?.redactor)??O,x=(H)=>{let z=V.get(H);if(!z)return;V.delete(H),z.redactor.dispose(),z.scope.dispose()},m=(H,z,L,E)=>{let S=F1(z,E),D=Y$(S,L);w.set(H,L),V.set(H,{sessionID:z.sessionID,redactor:Z$(S),scope:D}),D.settled.then(()=>x(H));while(V.size>G){let g=V.keys().next().value;if(g===void 0)break;x(g)}},w=new WeakMap,o=(H,z)=>{let L=H?w.get(H):void 0;if(!L||!z.ok)return O.redactResponse(z);let E=Y$([],L),S=E.redactResponse(z);return E.dispose(),S},r=(H,z)=>{let L=H?V.get(H)?.scope:void 0;if(!L)return o(H,z);try{return L.redactResponse(z)}catch{return o(H,z)}},i=!1,s=new WeakMap,Z=(H,z)=>{if(H&&!z.ok)s.set(z.headers,H);return z},W=(H,z)=>{if(z.dispatch!=="http-relay")return!0;let L=/^req_[A-Za-z0-9_-]+$/.test(H.get("request-id")??"");return Y.set(z,L),L},j=(H)=>new L$(H.sessionID,H.kind),A=new Map,R=async(H,z)=>{if(i)throw new u2(H.sessionID,H.kind);let L={revoked:!1},E=A.get(H.sessionID);if(!E)E=new Set,A.set(H.sessionID,E);E.add(L);let S=()=>{if(i||L.revoked)throw new u2(H.sessionID,H.kind)};try{let D=await z(S);return S(),D}finally{let D=A.get(H.sessionID);if(D?.delete(L)&&D.size===0)A.delete(H.sessionID)}},b=(H,z)=>{T.set(H,z);while(T.size>G){let L=T.keys().next().value;if(L===void 0)break;T.delete(L),M?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:G})}},y=(H,z)=>({providerID:H.providerID,modelID:H.modelID,sessionID:H.sessionID,agent:H.agent,kind:H.kind,accountId:H.accountId,attemptId:H.attemptId,transport:H.transport,route:z.route,provenance:z.provenance,dispatch:z.dispatch}),d=(H)=>R(H,async(z)=>{let{accountId:L,...E}=H,S=await J.authorizeAccount(E,L);return z(),p(E,S)}),p=(H,z)=>{if(!z)throw j(H);if(z.dispatch?.kind==="websocket-relay")throw new F2;let L=z.dispatch?.kind==="http-relay"?"http-relay":"direct",E=z.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":z.dispatch.token}:void 0;if(z.route==="oauth"){if(!z.accessToken)throw j(H);J1(z.accessToken,S2);let g=Object.freeze({route:"oauth",provenance:z.provenance,dispatch:L});b(g,{sessionID:H.sessionID,oauth:{accessToken:z.accessToken,...z.identity?{identity:z.identity}:{}},dispatch:z.dispatch,oauthHeaders:z.headers});let n=p2(z.headers);for(let u of q2)delete n[u];return delete n["anthropic-beta"],{headers:E??{...n,"x-api-key":null,authorization:`Bearer ${z.accessToken}`},attempt:g}}let S={authorization:null,"x-api-key":null,...p2(z.headers)};if(!S.authorization&&!S["x-api-key"])throw j(H);let D=Object.freeze({route:"api",provenance:z.provenance,dispatch:L});return b(D,{sessionID:H.sessionID,...z.baseURL?{baseURL:z.baseURL}:{},dispatch:z.dispatch,apiHeaders:S}),{headers:E??S,attempt:D}},f=(H)=>R(H,(z)=>c(H,z)),c=async(H,z)=>{let{request:L,attempt:E}=H,S=E.data,D=S?T.get(S):void 0;if(S)T.delete(S);if(!S||!D||S.route==="oauth"&&!D.oauth)throw j(H);let g=new Headers(L.headers);X1(g);let n=W$(g),u=L.body===null?void 0:await L.text();z();let J2=u!==void 0&&L1(L.url);try{if(S.route==="oauth"&&D.oauth){let{accessToken:$2,identity:t}=D.oauth;for(let[K2,Y2]of Object.entries(p2(D.oauthHeaders))){if(q2.has(K2))continue;if(Y2===null)g.delete(K2);else g.set(K2,Y2)}let B2=null;if(u!==void 0&&J2){let K2={...y(E,S),modelID:(()=>{let H2=E2(u);return G$(_2(H2)&&typeof H2.model==="string"?H2.model:H.modelID)})(),route:"oauth",correlation:n},Y2=await J.requestOptions?.(K2)??{};z(),u=await z$(u,{...Y2,...t?{identity:t}:{},sessionId:H.sessionID,onToolNameMap:(H2)=>B.set(S,H2)});let W2=E2(u);B2=_2(W2)?W2:null}K$(g,$2,{body:B2,...t?{identity:t}:{},requestClass:H$(E.agent)?"auxiliary":"main"})}else{if(u!==void 0&&J2)u=O1(u);g.delete("authorization"),g.delete("x-api-key");for(let[t,B2]of Object.entries(D.apiHeaders??{}))if(B2===null)g.delete(t);else g.set(t,B2);if(u!==void 0&&J2&&!g.has("content-type"))g.set("content-type","application/json");let $2=g.get("anthropic-beta");if($2!==null){let t=T1($2);if(t)g.set("anthropic-beta",t);else g.delete("anthropic-beta")}}}catch($2){let t=C1($2);if(!t)throw $2;throw K.set(S,t.check),M?.warn("refused an Anthropic request locally; nothing was sent",{check:t.check}),t}let j2=u!==void 0?E2(u):void 0;if(await J.admitRequest?.({...y(E,S),modelID:G$(_2(j2)&&typeof j2.model==="string"?j2.model:H.modelID)}),W$(g),u!==void 0)g.delete("content-length");z(),m(S,D,_2(j2)&&j2.stream===!0?"event-stream":"http",g);let Z2=M$(L.url,D.baseURL!==void 0?{baseURL:D.baseURL}:{}).url?.toString()??L.url;if(S.route==="oauth"&&J2&&u!==void 0)await J.onRequestPrepared?.({...y(E,S),url:Z2,bodyText:u}),z();if(D.dispatch?.kind==="http-relay"){let $2=u??"";g.delete("x-relay-token");let t={protocol:1,type:"request",affinity:H.sessionID,upstream:{url:Z2,method:L.method,headers:Object.fromEntries(g)},mode:"full_sync",revision:1,body:$2,next_hash:`sha256:${$1("sha256").update($2).digest("hex")}`};return new Request(D.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":D.dispatch.token},redirect:"error",signal:L.signal,body:JSON.stringify(t)})}let N2=u;if(S.route==="oauth"&&J2&&u!==void 0){let $2=await Y1({url:Z2,body:u,latch:C});if(z(),$2.gzip)N2=await G1(u),g.set("content-encoding","gzip"),P.add(S),z()}return new Request(Z2,{method:L.method,headers:g,redirect:L.redirect,signal:L.signal,...N2!==void 0?{body:N2}:{}})};return{adapter:{providerID:S2,chooseAccount:(H)=>R(H,async()=>{let z=await J.chooseAccount(H);if(!z)throw j(H);return z}),dropChoice:(H)=>J.dropChoice?.(H),accountHeaders:d,rewriteRequest:f,rewriteHandshakeURL(){throw new F2},rewriteResponse({response:H,attempt:z}){let L=z.data;if(L&&!W(H.headers,L)){if(H.status===401)return x(L),H.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return r(L,H)}if(L&&P.has(L))P.delete(L),Z1(H).then((n)=>{if(!n)return;C.latchProcess(),M?.warn("gzipped request body rejected; later requests go uncompressed",{kind:n,status:H.status})},()=>{});let E=r(L,H);if(L?.route!=="oauth"||!E.body)return Z(L,E);let S={...y(z,L),status:H.status},D=J.responseOptions?.(S)??{},g=(H.headers.get("content-type")??"").includes("application/json");return Z(L,_$(E,{...D,toolNameMap:B.get(L),onToolNameRefusal:()=>{K.set(L,"response_tool_names"),x(L)},laneStartOAuthServed:!0,...g?{responseMode:"json"}:{}}))},quotaFromHeaders(H,z,L){let E=L.data;if(!E||!W(H,E))return;return J.quotaFromHeaders?.(H,{...y(L,E),status:z})},async limitFromResponse({status:H,headers:z,body:L,attempt:E}){let S=E.data;if(!S||K.get(S)==="response_tool_names")return;if(!W(z,S))return J.limitFromRelayFailure?.({...y(E,S),status:H});if(U.set(S,`provider responded with HTTP ${H}`),!J.limitFromResponse)return;let D=s.get(z)===S,g=q(S);return J.limitFromResponse({...y(E,S),status:H,headers:z,body:async()=>D?await L():g.redactText(await L())})},inspectEvent({data:H,event:z,attempt:L}){if(L.data&&K.get(L.data)==="response_tool_names")return;let E=E2(H);if(!_2(E))return;let S=typeof E.type==="string"?E.type:z;if(S==="content_block_start"||S==="content_block_delta")return{outputStarted:!0};if(S==="message_stop")return{done:!0};if(S!=="error")return;let D=L.data,g=q(D),n=_2(E.error)?E.error:{},u=typeof n.type!=="string"?void 0:j$.has(n.type)?n.type:g.redactText(n.type),J2=typeof n.message==="string"?g.redactText(n.message):void 0;if(D?.dispatch==="http-relay"&&Y.get(D)===!1)return;let j2=D?J.limitFromStreamError?.({...y(L,D),errorType:u,message:J2}):void 0,Z2={error:[u??"error",J2].filter(Boolean).join(": ").slice(0,N1),...j2?{limit:j2}:{}};if(D&&Z2.error)U.set(D,Z2.error);return Z2},limitFromError(H,z){let L=z.data;if(!L||K.has(L))return;let E={type:j$.has(H.type)?H.type:"provider_error",message:U.get(L)??"provider request failed",...H.status!==void 0?{status:H.status}:{}};if(x(L),L.dispatch==="http-relay"&&Y.get(L)===!1)return;return J.limitFromHostError?.(E,y(z,L))},async onAttemptEnd(H,z){let L=H.data;if(!L)return;T.delete(L);let E=z.error?.reason;if(E==="cancelled"||E==="abandoned"||E===void 0&&(z.status===void 0||z.status<400))x(L);let S=K.get(L),{status:D,...g}=z,n=J.onAttemptEnd?.(y(H,L),{...g,...D!==void 0&&(L.dispatch!=="http-relay"||Y.get(L)===!0)?{status:D}:{},...S!==void 0?{localRefusal:{check:S}}:{}});if(await E1(n,F)==="timed-out")M?.warn("the account source did not finish recording a send",{timeoutMs:F})}},dispose(){i=!0;for(let[H,z]of A){for(let L of z)L.revoked=!0;J.forgetSession?.(H)}A.clear(),T.clear();for(let H of[...V.keys()])x(H)},forgetSession(H){for(let z of A.get(H)??[])z.revoked=!0;A.delete(H);for(let[z,L]of T)if(L.sessionID===H)T.delete(z);for(let[z,L]of[...V])if(L.sessionID===H)x(z);J.forgetSession?.(H)},get pendingSendCount(){return T.size},get heldCredentialCount(){let H=0;for(let z of T.values())if(z.oauth)H++;return H},get heldRedactorCount(){return V.size},get operationsInProgress(){let H=0;for(let z of A.values())H+=z.size;return H}}}function x2(X){return JSON.stringify([X.source,X.accountIdentity,X.credentialId,X.binding?.storageId,X.binding?.rowId,X.binding?.credentialEpoch])}function P$(X){let{runtime:J,source:M}=X,G=new AbortController,F=!1,C=new R1({directory:X.registryDirectory||process.env.OPENCODE_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR||x1("opencode"),now:X.now}),P=new Map,T=async(V,U,O)=>{let q=O?AbortSignal.any([G.signal,O]):G.signal;q.throwIfAborted();let x=JSON.parse(await U.text()),m={providerID:"anthropic",modelID:x.model,sessionID:`oc2-cachekeep:${V.id}`,agent:"cachekeep",kind:"generate"},w=P2({source:{...M,onRequestPrepared:void 0,responseOptions:void 0,async requestOptions(Z){return{...await M.requestOptions?.(Z),laneStart:!1,billingLineage:void 0,cacheDiagnosticsPreviousMessageId:void 0}},async authorizeAccount(Z,W){let j=await J.read();q.throwIfAborted();let A=j.accounts.find((b)=>b.id===W);if(A?.type!=="oauth"||x2(A)!==V.oauthAccountIdentity||V.isSubagent&&!c2(j.policyStorage)||!i2(j.policyStorage)||!F$(j.policyStorage,new Date(X.now?.()??Date.now())))return;let R=await M.authorizeAccount(Z,W);if(R?.provenance.kind==="local"&&x2({...A,binding:R.provenance.subject.binding,accountIdentity:R.provenance.subject.binding.identity})!==V.oauthAccountIdentity)return;if(R?.provenance.kind==="vault"&&R.provenance.credentialId!==A.credentialId)return;return R},async admitRequest(Z){await M.admitRequest?.(Z);let W=await J.read(),j=W.accounts.find((A)=>A.id===Z.accountId);if(q.throwIfAborted(),!j||x2(j)!==V.oauthAccountIdentity||V.isSubagent&&!c2(W.policyStorage)||!i2(W.policyStorage)||!F$(W.policyStorage,new Date(X.now?.()??Date.now())))throw Error("CacheKeep policy changed before dispatch")}}}),o,r,i=!1,s=()=>w.forgetSession(m.sessionID);q.addEventListener("abort",s,{once:!0});try{let Z=(await J.read()).accounts.find((y)=>x2(y)===V.oauthAccountIdentity)?.id;if(!Z)throw Error("CacheKeep account is unavailable");let W=await w.adapter.accountHeaders({...m,accountId:Z});if(!("headers"in W)||typeof W.headers!=="object"||W.headers===null||typeof W.attempt!=="object"||W.attempt===null||W.attempt.route!=="oauth")throw Error("CacheKeep authorization refused");o={...m,accountId:Z,attemptId:crypto.randomUUID(),transport:"http",data:W.attempt};let j=await w.adapter.rewriteRequest?.({...m,accountId:Z,attempt:o,request:new Request(V.url,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(x),signal:q})});if(!j)throw Error("CacheKeep rewrite refused");q.throwIfAborted();let A=await(X.fetch??fetch)(j),R=await w.adapter.rewriteResponse?.({...m,accountId:Z,attempt:o,request:j,response:A});if(!R)throw Error("CacheKeep response rewrite refused");if(r=R.status,w.adapter.quotaFromHeaders?.(R.headers,R.status,o),!R.ok)await w.adapter.limitFromResponse?.({status:r,headers:R.headers,body:()=>R.clone().text(),attempt:o});let b=await R.arrayBuffer();return i=!0,new Response(b,{status:r,headers:R.headers})}catch{throw Error("Native CacheKeep was not completed")}finally{q.removeEventListener("abort",s);try{if(o)await w.adapter.onAttemptEnd?.(o,{status:r,outputStarted:!1,...i?{}:{error:{reason:"cancelled"}}})}finally{w.dispose(),M.forgetSession?.(m.sessionID)}}},K=X.setIntervalImpl??globalThis.setInterval,Y=new S1({loadStorage:async()=>F?null:(await J.read()).policyStorage,now:X.now,setIntervalImpl:(V,U)=>K(()=>Y.tick().catch(()=>{A1.warn("cachekeep","tick failed")}),U),clearIntervalImpl:X.clearIntervalImpl,onTrackedSessionsChanged:(V)=>C.publish(F?[]:V),prepareHeaders(V,U,O){if(F)return;return P.set(O.id,{target:U,attempt:O}),new Headers({"x-native-cachekeep-attempt":String(O.id)})},fetchImpl:async(V,U)=>{let O=new Request(V,U),q=Number(O.headers.get("x-native-cachekeep-attempt")),x=P.get(q);if(P.delete(q),!x)throw Error("CacheKeep attempt is unavailable");return T(x.target,O,x.attempt.signal)},onComplete:({attempt:V})=>{P.delete(V.id)}}),B;return{async track(V){if(F||V.route!=="oauth"||V.agent==="cachekeep"||V.agent==="prime"||V.kind!=="primary")return;let U=await J.read();if(F||!i2(U.policyStorage))return;let O=!1;try{O=await X.isSubagent?.(V.sessionID)??!1}catch{return}if(F||O&&!c2(U.policyStorage))return;let q=U.accounts.find((x)=>x.id===V.accountId);if(!q?.accountIdentity)return;if(V.provenance.kind==="local"&&JSON.stringify(q.binding)!==JSON.stringify(V.provenance.subject.binding))return;if(V.provenance.kind==="vault"&&q.credentialId!==V.provenance.credentialId)return;Y.track({sessionId:V.sessionID,url:V.url,headers:new Headers,bodyText:V.bodyText,storage:U.policyStorage,cacheMode:"hybrid",oauthAccountId:V.accountId,oauthAccountIdentity:x2(q),isSubagent:O}),await C.publish(Y.trackedSessions())},registry:C,dispose(){if(B)return B;return F=!0,Y.stop(),G.abort(),B=(async()=>{try{await Y.tick()}finally{P.clear(),await C.dispose()}})(),B}}}async function T$(X,J,M){let G=P2(J),F=[],C=async(U,O,q)=>{let x=await X.session.hook(U,O,q);return F.push(x),x},P=new AbortController,T;try{T=await d2({session:{hook:C},event:X.event},G.adapter,{logger:J.log,gateOnPlaceholder:M})}catch(U){throw G.dispose(),await Promise.allSettled(F.map((O)=>O.dispose())),U}let K=(U)=>{G.forgetSession(U),T.forgetSession(U)},Y=X.event,B=Y?(async()=>{try{for await(let U of Y.subscribe({signal:P.signal}))if(U.type==="session.deleted")K(U.data.sessionID)}catch(U){if(!P.signal.aborted)J.log?.warn("stopped listening for session deletion",{error:U instanceof Error?U.name:"unknown"})}})():Promise.resolve(),V;return{installation:T,forgetSession:K,dispose(){if(V)return V;return G.dispose(),P.abort(),V=(async()=>{await T.dispose(),await B})(),V}}}import{effectiveRelayTransport as O$,getQuotaCheckIntervalMs as q1,logger as k1,nativeAccountCanServe as D1,oauthProfileIsFresh as b1,quotaSnapshotCheckedAt as w1}from"@cortexkit/anthropic-auth-core";function E$(X,J){let M=new AbortController,G,F=!1,C=async()=>{let K=await X.read();if(M.signal.throwIfAborted(),K.policyStorage.relay?.enabled===!0&&O$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="websocket")return;let Y=K,B=q1(Y.policyStorage);for(let V of Y.accounts){if(M.signal.aborted)return;if(!D1(V)||V.type!=="oauth")continue;if(Y.policyStorage.quota?.enabled!==!1&&Date.now()-w1(V.quota)>=B)await X.fetchQuota(V.id,J,M.signal,void 0,"background").catch(()=>{});if(!b1(V.profile)&&!M.signal.aborted)await X.fetchProfile(V.id,J,M.signal).catch(()=>{})}},P=()=>{if(F||G)return G;return G=C().catch(()=>{if(!M.signal.aborted)k1.debug("opencode2","native background readings did not complete")}).finally(()=>{G=void 0}),G},T=X.vault.watch({intervalMs:60000,onRefresh:P,shouldRefresh:async()=>{let K=await X.read();return K.policyStorage.relay?.enabled!==!0||O$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="http"}});return T.ready.catch(()=>{}),{async dispose(){F=!0,T.close(),M.abort(),await G}}}import{authorize as i1,buildCacheKeepStatusSummary as c1,buildClaudeQuotaSummary as o1,buildPrimeAccountStatuses as n1,buildPrimeStatusSummary as r1,CLAUSTRUM_OPENCODE_ENROLLMENT_NAME as s1,exchange as a1,formatNativeAccountState as t1,formatOAuthAccountTier as e1,getCacheKeepWindow as $X,getHostClaustrumEnrollmentPaths as XX,isCacheKeepAlways as JX,isCacheKeepHybridActive as ZX,isCacheKeepPersistentlyEnabled as YX,nativeAccountCanServe as GX,resetClaustrumEnrollmentState as jX}from"@cortexkit/anthropic-auth-core";import{buildPrimeAccountStatuses as y1,effectiveRelayStatus as I1,formatNativeAccountState as f1,formatOAuthAccountTier as S$,getCacheKeepWindow as g1,getRoutingMode as v1,isCacheKeepAlways as h1,isCacheKeepHybridActive as m1,isPermanentRefreshError as l1,isPrimePersistentlyEnabled as d1,nativeAccountCanServe as A$,refreshBackoffActive as R$}from"@cortexkit/anthropic-auth-core";var x$=(X)=>A$(X)&&X.state!=="unsupported-access"?void 0:f1(X)||void 0,p1=(X)=>{if(X.source!=="vault")return"off";if(X.state==="needs_reauth")return"on-vault-reauth";return A$(X)?"on-vault-served":"on-cold"},u1=(X,J)=>typeof X==="number"&&X>J;function q$(X,J){let{now:M}=J,G=X.policyStorage,F=X.accounts.filter((B)=>B.type==="oauth"),C=F.find((B)=>B.id==="main"),P=C?x$(C):void 0,T=C?.lastQuotaRefreshError?.nextRetryAt,K=C?.lastRefreshError,Y=g1(G);return{main:{quota:C?.quota??null,enabled:C?.enabled,tierLabel:S$(C?.profile),quotaBackedOff:u1(T,M),quotaBackoffUntil:T,refreshBackedOff:R$(K,C?.accountIdentity,M,void 0),refreshBackoffUntil:K?.nextRetryAt,stateLine:P,quotaDated:Boolean(P)},fallbacks:F.filter((B)=>B.id!=="main"&&(B.enabled||B.source==="vault")).map((B)=>{let V=x$(B),U=p1(B);return{id:B.id,label:B.label,quota:B.quota??null,enabled:B.enabled,tierLabel:S$(B.profile),needsReauth:l1(B.lastRefreshError)&&R$(B.lastRefreshError,B.accountIdentity,M,void 0),...U==="on-vault-reauth"?{vaultReauth:!0}:{},...U==="on-vault-served"?{vaultServed:!0}:{},...U!=="off"?{custodyState:U}:{},stateLine:V,quotaDated:Boolean(V)}}),activeId:J.activeId,route:v1(G),relay:I1(G.relay),fastMode:G.claudeFast?.enabled===!0,cacheKeep:{enabled:m1(G),window:h1(G)?"always":Y?`${Y.startHour}-${Y.endHour}`:void 0,trackedSessions:J.trackedSessions},prime:d1(G)?{enabled:!0,accounts:y1(G,{now:M})}:void 0,lastUpdated:M}}var o2=(X)=>X!==null&&typeof X==="object"&&!Array.isArray(X)?X:{};function k$(X){let{runtime:J,source:M}=X,G=new Map,F=!1,C=async(Y,B)=>{await J.updateSettings((V)=>({...V,[Y]:{...o2(V[Y]),...B}}))},P=()=>({ok:!0,text:"Native Claude settings updated."}),T=async(Y,B)=>{if(F)throw Error("Native menu is closed");switch(B.signal?.throwIfAborted(),Y.action){case"enable":case"disable":return await J.setEnabled(Y.values.id,Y.action==="enable"),P();case"remove":return await J.remove(Y.values.id),P();case"move-up":case"move-down":{let U=(await J.read()).accounts.map((w)=>w.id),O=U.indexOf(Y.values.id),q=O+(Y.action==="move-up"?-1:1);if(O<0||q<0||q>=U.length)return{ok:!1,text:"Account cannot move in that direction."};let x=U[O],m=U[q];if(x===void 0||m===void 0)return{ok:!1,text:"Account order changed."};return U[O]=m,U[q]=x,await J.reorder(U),P()}case"add-apikey":return await J.addApi(Y.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let V=new AbortController;G.get(Y.sessionId)?.active.abort();let U={active:V,auth:void 0};G.set(Y.sessionId,U);let O=await i1("max");if(F||V.signal.aborted||B.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return U.auth=O,{ok:!0,text:`Open ${O.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let V=G.get(Y.sessionId);if(!V?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let U=await a1(Y.values.code,V.auth.verifier,V.auth.redirectUri,V.auth.state);if(V.active.signal.throwIfAborted(),B.signal?.throwIfAborted(),F||U.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await J.loginOAuth({routeId:crypto.randomUUID(),credential:U,label:Y.values.label}),V.active.signal.throwIfAborted(),B.signal?.throwIfAborted(),F)return{ok:!1,text:"Sign-in cancelled."};return G.delete(Y.sessionId),{ok:!0,text:"OAuth account stored in the native account pool."}}case"reset-backoff":{let V=await J.read();for(let U of V.accounts){if(B.signal?.throwIfAborted(),U.type!=="oauth")continue;let O=U.source==="vault"?await J.authorizeVault(U.id,B.signal):await J.captureLocalSubject(U.id);await J.resetBackoff(U.id,O)}return P()}case"enrollment-reset":{let V=await jX(XX("opencode"),s1);return{ok:V==="reset",text:V==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":V==="refused-pending"?"An enrollment request may still be in progress. Quit OpenCode and run setup again; it picks up the same request.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let U=(await J.read()).accounts.filter((x)=>x.type==="oauth"&&GX(x)),O=await Promise.allSettled(U.map((x)=>J.fetchQuota(x.id,void 0,B.signal)));return{ok:O.every((x)=>x.status==="fulfilled"),text:`${O.filter((x)=>x.status==="fulfilled").length}/${U.length} native quota readings refreshed.`}}case"routing-reset":return await M.resetRouting(Y.sessionId),P();case"routing-mode":return await C("routing",{mode:Y.values.mode}),P();case"killswitch-on":case"killswitch-off":return await C("killswitch",{enabled:Y.action==="killswitch-on"}),P();case"killswitch-set":return await J.updateSettings((V)=>{let U=o2(V.killswitch),O={...o2(U.accounts)},q=U.main;for(let x of Y.values.entries){let m={five_hour:x.fh,seven_day:x.sd,...x.scoped!==void 0?{scoped:x.scoped}:{}};if(x.account==="main"||x.account==="all")q=m;if(x.account==="all")for(let w of Object.keys(O))O[w]=m;else if(x.account!=="main")O[x.account]=m}return{...V,killswitch:{...U,main:q,accounts:O}}}),P();case"cache-on":case"cache-off":return await C("claudeCache",{enabled:Y.action==="cache-on"}),P();case"cache-mode":return await C("claudeCache",{mode:Y.values.mode}),P();case"cachekeep-always":return await C("cacheKeep",{enabled:!0,always:!0}),P();case"cachekeep-off":return await C("cacheKeep",{enabled:!1}),P();case"cachekeep-window":return await C("cacheKeep",{enabled:!0,always:!1,startHour:Y.values.startHour,endHour:Y.values.endHour}),P();case"cachekeep-subagents":return await C("cacheKeep",{subagents:Y.values.enabled==="on"}),P();case"dump-on":case"dump-off":return await C("dump",{enabled:Y.action==="dump-on"}),P();case"logging-level":return await C("logging",{level:Y.values.level}),P();case"fast-on":case"fast-off":return await C("claudeFast",{enabled:Y.action==="fast-on"}),P();case"prime-on":case"prime-off":return await C("prime",{enabled:Y.action==="prime-on"}),P();case"start-fire":return await K(Y.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},K=(Y)=>X.start(Y,D2);return{dispatch:T,async readStatus(Y){let B=await J.read();if(Y==="account")return B.accounts.map((U)=>`${U.id}${U.label?` (${U.label})`:""}: ${U.type}, ${U.source}, ${U.enabled?"enabled":"disabled"}${U.state?`, ${t1(U)}`:""}${U.accountIdentity?`, ${U.accountIdentity}`:""}`).join(`
+`)||"No native Claude accounts.";if(Y==="quota")return o1({accounts:B.accounts.filter((U)=>U.type==="oauth").map((U)=>({name:U.label??U.id,role:U.id==="main"?"main":"fallback",enabled:U.enabled,quota:U.quota,tierLabel:e1(U.profile),lastRefreshedAt:U.lastRefreshedAt,error:U.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(Y==="prime")return r1({enabled:B.policyStorage.prime?.enabled===!0,accounts:n1(B.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");if(Y==="cachekeep"){let U=await X.cacheKeepRegistry?.list()??[];return c1({enabled:YX(B.policyStorage),always:JX(B.policyStorage),hybridActive:ZX(B.policyStorage),trackedSessionDetails:U,window:$X(B.policyStorage),trackedSessions:U.length,nextPrewarmAt:U.length?Math.min(...U.map((O)=>O.nextPrewarmAt)):void 0})}let V={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(B.settings[V[Y]]??{})},async readSidebar(Y){let[B,V]=await Promise.all([J.read(),X.cacheKeepRegistry?.list()??[]]);return q$(B,{activeId:M.servedAccount(Y),trackedSessions:V.length,now:Date.now()})},forgetSession(Y){G.get(Y)?.active.abort(),G.delete(Y)},close(){F=!0;for(let Y of G.values())Y.active.abort();G.clear()}}}import{resolveClaudeModelCapabilities as WX}from"@cortexkit/anthropic-auth-core";function D$(){let X=new Map;return{install:(M)=>M.model.transform((G)=>{X.clear();for(let F of G.list("anthropic")){X.set(String(F.id),String(F.modelID));let C=WX(F.modelID)?.efforts.variants;if(!C)continue;G.update("anthropic",String(F.id),(P)=>{let T=P.variants.filter((K)=>!C.some((Y)=>Y===String(K.id)));P.variants=[...T,...C.map((K)=>({id:K,settings:{effort:K,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(M)=>X.get(M)??M}}function b$(X){return X.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??X.get("x-api-key")??void 0}import{buildPrimeRequestBody as w$,effectiveRelayTransport as y$,nativeAccountCanServe as VX,PrimeManager as QX}from"@cortexkit/anthropic-auth-core";var I$=(X)=>X!==null&&typeof X==="object"&&!Array.isArray(X)?X:{};function f$(X){let{runtime:J,source:M}=X,G=new AbortController,F=new Set,C=(K)=>({providerID:"anthropic",modelID:w$().model,sessionID:`oc2-prime:${K}`,agent:"prime",kind:"generate"}),P=async(K)=>{let Y=C(K),B=P2({source:M}),V=performance.now();try{for(let U=0;U<3;U++){if(G.signal.throwIfAborted(),(await J.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let q=await B.adapter.accountHeaders({...Y,accountId:K});if(!("headers"in q)||typeof q.headers!=="object"||q.headers===null||typeof q.attempt!=="object"||q.attempt===null)throw Error("Native Prime authorization refused");let x={...Y,accountId:K,attemptId:crypto.randomUUID(),transport:"http",data:q.attempt},m,w=!1,o=!1,r=(i)=>{o=!0,i.body?.cancel().catch(()=>{})};try{let i=await B.adapter.rewriteRequest?.({...Y,accountId:K,attempt:x,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(w$()),signal:G.signal})});if(!i)throw Error("Native Prime rewrite refused");let s=new Headers(i.headers);for(let[d,p]of Object.entries(q.headers))if(p===null)s.delete(d);else s.set(d,p);let Z=new Request(i,{headers:s}),W=await(X.fetch??fetch)(Z),j=await B.adapter.rewriteResponse?.({...Y,accountId:K,request:Z,response:W,attempt:x})??W;m=j.status,B.adapter.quotaFromHeaders?.(j.headers,j.status,x);let A=j.ok?void 0:await B.adapter.limitFromResponse?.({status:j.status,headers:j.headers,body:()=>j.clone().text(),attempt:x});if(A&&/^(vault-newer|local-newer|relay-direct):/.test(A.reason)&&U<2){r(j);let d={...Y,phase:"retry",rerouteFrom:{accountId:K,limit:A}};if(await M.chooseAccount(d)!==K)throw Error("Native Prime retry changed account");continue}if(!j.ok)return r(j),{ok:!1,status:m,ms:performance.now()-V,error:"Native Prime upstream refused the request"};let R=I$(await j.json()),b=I$(R.usage),y={inputTokens:typeof b.input_tokens==="number"?b.input_tokens:void 0,outputTokens:typeof b.output_tokens==="number"?b.output_tokens:void 0};if(x.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(j.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(w=await M.recordPrime(q.attempt.provenance,y),!w)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:m,ms:performance.now()-V,usage:y}}finally{await B.adapter.onAttemptEnd?.(x,{status:m,outputStarted:!1,...w?{}:{error:{reason:o?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-V}}finally{B.dispose()}},T=new QX({storagePath:X.paths.legacyConfig,loadStorage:async()=>(await J.read()).policyStorage,async getAccountFingerprint(K){let Y=await J.read(),B=Y.accounts.find((U)=>U.id===K);if(!VX(B)||B?.type!=="oauth")return;if(Y.policyStorage.relay?.enabled===!0&&y$(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")return;if(B.source==="vault"){let U=await J.authorizeVault(K,G.signal);return J.getOrCreateAuthLineage(K,U)}let V=await J.authorizeLocal(K,{signal:G.signal});return V.status==="usable"?J.getOrCreateAuthLineage(K,V.subject):void 0},async refreshQuota(K){let Y=await J.read();if(Y.policyStorage.relay?.enabled===!0&&y$(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await J.fetchQuota(K,X.fetch,G.signal),fresh:!0}},sendPrime(K){let Y=P(K);return F.add(Y),Y.finally(()=>F.delete(Y)),Y},async recordSuccess(K){let Y=(await J.read()).accounts.find((B)=>B.id===K);if(!Y?.prime)throw Error("Native Prime counters are unavailable");return Y.prime}});return T.start(),{manager:T,async dispose(){T.stop(),G.abort(),await Promise.allSettled(F)}}}import{createNativeUsagePublisher as HX,effectiveRelayTransport as UX,getClaudeCodeIdentityForVerifiedAccount as b2,getQuotaCheckIntervalMs as BX,getRoutingMode as g$,isQuotaBearingHeaderFrame as KX,mergeHeaderQuotaForPersistence as MX,NativeVaultNoAccountError as zX,nativeAccountCanServe as n2,nativeAccountPolicy as w2,normalizeQuotaHeaders as _X,quotaSnapshotCheckedAt as NX,quotaSnapshotHasStandardWindows as LX,readNativeAccountsForRequest as CX,remapModelId as r2,StickySessionRouter as FX,shouldFallbackStatus as PX,stickyQuotaSnapshotIsFresh as y2,stickyRouteFamilyForModel as TX}from"@cortexkit/anthropic-auth-core";var s2=(X)=>["five_hour","seven_day"].some((J)=>(X?.[J]?.remainingPercent??1)<=0);function h$(X){let{runtime:J}=X,M=HX("native-auth"),G=new Map,F=(Z)=>{let W=Z.routingPath;if(!W)throw Error("Native routing storage is unavailable");let j=G.get(W);if(!j)j=new FX({path:W,vaultSeed:Z.routingSeed,onLockEvent:J.onLockEvent,localRecoveryPath:Z.mode==="local"?Z.routingRecoveryPath:void 0}),G.set(W,j);return j.setVaultSeed(Z.routingSeed),j},C=new WeakMap,P=new Map,T=new Map,K=new Map,Y=new Map,B=new WeakSet,V=!1,U=()=>{while(P.size>512){let Z=P.keys().next();if(!Z.done)P.delete(Z.value)}},O=(Z,W)=>JSON.stringify([Z.sessionID,Z.kind,Z.modelID,W]),q=(Z)=>{if(V)throw Error("Native Anthropic source is closed");let W=K.get(Z.sessionID);if(!W){W=new AbortController,K.set(Z.sessionID,W);while(K.size>512){let j=K.keys().next();if(!j.done)i.forgetSession?.(j.value)}}return W},x=(Z,W,j)=>n2(Z)&&(Z.type==="api"||w2(Z,W,r2(j)).status==="allowed"),m=async(Z,W,j,A)=>{let R=await J.read();A.signal.throwIfAborted(),w(R);let b=R.accounts.find((y)=>y.id===Z);if(!b||b.type!==j||!x(b,R,W))return!1;if(j==="api"){let y=R.accounts.find((d)=>d.id==="main"&&d.type==="oauth");return!!y&&y2(y.quota,R.policyStorage)&&s2(y.quota)}return!0},w=(Z)=>{let W=Z.policyStorage.relay;if(W?.enabled===!0&&UX(W.transport,W.url)==="websocket")throw new F2},o=async(Z,W)=>{if(w(Z),W||Z.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let j=await J.getRelayConfig();if(!j)throw Error("request refused: native HTTP relay configuration is unavailable");if(j.transport!=="http")throw new F2;return{dispatch:{kind:"http-relay",url:j.url,token:j.token},relayFallback:j.fallbackToDirect}};async function r(Z,W,j){if(Z.kind==="local")await J.publishLocal(Z.subject,j);else if(Z.kind==="vault"&&W.receipt)await J.vault.publish(W.receipt,j);else if(Z.kind==="api"&&j.lastUsed!==void 0)await J.publishApi(Z.subject,{lastUsed:j.lastUsed})}let i={async chooseAccount(Z){let W=q(Z);X.onOwnedRequest?.();let j=await J.read();W.signal.throwIfAborted(),w(j);let A=r2(await X.resolveModelId?.(Z)??Z.modelID);if(W.signal.throwIfAborted(),j.mode==="claustrum")j=await CX(J,W.signal),W.signal.throwIfAborted();if(j.policyStorage.quota?.enabled!==!1){let f=!1;for(let c of j.accounts){if(!n2(c)||c.type!=="oauth")continue;if(LX(c.quota)?y2(c.quota,j.policyStorage,Date.now(),A):Date.now()-NX(c.quota)<BX(j.policyStorage))continue;try{await J.fetchQuota(c.id,X.fetch,W.signal,void 0,"admission"),f=!0}catch{W.signal.throwIfAborted()}}if(f)j=await J.read();W.signal.throwIfAborted()}let R=Z.rerouteFrom?P.get(Z.rerouteFrom.limit.reason):void 0;if(Z.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(Z.rerouteFrom.limit.reason)&&!R)return;if(R&&Z.rerouteFrom){let f=j.accounts.find((H)=>H.id===R.accountId);if(!f||!x(f,j,A))return;P.delete(Z.rerouteFrom.limit.reason);let c=O(Z,R.accountId),l=T.get(c)??[];return l.push(R),T.set(c,l),R.accountId}let b=[];for(let f of j.accounts){if(f.type!=="oauth"||!x(f,j,A))continue;if(f.source==="local"){let c=await J.authorizeLocal(f.id,{signal:W.signal,policy:(l,H)=>w2(l,H,A)});if(W.signal.throwIfAborted(),c.status!=="usable")continue}b.push(f)}let y=b.filter((f)=>f.id!==Z.rerouteFrom?.accountId);if(g$(j.policyStorage)==="sticky-balanced"){let f=y.map((l,H)=>({accountId:l.id,order:H,quota:l.quota??{kind:"unknown"}})),c=await F(j).resolve({sessionId:Z.sessionID,family:TX(A),modelId:A,affinityModelId:Z.modelID,candidates:f,retainAccountIds:new Set(y.map((l)=>l.id)),...j.mode==="claustrum"?{accountIdentities:new Map(j.accounts.flatMap((l)=>l.accountIdentity?[[l.id,l.accountIdentity]]:[]))}:{},storage:j.policyStorage,inputBytes:1,preferredAccountId:Z.previousAccountId,preserveOnNoCandidate:!0});if(W.signal.throwIfAborted(),c)return c.accountId}else{let c=g$(j.policyStorage)==="fallback-first"?[...y.filter((l)=>l.id!=="main"),...y.filter((l)=>l.id==="main")]:[...y.filter((l)=>l.id==="main"),...y.filter((l)=>l.id!=="main")];if(c[0])return c[0].id}if(j.mode==="claustrum")throw new zX;let d=j.accounts.find((f)=>f.id==="main"&&f.type==="oauth");if(!d)return;let p=d.quota;if(Z.rerouteFrom?.limit.status===429||!y2(p,j.policyStorage))try{p=await J.fetchQuota("main",X.fetch,W.signal)}catch{return}if(W.signal.throwIfAborted(),!s2(p))return;return j.accounts.find((f)=>f.type==="api"&&n2(f)&&f.id!==Z.rerouteFrom?.accountId)?.id},dropChoice(Z){let W=O(Z,Z.accountId),j=T.get(W);if(j?.shift(),j?.length===0)T.delete(W)},async authorizeAccount(Z,W){let j=q(Z),A=await J.read();j.signal.throwIfAborted(),w(A);let R=r2(await X.resolveModelId?.(Z)??Z.modelID);j.signal.throwIfAborted();let b=A.accounts.find((E)=>E.id===W);if(!b||!x(b,A,R))return;let y=O(Z,W),d=T.get(y),p=d?.shift();if(d?.length===0)T.delete(y);let{dispatch:f,relayFallback:c}=await o(A,p?.direct===!0);if(j.signal.throwIfAborted(),p?.auth){if(!await m(W,R,p.auth.route,j))return;let E=C.get(p.auth.provenance);if(E?.receipt?.expiresAtMs!==void 0&&E.receipt.expiresAtMs!==null&&E.receipt.expiresAtMs<Date.now()+300000)return;if(E)C.set(p.auth.provenance,{...E,scope:{...Z,modelID:R},account:b,active:j,relayFallback:c});return Y.set(Z.sessionID,W),{...p.auth,dispatch:f}}let l={scope:{...Z,modelID:R},active:j,account:b,retry:p?.retry??!1,relayFallback:c,quota:b.quota};if(b.type==="api"){let E=A.accounts.find((n)=>n.id==="main"&&n.type==="oauth");if(!E||!y2(E.quota,A.policyStorage)||!s2(E.quota))return;let S=await J.authorizeApi(W,j.signal);if(j.signal.throwIfAborted(),!await m(W,R,"api",j))return;let D={kind:"api",subject:S.subject};return C.set(D,l),Y.set(Z.sessionID,W),{route:"api",headers:S.authHeader==="authorization-bearer"?{authorization:`Bearer ${S.apiKey}`}:{"x-api-key":S.apiKey},baseURL:S.baseURL,provenance:D,dispatch:f}}if(b.source==="vault"){let E=await J.authorizeVault(W,j.signal);if(j.signal.throwIfAborted(),!await m(W,R,"oauth",j))return;let S={kind:"vault",credentialId:E.credentialId,recordVersion:E.recordVersion};C.set(S,{...l,receipt:E});let D=E.assertedAccountIdentity;if(!D)return;return Y.set(Z.sessionID,W),{route:"oauth",accessToken:E.accessToken,provenance:S,dispatch:f,identity:b2(D,D)}}let H=await J.authorizeLocal(W,{signal:j.signal,policy:(E,S)=>w2(E,S,R)});if(j.signal.throwIfAborted(),H.status!=="usable")return;if(!await m(W,R,"oauth",j))return;let z={kind:"local",subject:H.subject};C.set(z,{...l,access:H.access}),Y.set(Z.sessionID,W);let L=H.subject.binding.identity;return{route:"oauth",accessToken:H.access,provenance:z,dispatch:f,identity:b2(L,L)}},async requestOptions(Z){let W=q(Z),j=await J.read();W.signal.throwIfAborted();let A=j.accounts.find((b)=>b.id===Z.accountId);if(!A||!x(A,j,Z.modelID))throw Error("request refused: native account is ineligible for this model");let R=C.get(Z.provenance);if(R)C.set(Z.provenance,{...R,scope:{...R.scope,modelID:Z.modelID}});return X.requestOptions(Z,j)},async admitRequest(Z){let W=C.get(Z.provenance);if(!W||!await m(Z.accountId,Z.modelID,Z.route,W.active))throw Error("request refused: native account policy changed before dispatch");C.set(Z.provenance,{...W,scope:{...W.scope,modelID:Z.modelID}})},onRequestPrepared:(Z)=>X.onRequestPrepared?.(Z),responseOptions(Z){return X.responseOptions?.({...Z,modelID:C.get(Z.provenance)?.scope.modelID??Z.modelID})},quotaFromHeaders(Z,W){let j=C.get(W.provenance),A=v$(Z);if(A)X.onRequestId?.(W,A);if(!j||W.route!=="oauth"||!KX(Z))return;let R=W.provenance.kind==="local"?W.provenance.subject.binding.identity:j.receipt?.assertedAccountIdentity,b={..._X(Z),...R?{accountIdentity:R}:{}};j.quota=MX(j.quota,b);let y=M.observe(r(W.provenance,j,{quota:j.quota}));return s.set(W.provenance,y),b},async limitFromResponse(Z){let W=C.get(Z.provenance);if(!W)return;if(Z.status===401&&W.receipt){if(!B.has(W.receipt))B.add(W.receipt),await J.vault.reportFailure(W.receipt,401,Z.dispatch==="http-relay"?"relay_status_field":"direct");if(W.retry||W.active.signal.aborted)return;let A=W.active,R=await J.vault.prepareRetry(W.receipt,A.signal);if(A.signal.throwIfAborted(),!R.retry)return;let b=R.receipt,y=b.assertedAccountIdentity;if(!y)return;let d={kind:"vault",credentialId:b.credentialId,recordVersion:b.recordVersion};C.set(d,{...W,receipt:b,retry:!0});let p=`vault-newer:${Z.attemptId}`;return P.set(p,{sessionID:Z.sessionID,accountId:Z.accountId,retry:!0,auth:{route:"oauth",accessToken:b.accessToken,provenance:d,identity:b2(y,y)}}),U(),{reason:p,status:401}}if(Z.status===401&&Z.provenance.kind==="local"&&W.access&&!W.retry){if(W.active.signal.aborted)return;let A=W.active,R=await J.authorizeLocal(Z.accountId,{rejectedAccessToken:W.access,signal:A.signal,policy:(p,f)=>w2(p,f,W.scope.modelID)});if(A.signal.throwIfAborted(),R.status!=="usable"||R.access===W.access)return;let b={kind:"local",subject:R.subject};C.set(b,{...W,access:R.access,retry:!0});let y=R.subject.binding.identity,d=`local-newer:${Z.attemptId}`;return P.set(d,{sessionID:Z.sessionID,accountId:Z.accountId,retry:!0,auth:{route:"oauth",accessToken:R.access,provenance:b,identity:b2(y,y)}}),U(),{reason:d,status:401}}let j=await J.read();if(PX(Z.status,j.policyStorage))return{reason:`provider-${Z.status}`,status:Z.status};return},limitFromRelayFailure(Z){let W=C.get(Z.provenance);if(!W?.relayFallback||W.active.signal.aborted||!(Z.status===401||Z.status>=500))return;let j=`relay-direct:${Z.attemptId}`;return P.set(j,{sessionID:Z.sessionID,accountId:Z.accountId,direct:!0,retry:!1}),U(),{reason:j}},limitFromStreamError(Z){return Z.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(Z,W){let j=C.get(W.provenance);if(W.dispatch==="http-relay"&&j?.relayFallback&&!j.active.signal.aborted&&Z.status===void 0){let A=`relay-direct:${W.attemptId}`;return P.set(A,{sessionID:W.sessionID,accountId:W.accountId,direct:!0,retry:!1}),U(),{reason:A}}return},async onAttemptEnd(Z,W){let j=C.get(Z.provenance);if(!j)return;try{if(await s.get(Z.provenance),W.status===401&&j.receipt&&!B.has(j.receipt))B.add(j.receipt),await J.vault.reportFailure(j.receipt,401,Z.dispatch==="http-relay"?"relay_status_field":"direct");if(!W.localRefusal&&W.status!==void 0)M.publish(()=>r(Z.provenance,j,{lastUsed:Date.now()}))}finally{C.delete(Z.provenance),s.delete(Z.provenance)}},forgetSession(Z){K.get(Z)?.abort(),K.delete(Z),Y.delete(Z);for(let[W,j]of P)if(j.sessionID===Z)P.delete(W);for(let[W,j]of T)if(j[0]?.sessionID===Z)T.delete(W);X.onForgetSession?.(Z)},servedAccount:(Z)=>Y.get(Z),resetRouting:async(Z)=>F(await J.read()).clear(Z),async recordPrime(Z,W){let j=C.get(Z);if(!j||j.active.signal.aborted)return!1;if(Z.kind==="local")return J.incrementPrimeUsage(j.account.id,Z.subject,W);if(Z.kind==="vault"&&j.receipt)return J.incrementPrimeUsage(j.account.id,j.receipt,W);return!1},drainRoutingPublications:()=>Promise.all([J.drainRoutingPublications(),...[...G.values()].map((Z)=>Z.drain())]).then(()=>{}),close(){V=!0;for(let Z of K.values())Z.abort();return K.clear(),T.clear(),P.clear(),Promise.all([M.drain(),i.drainRoutingPublications()]).then(()=>{})}},s=new WeakMap;return i}import{remapModelId as OX}from"@cortexkit/anthropic-auth-core";function d$(){let X=new m$,J=new Map,M=new Map,G=new Map,F=new Set,C=new Set,P=new Map,T=(K)=>{while(K.size>512){let Y=K.keys().next();if(!Y.done)K.delete(Y.value)}};return{async install(K){let Y=[];try{Y.push(await K.session.hook("context",(B)=>{let V=B.messages.map((O)=>{return{info:{id:O.id,sessionID:B.sessionID,role:O.role,agent:B.agent,model:{providerID:B.model.providerID,modelID:B.model.id}},parts:O.content.map((q)=>({type:q.type,...q.type==="text"?{text:q.text}:{}}))}});X.observeMessages(V);let U=B.messages.findLast((O)=>O.role==="user"&&O.id);if(U?.id)J.set(B.sessionID,U.id);if(U?.content.some((O)=>O.type==="text"&&O.text===D2))F.add(B.sessionID);else F.delete(B.sessionID);T(J)},{providerID:"anthropic"})),Y.push(await K.session.hook("model.request",(B)=>{if(B.kind!=="primary")return;let V=J.get(B.sessionID);if(!V)return;if(X.markHeaders({sessionId:B.sessionID,messageId:V,agent:B.agent,headers:B.headers}),F.has(B.sessionID))B.headers[R2]="1"},{providerID:"anthropic"}))}catch(B){throw await Promise.allSettled(Y.map((V)=>V.dispose())),B}return{dispose:async()=>{await Promise.all(Y.map((B)=>B.dispose()))}}},requestOptions(K,Y){let B=X.resolveHeader(K.correlation[k2]);if(B)M.set(K.attemptId,B),T(M);P.set(K.attemptId,K.sessionID),T(P);let V=K.correlation[R2]==="1";if(V)C.add(K.attemptId);return{cache1hEnabled:K.agent!=="compaction"&&K.agent!=="title"&&(Y.policyStorage.claudeCache?.enabled??!0),cache1hMode:Y.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:Y.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:Y.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,turnEndNoteEnabled:!0,turnEndNote:Y.policyStorage.turnEndNote,serverSideFallbackEnabled:l$(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:V,billingLineage:B?{promptId:B.promptId,previousRequestId:B.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:G.get(K.sessionID)}},responseOptions(K){return{serverSideFallbackModel:OX(K.modelID),laneStart:C.has(K.attemptId),onMessageStart(Y){if(K.kind==="primary"&&typeof Y.id==="string")G.set(K.sessionID,Y.id),T(G)},onStreamEnd(){M.delete(K.attemptId),C.delete(K.attemptId),P.delete(K.attemptId)}}},onRequestId(K,Y){X.commit(M.get(K.attemptId),Y)},forgetSession(K){X.clearSession(K),J.delete(K),G.delete(K),F.delete(K);for(let[Y,B]of P)if(B===K)M.delete(Y),C.delete(Y),P.delete(Y)}}}var I2="cortexkit-anthropic-auth",DX='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',bX="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",wX="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function yX(X){let J=X.authorize??SX,M=X.exchange??AX,G=()=>{if(!X.isActive())throw Error("Claude authentication setup is closed")},F=async()=>{let T;try{T=await X.readMode()}catch{throw Error(wX)}return G(),T},C=async()=>{if(await F()!=="local")throw Error(DX)};return{integrationID:"anthropic",methods:[{method:{id:u$,type:"oauth",label:i$},async authorize(){G(),await C();let T=await J("max");return G(),{mode:"code",url:T.url,instructions:"Paste the authorization code returned by Claude.",callback:async(K)=>{G();let Y=await M(K,T.verifier,T.redirectUri,T.state);if(!X.isActive()||Y.type!=="success")throw Error("Claude sign-in did not complete");return{access:Y.access,refresh:Y.refresh,expires:Y.expires}}}}}],vault:{method:{id:c$,type:"oauth",label:"Claude vault accounts"},async activate(){if(G(),await F()!=="claustrum")throw Error(bX)}},async onLogin(T){G(),await C(),await X.runtime.loginOAuth({routeId:"main",credential:T,replace:!0}),G()},label:"Claude native account pool"}}function IX(X){return{readMode:()=>qX("opencode",X),disconnectVault:()=>xX({host:"opencode",env:X})}}function a2(X={}){return{id:I2,setup:(J)=>n$(J,X)}}async function n$(X,J={}){let M=J.paths??await kX(),G=EX({paths:M,host:"opencode",local:J.local,vault:J.vault}),F=IX(J.vault?.env??process.env),C=!0,P=d$(),T=D$(),K,Y,B,V=h$({runtime:G,paths:M,fetch:J.fetch,requestOptions:P.requestOptions,responseOptions:P.responseOptions,onRequestId:P.onRequestId,onForgetSession:P.forgetSession,onRequestPrepared:async(w)=>{try{await B?.track(w)}catch{p$.warn("cachekeep","live request tracking failed")}},resolveModelId:async(w)=>T.modelId(w.modelID),onOwnedRequest:()=>{K??=E$(G,J.fetch),Y??=f$({runtime:G,paths:M,source:V,fetch:J.fetch})}});B=P$({...J.cacheKeep,runtime:G,source:V,fetch:J.fetch,isSubagent:async(w)=>Boolean((await X.session.get({sessionID:w})).parentID)});let U=k$({runtime:G,source:V,cacheKeepRegistry:B.registry,start:async(w,o)=>{await X.session.synthetic({sessionID:w,text:o,description:"Claude lane start",resume:!0})}}),O=[],q=await T$(X,{source:V,log:{warn:(w,o)=>p$.warn("opencode2",w,o)}},{credential:b$}).catch(async(w)=>{throw U.close(),await B?.dispose(),await V.close(),await G.drainQuotaPublications(),G.close(),w}),x,m=()=>{if(x)return x;return C=!1,U.close(),V.close(),x=(async()=>{await Promise.allSettled([q.dispose(),K?.dispose(),Y?.dispose(),B?.dispose(),...O.map((w)=>w.dispose())]),await V.close(),await G.drainQuotaPublications(),G.close()})(),x};try{O.push(await P.install(X)),O.push(await T.install(X)),O.push(await h2(X,yX({isActive:()=>C,readMode:F.readMode,runtime:G})));let w={host:"opencode",dispatch:U.dispatch,readStatus:(r)=>U.readStatus(r),readAccounts:()=>G.read(),readMode:F.readMode,disconnectVault:F.disconnectVault,interactive:!0},o=RX(w);return O.push(await o$(X,o,U)),m}catch(w){throw await m(),w}}var aJ={id:I2,setup:a2().setup,server:r$};export{n$ as setupAnthropicAuth,aJ as default,a2 as createAnthropicAuthPlugin,I2 as ANTHROPIC_AUTH_PLUGIN_ID};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/opencode-anthropic-auth",
-  "version": "2.2.3",
+  "version": "2.2.5",
   "type": "module",
   "repository": {
     "type": "git",
@@ -77,7 +77,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.6.0",
-    "@cortexkit/anthropic-auth-core": "2.2.3",
+    "@cortexkit/anthropic-auth-core": "2.2.5",
     "@cortexkit/claustrum-client": "0.12.0",
     "@cortexkit/private-files": "0.2.1",
     "@cortexkit/subc-client": "^0.22.0",