npm - @cortexkit/opencode-anthropic-auth - Versions diffs - 2.2.4 → 2.2.6 - Mend

@cortexkit/opencode-anthropic-auth 2.2.4 → 2.2.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/dist/cli.js +41 -41
package/dist/{index-79frmfve.js → index-0tb7qc58.js} +1 -1
package/dist/index.js +1 -1
package/dist/v2/adapter.d.ts +5 -1
package/dist/v2/server.js +4 -4
package/package.json +2 -2

package/dist/v2/server.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import{a as O2,b as q$,c as D$,d as e2,e as $$,f as E2,g as L2,h as X$,i as J$,j as b$,k as Z$,l as Y$,m as W$,n as G$,o as j$,p as m$}from"../index-79frmfve.js";import"../index-6chd6jnr.js";import"../index-hazrk5c3.js";import{u as v$}from"../index-jvhs8sxv.js";import{v as I$,w as f$,y as g$}from"../index-0kxy8k2c.js";import"../index-b1dvkp15.js";import"../index-20d6rmjj.js";import"../index-ppdrzs41.js";import"../index-62x1p34p.js";import{acquireNativeAccountRuntime as zX,authorize as _X,createNativeUi as CX,disconnectNativeVaultForHost as NX,exchange as LX,logger as y$,readNativeEnrollmentMode as PX,resolveNativePoolPaths as FX}from"@cortexkit/anthropic-auth-core";class _2 extends Error{kind;providerID;sessionID;requestKind;constructor($){super($.message??`${$.providerID} ${$.requestKind} request refused (${$.kind})`);this.name="OpenCode2AuthError",this.kind=$.kind,this.providerID=$.providerID,this.sessionID=$.sessionID,this.requestKind=$.requestKind}}function Q2($){return`common-auth-placeholder.${$}`}function i2($){let X=Q2($.integrationID);return{type:"oauth",methodID:$.methodID,access:X,refresh:X,expires:$.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function q2($,X){if($?.type!=="oauth")return!1;let M=X===void 0?void 0:Q2(X),W=(L)=>M===void 0?L.startsWith("common-auth-placeholder."):L===M;return W($.access)&&W($.refresh)}var c2="No browser sign-in: this connects the plugin to the accounts in its vault.";async function k2($,X){let M=X.now??Date.now,{integrationID:W}=X,L=(T)=>i2({integrationID:W,methodID:T,now:M()}),N=async(T,K)=>{return await X.onLogin(T,{integrationID:W,methodID:K}),L(K)},P=(T)=>async(K)=>{let Y=T.method.id,B=await T.authorize(K),V={url:B.url,instructions:B.instructions,...B.expiresAt===void 0?{}:{expiresAt:B.expiresAt}};if(B.mode==="auto")return{...V,mode:"auto",callback:B.callback.then((O)=>N(O,Y))};let U=B.callback;return{...V,mode:"code",callback:async(O)=>N(await U(O),Y)}};return $.integration.transform((T)=>{let K=X.label===void 0?{}:{label:()=>X.label};for(let V of X.methods)T.method.update({integrationID:W,method:V.method,authorize:P(V),refresh:async(U)=>{if(!q2(U,W))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return L(U.methodID)},...K});let Y=X.vault;if(Y===void 0)return;let B=Y.method.id;T.method.update({integrationID:W,method:Y.method,authorize:async()=>({url:"",instructions:Y.instructions??c2,mode:"auto",callback:Promise.resolve().then(()=>Y.activate({integrationID:W,methodID:B})).then(()=>L(B))}),refresh:async(V)=>{if(!q2(V,W)||V.methodID!==B)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return L(B)},...K})})}function l$($){let X=[],M;for(let W of $.split(/\r?\n/))if(W.startsWith("data:"))X.push(W.slice(5).replace(/^ /,""));else if(W.startsWith("event:"))M=W.slice(6).trim();if(X.length===0)return;return M===void 0?{data:X.join(`
-`)}:{event:M,data:X.join(`
-`)}}function D2($,X){let M=new TextDecoder,W="",L=(P)=>{let T=l$(P);if(!T)return;try{$(T)}catch(K){X(K)}},N=()=>{for(;;){let P=/\r?\n\r?\n/.exec(W);if(!P)return;let T=W.slice(0,P.index);W=W.slice(P.index+P[0].length),L(T)}};return new TransformStream({transform(P,T){T.enqueue(P),W+=M.decode(P,{stream:!0}),N()},flush(){if(W+=M.decode(),N(),W.trim()!=="")L(W);W=""}})}var o2=512,B2="x-common-auth-attempt",H2=($,X)=>JSON.stringify([$,X]),G2=($)=>({providerID:$.model.providerID,modelID:$.model.id,sessionID:$.sessionID,agent:$.agent,kind:$.kind});function d$($){let X=$.headers;return typeof X==="object"&&X!==null}function p$($,X){let M=$.getReader();return new ReadableStream({async pull(W){let L;try{L=await M.read()}catch(N){X({reason:"failed",message:N instanceof Error?N.message:String(N)}),W.error(N);return}if(L.done)X(),W.close();else W.enqueue(L.value)},async cancel(W){X({reason:"cancelled",...W===void 0?{}:{message:String(W)}}),await M.cancel(W)}})}function b2($,X){for(let[M,W]of Object.entries(X)){let L=M.toLowerCase();for(let N of Object.keys($))if(N.toLowerCase()===L)delete $[N];if(W!==null)$[M]=W}}function u$($,X){for(let[M,W]of Object.entries(X))if(W===null)$.delete(M);else $.set(M,W)}async function w2($,X,M={}){let{providerID:W}=X,L=M.gateOnPlaceholder,N=(J)=>L===void 0||L.credential(J)===Q2(W),P=M.logger,T=Math.max(1,M.maxRecords??o2),K=[...M.hostCredentials??[Q2(W)],...L?[Q2(W)]:[]].filter((J)=>J!==""),Y=new Map,B=new WeakMap,V=new Map,U=new Set,O=new Map,q=!1,R=!1,m=new Map,b=0,i=!1,n=new Map,c=(J,Q)=>{try{P?.warn(J,Q)}catch{}},a=(J)=>J instanceof Error?J.message:String(J),Z=async(J,Q)=>{let C=m.get(J);if(!C||C.size===0)return;await Promise.all([...C].map(async(F)=>{try{await F(Q)}catch(I){c("opencode2 auth listener threw; the request is unaffected",{event:J,error:a(I)})}}))},j=async(J,Q)=>{try{await X.onAttemptEnd?.(J,Q)}catch(C){c("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:J.attemptId,error:a(C)})}},G=(J,Q)=>{if(J.ended||!J.attempt)return;let C={...J.status===void 0?{}:{status:J.status},outputStarted:J.outputStarted,...J.limit?{limit:J.limit.signal}:{},...Q?{error:Q}:{}};if(Q)J.endError=Q;J.ended=j(J.attempt,C)},A=(J,Q)=>G(J,{reason:"abandoned",message:Q}),E=(J)=>[...Y.values()].filter((Q)=>Q.key===J),w=(J)=>E(J).at(-1),y=(J)=>{if(Y.delete(J.id),!E(J.key).length)V.delete(J.key)},s=(J)=>{Y.set(J.id,J);while(Y.size>T){let Q=Y.values().next().value;if(Q===void 0)break;A(Q,"dropped to keep the record bound"),y(Q)}},p=(J)=>J.accountId===void 0?void 0:{...J.scope,accountId:J.accountId},h=(J,Q)=>new _2({kind:"no-account",providerID:W,sessionID:J.sessionID,requestKind:J.kind,...Q===void 0?{}:{message:Q}}),o=(J)=>{n.get(J)?.clear(),n.delete(J)},l=async(J,Q)=>{let C=()=>h(J,`${W} ${J.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(i)throw C();let F=n.get(J.sessionID);if(!F)F=new Set,n.set(J.sessionID,F);let I={};F.add(I);let v=()=>{if(!F.has(I))throw C()};try{return await Q(v)}finally{if(F.delete(I),F.size===0&&n.get(J.sessionID)===F)n.delete(J.sessionID)}},H=(J,Q)=>{for(let[C,F]of Q)if(K.some((I)=>F.includes(I)))throw new _2({kind:"host-credential-on-wire",providerID:W,sessionID:J.sessionID,requestKind:J.kind,message:`${W} ${J.kind} request still carries the host's placeholder credential in ${C}; the adapter's account headers must replace it`})},z=(J)=>{for(let Q of E(J))if(Q.ended||!Q.attempt)y(Q);else if(Q.transport==="ws"||Q.judged)A(Q,"a newer attempt of its session and kind began"),y(Q)},_=async(J,Q,C,F)=>{let I=H2(J.sessionID,J.kind),v=V.get(I);V.delete(I);let D=v?.accountId??w(I)?.accountId;z(I);let g={...J,...D===void 0?{}:{previousAccountId:D},...v?.rerouteFrom===void 0?{}:{rerouteFrom:v.rerouteFrom}},u=await X.chooseAccount(g);C();let W2={},p2;if(u!==void 0){let F2=await X.accountHeaders({...J,accountId:u});if(C(),d$(F2))W2=F2.headers,p2=F2.attempt;else W2=F2}let u2=`attempt-${++b}`,z2={id:u2,key:I,scope:J,accountId:u,headers:W2,attempt:u===void 0?void 0:{...J,accountId:u,attemptId:u2,transport:F,data:p2},...F===void 0?{}:{transport:F},outputStarted:!1};if(s(z2),z2.attempt)Z("select",{...J,accountId:z2.attempt.accountId,hook:Q,...g.previousAccountId===void 0?{}:{previousAccountId:g.previousAccountId},...g.rerouteFrom===void 0?{}:{rerouteFrom:g.rerouteFrom},handle:z2.attempt});return z2},S=async(J,Q,C,F,I)=>{let v=H2(J.sessionID,J.kind),D=F===void 0?void 0:Y.get(F);if(D?.key!==v)D=void 0;if(!D){if(D=w(v),E(v).filter((u)=>u.transport===void 0&&!u.ended).length>1&&!R)R=!0,c("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:J.sessionID,kind:J.kind})}if(!D||D.transport!==void 0||D.ended)D=await _(J,Q,I,C);else if(D.transport=C,D.attempt)D.attempt.transport=C;if(C==="ws"){for(let g of E(v))if(g!==D&&g.transport==="ws")A(g,"a newer attempt of its session and kind went out over WebSocket")}return D},x=async(J,Q)=>{try{return await Q()}catch(C){throw G(J,{reason:"failed",message:a(C)}),C}},k=(J,Q)=>{let C=E(H2(J,Q)).filter((F)=>F.transport==="ws").at(-1);return C?.attempt!==void 0&&!C.ended?C:void 0},f=(J,Q,C)=>{let F=p(J);if(!F||!J.attempt||J.limit)return;J.limit={signal:Q,delivered:Z("limit",{...F,via:C,limit:Q,outputStarted:J.outputStarted,handle:J.attempt})}},r=(J,Q,C,F)=>{let I=p(J);if(!I||!J.attempt)return;Z("quota",{...I,transport:Q,...F===void 0?{}:{status:F},quota:C,handle:J.attempt})},d=(J,Q,C,F)=>{let I=J.attempt;if(!I)return;let v=X.inspectEvent?.(F===void 0?{transport:Q,data:C,attempt:I}:{transport:Q,data:C,event:F,attempt:I});if(!v)return;if(v.quota!==void 0)r(J,Q,v.quota);if(v.outputStarted)J.outputStarted=!0;if(v.limit)f(J,v.limit,Q);if(v.error!==void 0)G(J,{reason:"failed",message:v.error});else if(v.done)G(J)},X2=(J,Q)=>{let C=J.attempt;if(!C||Q.accountId===J.accountId)return;if(C.reboundFrom??=C.accountId,C.accountId=Q.accountId,"data"in Q)C.data=Q.data;J.accountId=Q.accountId},J2=(J)=>!J.attempt||J.endError!==void 0||J.status!==void 0&&J.status>=400,Z2=(J)=>{let Q=[...Y.values()].filter((g)=>g.scope.sessionID===J),C=Q.filter((g)=>g.limit&&!g.rerouted).at(-1);if(C)return C;let F=Q.filter((g)=>g.scope.kind==="primary"),I=F.length>0?F:Q;if(I.length<=1)return I[0];let v=I.filter((g)=>!g.judged&&J2(g)).at(-1);if(v)return v;let D=I.filter((g)=>g.attempt&&!g.ended);if(D.length>1)return"ambiguous";return D[0]??I.at(-1)},$2={providerID:W},t=[];t.push(await $.session.hook("model.request",(J)=>{if(L)return;return l(G2(J),async(Q)=>{let C=await _(G2(J),"model.request",Q);if(Q(),C.accountId===void 0)throw h(C.scope);b2(J.headers,{...C.headers,[B2]:C.id})})},$2)),t.push(await $.session.hook("http.request",(J)=>{if(L){let Q=N(J.request.headers);if(O.set(J.sessionID,Q),!Q)return}return l(G2(J),async(Q)=>{let C=J.request.headers.get(B2)??void 0,F=L?await _(G2(J),"http.request",Q,"http"):await S(G2(J),"http.request","http",C,Q);Q();let I=p(F),v=F.attempt;if(!I||!v)throw h(F.scope);await x(F,async()=>{let D=J.request;if(X.rewriteRequest){if(C!==void 0){let W2=new Headers(D.headers);W2.delete(B2),D=new Request(D,{headers:W2})}D=await X.rewriteRequest({...I,request:D,attempt:v})??D,Q()}let g=new Headers(D.headers);g.delete(B2),u$(g,F.headers),H(F.scope,g.entries());let u=new Request(D,{headers:g});B.set(u,F),J.request=u})})},$2)),t.push(await $.session.hook("http.response",async(J)=>{let Q=B.get(J.request);if(!Q){if(L)return;if(!q)q=!0,c("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:J.sessionID,kind:J.kind});return}let C=J.response;if(X.answeredBy&&Q.attempt){let g=Q.attempt,u=await x(Q,async()=>X.answeredBy?.({request:J.request,response:C,attempt:g}));if(u)X2(Q,u)}let F=p(Q),I=Q.attempt;if(!F||!I)return;Q.status=C.status;let v=X.quotaFromHeaders?.(C.headers,C.status,I);if(v!==void 0)r(Q,"http",v,C.status);if(!C.ok&&X.limitFromResponse){let g=await X.limitFromResponse({status:C.status,headers:C.headers,body:()=>C.clone().text(),attempt:I});if(g)f(Q,g,"http")}if(!C.ok||!C.body)G(Q);let D=C;if(C.body&&(X.inspectEvent||X.onAttemptEnd)){let g=C.body;if(X.inspectEvent)g=g.pipeThrough(D2((u)=>d(Q,"http",u.data,u.event),(u)=>c("opencode2 auth event inspection threw",{error:a(u)})));D=new Response(p$(g,(u)=>G(Q,u)),{status:C.status,statusText:C.statusText,headers:C.headers})}if(X.rewriteResponse)D=await X.rewriteResponse({...F,request:J.request,response:D,attempt:I})??D;if(D!==C)J.response=D},$2)),t.push(await $.session.hook("experimental.ws.handshake",(J)=>{if(L){let Q=N(new Headers(J.headers)),C=H2(J.sessionID,J.kind);if(O.set(J.sessionID,Q),U.delete(C),!Q)return}return l(G2(J),async(Q)=>{let C;for(let D of Object.keys(J.headers)){if(D.toLowerCase()!==B2)continue;C??=J.headers[D],delete J.headers[D]}let F=L?await _(G2(J),"experimental.ws.handshake",Q,"ws"):await S(G2(J),"experimental.ws.handshake","ws",C,Q);Q();let I=p(F),v=F.attempt;if(!I||!v)throw h(F.scope);await x(F,async()=>{b2(J.headers,F.headers);let D=X.rewriteHandshakeURL?.({...I,url:J.url,attempt:v});if(D!==void 0)J.url=D;if(H(F.scope,Object.entries(J.headers)),L)U.add(F.key)})})},$2));let e=X.rewriteWebSocketFrame?.bind(X);if(e)t.push(await $.session.hook("experimental.ws.send",async(J)=>{let Q=G2(J);if(L&&!U.has(H2(Q.sessionID,Q.kind)))return;let C=k(Q.sessionID,Q.kind),F=await e({...Q,attempt:C?.attempt,frame:J.frame});if(F!==void 0)J.frame=F},$2));t.push(await $.session.hook("experimental.ws.receive",(J)=>{if(L&&!U.has(H2(J.sessionID,J.kind)))return;let Q=k(J.sessionID,J.kind);if(!Q)return;try{d(Q,"ws",J.frame)}catch(C){c("opencode2 auth frame inspection threw",{error:a(C)})}},$2)),t.push(await $.session.hook("retry",async(J)=>{if(L&&O.get(J.sessionID)!==!0)return;let Q=Z2(J.sessionID);if(!Q)return;let C=J.decision;if(Q==="ambiguous"){await Z("retry",{sessionID:J.sessionID,attempt:J.attempt,reason:"host-decides",hostDecision:C,decision:C});return}let F=Q;await l(F.scope,async(I)=>{F.judged=!0;let v=C,D,g,u=F.attempt;if(F.accountId===void 0||!u)v={retry:!1},D="no-account";else if(F.outputStarted)v={retry:!1},D="output-started";else{if(!F.limit){let W2=X.limitFromError?.(J.error,u);if(W2)f(F,W2,"error")}if(F.ended)await F.ended,I();if(F.limit)await F.limit.delivered,I(),F.rerouted=!0,g={accountId:F.accountId,limit:F.limit.signal},v={retry:!0,delay:0},D="reroute";else D="host-decides"}if(J.decision=v,v.retry&&F.accountId!==void 0)V.set(F.key,{sessionID:F.scope.sessionID,accountId:F.accountId,...g===void 0?{}:{rerouteFrom:g}});await Z("retry",{sessionID:J.sessionID,...F.accountId===void 0?{}:{accountId:F.accountId},kind:F.scope.kind,attempt:J.attempt,reason:D,hostDecision:C,decision:v,...u===void 0?{}:{handle:u}})})},$2));let j2=(J)=>{o(J),O.delete(J);for(let Q of U)if(JSON.parse(Q)[0]===J)U.delete(Q);for(let Q of[...Y.values()]){if(Q.scope.sessionID!==J)continue;A(Q,"its session was forgotten"),Y.delete(Q.id)}for(let[Q,C]of V)if(C.sessionID===J)V.delete(Q)},Y2=new AbortController,V2=$.event;if(V2)(async()=>{try{for await(let J of V2.subscribe({signal:Y2.signal}))if(J.type==="session.deleted")j2(J.data.sessionID)}catch(J){if(!Y2.signal.aborted)c("opencode2 auth stopped listening for session deletion",{error:a(J)})}})();return{on(J,Q){let C=m.get(J);if(!C)C=new Set,m.set(J,C);let F=Q;return C.add(F),()=>{C.delete(F)}},accountFor(J,Q){return w(H2(J,Q))?.accountId},forgetSession:j2,get size(){return Y.size},async dispose(){if(i)return;i=!0;for(let J of n.keys())o(J);Y2.abort();for(let J of Y.values())A(J,"the installation was disposed");Y.clear(),V.clear(),U.clear(),O.clear(),m.clear(),await Promise.all(t.map(async(J)=>{try{await J.dispose()}catch(Q){c("opencode2 auth hook did not dispose cleanly",{error:a(Q)})}}))}}}import{CacheKeepManager as _1,CacheKeepSessionRegistry as C1,getDefaultCacheKeepRegistryDirectory as N1,isCacheKeepActiveNow as U$,isCacheKeepHybridActive as f2,isCacheKeepSubagentsEnabled as g2,logger as L1}from"@cortexkit/anthropic-auth-core";import{createHash as i$}from"node:crypto";import{applyCustomHeaders as c$,assertNotCustodyTombstone as o$,classifyGzipRejection as n$,createProviderErrorRedactor as n2,createProviderErrorResponseScope as r2,decideRequestGzip as r$,encodeGzipRequestBody as s$,getAccountStoragePath as a$,getRequestGzipLatch as t$,getRequestGzipLatchPath as e$,mergeAnthropicBetas as $1,remapModelId as s2,remapRequestBodyModel as X1,stripEmptyTrailingAssistantMessages as J1,TrailingAssistantHistoryError as Z1}from"@cortexkit/anthropic-auth-core";var N2="anthropic",V$="x-common-auth-attempt",Y1=["x-session-affinity","x-opencode-session","x-parent-session-id",e2,O2,L2,V$],T2=new Set(["authorization","x-api-key"]),W1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",G1=512,j1=5000,V1=500,a2=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class Q$ extends Error{sessionID;requestKind;kind="no-account";providerID=N2;constructor($,X){super(W1);this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicNoAccountError"}}class I2 extends Error{sessionID;requestKind;kind="session-forgotten";providerID=N2;constructor($,X){super("request refused: its session was closed while it was being prepared");this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicRevokedError"}}class K2 extends Error{kind="unsupported-transport";providerID=N2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class H$ extends Error{kind="local-invalid-request";status=400;check;constructor($){super($.message,{cause:$});this.name="NativeAnthropicLocalRefusal",this.check=$.check}}var U2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($);function C2($){try{return JSON.parse($)}catch{return}}function y2($){let X={};for(let[M,W]of Object.entries($??{}))X[M.toLowerCase()]=W;return X}function t2($){let X={};for(let M of Y1){let W=$.get(M);if(W!==null&&M!==V$)X[M]=W;$.delete(M)}return X}function Q1($){try{return new URL($).pathname.endsWith("/messages")}catch{return!1}}function H1($){return $ instanceof Z1||$ instanceof $$?new H$($):void 0}function U1($,X){let M=[];if($.oauth)M.push($.oauth.accessToken);for(let[W,L]of Object.entries($.apiHeaders??{})){if(L===null||!T2.has(W))continue;M.push(L.replace(/^Bearer\s+/i,""))}for(let W of T2){let L=X.get(W);if(L!==null)M.push(L.replace(/^Bearer\s+/i,""))}if($.dispatch?.kind==="http-relay")M.push($.dispatch.token);return[...new Set(M.filter(Boolean))]}var B1=new Set(["oauth-2025-04-20","claude-code-20250219",J$]);function K1($){let X=$.split(",").map((M)=>M.trim()).filter((M)=>M&&!B1.has(M));return $1(null,X)}function M1($){let X=C2($);if(!U2(X))return $;let M=J1(X.messages),W=Object.hasOwn(X,"fallbacks"),{droppedMarkers:L}=Z$(X,!1),N=W&&!Object.hasOwn(X,"fallbacks"),P=X1(X);return M>0||L>0||N||P?JSON.stringify(X):$}async function z1($,X){if(!($ instanceof Promise))return"settled";let M;try{return await Promise.race([$.then(()=>"settled"),new Promise((W)=>{M=setTimeout(()=>W("timed-out"),X)})])}finally{if(M!==void 0)clearTimeout(M)}}function M2($){let{source:X,log:M}=$,W=Math.max(1,$.maxPendingSends??G1),L=$.attemptEndTimeoutMs??j1,N=$.requestGzipLatch??t$(e$(a$())),P=new WeakSet,T=new Map,K=new WeakMap,Y=new WeakMap,B=new WeakMap,V=new Map,U=new WeakMap,O=n2([]);O.dispose();let q=(H)=>(H&&V.get(H)?.redactor)??O,R=(H)=>{let z=V.get(H);if(!z)return;V.delete(H),z.redactor.dispose(),z.scope.dispose()},m=(H,z,_,S)=>{let x=U1(z,S),k=r2(x,_);b.set(H,_),V.set(H,{sessionID:z.sessionID,redactor:n2(x),scope:k}),k.settled.then(()=>R(H));while(V.size>W){let f=V.keys().next().value;if(f===void 0)break;R(f)}},b=new WeakMap,i=(H,z)=>{let _=H?b.get(H):void 0;if(!_||!z.ok)return O.redactResponse(z);let S=r2([],_),x=S.redactResponse(z);return S.dispose(),x},n=(H,z)=>{let _=H?V.get(H)?.scope:void 0;if(!_)return i(H,z);try{return _.redactResponse(z)}catch{return i(H,z)}},c=!1,a=new WeakMap,Z=(H,z)=>{if(H&&!z.ok)a.set(z.headers,H);return z},j=(H,z)=>{if(z.dispatch!=="http-relay")return!0;let _=/^req_[A-Za-z0-9_-]+$/.test(H.get("request-id")??"");return Y.set(z,_),_},G=(H)=>new Q$(H.sessionID,H.kind),A=new Map,E=async(H,z)=>{if(c)throw new I2(H.sessionID,H.kind);let _={revoked:!1},S=A.get(H.sessionID);if(!S)S=new Set,A.set(H.sessionID,S);S.add(_);let x=()=>{if(c||_.revoked)throw new I2(H.sessionID,H.kind)};try{let k=await z(x);return x(),k}finally{let k=A.get(H.sessionID);if(k?.delete(_)&&k.size===0)A.delete(H.sessionID)}},w=(H,z)=>{T.set(H,z);while(T.size>W){let _=T.keys().next().value;if(_===void 0)break;T.delete(_),M?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:W})}},y=(H,z)=>({providerID:H.providerID,modelID:H.modelID,sessionID:H.sessionID,agent:H.agent,kind:H.kind,accountId:H.accountId,attemptId:H.attemptId,transport:H.transport,route:z.route,provenance:z.provenance,dispatch:z.dispatch}),s=(H)=>E(H,async(z)=>{let{accountId:_,...S}=H,x=await X.authorizeAccount(S,_);return z(),p(S,x)}),p=(H,z)=>{if(!z)throw G(H);if(z.dispatch?.kind==="websocket-relay")throw new K2;let _=z.dispatch?.kind==="http-relay"?"http-relay":"direct",S=z.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":z.dispatch.token}:void 0;if(z.route==="oauth"){if(!z.accessToken)throw G(H);o$(z.accessToken,N2);let f=Object.freeze({route:"oauth",provenance:z.provenance,dispatch:_});w(f,{sessionID:H.sessionID,oauth:{accessToken:z.accessToken,...z.identity?{identity:z.identity}:{}},dispatch:z.dispatch,oauthHeaders:z.headers});let r=y2(z.headers);for(let d of T2)delete r[d];return delete r["anthropic-beta"],{headers:S??{...r,"x-api-key":null,authorization:`Bearer ${z.accessToken}`},attempt:f}}let x={authorization:null,"x-api-key":null,...y2(z.headers)};if(!x.authorization&&!x["x-api-key"])throw G(H);let k=Object.freeze({route:"api",provenance:z.provenance,dispatch:_});return w(k,{sessionID:H.sessionID,...z.baseURL?{baseURL:z.baseURL}:{},dispatch:z.dispatch,apiHeaders:x}),{headers:S??x,attempt:k}},h=(H)=>E(H,(z)=>o(H,z)),o=async(H,z)=>{let{request:_,attempt:S}=H,x=S.data,k=x?T.get(x):void 0;if(x)T.delete(x);if(!x||!k||x.route==="oauth"&&!k.oauth)throw G(H);let f=new Headers(_.headers);c$(f);let r=t2(f),d=_.body===null?void 0:await _.text();z();let X2=d!==void 0&&Q1(_.url);try{if(x.route==="oauth"&&k.oauth){let{accessToken:t,identity:e}=k.oauth;for(let[Y2,V2]of Object.entries(y2(k.oauthHeaders))){if(T2.has(Y2))continue;if(V2===null)f.delete(Y2);else f.set(Y2,V2)}let j2=null;if(d!==void 0&&X2){let Y2={...y(S,x),modelID:(()=>{let Q=C2(d);return s2(U2(Q)&&typeof Q.model==="string"?Q.model:H.modelID)})(),route:"oauth",correlation:r},V2=await X.requestOptions?.(Y2)??{};z(),d=await G$(d,{...V2,...e?{identity:e}:{},sessionId:H.sessionID,onToolNameMap:(Q)=>B.set(x,Q)});let J=C2(d);j2=U2(J)?J:null}Y$(f,t,{body:j2,...e?{identity:e}:{},requestClass:X$(S.agent)?"auxiliary":"main"})}else{if(d!==void 0&&X2)d=M1(d);f.delete("authorization"),f.delete("x-api-key");for(let[e,j2]of Object.entries(k.apiHeaders??{}))if(j2===null)f.delete(e);else f.set(e,j2);if(d!==void 0&&X2&&!f.has("content-type"))f.set("content-type","application/json");let t=f.get("anthropic-beta");if(t!==null){let e=K1(t);if(e)f.set("anthropic-beta",e);else f.delete("anthropic-beta")}}}catch(t){let e=H1(t);if(!e)throw t;throw K.set(x,e.check),M?.warn("refused an Anthropic request locally; nothing was sent",{check:e.check}),e}let J2=d!==void 0?C2(d):void 0;if(await X.admitRequest?.({...y(S,x),modelID:s2(U2(J2)&&typeof J2.model==="string"?J2.model:H.modelID)}),t2(f),d!==void 0)f.delete("content-length");z(),m(x,k,U2(J2)&&J2.stream===!0?"event-stream":"http",f);let Z2=W$(_.url,k.baseURL!==void 0?{baseURL:k.baseURL}:{}).url?.toString()??_.url;if(x.route==="oauth"&&X2&&d!==void 0)await X.onRequestPrepared?.({...y(S,x),url:Z2,bodyText:d}),z();if(k.dispatch?.kind==="http-relay"){let t=d??"";f.delete("x-relay-token");let e={protocol:1,type:"request",affinity:H.sessionID,upstream:{url:Z2,method:_.method,headers:Object.fromEntries(f)},mode:"full_sync",revision:1,body:t,next_hash:`sha256:${i$("sha256").update(t).digest("hex")}`};return new Request(k.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":k.dispatch.token},redirect:"error",signal:_.signal,body:JSON.stringify(e)})}let $2=d;if(x.route==="oauth"&&X2&&d!==void 0){let t=await r$({url:Z2,body:d,latch:N});if(z(),t.gzip)$2=await s$(d),f.set("content-encoding","gzip"),P.add(x),z()}return new Request(Z2,{method:_.method,headers:f,redirect:_.redirect,signal:_.signal,...$2!==void 0?{body:$2}:{}})};return{adapter:{providerID:N2,chooseAccount:(H)=>E(H,async()=>{let z=await X.chooseAccount(H);if(!z)throw G(H);return z}),accountHeaders:s,rewriteRequest:h,rewriteHandshakeURL(){throw new K2},rewriteResponse({response:H,attempt:z}){let _=z.data;if(_&&!j(H.headers,_)){if(H.status===401)return R(_),H.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return n(_,H)}if(_&&P.has(_))P.delete(_),n$(H).then((r)=>{if(!r)return;N.latchProcess(),M?.warn("gzipped request body rejected; later requests go uncompressed",{kind:r,status:H.status})},()=>{});let S=n(_,H);if(_?.route!=="oauth"||!S.body)return Z(_,S);let x={...y(z,_),status:H.status},k=X.responseOptions?.(x)??{},f=(H.headers.get("content-type")??"").includes("application/json");return Z(_,j$(S,{...k,toolNameMap:B.get(_),onToolNameRefusal:()=>{K.set(_,"response_tool_names"),R(_)},laneStartOAuthServed:!0,...f?{responseMode:"json"}:{}}))},quotaFromHeaders(H,z,_){let S=_.data;if(!S||!j(H,S))return;return X.quotaFromHeaders?.(H,{...y(_,S),status:z})},async limitFromResponse({status:H,headers:z,body:_,attempt:S}){let x=S.data;if(!x||K.get(x)==="response_tool_names")return;if(!j(z,x))return X.limitFromRelayFailure?.({...y(S,x),status:H});if(U.set(x,`provider responded with HTTP ${H}`),!X.limitFromResponse)return;let k=a.get(z)===x,f=q(x);return X.limitFromResponse({...y(S,x),status:H,headers:z,body:async()=>k?await _():f.redactText(await _())})},inspectEvent({data:H,event:z,attempt:_}){if(_.data&&K.get(_.data)==="response_tool_names")return;let S=C2(H);if(!U2(S))return;let x=typeof S.type==="string"?S.type:z;if(x==="content_block_start"||x==="content_block_delta")return{outputStarted:!0};if(x==="message_stop")return{done:!0};if(x!=="error")return;let k=_.data,f=q(k),r=U2(S.error)?S.error:{},d=typeof r.type!=="string"?void 0:a2.has(r.type)?r.type:f.redactText(r.type),X2=typeof r.message==="string"?f.redactText(r.message):void 0;if(k?.dispatch==="http-relay"&&Y.get(k)===!1)return;let J2=k?X.limitFromStreamError?.({...y(_,k),errorType:d,message:X2}):void 0,Z2={error:[d??"error",X2].filter(Boolean).join(": ").slice(0,V1),...J2?{limit:J2}:{}};if(k&&Z2.error)U.set(k,Z2.error);return Z2},limitFromError(H,z){let _=z.data;if(!_||K.has(_))return;let S={type:a2.has(H.type)?H.type:"provider_error",message:U.get(_)??"provider request failed",...H.status!==void 0?{status:H.status}:{}};if(R(_),_.dispatch==="http-relay"&&Y.get(_)===!1)return;return X.limitFromHostError?.(S,y(z,_))},async onAttemptEnd(H,z){let _=H.data;if(!_)return;T.delete(_);let S=z.error?.reason;if(S==="cancelled"||S==="abandoned"||S===void 0&&(z.status===void 0||z.status<400))R(_);let x=K.get(_),{status:k,...f}=z,r=X.onAttemptEnd?.(y(H,_),{...f,...k!==void 0&&(_.dispatch!=="http-relay"||Y.get(_)===!0)?{status:k}:{},...x!==void 0?{localRefusal:{check:x}}:{}});if(await z1(r,L)==="timed-out")M?.warn("the account source did not finish recording a send",{timeoutMs:L})}},dispose(){c=!0;for(let[H,z]of A){for(let _ of z)_.revoked=!0;X.forgetSession?.(H)}A.clear(),T.clear();for(let H of[...V.keys()])R(H)},forgetSession(H){for(let z of A.get(H)??[])z.revoked=!0;A.delete(H);for(let[z,_]of T)if(_.sessionID===H)T.delete(z);for(let[z,_]of[...V])if(_.sessionID===H)R(z);X.forgetSession?.(H)},get pendingSendCount(){return T.size},get heldCredentialCount(){let H=0;for(let z of T.values())if(z.oauth)H++;return H},get heldRedactorCount(){return V.size},get operationsInProgress(){let H=0;for(let z of A.values())H+=z.size;return H}}}function P2($){return JSON.stringify([$.source,$.accountIdentity,$.credentialId,$.binding?.storageId,$.binding?.rowId,$.binding?.credentialEpoch])}function B$($){let{runtime:X,source:M}=$,W=new AbortController,L=!1,N=new C1({directory:$.registryDirectory||process.env.OPENCODE_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR||N1("opencode"),now:$.now}),P=new Map,T=async(V,U,O)=>{let q=O?AbortSignal.any([W.signal,O]):W.signal;q.throwIfAborted();let R=JSON.parse(await U.text()),m={providerID:"anthropic",modelID:R.model,sessionID:`oc2-cachekeep:${V.id}`,agent:"cachekeep",kind:"generate"},b=M2({source:{...M,onRequestPrepared:void 0,responseOptions:void 0,async requestOptions(Z){return{...await M.requestOptions?.(Z),laneStart:!1,billingLineage:void 0,cacheDiagnosticsPreviousMessageId:void 0}},async authorizeAccount(Z,j){let G=await X.read();q.throwIfAborted();let A=G.accounts.find((w)=>w.id===j);if(A?.type!=="oauth"||P2(A)!==V.oauthAccountIdentity||V.isSubagent&&!g2(G.policyStorage)||!f2(G.policyStorage)||!U$(G.policyStorage,new Date($.now?.()??Date.now())))return;let E=await M.authorizeAccount(Z,j);if(E?.provenance.kind==="local"&&P2({...A,binding:E.provenance.subject.binding,accountIdentity:E.provenance.subject.binding.identity})!==V.oauthAccountIdentity)return;if(E?.provenance.kind==="vault"&&E.provenance.credentialId!==A.credentialId)return;return E},async admitRequest(Z){await M.admitRequest?.(Z);let j=await X.read(),G=j.accounts.find((A)=>A.id===Z.accountId);if(q.throwIfAborted(),!G||P2(G)!==V.oauthAccountIdentity||V.isSubagent&&!g2(j.policyStorage)||!f2(j.policyStorage)||!U$(j.policyStorage,new Date($.now?.()??Date.now())))throw Error("CacheKeep policy changed before dispatch")}}}),i,n,c=!1,a=()=>b.forgetSession(m.sessionID);q.addEventListener("abort",a,{once:!0});try{let Z=(await X.read()).accounts.find((y)=>P2(y)===V.oauthAccountIdentity)?.id;if(!Z)throw Error("CacheKeep account is unavailable");let j=await b.adapter.accountHeaders({...m,accountId:Z});if(!("headers"in j)||typeof j.headers!=="object"||j.headers===null||typeof j.attempt!=="object"||j.attempt===null||j.attempt.route!=="oauth")throw Error("CacheKeep authorization refused");i={...m,accountId:Z,attemptId:crypto.randomUUID(),transport:"http",data:j.attempt};let G=await b.adapter.rewriteRequest?.({...m,accountId:Z,attempt:i,request:new Request(V.url,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(R),signal:q})});if(!G)throw Error("CacheKeep rewrite refused");q.throwIfAborted();let A=await($.fetch??fetch)(G),E=await b.adapter.rewriteResponse?.({...m,accountId:Z,attempt:i,request:G,response:A});if(!E)throw Error("CacheKeep response rewrite refused");if(n=E.status,b.adapter.quotaFromHeaders?.(E.headers,E.status,i),!E.ok)await b.adapter.limitFromResponse?.({status:n,headers:E.headers,body:()=>E.clone().text(),attempt:i});let w=await E.arrayBuffer();return c=!0,new Response(w,{status:n,headers:E.headers})}catch{throw Error("Native CacheKeep was not completed")}finally{q.removeEventListener("abort",a);try{if(i)await b.adapter.onAttemptEnd?.(i,{status:n,outputStarted:!1,...c?{}:{error:{reason:"cancelled"}}})}finally{b.dispose(),M.forgetSession?.(m.sessionID)}}},K=$.setIntervalImpl??globalThis.setInterval,Y=new _1({loadStorage:async()=>L?null:(await X.read()).policyStorage,now:$.now,setIntervalImpl:(V,U)=>K(()=>Y.tick().catch(()=>{L1.warn("cachekeep","tick failed")}),U),clearIntervalImpl:$.clearIntervalImpl,onTrackedSessionsChanged:(V)=>N.publish(L?[]:V),prepareHeaders(V,U,O){if(L)return;return P.set(O.id,{target:U,attempt:O}),new Headers({"x-native-cachekeep-attempt":String(O.id)})},fetchImpl:async(V,U)=>{let O=new Request(V,U),q=Number(O.headers.get("x-native-cachekeep-attempt")),R=P.get(q);if(P.delete(q),!R)throw Error("CacheKeep attempt is unavailable");return T(R.target,O,R.attempt.signal)},onComplete:({attempt:V})=>{P.delete(V.id)}}),B;return{async track(V){if(L||V.route!=="oauth"||V.agent==="cachekeep"||V.agent==="prime"||V.kind!=="primary")return;let U=await X.read();if(L||!f2(U.policyStorage))return;let O=!1;try{O=await $.isSubagent?.(V.sessionID)??!1}catch{return}if(L||O&&!g2(U.policyStorage))return;let q=U.accounts.find((R)=>R.id===V.accountId);if(!q?.accountIdentity)return;if(V.provenance.kind==="local"&&JSON.stringify(q.binding)!==JSON.stringify(V.provenance.subject.binding))return;if(V.provenance.kind==="vault"&&q.credentialId!==V.provenance.credentialId)return;Y.track({sessionId:V.sessionID,url:V.url,headers:new Headers,bodyText:V.bodyText,storage:U.policyStorage,cacheMode:"hybrid",oauthAccountId:V.accountId,oauthAccountIdentity:P2(q),isSubagent:O}),await N.publish(Y.trackedSessions())},registry:N,dispose(){if(B)return B;return L=!0,Y.stop(),W.abort(),B=(async()=>{try{await Y.tick()}finally{P.clear(),await N.dispose()}})(),B}}}async function K$($,X,M){let W=M2(X),L=[],N=async(U,O,q)=>{let R=await $.session.hook(U,O,q);return L.push(R),R},P=new AbortController,T;try{T=await w2({session:{hook:N},event:$.event},W.adapter,{logger:X.log,gateOnPlaceholder:M})}catch(U){throw W.dispose(),await Promise.allSettled(L.map((O)=>O.dispose())),U}let K=(U)=>{W.forgetSession(U),T.forgetSession(U)},Y=$.event,B=Y?(async()=>{try{for await(let U of Y.subscribe({signal:P.signal}))if(U.type==="session.deleted")K(U.data.sessionID)}catch(U){if(!P.signal.aborted)X.log?.warn("stopped listening for session deletion",{error:U instanceof Error?U.name:"unknown"})}})():Promise.resolve(),V;return{installation:T,forgetSession:K,dispose(){if(V)return V;return W.dispose(),P.abort(),V=(async()=>{await T.dispose(),await B})(),V}}}import{effectiveRelayTransport as M$,getQuotaCheckIntervalMs as P1,logger as F1,nativeAccountCanServe as T1,oauthProfileIsFresh as O1,quotaSnapshotCheckedAt as E1}from"@cortexkit/anthropic-auth-core";function z$($,X){let M=new AbortController,W,L=!1,N=async()=>{let K=await $.read();if(M.signal.throwIfAborted(),K.policyStorage.relay?.enabled===!0&&M$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="websocket")return;let Y=K,B=P1(Y.policyStorage);for(let V of Y.accounts){if(M.signal.aborted)return;if(!T1(V)||V.type!=="oauth")continue;if(Y.policyStorage.quota?.enabled!==!1&&Date.now()-E1(V.quota)>=B)await $.fetchQuota(V.id,X,M.signal,void 0,"background").catch(()=>{});if(!O1(V.profile)&&!M.signal.aborted)await $.fetchProfile(V.id,X,M.signal).catch(()=>{})}},P=()=>{if(L||W)return W;return W=N().catch(()=>{if(!M.signal.aborted)F1.debug("opencode2","native background readings did not complete")}).finally(()=>{W=void 0}),W},T=$.vault.watch({intervalMs:60000,onRefresh:P,shouldRefresh:async()=>{let K=await $.read();return K.policyStorage.relay?.enabled!==!0||M$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="http"}});return T.ready.catch(()=>{}),{async dispose(){L=!0,T.close(),M.abort(),await W}}}import{authorize as f1,buildCacheKeepStatusSummary as g1,buildClaudeQuotaSummary as v1,buildPrimeAccountStatuses as h1,buildPrimeStatusSummary as m1,CLAUSTRUM_OPENCODE_ENROLLMENT_NAME as l1,exchange as d1,formatNativeAccountState as p1,formatOAuthAccountTier as u1,getCacheKeepWindow as i1,getHostClaustrumEnrollmentPaths as c1,isCacheKeepAlways as o1,isCacheKeepHybridActive as n1,isCacheKeepPersistentlyEnabled as r1,nativeAccountCanServe as s1,resetClaustrumEnrollmentState as a1}from"@cortexkit/anthropic-auth-core";import{buildPrimeAccountStatuses as S1,effectiveRelayStatus as x1,formatNativeAccountState as R1,formatOAuthAccountTier as _$,getCacheKeepWindow as A1,getRoutingMode as q1,isCacheKeepAlways as k1,isCacheKeepHybridActive as D1,isPermanentRefreshError as b1,isPrimePersistentlyEnabled as w1,nativeAccountCanServe as L$,refreshBackoffActive as C$}from"@cortexkit/anthropic-auth-core";var N$=($)=>L$($)&&$.state!=="unsupported-access"?void 0:R1($)||void 0,y1=($)=>{if($.source!=="vault")return"off";if($.state==="needs_reauth")return"on-vault-reauth";return L$($)?"on-vault-served":"on-cold"},I1=($,X)=>typeof $==="number"&&$>X;function P$($,X){let{now:M}=X,W=$.policyStorage,L=$.accounts.filter((B)=>B.type==="oauth"),N=L.find((B)=>B.id==="main"),P=N?N$(N):void 0,T=N?.lastQuotaRefreshError?.nextRetryAt,K=N?.lastRefreshError,Y=A1(W);return{main:{quota:N?.quota??null,enabled:N?.enabled,tierLabel:_$(N?.profile),quotaBackedOff:I1(T,M),quotaBackoffUntil:T,refreshBackedOff:C$(K,N?.accountIdentity,M,void 0),refreshBackoffUntil:K?.nextRetryAt,stateLine:P,quotaDated:Boolean(P)},fallbacks:L.filter((B)=>B.id!=="main"&&(B.enabled||B.source==="vault")).map((B)=>{let V=N$(B),U=y1(B);return{id:B.id,label:B.label,quota:B.quota??null,enabled:B.enabled,tierLabel:_$(B.profile),needsReauth:b1(B.lastRefreshError)&&C$(B.lastRefreshError,B.accountIdentity,M,void 0),...U==="on-vault-reauth"?{vaultReauth:!0}:{},...U==="on-vault-served"?{vaultServed:!0}:{},...U!=="off"?{custodyState:U}:{},stateLine:V,quotaDated:Boolean(V)}}),activeId:X.activeId,route:q1(W),relay:x1(W.relay),fastMode:W.claudeFast?.enabled===!0,cacheKeep:{enabled:D1(W),window:k1(W)?"always":Y?`${Y.startHour}-${Y.endHour}`:void 0,trackedSessions:X.trackedSessions},prime:w1(W)?{enabled:!0,accounts:S1(W,{now:M})}:void 0,lastUpdated:M}}var v2=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{};function F$($){let{runtime:X,source:M}=$,W=new Map,L=!1,N=async(Y,B)=>{await X.updateSettings((V)=>({...V,[Y]:{...v2(V[Y]),...B}}))},P=()=>({ok:!0,text:"Native Claude settings updated."}),T=async(Y,B)=>{if(L)throw Error("Native menu is closed");switch(B.signal?.throwIfAborted(),Y.action){case"enable":case"disable":return await X.setEnabled(Y.values.id,Y.action==="enable"),P();case"remove":return await X.remove(Y.values.id),P();case"move-up":case"move-down":{let U=(await X.read()).accounts.map((b)=>b.id),O=U.indexOf(Y.values.id),q=O+(Y.action==="move-up"?-1:1);if(O<0||q<0||q>=U.length)return{ok:!1,text:"Account cannot move in that direction."};let R=U[O],m=U[q];if(R===void 0||m===void 0)return{ok:!1,text:"Account order changed."};return U[O]=m,U[q]=R,await X.reorder(U),P()}case"add-apikey":return await X.addApi(Y.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let V=new AbortController;W.get(Y.sessionId)?.active.abort();let U={active:V,auth:void 0};W.set(Y.sessionId,U);let O=await f1("max");if(L||V.signal.aborted||B.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return U.auth=O,{ok:!0,text:`Open ${O.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let V=W.get(Y.sessionId);if(!V?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let U=await d1(Y.values.code,V.auth.verifier,V.auth.redirectUri,V.auth.state);if(V.active.signal.throwIfAborted(),B.signal?.throwIfAborted(),L||U.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await X.loginOAuth({routeId:crypto.randomUUID(),credential:U,label:Y.values.label}),V.active.signal.throwIfAborted(),B.signal?.throwIfAborted(),L)return{ok:!1,text:"Sign-in cancelled."};return W.delete(Y.sessionId),{ok:!0,text:"OAuth account stored in the native account pool."}}case"reset-backoff":{let V=await X.read();for(let U of V.accounts){if(B.signal?.throwIfAborted(),U.type!=="oauth")continue;let O=U.source==="vault"?await X.authorizeVault(U.id,B.signal):await X.captureLocalSubject(U.id);await X.resetBackoff(U.id,O)}return P()}case"enrollment-reset":{let V=await a1(c1("opencode"),l1);return{ok:V==="reset",text:V==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":V==="refused-pending"?"An enrollment request may still be in progress. Quit OpenCode and run setup again; it picks up the same request.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let U=(await X.read()).accounts.filter((R)=>R.type==="oauth"&&s1(R)),O=await Promise.allSettled(U.map((R)=>X.fetchQuota(R.id,void 0,B.signal)));return{ok:O.every((R)=>R.status==="fulfilled"),text:`${O.filter((R)=>R.status==="fulfilled").length}/${U.length} native quota readings refreshed.`}}case"routing-reset":return await M.resetRouting(Y.sessionId),P();case"routing-mode":return await N("routing",{mode:Y.values.mode}),P();case"killswitch-on":case"killswitch-off":return await N("killswitch",{enabled:Y.action==="killswitch-on"}),P();case"killswitch-set":return await X.updateSettings((V)=>{let U=v2(V.killswitch),O={...v2(U.accounts)},q=U.main;for(let R of Y.values.entries){let m={five_hour:R.fh,seven_day:R.sd,...R.scoped!==void 0?{scoped:R.scoped}:{}};if(R.account==="main"||R.account==="all")q=m;if(R.account==="all")for(let b of Object.keys(O))O[b]=m;else if(R.account!=="main")O[R.account]=m}return{...V,killswitch:{...U,main:q,accounts:O}}}),P();case"cache-on":case"cache-off":return await N("claudeCache",{enabled:Y.action==="cache-on"}),P();case"cache-mode":return await N("claudeCache",{mode:Y.values.mode}),P();case"cachekeep-always":return await N("cacheKeep",{enabled:!0,always:!0}),P();case"cachekeep-off":return await N("cacheKeep",{enabled:!1}),P();case"cachekeep-window":return await N("cacheKeep",{enabled:!0,always:!1,startHour:Y.values.startHour,endHour:Y.values.endHour}),P();case"cachekeep-subagents":return await N("cacheKeep",{subagents:Y.values.enabled==="on"}),P();case"dump-on":case"dump-off":return await N("dump",{enabled:Y.action==="dump-on"}),P();case"logging-level":return await N("logging",{level:Y.values.level}),P();case"fast-on":case"fast-off":return await N("claudeFast",{enabled:Y.action==="fast-on"}),P();case"prime-on":case"prime-off":return await N("prime",{enabled:Y.action==="prime-on"}),P();case"start-fire":return await K(Y.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},K=(Y)=>$.start(Y,E2);return{dispatch:T,async readStatus(Y){let B=await X.read();if(Y==="account")return B.accounts.map((U)=>`${U.id}${U.label?` (${U.label})`:""}: ${U.type}, ${U.source}, ${U.enabled?"enabled":"disabled"}${U.state?`, ${p1(U)}`:""}${U.accountIdentity?`, ${U.accountIdentity}`:""}`).join(`
-`)||"No native Claude accounts.";if(Y==="quota")return v1({accounts:B.accounts.filter((U)=>U.type==="oauth").map((U)=>({name:U.label??U.id,role:U.id==="main"?"main":"fallback",enabled:U.enabled,quota:U.quota,tierLabel:u1(U.profile),lastRefreshedAt:U.lastRefreshedAt,error:U.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(Y==="prime")return m1({enabled:B.policyStorage.prime?.enabled===!0,accounts:h1(B.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");if(Y==="cachekeep"){let U=await $.cacheKeepRegistry?.list()??[];return g1({enabled:r1(B.policyStorage),always:o1(B.policyStorage),hybridActive:n1(B.policyStorage),trackedSessionDetails:U,window:i1(B.policyStorage),trackedSessions:U.length,nextPrewarmAt:U.length?Math.min(...U.map((O)=>O.nextPrewarmAt)):void 0})}let V={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(B.settings[V[Y]]??{})},async readSidebar(Y){let[B,V]=await Promise.all([X.read(),$.cacheKeepRegistry?.list()??[]]);return P$(B,{activeId:M.servedAccount(Y),trackedSessions:V.length,now:Date.now()})},forgetSession(Y){W.get(Y)?.active.abort(),W.delete(Y)},close(){L=!0;for(let Y of W.values())Y.active.abort();W.clear()}}}import{resolveClaudeModelCapabilities as t1}from"@cortexkit/anthropic-auth-core";function T$(){let $=new Map;return{install:(M)=>M.model.transform((W)=>{$.clear();for(let L of W.list("anthropic")){$.set(String(L.id),String(L.modelID));let N=t1(L.modelID)?.efforts.variants;if(!N)continue;W.update("anthropic",String(L.id),(P)=>{let T=P.variants.filter((K)=>!N.some((Y)=>Y===String(K.id)));P.variants=[...T,...N.map((K)=>({id:K,settings:{effort:K,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(M)=>$.get(M)??M}}function O$($){return $.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??$.get("x-api-key")??void 0}import{buildPrimeRequestBody as E$,effectiveRelayTransport as S$,nativeAccountCanServe as e1,PrimeManager as $X}from"@cortexkit/anthropic-auth-core";var x$=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{};function R$($){let{runtime:X,source:M}=$,W=new AbortController,L=new Set,N=(K)=>({providerID:"anthropic",modelID:E$().model,sessionID:`oc2-prime:${K}`,agent:"prime",kind:"generate"}),P=async(K)=>{let Y=N(K),B=M2({source:M}),V=performance.now();try{for(let U=0;U<3;U++){if(W.signal.throwIfAborted(),(await X.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let q=await B.adapter.accountHeaders({...Y,accountId:K});if(!("headers"in q)||typeof q.headers!=="object"||q.headers===null||typeof q.attempt!=="object"||q.attempt===null)throw Error("Native Prime authorization refused");let R={...Y,accountId:K,attemptId:crypto.randomUUID(),transport:"http",data:q.attempt},m,b=!1,i=!1,n=(c)=>{i=!0,c.body?.cancel().catch(()=>{})};try{let c=await B.adapter.rewriteRequest?.({...Y,accountId:K,attempt:R,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(E$()),signal:W.signal})});if(!c)throw Error("Native Prime rewrite refused");let a=new Headers(c.headers);for(let[s,p]of Object.entries(q.headers))if(p===null)a.delete(s);else a.set(s,p);let Z=new Request(c,{headers:a}),j=await($.fetch??fetch)(Z),G=await B.adapter.rewriteResponse?.({...Y,accountId:K,request:Z,response:j,attempt:R})??j;m=G.status,B.adapter.quotaFromHeaders?.(G.headers,G.status,R);let A=G.ok?void 0:await B.adapter.limitFromResponse?.({status:G.status,headers:G.headers,body:()=>G.clone().text(),attempt:R});if(A&&/^(vault-newer|local-newer|relay-direct):/.test(A.reason)&&U<2){if(n(G),await M.chooseAccount({...Y,rerouteFrom:{accountId:K,limit:A}})!==K)throw Error("Native Prime retry changed account");continue}if(!G.ok)return n(G),{ok:!1,status:m,ms:performance.now()-V,error:"Native Prime upstream refused the request"};let E=x$(await G.json()),w=x$(E.usage),y={inputTokens:typeof w.input_tokens==="number"?w.input_tokens:void 0,outputTokens:typeof w.output_tokens==="number"?w.output_tokens:void 0};if(R.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(G.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(b=await M.recordPrime(q.attempt.provenance,y),!b)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:m,ms:performance.now()-V,usage:y}}finally{await B.adapter.onAttemptEnd?.(R,{status:m,outputStarted:!1,...b?{}:{error:{reason:i?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-V}}finally{B.dispose()}},T=new $X({storagePath:$.paths.legacyConfig,loadStorage:async()=>(await X.read()).policyStorage,async getAccountFingerprint(K){let Y=await X.read(),B=Y.accounts.find((U)=>U.id===K);if(!e1(B)||B?.type!=="oauth")return;if(Y.policyStorage.relay?.enabled===!0&&S$(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")return;if(B.source==="vault"){let U=await X.authorizeVault(K,W.signal);return X.getOrCreateAuthLineage(K,U)}let V=await X.authorizeLocal(K,{signal:W.signal});return V.status==="usable"?X.getOrCreateAuthLineage(K,V.subject):void 0},async refreshQuota(K){let Y=await X.read();if(Y.policyStorage.relay?.enabled===!0&&S$(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await X.fetchQuota(K,$.fetch,W.signal),fresh:!0}},sendPrime(K){let Y=P(K);return L.add(Y),Y.finally(()=>L.delete(Y)),Y},async recordSuccess(K){let Y=(await X.read()).accounts.find((B)=>B.id===K);if(!Y?.prime)throw Error("Native Prime counters are unavailable");return Y.prime}});return T.start(),{manager:T,async dispose(){T.stop(),W.abort(),await Promise.allSettled(L)}}}import{createNativeUsagePublisher as XX,effectiveRelayTransport as JX,getClaudeCodeIdentityForVerifiedAccount as S2,getQuotaCheckIntervalMs as ZX,getRoutingMode as A$,isQuotaBearingHeaderFrame as YX,mergeHeaderQuotaForPersistence as WX,NativeVaultNoAccountError as GX,nativeAccountCanServe as h2,nativeAccountPolicy as x2,normalizeQuotaHeaders as jX,quotaSnapshotCheckedAt as VX,quotaSnapshotHasStandardWindows as QX,readNativeAccountsForRequest as HX,remapModelId as m2,StickySessionRouter as UX,shouldFallbackStatus as BX,stickyQuotaSnapshotIsFresh as R2,stickyRouteFamilyForModel as KX}from"@cortexkit/anthropic-auth-core";var l2=($)=>["five_hour","seven_day"].some((X)=>($?.[X]?.remainingPercent??1)<=0);function k$($){let{runtime:X}=$,M=XX("native-auth"),W=new Map,L=(Z)=>{let j=Z.routingPath;if(!j)throw Error("Native routing storage is unavailable");let G=W.get(j);if(!G)G=new UX({path:j,vaultSeed:Z.routingSeed,onLockEvent:X.onLockEvent,localRecoveryPath:Z.mode==="local"?Z.routingRecoveryPath:void 0}),W.set(j,G);return G.setVaultSeed(Z.routingSeed),G},N=new WeakMap,P=new Map,T=new Map,K=new Map,Y=new Map,B=new WeakSet,V=!1,U=()=>{while(P.size>512){let Z=P.keys().next();if(!Z.done)P.delete(Z.value)}},O=(Z,j)=>JSON.stringify([Z.sessionID,Z.kind,Z.modelID,j]),q=(Z)=>{if(V)throw Error("Native Anthropic source is closed");let j=K.get(Z.sessionID);if(!j){j=new AbortController,K.set(Z.sessionID,j);while(K.size>512){let G=K.keys().next();if(!G.done)c.forgetSession?.(G.value)}}return j},R=(Z,j,G)=>h2(Z)&&(Z.type==="api"||x2(Z,j,m2(G)).status==="allowed"),m=async(Z,j,G,A)=>{let E=await X.read();A.signal.throwIfAborted(),b(E);let w=E.accounts.find((y)=>y.id===Z);if(!w||w.type!==G||!R(w,E,j))return!1;if(G==="api"){let y=E.accounts.find((s)=>s.id==="main"&&s.type==="oauth");return!!y&&R2(y.quota,E.policyStorage)&&l2(y.quota)}return!0},b=(Z)=>{let j=Z.policyStorage.relay;if(j?.enabled===!0&&JX(j.transport,j.url)==="websocket")throw new K2},i=async(Z,j)=>{if(b(Z),j||Z.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let G=await X.getRelayConfig();if(!G)throw Error("request refused: native HTTP relay configuration is unavailable");if(G.transport!=="http")throw new K2;return{dispatch:{kind:"http-relay",url:G.url,token:G.token},relayFallback:G.fallbackToDirect}};async function n(Z,j,G){if(Z.kind==="local")await X.publishLocal(Z.subject,G);else if(Z.kind==="vault"&&j.receipt)await X.vault.publish(j.receipt,G);else if(Z.kind==="api"&&G.lastUsed!==void 0)await X.publishApi(Z.subject,{lastUsed:G.lastUsed})}let c={async chooseAccount(Z){let j=q(Z);$.onOwnedRequest?.();let G=await X.read();j.signal.throwIfAborted(),b(G);let A=m2(await $.resolveModelId?.(Z)??Z.modelID);if(j.signal.throwIfAborted(),G.mode==="claustrum")G=await HX(X,j.signal),j.signal.throwIfAborted();if(G.policyStorage.quota?.enabled!==!1){let h=!1;for(let o of G.accounts){if(!h2(o)||o.type!=="oauth")continue;if(QX(o.quota)?R2(o.quota,G.policyStorage,Date.now(),A):Date.now()-VX(o.quota)<ZX(G.policyStorage))continue;try{await X.fetchQuota(o.id,$.fetch,j.signal,void 0,"admission"),h=!0}catch{j.signal.throwIfAborted()}}if(h)G=await X.read();j.signal.throwIfAborted()}let E=Z.rerouteFrom?P.get(Z.rerouteFrom.limit.reason):void 0;if(Z.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(Z.rerouteFrom.limit.reason)&&!E)return;if(E&&Z.rerouteFrom){P.delete(Z.rerouteFrom.limit.reason);let h=G.accounts.find((H)=>H.id===E.accountId);if(!h||!R(h,G,A))return;let o=O(Z,E.accountId),l=T.get(o)??[];return l.push(E),T.set(o,l),E.accountId}let w=[];for(let h of G.accounts){if(h.type!=="oauth"||!R(h,G,A))continue;if(h.source==="local"){let o=await X.authorizeLocal(h.id,{signal:j.signal,policy:(l,H)=>x2(l,H,A)});if(j.signal.throwIfAborted(),o.status!=="usable")continue}w.push(h)}let y=w.filter((h)=>h.id!==Z.rerouteFrom?.accountId);if(A$(G.policyStorage)==="sticky-balanced"){let h=y.map((l,H)=>({accountId:l.id,order:H,quota:l.quota??{kind:"unknown"}})),o=await L(G).resolve({sessionId:Z.sessionID,family:KX(A),modelId:A,affinityModelId:Z.modelID,candidates:h,retainAccountIds:new Set(y.map((l)=>l.id)),...G.mode==="claustrum"?{accountIdentities:new Map(G.accounts.flatMap((l)=>l.accountIdentity?[[l.id,l.accountIdentity]]:[]))}:{},storage:G.policyStorage,inputBytes:1,preferredAccountId:Z.previousAccountId});if(j.signal.throwIfAborted(),o)return o.accountId}else{let o=A$(G.policyStorage)==="fallback-first"?[...y.filter((l)=>l.id!=="main"),...y.filter((l)=>l.id==="main")]:[...y.filter((l)=>l.id==="main"),...y.filter((l)=>l.id!=="main")];if(o[0])return o[0].id}if(G.mode==="claustrum")throw new GX;let s=G.accounts.find((h)=>h.id==="main"&&h.type==="oauth");if(!s)return;let p=s.quota;if(Z.rerouteFrom?.limit.status===429||!R2(p,G.policyStorage))try{p=await X.fetchQuota("main",$.fetch,j.signal)}catch{return}if(j.signal.throwIfAborted(),!l2(p))return;return G.accounts.find((h)=>h.type==="api"&&h2(h)&&h.id!==Z.rerouteFrom?.accountId)?.id},async authorizeAccount(Z,j){let G=q(Z),A=await X.read();G.signal.throwIfAborted(),b(A);let E=m2(await $.resolveModelId?.(Z)??Z.modelID);G.signal.throwIfAborted();let w=A.accounts.find((S)=>S.id===j);if(!w||!R(w,A,E))return;let y=O(Z,j),s=T.get(y),p=s?.shift();if(s?.length===0)T.delete(y);let{dispatch:h,relayFallback:o}=await i(A,p?.direct===!0);if(G.signal.throwIfAborted(),p?.auth){if(!await m(j,E,p.auth.route,G))return;let S=N.get(p.auth.provenance);if(S?.receipt?.expiresAtMs!==void 0&&S.receipt.expiresAtMs!==null&&S.receipt.expiresAtMs<Date.now()+300000)return;if(S)N.set(p.auth.provenance,{...S,scope:{...Z,modelID:E},account:w,active:G,relayFallback:o});return Y.set(Z.sessionID,j),{...p.auth,dispatch:h}}let l={scope:{...Z,modelID:E},active:G,account:w,retry:p?.retry??!1,relayFallback:o,quota:w.quota};if(w.type==="api"){let S=A.accounts.find((r)=>r.id==="main"&&r.type==="oauth");if(!S||!R2(S.quota,A.policyStorage)||!l2(S.quota))return;let x=await X.authorizeApi(j,G.signal);if(G.signal.throwIfAborted(),!await m(j,E,"api",G))return;let k={kind:"api",subject:x.subject};return N.set(k,l),Y.set(Z.sessionID,j),{route:"api",headers:x.authHeader==="authorization-bearer"?{authorization:`Bearer ${x.apiKey}`}:{"x-api-key":x.apiKey},baseURL:x.baseURL,provenance:k,dispatch:h}}if(w.source==="vault"){let S=await X.authorizeVault(j,G.signal);if(G.signal.throwIfAborted(),!await m(j,E,"oauth",G))return;let x={kind:"vault",credentialId:S.credentialId,recordVersion:S.recordVersion};N.set(x,{...l,receipt:S});let k=S.assertedAccountIdentity;if(!k)return;return Y.set(Z.sessionID,j),{route:"oauth",accessToken:S.accessToken,provenance:x,dispatch:h,identity:S2(k,k)}}let H=await X.authorizeLocal(j,{signal:G.signal,policy:(S,x)=>x2(S,x,E)});if(G.signal.throwIfAborted(),H.status!=="usable")return;if(!await m(j,E,"oauth",G))return;let z={kind:"local",subject:H.subject};N.set(z,{...l,access:H.access}),Y.set(Z.sessionID,j);let _=H.subject.binding.identity;return{route:"oauth",accessToken:H.access,provenance:z,dispatch:h,identity:S2(_,_)}},async requestOptions(Z){let j=q(Z),G=await X.read();j.signal.throwIfAborted();let A=G.accounts.find((w)=>w.id===Z.accountId);if(!A||!R(A,G,Z.modelID))throw Error("request refused: native account is ineligible for this model");let E=N.get(Z.provenance);if(E)N.set(Z.provenance,{...E,scope:{...E.scope,modelID:Z.modelID}});return $.requestOptions(Z,G)},async admitRequest(Z){let j=N.get(Z.provenance);if(!j||!await m(Z.accountId,Z.modelID,Z.route,j.active))throw Error("request refused: native account policy changed before dispatch");N.set(Z.provenance,{...j,scope:{...j.scope,modelID:Z.modelID}})},onRequestPrepared:(Z)=>$.onRequestPrepared?.(Z),responseOptions(Z){return $.responseOptions?.({...Z,modelID:N.get(Z.provenance)?.scope.modelID??Z.modelID})},quotaFromHeaders(Z,j){let G=N.get(j.provenance),A=q$(Z);if(A)$.onRequestId?.(j,A);if(!G||j.route!=="oauth"||!YX(Z))return;let E=j.provenance.kind==="local"?j.provenance.subject.binding.identity:G.receipt?.assertedAccountIdentity,w={...jX(Z),...E?{accountIdentity:E}:{}};G.quota=WX(G.quota,w);let y=M.observe(n(j.provenance,G,{quota:G.quota}));return a.set(j.provenance,y),w},async limitFromResponse(Z){let j=N.get(Z.provenance);if(!j)return;if(Z.status===401&&j.receipt){if(!B.has(j.receipt))B.add(j.receipt),await X.vault.reportFailure(j.receipt,401,Z.dispatch==="http-relay"?"relay_status_field":"direct");if(j.retry||j.active.signal.aborted)return;let A=j.active,E=await X.vault.prepareRetry(j.receipt,A.signal);if(A.signal.throwIfAborted(),!E.retry)return;let w=E.receipt,y=w.assertedAccountIdentity;if(!y)return;let s={kind:"vault",credentialId:w.credentialId,recordVersion:w.recordVersion};N.set(s,{...j,receipt:w,retry:!0});let p=`vault-newer:${Z.attemptId}`;return P.set(p,{sessionID:Z.sessionID,accountId:Z.accountId,retry:!0,auth:{route:"oauth",accessToken:w.accessToken,provenance:s,identity:S2(y,y)}}),U(),{reason:p,status:401}}if(Z.status===401&&Z.provenance.kind==="local"&&j.access&&!j.retry){if(j.active.signal.aborted)return;let A=j.active,E=await X.authorizeLocal(Z.accountId,{rejectedAccessToken:j.access,signal:A.signal,policy:(p,h)=>x2(p,h,j.scope.modelID)});if(A.signal.throwIfAborted(),E.status!=="usable"||E.access===j.access)return;let w={kind:"local",subject:E.subject};N.set(w,{...j,access:E.access,retry:!0});let y=E.subject.binding.identity,s=`local-newer:${Z.attemptId}`;return P.set(s,{sessionID:Z.sessionID,accountId:Z.accountId,retry:!0,auth:{route:"oauth",accessToken:E.access,provenance:w,identity:S2(y,y)}}),U(),{reason:s,status:401}}let G=await X.read();if(BX(Z.status,G.policyStorage))return{reason:`provider-${Z.status}`,status:Z.status};return},limitFromRelayFailure(Z){let j=N.get(Z.provenance);if(!j?.relayFallback||j.active.signal.aborted||!(Z.status===401||Z.status>=500))return;let G=`relay-direct:${Z.attemptId}`;return P.set(G,{sessionID:Z.sessionID,accountId:Z.accountId,direct:!0,retry:!1}),U(),{reason:G}},limitFromStreamError(Z){return Z.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(Z,j){let G=N.get(j.provenance);if(j.dispatch==="http-relay"&&G?.relayFallback&&!G.active.signal.aborted&&Z.status===void 0){let A=`relay-direct:${j.attemptId}`;return P.set(A,{sessionID:j.sessionID,accountId:j.accountId,direct:!0,retry:!1}),U(),{reason:A}}return},async onAttemptEnd(Z,j){let G=N.get(Z.provenance);if(!G)return;try{if(await a.get(Z.provenance),j.status===401&&G.receipt&&!B.has(G.receipt))B.add(G.receipt),await X.vault.reportFailure(G.receipt,401,Z.dispatch==="http-relay"?"relay_status_field":"direct");if(!j.localRefusal&&j.status!==void 0)M.publish(()=>n(Z.provenance,G,{lastUsed:Date.now()}))}finally{N.delete(Z.provenance),a.delete(Z.provenance)}},forgetSession(Z){K.get(Z)?.abort(),K.delete(Z),Y.delete(Z);for(let[j,G]of P)if(G.sessionID===Z)P.delete(j);for(let[j,G]of T)if(G[0]?.sessionID===Z)T.delete(j);$.onForgetSession?.(Z)},servedAccount:(Z)=>Y.get(Z),resetRouting:async(Z)=>L(await X.read()).clear(Z),async recordPrime(Z,j){let G=N.get(Z);if(!G||G.active.signal.aborted)return!1;if(Z.kind==="local")return X.incrementPrimeUsage(G.account.id,Z.subject,j);if(Z.kind==="vault"&&G.receipt)return X.incrementPrimeUsage(G.account.id,G.receipt,j);return!1},drainRoutingPublications:()=>Promise.all([X.drainRoutingPublications(),...[...W.values()].map((Z)=>Z.drain())]).then(()=>{}),close(){V=!0;for(let Z of K.values())Z.abort();return K.clear(),T.clear(),P.clear(),Promise.all([M.drain(),c.drainRoutingPublications()]).then(()=>{})}},a=new WeakMap;return c}import{remapModelId as MX}from"@cortexkit/anthropic-auth-core";function w$(){let $=new D$,X=new Map,M=new Map,W=new Map,L=new Set,N=new Set,P=new Map,T=(K)=>{while(K.size>512){let Y=K.keys().next();if(!Y.done)K.delete(Y.value)}};return{async install(K){let Y=[];try{Y.push(await K.session.hook("context",(B)=>{let V=B.messages.map((O)=>{return{info:{id:O.id,sessionID:B.sessionID,role:O.role,agent:B.agent,model:{providerID:B.model.providerID,modelID:B.model.id}},parts:O.content.map((q)=>({type:q.type,...q.type==="text"?{text:q.text}:{}}))}});$.observeMessages(V);let U=B.messages.findLast((O)=>O.role==="user"&&O.id);if(U?.id)X.set(B.sessionID,U.id);if(U?.content.some((O)=>O.type==="text"&&O.text===E2))L.add(B.sessionID);else L.delete(B.sessionID);T(X)},{providerID:"anthropic"})),Y.push(await K.session.hook("model.request",(B)=>{if(B.kind!=="primary")return;let V=X.get(B.sessionID);if(!V)return;if($.markHeaders({sessionId:B.sessionID,messageId:V,agent:B.agent,headers:B.headers}),L.has(B.sessionID))B.headers[L2]="1"},{providerID:"anthropic"}))}catch(B){throw await Promise.allSettled(Y.map((V)=>V.dispose())),B}return{dispose:async()=>{await Promise.all(Y.map((B)=>B.dispose()))}}},requestOptions(K,Y){let B=$.resolveHeader(K.correlation[O2]);if(B)M.set(K.attemptId,B),T(M);P.set(K.attemptId,K.sessionID),T(P);let V=K.correlation[L2]==="1";if(V)N.add(K.attemptId);return{cache1hEnabled:K.agent!=="compaction"&&K.agent!=="title"&&(Y.policyStorage.claudeCache?.enabled??!0),cache1hMode:Y.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:Y.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:Y.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,turnEndNoteEnabled:!0,turnEndNote:Y.policyStorage.turnEndNote,serverSideFallbackEnabled:b$(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:V,billingLineage:B?{promptId:B.promptId,previousRequestId:B.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:W.get(K.sessionID)}},responseOptions(K){return{serverSideFallbackModel:MX(K.modelID),laneStart:N.has(K.attemptId),onMessageStart(Y){if(K.kind==="primary"&&typeof Y.id==="string")W.set(K.sessionID,Y.id),T(W)},onStreamEnd(){M.delete(K.attemptId),N.delete(K.attemptId),P.delete(K.attemptId)}}},onRequestId(K,Y){$.commit(M.get(K.attemptId),Y)},forgetSession(K){$.clearSession(K),X.delete(K),W.delete(K),L.delete(K);for(let[Y,B]of P)if(B===K)M.delete(Y),N.delete(Y),P.delete(Y)}}}var A2="cortexkit-anthropic-auth",TX='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',OX="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",EX="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function SX($){let X=$.authorize??_X,M=$.exchange??LX,W=()=>{if(!$.isActive())throw Error("Claude authentication setup is closed")},L=async()=>{let T;try{T=await $.readMode()}catch{throw Error(EX)}return W(),T},N=async()=>{if(await L()!=="local")throw Error(TX)};return{integrationID:"anthropic",methods:[{method:{id:I$,type:"oauth",label:f$},async authorize(){W(),await N();let T=await X("max");return W(),{mode:"code",url:T.url,instructions:"Paste the authorization code returned by Claude.",callback:async(K)=>{W();let Y=await M(K,T.verifier,T.redirectUri,T.state);if(!$.isActive()||Y.type!=="success")throw Error("Claude sign-in did not complete");return{access:Y.access,refresh:Y.refresh,expires:Y.expires}}}}}],vault:{method:{id:g$,type:"oauth",label:"Claude vault accounts"},async activate(){if(W(),await L()!=="claustrum")throw Error(OX)}},async onLogin(T){W(),await N(),await $.runtime.loginOAuth({routeId:"main",credential:T,replace:!0}),W()},label:"Claude native account pool"}}function xX($){return{readMode:()=>PX("opencode",$),disconnectVault:()=>NX({host:"opencode",env:$})}}function d2($={}){return{id:A2,setup:(X)=>h$(X,$)}}async function h$($,X={}){let M=X.paths??await FX(),W=zX({paths:M,host:"opencode",local:X.local,vault:X.vault}),L=xX(X.vault?.env??process.env),N=!0,P=w$(),T=T$(),K,Y,B,V=k$({runtime:W,paths:M,fetch:X.fetch,requestOptions:P.requestOptions,responseOptions:P.responseOptions,onRequestId:P.onRequestId,onForgetSession:P.forgetSession,onRequestPrepared:async(b)=>{try{await B?.track(b)}catch{y$.warn("cachekeep","live request tracking failed")}},resolveModelId:async(b)=>T.modelId(b.modelID),onOwnedRequest:()=>{K??=z$(W,X.fetch),Y??=R$({runtime:W,paths:M,source:V,fetch:X.fetch})}});B=B$({...X.cacheKeep,runtime:W,source:V,fetch:X.fetch,isSubagent:async(b)=>Boolean((await $.session.get({sessionID:b})).parentID)});let U=F$({runtime:W,source:V,cacheKeepRegistry:B.registry,start:async(b,i)=>{await $.session.synthetic({sessionID:b,text:i,description:"Claude lane start",resume:!0})}}),O=[],q=await K$($,{source:V,log:{warn:(b,i)=>y$.warn("opencode2",b,i)}},{credential:O$}).catch(async(b)=>{throw U.close(),await B?.dispose(),await V.close(),await W.drainQuotaPublications(),W.close(),b}),R,m=()=>{if(R)return R;return N=!1,U.close(),V.close(),R=(async()=>{await Promise.allSettled([q.dispose(),K?.dispose(),Y?.dispose(),B?.dispose(),...O.map((b)=>b.dispose())]),await V.close(),await W.drainQuotaPublications(),W.close()})(),R};try{O.push(await P.install($)),O.push(await T.install($)),O.push(await k2($,SX({isActive:()=>N,readMode:L.readMode,runtime:W})));let b={host:"opencode",dispatch:U.dispatch,readStatus:(n)=>U.readStatus(n),readAccounts:()=>W.read(),readMode:L.readMode,disconnectVault:L.disconnectVault,interactive:!0},i=CX(b);return O.push(await v$($,i,U)),m}catch(b){throw await m(),b}}var dJ={id:A2,setup:d2().setup,server:m$};export{h$ as setupAnthropicAuth,dJ as default,d2 as createAnthropicAuthPlugin,A2 as ANTHROPIC_AUTH_PLUGIN_ID};
+import{a as k2,b as h$,c as l$,d as W$,e as Q$,f as D2,g as R2,h as H$,i as U$,j as d$,k as B$,l as K$,m as M$,n as z$,o as _$,p as s$}from"../index-0tb7qc58.js";import"../index-6chd6jnr.js";import"../index-hazrk5c3.js";import{u as n$}from"../index-jvhs8sxv.js";import{v as i$,w as c$,y as o$}from"../index-0kxy8k2c.js";import"../index-b1dvkp15.js";import"../index-20d6rmjj.js";import"../index-ppdrzs41.js";import"../index-62x1p34p.js";import{acquireNativeAccountRuntime as xX,authorize as AX,createNativeUi as qX,disconnectNativeVaultForHost as kX,exchange as DX,logger as u$,readNativeEnrollmentMode as bX,resolveNativePoolPaths as wX}from"@cortexkit/anthropic-auth-core";class O2 extends Error{kind;providerID;sessionID;requestKind;constructor(X){super(X.message??`${X.providerID} ${X.requestKind} request refused (${X.kind})`);this.name="OpenCode2AuthError",this.kind=X.kind,this.providerID=X.providerID,this.sessionID=X.sessionID,this.requestKind=X.requestKind}}function M2(X){return`common-auth-placeholder.${X}`}function $$(X){let J=M2(X.integrationID);return{type:"oauth",methodID:X.methodID,access:J,refresh:J,expires:X.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function v2(X,J){if(X?.type!=="oauth")return!1;let M=J===void 0?void 0:M2(J),V=(F)=>M===void 0?F.startsWith("common-auth-placeholder."):F===M;return V(X.access)&&V(X.refresh)}var X$="No browser sign-in: this connects the plugin to the accounts in its vault.";async function h2(X,J){let M=J.now??Date.now,{integrationID:V}=J,F=(T)=>$$({integrationID:V,methodID:T,now:M()}),L=async(T,K)=>{return await J.onLogin(T,{integrationID:V,methodID:K}),F(K)},P=(T)=>async(K)=>{let Y=T.method.id,B=await T.authorize(K),W={url:B.url,instructions:B.instructions,...B.expiresAt===void 0?{}:{expiresAt:B.expiresAt}};if(B.mode==="auto")return{...W,mode:"auto",callback:B.callback.then((O)=>L(O,Y))};let U=B.callback;return{...W,mode:"code",callback:async(O)=>L(await U(O),Y)}};return X.integration.transform((T)=>{let K=J.label===void 0?{}:{label:()=>J.label};for(let W of J.methods)T.method.update({integrationID:V,method:W.method,authorize:P(W),refresh:async(U)=>{if(!v2(U,V))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return F(U.methodID)},...K});let Y=J.vault;if(Y===void 0)return;let B=Y.method.id;T.method.update({integrationID:V,method:Y.method,authorize:async()=>({url:"",instructions:Y.instructions??X$,mode:"auto",callback:Promise.resolve().then(()=>Y.activate({integrationID:V,methodID:B})).then(()=>F(B))}),refresh:async(W)=>{if(!v2(W,V)||W.methodID!==B)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return F(B)},...K})})}function a$(X){let J=[],M;for(let V of X.split(/\r?\n/))if(V.startsWith("data:"))J.push(V.slice(5).replace(/^ /,""));else if(V.startsWith("event:"))M=V.slice(6).trim();if(J.length===0)return;return M===void 0?{data:J.join(`
+`)}:{event:M,data:J.join(`
+`)}}function m2(X,J){let M=new TextDecoder,V="",F=(P)=>{let T=a$(P);if(!T)return;try{X(T)}catch(K){J(K)}},L=()=>{for(;;){let P=/\r?\n\r?\n/.exec(V);if(!P)return;let T=V.slice(0,P.index);V=V.slice(P.index+P[0].length),F(T)}};return new TransformStream({transform(P,T){T.enqueue(P),V+=M.decode(P,{stream:!0}),L()},flush(){if(V+=M.decode(),L(),V.trim()!=="")F(V);V=""}})}var J$=512,L2="x-common-auth-attempt",z2=(X,J)=>JSON.stringify([X,J]),Q2=(X)=>({providerID:X.model.providerID,modelID:X.model.id,sessionID:X.sessionID,agent:X.agent,kind:X.kind});function t$(X){let J=X.headers;return typeof J==="object"&&J!==null}function e$(X,J){let M=X.getReader();return new ReadableStream({async pull(V){let F;try{F=await M.read()}catch(L){J({reason:"failed",message:L instanceof Error?L.message:String(L)}),V.error(L);return}if(F.done)J(),V.close();else V.enqueue(F.value)},async cancel(V){J({reason:"cancelled",...V===void 0?{}:{message:String(V)}}),await M.cancel(V)}})}function l2(X,J){for(let[M,V]of Object.entries(J)){let F=M.toLowerCase();for(let L of Object.keys(X))if(L.toLowerCase()===F)delete X[L];if(V!==null)X[M]=V}}function $1(X,J){for(let[M,V]of Object.entries(J))if(V===null)X.delete(M);else X.set(M,V)}async function d2(X,J,M={}){let{providerID:V}=J,F=M.gateOnPlaceholder,L=($)=>F===void 0||F.credential($)===M2(V),P=M.logger,T=Math.max(1,M.maxRecords??J$),K=[...M.hostCredentials??[M2(V)],...F?[M2(V)]:[]].filter(($)=>$!==""),Y=new Map,B=new WeakMap,W=new Map,U=new Set,O=new Map,q=!1,A=!1,m=new Map,w=0,c=!1,r=new Map,o=($,Q)=>{try{P?.warn($,Q)}catch{}},s=($)=>$ instanceof Error?$.message:String($),Z=new Map,j=($,Q)=>{let _=(Z.get($)??Promise.resolve()).then(Q),C=_.then(()=>{},()=>{});return Z.set($,C),C.then(()=>{if(Z.get($)===C)Z.delete($)}),_},G=($,Q)=>{let _=Z.get($);return _?_.then(()=>G($,Q)):Q()},x=async($)=>{try{await J.dropChoice?.({...$.input,accountId:$.accountId})}catch(Q){o("opencode2 auth dropChoice threw; the request is unaffected",{sessionID:$.input.sessionID,error:s(Q)})}},E=($)=>{let Q=W.get($);if(W.delete($),Q?.next){let _=Q.next;j(Q.sessionID,()=>x(_))}},D=async($,Q)=>{let _=m.get($);if(!_||_.size===0)return;await Promise.all([..._].map(async(C)=>{try{await C(Q)}catch(f){o("opencode2 auth listener threw; the request is unaffected",{event:$,error:s(f)})}}))},y=async($,Q)=>{try{await J.onAttemptEnd?.($,Q)}catch(_){o("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:$.attemptId,error:s(_)})}},l=($,Q)=>{if($.ended||!$.attempt)return;let _={...$.status===void 0?{}:{status:$.status},outputStarted:$.outputStarted,...$.limit?{limit:$.limit.signal}:{},...Q?{error:Q}:{}};if(Q)$.endError=Q;$.ended=y($.attempt,_)},p=($,Q)=>l($,{reason:"abandoned",message:Q}),I=($)=>[...Y.values()].filter((Q)=>Q.key===$),u=($)=>I($).at(-1),d=($)=>{if(Y.delete($.id),W.get($.key)?.attemptId===$.id||!I($.key).length)E($.key)},H=($)=>{Y.set($.id,$);while(Y.size>T){let Q=Y.values().next().value;if(Q===void 0)break;p(Q,"dropped to keep the record bound"),d(Q)}},z=($)=>$.accountId===void 0?void 0:{...$.scope,accountId:$.accountId},N=($,Q)=>new O2({kind:"no-account",providerID:V,sessionID:$.sessionID,requestKind:$.kind,...Q===void 0?{}:{message:Q}}),S=($)=>{r.get($)?.clear(),r.delete($)},R=async($,Q)=>{let _=()=>N($,`${V} ${$.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(c)throw _();let C=r.get($.sessionID);if(!C)C=new Set,r.set($.sessionID,C);let f={};C.add(f);let v=()=>{if(!C.has(f))throw _()};try{return await Q(v)}finally{if(C.delete(f),C.size===0&&r.get($.sessionID)===C)r.delete($.sessionID)}},b=($,Q)=>{for(let[_,C]of Q)if(K.some((f)=>C.includes(f)))throw new O2({kind:"host-credential-on-wire",providerID:V,sessionID:$.sessionID,requestKind:$.kind,message:`${V} ${$.kind} request still carries the host's placeholder credential in ${_}; the adapter's account headers must replace it`})},g=($)=>{for(let Q of I($))if(Q.ended||!Q.attempt)d(Q);else if(Q.transport==="ws"||Q.judged)p(Q,"a newer attempt of its session and kind began"),d(Q)},n=async($,Q,_,C)=>{let f=z2($.sessionID,$.kind),{input:v,accountId:k}=await G($.sessionID,async()=>{_();let e=W.get(f);W.delete(f);let N2=e?.accountId??u(f)?.accountId;g(f);let X2=e?.next,T2=X2!==void 0&&X2.input.modelID===$.modelID&&X2.input.agent===$.agent,U2={...$,phase:"request",...N2===void 0?{}:{previousAccountId:N2},...e?.rerouteFrom?{rerouteFrom:e.rerouteFrom}:{}};if(X2&&!T2)await j($.sessionID,()=>x(X2)),_();let A2=T2?X2.accountId:await J.chooseAccount(U2);return{input:U2,accountId:A2}});_();let h={},a;if(k!==void 0){let e=await J.accountHeaders({...$,accountId:k});if(_(),t$(e))h=e.headers,a=e.attempt;else h=e}let W2=`attempt-${++w}`,G2={id:W2,key:f,scope:$,accountId:k,headers:h,attempt:k===void 0?void 0:{...$,accountId:k,attemptId:W2,transport:C,data:a},...C===void 0?{}:{transport:C},outputStarted:!1};if(H(G2),G2.attempt)D("select",{...$,accountId:G2.attempt.accountId,hook:Q,...v.previousAccountId===void 0?{}:{previousAccountId:v.previousAccountId},...v.rerouteFrom===void 0?{}:{rerouteFrom:v.rerouteFrom},handle:G2.attempt});return G2},i=async($,Q,_,C,f)=>{let v=z2($.sessionID,$.kind),k=C===void 0?void 0:Y.get(C);if(k?.key!==v)k=void 0;if(!k){if(k=u(v),I(v).filter((a)=>a.transport===void 0&&!a.ended).length>1&&!A)A=!0,o("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:$.sessionID,kind:$.kind})}if(!k||k.transport!==void 0||k.ended)k=await n($,Q,f,_);else if(k.transport=_,k.attempt)k.attempt.transport=_;if(_==="ws"){for(let h of I(v))if(h!==k&&h.transport==="ws")p(h,"a newer attempt of its session and kind went out over WebSocket")}return k},J2=async($,Q)=>{try{return await Q()}catch(_){throw l($,{reason:"failed",message:s(_)}),_}},V2=($,Q)=>{let _=I(z2($,Q)).filter((C)=>C.transport==="ws").at(-1);return _?.attempt!==void 0&&!_.ended?_:void 0},Z2=($,Q,_)=>{let C=z($);if(!C||!$.attempt||$.limit)return;$.limit={signal:Q,delivered:D("limit",{...C,via:_,limit:Q,outputStarted:$.outputStarted,handle:$.attempt})}},C2=($,Q,_,C)=>{let f=z($);if(!f||!$.attempt)return;D("quota",{...f,transport:Q,...C===void 0?{}:{status:C},quota:_,handle:$.attempt})},$2=($,Q,_,C)=>{let f=$.attempt;if(!f)return;let v=J.inspectEvent?.(C===void 0?{transport:Q,data:_,attempt:f}:{transport:Q,data:_,event:C,attempt:f});if(!v)return;if(v.quota!==void 0)C2($,Q,v.quota);if(v.outputStarted)$.outputStarted=!0;if(v.limit)Z2($,v.limit,Q);if(v.error!==void 0)l($,{reason:"failed",message:v.error});else if(v.done)l($)},t=($,Q)=>{let _=$.attempt;if(!_||Q.accountId===$.accountId)return;if(_.reboundFrom??=_.accountId,_.accountId=Q.accountId,"data"in Q)_.data=Q.data;$.accountId=Q.accountId},B2=($)=>!$.attempt||$.endError!==void 0||$.status!==void 0&&$.status>=400,K2=($)=>{let Q=[...Y.values()].filter((h)=>h.scope.sessionID===$),_=Q.filter((h)=>h.limit&&!h.rerouted).at(-1);if(_)return _;let C=Q.filter((h)=>h.scope.kind==="primary"),f=C.length>0?C:Q;if(f.length<=1)return f[0];let v=f.filter((h)=>!h.judged&&B2(h)).at(-1);if(v)return v;let k=f.filter((h)=>h.attempt&&!h.ended);if(k.length>1)return"ambiguous";return k[0]??f.at(-1)},Y2={providerID:V},j2=[];j2.push(await X.session.hook("model.request",($)=>{if(F)return;return R(Q2($),async(Q)=>{let _=await n(Q2($),"model.request",Q);if(Q(),_.accountId===void 0)throw N(_.scope);l2($.headers,{..._.headers,[L2]:_.id})})},Y2)),j2.push(await X.session.hook("http.request",($)=>{if(F){let Q=L($.request.headers);if(O.set($.sessionID,Q),!Q)return}return R(Q2($),async(Q)=>{let _=$.request.headers.get(L2)??void 0,C=F?await n(Q2($),"http.request",Q,"http"):await i(Q2($),"http.request","http",_,Q);Q();let f=z(C),v=C.attempt;if(!f||!v)throw N(C.scope);await J2(C,async()=>{let k=$.request;if(J.rewriteRequest){if(_!==void 0){let W2=new Headers(k.headers);W2.delete(L2),k=new Request(k,{headers:W2})}k=await J.rewriteRequest({...f,request:k,attempt:v})??k,Q()}let h=new Headers(k.headers);h.delete(L2),$1(h,C.headers),b(C.scope,h.entries());let a=new Request(k,{headers:h});B.set(a,C),$.request=a})})},Y2)),j2.push(await X.session.hook("http.response",async($)=>{let Q=B.get($.request);if(!Q){if(F)return;if(!q)q=!0,o("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:$.sessionID,kind:$.kind});return}let _=$.response;if(J.answeredBy&&Q.attempt){let h=Q.attempt,a=await J2(Q,async()=>J.answeredBy?.({request:$.request,response:_,attempt:h}));if(a)t(Q,a)}let C=z(Q),f=Q.attempt;if(!C||!f)return;Q.status=_.status;let v=J.quotaFromHeaders?.(_.headers,_.status,f);if(v!==void 0)C2(Q,"http",v,_.status);if(!_.ok&&J.limitFromResponse){let h=await J.limitFromResponse({status:_.status,headers:_.headers,body:()=>_.clone().text(),attempt:f});if(h)Z2(Q,h,"http")}if(!_.ok||!_.body)l(Q);let k=_;if(_.body&&(J.inspectEvent||J.onAttemptEnd)){let h=_.body;if(J.inspectEvent)h=h.pipeThrough(m2((a)=>$2(Q,"http",a.data,a.event),(a)=>o("opencode2 auth event inspection threw",{error:s(a)})));k=new Response(e$(h,(a)=>l(Q,a)),{status:_.status,statusText:_.statusText,headers:_.headers})}if(J.rewriteResponse)k=await J.rewriteResponse({...C,request:$.request,response:k,attempt:f})??k;if(k!==_)$.response=k},Y2)),j2.push(await X.session.hook("experimental.ws.handshake",($)=>{if(F){let Q=L(new Headers($.headers)),_=z2($.sessionID,$.kind);if(O.set($.sessionID,Q),U.delete(_),!Q)return}return R(Q2($),async(Q)=>{let _;for(let k of Object.keys($.headers)){if(k.toLowerCase()!==L2)continue;_??=$.headers[k],delete $.headers[k]}let C=F?await n(Q2($),"experimental.ws.handshake",Q,"ws"):await i(Q2($),"experimental.ws.handshake","ws",_,Q);Q();let f=z(C),v=C.attempt;if(!f||!v)throw N(C.scope);await J2(C,async()=>{l2($.headers,C.headers);let k=J.rewriteHandshakeURL?.({...f,url:$.url,attempt:v});if(k!==void 0)$.url=k;if(b(C.scope,Object.entries($.headers)),F)U.add(C.key)})})},Y2));let H2=J.rewriteWebSocketFrame?.bind(J);if(H2)j2.push(await X.session.hook("experimental.ws.send",async($)=>{let Q=Q2($);if(F&&!U.has(z2(Q.sessionID,Q.kind)))return;let _=V2(Q.sessionID,Q.kind),C=await H2({...Q,attempt:_?.attempt,frame:$.frame});if(C!==void 0)$.frame=C},Y2));j2.push(await X.session.hook("experimental.ws.receive",($)=>{if(F&&!U.has(z2($.sessionID,$.kind)))return;let Q=V2($.sessionID,$.kind);if(!Q)return;try{$2(Q,"ws",$.frame)}catch(_){o("opencode2 auth frame inspection threw",{error:s(_)})}},Y2)),j2.push(await X.session.hook("retry",async($)=>{if(F&&O.get($.sessionID)!==!0)return;let Q=K2($.sessionID);if(!Q)return;let _=$.decision;if(Q==="ambiguous"){await D("retry",{sessionID:$.sessionID,attempt:$.attempt,reason:"host-decides",hostDecision:_,decision:_});return}let C=Q;await R(C.scope,async(f)=>{let v=f;C.judged=!0;let k=C.attempt;if(k&&!C.outputStarted){if(!C.limit){let W2=J.limitFromError?.($.error,k);if(W2)Z2(C,W2,"error")}if(C.ended)await C.ended;if(C.limit)await C.limit.delivered}v();let{decision:h,reason:a}=await j(C.scope.sessionID,async()=>{v();let W2=W.get(C.key);if(W.delete(C.key),W2?.next)await x(W2.next);v();let G2=_,e,N2,X2;if(C.accountId===void 0||!k)G2={retry:!1},e="no-account";else if(C.outputStarted)G2={retry:!1},e="output-started";else if(C.limit){let T2={accountId:C.accountId,limit:C.limit.signal},U2,A2={...C.scope,phase:"retry",previousAccountId:C.accountId,rerouteFrom:T2};try{U2=await J.chooseAccount(A2)}catch(g2){o("opencode2 auth chooseAccount threw while the retry hook looked for another account; the host decides the retry",{sessionID:C.scope.sessionID,error:s(g2)})}if(U2!==void 0)X2={accountId:U2,input:A2};try{v()}catch(g2){if(X2)await x(X2);throw g2}if(U2!==void 0&&U2!==C.accountId)C.rerouted=!0,N2=T2,G2={retry:!0,delay:0},e="reroute";else e="host-decides-last-account"}else e="host-decides";if($.decision=G2,G2.retry&&C.accountId!==void 0&&Y.has(C.id))W.set(C.key,{attemptId:C.id,sessionID:C.scope.sessionID,accountId:C.accountId,...N2===void 0?{}:{rerouteFrom:N2},...X2===void 0?{}:{next:X2}});else if(X2)await x(X2);return{decision:G2,reason:e}});v(),await D("retry",{sessionID:$.sessionID,...C.accountId===void 0?{}:{accountId:C.accountId},kind:C.scope.kind,attempt:$.attempt,reason:a,hostDecision:_,decision:h,...k===void 0?{}:{handle:k}})})},Y2));let t2=($)=>{S($),O.delete($);for(let Q of U)if(JSON.parse(Q)[0]===$)U.delete(Q);for(let Q of[...Y.values()]){if(Q.scope.sessionID!==$)continue;p(Q,"its session was forgotten"),Y.delete(Q.id)}for(let[Q,_]of W)if(_.sessionID===$)E(Q)},f2=new AbortController,e2=X.event;if(e2)(async()=>{try{for await(let $ of e2.subscribe({signal:f2.signal}))if($.type==="session.deleted")t2($.data.sessionID)}catch($){if(!f2.signal.aborted)o("opencode2 auth stopped listening for session deletion",{error:s($)})}})();return{on($,Q){let _=m.get($);if(!_)_=new Set,m.set($,_);let C=Q;return _.add(C),()=>{_.delete(C)}},accountFor($,Q){return u(z2($,Q))?.accountId},forgetSession:t2,get size(){return Y.size},async dispose(){if(c)return;c=!0;for(let $ of r.keys())S($);f2.abort();for(let $ of Y.values())p($,"the installation was disposed");Y.clear();for(let $ of W.keys())E($);U.clear(),O.clear(),m.clear(),await Promise.all(Z.values()),await Promise.all(j2.map(async($)=>{try{await $.dispose()}catch(Q){o("opencode2 auth hook did not dispose cleanly",{error:s(Q)})}}))}}}import{CacheKeepManager as R1,CacheKeepSessionRegistry as x1,getDefaultCacheKeepRegistryDirectory as A1,isCacheKeepActiveNow as F$,isCacheKeepHybridActive as i2,isCacheKeepSubagentsEnabled as c2,logger as q1}from"@cortexkit/anthropic-auth-core";import{createHash as X1}from"node:crypto";import{applyCustomHeaders as J1,assertNotCustodyTombstone as Z1,classifyGzipRejection as Y1,createProviderErrorRedactor as Z$,createProviderErrorResponseScope as Y$,decideRequestGzip as G1,encodeGzipRequestBody as V1,getAccountStoragePath as j1,getRequestGzipLatch as W1,getRequestGzipLatchPath as Q1,mergeAnthropicBetas as H1,remapModelId as G$,remapRequestBodyModel as U1,stripEmptyTrailingAssistantMessages as B1,TrailingAssistantHistoryError as K1}from"@cortexkit/anthropic-auth-core";var S2="anthropic",C$="x-common-auth-attempt",M1=["x-session-affinity","x-opencode-session","x-parent-session-id",W$,k2,R2,C$],q2=new Set(["authorization","x-api-key"]),z1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",_1=512,C1=5000,N1=500,V$=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class N$ extends Error{sessionID;requestKind;kind="no-account";providerID=S2;constructor(X,J){super(z1);this.sessionID=X;this.requestKind=J;this.name="NativeAnthropicNoAccountError"}}class u2 extends Error{sessionID;requestKind;kind="session-forgotten";providerID=S2;constructor(X,J){super("request refused: its session was closed while it was being prepared");this.sessionID=X;this.requestKind=J;this.name="NativeAnthropicRevokedError"}}class F2 extends Error{kind="unsupported-transport";providerID=S2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class L$ extends Error{kind="local-invalid-request";status=400;check;constructor(X){super(X.message,{cause:X});this.name="NativeAnthropicLocalRefusal",this.check=X.check}}var _2=(X)=>typeof X==="object"&&X!==null&&!Array.isArray(X);function E2(X){try{return JSON.parse(X)}catch{return}}function p2(X){let J={};for(let[M,V]of Object.entries(X??{}))J[M.toLowerCase()]=V;return J}function j$(X){let J={};for(let M of M1){let V=X.get(M);if(V!==null&&M!==C$)J[M]=V;X.delete(M)}return J}function L1(X){try{return new URL(X).pathname.endsWith("/messages")}catch{return!1}}function F1(X){return X instanceof K1||X instanceof Q$?new L$(X):void 0}function P1(X,J){let M=[];if(X.oauth)M.push(X.oauth.accessToken);for(let[V,F]of Object.entries(X.apiHeaders??{})){if(F===null||!q2.has(V))continue;M.push(F.replace(/^Bearer\s+/i,""))}for(let V of q2){let F=J.get(V);if(F!==null)M.push(F.replace(/^Bearer\s+/i,""))}if(X.dispatch?.kind==="http-relay")M.push(X.dispatch.token);return[...new Set(M.filter(Boolean))]}var T1=new Set(["oauth-2025-04-20","claude-code-20250219",U$]);function O1(X){let J=X.split(",").map((M)=>M.trim()).filter((M)=>M&&!T1.has(M));return H1(null,J)}function E1(X){let J=E2(X);if(!_2(J))return X;let M=B1(J.messages),V=Object.hasOwn(J,"fallbacks"),{droppedMarkers:F}=B$(J,!1),L=V&&!Object.hasOwn(J,"fallbacks"),P=U1(J);return M>0||F>0||L||P?JSON.stringify(J):X}async function S1(X,J){if(!(X instanceof Promise))return"settled";let M;try{return await Promise.race([X.then(()=>"settled"),new Promise((V)=>{M=setTimeout(()=>V("timed-out"),J)})])}finally{if(M!==void 0)clearTimeout(M)}}function P2(X){let{source:J,log:M}=X,V=Math.max(1,X.maxPendingSends??_1),F=X.attemptEndTimeoutMs??C1,L=X.requestGzipLatch??W1(Q1(j1())),P=new WeakSet,T=new Map,K=new WeakMap,Y=new WeakMap,B=new WeakMap,W=new Map,U=new WeakMap,O=Z$([]);O.dispose();let q=(H)=>(H&&W.get(H)?.redactor)??O,A=(H)=>{let z=W.get(H);if(!z)return;W.delete(H),z.redactor.dispose(),z.scope.dispose()},m=(H,z,N,S)=>{let R=P1(z,S),b=Y$(R,N);w.set(H,N),W.set(H,{sessionID:z.sessionID,redactor:Z$(R),scope:b}),b.settled.then(()=>A(H));while(W.size>V){let g=W.keys().next().value;if(g===void 0)break;A(g)}},w=new WeakMap,c=(H,z)=>{let N=H?w.get(H):void 0;if(!N||!z.ok)return O.redactResponse(z);let S=Y$([],N),R=S.redactResponse(z);return S.dispose(),R},r=(H,z)=>{let N=H?W.get(H)?.scope:void 0;if(!N)return c(H,z);try{return N.redactResponse(z)}catch{return c(H,z)}},o=!1,s=new WeakMap,Z=(H,z)=>{if(H&&!z.ok)s.set(z.headers,H);return z},j=(H,z)=>{if(z.dispatch!=="http-relay")return!0;let N=/^req_[A-Za-z0-9_-]+$/.test(H.get("request-id")??"");return Y.set(z,N),N},G=(H)=>new N$(H.sessionID,H.kind),x=new Map,E=async(H,z)=>{if(o)throw new u2(H.sessionID,H.kind);let N={revoked:!1},S=x.get(H.sessionID);if(!S)S=new Set,x.set(H.sessionID,S);S.add(N);let R=()=>{if(o||N.revoked)throw new u2(H.sessionID,H.kind)};try{let b=await z(R);return R(),b}finally{let b=x.get(H.sessionID);if(b?.delete(N)&&b.size===0)x.delete(H.sessionID)}},D=(H,z)=>{T.set(H,z);while(T.size>V){let N=T.keys().next().value;if(N===void 0)break;T.delete(N),M?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:V})}},y=(H,z)=>({providerID:H.providerID,modelID:H.modelID,sessionID:H.sessionID,agent:H.agent,kind:H.kind,accountId:H.accountId,attemptId:H.attemptId,transport:H.transport,route:z.route,provenance:z.provenance,dispatch:z.dispatch}),l=(H)=>E(H,async(z)=>{let{accountId:N,...S}=H,R=await J.authorizeAccount(S,N);return z(),p(S,R)}),p=(H,z)=>{if(!z)throw G(H);if(z.dispatch?.kind==="websocket-relay")throw new F2;let N=z.dispatch?.kind==="http-relay"?"http-relay":"direct",S=z.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":z.dispatch.token}:void 0;if(z.route==="oauth"){if(!z.accessToken)throw G(H);Z1(z.accessToken,S2);let g=Object.freeze({route:"oauth",provenance:z.provenance,dispatch:N});D(g,{sessionID:H.sessionID,oauth:{accessToken:z.accessToken,...z.identity?{identity:z.identity}:{}},dispatch:z.dispatch,oauthHeaders:z.headers});let n=p2(z.headers);for(let i of q2)delete n[i];return delete n["anthropic-beta"],{headers:S??{...n,"x-api-key":null,authorization:`Bearer ${z.accessToken}`},attempt:g}}let R={authorization:null,"x-api-key":null,...p2(z.headers)};if(!R.authorization&&!R["x-api-key"])throw G(H);let b=Object.freeze({route:"api",provenance:z.provenance,dispatch:N});return D(b,{sessionID:H.sessionID,...z.baseURL?{baseURL:z.baseURL}:{},dispatch:z.dispatch,apiHeaders:R}),{headers:S??R,attempt:b}},I=(H)=>E(H,(z)=>u(H,z)),u=async(H,z)=>{let{request:N,attempt:S}=H,R=S.data,b=R?T.get(R):void 0;if(R)T.delete(R);if(!R||!b||R.route==="oauth"&&!b.oauth)throw G(H);let g=new Headers(N.headers);J1(g);let n=j$(g),i=N.body===null?void 0:await N.text();z();let J2=i!==void 0&&L1(N.url);try{if(R.route==="oauth"&&b.oauth){let{accessToken:$2,identity:t}=b.oauth;for(let[K2,Y2]of Object.entries(p2(b.oauthHeaders))){if(q2.has(K2))continue;if(Y2===null)g.delete(K2);else g.set(K2,Y2)}let B2=null;if(i!==void 0&&J2){let K2={...y(S,R),modelID:(()=>{let H2=E2(i);return G$(_2(H2)&&typeof H2.model==="string"?H2.model:H.modelID)})(),route:"oauth",correlation:n},Y2=await J.requestOptions?.(K2)??{};z(),i=await z$(i,{...Y2,...t?{identity:t}:{},sessionId:H.sessionID,onToolNameMap:(H2)=>B.set(R,H2)});let j2=E2(i);B2=_2(j2)?j2:null}K$(g,$2,{body:B2,...t?{identity:t}:{},requestClass:H$(S.agent)?"auxiliary":"main"})}else{if(i!==void 0&&J2)i=E1(i);g.delete("authorization"),g.delete("x-api-key");for(let[t,B2]of Object.entries(b.apiHeaders??{}))if(B2===null)g.delete(t);else g.set(t,B2);if(i!==void 0&&J2&&!g.has("content-type"))g.set("content-type","application/json");let $2=g.get("anthropic-beta");if($2!==null){let t=O1($2);if(t)g.set("anthropic-beta",t);else g.delete("anthropic-beta")}}}catch($2){let t=F1($2);if(!t)throw $2;throw K.set(R,t.check),M?.warn("refused an Anthropic request locally; nothing was sent",{check:t.check}),t}let V2=i!==void 0?E2(i):void 0;if(await J.admitRequest?.({...y(S,R),modelID:G$(_2(V2)&&typeof V2.model==="string"?V2.model:H.modelID)}),j$(g),i!==void 0)g.delete("content-length");z(),m(R,b,_2(V2)&&V2.stream===!0?"event-stream":"http",g);let Z2=M$(N.url,b.baseURL!==void 0?{baseURL:b.baseURL}:{}).url?.toString()??N.url;if(R.route==="oauth"&&J2&&i!==void 0)await J.onRequestPrepared?.({...y(S,R),url:Z2,bodyText:i}),z();if(b.dispatch?.kind==="http-relay"){let $2=i??"";g.delete("x-relay-token");let t={protocol:1,type:"request",affinity:H.sessionID,upstream:{url:Z2,method:N.method,headers:Object.fromEntries(g)},mode:"full_sync",revision:1,body:$2,next_hash:`sha256:${X1("sha256").update($2).digest("hex")}`};return new Request(b.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":b.dispatch.token},redirect:"error",signal:N.signal,body:JSON.stringify(t)})}let C2=i;if(R.route==="oauth"&&J2&&i!==void 0){let $2=await G1({url:Z2,body:i,latch:L});if(z(),$2.gzip)C2=await V1(i),g.set("content-encoding","gzip"),P.add(R),z()}return new Request(Z2,{method:N.method,headers:g,redirect:N.redirect,signal:N.signal,...C2!==void 0?{body:C2}:{}})};return{adapter:{providerID:S2,chooseAccount:(H)=>E(H,async()=>{let z=await J.chooseAccount(H);if(!z)throw G(H);return z}),dropChoice:(H)=>J.dropChoice?.(H),accountHeaders:l,rewriteRequest:I,rewriteHandshakeURL(){throw new F2},rewriteResponse({response:H,attempt:z}){let N=z.data;if(N&&!j(H.headers,N)){if(H.status===401)return A(N),H.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return r(N,H)}if(N&&P.has(N))P.delete(N),Y1(H).then((n)=>{if(!n)return;L.latchProcess(),M?.warn("gzipped request body rejected; later requests go uncompressed",{kind:n,status:H.status})},()=>{});let S=r(N,H);if(N?.route!=="oauth"||!S.body)return Z(N,S);let R={...y(z,N),status:H.status},b=J.responseOptions?.(R)??{},g=(H.headers.get("content-type")??"").includes("application/json");return Z(N,_$(S,{...b,toolNameMap:B.get(N),onToolNameRefusal:()=>{K.set(N,"response_tool_names"),A(N)},laneStartOAuthServed:!0,...g?{responseMode:"json"}:{}}))},quotaFromHeaders(H,z,N){let S=N.data;if(!S||!j(H,S))return;return J.quotaFromHeaders?.(H,{...y(N,S),status:z})},async limitFromResponse({status:H,headers:z,body:N,attempt:S}){let R=S.data;if(!R||K.get(R)==="response_tool_names")return;if(!j(z,R))return J.limitFromRelayFailure?.({...y(S,R),status:H});if(U.set(R,`provider responded with HTTP ${H}`),!J.limitFromResponse)return;let b=s.get(z)===R,g=q(R);return J.limitFromResponse({...y(S,R),status:H,headers:z,body:async()=>b?await N():g.redactText(await N())})},inspectEvent({data:H,event:z,attempt:N}){if(N.data&&K.get(N.data)==="response_tool_names")return;let S=E2(H);if(!_2(S))return;let R=typeof S.type==="string"?S.type:z;if(R==="content_block_start"||R==="content_block_delta")return{outputStarted:!0};if(R==="message_stop")return{done:!0};if(R!=="error")return;let b=N.data,g=q(b),n=_2(S.error)?S.error:{},i=typeof n.type!=="string"?void 0:V$.has(n.type)?n.type:g.redactText(n.type),J2=typeof n.message==="string"?g.redactText(n.message):void 0;if(b?.dispatch==="http-relay"&&Y.get(b)===!1)return;let V2=b?J.limitFromStreamError?.({...y(N,b),errorType:i,message:J2}):void 0,Z2={error:[i??"error",J2].filter(Boolean).join(": ").slice(0,N1),...V2?{limit:V2}:{}};if(b&&Z2.error)U.set(b,Z2.error);return Z2},limitFromError(H,z){let N=z.data;if(!N||K.has(N))return;let S={type:V$.has(H.type)?H.type:"provider_error",message:U.get(N)??"provider request failed",...H.status!==void 0?{status:H.status}:{}};if(A(N),N.dispatch==="http-relay"&&Y.get(N)===!1)return;return J.limitFromHostError?.(S,y(z,N))},async onAttemptEnd(H,z){let N=H.data;if(!N)return;T.delete(N);let S=z.error?.reason;if(S==="cancelled"||S==="abandoned"||S===void 0&&(z.status===void 0||z.status<400))A(N);let R=K.get(N),{status:b,...g}=z,n=J.onAttemptEnd?.(y(H,N),{...g,...b!==void 0&&(N.dispatch!=="http-relay"||Y.get(N)===!0)?{status:b}:{},...R!==void 0?{localRefusal:{check:R}}:{}});if(await S1(n,F)==="timed-out")M?.warn("the account source did not finish recording a send",{timeoutMs:F})}},dispose(){o=!0;for(let[H,z]of x){for(let N of z)N.revoked=!0;J.forgetSession?.(H)}x.clear(),T.clear();for(let H of[...W.keys()])A(H)},forgetSession(H){for(let z of x.get(H)??[])z.revoked=!0;x.delete(H);for(let[z,N]of T)if(N.sessionID===H)T.delete(z);for(let[z,N]of[...W])if(N.sessionID===H)A(z);J.forgetSession?.(H)},get pendingSendCount(){return T.size},get heldCredentialCount(){let H=0;for(let z of T.values())if(z.oauth)H++;return H},get heldRedactorCount(){return W.size},get operationsInProgress(){let H=0;for(let z of x.values())H+=z.size;return H}}}function x2(X){return JSON.stringify([X.source,X.accountIdentity,X.credentialId,X.binding?.storageId,X.binding?.rowId,X.binding?.credentialEpoch])}function P$(X){let{runtime:J,source:M}=X,V=new AbortController,F=!1,L=new x1({directory:X.registryDirectory||process.env.OPENCODE_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR||A1("opencode"),now:X.now}),P=new Map,T=async(W,U,O)=>{let q=O?AbortSignal.any([V.signal,O]):V.signal;q.throwIfAborted();let A=JSON.parse(await U.text()),m={providerID:"anthropic",modelID:A.model,sessionID:`oc2-cachekeep:${W.id}`,agent:"cachekeep",kind:"generate"},w=P2({source:{...M,onRequestPrepared:void 0,responseOptions:void 0,async requestOptions(Z){return{...await M.requestOptions?.(Z),laneStart:!1,billingLineage:void 0,cacheDiagnosticsPreviousMessageId:void 0}},async authorizeAccount(Z,j){let G=await J.read();q.throwIfAborted();let x=G.accounts.find((D)=>D.id===j);if(x?.type!=="oauth"||x2(x)!==W.oauthAccountIdentity||W.isSubagent&&!c2(G.policyStorage)||!i2(G.policyStorage)||!F$(G.policyStorage,new Date(X.now?.()??Date.now())))return;let E=await M.authorizeAccount(Z,j);if(E?.provenance.kind==="local"&&x2({...x,binding:E.provenance.subject.binding,accountIdentity:E.provenance.subject.binding.identity})!==W.oauthAccountIdentity)return;if(E?.provenance.kind==="vault"&&E.provenance.credentialId!==x.credentialId)return;return E},async admitRequest(Z){await M.admitRequest?.(Z);let j=await J.read(),G=j.accounts.find((x)=>x.id===Z.accountId);if(q.throwIfAborted(),!G||x2(G)!==W.oauthAccountIdentity||W.isSubagent&&!c2(j.policyStorage)||!i2(j.policyStorage)||!F$(j.policyStorage,new Date(X.now?.()??Date.now())))throw Error("CacheKeep policy changed before dispatch")}}}),c,r,o=!1,s=()=>w.forgetSession(m.sessionID);q.addEventListener("abort",s,{once:!0});try{let Z=(await J.read()).accounts.find((y)=>x2(y)===W.oauthAccountIdentity)?.id;if(!Z)throw Error("CacheKeep account is unavailable");let j=await w.adapter.accountHeaders({...m,accountId:Z});if(!("headers"in j)||typeof j.headers!=="object"||j.headers===null||typeof j.attempt!=="object"||j.attempt===null||j.attempt.route!=="oauth")throw Error("CacheKeep authorization refused");c={...m,accountId:Z,attemptId:crypto.randomUUID(),transport:"http",data:j.attempt};let G=await w.adapter.rewriteRequest?.({...m,accountId:Z,attempt:c,request:new Request(W.url,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(A),signal:q})});if(!G)throw Error("CacheKeep rewrite refused");q.throwIfAborted();let x=await(X.fetch??fetch)(G),E=await w.adapter.rewriteResponse?.({...m,accountId:Z,attempt:c,request:G,response:x});if(!E)throw Error("CacheKeep response rewrite refused");if(r=E.status,w.adapter.quotaFromHeaders?.(E.headers,E.status,c),!E.ok)await w.adapter.limitFromResponse?.({status:r,headers:E.headers,body:()=>E.clone().text(),attempt:c});let D=await E.arrayBuffer();return o=!0,new Response(D,{status:r,headers:E.headers})}catch{throw Error("Native CacheKeep was not completed")}finally{q.removeEventListener("abort",s);try{if(c)await w.adapter.onAttemptEnd?.(c,{status:r,outputStarted:!1,...o?{}:{error:{reason:"cancelled"}}})}finally{w.dispose(),M.forgetSession?.(m.sessionID)}}},K=X.setIntervalImpl??globalThis.setInterval,Y=new R1({loadStorage:async()=>F?null:(await J.read()).policyStorage,now:X.now,setIntervalImpl:(W,U)=>K(()=>Y.tick().catch(()=>{q1.warn("cachekeep","tick failed")}),U),clearIntervalImpl:X.clearIntervalImpl,onTrackedSessionsChanged:(W)=>L.publish(F?[]:W),prepareHeaders(W,U,O){if(F)return;return P.set(O.id,{target:U,attempt:O}),new Headers({"x-native-cachekeep-attempt":String(O.id)})},fetchImpl:async(W,U)=>{let O=new Request(W,U),q=Number(O.headers.get("x-native-cachekeep-attempt")),A=P.get(q);if(P.delete(q),!A)throw Error("CacheKeep attempt is unavailable");return T(A.target,O,A.attempt.signal)},onComplete:({attempt:W})=>{P.delete(W.id)}}),B;return{async track(W){if(F||W.route!=="oauth"||W.agent==="cachekeep"||W.agent==="prime"||W.kind!=="primary")return;let U=await J.read();if(F||!i2(U.policyStorage))return;let O=!1;try{O=await X.isSubagent?.(W.sessionID)??!1}catch{return}if(F||O&&!c2(U.policyStorage))return;let q=U.accounts.find((A)=>A.id===W.accountId);if(!q?.accountIdentity)return;if(W.provenance.kind==="local"&&JSON.stringify(q.binding)!==JSON.stringify(W.provenance.subject.binding))return;if(W.provenance.kind==="vault"&&q.credentialId!==W.provenance.credentialId)return;Y.track({sessionId:W.sessionID,url:W.url,headers:new Headers,bodyText:W.bodyText,storage:U.policyStorage,cacheMode:"hybrid",oauthAccountId:W.accountId,oauthAccountIdentity:x2(q),isSubagent:O}),await L.publish(Y.trackedSessions())},registry:L,dispose(){if(B)return B;return F=!0,Y.stop(),V.abort(),B=(async()=>{try{await Y.tick()}finally{P.clear(),await L.dispose()}})(),B}}}async function T$(X,J,M){let V=P2(J),F=[],L=async(U,O,q)=>{let A=await X.session.hook(U,O,q);return F.push(A),A},P=new AbortController,T;try{T=await d2({session:{hook:L},event:X.event},V.adapter,{logger:J.log,gateOnPlaceholder:M})}catch(U){throw V.dispose(),await Promise.allSettled(F.map((O)=>O.dispose())),U}let K=(U)=>{V.forgetSession(U),T.forgetSession(U)},Y=X.event,B=Y?(async()=>{try{for await(let U of Y.subscribe({signal:P.signal}))if(U.type==="session.deleted")K(U.data.sessionID)}catch(U){if(!P.signal.aborted)J.log?.warn("stopped listening for session deletion",{error:U instanceof Error?U.name:"unknown"})}})():Promise.resolve(),W;return{installation:T,forgetSession:K,dispose(){if(W)return W;return V.dispose(),P.abort(),W=(async()=>{await T.dispose(),await B})(),W}}}import{effectiveRelayTransport as O$,getQuotaCheckIntervalMs as k1,logger as D1,nativeAccountCanServe as b1,oauthProfileIsFresh as w1,quotaSnapshotCheckedAt as y1}from"@cortexkit/anthropic-auth-core";function E$(X,J){let M=new AbortController,V,F=!1,L=async()=>{let K=await X.read();if(M.signal.throwIfAborted(),K.policyStorage.relay?.enabled===!0&&O$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="websocket")return;let Y=K,B=k1(Y.policyStorage);for(let W of Y.accounts){if(M.signal.aborted)return;if(!b1(W)||W.type!=="oauth")continue;if(Y.policyStorage.quota?.enabled!==!1&&Date.now()-y1(W.quota)>=B)await X.fetchQuota(W.id,J,M.signal,void 0,"background").catch(()=>{});if(!w1(W.profile)&&!M.signal.aborted)await X.fetchProfile(W.id,J,M.signal).catch(()=>{})}},P=()=>{if(F||V)return V;return V=L().catch(()=>{if(!M.signal.aborted)D1.debug("opencode2","native background readings did not complete")}).finally(()=>{V=void 0}),V},T=X.vault.watch({intervalMs:60000,onRefresh:P,shouldRefresh:async()=>{let K=await X.read();return K.policyStorage.relay?.enabled!==!0||O$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="http"}});return T.ready.catch(()=>{}),{async dispose(){F=!0,T.close(),M.abort(),await V}}}import{authorize as c1,buildCacheKeepStatusSummary as o1,buildClaudeQuotaSummary as n1,buildPrimeAccountStatuses as r1,buildPrimeStatusSummary as s1,CLAUSTRUM_OPENCODE_ENROLLMENT_NAME as a1,exchange as t1,formatNativeAccountState as e1,formatOAuthAccountTier as $X,getCacheKeepWindow as XX,getHostClaustrumEnrollmentPaths as JX,isCacheKeepAlways as ZX,isCacheKeepHybridActive as YX,isCacheKeepPersistentlyEnabled as GX,nativeAccountCanServe as VX,resetClaustrumEnrollmentState as jX}from"@cortexkit/anthropic-auth-core";import{buildPrimeAccountStatuses as I1,effectiveRelayStatus as f1,formatNativeAccountState as g1,formatOAuthAccountTier as S$,getCacheKeepWindow as v1,getRoutingMode as h1,isCacheKeepAlways as m1,isCacheKeepHybridActive as l1,isPermanentRefreshError as d1,isPrimePersistentlyEnabled as p1,nativeAccountCanServe as A$,refreshBackoffActive as R$}from"@cortexkit/anthropic-auth-core";var x$=(X)=>A$(X)&&X.state!=="unsupported-access"?void 0:g1(X)||void 0,u1=(X)=>{if(X.source!=="vault")return"off";if(X.state==="needs_reauth")return"on-vault-reauth";return A$(X)?"on-vault-served":"on-cold"},i1=(X,J)=>typeof X==="number"&&X>J;function q$(X,J){let{now:M}=J,V=X.policyStorage,F=X.accounts.filter((B)=>B.type==="oauth"),L=F.find((B)=>B.id==="main"),P=L?x$(L):void 0,T=L?.lastQuotaRefreshError?.nextRetryAt,K=L?.lastRefreshError,Y=v1(V);return{main:{quota:L?.quota??null,enabled:L?.enabled,tierLabel:S$(L?.profile),quotaBackedOff:i1(T,M),quotaBackoffUntil:T,refreshBackedOff:R$(K,L?.accountIdentity,M,void 0),refreshBackoffUntil:K?.nextRetryAt,stateLine:P,quotaDated:Boolean(P)},fallbacks:F.filter((B)=>B.id!=="main"&&(B.enabled||B.source==="vault")).map((B)=>{let W=x$(B),U=u1(B);return{id:B.id,label:B.label,quota:B.quota??null,enabled:B.enabled,tierLabel:S$(B.profile),needsReauth:d1(B.lastRefreshError)&&R$(B.lastRefreshError,B.accountIdentity,M,void 0),...U==="on-vault-reauth"?{vaultReauth:!0}:{},...U==="on-vault-served"?{vaultServed:!0}:{},...U!=="off"?{custodyState:U}:{},stateLine:W,quotaDated:Boolean(W)}}),activeId:J.activeId,route:h1(V),relay:f1(V.relay),fastMode:V.claudeFast?.enabled===!0,cacheKeep:{enabled:l1(V),window:m1(V)?"always":Y?`${Y.startHour}-${Y.endHour}`:void 0,trackedSessions:J.trackedSessions},prime:p1(V)?{enabled:!0,accounts:I1(V,{now:M})}:void 0,lastUpdated:M}}var o2=(X)=>X!==null&&typeof X==="object"&&!Array.isArray(X)?X:{};function k$(X){let{runtime:J,source:M}=X,V=new Map,F=!1,L=async(Y,B)=>{await J.updateSettings((W)=>({...W,[Y]:{...o2(W[Y]),...B}}))},P=()=>({ok:!0,text:"Native Claude settings updated."}),T=async(Y,B)=>{if(F)throw Error("Native menu is closed");switch(B.signal?.throwIfAborted(),Y.action){case"enable":case"disable":return await J.setEnabled(Y.values.id,Y.action==="enable"),P();case"remove":return await J.remove(Y.values.id),P();case"move-up":case"move-down":{let U=(await J.read()).accounts.map((w)=>w.id),O=U.indexOf(Y.values.id),q=O+(Y.action==="move-up"?-1:1);if(O<0||q<0||q>=U.length)return{ok:!1,text:"Account cannot move in that direction."};let A=U[O],m=U[q];if(A===void 0||m===void 0)return{ok:!1,text:"Account order changed."};return U[O]=m,U[q]=A,await J.reorder(U),P()}case"add-apikey":return await J.addApi(Y.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let W=new AbortController;V.get(Y.sessionId)?.active.abort();let U={active:W,auth:void 0};V.set(Y.sessionId,U);let O=await c1("max");if(F||W.signal.aborted||B.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return U.auth=O,{ok:!0,text:`Open ${O.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let W=V.get(Y.sessionId);if(!W?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let U=await t1(Y.values.code,W.auth.verifier,W.auth.redirectUri,W.auth.state);if(W.active.signal.throwIfAborted(),B.signal?.throwIfAborted(),F||U.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await J.loginOAuth({routeId:crypto.randomUUID(),credential:U,label:Y.values.label}),W.active.signal.throwIfAborted(),B.signal?.throwIfAborted(),F)return{ok:!1,text:"Sign-in cancelled."};return V.delete(Y.sessionId),{ok:!0,text:"OAuth account stored in the native account pool."}}case"reset-backoff":{let W=await J.read();for(let U of W.accounts){if(B.signal?.throwIfAborted(),U.type!=="oauth")continue;let O=U.source==="vault"?await J.authorizeVault(U.id,B.signal):await J.captureLocalSubject(U.id);await J.resetBackoff(U.id,O)}return P()}case"enrollment-reset":{let W=await jX(JX("opencode"),a1);return{ok:W==="reset",text:W==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":W==="refused-pending"?"An enrollment request may still be in progress. Quit OpenCode and run setup again; it picks up the same request.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let U=(await J.read()).accounts.filter((A)=>A.type==="oauth"&&VX(A)),O=await Promise.allSettled(U.map((A)=>J.fetchQuota(A.id,void 0,B.signal)));return{ok:O.every((A)=>A.status==="fulfilled"),text:`${O.filter((A)=>A.status==="fulfilled").length}/${U.length} native quota readings refreshed.`}}case"routing-reset":return await M.resetRouting(Y.sessionId),P();case"routing-mode":return await L("routing",{mode:Y.values.mode}),P();case"killswitch-on":case"killswitch-off":return await L("killswitch",{enabled:Y.action==="killswitch-on"}),P();case"killswitch-set":return await J.updateSettings((W)=>{let U=o2(W.killswitch),O={...o2(U.accounts)},q=U.main;for(let A of Y.values.entries){let m={five_hour:A.fh,seven_day:A.sd,...A.scoped!==void 0?{scoped:A.scoped}:{}};if(A.account==="main"||A.account==="all")q=m;if(A.account==="all")for(let w of Object.keys(O))O[w]=m;else if(A.account!=="main")O[A.account]=m}return{...W,killswitch:{...U,main:q,accounts:O}}}),P();case"cache-on":case"cache-off":return await L("claudeCache",{enabled:Y.action==="cache-on"}),P();case"cache-mode":return await L("claudeCache",{mode:Y.values.mode}),P();case"cachekeep-always":return await L("cacheKeep",{enabled:!0,always:!0}),P();case"cachekeep-off":return await L("cacheKeep",{enabled:!1}),P();case"cachekeep-window":return await L("cacheKeep",{enabled:!0,always:!1,startHour:Y.values.startHour,endHour:Y.values.endHour}),P();case"cachekeep-subagents":return await L("cacheKeep",{subagents:Y.values.enabled==="on"}),P();case"dump-on":case"dump-off":return await L("dump",{enabled:Y.action==="dump-on"}),P();case"logging-level":return await L("logging",{level:Y.values.level}),P();case"fast-on":case"fast-off":return await L("claudeFast",{enabled:Y.action==="fast-on"}),P();case"prime-on":case"prime-off":return await L("prime",{enabled:Y.action==="prime-on"}),P();case"start-fire":return await K(Y.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},K=(Y)=>X.start(Y,D2);return{dispatch:T,async readStatus(Y){let B=await J.read();if(Y==="account")return B.accounts.map((U)=>`${U.id}${U.label?` (${U.label})`:""}: ${U.type}, ${U.source}, ${U.enabled?"enabled":"disabled"}${U.state?`, ${e1(U)}`:""}${U.accountIdentity?`, ${U.accountIdentity}`:""}`).join(`
+`)||"No native Claude accounts.";if(Y==="quota")return n1({accounts:B.accounts.filter((U)=>U.type==="oauth").map((U)=>({name:U.label??U.id,role:U.id==="main"?"main":"fallback",enabled:U.enabled,quota:U.quota,tierLabel:$X(U.profile),lastRefreshedAt:U.lastRefreshedAt,error:U.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(Y==="prime")return s1({enabled:B.policyStorage.prime?.enabled===!0,accounts:r1(B.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");if(Y==="cachekeep"){let U=await X.cacheKeepRegistry?.list()??[];return o1({enabled:GX(B.policyStorage),always:ZX(B.policyStorage),hybridActive:YX(B.policyStorage),trackedSessionDetails:U,window:XX(B.policyStorage),trackedSessions:U.length,nextPrewarmAt:U.length?Math.min(...U.map((O)=>O.nextPrewarmAt)):void 0})}let W={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(B.settings[W[Y]]??{})},async readSidebar(Y){let[B,W]=await Promise.all([J.read(),X.cacheKeepRegistry?.list()??[]]);return q$(B,{activeId:M.servedAccount(Y),trackedSessions:W.length,now:Date.now()})},forgetSession(Y){V.get(Y)?.active.abort(),V.delete(Y)},close(){F=!0;for(let Y of V.values())Y.active.abort();V.clear()}}}import{resolveClaudeModelCapabilities as WX}from"@cortexkit/anthropic-auth-core";function D$(){let X=new Map;return{install:(M)=>M.model.transform((V)=>{X.clear();for(let F of V.list("anthropic")){X.set(String(F.id),String(F.modelID));let L=WX(F.modelID)?.efforts.variants;if(!L)continue;V.update("anthropic",String(F.id),(P)=>{let T=P.variants.filter((K)=>!L.some((Y)=>Y===String(K.id)));P.variants=[...T,...L.map((K)=>({id:K,settings:{effort:K,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(M)=>X.get(M)??M}}function b$(X){return X.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??X.get("x-api-key")??void 0}import{buildPrimeRequestBody as w$,effectiveRelayTransport as y$,nativeAccountCanServe as QX,PrimeManager as HX}from"@cortexkit/anthropic-auth-core";var I$=(X)=>X!==null&&typeof X==="object"&&!Array.isArray(X)?X:{};function f$(X){let{runtime:J,source:M}=X,V=new AbortController,F=new Set,L=(K)=>({providerID:"anthropic",modelID:w$().model,sessionID:`oc2-prime:${K}`,agent:"prime",kind:"generate"}),P=async(K)=>{let Y=L(K),B=P2({source:M}),W=performance.now();try{for(let U=0;U<3;U++){if(V.signal.throwIfAborted(),(await J.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let q=await B.adapter.accountHeaders({...Y,accountId:K});if(!("headers"in q)||typeof q.headers!=="object"||q.headers===null||typeof q.attempt!=="object"||q.attempt===null)throw Error("Native Prime authorization refused");let A={...Y,accountId:K,attemptId:crypto.randomUUID(),transport:"http",data:q.attempt},m,w=!1,c=!1,r=(o)=>{c=!0,o.body?.cancel().catch(()=>{})};try{let o=await B.adapter.rewriteRequest?.({...Y,accountId:K,attempt:A,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(w$()),signal:V.signal})});if(!o)throw Error("Native Prime rewrite refused");let s=new Headers(o.headers);for(let[l,p]of Object.entries(q.headers))if(p===null)s.delete(l);else s.set(l,p);let Z=new Request(o,{headers:s}),j=await(X.fetch??fetch)(Z),G=await B.adapter.rewriteResponse?.({...Y,accountId:K,request:Z,response:j,attempt:A})??j;m=G.status,B.adapter.quotaFromHeaders?.(G.headers,G.status,A);let x=G.ok?void 0:await B.adapter.limitFromResponse?.({status:G.status,headers:G.headers,body:()=>G.clone().text(),attempt:A});if(x&&/^(vault-newer|local-newer|relay-direct):/.test(x.reason)&&U<2){r(G);let l={...Y,phase:"retry",rerouteFrom:{accountId:K,limit:x}};if(await M.chooseAccount(l)!==K)throw Error("Native Prime retry changed account");continue}if(!G.ok)return r(G),{ok:!1,status:m,ms:performance.now()-W,error:"Native Prime upstream refused the request"};let E=I$(await G.json()),D=I$(E.usage),y={inputTokens:typeof D.input_tokens==="number"?D.input_tokens:void 0,outputTokens:typeof D.output_tokens==="number"?D.output_tokens:void 0};if(A.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(G.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(w=await M.recordPrime(q.attempt.provenance,y),!w)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:m,ms:performance.now()-W,usage:y}}finally{await B.adapter.onAttemptEnd?.(A,{status:m,outputStarted:!1,...w?{}:{error:{reason:c?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-W}}finally{B.dispose()}},T=new HX({storagePath:X.paths.legacyConfig,loadStorage:async()=>(await J.read()).policyStorage,async getAccountFingerprint(K){let Y=await J.read(),B=Y.accounts.find((U)=>U.id===K);if(!QX(B)||B?.type!=="oauth")return;if(Y.policyStorage.relay?.enabled===!0&&y$(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")return;if(B.source==="vault"){let U=await J.authorizeVault(K,V.signal);return J.getOrCreateAuthLineage(K,U)}let W=await J.authorizeLocal(K,{signal:V.signal});return W.status==="usable"?J.getOrCreateAuthLineage(K,W.subject):void 0},async refreshQuota(K){let Y=await J.read();if(Y.policyStorage.relay?.enabled===!0&&y$(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await J.fetchQuota(K,X.fetch,V.signal),fresh:!0}},sendPrime(K){let Y=P(K);return F.add(Y),Y.finally(()=>F.delete(Y)),Y},async recordSuccess(K){let Y=(await J.read()).accounts.find((B)=>B.id===K);if(!Y?.prime)throw Error("Native Prime counters are unavailable");return Y.prime}});return T.start(),{manager:T,async dispose(){T.stop(),V.abort(),await Promise.allSettled(F)}}}import{createNativeUsagePublisher as UX,effectiveRelayTransport as BX,getClaudeCodeIdentityForVerifiedAccount as b2,getQuotaCheckIntervalMs as KX,getRoutingMode as g$,isQuotaBearingHeaderFrame as MX,logger as zX,mergeHeaderQuotaForPersistence as _X,NativeVaultNoAccountError as CX,nativeAccountCanServe as n2,nativeAccountPolicy as w2,nativeLocalQuotaLineage as NX,nativePollQuotaGenerallyExhausted as LX,normalizeQuotaHeaders as FX,quotaSnapshotCheckedAt as v$,quotaSnapshotHasStandardWindows as PX,readNativeAccountsForRequest as TX,remapModelId as r2,StickySessionRouter as OX,shouldFallbackStatus as EX,stickyQuotaSnapshotIsFresh as y2,stickyRouteFamilyForModel as SX}from"@cortexkit/anthropic-auth-core";var s2=(X)=>["five_hour","seven_day"].some((J)=>(X?.[J]?.remainingPercent??1)<=0);function m$(X){let{runtime:J}=X,M=UX("native-auth"),V=new Map,F=(Z)=>{let j=Z.routingPath;if(!j)throw Error("Native routing storage is unavailable");let G=V.get(j);if(!G)G=new OX({path:j,vaultSeed:Z.routingSeed,onLockEvent:J.onLockEvent,localRecoveryPath:Z.mode==="local"?Z.routingRecoveryPath:void 0}),V.set(j,G);return G.setVaultSeed(Z.routingSeed),G},L=new WeakMap,P=new Map,T=new Map,K=new Map,Y=new Map,B=new WeakSet,W=!1,U=()=>{while(P.size>512){let Z=P.keys().next();if(!Z.done)P.delete(Z.value)}},O=(Z,j)=>JSON.stringify([Z.sessionID,Z.kind,Z.modelID,j]),q=(Z)=>{if(W)throw Error("Native Anthropic source is closed");let j=K.get(Z.sessionID);if(!j){j=new AbortController,K.set(Z.sessionID,j);while(K.size>512){let G=K.keys().next();if(!G.done)s.forgetSession?.(G.value)}}return j},A=(Z,j,G)=>n2(Z)&&(Z.type==="api"||w2(Z,j,r2(G)).status==="allowed"),m=async(Z,j,G,x)=>{let E=await J.read();x.signal.throwIfAborted(),w(E);let D=E.accounts.find((y)=>y.id===Z);if(!D||D.type!==G||!A(D,E,j))return!1;if(G==="api"){let y=E.accounts.find((l)=>l.id==="main"&&l.type==="oauth");return!!y&&y2(y.quota,E.policyStorage)&&s2(y.quota)}return!0},w=(Z)=>{let j=Z.policyStorage.relay;if(j?.enabled===!0&&BX(j.transport,j.url)==="websocket")throw new F2},c=async(Z,j)=>{if(w(Z),j||Z.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let G=await J.getRelayConfig();if(!G)throw Error("request refused: native HTTP relay configuration is unavailable");if(G.transport!=="http")throw new F2;return{dispatch:{kind:"http-relay",url:G.url,token:G.token},relayFallback:G.fallbackToDirect}};async function r(Z,j,G){if(Z.kind==="local"){let x=await J.publishLocal(Z.subject,G);if(!x&&G.quota)zX.warn("quota","Quota publication discarded");return x}if(Z.kind==="vault"&&j.receipt)await J.vault.publish(j.receipt,G);else if(Z.kind==="api"&&G.lastUsed!==void 0)await J.publishApi(Z.subject,{lastUsed:G.lastUsed});return!0}function o(Z,j,G){if(Z.kind!=="local")return;let x=Z.subject.binding,E=v$(G),D={lineage:NX(x),accountUuid:x.identity,entry:{quota:G,checkedAt:E,refreshAfter:E},generalExhausted:LX(G),routeBeforeSave:!0};return J.quotaObservations.hold(j.account.id,D)?D:void 0}let s={async chooseAccount(Z){let j=q(Z);X.onOwnedRequest?.();let G=await J.read();j.signal.throwIfAborted(),w(G);let x=r2(await X.resolveModelId?.(Z)??Z.modelID);if(j.signal.throwIfAborted(),G.mode==="claustrum")G=await TX(J,j.signal),j.signal.throwIfAborted();if(G.policyStorage.quota?.enabled!==!1){let I=!1;for(let u of G.accounts){if(!n2(u)||u.type!=="oauth")continue;if(PX(u.quota)?y2(u.quota,G.policyStorage,Date.now(),x):Date.now()-v$(u.quota)<KX(G.policyStorage))continue;try{await J.fetchQuota(u.id,X.fetch,j.signal,void 0,"admission"),I=!0}catch{j.signal.throwIfAborted()}}if(I)G=await J.read();j.signal.throwIfAborted()}let E=Z.rerouteFrom?P.get(Z.rerouteFrom.limit.reason):void 0;if(Z.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(Z.rerouteFrom.limit.reason)&&!E)return;if(E&&Z.rerouteFrom){let I=G.accounts.find((H)=>H.id===E.accountId);if(!I||!A(I,G,x))return;P.delete(Z.rerouteFrom.limit.reason);let u=O(Z,E.accountId),d=T.get(u)??[];return d.push(E),T.set(u,d),E.accountId}let D=[];for(let I of G.accounts){if(I.type!=="oauth"||!A(I,G,x))continue;if(I.source==="local"){let u=await J.authorizeLocal(I.id,{signal:j.signal,policy:(d,H)=>w2(d,H,x)});if(j.signal.throwIfAborted(),u.status!=="usable")continue}D.push(I)}let y=D.filter((I)=>I.id!==Z.rerouteFrom?.accountId);if(g$(G.policyStorage)==="sticky-balanced"){let I=y.map((d,H)=>({accountId:d.id,order:H,quota:d.quota??{kind:"unknown"}})),u=await F(G).resolve({sessionId:Z.sessionID,family:SX(x),modelId:x,affinityModelId:Z.modelID,candidates:I,retainAccountIds:new Set(y.map((d)=>d.id)),...G.mode==="claustrum"?{accountIdentities:new Map(G.accounts.flatMap((d)=>d.accountIdentity?[[d.id,d.accountIdentity]]:[]))}:{},storage:G.policyStorage,inputBytes:1,preferredAccountId:Z.previousAccountId,preserveOnNoCandidate:!0});if(j.signal.throwIfAborted(),u)return u.accountId}else{let u=g$(G.policyStorage)==="fallback-first"?[...y.filter((d)=>d.id!=="main"),...y.filter((d)=>d.id==="main")]:[...y.filter((d)=>d.id==="main"),...y.filter((d)=>d.id!=="main")];if(u[0])return u[0].id}if(G.mode==="claustrum")throw new CX;let l=G.accounts.find((I)=>I.id==="main"&&I.type==="oauth");if(!l)return;let p=l.quota;if(Z.rerouteFrom?.limit.status===429||!y2(p,G.policyStorage))try{p=await J.fetchQuota("main",X.fetch,j.signal)}catch{return}if(j.signal.throwIfAborted(),!s2(p))return;return G.accounts.find((I)=>I.type==="api"&&n2(I)&&I.id!==Z.rerouteFrom?.accountId)?.id},dropChoice(Z){let j=O(Z,Z.accountId),G=T.get(j);if(G?.shift(),G?.length===0)T.delete(j)},async authorizeAccount(Z,j){let G=q(Z),x=await J.read();G.signal.throwIfAborted(),w(x);let E=r2(await X.resolveModelId?.(Z)??Z.modelID);G.signal.throwIfAborted();let D=x.accounts.find((S)=>S.id===j);if(!D||!A(D,x,E))return;let y=O(Z,j),l=T.get(y),p=l?.shift();if(l?.length===0)T.delete(y);let{dispatch:I,relayFallback:u}=await c(x,p?.direct===!0);if(G.signal.throwIfAborted(),p?.auth){if(!await m(j,E,p.auth.route,G))return;let S=L.get(p.auth.provenance);if(S?.receipt?.expiresAtMs!==void 0&&S.receipt.expiresAtMs!==null&&S.receipt.expiresAtMs<Date.now()+300000)return;if(S)L.set(p.auth.provenance,{...S,scope:{...Z,modelID:E},account:D,active:G,relayFallback:u});return Y.set(Z.sessionID,j),{...p.auth,dispatch:I}}let d={scope:{...Z,modelID:E},active:G,account:D,retry:p?.retry??!1,relayFallback:u,quota:D.quota};if(D.type==="api"){let S=x.accounts.find((n)=>n.id==="main"&&n.type==="oauth");if(!S||!y2(S.quota,x.policyStorage)||!s2(S.quota))return;let R=await J.authorizeApi(j,G.signal);if(G.signal.throwIfAborted(),!await m(j,E,"api",G))return;let b={kind:"api",subject:R.subject};return L.set(b,d),Y.set(Z.sessionID,j),{route:"api",headers:R.authHeader==="authorization-bearer"?{authorization:`Bearer ${R.apiKey}`}:{"x-api-key":R.apiKey},baseURL:R.baseURL,provenance:b,dispatch:I}}if(D.source==="vault"){let S=await J.authorizeVault(j,G.signal);if(G.signal.throwIfAborted(),!await m(j,E,"oauth",G))return;let R={kind:"vault",credentialId:S.credentialId,recordVersion:S.recordVersion};L.set(R,{...d,receipt:S});let b=S.assertedAccountIdentity;if(!b)return;return Y.set(Z.sessionID,j),{route:"oauth",accessToken:S.accessToken,provenance:R,dispatch:I,identity:b2(b,b)}}let H=await J.authorizeLocal(j,{signal:G.signal,policy:(S,R)=>w2(S,R,E)});if(G.signal.throwIfAborted(),H.status!=="usable")return;if(!await m(j,E,"oauth",G))return;let z={kind:"local",subject:H.subject};L.set(z,{...d,access:H.access}),Y.set(Z.sessionID,j);let N=H.subject.binding.identity;return{route:"oauth",accessToken:H.access,provenance:z,dispatch:I,identity:b2(N,N)}},async requestOptions(Z){let j=q(Z),G=await J.read();j.signal.throwIfAborted();let x=G.accounts.find((D)=>D.id===Z.accountId);if(!x||!A(x,G,Z.modelID))throw Error("request refused: native account is ineligible for this model");let E=L.get(Z.provenance);if(E)L.set(Z.provenance,{...E,scope:{...E.scope,modelID:Z.modelID}});return X.requestOptions(Z,G)},async admitRequest(Z){let j=L.get(Z.provenance);if(!j||!await m(Z.accountId,Z.modelID,Z.route,j.active))throw Error("request refused: native account policy changed before dispatch");L.set(Z.provenance,{...j,scope:{...j.scope,modelID:Z.modelID}})},onRequestPrepared:(Z)=>X.onRequestPrepared?.(Z),responseOptions(Z){return X.responseOptions?.({...Z,modelID:L.get(Z.provenance)?.scope.modelID??Z.modelID})},quotaFromHeaders(Z,j){let G=L.get(j.provenance),x=h$(Z);if(x)X.onRequestId?.(j,x);if(!G||j.route!=="oauth"||!MX(Z))return;let E=j.provenance.kind==="local"?j.provenance.subject.binding.identity:G.receipt?.assertedAccountIdentity,D={...FX(Z),...E?{accountIdentity:E}:{}},y=_X(G.quota,D);G.quota=y;let l=o(j.provenance,G,y),p=G.account.id,I=()=>{if(l)J.quotaObservations.forget(p,l)};return M.observe(r(j.provenance,G,{quota:y}).then((u)=>{if(!u)I()},(u)=>{throw I(),u})),D},async limitFromResponse(Z){let j=L.get(Z.provenance);if(!j)return;if(Z.status===401&&j.receipt){if(!B.has(j.receipt))B.add(j.receipt),await J.vault.reportFailure(j.receipt,401,Z.dispatch==="http-relay"?"relay_status_field":"direct");if(j.retry||j.active.signal.aborted)return;let x=j.active,E=await J.vault.prepareRetry(j.receipt,x.signal);if(x.signal.throwIfAborted(),!E.retry)return;let D=E.receipt,y=D.assertedAccountIdentity;if(!y)return;let l={kind:"vault",credentialId:D.credentialId,recordVersion:D.recordVersion};L.set(l,{...j,receipt:D,retry:!0});let p=`vault-newer:${Z.attemptId}`;return P.set(p,{sessionID:Z.sessionID,accountId:Z.accountId,retry:!0,auth:{route:"oauth",accessToken:D.accessToken,provenance:l,identity:b2(y,y)}}),U(),{reason:p,status:401}}if(Z.status===401&&Z.provenance.kind==="local"&&j.access&&!j.retry){if(j.active.signal.aborted)return;let x=j.active,E=await J.authorizeLocal(Z.accountId,{rejectedAccessToken:j.access,signal:x.signal,policy:(p,I)=>w2(p,I,j.scope.modelID)});if(x.signal.throwIfAborted(),E.status!=="usable"||E.access===j.access)return;let D={kind:"local",subject:E.subject};L.set(D,{...j,access:E.access,retry:!0});let y=E.subject.binding.identity,l=`local-newer:${Z.attemptId}`;return P.set(l,{sessionID:Z.sessionID,accountId:Z.accountId,retry:!0,auth:{route:"oauth",accessToken:E.access,provenance:D,identity:b2(y,y)}}),U(),{reason:l,status:401}}let G=await J.read();if(EX(Z.status,G.policyStorage))return{reason:`provider-${Z.status}`,status:Z.status};return},limitFromRelayFailure(Z){let j=L.get(Z.provenance);if(!j?.relayFallback||j.active.signal.aborted||!(Z.status===401||Z.status>=500))return;let G=`relay-direct:${Z.attemptId}`;return P.set(G,{sessionID:Z.sessionID,accountId:Z.accountId,direct:!0,retry:!1}),U(),{reason:G}},limitFromStreamError(Z){return Z.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(Z,j){let G=L.get(j.provenance);if(j.dispatch==="http-relay"&&G?.relayFallback&&!G.active.signal.aborted&&Z.status===void 0){let x=`relay-direct:${j.attemptId}`;return P.set(x,{sessionID:j.sessionID,accountId:j.accountId,direct:!0,retry:!1}),U(),{reason:x}}return},async onAttemptEnd(Z,j){let G=L.get(Z.provenance);if(!G)return;try{if(j.status===401&&G.receipt&&!B.has(G.receipt))B.add(G.receipt),await J.vault.reportFailure(G.receipt,401,Z.dispatch==="http-relay"?"relay_status_field":"direct");if(!j.localRefusal&&j.status!==void 0)M.publish(()=>r(Z.provenance,G,{lastUsed:Date.now()}))}finally{L.delete(Z.provenance)}},forgetSession(Z){K.get(Z)?.abort(),K.delete(Z),Y.delete(Z);for(let[j,G]of P)if(G.sessionID===Z)P.delete(j);for(let[j,G]of T)if(G[0]?.sessionID===Z)T.delete(j);X.onForgetSession?.(Z)},servedAccount:(Z)=>Y.get(Z),resetRouting:async(Z)=>F(await J.read()).clear(Z),async recordPrime(Z,j){let G=L.get(Z);if(!G||G.active.signal.aborted)return!1;if(Z.kind==="local")return J.incrementPrimeUsage(G.account.id,Z.subject,j);if(Z.kind==="vault"&&G.receipt)return J.incrementPrimeUsage(G.account.id,G.receipt,j);return!1},drainRoutingPublications:()=>Promise.all([J.drainRoutingPublications(),...[...V.values()].map((Z)=>Z.drain())]).then(()=>{}),close(){W=!0;for(let Z of K.values())Z.abort();return K.clear(),T.clear(),P.clear(),Promise.all([M.drain(),s.drainRoutingPublications()]).then(()=>{})}};return s}import{remapModelId as RX}from"@cortexkit/anthropic-auth-core";function p$(){let X=new l$,J=new Map,M=new Map,V=new Map,F=new Set,L=new Set,P=new Map,T=(K)=>{while(K.size>512){let Y=K.keys().next();if(!Y.done)K.delete(Y.value)}};return{async install(K){let Y=[];try{Y.push(await K.session.hook("context",(B)=>{let W=B.messages.map((O)=>{return{info:{id:O.id,sessionID:B.sessionID,role:O.role,agent:B.agent,model:{providerID:B.model.providerID,modelID:B.model.id}},parts:O.content.map((q)=>({type:q.type,...q.type==="text"?{text:q.text}:{}}))}});X.observeMessages(W);let U=B.messages.findLast((O)=>O.role==="user"&&O.id);if(U?.id)J.set(B.sessionID,U.id);if(U?.content.some((O)=>O.type==="text"&&O.text===D2))F.add(B.sessionID);else F.delete(B.sessionID);T(J)},{providerID:"anthropic"})),Y.push(await K.session.hook("model.request",(B)=>{if(B.kind!=="primary")return;let W=J.get(B.sessionID);if(!W)return;if(X.markHeaders({sessionId:B.sessionID,messageId:W,agent:B.agent,headers:B.headers}),F.has(B.sessionID))B.headers[R2]="1"},{providerID:"anthropic"}))}catch(B){throw await Promise.allSettled(Y.map((W)=>W.dispose())),B}return{dispose:async()=>{await Promise.all(Y.map((B)=>B.dispose()))}}},requestOptions(K,Y){let B=X.resolveHeader(K.correlation[k2]);if(B)M.set(K.attemptId,B),T(M);P.set(K.attemptId,K.sessionID),T(P);let W=K.correlation[R2]==="1";if(W)L.add(K.attemptId);return{cache1hEnabled:K.agent!=="compaction"&&K.agent!=="title"&&(Y.policyStorage.claudeCache?.enabled??!0),cache1hMode:Y.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:Y.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:Y.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,turnEndNoteEnabled:!0,turnEndNote:Y.policyStorage.turnEndNote,serverSideFallbackEnabled:d$(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:W,billingLineage:B?{promptId:B.promptId,previousRequestId:B.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:V.get(K.sessionID)}},responseOptions(K){return{serverSideFallbackModel:RX(K.modelID),laneStart:L.has(K.attemptId),onMessageStart(Y){if(K.kind==="primary"&&typeof Y.id==="string")V.set(K.sessionID,Y.id),T(V)},onStreamEnd(){M.delete(K.attemptId),L.delete(K.attemptId),P.delete(K.attemptId)}}},onRequestId(K,Y){X.commit(M.get(K.attemptId),Y)},forgetSession(K){X.clearSession(K),J.delete(K),V.delete(K),F.delete(K);for(let[Y,B]of P)if(B===K)M.delete(Y),L.delete(Y),P.delete(Y)}}}var I2="cortexkit-anthropic-auth",yX='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',IX="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",fX="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function gX(X){let J=X.authorize??AX,M=X.exchange??DX,V=()=>{if(!X.isActive())throw Error("Claude authentication setup is closed")},F=async()=>{let T;try{T=await X.readMode()}catch{throw Error(fX)}return V(),T},L=async()=>{if(await F()!=="local")throw Error(yX)};return{integrationID:"anthropic",methods:[{method:{id:i$,type:"oauth",label:c$},async authorize(){V(),await L();let T=await J("max");return V(),{mode:"code",url:T.url,instructions:"Paste the authorization code returned by Claude.",callback:async(K)=>{V();let Y=await M(K,T.verifier,T.redirectUri,T.state);if(!X.isActive()||Y.type!=="success")throw Error("Claude sign-in did not complete");return{access:Y.access,refresh:Y.refresh,expires:Y.expires}}}}}],vault:{method:{id:o$,type:"oauth",label:"Claude vault accounts"},async activate(){if(V(),await F()!=="claustrum")throw Error(IX)}},async onLogin(T){V(),await L(),await X.runtime.loginOAuth({routeId:"main",credential:T,replace:!0}),V()},label:"Claude native account pool"}}function vX(X){return{readMode:()=>bX("opencode",X),disconnectVault:()=>kX({host:"opencode",env:X})}}function a2(X={}){return{id:I2,setup:(J)=>r$(J,X)}}async function r$(X,J={}){let M=J.paths??await wX(),V=xX({paths:M,host:"opencode",local:J.local,vault:J.vault}),F=vX(J.vault?.env??process.env),L=!0,P=p$(),T=D$(),K,Y,B,W=m$({runtime:V,paths:M,fetch:J.fetch,requestOptions:P.requestOptions,responseOptions:P.responseOptions,onRequestId:P.onRequestId,onForgetSession:P.forgetSession,onRequestPrepared:async(w)=>{try{await B?.track(w)}catch{u$.warn("cachekeep","live request tracking failed")}},resolveModelId:async(w)=>T.modelId(w.modelID),onOwnedRequest:()=>{K??=E$(V,J.fetch),Y??=f$({runtime:V,paths:M,source:W,fetch:J.fetch})}});B=P$({...J.cacheKeep,runtime:V,source:W,fetch:J.fetch,isSubagent:async(w)=>Boolean((await X.session.get({sessionID:w})).parentID)});let U=k$({runtime:V,source:W,cacheKeepRegistry:B.registry,start:async(w,c)=>{await X.session.synthetic({sessionID:w,text:c,description:"Claude lane start",resume:!0})}}),O=[],q=await T$(X,{source:W,log:{warn:(w,c)=>u$.warn("opencode2",w,c)}},{credential:b$}).catch(async(w)=>{throw U.close(),await B?.dispose(),await W.close(),await V.drainQuotaPublications(),V.close(),w}),A,m=()=>{if(A)return A;return L=!1,U.close(),W.close(),A=(async()=>{await Promise.allSettled([q.dispose(),K?.dispose(),Y?.dispose(),B?.dispose(),...O.map((w)=>w.dispose())]),await W.close(),await V.drainQuotaPublications(),V.close()})(),A};try{O.push(await P.install(X)),O.push(await T.install(X)),O.push(await h2(X,gX({isActive:()=>L,readMode:F.readMode,runtime:V})));let w={host:"opencode",dispatch:U.dispatch,readStatus:(r)=>U.readStatus(r),readAccounts:()=>V.read(),readMode:F.readMode,disconnectVault:F.disconnectVault,interactive:!0},c=qX(w);return O.push(await n$(X,c,U)),m}catch(w){throw await m(),w}}var $Z={id:I2,setup:a2().setup,server:s$};export{r$ as setupAnthropicAuth,$Z as default,a2 as createAnthropicAuthPlugin,I2 as ANTHROPIC_AUTH_PLUGIN_ID};

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/opencode-anthropic-auth",
-  "version": "2.2.4",
+  "version": "2.2.6",
   "type": "module",
   "repository": {
     "type": "git",
@@ -77,7 +77,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.6.0",
-    "@cortexkit/anthropic-auth-core": "2.2.4",
+    "@cortexkit/anthropic-auth-core": "2.2.6",
     "@cortexkit/claustrum-client": "0.12.0",
     "@cortexkit/private-files": "0.2.1",
     "@cortexkit/subc-client": "^0.22.0",