@cortexkit/opencode-anthropic-auth 2.2.7 → 2.2.8

package/dist/{index-b1dvkp15.js → index-naff9h33.js}

@@ -1,2 +1,2 @@
 import{existsSync as $,readFileSync as F}from"node:fs";import{homedir as Y}from"node:os";import{dirname as X,join as J,resolve as V}from"node:path";import{fileURLToPath as Z}from"node:url";var b="@cortexkit/opencode-anthropic-auth",G="@cortexkit/pi-anthropic-auth";function W(q=process.env,w=process.platform){return(w==="win32"?q.USERPROFILE||q.HOME:q.HOME)||Y()}function K(q=process.env,w=process.platform){let B=q.OPENCODE_CONFIG_DIR?.trim();if(B)return V(B);return J(q.XDG_CONFIG_HOME||J(W(q,w),".config"),"opencode")}function I(q=process.env){let w=q.XDG_DATA_HOME?.trim();if(w)return J(V(w),"opencode");return J(Y(),".local","share","opencode")}function M(q=process.env){return J(I(q),"auth.json")}function R(q=process.env,w=process.platform){let B=q.PI_CODING_AGENT_DIR?.trim()||q.PI_AGENT_DIR?.trim();if(B)return V(B);return J(W(q,w),".pi","agent")}function k(q=process.env){let w=q.PI_CODING_AGENT_DIR,B=W(q),z=w||J(B,".pi","agent");if(z==="~")z=B;else if(z.startsWith("~/")||process.platform==="win32"&&z.startsWith("~\\"))z=J(B,z.slice(2));if(z.startsWith("file://"))z=Z(z);return J(z,"auth.json")}async function x(){let q=X(Z(import.meta.url));for(let w=0;w<5;w++){let B=J(q,"package.json");if($(B))try{let Q=JSON.parse(F(B,"utf8"));if(typeof Q.version==="string"&&Q.version.trim())return Q.version.trim()}catch{}let z=X(q);if(z===q)break;q=z}return"1.22.0"}
-export{b as z,G as A,K as B,M as C,R as D,k as E,x as F};
+export{b as A,G as B,K as C,M as D,R as E,k as F,x as G};

package/dist/{index-jvhs8sxv.js → index-nm4pjrt8.js}

@@ -1,2 +1,2 @@
-import{I as $}from"./index-20d6rmjj.js";var D=(f)=>f!==null&&typeof f==="object"&&!Array.isArray(f),F=(f)=>D(f)&&typeof f.sessionId==="string"&&f.sessionId.length>0,A=(f)=>{if(!F(f)||!D(f)||f.command!=="claude"||typeof f.sectionId!=="string"||typeof f.actionId!=="string")return!1;if(f.itemId!==void 0&&typeof f.itemId!=="string")return!1;if(f.confirmed!==void 0&&typeof f.confirmed!=="boolean")return!1;if(f.values!==void 0&&(!D(f.values)||!Object.values(f.values).every((q)=>q===null||typeof q==="string"||typeof q==="boolean"||typeof q==="number"&&Number.isFinite(q))))return!1;return!0};function B(f){return{"~standard":{version:1,vendor:"cortexkit-native",validate:(q)=>f(q)?{value:q}:{issues:[{message:"Invalid native menu payload"}]}}}}var Z=(f)=>D(f)&&f.command==="claude"&&D(f.menu)&&f.menu.command==="claude"&&typeof f.menu.title==="string"&&Array.isArray(f.menu.sections),L=(f)=>D(f)&&f.command==="claude"&&typeof f.ok==="boolean"&&typeof f.text==="string"&&(f.authorizationUrl===void 0||typeof f.authorizationUrl==="string")&&D(f.menu)&&Array.isArray(f.menu.sections),M={"~standard":{version:1,vendor:"cortexkit-native",validate:(f)=>({value:$(f)})}},P={id:"cortexkit-anthropic-native",methods:{open:{input:B(F),output:B(Z)},apply:{input:B(A),output:B(L)},sidebar:{input:B(F),output:M}},events:{opened:{schema:B((f)=>F(f)&&Z(f.payload))},notification:{schema:B((f)=>F(f)&&typeof f.message==="string"&&["info","warning","error"].includes(String(f.kind)))}}};async function U(f,q,Q){let W=new AbortController,J=(j)=>({sessionId:j,notify(H,K="info"){G.events.emit("notification",{sessionId:j,message:H,kind:K}).catch(()=>{})}}),G=await f.rpc.register(P,{open:(j)=>q.open(J(j.sessionId)),apply:(j)=>q.apply(j,J(j.sessionId)),sidebar:(j)=>Q.readSidebar(j.sessionId)}),X;try{X=await f.command.transform((j)=>j.add({name:"claude",description:"Native Claude accounts and settings",async execute(H){let K=await q.open(J(H.sessionID));await G.events.emit("opened",{sessionId:H.sessionID,payload:K})}}))}catch(j){throw await G.dispose(),j}let z=(async()=>{try{for await(let j of f.event.subscribe({signal:W.signal}))if(j.type==="session.deleted")Q.forgetSession(j.data.sessionID)}catch{}})(),Y=!1;return{async dispose(){if(Y)return;Y=!0,W.abort(),await Promise.all([G.dispose(),X.dispose(),z])}}}
-export{P as t,U as u};
+import{J as $}from"./index-j6x60aqq.js";var D=(f)=>f!==null&&typeof f==="object"&&!Array.isArray(f),F=(f)=>D(f)&&typeof f.sessionId==="string"&&f.sessionId.length>0,A=(f)=>{if(!F(f)||!D(f)||f.command!=="claude"||typeof f.sectionId!=="string"||typeof f.actionId!=="string")return!1;if(f.itemId!==void 0&&typeof f.itemId!=="string")return!1;if(f.confirmed!==void 0&&typeof f.confirmed!=="boolean")return!1;if(f.values!==void 0&&(!D(f.values)||!Object.values(f.values).every((q)=>q===null||typeof q==="string"||typeof q==="boolean"||typeof q==="number"&&Number.isFinite(q))))return!1;return!0};function B(f){return{"~standard":{version:1,vendor:"cortexkit-native",validate:(q)=>f(q)?{value:q}:{issues:[{message:"Invalid native menu payload"}]}}}}var Z=(f)=>D(f)&&f.command==="claude"&&D(f.menu)&&f.menu.command==="claude"&&typeof f.menu.title==="string"&&Array.isArray(f.menu.sections),L=(f)=>D(f)&&f.command==="claude"&&typeof f.ok==="boolean"&&typeof f.text==="string"&&(f.authorizationUrl===void 0||typeof f.authorizationUrl==="string")&&D(f.menu)&&Array.isArray(f.menu.sections),M={"~standard":{version:1,vendor:"cortexkit-native",validate:(f)=>({value:$(f)})}},P={id:"cortexkit-anthropic-native",methods:{open:{input:B(F),output:B(Z)},apply:{input:B(A),output:B(L)},sidebar:{input:B(F),output:M}},events:{opened:{schema:B((f)=>F(f)&&Z(f.payload))},notification:{schema:B((f)=>F(f)&&typeof f.message==="string"&&["info","warning","error"].includes(String(f.kind)))}}};async function U(f,q,Q){let W=new AbortController,J=(j)=>({sessionId:j,notify(H,K="info"){G.events.emit("notification",{sessionId:j,message:H,kind:K}).catch(()=>{})}}),G=await f.rpc.register(P,{open:(j)=>q.open(J(j.sessionId)),apply:(j)=>q.apply(j,J(j.sessionId)),sidebar:(j)=>Q.readSidebar(j.sessionId)}),X;try{X=await f.command.transform((j)=>j.add({name:"claude",description:"Native Claude accounts and settings",async execute(H){let K=await q.open(J(H.sessionID));await G.events.emit("opened",{sessionId:H.sessionID,payload:K})}}))}catch(j){throw await G.dispose(),j}let z=(async()=>{try{for await(let j of f.event.subscribe({signal:W.signal}))if(j.type==="session.deleted")Q.forgetSession(j.data.sessionID)}catch{}})(),Y=!1;return{async dispose(){if(Y)return;Y=!0,W.abort(),await Promise.all([G.dispose(),X.dispose(),z])}}}
+export{P as u,U as v};

package/dist/{index-6chd6jnr.js → index-sg0knfec.js}

@@ -1,2 +1,2 @@
 var t=["claude-account","claude-cache","claude-cachekeep","claude-prime","claude-start","claude-quota","claude-dump","claude-fast","claude-routing","claude-killswitch","claude-logging"];
-export{t as q};
+export{t as r};

package/dist/index.js

@@ -1 +1 @@
-import{p as a}from"./index-cjjjgewq.js";import"./index-6chd6jnr.js";import"./index-hazrk5c3.js";import"./index-b1dvkp15.js";import"./index-20d6rmjj.js";import"./index-ppdrzs41.js";import"./index-62x1p34p.js";export{a as AnthropicAuthPlugin};
+import{q as a}from"./index-0jd4jg49.js";import"./index-sg0knfec.js";import"./index-c8ehrd0p.js";import"./index-naff9h33.js";import"./index-j6x60aqq.js";import"./index-bcp23wwb.js";import"./index-71temqvq.js";export{a as AnthropicAuthPlugin};

package/dist/oauth-destination.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Test-only escape hatch for the OAuth destination rule.
+ *
+ * End-to-end suites run a real OpenCode process against a local mock of the
+ * Anthropic API, so they need OAuth sends to reach a loopback server. Setting
+ * this variable to that server's exact origin (for example
+ * `http://127.0.0.1:43123`) allows it in addition to api.anthropic.com. Only
+ * an `http://` or `https://` origin on 127.0.0.1, [::1] or localhost, with an
+ * explicit port and no user name, password, path, query or fragment, is
+ * accepted; any other value is ignored, so OAuth stays limited to
+ * api.anthropic.com. ANTHROPIC_BASE_URL never widens the rule. It is not a
+ * user setting and is deliberately left out of the public documentation.
+ */
+export declare const TEST_OAUTH_LOOPBACK_ORIGIN_ENV = "ANTHROPIC_AUTH_TEST_OAUTH_LOOPBACK_ORIGIN";
+/** The accepted loopback origin from TEST_OAUTH_LOOPBACK_ORIGIN_ENV, if any. */
+export declare function testOAuthLoopbackOrigin(): string | undefined;
+/**
+ * Throws AnthropicOAuthOriginError unless an OAuth token may be sent to
+ * `url`. Call it with the final URL, after rewriteUrl has applied any
+ * ANTHROPIC_BASE_URL or provider baseURL, so neither can redirect a token.
+ *
+ * ANTHROPIC_BASE_URL is not trusted either. OpenCode's release binaries are
+ * built with Bun's `.env` autoloading turned off, but OpenCode started with
+ * `bun run` (from source) loads a `.env` file from the working directory, so
+ * an opened repository could set the variable. An OAuth token therefore goes
+ * only to api.anthropic.com whatever the variable says.
+ */
+export declare function requireOAuthDestination(url: string): URL;
+/** True when an OAuth token may be sent to `url`. */
+export declare function isAllowedOAuthDestination(url: string): boolean;
+/**
+ * Fetch for OAuth sends: rechecks the destination on every call and refuses
+ * redirects.
+ */
+export declare const fetchOAuth: typeof fetch;

package/dist/rpc/port-file.js

@@ -1 +1 @@
-import{fa as a,ga as b}from"../index-ppdrzs41.js";import"../index-62x1p34p.js";export{a as writePortFile,b as discoverPortFile};
+import{ga as a,ha as b}from"../index-bcp23wwb.js";import"../index-71temqvq.js";export{a as writePortFile,b as discoverPortFile};

package/dist/rpc/protocol.js

@@ -1 +1 @@
-import{q as a}from"../index-6chd6jnr.js";import"../index-62x1p34p.js";export{a as COMMAND_MODAL_NAMES};
+import{r as a}from"../index-sg0knfec.js";import"../index-71temqvq.js";export{a as COMMAND_MODAL_NAMES};

package/dist/rpc/rpc-client.js

@@ -1 +1 @@
-import{ga as s}from"../index-ppdrzs41.js";import"../index-62x1p34p.js";async function i(e,o,t,n){let r=await s(e,n);if(!r)return null;let a=new AbortController,l=setTimeout(()=>a.abort(),2000);try{let p=await fetch(`http://127.0.0.1:${r.port}/rpc/${o}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${r.token}`},body:JSON.stringify(t),signal:a.signal});if(!p.ok)return null;return await p.json()}catch{return null}finally{clearTimeout(l)}}function c(e,o){return{async pending(t,n){return(await i(e,"pending-notifications",{lastReceivedId:t,sessionId:n},o))?.messages??[]},async apply(t){return await i(e,"apply",{...t},o)??{text:"apply failed",knobs:{}}},async applyMenu(t){if(t.command!=="claude"||!t.sessionId?.trim())throw TypeError("A claude menu sessionId is required");let n=await i(e,"apply-menu",{...t},o);if(!n)throw Error("Menu apply unavailable; outcome unknown");return n}}}export{c as createRpcClient};
+import{ha as s}from"../index-bcp23wwb.js";import"../index-71temqvq.js";async function i(e,o,t,n){let r=await s(e,n);if(!r)return null;let a=new AbortController,l=setTimeout(()=>a.abort(),2000);try{let p=await fetch(`http://127.0.0.1:${r.port}/rpc/${o}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${r.token}`},body:JSON.stringify(t),signal:a.signal});if(!p.ok)return null;return await p.json()}catch{return null}finally{clearTimeout(l)}}function c(e,o){return{async pending(t,n){return(await i(e,"pending-notifications",{lastReceivedId:t,sessionId:n},o))?.messages??[]},async apply(t){return await i(e,"apply",{...t},o)??{text:"apply failed",knobs:{}}},async applyMenu(t){if(t.command!=="claude"||!t.sessionId?.trim())throw TypeError("A claude menu sessionId is required");let n=await i(e,"apply-menu",{...t},o);if(!n)throw Error("Menu apply unavailable; outcome unknown");return n}}}export{c as createRpcClient};

package/dist/rpc/rpc-dir.js

@@ -1 +1 @@
-import{r as a,s as b}from"../index-hazrk5c3.js";import"../index-62x1p34p.js";export{a as tmpdir,b as getRpcDir};
+import{s as a,t as b}from"../index-c8ehrd0p.js";import"../index-71temqvq.js";export{a as tmpdir,b as getRpcDir};

package/dist/sidebar-state.js

@@ -1 +1 @@
-import{$ as v,G as a,H as b,I as c,J as d,K as e,L as f,M as g,N as h,O as i,P as j,Q as k,R as l,S as m,T as n,U as o,V as p,W as q,X as r,Y as s,Z as t,_ as u,aa as w,ba as x,ca as y,da as z,ea as A}from"./index-20d6rmjj.js";import"./index-62x1p34p.js";export{i as setSidebarState,r as scopedQuotaShortNames,k as resolveActiveAccount,s as quotaLabelColumnWidth,c as normalizeSidebarState,a as getSidebarStateFile,h as getSidebarState,f as getInitialSidebarRoutingTestHooks,p as getFableRecoverySummary,w as getCollapsedQuotaSummary,x as getCollapsedAccounts,q as formatQuotaRowLabel,m as formatPrimeTime,n as formatPrimeCost,o as formatPrimeAccountValue,l as formatFallbackModelLabel,u as fitQuotaRow,v as fitPaceLine,j as drainSidebarWrites,A as computeQuotaPacing,d as __setSidebarStateWriteTestHooks,e as __setInitialSidebarRoutingTestHooks,g as __acquireSidebarStateLockForTest,z as SEVEN_DAY_MS,t as QUOTA_BAR_MIN_CELLS,y as FIVE_HOUR_MS,b as DEFAULT_SIDEBAR_STATE};
+import{$ as u,H as a,I as b,J as c,K as d,L as e,M as f,N as g,O as h,P as i,Q as j,R as k,S as l,T as m,U as n,V as o,W as p,X as q,Y as r,Z as s,_ as t,aa as v,ba as w,ca as x,da as y,ea as z,fa as A}from"./index-j6x60aqq.js";import"./index-71temqvq.js";export{i as setSidebarState,r as scopedQuotaShortNames,k as resolveActiveAccount,s as quotaLabelColumnWidth,c as normalizeSidebarState,a as getSidebarStateFile,h as getSidebarState,f as getInitialSidebarRoutingTestHooks,p as getFableRecoverySummary,w as getCollapsedQuotaSummary,x as getCollapsedAccounts,q as formatQuotaRowLabel,m as formatPrimeTime,n as formatPrimeCost,o as formatPrimeAccountValue,l as formatFallbackModelLabel,u as fitQuotaRow,v as fitPaceLine,j as drainSidebarWrites,A as computeQuotaPacing,d as __setSidebarStateWriteTestHooks,e as __setInitialSidebarRoutingTestHooks,g as __acquireSidebarStateLockForTest,z as SEVEN_DAY_MS,t as QUOTA_BAR_MIN_CELLS,y as FIVE_HOUR_MS,b as DEFAULT_SIDEBAR_STATE};

package/dist/tui-preferences.js

@@ -1,4 +1,4 @@
-import"./index-62x1p34p.js";import{readFileSync as k,watch as C}from"node:fs";import{mkdir as _,readFile as I,rename as E,writeFile as b}from"node:fs/promises";import{homedir as g}from"node:os";import{basename as F,dirname as P,join as N}from"node:path";import{clearTimeout as D,setTimeout as L}from"node:timers";import{applyEdits as T,modify as y,parse as f}from"jsonc-parser";var v="OPENCODE_TUI_PREFERENCES_FILE",h="tui-preferences.jsonc";function A(){let J=process.env[v];if(J)return J;let z=process.env.OPENCODE_CONFIG_DIR||N(process.env.XDG_CONFIG_HOME||N(g(),".config"),"opencode");return N(z,h)}function H(J){return typeof J==="object"&&J!==null&&!Array.isArray(J)}async function qq(){try{let J=await I(A(),"utf8"),z=[],q=f(J,z,{allowTrailingComma:!0});if(z.length>0)return{};return H(q)?q:{}}catch{return{}}}var m="anthropic-auth",p=160,R={forceToTop:!1,order:p,startCollapsed:!1,rememberCollapsed:!0,collapsed:null,pollMs:1500,refreshDebounceMs:200,header:{label:"CLAUDE",showVersion:!0},sections:{quota:!0,fallbackAccounts:!0,routing:!0,cache:!0,health:!0,pacing:!0},appearance:{barWidth:10,barFilledChar:"█",barEmptyChar:"░",warnThreshold:50,errorThreshold:80}};function $(J,z){return typeof J==="boolean"?J:z}function Y(J,z,q,X){if(typeof J!=="number"||!Number.isFinite(J))return z;return Math.min(Math.max(Math.round(J),q),X)}function c(J,z,q){if(typeof J!=="string"||J.length===0)return z;return J.slice(0,q)}function w(J,z){if(typeof J!=="string")return z;return[...J][0]??z}function zq(J){let z=J[m];if(!H(z))return structuredClone(R);let q=R,X=H(z.header)?z.header:{},Q=H(z.sections)?z.sections:{},Z=H(z.appearance)?z.appearance:{},G=Y(Z.warnThreshold,q.appearance.warnThreshold,0,99),V=Math.max(Y(Z.errorThreshold,q.appearance.errorThreshold,0,100),Math.min(G+1,100));return{forceToTop:$(z.forceToTop,q.forceToTop),order:Y(z.order,q.order,-1e4,1e4),startCollapsed:$(z.startCollapsed,q.startCollapsed),rememberCollapsed:$(z.rememberCollapsed,q.rememberCollapsed),collapsed:typeof z.collapsed==="boolean"?z.collapsed:null,pollMs:Y(z.pollMs,q.pollMs,500,30000),refreshDebounceMs:Y(z.refreshDebounceMs,q.refreshDebounceMs,50,5000),header:{label:c(X.label,q.header.label,20),showVersion:$(X.showVersion,q.header.showVersion)},sections:{quota:$(Q.quota,q.sections.quota),fallbackAccounts:$(Q.fallbackAccounts,q.sections.fallbackAccounts),routing:$(Q.routing,q.sections.routing),cache:$(Q.cache,q.sections.cache),health:$(Q.health,q.sections.health),pacing:$(Q.pacing,q.sections.pacing)},appearance:{barWidth:Y(Z.barWidth,q.appearance.barWidth,4,40),barFilledChar:w(Z.barFilledChar,q.appearance.barFilledChar),barEmptyChar:w(Z.barEmptyChar,q.appearance.barEmptyChar),warnThreshold:G,errorThreshold:V}}}var u=-1e5;function Jq(J,z,q){let X=J[z];if(!H(X))return q;if(X.forceToTop===!0)return u+Object.keys(J).indexOf(z);return Y(X.order,q,-1e4,1e4)}var s=`// Shared preferences for opencode TUI plugins.
+import"./index-71temqvq.js";import{readFileSync as k,watch as C}from"node:fs";import{mkdir as _,readFile as I,rename as E,writeFile as b}from"node:fs/promises";import{homedir as g}from"node:os";import{basename as F,dirname as P,join as N}from"node:path";import{clearTimeout as D,setTimeout as L}from"node:timers";import{applyEdits as T,modify as y,parse as f}from"jsonc-parser";var v="OPENCODE_TUI_PREFERENCES_FILE",h="tui-preferences.jsonc";function A(){let J=process.env[v];if(J)return J;let z=process.env.OPENCODE_CONFIG_DIR||N(process.env.XDG_CONFIG_HOME||N(g(),".config"),"opencode");return N(z,h)}function H(J){return typeof J==="object"&&J!==null&&!Array.isArray(J)}async function qq(){try{let J=await I(A(),"utf8"),z=[],q=f(J,z,{allowTrailingComma:!0});if(z.length>0)return{};return H(q)?q:{}}catch{return{}}}var m="anthropic-auth",p=160,R={forceToTop:!1,order:p,startCollapsed:!1,rememberCollapsed:!0,collapsed:null,pollMs:1500,refreshDebounceMs:200,header:{label:"CLAUDE",showVersion:!0},sections:{quota:!0,fallbackAccounts:!0,routing:!0,cache:!0,health:!0,pacing:!0},appearance:{barWidth:10,barFilledChar:"█",barEmptyChar:"░",warnThreshold:50,errorThreshold:80}};function $(J,z){return typeof J==="boolean"?J:z}function Y(J,z,q,X){if(typeof J!=="number"||!Number.isFinite(J))return z;return Math.min(Math.max(Math.round(J),q),X)}function c(J,z,q){if(typeof J!=="string"||J.length===0)return z;return J.slice(0,q)}function w(J,z){if(typeof J!=="string")return z;return[...J][0]??z}function zq(J){let z=J[m];if(!H(z))return structuredClone(R);let q=R,X=H(z.header)?z.header:{},Q=H(z.sections)?z.sections:{},Z=H(z.appearance)?z.appearance:{},G=Y(Z.warnThreshold,q.appearance.warnThreshold,0,99),V=Math.max(Y(Z.errorThreshold,q.appearance.errorThreshold,0,100),Math.min(G+1,100));return{forceToTop:$(z.forceToTop,q.forceToTop),order:Y(z.order,q.order,-1e4,1e4),startCollapsed:$(z.startCollapsed,q.startCollapsed),rememberCollapsed:$(z.rememberCollapsed,q.rememberCollapsed),collapsed:typeof z.collapsed==="boolean"?z.collapsed:null,pollMs:Y(z.pollMs,q.pollMs,500,30000),refreshDebounceMs:Y(z.refreshDebounceMs,q.refreshDebounceMs,50,5000),header:{label:c(X.label,q.header.label,20),showVersion:$(X.showVersion,q.header.showVersion)},sections:{quota:$(Q.quota,q.sections.quota),fallbackAccounts:$(Q.fallbackAccounts,q.sections.fallbackAccounts),routing:$(Q.routing,q.sections.routing),cache:$(Q.cache,q.sections.cache),health:$(Q.health,q.sections.health),pacing:$(Q.pacing,q.sections.pacing)},appearance:{barWidth:Y(Z.barWidth,q.appearance.barWidth,4,40),barFilledChar:w(Z.barFilledChar,q.appearance.barFilledChar),barEmptyChar:w(Z.barEmptyChar,q.appearance.barEmptyChar),warnThreshold:G,errorThreshold:V}}}var u=-1e5;function Jq(J,z,q){let X=J[z];if(!H(X))return q;if(X.forceToTop===!0)return u+Object.keys(J).indexOf(z);return Y(X.order,q,-1e4,1e4)}var s=`// Shared preferences for opencode TUI plugins.
 // One top-level key per plugin (short name). See each plugin's README for
 // its supported settings. This file is safe to hand-edit; plugins update
 // individual keys in place and preserve comments.

package/dist/v2/adapter.d.ts

@@ -1,4 +1,4 @@
-import { type ClaudeCodeIdentity, type RequestGzipLatch, TrailingAssistantHistoryError } from '@cortexkit/anthropic-auth-core';
+import { AnthropicOAuthOriginError, type ClaudeCodeIdentity, type RequestGzipLatch, TrailingAssistantHistoryError } from '@cortexkit/anthropic-auth-core';
 import type { AccountRequest, AttemptOutcome, ChooseAccountInput, HeaderEdits, HostError, LimitSignal, OpenCode2AuthAdapter, RequestScope, Transport } from '@cortexkit/common-auth/opencode2';
 import { EffortMarkerCorrelationError } from '../effort-history';
 import { createStrippedStream, rewriteRequestBody } from '../transform';
@@ -275,8 +275,9 @@ export declare class NativeAnthropicTransportRefusal extends Error {
 }
 /**
  * The request was refused with a local 400 because it can never succeed as
- * written: its history ends on a meaningful assistant turn, or an effort
- * marker in it cannot be matched to the session's effort plan. Nothing was
+ * written: its history ends on a meaningful assistant turn, an effort marker
+ * in it cannot be matched to the session's effort plan, or it is an OAuth
+ * request whose URL is not Anthropic's API server. Nothing was
  * sent, and another account cannot help, so the adapter never reports it as
  * an account limit. The message and `check` describe only the shape of the
  * problem, never conversation content.
@@ -285,7 +286,7 @@ export declare class NativeAnthropicLocalRefusal extends Error {
     readonly kind = "local-invalid-request";
     readonly status = 400;
     readonly check: string;
-    constructor(cause: TrailingAssistantHistoryError | EffortMarkerCorrelationError);
+    constructor(cause: TrailingAssistantHistoryError | EffortMarkerCorrelationError | AnthropicOAuthOriginError);
 }
 export declare function createNativeAnthropicAdapter<Q, P>(deps: NativeAnthropicAdapterDeps<Q, P>): NativeAnthropicAdapter<Q, P>;
 export {};

package/dist/v2/server.js

@@ -1,13 +1,13 @@
-import{a as k2,b as p$,c as i$,d as B$,e as H$,f as D2,g as R2,h as U$,i as K$,j as c$,k as M$,l as z$,m as _$,n as F$,o as C$,p as t$}from"../index-cjjjgewq.js";import"../index-6chd6jnr.js";import"../index-hazrk5c3.js";import{u as s$}from"../index-jvhs8sxv.js";import{v as b2,w as w2,y as r$}from"../index-0kxy8k2c.js";import"../index-b1dvkp15.js";import"../index-20d6rmjj.js";import"../index-ppdrzs41.js";import"../index-62x1p34p.js";import{acquireNativeAccountRuntime as kJ,authorize as DJ,createNativeUi as bJ,disconnectNativeVaultForHost as wJ,exchange as yJ,logger as n$,readNativeEnrollmentMode as IJ,resolveNativePoolPaths as fJ}from"@cortexkit/anthropic-auth-core";class E2 extends Error{kind;providerID;sessionID;requestKind;constructor($){super($.message??`${$.providerID} ${$.requestKind} request refused (${$.kind})`);this.name="OpenCode2AuthError",this.kind=$.kind,this.providerID=$.providerID,this.sessionID=$.sessionID,this.requestKind=$.requestKind}}function M2($){return`common-auth-placeholder.${$}`}function X$($){let X=M2($.integrationID);return{type:"oauth",methodID:$.methodID,access:X,refresh:X,expires:$.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function m2($,X){if($?.type!=="oauth")return!1;let M=X===void 0?void 0:M2(X),V=(L)=>M===void 0?L.startsWith("common-auth-placeholder."):L===M;return V($.access)&&V($.refresh)}var Z$="No browser sign-in: this connects the plugin to the accounts in its vault.";async function l2($,X){let M=X.now??Date.now,{integrationID:V}=X,L=(T)=>X$({integrationID:V,methodID:T,now:M()}),N=async(T,K)=>{return await X.onLogin(T,{integrationID:V,methodID:K}),L(K)},P=(T)=>async(K)=>{let Y=T.method.id,H=await T.authorize(K),W={url:H.url,instructions:H.instructions,...H.expiresAt===void 0?{}:{expiresAt:H.expiresAt}};if(H.mode==="auto")return{...W,mode:"auto",callback:H.callback.then((E)=>N(E,Y))};let U=H.callback;return{...W,mode:"code",callback:async(E)=>N(await U(E),Y)}};return $.integration.transform((T)=>{let K=X.label===void 0?{}:{label:()=>X.label};for(let W of X.methods)T.method.update({integrationID:V,method:W.method,authorize:P(W),refresh:async(U)=>{if(!m2(U,V))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return L(U.methodID)},...K});let Y=X.vault;if(Y===void 0)return;let H=Y.method.id;T.method.update({integrationID:V,method:Y.method,authorize:async()=>({url:"",instructions:Y.instructions??Z$,mode:"auto",callback:Promise.resolve().then(()=>Y.activate({integrationID:V,methodID:H})).then(()=>L(H))}),refresh:async(W)=>{if(!m2(W,V)||W.methodID!==H)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return L(H)},...K})})}function e$($){let X=[],M;for(let V of $.split(/\r?\n/))if(V.startsWith("data:"))X.push(V.slice(5).replace(/^ /,""));else if(V.startsWith("event:"))M=V.slice(6).trim();if(X.length===0)return;return M===void 0?{data:X.join(`
+import{a as k2,b as u$,c as c$,d as B$,e as H$,f as D2,g as R2,h as U$,i as K$,j as M$,k as o$,l as z$,m as _$,n as F$,o as C$,p as N$,q as e$}from"../index-0jd4jg49.js";import"../index-sg0knfec.js";import"../index-c8ehrd0p.js";import{v as a$}from"../index-nm4pjrt8.js";import{w as b2,x as w2,z as s$}from"../index-m4dazzyf.js";import"../index-naff9h33.js";import"../index-j6x60aqq.js";import"../index-bcp23wwb.js";import"../index-71temqvq.js";import{acquireNativeAccountRuntime as bJ,authorize as wJ,createNativeUi as yJ,disconnectNativeVaultForHost as IJ,exchange as fJ,logger as r$,readNativeEnrollmentMode as gJ,resolveNativePoolPaths as vJ}from"@cortexkit/anthropic-auth-core";class E2 extends Error{kind;providerID;sessionID;requestKind;constructor($){super($.message??`${$.providerID} ${$.requestKind} request refused (${$.kind})`);this.name="OpenCode2AuthError",this.kind=$.kind,this.providerID=$.providerID,this.sessionID=$.sessionID,this.requestKind=$.requestKind}}function M2($){return`common-auth-placeholder.${$}`}function X$($){let X=M2($.integrationID);return{type:"oauth",methodID:$.methodID,access:X,refresh:X,expires:$.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function m2($,X){if($?.type!=="oauth")return!1;let M=X===void 0?void 0:M2(X),V=(L)=>M===void 0?L.startsWith("common-auth-placeholder."):L===M;return V($.access)&&V($.refresh)}var Z$="No browser sign-in: this connects the plugin to the accounts in its vault.";async function l2($,X){let M=X.now??Date.now,{integrationID:V}=X,L=(T)=>X$({integrationID:V,methodID:T,now:M()}),N=async(T,K)=>{return await X.onLogin(T,{integrationID:V,methodID:K}),L(K)},P=(T)=>async(K)=>{let Y=T.method.id,H=await T.authorize(K),W={url:H.url,instructions:H.instructions,...H.expiresAt===void 0?{}:{expiresAt:H.expiresAt}};if(H.mode==="auto")return{...W,mode:"auto",callback:H.callback.then((E)=>N(E,Y))};let U=H.callback;return{...W,mode:"code",callback:async(E)=>N(await U(E),Y)}};return $.integration.transform((T)=>{let K=X.label===void 0?{}:{label:()=>X.label};for(let W of X.methods)T.method.update({integrationID:V,method:W.method,authorize:P(W),refresh:async(U)=>{if(!m2(U,V))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return L(U.methodID)},...K});let Y=X.vault;if(Y===void 0)return;let H=Y.method.id;T.method.update({integrationID:V,method:Y.method,authorize:async()=>({url:"",instructions:Y.instructions??Z$,mode:"auto",callback:Promise.resolve().then(()=>Y.activate({integrationID:V,methodID:H})).then(()=>L(H))}),refresh:async(W)=>{if(!m2(W,V)||W.methodID!==H)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return L(H)},...K})})}function $1($){let X=[],M;for(let V of $.split(/\r?\n/))if(V.startsWith("data:"))X.push(V.slice(5).replace(/^ /,""));else if(V.startsWith("event:"))M=V.slice(6).trim();if(X.length===0)return;return M===void 0?{data:X.join(`
 `)}:{event:M,data:X.join(`
-`)}}function d2($,X){let M=new TextDecoder,V="",L=(P)=>{let T=e$(P);if(!T)return;try{$(T)}catch(K){X(K)}},N=()=>{for(;;){let P=/\r?\n\r?\n/.exec(V);if(!P)return;let T=V.slice(0,P.index);V=V.slice(P.index+P[0].length),L(T)}};return new TransformStream({transform(P,T){T.enqueue(P),V+=M.decode(P,{stream:!0}),N()},flush(){if(V+=M.decode(),N(),V.trim()!=="")L(V);V=""}})}var Y$=512,N2="x-common-auth-attempt",z2=($,X)=>JSON.stringify([$,X]),Q2=($)=>({providerID:$.model.providerID,modelID:$.model.id,sessionID:$.sessionID,agent:$.agent,kind:$.kind});function $1($){let X=$.headers;return typeof X==="object"&&X!==null}function J1($,X){let M=$.getReader();return new ReadableStream({async pull(V){let L;try{L=await M.read()}catch(N){X({reason:"failed",message:N instanceof Error?N.message:String(N)}),V.error(N);return}if(L.done)X(),V.close();else V.enqueue(L.value)},async cancel(V){X({reason:"cancelled",...V===void 0?{}:{message:String(V)}}),await M.cancel(V)}})}function p2($,X){for(let[M,V]of Object.entries(X)){let L=M.toLowerCase();for(let N of Object.keys($))if(N.toLowerCase()===L)delete $[N];if(V!==null)$[M]=V}}function X1($,X){for(let[M,V]of Object.entries(X))if(V===null)$.delete(M);else $.set(M,V)}async function u2($,X,M={}){let{providerID:V}=X,L=M.gateOnPlaceholder,N=(J)=>L===void 0||L.credential(J)===M2(V),P=M.logger,T=Math.max(1,M.maxRecords??Y$),K=[...M.hostCredentials??[M2(V)],...L?[M2(V)]:[]].filter((J)=>J!==""),Y=new Map,H=new WeakMap,W=new Map,U=new Set,E=new Map,q=!1,A=!1,m=new Map,w=0,c=!1,r=new Map,o=(J,Q)=>{try{P?.warn(J,Q)}catch{}},s=(J)=>J instanceof Error?J.message:String(J),Z=new Map,j=(J,Q)=>{let _=(Z.get(J)??Promise.resolve()).then(Q),F=_.then(()=>{},()=>{});return Z.set(J,F),F.then(()=>{if(Z.get(J)===F)Z.delete(J)}),_},G=(J,Q)=>{let _=Z.get(J);return _?_.then(()=>G(J,Q)):Q()},x=async(J)=>{try{await X.dropChoice?.({...J.input,accountId:J.accountId})}catch(Q){o("opencode2 auth dropChoice threw; the request is unaffected",{sessionID:J.input.sessionID,error:s(Q)})}},O=(J)=>{let Q=W.get(J);if(W.delete(J),Q?.next){let _=Q.next;j(Q.sessionID,()=>x(_))}},D=async(J,Q)=>{let _=m.get(J);if(!_||_.size===0)return;await Promise.all([..._].map(async(F)=>{try{await F(Q)}catch(f){o("opencode2 auth listener threw; the request is unaffected",{event:J,error:s(f)})}}))},y=async(J,Q)=>{try{await X.onAttemptEnd?.(J,Q)}catch(_){o("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:J.attemptId,error:s(_)})}},l=(J,Q)=>{if(J.ended||!J.attempt)return;let _={...J.status===void 0?{}:{status:J.status},outputStarted:J.outputStarted,...J.limit?{limit:J.limit.signal}:{},...Q?{error:Q}:{}};if(Q)J.endError=Q;J.ended=y(J.attempt,_)},p=(J,Q)=>l(J,{reason:"abandoned",message:Q}),I=(J)=>[...Y.values()].filter((Q)=>Q.key===J),u=(J)=>I(J).at(-1),d=(J)=>{if(Y.delete(J.id),W.get(J.key)?.attemptId===J.id||!I(J.key).length)O(J.key)},B=(J)=>{Y.set(J.id,J);while(Y.size>T){let Q=Y.values().next().value;if(Q===void 0)break;p(Q,"dropped to keep the record bound"),d(Q)}},z=(J)=>J.accountId===void 0?void 0:{...J.scope,accountId:J.accountId},C=(J,Q)=>new E2({kind:"no-account",providerID:V,sessionID:J.sessionID,requestKind:J.kind,...Q===void 0?{}:{message:Q}}),S=(J)=>{r.get(J)?.clear(),r.delete(J)},R=async(J,Q)=>{let _=()=>C(J,`${V} ${J.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(c)throw _();let F=r.get(J.sessionID);if(!F)F=new Set,r.set(J.sessionID,F);let f={};F.add(f);let v=()=>{if(!F.has(f))throw _()};try{return await Q(v)}finally{if(F.delete(f),F.size===0&&r.get(J.sessionID)===F)r.delete(J.sessionID)}},b=(J,Q)=>{for(let[_,F]of Q)if(K.some((f)=>F.includes(f)))throw new E2({kind:"host-credential-on-wire",providerID:V,sessionID:J.sessionID,requestKind:J.kind,message:`${V} ${J.kind} request still carries the host's placeholder credential in ${_}; the adapter's account headers must replace it`})},g=(J)=>{for(let Q of I(J))if(Q.ended||!Q.attempt)d(Q);else if(Q.transport==="ws"||Q.judged)p(Q,"a newer attempt of its session and kind began"),d(Q)},n=async(J,Q,_,F)=>{let f=z2(J.sessionID,J.kind),{input:v,accountId:k}=await G(J.sessionID,async()=>{_();let e=W.get(f);W.delete(f);let C2=e?.accountId??u(f)?.accountId;g(f);let J2=e?.next,T2=J2!==void 0&&J2.input.modelID===J.modelID&&J2.input.agent===J.agent,H2={...J,phase:"request",...C2===void 0?{}:{previousAccountId:C2},...e?.rerouteFrom?{rerouteFrom:e.rerouteFrom}:{}};if(J2&&!T2)await j(J.sessionID,()=>x(J2)),_();let A2=T2?J2.accountId:await X.chooseAccount(H2);return{input:H2,accountId:A2}});_();let h={},a;if(k!==void 0){let e=await X.accountHeaders({...J,accountId:k});if(_(),$1(e))h=e.headers,a=e.attempt;else h=e}let W2=`attempt-${++w}`,G2={id:W2,key:f,scope:J,accountId:k,headers:h,attempt:k===void 0?void 0:{...J,accountId:k,attemptId:W2,transport:F,data:a},...F===void 0?{}:{transport:F},outputStarted:!1};if(B(G2),G2.attempt)D("select",{...J,accountId:G2.attempt.accountId,hook:Q,...v.previousAccountId===void 0?{}:{previousAccountId:v.previousAccountId},...v.rerouteFrom===void 0?{}:{rerouteFrom:v.rerouteFrom},handle:G2.attempt});return G2},i=async(J,Q,_,F,f)=>{let v=z2(J.sessionID,J.kind),k=F===void 0?void 0:Y.get(F);if(k?.key!==v)k=void 0;if(!k){if(k=u(v),I(v).filter((a)=>a.transport===void 0&&!a.ended).length>1&&!A)A=!0,o("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:J.sessionID,kind:J.kind})}if(!k||k.transport!==void 0||k.ended)k=await n(J,Q,f,_);else if(k.transport=_,k.attempt)k.attempt.transport=_;if(_==="ws"){for(let h of I(v))if(h!==k&&h.transport==="ws")p(h,"a newer attempt of its session and kind went out over WebSocket")}return k},X2=async(J,Q)=>{try{return await Q()}catch(_){throw l(J,{reason:"failed",message:s(_)}),_}},V2=(J,Q)=>{let _=I(z2(J,Q)).filter((F)=>F.transport==="ws").at(-1);return _?.attempt!==void 0&&!_.ended?_:void 0},Z2=(J,Q,_)=>{let F=z(J);if(!F||!J.attempt||J.limit)return;J.limit={signal:Q,delivered:D("limit",{...F,via:_,limit:Q,outputStarted:J.outputStarted,handle:J.attempt})}},F2=(J,Q,_,F)=>{let f=z(J);if(!f||!J.attempt)return;D("quota",{...f,transport:Q,...F===void 0?{}:{status:F},quota:_,handle:J.attempt})},$2=(J,Q,_,F)=>{let f=J.attempt;if(!f)return;let v=X.inspectEvent?.(F===void 0?{transport:Q,data:_,attempt:f}:{transport:Q,data:_,event:F,attempt:f});if(!v)return;if(v.quota!==void 0)F2(J,Q,v.quota);if(v.outputStarted)J.outputStarted=!0;if(v.limit)Z2(J,v.limit,Q);if(v.error!==void 0)l(J,{reason:"failed",message:v.error});else if(v.done)l(J)},t=(J,Q)=>{let _=J.attempt;if(!_||Q.accountId===J.accountId)return;if(_.reboundFrom??=_.accountId,_.accountId=Q.accountId,"data"in Q)_.data=Q.data;J.accountId=Q.accountId},U2=(J)=>!J.attempt||J.endError!==void 0||J.status!==void 0&&J.status>=400,K2=(J)=>{let Q=[...Y.values()].filter((h)=>h.scope.sessionID===J),_=Q.filter((h)=>h.limit&&!h.rerouted).at(-1);if(_)return _;let F=Q.filter((h)=>h.scope.kind==="primary"),f=F.length>0?F:Q;if(f.length<=1)return f[0];let v=f.filter((h)=>!h.judged&&U2(h)).at(-1);if(v)return v;let k=f.filter((h)=>h.attempt&&!h.ended);if(k.length>1)return"ambiguous";return k[0]??f.at(-1)},Y2={providerID:V},j2=[];j2.push(await $.session.hook("model.request",(J)=>{if(L)return;return R(Q2(J),async(Q)=>{let _=await n(Q2(J),"model.request",Q);if(Q(),_.accountId===void 0)throw C(_.scope);p2(J.headers,{..._.headers,[N2]:_.id})})},Y2)),j2.push(await $.session.hook("http.request",(J)=>{if(L){let Q=N(J.request.headers);if(E.set(J.sessionID,Q),!Q)return}return R(Q2(J),async(Q)=>{let _=J.request.headers.get(N2)??void 0,F=L?await n(Q2(J),"http.request",Q,"http"):await i(Q2(J),"http.request","http",_,Q);Q();let f=z(F),v=F.attempt;if(!f||!v)throw C(F.scope);await X2(F,async()=>{let k=J.request;if(X.rewriteRequest){if(_!==void 0){let W2=new Headers(k.headers);W2.delete(N2),k=new Request(k,{headers:W2})}k=await X.rewriteRequest({...f,request:k,attempt:v})??k,Q()}let h=new Headers(k.headers);h.delete(N2),X1(h,F.headers),b(F.scope,h.entries());let a=new Request(k,{headers:h});H.set(a,F),J.request=a})})},Y2)),j2.push(await $.session.hook("http.response",async(J)=>{let Q=H.get(J.request);if(!Q){if(L)return;if(!q)q=!0,o("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:J.sessionID,kind:J.kind});return}let _=J.response;if(X.answeredBy&&Q.attempt){let h=Q.attempt,a=await X2(Q,async()=>X.answeredBy?.({request:J.request,response:_,attempt:h}));if(a)t(Q,a)}let F=z(Q),f=Q.attempt;if(!F||!f)return;Q.status=_.status;let v=X.quotaFromHeaders?.(_.headers,_.status,f);if(v!==void 0)F2(Q,"http",v,_.status);if(!_.ok&&X.limitFromResponse){let h=await X.limitFromResponse({status:_.status,headers:_.headers,body:()=>_.clone().text(),attempt:f});if(h)Z2(Q,h,"http")}if(!_.ok||!_.body)l(Q);let k=_;if(_.body&&(X.inspectEvent||X.onAttemptEnd)){let h=_.body;if(X.inspectEvent)h=h.pipeThrough(d2((a)=>$2(Q,"http",a.data,a.event),(a)=>o("opencode2 auth event inspection threw",{error:s(a)})));k=new Response(J1(h,(a)=>l(Q,a)),{status:_.status,statusText:_.statusText,headers:_.headers})}if(X.rewriteResponse)k=await X.rewriteResponse({...F,request:J.request,response:k,attempt:f})??k;if(k!==_)J.response=k},Y2)),j2.push(await $.session.hook("experimental.ws.handshake",(J)=>{if(L){let Q=N(new Headers(J.headers)),_=z2(J.sessionID,J.kind);if(E.set(J.sessionID,Q),U.delete(_),!Q)return}return R(Q2(J),async(Q)=>{let _;for(let k of Object.keys(J.headers)){if(k.toLowerCase()!==N2)continue;_??=J.headers[k],delete J.headers[k]}let F=L?await n(Q2(J),"experimental.ws.handshake",Q,"ws"):await i(Q2(J),"experimental.ws.handshake","ws",_,Q);Q();let f=z(F),v=F.attempt;if(!f||!v)throw C(F.scope);await X2(F,async()=>{p2(J.headers,F.headers);let k=X.rewriteHandshakeURL?.({...f,url:J.url,attempt:v});if(k!==void 0)J.url=k;if(b(F.scope,Object.entries(J.headers)),L)U.add(F.key)})})},Y2));let B2=X.rewriteWebSocketFrame?.bind(X);if(B2)j2.push(await $.session.hook("experimental.ws.send",async(J)=>{let Q=Q2(J);if(L&&!U.has(z2(Q.sessionID,Q.kind)))return;let _=V2(Q.sessionID,Q.kind),F=await B2({...Q,attempt:_?.attempt,frame:J.frame});if(F!==void 0)J.frame=F},Y2));j2.push(await $.session.hook("experimental.ws.receive",(J)=>{if(L&&!U.has(z2(J.sessionID,J.kind)))return;let Q=V2(J.sessionID,J.kind);if(!Q)return;try{$2(Q,"ws",J.frame)}catch(_){o("opencode2 auth frame inspection threw",{error:s(_)})}},Y2)),j2.push(await $.session.hook("retry",async(J)=>{if(L&&E.get(J.sessionID)!==!0)return;let Q=K2(J.sessionID);if(!Q)return;let _=J.decision;if(Q==="ambiguous"){await D("retry",{sessionID:J.sessionID,attempt:J.attempt,reason:"host-decides",hostDecision:_,decision:_});return}let F=Q;await R(F.scope,async(f)=>{let v=f;F.judged=!0;let k=F.attempt;if(k&&!F.outputStarted){if(!F.limit){let W2=X.limitFromError?.(J.error,k);if(W2)Z2(F,W2,"error")}if(F.ended)await F.ended;if(F.limit)await F.limit.delivered}v();let{decision:h,reason:a}=await j(F.scope.sessionID,async()=>{v();let W2=W.get(F.key);if(W.delete(F.key),W2?.next)await x(W2.next);v();let G2=_,e,C2,J2;if(F.accountId===void 0||!k)G2={retry:!1},e="no-account";else if(F.outputStarted)G2={retry:!1},e="output-started";else if(F.limit){let T2={accountId:F.accountId,limit:F.limit.signal},H2,A2={...F.scope,phase:"retry",previousAccountId:F.accountId,rerouteFrom:T2};try{H2=await X.chooseAccount(A2)}catch(h2){o("opencode2 auth chooseAccount threw while the retry hook looked for another account; the host decides the retry",{sessionID:F.scope.sessionID,error:s(h2)})}if(H2!==void 0)J2={accountId:H2,input:A2};try{v()}catch(h2){if(J2)await x(J2);throw h2}if(H2!==void 0&&H2!==F.accountId)F.rerouted=!0,C2=T2,G2={retry:!0,delay:0},e="reroute";else e="host-decides-last-account"}else e="host-decides";if(J.decision=G2,G2.retry&&F.accountId!==void 0&&Y.has(F.id))W.set(F.key,{attemptId:F.id,sessionID:F.scope.sessionID,accountId:F.accountId,...C2===void 0?{}:{rerouteFrom:C2},...J2===void 0?{}:{next:J2}});else if(J2)await x(J2);return{decision:G2,reason:e}});v(),await D("retry",{sessionID:J.sessionID,...F.accountId===void 0?{}:{accountId:F.accountId},kind:F.scope.kind,attempt:J.attempt,reason:a,hostDecision:_,decision:h,...k===void 0?{}:{handle:k}})})},Y2));let $$=(J)=>{S(J),E.delete(J);for(let Q of U)if(JSON.parse(Q)[0]===J)U.delete(Q);for(let Q of[...Y.values()]){if(Q.scope.sessionID!==J)continue;p(Q,"its session was forgotten"),Y.delete(Q.id)}for(let[Q,_]of W)if(_.sessionID===J)O(Q)},v2=new AbortController,J$=$.event;if(J$)(async()=>{try{for await(let J of J$.subscribe({signal:v2.signal}))if(J.type==="session.deleted")$$(J.data.sessionID)}catch(J){if(!v2.signal.aborted)o("opencode2 auth stopped listening for session deletion",{error:s(J)})}})();return{on(J,Q){let _=m.get(J);if(!_)_=new Set,m.set(J,_);let F=Q;return _.add(F),()=>{_.delete(F)}},accountFor(J,Q){return u(z2(J,Q))?.accountId},forgetSession:$$,get size(){return Y.size},async dispose(){if(c)return;c=!0;for(let J of r.keys())S(J);v2.abort();for(let J of Y.values())p(J,"the installation was disposed");Y.clear();for(let J of W.keys())O(J);U.clear(),E.clear(),m.clear(),await Promise.all(Z.values()),await Promise.all(j2.map(async(J)=>{try{await J.dispose()}catch(Q){o("opencode2 auth hook did not dispose cleanly",{error:s(Q)})}}))}}}import{CacheKeepManager as A1,CacheKeepSessionRegistry as q1,getDefaultCacheKeepRegistryDirectory as k1,isCacheKeepActiveNow as T$,isCacheKeepHybridActive as o2,isCacheKeepSubagentsEnabled as n2,logger as D1}from"@cortexkit/anthropic-auth-core";import{createHash as Z1}from"node:crypto";import{applyCustomHeaders as Y1,assertNotCustodyTombstone as G1,classifyGzipRejection as V1,createProviderErrorRedactor as G$,createProviderErrorResponseScope as V$,decideRequestGzip as j1,encodeGzipRequestBody as W1,getAccountStoragePath as Q1,getRequestGzipLatch as B1,getRequestGzipLatchPath as H1,mergeAnthropicBetas as U1,remapModelId as j$,remapRequestBodyModel as K1,stripEmptyTrailingAssistantMessages as M1,TrailingAssistantHistoryError as z1}from"@cortexkit/anthropic-auth-core";var S2="anthropic",N$="x-common-auth-attempt",_1=["x-session-affinity","x-opencode-session","x-parent-session-id",B$,k2,R2,N$],q2=new Set(["authorization","x-api-key"]),F1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",C1=512,N1=5000,L1=500,W$=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class L$ extends Error{sessionID;requestKind;kind="no-account";providerID=S2;constructor($,X){super(F1);this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicNoAccountError"}}class c2 extends Error{sessionID;requestKind;kind="session-forgotten";providerID=S2;constructor($,X){super("request refused: its session was closed while it was being prepared");this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicRevokedError"}}class L2 extends Error{kind="unsupported-transport";providerID=S2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class P$ extends Error{kind="local-invalid-request";status=400;check;constructor($){super($.message,{cause:$});this.name="NativeAnthropicLocalRefusal",this.check=$.check}}var _2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($);function O2($){try{return JSON.parse($)}catch{return}}function i2($){let X={};for(let[M,V]of Object.entries($??{}))X[M.toLowerCase()]=V;return X}function Q$($){let X={};for(let M of _1){let V=$.get(M);if(V!==null&&M!==N$)X[M]=V;$.delete(M)}return X}function P1($){try{return new URL($).pathname.endsWith("/messages")}catch{return!1}}function T1($){return $ instanceof z1||$ instanceof H$?new P$($):void 0}function E1($,X){let M=[];if($.oauth)M.push($.oauth.accessToken);for(let[V,L]of Object.entries($.apiHeaders??{})){if(L===null||!q2.has(V))continue;M.push(L.replace(/^Bearer\s+/i,""))}for(let V of q2){let L=X.get(V);if(L!==null)M.push(L.replace(/^Bearer\s+/i,""))}if($.dispatch?.kind==="http-relay")M.push($.dispatch.token);return[...new Set(M.filter(Boolean))]}var O1=new Set(["oauth-2025-04-20","claude-code-20250219",K$]);function S1($){let X=$.split(",").map((M)=>M.trim()).filter((M)=>M&&!O1.has(M));return U1(null,X)}function R1($){let X=O2($);if(!_2(X))return $;let M=M1(X.messages),V=Object.hasOwn(X,"fallbacks"),{droppedMarkers:L}=M$(X,!1),N=V&&!Object.hasOwn(X,"fallbacks"),P=K1(X);return M>0||L>0||N||P?JSON.stringify(X):$}async function x1($,X){if(!($ instanceof Promise))return"settled";let M;try{return await Promise.race([$.then(()=>"settled"),new Promise((V)=>{M=setTimeout(()=>V("timed-out"),X)})])}finally{if(M!==void 0)clearTimeout(M)}}function P2($){let{source:X,log:M}=$,V=Math.max(1,$.maxPendingSends??C1),L=$.attemptEndTimeoutMs??N1,N=$.requestGzipLatch??B1(H1(Q1())),P=new WeakSet,T=new Map,K=new WeakMap,Y=new WeakMap,H=new WeakMap,W=new Map,U=new WeakMap,E=G$([]);E.dispose();let q=(B)=>(B&&W.get(B)?.redactor)??E,A=(B)=>{let z=W.get(B);if(!z)return;W.delete(B),z.redactor.dispose(),z.scope.dispose()},m=(B,z,C,S)=>{let R=E1(z,S),b=V$(R,C);w.set(B,C),W.set(B,{sessionID:z.sessionID,redactor:G$(R),scope:b}),b.settled.then(()=>A(B));while(W.size>V){let g=W.keys().next().value;if(g===void 0)break;A(g)}},w=new WeakMap,c=(B,z)=>{let C=B?w.get(B):void 0;if(!C||!z.ok)return E.redactResponse(z);let S=V$([],C),R=S.redactResponse(z);return S.dispose(),R},r=(B,z)=>{let C=B?W.get(B)?.scope:void 0;if(!C)return c(B,z);try{return C.redactResponse(z)}catch{return c(B,z)}},o=!1,s=new WeakMap,Z=(B,z)=>{if(B&&!z.ok)s.set(z.headers,B);return z},j=(B,z)=>{if(z.dispatch!=="http-relay")return!0;let C=/^req_[A-Za-z0-9_-]+$/.test(B.get("request-id")??"");return Y.set(z,C),C},G=(B)=>new L$(B.sessionID,B.kind),x=new Map,O=async(B,z)=>{if(o)throw new c2(B.sessionID,B.kind);let C={revoked:!1},S=x.get(B.sessionID);if(!S)S=new Set,x.set(B.sessionID,S);S.add(C);let R=()=>{if(o||C.revoked)throw new c2(B.sessionID,B.kind)};try{let b=await z(R);return R(),b}finally{let b=x.get(B.sessionID);if(b?.delete(C)&&b.size===0)x.delete(B.sessionID)}},D=(B,z)=>{T.set(B,z);while(T.size>V){let C=T.keys().next().value;if(C===void 0)break;T.delete(C),M?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:V})}},y=(B,z)=>({providerID:B.providerID,modelID:B.modelID,sessionID:B.sessionID,agent:B.agent,kind:B.kind,accountId:B.accountId,attemptId:B.attemptId,transport:B.transport,route:z.route,provenance:z.provenance,dispatch:z.dispatch}),l=(B)=>O(B,async(z)=>{let{accountId:C,...S}=B,R=await X.authorizeAccount(S,C);return z(),p(S,R)}),p=(B,z)=>{if(!z)throw G(B);if(z.dispatch?.kind==="websocket-relay")throw new L2;let C=z.dispatch?.kind==="http-relay"?"http-relay":"direct",S=z.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":z.dispatch.token}:void 0;if(z.route==="oauth"){if(!z.accessToken)throw G(B);G1(z.accessToken,S2);let g=Object.freeze({route:"oauth",provenance:z.provenance,dispatch:C});D(g,{sessionID:B.sessionID,oauth:{accessToken:z.accessToken,...z.identity?{identity:z.identity}:{}},dispatch:z.dispatch,oauthHeaders:z.headers});let n=i2(z.headers);for(let i of q2)delete n[i];return delete n["anthropic-beta"],{headers:S??{...n,"x-api-key":null,authorization:`Bearer ${z.accessToken}`},attempt:g}}let R={authorization:null,"x-api-key":null,...i2(z.headers)};if(!R.authorization&&!R["x-api-key"])throw G(B);let b=Object.freeze({route:"api",provenance:z.provenance,dispatch:C});return D(b,{sessionID:B.sessionID,...z.baseURL?{baseURL:z.baseURL}:{},dispatch:z.dispatch,apiHeaders:R}),{headers:S??R,attempt:b}},I=(B)=>O(B,(z)=>u(B,z)),u=async(B,z)=>{let{request:C,attempt:S}=B,R=S.data,b=R?T.get(R):void 0;if(R)T.delete(R);if(!R||!b||R.route==="oauth"&&!b.oauth)throw G(B);let g=new Headers(C.headers);Y1(g);let n=Q$(g),i=C.body===null?void 0:await C.text();z();let X2=i!==void 0&&P1(C.url);try{if(R.route==="oauth"&&b.oauth){let{accessToken:$2,identity:t}=b.oauth;for(let[K2,Y2]of Object.entries(i2(b.oauthHeaders))){if(q2.has(K2))continue;if(Y2===null)g.delete(K2);else g.set(K2,Y2)}let U2=null;if(i!==void 0&&X2){let K2={...y(S,R),modelID:(()=>{let B2=O2(i);return j$(_2(B2)&&typeof B2.model==="string"?B2.model:B.modelID)})(),route:"oauth",correlation:n},Y2=await X.requestOptions?.(K2)??{};z(),i=await F$(i,{...Y2,...t?{identity:t}:{},sessionId:B.sessionID,onToolNameMap:(B2)=>H.set(R,B2)});let j2=O2(i);U2=_2(j2)?j2:null}z$(g,$2,{body:U2,...t?{identity:t}:{},requestClass:U$(S.agent)?"auxiliary":"main"})}else{if(i!==void 0&&X2)i=R1(i);g.delete("authorization"),g.delete("x-api-key");for(let[t,U2]of Object.entries(b.apiHeaders??{}))if(U2===null)g.delete(t);else g.set(t,U2);if(i!==void 0&&X2&&!g.has("content-type"))g.set("content-type","application/json");let $2=g.get("anthropic-beta");if($2!==null){let t=S1($2);if(t)g.set("anthropic-beta",t);else g.delete("anthropic-beta")}}}catch($2){let t=T1($2);if(!t)throw $2;throw K.set(R,t.check),M?.warn("refused an Anthropic request locally; nothing was sent",{check:t.check}),t}let V2=i!==void 0?O2(i):void 0;if(await X.admitRequest?.({...y(S,R),modelID:j$(_2(V2)&&typeof V2.model==="string"?V2.model:B.modelID)}),Q$(g),i!==void 0)g.delete("content-length");z(),m(R,b,_2(V2)&&V2.stream===!0?"event-stream":"http",g);let Z2=_$(C.url,b.baseURL!==void 0?{baseURL:b.baseURL}:{}).url?.toString()??C.url;if(R.route==="oauth"&&X2&&i!==void 0)await X.onRequestPrepared?.({...y(S,R),url:Z2,bodyText:i}),z();if(b.dispatch?.kind==="http-relay"){let $2=i??"";g.delete("x-relay-token");let t={protocol:1,type:"request",affinity:B.sessionID,upstream:{url:Z2,method:C.method,headers:Object.fromEntries(g)},mode:"full_sync",revision:1,body:$2,next_hash:`sha256:${Z1("sha256").update($2).digest("hex")}`};return new Request(b.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":b.dispatch.token},redirect:"error",signal:C.signal,body:JSON.stringify(t)})}let F2=i;if(R.route==="oauth"&&X2&&i!==void 0){let $2=await j1({url:Z2,body:i,latch:N});if(z(),$2.gzip)F2=await W1(i),g.set("content-encoding","gzip"),P.add(R),z()}return new Request(Z2,{method:C.method,headers:g,redirect:C.redirect,signal:C.signal,...F2!==void 0?{body:F2}:{}})};return{adapter:{providerID:S2,chooseAccount:(B)=>O(B,async()=>{let z=await X.chooseAccount(B);if(!z)throw G(B);return z}),dropChoice:(B)=>X.dropChoice?.(B),accountHeaders:l,rewriteRequest:I,rewriteHandshakeURL(){throw new L2},rewriteResponse({response:B,attempt:z}){let C=z.data;if(C&&!j(B.headers,C)){if(B.status===401)return A(C),B.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return r(C,B)}if(C&&P.has(C))P.delete(C),V1(B).then((n)=>{if(!n)return;N.latchProcess(),M?.warn("gzipped request body rejected; later requests go uncompressed",{kind:n,status:B.status})},()=>{});let S=r(C,B);if(C?.route!=="oauth"||!S.body)return Z(C,S);let R={...y(z,C),status:B.status},b=X.responseOptions?.(R)??{},g=(B.headers.get("content-type")??"").includes("application/json");return Z(C,C$(S,{...b,toolNameMap:H.get(C),onToolNameRefusal:()=>{K.set(C,"response_tool_names"),A(C)},laneStartOAuthServed:!0,...g?{responseMode:"json"}:{}}))},quotaFromHeaders(B,z,C){let S=C.data;if(!S||!j(B,S))return;return X.quotaFromHeaders?.(B,{...y(C,S),status:z})},async limitFromResponse({status:B,headers:z,body:C,attempt:S}){let R=S.data;if(!R||K.get(R)==="response_tool_names")return;if(!j(z,R))return X.limitFromRelayFailure?.({...y(S,R),status:B});if(U.set(R,`provider responded with HTTP ${B}`),!X.limitFromResponse)return;let b=s.get(z)===R,g=q(R);return X.limitFromResponse({...y(S,R),status:B,headers:z,body:async()=>b?await C():g.redactText(await C())})},inspectEvent({data:B,event:z,attempt:C}){if(C.data&&K.get(C.data)==="response_tool_names")return;let S=O2(B);if(!_2(S))return;let R=typeof S.type==="string"?S.type:z;if(R==="content_block_start"||R==="content_block_delta")return{outputStarted:!0};if(R==="message_stop")return{done:!0};if(R!=="error")return;let b=C.data,g=q(b),n=_2(S.error)?S.error:{},i=typeof n.type!=="string"?void 0:W$.has(n.type)?n.type:g.redactText(n.type),X2=typeof n.message==="string"?g.redactText(n.message):void 0;if(b?.dispatch==="http-relay"&&Y.get(b)===!1)return;let V2=b?X.limitFromStreamError?.({...y(C,b),errorType:i,message:X2}):void 0,Z2={error:[i??"error",X2].filter(Boolean).join(": ").slice(0,L1),...V2?{limit:V2}:{}};if(b&&Z2.error)U.set(b,Z2.error);return Z2},limitFromError(B,z){let C=z.data;if(!C||K.has(C))return;let S={type:W$.has(B.type)?B.type:"provider_error",message:U.get(C)??"provider request failed",...B.status!==void 0?{status:B.status}:{}};if(A(C),C.dispatch==="http-relay"&&Y.get(C)===!1)return;return X.limitFromHostError?.(S,y(z,C))},async onAttemptEnd(B,z){let C=B.data;if(!C)return;T.delete(C);let S=z.error?.reason;if(S==="cancelled"||S==="abandoned"||S===void 0&&(z.status===void 0||z.status<400))A(C);let R=K.get(C),{status:b,...g}=z,n=X.onAttemptEnd?.(y(B,C),{...g,...b!==void 0&&(C.dispatch!=="http-relay"||Y.get(C)===!0)?{status:b}:{},...R!==void 0?{localRefusal:{check:R}}:{}});if(await x1(n,L)==="timed-out")M?.warn("the account source did not finish recording a send",{timeoutMs:L})}},dispose(){o=!0;for(let[B,z]of x){for(let C of z)C.revoked=!0;X.forgetSession?.(B)}x.clear(),T.clear();for(let B of[...W.keys()])A(B)},forgetSession(B){for(let z of x.get(B)??[])z.revoked=!0;x.delete(B);for(let[z,C]of T)if(C.sessionID===B)T.delete(z);for(let[z,C]of[...W])if(C.sessionID===B)A(z);X.forgetSession?.(B)},get pendingSendCount(){return T.size},get heldCredentialCount(){let B=0;for(let z of T.values())if(z.oauth)B++;return B},get heldRedactorCount(){return W.size},get operationsInProgress(){let B=0;for(let z of x.values())B+=z.size;return B}}}function x2($){return JSON.stringify([$.source,$.accountIdentity,$.credentialId,$.binding?.storageId,$.binding?.rowId,$.binding?.credentialEpoch])}function E$($){let{runtime:X,source:M}=$,V=new AbortController,L=!1,N=new q1({directory:$.registryDirectory||process.env.OPENCODE_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR||k1("opencode"),now:$.now}),P=new Map,T=async(W,U,E)=>{let q=E?AbortSignal.any([V.signal,E]):V.signal;q.throwIfAborted();let A=JSON.parse(await U.text()),m={providerID:"anthropic",modelID:A.model,sessionID:`oc2-cachekeep:${W.id}`,agent:"cachekeep",kind:"generate"},w=P2({source:{...M,onRequestPrepared:void 0,responseOptions:void 0,async requestOptions(Z){return{...await M.requestOptions?.(Z),laneStart:!1,billingLineage:void 0,cacheDiagnosticsPreviousMessageId:void 0}},async authorizeAccount(Z,j){let G=await X.read();q.throwIfAborted();let x=G.accounts.find((D)=>D.id===j);if(x?.type!=="oauth"||x2(x)!==W.oauthAccountIdentity||W.isSubagent&&!n2(G.policyStorage)||!o2(G.policyStorage)||!T$(G.policyStorage,new Date($.now?.()??Date.now())))return;let O=await M.authorizeAccount(Z,j);if(O?.provenance.kind==="local"&&x2({...x,binding:O.provenance.subject.binding,accountIdentity:O.provenance.subject.binding.identity})!==W.oauthAccountIdentity)return;if(O?.provenance.kind==="vault"&&O.provenance.credentialId!==x.credentialId)return;return O},async admitRequest(Z){await M.admitRequest?.(Z);let j=await X.read(),G=j.accounts.find((x)=>x.id===Z.accountId);if(q.throwIfAborted(),!G||x2(G)!==W.oauthAccountIdentity||W.isSubagent&&!n2(j.policyStorage)||!o2(j.policyStorage)||!T$(j.policyStorage,new Date($.now?.()??Date.now())))throw Error("CacheKeep policy changed before dispatch")}}}),c,r,o=!1,s=()=>w.forgetSession(m.sessionID);q.addEventListener("abort",s,{once:!0});try{let Z=(await X.read()).accounts.find((y)=>x2(y)===W.oauthAccountIdentity)?.id;if(!Z)throw Error("CacheKeep account is unavailable");let j=await w.adapter.accountHeaders({...m,accountId:Z});if(!("headers"in j)||typeof j.headers!=="object"||j.headers===null||typeof j.attempt!=="object"||j.attempt===null||j.attempt.route!=="oauth")throw Error("CacheKeep authorization refused");c={...m,accountId:Z,attemptId:crypto.randomUUID(),transport:"http",data:j.attempt};let G=await w.adapter.rewriteRequest?.({...m,accountId:Z,attempt:c,request:new Request(W.url,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(A),signal:q})});if(!G)throw Error("CacheKeep rewrite refused");q.throwIfAborted();let x=await($.fetch??fetch)(G),O=await w.adapter.rewriteResponse?.({...m,accountId:Z,attempt:c,request:G,response:x});if(!O)throw Error("CacheKeep response rewrite refused");if(r=O.status,w.adapter.quotaFromHeaders?.(O.headers,O.status,c),!O.ok)await w.adapter.limitFromResponse?.({status:r,headers:O.headers,body:()=>O.clone().text(),attempt:c});let D=await O.arrayBuffer();return o=!0,new Response(D,{status:r,headers:O.headers})}catch{throw Error("Native CacheKeep was not completed")}finally{q.removeEventListener("abort",s);try{if(c)await w.adapter.onAttemptEnd?.(c,{status:r,outputStarted:!1,...o?{}:{error:{reason:"cancelled"}}})}finally{w.dispose(),M.forgetSession?.(m.sessionID)}}},K=$.setIntervalImpl??globalThis.setInterval,Y=new A1({loadStorage:async()=>L?null:(await X.read()).policyStorage,now:$.now,setIntervalImpl:(W,U)=>K(()=>Y.tick().catch(()=>{D1.warn("cachekeep","tick failed")}),U),clearIntervalImpl:$.clearIntervalImpl,onTrackedSessionsChanged:(W)=>N.publish(L?[]:W),prepareHeaders(W,U,E){if(L)return;return P.set(E.id,{target:U,attempt:E}),new Headers({"x-native-cachekeep-attempt":String(E.id)})},fetchImpl:async(W,U)=>{let E=new Request(W,U),q=Number(E.headers.get("x-native-cachekeep-attempt")),A=P.get(q);if(P.delete(q),!A)throw Error("CacheKeep attempt is unavailable");return T(A.target,E,A.attempt.signal)},onComplete:({attempt:W})=>{P.delete(W.id)}}),H;return{async track(W){if(L||W.route!=="oauth"||W.agent==="cachekeep"||W.agent==="prime"||W.kind!=="primary")return;let U=await X.read();if(L||!o2(U.policyStorage))return;let E=!1;try{E=await $.isSubagent?.(W.sessionID)??!1}catch{return}if(L||E&&!n2(U.policyStorage))return;let q=U.accounts.find((A)=>A.id===W.accountId);if(!q?.accountIdentity)return;if(W.provenance.kind==="local"&&JSON.stringify(q.binding)!==JSON.stringify(W.provenance.subject.binding))return;if(W.provenance.kind==="vault"&&q.credentialId!==W.provenance.credentialId)return;Y.track({sessionId:W.sessionID,url:W.url,headers:new Headers,bodyText:W.bodyText,storage:U.policyStorage,cacheMode:"hybrid",oauthAccountId:W.accountId,oauthAccountIdentity:x2(q),isSubagent:E}),await N.publish(Y.trackedSessions())},registry:N,dispose(){if(H)return H;return L=!0,Y.stop(),V.abort(),H=(async()=>{try{await Y.tick()}finally{P.clear(),await N.dispose()}})(),H}}}async function O$($,X,M){let V=P2(X),L=[],N=async(U,E,q)=>{let A=await $.session.hook(U,E,q);return L.push(A),A},P=new AbortController,T;try{T=await u2({session:{hook:N},event:$.event},V.adapter,{logger:X.log,gateOnPlaceholder:M})}catch(U){throw V.dispose(),await Promise.allSettled(L.map((E)=>E.dispose())),U}let K=(U)=>{V.forgetSession(U),T.forgetSession(U)},Y=$.event,H=Y?(async()=>{try{for await(let U of Y.subscribe({signal:P.signal}))if(U.type==="session.deleted")K(U.data.sessionID)}catch(U){if(!P.signal.aborted)X.log?.warn("stopped listening for session deletion",{error:U instanceof Error?U.name:"unknown"})}})():Promise.resolve(),W;return{installation:T,forgetSession:K,dispose(){if(W)return W;return V.dispose(),P.abort(),W=(async()=>{await T.dispose(),await H})(),W}}}import{effectiveRelayTransport as S$,getQuotaCheckIntervalMs as b1,logger as w1,nativeAccountCanServe as y1,oauthProfileIsFresh as I1,quotaSnapshotCheckedAt as f1}from"@cortexkit/anthropic-auth-core";function R$($,X){let M=new AbortController,V,L=!1,N=async()=>{let K=await $.read();if(M.signal.throwIfAborted(),K.policyStorage.relay?.enabled===!0&&S$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="websocket")return;let Y=K,H=b1(Y.policyStorage);for(let W of Y.accounts){if(M.signal.aborted)return;if(!y1(W)||W.type!=="oauth")continue;if(Y.policyStorage.quota?.enabled!==!1&&Date.now()-f1(W.quota)>=H)await $.fetchQuota(W.id,X,M.signal,void 0,"background").catch(()=>{});if(!I1(W.profile)&&!M.signal.aborted)await $.fetchProfile(W.id,X,M.signal).catch(()=>{})}},P=()=>{if(L||V)return V;return V=N().catch(()=>{if(!M.signal.aborted)w1.debug("opencode2","native background readings did not complete")}).finally(()=>{V=void 0}),V},T=$.vault.watch({intervalMs:60000,onRefresh:P,shouldRefresh:async()=>{let K=await $.read();return K.policyStorage.relay?.enabled!==!0||S$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="http"}});return T.ready.catch(()=>{}),{async dispose(){L=!0,T.close(),M.abort(),await V}}}import{authorize as n1,buildCacheKeepStatusSummary as r1,buildClaudeQuotaSummary as s1,buildPrimeAccountStatuses as a1,buildPrimeStatusSummary as t1,CLAUSTRUM_OPENCODE_ENROLLMENT_NAME as e1,exchange as $J,formatNativeAccountState as JJ,formatOAuthAccountTier as XJ,getCacheKeepWindow as ZJ,getHostClaustrumEnrollmentPaths as YJ,isCacheKeepAlways as GJ,isCacheKeepHybridActive as VJ,isCacheKeepPersistentlyEnabled as jJ,nativeAccountCanServe as WJ,resetClaustrumEnrollmentState as QJ}from"@cortexkit/anthropic-auth-core";import{buildPrimeAccountStatuses as g1,effectiveRelayStatus as v1,formatNativeAccountState as h1,formatOAuthAccountTier as x$,getCacheKeepWindow as m1,getRoutingMode as l1,isCacheKeepAlways as d1,isCacheKeepHybridActive as p1,isPermanentRefreshError as u1,isPrimePersistentlyEnabled as i1,nativeAccountCanServe as k$,refreshBackoffActive as A$}from"@cortexkit/anthropic-auth-core";var q$=($)=>k$($)&&$.state!=="unsupported-access"?void 0:h1($)||void 0,c1=($)=>{if($.source!=="vault")return"off";if($.state==="needs_reauth")return"on-vault-reauth";return k$($)?"on-vault-served":"on-cold"},o1=($,X)=>typeof $==="number"&&$>X;function D$($,X){let{now:M}=X,V=$.policyStorage,L=$.accounts.filter((H)=>H.type==="oauth"),N=L.find((H)=>H.id==="main"),P=N?q$(N):void 0,T=N?.lastQuotaRefreshError?.nextRetryAt,K=N?.lastRefreshError,Y=m1(V);return{main:{quota:N?.quota??null,enabled:N?.enabled,tierLabel:x$(N?.profile),quotaBackedOff:o1(T,M),quotaBackoffUntil:T,refreshBackedOff:A$(K,N?.accountIdentity,M,void 0),refreshBackoffUntil:K?.nextRetryAt,stateLine:P,quotaDated:Boolean(P)},fallbacks:L.filter((H)=>H.id!=="main"&&(H.enabled||H.source==="vault")).map((H)=>{let W=q$(H),U=c1(H);return{id:H.id,label:H.label,quota:H.quota??null,enabled:H.enabled,tierLabel:x$(H.profile),needsReauth:u1(H.lastRefreshError)&&A$(H.lastRefreshError,H.accountIdentity,M,void 0),...U==="on-vault-reauth"?{vaultReauth:!0}:{},...U==="on-vault-served"?{vaultServed:!0}:{},...U!=="off"?{custodyState:U}:{},stateLine:W,quotaDated:Boolean(W)}}),activeId:X.activeId,route:l1(V),relay:v1(V.relay),fastMode:V.claudeFast?.enabled===!0,cacheKeep:{enabled:p1(V),window:d1(V)?"always":Y?`${Y.startHour}-${Y.endHour}`:void 0,trackedSessions:X.trackedSessions},prime:i1(V)?{enabled:!0,accounts:g1(V,{now:M})}:void 0,lastUpdated:M}}var r2=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{},b$=`For first-time model access, connect Anthropic with "${w2}".
-Run: opencode auth login anthropic --method ${b2}`,w$=($)=>$.mode==="local"&&!$.accounts.some((X)=>X.id==="main"),BJ=($)=>{let X=$.id==="main"?"main":"fallback",M=`${$.enabled?"enabled":"disabled"}, ${$.type}, ${$.source}${$.state?`, ${JJ($)}`:""}`;if($.label)return`${$.label} [${X}]: ${M}
-  Route: ${$.id}`;return`${X==="main"?"Main account":`Fallback ${$.id}`}: ${M}`};function y$($){let{runtime:X,source:M}=$,V=new Map,L=!1,N=async(Y,H)=>{await X.updateSettings((W)=>({...W,[Y]:{...r2(W[Y]),...H}}))},P=()=>({ok:!0,text:"Native Claude settings updated."}),T=async(Y,H)=>{if(L)throw Error("Native menu is closed");switch(H.signal?.throwIfAborted(),Y.action){case"enable":case"disable":return await X.setEnabled(Y.values.id,Y.action==="enable"),P();case"remove":return await X.remove(Y.values.id),P();case"move-up":case"move-down":{let U=(await X.read()).accounts.map((w)=>w.id),E=U.indexOf(Y.values.id),q=E+(Y.action==="move-up"?-1:1);if(E<0||q<0||q>=U.length)return{ok:!1,text:"Account cannot move in that direction."};let A=U[E],m=U[q];if(A===void 0||m===void 0)return{ok:!1,text:"Account order changed."};return U[E]=m,U[q]=A,await X.reorder(U),P()}case"add-apikey":return await X.addApi(Y.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let W=new AbortController;V.get(Y.sessionId)?.active.abort();let U={active:W,auth:void 0};V.set(Y.sessionId,U);let E=await n1("max");if(L||W.signal.aborted||H.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return U.auth=E,{ok:!0,text:`Open ${E.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let W=V.get(Y.sessionId);if(!W?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let U=await $J(Y.values.code,W.auth.verifier,W.auth.redirectUri,W.auth.state);if(W.active.signal.throwIfAborted(),H.signal?.throwIfAborted(),L||U.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await X.loginOAuth({routeId:crypto.randomUUID(),credential:{access:U.access,refresh:U.refresh,expires:U.expires},label:Y.values.label}),W.active.signal.throwIfAborted(),H.signal?.throwIfAborted(),L)return{ok:!1,text:"Sign-in cancelled."};V.delete(Y.sessionId);let E="OAuth account stored in the native account pool.";return{ok:!0,text:w$(await X.read())?`${E}
+`)}}function d2($,X){let M=new TextDecoder,V="",L=(P)=>{let T=$1(P);if(!T)return;try{$(T)}catch(K){X(K)}},N=()=>{for(;;){let P=/\r?\n\r?\n/.exec(V);if(!P)return;let T=V.slice(0,P.index);V=V.slice(P.index+P[0].length),L(T)}};return new TransformStream({transform(P,T){T.enqueue(P),V+=M.decode(P,{stream:!0}),N()},flush(){if(V+=M.decode(),N(),V.trim()!=="")L(V);V=""}})}var Y$=512,N2="x-common-auth-attempt",z2=($,X)=>JSON.stringify([$,X]),Q2=($)=>({providerID:$.model.providerID,modelID:$.model.id,sessionID:$.sessionID,agent:$.agent,kind:$.kind});function J1($){let X=$.headers;return typeof X==="object"&&X!==null}function X1($,X){let M=$.getReader();return new ReadableStream({async pull(V){let L;try{L=await M.read()}catch(N){X({reason:"failed",message:N instanceof Error?N.message:String(N)}),V.error(N);return}if(L.done)X(),V.close();else V.enqueue(L.value)},async cancel(V){X({reason:"cancelled",...V===void 0?{}:{message:String(V)}}),await M.cancel(V)}})}function p2($,X){for(let[M,V]of Object.entries(X)){let L=M.toLowerCase();for(let N of Object.keys($))if(N.toLowerCase()===L)delete $[N];if(V!==null)$[M]=V}}function Z1($,X){for(let[M,V]of Object.entries(X))if(V===null)$.delete(M);else $.set(M,V)}async function u2($,X,M={}){let{providerID:V}=X,L=M.gateOnPlaceholder,N=(J)=>L===void 0||L.credential(J)===M2(V),P=M.logger,T=Math.max(1,M.maxRecords??Y$),K=[...M.hostCredentials??[M2(V)],...L?[M2(V)]:[]].filter((J)=>J!==""),Y=new Map,H=new WeakMap,W=new Map,U=new Set,E=new Map,q=!1,A=!1,m=new Map,w=0,c=!1,r=new Map,o=(J,Q)=>{try{P?.warn(J,Q)}catch{}},s=(J)=>J instanceof Error?J.message:String(J),Z=new Map,j=(J,Q)=>{let _=(Z.get(J)??Promise.resolve()).then(Q),F=_.then(()=>{},()=>{});return Z.set(J,F),F.then(()=>{if(Z.get(J)===F)Z.delete(J)}),_},G=(J,Q)=>{let _=Z.get(J);return _?_.then(()=>G(J,Q)):Q()},x=async(J)=>{try{await X.dropChoice?.({...J.input,accountId:J.accountId})}catch(Q){o("opencode2 auth dropChoice threw; the request is unaffected",{sessionID:J.input.sessionID,error:s(Q)})}},O=(J)=>{let Q=W.get(J);if(W.delete(J),Q?.next){let _=Q.next;j(Q.sessionID,()=>x(_))}},D=async(J,Q)=>{let _=m.get(J);if(!_||_.size===0)return;await Promise.all([..._].map(async(F)=>{try{await F(Q)}catch(f){o("opencode2 auth listener threw; the request is unaffected",{event:J,error:s(f)})}}))},y=async(J,Q)=>{try{await X.onAttemptEnd?.(J,Q)}catch(_){o("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:J.attemptId,error:s(_)})}},l=(J,Q)=>{if(J.ended||!J.attempt)return;let _={...J.status===void 0?{}:{status:J.status},outputStarted:J.outputStarted,...J.limit?{limit:J.limit.signal}:{},...Q?{error:Q}:{}};if(Q)J.endError=Q;J.ended=y(J.attempt,_)},p=(J,Q)=>l(J,{reason:"abandoned",message:Q}),I=(J)=>[...Y.values()].filter((Q)=>Q.key===J),u=(J)=>I(J).at(-1),d=(J)=>{if(Y.delete(J.id),W.get(J.key)?.attemptId===J.id||!I(J.key).length)O(J.key)},B=(J)=>{Y.set(J.id,J);while(Y.size>T){let Q=Y.values().next().value;if(Q===void 0)break;p(Q,"dropped to keep the record bound"),d(Q)}},z=(J)=>J.accountId===void 0?void 0:{...J.scope,accountId:J.accountId},C=(J,Q)=>new E2({kind:"no-account",providerID:V,sessionID:J.sessionID,requestKind:J.kind,...Q===void 0?{}:{message:Q}}),S=(J)=>{r.get(J)?.clear(),r.delete(J)},R=async(J,Q)=>{let _=()=>C(J,`${V} ${J.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(c)throw _();let F=r.get(J.sessionID);if(!F)F=new Set,r.set(J.sessionID,F);let f={};F.add(f);let v=()=>{if(!F.has(f))throw _()};try{return await Q(v)}finally{if(F.delete(f),F.size===0&&r.get(J.sessionID)===F)r.delete(J.sessionID)}},b=(J,Q)=>{for(let[_,F]of Q)if(K.some((f)=>F.includes(f)))throw new E2({kind:"host-credential-on-wire",providerID:V,sessionID:J.sessionID,requestKind:J.kind,message:`${V} ${J.kind} request still carries the host's placeholder credential in ${_}; the adapter's account headers must replace it`})},g=(J)=>{for(let Q of I(J))if(Q.ended||!Q.attempt)d(Q);else if(Q.transport==="ws"||Q.judged)p(Q,"a newer attempt of its session and kind began"),d(Q)},n=async(J,Q,_,F)=>{let f=z2(J.sessionID,J.kind),{input:v,accountId:k}=await G(J.sessionID,async()=>{_();let e=W.get(f);W.delete(f);let C2=e?.accountId??u(f)?.accountId;g(f);let J2=e?.next,T2=J2!==void 0&&J2.input.modelID===J.modelID&&J2.input.agent===J.agent,H2={...J,phase:"request",...C2===void 0?{}:{previousAccountId:C2},...e?.rerouteFrom?{rerouteFrom:e.rerouteFrom}:{}};if(J2&&!T2)await j(J.sessionID,()=>x(J2)),_();let A2=T2?J2.accountId:await X.chooseAccount(H2);return{input:H2,accountId:A2}});_();let h={},a;if(k!==void 0){let e=await X.accountHeaders({...J,accountId:k});if(_(),J1(e))h=e.headers,a=e.attempt;else h=e}let W2=`attempt-${++w}`,G2={id:W2,key:f,scope:J,accountId:k,headers:h,attempt:k===void 0?void 0:{...J,accountId:k,attemptId:W2,transport:F,data:a},...F===void 0?{}:{transport:F},outputStarted:!1};if(B(G2),G2.attempt)D("select",{...J,accountId:G2.attempt.accountId,hook:Q,...v.previousAccountId===void 0?{}:{previousAccountId:v.previousAccountId},...v.rerouteFrom===void 0?{}:{rerouteFrom:v.rerouteFrom},handle:G2.attempt});return G2},i=async(J,Q,_,F,f)=>{let v=z2(J.sessionID,J.kind),k=F===void 0?void 0:Y.get(F);if(k?.key!==v)k=void 0;if(!k){if(k=u(v),I(v).filter((a)=>a.transport===void 0&&!a.ended).length>1&&!A)A=!0,o("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:J.sessionID,kind:J.kind})}if(!k||k.transport!==void 0||k.ended)k=await n(J,Q,f,_);else if(k.transport=_,k.attempt)k.attempt.transport=_;if(_==="ws"){for(let h of I(v))if(h!==k&&h.transport==="ws")p(h,"a newer attempt of its session and kind went out over WebSocket")}return k},Z2=async(J,Q)=>{try{return await Q()}catch(_){throw l(J,{reason:"failed",message:s(_)}),_}},V2=(J,Q)=>{let _=I(z2(J,Q)).filter((F)=>F.transport==="ws").at(-1);return _?.attempt!==void 0&&!_.ended?_:void 0},X2=(J,Q,_)=>{let F=z(J);if(!F||!J.attempt||J.limit)return;J.limit={signal:Q,delivered:D("limit",{...F,via:_,limit:Q,outputStarted:J.outputStarted,handle:J.attempt})}},F2=(J,Q,_,F)=>{let f=z(J);if(!f||!J.attempt)return;D("quota",{...f,transport:Q,...F===void 0?{}:{status:F},quota:_,handle:J.attempt})},$2=(J,Q,_,F)=>{let f=J.attempt;if(!f)return;let v=X.inspectEvent?.(F===void 0?{transport:Q,data:_,attempt:f}:{transport:Q,data:_,event:F,attempt:f});if(!v)return;if(v.quota!==void 0)F2(J,Q,v.quota);if(v.outputStarted)J.outputStarted=!0;if(v.limit)X2(J,v.limit,Q);if(v.error!==void 0)l(J,{reason:"failed",message:v.error});else if(v.done)l(J)},t=(J,Q)=>{let _=J.attempt;if(!_||Q.accountId===J.accountId)return;if(_.reboundFrom??=_.accountId,_.accountId=Q.accountId,"data"in Q)_.data=Q.data;J.accountId=Q.accountId},U2=(J)=>!J.attempt||J.endError!==void 0||J.status!==void 0&&J.status>=400,K2=(J)=>{let Q=[...Y.values()].filter((h)=>h.scope.sessionID===J),_=Q.filter((h)=>h.limit&&!h.rerouted).at(-1);if(_)return _;let F=Q.filter((h)=>h.scope.kind==="primary"),f=F.length>0?F:Q;if(f.length<=1)return f[0];let v=f.filter((h)=>!h.judged&&U2(h)).at(-1);if(v)return v;let k=f.filter((h)=>h.attempt&&!h.ended);if(k.length>1)return"ambiguous";return k[0]??f.at(-1)},Y2={providerID:V},j2=[];j2.push(await $.session.hook("model.request",(J)=>{if(L)return;return R(Q2(J),async(Q)=>{let _=await n(Q2(J),"model.request",Q);if(Q(),_.accountId===void 0)throw C(_.scope);p2(J.headers,{..._.headers,[N2]:_.id})})},Y2)),j2.push(await $.session.hook("http.request",(J)=>{if(L){let Q=N(J.request.headers);if(E.set(J.sessionID,Q),!Q)return}return R(Q2(J),async(Q)=>{let _=J.request.headers.get(N2)??void 0,F=L?await n(Q2(J),"http.request",Q,"http"):await i(Q2(J),"http.request","http",_,Q);Q();let f=z(F),v=F.attempt;if(!f||!v)throw C(F.scope);await Z2(F,async()=>{let k=J.request;if(X.rewriteRequest){if(_!==void 0){let W2=new Headers(k.headers);W2.delete(N2),k=new Request(k,{headers:W2})}k=await X.rewriteRequest({...f,request:k,attempt:v})??k,Q()}let h=new Headers(k.headers);h.delete(N2),Z1(h,F.headers),b(F.scope,h.entries());let a=new Request(k,{headers:h});H.set(a,F),J.request=a})})},Y2)),j2.push(await $.session.hook("http.response",async(J)=>{let Q=H.get(J.request);if(!Q){if(L)return;if(!q)q=!0,o("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:J.sessionID,kind:J.kind});return}let _=J.response;if(X.answeredBy&&Q.attempt){let h=Q.attempt,a=await Z2(Q,async()=>X.answeredBy?.({request:J.request,response:_,attempt:h}));if(a)t(Q,a)}let F=z(Q),f=Q.attempt;if(!F||!f)return;Q.status=_.status;let v=X.quotaFromHeaders?.(_.headers,_.status,f);if(v!==void 0)F2(Q,"http",v,_.status);if(!_.ok&&X.limitFromResponse){let h=await X.limitFromResponse({status:_.status,headers:_.headers,body:()=>_.clone().text(),attempt:f});if(h)X2(Q,h,"http")}if(!_.ok||!_.body)l(Q);let k=_;if(_.body&&(X.inspectEvent||X.onAttemptEnd)){let h=_.body;if(X.inspectEvent)h=h.pipeThrough(d2((a)=>$2(Q,"http",a.data,a.event),(a)=>o("opencode2 auth event inspection threw",{error:s(a)})));k=new Response(X1(h,(a)=>l(Q,a)),{status:_.status,statusText:_.statusText,headers:_.headers})}if(X.rewriteResponse)k=await X.rewriteResponse({...F,request:J.request,response:k,attempt:f})??k;if(k!==_)J.response=k},Y2)),j2.push(await $.session.hook("experimental.ws.handshake",(J)=>{if(L){let Q=N(new Headers(J.headers)),_=z2(J.sessionID,J.kind);if(E.set(J.sessionID,Q),U.delete(_),!Q)return}return R(Q2(J),async(Q)=>{let _;for(let k of Object.keys(J.headers)){if(k.toLowerCase()!==N2)continue;_??=J.headers[k],delete J.headers[k]}let F=L?await n(Q2(J),"experimental.ws.handshake",Q,"ws"):await i(Q2(J),"experimental.ws.handshake","ws",_,Q);Q();let f=z(F),v=F.attempt;if(!f||!v)throw C(F.scope);await Z2(F,async()=>{p2(J.headers,F.headers);let k=X.rewriteHandshakeURL?.({...f,url:J.url,attempt:v});if(k!==void 0)J.url=k;if(b(F.scope,Object.entries(J.headers)),L)U.add(F.key)})})},Y2));let B2=X.rewriteWebSocketFrame?.bind(X);if(B2)j2.push(await $.session.hook("experimental.ws.send",async(J)=>{let Q=Q2(J);if(L&&!U.has(z2(Q.sessionID,Q.kind)))return;let _=V2(Q.sessionID,Q.kind),F=await B2({...Q,attempt:_?.attempt,frame:J.frame});if(F!==void 0)J.frame=F},Y2));j2.push(await $.session.hook("experimental.ws.receive",(J)=>{if(L&&!U.has(z2(J.sessionID,J.kind)))return;let Q=V2(J.sessionID,J.kind);if(!Q)return;try{$2(Q,"ws",J.frame)}catch(_){o("opencode2 auth frame inspection threw",{error:s(_)})}},Y2)),j2.push(await $.session.hook("retry",async(J)=>{if(L&&E.get(J.sessionID)!==!0)return;let Q=K2(J.sessionID);if(!Q)return;let _=J.decision;if(Q==="ambiguous"){await D("retry",{sessionID:J.sessionID,attempt:J.attempt,reason:"host-decides",hostDecision:_,decision:_});return}let F=Q;await R(F.scope,async(f)=>{let v=f;F.judged=!0;let k=F.attempt;if(k&&!F.outputStarted){if(!F.limit){let W2=X.limitFromError?.(J.error,k);if(W2)X2(F,W2,"error")}if(F.ended)await F.ended;if(F.limit)await F.limit.delivered}v();let{decision:h,reason:a}=await j(F.scope.sessionID,async()=>{v();let W2=W.get(F.key);if(W.delete(F.key),W2?.next)await x(W2.next);v();let G2=_,e,C2,J2;if(F.accountId===void 0||!k)G2={retry:!1},e="no-account";else if(F.outputStarted)G2={retry:!1},e="output-started";else if(F.limit){let T2={accountId:F.accountId,limit:F.limit.signal},H2,A2={...F.scope,phase:"retry",previousAccountId:F.accountId,rerouteFrom:T2};try{H2=await X.chooseAccount(A2)}catch(h2){o("opencode2 auth chooseAccount threw while the retry hook looked for another account; the host decides the retry",{sessionID:F.scope.sessionID,error:s(h2)})}if(H2!==void 0)J2={accountId:H2,input:A2};try{v()}catch(h2){if(J2)await x(J2);throw h2}if(H2!==void 0&&H2!==F.accountId)F.rerouted=!0,C2=T2,G2={retry:!0,delay:0},e="reroute";else e="host-decides-last-account"}else e="host-decides";if(J.decision=G2,G2.retry&&F.accountId!==void 0&&Y.has(F.id))W.set(F.key,{attemptId:F.id,sessionID:F.scope.sessionID,accountId:F.accountId,...C2===void 0?{}:{rerouteFrom:C2},...J2===void 0?{}:{next:J2}});else if(J2)await x(J2);return{decision:G2,reason:e}});v(),await D("retry",{sessionID:J.sessionID,...F.accountId===void 0?{}:{accountId:F.accountId},kind:F.scope.kind,attempt:J.attempt,reason:a,hostDecision:_,decision:h,...k===void 0?{}:{handle:k}})})},Y2));let $$=(J)=>{S(J),E.delete(J);for(let Q of U)if(JSON.parse(Q)[0]===J)U.delete(Q);for(let Q of[...Y.values()]){if(Q.scope.sessionID!==J)continue;p(Q,"its session was forgotten"),Y.delete(Q.id)}for(let[Q,_]of W)if(_.sessionID===J)O(Q)},v2=new AbortController,J$=$.event;if(J$)(async()=>{try{for await(let J of J$.subscribe({signal:v2.signal}))if(J.type==="session.deleted")$$(J.data.sessionID)}catch(J){if(!v2.signal.aborted)o("opencode2 auth stopped listening for session deletion",{error:s(J)})}})();return{on(J,Q){let _=m.get(J);if(!_)_=new Set,m.set(J,_);let F=Q;return _.add(F),()=>{_.delete(F)}},accountFor(J,Q){return u(z2(J,Q))?.accountId},forgetSession:$$,get size(){return Y.size},async dispose(){if(c)return;c=!0;for(let J of r.keys())S(J);v2.abort();for(let J of Y.values())p(J,"the installation was disposed");Y.clear();for(let J of W.keys())O(J);U.clear(),E.clear(),m.clear(),await Promise.all(Z.values()),await Promise.all(j2.map(async(J)=>{try{await J.dispose()}catch(Q){o("opencode2 auth hook did not dispose cleanly",{error:s(Q)})}}))}}}import{CacheKeepManager as k1,CacheKeepSessionRegistry as D1,getDefaultCacheKeepRegistryDirectory as b1,isCacheKeepActiveNow as E$,isCacheKeepHybridActive as o2,isCacheKeepSubagentsEnabled as n2,logger as w1}from"@cortexkit/anthropic-auth-core";import{createHash as Y1}from"node:crypto";import{AnthropicOAuthOriginError as G1,applyCustomHeaders as V1,assertNotCustodyTombstone as j1,classifyGzipRejection as W1,createProviderErrorRedactor as G$,createProviderErrorResponseScope as V$,decideRequestGzip as Q1,encodeGzipRequestBody as B1,getAccountStoragePath as H1,getRequestGzipLatch as U1,getRequestGzipLatchPath as K1,mergeAnthropicBetas as M1,remapModelId as j$,remapRequestBodyModel as z1,stripEmptyTrailingAssistantMessages as _1,TrailingAssistantHistoryError as F1}from"@cortexkit/anthropic-auth-core";var S2="anthropic",L$="x-common-auth-attempt",C1=["x-session-affinity","x-opencode-session","x-parent-session-id",B$,k2,R2,L$],q2=new Set(["authorization","x-api-key"]),N1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",L1=512,P1=5000,T1=500,W$=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class P$ extends Error{sessionID;requestKind;kind="no-account";providerID=S2;constructor($,X){super(N1);this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicNoAccountError"}}class c2 extends Error{sessionID;requestKind;kind="session-forgotten";providerID=S2;constructor($,X){super("request refused: its session was closed while it was being prepared");this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicRevokedError"}}class L2 extends Error{kind="unsupported-transport";providerID=S2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class T$ extends Error{kind="local-invalid-request";status=400;check;constructor($){super($.message,{cause:$});this.name="NativeAnthropicLocalRefusal",this.check=$.check}}var _2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($);function O2($){try{return JSON.parse($)}catch{return}}function i2($){let X={};for(let[M,V]of Object.entries($??{}))X[M.toLowerCase()]=V;return X}function Q$($){let X={};for(let M of C1){let V=$.get(M);if(V!==null&&M!==L$)X[M]=V;$.delete(M)}return X}function E1($){try{return new URL($).pathname.endsWith("/messages")}catch{return!1}}function O1($){return $ instanceof F1||$ instanceof H$||$ instanceof G1?new T$($):void 0}function S1($,X){let M=[];if($.oauth)M.push($.oauth.accessToken);for(let[V,L]of Object.entries($.apiHeaders??{})){if(L===null||!q2.has(V))continue;M.push(L.replace(/^Bearer\s+/i,""))}for(let V of q2){let L=X.get(V);if(L!==null)M.push(L.replace(/^Bearer\s+/i,""))}if($.dispatch?.kind==="http-relay")M.push($.dispatch.token);return[...new Set(M.filter(Boolean))]}var R1=new Set(["oauth-2025-04-20","claude-code-20250219",M$]);function x1($){let X=$.split(",").map((M)=>M.trim()).filter((M)=>M&&!R1.has(M));return M1(null,X)}function A1($){let X=O2($);if(!_2(X))return $;let M=_1(X.messages),V=Object.hasOwn(X,"fallbacks"),{droppedMarkers:L}=z$(X,!1),N=V&&!Object.hasOwn(X,"fallbacks"),P=z1(X);return M>0||L>0||N||P?JSON.stringify(X):$}async function q1($,X){if(!($ instanceof Promise))return"settled";let M;try{return await Promise.race([$.then(()=>"settled"),new Promise((V)=>{M=setTimeout(()=>V("timed-out"),X)})])}finally{if(M!==void 0)clearTimeout(M)}}function P2($){let{source:X,log:M}=$,V=Math.max(1,$.maxPendingSends??L1),L=$.attemptEndTimeoutMs??P1,N=$.requestGzipLatch??U1(K1(H1())),P=new WeakSet,T=new Map,K=new WeakMap,Y=new WeakMap,H=new WeakMap,W=new Map,U=new WeakMap,E=G$([]);E.dispose();let q=(B)=>(B&&W.get(B)?.redactor)??E,A=(B)=>{let z=W.get(B);if(!z)return;W.delete(B),z.redactor.dispose(),z.scope.dispose()},m=(B,z,C,S)=>{let R=S1(z,S),b=V$(R,C);w.set(B,C),W.set(B,{sessionID:z.sessionID,redactor:G$(R),scope:b}),b.settled.then(()=>A(B));while(W.size>V){let g=W.keys().next().value;if(g===void 0)break;A(g)}},w=new WeakMap,c=(B,z)=>{let C=B?w.get(B):void 0;if(!C||!z.ok)return E.redactResponse(z);let S=V$([],C),R=S.redactResponse(z);return S.dispose(),R},r=(B,z)=>{let C=B?W.get(B)?.scope:void 0;if(!C)return c(B,z);try{return C.redactResponse(z)}catch{return c(B,z)}},o=!1,s=new WeakMap,Z=(B,z)=>{if(B&&!z.ok)s.set(z.headers,B);return z},j=(B,z)=>{if(z.dispatch!=="http-relay")return!0;let C=/^req_[A-Za-z0-9_-]+$/.test(B.get("request-id")??"");return Y.set(z,C),C},G=(B)=>new P$(B.sessionID,B.kind),x=new Map,O=async(B,z)=>{if(o)throw new c2(B.sessionID,B.kind);let C={revoked:!1},S=x.get(B.sessionID);if(!S)S=new Set,x.set(B.sessionID,S);S.add(C);let R=()=>{if(o||C.revoked)throw new c2(B.sessionID,B.kind)};try{let b=await z(R);return R(),b}finally{let b=x.get(B.sessionID);if(b?.delete(C)&&b.size===0)x.delete(B.sessionID)}},D=(B,z)=>{T.set(B,z);while(T.size>V){let C=T.keys().next().value;if(C===void 0)break;T.delete(C),M?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:V})}},y=(B,z)=>({providerID:B.providerID,modelID:B.modelID,sessionID:B.sessionID,agent:B.agent,kind:B.kind,accountId:B.accountId,attemptId:B.attemptId,transport:B.transport,route:z.route,provenance:z.provenance,dispatch:z.dispatch}),l=(B)=>O(B,async(z)=>{let{accountId:C,...S}=B,R=await X.authorizeAccount(S,C);return z(),p(S,R)}),p=(B,z)=>{if(!z)throw G(B);if(z.dispatch?.kind==="websocket-relay")throw new L2;let C=z.dispatch?.kind==="http-relay"?"http-relay":"direct",S=z.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":z.dispatch.token}:void 0;if(z.route==="oauth"){if(!z.accessToken)throw G(B);j1(z.accessToken,S2);let g=Object.freeze({route:"oauth",provenance:z.provenance,dispatch:C});D(g,{sessionID:B.sessionID,oauth:{accessToken:z.accessToken,...z.identity?{identity:z.identity}:{}},dispatch:z.dispatch,oauthHeaders:z.headers});let n=i2(z.headers);for(let i of q2)delete n[i];return delete n["anthropic-beta"],{headers:S??{...n,"x-api-key":null,authorization:`Bearer ${z.accessToken}`},attempt:g}}let R={authorization:null,"x-api-key":null,...i2(z.headers)};if(!R.authorization&&!R["x-api-key"])throw G(B);let b=Object.freeze({route:"api",provenance:z.provenance,dispatch:C});return D(b,{sessionID:B.sessionID,...z.baseURL?{baseURL:z.baseURL}:{},dispatch:z.dispatch,apiHeaders:R}),{headers:S??R,attempt:b}},I=(B)=>O(B,(z)=>u(B,z)),u=async(B,z)=>{let{request:C,attempt:S}=B,R=S.data,b=R?T.get(R):void 0;if(R)T.delete(R);if(!R||!b||R.route==="oauth"&&!b.oauth)throw G(B);let g=new Headers(C.headers);V1(g);let n=Q$(g),i=C.body===null?void 0:await C.text();z();let Z2=i!==void 0&&E1(C.url),V2=F$(C.url,b.baseURL!==void 0?{baseURL:b.baseURL}:{}).url?.toString()??C.url;try{if(R.route==="oauth"&&b.oauth){U$(V2);let{accessToken:$2,identity:t}=b.oauth;for(let[K2,Y2]of Object.entries(i2(b.oauthHeaders))){if(q2.has(K2))continue;if(Y2===null)g.delete(K2);else g.set(K2,Y2)}let U2=null;if(i!==void 0&&Z2){let K2={...y(S,R),modelID:(()=>{let B2=O2(i);return j$(_2(B2)&&typeof B2.model==="string"?B2.model:B.modelID)})(),route:"oauth",correlation:n},Y2=await X.requestOptions?.(K2)??{};z(),i=await C$(i,{...Y2,...t?{identity:t}:{},sessionId:B.sessionID,onToolNameMap:(B2)=>H.set(R,B2)});let j2=O2(i);U2=_2(j2)?j2:null}_$(g,$2,{body:U2,...t?{identity:t}:{},requestClass:K$(S.agent)?"auxiliary":"main"})}else{if(i!==void 0&&Z2)i=A1(i);g.delete("authorization"),g.delete("x-api-key");for(let[t,U2]of Object.entries(b.apiHeaders??{}))if(U2===null)g.delete(t);else g.set(t,U2);if(i!==void 0&&Z2&&!g.has("content-type"))g.set("content-type","application/json");let $2=g.get("anthropic-beta");if($2!==null){let t=x1($2);if(t)g.set("anthropic-beta",t);else g.delete("anthropic-beta")}}}catch($2){let t=O1($2);if(!t)throw $2;throw K.set(R,t.check),M?.warn("refused an Anthropic request locally; nothing was sent",{check:t.check}),t}let X2=i!==void 0?O2(i):void 0;if(await X.admitRequest?.({...y(S,R),modelID:j$(_2(X2)&&typeof X2.model==="string"?X2.model:B.modelID)}),Q$(g),i!==void 0)g.delete("content-length");if(z(),m(R,b,_2(X2)&&X2.stream===!0?"event-stream":"http",g),R.route==="oauth"&&Z2&&i!==void 0)await X.onRequestPrepared?.({...y(S,R),url:V2,bodyText:i}),z();if(b.dispatch?.kind==="http-relay"){let $2=i??"";g.delete("x-relay-token");let t={protocol:1,type:"request",affinity:B.sessionID,upstream:{url:V2,method:C.method,headers:Object.fromEntries(g)},mode:"full_sync",revision:1,body:$2,next_hash:`sha256:${Y1("sha256").update($2).digest("hex")}`};return new Request(b.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":b.dispatch.token},redirect:"error",signal:C.signal,body:JSON.stringify(t)})}let F2=i;if(R.route==="oauth"&&Z2&&i!==void 0){let $2=await Q1({url:V2,body:i,latch:N});if(z(),$2.gzip)F2=await B1(i),g.set("content-encoding","gzip"),P.add(R),z()}return new Request(V2,{method:C.method,headers:g,redirect:R.route==="oauth"?"error":C.redirect,signal:C.signal,...F2!==void 0?{body:F2}:{}})};return{adapter:{providerID:S2,chooseAccount:(B)=>O(B,async()=>{let z=await X.chooseAccount(B);if(!z)throw G(B);return z}),dropChoice:(B)=>X.dropChoice?.(B),accountHeaders:l,rewriteRequest:I,rewriteHandshakeURL(){throw new L2},rewriteResponse({response:B,attempt:z}){let C=z.data;if(C&&!j(B.headers,C)){if(B.status===401)return A(C),B.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return r(C,B)}if(C&&P.has(C))P.delete(C),W1(B).then((n)=>{if(!n)return;N.latchProcess(),M?.warn("gzipped request body rejected; later requests go uncompressed",{kind:n,status:B.status})},()=>{});let S=r(C,B);if(C?.route!=="oauth"||!S.body)return Z(C,S);let R={...y(z,C),status:B.status},b=X.responseOptions?.(R)??{},g=(B.headers.get("content-type")??"").includes("application/json");return Z(C,N$(S,{...b,toolNameMap:H.get(C),onToolNameRefusal:()=>{K.set(C,"response_tool_names"),A(C)},laneStartOAuthServed:!0,...g?{responseMode:"json"}:{}}))},quotaFromHeaders(B,z,C){let S=C.data;if(!S||!j(B,S))return;return X.quotaFromHeaders?.(B,{...y(C,S),status:z})},async limitFromResponse({status:B,headers:z,body:C,attempt:S}){let R=S.data;if(!R||K.get(R)==="response_tool_names")return;if(!j(z,R))return X.limitFromRelayFailure?.({...y(S,R),status:B});if(U.set(R,`provider responded with HTTP ${B}`),!X.limitFromResponse)return;let b=s.get(z)===R,g=q(R);return X.limitFromResponse({...y(S,R),status:B,headers:z,body:async()=>b?await C():g.redactText(await C())})},inspectEvent({data:B,event:z,attempt:C}){if(C.data&&K.get(C.data)==="response_tool_names")return;let S=O2(B);if(!_2(S))return;let R=typeof S.type==="string"?S.type:z;if(R==="content_block_start"||R==="content_block_delta")return{outputStarted:!0};if(R==="message_stop")return{done:!0};if(R!=="error")return;let b=C.data,g=q(b),n=_2(S.error)?S.error:{},i=typeof n.type!=="string"?void 0:W$.has(n.type)?n.type:g.redactText(n.type),Z2=typeof n.message==="string"?g.redactText(n.message):void 0;if(b?.dispatch==="http-relay"&&Y.get(b)===!1)return;let V2=b?X.limitFromStreamError?.({...y(C,b),errorType:i,message:Z2}):void 0,X2={error:[i??"error",Z2].filter(Boolean).join(": ").slice(0,T1),...V2?{limit:V2}:{}};if(b&&X2.error)U.set(b,X2.error);return X2},limitFromError(B,z){let C=z.data;if(!C||K.has(C))return;let S={type:W$.has(B.type)?B.type:"provider_error",message:U.get(C)??"provider request failed",...B.status!==void 0?{status:B.status}:{}};if(A(C),C.dispatch==="http-relay"&&Y.get(C)===!1)return;return X.limitFromHostError?.(S,y(z,C))},async onAttemptEnd(B,z){let C=B.data;if(!C)return;T.delete(C);let S=z.error?.reason;if(S==="cancelled"||S==="abandoned"||S===void 0&&(z.status===void 0||z.status<400))A(C);let R=K.get(C),{status:b,...g}=z,n=X.onAttemptEnd?.(y(B,C),{...g,...b!==void 0&&(C.dispatch!=="http-relay"||Y.get(C)===!0)?{status:b}:{},...R!==void 0?{localRefusal:{check:R}}:{}});if(await q1(n,L)==="timed-out")M?.warn("the account source did not finish recording a send",{timeoutMs:L})}},dispose(){o=!0;for(let[B,z]of x){for(let C of z)C.revoked=!0;X.forgetSession?.(B)}x.clear(),T.clear();for(let B of[...W.keys()])A(B)},forgetSession(B){for(let z of x.get(B)??[])z.revoked=!0;x.delete(B);for(let[z,C]of T)if(C.sessionID===B)T.delete(z);for(let[z,C]of[...W])if(C.sessionID===B)A(z);X.forgetSession?.(B)},get pendingSendCount(){return T.size},get heldCredentialCount(){let B=0;for(let z of T.values())if(z.oauth)B++;return B},get heldRedactorCount(){return W.size},get operationsInProgress(){let B=0;for(let z of x.values())B+=z.size;return B}}}function x2($){return JSON.stringify([$.source,$.accountIdentity,$.credentialId,$.binding?.storageId,$.binding?.rowId,$.binding?.credentialEpoch])}function O$($){let{runtime:X,source:M}=$,V=new AbortController,L=!1,N=new D1({directory:$.registryDirectory||process.env.OPENCODE_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR||b1("opencode"),now:$.now}),P=new Map,T=async(W,U,E)=>{let q=E?AbortSignal.any([V.signal,E]):V.signal;q.throwIfAborted();let A=JSON.parse(await U.text()),m={providerID:"anthropic",modelID:A.model,sessionID:`oc2-cachekeep:${W.id}`,agent:"cachekeep",kind:"generate"},w=P2({source:{...M,onRequestPrepared:void 0,responseOptions:void 0,async requestOptions(Z){return{...await M.requestOptions?.(Z),laneStart:!1,billingLineage:void 0,cacheDiagnosticsPreviousMessageId:void 0}},async authorizeAccount(Z,j){let G=await X.read();q.throwIfAborted();let x=G.accounts.find((D)=>D.id===j);if(x?.type!=="oauth"||x2(x)!==W.oauthAccountIdentity||W.isSubagent&&!n2(G.policyStorage)||!o2(G.policyStorage)||!E$(G.policyStorage,new Date($.now?.()??Date.now())))return;let O=await M.authorizeAccount(Z,j);if(O?.provenance.kind==="local"&&x2({...x,binding:O.provenance.subject.binding,accountIdentity:O.provenance.subject.binding.identity})!==W.oauthAccountIdentity)return;if(O?.provenance.kind==="vault"&&O.provenance.credentialId!==x.credentialId)return;return O},async admitRequest(Z){await M.admitRequest?.(Z);let j=await X.read(),G=j.accounts.find((x)=>x.id===Z.accountId);if(q.throwIfAborted(),!G||x2(G)!==W.oauthAccountIdentity||W.isSubagent&&!n2(j.policyStorage)||!o2(j.policyStorage)||!E$(j.policyStorage,new Date($.now?.()??Date.now())))throw Error("CacheKeep policy changed before dispatch")}}}),c,r,o=!1,s=()=>w.forgetSession(m.sessionID);q.addEventListener("abort",s,{once:!0});try{let Z=(await X.read()).accounts.find((y)=>x2(y)===W.oauthAccountIdentity)?.id;if(!Z)throw Error("CacheKeep account is unavailable");let j=await w.adapter.accountHeaders({...m,accountId:Z});if(!("headers"in j)||typeof j.headers!=="object"||j.headers===null||typeof j.attempt!=="object"||j.attempt===null||j.attempt.route!=="oauth")throw Error("CacheKeep authorization refused");c={...m,accountId:Z,attemptId:crypto.randomUUID(),transport:"http",data:j.attempt};let G=await w.adapter.rewriteRequest?.({...m,accountId:Z,attempt:c,request:new Request(W.url,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(A),signal:q})});if(!G)throw Error("CacheKeep rewrite refused");q.throwIfAborted();let x=await($.fetch??fetch)(G),O=await w.adapter.rewriteResponse?.({...m,accountId:Z,attempt:c,request:G,response:x});if(!O)throw Error("CacheKeep response rewrite refused");if(r=O.status,w.adapter.quotaFromHeaders?.(O.headers,O.status,c),!O.ok)await w.adapter.limitFromResponse?.({status:r,headers:O.headers,body:()=>O.clone().text(),attempt:c});let D=await O.arrayBuffer();return o=!0,new Response(D,{status:r,headers:O.headers})}catch{throw Error("Native CacheKeep was not completed")}finally{q.removeEventListener("abort",s);try{if(c)await w.adapter.onAttemptEnd?.(c,{status:r,outputStarted:!1,...o?{}:{error:{reason:"cancelled"}}})}finally{w.dispose(),M.forgetSession?.(m.sessionID)}}},K=$.setIntervalImpl??globalThis.setInterval,Y=new k1({loadStorage:async()=>L?null:(await X.read()).policyStorage,now:$.now,setIntervalImpl:(W,U)=>K(()=>Y.tick().catch(()=>{w1.warn("cachekeep","tick failed")}),U),clearIntervalImpl:$.clearIntervalImpl,onTrackedSessionsChanged:(W)=>N.publish(L?[]:W),prepareHeaders(W,U,E){if(L)return;return P.set(E.id,{target:U,attempt:E}),new Headers({"x-native-cachekeep-attempt":String(E.id)})},fetchImpl:async(W,U)=>{let E=new Request(W,U),q=Number(E.headers.get("x-native-cachekeep-attempt")),A=P.get(q);if(P.delete(q),!A)throw Error("CacheKeep attempt is unavailable");return T(A.target,E,A.attempt.signal)},onComplete:({attempt:W})=>{P.delete(W.id)}}),H;return{async track(W){if(L||W.route!=="oauth"||W.agent==="cachekeep"||W.agent==="prime"||W.kind!=="primary")return;let U=await X.read();if(L||!o2(U.policyStorage))return;let E=!1;try{E=await $.isSubagent?.(W.sessionID)??!1}catch{return}if(L||E&&!n2(U.policyStorage))return;let q=U.accounts.find((A)=>A.id===W.accountId);if(!q?.accountIdentity)return;if(W.provenance.kind==="local"&&JSON.stringify(q.binding)!==JSON.stringify(W.provenance.subject.binding))return;if(W.provenance.kind==="vault"&&q.credentialId!==W.provenance.credentialId)return;Y.track({sessionId:W.sessionID,url:W.url,headers:new Headers,bodyText:W.bodyText,storage:U.policyStorage,cacheMode:"hybrid",oauthAccountId:W.accountId,oauthAccountIdentity:x2(q),isSubagent:E}),await N.publish(Y.trackedSessions())},registry:N,dispose(){if(H)return H;return L=!0,Y.stop(),V.abort(),H=(async()=>{try{await Y.tick()}finally{P.clear(),await N.dispose()}})(),H}}}async function S$($,X,M){let V=P2(X),L=[],N=async(U,E,q)=>{let A=await $.session.hook(U,E,q);return L.push(A),A},P=new AbortController,T;try{T=await u2({session:{hook:N},event:$.event},V.adapter,{logger:X.log,gateOnPlaceholder:M})}catch(U){throw V.dispose(),await Promise.allSettled(L.map((E)=>E.dispose())),U}let K=(U)=>{V.forgetSession(U),T.forgetSession(U)},Y=$.event,H=Y?(async()=>{try{for await(let U of Y.subscribe({signal:P.signal}))if(U.type==="session.deleted")K(U.data.sessionID)}catch(U){if(!P.signal.aborted)X.log?.warn("stopped listening for session deletion",{error:U instanceof Error?U.name:"unknown"})}})():Promise.resolve(),W;return{installation:T,forgetSession:K,dispose(){if(W)return W;return V.dispose(),P.abort(),W=(async()=>{await T.dispose(),await H})(),W}}}import{effectiveRelayTransport as R$,getQuotaCheckIntervalMs as y1,logger as I1,nativeAccountCanServe as f1,oauthProfileIsFresh as g1,quotaSnapshotCheckedAt as v1}from"@cortexkit/anthropic-auth-core";function x$($,X){let M=new AbortController,V,L=!1,N=async()=>{let K=await $.read();if(M.signal.throwIfAborted(),K.policyStorage.relay?.enabled===!0&&R$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="websocket")return;let Y=K,H=y1(Y.policyStorage);for(let W of Y.accounts){if(M.signal.aborted)return;if(!f1(W)||W.type!=="oauth")continue;if(Y.policyStorage.quota?.enabled!==!1&&Date.now()-v1(W.quota)>=H)await $.fetchQuota(W.id,X,M.signal,void 0,"background").catch(()=>{});if(!g1(W.profile)&&!M.signal.aborted)await $.fetchProfile(W.id,X,M.signal).catch(()=>{})}},P=()=>{if(L||V)return V;return V=N().catch(()=>{if(!M.signal.aborted)I1.debug("opencode2","native background readings did not complete")}).finally(()=>{V=void 0}),V},T=$.vault.watch({intervalMs:60000,onRefresh:P,shouldRefresh:async()=>{let K=await $.read();return K.policyStorage.relay?.enabled!==!0||R$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="http"}});return T.ready.catch(()=>{}),{async dispose(){L=!0,T.close(),M.abort(),await V}}}import{authorize as s1,buildCacheKeepStatusSummary as a1,buildClaudeQuotaSummary as t1,buildPrimeAccountStatuses as e1,buildPrimeStatusSummary as $J,CLAUSTRUM_OPENCODE_ENROLLMENT_NAME as JJ,exchange as XJ,formatNativeAccountState as ZJ,formatOAuthAccountTier as YJ,getCacheKeepWindow as GJ,getHostClaustrumEnrollmentPaths as VJ,isCacheKeepAlways as jJ,isCacheKeepHybridActive as WJ,isCacheKeepPersistentlyEnabled as QJ,nativeAccountCanServe as BJ,resetClaustrumEnrollmentState as HJ}from"@cortexkit/anthropic-auth-core";import{buildPrimeAccountStatuses as h1,effectiveRelayStatus as m1,formatNativeAccountState as l1,formatOAuthAccountTier as A$,getCacheKeepWindow as d1,getRoutingMode as p1,isCacheKeepAlways as u1,isCacheKeepHybridActive as i1,isPermanentRefreshError as c1,isPrimePersistentlyEnabled as o1,nativeAccountCanServe as D$,refreshBackoffActive as q$}from"@cortexkit/anthropic-auth-core";var k$=($)=>D$($)&&$.state!=="unsupported-access"?void 0:l1($)||void 0,n1=($)=>{if($.source!=="vault")return"off";if($.state==="needs_reauth")return"on-vault-reauth";return D$($)?"on-vault-served":"on-cold"},r1=($,X)=>typeof $==="number"&&$>X;function b$($,X){let{now:M}=X,V=$.policyStorage,L=$.accounts.filter((H)=>H.type==="oauth"),N=L.find((H)=>H.id==="main"),P=N?k$(N):void 0,T=N?.lastQuotaRefreshError?.nextRetryAt,K=N?.lastRefreshError,Y=d1(V);return{main:{quota:N?.quota??null,enabled:N?.enabled,tierLabel:A$(N?.profile),quotaBackedOff:r1(T,M),quotaBackoffUntil:T,refreshBackedOff:q$(K,N?.accountIdentity,M,void 0),refreshBackoffUntil:K?.nextRetryAt,stateLine:P,quotaDated:Boolean(P)},fallbacks:L.filter((H)=>H.id!=="main"&&(H.enabled||H.source==="vault")).map((H)=>{let W=k$(H),U=n1(H);return{id:H.id,label:H.label,quota:H.quota??null,enabled:H.enabled,tierLabel:A$(H.profile),needsReauth:c1(H.lastRefreshError)&&q$(H.lastRefreshError,H.accountIdentity,M,void 0),...U==="on-vault-reauth"?{vaultReauth:!0}:{},...U==="on-vault-served"?{vaultServed:!0}:{},...U!=="off"?{custodyState:U}:{},stateLine:W,quotaDated:Boolean(W)}}),activeId:X.activeId,route:p1(V),relay:m1(V.relay),fastMode:V.claudeFast?.enabled===!0,cacheKeep:{enabled:i1(V),window:u1(V)?"always":Y?`${Y.startHour}-${Y.endHour}`:void 0,trackedSessions:X.trackedSessions},prime:o1(V)?{enabled:!0,accounts:h1(V,{now:M})}:void 0,lastUpdated:M}}var r2=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{},w$=`For first-time model access, connect Anthropic with "${w2}".
+Run: opencode auth login anthropic --method ${b2}`,y$=($)=>$.mode==="local"&&!$.accounts.some((X)=>X.id==="main"),UJ=($)=>{let X=$.id==="main"?"main":"fallback",M=`${$.enabled?"enabled":"disabled"}, ${$.type}, ${$.source}${$.state?`, ${ZJ($)}`:""}`;if($.label)return`${$.label} [${X}]: ${M}
+  Route: ${$.id}`;return`${X==="main"?"Main account":`Fallback ${$.id}`}: ${M}`};function I$($){let{runtime:X,source:M}=$,V=new Map,L=!1,N=async(Y,H)=>{await X.updateSettings((W)=>({...W,[Y]:{...r2(W[Y]),...H}}))},P=()=>({ok:!0,text:"Native Claude settings updated."}),T=async(Y,H)=>{if(L)throw Error("Native menu is closed");switch(H.signal?.throwIfAborted(),Y.action){case"enable":case"disable":return await X.setEnabled(Y.values.id,Y.action==="enable"),P();case"remove":return await X.remove(Y.values.id),P();case"move-up":case"move-down":{let U=(await X.read()).accounts.map((w)=>w.id),E=U.indexOf(Y.values.id),q=E+(Y.action==="move-up"?-1:1);if(E<0||q<0||q>=U.length)return{ok:!1,text:"Account cannot move in that direction."};let A=U[E],m=U[q];if(A===void 0||m===void 0)return{ok:!1,text:"Account order changed."};return U[E]=m,U[q]=A,await X.reorder(U),P()}case"add-apikey":return await X.addApi(Y.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let W=new AbortController;V.get(Y.sessionId)?.active.abort();let U={active:W,auth:void 0};V.set(Y.sessionId,U);let E=await s1("max");if(L||W.signal.aborted||H.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return U.auth=E,{ok:!0,text:`Open ${E.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let W=V.get(Y.sessionId);if(!W?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let U=await XJ(Y.values.code,W.auth.verifier,W.auth.redirectUri,W.auth.state);if(W.active.signal.throwIfAborted(),H.signal?.throwIfAborted(),L||U.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await X.loginOAuth({routeId:crypto.randomUUID(),credential:{access:U.access,refresh:U.refresh,expires:U.expires},label:Y.values.label}),W.active.signal.throwIfAborted(),H.signal?.throwIfAborted(),L)return{ok:!1,text:"Sign-in cancelled."};V.delete(Y.sessionId);let E="OAuth account stored in the native account pool.";return{ok:!0,text:y$(await X.read())?`${E}
 
-${b$}
+${w$}
 
-Adding an account here does not change OpenCode's Anthropic connection.`:E}}case"reset-backoff":{let W=await X.read();for(let U of W.accounts){if(H.signal?.throwIfAborted(),U.type!=="oauth")continue;let E=U.source==="vault"?await X.authorizeVault(U.id,H.signal):await X.captureLocalSubject(U.id);await X.resetBackoff(U.id,E)}return P()}case"enrollment-reset":{let W=await QJ(YJ("opencode"),e1);return{ok:W==="reset",text:W==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":W==="refused-pending"?"An enrollment request may still be in progress. Quit OpenCode and run setup again; it picks up the same request.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let U=(await X.read()).accounts.filter((A)=>A.type==="oauth"&&WJ(A)),E=await Promise.allSettled(U.map((A)=>X.fetchQuota(A.id,void 0,H.signal)));return{ok:E.every((A)=>A.status==="fulfilled"),text:`${E.filter((A)=>A.status==="fulfilled").length}/${U.length} native quota readings refreshed.`}}case"routing-reset":return await M.resetRouting(Y.sessionId),P();case"routing-mode":return await N("routing",{mode:Y.values.mode}),P();case"killswitch-on":case"killswitch-off":return await N("killswitch",{enabled:Y.action==="killswitch-on"}),P();case"killswitch-set":return await X.updateSettings((W)=>{let U=r2(W.killswitch),E={...r2(U.accounts)},q=U.main;for(let A of Y.values.entries){let m={five_hour:A.fh,seven_day:A.sd,...A.scoped!==void 0?{scoped:A.scoped}:{}};if(A.account==="main"||A.account==="all")q=m;if(A.account==="all")for(let w of Object.keys(E))E[w]=m;else if(A.account!=="main")E[A.account]=m}return{...W,killswitch:{...U,main:q,accounts:E}}}),P();case"cache-on":case"cache-off":return await N("claudeCache",{enabled:Y.action==="cache-on"}),P();case"cache-mode":return await N("claudeCache",{mode:Y.values.mode}),P();case"cachekeep-always":return await N("cacheKeep",{enabled:!0,always:!0}),P();case"cachekeep-off":return await N("cacheKeep",{enabled:!1}),P();case"cachekeep-window":return await N("cacheKeep",{enabled:!0,always:!1,startHour:Y.values.startHour,endHour:Y.values.endHour}),P();case"cachekeep-subagents":return await N("cacheKeep",{subagents:Y.values.enabled==="on"}),P();case"dump-on":case"dump-off":return await N("dump",{enabled:Y.action==="dump-on"}),P();case"logging-level":return await N("logging",{level:Y.values.level}),P();case"fast-on":case"fast-off":return await N("claudeFast",{enabled:Y.action==="fast-on"}),P();case"prime-on":case"prime-off":return await N("prime",{enabled:Y.action==="prime-on"}),P();case"start-fire":return await K(Y.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},K=(Y)=>$.start(Y,D2);return{dispatch:T,async readStatus(Y){let H=await X.read();if(Y==="account"){let U=H.accounts.map(BJ).join(`
-`)||"No native Claude accounts.";return w$(H)?`${U}
+Adding an account here does not change OpenCode's Anthropic connection.`:E}}case"reset-backoff":{let W=await X.read();for(let U of W.accounts){if(H.signal?.throwIfAborted(),U.type!=="oauth")continue;let E=U.source==="vault"?await X.authorizeVault(U.id,H.signal):await X.captureLocalSubject(U.id);await X.resetBackoff(U.id,E)}return P()}case"enrollment-reset":{let W=await HJ(VJ("opencode"),JJ);return{ok:W==="reset",text:W==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":W==="refused-pending"?"An enrollment request may still be in progress. Quit OpenCode and run setup again; it picks up the same request.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let U=(await X.read()).accounts.filter((A)=>A.type==="oauth"&&BJ(A)),E=await Promise.allSettled(U.map((A)=>X.fetchQuota(A.id,void 0,H.signal)));return{ok:E.every((A)=>A.status==="fulfilled"),text:`${E.filter((A)=>A.status==="fulfilled").length}/${U.length} native quota readings refreshed.`}}case"routing-reset":return await M.resetRouting(Y.sessionId),P();case"routing-mode":return await N("routing",{mode:Y.values.mode}),P();case"killswitch-on":case"killswitch-off":return await N("killswitch",{enabled:Y.action==="killswitch-on"}),P();case"killswitch-set":return await X.updateSettings((W)=>{let U=r2(W.killswitch),E={...r2(U.accounts)},q=U.main;for(let A of Y.values.entries){let m={five_hour:A.fh,seven_day:A.sd,...A.scoped!==void 0?{scoped:A.scoped}:{}};if(A.account==="main"||A.account==="all")q=m;if(A.account==="all")for(let w of Object.keys(E))E[w]=m;else if(A.account!=="main")E[A.account]=m}return{...W,killswitch:{...U,main:q,accounts:E}}}),P();case"cache-on":case"cache-off":return await N("claudeCache",{enabled:Y.action==="cache-on"}),P();case"cache-mode":return await N("claudeCache",{mode:Y.values.mode}),P();case"cachekeep-always":return await N("cacheKeep",{enabled:!0,always:!0}),P();case"cachekeep-off":return await N("cacheKeep",{enabled:!1}),P();case"cachekeep-window":return await N("cacheKeep",{enabled:!0,always:!1,startHour:Y.values.startHour,endHour:Y.values.endHour}),P();case"cachekeep-subagents":return await N("cacheKeep",{subagents:Y.values.enabled==="on"}),P();case"dump-on":case"dump-off":return await N("dump",{enabled:Y.action==="dump-on"}),P();case"logging-level":return await N("logging",{level:Y.values.level}),P();case"fast-on":case"fast-off":return await N("claudeFast",{enabled:Y.action==="fast-on"}),P();case"prime-on":case"prime-off":return await N("prime",{enabled:Y.action==="prime-on"}),P();case"start-fire":return await K(Y.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},K=(Y)=>$.start(Y,D2);return{dispatch:T,async readStatus(Y){let H=await X.read();if(Y==="account"){let U=H.accounts.map(UJ).join(`
+`)||"No native Claude accounts.";return y$(H)?`${U}
 
-${b$}
-Quota refresh checks the pool; it does not check OpenCode's Anthropic connection.`:U}if(Y==="quota")return s1({accounts:H.accounts.filter((U)=>U.type==="oauth").map((U)=>({name:U.label??U.id,role:U.id==="main"?"main":"fallback",enabled:U.enabled,quota:U.quota,tierLabel:XJ(U.profile),lastRefreshedAt:U.lastRefreshedAt,error:U.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(Y==="prime")return t1({enabled:H.policyStorage.prime?.enabled===!0,accounts:a1(H.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");if(Y==="cachekeep"){let U=await $.cacheKeepRegistry?.list()??[];return r1({enabled:jJ(H.policyStorage),always:GJ(H.policyStorage),hybridActive:VJ(H.policyStorage),trackedSessionDetails:U,window:ZJ(H.policyStorage),trackedSessions:U.length,nextPrewarmAt:U.length?Math.min(...U.map((E)=>E.nextPrewarmAt)):void 0})}let W={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(H.settings[W[Y]]??{})},async readSidebar(Y){let[H,W]=await Promise.all([X.read(),$.cacheKeepRegistry?.list()??[]]);return D$(H,{activeId:M.servedAccount(Y),trackedSessions:W.length,now:Date.now()})},forgetSession(Y){V.get(Y)?.active.abort(),V.delete(Y)},close(){L=!0;for(let Y of V.values())Y.active.abort();V.clear()}}}import{resolveClaudeModelCapabilities as HJ}from"@cortexkit/anthropic-auth-core";function I$(){let $=new Map;return{install:(M)=>M.model.transform((V)=>{$.clear();for(let L of V.list("anthropic")){$.set(String(L.id),String(L.modelID));let N=HJ(L.modelID)?.efforts.variants;if(!N)continue;V.update("anthropic",String(L.id),(P)=>{let T=P.variants.filter((K)=>!N.some((Y)=>Y===String(K.id)));P.variants=[...T,...N.map((K)=>({id:K,settings:{effort:K,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(M)=>$.get(M)??M}}function f$($){return $.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??$.get("x-api-key")??void 0}import{buildPrimeRequestBody as g$,effectiveRelayTransport as v$,nativeAccountCanServe as UJ,PrimeManager as KJ}from"@cortexkit/anthropic-auth-core";var h$=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{};function m$($){let{runtime:X,source:M}=$,V=new AbortController,L=new Set,N=(K)=>({providerID:"anthropic",modelID:g$().model,sessionID:`oc2-prime:${K}`,agent:"prime",kind:"generate"}),P=async(K)=>{let Y=N(K),H=P2({source:M}),W=performance.now();try{for(let U=0;U<3;U++){if(V.signal.throwIfAborted(),(await X.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let q=await H.adapter.accountHeaders({...Y,accountId:K});if(!("headers"in q)||typeof q.headers!=="object"||q.headers===null||typeof q.attempt!=="object"||q.attempt===null)throw Error("Native Prime authorization refused");let A={...Y,accountId:K,attemptId:crypto.randomUUID(),transport:"http",data:q.attempt},m,w=!1,c=!1,r=(o)=>{c=!0,o.body?.cancel().catch(()=>{})};try{let o=await H.adapter.rewriteRequest?.({...Y,accountId:K,attempt:A,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(g$()),signal:V.signal})});if(!o)throw Error("Native Prime rewrite refused");let s=new Headers(o.headers);for(let[l,p]of Object.entries(q.headers))if(p===null)s.delete(l);else s.set(l,p);let Z=new Request(o,{headers:s}),j=await($.fetch??fetch)(Z),G=await H.adapter.rewriteResponse?.({...Y,accountId:K,request:Z,response:j,attempt:A})??j;m=G.status,H.adapter.quotaFromHeaders?.(G.headers,G.status,A);let x=G.ok?void 0:await H.adapter.limitFromResponse?.({status:G.status,headers:G.headers,body:()=>G.clone().text(),attempt:A});if(x&&/^(vault-newer|local-newer|relay-direct):/.test(x.reason)&&U<2){r(G);let l={...Y,phase:"retry",rerouteFrom:{accountId:K,limit:x}};if(await M.chooseAccount(l)!==K)throw Error("Native Prime retry changed account");continue}if(!G.ok)return r(G),{ok:!1,status:m,ms:performance.now()-W,error:"Native Prime upstream refused the request"};let O=h$(await G.json()),D=h$(O.usage),y={inputTokens:typeof D.input_tokens==="number"?D.input_tokens:void 0,outputTokens:typeof D.output_tokens==="number"?D.output_tokens:void 0};if(A.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(G.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(w=await M.recordPrime(q.attempt.provenance,y),!w)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:m,ms:performance.now()-W,usage:y}}finally{await H.adapter.onAttemptEnd?.(A,{status:m,outputStarted:!1,...w?{}:{error:{reason:c?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-W}}finally{H.dispose()}},T=new KJ({storagePath:$.paths.legacyConfig,loadStorage:async()=>(await X.read()).policyStorage,async getAccountFingerprint(K){let Y=await X.read(),H=Y.accounts.find((U)=>U.id===K);if(!UJ(H)||H?.type!=="oauth")return;if(Y.policyStorage.relay?.enabled===!0&&v$(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")return;if(H.source==="vault"){let U=await X.authorizeVault(K,V.signal);return X.getOrCreateAuthLineage(K,U)}let W=await X.authorizeLocal(K,{signal:V.signal});return W.status==="usable"?X.getOrCreateAuthLineage(K,W.subject):void 0},async refreshQuota(K){let Y=await X.read();if(Y.policyStorage.relay?.enabled===!0&&v$(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await X.fetchQuota(K,$.fetch,V.signal),fresh:!0}},sendPrime(K){let Y=P(K);return L.add(Y),Y.finally(()=>L.delete(Y)),Y},async recordSuccess(K){let Y=(await X.read()).accounts.find((H)=>H.id===K);if(!Y?.prime)throw Error("Native Prime counters are unavailable");return Y.prime}});return T.start(),{manager:T,async dispose(){T.stop(),V.abort(),await Promise.allSettled(L)}}}import{createNativeUsagePublisher as MJ,effectiveRelayTransport as zJ,getClaudeCodeIdentityForVerifiedAccount as y2,getQuotaCheckIntervalMs as _J,getRoutingMode as l$,isQuotaBearingHeaderFrame as FJ,logger as CJ,mergeHeaderQuotaForPersistence as NJ,NativeVaultNoAccountError as LJ,nativeAccountCanServe as s2,nativeAccountPolicy as I2,nativeLocalQuotaLineage as PJ,nativePollQuotaGenerallyExhausted as TJ,normalizeQuotaHeaders as EJ,quotaSnapshotCheckedAt as d$,quotaSnapshotHasStandardWindows as OJ,readNativeAccountsForRequest as SJ,remapModelId as a2,StickySessionRouter as RJ,shouldFallbackStatus as xJ,stickyQuotaSnapshotIsFresh as f2,stickyRouteFamilyForModel as AJ}from"@cortexkit/anthropic-auth-core";var t2=($)=>["five_hour","seven_day"].some((X)=>($?.[X]?.remainingPercent??1)<=0);function u$($){let{runtime:X}=$,M=MJ("native-auth"),V=new Map,L=(Z)=>{let j=Z.routingPath;if(!j)throw Error("Native routing storage is unavailable");let G=V.get(j);if(!G)G=new RJ({path:j,vaultSeed:Z.routingSeed,onLockEvent:X.onLockEvent,localRecoveryPath:Z.mode==="local"?Z.routingRecoveryPath:void 0}),V.set(j,G);return G.setVaultSeed(Z.routingSeed),G},N=new WeakMap,P=new Map,T=new Map,K=new Map,Y=new Map,H=new WeakSet,W=!1,U=()=>{while(P.size>512){let Z=P.keys().next();if(!Z.done)P.delete(Z.value)}},E=(Z,j)=>JSON.stringify([Z.sessionID,Z.kind,Z.modelID,j]),q=(Z)=>{if(W)throw Error("Native Anthropic source is closed");let j=K.get(Z.sessionID);if(!j){j=new AbortController,K.set(Z.sessionID,j);while(K.size>512){let G=K.keys().next();if(!G.done)s.forgetSession?.(G.value)}}return j},A=(Z,j,G)=>s2(Z)&&(Z.type==="api"||I2(Z,j,a2(G)).status==="allowed"),m=async(Z,j,G,x)=>{let O=await X.read();x.signal.throwIfAborted(),w(O);let D=O.accounts.find((y)=>y.id===Z);if(!D||D.type!==G||!A(D,O,j))return!1;if(G==="api"){let y=O.accounts.find((l)=>l.id==="main"&&l.type==="oauth");return!!y&&f2(y.quota,O.policyStorage)&&t2(y.quota)}return!0},w=(Z)=>{let j=Z.policyStorage.relay;if(j?.enabled===!0&&zJ(j.transport,j.url)==="websocket")throw new L2},c=async(Z,j)=>{if(w(Z),j||Z.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let G=await X.getRelayConfig();if(!G)throw Error("request refused: native HTTP relay configuration is unavailable");if(G.transport!=="http")throw new L2;return{dispatch:{kind:"http-relay",url:G.url,token:G.token},relayFallback:G.fallbackToDirect}};async function r(Z,j,G){if(Z.kind==="local"){let x=await X.publishLocal(Z.subject,G);if(!x&&G.quota)CJ.warn("quota","Quota publication discarded");return x}if(Z.kind==="vault"&&j.receipt)await X.vault.publish(j.receipt,G);else if(Z.kind==="api"&&G.lastUsed!==void 0)await X.publishApi(Z.subject,{lastUsed:G.lastUsed});return!0}function o(Z,j,G){if(Z.kind!=="local")return;let x=Z.subject.binding,O=d$(G),D={lineage:PJ(x),accountUuid:x.identity,entry:{quota:G,checkedAt:O,refreshAfter:O},generalExhausted:TJ(G),routeBeforeSave:!0};return X.quotaObservations.hold(j.account.id,D)?D:void 0}let s={async chooseAccount(Z){let j=q(Z);$.onOwnedRequest?.();let G=await X.read();j.signal.throwIfAborted(),w(G);let x=a2(await $.resolveModelId?.(Z)??Z.modelID);if(j.signal.throwIfAborted(),G.mode==="claustrum")G=await SJ(X,j.signal),j.signal.throwIfAborted();if(G.policyStorage.quota?.enabled!==!1){let I=!1;for(let u of G.accounts){if(!s2(u)||u.type!=="oauth")continue;if(OJ(u.quota)?f2(u.quota,G.policyStorage,Date.now(),x):Date.now()-d$(u.quota)<_J(G.policyStorage))continue;try{await X.fetchQuota(u.id,$.fetch,j.signal,void 0,"admission"),I=!0}catch{j.signal.throwIfAborted()}}if(I)G=await X.read();j.signal.throwIfAborted()}let O=Z.rerouteFrom?P.get(Z.rerouteFrom.limit.reason):void 0;if(Z.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(Z.rerouteFrom.limit.reason)&&!O)return;if(O&&Z.rerouteFrom){let I=G.accounts.find((B)=>B.id===O.accountId);if(!I||!A(I,G,x))return;P.delete(Z.rerouteFrom.limit.reason);let u=E(Z,O.accountId),d=T.get(u)??[];return d.push(O),T.set(u,d),O.accountId}let D=[];for(let I of G.accounts){if(I.type!=="oauth"||!A(I,G,x))continue;if(I.source==="local"){let u=await X.authorizeLocal(I.id,{signal:j.signal,policy:(d,B)=>I2(d,B,x)});if(j.signal.throwIfAborted(),u.status!=="usable")continue}D.push(I)}let y=D.filter((I)=>I.id!==Z.rerouteFrom?.accountId);if(l$(G.policyStorage)==="sticky-balanced"){let I=y.map((d,B)=>({accountId:d.id,order:B,quota:d.quota??{kind:"unknown"}})),u=await L(G).resolve({sessionId:Z.sessionID,family:AJ(x),modelId:x,affinityModelId:Z.modelID,candidates:I,retainAccountIds:new Set(y.map((d)=>d.id)),...G.mode==="claustrum"?{accountIdentities:new Map(G.accounts.flatMap((d)=>d.accountIdentity?[[d.id,d.accountIdentity]]:[]))}:{},storage:G.policyStorage,inputBytes:1,preferredAccountId:Z.previousAccountId,preserveOnNoCandidate:!0});if(j.signal.throwIfAborted(),u)return u.accountId}else{let u=l$(G.policyStorage)==="fallback-first"?[...y.filter((d)=>d.id!=="main"),...y.filter((d)=>d.id==="main")]:[...y.filter((d)=>d.id==="main"),...y.filter((d)=>d.id!=="main")];if(u[0])return u[0].id}if(G.mode==="claustrum")throw new LJ;let l=G.accounts.find((I)=>I.id==="main"&&I.type==="oauth");if(!l)return;let p=l.quota;if(Z.rerouteFrom?.limit.status===429||!f2(p,G.policyStorage))try{p=await X.fetchQuota("main",$.fetch,j.signal)}catch{return}if(j.signal.throwIfAborted(),!t2(p))return;return G.accounts.find((I)=>I.type==="api"&&s2(I)&&I.id!==Z.rerouteFrom?.accountId)?.id},dropChoice(Z){let j=E(Z,Z.accountId),G=T.get(j);if(G?.shift(),G?.length===0)T.delete(j)},async authorizeAccount(Z,j){let G=q(Z),x=await X.read();G.signal.throwIfAborted(),w(x);let O=a2(await $.resolveModelId?.(Z)??Z.modelID);G.signal.throwIfAborted();let D=x.accounts.find((S)=>S.id===j);if(!D||!A(D,x,O))return;let y=E(Z,j),l=T.get(y),p=l?.shift();if(l?.length===0)T.delete(y);let{dispatch:I,relayFallback:u}=await c(x,p?.direct===!0);if(G.signal.throwIfAborted(),p?.auth){if(!await m(j,O,p.auth.route,G))return;let S=N.get(p.auth.provenance);if(S?.receipt?.expiresAtMs!==void 0&&S.receipt.expiresAtMs!==null&&S.receipt.expiresAtMs<Date.now()+300000)return;if(S)N.set(p.auth.provenance,{...S,scope:{...Z,modelID:O},account:D,active:G,relayFallback:u});return Y.set(Z.sessionID,j),{...p.auth,dispatch:I}}let d={scope:{...Z,modelID:O},active:G,account:D,retry:p?.retry??!1,relayFallback:u,quota:D.quota};if(D.type==="api"){let S=x.accounts.find((n)=>n.id==="main"&&n.type==="oauth");if(!S||!f2(S.quota,x.policyStorage)||!t2(S.quota))return;let R=await X.authorizeApi(j,G.signal);if(G.signal.throwIfAborted(),!await m(j,O,"api",G))return;let b={kind:"api",subject:R.subject};return N.set(b,d),Y.set(Z.sessionID,j),{route:"api",headers:R.authHeader==="authorization-bearer"?{authorization:`Bearer ${R.apiKey}`}:{"x-api-key":R.apiKey},baseURL:R.baseURL,provenance:b,dispatch:I}}if(D.source==="vault"){let S=await X.authorizeVault(j,G.signal);if(G.signal.throwIfAborted(),!await m(j,O,"oauth",G))return;let R={kind:"vault",credentialId:S.credentialId,recordVersion:S.recordVersion};N.set(R,{...d,receipt:S});let b=S.assertedAccountIdentity;if(!b)return;return Y.set(Z.sessionID,j),{route:"oauth",accessToken:S.accessToken,provenance:R,dispatch:I,identity:y2(b,b)}}let B=await X.authorizeLocal(j,{signal:G.signal,policy:(S,R)=>I2(S,R,O)});if(G.signal.throwIfAborted(),B.status!=="usable")return;if(!await m(j,O,"oauth",G))return;let z={kind:"local",subject:B.subject};N.set(z,{...d,access:B.access}),Y.set(Z.sessionID,j);let C=B.subject.binding.identity;return{route:"oauth",accessToken:B.access,provenance:z,dispatch:I,identity:y2(C,C)}},async requestOptions(Z){let j=q(Z),G=await X.read();j.signal.throwIfAborted();let x=G.accounts.find((D)=>D.id===Z.accountId);if(!x||!A(x,G,Z.modelID))throw Error("request refused: native account is ineligible for this model");let O=N.get(Z.provenance);if(O)N.set(Z.provenance,{...O,scope:{...O.scope,modelID:Z.modelID}});return $.requestOptions(Z,G)},async admitRequest(Z){let j=N.get(Z.provenance);if(!j||!await m(Z.accountId,Z.modelID,Z.route,j.active))throw Error("request refused: native account policy changed before dispatch");N.set(Z.provenance,{...j,scope:{...j.scope,modelID:Z.modelID}})},onRequestPrepared:(Z)=>$.onRequestPrepared?.(Z),responseOptions(Z){return $.responseOptions?.({...Z,modelID:N.get(Z.provenance)?.scope.modelID??Z.modelID})},quotaFromHeaders(Z,j){let G=N.get(j.provenance),x=p$(Z);if(x)$.onRequestId?.(j,x);if(!G||j.route!=="oauth"||!FJ(Z))return;let O=j.provenance.kind==="local"?j.provenance.subject.binding.identity:G.receipt?.assertedAccountIdentity,D={...EJ(Z),...O?{accountIdentity:O}:{}},y=NJ(G.quota,D);G.quota=y;let l=o(j.provenance,G,y),p=G.account.id,I=()=>{if(l)X.quotaObservations.forget(p,l)};return M.observe(r(j.provenance,G,{quota:y}).then((u)=>{if(!u)I()},(u)=>{throw I(),u})),D},async limitFromResponse(Z){let j=N.get(Z.provenance);if(!j)return;if(Z.status===401&&j.receipt){if(!H.has(j.receipt))H.add(j.receipt),await X.vault.reportFailure(j.receipt,401,Z.dispatch==="http-relay"?"relay_status_field":"direct");if(j.retry||j.active.signal.aborted)return;let x=j.active,O=await X.vault.prepareRetry(j.receipt,x.signal);if(x.signal.throwIfAborted(),!O.retry)return;let D=O.receipt,y=D.assertedAccountIdentity;if(!y)return;let l={kind:"vault",credentialId:D.credentialId,recordVersion:D.recordVersion};N.set(l,{...j,receipt:D,retry:!0});let p=`vault-newer:${Z.attemptId}`;return P.set(p,{sessionID:Z.sessionID,accountId:Z.accountId,retry:!0,auth:{route:"oauth",accessToken:D.accessToken,provenance:l,identity:y2(y,y)}}),U(),{reason:p,status:401}}if(Z.status===401&&Z.provenance.kind==="local"&&j.access&&!j.retry){if(j.active.signal.aborted)return;let x=j.active,O=await X.authorizeLocal(Z.accountId,{rejectedAccessToken:j.access,signal:x.signal,policy:(p,I)=>I2(p,I,j.scope.modelID)});if(x.signal.throwIfAborted(),O.status!=="usable"||O.access===j.access)return;let D={kind:"local",subject:O.subject};N.set(D,{...j,access:O.access,retry:!0});let y=O.subject.binding.identity,l=`local-newer:${Z.attemptId}`;return P.set(l,{sessionID:Z.sessionID,accountId:Z.accountId,retry:!0,auth:{route:"oauth",accessToken:O.access,provenance:D,identity:y2(y,y)}}),U(),{reason:l,status:401}}let G=await X.read();if(xJ(Z.status,G.policyStorage))return{reason:`provider-${Z.status}`,status:Z.status};return},limitFromRelayFailure(Z){let j=N.get(Z.provenance);if(!j?.relayFallback||j.active.signal.aborted||!(Z.status===401||Z.status>=500))return;let G=`relay-direct:${Z.attemptId}`;return P.set(G,{sessionID:Z.sessionID,accountId:Z.accountId,direct:!0,retry:!1}),U(),{reason:G}},limitFromStreamError(Z){return Z.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(Z,j){let G=N.get(j.provenance);if(j.dispatch==="http-relay"&&G?.relayFallback&&!G.active.signal.aborted&&Z.status===void 0){let x=`relay-direct:${j.attemptId}`;return P.set(x,{sessionID:j.sessionID,accountId:j.accountId,direct:!0,retry:!1}),U(),{reason:x}}return},async onAttemptEnd(Z,j){let G=N.get(Z.provenance);if(!G)return;try{if(j.status===401&&G.receipt&&!H.has(G.receipt))H.add(G.receipt),await X.vault.reportFailure(G.receipt,401,Z.dispatch==="http-relay"?"relay_status_field":"direct");if(!j.localRefusal&&j.status!==void 0)M.publish(()=>r(Z.provenance,G,{lastUsed:Date.now()}))}finally{N.delete(Z.provenance)}},forgetSession(Z){K.get(Z)?.abort(),K.delete(Z),Y.delete(Z);for(let[j,G]of P)if(G.sessionID===Z)P.delete(j);for(let[j,G]of T)if(G[0]?.sessionID===Z)T.delete(j);$.onForgetSession?.(Z)},servedAccount:(Z)=>Y.get(Z),resetRouting:async(Z)=>L(await X.read()).clear(Z),async recordPrime(Z,j){let G=N.get(Z);if(!G||G.active.signal.aborted)return!1;if(Z.kind==="local")return X.incrementPrimeUsage(G.account.id,Z.subject,j);if(Z.kind==="vault"&&G.receipt)return X.incrementPrimeUsage(G.account.id,G.receipt,j);return!1},drainRoutingPublications:()=>Promise.all([X.drainRoutingPublications(),...[...V.values()].map((Z)=>Z.drain())]).then(()=>{}),close(){W=!0;for(let Z of K.values())Z.abort();return K.clear(),T.clear(),P.clear(),Promise.all([M.drain(),s.drainRoutingPublications()]).then(()=>{})}};return s}import{remapModelId as qJ}from"@cortexkit/anthropic-auth-core";function o$(){let $=new i$,X=new Map,M=new Map,V=new Map,L=new Set,N=new Set,P=new Map,T=(K)=>{while(K.size>512){let Y=K.keys().next();if(!Y.done)K.delete(Y.value)}};return{async install(K){let Y=[];try{Y.push(await K.session.hook("context",(H)=>{let W=H.messages.map((E)=>{return{info:{id:E.id,sessionID:H.sessionID,role:E.role,agent:H.agent,model:{providerID:H.model.providerID,modelID:H.model.id}},parts:E.content.map((q)=>({type:q.type,...q.type==="text"?{text:q.text}:{}}))}});$.observeMessages(W);let U=H.messages.findLast((E)=>E.role==="user"&&E.id);if(U?.id)X.set(H.sessionID,U.id);if(U?.content.some((E)=>E.type==="text"&&E.text===D2))L.add(H.sessionID);else L.delete(H.sessionID);T(X)},{providerID:"anthropic"})),Y.push(await K.session.hook("model.request",(H)=>{if(H.kind!=="primary")return;let W=X.get(H.sessionID);if(!W)return;if($.markHeaders({sessionId:H.sessionID,messageId:W,agent:H.agent,headers:H.headers}),L.has(H.sessionID))H.headers[R2]="1"},{providerID:"anthropic"}))}catch(H){throw await Promise.allSettled(Y.map((W)=>W.dispose())),H}return{dispose:async()=>{await Promise.all(Y.map((H)=>H.dispose()))}}},requestOptions(K,Y){let H=$.resolveHeader(K.correlation[k2]);if(H)M.set(K.attemptId,H),T(M);P.set(K.attemptId,K.sessionID),T(P);let W=K.correlation[R2]==="1";if(W)N.add(K.attemptId);return{cache1hEnabled:K.agent!=="compaction"&&K.agent!=="title"&&(Y.policyStorage.claudeCache?.enabled??!0),cache1hMode:Y.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:Y.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:Y.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,turnEndNoteEnabled:!0,turnEndNote:Y.policyStorage.turnEndNote,serverSideFallbackEnabled:c$(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:W,billingLineage:H?{promptId:H.promptId,previousRequestId:H.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:V.get(K.sessionID)}},responseOptions(K){return{serverSideFallbackModel:qJ(K.modelID),laneStart:N.has(K.attemptId),onMessageStart(Y){if(K.kind==="primary"&&typeof Y.id==="string")V.set(K.sessionID,Y.id),T(V)},onStreamEnd(){M.delete(K.attemptId),N.delete(K.attemptId),P.delete(K.attemptId)}}},onRequestId(K,Y){$.commit(M.get(K.attemptId),Y)},forgetSession(K){$.clearSession(K),X.delete(K),V.delete(K),L.delete(K);for(let[Y,H]of P)if(H===K)M.delete(Y),N.delete(Y),P.delete(Y)}}}var g2="cortexkit-anthropic-auth",gJ='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',vJ="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",hJ="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function mJ($){let X=$.authorize??DJ,M=$.exchange??yJ,V=()=>{if(!$.isActive())throw Error("Claude authentication setup is closed")},L=async()=>{let T;try{T=await $.readMode()}catch{throw Error(hJ)}return V(),T},N=async()=>{if(await L()!=="local")throw Error(gJ)};return{integrationID:"anthropic",methods:[{method:{id:b2,type:"oauth",label:w2},async authorize(){V(),await N();let T=await X("max");return V(),{mode:"code",url:T.url,instructions:"Paste the authorization code returned by Claude.",callback:async(K)=>{V();let Y=await M(K,T.verifier,T.redirectUri,T.state);if(!$.isActive()||Y.type!=="success")throw Error("Claude sign-in did not complete");return{access:Y.access,refresh:Y.refresh,expires:Y.expires}}}}}],vault:{method:{id:r$,type:"oauth",label:"Claude vault accounts"},async activate(){if(V(),await L()!=="claustrum")throw Error(vJ)}},async onLogin(T){V(),await N(),await $.runtime.loginOAuth({routeId:"main",credential:T,replace:!0}),V()},label:"Claude native account pool"}}function lJ($){return{readMode:()=>IJ("opencode",$),disconnectVault:()=>wJ({host:"opencode",env:$})}}function e2($={}){return{id:g2,setup:(X)=>a$(X,$)}}async function a$($,X={}){let M=X.paths??await fJ(),V=kJ({paths:M,host:"opencode",local:X.local,vault:X.vault}),L=lJ(X.vault?.env??process.env),N=!0,P=o$(),T=I$(),K,Y,H,W=u$({runtime:V,paths:M,fetch:X.fetch,requestOptions:P.requestOptions,responseOptions:P.responseOptions,onRequestId:P.onRequestId,onForgetSession:P.forgetSession,onRequestPrepared:async(w)=>{try{await H?.track(w)}catch{n$.warn("cachekeep","live request tracking failed")}},resolveModelId:async(w)=>T.modelId(w.modelID),onOwnedRequest:()=>{K??=R$(V,X.fetch),Y??=m$({runtime:V,paths:M,source:W,fetch:X.fetch})}});H=E$({...X.cacheKeep,runtime:V,source:W,fetch:X.fetch,isSubagent:async(w)=>Boolean((await $.session.get({sessionID:w})).parentID)});let U=y$({runtime:V,source:W,cacheKeepRegistry:H.registry,start:async(w,c)=>{await $.session.synthetic({sessionID:w,text:c,description:"Claude lane start",resume:!0})}}),E=[],q=await O$($,{source:W,log:{warn:(w,c)=>n$.warn("opencode2",w,c)}},{credential:f$}).catch(async(w)=>{throw U.close(),await H?.dispose(),await W.close(),await V.drainQuotaPublications(),V.close(),w}),A,m=()=>{if(A)return A;return N=!1,U.close(),W.close(),A=(async()=>{await Promise.allSettled([q.dispose(),K?.dispose(),Y?.dispose(),H?.dispose(),...E.map((w)=>w.dispose())]),await W.close(),await V.drainQuotaPublications(),V.close()})(),A};try{E.push(await P.install($)),E.push(await T.install($)),E.push(await l2($,mJ({isActive:()=>N,readMode:L.readMode,runtime:V})));let w={host:"opencode",dispatch:U.dispatch,readStatus:(r)=>U.readStatus(r),readAccounts:()=>V.read(),readMode:L.readMode,disconnectVault:L.disconnectVault,interactive:!0},c=bJ(w);return E.push(await s$($,c,U)),m}catch(w){throw await m(),w}}var YZ={id:g2,setup:e2().setup,server:t$};export{a$ as setupAnthropicAuth,YZ as default,e2 as createAnthropicAuthPlugin,g2 as ANTHROPIC_AUTH_PLUGIN_ID};
+${w$}
+Quota refresh checks the pool; it does not check OpenCode's Anthropic connection.`:U}if(Y==="quota")return t1({accounts:H.accounts.filter((U)=>U.type==="oauth").map((U)=>({name:U.label??U.id,role:U.id==="main"?"main":"fallback",enabled:U.enabled,quota:U.quota,tierLabel:YJ(U.profile),lastRefreshedAt:U.lastRefreshedAt,error:U.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(Y==="prime")return $J({enabled:H.policyStorage.prime?.enabled===!0,accounts:e1(H.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");if(Y==="cachekeep"){let U=await $.cacheKeepRegistry?.list()??[];return a1({enabled:QJ(H.policyStorage),always:jJ(H.policyStorage),hybridActive:WJ(H.policyStorage),trackedSessionDetails:U,window:GJ(H.policyStorage),trackedSessions:U.length,nextPrewarmAt:U.length?Math.min(...U.map((E)=>E.nextPrewarmAt)):void 0})}let W={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(H.settings[W[Y]]??{})},async readSidebar(Y){let[H,W]=await Promise.all([X.read(),$.cacheKeepRegistry?.list()??[]]);return b$(H,{activeId:M.servedAccount(Y),trackedSessions:W.length,now:Date.now()})},forgetSession(Y){V.get(Y)?.active.abort(),V.delete(Y)},close(){L=!0;for(let Y of V.values())Y.active.abort();V.clear()}}}import{resolveClaudeModelCapabilities as KJ}from"@cortexkit/anthropic-auth-core";function f$(){let $=new Map;return{install:(M)=>M.model.transform((V)=>{$.clear();for(let L of V.list("anthropic")){$.set(String(L.id),String(L.modelID));let N=KJ(L.modelID)?.efforts.variants;if(!N)continue;V.update("anthropic",String(L.id),(P)=>{let T=P.variants.filter((K)=>!N.some((Y)=>Y===String(K.id)));P.variants=[...T,...N.map((K)=>({id:K,settings:{effort:K,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(M)=>$.get(M)??M}}function g$($){return $.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??$.get("x-api-key")??void 0}import{buildPrimeRequestBody as v$,effectiveRelayTransport as h$,nativeAccountCanServe as MJ,PrimeManager as zJ}from"@cortexkit/anthropic-auth-core";var m$=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{};function l$($){let{runtime:X,source:M}=$,V=new AbortController,L=new Set,N=(K)=>({providerID:"anthropic",modelID:v$().model,sessionID:`oc2-prime:${K}`,agent:"prime",kind:"generate"}),P=async(K)=>{let Y=N(K),H=P2({source:M}),W=performance.now();try{for(let U=0;U<3;U++){if(V.signal.throwIfAborted(),(await X.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let q=await H.adapter.accountHeaders({...Y,accountId:K});if(!("headers"in q)||typeof q.headers!=="object"||q.headers===null||typeof q.attempt!=="object"||q.attempt===null)throw Error("Native Prime authorization refused");let A={...Y,accountId:K,attemptId:crypto.randomUUID(),transport:"http",data:q.attempt},m,w=!1,c=!1,r=(o)=>{c=!0,o.body?.cancel().catch(()=>{})};try{let o=await H.adapter.rewriteRequest?.({...Y,accountId:K,attempt:A,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(v$()),signal:V.signal})});if(!o)throw Error("Native Prime rewrite refused");let s=new Headers(o.headers);for(let[l,p]of Object.entries(q.headers))if(p===null)s.delete(l);else s.set(l,p);let Z=new Request(o,{headers:s}),j=await($.fetch??fetch)(Z),G=await H.adapter.rewriteResponse?.({...Y,accountId:K,request:Z,response:j,attempt:A})??j;m=G.status,H.adapter.quotaFromHeaders?.(G.headers,G.status,A);let x=G.ok?void 0:await H.adapter.limitFromResponse?.({status:G.status,headers:G.headers,body:()=>G.clone().text(),attempt:A});if(x&&/^(vault-newer|local-newer|relay-direct):/.test(x.reason)&&U<2){r(G);let l={...Y,phase:"retry",rerouteFrom:{accountId:K,limit:x}};if(await M.chooseAccount(l)!==K)throw Error("Native Prime retry changed account");continue}if(!G.ok)return r(G),{ok:!1,status:m,ms:performance.now()-W,error:"Native Prime upstream refused the request"};let O=m$(await G.json()),D=m$(O.usage),y={inputTokens:typeof D.input_tokens==="number"?D.input_tokens:void 0,outputTokens:typeof D.output_tokens==="number"?D.output_tokens:void 0};if(A.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(G.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(w=await M.recordPrime(q.attempt.provenance,y),!w)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:m,ms:performance.now()-W,usage:y}}finally{await H.adapter.onAttemptEnd?.(A,{status:m,outputStarted:!1,...w?{}:{error:{reason:c?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-W}}finally{H.dispose()}},T=new zJ({storagePath:$.paths.legacyConfig,loadStorage:async()=>(await X.read()).policyStorage,async getAccountFingerprint(K){let Y=await X.read(),H=Y.accounts.find((U)=>U.id===K);if(!MJ(H)||H?.type!=="oauth")return;if(Y.policyStorage.relay?.enabled===!0&&h$(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")return;if(H.source==="vault"){let U=await X.authorizeVault(K,V.signal);return X.getOrCreateAuthLineage(K,U)}let W=await X.authorizeLocal(K,{signal:V.signal});return W.status==="usable"?X.getOrCreateAuthLineage(K,W.subject):void 0},async refreshQuota(K){let Y=await X.read();if(Y.policyStorage.relay?.enabled===!0&&h$(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await X.fetchQuota(K,$.fetch,V.signal),fresh:!0}},sendPrime(K){let Y=P(K);return L.add(Y),Y.finally(()=>L.delete(Y)),Y},async recordSuccess(K){let Y=(await X.read()).accounts.find((H)=>H.id===K);if(!Y?.prime)throw Error("Native Prime counters are unavailable");return Y.prime}});return T.start(),{manager:T,async dispose(){T.stop(),V.abort(),await Promise.allSettled(L)}}}import{createNativeUsagePublisher as _J,effectiveRelayTransport as FJ,getClaudeCodeIdentityForVerifiedAccount as y2,getQuotaCheckIntervalMs as CJ,getRoutingMode as d$,isQuotaBearingHeaderFrame as NJ,logger as LJ,mergeHeaderQuotaForPersistence as PJ,NativeVaultNoAccountError as TJ,nativeAccountCanServe as s2,nativeAccountPolicy as I2,nativeLocalQuotaLineage as EJ,nativePollQuotaGenerallyExhausted as OJ,normalizeQuotaHeaders as SJ,quotaSnapshotCheckedAt as p$,quotaSnapshotHasStandardWindows as RJ,readNativeAccountsForRequest as xJ,remapModelId as a2,StickySessionRouter as AJ,shouldFallbackStatus as qJ,stickyQuotaSnapshotIsFresh as f2,stickyRouteFamilyForModel as kJ}from"@cortexkit/anthropic-auth-core";var t2=($)=>["five_hour","seven_day"].some((X)=>($?.[X]?.remainingPercent??1)<=0);function i$($){let{runtime:X}=$,M=_J("native-auth"),V=new Map,L=(Z)=>{let j=Z.routingPath;if(!j)throw Error("Native routing storage is unavailable");let G=V.get(j);if(!G)G=new AJ({path:j,vaultSeed:Z.routingSeed,onLockEvent:X.onLockEvent,localRecoveryPath:Z.mode==="local"?Z.routingRecoveryPath:void 0}),V.set(j,G);return G.setVaultSeed(Z.routingSeed),G},N=new WeakMap,P=new Map,T=new Map,K=new Map,Y=new Map,H=new WeakSet,W=!1,U=()=>{while(P.size>512){let Z=P.keys().next();if(!Z.done)P.delete(Z.value)}},E=(Z,j)=>JSON.stringify([Z.sessionID,Z.kind,Z.modelID,j]),q=(Z)=>{if(W)throw Error("Native Anthropic source is closed");let j=K.get(Z.sessionID);if(!j){j=new AbortController,K.set(Z.sessionID,j);while(K.size>512){let G=K.keys().next();if(!G.done)s.forgetSession?.(G.value)}}return j},A=(Z,j,G)=>s2(Z)&&(Z.type==="api"||I2(Z,j,a2(G)).status==="allowed"),m=async(Z,j,G,x)=>{let O=await X.read();x.signal.throwIfAborted(),w(O);let D=O.accounts.find((y)=>y.id===Z);if(!D||D.type!==G||!A(D,O,j))return!1;if(G==="api"){let y=O.accounts.find((l)=>l.id==="main"&&l.type==="oauth");return!!y&&f2(y.quota,O.policyStorage)&&t2(y.quota)}return!0},w=(Z)=>{let j=Z.policyStorage.relay;if(j?.enabled===!0&&FJ(j.transport,j.url)==="websocket")throw new L2},c=async(Z,j)=>{if(w(Z),j||Z.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let G=await X.getRelayConfig();if(!G)throw Error("request refused: native HTTP relay configuration is unavailable");if(G.transport!=="http")throw new L2;return{dispatch:{kind:"http-relay",url:G.url,token:G.token},relayFallback:G.fallbackToDirect}};async function r(Z,j,G){if(Z.kind==="local"){let x=await X.publishLocal(Z.subject,G);if(!x&&G.quota)LJ.warn("quota","Quota publication discarded");return x}if(Z.kind==="vault"&&j.receipt)await X.vault.publish(j.receipt,G);else if(Z.kind==="api"&&G.lastUsed!==void 0)await X.publishApi(Z.subject,{lastUsed:G.lastUsed});return!0}function o(Z,j,G){if(Z.kind!=="local")return;let x=Z.subject.binding,O=p$(G),D={lineage:EJ(x),accountUuid:x.identity,entry:{quota:G,checkedAt:O,refreshAfter:O},generalExhausted:OJ(G),routeBeforeSave:!0};return X.quotaObservations.hold(j.account.id,D)?D:void 0}let s={async chooseAccount(Z){let j=q(Z);$.onOwnedRequest?.();let G=await X.read();j.signal.throwIfAborted(),w(G);let x=a2(await $.resolveModelId?.(Z)??Z.modelID);if(j.signal.throwIfAborted(),G.mode==="claustrum")G=await xJ(X,j.signal),j.signal.throwIfAborted();if(G.policyStorage.quota?.enabled!==!1){let I=!1;for(let u of G.accounts){if(!s2(u)||u.type!=="oauth")continue;if(RJ(u.quota)?f2(u.quota,G.policyStorage,Date.now(),x):Date.now()-p$(u.quota)<CJ(G.policyStorage))continue;try{await X.fetchQuota(u.id,$.fetch,j.signal,void 0,"admission"),I=!0}catch{j.signal.throwIfAborted()}}if(I)G=await X.read();j.signal.throwIfAborted()}let O=Z.rerouteFrom?P.get(Z.rerouteFrom.limit.reason):void 0;if(Z.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(Z.rerouteFrom.limit.reason)&&!O)return;if(O&&Z.rerouteFrom){let I=G.accounts.find((B)=>B.id===O.accountId);if(!I||!A(I,G,x))return;P.delete(Z.rerouteFrom.limit.reason);let u=E(Z,O.accountId),d=T.get(u)??[];return d.push(O),T.set(u,d),O.accountId}let D=[];for(let I of G.accounts){if(I.type!=="oauth"||!A(I,G,x))continue;if(I.source==="local"){let u=await X.authorizeLocal(I.id,{signal:j.signal,policy:(d,B)=>I2(d,B,x)});if(j.signal.throwIfAborted(),u.status!=="usable")continue}D.push(I)}let y=D.filter((I)=>I.id!==Z.rerouteFrom?.accountId);if(d$(G.policyStorage)==="sticky-balanced"){let I=y.map((d,B)=>({accountId:d.id,order:B,quota:d.quota??{kind:"unknown"}})),u=await L(G).resolve({sessionId:Z.sessionID,family:kJ(x),modelId:x,affinityModelId:Z.modelID,candidates:I,retainAccountIds:new Set(y.map((d)=>d.id)),...G.mode==="claustrum"?{accountIdentities:new Map(G.accounts.flatMap((d)=>d.accountIdentity?[[d.id,d.accountIdentity]]:[]))}:{},storage:G.policyStorage,inputBytes:1,preferredAccountId:Z.previousAccountId,preserveOnNoCandidate:!0});if(j.signal.throwIfAborted(),u)return u.accountId}else{let u=d$(G.policyStorage)==="fallback-first"?[...y.filter((d)=>d.id!=="main"),...y.filter((d)=>d.id==="main")]:[...y.filter((d)=>d.id==="main"),...y.filter((d)=>d.id!=="main")];if(u[0])return u[0].id}if(G.mode==="claustrum")throw new TJ;let l=G.accounts.find((I)=>I.id==="main"&&I.type==="oauth");if(!l)return;let p=l.quota;if(Z.rerouteFrom?.limit.status===429||!f2(p,G.policyStorage))try{p=await X.fetchQuota("main",$.fetch,j.signal)}catch{return}if(j.signal.throwIfAborted(),!t2(p))return;return G.accounts.find((I)=>I.type==="api"&&s2(I)&&I.id!==Z.rerouteFrom?.accountId)?.id},dropChoice(Z){let j=E(Z,Z.accountId),G=T.get(j);if(G?.shift(),G?.length===0)T.delete(j)},async authorizeAccount(Z,j){let G=q(Z),x=await X.read();G.signal.throwIfAborted(),w(x);let O=a2(await $.resolveModelId?.(Z)??Z.modelID);G.signal.throwIfAborted();let D=x.accounts.find((S)=>S.id===j);if(!D||!A(D,x,O))return;let y=E(Z,j),l=T.get(y),p=l?.shift();if(l?.length===0)T.delete(y);let{dispatch:I,relayFallback:u}=await c(x,p?.direct===!0);if(G.signal.throwIfAborted(),p?.auth){if(!await m(j,O,p.auth.route,G))return;let S=N.get(p.auth.provenance);if(S?.receipt?.expiresAtMs!==void 0&&S.receipt.expiresAtMs!==null&&S.receipt.expiresAtMs<Date.now()+300000)return;if(S)N.set(p.auth.provenance,{...S,scope:{...Z,modelID:O},account:D,active:G,relayFallback:u});return Y.set(Z.sessionID,j),{...p.auth,dispatch:I}}let d={scope:{...Z,modelID:O},active:G,account:D,retry:p?.retry??!1,relayFallback:u,quota:D.quota};if(D.type==="api"){let S=x.accounts.find((n)=>n.id==="main"&&n.type==="oauth");if(!S||!f2(S.quota,x.policyStorage)||!t2(S.quota))return;let R=await X.authorizeApi(j,G.signal);if(G.signal.throwIfAborted(),!await m(j,O,"api",G))return;let b={kind:"api",subject:R.subject};return N.set(b,d),Y.set(Z.sessionID,j),{route:"api",headers:R.authHeader==="authorization-bearer"?{authorization:`Bearer ${R.apiKey}`}:{"x-api-key":R.apiKey},baseURL:R.baseURL,provenance:b,dispatch:I}}if(D.source==="vault"){let S=await X.authorizeVault(j,G.signal);if(G.signal.throwIfAborted(),!await m(j,O,"oauth",G))return;let R={kind:"vault",credentialId:S.credentialId,recordVersion:S.recordVersion};N.set(R,{...d,receipt:S});let b=S.assertedAccountIdentity;if(!b)return;return Y.set(Z.sessionID,j),{route:"oauth",accessToken:S.accessToken,provenance:R,dispatch:I,identity:y2(b,b)}}let B=await X.authorizeLocal(j,{signal:G.signal,policy:(S,R)=>I2(S,R,O)});if(G.signal.throwIfAborted(),B.status!=="usable")return;if(!await m(j,O,"oauth",G))return;let z={kind:"local",subject:B.subject};N.set(z,{...d,access:B.access}),Y.set(Z.sessionID,j);let C=B.subject.binding.identity;return{route:"oauth",accessToken:B.access,provenance:z,dispatch:I,identity:y2(C,C)}},async requestOptions(Z){let j=q(Z),G=await X.read();j.signal.throwIfAborted();let x=G.accounts.find((D)=>D.id===Z.accountId);if(!x||!A(x,G,Z.modelID))throw Error("request refused: native account is ineligible for this model");let O=N.get(Z.provenance);if(O)N.set(Z.provenance,{...O,scope:{...O.scope,modelID:Z.modelID}});return $.requestOptions(Z,G)},async admitRequest(Z){let j=N.get(Z.provenance);if(!j||!await m(Z.accountId,Z.modelID,Z.route,j.active))throw Error("request refused: native account policy changed before dispatch");N.set(Z.provenance,{...j,scope:{...j.scope,modelID:Z.modelID}})},onRequestPrepared:(Z)=>$.onRequestPrepared?.(Z),responseOptions(Z){return $.responseOptions?.({...Z,modelID:N.get(Z.provenance)?.scope.modelID??Z.modelID})},quotaFromHeaders(Z,j){let G=N.get(j.provenance),x=u$(Z);if(x)$.onRequestId?.(j,x);if(!G||j.route!=="oauth"||!NJ(Z))return;let O=j.provenance.kind==="local"?j.provenance.subject.binding.identity:G.receipt?.assertedAccountIdentity,D={...SJ(Z),...O?{accountIdentity:O}:{}},y=PJ(G.quota,D);G.quota=y;let l=o(j.provenance,G,y),p=G.account.id,I=()=>{if(l)X.quotaObservations.forget(p,l)};return M.observe(r(j.provenance,G,{quota:y}).then((u)=>{if(!u)I()},(u)=>{throw I(),u})),D},async limitFromResponse(Z){let j=N.get(Z.provenance);if(!j)return;if(Z.status===401&&j.receipt){if(!H.has(j.receipt))H.add(j.receipt),await X.vault.reportFailure(j.receipt,401,Z.dispatch==="http-relay"?"relay_status_field":"direct");if(j.retry||j.active.signal.aborted)return;let x=j.active,O=await X.vault.prepareRetry(j.receipt,x.signal);if(x.signal.throwIfAborted(),!O.retry)return;let D=O.receipt,y=D.assertedAccountIdentity;if(!y)return;let l={kind:"vault",credentialId:D.credentialId,recordVersion:D.recordVersion};N.set(l,{...j,receipt:D,retry:!0});let p=`vault-newer:${Z.attemptId}`;return P.set(p,{sessionID:Z.sessionID,accountId:Z.accountId,retry:!0,auth:{route:"oauth",accessToken:D.accessToken,provenance:l,identity:y2(y,y)}}),U(),{reason:p,status:401}}if(Z.status===401&&Z.provenance.kind==="local"&&j.access&&!j.retry){if(j.active.signal.aborted)return;let x=j.active,O=await X.authorizeLocal(Z.accountId,{rejectedAccessToken:j.access,signal:x.signal,policy:(p,I)=>I2(p,I,j.scope.modelID)});if(x.signal.throwIfAborted(),O.status!=="usable"||O.access===j.access)return;let D={kind:"local",subject:O.subject};N.set(D,{...j,access:O.access,retry:!0});let y=O.subject.binding.identity,l=`local-newer:${Z.attemptId}`;return P.set(l,{sessionID:Z.sessionID,accountId:Z.accountId,retry:!0,auth:{route:"oauth",accessToken:O.access,provenance:D,identity:y2(y,y)}}),U(),{reason:l,status:401}}let G=await X.read();if(qJ(Z.status,G.policyStorage))return{reason:`provider-${Z.status}`,status:Z.status};return},limitFromRelayFailure(Z){let j=N.get(Z.provenance);if(!j?.relayFallback||j.active.signal.aborted||!(Z.status===401||Z.status>=500))return;let G=`relay-direct:${Z.attemptId}`;return P.set(G,{sessionID:Z.sessionID,accountId:Z.accountId,direct:!0,retry:!1}),U(),{reason:G}},limitFromStreamError(Z){return Z.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(Z,j){let G=N.get(j.provenance);if(j.dispatch==="http-relay"&&G?.relayFallback&&!G.active.signal.aborted&&Z.status===void 0){let x=`relay-direct:${j.attemptId}`;return P.set(x,{sessionID:j.sessionID,accountId:j.accountId,direct:!0,retry:!1}),U(),{reason:x}}return},async onAttemptEnd(Z,j){let G=N.get(Z.provenance);if(!G)return;try{if(j.status===401&&G.receipt&&!H.has(G.receipt))H.add(G.receipt),await X.vault.reportFailure(G.receipt,401,Z.dispatch==="http-relay"?"relay_status_field":"direct");if(!j.localRefusal&&j.status!==void 0)M.publish(()=>r(Z.provenance,G,{lastUsed:Date.now()}))}finally{N.delete(Z.provenance)}},forgetSession(Z){K.get(Z)?.abort(),K.delete(Z),Y.delete(Z);for(let[j,G]of P)if(G.sessionID===Z)P.delete(j);for(let[j,G]of T)if(G[0]?.sessionID===Z)T.delete(j);$.onForgetSession?.(Z)},servedAccount:(Z)=>Y.get(Z),resetRouting:async(Z)=>L(await X.read()).clear(Z),async recordPrime(Z,j){let G=N.get(Z);if(!G||G.active.signal.aborted)return!1;if(Z.kind==="local")return X.incrementPrimeUsage(G.account.id,Z.subject,j);if(Z.kind==="vault"&&G.receipt)return X.incrementPrimeUsage(G.account.id,G.receipt,j);return!1},drainRoutingPublications:()=>Promise.all([X.drainRoutingPublications(),...[...V.values()].map((Z)=>Z.drain())]).then(()=>{}),close(){W=!0;for(let Z of K.values())Z.abort();return K.clear(),T.clear(),P.clear(),Promise.all([M.drain(),s.drainRoutingPublications()]).then(()=>{})}};return s}import{remapModelId as DJ}from"@cortexkit/anthropic-auth-core";function n$(){let $=new c$,X=new Map,M=new Map,V=new Map,L=new Set,N=new Set,P=new Map,T=(K)=>{while(K.size>512){let Y=K.keys().next();if(!Y.done)K.delete(Y.value)}};return{async install(K){let Y=[];try{Y.push(await K.session.hook("context",(H)=>{let W=H.messages.map((E)=>{return{info:{id:E.id,sessionID:H.sessionID,role:E.role,agent:H.agent,model:{providerID:H.model.providerID,modelID:H.model.id}},parts:E.content.map((q)=>({type:q.type,...q.type==="text"?{text:q.text}:{}}))}});$.observeMessages(W);let U=H.messages.findLast((E)=>E.role==="user"&&E.id);if(U?.id)X.set(H.sessionID,U.id);if(U?.content.some((E)=>E.type==="text"&&E.text===D2))L.add(H.sessionID);else L.delete(H.sessionID);T(X)},{providerID:"anthropic"})),Y.push(await K.session.hook("model.request",(H)=>{if(H.kind!=="primary")return;let W=X.get(H.sessionID);if(!W)return;if($.markHeaders({sessionId:H.sessionID,messageId:W,agent:H.agent,headers:H.headers}),L.has(H.sessionID))H.headers[R2]="1"},{providerID:"anthropic"}))}catch(H){throw await Promise.allSettled(Y.map((W)=>W.dispose())),H}return{dispose:async()=>{await Promise.all(Y.map((H)=>H.dispose()))}}},requestOptions(K,Y){let H=$.resolveHeader(K.correlation[k2]);if(H)M.set(K.attemptId,H),T(M);P.set(K.attemptId,K.sessionID),T(P);let W=K.correlation[R2]==="1";if(W)N.add(K.attemptId);return{cache1hEnabled:K.agent!=="compaction"&&K.agent!=="title"&&(Y.policyStorage.claudeCache?.enabled??!0),cache1hMode:Y.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:Y.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:Y.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,turnEndNoteEnabled:!0,turnEndNote:Y.policyStorage.turnEndNote,serverSideFallbackEnabled:o$(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:W,billingLineage:H?{promptId:H.promptId,previousRequestId:H.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:V.get(K.sessionID)}},responseOptions(K){return{serverSideFallbackModel:DJ(K.modelID),laneStart:N.has(K.attemptId),onMessageStart(Y){if(K.kind==="primary"&&typeof Y.id==="string")V.set(K.sessionID,Y.id),T(V)},onStreamEnd(){M.delete(K.attemptId),N.delete(K.attemptId),P.delete(K.attemptId)}}},onRequestId(K,Y){$.commit(M.get(K.attemptId),Y)},forgetSession(K){$.clearSession(K),X.delete(K),V.delete(K),L.delete(K);for(let[Y,H]of P)if(H===K)M.delete(Y),N.delete(Y),P.delete(Y)}}}var g2="cortexkit-anthropic-auth",hJ='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',mJ="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",lJ="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function dJ($){let X=$.authorize??wJ,M=$.exchange??fJ,V=()=>{if(!$.isActive())throw Error("Claude authentication setup is closed")},L=async()=>{let T;try{T=await $.readMode()}catch{throw Error(lJ)}return V(),T},N=async()=>{if(await L()!=="local")throw Error(hJ)};return{integrationID:"anthropic",methods:[{method:{id:b2,type:"oauth",label:w2},async authorize(){V(),await N();let T=await X("max");return V(),{mode:"code",url:T.url,instructions:"Paste the authorization code returned by Claude.",callback:async(K)=>{V();let Y=await M(K,T.verifier,T.redirectUri,T.state);if(!$.isActive()||Y.type!=="success")throw Error("Claude sign-in did not complete");return{access:Y.access,refresh:Y.refresh,expires:Y.expires}}}}}],vault:{method:{id:s$,type:"oauth",label:"Claude vault accounts"},async activate(){if(V(),await L()!=="claustrum")throw Error(mJ)}},async onLogin(T){V(),await N(),await $.runtime.loginOAuth({routeId:"main",credential:T,replace:!0}),V()},label:"Claude native account pool"}}function pJ($){return{readMode:()=>gJ("opencode",$),disconnectVault:()=>IJ({host:"opencode",env:$})}}function e2($={}){return{id:g2,setup:(X)=>t$(X,$)}}async function t$($,X={}){let M=X.paths??await vJ(),V=bJ({paths:M,host:"opencode",local:X.local,vault:X.vault}),L=pJ(X.vault?.env??process.env),N=!0,P=n$(),T=f$(),K,Y,H,W=i$({runtime:V,paths:M,fetch:X.fetch,requestOptions:P.requestOptions,responseOptions:P.responseOptions,onRequestId:P.onRequestId,onForgetSession:P.forgetSession,onRequestPrepared:async(w)=>{try{await H?.track(w)}catch{r$.warn("cachekeep","live request tracking failed")}},resolveModelId:async(w)=>T.modelId(w.modelID),onOwnedRequest:()=>{K??=x$(V,X.fetch),Y??=l$({runtime:V,paths:M,source:W,fetch:X.fetch})}});H=O$({...X.cacheKeep,runtime:V,source:W,fetch:X.fetch,isSubagent:async(w)=>Boolean((await $.session.get({sessionID:w})).parentID)});let U=I$({runtime:V,source:W,cacheKeepRegistry:H.registry,start:async(w,c)=>{await $.session.synthetic({sessionID:w,text:c,description:"Claude lane start",resume:!0})}}),E=[],q=await S$($,{source:W,log:{warn:(w,c)=>r$.warn("opencode2",w,c)}},{credential:g$}).catch(async(w)=>{throw U.close(),await H?.dispose(),await W.close(),await V.drainQuotaPublications(),V.close(),w}),A,m=()=>{if(A)return A;return N=!1,U.close(),W.close(),A=(async()=>{await Promise.allSettled([q.dispose(),K?.dispose(),Y?.dispose(),H?.dispose(),...E.map((w)=>w.dispose())]),await W.close(),await V.drainQuotaPublications(),V.close()})(),A};try{E.push(await P.install($)),E.push(await T.install($)),E.push(await l2($,dJ({isActive:()=>N,readMode:L.readMode,runtime:V})));let w={host:"opencode",dispatch:U.dispatch,readStatus:(r)=>U.readStatus(r),readAccounts:()=>V.read(),readMode:L.readMode,disconnectVault:L.disconnectVault,interactive:!0},c=yJ(w);return E.push(await a$($,c,U)),m}catch(w){throw await m(),w}}var jZ={id:g2,setup:e2().setup,server:e$};export{t$ as setupAnthropicAuth,jZ as default,e2 as createAnthropicAuthPlugin,g2 as ANTHROPIC_AUTH_PLUGIN_ID};

package/dist/v2/tui.js

@@ -1,4 +1,4 @@
-import{t as L}from"../index-jvhs8sxv.js";import"../index-20d6rmjj.js";import"../index-62x1p34p.js";var T="Open this link in your browser and sign in. Then choose Finish OAuth sign-in in the Accounts menu and paste the code Claude shows you.";async function _(D,O={}){let G=D.client.rpc(L),Y=!0,P=!1,Z=new AbortController,$=()=>{let z=D.ui.router.current();return z.type==="session"?z.sessionID:void 0};function R(z){return new Promise((X)=>{let j="",J=!1,q=D.keymap.mode.push("cortexkit-protected-entry"),W=(H,Q=!0)=>{if(J)return;J=!0,D.renderer.keyInput.off("keypress",K),D.renderer.keyInput.off("paste",M),Z.signal.removeEventListener("abort",B),q();let V=H?j:void 0;if(j="",Q)D.ui.dialog.clear();X(V)},B=()=>W(!1),K=(H)=>{if(H.preventDefault(),H.stopPropagation(),H.name==="escape"||H.ctrl&&H.name==="c")return W(!1);if(H.name==="return"||H.name==="enter")return W(!0);if(H.name==="backspace"){j=Array.from(j).slice(0,-1).join("");return}if(!H.ctrl&&!H.meta&&!H.option&&Array.from(H.sequence).every((Q)=>Q.charCodeAt(0)>=32&&Q.charCodeAt(0)!==127))j=(j+H.sequence).slice(0,4096)},M=(H)=>{H.preventDefault(),H.stopPropagation(),j=(j+Array.from(new TextDecoder().decode(H.bytes)).filter((Q)=>Q.charCodeAt(0)>=32&&Q.charCodeAt(0)!==127).join("")).slice(0,4096)};if(D.renderer.keyInput.prependListener("keypress",K),D.renderer.keyInput.prependListener("paste",M),Z.signal.addEventListener("abort",B,{once:!0}),D.ui.dialog.alert({title:z,message:"Type or paste the value. Input is hidden. Enter accepts; Escape cancels."}).then(()=>W(!1,!1),()=>W(!1,!1)),Z.signal.aborted)B()})}async function U(z){let X={};for(let j of z.knobs){if(!Y)return;if(j.kind==="choice"){let J=await D.ui.dialog.select({title:j.label,options:j.choices.map((q)=>({title:q.label,value:q.value})),current:j.value});if(J===void 0)return;X[j.id]=J}else if(j.kind==="toggle"){let J=await D.ui.dialog.select({title:j.label,options:[{title:"On",value:!0},{title:"Off",value:!1}],current:j.value});if(J===void 0)return;X[j.id]=J}else{let J=j.kind==="text"&&j.masked?await R(j.label):await D.ui.dialog.prompt({title:j.label,value:j.value===void 0?void 0:String(j.value),placeholder:j.kind==="text"?j.placeholder:void 0});if(J===void 0)return;X[j.id]=J===""&&!j.required?null:j.kind==="number"?Number(J):J}}return X}async function C(z){if(O.showSignInLink)try{await O.showSignInLink(D,z,Z.signal);return}catch{}await D.ui.dialog.alert({title:"Claude sign-in",message:`${T}
+import{u as L}from"../index-nm4pjrt8.js";import"../index-j6x60aqq.js";import"../index-71temqvq.js";var T="Open this link in your browser and sign in. Then choose Finish OAuth sign-in in the Accounts menu and paste the code Claude shows you.";async function _(D,O={}){let G=D.client.rpc(L),Y=!0,P=!1,Z=new AbortController,$=()=>{let z=D.ui.router.current();return z.type==="session"?z.sessionID:void 0};function R(z){return new Promise((X)=>{let j="",J=!1,q=D.keymap.mode.push("cortexkit-protected-entry"),W=(H,Q=!0)=>{if(J)return;J=!0,D.renderer.keyInput.off("keypress",K),D.renderer.keyInput.off("paste",M),Z.signal.removeEventListener("abort",B),q();let V=H?j:void 0;if(j="",Q)D.ui.dialog.clear();X(V)},B=()=>W(!1),K=(H)=>{if(H.preventDefault(),H.stopPropagation(),H.name==="escape"||H.ctrl&&H.name==="c")return W(!1);if(H.name==="return"||H.name==="enter")return W(!0);if(H.name==="backspace"){j=Array.from(j).slice(0,-1).join("");return}if(!H.ctrl&&!H.meta&&!H.option&&Array.from(H.sequence).every((Q)=>Q.charCodeAt(0)>=32&&Q.charCodeAt(0)!==127))j=(j+H.sequence).slice(0,4096)},M=(H)=>{H.preventDefault(),H.stopPropagation(),j=(j+Array.from(new TextDecoder().decode(H.bytes)).filter((Q)=>Q.charCodeAt(0)>=32&&Q.charCodeAt(0)!==127).join("")).slice(0,4096)};if(D.renderer.keyInput.prependListener("keypress",K),D.renderer.keyInput.prependListener("paste",M),Z.signal.addEventListener("abort",B,{once:!0}),D.ui.dialog.alert({title:z,message:"Type or paste the value. Input is hidden. Enter accepts; Escape cancels."}).then(()=>W(!1,!1),()=>W(!1,!1)),Z.signal.aborted)B()})}async function U(z){let X={};for(let j of z.knobs){if(!Y)return;if(j.kind==="choice"){let J=await D.ui.dialog.select({title:j.label,options:j.choices.map((q)=>({title:q.label,value:q.value})),current:j.value});if(J===void 0)return;X[j.id]=J}else if(j.kind==="toggle"){let J=await D.ui.dialog.select({title:j.label,options:[{title:"On",value:!0},{title:"Off",value:!1}],current:j.value});if(J===void 0)return;X[j.id]=J}else{let J=j.kind==="text"&&j.masked?await R(j.label):await D.ui.dialog.prompt({title:j.label,value:j.value===void 0?void 0:String(j.value),placeholder:j.kind==="text"?j.placeholder:void 0});if(J===void 0)return;X[j.id]=J===""&&!j.required?null:j.kind==="number"?Number(J):J}}return X}async function C(z){if(O.showSignInLink)try{await O.showSignInLink(D,z,Z.signal);return}catch{}await D.ui.dialog.alert({title:"Claude sign-in",message:`${T}
 
 ${z}
 `})}async function w(z,X){if(!Y||P||$()!==z)return;P=!0;let j=X;try{while(Y&&$()===z){let J=await D.ui.dialog.select({title:j.menu.title,options:j.menu.sections.map((Q)=>({title:Q.title,description:Q.lines.join(`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/opencode-anthropic-auth",
-  "version": "2.2.7",
+  "version": "2.2.8",
   "type": "module",
   "repository": {
     "type": "git",
@@ -77,7 +77,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.6.0",
-    "@cortexkit/anthropic-auth-core": "2.2.7",
+    "@cortexkit/anthropic-auth-core": "2.2.8",
     "@cortexkit/claustrum-client": "0.12.0",
     "@cortexkit/private-files": "0.2.1",
     "@cortexkit/subc-client": "^0.22.0",