@cortexkit/opencode-anthropic-auth 2.4.2 → 2.4.4

package/dist/cli.js

@@ -1,58 +1,58 @@
 #!/usr/bin/env node
-import{y as j3}from"./index-m4dazzyf.js";import{A as r4,B as t4,C as f9,D as x9,E as y9,F as g9,G as e4}from"./index-naff9h33.js";import{ia as h4,ja as LZ,ka as R3}from"./index-71temqvq.js";var l$=LZ((Gq,y4)=>{var d$={to($,Z){if(!Z)return`\x1B[${$+1}G`;return`\x1B[${Z+1};${$+1}H`},move($,Z){let J="";if($<0)J+=`\x1B[${-$}D`;else if($>0)J+=`\x1B[${$}C`;if(Z<0)J+=`\x1B[${-Z}A`;else if(Z>0)J+=`\x1B[${Z}B`;return J},up:($=1)=>`\x1B[${$}A`,down:($=1)=>`\x1B[${$}B`,forward:($=1)=>`\x1B[${$}C`,backward:($=1)=>`\x1B[${$}D`,nextLine:($=1)=>"\x1B[E".repeat($),prevLine:($=1)=>"\x1B[F".repeat($),left:"\x1B[G",hide:"\x1B[?25l",show:"\x1B[?25h",save:"\x1B7",restore:"\x1B8"},CZ={up:($=1)=>"\x1B[S".repeat($),down:($=1)=>"\x1B[T".repeat($)},PZ={screen:"\x1B[2J",up:($=1)=>"\x1B[1J".repeat($),down:($=1)=>"\x1B[J".repeat($),line:"\x1B[2K",lineEnd:"\x1B[K",lineStart:"\x1B[1K",lines($){let Z="";for(let J=0;J<$;J++)Z+=this.line+(J<$-1?d$.up():"");if($)Z+=d$.left;return Z}};y4.exports={cursor:d$,scroll:CZ,erase:PZ,beep:"\x07"}});import{stdin as UJ,stdout as qJ}from"node:process";import{createInterface as KJ}from"node:readline/promises";import{authorize as VJ,createNativeAccountRuntime as FJ,decideOpenCodeStateLayoutOnce as BJ,exchange as jJ,formatNativeAccountState as MJ,generateRelayToken as DJ,getAccountStoragePath as NJ,isValidApiBaseURL as LJ,readNativeEnrollmentMode as CJ,resolveNativePoolPaths as PJ,WORKER_SCRIPT as OJ}from"@cortexkit/anthropic-auth-core";import{randomUUID as y6}from"node:crypto";import{constants as Z3}from"node:fs";import{lstat as g6,mkdir as v6,open as h6}from"node:fs/promises";import{homedir as m6}from"node:os";import{isAbsolute as w6,join as t9}from"node:path";import{types as R$}from"node:util";import{anthropicAuthStateRoot as u6,createProviderErrorRedactor as e9,createWindowsOwnerOnly as c6,ensureWindowsOwnerOnlyDirectory as p6,formatLogLine as d6,HOLDER_REGISTRATION_ERROR_MESSAGES as l6,isOwnerOnly as a6,isSecretKey as s6,isStateLayoutRefusalCode as n6,NativeMigrationError as i6,NativePiAuthSlotError as o6,PRIVATE_FILES_UNAVAILABLE_MESSAGE as $4,RELOCATED_MESSAGE as r6,STATE_LAYOUT_REFUSAL_CODES as t6,STATE_LAYOUT_REFUSAL_PUBLIC_MESSAGES as e6,setupEnrollment as $5,stateLayoutRefusalPublicMessage as Z5}from"@cortexkit/anthropic-auth-core";import{readFile as A6}from"node:fs/promises";import{assertHostsStopped as I6,createNativeAccountRuntime as _6,discoverNativeVaultInventory as R6,inspectNativeHostAuthEntry as C$,NativePiAuthSlotError as S6,nativePiAuthSlotPaths as k6,openNativePiAuthSlot as O$,readNativeEnrollmentMode as T6,requireNoSupervisedAuthContentSnapshot as b6}from"@cortexkit/anthropic-auth-core";import{dirname as e8}from"node:path";import{CLAUSTRUM_OPENCODE_ENROLLMENT_NAME as $6,CLAUSTRUM_PI_ENROLLMENT_NAME as Z6,getHostClaustrumEnrollmentPaths as S9,resolveClaustrumConnectionPath as J6}from"@cortexkit/anthropic-auth-core";import{writeEnrollmentTokenFile as jQ}from"@cortexkit/claustrum-client";import{ClaustrumClient as iG}from"@cortexkit/claustrum-client";import{ClaustrumCredentialError as G7}from"@cortexkit/claustrum-client";import{SocketClosedError as Q7,SocketTimeoutError as W7,SubcCallError as H7}from"@cortexkit/subc-client";class P extends Error{kind;constructor($,Z){super(Z);this.name="ClaustrumConsumerError",this.kind=$}}var P3=Object.freeze({ECONNREFUSED:"unreachable",ENOENT:"unreachable",ECONNRESET:"unreachable",EPIPE:"unreachable",ETIMEDOUT:"unreachable",transport_error:"unreachable",unavailable:"unreachable",timeout:"unreachable",route_closed:"unreachable",daemon_draining:"unreachable",connection_closed:"unreachable",connection_dropped:"unreachable",request_deadline:"unreachable",deadline_exceeded_no_drop_observed:"unreachable",module_reloading:"unreachable",module_warming:"unreachable",target_unavailable:"unreachable",module_timeout:"unreachable",invalid_response:"answered",invalid_record_version:"answered",invalid_expiry:"answered",invalid_status:"answered",invalid_params:"answered",ttl_unsatisfiable:"answered",not_found:"answered",enrollment_revoked:"answered",enrollment_invalid:"answered",grant_denied:"answered",credential_unavailable:"answered",needs_reauth:"answered",declined:"answered",disabled:"answered",identity_changed:"answered",closed:"answered",client_closed:"answered",pending_exists:"answered",pending_queue_full:"answered",already_consumed:"answered",superseded:"answered",stale_generation:"answered",missing_identity:"answered",invalid_control_body:"answered",unknown_module:"answered",module_removed:"answered",capability_denied:"answered",unknown_channel:"unreachable",stale_route_epoch:"unreachable",capability_forbidden:"answered",capability_unprovided:"answered",capability_ambiguous:"answered",invalid_capability_identifier:"answered",binary_body_required:"answered",binary_call_requires_call_binary:"answered",corr_exhausted:"answered",late_route_cleanup_failed:"answered",reverse_request_capability_not_declared:"answered",stale_route_handle:"answered",reverse_request_unhandled:"answered",handler_error:"answered",health_error:"answered",duplicate_module_id:"answered",route_rejected:"answered",lock_busy:"answered",owner_invalid:"answered",renewal_failed:"answered",unsupported_platform:"answered",EACCES:"answered",EPERM:"answered",ERR_PRIVATE_FILES_SECURITY:"answered"});class t extends P{constructor(){super("unavailable","Claustrum scoped operation unavailable");this.name="ClaustrumUnreachableError"}}function N0($){if($ instanceof t||$ instanceof Q7||$ instanceof W7)return"unreachable";let Z=$ instanceof G7||$ instanceof H7?$.code:$ instanceof Error&&("code"in $)?$.code:void 0;if(typeof Z!=="string"||!Object.hasOwn(P3,Z))return"answered";return P3[Z]}import{resolve as e$}from"node:path";import{storeIdentity as cJ}from"@cortexkit/claustrum-client";import{SubcClient as dJ}from"@cortexkit/subc-client";var d0=300000,y1=300000,O3=1000;class V1{#$;#Z=0;restart(){this.#Z=0}continuous($){let Z=$.kind==="changed"&&$.seq===this.#Z+1&&(this.#$===void 0||$.epoch===this.#$);return this.#$=$.epoch,this.#Z=$.seq,Z}}class g1{#$;#Z;#J;#W=!1;constructor($,Z){this.#$=$,this.#Z=Z}get running(){return this.#J}request(){if(this.#J)return this.#W=!0,this.#J;return this.#J=(async()=>{do{this.#W=!1;try{await this.#$()}catch($){this.#Z($)}}while(this.#W)})().finally(()=>{this.#J=void 0}),this.#J}}class v1{#$;#Z=new V1;#J;#W="polling";#G;#Q;#z=!1;#X;#j=!1;#H=0;constructor($){this.#$=$,this.#J=new g1(async()=>{let Z=this.#j;if(this.#j=!1,Z||this.#X!==this.#$.view())await this.#$.discover(this.#X??"")},(Z)=>{if(!this.#z)this.#$.onError?.(Z)})}get mode(){return this.#W}start(){if(this.#z||this.#G||this.#Q)return;if(typeof this.#$.client.watchScoped!=="function"){this.#Y("fallback","client-without-watch");return}this.#F(!1)}stop(){if(this.#z)return;if(this.#z=!0,this.#Q)(this.#$.clearTimeoutImpl??clearTimeout)(this.#Q);this.#Q=void 0;let $=this.#G;this.#G=void 0,$?.handle.stop()}#Y($,Z){if(this.#W===$)return;this.#W=$,this.#$.logger?.debug("claustrum vault watch",{mode:$,reason:Z}),this.#$.onMode?.($)}#q($,Z){this.#Q=(this.#$.setTimeoutImpl??setTimeout)(()=>{if(this.#Q=void 0,!this.#z)Z()},$),this.#Q.unref?.()}async#F($){let Z;try{Z=await this.#$.enrollmentToken()}catch(Q){if(this.#z)return;this.#$.onError?.(Q),this.#M("token-unreadable");return}let J=this.#$.client.watchScoped;if(this.#z||this.#G||!J)return;this.#Z.restart(),this.#j=$;let z,X;try{X=J.call(this.#$.client,(Q)=>{if(this.#z||!z||this.#G!==z)return;if(z.notices++,z.notices===1)this.#$.onReachable?.(),z.acceptedAt=(this.#$.now??Date.now)(),this.#Y("watching","accepted");if(!this.#Z.continuous(Q))this.#j=!0;this.#X=Q.view,this.#J.request()},{enrollmentToken:Z})}catch(Q){this.#$.onError?.(Q),this.#M("watch-failed");return}z={handle:X,notices:0},this.#G=z,this.#Y("polling",$?"resubscribing":"opening");let G=z;X.closed.then((Q)=>this.#U(G,Q),(Q)=>this.#U(G,{kind:"transport_lost",error:Q}))}#U($,Z){if(this.#z||this.#G!==$)return;if(this.#G=void 0,Z.kind==="stopped")return;if(Z.kind==="transport_lost")this.#$.onTransportLost?.();if(Z.kind==="unsupported"){this.#Y("fallback","vault-without-watch");return}if(Z.kind==="refused"){this.#M("refused");try{this.#$.onRefused(Z.error)}catch(J){this.#$.onError?.(J)}return}if($.notices>0){let J=(this.#$.now??Date.now)();if($.acceptedAt!==void 0&&J-$.acceptedAt>=300000)this.#H=0;let z=Math.min(1000*2**Math.min(this.#H,16),300000);this.#H++,this.#Y("polling","resubscribing"),this.#q(z,()=>void this.#F(!0));return}this.#M(Z.kind)}#M($){this.#Y("fallback",$),this.#q(300000,()=>void this.#F(!1))}}var m1=60000,$2=4*m1,Y7=2*m1,A3=new Map,h1=new Map;function F1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function U7($){let Z;try{Z=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode($))}catch{return}if(!F1(Z)||typeof Z.kind!=="string"||typeof Z.epoch!=="string"||Z.epoch.length===0||typeof Z.seq!=="number"||!Number.isSafeInteger(Z.seq)||Z.seq<1||Z.provider!==void 0&&typeof Z.provider!=="string")return;return{kind:Z.kind,epoch:Z.epoch,seq:Z.seq,...typeof Z.provider==="string"&&{provider:Z.provider}}}function q7($){return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:void 0}class Z2{transport;key;#$=[];#Z=!1;#J=new Set;#W=new Map;#G=new g1(async()=>{try{let $=await this.transport.getUsage();if(!F1($)||!Array.isArray($.result)||$.error!==void 0)throw Error("unavailable insula usage");this.#$=$.result.filter((Z)=>F1(Z)&&typeof Z.provider==="string"),this.#Z=this.#$.length===$.result.length&&($.completeProviders===void 0||Array.isArray($.completeProviders)&&$.completeProviders.every((Z)=>typeof Z==="string")),this.#J=new Set(this.#Z&&Array.isArray($.completeProviders)?$.completeProviders:[]);for(let Z of this.#J)this.#W.delete(Z)}catch{this.#$=[],this.#Z=!1,this.#J.clear()}},()=>{});#Q=new V1;#z="polling";#X=0;#j=0;#H=new Map;#Y;#q;#F={};#U=0;constructor($,Z){this.transport=$,this.key=Z}refresh($){if(this.#G.running)return this.#G.running;if(this.#z==="watching")return Promise.resolve();for(let[J,z]of h1)if($-z>=m1)h1.delete(J);let Z=h1.get(this.key);if(Z!==void 0&&$-Z<m1)return Promise.resolve();return h1.set(this.key,$),this.#G.request()}watchMode(){return this.#z}watch($={}){this.#X++;let Z=$.provider;if(Z===void 0)this.#j++;else this.#H.set(Z,(this.#H.get(Z)??0)+1);if(this.#X===1)this.#F=$,this.#N();let J=!1;return()=>{if(J)return;if(J=!0,Z===void 0)this.#j--;else{let z=(this.#H.get(Z)??1)-1;if(z>0)this.#H.set(Z,z);else this.#H.delete(Z)}if(--this.#X===0)this.#M()}}#M(){if(this.#q)(this.#F.clearTimeoutImpl??clearTimeout)(this.#q);this.#q=void 0;let $=this.#Y;this.#Y=void 0,$?.handle?.stop(),this.#z="polling"}#B($){this.#q=(this.#F.setTimeoutImpl??setTimeout)(()=>{if(this.#q=void 0,this.#X>0&&!this.#Y)this.#N()},$),this.#q.unref?.()}#N(){let $=this.transport.watchUsage;if(!$){this.#z="fallback";return}this.#z="polling",this.#Q.restart();let Z={notices:0};this.#Y=Z;let J;try{J=$.call(this.transport,(z)=>this.#_(Z,z))}catch(z){this.#C(Z,z);return}Z.handle=J,J.closed.then(()=>this.#C(Z,void 0),(z)=>this.#C(Z,z))}#_($,Z){if(this.#Y!==$)return;if($.notices++,$.notices===1)this.#z="watching";if($.notices===2)this.#U=0;let J=U7(Z);if(!J)this.#Q.restart();if(!(J?this.#Q.continuous(J):!1)||J?.provider===void 0||this.#j>0||this.#H.has(J.provider))this.#G.request()}#C($,Z){if(this.#Y!==$)return;this.#Y=void 0;let J=q7(Z);if(J==="unknown_method"||J==="usage_watch_limit"){this.#z="fallback";return}if($.notices>0){let z=Math.min(O3*2**Math.min(this.#U,16),y1);this.#U++,this.#z="polling",this.#B(z);return}if(this.#z="fallback",this.#G.request(),Z===void 0||N0(Z)==="unreachable")this.#B(y1)}current($,Z,J){for(let z of this.#$){if(z.provider!==$||typeof z.account!=="string"||z.account.trim()!==Z)continue;if(z.stale!==void 0||z.errorClass!==void 0||!F1(z.usage))continue;let X=typeof z.fetchedAt==="string"?Date.parse(z.fetchedAt):Number.NaN;if(!Number.isFinite(X)||J-X>=$2)continue;return{entry:z,context:{fetchedAt:X,...typeof z.source==="string"&&{source:z.source}}}}return}lookup($,Z,J){if(!this.#Z)return{miss:"unreachable"};let z=this.#$.find((Q)=>Q.provider===$&&typeof Q.account==="string"&&Q.account.trim()===Z),X=(z??this.#$.find((Q)=>Q.provider===$&&Q.account===void 0&&Q.errorClass!==void 0))?.errorClass;if(X==="upstream_failed")return{miss:"upstream-failed"};if(X==="credential_absent"||X==="credential_unusable"||X==="credential_rejected")return{miss:"credential"};if(X!==void 0)return{miss:"unreachable"};if(z){let Q=typeof z.fetchedAt==="string"?Date.parse(z.fetchedAt):Number.NaN;if(!F1(z.usage)||!Number.isFinite(Q))return{miss:"unreachable"};let W={entry:z,context:{fetchedAt:Q,...typeof z.source==="string"&&{source:z.source}}};return J>=Q+$2||z.stale!==void 0?{miss:"stale",reading:W}:{reading:W}}if(this.#J.has($))return{miss:"absent"};let G=this.#W.get($)??J;return this.#W.set($,G),{miss:J-G>=Y7?"unreachable":"cold"}}}function I3($,Z){let J=JSON.stringify([e$($.connectionFile),e$(Z)]),z=A3.get(J);if(!z)z={source:new Z2($,J),refs:0},A3.set(J,z);z.refs++;let X=!1;return{source:z.source,release(){if(X)return;if(X=!0,--z.refs===0)A3.delete(J)}}}import{ClaustrumCredentialError as $Q}from"@cortexkit/claustrum-client";import{appendFileSync as A7,chmodSync as I7,existsSync as k3,renameSync as K2,statSync as _7}from"node:fs";import{open as R7}from"node:fs/promises";import{dirname as S7,resolve as k7}from"node:path";import{randomUUID as G2}from"node:crypto";import{lstat as Q2,readFile as W2,rename as K7,unlink as J2}from"node:fs/promises";import{tmpdir as V7}from"node:os";import{dirname as L0,join as F7,resolve as e}from"node:path";var I=process.platform==="win32",z2=new Set;function _3($){if($?.reason==="io-error"){if($.win32Code===2||$.win32Code===3)return"ENOENT";if($.win32Code===80||$.win32Code===183)return"EEXIST"}return $?.code??"ERR_PRIVATE_FILE"}var X2;var H2="native-addon-unavailable";function Y2($){return Object.assign(Error("Windows private-files native addon is unavailable",{cause:$}),{code:"ERR_PRIVATE_FILES_UNAVAILABLE",reason:H2})}function B7($,Z){return Z instanceof $.PrivateFilesUnavailableError||Z?.code==="ERR_PRIVATE_FILES_UNAVAILABLE"}async function j7($){try{await $.verifyPrivatePath(F7(V7(),`.common-auth-private-files-probe-${G2()}`),"file")}catch(Z){if(B7($,Z))throw Y2(Z)}}function l0(){return X2??=import("@cortexkit/private-files").then(async($)=>{if(I)await j7($);return $},($)=>{throw I?Y2($):$}),X2}class m extends Error{path;stage;code;win32Code;reason;published=!1;durabilityConfirmed=!1;fileDurable=!1;attempts=0;elapsedMs=0;orphanPath;constructor($,Z,J){let z=J;super(z?.code==="ERR_PRIVATE_FILES_UNAVAILABLE"?`Private file refused at ${Z}: ${$} (${H2}). The Windows native addon of @cortexkit/private-files could not be loaded, so owner-only access cannot be enforced and nothing was read or written. Reinstall the plugin so the private-files Windows prebuild for this architecture is present; Windows has no safe fallback to permission bits.`:`Private file refused at ${Z}: ${$} (${z?.reason??z?.code??"io-error"}). Keep this file in a folder that only you, the system or administrators can change, such as a folder in your home directory. If other users could read the file before, sign in again to replace the credentials it held. On Windows the file must also be on a local drive that keeps Windows file permissions, such as NTFS.`,{cause:J});this.path=$,this.stage=Z,this.name="PrivateFileError",this.code=_3(z),this.win32Code=z?.win32Code,this.reason=z?.reason}}async function o($,Z,J){try{return await J()}catch(z){if(z instanceof m)throw z;throw new m($,Z,z)}}var M7;async function V0($,Z){$=e($),Z??=M7,await o($,"safe-parent",async()=>{let J=await(await l0()).verifySafeParent($,Z);if(J.ok===!1){if(J.reason==="io-error"||J.reason==="wrong-kind")await Q2($);throw new m(J.level??J.path,"safe-parent",{...J,code:"ERR_PRIVATE_FILES_SECURITY"})}})}async function d($,Z,J=!1){if($=e($),Z==="directory")return V0($);await o($,"verify",async()=>{let z=await l0(),X=await z.verifyOwnerOnly($),G=!1;if(!X.ok){let{reason:Q}=X.refusal;if(Q==="io-error")await z.verifyPrivatePath($,Z);if(J&&[z.EXTRA_ACE,z.NOT_PROTECTED,z.NULL_DACL,z.EMPTY_DACL].includes(Q))await V0(L0($)),await z.securePrivatePath($,Z),G=!0;else throw Object.assign(Error("Owner-only verification refused"),{reason:Q,code:"ERR_PRIVATE_FILES_SECURITY"})}if(await z.verifyPrivatePath($,Z),G&&!z2.has($))z2.add($),process.emitWarning(`Private permissions tightened: ${$}. This object may have been readable before; rotate credentials if needed.`,"PrivateFileMigration")})}async function W0($,Z=!1,J){$=e($),await o($,"directory",async()=>{let z=await l0();try{return await Q2($),await V0($,J)}catch(G){if(_3(G)!=="ENOENT")throw G}let X=L0($);if(X===$)throw Object.assign(Error("Missing root"),{code:"ENOENT"});await W0(X,!1,J);try{await z.createOwnerOnly($,{kind:"dir"})}catch(G){if(_3(G)!=="EEXIST")throw G}await V0($,J)})}async function J0($,Z=!1){if(!I)return W2($,"utf8");return(await D7($,Z)).toString("utf8")}async function D7($,Z=!1){if(!I)return W2($);if($=e($),Z)await V0(L0($)),await d($,"file",!0);return o($,"read",async()=>(await l0()).readOwnerOnly($))}async function a0($,Z){await V0(L0(e($))),await o($,"create",async()=>{await(await l0()).createPrivateFile(e($),Z)})}async function U2($){await V0(L0(e($))),await o($,"directory-create",async()=>{await(await l0()).createOwnerOnly(e($),{kind:"dir"})})}async function S3($,Z,J={}){$=e($),Z=e(Z);let z=J.now??(()=>performance.now()),X=z(),G=J.deadline??1/0,Q,W=[0,10,20,40,80,100],H,U=0;for(let K of W){let M=Math.min(Q??1/0,G);if(z()>=M)break;if(K)await(J.sleep??((D)=>new Promise((L)=>setTimeout(L,D))))(Math.min(K,Math.max(0,M-z())));if(z()>=M)break;let F=z();if(await J.beforeRename?.(),Q!==void 0)Q+=z()-F;if(z()>=G)break;U++;try{return await(J.rename??K7)($,Z),{attempts:U,elapsedMs:z()-X}}catch(D){H??=D;let L=D;if(!(L.win32Code!==void 0?L.win32Code===32||L.win32Code===33:["EBUSY","EPERM","EACCES"].includes(L.code??"")&&!L.reason))break;Q??=z()+500}}let Y=new m(Z,"rename",H??Object.assign(Error("Publication deadline expired"),{code:"ETIMEDOUT"}));throw Y.attempts=U,Y.elapsedMs=z()-X,Y}async function s0($,Z,J={}){$=e($),await W0(L0($));try{await d($,"file",!0)}catch(U){if(U.code!=="ENOENT")throw U}let z=e(J.stagePath??`${$}.${G2()}.tmp`);if(L0(z)!==L0($))throw new m($,"stage-directory",{code:"EXDEV"});let X=!1,G=!1,Q={attempts:0,elapsedMs:0},W="stage-create",H=(U)=>{try{J.onOutcome?.({path:$,stage:U?.stage??"published",published:G,fileDurable:G,durabilityConfirmed:!1,attempts:U?.attempts??Q.attempts,elapsedMs:U?.elapsedMs??Q.elapsedMs,...U&&{code:U.code,win32Code:U.win32Code}})}catch{}};try{if(await a0(z,Z),X=!0,W="before-rename",Q=await S3(z,$,J),X=!1,G=!0,W="published-callback",J.onRenamed?.(),W="published-verify",await d($,"file"),J.durable&&J.durability!=="file-only-on-windows")throw new m($,"directory-sync-unsupported",{code:"ENOTSUP"});H()}catch(U){let Y=U instanceof m?U:new m($,W,U);if(Y.published=G,Y.fileDurable=G,G)Object.assign(Y,Q);if(X){try{await J2(z)}catch{Y.orphanPath=z}X=!1}throw H(Y),Y}finally{if(X)await J2(z).catch(()=>{})}}var N7=/^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i,L7=/\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g;function C7($){return $ instanceof Error||Object.prototype.toString.call($)==="[object Error]"}function n0($={}){let Z=[L7,...$.extraValuePatterns??[]].map((G)=>new RegExp(G.source,G.flags.includes("g")?G.flags:`${G.flags}g`));function J(G){let Q=G.toLowerCase().replace(/[-_]/g,"");return N7.test(G)||Q.includes("apikey")||Q.endsWith("secret")||Q.endsWith("password")||Q.endsWith("token")&&!Q.endsWith("tokens")||!!$.extraSecretKeys?.(Q)}function z(G){let Q=G,W=[["name",G.name],["message",G.message],["stack",G.stack]];for(let U of["code","status","cause"])if(Q[U]!==void 0)W.push([U,Q[U]]);let H=new Set(W.map(([U])=>U));for(let U of Object.entries(G))if(!H.has(U[0]))W.push(U);return W}function X(G,Q,W,H=0){if(typeof G==="string")return Z.reduce((U,Y)=>U.replace(Y,"***REDACTED***"),G);if(!G||typeof G!=="object")return G;if(W.has(G))return"[Circular]";W.add(G);try{if(Array.isArray(G))return G.map((K)=>X(K,Q,W,H));let U=C7(G);if(U&&H>=8)return"[Truncated]";let Y=U?H+1:H;return Object.fromEntries((U?z(G):Object.entries(G)).map(([K,M])=>[K,Q&&J(K)?"***REDACTED***":X(M,Q,W,Y)]))}finally{W.delete(G)}}return{redact:(G)=>X(G,!0,new WeakSet),redactStrings:(G)=>X(G,!1,new WeakSet)}}var q2=n0(),P7=q2.redact,O7=q2.redactStrings;var w1={error:0,warn:1,info:2,debug:3,trace:4},F2=5242880,B2=3;function T3($){try{I7($,384)}catch{}}function T7($){try{if(!(k3($)&&_7($).size>=F2))return;for(let J=B2-1;J>=1;J--)if(k3(`${$}.${J}`)){let z=`${$}.${J+1}`;K2(`${$}.${J}`,z),T3(z)}let Z=`${$}.1`;K2($,Z),T3(Z)}catch{}}async function F0($){let{file:Z,handle:J}=$;if($.file=void 0,$.handle=void 0,Z&&J)await o(Z,"log-close",()=>J.close())}async function V2($,Z){await W0(S7(Z));try{await d(Z,"file",!0)}catch(J){if(J.code!=="ENOENT")throw J;try{await a0(Z,"")}catch(z){if(z.code!=="EEXIST")throw z;await d(Z,"file",!0)}}return $.handle=await o(Z,"log-open",()=>R7(Z,"a")),$.file=Z,$.handle}async function b7($,Z,J){Z=k7(Z);try{if($.file!==Z)await F0($);let z=$.handle??await V2($,Z);if((await o(Z,"log-stat",()=>z.stat())).size>=F2){await F0($);for(let G=B2-1;G>=0;G--){let Q=G===0?Z:`${Z}.${G}`,W=`${Z}.${G+1}`;try{await d(Q,"file",!0)}catch(H){if(H.code==="ENOENT")continue;throw H}try{await d(W,"file",!0)}catch(H){if(H.code!=="ENOENT")throw H}await S3(Q,W),await d(W,"file")}z=await V2($,Z)}await o(Z,"log-append",()=>z.appendFile(J,"utf8"))}catch(z){throw await F0($).catch(()=>{}),z}}function E7($){try{return` ${JSON.stringify($)}`}catch{return" [unserializable]"}}function f7($){let Z,J,z,X=n0(),G,Q=[],W,H=Promise.resolve(),U,Y={};function K(V){let q=H.then(V);return H=q.catch((B)=>{U=B}),q}function M(V){if(I&&V.file!==Z)K(()=>F0(Y)).catch(()=>{});Z=V.file,J=V.level,X=n0(V),G=V.captureSink}function F(V){if(V===void 0||V in w1)z=V}function D(){if(Z===void 0)return;return(typeof Z==="function"?Z():Z)||void 0}function L(){if(z)return z;let V=typeof J==="function"?J():J;if(V&&V in w1)return V;return"info"}function O(V=!0){if(W)clearTimeout(W),W=void 0;if(!Q.length){if(I)return K(async()=>{if(V)await F0(Y);if(U)throw U});return}let q;try{q=D()}catch{if(Q=[],I&&V)return K(()=>F0(Y));return}let B=Q.join("");if(Q=[],!q){if(I&&V)return K(()=>F0(Y));return}if(I)return K(async()=>{try{await b7(Y,q,B)}finally{if(V)await F0(Y)}});try{if(T7(q),k3(q))T3(q);A7(q,B,{encoding:"utf8",mode:384})}catch{}}function _(){if(!W)W=setTimeout(()=>{W=void 0;let V=O(!1);if(V instanceof Promise)V.catch(()=>{})},500)}function R(V,q,B,N){if(Z===void 0&&G===void 0)return;try{if(w1[q]>w1[L()])return;let x=X.redactStrings(B),k;try{k=X.redact(N)}catch{k="[unserializable]"}let y=`[${new Date().toISOString()}] ${q.toUpperCase()} [${V}] ${x}`+(N===void 0?"":E7(k))+`
-`;try{G?.({channel:V,level:q,message:x,data:k})}catch{}if(Z===void 0)return;if(Q.push(y),Q.length>=50){let Z0=O(!1);if(Z0 instanceof Promise)Z0.catch(()=>{})}else _()}catch{}}function v(V){return{error:(q,B)=>R(V,"error",q,B),warn:(q,B)=>R(V,"warn",q,B),info:(q,B)=>R(V,"info",q,B),debug:(q,B)=>R(V,"debug",q,B),trace:(q,B)=>R(V,"trace",q,B)}}function h(){if(I)K(()=>F0(Y)).catch(()=>{});if(U=void 0,Q=[],W)clearTimeout(W),W=void 0;Z=void 0,J=void 0,z=void 0,X=n0(),G=void 0}if($)M($);return{configure:M,createLogger:v,setLogLevel:F,flushLogs:O,reset:h}}var x7=f7();function H0($){return x7.createLogger($)}function R0($){let Z=new AbortController,J=[],z=!1,X=()=>{if(z)return;z=!0;for(let{source:W,listener:H}of J)W.removeEventListener("abort",H);J.length=0},G=(W)=>{if(z||Z.signal.aborted)return;Z.abort(W),X()},Q=$.find((W)=>W.aborted);if(Q)return Z.abort(Q.reason),{signal:Z.signal,dispose:X};for(let W of $){if(Z.signal.aborted)break;let H=()=>G(W.reason);if(J.push({source:W,listener:H}),W.addEventListener("abort",H,{once:!0}),W.aborted)G(W.reason)}return{signal:Z.signal,dispose:X}}import{ClaustrumCredentialError as l2}from"@cortexkit/claustrum-client";import{createHash as a7,randomBytes as s7,randomUUID as n7}from"node:crypto";import{constants as S2}from"node:fs";import{chmod as i7,mkdir as o7,open as E2,readFile as f3,realpath as r7,rename as t7,stat as f2,unlink as y3}from"node:fs/promises";import{basename as e7,dirname as k0,extname as az,isAbsolute as sz,join as $8,resolve as nz}from"node:path";import{ClaustrumCredentialError as Z8,ClaustrumClient as oz,writeEnrollmentTokenFile as J8}from"@cortexkit/claustrum-client";import{lstat as y7}from"node:fs/promises";import{resolve as g7}from"node:path";async function v7($){try{let Z=await y7($);return Z.isFile()?Z:void 0}catch(Z){return Z.code==="ENOENT"?"absent":void 0}}function h7($,Z){if($==="absent"||Z==="absent")return $===Z;return $.dev===Z.dev&&$.ino===Z.ino&&$.size===Z.size&&$.mtimeMs===Z.mtimeMs&&$.ctimeMs===Z.ctimeMs}class B1{#$=new Map;async read($,Z,J){let z=$.map((U)=>g7(U)),X=JSON.stringify(z),G=await Promise.all(z.map(v7)),Q=G.every((U)=>U!==void 0)?G:void 0,W=this.#$.get(X);if(Q&&W&&Q.every((U,Y)=>{let K=W.identities[Y];return K!==void 0&&h7(U,K)}))return J?.(Q),W.value;this.#$.delete(X);let H=await Z(z);if(Q){if(this.#$.size>=64){let U=this.#$.keys().next().value;if(U!==void 0)this.#$.delete(U)}this.#$.set(X,{identities:Q,value:H})}return H}}import{randomUUID as j2}from"node:crypto";import{mkdir as m7,open as M2,rename as w7,rm as u7}from"node:fs/promises";import{dirname as D2}from"node:path";class u1 extends Error{constructor($){super("file or directory sync failed",{cause:$});this.name="AtomicSyncError"}}async function j1($,Z,J={}){await N2($,Z,J)}async function N2($,Z,J,z){if(I)return s0($,J.serialize?J.serialize(Z):`${JSON.stringify(Z,null,2)}
-`,{beforeRename:J.beforeRename,stagePath:`${$}.${(J.stageName??j2)()}.tmp`,onRenamed:z,durable:J.durable,durability:J.durability,onOutcome:J.onOutcome});await m7(D2($),{recursive:!0});let X=`${$}.${(J.stageName??j2)()}.tmp`,G,Q=!1;try{if(G=await M2(X,"wx",384),Q=!0,await G.writeFile(J.serialize?J.serialize(Z):`${JSON.stringify(Z,null,2)}
-`,"utf8"),await G.chmod(384),J.durable)try{await G.sync()}catch(W){throw new u1(W)}if(await G.close(),G=void 0,await J.beforeRename?.(),await w7(X,$),Q=!1,z?.(),J.durable){let W=await M2(D2($),"r");try{await W.sync()}catch(H){throw new u1(H)}finally{await W.close()}}}finally{if(await G?.close().catch(()=>{}),Q)await u7(X,{force:!0}).catch(()=>{})}}var c7=Object.freeze({sidebar:Object.freeze({name:"sidebar-write",ttlMs:1e4,timeoutMs:15000,renew:!0}),preferences:Object.freeze({name:"preferences",ttlMs:1e4,timeoutMs:2000,renew:!0})});import{randomUUID as c1}from"node:crypto";import{mkdir as L2,open as _2,readFile as C2,rename as P2,rm as p1,stat as O2}from"node:fs/promises";import{dirname as E3,join as A2}from"node:path";function M1($,Z){return`${$}.${Z}.lock`}class C0 extends Error{details;constructor($){super(`Timed out acquiring ${$.name} lock for ${$.target}`);this.name="LockContentionError",this.details=$}}class B0 extends Error{details;constructor($){super(`Lost ${$.name} lock for ${$.target}`);this.name="LockOwnershipError",this.details=$}}async function b3($,Z,J){let z=performance.now();for(;;){Z.signal?.throwIfAborted();let X=await j0({path:$,name:Z.name,ttlMs:Z.ttlMs,renew:Z.renew??!1,...Z.onStep?{onStep:Z.onStep}:{},...Z.onRenewalTimer?{onRenewalTimer:Z.onRenewalTimer}:{}});if(X)try{return Z.signal?.throwIfAborted(),await J(X)}finally{await X.release()}let G=Z.timeoutMs-(performance.now()-z);if(G<=0)throw new C0({target:$,name:Z.name,timeoutMs:Z.timeoutMs});await new Promise((Q)=>setTimeout(Q,Math.min(25,Math.ceil(G))))}}async function I2($,Z){let J=await _2($,"wx",384);try{await J.writeFile(Z,"utf8")}finally{await J.close()}}var p7=globalThis.setTimeout.bind(globalThis),d7=globalThis.clearTimeout.bind(globalThis);function R2($){let Z=$?.code;return Z==="ENOENT"||!I&&(Z==="EINVAL"||Z==="ENOTDIR")}function j0($){return l7({...$,now:Date.now})}async function l7($){let Z=M1($.path,$.name),J=A2(Z,"owner.json"),z=c1(),X=$.now??Date.now,G=null,Q=!1,W=!1,H,U,Y=new Promise((j)=>{U=j});function K(j){try{let C=$.onRenewalTimer?.(j);if(C&&(typeof C==="object"||typeof C==="function")&&"then"in C&&typeof C.then==="function")Promise.resolve(C).catch(()=>{})}catch{}}function M(){if(!G)return;d7(G),G=null,K("cancelled")}function F(j,C){if(H||Q)return;H=Object.freeze({reason:j,expectedOwnerId:z,...typeof C?.ownerId==="string"?{observedOwnerId:C.ownerId}:{},...typeof C?.expiresAt==="number"?{observedExpiresAt:C.expiresAt}:{}}),M(),U(H)}let D,L=null,O=`${Z}.evicting`,_=A2(O,"owner.json"),R=c1(),v=5000,h=8;async function V(){if(I)try{return JSON.parse(await J0(Z,!0))}catch(j){if(j.code!=="EISDIR"&&j.reason!=="wrong-kind")throw j;return await d(Z,"directory",!0),JSON.parse(await J0(J,!0))}try{return JSON.parse(await C2(Z,"utf8"))}catch(j){if(j.code!=="EISDIR")throw j;return JSON.parse(await C2(J,"utf8"))}}async function q(){if(I){let g=await V(),u=Number(g?.expiresAt)-X();await s0(Z,`${JSON.stringify({ownerId:z,expiresAt:X()+$.ttlMs})}
-`,{deadline:performance.now()+Math.max(0,u),beforeRename:async()=>{let x1=await V();if(x1?.ownerId!==z||!(Number(x1?.expiresAt)>X())||!await p())throw new B0({target:$.path,name:$.name})}});return}let j=`${Z}.${c1()}.tmp`,C,A=!1;try{C=await _2(j,"wx",384),A=!0,await C.writeFile(`${JSON.stringify({ownerId:z,expiresAt:X()+$.ttlMs})}
-`,"utf8"),await C.chmod(384),await C.close(),C=void 0;let g=await V();if(g?.ownerId!==z||!(Number(g?.expiresAt)>X())||!await p())throw new B0({target:$.path,name:$.name});await P2(j,Z),A=!1}finally{if(await C?.close().catch(()=>{}),A)await p1(j,{force:!0}).catch(()=>{})}}async function B(){let j=`${JSON.stringify({ownerId:z,expiresAt:X()+$.ttlMs})}
-`;if(I)await a0(Z,j);else await I2(Z,j)}async function N(j){let C=j.code;if(C!=="EEXIST"&&C!=="EISDIR")return!1;if(I){if($.onStep)await $.onStep("lease-contention-read-ready");try{if(C==="EISDIR")await d(Z,"directory",!0),await J0(J,!0);else await V()}catch(A){if(A.code!=="ENOENT")throw A}}return!0}async function x(){if(I)await W0(E3(Z));try{return await B(),!0}catch(j){let C=j.code;if(await N(j))return!1;if(C==="ENOENT"){if(I)await W0(E3(Z));else await L2(E3(Z),{recursive:!0});try{return await B(),!0}catch(A){if(await N(A))return!1;throw A}}throw j}}async function k(){await new Promise((j)=>setTimeout(j,Math.floor(Math.random()*4)))}async function y(j=!0){if(j&&$.onStep)await $.onStep("lock-read-ready");let C;try{C=await V()}catch(g){if(I&&g.code!=="ENOENT")throw g}let A=Number(C?.expiresAt);if(Number.isFinite(A)&&A>X())return{status:"live"};if(typeof C?.ownerId==="string"&&Number.isFinite(A))return{status:"stale",identity:{kind:"owner",ownerId:C.ownerId,expiresAt:A}};try{let g=await O2(Z),u=Number.isFinite(A)?A:g.mtimeMs+$.ttlMs;if(u>X())return{status:"live"};return{status:"stale",identity:{kind:"stat",dev:g.dev,ino:g.ino,mtimeMs:g.mtimeMs,expiresAt:u}}}catch(g){if(g.code==="ENOENT"){if($.onStep)await $.onStep("lock-missing");return{status:"missing"}}throw g}}function Z0(j,C){if(C.status!=="stale")return!1;let A=C.identity;if(j.kind==="owner"&&A.kind==="owner")return j.ownerId===A.ownerId&&j.expiresAt===A.expiresAt;return j.kind==="stat"&&A.kind==="stat"&&j.dev===A.dev&&j.ino===A.ino&&j.mtimeMs===A.mtimeMs&&j.expiresAt===A.expiresAt}async function p(){try{return JSON.parse(await J0(_,I))?.ownerId===R}catch(j){if(I&&j.code!=="ENOENT")throw j;return!1}}async function c(j){if(I)await o(j,"remove",()=>p1(j,{recursive:!0,force:!0}));else await p1(j,{recursive:!0,force:!0}).catch(()=>{})}async function a(){if(await p())await c(O)}async function Q0(){if(I)await U2(O);else await L2(O);try{let j=`${JSON.stringify({ownerId:R,createdAt:X()})}
-`;if(I)await a0(_,j);else await I2(_,j)}catch(j){if(R2(j))return!1;throw await a(),j}if($.onStep)await $.onStep("eviction-marker-acquired");return!0}async function E1(){let j;try{j=await O2(O)}catch(A){if(A.code==="ENOENT")return"missing";throw A}if(I)try{await d(O,"directory",!0)}catch(A){if(A.code==="ENOENT")return"missing";throw A}if(j.mtimeMs+v>X())return"fresh";if($.onStep)await $.onStep("stale-marker-stat");let C=`${O}.${c1()}`;try{await P2(O,C)}catch(A){if(A.code==="ENOENT")return"missing";throw A}if($.onStep)await $.onStep("stale-marker-claimed");return await c(C),"recovered"}async function c0(j){try{if(!await Q0())return!1}catch(C){if(C.code==="EEXIST"){if(I)try{await d(O,"directory",!0),await J0(_,!0)}catch(A){if(A.code!=="ENOENT")throw A}return!1}throw C}try{await j()}finally{await a()}return!0}async function f1(){for(let j=0;j<h;j++){if($.onStep)await $.onStep("relinquish-read");let C;try{C=await V()}catch(A){if(I)throw A;return}if(C?.ownerId!==z)return;try{await p1(Z,{recursive:!0,force:!0});return}catch(A){if(I)throw A;await k()}}}function p0(){if(!$.renew||Q||H)return;let j=$.renewIntervalMs??Math.max(1000,Math.floor($.ttlMs/3));if(G=p7(()=>{G=null;let C=(async()=>{let A=!Q;try{if(!await c0(async()=>{let u=await V(),x1=X();if(Q||H){A=!1;return}if(u?.ownerId!==z){F("taken-over",u),A=!1;return}if(!(Number(u?.expiresAt)>x1)){F("expired",u),A=!1;return}if($.onStep)await $.onStep("renewal-owner-confirmed");if(Q||H){A=!1;return}if(!await p())return;if($.onStep)await $.onStep("renewal-write-fenced");if(Q||H){A=!1;return}if(!await p())return;if($.onStep)await $.onStep("renewal-write-ready");if(Q||H){A=!1;return}if(await q(),$.onStep)await $.onStep("renewal-write-finished");if(!await p()){F("marker-lost"),A=!1,await f1();return}})&&$.onStep)await $.onStep("renewal-marker-unavailable")}catch(g){if(I&&g instanceof m)D=g,F("renewal-failed"),A=!1;try{let u=await V();if(u?.ownerId!==z)F("taken-over",u);else if(!(Number(u?.expiresAt)>X()))F("expired",u)}catch{F("renewal-failed")}}finally{if($.onStep)try{await $.onStep("renewal-finished")}catch{}if(A&&!Q&&!H)p0()}})();L=C,C.finally(()=>{if(L===C)L=null})},j),"unref"in G)G.unref();K("scheduled")}function T(){try{let j=$.onContended?.();if(j&&(typeof j==="object"||typeof j==="function")&&"then"in j&&typeof j.then==="function")Promise.resolve(j).catch(()=>{})}catch{}return null}let s=await x();if(!s)for(let j=0;j<h;j++){if(s=await x(),s)break;let C=await y();if(C.status==="live")return T();if(C.status==="missing")continue;if($.onStep)await $.onStep("stale-lock-observed");try{if(!await Q0()){await k();continue}}catch(A){if(A.code!=="EEXIST")throw A;if(await E1()==="fresh")return null;await k();continue}try{let A=await y();if(A.status==="live")return T();if(!Z0(C.identity,A))continue;if(!await p())return null;if($.onStep)await $.onStep("stale-lock-confirmed");if(!await p())return null;let g=await y(!1);if(!Z0(C.identity,g))continue;if(await c(Z),!await p())return null;if($.onStep)await $.onStep("stale-lock-removed");if(s=await x(),!s)return null;if($.onStep)await $.onStep("stale-lock-recreated");if(!await p())return await f1(),s=!1,null;break}finally{await a()}}if(!s)return null;return p0(),{ownerId:z,whenLost:()=>Y,hasLost:()=>H!==void 0,assertOwned:async()=>{if(D)throw D;let j;try{let C=await V();if(j=C,!Q&&!H&&C?.ownerId===z&&Number(C?.expiresAt)>X())return;F(C?.ownerId!==z?"taken-over":"expired",C)}catch(C){if(F("unreadable"),I&&C instanceof m)throw C}throw new B0({target:$.path,name:$.name,expectedOwnerId:z,...typeof j?.ownerId==="string"?{observedOwnerId:j.ownerId}:{},...typeof j?.expiresAt==="number"?{observedExpiresAt:j.expiresAt}:{}})},release:async()=>{if(I&&W)return;Q=!0,M(),await L;for(let j=0;j<h;j++){try{let C=!1;if(await c0(async()=>{let g;try{g=await V()}catch(u){if(I&&u.code==="ENOENT"){C=!0;return}throw u}if(g?.ownerId!==z){C=!0;return}if($.onStep)await $.onStep("release-owner-confirmed");if(!await p())return;await c(Z),C=!0})){if(I&&!C)throw new m(Z,"release-not-confirmed",{code:"EIO"});W=C;return}await E1()}catch(C){if(I)throw C;return}await k()}if(I)throw new m(Z,"release-not-confirmed",{code:"ETIMEDOUT"})}}}var z8=1,l1=16384,x2=30000,g3=/^[0-9a-f]{64}$/,y2="unknown_method",g2=new Set([y2,"invalid_params","pending_exists","not_found","already_consumed","superseded","stale_generation"]),v2=new Set(["pending_queue_full"]);function x3($){if(!($ instanceof Z8))return;if(g2.has($.code))return{code:$.code,disposition:"terminal"};if(v2.has($.code))return{code:$.code,disposition:"retry"};return{code:$.code,disposition:$.action==="retry"?"retry":"terminal"}}function h2($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function d1($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0}function m2($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=1}function D1(){return new P("invalid-state","invalid Claustrum enrollment state")}function v3($){if(!h2($)||$.version!==z8||typeof $.proposedName!=="string"||$.proposedName.length===0)throw D1();if($.phase==="pending"){if(!g3.test(String($.requestSecret??""))||$.requestId!==void 0&&(typeof $.requestId!=="string"||$.requestId.length===0)||!d1($.createdAt)||!d1($.updatedAt))throw D1();return{version:1,phase:"pending",proposedName:$.proposedName,requestSecret:$.requestSecret,...$.requestId!==void 0&&{requestId:$.requestId},createdAt:$.createdAt,updatedAt:$.updatedAt}}if($.phase==="approved"){if($.approvedName!==void 0&&(typeof $.approvedName!=="string"||$.approvedName.length===0)||!m2($.tokenGeneration)||!d1($.updatedAt))throw D1();return{version:1,phase:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration,updatedAt:$.updatedAt}}if($.phase==="denied"||$.phase==="blocked"){if($.errorCode!==void 0&&typeof $.errorCode!=="string"||!d1($.updatedAt))throw D1();return{version:1,phase:$.phase,proposedName:$.proposedName,...$.errorCode!==void 0&&{errorCode:$.errorCode},updatedAt:$.updatedAt}}throw D1()}function h3($){if(!h2($)||!g3.test(String($.token??""))||!m2($.token_generation))throw new P("invalid-token","invalid Claustrum enrollment token file");return{token:$.token,token_generation:$.token_generation}}function w2($){if(!$.isFile())throw new P("unsafe-file","Claustrum enrollment file must be a regular file");if(($.mode&63)!==0)throw new P("unsafe-file","Claustrum enrollment file must be owner-only");let Z=process.geteuid?.();if(Z!==void 0&&$.uid!==Z)throw new P("unsafe-file","Claustrum enrollment file must be owned by the current user")}function k2($){try{return JSON.parse($)}catch{throw new P("invalid-state","Claustrum enrollment file is not valid JSON")}}async function T0($){if(I)try{await W0(k0($));let J=await J0($,!0);if(Buffer.byteLength(J)>l1)throw new P("unsafe-file","Claustrum enrollment file is too large");return k2(J)}catch(J){if(J.code==="ENOENT")return;throw J}let Z;try{Z=await E2($,S2.O_RDONLY|S2.O_NOFOLLOW)}catch(J){if(J.code==="ENOENT")return;throw new P("unsafe-file","Claustrum enrollment file could not be opened safely")}try{w2(await Z.stat());let J=Buffer.alloc(l1+1),{bytesRead:z}=await Z.read(J,0,J.byteLength,0);if(z>l1)throw new P("unsafe-file","Claustrum enrollment file is too large");return k2(J.subarray(0,z).toString("utf8"))}finally{await Z.close()}}function T2($,Z){let J=[];for(let z of $.split(`
-`)){if(z.trim()===""||z.startsWith("#"))continue;let X=z.split(":");if(X.length!==Z||!/^[^\s:,]+$/.test(X[0]??"")||!/^\d+$/.test(X[2]??"")||!Number.isSafeInteger(Number(X[2]))||Z===7&&(!/^\d+$/.test(X[3]??"")||!Number.isSafeInteger(Number(X[3])))||Z===4&&X[3]!==""&&!/^[^\s:,]+(?:,[^\s:,]+)*$/.test(X[3]??""))return;J.push(X)}return J}async function X8($,Z,J){try{let[z,X]=await Promise.all([f3(J.passwdPath??"/etc/passwd","utf8"),f3(J.groupPath??"/etc/group","utf8")]),G=T2(z,7),Q=T2(X,4);if(!G||!Q)return!1;let W=G.filter((K)=>Number(K[2])===$),H=Q.filter((K)=>Number(K[2])===Z);if(W.length!==1||H.length!==1)return!1;let U=W[0]?.[0],Y=H[0]?.[3]??"";return(Y===""||Y.split(",").every((K)=>K===U))&&!G.some((K)=>Number(K[2])!==$&&Number(K[3])===Z)}catch{return!1}}function u2($){if(!$.passwdPath&&!$.groupPath)return;return{fs:{readFile:(Z)=>f3(Z==="/etc/passwd"?$.passwdPath??Z:Z==="/etc/group"?$.groupPath??Z:Z)}}}async function c2($,Z={}){if(!I){let J=process.geteuid?.();if(J===void 0)return;let z=process.getegid?.(),X;try{X=await r7($)}catch{return}let G;for(;;){let Q=await f2(X).catch(()=>{return});if(Q&&(Q.mode&18)!==0&&(Q.mode&512)===0){if(G===void 0)G=z!==void 0&&await X8(J,z,Z);if((Q.mode&2)!==0||Q.uid!==J||Q.gid!==z||!G)throw new P("unsafe-file",`Claustrum enrollment path has a writable ancestor: ${X}. Another user could replace it. Run: chmod g-w,o-w ${X}`)}let W=k0(X);if(W===X)return;X=W}}try{await V0($,u2(Z))}catch(J){if(!(J instanceof m))throw J;throw new P("unsafe-file",`Claustrum enrollment parent refused: ${J.path} (${J.reason??J.code}). Use a folder that other users cannot write or replace.`)}}async function i0($,Z={},J="enrollment directory"){if(I){await W0($,!1,u2(Z));return}await o7($,{recursive:!0,mode:448});let z=await f2($),X=process.geteuid?.();if(X!==void 0&&z.uid!==X)throw new P("unsafe-file",`Claustrum ${J} must be owned by the current user`);if((z.mode&63)!==0)await i7($,448)}async function S0($,Z,J={}){let z=k0($);await i0(z,J),await c2(z,J);let X=`${JSON.stringify(Z)}
-`;if(Buffer.byteLength(X)>l1)throw new P("invalid-state","Claustrum enrollment state is too large");if(I)return s0($,X);let G=$8(z,`.${e7($)}.${process.pid}.${n7()}.tmp`),Q,W=!1;try{Q=await E2(G,"wx",384),W=!0,await Q.writeFile(X,"utf8"),await Q.chmod(384),await Q.sync(),await Q.close(),Q=void 0,await t7(G,$),W=!1}finally{if(await Q?.close().catch(()=>{}),W)await y3(G).catch(()=>{})}}var G8=new B1;async function a1($,Z){let J=I?await b2($,Z):await G8.read([$.tokenPath,$.statePath],async([X=$.tokenPath,G=$.statePath])=>b2({tokenPath:X,statePath:G},Z),(X)=>{for(let G of X)if(G!=="absent")w2(G)}),z={...J.status};if(J.usesProposedName&&z.state==="approved")z.proposedName=Z;return z}async function b2($,Z){let J=await T0($.tokenPath),z=J===void 0?void 0:h3(J),X=await T0($.statePath),G=X===void 0?void 0:v3(X);if(z)return{usesProposedName:G===void 0,status:{state:"approved",proposedName:G?.proposedName??Z,...G?.phase==="approved"&&G.approvedName!==void 0&&{approvedName:G.approvedName},tokenGeneration:z.token_generation}};if(!G)return{status:{state:"idle"},usesProposedName:!1};if(G.phase==="approved")return{usesProposedName:!1,status:{state:"blocked",proposedName:G.proposedName,code:"missing_token"}};return{status:P0(G),usesProposedName:!1}}async function O0($){let Z=await T0($);if(Z===void 0)throw new P("not-enrolled","Claustrum enrollment is not configured");return h3(Z)}function P0($){if($.phase==="pending")return{state:"pending",proposedName:$.proposedName,...$.requestId!==void 0&&{requestId:$.requestId}};if($.phase==="approved")return{state:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration};if($.phase==="denied")return{state:"denied",proposedName:$.proposedName};return{state:"blocked",proposedName:$.proposedName,code:$.errorCode??"unknown"}}function p2(){return new P("wrong-consumer","Claustrum enrollment state belongs to a different consumer")}class m3{#$;#Z;#J;#W;#G;#Q;#z;constructor($){this.#z=$.ancestorOptions??{},this.#$=$.client,this.#Z=$.paths,this.#J=$.proposedName,this.#W=$.now??Date.now,this.#G=$.mintSecret??(()=>s7(32).toString("hex")),this.#Q=$.writeTokenFile??J8}async status(){return a1(this.#Z,this.#J)}async resetTerminal(){return d2(this.#Z,this.#J)}async#X($,Z){let J={version:1,phase:"blocked",proposedName:$.proposedName,errorCode:Z,updatedAt:this.#W()};return await S0(this.#Z.statePath,J,this.#z),P0(J)}async reconcile(){await i0(k0(this.#Z.statePath),this.#z);let $=await j0({name:"ceremony",path:this.#Z.statePath,ttlMs:x2,renew:!0});if(!$)return{state:"busy"};try{let Z=await T0(this.#Z.tokenPath),J=Z===void 0?void 0:h3(Z),z=await T0(this.#Z.statePath),X=z===void 0?void 0:v3(z);if(X&&X.proposedName!==this.#J)throw p2();if(J){if(!X||X.phase==="pending"){let Q={version:1,phase:"approved",proposedName:X?.proposedName??this.#J,tokenGeneration:J.token_generation,updatedAt:this.#W()};await S0(this.#Z.statePath,Q,this.#z),X=Q}return{state:"approved",proposedName:X.proposedName,...X.phase==="approved"&&X.approvedName!==void 0&&{approvedName:X.approvedName},tokenGeneration:J.token_generation}}if(X?.phase==="approved"){let Q={version:1,phase:"blocked",proposedName:X.proposedName,errorCode:"missing_token",updatedAt:this.#W()};return await S0(this.#Z.statePath,Q,this.#z),P0(Q)}if(X&&X.phase!=="pending")return P0(X);if(!X){let Q=this.#W();if(X={version:1,phase:"pending",proposedName:this.#J,requestSecret:this.#G(),createdAt:Q,updatedAt:Q},!g3.test(X.requestSecret))throw new P("invalid-state","invalid minted Claustrum enrollment secret");await S0(this.#Z.statePath,X,this.#z)}if(!X.requestId)try{let Q=a7("sha256").update(Buffer.from(X.requestSecret,"hex")).digest("hex"),W=await this.#$.enrollPropose({name:X.proposedName,requestSecretHash:Q});X={...X,requestId:W.requestId,updatedAt:this.#W()},await S0(this.#Z.statePath,X,this.#z)}catch(Q){let W=x3(Q);if(!W)throw Q;if(W.disposition==="retry")return{state:"pending",proposedName:X.proposedName,retryCode:W.code};if(W.code===y2)return await $.assertOwned(),await y3(this.#Z.statePath).catch((H)=>{if(H.code!=="ENOENT")throw H}),{state:"unavailable",proposedName:X.proposedName,code:W.code};return this.#X(X,W.code)}let G=X.requestId;if(!G)return P0(X);try{let Q=await this.#$.enrollPoll({requestId:G,requestSecret:X.requestSecret});if(Q.status==="pending")return P0(X);if(Q.status==="denied"){let H={version:1,phase:"denied",proposedName:X.proposedName,updatedAt:this.#W()};return await S0(this.#Z.statePath,H,this.#z),P0(H)}await i0(k0(this.#Z.tokenPath),this.#z),await c2(k0(this.#Z.tokenPath),this.#z),await this.#Q(this.#Z.tokenPath,{token:Q.token,token_generation:Q.tokenGeneration});let W={version:1,phase:"approved",proposedName:X.proposedName,approvedName:Q.name,tokenGeneration:Q.tokenGeneration,updatedAt:this.#W()};return await S0(this.#Z.statePath,W,this.#z),P0(W)}catch(Q){let W=x3(Q);if(!W)throw Q;if(W.disposition==="retry")return{state:"pending",proposedName:X.proposedName,requestId:G,retryCode:W.code};return this.#X(X,W.code)}}finally{await $.release()}}}async function d2($,Z){await i0(k0($.statePath));let J=await j0({name:"ceremony",path:$.statePath,ttlMs:x2,renew:!0});if(!J)return"busy";try{if(await T0($.tokenPath)!==void 0)return"refused-approved";let z=await T0($.statePath);if(z===void 0)return"idle";let X=v3(z);if(X.proposedName!==Z)throw p2();if(X.phase==="pending")return"refused-pending";return await J.assertOwned(),await y3($.statePath),"reset"}finally{await J.release()}}var w3="claustrum-tombstone:v1:";function o0($,Z){let J=!1;return(z)=>{if(J)return;if(!Z||Z.aborted)J=!0;$.warn("claustrum shutdown drain timed out",{pendingOperations:z})}}async function r0($,Z){if(!$.size)return;let J,z=!1,X=(async()=>{while(!z&&$.size)await Promise.allSettled([...$])})();try{if(await Promise.race([X,new Promise((G)=>{J=setTimeout(()=>{z=!0,G()},2000)})]),z&&$.size)Z($.size)}finally{z=!0,clearTimeout(J)}}function a2($,Z){return Z!==void 0&&!Z.fromKeptReceipt&&!$.fromKeptReceipt&&Z.credentialId===$.credentialId&&Z.accountIdentity===$.accountIdentity&&Z.recordVersion!==$.recordVersion}function Q8($,Z){if(Z===void 0)return"reauthorize-failed";if(Z.credentialId!==$.credentialId)return"credential-changed";if(Z.accountIdentity!==$.accountIdentity)return"account-changed";if(Z.recordVersion===$.recordVersion)return"version-unchanged";return"rotated"}var c3=H0("claustrum");function d3($,Z,J,z=c3){let X=a2(Z,J);return z.debug("scoped 401 re-authorized",{site:$,credentialId:Z.credentialId,servedVersion:Z.recordVersion,currentVersion:J?.recordVersion??null,retry:X,reason:Q8(Z,J)}),X}var p3=300000,s2=60000;function u3(){return new P("invalid-material","Claustrum returned invalid credential material")}function W8($){let Z=$.trim();if(Z.startsWith("{")){let J;try{J=JSON.parse(Z)}catch{throw u3()}if(!J||typeof J!=="object")throw u3();let z=J,X=z.access_token??z.access;Z=typeof X==="string"?X:""}if(!/^[\x21-\x7e]+$/.test(Z)||Z.startsWith(w3))throw u3();return Z}function H8($,Z){let J={kind:"not-mine"};if(!$.operations.includes("read"))return J;if(!$.categories.includes(Z.category))return J;if($.credentialType!=="oauth"&&$.credentialType!=="api_key")return J;if("classify"in Z){let z={credentialId:$.id,credentialType:$.credentialType,categories:$.categories,refreshAdapter:$.refreshAdapter,...Y8($)};if(z.providerIds===void 0)return{kind:"refused",code:"unmapped"};try{let X=Z.classify(z);if(X.kind==="not-mine")return J;if(X.kind==="mine"&&typeof X.member==="string")return{kind:"mine",type:$.credentialType,member:X.member};if(X.kind==="refused"&&typeof X.code==="string"&&/^[a-z][a-z0-9-]{0,31}$/.test(X.code)&&!X.code.includes(`
-`)&&Z.refusalCodes.includes(X.code))return{kind:"refused",code:X.code}}catch{}return{kind:"refused",code:"unclassified"}}if($.credentialType==="oauth")return $.refreshAdapter===Z.refreshAdapter?{kind:"mine",type:"oauth"}:J;if($.credentialType==="api_key"&&Z.apiKeys)return $.refreshAdapter===void 0?{kind:"mine",type:"api_key"}:J;return J}function Y8($){let Z=$;return{providerIds:Z.providerIds,authMethod:Z.authMethod}}function U8($){let{grants:Z,grantTuples:J}=$;if(Z===void 0||J===void 0)return;return Object.freeze({grants:Z,tuples:Object.freeze(J.map(({selectorKind:z,selector:X,operation:G})=>Object.freeze({selectorKind:z,selector:X,operation:G})))})}class t0{#$;#Z;#J;#W;#G;#Q;#z;#X=new WeakMap;#j=new WeakMap;#H=new Map;#Y=new WeakMap;#q;#F;#U=!1;#M=new t;#B;#N=!1;#_=-1/0;#C=2000;#K=!1;#D;#I=new Set;#V=new Set;#P;#A;constructor($){let Z=$.tokenPath;if($.readToken)this.#Z=$.readToken;else if(Z)this.#Z=()=>O0(Z);else throw new P("not-enrolled","Claustrum enrollment token path is required");this.#$=$.client,this.#W=$.family,this.#G=$.parseIdentity,this.#Q=$.requireAssertion??!1,this.#J=$.now??Date.now,this.#z=$.logger??c3,this.#P=o0(this.#z),this.#q=$.setTimeoutImpl??setTimeout,this.#F=$.clearTimeoutImpl??clearTimeout}transportLost($){if(this.#K||this.#U)return;this.#U=!0,this.#M=$ instanceof l2?$:new t,this.#z.warn("serving kept vault receipt",{reason:"unreachable"}),this.#R()}reachable(){if(this.#K||!this.#U)return;if(this.#U=!1,this.#B)this.#F(this.#B);this.#B=void 0,this.#C=2000;for(let $ of this.#H.values())$.since=null;(this.#z.info??c3.info)("vault receipt serving resumed",{reason:"reachable"})}#R(){if(this.#K||!this.#U||this.#B||this.#N)return;this.#B=this.#q(()=>{this.#B=void 0,this.#L(!0)},this.#C),this.#B.unref?.()}#L($=!1){if(this.#K||!this.#U||this.#N)return;if(this.#J()-this.#_<1000){this.#R();return}this.#_=this.#J(),this.#N=!0,this.#E().catch(()=>{if($&&this.#U)this.#C=Math.min(this.#C*2,30000)}).finally(()=>{this.#N=!1,this.#R()})}#O($){if(this.#K)throw new P("closed","Claustrum scoped custody is closed");$?.throwIfAborted()}async#k($){this.#O($);let Z=this.#Z();this.#V.add(Z);let J;try{J=await Z}finally{this.#V.delete(Z)}if(this.#O($),!/^[0-9a-f]{64}$/.test(J.token)||!Number.isSafeInteger(J.token_generation)||J.token_generation<1)throw new P("invalid-token","Invalid Claustrum enrollment token");return J.token}async#S($,Z){this.#O(Z);let J,z;try{let X=$();J=Z?await Promise.race([X,new Promise((G,Q)=>{let W=()=>Q(Z.reason);if(Z.addEventListener("abort",W,{once:!0}),z=()=>Z.removeEventListener("abort",W),Z.aborted)W()})]):await X}catch(X){if(this.#O(Z),N0(X)==="unreachable")this.transportLost(X);else this.reachable();if(X instanceof l2)throw X;if(N0(X)==="unreachable")throw new t;throw new P("unavailable","Claustrum scoped operation unavailable")}finally{z?.()}return this.#O(Z),this.reachable(),J}async discover($){let Z=await this.#E($);return this.#D=Z.view,Z}async#E($){let Z,J;try{J=await this.#k($)}catch(Y){throw this.#H.clear(),Y}try{Z=await this.#S(()=>this.#$.listScoped(J),$)}catch(Y){throw this.listFailed(Y),Y}let z=[],X=[],G=0,Q=[],W=new Map;for(let Y of Z.rows){let K=H8(Y,this.#W);if(K.kind==="not-mine"){G++;continue}if(K.kind==="refused"){X.push({...Y.id.trim()&&{credentialId:Y.id},code:K.code});continue}Q.push({row:Y,type:K.type,...K.member!==void 0&&{member:K.member}}),W.set(Y.id,(W.get(Y.id)??0)+1)}let H=[];for(let{row:Y,type:K,member:M}of Q){let F;if(!Y.id.trim())F="empty credential id";else if((W.get(Y.id)??0)>1)F="duplicate credential id";else if(Y.accountId!==void 0&&!Y.accountId.trim())F="blank account identity";else if(!Y.state.trim())F="empty state";if(F){z.push({...Y.id.trim()&&{credentialId:Y.id},...M!==void 0&&{member:M},reason:F});continue}H.push(Object.freeze({credentialId:Y.id,credentialType:K,...M!==void 0&&{member:M},...Y.accountId!==void 0&&{accountIdentity:Y.accountId},state:Y.state,...Y.email!==void 0&&{email:Y.email},...Y.orgName!==void 0&&{orgName:Y.orgName}}))}for(let Y of z)this.#z.warn("skipped malformed vault record",Y);let U=U8(Z);return{view:Z.view,credentials:Object.freeze(H),skipped:Object.freeze(z),..."classify"in this.#W&&{refused:Object.freeze(X),notMine:G},...U&&{grantReach:U}}}listFailed($){if(N0($)==="unreachable")this.transportLost($);else this.reachable(),this.#H.clear()}forget($){this.#H.delete($)}retain($){let Z=new Map($.map((J)=>[J.credentialId,J]));for(let[J,z]of this.#H){let X=Z.get(J);if(!X?.enabled||X.state!=="active"||X.credentialType!==z.attempt.credentialType||X.accountIdentity!==z.attempt.expectedAccountIdentity)this.forget(J)}}keptReceiptState(){let $=null;for(let[Z,J]of this.#H){if(!this.#b(J.attempt)){this.forget(Z);continue}if(J.since!==null)$=Math.min($??J.since,J.since)}return Object.freeze({active:$!==null,since:$})}#b($){return $.expiresAtMs===null?$.credentialType==="api_key":$.expiresAtMs-this.#J()>s2}async authorize($,Z,J="vault"){this.#O(Z);let{credentialId:z,credentialType:X,accountIdentity:G}=$,Q=this.#H.get(z);if(Q&&(Q.attempt.credentialType!==X||Q.attempt.expectedAccountIdentity!==G))this.forget(z),Q=void 0;let W;try{W=await this.#k(Z)}catch(H){throw this.#H.clear(),H}if(this.#U&&Q)return this.#L(),this.#T(z,Q,W,J);try{let H=await this.#x({credentialId:z,credentialType:X,accountIdentity:G},W,Z);return this.#H.set(z,{attempt:H,routeId:J,since:null}),H}catch(H){if(this.#O(Z),N0(H)!=="unreachable")throw this.forget(z),H;return this.#T(z,Q,W,J,H)}}#T($,Z,J,z,X=this.#M){if(!Z||this.#H.get($)!==Z||!this.#b(Z.attempt))throw this.forget($),X;if(Z.since===null)Z.since=this.#J();let G=Object.freeze(Object.defineProperty({...Z.attempt,fromKeptReceipt:!0},"accessToken",{value:Z.attempt.accessToken,enumerable:!1}));return this.#X.set(G,J),this.#Y.set(G,z),G}async#x($,Z,J){if(!$.credentialId)throw new P("route-unavailable","Claustrum dispatch requires a credential id");let{credentialId:z,credentialType:X,accountIdentity:G}=$;if(this.#Q&&G===void 0)throw new P("identity-unasserted","Claustrum dispatch requires a known account identity");let Q=await this.#S(()=>this.#$.getScoped({credentialId:z,enrollmentToken:Z,...X==="oauth"&&{minTtlMs:p3}}),J);if(Q.credentialId!==void 0&&Q.credentialId!==z)throw new P("identity-changed","Claustrum served credential identity changed");let W=Q.expiresAtMs;if(!Number.isSafeInteger(Q.recordVersion)||Q.recordVersion<0||W===null&&X==="oauth"||W!==null&&(!Number.isFinite(W)||W-this.#J()<p3))throw new P("insufficient-validity","Claustrum served credential has insufficient validity");let H=W8(Q.material),U=Q.accountId?.trim()?Q.accountId:void 0;if(this.#Q&&(Q.credentialId===void 0||U===void 0))throw new P("identity-unasserted","Claustrum served credential did not assert its identity");let Y=U===void 0?this.#G?.(H):void 0,K=U??Y;if(G!==void 0&&K!==void 0&&K!==G)throw new P("identity-changed","Claustrum served credential identity changed");let M=K??G,D=Object.freeze(Object.defineProperty({credentialId:z,credentialType:X,...M!==void 0&&{accountIdentity:M},accountIdentitySource:U!==void 0?"asserted":Y!==void 0?"parsed":G!==void 0?"expected":"none",...G!==void 0&&{expectedAccountIdentity:G},...Q.credentialId!==void 0&&{assertedCredentialId:Q.credentialId},...U!==void 0&&{assertedAccountIdentity:U},...Q.projectId!==void 0&&{projectId:Q.projectId},recordVersion:Q.recordVersion,expiresAtMs:W},"accessToken",{value:H,enumerable:!1}));return this.#X.set(D,Z),D}async reportFailure($,Z,J){if(Z!==401)return;this.#O();let z=this.#X.get($);if(!z)throw new P("no-receipt","Claustrum failure report requires an original dispatch receipt");let X=this.#Y.get($);if(X!==void 0){this.forget($.credentialId),this.#z.debug("scoped 401 not reported",{routeId:X,reason:"kept-receipt"});return}let G=this.#H.get($.credentialId);if(G&&G.attempt.recordVersion===$.recordVersion)this.forget($.credentialId);let Q=this.#j.get($);if(Q)return Q;let W=this.#S(()=>this.#$.reportAuthFailureScoped({credentialId:$.credentialId,enrollmentToken:z,providerStatus:401,recordVersion:$.recordVersion,reporterSource:J}));this.#j.set($,W);try{await W,this.#z.debug("scoped 401 reported",{credentialId:$.credentialId,recordVersion:$.recordVersion,reporterSource:J})}catch(H){throw this.#j.delete($),H}}watchRoster($){this.#O();let Z=new v1({client:this.#$,enrollmentToken:()=>this.#k(),view:$.view??(()=>this.#D),discover:async(J)=>{await $.onView(J)},onRefused:(J)=>{this.listFailed(J),$.onRefused?.(J)},onTransportLost:()=>this.transportLost(),onReachable:()=>this.reachable(),onError:$.onError,onMode:$.onMode,logger:this.#z,now:this.#J,setTimeoutImpl:this.#q,clearTimeoutImpl:this.#F});return this.#I.add(Z),Z.start(),{get mode(){return Z.mode},close:()=>{this.#I.delete(Z),Z.stop()}}}close(){if(this.#K)return;if(this.#K=!0,this.#B)this.#F(this.#B);this.#B=void 0;for(let $ of this.#I)$.stop();this.#I.clear(),this.#H.clear(),this.#$.close()}async dispose($=this.#P){this.close(),this.#A??=r0(this.#V,$),await this.#A}}import{resolve as t1}from"node:path";var l3=30000,a3={now:()=>performance.now(),schedule($,Z){let J=setTimeout(()=>void Z(),$);return{cancel:()=>clearTimeout(J),unref:()=>J.unref?.()}}};var b0="all",q8=Object.freeze(["primary"]);function i2($){return $.kind==="retired"?$.retiredAt:$.checkedAt}function $1($,Z){return JSON.stringify([$,Z])}function A0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function l($){return typeof $==="number"&&Number.isFinite($)}function n2($){return typeof $==="string"&&$.length>0}function n($,Z,J){return $[Z]===void 0||J($[Z])}function K8($){return l($)&&$>0}function s3($){return typeof $==="string"}function V8($){if(!A0($)||!n2($.scope)||!n2($.label))return!1;switch($.kind){case"reading":return l($.checkedAt)&&l($.usedPercent)&&n($,"resetsAt",s3)&&n($,"windowMinutes",K8);case"retired":return l($.retiredAt);case"absent":return l($.checkedAt);default:return!1}}function F8($){if(!A0($)||!l($.checkedAt))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&n($,"remainingPercent",l)&&n($,"usedPercent",l)&&n($,"resetsAt",s3)&&n($,"limit",l)&&n($,"used",l)&&n($,"remaining",l)&&n($,"unit",s3)}function o2($){return A0($)&&l($.value)&&Number.isInteger($.value)&&$.value>=0&&l($.checkedAt)}function n3($){return A0($)&&Object.values($).every(o2)}function B8($){return typeof $==="boolean"}function Z1($){return A0($)&&typeof $.hasCredits==="boolean"&&typeof $.unlimited==="boolean"&&n($,"balance",l)&&n($,"overageLimitReached",B8)&&l($.checkedAt)}function r2($){if(!A0($))return;let Z=Object.entries($).filter(([,J])=>o2(J));return Z.length===0?void 0:Object.fromEntries(Z)}function E0($){if(e0($))return $;if(!A0($))return;let{counters:Z,credits:J,...z}=$;if(!e0(z))return;let X=r2(Z),G=Z1(J)?J:void 0;return{...z,...X===void 0?{}:{counters:X},...G===void 0?{}:{credits:G}}}function e0($){if(!A0($)||!Array.isArray($.limits))return!1;let Z=new Set;for(let J of $.limits){if(!V8(J))return!1;let z=$1(J.scope,J.label);if(Z.has(z))return!1;Z.add(z)}return n($,"budget",F8)&&n($,"counters",n3)&&n($,"credits",Z1)}class s1 extends TypeError{constructor($){super($);this.name="QuotaCodecError"}}function i1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function n1($){return typeof $==="number"&&Number.isFinite($)}function t2($){return $===void 0||typeof $==="string"&&$!==""}function e2($){return typeof $==="string"&&$!==""}function N1($,Z){return $[Z]===void 0||n1($[Z])}function i3($,Z){return $[Z]===void 0||typeof $[Z]==="string"}function j8($){return i1($)&&t2($.scope)&&e2($.label)&&n1($.usedPercent)&&i3($,"resetsAt")&&($.windowMinutes===void 0||n1($.windowMinutes)&&$.windowMinutes>0)}function M8($){return i1($)&&t2($.scope)&&e2($.label)}function D8($){if(!i1($))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&N1($,"remainingPercent")&&N1($,"usedPercent")&&i3($,"resetsAt")&&N1($,"limit")&&N1($,"used")&&N1($,"remaining")&&i3($,"unit")}function J1($){if(!i1($)||!n1($.checkedAt))return!1;let Z=$.readings??[],J=$.coverage??[];if(!Array.isArray(Z)||!Array.isArray(J))return!1;let z=new Set;for(let X of Z){if(!j8(X))return!1;let G=$1(X.scope??b0,X.label);if(z.has(G))return!1;z.add(G)}if(!J.every(M8))return!1;return($.budget===void 0||D8($.budget))&&($.counters===void 0||n3($.counters))&&($.credits===void 0||Z1($.credits))}function N8($,Z){if($.scope!==Z.scope)return $.scope<Z.scope?-1:1;if($.label!==Z.label)return $.label<Z.label?-1:1;return 0}function L8($,Z,J){if(Z===void 0)return $;if($!==void 0&&J<$.checkedAt)return $;return{...Z,checkedAt:J}}function C8($,Z){let J=new Map(Object.entries($??{}));for(let[z,X]of Object.entries(Z??{})){let G=J.get(z);if(G===void 0||X.checkedAt>=G.checkedAt)J.set(z,X)}return J.size===0?void 0:Object.fromEntries(J)}function P8($,Z){if(Z===void 0)return $;if($!==void 0&&Z.checkedAt<$.checkedAt)return $;return{...Z}}function L1($,Z){let J=$===void 0?void 0:E0($);if($!==void 0&&J===void 0)throw new s1("stored quota map is malformed");if(!J1(Z))throw new s1("quota observation is malformed");let z=J??{limits:[]},X=Z.checkedAt,G=new Map;for(let O of z.limits)G.set($1(O.scope,O.label),O);let Q=(O)=>{let _=G.get(O);return _===void 0||X>=i2(_)},W=new Set;for(let O of Z.readings??[]){let _=O.scope??b0,R=$1(_,O.label);if(W.add(R),!Q(R))continue;G.set(R,{scope:_,label:O.label,kind:"reading",checkedAt:X,usedPercent:O.usedPercent,...O.resetsAt===void 0?{}:{resetsAt:O.resetsAt},...O.windowMinutes===void 0?{}:{windowMinutes:O.windowMinutes}})}for(let O of Z.coverage??[]){let _=O.scope??b0,R=$1(_,O.label);if(W.has(R)||!Q(R))continue;let v=G.get(R);G.set(R,v===void 0||v.kind==="absent"?{scope:_,label:O.label,kind:"absent",checkedAt:X}:{scope:_,label:O.label,kind:"retired",retiredAt:X})}let{limits:H,budget:U,counters:Y,credits:K,...M}=z,F=L8(z.budget,Z.budget,X),D=C8(z.counters,Z.counters),L=P8(z.credits,Z.credits);return{...M,limits:[...G.values()].sort(N8),...F===void 0?{}:{budget:F},...D===void 0?{}:{counters:D},...L===void 0?{}:{credits:L}}}var O8=Object.freeze({validate:e0,decode:E0,merge:L1});function $9($,Z=""){let J=new Map,{observation:z}=$,X=(W,H,U)=>J.set(`${Z}:${W}`,{at:H,order:0,publication:{...$,observation:U}}),G=(W,H)=>JSON.stringify([W??"all",H]),Q=new Set;for(let W of z.readings??[]){let H=G(W.scope,W.label);Q.add(H),X(H,z.checkedAt,{checkedAt:z.checkedAt,readings:[{...W}]})}for(let W of z.coverage??[]){let H=G(W.scope,W.label);if(!Q.has(H))X(H,z.checkedAt,{checkedAt:z.checkedAt,coverage:[{...W}]})}if(z.budget)X("budget",z.checkedAt,{checkedAt:z.checkedAt,budget:{...z.budget}});for(let[W,H]of Object.entries(z.counters??{}))X(`counter:${W}`,H.checkedAt,{checkedAt:z.checkedAt,counters:{[W]:{...H}}});if(z.credits)X("credits",z.credits.checkedAt,{checkedAt:z.checkedAt,credits:{...z.credits}});if(!J.size)X("empty",z.checkedAt,{checkedAt:z.checkedAt});return J}import{createHash as R8}from"node:crypto";import{stat as S8}from"node:fs/promises";import{resolve as C1}from"node:path";function Z9($,Z,J){if($.accountIdentity!==void 0&&J!==void 0)return $.accountIdentity===J;return $.credentialId===Z}function o3($,Z,J){return $.some((z)=>Z9(z,Z,J))}function r3($,Z,J){let z={credentialId:Z,...J!==void 0&&{accountIdentity:J}};return[...$.filter((X)=>X.credentialId!==Z||X.accountIdentity!==J),z]}function t3($,Z,J){return $.filter((z)=>!Z.some((X)=>Z9(z,X,J)))}function e3($){return{declined:$.declined.map((Z)=>({...Z})),order:$.rows.flatMap((Z)=>Y0(Z).map((J)=>({credentialId:J,...Z.accountIdentity!==void 0&&{accountIdentity:Z.accountIdentity}})))}}function k8($,Z){let J=Y0(Z),z=Z.accountIdentity===void 0?-1:$.order.findIndex((G)=>G.accountIdentity===Z.accountIdentity),X=z>=0?z:$.order.findIndex((G)=>J.includes(G.credentialId));return X>=0?X:1/0}var r1="vault:";function T8($){return R8("sha256").update($).digest("hex")}function b8($){let Z=$.credentialId.split(":");return(Z.length>=3?Z.slice(2).join(":").trim():void 0)||$.email||$.credentialId}function E8($){return $.identity!==void 0?`identity:${$.identity}`:`credential:${$.credential.credentialId}`}function Y0($){return[$.credentialId,...$.aliases??[]]}function X9($,Z,J={}){let z=J.now??Date.now(),X=J.routePrefix??r1,G=J.reservedRouteIds??new Set,Q=$?.rows??[],W=$?void 0:J.seed,H=[...$?.declined??W?.declined??[]],U=Z.skipped.length===0,Y=new Set(Z.credentials.map((V)=>V.credentialId)),K=new Set(Z.skipped.flatMap((V)=>V.credentialId===void 0?[]:[V.credentialId])),M=Z.skipped.some((V)=>V.credentialId===void 0),F=(V)=>!Y.has(V)&&(K.has(V)||M),D=new Map;for(let V of Q){if(V.accountIdentity===void 0)continue;for(let q of Y0(V))if(!D.has(q))D.set(q,V.accountIdentity)}let L=new Map;for(let V of Z.credentials){let q=V.accountIdentity!==void 0?{credential:V,identity:V.accountIdentity,claimed:!0}:{credential:V,identity:D.get(V.credentialId),claimed:!1},B=E8(q),N=L.get(B)??[];N.push(q),L.set(B,N)}let O=new Set,_=new Set(G),R=[],v=(V,q)=>V.credential.credentialId.localeCompare(q.credential.credentialId),h=[...L.values()].map((V)=>V.toSorted(v)).sort((V,q)=>V[0]&&q[0]?v(V[0],q[0]):0);for(let V of h){let q=V[0]?.identity,B=V.filter((T)=>T.credential.state==="active"),N=B.length?B:V,x=N.filter((T)=>T.claimed),k=x.length?x:N,y=new Set(V.map((T)=>T.credential.credentialId)),Z0=Q.find((T)=>!O.has(T)&&Y0(T).some((s)=>y.has(s))&&(T.accountIdentity===void 0||T.accountIdentity===q)),p=k.find((T)=>T.credential.credentialId===Z0?.credentialId)??k[0];if(!p)continue;let c=p.credential,a=Z0??(q===void 0?void 0:Q.find((T)=>!O.has(T)&&T.accountIdentity===q));if(a)O.add(a);let Q0=a?.routeId;if(!Q0||G.has(Q0)){let T=`${X}${c.credentialId}${q===void 0?"":`~${T8(q).slice(0,10)}`}`;Q0=T;for(let s=2;_.has(Q0);s++)Q0=`${T}~${s}`}_.add(Q0);let E1=a?Y0(a).filter(F):[],c0=[...new Set([...V.map((T)=>T.credential.credentialId),...E1])].filter((T)=>T!==c.credentialId).sort((T,s)=>T.localeCompare(s)),f1=J.mapAccount?.(c)??{};R.push({previousIndex:a?Q.indexOf(a):1/0,row:{routeId:Q0,credentialId:c.credentialId,credentialType:c.credentialType,...q!==void 0&&{accountIdentity:q},...c0.length&&{aliases:c0},state:c.state,label:f1.label?.trim()||b8(c),...c.email!==void 0&&{email:c.email},...c.orgName!==void 0&&{orgName:c.orgName},enabled:![c.credentialId,...c0].some((T)=>o3(H,T,q)),addedAt:a?.addedAt??z,...a?.quota!==void 0&&{quota:a.quota},...!p.claimed&&q!==void 0&&{unclaimed:!0}}});let p0=R.at(-1);if(W&&p0)p0.previousIndex=k8(W,p0.row)}return Q.forEach((V,q)=>{if(O.has(V)||!Y0(V).some(F))return;if(_.has(V.routeId))return;let[B,...N]=Y0(V).filter((y)=>!Y.has(y));if(B===void 0)return;_.add(V.routeId);let{aliases:x,...k}=V;R.push({previousIndex:q,row:{...k,credentialId:B,...N.length&&{aliases:N},stale:!0}})}),R.sort((V,q)=>V.previousIndex===q.previousIndex?V.row.credentialId.localeCompare(q.row.credentialId):V.previousIndex-q.previousIndex),{version:1,view:Z.view,complete:U,...!U&&{rejected:Z.skipped.map((V)=>({...V.credentialId!==void 0&&{credentialId:V.credentialId},reason:V.reason}))},rows:R.map((V)=>V.row),declined:H}}function $$($){return($?.rows??[]).filter((Z)=>Z.enabled&&Z.state==="active").map((Z)=>({id:Z.routeId,kind:Z.credentialType==="oauth"?"oauth":"api-key",...Z.quota!==void 0&&{quota:Z.quota}}))}function P1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function z1($){return $===void 0||typeof $==="string"}function f8($){let Z=P1($)?E0($.quota):void 0;if(!P1($)||typeof $.routeId!=="string"||typeof $.credentialId!=="string"||$.credentialType!=="oauth"&&$.credentialType!=="api_key"||typeof $.state!=="string"||typeof $.label!=="string"||typeof $.enabled!=="boolean"||typeof $.addedAt!=="number"||!z1($.accountIdentity)||!z1($.email)||!z1($.orgName)||$.aliases!==void 0&&(!Array.isArray($.aliases)||!$.aliases.every((J)=>typeof J==="string"))||$.quota!==void 0&&Z===void 0||$.stale!==void 0&&$.stale!==!0||$.unclaimed!==void 0&&$.unclaimed!==!0)return;return{...$,...Z===void 0?{}:{quota:Z}}}var x8=new Set(["empty credential id","duplicate credential id","blank account identity","empty state"]);function J9($){if(!Array.isArray($))return;let Z=[];for(let J of $){if(!P1(J)||!z1(J.credentialId)||typeof J.reason!=="string"||!x8.has(J.reason))return;Z.push(J)}return Z}function G9($){if(!P1($)||$.version!==1||!z1($.view)||!Array.isArray($.rows)||!Array.isArray($.declined)||$.complete!==void 0&&typeof $.complete!=="boolean"||$.rejected!==void 0&&!J9($.rejected))throw new P("invalid-state","Claustrum roster file is not valid");let Z=[];for(let X of $.rows){let G=f8(X);if(!G)throw new P("invalid-state","Claustrum roster file is not valid");Z.push(G)}let J=[];for(let X of $.declined){if(!P1(X)||typeof X.credentialId!=="string"||!z1(X.accountIdentity))throw new P("invalid-state","Claustrum roster file is not valid");J.push(X)}let z=J9($.rejected);return{version:1,...typeof $.view==="string"&&{view:$.view},complete:$.complete!==!1,...z&&{rejected:z},rows:Z,declined:J}}function Q9($){return G9(JSON.parse(JSON.stringify($)))}async function w($){let Z;try{Z=await J0($,I)}catch(z){if(z.code==="ENOENT")return;throw z}let J;try{J=JSON.parse(Z)}catch{throw new P("invalid-state","Claustrum roster file is not valid")}return G9(J)}var W9={name:"claustrum-roster-write",ttlMs:1e4,timeoutMs:5000,renew:!0},H9={name:"claustrum-roster",ttlMs:30000};async function f0($,Z,J={}){return b3($,{...W9,signal:J.signal},async(z)=>{let X=await w($),{next:G,result:Q}=await Z(X,{assertOwned:()=>z.assertOwned()});if(G)await z.assertOwned(),await j1($,G,{beforeRename:async()=>{await J.beforePublish?.(),J.signal?.throwIfAborted(),await z.assertOwned()}});return Q})}function Z$($,Z){return f0($,(J)=>{let z=J?.rows.find((G)=>G.routeId===Z);if(!J||!z)throw new P("route-unavailable","Claustrum route is not in the roster");let X=r3(J.declined,z.credentialId,z.accountIdentity);return{next:{...J,declined:X,rows:J.rows.map((G)=>G===z?{...G,enabled:!1}:G)},result:void 0}})}function J$($,Z){return f0($,(J)=>{let z=J?.rows.find((X)=>X.routeId===Z);if(!J||!z)throw new P("route-unavailable","Claustrum route is not in the roster");return{next:{...J,declined:t3(J.declined,Y0(z),z.accountIdentity),rows:J.rows.map((X)=>X===z?{...X,enabled:!0}:X)},result:void 0}})}function y8($){return new P("invalid-order",$)}function g8($,Z){if(!Array.isArray(Z))return"route ids must be an array of route ids";let J=new Set($.map((G)=>G.routeId)),z=new Set;for(let G of Z){if(typeof G!=="string")return"route ids must be an array of route ids";if(z.has(G))return`route id ${G} appears more than once`;if(!J.has(G))return`route id ${G} is not in the roster`;z.add(G)}let X=[...J].filter((G)=>!z.has(G)).length;if(X>0)return`the order leaves out ${X} roster route id${X===1?"":"s"}`;return}function z$($,Z,J={}){return f0($,(z)=>{let X=z?.rows??[],G=g8(X,Z);if(G)throw y8(G);let Q=new Map;for(let U of X){let Y=Q.get(U.routeId);if(Y)Y.push(U);else Q.set(U.routeId,[U])}let W=[...Z],H=W.flatMap((U)=>Q.get(U)??[]);if(!z||H.every((U,Y)=>U===X[Y]))return{result:{ids:W,outcome:"unchanged"}};return{next:{...z,rows:H},result:{ids:W,outcome:"reordered"}}},{...J.signal&&{signal:J.signal}})}function v8($,Z){if(!Y0($).includes(Z.credentialId))return"refuse";if($.unclaimed&&(Z.accountIdentitySource==="expected"||Z.accountIdentitySource==="none"))return"refuse";if($.accountIdentity===Z.accountIdentity)return"hold";if($.accountIdentity===void 0&&Z.expectedAccountIdentity===void 0&&Z.accountIdentity!==void 0&&(Z.accountIdentitySource==="asserted"||Z.accountIdentitySource==="parsed")&&Y0($).length===1)return"bind";return"refuse"}async function X$($,Z){let{routeId:J,observation:z,...X}=Z;return Y9($,{routeId:J,observation:z,accountIdentity:X.accountIdentity,receipt:X})}async function Y9($,Z){if(!J1(Z.observation))return!1;let J=r($,await w($));if(!I0(J,Z).kept)return!1;return q9($,Z)}function G$($,Z){return Y9($,Z)}function I0($,Z){let J=$?.rows.find((Q)=>Q.routeId===Z.routeId),z=!J?"refuse":Z.receipt?v8(J,Z.receipt):J.accountIdentity!==void 0&&J.accountIdentity===Z.accountIdentity?"hold":"refuse";if(!$||!J||z==="refuse")return{roster:$,kept:!1};let X=L1(J.quota,Z.observation),G=z==="bind"?{accountIdentity:Z.accountIdentity,unclaimed:!0}:{};return{roster:{...$,rows:$.rows.map((Q)=>Q===J?{...Q,...G,quota:X}:Q)},kept:!0}}var o1=new Map;function O1($){o1.delete(C1($))}function U9($,Z){let J=C1($);if(Z instanceof P)return Z.kind==="roster-busy";if(Z instanceof C0||Z instanceof B0)return C1(Z.details.target)===J;if(Z instanceof m){let z=C1(Z.path);return[W9.name,H9.name].some((X)=>{let G=M1(J,X);return z===G||z.startsWith(`${G}.`)})}return!1}var h8=4;async function z9($){try{let{dev:Z,ino:J,size:z,mtimeMs:X}=await S8($);return{dev:Z,ino:J,size:z,mtimeMs:X}}catch{return}}function m8($,Z){return $!==void 0&&Z!==void 0&&$.dev===Z.dev&&$.ino===Z.ino&&$.size===Z.size&&$.mtimeMs===Z.mtimeMs}async function w8($,Z,J){for(let z=0;z<h8;z++){let X=await z9($),G=await w($),Q,W,H;try{({target:Q,local:W}=Z(G));let U=JSON.stringify(J(Q));H=JSON.stringify(Q)!==U||W!==void 0&&JSON.stringify(W)!==U}catch{return"commit"}if(!m8(X,await z9($)))continue;if(H)return"commit";return K9($)?"commit":"unchanged"}return"commit"}async function A1($){$.signal?.throwIfAborted();let Z=async()=>await $.isActive?.()??!0;if(!await Z()){O1($.path);return}let J=await j0({...H9,path:$.path,renew:!0});if(!J){let Q=await w($.path);if($.signal?.throwIfAborted(),!Q?.view)throw new P("roster-busy","Claustrum account discovery is already in progress");return Q}let z=C1($.path),X=$.listedOver,G;try{let Q=await w($.path),W=X?void 0:o1.get(z);G=W&&(W.previousView===Q?.view||W.inventory.view===Q?.view)?W:{inventory:await $.custody.discover($.signal),previousView:Q?.view},o1.delete(z);let{inventory:H}=G;$.onInventory?.(H),$.signal?.throwIfAborted();let U=typeof $.projection==="function"?$.projection():$.projection,Y=(F)=>X9(F,H,U),K=async()=>{return $.signal?.throwIfAborted(),await J.assertOwned(),Z()};if(await w8($.path,(F)=>{if(X)return{target:F};let D=r($.path,F);return{target:F,...D!==F&&{local:D}}},Y)==="unchanged"){if(!await K())return;return await w($.path)}return await f0($.path,async(F)=>{if(!await Z())return{result:void 0};if($.signal?.throwIfAborted(),await J.assertOwned(),X&&F?.view!==X.view&&F?.view!==H.view)return{result:F};let D=Y(F);return{...JSON.stringify(F)!==JSON.stringify(D)&&{next:D},result:D}},{signal:$.signal,beforePublish:async()=>{$.signal?.throwIfAborted(),await J.assertOwned()}})}catch(Q){if(Q instanceof C0&&G&&!X&&!$.signal?.aborted&&await Z())o1.set(z,G);throw Q}finally{await J.release()}}var x0=new Map,u8=H0("claustrum"),F9=100;function B9($,Z=a3){let J=t1($),z=x0.get(J);if(!z)z={path:J,pending:new Map,listeners:new Set,wake:new Set,abort:new AbortController,clock:Z,failures:0,draining:!1,order:0},x0.set(J,z);return z}function j9($,Z,J){let z=B9($,J);z.listeners.add(Z);let X;return()=>X??=(()=>{return z.listeners.delete(Z),z.listeners.size?Promise.resolve():Q$($)})()}function c8($){return $9($,JSON.stringify([$.routeId,$.receipt?.credentialId,$.receipt?.accountIdentitySource,$.receipt?.expectedAccountIdentity]))}function q9($,Z){if(!J1(Z.observation))return Promise.resolve(!1);let J=B9($),z=JSON.stringify([Z.accountIdentity??null,Z.accountIdentity===void 0?Z.routeId:null]),X=J.pending.get(z)??new Map;for(let[G,Q]of c8(Z)){let W=X.get(G);if(!W||Q.at>=W.at){if(Q.order=++J.order,Q.publication.observation.coverage)Q.priorReading=W?.publication.observation.readings?W.publication:W?.priorReading;X.set(G,Q)}}if(X.size)J.pending.set(z,X);for(let G of J.listeners)G(Z);return D9(J,F9),Promise.resolve(!0)}function M9($){return[...$.values()].flatMap((Z)=>[...Z.values()]).sort((Z,J)=>Z.order-J.order)}function r($,Z){let J=x0.get(t1($));if(J)for(let z of M9(J.pending)){if(z.priorReading)Z=I0(Z,z.priorReading).roster;Z=I0(Z,z.publication).roster}return Z}function K9($){return!!x0.get(t1($))?.pending.size}function D9($,Z){if($.running||$.timer||!$.pending.size||$.abort.signal.aborted)return;let J=$.draining?0:($.committedAt??-1/0)+l3-$.clock.now();if($.timer=$.clock.schedule(Math.max(Z,J),()=>{return $.timer=void 0,N9($)}),!$.draining)$.timer.unref?.()}function V9($){$.timer?.cancel(),$.timer=void 0}function N9($){if($.running||$.abort.signal.aborted)return $.running??Promise.resolve();let Z=new Map([...$.pending].map(([J,z])=>[J,new Map(z)]));return $.running=(async()=>{try{if(await f0($.path,(z)=>{let X=z;for(let Q of M9(Z)){if(Q.priorReading)X=I0(X,Q.priorReading).roster;X=I0(X,Q.publication).roster}let G=JSON.stringify(X)!==JSON.stringify(z);return{...G&&{next:X},result:G}},{signal:$.abort.signal}))$.committedAt=$.clock.now();for(let[z,X]of Z){let G=$.pending.get(z);for(let[Q,W]of X)if(G?.get(Q)===W)G.delete(Q);if(!G?.size)$.pending.delete(z)}$.failures=0}catch(J){if(!$.abort.signal.aborted&&$.failures++===0)u8.warn("vault quota publication delayed; retrying",{error:J instanceof Error?J.message:String(J)})}finally{$.running=void 0;for(let z of $.wake)z();let J=$.failures?Math.min(5000,100*2**Math.min($.failures,6))*(0.5+Math.random()):F9;D9($,J)}})(),$.running}async function Q$($,Z=1000){let J=t1($),z=x0.get(J);if(!z)return;z.draining=!0,V9(z);let X,G,Q=new Promise((W)=>{G=()=>{if(!z.pending.size||z.abort.signal.aborted)W()},z.wake.add(G),G()});try{if(z.pending.size)N9(z);await Promise.race([Q,new Promise((W)=>{X=setTimeout(W,Math.max(0,Z))})])}finally{if(clearTimeout(X),G)z.wake.delete(G);if(z.draining=!1,!z.listeners.size){if(z.abort.abort(),V9(z),z.pending.clear(),x0.get(J)===z)x0.delete(J)}}}var e1=1e4;function L9(){return new t}var W$;function P9($,Z){if(!W$)throw Error("ClaustrumConsumer is not initialized");return W$($,Z)}function C9(){return new P("not-active","Claustrum scoped custody is not active")}class H${#$;#Z=new AbortController;#J;#W;#G;#Q;#z;#X;#j;#H;#Y=!1;#q=new Set;#F;#U;#M;#B;#N=new Map;#_;#C;#K;#D;#I=new WeakMap;static{W$=($,Z)=>{let J=new H$(Z);return J.#K=$,{consumer:J,hooks:J.#x()}}}constructor($){this.#$=$,this.#J=$.logger??H0("claustrum"),this.#W=o0(this.#J,this.#Z.signal),this.#C=j9($.rosterPath,(Z)=>{this.#X=I0(this.#X,Z).roster})}#V($){this.#Z.signal.throwIfAborted(),$?.throwIfAborted()}#P($){return this.#q.add($),$.then(()=>this.#q.delete($),()=>this.#q.delete($)),$}async#A(){return await this.#$.isCustodyActive?.()??!0}#R($,Z){let J=R0([this.#Z.signal,...Z?[Z]:[]]);return new Promise((z,X)=>{let G=()=>{J.signal.removeEventListener("abort",Q),J.dispose()},Q=()=>{G(),X(J.signal.reason)};if(J.signal.addEventListener("abort",Q,{once:!0}),$.then((W)=>{if(G(),J.signal.aborted)X(J.signal.reason);else z(W)},(W)=>{G(),X(W)}),J.signal.aborted)Q()})}async#L(){if(this.#V(),this.#G)return this.#G;if(!this.#Q){let $={timedOut:!1};this.#Q=this.#O($),this.#P(this.#Q)}return this.#R(this.#Q)}#O($){let Z=this.#$.setTimeoutImpl??setTimeout,J=this.#$.clearTimeoutImpl??clearTimeout,z=this.#$.connect().then((Q)=>{if(this.#Z.signal.aborted||$.timedOut){if(Q.close(),!$.timedOut)this.#V();throw L9()}if(this.#G=new t0({client:Q,family:this.#$.family,tokenPath:this.#$.tokenPath,parseIdentity:this.#$.parseIdentity,requireAssertion:this.#$.requireAssertion,now:this.#$.now,logger:this.#J,setTimeoutImpl:this.#$.setTimeoutImpl,clearTimeoutImpl:this.#$.clearTimeoutImpl}),this.#$.insula&&Q.insula)this.#U=I3(Q.insula,this.#$.tokenPath);return this.#G}),X,G=new Promise((Q,W)=>{X=Z(()=>{if($.timedOut=!0,this.#Z.signal.aborted)return;this.#J.warn("vault connect timed out",{reason:"unreachable",connectTimeoutMs:this.#k()}),W(L9())},this.#k()),X.unref?.()});return Promise.race([z,G]).finally(()=>{if(X)J(X);this.#Q=void 0})}#k(){return this.#$.connectTimeoutMs??e1}snapshot(){return this.#X}grantReach(){if(this.#K)return this.#K.grantReach(this.#X?.view);let $=this.#j;return $&&this.#X?.view===$.view?$.reach:void 0}watchState(){if(this.#K)return Object.freeze({vault:this.#K.watchMode()});return Object.freeze({vault:this.#M?.mode??"polling",...this.#$.insula&&{insula:this.#U?.source.watchMode()??"polling"}})}#S(){this.#M?.close(),this.#M=void 0,this.#B?.(),this.#B=void 0}keptReceiptState(){if(this.#K){let $=this.#D;return $&&this.#K.leaseLive($)?$.custody.keptReceiptState():this.#K.keptReceiptState()}return this.#G?.keptReceiptState()??Object.freeze({active:!1,since:null})}routingRows(){return $$(this.#X)}refresh(){if(this.#V(),this.#K)return this.#P(this.#y(this.#K));if(this.#z)return this.#z;return this.#z=(async()=>{if(!await this.#A()){if(this.#X=void 0,this.#j=void 0,this.#S(),this.#G)this.#G.close(),this.#P(this.#G.dispose(this.#W));this.#G=void 0,this.#U?.release(),this.#U=void 0;return}let $=await this.#L(),Z,J=await A1({path:this.#$.rosterPath,custody:$,onInventory:(X)=>{Z=X},isActive:()=>this.#A(),signal:this.#Z.signal,projection:()=>({reservedRouteIds:new Set(this.#$.reservedRouteIds?.()??[]),routePrefix:this.#$.routePrefix,mapAccount:this.#$.mapAccount,now:(this.#$.now??Date.now)()})});this.#V();let z=J?.view!==this.#X?.view;if(this.#X=r(this.#$.rosterPath,J),$.retain(J?.rows??[]),Z&&J?.view!==void 0)this.#j=Z.grantReach?{view:J.view,reach:Z.grantReach}:void 0;if(J&&z)this.#$.onRoster?.(J);return this.#_=(this.#$.now??Date.now)(),J})().finally(()=>{this.#z=void 0}),this.#P(this.#z),this.#z}start(){if(this.#Y)return;if(this.#V(),this.#Y=!0,this.#K){this.#K.start();return}let $=async()=>{try{if(await this.#E())await this.refresh();await this.refreshInsulaQuota(),this.#b()}catch(J){if(!this.#Z.signal.aborted)this.#$.onError?.(J)}if(this.#Z.signal.aborted)return;let Z=this.#$.pollIntervalMs??5000;if(Z<=0)return;this.#H=(this.#$.setTimeoutImpl??setTimeout)(()=>{this.#H=void 0,this.#P($())},Z),this.#H.unref?.()};this.#P($())}async#E(){if(this.#M?.mode!=="watching")return!0;let $=(this.#$.now??Date.now)();if(this.#_===void 0||$-this.#_>=d0)return!0;return!await this.#A()}#b(){let $=this.#G;if(this.#Z.signal.aborted||!$)return;if(this.#M??=$.watchRoster({view:()=>this.#X?.view,onView:()=>this.#P((async()=>{while(this.#z)await this.#z.catch(()=>{});if(this.#Z.signal.aborted)return;await this.refresh()})()),onRefused:(Z)=>this.#$.onError?.(Z),onError:(Z)=>{if(!this.#Z.signal.aborted)this.#$.onError?.(Z)}}),this.#$.insula&&this.#U&&!this.#B)this.#B=this.#U.source.watch({provider:this.#$.insula.provider,setTimeoutImpl:this.#$.setTimeoutImpl,clearTimeoutImpl:this.#$.clearTimeoutImpl})}async refreshInsulaQuota(){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#A())return;try{await O0(this.#$.tokenPath),await this.#L(),await this.#U?.source.refresh((this.#$.now??Date.now)())}catch{}}async cachedInsulaQuota($){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#A())return;try{return await O0(this.#$.tokenPath),this.#T($.assertedAccountIdentity)}catch{return}}async cachedInsulaQuotaForRoute($){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#A())return;try{await O0(this.#$.tokenPath);let J=r(this.#$.rosterPath,await w(this.#$.rosterPath))?.rows.find((z)=>z.routeId===$);return this.#T(J?.accountIdentity)}catch{return}}async lookupInsulaQuotaForRoute($){let Z=this.#$.insula;if(!Z||this.#Z.signal.aborted||!await this.#A())return{miss:"unreachable"};try{await O0(this.#$.tokenPath);let z=r(this.#$.rosterPath,await w(this.#$.rosterPath))?.rows.find((Q)=>Q.routeId===$)?.accountIdentity;if(!z||!this.#U)return{miss:"unreachable"};let X=this.#U.source.lookup(Z.provider,z,(this.#$.now??Date.now)()),G=X.reading&&Z.normalize(X.reading.entry,X.reading.context);if(X.miss)return{miss:X.miss,...G!==void 0&&{reading:G}};return G===void 0?{miss:"unreachable"}:{reading:G}}catch{return{miss:"unreachable"}}}async pollInsulaQuotaForRoute($,Z){let J=await this.lookupInsulaQuotaForRoute($);if(J.miss==="cold"||J.miss==="upstream-failed"){if(this.#N.get($)!==J.miss)this.#N.set($,J.miss),this.#J.warn("skipped insula provider poll",{reason:J.miss});return}return this.#N.delete($),J.miss?Z():J.reading}#T($){if(!this.#$.insula||!$)return;let Z=this.#U?.source.current(this.#$.insula.provider,$,(this.#$.now??Date.now)());return Z?this.#$.insula.normalize(Z.entry,Z.context):void 0}async authorize($,Z){if(this.#K)return this.#h(this.#K,$,Z);this.#V(Z);let J=this.#X??await this.#R(this.refresh(),Z);if(!J||!await this.#A())throw this.#G?.close(),this.#G=void 0,this.#S(),this.#U?.release(),this.#U=void 0,new P("not-active","Claustrum scoped custody is not active");let z=r(this.#$.rosterPath,await w(this.#$.rosterPath));this.#V(Z);let X=J.rows.find((H)=>H.routeId===$),G=z?.rows.find((H)=>H.routeId===$);if(G&&!G.enabled){if(X)this.#G?.forget(X.credentialId);throw new P("route-declined","Claustrum route is disabled")}if(!X||!G||G.state!=="active"||G.credentialId!==X.credentialId||G.accountIdentity!==X.accountIdentity||G.credentialType!==X.credentialType){if(X)this.#G?.forget(X.credentialId);throw new P("route-unavailable","Claustrum route is disabled, removed or changed")}let Q=await this.#R(this.#L(),Z),W=R0([this.#Z.signal,...Z?[Z]:[]]);try{return await Q.authorize({credentialId:G.credentialId,credentialType:G.credentialType,...G.accountIdentity!==void 0&&{accountIdentity:G.accountIdentity}},W.signal,$)}finally{W.dispose()}}#x(){return{install:($)=>{if(this.#Z.signal.aborted)return;let Z=$.view!==this.#X?.view;if(this.#X=r(this.#$.rosterPath,$),Z)try{this.#$.onRoster?.($)}catch(J){this.#$.onError?.(J)}},reset:()=>{this.#X=void 0},roster:()=>this.#X,projection:()=>({reservedRouteIds:new Set(this.#$.reservedRouteIds?.()??[]),routePrefix:this.#$.routePrefix,mapAccount:this.#$.mapAccount,now:(this.#$.now??Date.now)()}),onError:($)=>{if(!this.#Z.signal.aborted)this.#$.onError?.($)}}}async#y($){let Z=await $.refresh();if(this.#V(),!Z)return;if(Z.errors.has($.provider))throw Z.errors.get($.provider);return this.#X}#g($){if($&&this.#D!==$)return;this.#D?.release(),this.#D=void 0}async#f($,Z){let J=this.#D;if(J&&$.leaseLive(J))return J;this.#g();let z=await $.acquire(Z);if(this.#Z.signal.aborted)z.release(),this.#V();let X=this.#D;if(X&&$.leaseLive(X))return z.release(),X;return this.#D=z,z}async#h($,Z,J){if(this.#V(J),!this.#X)await this.#R($.refresh(),J);let z=this.#X;if(!await $.readAuthority())throw this.#g(),C9();if(this.#V(J),!z)throw new P("route-unavailable","Claustrum has no roster for this provider yet");let X=r(this.#$.rosterPath,await w(this.#$.rosterPath));this.#V(J);let G=z.rows.find((U)=>U.routeId===Z),Q=X?.rows.find((U)=>U.routeId===Z);if(Q&&!Q.enabled){if(G)$.forget(G.credentialId);throw new P("route-declined","Claustrum route is disabled")}if(!G||!Q||Q.state!=="active"||Q.credentialId!==G.credentialId||Q.accountIdentity!==G.accountIdentity||Q.credentialType!==G.credentialType){if(G)$.forget(G.credentialId);throw new P("route-unavailable","Claustrum route is disabled, removed or changed")}let W={credentialId:Q.credentialId,credentialType:Q.credentialType,...Q.accountIdentity!==void 0&&{accountIdentity:Q.accountIdentity}},H=R0([this.#Z.signal,...J?[J]:[]]);try{for(let U=0;;U++){let Y=await this.#f($,H.signal);try{let K=await Y.custody.authorize(W,H.signal,Z);return this.#I.set(K,Y),K}catch(K){if(U>0||H.signal.aborted||$.leaseLive(Y)||!(K instanceof P)||K.kind!=="closed")throw K;if(this.#g(Y),!await $.readAuthority())throw C9()}}}finally{H.dispose()}}async reportFailure($,Z,J){if(this.#V(),this.#K){let z=this.#I.get($);if(!z)throw new P("no-receipt","Claustrum dispatch receipt has no active owner");await z.custody.reportFailure($,Z,J);return}if(!this.#G)throw new P("no-receipt","Claustrum dispatch receipt has no active owner");await this.#G.reportFailure($,Z,J)}async send($,Z,J){let z=J.signal,X=await this.authorize($,z),G=await Z(X,z);if(G.status===401&&X.fromKeptReceipt)return await this.reportFailure(X,401,J.reporterSource??"direct"),G;if(G.status===401&&!z?.aborted){let Q;try{Q=await this.authorize($,z),z?.throwIfAborted()}catch(W){if(z?.aborted)throw W}if(d3(J.site,X,Q,this.#J))await G.body?.cancel().catch(()=>{}),X=Q,G=await Z(Q,z)}if(G.status===401)await this.reportFailure(X,401,J.reporterSource??"direct").catch((Q)=>this.#$.onError?.(Q)),Promise.resolve().then(()=>this.refresh()).catch((Q)=>{if(!this.#Z.signal.aborted)this.#$.onError?.(Q)});return G}async decline($){if(this.#V(),await Z$(this.#$.rosterPath,$),this.#X=r(this.#$.rosterPath,await w(this.#$.rosterPath)),this.#K)this.#K.retainUnion();else this.#G?.retain(this.#X?.rows??[])}async accept($){this.#V(),await J$(this.#$.rosterPath,$),this.#X=r(this.#$.rosterPath,await w(this.#$.rosterPath))}async reorder($){this.#V();let Z=await z$(this.#$.rosterPath,$);return this.#X=r(this.#$.rosterPath,await w(this.#$.rosterPath)),Z}async recordQuota($,Z,J){return this.#V(),X$(this.#$.rosterPath,{routeId:$,observation:Z,credentialId:J.credentialId,accountIdentitySource:J.accountIdentitySource,...J.accountIdentity!==void 0&&{accountIdentity:J.accountIdentity},...J.expectedAccountIdentity!==void 0&&{expectedAccountIdentity:J.expectedAccountIdentity}})}async recordAccountQuota($,Z,J){return this.#V(),G$(this.#$.rosterPath,{routeId:$,accountIdentity:Z,observation:J})}close(){if(this.#Z.signal.aborted)return;if(this.#Z.abort(new P("closed","Claustrum consumer is closed")),this.#H)(this.#$.clearTimeoutImpl??clearTimeout)(this.#H);if(this.#H=void 0,this.#S(),this.#G)this.#G.close(),this.#P(this.#G.dispose(this.#W));this.#D?.release(),this.#D=void 0,this.#K?.detach(),this.#U?.release(),this.#U=void 0,this.#X=void 0,this.#j=void 0,this.#C(),O1(this.#$.rosterPath)}async dispose(){this.close(),this.#F??=Promise.all([r0(this.#q,this.#W),this.#C()]).then(()=>{}),await this.#F}}import{createHash as p8}from"node:crypto";import{readdir as d8,stat as l8}from"node:fs/promises";import{dirname as a8,join as X1}from"node:path";var s8=/^[a-z0-9][a-z0-9._-]{0,63}$/,n8=/^(con|prn|aux|nul|com[0-9]|lpt[0-9])(\.|$)/,i8=/^[0-9a-f]{16}$/,O9=3;function U$($,Z=new Set){if($===null)return"null";if(typeof $==="string"||typeof $==="boolean")return JSON.stringify($);if(typeof $==="number")return Number.isFinite($)?JSON.stringify($):void 0;if(typeof $!=="object"||Z.has($))return;let J=new Set(Z).add($),z=[];if(Array.isArray($)){for(let G=0;G<$.length;G++){let Q=U$($[G],J);if(Q===void 0)return;z.push(Q)}return`[${z.join(",")}]`}let X=Object.getPrototypeOf($);if(X!==Object.prototype&&X!==null)return;for(let G of Object.keys($).sort()){let Q=U$($[G],J);if(Q===void 0)return;z.push(`${JSON.stringify(G)}:${Q}`)}return`{${z.join(",")}}`}function o8($,Z){let J=U$({format:1,classifier:$.classifierInput,members:[...Z].sort(),routePrefix:$.routePrefix??r1,mapAccount:$.mapAccount?String($.mapAccount):null});if(J===void 0)throw new P("invalid-state","Claustrum hub classifierInput must be plain JSON");return p8("sha256").update(J).digest("hex").slice(0,16)}function A9($,Z){if(typeof $!=="string"||!s8.test($)||n8.test($))throw new P("invalid-state",`Claustrum hub ${Z} must be a lowercase file-safe id`);return $}function _0($="Claustrum custody lease is closed"){return new P("closed",$)}function Y$(){return new P("not-active","Claustrum scoped custody is not active")}function I9(){return new t}function r8($,Z){return new Promise((J,z)=>{let X=()=>z(Z.reason);if(Z.addEventListener("abort",X,{once:!0}),$.then((G)=>{Z.removeEventListener("abort",X),J(G)},(G)=>{Z.removeEventListener("abort",X),z(G)}),Z.aborted)X()})}function _9($){return JSON.stringify(($?.rows??[]).map((Z)=>[Z.credentialId,Z.enabled]))}class R9{#$;#Z;#J;#W=new AbortController;#G=new Map;#Q=new WeakMap;#z=0;#X;#j;#H;#Y;#q;#F;#U=0;#M;#B;#N;#_=!1;#C=new Set;#K;#D;#I;constructor($){if(!$.family||!("classify"in $.family))throw new P("wrong-consumer","Claustrum discovery hub requires a classifying family");let Z=A9($.hostGeneration,"host generation"),J=$.members.map((X)=>A9(X,"member"));if(new Set(J).size!==J.length)throw new P("invalid-state","Claustrum hub members must be distinct");this.#$=$,this.#Z=$.logger??H0("claustrum"),this.#J=o0(this.#Z,this.#W.signal),this.#D=X1($.stateDir,"rosters",Z),this.#I=o8($,J);let z=X1(this.#D,this.#I);for(let X of J)this.#G.set(X,{provider:X,path:X1(z,`${X}.json`),closed:!1})}#V($){return this.#C.add($),$.then(()=>this.#C.delete($),()=>this.#C.delete($)),$}#P(){if(this.#W.signal.aborted)throw _0("Claustrum discovery hub is closed")}#A($){let Z=this.#G.get($);if(!Z)throw new P("wrong-consumer","Claustrum hub has no such member");return Z}rosterPath($){return this.#A($).path}member($,Z){this.#P();let J=this.#A($);if(J.hooks)throw new P("wrong-consumer","Claustrum hub member was already built");for(let W of["rosterPath","tokenPath","family","connect","isCustodyActive","insula","pollIntervalMs","routePrefix","mapAccount"])if(W in Z)throw new P("wrong-consumer",`Claustrum hub members cannot take ${W}`);let z={provider:J.provider,start:()=>this.start(),refresh:()=>this.#m(),readAuthority:()=>this.#y(),acquire:(W)=>this.acquire(W),leaseLive:(W)=>this.#O(W),grantReach:(W)=>W!==void 0&&this.#M?.view===W?this.#M.reach:void 0,watchMode:()=>this.watchState(),keptReceiptState:()=>this.keptReceiptState(),retainUnion:()=>this.#w(),forget:(W)=>this.#X?.custody?.forget(W),detach:()=>{J.closed=!0}},X={rosterPath:J.path,...Z.reservedRouteIds&&{reservedRouteIds:Z.reservedRouteIds},...this.#$.routePrefix!==void 0&&{routePrefix:this.#$.routePrefix},...this.#$.mapAccount&&{mapAccount:this.#$.mapAccount},...Z.onRoster&&{onRoster:Z.onRoster},...Z.onError&&{onError:Z.onError},logger:Z.logger??this.#Z,...this.#$.now&&{now:this.#$.now}},{consumer:G,hooks:Q}=P9(z,X);return J.hooks=Q,G}#R(){let $={id:++this.#z,count:0,ended:!1,controller:new AbortController};return this.#X=$,$}#L($){return!$.ended&&this.#X===$&&!this.#W.signal.aborted}#O($){let Z=this.#Q.get($);return!!Z&&!Z.released&&!Z.generation.ended}#k($,Z=_0()){if($.ended)return;if($.ended=!0,$.count=0,this.#X===$)this.#X=void 0;if(this.#H&&this.#Q.get(this.#H)?.generation===$)this.#H=void 0;if(this.#Y?.generation===$)this.#Y.watch.close(),this.#Y=void 0;if($.controller.abort(Z),$.custody)$.custody.close(),this.#V($.custody.dispose(this.#J))}#S($){if($.ended)return;if($.count--,$.count<=0)this.#k($)}#E($){let Z=this.#j;if(Z?.generation===$&&Z.promise)return Z.promise;let J={generation:$,timedOut:!1},z=this.#$.connectTimeoutMs??e1,X,G=this.#$.connect().then((H)=>{if(J.timedOut)throw H.close(),I9();if(!this.#L($)||$.count<=0)throw H.close(),_0("Claustrum connection is no longer wanted");return $.custody=new t0({client:H,family:this.#$.family,tokenPath:this.#$.tokenPath,parseIdentity:this.#$.parseIdentity,requireAssertion:this.#$.requireAssertion,now:this.#$.now,logger:this.#Z,setTimeoutImpl:this.#$.setTimeoutImpl,clearTimeoutImpl:this.#$.clearTimeoutImpl}),$.custody}),Q=new Promise((H,U)=>{X=(this.#$.setTimeoutImpl??setTimeout)(()=>{if(J.timedOut=!0,!this.#L($))return;this.#Z.warn("vault connect timed out",{reason:"unreachable",connectTimeoutMs:z}),U(I9())},z),X.unref?.()});return J.promise=this.#V(Promise.race([G,Q]).finally(()=>{if(X)(this.#$.clearTimeoutImpl??clearTimeout)(X)})),J.promise.finally(()=>{if(this.#j===J)this.#j=void 0}).catch(()=>{}),this.#j=J,J.promise}acquire($){try{if(this.#P(),$?.throwIfAborted(),this.#F===!1)throw Y$()}catch(J){return Promise.reject(J)}let Z=this.#X??this.#R();return Z.count++,this.#b(Z,$,!0)}async#b($,Z,J){let z=$.custody;if(!z){let X=R0([$.controller.signal,...Z?[Z]:[]]);try{z=await r8(this.#E($),X.signal)}catch(G){if(!$.ended)throw this.#S($),G;return this.#T(Z,J)}finally{X.dispose()}}if($.ended)return this.#T(Z,J);if(Z?.aborted)throw this.#S($),Z.reason;return this.#x($,z)}#T($,Z){if($?.throwIfAborted(),this.#P(),this.#F===!1)throw Y$();if(!Z)throw _0();let J=this.#X??this.#R();return J.count++,this.#b(J,$,!1)}#x($,Z){let J={generation:$,custody:Z,released:!1},z=()=>{if(J.released||$.ended)throw _0()},X=Object.freeze({authorize:async(Q,W,H)=>{z();let U=R0([$.controller.signal,...W?[W]:[]]);try{return await Z.authorize(Q,U.signal,H)}finally{U.dispose()}},reportFailure:async(Q,W,H)=>{return z(),Z.reportFailure(Q,W,H)},forget:(Q)=>{z(),Z.forget(Q)},keptReceiptState:()=>{return z(),Z.keptReceiptState()}}),G=Object.freeze({custody:X,generation:$.id,release:()=>{if(J.released)return;J.released=!0,this.#S($)}});return this.#Q.set(G,J),G}leaseState(){let $=this.#X;return Object.freeze({generation:$?.id,count:$?.count??0})}async#y(){let $=await this.#$.isCustodyActive?.()??!0;if(this.#W.signal.aborted)return!1;let Z=this.#F;if(this.#F=$,!$&&Z!==!1)this.#g();return $}#g(){this.#U++;let $=this.#X;if($)this.#k($,Y$());this.#H=void 0,this.#Y?.watch.close(),this.#Y=void 0,this.#M=void 0,this.#B=void 0;for(let Z of this.#G.values())Z.seen=void 0,Z.pending=void 0,Z.hooks?.reset(),O1(Z.path)}#f(){return[...this.#G.values()].filter(($)=>$.hooks&&!$.closed)}async#h(){let $=this.#H,Z=$&&this.#Q.get($);if($&&Z&&this.#O($))return Z;this.#H=void 0;let J=await this.acquire(this.#W.signal),z=this.#H&&this.#Q.get(this.#H);if(this.#H&&z&&this.#O(this.#H))return J.release(),z;this.#H=J;let X=this.#Q.get(J);if(!X)throw _0();return X}#m(){try{this.#P()}catch(z){return Promise.reject(z)}let $=this.#q;if($&&!$.generation?.ended)return $.promise;let Z={},J=this.#V(this.#s(Z).finally(()=>{if(this.#q===Z)this.#q=void 0}));return Z.promise=J,this.#q=Z,J}async#s($){if(!await this.#y())return;let Z=await this.#h(),J=Z.generation;if($.generation=J,!this.#L(J))return;let z=await this.#i().then(()=>{return},(Y)=>Y instanceof Error?Y:Error(String(Y))),X=new Map(await Promise.all([...this.#G.values()].map(async(Y)=>[Y,await w(Y.path).then((K)=>K?{file:K}:{},(K)=>K instanceof Error?K:Error(String(K)))])));if(!this.#L(J))return;let G;try{G=await Z.custody.discover(J.controller.signal)}catch(Y){if(!this.#L(J))return;for(let K of this.#G.values())if(K.pending)this.#v(K);throw Y}if(!this.#L(J))return;let Q=this.#f(),W=await Promise.all(Q.map((Y)=>Y.hooks&&!Y.closed?this.#n(Y,Y.hooks,G,z??X.get(Y),J):void 0));if(!this.#L(J))return;let H=new Map,U=!0;for(let[Y,K]of Q.entries()){let M=K.hooks,F=W[Y];if(!M||!F)continue;if("error"in F){let{error:L}=F;if(U=!1,this.#v(K),U9(K.path,L))this.#Z.debug("claustrum hub member commit refused",{member:K.provider});else H.set(K.provider,L);continue}let{roster:D}=F;if(!this.#L(J))return;if(D?.view!==G.view)U=!1,this.#v(K);else K.pending=void 0;if(!D)continue;if(this.#u(M,D)){U=!1,this.#v(K);continue}if(K.seen=JSON.stringify(Q9(D)),!K.closed)M.install(D)}if(!this.#L(J))return;if(this.#w(),U)this.#M=Object.freeze({view:G.view,...G.grantReach&&{reach:G.grantReach},refused:Object.freeze([...G.refused??[]]),notMine:G.notMine??0});return this.#B=(this.#$.now??Date.now)(),{errors:H}}async#n($,Z,J,z,X){let G={...J,credentials:J.credentials.filter((Q)=>Q.member===$.provider),skipped:J.skipped.filter((Q)=>Q.member===$.provider)};try{if(!z)throw _0("Claustrum hub member has no base view");if(z instanceof Error)throw z;let Q=z.file?void 0:await this.#o($);return{roster:await A1({path:$.path,custody:{discover:async()=>G},isActive:()=>this.#L(X)&&this.#F===!0,signal:X.controller.signal,projection:()=>({...Z.projection(),...Q&&{seed:Q}}),listedOver:{view:z.file?.view}})}}catch(Q){return{error:Q}}}async#i(){for(let $ of[a8(this.#D),this.#D,X1(this.#D,this.#I)])await i0($,{},"roster directory")}async#o($){let Z=`${$.provider}.json`,J=[X1(this.#D,Z)];try{for(let X of await d8(this.#D))if(X!==this.#I&&i8.test(X))J.push(X1(this.#D,X,Z))}catch{}let z;for(let X of J)try{let G=(await l8(X)).mtimeMs,Q=await w(X);if(Q&&(!z||G>z.modified))z={modified:G,roster:Q}}catch{}return z&&e3(z.roster)}#u($,Z){let J=$.projection().reservedRouteIds;return!!J?.size&&Z.rows.some((z)=>J.has(z.routeId))}#v($){let Z=($.pending?.failures??0)+1,J=Math.max(1,this.#$.pollIntervalMs??5000),z=Math.max(1,Math.ceil(d0/J)),X=Z<=O9?1:Math.min(2**(Z-O9),z);$.pending={failures:Z,wait:X-1}}#w(){let $=this.#X?.custody;if(!$)return;$.retain(this.#f().flatMap((Z)=>Z.hooks?.roster()?.rows??[]))}async#r(){let $=this.#U;for(let Z of this.#f()){let J;try{J=await w(Z.path)}catch(W){Z.hooks?.onError(W);continue}if($!==this.#U||this.#F!==!0)return;let z=Z.hooks;if(!J||!z||Z.closed)continue;let X=JSON.stringify(J);if(X===Z.seen)continue;let G=z.roster();if(!G||G.view!==J.view||this.#u(z,J)){Z.pending??={failures:0,wait:0};continue}let Q=_9(G);if(Z.seen=X,z.install(J),_9(z.roster())!==Q)this.#w()}}#t(){let $=!1;for(let J of this.#G.values()){if(!J.pending)continue;if(J.pending.wait<=0)$=!0;else J.pending.wait--}if(this.#Y?.watch.mode!=="watching"||$)return!0;let Z=(this.#$.now??Date.now)();return this.#B===void 0||Z-this.#B>=d0}#e(){let $=this.#H,Z=$&&this.#Q.get($);if(!$||!Z||!this.#O($)||this.#F!==!0)return;let J=Z.generation;if(!this.#L(J)||this.#Y?.generation===J)return;let z=Z.custody.watchRoster({view:()=>this.#M?.view,onView:()=>this.#V((async()=>{while(this.#q)await this.#q.promise.catch(()=>{});if(!this.#L(J))return;await this.#l()})()),onRefused:(X)=>this.#p(X),onError:(X)=>this.#c(X)});this.#Y={generation:J,watch:z}}#c($){if(!this.#W.signal.aborted)this.#$.onError?.($)}#p($){if(this.#W.signal.aborted)return;this.#$.onError?.($);for(let Z of this.#f())Z.hooks?.onError($)}#d($){for(let[Z,J]of $?.errors??[])this.#G.get(Z)?.hooks?.onError(J)}async#l(){let $;try{$=await this.#m()}catch(Z){this.#p(Z);return}this.#d($)}async#a(){try{if(await this.#y()){if(await this.#r(),this.#t())await this.#l();this.#e()}}catch(Z){this.#c(Z)}if(this.#W.signal.aborted)return;let $=this.#$.pollIntervalMs??5000;if($<=0)return;this.#N=(this.#$.setTimeoutImpl??setTimeout)(()=>{this.#N=void 0,this.#V(this.#a())},$),this.#N.unref?.()}start(){if(this.#_)return;this.#P(),this.#_=!0,this.#V(this.#a())}async refresh(){this.#d(await this.#m())}refusals(){let $=this.#M;return $&&Object.freeze({view:$.view,refused:$.refused,notMine:$.notMine})}grantReach(){return this.#M?.reach}watchState(){let $=this.#Y;return $&&this.#L($.generation)?$.watch.mode:"polling"}keptReceiptState(){return this.#X?.custody?.keptReceiptState()??Object.freeze({active:!1,since:null})}close(){if(this.#W.signal.aborted)return;if(this.#W.abort(_0("Claustrum discovery hub is closed")),this.#N)(this.#$.clearTimeoutImpl??clearTimeout)(this.#N);this.#N=void 0;let $=this.#X;if($)this.#k($);this.#H=void 0,this.#Y?.watch.close(),this.#Y=void 0}async dispose(){this.close(),this.#K??=r0(this.#C,this.#J),await this.#K}}var g0={opencode:$6,pi:Z6};function q$($,Z){let{tokenPath:J}=S9($,Z);return{stateDir:e8(J),host:$,override:J}}function K$($,Z){return J6($==="pi"?Z.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE:void 0,$==="pi"?{...Z,OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE:void 0}:Z)}class y0 extends Error{code;constructor($){super($==="permission-refused"?"Native vault setup: permission-refused. Could not grant this host read access to native Claude accounts. An older ck may refuse a grant that already exists. Update CortexKit tools and run setup again.":`Native vault setup: ${$}`);this.code=$;this.name="NativeVaultEnrollmentError"}}function V$($,Z){let J=Z??g0[$];if(typeof J!=="string"||!/^[A-Za-z0-9_-]{1,128}$/.test(J))throw new y0("permission-refused");return["auth","grant","--principal",`enrolled:${J}`,"--selector-kind","category","--selector","anthropic-native","--operation","read"]}async function k9($,Z){try{await Z.processFence();let J=await a1(Z.paths??S9($,Z.env),g0[$]);if(J.state==="blocked")throw new y0("permission-refused");let z=J.state==="approved"?J.approvedName:void 0,X=V$($,z);if((await Z.runner.run(Z.ckBinary??"ck",X,{env:Z.env})).exitCode!==0)throw new y0("permission-refused");return z}catch{throw new y0("permission-refused")}}import{createHash as Y6}from"node:crypto";import{lstat as U6,mkdir as q6,readFile as w9}from"node:fs/promises";import{dirname as K6}from"node:path";import{assertHostsStopped as V6,canonicalPath as B$,createNativeAccountRuntime as F6,custodyTombstoneOAuth as B6,inspectNativeHostAuthEntry as u9,NativeMigrationError as v0,nativeJournalMayAdoptLaterHostLogin as j6,nativePoolHoldsAccountData as M6,prepareNativeMigration as D6,readNativeEnrollmentMode as c9,readNativeMigrationJournal as N6,releaseNativeMigrationPreflight as L6,requireNoSupervisedAuthContentSnapshot as C6,runNativeMigration as P6,writeNativeHostAuth as O6}from"@cortexkit/anthropic-auth-core";import{dirname as z6,join as T9,resolve as F$}from"node:path";import{ACCOUNT_FILE_NAME as b9,ACCOUNT_STATE_FILE_NAME as X6,canonicalPath as E9,getStickyRoutingStatePath as G6,resolveLocalRoutingDestination as Q6,resolveNativePoolPaths as W6}from"@cortexkit/anthropic-auth-core";async function M0($,Z){let J=$==="pi"?y9(Z):f9(Z),z=$==="pi"?Z.PI_ANTHROPIC_AUTH_FILE?.trim():Z.OPENCODE_ANTHROPIC_AUTH_FILE?.trim(),X=F$(z||T9(J,b9)),G=F$(Z.OPENCODE_ANTHROPIC_AUTH_STATE_FILE?.trim()||(X.endsWith(b9)?T9(z6(X),X6):`${X}.state.json`)),Q=await W6(X,G),W=$==="pi"?Z.PI_ANTHROPIC_AUTH_ROUTING_STATE_FILE?.trim():Z.OPENCODE_ANTHROPIC_AUTH_ROUTING_STATE_FILE?.trim();return{host:$,paths:Q,legacyConfigPath:X,legacyStatePath:G,hostAuthPath:$==="pi"?g9(Z):x9(Z),routingSourcePath:F$(W||G6(X)),routingDestinationPath:Q6($,Q,Z)}}async function v9($){let Z=new Map;for(let J of $){let z=new Set;for(let[X,G]of[J.paths.legacyConfig,J.paths.legacyState,J.paths.config,J.paths.state,J.paths.runtime,J.paths.roster,J.paths.journal,J.hostAuthPath,J.routingSourcePath,J.routingDestinationPath].entries()){let Q=await E9(G);if(z.has(Q)&&!(X===9&&Q===await E9(J.routingSourcePath)))throw Error("Native setup storage paths overlap");let W=Z.get(Q);if(W!==void 0&&W!==J.host)throw Error("Native setup storage paths overlap between selected hosts");Z.set(Q,J.host),z.add(Q)}}}import{types as H6}from"node:util";var h9=new WeakMap;function m9($){return typeof $==="object"&&$!==null?h9.get($):void 0}function G1($){if(!$||typeof $!=="object"||H6.isProxy($))return;if(Object.getOwnPropertyDescriptor($,"name")?.value==="ProcessInspectionError"&&Object.getOwnPropertyDescriptor($,"code")?.value==="process-inspection-failed")return"Process inspection failed; setup cannot prove hosts are stopped.";return}class i extends Error{constructor($){super($);this.name="SetupRefusal",h9.set(this,$)}}var j$="OpenCode's separate Anthropic login is not used. Add that account through /claude Accounts if needed, or remove the separate login from OpenCode.";function p9($){let Z=$==="opencode"?"OpenCode":"Pi";return`${Z} is still connected to the vault. Old local settings do not disconnect it. In ${Z}, run /claude → Accounts → Disconnect from the vault. Then run local setup again.`}async function M$($,Z){let J=[];for(let z of $)if(await c9(z,Z)!=="local")J.push(p9(z));if(J.length)throw new i(J.join(`
-`))}function h0($,Z){return async()=>{C6(Z.env);try{await V6(Z.fence,Z.env)}catch(J){let z=G1(J);if(z)throw new i(z);throw J}await M$([$],Z.env)}}async function D$($){try{return Y6("sha256").update(await w9($)).digest("hex")}catch(Z){if(Z.code==="ENOENT")return"absent";throw new v0("unsafe-source")}}async function I1($,Z){let J;try{J=JSON.parse(await w9(Z,"utf8"))}catch(G){if(G.code!=="ENOENT")throw new v0("unsafe-source")}let z=u9($,J),X=J?.anthropic;return{...z,realLogin:z.kind==="oauth"&&Boolean(X?.access&&X.refresh)}}async function $3($,Z){let{paths:J}=$,z=$.generation2?void 0:await I1(J.host,J.hostAuthPath),X=await Promise.all([J.paths.config,J.paths.state,J.paths.runtime,J.paths.roster,J.paths.journal,J.routingDestinationPath].map(D$));return JSON.stringify([await c9(J.host,Z),z?.digest,...X])}async function N$($,Z,J){let z=Z.paths??await M0($,Z.env),X=h0($,Z);await X();let G=await N6(z.paths);if(G&&G.host!==$)throw new v0("invalid-source");let Q=G?.phase==="committed"||G?.phase==="retired";if(G&&G.kind!=="empty-init"&&(G.hostAuthPath!==await B$(z.hostAuthPath)||G.routingPaths.source!==await B$(z.routingSourcePath)||G.routingPaths.destination!==await B$(z.routingDestinationPath)))throw new v0("invalid-source");let W={paths:z,generation2:J,action:"migration",notice:!1,fingerprint:"",authorityPhase:G?.phase??"absent",poolPopulation:"not-evaluated"};if(J){if(G&&!Q)throw new v0("invalid-source");if(W.action=G?"reuse":"empty-init",!G){let H=[z.paths.config,z.paths.state,z.paths.runtime,z.paths.roster];if(!Z.env.OPENCODE_ANTHROPIC_AUTH_ROUTING_STATE_FILE)H.push(z.routingDestinationPath);for(let U of H){try{await U6(U)}catch(Y){if(Y.code==="ENOENT")continue;throw new v0("unsafe-source")}throw new v0("invalid-source")}}}else{W.slot=await I1($,z.hostAuthPath);let H=j6(G,$)&&W.slot.kind==="oauth";W.poolPopulation=G?.kind==="empty-init"||H?await M6({paths:z.paths}):"not-evaluated";let U=W.poolPopulation===!0;if($==="opencode"&&(U||Q&&G?.kind!=="empty-init"&&!H&&W.slot.kind==="oauth"))W.action="skip",W.notice=W.slot.realLogin;else W.preflight=await D6({...z,env:Z.env,processFence:X,removePiAnthropicAuth:Z.removePiAnthropicAuth})}return W.fingerprint=await $3(W,Z.env),W}async function Q1($,Z){await h0($.paths.host,Z)();let J=await N$($.paths.host,{...Z,paths:$.paths},$.generation2);try{if(J.fingerprint!==$.fingerprint||J.action!==$.action)throw new i("Setup inputs changed. Rerun setup with all hosts stopped.")}finally{if(J.preflight)L6(J.preflight)}}async function L$($,Z){if($.paths.host!=="opencode"||$.slot?.kind!=="absent")return;let J=h0("opencode",Z);await J(),await q6(K6($.paths.hostAuthPath),{recursive:!0,mode:448}),await O6({host:"opencode",authPath:$.paths.hostAuthPath,sourceDigest:"absent",expectedDigest:u9("opencode",{anthropic:B6("anthropic")}).digest,env:Z.env,removePiAnthropicAuth:!1,processFence:J})}async function d9($,Z){let J={...Z.env},z=h0($,{...Z,env:J});await z();let X=Z.paths??await M0($,J),G=await Z.login?.($);if(G&&!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(G.accountIdentity))throw Error("Claude sign-in did not establish an account UUID");if(await z(),await Z.beforeCommit?.(),!Z.skipMigration)await P6({paths:X.paths,legacyConfigPath:X.legacyConfigPath,legacyStatePath:X.legacyStatePath,host:$,hostAuthPath:X.hostAuthPath,routingSourcePath:X.routingSourcePath,routingDestinationPath:X.routingDestinationPath,env:J,processFence:z,removePiAnthropicAuth:Z.removePiAnthropicAuth,preflight:Z.preflight});if(G){let Q=F6({paths:X.paths,host:$,vault:{env:J},beforePoolWrite:z});try{if((await Q.read()).mode!=="local")throw new i(p9($));await z(),await Q.loginOAuth({routeId:"main",replace:!0,...G})}finally{await Q.close()}}if(Z.skipMigration){let Q=await I1($,X.hostAuthPath);await L$({paths:X,slot:Q},Z)}}var l9={opencode:"OpenCode",pi:"Pi"};function E6($,Z,J){switch($){case"auth-content-refused":return"Run setup without OPENCODE_AUTH_CONTENT in the environment.";case"host-auth-invalid":return"The host auth file could not be read safely.";case"primary-conflict":return"Pi has a stored Anthropic API key, which would take precedence over the vault account. Remove it in Pi, then rerun setup.";case"consent-required":return"Pi has stored Anthropic authentication. Explicit consent is required to move it aside for vault use.";case"primary-unverified":return"The vault has no verified default Claude account. Sign in through the vault and rerun setup.";case"no-read-grant":return`${l9[Z]} has no read grant in the vault, so setup cannot see any Claude login. Run ${["ck",...V$(Z,J)].join(" ")}, then rerun setup.`;case"grant-reaches-nothing":return`${l9[Z]}'s vault read grant reaches no Claude login: no vault login carries the anthropic-native category, which logins saved before vault categories existed lack. Run ck auth reclassify --from-registry, check the logins with ck auth status, then rerun setup.`}}class z0 extends Error{host;approvedName;code;constructor($,Z="opencode",J){super(E6($,Z,J));this.host=Z;this.approvedName=J;this.name="NativeVaultActivationError",this.code=$}}function f6($){let Z=$?.grantReach;if(!Z||$.credentials.length>0||$.skipped.length>0)return"primary-unverified";return Z.grants===0?"no-read-grant":"grant-reaches-nothing"}async function P$($){try{return JSON.parse(await A6($,"utf8"))}catch(Z){if(Z.code==="ENOENT")return;throw new z0("host-auth-invalid")}}async function _1($,Z){if($==="opencode")return"opencode";let J=Z.paths??await M0($,Z.env),z=C$($,await P$(J.hostAuthPath)),X=O$({env:Z.env,authPath:J.hostAuthPath}),{stashPath:G}=k6({env:Z.env,authPath:J.hostAuthPath});return JSON.stringify([z.digest,await X.inspect(),await D$(G)])}async function a9($){try{b6($.env)}catch{throw new z0("auth-content-refused")}try{await I6($.fence,$.env)}catch(Z){let J=G1(Z);if(J)throw new i(J);throw Z}}async function s9($,Z){let J={...Z.env};await(()=>a9({...Z,env:J}))();let X=Z.paths??await M0($,J),G=$==="opencode"&&Z.inspectOpenCodeAuth!==!1&&C$("opencode",await P$(X.hostAuthPath)).kind==="oauth";if($==="pi"){let Q=C$("pi",await P$(X.hostAuthPath)),W=await O$({env:J,authPath:X.hostAuthPath}).inspect();if(W.slot==="placeholder"&&W.stash==="missing")throw new S6("missing-stash");if(Q.kind!=="absent"&&W.slot!=="placeholder"&&!Z.removePiAnthropicAuth)throw new z0("consent-required")}return{priorMode:await T6($,J),fingerprint:await _1($,{...Z,env:J}),separateOpenCodeLogin:G}}async function n9($,Z,J){let z={...Z.env},X=()=>a9({...Z,env:z});await X();let G=Z.paths??await M0($,z);if(await _1($,Z)!==J.fingerprint)throw new z0("host-auth-invalid");let Q=await k9($,{env:z,runner:Z.runner,processFence:X,ckBinary:Z.enrollment?.ckBinary,paths:Z.enrollment?.paths}),W=Z.discover??(()=>R6({paths:G.paths,host:$,env:$==="pi"?{...z,OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE:z.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE}:z})),H,U=async()=>{return H=await W(),H},Y=_6({paths:G.paths,host:$,vault:{env:z,discover:U}});try{await X(),await Y.vault.refresh();let K=await Y.read(),M=K.accounts.find((F)=>F.id==="main");if(K.mode!=="claustrum"||!M?.accountIdentity||M.source!=="vault"){let F=f6(H);throw F==="primary-unverified"?new z0(F):new z0(F,$,Q)}if(await X(),$==="pi")await O$({env:z,authPath:G.hostAuthPath}).enterVault();return J.priorMode==="claustrum"?"already-vault":"committed"}finally{await Y.close()}}var x6=/(?:^|[/\\])(opencode|litecode|opencode2|pi)(?:\.exe)?(?=$|\s|")/i;class A$ extends Error{activeHosts;constructor($){let Z=$.map((z)=>({pid:z.pid,command:x6.exec(z.command)?.[1]??"host"})),J=Z.map((z)=>`  - PID ${z.pid}: ${z.command}`).join(`
+import{y as D3}from"./index-m4dazzyf.js";import{A as Z7,B as J7,C as v9,D as h9,E as m9,F as w9,G as z7}from"./index-naff9h33.js";import{ia as c4,ja as _Z,ka as k3}from"./index-71temqvq.js";var n$=_Z((qq,m4)=>{var s$={to($,Z){if(!Z)return`\x1B[${$+1}G`;return`\x1B[${Z+1};${$+1}H`},move($,Z){let J="";if($<0)J+=`\x1B[${-$}D`;else if($>0)J+=`\x1B[${$}C`;if(Z<0)J+=`\x1B[${-Z}A`;else if(Z>0)J+=`\x1B[${Z}B`;return J},up:($=1)=>`\x1B[${$}A`,down:($=1)=>`\x1B[${$}B`,forward:($=1)=>`\x1B[${$}C`,backward:($=1)=>`\x1B[${$}D`,nextLine:($=1)=>"\x1B[E".repeat($),prevLine:($=1)=>"\x1B[F".repeat($),left:"\x1B[G",hide:"\x1B[?25l",show:"\x1B[?25h",save:"\x1B7",restore:"\x1B8"},RZ={up:($=1)=>"\x1B[S".repeat($),down:($=1)=>"\x1B[T".repeat($)},SZ={screen:"\x1B[2J",up:($=1)=>"\x1B[1J".repeat($),down:($=1)=>"\x1B[J".repeat($),line:"\x1B[2K",lineEnd:"\x1B[K",lineStart:"\x1B[1K",lines($){let Z="";for(let J=0;J<$;J++)Z+=this.line+(J<$-1?s$.up():"");if($)Z+=s$.left;return Z}};m4.exports={cursor:s$,scroll:RZ,erase:SZ,beep:"\x07"}});import{stdin as jJ,stdout as MJ}from"node:process";import{createInterface as DJ}from"node:readline/promises";import{authorize as NJ,createNativeAccountRuntime as LJ,decideOpenCodeStateLayoutOnce as PJ,exchange as CJ,formatNativeAccountState as OJ,generateRelayToken as AJ,getAccountStoragePath as IJ,isValidApiBaseURL as _J,readNativeEnrollmentMode as RJ,resolveNativePoolPaths as SJ,WORKER_SCRIPT as kJ}from"@cortexkit/anthropic-auth-core";import{randomUUID as u6}from"node:crypto";import{constants as z3}from"node:fs";import{lstat as c6,mkdir as p6,open as d6}from"node:fs/promises";import{homedir as l6}from"node:os";import{isAbsolute as a6,join as J4}from"node:path";import{types as T$}from"node:util";import{anthropicAuthStateRoot as s6,createProviderErrorRedactor as z4,createWindowsOwnerOnly as n6,ensureWindowsOwnerOnlyDirectory as i6,formatLogLine as o6,HOLDER_REGISTRATION_ERROR_MESSAGES as r6,isOwnerOnly as t6,isSecretKey as e6,isStateLayoutRefusalCode as $5,NativeMigrationError as Z5,NativePiAuthSlotError as J5,PRIVATE_FILES_UNAVAILABLE_MESSAGE as X4,RELOCATED_MESSAGE as z5,STATE_LAYOUT_REFUSAL_CODES as X5,STATE_LAYOUT_REFUSAL_PUBLIC_MESSAGES as G5,setupEnrollment as Q5,stateLayoutRefusalPublicMessage as W5}from"@cortexkit/anthropic-auth-core";import{readFile as T6}from"node:fs/promises";import{assertHostsStopped as E6,createNativeAccountRuntime as b6,discoverNativeVaultInventory as f6,inspectNativeHostAuthEntry as A$,NativePiAuthSlotError as x6,nativePiAuthSlotPaths as y6,openNativePiAuthSlot as _$,readNativeEnrollmentMode as g6,requireNoSupervisedAuthContentSnapshot as v6}from"@cortexkit/anthropic-auth-core";import{dirname as G6}from"node:path";import{CLAUSTRUM_OPENCODE_ENROLLMENT_NAME as Q6,CLAUSTRUM_PI_ENROLLMENT_NAME as W6,getHostClaustrumEnrollmentPaths as b9,resolveClaustrumConnectionPath as H6}from"@cortexkit/anthropic-auth-core";import{writeEnrollmentTokenFile as CQ}from"@cortexkit/claustrum-client";import{ClaustrumClient as ZQ}from"@cortexkit/claustrum-client";import{ClaustrumCredentialError as Y7}from"@cortexkit/claustrum-client";import{SocketClosedError as U7,SocketTimeoutError as q7,SubcCallError as K7}from"@cortexkit/subc-client";class O extends Error{kind;constructor($,Z){super(Z);this.name="ClaustrumConsumerError",this.kind=$}}var A3=Object.freeze({ECONNREFUSED:"unreachable",ENOENT:"unreachable",ECONNRESET:"unreachable",EPIPE:"unreachable",ETIMEDOUT:"unreachable",transport_error:"unreachable",unavailable:"unreachable",timeout:"unreachable",route_closed:"unreachable",daemon_draining:"unreachable",connection_closed:"unreachable",connection_dropped:"unreachable",request_deadline:"unreachable",deadline_exceeded_no_drop_observed:"unreachable",module_reloading:"unreachable",module_warming:"unreachable",target_unavailable:"unreachable",module_timeout:"unreachable",invalid_response:"answered",invalid_record_version:"answered",invalid_expiry:"answered",invalid_status:"answered",invalid_params:"answered",ttl_unsatisfiable:"answered",not_found:"answered",enrollment_revoked:"answered",enrollment_invalid:"answered",grant_denied:"answered",credential_unavailable:"answered",needs_reauth:"answered",declined:"answered",disabled:"answered",identity_changed:"answered",closed:"answered",client_closed:"answered",pending_exists:"answered",pending_queue_full:"answered",already_consumed:"answered",superseded:"answered",stale_generation:"answered",missing_identity:"answered",invalid_control_body:"answered",unknown_module:"answered",module_removed:"answered",capability_denied:"answered",unknown_channel:"unreachable",stale_route_epoch:"unreachable",capability_forbidden:"answered",capability_unprovided:"answered",capability_ambiguous:"answered",invalid_capability_identifier:"answered",binary_body_required:"answered",binary_call_requires_call_binary:"answered",corr_exhausted:"answered",late_route_cleanup_failed:"answered",reverse_request_capability_not_declared:"answered",stale_route_handle:"answered",reverse_request_unhandled:"answered",handler_error:"answered",health_error:"answered",duplicate_module_id:"answered",route_rejected:"answered",lock_busy:"answered",owner_invalid:"answered",renewal_failed:"answered",unsupported_platform:"answered",EACCES:"answered",EPERM:"answered",ERR_PRIVATE_FILES_SECURITY:"answered"});class r extends O{constructor(){super("unavailable","Claustrum scoped operation unavailable");this.name="ClaustrumUnreachableError"}}function N0($){if($ instanceof r||$ instanceof U7||$ instanceof q7)return"unreachable";let Z=$ instanceof Y7||$ instanceof K7?$.code:$ instanceof Error&&("code"in $)?$.code:void 0;if(typeof Z!=="string"||!Object.hasOwn(A3,Z))return"answered";return A3[Z]}import{resolve as z2}from"node:path";import{storeIdentity as nJ}from"@cortexkit/claustrum-client";import{SubcClient as oJ}from"@cortexkit/subc-client";var a0=300000,v1=300000,I3=1000;class B1{#$;#Z=0;restart(){this.#Z=0}continuous($){let Z=$.kind==="changed"&&$.seq===this.#Z+1&&(this.#$===void 0||$.epoch===this.#$);return this.#$=$.epoch,this.#Z=$.seq,Z}}class h1{#$;#Z;#J;#W=!1;constructor($,Z){this.#$=$,this.#Z=Z}get running(){return this.#J}request(){if(this.#J)return this.#W=!0,this.#J;return this.#J=(async()=>{do{this.#W=!1;try{await this.#$()}catch($){this.#Z($)}}while(this.#W)})().finally(()=>{this.#J=void 0}),this.#J}}class m1{#$;#Z=new B1;#J;#W="polling";#G;#Q;#z=!1;#X;#j=!1;#H=0;constructor($){this.#$=$,this.#J=new h1(async()=>{let Z=this.#j;if(this.#j=!1,Z||this.#X!==this.#$.view())await this.#$.discover(this.#X??"")},(Z)=>{if(!this.#z)this.#$.onError?.(Z)})}get mode(){return this.#W}start(){if(this.#z||this.#G||this.#Q)return;if(typeof this.#$.client.watchScoped!=="function"){this.#Y("fallback","client-without-watch");return}this.#V(!1)}stop(){if(this.#z)return;if(this.#z=!0,this.#Q)(this.#$.clearTimeoutImpl??clearTimeout)(this.#Q);this.#Q=void 0;let $=this.#G;this.#G=void 0,$?.handle.stop()}#Y($,Z){if(this.#W===$)return;this.#W=$,this.#$.logger?.debug("claustrum vault watch",{mode:$,reason:Z}),this.#$.onMode?.($)}#q($,Z){this.#Q=(this.#$.setTimeoutImpl??setTimeout)(()=>{if(this.#Q=void 0,!this.#z)Z()},$),this.#Q.unref?.()}async#V($){let Z;try{Z=await this.#$.enrollmentToken()}catch(Q){if(this.#z)return;this.#$.onError?.(Q),this.#M("token-unreadable");return}let J=this.#$.client.watchScoped;if(this.#z||this.#G||!J)return;this.#Z.restart(),this.#j=$;let z,X;try{X=J.call(this.#$.client,(Q)=>{if(this.#z||!z||this.#G!==z)return;if(z.notices++,z.notices===1)this.#$.onReachable?.(),z.acceptedAt=(this.#$.now??Date.now)(),this.#Y("watching","accepted");if(!this.#Z.continuous(Q))this.#j=!0;this.#X=Q.view,this.#J.request()},{enrollmentToken:Z})}catch(Q){this.#$.onError?.(Q),this.#M("watch-failed");return}z={handle:X,notices:0},this.#G=z,this.#Y("polling",$?"resubscribing":"opening");let G=z;X.closed.then((Q)=>this.#U(G,Q),(Q)=>this.#U(G,{kind:"transport_lost",error:Q}))}#U($,Z){if(this.#z||this.#G!==$)return;if(this.#G=void 0,Z.kind==="stopped")return;if(Z.kind==="transport_lost")this.#$.onTransportLost?.();if(Z.kind==="unsupported"){this.#Y("fallback","vault-without-watch");return}if(Z.kind==="refused"){this.#M("refused");try{this.#$.onRefused(Z.error)}catch(J){this.#$.onError?.(J)}return}if($.notices>0){let J=(this.#$.now??Date.now)();if($.acceptedAt!==void 0&&J-$.acceptedAt>=300000)this.#H=0;let z=Math.min(1000*2**Math.min(this.#H,16),300000);this.#H++,this.#Y("polling","resubscribing"),this.#q(z,()=>void this.#V(!0));return}this.#M(Z.kind)}#M($){this.#Y("fallback",$),this.#q(300000,()=>void this.#V(!1))}}var u1=60000,X2=4*u1,F7=2*u1,_3=new Map,w1=new Map;function j1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function V7($){let Z;try{Z=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode($))}catch{return}if(!j1(Z)||typeof Z.kind!=="string"||typeof Z.epoch!=="string"||Z.epoch.length===0||typeof Z.seq!=="number"||!Number.isSafeInteger(Z.seq)||Z.seq<1||Z.provider!==void 0&&typeof Z.provider!=="string")return;return{kind:Z.kind,epoch:Z.epoch,seq:Z.seq,...typeof Z.provider==="string"&&{provider:Z.provider}}}function B7($){return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:void 0}class G2{transport;key;#$=[];#Z=!1;#J=new Set;#W=new Map;#G=new h1(async()=>{try{let $=await this.transport.getUsage();if(!j1($)||!Array.isArray($.result)||$.error!==void 0)throw Error("unavailable insula usage");this.#$=$.result.filter((Z)=>j1(Z)&&typeof Z.provider==="string"),this.#Z=this.#$.length===$.result.length&&($.completeProviders===void 0||Array.isArray($.completeProviders)&&$.completeProviders.every((Z)=>typeof Z==="string")),this.#J=new Set(this.#Z&&Array.isArray($.completeProviders)?$.completeProviders:[]);for(let Z of this.#J)this.#W.delete(Z)}catch{this.#$=[],this.#Z=!1,this.#J.clear()}},()=>{});#Q=new B1;#z="polling";#X=0;#j=0;#H=new Map;#Y;#q;#V={};#U=0;constructor($,Z){this.transport=$,this.key=Z}refresh($){if(this.#G.running)return this.#G.running;if(this.#z==="watching")return Promise.resolve();for(let[J,z]of w1)if($-z>=u1)w1.delete(J);let Z=w1.get(this.key);if(Z!==void 0&&$-Z<u1)return Promise.resolve();return w1.set(this.key,$),this.#G.request()}watchMode(){return this.#z}watch($={}){this.#X++;let Z=$.provider;if(Z===void 0)this.#j++;else this.#H.set(Z,(this.#H.get(Z)??0)+1);if(this.#X===1)this.#V=$,this.#N();let J=!1;return()=>{if(J)return;if(J=!0,Z===void 0)this.#j--;else{let z=(this.#H.get(Z)??1)-1;if(z>0)this.#H.set(Z,z);else this.#H.delete(Z)}if(--this.#X===0)this.#M()}}#M(){if(this.#q)(this.#V.clearTimeoutImpl??clearTimeout)(this.#q);this.#q=void 0;let $=this.#Y;this.#Y=void 0,$?.handle?.stop(),this.#z="polling"}#B($){this.#q=(this.#V.setTimeoutImpl??setTimeout)(()=>{if(this.#q=void 0,this.#X>0&&!this.#Y)this.#N()},$),this.#q.unref?.()}#N(){let $=this.transport.watchUsage;if(!$){this.#z="fallback";return}this.#z="polling",this.#Q.restart();let Z={notices:0};this.#Y=Z;let J;try{J=$.call(this.transport,(z)=>this.#_(Z,z))}catch(z){this.#P(Z,z);return}Z.handle=J,J.closed.then(()=>this.#P(Z,void 0),(z)=>this.#P(Z,z))}#_($,Z){if(this.#Y!==$)return;if($.notices++,$.notices===1)this.#z="watching";if($.notices===2)this.#U=0;let J=V7(Z);if(!J)this.#Q.restart();if(!(J?this.#Q.continuous(J):!1)||J?.provider===void 0||this.#j>0||this.#H.has(J.provider))this.#G.request()}#P($,Z){if(this.#Y!==$)return;this.#Y=void 0;let J=B7(Z);if(J==="unknown_method"||J==="usage_watch_limit"){this.#z="fallback";return}if($.notices>0){let z=Math.min(I3*2**Math.min(this.#U,16),v1);this.#U++,this.#z="polling",this.#B(z);return}if(this.#z="fallback",this.#G.request(),Z===void 0||N0(Z)==="unreachable")this.#B(v1)}current($,Z,J){for(let z of this.#$){if(z.provider!==$||typeof z.account!=="string"||z.account.trim()!==Z)continue;if(z.stale!==void 0||z.errorClass!==void 0||!j1(z.usage))continue;let X=typeof z.fetchedAt==="string"?Date.parse(z.fetchedAt):Number.NaN;if(!Number.isFinite(X)||J-X>=X2)continue;return{entry:z,context:{fetchedAt:X,...typeof z.source==="string"&&{source:z.source}}}}return}lookup($,Z,J){if(!this.#Z)return{miss:"unreachable"};let z=this.#$.find((Q)=>Q.provider===$&&typeof Q.account==="string"&&Q.account.trim()===Z),X=(z??this.#$.find((Q)=>Q.provider===$&&Q.account===void 0&&Q.errorClass!==void 0))?.errorClass;if(X==="upstream_failed")return{miss:"upstream-failed"};if(X==="credential_absent"||X==="credential_unusable"||X==="credential_rejected")return{miss:"credential"};if(X!==void 0)return{miss:"unreachable"};if(z){let Q=typeof z.fetchedAt==="string"?Date.parse(z.fetchedAt):Number.NaN;if(!j1(z.usage)||!Number.isFinite(Q))return{miss:"unreachable"};let W={entry:z,context:{fetchedAt:Q,...typeof z.source==="string"&&{source:z.source}}};return J>=Q+X2||z.stale!==void 0?{miss:"stale",reading:W}:{reading:W}}if(this.#J.has($))return{miss:"absent"};let G=this.#W.get($)??J;return this.#W.set($,G),{miss:J-G>=F7?"unreachable":"cold"}}}function R3($,Z){let J=JSON.stringify([z2($.connectionFile),z2(Z)]),z=_3.get(J);if(!z)z={source:new G2($,J),refs:0},_3.set(J,z);z.refs++;let X=!1;return{source:z.source,release(){if(X)return;if(X=!0,--z.refs===0)_3.delete(J)}}}import{ClaustrumCredentialError as QQ}from"@cortexkit/claustrum-client";import{appendFileSync as S7,chmodSync as k7,existsSync as E3,renameSync as j2,statSync as T7}from"node:fs";import{open as E7}from"node:fs/promises";import{dirname as b7,resolve as f7}from"node:path";import{randomUUID as Y2}from"node:crypto";import{lstat as U2,readFile as q2,rename as j7,unlink as Q2}from"node:fs/promises";import{tmpdir as M7}from"node:os";import{dirname as L0,join as D7,resolve as t}from"node:path";var _=process.platform==="win32",W2=new Set;function S3($){if($?.reason==="io-error"){if($.win32Code===2||$.win32Code===3)return"ENOENT";if($.win32Code===80||$.win32Code===183)return"EEXIST"}return $?.code??"ERR_PRIVATE_FILE"}var H2;var K2="native-addon-unavailable";function F2($){return Object.assign(Error("Windows private-files native addon is unavailable",{cause:$}),{code:"ERR_PRIVATE_FILES_UNAVAILABLE",reason:K2})}function N7($,Z){return Z instanceof $.PrivateFilesUnavailableError||Z?.code==="ERR_PRIVATE_FILES_UNAVAILABLE"}async function L7($){try{await $.verifyPrivatePath(D7(M7(),`.common-auth-private-files-probe-${Y2()}`),"file")}catch(Z){if(N7($,Z))throw F2(Z)}}function s0(){return H2??=import("@cortexkit/private-files").then(async($)=>{if(_)await L7($);return $},($)=>{throw _?F2($):$}),H2}class m extends Error{path;stage;code;win32Code;reason;published=!1;durabilityConfirmed=!1;fileDurable=!1;attempts=0;elapsedMs=0;orphanPath;constructor($,Z,J){let z=J;super(z?.code==="ERR_PRIVATE_FILES_UNAVAILABLE"?`Private file refused at ${Z}: ${$} (${K2}). The Windows native addon of @cortexkit/private-files could not be loaded, so owner-only access cannot be enforced and nothing was read or written. Reinstall the plugin so the private-files Windows prebuild for this architecture is present; Windows has no safe fallback to permission bits.`:`Private file refused at ${Z}: ${$} (${z?.reason??z?.code??"io-error"}). Keep this file in a folder that only you, the system or administrators can change, such as a folder in your home directory. If other users could read the file before, sign in again to replace the credentials it held. On Windows the file must also be on a local drive that keeps Windows file permissions, such as NTFS.`,{cause:J});this.path=$,this.stage=Z,this.name="PrivateFileError",this.code=S3(z),this.win32Code=z?.win32Code,this.reason=z?.reason}}async function i($,Z,J){try{return await J()}catch(z){if(z instanceof m)throw z;throw new m($,Z,z)}}var P7;async function F0($,Z){$=t($),Z??=P7,await i($,"safe-parent",async()=>{let J=await(await s0()).verifySafeParent($,Z);if(J.ok===!1){if(J.reason==="io-error"||J.reason==="wrong-kind")await U2($);throw new m(J.level??J.path,"safe-parent",{...J,code:"ERR_PRIVATE_FILES_SECURITY"})}})}async function d($,Z,J=!1){if($=t($),Z==="directory")return F0($);await i($,"verify",async()=>{let z=await s0(),X=await z.verifyOwnerOnly($),G=!1;if(!X.ok){let{reason:Q}=X.refusal;if(Q==="io-error")await z.verifyPrivatePath($,Z);if(J&&[z.EXTRA_ACE,z.NOT_PROTECTED,z.NULL_DACL,z.EMPTY_DACL].includes(Q))await F0(L0($)),await z.securePrivatePath($,Z),G=!0;else throw Object.assign(Error("Owner-only verification refused"),{reason:Q,code:"ERR_PRIVATE_FILES_SECURITY"})}if(await z.verifyPrivatePath($,Z),G&&!W2.has($))W2.add($),process.emitWarning(`Private permissions tightened: ${$}. This object may have been readable before; rotate credentials if needed.`,"PrivateFileMigration")})}async function G0($,Z=!1,J){$=t($),await i($,"directory",async()=>{let z=await s0();try{return await U2($),await F0($,J)}catch(G){if(S3(G)!=="ENOENT")throw G}let X=L0($);if(X===$)throw Object.assign(Error("Missing root"),{code:"ENOENT"});await G0(X,!1,J);try{await z.createOwnerOnly($,{kind:"dir"})}catch(G){if(S3(G)!=="EEXIST")throw G}await F0($,J)})}async function Z0($,Z=!1){if(!_)return q2($,"utf8");return(await C7($,Z)).toString("utf8")}async function C7($,Z=!1){if(!_)return q2($);if($=t($),Z)await F0(L0($)),await d($,"file",!0);return i($,"read",async()=>(await s0()).readOwnerOnly($))}async function n0($,Z){await F0(L0(t($))),await i($,"create",async()=>{await(await s0()).createPrivateFile(t($),Z)})}async function V2($){await F0(L0(t($))),await i($,"directory-create",async()=>{await(await s0()).createOwnerOnly(t($),{kind:"dir"})})}async function T3($,Z,J={}){$=t($),Z=t(Z);let z=J.now??(()=>performance.now()),X=z(),G=J.deadline??1/0,Q,W=[0,10,20,40,80,100],H,U=0;for(let K of W){let M=Math.min(Q??1/0,G);if(z()>=M)break;if(K)await(J.sleep??((L)=>new Promise((C)=>setTimeout(C,L))))(Math.min(K,Math.max(0,M-z())));if(z()>=M)break;let V=z();if(await J.beforeRename?.(),Q!==void 0)Q+=z()-V;if(z()>=G)break;U++;try{return await(J.rename??j7)($,Z),{attempts:U,elapsedMs:z()-X}}catch(L){H??=L;let C=L;if(!(C.win32Code!==void 0?C.win32Code===32||C.win32Code===33:["EBUSY","EPERM","EACCES"].includes(C.code??"")&&!C.reason))break;Q??=z()+500}}let Y=new m(Z,"rename",H??Object.assign(Error("Publication deadline expired"),{code:"ETIMEDOUT"}));throw Y.attempts=U,Y.elapsedMs=z()-X,Y}async function i0($,Z,J={}){$=t($),await G0(L0($));try{await d($,"file",!0)}catch(U){if(U.code!=="ENOENT")throw U}let z=t(J.stagePath??`${$}.${Y2()}.tmp`);if(L0(z)!==L0($))throw new m($,"stage-directory",{code:"EXDEV"});let X=!1,G=!1,Q={attempts:0,elapsedMs:0},W="stage-create",H=(U)=>{try{J.onOutcome?.({path:$,stage:U?.stage??"published",published:G,fileDurable:G,durabilityConfirmed:!1,attempts:U?.attempts??Q.attempts,elapsedMs:U?.elapsedMs??Q.elapsedMs,...U&&{code:U.code,win32Code:U.win32Code}})}catch{}};try{if(await n0(z,Z),X=!0,W="before-rename",Q=await T3(z,$,J),X=!1,G=!0,W="published-callback",J.onRenamed?.(),W="published-verify",await d($,"file"),J.durable&&J.durability!=="file-only-on-windows")throw new m($,"directory-sync-unsupported",{code:"ENOTSUP"});H()}catch(U){let Y=U instanceof m?U:new m($,W,U);if(Y.published=G,Y.fileDurable=G,G)Object.assign(Y,Q);if(X){try{await Q2(z)}catch{Y.orphanPath=z}X=!1}throw H(Y),Y}finally{if(X)await Q2(z).catch(()=>{})}}var O7=/^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i,A7=/\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g;function I7($){return $ instanceof Error||Object.prototype.toString.call($)==="[object Error]"}function o0($={}){let Z=[A7,...$.extraValuePatterns??[]].map((G)=>new RegExp(G.source,G.flags.includes("g")?G.flags:`${G.flags}g`));function J(G){let Q=G.toLowerCase().replace(/[-_]/g,"");return O7.test(G)||Q.includes("apikey")||Q.endsWith("secret")||Q.endsWith("password")||Q.endsWith("token")&&!Q.endsWith("tokens")||!!$.extraSecretKeys?.(Q)}function z(G){let Q=G,W=[["name",G.name],["message",G.message],["stack",G.stack]];for(let U of["code","status","cause"])if(Q[U]!==void 0)W.push([U,Q[U]]);let H=new Set(W.map(([U])=>U));for(let U of Object.entries(G))if(!H.has(U[0]))W.push(U);return W}function X(G,Q,W,H=0){if(typeof G==="string")return Z.reduce((U,Y)=>U.replace(Y,"***REDACTED***"),G);if(!G||typeof G!=="object")return G;if(W.has(G))return"[Circular]";W.add(G);try{if(Array.isArray(G))return G.map((K)=>X(K,Q,W,H));let U=I7(G);if(U&&H>=8)return"[Truncated]";let Y=U?H+1:H;return Object.fromEntries((U?z(G):Object.entries(G)).map(([K,M])=>[K,Q&&J(K)?"***REDACTED***":X(M,Q,W,Y)]))}finally{W.delete(G)}}return{redact:(G)=>X(G,!0,new WeakSet),redactStrings:(G)=>X(G,!1,new WeakSet)}}var B2=o0(),_7=B2.redact,R7=B2.redactStrings;var c1={error:0,warn:1,info:2,debug:3,trace:4},D2=5242880,N2=3;function b3($){try{k7($,384)}catch{}}function x7($){try{if(!(E3($)&&T7($).size>=D2))return;for(let J=N2-1;J>=1;J--)if(E3(`${$}.${J}`)){let z=`${$}.${J+1}`;j2(`${$}.${J}`,z),b3(z)}let Z=`${$}.1`;j2($,Z),b3(Z)}catch{}}async function V0($){let{file:Z,handle:J}=$;if($.file=void 0,$.handle=void 0,Z&&J)await i(Z,"log-close",()=>J.close())}async function M2($,Z){await G0(b7(Z));try{await d(Z,"file",!0)}catch(J){if(J.code!=="ENOENT")throw J;try{await n0(Z,"")}catch(z){if(z.code!=="EEXIST")throw z;await d(Z,"file",!0)}}return $.handle=await i(Z,"log-open",()=>E7(Z,"a")),$.file=Z,$.handle}async function y7($,Z,J){Z=f7(Z);try{if($.file!==Z)await V0($);let z=$.handle??await M2($,Z);if((await i(Z,"log-stat",()=>z.stat())).size>=D2){await V0($);for(let G=N2-1;G>=0;G--){let Q=G===0?Z:`${Z}.${G}`,W=`${Z}.${G+1}`;try{await d(Q,"file",!0)}catch(H){if(H.code==="ENOENT")continue;throw H}try{await d(W,"file",!0)}catch(H){if(H.code!=="ENOENT")throw H}await T3(Q,W),await d(W,"file")}z=await M2($,Z)}await i(Z,"log-append",()=>z.appendFile(J,"utf8"))}catch(z){throw await V0($).catch(()=>{}),z}}function g7($){try{return` ${JSON.stringify($)}`}catch{return" [unserializable]"}}function v7($){let Z,J,z,X=o0(),G,Q=[],W,H=Promise.resolve(),U,Y={};function K(F){let q=H.then(F);return H=q.catch((B)=>{U=B}),q}function M(F){if(_&&F.file!==Z)K(()=>V0(Y)).catch(()=>{});Z=F.file,J=F.level,X=o0(F),G=F.captureSink}function V(F){if(F===void 0||F in c1)z=F}function L(){if(Z===void 0)return;return(typeof Z==="function"?Z():Z)||void 0}function C(){if(z)return z;let F=typeof J==="function"?J():J;if(F&&F in c1)return F;return"info"}function A(F=!0){if(W)clearTimeout(W),W=void 0;if(!Q.length){if(_)return K(async()=>{if(F)await V0(Y);if(U)throw U});return}let q;try{q=L()}catch{if(Q=[],_&&F)return K(()=>V0(Y));return}let B=Q.join("");if(Q=[],!q){if(_&&F)return K(()=>V0(Y));return}if(_)return K(async()=>{try{await y7(Y,q,B)}finally{if(F)await V0(Y)}});try{if(x7(q),E3(q))b3(q);S7(q,B,{encoding:"utf8",mode:384})}catch{}}function I(){if(!W)W=setTimeout(()=>{W=void 0;let F=A(!1);if(F instanceof Promise)F.catch(()=>{})},500)}function R(F,q,B,P){if(Z===void 0&&G===void 0)return;try{if(c1[q]>c1[C()])return;let y=X.redactStrings(B),T;try{T=X.redact(P)}catch{T="[unserializable]"}let g=`[${new Date().toISOString()}] ${q.toUpperCase()} [${F}] ${y}`+(P===void 0?"":g7(T))+`
+`;try{G?.({channel:F,level:q,message:y,data:T})}catch{}if(Z===void 0)return;if(Q.push(g),Q.length>=50){let $0=A(!1);if($0 instanceof Promise)$0.catch(()=>{})}else I()}catch{}}function v(F){return{error:(q,B)=>R(F,"error",q,B),warn:(q,B)=>R(F,"warn",q,B),info:(q,B)=>R(F,"info",q,B),debug:(q,B)=>R(F,"debug",q,B),trace:(q,B)=>R(F,"trace",q,B)}}function h(){if(_)K(()=>V0(Y)).catch(()=>{});if(U=void 0,Q=[],W)clearTimeout(W),W=void 0;Z=void 0,J=void 0,z=void 0,X=o0(),G=void 0}if($)M($);return{configure:M,createLogger:v,setLogLevel:V,flushLogs:A,reset:h}}var h7=v7();function Q0($){return h7.createLogger($)}function k0($){let Z=new AbortController,J=[],z=!1,X=()=>{if(z)return;z=!0;for(let{source:W,listener:H}of J)W.removeEventListener("abort",H);J.length=0},G=(W)=>{if(z||Z.signal.aborted)return;Z.abort(W),X()},Q=$.find((W)=>W.aborted);if(Q)return Z.abort(Q.reason),{signal:Z.signal,dispose:X};for(let W of $){if(Z.signal.aborted)break;let H=()=>G(W.reason);if(J.push({source:W,listener:H}),W.addEventListener("abort",H,{once:!0}),W.aborted)G(W.reason)}return{signal:Z.signal,dispose:X}}import{ClaustrumCredentialError as i2}from"@cortexkit/claustrum-client";import{createHash as t7,randomBytes as e7,randomUUID as $8}from"node:crypto";import{constants as b2}from"node:fs";import{chmod as Z8,mkdir as J8,open as g2,readFile as g3,realpath as z8,rename as X8,stat as v2,unlink as h3}from"node:fs/promises";import{basename as G8,dirname as E0,extname as tz,isAbsolute as ez,join as Q8,resolve as $X}from"node:path";import{ClaustrumCredentialError as W8,ClaustrumClient as JX,writeEnrollmentTokenFile as H8}from"@cortexkit/claustrum-client";import{lstat as m7}from"node:fs/promises";import{resolve as w7}from"node:path";async function u7($){try{let Z=await m7($);return Z.isFile()?Z:void 0}catch(Z){return Z.code==="ENOENT"?"absent":void 0}}function c7($,Z){if($==="absent"||Z==="absent")return $===Z;return $.dev===Z.dev&&$.ino===Z.ino&&$.size===Z.size&&$.mtimeMs===Z.mtimeMs&&$.ctimeMs===Z.ctimeMs}class M1{#$=new Map;async read($,Z,J){let z=$.map((U)=>w7(U)),X=JSON.stringify(z),G=await Promise.all(z.map(u7)),Q=G.every((U)=>U!==void 0)?G:void 0,W=this.#$.get(X);if(Q&&W&&Q.every((U,Y)=>{let K=W.identities[Y];return K!==void 0&&c7(U,K)}))return J?.(Q),W.value;this.#$.delete(X);let H=await Z(z);if(Q){if(this.#$.size>=64){let U=this.#$.keys().next().value;if(U!==void 0)this.#$.delete(U)}this.#$.set(X,{identities:Q,value:H})}return H}}import{randomUUID as L2}from"node:crypto";import{mkdir as p7,open as P2,rename as d7,rm as l7}from"node:fs/promises";import{dirname as C2}from"node:path";class p1 extends Error{constructor($){super("file or directory sync failed",{cause:$});this.name="AtomicSyncError"}}async function D1($,Z,J={}){await O2($,Z,J)}async function O2($,Z,J,z){if(_)return i0($,J.serialize?J.serialize(Z):`${JSON.stringify(Z,null,2)}
+`,{beforeRename:J.beforeRename,stagePath:`${$}.${(J.stageName??L2)()}.tmp`,onRenamed:z,durable:J.durable,durability:J.durability,onOutcome:J.onOutcome});await p7(C2($),{recursive:!0});let X=`${$}.${(J.stageName??L2)()}.tmp`,G,Q=!1;try{if(G=await P2(X,"wx",384),Q=!0,await G.writeFile(J.serialize?J.serialize(Z):`${JSON.stringify(Z,null,2)}
+`,"utf8"),await G.chmod(384),J.durable)try{await G.sync()}catch(W){throw new p1(W)}if(await G.close(),G=void 0,await J.beforeRename?.(),await d7(X,$),Q=!1,z?.(),J.durable){let W=await P2(C2($),"r");try{await W.sync()}catch(H){throw new p1(H)}finally{await W.close()}}}finally{if(await G?.close().catch(()=>{}),Q)await l7(X,{force:!0}).catch(()=>{})}}var a7=Object.freeze({sidebar:Object.freeze({name:"sidebar-write",ttlMs:1e4,timeoutMs:15000,renew:!0}),preferences:Object.freeze({name:"preferences",ttlMs:1e4,timeoutMs:2000,renew:!0})});import{randomUUID as d1}from"node:crypto";import{lstat as y3,mkdir as A2,open as T2,readFile as I2,rename as _2,rm as L1,stat as l1}from"node:fs/promises";import{dirname as x3,join as R2}from"node:path";function N1($,Z){return`${$}.${Z}.lock`}class P0 extends Error{details;constructor($){super(`Timed out acquiring ${$.name} lock for ${$.target}`);this.name="LockContentionError",this.details=$}}class B0 extends Error{details;constructor($){super(`Lost ${$.name} lock for ${$.target}`);this.name="LockOwnershipError",this.details=$}}async function f3($,Z,J){let z=performance.now();for(;;){Z.signal?.throwIfAborted();let X=await j0({path:$,name:Z.name,ttlMs:Z.ttlMs,renew:Z.renew??!1,...Z.onStep?{onStep:Z.onStep}:{},...Z.onRenewalTimer?{onRenewalTimer:Z.onRenewalTimer}:{}});if(X)try{return Z.signal?.throwIfAborted(),await J(X)}finally{await X.release()}let G=Z.timeoutMs-(performance.now()-z);if(G<=0)throw new P0({target:$,name:Z.name,timeoutMs:Z.timeoutMs});await new Promise((Q)=>setTimeout(Q,Math.min(25,Math.ceil(G))))}}async function S2($,Z){let J=await T2($,"wx",384),z;try{z=await J.stat()}catch{z=void 0}try{await J.writeFile(Z,"utf8")}catch(X){try{let G=await y3($).catch(()=>{return});if(z&&G&&G.dev===z.dev&&G.ino===z.ino)await L1($,{force:!0}).catch(()=>{})}catch{}throw X}finally{await J.close()}}var s7=globalThis.setTimeout.bind(globalThis),n7=globalThis.clearTimeout.bind(globalThis);function E2($){let Z=$?.code;return Z==="ENOENT"||!_&&(Z==="EINVAL"||Z==="ENOTDIR")}var k2;function i7($,Z){if($.dev!==Z.dev||$.ino!==Z.ino)return!1;if($.ino===0&&$.birthtimeMs!==Z.birthtimeMs)return!1;return!0}var o7=1000;function j0($){return r7({...$,now:Date.now})}async function r7($){let Z=N1($.path,$.name),J=R2(Z,"owner.json"),z=d1(),X=$.now??Date.now,G=null,Q=!1,W=!1,H,U,Y=new Promise((j)=>{U=j});function K(j){try{let D=$.onRenewalTimer?.(j);if(D&&(typeof D==="object"||typeof D==="function")&&"then"in D&&typeof D.then==="function")Promise.resolve(D).catch(()=>{})}catch{}}function M(){if(!G)return;n7(G),G=null,K("cancelled")}function V(j,D){if(H||Q)return;H=Object.freeze({reason:j,expectedOwnerId:z,...typeof D?.ownerId==="string"?{observedOwnerId:D.ownerId}:{},...typeof D?.expiresAt==="number"?{observedExpiresAt:D.expiresAt}:{}}),M(),U(H)}let L,C=null,A=`${Z}.evicting`,I=R2(A,"owner.json"),R=d1(),v=5000,h=8;async function F(){if(_)try{return JSON.parse(await Z0(Z,!0))}catch(j){if(j.code!=="EISDIR"&&j.reason!=="wrong-kind")throw j;return await d(Z,"directory",!0),JSON.parse(await Z0(J,!0))}try{return JSON.parse(await I2(Z,"utf8"))}catch(j){if(j.code!=="EISDIR")throw j;return JSON.parse(await I2(J,"utf8"))}}async function q(){if(_){let k=await F(),c=Number(k?.expiresAt)-X();await i0(Z,`${JSON.stringify({ownerId:z,expiresAt:X()+$.ttlMs})}
+`,{deadline:performance.now()+Math.max(0,c),beforeRename:async()=>{let S0=await F();if(S0?.ownerId!==z||!(Number(S0?.expiresAt)>X())||!await p())throw new B0({target:$.path,name:$.name})}});return}let j=`${Z}.${d1()}.tmp`,D,N=!1;try{D=await T2(j,"wx",384),N=!0,await D.writeFile(`${JSON.stringify({ownerId:z,expiresAt:X()+$.ttlMs})}
+`,"utf8"),await D.chmod(384),await D.close(),D=void 0;let k=await F();if(k?.ownerId!==z||!(Number(k?.expiresAt)>X())||!await p())throw new B0({target:$.path,name:$.name});await _2(j,Z),N=!1}finally{if(await D?.close().catch(()=>{}),N)await L1(j,{force:!0}).catch(()=>{})}}async function B(){let j=`${JSON.stringify({ownerId:z,expiresAt:X()+$.ttlMs})}
+`;if(_)await n0(Z,j);else await S2(Z,j)}async function P(j){let D=j.code;if(D!=="EEXIST"&&D!=="EISDIR")return!1;if(_){if($.onStep)await $.onStep("lease-contention-read-ready");try{if(D==="EISDIR")await d(Z,"directory",!0),await Z0(J,!0);else await F()}catch(N){if(N.code!=="ENOENT")throw N}}return!0}async function y(){if(_)await G0(x3(Z));try{return await B(),!0}catch(j){let D=j.code;if(await P(j))return!1;if(D==="ENOENT"){if(_)await G0(x3(Z));else await A2(x3(Z),{recursive:!0});try{return await B(),!0}catch(N){if(await P(N))return!1;throw N}}throw j}}async function T(){await new Promise((j)=>setTimeout(j,Math.floor(Math.random()*4)))}async function g(j=!0){if(j&&$.onStep)await $.onStep("lock-read-ready");let D;try{D=await F()}catch(k){if(_&&k.code!=="ENOENT")throw k}let N=Number(D?.expiresAt);if(Number.isFinite(N)&&N>X())return{status:"live"};if(typeof D?.ownerId==="string"&&Number.isFinite(N))return{status:"stale",identity:{kind:"owner",ownerId:D.ownerId,expiresAt:N}};try{let k=await l1(Z),c=Number.isFinite(N)?N:k.mtimeMs+$.ttlMs;if(c>X())return{status:"live"};return{status:"stale",identity:{kind:"stat",dev:k.dev,ino:k.ino,mtimeMs:k.mtimeMs,expiresAt:c}}}catch(k){if(k.code==="ENOENT"){if($.onStep)await $.onStep("lock-missing");return{status:"missing"}}throw k}}function $0(j,D){if(D.status!=="stale")return!1;let N=D.identity;if(j.kind==="owner"&&N.kind==="owner")return j.ownerId===N.ownerId&&j.expiresAt===N.expiresAt;return j.kind==="stat"&&N.kind==="stat"&&j.dev===N.dev&&j.ino===N.ino&&j.mtimeMs===N.mtimeMs&&j.expiresAt===N.expiresAt}async function p(){try{return JSON.parse(await Z0(I,_))?.ownerId===R}catch(j){if(_&&j.code!=="ENOENT")throw j;return!1}}async function u(j){if(_)await i(j,"remove",()=>L1(j,{recursive:!0,force:!0}));else await L1(j,{recursive:!0,force:!0}).catch(()=>{})}async function a(){if(await p())await u(A)}async function q0(j){if(!j)return!1;let D;try{let N=await y3(A);D={dev:N.dev,ino:N.ino,birthtimeMs:N.birthtimeMs}}catch{return!1}if(!i7(j,D))return!1;try{return await l1(I),!0}catch(N){if(N.code!=="ENOENT")return!0}try{await u(A)}catch{}return!0}async function y1(){if(_)await V2(A);else await A2(A);let j;try{let D=await y3(A);j={dev:D.dev,ino:D.ino,birthtimeMs:D.birthtimeMs}}catch{j=void 0}try{await k2?.beforeOwnerWrite?.(A,I);let D=await k2?.failOwnerWrite?.(A,I);if(D!==void 0)throw D;let N=`${JSON.stringify({ownerId:R,createdAt:X()})}
+`;if(_)await n0(I,N);else await S2(I,N)}catch(D){let N=await q0(j);if(E2(D)&&!N)return!1;try{await a()}catch{}throw D}if($.onStep)await $.onStep("eviction-marker-acquired");return!0}async function d0(){let j;try{j=await l1(A)}catch(N){if(N.code==="ENOENT")return"missing";throw N}if(_)try{await d(A,"directory",!0)}catch(N){if(N.code==="ENOENT")return"missing";throw N}if(j.mtimeMs+v>X()){let N=!0;try{await l1(I)}catch(k){if(k.code==="ENOENT")N=!1;else return"fresh"}if(N)return"fresh";if(j.mtimeMs+o7>X())return"fresh"}if($.onStep)await $.onStep("stale-marker-stat");let D=`${A}.${d1()}`;try{await _2(A,D)}catch(N){if(N.code==="ENOENT")return"missing";throw N}if($.onStep)await $.onStep("stale-marker-claimed");return await u(D),"recovered"}async function g1(j){try{if(!await y1())return!1}catch(D){if(D.code==="EEXIST"){if(_)try{await d(A,"directory",!0),await Z0(I,!0)}catch(N){if(N.code!=="ENOENT")throw N}return!1}throw D}try{await j()}finally{await a()}return!0}async function l0(){for(let j=0;j<h;j++){if($.onStep)await $.onStep("relinquish-read");let D;try{D=await F()}catch(N){if(_)throw N;return}if(D?.ownerId!==z)return;try{await L1(Z,{recursive:!0,force:!0});return}catch(N){if(_)throw N;await T()}}}function E(){if(!$.renew||Q||H)return;let j=$.renewIntervalMs??Math.max(1000,Math.floor($.ttlMs/3));if(G=s7(()=>{G=null;let D=(async()=>{let N=!Q;try{if(!await g1(async()=>{let c=await F(),S0=X();if(Q||H){N=!1;return}if(c?.ownerId!==z){V("taken-over",c),N=!1;return}if(!(Number(c?.expiresAt)>S0)){V("expired",c),N=!1;return}if($.onStep)await $.onStep("renewal-owner-confirmed");if(Q||H){N=!1;return}if(!await p())return;if($.onStep)await $.onStep("renewal-write-fenced");if(Q||H){N=!1;return}if(!await p())return;if($.onStep)await $.onStep("renewal-write-ready");if(Q||H){N=!1;return}if(await q(),$.onStep)await $.onStep("renewal-write-finished");if(!await p()){V("marker-lost"),N=!1,await l0();return}})&&$.onStep)await $.onStep("renewal-marker-unavailable")}catch(k){if(_&&k instanceof m)L=k,V("renewal-failed"),N=!1;try{let c=await F();if(c?.ownerId!==z)V("taken-over",c);else if(!(Number(c?.expiresAt)>X()))V("expired",c)}catch{V("renewal-failed")}}finally{if($.onStep)try{await $.onStep("renewal-finished")}catch{}if(N&&!Q&&!H)E()}})();C=D,D.finally(()=>{if(C===D)C=null})},j),"unref"in G)G.unref();K("scheduled")}function K0(){try{let j=$.onContended?.();if(j&&(typeof j==="object"||typeof j==="function")&&"then"in j&&typeof j.then==="function")Promise.resolve(j).catch(()=>{})}catch{}return null}let R0=await y();if(!R0)for(let j=0;j<h;j++){if(R0=await y(),R0)break;let D=await g();if(D.status==="live")return K0();if(D.status==="missing")continue;if($.onStep)await $.onStep("stale-lock-observed");try{if(!await y1()){await T();continue}}catch(N){if(N.code!=="EEXIST")throw N;if(await d0()==="fresh")return null;await T();continue}try{let N=await g();if(N.status==="live")return K0();if(!$0(D.identity,N))continue;if(!await p())return null;if($.onStep)await $.onStep("stale-lock-confirmed");if(!await p())return null;let k=await g(!1);if(!$0(D.identity,k))continue;if(await u(Z),!await p())return null;if($.onStep)await $.onStep("stale-lock-removed");if(R0=await y(),!R0)return null;if($.onStep)await $.onStep("stale-lock-recreated");if(!await p())return await l0(),R0=!1,null;break}finally{await a()}}if(!R0)return null;return E(),{ownerId:z,whenLost:()=>Y,hasLost:()=>H!==void 0,assertOwned:async()=>{if(L)throw L;let j;try{let D=await F();if(j=D,!Q&&!H&&D?.ownerId===z&&Number(D?.expiresAt)>X())return;V(D?.ownerId!==z?"taken-over":"expired",D)}catch(D){if(V("unreadable"),_&&D instanceof m)throw D}throw new B0({target:$.path,name:$.name,expectedOwnerId:z,...typeof j?.ownerId==="string"?{observedOwnerId:j.ownerId}:{},...typeof j?.expiresAt==="number"?{observedExpiresAt:j.expiresAt}:{}})},release:async()=>{if(_&&W)return;Q=!0,M(),await C;let j=performance.now()+v+1000,D=5;for(;;){try{let k=!1;if(await g1(async()=>{let S0;try{S0=await F()}catch(J2){if(_&&J2.code==="ENOENT"){k=!0;return}throw J2}if(S0?.ownerId!==z){k=!0;return}if($.onStep)await $.onStep("release-owner-confirmed");if(!await p())return;await u(Z),k=!0})){if(_&&!k)throw new m(Z,"release-not-confirmed",{code:"EIO"});W=k;return}await d0()}catch(k){if(_)throw k;return}let N=j-performance.now();if(N<=0)break;await new Promise((k)=>setTimeout(k,Math.min(D,N))),D=Math.min(D*2,50)}if(_)throw new m(Z,"release-not-confirmed",{code:"ETIMEDOUT"})}}}var Y8=1,s1=16384,h2=30000,m3=/^[0-9a-f]{64}$/,m2="unknown_method",w2=new Set([m2,"invalid_params","pending_exists","not_found","already_consumed","superseded","stale_generation"]),u2=new Set(["pending_queue_full"]);function v3($){if(!($ instanceof W8))return;if(w2.has($.code))return{code:$.code,disposition:"terminal"};if(u2.has($.code))return{code:$.code,disposition:"retry"};return{code:$.code,disposition:$.action==="retry"?"retry":"terminal"}}function c2($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function a1($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0}function p2($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=1}function P1(){return new O("invalid-state","invalid Claustrum enrollment state")}function w3($){if(!c2($)||$.version!==Y8||typeof $.proposedName!=="string"||$.proposedName.length===0)throw P1();if($.phase==="pending"){if(!m3.test(String($.requestSecret??""))||$.requestId!==void 0&&(typeof $.requestId!=="string"||$.requestId.length===0)||!a1($.createdAt)||!a1($.updatedAt))throw P1();return{version:1,phase:"pending",proposedName:$.proposedName,requestSecret:$.requestSecret,...$.requestId!==void 0&&{requestId:$.requestId},createdAt:$.createdAt,updatedAt:$.updatedAt}}if($.phase==="approved"){if($.approvedName!==void 0&&(typeof $.approvedName!=="string"||$.approvedName.length===0)||!p2($.tokenGeneration)||!a1($.updatedAt))throw P1();return{version:1,phase:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration,updatedAt:$.updatedAt}}if($.phase==="denied"||$.phase==="blocked"){if($.errorCode!==void 0&&typeof $.errorCode!=="string"||!a1($.updatedAt))throw P1();return{version:1,phase:$.phase,proposedName:$.proposedName,...$.errorCode!==void 0&&{errorCode:$.errorCode},updatedAt:$.updatedAt}}throw P1()}function u3($){if(!c2($)||!m3.test(String($.token??""))||!p2($.token_generation))throw new O("invalid-token","invalid Claustrum enrollment token file");return{token:$.token,token_generation:$.token_generation}}function d2($){if(!$.isFile())throw new O("unsafe-file","Claustrum enrollment file must be a regular file");if(($.mode&63)!==0)throw new O("unsafe-file","Claustrum enrollment file must be owner-only");let Z=process.geteuid?.();if(Z!==void 0&&$.uid!==Z)throw new O("unsafe-file","Claustrum enrollment file must be owned by the current user")}function f2($){try{return JSON.parse($)}catch{throw new O("invalid-state","Claustrum enrollment file is not valid JSON")}}async function b0($){if(_)try{await G0(E0($));let J=await Z0($,!0);if(Buffer.byteLength(J)>s1)throw new O("unsafe-file","Claustrum enrollment file is too large");return f2(J)}catch(J){if(J.code==="ENOENT")return;throw J}let Z;try{Z=await g2($,b2.O_RDONLY|b2.O_NOFOLLOW)}catch(J){if(J.code==="ENOENT")return;throw new O("unsafe-file","Claustrum enrollment file could not be opened safely")}try{d2(await Z.stat());let J=Buffer.alloc(s1+1),{bytesRead:z}=await Z.read(J,0,J.byteLength,0);if(z>s1)throw new O("unsafe-file","Claustrum enrollment file is too large");return f2(J.subarray(0,z).toString("utf8"))}finally{await Z.close()}}function x2($,Z){let J=[];for(let z of $.split(`
+`)){if(z.trim()===""||z.startsWith("#"))continue;let X=z.split(":");if(X.length!==Z||!/^[^\s:,]+$/.test(X[0]??"")||!/^\d+$/.test(X[2]??"")||!Number.isSafeInteger(Number(X[2]))||Z===7&&(!/^\d+$/.test(X[3]??"")||!Number.isSafeInteger(Number(X[3])))||Z===4&&X[3]!==""&&!/^[^\s:,]+(?:,[^\s:,]+)*$/.test(X[3]??""))return;J.push(X)}return J}async function U8($,Z,J){try{let[z,X]=await Promise.all([g3(J.passwdPath??"/etc/passwd","utf8"),g3(J.groupPath??"/etc/group","utf8")]),G=x2(z,7),Q=x2(X,4);if(!G||!Q)return!1;let W=G.filter((K)=>Number(K[2])===$),H=Q.filter((K)=>Number(K[2])===Z);if(W.length!==1||H.length!==1)return!1;let U=W[0]?.[0],Y=H[0]?.[3]??"";return(Y===""||Y.split(",").every((K)=>K===U))&&!G.some((K)=>Number(K[2])!==$&&Number(K[3])===Z)}catch{return!1}}function l2($){if(!$.passwdPath&&!$.groupPath)return;return{fs:{readFile:(Z)=>g3(Z==="/etc/passwd"?$.passwdPath??Z:Z==="/etc/group"?$.groupPath??Z:Z)}}}async function a2($,Z={}){if(!_){let J=process.geteuid?.();if(J===void 0)return;let z=process.getegid?.(),X;try{X=await z8($)}catch{return}let G;for(;;){let Q=await v2(X).catch(()=>{return});if(Q&&(Q.mode&18)!==0&&(Q.mode&512)===0){if(G===void 0)G=z!==void 0&&await U8(J,z,Z);if((Q.mode&2)!==0||Q.uid!==J||Q.gid!==z||!G)throw new O("unsafe-file",`Claustrum enrollment path has a writable ancestor: ${X}. Another user could replace it. Run: chmod g-w,o-w ${X}`)}let W=E0(X);if(W===X)return;X=W}}try{await F0($,l2(Z))}catch(J){if(!(J instanceof m))throw J;throw new O("unsafe-file",`Claustrum enrollment parent refused: ${J.path} (${J.reason??J.code}). Use a folder that other users cannot write or replace.`)}}async function r0($,Z={},J="enrollment directory"){if(_){await G0($,!1,l2(Z));return}await J8($,{recursive:!0,mode:448});let z=await v2($),X=process.geteuid?.();if(X!==void 0&&z.uid!==X)throw new O("unsafe-file",`Claustrum ${J} must be owned by the current user`);if((z.mode&63)!==0)await Z8($,448)}async function T0($,Z,J={}){let z=E0($);await r0(z,J),await a2(z,J);let X=`${JSON.stringify(Z)}
+`;if(Buffer.byteLength(X)>s1)throw new O("invalid-state","Claustrum enrollment state is too large");if(_)return i0($,X);let G=Q8(z,`.${G8($)}.${process.pid}.${$8()}.tmp`),Q,W=!1;try{Q=await g2(G,"wx",384),W=!0,await Q.writeFile(X,"utf8"),await Q.chmod(384),await Q.sync(),await Q.close(),Q=void 0,await X8(G,$),W=!1}finally{if(await Q?.close().catch(()=>{}),W)await h3(G).catch(()=>{})}}var q8=new M1;async function n1($,Z){let J=_?await y2($,Z):await q8.read([$.tokenPath,$.statePath],async([X=$.tokenPath,G=$.statePath])=>y2({tokenPath:X,statePath:G},Z),(X)=>{for(let G of X)if(G!=="absent")d2(G)}),z={...J.status};if(J.usesProposedName&&z.state==="approved")z.proposedName=Z;return z}async function y2($,Z){let J=await b0($.tokenPath),z=J===void 0?void 0:u3(J),X=await b0($.statePath),G=X===void 0?void 0:w3(X);if(z)return{usesProposedName:G===void 0,status:{state:"approved",proposedName:G?.proposedName??Z,...G?.phase==="approved"&&G.approvedName!==void 0&&{approvedName:G.approvedName},tokenGeneration:z.token_generation}};if(!G)return{status:{state:"idle"},usesProposedName:!1};if(G.phase==="approved")return{usesProposedName:!1,status:{state:"blocked",proposedName:G.proposedName,code:"missing_token"}};return{status:C0(G),usesProposedName:!1}}async function O0($){let Z=await b0($);if(Z===void 0)throw new O("not-enrolled","Claustrum enrollment is not configured");return u3(Z)}function C0($){if($.phase==="pending")return{state:"pending",proposedName:$.proposedName,...$.requestId!==void 0&&{requestId:$.requestId}};if($.phase==="approved")return{state:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration};if($.phase==="denied")return{state:"denied",proposedName:$.proposedName};return{state:"blocked",proposedName:$.proposedName,code:$.errorCode??"unknown"}}function s2(){return new O("wrong-consumer","Claustrum enrollment state belongs to a different consumer")}class c3{#$;#Z;#J;#W;#G;#Q;#z;constructor($){this.#z=$.ancestorOptions??{},this.#$=$.client,this.#Z=$.paths,this.#J=$.proposedName,this.#W=$.now??Date.now,this.#G=$.mintSecret??(()=>e7(32).toString("hex")),this.#Q=$.writeTokenFile??H8}async status(){return n1(this.#Z,this.#J)}async resetTerminal(){return n2(this.#Z,this.#J)}async#X($,Z){let J={version:1,phase:"blocked",proposedName:$.proposedName,errorCode:Z,updatedAt:this.#W()};return await T0(this.#Z.statePath,J,this.#z),C0(J)}async reconcile(){await r0(E0(this.#Z.statePath),this.#z);let $=await j0({name:"ceremony",path:this.#Z.statePath,ttlMs:h2,renew:!0});if(!$)return{state:"busy"};try{let Z=await b0(this.#Z.tokenPath),J=Z===void 0?void 0:u3(Z),z=await b0(this.#Z.statePath),X=z===void 0?void 0:w3(z);if(X&&X.proposedName!==this.#J)throw s2();if(J){if(!X||X.phase==="pending"){let Q={version:1,phase:"approved",proposedName:X?.proposedName??this.#J,tokenGeneration:J.token_generation,updatedAt:this.#W()};await T0(this.#Z.statePath,Q,this.#z),X=Q}return{state:"approved",proposedName:X.proposedName,...X.phase==="approved"&&X.approvedName!==void 0&&{approvedName:X.approvedName},tokenGeneration:J.token_generation}}if(X?.phase==="approved"){let Q={version:1,phase:"blocked",proposedName:X.proposedName,errorCode:"missing_token",updatedAt:this.#W()};return await T0(this.#Z.statePath,Q,this.#z),C0(Q)}if(X&&X.phase!=="pending")return C0(X);if(!X){let Q=this.#W();if(X={version:1,phase:"pending",proposedName:this.#J,requestSecret:this.#G(),createdAt:Q,updatedAt:Q},!m3.test(X.requestSecret))throw new O("invalid-state","invalid minted Claustrum enrollment secret");await T0(this.#Z.statePath,X,this.#z)}if(!X.requestId)try{let Q=t7("sha256").update(Buffer.from(X.requestSecret,"hex")).digest("hex"),W=await this.#$.enrollPropose({name:X.proposedName,requestSecretHash:Q});X={...X,requestId:W.requestId,updatedAt:this.#W()},await T0(this.#Z.statePath,X,this.#z)}catch(Q){let W=v3(Q);if(!W)throw Q;if(W.disposition==="retry")return{state:"pending",proposedName:X.proposedName,retryCode:W.code};if(W.code===m2)return await $.assertOwned(),await h3(this.#Z.statePath).catch((H)=>{if(H.code!=="ENOENT")throw H}),{state:"unavailable",proposedName:X.proposedName,code:W.code};return this.#X(X,W.code)}let G=X.requestId;if(!G)return C0(X);try{let Q=await this.#$.enrollPoll({requestId:G,requestSecret:X.requestSecret});if(Q.status==="pending")return C0(X);if(Q.status==="denied"){let H={version:1,phase:"denied",proposedName:X.proposedName,updatedAt:this.#W()};return await T0(this.#Z.statePath,H,this.#z),C0(H)}await r0(E0(this.#Z.tokenPath),this.#z),await a2(E0(this.#Z.tokenPath),this.#z),await this.#Q(this.#Z.tokenPath,{token:Q.token,token_generation:Q.tokenGeneration});let W={version:1,phase:"approved",proposedName:X.proposedName,approvedName:Q.name,tokenGeneration:Q.tokenGeneration,updatedAt:this.#W()};return await T0(this.#Z.statePath,W,this.#z),C0(W)}catch(Q){let W=v3(Q);if(!W)throw Q;if(W.disposition==="retry")return{state:"pending",proposedName:X.proposedName,requestId:G,retryCode:W.code};return this.#X(X,W.code)}}finally{await $.release()}}}async function n2($,Z){await r0(E0($.statePath));let J=await j0({name:"ceremony",path:$.statePath,ttlMs:h2,renew:!0});if(!J)return"busy";try{if(await b0($.tokenPath)!==void 0)return"refused-approved";let z=await b0($.statePath);if(z===void 0)return"idle";let X=w3(z);if(X.proposedName!==Z)throw s2();if(X.phase==="pending")return"refused-pending";return await J.assertOwned(),await h3($.statePath),"reset"}finally{await J.release()}}var p3="claustrum-tombstone:v1:";function t0($,Z){let J=!1;return(z)=>{if(J)return;if(!Z||Z.aborted)J=!0;$.warn("claustrum shutdown drain timed out",{pendingOperations:z})}}async function e0($,Z){if(!$.size)return;let J,z=!1,X=(async()=>{while(!z&&$.size)await Promise.allSettled([...$])})();try{if(await Promise.race([X,new Promise((G)=>{J=setTimeout(()=>{z=!0,G()},2000)})]),z&&$.size)Z($.size)}finally{z=!0,clearTimeout(J)}}function o2($,Z){return Z!==void 0&&!Z.fromKeptReceipt&&!$.fromKeptReceipt&&Z.credentialId===$.credentialId&&Z.accountIdentity===$.accountIdentity&&Z.recordVersion!==$.recordVersion}function K8($,Z){if(Z===void 0)return"reauthorize-failed";if(Z.credentialId!==$.credentialId)return"credential-changed";if(Z.accountIdentity!==$.accountIdentity)return"account-changed";if(Z.recordVersion===$.recordVersion)return"version-unchanged";return"rotated"}var l3=Q0("claustrum");function s3($,Z,J,z=l3){let X=o2(Z,J);return z.debug("scoped 401 re-authorized",{site:$,credentialId:Z.credentialId,servedVersion:Z.recordVersion,currentVersion:J?.recordVersion??null,retry:X,reason:K8(Z,J)}),X}var a3=300000,r2=60000;function d3(){return new O("invalid-material","Claustrum returned invalid credential material")}function F8($){let Z=$.trim();if(Z.startsWith("{")){let J;try{J=JSON.parse(Z)}catch{throw d3()}if(!J||typeof J!=="object")throw d3();let z=J,X=z.access_token??z.access;Z=typeof X==="string"?X:""}if(!/^[\x21-\x7e]+$/.test(Z)||Z.startsWith(p3))throw d3();return Z}function V8($,Z){let J={kind:"not-mine"};if(!$.operations.includes("read"))return J;if(!$.categories.includes(Z.category))return J;if($.credentialType!=="oauth"&&$.credentialType!=="api_key")return J;if("classify"in Z){let z={credentialId:$.id,credentialType:$.credentialType,categories:$.categories,refreshAdapter:$.refreshAdapter,...B8($)};if(z.providerIds===void 0)return{kind:"refused",code:"unmapped"};try{let X=Z.classify(z);if(X.kind==="not-mine")return J;if(X.kind==="mine"&&typeof X.member==="string")return{kind:"mine",type:$.credentialType,member:X.member};if(X.kind==="refused"&&typeof X.code==="string"&&/^[a-z][a-z0-9-]{0,31}$/.test(X.code)&&!X.code.includes(`
+`)&&Z.refusalCodes.includes(X.code))return{kind:"refused",code:X.code}}catch{}return{kind:"refused",code:"unclassified"}}if($.credentialType==="oauth")return $.refreshAdapter===Z.refreshAdapter?{kind:"mine",type:"oauth"}:J;if($.credentialType==="api_key"&&Z.apiKeys)return $.refreshAdapter===void 0?{kind:"mine",type:"api_key"}:J;return J}function B8($){let Z=$;return{providerIds:Z.providerIds,authMethod:Z.authMethod}}function j8($){let{grants:Z,grantTuples:J}=$;if(Z===void 0||J===void 0)return;return Object.freeze({grants:Z,tuples:Object.freeze(J.map(({selectorKind:z,selector:X,operation:G})=>Object.freeze({selectorKind:z,selector:X,operation:G})))})}class $1{#$;#Z;#J;#W;#G;#Q;#z;#X=new WeakMap;#j=new WeakMap;#H=new Map;#Y=new WeakMap;#q;#V;#U=!1;#M=new r;#B;#N=!1;#_=-1/0;#P=2000;#K=!1;#D;#I=new Set;#F=new Set;#C;#A;constructor($){let Z=$.tokenPath;if($.readToken)this.#Z=$.readToken;else if(Z)this.#Z=()=>O0(Z);else throw new O("not-enrolled","Claustrum enrollment token path is required");this.#$=$.client,this.#W=$.family,this.#G=$.parseIdentity,this.#Q=$.requireAssertion??!1,this.#J=$.now??Date.now,this.#z=$.logger??l3,this.#C=t0(this.#z),this.#q=$.setTimeoutImpl??setTimeout,this.#V=$.clearTimeoutImpl??clearTimeout}transportLost($){if(this.#K||this.#U)return;this.#U=!0,this.#M=$ instanceof i2?$:new r,this.#z.warn("serving kept vault receipt",{reason:"unreachable"}),this.#R()}reachable(){if(this.#K||!this.#U)return;if(this.#U=!1,this.#B)this.#V(this.#B);this.#B=void 0,this.#P=2000;for(let $ of this.#H.values())$.since=null;(this.#z.info??l3.info)("vault receipt serving resumed",{reason:"reachable"})}#R(){if(this.#K||!this.#U||this.#B||this.#N)return;this.#B=this.#q(()=>{this.#B=void 0,this.#L(!0)},this.#P),this.#B.unref?.()}#L($=!1){if(this.#K||!this.#U||this.#N)return;if(this.#J()-this.#_<1000){this.#R();return}this.#_=this.#J(),this.#N=!0,this.#b().catch(()=>{if($&&this.#U)this.#P=Math.min(this.#P*2,30000)}).finally(()=>{this.#N=!1,this.#R()})}#O($){if(this.#K)throw new O("closed","Claustrum scoped custody is closed");$?.throwIfAborted()}async#k($){this.#O($);let Z=this.#Z();this.#F.add(Z);let J;try{J=await Z}finally{this.#F.delete(Z)}if(this.#O($),!/^[0-9a-f]{64}$/.test(J.token)||!Number.isSafeInteger(J.token_generation)||J.token_generation<1)throw new O("invalid-token","Invalid Claustrum enrollment token");return J.token}async#S($,Z){this.#O(Z);let J,z;try{let X=$();J=Z?await Promise.race([X,new Promise((G,Q)=>{let W=()=>Q(Z.reason);if(Z.addEventListener("abort",W,{once:!0}),z=()=>Z.removeEventListener("abort",W),Z.aborted)W()})]):await X}catch(X){if(this.#O(Z),N0(X)==="unreachable")this.transportLost(X);else this.reachable();if(X instanceof i2)throw X;if(N0(X)==="unreachable")throw new r;throw new O("unavailable","Claustrum scoped operation unavailable")}finally{z?.()}return this.#O(Z),this.reachable(),J}async discover($){let Z=await this.#b($);return this.#D=Z.view,Z}async#b($){let Z,J;try{J=await this.#k($)}catch(Y){throw this.#H.clear(),Y}try{Z=await this.#S(()=>this.#$.listScoped(J),$)}catch(Y){throw this.listFailed(Y),Y}let z=[],X=[],G=0,Q=[],W=new Map;for(let Y of Z.rows){let K=V8(Y,this.#W);if(K.kind==="not-mine"){G++;continue}if(K.kind==="refused"){X.push({...Y.id.trim()&&{credentialId:Y.id},code:K.code});continue}Q.push({row:Y,type:K.type,...K.member!==void 0&&{member:K.member}}),W.set(Y.id,(W.get(Y.id)??0)+1)}let H=[];for(let{row:Y,type:K,member:M}of Q){let V;if(!Y.id.trim())V="empty credential id";else if((W.get(Y.id)??0)>1)V="duplicate credential id";else if(Y.accountId!==void 0&&!Y.accountId.trim())V="blank account identity";else if(!Y.state.trim())V="empty state";if(V){z.push({...Y.id.trim()&&{credentialId:Y.id},...M!==void 0&&{member:M},reason:V});continue}H.push(Object.freeze({credentialId:Y.id,credentialType:K,...M!==void 0&&{member:M},...Y.accountId!==void 0&&{accountIdentity:Y.accountId},state:Y.state,...Y.email!==void 0&&{email:Y.email},...Y.orgName!==void 0&&{orgName:Y.orgName}}))}for(let Y of z)this.#z.warn("skipped malformed vault record",Y);let U=j8(Z);return{view:Z.view,credentials:Object.freeze(H),skipped:Object.freeze(z),..."classify"in this.#W&&{refused:Object.freeze(X),notMine:G},...U&&{grantReach:U}}}listFailed($){if(N0($)==="unreachable")this.transportLost($);else this.reachable(),this.#H.clear()}forget($){this.#H.delete($)}retain($){let Z=new Map($.map((J)=>[J.credentialId,J]));for(let[J,z]of this.#H){let X=Z.get(J);if(!X?.enabled||X.state!=="active"||X.credentialType!==z.attempt.credentialType||X.accountIdentity!==z.attempt.expectedAccountIdentity)this.forget(J)}}keptReceiptState(){let $=null;for(let[Z,J]of this.#H){if(!this.#E(J.attempt)){this.forget(Z);continue}if(J.since!==null)$=Math.min($??J.since,J.since)}return Object.freeze({active:$!==null,since:$})}#E($){return $.expiresAtMs===null?$.credentialType==="api_key":$.expiresAtMs-this.#J()>r2}async authorize($,Z,J="vault"){this.#O(Z);let{credentialId:z,credentialType:X,accountIdentity:G}=$,Q=this.#H.get(z);if(Q&&(Q.attempt.credentialType!==X||Q.attempt.expectedAccountIdentity!==G))this.forget(z),Q=void 0;let W;try{W=await this.#k(Z)}catch(H){throw this.#H.clear(),H}if(this.#U&&Q)return this.#L(),this.#T(z,Q,W,J);try{let H=await this.#x({credentialId:z,credentialType:X,accountIdentity:G},W,Z);return this.#H.set(z,{attempt:H,routeId:J,since:null}),H}catch(H){if(this.#O(Z),N0(H)!=="unreachable")throw this.forget(z),H;return this.#T(z,Q,W,J,H)}}#T($,Z,J,z,X=this.#M){if(!Z||this.#H.get($)!==Z||!this.#E(Z.attempt))throw this.forget($),X;if(Z.since===null)Z.since=this.#J();let G=Object.freeze(Object.defineProperty({...Z.attempt,fromKeptReceipt:!0},"accessToken",{value:Z.attempt.accessToken,enumerable:!1}));return this.#X.set(G,J),this.#Y.set(G,z),G}async#x($,Z,J){if(!$.credentialId)throw new O("route-unavailable","Claustrum dispatch requires a credential id");let{credentialId:z,credentialType:X,accountIdentity:G}=$;if(this.#Q&&G===void 0)throw new O("identity-unasserted","Claustrum dispatch requires a known account identity");let Q=await this.#S(()=>this.#$.getScoped({credentialId:z,enrollmentToken:Z,...X==="oauth"&&{minTtlMs:a3}}),J);if(Q.credentialId!==void 0&&Q.credentialId!==z)throw new O("identity-changed","Claustrum served credential identity changed");let W=Q.expiresAtMs;if(!Number.isSafeInteger(Q.recordVersion)||Q.recordVersion<0||W===null&&X==="oauth"||W!==null&&(!Number.isFinite(W)||W-this.#J()<a3))throw new O("insufficient-validity","Claustrum served credential has insufficient validity");let H=F8(Q.material),U=Q.accountId?.trim()?Q.accountId:void 0;if(this.#Q&&(Q.credentialId===void 0||U===void 0))throw new O("identity-unasserted","Claustrum served credential did not assert its identity");let Y=U===void 0?this.#G?.(H):void 0,K=U??Y;if(G!==void 0&&K!==void 0&&K!==G)throw new O("identity-changed","Claustrum served credential identity changed");let M=K??G,L=Object.freeze(Object.defineProperty({credentialId:z,credentialType:X,...M!==void 0&&{accountIdentity:M},accountIdentitySource:U!==void 0?"asserted":Y!==void 0?"parsed":G!==void 0?"expected":"none",...G!==void 0&&{expectedAccountIdentity:G},...Q.credentialId!==void 0&&{assertedCredentialId:Q.credentialId},...U!==void 0&&{assertedAccountIdentity:U},...Q.projectId!==void 0&&{projectId:Q.projectId},recordVersion:Q.recordVersion,expiresAtMs:W},"accessToken",{value:H,enumerable:!1}));return this.#X.set(L,Z),L}async reportFailure($,Z,J){if(Z!==401)return;this.#O();let z=this.#X.get($);if(!z)throw new O("no-receipt","Claustrum failure report requires an original dispatch receipt");let X=this.#Y.get($);if(X!==void 0){this.forget($.credentialId),this.#z.debug("scoped 401 not reported",{routeId:X,reason:"kept-receipt"});return}let G=this.#H.get($.credentialId);if(G&&G.attempt.recordVersion===$.recordVersion)this.forget($.credentialId);let Q=this.#j.get($);if(Q)return Q;let W=this.#S(()=>this.#$.reportAuthFailureScoped({credentialId:$.credentialId,enrollmentToken:z,providerStatus:401,recordVersion:$.recordVersion,reporterSource:J}));this.#j.set($,W);try{await W,this.#z.debug("scoped 401 reported",{credentialId:$.credentialId,recordVersion:$.recordVersion,reporterSource:J})}catch(H){throw this.#j.delete($),H}}watchRoster($){this.#O();let Z=new m1({client:this.#$,enrollmentToken:()=>this.#k(),view:$.view??(()=>this.#D),discover:async(J)=>{await $.onView(J)},onRefused:(J)=>{this.listFailed(J),$.onRefused?.(J)},onTransportLost:()=>this.transportLost(),onReachable:()=>this.reachable(),onError:$.onError,onMode:$.onMode,logger:this.#z,now:this.#J,setTimeoutImpl:this.#q,clearTimeoutImpl:this.#V});return this.#I.add(Z),Z.start(),{get mode(){return Z.mode},close:()=>{this.#I.delete(Z),Z.stop()}}}close(){if(this.#K)return;if(this.#K=!0,this.#B)this.#V(this.#B);this.#B=void 0;for(let $ of this.#I)$.stop();this.#I.clear(),this.#H.clear(),this.#$.close()}async dispose($=this.#C){this.close(),this.#A??=e0(this.#F,$),await this.#A}}import{resolve as $3}from"node:path";var n3=30000,i3={now:()=>performance.now(),schedule($,Z){let J=setTimeout(()=>void Z(),$);return{cancel:()=>clearTimeout(J),unref:()=>J.unref?.()}}};var f0="all",M8=Object.freeze(["primary"]);function e2($){return $.kind==="retired"?$.retiredAt:$.checkedAt}function J1($,Z){return JSON.stringify([$,Z])}function A0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function l($){return typeof $==="number"&&Number.isFinite($)}function t2($){return typeof $==="string"&&$.length>0}function s($,Z,J){return $[Z]===void 0||J($[Z])}function D8($){return l($)&&$>0}function o3($){return typeof $==="string"}function N8($){if(!A0($)||!t2($.scope)||!t2($.label))return!1;switch($.kind){case"reading":return l($.checkedAt)&&l($.usedPercent)&&s($,"resetsAt",o3)&&s($,"windowMinutes",D8);case"retired":return l($.retiredAt);case"absent":return l($.checkedAt);default:return!1}}function L8($){if(!A0($)||!l($.checkedAt))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&s($,"remainingPercent",l)&&s($,"usedPercent",l)&&s($,"resetsAt",o3)&&s($,"limit",l)&&s($,"used",l)&&s($,"remaining",l)&&s($,"unit",o3)}function $9($){return A0($)&&l($.value)&&Number.isInteger($.value)&&$.value>=0&&l($.checkedAt)}function r3($){return A0($)&&Object.values($).every($9)}function P8($){return typeof $==="boolean"}function z1($){return A0($)&&typeof $.hasCredits==="boolean"&&typeof $.unlimited==="boolean"&&s($,"balance",l)&&s($,"overageLimitReached",P8)&&l($.checkedAt)}function Z9($){if(!A0($))return;let Z=Object.entries($).filter(([,J])=>$9(J));return Z.length===0?void 0:Object.fromEntries(Z)}function x0($){if(Z1($))return $;if(!A0($))return;let{counters:Z,credits:J,...z}=$;if(!Z1(z))return;let X=Z9(Z),G=z1(J)?J:void 0;return{...z,...X===void 0?{}:{counters:X},...G===void 0?{}:{credits:G}}}function Z1($){if(!A0($)||!Array.isArray($.limits))return!1;let Z=new Set;for(let J of $.limits){if(!N8(J))return!1;let z=J1(J.scope,J.label);if(Z.has(z))return!1;Z.add(z)}return s($,"budget",L8)&&s($,"counters",r3)&&s($,"credits",z1)}class i1 extends TypeError{constructor($){super($);this.name="QuotaCodecError"}}function r1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function o1($){return typeof $==="number"&&Number.isFinite($)}function J9($){return $===void 0||typeof $==="string"&&$!==""}function z9($){return typeof $==="string"&&$!==""}function C1($,Z){return $[Z]===void 0||o1($[Z])}function t3($,Z){return $[Z]===void 0||typeof $[Z]==="string"}function C8($){return r1($)&&J9($.scope)&&z9($.label)&&o1($.usedPercent)&&t3($,"resetsAt")&&($.windowMinutes===void 0||o1($.windowMinutes)&&$.windowMinutes>0)}function O8($){return r1($)&&J9($.scope)&&z9($.label)}function A8($){if(!r1($))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&C1($,"remainingPercent")&&C1($,"usedPercent")&&t3($,"resetsAt")&&C1($,"limit")&&C1($,"used")&&C1($,"remaining")&&t3($,"unit")}function X1($){if(!r1($)||!o1($.checkedAt))return!1;let Z=$.readings??[],J=$.coverage??[];if(!Array.isArray(Z)||!Array.isArray(J))return!1;let z=new Set;for(let X of Z){if(!C8(X))return!1;let G=J1(X.scope??f0,X.label);if(z.has(G))return!1;z.add(G)}if(!J.every(O8))return!1;return($.budget===void 0||A8($.budget))&&($.counters===void 0||r3($.counters))&&($.credits===void 0||z1($.credits))}function I8($,Z){if($.scope!==Z.scope)return $.scope<Z.scope?-1:1;if($.label!==Z.label)return $.label<Z.label?-1:1;return 0}function _8($,Z,J){if(Z===void 0)return $;if($!==void 0&&J<$.checkedAt)return $;return{...Z,checkedAt:J}}function R8($,Z){let J=new Map(Object.entries($??{}));for(let[z,X]of Object.entries(Z??{})){let G=J.get(z);if(G===void 0||X.checkedAt>=G.checkedAt)J.set(z,X)}return J.size===0?void 0:Object.fromEntries(J)}function S8($,Z){if(Z===void 0)return $;if($!==void 0&&Z.checkedAt<$.checkedAt)return $;return{...Z}}function O1($,Z){let J=$===void 0?void 0:x0($);if($!==void 0&&J===void 0)throw new i1("stored quota map is malformed");if(!X1(Z))throw new i1("quota observation is malformed");let z=J??{limits:[]},X=Z.checkedAt,G=new Map;for(let A of z.limits)G.set(J1(A.scope,A.label),A);let Q=(A)=>{let I=G.get(A);return I===void 0||X>=e2(I)},W=new Set;for(let A of Z.readings??[]){let I=A.scope??f0,R=J1(I,A.label);if(W.add(R),!Q(R))continue;G.set(R,{scope:I,label:A.label,kind:"reading",checkedAt:X,usedPercent:A.usedPercent,...A.resetsAt===void 0?{}:{resetsAt:A.resetsAt},...A.windowMinutes===void 0?{}:{windowMinutes:A.windowMinutes}})}for(let A of Z.coverage??[]){let I=A.scope??f0,R=J1(I,A.label);if(W.has(R)||!Q(R))continue;let v=G.get(R);G.set(R,v===void 0||v.kind==="absent"?{scope:I,label:A.label,kind:"absent",checkedAt:X}:{scope:I,label:A.label,kind:"retired",retiredAt:X})}let{limits:H,budget:U,counters:Y,credits:K,...M}=z,V=_8(z.budget,Z.budget,X),L=R8(z.counters,Z.counters),C=S8(z.credits,Z.credits);return{...M,limits:[...G.values()].sort(I8),...V===void 0?{}:{budget:V},...L===void 0?{}:{counters:L},...C===void 0?{}:{credits:C}}}var k8=Object.freeze({validate:Z1,decode:x0,merge:O1});function X9($,Z=""){let J=new Map,{observation:z}=$,X=(W,H,U)=>J.set(`${Z}:${W}`,{at:H,order:0,publication:{...$,observation:U}}),G=(W,H)=>JSON.stringify([W??"all",H]),Q=new Set;for(let W of z.readings??[]){let H=G(W.scope,W.label);Q.add(H),X(H,z.checkedAt,{checkedAt:z.checkedAt,readings:[{...W}]})}for(let W of z.coverage??[]){let H=G(W.scope,W.label);if(!Q.has(H))X(H,z.checkedAt,{checkedAt:z.checkedAt,coverage:[{...W}]})}if(z.budget)X("budget",z.checkedAt,{checkedAt:z.checkedAt,budget:{...z.budget}});for(let[W,H]of Object.entries(z.counters??{}))X(`counter:${W}`,H.checkedAt,{checkedAt:z.checkedAt,counters:{[W]:{...H}}});if(z.credits)X("credits",z.credits.checkedAt,{checkedAt:z.checkedAt,credits:{...z.credits}});if(!J.size)X("empty",z.checkedAt,{checkedAt:z.checkedAt});return J}import{createHash as f8}from"node:crypto";import{stat as x8}from"node:fs/promises";import{resolve as A1}from"node:path";function G9($,Z,J){if($.accountIdentity!==void 0&&J!==void 0)return $.accountIdentity===J;return $.credentialId===Z}function e3($,Z,J){return $.some((z)=>G9(z,Z,J))}function $$($,Z,J){let z={credentialId:Z,...J!==void 0&&{accountIdentity:J}};return[...$.filter((X)=>X.credentialId!==Z||X.accountIdentity!==J),z]}function Z$($,Z,J){return $.filter((z)=>!Z.some((X)=>G9(z,X,J)))}function J$($){return{declined:$.declined.map((Z)=>({...Z})),order:$.rows.flatMap((Z)=>W0(Z).map((J)=>({credentialId:J,...Z.accountIdentity!==void 0&&{accountIdentity:Z.accountIdentity}})))}}function y8($,Z){let J=W0(Z),z=Z.accountIdentity===void 0?-1:$.order.findIndex((G)=>G.accountIdentity===Z.accountIdentity),X=z>=0?z:$.order.findIndex((G)=>J.includes(G.credentialId));return X>=0?X:1/0}var e1="vault:";function g8($){return f8("sha256").update($).digest("hex")}function v8($){let Z=$.credentialId.split(":");return(Z.length>=3?Z.slice(2).join(":").trim():void 0)||$.email||$.credentialId}function h8($){return $.identity!==void 0?`identity:${$.identity}`:`credential:${$.credential.credentialId}`}function W0($){return[$.credentialId,...$.aliases??[]]}function H9($,Z,J={}){let z=J.now??Date.now(),X=J.routePrefix??e1,G=J.reservedRouteIds??new Set,Q=$?.rows??[],W=$?void 0:J.seed,H=[...$?.declined??W?.declined??[]],U=Z.skipped.length===0,Y=new Set(Z.credentials.map((F)=>F.credentialId)),K=new Set(Z.skipped.flatMap((F)=>F.credentialId===void 0?[]:[F.credentialId])),M=Z.skipped.some((F)=>F.credentialId===void 0),V=(F)=>!Y.has(F)&&(K.has(F)||M),L=new Map;for(let F of Q){if(F.accountIdentity===void 0)continue;for(let q of W0(F))if(!L.has(q))L.set(q,F.accountIdentity)}let C=new Map;for(let F of Z.credentials){let q=F.accountIdentity!==void 0?{credential:F,identity:F.accountIdentity,claimed:!0}:{credential:F,identity:L.get(F.credentialId),claimed:!1},B=h8(q),P=C.get(B)??[];P.push(q),C.set(B,P)}let A=new Set,I=new Set(G),R=[],v=(F,q)=>F.credential.credentialId.localeCompare(q.credential.credentialId),h=[...C.values()].map((F)=>F.toSorted(v)).sort((F,q)=>F[0]&&q[0]?v(F[0],q[0]):0);for(let F of h){let q=F[0]?.identity,B=F.filter((E)=>E.credential.state==="active"),P=B.length?B:F,y=P.filter((E)=>E.claimed),T=y.length?y:P,g=new Set(F.map((E)=>E.credential.credentialId)),$0=Q.find((E)=>!A.has(E)&&W0(E).some((K0)=>g.has(K0))&&(E.accountIdentity===void 0||E.accountIdentity===q)),p=T.find((E)=>E.credential.credentialId===$0?.credentialId)??T[0];if(!p)continue;let u=p.credential,a=$0??(q===void 0?void 0:Q.find((E)=>!A.has(E)&&E.accountIdentity===q));if(a)A.add(a);let q0=a?.routeId;if(!q0||G.has(q0)){let E=`${X}${u.credentialId}${q===void 0?"":`~${g8(q).slice(0,10)}`}`;q0=E;for(let K0=2;I.has(q0);K0++)q0=`${E}~${K0}`}I.add(q0);let y1=a?W0(a).filter(V):[],d0=[...new Set([...F.map((E)=>E.credential.credentialId),...y1])].filter((E)=>E!==u.credentialId).sort((E,K0)=>E.localeCompare(K0)),g1=J.mapAccount?.(u)??{};R.push({previousIndex:a?Q.indexOf(a):1/0,row:{routeId:q0,credentialId:u.credentialId,credentialType:u.credentialType,...q!==void 0&&{accountIdentity:q},...d0.length&&{aliases:d0},state:u.state,label:g1.label?.trim()||v8(u),...u.email!==void 0&&{email:u.email},...u.orgName!==void 0&&{orgName:u.orgName},enabled:![u.credentialId,...d0].some((E)=>e3(H,E,q)),addedAt:a?.addedAt??z,...a?.quota!==void 0&&{quota:a.quota},...!p.claimed&&q!==void 0&&{unclaimed:!0}}});let l0=R.at(-1);if(W&&l0)l0.previousIndex=y8(W,l0.row)}return Q.forEach((F,q)=>{if(A.has(F)||!W0(F).some(V))return;if(I.has(F.routeId))return;let[B,...P]=W0(F).filter((g)=>!Y.has(g));if(B===void 0)return;I.add(F.routeId);let{aliases:y,...T}=F;R.push({previousIndex:q,row:{...T,credentialId:B,...P.length&&{aliases:P},stale:!0}})}),R.sort((F,q)=>F.previousIndex===q.previousIndex?F.row.credentialId.localeCompare(q.row.credentialId):F.previousIndex-q.previousIndex),{version:1,view:Z.view,complete:U,...!U&&{rejected:Z.skipped.map((F)=>({...F.credentialId!==void 0&&{credentialId:F.credentialId},reason:F.reason}))},rows:R.map((F)=>F.row),declined:H}}function z$($){return($?.rows??[]).filter((Z)=>Z.enabled&&Z.state==="active").map((Z)=>({id:Z.routeId,kind:Z.credentialType==="oauth"?"oauth":"api-key",...Z.quota!==void 0&&{quota:Z.quota}}))}function I1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function G1($){return $===void 0||typeof $==="string"}function m8($){let Z=I1($)?x0($.quota):void 0;if(!I1($)||typeof $.routeId!=="string"||typeof $.credentialId!=="string"||$.credentialType!=="oauth"&&$.credentialType!=="api_key"||typeof $.state!=="string"||typeof $.label!=="string"||typeof $.enabled!=="boolean"||typeof $.addedAt!=="number"||!G1($.accountIdentity)||!G1($.email)||!G1($.orgName)||$.aliases!==void 0&&(!Array.isArray($.aliases)||!$.aliases.every((J)=>typeof J==="string"))||$.quota!==void 0&&Z===void 0||$.stale!==void 0&&$.stale!==!0||$.unclaimed!==void 0&&$.unclaimed!==!0)return;return{...$,...Z===void 0?{}:{quota:Z}}}var w8=new Set(["empty credential id","duplicate credential id","blank account identity","empty state"]);function Q9($){if(!Array.isArray($))return;let Z=[];for(let J of $){if(!I1(J)||!G1(J.credentialId)||typeof J.reason!=="string"||!w8.has(J.reason))return;Z.push(J)}return Z}function Y9($){if(!I1($)||$.version!==1||!G1($.view)||!Array.isArray($.rows)||!Array.isArray($.declined)||$.complete!==void 0&&typeof $.complete!=="boolean"||$.rejected!==void 0&&!Q9($.rejected))throw new O("invalid-state","Claustrum roster file is not valid");let Z=[];for(let X of $.rows){let G=m8(X);if(!G)throw new O("invalid-state","Claustrum roster file is not valid");Z.push(G)}let J=[];for(let X of $.declined){if(!I1(X)||typeof X.credentialId!=="string"||!G1(X.accountIdentity))throw new O("invalid-state","Claustrum roster file is not valid");J.push(X)}let z=Q9($.rejected);return{version:1,...typeof $.view==="string"&&{view:$.view},complete:$.complete!==!1,...z&&{rejected:z},rows:Z,declined:J}}function U9($){return Y9(JSON.parse(JSON.stringify($)))}async function w($){let Z;try{Z=await Z0($,_)}catch(z){if(z.code==="ENOENT")return;throw z}let J;try{J=JSON.parse(Z)}catch{throw new O("invalid-state","Claustrum roster file is not valid")}return Y9(J)}var q9={name:"claustrum-roster-write",ttlMs:1e4,timeoutMs:5000,renew:!0},K9={name:"claustrum-roster",ttlMs:30000};async function y0($,Z,J={}){return f3($,{...q9,signal:J.signal},async(z)=>{let X=await w($),{next:G,result:Q}=await Z(X,{assertOwned:()=>z.assertOwned()});if(G)await z.assertOwned(),await D1($,G,{beforeRename:async()=>{await J.beforePublish?.(),J.signal?.throwIfAborted(),await z.assertOwned()}});return Q})}function X$($,Z){return y0($,(J)=>{let z=J?.rows.find((G)=>G.routeId===Z);if(!J||!z)throw new O("route-unavailable","Claustrum route is not in the roster");let X=$$(J.declined,z.credentialId,z.accountIdentity);return{next:{...J,declined:X,rows:J.rows.map((G)=>G===z?{...G,enabled:!1}:G)},result:void 0}})}function G$($,Z){return y0($,(J)=>{let z=J?.rows.find((X)=>X.routeId===Z);if(!J||!z)throw new O("route-unavailable","Claustrum route is not in the roster");return{next:{...J,declined:Z$(J.declined,W0(z),z.accountIdentity),rows:J.rows.map((X)=>X===z?{...X,enabled:!0}:X)},result:void 0}})}function u8($){return new O("invalid-order",$)}function c8($,Z){if(!Array.isArray(Z))return"route ids must be an array of route ids";let J=new Set($.map((G)=>G.routeId)),z=new Set;for(let G of Z){if(typeof G!=="string")return"route ids must be an array of route ids";if(z.has(G))return`route id ${G} appears more than once`;if(!J.has(G))return`route id ${G} is not in the roster`;z.add(G)}let X=[...J].filter((G)=>!z.has(G)).length;if(X>0)return`the order leaves out ${X} roster route id${X===1?"":"s"}`;return}function Q$($,Z,J={}){return y0($,(z)=>{let X=z?.rows??[],G=c8(X,Z);if(G)throw u8(G);let Q=new Map;for(let U of X){let Y=Q.get(U.routeId);if(Y)Y.push(U);else Q.set(U.routeId,[U])}let W=[...Z],H=W.flatMap((U)=>Q.get(U)??[]);if(!z||H.every((U,Y)=>U===X[Y]))return{result:{ids:W,outcome:"unchanged"}};return{next:{...z,rows:H},result:{ids:W,outcome:"reordered"}}},{...J.signal&&{signal:J.signal}})}function p8($,Z){if(!W0($).includes(Z.credentialId))return"refuse";if($.unclaimed&&(Z.accountIdentitySource==="expected"||Z.accountIdentitySource==="none"))return"refuse";if($.accountIdentity===Z.accountIdentity)return"hold";if($.accountIdentity===void 0&&Z.expectedAccountIdentity===void 0&&Z.accountIdentity!==void 0&&(Z.accountIdentitySource==="asserted"||Z.accountIdentitySource==="parsed")&&W0($).length===1)return"bind";return"refuse"}async function W$($,Z){let{routeId:J,observation:z,...X}=Z;return F9($,{routeId:J,observation:z,accountIdentity:X.accountIdentity,receipt:X})}async function F9($,Z){if(!X1(Z.observation))return!1;let J=o($,await w($));if(!I0(J,Z).kept)return!1;return B9($,Z)}function H$($,Z){return F9($,Z)}function I0($,Z){let J=$?.rows.find((Q)=>Q.routeId===Z.routeId),z=!J?"refuse":Z.receipt?p8(J,Z.receipt):J.accountIdentity!==void 0&&J.accountIdentity===Z.accountIdentity?"hold":"refuse";if(!$||!J||z==="refuse")return{roster:$,kept:!1};let X=O1(J.quota,Z.observation),G=z==="bind"?{accountIdentity:Z.accountIdentity,unclaimed:!0}:{};return{roster:{...$,rows:$.rows.map((Q)=>Q===J?{...Q,...G,quota:X}:Q)},kept:!0}}var t1=new Map;function _1($){t1.delete(A1($))}function V9($,Z){let J=A1($);if(Z instanceof O)return Z.kind==="roster-busy";if(Z instanceof P0||Z instanceof B0)return A1(Z.details.target)===J;if(Z instanceof m){let z=A1(Z.path);return[q9.name,K9.name].some((X)=>{let G=N1(J,X);return z===G||z.startsWith(`${G}.`)})}return!1}var d8=4;async function W9($){try{let{dev:Z,ino:J,size:z,mtimeMs:X}=await x8($);return{dev:Z,ino:J,size:z,mtimeMs:X}}catch{return}}function l8($,Z){return $!==void 0&&Z!==void 0&&$.dev===Z.dev&&$.ino===Z.ino&&$.size===Z.size&&$.mtimeMs===Z.mtimeMs}async function a8($,Z,J){for(let z=0;z<d8;z++){let X=await W9($),G=await w($),Q,W,H;try{({target:Q,local:W}=Z(G));let U=JSON.stringify(J(Q));H=JSON.stringify(Q)!==U||W!==void 0&&JSON.stringify(W)!==U}catch{return"commit"}if(!l8(X,await W9($)))continue;if(H)return"commit";return j9($)?"commit":"unchanged"}return"commit"}async function R1($){$.signal?.throwIfAborted();let Z=async()=>await $.isActive?.()??!0;if(!await Z()){_1($.path);return}let J=await j0({...K9,path:$.path,renew:!0});if(!J){let Q=await w($.path);if($.signal?.throwIfAborted(),!Q?.view)throw new O("roster-busy","Claustrum account discovery is already in progress");return Q}let z=A1($.path),X=$.listedOver,G;try{let Q=await w($.path),W=X?void 0:t1.get(z);G=W&&(W.previousView===Q?.view||W.inventory.view===Q?.view)?W:{inventory:await $.custody.discover($.signal),previousView:Q?.view},t1.delete(z);let{inventory:H}=G;$.onInventory?.(H),$.signal?.throwIfAborted();let U=typeof $.projection==="function"?$.projection():$.projection,Y=(V)=>H9(V,H,U),K=async()=>{return $.signal?.throwIfAborted(),await J.assertOwned(),Z()};if(await a8($.path,(V)=>{if(X)return{target:V};let L=o($.path,V);return{target:V,...L!==V&&{local:L}}},Y)==="unchanged"){if(!await K())return;return await w($.path)}return await y0($.path,async(V)=>{if(!await Z())return{result:void 0};if($.signal?.throwIfAborted(),await J.assertOwned(),X&&V?.view!==X.view&&V?.view!==H.view)return{result:V};let L=Y(V);return{...JSON.stringify(V)!==JSON.stringify(L)&&{next:L},result:L}},{signal:$.signal,beforePublish:async()=>{$.signal?.throwIfAborted(),await J.assertOwned()}})}catch(Q){if(Q instanceof P0&&G&&!X&&!$.signal?.aborted&&await Z())t1.set(z,G);throw Q}finally{await J.release()}}var g0=new Map,s8=Q0("claustrum"),D9=100;function N9($,Z=i3){let J=$3($),z=g0.get(J);if(!z)z={path:J,pending:new Map,listeners:new Set,wake:new Set,abort:new AbortController,clock:Z,failures:0,draining:!1,order:0},g0.set(J,z);return z}function L9($,Z,J){let z=N9($,J);z.listeners.add(Z);let X;return()=>X??=(()=>{return z.listeners.delete(Z),z.listeners.size?Promise.resolve():Y$($)})()}function n8($){return X9($,JSON.stringify([$.routeId,$.receipt?.credentialId,$.receipt?.accountIdentitySource,$.receipt?.expectedAccountIdentity]))}function B9($,Z){if(!X1(Z.observation))return Promise.resolve(!1);let J=N9($),z=JSON.stringify([Z.accountIdentity??null,Z.accountIdentity===void 0?Z.routeId:null]),X=J.pending.get(z)??new Map;for(let[G,Q]of n8(Z)){let W=X.get(G);if(!W||Q.at>=W.at){if(Q.order=++J.order,Q.publication.observation.coverage)Q.priorReading=W?.publication.observation.readings?W.publication:W?.priorReading;X.set(G,Q)}}if(X.size)J.pending.set(z,X);for(let G of J.listeners)G(Z);return C9(J,D9),Promise.resolve(!0)}function P9($){return[...$.values()].flatMap((Z)=>[...Z.values()]).sort((Z,J)=>Z.order-J.order)}function o($,Z){let J=g0.get($3($));if(J)for(let z of P9(J.pending)){if(z.priorReading)Z=I0(Z,z.priorReading).roster;Z=I0(Z,z.publication).roster}return Z}function j9($){return!!g0.get($3($))?.pending.size}function C9($,Z){if($.running||$.timer||!$.pending.size||$.abort.signal.aborted)return;let J=$.draining?0:($.committedAt??-1/0)+n3-$.clock.now();if($.timer=$.clock.schedule(Math.max(Z,J),()=>{return $.timer=void 0,O9($)}),!$.draining)$.timer.unref?.()}function M9($){$.timer?.cancel(),$.timer=void 0}function O9($){if($.running||$.abort.signal.aborted)return $.running??Promise.resolve();let Z=new Map([...$.pending].map(([J,z])=>[J,new Map(z)]));return $.running=(async()=>{try{if(await y0($.path,(z)=>{let X=z;for(let Q of P9(Z)){if(Q.priorReading)X=I0(X,Q.priorReading).roster;X=I0(X,Q.publication).roster}let G=JSON.stringify(X)!==JSON.stringify(z);return{...G&&{next:X},result:G}},{signal:$.abort.signal}))$.committedAt=$.clock.now();for(let[z,X]of Z){let G=$.pending.get(z);for(let[Q,W]of X)if(G?.get(Q)===W)G.delete(Q);if(!G?.size)$.pending.delete(z)}$.failures=0}catch(J){if(!$.abort.signal.aborted&&$.failures++===0)s8.warn("vault quota publication delayed; retrying",{error:J instanceof Error?J.message:String(J)})}finally{$.running=void 0;for(let z of $.wake)z();let J=$.failures?Math.min(5000,100*2**Math.min($.failures,6))*(0.5+Math.random()):D9;C9($,J)}})(),$.running}async function Y$($,Z=1000){let J=$3($),z=g0.get(J);if(!z)return;z.draining=!0,M9(z);let X,G,Q=new Promise((W)=>{G=()=>{if(!z.pending.size||z.abort.signal.aborted)W()},z.wake.add(G),G()});try{if(z.pending.size)O9(z);await Promise.race([Q,new Promise((W)=>{X=setTimeout(W,Math.max(0,Z))})])}finally{if(clearTimeout(X),G)z.wake.delete(G);if(z.draining=!1,!z.listeners.size){if(z.abort.abort(),M9(z),z.pending.clear(),g0.get(J)===z)g0.delete(J)}}}var Z3=1e4;function A9(){return new r}var U$;function _9($,Z){if(!U$)throw Error("ClaustrumConsumer is not initialized");return U$($,Z)}function I9(){return new O("not-active","Claustrum scoped custody is not active")}class q${#$;#Z=new AbortController;#J;#W;#G;#Q;#z;#X;#j;#H;#Y=!1;#q=new Set;#V;#U;#M;#B;#N=new Map;#_;#P;#K;#D;#I=new WeakMap;static{U$=($,Z)=>{let J=new q$(Z);return J.#K=$,{consumer:J,hooks:J.#x()}}}constructor($){this.#$=$,this.#J=$.logger??Q0("claustrum"),this.#W=t0(this.#J,this.#Z.signal),this.#P=L9($.rosterPath,(Z)=>{this.#X=I0(this.#X,Z).roster})}#F($){this.#Z.signal.throwIfAborted(),$?.throwIfAborted()}#C($){return this.#q.add($),$.then(()=>this.#q.delete($),()=>this.#q.delete($)),$}async#A(){return await this.#$.isCustodyActive?.()??!0}#R($,Z){let J=k0([this.#Z.signal,...Z?[Z]:[]]);return new Promise((z,X)=>{let G=()=>{J.signal.removeEventListener("abort",Q),J.dispose()},Q=()=>{G(),X(J.signal.reason)};if(J.signal.addEventListener("abort",Q,{once:!0}),$.then((W)=>{if(G(),J.signal.aborted)X(J.signal.reason);else z(W)},(W)=>{G(),X(W)}),J.signal.aborted)Q()})}async#L(){if(this.#F(),this.#G)return this.#G;if(!this.#Q){let $={timedOut:!1};this.#Q=this.#O($),this.#C(this.#Q)}return this.#R(this.#Q)}#O($){let Z=this.#$.setTimeoutImpl??setTimeout,J=this.#$.clearTimeoutImpl??clearTimeout,z=this.#$.connect().then((Q)=>{if(this.#Z.signal.aborted||$.timedOut){if(Q.close(),!$.timedOut)this.#F();throw A9()}if(this.#G=new $1({client:Q,family:this.#$.family,tokenPath:this.#$.tokenPath,parseIdentity:this.#$.parseIdentity,requireAssertion:this.#$.requireAssertion,now:this.#$.now,logger:this.#J,setTimeoutImpl:this.#$.setTimeoutImpl,clearTimeoutImpl:this.#$.clearTimeoutImpl}),this.#$.insula&&Q.insula)this.#U=R3(Q.insula,this.#$.tokenPath);return this.#G}),X,G=new Promise((Q,W)=>{X=Z(()=>{if($.timedOut=!0,this.#Z.signal.aborted)return;this.#J.warn("vault connect timed out",{reason:"unreachable",connectTimeoutMs:this.#k()}),W(A9())},this.#k()),X.unref?.()});return Promise.race([z,G]).finally(()=>{if(X)J(X);this.#Q=void 0})}#k(){return this.#$.connectTimeoutMs??Z3}snapshot(){return this.#X}grantReach(){if(this.#K)return this.#K.grantReach(this.#X?.view);let $=this.#j;return $&&this.#X?.view===$.view?$.reach:void 0}watchState(){if(this.#K)return Object.freeze({vault:this.#K.watchMode()});return Object.freeze({vault:this.#M?.mode??"polling",...this.#$.insula&&{insula:this.#U?.source.watchMode()??"polling"}})}#S(){this.#M?.close(),this.#M=void 0,this.#B?.(),this.#B=void 0}keptReceiptState(){if(this.#K){let $=this.#D;return $&&this.#K.leaseLive($)?$.custody.keptReceiptState():this.#K.keptReceiptState()}return this.#G?.keptReceiptState()??Object.freeze({active:!1,since:null})}routingRows(){return z$(this.#X)}refresh(){if(this.#F(),this.#K)return this.#C(this.#y(this.#K));if(this.#z)return this.#z;return this.#z=(async()=>{if(!await this.#A()){if(this.#X=void 0,this.#j=void 0,this.#S(),this.#G)this.#G.close(),this.#C(this.#G.dispose(this.#W));this.#G=void 0,this.#U?.release(),this.#U=void 0;return}let $=await this.#L(),Z,J=await R1({path:this.#$.rosterPath,custody:$,onInventory:(X)=>{Z=X},isActive:()=>this.#A(),signal:this.#Z.signal,projection:()=>({reservedRouteIds:new Set(this.#$.reservedRouteIds?.()??[]),routePrefix:this.#$.routePrefix,mapAccount:this.#$.mapAccount,now:(this.#$.now??Date.now)()})});this.#F();let z=J?.view!==this.#X?.view;if(this.#X=o(this.#$.rosterPath,J),$.retain(J?.rows??[]),Z&&J?.view!==void 0)this.#j=Z.grantReach?{view:J.view,reach:Z.grantReach}:void 0;if(J&&z)this.#$.onRoster?.(J);return this.#_=(this.#$.now??Date.now)(),J})().finally(()=>{this.#z=void 0}),this.#C(this.#z),this.#z}start(){if(this.#Y)return;if(this.#F(),this.#Y=!0,this.#K){this.#K.start();return}let $=async()=>{try{if(await this.#b())await this.refresh();await this.refreshInsulaQuota(),this.#E()}catch(J){if(!this.#Z.signal.aborted)this.#$.onError?.(J)}if(this.#Z.signal.aborted)return;let Z=this.#$.pollIntervalMs??5000;if(Z<=0)return;this.#H=(this.#$.setTimeoutImpl??setTimeout)(()=>{this.#H=void 0,this.#C($())},Z),this.#H.unref?.()};this.#C($())}async#b(){if(this.#M?.mode!=="watching")return!0;let $=(this.#$.now??Date.now)();if(this.#_===void 0||$-this.#_>=a0)return!0;return!await this.#A()}#E(){let $=this.#G;if(this.#Z.signal.aborted||!$)return;if(this.#M??=$.watchRoster({view:()=>this.#X?.view,onView:()=>this.#C((async()=>{while(this.#z)await this.#z.catch(()=>{});if(this.#Z.signal.aborted)return;await this.refresh()})()),onRefused:(Z)=>this.#$.onError?.(Z),onError:(Z)=>{if(!this.#Z.signal.aborted)this.#$.onError?.(Z)}}),this.#$.insula&&this.#U&&!this.#B)this.#B=this.#U.source.watch({provider:this.#$.insula.provider,setTimeoutImpl:this.#$.setTimeoutImpl,clearTimeoutImpl:this.#$.clearTimeoutImpl})}async refreshInsulaQuota(){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#A())return;try{await O0(this.#$.tokenPath),await this.#L(),await this.#U?.source.refresh((this.#$.now??Date.now)())}catch{}}async cachedInsulaQuota($){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#A())return;try{return await O0(this.#$.tokenPath),this.#T($.assertedAccountIdentity)}catch{return}}async cachedInsulaQuotaForRoute($){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#A())return;try{await O0(this.#$.tokenPath);let J=o(this.#$.rosterPath,await w(this.#$.rosterPath))?.rows.find((z)=>z.routeId===$);return this.#T(J?.accountIdentity)}catch{return}}async lookupInsulaQuotaForRoute($){let Z=this.#$.insula;if(!Z||this.#Z.signal.aborted||!await this.#A())return{miss:"unreachable"};try{await O0(this.#$.tokenPath);let z=o(this.#$.rosterPath,await w(this.#$.rosterPath))?.rows.find((Q)=>Q.routeId===$)?.accountIdentity;if(!z||!this.#U)return{miss:"unreachable"};let X=this.#U.source.lookup(Z.provider,z,(this.#$.now??Date.now)()),G=X.reading&&Z.normalize(X.reading.entry,X.reading.context);if(X.miss)return{miss:X.miss,...G!==void 0&&{reading:G}};return G===void 0?{miss:"unreachable"}:{reading:G}}catch{return{miss:"unreachable"}}}async pollInsulaQuotaForRoute($,Z){let J=await this.lookupInsulaQuotaForRoute($);if(J.miss==="cold"||J.miss==="upstream-failed"){if(this.#N.get($)!==J.miss)this.#N.set($,J.miss),this.#J.warn("skipped insula provider poll",{reason:J.miss});return}return this.#N.delete($),J.miss?Z():J.reading}#T($){if(!this.#$.insula||!$)return;let Z=this.#U?.source.current(this.#$.insula.provider,$,(this.#$.now??Date.now)());return Z?this.#$.insula.normalize(Z.entry,Z.context):void 0}async authorize($,Z){if(this.#K)return this.#h(this.#K,$,Z);this.#F(Z);let J=this.#X??await this.#R(this.refresh(),Z);if(!J||!await this.#A())throw this.#G?.close(),this.#G=void 0,this.#S(),this.#U?.release(),this.#U=void 0,new O("not-active","Claustrum scoped custody is not active");let z=o(this.#$.rosterPath,await w(this.#$.rosterPath));this.#F(Z);let X=J.rows.find((H)=>H.routeId===$),G=z?.rows.find((H)=>H.routeId===$);if(G&&!G.enabled){if(X)this.#G?.forget(X.credentialId);throw new O("route-declined","Claustrum route is disabled")}if(!X||!G||G.state!=="active"||G.credentialId!==X.credentialId||G.accountIdentity!==X.accountIdentity||G.credentialType!==X.credentialType){if(X)this.#G?.forget(X.credentialId);throw new O("route-unavailable","Claustrum route is disabled, removed or changed")}let Q=await this.#R(this.#L(),Z),W=k0([this.#Z.signal,...Z?[Z]:[]]);try{return await Q.authorize({credentialId:G.credentialId,credentialType:G.credentialType,...G.accountIdentity!==void 0&&{accountIdentity:G.accountIdentity}},W.signal,$)}finally{W.dispose()}}#x(){return{install:($)=>{if(this.#Z.signal.aborted)return;let Z=$.view!==this.#X?.view;if(this.#X=o(this.#$.rosterPath,$),Z)try{this.#$.onRoster?.($)}catch(J){this.#$.onError?.(J)}},reset:()=>{this.#X=void 0},roster:()=>this.#X,projection:()=>({reservedRouteIds:new Set(this.#$.reservedRouteIds?.()??[]),routePrefix:this.#$.routePrefix,mapAccount:this.#$.mapAccount,now:(this.#$.now??Date.now)()}),onError:($)=>{if(!this.#Z.signal.aborted)this.#$.onError?.($)}}}async#y($){let Z=await $.refresh();if(this.#F(),!Z)return;if(Z.errors.has($.provider))throw Z.errors.get($.provider);return this.#X}#g($){if($&&this.#D!==$)return;this.#D?.release(),this.#D=void 0}async#f($,Z){let J=this.#D;if(J&&$.leaseLive(J))return J;this.#g();let z=await $.acquire(Z);if(this.#Z.signal.aborted)z.release(),this.#F();let X=this.#D;if(X&&$.leaseLive(X))return z.release(),X;return this.#D=z,z}async#h($,Z,J){if(this.#F(J),!this.#X)await this.#R($.refresh(),J);let z=this.#X;if(!await $.readAuthority())throw this.#g(),I9();if(this.#F(J),!z)throw new O("route-unavailable","Claustrum has no roster for this provider yet");let X=o(this.#$.rosterPath,await w(this.#$.rosterPath));this.#F(J);let G=z.rows.find((U)=>U.routeId===Z),Q=X?.rows.find((U)=>U.routeId===Z);if(Q&&!Q.enabled){if(G)$.forget(G.credentialId);throw new O("route-declined","Claustrum route is disabled")}if(!G||!Q||Q.state!=="active"||Q.credentialId!==G.credentialId||Q.accountIdentity!==G.accountIdentity||Q.credentialType!==G.credentialType){if(G)$.forget(G.credentialId);throw new O("route-unavailable","Claustrum route is disabled, removed or changed")}let W={credentialId:Q.credentialId,credentialType:Q.credentialType,...Q.accountIdentity!==void 0&&{accountIdentity:Q.accountIdentity}},H=k0([this.#Z.signal,...J?[J]:[]]);try{for(let U=0;;U++){let Y=await this.#f($,H.signal);try{let K=await Y.custody.authorize(W,H.signal,Z);return this.#I.set(K,Y),K}catch(K){if(U>0||H.signal.aborted||$.leaseLive(Y)||!(K instanceof O)||K.kind!=="closed")throw K;if(this.#g(Y),!await $.readAuthority())throw I9()}}}finally{H.dispose()}}async reportFailure($,Z,J){if(this.#F(),this.#K){let z=this.#I.get($);if(!z)throw new O("no-receipt","Claustrum dispatch receipt has no active owner");await z.custody.reportFailure($,Z,J);return}if(!this.#G)throw new O("no-receipt","Claustrum dispatch receipt has no active owner");await this.#G.reportFailure($,Z,J)}async send($,Z,J){let z=J.signal,X=await this.authorize($,z),G=await Z(X,z);if(G.status===401&&X.fromKeptReceipt)return await this.reportFailure(X,401,J.reporterSource??"direct"),G;if(G.status===401&&!z?.aborted){let Q;try{Q=await this.authorize($,z),z?.throwIfAborted()}catch(W){if(z?.aborted)throw W}if(s3(J.site,X,Q,this.#J))await G.body?.cancel().catch(()=>{}),X=Q,G=await Z(Q,z)}if(G.status===401)await this.reportFailure(X,401,J.reporterSource??"direct").catch((Q)=>this.#$.onError?.(Q)),Promise.resolve().then(()=>this.refresh()).catch((Q)=>{if(!this.#Z.signal.aborted)this.#$.onError?.(Q)});return G}async decline($){if(this.#F(),await X$(this.#$.rosterPath,$),this.#X=o(this.#$.rosterPath,await w(this.#$.rosterPath)),this.#K)this.#K.retainUnion();else this.#G?.retain(this.#X?.rows??[])}async accept($){this.#F(),await G$(this.#$.rosterPath,$),this.#X=o(this.#$.rosterPath,await w(this.#$.rosterPath))}async reorder($){this.#F();let Z=await Q$(this.#$.rosterPath,$);return this.#X=o(this.#$.rosterPath,await w(this.#$.rosterPath)),Z}async recordQuota($,Z,J){return this.#F(),W$(this.#$.rosterPath,{routeId:$,observation:Z,credentialId:J.credentialId,accountIdentitySource:J.accountIdentitySource,...J.accountIdentity!==void 0&&{accountIdentity:J.accountIdentity},...J.expectedAccountIdentity!==void 0&&{expectedAccountIdentity:J.expectedAccountIdentity}})}async recordAccountQuota($,Z,J){return this.#F(),H$(this.#$.rosterPath,{routeId:$,accountIdentity:Z,observation:J})}close(){if(this.#Z.signal.aborted)return;if(this.#Z.abort(new O("closed","Claustrum consumer is closed")),this.#H)(this.#$.clearTimeoutImpl??clearTimeout)(this.#H);if(this.#H=void 0,this.#S(),this.#G)this.#G.close(),this.#C(this.#G.dispose(this.#W));this.#D?.release(),this.#D=void 0,this.#K?.detach(),this.#U?.release(),this.#U=void 0,this.#X=void 0,this.#j=void 0,this.#P(),_1(this.#$.rosterPath)}async dispose(){this.close(),this.#V??=Promise.all([e0(this.#q,this.#W),this.#P()]).then(()=>{}),await this.#V}}import{createHash as i8}from"node:crypto";import{readdir as o8,stat as r8}from"node:fs/promises";import{dirname as t8,join as Q1}from"node:path";var e8=/^[a-z0-9][a-z0-9._-]{0,63}$/,$6=/^(con|prn|aux|nul|com[0-9]|lpt[0-9])(\.|$)/,Z6=/^[0-9a-f]{16}$/,R9=3;function F$($,Z=new Set){if($===null)return"null";if(typeof $==="string"||typeof $==="boolean")return JSON.stringify($);if(typeof $==="number")return Number.isFinite($)?JSON.stringify($):void 0;if(typeof $!=="object"||Z.has($))return;let J=new Set(Z).add($),z=[];if(Array.isArray($)){for(let G=0;G<$.length;G++){let Q=F$($[G],J);if(Q===void 0)return;z.push(Q)}return`[${z.join(",")}]`}let X=Object.getPrototypeOf($);if(X!==Object.prototype&&X!==null)return;for(let G of Object.keys($).sort()){let Q=F$($[G],J);if(Q===void 0)return;z.push(`${JSON.stringify(G)}:${Q}`)}return`{${z.join(",")}}`}function J6($,Z){let J=F$({format:1,classifier:$.classifierInput,members:[...Z].sort(),routePrefix:$.routePrefix??e1,mapAccount:$.mapAccount?String($.mapAccount):null});if(J===void 0)throw new O("invalid-state","Claustrum hub classifierInput must be plain JSON");return i8("sha256").update(J).digest("hex").slice(0,16)}function S9($,Z){if(typeof $!=="string"||!e8.test($)||$6.test($))throw new O("invalid-state",`Claustrum hub ${Z} must be a lowercase file-safe id`);return $}function _0($="Claustrum custody lease is closed"){return new O("closed",$)}function K$(){return new O("not-active","Claustrum scoped custody is not active")}function k9(){return new r}function z6($,Z){return new Promise((J,z)=>{let X=()=>z(Z.reason);if(Z.addEventListener("abort",X,{once:!0}),$.then((G)=>{Z.removeEventListener("abort",X),J(G)},(G)=>{Z.removeEventListener("abort",X),z(G)}),Z.aborted)X()})}function T9($){return JSON.stringify(($?.rows??[]).map((Z)=>[Z.credentialId,Z.enabled]))}class E9{#$;#Z;#J;#W=new AbortController;#G=new Map;#Q=new WeakMap;#z=0;#X;#j;#H;#Y;#q;#V;#U=0;#M;#B;#N;#_=!1;#P=new Set;#K;#D;#I;constructor($){if(!$.family||!("classify"in $.family))throw new O("wrong-consumer","Claustrum discovery hub requires a classifying family");let Z=S9($.hostGeneration,"host generation"),J=$.members.map((X)=>S9(X,"member"));if(new Set(J).size!==J.length)throw new O("invalid-state","Claustrum hub members must be distinct");this.#$=$,this.#Z=$.logger??Q0("claustrum"),this.#J=t0(this.#Z,this.#W.signal),this.#D=Q1($.stateDir,"rosters",Z),this.#I=J6($,J);let z=Q1(this.#D,this.#I);for(let X of J)this.#G.set(X,{provider:X,path:Q1(z,`${X}.json`),closed:!1})}#F($){return this.#P.add($),$.then(()=>this.#P.delete($),()=>this.#P.delete($)),$}#C(){if(this.#W.signal.aborted)throw _0("Claustrum discovery hub is closed")}#A($){let Z=this.#G.get($);if(!Z)throw new O("wrong-consumer","Claustrum hub has no such member");return Z}rosterPath($){return this.#A($).path}member($,Z){this.#C();let J=this.#A($);if(J.hooks)throw new O("wrong-consumer","Claustrum hub member was already built");for(let W of["rosterPath","tokenPath","family","connect","isCustodyActive","insula","pollIntervalMs","routePrefix","mapAccount"])if(W in Z)throw new O("wrong-consumer",`Claustrum hub members cannot take ${W}`);let z={provider:J.provider,start:()=>this.start(),refresh:()=>this.#m(),readAuthority:()=>this.#y(),acquire:(W)=>this.acquire(W),leaseLive:(W)=>this.#O(W),grantReach:(W)=>W!==void 0&&this.#M?.view===W?this.#M.reach:void 0,watchMode:()=>this.watchState(),keptReceiptState:()=>this.keptReceiptState(),retainUnion:()=>this.#w(),forget:(W)=>this.#X?.custody?.forget(W),detach:()=>{J.closed=!0}},X={rosterPath:J.path,...Z.reservedRouteIds&&{reservedRouteIds:Z.reservedRouteIds},...this.#$.routePrefix!==void 0&&{routePrefix:this.#$.routePrefix},...this.#$.mapAccount&&{mapAccount:this.#$.mapAccount},...Z.onRoster&&{onRoster:Z.onRoster},...Z.onError&&{onError:Z.onError},logger:Z.logger??this.#Z,...this.#$.now&&{now:this.#$.now}},{consumer:G,hooks:Q}=_9(z,X);return J.hooks=Q,G}#R(){let $={id:++this.#z,count:0,ended:!1,controller:new AbortController};return this.#X=$,$}#L($){return!$.ended&&this.#X===$&&!this.#W.signal.aborted}#O($){let Z=this.#Q.get($);return!!Z&&!Z.released&&!Z.generation.ended}#k($,Z=_0()){if($.ended)return;if($.ended=!0,$.count=0,this.#X===$)this.#X=void 0;if(this.#H&&this.#Q.get(this.#H)?.generation===$)this.#H=void 0;if(this.#Y?.generation===$)this.#Y.watch.close(),this.#Y=void 0;if($.controller.abort(Z),$.custody)$.custody.close(),this.#F($.custody.dispose(this.#J))}#S($){if($.ended)return;if($.count--,$.count<=0)this.#k($)}#b($){let Z=this.#j;if(Z?.generation===$&&Z.promise)return Z.promise;let J={generation:$,timedOut:!1},z=this.#$.connectTimeoutMs??Z3,X,G=this.#$.connect().then((H)=>{if(J.timedOut)throw H.close(),k9();if(!this.#L($)||$.count<=0)throw H.close(),_0("Claustrum connection is no longer wanted");return $.custody=new $1({client:H,family:this.#$.family,tokenPath:this.#$.tokenPath,parseIdentity:this.#$.parseIdentity,requireAssertion:this.#$.requireAssertion,now:this.#$.now,logger:this.#Z,setTimeoutImpl:this.#$.setTimeoutImpl,clearTimeoutImpl:this.#$.clearTimeoutImpl}),$.custody}),Q=new Promise((H,U)=>{X=(this.#$.setTimeoutImpl??setTimeout)(()=>{if(J.timedOut=!0,!this.#L($))return;this.#Z.warn("vault connect timed out",{reason:"unreachable",connectTimeoutMs:z}),U(k9())},z),X.unref?.()});return J.promise=this.#F(Promise.race([G,Q]).finally(()=>{if(X)(this.#$.clearTimeoutImpl??clearTimeout)(X)})),J.promise.finally(()=>{if(this.#j===J)this.#j=void 0}).catch(()=>{}),this.#j=J,J.promise}acquire($){try{if(this.#C(),$?.throwIfAborted(),this.#V===!1)throw K$()}catch(J){return Promise.reject(J)}let Z=this.#X??this.#R();return Z.count++,this.#E(Z,$,!0)}async#E($,Z,J){let z=$.custody;if(!z){let X=k0([$.controller.signal,...Z?[Z]:[]]);try{z=await z6(this.#b($),X.signal)}catch(G){if(!$.ended)throw this.#S($),G;return this.#T(Z,J)}finally{X.dispose()}}if($.ended)return this.#T(Z,J);if(Z?.aborted)throw this.#S($),Z.reason;return this.#x($,z)}#T($,Z){if($?.throwIfAborted(),this.#C(),this.#V===!1)throw K$();if(!Z)throw _0();let J=this.#X??this.#R();return J.count++,this.#E(J,$,!1)}#x($,Z){let J={generation:$,custody:Z,released:!1},z=()=>{if(J.released||$.ended)throw _0()},X=Object.freeze({authorize:async(Q,W,H)=>{z();let U=k0([$.controller.signal,...W?[W]:[]]);try{return await Z.authorize(Q,U.signal,H)}finally{U.dispose()}},reportFailure:async(Q,W,H)=>{return z(),Z.reportFailure(Q,W,H)},forget:(Q)=>{z(),Z.forget(Q)},keptReceiptState:()=>{return z(),Z.keptReceiptState()}}),G=Object.freeze({custody:X,generation:$.id,release:()=>{if(J.released)return;J.released=!0,this.#S($)}});return this.#Q.set(G,J),G}leaseState(){let $=this.#X;return Object.freeze({generation:$?.id,count:$?.count??0})}async#y(){let $=await this.#$.isCustodyActive?.()??!0;if(this.#W.signal.aborted)return!1;let Z=this.#V;if(this.#V=$,!$&&Z!==!1)this.#g();return $}#g(){this.#U++;let $=this.#X;if($)this.#k($,K$());this.#H=void 0,this.#Y?.watch.close(),this.#Y=void 0,this.#M=void 0,this.#B=void 0;for(let Z of this.#G.values())Z.seen=void 0,Z.pending=void 0,Z.hooks?.reset(),_1(Z.path)}#f(){return[...this.#G.values()].filter(($)=>$.hooks&&!$.closed)}async#h(){let $=this.#H,Z=$&&this.#Q.get($);if($&&Z&&this.#O($))return Z;this.#H=void 0;let J=await this.acquire(this.#W.signal),z=this.#H&&this.#Q.get(this.#H);if(this.#H&&z&&this.#O(this.#H))return J.release(),z;this.#H=J;let X=this.#Q.get(J);if(!X)throw _0();return X}#m(){try{this.#C()}catch(z){return Promise.reject(z)}let $=this.#q;if($&&!$.generation?.ended)return $.promise;let Z={},J=this.#F(this.#s(Z).finally(()=>{if(this.#q===Z)this.#q=void 0}));return Z.promise=J,this.#q=Z,J}async#s($){if(!await this.#y())return;let Z=await this.#h(),J=Z.generation;if($.generation=J,!this.#L(J))return;let z=await this.#i().then(()=>{return},(Y)=>Y instanceof Error?Y:Error(String(Y))),X=new Map(await Promise.all([...this.#G.values()].map(async(Y)=>[Y,await w(Y.path).then((K)=>K?{file:K}:{},(K)=>K instanceof Error?K:Error(String(K)))])));if(!this.#L(J))return;let G;try{G=await Z.custody.discover(J.controller.signal)}catch(Y){if(!this.#L(J))return;for(let K of this.#G.values())if(K.pending)this.#v(K);throw Y}if(!this.#L(J))return;let Q=this.#f(),W=await Promise.all(Q.map((Y)=>Y.hooks&&!Y.closed?this.#n(Y,Y.hooks,G,z??X.get(Y),J):void 0));if(!this.#L(J))return;let H=new Map,U=!0;for(let[Y,K]of Q.entries()){let M=K.hooks,V=W[Y];if(!M||!V)continue;if("error"in V){let{error:C}=V;if(U=!1,this.#v(K),V9(K.path,C))this.#Z.debug("claustrum hub member commit refused",{member:K.provider});else H.set(K.provider,C);continue}let{roster:L}=V;if(!this.#L(J))return;if(L?.view!==G.view)U=!1,this.#v(K);else K.pending=void 0;if(!L)continue;if(this.#u(M,L)){U=!1,this.#v(K);continue}if(K.seen=JSON.stringify(U9(L)),!K.closed)M.install(L)}if(!this.#L(J))return;if(this.#w(),U)this.#M=Object.freeze({view:G.view,...G.grantReach&&{reach:G.grantReach},refused:Object.freeze([...G.refused??[]]),notMine:G.notMine??0});return this.#B=(this.#$.now??Date.now)(),{errors:H}}async#n($,Z,J,z,X){let G={...J,credentials:J.credentials.filter((Q)=>Q.member===$.provider),skipped:J.skipped.filter((Q)=>Q.member===$.provider)};try{if(!z)throw _0("Claustrum hub member has no base view");if(z instanceof Error)throw z;let Q=z.file?void 0:await this.#o($);return{roster:await R1({path:$.path,custody:{discover:async()=>G},isActive:()=>this.#L(X)&&this.#V===!0,signal:X.controller.signal,projection:()=>({...Z.projection(),...Q&&{seed:Q}}),listedOver:{view:z.file?.view}})}}catch(Q){return{error:Q}}}async#i(){for(let $ of[t8(this.#D),this.#D,Q1(this.#D,this.#I)])await r0($,{},"roster directory")}async#o($){let Z=`${$.provider}.json`,J=[Q1(this.#D,Z)];try{for(let X of await o8(this.#D))if(X!==this.#I&&Z6.test(X))J.push(Q1(this.#D,X,Z))}catch{}let z;for(let X of J)try{let G=(await r8(X)).mtimeMs,Q=await w(X);if(Q&&(!z||G>z.modified))z={modified:G,roster:Q}}catch{}return z&&J$(z.roster)}#u($,Z){let J=$.projection().reservedRouteIds;return!!J?.size&&Z.rows.some((z)=>J.has(z.routeId))}#v($){let Z=($.pending?.failures??0)+1,J=Math.max(1,this.#$.pollIntervalMs??5000),z=Math.max(1,Math.ceil(a0/J)),X=Z<=R9?1:Math.min(2**(Z-R9),z);$.pending={failures:Z,wait:X-1}}#w(){let $=this.#X?.custody;if(!$)return;$.retain(this.#f().flatMap((Z)=>Z.hooks?.roster()?.rows??[]))}async#r(){let $=this.#U;for(let Z of this.#f()){let J;try{J=await w(Z.path)}catch(W){Z.hooks?.onError(W);continue}if($!==this.#U||this.#V!==!0)return;let z=Z.hooks;if(!J||!z||Z.closed)continue;let X=JSON.stringify(J);if(X===Z.seen)continue;let G=z.roster();if(!G||G.view!==J.view||this.#u(z,J)){Z.pending??={failures:0,wait:0};continue}let Q=T9(G);if(Z.seen=X,z.install(J),T9(z.roster())!==Q)this.#w()}}#t(){let $=!1;for(let J of this.#G.values()){if(!J.pending)continue;if(J.pending.wait<=0)$=!0;else J.pending.wait--}if(this.#Y?.watch.mode!=="watching"||$)return!0;let Z=(this.#$.now??Date.now)();return this.#B===void 0||Z-this.#B>=a0}#e(){let $=this.#H,Z=$&&this.#Q.get($);if(!$||!Z||!this.#O($)||this.#V!==!0)return;let J=Z.generation;if(!this.#L(J)||this.#Y?.generation===J)return;let z=Z.custody.watchRoster({view:()=>this.#M?.view,onView:()=>this.#F((async()=>{while(this.#q)await this.#q.promise.catch(()=>{});if(!this.#L(J))return;await this.#l()})()),onRefused:(X)=>this.#p(X),onError:(X)=>this.#c(X)});this.#Y={generation:J,watch:z}}#c($){if(!this.#W.signal.aborted)this.#$.onError?.($)}#p($){if(this.#W.signal.aborted)return;this.#$.onError?.($);for(let Z of this.#f())Z.hooks?.onError($)}#d($){for(let[Z,J]of $?.errors??[])this.#G.get(Z)?.hooks?.onError(J)}async#l(){let $;try{$=await this.#m()}catch(Z){this.#p(Z);return}this.#d($)}async#a(){try{if(await this.#y()){if(await this.#r(),this.#t())await this.#l();this.#e()}}catch(Z){this.#c(Z)}if(this.#W.signal.aborted)return;let $=this.#$.pollIntervalMs??5000;if($<=0)return;this.#N=(this.#$.setTimeoutImpl??setTimeout)(()=>{this.#N=void 0,this.#F(this.#a())},$),this.#N.unref?.()}start(){if(this.#_)return;this.#C(),this.#_=!0,this.#F(this.#a())}async refresh(){this.#d(await this.#m())}refusals(){let $=this.#M;return $&&Object.freeze({view:$.view,refused:$.refused,notMine:$.notMine})}grantReach(){return this.#M?.reach}watchState(){let $=this.#Y;return $&&this.#L($.generation)?$.watch.mode:"polling"}keptReceiptState(){return this.#X?.custody?.keptReceiptState()??Object.freeze({active:!1,since:null})}close(){if(this.#W.signal.aborted)return;if(this.#W.abort(_0("Claustrum discovery hub is closed")),this.#N)(this.#$.clearTimeoutImpl??clearTimeout)(this.#N);this.#N=void 0;let $=this.#X;if($)this.#k($);this.#H=void 0,this.#Y?.watch.close(),this.#Y=void 0}async dispose(){this.close(),this.#K??=e0(this.#P,this.#J),await this.#K}}var h0={opencode:Q6,pi:W6};function V$($,Z){let{tokenPath:J}=b9($,Z);return{stateDir:G6(J),host:$,override:J}}function B$($,Z){return H6($==="pi"?Z.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE:void 0,$==="pi"?{...Z,OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE:void 0}:Z)}class v0 extends Error{code;constructor($){super($==="permission-refused"?"Native vault setup: permission-refused. Could not grant this host read access to native Claude accounts. An older ck may refuse a grant that already exists. Update CortexKit tools and run setup again.":`Native vault setup: ${$}`);this.code=$;this.name="NativeVaultEnrollmentError"}}function j$($,Z){let J=Z??h0[$];if(typeof J!=="string"||!/^[A-Za-z0-9_-]{1,128}$/.test(J))throw new v0("permission-refused");return["auth","grant","--principal",`enrolled:${J}`,"--selector-kind","category","--selector","anthropic-native","--operation","read"]}async function f9($,Z){try{await Z.processFence();let J=await n1(Z.paths??b9($,Z.env),h0[$]);if(J.state==="blocked")throw new v0("permission-refused");let z=J.state==="approved"?J.approvedName:void 0,X=j$($,z);if((await Z.runner.run(Z.ckBinary??"ck",X,{env:Z.env})).exitCode!==0)throw new v0("permission-refused");return z}catch{throw new v0("permission-refused")}}import{createHash as B6}from"node:crypto";import{lstat as j6,mkdir as M6,readFile as d9}from"node:fs/promises";import{dirname as D6}from"node:path";import{assertHostsStopped as N6,canonicalPath as D$,createNativeAccountRuntime as L6,custodyTombstoneOAuth as P6,inspectNativeHostAuthEntry as l9,NativeMigrationError as m0,nativeJournalMayAdoptLaterHostLogin as C6,nativePoolHoldsAccountData as O6,prepareNativeMigration as A6,readNativeEnrollmentMode as a9,readNativeMigrationJournal as I6,releaseNativeMigrationPreflight as _6,requireNoSupervisedAuthContentSnapshot as R6,runNativeMigration as S6,writeNativeHostAuth as k6}from"@cortexkit/anthropic-auth-core";import{dirname as Y6,join as x9,resolve as M$}from"node:path";import{ACCOUNT_FILE_NAME as y9,ACCOUNT_STATE_FILE_NAME as U6,canonicalPath as g9,getStickyRoutingStatePath as q6,resolveLocalRoutingDestination as K6,resolveNativePoolPaths as F6}from"@cortexkit/anthropic-auth-core";async function M0($,Z){let J=$==="pi"?m9(Z):v9(Z),z=$==="pi"?Z.PI_ANTHROPIC_AUTH_FILE?.trim():Z.OPENCODE_ANTHROPIC_AUTH_FILE?.trim(),X=M$(z||x9(J,y9)),G=M$(Z.OPENCODE_ANTHROPIC_AUTH_STATE_FILE?.trim()||(X.endsWith(y9)?x9(Y6(X),U6):`${X}.state.json`)),Q=await F6(X,G),W=$==="pi"?Z.PI_ANTHROPIC_AUTH_ROUTING_STATE_FILE?.trim():Z.OPENCODE_ANTHROPIC_AUTH_ROUTING_STATE_FILE?.trim();return{host:$,paths:Q,legacyConfigPath:X,legacyStatePath:G,hostAuthPath:$==="pi"?w9(Z):h9(Z),routingSourcePath:M$(W||q6(X)),routingDestinationPath:K6($,Q,Z)}}async function u9($){let Z=new Map;for(let J of $){let z=new Set;for(let[X,G]of[J.paths.legacyConfig,J.paths.legacyState,J.paths.config,J.paths.state,J.paths.runtime,J.paths.roster,J.paths.journal,J.hostAuthPath,J.routingSourcePath,J.routingDestinationPath].entries()){let Q=await g9(G);if(z.has(Q)&&!(X===9&&Q===await g9(J.routingSourcePath)))throw Error("Native setup storage paths overlap");let W=Z.get(Q);if(W!==void 0&&W!==J.host)throw Error("Native setup storage paths overlap between selected hosts");Z.set(Q,J.host),z.add(Q)}}}import{types as V6}from"node:util";var c9=new WeakMap;function p9($){return typeof $==="object"&&$!==null?c9.get($):void 0}function W1($){if(!$||typeof $!=="object"||V6.isProxy($))return;if(Object.getOwnPropertyDescriptor($,"name")?.value==="ProcessInspectionError"&&Object.getOwnPropertyDescriptor($,"code")?.value==="process-inspection-failed")return"Process inspection failed; setup cannot prove hosts are stopped.";return}class n extends Error{constructor($){super($);this.name="SetupRefusal",c9.set(this,$)}}var N$="OpenCode's separate Anthropic login is not used. Add that account through /claude Accounts if needed, or remove the separate login from OpenCode.";function s9($){let Z=$==="opencode"?"OpenCode":"Pi";return`${Z} is still connected to the vault. Old local settings do not disconnect it. In ${Z}, run /claude → Accounts → Disconnect from the vault. Then run local setup again.`}async function L$($,Z){let J=[];for(let z of $)if(await a9(z,Z)!=="local")J.push(s9(z));if(J.length)throw new n(J.join(`
+`))}function w0($,Z){return async()=>{R6(Z.env);try{await N6(Z.fence,Z.env)}catch(J){let z=W1(J);if(z)throw new n(z);throw J}await L$([$],Z.env)}}async function P$($){try{return B6("sha256").update(await d9($)).digest("hex")}catch(Z){if(Z.code==="ENOENT")return"absent";throw new m0("unsafe-source")}}async function S1($,Z){let J;try{J=JSON.parse(await d9(Z,"utf8"))}catch(G){if(G.code!=="ENOENT")throw new m0("unsafe-source")}let z=l9($,J),X=J?.anthropic;return{...z,realLogin:z.kind==="oauth"&&Boolean(X?.access&&X.refresh)}}async function J3($,Z){let{paths:J}=$,z=$.generation2?void 0:await S1(J.host,J.hostAuthPath),X=await Promise.all([J.paths.config,J.paths.state,J.paths.runtime,J.paths.roster,J.paths.journal,J.routingDestinationPath].map(P$));return JSON.stringify([await a9(J.host,Z),z?.digest,...X])}async function C$($,Z,J){let z=Z.paths??await M0($,Z.env),X=w0($,Z);await X();let G=await I6(z.paths);if(G&&G.host!==$)throw new m0("invalid-source");let Q=G?.phase==="committed"||G?.phase==="retired";if(G&&G.kind!=="empty-init"&&(G.hostAuthPath!==await D$(z.hostAuthPath)||G.routingPaths.source!==await D$(z.routingSourcePath)||G.routingPaths.destination!==await D$(z.routingDestinationPath)))throw new m0("invalid-source");let W={paths:z,generation2:J,action:"migration",notice:!1,fingerprint:"",authorityPhase:G?.phase??"absent",poolPopulation:"not-evaluated"};if(J){if(G&&!Q)throw new m0("invalid-source");if(W.action=G?"reuse":"empty-init",!G){let H=[z.paths.config,z.paths.state,z.paths.runtime,z.paths.roster];if(!Z.env.OPENCODE_ANTHROPIC_AUTH_ROUTING_STATE_FILE)H.push(z.routingDestinationPath);for(let U of H){try{await j6(U)}catch(Y){if(Y.code==="ENOENT")continue;throw new m0("unsafe-source")}throw new m0("invalid-source")}}}else{W.slot=await S1($,z.hostAuthPath);let H=C6(G,$)&&W.slot.kind==="oauth";W.poolPopulation=G?.kind==="empty-init"||H?await O6({paths:z.paths}):"not-evaluated";let U=W.poolPopulation===!0;if($==="opencode"&&(U||Q&&G?.kind!=="empty-init"&&!H&&W.slot.kind==="oauth"))W.action="skip",W.notice=W.slot.realLogin;else W.preflight=await A6({...z,env:Z.env,processFence:X,removePiAnthropicAuth:Z.removePiAnthropicAuth})}return W.fingerprint=await J3(W,Z.env),W}async function H1($,Z){await w0($.paths.host,Z)();let J=await C$($.paths.host,{...Z,paths:$.paths},$.generation2);try{if(J.fingerprint!==$.fingerprint||J.action!==$.action)throw new n("Setup inputs changed. Rerun setup with all hosts stopped.")}finally{if(J.preflight)_6(J.preflight)}}async function O$($,Z){if($.paths.host!=="opencode"||$.slot?.kind!=="absent")return;let J=w0("opencode",Z);await J(),await M6(D6($.paths.hostAuthPath),{recursive:!0,mode:448}),await k6({host:"opencode",authPath:$.paths.hostAuthPath,sourceDigest:"absent",expectedDigest:l9("opencode",{anthropic:P6("anthropic")}).digest,env:Z.env,removePiAnthropicAuth:!1,processFence:J})}async function n9($,Z){let J={...Z.env},z=w0($,{...Z,env:J});await z();let X=Z.paths??await M0($,J),G=await Z.login?.($);if(G&&!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(G.accountIdentity))throw Error("Claude sign-in did not establish an account UUID");if(await z(),await Z.beforeCommit?.(),!Z.skipMigration)await S6({paths:X.paths,legacyConfigPath:X.legacyConfigPath,legacyStatePath:X.legacyStatePath,host:$,hostAuthPath:X.hostAuthPath,routingSourcePath:X.routingSourcePath,routingDestinationPath:X.routingDestinationPath,env:J,processFence:z,removePiAnthropicAuth:Z.removePiAnthropicAuth,preflight:Z.preflight});if(G){let Q=L6({paths:X.paths,host:$,vault:{env:J},beforePoolWrite:z});try{if((await Q.read()).mode!=="local")throw new n(s9($));await z(),await Q.loginOAuth({routeId:"main",replace:!0,...G})}finally{await Q.close()}}if(Z.skipMigration){let Q=await S1($,X.hostAuthPath);await O$({paths:X,slot:Q},Z)}}var i9={opencode:"OpenCode",pi:"Pi"};function h6($,Z,J){switch($){case"auth-content-refused":return"Run setup without OPENCODE_AUTH_CONTENT in the environment.";case"host-auth-invalid":return"The host auth file could not be read safely.";case"primary-conflict":return"Pi has a stored Anthropic API key, which would take precedence over the vault account. Remove it in Pi, then rerun setup.";case"consent-required":return"Pi has stored Anthropic authentication. Explicit consent is required to move it aside for vault use.";case"primary-unverified":return"The vault has no verified default Claude account. Sign in through the vault and rerun setup.";case"no-read-grant":return`${i9[Z]} has no read grant in the vault, so setup cannot see any Claude login. Run ${["ck",...j$(Z,J)].join(" ")}, then rerun setup.`;case"grant-reaches-nothing":return`${i9[Z]}'s vault read grant reaches no Claude login: no vault login carries the anthropic-native category, which logins saved before vault categories existed lack. Run ck auth reclassify --from-registry, check the logins with ck auth status, then rerun setup.`}}class J0 extends Error{host;approvedName;code;constructor($,Z="opencode",J){super(h6($,Z,J));this.host=Z;this.approvedName=J;this.name="NativeVaultActivationError",this.code=$}}function m6($){let Z=$?.grantReach;if(!Z||$.credentials.length>0||$.skipped.length>0)return"primary-unverified";return Z.grants===0?"no-read-grant":"grant-reaches-nothing"}async function I$($){try{return JSON.parse(await T6($,"utf8"))}catch(Z){if(Z.code==="ENOENT")return;throw new J0("host-auth-invalid")}}async function k1($,Z){if($==="opencode")return"opencode";let J=Z.paths??await M0($,Z.env),z=A$($,await I$(J.hostAuthPath)),X=_$({env:Z.env,authPath:J.hostAuthPath}),{stashPath:G}=y6({env:Z.env,authPath:J.hostAuthPath});return JSON.stringify([z.digest,await X.inspect(),await P$(G)])}async function o9($){try{v6($.env)}catch{throw new J0("auth-content-refused")}try{await E6($.fence,$.env)}catch(Z){let J=W1(Z);if(J)throw new n(J);throw Z}}async function r9($,Z){let J={...Z.env};await(()=>o9({...Z,env:J}))();let X=Z.paths??await M0($,J),G=$==="opencode"&&Z.inspectOpenCodeAuth!==!1&&A$("opencode",await I$(X.hostAuthPath)).kind==="oauth";if($==="pi"){let Q=A$("pi",await I$(X.hostAuthPath)),W=await _$({env:J,authPath:X.hostAuthPath}).inspect();if(W.slot==="placeholder"&&W.stash==="missing")throw new x6("missing-stash");if(Q.kind!=="absent"&&W.slot!=="placeholder"&&!Z.removePiAnthropicAuth)throw new J0("consent-required")}return{priorMode:await g6($,J),fingerprint:await k1($,{...Z,env:J}),separateOpenCodeLogin:G}}async function t9($,Z,J){let z={...Z.env},X=()=>o9({...Z,env:z});await X();let G=Z.paths??await M0($,z);if(await k1($,Z)!==J.fingerprint)throw new J0("host-auth-invalid");let Q=await f9($,{env:z,runner:Z.runner,processFence:X,ckBinary:Z.enrollment?.ckBinary,paths:Z.enrollment?.paths}),W=Z.discover??(()=>f6({paths:G.paths,host:$,env:$==="pi"?{...z,OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE:z.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE}:z})),H,U=async()=>{return H=await W(),H},Y=b6({paths:G.paths,host:$,vault:{env:z,discover:U}});try{await X(),await Y.vault.refresh();let K=await Y.read(),M=K.accounts.find((V)=>V.id==="main");if(K.mode!=="claustrum"||!M?.accountIdentity||M.source!=="vault"){let V=m6(H);throw V==="primary-unverified"?new J0(V):new J0(V,$,Q)}if(await X(),$==="pi")await _$({env:z,authPath:G.hostAuthPath}).enterVault();return J.priorMode==="claustrum"?"already-vault":"committed"}finally{await Y.close()}}var w6=/(?:^|[/\\])(opencode|litecode|opencode2|pi)(?:\.exe)?(?=$|\s|")/i;class R$ extends Error{activeHosts;constructor($){let Z=$.map((z)=>({pid:z.pid,command:w6.exec(z.command)?.[1]??"host"})),J=Z.map((z)=>`  - PID ${z.pid}: ${z.command}`).join(`
 `);super(`OpenCode or Pi processes are currently running:
 ${J}
 
-Please quit all OpenCode, LiteCode, and Pi processes before running setup.`);this.activeHosts=Z,this.name="ProcessFenceViolationError"}}var J5={"setup-activation":"Vault custody setup","setup-opencode-config":"OpenCode configuration","setup-pi-install":"Pi extension installation","setup-pi":"Pi setup","setup-process-check":"Host process check","cli-setup":"Setup","cli-login":"Login","cli-api-add":"API route setup","cli-list":"Account listing","cli-relay-setup":"Relay setup","cli-relay-workers-dev":"Workers.dev enablement","cli-command":"Command"};function R1(){return($)=>$}var _$=["opencode","pi"],z5=new Set(["enrolled","not-enrolled","unknown"]),Z4=R1()(["auth-content-refused","host-auth-invalid","primary-conflict","consent-required","primary-unverified","no-read-grant","grant-reaches-nothing"]),J4=R1()(["enrollment-refused","enrollment-reset","approval-refused","permission-refused"]),z4=R1()(["invalid-source","unsafe-source","consent-required","primary-unverified","migration-busy","ownership-lost","retirement-refused","pool-populated","host-login-present","settings-changed"]),X4=R1()(["invalid-options","invalid-auth","invalid-stash","unsafe-path","missing-stash","conflict","lock-timeout","lock-compromised","io"]),G4=R1()(["closed","not-enrolled","invalid-token","unavailable","identity-changed","identity-unasserted","insufficient-validity","invalid-material","not-active","route-unavailable","route-declined","no-receipt","unsafe-file","invalid-state","wrong-consumer","roster-busy","host-slot-login","host-slot-placeholder","placeholder-refresh","invalid-order"]),X5={name:new Set(["Error","TypeError","SyntaxError","RangeError","AggregateError","AbortError","PrivateFileError","PrivateFilesUnavailableError","DiagnosticFileError","NativeRuntimeError","NativeAuthorityError","NativeMigrationError","NativeMigrationSourceError","NativeHostAuthError","NativeHostAuthWriteError","NativePiAuthSlotError","NativeCustodyError","NativeVaultActivationError","NativeVaultEnrollmentError","SetupCommandError","HostNotEnrolledError","ProcessFenceViolationError","ProcessInspectionError","LockOwnershipError","LockContentionError","ClaustrumConsumerError","ClaustrumCredentialError","RelocatedError","HolderRegistrationError","StateLayoutRefusalError"]),code:new Set([...Z4,...J4,...z4,...X4,...G4,"EACCES","EPERM","ENOENT","EEXIST","ENOTDIR","EISDIR","ENOTEMPTY","EBUSY","ETIMEDOUT","ECONNREFUSED","ECONNRESET","ECANCELED","EIO","EINVAL","ENOTSUP","ENOSYS","ENOMEM","EMFILE","ENFILE","ELOOP","EROFS","EXDEV","ENAMETOOLONG","EBADF","EPIPE","ENOSPC","EINTR","ERR_INVALID_ARG_TYPE","ERR_INVALID_ARG_VALUE","ERR_OUT_OF_RANGE","ERR_FEATURE_UNAVAILABLE_ON_PLATFORM","ERR_PRIVATE_FILES_SECURITY","ERR_PRIVATE_FILES_UNAVAILABLE","ERR_PRIVATE_FILE","ERR_DIAGNOSTICS_DIRECTORY_UNAVAILABLE","ERR_DIAGNOSTICS_NOT_DIRECTORY","ERR_DIAGNOSTICS_NOT_OWNER_ONLY","unsafe-runtime","invalid-runtime","runtime-io","runtime-conflict","publication-refused","invalid-journal","source-io","source-changed","source-too-large","write-io","relocated","lock-timeout","managed-folder","malformed",...t6]),stage:new Set(["safe-parent","verify","directory","read","create","directory-create","rename","stage-directory","stage-create","before-rename","published-callback","published-verify","directory-sync-unsupported"]),reason:new Set(["wrong-owner","extra-ace","not-protected","null-dacl","empty-dacl","reparse-point","unsupported-filesystem","native-addon-unavailable","unsafe-ancestor","wrong-kind","io-error","mode","writable-by-others"])},G5=new Set([...Z4.flatMap(($)=>$==="no-read-grant"||$==="grant-reaches-nothing"?_$.map((Z)=>new z0($,Z).message):[new z0($).message]),...J4.map(($)=>new y0($).message),...z4.map(($)=>new i6($).message),...X4.map(($)=>new o6($).message),...G4.map(($)=>`Native custody refused: ${$}`),$4,r6,...l6,...e6,"Disconnect from the vault first.","Native account changes require offline setup without OPENCODE_AUTH_CONTENT","Local login cannot be verified while OPENCODE_AUTH_CONTENT is set","Authentication failed","API fallback base URL must be an http(s) URL without embedded credentials","API key is required","Vault routes cannot be replaced with a local API key","Cloudflare API token is required","Cloudflare account ID is required","Relay Worker URL is required","--claustrum and --no-claustrum cannot be used together.","Setup requires a TTY or --yes.","Multiple OpenCode generations found. Choose --opencode=1|2|both before running noninteractive setup.","Claustrum is not available. Start ck, or omit vault-only flags and use --no-claustrum for local sign-in.","Claude sign-in did not establish an account UUID","Native setup storage paths overlap between selected hosts","Anthropic account storage paths overlap; migration requires separate files","Anthropic account migration is required. Stop OpenCode, LiteCode and Pi, then run npx @cortexkit/opencode-anthropic-auth setup","Anthropic account migration is incomplete; resume setup","Anthropic account migration journal is invalid","Anthropic account migration journal changed","Anthropic runtime state is invalid","Anthropic runtime file is not owner-only regular storage","Anthropic runtime storage is unavailable","Anthropic runtime observation is older than persisted state","Anthropic runtime publication was refused","Claustrum connection failed; start ck and rerun setup.","Claustrum enrollment refused; inspect its status with ck before rerunning setup.","Invalid enrollment request id.","This Claustrum vault does not support connecting plugins yet, so setup cannot connect to it. Run setup without --claustrum to use local accounts.",'This Claustrum vault is too old to connect plugins. Run ck upgrade to move to Claustrum v0.2.0 or newer (read "Upgrading from v0.1.3" in its release notes first), or run setup without --claustrum to use local accounts.',"OAuth metadata read failed"]),Q5=Object.values(g0).join("|"),W5="Claustrum enrollment did not complete. Inspect and approve with ck, then rerun setup.",H5=[new RegExp(`^Claustrum approval is still pending\\. In another terminal, run: ck auth enroll approve --request-id [A-Za-z0-9_-]{1,128} --name (?:${Q5}) and then rerun setup\\.$`),/^The vault never created the enrollment request \(last error: [a-z][a-z0-9_]{0,63}\)\. Check that ck is running, then rerun setup\.$/],Y5=new Set(["opencode","litecode","opencode2","pi","host"]),U5=64,q5=256,K5=4096,I$=65536,V5=4096,F5=3,i9="[output beyond the diagnostic limit omitted]",B5="[output withheld: no line break within the inspected window]",j5="[detail withheld: the known credentials could not be read safely]",S$=new TextEncoder,Q4=new TextDecoder;function b($,Z){let J=Object.getOwnPropertyDescriptor($,Z);return J!==void 0&&"value"in J?J.value:void 0}function D0($){return $!==null&&(typeof $==="object"||typeof $==="function")&&!R$.isProxy($)}function k$($,Z){if(!D0($)||!Array.isArray($))return;let J=b($,"length");if(typeof J!=="number"||J>Z)return;let z=[];for(let X=0;X<J;X+=1){let G=Object.getOwnPropertyDescriptor($,String(X));if(G===void 0||!("value"in G))return;z.push(G.value)}return z}function M5($){let Z=k$($,U5);if(Z===void 0||Z.length===0)return;let J=[];for(let z of Z){if(!D0(z))return;let X=b(z,"pid"),G=b(z,"command");if(typeof X!=="number"||!Number.isSafeInteger(X)||X<0)return;if(typeof G!=="string"||!Y5.has(G.toLowerCase()))return;J.push({pid:X,command:G})}return J}function S1($){try{if(!D0($))return;if(b($,"name")==="ProcessInspectionError")return"";let Z=b($,"message");if(typeof Z!=="string")return;if(b($,"name")==="HostNotEnrolledError"&&Z===W5)return Z;if(G5.has(Z))return Z;if(b($,"name")==="StateLayoutRefusalError"){let X=b($,"code");if(n6(X))return Z5(X)}if(b($,"name")==="NativeVaultActivationError"&&b($,"code")==="no-read-grant"){let X=b($,"host"),G=b($,"approvedName");if((X==="opencode"||X==="pi")&&typeof G==="string"){let Q=new z0("no-read-grant",X,G).message;if(Z===Q)return Q}}if(Z.startsWith("Unknown setup argument: "))return Z;if(b($,"name")==="HostNotEnrolledError"&&H5.some((X)=>X.test(Z)))return Z;if(b($,"code")==="ERR_PRIVATE_FILES_UNAVAILABLE")return $4;let J=b($,"status");if(typeof J==="number"&&Number.isInteger(J)&&J>=100&&J<=599&&Z===`OAuth metadata read failed: ${J}`)return Z;let z=M5(b($,"activeHosts"));if(z){let X=new A$(z).message;if(Z===X)return X}}catch{}return}function W4($){try{if(!D0($))return;let Z=k$($5($),_$.length);if(Z===void 0)return;let J=[];for(let z of Z){if(!D0(z))return;let X=_$.find((Q)=>Q===b(z,"host")),G=b(z,"outcome");if(X===void 0||!z5.has(G))return;J.push({host:X,outcome:G})}return J}catch{return}}function D5($,Z=[]){try{let J=new Set,z=k$(Z,q5);if(z===void 0)return;for(let G of z){if(typeof G!=="string")return;if(G!=="")J.add(G)}if(!D0($))return;let X=Reflect.ownKeys($);if(X.length>K5)return;for(let G of X){if(typeof G!=="string"||!s6(G))continue;let Q=Object.getOwnPropertyDescriptor($,G);if(Q===void 0)continue;if(!("value"in Q))return;if(Q.value===void 0||Q.value==="")continue;if(typeof Q.value!=="string")return;J.add(Q.value)}return[...J]}catch{return}}function N5($,Z){let J=S$.encode($);if(J.length<=Z)return $;let z=Math.max(0,Z);while(z>0&&((J[z]??0)&192)===128)z-=1;return Q4.decode(J.subarray(0,z))}function L5($,Z){let J=S$.encode($);if(J.length<=Z)return $;let z=J.length-Math.max(0,Z);while(z<J.length&&((J[z]??0)&192)===128)z+=1;return Q4.decode(J.subarray(z))}function C5($,Z,J){let z=$,X=!1;if($.length>I$){if(X=!0,J==="tail"){let H=$.indexOf(`
-`,$.length-I$);z=H===-1?"":$.slice(H+1)}else{let H=$.lastIndexOf(`
-`,I$);z=H===-1?"":$.slice(0,H)}if(z==="")return[B5]}let G=Z.redactText(z).split(/\r?\n/);if(G.length>1&&G[G.length-1]==="")G.pop();if(J==="tail")G.reverse();let Q=[],W=V5;for(let H of G){let U=S$.encode(H).length+1;if(U<=W){Q.push(H),W-=U;continue}if(Q.length===0)Q.push(J==="tail"?L5(H,W-1):N5(H,W-1));X=!0;break}if(J==="tail")Q.reverse();if(X)if(J==="tail")Q.unshift(i9);else Q.push(i9);return Q}function H4($){let Z=$;for(let J=0;Z!==null&&J<8;J+=1){if(R$.isProxy(Z))break;let z=b(Z,"name");if(typeof z==="string")return z;Z=Object.getPrototypeOf(Z)}return"object"}function o9($,Z){let J={};if(Z===void 0)return J;try{if(!D0($))return J;let z=e9(Z);try{for(let X of["name","code","stage","reason"]){let G=X==="name"?H4($):b($,X);if(typeof G==="string"&&X5[X].has(G)&&z.redactText(G)===G)J[X]=G}}finally{z.dispose()}}catch{return{}}return J}function P5($){if(!D0($))return;let Z=b($,"step"),J=b($,"exitCode"),z=b($,"signal"),X=b($,"stderrTail");if(typeof Z!=="string"||Z.length===0||!(J===null||typeof J==="number"&&Number.isInteger(J))||!(z===null||typeof z==="string")||typeof X!=="string")return;return{step:Z,exitCode:J,signal:z,stderrTail:X}}function Y4($,Z){if($===null||typeof $!=="object"&&typeof $!=="function")return[`thrown ${typeof $}: ${String($)}`];if(R$.isProxy($))return["thrown proxy (not inspected)"];let J=[],z=H4($),X=b($,"message");J.push(typeof X==="string"?`${z}: ${X}`:`${z} (no message)`);let G=b($,"code");if(typeof G==="string"||typeof G==="number")J.push(`code: ${G}`);let Q=b($,"stack");if(typeof Q==="string")J.push(Q);let W=b($,"cause");if(W!==void 0)if(Z>=F5)J.push("caused by: [not described]");else J.push("caused by:",...Y4(W,Z+1));return J}function r9($,Z){let J=b($,Z);return typeof J==="string"&&J!==""?J:void 0}function O5($){if(!D0($))return;let Z=r9($,"HOME"),J=u6({xdgStateHome:r9($,"XDG_STATE_HOME"),home:Z&&w6(Z)?Z:m6()});return t9(J,"diagnostics")}async function A5($,Z,J,z={}){let X=(G)=>({error:{name:"DiagnosticFileError",code:G}});try{let G=O5($);if(G===void 0)return X("ERR_DIAGNOSTICS_DIRECTORY_UNAVAILABLE");if(!await p6(G,z)){await v6(G,{recursive:!0,mode:448});let H=await g6(G);if(!H.isDirectory())return X("ERR_DIAGNOSTICS_NOT_DIRECTORY");if(!await a6(G,()=>(H.mode&63)===0&&H.uid===process.getuid?.(),z))return X("ERR_DIAGNOSTICS_NOT_OWNER_ONLY")}let Q=t9(G,`${Z}-${Date.now()}-${process.pid}-${y6()}.log`);if(await c6(Q,J,z))return{path:Q};let W=await h6(Q,Z3.O_WRONLY|Z3.O_CREAT|Z3.O_EXCL|(Z3.O_NOFOLLOW??0),384);try{await W.writeFile(J,"utf8")}finally{await W.close()}return{path:Q}}catch(G){return{error:G}}}async function I5($,Z,J,z,X,G,Q,W={}){let H,U=D5(J,z);if(U===void 0)H=[j5];else try{let D=e9(U);try{let{text:L,keep:O}=G();H=C5(L,D,O)}finally{D.dispose()}}catch{H=["[failure detail could not be recorded]"]}let Y=J5[$],K=d6("error","cli",`${Y} failed`,{stage:$,code:Z,...X}),M=await A5(J,$,`${[K,...H].join(`
+Please quit all OpenCode, LiteCode, and Pi processes before running setup.`);this.activeHosts=Z,this.name="ProcessFenceViolationError"}}var H5={"setup-activation":"Vault custody setup","setup-opencode-config":"OpenCode configuration","setup-pi-install":"Pi extension installation","setup-pi":"Pi setup","setup-process-check":"Host process check","cli-setup":"Setup","cli-login":"Login","cli-api-add":"API route setup","cli-list":"Account listing","cli-relay-setup":"Relay setup","cli-relay-workers-dev":"Workers.dev enablement","cli-command":"Command"};function T1(){return($)=>$}var k$=["opencode","pi"],Y5=new Set(["enrolled","not-enrolled","unknown"]),G4=T1()(["auth-content-refused","host-auth-invalid","primary-conflict","consent-required","primary-unverified","no-read-grant","grant-reaches-nothing"]),Q4=T1()(["enrollment-refused","enrollment-reset","approval-refused","permission-refused"]),W4=T1()(["invalid-source","unsafe-source","consent-required","primary-unverified","migration-busy","ownership-lost","retirement-refused","pool-populated","host-login-present","settings-changed"]),H4=T1()(["invalid-options","invalid-auth","invalid-stash","unsafe-path","missing-stash","conflict","lock-timeout","lock-compromised","io"]),Y4=T1()(["closed","not-enrolled","invalid-token","unavailable","identity-changed","identity-unasserted","insufficient-validity","invalid-material","not-active","route-unavailable","route-declined","no-receipt","unsafe-file","invalid-state","wrong-consumer","roster-busy","host-slot-login","host-slot-placeholder","placeholder-refresh","invalid-order"]),U5={name:new Set(["Error","TypeError","SyntaxError","RangeError","AggregateError","AbortError","PrivateFileError","PrivateFilesUnavailableError","DiagnosticFileError","NativeRuntimeError","NativeAuthorityError","NativeMigrationError","NativeMigrationSourceError","NativeHostAuthError","NativeHostAuthWriteError","NativePiAuthSlotError","NativeCustodyError","NativeVaultActivationError","NativeVaultEnrollmentError","SetupCommandError","HostNotEnrolledError","ProcessFenceViolationError","ProcessInspectionError","LockOwnershipError","LockContentionError","ClaustrumConsumerError","ClaustrumCredentialError","RelocatedError","HolderRegistrationError","StateLayoutRefusalError"]),code:new Set([...G4,...Q4,...W4,...H4,...Y4,"EACCES","EPERM","ENOENT","EEXIST","ENOTDIR","EISDIR","ENOTEMPTY","EBUSY","ETIMEDOUT","ECONNREFUSED","ECONNRESET","ECANCELED","EIO","EINVAL","ENOTSUP","ENOSYS","ENOMEM","EMFILE","ENFILE","ELOOP","EROFS","EXDEV","ENAMETOOLONG","EBADF","EPIPE","ENOSPC","EINTR","ERR_INVALID_ARG_TYPE","ERR_INVALID_ARG_VALUE","ERR_OUT_OF_RANGE","ERR_FEATURE_UNAVAILABLE_ON_PLATFORM","ERR_PRIVATE_FILES_SECURITY","ERR_PRIVATE_FILES_UNAVAILABLE","ERR_PRIVATE_FILE","ERR_DIAGNOSTICS_DIRECTORY_UNAVAILABLE","ERR_DIAGNOSTICS_NOT_DIRECTORY","ERR_DIAGNOSTICS_NOT_OWNER_ONLY","unsafe-runtime","invalid-runtime","runtime-io","runtime-conflict","publication-refused","invalid-journal","source-io","source-changed","source-too-large","write-io","relocated","lock-timeout","managed-folder","malformed",...X5]),stage:new Set(["safe-parent","verify","directory","read","create","directory-create","rename","stage-directory","stage-create","before-rename","published-callback","published-verify","directory-sync-unsupported"]),reason:new Set(["wrong-owner","extra-ace","not-protected","null-dacl","empty-dacl","reparse-point","unsupported-filesystem","native-addon-unavailable","unsafe-ancestor","wrong-kind","io-error","mode","writable-by-others"])},q5=new Set([...G4.flatMap(($)=>$==="no-read-grant"||$==="grant-reaches-nothing"?k$.map((Z)=>new J0($,Z).message):[new J0($).message]),...Q4.map(($)=>new v0($).message),...W4.map(($)=>new Z5($).message),...H4.map(($)=>new J5($).message),...Y4.map(($)=>`Native custody refused: ${$}`),X4,z5,...r6,...G5,"Disconnect from the vault first.","Native account changes require offline setup without OPENCODE_AUTH_CONTENT","Local login cannot be verified while OPENCODE_AUTH_CONTENT is set","Authentication failed","API fallback base URL must be an http(s) URL without embedded credentials","API key is required","Vault routes cannot be replaced with a local API key","Cloudflare API token is required","Cloudflare account ID is required","Relay Worker URL is required","--claustrum and --no-claustrum cannot be used together.","Setup requires a TTY or --yes.","Multiple OpenCode generations found. Choose --opencode=1|2|both before running noninteractive setup.","Claustrum is not available. Start ck, or omit vault-only flags and use --no-claustrum for local sign-in.","Claude sign-in did not establish an account UUID","Native setup storage paths overlap between selected hosts","Anthropic account storage paths overlap; migration requires separate files","Anthropic account migration is required. Stop OpenCode, LiteCode and Pi, then run npx @cortexkit/opencode-anthropic-auth setup","Anthropic account migration is incomplete; resume setup","Anthropic account migration journal is invalid","Anthropic account migration journal changed","Anthropic runtime state is invalid","Anthropic runtime file is not owner-only regular storage","Anthropic runtime storage is unavailable","Anthropic runtime observation is older than persisted state","Anthropic runtime publication was refused","Claustrum connection failed; start ck and rerun setup.","Claustrum enrollment refused; inspect its status with ck before rerunning setup.","Invalid enrollment request id.","This Claustrum vault does not support connecting plugins yet, so setup cannot connect to it. Run setup without --claustrum to use local accounts.",'This Claustrum vault is too old to connect plugins. Run ck upgrade to move to Claustrum v0.2.0 or newer (read "Upgrading from v0.1.3" in its release notes first), or run setup without --claustrum to use local accounts.',"OAuth metadata read failed"]),K5=Object.values(h0).join("|"),F5="Claustrum enrollment did not complete. Inspect and approve with ck, then rerun setup.",V5=[new RegExp(`^Claustrum approval is still pending\\. In another terminal, run: ck auth enroll approve --request-id [A-Za-z0-9_-]{1,128} --name (?:${K5}) and then rerun setup\\.$`),/^The vault never created the enrollment request \(last error: [a-z][a-z0-9_]{0,63}\)\. Check that ck is running, then rerun setup\.$/],B5=new Set(["opencode","litecode","opencode2","pi","host"]),j5=64,M5=256,D5=4096,S$=65536,N5=4096,L5=3,e9="[output beyond the diagnostic limit omitted]",P5="[output withheld: no line break within the inspected window]",C5="[detail withheld: the known credentials could not be read safely]",E$=new TextEncoder,U4=new TextDecoder;function b($,Z){let J=Object.getOwnPropertyDescriptor($,Z);return J!==void 0&&"value"in J?J.value:void 0}function D0($){return $!==null&&(typeof $==="object"||typeof $==="function")&&!T$.isProxy($)}function b$($,Z){if(!D0($)||!Array.isArray($))return;let J=b($,"length");if(typeof J!=="number"||J>Z)return;let z=[];for(let X=0;X<J;X+=1){let G=Object.getOwnPropertyDescriptor($,String(X));if(G===void 0||!("value"in G))return;z.push(G.value)}return z}function O5($){let Z=b$($,j5);if(Z===void 0||Z.length===0)return;let J=[];for(let z of Z){if(!D0(z))return;let X=b(z,"pid"),G=b(z,"command");if(typeof X!=="number"||!Number.isSafeInteger(X)||X<0)return;if(typeof G!=="string"||!B5.has(G.toLowerCase()))return;J.push({pid:X,command:G})}return J}function E1($){try{if(!D0($))return;if(b($,"name")==="ProcessInspectionError")return"";let Z=b($,"message");if(typeof Z!=="string")return;if(b($,"name")==="HostNotEnrolledError"&&Z===F5)return Z;if(q5.has(Z))return Z;if(b($,"name")==="StateLayoutRefusalError"){let X=b($,"code");if($5(X))return W5(X)}if(b($,"name")==="NativeVaultActivationError"&&b($,"code")==="no-read-grant"){let X=b($,"host"),G=b($,"approvedName");if((X==="opencode"||X==="pi")&&typeof G==="string"){let Q=new J0("no-read-grant",X,G).message;if(Z===Q)return Q}}if(Z.startsWith("Unknown setup argument: "))return Z;if(b($,"name")==="HostNotEnrolledError"&&V5.some((X)=>X.test(Z)))return Z;if(b($,"code")==="ERR_PRIVATE_FILES_UNAVAILABLE")return X4;let J=b($,"status");if(typeof J==="number"&&Number.isInteger(J)&&J>=100&&J<=599&&Z===`OAuth metadata read failed: ${J}`)return Z;let z=O5(b($,"activeHosts"));if(z){let X=new R$(z).message;if(Z===X)return X}}catch{}return}function q4($){try{if(!D0($))return;let Z=b$(Q5($),k$.length);if(Z===void 0)return;let J=[];for(let z of Z){if(!D0(z))return;let X=k$.find((Q)=>Q===b(z,"host")),G=b(z,"outcome");if(X===void 0||!Y5.has(G))return;J.push({host:X,outcome:G})}return J}catch{return}}function A5($,Z=[]){try{let J=new Set,z=b$(Z,M5);if(z===void 0)return;for(let G of z){if(typeof G!=="string")return;if(G!=="")J.add(G)}if(!D0($))return;let X=Reflect.ownKeys($);if(X.length>D5)return;for(let G of X){if(typeof G!=="string"||!e6(G))continue;let Q=Object.getOwnPropertyDescriptor($,G);if(Q===void 0)continue;if(!("value"in Q))return;if(Q.value===void 0||Q.value==="")continue;if(typeof Q.value!=="string")return;J.add(Q.value)}return[...J]}catch{return}}function I5($,Z){let J=E$.encode($);if(J.length<=Z)return $;let z=Math.max(0,Z);while(z>0&&((J[z]??0)&192)===128)z-=1;return U4.decode(J.subarray(0,z))}function _5($,Z){let J=E$.encode($);if(J.length<=Z)return $;let z=J.length-Math.max(0,Z);while(z<J.length&&((J[z]??0)&192)===128)z+=1;return U4.decode(J.subarray(z))}function R5($,Z,J){let z=$,X=!1;if($.length>S$){if(X=!0,J==="tail"){let H=$.indexOf(`
+`,$.length-S$);z=H===-1?"":$.slice(H+1)}else{let H=$.lastIndexOf(`
+`,S$);z=H===-1?"":$.slice(0,H)}if(z==="")return[P5]}let G=Z.redactText(z).split(/\r?\n/);if(G.length>1&&G[G.length-1]==="")G.pop();if(J==="tail")G.reverse();let Q=[],W=N5;for(let H of G){let U=E$.encode(H).length+1;if(U<=W){Q.push(H),W-=U;continue}if(Q.length===0)Q.push(J==="tail"?_5(H,W-1):I5(H,W-1));X=!0;break}if(J==="tail")Q.reverse();if(X)if(J==="tail")Q.unshift(e9);else Q.push(e9);return Q}function K4($){let Z=$;for(let J=0;Z!==null&&J<8;J+=1){if(T$.isProxy(Z))break;let z=b(Z,"name");if(typeof z==="string")return z;Z=Object.getPrototypeOf(Z)}return"object"}function $4($,Z){let J={};if(Z===void 0)return J;try{if(!D0($))return J;let z=z4(Z);try{for(let X of["name","code","stage","reason"]){let G=X==="name"?K4($):b($,X);if(typeof G==="string"&&U5[X].has(G)&&z.redactText(G)===G)J[X]=G}}finally{z.dispose()}}catch{return{}}return J}function S5($){if(!D0($))return;let Z=b($,"step"),J=b($,"exitCode"),z=b($,"signal"),X=b($,"stderrTail");if(typeof Z!=="string"||Z.length===0||!(J===null||typeof J==="number"&&Number.isInteger(J))||!(z===null||typeof z==="string")||typeof X!=="string")return;return{step:Z,exitCode:J,signal:z,stderrTail:X}}function F4($,Z){if($===null||typeof $!=="object"&&typeof $!=="function")return[`thrown ${typeof $}: ${String($)}`];if(T$.isProxy($))return["thrown proxy (not inspected)"];let J=[],z=K4($),X=b($,"message");J.push(typeof X==="string"?`${z}: ${X}`:`${z} (no message)`);let G=b($,"code");if(typeof G==="string"||typeof G==="number")J.push(`code: ${G}`);let Q=b($,"stack");if(typeof Q==="string")J.push(Q);let W=b($,"cause");if(W!==void 0)if(Z>=L5)J.push("caused by: [not described]");else J.push("caused by:",...F4(W,Z+1));return J}function Z4($,Z){let J=b($,Z);return typeof J==="string"&&J!==""?J:void 0}function k5($){if(!D0($))return;let Z=Z4($,"HOME"),J=s6({xdgStateHome:Z4($,"XDG_STATE_HOME"),home:Z&&a6(Z)?Z:l6()});return J4(J,"diagnostics")}async function T5($,Z,J,z={}){let X=(G)=>({error:{name:"DiagnosticFileError",code:G}});try{let G=k5($);if(G===void 0)return X("ERR_DIAGNOSTICS_DIRECTORY_UNAVAILABLE");if(!await i6(G,z)){await p6(G,{recursive:!0,mode:448});let H=await c6(G);if(!H.isDirectory())return X("ERR_DIAGNOSTICS_NOT_DIRECTORY");if(!await t6(G,()=>(H.mode&63)===0&&H.uid===process.getuid?.(),z))return X("ERR_DIAGNOSTICS_NOT_OWNER_ONLY")}let Q=J4(G,`${Z}-${Date.now()}-${process.pid}-${u6()}.log`);if(await n6(Q,J,z))return{path:Q};let W=await d6(Q,z3.O_WRONLY|z3.O_CREAT|z3.O_EXCL|(z3.O_NOFOLLOW??0),384);try{await W.writeFile(J,"utf8")}finally{await W.close()}return{path:Q}}catch(G){return{error:G}}}async function E5($,Z,J,z,X,G,Q,W={}){let H,U=A5(J,z);if(U===void 0)H=[C5];else try{let L=z4(U);try{let{text:C,keep:A}=G();H=R5(C,L,A)}finally{L.dispose()}}catch{H=["[failure detail could not be recorded]"]}let Y=H5[$],K=o6("error","cli",`${Y} failed`,{stage:$,code:Z,...X}),M=await T5(J,$,`${[K,...H].join(`
 `)}
-`,W.ownership),F=M.path;if(F===void 0){let D={error:o9(Q,U),saveError:o9(M.error,U)};try{(W.stderr??((O)=>process.stderr.write(O)))(`CLI failure metadata: ${JSON.stringify(D)}
-`)}catch{}}return F===void 0?`${Y} failed (${Z}). Details could not be saved to a private diagnostics file.`:`${Y} failed (${Z}). Details were written to ${F}`}async function m0($,Z,J,z=[],X={}){let G=S1(Z);if(G!==void 0)return G;let Q=P5(Z);return I5($,`${$}/unexpected-error`,J,z,{},()=>({text:[...Q?[`step: ${Q.step}`,`exitCode: ${Q.exitCode}`,`signal: ${Q.signal}`]:[],...Y4(Z,0),...Q?[`stderrTail:
+`,W.ownership),V=M.path;if(V===void 0){let L={error:$4(Q,U),saveError:$4(M.error,U)};try{(W.stderr??((A)=>process.stderr.write(A)))(`CLI failure metadata: ${JSON.stringify(L)}
+`)}catch{}}return V===void 0?`${Y} failed (${Z}). Details could not be saved to a private diagnostics file.`:`${Y} failed (${Z}). Details were written to ${V}`}async function u0($,Z,J,z=[],X={}){let G=E1(Z);if(G!==void 0)return G;let Q=S5(Z);return E5($,`${$}/unexpected-error`,J,z,{},()=>({text:[...Q?[`step: ${Q.step}`,`exitCode: ${Q.exitCode}`,`signal: ${Q.signal}`]:[],...F4(Z,0),...Q?[`stderrTail:
 ${Q.stderrTail}`]:[]].join(`
-`),keep:"head"}),Z,X)}import{assertHostsStopped as nZ,createProcessFence as $7,decideOpenCodeStateLayoutOnce as iZ,decidePiStateLayout as oZ,NativePiAuthSlotError as rZ,openNativePiAuthSlot as tZ,publishNativeEmptyInit as eZ,readNativeEnrollmentMode as $J,releaseNativeMigrationPreflight as ZJ,requireNoSupervisedAuthContentSnapshot as JJ,restoreLegacyLayout as zJ,runSetup as XJ,StateLayoutRefusalError as GJ,setupUsage as QJ}from"@cortexkit/anthropic-auth-core";import{AsyncLocalStorage as R5}from"node:async_hooks";var JW=new R5;var U4=Object.freeze({ttlMs:1e4,timeoutMs:15000,retryMs:50,renew:!0});var W1="commonAuthPool";var n5=Object.freeze(["version","accounts",W1]);var WY=new B1;var S={hide:"\x1B[?25l",show:"\x1B[?25h",up:($=1)=>`\x1B[${$}A`,clearLine:"\x1B[2K",clearScreen:"\x1B[2J",moveTo:($,Z)=>`\x1B[${$};${Z}H`,cyan:"\x1B[36m",green:"\x1B[32m",red:"\x1B[31m",dim:"\x1B[2m",reset:"\x1B[0m"};function m$($){let Z=$.toString(),J=[];for(let z=0;z<Z.length;){let X=Z[z];if(X==="\x1B"){let G=Z.slice(z,z+3),Q=G[1]==="["||G[1]==="O"?G[2]:void 0;if(Q&&"ABCD".includes(Q)){let H={A:"up",B:"down",C:"right",D:"left"}[Q];if(H)J.push(H);z+=3}else if(z+1===Z.length){if(z===0)J.push("escape-start");z+=1}else if((Z[z+1]==="["||Z[z+1]==="O")&&z+2>=Z.length)break;else z+=1;continue}if(X==="\r"||X===`
-`)J.push("enter");else if(X==="\x03")J.push("escape");else if(X&&X>=" ")J.push("char");z+=1}return J}var N4=`${String.fromCharCode(27)}\\[[0-9;]*m`,i5=new RegExp(N4,"g"),o5=new RegExp(`^${N4}`);function L4($){return $.replace(i5,"")}function w0($,Z){if(Z<=0)return"";if(L4($).length<=Z)return $;let J=Z>=3?"...":".".repeat(Z),z=Math.max(0,Z-J.length),X="",G=0,Q=0;while(G<$.length&&Q<z){if($[G]==="\x1B"){let W=$.slice(G).match(o5);if(W){X+=W[0],G+=W[0].length;continue}}X+=$[G],G+=1,Q+=1}return X.includes("\x1B[")?`${X}${S.reset}${J}`:X+J}function U1($){return $.input.isTTY===!0}var r5=50;function t5($){if($==="red")return S.red;if($==="cyan")return S.cyan;return""}async function Q3($,Z,J){if(!U1($))throw Error("Interactive select requires a TTY terminal");if(Z.length===0)throw Error("No menu items provided");let{input:z,output:X,signals:G}=$,Q=0,W=null,H=!1,U=0,Y=()=>{let K=X.columns??80,M=X.rows??24,F=U;if(J.clearScreen)X.write(S.clearScreen+S.moveTo(1,1));else if(F>0)X.write(S.up(F));let D=0,L=(q)=>{X.write(`${S.clearLine}${q}
-`),D+=1},O=J.lines??[],_=1+(J.subtitle?3:0)+O.length+(O.length?1:0),R=Math.max(1,Math.min(Z.length,M-_-2-1)),v=Math.max(0,Math.min(Q-Math.floor(R/2),Math.max(0,Z.length-R))),h=Z.slice(v,v+R);if(L(`${S.dim}┌  ${S.reset}${w0(J.message,Math.max(1,K-4))}`),J.subtitle)L(`${S.dim}│${S.reset}`),L(`${S.cyan}◆${S.reset}  ${w0(J.subtitle,Math.max(1,K-4))}`),L("");for(let q of O)L(`${S.cyan}│${S.reset}  ${w0(q,Math.max(1,K-4))}`);if(O.length)L(`${S.cyan}│${S.reset}`);for(let q=0;q<h.length;q++){let B=h[q];if(!B)continue;let N=v+q===Q,x=t5(B.color),k=x?`${N?"":S.dim}${x}${B.label}${S.reset}`:N?B.label:`${S.dim}${B.label}${S.reset}`;if(B.hint)k+=` ${S.dim}${B.hint}${S.reset}`;k=w0(k,Math.max(1,K-8)),L(N?`${S.cyan}│${S.reset}  ${S.green}●${S.reset} ${k}`:`${S.cyan}│${S.reset}  ${S.dim}○${S.reset} ${k}`)}let V=h.length<Z.length?` (${v+1}-${v+h.length}/${Z.length})`:"";L(`${S.cyan}│${S.reset}  ${S.dim}${w0(`Up/Down to select | Enter: confirm | Esc: back${V}`,Math.max(1,K-6))}${S.reset}`),L(`${S.cyan}└${S.reset}`);for(let q=D;q<F;q++)L("");U=D};return new Promise((K)=>{let M=z.isRaw??!1,F=()=>{if(H)return;if(H=!0,W)clearTimeout(W);z.removeListener("data",O);try{z.setRawMode(M),z.pause(),X.write(S.show)}catch{}G?.removeListener("SIGINT",L),G?.removeListener("SIGTERM",L)},D=(_)=>{F(),K(_)},L=()=>D(null),O=(_)=>{for(let R of m$(_)){if(H)break;if(W)clearTimeout(W),W=null;switch(R){case"up":Q=(Q-1+Z.length)%Z.length,Y();break;case"down":Q=(Q+1)%Z.length,Y();break;case"enter":D(Z[Q]?.value??null);break;case"escape":D(null);break;case"escape-start":W=setTimeout(()=>D(null),r5);break;default:break}}};G?.once("SIGINT",L),G?.once("SIGTERM",L);try{z.setRawMode(!0)}catch{F(),K(null);return}z.resume(),X.write(S.hide),Y(),z.on("data",O)})}async function W3($,Z,J=!1){if(!U1($))return!1;return await Q3($,J?[{label:"Yes",value:!0},{label:"No",value:!1}]:[{label:"No",value:!1},{label:"Yes",value:!0}],{message:Z})??!1}import{execFile as XZ}from"node:child_process";import{promisify as GZ}from"node:util";var QZ=GZ(XZ),w$={async run($,Z,J={}){try{let z=J.env?{...process.env,...J.env}:process.env,{stdout:X,stderr:G}=await QZ($,Z,{env:z,timeout:J.timeoutMs??15000,maxBuffer:10485760});return{exitCode:0,stdout:typeof X==="string"?X:String(X),stderr:typeof G==="string"?G:String(G)}}catch(z){let X=z;return{exitCode:typeof X?.code==="number"?X.code:1,signal:typeof X?.signal==="string"?X.signal:null,...typeof X?.syscall==="string"&&(X.syscall==="spawn"||X.syscall.startsWith("spawn "))?{spawnError:!0}:{},stdout:typeof X?.stdout==="string"?X.stdout:X?.stdout!=null?String(X.stdout):"",stderr:typeof X?.stderr==="string"?X.stderr:X?.stderr!=null?String(X.stderr):String(X?.message??z)}}}};import{styleText as V3}from"node:util";import{stdout as OZ,stdin as AZ}from"node:process";import IZ from"node:readline";var C4=(()=>{let $=/[\uD800-\uDBFF][\uDC00-\uDFFF]/g;return(Z)=>{let J=0;$.lastIndex=0;while($.test(Z))J+=1;return Z.length-J}})(),P4=($)=>{return $===12288||$>=65281&&$<=65376||$>=65504&&$<=65510},O4=($)=>{return $===8987||$===9001||$>=12272&&$<=12287||$>=12289&&$<=12350||$>=12441&&$<=12543||$>=12549&&$<=12591||$>=12593&&$<=12686||$>=12688&&$<=12771||$>=12783&&$<=12830||$>=12832&&$<=12871||$>=12880&&$<=19903||$>=65040&&$<=65049||$>=65072&&$<=65106||$>=65108&&$<=65126||$>=65128&&$<=65131||$>=127488&&$<=127490||$>=127504&&$<=127547||$>=127552&&$<=127560||$>=131072&&$<=196605||$>=196608&&$<=262141};var WZ=/[\u001b\u009b][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]|\u001b\]8;[^;]*;.*?(?:\u0007|\u001b\u005c)/y,HZ=/[\x00-\x08\x0A-\x1F\x7F-\x9F]{1,1000}/y,A4=/(?:(?![\uFF61-\uFF9F\uFF00-\uFFEF])[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}\p{Script=Tangut}]){1,1000}/yu,YZ=/\t{1,1000}/y,I4=/[\u{1F1E6}-\u{1F1FF}]{2}|\u{1F3F4}[\u{E0061}-\u{E007A}]{2}[\u{E0030}-\u{E0039}\u{E0061}-\u{E007A}]{1,3}\u{E007F}|(?:\p{Emoji}\uFE0F\u20E3?|\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation})(?:\u200D(?:\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation}|\p{Emoji}\uFE0F\u20E3?))*/yu,UZ=/(?:[\x20-\x7E\xA0-\xFF](?!\uFE0F)){1,1000}/y,qZ=/\p{M}+/gu,KZ={limit:1/0,ellipsis:""},_4=($,Z={},J={})=>{let z=Z.limit??1/0,X=Z.ellipsis??"",G=Z?.ellipsisWidth??(X?_4(X,KZ,J).width:0),Q=0,W=J.controlWidth??0,H=J.tabWidth??8,U=J.emojiWidth??2,Y=2,K=J.regularWidth??1,M=J.wideWidth??2,F=[[UZ,K],[WZ,0],[HZ,W],[YZ,H],[I4,U],[A4,M]],D=0,L=0,O=$.length,_=0,R=!1,v=O,h=Math.max(0,z-G),V=0,q=0,B=0,N=0;$:while(!0){if(q>V||L>=O&&L>D){let x=$.slice(V,q)||$.slice(D,L);_=0;for(let k of x.replaceAll(qZ,"")){let y=k.codePointAt(0)||0;if(P4(y))N=2;else if(O4(y))N=M;else N=K;if(B+N>h)v=Math.min(v,Math.max(V,D)+_);if(B+N>z){R=!0;break $}_+=k.length,B+=N}V=q=0}if(L>=O)break $;for(let x=0,k=F.length;x<k;x++){let[y,Z0]=F[x];if(y.lastIndex=L,y.test($)){if(_=y===A4?C4($.slice(L,y.lastIndex)):y===I4?1:y.lastIndex-L,N=_*Z0,B+N>h)v=Math.min(v,L+Math.floor((h-B)/Z0));if(B+N>z){R=!0;break $}B+=N,V=D,q=L,L=D=y.lastIndex;continue $}}L+=1}return{width:R?h:B,index:R?v:O,truncated:R,ellipsed:R&&z>=G}},R4=_4;var VZ={limit:1/0,ellipsis:"",ellipsisWidth:0},FZ=($,Z={})=>{return R4($,VZ,Z).width},q0=FZ;var H3="\x1B",E4="›",BZ=39,c$="\x07",f4="[",jZ="]",x4="m",p$=`${jZ}8;;`,S4=new RegExp(`(?:\\${f4}(?<code>\\d+)m|\\${p$}(?<uri>.*)${c$})`,"y"),k4=($)=>{if($>=30&&$<=37)return 39;if($>=90&&$<=97)return 39;if($>=40&&$<=47)return 49;if($>=100&&$<=107)return 49;if($===1||$===2)return 22;if($===3)return 23;if($===4)return 24;if($===7)return 27;if($===8)return 28;if($===9)return 29;if($===0)return 0;return},T4=($)=>`${H3}${f4}${$}${x4}`,b4=($)=>`${H3}${p$}${$}${c$}`,u$=($,Z,J)=>{let z=Z[Symbol.iterator](),X=!1,G=!1,Q=$.at(-1),W=Q===void 0?0:q0(Q),H=z.next(),U=z.next(),Y=0;while(!H.done){let K=H.value,M=q0(K);if(W+M<=J)$[$.length-1]+=K;else $.push(K),W=0;if(K===H3||K===E4)X=!0,G=Z.startsWith(p$,Y+1);if(X){if(G){if(K===c$)X=!1,G=!1}else if(K===x4)X=!1}else if(W+=M,W===J&&!U.done)$.push(""),W=0;H=U,U=z.next(),Y+=K.length}if(Q=$.at(-1),!W&&Q!==void 0&&Q.length&&$.length>1)$[$.length-2]+=$.pop()},MZ=($)=>{let Z=$.split(" "),J=Z.length;while(J){if(q0(Z[J-1]))break;J--}if(J===Z.length)return $;return Z.slice(0,J).join(" ")+Z.slice(J).join("")},DZ=($,Z,J={})=>{if(J.trim!==!1&&$.trim()==="")return"";let z="",X,G,Q=$.split(" "),W=[""],H=0;for(let K=0;K<Q.length;K++){let M=Q[K];if(J.trim!==!1){let D=W.at(-1)??"",L=D.trimStart();if(D.length!==L.length)W[W.length-1]=L,H=q0(L)}if(K!==0){if(H>=Z&&(J.wordWrap===!1||J.trim===!1))W.push(""),H=0;if(H||J.trim===!1)W[W.length-1]+=" ",H++}let F=q0(M);if(J.hard&&F>Z){let D=Z-H,L=1+Math.floor((F-D-1)/Z);if(Math.floor((F-1)/Z)<L)W.push("");u$(W,M,Z),H=q0(W.at(-1)??"");continue}if(H+F>Z&&H&&F){if(J.wordWrap===!1&&H<Z){u$(W,M,Z),H=q0(W.at(-1)??"");continue}W.push(""),H=0}if(H+F>Z&&J.wordWrap===!1){u$(W,M,Z),H=q0(W.at(-1)??"");continue}W[W.length-1]+=M,H+=F}if(J.trim!==!1)W=W.map((K)=>MZ(K));let U=W.join(`
-`),Y=!1;for(let K=0;K<U.length;K++){let M=U[K];if(z+=M,!Y){if(Y=M>="\uD800"&&M<="\uDBFF",Y)continue}else Y=!1;if(M===H3||M===E4){S4.lastIndex=K+1;let D=S4.exec(U)?.groups;if(D?.code!==void 0){let L=Number.parseFloat(D.code);X=L===BZ?void 0:L}else if(D?.uri!==void 0)G=D.uri.length===0?void 0:D.uri}if(U[K+1]===`
-`){if(G)z+=b4("");let F=X?k4(X):void 0;if(X&&F)z+=T4(F)}else if(M===`
-`){if(X&&k4(X))z+=T4(X);if(G)z+=b4(G)}}return z},NZ=/\r?\n/;function Y3($,Z,J){return String($).normalize().split(NZ).map((z)=>DZ(z,Z,J)).join(`
-`)}var $0=h4(l$(),1);function s$($,Z,J){if(!J.some((Q)=>!Q.disabled))return $;let z=$+Z,X=Math.max(J.length-1,0),G=z<0?X:z>X?0:z;return J[G]?.disabled?s$(G,Z<0?-1:1,J):G}function U3($,Z,J,z){let X=z.split(`
-`),G=0,Q=$;for(let H of X){if(Q<=H.length)break;Q-=H.length+1,G++}for(G=Math.max(0,Math.min(X.length-1,G+J)),Q=Math.min(Q,X[G].length)+Z;Q<0&&G>0;)G--,Q+=X[G].length+1;for(;Q>X[G].length&&G<X.length-1;)Q-=X[G].length+1,G++;Q=Math.max(0,Math.min(X[G].length,Q));let W=0;for(let H=0;H<G;H++)W+=X[H].length+1;return W+Q}var _Z=["up","down","left","right","space","enter","cancel"],RZ=["January","February","March","April","May","June","July","August","September","October","November","December"],X0={actions:new Set(_Z),aliases:new Map([["k","up"],["j","down"],["h","left"],["l","right"],["\x03","cancel"],["escape","cancel"]]),messages:{cancel:"Canceled",error:"Something went wrong"},withGuide:!0,accessible:void 0,date:{monthNames:[...RZ],messages:{required:"Please enter a valid date",invalidMonth:"There are only 12 months in a year",invalidDay:($,Z)=>`There are only ${$} days in ${Z}`,afterMin:($)=>`Date must be on or after ${$.toISOString().slice(0,10)}`,beforeMax:($)=>`Date must be on or before ${$.toISOString().slice(0,10)}`}}};function SZ($){if($!==void 0)return $;if(X0.accessible!==void 0)return X0.accessible;let Z=process.env.ACCESSIBLE;return Z!==void 0&&Z!==""&&Z!=="0"&&Z!=="false"}function m4($,Z){if(typeof $=="string")return X0.aliases.get($)===Z;for(let J of $)if(J!==void 0&&m4(J,Z))return!0;return!1}function kZ($,Z){if($===Z)return;let J=$.split(`
+`),keep:"head"}),Z,X)}import{assertHostsStopped as $J,createProcessFence as X7,decideOpenCodeStateLayoutOnce as ZJ,decidePiStateLayout as JJ,NativePiAuthSlotError as zJ,openNativePiAuthSlot as XJ,publishNativeEmptyInit as GJ,readNativeEnrollmentMode as QJ,releaseNativeMigrationPreflight as WJ,requireNoSupervisedAuthContentSnapshot as HJ,restoreLegacyLayout as YJ,runSetup as UJ,StateLayoutRefusalError as qJ,setupUsage as KJ}from"@cortexkit/anthropic-auth-core";import{AsyncLocalStorage as f5}from"node:async_hooks";var HW=new f5;var V4=Object.freeze({ttlMs:1e4,timeoutMs:15000,retryMs:50,renew:!0});var Y1="commonAuthPool";var $Z=Object.freeze(["version","accounts",Y1]);var FY=new M1;var S={hide:"\x1B[?25l",show:"\x1B[?25h",up:($=1)=>`\x1B[${$}A`,clearLine:"\x1B[2K",clearScreen:"\x1B[2J",moveTo:($,Z)=>`\x1B[${$};${Z}H`,cyan:"\x1B[36m",green:"\x1B[32m",red:"\x1B[31m",dim:"\x1B[2m",reset:"\x1B[0m"};function c$($){let Z=$.toString(),J=[];for(let z=0;z<Z.length;){let X=Z[z];if(X==="\x1B"){let G=Z.slice(z,z+3),Q=G[1]==="["||G[1]==="O"?G[2]:void 0;if(Q&&"ABCD".includes(Q)){let H={A:"up",B:"down",C:"right",D:"left"}[Q];if(H)J.push(H);z+=3}else if(z+1===Z.length){if(z===0)J.push("escape-start");z+=1}else if((Z[z+1]==="["||Z[z+1]==="O")&&z+2>=Z.length)break;else z+=1;continue}if(X==="\r"||X===`
+`)J.push("enter");else if(X==="\x03")J.push("escape");else if(X&&X>=" ")J.push("char");z+=1}return J}var O4=`${String.fromCharCode(27)}\\[[0-9;]*m`,ZZ=new RegExp(O4,"g"),JZ=new RegExp(`^${O4}`);function A4($){return $.replace(ZZ,"")}function c0($,Z){if(Z<=0)return"";if(A4($).length<=Z)return $;let J=Z>=3?"...":".".repeat(Z),z=Math.max(0,Z-J.length),X="",G=0,Q=0;while(G<$.length&&Q<z){if($[G]==="\x1B"){let W=$.slice(G).match(JZ);if(W){X+=W[0],G+=W[0].length;continue}}X+=$[G],G+=1,Q+=1}return X.includes("\x1B[")?`${X}${S.reset}${J}`:X+J}function K1($){return $.input.isTTY===!0}var zZ=50;function XZ($){if($==="red")return S.red;if($==="cyan")return S.cyan;return""}async function H3($,Z,J){if(!K1($))throw Error("Interactive select requires a TTY terminal");if(Z.length===0)throw Error("No menu items provided");let{input:z,output:X,signals:G}=$,Q=0,W=null,H=!1,U=0,Y=()=>{let K=X.columns??80,M=X.rows??24,V=U;if(J.clearScreen)X.write(S.clearScreen+S.moveTo(1,1));else if(V>0)X.write(S.up(V));let L=0,C=(q)=>{X.write(`${S.clearLine}${q}
+`),L+=1},A=J.lines??[],I=1+(J.subtitle?3:0)+A.length+(A.length?1:0),R=Math.max(1,Math.min(Z.length,M-I-2-1)),v=Math.max(0,Math.min(Q-Math.floor(R/2),Math.max(0,Z.length-R))),h=Z.slice(v,v+R);if(C(`${S.dim}┌  ${S.reset}${c0(J.message,Math.max(1,K-4))}`),J.subtitle)C(`${S.dim}│${S.reset}`),C(`${S.cyan}◆${S.reset}  ${c0(J.subtitle,Math.max(1,K-4))}`),C("");for(let q of A)C(`${S.cyan}│${S.reset}  ${c0(q,Math.max(1,K-4))}`);if(A.length)C(`${S.cyan}│${S.reset}`);for(let q=0;q<h.length;q++){let B=h[q];if(!B)continue;let P=v+q===Q,y=XZ(B.color),T=y?`${P?"":S.dim}${y}${B.label}${S.reset}`:P?B.label:`${S.dim}${B.label}${S.reset}`;if(B.hint)T+=` ${S.dim}${B.hint}${S.reset}`;T=c0(T,Math.max(1,K-8)),C(P?`${S.cyan}│${S.reset}  ${S.green}●${S.reset} ${T}`:`${S.cyan}│${S.reset}  ${S.dim}○${S.reset} ${T}`)}let F=h.length<Z.length?` (${v+1}-${v+h.length}/${Z.length})`:"";C(`${S.cyan}│${S.reset}  ${S.dim}${c0(`Up/Down to select | Enter: confirm | Esc: back${F}`,Math.max(1,K-6))}${S.reset}`),C(`${S.cyan}└${S.reset}`);for(let q=L;q<V;q++)C("");U=L};return new Promise((K)=>{let M=z.isRaw??!1,V=()=>{if(H)return;if(H=!0,W)clearTimeout(W);z.removeListener("data",A);try{z.setRawMode(M),z.pause(),X.write(S.show)}catch{}G?.removeListener("SIGINT",C),G?.removeListener("SIGTERM",C)},L=(I)=>{V(),K(I)},C=()=>L(null),A=(I)=>{for(let R of c$(I)){if(H)break;if(W)clearTimeout(W),W=null;switch(R){case"up":Q=(Q-1+Z.length)%Z.length,Y();break;case"down":Q=(Q+1)%Z.length,Y();break;case"enter":L(Z[Q]?.value??null);break;case"escape":L(null);break;case"escape-start":W=setTimeout(()=>L(null),zZ);break;default:break}}};G?.once("SIGINT",C),G?.once("SIGTERM",C);try{z.setRawMode(!0)}catch{V(),K(null);return}z.resume(),X.write(S.hide),Y(),z.on("data",A)})}async function Y3($,Z,J=!1){if(!K1($))return!1;return await H3($,J?[{label:"Yes",value:!0},{label:"No",value:!1}]:[{label:"No",value:!1},{label:"Yes",value:!0}],{message:Z})??!1}import{execFile as UZ}from"node:child_process";import{promisify as qZ}from"node:util";var KZ=qZ(UZ),p$={async run($,Z,J={}){try{let z=J.env?{...process.env,...J.env}:process.env,{stdout:X,stderr:G}=await KZ($,Z,{env:z,timeout:J.timeoutMs??15000,maxBuffer:10485760});return{exitCode:0,stdout:typeof X==="string"?X:String(X),stderr:typeof G==="string"?G:String(G)}}catch(z){let X=z;return{exitCode:typeof X?.code==="number"?X.code:1,signal:typeof X?.signal==="string"?X.signal:null,...typeof X?.syscall==="string"&&(X.syscall==="spawn"||X.syscall.startsWith("spawn "))?{spawnError:!0}:{},stdout:typeof X?.stdout==="string"?X.stdout:X?.stdout!=null?String(X.stdout):"",stderr:typeof X?.stderr==="string"?X.stderr:X?.stderr!=null?String(X.stderr):String(X?.message??z)}}}};import{styleText as B3}from"node:util";import{stdout as kZ,stdin as TZ}from"node:process";import EZ from"node:readline";var I4=(()=>{let $=/[\uD800-\uDBFF][\uDC00-\uDFFF]/g;return(Z)=>{let J=0;$.lastIndex=0;while($.test(Z))J+=1;return Z.length-J}})(),_4=($)=>{return $===12288||$>=65281&&$<=65376||$>=65504&&$<=65510},R4=($)=>{return $===8987||$===9001||$>=12272&&$<=12287||$>=12289&&$<=12350||$>=12441&&$<=12543||$>=12549&&$<=12591||$>=12593&&$<=12686||$>=12688&&$<=12771||$>=12783&&$<=12830||$>=12832&&$<=12871||$>=12880&&$<=19903||$>=65040&&$<=65049||$>=65072&&$<=65106||$>=65108&&$<=65126||$>=65128&&$<=65131||$>=127488&&$<=127490||$>=127504&&$<=127547||$>=127552&&$<=127560||$>=131072&&$<=196605||$>=196608&&$<=262141};var FZ=/[\u001b\u009b][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]|\u001b\]8;[^;]*;.*?(?:\u0007|\u001b\u005c)/y,VZ=/[\x00-\x08\x0A-\x1F\x7F-\x9F]{1,1000}/y,S4=/(?:(?![\uFF61-\uFF9F\uFF00-\uFFEF])[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}\p{Script=Tangut}]){1,1000}/yu,BZ=/\t{1,1000}/y,k4=/[\u{1F1E6}-\u{1F1FF}]{2}|\u{1F3F4}[\u{E0061}-\u{E007A}]{2}[\u{E0030}-\u{E0039}\u{E0061}-\u{E007A}]{1,3}\u{E007F}|(?:\p{Emoji}\uFE0F\u20E3?|\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation})(?:\u200D(?:\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation}|\p{Emoji}\uFE0F\u20E3?))*/yu,jZ=/(?:[\x20-\x7E\xA0-\xFF](?!\uFE0F)){1,1000}/y,MZ=/\p{M}+/gu,DZ={limit:1/0,ellipsis:""},T4=($,Z={},J={})=>{let z=Z.limit??1/0,X=Z.ellipsis??"",G=Z?.ellipsisWidth??(X?T4(X,DZ,J).width:0),Q=0,W=J.controlWidth??0,H=J.tabWidth??8,U=J.emojiWidth??2,Y=2,K=J.regularWidth??1,M=J.wideWidth??2,V=[[jZ,K],[FZ,0],[VZ,W],[BZ,H],[k4,U],[S4,M]],L=0,C=0,A=$.length,I=0,R=!1,v=A,h=Math.max(0,z-G),F=0,q=0,B=0,P=0;$:while(!0){if(q>F||C>=A&&C>L){let y=$.slice(F,q)||$.slice(L,C);I=0;for(let T of y.replaceAll(MZ,"")){let g=T.codePointAt(0)||0;if(_4(g))P=2;else if(R4(g))P=M;else P=K;if(B+P>h)v=Math.min(v,Math.max(F,L)+I);if(B+P>z){R=!0;break $}I+=T.length,B+=P}F=q=0}if(C>=A)break $;for(let y=0,T=V.length;y<T;y++){let[g,$0]=V[y];if(g.lastIndex=C,g.test($)){if(I=g===S4?I4($.slice(C,g.lastIndex)):g===k4?1:g.lastIndex-C,P=I*$0,B+P>h)v=Math.min(v,C+Math.floor((h-B)/$0));if(B+P>z){R=!0;break $}B+=P,F=L,q=C,C=L=g.lastIndex;continue $}}C+=1}return{width:R?h:B,index:R?v:A,truncated:R,ellipsed:R&&z>=G}},E4=T4;var NZ={limit:1/0,ellipsis:"",ellipsisWidth:0},LZ=($,Z={})=>{return E4($,NZ,Z).width},Y0=LZ;var U3="\x1B",g4="›",PZ=39,l$="\x07",v4="[",CZ="]",h4="m",a$=`${CZ}8;;`,b4=new RegExp(`(?:\\${v4}(?<code>\\d+)m|\\${a$}(?<uri>.*)${l$})`,"y"),f4=($)=>{if($>=30&&$<=37)return 39;if($>=90&&$<=97)return 39;if($>=40&&$<=47)return 49;if($>=100&&$<=107)return 49;if($===1||$===2)return 22;if($===3)return 23;if($===4)return 24;if($===7)return 27;if($===8)return 28;if($===9)return 29;if($===0)return 0;return},x4=($)=>`${U3}${v4}${$}${h4}`,y4=($)=>`${U3}${a$}${$}${l$}`,d$=($,Z,J)=>{let z=Z[Symbol.iterator](),X=!1,G=!1,Q=$.at(-1),W=Q===void 0?0:Y0(Q),H=z.next(),U=z.next(),Y=0;while(!H.done){let K=H.value,M=Y0(K);if(W+M<=J)$[$.length-1]+=K;else $.push(K),W=0;if(K===U3||K===g4)X=!0,G=Z.startsWith(a$,Y+1);if(X){if(G){if(K===l$)X=!1,G=!1}else if(K===h4)X=!1}else if(W+=M,W===J&&!U.done)$.push(""),W=0;H=U,U=z.next(),Y+=K.length}if(Q=$.at(-1),!W&&Q!==void 0&&Q.length&&$.length>1)$[$.length-2]+=$.pop()},OZ=($)=>{let Z=$.split(" "),J=Z.length;while(J){if(Y0(Z[J-1]))break;J--}if(J===Z.length)return $;return Z.slice(0,J).join(" ")+Z.slice(J).join("")},AZ=($,Z,J={})=>{if(J.trim!==!1&&$.trim()==="")return"";let z="",X,G,Q=$.split(" "),W=[""],H=0;for(let K=0;K<Q.length;K++){let M=Q[K];if(J.trim!==!1){let L=W.at(-1)??"",C=L.trimStart();if(L.length!==C.length)W[W.length-1]=C,H=Y0(C)}if(K!==0){if(H>=Z&&(J.wordWrap===!1||J.trim===!1))W.push(""),H=0;if(H||J.trim===!1)W[W.length-1]+=" ",H++}let V=Y0(M);if(J.hard&&V>Z){let L=Z-H,C=1+Math.floor((V-L-1)/Z);if(Math.floor((V-1)/Z)<C)W.push("");d$(W,M,Z),H=Y0(W.at(-1)??"");continue}if(H+V>Z&&H&&V){if(J.wordWrap===!1&&H<Z){d$(W,M,Z),H=Y0(W.at(-1)??"");continue}W.push(""),H=0}if(H+V>Z&&J.wordWrap===!1){d$(W,M,Z),H=Y0(W.at(-1)??"");continue}W[W.length-1]+=M,H+=V}if(J.trim!==!1)W=W.map((K)=>OZ(K));let U=W.join(`
+`),Y=!1;for(let K=0;K<U.length;K++){let M=U[K];if(z+=M,!Y){if(Y=M>="\uD800"&&M<="\uDBFF",Y)continue}else Y=!1;if(M===U3||M===g4){b4.lastIndex=K+1;let L=b4.exec(U)?.groups;if(L?.code!==void 0){let C=Number.parseFloat(L.code);X=C===PZ?void 0:C}else if(L?.uri!==void 0)G=L.uri.length===0?void 0:L.uri}if(U[K+1]===`
+`){if(G)z+=y4("");let V=X?f4(X):void 0;if(X&&V)z+=x4(V)}else if(M===`
+`){if(X&&f4(X))z+=x4(X);if(G)z+=y4(G)}}return z},IZ=/\r?\n/;function q3($,Z,J){return String($).normalize().split(IZ).map((z)=>AZ(z,Z,J)).join(`
+`)}var e=c4(n$(),1);function o$($,Z,J){if(!J.some((Q)=>!Q.disabled))return $;let z=$+Z,X=Math.max(J.length-1,0),G=z<0?X:z>X?0:z;return J[G]?.disabled?o$(G,Z<0?-1:1,J):G}function K3($,Z,J,z){let X=z.split(`
+`),G=0,Q=$;for(let H of X){if(Q<=H.length)break;Q-=H.length+1,G++}for(G=Math.max(0,Math.min(X.length-1,G+J)),Q=Math.min(Q,X[G].length)+Z;Q<0&&G>0;)G--,Q+=X[G].length+1;for(;Q>X[G].length&&G<X.length-1;)Q-=X[G].length+1,G++;Q=Math.max(0,Math.min(X[G].length,Q));let W=0;for(let H=0;H<G;H++)W+=X[H].length+1;return W+Q}var bZ=["up","down","left","right","space","enter","cancel"],fZ=["January","February","March","April","May","June","July","August","September","October","November","December"],z0={actions:new Set(bZ),aliases:new Map([["k","up"],["j","down"],["h","left"],["l","right"],["\x03","cancel"],["escape","cancel"]]),messages:{cancel:"Canceled",error:"Something went wrong"},withGuide:!0,accessible:void 0,date:{monthNames:[...fZ],messages:{required:"Please enter a valid date",invalidMonth:"There are only 12 months in a year",invalidDay:($,Z)=>`There are only ${$} days in ${Z}`,afterMin:($)=>`Date must be on or after ${$.toISOString().slice(0,10)}`,beforeMax:($)=>`Date must be on or before ${$.toISOString().slice(0,10)}`}}};function xZ($){if($!==void 0)return $;if(z0.accessible!==void 0)return z0.accessible;let Z=process.env.ACCESSIBLE;return Z!==void 0&&Z!==""&&Z!=="0"&&Z!=="false"}function p4($,Z){if(typeof $=="string")return z0.aliases.get($)===Z;for(let J of $)if(J!==void 0&&p4(J,Z))return!0;return!1}function yZ($,Z){if($===Z)return;let J=$.split(`
 `),z=Z.split(`
-`),X=Math.max(J.length,z.length),G=[];for(let Q=0;Q<X;Q++)J[Q]!==z[Q]&&G.push(Q);return{lines:G,numLinesBefore:J.length,numLinesAfter:z.length,numLines:X}}var Uq=globalThis.process.platform.startsWith("win"),F3=Symbol("clack:cancel");function B3($){return $===F3}function q3($,Z){let J=$;J.isTTY&&J.setRawMode(Z)}var w4=($)=>("rows"in $)&&typeof $.rows=="number"?$.rows:20;function u4($,Z){if("~standard"in $){let J=$["~standard"].validate(Z);return J instanceof Promise?J.then((z)=>z.issues?.at(0)?.message):J.issues?.at(0)?.message}return $(Z)}class q1{input;output;_abortSignal;rl;opts;_render;_track=!1;_prevFrame="";_subscribers=new Map;_cursor=0;state="initial";error="";value;userInput="";get accessible(){return SZ(this.opts.accessible)}constructor($,Z=!0){let{input:J=AZ,output:z=OZ,render:X,signal:G,...Q}=$;this.opts=Q,this.onKeypress=this.onKeypress.bind(this),this.close=this.close.bind(this),this.render=this.render.bind(this),this._render=X.bind(this),this._track=Z,this._abortSignal=G,this.input=J,this.output=z}unsubscribe(){this._subscribers.clear()}setSubscriber($,Z){let J=this._subscribers.get($)??[];J.push(Z),this._subscribers.set($,J)}on($,Z){this.setSubscriber($,{cb:Z})}once($,Z){this.setSubscriber($,{cb:Z,once:!0})}emit($,...Z){let J=this._subscribers.get($)??[],z=[];for(let X of J)X.cb(...Z),X.once&&z.push(()=>J.splice(J.indexOf(X),1));for(let X of z)X()}prompt(){return new Promise(($)=>{if(this._abortSignal){if(this._abortSignal.aborted)return this.state="cancel",this.close(),$(F3);this._abortSignal.addEventListener("abort",()=>{this.state="cancel",this.close()},{once:!0})}this.rl=IZ.createInterface({input:this.input,tabSize:2,prompt:"",escapeCodeTimeout:50,terminal:!0}),this.rl.prompt(),this.opts.initialUserInput!==void 0&&this._setUserInput(this.opts.initialUserInput,!0),this.input.on("keypress",this.onKeypress),q3(this.input,!0),this.output.on("resize",this.render),this.render(),this.once("submit",()=>{this.output.write($0.cursor.show),this.output.off("resize",this.render),q3(this.input,!1),$(this.value)}),this.once("cancel",()=>{this.output.write($0.cursor.show),this.output.off("resize",this.render),q3(this.input,!1),$(F3)})})}_isActionKey($,Z){return $==="\t"}_shouldSubmit($,Z){return!0}_setValue($){this.value=$,this.emit("value",this.value)}_setUserInput($,Z){this.userInput=$??"",this.emit("userInput",this.userInput),Z&&this._track&&this.rl&&(this.rl.write(this.userInput),this._cursor=this.rl.cursor)}_clearUserInput(){this.rl?.write(null,{ctrl:!0,name:"u"}),this._setUserInput("")}async onKeypress($,Z){if(this.state!=="validating"){if(this._track&&Z.name!=="return"&&(Z.name&&this._isActionKey($,Z)&&this.rl?.write(null,{ctrl:!0,name:"h"}),this._cursor=this.rl?.cursor??0,this._setUserInput(this.rl?.line)),this.state==="error"&&(this.state="active"),Z?.name&&(!this._track&&X0.aliases.has(Z.name)&&this.emit("cursor",X0.aliases.get(Z.name)),X0.actions.has(Z.name)&&this.emit("cursor",Z.name)),$&&($.toLowerCase()==="y"||$.toLowerCase()==="n")&&this.emit("confirm",$.toLowerCase()==="y"),this.emit("key",$,Z),Z?.name==="return"&&this._shouldSubmit($,Z)){if(this.opts.validate){let J=u4(this.opts.validate,this.value),z;J instanceof Promise?(this.state="validating",this.render(),z=await J):z=J,z&&(this.error=z instanceof Error?z.message:z,this.state="error",this.rl?.write(this.userInput))}this.state!=="error"&&(this.state="submit")}m4([$,Z?.name,Z?.sequence],"cancel")&&(this.state="cancel"),(this.state==="submit"||this.state==="cancel")&&this.emit("finalize"),this.render(),(this.state==="submit"||this.state==="cancel")&&this.close()}}close(){this.input.unpipe(),this.input.removeListener("keypress",this.onKeypress),this.output.write(`
-`),q3(this.input,!1),this.rl?.close(),this.rl=void 0,this.emit(`${this.state}`,this.value),this.unsubscribe()}restoreCursor(){let $=Y3(this._prevFrame,process.stdout.columns,{hard:!0,trim:!1}).split(`
-`).length-1;this.output.write($0.cursor.move(-999,$*-1))}render(){let $=Y3(this._render(this)??"",process.stdout.columns,{hard:!0,trim:!1});if($!==this._prevFrame){if(this.state==="initial")this.output.write($0.cursor.hide);else{let Z=kZ(this._prevFrame,$),J=w4(this.output);if(this.restoreCursor(),Z){let z=Math.max(0,Z.numLinesAfter-J),X=Math.max(0,Z.numLinesBefore-J),G=Z.lines.find((Q)=>Q>=z);if(G===void 0){this._prevFrame=$;return}if(Z.lines.length===1){this.output.write($0.cursor.move(0,G-X)),this.output.write($0.erase.lines(1));let Q=$.split(`
-`);this.output.write(Q[G]),this._prevFrame=$,this.output.write($0.cursor.move(0,Q.length-G-1));return}else if(Z.lines.length>1){if(z<X)G=z;else{let W=G-X;W>0&&this.output.write($0.cursor.move(0,W))}this.output.write($0.erase.down());let Q=$.split(`
+`),X=Math.max(J.length,z.length),G=[];for(let Q=0;Q<X;Q++)J[Q]!==z[Q]&&G.push(Q);return{lines:G,numLinesBefore:J.length,numLinesAfter:z.length,numLines:X}}var jq=globalThis.process.platform.startsWith("win"),j3=Symbol("clack:cancel");function M3($){return $===j3}function F3($,Z){let J=$;J.isTTY&&J.setRawMode(Z)}var d4=($)=>("rows"in $)&&typeof $.rows=="number"?$.rows:20;function l4($,Z){if("~standard"in $){let J=$["~standard"].validate(Z);return J instanceof Promise?J.then((z)=>z.issues?.at(0)?.message):J.issues?.at(0)?.message}return $(Z)}class F1{input;output;_abortSignal;rl;opts;_render;_track=!1;_prevFrame="";_subscribers=new Map;_cursor=0;state="initial";error="";value;userInput="";get accessible(){return xZ(this.opts.accessible)}constructor($,Z=!0){let{input:J=TZ,output:z=kZ,render:X,signal:G,...Q}=$;this.opts=Q,this.onKeypress=this.onKeypress.bind(this),this.close=this.close.bind(this),this.render=this.render.bind(this),this._render=X.bind(this),this._track=Z,this._abortSignal=G,this.input=J,this.output=z}unsubscribe(){this._subscribers.clear()}setSubscriber($,Z){let J=this._subscribers.get($)??[];J.push(Z),this._subscribers.set($,J)}on($,Z){this.setSubscriber($,{cb:Z})}once($,Z){this.setSubscriber($,{cb:Z,once:!0})}emit($,...Z){let J=this._subscribers.get($)??[],z=[];for(let X of J)X.cb(...Z),X.once&&z.push(()=>J.splice(J.indexOf(X),1));for(let X of z)X()}prompt(){return new Promise(($)=>{if(this._abortSignal){if(this._abortSignal.aborted)return this.state="cancel",this.close(),$(j3);this._abortSignal.addEventListener("abort",()=>{this.state="cancel",this.close()},{once:!0})}this.rl=EZ.createInterface({input:this.input,tabSize:2,prompt:"",escapeCodeTimeout:50,terminal:!0}),this.rl.prompt(),this.opts.initialUserInput!==void 0&&this._setUserInput(this.opts.initialUserInput,!0),this.input.on("keypress",this.onKeypress),F3(this.input,!0),this.output.on("resize",this.render),this.render(),this.once("submit",()=>{this.output.write(e.cursor.show),this.output.off("resize",this.render),F3(this.input,!1),$(this.value)}),this.once("cancel",()=>{this.output.write(e.cursor.show),this.output.off("resize",this.render),F3(this.input,!1),$(j3)})})}_isActionKey($,Z){return $==="\t"}_shouldSubmit($,Z){return!0}_setValue($){this.value=$,this.emit("value",this.value)}_setUserInput($,Z){this.userInput=$??"",this.emit("userInput",this.userInput),Z&&this._track&&this.rl&&(this.rl.write(this.userInput),this._cursor=this.rl.cursor)}_clearUserInput(){this.rl?.write(null,{ctrl:!0,name:"u"}),this._setUserInput("")}async onKeypress($,Z){if(this.state!=="validating"){if(this._track&&Z.name!=="return"&&(Z.name&&this._isActionKey($,Z)&&this.rl?.write(null,{ctrl:!0,name:"h"}),this._cursor=this.rl?.cursor??0,this._setUserInput(this.rl?.line)),this.state==="error"&&(this.state="active"),Z?.name&&(!this._track&&z0.aliases.has(Z.name)&&this.emit("cursor",z0.aliases.get(Z.name)),z0.actions.has(Z.name)&&this.emit("cursor",Z.name)),$&&($.toLowerCase()==="y"||$.toLowerCase()==="n")&&this.emit("confirm",$.toLowerCase()==="y"),this.emit("key",$,Z),Z?.name==="return"&&this._shouldSubmit($,Z)){if(this.opts.validate){let J=l4(this.opts.validate,this.value),z;J instanceof Promise?(this.state="validating",this.render(),z=await J):z=J,z&&(this.error=z instanceof Error?z.message:z,this.state="error",this.rl?.write(this.userInput))}this.state!=="error"&&(this.state="submit")}p4([$,Z?.name,Z?.sequence],"cancel")&&(this.state="cancel"),(this.state==="submit"||this.state==="cancel")&&this.emit("finalize"),this.render(),(this.state==="submit"||this.state==="cancel")&&this.close()}}close(){this.input.unpipe(),this.input.removeListener("keypress",this.onKeypress),this.output.write(`
+`),F3(this.input,!1),this.rl?.close(),this.rl=void 0,this.emit(`${this.state}`,this.value),this.unsubscribe()}restoreCursor(){let $=q3(this._prevFrame,process.stdout.columns,{hard:!0,trim:!1}).split(`
+`).length-1;this.output.write(e.cursor.move(-999,$*-1))}render(){let $=q3(this._render(this)??"",process.stdout.columns,{hard:!0,trim:!1});if($!==this._prevFrame){if(this.state==="initial")this.output.write(e.cursor.hide);else{let Z=yZ(this._prevFrame,$),J=d4(this.output);if(this.restoreCursor(),Z){let z=Math.max(0,Z.numLinesAfter-J),X=Math.max(0,Z.numLinesBefore-J),G=Z.lines.find((Q)=>Q>=z);if(G===void 0){this._prevFrame=$;return}if(Z.lines.length===1){this.output.write(e.cursor.move(0,G-X)),this.output.write(e.erase.lines(1));let Q=$.split(`
+`);this.output.write(Q[G]),this._prevFrame=$,this.output.write(e.cursor.move(0,Q.length-G-1));return}else if(Z.lines.length>1){if(z<X)G=z;else{let W=G-X;W>0&&this.output.write(e.cursor.move(0,W))}this.output.write(e.erase.down());let Q=$.split(`
 `).slice(G);this.output.write(Q.join(`
-`)),this._prevFrame=$;return}}this.output.write($0.erase.down())}this.output.write($),this.state==="initial"&&(this.state="active"),this._prevFrame=$}}}function TZ($,Z){if($===void 0||Z.length===0)return 0;let J=Z.findIndex((z)=>z.value===$);return J!==-1?J:0}function bZ($,Z){return(Z.label??String(Z.value)).toLowerCase().includes($.toLowerCase())}function EZ($,Z){if(Z)return $?Z:Z[0]}var fZ=class extends q1{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#$=0;#Z="";#J;#W;#G;#Q;get cursor(){return this.#$}get userInputWithCursor(){if(!this.userInput)return V3(["inverse","hidden"],"_");if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let Z=this.userInput.slice(0,this.cursor),J=this.userInput.slice(this.cursor,this.cursor+1),z=this.userInput.slice(this.cursor+1);return`${Z}${V3("inverse",J)}${z}`}get options(){return typeof this.#W=="function"?this.#W():this.#W}constructor(Z){super(Z),this.#W=Z.options,this.#G=Z.placeholder,this.#Q=Z.completeOnTab===!0;let J=this.options;this.filteredOptions=[...J],this.multiple=Z.multiple===!0,this.#J=typeof Z.options=="function"?Z.filter:Z.filter??bZ;let z;if(Z.initialValue&&Array.isArray(Z.initialValue)?this.multiple?z=Z.initialValue:z=Z.initialValue.slice(0,1):!this.multiple&&this.options.length>0&&(z=[this.options[0]?.value]),z)for(let X of z){let G=J.findIndex((Q)=>Q.value===X);G!==-1&&(this.toggleSelected(X),this.#$=G)}this.focusedValue=this.options[this.#$]?.value,this.on("key",(X,G)=>this.#z(X,G)),this.on("userInput",(X)=>this.#X(X))}_isActionKey(Z,J){return Z==="\t"||this.multiple&&this.isNavigating&&J.name==="space"&&Z!==void 0&&Z!==""}#z(Z,J){let z=J.name==="up",X=J.name==="down",G=J.name==="return",Q=this.userInput===""||this.userInput==="\t",W=this.#G,H=this.options,U=W!==void 0&&W!==""&&H.some((Y)=>!Y.disabled&&(this.#J?this.#J(W,Y):!0));if(J.name==="tab"&&Q&&U){this.userInput==="\t"&&this._clearUserInput(),this._setUserInput(W,!0),this.isNavigating=!1;return}if(J.name==="tab"&&this.#Q&&!this.multiple&&this.focusedValue!==void 0){let Y=String(this.focusedValue);this._clearUserInput(),this._setUserInput(Y,!0),this.isNavigating=!1;return}z||X?(this.#$=s$(this.#$,z?-1:1,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#$]?.value,this.multiple||(this.selectedValues=[this.focusedValue]),this.isNavigating=!0):G?this.value=EZ(this.multiple,this.selectedValues):this.multiple?this.focusedValue!==void 0&&(J.name==="tab"||this.isNavigating&&J.name==="space")?this.toggleSelected(this.focusedValue):this.isNavigating=!1:(this.focusedValue&&(this.selectedValues=[this.focusedValue]),this.isNavigating=!1)}deselectAll(){this.selectedValues=[]}toggleSelected(Z){this.filteredOptions.length!==0&&(this.multiple?this.selectedValues.includes(Z)?this.selectedValues=this.selectedValues.filter((J)=>J!==Z):this.selectedValues=[...this.selectedValues,Z]:this.selectedValues=[Z])}#X(Z){if(Z!==this.#Z){this.#Z=Z;let J=this.options;Z&&this.#J?this.filteredOptions=J.filter((G)=>this.#J?.(Z,G)):this.filteredOptions=[...J];let z=TZ(this.focusedValue,this.filteredOptions);this.#$=s$(z,0,this.filteredOptions);let X=this.filteredOptions[this.#$];X&&!X.disabled?this.focusedValue=X.value:this.focusedValue=void 0,this.multiple||(this.focusedValue!==void 0?this.toggleSelected(this.focusedValue):this.deselectAll())}}};var xZ={Y:{type:"year",len:4},M:{type:"month",len:2},D:{type:"day",len:2}};function g4($){return[...$].map((Z)=>xZ[Z])}function yZ($){let Z=new Intl.DateTimeFormat($,{year:"numeric",month:"2-digit",day:"2-digit"}).formatToParts(new Date(2000,0,15)),J=[],z="/";for(let X of Z)X.type==="literal"?z=X.value.trim()||X.value:(X.type==="year"||X.type==="month"||X.type==="day")&&J.push({type:X.type,len:X.type==="year"?4:2});return{segments:J,separator:z}}function a$($){return Number.parseInt(($||"0").replace(/_/g,"0"),10)||0}function K3($){return{year:a$($.year),month:a$($.month),day:a$($.day)}}function n$($,Z){return new Date($||2001,Z||1,0).getDate()}function c4($){let{year:Z,month:J,day:z}=K3($);if(!Z||Z<0||Z>9999||!J||J<1||J>12||!z||z<1)return;let X=new Date(Date.UTC(Z,J-1,z));if(!(X.getUTCFullYear()!==Z||X.getUTCMonth()!==J-1||X.getUTCDate()!==z))return{year:Z,month:J,day:z}}function v4($){let Z=c4($);return Z?new Date(Date.UTC(Z.year,Z.month-1,Z.day)):void 0}function gZ($,Z,J,z){let X=J?{year:J.getUTCFullYear(),month:J.getUTCMonth()+1,day:J.getUTCDate()}:null,G=z?{year:z.getUTCFullYear(),month:z.getUTCMonth()+1,day:z.getUTCDate()}:null;return $==="year"?{min:X?.year??1,max:G?.year??9999}:$==="month"?{min:X&&Z.year===X.year?X.month:1,max:G&&Z.year===G.year?G.month:12}:{min:X&&Z.year===X.year&&Z.month===X.month?X.day:1,max:G&&Z.year===G.year&&Z.month===G.month?G.day:n$(Z.year,Z.month)}}class p4 extends q1{#$;#Z;#J;#W;#G;#Q={segmentIndex:0,positionInSegment:0};#z=!0;#X=null;inlineError="";get segmentCursor(){return{...this.#Q}}get segmentValues(){return{...this.#J}}get segments(){return this.#$}get separator(){return this.#Z}get formattedValue(){return this.#j(this.#J)}#j($){return this.#$.map((Z)=>$[Z.type]).join(this.#Z)}#H(){this._setUserInput(this.#j(this.#J)),this._setValue(v4(this.#J)??void 0)}constructor($){let Z=$.format?{segments:g4($.format),separator:$.separator??"/"}:yZ($.locale),J=$.separator??Z.separator,z=$.format?g4($.format):Z.segments,X=$.initialValue??$.defaultValue,G=X?{year:String(X.getUTCFullYear()).padStart(4,"0"),month:String(X.getUTCMonth()+1).padStart(2,"0"),day:String(X.getUTCDate()).padStart(2,"0")}:{year:"____",month:"__",day:"__"},Q=z.map((W)=>G[W.type]).join(J);super({...$,initialUserInput:Q},!1),this.#$=z,this.#Z=J,this.#J=G,this.#W=$.minDate,this.#G=$.maxDate,this.#H(),this.on("cursor",(W)=>this.#U(W)),this.on("key",(W,H)=>this.#M(W,H)),this.on("finalize",()=>this.#N($))}#Y(){let $=Math.max(0,Math.min(this.#Q.segmentIndex,this.#$.length-1)),Z=this.#$[$];if(Z)return this.#Q.positionInSegment=Math.max(0,Math.min(this.#Q.positionInSegment,Z.len-1)),{segment:Z,index:$}}#q($){this.inlineError="",this.#X=null;let Z=this.#Y();Z&&(this.#Q.segmentIndex=Math.max(0,Math.min(this.#$.length-1,Z.index+$)),this.#Q.positionInSegment=0,this.#z=!0)}#F($){let Z=this.#Y();if(!Z)return;let{segment:J}=Z,z=this.#J[J.type],X=!z||z.replace(/_/g,"")==="",G=Number.parseInt((z||"0").replace(/_/g,"0"),10)||0,Q=gZ(J.type,K3(this.#J),this.#W,this.#G),W;X?W=$===1?Q.min:Q.max:W=Math.max(Math.min(Q.max,G+$),Q.min),this.#J={...this.#J,[J.type]:W.toString().padStart(J.len,"0")},this.#z=!0,this.#X=null,this.#H()}#U($){if($)switch($){case"right":return this.#q(1);case"left":return this.#q(-1);case"up":return this.#F(1);case"down":return this.#F(-1)}}#M($,Z){if(Z?.name==="backspace"||Z?.sequence===""||Z?.sequence==="\b"||$===""||$==="\b"){this.inlineError="";let J=this.#Y();if(!J)return;if(!this.#J[J.segment.type].replace(/_/g,"")){this.#q(-1);return}this.#J[J.segment.type]="_".repeat(J.segment.len),this.#z=!0,this.#Q.positionInSegment=0,this.#H();return}if(Z?.name==="tab"){this.inlineError="";let J=this.#Y();if(!J)return;let z=Z.shift?-1:1,X=J.index+z;X>=0&&X<this.#$.length&&(this.#Q.segmentIndex=X,this.#Q.positionInSegment=0,this.#z=!0);return}if($&&/^[0-9]$/.test($)){let J=this.#Y();if(!J)return;let{segment:z}=J,X=!this.#J[z.type].replace(/_/g,"");if(this.#z&&this.#X!==null&&!X){let M=this.#X+$,F={...this.#J,[z.type]:M},D=this.#B(F,z);if(D){this.inlineError=D,this.#X=null,this.#z=!1;return}this.inlineError="",this.#J[z.type]=M,this.#X=null,this.#z=!1,this.#H(),J.index<this.#$.length-1&&(this.#Q.segmentIndex=J.index+1,this.#Q.positionInSegment=0,this.#z=!0);return}this.#z&&!X&&(this.#J[z.type]="_".repeat(z.len),this.#Q.positionInSegment=0),this.#z=!1,this.#X=null;let G=this.#J[z.type],Q=G.indexOf("_"),W=Q>=0?Q:Math.min(this.#Q.positionInSegment,z.len-1);if(W<0||W>=z.len)return;let H=G.slice(0,W)+$+G.slice(W+1),U=!1;if(W===0&&G==="__"&&(z.type==="month"||z.type==="day")){let M=Number.parseInt($,10);H=`0${$}`,U=M<=(z.type==="month"?1:2)}if(z.type==="year"&&(H=(G.replace(/_/g,"")+$).padStart(z.len,"_")),!H.includes("_")){let M={...this.#J,[z.type]:H},F=this.#B(M,z);if(F){this.inlineError=F;return}}this.inlineError="",this.#J[z.type]=H;let Y=H.includes("_")?void 0:c4(this.#J);if(Y){let{year:M,month:F}=Y,D=n$(M,F);this.#J={year:String(Math.max(0,Math.min(9999,M))).padStart(4,"0"),month:String(Math.max(1,Math.min(12,F))).padStart(2,"0"),day:String(Math.max(1,Math.min(D,Y.day))).padStart(2,"0")}}this.#H();let K=H.indexOf("_");U?(this.#z=!0,this.#X=$):K>=0?this.#Q.positionInSegment=K:Q>=0&&J.index<this.#$.length-1?(this.#Q.segmentIndex=J.index+1,this.#Q.positionInSegment=0,this.#z=!0):this.#Q.positionInSegment=Math.min(W+1,z.len-1)}}#B($,Z){let{month:J,day:z}=K3($);if(Z.type==="month"&&(J<0||J>12))return X0.date.messages.invalidMonth;if(Z.type==="day"&&(z<0||z>31))return X0.date.messages.invalidDay(31,"any month")}#N($){let{year:Z,month:J,day:z}=K3(this.#J);if(Z&&J&&z){let X=n$(Z,J);this.#J={...this.#J,day:String(Math.min(z,X)).padStart(2,"0")}}this.value=v4(this.#J)??$.defaultValue??void 0}}var vZ=class extends q1{options;cursor=0;#$;getGroupItems(Z){return this.options.filter((J)=>J.group===Z)}isGroupSelected(Z){let J=this.getGroupItems(Z),z=this.value;return z===void 0?!1:J.every((X)=>z.includes(X.value))}toggleValue(){let Z=this.options[this.cursor];if(Z!==void 0)if(this.value===void 0&&(this.value=[]),Z.group===!0){let J=Z.value,z=this.getGroupItems(J);this.isGroupSelected(J)?this.value=this.value.filter((X)=>z.findIndex((G)=>G.value===X)===-1):this.value=[...this.value,...z.map((X)=>X.value)],this.value=Array.from(new Set(this.value))}else{let J=this.value.includes(Z.value);this.value=J?this.value.filter((z)=>z!==Z.value):[...this.value,Z.value]}}constructor(Z){super(Z,!1);let{options:J}=Z;this.#$=Z.selectableGroups!==!1,this.options=Object.entries(J).flatMap(([z,X])=>[{value:z,group:!0,label:z},...X.map((G)=>({...G,group:z}))]),this.value=[...Z.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:z})=>z===Z.cursorAt),this.#$?0:1),this.on("cursor",(z)=>{switch(z){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let X=this.options[this.cursor]?.group===!0;!this.#$&&X&&(this.cursor=this.cursor===0?this.options.length-1:this.cursor-1);break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let X=this.options[this.cursor]?.group===!0;!this.#$&&X&&(this.cursor=this.cursor===this.options.length-1?0:this.cursor+1);break}case"space":this.toggleValue();break}})}},hZ=new Set(["up","down","left","right"]);class d4 extends q1{#$=!1;#Z;focused="editor";get userInputWithCursor(){if(this.state==="submit")return this.userInput;let $=this.userInput;if(this.cursor>=$.length)return`${$}█`;let Z=$.slice(0,this.cursor),J=$.slice(this.cursor,this.cursor+1),z=$.slice(this.cursor+1);return J===`
+`)),this._prevFrame=$;return}}this.output.write(e.erase.down())}this.output.write($),this.state==="initial"&&(this.state="active"),this._prevFrame=$}}}function gZ($,Z){if($===void 0||Z.length===0)return 0;let J=Z.findIndex((z)=>z.value===$);return J!==-1?J:0}function vZ($,Z){return(Z.label??String(Z.value)).toLowerCase().includes($.toLowerCase())}function hZ($,Z){if(Z)return $?Z:Z[0]}var mZ=class extends F1{filteredOptions;multiple;isNavigating=!1;selectedValues=[];focusedValue;#$=0;#Z="";#J;#W;#G;#Q;get cursor(){return this.#$}get userInputWithCursor(){if(!this.userInput)return B3(["inverse","hidden"],"_");if(this._cursor>=this.userInput.length)return`${this.userInput}█`;let Z=this.userInput.slice(0,this.cursor),J=this.userInput.slice(this.cursor,this.cursor+1),z=this.userInput.slice(this.cursor+1);return`${Z}${B3("inverse",J)}${z}`}get options(){return typeof this.#W=="function"?this.#W():this.#W}constructor(Z){super(Z),this.#W=Z.options,this.#G=Z.placeholder,this.#Q=Z.completeOnTab===!0;let J=this.options;this.filteredOptions=[...J],this.multiple=Z.multiple===!0,this.#J=typeof Z.options=="function"?Z.filter:Z.filter??vZ;let z;if(Z.initialValue&&Array.isArray(Z.initialValue)?this.multiple?z=Z.initialValue:z=Z.initialValue.slice(0,1):!this.multiple&&this.options.length>0&&(z=[this.options[0]?.value]),z)for(let X of z){let G=J.findIndex((Q)=>Q.value===X);G!==-1&&(this.toggleSelected(X),this.#$=G)}this.focusedValue=this.options[this.#$]?.value,this.on("key",(X,G)=>this.#z(X,G)),this.on("userInput",(X)=>this.#X(X))}_isActionKey(Z,J){return Z==="\t"||this.multiple&&this.isNavigating&&J.name==="space"&&Z!==void 0&&Z!==""}#z(Z,J){let z=J.name==="up",X=J.name==="down",G=J.name==="return",Q=this.userInput===""||this.userInput==="\t",W=this.#G,H=this.options,U=W!==void 0&&W!==""&&H.some((Y)=>!Y.disabled&&(this.#J?this.#J(W,Y):!0));if(J.name==="tab"&&Q&&U){this.userInput==="\t"&&this._clearUserInput(),this._setUserInput(W,!0),this.isNavigating=!1;return}if(J.name==="tab"&&this.#Q&&!this.multiple&&this.focusedValue!==void 0){let Y=String(this.focusedValue);this._clearUserInput(),this._setUserInput(Y,!0),this.isNavigating=!1;return}z||X?(this.#$=o$(this.#$,z?-1:1,this.filteredOptions),this.focusedValue=this.filteredOptions[this.#$]?.value,this.multiple||(this.selectedValues=[this.focusedValue]),this.isNavigating=!0):G?this.value=hZ(this.multiple,this.selectedValues):this.multiple?this.focusedValue!==void 0&&(J.name==="tab"||this.isNavigating&&J.name==="space")?this.toggleSelected(this.focusedValue):this.isNavigating=!1:(this.focusedValue&&(this.selectedValues=[this.focusedValue]),this.isNavigating=!1)}deselectAll(){this.selectedValues=[]}toggleSelected(Z){this.filteredOptions.length!==0&&(this.multiple?this.selectedValues.includes(Z)?this.selectedValues=this.selectedValues.filter((J)=>J!==Z):this.selectedValues=[...this.selectedValues,Z]:this.selectedValues=[Z])}#X(Z){if(Z!==this.#Z){this.#Z=Z;let J=this.options;Z&&this.#J?this.filteredOptions=J.filter((G)=>this.#J?.(Z,G)):this.filteredOptions=[...J];let z=gZ(this.focusedValue,this.filteredOptions);this.#$=o$(z,0,this.filteredOptions);let X=this.filteredOptions[this.#$];X&&!X.disabled?this.focusedValue=X.value:this.focusedValue=void 0,this.multiple||(this.focusedValue!==void 0?this.toggleSelected(this.focusedValue):this.deselectAll())}}};var wZ={Y:{type:"year",len:4},M:{type:"month",len:2},D:{type:"day",len:2}};function w4($){return[...$].map((Z)=>wZ[Z])}function uZ($){let Z=new Intl.DateTimeFormat($,{year:"numeric",month:"2-digit",day:"2-digit"}).formatToParts(new Date(2000,0,15)),J=[],z="/";for(let X of Z)X.type==="literal"?z=X.value.trim()||X.value:(X.type==="year"||X.type==="month"||X.type==="day")&&J.push({type:X.type,len:X.type==="year"?4:2});return{segments:J,separator:z}}function i$($){return Number.parseInt(($||"0").replace(/_/g,"0"),10)||0}function V3($){return{year:i$($.year),month:i$($.month),day:i$($.day)}}function r$($,Z){return new Date($||2001,Z||1,0).getDate()}function a4($){let{year:Z,month:J,day:z}=V3($);if(!Z||Z<0||Z>9999||!J||J<1||J>12||!z||z<1)return;let X=new Date(Date.UTC(Z,J-1,z));if(!(X.getUTCFullYear()!==Z||X.getUTCMonth()!==J-1||X.getUTCDate()!==z))return{year:Z,month:J,day:z}}function u4($){let Z=a4($);return Z?new Date(Date.UTC(Z.year,Z.month-1,Z.day)):void 0}function cZ($,Z,J,z){let X=J?{year:J.getUTCFullYear(),month:J.getUTCMonth()+1,day:J.getUTCDate()}:null,G=z?{year:z.getUTCFullYear(),month:z.getUTCMonth()+1,day:z.getUTCDate()}:null;return $==="year"?{min:X?.year??1,max:G?.year??9999}:$==="month"?{min:X&&Z.year===X.year?X.month:1,max:G&&Z.year===G.year?G.month:12}:{min:X&&Z.year===X.year&&Z.month===X.month?X.day:1,max:G&&Z.year===G.year&&Z.month===G.month?G.day:r$(Z.year,Z.month)}}class s4 extends F1{#$;#Z;#J;#W;#G;#Q={segmentIndex:0,positionInSegment:0};#z=!0;#X=null;inlineError="";get segmentCursor(){return{...this.#Q}}get segmentValues(){return{...this.#J}}get segments(){return this.#$}get separator(){return this.#Z}get formattedValue(){return this.#j(this.#J)}#j($){return this.#$.map((Z)=>$[Z.type]).join(this.#Z)}#H(){this._setUserInput(this.#j(this.#J)),this._setValue(u4(this.#J)??void 0)}constructor($){let Z=$.format?{segments:w4($.format),separator:$.separator??"/"}:uZ($.locale),J=$.separator??Z.separator,z=$.format?w4($.format):Z.segments,X=$.initialValue??$.defaultValue,G=X?{year:String(X.getUTCFullYear()).padStart(4,"0"),month:String(X.getUTCMonth()+1).padStart(2,"0"),day:String(X.getUTCDate()).padStart(2,"0")}:{year:"____",month:"__",day:"__"},Q=z.map((W)=>G[W.type]).join(J);super({...$,initialUserInput:Q},!1),this.#$=z,this.#Z=J,this.#J=G,this.#W=$.minDate,this.#G=$.maxDate,this.#H(),this.on("cursor",(W)=>this.#U(W)),this.on("key",(W,H)=>this.#M(W,H)),this.on("finalize",()=>this.#N($))}#Y(){let $=Math.max(0,Math.min(this.#Q.segmentIndex,this.#$.length-1)),Z=this.#$[$];if(Z)return this.#Q.positionInSegment=Math.max(0,Math.min(this.#Q.positionInSegment,Z.len-1)),{segment:Z,index:$}}#q($){this.inlineError="",this.#X=null;let Z=this.#Y();Z&&(this.#Q.segmentIndex=Math.max(0,Math.min(this.#$.length-1,Z.index+$)),this.#Q.positionInSegment=0,this.#z=!0)}#V($){let Z=this.#Y();if(!Z)return;let{segment:J}=Z,z=this.#J[J.type],X=!z||z.replace(/_/g,"")==="",G=Number.parseInt((z||"0").replace(/_/g,"0"),10)||0,Q=cZ(J.type,V3(this.#J),this.#W,this.#G),W;X?W=$===1?Q.min:Q.max:W=Math.max(Math.min(Q.max,G+$),Q.min),this.#J={...this.#J,[J.type]:W.toString().padStart(J.len,"0")},this.#z=!0,this.#X=null,this.#H()}#U($){if($)switch($){case"right":return this.#q(1);case"left":return this.#q(-1);case"up":return this.#V(1);case"down":return this.#V(-1)}}#M($,Z){if(Z?.name==="backspace"||Z?.sequence===""||Z?.sequence==="\b"||$===""||$==="\b"){this.inlineError="";let J=this.#Y();if(!J)return;if(!this.#J[J.segment.type].replace(/_/g,"")){this.#q(-1);return}this.#J[J.segment.type]="_".repeat(J.segment.len),this.#z=!0,this.#Q.positionInSegment=0,this.#H();return}if(Z?.name==="tab"){this.inlineError="";let J=this.#Y();if(!J)return;let z=Z.shift?-1:1,X=J.index+z;X>=0&&X<this.#$.length&&(this.#Q.segmentIndex=X,this.#Q.positionInSegment=0,this.#z=!0);return}if($&&/^[0-9]$/.test($)){let J=this.#Y();if(!J)return;let{segment:z}=J,X=!this.#J[z.type].replace(/_/g,"");if(this.#z&&this.#X!==null&&!X){let M=this.#X+$,V={...this.#J,[z.type]:M},L=this.#B(V,z);if(L){this.inlineError=L,this.#X=null,this.#z=!1;return}this.inlineError="",this.#J[z.type]=M,this.#X=null,this.#z=!1,this.#H(),J.index<this.#$.length-1&&(this.#Q.segmentIndex=J.index+1,this.#Q.positionInSegment=0,this.#z=!0);return}this.#z&&!X&&(this.#J[z.type]="_".repeat(z.len),this.#Q.positionInSegment=0),this.#z=!1,this.#X=null;let G=this.#J[z.type],Q=G.indexOf("_"),W=Q>=0?Q:Math.min(this.#Q.positionInSegment,z.len-1);if(W<0||W>=z.len)return;let H=G.slice(0,W)+$+G.slice(W+1),U=!1;if(W===0&&G==="__"&&(z.type==="month"||z.type==="day")){let M=Number.parseInt($,10);H=`0${$}`,U=M<=(z.type==="month"?1:2)}if(z.type==="year"&&(H=(G.replace(/_/g,"")+$).padStart(z.len,"_")),!H.includes("_")){let M={...this.#J,[z.type]:H},V=this.#B(M,z);if(V){this.inlineError=V;return}}this.inlineError="",this.#J[z.type]=H;let Y=H.includes("_")?void 0:a4(this.#J);if(Y){let{year:M,month:V}=Y,L=r$(M,V);this.#J={year:String(Math.max(0,Math.min(9999,M))).padStart(4,"0"),month:String(Math.max(1,Math.min(12,V))).padStart(2,"0"),day:String(Math.max(1,Math.min(L,Y.day))).padStart(2,"0")}}this.#H();let K=H.indexOf("_");U?(this.#z=!0,this.#X=$):K>=0?this.#Q.positionInSegment=K:Q>=0&&J.index<this.#$.length-1?(this.#Q.segmentIndex=J.index+1,this.#Q.positionInSegment=0,this.#z=!0):this.#Q.positionInSegment=Math.min(W+1,z.len-1)}}#B($,Z){let{month:J,day:z}=V3($);if(Z.type==="month"&&(J<0||J>12))return z0.date.messages.invalidMonth;if(Z.type==="day"&&(z<0||z>31))return z0.date.messages.invalidDay(31,"any month")}#N($){let{year:Z,month:J,day:z}=V3(this.#J);if(Z&&J&&z){let X=r$(Z,J);this.#J={...this.#J,day:String(Math.min(z,X)).padStart(2,"0")}}this.value=u4(this.#J)??$.defaultValue??void 0}}var pZ=class extends F1{options;cursor=0;#$;getGroupItems(Z){return this.options.filter((J)=>J.group===Z)}isGroupSelected(Z){let J=this.getGroupItems(Z),z=this.value;return z===void 0?!1:J.every((X)=>z.includes(X.value))}toggleValue(){let Z=this.options[this.cursor];if(Z!==void 0)if(this.value===void 0&&(this.value=[]),Z.group===!0){let J=Z.value,z=this.getGroupItems(J);this.isGroupSelected(J)?this.value=this.value.filter((X)=>z.findIndex((G)=>G.value===X)===-1):this.value=[...this.value,...z.map((X)=>X.value)],this.value=Array.from(new Set(this.value))}else{let J=this.value.includes(Z.value);this.value=J?this.value.filter((z)=>z!==Z.value):[...this.value,Z.value]}}constructor(Z){super(Z,!1);let{options:J}=Z;this.#$=Z.selectableGroups!==!1,this.options=Object.entries(J).flatMap(([z,X])=>[{value:z,group:!0,label:z},...X.map((G)=>({...G,group:z}))]),this.value=[...Z.initialValues??[]],this.cursor=Math.max(this.options.findIndex(({value:z})=>z===Z.cursorAt),this.#$?0:1),this.on("cursor",(z)=>{switch(z){case"left":case"up":{this.cursor=this.cursor===0?this.options.length-1:this.cursor-1;let X=this.options[this.cursor]?.group===!0;!this.#$&&X&&(this.cursor=this.cursor===0?this.options.length-1:this.cursor-1);break}case"down":case"right":{this.cursor=this.cursor===this.options.length-1?0:this.cursor+1;let X=this.options[this.cursor]?.group===!0;!this.#$&&X&&(this.cursor=this.cursor===this.options.length-1?0:this.cursor+1);break}case"space":this.toggleValue();break}})}},dZ=new Set(["up","down","left","right"]);class n4 extends F1{#$=!1;#Z;focused="editor";get userInputWithCursor(){if(this.state==="submit")return this.userInput;let $=this.userInput;if(this.cursor>=$.length)return`${$}█`;let Z=$.slice(0,this.cursor),J=$.slice(this.cursor,this.cursor+1),z=$.slice(this.cursor+1);return J===`
 `?`${Z}█
-${z}`:`${Z}${V3("inverse",J)}${z}`}get cursor(){return this._cursor}#J($){if(this.userInput.length===0){this._setUserInput($);return}this._setUserInput(this.userInput.slice(0,this.cursor)+$+this.userInput.slice(this.cursor))}#W($){let Z=this.value??"";switch($){case"up":this._cursor=U3(this._cursor,0,-1,Z);return;case"down":this._cursor=U3(this._cursor,0,1,Z);return;case"left":this._cursor=U3(this._cursor,-1,0,Z);return;case"right":this._cursor=U3(this._cursor,1,0,Z);return}}_shouldSubmit($,Z){if(this.#Z)return this.focused==="submit"?!0:(this.#J(`
+${z}`:`${Z}${B3("inverse",J)}${z}`}get cursor(){return this._cursor}#J($){if(this.userInput.length===0){this._setUserInput($);return}this._setUserInput(this.userInput.slice(0,this.cursor)+$+this.userInput.slice(this.cursor))}#W($){let Z=this.value??"";switch($){case"up":this._cursor=K3(this._cursor,0,-1,Z);return;case"down":this._cursor=K3(this._cursor,0,1,Z);return;case"left":this._cursor=K3(this._cursor,-1,0,Z);return;case"right":this._cursor=K3(this._cursor,1,0,Z);return}}_shouldSubmit($,Z){if(this.#Z)return this.focused==="submit"?!0:(this.#J(`
 `),this._cursor++,!1);let J=this.#$;return this.#$=!0,J&&this.cursor===this.userInput.length?(this.userInput[this.cursor-1]===`
 `&&(this._setUserInput(this.userInput.slice(0,this.cursor-1)+this.userInput.slice(this.cursor)),this._cursor--),!0):(this.#J(`
-`),this._cursor++,!1)}constructor($){let Z=$.initialUserInput??$.initialValue;super({...$,initialUserInput:Z},!1),Z!==void 0&&(this._cursor=Z.length),this.#Z=$.showSubmit??!1,this.on("key",(J,z)=>{if(z?.name&&hZ.has(z.name)){this.#$=!1,this.#W(z.name);return}if(J==="\t"&&this.#Z){this.focused=this.focused==="editor"?"submit":"editor";return}if(z?.name!=="return"){if(this.#$=!1,z?.name==="backspace"&&this.cursor>0){this._setUserInput(this.userInput.slice(0,this.cursor-1)+this.userInput.slice(this.cursor)),this._cursor--;return}if(z?.name==="delete"&&this.cursor<this.userInput.length){this._setUserInput(this.userInput.slice(0,this.cursor)+this.userInput.slice(this.cursor+1));return}J&&(this.#Z&&this.focused==="submit"&&(this.focused="editor"),this.#J(J??""),this._cursor++)}}),this.on("userInput",(J)=>{this._setValue(J)}),this.on("finalize",()=>{this.value||(this.value=$.defaultValue),this.value===void 0&&(this.value="")})}}class i$ extends q1{get userInputWithCursor(){if(this.state==="submit")return this.userInput;let $=this.userInput;if(this.cursor>=$.length)return`${this.userInput}█`;let Z=$.slice(0,this.cursor),J=$.slice(this.cursor,this.cursor+1),z=$.slice(this.cursor+1);return`${Z}${V3("inverse",J)}${z}`}get cursor(){return this._cursor}constructor($){super({...$,initialUserInput:$.initialUserInput??$.initialValue}),this.on("userInput",(Z)=>{this._setValue(Z)}),this.on("finalize",()=>{this.value||(this.value=$.defaultValue),this.value===void 0&&(this.value="")})}}import{styleText as E,stripVTControlCharacters as Oq}from"node:util";import G0 from"node:process";var a4=h4(l$(),1);function mZ(){if(G0.platform!=="win32")return G0.env.TERM!=="linux";return Boolean(G0.env.CI)||Boolean(G0.env.WT_SESSION)||Boolean(G0.env.TERMINUS_SUBLIME)||G0.env.ConEmuTask==="{cmd::Cmder}"||G0.env.TERM_PROGRAM==="Terminus-Sublime"||G0.env.TERM_PROGRAM==="vscode"||G0.env.TERM==="xterm-256color"||G0.env.TERM==="alacritty"||G0.env.TERMINAL_EMULATOR==="JetBrains-JediTerm"}var wZ=mZ();var f=($,Z)=>wZ?$:Z,l4=f("◆","*"),uZ=f("■","x"),cZ=f("▲","x"),pZ=f("◇","o"),Rq=f("┌","T"),u0=f("│","|"),o$=f("└","—"),Sq=f("┐","T"),kq=f("┘","—"),Tq=f("●",">"),bq=f("○"," "),Eq=f("◻","[•]"),fq=f("◼","[+]"),xq=f("◻","[ ]"),yq=f("▪","•"),gq=f("─","-"),vq=f("╮","+"),hq=f("├","+"),mq=f("╯","+"),wq=f("╰","+"),uq=f("╭","+"),cq=f("●","•"),pq=f("◆","*"),dq=f("▲","!"),lq=f("■","x"),dZ=($)=>{switch($){case"initial":case"active":return E("cyan",l4);case"cancel":return E("red",uZ);case"error":return E("yellow",cZ);case"submit":return E("green",pZ);case"validating":return E("dim",l4)}};var aq=[`${E("dim","↑/↓")} to navigate`,`${E("dim","Space:")} select`,`${E("dim","Enter:")} confirm`];var sq={light:f("─","-"),heavy:f("━","="),block:f("█","#")};var nq=[`${E("dim","↑/↓")} to navigate`,`${E("dim","Enter:")} confirm`];var iq=`${E("gray",u0)}  `;var s4=($)=>new i$({validate:$.validate,placeholder:$.placeholder,defaultValue:$.defaultValue,initialValue:$.initialValue,output:$.output,signal:$.signal,input:$.input,render(){let Z=$?.withGuide??X0.withGuide,J=`${`${Z?`${E("gray",u0)}
-`:""}${dZ(this.state)}  `}${$.message}
-`,z=$.placeholder&&$.placeholder.length>0?E("inverse",$.placeholder[0])+E("dim",$.placeholder.slice(1)):E(["inverse","hidden"],"_"),X=this.userInput?this.userInputWithCursor:z,G=this.value??"";switch(this.state){case"validating":{let Q=Z?`${E("cyan",u0)}  `:"",W=Z?E("cyan",o$):"",H=E("dim",X),U=E("dim","Validating...");return`${J}${Q}${H}
+`),this._cursor++,!1)}constructor($){let Z=$.initialUserInput??$.initialValue;super({...$,initialUserInput:Z},!1),Z!==void 0&&(this._cursor=Z.length),this.#Z=$.showSubmit??!1,this.on("key",(J,z)=>{if(z?.name&&dZ.has(z.name)){this.#$=!1,this.#W(z.name);return}if(J==="\t"&&this.#Z){this.focused=this.focused==="editor"?"submit":"editor";return}if(z?.name!=="return"){if(this.#$=!1,z?.name==="backspace"&&this.cursor>0){this._setUserInput(this.userInput.slice(0,this.cursor-1)+this.userInput.slice(this.cursor)),this._cursor--;return}if(z?.name==="delete"&&this.cursor<this.userInput.length){this._setUserInput(this.userInput.slice(0,this.cursor)+this.userInput.slice(this.cursor+1));return}J&&(this.#Z&&this.focused==="submit"&&(this.focused="editor"),this.#J(J??""),this._cursor++)}}),this.on("userInput",(J)=>{this._setValue(J)}),this.on("finalize",()=>{this.value||(this.value=$.defaultValue),this.value===void 0&&(this.value="")})}}class t$ extends F1{get userInputWithCursor(){if(this.state==="submit")return this.userInput;let $=this.userInput;if(this.cursor>=$.length)return`${this.userInput}█`;let Z=$.slice(0,this.cursor),J=$.slice(this.cursor,this.cursor+1),z=$.slice(this.cursor+1);return`${Z}${B3("inverse",J)}${z}`}get cursor(){return this._cursor}constructor($){super({...$,initialUserInput:$.initialUserInput??$.initialValue}),this.on("userInput",(Z)=>{this._setValue(Z)}),this.on("finalize",()=>{this.value||(this.value=$.defaultValue),this.value===void 0&&(this.value="")})}}import{styleText as f,stripVTControlCharacters as kq}from"node:util";import X0 from"node:process";var o4=c4(n$(),1);function lZ(){if(X0.platform!=="win32")return X0.env.TERM!=="linux";return Boolean(X0.env.CI)||Boolean(X0.env.WT_SESSION)||Boolean(X0.env.TERMINUS_SUBLIME)||X0.env.ConEmuTask==="{cmd::Cmder}"||X0.env.TERM_PROGRAM==="Terminus-Sublime"||X0.env.TERM_PROGRAM==="vscode"||X0.env.TERM==="xterm-256color"||X0.env.TERM==="alacritty"||X0.env.TERMINAL_EMULATOR==="JetBrains-JediTerm"}var aZ=lZ();var x=($,Z)=>aZ?$:Z,i4=x("◆","*"),sZ=x("■","x"),nZ=x("▲","x"),iZ=x("◇","o"),fq=x("┌","T"),p0=x("│","|"),e$=x("└","—"),xq=x("┐","T"),yq=x("┘","—"),gq=x("●",">"),vq=x("○"," "),hq=x("◻","[•]"),mq=x("◼","[+]"),wq=x("◻","[ ]"),uq=x("▪","•"),cq=x("─","-"),pq=x("╮","+"),dq=x("├","+"),lq=x("╯","+"),aq=x("╰","+"),sq=x("╭","+"),nq=x("●","•"),iq=x("◆","*"),oq=x("▲","!"),rq=x("■","x"),oZ=($)=>{switch($){case"initial":case"active":return f("cyan",i4);case"cancel":return f("red",sZ);case"error":return f("yellow",nZ);case"submit":return f("green",iZ);case"validating":return f("dim",i4)}};var tq=[`${f("dim","↑/↓")} to navigate`,`${f("dim","Space:")} select`,`${f("dim","Enter:")} confirm`];var eq={light:x("─","-"),heavy:x("━","="),block:x("█","#")};var $K=[`${f("dim","↑/↓")} to navigate`,`${f("dim","Enter:")} confirm`];var ZK=`${f("gray",p0)}  `;var r4=($)=>new t$({validate:$.validate,placeholder:$.placeholder,defaultValue:$.defaultValue,initialValue:$.initialValue,output:$.output,signal:$.signal,input:$.input,render(){let Z=$?.withGuide??z0.withGuide,J=`${`${Z?`${f("gray",p0)}
+`:""}${oZ(this.state)}  `}${$.message}
+`,z=$.placeholder&&$.placeholder.length>0?f("inverse",$.placeholder[0])+f("dim",$.placeholder.slice(1)):f(["inverse","hidden"],"_"),X=this.userInput?this.userInputWithCursor:z,G=this.value??"";switch(this.state){case"validating":{let Q=Z?`${f("cyan",p0)}  `:"",W=Z?f("cyan",e$):"",H=f("dim",X),U=f("dim","Validating...");return`${J}${Q}${H}
 ${W}  ${U}
-`}case"error":{let Q=this.error?`  ${E("yellow",this.error)}`:"",W=Z?`${E("yellow",u0)}  `:"",H=Z?E("yellow",o$):"";return`${J.trim()}
+`}case"error":{let Q=this.error?`  ${f("yellow",this.error)}`:"",W=Z?`${f("yellow",p0)}  `:"",H=Z?f("yellow",e$):"";return`${J.trim()}
 ${W}${X}
 ${H}${Q}
-`}case"submit":{let Q=G?`${Z?"  ":""}${E("dim",G)}`:"",W=Z?E("gray",u0):"";return`${J}${W}${Q}`}case"cancel":{let Q=G?`  ${E(["strikethrough","dim"],G)}`:"",W=Z?E("gray",u0):"";return`${J}${W}${Q}${G.trim()?`
-${W}`:""}`}default:{let Q=Z?`${E("cyan",u0)}  `:"",W=Z?E("cyan",o$):"";return`${J}${Q}${X}
+`}case"submit":{let Q=G?`${Z?"  ":""}${f("dim",G)}`:"",W=Z?f("gray",p0):"";return`${J}${W}${Q}`}case"cancel":{let Q=G?`  ${f(["strikethrough","dim"],G)}`:"",W=Z?f("gray",p0):"";return`${J}${W}${Q}${G.trim()?`
+${W}`:""}`}default:{let Q=Z?`${f("cyan",p0)}  `:"",W=Z?f("cyan",e$):"";return`${J}${Q}${X}
 ${W}
-`}}}}).prompt();import{authorize as lZ,exchange as aZ,resolveClaudeCodeIdentity as sZ}from"@cortexkit/anthropic-auth-core";async function n4($,Z={authorize:lZ,exchange:aZ,resolveClaudeCodeIdentity:sZ,text:s4,isCancel:B3,print:console.log}){let J=await Z.authorize("max");Z.print(`Claude sign-in for ${$==="pi"?"Pi":"OpenCode"}`),Z.print(J.url);let z=await Z.text({message:"Paste the Claude callback URL or authorization code:"});if(Z.isCancel(z))throw Error("Claude sign-in cancelled");let X=await Z.exchange(z,J.verifier,J.redirectUri,J.state);if(X.type!=="success")throw Error("Claude sign-in failed");let G=await Z.resolveClaudeCodeIdentity(X.access,void 0,void 0);if(!G.accountUuid)throw Error("Claude sign-in did not establish an account UUID");return{accountIdentity:G.accountUuid,credential:{type:"oauth",access:X.access,refresh:X.refresh,expires:X.expires}}}var i4='Warning: OpenCode holds a separate Anthropic OAuth login. Remove the separate OpenCode Anthropic login, then choose "Claude via credential vault". Setup has left that login unchanged.',WJ="npx @cortexkit/opencode-anthropic-auth setup",r$="--remove-pi-auth",M3="--restore-legacy",Z7="-y",J7=["--help","-h"],o4=[{label:r$,description:"Agree in advance to move a stored Pi Anthropic login out of the way: into the local account pool, or aside privately for vault use (restored on disconnect)."},{label:M3,description:"Move anthropic-auth's state from the CortexKit state folder back into OpenCode's config folder, for example before going back to an older version. Close every OpenCode, OpenCode 2 server and Pi first. Use it on its own."},{label:Z7,description:"Same as --yes."},{label:J7.join(", "),description:"Show this help."}];function HJ(){let $=Math.max(...o4.map((Z)=>Z.label.length));return[QJ({command:WJ}),"","Also accepted by this command:",...o4.map((Z)=>`  ${Z.label.padEnd($)}  ${Z.description}`),"","--login cannot be combined with --claustrum, or with --opencode=2: for OpenCode 2, sign in from OpenCode itself."].join(`
-`)}function K0($,Z){let J=$.get(Z);if(!J)throw Error("Missing setup plan");return J}async function z7($=[],Z={}){let J={...Z.env??process.env},z=Z.terminal??{input:process.stdin,output:process.stdout,signals:process},X=(q)=>z.output.write(`${q}
-`);if($.some((q)=>J7.includes(q)))return X(HJ()),0;if($.includes(M3))return YJ($,Z,J,X);let G=$.filter((q)=>q!==r$).map((q)=>q===Z7?"--yes":q),Q=G.includes("--login");if(Q&&G.includes("--claustrum"))return X("Local sign-in and vault setup are two separate choices. Use --login or --claustrum, not both."),1;if(Q&&G.includes("--opencode=2"))return X(j3),1;let W=Z.runner??w$,H=Z.fence??$7(W,{platform:Z.platform}),U=Z.migrateLocal??d9,Y=new Map,K=new Map,M=new Map,F=new Map,D=[],L=!1,O="setup-process-check",_=(q)=>({env:J,fence:H,paths:M.get(q),removePiAnthropicAuth:F.get(q)??!1}),R=(q)=>({..._(q),runner:W});async function v(q){if(!q.hosts.includes("pi"))return;let B=K0(M,"pi");if((await I1("pi",B.hostAuthPath)).kind==="absent")return;{let y=await tZ({env:J,authPath:B.hostAuthPath}).inspect();if(y.slot==="placeholder"&&y.stash==="missing")throw new rZ("missing-stash");if(q.mode==="claustrum"){if(y.slot==="placeholder")return}}if($.includes(r$)){F.set("pi",!0);return}let x=q.mode==="claustrum"?"Pi has stored Anthropic authentication. Rerun with --remove-pi-auth to preserve it privately during vault use and restore it on disconnect.":"Pi has a stored Anthropic login. Rerun with --remove-pi-auth to move it into the native account pool.";if(G.includes("--yes")||!z.input.isTTY)throw new i(x);if(!await W3(z,q.mode==="claustrum"?"Move Pi authentication aside privately for vault use, then restore it on disconnect?":"Move the Pi Anthropic OAuth login into the native account pool and remove its stored copy?"))throw new i("Native account-pool setup cannot finish while the stored Pi OAuth token takes precedence.");F.set("pi",!0)}async function h(q,B){let N=K0(K,q);if(await $J(q,J)!==(B?"claustrum":N.priorMode)||await _1(q,R(q))!==N.fingerprint)throw new i("Setup inputs changed. Rerun setup with all hosts stopped.")}let V={packages:{opencode:r4,pi:t4},version:await e4(),displayName:"CortexKit Anthropic Auth",slashCommand:"/claude",vault:{connectionFile:K$(J.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE&&!J.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE?"pi":"opencode",J),hosts:{opencode:{name:g0.opencode,paths:q$("opencode",J)},pi:{name:g0.pi,paths:q$("pi",J)}}},async beforeSignIn(q,B){if(O=B.mode==="claustrum"?"setup-activation":"cli-setup",!L){if(JJ(J),B.hosts.includes("opencode")){let N=await iZ({role:"setup",env:J});if(N.kind!=="state-home"&&N.registration)D.push(N.registration)}for(let N of B.hosts)M.set(N,await M0(N,J));if(await v9([...M.values()]),B.hosts.includes("pi"))D.push((await oZ({paths:K0(M,"pi").paths,role:"setup"})).registration);if(B.mode==="claustrum"){let N=B.hosts.map((k)=>K$(k,J)),x=N[0];if(new Set(N).size!==1||!x)throw new i("Selected hosts use different vault connection files.");V.vault.connectionFile=x}if(B.mode==="local"&&Q&&B.hosts.includes("opencode")&&B.opencodeGeneration==="2")throw new i(j3);if(B.mode==="local"){await M$(B.hosts,J);for(let N of B.hosts)await h0(N,_(N))()}await v(B);for(let N of B.hosts)if(B.mode==="claustrum"){if(K.set(N,await(Z.vaultPreflight??s9)(N,{...R(N),inspectOpenCodeAuth:B.opencodeGeneration!=="2"})),K0(K,N).separateOpenCodeLogin)X(i4)}else Y.set(N,await N$(N,_(N),N==="opencode"&&B.opencodeGeneration==="2"));L=!0}else if(B.mode==="claustrum")await h(q,!1);else await Q1(K0(Y,q),_(q))},async signInLocal(q){let B=K0(Y,q);if(!Q){if(B.generation2)X(j3);return}if(await Q1(B,_(q)),await U(q,{..._(q),login:Z.localLogin??n4,preflight:B.preflight,skipMigration:B.action==="skip",beforeCommit:()=>Q1(B,_(q))}),B.fingerprint=await $3(B,J),B.notice)X(j$)},async beforeRegister(q,B){if(B==="local")await Q1(K0(Y,q),_(q));else await h(q,!0),await(Z.vaultActivate??n9)(q,R(q),K0(K,q)),K0(K,q).fingerprint=await _1(q,R(q))},async migrate(q,B){if(B.mode==="claustrum"){if(await h(q,!0),q===B.hosts.at(-1)&&K.get("opencode")?.separateOpenCodeLogin)X(i4);return}let N=K0(Y,q);if(await Q1(N,_(q)),Q)return;if(N.action==="migration")await U(q,{..._(q),preflight:N.preflight});else if(N.action==="empty-init")await eZ({paths:N.paths.paths,routingDestinationPath:N.paths.routingDestinationPath,env:J,processFence:h0(q,_(q))});else if(N.action==="skip"){if(await L$(N,_(q)),N.notice)X(j$)}N.fingerprint=await $3(N,J)}};try{return await XJ(V,G,{...Z,env:J,terminal:z,runner:W,fence:H}),0}catch(q){let N=m9(q)??S1(q)??await m0(O,q,J);if(N)X(N);for(let{host:x,outcome:k}of W4(q)??[]){if(k!=="enrolled")continue;let y=x==="opencode"?"OpenCode":"Pi";X(`${y} stays connected to the vault. In ${y}, run /claude → Accounts → Disconnect from the vault to undo it. Or run setup again to finish connecting.`)}return 1}finally{for(let q of D)q.close();for(let q of Y.values())if(q.preflight)ZJ(q.preflight)}}async function YJ($,Z,J,z){if($.some((Q)=>Q!==M3))return z(`${M3} runs on its own; run it without other options.`),1;let X=Z.runner??w$,G=Z.fence??$7(X,{platform:Z.platform});try{await nZ(G,J)}catch(Q){let W=G1(Q)??S1(Q);return z(W??await m0("setup-process-check",Q,J)),1}try{let Q=await(Z.restoreLegacy??zJ)({env:J});if(Q.status==="not-moved")return z(`Nothing to restore: ${Q.reason}.`),0;z(`anthropic-auth's state is back in ${Q.oldDir}.`);for(let W of Q.kept)z(`${W} changed after it was copied back and was left in place; delete it once you have checked it.`);return 0}catch(Q){if(Q instanceof GJ)return z(Q.message),1;return z(S1(Q)??await m0("cli-setup",Q,J)),1}}async function K1($){if(process.env.OPENCODE_AUTH_CONTENT!==void 0)throw Error("Native account changes require offline setup without OPENCODE_AUTH_CONTENT");let Z=await BJ({role:"cli"}),J=await PJ(void 0,void 0,Z.layout),z=FJ({paths:J,host:"opencode"});try{return await z.read(),await $(z)}finally{if(Z.kind!=="state-home")Z.registration?.close();await z.close()}}async function D3(){if(await CJ("opencode",process.env)!=="local")throw Error("Disconnect from the vault first.")}function X7(){console.log(`Usage:
+`}}}}).prompt();import{authorize as rZ,exchange as tZ,resolveClaudeCodeIdentity as eZ}from"@cortexkit/anthropic-auth-core";async function t4($,Z={authorize:rZ,exchange:tZ,resolveClaudeCodeIdentity:eZ,text:r4,isCancel:M3,print:console.log}){let J=await Z.authorize("max");Z.print(`Claude sign-in for ${$==="pi"?"Pi":"OpenCode"}`),Z.print(J.url);let z=await Z.text({message:"Paste the Claude callback URL or authorization code:"});if(Z.isCancel(z))throw Error("Claude sign-in cancelled");let X=await Z.exchange(z,J.verifier,J.redirectUri,J.state);if(X.type!=="success")throw Error("Claude sign-in failed");let G=await Z.resolveClaudeCodeIdentity(X.access,void 0,void 0);if(!G.accountUuid)throw Error("Claude sign-in did not establish an account UUID");return{accountIdentity:G.accountUuid,credential:{type:"oauth",access:X.access,refresh:X.refresh,expires:X.expires}}}var e4='Warning: OpenCode holds a separate Anthropic OAuth login. Remove the separate OpenCode Anthropic login, then choose "Claude via credential vault". Setup has left that login unchanged.',FJ="npx @cortexkit/opencode-anthropic-auth setup",$2="--remove-pi-auth",N3="--restore-legacy",G7="-y",Q7=["--help","-h"],$7=[{label:$2,description:"Agree in advance to move a stored Pi Anthropic login out of the way: into the local account pool, or aside privately for vault use (restored on disconnect)."},{label:N3,description:"Move anthropic-auth's state from the CortexKit state folder back into OpenCode's config folder, for example before going back to an older version. Close every OpenCode, OpenCode 2 server and Pi first. Use it on its own."},{label:G7,description:"Same as --yes."},{label:Q7.join(", "),description:"Show this help."}];function VJ(){let $=Math.max(...$7.map((Z)=>Z.label.length));return[KJ({command:FJ}),"","Also accepted by this command:",...$7.map((Z)=>`  ${Z.label.padEnd($)}  ${Z.description}`),"","--login cannot be combined with --claustrum, or with --opencode=2: for OpenCode 2, sign in from OpenCode itself."].join(`
+`)}function U0($,Z){let J=$.get(Z);if(!J)throw Error("Missing setup plan");return J}async function W7($=[],Z={}){let J={...Z.env??process.env},z=Z.terminal??{input:process.stdin,output:process.stdout,signals:process},X=(q)=>z.output.write(`${q}
+`);if($.some((q)=>Q7.includes(q)))return X(VJ()),0;if($.includes(N3))return BJ($,Z,J,X);let G=$.filter((q)=>q!==$2).map((q)=>q===G7?"--yes":q),Q=G.includes("--login");if(Q&&G.includes("--claustrum"))return X("Local sign-in and vault setup are two separate choices. Use --login or --claustrum, not both."),1;if(Q&&G.includes("--opencode=2"))return X(D3),1;let W=Z.runner??p$,H=Z.fence??X7(W,{platform:Z.platform}),U=Z.migrateLocal??n9,Y=new Map,K=new Map,M=new Map,V=new Map,L=[],C=!1,A="setup-process-check",I=(q)=>({env:J,fence:H,paths:M.get(q),removePiAnthropicAuth:V.get(q)??!1}),R=(q)=>({...I(q),runner:W});async function v(q){if(!q.hosts.includes("pi"))return;let B=U0(M,"pi");if((await S1("pi",B.hostAuthPath)).kind==="absent")return;{let g=await XJ({env:J,authPath:B.hostAuthPath}).inspect();if(g.slot==="placeholder"&&g.stash==="missing")throw new zJ("missing-stash");if(q.mode==="claustrum"){if(g.slot==="placeholder")return}}if($.includes($2)){V.set("pi",!0);return}let y=q.mode==="claustrum"?"Pi has stored Anthropic authentication. Rerun with --remove-pi-auth to preserve it privately during vault use and restore it on disconnect.":"Pi has a stored Anthropic login. Rerun with --remove-pi-auth to move it into the native account pool.";if(G.includes("--yes")||!z.input.isTTY)throw new n(y);if(!await Y3(z,q.mode==="claustrum"?"Move Pi authentication aside privately for vault use, then restore it on disconnect?":"Move the Pi Anthropic OAuth login into the native account pool and remove its stored copy?"))throw new n("Native account-pool setup cannot finish while the stored Pi OAuth token takes precedence.");V.set("pi",!0)}async function h(q,B){let P=U0(K,q);if(await QJ(q,J)!==(B?"claustrum":P.priorMode)||await k1(q,R(q))!==P.fingerprint)throw new n("Setup inputs changed. Rerun setup with all hosts stopped.")}let F={packages:{opencode:Z7,pi:J7},version:await z7(),displayName:"CortexKit Anthropic Auth",slashCommand:"/claude",vault:{connectionFile:B$(J.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE&&!J.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE?"pi":"opencode",J),hosts:{opencode:{name:h0.opencode,paths:V$("opencode",J)},pi:{name:h0.pi,paths:V$("pi",J)}}},async beforeSignIn(q,B){if(A=B.mode==="claustrum"?"setup-activation":"cli-setup",!C){if(HJ(J),B.hosts.includes("opencode")){let P=await ZJ({role:"setup",env:J});if(P.kind!=="state-home"&&P.registration)L.push(P.registration)}for(let P of B.hosts)M.set(P,await M0(P,J));if(await u9([...M.values()]),B.hosts.includes("pi"))L.push((await JJ({paths:U0(M,"pi").paths,role:"setup"})).registration);if(B.mode==="claustrum"){let P=B.hosts.map((T)=>B$(T,J)),y=P[0];if(new Set(P).size!==1||!y)throw new n("Selected hosts use different vault connection files.");F.vault.connectionFile=y}if(B.mode==="local"&&Q&&B.hosts.includes("opencode")&&B.opencodeGeneration==="2")throw new n(D3);if(B.mode==="local"){await L$(B.hosts,J);for(let P of B.hosts)await w0(P,I(P))()}await v(B);for(let P of B.hosts)if(B.mode==="claustrum"){if(K.set(P,await(Z.vaultPreflight??r9)(P,{...R(P),inspectOpenCodeAuth:B.opencodeGeneration!=="2"})),U0(K,P).separateOpenCodeLogin)X(e4)}else Y.set(P,await C$(P,I(P),P==="opencode"&&B.opencodeGeneration==="2"));C=!0}else if(B.mode==="claustrum")await h(q,!1);else await H1(U0(Y,q),I(q))},async signInLocal(q){let B=U0(Y,q);if(!Q){if(B.generation2)X(D3);return}if(await H1(B,I(q)),await U(q,{...I(q),login:Z.localLogin??t4,preflight:B.preflight,skipMigration:B.action==="skip",beforeCommit:()=>H1(B,I(q))}),B.fingerprint=await J3(B,J),B.notice)X(N$)},async beforeRegister(q,B){if(B==="local")await H1(U0(Y,q),I(q));else await h(q,!0),await(Z.vaultActivate??t9)(q,R(q),U0(K,q)),U0(K,q).fingerprint=await k1(q,R(q))},async migrate(q,B){if(B.mode==="claustrum"){if(await h(q,!0),q===B.hosts.at(-1)&&K.get("opencode")?.separateOpenCodeLogin)X(e4);return}let P=U0(Y,q);if(await H1(P,I(q)),Q)return;if(P.action==="migration")await U(q,{...I(q),preflight:P.preflight});else if(P.action==="empty-init")await GJ({paths:P.paths.paths,routingDestinationPath:P.paths.routingDestinationPath,env:J,processFence:w0(q,I(q))});else if(P.action==="skip"){if(await O$(P,I(q)),P.notice)X(N$)}P.fingerprint=await J3(P,J)}};try{return await UJ(F,G,{...Z,env:J,terminal:z,runner:W,fence:H}),0}catch(q){let P=p9(q)??E1(q)??await u0(A,q,J);if(P)X(P);for(let{host:y,outcome:T}of q4(q)??[]){if(T!=="enrolled")continue;let g=y==="opencode"?"OpenCode":"Pi";X(`${g} stays connected to the vault. In ${g}, run /claude → Accounts → Disconnect from the vault to undo it. Or run setup again to finish connecting.`)}return 1}finally{for(let q of L)q.close();for(let q of Y.values())if(q.preflight)WJ(q.preflight)}}async function BJ($,Z,J,z){if($.some((Q)=>Q!==N3))return z(`${N3} runs on its own; run it without other options.`),1;let X=Z.runner??p$,G=Z.fence??X7(X,{platform:Z.platform});try{await $J(G,J)}catch(Q){let W=W1(Q)??E1(Q);return z(W??await u0("setup-process-check",Q,J)),1}try{let Q=await(Z.restoreLegacy??YJ)({env:J});if(Q.status==="not-moved")return z(`Nothing to restore: ${Q.reason}.`),0;z(`anthropic-auth's state is back in ${Q.oldDir}.`);for(let W of Q.kept)z(`${W} changed after it was copied back and was left in place; delete it once you have checked it.`);return 0}catch(Q){if(Q instanceof qJ)return z(Q.message),1;return z(E1(Q)??await u0("cli-setup",Q,J)),1}}async function V1($){if(process.env.OPENCODE_AUTH_CONTENT!==void 0)throw Error("Native account changes require offline setup without OPENCODE_AUTH_CONTENT");let Z=await PJ({role:"cli"}),J=await SJ(void 0,void 0,Z.layout),z=LJ({paths:J,host:"opencode"});try{return await z.read(),await $(z)}finally{if(Z.kind!=="state-home")Z.registration?.close();await z.close()}}async function L3(){if(await RJ("opencode",process.env)!=="local")throw Error("Disconnect from the vault first.")}function H7(){console.log(`Usage:
   opencode-anthropic-auth setup [--yes] [--dry-run]
   opencode-anthropic-auth login [label]
   opencode-anthropic-auth api add [label]
@@ -63,9 +63,9 @@ Setup --yes selects every found host, including Pi. Run setup without --yes to c
 Run setup --help to list every setup option.
 Native credentials are managed by the offline setup migration.
 Legacy import source:
-  ${NJ()}`)}function t$($,Z){let J=$?.trim();if(!J)throw Error(`${Z} is required`);return J}async function C3($){let J=await($.fetchImpl??fetch)(`https://api.cloudflare.com/client/v4${$.path}`,{method:$.method,headers:{authorization:`Bearer ${$.token}`,...$.body instanceof FormData?{}:{"content-type":"application/json"},...$.headers},body:$.body}),z=await J.text(),X;try{X=JSON.parse(z)}catch{throw Error(`Cloudflare API returned ${J.status}: ${z}`)}if(!J.ok||X.success===!1){let G=X.errors?.map((Q)=>Q.message).filter(Boolean).join("; ");throw Error(G||`Cloudflare API returned ${J.status}`)}return X.result}async function AJ($,Z,J,z){return C3({token:$,method:"POST",path:`/accounts/${Z}/storage/kv/namespaces`,body:JSON.stringify({title:J}),fetchImpl:z})}async function IJ($){let Z={main_module:"worker.js",compatibility_date:"2026-04-28",bindings:[{type:"kv_namespace",name:"RELAY_STATE",namespace_id:$.kvNamespaceId},{type:"secret_text",name:"RELAY_TOKEN",text:$.relayToken}]},J=new FormData;return J.set("metadata",JSON.stringify(Z)),J.set("worker.js",new Blob([OJ],{type:"application/javascript+module"}),"worker.js"),C3({token:$.token,method:"PUT",path:`/accounts/${$.accountId}/workers/scripts/${$.scriptName}`,body:J,fetchImpl:$.fetchImpl})}async function _J($,Z,J,z){await C3({token:$,method:"POST",path:`/accounts/${Z}/workers/scripts/${J}/subdomain`,body:JSON.stringify({enabled:!0,previews_enabled:!1}),fetchImpl:z})}async function RJ($,Z,J){return C3({token:$,method:"GET",path:`/accounts/${Z}/workers/subdomain`,fetchImpl:J}).catch(()=>null)}async function SJ($={}){await K1((F)=>F.read());let Z=$.fetchImpl??fetch,J=$.prompt??L3,z=$.warn??((F)=>console.warn(F)),X=t$(process.env.CLOUDFLARE_API_TOKEN?.trim()||await J("Cloudflare API token: "),"Cloudflare API token");$.secrets?.push(X);let G=t$(process.env.CLOUDFLARE_ACCOUNT_ID||await J("Cloudflare account ID: "),"Cloudflare account ID"),Q=await J("Worker name [opencode-anthropic-relay]: ")||"opencode-anthropic-relay",W=`${Q}-state`,H=DJ();$.secrets?.push(H),console.log("Creating Cloudflare KV namespace...");let U=await AJ(X,G,W,Z);console.log("Uploading relay Worker..."),await IJ({token:X,accountId:G,scriptName:Q,kvNamespaceId:U.id,relayToken:H,fetchImpl:Z}),await _J(X,G,Q,Z).catch(async(F)=>{z(await m0("cli-relay-workers-dev",F,process.env,[X,H]))});let Y=await RJ(X,G,Z),M=(Y?.subdomain?`https://${Q}.${Y.subdomain}.workers.dev`:"")||t$(await L3("Relay Worker URL: "),"Relay Worker URL");await K1((F)=>F.updateRelay({enabled:!0,url:M,token:H,fallbackToDirect:!0,transport:"http"})),console.log(`Relay enabled at ${M}`),console.log("Relay settings saved to the native account store.")}var N3=null;async function L3($){return N3??=KJ({input:UJ,output:qJ}),(await N3.question($)).trim()}function kJ(){N3?.close(),N3=null}async function TJ($,Z={}){if(process.env.OPENCODE_AUTH_CONTENT!==void 0)throw Error("Local login cannot be verified while OPENCODE_AUTH_CONTENT is set");let J=Z.prompt??L3,z=Z.authorize??VJ,X=Z.exchange??jJ;await D3(),await K1(async(G)=>{let Q=await G.read(),W=$?.trim()||await J("Fallback account label (optional): "),H=await z("max");console.log(`
+  ${IJ()}`)}function Z2($,Z){let J=$?.trim();if(!J)throw Error(`${Z} is required`);return J}async function O3($){let J=await($.fetchImpl??fetch)(`https://api.cloudflare.com/client/v4${$.path}`,{method:$.method,headers:{authorization:`Bearer ${$.token}`,...$.body instanceof FormData?{}:{"content-type":"application/json"},...$.headers},body:$.body}),z=await J.text(),X;try{X=JSON.parse(z)}catch{throw Error(`Cloudflare API returned ${J.status}: ${z}`)}if(!J.ok||X.success===!1){let G=X.errors?.map((Q)=>Q.message).filter(Boolean).join("; ");throw Error(G||`Cloudflare API returned ${J.status}`)}return X.result}async function TJ($,Z,J,z){return O3({token:$,method:"POST",path:`/accounts/${Z}/storage/kv/namespaces`,body:JSON.stringify({title:J}),fetchImpl:z})}async function EJ($){let Z={main_module:"worker.js",compatibility_date:"2026-04-28",bindings:[{type:"kv_namespace",name:"RELAY_STATE",namespace_id:$.kvNamespaceId},{type:"secret_text",name:"RELAY_TOKEN",text:$.relayToken}]},J=new FormData;return J.set("metadata",JSON.stringify(Z)),J.set("worker.js",new Blob([kJ],{type:"application/javascript+module"}),"worker.js"),O3({token:$.token,method:"PUT",path:`/accounts/${$.accountId}/workers/scripts/${$.scriptName}`,body:J,fetchImpl:$.fetchImpl})}async function bJ($,Z,J,z){await O3({token:$,method:"POST",path:`/accounts/${Z}/workers/scripts/${J}/subdomain`,body:JSON.stringify({enabled:!0,previews_enabled:!1}),fetchImpl:z})}async function fJ($,Z,J){return O3({token:$,method:"GET",path:`/accounts/${Z}/workers/subdomain`,fetchImpl:J}).catch(()=>null)}async function xJ($={}){await V1((V)=>V.read());let Z=$.fetchImpl??fetch,J=$.prompt??C3,z=$.warn??((V)=>console.warn(V)),X=Z2(process.env.CLOUDFLARE_API_TOKEN?.trim()||await J("Cloudflare API token: "),"Cloudflare API token");$.secrets?.push(X);let G=Z2(process.env.CLOUDFLARE_ACCOUNT_ID||await J("Cloudflare account ID: "),"Cloudflare account ID"),Q=await J("Worker name [opencode-anthropic-relay]: ")||"opencode-anthropic-relay",W=`${Q}-state`,H=AJ();$.secrets?.push(H),console.log("Creating Cloudflare KV namespace...");let U=await TJ(X,G,W,Z);console.log("Uploading relay Worker..."),await EJ({token:X,accountId:G,scriptName:Q,kvNamespaceId:U.id,relayToken:H,fetchImpl:Z}),await bJ(X,G,Q,Z).catch(async(V)=>{z(await u0("cli-relay-workers-dev",V,process.env,[X,H]))});let Y=await fJ(X,G,Z),M=(Y?.subdomain?`https://${Q}.${Y.subdomain}.workers.dev`:"")||Z2(await C3("Relay Worker URL: "),"Relay Worker URL");await V1((V)=>V.updateRelay({enabled:!0,url:M,token:H,fallbackToDirect:!0,transport:"http"})),console.log(`Relay enabled at ${M}`),console.log("Relay settings saved to the native account store.")}var P3=null;async function C3($){return P3??=DJ({input:jJ,output:MJ}),(await P3.question($)).trim()}function yJ(){P3?.close(),P3=null}async function gJ($,Z={}){if(process.env.OPENCODE_AUTH_CONTENT!==void 0)throw Error("Local login cannot be verified while OPENCODE_AUTH_CONTENT is set");let J=Z.prompt??C3,z=Z.authorize??NJ,X=Z.exchange??CJ;await L3(),await V1(async(G)=>{let Q=await G.read(),W=$?.trim()||await J("Fallback account label (optional): "),H=await z("max");console.log(`
 Open this URL in your browser and complete Claude sign-in:
 `),console.log(`${H.url}
-`);let U=await J("Paste the full callback URL or authorization code here: ");Z.secrets?.push(U);let Y=await X(U,H.verifier,H.redirectUri,H.state);if(Y.type==="failed")throw Error("Authentication failed");if(Z.secrets?.push(Y.access,Y.refresh),process.env.OPENCODE_AUTH_CONTENT!==void 0)throw Error("Local login cannot be verified while OPENCODE_AUTH_CONTENT is set");await D3();let K=W&&W!=="main"?W:crypto.randomUUID(),M=Q.accounts.some((F)=>F.id===K&&F.source==="local");await G.loginOAuth({routeId:K,replace:M,label:W||void 0,credential:{access:Y.access,refresh:Y.refresh,expires:Y.expires}}),console.log(`
-Saved native fallback account${W?` "${W}"`:""}.`)})}async function bJ($,Z={}){await D3(),await K1((H)=>H.read());let J=Z.prompt??L3,z=$?.trim()||await J("API fallback label (optional): "),X=process.env.OPENCODE_ANTHROPIC_AUTH_API_BASE_URL?.trim()||(await J("Anthropic-compatible base URL [https://api.kie.ai/claude]: ")).trim()||"https://api.kie.ai/claude";if(!LJ(X))throw Error("API fallback base URL must be an http(s) URL without embedded credentials");let G=process.env.OPENCODE_ANTHROPIC_AUTH_API_KEY?.trim()||await J("API key: ");if(!G.trim())throw Error("API key is required");Z.secrets?.push(G.trim());let W=(process.env.OPENCODE_ANTHROPIC_AUTH_API_AUTH_HEADER?.trim()||await J("Auth header [authorization-bearer|x-api-key] (default authorization-bearer): ")).trim().toLowerCase()==="x-api-key"?"x-api-key":"authorization-bearer";await K1(async(H)=>{await D3();let U=await H.read(),Y=z&&z!=="main"?z:crypto.randomUUID(),K=U.accounts.find((M)=>M.id===Y);if(K?.source==="vault")throw Error("Vault routes cannot be replaced with a local API key");await H.addApi({routeId:Y,replace:Boolean(K),label:z||void 0,apiKey:G.trim(),baseURL:X,authHeader:W})}),console.log(`
-Saved API fallback route${z?` "${z}"`:""} (${X}).`)}async function EJ(){await K1(async($)=>{let Z=(await $.read()).accounts.filter((J)=>J.id!=="main");if(!Z.length){console.log("No native fallback accounts found.");return}for(let[J,z]of Z.entries()){let X=z.label||z.id,G=z.enabled?"enabled":"disabled";if(z.type==="api"){console.log(`${J+1}. ${X} (${G}) — API route ${z.baseURL}`);continue}let Q=z.quota?.five_hour?.remainingPercent,W=z.quota?.seven_day?.remainingPercent,H=Q===void 0&&W===void 0?"quota unknown":`5h ${Q??"?"}%, 1w ${W??"?"}% remaining`;console.log(`${J+1}. ${X} (${G}) — ${H}${z.state?` — ${MJ(z)}`:""}`)}})}async function fJ($){let[Z,J,z]=process.argv.slice(2);if(!Z||Z==="help"||Z==="--help"||Z==="-h"){X7();return}if(Z==="setup"){$.stage="cli-setup";let X=await z7(process.argv.slice(3));if(X!==0)process.exitCode=X;return}if(Z==="login"){$.stage="cli-login",await TJ(J,{secrets:$.secrets});return}if(Z==="api"&&J==="add"){$.stage="cli-api-add",await bJ(z,{secrets:$.secrets});return}if(Z==="list"){$.stage="cli-list",await EJ();return}if(Z==="relay"&&J==="setup"){$.stage="cli-relay-setup",await SJ({secrets:$.secrets});return}X7(),process.exitCode=1}if(R3.main==R3.module){let $={stage:"cli-command",secrets:[]};try{await fJ($)}catch(Z){console.error(await m0($.stage,Z,process.env,$.secrets)),process.exitCode=1}finally{kJ()}}export{z7 as runSetupCommand,SJ as relaySetup,TJ as login,bJ as addApiRoute};
+`);let U=await J("Paste the full callback URL or authorization code here: ");Z.secrets?.push(U);let Y=await X(U,H.verifier,H.redirectUri,H.state);if(Y.type==="failed")throw Error("Authentication failed");if(Z.secrets?.push(Y.access,Y.refresh),process.env.OPENCODE_AUTH_CONTENT!==void 0)throw Error("Local login cannot be verified while OPENCODE_AUTH_CONTENT is set");await L3();let K=W&&W!=="main"?W:crypto.randomUUID(),M=Q.accounts.some((V)=>V.id===K&&V.source==="local");await G.loginOAuth({routeId:K,replace:M,label:W||void 0,credential:{access:Y.access,refresh:Y.refresh,expires:Y.expires}}),console.log(`
+Saved native fallback account${W?` "${W}"`:""}.`)})}async function vJ($,Z={}){await L3(),await V1((H)=>H.read());let J=Z.prompt??C3,z=$?.trim()||await J("API fallback label (optional): "),X=process.env.OPENCODE_ANTHROPIC_AUTH_API_BASE_URL?.trim()||(await J("Anthropic-compatible base URL [https://api.kie.ai/claude]: ")).trim()||"https://api.kie.ai/claude";if(!_J(X))throw Error("API fallback base URL must be an http(s) URL without embedded credentials");let G=process.env.OPENCODE_ANTHROPIC_AUTH_API_KEY?.trim()||await J("API key: ");if(!G.trim())throw Error("API key is required");Z.secrets?.push(G.trim());let W=(process.env.OPENCODE_ANTHROPIC_AUTH_API_AUTH_HEADER?.trim()||await J("Auth header [authorization-bearer|x-api-key] (default authorization-bearer): ")).trim().toLowerCase()==="x-api-key"?"x-api-key":"authorization-bearer";await V1(async(H)=>{await L3();let U=await H.read(),Y=z&&z!=="main"?z:crypto.randomUUID(),K=U.accounts.find((M)=>M.id===Y);if(K?.source==="vault")throw Error("Vault routes cannot be replaced with a local API key");await H.addApi({routeId:Y,replace:Boolean(K),label:z||void 0,apiKey:G.trim(),baseURL:X,authHeader:W})}),console.log(`
+Saved API fallback route${z?` "${z}"`:""} (${X}).`)}async function hJ(){await V1(async($)=>{let Z=(await $.read()).accounts.filter((J)=>J.id!=="main");if(!Z.length){console.log("No native fallback accounts found.");return}for(let[J,z]of Z.entries()){let X=z.label||z.id,G=z.enabled?"enabled":"disabled";if(z.type==="api"){console.log(`${J+1}. ${X} (${G}) — API route ${z.baseURL}`);continue}let Q=z.quota?.five_hour?.remainingPercent,W=z.quota?.seven_day?.remainingPercent,H=Q===void 0&&W===void 0?"quota unknown":`5h ${Q??"?"}%, 1w ${W??"?"}% remaining`;console.log(`${J+1}. ${X} (${G}) — ${H}${z.state?` — ${OJ(z)}`:""}`)}})}async function mJ($){let[Z,J,z]=process.argv.slice(2);if(!Z||Z==="help"||Z==="--help"||Z==="-h"){H7();return}if(Z==="setup"){$.stage="cli-setup";let X=await W7(process.argv.slice(3));if(X!==0)process.exitCode=X;return}if(Z==="login"){$.stage="cli-login",await gJ(J,{secrets:$.secrets});return}if(Z==="api"&&J==="add"){$.stage="cli-api-add",await vJ(z,{secrets:$.secrets});return}if(Z==="list"){$.stage="cli-list",await hJ();return}if(Z==="relay"&&J==="setup"){$.stage="cli-relay-setup",await xJ({secrets:$.secrets});return}H7(),process.exitCode=1}if(k3.main==k3.module){let $={stage:"cli-command",secrets:[]};try{await mJ($)}catch(Z){console.error(await u0($.stage,Z,process.env,$.secrets)),process.exitCode=1}finally{yJ()}}export{W7 as runSetupCommand,xJ as relaySetup,gJ as login,vJ as addApiRoute};