@cortexkit/opencode-anthropic-auth 2.4.3 → 2.4.4

package/dist/v2/server.js

@@ -1,14 +1,14 @@
-import{a as d2,b as K1,c as H1,d as A$,e as x$,f as c2,g as x2,h as k$,i as b$,j as w$,k as _1,l as D$,m as y$,n as I$,o as f$,p as Y$,q as T1}from"../index-42r4bnpm.js";import"../index-sg0knfec.js";import"../index-hc7bm3yf.js";import{v as F1}from"../index-hbk67489.js";import{w as i2,x as o2,z as L1}from"../index-m4dazzyf.js";import"../index-naff9h33.js";import{J as Z1}from"../index-t4aky73k.js";import"../index-gvswxab8.js";import"../index-71temqvq.js";import{acquireNativeAccountRuntime as KZ,assertUnmanagedInjectedPaths as MZ,authorize as HZ,createNativeUi as _Z,decideOpenCodeStateLayoutOnce as NZ,disconnectNativeVaultForHost as LZ,exchange as FZ,getPersistedLogLevel as PZ,isDumpPersistentlyEnabled as TZ,logger as M$,openCodeHolderKind as CZ,readNativeEnrollmentMode as OZ,registerNativePoolHolder as EZ,resolveNativePoolPaths as RZ,setDumpEnabled as SZ,setLogLevel as qZ,stateLayoutIoFailure as AZ,unmovedRegistrationPolicy as xZ}from"@cortexkit/anthropic-auth-core";class k2 extends Error{kind;providerID;sessionID;requestKind;constructor($){super($.message??`${$.providerID} ${$.requestKind} request refused (${$.kind})`);this.name="OpenCode2AuthError",this.kind=$.kind,this.providerID=$.providerID,this.sessionID=$.sessionID,this.requestKind=$.requestKind}}function O2($){return`common-auth-placeholder.${$}`}function _$($){let X=O2($.integrationID);return{type:"oauth",methodID:$.methodID,access:X,refresh:X,expires:$.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function e2($,X){if($?.type!=="oauth")return!1;let z=X===void 0?void 0:O2(X),V=(F)=>z===void 0?F.startsWith("common-auth-placeholder."):F===z;return V($.access)&&V($.refresh)}var N$="No browser sign-in: this connects the plugin to the accounts in its vault.";async function $$($,X){let z=X.now??Date.now,{integrationID:V}=X,F=(T)=>_$({integrationID:V,methodID:T,now:z()}),L=async(T,K)=>{return await X.onLogin(T,{integrationID:V,methodID:K}),F(K)},C=(T)=>async(K)=>{let Y=T.method.id,U=await T.authorize(K),M={url:U.url,instructions:U.instructions,...U.expiresAt===void 0?{}:{expiresAt:U.expiresAt}};if(U.mode==="auto")return{...M,mode:"auto",callback:U.callback.then((P)=>L(P,Y))};let G=U.callback;return{...M,mode:"code",callback:async(P)=>L(await G(P),Y)}};return $.integration.transform((T)=>{let K=X.label===void 0?{}:{label:()=>X.label};for(let M of X.methods)T.method.update({integrationID:V,method:M.method,authorize:C(M),refresh:async(G)=>{if(!e2(G,V))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return F(G.methodID)},...K});let Y=X.vault;if(Y===void 0)return;let U=Y.method.id;T.method.update({integrationID:V,method:Y.method,authorize:async()=>({url:"",instructions:Y.instructions??N$,mode:"auto",callback:Promise.resolve().then(()=>Y.activate({integrationID:V,methodID:U})).then(()=>F(U))}),refresh:async(M)=>{if(!e2(M,V)||M.methodID!==U)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return F(U)},...K})})}function C1($){let X=[],z;for(let V of $.split(/\r?\n/))if(V.startsWith("data:"))X.push(V.slice(5).replace(/^ /,""));else if(V.startsWith("event:"))z=V.slice(6).trim();if(X.length===0)return;return z===void 0?{data:X.join(`
+import{a as c2,b as M1,c as _1,d as k$,e as b$,f as r2,g as R2,h as w$,i as D$,j as y$,k as N1,l as I$,m as v$,n as f$,o as g$,p as V$,q as C1}from"../index-j3mytf5r.js";import"../index-sg0knfec.js";import"../index-hc7bm3yf.js";import{v as P1}from"../index-61bbefpq.js";import{w as n2,x as s2,z as F1}from"../index-m4dazzyf.js";import"../index-naff9h33.js";import{J as o2}from"../index-j2cv839v.js";import"../index-gvswxab8.js";import"../index-71temqvq.js";import{acquireNativeAccountRuntime as _Z,assertUnmanagedInjectedPaths as NZ,authorize as LZ,createNativeUi as FZ,decideOpenCodeStateLayoutOnce as PZ,disconnectNativeVaultForHost as TZ,exchange as CZ,getPersistedLogLevel as OZ,isDumpPersistentlyEnabled as EZ,logger as _$,openCodeHolderKind as SZ,readNativeEnrollmentMode as qZ,registerNativePoolHolder as xZ,resolveNativePoolPaths as AZ,setDumpEnabled as RZ,setLogLevel as kZ,stateLayoutIoFailure as bZ,unmovedRegistrationPolicy as wZ}from"@cortexkit/anthropic-auth-core";class b2 extends Error{kind;providerID;sessionID;requestKind;constructor($){super($.message??`${$.providerID} ${$.requestKind} request refused (${$.kind})`);this.name="OpenCode2AuthError",this.kind=$.kind,this.providerID=$.providerID,this.sessionID=$.sessionID,this.requestKind=$.requestKind}}function C2($){return`common-auth-placeholder.${$}`}function L$($){let X=C2($.integrationID);return{type:"oauth",methodID:$.methodID,access:X,refresh:X,expires:$.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function Z$($,X){if($?.type!=="oauth")return!1;let z=X===void 0?void 0:C2(X),W=(F)=>z===void 0?F.startsWith("common-auth-placeholder."):F===z;return W($.access)&&W($.refresh)}var F$="No browser sign-in: this connects the plugin to the accounts in its vault.";async function J$($,X){let z=X.now??Date.now,{integrationID:W}=X,F=(T)=>L$({integrationID:W,methodID:T,now:z()}),L=async(T,K)=>{return await X.onLogin(T,{integrationID:W,methodID:K}),F(K)},C=(T)=>async(K)=>{let Y=T.method.id,U=await T.authorize(K),M={url:U.url,instructions:U.instructions,...U.expiresAt===void 0?{}:{expiresAt:U.expiresAt}};if(U.mode==="auto")return{...M,mode:"auto",callback:U.callback.then((P)=>L(P,Y))};let G=U.callback;return{...M,mode:"code",callback:async(P)=>L(await G(P),Y)}};return $.integration.transform((T)=>{let K=X.label===void 0?{}:{label:()=>X.label};for(let M of X.methods)T.method.update({integrationID:W,method:M.method,authorize:C(M),refresh:async(G)=>{if(!Z$(G,W))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return F(G.methodID)},...K});let Y=X.vault;if(Y===void 0)return;let U=Y.method.id;T.method.update({integrationID:W,method:Y.method,authorize:async()=>({url:"",instructions:Y.instructions??F$,mode:"auto",callback:Promise.resolve().then(()=>Y.activate({integrationID:W,methodID:U})).then(()=>F(U))}),refresh:async(M)=>{if(!Z$(M,W)||M.methodID!==U)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return F(U)},...K})})}function O1($){let X=[],z;for(let W of $.split(/\r?\n/))if(W.startsWith("data:"))X.push(W.slice(5).replace(/^ /,""));else if(W.startsWith("event:"))z=W.slice(6).trim();if(X.length===0)return;return z===void 0?{data:X.join(`
 `)}:{event:z,data:X.join(`
-`)}}function X$($,X){let z=new TextDecoder,V="",F=(C)=>{let T=C1(C);if(!T)return;try{$(T)}catch(K){X(K)}},L=()=>{for(;;){let C=/\r?\n\r?\n/.exec(V);if(!C)return;let T=V.slice(0,C.index);V=V.slice(C.index+C[0].length),F(T)}};return new TransformStream({transform(C,T){T.enqueue(C),V+=z.decode(C,{stream:!0}),L()},flush(){if(V+=z.decode(),L(),V.trim()!=="")F(V);V=""}})}var L$=512,F$=1200000,b2="x-common-auth-attempt",q2=($,X)=>JSON.stringify([$,X]),N2=($)=>({providerID:$.model.providerID,modelID:$.model.id,sessionID:$.sessionID,agent:$.agent,kind:$.kind});function O1($){let X=$.headers;return typeof X==="object"&&X!==null}function E1($,X){let z=$.getReader();return new ReadableStream({async pull(V){let F;try{F=await z.read()}catch(L){X({reason:"failed",message:L instanceof Error?L.message:String(L)}),V.error(L);return}if(F.done)X(),V.close();else V.enqueue(F.value)},async cancel(V){X({reason:"cancelled",...V===void 0?{}:{message:String(V)}}),await z.cancel(V)}})}function m2($,X){for(let[z,V]of Object.entries(X)){let F=z.toLowerCase();for(let L of Object.keys($))if(L.toLowerCase()===F)delete $[L];if(V!==null)$[z]=V}}function R1($,X){for(let[z,V]of Object.entries(X))if(V===null)$.delete(z);else $.set(z,V)}async function Z$($,X,z={}){let{providerID:V}=X,F=z.gateOnPlaceholder,L=(Z)=>F===void 0||F.credential(Z)===O2(V),C=z.logger,T=Math.max(1,z.maxRecords??L$),K=[...z.hostCredentials??[O2(V)],...F?[O2(V)]:[]].filter((Z)=>Z!==""),Y=new Map,U=new WeakMap,M=new Map,G=0,P=new Set,x=new Map,E=new Map,D=(Z)=>{let j=E.get(Z);return j?.ownedSeen===!0&&j.foreignSeen},l=(Z,j)=>{x.set(Z,j);let _=E.get(Z)??{ownedSeen:!1,foreignSeen:!1};if(j)_.ownedSeen=!0;else _.foreignSeen=!0;E.set(Z,_)},b=(Z,j)=>{let _=F?.refuseMisplaced,q=_?[...j].filter(([,d])=>d.includes(O2(V))):[],O=L(j)&&(!_||q.length>0);if(_){if(q.length>0&&(q.length!==1||!O))throw l(Z.sessionID,!1),new k2({kind:"placement-refused",providerID:V,sessionID:Z.sessionID,requestKind:Z.kind,message:_(q[0]?.[0]??"")})}return l(Z.sessionID,O),O},n=!1,$2=!1,a=new Map,H2=0,r=!1,J=new Map,Q=(Z,j)=>{try{C?.warn(Z,j)}catch{}},B=(Z)=>Z instanceof Error?Z.message:String(Z),R=new Map,k=(Z,j)=>{let _=(R.get(Z)??Promise.resolve()).then(j),q=_.then(()=>{},()=>{});return R.set(Z,q),q.then(()=>{if(R.get(Z)===q)R.delete(Z)}),_},f=(Z,j)=>{let _=R.get(Z);return _?_.then(()=>f(Z,j)):j()},h=async(Z)=>{try{await X.dropChoice?.({...Z.input,accountId:Z.accountId})}catch(j){Q("opencode2 auth dropChoice threw; the request is unaffected",{sessionID:Z.input.sessionID,error:B(j)})}},i=(Z)=>{let j=M.get(Z);if(M.delete(Z),j?.next){let _=j.next;k(j.sessionID,()=>h(_))}},c=async(Z,j)=>{let _=a.get(Z);if(!_||_.size===0)return;await Promise.all([..._].map(async(q)=>{try{await q(j)}catch(O){Q("opencode2 auth listener threw; the request is unaffected",{event:Z,error:B(O)})}}))},J2=async(Z,j)=>{try{await X.onAttemptEnd?.(Z,j)}catch(_){Q("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:Z.attemptId,error:B(_)})}},g=(Z,j)=>{if(Z.ended||!Z.attempt)return;let _={...Z.status===void 0?{}:{status:Z.status},outputStarted:Z.outputStarted,...Z.limit?{limit:Z.limit.signal}:{},...j?{error:j}:{}};if(j)Z.endError=j;Z.ended=J2(Z.attempt,_)},m=(Z,j)=>g(Z,{reason:"abandoned",message:j}),u=(Z)=>[...Y.values()].filter((j)=>j.key===Z),U2=(Z)=>u(Z).at(-1),T2=(Z)=>{if(Y.delete(Z.id),M.get(Z.key)?.attemptId===Z.id||!u(Z.key).length)i(Z.key)},t=(Z)=>{Y.set(Z.id,Z);while(Y.size>T){let j=Y.values().next().value;if(j===void 0)break;m(j,"dropped to keep the record bound"),T2(j)}},V2=(Z)=>Z.accountId===void 0?void 0:{...Z.scope,accountId:Z.accountId},W=(Z,j)=>new k2({kind:"no-account",providerID:V,sessionID:Z.sessionID,requestKind:Z.kind,...j===void 0?{}:{message:j}}),N=(Z)=>{J.get(Z)?.clear(),J.delete(Z)},H=async(Z,j)=>{let _=()=>W(Z,`${V} ${Z.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(r)throw _();let q=J.get(Z.sessionID);if(!q)q=new Set,J.set(Z.sessionID,q);let O={};q.add(O);let d=()=>{if(!q.has(O))throw _()};try{return await j(d)}finally{if(q.delete(O),q.size===0&&J.get(Z.sessionID)===q)J.delete(Z.sessionID)}},A=(Z,j)=>{for(let[_,q]of j)if(K.some((O)=>q.includes(O)))throw new k2({kind:"host-credential-on-wire",providerID:V,sessionID:Z.sessionID,requestKind:Z.kind,message:`${V} ${Z.kind} request still carries the host's placeholder credential in ${_}; the adapter's account headers must replace it`})},S=(Z)=>{for(let j of u(Z))if(j.ended||!j.attempt)T2(j);else if(j.transport==="ws"||j.judged)m(j,"a newer attempt of its session and kind began"),T2(j)},y=async(Z,j,_,q)=>{let O=q2(Z.sessionID,Z.kind),{input:d,accountId:w}=await f(Z.sessionID,async()=>{_();let W2=M.get(O);M.delete(O);let L2=W2?.accountId??U2(O)?.accountId;S(O);let F2=W2?.next,z2=F2!==void 0&&F2.input.modelID===Z.modelID&&F2.input.agent===Z.agent,y2={...Z,phase:"request",...L2===void 0?{}:{previousAccountId:L2},...W2?.rerouteFrom?{rerouteFrom:W2.rerouteFrom}:{}};if(F2&&!z2)await k(Z.sessionID,()=>h(F2)),_();let C2=z2?F2.accountId:await X.chooseAccount(y2);return{input:y2,accountId:typeof C2==="string"?C2:void 0}});_();let v={},Z2;if(w!==void 0){let W2=await X.accountHeaders({...Z,accountId:w});if(_(),O1(W2))v=W2.headers,Z2=W2.attempt;else v=W2}let R2=`attempt-${++H2}`,_2={id:R2,key:O,scope:Z,accountId:w,headers:v,attempt:w===void 0?void 0:{...Z,accountId:w,attemptId:R2,transport:q,data:Z2},...q===void 0?{}:{transport:q},outputStarted:!1};if(t(_2),_2.attempt)c("select",{...Z,accountId:_2.attempt.accountId,hook:j,...d.previousAccountId===void 0?{}:{previousAccountId:d.previousAccountId},...d.rerouteFrom===void 0?{}:{rerouteFrom:d.rerouteFrom},handle:_2.attempt});return _2},I=async(Z,j,_,q,O)=>{let d=q2(Z.sessionID,Z.kind),w=q===void 0?void 0:Y.get(q);if(w?.key!==d)w=void 0;if(!w){if(w=U2(d),u(d).filter((Z2)=>Z2.transport===void 0&&!Z2.ended).length>1&&!$2)$2=!0,Q("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:Z.sessionID,kind:Z.kind})}if(!w||w.transport!==void 0||w.ended)w=await y(Z,j,O,_);else if(w.transport=_,w.attempt)w.attempt.transport=_;if(_==="ws"){for(let v of u(d))if(v!==w&&v.transport==="ws")m(v,"a newer attempt of its session and kind went out over WebSocket")}return w},s=async(Z,j)=>{try{return await j()}catch(_){throw g(Z,{reason:"failed",message:B(_)}),_}},p=(Z,j)=>{let _=u(q2(Z,j)).filter((q)=>q.transport==="ws").at(-1);return _?.attempt!==void 0&&!_.ended?_:void 0},Y2=(Z,j,_)=>{let q=V2(Z);if(!q||!Z.attempt||Z.limit)return;Z.limit={signal:j,delivered:c("limit",{...q,via:_,limit:j,outputStarted:Z.outputStarted,handle:Z.attempt})}},Q2=(Z,j,_,q)=>{let O=V2(Z);if(!O||!Z.attempt)return;c("quota",{...O,transport:j,...q===void 0?{}:{status:q},quota:_,handle:Z.attempt})},B2=(Z,j,_,q)=>{let O=Z.attempt;if(!O)return;let d=X.inspectEvent?.(q===void 0?{transport:j,data:_,attempt:O}:{transport:j,data:_,event:q,attempt:O});if(!d)return;if(d.quota!==void 0)Q2(Z,j,d.quota);if(d.outputStarted)Z.outputStarted=!0;if(d.limit)Y2(Z,d.limit,j);if(d.error!==void 0)g(Z,{reason:"failed",message:d.error});else if(d.done)g(Z)},P2=(Z,j)=>{let _=Z.attempt;if(!_||j.accountId===Z.accountId)return;if(_.reboundFrom??=_.accountId,_.accountId=j.accountId,"data"in j)_.data=j.data;Z.accountId=j.accountId},X2=(Z)=>!Z.attempt||Z.endError!==void 0||Z.status!==void 0&&Z.status>=400,e=(Z)=>{let j=[...Y.values()].filter((v)=>v.scope.sessionID===Z),_=j.filter((v)=>v.limit&&!v.rerouted).at(-1);if(_)return _;let q=j.filter((v)=>v.scope.kind==="primary"),O=q.length>0?q:j;if(O.length<=1)return O[0];let d=O.filter((v)=>!v.judged&&X2(v)).at(-1);if(d)return d;let w=O.filter((v)=>v.attempt&&!v.ended);if(w.length>1)return"ambiguous";return w[0]??O.at(-1)},G2={providerID:V},j2=[];j2.push(await $.session.hook("model.request",(Z)=>{if(F)return;return H(N2(Z),async(j)=>{let _=await y(N2(Z),"model.request",j);if(j(),_.accountId===void 0)throw W(_.scope);m2(Z.headers,{..._.headers,[b2]:_.id})})},G2)),j2.push(await $.session.hook("http.request",(Z)=>{if(F){if(!b(N2(Z),Z.request.headers))return}return H(N2(Z),async(j)=>{let _=Z.request.headers.get(b2)??void 0,q=F?await y(N2(Z),"http.request",j,"http"):await I(N2(Z),"http.request","http",_,j);j();let O=V2(q),d=q.attempt;if(!O||!d)throw W(q.scope);await s(q,async()=>{let w=Z.request;if(X.rewriteRequest){if(_!==void 0){let R2=new Headers(w.headers);R2.delete(b2),w=new Request(w,{headers:R2})}w=await X.rewriteRequest({...O,request:w,attempt:d})??w,j()}let v=new Headers(w.headers);v.delete(b2),R1(v,q.headers),A(q.scope,v.entries());let Z2=new Request(w,{headers:v});U.set(Z2,q),Z.request=Z2})})},G2)),j2.push(await $.session.hook("http.response",async(Z)=>{let j=U.get(Z.request);if(!j){if(F)return;if(!n)n=!0,Q("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:Z.sessionID,kind:Z.kind});return}let _=Z.response;if(X.answeredBy&&j.attempt){let v=j.attempt,Z2=await s(j,async()=>X.answeredBy?.({request:Z.request,response:_,attempt:v}));if(Z2)P2(j,Z2)}let q=V2(j),O=j.attempt;if(!q||!O)return;j.status=_.status;let d=X.quotaFromHeaders?.(_.headers,_.status,O);if(d!==void 0)Q2(j,"http",d,_.status);if(!_.ok&&X.limitFromResponse){let v=await X.limitFromResponse({status:_.status,headers:_.headers,body:()=>_.clone().text(),attempt:O});if(v)Y2(j,v,"http")}if(!_.ok||!_.body)g(j);let w=_;if(_.body&&(X.inspectEvent||X.onAttemptEnd)){let v=_.body;if(X.inspectEvent)v=v.pipeThrough(X$((Z2)=>B2(j,"http",Z2.data,Z2.event),(Z2)=>Q("opencode2 auth event inspection threw",{error:B(Z2)})));w=new Response(E1(v,(Z2)=>g(j,Z2)),{status:_.status,statusText:_.statusText,headers:_.headers})}if(X.rewriteResponse)w=await X.rewriteResponse({...q,request:Z.request,response:w,attempt:O})??w;if(w!==_)Z.response=w},G2)),j2.push(await $.session.hook("experimental.ws.handshake",(Z)=>{if(F){let j=q2(Z.sessionID,Z.kind);if(P.delete(j),!b(N2(Z),new Headers(Z.headers)))return}return H(N2(Z),async(j)=>{let _;for(let w of Object.keys(Z.headers)){if(w.toLowerCase()!==b2)continue;_??=Z.headers[w],delete Z.headers[w]}let q=F?await y(N2(Z),"experimental.ws.handshake",j,"ws"):await I(N2(Z),"experimental.ws.handshake","ws",_,j);j();let O=V2(q),d=q.attempt;if(!O||!d)throw W(q.scope);await s(q,async()=>{if(!F?.refuseMisplaced)m2(Z.headers,q.headers);let w=X.rewriteHandshakeURL?.({...O,url:Z.url,attempt:d});if(w!==void 0)Z.url=w;if(F?.refuseMisplaced)m2(Z.headers,q.headers);if(A(q.scope,Object.entries(Z.headers)),F)P.add(q.key)})})},G2));let o=X.rewriteWebSocketFrame?.bind(X);if(o)j2.push(await $.session.hook("experimental.ws.send",async(Z)=>{let j=N2(Z);if(F&&!P.has(q2(j.sessionID,j.kind)))return;let _=p(j.sessionID,j.kind),q=await o({...j,attempt:_?.attempt,frame:Z.frame});if(q!==void 0)Z.frame=q},G2));j2.push(await $.session.hook("experimental.ws.receive",(Z)=>{if(F&&!P.has(q2(Z.sessionID,Z.kind)))return;let j=p(Z.sessionID,Z.kind);if(!j)return;try{B2(j,"ws",Z.frame)}catch(_){Q("opencode2 auth frame inspection threw",{error:B(_)})}},G2)),j2.push(await $.session.hook("retry",async(Z)=>{if(F&&x.get(Z.sessionID)!==!0)return;let j=Z.decision,_=()=>c("retry",{sessionID:Z.sessionID,attempt:Z.attempt,reason:"host-decides",hostDecision:j,decision:j});if(D(Z.sessionID)){await _();return}let q=e(Z.sessionID);if(!q)return;if(q==="ambiguous"){await c("retry",{sessionID:Z.sessionID,attempt:Z.attempt,reason:"host-decides",hostDecision:j,decision:j});return}let O=q;await H(O.scope,async(d)=>{let w=d;if(D(Z.sessionID)){await _();return}O.judged=!0;let v=O.attempt;if(v&&!O.outputStarted){if(!O.limit){let _2=X.limitFromError?.(Z.error,v);if(_2)Y2(O,_2,"error")}if(O.ended)await O.ended;if(O.limit)await O.limit.delivered}w();let{decision:Z2,reason:R2}=await k(O.scope.sessionID,async()=>{if(w(),D(Z.sessionID))return{decision:j,reason:"host-decides"};let _2=M.get(O.key);if(M.delete(O.key),_2?.next)await h(_2.next);if(w(),D(Z.sessionID))return{decision:j,reason:"host-decides"};let W2=j,L2,F2,z2;if(O.accountId===void 0||!v)W2={retry:!1},L2="no-account";else if(O.outputStarted)W2={retry:!1},L2="output-started";else if(O.limit){let y2={accountId:O.accountId,limit:O.limit.signal},C2,a2={...O.scope,phase:"retry",previousAccountId:O.accountId,rerouteFrom:y2};try{C2=await X.chooseAccount(a2)}catch(t2){Q("opencode2 auth chooseAccount threw while the retry hook looked for another account; the host decides the retry",{sessionID:O.scope.sessionID,error:B(t2)})}let S2=typeof C2==="object"?C2.hold:void 0,h2=typeof C2==="string"?C2:S2?O.accountId:void 0;if(h2!==void 0)z2={accountId:h2,input:a2};try{w()}catch(t2){if(z2)await h(z2);throw t2}if(D(Z.sessionID)){if(z2)await h(z2);return{decision:j,reason:"host-decides"}}if(S2&&Number.isFinite(S2.delayMs)&&S2.delayMs>=0)W2={retry:!0,delay:Math.min(S2.delayMs,F$)},L2="hold";else if(!S2&&h2!==void 0&&h2!==O.accountId)O.rerouted=!0,F2=y2,W2={retry:!0,delay:0},L2="reroute";else{if(S2&&z2)await h(z2),z2=void 0;L2="host-decides-last-account"}}else L2="host-decides";if(Z.decision=W2,W2.retry&&O.accountId!==void 0&&Y.has(O.id))M.set(O.key,{attemptId:O.id,sessionID:O.scope.sessionID,order:++G,accountId:O.accountId,...F2===void 0?{}:{rerouteFrom:F2},...z2===void 0?{}:{next:z2}});else if(z2)await h(z2);return{decision:W2,reason:L2}});w(),await c("retry",{sessionID:Z.sessionID,...O.accountId===void 0?{}:{accountId:O.accountId},kind:O.scope.kind,attempt:Z.attempt,reason:R2,hostDecision:j,decision:Z2,...v===void 0?{}:{handle:v}})})},G2));let M2=(Z)=>{if(N(Z),x.delete(Z),!E.get(Z)?.foreignSeen)E.delete(Z);for(let j of P)if(JSON.parse(j)[0]===Z)P.delete(j);for(let j of[...Y.values()]){if(j.scope.sessionID!==Z)continue;m(j,"its session was forgotten"),Y.delete(j.id)}for(let[j,_]of M)if(_.sessionID===Z)i(j)},K2=new AbortController,g2=$.event;if(g2)(async()=>{try{for await(let Z of g2.subscribe({signal:K2.signal}))if(Z.type==="session.deleted")M2(Z.data.sessionID);else if(Z.type==="session.status"&&Z.data.status.type==="idle"){let j=Z.data.sessionID,_=++G;k(j,async()=>{for(let[q,O]of M)if(O.sessionID===j&&O.order<_){if(M.delete(q),O.next)await h(O.next)}})}}catch(Z){if(!K2.signal.aborted)Q("opencode2 auth stopped listening for session deletion",{error:B(Z)})}})();return{on(Z,j){let _=a.get(Z);if(!_)_=new Set,a.set(Z,_);let q=j;return _.add(q),()=>{_.delete(q)}},accountFor(Z,j){return U2(q2(Z,j))?.accountId},forgetSession:M2,get size(){return Y.size},async dispose(){if(r)return;r=!0;for(let Z of J.keys())N(Z);K2.abort();for(let Z of Y.values())m(Z,"the installation was disposed");Y.clear();for(let Z of M.keys())i(Z);P.clear(),x.clear(),E.clear(),a.clear(),await Promise.all(R.values()),await Promise.all(j2.map(async(Z)=>{try{await Z.dispose()}catch(j){Q("opencode2 auth hook did not dispose cleanly",{error:B(j)})}}))}}}import{createHash as S1}from"node:crypto";import{AnthropicOAuthOriginError as q1,applyCustomHeaders as A1,assertNotCustodyTombstone as x1,classifyGzipRejection as k1,createProviderErrorRedactor as P$,createProviderErrorResponseScope as T$,decideRequestGzip as b1,dumpDirectRequest as C$,dumpRelayRequest as O$,dumpResponseArtifact as l2,encodeGzipRequestBody as w1,getAccountStoragePath as D1,getRequestGzipLatch as y1,getRequestGzipLatchPath as I1,isDumpEnabled as f1,mergeAnthropicBetas as v1,remapModelId as E$,remapRequestBodyModel as g1,setDumpEnabled as R$,stateRefusalCause as h1,stateRefusalPublicMessage as m1,stripEmptyTrailingAssistantMessages as l1,TrailingAssistantHistoryError as u1}from"@cortexkit/anthropic-auth-core";var w2="anthropic",v$="x-common-auth-attempt",d1=["x-session-affinity","x-opencode-session","x-parent-session-id",A$,d2,x2,v$],u2=new Set(["authorization","x-api-key"]),p1="physical send before a response",c1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",i1=512,o1=5000,n1=500,S$=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class g$ extends Error{sessionID;requestKind;kind="no-account";providerID=w2;constructor($,X){super(c1);this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicNoAccountError"}}class G$ extends Error{sessionID;requestKind;kind="session-forgotten";providerID=w2;constructor($,X){super("request refused: its session was closed while it was being prepared");this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicRevokedError"}}class E2 extends Error{kind="unsupported-transport";providerID=w2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class h$ extends Error{kind="local-invalid-request";status=400;check;constructor($){super($.message,{cause:$});this.name="NativeAnthropicLocalRefusal",this.check=$.check}}class m$ extends Error{kind="state-relocated";providerID=w2;constructor($){super(m1($)??$.message,{cause:$});this.name="NativeAnthropicStateRefusal"}}function p2($){let X=h1($);return X?new m$(X):void 0}var A2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($);function I2($){try{return JSON.parse($)}catch{return}}function J$($){let X={};for(let[z,V]of Object.entries($??{}))X[z.toLowerCase()]=V;return X}function q$($){let X={};for(let z of d1){let V=$.get(z);if(V!==null&&z!==v$)X[z]=V;$.delete(z)}return X}function r1($){try{return new URL($).pathname.endsWith("/messages")}catch{return!1}}function s1($){return $ instanceof u1||$ instanceof x$||$ instanceof q1?new h$($):void 0}function a1($,X){let z=[];if($.oauth)z.push($.oauth.accessToken);for(let[V,F]of Object.entries($.apiHeaders??{})){if(F===null||!u2.has(V))continue;z.push(F.replace(/^Bearer\s+/i,""))}for(let V of u2){let F=X.get(V);if(F!==null)z.push(F.replace(/^Bearer\s+/i,""))}if($.dispatch?.kind==="http-relay")z.push($.dispatch.token);return[...new Set(z.filter(Boolean))]}var t1=new Set(["oauth-2025-04-20","claude-code-20250219",w$]);function e1($){let X=$.split(",").map((z)=>z.trim()).filter((z)=>z&&!t1.has(z));return v1(null,X)}function $X($){let X=I2($);if(!A2(X))return $;let z=l1(X.messages),V=Object.hasOwn(X,"fallbacks"),{droppedMarkers:F}=D$(X,!1),L=V&&!Object.hasOwn(X,"fallbacks"),C=g1(X);return z>0||F>0||L||C?JSON.stringify(X):$}async function XX($,X){if(!($ instanceof Promise))return"settled";let z;try{return await Promise.race([$.then(()=>"settled"),new Promise((V)=>{z=setTimeout(()=>V("timed-out"),X)})])}finally{if(z!==void 0)clearTimeout(z)}}function D2($){let{source:X,log:z}=$,V=Math.max(1,$.maxPendingSends??i1),F=$.attemptEndTimeoutMs??o1,L=$.requestGzipLatch??y1(I1(D1())),C=new WeakSet,T=new Map,K=new WeakMap,Y=new WeakMap,U=new WeakMap,M=new Map,G=new WeakMap,P=P$([]);P.dispose();let x=(W)=>(W&&M.get(W)?.redactor)??P,E=(W)=>{let N=M.get(W);if(!N)return;M.delete(W),N.redactor.dispose(),N.scope.dispose()},D=(W,N,H,A)=>{let S=a1(N,A),y=T$(S,H);l.set(W,H),M.set(W,{sessionID:N.sessionID,redactor:P$(S),scope:y}),y.settled.then(()=>E(W));while(M.size>V){let I=M.keys().next().value;if(I===void 0)break;E(I)}},l=new WeakMap,b=(W,N)=>{let H=W?l.get(W):void 0;if(!H||!N.ok)return P.redactResponse(N);let A=T$([],H),S=A.redactResponse(N);return A.dispose(),S},n=(W,N)=>{let H=W?M.get(W)?.scope:void 0;if(!H)return b(W,N);try{return H.redactResponse(N)}catch{return b(W,N)}},$2=!1,a=new Map,H2=new WeakMap,r=new WeakMap,J=new WeakMap,Q=(W)=>W.agent==="cachekeep"||W.agent==="prime",B=async()=>{try{if(X.isDumpEnabled)return await X.isDumpEnabled()}catch{return!1}try{return f1()}catch{return!1}},R=(W)=>{a.delete(W)},k=new WeakMap,f=(W,N)=>{if(W&&!N.ok)k.set(N.headers,W);return N},h=(W,N)=>{if(N.dispatch!=="http-relay")return!0;let H=/^req_[A-Za-z0-9_-]+$/.test(W.get("request-id")??"");return Y.set(N,H),H},i=(W)=>new g$(W.sessionID,W.kind),c=new Map,J2=async(W,N)=>{if($2)throw new G$(W.sessionID,W.kind);let H={revoked:!1},A=c.get(W.sessionID);if(!A)A=new Set,c.set(W.sessionID,A);A.add(H);let S=()=>{if($2||H.revoked)throw new G$(W.sessionID,W.kind)};try{let y=await N(S);return S(),y}finally{let y=c.get(W.sessionID);if(y?.delete(H)&&y.size===0)c.delete(W.sessionID)}},g=(W,N)=>{T.set(W,N);while(T.size>V){let H=T.keys().next().value;if(H===void 0)break;T.delete(H),z?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:V})}},m=(W,N)=>({providerID:W.providerID,modelID:W.modelID,sessionID:W.sessionID,agent:W.agent,kind:W.kind,accountId:W.accountId,attemptId:W.attemptId,transport:W.transport,route:N.route,provenance:N.provenance,dispatch:N.dispatch}),u=(W)=>J2(W,async(N)=>{let{accountId:H,...A}=W,S;try{S=await X.authorizeAccount(A,H)}catch(y){let I=p2(y);if(I)throw z?.warn("refused an Anthropic request: its account state was moved or could not be recorded",{error:I.cause instanceof Error?I.cause.name:""}),I;throw y}return N(),U2(A,S)}),U2=(W,N)=>{if(!N)throw i(W);if(N.dispatch?.kind==="websocket-relay")throw new E2;let H=N.dispatch?.kind==="http-relay"?"http-relay":"direct",A=N.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":N.dispatch.token}:void 0;if(N.route==="oauth"){if(!N.accessToken)throw i(W);x1(N.accessToken,w2);let I=Object.freeze({route:"oauth",provenance:N.provenance,dispatch:H});g(I,{sessionID:W.sessionID,oauth:{accessToken:N.accessToken,...N.identity?{identity:N.identity}:{}},dispatch:N.dispatch,oauthHeaders:N.headers});let s=J$(N.headers);for(let p of u2)delete s[p];return delete s["anthropic-beta"],{headers:A??{...s,"x-api-key":null,authorization:`Bearer ${N.accessToken}`},attempt:I}}let S={authorization:null,"x-api-key":null,...J$(N.headers)};if(!S.authorization&&!S["x-api-key"])throw i(W);let y=Object.freeze({route:"api",provenance:N.provenance,dispatch:H});return g(y,{sessionID:W.sessionID,...N.baseURL?{baseURL:N.baseURL}:{},dispatch:N.dispatch,apiHeaders:S}),{headers:A??S,attempt:y}},T2=(W)=>J2(W,(N)=>t(W,N)),t=async(W,N)=>{let{request:H,attempt:A}=W,S=A.data,y=S?T.get(S):void 0;if(S)T.delete(S);if(!S||!y||S.route==="oauth"&&!y.oauth)throw i(W);let I=new Headers(H.headers);A1(I);let s=q$(I),p=H.body===null?void 0:await H.text();N();let Y2=p!==void 0&&r1(H.url),Q2=I$(H.url,y.baseURL!==void 0?{baseURL:y.baseURL}:{}).url?.toString()??H.url;try{if(S.route==="oauth"&&y.oauth){k$(Q2);let{accessToken:X2,identity:e}=y.oauth;for(let[j2,o]of Object.entries(J$(y.oauthHeaders))){if(u2.has(j2))continue;if(o===null)I.delete(j2);else I.set(j2,o)}let G2=null;if(p!==void 0&&Y2){let j2={...m(A,S),modelID:(()=>{let K2=I2(p);return E$(A2(K2)&&typeof K2.model==="string"?K2.model:W.modelID)})(),route:"oauth",correlation:s},o=await X.requestOptions?.(j2)??{};if(N(),A.agent!=="cachekeep")p=await f$(p,{...o,...e?{identity:e}:{},sessionId:W.sessionID,onToolNameMap:(K2)=>U.set(S,K2)});let M2=I2(p);G2=A2(M2)?M2:null}y$(I,X2,{body:G2,...e?{identity:e}:{},requestClass:b$(A.agent)?"auxiliary":"main"})}else{if(p!==void 0&&Y2)p=$X(p);I.delete("authorization"),I.delete("x-api-key");for(let[e,G2]of Object.entries(y.apiHeaders??{}))if(G2===null)I.delete(e);else I.set(e,G2);if(p!==void 0&&Y2&&!I.has("content-type"))I.set("content-type","application/json");let X2=I.get("anthropic-beta");if(X2!==null){let e=e1(X2);if(e)I.set("anthropic-beta",e);else I.delete("anthropic-beta")}}}catch(X2){let e=s1(X2);if(!e)throw X2;throw K.set(S,e.check),z?.warn("refused an Anthropic request locally; nothing was sent",{check:e.check}),e}let B2=p!==void 0?I2(p):void 0;if(await X.admitRequest?.({...m(A,S),modelID:E$(A2(B2)&&typeof B2.model==="string"?B2.model:W.modelID)}),q$(I),p!==void 0)I.delete("content-length");if(N(),D(S,y,A2(B2)&&B2.stream===!0?"event-stream":"http",I),S.route==="oauth"&&Y2&&p!==void 0)await X.onRequestPrepared?.({...m(A,S),url:Q2,bodyText:p}),N();if(y.dispatch?.kind==="http-relay"){let X2=p??"";I.delete("x-relay-token");let e={protocol:1,type:"request",affinity:W.sessionID,upstream:{url:Q2,method:H.method,headers:Object.fromEntries(I)},mode:"full_sync",revision:1,body:X2,next_hash:`sha256:${S1("sha256").update(X2).digest("hex")}`};if(Y2&&p!==void 0&&!Q(A)){let G2=s[x2]==="1"?"start":void 0,j2=JSON.stringify(e);a.set(S,{affinity:W.sessionID,route:W.accountId,bodyText:X2,url:Q2,method:H.method,headers:new Headers(I),dispatch:"http-relay",relayUrl:y.dispatch.url,envelope:e,relayBytes:j2.length,...G2?{tag:G2}:{}})}else R(S);return new Request(y.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":y.dispatch.token},redirect:"error",signal:H.signal,body:JSON.stringify(e)})}let P2=p;if(S.route==="oauth"&&Y2&&p!==void 0){let X2=await b1({url:Q2,body:p,latch:L});if(N(),X2.gzip)P2=await w1(p),I.set("content-encoding","gzip"),C.add(S),N()}if(Y2&&p!==void 0&&!Q(A)){let X2=s[x2]==="1"?"start":void 0;a.set(S,{affinity:W.sessionID,route:W.accountId,bodyText:p,url:Q2,method:H.method,headers:new Headers(I),dispatch:"direct",...X2?{tag:X2}:{}})}else R(S);return new Request(Q2,{method:H.method,headers:I,redirect:S.route==="oauth"?"error":H.redirect,signal:H.signal,...P2!==void 0?{body:P2}:{}})};return{adapter:{providerID:w2,chooseAccount:(W)=>J2(W,async()=>{let N=await X.chooseAccount(W);if(typeof N==="object"&&W.phase==="retry")return N;if(typeof N!=="string"||!N)throw i(W);return N}),dropChoice:(W)=>X.dropChoice?.(W),accountHeaders:u,rewriteRequest:T2,rewriteHandshakeURL(){throw new E2},async rewriteResponse({response:W,attempt:N}){let H=N.data;if(H&&!h(W.headers,H)){if(H)R(H);if(W.status===401)return E(H),W.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return n(H,W)}if(H&&C.has(H))C.delete(H),k1(W).then((o)=>{if(!o)return;L.latchProcess(),z?.warn("gzipped request body rejected; later requests go uncompressed",{kind:o,status:W.status})},()=>{});let A=null,S=H?a.get(H):void 0;if(H&&S){let o=!1;try{o=await B()}catch{o=!1}if(!o)R(H);else{try{R$(!0)}catch{}try{if(S.dispatch==="http-relay")A=await O$({affinity:S.affinity,transport:"http",protocol:1,mode:"full_sync",status:W.status,bodyText:S.bodyText,payload:S.envelope??{},relayBytes:S.relayBytes??0,...S.tag?{tag:S.tag}:{}});else A=await C$({affinity:S.affinity,route:S.route,status:W.status,bodyText:S.bodyText,url:S.url,method:S.method,headers:S.headers,...S.tag?{tag:S.tag}:{}})}catch{A=null}if(R(H),A){H2.set(H,A);try{await l2(A,{status:W.status,message:null,complete:!1})}catch{}J.set(H,Promise.resolve())}}}let y=n(H,W);if(H?.route!=="oauth"||!y.body)return f(H,y);let I={...m(N,H),status:W.status},s=X.responseOptions?.(I)??{},p=(W.headers.get("content-type")??"").includes("application/json"),Y2={...s,toolNameMap:H?U.get(H):void 0,onToolNameRefusal:()=>{if(!H)return;K.set(H,"response_tool_names"),E(H)},laneStartOAuthServed:!0,...p?{responseMode:"json"}:{}};if(!H||!A)return f(H,Y$(y,Y2));let Q2=A,B2=W.status,P2=(o)=>{let K2=(J.get(H)??Promise.resolve()).then(()=>o().then(()=>{return})).catch(()=>{return});J.set(H,K2)},X2=s.onMessageStart,e=s.onMessageDelta,G2=s.onMessageResponse,j2=s.onStreamEnd;return f(H,Y$(y,{...Y2,onMessageStart:(o)=>{try{X2?.(o)}catch{}try{r.set(H,{...o}),P2(()=>l2(Q2,{status:B2,message:o,complete:!1}))}catch{}},onMessageDelta:(o)=>{try{e?.(o)}catch{}try{let M2=r.get(H)??{},K2=M2.usage&&typeof M2.usage==="object"&&!Array.isArray(M2.usage)?M2.usage:{},g2={...M2,...o.usage?{usage:{...K2,...o.usage}}:{},...o.stopReason?{stop_reason:o.stopReason}:{}};P2(()=>l2(Q2,{status:B2,message:g2,complete:!0}))}catch{}},onMessageResponse:(o)=>{try{G2?.(o)}catch{}try{P2(()=>l2(Q2,{status:B2,message:o,complete:!0}))}catch{}},onStreamEnd:async()=>{try{await j2?.()}catch{}try{await(J.get(H)??Promise.resolve())}catch{}}}))},quotaFromHeaders(W,N,H){let A=H.data;if(!A||!h(W,A))return;return X.quotaFromHeaders?.(W,{...m(H,A),status:N})},async limitFromResponse({status:W,headers:N,body:H,attempt:A}){let S=A.data;if(!S||K.get(S)==="response_tool_names")return;if(!h(N,S))return X.limitFromRelayFailure?.({...m(A,S),status:W});if(G.set(S,`provider responded with HTTP ${W}`),!X.limitFromResponse)return;let y=k.get(N)===S,I=x(S);return X.limitFromResponse({...m(A,S),status:W,headers:N,body:async()=>y?await H():I.redactText(await H())})},inspectEvent({data:W,event:N,attempt:H}){if(H.data&&K.get(H.data)==="response_tool_names")return;let A=I2(W);if(!A2(A))return;let S=typeof A.type==="string"?A.type:N;if(S==="content_block_start"||S==="content_block_delta")return{outputStarted:!0};if(S==="message_stop")return{done:!0};if(S!=="error")return;let y=H.data,I=x(y),s=A2(A.error)?A.error:{},p=typeof s.type!=="string"?void 0:S$.has(s.type)?s.type:I.redactText(s.type),Y2=typeof s.message==="string"?I.redactText(s.message):void 0;if(y?.dispatch==="http-relay"&&Y.get(y)===!1)return;let Q2=y?X.limitFromStreamError?.({...m(H,y),errorType:p,message:Y2}):void 0,B2={error:[p??"error",Y2].filter(Boolean).join(": ").slice(0,n1),...Q2?{limit:Q2}:{}};if(y&&B2.error)G.set(y,B2.error);return B2},limitFromError(W,N){let H=N.data;if(!H||K.has(H))return;let A={type:S$.has(W.type)?W.type:"provider_error",message:G.get(H)??"provider request failed",...W.status!==void 0?{status:W.status}:{}};if(E(H),H.dispatch==="http-relay"&&Y.get(H)===!1)return;return X.limitFromHostError?.(A,m(N,H))},async onAttemptEnd(W,N){let H=W.data;if(!H)return;T.delete(H);let A=a.get(H);if(A){R(H);try{if(await B()){try{R$(!0)}catch{}try{if(A.dispatch==="http-relay"){if(N.status!==void 0)await O$({affinity:A.affinity,transport:"http",protocol:1,mode:"full_sync",status:N.status,bodyText:A.bodyText,payload:A.envelope??{},relayBytes:A.relayBytes??0,...A.tag?{tag:A.tag}:{}})}else await C$({affinity:A.affinity,route:A.route,status:N.status,error:N.status===void 0?p1:void 0,bodyText:A.bodyText,url:A.url,method:A.method,headers:A.headers,...A.tag?{tag:A.tag}:{}})}catch{}}}catch{}}let S=N.error?.reason;if(S==="cancelled"||S==="abandoned"||S===void 0&&(N.status===void 0||N.status<400))E(H);let y=K.get(H),{status:I,...s}=N,p=X.onAttemptEnd?.(m(W,H),{...s,...I!==void 0&&(H.dispatch!=="http-relay"||Y.get(H)===!0)?{status:I}:{},...y!==void 0?{localRefusal:{check:y}}:{}});if(await XX(p,F)==="timed-out")z?.warn("the account source did not finish recording a send",{timeoutMs:F})}},dispose(){$2=!0;for(let[W,N]of c){for(let H of N)H.revoked=!0;X.forgetSession?.(W)}c.clear(),T.clear(),a.clear();for(let W of[...M.keys()])E(W)},forgetSession(W){for(let N of c.get(W)??[])N.revoked=!0;c.delete(W);for(let[N,H]of T)if(H.sessionID===W)T.delete(N);for(let[N,H]of[...M])if(H.sessionID===W)E(N);for(let[N,H]of[...a])if(H.affinity===W)a.delete(N);X.forgetSession?.(W)},get pendingSendCount(){return T.size},get heldCredentialCount(){let W=0;for(let N of T.values())if(N.oauth)W++;return W},get heldRedactorCount(){return M.size},get operationsInProgress(){let W=0;for(let N of c.values())W+=N.size;return W}}}import{CacheKeepManager as ZX,CacheKeepSessionRegistry as JX,getDefaultCacheKeepRegistryDirectory as YX,isCacheKeepActiveNow as l$,isCacheKeepHybridActive as j$,isCacheKeepSubagentsEnabled as V$,logger as Q$}from"@cortexkit/anthropic-auth-core";function f2($){return JSON.stringify([$.source,$.accountIdentity,$.credentialId,$.binding?.storageId,$.binding?.rowId,$.binding?.credentialEpoch])}var u$=Symbol.for("cortexkit.anthropic-auth.opencode2.cachekeep.v1");function d$(){let $=globalThis;return $[u$]??=new Map,$[u$]}function GX($,X){let z=new Map,V=new Map,F=new JX({directory:X.registryDirectory||process.env.OPENCODE_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR||YX("opencode"),now:X.now}),L=()=>{let G;for(let P of V.values())G=P;return G},C=X.setIntervalImpl??globalThis.setInterval,T=new ZX({loadStorage:async()=>{let G=L();return G?G.loadStorage():null},now:X.now,setIntervalImpl:(G,P)=>C(()=>{let x=T.tick();return M.ticking=x.catch(()=>{Q$.warn("cachekeep","tick failed")}),M.ticking},P),clearIntervalImpl:X.clearIntervalImpl,onTrackedSessionsChanged:(G)=>F.publish(V.size===0?[]:G),prepareHeaders(G,P,x){let E=L();if(!E)return;return z.set(x.id,{target:P,attempt:x,lease:E}),new Headers({"x-native-cachekeep-attempt":String(x.id)})},fetchImpl:async(G,P)=>{let x=new Request(G,P),E=Number(x.headers.get("x-native-cachekeep-attempt")),D=z.get(E);if(z.delete(E),!D||D.lease.stopped)throw Error("CacheKeep attempt is unavailable");let l=D.lease.send(D.target,x,D.attempt.signal),b=l.then(()=>{},()=>{});return D.lease.inflight.add(b),b.then(()=>D.lease.inflight.delete(b)),l},onComplete:({attempt:G})=>{z.delete(G.id)}}),K,Y=()=>{if(K!==void 0)clearTimeout(K);K=void 0},U=()=>{if(Y(),V.size>0)return;let G=T.dropExpiredTargets();if(G===void 0){let x=d$();if(x.get($)===M)x.delete($);return}let P=X.now?.()??Date.now();if(K=setTimeout(U,Math.max(0,G-P)),typeof K==="object"&&"unref"in K)K.unref()},M={manager:T,registry:F,prepared:z,leases:V,nextGeneration:0,retain(){T.stop(),z.clear(),U()},adopt(){if(Y(),T.dropExpiredTargets()===void 0)return;T.start(),F.publish(T.trackedSessions()).catch(()=>{Q$.warn("cachekeep","failed to publish tracked sessions")})}};return M}function p$($){let{runtime:X,source:z}=$,V=new AbortController,F=d$(),L=F.get($.storageId)??GX($.storageId,$);F.set($.storageId,L);let{manager:C,registry:T}=L,K=async(G,P,x)=>{let E=x?AbortSignal.any([V.signal,x]):V.signal;E.throwIfAborted();let D=JSON.parse(await P.text()),l={providerID:"anthropic",modelID:D.model,sessionID:`oc2-cachekeep:${G.id}`,agent:"cachekeep",kind:"generate"},b=D2({source:{...z,onRequestPrepared:void 0,responseOptions:void 0,async requestOptions(r){return{...await z.requestOptions?.(r),laneStart:!1,billingLineage:void 0,cacheDiagnosticsPreviousMessageId:void 0}},async authorizeAccount(r,J){let Q=await X.read();E.throwIfAborted();let B=Q.accounts.find((k)=>k.id===J);if(B?.type!=="oauth"||f2(B)!==G.oauthAccountIdentity||G.isSubagent&&!V$(Q.policyStorage)||!j$(Q.policyStorage)||!l$(Q.policyStorage,new Date($.now?.()??Date.now())))return;let R=await z.authorizeAccount(r,J);if(R?.provenance.kind==="local"&&f2({...B,binding:R.provenance.subject.binding,accountIdentity:R.provenance.subject.binding.identity})!==G.oauthAccountIdentity)return;if(R?.provenance.kind==="vault"&&R.provenance.credentialId!==B.credentialId)return;return R},async admitRequest(r){await z.admitRequest?.(r);let J=await X.read(),Q=J.accounts.find((B)=>B.id===r.accountId);if(E.throwIfAborted(),!Q||f2(Q)!==G.oauthAccountIdentity||G.isSubagent&&!V$(J.policyStorage)||!j$(J.policyStorage)||!l$(J.policyStorage,new Date($.now?.()??Date.now())))throw Error("CacheKeep policy changed before dispatch")}}}),n,$2,a=!1,H2=()=>b.forgetSession(l.sessionID);E.addEventListener("abort",H2,{once:!0});try{let r=(await X.read()).accounts.find((f)=>f2(f)===G.oauthAccountIdentity)?.id;if(!r)throw Error("CacheKeep account is unavailable");let J=await b.adapter.accountHeaders({...l,accountId:r});if(!("headers"in J)||typeof J.headers!=="object"||J.headers===null||typeof J.attempt!=="object"||J.attempt===null||J.attempt.route!=="oauth")throw Error("CacheKeep authorization refused");n={...l,accountId:r,attemptId:crypto.randomUUID(),transport:"http",data:J.attempt};let Q=await b.adapter.rewriteRequest?.({...l,accountId:r,attempt:n,request:new Request(G.url,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(D),signal:E})});if(!Q)throw Error("CacheKeep rewrite refused");E.throwIfAborted();let B=await($.fetch??fetch)(Q),R=await b.adapter.rewriteResponse?.({...l,accountId:r,attempt:n,request:Q,response:B});if(!R)throw Error("CacheKeep response rewrite refused");if($2=R.status,b.adapter.quotaFromHeaders?.(R.headers,R.status,n),!R.ok)await b.adapter.limitFromResponse?.({status:$2,headers:R.headers,body:()=>R.clone().text(),attempt:n});let k=await R.arrayBuffer();return a=!0,new Response(k,{status:$2,headers:R.headers})}catch{throw Error("Native CacheKeep was not completed")}finally{E.removeEventListener("abort",H2);try{if(n)await b.adapter.onAttemptEnd?.(n,{status:$2,outputStarted:!1,...a?{}:{error:{reason:"cancelled"}}})}finally{b.dispose(),z.forgetSession?.(l.sessionID)}}},Y={generation:L.nextGeneration++,stopped:!1,loadStorage:async()=>(await X.read()).policyStorage,send:K,inflight:new Set},U=L.leases.size===0;if(L.leases.set(Y.generation,Y),U)L.adopt();let M;return{async track(G){let P=(b)=>{Q$.debug("cachekeep","tracking skipped",{session:G.sessionID,reason:b})};if(Y.stopped)return P("lease-stopped");if(G.route!=="oauth")return P("not-oauth");if(G.agent==="cachekeep"||G.agent==="prime")return P("background-agent");if(G.kind!=="primary")return P("not-primary");let x=await X.read();if(Y.stopped)return P("lease-stopped");if(!j$(x.policyStorage))return P("hybrid-inactive");let E=!1;try{E=await $.isSubagent?.(G.sessionID)??!1}catch{return P("session-lookup-failed")}if(Y.stopped)return P("lease-stopped");if(E&&!V$(x.policyStorage))return P("subagents-disabled");let D=x.accounts.find((b)=>b.id===G.accountId);if(!D?.accountIdentity)return P("account-identity-missing");if(G.provenance.kind==="local"&&JSON.stringify(D.binding)!==JSON.stringify(G.provenance.subject.binding))return P("local-binding-changed");if(G.provenance.kind==="vault"&&D.credentialId!==G.provenance.credentialId)return P("vault-credential-changed");let l=C.track({sessionId:G.sessionID,url:G.url,headers:new Headers,bodyText:G.bodyText,storage:x.policyStorage,cacheMode:"hybrid",oauthAccountId:G.accountId,oauthAccountIdentity:f2(D),isSubagent:E});return await T.publish(C.trackedSessions()),l},registry:T,dispose(){if(M)return M;Y.stopped=!0,V.abort();for(let[P,x]of L.prepared)if(x.lease===Y)L.prepared.delete(P);let G=L.leases.delete(Y.generation)&&L.leases.size===0;if(G)L.retain();return M=(async()=>{try{if(G)await L.ticking;await Promise.all(Y.inflight)}finally{if(G&&L.leases.size===0)await T.dispose()}})(),M}}}async function c$($,X,z){let V=D2(X),F=[],L=async(G,P,x)=>{let E=await $.session.hook(G,P,x);return F.push(E),E},C=new AbortController,T;try{T=await Z$({session:{hook:L},event:$.event},V.adapter,{logger:X.log,gateOnPlaceholder:z})}catch(G){throw V.dispose(),await Promise.allSettled(F.map((P)=>P.dispose())),G}let K=(G)=>{V.forgetSession(G),T.forgetSession(G)},Y=$.event,U=Y?(async()=>{try{for await(let G of Y.subscribe({signal:C.signal}))if(G.type==="session.deleted")K(G.data.sessionID)}catch(G){if(!C.signal.aborted)X.log?.warn("stopped listening for session deletion",{error:G instanceof Error?G.name:"unknown"})}})():Promise.resolve(),M;return{installation:T,forgetSession:K,dispose(){if(M)return M;return V.dispose(),C.abort(),M=(async()=>{await T.dispose(),await U})(),M}}}import{effectiveRelayTransport as i$,getQuotaCheckIntervalMs as jX,logger as VX,nativeAccountCanServe as QX,oauthProfileIsFresh as WX,quotaSnapshotCheckedAt as BX}from"@cortexkit/anthropic-auth-core";function o$($,X){let z=new AbortController,V,F=!1,L=async()=>{let K=await $.read();if(z.signal.throwIfAborted(),K.policyStorage.relay?.enabled===!0&&i$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="websocket")return;let Y=K,U=jX(Y.policyStorage);for(let M of Y.accounts){if(z.signal.aborted)return;if(!QX(M)||M.type!=="oauth")continue;if(Y.policyStorage.quota?.enabled!==!1&&Date.now()-BX(M.quota)>=U)await $.fetchQuota(M.id,X,z.signal,void 0,"background").catch(()=>{});if(!WX(M.profile)&&!z.signal.aborted)await $.fetchProfile(M.id,X,z.signal).catch(()=>{})}},C=()=>{if(F||V)return V;return V=L().catch(()=>{if(!z.signal.aborted)VX.debug("opencode2","native background readings did not complete")}).finally(()=>{V=void 0}),V},T=$.vault.watch({intervalMs:60000,onRefresh:C,shouldRefresh:async()=>{let K=await $.read();return K.policyStorage.relay?.enabled!==!0||i$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="http"}});return T.ready.catch(()=>{}),{async dispose(){F=!0,T.close(),z.abort(),await V}}}import{authorize as CX,buildCacheKeepStatusSummary as OX,buildClaudeQuotaSummary as EX,buildPrimeAccountStatuses as RX,buildPrimeStatusSummary as SX,CLAUSTRUM_OPENCODE_ENROLLMENT_NAME as qX,effectiveRelayTransport as AX,exchange as xX,formatNativeAccountState as kX,formatOAuthAccountTier as bX,getCacheKeepWindow as wX,getHostClaustrumEnrollmentPaths as DX,isCacheKeepAlways as yX,isCacheKeepHybridActive as IX,isCacheKeepPersistentlyEnabled as fX,nativeAccountCanServe as vX,parseLogLevel as gX,resetClaustrumEnrollmentState as hX,setDumpEnabled as mX}from"@cortexkit/anthropic-auth-core";import{buildPrimeAccountStatuses as zX,effectiveRelayStatus as UX,formatNativeAccountState as KX,formatOAuthAccountTier as n$,getCacheKeepWindow as MX,getRoutingMode as HX,isCacheKeepAlways as _X,isCacheKeepHybridActive as NX,isPermanentRefreshError as LX,isPrimePersistentlyEnabled as FX,nativeAccountCanServe as a$,refreshBackoffActive as r$}from"@cortexkit/anthropic-auth-core";var s$=($)=>a$($)&&$.state!=="unsupported-access"?void 0:KX($)||void 0,PX=($)=>{if($.source!=="vault")return"off";if($.state==="needs_reauth")return"on-vault-reauth";return a$($)?"on-vault-served":"on-cold"},TX=($,X)=>typeof $==="number"&&$>X;function t$($,X){let{now:z}=X,V=$.policyStorage,F=$.accounts.filter((U)=>U.type==="oauth"),L=F.find((U)=>U.id==="main"),C=L?s$(L):void 0,T=L?.lastQuotaRefreshError?.nextRetryAt,K=L?.lastRefreshError,Y=MX(V);return{main:{quota:L?.quota??null,enabled:L?.enabled,tierLabel:n$(L?.profile),quotaBackedOff:TX(T,z),quotaBackoffUntil:T,refreshBackedOff:r$(K,L?.accountIdentity,z,void 0),refreshBackoffUntil:K?.nextRetryAt,stateLine:C,quotaDated:Boolean(C)},fallbacks:F.filter((U)=>U.id!=="main"&&(U.enabled||U.source==="vault")).map((U)=>{let M=s$(U),G=PX(U);return{id:U.id,label:U.label,quota:U.quota??null,enabled:U.enabled,tierLabel:n$(U.profile),needsReauth:LX(U.lastRefreshError)&&r$(U.lastRefreshError,U.accountIdentity,z,void 0),...G==="on-vault-reauth"?{vaultReauth:!0}:{},...G==="on-vault-served"?{vaultServed:!0}:{},...G!=="off"?{custodyState:G}:{},stateLine:M,quotaDated:Boolean(M)}}),...X.activeId!==void 0&&{activeId:X.activeId},route:HX(V),relay:UX(V.relay),fastMode:V.claudeFast?.enabled===!0,cacheKeep:{enabled:NX(V),..._X(V)?{window:"always"}:Y&&{window:`${Y.startHour}-${Y.endHour}`},trackedSessions:X.trackedSessions},prime:FX(V)?{enabled:!0,accounts:zX(V,{now:z})}:void 0,lastUpdated:z}}var W$=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{},e$=`For first-time model access, connect Anthropic with "${o2}".
-Run: opencode auth login anthropic --method ${i2}`,lX="No Claude accounts in the vault for this host yet. Add one with `ck auth login --provider anthropic`, then grant it to this host.",$1="The vault returned an account this plugin cannot use yet.";async function uX($){let X=new AbortController,z;try{return await Promise.race([$.vault.refresh(X.signal).then(()=>"complete",()=>"failed"),new Promise((V)=>{z=setTimeout(()=>{V("pending"),X.abort()},2000)})])}finally{clearTimeout(z)}}var X1=($)=>$.mode==="local"&&!$.accounts.some((X)=>X.id==="main"),dX=($)=>{let X=$.id==="main"?"main":"fallback",z=`${$.enabled?"enabled":"disabled"}, ${$.type}, ${$.source}${$.state?`, ${kX($)}`:""}`;if($.label)return`${$.label} [${X}]: ${z}
-  Route: ${$.id}`;return`${X==="main"?"Main account":`Fallback ${$.id}`}: ${z}`};function J1($){let{runtime:X,source:z}=$,V=new Map,F=!1,L=async(Y,U)=>{await X.updateSettings((M)=>({...M,[Y]:{...W$(M[Y]),...U}}))},C=()=>({ok:!0,text:"Native Claude settings updated."}),T=async(Y,U)=>{if(F)throw Error("Native menu is closed");switch(U.signal?.throwIfAborted(),Y.action){case"enable":case"disable":return await X.setEnabled(Y.values.id,Y.action==="enable"),C();case"remove":return await X.remove(Y.values.id),C();case"move-up":case"move-down":{let G=(await X.read()).accounts.map((l)=>l.id),P=G.indexOf(Y.values.id),x=P+(Y.action==="move-up"?-1:1);if(P<0||x<0||x>=G.length)return{ok:!1,text:"Account cannot move in that direction."};let E=G[P],D=G[x];if(E===void 0||D===void 0)return{ok:!1,text:"Account order changed."};return G[P]=D,G[x]=E,await X.reorder(G),C()}case"add-apikey":return await X.addApi(Y.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let M=new AbortController;V.get(Y.sessionId)?.active.abort();let G={active:M,auth:void 0};V.set(Y.sessionId,G);let P=await CX("max");if(F||M.signal.aborted||U.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return G.auth=P,{ok:!0,text:`Open ${P.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let M=V.get(Y.sessionId);if(!M?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let G=await xX(Y.values.code,M.auth.verifier,M.auth.redirectUri,M.auth.state);if(M.active.signal.throwIfAborted(),U.signal?.throwIfAborted(),F||G.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await X.loginOAuth({routeId:crypto.randomUUID(),credential:{access:G.access,refresh:G.refresh,expires:G.expires},label:Y.values.label}),M.active.signal.throwIfAborted(),U.signal?.throwIfAborted(),F)return{ok:!1,text:"Sign-in cancelled."};V.delete(Y.sessionId);let P="OAuth account stored in the native account pool.";return{ok:!0,text:X1(await X.read())?`${P}
+`)}}function Y$($,X){let z=new TextDecoder,W="",F=(C)=>{let T=O1(C);if(!T)return;try{$(T)}catch(K){X(K)}},L=()=>{for(;;){let C=/\r?\n\r?\n/.exec(W);if(!C)return;let T=W.slice(0,C.index);W=W.slice(C.index+C[0].length),F(T)}};return new TransformStream({transform(C,T){T.enqueue(C),W+=z.decode(C,{stream:!0}),L()},flush(){if(W+=z.decode(),L(),W.trim()!=="")F(W);W=""}})}var P$=512,T$=1200000,w2="x-common-auth-attempt",x2=($,X)=>JSON.stringify([$,X]),_2=($)=>({providerID:$.model.providerID,modelID:$.model.id,sessionID:$.sessionID,agent:$.agent,kind:$.kind});function E1($){let X=$.headers;return typeof X==="object"&&X!==null}function S1($,X){let z=$.getReader();return new ReadableStream({async pull(W){let F;try{F=await z.read()}catch(L){X({reason:"failed",message:L instanceof Error?L.message:String(L)}),W.error(L);return}if(F.done)X(),W.close();else W.enqueue(F.value)},async cancel(W){X({reason:"cancelled",...W===void 0?{}:{message:String(W)}}),await z.cancel(W)}})}function d2($,X){for(let[z,W]of Object.entries(X)){let F=z.toLowerCase();for(let L of Object.keys($))if(L.toLowerCase()===F)delete $[L];if(W!==null)$[z]=W}}function q1($,X){for(let[z,W]of Object.entries(X))if(W===null)$.delete(z);else $.set(z,W)}async function G$($,X,z={}){let{providerID:W}=X,F=z.gateOnPlaceholder,L=(Z)=>F===void 0||F.credential(Z)===C2(W),C=z.logger,T=Math.max(1,z.maxRecords??P$),K=[...z.hostCredentials??[C2(W)],...F?[C2(W)]:[]].filter((Z)=>Z!==""),Y=new Map,U=new WeakMap,M=new Map,G=0,P=new Set,R=new Map,S=new Map,D=(Z)=>{let j=S.get(Z);return j?.ownedSeen===!0&&j.foreignSeen},l=(Z,j)=>{R.set(Z,j);let N=S.get(Z)??{ownedSeen:!1,foreignSeen:!1};if(j)N.ownedSeen=!0;else N.foreignSeen=!0;S.set(Z,N)},v=(Z,j)=>{let N=F?.refuseMisplaced,x=N?[...j].filter(([,u])=>u.includes(C2(W))):[],O=L(j)&&(!N||x.length>0);if(N){if(x.length>0&&(x.length!==1||!O))throw l(Z.sessionID,!1),new b2({kind:"placement-refused",providerID:W,sessionID:Z.sessionID,requestKind:Z.kind,message:N(x[0]?.[0]??"")})}return l(Z.sessionID,O),O},n=!1,t=!1,a=new Map,M2=0,W2=!1,J=new Map,Q=(Z,j)=>{try{C?.warn(Z,j)}catch{}},B=(Z)=>Z instanceof Error?Z.message:String(Z),E=new Map,b=(Z,j)=>{let N=(E.get(Z)??Promise.resolve()).then(j),x=N.then(()=>{},()=>{});return E.set(Z,x),x.then(()=>{if(E.get(Z)===x)E.delete(Z)}),N},k=(Z,j)=>{let N=E.get(Z);return N?N.then(()=>k(Z,j)):j()},y=async(Z)=>{try{await X.dropChoice?.({...Z.input,accountId:Z.accountId})}catch(j){Q("opencode2 auth dropChoice threw; the request is unaffected",{sessionID:Z.input.sessionID,error:B(j)})}},m=(Z)=>{let j=M.get(Z);if(M.delete(Z),j?.next){let N=j.next;b(j.sessionID,()=>y(N))}},i=async(Z,j)=>{let N=a.get(Z);if(!N||N.size===0)return;await Promise.all([...N].map(async(x)=>{try{await x(j)}catch(O){Q("opencode2 auth listener threw; the request is unaffected",{event:Z,error:B(O)})}}))},$2=async(Z,j)=>{try{await X.onAttemptEnd?.(Z,j)}catch(N){Q("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:Z.attemptId,error:B(N)})}},g=(Z,j)=>{if(Z.ended||!Z.attempt)return;let N={...Z.status===void 0?{}:{status:Z.status},outputStarted:Z.outputStarted,...Z.limit?{limit:Z.limit.signal}:{},...j?{error:j}:{}};if(j)Z.endError=j;Z.ended=$2(Z.attempt,N)},d=(Z,j)=>g(Z,{reason:"abandoned",message:j}),p=(Z)=>[...Y.values()].filter((j)=>j.key===Z),J2=(Z)=>p(Z).at(-1),P2=(Z)=>{if(Y.delete(Z.id),M.get(Z.key)?.attemptId===Z.id||!p(Z.key).length)m(Z.key)},k2=(Z)=>{Y.set(Z.id,Z);while(Y.size>T){let j=Y.values().next().value;if(j===void 0)break;d(j,"dropped to keep the record bound"),P2(j)}},o=(Z)=>Z.accountId===void 0?void 0:{...Z.scope,accountId:Z.accountId},V=(Z,j)=>new b2({kind:"no-account",providerID:W,sessionID:Z.sessionID,requestKind:Z.kind,...j===void 0?{}:{message:j}}),H=(Z)=>{J.get(Z)?.clear(),J.delete(Z)},_=async(Z,j)=>{let N=()=>V(Z,`${W} ${Z.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(W2)throw N();let x=J.get(Z.sessionID);if(!x)x=new Set,J.set(Z.sessionID,x);let O={};x.add(O);let u=()=>{if(!x.has(O))throw N()};try{return await j(u)}finally{if(x.delete(O),x.size===0&&J.get(Z.sessionID)===x)J.delete(Z.sessionID)}},A=(Z,j)=>{for(let[N,x]of j)if(K.some((O)=>x.includes(O)))throw new b2({kind:"host-credential-on-wire",providerID:W,sessionID:Z.sessionID,requestKind:Z.kind,message:`${W} ${Z.kind} request still carries the host's placeholder credential in ${N}; the adapter's account headers must replace it`})},q=(Z)=>{for(let j of p(Z))if(j.ended||!j.attempt)P2(j);else if(j.transport==="ws"||j.judged)d(j,"a newer attempt of its session and kind began"),P2(j)},I=async(Z,j,N,x)=>{let O=x2(Z.sessionID,Z.kind),{input:u,accountId:w}=await k(Z.sessionID,async()=>{N();let Q2=M.get(O);M.delete(O);let N2=Q2?.accountId??J2(O)?.accountId;q(O);let L2=Q2?.next,z2=L2!==void 0&&L2.input.modelID===Z.modelID&&L2.input.agent===Z.agent,v2={...Z,phase:"request",...N2===void 0?{}:{previousAccountId:N2},...Q2?.rerouteFrom?{rerouteFrom:Q2.rerouteFrom}:{}};if(L2&&!z2)await b(Z.sessionID,()=>y(L2)),N();let T2=z2?L2.accountId:await X.chooseAccount(v2);return{input:v2,accountId:typeof T2==="string"?T2:void 0}});N();let h={},Z2;if(w!==void 0){let Q2=await X.accountHeaders({...Z,accountId:w});if(N(),E1(Q2))h=Q2.headers,Z2=Q2.attempt;else h=Q2}let S2=`attempt-${++M2}`,H2={id:S2,key:O,scope:Z,accountId:w,headers:h,attempt:w===void 0?void 0:{...Z,accountId:w,attemptId:S2,transport:x,data:Z2},...x===void 0?{}:{transport:x},outputStarted:!1};if(k2(H2),H2.attempt)i("select",{...Z,accountId:H2.attempt.accountId,hook:j,...u.previousAccountId===void 0?{}:{previousAccountId:u.previousAccountId},...u.rerouteFrom===void 0?{}:{rerouteFrom:u.rerouteFrom},handle:H2.attempt});return H2},f=async(Z,j,N,x,O)=>{let u=x2(Z.sessionID,Z.kind),w=x===void 0?void 0:Y.get(x);if(w?.key!==u)w=void 0;if(!w){if(w=J2(u),p(u).filter((Z2)=>Z2.transport===void 0&&!Z2.ended).length>1&&!t)t=!0,Q("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:Z.sessionID,kind:Z.kind})}if(!w||w.transport!==void 0||w.ended)w=await I(Z,j,O,N);else if(w.transport=N,w.attempt)w.attempt.transport=N;if(N==="ws"){for(let h of p(u))if(h!==w&&h.transport==="ws")d(h,"a newer attempt of its session and kind went out over WebSocket")}return w},s=async(Z,j)=>{try{return await j()}catch(N){throw g(Z,{reason:"failed",message:B(N)}),N}},c=(Z,j)=>{let N=p(x2(Z,j)).filter((x)=>x.transport==="ws").at(-1);return N?.attempt!==void 0&&!N.ended?N:void 0},Y2=(Z,j,N)=>{let x=o(Z);if(!x||!Z.attempt||Z.limit)return;Z.limit={signal:j,delivered:i("limit",{...x,via:N,limit:j,outputStarted:Z.outputStarted,handle:Z.attempt})}},V2=(Z,j,N,x)=>{let O=o(Z);if(!O||!Z.attempt)return;i("quota",{...O,transport:j,...x===void 0?{}:{status:x},quota:N,handle:Z.attempt})},B2=(Z,j,N,x)=>{let O=Z.attempt;if(!O)return;let u=X.inspectEvent?.(x===void 0?{transport:j,data:N,attempt:O}:{transport:j,data:N,event:x,attempt:O});if(!u)return;if(u.quota!==void 0)V2(Z,j,u.quota);if(u.outputStarted)Z.outputStarted=!0;if(u.limit)Y2(Z,u.limit,j);if(u.error!==void 0)g(Z,{reason:"failed",message:u.error});else if(u.done)g(Z)},F2=(Z,j)=>{let N=Z.attempt;if(!N||j.accountId===Z.accountId)return;if(N.reboundFrom??=N.accountId,N.accountId=j.accountId,"data"in j)N.data=j.data;Z.accountId=j.accountId},X2=(Z)=>!Z.attempt||Z.endError!==void 0||Z.status!==void 0&&Z.status>=400,e=(Z)=>{let j=[...Y.values()].filter((h)=>h.scope.sessionID===Z),N=j.filter((h)=>h.limit&&!h.rerouted).at(-1);if(N)return N;let x=j.filter((h)=>h.scope.kind==="primary"),O=x.length>0?x:j;if(O.length<=1)return O[0];let u=O.filter((h)=>!h.judged&&X2(h)).at(-1);if(u)return u;let w=O.filter((h)=>h.attempt&&!h.ended);if(w.length>1)return"ambiguous";return w[0]??O.at(-1)},G2={providerID:W},j2=[];j2.push(await $.session.hook("model.request",(Z)=>{if(F)return;return _(_2(Z),async(j)=>{let N=await I(_2(Z),"model.request",j);if(j(),N.accountId===void 0)throw V(N.scope);d2(Z.headers,{...N.headers,[w2]:N.id})})},G2)),j2.push(await $.session.hook("http.request",(Z)=>{if(F){if(!v(_2(Z),Z.request.headers))return}return _(_2(Z),async(j)=>{let N=Z.request.headers.get(w2)??void 0,x=F?await I(_2(Z),"http.request",j,"http"):await f(_2(Z),"http.request","http",N,j);j();let O=o(x),u=x.attempt;if(!O||!u)throw V(x.scope);await s(x,async()=>{let w=Z.request;if(X.rewriteRequest){if(N!==void 0){let S2=new Headers(w.headers);S2.delete(w2),w=new Request(w,{headers:S2})}w=await X.rewriteRequest({...O,request:w,attempt:u})??w,j()}let h=new Headers(w.headers);h.delete(w2),q1(h,x.headers),A(x.scope,h.entries());let Z2=new Request(w,{headers:h});U.set(Z2,x),Z.request=Z2})})},G2)),j2.push(await $.session.hook("http.response",async(Z)=>{let j=U.get(Z.request);if(!j){if(F)return;if(!n)n=!0,Q("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:Z.sessionID,kind:Z.kind});return}let N=Z.response;if(X.answeredBy&&j.attempt){let h=j.attempt,Z2=await s(j,async()=>X.answeredBy?.({request:Z.request,response:N,attempt:h}));if(Z2)F2(j,Z2)}let x=o(j),O=j.attempt;if(!x||!O)return;j.status=N.status;let u=X.quotaFromHeaders?.(N.headers,N.status,O);if(u!==void 0)V2(j,"http",u,N.status);if(!N.ok&&X.limitFromResponse){let h=await X.limitFromResponse({status:N.status,headers:N.headers,body:()=>N.clone().text(),attempt:O});if(h)Y2(j,h,"http")}if(!N.ok||!N.body)g(j);let w=N;if(N.body&&(X.inspectEvent||X.onAttemptEnd)){let h=N.body;if(X.inspectEvent)h=h.pipeThrough(Y$((Z2)=>B2(j,"http",Z2.data,Z2.event),(Z2)=>Q("opencode2 auth event inspection threw",{error:B(Z2)})));w=new Response(S1(h,(Z2)=>g(j,Z2)),{status:N.status,statusText:N.statusText,headers:N.headers})}if(X.rewriteResponse)w=await X.rewriteResponse({...x,request:Z.request,response:w,attempt:O})??w;if(w!==N)Z.response=w},G2)),j2.push(await $.session.hook("experimental.ws.handshake",(Z)=>{if(F){let j=x2(Z.sessionID,Z.kind);if(P.delete(j),!v(_2(Z),new Headers(Z.headers)))return}return _(_2(Z),async(j)=>{let N;for(let w of Object.keys(Z.headers)){if(w.toLowerCase()!==w2)continue;N??=Z.headers[w],delete Z.headers[w]}let x=F?await I(_2(Z),"experimental.ws.handshake",j,"ws"):await f(_2(Z),"experimental.ws.handshake","ws",N,j);j();let O=o(x),u=x.attempt;if(!O||!u)throw V(x.scope);await s(x,async()=>{if(!F?.refuseMisplaced)d2(Z.headers,x.headers);let w=X.rewriteHandshakeURL?.({...O,url:Z.url,attempt:u});if(w!==void 0)Z.url=w;if(F?.refuseMisplaced)d2(Z.headers,x.headers);if(A(x.scope,Object.entries(Z.headers)),F)P.add(x.key)})})},G2));let r=X.rewriteWebSocketFrame?.bind(X);if(r)j2.push(await $.session.hook("experimental.ws.send",async(Z)=>{let j=_2(Z);if(F&&!P.has(x2(j.sessionID,j.kind)))return;let N=c(j.sessionID,j.kind),x=await r({...j,attempt:N?.attempt,frame:Z.frame});if(x!==void 0)Z.frame=x},G2));j2.push(await $.session.hook("experimental.ws.receive",(Z)=>{if(F&&!P.has(x2(Z.sessionID,Z.kind)))return;let j=c(Z.sessionID,Z.kind);if(!j)return;try{B2(j,"ws",Z.frame)}catch(N){Q("opencode2 auth frame inspection threw",{error:B(N)})}},G2)),j2.push(await $.session.hook("retry",async(Z)=>{if(F&&R.get(Z.sessionID)!==!0)return;let j=Z.decision,N=()=>i("retry",{sessionID:Z.sessionID,attempt:Z.attempt,reason:"host-decides",hostDecision:j,decision:j});if(D(Z.sessionID)){await N();return}let x=e(Z.sessionID);if(!x)return;if(x==="ambiguous"){await i("retry",{sessionID:Z.sessionID,attempt:Z.attempt,reason:"host-decides",hostDecision:j,decision:j});return}let O=x;await _(O.scope,async(u)=>{let w=u;if(D(Z.sessionID)){await N();return}O.judged=!0;let h=O.attempt;if(h&&!O.outputStarted){if(!O.limit){let H2=X.limitFromError?.(Z.error,h);if(H2)Y2(O,H2,"error")}if(O.ended)await O.ended;if(O.limit)await O.limit.delivered}w();let{decision:Z2,reason:S2}=await b(O.scope.sessionID,async()=>{if(w(),D(Z.sessionID))return{decision:j,reason:"host-decides"};let H2=M.get(O.key);if(M.delete(O.key),H2?.next)await y(H2.next);if(w(),D(Z.sessionID))return{decision:j,reason:"host-decides"};let Q2=j,N2,L2,z2;if(O.accountId===void 0||!h)Q2={retry:!1},N2="no-account";else if(O.outputStarted)Q2={retry:!1},N2="output-started";else if(O.limit){let v2={accountId:O.accountId,limit:O.limit.signal},T2,$$={...O.scope,phase:"retry",previousAccountId:O.accountId,rerouteFrom:v2};try{T2=await X.chooseAccount($$)}catch(X$){Q("opencode2 auth chooseAccount threw while the retry hook looked for another account; the host decides the retry",{sessionID:O.scope.sessionID,error:B(X$)})}let q2=typeof T2==="object"?T2.hold:void 0,l2=typeof T2==="string"?T2:q2?O.accountId:void 0;if(l2!==void 0)z2={accountId:l2,input:$$};try{w()}catch(X$){if(z2)await y(z2);throw X$}if(D(Z.sessionID)){if(z2)await y(z2);return{decision:j,reason:"host-decides"}}if(q2&&Number.isFinite(q2.delayMs)&&q2.delayMs>=0)Q2={retry:!0,delay:Math.min(q2.delayMs,T$)},N2="hold";else if(!q2&&l2!==void 0&&l2!==O.accountId)O.rerouted=!0,L2=v2,Q2={retry:!0,delay:0},N2="reroute";else{if(q2&&z2)await y(z2),z2=void 0;N2="host-decides-last-account"}}else N2="host-decides";if(Z.decision=Q2,Q2.retry&&O.accountId!==void 0&&Y.has(O.id))M.set(O.key,{attemptId:O.id,sessionID:O.scope.sessionID,order:++G,accountId:O.accountId,...L2===void 0?{}:{rerouteFrom:L2},...z2===void 0?{}:{next:z2}});else if(z2)await y(z2);return{decision:Q2,reason:N2}});w(),await i("retry",{sessionID:Z.sessionID,...O.accountId===void 0?{}:{accountId:O.accountId},kind:O.scope.kind,attempt:Z.attempt,reason:S2,hostDecision:j,decision:Z2,...h===void 0?{}:{handle:h}})})},G2));let K2=(Z)=>{if(H(Z),R.delete(Z),!S.get(Z)?.foreignSeen)S.delete(Z);for(let j of P)if(JSON.parse(j)[0]===Z)P.delete(j);for(let j of[...Y.values()]){if(j.scope.sessionID!==Z)continue;d(j,"its session was forgotten"),Y.delete(j.id)}for(let[j,N]of M)if(N.sessionID===Z)m(j)},U2=new AbortController,m2=$.event;if(m2)(async()=>{try{for await(let Z of m2.subscribe({signal:U2.signal}))if(Z.type==="session.deleted")K2(Z.data.sessionID);else if(Z.type==="session.status"&&Z.data.status.type==="idle"){let j=Z.data.sessionID,N=++G;b(j,async()=>{for(let[x,O]of M)if(O.sessionID===j&&O.order<N){if(M.delete(x),O.next)await y(O.next)}})}}catch(Z){if(!U2.signal.aborted)Q("opencode2 auth stopped listening for session deletion",{error:B(Z)})}})();return{on(Z,j){let N=a.get(Z);if(!N)N=new Set,a.set(Z,N);let x=j;return N.add(x),()=>{N.delete(x)}},accountFor(Z,j){return J2(x2(Z,j))?.accountId},forgetSession:K2,get size(){return Y.size},async dispose(){if(W2)return;W2=!0;for(let Z of J.keys())H(Z);U2.abort();for(let Z of Y.values())d(Z,"the installation was disposed");Y.clear();for(let Z of M.keys())m(Z);P.clear(),R.clear(),S.clear(),a.clear(),await Promise.all(E.values()),await Promise.all(j2.map(async(Z)=>{try{await Z.dispose()}catch(j){Q("opencode2 auth hook did not dispose cleanly",{error:B(j)})}}))}}}import{createHash as x1}from"node:crypto";import{AnthropicOAuthOriginError as A1,applyCustomHeaders as R1,assertNotCustodyTombstone as k1,classifyGzipRejection as b1,createProviderErrorRedactor as C$,createProviderErrorResponseScope as O$,decideRequestGzip as w1,dumpDirectRequest as E$,dumpRelayRequest as S$,dumpResponseArtifact as u2,encodeGzipRequestBody as D1,getAccountStoragePath as y1,getRequestGzipLatch as I1,getRequestGzipLatchPath as v1,isDumpEnabled as f1,mergeAnthropicBetas as g1,remapModelId as q$,remapRequestBodyModel as h1,setDumpEnabled as x$,stateRefusalCause as m1,stateRefusalPublicMessage as l1,stripEmptyTrailingAssistantMessages as d1,TrailingAssistantHistoryError as u1}from"@cortexkit/anthropic-auth-core";var D2="anthropic",h$="x-common-auth-attempt",p1=["x-session-affinity","x-opencode-session","x-parent-session-id",k$,c2,R2,h$],p2=new Set(["authorization","x-api-key"]),c1="physical send before a response",i1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",o1=512,r1=5000,n1=500,A$=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class m$ extends Error{sessionID;requestKind;kind="no-account";providerID=D2;constructor($,X){super(i1);this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicNoAccountError"}}class Q$ extends Error{sessionID;requestKind;kind="session-forgotten";providerID=D2;constructor($,X){super("request refused: its session was closed while it was being prepared");this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicRevokedError"}}class O2 extends Error{kind="unsupported-transport";providerID=D2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class l$ extends Error{kind="local-invalid-request";status=400;check;constructor($){super($.message,{cause:$});this.name="NativeAnthropicLocalRefusal",this.check=$.check}}class d$ extends Error{kind="state-relocated";providerID=D2;constructor($){super(l1($)??$.message,{cause:$});this.name="NativeAnthropicStateRefusal"}}function i2($){let X=m1($);return X?new d$(X):void 0}var A2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($);function f2($){try{return JSON.parse($)}catch{return}}function j$($){let X={};for(let[z,W]of Object.entries($??{}))X[z.toLowerCase()]=W;return X}function R$($){let X={};for(let z of p1){let W=$.get(z);if(W!==null&&z!==h$)X[z]=W;$.delete(z)}return X}function s1($){try{return new URL($).pathname.endsWith("/messages")}catch{return!1}}function a1($){return $ instanceof u1||$ instanceof b$||$ instanceof A1?new l$($):void 0}function t1($,X){let z=[];if($.oauth)z.push($.oauth.accessToken);for(let[W,F]of Object.entries($.apiHeaders??{})){if(F===null||!p2.has(W))continue;z.push(F.replace(/^Bearer\s+/i,""))}for(let W of p2){let F=X.get(W);if(F!==null)z.push(F.replace(/^Bearer\s+/i,""))}if($.dispatch?.kind==="http-relay")z.push($.dispatch.token);return[...new Set(z.filter(Boolean))]}var e1=new Set(["oauth-2025-04-20","claude-code-20250219",y$]);function $X($){let X=$.split(",").map((z)=>z.trim()).filter((z)=>z&&!e1.has(z));return g1(null,X)}function XX($){let X=f2($);if(!A2(X))return $;let z=d1(X.messages),W=Object.hasOwn(X,"fallbacks"),{droppedMarkers:F}=I$(X,!1),L=W&&!Object.hasOwn(X,"fallbacks"),C=h1(X);return z>0||F>0||L||C?JSON.stringify(X):$}async function ZX($,X){if(!($ instanceof Promise))return"settled";let z;try{return await Promise.race([$.then(()=>"settled"),new Promise((W)=>{z=setTimeout(()=>W("timed-out"),X)})])}finally{if(z!==void 0)clearTimeout(z)}}function y2($){let{source:X,log:z}=$,W=Math.max(1,$.maxPendingSends??o1),F=$.attemptEndTimeoutMs??r1,L=$.requestGzipLatch??I1(v1(y1())),C=new WeakSet,T=new Map,K=new WeakMap,Y=new WeakMap,U=new WeakMap,M=new Map,G=new WeakMap,P=C$([]);P.dispose();let R=(V)=>(V&&M.get(V)?.redactor)??P,S=(V)=>{let H=M.get(V);if(!H)return;M.delete(V),H.redactor.dispose(),H.scope.dispose()},D=(V,H,_,A)=>{let q=t1(H,A),I=O$(q,_);l.set(V,_),M.set(V,{sessionID:H.sessionID,redactor:C$(q),scope:I}),I.settled.then(()=>S(V));while(M.size>W){let f=M.keys().next().value;if(f===void 0)break;S(f)}},l=new WeakMap,v=(V,H)=>{let _=V?l.get(V):void 0;if(!_||!H.ok)return P.redactResponse(H);let A=O$([],_),q=A.redactResponse(H);return A.dispose(),q},n=(V,H)=>{let _=V?M.get(V)?.scope:void 0;if(!_)return v(V,H);try{return _.redactResponse(H)}catch{return v(V,H)}},t=!1,a=new Map,M2=new WeakMap,W2=new WeakMap,J=new WeakMap,Q=(V)=>V.agent==="cachekeep"||V.agent==="prime",B=async()=>{try{if(X.isDumpEnabled)return await X.isDumpEnabled()}catch{return!1}try{return f1()}catch{return!1}},E=(V)=>{a.delete(V)},b=new WeakMap,k=(V,H)=>{if(V&&!H.ok)b.set(H.headers,V);return H},y=(V,H)=>{if(H.dispatch!=="http-relay")return!0;let _=/^req_[A-Za-z0-9_-]+$/.test(V.get("request-id")??"");return Y.set(H,_),_},m=(V)=>new m$(V.sessionID,V.kind),i=new Map,$2=async(V,H)=>{if(t)throw new Q$(V.sessionID,V.kind);let _={revoked:!1},A=i.get(V.sessionID);if(!A)A=new Set,i.set(V.sessionID,A);A.add(_);let q=()=>{if(t||_.revoked)throw new Q$(V.sessionID,V.kind)};try{let I=await H(q);return q(),I}finally{let I=i.get(V.sessionID);if(I?.delete(_)&&I.size===0)i.delete(V.sessionID)}},g=(V,H)=>{T.set(V,H);while(T.size>W){let _=T.keys().next().value;if(_===void 0)break;T.delete(_),z?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:W})}},d=(V,H)=>({providerID:V.providerID,modelID:V.modelID,sessionID:V.sessionID,agent:V.agent,kind:V.kind,accountId:V.accountId,attemptId:V.attemptId,transport:V.transport,route:H.route,provenance:H.provenance,dispatch:H.dispatch}),p=(V)=>$2(V,async(H)=>{let{accountId:_,...A}=V,q;try{q=await X.authorizeAccount(A,_)}catch(I){let f=i2(I);if(f)throw z?.warn("refused an Anthropic request: its account state was moved or could not be recorded",{error:f.cause instanceof Error?f.cause.name:""}),f;throw I}return H(),J2(A,q)}),J2=(V,H)=>{if(!H)throw m(V);if(H.dispatch?.kind==="websocket-relay")throw new O2;let _=H.dispatch?.kind==="http-relay"?"http-relay":"direct",A=H.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":H.dispatch.token}:void 0;if(H.route==="oauth"){if(!H.accessToken)throw m(V);k1(H.accessToken,D2);let f=Object.freeze({route:"oauth",provenance:H.provenance,dispatch:_});g(f,{sessionID:V.sessionID,oauth:{accessToken:H.accessToken,...H.identity?{identity:H.identity}:{}},dispatch:H.dispatch,oauthHeaders:H.headers});let s=j$(H.headers);for(let c of p2)delete s[c];return delete s["anthropic-beta"],{headers:A??{...s,"x-api-key":null,authorization:`Bearer ${H.accessToken}`},attempt:f}}let q={authorization:null,"x-api-key":null,...j$(H.headers)};if(!q.authorization&&!q["x-api-key"])throw m(V);let I=Object.freeze({route:"api",provenance:H.provenance,dispatch:_});return g(I,{sessionID:V.sessionID,...H.baseURL?{baseURL:H.baseURL}:{},dispatch:H.dispatch,apiHeaders:q}),{headers:A??q,attempt:I}},P2=(V)=>$2(V,(H)=>k2(V,H)),k2=async(V,H)=>{let{request:_,attempt:A}=V,q=A.data,I=q?T.get(q):void 0;if(q)T.delete(q);if(!q||!I||q.route==="oauth"&&!I.oauth)throw m(V);let f=new Headers(_.headers);R1(f);let s=R$(f),c=_.body===null?void 0:await _.text();H();let Y2=c!==void 0&&s1(_.url),V2=f$(_.url,I.baseURL!==void 0?{baseURL:I.baseURL}:{}).url?.toString()??_.url;try{if(q.route==="oauth"&&I.oauth){w$(V2);let{accessToken:X2,identity:e}=I.oauth;for(let[j2,r]of Object.entries(j$(I.oauthHeaders))){if(p2.has(j2))continue;if(r===null)f.delete(j2);else f.set(j2,r)}let G2=null;if(c!==void 0&&Y2){let j2={...d(A,q),modelID:(()=>{let U2=f2(c);return q$(A2(U2)&&typeof U2.model==="string"?U2.model:V.modelID)})(),route:"oauth",correlation:s},r=await X.requestOptions?.(j2)??{};if(H(),A.agent!=="cachekeep")c=await g$(c,{...r,...e?{identity:e}:{},sessionId:V.sessionID,onToolNameMap:(U2)=>U.set(q,U2)});let K2=f2(c);G2=A2(K2)?K2:null}v$(f,X2,{body:G2,...e?{identity:e}:{},requestClass:D$(A.agent)?"auxiliary":"main"})}else{if(c!==void 0&&Y2)c=XX(c);f.delete("authorization"),f.delete("x-api-key");for(let[e,G2]of Object.entries(I.apiHeaders??{}))if(G2===null)f.delete(e);else f.set(e,G2);if(c!==void 0&&Y2&&!f.has("content-type"))f.set("content-type","application/json");let X2=f.get("anthropic-beta");if(X2!==null){let e=$X(X2);if(e)f.set("anthropic-beta",e);else f.delete("anthropic-beta")}}}catch(X2){let e=a1(X2);if(!e)throw X2;throw K.set(q,e.check),z?.warn("refused an Anthropic request locally; nothing was sent",{check:e.check}),e}let B2=c!==void 0?f2(c):void 0;if(await X.admitRequest?.({...d(A,q),modelID:q$(A2(B2)&&typeof B2.model==="string"?B2.model:V.modelID)}),R$(f),c!==void 0)f.delete("content-length");if(H(),D(q,I,A2(B2)&&B2.stream===!0?"event-stream":"http",f),q.route==="oauth"&&Y2&&c!==void 0)await X.onRequestPrepared?.({...d(A,q),url:V2,bodyText:c}),H();if(I.dispatch?.kind==="http-relay"){let X2=c??"";f.delete("x-relay-token");let e={protocol:1,type:"request",affinity:V.sessionID,upstream:{url:V2,method:_.method,headers:Object.fromEntries(f)},mode:"full_sync",revision:1,body:X2,next_hash:`sha256:${x1("sha256").update(X2).digest("hex")}`};if(Y2&&c!==void 0&&!Q(A)){let G2=s[R2]==="1"?"start":void 0,j2=JSON.stringify(e);a.set(q,{affinity:V.sessionID,route:V.accountId,bodyText:X2,url:V2,method:_.method,headers:new Headers(f),dispatch:"http-relay",relayUrl:I.dispatch.url,envelope:e,relayBytes:j2.length,...G2?{tag:G2}:{}})}else E(q);return new Request(I.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":I.dispatch.token},redirect:"error",signal:_.signal,body:JSON.stringify(e)})}let F2=c;if(q.route==="oauth"&&Y2&&c!==void 0){let X2=await w1({url:V2,body:c,latch:L});if(H(),X2.gzip)F2=await D1(c),f.set("content-encoding","gzip"),C.add(q),H()}if(Y2&&c!==void 0&&!Q(A)){let X2=s[R2]==="1"?"start":void 0;a.set(q,{affinity:V.sessionID,route:V.accountId,bodyText:c,url:V2,method:_.method,headers:new Headers(f),dispatch:"direct",...X2?{tag:X2}:{}})}else E(q);return new Request(V2,{method:_.method,headers:f,redirect:q.route==="oauth"?"error":_.redirect,signal:_.signal,...F2!==void 0?{body:F2}:{}})};return{adapter:{providerID:D2,chooseAccount:(V)=>$2(V,async()=>{let H=await X.chooseAccount(V);if(typeof H==="object"&&V.phase==="retry")return H;if(typeof H!=="string"||!H)throw m(V);return H}),dropChoice:(V)=>X.dropChoice?.(V),accountHeaders:p,rewriteRequest:P2,rewriteHandshakeURL(){throw new O2},async rewriteResponse({response:V,attempt:H}){let _=H.data;if(_&&!y(V.headers,_)){if(_)E(_);if(V.status===401)return S(_),V.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return n(_,V)}if(_&&C.has(_))C.delete(_),b1(V).then((r)=>{if(!r)return;L.latchProcess(),z?.warn("gzipped request body rejected; later requests go uncompressed",{kind:r,status:V.status})},()=>{});let A=null,q=_?a.get(_):void 0;if(_&&q){let r=!1;try{r=await B()}catch{r=!1}if(!r)E(_);else{try{x$(!0)}catch{}try{if(q.dispatch==="http-relay")A=await S$({affinity:q.affinity,transport:"http",protocol:1,mode:"full_sync",status:V.status,bodyText:q.bodyText,payload:q.envelope??{},relayBytes:q.relayBytes??0,...q.tag?{tag:q.tag}:{}});else A=await E$({affinity:q.affinity,route:q.route,status:V.status,bodyText:q.bodyText,url:q.url,method:q.method,headers:q.headers,...q.tag?{tag:q.tag}:{}})}catch{A=null}if(E(_),A){M2.set(_,A);try{await u2(A,{status:V.status,message:null,complete:!1})}catch{}J.set(_,Promise.resolve())}}}let I=n(_,V);if(_?.route!=="oauth"||!I.body)return k(_,I);let f={...d(H,_),status:V.status},s=X.responseOptions?.(f)??{},c=(V.headers.get("content-type")??"").includes("application/json"),Y2={...s,toolNameMap:_?U.get(_):void 0,onToolNameRefusal:()=>{if(!_)return;K.set(_,"response_tool_names"),S(_)},laneStartOAuthServed:!0,...c?{responseMode:"json"}:{}};if(!_||!A)return k(_,V$(I,Y2));let V2=A,B2=V.status,F2=(r)=>{let U2=(J.get(_)??Promise.resolve()).then(()=>r().then(()=>{return})).catch(()=>{return});J.set(_,U2)},X2=s.onMessageStart,e=s.onMessageDelta,G2=s.onMessageResponse,j2=s.onStreamEnd;return k(_,V$(I,{...Y2,onMessageStart:(r)=>{try{X2?.(r)}catch{}try{W2.set(_,{...r}),F2(()=>u2(V2,{status:B2,message:r,complete:!1}))}catch{}},onMessageDelta:(r)=>{try{e?.(r)}catch{}try{let K2=W2.get(_)??{},U2=K2.usage&&typeof K2.usage==="object"&&!Array.isArray(K2.usage)?K2.usage:{},m2={...K2,...r.usage?{usage:{...U2,...r.usage}}:{},...r.stopReason?{stop_reason:r.stopReason}:{}};F2(()=>u2(V2,{status:B2,message:m2,complete:!0}))}catch{}},onMessageResponse:(r)=>{try{G2?.(r)}catch{}try{F2(()=>u2(V2,{status:B2,message:r,complete:!0}))}catch{}},onStreamEnd:async()=>{try{await j2?.()}catch{}try{await(J.get(_)??Promise.resolve())}catch{}}}))},quotaFromHeaders(V,H,_){let A=_.data;if(!A||!y(V,A))return;return X.quotaFromHeaders?.(V,{...d(_,A),status:H})},async limitFromResponse({status:V,headers:H,body:_,attempt:A}){let q=A.data;if(!q||K.get(q)==="response_tool_names")return;if(!y(H,q))return X.limitFromRelayFailure?.({...d(A,q),status:V});if(G.set(q,`provider responded with HTTP ${V}`),!X.limitFromResponse)return;let I=b.get(H)===q,f=R(q);return X.limitFromResponse({...d(A,q),status:V,headers:H,body:async()=>I?await _():f.redactText(await _())})},inspectEvent({data:V,event:H,attempt:_}){if(_.data&&K.get(_.data)==="response_tool_names")return;let A=f2(V);if(!A2(A))return;let q=typeof A.type==="string"?A.type:H;if(q==="content_block_start"||q==="content_block_delta")return{outputStarted:!0};if(q==="message_stop")return{done:!0};if(q!=="error")return;let I=_.data,f=R(I),s=A2(A.error)?A.error:{},c=typeof s.type!=="string"?void 0:A$.has(s.type)?s.type:f.redactText(s.type),Y2=typeof s.message==="string"?f.redactText(s.message):void 0;if(I?.dispatch==="http-relay"&&Y.get(I)===!1)return;let V2=I?X.limitFromStreamError?.({...d(_,I),errorType:c,message:Y2}):void 0,B2={error:[c??"error",Y2].filter(Boolean).join(": ").slice(0,n1),...V2?{limit:V2}:{}};if(I&&B2.error)G.set(I,B2.error);return B2},limitFromError(V,H){let _=H.data;if(!_||K.has(_))return;let A={type:A$.has(V.type)?V.type:"provider_error",message:G.get(_)??"provider request failed",...V.status!==void 0?{status:V.status}:{}};if(S(_),_.dispatch==="http-relay"&&Y.get(_)===!1)return;return X.limitFromHostError?.(A,d(H,_))},async onAttemptEnd(V,H){let _=V.data;if(!_)return;T.delete(_);let A=a.get(_);if(A){E(_);try{if(await B()){try{x$(!0)}catch{}try{if(A.dispatch==="http-relay"){if(H.status!==void 0)await S$({affinity:A.affinity,transport:"http",protocol:1,mode:"full_sync",status:H.status,bodyText:A.bodyText,payload:A.envelope??{},relayBytes:A.relayBytes??0,...A.tag?{tag:A.tag}:{}})}else await E$({affinity:A.affinity,route:A.route,status:H.status,error:H.status===void 0?c1:void 0,bodyText:A.bodyText,url:A.url,method:A.method,headers:A.headers,...A.tag?{tag:A.tag}:{}})}catch{}}}catch{}}let q=H.error?.reason;if(q==="cancelled"||q==="abandoned"||q===void 0&&(H.status===void 0||H.status<400))S(_);let I=K.get(_),{status:f,...s}=H,c=X.onAttemptEnd?.(d(V,_),{...s,...f!==void 0&&(_.dispatch!=="http-relay"||Y.get(_)===!0)?{status:f}:{},...I!==void 0?{localRefusal:{check:I}}:{}});if(await ZX(c,F)==="timed-out")z?.warn("the account source did not finish recording a send",{timeoutMs:F})}},dispose(){t=!0;for(let[V,H]of i){for(let _ of H)_.revoked=!0;X.forgetSession?.(V)}i.clear(),T.clear(),a.clear();for(let V of[...M.keys()])S(V)},forgetSession(V){for(let H of i.get(V)??[])H.revoked=!0;i.delete(V);for(let[H,_]of T)if(_.sessionID===V)T.delete(H);for(let[H,_]of[...M])if(_.sessionID===V)S(H);for(let[H,_]of[...a])if(_.affinity===V)a.delete(H);X.forgetSession?.(V)},get pendingSendCount(){return T.size},get heldCredentialCount(){let V=0;for(let H of T.values())if(H.oauth)V++;return V},get heldRedactorCount(){return M.size},get operationsInProgress(){let V=0;for(let H of i.values())V+=H.size;return V}}}import{CacheKeepManager as JX,CacheKeepSessionRegistry as YX,getDefaultCacheKeepRegistryDirectory as GX,isCacheKeepActiveNow as u$,isCacheKeepHybridActive as W$,isCacheKeepSubagentsEnabled as B$,logger as z$,NativeAccountRefusal as E2,nativeAccountRefusal as jX}from"@cortexkit/anthropic-auth-core";function g2($){return JSON.stringify([$.source,$.accountIdentity,$.credentialId,$.binding?.storageId,$.binding?.rowId,$.binding?.credentialEpoch])}var p$=Symbol.for("cortexkit.anthropic-auth.opencode2.cachekeep.v1");function c$(){let $=globalThis;return $[p$]??=new Map,$[p$]}function VX($,X){let z=new Map,W=new Map,F=new YX({directory:X.registryDirectory||process.env.OPENCODE_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR||GX("opencode"),now:X.now}),L=()=>{let G;for(let P of W.values())G=P;return G},C=X.setIntervalImpl??globalThis.setInterval,T=new JX({loadStorage:async()=>{let G=L();return G?G.loadStorage():null},now:X.now,setIntervalImpl:(G,P)=>C(()=>{let R=T.tick();return M.ticking=R.catch(()=>{z$.warn("cachekeep","tick failed")}),M.ticking},P),clearIntervalImpl:X.clearIntervalImpl,onTrackedSessionsChanged:(G)=>F.publish(W.size===0?[]:G),prepareHeaders(G,P,R){let S=L();if(!S)return;return z.set(R.id,{target:P,attempt:R,lease:S}),new Headers({"x-native-cachekeep-attempt":String(R.id)})},fetchImpl:async(G,P)=>{let R=new Request(G,P),S=Number(R.headers.get("x-native-cachekeep-attempt")),D=z.get(S);if(z.delete(S),!D||D.lease.stopped)throw Error("CacheKeep attempt is unavailable");let l=D.lease.send(D.target,R,D.attempt.signal),v=l.then(()=>{},()=>{});return D.lease.inflight.add(v),v.then(()=>D.lease.inflight.delete(v)),l},onComplete:({attempt:G})=>{z.delete(G.id)}}),K,Y=()=>{if(K!==void 0)clearTimeout(K);K=void 0},U=()=>{if(Y(),W.size>0)return;let G=T.dropExpiredTargets();if(G===void 0){let R=c$();if(R.get($)===M)R.delete($);return}let P=X.now?.()??Date.now();if(K=setTimeout(U,Math.max(0,G-P)),typeof K==="object"&&"unref"in K)K.unref()},M={manager:T,registry:F,prepared:z,leases:W,nextGeneration:0,retain(){T.stop(),z.clear(),U()},adopt(){if(Y(),T.dropExpiredTargets()===void 0)return;T.start(),F.publish(T.trackedSessions()).catch(()=>{z$.warn("cachekeep","failed to publish tracked sessions")})}};return M}function i$($){let{runtime:X,source:z}=$,W=new AbortController,F=c$(),L=F.get($.storageId)??VX($.storageId,$);F.set($.storageId,L);let{manager:C,registry:T}=L,K=async(G,P,R)=>{let S=R?AbortSignal.any([W.signal,R]):W.signal;S.throwIfAborted();let D=JSON.parse(await P.text()),l={providerID:"anthropic",modelID:D.model,sessionID:`oc2-cachekeep:${G.id}`,agent:"cachekeep",kind:"generate"},v=(J)=>{throw new E2(J)},n=y2({source:{...z,onRequestPrepared:void 0,responseOptions:void 0,async requestOptions(J){return{...await z.requestOptions?.(J,v),laneStart:!1,billingLineage:void 0,cacheDiagnosticsPreviousMessageId:void 0}},async authorizeAccount(J,Q){let B=await X.read();S.throwIfAborted();let E=B.accounts.find((k)=>k.id===Q);if(E?.type!=="oauth")throw new E2("account-unavailable");if(g2(E)!==G.oauthAccountIdentity)throw new E2("credential-changed");if(G.isSubagent&&!B$(B.policyStorage)||!W$(B.policyStorage)||!u$(B.policyStorage,new Date($.now?.()??Date.now())))return;let b=await z.authorizeAccount(J,Q,v);if(b?.provenance.kind==="local"&&g2({...E,binding:b.provenance.subject.binding,accountIdentity:b.provenance.subject.binding.identity})!==G.oauthAccountIdentity)throw new E2("credential-changed");if(b?.provenance.kind==="vault"&&b.provenance.credentialId!==E.credentialId)throw new E2("credential-changed");return b},async admitRequest(J){await z.admitRequest?.(J,v);let Q=await X.read(),B=Q.accounts.find((E)=>E.id===J.accountId);if(S.throwIfAborted(),!B)throw new E2("account-unavailable");if(g2(B)!==G.oauthAccountIdentity)throw new E2("credential-changed");if(G.isSubagent&&!B$(Q.policyStorage)||!W$(Q.policyStorage)||!u$(Q.policyStorage,new Date($.now?.()??Date.now())))throw Error("CacheKeep policy changed before dispatch")}}}),t,a,M2=!1,W2=()=>n.forgetSession(l.sessionID);S.addEventListener("abort",W2,{once:!0});try{let J=await X.read(),Q=J.accounts.find((m)=>g2(m)===G.oauthAccountIdentity)?.id;if(!Q)throw new E2(J.accounts.some((m)=>m.id===G.oauthAccountId)?"credential-changed":"account-unavailable");let B=await n.adapter.accountHeaders({...l,accountId:Q});if(!("headers"in B)||typeof B.headers!=="object"||B.headers===null||typeof B.attempt!=="object"||B.attempt===null||B.attempt.route!=="oauth")throw Error("CacheKeep authorization refused");t={...l,accountId:Q,attemptId:crypto.randomUUID(),transport:"http",data:B.attempt};let E=await n.adapter.rewriteRequest?.({...l,accountId:Q,attempt:t,request:new Request(G.url,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(D),signal:S})});if(!E)throw Error("CacheKeep rewrite refused");S.throwIfAborted();let b=await($.fetch??fetch)(E),k=await n.adapter.rewriteResponse?.({...l,accountId:Q,attempt:t,request:E,response:b});if(!k)throw Error("CacheKeep response rewrite refused");if(a=k.status,n.adapter.quotaFromHeaders?.(k.headers,k.status,t),!k.ok)await n.adapter.limitFromResponse?.({status:a,headers:k.headers,body:()=>k.clone().text(),attempt:t});let y=await k.arrayBuffer();return M2=!0,new Response(y,{status:a,headers:k.headers})}catch(J){let Q=jX(J);if(Q)throw Q;throw Error("Native CacheKeep was not completed")}finally{S.removeEventListener("abort",W2);try{if(t)await n.adapter.onAttemptEnd?.(t,{status:a,outputStarted:!1,...M2?{}:{error:{reason:"cancelled"}}})}finally{n.dispose(),z.forgetSession?.(l.sessionID)}}},Y={generation:L.nextGeneration++,stopped:!1,loadStorage:async()=>(await X.read()).policyStorage,send:K,inflight:new Set},U=L.leases.size===0;if(L.leases.set(Y.generation,Y),U)L.adopt();let M;return{async track(G){let P=(v)=>{z$.debug("cachekeep","tracking skipped",{session:G.sessionID,reason:v})};if(Y.stopped)return P("lease-stopped");if(G.route!=="oauth")return P("not-oauth");if(G.agent==="cachekeep"||G.agent==="prime")return P("background-agent");if(G.kind!=="primary")return P("not-primary");let R=await X.read();if(Y.stopped)return P("lease-stopped");if(!W$(R.policyStorage))return P("hybrid-inactive");let S=!1;try{S=await $.isSubagent?.(G.sessionID)??!1}catch{return P("session-lookup-failed")}if(Y.stopped)return P("lease-stopped");if(S&&!B$(R.policyStorage))return P("subagents-disabled");let D=R.accounts.find((v)=>v.id===G.accountId);if(!D?.accountIdentity)return P("account-identity-missing");if(G.provenance.kind==="local"&&JSON.stringify(D.binding)!==JSON.stringify(G.provenance.subject.binding))return P("local-binding-changed");if(G.provenance.kind==="vault"&&D.credentialId!==G.provenance.credentialId)return P("vault-credential-changed");let l=C.track({sessionId:G.sessionID,url:G.url,headers:new Headers,bodyText:G.bodyText,storage:R.policyStorage,cacheMode:"hybrid",oauthAccountId:G.accountId,oauthAccountIdentity:g2(D),isSubagent:S});return await T.publish(C.trackedSessions()),l},registry:T,dispose(){if(M)return M;Y.stopped=!0,W.abort();for(let[P,R]of L.prepared)if(R.lease===Y)L.prepared.delete(P);let G=L.leases.delete(Y.generation)&&L.leases.size===0;if(G)L.retain();return M=(async()=>{try{if(G)await L.ticking;await Promise.all(Y.inflight)}finally{if(G&&L.leases.size===0)await T.dispose()}})(),M}}}async function o$($,X,z){let W=y2(X),F=[],L=async(G,P,R)=>{let S=await $.session.hook(G,P,R);return F.push(S),S},C=new AbortController,T;try{T=await G$({session:{hook:L},event:$.event},W.adapter,{logger:X.log,gateOnPlaceholder:z})}catch(G){throw W.dispose(),await Promise.allSettled(F.map((P)=>P.dispose())),G}let K=(G)=>{W.forgetSession(G),T.forgetSession(G)},Y=$.event,U=Y?(async()=>{try{for await(let G of Y.subscribe({signal:C.signal}))if(G.type==="session.deleted")K(G.data.sessionID)}catch(G){if(!C.signal.aborted)X.log?.warn("stopped listening for session deletion",{error:G instanceof Error?G.name:"unknown"})}})():Promise.resolve(),M;return{installation:T,forgetSession:K,dispose(){if(M)return M;return W.dispose(),C.abort(),M=(async()=>{await T.dispose(),await U})(),M}}}import{effectiveRelayTransport as r$,getQuotaCheckIntervalMs as QX,logger as WX,nativeAccountCanServe as BX,oauthProfileIsFresh as zX,quotaSnapshotCheckedAt as UX}from"@cortexkit/anthropic-auth-core";function n$($,X){let z=new AbortController,W,F=!1,L=async()=>{let K=await $.read();if(z.signal.throwIfAborted(),K.policyStorage.relay?.enabled===!0&&r$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="websocket")return;let Y=K,U=QX(Y.policyStorage);for(let M of Y.accounts){if(z.signal.aborted)return;if(!BX(M)||M.type!=="oauth")continue;if(Y.policyStorage.quota?.enabled!==!1&&Date.now()-UX(M.quota)>=U)await $.fetchQuota(M.id,X,z.signal,void 0,"background").catch(()=>{});if(!zX(M.profile)&&!z.signal.aborted)await $.fetchProfile(M.id,X,z.signal).catch(()=>{})}},C=()=>{if(F||W)return W;return W=L().catch(()=>{if(!z.signal.aborted)WX.debug("opencode2","native background readings did not complete")}).finally(()=>{W=void 0}),W},T=$.vault.watch({intervalMs:60000,onRefresh:C,shouldRefresh:async()=>{let K=await $.read();return K.policyStorage.relay?.enabled!==!0||r$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="http"}});return T.ready.catch(()=>{}),{async dispose(){F=!0,T.close(),z.abort(),await W}}}import{authorize as EX,buildCacheKeepStatusSummary as SX,buildClaudeQuotaSummary as qX,buildPrimeAccountStatuses as xX,buildPrimeStatusSummary as AX,CLAUSTRUM_OPENCODE_ENROLLMENT_NAME as RX,effectiveRelayTransport as kX,exchange as bX,formatNativeAccountState as wX,formatOAuthAccountTier as DX,getCacheKeepWindow as yX,getHostClaustrumEnrollmentPaths as IX,isCacheKeepAlways as vX,isCacheKeepHybridActive as fX,isCacheKeepPersistentlyEnabled as gX,nativeAccountCanServe as hX,parseLogLevel as mX,resetClaustrumEnrollmentState as lX,setDumpEnabled as dX}from"@cortexkit/anthropic-auth-core";import{buildPrimeAccountStatuses as KX,effectiveRelayStatus as MX,formatNativeAccountState as HX,formatOAuthAccountTier as s$,getCacheKeepWindow as _X,getRoutingMode as NX,isCacheKeepAlways as LX,isCacheKeepHybridActive as FX,isPermanentRefreshError as PX,isPrimePersistentlyEnabled as TX,nativeAccountCanServe as e$,refreshBackoffActive as a$}from"@cortexkit/anthropic-auth-core";var t$=($)=>e$($)&&$.state!=="unsupported-access"?void 0:HX($)||void 0,CX=($)=>{if($.source!=="vault")return"off";if($.state==="needs_reauth")return"on-vault-reauth";return e$($)?"on-vault-served":"on-cold"},OX=($,X)=>typeof $==="number"&&$>X;function $1($,X){let{now:z}=X,W=$.policyStorage,F=$.accounts.filter((U)=>U.type==="oauth"),L=F.find((U)=>U.id==="main"),C=L?t$(L):void 0,T=L?.lastQuotaRefreshError?.nextRetryAt,K=L?.lastRefreshError,Y=_X(W);return o2({main:{quota:L?.quota??null,enabled:L?.enabled,tierLabel:s$(L?.profile),quotaBackedOff:OX(T,z),quotaBackoffUntil:T,refreshBackedOff:a$(K,L?.accountIdentity,z,void 0),refreshBackoffUntil:K?.nextRetryAt,stateLine:C,quotaDated:Boolean(C)},fallbacks:F.filter((U)=>U.id!=="main"&&(U.enabled||U.source==="vault")).map((U)=>{let M=t$(U),G=CX(U);return{id:U.id,label:U.label,quota:U.quota??null,enabled:U.enabled,tierLabel:s$(U.profile),needsReauth:PX(U.lastRefreshError)&&a$(U.lastRefreshError,U.accountIdentity,z,void 0),...G==="on-vault-reauth"?{vaultReauth:!0}:{},...G==="on-vault-served"?{vaultServed:!0}:{},...G!=="off"?{custodyState:G}:{},stateLine:M,quotaDated:Boolean(M)}}),...X.activeId!==void 0&&{activeId:X.activeId},route:NX(W),relay:MX(W.relay),fastMode:W.claudeFast?.enabled===!0,cacheKeep:{enabled:FX(W),...LX(W)?{window:"always"}:Y&&{window:`${Y.startHour}-${Y.endHour}`},trackedSessions:X.trackedSessions},prime:TX(W)?{enabled:!0,accounts:KX(W,{now:z})}:void 0,lastUpdated:z})}var U$=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{},X1=`For first-time model access, connect Anthropic with "${s2}".
+Run: opencode auth login anthropic --method ${n2}`,uX="No Claude accounts in the vault for this host yet. Add one with `ck auth login --provider anthropic`, then grant it to this host.",Z1="The vault returned an account this plugin cannot use yet.";async function pX($){let X=new AbortController,z;try{return await Promise.race([$.vault.refresh(X.signal).then(()=>"complete",()=>"failed"),new Promise((W)=>{z=setTimeout(()=>{W("pending"),X.abort()},2000)})])}finally{clearTimeout(z)}}var J1=($)=>$.mode==="local"&&!$.accounts.some((X)=>X.id==="main"),cX=($)=>{let X=$.id==="main"?"main":"fallback",z=`${$.enabled?"enabled":"disabled"}, ${$.type}, ${$.source}${$.state?`, ${wX($)}`:""}`;if($.label)return`${$.label} [${X}]: ${z}
+  Route: ${$.id}`;return`${X==="main"?"Main account":`Fallback ${$.id}`}: ${z}`};function Y1($){let{runtime:X,source:z}=$,W=new Map,F=!1,L=async(Y,U)=>{await X.updateSettings((M)=>({...M,[Y]:{...U$(M[Y]),...U}}))},C=()=>({ok:!0,text:"Native Claude settings updated."}),T=async(Y,U)=>{if(F)throw Error("Native menu is closed");switch(U.signal?.throwIfAborted(),Y.action){case"enable":case"disable":return await X.setEnabled(Y.values.id,Y.action==="enable"),C();case"remove":return await X.remove(Y.values.id),C();case"move-up":case"move-down":{let G=(await X.read()).accounts.map((l)=>l.id),P=G.indexOf(Y.values.id),R=P+(Y.action==="move-up"?-1:1);if(P<0||R<0||R>=G.length)return{ok:!1,text:"Account cannot move in that direction."};let S=G[P],D=G[R];if(S===void 0||D===void 0)return{ok:!1,text:"Account order changed."};return G[P]=D,G[R]=S,await X.reorder(G),C()}case"add-apikey":return await X.addApi(Y.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let M=new AbortController;W.get(Y.sessionId)?.active.abort();let G={active:M,auth:void 0};W.set(Y.sessionId,G);let P=await EX("max");if(F||M.signal.aborted||U.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return G.auth=P,{ok:!0,text:`Open ${P.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let M=W.get(Y.sessionId);if(!M?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let G=await bX(Y.values.code,M.auth.verifier,M.auth.redirectUri,M.auth.state);if(M.active.signal.throwIfAborted(),U.signal?.throwIfAborted(),F||G.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await X.loginOAuth({routeId:crypto.randomUUID(),credential:{access:G.access,refresh:G.refresh,expires:G.expires},label:Y.values.label}),M.active.signal.throwIfAborted(),U.signal?.throwIfAborted(),F)return{ok:!1,text:"Sign-in cancelled."};W.delete(Y.sessionId);let P="OAuth account stored in the native account pool.";return{ok:!0,text:J1(await X.read())?`${P}
 
-${e$}
+${X1}
 
-Adding an account here does not change OpenCode's Anthropic connection.`:P}}case"reset-backoff":{let M=await X.read();for(let G of M.accounts){if(U.signal?.throwIfAborted(),G.type!=="oauth")continue;let P=G.source==="vault"?await X.authorizeVault(G.id,U.signal):await X.captureLocalSubject(G.id);await X.resetBackoff(G.id,P)}return C()}case"enrollment-reset":{let M=await hX(DX("opencode"),qX);return{ok:M==="reset",text:M==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":M==="refused-pending"?"An enrollment request may still be in progress. Quit OpenCode and run setup again; it picks up the same request.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let G=(await X.read()).accounts.filter((E)=>E.type==="oauth"&&vX(E)),P=await Promise.allSettled(G.map((E)=>X.fetchQuota(E.id,void 0,U.signal)));return{ok:P.every((E)=>E.status==="fulfilled"),text:`${P.filter((E)=>E.status==="fulfilled").length}/${G.length} native quota readings refreshed.`}}case"routing-reset":return await z.resetRouting(Y.sessionId),C();case"routing-mode":return await L("routing",{mode:Y.values.mode}),C();case"killswitch-on":case"killswitch-off":return await L("killswitch",{enabled:Y.action==="killswitch-on"}),C();case"killswitch-set":return await X.updateSettings((M)=>{let G=W$(M.killswitch),P={...W$(G.accounts)},x=G.main;for(let E of Y.values.entries){let D={five_hour:E.fh,seven_day:E.sd,...E.scoped!==void 0?{scoped:E.scoped}:{}};if(E.account==="main"||E.account==="all")x=D;if(E.account==="all")for(let l of Object.keys(P))P[l]=D;else if(E.account!=="main")P[E.account]=D}return{...M,killswitch:{...G,main:x,accounts:P}}}),C();case"cache-on":case"cache-off":return await L("claudeCache",{enabled:Y.action==="cache-on"}),C();case"cache-mode":return await L("claudeCache",{mode:Y.values.mode}),C();case"cachekeep-always":return await L("cacheKeep",{enabled:!0,always:!0}),C();case"cachekeep-off":return await L("cacheKeep",{enabled:!1}),C();case"cachekeep-window":return await L("cacheKeep",{enabled:!0,always:!1,startHour:Y.values.startHour,endHour:Y.values.endHour}),C();case"cachekeep-subagents":return await L("cacheKeep",{subagents:Y.values.enabled==="on"}),C();case"dump-on":case"dump-off":{let M=Y.action==="dump-on";await L("dump",{enabled:M});try{mX(M)}catch{}return C()}case"logging-level":{let M=gX(Y.values.level);if(!M)throw Error("Invalid log level");return await X.setLoggingLevel(M),C()}case"fast-on":case"fast-off":return await L("claudeFast",{enabled:Y.action==="fast-on"}),C();case"prime-on":case"prime-off":return await L("prime",{enabled:Y.action==="prime-on"}),C();case"start-fire":return await K(Y.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},K=(Y)=>$.start(Y,c2);return{dispatch:T,async readStatus(Y){let U=await X.read();if(Y==="account"){let G="No native Claude accounts.",P=[];if(U.mode==="claustrum"){let E=U.policyStorage.relay;if(E?.enabled===!0&&AX(E.transport,E.url)==="websocket")return new E2().message;let D=await uX(X);if(U=await X.read(),U.mode==="claustrum"){let l=await X.vault.read();if(D==="complete"&&!l?.view)D="failed";if(G=D==="complete"?lX:"No saved Claude accounts for this host yet.",l?.rejected?.length){if(G=$1,U.accounts.length)P.push($1)}if(D==="pending")P.push("Vault account lookup is still running.");else if(D==="failed")P.push("Vault account lookup did not complete; reopen /claude to retry.")}}let x=[U.accounts.map(dX).join(`
+Adding an account here does not change OpenCode's Anthropic connection.`:P}}case"reset-backoff":{let M=await X.read();for(let G of M.accounts){if(U.signal?.throwIfAborted(),G.type!=="oauth")continue;let P=G.source==="vault"?await X.authorizeVault(G.id,U.signal):await X.captureLocalSubject(G.id);await X.resetBackoff(G.id,P)}return C()}case"enrollment-reset":{let M=await lX(IX("opencode"),RX);return{ok:M==="reset",text:M==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":M==="refused-pending"?"An enrollment request may still be in progress. Quit OpenCode and run setup again; it picks up the same request.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let G=(await X.read()).accounts.filter((S)=>S.type==="oauth"&&hX(S)),P=await Promise.allSettled(G.map((S)=>X.fetchQuota(S.id,void 0,U.signal)));return{ok:P.every((S)=>S.status==="fulfilled"),text:`${P.filter((S)=>S.status==="fulfilled").length}/${G.length} native quota readings refreshed.`}}case"routing-reset":return await z.resetRouting(Y.sessionId),C();case"routing-mode":return await L("routing",{mode:Y.values.mode}),C();case"killswitch-on":case"killswitch-off":return await L("killswitch",{enabled:Y.action==="killswitch-on"}),C();case"killswitch-set":return await X.updateSettings((M)=>{let G=U$(M.killswitch),P={...U$(G.accounts)},R=G.main;for(let S of Y.values.entries){let D={five_hour:S.fh,seven_day:S.sd,...S.scoped!==void 0?{scoped:S.scoped}:{}};if(S.account==="main"||S.account==="all")R=D;if(S.account==="all")for(let l of Object.keys(P))P[l]=D;else if(S.account!=="main")P[S.account]=D}return{...M,killswitch:{...G,main:R,accounts:P}}}),C();case"cache-on":case"cache-off":return await L("claudeCache",{enabled:Y.action==="cache-on"}),C();case"cache-mode":return await L("claudeCache",{mode:Y.values.mode}),C();case"cachekeep-always":return await L("cacheKeep",{enabled:!0,always:!0}),C();case"cachekeep-off":return await L("cacheKeep",{enabled:!1}),C();case"cachekeep-window":return await L("cacheKeep",{enabled:!0,always:!1,startHour:Y.values.startHour,endHour:Y.values.endHour}),C();case"cachekeep-subagents":return await L("cacheKeep",{subagents:Y.values.enabled==="on"}),C();case"dump-on":case"dump-off":{let M=Y.action==="dump-on";await L("dump",{enabled:M});try{dX(M)}catch{}return C()}case"logging-level":{let M=mX(Y.values.level);if(!M)throw Error("Invalid log level");return await X.setLoggingLevel(M),C()}case"fast-on":case"fast-off":return await L("claudeFast",{enabled:Y.action==="fast-on"}),C();case"prime-on":case"prime-off":return await L("prime",{enabled:Y.action==="prime-on"}),C();case"start-fire":return await K(Y.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},K=(Y)=>$.start(Y,r2);return{dispatch:T,async readStatus(Y){let U=await X.read();if(Y==="account"){let G="No native Claude accounts.",P=[];if(U.mode==="claustrum"){let S=U.policyStorage.relay;if(S?.enabled===!0&&kX(S.transport,S.url)==="websocket")return new O2().message;let D=await pX(X);if(U=await X.read(),U.mode==="claustrum"){let l=await X.vault.read();if(D==="complete"&&!l?.view)D="failed";if(G=D==="complete"?uX:"No saved Claude accounts for this host yet.",l?.rejected?.length){if(G=Z1,U.accounts.length)P.push(Z1)}if(D==="pending")P.push("Vault account lookup is still running.");else if(D==="failed")P.push("Vault account lookup did not complete; reopen /claude to retry.")}}let R=[U.accounts.map(cX).join(`
 `)||G,...P].join(`
-`);return X1(U)?`${x}
+`);return J1(U)?`${R}
 
-${e$}
-Quota refresh checks the pool; it does not check OpenCode's Anthropic connection.`:x}if(Y==="quota")return EX({accounts:U.accounts.filter((G)=>G.type==="oauth").map((G)=>({name:G.label??G.id,role:G.id==="main"?"main":"fallback",enabled:G.enabled,quota:G.quota,tierLabel:bX(G.profile),lastRefreshedAt:G.lastRefreshedAt,error:G.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(Y==="prime")return SX({enabled:U.policyStorage.prime?.enabled===!0,accounts:RX(U.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");if(Y==="cachekeep"){let G=await $.cacheKeepRegistry?.list()??[];return OX({enabled:fX(U.policyStorage),always:yX(U.policyStorage),hybridActive:IX(U.policyStorage),trackedSessionDetails:G,window:wX(U.policyStorage),trackedSessions:G.length,nextPrewarmAt:G.length?Math.min(...G.map((P)=>P.nextPrewarmAt)):void 0})}let M={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(U.settings[M[Y]]??{})},async readSidebar(Y){let[U,M]=await Promise.all([X.read(),$.cacheKeepRegistry?.list()??[]]);return Z1(t$(U,{activeId:z.servedAccount(Y),trackedSessions:M.length,now:Date.now()}))},forgetSession(Y){V.get(Y)?.active.abort(),V.delete(Y)},close(){F=!0;for(let Y of V.values())Y.active.abort();V.clear()}}}import{resolveClaudeModelCapabilities as pX}from"@cortexkit/anthropic-auth-core";function Y1(){let $=new Map;return{install:(z)=>z.model.transform((V)=>{$.clear();for(let F of V.list("anthropic")){$.set(String(F.id),String(F.modelID));let L=pX(F.modelID)?.efforts.variants;if(!L)continue;V.update("anthropic",String(F.id),(C)=>{let T=C.variants.filter((K)=>!L.some((Y)=>Y===String(K.id)));C.variants=[...T,...L.map((K)=>({id:K,settings:{effort:K,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(z)=>$.get(z)??z}}function G1($){return $.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??$.get("x-api-key")??void 0}import{buildPrimeRequestBody as j1,effectiveRelayTransport as V1,nativeAccountCanServe as cX,PrimeManager as iX,tokenFingerprint as Q1}from"@cortexkit/anthropic-auth-core";var W1=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{};function B1($){let{runtime:X,source:z}=$,V=new AbortController,F=new Set,L=(K)=>({providerID:"anthropic",modelID:j1().model,sessionID:`oc2-prime:${K}`,agent:"prime",kind:"generate"}),C=async(K)=>{let Y=L(K),U=D2({source:z}),M=performance.now();try{for(let G=0;G<3;G++){if(V.signal.throwIfAborted(),(await X.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let x=await U.adapter.accountHeaders({...Y,accountId:K});if(!("headers"in x)||typeof x.headers!=="object"||x.headers===null||typeof x.attempt!=="object"||x.attempt===null)throw Error("Native Prime authorization refused");let E={...Y,accountId:K,attemptId:crypto.randomUUID(),transport:"http",data:x.attempt},D,l=!1,b=!1,n=($2)=>{b=!0,$2.body?.cancel().catch(()=>{})};try{let $2=await U.adapter.rewriteRequest?.({...Y,accountId:K,attempt:E,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(j1()),signal:V.signal})});if(!$2)throw Error("Native Prime rewrite refused");let a=new Headers($2.headers);for(let[f,h]of Object.entries(x.headers))if(h===null)a.delete(f);else a.set(f,h);let H2=new Request($2,{headers:a}),r=await($.fetch??fetch)(H2),J=await U.adapter.rewriteResponse?.({...Y,accountId:K,request:H2,response:r,attempt:E})??r;D=J.status,U.adapter.quotaFromHeaders?.(J.headers,J.status,E);let Q=J.ok?void 0:await U.adapter.limitFromResponse?.({status:J.status,headers:J.headers,body:()=>J.clone().text(),attempt:E});if(Q&&/^(vault-newer|local-newer|relay-direct):/.test(Q.reason)&&G<2){n(J);let f={...Y,phase:"retry",rerouteFrom:{accountId:K,limit:Q}};if(await z.chooseAccount(f)!==K)throw Error("Native Prime retry changed account");continue}if(!J.ok)return n(J),{ok:!1,status:D,ms:performance.now()-M,error:"Native Prime upstream refused the request"};let B=W1(await J.json()),R=W1(B.usage),k={inputTokens:typeof R.input_tokens==="number"?R.input_tokens:void 0,outputTokens:typeof R.output_tokens==="number"?R.output_tokens:void 0};if(E.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(J.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(l=await z.recordPrime(x.attempt.provenance,k),!l)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:D,ms:performance.now()-M,usage:k}}finally{await U.adapter.onAttemptEnd?.(E,{status:D,outputStarted:!1,...l?{}:{error:{reason:b?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-M}}finally{U.dispose()}},T=new iX({storagePath:$.paths.legacyConfig,loadStorage:async()=>(await X.read()).policyStorage,async getAccountFingerprint(K){let Y=await X.read(),U=Y.accounts.find((P)=>P.id===K);if(!cX(U)||U?.type!=="oauth")return;if(Y.policyStorage.relay?.enabled===!0&&V1(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")return;if(U.source==="vault"){let P=await X.authorizeVault(K,V.signal),x=await X.getOrCreateAuthLineage(K,P);return x?Q1(x):void 0}let M=await X.authorizeLocal(K,{signal:V.signal});if(M.status!=="usable")return;let G=await X.getOrCreateAuthLineage(K,M.subject);return G?Q1(G):void 0},async refreshQuota(K){let Y=await X.read();if(Y.policyStorage.relay?.enabled===!0&&V1(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await X.fetchQuota(K,$.fetch,V.signal),fresh:!0}},sendPrime(K){let Y=C(K);return F.add(Y),Y.finally(()=>F.delete(Y)),Y},async recordSuccess(K){let Y=(await X.read()).accounts.find((U)=>U.id===K);if(!Y?.prime)throw Error("Native Prime counters are unavailable");return Y.prime}});return T.start(),{manager:T,async dispose(){T.stop(),V.abort(),await Promise.allSettled(F)}}}import{createNativeUsagePublisher as oX,decideStickyQuotaFailure as nX,effectiveRelayTransport as rX,getClaudeCodeIdentityForVerifiedAccount as n2,getQuotaCheckIntervalMs as sX,getRoutingMode as K$,isDumpPersistentlyEnabled as z1,isQuotaBearingHeaderFrame as aX,logger as tX,mergeHeaderQuotaForPersistence as eX,NativeVaultNoAccountError as $Z,nativeAccountCanServe as B$,nativeAccountPolicy as r2,nativeLocalQuotaLineage as XZ,nativePollQuotaGenerallyExhausted as ZZ,normalizeQuotaHeaders as JZ,quotaSnapshotCheckedAt as U1,quotaSnapshotHasStandardWindows as YZ,readNativeAccountsForRequest as GZ,remapModelId as z$,StickySessionRouter as jZ,setDumpEnabled as VZ,shouldFallbackStatus as QZ,stickyQuotaSnapshotIsFresh as v2,stickyRetryAfterWithJitter as WZ,stickyRouteFamilyForModel as BZ}from"@cortexkit/anthropic-auth-core";var U$=($)=>["five_hour","seven_day"].some((X)=>($?.[X]?.remainingPercent??1)<=0);function zZ($,X,z,V){let F=$.rerouteFrom;if($.phase!=="retry"||F?.limit.status!==429||K$(X.policyStorage)!=="sticky-balanced")return;let L=z.find((T)=>T.id===F.accountId);if(!L||!v2(L.quota,X.policyStorage,Date.now(),V))return;let C=nX({quota:L.quota,modelId:V});if(C.action!=="hold")return;return{hold:{delayMs:WZ($.sessionID,C.retryAfterSeconds)*1000}}}function M1($){let{runtime:X}=$,z=oX("native-auth"),V=new Map,F=(J)=>{let Q=J.routingPath;if(!Q)throw Error("Native routing storage is unavailable");let B=V.get(Q);if(!B)B=new jZ({path:Q,vaultSeed:J.routingSeed,onLockEvent:X.onLockEvent,relocationGuard:X.relocationGuard,localRecoveryPath:J.mode==="local"?J.routingRecoveryPath:void 0}),V.set(Q,B);return B.setVaultSeed(J.routingSeed),B},L=new WeakMap,C=new Map,T=new Map,K=new Map,Y=new Map,U=new WeakSet,M=!1,G=()=>{while(C.size>512){let J=C.keys().next();if(!J.done)C.delete(J.value)}},P=(J)=>{try{VZ(z1(J.policyStorage))}catch{}},x=async()=>{try{let J=await X.read();return P(J),z1(J.policyStorage)}catch{return!1}},E=(J,Q)=>JSON.stringify([J.sessionID,J.kind,J.modelID,Q]),D=(J)=>{if(M)throw Error("Native Anthropic source is closed");let Q=K.get(J.sessionID);if(!Q){Q=new AbortController,K.set(J.sessionID,Q);while(K.size>512){let B=K.keys().next();if(!B.done)r.forgetSession?.(B.value)}}return Q},l=(J,Q,B)=>B$(J)&&(J.type==="api"||r2(J,Q,z$(B)).status==="allowed"),b=async(J,Q,B,R)=>{let k=await X.read();P(k),R.signal.throwIfAborted(),n(k);let f=k.accounts.find((h)=>h.id===J);if(!f||f.type!==B||!l(f,k,Q))return!1;if(B==="api"){let h=k.accounts.find((i)=>i.id==="main"&&i.type==="oauth");return!!h&&v2(h.quota,k.policyStorage)&&U$(h.quota)}return!0},n=(J)=>{let Q=J.policyStorage.relay;if(Q?.enabled===!0&&rX(Q.transport,Q.url)==="websocket")throw new E2},$2=async(J,Q)=>{if(n(J),Q||J.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let B=await X.getRelayConfig();if(!B)throw Error("request refused: native HTTP relay configuration is unavailable");if(B.transport!=="http")throw new E2;return{dispatch:{kind:"http-relay",url:B.url,token:B.token},relayFallback:B.fallbackToDirect}};async function a(J,Q,B){if(J.kind==="local"){let R=await X.publishLocal(J.subject,B);if(!R&&B.quota)tX.warn("quota","Quota publication discarded");return R}if(J.kind==="vault"&&Q.receipt)await X.vault.publish(Q.receipt,B);else if(J.kind==="api"&&B.lastUsed!==void 0)await X.publishApi(J.subject,{lastUsed:B.lastUsed});return!0}function H2(J,Q,B){if(J.kind!=="local")return;let R=J.subject.binding,k=U1(B),f={lineage:XZ(R),accountUuid:R.identity,entry:{quota:B,checkedAt:k,refreshAfter:k},generalExhausted:ZZ(B),routeBeforeSave:!0};return X.quotaObservations.hold(Q.account.id,f)?f:void 0}let r={async chooseAccount(J){let Q=D(J);$.onOwnedRequest?.();let B=await X.read();P(B),Q.signal.throwIfAborted(),n(B);let R=z$(await $.resolveModelId?.(J)??J.modelID);if(Q.signal.throwIfAborted(),B.mode==="claustrum")B=await GZ(X,Q.signal),Q.signal.throwIfAborted();if(B.policyStorage.quota?.enabled!==!1){let g=!1;for(let m of B.accounts){if(!B$(m)||m.type!=="oauth")continue;if(YZ(m.quota)?v2(m.quota,B.policyStorage,Date.now(),R):Date.now()-U1(m.quota)<sX(B.policyStorage))continue;try{await X.fetchQuota(m.id,$.fetch,Q.signal,void 0,"admission"),g=!0}catch{Q.signal.throwIfAborted()}}if(g)B=await X.read();Q.signal.throwIfAborted()}let k=J.rerouteFrom?C.get(J.rerouteFrom.limit.reason):void 0;if(J.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(J.rerouteFrom.limit.reason)&&!k)return;if(k&&J.rerouteFrom){let g=B.accounts.find((U2)=>U2.id===k.accountId);if(!g||!l(g,B,R))return;C.delete(J.rerouteFrom.limit.reason);let m=E(J,k.accountId),u=T.get(m)??[];return u.push(k),T.set(m,u),k.accountId}let f=[];for(let g of B.accounts){if(g.type!=="oauth"||!l(g,B,R))continue;if(g.source==="local"){let m=await X.authorizeLocal(g.id,{signal:Q.signal,policy:(u,U2)=>r2(u,U2,R)});if(Q.signal.throwIfAborted(),m.status!=="usable")continue}f.push(g)}let h=zZ(J,B,f,R);if(h)return h;let i=f.filter((g)=>g.id!==J.rerouteFrom?.accountId);if(K$(B.policyStorage)==="sticky-balanced"){let g=i.map((u,U2)=>({accountId:u.id,order:U2,quota:u.quota??{kind:"unknown"}})),m=await F(B).resolve({sessionId:J.sessionID,family:BZ(R),modelId:R,affinityModelId:J.modelID,candidates:g,retainAccountIds:new Set(i.map((u)=>u.id)),...B.mode==="claustrum"?{accountIdentities:new Map(B.accounts.flatMap((u)=>u.accountIdentity?[[u.id,u.accountIdentity]]:[]))}:{},storage:B.policyStorage,inputBytes:1,preferredAccountId:J.previousAccountId,preserveOnNoCandidate:!0});if(Q.signal.throwIfAborted(),m)return m.accountId}else{let m=K$(B.policyStorage)==="fallback-first"?[...i.filter((u)=>u.id!=="main"),...i.filter((u)=>u.id==="main")]:[...i.filter((u)=>u.id==="main"),...i.filter((u)=>u.id!=="main")];if(m[0])return m[0].id}if(B.mode==="claustrum")throw new $Z;let c=B.accounts.find((g)=>g.id==="main"&&g.type==="oauth");if(!c)return;let J2=c.quota;if(J.rerouteFrom?.limit.status===429||!v2(J2,B.policyStorage))try{J2=await X.fetchQuota("main",$.fetch,Q.signal)}catch{return}if(Q.signal.throwIfAborted(),!U$(J2))return;return B.accounts.find((g)=>g.type==="api"&&B$(g)&&g.id!==J.rerouteFrom?.accountId)?.id},dropChoice(J){let Q=E(J,J.accountId),B=T.get(Q);if(B?.shift(),B?.length===0)T.delete(Q)},async authorizeAccount(J,Q){let B=D(J),R=await X.read();P(R),B.signal.throwIfAborted(),n(R);let k=z$(await $.resolveModelId?.(J)??J.modelID);B.signal.throwIfAborted();let f=R.accounts.find((t)=>t.id===Q);if(!f||!l(f,R,k))return;let h=E(J,Q),i=T.get(h),c=i?.shift();if(i?.length===0)T.delete(h);let{dispatch:J2,relayFallback:g}=await $2(R,c?.direct===!0);if(B.signal.throwIfAborted(),c?.auth){if(!await b(Q,k,c.auth.route,B))return;let t=L.get(c.auth.provenance);if(t?.receipt?.expiresAtMs!==void 0&&t.receipt.expiresAtMs!==null&&t.receipt.expiresAtMs<Date.now()+300000)return;if(t)L.set(c.auth.provenance,{...t,scope:{...J,modelID:k},account:f,active:B,relayFallback:g});return Y.set(J.sessionID,Q),{...c.auth,dispatch:J2}}let m={scope:{...J,modelID:k},active:B,account:f,retry:c?.retry??!1,relayFallback:g,quota:f.quota};if(f.type==="api"){let t=R.accounts.find((H)=>H.id==="main"&&H.type==="oauth");if(!t||!v2(t.quota,R.policyStorage)||!U$(t.quota))return;let V2=await X.authorizeApi(Q,B.signal);if(B.signal.throwIfAborted(),!await b(Q,k,"api",B))return;let W={kind:"api",subject:V2.subject};return L.set(W,m),Y.set(J.sessionID,Q),{route:"api",headers:V2.authHeader==="authorization-bearer"?{authorization:`Bearer ${V2.apiKey}`}:{"x-api-key":V2.apiKey},baseURL:V2.baseURL,provenance:W,dispatch:J2}}if(f.source==="vault"){let t=await X.authorizeVault(Q,B.signal);if(B.signal.throwIfAborted(),!await b(Q,k,"oauth",B))return;let V2={kind:"vault",credentialId:t.credentialId,recordVersion:t.recordVersion};L.set(V2,{...m,receipt:t});let W=t.assertedAccountIdentity;if(!W)return;return Y.set(J.sessionID,Q),{route:"oauth",accessToken:t.accessToken,provenance:V2,dispatch:J2,identity:n2(W,W)}}let u=await X.authorizeLocal(Q,{signal:B.signal,policy:(t,V2)=>r2(t,V2,k)});if(B.signal.throwIfAborted(),u.status!=="usable")return;if(!await b(Q,k,"oauth",B))return;let U2={kind:"local",subject:u.subject};L.set(U2,{...m,access:u.access}),Y.set(J.sessionID,Q);let T2=u.subject.binding.identity;return{route:"oauth",accessToken:u.access,provenance:U2,dispatch:J2,identity:n2(T2,T2)}},async requestOptions(J){let Q=D(J),B=await X.read();P(B),Q.signal.throwIfAborted();let R=B.accounts.find((f)=>f.id===J.accountId);if(!R||!l(R,B,J.modelID))throw Error("request refused: native account is ineligible for this model");let k=L.get(J.provenance);if(k)L.set(J.provenance,{...k,scope:{...k.scope,modelID:J.modelID}});return $.requestOptions(J,B)},async admitRequest(J){let Q=L.get(J.provenance);if(!Q||!await b(J.accountId,J.modelID,J.route,Q.active))throw Error("request refused: native account policy changed before dispatch");L.set(J.provenance,{...Q,scope:{...Q.scope,modelID:J.modelID}})},isDumpEnabled:()=>x(),onRequestPrepared:(J)=>$.onRequestPrepared?.(J),responseOptions(J){return $.responseOptions?.({...J,modelID:L.get(J.provenance)?.scope.modelID??J.modelID})},quotaFromHeaders(J,Q){let B=L.get(Q.provenance),R=K1(J);if(R)$.onRequestId?.(Q,R);if(!B||Q.route!=="oauth"||!aX(J))return;let k=Q.provenance.kind==="local"?Q.provenance.subject.binding.identity:B.receipt?.assertedAccountIdentity,f={...JZ(J),...k?{accountIdentity:k}:{}},h=eX(B.quota,f);B.quota=h;let i=H2(Q.provenance,B,h),c=B.account.id,J2=()=>{if(i)X.quotaObservations.forget(c,i)};return z.observe(a(Q.provenance,B,{quota:h}).then((g)=>{if(!g)J2()},(g)=>{throw J2(),g})),f},async limitFromResponse(J){let Q=L.get(J.provenance);if(!Q)return;if(J.status===401&&Q.receipt){if(!U.has(Q.receipt))U.add(Q.receipt),await X.vault.reportFailure(Q.receipt,401,J.dispatch==="http-relay"?"relay_status_field":"direct");if(Q.retry||Q.active.signal.aborted)return;let R=Q.active,k=await X.vault.prepareRetry(Q.receipt,R.signal);if(R.signal.throwIfAborted(),!k.retry)return;let f=k.receipt,h=f.assertedAccountIdentity;if(!h)return;let i={kind:"vault",credentialId:f.credentialId,recordVersion:f.recordVersion};L.set(i,{...Q,receipt:f,retry:!0});let c=`vault-newer:${J.attemptId}`;return C.set(c,{sessionID:J.sessionID,accountId:J.accountId,retry:!0,auth:{route:"oauth",accessToken:f.accessToken,provenance:i,identity:n2(h,h)}}),G(),{reason:c,status:401}}if(J.status===401&&J.provenance.kind==="local"&&Q.access&&!Q.retry){if(Q.active.signal.aborted)return;let R=Q.active,k=await X.authorizeLocal(J.accountId,{rejectedAccessToken:Q.access,signal:R.signal,policy:(c,J2)=>r2(c,J2,Q.scope.modelID)});if(R.signal.throwIfAborted(),k.status!=="usable"||k.access===Q.access)return;let f={kind:"local",subject:k.subject};L.set(f,{...Q,access:k.access,retry:!0});let h=k.subject.binding.identity,i=`local-newer:${J.attemptId}`;return C.set(i,{sessionID:J.sessionID,accountId:J.accountId,retry:!0,auth:{route:"oauth",accessToken:k.access,provenance:f,identity:n2(h,h)}}),G(),{reason:i,status:401}}let B=await X.read();if(QZ(J.status,B.policyStorage))return{reason:`provider-${J.status}`,status:J.status};return},limitFromRelayFailure(J){let Q=L.get(J.provenance);if(!Q?.relayFallback||Q.active.signal.aborted||!(J.status===401||J.status>=500))return;let B=`relay-direct:${J.attemptId}`;return C.set(B,{sessionID:J.sessionID,accountId:J.accountId,direct:!0,retry:!1}),G(),{reason:B}},limitFromStreamError(J){return J.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(J,Q){let B=L.get(Q.provenance);if(Q.dispatch==="http-relay"&&B?.relayFallback&&!B.active.signal.aborted&&J.status===void 0){let R=`relay-direct:${Q.attemptId}`;return C.set(R,{sessionID:Q.sessionID,accountId:Q.accountId,direct:!0,retry:!1}),G(),{reason:R}}return},async onAttemptEnd(J,Q){let B=L.get(J.provenance);if(!B)return;try{if(Q.status===401&&B.receipt&&!U.has(B.receipt))U.add(B.receipt),await X.vault.reportFailure(B.receipt,401,J.dispatch==="http-relay"?"relay_status_field":"direct");if(!Q.localRefusal&&Q.status!==void 0)z.publish(()=>a(J.provenance,B,{lastUsed:Date.now()}))}finally{L.delete(J.provenance)}},forgetSession(J){K.get(J)?.abort(),K.delete(J),Y.delete(J);for(let[Q,B]of C)if(B.sessionID===J)C.delete(Q);for(let[Q,B]of T)if(B[0]?.sessionID===J)T.delete(Q);$.onForgetSession?.(J)},servedAccount:(J)=>Y.get(J),resetRouting:async(J)=>F(await X.read()).clear(J),async recordPrime(J,Q){let B=L.get(J);if(!B||B.active.signal.aborted)return!1;if(J.kind==="local")return X.incrementPrimeUsage(B.account.id,J.subject,Q);if(J.kind==="vault"&&B.receipt)return X.incrementPrimeUsage(B.account.id,B.receipt,Q);return!1},drainRoutingPublications:()=>Promise.all([X.drainRoutingPublications(),...[...V.values()].map((J)=>J.drain())]).then(()=>{}),close(){M=!0;for(let J of K.values())J.abort();return K.clear(),T.clear(),C.clear(),Promise.all([z.drain(),r.drainRoutingPublications()]).then(()=>{})}};return r}import{remapModelId as UZ}from"@cortexkit/anthropic-auth-core";function N1(){let $=new H1,X=new Map,z=new Map,V=new Map,F=new Set,L=new Set,C=new Map,T=(K)=>{while(K.size>512){let Y=K.keys().next();if(!Y.done)K.delete(Y.value)}};return{async install(K){let Y=[];try{Y.push(await K.session.hook("context",(U)=>{let M=U.messages.map((P)=>{return{info:{id:P.id,sessionID:U.sessionID,role:P.role,agent:U.agent,model:{providerID:U.model.providerID,modelID:U.model.id}},parts:P.content.map((x)=>({type:x.type,...x.type==="text"?{text:x.text}:{}}))}});$.observeMessages(M);let G=U.messages.findLast((P)=>P.role==="user"&&P.id);if(G?.id)X.set(U.sessionID,G.id);if(G?.content.some((P)=>P.type==="text"&&P.text===c2))F.add(U.sessionID);else F.delete(U.sessionID);T(X)},{providerID:"anthropic"})),Y.push(await K.session.hook("model.request",(U)=>{if(U.kind!=="primary")return;let M=X.get(U.sessionID);if(!M)return;if($.markHeaders({sessionId:U.sessionID,messageId:M,agent:U.agent,headers:U.headers}),F.has(U.sessionID))U.headers[x2]="1"},{providerID:"anthropic"}))}catch(U){throw await Promise.allSettled(Y.map((M)=>M.dispose())),U}return{dispose:async()=>{await Promise.all(Y.map((U)=>U.dispose()))}}},requestOptions(K,Y){let U=$.resolveHeader(K.correlation[d2]);if(U)z.set(K.attemptId,U),T(z);C.set(K.attemptId,K.sessionID),T(C);let M=K.correlation[x2]==="1";if(M)L.add(K.attemptId);return{cache1hEnabled:K.agent!=="compaction"&&K.agent!=="title"&&(Y.policyStorage.claudeCache?.enabled??!0),cache1hMode:Y.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:Y.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:Y.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,turnEndNoteEnabled:!0,turnEndNote:Y.policyStorage.turnEndNote,serverSideFallbackEnabled:_1(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:M,billingLineage:U?{promptId:U.promptId,previousRequestId:U.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:V.get(K.sessionID)}},responseOptions(K){return{serverSideFallbackModel:UZ(K.modelID),laneStart:L.has(K.attemptId),onMessageStart(Y){if(K.kind==="primary"&&typeof Y.id==="string")V.set(K.sessionID,Y.id),T(V)},onStreamEnd(){z.delete(K.attemptId),L.delete(K.attemptId),C.delete(K.attemptId)}}},onRequestId(K,Y){$.commit(z.get(K.attemptId),Y)},forgetSession(K){$.clearSession(K),X.delete(K),V.delete(K),F.delete(K);for(let[Y,U]of C)if(U===K)z.delete(Y),L.delete(Y),C.delete(Y)}}}var s2="cortexkit-anthropic-auth",kZ='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',bZ="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",wZ="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function DZ($){let X=$.authorize??HZ,z=$.exchange??FZ,V=()=>{if(!$.isActive())throw Error("Claude authentication setup is closed")},F=async()=>{let T;try{T=await $.readMode()}catch{throw Error(wZ)}return V(),T},L=async()=>{if(await F()!=="local")throw Error(kZ)};return{integrationID:"anthropic",methods:[{method:{id:i2,type:"oauth",label:o2},async authorize(){V(),await L();let T=await X("max");return V(),{mode:"code",url:T.url,instructions:"Paste the authorization code returned by Claude.",callback:async(K)=>{V();let Y=await z(K,T.verifier,T.redirectUri,T.state);if(!$.isActive()||Y.type!=="success")throw Error("Claude sign-in did not complete");return{access:Y.access,refresh:Y.refresh,expires:Y.expires}}}}}],vault:{method:{id:L1,type:"oauth",label:"Claude vault accounts"},async activate(){if(V(),await F()!=="claustrum")throw Error(bZ)}},async onLogin(T){V(),await L(),await $.runtime.loginOAuth({routeId:"main",credential:T,replace:!0}),V()},label:"Claude native account pool"}}function yZ($){return{readMode:()=>OZ("opencode",$),disconnectVault:()=>LZ({host:"opencode",env:$})}}function H$($={}){return{id:s2,setup:(X)=>P1(X,$)}}async function IZ($){try{return await vZ($)}catch(X){throw fZ(X)}}function fZ($){let X=p2($);if(X)return X;let z=AZ("decide where its account state is",[],$);return M$.error("state-layout",z.message,{code:z.code}),p2(z)??z}async function vZ($){if($.paths){let z=$.paths;return await MZ(z),{paths:z,holderRegistration:await EZ({paths:z,role:"opencode2",kind:CZ(),policy:xZ(),onLockEvent:$.local?.onLockEvent})}}let X=await NZ({role:"opencode2",onLockEvent:$.local?.onLockEvent});return{paths:await RZ(void 0,void 0,X.layout),holderRegistration:X.kind==="state-home"?void 0:X.registration}}async function P1($,X={}){let{paths:z,holderRegistration:V}=await IZ(X),F=KZ({paths:z,host:"opencode",local:X.local,vault:X.vault}),L=yZ(X.vault?.env??process.env);try{let b=await F.read();if(!process.env.OPENCODE_ANTHROPIC_AUTH_LOG_LEVEL)qZ(PZ(b.policyStorage)??"info");SZ(TZ(b.policyStorage))}catch{}let C=!0,T=N1(),K=Y1(),Y,U,M,G=M1({runtime:F,paths:z,fetch:X.fetch,requestOptions:T.requestOptions,responseOptions:T.responseOptions,onRequestId:T.onRequestId,onForgetSession:T.forgetSession,onRequestPrepared:async(b)=>{try{await M?.track(b)}catch{M$.warn("cachekeep","live request tracking failed")}},resolveModelId:async(b)=>K.modelId(b.modelID),onOwnedRequest:()=>{Y??=o$(F,X.fetch),U??=B1({runtime:F,paths:z,source:G,fetch:X.fetch})}});M=p$({...X.cacheKeep,runtime:F,source:G,storageId:z.storageId,fetch:X.fetch,isSubagent:async(b)=>Boolean((await $.session.get({sessionID:b})).parentID)});let P=J1({runtime:F,source:G,cacheKeepRegistry:M.registry,start:async(b,n)=>{await $.session.synthetic({sessionID:b,text:n,description:"Claude lane start",resume:!0})}}),x=[],E=await c$($,{source:G,log:{warn:(b,n)=>M$.warn("opencode2",b,n)}},{credential:G1}).catch(async(b)=>{throw V?.close(),P.close(),await M?.dispose(),await G.close(),await F.drainQuotaPublications(),await F.close(),b}),D,l=()=>{if(D)return D;return C=!1,V?.close(),P.close(),G.close(),D=(async()=>{await Promise.allSettled([E.dispose(),Y?.dispose(),U?.dispose(),M?.dispose(),...x.map((b)=>b.dispose())]),await G.close(),await F.drainQuotaPublications(),await F.close()})(),D};try{x.push(await T.install($)),x.push(await K.install($)),x.push(await $$($,DZ({isActive:()=>C,readMode:L.readMode,runtime:F})));let b={host:"opencode",dispatch:P.dispatch,readStatus:($2)=>P.readStatus($2),readAccounts:()=>F.read(),readMode:L.readMode,disconnectVault:L.disconnectVault,interactive:!0},n=_Z(b);return x.push(await F1($,n,P)),l}catch(b){throw await l(),b}}var Y4={id:s2,setup:H$().setup,server:T1};export{P1 as setupAnthropicAuth,Y4 as default,H$ as createAnthropicAuthPlugin,s2 as ANTHROPIC_AUTH_PLUGIN_ID};
+${X1}
+Quota refresh checks the pool; it does not check OpenCode's Anthropic connection.`:R}if(Y==="quota")return qX({accounts:U.accounts.filter((G)=>G.type==="oauth").map((G)=>({name:G.label??G.id,role:G.id==="main"?"main":"fallback",enabled:G.enabled,quota:G.quota,tierLabel:DX(G.profile),lastRefreshedAt:G.lastRefreshedAt,error:G.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(Y==="prime")return AX({enabled:U.policyStorage.prime?.enabled===!0,accounts:xX(U.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");if(Y==="cachekeep"){let G=await $.cacheKeepRegistry?.list()??[];return SX({enabled:gX(U.policyStorage),always:vX(U.policyStorage),hybridActive:fX(U.policyStorage),trackedSessionDetails:G,window:yX(U.policyStorage),trackedSessions:G.length,nextPrewarmAt:G.length?Math.min(...G.map((P)=>P.nextPrewarmAt)):void 0})}let M={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(U.settings[M[Y]]??{})},async readSidebar(Y){let[U,M]=await Promise.all([X.read(),$.cacheKeepRegistry?.list()??[]]);return o2($1(U,{activeId:z.servedAccount(Y),trackedSessions:M.length,now:Date.now()}))},forgetSession(Y){W.get(Y)?.active.abort(),W.delete(Y)},close(){F=!0;for(let Y of W.values())Y.active.abort();W.clear()}}}import{resolveClaudeModelCapabilities as iX}from"@cortexkit/anthropic-auth-core";function G1(){let $=new Map;return{install:(z)=>z.model.transform((W)=>{$.clear();for(let F of W.list("anthropic")){$.set(String(F.id),String(F.modelID));let L=iX(F.modelID)?.efforts.variants;if(!L)continue;W.update("anthropic",String(F.id),(C)=>{let T=C.variants.filter((K)=>!L.some((Y)=>Y===String(K.id)));C.variants=[...T,...L.map((K)=>({id:K,settings:{effort:K,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(z)=>$.get(z)??z}}function j1($){return $.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??$.get("x-api-key")??void 0}import{buildPrimeRequestBody as V1,effectiveRelayTransport as Q1,nativeAccountCanServe as oX,PrimeManager as rX,tokenFingerprint as W1}from"@cortexkit/anthropic-auth-core";var B1=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{};function z1($){let{runtime:X,source:z}=$,W=new AbortController,F=new Set,L=(K)=>({providerID:"anthropic",modelID:V1().model,sessionID:`oc2-prime:${K}`,agent:"prime",kind:"generate"}),C=async(K)=>{let Y=L(K),U=y2({source:z}),M=performance.now();try{for(let G=0;G<3;G++){if(W.signal.throwIfAborted(),(await X.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let R=await U.adapter.accountHeaders({...Y,accountId:K});if(!("headers"in R)||typeof R.headers!=="object"||R.headers===null||typeof R.attempt!=="object"||R.attempt===null)throw Error("Native Prime authorization refused");let S={...Y,accountId:K,attemptId:crypto.randomUUID(),transport:"http",data:R.attempt},D,l=!1,v=!1,n=(t)=>{v=!0,t.body?.cancel().catch(()=>{})};try{let t=await U.adapter.rewriteRequest?.({...Y,accountId:K,attempt:S,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(V1()),signal:W.signal})});if(!t)throw Error("Native Prime rewrite refused");let a=new Headers(t.headers);for(let[k,y]of Object.entries(R.headers))if(y===null)a.delete(k);else a.set(k,y);let M2=new Request(t,{headers:a}),W2=await($.fetch??fetch)(M2),J=await U.adapter.rewriteResponse?.({...Y,accountId:K,request:M2,response:W2,attempt:S})??W2;D=J.status,U.adapter.quotaFromHeaders?.(J.headers,J.status,S);let Q=J.ok?void 0:await U.adapter.limitFromResponse?.({status:J.status,headers:J.headers,body:()=>J.clone().text(),attempt:S});if(Q&&/^(vault-newer|local-newer|relay-direct):/.test(Q.reason)&&G<2){n(J);let k={...Y,phase:"retry",rerouteFrom:{accountId:K,limit:Q}};if(await z.chooseAccount(k)!==K)throw Error("Native Prime retry changed account");continue}if(!J.ok)return n(J),{ok:!1,status:D,ms:performance.now()-M,error:"Native Prime upstream refused the request"};let B=B1(await J.json()),E=B1(B.usage),b={inputTokens:typeof E.input_tokens==="number"?E.input_tokens:void 0,outputTokens:typeof E.output_tokens==="number"?E.output_tokens:void 0};if(S.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(J.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(l=await z.recordPrime(R.attempt.provenance,b),!l)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:D,ms:performance.now()-M,usage:b}}finally{await U.adapter.onAttemptEnd?.(S,{status:D,outputStarted:!1,...l?{}:{error:{reason:v?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-M}}finally{U.dispose()}},T=new rX({storagePath:$.paths.legacyConfig,loadStorage:async()=>(await X.read()).policyStorage,async getAccountFingerprint(K){let Y=await X.read(),U=Y.accounts.find((P)=>P.id===K);if(!oX(U)||U?.type!=="oauth")return;if(Y.policyStorage.relay?.enabled===!0&&Q1(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")return;if(U.source==="vault"){let P=await X.authorizeVault(K,W.signal),R=await X.getOrCreateAuthLineage(K,P);return R?W1(R):void 0}let M=await X.authorizeLocal(K,{signal:W.signal});if(M.status!=="usable")return;let G=await X.getOrCreateAuthLineage(K,M.subject);return G?W1(G):void 0},async refreshQuota(K){let Y=await X.read();if(Y.policyStorage.relay?.enabled===!0&&Q1(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await X.fetchQuota(K,$.fetch,W.signal),fresh:!0}},sendPrime(K){let Y=C(K);return F.add(Y),Y.finally(()=>F.delete(Y)),Y},async recordSuccess(K){let Y=(await X.read()).accounts.find((U)=>U.id===K);if(!Y?.prime)throw Error("Native Prime counters are unavailable");return Y.prime}});return T.start(),{manager:T,async dispose(){T.stop(),W.abort(),await Promise.allSettled(F)}}}import{createNativeUsagePublisher as nX,decideStickyQuotaFailure as sX,effectiveRelayTransport as aX,getClaudeCodeIdentityForVerifiedAccount as a2,getQuotaCheckIntervalMs as tX,getRoutingMode as H$,isDumpPersistentlyEnabled as U1,isQuotaBearingHeaderFrame as eX,logger as $Z,mergeHeaderQuotaForPersistence as XZ,NativeVaultNoAccountError as ZZ,nativeAccountCanServe as I2,nativeAccountPolicy as t2,nativeLocalAccountRefusal as JZ,nativeLocalQuotaLineage as YZ,nativePollQuotaGenerallyExhausted as GZ,normalizeQuotaHeaders as jZ,quotaSnapshotCheckedAt as K1,quotaSnapshotHasStandardWindows as VZ,readNativeAccountsForRequest as QZ,remapModelId as K$,StickySessionRouter as WZ,setDumpEnabled as BZ,shouldFallbackStatus as zZ,stickyQuotaSnapshotIsFresh as h2,stickyRetryAfterWithJitter as UZ,stickyRouteFamilyForModel as KZ}from"@cortexkit/anthropic-auth-core";var M$=($)=>["five_hour","seven_day"].some((X)=>($?.[X]?.remainingPercent??1)<=0);function MZ($,X,z,W){let F=$.rerouteFrom;if($.phase!=="retry"||F?.limit.status!==429||H$(X.policyStorage)!=="sticky-balanced")return;let L=z.find((T)=>T.id===F.accountId);if(!L||!h2(L.quota,X.policyStorage,Date.now(),W))return;let C=sX({quota:L.quota,modelId:W});if(C.action!=="hold")return;return{hold:{delayMs:UZ($.sessionID,C.retryAfterSeconds)*1000}}}function H1($){let{runtime:X}=$,z=nX("native-auth"),W=new Map,F=(J)=>{let Q=J.routingPath;if(!Q)throw Error("Native routing storage is unavailable");let B=W.get(Q);if(!B)B=new WZ({path:Q,vaultSeed:J.routingSeed,onLockEvent:X.onLockEvent,relocationGuard:X.relocationGuard,localRecoveryPath:J.mode==="local"?J.routingRecoveryPath:void 0}),W.set(Q,B);return B.setVaultSeed(J.routingSeed),B},L=new WeakMap,C=new Map,T=new Map,K=new Map,Y=new Map,U=new WeakSet,M=!1,G=()=>{while(C.size>512){let J=C.keys().next();if(!J.done)C.delete(J.value)}},P=(J)=>{try{BZ(U1(J.policyStorage))}catch{}},R=async()=>{try{let J=await X.read();return P(J),U1(J.policyStorage)}catch{return!1}},S=(J,Q)=>JSON.stringify([J.sessionID,J.kind,J.modelID,Q]),D=(J)=>{if(M)throw Error("Native Anthropic source is closed");let Q=K.get(J.sessionID);if(!Q){Q=new AbortController,K.set(J.sessionID,Q);while(K.size>512){let B=K.keys().next();if(!B.done)W2.forgetSession?.(B.value)}}return Q},l=(J,Q,B)=>I2(J)&&(J.type==="api"||t2(J,Q,K$(B)).status==="allowed"),v=async(J,Q,B,E,b)=>{let k=await X.read();P(k),E.signal.throwIfAborted(),n(k);let y=k.accounts.find((m)=>m.id===J);if(!y||y.type!==B||!l(y,k,Q))return b?.(!y||!I2(y)?"account-unavailable":"account-policy"),!1;if(B==="api"){let m=k.accounts.find((i)=>i.id==="main"&&i.type==="oauth");return!!m&&h2(m.quota,k.policyStorage)&&M$(m.quota)}return!0},n=(J)=>{let Q=J.policyStorage.relay;if(Q?.enabled===!0&&aX(Q.transport,Q.url)==="websocket")throw new O2},t=async(J,Q)=>{if(n(J),Q||J.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let B=await X.getRelayConfig();if(!B)throw Error("request refused: native HTTP relay configuration is unavailable");if(B.transport!=="http")throw new O2;return{dispatch:{kind:"http-relay",url:B.url,token:B.token},relayFallback:B.fallbackToDirect}};async function a(J,Q,B){if(J.kind==="local"){let E=await X.publishLocal(J.subject,B);if(!E&&B.quota)$Z.warn("quota","Quota publication discarded");return E}if(J.kind==="vault"&&Q.receipt)await X.vault.publish(Q.receipt,B);else if(J.kind==="api"&&B.lastUsed!==void 0)await X.publishApi(J.subject,{lastUsed:B.lastUsed});return!0}function M2(J,Q,B){if(J.kind!=="local")return;let E=J.subject.binding,b=K1(B),k={lineage:YZ(E),accountUuid:E.identity,entry:{quota:B,checkedAt:b,refreshAfter:b},generalExhausted:GZ(B),routeBeforeSave:!0};return X.quotaObservations.hold(Q.account.id,k)?k:void 0}let W2={async chooseAccount(J){let Q=D(J);$.onOwnedRequest?.();let B=await X.read();P(B),Q.signal.throwIfAborted(),n(B);let E=K$(await $.resolveModelId?.(J)??J.modelID);if(Q.signal.throwIfAborted(),B.mode==="claustrum")B=await QZ(X,Q.signal),Q.signal.throwIfAborted();if(B.policyStorage.quota?.enabled!==!1){let g=!1;for(let d of B.accounts){if(!I2(d)||d.type!=="oauth")continue;if(VZ(d.quota)?h2(d.quota,B.policyStorage,Date.now(),E):Date.now()-K1(d.quota)<tX(B.policyStorage))continue;try{await X.fetchQuota(d.id,$.fetch,Q.signal,void 0,"admission"),g=!0}catch{Q.signal.throwIfAborted()}}if(g)B=await X.read();Q.signal.throwIfAborted()}let b=J.rerouteFrom?C.get(J.rerouteFrom.limit.reason):void 0;if(J.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(J.rerouteFrom.limit.reason)&&!b)return;if(b&&J.rerouteFrom){let g=B.accounts.find((J2)=>J2.id===b.accountId);if(!g||!l(g,B,E))return;C.delete(J.rerouteFrom.limit.reason);let d=S(J,b.accountId),p=T.get(d)??[];return p.push(b),T.set(d,p),b.accountId}let k=[];for(let g of B.accounts){if(g.type!=="oauth"||!l(g,B,E))continue;if(g.source==="local"){let d=await X.authorizeLocal(g.id,{signal:Q.signal,policy:(p,J2)=>t2(p,J2,E)});if(Q.signal.throwIfAborted(),d.status!=="usable")continue}k.push(g)}let y=MZ(J,B,k,E);if(y)return y;let m=k.filter((g)=>g.id!==J.rerouteFrom?.accountId);if(H$(B.policyStorage)==="sticky-balanced"){let g=m.map((p,J2)=>({accountId:p.id,order:J2,quota:p.quota??{kind:"unknown"}})),d=await F(B).resolve({sessionId:J.sessionID,family:KZ(E),modelId:E,affinityModelId:J.modelID,candidates:g,retainAccountIds:new Set(m.map((p)=>p.id)),...B.mode==="claustrum"?{accountIdentities:new Map(B.accounts.flatMap((p)=>p.accountIdentity?[[p.id,p.accountIdentity]]:[]))}:{},storage:B.policyStorage,inputBytes:1,preferredAccountId:J.previousAccountId,preserveOnNoCandidate:!0});if(Q.signal.throwIfAborted(),d)return d.accountId}else{let d=H$(B.policyStorage)==="fallback-first"?[...m.filter((p)=>p.id!=="main"),...m.filter((p)=>p.id==="main")]:[...m.filter((p)=>p.id==="main"),...m.filter((p)=>p.id!=="main")];if(d[0])return d[0].id}if(B.mode==="claustrum")throw new ZZ;let i=B.accounts.find((g)=>g.id==="main"&&g.type==="oauth");if(!i)return;let $2=i.quota;if(J.rerouteFrom?.limit.status===429||!h2($2,B.policyStorage))try{$2=await X.fetchQuota("main",$.fetch,Q.signal)}catch{return}if(Q.signal.throwIfAborted(),!M$($2))return;return B.accounts.find((g)=>g.type==="api"&&I2(g)&&g.id!==J.rerouteFrom?.accountId)?.id},dropChoice(J){let Q=S(J,J.accountId),B=T.get(Q);if(B?.shift(),B?.length===0)T.delete(Q)},async authorizeAccount(J,Q,B){let E=D(J),b=await X.read();P(b),E.signal.throwIfAborted(),n(b);let k=K$(await $.resolveModelId?.(J)??J.modelID);E.signal.throwIfAborted();let y=b.accounts.find((o)=>o.id===Q);if(!y||!l(y,b,k)){B?.(!y||!I2(y)?"account-unavailable":"account-policy");return}let m=S(J,Q),i=T.get(m),$2=i?.shift();if(i?.length===0)T.delete(m);let{dispatch:g,relayFallback:d}=await t(b,$2?.direct===!0);if(E.signal.throwIfAborted(),$2?.auth){if(!await v(Q,k,$2.auth.route,E,B))return;let o=L.get($2.auth.provenance);if(o?.receipt?.expiresAtMs!==void 0&&o.receipt.expiresAtMs!==null&&o.receipt.expiresAtMs<Date.now()+300000)return;if(o)L.set($2.auth.provenance,{...o,scope:{...J,modelID:k},account:y,active:E,relayFallback:d});return Y.set(J.sessionID,Q),{...$2.auth,dispatch:g}}let p={scope:{...J,modelID:k},active:E,account:y,retry:$2?.retry??!1,relayFallback:d,quota:y.quota};if(y.type==="api"){let o=b.accounts.find((A)=>A.id==="main"&&A.type==="oauth");if(!o||!h2(o.quota,b.policyStorage)||!M$(o.quota))return;let V=await X.authorizeApi(Q,E.signal);if(E.signal.throwIfAborted(),!await v(Q,k,"api",E))return;let H={kind:"api",subject:V.subject};return L.set(H,p),Y.set(J.sessionID,Q),{route:"api",headers:V.authHeader==="authorization-bearer"?{authorization:`Bearer ${V.apiKey}`}:{"x-api-key":V.apiKey},baseURL:V.baseURL,provenance:H,dispatch:g}}if(y.source==="vault"){let o=await X.authorizeVault(Q,E.signal);if(E.signal.throwIfAborted(),!await v(Q,k,"oauth",E,B))return;let V={kind:"vault",credentialId:o.credentialId,recordVersion:o.recordVersion};L.set(V,{...p,receipt:o});let H=o.assertedAccountIdentity;if(!H){B?.("account-unavailable");return}return Y.set(J.sessionID,Q),{route:"oauth",accessToken:o.accessToken,provenance:V,dispatch:g,identity:a2(H,H)}}let J2=await X.authorizeLocal(Q,{signal:E.signal,policy:(o,V)=>t2(o,V,k)});if(E.signal.throwIfAborted(),J2.status!=="usable"){let o=JZ(J2);if(o)B?.(o.reason);return}if(!await v(Q,k,"oauth",E,B))return;let P2={kind:"local",subject:J2.subject};L.set(P2,{...p,access:J2.access}),Y.set(J.sessionID,Q);let k2=J2.subject.binding.identity;return{route:"oauth",accessToken:J2.access,provenance:P2,dispatch:g,identity:a2(k2,k2)}},async requestOptions(J,Q){let B=D(J),E=await X.read();P(E),B.signal.throwIfAborted();let b=E.accounts.find((y)=>y.id===J.accountId);if(!b||!l(b,E,J.modelID))throw Q?.(!b||!I2(b)?"account-unavailable":"account-policy"),Error("request refused: native account is ineligible for this model");let k=L.get(J.provenance);if(k)L.set(J.provenance,{...k,scope:{...k.scope,modelID:J.modelID}});return $.requestOptions(J,E)},async admitRequest(J,Q){let B=L.get(J.provenance);if(!B||!await v(J.accountId,J.modelID,J.route,B.active,Q))throw Error("request refused: native account policy changed before dispatch");L.set(J.provenance,{...B,scope:{...B.scope,modelID:J.modelID}})},isDumpEnabled:()=>R(),onRequestPrepared:(J)=>$.onRequestPrepared?.(J),responseOptions(J){return $.responseOptions?.({...J,modelID:L.get(J.provenance)?.scope.modelID??J.modelID})},quotaFromHeaders(J,Q){let B=L.get(Q.provenance),E=M1(J);if(E)$.onRequestId?.(Q,E);if(!B||Q.route!=="oauth"||!eX(J))return;let b=Q.provenance.kind==="local"?Q.provenance.subject.binding.identity:B.receipt?.assertedAccountIdentity,k={...jZ(J),...b?{accountIdentity:b}:{}},y=XZ(B.quota,k);B.quota=y;let m=M2(Q.provenance,B,y),i=B.account.id,$2=()=>{if(m)X.quotaObservations.forget(i,m)};return z.observe(a(Q.provenance,B,{quota:y}).then((g)=>{if(!g)$2()},(g)=>{throw $2(),g})),k},async limitFromResponse(J){let Q=L.get(J.provenance);if(!Q)return;if(J.status===401&&Q.receipt){if(!U.has(Q.receipt))U.add(Q.receipt),await X.vault.reportFailure(Q.receipt,401,J.dispatch==="http-relay"?"relay_status_field":"direct");if(Q.retry||Q.active.signal.aborted)return;let E=Q.active,b=await X.vault.prepareRetry(Q.receipt,E.signal);if(E.signal.throwIfAborted(),!b.retry)return;let k=b.receipt,y=k.assertedAccountIdentity;if(!y)return;let m={kind:"vault",credentialId:k.credentialId,recordVersion:k.recordVersion};L.set(m,{...Q,receipt:k,retry:!0});let i=`vault-newer:${J.attemptId}`;return C.set(i,{sessionID:J.sessionID,accountId:J.accountId,retry:!0,auth:{route:"oauth",accessToken:k.accessToken,provenance:m,identity:a2(y,y)}}),G(),{reason:i,status:401}}if(J.status===401&&J.provenance.kind==="local"&&Q.access&&!Q.retry){if(Q.active.signal.aborted)return;let E=Q.active,b=await X.authorizeLocal(J.accountId,{rejectedAccessToken:Q.access,signal:E.signal,policy:(i,$2)=>t2(i,$2,Q.scope.modelID)});if(E.signal.throwIfAborted(),b.status!=="usable"||b.access===Q.access)return;let k={kind:"local",subject:b.subject};L.set(k,{...Q,access:b.access,retry:!0});let y=b.subject.binding.identity,m=`local-newer:${J.attemptId}`;return C.set(m,{sessionID:J.sessionID,accountId:J.accountId,retry:!0,auth:{route:"oauth",accessToken:b.access,provenance:k,identity:a2(y,y)}}),G(),{reason:m,status:401}}let B=await X.read();if(zZ(J.status,B.policyStorage))return{reason:`provider-${J.status}`,status:J.status};return},limitFromRelayFailure(J){let Q=L.get(J.provenance);if(!Q?.relayFallback||Q.active.signal.aborted||!(J.status===401||J.status>=500))return;let B=`relay-direct:${J.attemptId}`;return C.set(B,{sessionID:J.sessionID,accountId:J.accountId,direct:!0,retry:!1}),G(),{reason:B}},limitFromStreamError(J){return J.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(J,Q){let B=L.get(Q.provenance);if(Q.dispatch==="http-relay"&&B?.relayFallback&&!B.active.signal.aborted&&J.status===void 0){let E=`relay-direct:${Q.attemptId}`;return C.set(E,{sessionID:Q.sessionID,accountId:Q.accountId,direct:!0,retry:!1}),G(),{reason:E}}return},async onAttemptEnd(J,Q){let B=L.get(J.provenance);if(!B)return;try{if(Q.status===401&&B.receipt&&!U.has(B.receipt))U.add(B.receipt),await X.vault.reportFailure(B.receipt,401,J.dispatch==="http-relay"?"relay_status_field":"direct");if(!Q.localRefusal&&Q.status!==void 0)z.publish(()=>a(J.provenance,B,{lastUsed:Date.now()}))}finally{L.delete(J.provenance)}},forgetSession(J){K.get(J)?.abort(),K.delete(J),Y.delete(J);for(let[Q,B]of C)if(B.sessionID===J)C.delete(Q);for(let[Q,B]of T)if(B[0]?.sessionID===J)T.delete(Q);$.onForgetSession?.(J)},servedAccount:(J)=>Y.get(J),resetRouting:async(J)=>F(await X.read()).clear(J),async recordPrime(J,Q){let B=L.get(J);if(!B||B.active.signal.aborted)return!1;if(J.kind==="local")return X.incrementPrimeUsage(B.account.id,J.subject,Q);if(J.kind==="vault"&&B.receipt)return X.incrementPrimeUsage(B.account.id,B.receipt,Q);return!1},drainRoutingPublications:()=>Promise.all([X.drainRoutingPublications(),...[...W.values()].map((J)=>J.drain())]).then(()=>{}),close(){M=!0;for(let J of K.values())J.abort();return K.clear(),T.clear(),C.clear(),Promise.all([z.drain(),W2.drainRoutingPublications()]).then(()=>{})}};return W2}import{remapModelId as HZ}from"@cortexkit/anthropic-auth-core";function L1(){let $=new _1,X=new Map,z=new Map,W=new Map,F=new Set,L=new Set,C=new Map,T=(K)=>{while(K.size>512){let Y=K.keys().next();if(!Y.done)K.delete(Y.value)}};return{async install(K){let Y=[];try{Y.push(await K.session.hook("context",(U)=>{let M=U.messages.map((P)=>{return{info:{id:P.id,sessionID:U.sessionID,role:P.role,agent:U.agent,model:{providerID:U.model.providerID,modelID:U.model.id}},parts:P.content.map((R)=>({type:R.type,...R.type==="text"?{text:R.text}:{}}))}});$.observeMessages(M);let G=U.messages.findLast((P)=>P.role==="user"&&P.id);if(G?.id)X.set(U.sessionID,G.id);if(G?.content.some((P)=>P.type==="text"&&P.text===r2))F.add(U.sessionID);else F.delete(U.sessionID);T(X)},{providerID:"anthropic"})),Y.push(await K.session.hook("model.request",(U)=>{if(U.kind!=="primary")return;let M=X.get(U.sessionID);if(!M)return;if($.markHeaders({sessionId:U.sessionID,messageId:M,agent:U.agent,headers:U.headers}),F.has(U.sessionID))U.headers[R2]="1"},{providerID:"anthropic"}))}catch(U){throw await Promise.allSettled(Y.map((M)=>M.dispose())),U}return{dispose:async()=>{await Promise.all(Y.map((U)=>U.dispose()))}}},requestOptions(K,Y){let U=$.resolveHeader(K.correlation[c2]);if(U)z.set(K.attemptId,U),T(z);C.set(K.attemptId,K.sessionID),T(C);let M=K.correlation[R2]==="1";if(M)L.add(K.attemptId);return{cache1hEnabled:K.agent!=="compaction"&&K.agent!=="title"&&(Y.policyStorage.claudeCache?.enabled??!0),cache1hMode:Y.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:Y.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:Y.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,turnEndNoteEnabled:!0,turnEndNote:Y.policyStorage.turnEndNote,serverSideFallbackEnabled:N1(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:M,billingLineage:U?{promptId:U.promptId,previousRequestId:U.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:W.get(K.sessionID)}},responseOptions(K){return{serverSideFallbackModel:HZ(K.modelID),laneStart:L.has(K.attemptId),onMessageStart(Y){if(K.kind==="primary"&&typeof Y.id==="string")W.set(K.sessionID,Y.id),T(W)},onStreamEnd(){z.delete(K.attemptId),L.delete(K.attemptId),C.delete(K.attemptId)}}},onRequestId(K,Y){$.commit(z.get(K.attemptId),Y)},forgetSession(K){$.clearSession(K),X.delete(K),W.delete(K),F.delete(K);for(let[Y,U]of C)if(U===K)z.delete(Y),L.delete(Y),C.delete(Y)}}}var e2="cortexkit-anthropic-auth",DZ='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',yZ="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",IZ="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function vZ($){let X=$.authorize??LZ,z=$.exchange??CZ,W=()=>{if(!$.isActive())throw Error("Claude authentication setup is closed")},F=async()=>{let T;try{T=await $.readMode()}catch{throw Error(IZ)}return W(),T},L=async()=>{if(await F()!=="local")throw Error(DZ)};return{integrationID:"anthropic",methods:[{method:{id:n2,type:"oauth",label:s2},async authorize(){W(),await L();let T=await X("max");return W(),{mode:"code",url:T.url,instructions:"Paste the authorization code returned by Claude.",callback:async(K)=>{W();let Y=await z(K,T.verifier,T.redirectUri,T.state);if(!$.isActive()||Y.type!=="success")throw Error("Claude sign-in did not complete");return{access:Y.access,refresh:Y.refresh,expires:Y.expires}}}}}],vault:{method:{id:F1,type:"oauth",label:"Claude vault accounts"},async activate(){if(W(),await F()!=="claustrum")throw Error(yZ)}},async onLogin(T){W(),await L(),await $.runtime.loginOAuth({routeId:"main",credential:T,replace:!0}),W()},label:"Claude native account pool"}}function fZ($){return{readMode:()=>qZ("opencode",$),disconnectVault:()=>TZ({host:"opencode",env:$})}}function N$($={}){return{id:e2,setup:(X)=>T1(X,$)}}async function gZ($){try{return await mZ($)}catch(X){throw hZ(X)}}function hZ($){let X=i2($);if(X)return X;let z=bZ("decide where its account state is",[],$);return _$.error("state-layout",z.message,{code:z.code}),i2(z)??z}async function mZ($){if($.paths){let z=$.paths;return await NZ(z),{paths:z,holderRegistration:await xZ({paths:z,role:"opencode2",kind:SZ(),policy:wZ(),onLockEvent:$.local?.onLockEvent})}}let X=await PZ({role:"opencode2",onLockEvent:$.local?.onLockEvent});return{paths:await AZ(void 0,void 0,X.layout),holderRegistration:X.kind==="state-home"?void 0:X.registration}}async function T1($,X={}){let{paths:z,holderRegistration:W}=await gZ(X),F=_Z({paths:z,host:"opencode",local:X.local,vault:X.vault}),L=fZ(X.vault?.env??process.env);try{let v=await F.read();if(!process.env.OPENCODE_ANTHROPIC_AUTH_LOG_LEVEL)kZ(OZ(v.policyStorage)??"info");RZ(EZ(v.policyStorage))}catch{}let C=!0,T=L1(),K=G1(),Y,U,M,G=H1({runtime:F,paths:z,fetch:X.fetch,requestOptions:T.requestOptions,responseOptions:T.responseOptions,onRequestId:T.onRequestId,onForgetSession:T.forgetSession,onRequestPrepared:async(v)=>{try{await M?.track(v)}catch{_$.warn("cachekeep","live request tracking failed")}},resolveModelId:async(v)=>K.modelId(v.modelID),onOwnedRequest:()=>{Y??=n$(F,X.fetch),U??=z1({runtime:F,paths:z,source:G,fetch:X.fetch})}});M=i$({...X.cacheKeep,runtime:F,source:G,storageId:z.storageId,fetch:X.fetch,isSubagent:async(v)=>Boolean((await $.session.get({sessionID:v})).parentID)});let P=Y1({runtime:F,source:G,cacheKeepRegistry:M.registry,start:async(v,n)=>{await $.session.synthetic({sessionID:v,text:n,description:"Claude lane start",resume:!0})}}),R=[],S=await o$($,{source:G,log:{warn:(v,n)=>_$.warn("opencode2",v,n)}},{credential:j1}).catch(async(v)=>{throw W?.close(),P.close(),await M?.dispose(),await G.close(),await F.drainQuotaPublications(),await F.close(),v}),D,l=()=>{if(D)return D;return C=!1,W?.close(),P.close(),G.close(),D=(async()=>{await Promise.allSettled([S.dispose(),Y?.dispose(),U?.dispose(),M?.dispose(),...R.map((v)=>v.dispose())]),await G.close(),await F.drainQuotaPublications(),await F.close()})(),D};try{R.push(await T.install($)),R.push(await K.install($)),R.push(await J$($,vZ({isActive:()=>C,readMode:L.readMode,runtime:F})));let v={host:"opencode",dispatch:P.dispatch,readStatus:(t)=>P.readStatus(t),readAccounts:()=>F.read(),readMode:L.readMode,disconnectVault:L.disconnectVault,interactive:!0},n=FZ(v);return R.push(await P1($,n,P)),l}catch(v){throw await l(),v}}var Q4={id:e2,setup:N$().setup,server:C1};export{T1 as setupAnthropicAuth,Q4 as default,N$ as createAnthropicAuthPlugin,e2 as ANTHROPIC_AUTH_PLUGIN_ID};

package/dist/v2/sidebar.d.ts

@@ -1,5 +1,5 @@
 import { type NativeAccountSnapshot } from '@cortexkit/anthropic-auth-core';
-import type { SidebarState } from '../sidebar-state';
+import { type SidebarState } from '../sidebar-state';
 export interface NativeSidebarExtras {
     /** The account that served the requested session, if any. */
     readonly activeId: string | undefined;

package/dist/v2/source.d.ts

@@ -1,6 +1,6 @@
-import { type NativeAccountRuntime, type NativeAccountSnapshot, type NativeApiSubject, type NativeLocalCredentialValidation as NativeKnownCredentialSubject, type NativePoolPaths, type OAuthQuotaSnapshot } from '@cortexkit/anthropic-auth-core';
+import { type NativeAccountRefusalReason, type NativeAccountRuntime, type NativeAccountSnapshot, type NativeApiSubject, type NativeLocalCredentialValidation as NativeKnownCredentialSubject, type NativePoolPaths, type OAuthQuotaSnapshot } from '@cortexkit/anthropic-auth-core';
 import type { RequestScope } from '@cortexkit/common-auth/opencode2';
-import { type NativeAnthropicBodyOptions, type NativeAnthropicRequestContext, type NativeAnthropicResponseContext, type NativeAnthropicResponseOptions, type NativeAnthropicSource } from './adapter';
+import { type NativeAnthropicAttemptContext, type NativeAnthropicAuthorization, type NativeAnthropicBodyOptions, type NativeAnthropicRequestContext, type NativeAnthropicResponseContext, type NativeAnthropicResponseOptions, type NativeAnthropicSource } from './adapter';
 /**
  * Identifies the account and credential version that served a send, so a
  * later 401 or quota reading is recorded against that exact version. It never
@@ -17,6 +17,8 @@ export type NativeSourceProvenance = {
     readonly kind: 'api';
     readonly subject: NativeApiSubject;
 };
+type Authorization = NativeAnthropicAuthorization<NativeSourceProvenance>;
+type OnAccountRefusal = (reason: NativeAccountRefusalReason) => void;
 export interface NativeSourceOptions {
     readonly runtime: NativeAccountRuntime;
     readonly paths: NativePoolPaths;
@@ -31,6 +33,10 @@ export interface NativeSourceOptions {
     readonly resolveModelId?: (scope: RequestScope) => Promise<string>;
 }
 export interface NativeSource extends NativeAnthropicSource<OAuthQuotaSnapshot, NativeSourceProvenance> {
+    /** Background sends can stop retrying terminal refusals without changing live routing. */
+    readonly authorizeAccount: (scope: RequestScope, accountId: string, onRefusal?: OnAccountRefusal) => Promise<Authorization | undefined>;
+    readonly requestOptions?: (input: NativeAnthropicRequestContext<NativeSourceProvenance>, onRefusal?: OnAccountRefusal) => Promise<NativeAnthropicBodyOptions> | NativeAnthropicBodyOptions;
+    readonly admitRequest?: (input: NativeAnthropicAttemptContext<NativeSourceProvenance>, onRefusal?: OnAccountRefusal) => Promise<void> | void;
     readonly close: () => Promise<void>;
     readonly drainRoutingPublications: () => Promise<void>;
     readonly resetRouting: (sessionID: string) => Promise<void>;
@@ -43,3 +49,4 @@ export interface NativeSource extends NativeAnthropicSource<OAuthQuotaSnapshot,
 }
 /** The native account service supplies fresh credentials; existing quota and routing rules choose each OpenCode 2 request's route. */
 export declare function createNativeAnthropicSource(options: NativeSourceOptions): NativeSource;
+export {};

package/dist/v2/tui.js

@@ -1,4 +1,4 @@
-import{u as q}from"../index-hbk67489.js";import"../index-t4aky73k.js";import"../index-71temqvq.js";var N="Open this link in your browser and sign in. Then choose Finish OAuth sign-in in the Accounts menu and paste the code Claude shows you.";async function g(D,M={}){let B=D.client.rpc(q),Z=!0,V=!1,Y=new AbortController,$=()=>{let j=D.ui.router.current();return j.type==="session"?j.sessionID:void 0};function C(j){return new Promise((Q)=>{let z="",J=!1,G=D.keymap.mode.push("cortexkit-protected-entry"),X=(H,W=!0)=>{if(J)return;J=!0,D.renderer.keyInput.off("keypress",O),D.renderer.keyInput.off("paste",P),Y.signal.removeEventListener("abort",K),G();let F=H?z:void 0;if(z="",W)D.ui.dialog.clear();Q(F)},K=()=>X(!1),O=(H)=>{if(H.preventDefault(),H.stopPropagation(),H.name==="escape"||H.ctrl&&H.name==="c")return X(!1);if(H.name==="return"||H.name==="enter")return X(!0);if(H.name==="backspace"){z=Array.from(z).slice(0,-1).join("");return}if(!H.ctrl&&!H.meta&&!H.option&&Array.from(H.sequence).every((W)=>W.charCodeAt(0)>=32&&W.charCodeAt(0)!==127))z=(z+H.sequence).slice(0,4096)},P=(H)=>{H.preventDefault(),H.stopPropagation(),z=(z+Array.from(new TextDecoder().decode(H.bytes)).filter((W)=>W.charCodeAt(0)>=32&&W.charCodeAt(0)!==127).join("")).slice(0,4096)};if(D.renderer.keyInput.prependListener("keypress",O),D.renderer.keyInput.prependListener("paste",P),Y.signal.addEventListener("abort",K,{once:!0}),D.ui.dialog.alert({title:j,message:"Type or paste the value. Input is hidden. Enter accepts; Escape cancels."}).then(()=>X(!1,!1),()=>X(!1,!1)),Y.signal.aborted)K()})}async function E(j){let Q={};for(let z of j.knobs){if(!Z)return;if(z.kind==="choice"){let J=await D.ui.dialog.select({title:z.label,options:z.choices.map((G)=>({title:G.label,value:G.value})),current:z.value});if(J===void 0)return;Q[z.id]=J}else if(z.kind==="toggle"){let J=await D.ui.dialog.select({title:z.label,options:[{title:"On",value:!0},{title:"Off",value:!1}],current:z.value});if(J===void 0)return;Q[z.id]=J}else{let J=z.kind==="text"&&z.masked?await C(z.label):await D.ui.dialog.prompt({title:z.label,value:z.value===void 0?void 0:String(z.value),placeholder:z.kind==="text"?z.placeholder:void 0});if(J===void 0)return;Q[z.id]=J===""&&!z.required?null:z.kind==="number"?Number(J):J}}return Q}async function A(j){if(M.showSignInLink)try{await M.showSignInLink(D,j,Y.signal);return}catch{}await D.ui.dialog.alert({title:"Claude sign-in",message:`${N}
+import{u as q}from"../index-61bbefpq.js";import"../index-j2cv839v.js";import"../index-71temqvq.js";var N="Open this link in your browser and sign in. Then choose Finish OAuth sign-in in the Accounts menu and paste the code Claude shows you.";async function g(D,M={}){let B=D.client.rpc(q),Z=!0,V=!1,Y=new AbortController,$=()=>{let j=D.ui.router.current();return j.type==="session"?j.sessionID:void 0};function C(j){return new Promise((Q)=>{let z="",J=!1,G=D.keymap.mode.push("cortexkit-protected-entry"),X=(H,W=!0)=>{if(J)return;J=!0,D.renderer.keyInput.off("keypress",O),D.renderer.keyInput.off("paste",P),Y.signal.removeEventListener("abort",K),G();let F=H?z:void 0;if(z="",W)D.ui.dialog.clear();Q(F)},K=()=>X(!1),O=(H)=>{if(H.preventDefault(),H.stopPropagation(),H.name==="escape"||H.ctrl&&H.name==="c")return X(!1);if(H.name==="return"||H.name==="enter")return X(!0);if(H.name==="backspace"){z=Array.from(z).slice(0,-1).join("");return}if(!H.ctrl&&!H.meta&&!H.option&&Array.from(H.sequence).every((W)=>W.charCodeAt(0)>=32&&W.charCodeAt(0)!==127))z=(z+H.sequence).slice(0,4096)},P=(H)=>{H.preventDefault(),H.stopPropagation(),z=(z+Array.from(new TextDecoder().decode(H.bytes)).filter((W)=>W.charCodeAt(0)>=32&&W.charCodeAt(0)!==127).join("")).slice(0,4096)};if(D.renderer.keyInput.prependListener("keypress",O),D.renderer.keyInput.prependListener("paste",P),Y.signal.addEventListener("abort",K,{once:!0}),D.ui.dialog.alert({title:j,message:"Type or paste the value. Input is hidden. Enter accepts; Escape cancels."}).then(()=>X(!1,!1),()=>X(!1,!1)),Y.signal.aborted)K()})}async function E(j){let Q={};for(let z of j.knobs){if(!Z)return;if(z.kind==="choice"){let J=await D.ui.dialog.select({title:z.label,options:z.choices.map((G)=>({title:G.label,value:G.value})),current:z.value});if(J===void 0)return;Q[z.id]=J}else if(z.kind==="toggle"){let J=await D.ui.dialog.select({title:z.label,options:[{title:"On",value:!0},{title:"Off",value:!1}],current:z.value});if(J===void 0)return;Q[z.id]=J}else{let J=z.kind==="text"&&z.masked?await C(z.label):await D.ui.dialog.prompt({title:z.label,value:z.value===void 0?void 0:String(z.value),placeholder:z.kind==="text"?z.placeholder:void 0});if(J===void 0)return;Q[z.id]=J===""&&!z.required?null:z.kind==="number"?Number(J):J}}return Q}async function A(j){if(M.showSignInLink)try{await M.showSignInLink(D,j,Y.signal);return}catch{}await D.ui.dialog.alert({title:"Claude sign-in",message:`${N}
 
 ${j}
 `})}async function T(j,Q){let z=`${Q.title} status`;if(M.showStatus)try{await M.showStatus(D,{title:z,lines:Q.lines,...Q.slot==="quota"&&{readQuota:(J)=>B.sidebar({sessionId:j},{signal:J,location:D.location})}},Y.signal);return}catch{}await D.ui.dialog.alert({title:z,message:Q.lines.join(`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/opencode-anthropic-auth",
-  "version": "2.4.3",
+  "version": "2.4.4",
   "type": "module",
   "repository": {
     "type": "git",
@@ -77,7 +77,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.6.0",
-    "@cortexkit/anthropic-auth-core": "2.4.3",
+    "@cortexkit/anthropic-auth-core": "2.4.4",
     "@cortexkit/claustrum-client": "0.13.0",
     "@cortexkit/private-files": "0.2.2",
     "@cortexkit/subc-client": "^0.22.10",

package/src/sidebar-state.ts

@@ -244,7 +244,7 @@ function normalizeQuotaWindow(value: unknown): QuotaWindow | undefined {
   return {
     usedPercent,
     remainingPercent,
-    resetsAt: typeof value.resetsAt === 'string' ? value.resetsAt : undefined,
+    ...(typeof value.resetsAt === 'string' && { resetsAt: value.resetsAt }),
     ...(isFiniteNumber(value.checkedAt) && { checkedAt: value.checkedAt }),
   }
 }
@@ -464,7 +464,7 @@ export function normalizeSidebarState(raw: unknown): SidebarState {
       typeof raw.fastMode === 'boolean'
         ? raw.fastMode
         : DEFAULT_SIDEBAR_STATE.fastMode,
-    cacheKeep,
+    ...(cacheKeep && { cacheKeep }),
     ...(prime && { prime }),
     ...(fableRecoveries.length > 0 && { fableRecoveries }),
     lastUpdated: isFiniteNumber(raw.lastUpdated) ? raw.lastUpdated : 0,

package/src/tui-compiled/sidebar-state.ts

@@ -244,7 +244,7 @@ function normalizeQuotaWindow(value: unknown): QuotaWindow | undefined {
   return {
     usedPercent,
     remainingPercent,
-    resetsAt: typeof value.resetsAt === 'string' ? value.resetsAt : undefined,
+    ...(typeof value.resetsAt === 'string' && { resetsAt: value.resetsAt }),
     ...(isFiniteNumber(value.checkedAt) && { checkedAt: value.checkedAt }),
   }
 }
@@ -464,7 +464,7 @@ export function normalizeSidebarState(raw: unknown): SidebarState {
       typeof raw.fastMode === 'boolean'
         ? raw.fastMode
         : DEFAULT_SIDEBAR_STATE.fastMode,
-    cacheKeep,
+    ...(cacheKeep && { cacheKeep }),
     ...(prime && { prime }),
     ...(fableRecoveries.length > 0 && { fableRecoveries }),
     lastUpdated: isFiniteNumber(raw.lastUpdated) ? raw.lastUpdated : 0,