@cortexkit/opencode-anthropic-auth 2.4.4 → 2.4.5

package/dist/index.js

@@ -1 +1 @@
-import{q as a}from"./index-j3mytf5r.js";import"./index-sg0knfec.js";import"./index-hc7bm3yf.js";import"./index-naff9h33.js";import"./index-j2cv839v.js";import"./index-gvswxab8.js";import"./index-71temqvq.js";export{a as AnthropicAuthPlugin};
+import{q as a}from"./index-y35yxsnq.js";import"./index-sg0knfec.js";import"./index-hc7bm3yf.js";import"./index-naff9h33.js";import"./index-j2cv839v.js";import"./index-gvswxab8.js";import"./index-71temqvq.js";export{a as AnthropicAuthPlugin};

package/dist/v2/adapter.d.ts

@@ -1,5 +1,5 @@
 import { AnthropicOAuthOriginError, type ClaudeCodeIdentity, type RequestGzipLatch, stateRefusalCause, TrailingAssistantHistoryError } from '@cortexkit/anthropic-auth-core';
-import type { AccountRequest, AttemptOutcome, ChooseAccountInput, ChooseAccountResult, HeaderEdits, HostError, LimitSignal, OpenCode2AuthAdapter, RequestScope, Transport } from '@cortexkit/common-auth/opencode2';
+import type { AccountRequest, AttemptOutcome, ChooseAccountInput, ChooseAccountResult, HeaderEdits, HostError, LimitSignal, OpenCode2AuthAdapter, RequestScope, SameAccountRetryInput, SameAccountRetryResult, Transport } from '@cortexkit/common-auth/opencode2';
 import { EffortMarkerCorrelationError } from '../effort-history';
 import { createStrippedStream, rewriteRequestBody } from '../transform';
 /** The provider OpenCode 2 serves Claude under. */
@@ -158,6 +158,13 @@ export interface NativeAnthropicSource<Q, P> {
     readonly chooseAccount: (input: ChooseAccountInput) => Promise<ChooseAccountResult> | ChooseAccountResult;
     /** Discards one queued choice that the installer will not authorize. */
     readonly dropChoice?: (input: AccountRequest) => Promise<void> | void;
+    /** Retries a prepared credential or switches relay to direct on the same account. */
+    readonly retrySameAccount?: (input: SameAccountRetryInput) => Promise<SameAccountRetryResult | undefined> | SameAccountRetryResult | undefined;
+    /**
+     * Discards the retry `retrySameAccount` prepared (the newer credential or
+     * the switch from relay to direct) when the host decides not to send it.
+     */
+    readonly dropSameAccountRetry?: (input: SameAccountRetryInput & SameAccountRetryResult) => Promise<void> | void;
     /**
      * The credential for one send with the chosen account; `undefined` refuses
      * the request before anything is sent.

package/dist/v2/cachekeep-store.d.ts

@@ -0,0 +1,36 @@
+import { type CacheKeepTarget, type OwnerOnlyOptions } from '@cortexkit/anthropic-auth-core';
+export declare function cacheKeepStoreDirectory(storageId: string, root?: string): string;
+export type SavedCacheKeepTarget = Pick<CacheKeepTarget, 'id' | 'bodyText' | 'url' | 'cacheExpiresAt' | 'nextPrewarmAt' | 'oauthAccountIdentity' | 'isSubagent'> & {
+    v: 1;
+    pluginVersion: string;
+};
+export interface CacheKeepStoreOptions {
+    storageId: string;
+    /** Test seam; production always uses os.tmpdir(), never OpenCode's config. */
+    root?: string;
+    ownerOnly?: OwnerOnlyOptions;
+    now?: () => number;
+    setTimeoutImpl?: typeof globalThis.setTimeout;
+    clearTimeoutImpl?: typeof globalThis.clearTimeout;
+}
+/** Best-effort restart storage. No caller of changed() waits for disk or zlib. */
+export declare class CacheKeepStore {
+    private readonly options;
+    readonly directory: string;
+    private disabled;
+    private chain;
+    private readonly pending;
+    private readonly timers;
+    private readonly lastWrite;
+    private readonly latest;
+    constructor(options: CacheKeepStoreOptions);
+    private refuse;
+    private directoryReady;
+    private enqueue;
+    load(now: number, accept: (entry: SavedCacheKeepTarget) => boolean): Promise<void>;
+    changed(target: Readonly<CacheKeepTarget>): void;
+    private flush;
+    removed(id: string): void;
+    clear(): void;
+    drain(): Promise<void>;
+}

package/dist/v2/cachekeep.d.ts

@@ -1,10 +1,13 @@
 import { CacheKeepSessionRegistry, type NativeAccountRuntime } from '@cortexkit/anthropic-auth-core';
+import { type CacheKeepStoreOptions } from './cachekeep-store';
 import type { NativeSource } from './source';
 export interface NativeCacheKeepOptions {
     readonly now?: () => number;
     readonly setIntervalImpl?: typeof globalThis.setInterval;
     readonly clearIntervalImpl?: typeof globalThis.clearInterval;
     readonly registryDirectory?: string;
+    /** Filesystem seam for tests; this is not a user setting. */
+    readonly persistence?: Omit<CacheKeepStoreOptions, 'storageId'>;
 }
 /**
  * Keep admitted hybrid-cache prefixes warm using fresh native authorization for
@@ -22,6 +25,7 @@ export declare function createNativeCacheKeep(options: NativeCacheKeepOptions &
     fetch?: typeof fetch;
     isSubagent?: (sessionID: string) => Promise<boolean>;
 }): {
+    ready: Promise<void>;
     track(input: Parameters<NonNullable<NativeSource['onRequestPrepared']>>[0]): Promise<void | {
         tracked: true;
     } | {

package/dist/v2/server.js

@@ -1,14 +1,14 @@
-import{a as c2,b as M1,c as _1,d as k$,e as b$,f as r2,g as R2,h as w$,i as D$,j as y$,k as N1,l as I$,m as v$,n as f$,o as g$,p as V$,q as C1}from"../index-j3mytf5r.js";import"../index-sg0knfec.js";import"../index-hc7bm3yf.js";import{v as P1}from"../index-61bbefpq.js";import{w as n2,x as s2,z as F1}from"../index-m4dazzyf.js";import"../index-naff9h33.js";import{J as o2}from"../index-j2cv839v.js";import"../index-gvswxab8.js";import"../index-71temqvq.js";import{acquireNativeAccountRuntime as _Z,assertUnmanagedInjectedPaths as NZ,authorize as LZ,createNativeUi as FZ,decideOpenCodeStateLayoutOnce as PZ,disconnectNativeVaultForHost as TZ,exchange as CZ,getPersistedLogLevel as OZ,isDumpPersistentlyEnabled as EZ,logger as _$,openCodeHolderKind as SZ,readNativeEnrollmentMode as qZ,registerNativePoolHolder as xZ,resolveNativePoolPaths as AZ,setDumpEnabled as RZ,setLogLevel as kZ,stateLayoutIoFailure as bZ,unmovedRegistrationPolicy as wZ}from"@cortexkit/anthropic-auth-core";class b2 extends Error{kind;providerID;sessionID;requestKind;constructor($){super($.message??`${$.providerID} ${$.requestKind} request refused (${$.kind})`);this.name="OpenCode2AuthError",this.kind=$.kind,this.providerID=$.providerID,this.sessionID=$.sessionID,this.requestKind=$.requestKind}}function C2($){return`common-auth-placeholder.${$}`}function L$($){let X=C2($.integrationID);return{type:"oauth",methodID:$.methodID,access:X,refresh:X,expires:$.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function Z$($,X){if($?.type!=="oauth")return!1;let z=X===void 0?void 0:C2(X),W=(F)=>z===void 0?F.startsWith("common-auth-placeholder."):F===z;return W($.access)&&W($.refresh)}var F$="No browser sign-in: this connects the plugin to the accounts in its vault.";async function J$($,X){let z=X.now??Date.now,{integrationID:W}=X,F=(T)=>L$({integrationID:W,methodID:T,now:z()}),L=async(T,K)=>{return await X.onLogin(T,{integrationID:W,methodID:K}),F(K)},C=(T)=>async(K)=>{let Y=T.method.id,U=await T.authorize(K),M={url:U.url,instructions:U.instructions,...U.expiresAt===void 0?{}:{expiresAt:U.expiresAt}};if(U.mode==="auto")return{...M,mode:"auto",callback:U.callback.then((P)=>L(P,Y))};let G=U.callback;return{...M,mode:"code",callback:async(P)=>L(await G(P),Y)}};return $.integration.transform((T)=>{let K=X.label===void 0?{}:{label:()=>X.label};for(let M of X.methods)T.method.update({integrationID:W,method:M.method,authorize:C(M),refresh:async(G)=>{if(!Z$(G,W))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return F(G.methodID)},...K});let Y=X.vault;if(Y===void 0)return;let U=Y.method.id;T.method.update({integrationID:W,method:Y.method,authorize:async()=>({url:"",instructions:Y.instructions??F$,mode:"auto",callback:Promise.resolve().then(()=>Y.activate({integrationID:W,methodID:U})).then(()=>F(U))}),refresh:async(M)=>{if(!Z$(M,W)||M.methodID!==U)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return F(U)},...K})})}function O1($){let X=[],z;for(let W of $.split(/\r?\n/))if(W.startsWith("data:"))X.push(W.slice(5).replace(/^ /,""));else if(W.startsWith("event:"))z=W.slice(6).trim();if(X.length===0)return;return z===void 0?{data:X.join(`
-`)}:{event:z,data:X.join(`
-`)}}function Y$($,X){let z=new TextDecoder,W="",F=(C)=>{let T=O1(C);if(!T)return;try{$(T)}catch(K){X(K)}},L=()=>{for(;;){let C=/\r?\n\r?\n/.exec(W);if(!C)return;let T=W.slice(0,C.index);W=W.slice(C.index+C[0].length),F(T)}};return new TransformStream({transform(C,T){T.enqueue(C),W+=z.decode(C,{stream:!0}),L()},flush(){if(W+=z.decode(),L(),W.trim()!=="")F(W);W=""}})}var P$=512,T$=1200000,w2="x-common-auth-attempt",x2=($,X)=>JSON.stringify([$,X]),_2=($)=>({providerID:$.model.providerID,modelID:$.model.id,sessionID:$.sessionID,agent:$.agent,kind:$.kind});function E1($){let X=$.headers;return typeof X==="object"&&X!==null}function S1($,X){let z=$.getReader();return new ReadableStream({async pull(W){let F;try{F=await z.read()}catch(L){X({reason:"failed",message:L instanceof Error?L.message:String(L)}),W.error(L);return}if(F.done)X(),W.close();else W.enqueue(F.value)},async cancel(W){X({reason:"cancelled",...W===void 0?{}:{message:String(W)}}),await z.cancel(W)}})}function d2($,X){for(let[z,W]of Object.entries(X)){let F=z.toLowerCase();for(let L of Object.keys($))if(L.toLowerCase()===F)delete $[L];if(W!==null)$[z]=W}}function q1($,X){for(let[z,W]of Object.entries(X))if(W===null)$.delete(z);else $.set(z,W)}async function G$($,X,z={}){let{providerID:W}=X,F=z.gateOnPlaceholder,L=(Z)=>F===void 0||F.credential(Z)===C2(W),C=z.logger,T=Math.max(1,z.maxRecords??P$),K=[...z.hostCredentials??[C2(W)],...F?[C2(W)]:[]].filter((Z)=>Z!==""),Y=new Map,U=new WeakMap,M=new Map,G=0,P=new Set,R=new Map,S=new Map,D=(Z)=>{let j=S.get(Z);return j?.ownedSeen===!0&&j.foreignSeen},l=(Z,j)=>{R.set(Z,j);let N=S.get(Z)??{ownedSeen:!1,foreignSeen:!1};if(j)N.ownedSeen=!0;else N.foreignSeen=!0;S.set(Z,N)},v=(Z,j)=>{let N=F?.refuseMisplaced,x=N?[...j].filter(([,u])=>u.includes(C2(W))):[],O=L(j)&&(!N||x.length>0);if(N){if(x.length>0&&(x.length!==1||!O))throw l(Z.sessionID,!1),new b2({kind:"placement-refused",providerID:W,sessionID:Z.sessionID,requestKind:Z.kind,message:N(x[0]?.[0]??"")})}return l(Z.sessionID,O),O},n=!1,t=!1,a=new Map,M2=0,W2=!1,J=new Map,Q=(Z,j)=>{try{C?.warn(Z,j)}catch{}},B=(Z)=>Z instanceof Error?Z.message:String(Z),E=new Map,b=(Z,j)=>{let N=(E.get(Z)??Promise.resolve()).then(j),x=N.then(()=>{},()=>{});return E.set(Z,x),x.then(()=>{if(E.get(Z)===x)E.delete(Z)}),N},k=(Z,j)=>{let N=E.get(Z);return N?N.then(()=>k(Z,j)):j()},y=async(Z)=>{try{await X.dropChoice?.({...Z.input,accountId:Z.accountId})}catch(j){Q("opencode2 auth dropChoice threw; the request is unaffected",{sessionID:Z.input.sessionID,error:B(j)})}},m=(Z)=>{let j=M.get(Z);if(M.delete(Z),j?.next){let N=j.next;b(j.sessionID,()=>y(N))}},i=async(Z,j)=>{let N=a.get(Z);if(!N||N.size===0)return;await Promise.all([...N].map(async(x)=>{try{await x(j)}catch(O){Q("opencode2 auth listener threw; the request is unaffected",{event:Z,error:B(O)})}}))},$2=async(Z,j)=>{try{await X.onAttemptEnd?.(Z,j)}catch(N){Q("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:Z.attemptId,error:B(N)})}},g=(Z,j)=>{if(Z.ended||!Z.attempt)return;let N={...Z.status===void 0?{}:{status:Z.status},outputStarted:Z.outputStarted,...Z.limit?{limit:Z.limit.signal}:{},...j?{error:j}:{}};if(j)Z.endError=j;Z.ended=$2(Z.attempt,N)},d=(Z,j)=>g(Z,{reason:"abandoned",message:j}),p=(Z)=>[...Y.values()].filter((j)=>j.key===Z),J2=(Z)=>p(Z).at(-1),P2=(Z)=>{if(Y.delete(Z.id),M.get(Z.key)?.attemptId===Z.id||!p(Z.key).length)m(Z.key)},k2=(Z)=>{Y.set(Z.id,Z);while(Y.size>T){let j=Y.values().next().value;if(j===void 0)break;d(j,"dropped to keep the record bound"),P2(j)}},o=(Z)=>Z.accountId===void 0?void 0:{...Z.scope,accountId:Z.accountId},V=(Z,j)=>new b2({kind:"no-account",providerID:W,sessionID:Z.sessionID,requestKind:Z.kind,...j===void 0?{}:{message:j}}),H=(Z)=>{J.get(Z)?.clear(),J.delete(Z)},_=async(Z,j)=>{let N=()=>V(Z,`${W} ${Z.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(W2)throw N();let x=J.get(Z.sessionID);if(!x)x=new Set,J.set(Z.sessionID,x);let O={};x.add(O);let u=()=>{if(!x.has(O))throw N()};try{return await j(u)}finally{if(x.delete(O),x.size===0&&J.get(Z.sessionID)===x)J.delete(Z.sessionID)}},A=(Z,j)=>{for(let[N,x]of j)if(K.some((O)=>x.includes(O)))throw new b2({kind:"host-credential-on-wire",providerID:W,sessionID:Z.sessionID,requestKind:Z.kind,message:`${W} ${Z.kind} request still carries the host's placeholder credential in ${N}; the adapter's account headers must replace it`})},q=(Z)=>{for(let j of p(Z))if(j.ended||!j.attempt)P2(j);else if(j.transport==="ws"||j.judged)d(j,"a newer attempt of its session and kind began"),P2(j)},I=async(Z,j,N,x)=>{let O=x2(Z.sessionID,Z.kind),{input:u,accountId:w}=await k(Z.sessionID,async()=>{N();let Q2=M.get(O);M.delete(O);let N2=Q2?.accountId??J2(O)?.accountId;q(O);let L2=Q2?.next,z2=L2!==void 0&&L2.input.modelID===Z.modelID&&L2.input.agent===Z.agent,v2={...Z,phase:"request",...N2===void 0?{}:{previousAccountId:N2},...Q2?.rerouteFrom?{rerouteFrom:Q2.rerouteFrom}:{}};if(L2&&!z2)await b(Z.sessionID,()=>y(L2)),N();let T2=z2?L2.accountId:await X.chooseAccount(v2);return{input:v2,accountId:typeof T2==="string"?T2:void 0}});N();let h={},Z2;if(w!==void 0){let Q2=await X.accountHeaders({...Z,accountId:w});if(N(),E1(Q2))h=Q2.headers,Z2=Q2.attempt;else h=Q2}let S2=`attempt-${++M2}`,H2={id:S2,key:O,scope:Z,accountId:w,headers:h,attempt:w===void 0?void 0:{...Z,accountId:w,attemptId:S2,transport:x,data:Z2},...x===void 0?{}:{transport:x},outputStarted:!1};if(k2(H2),H2.attempt)i("select",{...Z,accountId:H2.attempt.accountId,hook:j,...u.previousAccountId===void 0?{}:{previousAccountId:u.previousAccountId},...u.rerouteFrom===void 0?{}:{rerouteFrom:u.rerouteFrom},handle:H2.attempt});return H2},f=async(Z,j,N,x,O)=>{let u=x2(Z.sessionID,Z.kind),w=x===void 0?void 0:Y.get(x);if(w?.key!==u)w=void 0;if(!w){if(w=J2(u),p(u).filter((Z2)=>Z2.transport===void 0&&!Z2.ended).length>1&&!t)t=!0,Q("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:Z.sessionID,kind:Z.kind})}if(!w||w.transport!==void 0||w.ended)w=await I(Z,j,O,N);else if(w.transport=N,w.attempt)w.attempt.transport=N;if(N==="ws"){for(let h of p(u))if(h!==w&&h.transport==="ws")d(h,"a newer attempt of its session and kind went out over WebSocket")}return w},s=async(Z,j)=>{try{return await j()}catch(N){throw g(Z,{reason:"failed",message:B(N)}),N}},c=(Z,j)=>{let N=p(x2(Z,j)).filter((x)=>x.transport==="ws").at(-1);return N?.attempt!==void 0&&!N.ended?N:void 0},Y2=(Z,j,N)=>{let x=o(Z);if(!x||!Z.attempt||Z.limit)return;Z.limit={signal:j,delivered:i("limit",{...x,via:N,limit:j,outputStarted:Z.outputStarted,handle:Z.attempt})}},V2=(Z,j,N,x)=>{let O=o(Z);if(!O||!Z.attempt)return;i("quota",{...O,transport:j,...x===void 0?{}:{status:x},quota:N,handle:Z.attempt})},B2=(Z,j,N,x)=>{let O=Z.attempt;if(!O)return;let u=X.inspectEvent?.(x===void 0?{transport:j,data:N,attempt:O}:{transport:j,data:N,event:x,attempt:O});if(!u)return;if(u.quota!==void 0)V2(Z,j,u.quota);if(u.outputStarted)Z.outputStarted=!0;if(u.limit)Y2(Z,u.limit,j);if(u.error!==void 0)g(Z,{reason:"failed",message:u.error});else if(u.done)g(Z)},F2=(Z,j)=>{let N=Z.attempt;if(!N||j.accountId===Z.accountId)return;if(N.reboundFrom??=N.accountId,N.accountId=j.accountId,"data"in j)N.data=j.data;Z.accountId=j.accountId},X2=(Z)=>!Z.attempt||Z.endError!==void 0||Z.status!==void 0&&Z.status>=400,e=(Z)=>{let j=[...Y.values()].filter((h)=>h.scope.sessionID===Z),N=j.filter((h)=>h.limit&&!h.rerouted).at(-1);if(N)return N;let x=j.filter((h)=>h.scope.kind==="primary"),O=x.length>0?x:j;if(O.length<=1)return O[0];let u=O.filter((h)=>!h.judged&&X2(h)).at(-1);if(u)return u;let w=O.filter((h)=>h.attempt&&!h.ended);if(w.length>1)return"ambiguous";return w[0]??O.at(-1)},G2={providerID:W},j2=[];j2.push(await $.session.hook("model.request",(Z)=>{if(F)return;return _(_2(Z),async(j)=>{let N=await I(_2(Z),"model.request",j);if(j(),N.accountId===void 0)throw V(N.scope);d2(Z.headers,{...N.headers,[w2]:N.id})})},G2)),j2.push(await $.session.hook("http.request",(Z)=>{if(F){if(!v(_2(Z),Z.request.headers))return}return _(_2(Z),async(j)=>{let N=Z.request.headers.get(w2)??void 0,x=F?await I(_2(Z),"http.request",j,"http"):await f(_2(Z),"http.request","http",N,j);j();let O=o(x),u=x.attempt;if(!O||!u)throw V(x.scope);await s(x,async()=>{let w=Z.request;if(X.rewriteRequest){if(N!==void 0){let S2=new Headers(w.headers);S2.delete(w2),w=new Request(w,{headers:S2})}w=await X.rewriteRequest({...O,request:w,attempt:u})??w,j()}let h=new Headers(w.headers);h.delete(w2),q1(h,x.headers),A(x.scope,h.entries());let Z2=new Request(w,{headers:h});U.set(Z2,x),Z.request=Z2})})},G2)),j2.push(await $.session.hook("http.response",async(Z)=>{let j=U.get(Z.request);if(!j){if(F)return;if(!n)n=!0,Q("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:Z.sessionID,kind:Z.kind});return}let N=Z.response;if(X.answeredBy&&j.attempt){let h=j.attempt,Z2=await s(j,async()=>X.answeredBy?.({request:Z.request,response:N,attempt:h}));if(Z2)F2(j,Z2)}let x=o(j),O=j.attempt;if(!x||!O)return;j.status=N.status;let u=X.quotaFromHeaders?.(N.headers,N.status,O);if(u!==void 0)V2(j,"http",u,N.status);if(!N.ok&&X.limitFromResponse){let h=await X.limitFromResponse({status:N.status,headers:N.headers,body:()=>N.clone().text(),attempt:O});if(h)Y2(j,h,"http")}if(!N.ok||!N.body)g(j);let w=N;if(N.body&&(X.inspectEvent||X.onAttemptEnd)){let h=N.body;if(X.inspectEvent)h=h.pipeThrough(Y$((Z2)=>B2(j,"http",Z2.data,Z2.event),(Z2)=>Q("opencode2 auth event inspection threw",{error:B(Z2)})));w=new Response(S1(h,(Z2)=>g(j,Z2)),{status:N.status,statusText:N.statusText,headers:N.headers})}if(X.rewriteResponse)w=await X.rewriteResponse({...x,request:Z.request,response:w,attempt:O})??w;if(w!==N)Z.response=w},G2)),j2.push(await $.session.hook("experimental.ws.handshake",(Z)=>{if(F){let j=x2(Z.sessionID,Z.kind);if(P.delete(j),!v(_2(Z),new Headers(Z.headers)))return}return _(_2(Z),async(j)=>{let N;for(let w of Object.keys(Z.headers)){if(w.toLowerCase()!==w2)continue;N??=Z.headers[w],delete Z.headers[w]}let x=F?await I(_2(Z),"experimental.ws.handshake",j,"ws"):await f(_2(Z),"experimental.ws.handshake","ws",N,j);j();let O=o(x),u=x.attempt;if(!O||!u)throw V(x.scope);await s(x,async()=>{if(!F?.refuseMisplaced)d2(Z.headers,x.headers);let w=X.rewriteHandshakeURL?.({...O,url:Z.url,attempt:u});if(w!==void 0)Z.url=w;if(F?.refuseMisplaced)d2(Z.headers,x.headers);if(A(x.scope,Object.entries(Z.headers)),F)P.add(x.key)})})},G2));let r=X.rewriteWebSocketFrame?.bind(X);if(r)j2.push(await $.session.hook("experimental.ws.send",async(Z)=>{let j=_2(Z);if(F&&!P.has(x2(j.sessionID,j.kind)))return;let N=c(j.sessionID,j.kind),x=await r({...j,attempt:N?.attempt,frame:Z.frame});if(x!==void 0)Z.frame=x},G2));j2.push(await $.session.hook("experimental.ws.receive",(Z)=>{if(F&&!P.has(x2(Z.sessionID,Z.kind)))return;let j=c(Z.sessionID,Z.kind);if(!j)return;try{B2(j,"ws",Z.frame)}catch(N){Q("opencode2 auth frame inspection threw",{error:B(N)})}},G2)),j2.push(await $.session.hook("retry",async(Z)=>{if(F&&R.get(Z.sessionID)!==!0)return;let j=Z.decision,N=()=>i("retry",{sessionID:Z.sessionID,attempt:Z.attempt,reason:"host-decides",hostDecision:j,decision:j});if(D(Z.sessionID)){await N();return}let x=e(Z.sessionID);if(!x)return;if(x==="ambiguous"){await i("retry",{sessionID:Z.sessionID,attempt:Z.attempt,reason:"host-decides",hostDecision:j,decision:j});return}let O=x;await _(O.scope,async(u)=>{let w=u;if(D(Z.sessionID)){await N();return}O.judged=!0;let h=O.attempt;if(h&&!O.outputStarted){if(!O.limit){let H2=X.limitFromError?.(Z.error,h);if(H2)Y2(O,H2,"error")}if(O.ended)await O.ended;if(O.limit)await O.limit.delivered}w();let{decision:Z2,reason:S2}=await b(O.scope.sessionID,async()=>{if(w(),D(Z.sessionID))return{decision:j,reason:"host-decides"};let H2=M.get(O.key);if(M.delete(O.key),H2?.next)await y(H2.next);if(w(),D(Z.sessionID))return{decision:j,reason:"host-decides"};let Q2=j,N2,L2,z2;if(O.accountId===void 0||!h)Q2={retry:!1},N2="no-account";else if(O.outputStarted)Q2={retry:!1},N2="output-started";else if(O.limit){let v2={accountId:O.accountId,limit:O.limit.signal},T2,$$={...O.scope,phase:"retry",previousAccountId:O.accountId,rerouteFrom:v2};try{T2=await X.chooseAccount($$)}catch(X$){Q("opencode2 auth chooseAccount threw while the retry hook looked for another account; the host decides the retry",{sessionID:O.scope.sessionID,error:B(X$)})}let q2=typeof T2==="object"?T2.hold:void 0,l2=typeof T2==="string"?T2:q2?O.accountId:void 0;if(l2!==void 0)z2={accountId:l2,input:$$};try{w()}catch(X$){if(z2)await y(z2);throw X$}if(D(Z.sessionID)){if(z2)await y(z2);return{decision:j,reason:"host-decides"}}if(q2&&Number.isFinite(q2.delayMs)&&q2.delayMs>=0)Q2={retry:!0,delay:Math.min(q2.delayMs,T$)},N2="hold";else if(!q2&&l2!==void 0&&l2!==O.accountId)O.rerouted=!0,L2=v2,Q2={retry:!0,delay:0},N2="reroute";else{if(q2&&z2)await y(z2),z2=void 0;N2="host-decides-last-account"}}else N2="host-decides";if(Z.decision=Q2,Q2.retry&&O.accountId!==void 0&&Y.has(O.id))M.set(O.key,{attemptId:O.id,sessionID:O.scope.sessionID,order:++G,accountId:O.accountId,...L2===void 0?{}:{rerouteFrom:L2},...z2===void 0?{}:{next:z2}});else if(z2)await y(z2);return{decision:Q2,reason:N2}});w(),await i("retry",{sessionID:Z.sessionID,...O.accountId===void 0?{}:{accountId:O.accountId},kind:O.scope.kind,attempt:Z.attempt,reason:S2,hostDecision:j,decision:Z2,...h===void 0?{}:{handle:h}})})},G2));let K2=(Z)=>{if(H(Z),R.delete(Z),!S.get(Z)?.foreignSeen)S.delete(Z);for(let j of P)if(JSON.parse(j)[0]===Z)P.delete(j);for(let j of[...Y.values()]){if(j.scope.sessionID!==Z)continue;d(j,"its session was forgotten"),Y.delete(j.id)}for(let[j,N]of M)if(N.sessionID===Z)m(j)},U2=new AbortController,m2=$.event;if(m2)(async()=>{try{for await(let Z of m2.subscribe({signal:U2.signal}))if(Z.type==="session.deleted")K2(Z.data.sessionID);else if(Z.type==="session.status"&&Z.data.status.type==="idle"){let j=Z.data.sessionID,N=++G;b(j,async()=>{for(let[x,O]of M)if(O.sessionID===j&&O.order<N){if(M.delete(x),O.next)await y(O.next)}})}}catch(Z){if(!U2.signal.aborted)Q("opencode2 auth stopped listening for session deletion",{error:B(Z)})}})();return{on(Z,j){let N=a.get(Z);if(!N)N=new Set,a.set(Z,N);let x=j;return N.add(x),()=>{N.delete(x)}},accountFor(Z,j){return J2(x2(Z,j))?.accountId},forgetSession:K2,get size(){return Y.size},async dispose(){if(W2)return;W2=!0;for(let Z of J.keys())H(Z);U2.abort();for(let Z of Y.values())d(Z,"the installation was disposed");Y.clear();for(let Z of M.keys())m(Z);P.clear(),R.clear(),S.clear(),a.clear(),await Promise.all(E.values()),await Promise.all(j2.map(async(Z)=>{try{await Z.dispose()}catch(j){Q("opencode2 auth hook did not dispose cleanly",{error:B(j)})}}))}}}import{createHash as x1}from"node:crypto";import{AnthropicOAuthOriginError as A1,applyCustomHeaders as R1,assertNotCustodyTombstone as k1,classifyGzipRejection as b1,createProviderErrorRedactor as C$,createProviderErrorResponseScope as O$,decideRequestGzip as w1,dumpDirectRequest as E$,dumpRelayRequest as S$,dumpResponseArtifact as u2,encodeGzipRequestBody as D1,getAccountStoragePath as y1,getRequestGzipLatch as I1,getRequestGzipLatchPath as v1,isDumpEnabled as f1,mergeAnthropicBetas as g1,remapModelId as q$,remapRequestBodyModel as h1,setDumpEnabled as x$,stateRefusalCause as m1,stateRefusalPublicMessage as l1,stripEmptyTrailingAssistantMessages as d1,TrailingAssistantHistoryError as u1}from"@cortexkit/anthropic-auth-core";var D2="anthropic",h$="x-common-auth-attempt",p1=["x-session-affinity","x-opencode-session","x-parent-session-id",k$,c2,R2,h$],p2=new Set(["authorization","x-api-key"]),c1="physical send before a response",i1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",o1=512,r1=5000,n1=500,A$=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class m$ extends Error{sessionID;requestKind;kind="no-account";providerID=D2;constructor($,X){super(i1);this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicNoAccountError"}}class Q$ extends Error{sessionID;requestKind;kind="session-forgotten";providerID=D2;constructor($,X){super("request refused: its session was closed while it was being prepared");this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicRevokedError"}}class O2 extends Error{kind="unsupported-transport";providerID=D2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class l$ extends Error{kind="local-invalid-request";status=400;check;constructor($){super($.message,{cause:$});this.name="NativeAnthropicLocalRefusal",this.check=$.check}}class d$ extends Error{kind="state-relocated";providerID=D2;constructor($){super(l1($)??$.message,{cause:$});this.name="NativeAnthropicStateRefusal"}}function i2($){let X=m1($);return X?new d$(X):void 0}var A2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($);function f2($){try{return JSON.parse($)}catch{return}}function j$($){let X={};for(let[z,W]of Object.entries($??{}))X[z.toLowerCase()]=W;return X}function R$($){let X={};for(let z of p1){let W=$.get(z);if(W!==null&&z!==h$)X[z]=W;$.delete(z)}return X}function s1($){try{return new URL($).pathname.endsWith("/messages")}catch{return!1}}function a1($){return $ instanceof u1||$ instanceof b$||$ instanceof A1?new l$($):void 0}function t1($,X){let z=[];if($.oauth)z.push($.oauth.accessToken);for(let[W,F]of Object.entries($.apiHeaders??{})){if(F===null||!p2.has(W))continue;z.push(F.replace(/^Bearer\s+/i,""))}for(let W of p2){let F=X.get(W);if(F!==null)z.push(F.replace(/^Bearer\s+/i,""))}if($.dispatch?.kind==="http-relay")z.push($.dispatch.token);return[...new Set(z.filter(Boolean))]}var e1=new Set(["oauth-2025-04-20","claude-code-20250219",y$]);function $X($){let X=$.split(",").map((z)=>z.trim()).filter((z)=>z&&!e1.has(z));return g1(null,X)}function XX($){let X=f2($);if(!A2(X))return $;let z=d1(X.messages),W=Object.hasOwn(X,"fallbacks"),{droppedMarkers:F}=I$(X,!1),L=W&&!Object.hasOwn(X,"fallbacks"),C=h1(X);return z>0||F>0||L||C?JSON.stringify(X):$}async function ZX($,X){if(!($ instanceof Promise))return"settled";let z;try{return await Promise.race([$.then(()=>"settled"),new Promise((W)=>{z=setTimeout(()=>W("timed-out"),X)})])}finally{if(z!==void 0)clearTimeout(z)}}function y2($){let{source:X,log:z}=$,W=Math.max(1,$.maxPendingSends??o1),F=$.attemptEndTimeoutMs??r1,L=$.requestGzipLatch??I1(v1(y1())),C=new WeakSet,T=new Map,K=new WeakMap,Y=new WeakMap,U=new WeakMap,M=new Map,G=new WeakMap,P=C$([]);P.dispose();let R=(V)=>(V&&M.get(V)?.redactor)??P,S=(V)=>{let H=M.get(V);if(!H)return;M.delete(V),H.redactor.dispose(),H.scope.dispose()},D=(V,H,_,A)=>{let q=t1(H,A),I=O$(q,_);l.set(V,_),M.set(V,{sessionID:H.sessionID,redactor:C$(q),scope:I}),I.settled.then(()=>S(V));while(M.size>W){let f=M.keys().next().value;if(f===void 0)break;S(f)}},l=new WeakMap,v=(V,H)=>{let _=V?l.get(V):void 0;if(!_||!H.ok)return P.redactResponse(H);let A=O$([],_),q=A.redactResponse(H);return A.dispose(),q},n=(V,H)=>{let _=V?M.get(V)?.scope:void 0;if(!_)return v(V,H);try{return _.redactResponse(H)}catch{return v(V,H)}},t=!1,a=new Map,M2=new WeakMap,W2=new WeakMap,J=new WeakMap,Q=(V)=>V.agent==="cachekeep"||V.agent==="prime",B=async()=>{try{if(X.isDumpEnabled)return await X.isDumpEnabled()}catch{return!1}try{return f1()}catch{return!1}},E=(V)=>{a.delete(V)},b=new WeakMap,k=(V,H)=>{if(V&&!H.ok)b.set(H.headers,V);return H},y=(V,H)=>{if(H.dispatch!=="http-relay")return!0;let _=/^req_[A-Za-z0-9_-]+$/.test(V.get("request-id")??"");return Y.set(H,_),_},m=(V)=>new m$(V.sessionID,V.kind),i=new Map,$2=async(V,H)=>{if(t)throw new Q$(V.sessionID,V.kind);let _={revoked:!1},A=i.get(V.sessionID);if(!A)A=new Set,i.set(V.sessionID,A);A.add(_);let q=()=>{if(t||_.revoked)throw new Q$(V.sessionID,V.kind)};try{let I=await H(q);return q(),I}finally{let I=i.get(V.sessionID);if(I?.delete(_)&&I.size===0)i.delete(V.sessionID)}},g=(V,H)=>{T.set(V,H);while(T.size>W){let _=T.keys().next().value;if(_===void 0)break;T.delete(_),z?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:W})}},d=(V,H)=>({providerID:V.providerID,modelID:V.modelID,sessionID:V.sessionID,agent:V.agent,kind:V.kind,accountId:V.accountId,attemptId:V.attemptId,transport:V.transport,route:H.route,provenance:H.provenance,dispatch:H.dispatch}),p=(V)=>$2(V,async(H)=>{let{accountId:_,...A}=V,q;try{q=await X.authorizeAccount(A,_)}catch(I){let f=i2(I);if(f)throw z?.warn("refused an Anthropic request: its account state was moved or could not be recorded",{error:f.cause instanceof Error?f.cause.name:""}),f;throw I}return H(),J2(A,q)}),J2=(V,H)=>{if(!H)throw m(V);if(H.dispatch?.kind==="websocket-relay")throw new O2;let _=H.dispatch?.kind==="http-relay"?"http-relay":"direct",A=H.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":H.dispatch.token}:void 0;if(H.route==="oauth"){if(!H.accessToken)throw m(V);k1(H.accessToken,D2);let f=Object.freeze({route:"oauth",provenance:H.provenance,dispatch:_});g(f,{sessionID:V.sessionID,oauth:{accessToken:H.accessToken,...H.identity?{identity:H.identity}:{}},dispatch:H.dispatch,oauthHeaders:H.headers});let s=j$(H.headers);for(let c of p2)delete s[c];return delete s["anthropic-beta"],{headers:A??{...s,"x-api-key":null,authorization:`Bearer ${H.accessToken}`},attempt:f}}let q={authorization:null,"x-api-key":null,...j$(H.headers)};if(!q.authorization&&!q["x-api-key"])throw m(V);let I=Object.freeze({route:"api",provenance:H.provenance,dispatch:_});return g(I,{sessionID:V.sessionID,...H.baseURL?{baseURL:H.baseURL}:{},dispatch:H.dispatch,apiHeaders:q}),{headers:A??q,attempt:I}},P2=(V)=>$2(V,(H)=>k2(V,H)),k2=async(V,H)=>{let{request:_,attempt:A}=V,q=A.data,I=q?T.get(q):void 0;if(q)T.delete(q);if(!q||!I||q.route==="oauth"&&!I.oauth)throw m(V);let f=new Headers(_.headers);R1(f);let s=R$(f),c=_.body===null?void 0:await _.text();H();let Y2=c!==void 0&&s1(_.url),V2=f$(_.url,I.baseURL!==void 0?{baseURL:I.baseURL}:{}).url?.toString()??_.url;try{if(q.route==="oauth"&&I.oauth){w$(V2);let{accessToken:X2,identity:e}=I.oauth;for(let[j2,r]of Object.entries(j$(I.oauthHeaders))){if(p2.has(j2))continue;if(r===null)f.delete(j2);else f.set(j2,r)}let G2=null;if(c!==void 0&&Y2){let j2={...d(A,q),modelID:(()=>{let U2=f2(c);return q$(A2(U2)&&typeof U2.model==="string"?U2.model:V.modelID)})(),route:"oauth",correlation:s},r=await X.requestOptions?.(j2)??{};if(H(),A.agent!=="cachekeep")c=await g$(c,{...r,...e?{identity:e}:{},sessionId:V.sessionID,onToolNameMap:(U2)=>U.set(q,U2)});let K2=f2(c);G2=A2(K2)?K2:null}v$(f,X2,{body:G2,...e?{identity:e}:{},requestClass:D$(A.agent)?"auxiliary":"main"})}else{if(c!==void 0&&Y2)c=XX(c);f.delete("authorization"),f.delete("x-api-key");for(let[e,G2]of Object.entries(I.apiHeaders??{}))if(G2===null)f.delete(e);else f.set(e,G2);if(c!==void 0&&Y2&&!f.has("content-type"))f.set("content-type","application/json");let X2=f.get("anthropic-beta");if(X2!==null){let e=$X(X2);if(e)f.set("anthropic-beta",e);else f.delete("anthropic-beta")}}}catch(X2){let e=a1(X2);if(!e)throw X2;throw K.set(q,e.check),z?.warn("refused an Anthropic request locally; nothing was sent",{check:e.check}),e}let B2=c!==void 0?f2(c):void 0;if(await X.admitRequest?.({...d(A,q),modelID:q$(A2(B2)&&typeof B2.model==="string"?B2.model:V.modelID)}),R$(f),c!==void 0)f.delete("content-length");if(H(),D(q,I,A2(B2)&&B2.stream===!0?"event-stream":"http",f),q.route==="oauth"&&Y2&&c!==void 0)await X.onRequestPrepared?.({...d(A,q),url:V2,bodyText:c}),H();if(I.dispatch?.kind==="http-relay"){let X2=c??"";f.delete("x-relay-token");let e={protocol:1,type:"request",affinity:V.sessionID,upstream:{url:V2,method:_.method,headers:Object.fromEntries(f)},mode:"full_sync",revision:1,body:X2,next_hash:`sha256:${x1("sha256").update(X2).digest("hex")}`};if(Y2&&c!==void 0&&!Q(A)){let G2=s[R2]==="1"?"start":void 0,j2=JSON.stringify(e);a.set(q,{affinity:V.sessionID,route:V.accountId,bodyText:X2,url:V2,method:_.method,headers:new Headers(f),dispatch:"http-relay",relayUrl:I.dispatch.url,envelope:e,relayBytes:j2.length,...G2?{tag:G2}:{}})}else E(q);return new Request(I.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":I.dispatch.token},redirect:"error",signal:_.signal,body:JSON.stringify(e)})}let F2=c;if(q.route==="oauth"&&Y2&&c!==void 0){let X2=await w1({url:V2,body:c,latch:L});if(H(),X2.gzip)F2=await D1(c),f.set("content-encoding","gzip"),C.add(q),H()}if(Y2&&c!==void 0&&!Q(A)){let X2=s[R2]==="1"?"start":void 0;a.set(q,{affinity:V.sessionID,route:V.accountId,bodyText:c,url:V2,method:_.method,headers:new Headers(f),dispatch:"direct",...X2?{tag:X2}:{}})}else E(q);return new Request(V2,{method:_.method,headers:f,redirect:q.route==="oauth"?"error":_.redirect,signal:_.signal,...F2!==void 0?{body:F2}:{}})};return{adapter:{providerID:D2,chooseAccount:(V)=>$2(V,async()=>{let H=await X.chooseAccount(V);if(typeof H==="object"&&V.phase==="retry")return H;if(typeof H!=="string"||!H)throw m(V);return H}),dropChoice:(V)=>X.dropChoice?.(V),accountHeaders:p,rewriteRequest:P2,rewriteHandshakeURL(){throw new O2},async rewriteResponse({response:V,attempt:H}){let _=H.data;if(_&&!y(V.headers,_)){if(_)E(_);if(V.status===401)return S(_),V.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return n(_,V)}if(_&&C.has(_))C.delete(_),b1(V).then((r)=>{if(!r)return;L.latchProcess(),z?.warn("gzipped request body rejected; later requests go uncompressed",{kind:r,status:V.status})},()=>{});let A=null,q=_?a.get(_):void 0;if(_&&q){let r=!1;try{r=await B()}catch{r=!1}if(!r)E(_);else{try{x$(!0)}catch{}try{if(q.dispatch==="http-relay")A=await S$({affinity:q.affinity,transport:"http",protocol:1,mode:"full_sync",status:V.status,bodyText:q.bodyText,payload:q.envelope??{},relayBytes:q.relayBytes??0,...q.tag?{tag:q.tag}:{}});else A=await E$({affinity:q.affinity,route:q.route,status:V.status,bodyText:q.bodyText,url:q.url,method:q.method,headers:q.headers,...q.tag?{tag:q.tag}:{}})}catch{A=null}if(E(_),A){M2.set(_,A);try{await u2(A,{status:V.status,message:null,complete:!1})}catch{}J.set(_,Promise.resolve())}}}let I=n(_,V);if(_?.route!=="oauth"||!I.body)return k(_,I);let f={...d(H,_),status:V.status},s=X.responseOptions?.(f)??{},c=(V.headers.get("content-type")??"").includes("application/json"),Y2={...s,toolNameMap:_?U.get(_):void 0,onToolNameRefusal:()=>{if(!_)return;K.set(_,"response_tool_names"),S(_)},laneStartOAuthServed:!0,...c?{responseMode:"json"}:{}};if(!_||!A)return k(_,V$(I,Y2));let V2=A,B2=V.status,F2=(r)=>{let U2=(J.get(_)??Promise.resolve()).then(()=>r().then(()=>{return})).catch(()=>{return});J.set(_,U2)},X2=s.onMessageStart,e=s.onMessageDelta,G2=s.onMessageResponse,j2=s.onStreamEnd;return k(_,V$(I,{...Y2,onMessageStart:(r)=>{try{X2?.(r)}catch{}try{W2.set(_,{...r}),F2(()=>u2(V2,{status:B2,message:r,complete:!1}))}catch{}},onMessageDelta:(r)=>{try{e?.(r)}catch{}try{let K2=W2.get(_)??{},U2=K2.usage&&typeof K2.usage==="object"&&!Array.isArray(K2.usage)?K2.usage:{},m2={...K2,...r.usage?{usage:{...U2,...r.usage}}:{},...r.stopReason?{stop_reason:r.stopReason}:{}};F2(()=>u2(V2,{status:B2,message:m2,complete:!0}))}catch{}},onMessageResponse:(r)=>{try{G2?.(r)}catch{}try{F2(()=>u2(V2,{status:B2,message:r,complete:!0}))}catch{}},onStreamEnd:async()=>{try{await j2?.()}catch{}try{await(J.get(_)??Promise.resolve())}catch{}}}))},quotaFromHeaders(V,H,_){let A=_.data;if(!A||!y(V,A))return;return X.quotaFromHeaders?.(V,{...d(_,A),status:H})},async limitFromResponse({status:V,headers:H,body:_,attempt:A}){let q=A.data;if(!q||K.get(q)==="response_tool_names")return;if(!y(H,q))return X.limitFromRelayFailure?.({...d(A,q),status:V});if(G.set(q,`provider responded with HTTP ${V}`),!X.limitFromResponse)return;let I=b.get(H)===q,f=R(q);return X.limitFromResponse({...d(A,q),status:V,headers:H,body:async()=>I?await _():f.redactText(await _())})},inspectEvent({data:V,event:H,attempt:_}){if(_.data&&K.get(_.data)==="response_tool_names")return;let A=f2(V);if(!A2(A))return;let q=typeof A.type==="string"?A.type:H;if(q==="content_block_start"||q==="content_block_delta")return{outputStarted:!0};if(q==="message_stop")return{done:!0};if(q!=="error")return;let I=_.data,f=R(I),s=A2(A.error)?A.error:{},c=typeof s.type!=="string"?void 0:A$.has(s.type)?s.type:f.redactText(s.type),Y2=typeof s.message==="string"?f.redactText(s.message):void 0;if(I?.dispatch==="http-relay"&&Y.get(I)===!1)return;let V2=I?X.limitFromStreamError?.({...d(_,I),errorType:c,message:Y2}):void 0,B2={error:[c??"error",Y2].filter(Boolean).join(": ").slice(0,n1),...V2?{limit:V2}:{}};if(I&&B2.error)G.set(I,B2.error);return B2},limitFromError(V,H){let _=H.data;if(!_||K.has(_))return;let A={type:A$.has(V.type)?V.type:"provider_error",message:G.get(_)??"provider request failed",...V.status!==void 0?{status:V.status}:{}};if(S(_),_.dispatch==="http-relay"&&Y.get(_)===!1)return;return X.limitFromHostError?.(A,d(H,_))},async onAttemptEnd(V,H){let _=V.data;if(!_)return;T.delete(_);let A=a.get(_);if(A){E(_);try{if(await B()){try{x$(!0)}catch{}try{if(A.dispatch==="http-relay"){if(H.status!==void 0)await S$({affinity:A.affinity,transport:"http",protocol:1,mode:"full_sync",status:H.status,bodyText:A.bodyText,payload:A.envelope??{},relayBytes:A.relayBytes??0,...A.tag?{tag:A.tag}:{}})}else await E$({affinity:A.affinity,route:A.route,status:H.status,error:H.status===void 0?c1:void 0,bodyText:A.bodyText,url:A.url,method:A.method,headers:A.headers,...A.tag?{tag:A.tag}:{}})}catch{}}}catch{}}let q=H.error?.reason;if(q==="cancelled"||q==="abandoned"||q===void 0&&(H.status===void 0||H.status<400))S(_);let I=K.get(_),{status:f,...s}=H,c=X.onAttemptEnd?.(d(V,_),{...s,...f!==void 0&&(_.dispatch!=="http-relay"||Y.get(_)===!0)?{status:f}:{},...I!==void 0?{localRefusal:{check:I}}:{}});if(await ZX(c,F)==="timed-out")z?.warn("the account source did not finish recording a send",{timeoutMs:F})}},dispose(){t=!0;for(let[V,H]of i){for(let _ of H)_.revoked=!0;X.forgetSession?.(V)}i.clear(),T.clear(),a.clear();for(let V of[...M.keys()])S(V)},forgetSession(V){for(let H of i.get(V)??[])H.revoked=!0;i.delete(V);for(let[H,_]of T)if(_.sessionID===V)T.delete(H);for(let[H,_]of[...M])if(_.sessionID===V)S(H);for(let[H,_]of[...a])if(_.affinity===V)a.delete(H);X.forgetSession?.(V)},get pendingSendCount(){return T.size},get heldCredentialCount(){let V=0;for(let H of T.values())if(H.oauth)V++;return V},get heldRedactorCount(){return M.size},get operationsInProgress(){let V=0;for(let H of i.values())V+=H.size;return V}}}import{CacheKeepManager as JX,CacheKeepSessionRegistry as YX,getDefaultCacheKeepRegistryDirectory as GX,isCacheKeepActiveNow as u$,isCacheKeepHybridActive as W$,isCacheKeepSubagentsEnabled as B$,logger as z$,NativeAccountRefusal as E2,nativeAccountRefusal as jX}from"@cortexkit/anthropic-auth-core";function g2($){return JSON.stringify([$.source,$.accountIdentity,$.credentialId,$.binding?.storageId,$.binding?.rowId,$.binding?.credentialEpoch])}var p$=Symbol.for("cortexkit.anthropic-auth.opencode2.cachekeep.v1");function c$(){let $=globalThis;return $[p$]??=new Map,$[p$]}function VX($,X){let z=new Map,W=new Map,F=new YX({directory:X.registryDirectory||process.env.OPENCODE_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR||GX("opencode"),now:X.now}),L=()=>{let G;for(let P of W.values())G=P;return G},C=X.setIntervalImpl??globalThis.setInterval,T=new JX({loadStorage:async()=>{let G=L();return G?G.loadStorage():null},now:X.now,setIntervalImpl:(G,P)=>C(()=>{let R=T.tick();return M.ticking=R.catch(()=>{z$.warn("cachekeep","tick failed")}),M.ticking},P),clearIntervalImpl:X.clearIntervalImpl,onTrackedSessionsChanged:(G)=>F.publish(W.size===0?[]:G),prepareHeaders(G,P,R){let S=L();if(!S)return;return z.set(R.id,{target:P,attempt:R,lease:S}),new Headers({"x-native-cachekeep-attempt":String(R.id)})},fetchImpl:async(G,P)=>{let R=new Request(G,P),S=Number(R.headers.get("x-native-cachekeep-attempt")),D=z.get(S);if(z.delete(S),!D||D.lease.stopped)throw Error("CacheKeep attempt is unavailable");let l=D.lease.send(D.target,R,D.attempt.signal),v=l.then(()=>{},()=>{});return D.lease.inflight.add(v),v.then(()=>D.lease.inflight.delete(v)),l},onComplete:({attempt:G})=>{z.delete(G.id)}}),K,Y=()=>{if(K!==void 0)clearTimeout(K);K=void 0},U=()=>{if(Y(),W.size>0)return;let G=T.dropExpiredTargets();if(G===void 0){let R=c$();if(R.get($)===M)R.delete($);return}let P=X.now?.()??Date.now();if(K=setTimeout(U,Math.max(0,G-P)),typeof K==="object"&&"unref"in K)K.unref()},M={manager:T,registry:F,prepared:z,leases:W,nextGeneration:0,retain(){T.stop(),z.clear(),U()},adopt(){if(Y(),T.dropExpiredTargets()===void 0)return;T.start(),F.publish(T.trackedSessions()).catch(()=>{z$.warn("cachekeep","failed to publish tracked sessions")})}};return M}function i$($){let{runtime:X,source:z}=$,W=new AbortController,F=c$(),L=F.get($.storageId)??VX($.storageId,$);F.set($.storageId,L);let{manager:C,registry:T}=L,K=async(G,P,R)=>{let S=R?AbortSignal.any([W.signal,R]):W.signal;S.throwIfAborted();let D=JSON.parse(await P.text()),l={providerID:"anthropic",modelID:D.model,sessionID:`oc2-cachekeep:${G.id}`,agent:"cachekeep",kind:"generate"},v=(J)=>{throw new E2(J)},n=y2({source:{...z,onRequestPrepared:void 0,responseOptions:void 0,async requestOptions(J){return{...await z.requestOptions?.(J,v),laneStart:!1,billingLineage:void 0,cacheDiagnosticsPreviousMessageId:void 0}},async authorizeAccount(J,Q){let B=await X.read();S.throwIfAborted();let E=B.accounts.find((k)=>k.id===Q);if(E?.type!=="oauth")throw new E2("account-unavailable");if(g2(E)!==G.oauthAccountIdentity)throw new E2("credential-changed");if(G.isSubagent&&!B$(B.policyStorage)||!W$(B.policyStorage)||!u$(B.policyStorage,new Date($.now?.()??Date.now())))return;let b=await z.authorizeAccount(J,Q,v);if(b?.provenance.kind==="local"&&g2({...E,binding:b.provenance.subject.binding,accountIdentity:b.provenance.subject.binding.identity})!==G.oauthAccountIdentity)throw new E2("credential-changed");if(b?.provenance.kind==="vault"&&b.provenance.credentialId!==E.credentialId)throw new E2("credential-changed");return b},async admitRequest(J){await z.admitRequest?.(J,v);let Q=await X.read(),B=Q.accounts.find((E)=>E.id===J.accountId);if(S.throwIfAborted(),!B)throw new E2("account-unavailable");if(g2(B)!==G.oauthAccountIdentity)throw new E2("credential-changed");if(G.isSubagent&&!B$(Q.policyStorage)||!W$(Q.policyStorage)||!u$(Q.policyStorage,new Date($.now?.()??Date.now())))throw Error("CacheKeep policy changed before dispatch")}}}),t,a,M2=!1,W2=()=>n.forgetSession(l.sessionID);S.addEventListener("abort",W2,{once:!0});try{let J=await X.read(),Q=J.accounts.find((m)=>g2(m)===G.oauthAccountIdentity)?.id;if(!Q)throw new E2(J.accounts.some((m)=>m.id===G.oauthAccountId)?"credential-changed":"account-unavailable");let B=await n.adapter.accountHeaders({...l,accountId:Q});if(!("headers"in B)||typeof B.headers!=="object"||B.headers===null||typeof B.attempt!=="object"||B.attempt===null||B.attempt.route!=="oauth")throw Error("CacheKeep authorization refused");t={...l,accountId:Q,attemptId:crypto.randomUUID(),transport:"http",data:B.attempt};let E=await n.adapter.rewriteRequest?.({...l,accountId:Q,attempt:t,request:new Request(G.url,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(D),signal:S})});if(!E)throw Error("CacheKeep rewrite refused");S.throwIfAborted();let b=await($.fetch??fetch)(E),k=await n.adapter.rewriteResponse?.({...l,accountId:Q,attempt:t,request:E,response:b});if(!k)throw Error("CacheKeep response rewrite refused");if(a=k.status,n.adapter.quotaFromHeaders?.(k.headers,k.status,t),!k.ok)await n.adapter.limitFromResponse?.({status:a,headers:k.headers,body:()=>k.clone().text(),attempt:t});let y=await k.arrayBuffer();return M2=!0,new Response(y,{status:a,headers:k.headers})}catch(J){let Q=jX(J);if(Q)throw Q;throw Error("Native CacheKeep was not completed")}finally{S.removeEventListener("abort",W2);try{if(t)await n.adapter.onAttemptEnd?.(t,{status:a,outputStarted:!1,...M2?{}:{error:{reason:"cancelled"}}})}finally{n.dispose(),z.forgetSession?.(l.sessionID)}}},Y={generation:L.nextGeneration++,stopped:!1,loadStorage:async()=>(await X.read()).policyStorage,send:K,inflight:new Set},U=L.leases.size===0;if(L.leases.set(Y.generation,Y),U)L.adopt();let M;return{async track(G){let P=(v)=>{z$.debug("cachekeep","tracking skipped",{session:G.sessionID,reason:v})};if(Y.stopped)return P("lease-stopped");if(G.route!=="oauth")return P("not-oauth");if(G.agent==="cachekeep"||G.agent==="prime")return P("background-agent");if(G.kind!=="primary")return P("not-primary");let R=await X.read();if(Y.stopped)return P("lease-stopped");if(!W$(R.policyStorage))return P("hybrid-inactive");let S=!1;try{S=await $.isSubagent?.(G.sessionID)??!1}catch{return P("session-lookup-failed")}if(Y.stopped)return P("lease-stopped");if(S&&!B$(R.policyStorage))return P("subagents-disabled");let D=R.accounts.find((v)=>v.id===G.accountId);if(!D?.accountIdentity)return P("account-identity-missing");if(G.provenance.kind==="local"&&JSON.stringify(D.binding)!==JSON.stringify(G.provenance.subject.binding))return P("local-binding-changed");if(G.provenance.kind==="vault"&&D.credentialId!==G.provenance.credentialId)return P("vault-credential-changed");let l=C.track({sessionId:G.sessionID,url:G.url,headers:new Headers,bodyText:G.bodyText,storage:R.policyStorage,cacheMode:"hybrid",oauthAccountId:G.accountId,oauthAccountIdentity:g2(D),isSubagent:S});return await T.publish(C.trackedSessions()),l},registry:T,dispose(){if(M)return M;Y.stopped=!0,W.abort();for(let[P,R]of L.prepared)if(R.lease===Y)L.prepared.delete(P);let G=L.leases.delete(Y.generation)&&L.leases.size===0;if(G)L.retain();return M=(async()=>{try{if(G)await L.ticking;await Promise.all(Y.inflight)}finally{if(G&&L.leases.size===0)await T.dispose()}})(),M}}}async function o$($,X,z){let W=y2(X),F=[],L=async(G,P,R)=>{let S=await $.session.hook(G,P,R);return F.push(S),S},C=new AbortController,T;try{T=await G$({session:{hook:L},event:$.event},W.adapter,{logger:X.log,gateOnPlaceholder:z})}catch(G){throw W.dispose(),await Promise.allSettled(F.map((P)=>P.dispose())),G}let K=(G)=>{W.forgetSession(G),T.forgetSession(G)},Y=$.event,U=Y?(async()=>{try{for await(let G of Y.subscribe({signal:C.signal}))if(G.type==="session.deleted")K(G.data.sessionID)}catch(G){if(!C.signal.aborted)X.log?.warn("stopped listening for session deletion",{error:G instanceof Error?G.name:"unknown"})}})():Promise.resolve(),M;return{installation:T,forgetSession:K,dispose(){if(M)return M;return W.dispose(),C.abort(),M=(async()=>{await T.dispose(),await U})(),M}}}import{effectiveRelayTransport as r$,getQuotaCheckIntervalMs as QX,logger as WX,nativeAccountCanServe as BX,oauthProfileIsFresh as zX,quotaSnapshotCheckedAt as UX}from"@cortexkit/anthropic-auth-core";function n$($,X){let z=new AbortController,W,F=!1,L=async()=>{let K=await $.read();if(z.signal.throwIfAborted(),K.policyStorage.relay?.enabled===!0&&r$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="websocket")return;let Y=K,U=QX(Y.policyStorage);for(let M of Y.accounts){if(z.signal.aborted)return;if(!BX(M)||M.type!=="oauth")continue;if(Y.policyStorage.quota?.enabled!==!1&&Date.now()-UX(M.quota)>=U)await $.fetchQuota(M.id,X,z.signal,void 0,"background").catch(()=>{});if(!zX(M.profile)&&!z.signal.aborted)await $.fetchProfile(M.id,X,z.signal).catch(()=>{})}},C=()=>{if(F||W)return W;return W=L().catch(()=>{if(!z.signal.aborted)WX.debug("opencode2","native background readings did not complete")}).finally(()=>{W=void 0}),W},T=$.vault.watch({intervalMs:60000,onRefresh:C,shouldRefresh:async()=>{let K=await $.read();return K.policyStorage.relay?.enabled!==!0||r$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="http"}});return T.ready.catch(()=>{}),{async dispose(){F=!0,T.close(),z.abort(),await W}}}import{authorize as EX,buildCacheKeepStatusSummary as SX,buildClaudeQuotaSummary as qX,buildPrimeAccountStatuses as xX,buildPrimeStatusSummary as AX,CLAUSTRUM_OPENCODE_ENROLLMENT_NAME as RX,effectiveRelayTransport as kX,exchange as bX,formatNativeAccountState as wX,formatOAuthAccountTier as DX,getCacheKeepWindow as yX,getHostClaustrumEnrollmentPaths as IX,isCacheKeepAlways as vX,isCacheKeepHybridActive as fX,isCacheKeepPersistentlyEnabled as gX,nativeAccountCanServe as hX,parseLogLevel as mX,resetClaustrumEnrollmentState as lX,setDumpEnabled as dX}from"@cortexkit/anthropic-auth-core";import{buildPrimeAccountStatuses as KX,effectiveRelayStatus as MX,formatNativeAccountState as HX,formatOAuthAccountTier as s$,getCacheKeepWindow as _X,getRoutingMode as NX,isCacheKeepAlways as LX,isCacheKeepHybridActive as FX,isPermanentRefreshError as PX,isPrimePersistentlyEnabled as TX,nativeAccountCanServe as e$,refreshBackoffActive as a$}from"@cortexkit/anthropic-auth-core";var t$=($)=>e$($)&&$.state!=="unsupported-access"?void 0:HX($)||void 0,CX=($)=>{if($.source!=="vault")return"off";if($.state==="needs_reauth")return"on-vault-reauth";return e$($)?"on-vault-served":"on-cold"},OX=($,X)=>typeof $==="number"&&$>X;function $1($,X){let{now:z}=X,W=$.policyStorage,F=$.accounts.filter((U)=>U.type==="oauth"),L=F.find((U)=>U.id==="main"),C=L?t$(L):void 0,T=L?.lastQuotaRefreshError?.nextRetryAt,K=L?.lastRefreshError,Y=_X(W);return o2({main:{quota:L?.quota??null,enabled:L?.enabled,tierLabel:s$(L?.profile),quotaBackedOff:OX(T,z),quotaBackoffUntil:T,refreshBackedOff:a$(K,L?.accountIdentity,z,void 0),refreshBackoffUntil:K?.nextRetryAt,stateLine:C,quotaDated:Boolean(C)},fallbacks:F.filter((U)=>U.id!=="main"&&(U.enabled||U.source==="vault")).map((U)=>{let M=t$(U),G=CX(U);return{id:U.id,label:U.label,quota:U.quota??null,enabled:U.enabled,tierLabel:s$(U.profile),needsReauth:PX(U.lastRefreshError)&&a$(U.lastRefreshError,U.accountIdentity,z,void 0),...G==="on-vault-reauth"?{vaultReauth:!0}:{},...G==="on-vault-served"?{vaultServed:!0}:{},...G!=="off"?{custodyState:G}:{},stateLine:M,quotaDated:Boolean(M)}}),...X.activeId!==void 0&&{activeId:X.activeId},route:NX(W),relay:MX(W.relay),fastMode:W.claudeFast?.enabled===!0,cacheKeep:{enabled:FX(W),...LX(W)?{window:"always"}:Y&&{window:`${Y.startHour}-${Y.endHour}`},trackedSessions:X.trackedSessions},prime:TX(W)?{enabled:!0,accounts:KX(W,{now:z})}:void 0,lastUpdated:z})}var U$=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{},X1=`For first-time model access, connect Anthropic with "${s2}".
-Run: opencode auth login anthropic --method ${n2}`,uX="No Claude accounts in the vault for this host yet. Add one with `ck auth login --provider anthropic`, then grant it to this host.",Z1="The vault returned an account this plugin cannot use yet.";async function pX($){let X=new AbortController,z;try{return await Promise.race([$.vault.refresh(X.signal).then(()=>"complete",()=>"failed"),new Promise((W)=>{z=setTimeout(()=>{W("pending"),X.abort()},2000)})])}finally{clearTimeout(z)}}var J1=($)=>$.mode==="local"&&!$.accounts.some((X)=>X.id==="main"),cX=($)=>{let X=$.id==="main"?"main":"fallback",z=`${$.enabled?"enabled":"disabled"}, ${$.type}, ${$.source}${$.state?`, ${wX($)}`:""}`;if($.label)return`${$.label} [${X}]: ${z}
-  Route: ${$.id}`;return`${X==="main"?"Main account":`Fallback ${$.id}`}: ${z}`};function Y1($){let{runtime:X,source:z}=$,W=new Map,F=!1,L=async(Y,U)=>{await X.updateSettings((M)=>({...M,[Y]:{...U$(M[Y]),...U}}))},C=()=>({ok:!0,text:"Native Claude settings updated."}),T=async(Y,U)=>{if(F)throw Error("Native menu is closed");switch(U.signal?.throwIfAborted(),Y.action){case"enable":case"disable":return await X.setEnabled(Y.values.id,Y.action==="enable"),C();case"remove":return await X.remove(Y.values.id),C();case"move-up":case"move-down":{let G=(await X.read()).accounts.map((l)=>l.id),P=G.indexOf(Y.values.id),R=P+(Y.action==="move-up"?-1:1);if(P<0||R<0||R>=G.length)return{ok:!1,text:"Account cannot move in that direction."};let S=G[P],D=G[R];if(S===void 0||D===void 0)return{ok:!1,text:"Account order changed."};return G[P]=D,G[R]=S,await X.reorder(G),C()}case"add-apikey":return await X.addApi(Y.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let M=new AbortController;W.get(Y.sessionId)?.active.abort();let G={active:M,auth:void 0};W.set(Y.sessionId,G);let P=await EX("max");if(F||M.signal.aborted||U.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return G.auth=P,{ok:!0,text:`Open ${P.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let M=W.get(Y.sessionId);if(!M?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let G=await bX(Y.values.code,M.auth.verifier,M.auth.redirectUri,M.auth.state);if(M.active.signal.throwIfAborted(),U.signal?.throwIfAborted(),F||G.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await X.loginOAuth({routeId:crypto.randomUUID(),credential:{access:G.access,refresh:G.refresh,expires:G.expires},label:Y.values.label}),M.active.signal.throwIfAborted(),U.signal?.throwIfAborted(),F)return{ok:!1,text:"Sign-in cancelled."};W.delete(Y.sessionId);let P="OAuth account stored in the native account pool.";return{ok:!0,text:J1(await X.read())?`${P}
+import{a as t2,b as y1,c as v1,d as m0,e as l0,f as G0,g as I2,h as d0,i as u0,j as p0,k as g1,l as c0,m as i0,n as o0,o as n0,p as F0,q as u1}from"../index-y35yxsnq.js";import"../index-sg0knfec.js";import"../index-hc7bm3yf.js";import{v as l1}from"../index-61bbefpq.js";import{w as Y0,x as V0,z as m1}from"../index-m4dazzyf.js";import"../index-naff9h33.js";import{J as X0}from"../index-j2cv839v.js";import"../index-gvswxab8.js";import"../index-71temqvq.js";import{acquireNativeAccountRuntime as J5,assertUnmanagedInjectedPaths as X5,authorize as G5,createNativeUi as Y5,decideOpenCodeStateLayoutOnce as V5,disconnectNativeVaultForHost as Q5,exchange as W5,getPersistedLogLevel as U5,isDumpPersistentlyEnabled as B5,logger as S0,openCodeHolderKind as z5,readNativeEnrollmentMode as M5,registerNativePoolHolder as K5,resolveNativePoolPaths as H5,setDumpEnabled as N5,setLogLevel as _5,stateLayoutIoFailure as L5,unmovedRegistrationPolicy as F5}from"@cortexkit/anthropic-auth-core";class f2 extends Error{kind;providerID;sessionID;requestKind;constructor($){super($.message??`${$.providerID} ${$.requestKind} request refused (${$.kind})`);this.name="OpenCode2AuthError",this.kind=$.kind,this.providerID=$.providerID,this.sessionID=$.sessionID,this.requestKind=$.requestKind}}function k2($){return`common-auth-placeholder.${$}`}function R0($){let Z=k2($.integrationID);return{type:"oauth",methodID:$.methodID,access:Z,refresh:Z,expires:$.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function M0($,Z){if($?.type!=="oauth")return!1;let V=Z===void 0?void 0:k2(Z),Y=(M)=>V===void 0?M.startsWith("common-auth-placeholder."):M===V;return Y($.access)&&Y($.refresh)}var b0="No browser sign-in: this connects the plugin to the accounts in its vault.";async function K0($,Z){let V=Z.now??Date.now,{integrationID:Y}=Z,M=(C)=>R0({integrationID:Y,methodID:C,now:V()}),_=async(C,N)=>{return await Z.onLogin(C,{integrationID:Y,methodID:N}),M(N)},O=(C)=>async(N)=>{let X=C.method.id,B=await C.authorize(N),z={url:B.url,instructions:B.instructions,...B.expiresAt===void 0?{}:{expiresAt:B.expiresAt}};if(B.mode==="auto")return{...z,mode:"auto",callback:B.callback.then((L)=>_(L,X))};let F=B.callback;return{...z,mode:"code",callback:async(L)=>_(await F(L),X)}};return $.integration.transform((C)=>{let N=Z.label===void 0?{}:{label:()=>Z.label};for(let z of Z.methods)C.method.update({integrationID:Y,method:z.method,authorize:O(z),refresh:async(F)=>{if(!M0(F,Y))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return M(F.methodID)},...N});let X=Z.vault;if(X===void 0)return;let B=X.method.id;C.method.update({integrationID:Y,method:X.method,authorize:async()=>({url:"",instructions:X.instructions??b0,mode:"auto",callback:Promise.resolve().then(()=>X.activate({integrationID:Y,methodID:B})).then(()=>M(B))}),refresh:async(z)=>{if(!M0(z,Y)||z.methodID!==B)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return M(B)},...N})})}function p1($){let Z=[],V;for(let Y of $.split(/\r?\n/))if(Y.startsWith("data:"))Z.push(Y.slice(5).replace(/^ /,""));else if(Y.startsWith("event:"))V=Y.slice(6).trim();if(Z.length===0)return;return V===void 0?{data:Z.join(`
+`)}:{event:V,data:Z.join(`
+`)}}function H0($,Z){let V=new TextDecoder,Y="",M=(O)=>{let C=p1(O);if(!C)return;try{$(C)}catch(N){Z(N)}},_=()=>{for(;;){let O=/\r?\n\r?\n/.exec(Y);if(!O)return;let C=Y.slice(0,O.index);Y=Y.slice(O.index+O[0].length),M(C)}};return new TransformStream({transform(O,C){C.enqueue(O),Y+=V.decode(O,{stream:!0}),_()},flush(){if(Y+=V.decode(),_(),Y.trim()!=="")M(Y);Y=""}})}var A0=512,w0=1200000,v2="x-common-auth-attempt",w2=($,Z)=>JSON.stringify([$,Z]),E2=($)=>({providerID:$.model.providerID,modelID:$.model.id,sessionID:$.sessionID,agent:$.agent,kind:$.kind});function c1($){let Z=$.headers;return typeof Z==="object"&&Z!==null}function i1($,Z){let V=$.getReader();return new ReadableStream({async pull(Y){let M;try{M=await V.read()}catch(_){Z({reason:"failed",message:_ instanceof Error?_.message:String(_)}),Y.error(_);return}if(M.done)Z(),Y.close();else Y.enqueue(M.value)},async cancel(Y){Z({reason:"cancelled",...Y===void 0?{}:{message:String(Y)}}),await V.cancel(Y)}})}function r2($,Z){for(let[V,Y]of Object.entries(Z)){let M=V.toLowerCase();for(let _ of Object.keys($))if(_.toLowerCase()===M)delete $[_];if(Y!==null)$[V]=Y}}function o1($,Z){for(let[V,Y]of Object.entries(Z))if(Y===null)$.delete(V);else $.set(V,Y)}async function N0($,Z,V={}){let{providerID:Y}=Z,M=V.gateOnPlaceholder,_=(j)=>M===void 0||M.credential(j)===k2(Y),O=V.logger,C=Math.max(1,V.maxRecords??A0),N=[...V.hostCredentials??[k2(Y)],...M?[k2(Y)]:[]].filter((j)=>j!==""),X=new Map,B=new WeakMap,z=new Map,F=0,L=new Set,R=new Map,E=new Map,b=(j)=>{let Q=E.get(j);return Q?.ownedSeen===!0&&Q.foreignSeen},w=(j,Q)=>{R.set(j,Q);let P=E.get(j)??{ownedSeen:!1,foreignSeen:!1};if(Q)P.ownedSeen=!0;else P.foreignSeen=!0;E.set(j,P)},f=(j,Q)=>{let P=M?.refuseMisplaced,k=P?[...Q].filter(([,p])=>p.includes(k2(Y))):[],T=_(Q)&&(!P||k.length>0);if(P){if(k.length>0&&(k.length!==1||!T))throw w(j.sessionID,!1),new f2({kind:"placement-refused",providerID:Y,sessionID:j.sessionID,requestKind:j.kind,message:P(k[0]?.[0]??"")})}return w(j.sessionID,T),T},v=!1,i=!1,a=new Map,Y2=0,j2=!1,e=new Map,u=(j,Q)=>{try{O?.warn(j,Q)}catch{}},J=(j)=>j instanceof Error?j.message:String(j),W=new Map,U=(j,Q)=>{let P=(W.get(j)??Promise.resolve()).then(Q),k=P.then(()=>{},()=>{});return W.set(j,k),k.then(()=>{if(W.get(j)===k)W.delete(j)}),P},q=(j,Q)=>{let P=W.get(j);return P?P.then(()=>q(j,Q)):Q()},A=async(j)=>{try{await Z.dropChoice?.({...j.input,accountId:j.accountId})}catch(Q){u("opencode2 auth dropChoice threw; the request is unaffected",{sessionID:j.input.sessionID,error:J(Q)})}},y=async(j)=>{try{await Z.dropSameAccountRetry?.({...j.input,accountId:j.accountId})}catch(Q){u("opencode2 auth dropSameAccountRetry threw; the request is unaffected",{sessionID:j.input.sessionID,error:J(Q)})}},I=async(j)=>{if(j.next)await A(j.next);if(j.sameAccount)await y(j.sameAccount)},n=(j)=>{let Q=z.get(j);if(z.delete(j),Q)U(Q.sessionID,()=>I(Q))},d=async(j,Q)=>{let P=a.get(j);if(!P||P.size===0)return;await Promise.all([...P].map(async(k)=>{try{await k(Q)}catch(T){u("opencode2 auth listener threw; the request is unaffected",{event:j,error:J(T)})}}))},m=async(j,Q)=>{try{await Z.onAttemptEnd?.(j,Q)}catch(P){u("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:j.attemptId,error:J(P)})}},r=(j,Q)=>{if(j.ended||!j.attempt)return;let P={...j.status===void 0?{}:{status:j.status},outputStarted:j.outputStarted,...j.limit?{limit:j.limit.signal}:{},...Q?{error:Q}:{}};if(Q)j.endError=Q;j.ended=m(j.attempt,P)},l=(j,Q)=>r(j,{reason:"abandoned",message:Q}),M2=(j)=>[...X.values()].filter((Q)=>Q.key===j),L2=(j)=>M2(j).at(-1),x2=(j)=>{if(X.delete(j.id),z.get(j.key)?.attemptId===j.id||!M2(j.key).length)n(j.key)},y2=(j)=>{X.set(j.id,j);while(X.size>C){let Q=X.values().next().value;if(Q===void 0)break;l(Q,"dropped to keep the record bound"),x2(Q)}},s=(j)=>j.accountId===void 0?void 0:{...j.scope,accountId:j.accountId},G=(j,Q)=>new f2({kind:"no-account",providerID:Y,sessionID:j.sessionID,requestKind:j.kind,...Q===void 0?{}:{message:Q}}),K=(j)=>{e.get(j)?.clear(),e.delete(j)},H=async(j,Q)=>{let P=()=>G(j,`${Y} ${j.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(j2)throw P();let k=e.get(j.sessionID);if(!k)k=new Set,e.set(j.sessionID,k);let T={};k.add(T);let p=()=>{if(!k.has(T))throw P()};try{return await Q(p)}finally{if(k.delete(T),k.size===0&&e.get(j.sessionID)===k)e.delete(j.sessionID)}},x=(j,Q)=>{for(let[P,k]of Q)if(N.some((T)=>k.includes(T)))throw new f2({kind:"host-credential-on-wire",providerID:Y,sessionID:j.sessionID,requestKind:j.kind,message:`${Y} ${j.kind} request still carries the host's placeholder credential in ${P}; the adapter's account headers must replace it`})},S=(j)=>{for(let Q of M2(j))if(Q.ended||!Q.attempt)x2(Q);else if(Q.transport==="ws"||Q.judged)l(Q,"a newer attempt of its session and kind began"),x2(Q)},g=async(j,Q,P,k)=>{let T=w2(j.sessionID,j.kind),{input:p,accountId:D,sameAccountRetry:c}=await q(j.sessionID,async()=>{P();let U2=z.get(T);z.delete(T);let H2=U2?.accountId??L2(T)?.accountId;S(T);let B2=U2?.next,_2=U2?.sameAccount,G2=_2!==void 0&&_2.input.modelID===j.modelID&&_2.input.agent===j.agent,T2=B2!==void 0&&B2.input.modelID===j.modelID&&B2.input.agent===j.agent,C2={...j,phase:"request",...H2===void 0?{}:{previousAccountId:H2},...U2?.rerouteFrom?{rerouteFrom:U2.rerouteFrom}:{}};if(B2&&!T2)await U(j.sessionID,()=>A(B2)),P();if(_2&&!G2)await U(j.sessionID,()=>y(_2)),P();let O2=G2?_2.accountId:T2?B2.accountId:await Z.chooseAccount(C2);return{input:C2,accountId:typeof O2==="string"?O2:void 0,sameAccountRetry:G2}});P();let X2={},P2;if(D!==void 0){let U2=await Z.accountHeaders({...j,accountId:D});if(P(),c1(U2))X2=U2.headers,P2=U2.attempt;else X2=U2}let o2=`attempt-${++Y2}`,A2={id:o2,key:T,scope:j,accountId:D,headers:X2,attempt:D===void 0?void 0:{...j,accountId:D,attemptId:o2,transport:k,data:P2},...k===void 0?{}:{transport:k},outputStarted:!1,sameAccountRetry:c};if(y2(A2),A2.attempt)d("select",{...j,accountId:A2.attempt.accountId,hook:Q,...p.previousAccountId===void 0?{}:{previousAccountId:p.previousAccountId},...p.rerouteFrom===void 0?{}:{rerouteFrom:p.rerouteFrom},handle:A2.attempt});return A2},h=async(j,Q,P,k,T)=>{let p=w2(j.sessionID,j.kind),D=k===void 0?void 0:X.get(k);if(D?.key!==p)D=void 0;if(!D){if(D=L2(p),M2(p).filter((X2)=>X2.transport===void 0&&!X2.ended).length>1&&!i)i=!0,u("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:j.sessionID,kind:j.kind})}if(!D||D.transport!==void 0||D.ended)D=await g(j,Q,T,P);else if(D.transport=P,D.attempt)D.attempt.transport=P;if(P==="ws"){for(let c of M2(p))if(c!==D&&c.transport==="ws")l(c,"a newer attempt of its session and kind went out over WebSocket")}return D},$2=async(j,Q)=>{try{return await Q()}catch(P){throw r(j,{reason:"failed",message:J(P)}),P}},o=(j,Q)=>{let P=M2(w2(j,Q)).filter((k)=>k.transport==="ws").at(-1);return P?.attempt!==void 0&&!P.ended?P:void 0},V2=(j,Q,P)=>{let k=s(j);if(!k||!j.attempt||j.limit)return;j.limit={signal:Q,delivered:d("limit",{...k,via:P,limit:Q,outputStarted:j.outputStarted,handle:j.attempt})}},z2=(j,Q,P,k)=>{let T=s(j);if(!T||!j.attempt)return;d("quota",{...T,transport:Q,...k===void 0?{}:{status:k},quota:P,handle:j.attempt})},K2=(j,Q,P,k)=>{let T=j.attempt;if(!T)return;let p=Z.inspectEvent?.(k===void 0?{transport:Q,data:P,attempt:T}:{transport:Q,data:P,event:k,attempt:T});if(!p)return;if(p.quota!==void 0)z2(j,Q,p.quota);if(p.outputStarted)j.outputStarted=!0;if(p.limit)V2(j,p.limit,Q);if(p.error!==void 0)r(j,{reason:"failed",message:p.error});else if(p.done)r(j)},q2=(j,Q)=>{let P=j.attempt;if(!P||Q.accountId===j.accountId)return;if(P.reboundFrom??=P.accountId,P.accountId=Q.accountId,"data"in Q)P.data=Q.data;j.accountId=Q.accountId},J2=(j)=>!j.attempt||j.endError!==void 0||j.status!==void 0&&j.status>=400,Z2=(j)=>{let Q=[...X.values()].filter((c)=>c.scope.sessionID===j),P=Q.filter((c)=>c.limit&&!c.rerouted).at(-1);if(P)return P;let k=Q.filter((c)=>c.scope.kind==="primary"),T=k.length>0?k:Q;if(T.length<=1)return T[0];let p=T.filter((c)=>!c.judged&&J2(c)).at(-1);if(p)return p;let D=T.filter((c)=>c.attempt&&!c.ended);if(D.length>1)return"ambiguous";return D[0]??T.at(-1)},Q2={providerID:Y},W2=[];W2.push(await $.session.hook("model.request",(j)=>{if(M)return;return H(E2(j),async(Q)=>{let P=await g(E2(j),"model.request",Q);if(Q(),P.accountId===void 0)throw G(P.scope);r2(j.headers,{...P.headers,[v2]:P.id})})},Q2)),W2.push(await $.session.hook("http.request",(j)=>{if(M){if(!f(E2(j),j.request.headers))return}return H(E2(j),async(Q)=>{let P=j.request.headers.get(v2)??void 0,k=M?await g(E2(j),"http.request",Q,"http"):await h(E2(j),"http.request","http",P,Q);Q();let T=s(k),p=k.attempt;if(!T||!p)throw G(k.scope);await $2(k,async()=>{let D=j.request;if(Z.rewriteRequest){if(P!==void 0){let P2=new Headers(D.headers);P2.delete(v2),D=new Request(D,{headers:P2})}D=await Z.rewriteRequest({...T,request:D,attempt:p})??D,Q()}let c=new Headers(D.headers);c.delete(v2),o1(c,k.headers),x(k.scope,c.entries());let X2=new Request(D,{headers:c});B.set(X2,k),j.request=X2})})},Q2)),W2.push(await $.session.hook("http.response",async(j)=>{let Q=B.get(j.request);if(!Q){if(M)return;if(!v)v=!0,u("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:j.sessionID,kind:j.kind});return}let P=j.response;if(Z.answeredBy&&Q.attempt){let c=Q.attempt,X2=await $2(Q,async()=>Z.answeredBy?.({request:j.request,response:P,attempt:c}));if(X2)q2(Q,X2)}let k=s(Q),T=Q.attempt;if(!k||!T)return;Q.status=P.status;let p=Z.quotaFromHeaders?.(P.headers,P.status,T);if(p!==void 0)z2(Q,"http",p,P.status);if(!P.ok&&Z.limitFromResponse){let c=await Z.limitFromResponse({status:P.status,headers:P.headers,body:()=>P.clone().text(),attempt:T});if(c)V2(Q,c,"http")}if(!P.ok||!P.body)r(Q);let D=P;if(P.body&&(Z.inspectEvent||Z.onAttemptEnd)){let c=P.body;if(Z.inspectEvent)c=c.pipeThrough(H0((X2)=>K2(Q,"http",X2.data,X2.event),(X2)=>u("opencode2 auth event inspection threw",{error:J(X2)})));D=new Response(i1(c,(X2)=>r(Q,X2)),{status:P.status,statusText:P.statusText,headers:P.headers})}if(Z.rewriteResponse)D=await Z.rewriteResponse({...k,request:j.request,response:D,attempt:T})??D;if(D!==P)j.response=D},Q2)),W2.push(await $.session.hook("experimental.ws.handshake",(j)=>{if(M){let Q=w2(j.sessionID,j.kind);if(L.delete(Q),!f(E2(j),new Headers(j.headers)))return}return H(E2(j),async(Q)=>{let P;for(let D of Object.keys(j.headers)){if(D.toLowerCase()!==v2)continue;P??=j.headers[D],delete j.headers[D]}let k=M?await g(E2(j),"experimental.ws.handshake",Q,"ws"):await h(E2(j),"experimental.ws.handshake","ws",P,Q);Q();let T=s(k),p=k.attempt;if(!T||!p)throw G(k.scope);await $2(k,async()=>{if(!M?.refuseMisplaced)r2(j.headers,k.headers);let D=Z.rewriteHandshakeURL?.({...T,url:j.url,attempt:p});if(D!==void 0)j.url=D;if(M?.refuseMisplaced)r2(j.headers,k.headers);if(x(k.scope,Object.entries(j.headers)),M)L.add(k.key)})})},Q2));let t=Z.rewriteWebSocketFrame?.bind(Z);if(t)W2.push(await $.session.hook("experimental.ws.send",async(j)=>{let Q=E2(j);if(M&&!L.has(w2(Q.sessionID,Q.kind)))return;let P=o(Q.sessionID,Q.kind),k=await t({...Q,attempt:P?.attempt,frame:j.frame});if(k!==void 0)j.frame=k},Q2));W2.push(await $.session.hook("experimental.ws.receive",(j)=>{if(M&&!L.has(w2(j.sessionID,j.kind)))return;let Q=o(j.sessionID,j.kind);if(!Q)return;try{K2(Q,"ws",j.frame)}catch(P){u("opencode2 auth frame inspection threw",{error:J(P)})}},Q2)),W2.push(await $.session.hook("retry",async(j)=>{if(M&&R.get(j.sessionID)!==!0)return;let Q=j.decision,P=()=>d("retry",{sessionID:j.sessionID,attempt:j.attempt,reason:"host-decides",hostDecision:Q,decision:Q});if(b(j.sessionID)&&!Z.retrySameAccount){await P();return}let k=Z2(j.sessionID);if(!k)return;if(k==="ambiguous"){await d("retry",{sessionID:j.sessionID,attempt:j.attempt,reason:"host-decides",hostDecision:Q,decision:Q});return}let T=k;await H(T.scope,async(p)=>{let D=p,c=Z.retrySameAccount?.bind(Z),X2=T.attempt;if(c&&X2&&!T.outputStarted&&!T.sameAccountRetry){if(T.ended)await T.ended;if(T.limit)await T.limit.delivered;let U2=await U(T.scope.sessionID,async()=>{D();let H2=X2.accountId,B2=()=>X.has(T.id)&&T.accountId===H2&&Z2(j.sessionID)===T&&!T.outputStarted&&(!M||R.get(j.sessionID)===!0);if(!B2()||T.sameAccountRetry)return!1;T.sameAccountRetry=!0;let _2={...T.scope,accountId:H2,error:j.error,attempt:j.attempt,...T.limit?{limit:T.limit.signal}:{}},G2;try{G2=await c(_2)}catch(O2){u("opencode2 auth retrySameAccount threw; recovery declined",{sessionID:j.sessionID,error:J(O2)})}if(!G2)return D(),!1;let T2={accountId:G2.accountId,input:_2};try{D()}catch(O2){throw await y(T2),O2}if(!B2()||G2.accountId!==H2)return await y(T2),!1;let C2=z.get(T.key);if(z.delete(T.key),C2)await I(C2);try{D()}catch(O2){throw await y(T2),O2}if(!B2())return await y(T2),!1;return z.set(T.key,{attemptId:T.id,sessionID:T.scope.sessionID,order:++F,accountId:H2,sameAccount:T2}),T.judged=!0,j.decision={retry:!0,delay:0},!0});if(D(),U2){await d("retry",{sessionID:j.sessionID,accountId:T.accountId,kind:T.scope.kind,attempt:j.attempt,reason:"same-account",hostDecision:Q,decision:j.decision,handle:T.attempt});return}}if(b(j.sessionID)){await P();return}T.judged=!0;let P2=T.attempt;if(P2&&!T.outputStarted){if(!T.limit){let U2=Z.limitFromError?.(j.error,P2);if(U2)V2(T,U2,"error")}if(T.ended)await T.ended;if(T.limit)await T.limit.delivered}D();let{decision:o2,reason:A2}=await U(T.scope.sessionID,async()=>{if(D(),b(j.sessionID))return{decision:Q,reason:"host-decides"};let U2=z.get(T.key);if(z.delete(T.key),U2)await I(U2);if(D(),b(j.sessionID))return{decision:Q,reason:"host-decides"};let H2=Q,B2,_2,G2;if(T.accountId===void 0||!P2)H2={retry:!1},B2="no-account";else if(T.outputStarted)H2={retry:!1},B2="output-started";else if(T.limit){let T2={accountId:T.accountId,limit:T.limit.signal},C2,O2={...T.scope,phase:"retry",previousAccountId:T.accountId,rerouteFrom:T2};try{C2=await Z.chooseAccount(O2)}catch(z0){u("opencode2 auth chooseAccount threw while the retry hook looked for another account; the host decides the retry",{sessionID:T.scope.sessionID,error:J(z0)})}let S2=typeof C2==="object"?C2.hold:void 0,n2=typeof C2==="string"?C2:S2?T.accountId:void 0;if(n2!==void 0)G2={accountId:n2,input:O2};try{D()}catch(z0){if(G2)await A(G2);throw z0}if(b(j.sessionID)){if(G2)await A(G2);return{decision:Q,reason:"host-decides"}}if(S2&&Number.isFinite(S2.delayMs)&&S2.delayMs>=0)H2={retry:!0,delay:Math.min(S2.delayMs,w0)},B2="hold";else if(!S2&&n2!==void 0&&n2!==T.accountId)T.rerouted=!0,_2=T2,H2={retry:!0,delay:0},B2="reroute";else{if(S2&&G2)await A(G2),G2=void 0;B2="host-decides-last-account"}}else B2="host-decides";if(j.decision=H2,H2.retry&&T.accountId!==void 0&&X.has(T.id))z.set(T.key,{attemptId:T.id,sessionID:T.scope.sessionID,order:++F,accountId:T.accountId,..._2===void 0?{}:{rerouteFrom:_2},...G2===void 0?{}:{next:G2}});else if(G2)await A(G2);return{decision:H2,reason:B2}});D(),await d("retry",{sessionID:j.sessionID,...T.accountId===void 0?{}:{accountId:T.accountId},kind:T.scope.kind,attempt:j.attempt,reason:A2,hostDecision:Q,decision:o2,...P2===void 0?{}:{handle:P2}})})},Q2));let F2=(j)=>{if(K(j),R.delete(j),!E.get(j)?.foreignSeen)E.delete(j);for(let Q of L)if(JSON.parse(Q)[0]===j)L.delete(Q);for(let Q of[...X.values()]){if(Q.scope.sessionID!==j)continue;l(Q,"its session was forgotten"),X.delete(Q.id)}for(let[Q,P]of z)if(P.sessionID===j)n(Q)},N2=new AbortController,i2=$.event;if(i2)(async()=>{try{for await(let j of i2.subscribe({signal:N2.signal}))if(j.type==="session.deleted")F2(j.data.sessionID);else if(j.type==="session.status"&&j.data.status.type==="idle"){let Q=j.data.sessionID,P=++F;U(Q,async()=>{for(let[k,T]of z)if(T.sessionID===Q&&T.order<P)z.delete(k),await I(T)})}}catch(j){if(!N2.signal.aborted)u("opencode2 auth stopped listening for session deletion",{error:J(j)})}})();return{on(j,Q){let P=a.get(j);if(!P)P=new Set,a.set(j,P);let k=Q;return P.add(k),()=>{P.delete(k)}},accountFor(j,Q){return L2(w2(j,Q))?.accountId},forgetSession:F2,get size(){return X.size},async dispose(){if(j2)return;j2=!0;for(let j of e.keys())K(j);N2.abort();for(let j of X.values())l(j,"the installation was disposed");X.clear();for(let j of z.keys())n(j);L.clear(),R.clear(),E.clear(),a.clear(),await Promise.all(W.values()),await Promise.all(W2.map(async(j)=>{try{await j.dispose()}catch(Q){u("opencode2 auth hook did not dispose cleanly",{error:J(Q)})}}))}}}import{createHash as n1}from"node:crypto";import{AnthropicOAuthOriginError as r1,applyCustomHeaders as s1,assertNotCustodyTombstone as a1,classifyGzipRejection as t1,createProviderErrorRedactor as D0,createProviderErrorResponseScope as I0,decideRequestGzip as e1,dumpDirectRequest as y0,dumpRelayRequest as f0,dumpResponseArtifact as s2,encodeGzipRequestBody as $4,getAccountStoragePath as Z4,getRequestGzipLatch as j4,getRequestGzipLatchPath as J4,isDumpEnabled as X4,mergeAnthropicBetas as G4,remapModelId as v0,remapRequestBodyModel as Y4,setDumpEnabled as g0,stateRefusalCause as V4,stateRefusalPublicMessage as Q4,stripEmptyTrailingAssistantMessages as W4,TrailingAssistantHistoryError as U4}from"@cortexkit/anthropic-auth-core";var g2="anthropic",r0="x-common-auth-attempt",B4=["x-session-affinity","x-opencode-session","x-parent-session-id",m0,t2,I2,r0],a2=new Set(["authorization","x-api-key"]),z4="physical send before a response",M4="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",K4=512,H4=5000,N4=500,s0=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]),_0=($,Z="provider request failed")=>({type:s0.has($.type)?$.type:"provider_error",message:Z,...$.status!==void 0?{status:$.status}:{}});class a0 extends Error{sessionID;requestKind;kind="no-account";providerID=g2;constructor($,Z){super(M4);this.sessionID=$;this.requestKind=Z;this.name="NativeAnthropicNoAccountError"}}class P0 extends Error{sessionID;requestKind;kind="session-forgotten";providerID=g2;constructor($,Z){super("request refused: its session was closed while it was being prepared");this.sessionID=$;this.requestKind=Z;this.name="NativeAnthropicRevokedError"}}class R2 extends Error{kind="unsupported-transport";providerID=g2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class t0 extends Error{kind="local-invalid-request";status=400;check;constructor($){super($.message,{cause:$});this.name="NativeAnthropicLocalRefusal",this.check=$.check}}class e0 extends Error{kind="state-relocated";providerID=g2;constructor($){super(Q4($)??$.message,{cause:$});this.name="NativeAnthropicStateRefusal"}}function e2($){let Z=V4($);return Z?new e0(Z):void 0}var D2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($);function d2($){try{return JSON.parse($)}catch{return}}function L0($){let Z={};for(let[V,Y]of Object.entries($??{}))Z[V.toLowerCase()]=Y;return Z}function h0($){let Z={};for(let V of B4){let Y=$.get(V);if(Y!==null&&V!==r0)Z[V]=Y;$.delete(V)}return Z}function _4($){try{return new URL($).pathname.endsWith("/messages")}catch{return!1}}function L4($){return $ instanceof U4||$ instanceof l0||$ instanceof r1?new t0($):void 0}function F4($,Z){let V=[];if($.oauth)V.push($.oauth.accessToken);for(let[Y,M]of Object.entries($.apiHeaders??{})){if(M===null||!a2.has(Y))continue;V.push(M.replace(/^Bearer\s+/i,""))}for(let Y of a2){let M=Z.get(Y);if(M!==null)V.push(M.replace(/^Bearer\s+/i,""))}if($.dispatch?.kind==="http-relay")V.push($.dispatch.token);return[...new Set(V.filter(Boolean))]}var P4=new Set(["oauth-2025-04-20","claude-code-20250219",p0]);function T4($){let Z=$.split(",").map((V)=>V.trim()).filter((V)=>V&&!P4.has(V));return G4(null,Z)}function C4($){let Z=d2($);if(!D2(Z))return $;let V=W4(Z.messages),Y=Object.hasOwn(Z,"fallbacks"),{droppedMarkers:M}=c0(Z,!1),_=Y&&!Object.hasOwn(Z,"fallbacks"),O=Y4(Z);return V>0||M>0||_||O?JSON.stringify(Z):$}async function O4($,Z){if(!($ instanceof Promise))return"settled";let V;try{return await Promise.race([$.then(()=>"settled"),new Promise((Y)=>{V=setTimeout(()=>Y("timed-out"),Z)})])}finally{if(V!==void 0)clearTimeout(V)}}function h2($){let{source:Z,log:V}=$,Y=Math.max(1,$.maxPendingSends??K4),M=$.attemptEndTimeoutMs??H4,_=$.requestGzipLatch??j4(J4(Z4())),O=new WeakSet,C=new Map,N=new WeakMap,X=new WeakMap,B=(G)=>JSON.stringify([G.providerID,G.sessionID,G.kind,G.modelID,G.agent,G.accountId]),z=new Map,F=new WeakMap,L=new Map,R=new WeakMap,E=D0([]);E.dispose();let b=(G)=>(G&&L.get(G)?.redactor)??E,w=(G)=>{let K=L.get(G);if(!K)return;L.delete(G),K.redactor.dispose(),K.scope.dispose()},f=(G,K,H,x)=>{let S=F4(K,x),g=I0(S,H);v.set(G,H),L.set(G,{sessionID:K.sessionID,redactor:D0(S),scope:g}),g.settled.then(()=>w(G));while(L.size>Y){let h=L.keys().next().value;if(h===void 0)break;w(h)}},v=new WeakMap,i=(G,K)=>{let H=G?v.get(G):void 0;if(!H||!K.ok)return E.redactResponse(K);let x=I0([],H),S=x.redactResponse(K);return x.dispose(),S},a=(G,K)=>{let H=G?L.get(G)?.scope:void 0;if(!H)return i(G,K);try{return H.redactResponse(K)}catch{return i(G,K)}},Y2=!1,j2=new Map,e=new WeakMap,u=new WeakMap,J=new WeakMap,W=(G)=>G.agent==="cachekeep"||G.agent==="prime",U=async()=>{try{if(Z.isDumpEnabled)return await Z.isDumpEnabled()}catch{return!1}try{return X4()}catch{return!1}},q=(G)=>{j2.delete(G)},A=new WeakMap,y=(G,K)=>{if(G&&!K.ok)A.set(K.headers,G);return K},I=(G,K)=>{if(K.dispatch!=="http-relay")return!0;let H=/^req_[A-Za-z0-9_-]+$/.test(G.get("request-id")??"");return X.set(K,H),H},n=(G)=>new a0(G.sessionID,G.kind),d=new Map,m=async(G,K)=>{if(Y2)throw new P0(G.sessionID,G.kind);let H={revoked:!1},x=d.get(G.sessionID);if(!x)x=new Set,d.set(G.sessionID,x);x.add(H);let S=()=>{if(Y2||H.revoked)throw new P0(G.sessionID,G.kind)};try{let g=await K(S);return S(),g}finally{let g=d.get(G.sessionID);if(g?.delete(H)&&g.size===0)d.delete(G.sessionID)}},r=(G,K)=>{C.set(G,K);while(C.size>Y){let H=C.keys().next().value;if(H===void 0)break;C.delete(H),V?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:Y})}},l=(G,K)=>({providerID:G.providerID,modelID:G.modelID,sessionID:G.sessionID,agent:G.agent,kind:G.kind,accountId:G.accountId,attemptId:G.attemptId,transport:G.transport,route:K.route,provenance:K.provenance,dispatch:K.dispatch}),M2=(G)=>m(G,async(K)=>{let{accountId:H,...x}=G,S;try{S=await Z.authorizeAccount(x,H)}catch(g){let h=e2(g);if(h)throw V?.warn("refused an Anthropic request: its account state was moved or could not be recorded",{error:h.cause instanceof Error?h.cause.name:""}),h;throw g}return K(),L2(x,S)}),L2=(G,K)=>{if(!K)throw n(G);if(K.dispatch?.kind==="websocket-relay")throw new R2;let H=K.dispatch?.kind==="http-relay"?"http-relay":"direct",x=K.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":K.dispatch.token}:void 0;if(K.route==="oauth"){if(!K.accessToken)throw n(G);a1(K.accessToken,g2);let h=Object.freeze({route:"oauth",provenance:K.provenance,dispatch:H});r(h,{sessionID:G.sessionID,oauth:{accessToken:K.accessToken,...K.identity?{identity:K.identity}:{}},dispatch:K.dispatch,oauthHeaders:K.headers});let $2=L0(K.headers);for(let o of a2)delete $2[o];return delete $2["anthropic-beta"],{headers:x??{...$2,"x-api-key":null,authorization:`Bearer ${K.accessToken}`},attempt:h}}let S={authorization:null,"x-api-key":null,...L0(K.headers)};if(!S.authorization&&!S["x-api-key"])throw n(G);let g=Object.freeze({route:"api",provenance:K.provenance,dispatch:H});return r(g,{sessionID:G.sessionID,...K.baseURL?{baseURL:K.baseURL}:{},dispatch:K.dispatch,apiHeaders:S}),{headers:x??S,attempt:g}},x2=(G)=>m(G,(K)=>y2(G,K)),y2=async(G,K)=>{let{request:H,attempt:x}=G,S=x.data;z.set(B(G),x);while(z.size>Y){let J2=z.keys().next();if(!J2.done)z.delete(J2.value)}let g=S?C.get(S):void 0;if(S)C.delete(S);if(!S||!g||S.route==="oauth"&&!g.oauth)throw n(G);let h=new Headers(H.headers);s1(h);let $2=h0(h),o=H.body===null?void 0:await H.text();K();let V2=o!==void 0&&_4(H.url),z2=o0(H.url,g.baseURL!==void 0?{baseURL:g.baseURL}:{}).url?.toString()??H.url;try{if(S.route==="oauth"&&g.oauth){d0(z2);let{accessToken:J2,identity:Z2}=g.oauth;for(let[W2,t]of Object.entries(L0(g.oauthHeaders))){if(a2.has(W2))continue;if(t===null)h.delete(W2);else h.set(W2,t)}let Q2=null;if(o!==void 0&&V2){let W2={...l(x,S),modelID:(()=>{let N2=d2(o);return v0(D2(N2)&&typeof N2.model==="string"?N2.model:G.modelID)})(),route:"oauth",correlation:$2},t=await Z.requestOptions?.(W2)??{};if(K(),x.agent!=="cachekeep")o=await n0(o,{...t,...Z2?{identity:Z2}:{},sessionId:G.sessionID,onToolNameMap:(N2)=>F.set(S,N2)});let F2=d2(o);Q2=D2(F2)?F2:null}i0(h,J2,{body:Q2,...Z2?{identity:Z2}:{},requestClass:u0(x.agent)?"auxiliary":"main"})}else{if(o!==void 0&&V2)o=C4(o);h.delete("authorization"),h.delete("x-api-key");for(let[Z2,Q2]of Object.entries(g.apiHeaders??{}))if(Q2===null)h.delete(Z2);else h.set(Z2,Q2);if(o!==void 0&&V2&&!h.has("content-type"))h.set("content-type","application/json");let J2=h.get("anthropic-beta");if(J2!==null){let Z2=T4(J2);if(Z2)h.set("anthropic-beta",Z2);else h.delete("anthropic-beta")}}}catch(J2){let Z2=L4(J2);if(!Z2)throw J2;throw N.set(S,Z2.check),V?.warn("refused an Anthropic request locally; nothing was sent",{check:Z2.check}),Z2}let K2=o!==void 0?d2(o):void 0;if(await Z.admitRequest?.({...l(x,S),modelID:v0(D2(K2)&&typeof K2.model==="string"?K2.model:G.modelID)}),h0(h),o!==void 0)h.delete("content-length");if(K(),f(S,g,D2(K2)&&K2.stream===!0?"event-stream":"http",h),S.route==="oauth"&&V2&&o!==void 0)await Z.onRequestPrepared?.({...l(x,S),url:z2,bodyText:o}),K();if(g.dispatch?.kind==="http-relay"){let J2=o??"";h.delete("x-relay-token");let Z2={protocol:1,type:"request",affinity:G.sessionID,upstream:{url:z2,method:H.method,headers:Object.fromEntries(h)},mode:"full_sync",revision:1,body:J2,next_hash:`sha256:${n1("sha256").update(J2).digest("hex")}`};if(V2&&o!==void 0&&!W(x)){let Q2=$2[I2]==="1"?"start":void 0,W2=JSON.stringify(Z2);j2.set(S,{affinity:G.sessionID,route:G.accountId,bodyText:J2,url:z2,method:H.method,headers:new Headers(h),dispatch:"http-relay",relayUrl:g.dispatch.url,envelope:Z2,relayBytes:W2.length,...Q2?{tag:Q2}:{}})}else q(S);return new Request(g.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":g.dispatch.token},redirect:"error",signal:H.signal,body:JSON.stringify(Z2)})}let q2=o;if(S.route==="oauth"&&V2&&o!==void 0){let J2=await e1({url:z2,body:o,latch:_});if(K(),J2.gzip)q2=await $4(o),h.set("content-encoding","gzip"),O.add(S),K()}if(V2&&o!==void 0&&!W(x)){let J2=$2[I2]==="1"?"start":void 0;j2.set(S,{affinity:G.sessionID,route:G.accountId,bodyText:o,url:z2,method:H.method,headers:new Headers(h),dispatch:"direct",...J2?{tag:J2}:{}})}else q(S);return new Request(z2,{method:H.method,headers:h,redirect:S.route==="oauth"?"error":H.redirect,signal:H.signal,...q2!==void 0?{body:q2}:{}})},s={providerID:g2,chooseAccount:(G)=>m(G,async()=>{let K=await Z.chooseAccount(G);if(typeof K==="object"&&G.phase==="retry")return K;if(typeof K!=="string"||!K)throw n(G);return K}),dropChoice:(G)=>Z.dropChoice?.(G),async retrySameAccount(G){if(!Z.retrySameAccount)return;let K=B(G),H=z.get(K);z.delete(K);let x=G.limit??(H?s.limitFromError?.(G.error,H):void 0);return Z.retrySameAccount({...G,error:_0(G.error),...x?{limit:x}:{}})},dropSameAccountRetry:(G)=>Z.dropSameAccountRetry?.({...G,error:_0(G.error)}),accountHeaders:M2,rewriteRequest:x2,rewriteHandshakeURL(){throw new R2},async rewriteResponse({response:G,attempt:K}){let H=K.data;if(H&&!I(G.headers,H)){if(H)q(H);if(G.status===401)return w(H),G.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return a(H,G)}if(H&&O.has(H))O.delete(H),t1(G).then((t)=>{if(!t)return;_.latchProcess(),V?.warn("gzipped request body rejected; later requests go uncompressed",{kind:t,status:G.status})},()=>{});let x=null,S=H?j2.get(H):void 0;if(H&&S){let t=!1;try{t=await U()}catch{t=!1}if(!t)q(H);else{try{g0(!0)}catch{}try{if(S.dispatch==="http-relay")x=await f0({affinity:S.affinity,transport:"http",protocol:1,mode:"full_sync",status:G.status,bodyText:S.bodyText,payload:S.envelope??{},relayBytes:S.relayBytes??0,...S.tag?{tag:S.tag}:{}});else x=await y0({affinity:S.affinity,route:S.route,status:G.status,bodyText:S.bodyText,url:S.url,method:S.method,headers:S.headers,...S.tag?{tag:S.tag}:{}})}catch{x=null}if(q(H),x){e.set(H,x);try{await s2(x,{status:G.status,message:null,complete:!1})}catch{}J.set(H,Promise.resolve())}}}let g=a(H,G);if(H?.route!=="oauth"||!g.body)return y(H,g);let h={...l(K,H),status:G.status},$2=Z.responseOptions?.(h)??{},o=(G.headers.get("content-type")??"").includes("application/json"),V2={...$2,toolNameMap:H?F.get(H):void 0,onToolNameRefusal:()=>{if(!H)return;N.set(H,"response_tool_names"),w(H)},laneStartOAuthServed:!0,...o?{responseMode:"json"}:{}};if(!H||!x)return y(H,F0(g,V2));let z2=x,K2=G.status,q2=(t)=>{let N2=(J.get(H)??Promise.resolve()).then(()=>t().then(()=>{return})).catch(()=>{return});J.set(H,N2)},J2=$2.onMessageStart,Z2=$2.onMessageDelta,Q2=$2.onMessageResponse,W2=$2.onStreamEnd;return y(H,F0(g,{...V2,onMessageStart:(t)=>{try{J2?.(t)}catch{}try{u.set(H,{...t}),q2(()=>s2(z2,{status:K2,message:t,complete:!1}))}catch{}},onMessageDelta:(t)=>{try{Z2?.(t)}catch{}try{let F2=u.get(H)??{},N2=F2.usage&&typeof F2.usage==="object"&&!Array.isArray(F2.usage)?F2.usage:{},i2={...F2,...t.usage?{usage:{...N2,...t.usage}}:{},...t.stopReason?{stop_reason:t.stopReason}:{}};q2(()=>s2(z2,{status:K2,message:i2,complete:!0}))}catch{}},onMessageResponse:(t)=>{try{Q2?.(t)}catch{}try{q2(()=>s2(z2,{status:K2,message:t,complete:!0}))}catch{}},onStreamEnd:async()=>{try{await W2?.()}catch{}try{await(J.get(H)??Promise.resolve())}catch{}}}))},quotaFromHeaders(G,K,H){let x=H.data;if(!x||!I(G,x))return;return Z.quotaFromHeaders?.(G,{...l(H,x),status:K})},async limitFromResponse({status:G,headers:K,body:H,attempt:x}){let S=x.data;if(!S||N.get(S)==="response_tool_names")return;if(!I(K,S))return Z.limitFromRelayFailure?.({...l(x,S),status:G});if(R.set(S,`provider responded with HTTP ${G}`),!Z.limitFromResponse)return;let g=A.get(K)===S,h=b(S);return Z.limitFromResponse({...l(x,S),status:G,headers:K,body:async()=>g?await H():h.redactText(await H())})},inspectEvent({data:G,event:K,attempt:H}){if(H.data&&N.get(H.data)==="response_tool_names")return;let x=d2(G);if(!D2(x))return;let S=typeof x.type==="string"?x.type:K;if(S==="content_block_start"||S==="content_block_delta")return{outputStarted:!0};if(S==="message_stop")return{done:!0};if(S!=="error")return;let g=H.data,h=b(g),$2=D2(x.error)?x.error:{},o=typeof $2.type!=="string"?void 0:s0.has($2.type)?$2.type:h.redactText($2.type),V2=typeof $2.message==="string"?h.redactText($2.message):void 0;if(g?.dispatch==="http-relay"&&X.get(g)===!1)return;let z2=g?Z.limitFromStreamError?.({...l(H,g),errorType:o,message:V2}):void 0,K2={error:[o??"error",V2].filter(Boolean).join(": ").slice(0,N4),...z2?{limit:z2}:{}};if(g&&K2.error)R.set(g,K2.error);return K2},limitFromError(G,K){let H=K.data;if(!H||N.has(H))return;let x=_0(G,R.get(H));if(w(H),H.dispatch==="http-relay"&&X.get(H)===!1)return;return Z.limitFromHostError?.(x,l(K,H))},async onAttemptEnd(G,K){let H=G.data;if(!H)return;C.delete(H);let x=j2.get(H);if(x){q(H);try{if(await U()){try{g0(!0)}catch{}try{if(x.dispatch==="http-relay"){if(K.status!==void 0)await f0({affinity:x.affinity,transport:"http",protocol:1,mode:"full_sync",status:K.status,bodyText:x.bodyText,payload:x.envelope??{},relayBytes:x.relayBytes??0,...x.tag?{tag:x.tag}:{}})}else await y0({affinity:x.affinity,route:x.route,status:K.status,error:K.status===void 0?z4:void 0,bodyText:x.bodyText,url:x.url,method:x.method,headers:x.headers,...x.tag?{tag:x.tag}:{}})}catch{}}}catch{}}let S=K.error?.reason;if(S==="cancelled"||S==="abandoned"||S===void 0&&(K.status===void 0||K.status<400))w(H);let g=N.get(H),{status:h,...$2}=K,o=Z.onAttemptEnd?.(l(G,H),{...$2,...h!==void 0&&(H.dispatch!=="http-relay"||X.get(H)===!0)?{status:h}:{},...g!==void 0?{localRefusal:{check:g}}:{}});if(await O4(o,M)==="timed-out")V?.warn("the account source did not finish recording a send",{timeoutMs:M})}};return{adapter:s,dispose(){Y2=!0;for(let[G,K]of d){for(let H of K)H.revoked=!0;Z.forgetSession?.(G)}d.clear(),C.clear(),z.clear(),j2.clear();for(let G of[...L.keys()])w(G)},forgetSession(G){for(let K of d.get(G)??[])K.revoked=!0;d.delete(G);for(let[K,H]of z)if(H.sessionID===G)z.delete(K);for(let[K,H]of C)if(H.sessionID===G)C.delete(K);for(let[K,H]of[...L])if(H.sessionID===G)w(K);for(let[K,H]of[...j2])if(H.affinity===G)j2.delete(K);Z.forgetSession?.(G)},get pendingSendCount(){return C.size},get heldCredentialCount(){let G=0;for(let K of C.values())if(K.oauth)G++;return G},get heldRedactorCount(){return L.size},get operationsInProgress(){let G=0;for(let K of d.values())G+=K.size;return G}}}import{setTimeout as u4}from"node:timers/promises";import{CacheKeepManager as p4,CacheKeepSessionRegistry as c4,getDefaultCacheKeepRegistryDirectory as i4,isCacheKeepActiveNow as W1,isCacheKeepHybridActive as p2,isCacheKeepSubagentsEnabled as j0,logger as J0,NativeAccountRefusal as b2,nativeAccountCanServe as B1,nativeAccountRefusal as o4}from"@cortexkit/anthropic-auth-core";import{createHash as q4,randomUUID as x4}from"node:crypto";import{constants as $1}from"node:fs";import{lstat as Z1,mkdir as S4,open as k4,readdir as j1,rm as $0,writeFile as R4}from"node:fs/promises";import{tmpdir as b4}from"node:os";import{join as u2}from"node:path";import{promisify as Y1}from"node:util";import{gunzip as A4,gzip as w4}from"node:zlib";import{CACHE_KEEP_MAX_BODY_BYTES as V1,createWindowsOwnerOnly as D4,ensureWindowsOwnerOnlyDirectory as I4,isOwnerOnly as J1,logger as y4,readWindowsOwnerOnly as f4,renameWithWindowsSharingRetry as v4}from"@cortexkit/anthropic-auth-core";var T0="2.4.5";var g4=Y1(w4),h4=Y1(A4),Z0=($)=>q4("sha256").update($).digest("hex"),X1=/^[a-f0-9]{64}\.json\.gz$/,C0=/^[a-f0-9]{64}\.json\.gz\.[a-f0-9-]+\.tmp$/,G1=2*V1+65536;function m4($,Z=b4()){return u2(Z,`cortexkit-anthropic-auth-cachekeep-${Z0($).slice(0,16)}`)}function l4($){return{v:1,pluginVersion:T0,id:$.id,bodyText:$.bodyText,url:$.url,cacheExpiresAt:$.cacheExpiresAt,nextPrewarmAt:$.nextPrewarmAt,oauthAccountIdentity:$.oauthAccountIdentity,isSubagent:$.isSubagent}}function Q1($){let Z=JSON.parse($);if(!Z||typeof Z!=="object"||Array.isArray(Z))throw Error("Invalid restart body");let V=!1;for(let Y of Object.keys(Z))if(/^(authorization|x-api-key|cookie|set-cookie|headers|credentials|token|access[_-]?token|refresh[_-]?token)$/i.test(Y))delete Z[Y],V=!0;return V?JSON.stringify(Z):$}function d4($,Z,V){if(!$||typeof $!=="object"||Array.isArray($))return!1;if($.v!==1||$.pluginVersion!==T0||typeof $.id!=="string"||!$.id||`${Z0($.id)}.json.gz`!==Z||typeof $.bodyText!=="string"||Buffer.byteLength($.bodyText)>V1||typeof $.url!=="string"||typeof $.oauthAccountIdentity!=="string"||!$.oauthAccountIdentity||typeof $.isSubagent!=="boolean"||!Number.isFinite($.cacheExpiresAt)||$.cacheExpiresAt<=V||!Number.isFinite($.nextPrewarmAt))return!1;return Q1($.bodyText)===$.bodyText}class O0{options;directory;disabled=!1;chain=Promise.resolve();pending=new Map;timers=new Map;lastWrite=new Map;latest=new Map;constructor($){this.options=$;this.directory=m4($.storageId,$.root)}refuse(){if(this.disabled)return;this.disabled=!0;for(let $ of this.timers.values())(this.options.clearTimeoutImpl??clearTimeout)($);this.timers.clear(),this.pending.clear(),this.latest.clear(),this.lastWrite.clear(),y4.warn("cachekeep","restart storage unavailable; retaining sessions in memory only")}async directoryReady(){if(this.disabled)return!1;try{if(!await I4(this.directory,this.options.ownerOnly))try{await S4(this.directory,{mode:448})}catch(Z){if(Z.code!=="EEXIST")throw Z}let $=await Z1(this.directory);if(!$.isDirectory()||$.isSymbolicLink()||!await J1(this.directory,()=>$.uid===process.getuid?.()&&($.mode&511)===448,this.options.ownerOnly))throw Error("Unsafe restart directory");return!0}catch{return this.refuse(),!1}}enqueue($){this.chain=this.chain.then(async()=>{if(await this.directoryReady())await $()}).catch(()=>this.refuse())}async load($,Z){if(!await this.directoryReady())return;try{for(let V of(await j1(this.directory)).sort()){if(!X1.test(V)&&!C0.test(V))continue;let Y=u2(this.directory,V);try{if(C0.test(V))throw Error("Unfinished write");let M=await Z1(Y);if(!M.isFile()||M.isSymbolicLink()||M.size>G1||!await J1(Y,()=>M.uid===process.getuid?.()&&(M.mode&511)===384,this.options.ownerOnly))throw Error("Unsafe restart file");let _=await f4(Y,this.options.ownerOnly);if(!_){let N=await k4(Y,$1.O_RDONLY|$1.O_NOFOLLOW);try{_=await N.readFile()}finally{await N.close()}}let O=await h4(_,{maxOutputLength:G1}),C=JSON.parse(O.toString("utf8"));if(!d4(C,V,$)||!Z(C))throw Error("Stale restart file")}catch{await $0(Y,{force:!0})}}}catch{this.refuse()}}changed($){if(this.disabled)return;let Z=l4($),V=this.latest.get(Z.id);if(V&&V.bodyText===Z.bodyText&&V.url===Z.url&&V.oauthAccountIdentity===Z.oauthAccountIdentity&&V.cacheExpiresAt===Z.cacheExpiresAt&&V.nextPrewarmAt===Z.nextPrewarmAt&&V.isSubagent===Z.isSubagent)return;if(this.latest.set(Z.id,Z),this.pending.set(Z.id,Z),this.timers.has(Z.id))return;let Y=Math.max(250,(this.lastWrite.get(Z.id)??0)+5000-(this.options.now?.()??Date.now())),M=(this.options.setTimeoutImpl??setTimeout)(()=>this.flush(Z.id),Y);M.unref?.(),this.timers.set(Z.id,M)}flush($){let Z=this.timers.get($);if(Z)(this.options.clearTimeoutImpl??clearTimeout)(Z);this.timers.delete($);let V=this.pending.get($);if(this.pending.delete($),!V)return this.chain;return this.lastWrite.set($,this.options.now?.()??Date.now()),this.enqueue(async()=>{let Y=u2(this.directory,`${Z0($)}.json.gz`),M=`${Y}.${x4()}.tmp`;try{let _={...V,bodyText:Q1(V.bodyText)},O=await g4(JSON.stringify(_));if(!await D4(M,O,this.options.ownerOnly))await R4(M,O,{flag:"wx",mode:384});await v4(M,Y,{platform:this.options.ownerOnly?.platform})}finally{await $0(M,{force:!0})}}),this.chain}removed($){let Z=this.timers.get($);if(Z)(this.options.clearTimeoutImpl??clearTimeout)(Z);this.timers.delete($),this.pending.delete($),this.latest.delete($),this.lastWrite.delete($),this.enqueue(()=>$0(u2(this.directory,`${Z0($)}.json.gz`),{force:!0}))}clear(){for(let $ of this.timers.values())(this.options.clearTimeoutImpl??clearTimeout)($);this.timers.clear(),this.pending.clear(),this.latest.clear(),this.lastWrite.clear(),this.enqueue(async()=>{for(let $ of await j1(this.directory))if(X1.test($)||C0.test($))await $0(u2(this.directory,$),{force:!0})})}async drain(){for(let $ of this.pending.keys())this.flush($);await this.chain}}function m2($){return JSON.stringify([$.source,$.accountIdentity,$.credentialId,$.binding?.storageId,$.binding?.rowId,$.binding?.credentialEpoch])}var U1=Symbol.for("cortexkit.anthropic-auth.opencode2.cachekeep.v2");function z1(){let $=globalThis;return $[U1]??=new Map,$[U1]}function n4($,Z){let V=new Map,Y=new Map,M=new O0({storageId:$,...Z.persistence}),_=new Set,O=0,C=new c4({directory:Z.registryDirectory||process.env.OPENCODE_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR||i4("opencode"),now:Z.now}),N=()=>{let E;for(let b of Y.values())E=b;return E},X=Z.setIntervalImpl??globalThis.setInterval,B=new p4({loadStorage:async()=>{let E=N(),b=E?await E.loadStorage():null;if(E&&!p2(b)){for(let w of B.trackedSessions())B.untrack(w.id);M.clear()}return b},now:Z.now,setIntervalImpl:(E,b)=>X(()=>{let w=B.tick();return R.ticking=w.catch(()=>{J0.warn("cachekeep","tick failed")}),R.ticking},b),clearIntervalImpl:Z.clearIntervalImpl,onTargetChanged:(E)=>M.changed(E),onTargetRemoved:(E)=>{_.delete(E),M.removed(E)},onTrackedSessionsChanged:(E)=>C.publish(Y.size===0?[]:E),prepareHeaders(E,b,w){let f=N();if(!f)return;return V.set(w.id,{target:b,attempt:w,lease:f}),new Headers({"x-native-cachekeep-attempt":String(w.id)})},fetchImpl:async(E,b)=>{let w=new Request(E,b),f=Number(w.headers.get("x-native-cachekeep-attempt")),v=V.get(f);if(V.delete(f),!v||v.lease.stopped)throw Error("CacheKeep attempt is unavailable");if(_.delete(v.target.id))await u4(Math.max(0,O+3000-Date.now()),void 0,{signal:v.attempt.signal}),O=Date.now();let i=v.lease.send(v.target,w,v.attempt.signal),a=i.then(()=>{},()=>{});return v.lease.inflight.add(a),a.then(()=>v.lease.inflight.delete(a)),i},onComplete:({attempt:E})=>{V.delete(E.id)}}),z,F=()=>{if(z!==void 0)clearTimeout(z);z=void 0},L=()=>{if(F(),Y.size>0)return;let E=B.dropExpiredTargets();if(E===void 0){let w=z1();if(w.get($)===R)w.delete($);return}let b=Z.now?.()??Date.now();if(z=setTimeout(L,Math.max(0,E-b)),typeof z==="object"&&"unref"in z)z.unref()},R={manager:B,registry:C,persistence:M,prepared:V,leases:Y,nextGeneration:0,retain(){B.stop(),V.clear(),L()},async adopt(){if(F(),R.loading??=(async()=>{let E=N();if(!E)return;let b=await E.read();if(!p2(b.policyStorage)){M.clear();return}let w=Z.now?.()??Date.now(),f=0;await M.load(w,(v)=>{if(!Y.size||B.trackedRequest(v.id))return!0;let i=b.accounts.find((j2)=>m2(j2)===v.oauthAccountIdentity);if(i?.type!=="oauth"||!B1(i)||v.isSubagent&&!j0(b.policyStorage))return!1;let a=v.nextPrewarmAt<=w?w+f++*3000:v.nextPrewarmAt,Y2=B.track({sessionId:v.id,url:v.url,headers:new Headers,bodyText:v.bodyText,storage:b.policyStorage,cacheMode:"hybrid",oauthAccountId:i.id,oauthAccountIdentity:v.oauthAccountIdentity,isSubagent:v.isSubagent,retained:{cacheExpiresAt:v.cacheExpiresAt,nextPrewarmAt:a}});if(Y2.tracked)_.add(v.id);return Y2.tracked})})().catch(()=>{J0.warn("cachekeep","failed to restore tracked sessions")}),await R.loading,!Y.size)return;if(B.dropExpiredTargets()===void 0)return;B.start(),C.publish(B.trackedSessions()).catch(()=>{J0.warn("cachekeep","failed to publish tracked sessions")})}};return R}function M1($){let{runtime:Z,source:V}=$,Y=new AbortController,M=z1(),_=M.get($.storageId)??n4($.storageId,$);M.set($.storageId,_);let{manager:O,registry:C}=_,N=async(L,R,E)=>{let b=E?AbortSignal.any([Y.signal,E]):Y.signal;b.throwIfAborted();let w=JSON.parse(await R.text()),f={providerID:"anthropic",modelID:w.model,sessionID:`oc2-cachekeep:${L.id}`,agent:"cachekeep",kind:"generate"},v=(u)=>{throw new b2(u)},i=h2({source:{...V,onRequestPrepared:void 0,responseOptions:void 0,async requestOptions(u){return{...await V.requestOptions?.(u,v),laneStart:!1,billingLineage:void 0,cacheDiagnosticsPreviousMessageId:void 0}},async authorizeAccount(u,J){let W=await Z.read();b.throwIfAborted();let U=W.accounts.find((A)=>A.id===J);if(U?.type!=="oauth"||!B1(U))throw new b2("account-unavailable");if(m2(U)!==L.oauthAccountIdentity)throw new b2("credential-changed");if(L.isSubagent&&!j0(W.policyStorage)||!p2(W.policyStorage)||!W1(W.policyStorage,new Date($.now?.()??Date.now())))return;let q=await V.authorizeAccount(u,J,v);if(q?.provenance.kind==="local"&&m2({...U,binding:q.provenance.subject.binding,accountIdentity:q.provenance.subject.binding.identity})!==L.oauthAccountIdentity)throw new b2("credential-changed");if(q?.provenance.kind==="vault"&&q.provenance.credentialId!==U.credentialId)throw new b2("credential-changed");return q},async admitRequest(u){await V.admitRequest?.(u,v);let J=await Z.read(),W=J.accounts.find((U)=>U.id===u.accountId);if(b.throwIfAborted(),!W)throw new b2("account-unavailable");if(m2(W)!==L.oauthAccountIdentity)throw new b2("credential-changed");if(L.isSubagent&&!j0(J.policyStorage)||!p2(J.policyStorage)||!W1(J.policyStorage,new Date($.now?.()??Date.now())))throw Error("CacheKeep policy changed before dispatch")}}}),a,Y2,j2=!1,e=()=>i.forgetSession(f.sessionID);b.addEventListener("abort",e,{once:!0});try{let u=await Z.read(),J=u.accounts.find((I)=>m2(I)===L.oauthAccountIdentity)?.id;if(!J)throw new b2(u.accounts.some((I)=>I.id===L.oauthAccountId)?"credential-changed":"account-unavailable");let W=await i.adapter.accountHeaders({...f,accountId:J});if(!("headers"in W)||typeof W.headers!=="object"||W.headers===null||typeof W.attempt!=="object"||W.attempt===null||W.attempt.route!=="oauth")throw Error("CacheKeep authorization refused");a={...f,accountId:J,attemptId:crypto.randomUUID(),transport:"http",data:W.attempt};let U=await i.adapter.rewriteRequest?.({...f,accountId:J,attempt:a,request:new Request(L.url,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(w),signal:b})});if(!U)throw Error("CacheKeep rewrite refused");b.throwIfAborted();let q=await($.fetch??fetch)(U),A=await i.adapter.rewriteResponse?.({...f,accountId:J,attempt:a,request:U,response:q});if(!A)throw Error("CacheKeep response rewrite refused");if(Y2=A.status,i.adapter.quotaFromHeaders?.(A.headers,A.status,a),!A.ok)await i.adapter.limitFromResponse?.({status:Y2,headers:A.headers,body:()=>A.clone().text(),attempt:a});let y=await A.arrayBuffer();return j2=!0,new Response(y,{status:Y2,headers:A.headers})}catch(u){let J=o4(u);if(J)throw J;throw Error("Native CacheKeep was not completed")}finally{b.removeEventListener("abort",e);try{if(a)await i.adapter.onAttemptEnd?.(a,{status:Y2,outputStarted:!1,...j2?{}:{error:{reason:"cancelled"}}})}finally{i.dispose(),V.forgetSession?.(f.sessionID)}}},X={generation:_.nextGeneration++,stopped:!1,loadStorage:async()=>(await Z.read()).policyStorage,send:N,inflight:new Set,read:()=>Z.read()},B=_.leases.size===0;_.leases.set(X.generation,X);let z=B?_.adopt():_.loading??Promise.resolve(),F;return{ready:z,async track(L){let R=(v)=>{J0.debug("cachekeep","tracking skipped",{session:L.sessionID,reason:v})};if(X.stopped)return R("lease-stopped");if(L.route!=="oauth")return R("not-oauth");if(L.agent==="cachekeep"||L.agent==="prime")return R("background-agent");if(L.kind!=="primary")return R("not-primary");let E=await Z.read();if(X.stopped)return R("lease-stopped");if(!p2(E.policyStorage)){for(let v of O.trackedSessions())O.untrack(v.id);return _.persistence.clear(),R("hybrid-inactive")}let b=!1;try{b=await $.isSubagent?.(L.sessionID)??!1}catch{return R("session-lookup-failed")}if(X.stopped)return R("lease-stopped");if(b&&!j0(E.policyStorage))return R("subagents-disabled");let w=E.accounts.find((v)=>v.id===L.accountId);if(!w?.accountIdentity)return R("account-identity-missing");if(L.provenance.kind==="local"&&JSON.stringify(w.binding)!==JSON.stringify(L.provenance.subject.binding))return R("local-binding-changed");if(L.provenance.kind==="vault"&&w.credentialId!==L.provenance.credentialId)return R("vault-credential-changed");let f=O.track({sessionId:L.sessionID,url:L.url,headers:new Headers,bodyText:L.bodyText,storage:E.policyStorage,cacheMode:"hybrid",oauthAccountId:L.accountId,oauthAccountIdentity:m2(w),isSubagent:b});return await C.publish(O.trackedSessions()),f},registry:C,dispose(){if(F)return F;X.stopped=!0,Y.abort();for(let[R,E]of _.prepared)if(E.lease===X)_.prepared.delete(R);let L=_.leases.delete(X.generation)&&_.leases.size===0;if(L)_.retain();return F=(async()=>{try{if(L)await _.ticking;await z,await Promise.all(X.inflight),await _.persistence.drain()}finally{if(L&&_.leases.size===0)await C.dispose()}})(),F}}}async function K1($,Z,V){let Y=h2(Z),M=[],_=async(F,L,R)=>{let E=await $.session.hook(F,L,R);return M.push(E),E},O=new AbortController,C;try{C=await N0({session:{hook:_},event:$.event},Y.adapter,{logger:Z.log,gateOnPlaceholder:V})}catch(F){throw Y.dispose(),await Promise.allSettled(M.map((L)=>L.dispose())),F}let N=(F)=>{Y.forgetSession(F),C.forgetSession(F)},X=$.event,B=X?(async()=>{try{for await(let F of X.subscribe({signal:O.signal}))if(F.type==="session.deleted")N(F.data.sessionID)}catch(F){if(!O.signal.aborted)Z.log?.warn("stopped listening for session deletion",{error:F instanceof Error?F.name:"unknown"})}})():Promise.resolve(),z;return{installation:C,forgetSession:N,dispose(){if(z)return z;return Y.dispose(),O.abort(),z=(async()=>{await C.dispose(),await B})(),z}}}import{effectiveRelayTransport as H1,getQuotaCheckIntervalMs as r4,logger as s4,nativeAccountCanServe as a4,oauthProfileIsFresh as t4,quotaSnapshotCheckedAt as e4}from"@cortexkit/anthropic-auth-core";function N1($,Z){let V=new AbortController,Y,M=!1,_=async()=>{let N=await $.read();if(V.signal.throwIfAborted(),N.policyStorage.relay?.enabled===!0&&H1(N.policyStorage.relay.transport,N.policyStorage.relay.url)==="websocket")return;let X=N,B=r4(X.policyStorage);for(let z of X.accounts){if(V.signal.aborted)return;if(!a4(z)||z.type!=="oauth")continue;if(X.policyStorage.quota?.enabled!==!1&&Date.now()-e4(z.quota)>=B)await $.fetchQuota(z.id,Z,V.signal,void 0,"background").catch(()=>{});if(!t4(z.profile)&&!V.signal.aborted)await $.fetchProfile(z.id,Z,V.signal).catch(()=>{})}},O=()=>{if(M||Y)return Y;return Y=_().catch(()=>{if(!V.signal.aborted)s4.debug("opencode2","native background readings did not complete")}).finally(()=>{Y=void 0}),Y},C=$.vault.watch({intervalMs:60000,onRefresh:O,shouldRefresh:async()=>{let N=await $.read();return N.policyStorage.relay?.enabled!==!0||H1(N.policyStorage.relay.transport,N.policyStorage.relay.url)==="http"}});return C.ready.catch(()=>{}),{async dispose(){M=!0,C.close(),V.abort(),await Y}}}import{authorize as B$,buildCacheKeepStatusSummary as z$,buildClaudeQuotaSummary as M$,buildPrimeAccountStatuses as K$,buildPrimeStatusSummary as H$,CLAUSTRUM_OPENCODE_ENROLLMENT_NAME as N$,effectiveRelayTransport as _$,exchange as L$,formatNativeAccountState as F$,formatOAuthAccountTier as P$,getCacheKeepWindow as T$,getHostClaustrumEnrollmentPaths as C$,isCacheKeepAlways as O$,isCacheKeepHybridActive as E$,isCacheKeepPersistentlyEnabled as q$,nativeAccountCanServe as x$,parseLogLevel as S$,resetClaustrumEnrollmentState as k$,setDumpEnabled as R$}from"@cortexkit/anthropic-auth-core";import{buildPrimeAccountStatuses as $$,effectiveRelayStatus as Z$,formatNativeAccountState as j$,formatOAuthAccountTier as _1,getCacheKeepWindow as J$,getRoutingMode as X$,isCacheKeepAlways as G$,isCacheKeepHybridActive as Y$,isPermanentRefreshError as V$,isPrimePersistentlyEnabled as Q$,nativeAccountCanServe as P1,refreshBackoffActive as L1}from"@cortexkit/anthropic-auth-core";var F1=($)=>P1($)&&$.state!=="unsupported-access"?void 0:j$($)||void 0,W$=($)=>{if($.source!=="vault")return"off";if($.state==="needs_reauth")return"on-vault-reauth";return P1($)?"on-vault-served":"on-cold"},U$=($,Z)=>typeof $==="number"&&$>Z;function T1($,Z){let{now:V}=Z,Y=$.policyStorage,M=$.accounts.filter((B)=>B.type==="oauth"),_=M.find((B)=>B.id==="main"),O=_?F1(_):void 0,C=_?.lastQuotaRefreshError?.nextRetryAt,N=_?.lastRefreshError,X=J$(Y);return X0({main:{quota:_?.quota??null,enabled:_?.enabled,tierLabel:_1(_?.profile),quotaBackedOff:U$(C,V),quotaBackoffUntil:C,refreshBackedOff:L1(N,_?.accountIdentity,V,void 0),refreshBackoffUntil:N?.nextRetryAt,stateLine:O,quotaDated:Boolean(O)},fallbacks:M.filter((B)=>B.id!=="main"&&(B.enabled||B.source==="vault")).map((B)=>{let z=F1(B),F=W$(B);return{id:B.id,label:B.label,quota:B.quota??null,enabled:B.enabled,tierLabel:_1(B.profile),needsReauth:V$(B.lastRefreshError)&&L1(B.lastRefreshError,B.accountIdentity,V,void 0),...F==="on-vault-reauth"?{vaultReauth:!0}:{},...F==="on-vault-served"?{vaultServed:!0}:{},...F!=="off"?{custodyState:F}:{},stateLine:z,quotaDated:Boolean(z)}}),...Z.activeId!==void 0&&{activeId:Z.activeId},route:X$(Y),relay:Z$(Y.relay),fastMode:Y.claudeFast?.enabled===!0,cacheKeep:{enabled:Y$(Y),...G$(Y)?{window:"always"}:X&&{window:`${X.startHour}-${X.endHour}`},trackedSessions:Z.trackedSessions},prime:Q$(Y)?{enabled:!0,accounts:$$(Y,{now:V})}:void 0,lastUpdated:V})}var E0=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{},C1=`For first-time model access, connect Anthropic with "${V0}".
+Run: opencode auth login anthropic --method ${Y0}`,b$="No Claude accounts in the vault for this host yet. Add one with `ck auth login --provider anthropic`, then grant it to this host.",O1="The vault returned an account this plugin cannot use yet.";async function A$($){let Z=new AbortController,V;try{return await Promise.race([$.vault.refresh(Z.signal).then(()=>"complete",()=>"failed"),new Promise((Y)=>{V=setTimeout(()=>{Y("pending"),Z.abort()},2000)})])}finally{clearTimeout(V)}}var E1=($)=>$.mode==="local"&&!$.accounts.some((Z)=>Z.id==="main"),w$=($)=>{let Z=$.id==="main"?"main":"fallback",V=`${$.enabled?"enabled":"disabled"}, ${$.type}, ${$.source}${$.state?`, ${F$($)}`:""}`;if($.label)return`${$.label} [${Z}]: ${V}
+  Route: ${$.id}`;return`${Z==="main"?"Main account":`Fallback ${$.id}`}: ${V}`};function q1($){let{runtime:Z,source:V}=$,Y=new Map,M=!1,_=async(X,B)=>{await Z.updateSettings((z)=>({...z,[X]:{...E0(z[X]),...B}}))},O=()=>({ok:!0,text:"Native Claude settings updated."}),C=async(X,B)=>{if(M)throw Error("Native menu is closed");switch(B.signal?.throwIfAborted(),X.action){case"enable":case"disable":return await Z.setEnabled(X.values.id,X.action==="enable"),O();case"remove":return await Z.remove(X.values.id),O();case"move-up":case"move-down":{let F=(await Z.read()).accounts.map((w)=>w.id),L=F.indexOf(X.values.id),R=L+(X.action==="move-up"?-1:1);if(L<0||R<0||R>=F.length)return{ok:!1,text:"Account cannot move in that direction."};let E=F[L],b=F[R];if(E===void 0||b===void 0)return{ok:!1,text:"Account order changed."};return F[L]=b,F[R]=E,await Z.reorder(F),O()}case"add-apikey":return await Z.addApi(X.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let z=new AbortController;Y.get(X.sessionId)?.active.abort();let F={active:z,auth:void 0};Y.set(X.sessionId,F);let L=await B$("max");if(M||z.signal.aborted||B.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return F.auth=L,{ok:!0,text:`Open ${L.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let z=Y.get(X.sessionId);if(!z?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let F=await L$(X.values.code,z.auth.verifier,z.auth.redirectUri,z.auth.state);if(z.active.signal.throwIfAborted(),B.signal?.throwIfAborted(),M||F.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await Z.loginOAuth({routeId:crypto.randomUUID(),credential:{access:F.access,refresh:F.refresh,expires:F.expires},label:X.values.label}),z.active.signal.throwIfAborted(),B.signal?.throwIfAborted(),M)return{ok:!1,text:"Sign-in cancelled."};Y.delete(X.sessionId);let L="OAuth account stored in the native account pool.";return{ok:!0,text:E1(await Z.read())?`${L}
 
-${X1}
+${C1}
 
-Adding an account here does not change OpenCode's Anthropic connection.`:P}}case"reset-backoff":{let M=await X.read();for(let G of M.accounts){if(U.signal?.throwIfAborted(),G.type!=="oauth")continue;let P=G.source==="vault"?await X.authorizeVault(G.id,U.signal):await X.captureLocalSubject(G.id);await X.resetBackoff(G.id,P)}return C()}case"enrollment-reset":{let M=await lX(IX("opencode"),RX);return{ok:M==="reset",text:M==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":M==="refused-pending"?"An enrollment request may still be in progress. Quit OpenCode and run setup again; it picks up the same request.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let G=(await X.read()).accounts.filter((S)=>S.type==="oauth"&&hX(S)),P=await Promise.allSettled(G.map((S)=>X.fetchQuota(S.id,void 0,U.signal)));return{ok:P.every((S)=>S.status==="fulfilled"),text:`${P.filter((S)=>S.status==="fulfilled").length}/${G.length} native quota readings refreshed.`}}case"routing-reset":return await z.resetRouting(Y.sessionId),C();case"routing-mode":return await L("routing",{mode:Y.values.mode}),C();case"killswitch-on":case"killswitch-off":return await L("killswitch",{enabled:Y.action==="killswitch-on"}),C();case"killswitch-set":return await X.updateSettings((M)=>{let G=U$(M.killswitch),P={...U$(G.accounts)},R=G.main;for(let S of Y.values.entries){let D={five_hour:S.fh,seven_day:S.sd,...S.scoped!==void 0?{scoped:S.scoped}:{}};if(S.account==="main"||S.account==="all")R=D;if(S.account==="all")for(let l of Object.keys(P))P[l]=D;else if(S.account!=="main")P[S.account]=D}return{...M,killswitch:{...G,main:R,accounts:P}}}),C();case"cache-on":case"cache-off":return await L("claudeCache",{enabled:Y.action==="cache-on"}),C();case"cache-mode":return await L("claudeCache",{mode:Y.values.mode}),C();case"cachekeep-always":return await L("cacheKeep",{enabled:!0,always:!0}),C();case"cachekeep-off":return await L("cacheKeep",{enabled:!1}),C();case"cachekeep-window":return await L("cacheKeep",{enabled:!0,always:!1,startHour:Y.values.startHour,endHour:Y.values.endHour}),C();case"cachekeep-subagents":return await L("cacheKeep",{subagents:Y.values.enabled==="on"}),C();case"dump-on":case"dump-off":{let M=Y.action==="dump-on";await L("dump",{enabled:M});try{dX(M)}catch{}return C()}case"logging-level":{let M=mX(Y.values.level);if(!M)throw Error("Invalid log level");return await X.setLoggingLevel(M),C()}case"fast-on":case"fast-off":return await L("claudeFast",{enabled:Y.action==="fast-on"}),C();case"prime-on":case"prime-off":return await L("prime",{enabled:Y.action==="prime-on"}),C();case"start-fire":return await K(Y.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},K=(Y)=>$.start(Y,r2);return{dispatch:T,async readStatus(Y){let U=await X.read();if(Y==="account"){let G="No native Claude accounts.",P=[];if(U.mode==="claustrum"){let S=U.policyStorage.relay;if(S?.enabled===!0&&kX(S.transport,S.url)==="websocket")return new O2().message;let D=await pX(X);if(U=await X.read(),U.mode==="claustrum"){let l=await X.vault.read();if(D==="complete"&&!l?.view)D="failed";if(G=D==="complete"?uX:"No saved Claude accounts for this host yet.",l?.rejected?.length){if(G=Z1,U.accounts.length)P.push(Z1)}if(D==="pending")P.push("Vault account lookup is still running.");else if(D==="failed")P.push("Vault account lookup did not complete; reopen /claude to retry.")}}let R=[U.accounts.map(cX).join(`
-`)||G,...P].join(`
-`);return J1(U)?`${R}
+Adding an account here does not change OpenCode's Anthropic connection.`:L}}case"reset-backoff":{let z=await Z.read();for(let F of z.accounts){if(B.signal?.throwIfAborted(),F.type!=="oauth")continue;let L=F.source==="vault"?await Z.authorizeVault(F.id,B.signal):await Z.captureLocalSubject(F.id);await Z.resetBackoff(F.id,L)}return O()}case"enrollment-reset":{let z=await k$(C$("opencode"),N$);return{ok:z==="reset",text:z==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":z==="refused-pending"?"An enrollment request may still be in progress. Quit OpenCode and run setup again; it picks up the same request.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let F=(await Z.read()).accounts.filter((E)=>E.type==="oauth"&&x$(E)),L=await Promise.allSettled(F.map((E)=>Z.fetchQuota(E.id,void 0,B.signal)));return{ok:L.every((E)=>E.status==="fulfilled"),text:`${L.filter((E)=>E.status==="fulfilled").length}/${F.length} native quota readings refreshed.`}}case"routing-reset":return await V.resetRouting(X.sessionId),O();case"routing-mode":return await _("routing",{mode:X.values.mode}),O();case"killswitch-on":case"killswitch-off":return await _("killswitch",{enabled:X.action==="killswitch-on"}),O();case"killswitch-set":return await Z.updateSettings((z)=>{let F=E0(z.killswitch),L={...E0(F.accounts)},R=F.main;for(let E of X.values.entries){let b={five_hour:E.fh,seven_day:E.sd,...E.scoped!==void 0?{scoped:E.scoped}:{}};if(E.account==="main"||E.account==="all")R=b;if(E.account==="all")for(let w of Object.keys(L))L[w]=b;else if(E.account!=="main")L[E.account]=b}return{...z,killswitch:{...F,main:R,accounts:L}}}),O();case"cache-on":case"cache-off":return await _("claudeCache",{enabled:X.action==="cache-on"}),O();case"cache-mode":return await _("claudeCache",{mode:X.values.mode}),O();case"cachekeep-always":return await _("cacheKeep",{enabled:!0,always:!0}),O();case"cachekeep-off":return await _("cacheKeep",{enabled:!1}),O();case"cachekeep-window":return await _("cacheKeep",{enabled:!0,always:!1,startHour:X.values.startHour,endHour:X.values.endHour}),O();case"cachekeep-subagents":return await _("cacheKeep",{subagents:X.values.enabled==="on"}),O();case"dump-on":case"dump-off":{let z=X.action==="dump-on";await _("dump",{enabled:z});try{R$(z)}catch{}return O()}case"logging-level":{let z=S$(X.values.level);if(!z)throw Error("Invalid log level");return await Z.setLoggingLevel(z),O()}case"fast-on":case"fast-off":return await _("claudeFast",{enabled:X.action==="fast-on"}),O();case"prime-on":case"prime-off":return await _("prime",{enabled:X.action==="prime-on"}),O();case"start-fire":return await N(X.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},N=(X)=>$.start(X,G0);return{dispatch:C,async readStatus(X){let B=await Z.read();if(X==="account"){let F="No native Claude accounts.",L=[];if(B.mode==="claustrum"){let E=B.policyStorage.relay;if(E?.enabled===!0&&_$(E.transport,E.url)==="websocket")return new R2().message;let b=await A$(Z);if(B=await Z.read(),B.mode==="claustrum"){let w=await Z.vault.read();if(b==="complete"&&!w?.view)b="failed";if(F=b==="complete"?b$:"No saved Claude accounts for this host yet.",w?.rejected?.length){if(F=O1,B.accounts.length)L.push(O1)}if(b==="pending")L.push("Vault account lookup is still running.");else if(b==="failed")L.push("Vault account lookup did not complete; reopen /claude to retry.")}}let R=[B.accounts.map(w$).join(`
+`)||F,...L].join(`
+`);return E1(B)?`${R}
 
-${X1}
-Quota refresh checks the pool; it does not check OpenCode's Anthropic connection.`:R}if(Y==="quota")return qX({accounts:U.accounts.filter((G)=>G.type==="oauth").map((G)=>({name:G.label??G.id,role:G.id==="main"?"main":"fallback",enabled:G.enabled,quota:G.quota,tierLabel:DX(G.profile),lastRefreshedAt:G.lastRefreshedAt,error:G.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(Y==="prime")return AX({enabled:U.policyStorage.prime?.enabled===!0,accounts:xX(U.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");if(Y==="cachekeep"){let G=await $.cacheKeepRegistry?.list()??[];return SX({enabled:gX(U.policyStorage),always:vX(U.policyStorage),hybridActive:fX(U.policyStorage),trackedSessionDetails:G,window:yX(U.policyStorage),trackedSessions:G.length,nextPrewarmAt:G.length?Math.min(...G.map((P)=>P.nextPrewarmAt)):void 0})}let M={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(U.settings[M[Y]]??{})},async readSidebar(Y){let[U,M]=await Promise.all([X.read(),$.cacheKeepRegistry?.list()??[]]);return o2($1(U,{activeId:z.servedAccount(Y),trackedSessions:M.length,now:Date.now()}))},forgetSession(Y){W.get(Y)?.active.abort(),W.delete(Y)},close(){F=!0;for(let Y of W.values())Y.active.abort();W.clear()}}}import{resolveClaudeModelCapabilities as iX}from"@cortexkit/anthropic-auth-core";function G1(){let $=new Map;return{install:(z)=>z.model.transform((W)=>{$.clear();for(let F of W.list("anthropic")){$.set(String(F.id),String(F.modelID));let L=iX(F.modelID)?.efforts.variants;if(!L)continue;W.update("anthropic",String(F.id),(C)=>{let T=C.variants.filter((K)=>!L.some((Y)=>Y===String(K.id)));C.variants=[...T,...L.map((K)=>({id:K,settings:{effort:K,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(z)=>$.get(z)??z}}function j1($){return $.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??$.get("x-api-key")??void 0}import{buildPrimeRequestBody as V1,effectiveRelayTransport as Q1,nativeAccountCanServe as oX,PrimeManager as rX,tokenFingerprint as W1}from"@cortexkit/anthropic-auth-core";var B1=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{};function z1($){let{runtime:X,source:z}=$,W=new AbortController,F=new Set,L=(K)=>({providerID:"anthropic",modelID:V1().model,sessionID:`oc2-prime:${K}`,agent:"prime",kind:"generate"}),C=async(K)=>{let Y=L(K),U=y2({source:z}),M=performance.now();try{for(let G=0;G<3;G++){if(W.signal.throwIfAborted(),(await X.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let R=await U.adapter.accountHeaders({...Y,accountId:K});if(!("headers"in R)||typeof R.headers!=="object"||R.headers===null||typeof R.attempt!=="object"||R.attempt===null)throw Error("Native Prime authorization refused");let S={...Y,accountId:K,attemptId:crypto.randomUUID(),transport:"http",data:R.attempt},D,l=!1,v=!1,n=(t)=>{v=!0,t.body?.cancel().catch(()=>{})};try{let t=await U.adapter.rewriteRequest?.({...Y,accountId:K,attempt:S,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(V1()),signal:W.signal})});if(!t)throw Error("Native Prime rewrite refused");let a=new Headers(t.headers);for(let[k,y]of Object.entries(R.headers))if(y===null)a.delete(k);else a.set(k,y);let M2=new Request(t,{headers:a}),W2=await($.fetch??fetch)(M2),J=await U.adapter.rewriteResponse?.({...Y,accountId:K,request:M2,response:W2,attempt:S})??W2;D=J.status,U.adapter.quotaFromHeaders?.(J.headers,J.status,S);let Q=J.ok?void 0:await U.adapter.limitFromResponse?.({status:J.status,headers:J.headers,body:()=>J.clone().text(),attempt:S});if(Q&&/^(vault-newer|local-newer|relay-direct):/.test(Q.reason)&&G<2){n(J);let k={...Y,phase:"retry",rerouteFrom:{accountId:K,limit:Q}};if(await z.chooseAccount(k)!==K)throw Error("Native Prime retry changed account");continue}if(!J.ok)return n(J),{ok:!1,status:D,ms:performance.now()-M,error:"Native Prime upstream refused the request"};let B=B1(await J.json()),E=B1(B.usage),b={inputTokens:typeof E.input_tokens==="number"?E.input_tokens:void 0,outputTokens:typeof E.output_tokens==="number"?E.output_tokens:void 0};if(S.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(J.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(l=await z.recordPrime(R.attempt.provenance,b),!l)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:D,ms:performance.now()-M,usage:b}}finally{await U.adapter.onAttemptEnd?.(S,{status:D,outputStarted:!1,...l?{}:{error:{reason:v?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-M}}finally{U.dispose()}},T=new rX({storagePath:$.paths.legacyConfig,loadStorage:async()=>(await X.read()).policyStorage,async getAccountFingerprint(K){let Y=await X.read(),U=Y.accounts.find((P)=>P.id===K);if(!oX(U)||U?.type!=="oauth")return;if(Y.policyStorage.relay?.enabled===!0&&Q1(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")return;if(U.source==="vault"){let P=await X.authorizeVault(K,W.signal),R=await X.getOrCreateAuthLineage(K,P);return R?W1(R):void 0}let M=await X.authorizeLocal(K,{signal:W.signal});if(M.status!=="usable")return;let G=await X.getOrCreateAuthLineage(K,M.subject);return G?W1(G):void 0},async refreshQuota(K){let Y=await X.read();if(Y.policyStorage.relay?.enabled===!0&&Q1(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await X.fetchQuota(K,$.fetch,W.signal),fresh:!0}},sendPrime(K){let Y=C(K);return F.add(Y),Y.finally(()=>F.delete(Y)),Y},async recordSuccess(K){let Y=(await X.read()).accounts.find((U)=>U.id===K);if(!Y?.prime)throw Error("Native Prime counters are unavailable");return Y.prime}});return T.start(),{manager:T,async dispose(){T.stop(),W.abort(),await Promise.allSettled(F)}}}import{createNativeUsagePublisher as nX,decideStickyQuotaFailure as sX,effectiveRelayTransport as aX,getClaudeCodeIdentityForVerifiedAccount as a2,getQuotaCheckIntervalMs as tX,getRoutingMode as H$,isDumpPersistentlyEnabled as U1,isQuotaBearingHeaderFrame as eX,logger as $Z,mergeHeaderQuotaForPersistence as XZ,NativeVaultNoAccountError as ZZ,nativeAccountCanServe as I2,nativeAccountPolicy as t2,nativeLocalAccountRefusal as JZ,nativeLocalQuotaLineage as YZ,nativePollQuotaGenerallyExhausted as GZ,normalizeQuotaHeaders as jZ,quotaSnapshotCheckedAt as K1,quotaSnapshotHasStandardWindows as VZ,readNativeAccountsForRequest as QZ,remapModelId as K$,StickySessionRouter as WZ,setDumpEnabled as BZ,shouldFallbackStatus as zZ,stickyQuotaSnapshotIsFresh as h2,stickyRetryAfterWithJitter as UZ,stickyRouteFamilyForModel as KZ}from"@cortexkit/anthropic-auth-core";var M$=($)=>["five_hour","seven_day"].some((X)=>($?.[X]?.remainingPercent??1)<=0);function MZ($,X,z,W){let F=$.rerouteFrom;if($.phase!=="retry"||F?.limit.status!==429||H$(X.policyStorage)!=="sticky-balanced")return;let L=z.find((T)=>T.id===F.accountId);if(!L||!h2(L.quota,X.policyStorage,Date.now(),W))return;let C=sX({quota:L.quota,modelId:W});if(C.action!=="hold")return;return{hold:{delayMs:UZ($.sessionID,C.retryAfterSeconds)*1000}}}function H1($){let{runtime:X}=$,z=nX("native-auth"),W=new Map,F=(J)=>{let Q=J.routingPath;if(!Q)throw Error("Native routing storage is unavailable");let B=W.get(Q);if(!B)B=new WZ({path:Q,vaultSeed:J.routingSeed,onLockEvent:X.onLockEvent,relocationGuard:X.relocationGuard,localRecoveryPath:J.mode==="local"?J.routingRecoveryPath:void 0}),W.set(Q,B);return B.setVaultSeed(J.routingSeed),B},L=new WeakMap,C=new Map,T=new Map,K=new Map,Y=new Map,U=new WeakSet,M=!1,G=()=>{while(C.size>512){let J=C.keys().next();if(!J.done)C.delete(J.value)}},P=(J)=>{try{BZ(U1(J.policyStorage))}catch{}},R=async()=>{try{let J=await X.read();return P(J),U1(J.policyStorage)}catch{return!1}},S=(J,Q)=>JSON.stringify([J.sessionID,J.kind,J.modelID,Q]),D=(J)=>{if(M)throw Error("Native Anthropic source is closed");let Q=K.get(J.sessionID);if(!Q){Q=new AbortController,K.set(J.sessionID,Q);while(K.size>512){let B=K.keys().next();if(!B.done)W2.forgetSession?.(B.value)}}return Q},l=(J,Q,B)=>I2(J)&&(J.type==="api"||t2(J,Q,K$(B)).status==="allowed"),v=async(J,Q,B,E,b)=>{let k=await X.read();P(k),E.signal.throwIfAborted(),n(k);let y=k.accounts.find((m)=>m.id===J);if(!y||y.type!==B||!l(y,k,Q))return b?.(!y||!I2(y)?"account-unavailable":"account-policy"),!1;if(B==="api"){let m=k.accounts.find((i)=>i.id==="main"&&i.type==="oauth");return!!m&&h2(m.quota,k.policyStorage)&&M$(m.quota)}return!0},n=(J)=>{let Q=J.policyStorage.relay;if(Q?.enabled===!0&&aX(Q.transport,Q.url)==="websocket")throw new O2},t=async(J,Q)=>{if(n(J),Q||J.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let B=await X.getRelayConfig();if(!B)throw Error("request refused: native HTTP relay configuration is unavailable");if(B.transport!=="http")throw new O2;return{dispatch:{kind:"http-relay",url:B.url,token:B.token},relayFallback:B.fallbackToDirect}};async function a(J,Q,B){if(J.kind==="local"){let E=await X.publishLocal(J.subject,B);if(!E&&B.quota)$Z.warn("quota","Quota publication discarded");return E}if(J.kind==="vault"&&Q.receipt)await X.vault.publish(Q.receipt,B);else if(J.kind==="api"&&B.lastUsed!==void 0)await X.publishApi(J.subject,{lastUsed:B.lastUsed});return!0}function M2(J,Q,B){if(J.kind!=="local")return;let E=J.subject.binding,b=K1(B),k={lineage:YZ(E),accountUuid:E.identity,entry:{quota:B,checkedAt:b,refreshAfter:b},generalExhausted:GZ(B),routeBeforeSave:!0};return X.quotaObservations.hold(Q.account.id,k)?k:void 0}let W2={async chooseAccount(J){let Q=D(J);$.onOwnedRequest?.();let B=await X.read();P(B),Q.signal.throwIfAborted(),n(B);let E=K$(await $.resolveModelId?.(J)??J.modelID);if(Q.signal.throwIfAborted(),B.mode==="claustrum")B=await QZ(X,Q.signal),Q.signal.throwIfAborted();if(B.policyStorage.quota?.enabled!==!1){let g=!1;for(let d of B.accounts){if(!I2(d)||d.type!=="oauth")continue;if(VZ(d.quota)?h2(d.quota,B.policyStorage,Date.now(),E):Date.now()-K1(d.quota)<tX(B.policyStorage))continue;try{await X.fetchQuota(d.id,$.fetch,Q.signal,void 0,"admission"),g=!0}catch{Q.signal.throwIfAborted()}}if(g)B=await X.read();Q.signal.throwIfAborted()}let b=J.rerouteFrom?C.get(J.rerouteFrom.limit.reason):void 0;if(J.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(J.rerouteFrom.limit.reason)&&!b)return;if(b&&J.rerouteFrom){let g=B.accounts.find((J2)=>J2.id===b.accountId);if(!g||!l(g,B,E))return;C.delete(J.rerouteFrom.limit.reason);let d=S(J,b.accountId),p=T.get(d)??[];return p.push(b),T.set(d,p),b.accountId}let k=[];for(let g of B.accounts){if(g.type!=="oauth"||!l(g,B,E))continue;if(g.source==="local"){let d=await X.authorizeLocal(g.id,{signal:Q.signal,policy:(p,J2)=>t2(p,J2,E)});if(Q.signal.throwIfAborted(),d.status!=="usable")continue}k.push(g)}let y=MZ(J,B,k,E);if(y)return y;let m=k.filter((g)=>g.id!==J.rerouteFrom?.accountId);if(H$(B.policyStorage)==="sticky-balanced"){let g=m.map((p,J2)=>({accountId:p.id,order:J2,quota:p.quota??{kind:"unknown"}})),d=await F(B).resolve({sessionId:J.sessionID,family:KZ(E),modelId:E,affinityModelId:J.modelID,candidates:g,retainAccountIds:new Set(m.map((p)=>p.id)),...B.mode==="claustrum"?{accountIdentities:new Map(B.accounts.flatMap((p)=>p.accountIdentity?[[p.id,p.accountIdentity]]:[]))}:{},storage:B.policyStorage,inputBytes:1,preferredAccountId:J.previousAccountId,preserveOnNoCandidate:!0});if(Q.signal.throwIfAborted(),d)return d.accountId}else{let d=H$(B.policyStorage)==="fallback-first"?[...m.filter((p)=>p.id!=="main"),...m.filter((p)=>p.id==="main")]:[...m.filter((p)=>p.id==="main"),...m.filter((p)=>p.id!=="main")];if(d[0])return d[0].id}if(B.mode==="claustrum")throw new ZZ;let i=B.accounts.find((g)=>g.id==="main"&&g.type==="oauth");if(!i)return;let $2=i.quota;if(J.rerouteFrom?.limit.status===429||!h2($2,B.policyStorage))try{$2=await X.fetchQuota("main",$.fetch,Q.signal)}catch{return}if(Q.signal.throwIfAborted(),!M$($2))return;return B.accounts.find((g)=>g.type==="api"&&I2(g)&&g.id!==J.rerouteFrom?.accountId)?.id},dropChoice(J){let Q=S(J,J.accountId),B=T.get(Q);if(B?.shift(),B?.length===0)T.delete(Q)},async authorizeAccount(J,Q,B){let E=D(J),b=await X.read();P(b),E.signal.throwIfAborted(),n(b);let k=K$(await $.resolveModelId?.(J)??J.modelID);E.signal.throwIfAborted();let y=b.accounts.find((o)=>o.id===Q);if(!y||!l(y,b,k)){B?.(!y||!I2(y)?"account-unavailable":"account-policy");return}let m=S(J,Q),i=T.get(m),$2=i?.shift();if(i?.length===0)T.delete(m);let{dispatch:g,relayFallback:d}=await t(b,$2?.direct===!0);if(E.signal.throwIfAborted(),$2?.auth){if(!await v(Q,k,$2.auth.route,E,B))return;let o=L.get($2.auth.provenance);if(o?.receipt?.expiresAtMs!==void 0&&o.receipt.expiresAtMs!==null&&o.receipt.expiresAtMs<Date.now()+300000)return;if(o)L.set($2.auth.provenance,{...o,scope:{...J,modelID:k},account:y,active:E,relayFallback:d});return Y.set(J.sessionID,Q),{...$2.auth,dispatch:g}}let p={scope:{...J,modelID:k},active:E,account:y,retry:$2?.retry??!1,relayFallback:d,quota:y.quota};if(y.type==="api"){let o=b.accounts.find((A)=>A.id==="main"&&A.type==="oauth");if(!o||!h2(o.quota,b.policyStorage)||!M$(o.quota))return;let V=await X.authorizeApi(Q,E.signal);if(E.signal.throwIfAborted(),!await v(Q,k,"api",E))return;let H={kind:"api",subject:V.subject};return L.set(H,p),Y.set(J.sessionID,Q),{route:"api",headers:V.authHeader==="authorization-bearer"?{authorization:`Bearer ${V.apiKey}`}:{"x-api-key":V.apiKey},baseURL:V.baseURL,provenance:H,dispatch:g}}if(y.source==="vault"){let o=await X.authorizeVault(Q,E.signal);if(E.signal.throwIfAborted(),!await v(Q,k,"oauth",E,B))return;let V={kind:"vault",credentialId:o.credentialId,recordVersion:o.recordVersion};L.set(V,{...p,receipt:o});let H=o.assertedAccountIdentity;if(!H){B?.("account-unavailable");return}return Y.set(J.sessionID,Q),{route:"oauth",accessToken:o.accessToken,provenance:V,dispatch:g,identity:a2(H,H)}}let J2=await X.authorizeLocal(Q,{signal:E.signal,policy:(o,V)=>t2(o,V,k)});if(E.signal.throwIfAborted(),J2.status!=="usable"){let o=JZ(J2);if(o)B?.(o.reason);return}if(!await v(Q,k,"oauth",E,B))return;let P2={kind:"local",subject:J2.subject};L.set(P2,{...p,access:J2.access}),Y.set(J.sessionID,Q);let k2=J2.subject.binding.identity;return{route:"oauth",accessToken:J2.access,provenance:P2,dispatch:g,identity:a2(k2,k2)}},async requestOptions(J,Q){let B=D(J),E=await X.read();P(E),B.signal.throwIfAborted();let b=E.accounts.find((y)=>y.id===J.accountId);if(!b||!l(b,E,J.modelID))throw Q?.(!b||!I2(b)?"account-unavailable":"account-policy"),Error("request refused: native account is ineligible for this model");let k=L.get(J.provenance);if(k)L.set(J.provenance,{...k,scope:{...k.scope,modelID:J.modelID}});return $.requestOptions(J,E)},async admitRequest(J,Q){let B=L.get(J.provenance);if(!B||!await v(J.accountId,J.modelID,J.route,B.active,Q))throw Error("request refused: native account policy changed before dispatch");L.set(J.provenance,{...B,scope:{...B.scope,modelID:J.modelID}})},isDumpEnabled:()=>R(),onRequestPrepared:(J)=>$.onRequestPrepared?.(J),responseOptions(J){return $.responseOptions?.({...J,modelID:L.get(J.provenance)?.scope.modelID??J.modelID})},quotaFromHeaders(J,Q){let B=L.get(Q.provenance),E=M1(J);if(E)$.onRequestId?.(Q,E);if(!B||Q.route!=="oauth"||!eX(J))return;let b=Q.provenance.kind==="local"?Q.provenance.subject.binding.identity:B.receipt?.assertedAccountIdentity,k={...jZ(J),...b?{accountIdentity:b}:{}},y=XZ(B.quota,k);B.quota=y;let m=M2(Q.provenance,B,y),i=B.account.id,$2=()=>{if(m)X.quotaObservations.forget(i,m)};return z.observe(a(Q.provenance,B,{quota:y}).then((g)=>{if(!g)$2()},(g)=>{throw $2(),g})),k},async limitFromResponse(J){let Q=L.get(J.provenance);if(!Q)return;if(J.status===401&&Q.receipt){if(!U.has(Q.receipt))U.add(Q.receipt),await X.vault.reportFailure(Q.receipt,401,J.dispatch==="http-relay"?"relay_status_field":"direct");if(Q.retry||Q.active.signal.aborted)return;let E=Q.active,b=await X.vault.prepareRetry(Q.receipt,E.signal);if(E.signal.throwIfAborted(),!b.retry)return;let k=b.receipt,y=k.assertedAccountIdentity;if(!y)return;let m={kind:"vault",credentialId:k.credentialId,recordVersion:k.recordVersion};L.set(m,{...Q,receipt:k,retry:!0});let i=`vault-newer:${J.attemptId}`;return C.set(i,{sessionID:J.sessionID,accountId:J.accountId,retry:!0,auth:{route:"oauth",accessToken:k.accessToken,provenance:m,identity:a2(y,y)}}),G(),{reason:i,status:401}}if(J.status===401&&J.provenance.kind==="local"&&Q.access&&!Q.retry){if(Q.active.signal.aborted)return;let E=Q.active,b=await X.authorizeLocal(J.accountId,{rejectedAccessToken:Q.access,signal:E.signal,policy:(i,$2)=>t2(i,$2,Q.scope.modelID)});if(E.signal.throwIfAborted(),b.status!=="usable"||b.access===Q.access)return;let k={kind:"local",subject:b.subject};L.set(k,{...Q,access:b.access,retry:!0});let y=b.subject.binding.identity,m=`local-newer:${J.attemptId}`;return C.set(m,{sessionID:J.sessionID,accountId:J.accountId,retry:!0,auth:{route:"oauth",accessToken:b.access,provenance:k,identity:a2(y,y)}}),G(),{reason:m,status:401}}let B=await X.read();if(zZ(J.status,B.policyStorage))return{reason:`provider-${J.status}`,status:J.status};return},limitFromRelayFailure(J){let Q=L.get(J.provenance);if(!Q?.relayFallback||Q.active.signal.aborted||!(J.status===401||J.status>=500))return;let B=`relay-direct:${J.attemptId}`;return C.set(B,{sessionID:J.sessionID,accountId:J.accountId,direct:!0,retry:!1}),G(),{reason:B}},limitFromStreamError(J){return J.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(J,Q){let B=L.get(Q.provenance);if(Q.dispatch==="http-relay"&&B?.relayFallback&&!B.active.signal.aborted&&J.status===void 0){let E=`relay-direct:${Q.attemptId}`;return C.set(E,{sessionID:Q.sessionID,accountId:Q.accountId,direct:!0,retry:!1}),G(),{reason:E}}return},async onAttemptEnd(J,Q){let B=L.get(J.provenance);if(!B)return;try{if(Q.status===401&&B.receipt&&!U.has(B.receipt))U.add(B.receipt),await X.vault.reportFailure(B.receipt,401,J.dispatch==="http-relay"?"relay_status_field":"direct");if(!Q.localRefusal&&Q.status!==void 0)z.publish(()=>a(J.provenance,B,{lastUsed:Date.now()}))}finally{L.delete(J.provenance)}},forgetSession(J){K.get(J)?.abort(),K.delete(J),Y.delete(J);for(let[Q,B]of C)if(B.sessionID===J)C.delete(Q);for(let[Q,B]of T)if(B[0]?.sessionID===J)T.delete(Q);$.onForgetSession?.(J)},servedAccount:(J)=>Y.get(J),resetRouting:async(J)=>F(await X.read()).clear(J),async recordPrime(J,Q){let B=L.get(J);if(!B||B.active.signal.aborted)return!1;if(J.kind==="local")return X.incrementPrimeUsage(B.account.id,J.subject,Q);if(J.kind==="vault"&&B.receipt)return X.incrementPrimeUsage(B.account.id,B.receipt,Q);return!1},drainRoutingPublications:()=>Promise.all([X.drainRoutingPublications(),...[...W.values()].map((J)=>J.drain())]).then(()=>{}),close(){M=!0;for(let J of K.values())J.abort();return K.clear(),T.clear(),C.clear(),Promise.all([z.drain(),W2.drainRoutingPublications()]).then(()=>{})}};return W2}import{remapModelId as HZ}from"@cortexkit/anthropic-auth-core";function L1(){let $=new _1,X=new Map,z=new Map,W=new Map,F=new Set,L=new Set,C=new Map,T=(K)=>{while(K.size>512){let Y=K.keys().next();if(!Y.done)K.delete(Y.value)}};return{async install(K){let Y=[];try{Y.push(await K.session.hook("context",(U)=>{let M=U.messages.map((P)=>{return{info:{id:P.id,sessionID:U.sessionID,role:P.role,agent:U.agent,model:{providerID:U.model.providerID,modelID:U.model.id}},parts:P.content.map((R)=>({type:R.type,...R.type==="text"?{text:R.text}:{}}))}});$.observeMessages(M);let G=U.messages.findLast((P)=>P.role==="user"&&P.id);if(G?.id)X.set(U.sessionID,G.id);if(G?.content.some((P)=>P.type==="text"&&P.text===r2))F.add(U.sessionID);else F.delete(U.sessionID);T(X)},{providerID:"anthropic"})),Y.push(await K.session.hook("model.request",(U)=>{if(U.kind!=="primary")return;let M=X.get(U.sessionID);if(!M)return;if($.markHeaders({sessionId:U.sessionID,messageId:M,agent:U.agent,headers:U.headers}),F.has(U.sessionID))U.headers[R2]="1"},{providerID:"anthropic"}))}catch(U){throw await Promise.allSettled(Y.map((M)=>M.dispose())),U}return{dispose:async()=>{await Promise.all(Y.map((U)=>U.dispose()))}}},requestOptions(K,Y){let U=$.resolveHeader(K.correlation[c2]);if(U)z.set(K.attemptId,U),T(z);C.set(K.attemptId,K.sessionID),T(C);let M=K.correlation[R2]==="1";if(M)L.add(K.attemptId);return{cache1hEnabled:K.agent!=="compaction"&&K.agent!=="title"&&(Y.policyStorage.claudeCache?.enabled??!0),cache1hMode:Y.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:Y.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:Y.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,turnEndNoteEnabled:!0,turnEndNote:Y.policyStorage.turnEndNote,serverSideFallbackEnabled:N1(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:M,billingLineage:U?{promptId:U.promptId,previousRequestId:U.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:W.get(K.sessionID)}},responseOptions(K){return{serverSideFallbackModel:HZ(K.modelID),laneStart:L.has(K.attemptId),onMessageStart(Y){if(K.kind==="primary"&&typeof Y.id==="string")W.set(K.sessionID,Y.id),T(W)},onStreamEnd(){z.delete(K.attemptId),L.delete(K.attemptId),C.delete(K.attemptId)}}},onRequestId(K,Y){$.commit(z.get(K.attemptId),Y)},forgetSession(K){$.clearSession(K),X.delete(K),W.delete(K),F.delete(K);for(let[Y,U]of C)if(U===K)z.delete(Y),L.delete(Y),C.delete(Y)}}}var e2="cortexkit-anthropic-auth",DZ='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',yZ="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",IZ="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function vZ($){let X=$.authorize??LZ,z=$.exchange??CZ,W=()=>{if(!$.isActive())throw Error("Claude authentication setup is closed")},F=async()=>{let T;try{T=await $.readMode()}catch{throw Error(IZ)}return W(),T},L=async()=>{if(await F()!=="local")throw Error(DZ)};return{integrationID:"anthropic",methods:[{method:{id:n2,type:"oauth",label:s2},async authorize(){W(),await L();let T=await X("max");return W(),{mode:"code",url:T.url,instructions:"Paste the authorization code returned by Claude.",callback:async(K)=>{W();let Y=await z(K,T.verifier,T.redirectUri,T.state);if(!$.isActive()||Y.type!=="success")throw Error("Claude sign-in did not complete");return{access:Y.access,refresh:Y.refresh,expires:Y.expires}}}}}],vault:{method:{id:F1,type:"oauth",label:"Claude vault accounts"},async activate(){if(W(),await F()!=="claustrum")throw Error(yZ)}},async onLogin(T){W(),await L(),await $.runtime.loginOAuth({routeId:"main",credential:T,replace:!0}),W()},label:"Claude native account pool"}}function fZ($){return{readMode:()=>qZ("opencode",$),disconnectVault:()=>TZ({host:"opencode",env:$})}}function N$($={}){return{id:e2,setup:(X)=>T1(X,$)}}async function gZ($){try{return await mZ($)}catch(X){throw hZ(X)}}function hZ($){let X=i2($);if(X)return X;let z=bZ("decide where its account state is",[],$);return _$.error("state-layout",z.message,{code:z.code}),i2(z)??z}async function mZ($){if($.paths){let z=$.paths;return await NZ(z),{paths:z,holderRegistration:await xZ({paths:z,role:"opencode2",kind:SZ(),policy:wZ(),onLockEvent:$.local?.onLockEvent})}}let X=await PZ({role:"opencode2",onLockEvent:$.local?.onLockEvent});return{paths:await AZ(void 0,void 0,X.layout),holderRegistration:X.kind==="state-home"?void 0:X.registration}}async function T1($,X={}){let{paths:z,holderRegistration:W}=await gZ(X),F=_Z({paths:z,host:"opencode",local:X.local,vault:X.vault}),L=fZ(X.vault?.env??process.env);try{let v=await F.read();if(!process.env.OPENCODE_ANTHROPIC_AUTH_LOG_LEVEL)kZ(OZ(v.policyStorage)??"info");RZ(EZ(v.policyStorage))}catch{}let C=!0,T=L1(),K=G1(),Y,U,M,G=H1({runtime:F,paths:z,fetch:X.fetch,requestOptions:T.requestOptions,responseOptions:T.responseOptions,onRequestId:T.onRequestId,onForgetSession:T.forgetSession,onRequestPrepared:async(v)=>{try{await M?.track(v)}catch{_$.warn("cachekeep","live request tracking failed")}},resolveModelId:async(v)=>K.modelId(v.modelID),onOwnedRequest:()=>{Y??=n$(F,X.fetch),U??=z1({runtime:F,paths:z,source:G,fetch:X.fetch})}});M=i$({...X.cacheKeep,runtime:F,source:G,storageId:z.storageId,fetch:X.fetch,isSubagent:async(v)=>Boolean((await $.session.get({sessionID:v})).parentID)});let P=Y1({runtime:F,source:G,cacheKeepRegistry:M.registry,start:async(v,n)=>{await $.session.synthetic({sessionID:v,text:n,description:"Claude lane start",resume:!0})}}),R=[],S=await o$($,{source:G,log:{warn:(v,n)=>_$.warn("opencode2",v,n)}},{credential:j1}).catch(async(v)=>{throw W?.close(),P.close(),await M?.dispose(),await G.close(),await F.drainQuotaPublications(),await F.close(),v}),D,l=()=>{if(D)return D;return C=!1,W?.close(),P.close(),G.close(),D=(async()=>{await Promise.allSettled([S.dispose(),Y?.dispose(),U?.dispose(),M?.dispose(),...R.map((v)=>v.dispose())]),await G.close(),await F.drainQuotaPublications(),await F.close()})(),D};try{R.push(await T.install($)),R.push(await K.install($)),R.push(await J$($,vZ({isActive:()=>C,readMode:L.readMode,runtime:F})));let v={host:"opencode",dispatch:P.dispatch,readStatus:(t)=>P.readStatus(t),readAccounts:()=>F.read(),readMode:L.readMode,disconnectVault:L.disconnectVault,interactive:!0},n=FZ(v);return R.push(await P1($,n,P)),l}catch(v){throw await l(),v}}var Q4={id:e2,setup:N$().setup,server:C1};export{T1 as setupAnthropicAuth,Q4 as default,N$ as createAnthropicAuthPlugin,e2 as ANTHROPIC_AUTH_PLUGIN_ID};
+${C1}
+Quota refresh checks the pool; it does not check OpenCode's Anthropic connection.`:R}if(X==="quota")return M$({accounts:B.accounts.filter((F)=>F.type==="oauth").map((F)=>({name:F.label??F.id,role:F.id==="main"?"main":"fallback",enabled:F.enabled,quota:F.quota,tierLabel:P$(F.profile),lastRefreshedAt:F.lastRefreshedAt,error:F.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(X==="prime")return H$({enabled:B.policyStorage.prime?.enabled===!0,accounts:K$(B.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");if(X==="cachekeep"){let F=await $.cacheKeepRegistry?.list()??[];return z$({enabled:q$(B.policyStorage),always:O$(B.policyStorage),hybridActive:E$(B.policyStorage),trackedSessionDetails:F,window:T$(B.policyStorage),trackedSessions:F.length,nextPrewarmAt:F.length?Math.min(...F.map((L)=>L.nextPrewarmAt)):void 0})}let z={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(B.settings[z[X]]??{})},async readSidebar(X){let[B,z]=await Promise.all([Z.read(),$.cacheKeepRegistry?.list()??[]]);return X0(T1(B,{activeId:V.servedAccount(X),trackedSessions:z.length,now:Date.now()}))},forgetSession(X){Y.get(X)?.active.abort(),Y.delete(X)},close(){M=!0;for(let X of Y.values())X.active.abort();Y.clear()}}}import{resolveClaudeModelCapabilities as D$}from"@cortexkit/anthropic-auth-core";function x1(){let $=new Map;return{install:(V)=>V.model.transform((Y)=>{$.clear();for(let M of Y.list("anthropic")){$.set(String(M.id),String(M.modelID));let _=D$(M.modelID)?.efforts.variants;if(!_)continue;Y.update("anthropic",String(M.id),(O)=>{let C=O.variants.filter((N)=>!_.some((X)=>X===String(N.id)));O.variants=[...C,..._.map((N)=>({id:N,settings:{effort:N,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(V)=>$.get(V)??V}}function S1($){return $.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??$.get("x-api-key")??void 0}import{buildPrimeRequestBody as k1,effectiveRelayTransport as R1,nativeAccountCanServe as I$,PrimeManager as y$,tokenFingerprint as b1}from"@cortexkit/anthropic-auth-core";var A1=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{};function w1($){let{runtime:Z,source:V}=$,Y=new AbortController,M=new Set,_=(N)=>({providerID:"anthropic",modelID:k1().model,sessionID:`oc2-prime:${N}`,agent:"prime",kind:"generate"}),O=async(N)=>{let X=_(N),B=h2({source:V}),z=performance.now();try{for(let F=0;F<3;F++){if(Y.signal.throwIfAborted(),(await Z.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let R=await B.adapter.accountHeaders({...X,accountId:N});if(!("headers"in R)||typeof R.headers!=="object"||R.headers===null||typeof R.attempt!=="object"||R.attempt===null)throw Error("Native Prime authorization refused");let E={...X,accountId:N,attemptId:crypto.randomUUID(),transport:"http",data:R.attempt},b,w=!1,f=!1,v=(i)=>{f=!0,i.body?.cancel().catch(()=>{})};try{let i=await B.adapter.rewriteRequest?.({...X,accountId:N,attempt:E,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(k1()),signal:Y.signal})});if(!i)throw Error("Native Prime rewrite refused");let a=new Headers(i.headers);for(let[q,A]of Object.entries(R.headers))if(A===null)a.delete(q);else a.set(q,A);let Y2=new Request(i,{headers:a}),j2=await($.fetch??fetch)(Y2),e=await B.adapter.rewriteResponse?.({...X,accountId:N,request:Y2,response:j2,attempt:E})??j2;b=e.status,B.adapter.quotaFromHeaders?.(e.headers,e.status,E);let u=e.ok?void 0:await B.adapter.limitFromResponse?.({status:e.status,headers:e.headers,body:()=>e.clone().text(),attempt:E});if(u&&/^(vault-newer|local-newer|relay-direct):/.test(u.reason)&&F<2){if(v(e),(await V.retrySameAccount?.({...X,accountId:N,attempt:F+1,limit:u,error:{type:"api_error",message:"Native Prime credential retry",status:e.status}}))?.accountId!==N)throw Error("Native Prime retry changed account");continue}if(!e.ok)return v(e),{ok:!1,status:b,ms:performance.now()-z,error:"Native Prime upstream refused the request"};let J=A1(await e.json()),W=A1(J.usage),U={inputTokens:typeof W.input_tokens==="number"?W.input_tokens:void 0,outputTokens:typeof W.output_tokens==="number"?W.output_tokens:void 0};if(E.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(e.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(w=await V.recordPrime(R.attempt.provenance,U),!w)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:b,ms:performance.now()-z,usage:U}}finally{await B.adapter.onAttemptEnd?.(E,{status:b,outputStarted:!1,...w?{}:{error:{reason:f?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-z}}finally{B.dispose()}},C=new y$({storagePath:$.paths.legacyConfig,loadStorage:async()=>(await Z.read()).policyStorage,async getAccountFingerprint(N){let X=await Z.read(),B=X.accounts.find((L)=>L.id===N);if(!I$(B)||B?.type!=="oauth")return;if(X.policyStorage.relay?.enabled===!0&&R1(X.policyStorage.relay.transport,X.policyStorage.relay.url)==="websocket")return;if(B.source==="vault"){let L=await Z.authorizeVault(N,Y.signal),R=await Z.getOrCreateAuthLineage(N,L);return R?b1(R):void 0}let z=await Z.authorizeLocal(N,{signal:Y.signal});if(z.status!=="usable")return;let F=await Z.getOrCreateAuthLineage(N,z.subject);return F?b1(F):void 0},async refreshQuota(N){let X=await Z.read();if(X.policyStorage.relay?.enabled===!0&&R1(X.policyStorage.relay.transport,X.policyStorage.relay.url)==="websocket")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await Z.fetchQuota(N,$.fetch,Y.signal),fresh:!0}},sendPrime(N){let X=O(N);return M.add(X),X.finally(()=>M.delete(X)),X},async recordSuccess(N){let X=(await Z.read()).accounts.find((B)=>B.id===N);if(!X?.prime)throw Error("Native Prime counters are unavailable");return X.prime}});return C.start(),{manager:C,async dispose(){C.stop(),Y.abort(),await Promise.allSettled(M)}}}import{createNativeUsagePublisher as f$,decideStickyQuotaFailure as v$,effectiveRelayTransport as g$,getClaudeCodeIdentityForVerifiedAccount as Q0,getQuotaCheckIntervalMs as h$,getRoutingMode as x0,isDumpPersistentlyEnabled as D1,isQuotaBearingHeaderFrame as m$,logger as l$,mergeHeaderQuotaForPersistence as d$,NativeVaultNoAccountError as u$,nativeAccountCanServe as l2,nativeAccountPolicy as W0,nativeLocalAccountRefusal as p$,nativeLocalQuotaLineage as c$,nativePollQuotaGenerallyExhausted as i$,normalizeQuotaHeaders as o$,quotaSnapshotCheckedAt as I1,quotaSnapshotHasStandardWindows as n$,readNativeAccountsForRequest as r$,remapModelId as U0,StickySessionRouter as s$,setDumpEnabled as a$,shouldFallbackStatus as t$,stickyQuotaSnapshotIsFresh as c2,stickyRetryAfterWithJitter as e$,stickyRouteFamilyForModel as $5}from"@cortexkit/anthropic-auth-core";var q0=($)=>["five_hour","seven_day"].some((Z)=>($?.[Z]?.remainingPercent??1)<=0);function Z5($,Z,V,Y){let M=$.rerouteFrom;if($.phase!=="retry"||M?.limit.status!==429||x0(Z.policyStorage)!=="sticky-balanced")return;let _=V.find((C)=>C.id===M.accountId);if(!_||!c2(_.quota,Z.policyStorage,Date.now(),Y))return;let O=v$({quota:_.quota,modelId:Y});if(O.action!=="hold")return;return{hold:{delayMs:e$($.sessionID,O.retryAfterSeconds)*1000}}}function f1($){let{runtime:Z}=$,V=f$("native-auth"),Y=new Map,M=(J)=>{let W=J.routingPath;if(!W)throw Error("Native routing storage is unavailable");let U=Y.get(W);if(!U)U=new s$({path:W,vaultSeed:J.routingSeed,onLockEvent:Z.onLockEvent,relocationGuard:Z.relocationGuard,localRecoveryPath:J.mode==="local"?J.routingRecoveryPath:void 0}),Y.set(W,U);return U.setVaultSeed(J.routingSeed),U},_=new WeakMap,O=new Map,C=new Map,N=new Map,X=new Map,B=new WeakSet,z=!1,F=()=>{while(O.size>512){let J=O.keys().next();if(!J.done)O.delete(J.value)}},L=(J)=>{try{a$(D1(J.policyStorage))}catch{}},R=async()=>{try{let J=await Z.read();return L(J),D1(J.policyStorage)}catch{return!1}},E=(J)=>({providerID:J.providerID,sessionID:J.sessionID,kind:J.kind,modelID:J.modelID,agent:J.agent}),b=(J,W)=>JSON.stringify([J.providerID,J.sessionID,J.kind,J.modelID,J.agent,W]),w=(J)=>{if(z)throw Error("Native Anthropic source is closed");let W=N.get(J.sessionID);if(!W){W=new AbortController,N.set(J.sessionID,W);while(N.size>512){let U=N.keys().next();if(!U.done)u.forgetSession?.(U.value)}}return W},f=(J,W,U)=>l2(J)&&(J.type==="api"||W0(J,W,U0(U)).status==="allowed"),v=(J,W)=>J.source===W.source&&J.accountIdentity===W.accountIdentity&&J.credentialId===W.credentialId,i=async(J,W,U,q,A)=>{let y=await Z.read();L(y),q.signal.throwIfAborted(),a(y);let I=y.accounts.find((n)=>n.id===J);if(!I||I.type!==U||!f(I,y,W))return A?.(!I||!l2(I)?"account-unavailable":"account-policy"),!1;if(U==="api"){let n=y.accounts.find((d)=>d.id==="main"&&d.type==="oauth");return!!n&&c2(n.quota,y.policyStorage)&&q0(n.quota)}return!0},a=(J)=>{let W=J.policyStorage.relay;if(W?.enabled===!0&&g$(W.transport,W.url)==="websocket")throw new R2},Y2=async(J,W)=>{if(a(J),W||J.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let U=await Z.getRelayConfig();if(!U)throw Error("request refused: native HTTP relay configuration is unavailable");if(U.transport!=="http")throw new R2;return{dispatch:{kind:"http-relay",url:U.url,token:U.token},relayFallback:U.fallbackToDirect}};async function j2(J,W,U){if(J.kind==="local"){let q=await Z.publishLocal(J.subject,U);if(!q&&U.quota)l$.warn("quota","Quota publication discarded");return q}if(J.kind==="vault"&&W.receipt)await Z.vault.publish(W.receipt,U);else if(J.kind==="api"&&U.lastUsed!==void 0)await Z.publishApi(J.subject,{lastUsed:U.lastUsed});return!0}function e(J,W,U){if(J.kind!=="local")return;let q=J.subject.binding,A=I1(U),y={lineage:c$(q),accountUuid:q.identity,entry:{quota:U,checkedAt:A,refreshAfter:A},generalExhausted:i$(U),routeBeforeSave:!0};return Z.quotaObservations.hold(W.account.id,y)?y:void 0}let u={async chooseAccount(J){let W=w(J);$.onOwnedRequest?.();let U=await Z.read();L(U),W.signal.throwIfAborted(),a(U);let q=U0(await $.resolveModelId?.(J)??J.modelID);if(W.signal.throwIfAborted(),U.mode==="claustrum")U=await r$(Z,W.signal),W.signal.throwIfAborted();if(U.policyStorage.quota?.enabled!==!1){let m=!1;for(let r of U.accounts){if(!l2(r)||r.type!=="oauth")continue;if(n$(r.quota)?c2(r.quota,U.policyStorage,Date.now(),q):Date.now()-I1(r.quota)<h$(U.policyStorage))continue;try{await Z.fetchQuota(r.id,$.fetch,W.signal,void 0,"admission"),m=!0}catch{W.signal.throwIfAborted()}}if(m)U=await Z.read();W.signal.throwIfAborted()}if(J.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(J.rerouteFrom.limit.reason))return;let A=[];for(let m of U.accounts){if(m.type!=="oauth"||!f(m,U,q))continue;if(m.source==="local"){let r=await Z.authorizeLocal(m.id,{signal:W.signal,policy:(l,M2)=>W0(l,M2,q)});if(W.signal.throwIfAborted(),r.status!=="usable")continue}A.push(m)}let y=Z5(J,U,A,q);if(y)return y;let I=A.filter((m)=>m.id!==J.rerouteFrom?.accountId);if(x0(U.policyStorage)==="sticky-balanced"){let m=I.map((l,M2)=>({accountId:l.id,order:M2,quota:l.quota??{kind:"unknown"}})),r=await M(U).resolve({sessionId:J.sessionID,family:$5(q),modelId:q,affinityModelId:J.modelID,candidates:m,retainAccountIds:new Set(I.map((l)=>l.id)),...U.mode==="claustrum"?{accountIdentities:new Map(U.accounts.flatMap((l)=>l.accountIdentity?[[l.id,l.accountIdentity]]:[]))}:{},storage:U.policyStorage,inputBytes:1,preferredAccountId:J.previousAccountId,preserveOnNoCandidate:!0});if(W.signal.throwIfAborted(),r)return r.accountId}else{let r=x0(U.policyStorage)==="fallback-first"?[...I.filter((l)=>l.id!=="main"),...I.filter((l)=>l.id==="main")]:[...I.filter((l)=>l.id==="main"),...I.filter((l)=>l.id!=="main")];if(r[0])return r[0].id}if(U.mode==="claustrum")throw new u$;let n=U.accounts.find((m)=>m.id==="main"&&m.type==="oauth");if(!n)return;let d=n.quota;if(J.rerouteFrom?.limit.status===429||!c2(d,U.policyStorage))try{d=await Z.fetchQuota("main",$.fetch,W.signal)}catch{return}if(W.signal.throwIfAborted(),!q0(d))return;return U.accounts.find((m)=>m.type==="api"&&l2(m)&&m.id!==J.rerouteFrom?.accountId)?.id},dropChoice(){},async retrySameAccount(J){let W=J.limit?.reason,U=W?O.get(W):void 0;if(!U||b(U.scope,U.accountId)!==b(J,J.accountId))return;O.delete(U.reason);let q=w(J),A=await Z.read();q.signal.throwIfAborted(),a(A);let y=U0(await $.resolveModelId?.(J)??J.modelID);q.signal.throwIfAborted();let I=A.accounts.find((m)=>m.id===J.accountId);if(!I||!v(I,U.account)||!f(I,A,y))return;let n=b(J,J.accountId),d=C.get(n)??[];return d.push(U),C.set(n,d),{accountId:J.accountId}},dropSameAccountRetry(J){let W=b(J,J.accountId),U=C.get(W),q=U?.findIndex((A)=>!J.limit||A.reason===J.limit.reason)??-1;if(q!==-1)U?.splice(q,1);if(U?.length===0)C.delete(W)},async authorizeAccount(J,W,U){let q=w(J),A=await Z.read();L(A),q.signal.throwIfAborted(),a(A);let y=U0(await $.resolveModelId?.(J)??J.modelID);q.signal.throwIfAborted();let I=A.accounts.find((s)=>s.id===W);if(!I||!f(I,A,y)){U?.(!I||!l2(I)?"account-unavailable":"account-policy");return}let n=b(J,W),d=C.get(n),m=d?.shift();if(d?.length===0)C.delete(n);if(m&&!v(I,m.account))return;let{dispatch:r,relayFallback:l}=await Y2(A,m?.direct===!0);if(q.signal.throwIfAborted(),m?.auth){if(!await i(W,y,m.auth.route,q,U))return;let s=_.get(m.auth.provenance);if(s?.receipt?.expiresAtMs!==void 0&&s.receipt.expiresAtMs!==null&&s.receipt.expiresAtMs<Date.now()+300000)return;if(s)_.set(m.auth.provenance,{...s,scope:{...J,modelID:y},account:I,active:q,relayFallback:l});return X.set(J.sessionID,W),{...m.auth,dispatch:r}}let M2={scope:{...J,modelID:y},active:q,account:I,retry:m?.retry??!1,relayFallback:l,quota:I.quota};if(I.type==="api"){let s=A.accounts.find((x)=>x.id==="main"&&x.type==="oauth");if(!s||!c2(s.quota,A.policyStorage)||!q0(s.quota))return;let G=await Z.authorizeApi(W,q.signal);if(q.signal.throwIfAborted(),!await i(W,y,"api",q))return;let K={kind:"api",subject:G.subject};return _.set(K,M2),X.set(J.sessionID,W),{route:"api",headers:G.authHeader==="authorization-bearer"?{authorization:`Bearer ${G.apiKey}`}:{"x-api-key":G.apiKey},baseURL:G.baseURL,provenance:K,dispatch:r}}if(I.source==="vault"){let s=await Z.authorizeVault(W,q.signal);if(q.signal.throwIfAborted(),m&&(s.credentialId!==m.account.credentialId||s.assertedAccountIdentity!==m.account.accountIdentity))return;if(!await i(W,y,"oauth",q,U))return;let G={kind:"vault",credentialId:s.credentialId,recordVersion:s.recordVersion};_.set(G,{...M2,receipt:s});let K=s.assertedAccountIdentity;if(!K){U?.("account-unavailable");return}return X.set(J.sessionID,W),{route:"oauth",accessToken:s.accessToken,provenance:G,dispatch:r,identity:Q0(K,K)}}let L2=await Z.authorizeLocal(W,{signal:q.signal,policy:(s,G)=>W0(s,G,y)});if(q.signal.throwIfAborted(),L2.status!=="usable"){let s=p$(L2);if(s)U?.(s.reason);return}if(!await i(W,y,"oauth",q,U))return;let x2={kind:"local",subject:L2.subject};_.set(x2,{...M2,access:L2.access}),X.set(J.sessionID,W);let y2=L2.subject.binding.identity;return{route:"oauth",accessToken:L2.access,provenance:x2,dispatch:r,identity:Q0(y2,y2)}},async requestOptions(J,W){let U=w(J),q=await Z.read();L(q),U.signal.throwIfAborted();let A=q.accounts.find((I)=>I.id===J.accountId);if(!A||!f(A,q,J.modelID))throw W?.(!A||!l2(A)?"account-unavailable":"account-policy"),Error("request refused: native account is ineligible for this model");let y=_.get(J.provenance);if(y)_.set(J.provenance,{...y,scope:{...y.scope,modelID:J.modelID}});return $.requestOptions(J,q)},async admitRequest(J,W){let U=_.get(J.provenance);if(!U||!await i(J.accountId,J.modelID,J.route,U.active,W))throw Error("request refused: native account policy changed before dispatch");_.set(J.provenance,{...U,scope:{...U.scope,modelID:J.modelID}})},isDumpEnabled:()=>R(),onRequestPrepared:(J)=>$.onRequestPrepared?.(J),responseOptions(J){return $.responseOptions?.({...J,modelID:_.get(J.provenance)?.scope.modelID??J.modelID})},quotaFromHeaders(J,W){let U=_.get(W.provenance),q=y1(J);if(q)$.onRequestId?.(W,q);if(!U||W.route!=="oauth"||!m$(J))return;let A=W.provenance.kind==="local"?W.provenance.subject.binding.identity:U.receipt?.assertedAccountIdentity,y={...o$(J),...A?{accountIdentity:A}:{}},I=d$(U.quota,y);U.quota=I;let n=e(W.provenance,U,I),d=U.account.id,m=()=>{if(n)Z.quotaObservations.forget(d,n)};return V.observe(j2(W.provenance,U,{quota:I}).then((r)=>{if(!r)m()},(r)=>{throw m(),r})),y},async limitFromResponse(J){let W=_.get(J.provenance);if(!W)return;if(J.status===401&&W.receipt){if(!B.has(W.receipt))B.add(W.receipt),await Z.vault.reportFailure(W.receipt,401,J.dispatch==="http-relay"?"relay_status_field":"direct");if(W.retry||W.active.signal.aborted)return;let q=W.active,A=await Z.vault.prepareRetry(W.receipt,q.signal);if(q.signal.throwIfAborted(),!A.retry)return;let y=A.receipt,I=y.assertedAccountIdentity;if(!I)return;let n={kind:"vault",credentialId:y.credentialId,recordVersion:y.recordVersion};_.set(n,{...W,receipt:y,retry:!0});let d=`vault-newer:${J.attemptId}`;return O.set(d,{scope:E(J),reason:d,accountId:J.accountId,account:W.account,retry:!0,auth:{route:"oauth",accessToken:y.accessToken,provenance:n,identity:Q0(I,I)}}),F(),{reason:d,status:401}}if(J.status===401&&J.provenance.kind==="local"&&W.access&&!W.retry){if(W.active.signal.aborted)return;let q=W.active,A=await Z.authorizeLocal(J.accountId,{rejectedAccessToken:W.access,signal:q.signal,policy:(d,m)=>W0(d,m,W.scope.modelID)});if(q.signal.throwIfAborted(),A.status!=="usable"||A.access===W.access)return;let y={kind:"local",subject:A.subject};_.set(y,{...W,access:A.access,retry:!0});let I=A.subject.binding.identity,n=`local-newer:${J.attemptId}`;return O.set(n,{scope:E(J),reason:n,accountId:J.accountId,account:W.account,retry:!0,auth:{route:"oauth",accessToken:A.access,provenance:y,identity:Q0(I,I)}}),F(),{reason:n,status:401}}let U=await Z.read();if(t$(J.status,U.policyStorage))return{reason:`provider-${J.status}`,status:J.status};return},limitFromRelayFailure(J){let W=_.get(J.provenance);if(!W?.relayFallback||W.active.signal.aborted||!(J.status===401||J.status>=500))return;let U=`relay-direct:${J.attemptId}`;return O.set(U,{scope:E(J),reason:U,accountId:J.accountId,account:W.account,direct:!0,retry:!1}),F(),{reason:U}},limitFromStreamError(J){return J.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(J,W){let U=_.get(W.provenance);if(W.dispatch==="http-relay"&&U?.relayFallback&&!U.active.signal.aborted&&J.status===void 0){let q=`relay-direct:${W.attemptId}`;return O.set(q,{scope:E(W),reason:q,accountId:W.accountId,account:U.account,direct:!0,retry:!1}),F(),{reason:q}}return},async onAttemptEnd(J,W){let U=_.get(J.provenance);if(!U)return;try{if(W.status===401&&U.receipt&&!B.has(U.receipt))B.add(U.receipt),await Z.vault.reportFailure(U.receipt,401,J.dispatch==="http-relay"?"relay_status_field":"direct");if(!W.localRefusal&&W.status!==void 0)V.publish(()=>j2(J.provenance,U,{lastUsed:Date.now()}))}finally{_.delete(J.provenance)}},forgetSession(J){N.get(J)?.abort(),N.delete(J),X.delete(J);for(let[W,U]of O)if(U.scope.sessionID===J)O.delete(W);for(let[W,U]of C)if(U[0]?.scope.sessionID===J)C.delete(W);$.onForgetSession?.(J)},servedAccount:(J)=>X.get(J),resetRouting:async(J)=>M(await Z.read()).clear(J),async recordPrime(J,W){let U=_.get(J);if(!U||U.active.signal.aborted)return!1;if(J.kind==="local")return Z.incrementPrimeUsage(U.account.id,J.subject,W);if(J.kind==="vault"&&U.receipt)return Z.incrementPrimeUsage(U.account.id,U.receipt,W);return!1},drainRoutingPublications:()=>Promise.all([Z.drainRoutingPublications(),...[...Y.values()].map((J)=>J.drain())]).then(()=>{}),close(){z=!0;for(let J of N.values())J.abort();return N.clear(),C.clear(),O.clear(),Promise.all([V.drain(),u.drainRoutingPublications()]).then(()=>{})}};return u}import{remapModelId as j5}from"@cortexkit/anthropic-auth-core";function h1(){let $=new v1,Z=new Map,V=new Map,Y=new Map,M=new Set,_=new Set,O=new Map,C=(N)=>{while(N.size>512){let X=N.keys().next();if(!X.done)N.delete(X.value)}};return{async install(N){let X=[];try{X.push(await N.session.hook("context",(B)=>{let z=B.messages.map((L)=>{return{info:{id:L.id,sessionID:B.sessionID,role:L.role,agent:B.agent,model:{providerID:B.model.providerID,modelID:B.model.id}},parts:L.content.map((R)=>({type:R.type,...R.type==="text"?{text:R.text}:{}}))}});$.observeMessages(z);let F=B.messages.findLast((L)=>L.role==="user"&&L.id);if(F?.id)Z.set(B.sessionID,F.id);if(F?.content.some((L)=>L.type==="text"&&L.text===G0))M.add(B.sessionID);else M.delete(B.sessionID);C(Z)},{providerID:"anthropic"})),X.push(await N.session.hook("model.request",(B)=>{if(B.kind!=="primary")return;let z=Z.get(B.sessionID);if(!z)return;if($.markHeaders({sessionId:B.sessionID,messageId:z,agent:B.agent,headers:B.headers}),M.has(B.sessionID))B.headers[I2]="1"},{providerID:"anthropic"}))}catch(B){throw await Promise.allSettled(X.map((z)=>z.dispose())),B}return{dispose:async()=>{await Promise.all(X.map((B)=>B.dispose()))}}},requestOptions(N,X){let B=$.resolveHeader(N.correlation[t2]);if(B)V.set(N.attemptId,B),C(V);O.set(N.attemptId,N.sessionID),C(O);let z=N.correlation[I2]==="1";if(z)_.add(N.attemptId);return{cache1hEnabled:N.agent!=="compaction"&&N.agent!=="title"&&(X.policyStorage.claudeCache?.enabled??!0),cache1hMode:X.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:X.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:X.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,turnEndNoteEnabled:!0,turnEndNote:X.policyStorage.turnEndNote,serverSideFallbackEnabled:g1(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:z,billingLineage:B?{promptId:B.promptId,previousRequestId:B.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:Y.get(N.sessionID)}},responseOptions(N){return{serverSideFallbackModel:j5(N.modelID),laneStart:_.has(N.attemptId),onMessageStart(X){if(N.kind==="primary"&&typeof X.id==="string")Y.set(N.sessionID,X.id),C(Y)},onStreamEnd(){V.delete(N.attemptId),_.delete(N.attemptId),O.delete(N.attemptId)}}},onRequestId(N,X){$.commit(V.get(N.attemptId),X)},forgetSession(N){$.clearSession(N),Z.delete(N),Y.delete(N),M.delete(N);for(let[X,B]of O)if(B===N)V.delete(X),_.delete(X),O.delete(X)}}}var B0="cortexkit-anthropic-auth",P5='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',T5="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",C5="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function O5($){let Z=$.authorize??G5,V=$.exchange??W5,Y=()=>{if(!$.isActive())throw Error("Claude authentication setup is closed")},M=async()=>{let C;try{C=await $.readMode()}catch{throw Error(C5)}return Y(),C},_=async()=>{if(await M()!=="local")throw Error(P5)};return{integrationID:"anthropic",methods:[{method:{id:Y0,type:"oauth",label:V0},async authorize(){Y(),await _();let C=await Z("max");return Y(),{mode:"code",url:C.url,instructions:"Paste the authorization code returned by Claude.",callback:async(N)=>{Y();let X=await V(N,C.verifier,C.redirectUri,C.state);if(!$.isActive()||X.type!=="success")throw Error("Claude sign-in did not complete");return{access:X.access,refresh:X.refresh,expires:X.expires}}}}}],vault:{method:{id:m1,type:"oauth",label:"Claude vault accounts"},async activate(){if(Y(),await M()!=="claustrum")throw Error(T5)}},async onLogin(C){Y(),await _(),await $.runtime.loginOAuth({routeId:"main",credential:C,replace:!0}),Y()},label:"Claude native account pool"}}function E5($){return{readMode:()=>M5("opencode",$),disconnectVault:()=>Q5({host:"opencode",env:$})}}function k0($={}){return{id:B0,setup:(Z)=>d1(Z,$)}}async function q5($){try{return await S5($)}catch(Z){throw x5(Z)}}function x5($){let Z=e2($);if(Z)return Z;let V=L5("decide where its account state is",[],$);return S0.error("state-layout",V.message,{code:V.code}),e2(V)??V}async function S5($){if($.paths){let V=$.paths;return await X5(V),{paths:V,holderRegistration:await K5({paths:V,role:"opencode2",kind:z5(),policy:F5(),onLockEvent:$.local?.onLockEvent})}}let Z=await V5({role:"opencode2",onLockEvent:$.local?.onLockEvent});return{paths:await H5(void 0,void 0,Z.layout),holderRegistration:Z.kind==="state-home"?void 0:Z.registration}}async function d1($,Z={}){let{paths:V,holderRegistration:Y}=await q5(Z),M=J5({paths:V,host:"opencode",local:Z.local,vault:Z.vault}),_=E5(Z.vault?.env??process.env);try{let f=await M.read();if(!process.env.OPENCODE_ANTHROPIC_AUTH_LOG_LEVEL)_5(U5(f.policyStorage)??"info");N5(B5(f.policyStorage))}catch{}let O=!0,C=h1(),N=x1(),X,B,z,F=f1({runtime:M,paths:V,fetch:Z.fetch,requestOptions:C.requestOptions,responseOptions:C.responseOptions,onRequestId:C.onRequestId,onForgetSession:C.forgetSession,onRequestPrepared:async(f)=>{try{await z?.track(f)}catch{S0.warn("cachekeep","live request tracking failed")}},resolveModelId:async(f)=>N.modelId(f.modelID),onOwnedRequest:()=>{X??=N1(M,Z.fetch),B??=w1({runtime:M,paths:V,source:F,fetch:Z.fetch})}});z=M1({...Z.cacheKeep,runtime:M,source:F,storageId:V.storageId,fetch:Z.fetch,isSubagent:async(f)=>Boolean((await $.session.get({sessionID:f})).parentID)}),await z.ready;let L=q1({runtime:M,source:F,cacheKeepRegistry:z.registry,start:async(f,v)=>{await $.session.synthetic({sessionID:f,text:v,description:"Claude lane start",resume:!0})}}),R=[],E=await K1($,{source:F,log:{warn:(f,v)=>S0.warn("opencode2",f,v)}},{credential:S1}).catch(async(f)=>{throw Y?.close(),L.close(),await z?.dispose(),await F.close(),await M.drainQuotaPublications(),await M.close(),f}),b,w=()=>{if(b)return b;return O=!1,Y?.close(),L.close(),F.close(),b=(async()=>{await Promise.allSettled([E.dispose(),X?.dispose(),B?.dispose(),z?.dispose(),...R.map((f)=>f.dispose())]),await F.close(),await M.drainQuotaPublications(),await M.close()})(),b};try{R.push(await C.install($)),R.push(await N.install($)),R.push(await K0($,O5({isActive:()=>O,readMode:_.readMode,runtime:M})));let f={host:"opencode",dispatch:L.dispatch,readStatus:(i)=>L.readStatus(i),readAccounts:()=>M.read(),readMode:_.readMode,disconnectVault:_.disconnectVault,interactive:!0},v=Y5(f);return R.push(await l1($,v,L)),w}catch(f){throw await w(),f}}var Q8={id:B0,setup:k0().setup,server:u1};export{d1 as setupAnthropicAuth,Q8 as default,k0 as createAnthropicAuthPlugin,B0 as ANTHROPIC_AUTH_PLUGIN_ID};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/opencode-anthropic-auth",
-  "version": "2.4.4",
+  "version": "2.4.5",
   "type": "module",
   "repository": {
     "type": "git",
@@ -77,7 +77,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.6.0",
-    "@cortexkit/anthropic-auth-core": "2.4.4",
+    "@cortexkit/anthropic-auth-core": "2.4.5",
     "@cortexkit/claustrum-client": "0.13.0",
     "@cortexkit/private-files": "0.2.2",
     "@cortexkit/subc-client": "^0.22.10",