@cortexkit/opencode-anthropic-auth 2.4.4 → 2.4.6

package/dist/rpc/rpc-client.js

@@ -1 +1 @@
-import{ha as s}from"../index-gvswxab8.js";import"../index-71temqvq.js";async function i(e,o,t,n){let r=await s(e,n);if(!r)return null;let a=new AbortController,l=setTimeout(()=>a.abort(),2000);try{let p=await fetch(`http://127.0.0.1:${r.port}/rpc/${o}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${r.token}`},body:JSON.stringify(t),signal:a.signal});if(!p.ok)return null;return await p.json()}catch{return null}finally{clearTimeout(l)}}function c(e,o){return{async pending(t,n){return(await i(e,"pending-notifications",{lastReceivedId:t,sessionId:n},o))?.messages??[]},async apply(t){return await i(e,"apply",{...t},o)??{text:"apply failed",knobs:{}}},async applyMenu(t){if(t.command!=="claude"||!t.sessionId?.trim())throw TypeError("A claude menu sessionId is required");let n=await i(e,"apply-menu",{...t},o);if(!n)throw Error("Menu apply unavailable; outcome unknown");return n}}}export{c as createRpcClient};
+import{ka as s}from"../index-crx0xd9j.js";import"../index-n8xr16kr.js";async function i(e,o,t,n){let r=await s(e,n);if(!r)return null;let a=new AbortController,l=setTimeout(()=>a.abort(),2000);try{let p=await fetch(`http://127.0.0.1:${r.port}/rpc/${o}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${r.token}`},body:JSON.stringify(t),signal:a.signal});if(!p.ok)return null;return await p.json()}catch{return null}finally{clearTimeout(l)}}function c(e,o){return{async pending(t,n){return(await i(e,"pending-notifications",{lastReceivedId:t,sessionId:n},o))?.messages??[]},async apply(t){return await i(e,"apply",{...t},o)??{text:"apply failed",knobs:{}}},async applyMenu(t){if(t.command!=="claude"||!t.sessionId?.trim())throw TypeError("A claude menu sessionId is required");let n=await i(e,"apply-menu",{...t},o);if(!n)throw Error("Menu apply unavailable; outcome unknown");return n}}}export{c as createRpcClient};

package/dist/rpc/rpc-dir.js

@@ -1 +1 @@
-import{s as a,t as b}from"../index-hc7bm3yf.js";import"../index-71temqvq.js";export{a as tmpdir,b as getRpcDir};
+import{v as a,w as b}from"../index-jc8zwxvw.js";import"../index-n8xr16kr.js";export{a as tmpdir,b as getRpcDir};

package/dist/sidebar-state.js

@@ -1 +1 @@
-import{$ as u,H as a,I as b,J as c,K as d,L as e,M as f,N as g,O as h,P as i,Q as j,R as k,S as l,T as m,U as n,V as o,W as p,X as q,Y as r,Z as s,_ as t,aa as v,ba as w,ca as x,da as y,ea as z,fa as A}from"./index-j2cv839v.js";import"./index-71temqvq.js";export{i as setSidebarState,r as scopedQuotaShortNames,k as resolveActiveAccount,s as quotaLabelColumnWidth,c as normalizeSidebarState,a as getSidebarStateFile,h as getSidebarState,f as getInitialSidebarRoutingTestHooks,p as getFableRecoverySummary,w as getCollapsedQuotaSummary,x as getCollapsedAccounts,q as formatQuotaRowLabel,m as formatPrimeTime,n as formatPrimeCost,o as formatPrimeAccountValue,l as formatFallbackModelLabel,u as fitQuotaRow,v as fitPaceLine,j as drainSidebarWrites,A as computeQuotaPacing,d as __setSidebarStateWriteTestHooks,e as __setInitialSidebarRoutingTestHooks,g as __acquireSidebarStateLockForTest,z as SEVEN_DAY_MS,t as QUOTA_BAR_MIN_CELLS,y as FIVE_HOUR_MS,b as DEFAULT_SIDEBAR_STATE};
+import{$ as r,K as a,L as b,M as c,N as d,O as e,P as f,Q as g,R as h,S as i,T as j,U as k,V as l,W as m,X as n,Y as o,Z as p,_ as q,aa as s,ba as t,ca as u,da as v,ea as w,fa as x,ga as y,ha as z,ia as A}from"./index-d4e8qj37.js";import"./index-n8xr16kr.js";export{i as setSidebarState,r as scopedQuotaShortNames,k as resolveActiveAccount,s as quotaLabelColumnWidth,c as normalizeSidebarState,a as getSidebarStateFile,h as getSidebarState,f as getInitialSidebarRoutingTestHooks,p as getFableRecoverySummary,w as getCollapsedQuotaSummary,x as getCollapsedAccounts,q as formatQuotaRowLabel,m as formatPrimeTime,n as formatPrimeCost,o as formatPrimeAccountValue,l as formatFallbackModelLabel,u as fitQuotaRow,v as fitPaceLine,j as drainSidebarWrites,A as computeQuotaPacing,d as __setSidebarStateWriteTestHooks,e as __setInitialSidebarRoutingTestHooks,g as __acquireSidebarStateLockForTest,z as SEVEN_DAY_MS,t as QUOTA_BAR_MIN_CELLS,y as FIVE_HOUR_MS,b as DEFAULT_SIDEBAR_STATE};

package/dist/tui-preferences.js

@@ -1,4 +1,4 @@
-import"./index-71temqvq.js";import{readFileSync as S,statSync as b,watch as F}from"node:fs";import{mkdir as g,readFile as I,rename as T,writeFile as y}from"node:fs/promises";import{homedir as h}from"node:os";import{basename as v,dirname as _,join as N}from"node:path";import{clearTimeout as D,setTimeout as P}from"node:timers";import{applyEdits as f,modify as m,parse as p}from"jsonc-parser";var c="OPENCODE_TUI_PREFERENCES_FILE",u="tui-preferences.jsonc";function K(){let Q=process.env[c];if(Q)return Q;let q=process.env.OPENCODE_CONFIG_DIR||N(process.env.XDG_CONFIG_HOME||N(h(),".config"),"opencode");return N(q,u)}function H(Q){return typeof Q==="object"&&Q!==null&&!Array.isArray(Q)}async function Zq(){try{let Q=await I(K(),"utf8"),q=[],J=p(Q,q,{allowTrailingComma:!0});if(q.length>0)return{};return H(J)?J:{}}catch{return{}}}var s="anthropic-auth",d=160,k={forceToTop:!1,order:d,startCollapsed:!1,rememberCollapsed:!0,collapsed:null,pollMs:1500,refreshDebounceMs:200,header:{label:"CLAUDE",showVersion:!0},sections:{quota:!0,fallbackAccounts:!0,routing:!0,cache:!0,health:!0,pacing:!0},appearance:{barWidth:10,barFilledChar:"█",barEmptyChar:"░",warnThreshold:50,errorThreshold:80}};function z(Q,q){return typeof Q==="boolean"?Q:q}function B(Q,q,J,Z){if(typeof Q!=="number"||!Number.isFinite(Q))return q;return Math.min(Math.max(Math.round(Q),J),Z)}function o(Q,q,J){if(typeof Q!=="string"||Q.length===0)return q;return Q.slice(0,J)}function x(Q,q){if(typeof Q!=="string")return q;return[...Q][0]??q}function $q(Q){let q=Q[s];if(!H(q))return structuredClone(k);let J=k,Z=H(q.header)?q.header:{},X=H(q.sections)?q.sections:{},$=H(q.appearance)?q.appearance:{},Y=B($.warnThreshold,J.appearance.warnThreshold,0,99),G=Math.max(B($.errorThreshold,J.appearance.errorThreshold,0,100),Math.min(Y+1,100));return{forceToTop:z(q.forceToTop,J.forceToTop),order:B(q.order,J.order,-1e4,1e4),startCollapsed:z(q.startCollapsed,J.startCollapsed),rememberCollapsed:z(q.rememberCollapsed,J.rememberCollapsed),collapsed:typeof q.collapsed==="boolean"?q.collapsed:null,pollMs:B(q.pollMs,J.pollMs,500,30000),refreshDebounceMs:B(q.refreshDebounceMs,J.refreshDebounceMs,50,5000),header:{label:o(Z.label,J.header.label,20),showVersion:z(Z.showVersion,J.header.showVersion)},sections:{quota:z(X.quota,J.sections.quota),fallbackAccounts:z(X.fallbackAccounts,J.sections.fallbackAccounts),routing:z(X.routing,J.sections.routing),cache:z(X.cache,J.sections.cache),health:z(X.health,J.sections.health),pacing:z(X.pacing,J.sections.pacing)},appearance:{barWidth:B($.barWidth,J.appearance.barWidth,4,40),barFilledChar:x($.barFilledChar,J.appearance.barFilledChar),barEmptyChar:x($.barEmptyChar,J.appearance.barEmptyChar),warnThreshold:Y,errorThreshold:G}}}var n=-1e5;function zq(Q,q,J){let Z=Q[q];if(!H(Z))return J;if(Z.forceToTop===!0)return n+Object.keys(Q).indexOf(q);return B(Z.order,J,-1e4,1e4)}var i=`// Shared preferences for opencode TUI plugins.
+import"./index-n8xr16kr.js";import{readFileSync as S,statSync as b,watch as F}from"node:fs";import{mkdir as g,readFile as I,rename as T,writeFile as y}from"node:fs/promises";import{homedir as h}from"node:os";import{basename as v,dirname as _,join as N}from"node:path";import{clearTimeout as D,setTimeout as P}from"node:timers";import{applyEdits as f,modify as m,parse as p}from"jsonc-parser";var c="OPENCODE_TUI_PREFERENCES_FILE",u="tui-preferences.jsonc";function K(){let Q=process.env[c];if(Q)return Q;let q=process.env.OPENCODE_CONFIG_DIR||N(process.env.XDG_CONFIG_HOME||N(h(),".config"),"opencode");return N(q,u)}function H(Q){return typeof Q==="object"&&Q!==null&&!Array.isArray(Q)}async function Zq(){try{let Q=await I(K(),"utf8"),q=[],J=p(Q,q,{allowTrailingComma:!0});if(q.length>0)return{};return H(J)?J:{}}catch{return{}}}var s="anthropic-auth",d=160,k={forceToTop:!1,order:d,startCollapsed:!1,rememberCollapsed:!0,collapsed:null,pollMs:1500,refreshDebounceMs:200,header:{label:"CLAUDE",showVersion:!0},sections:{quota:!0,fallbackAccounts:!0,routing:!0,cache:!0,health:!0,pacing:!0},appearance:{barWidth:10,barFilledChar:"█",barEmptyChar:"░",warnThreshold:50,errorThreshold:80}};function z(Q,q){return typeof Q==="boolean"?Q:q}function B(Q,q,J,Z){if(typeof Q!=="number"||!Number.isFinite(Q))return q;return Math.min(Math.max(Math.round(Q),J),Z)}function o(Q,q,J){if(typeof Q!=="string"||Q.length===0)return q;return Q.slice(0,J)}function x(Q,q){if(typeof Q!=="string")return q;return[...Q][0]??q}function $q(Q){let q=Q[s];if(!H(q))return structuredClone(k);let J=k,Z=H(q.header)?q.header:{},X=H(q.sections)?q.sections:{},$=H(q.appearance)?q.appearance:{},Y=B($.warnThreshold,J.appearance.warnThreshold,0,99),G=Math.max(B($.errorThreshold,J.appearance.errorThreshold,0,100),Math.min(Y+1,100));return{forceToTop:z(q.forceToTop,J.forceToTop),order:B(q.order,J.order,-1e4,1e4),startCollapsed:z(q.startCollapsed,J.startCollapsed),rememberCollapsed:z(q.rememberCollapsed,J.rememberCollapsed),collapsed:typeof q.collapsed==="boolean"?q.collapsed:null,pollMs:B(q.pollMs,J.pollMs,500,30000),refreshDebounceMs:B(q.refreshDebounceMs,J.refreshDebounceMs,50,5000),header:{label:o(Z.label,J.header.label,20),showVersion:z(Z.showVersion,J.header.showVersion)},sections:{quota:z(X.quota,J.sections.quota),fallbackAccounts:z(X.fallbackAccounts,J.sections.fallbackAccounts),routing:z(X.routing,J.sections.routing),cache:z(X.cache,J.sections.cache),health:z(X.health,J.sections.health),pacing:z(X.pacing,J.sections.pacing)},appearance:{barWidth:B($.barWidth,J.appearance.barWidth,4,40),barFilledChar:x($.barFilledChar,J.appearance.barFilledChar),barEmptyChar:x($.barEmptyChar,J.appearance.barEmptyChar),warnThreshold:Y,errorThreshold:G}}}var n=-1e5;function zq(Q,q,J){let Z=Q[q];if(!H(Z))return J;if(Z.forceToTop===!0)return n+Object.keys(Q).indexOf(q);return B(Z.order,J,-1e4,1e4)}var i=`// Shared preferences for opencode TUI plugins.
 // One top-level key per plugin (short name). See each plugin's README for
 // its supported settings. This file is safe to hand-edit; plugins update
 // individual keys in place and preserve comments.

package/dist/v2/adapter.d.ts

@@ -1,5 +1,5 @@
 import { AnthropicOAuthOriginError, type ClaudeCodeIdentity, type RequestGzipLatch, stateRefusalCause, TrailingAssistantHistoryError } from '@cortexkit/anthropic-auth-core';
-import type { AccountRequest, AttemptOutcome, ChooseAccountInput, ChooseAccountResult, HeaderEdits, HostError, LimitSignal, OpenCode2AuthAdapter, RequestScope, Transport } from '@cortexkit/common-auth/opencode2';
+import type { AccountRequest, AttemptOutcome, ChooseAccountInput, ChooseAccountResult, HeaderEdits, HostError, LimitSignal, OpenCode2AuthAdapter, RequestScope, SameAccountRetryInput, SameAccountRetryResult, Transport } from '@cortexkit/common-auth/opencode2';
 import { EffortMarkerCorrelationError } from '../effort-history';
 import { createStrippedStream, rewriteRequestBody } from '../transform';
 /** The provider OpenCode 2 serves Claude under. */
@@ -158,6 +158,13 @@ export interface NativeAnthropicSource<Q, P> {
     readonly chooseAccount: (input: ChooseAccountInput) => Promise<ChooseAccountResult> | ChooseAccountResult;
     /** Discards one queued choice that the installer will not authorize. */
     readonly dropChoice?: (input: AccountRequest) => Promise<void> | void;
+    /** Retries a prepared credential or switches relay to direct on the same account. */
+    readonly retrySameAccount?: (input: SameAccountRetryInput) => Promise<SameAccountRetryResult | undefined> | SameAccountRetryResult | undefined;
+    /**
+     * Discards the retry `retrySameAccount` prepared (the newer credential or
+     * the switch from relay to direct) when the host decides not to send it.
+     */
+    readonly dropSameAccountRetry?: (input: SameAccountRetryInput & SameAccountRetryResult) => Promise<void> | void;
     /**
      * The credential for one send with the chosen account; `undefined` refuses
      * the request before anything is sent.

package/dist/v2/cachekeep-store.d.ts

@@ -0,0 +1,36 @@
+import { type CacheKeepTarget, type OwnerOnlyOptions } from '@cortexkit/anthropic-auth-core';
+export declare function cacheKeepStoreDirectory(storageId: string, root?: string): string;
+export type SavedCacheKeepTarget = Pick<CacheKeepTarget, 'id' | 'bodyText' | 'url' | 'cacheExpiresAt' | 'nextPrewarmAt' | 'oauthAccountIdentity' | 'isSubagent'> & {
+    v: 1;
+    pluginVersion: string;
+};
+export interface CacheKeepStoreOptions {
+    storageId: string;
+    /** Test seam; production always uses os.tmpdir(), never OpenCode's config. */
+    root?: string;
+    ownerOnly?: OwnerOnlyOptions;
+    now?: () => number;
+    setTimeoutImpl?: typeof globalThis.setTimeout;
+    clearTimeoutImpl?: typeof globalThis.clearTimeout;
+}
+/** Best-effort restart storage. No caller of changed() waits for disk or zlib. */
+export declare class CacheKeepStore {
+    private readonly options;
+    readonly directory: string;
+    private disabled;
+    private chain;
+    private readonly pending;
+    private readonly timers;
+    private readonly lastWrite;
+    private readonly latest;
+    constructor(options: CacheKeepStoreOptions);
+    private refuse;
+    private directoryReady;
+    private enqueue;
+    load(now: number, accept: (entry: SavedCacheKeepTarget) => boolean): Promise<void>;
+    changed(target: Readonly<CacheKeepTarget>): void;
+    private flush;
+    removed(id: string): void;
+    clear(): void;
+    drain(): Promise<void>;
+}

package/dist/v2/cachekeep.d.ts

@@ -1,10 +1,13 @@
 import { CacheKeepSessionRegistry, type NativeAccountRuntime } from '@cortexkit/anthropic-auth-core';
+import { type CacheKeepStoreOptions } from './cachekeep-store';
 import type { NativeSource } from './source';
 export interface NativeCacheKeepOptions {
     readonly now?: () => number;
     readonly setIntervalImpl?: typeof globalThis.setInterval;
     readonly clearIntervalImpl?: typeof globalThis.clearInterval;
     readonly registryDirectory?: string;
+    /** Filesystem seam for tests; this is not a user setting. */
+    readonly persistence?: Omit<CacheKeepStoreOptions, 'storageId'>;
 }
 /**
  * Keep admitted hybrid-cache prefixes warm using fresh native authorization for
@@ -22,6 +25,7 @@ export declare function createNativeCacheKeep(options: NativeCacheKeepOptions &
     fetch?: typeof fetch;
     isSubagent?: (sessionID: string) => Promise<boolean>;
 }): {
+    ready: Promise<void>;
     track(input: Parameters<NonNullable<NativeSource['onRequestPrepared']>>[0]): Promise<void | {
         tracked: true;
     } | {

package/dist/v2/server.js

@@ -1,14 +1,14 @@
-import{a as c2,b as M1,c as _1,d as k$,e as b$,f as r2,g as R2,h as w$,i as D$,j as y$,k as N1,l as I$,m as v$,n as f$,o as g$,p as V$,q as C1}from"../index-j3mytf5r.js";import"../index-sg0knfec.js";import"../index-hc7bm3yf.js";import{v as P1}from"../index-61bbefpq.js";import{w as n2,x as s2,z as F1}from"../index-m4dazzyf.js";import"../index-naff9h33.js";import{J as o2}from"../index-j2cv839v.js";import"../index-gvswxab8.js";import"../index-71temqvq.js";import{acquireNativeAccountRuntime as _Z,assertUnmanagedInjectedPaths as NZ,authorize as LZ,createNativeUi as FZ,decideOpenCodeStateLayoutOnce as PZ,disconnectNativeVaultForHost as TZ,exchange as CZ,getPersistedLogLevel as OZ,isDumpPersistentlyEnabled as EZ,logger as _$,openCodeHolderKind as SZ,readNativeEnrollmentMode as qZ,registerNativePoolHolder as xZ,resolveNativePoolPaths as AZ,setDumpEnabled as RZ,setLogLevel as kZ,stateLayoutIoFailure as bZ,unmovedRegistrationPolicy as wZ}from"@cortexkit/anthropic-auth-core";class b2 extends Error{kind;providerID;sessionID;requestKind;constructor($){super($.message??`${$.providerID} ${$.requestKind} request refused (${$.kind})`);this.name="OpenCode2AuthError",this.kind=$.kind,this.providerID=$.providerID,this.sessionID=$.sessionID,this.requestKind=$.requestKind}}function C2($){return`common-auth-placeholder.${$}`}function L$($){let X=C2($.integrationID);return{type:"oauth",methodID:$.methodID,access:X,refresh:X,expires:$.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function Z$($,X){if($?.type!=="oauth")return!1;let z=X===void 0?void 0:C2(X),W=(F)=>z===void 0?F.startsWith("common-auth-placeholder."):F===z;return W($.access)&&W($.refresh)}var F$="No browser sign-in: this connects the plugin to the accounts in its vault.";async function J$($,X){let z=X.now??Date.now,{integrationID:W}=X,F=(T)=>L$({integrationID:W,methodID:T,now:z()}),L=async(T,K)=>{return await X.onLogin(T,{integrationID:W,methodID:K}),F(K)},C=(T)=>async(K)=>{let Y=T.method.id,U=await T.authorize(K),M={url:U.url,instructions:U.instructions,...U.expiresAt===void 0?{}:{expiresAt:U.expiresAt}};if(U.mode==="auto")return{...M,mode:"auto",callback:U.callback.then((P)=>L(P,Y))};let G=U.callback;return{...M,mode:"code",callback:async(P)=>L(await G(P),Y)}};return $.integration.transform((T)=>{let K=X.label===void 0?{}:{label:()=>X.label};for(let M of X.methods)T.method.update({integrationID:W,method:M.method,authorize:C(M),refresh:async(G)=>{if(!Z$(G,W))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return F(G.methodID)},...K});let Y=X.vault;if(Y===void 0)return;let U=Y.method.id;T.method.update({integrationID:W,method:Y.method,authorize:async()=>({url:"",instructions:Y.instructions??F$,mode:"auto",callback:Promise.resolve().then(()=>Y.activate({integrationID:W,methodID:U})).then(()=>F(U))}),refresh:async(M)=>{if(!Z$(M,W)||M.methodID!==U)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return F(U)},...K})})}function O1($){let X=[],z;for(let W of $.split(/\r?\n/))if(W.startsWith("data:"))X.push(W.slice(5).replace(/^ /,""));else if(W.startsWith("event:"))z=W.slice(6).trim();if(X.length===0)return;return z===void 0?{data:X.join(`
-`)}:{event:z,data:X.join(`
-`)}}function Y$($,X){let z=new TextDecoder,W="",F=(C)=>{let T=O1(C);if(!T)return;try{$(T)}catch(K){X(K)}},L=()=>{for(;;){let C=/\r?\n\r?\n/.exec(W);if(!C)return;let T=W.slice(0,C.index);W=W.slice(C.index+C[0].length),F(T)}};return new TransformStream({transform(C,T){T.enqueue(C),W+=z.decode(C,{stream:!0}),L()},flush(){if(W+=z.decode(),L(),W.trim()!=="")F(W);W=""}})}var P$=512,T$=1200000,w2="x-common-auth-attempt",x2=($,X)=>JSON.stringify([$,X]),_2=($)=>({providerID:$.model.providerID,modelID:$.model.id,sessionID:$.sessionID,agent:$.agent,kind:$.kind});function E1($){let X=$.headers;return typeof X==="object"&&X!==null}function S1($,X){let z=$.getReader();return new ReadableStream({async pull(W){let F;try{F=await z.read()}catch(L){X({reason:"failed",message:L instanceof Error?L.message:String(L)}),W.error(L);return}if(F.done)X(),W.close();else W.enqueue(F.value)},async cancel(W){X({reason:"cancelled",...W===void 0?{}:{message:String(W)}}),await z.cancel(W)}})}function d2($,X){for(let[z,W]of Object.entries(X)){let F=z.toLowerCase();for(let L of Object.keys($))if(L.toLowerCase()===F)delete $[L];if(W!==null)$[z]=W}}function q1($,X){for(let[z,W]of Object.entries(X))if(W===null)$.delete(z);else $.set(z,W)}async function G$($,X,z={}){let{providerID:W}=X,F=z.gateOnPlaceholder,L=(Z)=>F===void 0||F.credential(Z)===C2(W),C=z.logger,T=Math.max(1,z.maxRecords??P$),K=[...z.hostCredentials??[C2(W)],...F?[C2(W)]:[]].filter((Z)=>Z!==""),Y=new Map,U=new WeakMap,M=new Map,G=0,P=new Set,R=new Map,S=new Map,D=(Z)=>{let j=S.get(Z);return j?.ownedSeen===!0&&j.foreignSeen},l=(Z,j)=>{R.set(Z,j);let N=S.get(Z)??{ownedSeen:!1,foreignSeen:!1};if(j)N.ownedSeen=!0;else N.foreignSeen=!0;S.set(Z,N)},v=(Z,j)=>{let N=F?.refuseMisplaced,x=N?[...j].filter(([,u])=>u.includes(C2(W))):[],O=L(j)&&(!N||x.length>0);if(N){if(x.length>0&&(x.length!==1||!O))throw l(Z.sessionID,!1),new b2({kind:"placement-refused",providerID:W,sessionID:Z.sessionID,requestKind:Z.kind,message:N(x[0]?.[0]??"")})}return l(Z.sessionID,O),O},n=!1,t=!1,a=new Map,M2=0,W2=!1,J=new Map,Q=(Z,j)=>{try{C?.warn(Z,j)}catch{}},B=(Z)=>Z instanceof Error?Z.message:String(Z),E=new Map,b=(Z,j)=>{let N=(E.get(Z)??Promise.resolve()).then(j),x=N.then(()=>{},()=>{});return E.set(Z,x),x.then(()=>{if(E.get(Z)===x)E.delete(Z)}),N},k=(Z,j)=>{let N=E.get(Z);return N?N.then(()=>k(Z,j)):j()},y=async(Z)=>{try{await X.dropChoice?.({...Z.input,accountId:Z.accountId})}catch(j){Q("opencode2 auth dropChoice threw; the request is unaffected",{sessionID:Z.input.sessionID,error:B(j)})}},m=(Z)=>{let j=M.get(Z);if(M.delete(Z),j?.next){let N=j.next;b(j.sessionID,()=>y(N))}},i=async(Z,j)=>{let N=a.get(Z);if(!N||N.size===0)return;await Promise.all([...N].map(async(x)=>{try{await x(j)}catch(O){Q("opencode2 auth listener threw; the request is unaffected",{event:Z,error:B(O)})}}))},$2=async(Z,j)=>{try{await X.onAttemptEnd?.(Z,j)}catch(N){Q("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:Z.attemptId,error:B(N)})}},g=(Z,j)=>{if(Z.ended||!Z.attempt)return;let N={...Z.status===void 0?{}:{status:Z.status},outputStarted:Z.outputStarted,...Z.limit?{limit:Z.limit.signal}:{},...j?{error:j}:{}};if(j)Z.endError=j;Z.ended=$2(Z.attempt,N)},d=(Z,j)=>g(Z,{reason:"abandoned",message:j}),p=(Z)=>[...Y.values()].filter((j)=>j.key===Z),J2=(Z)=>p(Z).at(-1),P2=(Z)=>{if(Y.delete(Z.id),M.get(Z.key)?.attemptId===Z.id||!p(Z.key).length)m(Z.key)},k2=(Z)=>{Y.set(Z.id,Z);while(Y.size>T){let j=Y.values().next().value;if(j===void 0)break;d(j,"dropped to keep the record bound"),P2(j)}},o=(Z)=>Z.accountId===void 0?void 0:{...Z.scope,accountId:Z.accountId},V=(Z,j)=>new b2({kind:"no-account",providerID:W,sessionID:Z.sessionID,requestKind:Z.kind,...j===void 0?{}:{message:j}}),H=(Z)=>{J.get(Z)?.clear(),J.delete(Z)},_=async(Z,j)=>{let N=()=>V(Z,`${W} ${Z.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(W2)throw N();let x=J.get(Z.sessionID);if(!x)x=new Set,J.set(Z.sessionID,x);let O={};x.add(O);let u=()=>{if(!x.has(O))throw N()};try{return await j(u)}finally{if(x.delete(O),x.size===0&&J.get(Z.sessionID)===x)J.delete(Z.sessionID)}},A=(Z,j)=>{for(let[N,x]of j)if(K.some((O)=>x.includes(O)))throw new b2({kind:"host-credential-on-wire",providerID:W,sessionID:Z.sessionID,requestKind:Z.kind,message:`${W} ${Z.kind} request still carries the host's placeholder credential in ${N}; the adapter's account headers must replace it`})},q=(Z)=>{for(let j of p(Z))if(j.ended||!j.attempt)P2(j);else if(j.transport==="ws"||j.judged)d(j,"a newer attempt of its session and kind began"),P2(j)},I=async(Z,j,N,x)=>{let O=x2(Z.sessionID,Z.kind),{input:u,accountId:w}=await k(Z.sessionID,async()=>{N();let Q2=M.get(O);M.delete(O);let N2=Q2?.accountId??J2(O)?.accountId;q(O);let L2=Q2?.next,z2=L2!==void 0&&L2.input.modelID===Z.modelID&&L2.input.agent===Z.agent,v2={...Z,phase:"request",...N2===void 0?{}:{previousAccountId:N2},...Q2?.rerouteFrom?{rerouteFrom:Q2.rerouteFrom}:{}};if(L2&&!z2)await b(Z.sessionID,()=>y(L2)),N();let T2=z2?L2.accountId:await X.chooseAccount(v2);return{input:v2,accountId:typeof T2==="string"?T2:void 0}});N();let h={},Z2;if(w!==void 0){let Q2=await X.accountHeaders({...Z,accountId:w});if(N(),E1(Q2))h=Q2.headers,Z2=Q2.attempt;else h=Q2}let S2=`attempt-${++M2}`,H2={id:S2,key:O,scope:Z,accountId:w,headers:h,attempt:w===void 0?void 0:{...Z,accountId:w,attemptId:S2,transport:x,data:Z2},...x===void 0?{}:{transport:x},outputStarted:!1};if(k2(H2),H2.attempt)i("select",{...Z,accountId:H2.attempt.accountId,hook:j,...u.previousAccountId===void 0?{}:{previousAccountId:u.previousAccountId},...u.rerouteFrom===void 0?{}:{rerouteFrom:u.rerouteFrom},handle:H2.attempt});return H2},f=async(Z,j,N,x,O)=>{let u=x2(Z.sessionID,Z.kind),w=x===void 0?void 0:Y.get(x);if(w?.key!==u)w=void 0;if(!w){if(w=J2(u),p(u).filter((Z2)=>Z2.transport===void 0&&!Z2.ended).length>1&&!t)t=!0,Q("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:Z.sessionID,kind:Z.kind})}if(!w||w.transport!==void 0||w.ended)w=await I(Z,j,O,N);else if(w.transport=N,w.attempt)w.attempt.transport=N;if(N==="ws"){for(let h of p(u))if(h!==w&&h.transport==="ws")d(h,"a newer attempt of its session and kind went out over WebSocket")}return w},s=async(Z,j)=>{try{return await j()}catch(N){throw g(Z,{reason:"failed",message:B(N)}),N}},c=(Z,j)=>{let N=p(x2(Z,j)).filter((x)=>x.transport==="ws").at(-1);return N?.attempt!==void 0&&!N.ended?N:void 0},Y2=(Z,j,N)=>{let x=o(Z);if(!x||!Z.attempt||Z.limit)return;Z.limit={signal:j,delivered:i("limit",{...x,via:N,limit:j,outputStarted:Z.outputStarted,handle:Z.attempt})}},V2=(Z,j,N,x)=>{let O=o(Z);if(!O||!Z.attempt)return;i("quota",{...O,transport:j,...x===void 0?{}:{status:x},quota:N,handle:Z.attempt})},B2=(Z,j,N,x)=>{let O=Z.attempt;if(!O)return;let u=X.inspectEvent?.(x===void 0?{transport:j,data:N,attempt:O}:{transport:j,data:N,event:x,attempt:O});if(!u)return;if(u.quota!==void 0)V2(Z,j,u.quota);if(u.outputStarted)Z.outputStarted=!0;if(u.limit)Y2(Z,u.limit,j);if(u.error!==void 0)g(Z,{reason:"failed",message:u.error});else if(u.done)g(Z)},F2=(Z,j)=>{let N=Z.attempt;if(!N||j.accountId===Z.accountId)return;if(N.reboundFrom??=N.accountId,N.accountId=j.accountId,"data"in j)N.data=j.data;Z.accountId=j.accountId},X2=(Z)=>!Z.attempt||Z.endError!==void 0||Z.status!==void 0&&Z.status>=400,e=(Z)=>{let j=[...Y.values()].filter((h)=>h.scope.sessionID===Z),N=j.filter((h)=>h.limit&&!h.rerouted).at(-1);if(N)return N;let x=j.filter((h)=>h.scope.kind==="primary"),O=x.length>0?x:j;if(O.length<=1)return O[0];let u=O.filter((h)=>!h.judged&&X2(h)).at(-1);if(u)return u;let w=O.filter((h)=>h.attempt&&!h.ended);if(w.length>1)return"ambiguous";return w[0]??O.at(-1)},G2={providerID:W},j2=[];j2.push(await $.session.hook("model.request",(Z)=>{if(F)return;return _(_2(Z),async(j)=>{let N=await I(_2(Z),"model.request",j);if(j(),N.accountId===void 0)throw V(N.scope);d2(Z.headers,{...N.headers,[w2]:N.id})})},G2)),j2.push(await $.session.hook("http.request",(Z)=>{if(F){if(!v(_2(Z),Z.request.headers))return}return _(_2(Z),async(j)=>{let N=Z.request.headers.get(w2)??void 0,x=F?await I(_2(Z),"http.request",j,"http"):await f(_2(Z),"http.request","http",N,j);j();let O=o(x),u=x.attempt;if(!O||!u)throw V(x.scope);await s(x,async()=>{let w=Z.request;if(X.rewriteRequest){if(N!==void 0){let S2=new Headers(w.headers);S2.delete(w2),w=new Request(w,{headers:S2})}w=await X.rewriteRequest({...O,request:w,attempt:u})??w,j()}let h=new Headers(w.headers);h.delete(w2),q1(h,x.headers),A(x.scope,h.entries());let Z2=new Request(w,{headers:h});U.set(Z2,x),Z.request=Z2})})},G2)),j2.push(await $.session.hook("http.response",async(Z)=>{let j=U.get(Z.request);if(!j){if(F)return;if(!n)n=!0,Q("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:Z.sessionID,kind:Z.kind});return}let N=Z.response;if(X.answeredBy&&j.attempt){let h=j.attempt,Z2=await s(j,async()=>X.answeredBy?.({request:Z.request,response:N,attempt:h}));if(Z2)F2(j,Z2)}let x=o(j),O=j.attempt;if(!x||!O)return;j.status=N.status;let u=X.quotaFromHeaders?.(N.headers,N.status,O);if(u!==void 0)V2(j,"http",u,N.status);if(!N.ok&&X.limitFromResponse){let h=await X.limitFromResponse({status:N.status,headers:N.headers,body:()=>N.clone().text(),attempt:O});if(h)Y2(j,h,"http")}if(!N.ok||!N.body)g(j);let w=N;if(N.body&&(X.inspectEvent||X.onAttemptEnd)){let h=N.body;if(X.inspectEvent)h=h.pipeThrough(Y$((Z2)=>B2(j,"http",Z2.data,Z2.event),(Z2)=>Q("opencode2 auth event inspection threw",{error:B(Z2)})));w=new Response(S1(h,(Z2)=>g(j,Z2)),{status:N.status,statusText:N.statusText,headers:N.headers})}if(X.rewriteResponse)w=await X.rewriteResponse({...x,request:Z.request,response:w,attempt:O})??w;if(w!==N)Z.response=w},G2)),j2.push(await $.session.hook("experimental.ws.handshake",(Z)=>{if(F){let j=x2(Z.sessionID,Z.kind);if(P.delete(j),!v(_2(Z),new Headers(Z.headers)))return}return _(_2(Z),async(j)=>{let N;for(let w of Object.keys(Z.headers)){if(w.toLowerCase()!==w2)continue;N??=Z.headers[w],delete Z.headers[w]}let x=F?await I(_2(Z),"experimental.ws.handshake",j,"ws"):await f(_2(Z),"experimental.ws.handshake","ws",N,j);j();let O=o(x),u=x.attempt;if(!O||!u)throw V(x.scope);await s(x,async()=>{if(!F?.refuseMisplaced)d2(Z.headers,x.headers);let w=X.rewriteHandshakeURL?.({...O,url:Z.url,attempt:u});if(w!==void 0)Z.url=w;if(F?.refuseMisplaced)d2(Z.headers,x.headers);if(A(x.scope,Object.entries(Z.headers)),F)P.add(x.key)})})},G2));let r=X.rewriteWebSocketFrame?.bind(X);if(r)j2.push(await $.session.hook("experimental.ws.send",async(Z)=>{let j=_2(Z);if(F&&!P.has(x2(j.sessionID,j.kind)))return;let N=c(j.sessionID,j.kind),x=await r({...j,attempt:N?.attempt,frame:Z.frame});if(x!==void 0)Z.frame=x},G2));j2.push(await $.session.hook("experimental.ws.receive",(Z)=>{if(F&&!P.has(x2(Z.sessionID,Z.kind)))return;let j=c(Z.sessionID,Z.kind);if(!j)return;try{B2(j,"ws",Z.frame)}catch(N){Q("opencode2 auth frame inspection threw",{error:B(N)})}},G2)),j2.push(await $.session.hook("retry",async(Z)=>{if(F&&R.get(Z.sessionID)!==!0)return;let j=Z.decision,N=()=>i("retry",{sessionID:Z.sessionID,attempt:Z.attempt,reason:"host-decides",hostDecision:j,decision:j});if(D(Z.sessionID)){await N();return}let x=e(Z.sessionID);if(!x)return;if(x==="ambiguous"){await i("retry",{sessionID:Z.sessionID,attempt:Z.attempt,reason:"host-decides",hostDecision:j,decision:j});return}let O=x;await _(O.scope,async(u)=>{let w=u;if(D(Z.sessionID)){await N();return}O.judged=!0;let h=O.attempt;if(h&&!O.outputStarted){if(!O.limit){let H2=X.limitFromError?.(Z.error,h);if(H2)Y2(O,H2,"error")}if(O.ended)await O.ended;if(O.limit)await O.limit.delivered}w();let{decision:Z2,reason:S2}=await b(O.scope.sessionID,async()=>{if(w(),D(Z.sessionID))return{decision:j,reason:"host-decides"};let H2=M.get(O.key);if(M.delete(O.key),H2?.next)await y(H2.next);if(w(),D(Z.sessionID))return{decision:j,reason:"host-decides"};let Q2=j,N2,L2,z2;if(O.accountId===void 0||!h)Q2={retry:!1},N2="no-account";else if(O.outputStarted)Q2={retry:!1},N2="output-started";else if(O.limit){let v2={accountId:O.accountId,limit:O.limit.signal},T2,$$={...O.scope,phase:"retry",previousAccountId:O.accountId,rerouteFrom:v2};try{T2=await X.chooseAccount($$)}catch(X$){Q("opencode2 auth chooseAccount threw while the retry hook looked for another account; the host decides the retry",{sessionID:O.scope.sessionID,error:B(X$)})}let q2=typeof T2==="object"?T2.hold:void 0,l2=typeof T2==="string"?T2:q2?O.accountId:void 0;if(l2!==void 0)z2={accountId:l2,input:$$};try{w()}catch(X$){if(z2)await y(z2);throw X$}if(D(Z.sessionID)){if(z2)await y(z2);return{decision:j,reason:"host-decides"}}if(q2&&Number.isFinite(q2.delayMs)&&q2.delayMs>=0)Q2={retry:!0,delay:Math.min(q2.delayMs,T$)},N2="hold";else if(!q2&&l2!==void 0&&l2!==O.accountId)O.rerouted=!0,L2=v2,Q2={retry:!0,delay:0},N2="reroute";else{if(q2&&z2)await y(z2),z2=void 0;N2="host-decides-last-account"}}else N2="host-decides";if(Z.decision=Q2,Q2.retry&&O.accountId!==void 0&&Y.has(O.id))M.set(O.key,{attemptId:O.id,sessionID:O.scope.sessionID,order:++G,accountId:O.accountId,...L2===void 0?{}:{rerouteFrom:L2},...z2===void 0?{}:{next:z2}});else if(z2)await y(z2);return{decision:Q2,reason:N2}});w(),await i("retry",{sessionID:Z.sessionID,...O.accountId===void 0?{}:{accountId:O.accountId},kind:O.scope.kind,attempt:Z.attempt,reason:S2,hostDecision:j,decision:Z2,...h===void 0?{}:{handle:h}})})},G2));let K2=(Z)=>{if(H(Z),R.delete(Z),!S.get(Z)?.foreignSeen)S.delete(Z);for(let j of P)if(JSON.parse(j)[0]===Z)P.delete(j);for(let j of[...Y.values()]){if(j.scope.sessionID!==Z)continue;d(j,"its session was forgotten"),Y.delete(j.id)}for(let[j,N]of M)if(N.sessionID===Z)m(j)},U2=new AbortController,m2=$.event;if(m2)(async()=>{try{for await(let Z of m2.subscribe({signal:U2.signal}))if(Z.type==="session.deleted")K2(Z.data.sessionID);else if(Z.type==="session.status"&&Z.data.status.type==="idle"){let j=Z.data.sessionID,N=++G;b(j,async()=>{for(let[x,O]of M)if(O.sessionID===j&&O.order<N){if(M.delete(x),O.next)await y(O.next)}})}}catch(Z){if(!U2.signal.aborted)Q("opencode2 auth stopped listening for session deletion",{error:B(Z)})}})();return{on(Z,j){let N=a.get(Z);if(!N)N=new Set,a.set(Z,N);let x=j;return N.add(x),()=>{N.delete(x)}},accountFor(Z,j){return J2(x2(Z,j))?.accountId},forgetSession:K2,get size(){return Y.size},async dispose(){if(W2)return;W2=!0;for(let Z of J.keys())H(Z);U2.abort();for(let Z of Y.values())d(Z,"the installation was disposed");Y.clear();for(let Z of M.keys())m(Z);P.clear(),R.clear(),S.clear(),a.clear(),await Promise.all(E.values()),await Promise.all(j2.map(async(Z)=>{try{await Z.dispose()}catch(j){Q("opencode2 auth hook did not dispose cleanly",{error:B(j)})}}))}}}import{createHash as x1}from"node:crypto";import{AnthropicOAuthOriginError as A1,applyCustomHeaders as R1,assertNotCustodyTombstone as k1,classifyGzipRejection as b1,createProviderErrorRedactor as C$,createProviderErrorResponseScope as O$,decideRequestGzip as w1,dumpDirectRequest as E$,dumpRelayRequest as S$,dumpResponseArtifact as u2,encodeGzipRequestBody as D1,getAccountStoragePath as y1,getRequestGzipLatch as I1,getRequestGzipLatchPath as v1,isDumpEnabled as f1,mergeAnthropicBetas as g1,remapModelId as q$,remapRequestBodyModel as h1,setDumpEnabled as x$,stateRefusalCause as m1,stateRefusalPublicMessage as l1,stripEmptyTrailingAssistantMessages as d1,TrailingAssistantHistoryError as u1}from"@cortexkit/anthropic-auth-core";var D2="anthropic",h$="x-common-auth-attempt",p1=["x-session-affinity","x-opencode-session","x-parent-session-id",k$,c2,R2,h$],p2=new Set(["authorization","x-api-key"]),c1="physical send before a response",i1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",o1=512,r1=5000,n1=500,A$=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class m$ extends Error{sessionID;requestKind;kind="no-account";providerID=D2;constructor($,X){super(i1);this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicNoAccountError"}}class Q$ extends Error{sessionID;requestKind;kind="session-forgotten";providerID=D2;constructor($,X){super("request refused: its session was closed while it was being prepared");this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicRevokedError"}}class O2 extends Error{kind="unsupported-transport";providerID=D2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class l$ extends Error{kind="local-invalid-request";status=400;check;constructor($){super($.message,{cause:$});this.name="NativeAnthropicLocalRefusal",this.check=$.check}}class d$ extends Error{kind="state-relocated";providerID=D2;constructor($){super(l1($)??$.message,{cause:$});this.name="NativeAnthropicStateRefusal"}}function i2($){let X=m1($);return X?new d$(X):void 0}var A2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($);function f2($){try{return JSON.parse($)}catch{return}}function j$($){let X={};for(let[z,W]of Object.entries($??{}))X[z.toLowerCase()]=W;return X}function R$($){let X={};for(let z of p1){let W=$.get(z);if(W!==null&&z!==h$)X[z]=W;$.delete(z)}return X}function s1($){try{return new URL($).pathname.endsWith("/messages")}catch{return!1}}function a1($){return $ instanceof u1||$ instanceof b$||$ instanceof A1?new l$($):void 0}function t1($,X){let z=[];if($.oauth)z.push($.oauth.accessToken);for(let[W,F]of Object.entries($.apiHeaders??{})){if(F===null||!p2.has(W))continue;z.push(F.replace(/^Bearer\s+/i,""))}for(let W of p2){let F=X.get(W);if(F!==null)z.push(F.replace(/^Bearer\s+/i,""))}if($.dispatch?.kind==="http-relay")z.push($.dispatch.token);return[...new Set(z.filter(Boolean))]}var e1=new Set(["oauth-2025-04-20","claude-code-20250219",y$]);function $X($){let X=$.split(",").map((z)=>z.trim()).filter((z)=>z&&!e1.has(z));return g1(null,X)}function XX($){let X=f2($);if(!A2(X))return $;let z=d1(X.messages),W=Object.hasOwn(X,"fallbacks"),{droppedMarkers:F}=I$(X,!1),L=W&&!Object.hasOwn(X,"fallbacks"),C=h1(X);return z>0||F>0||L||C?JSON.stringify(X):$}async function ZX($,X){if(!($ instanceof Promise))return"settled";let z;try{return await Promise.race([$.then(()=>"settled"),new Promise((W)=>{z=setTimeout(()=>W("timed-out"),X)})])}finally{if(z!==void 0)clearTimeout(z)}}function y2($){let{source:X,log:z}=$,W=Math.max(1,$.maxPendingSends??o1),F=$.attemptEndTimeoutMs??r1,L=$.requestGzipLatch??I1(v1(y1())),C=new WeakSet,T=new Map,K=new WeakMap,Y=new WeakMap,U=new WeakMap,M=new Map,G=new WeakMap,P=C$([]);P.dispose();let R=(V)=>(V&&M.get(V)?.redactor)??P,S=(V)=>{let H=M.get(V);if(!H)return;M.delete(V),H.redactor.dispose(),H.scope.dispose()},D=(V,H,_,A)=>{let q=t1(H,A),I=O$(q,_);l.set(V,_),M.set(V,{sessionID:H.sessionID,redactor:C$(q),scope:I}),I.settled.then(()=>S(V));while(M.size>W){let f=M.keys().next().value;if(f===void 0)break;S(f)}},l=new WeakMap,v=(V,H)=>{let _=V?l.get(V):void 0;if(!_||!H.ok)return P.redactResponse(H);let A=O$([],_),q=A.redactResponse(H);return A.dispose(),q},n=(V,H)=>{let _=V?M.get(V)?.scope:void 0;if(!_)return v(V,H);try{return _.redactResponse(H)}catch{return v(V,H)}},t=!1,a=new Map,M2=new WeakMap,W2=new WeakMap,J=new WeakMap,Q=(V)=>V.agent==="cachekeep"||V.agent==="prime",B=async()=>{try{if(X.isDumpEnabled)return await X.isDumpEnabled()}catch{return!1}try{return f1()}catch{return!1}},E=(V)=>{a.delete(V)},b=new WeakMap,k=(V,H)=>{if(V&&!H.ok)b.set(H.headers,V);return H},y=(V,H)=>{if(H.dispatch!=="http-relay")return!0;let _=/^req_[A-Za-z0-9_-]+$/.test(V.get("request-id")??"");return Y.set(H,_),_},m=(V)=>new m$(V.sessionID,V.kind),i=new Map,$2=async(V,H)=>{if(t)throw new Q$(V.sessionID,V.kind);let _={revoked:!1},A=i.get(V.sessionID);if(!A)A=new Set,i.set(V.sessionID,A);A.add(_);let q=()=>{if(t||_.revoked)throw new Q$(V.sessionID,V.kind)};try{let I=await H(q);return q(),I}finally{let I=i.get(V.sessionID);if(I?.delete(_)&&I.size===0)i.delete(V.sessionID)}},g=(V,H)=>{T.set(V,H);while(T.size>W){let _=T.keys().next().value;if(_===void 0)break;T.delete(_),z?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:W})}},d=(V,H)=>({providerID:V.providerID,modelID:V.modelID,sessionID:V.sessionID,agent:V.agent,kind:V.kind,accountId:V.accountId,attemptId:V.attemptId,transport:V.transport,route:H.route,provenance:H.provenance,dispatch:H.dispatch}),p=(V)=>$2(V,async(H)=>{let{accountId:_,...A}=V,q;try{q=await X.authorizeAccount(A,_)}catch(I){let f=i2(I);if(f)throw z?.warn("refused an Anthropic request: its account state was moved or could not be recorded",{error:f.cause instanceof Error?f.cause.name:""}),f;throw I}return H(),J2(A,q)}),J2=(V,H)=>{if(!H)throw m(V);if(H.dispatch?.kind==="websocket-relay")throw new O2;let _=H.dispatch?.kind==="http-relay"?"http-relay":"direct",A=H.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":H.dispatch.token}:void 0;if(H.route==="oauth"){if(!H.accessToken)throw m(V);k1(H.accessToken,D2);let f=Object.freeze({route:"oauth",provenance:H.provenance,dispatch:_});g(f,{sessionID:V.sessionID,oauth:{accessToken:H.accessToken,...H.identity?{identity:H.identity}:{}},dispatch:H.dispatch,oauthHeaders:H.headers});let s=j$(H.headers);for(let c of p2)delete s[c];return delete s["anthropic-beta"],{headers:A??{...s,"x-api-key":null,authorization:`Bearer ${H.accessToken}`},attempt:f}}let q={authorization:null,"x-api-key":null,...j$(H.headers)};if(!q.authorization&&!q["x-api-key"])throw m(V);let I=Object.freeze({route:"api",provenance:H.provenance,dispatch:_});return g(I,{sessionID:V.sessionID,...H.baseURL?{baseURL:H.baseURL}:{},dispatch:H.dispatch,apiHeaders:q}),{headers:A??q,attempt:I}},P2=(V)=>$2(V,(H)=>k2(V,H)),k2=async(V,H)=>{let{request:_,attempt:A}=V,q=A.data,I=q?T.get(q):void 0;if(q)T.delete(q);if(!q||!I||q.route==="oauth"&&!I.oauth)throw m(V);let f=new Headers(_.headers);R1(f);let s=R$(f),c=_.body===null?void 0:await _.text();H();let Y2=c!==void 0&&s1(_.url),V2=f$(_.url,I.baseURL!==void 0?{baseURL:I.baseURL}:{}).url?.toString()??_.url;try{if(q.route==="oauth"&&I.oauth){w$(V2);let{accessToken:X2,identity:e}=I.oauth;for(let[j2,r]of Object.entries(j$(I.oauthHeaders))){if(p2.has(j2))continue;if(r===null)f.delete(j2);else f.set(j2,r)}let G2=null;if(c!==void 0&&Y2){let j2={...d(A,q),modelID:(()=>{let U2=f2(c);return q$(A2(U2)&&typeof U2.model==="string"?U2.model:V.modelID)})(),route:"oauth",correlation:s},r=await X.requestOptions?.(j2)??{};if(H(),A.agent!=="cachekeep")c=await g$(c,{...r,...e?{identity:e}:{},sessionId:V.sessionID,onToolNameMap:(U2)=>U.set(q,U2)});let K2=f2(c);G2=A2(K2)?K2:null}v$(f,X2,{body:G2,...e?{identity:e}:{},requestClass:D$(A.agent)?"auxiliary":"main"})}else{if(c!==void 0&&Y2)c=XX(c);f.delete("authorization"),f.delete("x-api-key");for(let[e,G2]of Object.entries(I.apiHeaders??{}))if(G2===null)f.delete(e);else f.set(e,G2);if(c!==void 0&&Y2&&!f.has("content-type"))f.set("content-type","application/json");let X2=f.get("anthropic-beta");if(X2!==null){let e=$X(X2);if(e)f.set("anthropic-beta",e);else f.delete("anthropic-beta")}}}catch(X2){let e=a1(X2);if(!e)throw X2;throw K.set(q,e.check),z?.warn("refused an Anthropic request locally; nothing was sent",{check:e.check}),e}let B2=c!==void 0?f2(c):void 0;if(await X.admitRequest?.({...d(A,q),modelID:q$(A2(B2)&&typeof B2.model==="string"?B2.model:V.modelID)}),R$(f),c!==void 0)f.delete("content-length");if(H(),D(q,I,A2(B2)&&B2.stream===!0?"event-stream":"http",f),q.route==="oauth"&&Y2&&c!==void 0)await X.onRequestPrepared?.({...d(A,q),url:V2,bodyText:c}),H();if(I.dispatch?.kind==="http-relay"){let X2=c??"";f.delete("x-relay-token");let e={protocol:1,type:"request",affinity:V.sessionID,upstream:{url:V2,method:_.method,headers:Object.fromEntries(f)},mode:"full_sync",revision:1,body:X2,next_hash:`sha256:${x1("sha256").update(X2).digest("hex")}`};if(Y2&&c!==void 0&&!Q(A)){let G2=s[R2]==="1"?"start":void 0,j2=JSON.stringify(e);a.set(q,{affinity:V.sessionID,route:V.accountId,bodyText:X2,url:V2,method:_.method,headers:new Headers(f),dispatch:"http-relay",relayUrl:I.dispatch.url,envelope:e,relayBytes:j2.length,...G2?{tag:G2}:{}})}else E(q);return new Request(I.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":I.dispatch.token},redirect:"error",signal:_.signal,body:JSON.stringify(e)})}let F2=c;if(q.route==="oauth"&&Y2&&c!==void 0){let X2=await w1({url:V2,body:c,latch:L});if(H(),X2.gzip)F2=await D1(c),f.set("content-encoding","gzip"),C.add(q),H()}if(Y2&&c!==void 0&&!Q(A)){let X2=s[R2]==="1"?"start":void 0;a.set(q,{affinity:V.sessionID,route:V.accountId,bodyText:c,url:V2,method:_.method,headers:new Headers(f),dispatch:"direct",...X2?{tag:X2}:{}})}else E(q);return new Request(V2,{method:_.method,headers:f,redirect:q.route==="oauth"?"error":_.redirect,signal:_.signal,...F2!==void 0?{body:F2}:{}})};return{adapter:{providerID:D2,chooseAccount:(V)=>$2(V,async()=>{let H=await X.chooseAccount(V);if(typeof H==="object"&&V.phase==="retry")return H;if(typeof H!=="string"||!H)throw m(V);return H}),dropChoice:(V)=>X.dropChoice?.(V),accountHeaders:p,rewriteRequest:P2,rewriteHandshakeURL(){throw new O2},async rewriteResponse({response:V,attempt:H}){let _=H.data;if(_&&!y(V.headers,_)){if(_)E(_);if(V.status===401)return S(_),V.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return n(_,V)}if(_&&C.has(_))C.delete(_),b1(V).then((r)=>{if(!r)return;L.latchProcess(),z?.warn("gzipped request body rejected; later requests go uncompressed",{kind:r,status:V.status})},()=>{});let A=null,q=_?a.get(_):void 0;if(_&&q){let r=!1;try{r=await B()}catch{r=!1}if(!r)E(_);else{try{x$(!0)}catch{}try{if(q.dispatch==="http-relay")A=await S$({affinity:q.affinity,transport:"http",protocol:1,mode:"full_sync",status:V.status,bodyText:q.bodyText,payload:q.envelope??{},relayBytes:q.relayBytes??0,...q.tag?{tag:q.tag}:{}});else A=await E$({affinity:q.affinity,route:q.route,status:V.status,bodyText:q.bodyText,url:q.url,method:q.method,headers:q.headers,...q.tag?{tag:q.tag}:{}})}catch{A=null}if(E(_),A){M2.set(_,A);try{await u2(A,{status:V.status,message:null,complete:!1})}catch{}J.set(_,Promise.resolve())}}}let I=n(_,V);if(_?.route!=="oauth"||!I.body)return k(_,I);let f={...d(H,_),status:V.status},s=X.responseOptions?.(f)??{},c=(V.headers.get("content-type")??"").includes("application/json"),Y2={...s,toolNameMap:_?U.get(_):void 0,onToolNameRefusal:()=>{if(!_)return;K.set(_,"response_tool_names"),S(_)},laneStartOAuthServed:!0,...c?{responseMode:"json"}:{}};if(!_||!A)return k(_,V$(I,Y2));let V2=A,B2=V.status,F2=(r)=>{let U2=(J.get(_)??Promise.resolve()).then(()=>r().then(()=>{return})).catch(()=>{return});J.set(_,U2)},X2=s.onMessageStart,e=s.onMessageDelta,G2=s.onMessageResponse,j2=s.onStreamEnd;return k(_,V$(I,{...Y2,onMessageStart:(r)=>{try{X2?.(r)}catch{}try{W2.set(_,{...r}),F2(()=>u2(V2,{status:B2,message:r,complete:!1}))}catch{}},onMessageDelta:(r)=>{try{e?.(r)}catch{}try{let K2=W2.get(_)??{},U2=K2.usage&&typeof K2.usage==="object"&&!Array.isArray(K2.usage)?K2.usage:{},m2={...K2,...r.usage?{usage:{...U2,...r.usage}}:{},...r.stopReason?{stop_reason:r.stopReason}:{}};F2(()=>u2(V2,{status:B2,message:m2,complete:!0}))}catch{}},onMessageResponse:(r)=>{try{G2?.(r)}catch{}try{F2(()=>u2(V2,{status:B2,message:r,complete:!0}))}catch{}},onStreamEnd:async()=>{try{await j2?.()}catch{}try{await(J.get(_)??Promise.resolve())}catch{}}}))},quotaFromHeaders(V,H,_){let A=_.data;if(!A||!y(V,A))return;return X.quotaFromHeaders?.(V,{...d(_,A),status:H})},async limitFromResponse({status:V,headers:H,body:_,attempt:A}){let q=A.data;if(!q||K.get(q)==="response_tool_names")return;if(!y(H,q))return X.limitFromRelayFailure?.({...d(A,q),status:V});if(G.set(q,`provider responded with HTTP ${V}`),!X.limitFromResponse)return;let I=b.get(H)===q,f=R(q);return X.limitFromResponse({...d(A,q),status:V,headers:H,body:async()=>I?await _():f.redactText(await _())})},inspectEvent({data:V,event:H,attempt:_}){if(_.data&&K.get(_.data)==="response_tool_names")return;let A=f2(V);if(!A2(A))return;let q=typeof A.type==="string"?A.type:H;if(q==="content_block_start"||q==="content_block_delta")return{outputStarted:!0};if(q==="message_stop")return{done:!0};if(q!=="error")return;let I=_.data,f=R(I),s=A2(A.error)?A.error:{},c=typeof s.type!=="string"?void 0:A$.has(s.type)?s.type:f.redactText(s.type),Y2=typeof s.message==="string"?f.redactText(s.message):void 0;if(I?.dispatch==="http-relay"&&Y.get(I)===!1)return;let V2=I?X.limitFromStreamError?.({...d(_,I),errorType:c,message:Y2}):void 0,B2={error:[c??"error",Y2].filter(Boolean).join(": ").slice(0,n1),...V2?{limit:V2}:{}};if(I&&B2.error)G.set(I,B2.error);return B2},limitFromError(V,H){let _=H.data;if(!_||K.has(_))return;let A={type:A$.has(V.type)?V.type:"provider_error",message:G.get(_)??"provider request failed",...V.status!==void 0?{status:V.status}:{}};if(S(_),_.dispatch==="http-relay"&&Y.get(_)===!1)return;return X.limitFromHostError?.(A,d(H,_))},async onAttemptEnd(V,H){let _=V.data;if(!_)return;T.delete(_);let A=a.get(_);if(A){E(_);try{if(await B()){try{x$(!0)}catch{}try{if(A.dispatch==="http-relay"){if(H.status!==void 0)await S$({affinity:A.affinity,transport:"http",protocol:1,mode:"full_sync",status:H.status,bodyText:A.bodyText,payload:A.envelope??{},relayBytes:A.relayBytes??0,...A.tag?{tag:A.tag}:{}})}else await E$({affinity:A.affinity,route:A.route,status:H.status,error:H.status===void 0?c1:void 0,bodyText:A.bodyText,url:A.url,method:A.method,headers:A.headers,...A.tag?{tag:A.tag}:{}})}catch{}}}catch{}}let q=H.error?.reason;if(q==="cancelled"||q==="abandoned"||q===void 0&&(H.status===void 0||H.status<400))S(_);let I=K.get(_),{status:f,...s}=H,c=X.onAttemptEnd?.(d(V,_),{...s,...f!==void 0&&(_.dispatch!=="http-relay"||Y.get(_)===!0)?{status:f}:{},...I!==void 0?{localRefusal:{check:I}}:{}});if(await ZX(c,F)==="timed-out")z?.warn("the account source did not finish recording a send",{timeoutMs:F})}},dispose(){t=!0;for(let[V,H]of i){for(let _ of H)_.revoked=!0;X.forgetSession?.(V)}i.clear(),T.clear(),a.clear();for(let V of[...M.keys()])S(V)},forgetSession(V){for(let H of i.get(V)??[])H.revoked=!0;i.delete(V);for(let[H,_]of T)if(_.sessionID===V)T.delete(H);for(let[H,_]of[...M])if(_.sessionID===V)S(H);for(let[H,_]of[...a])if(_.affinity===V)a.delete(H);X.forgetSession?.(V)},get pendingSendCount(){return T.size},get heldCredentialCount(){let V=0;for(let H of T.values())if(H.oauth)V++;return V},get heldRedactorCount(){return M.size},get operationsInProgress(){let V=0;for(let H of i.values())V+=H.size;return V}}}import{CacheKeepManager as JX,CacheKeepSessionRegistry as YX,getDefaultCacheKeepRegistryDirectory as GX,isCacheKeepActiveNow as u$,isCacheKeepHybridActive as W$,isCacheKeepSubagentsEnabled as B$,logger as z$,NativeAccountRefusal as E2,nativeAccountRefusal as jX}from"@cortexkit/anthropic-auth-core";function g2($){return JSON.stringify([$.source,$.accountIdentity,$.credentialId,$.binding?.storageId,$.binding?.rowId,$.binding?.credentialEpoch])}var p$=Symbol.for("cortexkit.anthropic-auth.opencode2.cachekeep.v1");function c$(){let $=globalThis;return $[p$]??=new Map,$[p$]}function VX($,X){let z=new Map,W=new Map,F=new YX({directory:X.registryDirectory||process.env.OPENCODE_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR||GX("opencode"),now:X.now}),L=()=>{let G;for(let P of W.values())G=P;return G},C=X.setIntervalImpl??globalThis.setInterval,T=new JX({loadStorage:async()=>{let G=L();return G?G.loadStorage():null},now:X.now,setIntervalImpl:(G,P)=>C(()=>{let R=T.tick();return M.ticking=R.catch(()=>{z$.warn("cachekeep","tick failed")}),M.ticking},P),clearIntervalImpl:X.clearIntervalImpl,onTrackedSessionsChanged:(G)=>F.publish(W.size===0?[]:G),prepareHeaders(G,P,R){let S=L();if(!S)return;return z.set(R.id,{target:P,attempt:R,lease:S}),new Headers({"x-native-cachekeep-attempt":String(R.id)})},fetchImpl:async(G,P)=>{let R=new Request(G,P),S=Number(R.headers.get("x-native-cachekeep-attempt")),D=z.get(S);if(z.delete(S),!D||D.lease.stopped)throw Error("CacheKeep attempt is unavailable");let l=D.lease.send(D.target,R,D.attempt.signal),v=l.then(()=>{},()=>{});return D.lease.inflight.add(v),v.then(()=>D.lease.inflight.delete(v)),l},onComplete:({attempt:G})=>{z.delete(G.id)}}),K,Y=()=>{if(K!==void 0)clearTimeout(K);K=void 0},U=()=>{if(Y(),W.size>0)return;let G=T.dropExpiredTargets();if(G===void 0){let R=c$();if(R.get($)===M)R.delete($);return}let P=X.now?.()??Date.now();if(K=setTimeout(U,Math.max(0,G-P)),typeof K==="object"&&"unref"in K)K.unref()},M={manager:T,registry:F,prepared:z,leases:W,nextGeneration:0,retain(){T.stop(),z.clear(),U()},adopt(){if(Y(),T.dropExpiredTargets()===void 0)return;T.start(),F.publish(T.trackedSessions()).catch(()=>{z$.warn("cachekeep","failed to publish tracked sessions")})}};return M}function i$($){let{runtime:X,source:z}=$,W=new AbortController,F=c$(),L=F.get($.storageId)??VX($.storageId,$);F.set($.storageId,L);let{manager:C,registry:T}=L,K=async(G,P,R)=>{let S=R?AbortSignal.any([W.signal,R]):W.signal;S.throwIfAborted();let D=JSON.parse(await P.text()),l={providerID:"anthropic",modelID:D.model,sessionID:`oc2-cachekeep:${G.id}`,agent:"cachekeep",kind:"generate"},v=(J)=>{throw new E2(J)},n=y2({source:{...z,onRequestPrepared:void 0,responseOptions:void 0,async requestOptions(J){return{...await z.requestOptions?.(J,v),laneStart:!1,billingLineage:void 0,cacheDiagnosticsPreviousMessageId:void 0}},async authorizeAccount(J,Q){let B=await X.read();S.throwIfAborted();let E=B.accounts.find((k)=>k.id===Q);if(E?.type!=="oauth")throw new E2("account-unavailable");if(g2(E)!==G.oauthAccountIdentity)throw new E2("credential-changed");if(G.isSubagent&&!B$(B.policyStorage)||!W$(B.policyStorage)||!u$(B.policyStorage,new Date($.now?.()??Date.now())))return;let b=await z.authorizeAccount(J,Q,v);if(b?.provenance.kind==="local"&&g2({...E,binding:b.provenance.subject.binding,accountIdentity:b.provenance.subject.binding.identity})!==G.oauthAccountIdentity)throw new E2("credential-changed");if(b?.provenance.kind==="vault"&&b.provenance.credentialId!==E.credentialId)throw new E2("credential-changed");return b},async admitRequest(J){await z.admitRequest?.(J,v);let Q=await X.read(),B=Q.accounts.find((E)=>E.id===J.accountId);if(S.throwIfAborted(),!B)throw new E2("account-unavailable");if(g2(B)!==G.oauthAccountIdentity)throw new E2("credential-changed");if(G.isSubagent&&!B$(Q.policyStorage)||!W$(Q.policyStorage)||!u$(Q.policyStorage,new Date($.now?.()??Date.now())))throw Error("CacheKeep policy changed before dispatch")}}}),t,a,M2=!1,W2=()=>n.forgetSession(l.sessionID);S.addEventListener("abort",W2,{once:!0});try{let J=await X.read(),Q=J.accounts.find((m)=>g2(m)===G.oauthAccountIdentity)?.id;if(!Q)throw new E2(J.accounts.some((m)=>m.id===G.oauthAccountId)?"credential-changed":"account-unavailable");let B=await n.adapter.accountHeaders({...l,accountId:Q});if(!("headers"in B)||typeof B.headers!=="object"||B.headers===null||typeof B.attempt!=="object"||B.attempt===null||B.attempt.route!=="oauth")throw Error("CacheKeep authorization refused");t={...l,accountId:Q,attemptId:crypto.randomUUID(),transport:"http",data:B.attempt};let E=await n.adapter.rewriteRequest?.({...l,accountId:Q,attempt:t,request:new Request(G.url,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(D),signal:S})});if(!E)throw Error("CacheKeep rewrite refused");S.throwIfAborted();let b=await($.fetch??fetch)(E),k=await n.adapter.rewriteResponse?.({...l,accountId:Q,attempt:t,request:E,response:b});if(!k)throw Error("CacheKeep response rewrite refused");if(a=k.status,n.adapter.quotaFromHeaders?.(k.headers,k.status,t),!k.ok)await n.adapter.limitFromResponse?.({status:a,headers:k.headers,body:()=>k.clone().text(),attempt:t});let y=await k.arrayBuffer();return M2=!0,new Response(y,{status:a,headers:k.headers})}catch(J){let Q=jX(J);if(Q)throw Q;throw Error("Native CacheKeep was not completed")}finally{S.removeEventListener("abort",W2);try{if(t)await n.adapter.onAttemptEnd?.(t,{status:a,outputStarted:!1,...M2?{}:{error:{reason:"cancelled"}}})}finally{n.dispose(),z.forgetSession?.(l.sessionID)}}},Y={generation:L.nextGeneration++,stopped:!1,loadStorage:async()=>(await X.read()).policyStorage,send:K,inflight:new Set},U=L.leases.size===0;if(L.leases.set(Y.generation,Y),U)L.adopt();let M;return{async track(G){let P=(v)=>{z$.debug("cachekeep","tracking skipped",{session:G.sessionID,reason:v})};if(Y.stopped)return P("lease-stopped");if(G.route!=="oauth")return P("not-oauth");if(G.agent==="cachekeep"||G.agent==="prime")return P("background-agent");if(G.kind!=="primary")return P("not-primary");let R=await X.read();if(Y.stopped)return P("lease-stopped");if(!W$(R.policyStorage))return P("hybrid-inactive");let S=!1;try{S=await $.isSubagent?.(G.sessionID)??!1}catch{return P("session-lookup-failed")}if(Y.stopped)return P("lease-stopped");if(S&&!B$(R.policyStorage))return P("subagents-disabled");let D=R.accounts.find((v)=>v.id===G.accountId);if(!D?.accountIdentity)return P("account-identity-missing");if(G.provenance.kind==="local"&&JSON.stringify(D.binding)!==JSON.stringify(G.provenance.subject.binding))return P("local-binding-changed");if(G.provenance.kind==="vault"&&D.credentialId!==G.provenance.credentialId)return P("vault-credential-changed");let l=C.track({sessionId:G.sessionID,url:G.url,headers:new Headers,bodyText:G.bodyText,storage:R.policyStorage,cacheMode:"hybrid",oauthAccountId:G.accountId,oauthAccountIdentity:g2(D),isSubagent:S});return await T.publish(C.trackedSessions()),l},registry:T,dispose(){if(M)return M;Y.stopped=!0,W.abort();for(let[P,R]of L.prepared)if(R.lease===Y)L.prepared.delete(P);let G=L.leases.delete(Y.generation)&&L.leases.size===0;if(G)L.retain();return M=(async()=>{try{if(G)await L.ticking;await Promise.all(Y.inflight)}finally{if(G&&L.leases.size===0)await T.dispose()}})(),M}}}async function o$($,X,z){let W=y2(X),F=[],L=async(G,P,R)=>{let S=await $.session.hook(G,P,R);return F.push(S),S},C=new AbortController,T;try{T=await G$({session:{hook:L},event:$.event},W.adapter,{logger:X.log,gateOnPlaceholder:z})}catch(G){throw W.dispose(),await Promise.allSettled(F.map((P)=>P.dispose())),G}let K=(G)=>{W.forgetSession(G),T.forgetSession(G)},Y=$.event,U=Y?(async()=>{try{for await(let G of Y.subscribe({signal:C.signal}))if(G.type==="session.deleted")K(G.data.sessionID)}catch(G){if(!C.signal.aborted)X.log?.warn("stopped listening for session deletion",{error:G instanceof Error?G.name:"unknown"})}})():Promise.resolve(),M;return{installation:T,forgetSession:K,dispose(){if(M)return M;return W.dispose(),C.abort(),M=(async()=>{await T.dispose(),await U})(),M}}}import{effectiveRelayTransport as r$,getQuotaCheckIntervalMs as QX,logger as WX,nativeAccountCanServe as BX,oauthProfileIsFresh as zX,quotaSnapshotCheckedAt as UX}from"@cortexkit/anthropic-auth-core";function n$($,X){let z=new AbortController,W,F=!1,L=async()=>{let K=await $.read();if(z.signal.throwIfAborted(),K.policyStorage.relay?.enabled===!0&&r$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="websocket")return;let Y=K,U=QX(Y.policyStorage);for(let M of Y.accounts){if(z.signal.aborted)return;if(!BX(M)||M.type!=="oauth")continue;if(Y.policyStorage.quota?.enabled!==!1&&Date.now()-UX(M.quota)>=U)await $.fetchQuota(M.id,X,z.signal,void 0,"background").catch(()=>{});if(!zX(M.profile)&&!z.signal.aborted)await $.fetchProfile(M.id,X,z.signal).catch(()=>{})}},C=()=>{if(F||W)return W;return W=L().catch(()=>{if(!z.signal.aborted)WX.debug("opencode2","native background readings did not complete")}).finally(()=>{W=void 0}),W},T=$.vault.watch({intervalMs:60000,onRefresh:C,shouldRefresh:async()=>{let K=await $.read();return K.policyStorage.relay?.enabled!==!0||r$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="http"}});return T.ready.catch(()=>{}),{async dispose(){F=!0,T.close(),z.abort(),await W}}}import{authorize as EX,buildCacheKeepStatusSummary as SX,buildClaudeQuotaSummary as qX,buildPrimeAccountStatuses as xX,buildPrimeStatusSummary as AX,CLAUSTRUM_OPENCODE_ENROLLMENT_NAME as RX,effectiveRelayTransport as kX,exchange as bX,formatNativeAccountState as wX,formatOAuthAccountTier as DX,getCacheKeepWindow as yX,getHostClaustrumEnrollmentPaths as IX,isCacheKeepAlways as vX,isCacheKeepHybridActive as fX,isCacheKeepPersistentlyEnabled as gX,nativeAccountCanServe as hX,parseLogLevel as mX,resetClaustrumEnrollmentState as lX,setDumpEnabled as dX}from"@cortexkit/anthropic-auth-core";import{buildPrimeAccountStatuses as KX,effectiveRelayStatus as MX,formatNativeAccountState as HX,formatOAuthAccountTier as s$,getCacheKeepWindow as _X,getRoutingMode as NX,isCacheKeepAlways as LX,isCacheKeepHybridActive as FX,isPermanentRefreshError as PX,isPrimePersistentlyEnabled as TX,nativeAccountCanServe as e$,refreshBackoffActive as a$}from"@cortexkit/anthropic-auth-core";var t$=($)=>e$($)&&$.state!=="unsupported-access"?void 0:HX($)||void 0,CX=($)=>{if($.source!=="vault")return"off";if($.state==="needs_reauth")return"on-vault-reauth";return e$($)?"on-vault-served":"on-cold"},OX=($,X)=>typeof $==="number"&&$>X;function $1($,X){let{now:z}=X,W=$.policyStorage,F=$.accounts.filter((U)=>U.type==="oauth"),L=F.find((U)=>U.id==="main"),C=L?t$(L):void 0,T=L?.lastQuotaRefreshError?.nextRetryAt,K=L?.lastRefreshError,Y=_X(W);return o2({main:{quota:L?.quota??null,enabled:L?.enabled,tierLabel:s$(L?.profile),quotaBackedOff:OX(T,z),quotaBackoffUntil:T,refreshBackedOff:a$(K,L?.accountIdentity,z,void 0),refreshBackoffUntil:K?.nextRetryAt,stateLine:C,quotaDated:Boolean(C)},fallbacks:F.filter((U)=>U.id!=="main"&&(U.enabled||U.source==="vault")).map((U)=>{let M=t$(U),G=CX(U);return{id:U.id,label:U.label,quota:U.quota??null,enabled:U.enabled,tierLabel:s$(U.profile),needsReauth:PX(U.lastRefreshError)&&a$(U.lastRefreshError,U.accountIdentity,z,void 0),...G==="on-vault-reauth"?{vaultReauth:!0}:{},...G==="on-vault-served"?{vaultServed:!0}:{},...G!=="off"?{custodyState:G}:{},stateLine:M,quotaDated:Boolean(M)}}),...X.activeId!==void 0&&{activeId:X.activeId},route:NX(W),relay:MX(W.relay),fastMode:W.claudeFast?.enabled===!0,cacheKeep:{enabled:FX(W),...LX(W)?{window:"always"}:Y&&{window:`${Y.startHour}-${Y.endHour}`},trackedSessions:X.trackedSessions},prime:TX(W)?{enabled:!0,accounts:KX(W,{now:z})}:void 0,lastUpdated:z})}var U$=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{},X1=`For first-time model access, connect Anthropic with "${s2}".
-Run: opencode auth login anthropic --method ${n2}`,uX="No Claude accounts in the vault for this host yet. Add one with `ck auth login --provider anthropic`, then grant it to this host.",Z1="The vault returned an account this plugin cannot use yet.";async function pX($){let X=new AbortController,z;try{return await Promise.race([$.vault.refresh(X.signal).then(()=>"complete",()=>"failed"),new Promise((W)=>{z=setTimeout(()=>{W("pending"),X.abort()},2000)})])}finally{clearTimeout(z)}}var J1=($)=>$.mode==="local"&&!$.accounts.some((X)=>X.id==="main"),cX=($)=>{let X=$.id==="main"?"main":"fallback",z=`${$.enabled?"enabled":"disabled"}, ${$.type}, ${$.source}${$.state?`, ${wX($)}`:""}`;if($.label)return`${$.label} [${X}]: ${z}
-  Route: ${$.id}`;return`${X==="main"?"Main account":`Fallback ${$.id}`}: ${z}`};function Y1($){let{runtime:X,source:z}=$,W=new Map,F=!1,L=async(Y,U)=>{await X.updateSettings((M)=>({...M,[Y]:{...U$(M[Y]),...U}}))},C=()=>({ok:!0,text:"Native Claude settings updated."}),T=async(Y,U)=>{if(F)throw Error("Native menu is closed");switch(U.signal?.throwIfAborted(),Y.action){case"enable":case"disable":return await X.setEnabled(Y.values.id,Y.action==="enable"),C();case"remove":return await X.remove(Y.values.id),C();case"move-up":case"move-down":{let G=(await X.read()).accounts.map((l)=>l.id),P=G.indexOf(Y.values.id),R=P+(Y.action==="move-up"?-1:1);if(P<0||R<0||R>=G.length)return{ok:!1,text:"Account cannot move in that direction."};let S=G[P],D=G[R];if(S===void 0||D===void 0)return{ok:!1,text:"Account order changed."};return G[P]=D,G[R]=S,await X.reorder(G),C()}case"add-apikey":return await X.addApi(Y.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let M=new AbortController;W.get(Y.sessionId)?.active.abort();let G={active:M,auth:void 0};W.set(Y.sessionId,G);let P=await EX("max");if(F||M.signal.aborted||U.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return G.auth=P,{ok:!0,text:`Open ${P.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let M=W.get(Y.sessionId);if(!M?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let G=await bX(Y.values.code,M.auth.verifier,M.auth.redirectUri,M.auth.state);if(M.active.signal.throwIfAborted(),U.signal?.throwIfAborted(),F||G.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await X.loginOAuth({routeId:crypto.randomUUID(),credential:{access:G.access,refresh:G.refresh,expires:G.expires},label:Y.values.label}),M.active.signal.throwIfAborted(),U.signal?.throwIfAborted(),F)return{ok:!1,text:"Sign-in cancelled."};W.delete(Y.sessionId);let P="OAuth account stored in the native account pool.";return{ok:!0,text:J1(await X.read())?`${P}
+import{a as t2,b as f1,c as l1,d as m0,e as l0,f as G0,g as y2,h as d0,i as u0,j as v1,k as g1,l as h1,m as p0,n as d1,o as c0,p as i0,q as o0,r as n0,s as F0,t as o1}from"../index-zxyjjr82.js";import"../index-2ra790fx.js";import"../index-jc8zwxvw.js";import{y as c1}from"../index-eq1kbq5z.js";import{A as V0,C as p1,z as Y0}from"../index-qqs4ec18.js";import"../index-a0jxsmac.js";import{M as X0}from"../index-d4e8qj37.js";import"../index-crx0xd9j.js";import"../index-n8xr16kr.js";import{acquireNativeAccountRuntime as Y6,assertUnmanagedInjectedPaths as V6,authorize as Q6,createNativeUi as W6,decideOpenCodeStateLayoutOnce as U6,disconnectNativeVaultForHost as B6,exchange as z6,getPersistedLogLevel as K6,isDumpPersistentlyEnabled as M6,logger as S0,openCodeHolderKind as H6,readNativeEnrollmentMode as N6,registerNativePoolHolder as _6,resolveNativePoolPaths as L6,setDumpEnabled as F6,setLogLevel as P6,stateLayoutIoFailure as T6,unmovedRegistrationPolicy as C6}from"@cortexkit/anthropic-auth-core";class f2 extends Error{kind;providerID;sessionID;requestKind;constructor($){super($.message??`${$.providerID} ${$.requestKind} request refused (${$.kind})`);this.name="OpenCode2AuthError",this.kind=$.kind,this.providerID=$.providerID,this.sessionID=$.sessionID,this.requestKind=$.requestKind}}function R2($){return`common-auth-placeholder.${$}`}function R0($){let Z=R2($.integrationID);return{type:"oauth",methodID:$.methodID,access:Z,refresh:Z,expires:$.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function K0($,Z){if($?.type!=="oauth")return!1;let Q=Z===void 0?void 0:R2(Z),Y=(M)=>Q===void 0?M.startsWith("common-auth-placeholder."):M===Q;return Y($.access)&&Y($.refresh)}var b0="No browser sign-in: this connects the plugin to the accounts in its vault.";async function M0($,Z){let Q=Z.now??Date.now,{integrationID:Y}=Z,M=(T)=>R0({integrationID:Y,methodID:T,now:Q()}),C=async(T,H)=>{return await Z.onLogin(T,{integrationID:Y,methodID:H}),M(H)},q=(T)=>async(H)=>{let G=T.method.id,B=await T.authorize(H),K={url:B.url,instructions:B.instructions,...B.expiresAt===void 0?{}:{expiresAt:B.expiresAt}};if(B.mode==="auto")return{...K,mode:"auto",callback:B.callback.then((L)=>C(L,G))};let _=B.callback;return{...K,mode:"code",callback:async(L)=>C(await _(L),G)}};return $.integration.transform((T)=>{let H=Z.label===void 0?{}:{label:()=>Z.label};for(let K of Z.methods)T.method.update({integrationID:Y,method:K.method,authorize:q(K),refresh:async(_)=>{if(!K0(_,Y))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return M(_.methodID)},...H});let G=Z.vault;if(G===void 0)return;let B=G.method.id;T.method.update({integrationID:Y,method:G.method,authorize:async()=>({url:"",instructions:G.instructions??b0,mode:"auto",callback:Promise.resolve().then(()=>G.activate({integrationID:Y,methodID:B})).then(()=>M(B))}),refresh:async(K)=>{if(!K0(K,Y)||K.methodID!==B)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return M(B)},...H})})}function n1($){let Z=[],Q;for(let Y of $.split(/\r?\n/))if(Y.startsWith("data:"))Z.push(Y.slice(5).replace(/^ /,""));else if(Y.startsWith("event:"))Q=Y.slice(6).trim();if(Z.length===0)return;return Q===void 0?{data:Z.join(`
+`)}:{event:Q,data:Z.join(`
+`)}}function H0($,Z){let Q=new TextDecoder,Y="",M=(q)=>{let T=n1(q);if(!T)return;try{$(T)}catch(H){Z(H)}},C=()=>{for(;;){let q=/\r?\n\r?\n/.exec(Y);if(!q)return;let T=Y.slice(0,q.index);Y=Y.slice(q.index+q[0].length),M(T)}};return new TransformStream({transform(q,T){T.enqueue(q),Y+=Q.decode(q,{stream:!0}),C()},flush(){if(Y+=Q.decode(),C(),Y.trim()!=="")M(Y);Y=""}})}var A0=512,w0=1200000,v2="x-common-auth-attempt",D2=($,Z)=>JSON.stringify([$,Z]),x2=($)=>({providerID:$.model.providerID,modelID:$.model.id,sessionID:$.sessionID,agent:$.agent,kind:$.kind});function r1($){let Z=$.headers;return typeof Z==="object"&&Z!==null}function s1($,Z){let Q=$.getReader();return new ReadableStream({async pull(Y){let M;try{M=await Q.read()}catch(C){Z({reason:"failed",message:C instanceof Error?C.message:String(C)}),Y.error(C);return}if(M.done)Z(),Y.close();else Y.enqueue(M.value)},async cancel(Y){Z({reason:"cancelled",...Y===void 0?{}:{message:String(Y)}}),await Q.cancel(Y)}})}function r2($,Z){for(let[Q,Y]of Object.entries(Z)){let M=Q.toLowerCase();for(let C of Object.keys($))if(C.toLowerCase()===M)delete $[C];if(Y!==null)$[Q]=Y}}function a1($,Z){for(let[Q,Y]of Object.entries(Z))if(Y===null)$.delete(Q);else $.set(Q,Y)}async function N0($,Z,Q={}){let{providerID:Y}=Z,M=Q.gateOnPlaceholder,C=(j)=>M===void 0||M.credential(j)===R2(Y),q=Q.logger,T=Math.max(1,Q.maxRecords??A0),H=[...Q.hostCredentials??[R2(Y)],...M?[R2(Y)]:[]].filter((j)=>j!==""),G=new Map,B=new WeakMap,K=new Map,_=0,L=new Set,S=new Map,O=new Map,b=(j)=>{let W=O.get(j);return W?.ownedSeen===!0&&W.foreignSeen},w=(j,W)=>{S.set(j,W);let F=O.get(j)??{ownedSeen:!1,foreignSeen:!1};if(W)F.ownedSeen=!0;else F.foreignSeen=!0;O.set(j,F)},f=(j,W)=>{let F=M?.refuseMisplaced,k=F?[...W].filter(([,u])=>u.includes(R2(Y))):[],P=C(W)&&(!F||k.length>0);if(F){if(k.length>0&&(k.length!==1||!P))throw w(j.sessionID,!1),new f2({kind:"placement-refused",providerID:Y,sessionID:j.sessionID,requestKind:j.kind,message:F(k[0]?.[0]??"")})}return w(j.sessionID,P),P},y=!1,o=!1,e=new Map,Q2=0,j2=!1,$2=new Map,p=(j,W)=>{try{q?.warn(j,W)}catch{}},l=(j)=>j instanceof Error?j.message:String(j),r=new Map,Z2=(j,W)=>{let F=(r.get(j)??Promise.resolve()).then(W),k=F.then(()=>{},()=>{});return r.set(j,k),k.then(()=>{if(r.get(j)===k)r.delete(j)}),F},J=(j,W)=>{let F=r.get(j);return F?F.then(()=>J(j,W)):W()},X=async(j)=>{try{await Z.dropChoice?.({...j.input,accountId:j.accountId})}catch(W){p("opencode2 auth dropChoice threw; the request is unaffected",{sessionID:j.input.sessionID,error:l(W)})}},z=async(j)=>{try{await Z.dropSameAccountRetry?.({...j.input,accountId:j.accountId})}catch(W){p("opencode2 auth dropSameAccountRetry threw; the request is unaffected",{sessionID:j.input.sessionID,error:l(W)})}},R=async(j)=>{if(j.next)await X(j.next);if(j.sameAccount)await z(j.sameAccount)},I=(j)=>{let W=K.get(j);if(K.delete(j),W)Z2(W.sessionID,()=>R(W))},A=async(j,W)=>{let F=e.get(j);if(!F||F.size===0)return;await Promise.all([...F].map(async(k)=>{try{await k(W)}catch(P){p("opencode2 auth listener threw; the request is unaffected",{event:j,error:l(P)})}}))},m=async(j,W)=>{try{await Z.onAttemptEnd?.(j,W)}catch(F){p("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:j.attemptId,error:l(F)})}},d=(j,W)=>{if(j.ended||!j.attempt)return;let F={...j.status===void 0?{}:{status:j.status},outputStarted:j.outputStarted,...j.limit?{limit:j.limit.signal}:{},...W?{error:W}:{}};if(W)j.endError=W;j.ended=m(j.attempt,F)},c=(j,W)=>d(j,{reason:"abandoned",message:W}),s=(j)=>[...G.values()].filter((W)=>W.key===j),h=(j)=>s(j).at(-1),X2=(j)=>{if(G.delete(j.id),K.get(j.key)?.attemptId===j.id||!s(j.key).length)I(j.key)},a=(j)=>{G.set(j.id,j);while(G.size>T){let W=G.values().next().value;if(W===void 0)break;c(W,"dropped to keep the record bound"),X2(W)}},J2=(j)=>j.accountId===void 0?void 0:{...j.scope,accountId:j.accountId},V=(j,W)=>new f2({kind:"no-account",providerID:Y,sessionID:j.sessionID,requestKind:j.kind,...W===void 0?{}:{message:W}}),N=(j)=>{$2.get(j)?.clear(),$2.delete(j)},U=async(j,W)=>{let F=()=>V(j,`${Y} ${j.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(j2)throw F();let k=$2.get(j.sessionID);if(!k)k=new Set,$2.set(j.sessionID,k);let P={};k.add(P);let u=()=>{if(!k.has(P))throw F()};try{return await W(u)}finally{if(k.delete(P),k.size===0&&$2.get(j.sessionID)===k)$2.delete(j.sessionID)}},E=(j,W)=>{for(let[F,k]of W)if(H.some((P)=>k.includes(P)))throw new f2({kind:"host-credential-on-wire",providerID:Y,sessionID:j.sessionID,requestKind:j.kind,message:`${Y} ${j.kind} request still carries the host's placeholder credential in ${F}; the adapter's account headers must replace it`})},x=(j)=>{for(let W of s(j))if(W.ended||!W.attempt)X2(W);else if(W.transport==="ws"||W.judged)c(W,"a newer attempt of its session and kind began"),X2(W)},v=async(j,W,F,k)=>{let P=D2(j.sessionID,j.kind),{input:u,accountId:D,sameAccountRetry:i}=await J(j.sessionID,async()=>{F();let M2=K.get(P);K.delete(P);let L2=M2?.accountId??h(P)?.accountId;x(P);let H2=M2?.next,P2=M2?.sameAccount,U2=P2!==void 0&&P2.input.modelID===j.modelID&&P2.input.agent===j.agent,O2=H2!==void 0&&H2.input.modelID===j.modelID&&H2.input.agent===j.agent,E2={...j,phase:"request",...L2===void 0?{}:{previousAccountId:L2},...M2?.rerouteFrom?{rerouteFrom:M2.rerouteFrom}:{}};if(H2&&!O2)await Z2(j.sessionID,()=>X(H2)),F();if(P2&&!U2)await Z2(j.sessionID,()=>z(P2)),F();let q2=U2?P2.accountId:O2?H2.accountId:await Z.chooseAccount(E2);return{input:E2,accountId:typeof q2==="string"?q2:void 0,sameAccountRetry:U2}});F();let W2={},C2;if(D!==void 0){let M2=await Z.accountHeaders({...j,accountId:D});if(F(),r1(M2))W2=M2.headers,C2=M2.attempt;else W2=M2}let o2=`attempt-${++Q2}`,w2={id:o2,key:P,scope:j,accountId:D,headers:W2,attempt:D===void 0?void 0:{...j,accountId:D,attemptId:o2,transport:k,data:C2},...k===void 0?{}:{transport:k},outputStarted:!1,sameAccountRetry:i};if(a(w2),w2.attempt)A("select",{...j,accountId:w2.attempt.accountId,hook:W,...u.previousAccountId===void 0?{}:{previousAccountId:u.previousAccountId},...u.rerouteFrom===void 0?{}:{rerouteFrom:u.rerouteFrom},handle:w2.attempt});return w2},g=async(j,W,F,k,P)=>{let u=D2(j.sessionID,j.kind),D=k===void 0?void 0:G.get(k);if(D?.key!==u)D=void 0;if(!D){if(D=h(u),s(u).filter((W2)=>W2.transport===void 0&&!W2.ended).length>1&&!o)o=!0,p("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:j.sessionID,kind:j.kind})}if(!D||D.transport!==void 0||D.ended)D=await v(j,W,P,F);else if(D.transport=F,D.attempt)D.attempt.transport=F;if(F==="ws"){for(let i of s(u))if(i!==D&&i.transport==="ws")c(i,"a newer attempt of its session and kind went out over WebSocket")}return D},G2=async(j,W)=>{try{return await W()}catch(F){throw d(j,{reason:"failed",message:l(F)}),F}},n=(j,W)=>{let F=s(D2(j,W)).filter((k)=>k.transport==="ws").at(-1);return F?.attempt!==void 0&&!F.ended?F:void 0},B2=(j,W,F)=>{let k=J2(j);if(!k||!j.attempt||j.limit)return;j.limit={signal:W,delivered:A("limit",{...k,via:F,limit:W,outputStarted:j.outputStarted,handle:j.attempt})}},N2=(j,W,F,k)=>{let P=J2(j);if(!P||!j.attempt)return;A("quota",{...P,transport:W,...k===void 0?{}:{status:k},quota:F,handle:j.attempt})},_2=(j,W,F,k)=>{let P=j.attempt;if(!P)return;let u=Z.inspectEvent?.(k===void 0?{transport:W,data:F,attempt:P}:{transport:W,data:F,event:k,attempt:P});if(!u)return;if(u.quota!==void 0)N2(j,W,u.quota);if(u.outputStarted)j.outputStarted=!0;if(u.limit)B2(j,u.limit,W);if(u.error!==void 0)d(j,{reason:"failed",message:u.error});else if(u.done)d(j)},S2=(j,W)=>{let F=j.attempt;if(!F||W.accountId===j.accountId)return;if(F.reboundFrom??=F.accountId,F.accountId=W.accountId,"data"in W)F.data=W.data;j.accountId=W.accountId},V2=(j)=>!j.attempt||j.endError!==void 0||j.status!==void 0&&j.status>=400,Y2=(j)=>{let W=[...G.values()].filter((i)=>i.scope.sessionID===j),F=W.filter((i)=>i.limit&&!i.rerouted).at(-1);if(F)return F;let k=W.filter((i)=>i.scope.kind==="primary"),P=k.length>0?k:W;if(P.length<=1)return P[0];let u=P.filter((i)=>!i.judged&&V2(i)).at(-1);if(u)return u;let D=P.filter((i)=>i.attempt&&!i.ended);if(D.length>1)return"ambiguous";return D[0]??P.at(-1)},z2={providerID:Y},K2=[];K2.push(await $.session.hook("model.request",(j)=>{if(M)return;return U(x2(j),async(W)=>{let F=await v(x2(j),"model.request",W);if(W(),F.accountId===void 0)throw V(F.scope);r2(j.headers,{...F.headers,[v2]:F.id})})},z2)),K2.push(await $.session.hook("http.request",(j)=>{if(M){if(!f(x2(j),j.request.headers))return}return U(x2(j),async(W)=>{let F=j.request.headers.get(v2)??void 0,k=M?await v(x2(j),"http.request",W,"http"):await g(x2(j),"http.request","http",F,W);W();let P=J2(k),u=k.attempt;if(!P||!u)throw V(k.scope);await G2(k,async()=>{let D=j.request;if(Z.rewriteRequest){if(F!==void 0){let C2=new Headers(D.headers);C2.delete(v2),D=new Request(D,{headers:C2})}D=await Z.rewriteRequest({...P,request:D,attempt:u})??D,W()}let i=new Headers(D.headers);i.delete(v2),a1(i,k.headers),E(k.scope,i.entries());let W2=new Request(D,{headers:i});B.set(W2,k),j.request=W2})})},z2)),K2.push(await $.session.hook("http.response",async(j)=>{let W=B.get(j.request);if(!W){if(M)return;if(!y)y=!0,p("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:j.sessionID,kind:j.kind});return}let F=j.response;if(Z.answeredBy&&W.attempt){let i=W.attempt,W2=await G2(W,async()=>Z.answeredBy?.({request:j.request,response:F,attempt:i}));if(W2)S2(W,W2)}let k=J2(W),P=W.attempt;if(!k||!P)return;W.status=F.status;let u=Z.quotaFromHeaders?.(F.headers,F.status,P);if(u!==void 0)N2(W,"http",u,F.status);if(!F.ok&&Z.limitFromResponse){let i=await Z.limitFromResponse({status:F.status,headers:F.headers,body:()=>F.clone().text(),attempt:P});if(i)B2(W,i,"http")}if(!F.ok||!F.body)d(W);let D=F;if(F.body&&(Z.inspectEvent||Z.onAttemptEnd)){let i=F.body;if(Z.inspectEvent)i=i.pipeThrough(H0((W2)=>_2(W,"http",W2.data,W2.event),(W2)=>p("opencode2 auth event inspection threw",{error:l(W2)})));D=new Response(s1(i,(W2)=>d(W,W2)),{status:F.status,statusText:F.statusText,headers:F.headers})}if(Z.rewriteResponse)D=await Z.rewriteResponse({...k,request:j.request,response:D,attempt:P})??D;if(D!==F)j.response=D},z2)),K2.push(await $.session.hook("experimental.ws.handshake",(j)=>{if(M){let W=D2(j.sessionID,j.kind);if(L.delete(W),!f(x2(j),new Headers(j.headers)))return}return U(x2(j),async(W)=>{let F;for(let D of Object.keys(j.headers)){if(D.toLowerCase()!==v2)continue;F??=j.headers[D],delete j.headers[D]}let k=M?await v(x2(j),"experimental.ws.handshake",W,"ws"):await g(x2(j),"experimental.ws.handshake","ws",F,W);W();let P=J2(k),u=k.attempt;if(!P||!u)throw V(k.scope);await G2(k,async()=>{if(!M?.refuseMisplaced)r2(j.headers,k.headers);let D=Z.rewriteHandshakeURL?.({...P,url:j.url,attempt:u});if(D!==void 0)j.url=D;if(M?.refuseMisplaced)r2(j.headers,k.headers);if(E(k.scope,Object.entries(j.headers)),M)L.add(k.key)})})},z2));let t=Z.rewriteWebSocketFrame?.bind(Z);if(t)K2.push(await $.session.hook("experimental.ws.send",async(j)=>{let W=x2(j);if(M&&!L.has(D2(W.sessionID,W.kind)))return;let F=n(W.sessionID,W.kind),k=await t({...W,attempt:F?.attempt,frame:j.frame});if(k!==void 0)j.frame=k},z2));K2.push(await $.session.hook("experimental.ws.receive",(j)=>{if(M&&!L.has(D2(j.sessionID,j.kind)))return;let W=n(j.sessionID,j.kind);if(!W)return;try{_2(W,"ws",j.frame)}catch(F){p("opencode2 auth frame inspection threw",{error:l(F)})}},z2)),K2.push(await $.session.hook("retry",async(j)=>{if(M&&S.get(j.sessionID)!==!0)return;let W=j.decision,F=()=>A("retry",{sessionID:j.sessionID,attempt:j.attempt,reason:"host-decides",hostDecision:W,decision:W});if(b(j.sessionID)&&!Z.retrySameAccount){await F();return}let k=Y2(j.sessionID);if(!k)return;if(k==="ambiguous"){await A("retry",{sessionID:j.sessionID,attempt:j.attempt,reason:"host-decides",hostDecision:W,decision:W});return}let P=k;await U(P.scope,async(u)=>{let D=u,i=Z.retrySameAccount?.bind(Z),W2=P.attempt;if(i&&W2&&!P.outputStarted&&!P.sameAccountRetry){if(P.ended)await P.ended;if(P.limit)await P.limit.delivered;let M2=await Z2(P.scope.sessionID,async()=>{D();let L2=W2.accountId,H2=()=>G.has(P.id)&&P.accountId===L2&&Y2(j.sessionID)===P&&!P.outputStarted&&(!M||S.get(j.sessionID)===!0);if(!H2()||P.sameAccountRetry)return!1;P.sameAccountRetry=!0;let P2={...P.scope,accountId:L2,error:j.error,attempt:j.attempt,...P.limit?{limit:P.limit.signal}:{}},U2;try{U2=await i(P2)}catch(q2){p("opencode2 auth retrySameAccount threw; recovery declined",{sessionID:j.sessionID,error:l(q2)})}if(!U2)return D(),!1;let O2={accountId:U2.accountId,input:P2};try{D()}catch(q2){throw await z(O2),q2}if(!H2()||U2.accountId!==L2)return await z(O2),!1;let E2=K.get(P.key);if(K.delete(P.key),E2)await R(E2);try{D()}catch(q2){throw await z(O2),q2}if(!H2())return await z(O2),!1;return K.set(P.key,{attemptId:P.id,sessionID:P.scope.sessionID,order:++_,accountId:L2,sameAccount:O2}),P.judged=!0,j.decision={retry:!0,delay:0},!0});if(D(),M2){await A("retry",{sessionID:j.sessionID,accountId:P.accountId,kind:P.scope.kind,attempt:j.attempt,reason:"same-account",hostDecision:W,decision:j.decision,handle:P.attempt});return}}if(b(j.sessionID)){await F();return}P.judged=!0;let C2=P.attempt;if(C2&&!P.outputStarted){if(!P.limit){let M2=Z.limitFromError?.(j.error,C2);if(M2)B2(P,M2,"error")}if(P.ended)await P.ended;if(P.limit)await P.limit.delivered}D();let{decision:o2,reason:w2}=await Z2(P.scope.sessionID,async()=>{if(D(),b(j.sessionID))return{decision:W,reason:"host-decides"};let M2=K.get(P.key);if(K.delete(P.key),M2)await R(M2);if(D(),b(j.sessionID))return{decision:W,reason:"host-decides"};let L2=W,H2,P2,U2;if(P.accountId===void 0||!C2)L2={retry:!1},H2="no-account";else if(P.outputStarted)L2={retry:!1},H2="output-started";else if(P.limit){let O2={accountId:P.accountId,limit:P.limit.signal},E2,q2={...P.scope,phase:"retry",previousAccountId:P.accountId,rerouteFrom:O2};try{E2=await Z.chooseAccount(q2)}catch(z0){p("opencode2 auth chooseAccount threw while the retry hook looked for another account; the host decides the retry",{sessionID:P.scope.sessionID,error:l(z0)})}let k2=typeof E2==="object"?E2.hold:void 0,n2=typeof E2==="string"?E2:k2?P.accountId:void 0;if(n2!==void 0)U2={accountId:n2,input:q2};try{D()}catch(z0){if(U2)await X(U2);throw z0}if(b(j.sessionID)){if(U2)await X(U2);return{decision:W,reason:"host-decides"}}if(k2&&Number.isFinite(k2.delayMs)&&k2.delayMs>=0)L2={retry:!0,delay:Math.min(k2.delayMs,w0)},H2="hold";else if(!k2&&n2!==void 0&&n2!==P.accountId)P.rerouted=!0,P2=O2,L2={retry:!0,delay:0},H2="reroute";else{if(k2&&U2)await X(U2),U2=void 0;H2="host-decides-last-account"}}else H2="host-decides";if(j.decision=L2,L2.retry&&P.accountId!==void 0&&G.has(P.id))K.set(P.key,{attemptId:P.id,sessionID:P.scope.sessionID,order:++_,accountId:P.accountId,...P2===void 0?{}:{rerouteFrom:P2},...U2===void 0?{}:{next:U2}});else if(U2)await X(U2);return{decision:L2,reason:H2}});D(),await A("retry",{sessionID:j.sessionID,...P.accountId===void 0?{}:{accountId:P.accountId},kind:P.scope.kind,attempt:j.attempt,reason:w2,hostDecision:W,decision:o2,...C2===void 0?{}:{handle:C2}})})},z2));let T2=(j)=>{if(N(j),S.delete(j),!O.get(j)?.foreignSeen)O.delete(j);for(let W of L)if(JSON.parse(W)[0]===j)L.delete(W);for(let W of[...G.values()]){if(W.scope.sessionID!==j)continue;c(W,"its session was forgotten"),G.delete(W.id)}for(let[W,F]of K)if(F.sessionID===j)I(W)},F2=new AbortController,i2=$.event;if(i2)(async()=>{try{for await(let j of i2.subscribe({signal:F2.signal}))if(j.type==="session.deleted")T2(j.data.sessionID);else if(j.type==="session.status"&&j.data.status.type==="idle"){let W=j.data.sessionID,F=++_;Z2(W,async()=>{for(let[k,P]of K)if(P.sessionID===W&&P.order<F)K.delete(k),await R(P)})}}catch(j){if(!F2.signal.aborted)p("opencode2 auth stopped listening for session deletion",{error:l(j)})}})();return{on(j,W){let F=e.get(j);if(!F)F=new Set,e.set(j,F);let k=W;return F.add(k),()=>{F.delete(k)}},accountFor(j,W){return h(D2(j,W))?.accountId},forgetSession:T2,get size(){return G.size},async dispose(){if(j2)return;j2=!0;for(let j of $2.keys())N(j);F2.abort();for(let j of G.values())c(j,"the installation was disposed");G.clear();for(let j of K.keys())I(j);L.clear(),S.clear(),O.clear(),e.clear(),await Promise.all(r.values()),await Promise.all(K2.map(async(j)=>{try{await j.dispose()}catch(W){p("opencode2 auth hook did not dispose cleanly",{error:l(W)})}}))}}}import{createHash as t1}from"node:crypto";import{AnthropicOAuthOriginError as e1,applyCustomHeaders as $4,assertNotCustodyTombstone as Z4,classifyGzipRejection as j4,createProviderErrorRedactor as D0,createProviderErrorResponseScope as I0,decideRequestGzip as J4,dumpDirectRequest as y0,dumpRelayRequest as f0,dumpResponseArtifact as s2,encodeGzipRequestBody as X4,getAccountStoragePath as G4,getRequestGzipLatch as Y4,getRequestGzipLatchPath as V4,isDumpEnabled as Q4,mergeAnthropicBetas as W4,remapModelId as v0,remapRequestBodyModel as U4,setDumpEnabled as g0,stateRefusalCause as B4,stateRefusalPublicMessage as z4,stripEmptyTrailingAssistantMessages as K4,TrailingAssistantHistoryError as M4}from"@cortexkit/anthropic-auth-core";var g2="anthropic",r0="x-common-auth-attempt",H4=["x-session-affinity","x-opencode-session","x-parent-session-id",m0,t2,y2,r0],a2=new Set(["authorization","x-api-key"]),N4="physical send before a response",_4="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",L4=512,F4=5000,P4=500,s0=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]),_0=($,Z="provider request failed")=>({type:s0.has($.type)?$.type:"provider_error",message:Z,...$.status!==void 0?{status:$.status}:{}});class a0 extends Error{sessionID;requestKind;kind="no-account";providerID=g2;constructor($,Z){super(_4);this.sessionID=$;this.requestKind=Z;this.name="NativeAnthropicNoAccountError"}}class P0 extends Error{sessionID;requestKind;kind="session-forgotten";providerID=g2;constructor($,Z){super("request refused: its session was closed while it was being prepared");this.sessionID=$;this.requestKind=Z;this.name="NativeAnthropicRevokedError"}}class b2 extends Error{kind="unsupported-transport";providerID=g2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class t0 extends Error{kind="local-invalid-request";status=400;check;constructor($){super($.message,{cause:$});this.name="NativeAnthropicLocalRefusal",this.check=$.check}}class e0 extends Error{kind="state-relocated";providerID=g2;constructor($){super(z4($)??$.message,{cause:$});this.name="NativeAnthropicStateRefusal"}}function e2($){let Z=B4($);return Z?new e0(Z):void 0}var I2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($);function d2($){try{return JSON.parse($)}catch{return}}function L0($){let Z={};for(let[Q,Y]of Object.entries($??{}))Z[Q.toLowerCase()]=Y;return Z}function h0($){let Z={};for(let Q of H4){let Y=$.get(Q);if(Y!==null&&Q!==r0)Z[Q]=Y;$.delete(Q)}return Z}function T4($){try{return new URL($).pathname.endsWith("/messages")}catch{return!1}}function C4($){return $ instanceof M4||$ instanceof l0||$ instanceof e1?new t0($):void 0}function O4($,Z){let Q=[];if($.oauth)Q.push($.oauth.accessToken);for(let[Y,M]of Object.entries($.apiHeaders??{})){if(M===null||!a2.has(Y))continue;Q.push(M.replace(/^Bearer\s+/i,""))}for(let Y of a2){let M=Z.get(Y);if(M!==null)Q.push(M.replace(/^Bearer\s+/i,""))}if($.dispatch?.kind==="http-relay")Q.push($.dispatch.token);return[...new Set(Q.filter(Boolean))]}var E4=new Set(["oauth-2025-04-20","claude-code-20250219",p0]);function q4($){let Z=$.split(",").map((Q)=>Q.trim()).filter((Q)=>Q&&!E4.has(Q));return W4(null,Z)}function x4($){let Z=d2($);if(!I2(Z))return $;let Q=K4(Z.messages),Y=Object.hasOwn(Z,"fallbacks"),{droppedMarkers:M}=c0(Z,!1),C=Y&&!Object.hasOwn(Z,"fallbacks"),q=U4(Z);return Q>0||M>0||C||q?JSON.stringify(Z):$}async function S4($,Z){if(!($ instanceof Promise))return"settled";let Q;try{return await Promise.race([$.then(()=>"settled"),new Promise((Y)=>{Q=setTimeout(()=>Y("timed-out"),Z)})])}finally{if(Q!==void 0)clearTimeout(Q)}}function h2($){let{source:Z,log:Q}=$,Y=Math.max(1,$.maxPendingSends??L4),M=$.attemptEndTimeoutMs??F4,C=$.requestGzipLatch??Y4(V4(G4())),q=new WeakSet,T=new Map,H=new WeakMap,G=new WeakMap,B=(V)=>JSON.stringify([V.providerID,V.sessionID,V.kind,V.modelID,V.agent,V.accountId]),K=new Map,_=new WeakMap,L=new Map,S=new WeakMap,O=D0([]);O.dispose();let b=(V)=>(V&&L.get(V)?.redactor)??O,w=(V)=>{let N=L.get(V);if(!N)return;L.delete(V),N.redactor.dispose(),N.scope.dispose()},f=(V,N,U,E)=>{let x=O4(N,E),v=I0(x,U);y.set(V,U),L.set(V,{sessionID:N.sessionID,redactor:D0(x),scope:v}),v.settled.then(()=>w(V));while(L.size>Y){let g=L.keys().next().value;if(g===void 0)break;w(g)}},y=new WeakMap,o=(V,N)=>{let U=V?y.get(V):void 0;if(!U||!N.ok)return O.redactResponse(N);let E=I0([],U),x=E.redactResponse(N);return E.dispose(),x},e=(V,N)=>{let U=V?L.get(V)?.scope:void 0;if(!U)return o(V,N);try{return U.redactResponse(N)}catch{return o(V,N)}},Q2=!1,j2=new Map,$2=new WeakMap,p=new WeakMap,l=new WeakMap,r=(V)=>V.agent==="cachekeep"||V.agent==="prime",Z2=async()=>{try{if(Z.isDumpEnabled)return await Z.isDumpEnabled()}catch{return!1}try{return Q4()}catch{return!1}},J=(V)=>{j2.delete(V)},X=new WeakMap,z=(V,N)=>{if(V&&!N.ok)X.set(N.headers,V);return N},R=(V,N)=>{if(N.dispatch!=="http-relay")return!0;let U=/^req_[A-Za-z0-9_-]+$/.test(V.get("request-id")??"");return G.set(N,U),U},I=(V)=>new a0(V.sessionID,V.kind),A=new Map,m=async(V,N)=>{if(Q2)throw new P0(V.sessionID,V.kind);let U={revoked:!1},E=A.get(V.sessionID);if(!E)E=new Set,A.set(V.sessionID,E);E.add(U);let x=()=>{if(Q2||U.revoked)throw new P0(V.sessionID,V.kind)};try{let v=await N(x);return x(),v}finally{let v=A.get(V.sessionID);if(v?.delete(U)&&v.size===0)A.delete(V.sessionID)}},d=(V,N)=>{T.set(V,N);while(T.size>Y){let U=T.keys().next().value;if(U===void 0)break;T.delete(U),Q?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:Y})}},c=(V,N)=>({providerID:V.providerID,modelID:V.modelID,sessionID:V.sessionID,agent:V.agent,kind:V.kind,accountId:V.accountId,attemptId:V.attemptId,transport:V.transport,route:N.route,provenance:N.provenance,dispatch:N.dispatch}),s=(V)=>m(V,async(N)=>{let{accountId:U,...E}=V,x;try{x=await Z.authorizeAccount(E,U)}catch(v){let g=e2(v);if(g)throw Q?.warn("refused an Anthropic request: its account state was moved or could not be recorded",{error:g.cause instanceof Error?g.cause.name:""}),g;throw v}return N(),h(E,x)}),h=(V,N)=>{if(!N)throw I(V);if(N.dispatch?.kind==="websocket-relay")throw new b2;let U=N.dispatch?.kind==="http-relay"?"http-relay":"direct",E=N.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":N.dispatch.token}:void 0;if(N.route==="oauth"){if(!N.accessToken)throw I(V);Z4(N.accessToken,g2);let g=Object.freeze({route:"oauth",provenance:N.provenance,dispatch:U});d(g,{sessionID:V.sessionID,oauth:{accessToken:N.accessToken,...N.identity?{identity:N.identity}:{}},dispatch:N.dispatch,oauthHeaders:N.headers});let G2=L0(N.headers);for(let n of a2)delete G2[n];return delete G2["anthropic-beta"],{headers:E??{...G2,"x-api-key":null,authorization:`Bearer ${N.accessToken}`},attempt:g}}let x={authorization:null,"x-api-key":null,...L0(N.headers)};if(!x.authorization&&!x["x-api-key"])throw I(V);let v=Object.freeze({route:"api",provenance:N.provenance,dispatch:U});return d(v,{sessionID:V.sessionID,...N.baseURL?{baseURL:N.baseURL}:{},dispatch:N.dispatch,apiHeaders:x}),{headers:E??x,attempt:v}},X2=(V)=>m(V,(N)=>a(V,N)),a=async(V,N)=>{let{request:U,attempt:E}=V,x=E.data;K.set(B(V),E);while(K.size>Y){let V2=K.keys().next();if(!V2.done)K.delete(V2.value)}let v=x?T.get(x):void 0;if(x)T.delete(x);if(!x||!v||x.route==="oauth"&&!v.oauth)throw I(V);let g=new Headers(U.headers);$4(g);let G2=h0(g),n=U.body===null?void 0:await U.text();N();let B2=n!==void 0&&T4(U.url),N2=o0(U.url,v.baseURL!==void 0?{baseURL:v.baseURL}:{}).url?.toString()??U.url;try{if(x.route==="oauth"&&v.oauth){d0(N2);let{accessToken:V2,identity:Y2}=v.oauth;for(let[K2,t]of Object.entries(L0(v.oauthHeaders))){if(a2.has(K2))continue;if(t===null)g.delete(K2);else g.set(K2,t)}let z2=null;if(n!==void 0&&B2){let K2={...c(E,x),modelID:(()=>{let F2=d2(n);return v0(I2(F2)&&typeof F2.model==="string"?F2.model:V.modelID)})(),route:"oauth",correlation:G2},t=await Z.requestOptions?.(K2)??{};if(N(),E.agent!=="cachekeep")n=await n0(n,{...t,...Y2?{identity:Y2}:{},sessionId:V.sessionID,onToolNameMap:(F2)=>_.set(x,F2)});let T2=d2(n);z2=I2(T2)?T2:null}i0(g,V2,{body:z2,...Y2?{identity:Y2}:{},requestClass:u0(E.agent)?"auxiliary":"main"})}else{if(n!==void 0&&B2)n=x4(n);g.delete("authorization"),g.delete("x-api-key");for(let[Y2,z2]of Object.entries(v.apiHeaders??{}))if(z2===null)g.delete(Y2);else g.set(Y2,z2);if(n!==void 0&&B2&&!g.has("content-type"))g.set("content-type","application/json");let V2=g.get("anthropic-beta");if(V2!==null){let Y2=q4(V2);if(Y2)g.set("anthropic-beta",Y2);else g.delete("anthropic-beta")}}}catch(V2){let Y2=C4(V2);if(!Y2)throw V2;throw H.set(x,Y2.check),Q?.warn("refused an Anthropic request locally; nothing was sent",{check:Y2.check}),Y2}let _2=n!==void 0?d2(n):void 0;if(await Z.admitRequest?.({...c(E,x),modelID:v0(I2(_2)&&typeof _2.model==="string"?_2.model:V.modelID)}),h0(g),n!==void 0)g.delete("content-length");if(N(),f(x,v,I2(_2)&&_2.stream===!0?"event-stream":"http",g),x.route==="oauth"&&B2&&n!==void 0)await Z.onRequestPrepared?.({...c(E,x),url:N2,bodyText:n}),N();if(v.dispatch?.kind==="http-relay"){let V2=n??"";g.delete("x-relay-token");let Y2={protocol:1,type:"request",affinity:V.sessionID,upstream:{url:N2,method:U.method,headers:Object.fromEntries(g)},mode:"full_sync",revision:1,body:V2,next_hash:`sha256:${t1("sha256").update(V2).digest("hex")}`};if(B2&&n!==void 0&&!r(E)){let z2=G2[y2]==="1"?"start":void 0,K2=JSON.stringify(Y2);j2.set(x,{affinity:V.sessionID,route:V.accountId,bodyText:V2,url:N2,method:U.method,headers:new Headers(g),dispatch:"http-relay",relayUrl:v.dispatch.url,envelope:Y2,relayBytes:K2.length,...z2?{tag:z2}:{}})}else J(x);return new Request(v.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":v.dispatch.token},redirect:"error",signal:U.signal,body:JSON.stringify(Y2)})}let S2=n;if(x.route==="oauth"&&B2&&n!==void 0){let V2=await J4({url:N2,body:n,latch:C});if(N(),V2.gzip)S2=await X4(n),g.set("content-encoding","gzip"),q.add(x),N()}if(B2&&n!==void 0&&!r(E)){let V2=G2[y2]==="1"?"start":void 0;j2.set(x,{affinity:V.sessionID,route:V.accountId,bodyText:n,url:N2,method:U.method,headers:new Headers(g),dispatch:"direct",...V2?{tag:V2}:{}})}else J(x);return new Request(N2,{method:U.method,headers:g,redirect:x.route==="oauth"?"error":U.redirect,signal:U.signal,...S2!==void 0?{body:S2}:{}})},J2={providerID:g2,chooseAccount:(V)=>m(V,async()=>{let N=await Z.chooseAccount(V);if(typeof N==="object"&&V.phase==="retry")return N;if(typeof N!=="string"||!N)throw I(V);return N}),dropChoice:(V)=>Z.dropChoice?.(V),async retrySameAccount(V){if(!Z.retrySameAccount)return;let N=B(V),U=K.get(N);K.delete(N);let E=V.limit??(U?J2.limitFromError?.(V.error,U):void 0);return Z.retrySameAccount({...V,error:_0(V.error),...E?{limit:E}:{}})},dropSameAccountRetry:(V)=>Z.dropSameAccountRetry?.({...V,error:_0(V.error)}),accountHeaders:s,rewriteRequest:X2,rewriteHandshakeURL(){throw new b2},async rewriteResponse({response:V,attempt:N}){let U=N.data;if(U&&!R(V.headers,U)){if(U)J(U);if(V.status===401)return w(U),V.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return e(U,V)}if(U&&q.has(U))q.delete(U),j4(V).then((t)=>{if(!t)return;C.latchProcess(),Q?.warn("gzipped request body rejected; later requests go uncompressed",{kind:t,status:V.status})},()=>{});let E=null,x=U?j2.get(U):void 0;if(U&&x){let t=!1;try{t=await Z2()}catch{t=!1}if(!t)J(U);else{try{g0(!0)}catch{}try{if(x.dispatch==="http-relay")E=await f0({affinity:x.affinity,transport:"http",protocol:1,mode:"full_sync",status:V.status,bodyText:x.bodyText,payload:x.envelope??{},relayBytes:x.relayBytes??0,...x.tag?{tag:x.tag}:{}});else E=await y0({affinity:x.affinity,route:x.route,status:V.status,bodyText:x.bodyText,url:x.url,method:x.method,headers:x.headers,...x.tag?{tag:x.tag}:{}})}catch{E=null}if(J(U),E){$2.set(U,E);try{await s2(E,{status:V.status,message:null,complete:!1})}catch{}l.set(U,Promise.resolve())}}}let v=e(U,V);if(U?.route!=="oauth"||!v.body)return z(U,v);let g={...c(N,U),status:V.status},G2=Z.responseOptions?.(g)??{},n=(V.headers.get("content-type")??"").includes("application/json"),B2={...G2,toolNameMap:U?_.get(U):void 0,onToolNameRefusal:()=>{if(!U)return;H.set(U,"response_tool_names"),w(U)},laneStartOAuthServed:!0,...n?{responseMode:"json"}:{}};if(!U||!E)return z(U,F0(v,B2));let N2=E,_2=V.status,S2=(t)=>{let F2=(l.get(U)??Promise.resolve()).then(()=>t().then(()=>{return})).catch(()=>{return});l.set(U,F2)},V2=G2.onMessageStart,Y2=G2.onMessageDelta,z2=G2.onMessageResponse,K2=G2.onStreamEnd;return z(U,F0(v,{...B2,onMessageStart:(t)=>{try{V2?.(t)}catch{}try{p.set(U,{...t}),S2(()=>s2(N2,{status:_2,message:t,complete:!1}))}catch{}},onMessageDelta:(t)=>{try{Y2?.(t)}catch{}try{let T2=p.get(U)??{},F2=T2.usage&&typeof T2.usage==="object"&&!Array.isArray(T2.usage)?T2.usage:{},i2={...T2,...t.usage?{usage:{...F2,...t.usage}}:{},...t.stopReason?{stop_reason:t.stopReason}:{}};S2(()=>s2(N2,{status:_2,message:i2,complete:!0}))}catch{}},onMessageResponse:(t)=>{try{z2?.(t)}catch{}try{S2(()=>s2(N2,{status:_2,message:t,complete:!0}))}catch{}},onStreamEnd:async()=>{try{await K2?.()}catch{}try{await(l.get(U)??Promise.resolve())}catch{}}}))},quotaFromHeaders(V,N,U){let E=U.data;if(!E||!R(V,E))return;return Z.quotaFromHeaders?.(V,{...c(U,E),status:N})},async limitFromResponse({status:V,headers:N,body:U,attempt:E}){let x=E.data;if(!x||H.get(x)==="response_tool_names")return;if(!R(N,x))return Z.limitFromRelayFailure?.({...c(E,x),status:V});if(S.set(x,`provider responded with HTTP ${V}`),!Z.limitFromResponse)return;let v=X.get(N)===x,g=b(x);return Z.limitFromResponse({...c(E,x),status:V,headers:N,body:async()=>v?await U():g.redactText(await U())})},inspectEvent({data:V,event:N,attempt:U}){if(U.data&&H.get(U.data)==="response_tool_names")return;let E=d2(V);if(!I2(E))return;let x=typeof E.type==="string"?E.type:N;if(x==="content_block_start"||x==="content_block_delta")return{outputStarted:!0};if(x==="message_stop")return{done:!0};if(x!=="error")return;let v=U.data,g=b(v),G2=I2(E.error)?E.error:{},n=typeof G2.type!=="string"?void 0:s0.has(G2.type)?G2.type:g.redactText(G2.type),B2=typeof G2.message==="string"?g.redactText(G2.message):void 0;if(v?.dispatch==="http-relay"&&G.get(v)===!1)return;let N2=v?Z.limitFromStreamError?.({...c(U,v),errorType:n,message:B2}):void 0,_2={error:[n??"error",B2].filter(Boolean).join(": ").slice(0,P4),...N2?{limit:N2}:{}};if(v&&_2.error)S.set(v,_2.error);return _2},limitFromError(V,N){let U=N.data;if(!U||H.has(U))return;let E=_0(V,S.get(U));if(w(U),U.dispatch==="http-relay"&&G.get(U)===!1)return;return Z.limitFromHostError?.(E,c(N,U))},async onAttemptEnd(V,N){let U=V.data;if(!U)return;T.delete(U);let E=j2.get(U);if(E){J(U);try{if(await Z2()){try{g0(!0)}catch{}try{if(E.dispatch==="http-relay"){if(N.status!==void 0)await f0({affinity:E.affinity,transport:"http",protocol:1,mode:"full_sync",status:N.status,bodyText:E.bodyText,payload:E.envelope??{},relayBytes:E.relayBytes??0,...E.tag?{tag:E.tag}:{}})}else await y0({affinity:E.affinity,route:E.route,status:N.status,error:N.status===void 0?N4:void 0,bodyText:E.bodyText,url:E.url,method:E.method,headers:E.headers,...E.tag?{tag:E.tag}:{}})}catch{}}}catch{}}let x=N.error?.reason;if(x==="cancelled"||x==="abandoned"||x===void 0&&(N.status===void 0||N.status<400))w(U);let v=H.get(U),{status:g,...G2}=N,n=Z.onAttemptEnd?.(c(V,U),{...G2,...g!==void 0&&(U.dispatch!=="http-relay"||G.get(U)===!0)?{status:g}:{},...v!==void 0?{localRefusal:{check:v}}:{}});if(await S4(n,M)==="timed-out")Q?.warn("the account source did not finish recording a send",{timeoutMs:M})}};return{adapter:J2,dispose(){Q2=!0;for(let[V,N]of A){for(let U of N)U.revoked=!0;Z.forgetSession?.(V)}A.clear(),T.clear(),K.clear(),j2.clear();for(let V of[...L.keys()])w(V)},forgetSession(V){for(let N of A.get(V)??[])N.revoked=!0;A.delete(V);for(let[N,U]of K)if(U.sessionID===V)K.delete(N);for(let[N,U]of T)if(U.sessionID===V)T.delete(N);for(let[N,U]of[...L])if(U.sessionID===V)w(N);for(let[N,U]of[...j2])if(U.affinity===V)j2.delete(N);Z.forgetSession?.(V)},get pendingSendCount(){return T.size},get heldCredentialCount(){let V=0;for(let N of T.values())if(N.oauth)V++;return V},get heldRedactorCount(){return L.size},get operationsInProgress(){let V=0;for(let N of A.values())V+=N.size;return V}}}import{setTimeout as o4}from"node:timers/promises";import{CacheKeepManager as n4,CacheKeepSessionRegistry as r4,getDefaultCacheKeepRegistryDirectory as s4,isCacheKeepActiveNow as W1,isCacheKeepHybridActive as p2,isCacheKeepSubagentsEnabled as j0,logger as J0,NativeAccountRefusal as A2,nativeAccountCanServe as B1,nativeAccountRefusal as a4}from"@cortexkit/anthropic-auth-core";import{createHash as R4,randomUUID as b4}from"node:crypto";import{constants as $1}from"node:fs";import{lstat as Z1,mkdir as A4,open as w4,readdir as j1,rm as $0,writeFile as D4}from"node:fs/promises";import{tmpdir as I4}from"node:os";import{join as u2}from"node:path";import{promisify as Y1}from"node:util";import{gunzip as y4,gzip as f4}from"node:zlib";import{CACHE_KEEP_MAX_BODY_BYTES as V1,createWindowsOwnerOnly as v4,ensureWindowsOwnerOnlyDirectory as g4,isOwnerOnly as J1,logger as h4,readWindowsOwnerOnly as m4,renameWithWindowsSharingRetry as l4}from"@cortexkit/anthropic-auth-core";var T0="2.4.6";var d4=Y1(f4),u4=Y1(y4),Z0=($)=>R4("sha256").update($).digest("hex"),X1=/^[a-f0-9]{64}\.json\.gz$/,C0=/^[a-f0-9]{64}\.json\.gz\.[a-f0-9-]+\.tmp$/,G1=2*V1+65536;function p4($,Z=I4()){return u2(Z,`cortexkit-anthropic-auth-cachekeep-${Z0($).slice(0,16)}`)}function c4($){return{v:1,pluginVersion:T0,id:$.id,bodyText:$.bodyText,url:$.url,cacheExpiresAt:$.cacheExpiresAt,nextPrewarmAt:$.nextPrewarmAt,oauthAccountIdentity:$.oauthAccountIdentity,isSubagent:$.isSubagent}}function Q1($){let Z=JSON.parse($);if(!Z||typeof Z!=="object"||Array.isArray(Z))throw Error("Invalid restart body");let Q=!1;for(let Y of Object.keys(Z))if(/^(authorization|x-api-key|cookie|set-cookie|headers|credentials|token|access[_-]?token|refresh[_-]?token)$/i.test(Y))delete Z[Y],Q=!0;return Q?JSON.stringify(Z):$}function i4($,Z,Q){if(!$||typeof $!=="object"||Array.isArray($))return!1;if($.v!==1||$.pluginVersion!==T0||typeof $.id!=="string"||!$.id||`${Z0($.id)}.json.gz`!==Z||typeof $.bodyText!=="string"||Buffer.byteLength($.bodyText)>V1||typeof $.url!=="string"||typeof $.oauthAccountIdentity!=="string"||!$.oauthAccountIdentity||typeof $.isSubagent!=="boolean"||!Number.isFinite($.cacheExpiresAt)||$.cacheExpiresAt<=Q||!Number.isFinite($.nextPrewarmAt))return!1;return Q1($.bodyText)===$.bodyText}class O0{options;directory;disabled=!1;chain=Promise.resolve();pending=new Map;timers=new Map;lastWrite=new Map;latest=new Map;constructor($){this.options=$;this.directory=p4($.storageId,$.root)}refuse(){if(this.disabled)return;this.disabled=!0;for(let $ of this.timers.values())(this.options.clearTimeoutImpl??clearTimeout)($);this.timers.clear(),this.pending.clear(),this.latest.clear(),this.lastWrite.clear(),h4.warn("cachekeep","restart storage unavailable; retaining sessions in memory only")}async directoryReady(){if(this.disabled)return!1;try{if(!await g4(this.directory,this.options.ownerOnly))try{await A4(this.directory,{mode:448})}catch(Z){if(Z.code!=="EEXIST")throw Z}let $=await Z1(this.directory);if(!$.isDirectory()||$.isSymbolicLink()||!await J1(this.directory,()=>$.uid===process.getuid?.()&&($.mode&511)===448,this.options.ownerOnly))throw Error("Unsafe restart directory");return!0}catch{return this.refuse(),!1}}enqueue($){this.chain=this.chain.then(async()=>{if(await this.directoryReady())await $()}).catch(()=>this.refuse())}async load($,Z){if(!await this.directoryReady())return;try{for(let Q of(await j1(this.directory)).sort()){if(!X1.test(Q)&&!C0.test(Q))continue;let Y=u2(this.directory,Q);try{if(C0.test(Q))throw Error("Unfinished write");let M=await Z1(Y);if(!M.isFile()||M.isSymbolicLink()||M.size>G1||!await J1(Y,()=>M.uid===process.getuid?.()&&(M.mode&511)===384,this.options.ownerOnly))throw Error("Unsafe restart file");let C=await m4(Y,this.options.ownerOnly);if(!C){let H=await w4(Y,$1.O_RDONLY|$1.O_NOFOLLOW);try{C=await H.readFile()}finally{await H.close()}}let q=await u4(C,{maxOutputLength:G1}),T=JSON.parse(q.toString("utf8"));if(!i4(T,Q,$)||!Z(T))throw Error("Stale restart file")}catch{await $0(Y,{force:!0})}}}catch{this.refuse()}}changed($){if(this.disabled)return;let Z=c4($),Q=this.latest.get(Z.id);if(Q&&Q.bodyText===Z.bodyText&&Q.url===Z.url&&Q.oauthAccountIdentity===Z.oauthAccountIdentity&&Q.cacheExpiresAt===Z.cacheExpiresAt&&Q.nextPrewarmAt===Z.nextPrewarmAt&&Q.isSubagent===Z.isSubagent)return;if(this.latest.set(Z.id,Z),this.pending.set(Z.id,Z),this.timers.has(Z.id))return;let Y=Math.max(250,(this.lastWrite.get(Z.id)??0)+5000-(this.options.now?.()??Date.now())),M=(this.options.setTimeoutImpl??setTimeout)(()=>this.flush(Z.id),Y);M.unref?.(),this.timers.set(Z.id,M)}flush($){let Z=this.timers.get($);if(Z)(this.options.clearTimeoutImpl??clearTimeout)(Z);this.timers.delete($);let Q=this.pending.get($);if(this.pending.delete($),!Q)return this.chain;return this.lastWrite.set($,this.options.now?.()??Date.now()),this.enqueue(async()=>{let Y=u2(this.directory,`${Z0($)}.json.gz`),M=`${Y}.${b4()}.tmp`;try{let C={...Q,bodyText:Q1(Q.bodyText)},q=await d4(JSON.stringify(C));if(!await v4(M,q,this.options.ownerOnly))await D4(M,q,{flag:"wx",mode:384});await l4(M,Y,{platform:this.options.ownerOnly?.platform})}finally{await $0(M,{force:!0})}}),this.chain}removed($){let Z=this.timers.get($);if(Z)(this.options.clearTimeoutImpl??clearTimeout)(Z);this.timers.delete($),this.pending.delete($),this.latest.delete($),this.lastWrite.delete($),this.enqueue(()=>$0(u2(this.directory,`${Z0($)}.json.gz`),{force:!0}))}clear(){for(let $ of this.timers.values())(this.options.clearTimeoutImpl??clearTimeout)($);this.timers.clear(),this.pending.clear(),this.latest.clear(),this.lastWrite.clear(),this.enqueue(async()=>{for(let $ of await j1(this.directory))if(X1.test($)||C0.test($))await $0(u2(this.directory,$),{force:!0})})}async drain(){for(let $ of this.pending.keys())this.flush($);await this.chain}}function m2($){return JSON.stringify([$.source,$.accountIdentity,$.credentialId,$.binding?.storageId,$.binding?.rowId,$.binding?.credentialEpoch])}var U1=Symbol.for("cortexkit.anthropic-auth.opencode2.cachekeep.v2");function z1(){let $=globalThis;return $[U1]??=new Map,$[U1]}function t4($,Z){let Q=new Map,Y=new Map,M=new O0({storageId:$,...Z.persistence}),C=new Set,q=0,T=new r4({directory:Z.registryDirectory||process.env.OPENCODE_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR||s4("opencode"),now:Z.now}),H=()=>{let O;for(let b of Y.values())O=b;return O},G=Z.setIntervalImpl??globalThis.setInterval,B=new n4({loadStorage:async()=>{let O=H(),b=O?await O.loadStorage():null;if(O&&!p2(b)){for(let w of B.trackedSessions())B.untrack(w.id);M.clear()}return b},now:Z.now,setIntervalImpl:(O,b)=>G(()=>{let w=B.tick();return S.ticking=w.catch(()=>{J0.warn("cachekeep","tick failed")}),S.ticking},b),clearIntervalImpl:Z.clearIntervalImpl,onTargetChanged:(O)=>M.changed(O),onTargetRemoved:(O)=>{C.delete(O),M.removed(O)},onTrackedSessionsChanged:(O)=>T.publish(Y.size===0?[]:O),prepareHeaders(O,b,w){let f=H();if(!f)return;return Q.set(w.id,{target:b,attempt:w,lease:f}),new Headers({"x-native-cachekeep-attempt":String(w.id)})},fetchImpl:async(O,b)=>{let w=new Request(O,b),f=Number(w.headers.get("x-native-cachekeep-attempt")),y=Q.get(f);if(Q.delete(f),!y||y.lease.stopped)throw Error("CacheKeep attempt is unavailable");if(C.delete(y.target.id))await o4(Math.max(0,q+3000-Date.now()),void 0,{signal:y.attempt.signal}),q=Date.now();let o=y.lease.send(y.target,w,y.attempt.signal),e=o.then(()=>{},()=>{});return y.lease.inflight.add(e),e.then(()=>y.lease.inflight.delete(e)),o},onComplete:({attempt:O})=>{Q.delete(O.id)}}),K,_=()=>{if(K!==void 0)clearTimeout(K);K=void 0},L=()=>{if(_(),Y.size>0)return;let O=B.dropExpiredTargets();if(O===void 0){let w=z1();if(w.get($)===S)w.delete($);return}let b=Z.now?.()??Date.now();if(K=setTimeout(L,Math.max(0,O-b)),typeof K==="object"&&"unref"in K)K.unref()},S={manager:B,registry:T,persistence:M,prepared:Q,leases:Y,nextGeneration:0,retain(){B.stop(),Q.clear(),L()},async adopt(){if(_(),S.loading??=(async()=>{let O=H();if(!O)return;let b=await O.read();if(!p2(b.policyStorage)){M.clear();return}let w=Z.now?.()??Date.now(),f=0;await M.load(w,(y)=>{if(!Y.size||B.trackedRequest(y.id))return!0;let o=b.accounts.find((j2)=>m2(j2)===y.oauthAccountIdentity);if(o?.type!=="oauth"||!B1(o)||y.isSubagent&&!j0(b.policyStorage))return!1;let e=y.nextPrewarmAt<=w?w+f++*3000:y.nextPrewarmAt,Q2=B.track({sessionId:y.id,url:y.url,headers:new Headers,bodyText:y.bodyText,storage:b.policyStorage,cacheMode:"hybrid",oauthAccountId:o.id,oauthAccountIdentity:y.oauthAccountIdentity,isSubagent:y.isSubagent,retained:{cacheExpiresAt:y.cacheExpiresAt,nextPrewarmAt:e}});if(Q2.tracked)C.add(y.id);return Q2.tracked})})().catch(()=>{J0.warn("cachekeep","failed to restore tracked sessions")}),await S.loading,!Y.size)return;if(B.dropExpiredTargets()===void 0)return;B.start(),T.publish(B.trackedSessions()).catch(()=>{J0.warn("cachekeep","failed to publish tracked sessions")})}};return S}function K1($){let{runtime:Z,source:Q}=$,Y=new AbortController,M=z1(),C=M.get($.storageId)??t4($.storageId,$);M.set($.storageId,C);let{manager:q,registry:T}=C,H=async(L,S,O)=>{let b=O?AbortSignal.any([Y.signal,O]):Y.signal;b.throwIfAborted();let w=JSON.parse(await S.text()),f={providerID:"anthropic",modelID:w.model,sessionID:`oc2-cachekeep:${L.id}`,agent:"cachekeep",kind:"generate"},y=(p)=>{throw new A2(p)},o=h2({source:{...Q,onRequestPrepared:void 0,responseOptions:void 0,async requestOptions(p){return{...await Q.requestOptions?.(p,y),laneStart:!1,billingLineage:void 0,cacheDiagnosticsPreviousMessageId:void 0}},async authorizeAccount(p,l){let r=await Z.read();b.throwIfAborted();let Z2=r.accounts.find((X)=>X.id===l);if(Z2?.type!=="oauth"||!B1(Z2))throw new A2("account-unavailable");if(m2(Z2)!==L.oauthAccountIdentity)throw new A2("credential-changed");if(L.isSubagent&&!j0(r.policyStorage)||!p2(r.policyStorage)||!W1(r.policyStorage,new Date($.now?.()??Date.now())))return;let J=await Q.authorizeAccount(p,l,y);if(J?.provenance.kind==="local"&&m2({...Z2,binding:J.provenance.subject.binding,accountIdentity:J.provenance.subject.binding.identity})!==L.oauthAccountIdentity)throw new A2("credential-changed");if(J?.provenance.kind==="vault"&&J.provenance.credentialId!==Z2.credentialId)throw new A2("credential-changed");return J},async admitRequest(p){await Q.admitRequest?.(p,y);let l=await Z.read(),r=l.accounts.find((Z2)=>Z2.id===p.accountId);if(b.throwIfAborted(),!r)throw new A2("account-unavailable");if(m2(r)!==L.oauthAccountIdentity)throw new A2("credential-changed");if(L.isSubagent&&!j0(l.policyStorage)||!p2(l.policyStorage)||!W1(l.policyStorage,new Date($.now?.()??Date.now())))throw Error("CacheKeep policy changed before dispatch")}}}),e,Q2,j2=!1,$2=()=>o.forgetSession(f.sessionID);b.addEventListener("abort",$2,{once:!0});try{let p=await Z.read(),l=p.accounts.find((R)=>m2(R)===L.oauthAccountIdentity)?.id;if(!l)throw new A2(p.accounts.some((R)=>R.id===L.oauthAccountId)?"credential-changed":"account-unavailable");let r=await o.adapter.accountHeaders({...f,accountId:l});if(!("headers"in r)||typeof r.headers!=="object"||r.headers===null||typeof r.attempt!=="object"||r.attempt===null||r.attempt.route!=="oauth")throw Error("CacheKeep authorization refused");e={...f,accountId:l,attemptId:crypto.randomUUID(),transport:"http",data:r.attempt};let Z2=await o.adapter.rewriteRequest?.({...f,accountId:l,attempt:e,request:new Request(L.url,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(w),signal:b})});if(!Z2)throw Error("CacheKeep rewrite refused");b.throwIfAborted();let J=await($.fetch??fetch)(Z2),X=await o.adapter.rewriteResponse?.({...f,accountId:l,attempt:e,request:Z2,response:J});if(!X)throw Error("CacheKeep response rewrite refused");if(Q2=X.status,o.adapter.quotaFromHeaders?.(X.headers,X.status,e),!X.ok)await o.adapter.limitFromResponse?.({status:Q2,headers:X.headers,body:()=>X.clone().text(),attempt:e});let z=await X.arrayBuffer();return j2=!0,new Response(z,{status:Q2,headers:X.headers})}catch(p){let l=a4(p);if(l)throw l;throw Error("Native CacheKeep was not completed")}finally{b.removeEventListener("abort",$2);try{if(e)await o.adapter.onAttemptEnd?.(e,{status:Q2,outputStarted:!1,...j2?{}:{error:{reason:"cancelled"}}})}finally{o.dispose(),Q.forgetSession?.(f.sessionID)}}},G={generation:C.nextGeneration++,stopped:!1,loadStorage:async()=>(await Z.read()).policyStorage,send:H,inflight:new Set,read:()=>Z.read()},B=C.leases.size===0;C.leases.set(G.generation,G);let K=B?C.adopt():C.loading??Promise.resolve(),_;return{ready:K,async track(L){let S=(y)=>{J0.debug("cachekeep","tracking skipped",{session:L.sessionID,reason:y})};if(G.stopped)return S("lease-stopped");if(L.route!=="oauth")return S("not-oauth");if(L.agent==="cachekeep"||L.agent==="prime")return S("background-agent");if(L.kind!=="primary")return S("not-primary");let O=await Z.read();if(G.stopped)return S("lease-stopped");if(!p2(O.policyStorage)){for(let y of q.trackedSessions())q.untrack(y.id);return C.persistence.clear(),S("hybrid-inactive")}let b=!1;try{b=await $.isSubagent?.(L.sessionID)??!1}catch{return S("session-lookup-failed")}if(G.stopped)return S("lease-stopped");if(b&&!j0(O.policyStorage))return S("subagents-disabled");let w=O.accounts.find((y)=>y.id===L.accountId);if(!w?.accountIdentity)return S("account-identity-missing");if(L.provenance.kind==="local"&&JSON.stringify(w.binding)!==JSON.stringify(L.provenance.subject.binding))return S("local-binding-changed");if(L.provenance.kind==="vault"&&w.credentialId!==L.provenance.credentialId)return S("vault-credential-changed");let f=q.track({sessionId:L.sessionID,url:L.url,headers:new Headers,bodyText:L.bodyText,storage:O.policyStorage,cacheMode:"hybrid",oauthAccountId:L.accountId,oauthAccountIdentity:m2(w),isSubagent:b});return await T.publish(q.trackedSessions()),f},registry:T,dispose(){if(_)return _;G.stopped=!0,Y.abort();for(let[S,O]of C.prepared)if(O.lease===G)C.prepared.delete(S);let L=C.leases.delete(G.generation)&&C.leases.size===0;if(L)C.retain();return _=(async()=>{try{if(L)await C.ticking;await K,await Promise.all(G.inflight),await C.persistence.drain()}finally{if(L&&C.leases.size===0)await T.dispose()}})(),_}}}async function M1($,Z,Q){let Y=h2(Z),M=[],C=async(_,L,S)=>{let O=await $.session.hook(_,L,S);return M.push(O),O},q=new AbortController,T;try{T=await N0({session:{hook:C},event:$.event},Y.adapter,{logger:Z.log,gateOnPlaceholder:Q})}catch(_){throw Y.dispose(),await Promise.allSettled(M.map((L)=>L.dispose())),_}let H=(_)=>{Y.forgetSession(_),T.forgetSession(_)},G=$.event,B=G?(async()=>{try{for await(let _ of G.subscribe({signal:q.signal}))if(_.type==="session.deleted")H(_.data.sessionID)}catch(_){if(!q.signal.aborted)Z.log?.warn("stopped listening for session deletion",{error:_ instanceof Error?_.name:"unknown"})}})():Promise.resolve(),K;return{installation:T,forgetSession:H,dispose(){if(K)return K;return Y.dispose(),q.abort(),K=(async()=>{await T.dispose(),await B})(),K}}}import{effectiveRelayTransport as H1,getQuotaCheckIntervalMs as e4,logger as $$,nativeAccountCanServe as Z$,oauthProfileIsFresh as j$,quotaSnapshotCheckedAt as J$}from"@cortexkit/anthropic-auth-core";function N1($,Z){let Q=new AbortController,Y,M=!1,C=async()=>{let H=await $.read();if(Q.signal.throwIfAborted(),H.policyStorage.relay?.enabled===!0&&H1(H.policyStorage.relay.transport,H.policyStorage.relay.url)==="websocket")return;let G=H,B=e4(G.policyStorage);for(let K of G.accounts){if(Q.signal.aborted)return;if(!Z$(K)||K.type!=="oauth")continue;if(G.policyStorage.quota?.enabled!==!1&&Date.now()-J$(K.quota)>=B)await $.fetchQuota(K.id,Z,Q.signal,void 0,"background").catch(()=>{});if(!j$(K.profile)&&!Q.signal.aborted)await $.fetchProfile(K.id,Z,Q.signal).catch(()=>{})}},q=()=>{if(M||Y)return Y;return Y=C().catch(()=>{if(!Q.signal.aborted)$$.debug("opencode2","native background readings did not complete")}).finally(()=>{Y=void 0}),Y},T=$.vault.watch({intervalMs:60000,onRefresh:q,shouldRefresh:async()=>{let H=await $.read();return H.policyStorage.relay?.enabled!==!0||H1(H.policyStorage.relay.transport,H.policyStorage.relay.url)==="http"}});return T.ready.catch(()=>{}),{async dispose(){M=!0,T.close(),Q.abort(),await Y}}}import{authorize as H$,buildCacheKeepStatusSummary as N$,buildClaudeQuotaSummary as _$,buildPrimeAccountStatuses as L$,buildPrimeStatusSummary as F$,CLAUSTRUM_OPENCODE_ENROLLMENT_NAME as P$,effectiveRelayTransport as T$,exchange as C$,formatNativeAccountState as O$,formatOAuthAccountTier as E$,getCacheKeepWindow as q$,getHostClaustrumEnrollmentPaths as x$,isCacheKeepAlways as S$,isCacheKeepHybridActive as k$,isCacheKeepPersistentlyEnabled as R$,nativeAccountCanServe as b$,parseLogLevel as A$,resetClaustrumEnrollmentState as w$,setDumpEnabled as D$}from"@cortexkit/anthropic-auth-core";import{buildPrimeAccountStatuses as X$,effectiveRelayStatus as G$,formatNativeAccountState as Y$,formatOAuthAccountTier as _1,getCacheKeepWindow as V$,getRoutingMode as Q$,isCacheKeepAlways as W$,isCacheKeepHybridActive as U$,isPermanentRefreshError as B$,isPrimePersistentlyEnabled as z$,nativeAccountCanServe as P1,refreshBackoffActive as L1}from"@cortexkit/anthropic-auth-core";var F1=($)=>P1($)&&$.state!=="unsupported-access"?void 0:Y$($)||void 0,K$=($)=>{if($.source!=="vault")return"off";if($.state==="needs_reauth")return"on-vault-reauth";return P1($)?"on-vault-served":"on-cold"},M$=($,Z)=>typeof $==="number"&&$>Z;function T1($,Z){let{now:Q}=Z,Y=$.policyStorage,M=$.accounts.filter((B)=>B.type==="oauth"),C=M.find((B)=>B.id==="main"),q=C?F1(C):void 0,T=C?.lastQuotaRefreshError?.nextRetryAt,H=C?.lastRefreshError,G=V$(Y);return X0({main:{quota:C?.quota??null,enabled:C?.enabled,tierLabel:_1(C?.profile),quotaBackedOff:M$(T,Q),quotaBackoffUntil:T,refreshBackedOff:L1(H,C?.accountIdentity,Q,void 0),refreshBackoffUntil:H?.nextRetryAt,stateLine:q,quotaDated:Boolean(q)},fallbacks:M.filter((B)=>B.id!=="main"&&(B.enabled||B.source==="vault")).map((B)=>{let K=F1(B),_=K$(B);return{id:B.id,label:B.label,quota:B.quota??null,enabled:B.enabled,tierLabel:_1(B.profile),needsReauth:B$(B.lastRefreshError)&&L1(B.lastRefreshError,B.accountIdentity,Q,void 0),..._==="on-vault-reauth"?{vaultReauth:!0}:{},..._==="on-vault-served"?{vaultServed:!0}:{},..._!=="off"?{custodyState:_}:{},stateLine:K,quotaDated:Boolean(K)}}),...Z.activeId!==void 0&&{activeId:Z.activeId},route:Q$(Y),relay:G$(Y.relay),fastMode:Y.claudeFast?.enabled===!0,cacheKeep:{enabled:U$(Y),...W$(Y)?{window:"always"}:G&&{window:`${G.startHour}-${G.endHour}`},trackedSessions:Z.trackedSessions},prime:z$(Y)?{enabled:!0,accounts:X$(Y,{now:Q})}:void 0,lastUpdated:Q})}var E0=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{},C1=`For first-time model access, connect Anthropic with "${V0}".
+Run: opencode auth login anthropic --method ${Y0}`,I$="No Claude accounts in the vault for this host yet. Add one with `ck auth login --provider anthropic`, then grant it to this host.",O1="The vault returned an account this plugin cannot use yet.";async function y$($){let Z=new AbortController,Q;try{return await Promise.race([$.vault.refresh(Z.signal).then(()=>"complete",()=>"failed"),new Promise((Y)=>{Q=setTimeout(()=>{Y("pending"),Z.abort()},2000)})])}finally{clearTimeout(Q)}}var E1=($)=>$.mode==="local"&&!$.accounts.some((Z)=>Z.id==="main"),f$=($)=>{let Z=$.id==="main"?"main":"fallback",Q=`${$.enabled?"enabled":"disabled"}, ${$.type}, ${$.source}${$.state?`, ${O$($)}`:""}`;if($.label)return`${$.label} [${Z}]: ${Q}
+  Route: ${$.id}`;return`${Z==="main"?"Main account":`Fallback ${$.id}`}: ${Q}`};function q1($){let{runtime:Z,source:Q}=$,Y=new Map,M=!1,C=async(G,B)=>{await Z.updateSettings((K)=>({...K,[G]:{...E0(K[G]),...B}}))},q=()=>({ok:!0,text:"Native Claude settings updated."}),T=async(G,B)=>{if(M)throw Error("Native menu is closed");switch(B.signal?.throwIfAborted(),G.action){case"enable":case"disable":return await Z.setEnabled(G.values.id,G.action==="enable"),q();case"remove":return await Z.remove(G.values.id),q();case"move-up":case"move-down":{let _=(await Z.read()).accounts.map((w)=>w.id),L=_.indexOf(G.values.id),S=L+(G.action==="move-up"?-1:1);if(L<0||S<0||S>=_.length)return{ok:!1,text:"Account cannot move in that direction."};let O=_[L],b=_[S];if(O===void 0||b===void 0)return{ok:!1,text:"Account order changed."};return _[L]=b,_[S]=O,await Z.reorder(_),q()}case"add-apikey":return await Z.addApi(G.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let K=new AbortController;Y.get(G.sessionId)?.active.abort();let _={active:K,auth:void 0};Y.set(G.sessionId,_);let L=await H$("max");if(M||K.signal.aborted||B.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return _.auth=L,{ok:!0,text:`Open ${L.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let K=Y.get(G.sessionId);if(!K?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let _=await C$(G.values.code,K.auth.verifier,K.auth.redirectUri,K.auth.state);if(K.active.signal.throwIfAborted(),B.signal?.throwIfAborted(),M||_.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await Z.loginOAuth({routeId:crypto.randomUUID(),credential:{access:_.access,refresh:_.refresh,expires:_.expires},label:G.values.label}),K.active.signal.throwIfAborted(),B.signal?.throwIfAborted(),M)return{ok:!1,text:"Sign-in cancelled."};Y.delete(G.sessionId);let L="OAuth account stored in the native account pool.";return{ok:!0,text:E1(await Z.read())?`${L}
 
-${X1}
+${C1}
 
-Adding an account here does not change OpenCode's Anthropic connection.`:P}}case"reset-backoff":{let M=await X.read();for(let G of M.accounts){if(U.signal?.throwIfAborted(),G.type!=="oauth")continue;let P=G.source==="vault"?await X.authorizeVault(G.id,U.signal):await X.captureLocalSubject(G.id);await X.resetBackoff(G.id,P)}return C()}case"enrollment-reset":{let M=await lX(IX("opencode"),RX);return{ok:M==="reset",text:M==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":M==="refused-pending"?"An enrollment request may still be in progress. Quit OpenCode and run setup again; it picks up the same request.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let G=(await X.read()).accounts.filter((S)=>S.type==="oauth"&&hX(S)),P=await Promise.allSettled(G.map((S)=>X.fetchQuota(S.id,void 0,U.signal)));return{ok:P.every((S)=>S.status==="fulfilled"),text:`${P.filter((S)=>S.status==="fulfilled").length}/${G.length} native quota readings refreshed.`}}case"routing-reset":return await z.resetRouting(Y.sessionId),C();case"routing-mode":return await L("routing",{mode:Y.values.mode}),C();case"killswitch-on":case"killswitch-off":return await L("killswitch",{enabled:Y.action==="killswitch-on"}),C();case"killswitch-set":return await X.updateSettings((M)=>{let G=U$(M.killswitch),P={...U$(G.accounts)},R=G.main;for(let S of Y.values.entries){let D={five_hour:S.fh,seven_day:S.sd,...S.scoped!==void 0?{scoped:S.scoped}:{}};if(S.account==="main"||S.account==="all")R=D;if(S.account==="all")for(let l of Object.keys(P))P[l]=D;else if(S.account!=="main")P[S.account]=D}return{...M,killswitch:{...G,main:R,accounts:P}}}),C();case"cache-on":case"cache-off":return await L("claudeCache",{enabled:Y.action==="cache-on"}),C();case"cache-mode":return await L("claudeCache",{mode:Y.values.mode}),C();case"cachekeep-always":return await L("cacheKeep",{enabled:!0,always:!0}),C();case"cachekeep-off":return await L("cacheKeep",{enabled:!1}),C();case"cachekeep-window":return await L("cacheKeep",{enabled:!0,always:!1,startHour:Y.values.startHour,endHour:Y.values.endHour}),C();case"cachekeep-subagents":return await L("cacheKeep",{subagents:Y.values.enabled==="on"}),C();case"dump-on":case"dump-off":{let M=Y.action==="dump-on";await L("dump",{enabled:M});try{dX(M)}catch{}return C()}case"logging-level":{let M=mX(Y.values.level);if(!M)throw Error("Invalid log level");return await X.setLoggingLevel(M),C()}case"fast-on":case"fast-off":return await L("claudeFast",{enabled:Y.action==="fast-on"}),C();case"prime-on":case"prime-off":return await L("prime",{enabled:Y.action==="prime-on"}),C();case"start-fire":return await K(Y.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},K=(Y)=>$.start(Y,r2);return{dispatch:T,async readStatus(Y){let U=await X.read();if(Y==="account"){let G="No native Claude accounts.",P=[];if(U.mode==="claustrum"){let S=U.policyStorage.relay;if(S?.enabled===!0&&kX(S.transport,S.url)==="websocket")return new O2().message;let D=await pX(X);if(U=await X.read(),U.mode==="claustrum"){let l=await X.vault.read();if(D==="complete"&&!l?.view)D="failed";if(G=D==="complete"?uX:"No saved Claude accounts for this host yet.",l?.rejected?.length){if(G=Z1,U.accounts.length)P.push(Z1)}if(D==="pending")P.push("Vault account lookup is still running.");else if(D==="failed")P.push("Vault account lookup did not complete; reopen /claude to retry.")}}let R=[U.accounts.map(cX).join(`
-`)||G,...P].join(`
-`);return J1(U)?`${R}
+Adding an account here does not change OpenCode's Anthropic connection.`:L}}case"reset-backoff":{let K=await Z.read();for(let _ of K.accounts){if(B.signal?.throwIfAborted(),_.type!=="oauth")continue;let L=_.source==="vault"?await Z.authorizeVault(_.id,B.signal):await Z.captureLocalSubject(_.id);await Z.resetBackoff(_.id,L)}return q()}case"enrollment-reset":{let K=await w$(x$("opencode"),P$);return{ok:K==="reset",text:K==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":K==="refused-pending"?"An enrollment request may still be in progress. Quit OpenCode and run setup again; it picks up the same request.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let _=(await Z.read()).accounts.filter((O)=>O.type==="oauth"&&b$(O)),L=await Promise.allSettled(_.map((O)=>Z.fetchQuota(O.id,void 0,B.signal)));return{ok:L.every((O)=>O.status==="fulfilled"),text:`${L.filter((O)=>O.status==="fulfilled").length}/${_.length} native quota readings refreshed.`}}case"routing-reset":return await Q.resetRouting(G.sessionId),q();case"routing-mode":return await C("routing",{mode:G.values.mode}),q();case"killswitch-on":case"killswitch-off":return await C("killswitch",{enabled:G.action==="killswitch-on"}),q();case"killswitch-set":return await Z.updateSettings((K)=>{let _=E0(K.killswitch),L={...E0(_.accounts)},S=_.main;for(let O of G.values.entries){let b={five_hour:O.fh,seven_day:O.sd,...O.scoped!==void 0?{scoped:O.scoped}:{}};if(O.account==="main"||O.account==="all")S=b;if(O.account==="all")for(let w of Object.keys(L))L[w]=b;else if(O.account!=="main")L[O.account]=b}return{...K,killswitch:{..._,main:S,accounts:L}}}),q();case"cache-on":case"cache-off":return await C("claudeCache",{enabled:G.action==="cache-on"}),q();case"cache-mode":return await C("claudeCache",{mode:G.values.mode}),q();case"cachekeep-always":return await C("cacheKeep",{enabled:!0,always:!0}),q();case"cachekeep-off":return await C("cacheKeep",{enabled:!1}),q();case"cachekeep-window":return await C("cacheKeep",{enabled:!0,always:!1,startHour:G.values.startHour,endHour:G.values.endHour}),q();case"cachekeep-subagents":return await C("cacheKeep",{subagents:G.values.enabled==="on"}),q();case"dump-on":case"dump-off":{let K=G.action==="dump-on";await C("dump",{enabled:K});try{D$(K)}catch{}return q()}case"logging-level":{let K=A$(G.values.level);if(!K)throw Error("Invalid log level");return await Z.setLoggingLevel(K),q()}case"fast-on":case"fast-off":return await C("claudeFast",{enabled:G.action==="fast-on"}),q();case"prime-on":case"prime-off":return await C("prime",{enabled:G.action==="prime-on"}),q();case"start-fire":return await H(G.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},H=(G)=>$.start(G,G0);return{dispatch:T,async readStatus(G){let B=await Z.read();if(G==="account"){let _="No native Claude accounts.",L=[];if(B.mode==="claustrum"){let O=B.policyStorage.relay;if(O?.enabled===!0&&T$(O.transport,O.url)==="websocket")return new b2().message;let b=await y$(Z);if(B=await Z.read(),B.mode==="claustrum"){let w=await Z.vault.read();if(b==="complete"&&!w?.view)b="failed";if(_=b==="complete"?I$:"No saved Claude accounts for this host yet.",w?.rejected?.length){if(_=O1,B.accounts.length)L.push(O1)}if(b==="pending")L.push("Vault account lookup is still running.");else if(b==="failed")L.push("Vault account lookup did not complete; reopen /claude to retry.")}}let S=[B.accounts.map(f$).join(`
+`)||_,...L].join(`
+`);return E1(B)?`${S}
 
-${X1}
-Quota refresh checks the pool; it does not check OpenCode's Anthropic connection.`:R}if(Y==="quota")return qX({accounts:U.accounts.filter((G)=>G.type==="oauth").map((G)=>({name:G.label??G.id,role:G.id==="main"?"main":"fallback",enabled:G.enabled,quota:G.quota,tierLabel:DX(G.profile),lastRefreshedAt:G.lastRefreshedAt,error:G.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(Y==="prime")return AX({enabled:U.policyStorage.prime?.enabled===!0,accounts:xX(U.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");if(Y==="cachekeep"){let G=await $.cacheKeepRegistry?.list()??[];return SX({enabled:gX(U.policyStorage),always:vX(U.policyStorage),hybridActive:fX(U.policyStorage),trackedSessionDetails:G,window:yX(U.policyStorage),trackedSessions:G.length,nextPrewarmAt:G.length?Math.min(...G.map((P)=>P.nextPrewarmAt)):void 0})}let M={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(U.settings[M[Y]]??{})},async readSidebar(Y){let[U,M]=await Promise.all([X.read(),$.cacheKeepRegistry?.list()??[]]);return o2($1(U,{activeId:z.servedAccount(Y),trackedSessions:M.length,now:Date.now()}))},forgetSession(Y){W.get(Y)?.active.abort(),W.delete(Y)},close(){F=!0;for(let Y of W.values())Y.active.abort();W.clear()}}}import{resolveClaudeModelCapabilities as iX}from"@cortexkit/anthropic-auth-core";function G1(){let $=new Map;return{install:(z)=>z.model.transform((W)=>{$.clear();for(let F of W.list("anthropic")){$.set(String(F.id),String(F.modelID));let L=iX(F.modelID)?.efforts.variants;if(!L)continue;W.update("anthropic",String(F.id),(C)=>{let T=C.variants.filter((K)=>!L.some((Y)=>Y===String(K.id)));C.variants=[...T,...L.map((K)=>({id:K,settings:{effort:K,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(z)=>$.get(z)??z}}function j1($){return $.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??$.get("x-api-key")??void 0}import{buildPrimeRequestBody as V1,effectiveRelayTransport as Q1,nativeAccountCanServe as oX,PrimeManager as rX,tokenFingerprint as W1}from"@cortexkit/anthropic-auth-core";var B1=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{};function z1($){let{runtime:X,source:z}=$,W=new AbortController,F=new Set,L=(K)=>({providerID:"anthropic",modelID:V1().model,sessionID:`oc2-prime:${K}`,agent:"prime",kind:"generate"}),C=async(K)=>{let Y=L(K),U=y2({source:z}),M=performance.now();try{for(let G=0;G<3;G++){if(W.signal.throwIfAborted(),(await X.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let R=await U.adapter.accountHeaders({...Y,accountId:K});if(!("headers"in R)||typeof R.headers!=="object"||R.headers===null||typeof R.attempt!=="object"||R.attempt===null)throw Error("Native Prime authorization refused");let S={...Y,accountId:K,attemptId:crypto.randomUUID(),transport:"http",data:R.attempt},D,l=!1,v=!1,n=(t)=>{v=!0,t.body?.cancel().catch(()=>{})};try{let t=await U.adapter.rewriteRequest?.({...Y,accountId:K,attempt:S,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(V1()),signal:W.signal})});if(!t)throw Error("Native Prime rewrite refused");let a=new Headers(t.headers);for(let[k,y]of Object.entries(R.headers))if(y===null)a.delete(k);else a.set(k,y);let M2=new Request(t,{headers:a}),W2=await($.fetch??fetch)(M2),J=await U.adapter.rewriteResponse?.({...Y,accountId:K,request:M2,response:W2,attempt:S})??W2;D=J.status,U.adapter.quotaFromHeaders?.(J.headers,J.status,S);let Q=J.ok?void 0:await U.adapter.limitFromResponse?.({status:J.status,headers:J.headers,body:()=>J.clone().text(),attempt:S});if(Q&&/^(vault-newer|local-newer|relay-direct):/.test(Q.reason)&&G<2){n(J);let k={...Y,phase:"retry",rerouteFrom:{accountId:K,limit:Q}};if(await z.chooseAccount(k)!==K)throw Error("Native Prime retry changed account");continue}if(!J.ok)return n(J),{ok:!1,status:D,ms:performance.now()-M,error:"Native Prime upstream refused the request"};let B=B1(await J.json()),E=B1(B.usage),b={inputTokens:typeof E.input_tokens==="number"?E.input_tokens:void 0,outputTokens:typeof E.output_tokens==="number"?E.output_tokens:void 0};if(S.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(J.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(l=await z.recordPrime(R.attempt.provenance,b),!l)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:D,ms:performance.now()-M,usage:b}}finally{await U.adapter.onAttemptEnd?.(S,{status:D,outputStarted:!1,...l?{}:{error:{reason:v?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-M}}finally{U.dispose()}},T=new rX({storagePath:$.paths.legacyConfig,loadStorage:async()=>(await X.read()).policyStorage,async getAccountFingerprint(K){let Y=await X.read(),U=Y.accounts.find((P)=>P.id===K);if(!oX(U)||U?.type!=="oauth")return;if(Y.policyStorage.relay?.enabled===!0&&Q1(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")return;if(U.source==="vault"){let P=await X.authorizeVault(K,W.signal),R=await X.getOrCreateAuthLineage(K,P);return R?W1(R):void 0}let M=await X.authorizeLocal(K,{signal:W.signal});if(M.status!=="usable")return;let G=await X.getOrCreateAuthLineage(K,M.subject);return G?W1(G):void 0},async refreshQuota(K){let Y=await X.read();if(Y.policyStorage.relay?.enabled===!0&&Q1(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await X.fetchQuota(K,$.fetch,W.signal),fresh:!0}},sendPrime(K){let Y=C(K);return F.add(Y),Y.finally(()=>F.delete(Y)),Y},async recordSuccess(K){let Y=(await X.read()).accounts.find((U)=>U.id===K);if(!Y?.prime)throw Error("Native Prime counters are unavailable");return Y.prime}});return T.start(),{manager:T,async dispose(){T.stop(),W.abort(),await Promise.allSettled(F)}}}import{createNativeUsagePublisher as nX,decideStickyQuotaFailure as sX,effectiveRelayTransport as aX,getClaudeCodeIdentityForVerifiedAccount as a2,getQuotaCheckIntervalMs as tX,getRoutingMode as H$,isDumpPersistentlyEnabled as U1,isQuotaBearingHeaderFrame as eX,logger as $Z,mergeHeaderQuotaForPersistence as XZ,NativeVaultNoAccountError as ZZ,nativeAccountCanServe as I2,nativeAccountPolicy as t2,nativeLocalAccountRefusal as JZ,nativeLocalQuotaLineage as YZ,nativePollQuotaGenerallyExhausted as GZ,normalizeQuotaHeaders as jZ,quotaSnapshotCheckedAt as K1,quotaSnapshotHasStandardWindows as VZ,readNativeAccountsForRequest as QZ,remapModelId as K$,StickySessionRouter as WZ,setDumpEnabled as BZ,shouldFallbackStatus as zZ,stickyQuotaSnapshotIsFresh as h2,stickyRetryAfterWithJitter as UZ,stickyRouteFamilyForModel as KZ}from"@cortexkit/anthropic-auth-core";var M$=($)=>["five_hour","seven_day"].some((X)=>($?.[X]?.remainingPercent??1)<=0);function MZ($,X,z,W){let F=$.rerouteFrom;if($.phase!=="retry"||F?.limit.status!==429||H$(X.policyStorage)!=="sticky-balanced")return;let L=z.find((T)=>T.id===F.accountId);if(!L||!h2(L.quota,X.policyStorage,Date.now(),W))return;let C=sX({quota:L.quota,modelId:W});if(C.action!=="hold")return;return{hold:{delayMs:UZ($.sessionID,C.retryAfterSeconds)*1000}}}function H1($){let{runtime:X}=$,z=nX("native-auth"),W=new Map,F=(J)=>{let Q=J.routingPath;if(!Q)throw Error("Native routing storage is unavailable");let B=W.get(Q);if(!B)B=new WZ({path:Q,vaultSeed:J.routingSeed,onLockEvent:X.onLockEvent,relocationGuard:X.relocationGuard,localRecoveryPath:J.mode==="local"?J.routingRecoveryPath:void 0}),W.set(Q,B);return B.setVaultSeed(J.routingSeed),B},L=new WeakMap,C=new Map,T=new Map,K=new Map,Y=new Map,U=new WeakSet,M=!1,G=()=>{while(C.size>512){let J=C.keys().next();if(!J.done)C.delete(J.value)}},P=(J)=>{try{BZ(U1(J.policyStorage))}catch{}},R=async()=>{try{let J=await X.read();return P(J),U1(J.policyStorage)}catch{return!1}},S=(J,Q)=>JSON.stringify([J.sessionID,J.kind,J.modelID,Q]),D=(J)=>{if(M)throw Error("Native Anthropic source is closed");let Q=K.get(J.sessionID);if(!Q){Q=new AbortController,K.set(J.sessionID,Q);while(K.size>512){let B=K.keys().next();if(!B.done)W2.forgetSession?.(B.value)}}return Q},l=(J,Q,B)=>I2(J)&&(J.type==="api"||t2(J,Q,K$(B)).status==="allowed"),v=async(J,Q,B,E,b)=>{let k=await X.read();P(k),E.signal.throwIfAborted(),n(k);let y=k.accounts.find((m)=>m.id===J);if(!y||y.type!==B||!l(y,k,Q))return b?.(!y||!I2(y)?"account-unavailable":"account-policy"),!1;if(B==="api"){let m=k.accounts.find((i)=>i.id==="main"&&i.type==="oauth");return!!m&&h2(m.quota,k.policyStorage)&&M$(m.quota)}return!0},n=(J)=>{let Q=J.policyStorage.relay;if(Q?.enabled===!0&&aX(Q.transport,Q.url)==="websocket")throw new O2},t=async(J,Q)=>{if(n(J),Q||J.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let B=await X.getRelayConfig();if(!B)throw Error("request refused: native HTTP relay configuration is unavailable");if(B.transport!=="http")throw new O2;return{dispatch:{kind:"http-relay",url:B.url,token:B.token},relayFallback:B.fallbackToDirect}};async function a(J,Q,B){if(J.kind==="local"){let E=await X.publishLocal(J.subject,B);if(!E&&B.quota)$Z.warn("quota","Quota publication discarded");return E}if(J.kind==="vault"&&Q.receipt)await X.vault.publish(Q.receipt,B);else if(J.kind==="api"&&B.lastUsed!==void 0)await X.publishApi(J.subject,{lastUsed:B.lastUsed});return!0}function M2(J,Q,B){if(J.kind!=="local")return;let E=J.subject.binding,b=K1(B),k={lineage:YZ(E),accountUuid:E.identity,entry:{quota:B,checkedAt:b,refreshAfter:b},generalExhausted:GZ(B),routeBeforeSave:!0};return X.quotaObservations.hold(Q.account.id,k)?k:void 0}let W2={async chooseAccount(J){let Q=D(J);$.onOwnedRequest?.();let B=await X.read();P(B),Q.signal.throwIfAborted(),n(B);let E=K$(await $.resolveModelId?.(J)??J.modelID);if(Q.signal.throwIfAborted(),B.mode==="claustrum")B=await QZ(X,Q.signal),Q.signal.throwIfAborted();if(B.policyStorage.quota?.enabled!==!1){let g=!1;for(let d of B.accounts){if(!I2(d)||d.type!=="oauth")continue;if(VZ(d.quota)?h2(d.quota,B.policyStorage,Date.now(),E):Date.now()-K1(d.quota)<tX(B.policyStorage))continue;try{await X.fetchQuota(d.id,$.fetch,Q.signal,void 0,"admission"),g=!0}catch{Q.signal.throwIfAborted()}}if(g)B=await X.read();Q.signal.throwIfAborted()}let b=J.rerouteFrom?C.get(J.rerouteFrom.limit.reason):void 0;if(J.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(J.rerouteFrom.limit.reason)&&!b)return;if(b&&J.rerouteFrom){let g=B.accounts.find((J2)=>J2.id===b.accountId);if(!g||!l(g,B,E))return;C.delete(J.rerouteFrom.limit.reason);let d=S(J,b.accountId),p=T.get(d)??[];return p.push(b),T.set(d,p),b.accountId}let k=[];for(let g of B.accounts){if(g.type!=="oauth"||!l(g,B,E))continue;if(g.source==="local"){let d=await X.authorizeLocal(g.id,{signal:Q.signal,policy:(p,J2)=>t2(p,J2,E)});if(Q.signal.throwIfAborted(),d.status!=="usable")continue}k.push(g)}let y=MZ(J,B,k,E);if(y)return y;let m=k.filter((g)=>g.id!==J.rerouteFrom?.accountId);if(H$(B.policyStorage)==="sticky-balanced"){let g=m.map((p,J2)=>({accountId:p.id,order:J2,quota:p.quota??{kind:"unknown"}})),d=await F(B).resolve({sessionId:J.sessionID,family:KZ(E),modelId:E,affinityModelId:J.modelID,candidates:g,retainAccountIds:new Set(m.map((p)=>p.id)),...B.mode==="claustrum"?{accountIdentities:new Map(B.accounts.flatMap((p)=>p.accountIdentity?[[p.id,p.accountIdentity]]:[]))}:{},storage:B.policyStorage,inputBytes:1,preferredAccountId:J.previousAccountId,preserveOnNoCandidate:!0});if(Q.signal.throwIfAborted(),d)return d.accountId}else{let d=H$(B.policyStorage)==="fallback-first"?[...m.filter((p)=>p.id!=="main"),...m.filter((p)=>p.id==="main")]:[...m.filter((p)=>p.id==="main"),...m.filter((p)=>p.id!=="main")];if(d[0])return d[0].id}if(B.mode==="claustrum")throw new ZZ;let i=B.accounts.find((g)=>g.id==="main"&&g.type==="oauth");if(!i)return;let $2=i.quota;if(J.rerouteFrom?.limit.status===429||!h2($2,B.policyStorage))try{$2=await X.fetchQuota("main",$.fetch,Q.signal)}catch{return}if(Q.signal.throwIfAborted(),!M$($2))return;return B.accounts.find((g)=>g.type==="api"&&I2(g)&&g.id!==J.rerouteFrom?.accountId)?.id},dropChoice(J){let Q=S(J,J.accountId),B=T.get(Q);if(B?.shift(),B?.length===0)T.delete(Q)},async authorizeAccount(J,Q,B){let E=D(J),b=await X.read();P(b),E.signal.throwIfAborted(),n(b);let k=K$(await $.resolveModelId?.(J)??J.modelID);E.signal.throwIfAborted();let y=b.accounts.find((o)=>o.id===Q);if(!y||!l(y,b,k)){B?.(!y||!I2(y)?"account-unavailable":"account-policy");return}let m=S(J,Q),i=T.get(m),$2=i?.shift();if(i?.length===0)T.delete(m);let{dispatch:g,relayFallback:d}=await t(b,$2?.direct===!0);if(E.signal.throwIfAborted(),$2?.auth){if(!await v(Q,k,$2.auth.route,E,B))return;let o=L.get($2.auth.provenance);if(o?.receipt?.expiresAtMs!==void 0&&o.receipt.expiresAtMs!==null&&o.receipt.expiresAtMs<Date.now()+300000)return;if(o)L.set($2.auth.provenance,{...o,scope:{...J,modelID:k},account:y,active:E,relayFallback:d});return Y.set(J.sessionID,Q),{...$2.auth,dispatch:g}}let p={scope:{...J,modelID:k},active:E,account:y,retry:$2?.retry??!1,relayFallback:d,quota:y.quota};if(y.type==="api"){let o=b.accounts.find((A)=>A.id==="main"&&A.type==="oauth");if(!o||!h2(o.quota,b.policyStorage)||!M$(o.quota))return;let V=await X.authorizeApi(Q,E.signal);if(E.signal.throwIfAborted(),!await v(Q,k,"api",E))return;let H={kind:"api",subject:V.subject};return L.set(H,p),Y.set(J.sessionID,Q),{route:"api",headers:V.authHeader==="authorization-bearer"?{authorization:`Bearer ${V.apiKey}`}:{"x-api-key":V.apiKey},baseURL:V.baseURL,provenance:H,dispatch:g}}if(y.source==="vault"){let o=await X.authorizeVault(Q,E.signal);if(E.signal.throwIfAborted(),!await v(Q,k,"oauth",E,B))return;let V={kind:"vault",credentialId:o.credentialId,recordVersion:o.recordVersion};L.set(V,{...p,receipt:o});let H=o.assertedAccountIdentity;if(!H){B?.("account-unavailable");return}return Y.set(J.sessionID,Q),{route:"oauth",accessToken:o.accessToken,provenance:V,dispatch:g,identity:a2(H,H)}}let J2=await X.authorizeLocal(Q,{signal:E.signal,policy:(o,V)=>t2(o,V,k)});if(E.signal.throwIfAborted(),J2.status!=="usable"){let o=JZ(J2);if(o)B?.(o.reason);return}if(!await v(Q,k,"oauth",E,B))return;let P2={kind:"local",subject:J2.subject};L.set(P2,{...p,access:J2.access}),Y.set(J.sessionID,Q);let k2=J2.subject.binding.identity;return{route:"oauth",accessToken:J2.access,provenance:P2,dispatch:g,identity:a2(k2,k2)}},async requestOptions(J,Q){let B=D(J),E=await X.read();P(E),B.signal.throwIfAborted();let b=E.accounts.find((y)=>y.id===J.accountId);if(!b||!l(b,E,J.modelID))throw Q?.(!b||!I2(b)?"account-unavailable":"account-policy"),Error("request refused: native account is ineligible for this model");let k=L.get(J.provenance);if(k)L.set(J.provenance,{...k,scope:{...k.scope,modelID:J.modelID}});return $.requestOptions(J,E)},async admitRequest(J,Q){let B=L.get(J.provenance);if(!B||!await v(J.accountId,J.modelID,J.route,B.active,Q))throw Error("request refused: native account policy changed before dispatch");L.set(J.provenance,{...B,scope:{...B.scope,modelID:J.modelID}})},isDumpEnabled:()=>R(),onRequestPrepared:(J)=>$.onRequestPrepared?.(J),responseOptions(J){return $.responseOptions?.({...J,modelID:L.get(J.provenance)?.scope.modelID??J.modelID})},quotaFromHeaders(J,Q){let B=L.get(Q.provenance),E=M1(J);if(E)$.onRequestId?.(Q,E);if(!B||Q.route!=="oauth"||!eX(J))return;let b=Q.provenance.kind==="local"?Q.provenance.subject.binding.identity:B.receipt?.assertedAccountIdentity,k={...jZ(J),...b?{accountIdentity:b}:{}},y=XZ(B.quota,k);B.quota=y;let m=M2(Q.provenance,B,y),i=B.account.id,$2=()=>{if(m)X.quotaObservations.forget(i,m)};return z.observe(a(Q.provenance,B,{quota:y}).then((g)=>{if(!g)$2()},(g)=>{throw $2(),g})),k},async limitFromResponse(J){let Q=L.get(J.provenance);if(!Q)return;if(J.status===401&&Q.receipt){if(!U.has(Q.receipt))U.add(Q.receipt),await X.vault.reportFailure(Q.receipt,401,J.dispatch==="http-relay"?"relay_status_field":"direct");if(Q.retry||Q.active.signal.aborted)return;let E=Q.active,b=await X.vault.prepareRetry(Q.receipt,E.signal);if(E.signal.throwIfAborted(),!b.retry)return;let k=b.receipt,y=k.assertedAccountIdentity;if(!y)return;let m={kind:"vault",credentialId:k.credentialId,recordVersion:k.recordVersion};L.set(m,{...Q,receipt:k,retry:!0});let i=`vault-newer:${J.attemptId}`;return C.set(i,{sessionID:J.sessionID,accountId:J.accountId,retry:!0,auth:{route:"oauth",accessToken:k.accessToken,provenance:m,identity:a2(y,y)}}),G(),{reason:i,status:401}}if(J.status===401&&J.provenance.kind==="local"&&Q.access&&!Q.retry){if(Q.active.signal.aborted)return;let E=Q.active,b=await X.authorizeLocal(J.accountId,{rejectedAccessToken:Q.access,signal:E.signal,policy:(i,$2)=>t2(i,$2,Q.scope.modelID)});if(E.signal.throwIfAborted(),b.status!=="usable"||b.access===Q.access)return;let k={kind:"local",subject:b.subject};L.set(k,{...Q,access:b.access,retry:!0});let y=b.subject.binding.identity,m=`local-newer:${J.attemptId}`;return C.set(m,{sessionID:J.sessionID,accountId:J.accountId,retry:!0,auth:{route:"oauth",accessToken:b.access,provenance:k,identity:a2(y,y)}}),G(),{reason:m,status:401}}let B=await X.read();if(zZ(J.status,B.policyStorage))return{reason:`provider-${J.status}`,status:J.status};return},limitFromRelayFailure(J){let Q=L.get(J.provenance);if(!Q?.relayFallback||Q.active.signal.aborted||!(J.status===401||J.status>=500))return;let B=`relay-direct:${J.attemptId}`;return C.set(B,{sessionID:J.sessionID,accountId:J.accountId,direct:!0,retry:!1}),G(),{reason:B}},limitFromStreamError(J){return J.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(J,Q){let B=L.get(Q.provenance);if(Q.dispatch==="http-relay"&&B?.relayFallback&&!B.active.signal.aborted&&J.status===void 0){let E=`relay-direct:${Q.attemptId}`;return C.set(E,{sessionID:Q.sessionID,accountId:Q.accountId,direct:!0,retry:!1}),G(),{reason:E}}return},async onAttemptEnd(J,Q){let B=L.get(J.provenance);if(!B)return;try{if(Q.status===401&&B.receipt&&!U.has(B.receipt))U.add(B.receipt),await X.vault.reportFailure(B.receipt,401,J.dispatch==="http-relay"?"relay_status_field":"direct");if(!Q.localRefusal&&Q.status!==void 0)z.publish(()=>a(J.provenance,B,{lastUsed:Date.now()}))}finally{L.delete(J.provenance)}},forgetSession(J){K.get(J)?.abort(),K.delete(J),Y.delete(J);for(let[Q,B]of C)if(B.sessionID===J)C.delete(Q);for(let[Q,B]of T)if(B[0]?.sessionID===J)T.delete(Q);$.onForgetSession?.(J)},servedAccount:(J)=>Y.get(J),resetRouting:async(J)=>F(await X.read()).clear(J),async recordPrime(J,Q){let B=L.get(J);if(!B||B.active.signal.aborted)return!1;if(J.kind==="local")return X.incrementPrimeUsage(B.account.id,J.subject,Q);if(J.kind==="vault"&&B.receipt)return X.incrementPrimeUsage(B.account.id,B.receipt,Q);return!1},drainRoutingPublications:()=>Promise.all([X.drainRoutingPublications(),...[...W.values()].map((J)=>J.drain())]).then(()=>{}),close(){M=!0;for(let J of K.values())J.abort();return K.clear(),T.clear(),C.clear(),Promise.all([z.drain(),W2.drainRoutingPublications()]).then(()=>{})}};return W2}import{remapModelId as HZ}from"@cortexkit/anthropic-auth-core";function L1(){let $=new _1,X=new Map,z=new Map,W=new Map,F=new Set,L=new Set,C=new Map,T=(K)=>{while(K.size>512){let Y=K.keys().next();if(!Y.done)K.delete(Y.value)}};return{async install(K){let Y=[];try{Y.push(await K.session.hook("context",(U)=>{let M=U.messages.map((P)=>{return{info:{id:P.id,sessionID:U.sessionID,role:P.role,agent:U.agent,model:{providerID:U.model.providerID,modelID:U.model.id}},parts:P.content.map((R)=>({type:R.type,...R.type==="text"?{text:R.text}:{}}))}});$.observeMessages(M);let G=U.messages.findLast((P)=>P.role==="user"&&P.id);if(G?.id)X.set(U.sessionID,G.id);if(G?.content.some((P)=>P.type==="text"&&P.text===r2))F.add(U.sessionID);else F.delete(U.sessionID);T(X)},{providerID:"anthropic"})),Y.push(await K.session.hook("model.request",(U)=>{if(U.kind!=="primary")return;let M=X.get(U.sessionID);if(!M)return;if($.markHeaders({sessionId:U.sessionID,messageId:M,agent:U.agent,headers:U.headers}),F.has(U.sessionID))U.headers[R2]="1"},{providerID:"anthropic"}))}catch(U){throw await Promise.allSettled(Y.map((M)=>M.dispose())),U}return{dispose:async()=>{await Promise.all(Y.map((U)=>U.dispose()))}}},requestOptions(K,Y){let U=$.resolveHeader(K.correlation[c2]);if(U)z.set(K.attemptId,U),T(z);C.set(K.attemptId,K.sessionID),T(C);let M=K.correlation[R2]==="1";if(M)L.add(K.attemptId);return{cache1hEnabled:K.agent!=="compaction"&&K.agent!=="title"&&(Y.policyStorage.claudeCache?.enabled??!0),cache1hMode:Y.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:Y.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:Y.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,turnEndNoteEnabled:!0,turnEndNote:Y.policyStorage.turnEndNote,serverSideFallbackEnabled:N1(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:M,billingLineage:U?{promptId:U.promptId,previousRequestId:U.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:W.get(K.sessionID)}},responseOptions(K){return{serverSideFallbackModel:HZ(K.modelID),laneStart:L.has(K.attemptId),onMessageStart(Y){if(K.kind==="primary"&&typeof Y.id==="string")W.set(K.sessionID,Y.id),T(W)},onStreamEnd(){z.delete(K.attemptId),L.delete(K.attemptId),C.delete(K.attemptId)}}},onRequestId(K,Y){$.commit(z.get(K.attemptId),Y)},forgetSession(K){$.clearSession(K),X.delete(K),W.delete(K),F.delete(K);for(let[Y,U]of C)if(U===K)z.delete(Y),L.delete(Y),C.delete(Y)}}}var e2="cortexkit-anthropic-auth",DZ='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',yZ="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",IZ="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function vZ($){let X=$.authorize??LZ,z=$.exchange??CZ,W=()=>{if(!$.isActive())throw Error("Claude authentication setup is closed")},F=async()=>{let T;try{T=await $.readMode()}catch{throw Error(IZ)}return W(),T},L=async()=>{if(await F()!=="local")throw Error(DZ)};return{integrationID:"anthropic",methods:[{method:{id:n2,type:"oauth",label:s2},async authorize(){W(),await L();let T=await X("max");return W(),{mode:"code",url:T.url,instructions:"Paste the authorization code returned by Claude.",callback:async(K)=>{W();let Y=await z(K,T.verifier,T.redirectUri,T.state);if(!$.isActive()||Y.type!=="success")throw Error("Claude sign-in did not complete");return{access:Y.access,refresh:Y.refresh,expires:Y.expires}}}}}],vault:{method:{id:F1,type:"oauth",label:"Claude vault accounts"},async activate(){if(W(),await F()!=="claustrum")throw Error(yZ)}},async onLogin(T){W(),await L(),await $.runtime.loginOAuth({routeId:"main",credential:T,replace:!0}),W()},label:"Claude native account pool"}}function fZ($){return{readMode:()=>qZ("opencode",$),disconnectVault:()=>TZ({host:"opencode",env:$})}}function N$($={}){return{id:e2,setup:(X)=>T1(X,$)}}async function gZ($){try{return await mZ($)}catch(X){throw hZ(X)}}function hZ($){let X=i2($);if(X)return X;let z=bZ("decide where its account state is",[],$);return _$.error("state-layout",z.message,{code:z.code}),i2(z)??z}async function mZ($){if($.paths){let z=$.paths;return await NZ(z),{paths:z,holderRegistration:await xZ({paths:z,role:"opencode2",kind:SZ(),policy:wZ(),onLockEvent:$.local?.onLockEvent})}}let X=await PZ({role:"opencode2",onLockEvent:$.local?.onLockEvent});return{paths:await AZ(void 0,void 0,X.layout),holderRegistration:X.kind==="state-home"?void 0:X.registration}}async function T1($,X={}){let{paths:z,holderRegistration:W}=await gZ(X),F=_Z({paths:z,host:"opencode",local:X.local,vault:X.vault}),L=fZ(X.vault?.env??process.env);try{let v=await F.read();if(!process.env.OPENCODE_ANTHROPIC_AUTH_LOG_LEVEL)kZ(OZ(v.policyStorage)??"info");RZ(EZ(v.policyStorage))}catch{}let C=!0,T=L1(),K=G1(),Y,U,M,G=H1({runtime:F,paths:z,fetch:X.fetch,requestOptions:T.requestOptions,responseOptions:T.responseOptions,onRequestId:T.onRequestId,onForgetSession:T.forgetSession,onRequestPrepared:async(v)=>{try{await M?.track(v)}catch{_$.warn("cachekeep","live request tracking failed")}},resolveModelId:async(v)=>K.modelId(v.modelID),onOwnedRequest:()=>{Y??=n$(F,X.fetch),U??=z1({runtime:F,paths:z,source:G,fetch:X.fetch})}});M=i$({...X.cacheKeep,runtime:F,source:G,storageId:z.storageId,fetch:X.fetch,isSubagent:async(v)=>Boolean((await $.session.get({sessionID:v})).parentID)});let P=Y1({runtime:F,source:G,cacheKeepRegistry:M.registry,start:async(v,n)=>{await $.session.synthetic({sessionID:v,text:n,description:"Claude lane start",resume:!0})}}),R=[],S=await o$($,{source:G,log:{warn:(v,n)=>_$.warn("opencode2",v,n)}},{credential:j1}).catch(async(v)=>{throw W?.close(),P.close(),await M?.dispose(),await G.close(),await F.drainQuotaPublications(),await F.close(),v}),D,l=()=>{if(D)return D;return C=!1,W?.close(),P.close(),G.close(),D=(async()=>{await Promise.allSettled([S.dispose(),Y?.dispose(),U?.dispose(),M?.dispose(),...R.map((v)=>v.dispose())]),await G.close(),await F.drainQuotaPublications(),await F.close()})(),D};try{R.push(await T.install($)),R.push(await K.install($)),R.push(await J$($,vZ({isActive:()=>C,readMode:L.readMode,runtime:F})));let v={host:"opencode",dispatch:P.dispatch,readStatus:(t)=>P.readStatus(t),readAccounts:()=>F.read(),readMode:L.readMode,disconnectVault:L.disconnectVault,interactive:!0},n=FZ(v);return R.push(await P1($,n,P)),l}catch(v){throw await l(),v}}var Q4={id:e2,setup:N$().setup,server:C1};export{T1 as setupAnthropicAuth,Q4 as default,N$ as createAnthropicAuthPlugin,e2 as ANTHROPIC_AUTH_PLUGIN_ID};
+${C1}
+Quota refresh checks the pool; it does not check OpenCode's Anthropic connection.`:S}if(G==="quota")return _$({accounts:B.accounts.filter((_)=>_.type==="oauth").map((_)=>({name:_.label??_.id,role:_.id==="main"?"main":"fallback",enabled:_.enabled,quota:_.quota,tierLabel:E$(_.profile),lastRefreshedAt:_.lastRefreshedAt,error:_.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(G==="prime")return F$({enabled:B.policyStorage.prime?.enabled===!0,accounts:L$(B.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");if(G==="cachekeep"){let _=await $.cacheKeepRegistry?.list()??[];return N$({enabled:R$(B.policyStorage),always:S$(B.policyStorage),hybridActive:k$(B.policyStorage),trackedSessionDetails:_,window:q$(B.policyStorage),trackedSessions:_.length,nextPrewarmAt:_.length?Math.min(..._.map((L)=>L.nextPrewarmAt)):void 0})}let K={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(B.settings[K[G]]??{})},async readSidebar(G){let[B,K]=await Promise.all([Z.read(),$.cacheKeepRegistry?.list()??[]]);return X0(T1(B,{activeId:Q.servedAccount(G),trackedSessions:K.length,now:Date.now()}))},forgetSession(G){Y.get(G)?.active.abort(),Y.delete(G)},close(){M=!0;for(let G of Y.values())G.active.abort();Y.clear()}}}import{resolveClaudeModelCapabilities as v$}from"@cortexkit/anthropic-auth-core";function x1(){let $=new Map;return{install:(Q)=>Q.model.transform((Y)=>{$.clear();for(let M of Y.list("anthropic")){$.set(String(M.id),String(M.modelID));let C=v$(M.modelID)?.efforts.variants;if(!C)continue;Y.update("anthropic",String(M.id),(q)=>{let T=q.variants.filter((H)=>!C.some((G)=>G===String(H.id)));q.variants=[...T,...C.map((H)=>({id:H,settings:{effort:H,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(Q)=>$.get(Q)??Q}}function S1($){return $.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??$.get("x-api-key")??void 0}import{buildPrimeRequestBody as k1,effectiveRelayTransport as R1,nativeAccountCanServe as g$,PrimeManager as h$,tokenFingerprint as b1}from"@cortexkit/anthropic-auth-core";var A1=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{};function w1($){let{runtime:Z,source:Q}=$,Y=new AbortController,M=new Set,C=(H)=>({providerID:"anthropic",modelID:k1().model,sessionID:`oc2-prime:${H}`,agent:"prime",kind:"generate"}),q=async(H)=>{let G=C(H),B=h2({source:Q}),K=performance.now();try{for(let _=0;_<3;_++){if(Y.signal.throwIfAborted(),(await Z.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let S=await B.adapter.accountHeaders({...G,accountId:H});if(!("headers"in S)||typeof S.headers!=="object"||S.headers===null||typeof S.attempt!=="object"||S.attempt===null)throw Error("Native Prime authorization refused");let O={...G,accountId:H,attemptId:crypto.randomUUID(),transport:"http",data:S.attempt},b,w=!1,f=!1,y=(o)=>{f=!0,o.body?.cancel().catch(()=>{})};try{let o=await B.adapter.rewriteRequest?.({...G,accountId:H,attempt:O,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(k1()),signal:Y.signal})});if(!o)throw Error("Native Prime rewrite refused");let e=new Headers(o.headers);for(let[J,X]of Object.entries(S.headers))if(X===null)e.delete(J);else e.set(J,X);let Q2=new Request(o,{headers:e}),j2=await($.fetch??fetch)(Q2),$2=await B.adapter.rewriteResponse?.({...G,accountId:H,request:Q2,response:j2,attempt:O})??j2;b=$2.status,B.adapter.quotaFromHeaders?.($2.headers,$2.status,O);let p=$2.ok?void 0:await B.adapter.limitFromResponse?.({status:$2.status,headers:$2.headers,body:()=>$2.clone().text(),attempt:O});if(p&&/^(vault-newer|local-newer|relay-direct):/.test(p.reason)&&_<2){if(y($2),(await Q.retrySameAccount?.({...G,accountId:H,attempt:_+1,limit:p,error:{type:"api_error",message:"Native Prime credential retry",status:$2.status}}))?.accountId!==H)throw Error("Native Prime retry changed account");continue}if(!$2.ok)return y($2),{ok:!1,status:b,ms:performance.now()-K,error:"Native Prime upstream refused the request"};let l=A1(await $2.json()),r=A1(l.usage),Z2={inputTokens:typeof r.input_tokens==="number"?r.input_tokens:void 0,outputTokens:typeof r.output_tokens==="number"?r.output_tokens:void 0};if(O.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test($2.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(w=await Q.recordPrime(S.attempt.provenance,Z2),!w)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:b,ms:performance.now()-K,usage:Z2}}finally{await B.adapter.onAttemptEnd?.(O,{status:b,outputStarted:!1,...w?{}:{error:{reason:f?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-K}}finally{B.dispose()}},T=new h$({storagePath:$.paths.legacyConfig,loadStorage:async()=>(await Z.read()).policyStorage,async getAccountFingerprint(H){let G=await Z.read(),B=G.accounts.find((L)=>L.id===H);if(!g$(B)||B?.type!=="oauth")return;if(G.policyStorage.relay?.enabled===!0&&R1(G.policyStorage.relay.transport,G.policyStorage.relay.url)==="websocket")return;if(B.source==="vault"){let L=await Z.authorizeVault(H,Y.signal),S=await Z.getOrCreateAuthLineage(H,L);return S?b1(S):void 0}let K=await Z.authorizeLocal(H,{signal:Y.signal});if(K.status!=="usable")return;let _=await Z.getOrCreateAuthLineage(H,K.subject);return _?b1(_):void 0},async refreshQuota(H){let G=await Z.read();if(G.policyStorage.relay?.enabled===!0&&R1(G.policyStorage.relay.transport,G.policyStorage.relay.url)==="websocket")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await Z.fetchQuota(H,$.fetch,Y.signal),fresh:!0}},sendPrime(H){let G=q(H);return M.add(G),G.finally(()=>M.delete(G)),G},async recordSuccess(H){let G=(await Z.read()).accounts.find((B)=>B.id===H);if(!G?.prime)throw Error("Native Prime counters are unavailable");return G.prime}});return T.start(),{manager:T,async dispose(){T.stop(),Y.abort(),await Promise.allSettled(M)}}}import{createNativeUsagePublisher as m$,decideStickyQuotaFailure as l$,effectiveRelayTransport as d$,getClaudeCodeIdentityForVerifiedAccount as Q0,getQuotaCheckIntervalMs as u$,getRoutingMode as x0,isDumpPersistentlyEnabled as D1,isQuotaBearingHeaderFrame as p$,logger as c$,mergeHeaderQuotaForPersistence as i$,NativeVaultNoAccountError as o$,nativeAccountCanServe as l2,nativeAccountPolicy as W0,nativeLocalAccountRefusal as n$,nativeLocalQuotaLineage as r$,nativePollQuotaGenerallyExhausted as s$,normalizeQuotaHeaders as a$,quotaSnapshotCheckedAt as I1,quotaSnapshotHasStandardWindows as t$,readNativeAccountsForRequest as e$,remapModelId as U0,StickySessionRouter as $6,setDumpEnabled as Z6,shouldFallbackStatus as j6,stickyQuotaSnapshotIsFresh as c2,stickyRetryAfterWithJitter as J6,stickyRouteFamilyForModel as y1}from"@cortexkit/anthropic-auth-core";var q0=($)=>["five_hour","seven_day"].some((Z)=>($?.[Z]?.remainingPercent??1)<=0);function X6($,Z,Q,Y){let M=$.rerouteFrom;if($.phase!=="retry"||M?.limit.status!==429||x0(Z.policyStorage)!=="sticky-balanced")return;let C=Q.find((T)=>T.id===M.accountId);if(!C||!c2(C.quota,Z.policyStorage,Date.now(),Y))return;let q=l$({quota:C.quota,modelId:Y});if(q.action!=="hold")return;return{hold:{delayMs:J6($.sessionID,q.retryAfterSeconds)*1000}}}function m1($){let{runtime:Z}=$,Q=m$("native-auth"),Y=h1(),M=new Set,C=new Map,q=(J)=>{let X=J.routingPath;if(!X)throw Error("Native routing storage is unavailable");let z=C.get(X);if(!z)z=new $6({path:X,vaultSeed:J.routingSeed,onLockEvent:Z.onLockEvent,relocationGuard:Z.relocationGuard,localRecoveryPath:J.mode==="local"?J.routingRecoveryPath:void 0}),C.set(X,z);return z.setVaultSeed(J.routingSeed),z},T=new WeakMap,H=new Map,G=new Map,B=new Map,K=new Map,_=new WeakSet,L=!1,S=()=>{while(H.size>512){let J=H.keys().next();if(!J.done)H.delete(J.value)}},O=(J)=>{try{Z6(D1(J.policyStorage))}catch{}},b=async()=>{try{let J=await Z.read();return O(J),D1(J.policyStorage)}catch{return!1}},w=(J)=>({providerID:J.providerID,sessionID:J.sessionID,kind:J.kind,modelID:J.modelID,agent:J.agent}),f=(J,X)=>JSON.stringify([J.providerID,J.sessionID,J.kind,J.modelID,J.agent,X]),y=(J)=>{if(L)throw Error("Native Anthropic source is closed");let X=B.get(J.sessionID);if(!X){X=new AbortController,B.set(J.sessionID,X);while(B.size>512){let z=B.keys().next();if(!z.done)Z2.forgetSession?.(z.value)}}return X},o=(J,X,z)=>l2(J)&&(J.type==="api"||W0(J,X,U0(z)).status==="allowed"),e=(J,X)=>J.source===X.source&&J.accountIdentity===X.accountIdentity&&J.credentialId===X.credentialId,Q2=async(J,X,z,R,I)=>{let A=await Z.read();O(A),R.signal.throwIfAborted(),j2(A);let m=A.accounts.find((d)=>d.id===J);if(!m||m.type!==z||!o(m,A,X))return I?.(!m||!l2(m)?"account-unavailable":"account-policy"),!1;if(z==="api"){let d=A.accounts.find((c)=>c.id==="main"&&c.type==="oauth");return!!d&&c2(d.quota,A.policyStorage)&&q0(d.quota)}return!0},j2=(J)=>{let X=J.policyStorage.relay;if(X?.enabled===!0&&d$(X.transport,X.url)==="websocket")throw new b2},$2=async(J,X)=>{if(j2(J),X||J.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let z=await Z.getRelayConfig();if(!z)throw Error("request refused: native HTTP relay configuration is unavailable");if(z.transport!=="http")throw new b2;return{dispatch:{kind:"http-relay",url:z.url,token:z.token},relayFallback:z.fallbackToDirect}};async function p(J,X,z){if(J.kind==="local"){let R=await Z.publishLocal(J.subject,z);if(!R&&z.quota)c$.warn("quota","Quota publication discarded");return R}if(J.kind==="vault"&&X.receipt)await Z.vault.publish(X.receipt,z);else if(J.kind==="api"&&z.lastUsed!==void 0)await Z.publishApi(J.subject,{lastUsed:z.lastUsed});return!0}function l(J,X,z){if(J.kind!=="local")return;let R=J.subject.binding,I=I1(z),A={lineage:r$(R),accountUuid:R.identity,entry:{quota:z,checkedAt:I,refreshAfter:I},generalExhausted:s$(z),routeBeforeSave:!0};return Z.quotaObservations.hold(X.account.id,A)?A:void 0}function r(J,X){if(X.exhaustionReported)return;X.exhaustionReported=!0,Y.report(J.sessionID,{accountIdentity:X.account.accountIdentity,credentialId:J.provenance.kind==="vault"?J.provenance.credentialId:X.account.credentialId},X.responseHeaders??new Headers,429,X.scope.modelID,!1)}let Z2={async chooseAccount(J){let X=y(J);$.onOwnedRequest?.();let z=await Z.read();O(z),X.signal.throwIfAborted(),j2(z);let R=U0(await $.resolveModelId?.(J)??J.modelID);if(X.signal.throwIfAborted(),z.mode==="claustrum")z=await e$(Z,X.signal),X.signal.throwIfAborted();if(z.policyStorage.quota?.enabled!==!1){let h=!1;for(let X2 of z.accounts){if(!l2(X2)||X2.type!=="oauth")continue;if(t$(X2.quota)?c2(X2.quota,z.policyStorage,Date.now(),R):Date.now()-I1(X2.quota)<u$(z.policyStorage))continue;try{await Z.fetchQuota(X2.id,$.fetch,X.signal,void 0,"admission"),h=!0}catch{X.signal.throwIfAborted()}}if(h)z=await Z.read();X.signal.throwIfAborted()}if(J.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(J.rerouteFrom.limit.reason))return;if(J.phase==="request")M.delete(J.sessionID);let I=await Y.accountFor(J.sessionID,R);if(X.signal.throwIfAborted(),I)z=await Z.read(),X.signal.throwIfAborted(),j2(z);let A=[];for(let h of z.accounts){if(h.type!=="oauth"||!o(h,z,R))continue;if(h.source==="local"){let X2=await Z.authorizeLocal(h.id,{signal:X.signal,policy:(a,J2)=>W0(a,J2,R)});if(X.signal.throwIfAborted(),X2.status!=="usable")continue}A.push(h)}if(I){let h=A.find((J2)=>v1(I,J2)),X2=A.map((J2,V)=>({accountId:J2.id,order:V,quota:J2.quota??{kind:"unknown"}})),a=!I.hold||J.phase==="retry"&&J.rerouteFrom?.accountId===h?.id;if(h&&a&&(I.hold||h.id!==J.rerouteFrom?.accountId)&&g1(h.id,X2,z.policyStorage,R)){let J2=await q(z).resolve({sessionId:J.sessionID,family:y1(R),modelId:R,affinityModelId:J.modelID,candidates:X2.filter((V)=>V.accountId===h.id),retainAccountIds:new Set([h.id]),...z.mode==="claustrum"?{accountIdentities:new Map([[h.id,I.account_id]])}:{},storage:z.policyStorage,inputBytes:1,preserveOnNoCandidate:!0});if(X.signal.throwIfAborted(),J2)return I.hold?{hold:{delayMs:I.hold.retry_after_ms}}:J2.accountId}Y.override(J.sessionID,!a?"hold requires the same refused retry account":"unknown account, credential, account policy or Fable reserve")}let m=X6(J,z,A,R);if(m)return m;let d=A.filter((h)=>h.id!==J.rerouteFrom?.accountId);if(x0(z.policyStorage)==="sticky-balanced"){let h=d.map((a,J2)=>({accountId:a.id,order:J2,quota:a.quota??{kind:"unknown"}})),X2=await q(z).resolve({sessionId:J.sessionID,family:y1(R),modelId:R,affinityModelId:J.modelID,candidates:h,retainAccountIds:new Set(d.map((a)=>a.id)),...z.mode==="claustrum"?{accountIdentities:new Map(z.accounts.flatMap((a)=>a.accountIdentity?[[a.id,a.accountIdentity]]:[]))}:{},storage:z.policyStorage,inputBytes:1,preferredAccountId:J.previousAccountId,preserveOnNoCandidate:!0});if(X.signal.throwIfAborted(),X2)return X2.accountId}else{let X2=x0(z.policyStorage)==="fallback-first"?[...d.filter((a)=>a.id!=="main"),...d.filter((a)=>a.id==="main")]:[...d.filter((a)=>a.id==="main"),...d.filter((a)=>a.id!=="main")];if(X2[0])return X2[0].id}if(z.mode==="claustrum")throw new o$;let c=z.accounts.find((h)=>h.id==="main"&&h.type==="oauth");if(!c)return;let s=c.quota;if(J.rerouteFrom?.limit.status===429||!c2(s,z.policyStorage))try{s=await Z.fetchQuota("main",$.fetch,X.signal)}catch{return}if(X.signal.throwIfAborted(),!q0(s))return;return z.accounts.find((h)=>h.type==="api"&&l2(h)&&h.id!==J.rerouteFrom?.accountId)?.id},dropChoice(){},async retrySameAccount(J){let X=J.limit?.reason,z=X?H.get(X):void 0;if(!z||f(z.scope,z.accountId)!==f(J,J.accountId))return;H.delete(z.reason);let R=y(J),I=await Z.read();R.signal.throwIfAborted(),j2(I);let A=U0(await $.resolveModelId?.(J)??J.modelID);R.signal.throwIfAborted();let m=I.accounts.find((s)=>s.id===J.accountId);if(!m||!e(m,z.account)||!o(m,I,A))return;let d=f(J,J.accountId),c=G.get(d)??[];return c.push(z),G.set(d,c),{accountId:J.accountId}},dropSameAccountRetry(J){let X=f(J,J.accountId),z=G.get(X),R=z?.findIndex((I)=>!J.limit||I.reason===J.limit.reason)??-1;if(R!==-1)z?.splice(R,1);if(z?.length===0)G.delete(X)},async authorizeAccount(J,X,z){let R=y(J),I=await Z.read();O(I),R.signal.throwIfAborted(),j2(I);let A=U0(await $.resolveModelId?.(J)??J.modelID);R.signal.throwIfAborted();let m=I.accounts.find((U)=>U.id===X);if(!m||!o(m,I,A)){z?.(!m||!l2(m)?"account-unavailable":"account-policy");return}let d=f(J,X),c=G.get(d),s=c?.shift();if(c?.length===0)G.delete(d);if(s&&!e(m,s.account))return;let{dispatch:h,relayFallback:X2}=await $2(I,s?.direct===!0);if(R.signal.throwIfAborted(),s?.auth){if(!await Q2(X,A,s.auth.route,R,z))return;let U=T.get(s.auth.provenance);if(U?.receipt?.expiresAtMs!==void 0&&U.receipt.expiresAtMs!==null&&U.receipt.expiresAtMs<Date.now()+300000)return;if(U)T.set(s.auth.provenance,{...U,scope:{...J,modelID:A},account:m,active:R,relayFallback:X2});return K.set(J.sessionID,X),{...s.auth,dispatch:h}}let a={scope:{...J,modelID:A},active:R,account:m,retry:s?.retry??!1,relayFallback:X2,quota:m.quota};if(m.type==="api"){let U=I.accounts.find((g)=>g.id==="main"&&g.type==="oauth");if(!U||!c2(U.quota,I.policyStorage)||!q0(U.quota))return;let E=await Z.authorizeApi(X,R.signal);if(R.signal.throwIfAborted(),!await Q2(X,A,"api",R))return;let x={kind:"api",subject:E.subject};return T.set(x,a),K.set(J.sessionID,X),{route:"api",headers:E.authHeader==="authorization-bearer"?{authorization:`Bearer ${E.apiKey}`}:{"x-api-key":E.apiKey},baseURL:E.baseURL,provenance:x,dispatch:h}}if(m.source==="vault"){let U=await Z.authorizeVault(X,R.signal);if(R.signal.throwIfAborted(),s&&(U.credentialId!==s.account.credentialId||U.assertedAccountIdentity!==s.account.accountIdentity))return;if(!await Q2(X,A,"oauth",R,z))return;let E={kind:"vault",credentialId:U.credentialId,recordVersion:U.recordVersion};T.set(E,{...a,receipt:U});let x=U.assertedAccountIdentity;if(!x){z?.("account-unavailable");return}return K.set(J.sessionID,X),{route:"oauth",accessToken:U.accessToken,provenance:E,dispatch:h,identity:Q0(x,x)}}let J2=await Z.authorizeLocal(X,{signal:R.signal,policy:(U,E)=>W0(U,E,A)});if(R.signal.throwIfAborted(),J2.status!=="usable"){let U=n$(J2);if(U)z?.(U.reason);return}if(!await Q2(X,A,"oauth",R,z))return;let V={kind:"local",subject:J2.subject};T.set(V,{...a,access:J2.access}),K.set(J.sessionID,X);let N=J2.subject.binding.identity;return{route:"oauth",accessToken:J2.access,provenance:V,dispatch:h,identity:Q0(N,N)}},async requestOptions(J,X){let z=y(J),R=await Z.read();O(R),z.signal.throwIfAborted();let I=R.accounts.find((m)=>m.id===J.accountId);if(!I||!o(I,R,J.modelID))throw X?.(!I||!l2(I)?"account-unavailable":"account-policy"),Error("request refused: native account is ineligible for this model");let A=T.get(J.provenance);if(A)T.set(J.provenance,{...A,scope:{...A.scope,modelID:J.modelID}});return $.requestOptions(J,R)},async admitRequest(J,X){let z=T.get(J.provenance);if(!z||!await Q2(J.accountId,J.modelID,J.route,z.active,X))throw Error("request refused: native account policy changed before dispatch");T.set(J.provenance,{...z,scope:{...z.scope,modelID:J.modelID}})},isDumpEnabled:()=>b(),onRequestPrepared:(J)=>$.onRequestPrepared?.(J),responseOptions(J){return $.responseOptions?.({...J,modelID:T.get(J.provenance)?.scope.modelID??J.modelID})},quotaFromHeaders(J,X){let z=T.get(X.provenance);if(z){z.responseHeaders=J;let h=X.status<400&&!M.has(X.sessionID);if(h)M.add(X.sessionID);if(X.status===429)r(X,z);else Y.report(X.sessionID,{accountIdentity:z.account.accountIdentity,credentialId:X.provenance.kind==="vault"?X.provenance.credentialId:z.account.credentialId},J,X.status,z.scope.modelID,h)}let R=f1(J);if(R)$.onRequestId?.(X,R);if(!z||X.route!=="oauth"||!p$(J))return;let I=X.provenance.kind==="local"?X.provenance.subject.binding.identity:z.receipt?.assertedAccountIdentity,A={...a$(J),...I?{accountIdentity:I}:{}},m=i$(z.quota,A);z.quota=m;let d=l(X.provenance,z,m),c=z.account.id,s=()=>{if(d)Z.quotaObservations.forget(c,d)};return Q.observe(p(X.provenance,z,{quota:m}).then((h)=>{if(!h)s()},(h)=>{throw s(),h})),A},async limitFromResponse(J){let X=T.get(J.provenance);if(!X)return;if(J.status===401&&X.receipt){if(!_.has(X.receipt))_.add(X.receipt),await Z.vault.reportFailure(X.receipt,401,J.dispatch==="http-relay"?"relay_status_field":"direct");if(X.retry||X.active.signal.aborted)return;let R=X.active,I=await Z.vault.prepareRetry(X.receipt,R.signal);if(R.signal.throwIfAborted(),!I.retry)return;let A=I.receipt,m=A.assertedAccountIdentity;if(!m)return;let d={kind:"vault",credentialId:A.credentialId,recordVersion:A.recordVersion};T.set(d,{...X,receipt:A,retry:!0});let c=`vault-newer:${J.attemptId}`;return H.set(c,{scope:w(J),reason:c,accountId:J.accountId,account:X.account,retry:!0,auth:{route:"oauth",accessToken:A.accessToken,provenance:d,identity:Q0(m,m)}}),S(),{reason:c,status:401}}if(J.status===401&&J.provenance.kind==="local"&&X.access&&!X.retry){if(X.active.signal.aborted)return;let R=X.active,I=await Z.authorizeLocal(J.accountId,{rejectedAccessToken:X.access,signal:R.signal,policy:(c,s)=>W0(c,s,X.scope.modelID)});if(R.signal.throwIfAborted(),I.status!=="usable"||I.access===X.access)return;let A={kind:"local",subject:I.subject};T.set(A,{...X,access:I.access,retry:!0});let m=I.subject.binding.identity,d=`local-newer:${J.attemptId}`;return H.set(d,{scope:w(J),reason:d,accountId:J.accountId,account:X.account,retry:!0,auth:{route:"oauth",accessToken:I.access,provenance:A,identity:Q0(m,m)}}),S(),{reason:d,status:401}}let z=await Z.read();if(j6(J.status,z.policyStorage))return{reason:`provider-${J.status}`,status:J.status};return},limitFromRelayFailure(J){let X=T.get(J.provenance);if(!X?.relayFallback||X.active.signal.aborted||!(J.status===401||J.status>=500))return;let z=`relay-direct:${J.attemptId}`;return H.set(z,{scope:w(J),reason:z,accountId:J.accountId,account:X.account,direct:!0,retry:!1}),S(),{reason:z}},limitFromStreamError(J){let X=T.get(J.provenance);if(X&&J.errorType==="rate_limit_error")r(J,X);return J.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(J,X){let z=T.get(X.provenance);if(X.dispatch==="http-relay"&&z?.relayFallback&&!z.active.signal.aborted&&J.status===void 0){let R=`relay-direct:${X.attemptId}`;return H.set(R,{scope:w(X),reason:R,accountId:X.accountId,account:z.account,direct:!0,retry:!1}),S(),{reason:R}}return},async onAttemptEnd(J,X){let z=T.get(J.provenance);if(!z)return;try{if(X.status===401&&z.receipt&&!_.has(z.receipt))_.add(z.receipt),await Z.vault.reportFailure(z.receipt,401,J.dispatch==="http-relay"?"relay_status_field":"direct");if(!X.localRefusal&&X.status!==void 0)Q.publish(()=>p(J.provenance,z,{lastUsed:Date.now()}))}finally{T.delete(J.provenance)}},forgetSession(J){M.delete(J),B.get(J)?.abort(),B.delete(J),K.delete(J);for(let[X,z]of H)if(z.scope.sessionID===J)H.delete(X);for(let[X,z]of G)if(z[0]?.scope.sessionID===J)G.delete(X);$.onForgetSession?.(J)},servedAccount:(J)=>K.get(J),resetRouting:async(J)=>q(await Z.read()).clear(J),async recordPrime(J,X){let z=T.get(J);if(!z||z.active.signal.aborted)return!1;if(J.kind==="local")return Z.incrementPrimeUsage(z.account.id,J.subject,X);if(J.kind==="vault"&&z.receipt)return Z.incrementPrimeUsage(z.account.id,z.receipt,X);return!1},drainRoutingPublications:()=>Promise.all([Z.drainRoutingPublications(),...[...C.values()].map((J)=>J.drain())]).then(()=>{}),close(){L=!0;for(let J of B.values())J.abort();return B.clear(),G.clear(),H.clear(),Promise.all([Q.drain(),Z2.drainRoutingPublications()]).then(()=>{})}};return Z2}import{remapModelId as G6}from"@cortexkit/anthropic-auth-core";function u1(){let $=new l1,Z=new Map,Q=new Map,Y=new Map,M=new Set,C=new Set,q=new Map,T=(H)=>{while(H.size>512){let G=H.keys().next();if(!G.done)H.delete(G.value)}};return{async install(H){let G=[];try{G.push(await H.session.hook("context",(B)=>{let K=B.messages.map((L)=>{return{info:{id:L.id,sessionID:B.sessionID,role:L.role,agent:B.agent,model:{providerID:B.model.providerID,modelID:B.model.id}},parts:L.content.map((S)=>({type:S.type,...S.type==="text"?{text:S.text}:{}}))}});$.observeMessages(K);let _=B.messages.findLast((L)=>L.role==="user"&&L.id);if(_?.id)Z.set(B.sessionID,_.id);if(_?.content.some((L)=>L.type==="text"&&L.text===G0))M.add(B.sessionID);else M.delete(B.sessionID);T(Z)},{providerID:"anthropic"})),G.push(await H.session.hook("model.request",(B)=>{if(B.kind!=="primary")return;let K=Z.get(B.sessionID);if(!K)return;if($.markHeaders({sessionId:B.sessionID,messageId:K,agent:B.agent,headers:B.headers}),M.has(B.sessionID))B.headers[y2]="1"},{providerID:"anthropic"}))}catch(B){throw await Promise.allSettled(G.map((K)=>K.dispose())),B}return{dispose:async()=>{await Promise.all(G.map((B)=>B.dispose()))}}},requestOptions(H,G){let B=$.resolveHeader(H.correlation[t2]);if(B)Q.set(H.attemptId,B),T(Q);q.set(H.attemptId,H.sessionID),T(q);let K=H.correlation[y2]==="1";if(K)C.add(H.attemptId);return{cache1hEnabled:H.agent!=="compaction"&&H.agent!=="title"&&(G.policyStorage.claudeCache?.enabled??!0),cache1hMode:G.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:G.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:G.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,turnEndNoteEnabled:!0,turnEndNote:G.policyStorage.turnEndNote,serverSideFallbackEnabled:d1(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:K,billingLineage:B?{promptId:B.promptId,previousRequestId:B.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:Y.get(H.sessionID)}},responseOptions(H){return{serverSideFallbackModel:G6(H.modelID),laneStart:C.has(H.attemptId),onMessageStart(G){if(H.kind==="primary"&&typeof G.id==="string")Y.set(H.sessionID,G.id),T(Y)},onStreamEnd(){Q.delete(H.attemptId),C.delete(H.attemptId),q.delete(H.attemptId)}}},onRequestId(H,G){$.commit(Q.get(H.attemptId),G)},forgetSession(H){$.clearSession(H),Z.delete(H),Y.delete(H),M.delete(H);for(let[G,B]of q)if(B===H)Q.delete(G),C.delete(G),q.delete(G)}}}var B0="cortexkit-anthropic-auth",O6='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',E6="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",q6="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function x6($){let Z=$.authorize??Q6,Q=$.exchange??z6,Y=()=>{if(!$.isActive())throw Error("Claude authentication setup is closed")},M=async()=>{let T;try{T=await $.readMode()}catch{throw Error(q6)}return Y(),T},C=async()=>{if(await M()!=="local")throw Error(O6)};return{integrationID:"anthropic",methods:[{method:{id:Y0,type:"oauth",label:V0},async authorize(){Y(),await C();let T=await Z("max");return Y(),{mode:"code",url:T.url,instructions:"Paste the authorization code returned by Claude.",callback:async(H)=>{Y();let G=await Q(H,T.verifier,T.redirectUri,T.state);if(!$.isActive()||G.type!=="success")throw Error("Claude sign-in did not complete");return{access:G.access,refresh:G.refresh,expires:G.expires}}}}}],vault:{method:{id:p1,type:"oauth",label:"Claude vault accounts"},async activate(){if(Y(),await M()!=="claustrum")throw Error(E6)}},async onLogin(T){Y(),await C(),await $.runtime.loginOAuth({routeId:"main",credential:T,replace:!0}),Y()},label:"Claude native account pool"}}function S6($){return{readMode:()=>N6("opencode",$),disconnectVault:()=>B6({host:"opencode",env:$})}}function k0($={}){return{id:B0,setup:(Z)=>i1(Z,$)}}async function k6($){try{return await b6($)}catch(Z){throw R6(Z)}}function R6($){let Z=e2($);if(Z)return Z;let Q=T6("decide where its account state is",[],$);return S0.error("state-layout",Q.message,{code:Q.code}),e2(Q)??Q}async function b6($){if($.paths){let Q=$.paths;return await V6(Q),{paths:Q,holderRegistration:await _6({paths:Q,role:"opencode2",kind:H6(),policy:C6(),onLockEvent:$.local?.onLockEvent})}}let Z=await U6({role:"opencode2",onLockEvent:$.local?.onLockEvent});return{paths:await L6(void 0,void 0,Z.layout),holderRegistration:Z.kind==="state-home"?void 0:Z.registration}}async function i1($,Z={}){let{paths:Q,holderRegistration:Y}=await k6(Z),M=Y6({paths:Q,host:"opencode",local:Z.local,vault:Z.vault}),C=S6(Z.vault?.env??process.env);try{let f=await M.read();if(!process.env.OPENCODE_ANTHROPIC_AUTH_LOG_LEVEL)P6(K6(f.policyStorage)??"info");F6(M6(f.policyStorage))}catch{}let q=!0,T=u1(),H=x1(),G,B,K,_=m1({runtime:M,paths:Q,fetch:Z.fetch,requestOptions:T.requestOptions,responseOptions:T.responseOptions,onRequestId:T.onRequestId,onForgetSession:T.forgetSession,onRequestPrepared:async(f)=>{try{await K?.track(f)}catch{S0.warn("cachekeep","live request tracking failed")}},resolveModelId:async(f)=>H.modelId(f.modelID),onOwnedRequest:()=>{G??=N1(M,Z.fetch),B??=w1({runtime:M,paths:Q,source:_,fetch:Z.fetch})}});K=K1({...Z.cacheKeep,runtime:M,source:_,storageId:Q.storageId,fetch:Z.fetch,isSubagent:async(f)=>Boolean((await $.session.get({sessionID:f})).parentID)}),await K.ready;let L=q1({runtime:M,source:_,cacheKeepRegistry:K.registry,start:async(f,y)=>{await $.session.synthetic({sessionID:f,text:y,description:"Claude lane start",resume:!0})}}),S=[],O=await M1($,{source:_,log:{warn:(f,y)=>S0.warn("opencode2",f,y)}},{credential:S1}).catch(async(f)=>{throw Y?.close(),L.close(),await K?.dispose(),await _.close(),await M.drainQuotaPublications(),await M.close(),f}),b,w=()=>{if(b)return b;return q=!1,Y?.close(),L.close(),_.close(),b=(async()=>{await Promise.allSettled([O.dispose(),G?.dispose(),B?.dispose(),K?.dispose(),...S.map((f)=>f.dispose())]),await _.close(),await M.drainQuotaPublications(),await M.close()})(),b};try{S.push(await T.install($)),S.push(await H.install($)),S.push(await M0($,x6({isActive:()=>q,readMode:C.readMode,runtime:M})));let f={host:"opencode",dispatch:L.dispatch,readStatus:(o)=>L.readStatus(o),readAccounts:()=>M.read(),readMode:C.readMode,disconnectVault:C.disconnectVault,interactive:!0},y=W6(f);return S.push(await c1($,y,L)),w}catch(f){throw await w(),f}}var z8={id:B0,setup:k0().setup,server:o1};export{i1 as setupAnthropicAuth,z8 as default,k0 as createAnthropicAuthPlugin,B0 as ANTHROPIC_AUTH_PLUGIN_ID};