@cortexkit/opencode-openai-auth 1.0.3 → 1.0.5

package/dist/index-ff1jy44a.js

@@ -1,222 +0,0 @@
-import{Ab as YX,Bb as GX,Cb as LL,Db as DL,Eb as C1,Fb as FL,La as $Q,Ma as YQ,Na as G6,Oa as V7,Pa as m8,Qa as Nz,Ra as R7,Sa as R8,Ta as f0,Ua as z2,Va as GQ,Wa as oX,Ya as BY,_a as rH,ab as p8,bb as ZL,eb as WL,ib as kV,jb as BL,kb as HL,lb as VL,qb as vX,rb as yX,sb as UL,tb as KL,wb as jL,xb as NL,yb as qL}from"./index-sjx8t1nr.js";import{Kb as CQ,Lb as M6,Mb as EQ,Nb as L5,Ob as g0,Pb as H2,Qb as SQ,Rb as sZ}from"./index-jyr8y8k4.js";import{Tb as vH,Ub as yH,Vb as hH,Wb as eV,Xb as QL,Yb as o7}from"./index-rv08jmd4.js";import{dc as C2,ec as XX,gc as Z0,hc as dB,jc as cJ,kc as lJ,lc as e0,nc as xH}from"./index-bmd7x5aq.js";import{pc as fH,rc as zL}from"./index-766sfrh5.js";import{uc as MY}from"./index-b3q3j39x.js";import{createHash as sI,randomUUID as aI}from"node:crypto";import{mkdirSync as oI,readFileSync as rI,renameSync as tI,statSync as eI,writeFileSync as Xb}from"node:fs";import DG from"node:os";import{join as Jb}from"node:path";function QQ(X,J,$){let Y=J.rateLimitMarks?.get(X);if(Y!==void 0&&$<Y)return{id:X,reason:"rate-limited",until:Y};let G=J.refreshBackoff?.get(X);if(G!==void 0&&$<G)return{id:X,reason:"refresh-backoff",until:G};return}function wL(X,J,$,Y){if(J.limits.length===0)return{id:X,stage:1,gate:2,reason:"needs-first-reading",pullRequested:!0};for(let Q of $)if(!J.limits.some((z)=>z.label===Q))return{id:X,stage:1,gate:3,reason:"unknown-window",window:{scope:J.scope,label:Q},pullRequested:!0};let G=J.limits.filter(GQ);for(let Q of G)if(oX(Q,Y)===void 0)return{id:X,stage:1,gate:4,reason:"unknown-reset",window:{scope:Q.scope,label:Q.label},pullRequested:!0};for(let Q of G){let z=oX(Q,Y);if(z!==void 0&&typeof Q.resetsAt==="string")return{id:X,stage:1,gate:5,reason:"exhausted",window:{scope:Q.scope,label:Q.label},resetsAt:Q.resetsAt,resetAtMs:z}}return}function a8(X){let J=X.scope??$Q,$=X.requiredLabels??YQ,Y=[],G=[],Q=[];for(let j of X.rows){let N=QQ(j.id,X,X.now);if(N){Y.push(N);continue}if(j.kind==="api-key"){Q.push({id:j.id,kind:j.kind});continue}let K=f0(j.quota,J),q=wL(j.id,K,$,X.now);if(q){G.push(q);continue}Q.push({id:j.id,kind:j.kind,projection:K})}let z=new Map(Q.flatMap((j)=>{let N=z2(j.projection,X.now);return N?[[j.id,N]]:[]})),Z=z.size>0&&z.size===Q.length,W=[];for(let j of Q){let N=z.get(j.id);if(N===void 0)W.push(j);else if(Z)W.push({...j,lastPath:!0});else G.push({id:j.id,stage:2,reason:"budget-spent",...N})}let B=new Map(X.rows.map((j,N)=>[j.id,N])),H=(j,N)=>(B.get(j.id)??0)-(B.get(N.id)??0);G.sort(H);let U=G.filter((j)=>("pullRequested"in j)).map((j)=>j.id);for(let j of U)X.requestPull?.(j);return{admitted:W,refused:G,excluded:Y,pulls:U}}var Z2="main";function rX(X){switch(X){case"sticky-balanced":return{mode:"sticky-balanced",placement:"roster"};case"main-first":return{mode:"ordered",placement:"main-first"};case"fallback-first":return{mode:"ordered",placement:"fallback-first"};default:return{mode:"ordered",placement:"roster"}}}function k1(X,J,$=Z2){if(J==="roster"||!X.includes($))return[...X];let Y=X.filter((G)=>G!==$);return J==="main-first"?[$,...Y]:[...Y,$]}function tX(X){let J=a8(X),$=new Set(J.admitted.map((G)=>G.id));return{order:k1(X.rows.map((G)=>G.id),X.placement??"roster",X.formerMainId).filter((G)=>$.has(G)&&X.killswitch?.get(G)!==!1),admission:J}}function eX(X,J,$){let Y=J.at(-1);if(Y!==void 0){if(Y.status===void 0||!$.includes(Y.status))return}let G=new Set(J.map((Q)=>Q.id));return X.find((Q)=>!G.has(Q))}function v4(X,J,$){if(!J.has(X.accountId))return!1;return!(typeof X.wireIdentity==="string"&&typeof $==="string"&&X.wireIdentity!==$)}function X5(X,J,$){let Y=new Map;for(let[G,Q]of X){if(G===$)continue;if(Q.quotaCheckedAt!==J.get(Q.accountId))continue;Y.set(Q.accountId,(Y.get(Q.accountId)??0)+(Q.inputBytes??0))}return Y}var Y5=900000,ZQ=0.016666666666666666,J5=0.000001;function W2(X,J){for(let $ of[X?.checkedAt,J])if(typeof $==="number"&&Number.isFinite($))return $;return}function WQ(X){if(X===401||X===403)return"permanent";if(X===void 0||X===0||!Number.isFinite(X)||X>=500&&X<=599||X===429)return"transient";return"healthy"}function BQ(X){return X.limits.filter((J)=>J.kind==="reading").sort((J,$)=>{let Y=J.windowMinutes!==void 0,G=$.windowMinutes!==void 0;if(Y!==G)return Y?-1:1;if(Y&&G)return($.windowMinutes??0)-(J.windowMinutes??0);return 0})}function G5(X){let J=(X.classifyStatus??WQ)(X.status);if(J==="permanent")return{action:"migrate",reason:"permanent"};if(!X.quota)return{action:"retain",reason:"unknown"};let $=W2(X.quota,X.quotaCheckedAt);if($===void 0||!Number.isFinite($)||X.now-$>Y5)return{action:"retain",reason:"stale"};if(X.killswitchPasses===!1)return{action:"migrate",reason:"killswitch"};for(let G of BQ(X.quota)){let Q=G.remainingPercent;if(typeof Q==="number"&&Number.isFinite(Q)&&Q<=0)return{action:"migrate",reason:"exhausted",window:{scope:G.scope,label:G.label},...typeof G.resetsAt==="string"?{resetsAt:G.resetsAt}:{}}}let Y=z2(X.quota,X.now);if(Y)return{action:"migrate",reason:"exhausted",resetsAt:Y.resetsAt};return{action:"retain",reason:J}}function $5(X,J,$){let Y=Math.max(0,X.remainingPercent-J);if(Y<=0)return 0;if(!X.resetsAt)return Y;let G=Date.parse(X.resetsAt);if(!Number.isFinite(G)||G<=$)return Y;let Q=Math.max((G-$)/3600000,ZQ);return Y/Q}function zQ(X,J){if(X<J)return-1;if(X>J)return 1;return 0}function vL(X,J){if(!X.quota)return;let $=W2(X.quota,X.quotaCheckedAt);if($===void 0||J-$>Y5)return;let Y=BQ(X.quota).map((z)=>$5({remainingPercent:z.remainingPercent??Number.NaN,...z.resetsAt===void 0?{}:{resetsAt:z.resetsAt}},X.reservePercent[z.label]??0,J)),G=X.quota.budget;if(G&&typeof G.remainingPercent==="number"&&Number.isFinite(G.remainingPercent))Y.push($5({remainingPercent:G.remainingPercent,...G.resetsAt===void 0?{}:{resetsAt:G.resetsAt}},0,J));let Q=Y.length>0?Math.min(...Y):0;return Q>0?{candidate:X,quotaCheckedAt:$,weight:Q}:void 0}function HQ(X){let J=X.candidates.filter((G)=>G.killswitchPasses!==!1);if(X.candidates.length===0)throw Error("Cannot select a sticky candidate: input.candidates is empty");if(J.length===0)return;let $=J.map((G)=>vL(G,X.now)).filter((G)=>G!==void 0);if($.length>0){$.sort((Q,z)=>{let Z=((X.pendingBytes.get(Q.candidate.accountId)??0)+X.requestBytes)/Math.max(Q.weight,J5),W=((X.pendingBytes.get(z.candidate.accountId)??0)+X.requestBytes)/Math.max(z.weight,J5);return Z-W||Q.candidate.configuredOrder-z.candidate.configuredOrder||zQ(Q.candidate.accountId,z.candidate.accountId)});let G=$[0];if(G)return{accountId:G.candidate.accountId,quotaCheckedAt:G.quotaCheckedAt,source:"weighted"}}X.onEmptyWeightedSet?.();let Y=[...J].sort((G,Q)=>{let z=(G.resetCreditsApplicable??0)>0?1:0;return((Q.resetCreditsApplicable??0)>0?1:0)-z||G.configuredOrder-Q.configuredOrder||zQ(G.accountId,Q.accountId)})[0];if(!Y)throw Error("Cannot select a sticky candidate: input.candidates is empty");return{accountId:Y.accountId,quotaCheckedAt:W2(Y.quota,Y.quotaCheckedAt),source:"mode-fallback"}}function Q5(X){let J=a8(X),$=new Map(J.admitted.map((K)=>[K.id,K])),Y=new Map(J.refused.map((K)=>[K.id,K])),G=new Set(J.excluded.map((K)=>K.id)),Q=new Set(X.rows.map((K)=>K.id)),z=X.pin!==void 0&&v4(X.pin,Q,X.identities?.get(X.pin.accountId));if(z&&X.pin){let K=$.get(X.pin.accountId);if(K&&X.killswitch?.get(K.id)!==!1)return{outcome:"dispatch",accountId:K.id,source:"pin",...K.projection?.checkedAt===void 0?{}:{quotaCheckedAt:K.projection.checkedAt},pin:{action:"retain"},refusedSelections:[],admission:J}}let Z=X.pin?Y.get(X.pin.accountId):void 0,W=z&&X.pin!==void 0&&X.refusedPinPolicy==="move-on-confirmed-exhaustion"&&(X.killswitch?.get(X.pin.accountId)===!1||Z?.reason==="exhausted"||Z?.reason==="budget-spent"),B=(K)=>{return(typeof X.rowReservePercent==="function"?X.rowReservePercent(K):X.rowReservePercent?.get(K.id))??X.reservePercent??{}},H=X.scope,U=X.rows.map((K,q)=>({row:K,configuredOrder:q})).filter(({row:K})=>!G.has(K.id)).map(({row:K,configuredOrder:q})=>{let F=X.killswitch?.get(K.id),O=X.resetCreditsApplicable?.get(K.id);return{accountId:K.id,quota:K.kind==="api-key"?void 0:$.get(K.id)?.projection??f0(K.quota,H),reservePercent:B(K),configuredOrder:q,...O===void 0?{}:{resetCreditsApplicable:O},...F===void 0?{}:{killswitchPasses:F}}}),j=[],N=z?{action:"retain"}:X.pin?{action:"clear"}:{action:"none"};while(U.length>0){let K=HQ({candidates:U,pendingBytes:X.pendingBytes??new Map,requestBytes:X.requestBytes,now:X.now,...X.onEmptyWeightedSet?{onEmptyWeightedSet:X.onEmptyWeightedSet}:{}});if(!K)break;let q=Y.get(K.accountId);if(q){j.push(q),U=U.filter((O)=>O.accountId!==K.accountId);continue}let F=X.identities?.get(K.accountId);return{outcome:"dispatch",accountId:K.accountId,source:K.source,...K.quotaCheckedAt===void 0?{}:{quotaCheckedAt:K.quotaCheckedAt},pin:z&&!W?{action:"retain"}:{action:"assign",pin:{accountId:K.accountId,inputBytes:X.requestBytes,...F===void 0?{}:{wireIdentity:F},...K.quotaCheckedAt===void 0?{}:{quotaCheckedAt:K.quotaCheckedAt}}},refusedSelections:j,admission:J}}return{outcome:"no-admissible-account",pin:N,refusedSelections:j,admission:J}}class K0 extends Error{operation;rowId;phase;retryable;kind;committed;constructor(X){super(X.message??`${X.operation} failed (${X.kind}, ${X.phase})`,X.cause===void 0?void 0:{cause:X.cause});this.name="PoolOperationError",this.operation=X.operation,this.rowId=X.rowId,this.phase=X.phase,this.retryable=X.retryable,this.kind=X.kind,this.committed=X.committed}}class B2 extends Error{operation;constructor(X){super(`${X} was called from inside a store hook; hand it to the caller's continuation instead`);this.name="PoolReentryError",this.operation=X}}var x1="identity-contradicted: ",z5="duplicate-identity";function q9(X,J,$){let Y=X.rosterRow(J);if(!Y)return;Y.enabled=!1;let G=X.entry(J)??{credentialEpoch:1,needsFirstReading:!0},Q=typeof G.disabledReason==="string"&&G.disabledReason.startsWith("identity-contradicted: ");X.setEntry(J,{...G,disabledReason:Q?G.disabledReason:$})}function y4(X,J){let $=X.rosterRow(J);if(!$)return;$.enabled=!0;let Y=X.entry(J);if(Y&&"disabledReason"in Y){let G={...Y};delete G.disabledReason,X.setEntry(J,G)}}function w1(X,J){let $=X.rows().filter((G)=>G.invalid===void 0&&!G.staged&&G.type==="oauth"&&G.enabled&&G.identity===J),Y=[];for(let G of $.slice(1))q9(X,G.id,"duplicate-identity"),Y.push(G.id);return Y}function c9(X,J,$){let Y=X.rosterRow(J);if(!Y)return[];return Y.accountId=$,w1(X,$)}import{readFile as eL}from"node:fs/promises";import{setTimeout as XD}from"node:timers/promises";import{AsyncLocalStorage as yL}from"node:async_hooks";var VQ=new yL;function B6(X){if(VQ.getStore()!==void 0)throw new B2(X)}function A8(X,J){return VQ.run(X,async()=>await J())}async function UQ(X,J,$,Y,G){if(!J)return;try{await A8(X,()=>J($,Y))}catch(Q){G?.warn("store failure hook threw; the original failure stands",{operation:X,rowId:$,error:Q instanceof Error?Q.message:String(Q)})}}var Z5=Object.freeze({ttlMs:1e4,timeoutMs:15000,retryMs:50,renew:!0});async function hL(X,J,$){let Y=(z)=>{try{let Z=$.onLockEvent?.({type:z,name:X.name,path:X.path});if(Z&&(typeof Z==="object"||typeof Z==="function")&&"then"in Z&&typeof Z.then==="function")Promise.resolve(Z).catch(()=>{})}catch{}},G={...J,...fL(X)},Q=performance.now();for(;;){let z=await g0({name:X.name,path:X.path,ttlMs:G.ttlMs,now:$.now,renew:G.renew,onContended:()=>Y("contended"),...G.renewIntervalMs!==void 0?{renewIntervalMs:G.renewIntervalMs}:{},...$.onLockStep?{onStep:(B)=>$.onLockStep?.({name:X.name,path:X.path},B)}:{}});if(z){Y("acquired");let B={name:X.name,path:X.path,assertOwned:()=>z.assertOwned(),release:async()=>{await z.release(),Y("released")}};try{await B.assertOwned()}catch(H){throw await B.release(),H}return B}let Z=G.timeoutMs-(performance.now()-Q);if(Z<=0)throw new H2({target:X.path,name:X.name,timeoutMs:G.timeoutMs});let W=Math.floor(Math.random()*(G.retryMs+1));await new Promise((B)=>setTimeout(B,Math.min(G.retryMs+W,Z)))}}function fL(X){let J={};if(X.ttlMs!==void 0)J.ttlMs=X.ttlMs;if(X.timeoutMs!==void 0)J.timeoutMs=X.timeoutMs;if(X.retryMs!==void 0)J.retryMs=X.retryMs;if(X.renew!==void 0)J.renew=X.renew;if(X.renewIntervalMs!==void 0)J.renewIntervalMs=X.renewIntervalMs;return J}class L9{defaults;env;held=[];constructor(X,J){this.defaults=X,this.env=J}async acquire(X){let J=await hL(X,this.defaults,this.env);return this.held.push(J),await this.assertAll(),J}async assertAll(){for(let X of this.held)await X.assertOwned()}async releaseTo(X){while(this.held.length>X)await this.held.pop()?.release().catch(()=>{})}async releaseAll(){await this.releaseTo(0)}}function l9(X,J,$){if($!==void 0)throw new K0({operation:X,rowId:J,kind:"row-staged",phase:X==="pull"?"pull":"before-first-write",retryable:!1,message:`row ${J} is reserved for roster publication`})}import{createHash as h4}from"node:crypto";var E0="commonAuthPool",D9=1,$8="rows",V2="retiredEpochs",f4=1,W5=300000,_0=E0;function gL(X){let J=JSON.parse(JSON.stringify(X)),$=(Y)=>{if(Array.isArray(Y))return`[${Y.map($).join(",")}]`;if(y(Y))return`{${Object.keys(Y).sort().map((G)=>`${JSON.stringify(G)}:${$(Y[G])}`).join(",")}}`;return JSON.stringify(Y)};return $(J)}function d9(X){return h4("sha256").update(gL(X)).digest("hex")}function KQ(X){if(!y(X)||Object.keys(X).length!==1||typeof X.reservation!=="string"||!X.reservation)return;return{reservation:X.reservation}}function mL(X){if(!y(X)||typeof X.reservation!=="string"||!X.reservation||typeof X.disabledReason!=="string")return;if(Object.keys(X).some((J)=>!["reservation","label","disabledReason","providerState"].includes(J)))return;if("label"in X&&typeof X.label!=="string")return;if("providerState"in X&&(typeof X.providerState!=="string"||!/^[a-f0-9]{64}$/.test(X.providerState)))return;return X}var O6="commonAuthProviderState";function y(X){return X!=null&&typeof X==="object"&&!Array.isArray(X)}var uL=new Set(["__proto__","constructor","prototype"]);function v1(X){if(typeof X!=="string"||X.length===0)return"id must be non-empty";if(X.trim()!==X)return"id must not carry surrounding whitespace";if(uL.has(X))return"id is a reserved object key";return}function B5(X){let J=typeof X==="string"?X.trim():"";if(!J)return!1;try{let $=new URL(J);return($.protocol==="http:"||$.protocol==="https:")&&!$.username&&!$.password}catch{return!1}}function jQ(X){return X.type==="oauth"?`oauth\x00${X.refresh}`:`api\x00${X.apiKey}`}function Y8(X){return h4("sha256").update(jQ(X)).digest("hex")}function T8(X){return h4("sha256").update(`credential-stamp\x00${jQ(X)}`).digest("hex")}function o8(X){let J=X.type==="oauth"?["oauth",typeof X.access==="string"?X.access:null,X.refresh,typeof X.expires==="number"&&Number.isFinite(X.expires)?X.expires:null]:["api",X.apiKey,X.baseURL.trim(),X.authHeader??"authorization-bearer"];return h4("sha256").update(`credential-dispatch\x00${JSON.stringify(J)}`).digest("hex")}function H5(X,J,$,Y={}){return{credentialEpoch:J,digest:T8(X),dispatch:o8(X),binding:{...$},...Y.replace?{replace:!0}:{},...Y.providerState!==void 0?{providerState:Y.providerState}:{}}}function y1(X,J){let $=X?.credentialBound?X.credentialBound(J):J;return h4("sha256").update(`provider-state\x00${JSON.stringify($??null)}`).digest("hex")}function g4(X,J,$,Y){if(!J||$===void 0)return;if(!y(X)||!Object.hasOwn(X,O6))return;let G=b6(X[_0]);if(!G||G.providerState===void 0||G.digest!==T8(J)||G.credentialEpoch!==$||G.binding?.identity!==Y)return;return G.providerState}function Y6(X){return Number.isSafeInteger(X)&&X>=1}function b6(X){if(!y(X))return;let J=X.credentialEpoch;if(!Y6(J))return;if(typeof X.digest!=="string")return;if("dispatch"in X&&typeof X.dispatch!=="string")return;if("replace"in X&&X.replace!==!0)return;if("providerState"in X&&typeof X.providerState!=="string")return;let $="staged"in X?mL(X.staged):void 0;if("staged"in X&&!$)return;let Y={...$?{staged:$}:{},...typeof X.dispatch==="string"?{dispatch:X.dispatch}:{},...X.replace===!0?{replace:!0}:{},...typeof X.providerState==="string"?{providerState:X.providerState}:{}};if(!("binding"in X))return"dispatch"in X||"replace"in X||"providerState"in X||"staged"in X?void 0:{credentialEpoch:J,digest:X.digest};let G=X.binding;if(!y(G))return;if("identity"in G&&(typeof G.identity!=="string"||!G.identity))return;if("baseURL"in G&&!B5(G.baseURL))return;if("authHeader"in G&&G.authHeader!=="authorization-bearer"&&G.authHeader!=="x-api-key")return;return{credentialEpoch:J,digest:X.digest,...Y,binding:{...typeof G.identity==="string"?{identity:G.identity}:{},...typeof G.baseURL==="string"?{baseURL:G.baseURL.trim()}:{},...G.authHeader==="authorization-bearer"||G.authHeader==="x-api-key"?{authHeader:G.authHeader}:{}}}}function pL(X,J,$){if(X.identity!==$)return!1;if(X.baseURL!==void 0&&(J.type!=="api"||J.baseURL!==X.baseURL))return!1;if(X.authHeader!==void 0&&(J.type!=="api"||J.authHeader!==X.authHeader))return!1;return!0}function cL(X,J,$,Y){if(!X)return"none";if(!y(Y)||!Object.hasOwn(Y,_0))return"missing";let G=b6(Y[_0]);if(!G)return"malformed";if(G.digest!==T8(X))return"mismatched";if(G.dispatch===void 0)return"legacy";if(G.credentialEpoch!==J)return"mismatched";if(!G.binding||!pL(G.binding,X,$))return"mismatched";if(G.dispatch!==o8(X))return"mismatched";return"bound"}function NQ(X){if(!X.exists)return{status:"ready",exists:!1,config:{}};if("parseError"in X)return{status:"error",reason:"config file is not valid JSON"};let J=X.value;if(!y(J))return{status:"error",reason:"config root is not an object"};if("accounts"in J&&!Array.isArray(J.accounts))return{status:"error",reason:"config accounts is not an array"};if(!(E0 in J))return Array.isArray(J.accounts)?{status:"pending-migration",config:J}:{status:"ready",exists:!0,config:J};let $=J[E0];if(!y($))return{status:"error",reason:`${E0} is not an object`};let Y=$.schemaVersion;if(typeof Y!=="number"||!Number.isInteger(Y)||Y<1)return{status:"error",reason:`${E0}.schemaVersion is invalid`};if(Y>D9)return{status:"error",reason:`${E0}.schemaVersion ${Y} is newer than ${D9}`};if($8 in $&&!y($[$8]))return{status:"error",reason:`${E0}.${$8} is not an object`};return{status:"ready",exists:!0,config:J}}function qQ(X){if(!X.exists)return{status:"ready",exists:!1,state:{}};if("parseError"in X)return{status:"error",reason:"state file is not valid JSON"};if(!y(X.value))return{status:"error",reason:"state root is not an object"};if("accounts"in X.value&&!y(X.value.accounts))return{status:"error",reason:"state accounts is not an object"};return{status:"ready",exists:!0,state:X.value}}function h1(X){return Array.isArray(X.accounts)?X.accounts:[]}function LQ(X){let J=X[E0];if(!y(J))return{};let $=J[$8];return y($)?$:{}}function lL(X){return y(X.accounts)?X.accounts:{}}function dL(X){if(!y(X))return"not an object";let J=v1(X.id);if(J)return J;if(X.type==="api")return B5(X.baseURL)?void 0:"invalid baseURL";if(X.type==="oauth")return;return"unknown type"}function iL(X,J){if(!y(X))return;let $=X.credentialEpoch;if(!Y6($))return;if("needsFirstReading"in X&&typeof X.needsFirstReading!=="boolean")return;if("disabledReason"in X&&typeof X.disabledReason!=="string")return;if("quota"in X&&!J.validate(X.quota))return;if("staged"in X&&!KQ(X.staged))return;return{credentialEpoch:$,needsFirstReading:X.needsFirstReading===!0,...typeof X.disabledReason==="string"?{disabledReason:X.disabledReason}:{},..."quota"in X?{quota:X.quota}:{}}}function nL(X,J){if(!y(J))return;if(X.type==="api"){let Y=typeof J.apiKey==="string"?J.apiKey.trim():"";if(!Y)return;return{type:"api",apiKey:Y,baseURL:String(X.baseURL).trim(),authHeader:X.authHeader==="x-api-key"?"x-api-key":"authorization-bearer"}}if(X.corrupt===!0)return;let $=J.refresh;if(typeof $!=="string"||!$.trim())return;return{type:"oauth",refresh:$,...typeof J.access==="string"?{access:J.access}:{},...typeof J.expires==="number"?{expires:J.expires}:{},...typeof J.lastRefreshedAt==="number"?{lastRefreshedAt:J.lastRefreshedAt}:{}}}function U2(X,J){return h1(X).find(($)=>y($)&&$.id===J)}function DQ(X){if(!y(X[E0]))X[E0]={};return X[E0]}function V5(X){let J=DQ(X);if(!y(J[$8]))J[$8]={};return J[$8]}function F9(X,J){let $=LQ(X),Y=Object.hasOwn($,J)?$[J]:void 0;return y(Y)?Y:void 0}function K2(X,J,$){Object.defineProperty(V5(X),J,{value:$,enumerable:!0,writable:!0,configurable:!0})}function FQ(X,J){let $=X[E0];if(!y($))return;let Y=$[V2];if(!y(Y)||!Object.hasOwn(Y,J))return;let G=Y[J];return Y6(G)?G:void 0}function PQ(X,J){let $=F9(X,J)?.credentialEpoch;return Y6($)?$:void 0}function j2(X,J){return Math.max(FQ(X,J)??0,PQ(X,J)??0)+1}function OQ(X,J){let $=[...J];if($.length===0)return;let Y=DQ(X),G=y(Y[V2])?Y[V2]:{},Q={},z=(Z,W)=>Object.defineProperty(Q,Z,{value:W,enumerable:!0,writable:!0,configurable:!0});for(let[Z,W]of Object.entries(G))if(Y6(W))z(Z,W);for(let Z of $)z(Z,Math.max(FQ(X,Z)??0,PQ(X,Z)??1));Y[V2]=Q}function P9(X,J,$,Y){let G=LQ(X),Q=lL(J),z=new Set,Z=[];for(let W of h1(X)){let B=dL(W),H=y(W)&&typeof W.id==="string"?W.id:void 0,U=H===void 0?void 0:G[H],j=y(U)&&Object.hasOwn(U,"staged"),N=j?KQ(U.staged):void 0;if(B||!y(W)||H===void 0||z.has(H)){if(H!==void 0&&!z.has(H))z.add(H);if(H!==void 0)Z.push({id:H,type:y(W)&&W.type==="api"?"api":"oauth",enabled:!1,needsFirstReading:!0,hasEntry:Object.hasOwn(G,H),candidate:!1,invalid:"roster",stamp:"none",...N?{staged:N}:{}});continue}z.add(H);let K=W.type==="api"?"api":"oauth",q=Object.hasOwn(G,H),F=q?iL(G[H],$):void 0,O=nL(W,Q[H]),_=W.enabled!==!1,C=F?F.credentialEpoch:q?void 0:1,L=typeof W.accountId==="string"&&W.accountId?W.accountId:void 0,P={id:H,type:K,enabled:_,needsFirstReading:F?F.needsFirstReading:K==="oauth",hasEntry:q,candidate:!1,...typeof W.label==="string"?{label:W.label}:{},...typeof W.addedAt==="number"?{addedAt:W.addedAt}:{},...L!==void 0?{identity:L}:{},...O?{credential:O,fingerprint:Y8(O)}:{},...F?{credentialEpoch:F.credentialEpoch}:{},...N?{staged:N}:{},...F?.disabledReason!==void 0?{disabledReason:F.disabledReason}:{},...F&&"quota"in F?{quota:F.quota}:{},...sL(Q[H],O,C,L,Y),stamp:cL(O,C,L,Q[H])};if(q&&!F)P.invalid="entry";else P.candidate=_&&O!==void 0&&!j;Z.push(P)}return Z}function sL(X,J,$,Y,G){if(!y(X)||!Object.hasOwn(X,O6))return{};let Q=g4(X,J,$,Y);if(Q===void 0)return{providerStateDropped:"uncovered"};let z=X[O6];if(!G?.validate(z))return{providerStateDropped:"invalid"};if(y1(G,z)!==Q)return{providerStateDropped:"uncovered"};return{providerState:z}}function x0(X){return X.identity??X.id}function m4(X,J){if(X===void 0||X>J+W5)return J;return Math.max(J,X+1)}function U5(X,J){return m4(X,J)>J+W5}function f1(X){let{id:J,credential:$,identity:Y,label:G,addedAt:Q}=X;return{id:J,...G!==void 0?{label:G}:{},type:$.type,addedAt:Q,...Y!==void 0?{accountId:Y}:{},...$.type==="api"?{baseURL:$.baseURL.trim(),authHeader:$.authHeader??"authorization-bearer"}:{}}}function MQ(X,J){if(X.type==="api")return{apiKey:X.apiKey};return{...X.access!==void 0?{access:X.access}:{},refresh:X.refresh,...X.expires!==void 0?{expires:X.expires}:{},...J!==void 0?{lastRefreshedAt:J}:{}}}function _Q(X,J){if(X.type==="api")return{...X,baseURL:X.baseURL.trim(),authHeader:X.authHeader??"authorization-bearer"};return{...X,...J!==void 0?{lastRefreshedAt:J}:{}}}function AQ(X,J={}){if(!y(X))return"credential must be an object";if(X.type==="oauth"){if(typeof X.refresh!=="string"||!X.refresh.trim())return"oauth credential needs a refresh token";return}if(X.type==="api"){if(typeof X.apiKey!=="string"||!X.apiKey.trim())return"api credential needs an api key";if(X.apiKey.trim()!==X.apiKey)return"api key must not carry surrounding whitespace";if(!(J.baseURLOptional&&X.baseURL===void 0)&&!B5(X.baseURL))return"api credential needs a valid baseURL";return}return"credential type must be oauth or api"}var N2="transition",TQ="transitionMark";function aL(X){if(!y(X))return;let J=X[N2];if(!y(J))return;if(typeof J.mark!=="string"||J.mark.length===0)return;if(J.enabled===!0)return{mark:J.mark,enabled:!0};if(J.enabled===!1&&typeof J.reason==="string")return{mark:J.mark,enabled:!1,reason:J.reason};return}function u4(X,J,$){if($.enabled)y4(X,J);else q9(X,J,$.reason??"");if(!X.rosterRow(J))return;let Y=X.entry(J)??{credentialEpoch:1,needsFirstReading:!0};if(X.setEntry(J,{...Y,[TQ]:$.mark}),!$.enabled)return;let G=X.rows().find((Q)=>Q.id===J);if(G?.type==="oauth"&&G.identity!==void 0)w1(X,G.identity)}function oL(X,J){if(X.type!=="api")return X;return{...X,...J.baseURL!==void 0?{baseURL:J.baseURL}:{},...J.authHeader!==void 0?{authHeader:J.authHeader}:{}}}function rL(X){if(!X.binding)return!1;return X.replace===!0||X.dispatch===void 0}function tL(X,J,$,Y={}){let G=y(J.accounts)?J.accounts:{},Q=new Map;for(let z of P9(X,J,$)){if(z.invalid||z.staged||!z.credential)continue;let Z=Object.hasOwn(G,z.id)?G[z.id]:void 0;if(!y(Z))continue;let W=b6(Z[_0]);if(!W?.binding)continue;if(W.digest!==T8(z.credential))continue;let B=z.credentialEpoch??1;if(W.credentialEpoch>B){if(!rL(W))continue;if(Y.requireCredentialStamps){if(W.dispatch===void 0)continue;if(W.dispatch!==o8(oL(z.credential,W.binding)))continue}Q.set(z.id,{kind:"replace",stamp:{...W,binding:W.binding}})}else if(W.credentialEpoch===B&&W.dispatch!==void 0&&W.dispatch===o8(z.credential)&&W.binding.identity!==void 0&&z.identity===void 0)Q.set(z.id,{kind:"identity",identity:W.binding.identity});else if(W.credentialEpoch===B&&W.binding.identity===z.identity){if(Y.requireCredentialStamps&&W.dispatch!==o8(z.credential))continue;let H=aL(Z[_0]);if(H&&F9(X,z.id)?.[TQ]!==H.mark)Q.set(z.id,{kind:"transition",transition:H})}}return Q}function K5(X,J,$,Y){let Q={...X.entry(J)??{},credentialEpoch:$,needsFirstReading:!0};if(delete Q.quota,Y.identity!==void 0&&typeof Q.disabledReason==="string"&&Q.disabledReason.startsWith(x1))delete Q.disabledReason;X.setEntry(J,Q);let z=X.rosterRow(J);if(!z)return;if(Y.identity!==void 0)z.accountId=Y.identity;else delete z.accountId;if(Y.baseURL!==void 0)z.baseURL=Y.baseURL;if(Y.authHeader!==void 0)z.authHeader=Y.authHeader}function j5(X,J,$,Y={}){let G=tL(X,J,$,Y);if(G.size===0)return{config:X,torn:[]};let Q=structuredClone(X),z={rows:()=>P9(Q,J,$),rosterRow:(Z)=>U2(Q,Z),entry:(Z)=>F9(Q,Z),setEntry:(Z,W)=>K2(Q,Z,W)};for(let[Z,W]of G)if(W.kind==="replace")K5(z,Z,W.stamp.credentialEpoch,W.stamp.binding);for(let[Z,W]of G)if(W.kind==="identity")c9(z,Z,W.identity);else if(W.kind==="transition")u4(z,Z,W.transition);else if(W.stamp.binding.identity!==void 0)w1(z,W.stamp.binding.identity);return{config:Q,torn:[...G.keys()]}}function N5(X,J,$,Y={}){let{config:G,torn:Q}=j5(X,J,$,Y),z=P9(G,J,$,Y.providerState);for(let Z of z){if(Q.includes(Z.id))Z.torn=!0,Z.candidate=!1;if(Y.requireCredentialStamps&&Z.stamp!=="bound")Z.unbound=!0,Z.candidate=!1}return z}async function q5(X){try{return await eL(X,"utf8")}catch(J){if(J.code==="ENOENT")return;throw J}}function RQ(X){if(X===void 0)return{exists:!1};try{return{exists:!0,value:JSON.parse(X)}}catch(J){return{exists:!0,parseError:J}}}async function _6(X){for(let J=0;J<3;J++){let $=await q5(X.configPath),Y=await q5(X.statePath),G=await q5(X.configPath);if($!==G){if(J<2)await XD(2+Math.floor(Math.random()*4));continue}let Q=NQ(RQ($));if(Q.status==="error")return{status:"error",file:"config",reason:Q.reason};let z=qQ(RQ(Y));if(z.status==="error")return{status:"error",file:"state",reason:z.reason};if(Q.status==="pending-migration")return{status:"pending-migration",config:Q.config};return{status:"ready",configExists:Q.exists,stateExists:z.exists,config:Q.config,state:z.state,rows:N5(Q.config,z.state,X.codec,{requireCredentialStamps:X.requireCredentialStamps===!0,...X.providerState?{providerState:X.providerState}:{}})}}return{status:"error",file:"config",kind:"snapshot-contended",retryable:!0,reason:"The store was changing; retry the operation once writes settle."}}function G8(X,J,$,Y="before-first-write"){if(X.status==="error"&&X.kind==="snapshot-contended")return new K0({operation:J,...$!==void 0?{rowId:$}:{},phase:Y,kind:"snapshot-contended",retryable:!0,message:X.reason});return new K0({operation:J,...$!==void 0?{rowId:$}:{},phase:Y,retryable:!1,kind:X.status==="pending-migration"?"pending-migration":"load-error",message:X.status==="pending-migration"?"the config holds a legacy roster that has not been migrated into the pool":`${X.file} file cannot be loaded: ${X.reason}`})}class IQ{ctx;snapshot;locks;progress;info;config;state;constructor(X,J,$,Y,G){this.ctx=X,this.snapshot=J,this.locks=$,this.progress=Y,this.info=G,this.config=structuredClone(J.config),this.state=structuredClone(J.state)}rows(){return N5(this.config,this.state,this.ctx.codec,{requireCredentialStamps:this.ctx.requireCredentialStamps===!0,...this.ctx.providerState?{providerState:this.ctx.providerState}:{}})}row(X){return this.rows().find((J)=>J.id===X)}reservation(X){if(this.rosterRow(X)){let $=this.entry(X);return $&&Object.hasOwn($,"staged")?$.staged:void 0}let J=this.stateAccount(X)?.[_0];return y(J)&&Object.hasOwn(J,"staged")?J.staged:void 0}assertNotStaged(X){l9(this.info.operation,X,this.reservation(X))}roster(){if(!Array.isArray(this.config.accounts))this.config.accounts=[];return this.config.accounts}rosterRow(X){return this.roster(),U2(this.config,X)}dropRosterRows(X){let J=this.roster(),$=J.filter((Y)=>!(y(Y)&&Y.id===X));return this.config.accounts=$,J.length-$.length}entries(){return V5(this.config)}entry(X){return this.entries(),F9(this.config,X)}setEntry(X,J){K2(this.config,X,J)}async completeTorn(){let{config:X,torn:J}=j5(this.config,this.state,this.ctx.codec,{requireCredentialStamps:this.ctx.requireCredentialStamps===!0});if(J.length===0)return;this.config=X,await this.commitConfig({counted:!1})}stateAccount(X){let J=y(this.state.accounts)?this.state.accounts:{},$=Object.hasOwn(J,X)?J[X]:void 0;return y($)?$:void 0}dropStateAccount(X){if(y(this.state.accounts)&&Object.hasOwn(this.state.accounts,X))delete this.state.accounts[X]}setStateAccount(X,J){if(!y(this.state.accounts))this.state.accounts={};Object.defineProperty(this.state.accounts,X,{value:J,enumerable:!0,writable:!0,configurable:!0})}async commitConfig(X={}){let J=this.roster(),$=new Set;for(let W of J)if(y(W)&&typeof W.id==="string")$.add(W.id);let Y=new Set;for(let W of h1(this.snapshot.config))if(y(W)&&typeof W.id==="string"&&!$.has(W.id))Y.add(W.id);for(let W of Object.keys(this.entries()))if(!$.has(W))Y.add(W);OQ(this.config,Y);let G=this.entries(),Q={};for(let[W,B]of Object.entries(G))if($.has(W))Object.defineProperty(Q,W,{value:B,enumerable:!0,writable:!0,configurable:!0});let z=this.config[E0],Z={...this.config,version:f4,accounts:J,[E0]:{...z,schemaVersion:D9,[$8]:Q}};await this.write(this.ctx.configPath,Z,"config",X.counted??!0,X.durable??!1,()=>{if(X.publicationDecision)this.markPublicationDecision();for(let W of Y)this.ctx.removedIds.add(W);this.config=Z}),this.config=Z}async commitState(X,J={}){let $={...this.state,version:f4,accounts:y(this.state.accounts)?this.state.accounts:{}};if(await this.write(this.ctx.statePath,$,"state",!0,J.durable??!1),this.state=$,X)this.progress.committed=X}async assertAll(){await this.locks.assertAll()}async syncState(){await this.assertAll();try{if(this.snapshot.stateExists)await L5(this.ctx.statePath)}catch(X){throw new K0({operation:this.info.operation,rowId:this.info.rowId,phase:"before-first-write",kind:"publication-sync",retryable:!0,message:"Publication sync failed before the decision; nothing was written. Retry the same plan.",cause:X})}}markPublicationDecision(){this.progress.publicationDecided=!0}async syncConfig(){await this.assertAll(),await L5(this.ctx.configPath)}async write(X,J,$,Y=!0,G=!1,Q){await EQ(X,J,{durable:G,beforeRename:async()=>{await this.ctx.onStep?.(`before-${$}-write`,this.info),await this.locks.assertAll()}},()=>{if(Y)this.progress.writes++;Q?.()}),await this.ctx.onStep?.(`after-${$}-write`,this.info)}}async function bQ(X,J){let $=new L9(X.lockDefaults,X.lockEnv),Y={writes:0};try{for(let Z of X.storeLocks)await $.acquire(Z);let G=await _6(X);if(G.status==="error")throw G8(G,"initialize",void 0);if(G.status==="ready")return"already-ready";let Q={};for(let[Z,W]of Object.entries(G.config))if(!J.includes(Z))Q[Z]=W;Q.version=f4,Q[E0]={schemaVersion:D9,[$8]:{}};let z={operation:"initialize",rowId:void 0};return await M6(X.configPath,Q,{beforeRename:async()=>{await X.onStep?.("before-config-write",z),await $.assertAll()}}),Y.writes++,await X.onStep?.("after-config-write",z),"initialized"}catch(G){throw g1(G,"initialize",void 0,Y)}finally{await $.releaseAll()}}async function s0(X,J,$,Y,G,Q={}){let z=J.held.length;try{for(let B of X.storeLocks)await J.acquire(B);let Z=await _6(X);if(Z.status!=="ready")throw G8(Z,Y.operation,Y.rowId,$.writes>0?"after-first-write":"before-first-write");let W=new IQ(X,Z,J,$,Y);if(Y.rowId!==void 0&&!["add","remove","pull","publishRoster","enable","disable"].includes(Y.operation))W.assertNotStaged(Y.rowId);if(Q.completeTorn??!0)await W.completeTorn();return await G(W)}finally{await J.releaseTo(z)}}function g1(X,J,$,Y){let G=J==="pull"?"pull":Y.writes>0?"after-first-write":"before-first-write",Q=G==="after-first-write"?Y.committed:void 0;if(J==="publishRoster"&&Y.publicationDecided)return new K0({operation:J,...$!==void 0?{rowId:$}:{},phase:G,kind:"publication-incomplete",retryable:!0,message:"The publication may already be decided. Replay the same plan or check publication(operationId).",cause:X});if(J==="publishRoster"&&X instanceof CQ)return new K0({operation:J,...$!==void 0?{rowId:$}:{},phase:G,kind:"publication-sync",retryable:!0,message:"Publication sync failed before the decision; nothing was written. Retry the same plan.",cause:X});if(X instanceof K0){if(X.phase===G&&X.rowId===$&&X.operation===J&&X.committed===Q)return X;return new K0({operation:J,...$!==void 0?{rowId:$}:{},phase:X.kind==="after-persist-hook"?X.phase:G,retryable:X.retryable,kind:X.kind,...X.committed??Q?{committed:X.committed??Q}:{},message:X.message,...X.cause!==void 0?{cause:X.cause}:{}})}let z={operation:J,...$!==void 0?{rowId:$}:{},phase:G,...Q?{committed:Q}:{},cause:X};if(X instanceof SQ)return new K0({...z,retryable:!0,kind:"lock-ownership",message:G==="after-first-write"?`${J} lost a lease after its first write; the intermediate stays on disk`:`${J} lost a lease before writing; nothing was written`});if(X instanceof H2)return new K0({...z,retryable:!0,kind:"lock-contention",message:X.message});return new K0({...z,retryable:!1,kind:"unexpected",message:X instanceof Error?X.message:String(X)})}async function H6(X,J,$,Y,G){let Q=new L9(X.lockDefaults,X.lockEnv),z={writes:0};try{return await G(Q,z)}catch(Z){let W=g1(Z,J,$,z);if(W.kind!=="after-persist-hook")await UQ(J,Y,$,W,X.logger);throw W}finally{await Q.releaseAll()}}function g6(X,J){return{...X.rowLockOptions,name:`row-${encodeURIComponent(x0(J))}`,path:X.ctx.statePath}}async function r8(X,J,$){let Y=await _6(X.ctx);if(Y.status!=="ready")throw G8(Y,J,$);let G=Y.rows.find((B)=>B.id===$),Q=F9(Y.config,$),z=Y.state.accounts,Z=y(z)&&Object.hasOwn(z,$)?z[$]:void 0,W=y(Z)?Z[_0]:void 0;if(G&&!["enable","disable"].includes(J)&&Q&&Object.hasOwn(Q,"staged"))l9(J,$,Q.staged);if(!G&&y(W)&&Object.hasOwn(W,"staged"))l9(J,$,W.staged);if(!G)throw Q8(J,$);return{result:Y,row:G}}function Q8(X,J){return new K0({operation:X,rowId:J,phase:X==="pull"?"pull":"before-first-write",retryable:!1,kind:"unknown-row",message:`no row ${J} in the pool`})}function A6(X,J){if(J.unbound)throw x(X,J.id,"unbound-credential",`row ${J.id}'s credential is not the one this store stamped for it (stamp ${J.stamp}); replace it with fresh material`)}function x(X,J,$,Y,G=!1){return new K0({operation:X,rowId:J,phase:X==="pull"?"pull":"before-first-write",retryable:G,kind:$,message:Y})}async function q2(X,J,$,Y){let{ctx:G}=X,Q=new L9(G.lockDefaults,G.lockEnv),z={writes:0};try{if(!Y6($?.credentialEpoch))throw x("pull",J,"invalid-input","the credential epoch the reading was issued for must be a positive safe integer");await s0(G,Q,z,{operation:"pull",rowId:J},async(Z)=>{Z.assertNotStaged(J);let W=Z.row(J);if(!W)throw Q8("pull",J);if(W.invalid)throw x("pull",J,"invalid-row",`row ${J} is invalid`);if(!W.credential)throw x("pull",J,"no-credential",`row ${J} holds no credential`);A6("pull",W);let B=Z.entry(J);if(W.torn||!B||B.credentialEpoch!==$.credentialEpoch||W.identity!==$.identity)throw new K0({operation:"pull",rowId:J,phase:"pull",retryable:!0,kind:"attribution",message:`quota for ${J} was issued for a credential the row no longer holds`});let H=G.codec.merge(B.quota,Y);if(!G.codec.validate(H))throw x("pull",J,"invalid-quota","the quota codec rejected the merged map");Z.setEntry(J,{...B,quota:H,needsFirstReading:!1}),await Z.commitConfig()},{completeTorn:!1})}catch(Z){throw g1(Z,"pull",J,z)}finally{await Q.releaseAll()}}function t8(X,J,$,Y,G="the provider state"){if(!X)throw x(J,$,"invalid-input","the store was opened without a provider-state codec");let Q;try{let z=JSON.stringify(Y);Q=z===void 0?void 0:JSON.parse(z)}catch{Q=void 0}if(Q===void 0)throw x(J,$,"invalid-provider-state",`${G} cannot be stored as JSON`);if(!X.validate(Q))throw x(J,$,"invalid-provider-state",`the provider-state codec rejected ${G}`);return Q}function p4(X,J,$,Y,G){if(Y===void 0||!X?.merge)return{kind:"set",value:G};return{kind:"set",value:t8(X,J,$,X.merge(structuredClone(Y),structuredClone(G)),"the merged provider state")}}function kQ(X,J,$,Y,G){let Q=X?.onReplace,z=Q?Q(J.providerState===void 0?void 0:structuredClone(J.providerState),{id:J.id,credentialEpoch:$,...J.identity!==void 0?{previousIdentity:J.identity}:{},...Y!==void 0?{identity:Y}:{},...G!==void 0?{incoming:structuredClone(G)}:{}}):G;if(z===void 0)return{kind:"clear"};if(!Q)return{kind:"set",value:z};return{kind:"set",value:t8(X,"replace",J.id,z,"the provider state onReplace returned")}}function xQ(X,J,$,Y,G){if(J.kind==="set")return y1(X,J.value);if(J.kind==="clear")return;return g4($,Y?.credential,G,Y?.identity)}async function wQ(X,J,$,Y,G={}){B6("updateProviderState");let{ctx:Q}=X,z="updateProviderState";return H6(Q,z,J,G.onFailure,async(Z,W)=>{let B=Q.providerState;if(!B)throw x(z,J,"invalid-input","the store was opened without a provider-state codec");if(typeof Y!=="function")throw x(z,J,"invalid-input","a mutator is required");let H=y($)?$.credentialEpoch:void 0;if(!Y6(H))throw x(z,J,"invalid-input","the credential epoch the provider state was read at is required");let{row:U}=await r8(X,z,J);await Z.acquire(g6(X,U));for(let j of G.extraLocks??[])await Z.acquire(j);return s0(Q,Z,W,{operation:z,rowId:J},async(j)=>{let N=j.row(J);if(!N)throw Q8(z,J);if(x0(N)!==x0(U))throw x(z,J,"row-key-changed",`row ${J}'s wire identity changed while its lock was being taken`,!0);if(N.invalid)throw x(z,J,"invalid-row",`row ${J} failed validation`);if(!N.credential)throw x(z,J,"no-credential",`row ${J} holds no credential`);if(A6(z,N),(N.credentialEpoch??1)!==H||N.identity!==$.identity)throw x(z,J,"attribution",`the provider state for ${J} was read for a credential or account the row no longer holds`,!0);let q=await D5(j,B,z,N,Y);if(q.kind!=="changed")return{id:J,outcome:"unchanged",...q.kind==="unchanged"&&q.value!==void 0?{providerState:q.value}:{}};return j.setStateAccount(J,q.account),await j.commitState(),q.value===void 0?{id:J,outcome:"cleared"}:{id:J,outcome:"updated",providerState:q.value}})})}var vQ=Symbol.for("@cortexkit/common-auth/store/decline-transition");async function D5(X,J,$,Y,G,Q=!1){let{id:z,credential:Z}=Y;if(!Z)throw x($,z,"no-credential",`row ${z} holds no credential`);let W=Y.credentialEpoch??1,B=X.stateAccount(z),H=B?.[_0],U=b6(H);if(!y(H)||!U?.binding||U.digest!==T8(Z)||U.credentialEpoch!==W||U.binding.identity!==Y.identity)throw x($,z,"unbound-credential",`row ${z}'s credential carries no stamp of this store to bind a provider state to (stamp ${Y.stamp}); rotate or replace it first`);let j=Y.providerState===void 0?void 0:structuredClone(Y.providerState),N=await A8($,()=>G(j,Y));if(Q&&N===vQ)return{kind:"declined"};let K=N===void 0?void 0:t8(J,$,z,N,"the provider state the mutator returned"),q=B!==void 0&&Object.hasOwn(B,O6);if(K===void 0?!q:Y.providerState!==void 0&&JSON.stringify(Y.providerState)===JSON.stringify(K))return{kind:"unchanged",...K!==void 0?{value:K}:{}};let F={...B};if(K===void 0){delete F[O6];let O={...H};delete O.providerState,F[_0]=O}else{F[O6]=K;let O=y1(J,K);if(U.providerState!==O)F[_0]={...H,providerState:O}}return{kind:"changed",...K!==void 0?{value:K}:{},account:F}}import{randomUUID as yQ}from"node:crypto";async function P2(X,J,$){if(!$)return;let Y=X.rows().map((Q)=>{let{id:z,type:Z,label:W,enabled:B,disabledReason:H,identity:U,credentialEpoch:j,stamp:N,staged:K,torn:q,invalid:F}=Q;return{id:z,type:Z,label:W,enabled:B,disabledReason:H,identity:U,credentialEpoch:j,stamp:N,staged:K,torn:q,invalid:F}}),G=await A8(X.info.operation,()=>$({id:J,row:Y.find((Q)=>Q.id===J),rows:Y,config:structuredClone(X.snapshot.config)}));if(G!==void 0)throw x(X.info.operation,J,"row-protected",G)}var JD=["access","refresh","expires","lastRefreshedAt","apiKey"];function $D(X){return{baseURL:String(X.baseURL).trim(),authHeader:X.authHeader==="x-api-key"?"x-api-key":"authorization-bearer"}}function YD(X,J,$){if($.type!=="api")return $;let Y=X.rosterRow(J);if(!y(Y)){if($.baseURL===void 0)throw x(X.info.operation,J,"invalid-input","api credential needs a valid baseURL");return{...$,baseURL:$.baseURL}}let G=X.row(J)?.credential,Q=G?.type==="api"?{baseURL:G.baseURL.trim(),authHeader:G.authHeader??"authorization-bearer"}:$D(Y),z=$.baseURL?.trim()??Q.baseURL,Z=$.authHeader??Q.authHeader;if(z!==Q.baseURL||Z!==Q.authHeader)throw x(X.info.operation,J,"endpoint-mismatch",`row ${J} sends its key to another endpoint or header; a key for another endpoint is a replacement`);return{...$,baseURL:z,authHeader:Z}}function hQ(X,J,$,Y){let G=X.rosterRow(J),Q=X.row(J),z=Y??(Q?Q.identity:y(G)&&typeof G.accountId==="string"&&G.accountId?G.accountId:void 0);return{...z!==void 0?{identity:z}:{},...$.type==="api"?{baseURL:$.baseURL,authHeader:$.authHeader??"authorization-bearer"}:{}}}function L2(X,J,$,Y,G={}){let Q=YD(J,$,Y),z=J.stateAccount($),Z=G.providerState??{kind:"keep"},W=J.row($)?.credentialEpoch??J.entry($)?.credentialEpoch,B=typeof W==="number"?W:1,H=xQ(X.ctx.providerState,Z,z,z&&Object.hasOwn(z,O6)?J.row($):void 0,B),U=typeof z?.lastRefreshedAt==="number"?z.lastRefreshedAt:void 0,j=Q.type==="oauth"?G.stamp??m4(U,X.ctx.now()):void 0,N={...z??{}};for(let F of JD)delete N[F];if(G.clearErrors)delete N.lastRefreshError,delete N.lastQuotaRefreshError,delete N.quota;if(Z.kind==="clear")delete N[O6];else if(Z.kind==="set")N[O6]=Z.value;let K=_Q(Q,j),q={...N,...MQ(Q,j),[_0]:{...G.staged?{staged:G.staged}:{},...G.transition!==void 0?{[N2]:G.transition}:{},...H5(K,B,G.binding??hQ(J,$,K,G.identity),{replace:G.binding!==void 0,...H!==void 0?{providerState:H}:{}})}};return{stored:K,account:q}}async function D2(X,J,$){return X.setStateAccount(J,$.account),await X.commitState($.stored),$.stored}async function O2(X,J,$,Y,G={}){return D2(J,$,L2(X,J,$,Y,G))}async function GD(X,J,$){if(!J.credential||J.stamp!=="bound")return;let Y=X.stateAccount(J.id),G=g4(Y,J.credential,J.credentialEpoch??1,J.identity);X.setStateAccount(J.id,{...Y??{},[_0]:H5(J.credential,J.credentialEpoch??1,hQ(X,J.id,J.credential,$),G!==void 0?{providerState:G}:{})}),await X.commitState()}function P5(X,J,$){let Y=X==="add"?v1(J):void 0;if(Y)throw x(X,J,"invalid-input",Y);let G=AQ($,{baseURLOptional:X==="rotate"});if(G)throw x(X,J,"invalid-input",G)}function M2(X,J,$,Y){if(!$)throw Q8(X,J);if($.invalid)throw x(X,J,"invalid-row",`row ${J} failed validation`);if(Y&&Y.type!==$.type)throw x(X,J,"type-mismatch",`row ${J} holds a ${$.type} credential`);return $}function u1(X,J,$){if($!==void 0&&!Y6(y($)?$.credentialEpoch:void 0))throw x(X,J,"invalid-input","the attribution must name a credential epoch that is a positive safe integer")}function _2(X,J,$,Y){if(!$)throw Q8(X,J);if($.invalid)throw x(X,J,"invalid-row",`row ${J} failed validation`);if(($.credentialEpoch??1)!==Y.credentialEpoch||$.identity!==Y.identity)throw x(X,J,"attribution",`the ${X} of ${J} was issued for a credential or account the row no longer holds`,!0)}function F2(X,J){return x(X,J,"identity-mismatch",`row ${J} is recorded for another account; a credential of a different account is a replacement`)}function c4(X,J){return x(X,J,"row-key-changed",`row ${J}'s wire identity changed while its lock was being taken`,!0)}function QD(X,J,$,Y){let{id:G,credential:Q,identity:z}=$;if(!X.ctx.requireCredentialStamps||J.rosterRow(G)||!m1(J.state,G))return;let Z=()=>{throw x("add",G,"unbound-credential",`orphan ${G} cannot be bound to this add's material; remove it explicitly before adding different material`)},W=J.stateAccount(G),B=b6(W?.[_0]);if(!B?.binding||B.dispatch===void 0||B.replace)return Z();if(Q.type==="api"&&(B.binding.baseURL===void 0||B.binding.authHeader===void 0))return Z();let H=Q.type==="api"?{...Q,baseURL:B.binding.baseURL,authHeader:B.binding.authHeader}:Q,[U]=P9({accounts:[f1({id:G,credential:H,identity:B.binding.identity,addedAt:0})],[E0]:{rows:{[G]:{credentialEpoch:j2(J.config,G)}}}},J.state,X.ctx.codec,X.ctx.providerState);if(!U?.credential||U.invalid||U.stamp!=="bound")return Z();if(z!==void 0&&z!==U.identity)return Z();if(T8(Q)!==B.digest)return Z();if(Q.type==="api"){if(Q.baseURL.trim()!==B.binding.baseURL)return Z();if((Q.authHeader??"authorization-bearer")!==B.binding.authHeader)return Z()}else if(o8(Q)!==B.dispatch)return Z();if(B.providerState!==void 0&&U.providerState===void 0)return Z();if(Y!==void 0&&y1(X.ctx.providerState,Y)!==B.providerState)return Z();return U}function zD(X,J,$,Y){let{id:G,credential:Q,identity:z,label:Z}=$,W=J.rosterRow(G),B=()=>{throw x("add",G,W?"id-exists":"unbound-credential",`row ${G} does not match this staged add`)},H=J.stateAccount(G),U=b6(H?.[_0]),j=U?.staged;if(!U?.binding||!j||U.replace||U.dispatch===void 0)return B();if(W&&(W.type!==Q.type||W.label!==Z||W.accountId!==z))return B();if(j.reservation!==$.stage?.reservation||j.label!==Z||j.disabledReason!==$.disabled?.reason||U.binding.identity!==z)return B();let N=Y===void 0?void 0:d9(Y),K=H?.[O6],q=K===void 0?void 0:d9(K);if(j.providerState!==N||j.providerState!==q)return B();if(T8(Q)!==U.digest||o8(Q)!==U.dispatch)return B();let F=W?J.config:{accounts:[{...f1({id:G,credential:Q.type==="api"?{...Q,baseURL:U.binding.baseURL??"",authHeader:U.binding.authHeader}:Q,identity:U.binding.identity,label:j.label,addedAt:0}),enabled:!1}],[E0]:{rows:{[G]:{credentialEpoch:U.credentialEpoch,disabledReason:j.disabledReason,staged:{reservation:j.reservation}}}}},O=P9(F,J.state,X.ctx.codec,X.ctx.providerState).find((_)=>_.id===G);if(!O?.credential||O.invalid||O.stamp!=="bound"||O.type!==Q.type||O.enabled||O.label!==j.label||O.identity!==U.binding.identity||O.disabledReason!==j.disabledReason||O.staged?.reservation!==j.reservation)return B();if(W)return{id:G,outcome:"exists",credential:O.credential,credentialEpoch:U.credentialEpoch};if(j2(J.config,G)!==U.credentialEpoch)return B();return J.roster().push({...f1({id:G,credential:Q,identity:z,label:Z,addedAt:X.ctx.now()}),enabled:!1}),J.setEntry(G,{credentialEpoch:U.credentialEpoch,needsFirstReading:Q.type==="oauth",disabledReason:j.disabledReason,staged:{reservation:j.reservation}}),J.commitConfig().then(()=>({id:G,outcome:"completed",credential:O.credential,credentialEpoch:U.credentialEpoch}))}async function fQ(X,J,$={}){B6("add");let{ctx:Y}=X,{id:G,credential:Q,identity:z,label:Z}=J,W=J.stage!==void 0||J.disabled!==void 0,B=await H6(Y,"add",G,$.onFailure,async(H,U)=>{P5("add",G,Q);let j=$.onExisting??"rotate";if(J.stage!==void 0&&j==="rotate")throw x("add",G,"invalid-input","a staged add needs onExisting: 'refuse' or 'stage-duplicate'");if(!["rotate","refuse","stage-duplicate"].includes(j)||J.stage!==void 0&&(Z!==void 0&&typeof Z!=="string"||z!==void 0&&(typeof z!=="string"||!z))||J.disabled!==void 0&&(!y(J.disabled)||typeof J.disabled.reason!=="string")||J.stage!==void 0&&(!y(J.stage)||typeof J.stage.reservation!=="string"||!J.stage.reservation||!J.disabled)||j==="stage-duplicate"&&(!J.disabled||!J.stage))throw x("add",G,"invalid-input","staging requires a reservation and a disabled reason");let N=J.providerState===void 0?void 0:t8(Y.providerState,"add",G,J.providerState);if(await H.acquire(g6(X,{id:G,identity:z})),Q.type==="oauth")await H.acquire($.providerLock??X.providerLock);for(let K of $.extraLocks??[])await H.acquire(K);return s0(Y,H,U,{operation:"add",rowId:G},async(K)=>{await P2(K,G,$.protect);let q=y(K.state.accounts)?K.state.accounts:{},F=Object.entries(q).find(([X0,w])=>{if(X0===G||K.rosterRow(X0)||!y(w))return!1;let J0=w[_0];if(!y(J0)||!Object.hasOwn(J0,"staged"))return!1;return Q.type==="oauth"?w.refresh===Q.refresh:typeof w.apiKey==="string"&&w.apiKey.trim()===Q.apiKey.trim()});if(F)throw x("add",F[0],"row-staged",`orphan ${F[0]} reserves this secret until its staged add is replayed or removed`);if(Y.removedIds.has(G))throw x("add",G,"id-removed",`id ${G} was removed from the roster in this process and is not reused`);if(J.stage&&j!=="rotate"&&(K.rosterRow(G)||m1(K.state,G)))return zD(X,K,J,N);if(j==="rotate"){K.assertNotStaged(G);let X0=K.rows().find((w)=>w.fingerprint===Y8(Q));if(X0)K.assertNotStaged(X0.id)}if(j==="refuse"){let X0=K.rows().find((L0)=>L0.fingerprint===Y8(Q)||L0.id===G&&L0.credential),w=y(K.state.accounts)?K.state.accounts:{},J0=Object.entries(w).find(([,L0])=>{if(!y(L0))return!1;if(Q.type==="oauth")return L0.refresh===Q.refresh;return typeof L0.apiKey==="string"&&L0.apiKey.trim()===Q.apiKey.trim()})?.[0],G0=X0?.id??J0??G;if(X0||J0!==void 0||m1(K.state,G))throw x("add",G0,"credential-exists",`row ${G0} already holds this secret or id`)}if(j==="stage-duplicate"&&(K.rosterRow(G)||m1(K.state,G)))throw x("add",G,"id-exists",`row ${G} already exists`);let O=QD(X,K,J,N),_=K.rows(),C=Y8(Q),L=j==="rotate"&&!O&&_.find((X0)=>X0.invalid===void 0&&X0.fingerprint===C);if(L){if(K.assertNotStaged(L.id),A6("add",L),z!==void 0&&L.identity!==void 0&&z!==L.identity)throw F2("add",L.id);let X0=L2(X,K,L.id,Q,{...N!==void 0?{providerState:p4(Y.providerState,"add",L.id,L.providerState,N)}:{}});await K.completeTorn(),K.assertNotStaged(L.id);let w=await D2(K,L.id,X0);return{id:L.id,outcome:"rotated",credential:w,credentialEpoch:L.credentialEpoch??1}}let P=_.find((X0)=>X0.id===G);if(P){if(P.invalid)throw x("add",G,"invalid-row",`row ${G} is invalid`);if(P.credential)throw x("add",G,"id-exists",`row ${G} already holds a credential`);if(A6("add",P),P.type!==Q.type)throw x("add",G,"type-mismatch",`row ${G} is a ${P.type} row`);if(z!==void 0&&P.identity!==void 0&&z!==P.identity)throw F2("add",G);if(!P.hasEntry)K.setEntry(G,{credentialEpoch:1,needsFirstReading:Q.type==="oauth"});let X0=L2(X,K,G,Q,{clearErrors:!0,...N!==void 0?{providerState:{kind:"set",value:N}}:{}});await K.completeTorn();let w=await D2(K,G,X0);if(!P.hasEntry)await K.commitConfig();return{id:G,outcome:"completed",credential:w,credentialEpoch:P.credentialEpoch??1}}let A=j2(K.config,G);if(!Y6(A))throw x("add",G,"id-removed",`id ${G} has held every credential epoch and is not reused; add the credential under another id`);let T=O?.identity??z;K.roster().push(f1({id:G,credential:Q,...T!==void 0?{identity:T}:{},...Z!==void 0?{label:Z}:{},addedAt:Y.now()})),K.setEntry(G,{credentialEpoch:A,needsFirstReading:Q.type==="oauth",...J.stage?{staged:{reservation:J.stage.reservation}}:{}});let k="added";if(J.disabled)q9(K,G,J.disabled.reason),k="added-disabled";if(!J.disabled&&T!==void 0&&Q.type==="oauth"){if(_.find((w)=>w.invalid===void 0&&w.type==="oauth"&&w.enabled&&w.identity===T))q9(K,G,z5),k="added-disabled"}if(O?.credential)return await K.commitConfig(),{id:G,outcome:k,credential:O.credential,credentialEpoch:O.credentialEpoch??A};K.dropStateAccount(G);let p=L2(X,K,G,Q,{...J.stage&&J.disabled?{staged:{reservation:J.stage.reservation,disabledReason:J.disabled.reason,...Z!==void 0?{label:Z}:{},...N!==void 0?{providerState:d9(N)}:{}}}:{},...N!==void 0?{providerState:{kind:"set",value:N}}:{}});if(j==="rotate")await K.completeTorn();let i=await D2(K,G,p);return await K.commitConfig(),{id:G,outcome:k,credential:i,credentialEpoch:A}},{completeTorn:!1})});if(!W&&Q.type==="oauth"&&(B.outcome==="added"||B.outcome==="completed"))X.firePull(B.id,"add");return B}async function gQ(X,J,$,Y={},G={}){B6("replace");let{ctx:Q}=X,z=await H6(Q,"replace",J,G.onFailure,async(Z,W)=>{P5("replace",J,$),u1("replace",J,G.attribution);let B=Y.providerState===void 0?void 0:t8(Q.providerState,"replace",J,Y.providerState),{row:H}=await r8(X,"replace",J);if(await Z.acquire(g6(X,H)),$.type==="oauth")await Z.acquire(G.providerLock??X.providerLock);for(let U of G.extraLocks??[])await Z.acquire(U);return s0(Q,Z,W,{operation:"replace",rowId:J},async(U)=>{if(G.attribution!==void 0)_2("replace",J,U.row(J),G.attribution),await U.completeTorn();let j=M2("replace",J,U.row(J),$);if(x0(j)!==x0(H))throw c4("replace",J);let N=U.entry(J)?.credentialEpoch,K=(typeof N==="number"?N:1)+1;if(!Y6(K))throw x("replace",J,"invalid-row",`row ${J}'s credential epoch cannot advance past ${Number.MAX_SAFE_INTEGER}; remove the row and add the new credential as a new row`);let q=kQ(Q.providerState,j,K,Y.identity,B),F={...Y.identity!==void 0?{identity:Y.identity}:{},...$.type==="api"?{baseURL:$.baseURL.trim(),authHeader:$.authHeader??"authorization-bearer"}:{}};if(K5(U,J,K,F),Y.identity!==void 0)w1(U,Y.identity);let O=await O2(X,U,J,$,{clearErrors:!0,binding:F,providerState:q});return await U.commitConfig(),{id:J,credential:O,credentialEpoch:K}},{completeTorn:G.attribution===void 0})});if($.type==="oauth")X.firePull(J,"replace");return z}async function mQ(X,J,$,Y={},G={}){B6("rotate");let{ctx:Q}=X;return H6(Q,"rotate",J,G.onFailure,async(z,Z)=>{P5("rotate",J,$),u1("rotate",J,G.attribution);let W=Y.providerState===void 0?void 0:t8(Q.providerState,"rotate",J,Y.providerState),{row:B}=await r8(X,"rotate",J);if(await z.acquire(g6(X,B)),Y.identity!==void 0&&$.type==="oauth")await z.acquire(G.providerLock??X.providerLock);for(let H of G.extraLocks??[])await z.acquire(H);return s0(Q,z,Z,{operation:"rotate",rowId:J},async(H)=>{if(G.attribution!==void 0)_2("rotate",J,H.row(J),G.attribution),await H.completeTorn();let U=M2("rotate",J,H.row(J),$);if(x0(U)!==x0(B))throw c4("rotate",J);if(A6("rotate",U),Y.identity!==void 0&&U.identity!==void 0&&Y.identity!==U.identity)throw F2("rotate",J);let j=Y.identity!==void 0&&U.identity===void 0?Y.identity:void 0,N=await O2(X,H,J,$,{identity:j,...W!==void 0?{providerState:p4(Q.providerState,"rotate",J,U.providerState,W)}:{}}),K=!1;if(!U.hasEntry)H.setEntry(J,{credentialEpoch:1,needsFirstReading:U.type==="oauth"}),K=!0;if(Y.identity!==void 0&&U.identity!==Y.identity)c9(H,J,Y.identity),K=!0;if(K)await H.commitConfig();return{id:J,credential:N}},{completeTorn:G.attribution===void 0})})}async function uQ(X,J,$,Y,G){B6(J);let{ctx:Q}=X,z=Q.providerState,Z=G.attribution,W=G.providerState;return H6(Q,J,$,G.onFailure,async(B,H)=>{if(u1(J,$,Z),W!==void 0){if(typeof W!=="function")throw x(J,$,"invalid-input","the provider-state mutator must be a function");if(Z===void 0)throw x(J,$,"invalid-input","a provider-state change needs the attribution of the credential it is for");if(!z)throw x(J,$,"invalid-input","the store was opened without a provider-state codec")}let{row:U}=await r8(X,J,$);await B.acquire(g6(X,U));for(let j of G.extraLocks??[])await B.acquire(j);return s0(Q,B,H,{operation:J,rowId:$},async(j)=>{await P2(j,$,G.protect),j.assertNotStaged($);let N=j.row($),K=Y.enabled?M2("enable",$,N):N;if(!K||!j.rosterRow($))throw Q8(J,$);if(x0(K)!==x0(U))throw c4(J,$);if(Z!==void 0)_2(J,$,K,Z);if(Y.enabled&&K.disabledReason?.startsWith(x1))throw x("enable",$,"identity-contradicted",`row ${$} needs an identity-validated credential replacement before it can be enabled`);let q=!Y.enabled||!K.enabled||K.disabledReason!==void 0;if(Y.enabled&&q&&K.type==="oauth"){let L=K.identity===void 0?void 0:j.rows().find((P)=>P.id!==$&&P.invalid===void 0&&P.type==="oauth"&&P.enabled&&P.identity===K.identity);if(L)throw x("enable",$,"duplicate-identity",`row ${L.id} is enabled with the same identity as row ${$}`)}if(W===void 0||z===void 0){if(await j.completeTorn(),!q)return{id:$};if(Y.enabled)y4(j,$);else q9(j,$,Y.reason);return await j.commitConfig(),{id:$}}if(!K.credential)throw x(J,$,"no-credential",`row ${$} holds no credential`);A6(J,K);let F=await D5(j,z,J,K,W,!0);if(F.kind==="declined")return{id:$,declined:!0};await j.completeTorn();let O={id:$,providerStateOutcome:F.kind==="unchanged"?"unchanged":F.value===void 0?"cleared":"updated",...F.value!==void 0?{providerState:F.value}:{}};if(F.kind==="unchanged"){if(q){if(Y.enabled)y4(j,$);else q9(j,$,Y.reason);await j.commitConfig()}return O}if(!q)return j.setStateAccount($,F.account),await j.commitState(),O;let _=Y.enabled?{mark:yQ(),enabled:!0}:{mark:yQ(),enabled:!1,reason:Y.reason},C=F.account[_0];return j.setStateAccount($,{...F.account,[_0]:{...C,[N2]:_}}),await j.commitState(),u4(j,$,_),await j.commitConfig(),O},{completeTorn:!1})})}function pQ(X,J,$,Y={}){return uQ(X,"disable",J,{enabled:!1,reason:$},Y)}function cQ(X,J,$={}){return uQ(X,"enable",J,{enabled:!0},$)}async function lQ(X,J,$={}){B6("remove");let{ctx:Y}=X;return H6(Y,"remove",J,$.onFailure,async(G,Q)=>{if(typeof J!=="string"||J.length===0)throw x("remove",J,"invalid-input","id must be non-empty");let z=$.attribution;if(u1("remove",J,z),$.staged!==void 0&&(!y($.staged)||typeof $.staged.reservation!=="string"||!$.staged.reservation))throw x("remove",J,"invalid-input","a staged removal needs a reservation");let Z=await _6(Y);if(Z.status!=="ready")throw G8(Z,"remove",J);let W=Z.rows.find((H)=>H.id===J);if(!W&&!m1(Z.state,J))throw Q8("remove",J);let B=x0(W??{id:J});await G.acquire(g6(X,W??{id:J}));for(let H of $.extraLocks??[])await G.acquire(H);return s0(Y,G,Q,{operation:"remove",rowId:J},async(H)=>{let U=H.reservation(J);if(U!==void 0){if(!y(U)||!$.staged||U.reservation!==$.staged.reservation)throw x("remove",J,"row-staged",`row ${J} is reserved for roster publication`)}else if($.staged)throw x("remove",J,"attribution",`row ${J} is no longer reserved`);let j=H.row(J),N=m1(H.state,J);if(!j&&!N)throw Q8("remove",J);if(x0(j??{id:J})!==B)throw c4("remove",J);if(z!==void 0)if(j)A2(J,j,z);else ZD(X,H,J,z);let K=$.protect;if(K){let q={row:j,config:H.snapshot.config,state:H.snapshot.state},F=await A8("remove",()=>K(J,q));if(F!==void 0)throw x("remove",J,"row-protected",F)}if(j){if(z===void 0)await H.completeTorn();H.dropRosterRows(J),await H.commitConfig()}if(N)H.dropStateAccount(J),await H.commitState();return{id:J,outcome:j?"removed":"completed"}},{completeTorn:!1})})}function A2(X,J,$,Y="remove"){if(_2(Y,X,J,$),J.torn)throw x(Y,X,"attribution",`row ${X} is between the writes of another operation; retry once it completes`,!0);if(J.stamp!=="bound")throw x(Y,X,"unbound-credential",`row ${X}'s credential is not bound to its stamp, so the removal cannot be attributed to it`)}function ZD(X,J,$,Y){let G=()=>x("remove",$,"unbound-credential",`orphan ${$} has no credential stamp this store can bind, so the removal cannot be attributed to it`),Q=J.stateAccount($),z=b6(Q?.[_0]);if(!Q||!z?.binding||z.dispatch===void 0||z.replace)throw G();let Z;if(typeof Q.apiKey==="string"){if(z.binding.baseURL===void 0||z.binding.authHeader===void 0)throw G();Z={type:"api",apiKey:Q.apiKey,baseURL:z.binding.baseURL,authHeader:z.binding.authHeader}}else if(typeof Q.refresh==="string")Z={type:"oauth",refresh:Q.refresh};else throw G();let[W]=P9({accounts:[f1({id:$,credential:Z,identity:z.binding.identity,addedAt:0})],[E0]:{rows:{[$]:{credentialEpoch:z.credentialEpoch}}}},J.state,X.ctx.codec,X.ctx.providerState);if(!W?.credential||W.invalid||W.stamp!=="bound")throw G();if(z.credentialEpoch!==Y.credentialEpoch||z.binding.identity!==Y.identity)throw x("remove",$,"attribution",`orphan ${$} was written for a credential or account other than the one this removal was decided for`,!0)}function m1(X,J){let $=X.accounts;return y($)&&Object.hasOwn($,J)}function F5(X){return y(X)&&typeof X.id==="string"?X.id:void 0}function WD(X,J){if(!Array.isArray(J))return"ids must be an array of roster ids";let $=new Set;for(let Q of X){let z=F5(Q);if(z!==void 0)$.add(z)}let Y=new Set;for(let Q of J){if(typeof Q!=="string")return"ids must be an array of roster ids";if(Y.has(Q))return`id ${Q} appears more than once`;if(!$.has(Q))return`id ${Q} is not in the roster`;Y.add(Q)}let G=[...$].filter((Q)=>!Y.has(Q));if(G.length>0)return`the order leaves out roster id(s) ${G.join(", ")}`;return}function BD(X,J){let $=new Map;for(let Q of X){let z=F5(Q);if(z===void 0)continue;let Z=$.get(z);if(Z)Z.push(Q);else $.set(z,[Q])}let Y=J.flatMap((Q)=>$.get(Q)??[]),G=0;return X.map((Q)=>F5(Q)===void 0?Q:Y[G++])}async function dQ(X,J,$={}){B6("reorder");let{ctx:Y}=X,G=$.onFailure;return H6(Y,"reorder",void 0,G&&((Q,z)=>G(z)),async(Q,z)=>{for(let Z of $.extraLocks??[])await Q.acquire(Z);return s0(Y,Q,z,{operation:"reorder",rowId:void 0},async(Z)=>{let W=Z.roster(),B=WD(W,J);if(B)throw new K0({operation:"reorder",phase:"before-first-write",retryable:!1,kind:"invalid-order",message:B});let H=[...J],U=BD(W,H);if(U.every((j,N)=>j===W[N]))return{ids:H,outcome:"unchanged"};return Z.config.accounts=U,await Z.commitConfig(),{ids:H,outcome:"reordered"}},{completeTorn:!1})})}async function iQ(X,J,$,Y,G={}){return B6("recordIdentity"),H6(X.ctx,"recordIdentity",J,G.onFailure,async(Q,z)=>{if(typeof $!=="string"||$.length===0)throw x("recordIdentity",J,"invalid-input","identity must be non-empty");let Z=y(Y)?Y.credentialEpoch:void 0;if(!Y6(Z))throw x("recordIdentity",J,"invalid-input","the credential epoch the identity lookup was issued for is required");let{row:W}=await r8(X,"recordIdentity",J);await Q.acquire(g6(X,W)),await Q.acquire(G.providerLock??X.providerLock);for(let B of G.extraLocks??[])await Q.acquire(B);return s0(X.ctx,Q,z,{operation:"recordIdentity",rowId:J},async(B)=>{let H=M2("recordIdentity",J,B.row(J));if(x0(H)!==x0(W))throw c4("recordIdentity",J);if(A6("recordIdentity",H),(H.credentialEpoch??1)!==Z)throw x("recordIdentity",J,"attribution",`the identity for ${J} was looked up for a credential the row no longer holds`,!0);if(H.identity!==void 0&&H.identity!==$)throw F2("recordIdentity",J);if(H.identity===void 0)await GD(B,H,$);let U=c9(B,J,$);return await B.commitConfig(),{id:J,disabled:U}})})}function sQ(X){let J=X[E0];return y(J)&&y(J.publications)?J.publications:{}}function aQ(X,J){let $=sQ(X);if(!Object.hasOwn($,J))return;let Y=$[J];if(!y(Y)||Y.operationId!==J||typeof Y.planDigest!=="string"||!/^[a-f0-9]{64}$/.test(Y.planDigest)||!["committed","cleaned"].includes(String(Y.phase))||!Array.isArray(Y.removed)||!Array.isArray(Y.finalized)||Y.removed.some((G)=>!y(G)||typeof G.id!=="string"||!Y6(G.credentialEpoch))||Y.finalized.some((G)=>!y(G)||typeof G.id!=="string"||!Y6(G.credentialEpoch)||typeof G.reservation!=="string"||!G.reservation||typeof G.enabled!=="boolean"))throw x("publishRoster",J,"invalid-input","the stored publication receipt is malformed");return structuredClone(Y)}async function oQ(X,J){let $=await _6(X.ctx);if($.status!=="ready")throw G8($,"publishRoster",J);return aQ($.config,J)}function HD(X,J){let $=()=>{throw x("publishRoster",J?.operationId??"","invalid-input","the publication plan is invalid")};if(!y(J)||typeof J.operationId!=="string"||!J.operationId||!Array.isArray(J.remove)||!Array.isArray(J.finalize)||!Array.isArray(J.order))$();let Y=new Set;for(let G of[...J.remove,...J.finalize]){if(!y(G)||typeof G.id!=="string"||v1(G.id)||Y.has(G.id)||!G.attribution)$();if(Y.add(G.id),u1("publishRoster",G.id,G.attribution),G.attribution.identity!==void 0&&(typeof G.attribution.identity!=="string"||!G.attribution.identity))$()}for(let G of J.remove)if(X.ctx.requireRemovedFingerprint&&!G.fingerprint||G.fingerprint!==void 0&&typeof G.fingerprint!=="string")$();for(let G of J.finalize)if(typeof G.reservation!=="string"||!G.reservation||typeof G.enabled!=="boolean"||(G.enabled?G.disabledReason!==void 0:typeof G.disabledReason!=="string"))$();if(J.order.some((G)=>typeof G!=="string"||v1(G))||new Set(J.order).size!==J.order.length)$()}function rQ(X,J){X.entries();let $=X.config[E0],Y={...sQ(X.config)};Object.defineProperty(Y,J.operationId,{value:J,enumerable:!0,writable:!0,configurable:!0}),$.publications=Y,delete $.publicationOrder}function VD(X,J,$){let Y=new Set;for(let z of h1(X.config)){if(!y(z)||typeof z.id!=="string")continue;if(Y.has(z.id))throw x("publishRoster",J.operationId,"invalid-input","publication needs a roster of unique named rows");Y.add(z.id)}let G=new Set(J.remove.map((z)=>z.id)),Q=$.filter((z)=>z.invalid!=="roster"&&!G.has(z.id));if(Q.length!==J.order.length||J.order.some((z)=>!Q.some((Z)=>Z.id===z))||Q.some((z)=>!J.order.includes(z.id)))throw x("publishRoster",J.operationId,"invalid-input","order must name exactly the surviving roster");return Q}async function nQ(X,J){await X.assertAll();for(let Y of J.removed)if(b6(X.stateAccount(Y.id)?.[_0])?.credentialEpoch===Y.credentialEpoch&&!X.rosterRow(Y.id))X.dropStateAccount(Y.id);for(let Y of J.finalized){let G=X.stateAccount(Y.id),Q=b6(G?.[_0]);if(G&&Q?.credentialEpoch===Y.credentialEpoch&&Q.staged?.reservation===Y.reservation){let z={...G[_0]};delete z.staged,X.setStateAccount(Y.id,{...G,[_0]:z})}}await X.commitState(void 0,{durable:!0});let $={...J,phase:"cleaned"};return rQ(X,$),await X.commitConfig({durable:!0}),$}async function tQ(X,J,$={}){return B6("publishRoster"),H6(X.ctx,"publishRoster",J?.operationId??"",$.onFailure,async(Y,G)=>{if(!y(J)||typeof J.operationId!=="string"||!J.operationId)throw x("publishRoster",J?.operationId??"","invalid-input","the publication needs an operation id");J=structuredClone(J);let Q=d9(J),z=[...Array.isArray(J.remove)?J.remove:[],...Array.isArray(J.finalize)?J.finalize:[]].filter((Z)=>y(Z)&&typeof Z.id==="string");for(let Z=0;;Z++){let W=await _6(X.ctx);if(W.status!=="ready")throw G8(W,"publishRoster",J.operationId);let B=new Map(z.map(({id:U})=>[U,x0(W.rows.find((j)=>j.id===U)??{id:U})]));for(let U of[...new Set(B.values())].sort())await Y.acquire(g6(X,{id:U}));await Y.acquire($.providerLock??X.providerLock);for(let U of $.extraLocks??[])await Y.acquire(U);let H=await s0(X.ctx,Y,G,{operation:"publishRoster",rowId:J.operationId},async(U)=>{let j=U.rows();if(z.some(({id:P})=>x0(j.find((A)=>A.id===P)??{id:P})!==B.get(P)))return;let N=aQ(U.config,J.operationId);if(N){if(N.planDigest!==Q)throw x("publishRoster",J.operationId,"publication-mismatch","the operation id belongs to a different publication plan");if(N.phase==="cleaned")return{outcome:"already-cleaned",receipt:N};return U.markPublicationDecision(),await U.syncConfig(),{outcome:"cleaned",receipt:await nQ(U,N)}}HD(X,J);let K=VD(U,J,j),q=[];for(let P of J.remove){U.assertNotStaged(P.id);let A=j.find((T)=>T.id===P.id);if(!A)throw x("publishRoster",P.id,"attribution","the removed row no longer exists");if(A2(P.id,A,P.attribution,"publishRoster"),!A.credential||P.fingerprint!==void 0&&Y8(A.credential)!==P.fingerprint)throw x("publishRoster",P.id,"attribution","the removed secret no longer matches");q.push(A)}let F=[];for(let P of J.finalize){let A=j.find((w)=>w.id===P.id),T=b6(U.stateAccount(P.id)?.[_0]);if(!A||A.staged?.reservation!==P.reservation||T?.staged?.reservation!==P.reservation||A.enabled)throw x("publishRoster",P.id,"row-staged","the finalized row is not disabled under this reservation");let k=U.stateAccount(P.id),p=U.rosterRow(P.id),i=k?.[O6],X0=i===void 0?void 0:d9(i);if(!T?.staged||T.staged.label!==p?.label||T.staged.disabledReason!==A.disabledReason||T.staged.providerState!==X0)throw x("publishRoster",P.id,"row-staged","the staged label, disabled reason or full provider state no longer matches its stamp");A2(P.id,A,P.attribution,"publishRoster"),F.push(A)}let O=K.find((P)=>P.torn);if(O)throw x("publishRoster",J.operationId,"attribution",`Row ${O.id} has an interrupted write; complete it with a normal store operation before publishing.`,!1);let _=new Set;for(let P of K){if(!(J.finalize.find((T)=>T.id===P.id)?.enabled??P.enabled)||P.type!=="oauth"||P.identity===void 0)continue;if(_.has(P.identity))throw x("publishRoster",P.id,"invalid-input","the final enabled roster repeats a known identity");_.add(P.identity)}for(let P of K)if(P.identity!==void 0&&P.fingerprint!==void 0&&K.some((A)=>A.id!==P.id&&A.identity!==void 0&&A.identity!==P.identity&&A.fingerprint===P.fingerprint))throw x("publishRoster",P.id,"attribution","the resulting pool gives the same secret different known identities");for(let P of F)if(P.identity!==void 0&&q.some((A)=>A.identity!==void 0&&A.identity!==P.identity&&A.fingerprint===P.fingerprint))throw x("publishRoster",P.id,"attribution","the staged secret belonged to a different known identity");await P2(U,J.operationId,$.protect);let C={operationId:J.operationId,planDigest:Q,phase:"committed",removed:q.map((P)=>({id:P.id,credentialEpoch:P.credentialEpoch??1})),finalized:J.finalize.map((P,A)=>({id:P.id,credentialEpoch:F[A]?.credentialEpoch??1,reservation:P.reservation,enabled:P.enabled}))};for(let P of J.remove)U.dropRosterRows(P.id);for(let P of J.finalize){let A=U.rosterRow(P.id);A.enabled=P.enabled;let T={...U.entry(P.id)};if(delete T.staged,P.enabled)delete T.disabledReason;else T.disabledReason=P.disabledReason;U.setEntry(P.id,T)}let L=U.roster().filter((P)=>!y(P)||typeof P.id!=="string"||j.find((A)=>A.id===P.id)?.invalid==="roster");return U.config.accounts=[...J.order.map((P)=>U.rosterRow(P)),...L],rQ(U,C),await U.syncState(),await U.commitConfig({durable:!0,publicationDecision:!0}),{outcome:"published",receipt:await nQ(U,C)}},{completeTorn:!1});if(H)return H;if(await Y.releaseAll(),Z>=1)throw x("publishRoster",J.operationId,"row-key-changed","a named row changed lock key twice during publication",!0)}})}class O5{rt;hook;onFailure;firedAtLoad;logger;inflight=new Set;constructor(X,J,$,Y,G){this.rt=X,this.hook=J,this.onFailure=$,this.firedAtLoad=Y,this.logger=G}fire(X,J){if(!this.hook)return;if(J==="load"){if(this.firedAtLoad.has(X))return;this.firedAtLoad.add(X)}let $=this.run(X,J);this.inflight.add($),$.finally(()=>this.inflight.delete($))}async settled(){while(this.inflight.size>0)await Promise.allSettled([...this.inflight])}async run(X,J){let $=this.rt(),{ctx:Y}=$,G=new L9(Y.lockDefaults,Y.lockEnv),Q={writes:0};try{let z=await s0(Y,G,Q,{operation:"pull",rowId:X},async(W)=>{if(W.reservation(X)!==void 0)return;await W.completeTorn();let B=W.row(X);if(B?.unbound&&B.enabled&&B.type==="oauth"&&B.credential&&!B.invalid)A6("pull",B);if(!B?.candidate||B.type!=="oauth")return;if(!B.hasEntry)W.setEntry(X,{credentialEpoch:1,needsFirstReading:!0}),await W.commitConfig();let H=W.row(X);if(!H?.credential||H.credentialEpoch===void 0)return;return{id:X,credential:H.credential,credentialEpoch:H.credentialEpoch,...H.identity!==void 0?{identity:H.identity}:{},reason:J}},{completeTorn:!1});if(await G.releaseAll(),!z){this.firedAtLoad.delete(X);return}await Y.hold?.("pull-before-request",X);let Z;try{Z=await this.hook?.(z)}catch(W){throw new K0({operation:"pull",rowId:X,phase:"pull",retryable:!0,kind:"pull",message:"the quota pull rejected",cause:W})}await q2($,X,{credentialEpoch:z.credentialEpoch,...z.identity!==void 0?{identity:z.identity}:{}},Z)}catch(z){this.firedAtLoad.delete(X);let Z=g1(z,"pull",X,Q);if(this.onFailure)try{await this.onFailure(X,Z)}catch(W){this.logger?.warn("pull failure hook threw",{rowId:X,error:W instanceof Error?W.message:String(W)})}else this.logger?.warn("quota pull failed",{rowId:X,kind:Z.kind})}finally{await G.releaseAll()}}}import{randomUUID as UD}from"node:crypto";function M5(X,J){if(l9("refresh",X,J?.staged),!J)throw x("refresh",X,"unknown-row",`no row ${X} in the pool`);if(J.invalid)throw x("refresh",X,"invalid-row",`row ${X} is invalid`);if(J.type!=="oauth"||J.credential?.type!=="oauth")throw x("refresh",X,"no-credential",`row ${X} holds no OAuth credential`);if(!J.enabled)throw x("refresh",X,"row-disabled",`row ${X} is disabled`);return J}function eQ(X){return x("refresh",X,"refresh-stamp-ahead",`row ${X}'s stored refresh stamp is ahead of the clock; a rotation now could not be stamped newer within the trust bound`,!0)}async function Xz(X,J,$,Y={}){B6("refresh");let{ctx:G}=X;return H6(G,"refresh",J,Y.onFailure,async(Q,z)=>{let{row:Z}=await r8(X,"refresh",J);M5(J,Z);let W=await Y.refuse?.(Z);if(W!==void 0)return{status:"refused",rowId:J,reason:W};let B=x0(Z),H;for(let K=0;;K++){await Q.acquire(g6(X,{id:J,identity:B===J?void 0:B})),await Q.acquire(Y.providerLock??X.providerLock);for(let O of Y.extraLocks??[])await Q.acquire(O);let F=await s0(G,Q,{writes:0},{operation:"refresh",rowId:J},async(O)=>{let _=M5(J,O.row(J));if(A6("refresh",_),!_.hasEntry)O.setEntry(J,{credentialEpoch:1,needsFirstReading:!0}),await O.commitConfig(),_=M5(J,O.row(J));if(x0(_)!==B)return{keyNow:x0(_)};let C=await Y.refuse?.(_);if(C!==void 0)return{refused:C};return{row:_,credential:_.credential,credentialEpoch:_.credentialEpoch,identity:_.identity}});if("refused"in F)return{status:"refused",rowId:J,reason:F.refused};if("keyNow"in F){if(await Q.releaseAll(),K>=1)throw x("refresh",J,"row-key-changed",`row ${J}'s wire identity changed twice while its lock was held`,!0);B=F.keyNow;continue}H=F;break}if(U5(H.credential.lastRefreshedAt,G.now()))throw eQ(J);await G.hold?.("refresh-before-provider",J),await Q.assertAll();let U;try{U=await $(H.credential,H.row)}catch(K){throw new K0({operation:"refresh",rowId:J,phase:"before-first-write",retryable:!0,kind:"provider",message:"the provider refresh failed",cause:K})}if(typeof U?.refresh!=="string"||!U.refresh.trim())throw x("refresh",J,"provider","the provider returned no refresh token",!0);let j=U.providerState===void 0?void 0:t8(G.providerState,"refresh",J,U.providerState,"the provider state the provider returned"),N=await s0(G,Q,z,{operation:"refresh",rowId:J},async(K)=>{let q=K.row(J),F=K.entry(J);if(!q||q.invalid||!F||F.credentialEpoch!==H.credentialEpoch||q.identity!==H.identity)throw new K0({operation:"refresh",rowId:J,phase:"before-first-write",retryable:!0,kind:"attribution",message:`row ${J} changed credential while its refresh was in flight; the rotation is discarded`});A6("refresh",q);let O=await Y.refuse?.(q);if(O!==void 0)return{refused:O};let _=G.now(),C=q.credential?.type==="oauth"?q.credential.lastRefreshedAt:void 0;if(U5(C,_))throw eQ(J);let L={type:"oauth",access:U.access,refresh:U.refresh,expires:U.expires},P=q.identity!==void 0&&U.identity!==void 0&&q.identity!==U.identity?{expectedIdentity:q.identity,returnedIdentity:U.identity}:void 0,A=P?{mark:UD(),enabled:!1,reason:`${x1}${JSON.stringify(P)}`}:void 0,T=q.identity===void 0&&U.identity?U.identity:void 0,k=await O2(X,K,J,L,{stamp:m4(C,_),transition:A,identity:T,...j!==void 0?{providerState:p4(G.providerState,"refresh",J,q.providerState,j)}:{}});if(A!==void 0)u4(K,J,A),await K.commitConfig();let p=q.identity;if(T!==void 0)c9(K,J,T),p=T,await K.commitConfig();return{stored:k,identity:p,contradiction:P,refused:void 0}});if(N.refused!==void 0)return{status:"refused",rowId:J,reason:N.refused};if(N.contradiction!==void 0)return{status:"identity-contradicted",rowId:J,...N.contradiction,credential:N.stored};if(Y.onPersisted)try{let K=Y.onPersisted;await A8("refresh",()=>K(J,N.stored))}catch(K){throw new K0({operation:"refresh",rowId:J,phase:"after-first-write",retryable:!1,kind:"after-persist-hook",committed:N.stored,message:"the after-persist hook threw; the rotation stays committed",cause:K})}return{status:"rotated",rowId:J,credential:N.stored,...N.identity!==void 0?{identity:N.identity}:{}}})}import{isDeepStrictEqual as KD}from"node:util";var R2=Object.freeze(["version","accounts",E0]);function _5(X){let J={};for(let[$,Y]of Object.entries(X))if(!R2.includes($))T2(J,$,Y);return J}function T2(X,J,$){Object.defineProperty(X,J,{value:$,enumerable:!0,writable:!0,configurable:!0})}function jD(X,J){let $={};for(let[Y,G]of Object.entries(X))if(R2.includes(Y))T2($,Y,G);else if(Object.hasOwn(J,Y))T2($,Y,J[Y]);for(let[Y,G]of Object.entries(J))if(!Object.hasOwn(X,Y))T2($,Y,G);return $}function Jz(X){return new K0({operation:"updateSettings",phase:"before-first-write",retryable:!1,kind:"invalid-input",message:X})}async function $z(X){let J=await _6(X.ctx);if(J.status==="error")return J;return{status:J.status,settings:_5(J.config)}}async function Yz(X,J,$={}){B6("updateSettings");let{ctx:Y}=X,G=$.onFailure;return H6(Y,"updateSettings",void 0,G&&((Q,z)=>G(z)),async(Q,z)=>{for(let W of $.extraLocks??[])await Q.acquire(W);let Z=Q.held.length;try{for(let F of Y.storeLocks)await Q.acquire(F);let W=await _6(Y);if(W.status!=="ready")throw G8(W,"updateSettings",void 0);let B=_5(W.config),H=structuredClone(B),U=await A8("updateSettings",()=>J(H)),j=U===void 0?H:U;if(!y(j))throw Jz("the settings mutator must produce an object");let N=R2.filter((F)=>Object.hasOwn(j,F));if(N.length>0)throw Jz(`settings cannot set the pool-owned key(s) ${N.join(", ")}`);if(KD(j,B))return{settings:B,outcome:"unchanged"};let K=jD(W.config,j),q={operation:"updateSettings",rowId:void 0};return await M6(Y.configPath,K,{beforeRename:async()=>{await Y.onStep?.("before-config-write",q),await Q.assertAll()}}),z.writes++,await Y.onStep?.("after-config-write",q),{settings:_5(K),outcome:"updated"}}finally{await Q.releaseTo(Z)}})}var Gz=new Map;function ND(X){let J=Gz.get(X);if(!J)J={removedIds:new Set,firedAtLoad:new Set},Gz.set(X,J);return J}function Qz(X){if(X.status==="ready")return{status:"ready",schemaVersion:D9,rows:X.rows};if(X.status==="pending-migration")return{status:"pending-migration",roster:Array.isArray(X.config.accounts)?X.config.accounts:[]};return X}function z8(X){let J=ND(X.configPath),$={...Z5,...X.lockOptions},Y={provider:X.provider,configPath:X.configPath,statePath:X.statePath,codec:X.quota,...X.providerState?{providerState:X.providerState}:{},now:X.now??Date.now,storeLocks:X.storeLocks??[{name:"save",path:X.configPath},{name:"save",path:X.statePath}],lockDefaults:$,lockEnv:{now:X.now??Date.now,...X.onLockEvent?{onLockEvent:X.onLockEvent}:{},...X.onLockStep?{onLockStep:X.onLockStep}:{}},removedIds:J.removedIds,requireCredentialStamps:X.requireCredentialStamps===!0,requireRemovedFingerprint:X.requireRemovedFingerprint===!0,...X.logger?{logger:X.logger}:{},...X.onStep?{onStep:X.onStep}:{},...X.hold?{hold:X.hold}:{}},G=new O5(()=>Q,X.pull,X.onPullFailure,J.firedAtLoad,X.logger),Q={ctx:Y,providerLock:X.providerLock??{name:`provider-${encodeURIComponent(X.provider)}`,path:X.statePath},rowLockOptions:X.rowLockOptions??{},firePull:(z,Z)=>G.fire(z,Z)};return{async load(){let z=await _6(Y);if(z.status==="ready"){for(let Z of z.rows)if((Z.candidate||Z.torn&&Z.enabled)&&Z.type==="oauth"&&Z.needsFirstReading)G.fire(Z.id,"load")}return Qz(z)},async read(){return Qz(await _6(Y))},async initialize(z={}){return{status:await bQ(Y,z.dropKeys??[])}},add:(z,Z)=>fQ(Q,z,Z),publishRoster:(z,Z)=>tQ(Q,z,Z),publication:(z)=>oQ(Q,z),replace:(z,Z,W,B)=>gQ(Q,z,Z,W,B),rotate:(z,Z,W,B)=>mQ(Q,z,Z,W,B),updateProviderState:(z,Z,W,B)=>wQ(Q,z,Z,W,B),disable:(z,Z,W)=>pQ(Q,z,Z,W),enable:(z,Z)=>cQ(Q,z,Z),remove:(z,Z)=>lQ(Q,z,Z),reorder:(z,Z)=>dQ(Q,z,Z),readSettings:()=>$z(Q),updateSettings:(z,Z)=>Yz(Q,z,Z),recordIdentity:(z,Z,W,B)=>iQ(Q,z,Z,W,B),refresh:(z,Z,W)=>Xz(Q,z,Z,W),recordQuota:(z,Z,W)=>q2(Q,z,Z,W),requestReading:(z)=>G.fire(z,"admission"),pullsSettled:()=>G.settled()}}var qD=[/\b[\w-]*(?:secret|token|password|passwd|api[_-]?key|authorization|verifier)["']?\s*[:=]\s*["']?(?:(?:Bearer|Basic)\s+)?[^\s"'&,;}]+/gi,/\b[0-9a-fA-F]{32,}\b/g];function R5(X={}){let{redactStrings:J}=C2({...X,extraValuePatterns:[...qD,...X.extraValuePatterns??[]]});return($)=>J($)}class k6 extends Error{code;constructor(X,J,$){super(J,$);this.name="CommandError",this.code=X}}var zz=/^[a-z][a-z0-9-]{0,63}$/,A5={code:"action-failed",text:"That action failed."},LD=new Set(["unknown-row","invalid-row","invalid-input","id-exists","id-removed","type-mismatch","no-credential","row-disabled","row-protected","duplicate-identity","row-key-changed","invalid-order","pending-migration","provider","pull","attribution"]);function l4(X){if(X instanceof k6)return{code:zz.test(X.code)?X.code:A5.code,text:X.message};if(X instanceof K0)return{code:`pool-${X.kind}`,text:LD.has(X.kind)?X.message:`The account pool could not do that (${X.kind}).`};return A5}var Zz="This cannot be undone. Continue?",DD=new Set(["access","refresh","apikey","password","authheader","credential","credentials"]);function FD(X){let J=X.toLowerCase().replace(/[-_]/g,"");return DD.has(J)||J.endsWith("token")||J.endsWith("key")||J.endsWith("secret")}function PD(X){return X!==null&&typeof X==="object"&&!Array.isArray(X)}function T5(X,J,$){if(typeof X==="string"){let G=$.redact(X);if(G!==X)$.redacted.push(J);return G}if(Array.isArray(X))return X.map((G,Q)=>T5(G,`${J}[${Q}]`,$));if(!PD(X))return X;let Y={};for(let[G,Q]of Object.entries(X)){if(FD(G)){$.dropped.push(`${J}.${G}`);continue}Object.defineProperty(Y,G,{value:T5(Q,`${J}.${G}`,$),enumerable:!0,writable:!0,configurable:!0})}return Y}function Wz(X,J,$){let Y={redact:$.redact,dropped:[],redacted:[]},G=T5(X,"payload",Y);if(Y.dropped.length>0)$.logger.warn("credential-shaped field dropped from a command payload",{command:J,fields:Y.dropped});if(Y.redacted.length>0)$.logger.warn("secret-shaped text masked in a command payload",{command:J,fields:Y.redacted});return G}function OD(X){return{value:String(X.value),label:String(X.label)}}function MD(X){switch(X.kind){case"choice":return{kind:"choice",id:X.id,label:X.label,choices:(X.choices??[]).map(OD),...X.value!==void 0?{value:X.value}:{}};case"toggle":return{kind:"toggle",id:X.id,label:X.label,value:X.value===!0};case"number":return{kind:"number",id:X.id,label:X.label,...X.value!==void 0?{value:X.value}:{},...X.min!==void 0?{min:X.min}:{},...X.max!==void 0?{max:X.max}:{},...X.required?{required:!0}:{}};case"text":return{kind:"text",id:X.id,label:X.label,...X.value!==void 0&&!X.masked?{value:X.value}:{},...X.placeholder!==void 0?{placeholder:X.placeholder}:{},...X.masked?{masked:!0}:{},...X.required?{required:!0}:{}}}}function C5(X){if(X.irreversible===!0)return{message:X.confirm||Zz,irreversible:!0};if(X.confirm)return{message:X.confirm,irreversible:!1};return}function Bz(X){let J=C5(X);return{id:X.id,label:X.label,...X.description!==void 0?{description:X.description}:{},...X.group!==void 0?{group:String(X.group)}:{},knobs:(X.knobs??[]).map(MD),...J?{confirm:J}:{}}}function _D(X){return{id:X.id,...X.label!==void 0?{label:X.label}:{},enabled:X.enabled,type:X.type,...X.identity!==void 0?{identity:X.identity}:{}}}function AD(X){return{id:X.id,label:X.label,...X.detail!==void 0?{detail:X.detail}:{},...X.group!==void 0?{group:String(X.group)}:{},...X.status!==void 0?{status:String(X.status)}:{},...X.account?{account:_D(X.account)}:{},...X.facts!==void 0?{facts:X.facts}:{},actions:(X.actions??[]).map(Bz)}}function TD(X){let{content:J}=X;return{id:X.id,slot:X.slot,title:X.title,lines:(J.lines??[]).map(String),items:(J.items??[]).map(AD),actions:(J.actions??[]).map(Bz),...J.facts!==void 0?{facts:J.facts}:{}}}function Hz(X,J,$){return{command:X,title:J,sections:$.map(TD)}}function Vz(X,J,$,Y){return Wz({command:X,menu:Hz(X,J,$)},X,Y)}function Uz(X,J,$,Y,G){return Wz({command:X,ok:Y.ok,text:String(Y.text),...!Y.ok&&Y.code!==void 0?{code:zz.test(Y.code)?Y.code:"refused"}:{},...Y.needsConfirmation?{needsConfirmation:!0}:{},menu:Hz(X,J,$)},X,G)}var qz="disabled from the command menu";function RD(X){return X!==null&&typeof X==="object"&&!Array.isArray(X)}function e8(X){return RD(X)?{...X}:{}}function CD(X){if(X.status!=="ready")return[];let J=new Set;return X.rows.filter(($)=>{if(J.has($.id))return!1;return J.add($.id),!0})}function ED(X,J){return X.label??J??X.id}function E2(X,J){return G6(X.quota)?f0(X.quota,J):void 0}function Lz(X,J){return`${X} ${J}${X===1?"":"s"}`}var d4="Actions";function SD(X){if(X.status==="pending-migration")return"The account pool has not been migrated yet.";if(X.status==="error")return`The ${X.file} file cannot be read: ${X.reason}`;return}function Kz(X,J){switch(J.outcome){case"added":return`Added ${X}.`;case"added-disabled":return`Added ${X}, disabled: another enabled account has the same identity.`;case"completed":return`Finished adding ${X}.`;case"rotated":return`${X} was already in the pool; its credential was updated.`;case"exists":return`${X} was already in the pool; its credential is unchanged.`}}function jz(X){return l4(X).text}async function ID(X){let J=await X.read(),$=await X.readSettings();return{load:J,rows:CD(J),settings:$.status==="error"?{}:$.settings}}function S2(X,J){let $=J.accounts?.describeIdentity?J.accounts.describeIdentity(X):X.identity;return{account:{id:X.id,...X.label!==void 0?{label:X.label}:{},enabled:X.enabled,type:X.type,...$!==void 0?{identity:$}:{}},name:ED(X,$)}}function bD(X,J){let{store:$,extraLocks:Y}=X,G=Y?{extraLocks:Y}:{},Q=J.rows.map((U)=>U.id),z=SD(J.load),Z=J.rows.filter((U)=>U.enabled).length,W=J.rows.map((U,j)=>{let{account:N,name:K}=S2(U,X),q=[U.type==="api"?"API key":"OAuth",...N.identity!==void 0?[N.identity]:[],...!U.invalid&&!U.enabled&&U.disabledReason?[`disabled: ${U.disabledReason}`]:[]].join(" · "),F=U.invalid?"invalid":U.enabled?"enabled":"disabled",O=[];if(!U.invalid&&U.enabled)O.push({id:"disable",label:"Disable",run:async()=>{return await $.disable(U.id,qz,G),`Disabled ${K}.`}});if(!U.invalid&&!U.enabled)O.push({id:"enable",label:"Enable",run:async()=>{return await $.enable(U.id,G),`Enabled ${K}.`}});if(Q.length>1)O.push({id:"move",label:"Move",knobs:[{kind:"choice",id:"position",label:"Position",choices:Q.map((_,C)=>({value:String(C+1),label:String(C+1)})),value:String(j+1)}],run:async({values:_})=>{let C=Number(_.position),L=Q.filter((A)=>A!==U.id);return L.splice(C-1,0,U.id),(await $.reorder(L,G)).outcome==="unchanged"?`${K} is already at position ${C}.`:`Moved ${K} to position ${C}.`}});return O.push({id:"remove",label:"Remove",irreversible:!0,confirm:`Remove ${K}? Its stored credential is deleted.`,run:async()=>{return await $.remove(U.id,{...G,...X.accounts?.protect?{protect:X.accounts.protect}:{}}),`Removed ${K}.`}}),{id:U.id,label:K,detail:q,group:"Accounts",status:F,account:N,actions:O}}),B=X.accounts?.login,H=[];if(B&&!z)H.push({id:"add",label:B.label??"Add account",group:d4,knobs:B.knobs??[],run:async({values:U,invocation:j})=>{let N=await B.run(U,j);if(N.status==="cancelled")return{ok:!1,text:N.message??"Login cancelled."};if(N.status==="ready"){let K=await $.add(N.account,G);return Kz(N.account.label??K.id,K)}return N.completion.then(async(K)=>{if(!K){j.notify("Login cancelled.","warning");return}let q=await $.add(K,G);j.notify(Kz(K.label??q.id,q))},(K)=>{j.notify(`Adding the account failed: ${jz(K)}`,"error")}).catch((K)=>{j.notify(`Adding the account failed: ${jz(K)}`,"error")}),N.message}});return{id:"accounts",slot:"accounts",title:"Accounts",content:{lines:z?[z]:[J.rows.length===0?"No accounts yet":`${Lz(J.rows.length,"account")}, ${Z} enabled`],items:z?[]:W,actions:H}}}function kD(X,J){let $=X.quota?.scope??"all",Y=X.now(),G=$==="all"?"Accounts":`Accounts · ${$}`,Q=async(H,U)=>{if(X.quota?.check)await X.quota.check(H,U);else{for(let j of H)X.store.requestReading(j);await X.store.pullsSettled()}},z=J.rows.filter((H)=>H.candidate),Z=z.map((H)=>{let{account:U,name:j}=S2(H,X),N=E2(H,$);return{id:H.id,label:j,group:G,status:R8(N,{now:Y,form:"compact"}),detail:R8(N,{now:Y,form:"full"}),account:U,actions:[{id:"check",label:"Check this account",run:async({invocation:K})=>{return await Q([H.id],K),`Checked quota for ${j}.`}}]}}),W=J.rows.filter((H)=>!H.candidate).map((H)=>{let{name:U}=S2(H,X),j=H.invalid?"invalid":!H.enabled?"disabled":H.credential===void 0?"no credential":"unavailable",N=R8(E2(H,$),{now:Y,form:"compact"});return`${U} (${j}): ${N}`}),B=[];if(z.length>0)B.push({id:"check",label:"Check now",description:"Checks every account that can be checked.",group:d4,run:async({invocation:H})=>{let U=z.map((j)=>j.id);return await Q(U,H),`Checked quota for ${Lz(U.length,"account")}.`}});return{id:"quota",slot:"quota",title:"Quota",content:{lines:J.rows.length===0?["No accounts yet"]:W,items:Z,actions:B}}}function xD(X,J){let{store:$,extraLocks:Y}=X,G=Y?{extraLocks:Y}:{},Q=[{value:"ordered",label:"Ordered (roster order)"},...X.routing?.orderedVariants??[],{value:"sticky-balanced",label:"Sticky balanced"}],z=e8(J.settings.routing).mode,Z=typeof z==="string"&&Q.some((K)=>K.value===z)?z:"ordered",W=rX(Z),B=J.rows.map((K)=>K.id),H=k1(B,W.placement,X.routing?.formerMainId??Z2),j=[`Mode: ${Q.find((K)=>K.value===Z)?.label??Z}`];if(B.length>0)j.push(`Roster order: ${B.join(", ")}`);if(W.mode==="ordered"&&H.join()!==B.join())j.push(`Tried in order: ${H.join(", ")}`);let N=[{id:"mode",label:"Change mode",group:d4,knobs:[{kind:"choice",id:"mode",label:"Mode",choices:Q,value:Z}],run:async({values:K})=>{let q=String(K.mode);return await $.updateSettings((F)=>{F.routing={...e8(F.routing),mode:q};return},G),`Routing mode set to ${Q.find((F)=>F.value===q)?.label??q}.`}}];if(B.length>1)N.push({id:"order",label:"Set order",group:d4,knobs:[{kind:"text",id:"order",label:"Account ids, first to last",value:B.join(", "),required:!0}],run:async({values:K})=>{let q=String(K.order).split(/[\s,]+/).filter((O)=>O.length>0),F=await $.reorder(q,G);return F.outcome==="unchanged"?"The order is unchanged.":`Order set to ${F.ids.join(", ")}.`}});return{id:"routing",slot:"routing",title:"Routing",content:{lines:j,actions:N}}}function wD(X,J){if(X.limits?.labels)return[...X.limits.labels];let $=X.quota?.scope??"all",Y=[];for(let G of J.rows)for(let Q of E2(G,$)?.limits??[])if(!Y.includes(Q.label))Y.push(Q.label);return Y.length>0?Y:["primary"]}function vD(X,J){let $=X.quota?.scope??"all",Y=new Map;for(let G of J.rows)for(let Q of E2(G,$)?.limits??[])if(Q.windowMinutes!==void 0&&!Y.has(Q.label))Y.set(Q.label,Nz(Q));return(G)=>Y.get(G)??G}function yD(X,J){let{store:$,extraLocks:Y}=X,G=Y?{extraLocks:Y}:{},Q=e8(J.settings.killswitch),z=Q.enabled===!0,Z=e8(Q.accounts),W=wD(X,J),B=vD(X,J),H=z?"on":"off",U=J.rows.map((j)=>{let{account:N,name:K}=S2(j,X),q=e8(Z[j.id]),F=W.filter((O)=>typeof q[O]==="number");return{id:j.id,label:K,group:`Floors · killswitch ${H}`,status:F.length===0?"no floors":F.map((O)=>`${B(O)} ≥${q[O]}%`).join(" · "),account:N,actions:[{id:"floors",label:"Set floors",knobs:W.map((O)=>({kind:"number",id:O,label:`Minimum % left for ${B(O)}`,min:0,max:100,...typeof q[O]==="number"?{value:q[O]}:{}})),run:async({values:O})=>{return await $.updateSettings((_)=>{let C=e8(_.killswitch),L=e8(C.accounts),P=e8(L[j.id]);for(let A of W){let T=O[A];if(typeof T==="number")P[A]=T;else if(T===null)delete P[A]}if(Object.keys(P).length>0)L[j.id]=P;else delete L[j.id];if(Object.keys(L).length>0)C.accounts=L;else delete C.accounts;_.killswitch=C;return},G),`Floors updated for ${K}.`}}]}});return{id:"limits",slot:"limits",title:"Limits",content:{lines:[`Killswitch ${H}`],items:U,actions:[{id:"killswitch",label:z?"Turn killswitch off":"Turn killswitch on",description:"With the killswitch on, an account whose quota falls below one of its floors is not used.",group:d4,knobs:[{kind:"toggle",id:"enabled",label:"Killswitch",value:!z}],run:async({values:j})=>{let N=j.enabled===!0;return await $.updateSettings((K)=>{K.killswitch={...e8(K.killswitch),enabled:N};return},G),`Killswitch ${N?"on":"off"}.`}}]}}}async function Dz(X){let J=await ID(X.store);return[bD(X,J),kD(X,J),xD(X,J),yD(X,J)]}var hD=new Set(["accounts","quota","routing","limits","cache","diagnostics"]),E5=["accounts","quota","routing","limits"];function Fz(X,J){let{sessionId:$}=X,Y=X.notify.bind(X);return Object.freeze({...$!==void 0?{sessionId:$}:{},notify:(G,Q)=>Q===void 0?Y(J(String(G))):Y(J(String(G)),Q)})}function fD(X,J){switch(X.kind){case"choice":{let $=J??X.value;if(typeof $==="string"&&X.choices.some((Y)=>Y.value===$))return{value:$};return{problem:`Choose one of the options for ${X.label}.`}}case"toggle":{let $=J??X.value;return typeof $==="boolean"?{value:$}:{problem:`${X.label} must be on or off.`}}case"number":{let $=J===void 0?X.value??null:J;if($===null||$==="")return X.required?{problem:`${X.label} needs a number.`}:{value:null};let Y=typeof $==="number"?$:Number($);if(typeof $==="boolean"||!Number.isFinite(Y))return{problem:`${X.label} needs a number.`};if(X.min!==void 0&&Y<X.min)return{problem:`${X.label} must be at least ${X.min}.`};if(X.max!==void 0&&Y>X.max)return{problem:`${X.label} must be at most ${X.max}.`};return{value:Y}}case"text":{let $=J===void 0?X.value??null:J;if($===null||$==="")return X.required?{problem:`${X.label} cannot be empty.`}:{value:null};return typeof $==="string"?{value:$}:{problem:`${X.label} must be text.`}}}}function gD(X,J){let $={};for(let Y of X){let G=J&&Object.hasOwn(J,Y.id)?J[Y.id]:void 0,Q=fD(Y,G);if("problem"in Q)return Q;$[Y.id]=Q.value}return{values:$}}function mD(X,J){let $=X.find((G)=>G.id===J.sectionId);if(!$)return;return(J.itemId===void 0?$.content.actions:$.content.items?.find((G)=>G.id===J.itemId)?.actions)?.find((G)=>G.id===J.actionId)}function i9(X){let J=X.logger??Z0("commands"),$=R5(X.redaction),Y={logger:J,redact:$},G=X.now??Date.now,Q=X.extras??[],z=X.replace??{},Z=E5.filter((j)=>!z[j]);for(let j of E5)if(z[j]&&X[j]!==void 0)throw Error(`the ${j} section is replaced; its built-in options cannot also be given`);let W=X.store;if(Z.length>0&&!W)throw Error(`a store is required for the built-in ${Z.join(", ")} section${Z.length>1?"s":""}`);let B=new Set;for(let j of Q){if(hD.has(j.id)||B.has(j.id))throw Error(`extra section id ${j.id} is taken`);B.add(j.id)}async function H(j,N,K,q){try{return{id:j,slot:N,title:K.title,content:await K.build(q)}}catch(F){return J.warn("command menu section failed to build",{command:X.command,section:j,error:$(F instanceof Error?F.message:String(F))}),{id:j,slot:N,title:K.title,content:{lines:["This section could not be loaded."]}}}}async function U(j){let N=W&&Z.length>0?await Dz({store:W,now:G,...X.extraLocks?{extraLocks:X.extraLocks}:{},...X.accounts?{accounts:X.accounts}:{},...X.quota?{quota:X.quota}:{},...X.routing?{routing:X.routing}:{},...X.limits?{limits:X.limits}:{}}):[],K=[];for(let q of E5){let F=z[q];if(F)K.push(await H(q,q,F,j));else{let O=N.find((_)=>_.slot===q);if(O)K.push(O)}}if(X.cache)K.push(await H("cache","cache",X.cache,j));if(X.diagnostics)K.push(await H("diagnostics","diagnostics",X.diagnostics,j));for(let q of Q)K.push(await H(q.id,"extra",q,j));return K}return{command:X.command,async open(j){let N=Fz(j,$);return Vz(X.command,X.title,await U(N),Y)},async apply(j,N){let K=Fz(N,$),q=async(L)=>Uz(X.command,X.title,await U(K),L,Y),F=j.command===X.command?mD(await U(K),j):void 0;if(!F)return q({ok:!1,code:"unavailable",text:"That action is no longer available."});let O=C5(F);if(O&&j.confirmed!==!0)return q({ok:!1,code:"needs-confirmation",text:O.message,needsConfirmation:!0});let _=gD(F.knobs??[],j.values);if("problem"in _)return q({ok:!1,code:"invalid-input",text:_.problem});let C;try{let L=await F.run({values:_.values,...j.itemId!==void 0?{itemId:j.itemId}:{},invocation:K});C=typeof L==="string"?{ok:!0,text:L}:{ok:L.ok,text:L.text,...L.ok?{}:{code:L.code??"refused"}}}catch(L){let P=l4(L);J.warn("command menu action failed",{command:X.command,section:j.sectionId,action:j.actionId,code:P.code,error:$(L instanceof Error?L.message:String(L))}),C={ok:!1,...P}}return q(C)}}}function uD(X){return X===null||typeof X==="string"||typeof X==="boolean"||typeof X==="number"&&Number.isFinite(X)}function S5(X){if(X===null||typeof X!=="object"||Array.isArray(X))return;let J=X;if(typeof J.command!=="string"||typeof J.sectionId!=="string"||typeof J.actionId!=="string")return;if(J.itemId!==void 0&&typeof J.itemId!=="string")return;if(J.sessionId!==void 0&&typeof J.sessionId!=="string")return;if(J.confirmed!==void 0&&typeof J.confirmed!=="boolean")return;let $={};if(J.values!==void 0){if(J.values===null||typeof J.values!=="object"||Array.isArray(J.values))return;for(let[Y,G]of Object.entries(J.values)){if(!uD(G))return;Object.defineProperty($,Y,{value:G,enumerable:!0,writable:!0,configurable:!0})}}return{command:J.command,sectionId:J.sectionId,actionId:J.actionId,...typeof J.itemId==="string"?{itemId:J.itemId}:{},...J.values!==void 0?{values:$}:{},...J.confirmed===!0?{confirmed:!0}:{},...typeof J.sessionId==="string"?{sessionId:J.sessionId}:{}}}import{createHash as YO,randomUUID as GO}from"node:crypto";import{setTimeout as QO}from"node:timers/promises";import{createHash as pD}from"node:crypto";var I5=86400000,cD=300000,lD=3600000,dD=60000,iD=900000,nD=300000;function b5(X){return X instanceof Error?X.message:String(X)}function k5(X){let J=X?.status;if(typeof J==="number")return J===429||J>=500;if(!(X instanceof Error))return!1;return X.name==="AbortError"||X.name==="TimeoutError"||X.message.includes("fetch failed")||"code"in X&&(X.code==="ECONNRESET"||X.code==="ECONNREFUSED"||X.code==="ETIMEDOUT"||X.code==="UND_ERR_CONNECT_TIMEOUT")}function x5(X){let J=b5(X),$=X?.status;if(typeof $==="number")return $===429||$>=500;if(!(X instanceof Error))return!1;let Y=X.code;return X.name==="AbortError"||X.name==="TimeoutError"||J.includes("fetch failed")||Y==="ECONNRESET"||Y==="ECONNREFUSED"||Y==="ETIMEDOUT"||Y==="UND_ERR_CONNECT_TIMEOUT"}function s6(X){return pD("sha256").update(X).digest("hex")}function p1(X){let J=s6(X.refreshToken),Y=(X.previous?.tokenHash===J?X.previous.retryCount??0:0)+1,G,Q=X.error?.retryAfter;if(typeof Q==="number"&&Q>0)G=Q*1000;else if(k5(X.error))G=Math.min(lD,cD*2**Math.min(Y-1,6));else G=I5;return{message:b5(X.error),checkedAt:X.now,nextRetryAt:X.now+G,retryCount:Y,tokenHash:J}}function r0(X,J,$){if(!X?.nextRetryAt||X.nextRetryAt<=$)return!1;if(!J)return!0;return X.tokenHash===s6(J)}function X9(X,J){return`Codex OAuth refresh is backed off for ${Math.max(1,Math.ceil(((X.nextRetryAt??J)-J)/1000))}s after: ${X.message}`}function i4(X){let $=(X.previous?.retryCount??0)+1,Y,G=X.error?.retryAfter;if(typeof G==="number"&&G>0)Y=G*1000;else if(x5(X.error))Y=Math.min(iD,dD*2**Math.min($-1,6));else Y=nD;return{message:b5(X.error),checkedAt:X.now,nextRetryAt:X.now+Y,retryCount:$}}function c1(X,J){if(!X?.nextRetryAt||X.nextRetryAt<=J)return!1;return!0}function w5(X){if(!X)return;let J=Number(X);if(Number.isFinite(J)&&J>0)return Math.ceil(J);let $=Date.parse(X);if(Number.isFinite($)){let Y=Math.ceil(($-Date.now())/1000);return Y>0?Y:void 0}return}import{createServer as Pz}from"node:http";import{setTimeout as sD}from"node:timers/promises";var k2="app_EMoamEEZ73f0CkXaXp7hrann",a9="https://auth.openai.com",s4=1455,aD=3000,oD="cortexkit-opencode-openai-auth";function x2(X){return`${oD}/${X}`}var Mz="main",rD=`"${Mz}" is a reserved account id; choose a different label.`;function w2(X){let J=new Uint8Array(X),$=String.fromCharCode(...J);return btoa($).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function y5(){let J=Array.from(crypto.getRandomValues(new Uint8Array(43))).map((Y)=>"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"[Y%66]).join(""),$=w2(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(J)));return{verifier:J,challenge:$}}function V6(X){if(X.length>16384)return;let J=X.split(".");if(J.length!==3)return;let $=J[1];if(!$||$.length>8192)return;try{return JSON.parse(Buffer.from($,"base64url").toString())}catch{return}}function U6(X){let J=X.chatgpt_account_id;if(typeof J==="string"&&J.length>0)return J;let $=X["https://api.openai.com/auth"];if($&&typeof $==="object"&&!Array.isArray($)&&typeof $.chatgpt_account_id==="string"&&$.chatgpt_account_id.length>0)return $.chatgpt_account_id;let Y=X.organizations;if(Array.isArray(Y)){let G=Y[0];if(G&&typeof G==="object"&&!Array.isArray(G)&&typeof G.id==="string"&&G.id.length>0)return G.id}return}function Z8(X){if(X.id_token){let J=V6(X.id_token),$=J&&U6(J);if($)return $}if(X.access_token){let J=V6(X.access_token);return J?U6(J):void 0}return}function tD(X){return typeof X==="string"&&X.toLowerCase()===Mz}function v5(X){if(tD(X))throw Error(rD);return X}function h5(X,J,$){let Y=new URLSearchParams({response_type:"code",client_id:k2,redirect_uri:X,scope:"openid profile email offline_access",code_challenge:J.challenge,code_challenge_method:"S256",id_token_add_organizations:"true",codex_cli_simplified_flow:"true",state:$,originator:"opencode"});return`${a9}/oauth/authorize?${Y.toString()}`}async function eD(X,J,$){let Y=await fetch(`${a9}/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:X,redirect_uri:J,client_id:k2,code_verifier:$.verifier}).toString()});if(!Y.ok)throw Error(`Token exchange failed: ${Y.status}`);return await Y.json()}function XF(X){return X.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&#39;")}var JF=`<!doctype html>
-<html>
-  <head>
-    <title>CortexKit OpenAI Auth - Authorization Successful</title>
-    <style>
-      body {
-        font-family:
-          system-ui,
-          -apple-system,
-          sans-serif;
-        display: flex;
-        justify-content: center;
-        align-items: center;
-        height: 100vh;
-        margin: 0;
-        background: #131010;
-        color: #f1ecec;
-      }
-      .container {
-        text-align: center;
-        padding: 2rem;
-      }
-      h1 {
-        color: #f1ecec;
-        margin-bottom: 1rem;
-      }
-      p {
-        color: #b7b1b1;
-      }
-    </style>
-  </head>
-  <body>
-    <div class="container">
-      <h1>Authorization Successful</h1>
-      <p>You can close this window and return to OpenCode.</p>
-    </div>
-    <script>
-      setTimeout(() => window.close(), 2000)
-    </script>
-  </body>
-</html>`,I2=(X)=>`<!doctype html>
-<html>
-  <head>
-    <title>CortexKit OpenAI Auth - Authorization Failed</title>
-    <style>
-      body {
-        font-family:
-          system-ui,
-          -apple-system,
-          sans-serif;
-        display: flex;
-        justify-content: center;
-        align-items: center;
-        height: 100vh;
-        margin: 0;
-        background: #131010;
-        color: #f1ecec;
-      }
-      .container {
-        text-align: center;
-        padding: 2rem;
-      }
-      h1 {
-        color: #fc533a;
-        margin-bottom: 1rem;
-      }
-      p {
-        color: #b7b1b1;
-      }
-      .error {
-        color: #ff917b;
-        font-family: monospace;
-        margin-top: 1rem;
-        padding: 1rem;
-        background: #3c140d;
-        border-radius: 0.5rem;
-      }
-    </style>
-  </head>
-  <body>
-    <div class="container">
-      <h1>Authorization Failed</h1>
-      <p>An error occurred during authorization.</p>
-      <div class="error">${XF(X)}</div>
-    </div>
-  </body>
-</html>`,b2=[],n4,J9=new Map;function Oz(X,J){return new Promise(($,Y)=>{let G=(z)=>{X.off("listening",Q),Y(z)},Q=()=>{X.off("error",G),$()};X.once("error",G),X.once("listening",Q),X.listen(s4,J)})}function _z(X){X.close(()=>{}),X.closeIdleConnections?.(),setTimeout(()=>{X.closeAllConnections?.()},25).unref?.()}function n9(){return J9.size}function $9(X){if(J9.delete(X),n9()===0)s9()}async function f5(){let X=`http://localhost:${s4}/auth/callback`;if(b2.length>0)return{port:s4,redirectUri:X};if(n4)return n4;n4=(async()=>{let J=(Q,z)=>{let Z=new URL(Q.url||"/",`http://127.0.0.1:${s4}`);if(Z.pathname==="/auth/callback"){let W=Z.searchParams.get("code"),B=Z.searchParams.get("state"),H=Z.searchParams.get("error"),U=Z.searchParams.get("error_description");if(H){let N=U||H;if(B){let K=J9.get(B);if(K)K.reject(Error(N)),$9(B);else if(n9()===0)s9()}else if(n9()===0)s9();z.writeHead(200,{"Content-Type":"text/html"}),z.end(I2(N));return}if(!B){if(n9()===0)s9();z.writeHead(400,{"Content-Type":"text/html"}),z.end(I2("Missing state parameter"));return}if(!W){if(n9()===0)s9();z.writeHead(400,{"Content-Type":"text/html"}),z.end(I2("Missing authorization code"));return}let j=J9.get(B);if(!j){if(n9()===0)s9();z.writeHead(400,{"Content-Type":"text/html"}),z.end(I2("Unknown state — authorization may have expired"));return}$9(B),eD(W,X,j.pkce).then((N)=>j.resolve(N)).catch((N)=>j.reject(N)),z.writeHead(200,{"Content-Type":"text/html"}),z.end(JF);return}if(Z.pathname==="/cancel"){let W=Z.searchParams.get("state"),B=W?[W]:[...J9.keys()];z.writeHead(200),z.end("Login cancelled");for(let H of B){let U=J9.get(H);if(!U)continue;U.reject(Error("Login cancelled")),$9(H)}if(n9()===0)s9();return}z.writeHead(404),z.end("Not found")},$=Pz(J);await Oz($,"127.0.0.1");let Y=[$],G=Pz(J);try{await Oz(G,"::1"),Y.push(G)}catch(Q){let z=Q.code;if(z!=="EADDRNOTAVAIL"&&z!=="EAFNOSUPPORT")throw _z($),Q}return b2=Y,{port:s4,redirectUri:X}})();try{return await n4}finally{n4=void 0}}function s9(){let X=b2;b2=[];for(let J of X)_z(J)}function g5(X,J,$=300000,Y){return new Promise((G,Q)=>{if(Y?.aborted){$9(J),Q(Error("Login cancelled"));return}let z=setTimeout(()=>{if(J9.get(J))$9(J),Q(Error("OAuth callback timeout — authorization took too long"))},$),Z=()=>{if(clearTimeout(z),J9.get(J))$9(J),Q(Error("Login cancelled"))};if(Y)Y.addEventListener("abort",Z);J9.set(J,{pkce:X,state:J,resolve:(W)=>{if(clearTimeout(z),Y)Y.removeEventListener("abort",Z);G(W)},reject:(W)=>{if(clearTimeout(z),Y)Y.removeEventListener("abort",Z);Q(W)}})})}async function m5(X){let J=await fetch(`${a9}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"Content-Type":"application/json","User-Agent":x2(X)},body:JSON.stringify({client_id:k2})});if(!J.ok)throw Error("Failed to initiate device authorization");let $=await J.json();return{deviceData:$,url:`${a9}/codex/device`,instructions:`Enter code: ${$.user_code}`}}async function u5(X,J,$){let Y=Math.max(parseInt(X.interval,10)||5,1)*1000,G=typeof X.expires_in==="number"?X.expires_in:parseInt(X.expires_in||"",10),Q=!Number.isNaN(G)&&G>0?G*1000:900000,z=Date.now();while(!0){if($?.aborted)throw Error("Device authorization cancelled");if(Date.now()-z>Q)throw Error("Device authorization expired");let Z=await fetch(`${a9}/api/accounts/deviceauth/token`,{method:"POST",headers:{"Content-Type":"application/json","User-Agent":x2(J)},body:JSON.stringify({device_auth_id:X.device_auth_id,user_code:X.user_code})});if(Z.ok){let H=await Z.json(),U=await fetch(`${a9}/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:H.authorization_code,redirect_uri:`${a9}/deviceauth/callback`,client_id:k2,code_verifier:H.code_verifier}).toString()});if(!U.ok)throw Error(`Token exchange failed: ${U.status}`);return await U.json()}if(Z.status!==403&&Z.status!==404)throw Error(`Device authorization failed: ${Z.status}`);let W=Q-(Date.now()-z);if(W<=0)throw Error("Device authorization expired");let B=Math.min(Y+aD,W);try{await sD(B,void 0,{signal:$})}catch(H){if(H instanceof Error&&H.name==="AbortError")throw Error("Device authorization cancelled");throw H}}}async function v2(X){let{label:J,headless:$=!1,signal:Y,version:G}=X;if(v5(J),$){let{deviceData:H,url:U,instructions:j}=await m5(G),N=(async()=>{let K=await u5(H,G,Y),q=Date.now(),F=Z8(K);return{id:v5(J||F||crypto.randomUUID()),label:J||void 0,type:"oauth",access:K.access_token,refresh:K.refresh_token,expires:q+(K.expires_in??3600)*1000,enabled:!0,addedAt:q,lastUsed:q,lastRefreshedAt:q,accountId:F}})();return{url:U,instructions:j,completion:N}}let{redirectUri:Q}=await f5(),z=await y5(),Z=w2(crypto.getRandomValues(new Uint8Array(32)).buffer),W=h5(Q,z,Z),B=(async()=>{try{if(Y?.aborted)throw Error("Login cancelled");let H=await g5(z,Z,void 0,Y),U=Date.now(),j=Z8(H);return{id:v5(J||j||crypto.randomUUID()),label:J||void 0,type:"oauth",access:H.access_token,refresh:H.refresh_token,expires:U+(H.expires_in??3600)*1000,enabled:!0,addedAt:U,lastUsed:U,lastRefreshedAt:U,accountId:j}}finally{$9(Z)}})();return{url:W,instructions:"Complete authorization in your browser. This window will close automatically.",completion:B}}function y2(X){if(X==null||X==="")return;let J=typeof X==="number"?X:Number(X);if(Number.isFinite(J)){let Y=J<100000000000?J*1000:J,G=new Date(Y);return Number.isNaN(G.getTime())?void 0:G.toISOString()}let $=new Date(X);return Number.isNaN($.getTime())?void 0:$.toISOString()}function p5(X){let J=Number(X);return Number.isFinite(J)&&J>0?J:void 0}function Az(X){return typeof X==="number"&&Number.isFinite(X)&&X>=0?X:void 0}function Tz(X,J){let $=X.get(J);if($===null||$.trim()==="")return;let Y=Number($);if(!Number.isFinite(Y)||Y<0||Y>100)return;let G=J.slice(0,-13),Q=p5(X.get(`${G}-window-minutes`)),z=y2(X.get(`${G}-reset-at`)??void 0);if(Y===0&&X.get(`${G}-window-minutes`)==="0"&&!z)return;return{usedPercent:Y,remainingPercent:100-Y,resetsAt:z,checkedAt:Date.now(),...Q!==void 0?{windowMinutes:Q}:{}}}var Ez=["x-codex-primary-used-percent","x-codex-secondary-used-percent"];function Sz(X,J){let $=X.get(J);if($===null)return"absent";if($.trim()==="")return"invalid";let Y=Number($);return Number.isFinite(Y)&&Y>=0&&Y<=100?"valid":"invalid"}function o9(X){if(Ez.some((G)=>Sz(X,G)==="invalid"))return{};let J={},$=Tz(X,"x-codex-primary-used-percent");if($)J.primary=$;let Y=Tz(X,"x-codex-secondary-used-percent");if(Y)J.secondary=Y;return J}function d1(X){let J=Ez.map(($)=>Sz(X,$));return J.includes("valid")&&!J.includes("invalid")}function Rz(X){if(!X)return;if(!Number.isFinite(X.used_percent)||X.used_percent<0||X.used_percent>100)return;let J=p5(X.window_minutes),$=y2(X.reset_at);if(X.used_percent===0&&J===void 0&&!$)return;return{usedPercent:X.used_percent,remainingPercent:100-X.used_percent,resetsAt:$,checkedAt:Date.now(),...J!==void 0?{windowMinutes:J}:{}}}function Iz(X){let J={},$=Rz(X.rate_limits?.primary);if($)J.primary=$;let Y=Rz(X.rate_limits?.secondary);if(Y)J.secondary=Y;return J}function l1(X){if(X==null||X==="")return;let J=Number(X);return Number.isFinite(J)&&J>=0?J:void 0}function Cz(X){if(!X)return;if(!Number.isFinite(X.used_percent)||X.used_percent<0||X.used_percent>100)return;let J=p5(X.limit_window_seconds),$=y2(X.reset_at);if(X.used_percent===0&&J===void 0&&!$)return;return{usedPercent:X.used_percent,remainingPercent:100-X.used_percent,resetsAt:$,checkedAt:Date.now(),...J!==void 0?{windowMinutes:J/60}:{}}}function bz(X){let J={},$=Cz(X.rate_limit?.primary_window);if($)J.primary=$;let Y=Cz(X.rate_limit?.secondary_window);if(Y)J.secondary=Y;let G=Az(X.rate_limit_reset_credits?.available_count);if(G!==void 0)J.resetCreditsAvailable=G;let Q=Az(X.rate_limit_reset_credits?.applicable_available_count);if(Q!==void 0)J.resetCreditsApplicable=Q;let z=X.spend_control?.individual_limit;if(X.spend_control===null||z===null)J.spendControlCleared=!0;if(z&&typeof X.spend_control?.reached==="boolean"){let W=l1(z.limit),B=l1(z.used),H=l1(z.remaining),U=l1(z.used_percent),j=l1(z.remaining_percent);if(W!==void 0&&B!==void 0&&H!==void 0&&U!==void 0&&j!==void 0)J.spendControl={limit:W,used:B,remaining:H,usedPercent:U,remainingPercent:j,resetsAt:y2(z.reset_at),unit:z.unit,source:z.source,reached:X.spend_control.reached}}let Z=X.credits;if(Z&&typeof Z.has_credits==="boolean"&&typeof Z.unlimited==="boolean"&&typeof Z.overage_limit_reached==="boolean"){let W=l1(Z.balance);J.credits={hasCredits:Z.has_credits,unlimited:Z.unlimited,overageLimitReached:Z.overage_limit_reached,...W!==void 0?{balance:W}:{}}}return J}import{readdirSync as mF,statSync as uF}from"node:fs";import{tmpdir as HZ,userInfo as pF}from"node:os";import{join as a1}from"node:path";import{debuglog as KF}from"node:util";import{createHmac as QF,randomBytes as zF,timingSafeEqual as ZF}from"node:crypto";import GF from"node:net";var m6=2,h2=21,f2=5,c5=67108864,u;(function(X){X[X.Request=0]="Request",X[X.Response=1]="Response",X[X.Push=2]="Push",X[X.StreamData=3]="StreamData",X[X.StreamEnd=4]="StreamEnd",X[X.Error=5]="Error",X[X.Cancel=6]="Cancel",X[X.Ping=7]="Ping",X[X.Pong=8]="Pong",X[X.Hello=9]="Hello",X[X.HelloAck=10]="HelloAck",X[X.Goodbye=11]="Goodbye"})(u||(u={}));var kz=u.Goodbye;function xz(X){return X===u.Cancel||X===u.Ping||X===u.Pong||X===u.Goodbye}var t0;(function(X){X[X.Passive=0]="Passive",X[X.Interactive=1]="Interactive",X[X.Background=2]="Background"})(t0||(t0={}));var K6;(function(X){X[X.Normal=0]="Normal",X[X.Expedite=1]="Expedite",X[X.Sheddable=2]="Sheddable"})(K6||(K6={}));var wz=1,vz=6,l5=1,$F=8,yz=48,d5=4;var hz=0;function T6(X,J,$,Y=K6.Normal){let G=0;if(X)G|=wz;if(G|=J<<l5,$)G|=$F;return G|=Y<<d5,G}function i5(X){return(X&wz)!==0}function fz(X){let J=new Uint8Array(21),$=new DataView(J.buffer);return $.setUint32(0,X.len,!0),J[4]=X.ver,J[5]=X.ty,J[6]=X.flags,$.setUint16(7,X.channel,!0),$.setUint32(9,X.epoch,!0),$.setBigUint64(13,X.corr,!0),J}class I0 extends Error{code;constructor(X,J){super(X);this.code=J,this.name="DecodeError"}}function YF(X){let J=X.len>>>0,$=X.ver>>>0&255,Y=X.ty>>>0&255,G=X.flags>>>0&255,Q=X.channel>>>0&65535,z=X.epoch>>>0;if(BigInt.asUintN(64,X.corr),$!==2)throw new I0(`unsupported envelope version ${$}`,"unsupported_version");if(Y>kz)throw new I0(`unknown frame type byte ${Y}`,"unknown_frame_type");let Z=Y;if((G&hz)!==0)throw new I0(`reserved flag bits set in flags 0b${G.toString(2).padStart(8,"0")}`,"reserved_flag_bits");if((G&vz)>>l5===3)throw new I0(`reserved priority bits set in flags 0b${G.toString(2).padStart(8,"0")}`,"reserved_priority_bits");let W=(G&yz)>>d5;if(W===3)throw new I0(`reserved admission class set in flags 0b${G.toString(2).padStart(8,"0")}`,"reserved_admission_class");if(W===K6.Sheddable&&Z!==u.Push&&Z!==u.StreamData)throw new I0(`SHEDDABLE admission class is illegal on ${u[Z]} in flags 0b${G.toString(2).padStart(8,"0")}`,"sheddable_illegal_frame_type");if(Q===0&&z!==0)throw new I0(`control channel carried nonzero epoch ${z}`,"nonzero_epoch_on_control_channel");if(xz(Z)&&J!==0)throw new I0(`pure-header frame ${u[Z]} declared non-zero body length ${J}`,"pure_header_frame_with_body")}function n5(X){if(X.length<5)throw new I0(`header shorter than frozen prefix: have ${X.length} bytes`,"too_short_for_prefix");let J=X[4];if(J!==2)throw new I0(`unsupported envelope version ${J}`,"unsupported_version");if(X.length<21)throw new I0(`header too short for version: have ${X.length} bytes, need 21`,"too_short_for_header");let $=new DataView(X.buffer,X.byteOffset,X.byteLength),Y=$.getUint32(0,!0),G=X[5];if(G>kz)throw new I0(`unknown frame type byte ${G}`,"unknown_frame_type");let Q=G,z=X[6];if((z&hz)!==0)throw new I0(`reserved flag bits set in flags 0b${z.toString(2).padStart(8,"0")}`,"reserved_flag_bits");if((z&vz)>>l5===3)throw new I0(`reserved priority bits set in flags 0b${z.toString(2).padStart(8,"0")}`,"reserved_priority_bits");let Z=(z&yz)>>d5;if(Z===3)throw new I0(`reserved admission class set in flags 0b${z.toString(2).padStart(8,"0")}`,"reserved_admission_class");if(Z===K6.Sheddable&&Q!==u.Push&&Q!==u.StreamData)throw new I0(`SHEDDABLE admission class is illegal on ${u[Q]} in flags 0b${z.toString(2).padStart(8,"0")}`,"sheddable_illegal_frame_type");let W=$.getUint16(7,!0),B=$.getUint32(9,!0);if(W===0&&B!==0)throw new I0(`control channel carried nonzero epoch ${B}`,"nonzero_epoch_on_control_channel");if(xz(Q)&&Y!==0)throw new I0(`pure-header frame ${u[Q]} declared non-zero body length ${Y}`,"pure_header_frame_with_body");return{len:Y,ver:J,ty:Q,flags:z,channel:W,epoch:B,corr:$.getBigUint64(13,!0)}}function j6(X,J,$,Y,G,Q){return C8(2,X,J,$,Y,G,Q)}function C8(X,J,$,Y,G,Q,z){if(z.length>67108864)throw new I0(`frame body ${z.length} exceeds max 67108864`,"frame_body_too_large");let Z={len:z.length,ver:X,ty:J,flags:$,channel:Y,epoch:G,corr:Q};return YF(Z),{header:Z,body:z}}function W8(X){if(X.header.len!==X.body.length)throw new I0(`frame header length ${X.header.len} does not match body length ${X.body.length}`,"frame_length_mismatch");let J=fz(X.header),$=new Uint8Array(J.length+X.body.length);return $.set(J,0),$.set(X.body,J.length),$}class Y9 extends Error{}class B8 extends Error{}class E8 extends Error{cause;constructor(X,J){super(X);this.cause=J}}class O9 extends Error{cause;constructor(X,J){super(X);this.cause=J}}function gz(X){return Buffer.from(X.buffer,X.byteOffset,X.byteLength)}var mz=Symbol("subc.socket.writeBorrowed"),uz=Symbol("subc.socket.writeTrackedBorrowed");function H8(X,J,$){let Y=X[mz];return Y?Y.call(X,J,$):X.write(J,$)}function s5(X,J,$){let Y=X[uz];return Y?Y.call(X,J,$):X.writeTracked(J,$)}class r9{sock;chunks=[];buffered=0;waiter=null;closedErr=null;bufferedBytes(){return this.buffered}constructor(X){this.sock=X,X.on("data",($)=>{this.chunks.push($),this.buffered+=$.length,this.tryServe()});let J=($)=>{if(!this.closedErr)this.closedErr=$;this.tryServe()};X.on("error",($)=>J($ instanceof Error?$:Error(String($)))),X.on("end",()=>J(new Y9("subc closed the connection"))),X.on("close",()=>J(new Y9("subc connection closed")))}localPort(){return this.sock.localPort??null}static connect(X,J,$){return new Promise((Y,G)=>{let Q=GF.connect({host:X,port:J});Q.setNoDelay(!0);let z=setTimeout(()=>{Q.destroy(),G(new B8(`timed out connecting to ${X}:${J}`))},Math.max(0,$-Date.now()));Q.once("connect",()=>{clearTimeout(z),Y(new r9(Q))}),Q.once("error",(Z)=>{clearTimeout(z),G(Z)})})}async readFrame(X,J,$){let Y=await this.readExact(f2,X),G=Y[4];if(G!==m6)throw new I0(`unsupported envelope version ${G}`,"unsupported_version");let Q=await this.readExact(h2-f2,X),z=new Uint8Array(h2);z.set(Y),z.set(Q,f2);let Z=n5(z);if(Z.len>c5)throw new I0(`frame body ${Z.len} exceeds max ${c5}`,"frame_body_too_large");$?.();let W=typeof J==="number"?J:Date.now()+J.afterHeaderMs,B=Z.len===0?new Uint8Array(0):await this.readExact(Z.len,W);return{header:Z,body:B}}readExact(X,J){if(this.waiter)return Promise.reject(Error("concurrent readExact is not supported"));if(X===0)return Promise.resolve(new Uint8Array(0));return new Promise(($,Y)=>{let G=null;if(Number.isFinite(J)){let Q=J-Date.now();if(Q<=0){Y(new B8(`timed out waiting for ${X} bytes`));return}G=setTimeout(()=>{this.waiter=null,Y(new B8(`timed out waiting for ${X} bytes`))},Q)}this.waiter={need:X,resolve:$,reject:Y,timer:G},this.tryServe()})}async write(X,J){await this.writeBuffer(Buffer.from(X),J)}writeTracked(X,J){return this.writeTrackedBuffer(Buffer.from(X),J)}async[mz](X,J){await this.writeBuffer(gz(X),J)}[uz](X,J){return this.writeTrackedBuffer(gz(X),J)}async writeBuffer(X,J){try{await this.writeTrackedBuffer(X,J).completed}catch($){if($ instanceof E8||$ instanceof O9)throw $.cause??$;throw $}}writeTrackedBuffer(X,J){if(this.closedErr)return{queued:!1,completed:Promise.reject(new E8("subc socket was closed before bytes could be queued",this.closedErr))};let $=!1,Y=!1,G=null,Q=new Promise((z,Z)=>{let W=(H)=>{if(Y)return;if(Y=!0,G)clearTimeout(G);H()},B=J-Date.now();if(B<=0){W(()=>Z(new E8("timed out before bytes could be queued to subc",new B8("timed out writing to subc"))));return}G=setTimeout(()=>{let H=new B8("timed out writing to subc");W(()=>Z($?new O9("timed out after bytes were handed to the subc socket",H):new E8("timed out before bytes could be queued to subc",H)))},B);try{this.sock.write(X,(H)=>{W(()=>{if(H)Z(new O9("subc socket reported a write error after bytes were handed to the socket",H instanceof Error?H:Error(String(H))));else z()})}),$=!0}catch(H){W(()=>Z(new E8("subc socket write threw before bytes could be queued",H instanceof Error?H:Error(String(H)))))}});return{queued:$,completed:Q}}close(){this.sock.destroy()}tryServe(){let X=this.waiter;if(!X)return;if(this.buffered>=X.need){let J=this.take(X.need);if(this.waiter=null,X.timer)clearTimeout(X.timer);X.resolve(J);return}if(this.closedErr){if(this.waiter=null,X.timer)clearTimeout(X.timer);X.reject(this.closedErr)}}take(X){let J=Buffer.allocUnsafe(X),$=0;while($<X){let Y=this.chunks[0],G=X-$;if(Y.length<=G)Y.copy(J,$),$+=Y.length,this.chunks.shift();else Y.copy(J,$,0,G),this.chunks[0]=Y.subarray(G),$+=G}return this.buffered-=X,J}}var lz=32;var g2=4096,dz="subc-server-v1",iz="subc-client-v1",WF="client";class R6 extends Error{}function o5(X,J,$,Y,G){let Q=QF("sha256",Buffer.from(X));return Q.update(Buffer.from(J,"utf8")),Q.update(Buffer.from($)),Q.update(Buffer.from(Y)),Q.update(Buffer.from(G)),new Uint8Array(Q.digest())}function pz(X,J){if(X.length!==J.length)return!1;return ZF(Buffer.from(X),Buffer.from(J))}async function cz(X,J,$){let Y=Buffer.from(JSON.stringify(J),"utf8");if(Y.length>g2)throw new R6(`auth message too large: ${Y.length} > ${g2}`);let G=new Uint8Array(4);new DataView(G.buffer).setUint32(0,Y.length,!0),await H8(X,G,$),await H8(X,Y,$)}async function BF(X,J){let $=await X.readExact(4,J),Y=new DataView($.buffer,$.byteOffset,4).getUint32(0,!0);if(Y>g2)throw new R6(`auth message too large: ${Y} > ${g2}`);let G=Y===0?new Uint8Array(0):await X.readExact(Y,J);try{return JSON.parse(Buffer.from(G).toString("utf8"))}catch(Q){throw new R6(`auth message JSON decode failed: ${String(Q)}`)}}function a5(X,J){if(!Array.isArray(X))throw new R6(`auth field '${J}' must be a byte array`);for(let $ of X)if(typeof $!=="number"||!Number.isInteger($)||$<0||$>255)throw new R6(`auth field '${J}' has invalid byte ${String($)}`);return Uint8Array.from(X)}async function a4(X,J,$){let Y=new Uint8Array(zF(lz));await cz(X,{client_nonce:Array.from(Y),role:WF},$);let G=await BF(X,$),Q=a5(G.server_nonce,"server_nonce"),z=a5(G.daemon_id,"daemon_id"),Z=a5(G.server_proof,"server_proof"),W=o5(J.key,dz,Y,Q,z);if(!pz(W,Z))throw new R6("server proof mismatch — wrong key or impostor daemon");if(!pz(z,J.daemonId))throw new R6("daemon id mismatch — connection file points at a different daemon");let B=o5(J.key,iz,Y,Q,z);await cz(X,{client_auth:Array.from(B)},$)}import{promises as r5}from"node:fs";var nz=1,sz=32,az=16;class Q6 extends Error{}function oz(X,J){if(!Array.isArray(X))throw new Q6(`connection file field '${J}' must be a JSON array of bytes`);for(let $ of X)if(typeof $!=="number"||!Number.isInteger($)||$<0||$>255)throw new Q6(`connection file field '${J}' has invalid byte ${String($)}`);return Uint8Array.from(X)}function HF(X){if(X.schema!==nz)throw new Q6(`unsupported connection file schema ${X.schema}; expected ${nz}`);if(X.endpoints.length===0)throw new Q6("connection file must include at least one endpoint");if(X.key.length<sz)throw new Q6(`connection file key is too short: ${X.key.length} bytes, need at least ${sz}`);if(X.daemonId.length!==az)throw new Q6(`connection file daemon_id must be ${az} bytes, got ${X.daemonId.length}`)}async function VF(X){if(process.platform==="win32")return;let $=(await r5.stat(X)).mode&511;if(($&63)!==0)throw new Q6(`connection file ${X} has insecure permissions 0o${$.toString(8)}; expected owner-only 0600`)}async function i1(X){await VF(X);let J=await r5.readFile(X,"utf8"),$;try{$=JSON.parse(J)}catch(Z){throw new Q6(`connection file JSON read failed for ${X}: ${String(Z)}`)}let Y=$.wire_version;if(Y!==void 0&&Y!==m6)throw new Q6(`connection file wire_version ${String(Y)} but this client speaks ${m6}; the client library must be upgraded`);let G=$.endpoints;if(!Array.isArray(G))throw new Q6("connection file 'endpoints' must be an array");let Q=G.map((Z)=>{let W=Z;if(typeof W.host!=="string"||typeof W.port!=="number")throw new Q6("connection file endpoint must be { host: string, port: number }");return{host:W.host,port:W.port}}),z={schema:$.schema,endpoints:Q,key:oz($.key,"key"),daemonId:oz($.daemon_id,"daemon_id"),pid:$.pid,daemonVer:$.daemon_ver??""};return HF(z),z}var rz=new WeakMap,t5=new WeakMap;class e5 extends Error{methodFamily;code="reverse_request_capability_not_declared";constructor(X){super(`reverse-request capability ${JSON.stringify(X)} was not registered before route.open`);this.methodFamily=X,this.name="ReverseRequestRegistrationError"}}class M9{handlers=new Map;declaredFamilies=null;onRequest(X,J){if(!UF(X))throw TypeError(`reverse-request method family must be a capability identifier, got ${JSON.stringify(X)}`);if(typeof J!=="function")throw TypeError("reverse-request handler must be a function");if(this.declaredFamilies&&!this.declaredFamilies.has(X))throw new e5(X);this.handlers.set(X,J)}capabilities(){return[...this.handlers.keys()].sort()}handler(X){return this.handlers.get(X)}seal(){this.declaredFamilies??=new Set(this.handlers.keys())}}class m2{channel;epoch;constructor(X,J,$,Y){if(!Number.isInteger(X)||X<=0||X>65535)throw RangeError(`route channel must be an integer in 1..65535, got ${X}`);if(!Number.isInteger(J)||J<=0||J>4294967295)throw RangeError(`route epoch must be an integer in 1..4294967295, got ${J}`);this.channel=X,this.epoch=J,Y.seal(),rz.set(this,$),t5.set(this,Y),Object.freeze(this)}onRequest(X,J){t5.get(this).onRequest(X,J)}static create(X,J,$,Y){return new m2(X,J,$,Y)}}function u2(X,J,$,Y=new M9){return m2.create(X,J,$,Y)}function tz(X,J){return t5.get(X)?.handler(J)}function UF(X){return/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/.test(X)}class G9 extends Error{handle;code="stale_route_handle";constructor(X){super(`route handle (${X.channel}, ${X.epoch}) is not live on the current connection`);this.handle=X,this.name="StaleRouteHandleError"}}function n1(){return Object.freeze({})}function o4(X,J){return rz.get(X)===J}function p2(X,J){return X===J}var ez=KF("subc-client"),jF=1e4,s1=30000,NF=50,qF=2000,XZ="request_deadline",XJ="deadline_exceeded_no_drop_observed",LF=30000,DF=30000,JZ=new Uint8Array(0),FF="management_surface",i2="SUBC_MODULE_ID",n2="SUBC_LAUNCH_NONCE",s2={baseMs:100,capMs:2000,maxAttempts:6};class z6 extends Error{kind;code;cause;constructor(X,J,$,Y){super(J);this.kind=X,this.code=$,this.cause=Y,this.name="SubcCallError"}get detail(){return this.cause instanceof N0?this.cause.detail:void 0}}class N0 extends Error{code;detail;constructor(X,J,$){super(X);this.code=J,this.detail=$}}var $Z=new WeakMap;function JJ(X){if(X instanceof Uint8Array)return X;let J=X===null?"null":Array.isArray(X)?"array":typeof X;throw new N0(`binary request body must be a Uint8Array; got ${J}`,"binary_body_required")}class t9{sock;currentConn;opts;nextCorr=1n;pending=new Map;lateResponses=new Map;routes=new Map;liveRoutes=new Map;connectionToken=n1();ingressEpochDropCount=0;closedErr=null;closeStarted=!1;reconnecting=null;generation=1;readerActive=!1;constructor(X,J,$){this.sock=X,this.currentConn=J,this.opts=$,this.readLoop(X,this.generation)}get conn(){return this.currentConn}static async connect(X){let J=MF(X),$=await t9.openConnection(J);return new t9($.sock,$.conn,J)}async catalogList(X){let J=this.encode(X===void 0?{op:"catalog.list"}:{op:"catalog.list",module_id:X}),$=await this.controlRpc(J);return this.parseJson($).modules??[]}async resolveProvider(X){let J=await this.resolveProviders(X);if(J.length===0)throw new N0(`no catalog claimant for capability ${X}`,"capability_unprovided");if(J.length>1)throw new N0(`multiple catalog claimants for capability ${X}: ${J.join(", ")}`,"capability_ambiguous");return J[0]}async resolveProviders(X){if(!zZ(X))throw new N0(`malformed capability identifier ${JSON.stringify(X)}`,"invalid_capability_identifier");return(await this.catalogList()).filter(($)=>$.capabilities?.provides.includes(X)??!1).map(($)=>$.module_id).sort()}async routeOpen(X,J,$={}){let Y=$J($),G=$.reverseRequests??new M9;G.seal();let Q=G.capabilities(),z=this.encode({op:"route.open",target:X,identity:J,...Y?{consumer_identity:Y}:{},...Q.length>0?{consumer_capabilities:Q}:{}}),Z=null,W=(H)=>{if(H.header.ty!==u.Response)return!0;let U=this.parseJson(H);if(typeof U.route_channel!=="number"||typeof U.route_epoch!=="number")throw new N0(`route.open returned no route handle: ${JSON.stringify(U)}`);return Z=this.installRoute(U.route_channel,U.route_epoch,G),!0},B=(H)=>{if(H.header.ty!==u.Response)return;try{let U=this.parseJson(H);if(typeof U.route_channel!=="number"||typeof U.route_epoch!=="number")return;let j=this.installRoute(U.route_channel,U.route_epoch);this.failHandle(j,new N0("late route.open was closed","route_closed")),this.liveRoutes.delete(j.channel),this.sendRouteGoodbye(j,!0)}catch{this.closeConnectionAfterCleanupFailure()}};if(await this.controlRpc(z,W,B),!Z)throw new N0("route.open response was not installed");return Z}async request(X,J,$={}){this.assertLiveHandle(X);let Y=$.binary??!1,G=Y?JJ(J):J instanceof Uint8Array?J:this.encode(J),Q=$.priority??t0.Interactive,z=$.admissionClass??K6.Normal,Z=await this.send(X,G,Q,z,$.timeoutMs,$.onProgress,void 0,void 0,Y,$.signal);return this.decodeReply(Z)}async call(X,J,$,Y={}){if(Y.binary)throw new N0("call() builds a JSON body and cannot send a binary request; use callBinary(moduleId, body, opts) with a Uint8Array","binary_call_requires_call_binary");let G=$===void 0?{method:J}:{method:J,params:$};return await this.managedCall(X,G,Y)}async callBinary(X,J,$={}){let Y=JJ(J);return this.managedCall(X,Y,{...$,binary:!0})}async managedCall(X,J,$){let Y=!1;for(;;){let G=await this.cachedRouteHandle(X,$);try{return await this.managedRequest(G,J,$)}catch(Q){if(!(Q instanceof z6))throw this.terminalCallError("managed call failed",Q);let z=a2(Q.cause instanceof N0?$Z.get(Q.cause)??0:0,Q.code);if(z&&!Y&&!this.closeStarted){Y=!0,this.evictRouteHandle(G);continue}if(z&&Y)this.evictRouteHandle(G);if(Q.code==="route_closed")throw this.evictRouteHandle(G),Q;if(Q.kind==="not_sent"){if(!this.closedErr)throw Q;try{await this.reconnectAfterDrop(Q)}catch(Z){throw this.notSentRecoveryError("managed call was not sent",Z)}continue}if(Q.kind==="outcome_unknown"&&Q.code!==XJ){if(this.closedErr)this.scheduleReconnectAfterDrop(Q)}else if(Q.kind==="outcome_unknown"&&Q.code===XJ)this.probeLivenessAfterDeadline();throw Q}}}subscribe(X,J,$,Y={}){this.assertLiveHandle(X);let G=J instanceof Uint8Array?J:this.encode(J),Q=Y.priority??t0.Interactive,z=Y.admissionClass??K6.Normal,Z=this.allocateCorr(),W=c2(X,Z),B=null,H=null,U=new Promise((K,q)=>{if(this.closedErr){q(this.closedErr);return}H=K,B={handle:X,resolve:()=>K(),reject:q,onProgress:$,timer:null,subscription:!0},this.pending.set(W,B);let F=j6(u.Request,T6(!1,Q,!1,z),X.channel,X.epoch,Z,G);H8(this.sock,W8(F),Date.now()+s1).catch((O)=>{let _=this.pending.get(W);if(_)this.rejectPending(W,_,O instanceof Error?O:new N0(String(O)))})}),j=!1;return{unsubscribe:()=>{if(j)return;if(j=!0,B&&H)this.settle(W,B,H);if(this.isLiveHandle(X))this.cancel(X,Z,Q)},closed:U}}attachCancelSignal(X,J,$,Y,G){if(!$)return;let Q=()=>{if(!this.pending.has(J))return;try{this.cancel($,Y,G)}catch{}};if(X.aborted){Q();return}X.addEventListener("abort",Q,{once:!0});let z=this.pending.get(J);if(z){let Z=z.onSettle;z.onSettle=()=>{Z?.(),X.removeEventListener("abort",Q)}}}cancel(X,J,$=t0.Interactive){this.assertLiveHandle(X);let Y=j6(u.Cancel,T6(!1,$,!1),X.channel,X.epoch,J,JZ);H8(this.sock,W8(Y),Date.now()+s1).catch(()=>{return})}async routePoll(X,J){this.assertLiveHandle(X);let $=this.encode({op:"route.poll",route_channel:X.channel,route_epoch:X.epoch,kind:J}),Y=await this.controlRpc($,(G)=>{if(G.header.ty!==u.Response)return!0;let Q=this.parseJson(G);return Q.route_channel===X.channel&&Q.route_epoch===X.epoch});return this.parseJson(Y)}async closeRoute(X,J={}){this.assertLiveHandle(X);for(let[$,Y]of this.routes)if(Y.handle&&p2(Y.handle,X))Y.closed=!0,Y.handle=null,this.routes.delete($);if(J.drain)await this.drainUnaryOnHandle(X);if(this.failHandle(X,new N0("route closed by closeRoute","route_closed")),this.liveRoutes.get(X.channel)===X)this.liveRoutes.delete(X.channel);this.sendRouteGoodbye(X)}async closeManagedRoute(X,J,$={}){let Y=YZ(X,J,$J($),($.reverseRequests??new M9).capabilities()),G=this.routes.get(Y);if(!G)return;G.closed=!0,this.routes.delete(Y);let Q=G.handle;if(G.handle=null,Q)await this.closeRoute(Q,$)}async closeRouteChannel(X,J={}){await this.closeRoute(X,J)}close(){this.closeStarted=!0,this.fail(new N0("client closed")),this.sock.close()}drainUnaryOnHandle(X){let J=[];for(let $ of this.pending.values())if($.handle===X&&!$.subscription)J.push(new Promise((Y)=>{let G=$.onSettle;$.onSettle=()=>{G?.(),Y()}}));return Promise.all(J).then(()=>{return})}sendRouteGoodbye(X,J=!1){if(this.assertLiveConnection(X),this.closedErr){if(J)this.closeConnectionAfterCleanupFailure();return}let $=j6(u.Goodbye,T6(!1,t0.Interactive,!1),X.channel,X.epoch,0n,JZ),Y=s5(this.sock,W8($),Date.now()+s1);if(!Y.queued&&J)this.closeConnectionAfterCleanupFailure();Y.completed.catch(()=>{if(J&&!Y.queued)this.closeConnectionAfterCleanupFailure()})}static async openConnection(X){let J=await i1(X.connectionFile),$=Date.now()+(X.handshakeTimeoutMs??jF),Y=J.endpoints[0],G=await r9.connect(Y.host,Y.port,$);try{await a4(G,J,$)}catch(Q){throw G.close(),Q}return{sock:G,conn:J}}async controlRpc(X,J,$){return this.send(null,X,t0.Interactive,K6.Normal,void 0,void 0,J,$)}send(X,J,$,Y,G,Q,z,Z,W=!1,B){if(X)this.assertLiveHandle(X);if(this.closedErr)return Promise.reject(this.closedErr);let H;try{H=this.allocateCorr()}catch(q){return Promise.reject(q)}let U=c2(X,H),j=X?.channel??0,N=X?.epoch??0,K=j6(u.Request,T6(W,$,!1,Y),j,N,H,J);return new Promise((q,F)=>{let O=G??s1,_={handle:X,resolve:q,reject:F,onProgress:Q,timer:null,acceptFrame:z,onLateResponse:Z};if(_.timer=setTimeout(()=>this.arbitrateTimeout(U,_,j,H,O),O),this.pending.set(U,_),B)this.attachCancelSignal(B,U,X,H,$);H8(this.sock,W8(K),Date.now()+O).catch((C)=>{let L=this.pending.get(U);if(L)this.rejectPending(U,L,C instanceof Error?C:new N0(String(C)))})})}arbitrateTimeout(X,J,$,Y,G){let Q=()=>{if(J.onLateResponse)this.lateResponses.set(X,J.onLateResponse);this.rejectPending(X,J,new N0(this.timeoutMessage($,Y,G),XZ))},z=Date.now()+this.opts.timeoutArbitrationGraceMs,Z=()=>{if(this.pending.get(X)!==J)return;if((this.readerActive||this.sock.bufferedBytes()>0)&&Date.now()<z){setImmediate(Z);return}Q()};setImmediate(Z)}async managedRequest(X,J,$){let Y=$.binary??!1,G=Y?JJ(J):J instanceof Uint8Array?J:this.encode(J),Q=$.priority??t0.Interactive,z=$.admissionClass??K6.Normal;try{let Z=await this.sendManaged(X,G,Q,z,$.timeoutMs,$.onProgress,Y,$.signal);return this.decodeReply(Z)}catch(Z){if(Z instanceof z6)throw Z;throw this.terminalCallError("managed call failed",Z)}}sendManaged(X,J,$,Y,G,Q,z=!1,Z){try{this.assertLiveHandle(X)}catch(N){return Promise.reject(this.notSentCallError("request used a stale route handle",N))}if(this.closedErr)return Promise.reject(this.notSentCallError("request was not sent because the subc connection was already closed",this.closedErr));let W;try{W=this.allocateCorr()}catch(N){return Promise.reject(this.notSentCallError("request correlation allocator was exhausted",N))}let B=c2(X,W),H=j6(u.Request,T6(z,$,!1,Y),X.channel,X.epoch,W,J),U=!1,j=(N)=>{if(!U)return this.notSentCallError("request bytes were not queued to the subc socket",N);if(N instanceof N0&&N.code===XZ)return new z6("outcome_unknown",`managed call deadline exceeded after request bytes were queued to the local socket; no terminal response was observed; outcome unknown${r4(N)}`,XJ,N);return this.outcomeUnknownCallError("connection dropped before the managed call returned a response",N)};return new Promise((N,K)=>{let q=G??s1,F={handle:X,resolve:N,reject:K,onProgress:Q,timer:null,classifyFailure:j};if(F.timer=setTimeout(()=>this.arbitrateTimeout(B,F,X.channel,W,q),q),this.pending.set(B,F),Z)this.attachCancelSignal(Z,B,X,W,$);let O=s5(this.sock,W8(H),Date.now()+q);U=O.queued,O.completed.catch((_)=>{let C=this.pending.get(B);if(C)this.rejectPending(B,C,_ instanceof Error?_:new N0(String(_)))})})}async cachedRouteHandle(X,J){let $=J.identity??this.opts.identity;if(!$)throw new z6("terminal","managed call requires a BindIdentity in SubcClient.connect({ identity }) or call(..., { identity })","missing_identity");let Y={kind:J.targetKind??this.opts.targetKind,module_id:X},G=$J(J),Q=J.reverseRequests??new M9;Q.seal();let z=YZ(Y,$,G,Q.capabilities()),Z=this.routes.get(z);if(!Z)Z={key:z,moduleId:X,target:Y,identity:$,consumerIdentity:G,reverseRequests:Q,handle:null,opening:null},this.routes.set(z,Z);if(Z.handle&&this.isLiveHandle(Z.handle))return Z.handle;if(!Z.opening)Z.opening=this.openCachedRoute(Z).finally(()=>{Z.opening=null});return Z.opening}async openCachedRoute(X){let J=Date.now()+this.opts.routeOpenRetryDeadlineMs,$=this.opts.reconnectBackoff.baseMs,Y=0;for(;;){if(X.closed)throw this.routeClosedDuringOpen();try{await this.ensureConnectedForManaged()}catch(G){throw this.notSentRecoveryError("route.open could not run because reconnect failed",G)}if(X.handle&&this.isLiveHandle(X.handle))return X.handle;try{let G=await this.routeOpen(X.target,X.identity,{consumerIdentity:X.consumerIdentity??null,reverseRequests:X.reverseRequests});if(X.closed)throw this.liveRoutes.delete(G.channel),this.sendRouteGoodbye(G),this.routeClosedDuringOpen();return X.handle=G,G}catch(G){if(G instanceof z6&&G.code==="route_closed")throw G;if(!this.closeStarted&&l2(G)){try{await this.reconnectAfterDrop(G)}catch(Q){throw this.notSentRecoveryError("route.open was not sent and reconnect failed",Q)}continue}if(!this.closeStarted&&G instanceof N0&&OF(G.code)){if(Y+=1,Date.now()<J){await this.opts.sleep($),$=Math.min($*2,this.opts.reconnectBackoff.capMs);continue}throw this.notSentCallError(`route.open failed for module ${X.moduleId}: ${G.code} (retry deadline exhausted after ${Y} attempts)`,G)}throw this.terminalCallError(`route.open failed for module ${X.moduleId}`,G)}}}lastInboundAtMs=0;livenessProbe=null;hasControlPending(){for(let X of this.pending.values())if(X.handle===null)return!0;return!1}probeLivenessAfterDeadline(){if(this.livenessProbe||this.closeStarted||this.closedErr)return;if(this.hasControlPending())return;let X=this.sock,J=this.generation,$;try{$=this.allocateCorr()}catch{return}let Y=Date.now(),G=j6(u.Ping,T6(!1,t0.Interactive,!1,K6.Normal),0,0,$,new Uint8Array),Q=(async()=>{if(await H8(X,W8(G),Y+this.opts.livenessProbeWindowMs).catch(()=>{}),await this.opts.sleep(this.opts.livenessProbeWindowMs),this.sock!==X||this.generation!==J||this.closeStarted)return;if(this.lastInboundAtMs>=Y)return;if(this.hasControlPending())return;this.fail(new Y9(`liveness probe convicted a half-open socket: no inbound frame for ${this.opts.livenessProbeWindowMs}ms after a channel-0 Ping (deadline-no-drop settles preceded this); closing so the next call reconnects`)),X.close()})().finally(()=>{this.livenessProbe=null});this.livenessProbe=Q}async ensureConnectedForManaged(){if(this.closeStarted)throw new N0("client closed");if(this.reconnecting)await this.reconnecting;if(this.closedErr)await this.reconnectAfterDrop(this.closedErr)}scheduleReconnectAfterDrop(X){if(this.closeStarted||this.reconnecting)return;this.reconnectAfterDrop(X).catch(()=>{})}reconnectAfterDrop(X){if(this.closeStarted)return Promise.reject(new N0("client closed"));if(this.reconnecting)return this.reconnecting;let J=this.reconnectWithRetry(X).finally(()=>{if(this.reconnecting===J)this.reconnecting=null});return this.reconnecting=J,J}async reconnectWithRetry(X){let J=0,$=this.opts.reconnectBackoff.baseMs;for(;;){if(this.closeStarted)throw new N0("client closed");J+=1;try{let Y=await t9.openConnection(this.opts);if(this.closeStarted)throw Y.sock.close(),new N0("client closed");this.replaceConnection(Y),await this.reopenCachedRoutes();return}catch(Y){if(!l2(Y)||J>=this.opts.reconnectBackoff.maxAttempts){if(Y instanceof R6&&J>1)throw new R6(`reconnect gave up after ${J} attempts: ${Y.message} — the connection file and the daemon's key disagree persistently `+"(daemon restarting in a loop, split connection-file paths, or a genuinely foreign daemon on this port); check the daemon, then restart this host app");throw Y}await this.opts.sleep($),$=Math.min($*2,this.opts.reconnectBackoff.capMs)}}}replaceConnection(X){this.fail(new N0("subc connection replaced")),this.sock.close(),this.sock=X.sock,this.currentConn=X.conn,this.closedErr=null,this.generation+=1,this.connectionToken=n1(),this.liveRoutes.clear(),this.lateResponses.clear(),this.nextCorr=1n,this.readLoop(X.sock,this.generation)}async reopenCachedRoutes(){let X=[...this.routes.keys()];for(let J of X){let $=this.routes.get(J);if($)$.handle=null}for(let J of X){let $=this.routes.get(J);if(!$||$.closed)continue;try{let Y=await this.routeOpen($.target,$.identity,{consumerIdentity:$.consumerIdentity??null,reverseRequests:$.reverseRequests});if($.closed){this.liveRoutes.delete(Y.channel),this.sendRouteGoodbye(Y);continue}$.handle=Y}catch(Y){if(PF(Y)){this.routes.delete(J);continue}throw Y}}}timeoutMessage(X,J,$){let Y=this.sock.localPort();return`request on ${Y===null?"channel":`local_port=${Y} channel`} ${X} corr ${J} timed out after ${$}ms`}routeClosedDuringOpen(){return new z6("not_sent","route was closed before route.open completed","route_closed")}async readLoop(X,J){try{for(;;){this.readerActive=!1;let $=await X.readFrame(Number.POSITIVE_INFINITY,{afterHeaderMs:DF},()=>{this.readerActive=!0});try{if(this.sock===X&&this.generation===J)this.dispatch($)}finally{this.readerActive=!1}}}catch($){if(this.sock===X&&this.generation===J)this.fail($ instanceof Error?$:new N0(String($)))}}dispatch(X){if(this.lastInboundAtMs=Date.now(),X.header.channel===0&&X.header.ty===u.Push){let Q=this.opts.onControlPush;if(Q){let z=null;try{let Z=this.parseJson(X);if(Z&&typeof Z.op==="string")z={op:Z.op,body:Z}}catch{}if(z)try{Q(z)}catch{}}return}let J=null;if(X.header.channel!==0){if(J=this.liveRoutes.get(X.header.channel)??null,!J||J.epoch!==X.header.epoch){this.ingressEpochDropCount+=1;return}}if(X.header.ty===u.Request&&J){this.dispatchReverseRequest(X,J);return}let $=c2(J,X.header.corr),Y=this.pending.get($);if(Y){if(Y.acceptFrame&&!Y.acceptFrame(X))return;switch(X.header.ty){case u.Push:case u.StreamData:try{Y.onProgress?.(X.body)}catch{}return;case u.Response:case u.StreamEnd:this.settle($,Y,()=>Y.resolve(X));return;case u.Error:this.settle($,Y,()=>Y.reject(this.errorFromFrame(X)));return;default:return}}let G=this.lateResponses.get($);if(G&&(X.header.ty===u.Response||X.header.ty===u.Error)){this.lateResponses.delete($),G(X);return}if(X.header.ty===u.Goodbye&&J){if(this.failHandle(J,new N0("route closed by subc (GOODBYE)","route_closed")),this.liveRoutes.get(J.channel)===J)this.liveRoutes.delete(J.channel);this.evictRouteHandle(J);return}if(X.header.ty===u.Response||X.header.ty===u.Error||X.header.ty===u.StreamEnd)ez("dropped terminal frame with no waiter: type=%d channel=%d epoch=%d corr=%s port=%s",X.header.ty,X.header.channel,X.header.epoch,X.header.corr,this.sock.localPort()??"?")}settle(X,J,$){if(this.pending.get(X)!==J)return!1;if(this.pending.delete(X),J.timer)clearTimeout(J.timer);return $(),J.onSettle?.(),!0}rejectPending(X,J,$){this.settle(X,J,()=>J.reject(J.classifyFailure?.($)??$))}dispatchReverseRequest(X,J){let $=_F(X.body),Y=$?.split("/",1)[0],G=Y?tz(J,Y):void 0,Q=this.sock,z=this.generation;(async()=>{if(!G||!$){await this.sendReverseError(X,J,"reverse_request_unhandled",Y?`no reverse-request handler is registered for ${Y}`:"reverse request has no valid method",Q,z);return}let W;try{if(W=await G(X.body,{corr:X.header.corr,method:$}),!(W instanceof Uint8Array))throw TypeError("reverse-request handler must return a Uint8Array")}catch(B){await this.sendReverseError(X,J,"reverse_request_unhandled",B instanceof Error?B.message:String(B),Q,z);return}await this.sendReverseReply(X,J,u.Response,W,Q,z)})().catch((W)=>{if(this.sock===Q&&this.generation===z&&!this.closeStarted)ez("failed to answer reverse request: %s",r4(W))})}async sendReverseError(X,J,$,Y,G,Q){await this.sendReverseReply(X,J,u.Error,this.encode({code:$,message:Y}),G,Q)}async sendReverseReply(X,J,$,Y,G,Q){if(this.sock!==G||this.generation!==Q||!this.isLiveHandle(J)||this.closeStarted||this.closedErr)return;let z=j6($,T6(!1,t0.Interactive,!1),J.channel,J.epoch,X.header.corr,Y);await H8(G,W8(z),Date.now()+s1)}errorFromFrame(X){try{let J=JSON.parse(Buffer.from(X.body).toString("utf8")),$=new N0(J.message??"subc error",J.code,J.detail);return $Z.set($,X.header.flags),$}catch{return new N0(Buffer.from(X.body).toString("utf8")||"subc error")}}evictRouteHandle(X){for(let J of this.routes.values())if(J.handle&&p2(J.handle,X))J.handle=null}failHandle(X,J){for(let[$,Y]of this.pending)if(Y.handle&&p2(Y.handle,X))this.rejectPending($,Y,J)}fail(X){if(!this.closedErr)this.closedErr=X;for(let[J,$]of this.pending)this.rejectPending(J,$,X)}notSentCallError(X,J){return new z6("not_sent",`${X}${r4(J)}`,d2(J),J)}outcomeUnknownCallError(X,J){return new z6("outcome_unknown",`${X}${r4(J)}`,d2(J),J)}terminalCallError(X,J){if(J instanceof z6)return J;return new z6("terminal",`${X}${r4(J)}`,d2(J),J)}notSentRecoveryError(X,J){if(J instanceof z6)return J;if(l2(J))return this.notSentCallError(X,J);return this.terminalCallError(X,J)}get droppedIngressFrames(){return this.ingressEpochDropCount}installRoute(X,J,$=new M9){let Y=u2(X,J,this.connectionToken,$);return this.liveRoutes.set(X,Y),Y}isLiveHandle(X){return o4(X,this.connectionToken)&&this.liveRoutes.get(X.channel)===X}assertLiveConnection(X){if(!o4(X,this.connectionToken))throw new G9(X)}assertLiveHandle(X){if(!this.isLiveHandle(X))throw new G9(X)}allocateCorr(){let X=0xffffffffffffffffn;if(this.nextCorr>X){let $=new N0("channel-0 correlation id allocator exhausted","corr_exhausted");throw this.fail($),this.sock.close(),this.scheduleReconnectAfterDrop($),$}let J=this.nextCorr;return this.nextCorr+=1n,J}closeConnectionAfterCleanupFailure(){let X=new N0("late route cleanup could not be queued","late_route_cleanup_failed");this.fail(X),this.sock.close(),this.scheduleReconnectAfterDrop(X)}encode(X){return Buffer.from(JSON.stringify(X),"utf8")}decodeReply(X){return i5(X.header.flags)?X.body:this.parseJson(X)}parseJson(X){let J=X.body;return JSON.parse(Buffer.from(J.buffer,J.byteOffset,J.byteLength).toString("utf8"))}}function l2(X){if(X instanceof Y9||X instanceof B8)return!0;if(X instanceof E8||X instanceof O9)return!0;if(X instanceof z6)return X.kind==="not_sent"||X.kind==="outcome_unknown";if(X instanceof R6)return!0;if(X instanceof N0||X instanceof Q6)return!1;let J=d2(X);return J==="ECONNREFUSED"||J==="ECONNRESET"||J==="EPIPE"||J==="ETIMEDOUT"||J==="ENOENT"}function PF(X){return X instanceof N0&&typeof X.code==="string"}function OF(X){if(X==="capability_forbidden")return!1;return X==="module_reloading"||X==="module_warming"||X==="target_unavailable"||X==="module_timeout"}var GZ="unknown_channel",QZ="stale_route_epoch";function a2(X,J){return J===GZ||J===QZ}function MF(X){return{connectionFile:X.connectionFile,handshakeTimeoutMs:X.handshakeTimeoutMs,identity:X.identity,targetKind:X.targetKind??FF,reconnectBackoff:X.reconnectBackoff??s2,sleep:X.sleep??((J)=>new Promise(($)=>setTimeout($,J))),routeOpenRetryDeadlineMs:X.routeOpenRetryDeadlineMs??LF,timeoutArbitrationGraceMs:X.timeoutArbitrationGraceMs??NF,livenessProbeWindowMs:X.livenessProbeWindowMs??qF,onControlPush:X.onControlPush}}function zZ(X){if(/\s/u.test(X))return!1;let J=X.indexOf("/v");if(J<=0||X.indexOf("/v",J+1)!==-1)return!1;let $=X.slice(0,J),Y=X.slice(J+2);if(new TextEncoder().encode($).byteLength>64||Y.length===0)return!1;if(!/^[a-z][a-z0-9-]*[a-z0-9]$/u.test($)&&!/^[a-z]$/u.test($))return!1;if($.includes("--"))return!1;if(!/^\d+$/u.test(Y)||Y.length>1&&Y.startsWith("0"))return!1;let G=Number(Y);return Number.isSafeInteger(G)&&G>=1&&G<=4294967295}function YZ(X,J,$,Y){let G=$?`${$.module_id}\x00${$.launch_nonce}`:"",Q=[...Y].sort().join("\x00");return`${X.kind}\x00${X.module_id}\x00${J.project_root}\x00${J.harness}\x00${J.session}\x00${G}\x00${Q}`}function $J(X={}){if(X.consumerIdentity!==void 0)return X.consumerIdentity??void 0;let J=process.env[i2],$=process.env[n2];if(!J||!$)return;return{module_id:J,launch_nonce:$}}function d2(X){if(typeof X==="object"&&X!==null&&"code"in X){let J=X.code;if(typeof J==="string")return J}return}function r4(X){if(X===void 0)return"";return`: ${X instanceof Error?X.message:String(X)}`}function c2(X,J){return X?`${X.channel}:${X.epoch}:${J}`:`0:0:${J}`}function _F(X){try{let J=JSON.parse(Buffer.from(X).toString("utf8"));return typeof J.method==="string"&&J.method.length>0?J.method:void 0}catch{return}}import{Buffer as WJ}from"node:buffer";var AF=1e4,TF=30000,WZ=30000,RF=250,YJ=64,zJ="health.check",BZ=1n,CF=/^[0-9a-f]{32}$/;function ZJ(X){let J=X.machine_id;return typeof J==="string"&&CF.test(J)?J:void 0}class r2{available;waiters=[];constructor(X){if(!Number.isInteger(X)||X<=0)throw new w0("provider handler capacity must be a positive integer","invalid_handler_capacity");this.available=X}async acquire(){if(this.available>0)return this.available-=1,this.releaseOnce();return await new Promise((X)=>{this.waiters.push(X)}),this.releaseOnce()}releaseOnce(){let X=!1;return()=>{if(X)return;X=!0;let J=this.waiters.shift();if(J)J();else this.available+=1}}}class w0 extends Error{code;kind;detail;constructor(X,J,$="terminal",Y){super(X);this.code=J,this.kind=$,this.detail=Y}}class t4{sock;currentConn;opts;closed;resolveClosed=()=>{return};closeStarted=!1;closedErr=null;inflight=new Map;pending=new Map;liveRoutes=new Map;connectionToken=n1();nextCorr=1n;ingressEpochDropCount=0;requestGate=new r2(YJ);reconnecting=null;generation=1;connectionEpoch=1;stateQueue=[];drainingStateQueue=!1;restoredDebounceToken=0;storage;machineId;constructor(X,J,$,Y){this.sock=X,this.currentConn=J,this.opts=$,this.storage=Y.storage,this.machineId=ZJ(Y),this.closed=new Promise((G)=>{this.resolveClosed=G}),this.readLoop(X,this.generation),this.enqueueConnectionState({state:"connected",epoch:this.connectionEpoch})}get droppedIngressFrames(){return this.ingressEpochDropCount}get conn(){return this.currentConn}currentEpoch(){return this.connectionEpoch}async request(X,J,$={}){this.assertLiveHandle(X);let Y=this.allocateCorr(),G=o2(X,Y),Q=$.timeoutMs??WZ,z=j6(u.Request,T6(!1,$.priority??t0.Interactive,!1,$.admissionClass??K6.Normal),X.channel,X.epoch,Y,J);return await new Promise((Z,W)=>{let B=setTimeout(()=>{if(this.pending.delete(G))W(new w0("reverse request timed out","request_timeout"))},Q);this.pending.set(G,{resolve:(H)=>Z(H.body),reject:W,timer:B}),this.sendOn(this.sock,this.generation,z).catch((H)=>{let U=this.pending.get(G);if(!U)return;this.pending.delete(G),clearTimeout(U.timer),W(H instanceof Error?H:new w0(String(H)))})})}async push(X,J,$={}){this.assertLiveHandle(X),await this.sendOn(this.sock,this.generation,j6(u.Push,T6(!1,$.priority??t0.Interactive,!1,$.admissionClass??K6.Normal),X.channel,X.epoch,0n,J))}cancel(X,J){this.assertLiveHandle(X),this.sendOn(this.sock,this.generation,j6(u.Cancel,S8(),X.channel,X.epoch,J,new Uint8Array(0))).catch(()=>{return})}closeRoute(X){this.assertLiveHandle(X),this.liveRoutes.delete(X.channel),this.abortHandle(X),this.sendOn(this.sock,this.generation,j6(u.Goodbye,S8(),X.channel,X.epoch,0n,new Uint8Array(0))).catch(()=>{return})}static async connect(X){if(X.manifest.protocol_ver!==m6)throw new w0(`manifest protocol_ver ${X.manifest.protocol_ver} does not match client protocol ${m6}`,"invalid_manifest");let J=SF(X),$=await t4.openConnection(J);return new t4($.sock,$.conn,J,$.ack)}async close(){if(!this.closeStarted){this.closeStarted=!0,this.cancelRestoredDebounce();let X=this.sock;try{await QJ(X,j6(u.Goodbye,S8(),0,0,0n,new Uint8Array(0)))}catch{}finally{X.close(),this.finishClosed()}}await this.closed}static async openConnection(X,J){let $=await i1(X.connectionFile),Y=Date.now()+(X.handshakeTimeoutMs??AF),G=$.endpoints[0],Q=await r9.connect(G.host,G.port,Y);try{J?.(Q),await a4(Q,$,Y),await QJ(Q,bF(X));let z=await vF(Q,Y);return{sock:Q,conn:$,ack:z}}catch(z){throw Q.close(),z}}async readLoop(X,J){try{for(;;){let $=await X.readFrame(Number.POSITIVE_INFINITY,{afterHeaderMs:TF});if(!await this.dispatch($,X,J)){if(this.sock===X&&this.generation===J)this.closeStarted=!0;break}}}catch($){if(this.sock===X&&this.generation===J&&!this.closeStarted){this.handleUnexpectedDrop(X,J,$ instanceof Error?$:new w0(String($)));return}}finally{if(this.sock===X&&this.generation===J){if(X.close(),this.closeStarted)this.finishClosed()}}}async dispatch(X,J,$){let Y=null;if(X.header.channel!==0){if(Y=this.liveRoutes.get(X.header.channel)??null,!Y||Y.epoch!==X.header.epoch)return this.ingressEpochDropCount+=1,!0}if(Y){let G=o2(Y,X.header.corr),Q=this.pending.get(G);if(Q){if(X.header.ty===u.Push||X.header.ty===u.StreamData)return!0;if(X.header.ty===u.Response||X.header.ty===u.StreamEnd)return this.pending.delete(G),clearTimeout(Q.timer),Q.resolve(X),!0;if(X.header.ty===u.Error)return this.pending.delete(G),clearTimeout(Q.timer),Q.reject(EF(X)),!0}}switch(X.header.ty){case u.Ping:if(X.header.channel===0)await this.sendOn(J,$,C8(X.header.ver,u.Pong,X.header.flags,0,0,X.header.corr,new Uint8Array(0)));return!0;case u.Goodbye:if(!Y)return!1;return this.liveRoutes.delete(Y.channel),this.abortHandle(Y),await this.reportRouteGone(Y),!0;case u.Cancel:if(Y)this.inflight.get(o2(Y,X.header.corr))?.abort();return!0;case u.Request:if(X.header.channel===0)await this.handleControlRequest(X,J,$);else if(Y)this.handleDataRequest(X,Y,J,$).catch((G)=>{if(!this.closeStarted&&this.sock===J&&this.generation===$)console.warn("SubcProvider handler failed after its request was dispatched",G)});return!0;default:return!0}}async reportRouteBound(X){if(!this.opts.onBound)return;try{await this.opts.onBound(X)}catch(J){console.warn("SubcProvider bound callback failed",J)}}async reportRouteGone(X){if(!this.opts.onRouteGone)return;try{await this.opts.onRouteGone(X)}catch(J){console.warn("SubcProvider route-gone callback failed",J)}}abortHandle(X){let J=`${X.channel}:${X.epoch}:`;for(let[$,Y]of this.inflight)if($.startsWith(J))Y.abort();for(let[$,Y]of this.pending){if(!$.startsWith(J))continue;this.pending.delete($),clearTimeout(Y.timer),Y.reject(new G9(X))}}abortGeneration(X){this.abortAllInflight();for(let[J,$]of this.pending)this.pending.delete(J),clearTimeout($.timer),$.reject(new w0("provider connection dropped","connection_dropped"));this.liveRoutes.clear()}abortAllInflight(){for(let X of this.inflight.values())X.abort()}async handleControlRequest(X,J,$){let Y=e2(X.body);if(Y.op===zJ){this.handleHealthRequest(X,J,$).catch((U)=>{if(!this.closeStarted&&this.sock===J&&this.generation===$)console.warn("SubcProvider health handler failed after its request was dispatched",U)});return}if(Y.op!=="route.bind")throw new w0(`unsupported module control request ${Y.op??"<missing op>"}`);let G=ZZ(Y.route_channel,"route_channel"),Q=ZZ(Y.epoch,"epoch"),z=this.liveRoutes.get(G);if(z){if(Q<=z.epoch){await this.sendError(X,"route_rejected",`route.bind epoch ${Q} does not supersede installed epoch ${z.epoch} on channel ${G}`,S8(),J,$);return}this.liveRoutes.delete(z.channel),this.abortHandle(z),await this.reportRouteGone(z)}let Z=u2(G,Q,this.connectionToken),W={handle:Z,target:Y.target,identity:Y.identity,principal:Y.principal,consumer_capabilities:Y.consumer_capabilities},B;try{B=await this.opts.onBind?.(W)}catch(U){try{await this.sendError(X,"route_rejected",U instanceof Error?U.message:String(U),S8(),J,$)}finally{await this.reportRouteGone(Z)}return}let H=yF(B);if(H){try{await this.sendError(X,H.code,H.message,S8(),J,$)}finally{await this.reportRouteGone(Z)}return}try{await this.sendOn(J,$,C8(X.header.ver,u.Response,S8(),0,0,X.header.corr,t2({op:"route.bind"})))}catch(U){throw await this.reportRouteGone(Z),U}if(this.sock!==J||this.generation!==$||this.closeStarted||this.closedErr){await this.reportRouteGone(Z);return}this.liveRoutes.set(Z.channel,Z),await this.reportRouteBound(Z)}async handleDataRequest(X,J,$,Y){let{corr:G,ver:Q}=X.header,z=o2(J,G),Z=new AbortController;this.inflight.set(z,Z);let W={handle:J,signal:Z.signal,currentEpoch:()=>this.connectionEpoch,emit:async(U,j={})=>{if(this.assertLiveHandle(J),Z.signal.aborted)return;await this.sendOn($,Y,C8(Q,u.StreamData,T6(!1,j.priority??t0.Interactive,!1,j.admissionClass??K6.Normal),J.channel,J.epoch,G,U))}},B=await(this.requestGate??new r2(YJ)).acquire(),H=T6(!1,t0.Interactive,!1);try{if(Z.signal.aborted){await this.sendError(X,"cancelled","request cancelled",H,$,Y);return}let U=await this.opts.handler(J,X.body,W);if(Z.signal.aborted){await this.sendError(X,"cancelled","request cancelled",H,$,Y);return}if(this.assertLiveHandle(J),U===void 0)await this.sendOn($,Y,C8(Q,u.StreamEnd,H,J.channel,J.epoch,G,new Uint8Array(0)));else if(U instanceof Uint8Array)await this.sendOn($,Y,C8(Q,u.Response,H,J.channel,J.epoch,G,U));else throw new w0("provider handler must return a Uint8Array or void","invalid_handler_response")}catch(U){if(U instanceof G9)return;if(Z.signal.aborted){await this.sendError(X,"cancelled","request cancelled",H,$,Y);return}await this.sendError(X,U instanceof w0&&U.code?U.code:"handler_error",U instanceof Error?U.message:String(U),H,$,Y)}finally{if(B(),this.inflight.get(z)===Z)this.inflight.delete(z)}}async handleHealthRequest(X,J,$){let{corr:Y,ver:G}=X.header,Q=`control:${$}:${Y}`,z=new AbortController;this.inflight.set(Q,z);let Z=await(this.requestGate??new r2(YJ)).acquire();try{if(z.signal.aborted)return;let W=await this.opts.health();await this.sendOn(J,$,C8(G,u.Response,S8(),0,0,Y,t2({op:zJ,status:W.status,...W.detail===void 0?{}:{detail:W.detail},...W.metrics===void 0?{}:{metrics:W.metrics}})))}catch(W){await this.sendError(X,W instanceof w0&&W.code?W.code:"health_error",W instanceof Error?W.message:String(W),S8(),J,$)}finally{if(Z(),this.inflight.get(Q)===z)this.inflight.delete(Q)}}async sendError(X,J,$,Y,G,Q){if(X.header.channel!==0){let z=this.liveRoutes.get(X.header.channel);if(!z||z.epoch!==X.header.epoch||!this.isLiveHandle(z))return}await this.sendOn(G,Q,C8(X.header.ver,u.Error,Y,X.header.channel,X.header.epoch,X.header.corr,t2({code:J,message:$})))}async sendOn(X,J,$){if(this.sock!==X||this.generation!==J||this.closeStarted||this.closedErr)return;await QJ(X,$)}handleUnexpectedDrop(X,J,$){if(this.closeStarted||this.sock!==X||this.generation!==J)return;if(!this.opts.reconnectOnDrop){this.failFatal($);return}this.cancelRestoredDebounce(),this.abortGeneration(J),this.generation+=1,X.close(),this.scheduleReconnectAfterDrop($,this.generation,X)}scheduleReconnectAfterDrop(X,J,$){if(this.closeStarted)return;let Y=this.reconnecting;if(Y){if(!this.shouldSupersedeReconnect(Y,J,$))return;Y.superseded=!0,Y.socket?.close()}let G={generation:J,socket:null,socketDied:!1,superseded:!1};this.reconnecting=G,this.enqueueConnectionState({state:"down",cause:X}),this.reconnectWithRetry(G).catch((Q)=>{if(this.isCurrentReconnect(G)&&!this.closeStarted)this.failFatal(Q instanceof Error?Q:new w0(String(Q)))}).finally(()=>{if(this.isCurrentReconnect(G))this.reconnecting=null})}async reconnectWithRetry(X){let J=0,$=this.opts.reconnectBackoff.baseMs;for(;;){if(!this.isCurrentReconnect(X))return;if(this.closeStarted)throw new w0("provider closed");X.socket=null,X.socketDied=!1,J+=1,this.enqueueReconnectState(X,J);try{let Y=await t4.openConnection(this.opts,(Q)=>{if(!this.isCurrentReconnect(X)){Q.close();return}X.socket=Q});if(!this.isCurrentReconnect(X)||this.closeStarted){if(Y.sock.close(),this.closeStarted)throw new w0("provider closed");return}let G=this.replaceConnection(Y,X.generation);if(this.reconnecting=null,this.reconnecting!==null)throw new w0("reconnect state must clear before restored","reconnect_state");this.scheduleRestored(X.generation,G);return}catch(Y){if(!this.isCurrentReconnect(X))return;if(X.socket)X.socketDied=!0;if(this.closeStarted)throw Y;if(!kF(Y))throw Y;await this.opts.sleep($),$=Math.min($*2,this.opts.reconnectBackoff.capMs)}}}isCurrentReconnect(X){return!X.superseded&&this.reconnecting===X&&this.generation===X.generation}shouldSupersedeReconnect(X,J,$){return X.generation<J||X.socketDied||X.socket===$}enqueueReconnectState(X,J){if(!this.isCurrentReconnect(X))return;this.enqueueConnectionState({state:"reconnecting",attempt:J},X.generation,X)}replaceConnection(X,J){return this.sock.close(),this.sock=X.sock,this.currentConn=X.conn,this.storage=X.ack.storage,this.machineId=ZJ(X.ack),this.closedErr=null,this.connectionEpoch+=1,this.connectionToken=n1(),this.liveRoutes.clear(),this.nextCorr=1n,this.readLoop(X.sock,J),this.connectionEpoch}scheduleRestored(X,J){if(!this.opts.onConnectionState)return;let $=++this.restoredDebounceToken;this.opts.sleep(this.opts.restoredDebounceMs).then(()=>{if($===this.restoredDebounceToken&&!this.closeStarted&&this.sock&&this.generation===X&&this.connectionEpoch===J)this.enqueueConnectionState({state:"restored",epoch:J},X)}).catch((Y)=>{if($===this.restoredDebounceToken&&!this.closeStarted)console.warn("SubcProvider restored debounce timer failed",Y)})}cancelRestoredDebounce(){this.restoredDebounceToken+=1}enqueueConnectionState(X,J,$){if(!this.opts.onConnectionState)return;if(this.stateQueue.push({event:X,generation:J,reconnect:$}),!this.drainingStateQueue)this.drainConnectionStateQueue()}async drainConnectionStateQueue(){if(this.drainingStateQueue)return;this.drainingStateQueue=!0;try{while(this.stateQueue.length>0){let X=this.stateQueue[0];if(this.closeStarted||X.generation!==void 0&&X.generation!==this.generation||X.reconnect?.superseded){this.stateQueue.shift();continue}let{event:J}=X;try{await this.opts.onConnectionState?.(J),this.stateQueue.shift()}catch($){if(J.state==="restored"){console.warn("SubcProvider restored callback failed; retrying delivery",$),await wF();continue}console.warn("SubcProvider connection-state callback failed",$),this.stateQueue.shift()}}}finally{if(this.drainingStateQueue=!1,this.stateQueue.length>0)this.drainConnectionStateQueue()}}isLiveHandle(X){return o4(X,this.connectionToken)&&this.liveRoutes.get(X.channel)===X}assertLiveHandle(X){if(!this.isLiveHandle(X))throw new G9(X)}allocateCorr(){let X=0xffffffffffffffffn;if(this.nextCorr>X){let $=new w0("channel-0 correlation id allocator exhausted","corr_exhausted");throw this.handleUnexpectedDrop(this.sock,this.generation,$),$}let J=this.nextCorr;return this.nextCorr+=1n,J}failFatal(X){if(!this.closedErr)this.closedErr=X;this.closeStarted=!0,this.cancelRestoredDebounce(),this.abortAllInflight(),this.sock.close(),this.finishClosed()}finishClosed(){this.resolveClosed()}}function o2(X,J){return`${X.channel}:${X.epoch}:${J}`}function EF(X){try{let J=e2(X.body);return new w0(J.message??"subc error",J.code,a2(X.header.flags,J.code)?"not_sent":"terminal",J.detail)}catch{return new w0(WJ.from(X.body).toString("utf8")||"subc error")}}function GJ(X){return X&&X.length>0?X:void 0}function SF(X){let J=GJ(process.env[i2]),$=GJ(process.env[n2]),Y=J!==void 0&&$!==void 0;return{connectionFile:X.connectionFile,manifest:X.manifest,handler:X.handler,health:X.health??(()=>({status:"ok"})),handshakeTimeoutMs:X.handshakeTimeoutMs,controlOps:X.controlOps,onBind:X.onBind,onBound:X.onBound,onRouteGone:X.onRouteGone,reconnectBackoff:X.reconnectBackoff??s2,sleep:X.sleep??((G)=>new Promise((Q)=>setTimeout(Q,G))),restoredDebounceMs:X.restoredDebounceMs??RF,onConnectionState:X.onConnectionState,launchNonce:GJ(X.launchNonce??$),reconnectOnDrop:X.reconnectOnDrop??!Y}}function IF(X){if(X===null)return null;let J=new Set(X??[]);return J.add(zJ),[...J]}function bF(X){let J=X.launchNonce;return j6(u.Hello,S8(),0,0,BZ,t2({manifest:hF(X.manifest),protocol_ver:m6,control_ops:IF(X.controlOps),...J?{launch_nonce:J}:{}}))}function kF(X){if(X instanceof w0)return X.code==="duplicate_module_id";if(X instanceof Y9||X instanceof B8)return!0;if(X instanceof E8||X instanceof O9)return!0;if(X instanceof R6)return!0;if(X instanceof Q6)return!1;let J=xF(X);return J==="ECONNREFUSED"||J==="ECONNRESET"||J==="EPIPE"||J==="ETIMEDOUT"||J==="ENOENT"}function xF(X){if(typeof X==="object"&&X!==null&&"code"in X){let J=X.code;if(typeof J==="string")return J}return}async function wF(){await new Promise((X)=>setTimeout(X,0))}function S8(){return T6(!1,t0.Passive,!1)}async function QJ(X,J){await H8(X,W8(J),Date.now()+WZ)}async function vF(X,J){let $=await X.readFrame(J,J);switch($.header.ty){case u.HelloAck:{let Y=e2($.body);if(Y.negotiated_ver!==m6)throw new w0(`subc negotiated protocol ${Y.negotiated_ver}; expected exactly ${m6}`,"unsupported_version");return Y}case u.Error:{let Y=e2($.body);throw new w0(`subc rejected HELLO: ${Y.code??"unknown"} — ${Y.message??"subc error"}`,Y.code)}default:throw new w0(`unexpected frame ${u[$.header.ty]} awaiting HELLO_ACK`)}}function t2(X){return new Uint8Array(WJ.from(JSON.stringify(X),"utf8"))}function e2(X){return JSON.parse(WJ.from(X).toString("utf8"))}function ZZ(X,J){if(typeof X!=="number"||!Number.isInteger(X))throw new w0(`route.bind ${J} must be an integer`);return X}function yF(X){if(X===void 0||X===!0)return null;if(X===!1)return{code:"route_rejected",message:"route.bind rejected by provider"};if(X.accept)return null;return{code:X.code??"route_rejected",message:X.message??"route.bind rejected by provider"}}function hF(X){return{module_id:X.module_id,module_version:X.module_version,protocol_ver:X.protocol_ver,trust_tier:X.trust_tier,provides:X.provides.map(fF),consumes:X.consumes.map(gF),bindings:{storage:{kind:X.bindings.storage.kind,scope:X.bindings.storage.scope,owns_schema:X.bindings.storage.owns_schema},vault_grants:X.bindings.vault_grants.map((J)=>({secret:J.secret,reason:J.reason})),identity:{requires:[...X.bindings.identity.requires],optional:[...X.bindings.identity.optional]}}}}function fF(X){switch(X.role){case"tool_provider":return{role:"tool_provider",tools:X.tools.map((J)=>({name:J.name,...J.description===void 0?{}:{description:J.description},execution_mode:J.execution_mode,schema:J.schema})),identity_scope:[...X.identity_scope],concurrency:X.concurrency,emits_push:X.emits_push,sub_supervises:X.sub_supervises};case"pipeline_stage":return{role:"pipeline_stage",stage:X.stage,applies_to:{provider:X.applies_to.provider,model:X.applies_to.model},interface:X.interface,declares_frozen_floor:X.declares_frozen_floor,needs_signals:[...X.needs_signals],conformance_class:X.conformance_class};case"management_surface":return{role:"management_surface",operations:X.operations.map((J)=>({name:J.name,kind:J.kind})),config_schema:X.config_schema,observability:X.observability.map((J)=>({name:J.name,kind:J.kind})),identity_scope:[...X.identity_scope],concurrency:X.concurrency};case"internal_service":return{role:"internal_service",service_id:X.service_id,transport:X.transport,agent_facing:X.agent_facing,operations:[...X.operations]}}}function gF(X){switch(X.role){case"tool_client":return{role:"tool_client",of:[...X.of]};case"llm_client":return{role:"llm_client",via:X.via,auth:X.auth};case"service_client":return{role:"service_client",of:[...X.of]}}}var J7="subc-connection.json",VZ="subc-",UZ=".connection.json";function KZ(){let X=process.env.HOME;return X?a1(X,".local","share","cortexkit","run",J7):void 0}function cF(){let X=process.env.XDG_RUNTIME_DIR;if(X)return a1(X,J7);let J=KZ();if(J)return J;return a1(pF().homedir,".local","share","cortexkit","run",J7)}function lF(){if(process.env.SUBC_CONNECTION_FILE)return process.env.SUBC_CONNECTION_FILE;let X=process.env.XDG_RUNTIME_DIR;if(X){let G=a1(X,J7);if(X7(G))return G}let J=KZ();if(J&&X7(J))return J;let $=a1(HZ(),`${VZ}${dF()}${UZ}`);if(X7($))return $;let Y=iF(HZ());return Y.length===1?Y[0]:void 0}function dF(X=process.getuid??null,J=process.env){if(X)return String(X());for(let $ of["USER","USERNAME","HOME","USERPROFILE"]){let Y=J[$];if(Y)return Array.from(Y,(G)=>/^[a-zA-Z0-9_-]$/.test(G)?G:"_").join("")}return"unknown"}function jZ(){return lF()??cF()}function e9(X){return X?.trim()||process.env.SUBC_CONNECTION_FILE||process.env.CLAUSTRUM_SUBC_CONNECTION?.trim()||jZ()}function X7(X){try{return uF(X).isFile()}catch{return!1}}function iF(X){let J;try{J=mF(X)}catch{return[]}let $=[];for(let Y of J){if(typeof Y!=="string")continue;if(!Y.startsWith(VZ)||!Y.endsWith(UZ))continue;let G=a1(X,Y);if(X7(G))$.push(G)}return $.sort(),$}import{createHash as nF}from"node:crypto";import{existsSync as sF,realpathSync as NZ}from"node:fs";import{dirname as aF,relative as oF,resolve as rF}from"node:path";function qZ(X){let J=X,$;try{$=NZ(J)}catch(Y){if(Y.code!=="ENOENT")throw Y;let G=J;while(!sF(G)){let Q=aF(G);if(Q===G)break;G=Q}$=rF(NZ(G),oF(G,J))}return nF("sha256").update($).digest("hex")}function BJ(X,J){return{project_root:X,harness:"opencode",session:`store-${qZ(J)}`}}import{AsyncLocalStorage as tF}from"node:async_hooks";import{readFile as LZ}from"node:fs/promises";var eF=new tF;function DZ(X,J){return X.split(`
-`).filter(($)=>$.trim()!==""&&!$.trimStart().startsWith("#")).map(($)=>{let Y=$.split(":");if(Y.length!==J||!Y[0]||/\s/.test(Y[0])||!/^\d+$/.test(Y[2])||!Number.isSafeInteger(Number(Y[2]))||Number(Y[2])>4294967295||J===7&&(!/^\d+$/.test(Y[3])||!Number.isSafeInteger(Number(Y[3]))||Number(Y[3])>4294967295))throw Error("malformed account record");if(J===4&&Y[3]!==""&&Y[3].split(",").some((G)=>G===""||/\s/.test(G)))throw Error("malformed group members");return Y})}async function $7(X,J=eF.getStore()??{euid:process.geteuid?.(),egid:process.getegid?.(),passwdPath:"/etc/passwd",groupPath:"/etc/group"}){if((X.mode&18)===0||(X.mode&512)!==0)return!0;if((X.mode&2)!==0||J.euid===void 0||J.egid===void 0||X.uid!==J.euid||X.gid!==J.egid)return!1;try{let $=DZ(new TextDecoder("utf-8",{fatal:!0}).decode(await LZ(J.passwdPath)),7),Y=DZ(new TextDecoder("utf-8",{fatal:!0}).decode(await LZ(J.groupPath)),4),G=$.filter((Z)=>Number(Z[2])===J.euid),Q=Y.filter((Z)=>Number(Z[2])===J.egid);if(G.length!==1||Q.length!==1)return!1;let z=G[0][0];return(Q[0][3]===""||Q[0][3].split(",").every((Z)=>Z===z))&&!$.some((Z)=>Number(Z[2])!==J.euid&&Number(Z[3])===J.egid)}catch{return!1}}import{randomBytes as XP}from"node:crypto";import{chmod as JP,mkdir as $P,open as YP,realpath as GP,rename as QP,stat as zP,unlink as ZP}from"node:fs/promises";import{basename as WP,dirname as FZ,join as BP}from"node:path";var HP=/^[0-9a-f]{64}$/;function VP(X){if(!HP.test(X.token))throw Error("enrollment token must be exactly 64 lowercase hex characters");if(!Number.isSafeInteger(X.token_generation)||X.token_generation<1)throw Error("enrollment token generation must be a positive safe integer")}async function UP(X){let J;try{J=await GP(X)}catch{return}for(;;){let $=await zP(J).catch(()=>{return});if($&&!await $7($))throw Error(`enrollment token ancestor ${J} is group- or world-writable without sticky bit`);let Y=FZ(J);if(Y===J)return;J=Y}}async function HJ(X,J){VP(J);let $=FZ(X);await $P($,{recursive:!0,mode:448}),await UP($);let Y=BP($,`.${WP(X)}.${process.pid}.${XP(12).toString("hex")}.tmp`),G=!1;try{let Q=await YP(Y,"wx",384);G=!0;try{await Q.writeFile(`${JSON.stringify(J)}
-`,"utf8"),await Q.sync(),await JP(Y,384)}finally{await Q.close()}await QP(Y,X),G=!1}finally{if(G)await ZP(Y).catch(()=>{return})}}var PZ=["transient","permanent","auth_required","context_overflow"];class V8 extends Error{code;action;["class"];constructor(X,J,$){super(`Claustrum credential request failed: ${X}`);this.code=X,this.action=$,this.name="ClaustrumCredentialError",this.class=J}}function o1(X){return typeof X==="object"&&X!==null&&!Array.isArray(X)}function OZ(X){switch(X){case"permanent":return"gone";case"auth_required":return"reauth";case"context_overflow":return"reduce_and_retry";case"transient":return"retry"}}function O0(X,J="invalid_response",$=(Y)=>console.warn(Y)){let Y=o1(X)&&o1(X.result)?X.result:void 0,G=Y&&o1(Y.error)?Y.error:void 0,Q=G?.class,z=G?.code,Z=typeof Q==="string"&&PZ.includes(Q),W=typeof z==="string",H=Z&&W?Q:"transient";if(typeof Q!=="string")$("unknown");else if(!Z)$(Q);return new V8(W?z:J,H,OZ(H))}function X1(X){return o1(X)&&o1(X.result)&&o1(X.result.error)}var MZ="claustrum",NP=60000;function u6(X){return typeof X==="object"&&X!==null&&!Array.isArray(X)}function UJ(X){return typeof X==="number"&&Number.isSafeInteger(X)&&X>=0?X:void 0}function I8(X){return X===void 0||typeof X==="string"}function _Z(X,J){if(X1(X))throw O0(X,"invalid_response",J);let $=u6(X)&&u6(X.result)?X.result:void 0,Y=$?.payload;if(!Array.isArray(Y)||Y.length===0||!Y.every((N)=>typeof N==="number"&&Number.isInteger(N)&&N>=0&&N<=255))throw O0(X,"invalid_response",J);let G=UJ($?.record_version);if(G===void 0)throw O0(X,"invalid_record_version",J);let Q=$?.expires_at_ms,z=Q===void 0||Q===null?null:typeof Q==="number"&&Number.isFinite(Q)?Q:void 0;if(z===void 0)throw O0(X,"invalid_expiry",J);let Z=$?.credential_id,W=$?.project_id,B=$?.account_id,H=$?.email,U=$?.org_name;if(!I8(Z)||!I8(W)||!I8(B)||!I8(H)||!I8(U))throw O0(X,"invalid_response",J);let j;try{j=new TextDecoder("utf-8",{fatal:!0}).decode(Uint8Array.from(Y))}catch{throw O0(X,"invalid_response",J)}return{material:j,recordVersion:G,expiresAtMs:z,credentialId:Z,projectId:W,accountId:B,email:H,orgName:U}}function qP(X,J){if(X1(X))throw O0(X,"invalid_response",J);let $=u6(X)&&u6(X.result)?X.result:void 0,Y=$?.record_version,G=Y===void 0?void 0:UJ(Y),Q=$?.credential_id;if(typeof $?.ready!=="boolean"||$?.last_error_code!==void 0&&$?.last_error_code!==null&&typeof $?.last_error_code!=="string"||typeof $?.lease_held!=="boolean"||Y!==void 0&&G===void 0||!I8(Q)||$?.stale_pending!==void 0&&typeof $.stale_pending!=="boolean")throw O0(X,"invalid_status",J);return{ready:$.ready,lastErrorCode:$.last_error_code??null,leaseHeld:$.lease_held,...Q===void 0?{}:{credentialId:Q},...G===void 0?{}:{recordVersion:G},...$.stale_pending===void 0?{}:{stalePending:$.stale_pending}}}class J1{#X;#J;#W;#Q;#z;#Y;#$=null;#B=0;#H=!1;constructor(X,J,$,Y,G,Q){this.#X=X,this.#J=J,this.#W=$,this.#Q=Y,this.#z=G,this.#Y=Q}static async connect(X={}){let J=e9(X.connectionFile),$=X.connector??((Q)=>t9.connect(Q)),Y=X.identity??BJ(X.projectRoot??process.cwd(),X.storagePath??process.cwd()),G=await $({connectionFile:J,handshakeTimeoutMs:X.handshakeTimeoutMs});return new J1(G,$,J,X.handshakeTimeoutMs,Y,X.logger??((Q)=>console.warn(Q)))}async getCredential(X,J){let $=await this.#G("credential.get",{handle:X,min_ttl_ms:J,force_refresh:!1});return _Z($,this.#Y)}async statusCredential(X){let J=await this.#G("credential.status",{handle:X});return qP(J,this.#Y)}async reportAuthFailure(X){let J=await this.#G("credential.report_auth_failure",{handle:X.handle,provider_status:X.providerStatus,record_version:X.recordVersion,reporter_source:X.reporterSource});if(X1(J))throw O0(J,"invalid_response",this.#Y);if((u6(J)&&u6(J.result)?J.result:void 0)?.accepted!==!0)throw O0(J,"invalid_response",this.#Y)}async listScoped(X){let J=await this.#G("credential.list_scoped",X===void 0?{}:{enrollment_token:X});return LP(J,this.#Y)}async getScoped(X){let J=await this.#G("credential.get_scoped",{credential_id:X.credentialId,enrollment_token:X.enrollmentToken,min_ttl_ms:X.minTtlMs});return _Z(J,this.#Y)}async reportAuthFailureScoped(X){let J=await this.#G("credential.report_auth_failure",{credential_id:X.credentialId,enrollment_token:X.enrollmentToken,provider_status:X.providerStatus,record_version:X.recordVersion,reporter_source:X.reporterSource});if(X1(J))throw O0(J,"invalid_response",this.#Y);if((u6(J)&&u6(J.result)?J.result:void 0)?.accepted!==!0)throw O0(J,"invalid_response",this.#Y)}async enrollPropose(X){let J=await this.#G("auth.enroll_propose",{proposed_name:X.name,request_secret_hash:X.requestSecretHash}),Y=VJ(J,this.#Y).request_id;if(typeof Y!=="string"||Y.length===0)throw O0(J,"invalid_response",this.#Y);return{requestId:Y}}async enrollPoll(X){let J=await this.#G("auth.enroll_poll",{request_id:X.requestId,request_secret:X.requestSecret});return DP(J,this.#Y)}async enrollRotate(X){let J=await this.#G("auth.enroll_rotate",{token:X.token,expected_token_generation:X.expectedTokenGeneration}),$=VJ(J,this.#Y),Y=$.token,G=$.token_generation;if(typeof Y!=="string"||Y.length===0||typeof G!=="number"||!Number.isInteger(G)||G<0)throw O0(J,"invalid_response",this.#Y);return{token:Y,tokenGeneration:G}}close(){this.#H=!0,this.#X.close()}async#G(X,J){let $=this.#X;try{return await $.call(MZ,X,J,{identity:this.#z,consumerIdentity:null})}catch(Y){if(this.#V(Y)){try{if(this.#X===$)await this.#U()}catch(G){throw this.#Z(G)}try{return await this.#X.call(MZ,X,J,{identity:this.#z,consumerIdentity:null})}catch(G){throw this.#Z(G)}}throw this.#Z(Y)}}#Z(X){if(X instanceof V8)return X;let J=X instanceof z6&&X.code?X.code:"transport_error";return new V8(J,"transient","retry")}#V(X){return!this.#H&&X instanceof z6&&X.kind==="terminal"&&X.code!=="missing_identity"&&X.code!=="invalid_control_body"&&X.code!=="unknown_module"}async#U(){if(this.#H)throw Error("Claustrum client is closed");if(this.#$){await this.#$;return}let X=Date.now();if(X<this.#B)throw Error("Claustrum client reconnect is backed off");this.#B=X+NP,this.#$=this.#J({connectionFile:this.#W,handshakeTimeoutMs:this.#Q}).then((J)=>{if(this.#H)throw J.close(),Error("Claustrum client is closed");let $=this.#X;this.#X=J,$.close()}).finally(()=>{this.#$=null}),await this.#$}}function LP(X,J){if(X1(X))throw O0(X,"invalid_response",J);let $=u6(X)&&u6(X.result)?X.result:void 0,Y=$?.credentials;if(!Array.isArray(Y))throw O0(X,"invalid_response",J);let G=$?.view;if(typeof G!=="string"||G.length===0)throw O0(X,"invalid_response",J);return{rows:Y.map((z)=>{if(!u6(z))throw O0(X,"invalid_response",J);let Z=UJ(z.record_version);if(Z===void 0)throw O0(X,"invalid_record_version",J);let W=(U)=>{if(!Array.isArray(U)||!U.every((j)=>typeof j==="string"))throw O0(X,"invalid_response",J);return U};if(typeof z.id!=="string"||typeof z.type!=="string"||typeof z.state!=="string")throw O0(X,"invalid_response",J);let B=z.created_at_ms===void 0||z.created_at_ms===null?null:typeof z.created_at_ms==="number"&&Number.isFinite(z.created_at_ms)?z.created_at_ms:void 0;if(B===void 0)throw O0(X,"invalid_response",J);let H=z.auth_method;if(H!==void 0&&H!=="apikey"&&H!=="chatgpt"&&H!=="antigravity"&&H!=="oauth")throw O0(X,"invalid_response",J);if(!I8(z.refresh_adapter))throw O0(X,"invalid_response",J);if(!I8(z.account_id)||!I8(z.email)||!I8(z.org_name))throw O0(X,"invalid_response",J);return{id:z.id,categories:W(z.categories),credentialType:z.type,serves:W(z.serves),providerIds:z.provider_ids===void 0?[]:W(z.provider_ids),authMethod:H,state:z.state,refreshAdapter:z.refresh_adapter,recordVersion:Z,operations:W(z.operations),createdAtMs:B,accountId:z.account_id,email:z.email,orgName:z.org_name}}),view:G}}function VJ(X,J){if(X1(X))throw O0(X,"invalid_response",J);let $=u6(X)&&u6(X.result)?X.result:void 0;if($===void 0)throw O0(X,"invalid_response",J);return $}function DP(X,J){let $=VJ(X,J),Y=$.status;if(Y==="pending")return{status:"pending"};if(Y==="denied")return{status:"denied"};if(Y!=="approved")throw O0(X,"invalid_response",J);let{name:G,token:Q,token_generation:z}=$;if(typeof G!=="string"||typeof Q!=="string"||Q.length===0||typeof z!=="number"||!Number.isInteger(z))throw O0(X,"invalid_response",J);return{status:"approved",name:G,token:Q,tokenGeneration:z}}function e4(X){let J=new AbortController,$=[],Y=!1,G=()=>{if(Y)return;Y=!0;for(let{source:Z,listener:W}of $)Z.removeEventListener("abort",W);$.length=0},Q=(Z)=>{if(Y||J.signal.aborted)return;J.abort(Z),G()},z=X.find((Z)=>Z.aborted);if(z)return J.abort(z.reason),{signal:J.signal,dispose:G};for(let Z of X){if(J.signal.aborted)break;let W=()=>Q(Z.reason);if($.push({source:Z,listener:W}),Z.addEventListener("abort",W,{once:!0}),Z.aborted)Q(Z.reason)}return{signal:J.signal,dispose:G}}import{createHash as FP,randomBytes as PP,randomUUID as OP}from"node:crypto";import{constants as AZ}from"node:fs";import{chmod as MP,mkdir as _P,open as SZ,readFile as TZ,realpath as AP,rename as TP,stat as IZ,unlink as bZ}from"node:fs/promises";import{basename as kZ,dirname as Y1,extname as RZ,isAbsolute as CZ,join as NJ,resolve as RP}from"node:path";class $0 extends Error{kind;constructor(X,J){super(J);this.name="ClaustrumConsumerError",this.kind=X}}var CP=1,KJ=16384,xZ=30000,qJ=/^[0-9a-f]{64}$/,wZ=new Set(["invalid_params","pending_exists","not_found","already_consumed","superseded","stale_generation"]),vZ=new Set(["pending_queue_full"]);function jJ(X){if(!(X instanceof V8))return;if(wZ.has(X.code))return{code:X.code,disposition:"terminal"};if(vZ.has(X.code))return{code:X.code,disposition:"retry"};return{code:X.code,disposition:X.action==="retry"?"retry":"terminal"}}function LJ(X,J){if(!/^[a-z0-9][a-z0-9-]*$/.test(X)||!/^[a-z0-9][a-z0-9-]*$/.test(J))throw new $0("invalid-state","Claustrum enrollment names use lowercase letters, digits and dashes");return`${X}-${J}`}function DJ(X){return J1.connect(X)}function yZ(X){let J=RZ(X)||".json",$=kZ(X,RZ(X));return{statePath:NJ(Y1(X),`${$}-state${J}`),tokenPath:X}}function FJ(X){let J=X.override?.trim();if(J&&!CZ(J)&&!X.cwd)throw new $0("invalid-state","A relative Claustrum enrollment override needs a base directory");let $=J?CZ(J)?J:RP(X.cwd,J):NJ(X.stateDir,`${X.host}-enrollment.json`);return yZ($)}function hZ(X){return typeof X==="object"&&X!==null&&!Array.isArray(X)}function Y7(X){return typeof X==="number"&&Number.isSafeInteger(X)&&X>=0}function fZ(X){return typeof X==="number"&&Number.isSafeInteger(X)&&X>=1}function X3(){return new $0("invalid-state","invalid Claustrum enrollment state")}function Q7(X){if(!hZ(X)||X.version!==CP||typeof X.proposedName!=="string"||X.proposedName.length===0)throw X3();if(X.phase==="pending"){if(!qJ.test(String(X.requestSecret??""))||X.requestId!==void 0&&(typeof X.requestId!=="string"||X.requestId.length===0)||!Y7(X.createdAt)||!Y7(X.updatedAt))throw X3();return{version:1,phase:"pending",proposedName:X.proposedName,requestSecret:X.requestSecret,...X.requestId!==void 0&&{requestId:X.requestId},createdAt:X.createdAt,updatedAt:X.updatedAt}}if(X.phase==="approved"){if(X.approvedName!==void 0&&(typeof X.approvedName!=="string"||X.approvedName.length===0)||!fZ(X.tokenGeneration)||!Y7(X.updatedAt))throw X3();return{version:1,phase:"approved",proposedName:X.proposedName,...X.approvedName!==void 0&&{approvedName:X.approvedName},tokenGeneration:X.tokenGeneration,updatedAt:X.updatedAt}}if(X.phase==="denied"||X.phase==="blocked"){if(X.errorCode!==void 0&&typeof X.errorCode!=="string"||!Y7(X.updatedAt))throw X3();return{version:1,phase:X.phase,proposedName:X.proposedName,...X.errorCode!==void 0&&{errorCode:X.errorCode},updatedAt:X.updatedAt}}throw X3()}function PJ(X){if(!hZ(X)||!qJ.test(String(X.token??""))||!fZ(X.token_generation))throw new $0("invalid-token","invalid Claustrum enrollment token file");return{token:X.token,token_generation:X.token_generation}}function EP(X){if(!X.isFile())throw new $0("unsafe-file","Claustrum enrollment file must be a regular file");if((X.mode&63)!==0)throw new $0("unsafe-file","Claustrum enrollment file must be owner-only");let J=process.geteuid?.();if(J!==void 0&&X.uid!==J)throw new $0("unsafe-file","Claustrum enrollment file must be owned by the current user")}function SP(X){try{return JSON.parse(X)}catch{throw new $0("invalid-state","Claustrum enrollment file is not valid JSON")}}async function A9(X){let J;try{J=await SZ(X,AZ.O_RDONLY|AZ.O_NOFOLLOW)}catch($){if($.code==="ENOENT")return;throw new $0("unsafe-file","Claustrum enrollment file could not be opened safely")}try{EP(await J.stat());let $=Buffer.alloc(KJ+1),{bytesRead:Y}=await J.read($,0,$.byteLength,0);if(Y>KJ)throw new $0("unsafe-file","Claustrum enrollment file is too large");return SP($.subarray(0,Y).toString("utf8"))}finally{await J.close()}}function EZ(X,J){let $=[];for(let Y of X.split(`
-`)){if(Y.trim()===""||Y.startsWith("#"))continue;let G=Y.split(":");if(G.length!==J||!/^[^\s:,]+$/.test(G[0]??"")||!/^\d+$/.test(G[2]??"")||!Number.isSafeInteger(Number(G[2]))||J===7&&(!/^\d+$/.test(G[3]??"")||!Number.isSafeInteger(Number(G[3])))||J===4&&G[3]!==""&&!/^[^\s:,]+(?:,[^\s:,]+)*$/.test(G[3]??""))return;$.push(G)}return $}async function IP(X,J,$){try{let[Y,G]=await Promise.all([TZ($.passwdPath??"/etc/passwd","utf8"),TZ($.groupPath??"/etc/group","utf8")]),Q=EZ(Y,7),z=EZ(G,4);if(!Q||!z)return!1;let Z=Q.filter((U)=>Number(U[2])===X),W=z.filter((U)=>Number(U[2])===J);if(Z.length!==1||W.length!==1)return!1;let B=Z[0]?.[0],H=W[0]?.[3]??"";return(H===""||H.split(",").every((U)=>U===B))&&!Q.some((U)=>Number(U[2])!==X&&Number(U[3])===J)}catch{return!1}}async function gZ(X,J={}){let $=process.geteuid?.();if($===void 0)return;let Y=process.getegid?.(),G;try{G=await AP(X)}catch{return}let Q;for(;;){let z=await IZ(G).catch(()=>{return});if(z&&(z.mode&18)!==0&&(z.mode&512)===0){if(Q===void 0)Q=Y!==void 0&&await IP($,Y,J);if((z.mode&2)!==0||z.uid!==$||z.gid!==Y||!Q)throw new $0("unsafe-file",`Claustrum enrollment path has a writable ancestor: ${G}. Another user could replace it. Run: chmod g-w,o-w ${G}`)}let Z=Y1(G);if(Z===G)return;G=Z}}async function G7(X){await _P(X,{recursive:!0,mode:448});let J=await IZ(X),$=process.geteuid?.();if($!==void 0&&J.uid!==$)throw new $0("unsafe-file","Claustrum enrollment directory must be owned by the current user");if((J.mode&63)!==0)await MP(X,448)}async function $1(X,J,$={}){let Y=Y1(X);await G7(Y),await gZ(Y,$);let G=`${JSON.stringify(J)}
-`;if(Buffer.byteLength(G)>KJ)throw new $0("invalid-state","Claustrum enrollment state is too large");let Q=NJ(Y,`.${kZ(X)}.${process.pid}.${OP()}.tmp`),z,Z=!1;try{z=await SZ(Q,"wx",384),Z=!0,await z.writeFile(G,"utf8"),await z.chmod(384),await z.sync(),await z.close(),z=void 0,await TP(Q,X),Z=!1}finally{if(await z?.close().catch(()=>{}),Z)await bZ(Q).catch(()=>{})}}async function J3(X,J){let $=await A9(X.tokenPath),Y=$===void 0?void 0:PJ($),G=await A9(X.statePath),Q=G===void 0?void 0:Q7(G);if(Y)return{state:"approved",proposedName:Q?.proposedName??J,...Q?.phase==="approved"&&Q.approvedName!==void 0&&{approvedName:Q.approvedName},tokenGeneration:Y.token_generation};if(!Q)return{state:"idle"};if(Q.phase==="approved")return{state:"blocked",proposedName:Q.proposedName,code:"missing_token"};return _9(Q)}async function $3(X,J){let $;try{$=await J3(X,J)}catch(Y){if(!(Y instanceof $0)||Y.kind!=="invalid-state"&&Y.kind!=="invalid-token")return"unreadable";try{let G=await A9(X.statePath);if(G===void 0)return"unreadable";let Q=Q7(G);return Q.phase==="approved"&&Q.proposedName===J?"vault":"unreadable"}catch{return"unreadable"}}if("proposedName"in $&&$.proposedName!==J)return"unreadable";if($.state==="approved"||$.state==="blocked"&&$.code==="missing_token")return"vault";return"local"}async function OJ(X){let J=await A9(X);if(J===void 0)throw new $0("not-enrolled","Claustrum enrollment is not configured");return PJ(J)}function _9(X){if(X.phase==="pending")return{state:"pending",proposedName:X.proposedName,...X.requestId!==void 0&&{requestId:X.requestId}};if(X.phase==="approved")return{state:"approved",proposedName:X.proposedName,...X.approvedName!==void 0&&{approvedName:X.approvedName},tokenGeneration:X.tokenGeneration};if(X.phase==="denied")return{state:"denied",proposedName:X.proposedName};return{state:"blocked",proposedName:X.proposedName,code:X.errorCode??"unknown"}}function mZ(){return new $0("wrong-consumer","Claustrum enrollment state belongs to a different consumer")}class z7{#X;#J;#W;#Q;#z;#Y;#$;constructor(X){this.#$=X.ancestorOptions??{},this.#X=X.client,this.#J=X.paths,this.#W=X.proposedName,this.#Q=X.now??Date.now,this.#z=X.mintSecret??(()=>PP(32).toString("hex")),this.#Y=X.writeTokenFile??HJ}async status(){return J3(this.#J,this.#W)}async resetTerminal(){return uZ(this.#J,this.#W)}async#B(X,J){let $={version:1,phase:"blocked",proposedName:X.proposedName,errorCode:J,updatedAt:this.#Q()};return await $1(this.#J.statePath,$,this.#$),_9($)}async reconcile(){await G7(Y1(this.#J.statePath));let X=await g0({name:"ceremony",path:this.#J.statePath,ttlMs:xZ,renew:!0});if(!X)return{state:"busy"};try{let J=await A9(this.#J.tokenPath),$=J===void 0?void 0:PJ(J),Y=await A9(this.#J.statePath),G=Y===void 0?void 0:Q7(Y);if(G&&G.proposedName!==this.#W)throw mZ();if($){if(!G||G.phase==="pending"){let z={version:1,phase:"approved",proposedName:G?.proposedName??this.#W,tokenGeneration:$.token_generation,updatedAt:this.#Q()};await $1(this.#J.statePath,z,this.#$),G=z}return{state:"approved",proposedName:G.proposedName,...G.phase==="approved"&&G.approvedName!==void 0&&{approvedName:G.approvedName},tokenGeneration:$.token_generation}}if(G?.phase==="approved"){let z={version:1,phase:"blocked",proposedName:G.proposedName,errorCode:"missing_token",updatedAt:this.#Q()};return await $1(this.#J.statePath,z,this.#$),_9(z)}if(G&&G.phase!=="pending")return _9(G);if(!G){let z=this.#Q();if(G={version:1,phase:"pending",proposedName:this.#W,requestSecret:this.#z(),createdAt:z,updatedAt:z},!qJ.test(G.requestSecret))throw new $0("invalid-state","invalid minted Claustrum enrollment secret");await $1(this.#J.statePath,G,this.#$)}if(!G.requestId)try{let z=FP("sha256").update(Buffer.from(G.requestSecret,"hex")).digest("hex"),Z=await this.#X.enrollPropose({name:G.proposedName,requestSecretHash:z});G={...G,requestId:Z.requestId,updatedAt:this.#Q()},await $1(this.#J.statePath,G,this.#$)}catch(z){let Z=jJ(z);if(!Z)throw z;if(Z.disposition==="retry")return{state:"pending",proposedName:G.proposedName,retryCode:Z.code};return this.#B(G,Z.code)}let Q=G.requestId;if(!Q)return _9(G);try{let z=await this.#X.enrollPoll({requestId:Q,requestSecret:G.requestSecret});if(z.status==="pending")return _9(G);if(z.status==="denied"){let W={version:1,phase:"denied",proposedName:G.proposedName,updatedAt:this.#Q()};return await $1(this.#J.statePath,W,this.#$),_9(W)}await G7(Y1(this.#J.tokenPath)),await gZ(Y1(this.#J.tokenPath),this.#$),await this.#Y(this.#J.tokenPath,{token:z.token,token_generation:z.tokenGeneration});let Z={version:1,phase:"approved",proposedName:G.proposedName,approvedName:z.name,tokenGeneration:z.tokenGeneration,updatedAt:this.#Q()};return await $1(this.#J.statePath,Z,this.#$),_9(Z)}catch(z){let Z=jJ(z);if(!Z)throw z;if(Z.disposition==="retry")return{state:"pending",proposedName:G.proposedName,requestId:Q,retryCode:Z.code};return this.#B(G,Z.code)}}finally{await X.release()}}}async function uZ(X,J){await G7(Y1(X.statePath));let $=await g0({name:"ceremony",path:X.statePath,ttlMs:xZ,renew:!0});if(!$)return"busy";try{if(await A9(X.tokenPath)!==void 0)return"refused-approved";let Y=await A9(X.statePath);if(Y===void 0)return"idle";let G=Q7(Y);if(G.proposedName!==J)throw mZ();if(G.phase==="pending")return"refused-pending";return await $.assertOwned(),await bZ(X.statePath),"reset"}finally{await $.release()}}var Y3="claustrum-tombstone:v1:";function Z7(X){return`${Y3}${X}`}function MJ(X){return typeof X==="object"&&X!==null&&!Array.isArray(X)}function W7(X){return typeof X==="string"&&X.startsWith(Y3)}function pZ(X,J){if(!MJ(X)||X.type!=="oauth")return!1;return X.refresh===Z7(J)}function cZ(X,J){if(pZ(X,J))return"placeholder";if(MJ(X)&&X.type==="oauth"&&typeof X.refresh==="string"&&X.refresh.length>0&&!W7(X.refresh))return"login";if(MJ(X)&&X.type==="api"&&typeof X.key==="string"&&X.key.length>0)return"login";return"empty"}function _J(X){let J=cZ(X.auth,X.provider);if(X.mode==="custody"&&J==="login")throw new $0("host-slot-login",`${X.provider} has a host login while its accounts are vault-custodied; refusing to serve until one is removed`);if(X.mode==="local"&&J==="placeholder")throw new $0("host-slot-placeholder",`${X.provider} host slot holds the vault placeholder; sign in to use local accounts`);return J}function lZ(X,J){return J!==void 0&&J.credentialId===X.credentialId&&J.accountIdentity===X.accountIdentity&&J.recordVersion!==X.recordVersion}function bP(X,J){if(J===void 0)return"reauthorize-failed";if(J.credentialId!==X.credentialId)return"credential-changed";if(J.accountIdentity!==X.accountIdentity)return"account-changed";if(J.recordVersion===X.recordVersion)return"version-unchanged";return"rotated"}var dZ=Z0("claustrum");function RJ(X,J,$,Y=dZ){let G=lZ(J,$);return Y.debug("scoped 401 re-authorized",{site:X,credentialId:J.credentialId,servedVersion:J.recordVersion,currentVersion:$?.recordVersion??null,retry:G,reason:bP(J,$)}),G}var TJ=300000;function AJ(){return new $0("invalid-material","Claustrum returned invalid credential material")}function kP(X){let J=X.trim();if(J.startsWith("{")){let $;try{$=JSON.parse(J)}catch{throw AJ()}if(!$||typeof $!=="object")throw AJ();let Y=$,G=Y.access_token??Y.access;J=typeof G==="string"?G:""}if(!/^[\x21-\x7e]+$/.test(J)||J.startsWith(Y3))throw AJ();return J}function xP(X,J){if(!X.operations.includes("read"))return;if(!X.categories.includes(J.category))return;if(X.credentialType==="oauth")return X.refreshAdapter===J.refreshAdapter?"oauth":void 0;if(X.credentialType==="api_key"&&J.apiKeys)return X.refreshAdapter===void 0?"api_key":void 0;return}class B7{#X;#J;#W;#Q;#z;#Y;#$;#B=new WeakMap;#H=new WeakMap;#G=!1;constructor(X){let J=X.tokenPath;if(X.readToken)this.#J=X.readToken;else if(J)this.#J=()=>OJ(J);else throw new $0("not-enrolled","Claustrum enrollment token path is required");this.#X=X.client,this.#Q=X.family,this.#z=X.parseIdentity,this.#Y=X.requireAssertion??!1,this.#W=X.now??Date.now,this.#$=X.logger??dZ}#Z(X){if(this.#G)throw new $0("closed","Claustrum scoped custody is closed");X?.throwIfAborted()}async#V(X){this.#Z(X);let J=await this.#J();if(this.#Z(X),!/^[0-9a-f]{64}$/.test(J.token)||!Number.isSafeInteger(J.token_generation)||J.token_generation<1)throw new $0("invalid-token","Invalid Claustrum enrollment token");return J.token}async#U(X,J){this.#Z(J);let $,Y;try{let G=X();$=J?await Promise.race([G,new Promise((Q,z)=>{let Z=()=>z(J.reason);if(J.addEventListener("abort",Z,{once:!0}),Y=()=>J.removeEventListener("abort",Z),J.aborted)Z()})]):await G}catch(G){if(this.#Z(J),G instanceof V8)throw G;throw new $0("unavailable","Claustrum scoped operation unavailable")}finally{Y?.()}return this.#Z(J),$}async discover(X){let J=await this.#V(X),$=await this.#U(()=>this.#X.listScoped(J),X),Y=[],G=[],Q=new Map;for(let Z of $.rows){let W=xP(Z,this.#Q);if(!W)continue;G.push({row:Z,type:W}),Q.set(Z.id,(Q.get(Z.id)??0)+1)}let z=[];for(let{row:Z,type:W}of G){let B;if(!Z.id.trim())B="empty credential id";else if((Q.get(Z.id)??0)>1)B="duplicate credential id";else if(Z.accountId!==void 0&&!Z.accountId.trim())B="blank account identity";else if(!Z.state.trim())B="empty state";if(B){Y.push({...Z.id.trim()&&{credentialId:Z.id},reason:B});continue}z.push(Object.freeze({credentialId:Z.id,credentialType:W,...Z.accountId!==void 0&&{accountIdentity:Z.accountId},state:Z.state,...Z.email!==void 0&&{email:Z.email},...Z.orgName!==void 0&&{orgName:Z.orgName}}))}for(let Z of Y)this.#$.warn("skipped malformed vault record",Z);return{view:$.view,credentials:Object.freeze(z),skipped:Object.freeze(Y)}}async authorize(X,J){if(!X.credentialId)throw new $0("route-unavailable","Claustrum dispatch requires a credential id");let{credentialId:$,credentialType:Y,accountIdentity:G}=X;if(this.#Y&&G===void 0)throw new $0("identity-unasserted","Claustrum dispatch requires a known account identity");let Q=await this.#V(J),z=await this.#U(()=>this.#X.getScoped({credentialId:$,enrollmentToken:Q,...Y==="oauth"&&{minTtlMs:TJ}}),J);if(z.credentialId!==void 0&&z.credentialId!==$)throw new $0("identity-changed","Claustrum served credential identity changed");let Z=z.expiresAtMs;if(!Number.isSafeInteger(z.recordVersion)||z.recordVersion<0||Z===null&&Y==="oauth"||Z!==null&&(!Number.isFinite(Z)||Z-this.#W()<TJ))throw new $0("insufficient-validity","Claustrum served credential has insufficient validity");let W=kP(z.material),B=z.accountId?.trim()?z.accountId:void 0;if(this.#Y&&(z.credentialId===void 0||B===void 0))throw new $0("identity-unasserted","Claustrum served credential did not assert its identity");let H=B===void 0?this.#z?.(W):void 0,U=B??H;if(G!==void 0&&U!==void 0&&U!==G)throw new $0("identity-changed","Claustrum served credential identity changed");let j=U??G,K=Object.freeze(Object.defineProperty({credentialId:$,credentialType:Y,...j!==void 0&&{accountIdentity:j},accountIdentitySource:B!==void 0?"asserted":H!==void 0?"parsed":G!==void 0?"expected":"none",...G!==void 0&&{expectedAccountIdentity:G},...z.credentialId!==void 0&&{assertedCredentialId:z.credentialId},...B!==void 0&&{assertedAccountIdentity:B},...z.projectId!==void 0&&{projectId:z.projectId},recordVersion:z.recordVersion,expiresAtMs:Z},"accessToken",{value:W,enumerable:!1}));return this.#B.set(K,Q),K}async reportFailure(X,J,$){if(J!==401)return;this.#Z();let Y=this.#B.get(X);if(!Y)throw new $0("no-receipt","Claustrum failure report requires an original dispatch receipt");let G=this.#H.get(X);if(G)return G;let Q=this.#U(()=>this.#X.reportAuthFailureScoped({credentialId:X.credentialId,enrollmentToken:Y,providerStatus:401,recordVersion:X.recordVersion,reporterSource:$}));this.#H.set(X,Q);try{await Q,this.#$.debug("scoped 401 reported",{credentialId:X.credentialId,recordVersion:X.recordVersion,reporterSource:$})}catch(z){throw this.#H.delete(X),z}}close(){if(this.#G)return;this.#G=!0,this.#X.close()}}import{createHash as wP}from"node:crypto";import{readFile as vP}from"node:fs/promises";function iZ(X,J,$){if(X.accountIdentity!==void 0&&$!==void 0)return X.accountIdentity===$;return X.credentialId===J}function CJ(X,J,$){return X.some((Y)=>iZ(Y,J,$))}function EJ(X,J,$){let Y={credentialId:J,...$!==void 0&&{accountIdentity:$}};return[...X.filter((G)=>G.credentialId!==J||G.accountIdentity!==$),Y]}function SJ(X,J,$){return X.filter((Y)=>!J.some((G)=>iZ(Y,G,$)))}var aZ="vault:";function yP(X){return wP("sha256").update(X).digest("hex")}function hP(X){let J=X.credentialId.split(":");return(J.length>=3?J.slice(2).join(":").trim():void 0)||X.email||X.credentialId}function fP(X){return X.identity!==void 0?`identity:${X.identity}`:`credential:${X.credential.credentialId}`}function T9(X){return[X.credentialId,...X.aliases??[]]}function oZ(X,J,$={}){let Y=$.now??Date.now(),G=$.routePrefix??aZ,Q=$.reservedRouteIds??new Set,z=X?.rows??[],Z=[...X?.declined??[]],W=J.skipped.length===0,B=new Set(J.credentials.map((L)=>L.credentialId)),H=new Set(J.skipped.flatMap((L)=>L.credentialId===void 0?[]:[L.credentialId])),U=J.skipped.some((L)=>L.credentialId===void 0),j=(L)=>!B.has(L)&&(H.has(L)||U),N=new Map;for(let L of z){if(L.accountIdentity===void 0)continue;for(let P of T9(L))if(!N.has(P))N.set(P,L.accountIdentity)}let K=new Map;for(let L of J.credentials){let P=L.accountIdentity!==void 0?{credential:L,identity:L.accountIdentity,claimed:!0}:{credential:L,identity:N.get(L.credentialId),claimed:!1},A=fP(P),T=K.get(A)??[];T.push(P),K.set(A,T)}let q=new Set,F=new Set(Q),O=[],_=(L,P)=>L.credential.credentialId.localeCompare(P.credential.credentialId),C=[...K.values()].map((L)=>L.toSorted(_)).sort((L,P)=>L[0]&&P[0]?_(L[0],P[0]):0);for(let L of C){let P=L[0]?.identity,A=L.filter((r)=>r.credential.state==="active"),T=A.length?A:L,k=T.filter((r)=>r.claimed),p=k.length?k:T,i=new Set(L.map((r)=>r.credential.credentialId)),X0=z.find((r)=>!q.has(r)&&T9(r).some((a)=>i.has(a))&&(r.accountIdentity===void 0||r.accountIdentity===P)),w=p.find((r)=>r.credential.credentialId===X0?.credentialId)??p[0];if(!w)continue;let J0=w.credential,G0=X0??(P===void 0?void 0:z.find((r)=>!q.has(r)&&r.accountIdentity===P));if(G0)q.add(G0);let L0=G0?.routeId;if(!L0||Q.has(L0)){let r=`${G}${J0.credentialId}${P===void 0?"":`~${yP(P).slice(0,10)}`}`;L0=r;for(let a=2;F.has(L0);a++)L0=`${r}~${a}`}F.add(L0);let m=G0?T9(G0).filter(j):[],c0=[...new Set([...L.map((r)=>r.credential.credentialId),...m])].filter((r)=>r!==J0.credentialId).sort((r,a)=>r.localeCompare(a)),m0=$.mapAccount?.(J0)??{};O.push({previousIndex:G0?z.indexOf(G0):1/0,row:{routeId:L0,credentialId:J0.credentialId,credentialType:J0.credentialType,...P!==void 0&&{accountIdentity:P},...c0.length&&{aliases:c0},state:J0.state,label:m0.label?.trim()||hP(J0),...J0.email!==void 0&&{email:J0.email},...J0.orgName!==void 0&&{orgName:J0.orgName},enabled:![J0.credentialId,...c0].some((r)=>CJ(Z,r,P)),addedAt:G0?.addedAt??Y,...G0?.quota!==void 0&&{quota:G0.quota},...!w.claimed&&P!==void 0&&{unclaimed:!0}}})}return z.forEach((L,P)=>{if(q.has(L)||!T9(L).some(j))return;if(F.has(L.routeId))return;let[A,...T]=T9(L).filter((i)=>!B.has(i));if(A===void 0)return;F.add(L.routeId);let{aliases:k,...p}=L;O.push({previousIndex:P,row:{...p,credentialId:A,...T.length&&{aliases:T},stale:!0}})}),O.sort((L,P)=>L.previousIndex===P.previousIndex?L.row.credentialId.localeCompare(P.row.credentialId):L.previousIndex-P.previousIndex),{version:1,view:J.view,complete:W,...!W&&{rejected:J.skipped.map((L)=>({...L.credentialId!==void 0&&{credentialId:L.credentialId},reason:L.reason}))},rows:O.map((L)=>L.row),declined:Z}}function IJ(X){return(X?.rows??[]).filter((J)=>J.enabled&&J.state==="active").map((J)=>({id:J.routeId,kind:J.credentialType==="oauth"?"oauth":"api-key",...J.quota!==void 0&&{quota:J.quota}}))}function H7(X){return typeof X==="object"&&X!==null&&!Array.isArray(X)}function r1(X){return X===void 0||typeof X==="string"}function gP(X){if(!H7(X)||typeof X.routeId!=="string"||typeof X.credentialId!=="string"||X.credentialType!=="oauth"&&X.credentialType!=="api_key"||typeof X.state!=="string"||typeof X.label!=="string"||typeof X.enabled!=="boolean"||typeof X.addedAt!=="number"||!r1(X.accountIdentity)||!r1(X.email)||!r1(X.orgName)||X.aliases!==void 0&&(!Array.isArray(X.aliases)||!X.aliases.every((J)=>typeof J==="string"))||X.quota!==void 0&&!G6(X.quota)||X.stale!==void 0&&X.stale!==!0||X.unclaimed!==void 0&&X.unclaimed!==!0)return;return X}var mP=new Set(["empty credential id","duplicate credential id","blank account identity","empty state"]);function nZ(X){if(!Array.isArray(X))return;let J=[];for(let $ of X){if(!H7($)||!r1($.credentialId)||typeof $.reason!=="string"||!mP.has($.reason))return;J.push($)}return J}function uP(X){if(!H7(X)||X.version!==1||!r1(X.view)||!Array.isArray(X.rows)||!Array.isArray(X.declined)||X.complete!==void 0&&typeof X.complete!=="boolean"||X.rejected!==void 0&&!nZ(X.rejected))throw new $0("invalid-state","Claustrum roster file is not valid");let J=[];for(let G of X.rows){let Q=gP(G);if(!Q)throw new $0("invalid-state","Claustrum roster file is not valid");J.push(Q)}let $=[];for(let G of X.declined){if(!H7(G)||typeof G.credentialId!=="string"||!r1(G.accountIdentity))throw new $0("invalid-state","Claustrum roster file is not valid");$.push(G)}let Y=nZ(X.rejected);return{version:1,...typeof X.view==="string"&&{view:X.view},complete:X.complete!==!1,...Y&&{rejected:Y},rows:J,declined:$}}async function R9(X){let J;try{J=await vP(X,"utf8")}catch(Y){if(Y.code==="ENOENT")return;throw Y}let $;try{$=JSON.parse(J)}catch{throw new $0("invalid-state","Claustrum roster file is not valid")}return uP($)}var pP={name:"claustrum-roster-write",ttlMs:1e4,timeoutMs:5000},cP={name:"claustrum-roster",ttlMs:30000};async function G3(X,J,$={}){return sZ(X,pP,async(Y)=>{let G=await R9(X),{next:Q,result:z}=await J(G,{assertOwned:()=>Y.assertOwned()});if(Q)await Y.assertOwned(),await M6(X,Q,{beforeRename:async()=>{await $.beforePublish?.(),await Y.assertOwned()}});return z})}function bJ(X,J){return G3(X,($)=>{let Y=$?.rows.find((Q)=>Q.routeId===J);if(!$||!Y)throw new $0("route-unavailable","Claustrum route is not in the roster");let G=EJ($.declined,Y.credentialId,Y.accountIdentity);return{next:{...$,declined:G,rows:$.rows.map((Q)=>Q===Y?{...Q,enabled:!1}:Q)},result:void 0}})}function kJ(X,J){return G3(X,($)=>{let Y=$?.rows.find((G)=>G.routeId===J);if(!$||!Y)throw new $0("route-unavailable","Claustrum route is not in the roster");return{next:{...$,declined:SJ($.declined,T9(Y),Y.accountIdentity),rows:$.rows.map((G)=>G===Y?{...G,enabled:!0}:G)},result:void 0}})}function lP(X,J){if(!T9(X).includes(J.credentialId))return"refuse";if(X.unclaimed&&(J.accountIdentitySource==="expected"||J.accountIdentitySource==="none"))return"refuse";if(X.accountIdentity===J.accountIdentity)return"hold";if(X.accountIdentity===void 0&&J.expectedAccountIdentity===void 0&&J.accountIdentity!==void 0&&(J.accountIdentitySource==="asserted"||J.accountIdentitySource==="parsed")&&T9(X).length===1)return"bind";return"refuse"}function xJ(X,J){return G3(X,($)=>{let Y=$?.rows.find((Z)=>Z.routeId===J.routeId),G=!$||!Y?"refuse":lP(Y,J);if(!$||!Y||G==="refuse")return{result:!1};let Q=V7(Y.quota,J.observation),z=G==="bind"?{accountIdentity:J.accountIdentity,unclaimed:!0}:{};return{next:{...$,rows:$.rows.map((Z)=>Z===Y?{...Z,...z,quota:Q}:Z)},result:!0}})}async function wJ(X){X.signal?.throwIfAborted();let J=async()=>await X.isActive?.()??!0;if(!await J())return;let $=await g0({...cP,path:X.path,renew:!0});if(!$){let Y=await R9(X.path);if(X.signal?.throwIfAborted(),!Y?.view)throw new $0("roster-busy","Claustrum account discovery is already in progress");return Y}try{let Y=await X.custody.discover(X.signal);return X.signal?.throwIfAborted(),await G3(X.path,async(G)=>{if(!await J())return{result:void 0};X.signal?.throwIfAborted(),await $.assertOwned();let Q=typeof X.projection==="function"?X.projection():X.projection,z=oZ(G,Y,Q);return{...JSON.stringify(G)!==JSON.stringify(z)&&{next:z},result:z}})}finally{await $.release()}}class U7{#X;#J=new AbortController;#W;#Q;#z;#Y;#$;#B;#H=!1;constructor(X){this.#X=X,this.#W=X.logger??Z0("claustrum")}#G(X){this.#J.signal.throwIfAborted(),X?.throwIfAborted()}async#Z(){return await this.#X.isCustodyActive?.()??!0}#V(X,J){let $=e4([this.#J.signal,...J?[J]:[]]);return new Promise((Y,G)=>{let Q=()=>{$.signal.removeEventListener("abort",z),$.dispose()},z=()=>{Q(),G($.signal.reason)};if($.signal.addEventListener("abort",z,{once:!0}),X.then((Z)=>{if(Q(),$.signal.aborted)G($.signal.reason);else Y(Z)},(Z)=>{Q(),G(Z)}),$.signal.aborted)z()})}async#U(){if(this.#G(),this.#Q)return this.#Q;if(!this.#z)this.#z=this.#X.connect().then((X)=>{if(this.#J.signal.aborted)X.close(),this.#G();return this.#Q=new B7({client:X,family:this.#X.family,tokenPath:this.#X.tokenPath,parseIdentity:this.#X.parseIdentity,requireAssertion:this.#X.requireAssertion,now:this.#X.now,logger:this.#W}),this.#Q}).finally(()=>{this.#z=void 0});return this.#V(this.#z)}snapshot(){return this.#$}routingRows(){return IJ(this.#$)}refresh(){if(this.#G(),this.#Y)return this.#Y;return this.#Y=(async()=>{if(!await this.#Z()){this.#$=void 0,this.#Q?.close(),this.#Q=void 0;return}let X=await this.#U(),J=await wJ({path:this.#X.rosterPath,custody:X,isActive:()=>this.#Z(),signal:this.#J.signal,projection:()=>({reservedRouteIds:new Set(this.#X.reservedRouteIds?.()??[]),routePrefix:this.#X.routePrefix,mapAccount:this.#X.mapAccount,now:(this.#X.now??Date.now)()})});this.#G();let $=J?.view!==this.#$?.view;if(this.#$=J,J&&$)this.#X.onRoster?.(J);return J})().finally(()=>{this.#Y=void 0}),this.#Y}start(){if(this.#H)return;this.#G(),this.#H=!0;let X=async()=>{try{await this.refresh()}catch($){if(!this.#J.signal.aborted)this.#X.onError?.($)}if(this.#J.signal.aborted)return;let J=this.#X.pollIntervalMs??5000;if(J<=0)return;this.#B=(this.#X.setTimeoutImpl??setTimeout)(()=>{this.#B=void 0,X()},J),this.#B.unref?.()};X()}async authorize(X,J){this.#G(J);let $=this.#$??await this.#V(this.refresh(),J);if(!$||!await this.#Z())throw new $0("not-active","Claustrum scoped custody is not active");let Y=await R9(this.#X.rosterPath);this.#G(J);let G=$.rows.find((W)=>W.routeId===X),Q=Y?.rows.find((W)=>W.routeId===X);if(Q&&!Q.enabled)throw new $0("route-declined","Claustrum route is disabled");if(!G||!Q||Q.state!=="active"||Q.credentialId!==G.credentialId||Q.accountIdentity!==G.accountIdentity)throw new $0("route-unavailable","Claustrum route is disabled, removed or changed");let z=await this.#V(this.#U(),J),Z=e4([this.#J.signal,...J?[J]:[]]);try{return await z.authorize({credentialId:Q.credentialId,credentialType:Q.credentialType,...Q.accountIdentity!==void 0&&{accountIdentity:Q.accountIdentity}},Z.signal)}finally{Z.dispose()}}async reportFailure(X,J,$){if(this.#G(),!this.#Q)throw new $0("no-receipt","Claustrum dispatch receipt has no active owner");await this.#Q.reportFailure(X,J,$)}async send(X,J,$){let Y=$.signal,G=await this.authorize(X,Y),Q=await J(G,Y);if(Q.status===401&&!Y?.aborted){let z;try{z=await this.authorize(X,Y)}catch{}if(RJ($.site,G,z,this.#W))await Q.body?.cancel().catch(()=>{}),G=z,Q=await J(z,Y)}if(Q.status===401)await this.reportFailure(G,401,$.reporterSource??"direct").catch((z)=>this.#X.onError?.(z)),Promise.resolve().then(()=>this.refresh()).catch((z)=>{if(!this.#J.signal.aborted)this.#X.onError?.(z)});return Q}async decline(X){this.#G(),await bJ(this.#X.rosterPath,X),this.#$=await R9(this.#X.rosterPath)}async accept(X){this.#G(),await kJ(this.#X.rosterPath,X),this.#$=await R9(this.#X.rosterPath)}async recordQuota(X,J,$){this.#G();let Y=await xJ(this.#X.rosterPath,{routeId:X,observation:J,credentialId:$.credentialId,accountIdentitySource:$.accountIdentitySource,...$.accountIdentity!==void 0&&{accountIdentity:$.accountIdentity},...$.expectedAccountIdentity!==void 0&&{expectedAccountIdentity:$.expectedAccountIdentity}});if(Y)this.#$=await R9(this.#X.rosterPath);return Y}close(){if(this.#J.signal.aborted)return;if(this.#J.abort(new $0("closed","Claustrum consumer is closed")),this.#B)(this.#X.clearTimeoutImpl??clearTimeout)(this.#B);this.#B=void 0,this.#Q?.close(),this.#$=void 0}}function rZ(X){return J1.connect(X)}var tZ=Z7("openai");function eZ(X){return W7(X)}function T0(X){if(!X||X.corrupt===!0)return!1;return eZ(X.refresh)}class G1 extends Error{code="tombstone-refresh";constructor(){super("This OpenAI account was moved into the Claustrum vault by an older version of OpenAI auth and holds no local credential. Connect the vault, or sign in to the account again.");this.name="TombstoneRefreshError"}}function K7(X){if(eZ(X))throw new G1}var dP=Z0("quota"),vJ="primary",yJ="secondary",iP="app_EMoamEEZ73f0CkXaXp7hrann",nP="https://auth.openai.com";async function Q3(X){K7(X.refreshToken);let J=await X.fetchImpl(`${nP}/oauth/token`,{method:"POST",signal:AbortSignal.timeout(15000),headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"refresh_token",refresh_token:X.refreshToken,client_id:iP}).toString()});if(!J.ok){let G=w5(J.headers.get("retry-after"));throw Object.assign(Error(`Token refresh failed: ${J.status}`),{status:J.status,retryAfter:G,isRefreshError:!0})}let $=await J.json();if(!$||typeof $.access_token!=="string"||!$.access_token||typeof $.expires_in!=="number")throw Object.assign(Error("Token refresh failed: malformed response"),{status:J.status,isRefreshError:!0});if($.refresh_token!==void 0&&typeof $.refresh_token!=="string")throw Object.assign(Error("Token refresh failed: malformed response"),{status:J.status,isRefreshError:!0});let Y=typeof $.refresh_token==="string"&&$.refresh_token?$.refresh_token:X.refreshToken;return{access:$.access_token,refresh:Y,expires:X.now()+$.expires_in*1000,expiresIn:$.expires_in}}var sP="https://chatgpt.com/backend-api/wham/usage";async function b8(X){let J=X.logger??dP,$=X.accountKey??"unknown",Y=Date.now();J.debug("wham usage fetch started",{pid:process.pid,accountId:$});try{let G=await X.fetchImpl(sP,{signal:AbortSignal.timeout(15000),headers:{authorization:`Bearer ${X.accessToken}`,"chatgpt-account-id":X.accountId??"","oai-client-platform":"web","oai-client-version":"0","x-openai-target-path":"/backend-api/wham/usage"}});if(!G.ok){let z=w5(G.headers.get("retry-after"));throw Object.assign(Error(`wham usage check failed: ${G.status}`),{status:G.status,retryAfter:z})}let Q=bz(await G.json());return J.debug("wham usage fetch succeeded",{pid:process.pid,accountId:$,status:G.status,elapsedMs:Date.now()-Y}),Q}catch(G){throw J.warn("wham usage fetch failed",{pid:process.pid,accountId:$,status:typeof G?.status==="number"?G.status:"error",elapsedMs:Date.now()-Y,error:e0(G)}),G}}import{createHash as aP}from"node:crypto";var oP=globalThis.setTimeout,rP=5;function z3(X){let J=X?.quota?.checkIntervalMinutes??rP;return Math.max(1,J)*60000}function tP(X){return X?.quota?.enabled!==!1}function j7(X,J){if(!X?.resetsAt)return!1;let $=Date.parse(X.resetsAt);return Number.isFinite($)&&$<=J}function $W(X,J,$,Y,G){if(G!==void 0&&Number.isFinite(G)&&G>$)return G;let Q=J===vJ?X?.primary:J===yJ?X?.secondary:void 0,z=Q?.resetsAt?Date.parse(Q.resetsAt):NaN;if(Number.isFinite(z)&&z>$)return z;return $+Y}function eP(X){let J=X?.quota?.minimumRemaining||{};return{primary:J.primary??J["5h"]??15,secondary:J.secondary??J["1w"]??10}}function XW(X,J,$){if(!tP(J))return $+z3(J);let Y=eP(J),G=[];for(let Q of["primary","secondary"]){let z=X?.[Q];if(!z)continue;if(z.remainingPercent>=Y[Q])continue;let Z=z.resetsAt?Date.parse(z.resetsAt):Number.NaN;if(!Number.isFinite(Z)||Z<=$)return $+z3(J);G.push(Z)}if(!G.length)return $+z3(J);return Math.min(...G)+60000}function XO(X){if(!X?.quota?.mainQuota||!X.quota.mainQuotaCheckedAt)return null;return{quota:X.quota.mainQuota,checkedAt:X.quota.mainQuotaCheckedAt,tokenFingerprint:X.quota.mainQuotaToken}}function JO(X){let J=X?.quota?.refreshEveryNRequests;return typeof J==="number"&&Number.isFinite(J)&&J>0?Math.floor(J):0}function x6(X){return aP("sha256").update(X).digest("hex").slice(0,16)}class k8{main=null;mainTokenFp=null;mainQuotaAccountId=null;fallbacks=new Map;fallbackTokenFps=new Map;inflightMain=null;inflightMainFp=null;inflightFallbacks=new Map;mainLastApiError=void 0;fallbackApiErrors=new Map;fallbackErrorTokenFps=new Map;rateLimitedUntilMap=new Map;apiGate=Promise.resolve();lastApiCallAt=0;storage;fetchImpl;now;fetchQuotaFn;onMainQuotaFetched;onApiError;configPath;constructor(X){this.storage=X.storage,this.fetchImpl=X.fetchImpl??fetch,this.configPath=X.configPath,this.now=X.now??Date.now,this.fetchQuotaFn=X.fetchQuotaFn,this.onMainQuotaFetched=X.onMainQuotaFetched,this.onApiError=X.onApiError,this.seedMainFromStorage(X.storage),this.seedMainBackoffFromStorage(X.storage)}getMain(X){if(X&&this.main&&this.mainTokenFp&&this.mainTokenFp!==x6(X))this.main=null,this.mainTokenFp=null;return this.main}getFallback(X,J){let $=this.fallbacks.get(X)??null;if(!J||!$)return $;if(this.fallbackTokenFps.get(X)!==x6(J))return this.fallbacks.delete(X),this.fallbackTokenFps.delete(X),null;return $}getAllFallbacks(){return this.fallbacks}setMain(X,J,$,Y=!1){if(!Y&&!JW(J.quota))return;if(this.mainTokenFp=x6(X),$&&this.mainQuotaAccountId&&this.mainQuotaAccountId!==$)this.clearRateLimited("main");if($)this.mainQuotaAccountId=$;if(this.main=J,hJ(J.quota))this.clearRateLimited("main")}peekMainForPolicy(X){if(X&&this.mainQuotaAccountId&&this.mainQuotaAccountId!==X)return null;return this.main}peekFallbackForPolicy(X,J){let $=this.fallbacks.get(X)??null;if(J&&$?.accountId&&$.accountId!==J)return null;return $}setFallback(X,J,$,Y=!1,G){if(!Y&&!JW(J.quota))return;let Q=this.fallbacks.get(X)?.accountId;if(G&&Q&&G!==Q)this.clearRateLimited(X);let z=G??Q;if(this.fallbacks.set(X,{...J,accountId:z}),$)this.fallbackTokenFps.set(X,x6($));else this.fallbackTokenFps.delete(X);if(hJ(J.quota))this.clearRateLimited(X)}markRateLimited(X,J){let $=this.rateLimitedUntilMap.get(X);if($!==void 0&&$>J)return;this.rateLimitedUntilMap.set(X,J)}isRateLimited(X){let J=this.rateLimitedUntilMap.get(X);return J!==void 0&&this.now()<J}rateLimitedUntil(X){return this.rateLimitedUntilMap.get(X)}clearRateLimited(X){this.rateLimitedUntilMap.delete(X)}async refreshMain(X){let J=x6(X);if(this.mainTokenFp&&this.mainTokenFp!==J)this.main=null,this.mainTokenFp=null;if(this.inflightMain&&this.inflightMainFp===J)return this.inflightMain;if(this.isBackedOff()){if(this.main)return this.main.quota;throw Error("Quota API rate-limited — try again later")}return this.inflightMainFp=J,this.inflightMain=this._fetchMain(X),this.inflightMain}async refreshFallback(X,J){let $=k8.fallbackInflightKey(X,J),Y=this.inflightFallbacks.get($);if(Y)return Y;if(this.isFallbackBackedOff(X,J)){let Q=this.getFallback(X,J);if(Q)return Q.quota;throw Error("Quota API rate-limited — try again later")}let G=this._fetchFallback(X,J);return this.inflightFallbacks.set($,G),G}async refreshAllFallbacks(X){let J=this.now();for(let $ of X){if($.enabled===!1)continue;if(T0($)||!$.access)continue;let Y=this.getFallback($.id,$.access);if(Y&&J<Y.refreshAfter)continue;try{await this.refreshFallback($.id,$.access)}catch{}}}refreshMainInBackground(X){let J=x6(X);if(this.inflightMain&&this.inflightMainFp===J)return;if(this.isBackedOff())return;this.refreshMain(X).catch(()=>{})}isMainStale(){if(!this.main)return!0;return this.now()>=this.main.refreshAfter}isFallbackStale(X,J){let $=this.getFallback(X,J);if(!$)return!0;return this.now()>=$.refreshAfter}shouldRefreshOnRequestCount(X){let J=JO(this.storage);if(J<=0)return!1;return X>0&&X%J===0}needsRefresh(X){return this.isMainStale()||this.shouldRefreshOnRequestCount(X)}updateStorage(X){this.storage=X,this.seedMainFromStorage(X),this.seedMainBackoffFromStorage(X)}seedMainFromStorage(X,J){let $=XO(X);if(!$)return;let Y=J?x6(J):null;if(Y&&$.tokenFingerprint&&$.tokenFingerprint!==Y)return;let G={quota:$.quota,refreshAfter:XW($.quota,X,$.checkedAt),checkedAt:$.checkedAt};if(this.main&&this.main.checkedAt>=G.checkedAt&&(!Y||!this.mainTokenFp||this.mainTokenFp===Y))return;if(this.main=G,this.mainTokenFp=$.tokenFingerprint??null,X?.mainAccountId){if(this.mainQuotaAccountId&&this.mainQuotaAccountId!==X.mainAccountId)this.clearRateLimited("main");this.mainQuotaAccountId=X.mainAccountId}}seedMainBackoffFromStorage(X){let J=X?.quota?.mainLastQuotaApiError;this.mainLastApiError=J&&c1(J,this.now())?J:void 0}seedFallbacksFromAccounts(X){let J=z3(this.storage);for(let $ of X){if($.enabled===!1)continue;if(!$.quota)continue;let Y=Math.max($.quota.primary?.checkedAt??0,$.quota.secondary?.checkedAt??0);if(Y<=0)continue;let G=this.getFallback($.id,$.access);if(G&&G.checkedAt>=Y)continue;this.setFallback($.id,{quota:$.quota,refreshAfter:Y+J,checkedAt:Y},$.access,!1,$.accountId)}}isBackedOff(){return c1(this.mainLastApiError,this.now())}isFallbackBackedOff(X,J){if(J){if(this.fallbackErrorTokenFps.get(X)!==x6(J))return!1}return c1(this.fallbackApiErrors.get(X),this.now())}getLastApiError(){return this.mainLastApiError}static API_CALL_GAP_MS=1000;static fallbackInflightKey(X,J){return JSON.stringify([X,x6(J)])}static quotaLockName(X){return`opencode-fallback-quota-refresh-${X.replace(/[^a-zA-Z0-9._-]+/g,"-")||"account"}`}_enqueueApiFetch(X){let J=async()=>{let Y=this.now()-this.lastApiCallAt;if(Y<k8.API_CALL_GAP_MS)await new Promise((G)=>{let Q=oP(G,k8.API_CALL_GAP_MS-Y);if(typeof Q==="object"&&"unref"in Q)Q.unref()});return this.lastApiCallAt=this.now(),X()},$=this.apiGate.then(J,J);return this.apiGate=$.catch(()=>{}),$}async _fetchMain(X){let J=x6(X);return this._enqueueApiFetch(async()=>{try{if(this.isBackedOff()){if(this.main)return this.main.quota;throw Error("Quota API rate-limited — try again later")}let $=await g0({name:"opencode-main-quota-refresh",ttlMs:30000,path:this.configPath});if(!$){let Y=this.main;if(Y&&this.now()<Y.refreshAfter)return Y.quota;throw Error("Quota refresh is already in progress")}try{let Y=this.now(),G=await this._fetchQuota(X),Q=this.now();if(this.mainTokenFp=x6(X),this.main={quota:G,refreshAfter:XW(G,this.storage,Q),checkedAt:Q},hJ(G))this.clearRateLimited("main");return this.mainLastApiError=void 0,this.onMainQuotaFetched?.(G,Q,this.mainTokenFp,Y),G}catch(Y){throw this._handleMainFetchError(Y),Y}finally{await $.release()}}finally{if(this.inflightMainFp===J)this.inflightMain=null,this.inflightMainFp=null}})}async _fetchFallback(X,J){return this._enqueueApiFetch(async()=>{try{if(this.isFallbackBackedOff(X,J)){let Y=this.getFallback(X,J);if(Y)return Y.quota;throw Error("Quota API rate-limited — try again later")}let $=await g0({name:k8.quotaLockName(X),ttlMs:30000,path:this.configPath});if(!$){let Y=this.getFallback(X,J);if(Y&&this.now()<Y.refreshAfter)return Y.quota;throw Error("Quota refresh is already in progress")}try{let Y=await this._fetchQuota(J),G=this.now();return this.setFallback(X,{quota:Y,refreshAfter:G+z3(this.storage),checkedAt:G},J,!0),this.fallbackApiErrors.delete(X),this.fallbackErrorTokenFps.delete(X),Y}finally{await $.release()}}catch($){throw this._handleFallbackFetchError(X,J,$),$}finally{this.inflightFallbacks.delete(k8.fallbackInflightKey(X,J))}})}async _fetchQuota(X){if(!this.fetchQuotaFn)throw Error("Quota fetch not available — no fetchQuotaFn injected (push-only mode)");return this.fetchQuotaFn({accessToken:X,fetchImpl:this.fetchImpl,now:this.now})}static isAuthError(X){return X?.status===401}_handleMainFetchError(X){if(k8.isAuthError(X))return;this.mainLastApiError=i4({error:X,now:this.now(),previous:this.mainLastApiError}),this.onApiError?.(this.mainLastApiError)}_handleFallbackFetchError(X,J,$){if(k8.isAuthError($))return;let Y=x6(J),G=this.fallbackErrorTokenFps.get(X)===Y?this.fallbackApiErrors.get(X):void 0;this.fallbackApiErrors.set(X,i4({error:$,now:this.now(),previous:G})),this.fallbackErrorTokenFps.set(X,Y)}}function JW(X){return Boolean(X.primary||X.secondary)}function hJ(X){let{primary:J,secondary:$}=X;if(!J&&!$)return!1;if(J&&J.usedPercent>=100)return!1;if($&&$.usedPercent>=100)return!1;return!0}import{readFile as qO}from"node:fs/promises";var Q1=Z0("refresh"),q7=Z0("accounts"),zO=1e4,ZO=15000,fJ=50;function v0(X){return X.type==="oauth"&&X.corrupt!==!0}function WO(X){let J=X?.trim();if(!J)return!1;try{let $=new URL(J);return($.protocol==="http:"||$.protocol==="https:")&&!$.username&&!$.password}catch{return!1}}var t1="floors-v1";function UW(X){return X.costZeroing?.enabled!==!1}class L7 extends Error{code="ACCOUNT_REMOVED_DURING_REFRESH";constructor(X){super(`Fallback account ${X} was removed before refresh`);this.name="AccountRemovedDuringRefreshError"}}var BO=[401,403,429],YW={primary:0,secondary:0},HO=!1,C9={primary:5,secondary:10};function Q0(X){return X!=null&&typeof X==="object"&&!Array.isArray(X)}var VO=new Set(["__proto__","constructor","prototype"]);function x8(X){return X.length>0&&!VO.has(X)}function UO(X){return X instanceof L7||Q0(X)&&X.name==="AccountRemovedDuringRefreshError"&&X.code==="ACCOUNT_REMOVED_DURING_REFRESH"}function N7(X){return{id:typeof X.id==="string"&&X.id.trim()?X.id.trim():GO(),label:typeof X.label==="string"?X.label:void 0,enabled:typeof X.enabled==="boolean"?X.enabled:void 0,addedAt:typeof X.addedAt==="number"?X.addedAt:void 0,lastUsed:typeof X.lastUsed==="number"?X.lastUsed:void 0,accountId:typeof X.accountId==="string"?X.accountId:void 0}}function GW(X){if(!Q0(X))return;if(typeof X.message!=="string")return;let J=Number(X.checkedAt);if(!Number.isFinite(J))return;let $=Number(X.nextRetryAt),Y=Number(X.retryCount);return{message:X.message,checkedAt:J,nextRetryAt:Number.isFinite($)?$:void 0,retryCount:Number.isFinite(Y)?Y:void 0,tokenHash:typeof X.tokenHash==="string"?X.tokenHash:void 0}}function KO(X){if(!Q0(X))return;let J={};for(let G of["primary","secondary"]){let Q=X[G];if(!Q0(Q))continue;let z=Number(Q.usedPercent),Z=Number(Q.remainingPercent),W=Number(Q.checkedAt);if(!Number.isFinite(z)||!Number.isFinite(Z)||!Number.isFinite(W))continue;let B=typeof Q.windowMinutes==="number"?Q.windowMinutes:Number.NaN;J[G]={usedPercent:z,remainingPercent:Z,checkedAt:W,resetsAt:typeof Q.resetsAt==="string"?Q.resetsAt:void 0,...Number.isFinite(B)&&B>0?{windowMinutes:B}:{}}}for(let G of["resetCreditsAvailable","resetCreditsApplicable"]){let Q=typeof X[G]==="number"?X[G]:Number.NaN;if(Number.isFinite(Q)&&Q>=0)J[G]=Q}let $=X.spendControl;if(Q0($)){let G=Number($.limit),Q=Number($.used),z=Number($.remaining),Z=Number($.usedPercent),W=Number($.remainingPercent);if(Number.isFinite(G)&&Number.isFinite(Q)&&Number.isFinite(z)&&Number.isFinite(Z)&&Number.isFinite(W)&&typeof $.reached==="boolean")J.spendControl={limit:G,used:Q,remaining:z,usedPercent:Z,remainingPercent:W,resetsAt:typeof $.resetsAt==="string"?$.resetsAt:void 0,unit:typeof $.unit==="string"?$.unit:void 0,source:typeof $.source==="string"?$.source:void 0,reached:$.reached}}let Y=X.credits;if(Q0(Y)&&typeof Y.hasCredits==="boolean"&&typeof Y.unlimited==="boolean"&&typeof Y.overageLimitReached==="boolean"){let G=Number(Y.balance);J.credits={hasCredits:Y.hasCredits,unlimited:Y.unlimited,overageLimitReached:Y.overageLimitReached,...Number.isFinite(G)?{balance:G}:{}}}return Object.keys(J).length?J:void 0}function jO(X){if(!Q0(X))return null;if(X.type==="api"){let J=typeof X.baseURL==="string"?X.baseURL.trim():"",$=typeof X.apiKey==="string"?X.apiKey.trim():"";if(!WO(J))return null;let Y=X.authHeader==="x-api-key"?"x-api-key":"authorization-bearer";return{...N7(X),type:"api",apiKey:$||void 0,baseURL:J,authHeader:Y}}if(X.type!=="oauth")return null;if(X.corrupt===!0){if(typeof X.id!=="string"||!X.id.trim())return null;return{...N7(X),type:"oauth",corrupt:!0}}if(typeof X.refresh!=="string"||!X.refresh.trim()){if(!Object.hasOwn(X,"refresh")||typeof X.id!=="string"||!X.id.trim())return null;return{...N7(X),type:"oauth",corrupt:!0}}return{...N7(X),type:"oauth",access:typeof X.access==="string"?X.access:void 0,refresh:X.refresh,expires:typeof X.expires==="number"?X.expires:void 0,lastRefreshedAt:typeof X.lastRefreshedAt==="number"?X.lastRefreshedAt:void 0,lastRefreshError:GW(X.lastRefreshError),lastQuotaRefreshError:GW(X.lastQuotaRefreshError),quota:KO(X.quota)}}function NO(X){if(!Q0(X))return;let J=Object.create(null);for(let[$,Y]of Object.entries(X)){if(!x8($)||!Q0(Y))continue;let G={};if(Q0(Y.inFlight))G.inFlight={...Y.inFlight};if(Q0(Y.lastOutcome)&&typeof Y.lastOutcome.code==="string"&&Y.lastOutcome.code.length>0&&typeof Y.lastOutcome.at==="number"&&Number.isFinite(Y.lastOutcome.at))G.lastOutcome={code:Y.lastOutcome.code,at:Y.lastOutcome.at,...Q0(Y.lastOutcome.previousOutcome)&&typeof Y.lastOutcome.previousOutcome.code==="string"&&Y.lastOutcome.previousOutcome.code.length>0&&typeof Y.lastOutcome.previousOutcome.at==="number"&&Number.isFinite(Y.lastOutcome.previousOutcome.at)?{previousOutcome:{code:Y.lastOutcome.previousOutcome.code,at:Y.lastOutcome.previousOutcome.at}}:{}};if(typeof Y.cooldownUntil==="number"&&Number.isFinite(Y.cooldownUntil))G.cooldownUntil=Y.cooldownUntil;if(Object.keys(G).length>0)J[$]=G}return Object.keys(J).length>0?J:void 0}var QW=new Set;function KW(X){if(X.length===0)return;let J=JSON.stringify([...X].sort());if(QW.has(J))return;QW.add(J),q7.warn("account load-dropped, preserved on disk",{droppedIds:X})}function jW(X){if(!Q0(X)||!Array.isArray(X.accounts))return null;let J=X.accounts,$=J.map(jO).filter((Y)=>Y!=null);if($.length<J.length){let Y=new Set;for(let z of J)if(Q0(z)&&typeof z.id==="string"&&z.id.trim())Y.add(z.id.trim());let G=new Set($.map((z)=>z.id)),Q=[];for(let z of Y)if(!G.has(z))Q.push(z);KW(Q)}return{version:1,main:{type:"opencode",provider:"openai"},routing:Q0(X.routing)?X.routing:void 0,fallbackOn:Array.isArray(X.fallbackOn)?X.fallbackOn.filter((Y)=>Number.isInteger(Y)):void 0,refresh:Q0(X.refresh)?X.refresh:void 0,quota:Q0(X.quota)?X.quota:void 0,reset:NO(X.reset),dump:Q0(X.dump)?X.dump:void 0,costZeroing:Q0(X.costZeroing)?X.costZeroing:void 0,killswitch:Q0(X.killswitch)?X.killswitch:void 0,logging:Q0(X.logging)?X.logging:void 0,cachekeep:Q0(X.cachekeep)?X.cachekeep:void 0,cacheKeep:Q0(X.cacheKeep)?X.cacheKeep:void 0,mainAccountId:typeof X.mainAccountId==="string"?X.mainAccountId:void 0,accounts:$}}function NW(X){if(!("claustrum"in X))return X;let{claustrum:J,...$}=X;return $}async function E9(X){try{return{exists:!0,value:JSON.parse(await qO(X,"utf8"))}}catch(J){if(J.code==="ENOENT")return{exists:!1,value:null};throw J}}function S9(X){return Object.fromEntries(Object.entries(X).filter(([,J])=>J!==void 0))}async function dJ(X){let J;try{J=(await E9(X)).value}catch{return null}return iJ(J)}function qW(X,J){if(!Q0(X))return X;let $=Q0(J)?J:{},Y=Q0($.main)?$.main:void 0,G=Q0($.accounts)?$.accounts:{},Q=Q0(X.quota)?X.quota:{},z=Q0(X.refresh)?X.refresh:{},Z=Y??Q,W=Y??z,H=z.mainRefreshLeaseId!==void 0?{id:z.mainRefreshLeaseId,until:z.mainRefreshLeaseUntil,tokenHash:z.mainRefreshLeaseTokenHash}:{id:W.refreshLeaseId,until:W.refreshLeaseUntil,tokenHash:W.refreshLeaseTokenHash},j=Array.isArray(X.accounts)?X.accounts.map((N)=>{if(!Q0(N))return N;let K=typeof N.id==="string"&&Q0(G[N.id])?G[N.id]:{};return{...N,...K}}):void 0;return LW({...X,refresh:S9({...z,mainLastRefreshError:z.mainLastRefreshError??W.lastRefreshError,mainRefreshLeaseId:H.id,mainRefreshLeaseUntil:H.until,mainRefreshLeaseTokenHash:H.tokenHash}),quota:S9({...Q,mainQuota:Z.quota,mainQuotaCheckedAt:Z.quotaCheckedAt,mainQuotaToken:Z.quotaToken,mainLastQuotaApiError:Z.lastQuotaApiError}),accounts:j})}async function b0(X){let J=await E9(X.configPath);if(!J.exists)return null;let $=await E9(X.statePath);return jW(qW(J.value,$.value))}function LW(X){return Object.fromEntries(Object.entries(X).filter(([,J])=>J!==void 0))}function LO(X){return S9({id:X.id,label:X.label,type:X.type,corrupt:X.type==="oauth"&&X.corrupt===!0?!0:void 0,enabled:X.enabled,addedAt:X.addedAt,accountId:X.accountId,baseURL:X.type==="api"?X.baseURL:void 0,authHeader:X.type==="api"?X.authHeader:void 0})}function DW(X){if(X.type==="api")return S9({apiKey:X.apiKey,lastUsed:X.lastUsed});if(X.corrupt)return{};return S9({access:X.access,refresh:X.refresh,expires:X.expires,lastUsed:X.lastUsed,lastRefreshedAt:X.lastRefreshedAt,lastRefreshError:X.lastRefreshError,lastQuotaRefreshError:X.lastQuotaRefreshError,quota:X.quota})}function D7(X){return Math.max(X?.primary?.checkedAt??0,X?.secondary?.checkedAt??0)}function Z3(X,J,$){if($ in J)X[$]=J[$];else delete X[$]}function DO(X,J){return X.access===J.access&&X.refresh===J.refresh&&X.expires===J.expires&&X.lastRefreshedAt===J.lastRefreshedAt}function FO(X,J){if(!DO(X,J))return J;if(!("lastRefreshError"in J))return X;if(!("lastRefreshError"in X))return J;return(J.lastRefreshError?.checkedAt??0)>(X.lastRefreshError?.checkedAt??0)?J:X}var PO=300000;function zW(X,J){if(X===void 0)return 0;return X>J+PO?0:X}function OO(X,J,$){let Y=Date.now(),G=zW(J.lastRefreshedAt,Y),Q=zW($.lastRefreshedAt,Y),z=J.expires??0,Z=$.expires??0,W=Q>G?$:G>Q?J:Z>z?$:z>Z?J:FO(J,$);Z3(X,W,"access"),Z3(X,W,"refresh"),Z3(X,W,"expires"),Z3(X,W,"lastRefreshedAt"),Z3(X,W,"lastRefreshError")}function MO(X,J){if(!Q0(X))return J;let $=X,Y=D7($.quota),G=D7(J.quota),Q=Y>G,z=Q?{...$,...J,quota:$.quota,lastQuotaRefreshError:$.lastQuotaRefreshError}:{...$,...J};if(!Q&&!("lastQuotaRefreshError"in J))delete z.lastQuotaRefreshError;if(!("lastRefreshError"in J))delete z.lastRefreshError;if(typeof $.lastUsed==="number"&&(typeof J.lastUsed!=="number"||$.lastUsed>J.lastUsed))z.lastUsed=$.lastUsed;return OO(z,$,J),z}function FW(X){let J=X.refresh?S9({enabled:X.refresh.enabled,refreshBeforeExpiryMinutes:X.refresh.refreshBeforeExpiryMinutes}):void 0,$=X.quota?S9({enabled:X.quota.enabled,checkIntervalMinutes:X.quota.checkIntervalMinutes,refreshEveryNRequests:X.quota.refreshEveryNRequests,minimumRemaining:X.quota.minimumRemaining,failClosedOnUnknownQuota:X.quota.failClosedOnUnknownQuota}):void 0;return LW({version:1,main:X.main,routing:X.routing,fallbackOn:X.fallbackOn,refresh:J,quota:$,reset:X.reset,dump:X.dump,costZeroing:X.costZeroing,killswitch:X.killswitch,logging:X.logging,cachekeep:X.cachekeep,cacheKeep:X.cacheKeep,mainAccountId:X.mainAccountId,accounts:X.accounts.map(LO)})}async function B3(X,J=!1){let $=Date.now(),Y=$+ZO,G=0;while(Date.now()<=Y){G++;let Z=await g0({name:"save",ttlMs:zO,path:X,renew:J});if(Z)return Z;let W=Y-Date.now();if(W<=0)break;await QO(Math.min(fJ+_W(fJ),W))}let Q=Date.now()-$,z=Math.round(Q/Math.max(1,G));throw Error(`Timed out after ${Q}ms waiting for the account store lock on ${X} (${G} attempts, ~${z}ms apart; retry interval is ${fJ}ms). A gap near the retry interval means lock contention; a much larger one means this process's event loop was saturated and the wait expired without getting scheduled.`)}function PW(X){let J=Object.fromEntries(X.accounts.map(($)=>[$.id,DW($)]));return{version:1,main:S9({quota:X.quota?.mainQuota,quotaCheckedAt:X.quota?.mainQuotaCheckedAt,quotaToken:X.quota?.mainQuotaToken,lastQuotaApiError:X.quota?.mainLastQuotaApiError,lastRefreshError:X.refresh?.mainLastRefreshError,refreshLeaseId:X.refresh?.mainRefreshLeaseId,refreshLeaseUntil:X.refresh?.mainRefreshLeaseUntil,refreshLeaseTokenHash:X.refresh?.mainRefreshLeaseTokenHash}),accounts:J}}function iJ(X){if(!Q0(X)||!Array.isArray(X.accounts))return null;let J=new Set;for(let $ of X.accounts){if(!Q0($))continue;if(typeof $.id!=="string")continue;let Y=$.id.trim();if(!Y)continue;J.add(Y)}return J}function _O(X,J,$,Y){if(!Q0(X)||!Array.isArray(X.accounts))return{preservedRawEntries:[],preservedIds:[]};let G=[],Q=[];for(let z of J){if($.has(z))continue;if(Y.has(z))continue;let Z=X.accounts.find((W)=>Q0(W)&&typeof W.id==="string"&&W.id.trim()===z);if(!Z)continue;G.push(Z),Q.push(z)}return{preservedRawEntries:G,preservedIds:Q}}function AO(X){if(!Array.isArray(X))return[];let J=[];for(let $ of X){if(!Q0($))continue;if(typeof $.id!=="string")continue;J.push($.id)}return J}function TO(X,J,$){let Y=iJ(X);if(Y===null)return[];let{preservedRawEntries:G,preservedIds:Q}=_O(X,Y,J,$);return KW(Q),G}async function F7(X,J,$={}){let{configPath:Y,statePath:G}=J,Q=await B3(Y);try{let z=await B3(G);try{let Z=await E9(Y),W=await E9(G),B=(Z.exists?jW(qW(Z.value,W.value)):null)??RO(),H=new Set(B.accounts.map((L)=>L.id)),U=iJ(Z.value)??new Set,j=X(B,{rawRosterIds:[...U],loadedRosterIds:[...H]})??B,N=new Set($.allowDrop??[]),K=TO(Z.value,H,N),q=FW(j),F=new Set((Array.isArray(q.accounts)?q.accounts:[]).map((L)=>Q0(L)&&typeof L.id==="string"?L.id.trim():"").filter(Boolean)),O=K.filter((L)=>{if(!Q0(L))return!1;if(typeof L.id!=="string")return!1;return!F.has(L.id.trim())}),_=Q0(Z.value)?Z.value:{},C={...NW(_),...q,accounts:[...Array.isArray(q.accounts)?q.accounts:[],...O]};if($.canWrite&&!$.canWrite())return B;if(await M6(Y,C),$.canWrite&&!$.canWrite())return B;return await M6(G,PW(j)),q7.debug("account config written",{accountCount:C.accounts.length,accountIds:AO(C.accounts)}),j}finally{await z.release()}}finally{await Q.release()}}function RO(){return{version:1,main:{type:"opencode",provider:"openai"},accounts:[]}}function CO(X,J){X.main=X.main??{};let $=typeof X.main.quotaCheckedAt==="number"?X.main.quotaCheckedAt:D7(X.main.quota),Y=typeof J.quota?.mainQuotaCheckedAt==="number"?J.quota.mainQuotaCheckedAt:D7(J.quota?.mainQuota);if($>Y)return;X.main.quota=J.quota?.mainQuota,X.main.quotaCheckedAt=J.quota?.mainQuotaCheckedAt,X.main.quotaToken=J.quota?.mainQuotaToken,X.main.lastQuotaApiError=J.quota?.mainLastQuotaApiError}function EO(X,J){X.main=X.main??{},X.main.lastRefreshError=J.refresh?.mainLastRefreshError,X.main.refreshLeaseId=J.refresh?.mainRefreshLeaseId,X.main.refreshLeaseUntil=J.refresh?.mainRefreshLeaseUntil,X.main.refreshLeaseTokenHash=J.refresh?.mainRefreshLeaseTokenHash}function mJ(X){if(Array.isArray(X))return X.map(mJ);if(!Q0(X))return X;return Object.fromEntries(Object.entries(X).filter(([,J])=>J!==void 0).map(([J,$])=>[J,mJ($)]))}async function nJ(X,J,$={mainQuota:!0,mainRefresh:!0,accounts:!0},Y){let G=J.statePath,Q=await B3(G);try{let z=(await E9(G)).value,Z=Q0(z)?{...z,version:1}:{version:1};if($.mainQuota)CO(Z,X);if($.mainRefresh)EO(Z,X);if($.accounts){let W=$.accounts===!0?null:new Set($.accounts),B=await dJ(J.configPath);Z.accounts={...Q0(Z.accounts)?Z.accounts:{}};for(let H of X.accounts){if(W&&!W.has(H.id))continue;if(B&&!B.has(H.id))continue;Z.accounts[H.id]=MO(Z.accounts[H.id],DW(H))}if(W){for(let H of W)if(!X.accounts.some((U)=>U.id===H))delete Z.accounts[H]}if(B){for(let H of Object.keys(Z.accounts))if(!B.has(H))delete Z.accounts[H]}}if(Y&&!Y())return;await M6(G,mJ(Z))}finally{await Q.release()}}function sJ(X){return X?.fallbackOn?.length?X.fallbackOn:BO}function V3(X,J){return sJ(J).includes(X)}function SO(X){let J=X?.quota?.minimumRemaining||{};return{primary:J.primary??J["5h"]??YW.primary,secondary:J.secondary??J["1w"]??YW.secondary}}function uJ(X){return X?.quota?.enabled!==!1}function H3(X){return X?.quota?.failClosedOnUnknownQuota??HO}function U3(X,J,$=Date.now()){if(!uJ(J))return!0;if(!X)return!H3(J);let Y=SO(J),G=H3(J);for(let Q of["primary","secondary"]){let z=X[Q];if(!z)continue;if(j7(z,$)){if(G)return!1;continue}if(z.remainingPercent<Y[Q])return!1}return!0}function z9(X){return X?.killswitch?.enabled===!0}function ZW(X){return{primary:X?.primary??X?.["5h"]??C9.primary,secondary:X?.secondary??X?.["1w"]??C9.secondary}}function P7(X){return X?.cacheKeep??X?.cachekeep}function WW(X){return typeof X==="number"&&Number.isFinite(X)?X:0}function a6(X,J){if(!X?.killswitch)return C9;if(X.killswitch.schema===t1){let{accounts:$,defaults:Y}=X.killswitch,G=J??"main",Q=Q0($)&&Object.hasOwn($,G)&&Q0($[G])?$[G]:Q0(Y)?Y:void 0;return{primary:WW(Q?.primary),secondary:WW(Q?.secondary)}}if(J&&X.killswitch.accounts?.[J])return ZW(X.killswitch.accounts[J]);return ZW(X.killswitch.main)}function Z1(X,J,$,Y=Date.now()){if(!z9(J))return!0;if(!X)return!H3(J);let G=a6(J,$),Q=H3(J);for(let z of["primary","secondary"]){let Z=X[z];if(!Z)continue;if(j7(Z,Y)){if(Q)return!1;continue}if(Z.remainingPercent<G[z])return!1}return!0}function OW(X,J,$,Y){if(!z9(Y))return 300;let G=[],Q=[{accountId:void 0,quota:X},...J];for(let{accountId:Z,quota:W}of Q){if(!W)continue;let B=a6(Y,Z),H=[],U=!1;for(let j of["primary","secondary"]){let N=W[j];if(!N||j7(N,$))continue;if(N.remainingPercent>=B[j])continue;let K=N.resetsAt?Date.parse(N.resetsAt):NaN;if(!Number.isFinite(K)||K<=$){U=!0;break}H.push(K)}if(U||H.length===0)continue;G.push(Math.max(...H))}if(G.length===0)return 300;let z=Math.min(...G);return Math.max(1,Math.ceil((z-$)/1000))}function BW(X){return typeof X.version==="number"&&Array.isArray(X.accounts)}async function MW(X,J){let{configPath:$,statePath:Y}=J;if(!X)return;try{let Q=await E9($);if(Q.exists&&Q0(Q.value)&&BW(Q.value))return}catch{}let G=await B3($);try{let Q=await B3(Y);try{let z=await E9($);if(z.exists&&Q0(z.value)){if(BW(z.value))return}if(!X)return;let Z={version:1,main:{type:"opencode",provider:"openai"},accounts:[]};if(X.access){let H=Z8({id_token:"",access_token:X.access,refresh_token:X.refresh});if(H)Z.mainAccountId=H}let W=z.exists&&Q0(z.value)?z.value:{},B={...NW(W),...FW(Z)};await M6($,B),await M6(Y,PW(Z))}finally{await Q.release()}}finally{await G.release()}}function IO(X){return X?.refresh?.enabled!==!1}function aJ(X){return(X?.refresh?.refreshBeforeExpiryMinutes??240)*60000}function _W(X){return Math.floor(Math.random()*(X+1))}function z1(X,J,$){return!X.access||!X.expires||X.expires-$<=aJ(J)}function bO(X,J){return Boolean(X.access&&typeof X.expires==="number"&&X.expires>J)}function Q9(X,J){return Boolean(X?.mainAccountId&&J.accountId&&J.accountId===X.mainAccountId)}class AW extends Error{constructor(X){super(`Refusing to refresh account ${X}: it holds the main account's credential while the main slot is live`);this.name="ShieldedMainRowRefreshError"}}var TW="common-auth-placeholder:v1:openai",U8="main";function C6(X){return Q0(X)&&X.type==="oauth"&&(X.refresh===TW||X.refresh===tZ)}function Z9(X){return X?.accounts.find((J)=>J.id===U8&&J.enabled!==!1&&v0(J))}function oJ(X){if(!X)return X;return{...X,accounts:X.accounts.filter((J)=>J.id!==U8)}}function w6(X,J){let $=X.accounts.findIndex((Y)=>Y.id===J.id);if($!==-1)X.accounts[$]=J}function W3(X){return X instanceof Error?X.message:String(X)}function pJ(X,J,$){if(J instanceof G1)return;X.lastRefreshError=p1({error:J,now:$,refreshToken:X.refresh,previous:X.lastRefreshError})}function gJ(X,J,$){if(J instanceof G1)return;if(X.lastQuotaRefreshError=i4({error:J,now:$,previous:X.lastQuotaRefreshError}),J?.isRefreshError===!0)pJ(X,J,$)}function HW(X,J){if(!X)return!1;if(!X.resetsAt)return!0;let $=Date.parse(X.resetsAt);return Number.isFinite($)?$>J:!0}function kO(X,J){if(!X)return!1;return HW(X.primary,J)||HW(X.secondary,J)}function xO(X,J,$){if(!X)return!1;let Y=J?.quota?.checkIntervalMinutes??5,G=Math.max(1,Y)*60000,Q=Math.max(X.primary?.checkedAt??0,X.secondary?.checkedAt??0);return $-Q<G}function VW(X,J,$){return!xO(X.quota,J,$)}function wO(X,J,$,Y){return x5($)&&U3(X.quota,J,Y)&&kO(X.quota,Y)}function vO(X){let J=X?.quota?.checkIntervalMinutes??5;return Math.max(1,J)*60000}var yO=60000,hO=60000,rJ=600000;function tJ(X){return`fallback-oauth-refresh-${YO("sha256").update(X).digest("base64url").slice(0,16)}`}var fO=1e4,gO=100;class eJ{now;fetchImpl;paths;refreshPromises=new Map;refreshTimer=null;quotaTimer=null;quotaManager;onFallbackStorageChanged;options;constructor(X){this.options=X,this.now=X.now??Date.now,this.fetchImpl=X.fetchImpl??fetch,this.paths=X.paths,this.quotaManager=X.quotaManager??null,this.onFallbackStorageChanged=X.onFallbackStorageChanged}assertNotTombstoned(X){if(X)K7(X.refresh)}seedFallbackQuota(X,J){if(!this.quotaManager)return;if(!X.quota)return;let $=Math.max(X.quota.primary?.checkedAt??0,X.quota.secondary?.checkedAt??0);if($<=0)return;let Y=this.quotaManager.getFallback(X.id,X.access);if(Y&&Y.checkedAt>=$)return;this.quotaManager.setFallback(X.id,{quota:X.quota,refreshAfter:$+vO(J),checkedAt:$},X.access,!1,X.accountId)}async load(){return b0(this.paths)}selectionBookkeeping=Promise.resolve();selectionBookkeepingSettled(){return this.selectionBookkeeping}async save(X,J){await nJ(X,this.paths,{accounts:J??!0},this.options.canWrite)}startBackgroundRefresh(){let X=async()=>{if(await this.options.backgroundRefreshPaused?.())return;if(await this.refreshDueAccounts(),this.options.fetchQuotaFn)await this.refreshQuotaForDueAccounts()};if(X().catch(()=>{}),!this.refreshTimer){if(this.refreshTimer=setInterval(()=>{X().catch(()=>{})},yO+_W(hO)),"unref"in this.refreshTimer)this.refreshTimer.unref()}}stopBackgroundRefresh(){if(this.refreshTimer)clearInterval(this.refreshTimer);if(this.quotaTimer)clearInterval(this.quotaTimer);this.refreshTimer=null,this.quotaTimer=null}async getUsableFallbackAccounts(X){let J=X!==void 0?X:await this.load();if(!J)return[];let $=[],Y=!1;for(let G of J.accounts){if(G.enabled===!1||!v0(G))continue;if(Q9(J,G))continue;if(T0(G))continue;let Q=!1,z=G;try{if(z1(z,J,this.now())){let Z=z.lastRefreshError;if(Z&&r0(Z,z.refresh,this.now()))throw Q=!0,Error(X9(Z,this.now()));try{z=await this.refreshAccount(z,J),Y=!0}catch(W){if(UO(W))continue;Q=!0;let B=J.accounts.find((H)=>H.id===G.id&&v0(H));if(B&&!r0(B.lastRefreshError,B.refresh,this.now()))pJ(B,W,this.now()),w6(J,B),Y=!0;throw W}}if(this.seedFallbackQuota(z,J),this.accountPassesQuotaPolicy(this.quotaPolicyAccount(z),J))$.push(z)}catch(Z){let W=bO(z,this.now());if(Q){if(!W)continue}else if(!W)continue;if(wO(z,J,Z,this.now()))Q1.debug("fallback quota using cached quota after refresh error",{pid:process.pid,accountId:z.id,error:W3(Z)}),$.push(z);else if(!H3(J))$.push(z)}}if(Y){let G=structuredClone(J);this.selectionBookkeeping=this.selectionBookkeeping.then(()=>this.save(G)).catch((Q)=>{q7.warn("fallback selection bookkeeping not persisted",{pid:process.pid,error:W3(Q)})})}return $}async markUsed(X){try{let J=await this.load();if(!J)return;let $=J.accounts.find((Y)=>Y.id===X.id);if(!$)return;$.lastUsed=this.now(),await this.save(J,[$.id])}catch(J){q7.warn("lastUsed stamp not persisted",{pid:process.pid,accountId:X.id,error:W3(J)})}}accountPassesQuotaPolicy(X,J){return U3(X.quota,J,this.now())}quotaPolicyAccount(X){if(!this.quotaManager)return X;let J=this.quotaManager.getFallback(X.id,X.access)?.quota;return J?{...X,quota:J}:X}async refreshDueAccounts(){let X=await this.load();if(!X||!IO(X))return;let J=!1;for(let $ of X.accounts){if($.enabled===!1||!v0($))continue;if(Q9(X,$))continue;if(T0($))continue;if(!z1($,X,this.now()))continue;if(r0($.lastRefreshError,$.refresh,this.now()))continue;try{Q1.debug("fallback oauth background due",{pid:process.pid,accountId:$.id,expiresInMs:$.expires?$.expires-this.now():void 0}),await this.refreshAccount($,X),J=!0}catch(Y){Q1.warn("fallback oauth background failed",{pid:process.pid,accountId:$.id,error:W3(Y)}),pJ($,Y,this.now()),w6(X,$),J=!0}}if(J)await this.save(X)}async refreshQuotaForDueAccounts(){let X=await this.load();if(!X||!uJ(X))return;if(!this.options.fetchQuotaFn)return;let J=!1;for(let $ of X.accounts){if($.enabled===!1||!v0($))continue;if(Q9(X,$))continue;if(T0($))continue;let Y=$;try{if(z1(Y,X,this.now())){if(r0(Y.lastRefreshError,Y.refresh,this.now()))continue;Y=await this.refreshAccount(Y,X),J=!0}if(c1(Y.lastQuotaRefreshError,this.now()))continue;if(this.seedFallbackQuota(Y,X),!(this.quotaManager?this.quotaManager.isFallbackStale(Y.id,Y.access):VW(Y,X,this.now())))continue;await this.refreshAccountQuota(Y,X),J=!0}catch(G){gJ($,G,this.now()),w6(X,$),J=!0}}if(J)await this.save(X),this.onFallbackStorageChanged?.()}async refreshQuotaForAllAccounts(X={}){let J=await this.load(),$=[];if(!J||!uJ(J))return{storage:J,errors:$};if(!this.options.fetchQuotaFn)return{storage:J,errors:$};let Y=X.force??!1,G=!1;for(let Q of J.accounts){if(Q.enabled===!1||!v0(Q))continue;if(Q9(J,Q))continue;if(T0(Q))continue;let z=Q;try{if(z1(z,J,this.now())){let Z=z.lastRefreshError;if(Z&&r0(Z,z.refresh,this.now()))throw Error(X9(Z,this.now()));z=await this.refreshAccount(z,J),G=!0}if(!Y&&!VW(z,J,this.now())){if(z.lastQuotaRefreshError)z.lastQuotaRefreshError=void 0,w6(J,z),G=!0;continue}await this.refreshAccountQuota(z,J),G=!0}catch(Z){gJ(Q,Z,this.now()),w6(J,Q),G=!0,$.push({accountId:Q.id,message:W3(Z)})}}if(G)await this.save(J);return{storage:J,errors:$}}async refreshAccount(X,J,$={}){let Y=this.refreshPromises.get(X.id);if(Y){let z=await Y;return w6(J,z),z}let G=this.refreshAccountNow(X,J,$).finally(()=>{this.refreshPromises.delete(X.id)});this.refreshPromises.set(X.id,G);let Q=await G;return w6(J,Q),Q}async waitForConcurrentFallbackRefresh(X,J,$,Y){let G=Date.now()+fO;while(Date.now()<G){await new Promise((B)=>setTimeout(B,gO));let Q=await this.load(),z=Q?.accounts.find((B)=>B.id===X.id&&v0(B));if(!z)continue;if(this.assertNotTombstoned(z),(z.access!==$.access||z.refresh!==$.refresh||(z.expires??0)>($.expires??0)+60000)&&(Y.force||!z1(z,Q,this.now())))return w6(J,z),Q1.debug("fallback oauth joined concurrent refresh",{pid:process.pid,accountId:z.id,expiresInMs:z.expires?z.expires-this.now():void 0}),z;let W=z.lastRefreshError;if(W&&r0(W,z.refresh,this.now()))throw w6(J,z),Error(X9(W,this.now()))}return null}assertNotShieldedMainRow(X,J,$){if($.asPoolMain||!J)return;if(Q9(X,J))throw new AW(J.id)}async refreshAccountNow(X,J,$){let Y=await this.load(),G=Y?.accounts.find((Z)=>Z.id===X.id&&v0(Z));if(this.assertNotTombstoned(G),this.assertNotShieldedMainRow(Y,G,$),G&&!$.force&&!z1(G,Y,this.now()))return w6(J,G),G;let Q=G??X,z=await g0({name:tJ(Q.id),ttlMs:rJ,path:this.paths.configPath,now:this.now,renew:!0});if(!z){Q1.debug("fallback oauth refresh skipped file lock",{pid:process.pid,accountId:Q.id});let Z=await this.waitForConcurrentFallbackRefresh(X,J,Q,$);if(Z)return Z;throw Error("Fallback OAuth refresh is already in progress")}try{if(Y=await this.load(),G=Y?.accounts.find((H)=>H.id===X.id&&v0(H)),this.assertNotTombstoned(G),this.assertNotShieldedMainRow(Y,G,$),G&&!$.force&&!z1(G,Y,this.now()))return w6(J,G),G;if(!G)throw new L7(X.id);Q=G;let Z=this.options.refreshFn??(async()=>{throw Error("No refreshFn injected into FallbackAccountManager")});Q1.debug("fallback oauth refresh request start",{pid:process.pid,accountId:Q.id,force:$.force===!0,expiresInMs:Q.expires?Q.expires-this.now():void 0});let W=await Z({refreshToken:Q.refresh,fetchImpl:this.fetchImpl,now:this.now});if(Q.access=W.access,Q.refresh=W.refresh,Q.expires=W.expires,Q.lastRefreshedAt=W.expires-W.expiresIn*1000,Q.lastRefreshError=void 0,w6(J,Q),await this.save(J),!(await this.load())?.accounts.some((H)=>H.id===X.id))throw new L7(X.id);return Q1.debug("fallback oauth refresh succeeded",{pid:process.pid,accountId:Q.id,expiresInMs:Q.expires?Q.expires-this.now():void 0}),Q}finally{await z.release()}}async refreshAccountQuota(X,J){let $=X;if(this.assertNotTombstoned($),!$.access)throw Error(`Fallback account ${X.id} has no access token`);if(!this.options.fetchQuotaFn)throw Error("No fetchQuotaFn injected — wham/usage supplement is disabled");let Y=this.options.fetchQuotaFn??(async()=>{throw Error("No fetchQuotaFn injected — wham/usage supplement is disabled")}),G=(Q)=>this.quotaManager?this.quotaManager.refreshFallback($.id,Q):Y({accessToken:Q,fetchImpl:this.fetchImpl,now:this.now});try{if(!$.access)throw Error(`Fallback account ${X.id} has no access token`);let Q=await G($.access);$.quota=Q,$.lastQuotaRefreshError=void 0,w6(J,$),await this.save(J)}catch(Q){throw gJ(X,Q,this.now()),w6(J,X),Q}}}var X$="/backend-api/wham/rate-limit-reset-credits",mO=`https://chatgpt.com${X$}`,bW=`${X$}/consume`,uO=`https://chatgpt.com${bW}`,pO=300000,cO=60000,lO=15000,dO=60000;function e1(X){return{configPath:X.configPath,statePath:X.statePath}}class o6 extends Error{kind;cooldownUntil;constructor(X,J,$){super(J);this.name="ResetRedemptionError",this.kind=X,this.cooldownUntil=$}}class W1 extends Error{kind;status;constructor(X,J,$){super(J);this.name="ResetCreditError",this.kind=X,this.status=$}}function kW(X,J,$){return{authorization:`Bearer ${X}`,...$?{"chatgpt-account-id":$}:{},"oai-client-platform":"web","oai-client-version":"0","x-openai-target-path":J}}function M7(X){return typeof X==="object"&&X!==null&&!Array.isArray(X)}function xW(X){if(!X)return;return{...X.inFlight?{inFlight:{...X.inFlight}}:{},...X.lastOutcome?{lastOutcome:{...X.lastOutcome}}:{},...X.cooldownUntil!==void 0?{cooldownUntil:X.cooldownUntil}:{}}}function _7(X){if(!M7(X)||typeof X.redeemRequestId!=="string"||X.redeemRequestId.length===0||typeof X.creditId!=="string"||X.creditId.length===0||typeof X.startedAt!=="number"||!Number.isFinite(X.startedAt)||X.chatgptAccountId!==void 0&&(typeof X.chatgptAccountId!=="string"||X.chatgptAccountId.length===0))return;return{redeemRequestId:X.redeemRequestId,creditId:X.creditId,startedAt:X.startedAt,...typeof X.chatgptAccountId==="string"?{chatgptAccountId:X.chatgptAccountId}:{},...wW(X.rejectedStatus)?{rejectedStatus:X.rejectedStatus}:{},...typeof X.unknownAnswers==="number"&&Number.isSafeInteger(X.unknownAnswers)&&X.unknownAnswers>0?{unknownAnswers:X.unknownAnswers}:{}}}function wW(X){return typeof X==="number"&&X>=400&&X<500&&X!==408&&X!==409&&X!==425&&X!==429}function O7(X){return X.kind==="http_error"&&wW(X.status)}function vW(X,J){return X.chatgptAccountId!==void 0&&X.chatgptAccountId!==J||X.rejectedStatus!==void 0}function iO(X,J){if(X.chatgptAccountId!==void 0&&X.chatgptAccountId!==J)throw new o6("pair_identity_mismatch","the saved reset redemption was started under a different ChatGPT account")}function yW(X){return Boolean(X&&Object.hasOwn(X,"inFlight"))}function hW(X,J){return J-X.startedAt<pO}function X4(X,J){if(!x8(J))return;return X.reset?.[J]}function fW(X){if(!X.reset)X.reset=Object.create(null);return X.reset}function gW(X,J,$){if(!x8(J))return;let Y=fW(X),G=Y[J]??{},Q=G.lastOutcome;delete G.inFlight,G.lastOutcome={code:"ambiguous_local",at:$,...Q?{previousOutcome:{code:Q.code,at:Q.at}}:{}},Y[J]=G}function mW(X,J){let $=xW(X),Y=_7(X?.inFlight);if(yW(X)&&!Y)return{kind:"corrupt",beforeState:$};if(X?.cooldownUntil!==void 0&&X.cooldownUntil>J)return{kind:"cooldown",beforeState:$,cooldownUntil:X.cooldownUntil};if(Y&&hW(Y,J))return{kind:"claim",beforeState:$,claim:{inFlight:Y,selectedCredit:{id:Y.creditId}}};if(Y)return{kind:"expired_unreconciled",beforeState:$,claim:{inFlight:Y,selectedCredit:{id:Y.creditId}}};return{kind:"fresh",beforeState:$}}async function nO(X,J){if(!x8(J))return{kind:"fresh",beforeState:void 0};let $=await X.loadAccountsFn(e1(X));return mW($?X4($,J):void 0,X.now())}async function sO(X,J){let $;if(await X.mutateAccountsFn((Y)=>{let G=X.now(),Q=X4(Y,J);if($=mW(Q,G),$.kind==="corrupt")gW(Y,J,G);return Y},e1(X)),!$)throw Error("corrupt reset state mutation did not run");return $}async function aO(X,J,$,Y){if(!x8(J))return{kind:"fresh",beforeState:void 0};let G;if(await X.mutateAccountsFn((Q)=>{let z=X.now(),Z=X4(Q,J),W=xW(Z),B=_7(Z?.inFlight);if(yW(Z)&&!B)return gW(Q,J,z),G={kind:"corrupt",beforeState:W},Q;if(Z?.cooldownUntil!==void 0&&Z.cooldownUntil>z)return G={kind:"cooldown",beforeState:W,cooldownUntil:Z.cooldownUntil},Q;if(B&&hW(B,z))return G={kind:"claim",beforeState:W,claim:{inFlight:B,selectedCredit:{id:B.creditId}}},Q;if(B&&!vW(B,Y))return G={kind:"expired_unreconciled",beforeState:W,claim:{inFlight:B,selectedCredit:{id:B.creditId}}},Q;let H=A7($);if(!H)return G={kind:"fresh",beforeState:W},Q;let U={redeemRequestId:X.randomUUID(),creditId:H.id,startedAt:z,...Y===void 0?{}:{chatgptAccountId:Y}},j=fW(Q);return j[J]={...Z,inFlight:U},G={kind:"claim",beforeState:W,claim:{inFlight:U,selectedCredit:H}},Q},e1(X)),!G)throw Error("reset claim mutation did not run");return G}async function oO(X,J,$,Y,G){if(!x8(J))return;if(!Y$(Y.kind))return rO(X,J,$,Y,G);await X.mutateAccountsFn((Q)=>{let z=X4(Q,J),Z=_7(z?.inFlight);if(!z||!Z||Z.redeemRequestId!==$.redeemRequestId||Z.creditId!==$.creditId)return Q;let W=X.now();if(delete z.inFlight,z.lastOutcome={code:Y.kind,at:W},Y.kind==="reset"||Y.kind==="already_redeemed")z.cooldownUntil=W+dO;else delete z.cooldownUntil;return Q},e1(X));return}function RW(X,J){let $=_7(X?.inFlight);return $&&$.redeemRequestId===J.redeemRequestId&&$.creditId===J.creditId?$:void 0}async function rO(X,J,$,Y,G){let Q=O7(Y)?Y.status:void 0;if(!($.chatgptAccountId===void 0&&G!==void 0)&&Q!==void 0&&Q===$.rejectedStatus){let W=await X.loadAccountsFn(e1(X));return RW(W?X4(W,J):void 0,$)}let Z;return await X.mutateAccountsFn((W)=>{Z=void 0;let B=X4(W,J),H=RW(B,$);if(!B||!H)return W;let U={...H};if(U.chatgptAccountId===void 0&&G!==void 0)U.chatgptAccountId=G;if(Q===void 0)delete U.rejectedStatus,U.unknownAnswers=(H.unknownAnswers??0)+1;else if((H.unknownAnswers??0)===($.unknownAnswers??0))U.rejectedStatus=Q;return B.inFlight=U,Z=U,W},e1(X)),Z}function K3(X,J){if(!X||X.usedPercent<100)return!1;if(!X.resetsAt)return!0;let $=Date.parse(X.resetsAt);return!Number.isFinite($)||$>J}function J$(X,J,$){if(!(J||K3(X.primary,$)||K3(X.secondary,$)))return{ok:!1,reason:"not exhausted"};return{ok:!0}}function CW(X,J){let $=X[J];if($===void 0||$===null)return;return typeof $==="string"?$:null}function tO(X){if(!M7(X))return;let J=CW(X,"granted_at"),$=CW(X,"reset_type");if(typeof X.id!=="string"||typeof X.status!=="string"||typeof X.expires_at!=="string"||Number.isNaN(Date.parse(X.expires_at))||typeof X.is_supported_by_plan!=="boolean"||J===null||$===null)return;return{id:X.id,status:X.status,...J===void 0?{}:{grantedAt:J},expiresAt:X.expires_at,...$===void 0?{}:{resetType:$},isSupportedByPlan:X.is_supported_by_plan}}async function $$(X,J,$){let Y;try{Y=await X(mO,{method:"GET",headers:kW(J,X$,$),signal:AbortSignal.timeout(lO)})}catch{throw new W1("http_error","reset credit list request failed")}if(!Y.ok)throw new W1("http_error",`reset credit list request failed: ${Y.status}`,Y.status);let G;try{G=await Y.json()}catch{throw new W1("invalid_response","reset credit list response was not valid JSON",Y.status)}if(!M7(G))throw new W1("invalid_response","reset credit list response was not an object",Y.status);return{credits:(Array.isArray(G.credits)?G.credits:[]).flatMap((z)=>{let Z=tO(z);return Z===void 0?[]:[Z]}),availableCount:typeof G.available_count==="number"&&Number.isFinite(G.available_count)?G.available_count:void 0}}function A7(X){return[...X].filter(uW).sort((J,$)=>Date.parse(J.expiresAt)-Date.parse($.expiresAt))[0]}function uW(X){return X.status==="available"&&X.isSupportedByPlan&&X.resetType==="codex_rate_limits"}function pW(X){return X.filter(uW).length}function Y$(X){return X==="reset"||X==="already_redeemed"||X==="nothing_to_reset"||X==="no_credit"}async function eO(X,J,$,Y,G){let Q;try{Q=await X(uO,{method:"POST",headers:{...kW(J,bW,$),"content-type":"application/json"},body:JSON.stringify({redeem_request_id:G,credit_id:Y}),signal:AbortSignal.timeout(cO)})}catch(B){return{kind:"ambiguous",raw:B}}let z;try{z=await Q.text()}catch(B){return Q.ok?{kind:"ambiguous",raw:B}:{kind:"http_error",raw:B,status:Q.status}}let Z=z,W=!1;try{Z=JSON.parse(z),W=!0}catch{}if(!Q.ok)return{kind:"http_error",raw:Z,status:Q.status};if(!W||!M7(Z)||!Y$(Z.code))return{kind:"ambiguous",raw:Z};return{kind:Z.code,raw:Z}}function EW(X){if(X.kind==="cooldown")throw new o6("cooldown_active","reset credit redemption is cooling down",X.cooldownUntil);throw Error(`unexpected reset state decision: ${X.kind}`)}function SW(){throw new o6("expired_unreconciled","the previous reset attempt outcome is unknown")}function IW(X,J){return{target:X,selectedCredit:void 0,beforeState:J,outcome:{kind:"ambiguous_local",raw:{reason:"corrupt_in_flight"}},retrySafety:"No request was sent because the saved redemption identity was incomplete."}}function XM(X){if(X.kind==="reset"||X.kind==="already_redeemed")return"The server returned a terminal result; cooldown blocks an immediate new redemption.";if(X.kind==="nothing_to_reset"||X.kind==="no_credit")return"The server returned a terminal no-op. No cooldown was set; a new attempt starts fresh and remains gated by fresh preconditions.";if(O7(X))return"The server refused the request. A retry within five minutes reuses the same request and credit identifiers; after that, a new attempt starts fresh and remains gated by fresh preconditions.";return"The outcome is uncertain. A retry within five minutes reuses the same request and credit identifiers; this does not prove the server did nothing."}function JM(X,J){if(X)return"The server refused the request, but recording the refusal failed, so the saved redemption may still be treated as unknown and block a new attempt. A retry reuses the same request and credit identifiers; this does not prove the server did nothing.";if(J)return"The server refused the request, but another send of the same request had an unknown outcome, so the saved redemption still blocks a new attempt until a retry settles it. A retry reuses the same request and credit identifiers; this does not prove the server did nothing.";return"The server refused the request, and another attempt has already settled or replaced the saved redemption. A new attempt is gated by the current saved state and fresh preconditions."}async function cW(X,J){if(!x8(J.accountKey))throw new o6("invalid_account_key","the reset account key is reserved");let $=await X.resolveTarget(J.accountKey);if($.chatgptAccountId!==J.expectedChatgptAccountId)throw new o6("identity_mismatch","the resolved ChatGPT account identity changed before redemption");let Y=$.chatgptAccountId,G=$.accountKey==="main"?void 0:Y,Q=await nO(X,J.accountKey);if(Q.kind==="corrupt"){if(Q=await sO(X,J.accountKey),Q.kind==="corrupt")return IW($,Q.beforeState)}if(Q.kind==="cooldown")EW(Q);let z;if(Q.kind==="claim")z=Q.claim;else if(Q.kind==="expired_unreconciled"&&(J.retry||!vW(Q.claim.inFlight,Y))){if(!J.retry)SW();z=Q.claim}else{if(J.retry)throw new o6("retry_without_inflight","there is no active reset credit redemption to retry");let[j,N]=await Promise.all([X.fetchUsage($),$$(X.fetchImpl,$.accessToken,G)]),K=J$(j,X.hasActiveRateLimitMark(J.accountKey),X.now());if(!K.ok)throw new o6("not_exhausted",K.reason);if(!A7(N.credits))throw new o6("no_eligible_credit","no eligible reset credit was returned");let q=await aO(X,J.accountKey,N.credits,Y);if(q.kind==="corrupt")return IW($,q.beforeState);if(q.kind==="cooldown")EW(q);if(q.kind==="expired_unreconciled")SW();if(q.kind!=="claim")throw new o6("no_eligible_credit","no eligible reset credit was available while claiming");z=q.claim}iO(z.inFlight,Y);let Z=await eO(X.fetchImpl,$.accessToken,G,z.inFlight.creditId,z.inFlight.redeemRequestId),W,B=!1;try{W=await oO(X,J.accountKey,z.inFlight,Z,Y)}catch{B=!0}let H=B&&Y$(Z.kind),U=O7(Z)&&!B&&W?.rejectedStatus!==void 0;return{target:$,selectedCredit:z.selectedCredit,beforeState:Q.beforeState,outcome:Z,retrySafety:H?"The server returned a terminal result, but the state write failed. A retry within five minutes reuses the same request and credit identifiers.":O7(Z)&&!U?JM(B,W):XM(Z),...U?{refused:!0}:{},...H?{finalizeStateWriteFailed:!0}:{}}}function s(X){return typeof X==="object"&&X!==null&&!Array.isArray(X)}import{statSync as GM}from"node:fs";import{rm as dW}from"node:fs/promises";import{dirname as QM,join as iW}from"node:path";var lW=["primary","secondary"];function G$(X){return X!=null&&typeof X==="object"&&!Array.isArray(X)}function j3(X){return typeof X==="number"&&Number.isFinite(X)}function $M(X,J){if(!G$(J))return;let $=J.usedPercent;if(!j3($)||$<0||$>100)return;return{label:X,usedPercent:$,...typeof J.resetsAt==="string"?{resetsAt:J.resetsAt}:{},...j3(J.windowMinutes)&&J.windowMinutes>0?{windowMinutes:J.windowMinutes}:{}}}function YM(X){let J=X.spendControl;if(G$(J)&&typeof J.reached==="boolean"){let $=(Y)=>j3(J[Y])?{[Y]:J[Y]}:{};return{kind:"reading",reached:J.reached,...$("remainingPercent"),...$("usedPercent"),...$("limit"),...$("used"),...$("remaining"),...typeof J.resetsAt==="string"?{resetsAt:J.resetsAt}:{},...typeof J.unit==="string"?{unit:J.unit}:{}}}if(X.spendControlCleared===!0)return{kind:"cleared"};return}function I9(X,J,$){if(!G$(X)||!j3(J))return;let Y=[],G=[];for(let z of lW){let Z=$M(z,X[z]);if(Z)Y.push(Z);else if($)G.push({label:z})}let Q=YM(X);if(Y.length===0&&G.length===0&&!Q)return;return{checkedAt:J,...Y.length>0?{readings:Y}:{},...G.length>0?{coverage:G}:{},...Q?{budget:Q}:{}}}function K8(X){if(!G6(X))return;let J=f0(X),$={};for(let Y of lW){let G=J.limits.find((z)=>z.label===Y&&z.kind==="reading");if(!G||!j3(G.usedPercent))continue;let Q={usedPercent:G.usedPercent,remainingPercent:100-G.usedPercent,checkedAt:G.checkedAt,...G.resetsAt!==void 0?{resetsAt:G.resetsAt}:{},...G.windowMinutes!==void 0?{windowMinutes:G.windowMinutes}:{}};$[Y]=Q}return $.primary||$.secondary?$:void 0}var W9=Z0("vault"),zM="openai-auth",nW={refreshAdapter:"openai",category:"openai-native",apiKeys:!1},ZM={opencode:"OpenCode",pi:"Pi"};function WM(X){return LJ(zM,X)}function sW(X){return iW(QM(X),"openai-auth-vault")}function BM(X,J){return{...FJ({stateDir:X,host:J}),rosterPath:iW(X,`${J}-roster.json`)}}var aW=2000,Q$={"vault-unreachable":"Request refused locally: this host is connected to the credential vault, which could not be reached, and local accounts are not used while it is connected. Start the vault and connect accounts in it, or disconnect this host from the vault.","vault-empty":"Request refused locally: this host is connected to the credential vault, which serves it no usable OpenAI account, and local accounts are not used while it is connected. Connect accounts in the vault, or disconnect this host from the vault.","vault-refused":"Request refused locally: the credential vault did not authorize an account, and local accounts are not used while this host is connected to it. Check the accounts in the vault, or disconnect this host from the vault."};function oW(X){return X.snapshot()===void 0?"vault-unreachable":"vault-empty"}function HM(X){let J=V6(X);return J?U6(J):void 0}class z${host;name;paths;#X;#J;#W=new Map;#Q=new Map;#z;#Y;#$;#B=!1;#H=!1;#G=Promise.withResolvers();#Z;#V="unknown";#U;constructor(X){this.#X=X,this.host=X.host,this.name=WM(X.host),this.paths=BM(X.stateDir,X.host),this.#J=new U7({rosterPath:this.paths.rosterPath,tokenPath:this.paths.tokenPath,family:nW,connect:()=>this.#D(),isCustodyActive:()=>this.enrolled(),...X.reservedRouteIds?{reservedRouteIds:X.reservedRouteIds}:{},parseIdentity:HM,...X.now?{now:X.now}:{},onRoster:()=>{this.#z=void 0},onError:(J)=>this.#K("vault roster refresh failed",J),logger:W9})}#N(){return(this.#X.connectionFile??e9)()}#q(){return{connectionFile:this.#N(),projectRoot:this.#X.projectRoot??process.cwd(),storagePath:this.paths.tokenPath,logger:(X)=>W9.debug("vault transport error",{errorClass:X})}}#D(){return this.#X.connectScoped?.()??rZ(this.#q())}#F(){return this.#X.connectEnrollment?.()??DJ(this.#q())}#K(X,J){this.#z=e0(J),W9.warn(X,{host:this.host,error:this.#z})}#j(){return[this.paths.tokenPath,this.paths.statePath].map((X)=>{try{let J=GM(X);return`${J.ino}:${J.size}:${J.mtimeMs}:${J.ctimeMs}`}catch{return"?"}}).join("|")}async authority(){let X=this.#j(),J=await $3(this.paths,this.name);if(X===this.#j())return this.#V=J,this.#U=X,J;return"unreadable"}enrolled(){return this.#U!==this.#j()||this.#V!=="local"}start(){if(this.#B||this.#H)return;this.#B=!0;let X=async()=>{try{await this.authority(),await this.#L()}catch($){if(!this.#H)this.#K("vault roster refresh failed",$)}if(this.#H)return;let J=this.#X.pollIntervalMs??5000;if(J<=0)return;this.#Z=setTimeout(()=>{this.#Z=void 0,X()},J),this.#Z.unref?.()};X()}#L(){return this.#$??=this.#J.refresh().finally(()=>{this.#$=void 0,this.#G.resolve()}),this.#$}firstRoster(){return this.#G.promise}async refresh(){try{await this.authority();let X=this.#$;if(X)await X.catch(()=>{return});let J=await this.#L();return this.#z=void 0,J}catch(X){return this.#K("vault roster refresh failed",X),this.#J.snapshot()}}snapshot(){return this.#J.snapshot()}serves(){return this.enrolled()&&(this.snapshot()?.rows.length??0)>0}identities(){if(!this.enrolled())return new Set;return new Set((this.snapshot()?.rows??[]).flatMap((X)=>X.accountIdentity!==void 0?[X.accountIdentity]:[]))}routes(){if(!this.enrolled())return[];let X=new Map((this.snapshot()?.rows??[]).map((J)=>[J.routeId,J]));return this.#J.routingRows().map((J)=>{let $=X.get(J.id)?.accountIdentity;return{id:J.id,kind:J.kind==="api-key"?"api-key":"oauth",...$!==void 0?{identity:$}:{},...J.quota!==void 0?{quota:J.quota}:{}}})}owns(X){return(this.snapshot()?.rows??[]).some((J)=>J.routeId===X)}async send(X,J,$){let Y=!1;try{return await this.#J.send(X,(G)=>{return Y=!0,J(G.accessToken,G)},{site:$.site,...$.signal?{signal:$.signal}:{}})}catch(G){if(Y)throw G;this.#K("vault refused to serve an account",G);return}}async authorize(X,J={}){try{return await this.#J.authorize(X,J.signal)}catch($){this.#K("vault refused to serve an account",$);return}}async reportFailure(X,J){if(J!==401)return;try{await this.#J.reportFailure(X,401,"direct")}catch($){this.#K("vault failure report failed",$)}await this.refresh()}recordSnapshot(X,J,$,Y){let G=I9(J,(this.#X.now??Date.now)(),$);if(!G)return Promise.resolve();return this.#J.recordQuota(X,G,Y).then(()=>{},(Q)=>this.#K("vault quota write failed",Q))}pollQuota(X){let J=this.#Q.get(X);if(J)return J;let $=this.#P(X).finally(()=>{this.#Q.delete(X)});return this.#Q.set(X,$),$}async#P(X){let J,$=this.#X.fetchImpl?.()??globalThis.fetch,Y=await this.send(X,async(G,Q)=>{try{let z=await b8({accessToken:G,fetchImpl:$,now:this.#X.now??Date.now,...Q.accountIdentity?{accountId:Q.accountIdentity}:{},accountKey:X,logger:W9});return await this.recordSnapshot(X,z,!0,Q),J=void 0,new Response(null,{status:200})}catch(z){J=e0(z);let Z=z?.status;if(typeof Z==="number")return new Response(null,{status:Z});throw z}},{site:"quota"}).catch((G)=>{J=e0(G);return});if(!Y)return{ok:!1,error:J??"vault refused"};return Y.ok?{ok:!0}:{ok:!1,error:J??`status ${Y.status}`}}requestReading(X){let J=this.#W.get(X);if(J)return J;let $=this.pollQuota(X).catch((Y)=>{W9.warn("vault quota poll failed",{routeId:X,error:e0(Y)})}).finally(()=>{this.#W.delete(X)});return this.#W.set(X,$),$}async pollStale(X){let J=(this.#X.now??Date.now)(),$=[];for(let Y of this.routes()){let G=VM(Y.quota);if(G!==void 0&&J-G<X)continue;$.push({id:Y.id,...await this.pollQuota(Y.id)})}return $}async decline(X){await this.#J.decline(X),W9.info("vault account declined",{routeId:X})}async accept(X){await this.#J.accept(X),W9.info("vault account accepted",{routeId:X})}async status(){await this.authority();let X;try{X=await J3(this.paths,this.name)}catch(J){this.#K("vault enrollment state unreadable",J),X={state:"blocked",proposedName:this.name,code:J instanceof $0?J.kind:"unreadable-state"}}return{host:this.host,name:this.name,enrollment:X,accounts:this.enrolled()?this.snapshot()?.rows??[]:[],...this.#z?{lastError:this.#z}:{}}}async connectStep(){let X=await this.#F().catch((J)=>{throw new k6("vault-unreachable",`Could not reach the Claustrum vault (${this.#N()}): ${e0(J)}. Is the vault running?`)});try{let J=new z7({client:X,paths:this.paths,proposedName:this.name,...this.#X.now?{now:this.#X.now}:{}}),$=await J.status();if($.state==="denied"||$.state==="blocked")await J.resetTerminal();let Y=await J.reconcile();if(W9.info("vault enrollment step",{host:this.host,state:Y.state}),Y.state==="approved")this.#z=void 0,await this.refresh();return Y}finally{X.close()}}waitForApproval(X={}){return this.#Y??=(async()=>{let J=X.sleep??((Q)=>new Promise((z)=>setTimeout(z,Q))),$=X.pollIntervalMs??2000,Y=Date.now()+(X.timeoutMs??600000),G=await this.connectStep();while(G.state==="pending"||G.state==="busy"){if(X.onPending?.(G),Date.now()>=Y)return G;await J($),G=await this.connectStep()}return G})().finally(()=>{this.#Y=void 0}),this.#Y}async disconnect(){await dW(this.paths.tokenPath,{force:!0}),await dW(this.paths.statePath,{force:!0}),await this.authority(),this.#z=void 0,W9.info("vault enrollment forgotten",{host:this.host})}assertHostSlot(X){if(this.serves())_J({mode:"custody",auth:X,provider:"openai"})}close(){if(this.#H=!0,this.#G.resolve(),this.#Z)clearTimeout(this.#Z);this.#Z=void 0,this.#J.close()}}function VM(X){if(!X)return;let J=f0(X).limits.map(($)=>$.checkedAt);return J.length>0?Math.max(...J):void 0}function J4(X,J){if(J.state!=="pending")return[];if(!J.requestId)return[`The vault did not take the enrollment request yet${J.retryCode?` (${J.retryCode})`:""}. Run Connect again in a moment.`];return[`Enrollment request ${J.requestId} for ${X} is waiting for approval. Approve it with:`,`  ck auth enroll approve --request-id ${J.requestId}`,"and let it read your OpenAI accounts with:",`  ck auth grant --principal enrolled:${X} --selector-kind category --selector ${nW.category} --operation read`]}function N3(X,J,$){let Y=`${ZM[X]} (${J})`;switch($.state){case"approved":return`${Y}: connected to the Claustrum vault.`;case"idle":return`${Y}: not connected to the Claustrum vault.`;case"pending":return $.requestId?`${Y}: waiting for approval of request ${$.requestId}.`:`${Y}: enrollment request not taken yet${$.retryCode?` (${$.retryCode})`:""}.`;case"denied":return`${Y}: the vault denied the enrollment request.`;case"blocked":return`${Y}: enrollment stopped (${$.code}).`;case"unavailable":return`${Y}: the vault is unavailable (${$.code}).`;case"busy":return`${Y}: another process is enrolling right now.`}}function q3(X,J){switch(J.state){case"approved":{let $=X.snapshot()?.rows.length??0;return{ok:!0,text:`Connected: the vault approved ${X.name}. It serves ${$} OpenAI account${$===1?"":"s"} to this host${$===0?" (grant it the openai-native category with `ck auth grant` to add some)":""}.`}}case"denied":return{ok:!1,text:"The vault denied the enrollment request. Run Connect again to send a new one."};case"blocked":return{ok:!1,text:`Enrollment stopped (${J.code}). Run Connect again to send a new request.`};case"pending":case"busy":return{ok:!1,text:[...J4(X.name,J),"Still waiting. The request stays open: run Connect again after approving it."].join(`
-`)};default:return{ok:!1,text:`Enrollment is ${J.state}.`}}}async function rW(X){let J=[];for(let $ of X)try{J.push(...await $.run())}catch(Y){J.push({code:"doctor-check-failed",message:`Check ${$.id} failed: ${Y instanceof Error?Y.message:String(Y)}`})}return{findings:J}}function tW(X,J){let $=[X];if(J.findings.length===0)return $.push("No problems found."),$;for(let Y of J.findings){let G=Y.repair?" (repair available)":"";$.push(`- ${Y.message}${G}`)}return $}async function eW(X,J){let $={applied:[],declined:[],failed:[]};for(let Y of J.findings){let G=Y.repair;if(!G)continue;if(!await X.confirm(`Apply repair: ${G.label}?`)){$.declined.push(Y);continue}try{await G.apply(),$.applied.push(Y)}catch(Q){$.failed.push({finding:Y,error:Q}),X.print(`Repair failed: ${G.label}: ${Q instanceof Error?Q.message:String(Q)}`)}}return $}function L3(X){let J=X.title??"Auth doctor";return{id:"doctor",label:X.label??"Auth doctor",hint:"check accounts and offer repairs",async run($){let Y=await rW(X.checks);for(let z of tW(J,Y))$.print(z);let G=Y.findings.filter((z)=>z.repair);if(G.length===0){if(Y.findings.length>0)$.print("No repairs are available.");return}let Q=await eW($,Y);$.print(`Applied ${Q.applied.length} of ${G.length} repair(s).`)}}}import{execFileSync as UM,spawn as KM}from"node:child_process";function JB(X,J=process.platform,$=UM,Y=KM){try{if(J==="win32"){let G=`Start-Process '${X.replaceAll("'","''")}'`,Q=Y("powershell.exe",["-NoProfile","-NonInteractive","-WindowStyle","Hidden","-EncodedCommand",Buffer.from(G,"utf16le").toString("base64")],{stdio:"ignore",windowsHide:!0});return Q.on("error",()=>{}),Q.unref(),Q.pid!==void 0}else $(J==="darwin"?"open":"xdg-open",[X],{stdio:"ignore",timeout:3000});return!0}catch{return!1}}function XB(X,J){if(X.print(""),X.print("Open this URL in your browser and complete sign-in:"),X.print(""),X.print(J.url),X.print(""),J.instructions)X.print(J.instructions),X.print("")}async function T7(X,J){let $=new AbortController,Y=await X.begin({headless:!1,signal:$.signal});Y.completion.catch(()=>{}),XB(J,Y);let G=!1;try{G=await(X.openBrowser??JB)(Y.url)!==!1}catch{G=!1}if(!G)$.abort(),J.print("Could not open a browser. Switching to device authorization."),J.print(""),Y=await X.begin({headless:!0}),XB(J,Y);return Y.completion}var B0={hide:"\x1B[?25l",show:"\x1B[?25h",up:(X=1)=>`\x1B[${X}A`,clearLine:"\x1B[2K",clearScreen:"\x1B[2J",moveTo:(X,J)=>`\x1B[${X};${J}H`,cyan:"\x1B[36m",green:"\x1B[32m",red:"\x1B[31m",dim:"\x1B[2m",reset:"\x1B[0m"};function Z$(X){let J=X.toString(),$=[];for(let Y=0;Y<J.length;){let G=J[Y];if(G==="\x1B"){let Q=J.slice(Y,Y+3),z=Q[1]==="["||Q[1]==="O"?Q[2]:void 0;if(z&&"ABCD".includes(z)){let W={A:"up",B:"down",C:"right",D:"left"}[z];if(W)$.push(W);Y+=3}else if(Y+1===J.length){if(Y===0)$.push("escape-start");Y+=1}else if((J[Y+1]==="["||J[Y+1]==="O")&&Y+2>=J.length)break;else Y+=1;continue}if(G==="\r"||G===`
-`)$.push("enter");else if(G==="\x03")$.push("escape");else if(G&&G>=" ")$.push("char");Y+=1}return $}var $B=`${String.fromCharCode(27)}\\[[0-9;]*m`,jM=new RegExp($B,"g"),NM=new RegExp(`^${$B}`);function YB(X){return X.replace(jM,"")}function B1(X,J){if(J<=0)return"";if(YB(X).length<=J)return X;let $=J>=3?"...":".".repeat(J),Y=Math.max(0,J-$.length),G="",Q=0,z=0;while(Q<X.length&&z<Y){if(X[Q]==="\x1B"){let Z=X.slice(Q).match(NM);if(Z){G+=Z[0],Q+=Z[0].length;continue}}G+=X[Q],Q+=1,z+=1}return G.includes("\x1B[")?`${G}${B0.reset}${$}`:G+$}function W$(){return{input:process.stdin,output:process.stdout,signals:process}}function H1(X){return X.input.isTTY===!0}function B$(X,J=""){X.output.write(`${J}
-`)}var qM=50;function LM(X){if(X==="red")return B0.red;if(X==="cyan")return B0.cyan;return""}async function $4(X,J,$){if(!H1(X))throw Error("Interactive select requires a TTY terminal");if(J.length===0)throw Error("No menu items provided");let{input:Y,output:G,signals:Q}=X,z=0,Z=null,W=!1,B=0,H=()=>{let U=G.columns??80,j=G.rows??24,N=B;if($.clearScreen)G.write(B0.clearScreen+B0.moveTo(1,1));else if(N>0)G.write(B0.up(N));let K=0,q=(A)=>{G.write(`${B0.clearLine}${A}
-`),K+=1},F=$.lines??[],O=1+($.subtitle?3:0)+F.length+(F.length?1:0),_=Math.max(1,Math.min(J.length,j-O-2-1)),C=Math.max(0,Math.min(z-Math.floor(_/2),Math.max(0,J.length-_))),L=J.slice(C,C+_);if(q(`${B0.dim}┌  ${B0.reset}${B1($.message,Math.max(1,U-4))}`),$.subtitle)q(`${B0.dim}│${B0.reset}`),q(`${B0.cyan}◆${B0.reset}  ${B1($.subtitle,Math.max(1,U-4))}`),q("");for(let A of F)q(`${B0.cyan}│${B0.reset}  ${B1(A,Math.max(1,U-4))}`);if(F.length)q(`${B0.cyan}│${B0.reset}`);for(let A=0;A<L.length;A++){let T=L[A];if(!T)continue;let k=C+A===z,p=LM(T.color),i=p?`${k?"":B0.dim}${p}${T.label}${B0.reset}`:k?T.label:`${B0.dim}${T.label}${B0.reset}`;if(T.hint)i+=` ${B0.dim}${T.hint}${B0.reset}`;i=B1(i,Math.max(1,U-8)),q(k?`${B0.cyan}│${B0.reset}  ${B0.green}●${B0.reset} ${i}`:`${B0.cyan}│${B0.reset}  ${B0.dim}○${B0.reset} ${i}`)}let P=L.length<J.length?` (${C+1}-${C+L.length}/${J.length})`:"";q(`${B0.cyan}│${B0.reset}  ${B0.dim}${B1(`Up/Down to select | Enter: confirm | Esc: back${P}`,Math.max(1,U-6))}${B0.reset}`),q(`${B0.cyan}└${B0.reset}`);for(let A=K;A<N;A++)q("");B=K};return new Promise((U)=>{let j=Y.isRaw??!1,N=()=>{if(W)return;if(W=!0,Z)clearTimeout(Z);Y.removeListener("data",F);try{Y.setRawMode(j),Y.pause(),G.write(B0.show)}catch{}Q?.removeListener("SIGINT",q),Q?.removeListener("SIGTERM",q)},K=(O)=>{N(),U(O)},q=()=>K(null),F=(O)=>{for(let _ of Z$(O)){if(W)break;if(Z)clearTimeout(Z),Z=null;switch(_){case"up":z=(z-1+J.length)%J.length,H();break;case"down":z=(z+1)%J.length,H();break;case"enter":K(J[z]?.value??null);break;case"escape":K(null);break;case"escape-start":Z=setTimeout(()=>K(null),qM);break;default:break}}};Q?.once("SIGINT",q),Q?.once("SIGTERM",q);try{Y.setRawMode(!0)}catch{N(),U(null);return}Y.resume(),G.write(B0.hide),H(),Y.on("data",F)})}async function H$(X,J,$=!1){if(!H1(X))return!1;return await $4(X,$?[{label:"Yes",value:!0},{label:"No",value:!1}]:[{label:"No",value:!1},{label:"Yes",value:!0}],{message:J})??!1}function GB(X){let J=H1(X);return{terminal:X,interactive:J,print:($)=>B$(X,$),confirm:($,Y)=>H$(X,$,Y),select:async($,Y)=>J&&$.length>0?$4(X,$,Y):null}}function DM(X,J){if(X.print(J.title),J.subtitle)X.print(J.subtitle);for(let $ of J.status??[])X.print(`  ${$}`);X.print(""),X.print("Actions:");for(let $ of J.actions)X.print($.hint?`  - ${$.label} (${$.hint})`:`  - ${$.label}`);return X.print(""),X.print("This menu needs an interactive terminal to choose an action; nothing was changed."),{status:"not-interactive"}}async function V1(X){let J=X.terminal??W$(),$=GB(J);if(!$.interactive)return DM($,X);if(X.actions.length===0)return $.print("No actions are available."),{status:"cancelled"};let Y=await $4(J,X.actions.map((G)=>({label:G.label,value:G,color:G.destructive?"red":"cyan",...G.hint?{hint:G.hint}:{}})),{message:X.title,subtitle:X.subtitle??"Select an account action",...X.status?{lines:X.status}:{},clearScreen:!0});if(!Y)return{status:"cancelled"};if(Y.destructive&&!await $.confirm(Y.confirm??`${Y.label}?`))return $.print("Cancelled; nothing was changed."),{status:"declined",action:Y.id};try{return await Y.run($),{status:"ran",action:Y.id}}catch(G){return $.print(`${Y.label} failed: ${G instanceof Error?G.message:String(G)}`),{status:"failed",action:Y.id,error:G}}}var zB="disabled from the auth menu",QB=8;async function w8(X){let J=await X.read();if(J.status==="ready")return{rows:J.rows};if(J.status==="pending-migration")return{rows:[],problem:"The account store has not been migrated yet."};return{rows:[],problem:`The account store could not be read (${J.file}: ${J.reason}).`}}async function K$(X){let{rows:J}=await w8(X);return J.some(($)=>$.credential!==void 0)}function j$(X){let J=[];if(X.label)J.push(X.label);if(X.invalid)J.push(`invalid ${X.invalid}`);else if(!X.enabled)J.push(X.disabledReason?`disabled: ${X.disabledReason}`:"disabled");else J.push("enabled");if(!X.credential&&!X.invalid)J.push("no credential");return J.join(", ")}function FM(X){if(X.problem)return[X.problem];if(X.rows.length===0)return["No accounts yet."];let J=X.rows.slice(0,QB).map((Y)=>`${Y.id}: ${j$(Y)}`),$=X.rows.length-QB;if($>0)J.push(`... and ${$} more`);return J}function PM(X){return X instanceof Error?X.message:String(X)}async function N$(X,J,$){if(J.length===0)return X.print("There are no accounts."),null;return X.select(J.map((Y)=>({label:Y.id,value:Y,hint:j$(Y)})),{message:$})}function OM(X,J){let $=new Set(J.map((Y)=>Y.id));if(X.id&&!$.has(X.id))return X.id;for(let Y=1;;Y++){let G=`account-${Y}`;if(!$.has(G))return G}}function ZB(X,J=Date.now()){let $=G6(X.quota)?f0(X.quota):void 0,Y=R7($,{now:J,form:"full"});return(Y.length>0?Y:[R8($,{now:J})]).map((G)=>`  ${G}`)}function WB(X){return{id:"add-account",label:"Add account",hint:"sign in to another account",async run(J){let $=X.login;if(!$)throw Error("No login is configured");let Y=await T7($,J),{rows:G}=await w8(X.store),Q=(X.newAccountId??OM)(Y,G),z=await X.store.add({id:Q,credential:Y.credential,...Y.identity!==void 0?{identity:Y.identity}:{},...Y.label!==void 0?{label:Y.label}:{}},X.extraLocks?{extraLocks:X.extraLocks}:{});if(z.outcome==="rotated")J.print(`That sign-in is already account ${z.id}; its credential was updated.`);else if(z.outcome==="added-disabled")J.print(`Added account ${z.id}, disabled: another enabled account is the same provider account.`);else if(z.outcome==="completed")J.print(`Finished adding account ${z.id}.`);else J.print(`Added account ${z.id}.`)}}}function BB(X){return{id:"reauthenticate",label:"Re-authenticate account",hint:"sign an account in again",async run(J){let $=X.login;if(!$)throw Error("No login is configured");let{rows:Y}=await w8(X.store),G=await N$(J,Y,"Re-authenticate which account?");if(!G)return;let Q=await T7($,J);if(Q.identity!==void 0&&G.identity!==void 0&&Q.identity!==G.identity){J.print(`That sign-in is a different account from ${G.id}; nothing was changed. Use Add account to add it.`);return}let z=Q.identity??G.identity;await X.store.replace(G.id,Q.credential,z!==void 0?{identity:z}:{},X.extraLocks?{extraLocks:X.extraLocks}:{}),J.print(`Updated the sign-in of account ${G.id}.`)}}}function HB(X){return{...X.protect?{protect:X.protect}:{},...X.extraLocks?{extraLocks:X.extraLocks}:{}}}function VB(X){return X instanceof K0&&X.kind==="row-protected"?X.message:void 0}function UB(X){return{id:"remove-account",label:"Remove account",hint:"delete one account",async run(J){let{rows:$}=await w8(X.store),Y=await N$(J,$,"Remove which account?");if(!Y)return;if(!await J.confirm(`Remove account ${Y.id}?`)){J.print("Cancelled; nothing was changed.");return}try{await X.store.remove(Y.id,HB(X))}catch(G){let Q=VB(G);if(Q===void 0)throw G;J.print(`Account ${Y.id} was kept: ${Q}`);return}J.print(`Removed account ${Y.id}.`)}}}function V$(X){return{id:"toggle-account",label:"Enable or disable account",hint:"stop or resume using an account",async run(J){let{rows:$}=await w8(X.store),Y=await N$(J,$,"Enable or disable which account?");if(!Y)return;let G=X.extraLocks?{extraLocks:X.extraLocks}:{};if(Y.enabled){await X.store.disable(Y.id,X.disableReason??zB,G),J.print(`Disabled account ${Y.id}.`);return}try{await X.store.enable(Y.id,G)}catch(Q){if(Q instanceof K0&&Q.kind==="duplicate-identity"){J.print(`Account ${Y.id} stays disabled: another enabled account is the same provider account.`);return}throw Q}J.print(`Enabled account ${Y.id}.`)}}}function KB(X){return{id:"list-accounts",label:"List accounts",hint:"show every account",async run(J){let $=await w8(X.store);if($.problem){J.print($.problem);return}if($.rows.length===0)J.print("No accounts yet.");for(let Y of $.rows)J.print(`${Y.id}: ${j$(Y)}`)}}}function U$(X){return{id:"check-quotas",label:"Check quotas",hint:"poll and show the windows of each account",async run(J){let $=await w8(X.store);if($.problem){J.print($.problem);return}let Y=new Map,G=X.pollQuota;if(G)for(let z of $.rows){if(z.invalid||!z.credential||z.credentialEpoch===void 0){Y.set(z.id,"no usable credential");continue}try{let Z=await G(z);await X.store.recordQuota(z.id,{credentialEpoch:z.credentialEpoch,...z.identity!==void 0?{identity:z.identity}:{}},Z)}catch(Z){Y.set(z.id,PM(Z))}}let Q=await w8(X.store);if(Q.rows.length===0)J.print("No accounts yet.");for(let z of Q.rows){J.print(`${z.id}:`);let Z=Y.get(z.id);if(Z)J.print(`  quota check failed: ${Z}`);for(let W of ZB(z,(X.now??Date.now)()))J.print(W)}}}}function jB(X){return{id:"delete-all",label:"Delete all accounts",destructive:!0,confirm:"Delete every account? Accounts the plugin keeps are not deleted.",async run(J){let $=await w8(X.store);if($.problem){J.print($.problem);return}let Y=[],G=[];for(let Q of $.rows)try{await X.store.remove(Q.id,HB(X)),Y.push(Q.id)}catch(z){let Z=VB(z);if(Z===void 0)throw z;G.push(`${Q.id} (${Z})`)}if(J.print(`Deleted ${Y.length} account(s).`),G.length>0)J.print(`Kept: ${G.join(", ")}.`)}}}async function q$(X){return NB(X,await X.custody?.()===!0)}function NB(X,J){let $=X.doctor?.length?[L3({checks:X.doctor})]:[],Y=[...X.extraActions??[]];if(J)return[KB(X),V$(X),U$(X),...$,...Y];return[...X.login?[WB(X),BB(X)]:[],UB(X),V$(X),U$(X),...$,...Y,jB(X)]}async function L$(X){let J=await X.custody?.()===!0,$=NB(X,J),[Y,G]=await Promise.all([w8(X.store),X.status?.()??[]]);return V1({title:X.title,subtitle:J?"Accounts come from the vault; select an action":"Select an account action",status:[...G,...FM(Y)],actions:$,...X.terminal?{terminal:X.terminal}:{}})}function D$(){return{url:"",instructions:"",method:"auto",callback:async()=>({type:"failed"})}}function qB(X){return X!==void 0}function F$(X){return async(J)=>{if(!qB(J))return X.login();if(!await X.hasCredential())return X.login(J);return await X.openMenu(J),D$()}}function v8(X){return X.authority!=="local"}async function r6(X){return{authority:await X.authority(),status:await X.status(),identities:X.identities(),routes:new Set(X.routes().map((J)=>J.id))}}async function C7(X){let J;try{return await Promise.race([Promise.resolve().then(()=>X.refresh()).then(()=>{return},($)=>$ instanceof Error?$.message:String($)),new Promise(($)=>{J=setTimeout(()=>$("Vault roster refresh did not finish within the roster wait budget."),aW)})])}finally{clearTimeout(J)}}function y8(X){return X.email||X.label||X.routeId}function LB(X,J){let $=f0(G6(X.quota)?X.quota:void 0),Y=R7($,{now:J});return(Y.length>0?Y:[R8($,{now:J})]).map((G)=>`  ${G}`)}var D3="Accounts are managed in the vault with ck. Disconnect to use local accounts.",h8="Nothing was changed: accounts are managed in the vault with ck. Disconnect to use local accounts.";function DB(X){let J=[...X.label?[X.label]:[],X.invalid?`invalid ${X.invalid}`:X.enabled?"enabled":`disabled${X.disabledReason?`: ${X.disabledReason}`:""}`];return`${X.id}: ${J.join(", ")}`}async function F3(X,J){let $=await C7(J),Y=await r6(J),{status:G}=Y,Q=v8(Y)?void 0:await X.store.read(),z=await q$(X),Z=new Set(["check-quotas",...(X.extraActions??[]).map((H)=>H.id)]),W=z.filter((H)=>!v8(Y)||Z.has(H.id)).map((H)=>({...H,run:async(U)=>{if(!Z.has(H.id)&&v8(await r6(J))){U.print(h8);return}await J.authority(),await H.run(U)}})),B=W.find((H)=>H.id==="check-quotas");if(B)B.run=async(H)=>{await C7(J);let U=await r6(J),j=v8(U)?void 0:await X.store.read();if(!j)H.print(D3);else if(j.status!=="ready")H.print("The local account store could not be read.");else for(let q of j.rows){H.print(DB(q));try{if(X.pollQuota&&q.credentialEpoch!==void 0){let _=await X.pollQuota(q);await X.store.recordQuota(q.id,{credentialEpoch:q.credentialEpoch,...q.identity!==void 0?{identity:q.identity}:{}},_)}}catch(_){H.print(`  quota check failed: ${_ instanceof Error?_.message:String(_)}`)}let F=await X.store.read(),O=F.status==="ready"?F.rows.find((_)=>_.id===q.id):void 0;for(let _ of LB(O??q,(X.now??Date.now)()))H.print(_)}let N=U.routes;for(let q of J.snapshot()?.rows??[]){if(H.print(`Vault ${y8(q)}: ${q.enabled?q.state:"declined"}`),!N.has(q.routeId)){H.print("  quota check skipped: account is not enabled and active");continue}let F=await J.pollQuota(q.routeId);if(!F.ok)H.print(`  quota check failed: ${F.error??"vault unavailable"}`);let O=J.snapshot()?.rows.find((_)=>_.routeId===q.routeId);for(let _ of LB({quota:O?.quota},(X.now??Date.now)()))H.print(_)}let K=await J.status();if(K.lastError)H.print(`Claustrum vault unreachable: ${K.lastError}`)};return V1({title:X.title,subtitle:"Select an account action",status:[...await X.status?.()??[],...$?[`Last error: ${$}`]:[],...G.lastError?[`Claustrum vault unreachable: ${G.lastError}`]:[],...G.accounts.map((H)=>`Vault ${y8(H)}: ${H.enabled?`enabled (${H.state})`:"declined"}`),...!Q?[D3]:Q.status==="ready"?Q.rows.map((H)=>DB(H)):["The local account store could not be read."]],actions:W,...X.terminal?{terminal:X.terminal}:{}})}function FB(X){return s(X)?{...X}:{}}function E7(X,J,$,Y){let G=$.confirm?.irreversible?{irreversible:!0,confirm:$.confirm.message}:{...$.confirm?{confirm:$.confirm.message}:{}};return{id:$.id,label:$.label,...$.description?{description:$.description}:{},...$.group?{group:$.group}:{},knobs:$.knobs,...G,run:async({values:Q,invocation:z})=>{let Z=await X.apply({command:X.command,sectionId:J,...Y?{itemId:Y}:{},actionId:$.id,values:Q,confirmed:!0},z);return{ok:Z.ok,text:Z.text,...Z.code?{code:Z.code}:{}}}}}function P$(X,J){return new Proxy(X,{get($,Y){if(Y==="read")return async()=>{let Q=await $.read();if(Q.status!=="ready")return Q;let z={...Q,rows:Q.rows.map((B)=>({...B,label:B.label??B.id}))};if(!J)return z;let Z=await r6(J);if(!v8(Z))return z;let W=[...Z.status.accounts.map((B)=>({id:B.routeId,label:y8(B),type:"oauth",enabled:B.enabled,identity:B.accountIdentity,quota:B.quota,hasEntry:!1,needsFirstReading:!1,candidate:!1}))];return{...Q,rows:W}};if(Y==="readSettings")return async()=>{let Q=await $.readSettings();if(Q.status==="error"||!J)return Q;let z=await r6(J),Z=FB(Q.settings.killswitch);if(!v8(z)||!Q.settings.killswitch)return Q;let W=FB(Z.accounts);for(let B of z.status.accounts)W[B.routeId]=a6({version:1,accounts:[],...Q.settings},B.routeId);return{...Q,settings:{...Q.settings,killswitch:{...Z,accounts:W}}}};let G=Reflect.get($,Y);return typeof G==="function"?G.bind($):G}})}function PB(X,J){let $=i9(X),Y=i9({command:X.command,title:X.title,store:P$(X.store,J),accounts:X.accounts,quota:X.quota,limits:X.limits,routing:X.routing,...X.extraLocks?{extraLocks:X.extraLocks}:{},...X.now?{now:X.now}:{}}),G=async(W,B)=>{let H=await r6(J),U=v8(H),j=U?Y:$,K=(await j.open(B)).menu.sections.find((L)=>L.id===W);if(!K)throw new k6("unavailable","The account menu is unavailable.");if(!U)return{lines:K.lines,items:K.items.map((L)=>({...L,actions:L.actions.map((P)=>E7(j,W,P,L.id))})),actions:K.actions.map((L)=>E7(j,W,L))};let q=new Map(H.status.accounts.map((L)=>[L.routeId,L])),F=(X.now??Date.now)(),O=(L)=>({id:"check",label:L?"Check this account":"Check now",group:"Actions",run:async()=>{let A=[...(await r6(J)).routes].filter((T)=>!L||T===L);if(L&&A.length===0)throw new k6("unavailable","This vault account cannot be checked right now.");for(let T of A){let k=await J.pollQuota(T);if(!k.ok)throw new k6("quota-check-failed",`${T}: ${k.error??"vault unavailable"}`)}return`Checked quota for ${A.length} account${A.length===1?"":"s"}.`}});if(W==="quota"){let L=(P,A)=>R8(f0(P.quota,X.quota?.scope),{now:F,form:A});return{lines:H.status.accounts.filter((P)=>!H.routes.has(P.routeId)).map((P)=>`${y8(P)} (${P.enabled?P.state:"disabled"}): ${L(P,"compact")}`),items:H.status.accounts.filter((P)=>H.routes.has(P.routeId)).map((P)=>({id:P.routeId,label:y8(P),group:"Accounts",status:L(P,"compact"),detail:L(P,"full"),actions:[O(P.routeId)]})),actions:H.routes.size>0?[O()]:[]}}let _=K.items.map((L)=>{let P=q.get(L.id),A=P&&W==="accounts"?`Vault · ${P.credentialType==="oauth"?"login":"API key"} · ${P.state} · ${P.enabled?"enabled":"declined"}`:L.detail;return{id:L.id,label:L.label,detail:A,group:L.group,status:P&&W==="accounts"?P.enabled?P.state:"disabled":L.status,...L.facts?{facts:L.facts}:{},actions:P&&W!=="limits"?[]:L.actions.map((T)=>E7(j,W,T,L.id))}}),C=K.actions.filter((L)=>W==="limits"||W==="routing"&&L.id==="mode").map((L)=>E7(j,W,L));return{lines:W==="accounts"?[`${H.status.accounts.length} vault account${H.status.accounts.length===1?"":"s"}`,`${H.routes.size} can route`,D3]:K.lines,items:_,actions:C}},Q=i9({...X,accounts:void 0,quota:void 0,routing:void 0,limits:void 0,replace:{accounts:{title:"Accounts",build:(W)=>G("accounts",W)},quota:{title:"Quota",build:(W)=>G("quota",W)},routing:{title:"Routing",build:(W)=>G("routing",W)},limits:{title:"Limits",build:(W)=>G("limits",W)}},extras:X.extras?.map((W)=>W.id!=="reset"?W:{...W,build:async(B)=>{let H=await r6(J);if(v8(H))return{lines:[D3]};return W.build(B)}})}),z=async()=>{if(!v8(await r6(J)))return{menu:$,error:void 0};let W=await C7(J);return{menu:Q,error:W}},Z=async(W,B)=>{let H=await W.menu.open(B);if(W.error)H.menu.sections.find((j)=>j.id==="vault")?.lines.push(`Last error: ${W.error}`);return H};return{command:X.command,open:async(W)=>Z(await z(),W),apply:async(W,B)=>{let H=await z(),{menu:U}=H;if(U===Q&&(W.sectionId==="accounts"||W.sectionId==="routing"&&W.actionId==="order"||W.sectionId==="reset"||W.sectionId==="quota"&&(await r6(J)).routes.size===0||W.sectionId==="limits"&&W.itemId!==void 0&&!(await r6(J)).status.accounts.some((j)=>j.routeId===W.itemId)))return{...await Z(H,B),ok:!1,code:"vault-local-action",text:h8};return U.apply(W,B)}}}var p6="openai",_$="OpenAI accounts",U1="main",_B="that account is already your main account, so it was not added again",e6=Z0("commands"),AB=new Set(["__proto__","constructor","prototype"]);function TB(X,J){let $={version:1,accounts:[],killswitch:X},Y=s(X.accounts)?Object.keys(X.accounts):[],G={};for(let Z of new Set([U1,...J,...Y])){if(AB.has(Z))continue;let W=a6($,Z===U1?void 0:Z);G[Z]={primary:W.primary,secondary:W.secondary}}let Q=a6($,void 0),z={...X};return delete z.main,z.accounts=G,z.defaults={primary:Q.primary,secondary:Q.secondary},z.schema=t1,z}function RB(X,J){let $=s(X.accounts)?{...X.accounts}:{};for(let G of new Set([U1,...J])){if(AB.has(G)||Object.hasOwn($,G))continue;$[G]={primary:C9.primary,secondary:C9.secondary}}let Y=s(X.defaults)?X.defaults:{primary:C9.primary,secondary:C9.secondary};return{...X,accounts:$,defaults:Y,schema:t1}}function O$(X,J){let $=!1;if(s(X.cachekeep))X.cacheKeep={...X.cachekeep,...s(X.cacheKeep)?X.cacheKeep:{}},delete X.cachekeep,$=!0;let Y=X.killswitch;if(s(Y)&&Y.schema!==t1)X.killswitch=TB(Y,J),$=!0;return $}async function OB(X){let J=await X.read();return J.status==="ready"?J.rows.map(($)=>$.id):[]}function I7(X){let J=async()=>{let Y=await X.readSettings();if(Y.status==="error")return Y;let G=structuredClone(Y.settings);return O$(G,await OB(X)),{...Y,settings:G}},$=async(Y,G)=>{let Q=await OB(X);return X.updateSettings(async(z)=>{O$(z,Q);let Z=await Y(z)??z;if(s(Z.killswitch)&&Z.killswitch.schema!==t1)Z.killswitch=RB(Z.killswitch,Q);return Z},G)};return new Proxy(X,{get(Y,G){if(G==="readSettings")return J;if(G==="updateSettings")return $;let Q=Reflect.get(Y,G,Y);return typeof Q==="function"?Q.bind(Y):Q}})}function b7(X,J){let $=(W,B)=>J.rowLocks?J.rowLocks(W):B,Y=(W,B)=>{let H=$(W,B?.extraLocks);return{...B??{},...H?{extraLocks:H}:{}}},G=(W,B,H,U)=>X.replace(W,B,H,Y(W,U)),Z={add:async(W,B)=>{let H=await X.read(),j=(H.status==="ready"?H.rows:[]).filter((F)=>F.type==="oauth"&&!F.invalid),N=W.identity?j.find((F)=>F.identity===W.identity):void 0;if(N?.id===U1)throw new k6("main-account",_B);let K=N??j.find((F)=>F.id===W.id&&F.id!==U1);if(!K||W.credential.type!=="oauth")return X.add(W,B);let q=await G(K.id,W.credential,W.identity!==void 0?{identity:W.identity}:{},B?.extraLocks?{extraLocks:B.extraLocks}:void 0);return e6.info("account signed in again",{id:K.id}),{id:q.id,outcome:"rotated",credential:q.credential,credentialEpoch:q.credentialEpoch}},replace:G,enable:(W,B)=>X.enable(W,Y(W,B)),disable:(W,B,H)=>X.disable(W,B,Y(W,H)),remove:(W,B)=>X.remove(W,Y(W,B))};return new Proxy(X,{get(W,B){if(Object.hasOwn(Z,B))return Z[B];let H=Reflect.get(W,B,W);return typeof H==="function"?H.bind(W):H}})}async function K1(X,J,$){await I7(X).updateSettings((Y)=>{$(Y);return},J?{extraLocks:J}:{})}var MM=["version","accounts","commonAuthPool"];function A$(X,J){return async($)=>{let Y;if(await I7(X).updateSettings((G)=>{let Q={...G,version:1,accounts:[]},z=$(Q)??Q;Y=z;let Z={...z};for(let W of MM)delete Z[W];return Z},J?{extraLocks:J}:{}),!Y)throw Error("the settings write did not run");return Y}}var CB="migration";function M$(X){let J=["Accounts move to the new account layout once every OpenCode process on this machine runs this version of OpenAI auth. This menu works on that layout, so it opens after the move.",X.length>0?"These processes still hold the move back:":"No running process holds the move back."],$={command:p6,title:_$,sections:[{id:CB,slot:"extra",title:"Accounts are moving",lines:J,items:X.map((Y,G)=>({id:`blocker-${G}`,label:Y.pid==="unknown"?"processes that could not be read":`pid ${Y.pid}`,detail:`version ${Y.version}`,actions:[]})),actions:[]}]};return TM($)}var _M=new Set(["access","refresh","apikey","authheader","password","credential","credentials"]);function AM(X){let J=X.toLowerCase().replace(/[-_]/g,"");if(_M.has(J))return!0;return J.endsWith("token")||J.endsWith("key")||J.endsWith("secret")}function S7(X,J,$){if(Array.isArray(X))return X.map((G,Q)=>S7(G,`${J}[${Q}]`,$));if(!s(X))return X;let Y={};for(let[G,Q]of Object.entries(X)){if(AM(G)){$.push(`${J}.${G}`);continue}Y[G]=S7(Q,`${J}.${G}`,$)}return Y}function TM(X){let J=[],$=S7(X,"menu",J);if(J.length>0)e6.warn("credential-shaped field stripped before RPC",{fields:J});return $}function EB(X){return{id:X.id,credential:{type:"oauth",refresh:X.refresh,...X.access!==void 0?{access:X.access}:{},...X.expires!==void 0?{expires:X.expires}:{}},...X.accountId!==void 0?{identity:X.accountId}:{},...X.label!==void 0?{label:X.label}:{}}}function SB(X){return{label:"Add account",knobs:[{kind:"text",id:"label",label:"Label (optional)"},{kind:"toggle",id:"headless",label:"Sign in with a device code (no browser on this machine)",value:!1}],run:async(J)=>{let $=typeof J.label==="string"&&J.label.trim().length>0?J.label.trim():void 0,Y=J.headless===!0,G=await X.begin({...$!==void 0?{label:$}:{},headless:Y}),Q=Y?`Open this verification URL:
-
-${G.url}
-
-Then enter the code: ${G.instructions.match(/Enter code: (.+)/)?.[1]??G.instructions}
-
-The account is added when you finish.`:`Open this URL and complete sign-in:
-
-${G.url}
-
-${G.instructions}
-
-The account is added when you finish.`,z=G.completion.then(async(Z)=>{let W=await X.mainIdentity?.();if(Z.accountId&&W&&Z.accountId===W)throw e6.warn("account add rejected (main identity)",{id:Z.id}),new k6("main-account",_B);return e6.info("account added",{id:Z.id}),EB(Z)});return{status:"pending",message:Q,completion:z}}}}function T$(X){return{id:"session",title:"This session",build:async(J)=>{let $=J.sessionId;if(!$)return{lines:["No current session"]};let Y=await X.getPin?.($);return{lines:[Y?`Pinned to ${Y}`:"No sticky pin"],actions:X.clearPin?[{id:"clear-pin",label:"Clear this session's pin",description:"The next request may still choose the same account.",run:async({invocation:G})=>{if(!G.sessionId)return"No current session.";return await X.clearPin?.(G.sessionId),e6.info("routing session pin cleared"),"This session's pin was cleared. The next request may choose the same account if it remains the best selection."}}]:[]}}}}function R$(X){let{vault:J}=X;return{id:"vault",title:"Vault",build:async()=>{let $=await J.status(),Y=await J.authority()!=="local",G=J.routes().length;return{lines:[Y?`Connected · ${$.accounts.length} account${$.accounts.length===1?"":"s"}`:$.enrollment.state==="idle"?"Not connected":`Enrollment ${$.enrollment.state}`,N3($.host,$.name,$.enrollment),...J4($.name,$.enrollment),...Y?[$.accounts.length===0?"The vault serves no OpenAI account to this host yet.":`The vault serves ${$.accounts.length} OpenAI account${$.accounts.length===1?"":"s"}; ${G} can route now.`]:[],...Y&&J.snapshot()?.complete===!1?["The vault's last list had records this host could not read; accounts it did not list are kept as they were until a complete list arrives."]:[],...$.lastError?[`Last error: ${$.lastError}`]:[]],items:$.accounts.map((Q)=>({id:Q.routeId,label:y8(Q),group:"Accounts",status:Q.enabled?Q.state:"disabled",detail:[Q.credentialType==="api_key"?"API key":"login",Q.state==="active"?"active":`vault state ${Q.state}`,Q.enabled?"enabled":"disabled here"].join(", "),actions:[Q.enabled?{id:"disable",label:"Disable on this host",description:"It stays in the vault and in this list, and is never sent from this host until enabled again.",run:async()=>{return await J.decline(Q.routeId),await X.changed?.(),`${y8(Q)} is disabled on this host.`}}:{id:"enable",label:"Enable on this host",run:async()=>{return await J.accept(Q.routeId),await X.changed?.(),`${y8(Q)} is enabled on this host.`}}]})),actions:Y?[{id:"disconnect",label:"Disconnect",description:"Forgets this host's vault token; its vault accounts stop routing at once. Revoke the enrollment itself with `ck auth enroll revoke`.",confirm:"Disconnect from the vault? Connecting again needs a new approval with `ck`.",run:async()=>{return await J.disconnect(),await X.changed?.(),`Disconnected: ${J.name} no longer reads from the vault. Run \`ck auth enroll revoke --name ${J.name}\` to revoke it in the vault too.`}}]:[{id:"connect",label:"Connect",description:"Asks the vault to enroll this host; you approve the request with `ck`.",run:async({invocation:Q})=>{let z=await J.connectStep();if(z.state!=="pending"&&z.state!=="busy")return await X.changed?.(),q3(J,z);return J.waitForApproval(X.wait).then(async(Z)=>{await X.changed?.();let W=q3(J,Z);Q.notify(W.text,W.ok?"info":"warning")}).catch((Z)=>{Q.notify(`Connecting to the vault failed: ${Z instanceof Error?Z.message:String(Z)}`,"error")}),{ok:!0,text:[...J4(J.name,z),"Waiting for the approval; you are told here when it lands."].join(`
-`)}}}]}}}}async function MB(X,J,$){if(!x8(J))return t6(J,"invalid_account_key","That account cannot take a reset credit.");let Y;try{let G=(await X.loadAccounts({configPath:X.configPath,statePath:X.statePath}))?.reset?.[J];if($||G&&Object.hasOwn(G,"inFlight"))Y=(await X.resolveResetTarget(J)).chatgptAccountId;else{let z=await xB(J,X);if(!z.eligible)return t6(J,"not_eligible",wB(z));Y=z.chatgptAccountId}if(!Y)return t6(J,"not_eligible","Cannot reset: stable ChatGPT account identity unavailable.");e6.info("reset redemption decision",{accountKey:J,retry:$});let Q=await cW({configPath:X.configPath,statePath:X.statePath,mutateAccountsFn:X.mutateAccounts,loadAccountsFn:X.loadAccounts,now:X.now,randomUUID:X.randomUUID,fetchImpl:X.fetchImpl,resolveTarget:X.resolveResetTarget,fetchUsage:(z)=>b8({accessToken:z.accessToken,fetchImpl:X.fetchImpl,now:X.now,accountId:z.chatgptAccountId}),hasActiveRateLimitMark:(z)=>X.quotaManager.isRateLimited(z)},{accountKey:J,expectedChatgptAccountId:Y,retry:$});return e6.info("reset redemption outcome",{accountKey:J,code:Q.outcome.kind}),vB(Q,X,Y)}catch(G){let Q=SM(J,G,Y);return e6.info("reset redemption outcome",{accountKey:J,code:Q.code}),Q}}function C$(X){return{id:"reset",title:"Reset credits",build:async()=>({lines:["Restore exhausted quota"],items:(await X.accountKeys()).map((J)=>({id:J,group:"Accounts",label:J===U1?"Main account":J,actions:[{id:"preview",label:"Preview",description:"Fetch the account's current quota and reset credits before spending a credit.",run:async()=>{let $=await xB(J,X);return{ok:$.eligible,text:`${EM($)}
-
-${wB($)}`}}},{id:"spend",label:"Spend a reset credit",irreversible:!0,confirm:"Spend one reset credit on this account? Its eligibility is checked again first, and nothing is spent when it is not eligible.",run:async()=>{let{ok:$,text:Y}=await MB(X,J,!1);return{ok:$,text:Y}}},{id:"retry",label:"Retry the last redemption",irreversible:!0,confirm:"Retry the last redemption? A retry within five minutes reuses the same request and credit identifiers.",run:async()=>{let{ok:$,text:Y}=await MB(X,J,!0);return{ok:$,text:Y}}}]}))})}}var IB=[{value:"main-first",label:"Main first"},{value:"fallback-first",label:"Fallback first"}],bB=["primary","secondary"];function E$(X){let J={command:p6,title:_$,store:P$(I7(b7(X.store,{...X.rowLocks?{rowLocks:X.rowLocks}:{}}))),...X.extraLocks?{extraLocks:X.extraLocks}:{},accounts:{...X.login?{login:SB(X.login)}:{},...X.protect?{protect:X.protect}:{},...X.describeIdentity?{describeIdentity:X.describeIdentity}:{}},quota:X.quotaCheck?{check:X.quotaCheck}:{},routing:{orderedVariants:IB,formerMainId:U1},limits:{labels:bB},...X.cache?{cache:X.cache}:{},...X.diagnostics?{diagnostics:X.diagnostics}:{},...X.extras?{extras:X.extras}:{},...X.logger?{logger:X.logger}:{},...X.now?{now:X.now}:{}},$=X.vault?PB(J,X.vault):i9(J),Y=(G)=>{let{sessionId:Q}=G,z=G.notify.bind(G);return{...Q!==void 0?{sessionId:Q}:{},notify:z}};return{command:p6,async open(G){let Q=Y(G),z=X.vault&&await X.vault.authority()!=="local"?void 0:await X.migration?.();if(z&&!z.migrated)return{command:p6,menu:M$(z.blockers)};return $.open(Q)},async apply(G,Q){let z=Y(Q),Z=X.vault&&await X.vault.authority()!=="local"?void 0:await X.migration?.();if(Z&&!Z.migrated)return{command:p6,ok:!1,text:"Nothing was changed: the accounts have not moved to the new layout yet.",menu:M$(Z.blockers)};let W=await $.apply(G,z);if(W.ok)await X.afterApply?.();return W}}}function kB(X){let J=[X.primary?.usedPercent,X.secondary?.usedPercent].filter(($)=>$!==void 0);return J.length>0?Math.max(...J):void 0}function RM(X,J){let $=[X.primary,X.secondary].filter((G)=>G!==void 0),Y=$.filter((G)=>K3(G,J));return(Y.length>0?Y:$).sort((G,Q)=>Q.usedPercent-G.usedPercent)[0]?.resetsAt}function CM(X,J){if(!X)return!1;let $=[X.primary,X.secondary].filter((Y)=>Y!==void 0);if($.length===0)return!1;return $.every((Y)=>!K3(Y,J))}async function xB(X,J){let $;try{$=await J.resolveResetTarget(X);let Y=$.accountKey==="main"?void 0:$.chatgptAccountId,[G,Q]=await Promise.all([b8({accessToken:$.accessToken,fetchImpl:J.fetchImpl,now:J.now,accountId:$.chatgptAccountId}),$$(J.fetchImpl,$.accessToken,Y)]),z=A7(Q.credits),Z=pW(Q.credits),W=Q.availableCount??G.resetCreditsAvailable??(Z>0?Z:void 0),B=G.resetCreditsApplicable,H=J$(G,J.quotaManager.isRateLimited(X),J.now()),U;if(!$.chatgptAccountId)U="stable ChatGPT account identity unavailable";else if(!H.ok)U=H.reason;else if(!z)U="no eligible credit";return{accountKey:$.accountKey,label:$.label,chatgptAccountId:$.chatgptAccountId,usedPercent:kB(G),resetTime:RM(G,J.now()),availableCount:W,applicableAvailableCount:B,eligible:U===void 0,reason:U,selectedCreditId:z?.id,selectedCreditExpiresAt:z?.expiresAt}}catch(Y){if(Y?.status===401)await $?.onAuthFailure?.(401);return e6.warn("reset preview row failed",{accountKey:X,error:Y?.message??String(Y)}),{accountKey:X,label:X==="main"?"Main account":X,eligible:!1,reason:Y?.message??String(Y)}}}function EM(X){let J=X.usedPercent===void 0?"quota unavailable":`${X.usedPercent}% used`,$=X.availableCount===void 0?"credits unavailable":`${X.applicableAvailableCount===void 0?"?":X.applicableAvailableCount}/${X.availableCount} applicable/available`,Y=X.eligible?`eligible · credit ${X.selectedCreditId} expires ${X.selectedCreditExpiresAt}`:X.reason;return`${J}; ${$}; ${Y}`}function wB(X){let J=["## Confirm reset credit","",`Account: **${X.label}** (\`${X.accountKey}\`)`,`Current quota: **${X.usedPercent??"unknown"}% used**`,`Credit: **Spend 1 of ${X.availableCount??"unknown"}**`,`Credit expires: **${X.selectedCreditExpiresAt??"unavailable"}**`,`Quota resets: **${X.resetTime??"unavailable"}**`,""];if((X.availableCount??0)>0&&X.applicableAvailableCount===0)J.push("The server does not currently count this credit as applicable; redemption may return a no-op, and a no-op does not spend the credit."),J.push("");if(X.eligible&&X.chatgptAccountId)J.push('Eligible: choose "Spend a reset credit" to redeem one.');else J.push(`Cannot reset: **${X.reason??"not eligible"}**`);return J.join(`
-`)}function t6(X,J,$,Y={}){if(Object.keys(Y).length>0)e6.debug("reset step details",{accountKey:X,code:J,...Y});return{ok:J==="reset"||J==="already_redeemed",code:J,text:$}}function SM(X,J,$){if(J instanceof o6){let G={identity_mismatch:"The account identity changed before redemption. Reopen the reset account list.",pair_identity_mismatch:"Nothing was sent: the saved redemption was started while this account was signed in as a different ChatGPT account. Sign this account back in as that ChatGPT account and retry, or wait until five minutes after the saved redemption started and spend a new credit.",invalid_account_key:"The selected account key is reserved. Reopen the reset account list.",cooldown_active:"This account just reset — re-checking quota. Wait for the cooldown before another redemption.",expired_unreconciled:"The previous attempt outcome is unknown — retry replays the same identifiers, or wait until quota reflects the earlier attempt.",retry_without_inflight:"There is no active reset redemption to retry. Reopen the account list.",not_exhausted:"No credit was spent: the fresh account state is not exhausted.",no_eligible_credit:"No credit was spent: no eligible credit was returned."};return t6(X,J.kind,`## Reset credit
-
-${G[J.kind]}
-
-Code: \`${J.kind}\``,{cooldownUntil:J.cooldownUntil,...J.kind==="expired_unreconciled"?{chatgptAccountId:$,retryGuidance:"Retry replays the same request and credit identifiers from the previous attempt."}:{}})}let Y=J?.code;if(Y==="unknown_account"||Y==="disabled_account"||Y==="non_oauth_account"||Y==="token_unavailable")return t6(X,Y,`## Reset credit
-
-${{unknown_account:"Account unavailable: the selected account no longer exists. Reopen the reset account list.",disabled_account:"Account unavailable: the selected account is disabled. Reopen the reset account list.",non_oauth_account:"Account unavailable: the selected account is not authenticated with OAuth. Reopen the reset account list.",token_unavailable:"Authentication problem: the selected account token is unavailable. Reauthenticate the account before retrying."}[Y]}
-
-Code: \`${Y}\``);if(J instanceof W1)return t6(X,J.kind,`## Reset credit
-
-No redemption was attempted: reset credit availability could not be loaded.
-
-Code: \`${J.kind}\``);return e6.warn("reset command failed before a known result",{accountKey:X,error:J?.message??String(J)}),t6(X,"error",`## Reset credit
-
-The reset request failed before a known result: internal command failure — see plugin log.`)}async function vB(X,J,$){let{accountKey:Y}=X.target,G=X.outcome.kind;if(X.finalizeStateWriteFailed)return t6(Y,G,`## Reset credit result
-
-Account: **${X.target.label}** (\`${Y}\`)
-
-The server outcome recorded as \`${G}\`, but the state write failed. A retry within five minutes reuses the same request and credit identifiers; this does not prove the server did nothing.`,{stateWriteFailed:!0,retryGuidance:X.retrySafety,chatgptAccountId:$});if(G==="reset"||G==="already_redeemed"){let z={account:Y,ok:!1,error:"targeted quota refresh did not complete"};try{z=await J.refreshResetTargetQuota(Y)}catch(N){z.error=N?.message??String(N)}let Z=!z.ok&&z.error!==void 0;if(Z)e6.warn("reset quota re-check failed",{accountKey:Y,error:z.error});let W=Y==="main"?J.quotaManager.getMain():J.quotaManager.getFallback(Y),B=z.ok&&CM(W?.quota,J.now()),H=W?.quota.resetCreditsApplicable,U=B?"Post-verification: **window fresh**.":`Post-verification: **window not yet refreshed** (server code \`${G}\`).`,j=Z?`
-
-quota re-check failed — see log.`:"";return t6(Y,G,`## Reset credit result
-
-Account: **${X.target.label}** (\`${Y}\`)
-
-Code: \`${G}\`
-
-${U}${j}${H===void 0?"":`
-
-Remaining applicable credits: **${H}**`}`,{verifiedFresh:B,afterUsedPercent:kB(W?.quota??{}),remainingCredits:H})}if(G==="ambiguous_local")return t6(Y,G,`## Reset credit result
-
-Account: **${X.target.label}** (\`${Y}\`)
-
-Code: \`${G}\`
-
-${X.retrySafety}`,{retryGuidance:X.retrySafety});if(G==="ambiguous"||G==="http_error"){let z=X.refused?' The server refused the request; five minutes after the redemption started, "Spend a reset credit" starts a new one instead.':"";return t6(Y,G,`## Reset credit result
-
-Account: **${X.target.label}** (\`${Y}\`)
-
-The redemption outcome is unknown (\`${G}\`).
-
-Retry with "Retry the last redemption" on this account. A retry within five minutes reuses the same request and credit identifiers; this does not prove the server did nothing.${z}`,{retryGuidance:X.retrySafety,chatgptAccountId:$})}let Q={nothing_to_reset:"The server found no exhausted quota window to reset. No reset was confirmed. A new attempt starts fresh and must pass the current preconditions.",no_credit:"The server found no usable reset credit. No reset was confirmed. A new attempt starts fresh and must pass the current preconditions."};return t6(Y,G,`## Reset credit result
-
-Account: **${X.target.label}** (\`${Y}\`)
-
-Code: \`${G}\`
-
-${Q[G]??"The server returned a no-op result. No reset was confirmed."}`)}function sf(X,J,$){let Y=X.get(J.sessionId),G=new Set(J.validPinnedAccountIds);if(Y&&!J.excludeAccountIds.includes(Y.accountId)&&v4(Y,G,J.wireAccountIdByAccount[Y.accountId])){if(J.persist){let W=J.quotaCheckedAtByAccount[Y.accountId];$(J.sessionId,{accountId:Y.accountId,inputBytes:J.requestBytes,...Y.wireIdentity!==void 0?{wireIdentity:Y.wireIdentity}:{},...W!==void 0?{quotaCheckedAt:W}:{}})}return{accountId:Y.accountId}}let Q=new Map(Object.entries(J.quotaCheckedAtByAccount)),z=X5(X,Q,J.sessionId),Z=J.select(z);if(!Z)return;if(J.persist){let W=J.wireAccountIdByAccount[Z.accountId];$(J.sessionId,{accountId:Z.accountId,inputBytes:J.requestBytes,...W!==void 0?{wireIdentity:W}:{},...Z.quotaCheckedAt!==void 0?{quotaCheckedAt:Z.quotaCheckedAt}:{}})}return{accountId:Z.accountId}}import{statSync as IM}from"node:fs";var yB=30000,bM=8,kM=1800000;function P3(X){return X.identity?`identity:${X.identity}`:`row:${X.id}`}function S$(X){try{let J=IM(X);return`${J.ino}:${J.size}:${J.mtimeMs}`}catch{return"-"}}function Y4(X){let J=X.credential;if(J?.type!=="oauth")return;return{access:J.access??"",expires:J.expires,refresh:J.refresh}}function I$(X,J){try{return V7(X,J)}catch{return X}}function hB(X,J,$){let Y=P3(J);X.set(Y,[...X.get(Y)??[],{credentialEpoch:J.credentialEpoch,identity:J.identity,observation:$}].slice(-bM))}function fB(X,J,$){let Y=X;for(let G of J.get(P3(X))??[]){if(!($-G.observation.checkedAt<=kM)||G.credentialEpoch!==X.credentialEpoch||G.identity!==X.identity)continue;Y={...Y,quota:I$(Y.quota,G.observation)}}return Y}function gB(X,J,$,Y){let G=s6(X);if(typeof J?.status==="number"||k5(J)){let z=p1({error:J,now:$,refreshToken:X,...Y?{previous:{message:"",checkedAt:$,nextRetryAt:Y.nextRetryAt,retryCount:Y.retryCount,tokenHash:Y.tokenHash}}:{}});return{nextRetryAt:z.nextRetryAt,tokenHash:G,retryCount:z.retryCount}}return{nextRetryAt:$+yB,tokenHash:G,retryCount:Y?.tokenHash===G?Y.retryCount:0}}function mB(X,J,$,Y){let G=new Map;for(let Q of X){if(Y(Q,$))continue;let z=J.get(Q.id);G.set(Q.id,z&&z.nextRetryAt>$?z.nextRetryAt:$+yB)}return G}var b$=Z0("quota"),uB="the account holds a tombstone from the removed vault custody, not a credential";function xM(X){return X?.status===401}async function G4(X,J={}){let $=X.whamFn;if(!$)throw Error("whamFn is required for refreshAllQuota");let Y=[],G=X.logger??b$,Q=(K)=>{Y.push(K);let q={pid:process.pid,accountId:K.account,status:K.ok?"ok":"error",...K.error?{error:K.error}:{}};if(K.ok)G.debug("quota refresh succeeded",q);else G.warn("quota refresh failed",q)},z=X.skipFresherThanMs,Z=!1,W;if(z!==void 0)try{W=await X.readSidebarState()}catch{}let B=new Map(W?.fallbacks.map((K)=>[K.id,K])??[]),H=(...K)=>z!==void 0&&K.some((q)=>typeof q==="number"&&Number.isFinite(q)&&q<=X.now()&&X.now()-q<z),U=await X.loadAccounts(X.paths).catch(()=>{return}),j=U?.mainAccountId??X.storageMainAccountId,N;if(!J.accountKey||J.accountKey==="main")try{let K=await X.getAuth();if(C6(K)){if(N=Z9(U),!N)Q({account:"main",ok:!1,error:T0(K)?uB:"main account row is missing from the account pool"})}else if(K.type==="oauth"){let q=W&&j!==void 0&&W.main.mainAccountId===j?W.main.quota:void 0;if(H(X.quotaManager.peekMainForPolicy(j)?.checkedAt,q?.primary?.checkedAt,q?.secondary?.checkedAt,q?.checkedAt))Q({account:"main",ok:!0});else{if(!K.access||(K.expires??0)<X.now()){let O=await X.refreshMainWithLease();K={...K,access:O.access,expires:O.expires}}if(K.access)if(X.respectBackoff&&X.quotaManager.isBackedOff())Q({account:"main",ok:!0});else{let O=await $({accessToken:K.access,fetchImpl:X.fetchImpl,now:X.now,accountId:j,accountKey:"main"});X.quotaManager.setMain(K.access,{quota:O,refreshAfter:X.now()+300000,checkedAt:X.now()},j,!0),Z=!0,Q({account:"main",ok:!0})}else if(!Y.some((O)=>O.account==="main"))Q({account:"main",ok:!1,error:"no access token"})}}else Q({account:"main",ok:!1,error:"auth type is not oauth"})}catch(K){Q({account:"main",ok:!1,error:e0(K)})}if(U)for(let K of U.accounts){let q=N!==void 0&&K===N;if(!q&&J.accountKey&&(J.accountKey==="main"||K.id!==J.accountKey))continue;if(!q&&X.isOAuthAccountFn(K)&&Q9(U,K)){if(J.accountKey)Q({account:K.id,ok:!1,error:"account holds the main credential while the main slot is live"});continue}let F=q?K.accountId??j:void 0,O=(_,C,L)=>{if(q)X.quotaManager.setMain(C,_,F,!0);else X.quotaManager.setFallback(K.id,_,C,!0,L)};if(K.enabled===!1||!X.isOAuthAccountFn(K)){if(J.accountKey)Q({account:K.id,ok:!1,error:"account is not an enabled OAuth fallback"});continue}try{let _=B.get(K.id),C=K.accountId,L=q?W&&F!==void 0&&W.main.mainAccountId===F?W.main.quota:void 0:_&&C!==void 0&&_.accountId===C?_.quota:void 0;if(H(q?X.quotaManager.peekMainForPolicy(F)?.checkedAt:X.quotaManager.peekFallbackForPolicy(K.id,C)?.checkedAt,L?.primary?.checkedAt,L?.secondary?.checkedAt,L?.checkedAt)){Q({account:K.id,ok:!0});continue}if(X.respectBackoff&&(q?X.quotaManager.isBackedOff():X.quotaManager.isFallbackBackedOff(K.id,K.access))){Q({account:K.id,ok:!0});continue}let P=K.lastRefreshError;if(r0(P,K.refresh,X.now())){Q({account:K.id,ok:!1,error:X9(P,X.now()),permanent:!0});continue}if(T0(K)){Q({account:K.id,ok:!1,error:uB});continue}let A;try{A=q?await X.fallbackManager.refreshAccount(K,U,{asPoolMain:!0}):await X.fallbackManager.refreshAccount(K,U)}catch(k){b$.warn("fallback token refresh failed during quota poll",{pid:process.pid,accountId:K.id,error:e0(k)}),A=K}if(!A.access||(A.expires??0)<X.now()){Q({account:K.id,ok:!1,error:"no usable access token"});continue}let T;try{T=await $({accessToken:A.access,fetchImpl:X.fetchImpl,now:X.now,accountId:A.accountId,accountKey:K.id})}catch(k){if(!xM(k))throw k;if(b$.warn("quota endpoint rejected the token; forcing a refresh",{pid:process.pid,accountId:K.id}),A=await X.fallbackManager.refreshAccount(K,U,q?{force:!0,asPoolMain:!0}:{force:!0}),!A.access){Q({account:K.id,ok:!1,error:"no usable access token after forced refresh"});continue}T=await $({accessToken:A.access,fetchImpl:X.fetchImpl,now:X.now,accountId:A.accountId,accountKey:K.id})}O({quota:T,refreshAfter:X.now()+300000,checkedAt:X.now()},A.access,A.accountId),Z=!0,Q({account:K.id,ok:!0})}catch(_){Q({account:K.id,ok:!1,error:e0(_)})}}if(J.accountKey&&J.accountKey!=="main"&&!Y.some((K)=>K.account===J.accountKey))Y.push({account:J.accountKey,ok:!1,error:"account not found"});if(z===void 0||Z){let K=await X.loadAccounts(X.paths);await X.writeSidebarState(X.quotaManager,K)}return Y}import{types as wM}from"node:util";var vM=/"(?:e|\\u0065)(?:r|\\u0072){2}(?:o|\\u006f)(?:r|\\u0072)"\s*:/i,yM=/"(?:t|\\u0074)(?:y|\\u0079)(?:p|\\u0070)(?:e|\\u0065)"\s*:\s*"(?:e|\\u0065)(?:r|\\u0072){2}(?:o|\\u006f)(?:r|\\u0072)"/i;function iB(X){return X.replace(/\\(?:u([a-f\d]{4})|(["\\/bfnrt]))/gi,(J,$,Y)=>{if($)return String.fromCharCode(Number.parseInt($,16));return{b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t"}[Y]??Y??J})}function hM(X,J){if(!J)return X;let $=X.split(J).join("[credential]"),Y=J.replace(/\s/g,"");if(!Y)return $;let G=$.replace(/\s/g,"");if(!G.includes(Y))return $;let Q=[];for(let W=0;W<$.length;W++){let B=$[W]??"";if(!/\s/.test(B))Q.push(W)}let z=[],Z=0;for(let W=G.indexOf(Y);W>=0;W=G.indexOf(Y,W+Y.length)){let B=Q[W]??Z,H=(Q[W+Y.length-1]??B)+1;z.push($.slice(Z,B),"[credential]"),Z=H}return z.length?z.join("")+$.slice(Z):$}function pB(X,J){let $=hM(X,J);return dB($).replaceAll("***REDACTED***","[credential]")}function Q4(X,J){let $=pB(X,J),Y=iB($),G=pB(Y,J);return G===Y?$:G}function cB(X){let J=/^(-?)(0|[1-9]\d*)(?:\.(\d+))?(?:[eE]([+-]?\d+))?$/.exec(X);if(!J)return;let $=J[3]??"",Y=(J[2]??"")+$,G=0;while(Y[G]==="0")G++;if(G===Y.length)return"0";let Q=Y.length;while(Y[Q-1]==="0")Q--;let z=J[4]??"0",Z=z.startsWith("-")||z.startsWith("+")?1:0;while(z[Z]==="0")Z++;let W=z.slice(Z)||"0";if(W.length>16)return;let B=BigInt((z.startsWith("-")?"-":"")+W)-BigInt($.length)+BigInt(Y.length-Q);return`${J[1]}${Y.slice(G,Q)}e${B}`}function nB(X,J){let $=J?cB(J):void 0;return X.replace(/"(?:\\.|[^"\\])*"|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null/g,(Y)=>{if(!Y.startsWith('"'))return J&&(Y===J||$!==void 0&&cB(Y)===$||(J==="Infinity"||J==="-Infinity")&&/^[-\d]/.test(Y)&&String(Number(Y))===J)?'"[credential]"':Y;let G=iB(Y.slice(1,-1)),Q=Q4(G,J);return Q===G?Y:JSON.stringify(Q)})}function k$(X,J){let $=nB(X,J);try{return JSON.parse(X),$}catch{return Q4($,J)}}var fM=16384,gM=65536,mM=[/429|500|502|503|504|524/i,/rate increased too quickly|rate limit|rate-limit|rate_limit|too many requests/i,/overloaded|service unavailable|service_unavailable|service-unavailable|internal error|internal_error|internal server error|server error|server_error|server-error|provider returned error|provider_returned_error|provider-returned-error/i,/terminated|fetch failed|failed to fetch|network[-_\s]error|upstream connect|connection error|connection refused|connection lost|socket connection was closed|socket hang up|reset before headers|getaddrinfo|enotfound|eai_again|econnrefused|econnreset|etimedout/i,/^timeout$|\b(?:request|response|connection|network|stream|read) (?:timeout|timed out|time out)\b/i,/try your request again|retry your request|resource exhausted|resource_exhausted/i,/\btry again (?:later|in\b)|\b(?:currently|temporarily) at capacity\b/i];function uM(X){try{let J=X6(JSON.parse(X),"request_id");if(typeof J==="string")return J;if(typeof J!=="number")return;let $=0,Y,G=!0,Q=!1,z;for(let Z of X.matchAll(/"(?:\\.|[^"\\])*"|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?|[{}[\]:,]/g)){let W=Z[0];if(W==="{"||W==="["){$++;continue}if(W==="}"||W==="]"){$--;continue}if($!==1)continue;if(W===","){G=!0,Q=!1,Y=void 0;continue}if(W===":"){Q=!0;continue}if(G&&W.startsWith('"')){Y=JSON.parse(W),G=!1;continue}if(Q&&Y==="request_id"&&!W.startsWith('"'))z=W;Q=!1}return z}catch{return}}function pM(X,J){let $=k$(X,J);if(Buffer.byteLength($,"utf8")<=gM)return $;let Y=mM.flatMap((Q)=>Q.exec($)?.[0]??[]);for(let Q of["FreeUsageLimitError","GoUsageLimitError"])if($.includes(Q))Y.push(Q);let G={retry:Y};try{let Q=JSON.parse($);if(X6(Q,"type")==="error")G.type="error";let z=X6(Q,"error"),Z={};for(let B of["code","type"]){let H=X6(z,B);if(typeof H==="string")Z[B]=H.slice(0,256)}if(Object.keys(Z).length)G.error=Z;let W={};for(let B of["workspace","limitName"]){let H=X6(X6(Q,"metadata"),B);if(typeof H==="string")W[B]=H.slice(0,256)}if(Object.keys(W).length)G.metadata=W}catch{}return JSON.stringify(G)}function k7(X){if(!X||typeof X!=="object")return!1;let J=X;for(let $=0;J&&$<16;$++){if(wM.isProxy(J))return!1;J=Object.getPrototypeOf(J)}return J===null}function X6(X,J){if(!k7(X))return;let $=Object.getOwnPropertyDescriptor(X,J);return $&&"value"in $?$.value:void 0}function O3(X,J){return Q4(X,J).slice(0,fM)}function z4(X,J){let $=Object.getOwnPropertyDescriptor(X,J)?.get;if(!$)throw Error(`Missing native ${J} accessor`);return $}var cM=z4(DOMException.prototype,"message"),lM=z4(DOMException.prototype,"name");function j8(X,J){let $=X6(X,"message"),Y=X6(X,"name");if(k7(X)&&X instanceof DOMException)try{$=cM.call(X),Y=lM.call(X)}catch{}let G=Error(O3(typeof $==="string"?$:typeof X==="string"?X:"Provider request failed",J));for(let U of Object.getOwnPropertyNames(G))if(U!=="message")Reflect.deleteProperty(G,U);Object.defineProperty(G,"name",{value:typeof Y==="string"?O3(Y,J):"Error",configurable:!0,writable:!0});let Q=(U,j,N)=>{let K=X6(U,N);if(typeof K==="string"||typeof K==="number"&&Number.isFinite(K)||typeof K==="boolean")Object.defineProperty(j,N,{value:typeof K==="string"?O3(K,J):K,enumerable:!0,configurable:!0,writable:!0})};for(let U of["status","statusCode","status_code","resets_at","resets_in_seconds"]){let j=X6(X,U);if(typeof j==="number"&&Number.isFinite(j))Q(X,G,U)}for(let U of["code","type","isRetryable"])Q(X,G,U);for(let U of["error","data"]){let j=X6(X,U),N=Object.create(null);for(let q of["type","code","message","resets_at","resets_in_seconds"])Q(j,N,q);let K=X6(j,"error");if(k7(K)){let q=Object.create(null);for(let F of["type","code","message","resets_at","resets_in_seconds"])Q(K,q,F);N.error=q}if(Object.keys(N).length)Object.defineProperty(G,U,{value:N,enumerable:!0})}let z=X6(X,"responseHeaders");if(z&&typeof z==="object"){let U={};for(let j of["retry-after-ms","retry-after"]){let N=X6(z,j);if(typeof N==="string")U[j]=O3(N,J)}Object.defineProperty(G,"responseHeaders",{value:U,enumerable:!0})}let Z=X6(X,"responseBody");if(typeof Z==="string")Object.defineProperty(G,"responseBody",{value:pM(Z,J),enumerable:!0});let W=X6(X,"request_id"),B=X6(z,"x-request-id"),H=typeof W==="string"?W:typeof B==="string"?B:typeof Z==="string"?uM(k$(Z,J)):void 0;if(typeof H==="string")Object.defineProperty(G,"request_id",{value:O3(H,J),enumerable:!0});for(let U of["vercel.ai.error","vercel.ai.error.AI_APICallError"]){let j=Symbol.for(U);if(X6(X,j)===!0)Object.defineProperty(G,j,{value:!0})}return G}function dM(X,J){if(!X.includes("error")&&(!X.includes("\\u00")||!vM.test(X)&&!yM.test(X)))return X;let $;try{$=JSON.parse(X)}catch{return X}if($?.type==="error"||$?.error||$?.response?.error)return nB(X,J);return X}var iM=z4(Response.prototype,"status"),nM=z4(Response.prototype,"statusText"),sM=z4(Response.prototype,"headers"),aM=z4(Response.prototype,"body"),oM=Response.prototype.text,lB=Headers.prototype.entries;async function j1(X,J,$="http"){try{let N=function(K){let q=j&&K.startsWith("\uFEFF")?"\uFEFF":"";return j=!1,q+K.slice(q.length).replace(/^data: ?([^\r\n]*)/gm,(F,O)=>F.slice(0,F.length-O.length)+dM(O,J))};if(!k7(X))throw Error("Invalid provider response");let Y=iM.call(X),G=sM.call(X),Q=aM.call(X),z=new Headers;for(let[K,q]of lB.call(G))z.append(K,q);let Z={status:Y,statusText:Q4(nM.call(X),J),headers:z};if(Y<200||Y>299){for(let[q,F]of lB.call(G)){if(Q4(q,J?.toLowerCase())!==q){Z.headers.delete(q);continue}try{Z.headers.set(q,Q4(F,J))}catch{Z.headers.delete(q)}}Z.headers.delete("content-length");let K=await oM.call(X);return new Response(k$(K,J),Z)}if(!Q||$==="http")return X;Z.headers.delete("content-length");let W=ReadableStream.prototype.getReader.call(Q),B=new TextDecoder("utf-8",{ignoreBOM:!0}),H=new TextEncoder,U="",j=!0;return new Response(new ReadableStream({async pull(K){try{for(;;){let q=await W.read();U+=B.decode(q.value,{stream:!q.done});let F=!1;for(;;){let O=/\r?\n\r?\n/.exec(U);if(!O)break;let _=O.index+O[0].length;K.enqueue(H.encode(N(U.slice(0,_)))),U=U.slice(_),F=!0}if(q.done){if(U)K.enqueue(H.encode(N(U)));K.close();return}if(F)return}}catch(q){K.error(j8(q,J))}},async cancel(K){try{await W.cancel(K)}catch(q){throw j8(q,J)}finally{W.releaseLock()}}}),Z)}catch(Y){throw j8(Y,J)}}import{readFile as GA}from"node:fs/promises";import{readFileSync as rM}from"node:fs";import{homedir as tM,tmpdir as eM}from"node:os";import{join as v7}from"node:path";var X_="https://chatgpt.com/backend-api/codex/responses",J_="openai-auth.json",b9={webSockets:"CORTEXKIT_OPENAI_AUTH_WEBSOCKETS",rawWebSocket:"CORTEXKIT_OPENAI_AUTH_RAW_WS",responsesLite:"CORTEXKIT_OPENAI_AUTH_RESPONSES_LITE",dump:"CORTEXKIT_OPENAI_AUTH_DUMP",dumpDir:"OPENCODE_OPENAI_AUTH_DUMP_DIR",codexApiEndpoint:"CORTEXKIT_OPENAI_AUTH_CODEX_ENDPOINT",configFile:"OPENCODE_OPENAI_AUTH_FILE",stateFile:"OPENCODE_OPENAI_AUTH_STATE_FILE",configDir:"OPENCODE_CONFIG_DIR"};function y7(){let X=process.env[b9.configDir]?.trim();if(X)return X;return v7(process.env.XDG_CONFIG_HOME||v7(tM(),".config"),"opencode")}function V0(){return process.env[b9.configFile]?.trim()||v7(y7(),J_)}function $_(){try{let X=JSON.parse(rM(V0(),"utf8"));return X!=null&&typeof X==="object"&&!Array.isArray(X)?X:{}}catch{return{}}}function Y_(X){let J=process.env[X];if(J===void 0)return;let $=J.trim().toLowerCase();if($==="1"||$==="true"||$==="yes"||$==="on")return!0;if($===""||$==="0"||$==="false"||$==="no"||$==="off")return!1;return}function x7(X,J,$){let Y=Y_(X);if(Y!==void 0)return Y;if(typeof J==="boolean")return J;return $}function G_(){let X=$_(),J;if(X.dump!==void 0&&X.dump!==null){if(typeof X.dump==="object")J=X.dump.enabled;else if(typeof X.dump==="boolean")J=X.dump}return{webSockets:x7(b9.webSockets,X.webSockets,!1),rawWebSocket:x7(b9.rawWebSocket,X.rawWebSocket,!1),responsesLite:x7(b9.responsesLite,X.responsesLite,!1),dump:x7(b9.dump,J,!1),dumpDir:process.env[b9.dumpDir]?.trim()||(typeof X.dumpDir==="string"&&X.dumpDir.trim()?X.dumpDir.trim():v7(eM(),"opencode-openai-auth-dumps")),codexApiEndpoint:process.env[b9.codexApiEndpoint]?.trim()||(typeof X.codexApiEndpoint==="string"&&X.codexApiEndpoint.trim()?X.codexApiEndpoint.trim():X_)}}var w7;function c6(){if(!w7)w7=G_();return w7}function sB(){return w7=void 0,c6()}import{realpathSync as aB}from"node:fs";import{homedir as Q_}from"node:os";import{basename as z_,dirname as Z_,join as f7,resolve as rB}from"node:path";function W_(){if(process.env.OPENCODE_CONFIG_DIR?.trim())return process.env.OPENCODE_CONFIG_DIR.trim();return f7(process.env.XDG_CONFIG_HOME||f7(Q_(),".config"),"opencode")}function tB(){return process.env.OPENCODE_OPENAI_AUTH_FILE?.trim()||f7(W_(),cJ)}function h7(X,J){let $=rB(X);return J==="win32"||J==="darwin"?$.toLowerCase():$}function oB(X){try{return aB.native(X)}catch{try{return f7(aB.native(Z_(X)),z_(X))}catch{return}}}function B_(X,J,$=process.platform){if(h7(X,$)===h7(J,$))return!0;let Y=oB(X),G=oB(J);return Y!==void 0&&G!==void 0&&h7(Y,$)===h7(G,$)}function x$(X=tB()){let J=process.env.OPENCODE_OPENAI_AUTH_STATE_FILE?.trim();if(J){if(B_(X,J))throw Error(`OPENCODE_OPENAI_AUTH_STATE_FILE resolves to the config path (${rB(X)}). Set OPENCODE_OPENAI_AUTH_STATE_FILE to a different file.`);return J}return lJ(X)}function M0(X=tB()){return{configPath:X,statePath:x$(X)}}import{createHash as y_}from"node:crypto";import{readFile as h_}from"node:fs/promises";import{homedir as f_}from"node:os";import{join as qH,resolve as g_}from"node:path";import{createHash as H_}from"node:crypto";import{readFileSync as V_}from"node:fs";import{readFile as U_}from"node:fs/promises";import{resolve as K_}from"node:path";var Z4="openai",j_="common-auth-placeholder:v1:openai",N1=Object.freeze({type:"oauth",access:"",refresh:j_,expires:0});function A3(X){if(!X8(X))return!1;return X.type===N1.type&&X.access===N1.access&&X.refresh===N1.refresh&&X.expires===N1.expires}var g7="openaiAuthPool",N_=120000,$H="pool-migration",v$="slot-transfer-origin-unknown",y$="Sign in again with `opencode auth login`, or re-enable the row only if this config root is the only one using that auth.json.",u7=Object.freeze({mainRefreshTtlMs:N_,fallbackTtlMs:rJ,saveTtlMs:1e4,renew:!0,timeoutMs:15000,retryMs:50});function m7(X,J,$){return X.kind==="placeholder"&&!J&&!$.pending}class M3 extends Error{constructor(X){super(`timed out waiting for the legacy ${X} lock`);this.name="LegacyLockContention"}}function X8(X){return X!=null&&typeof X==="object"&&!Array.isArray(X)}function q_(X){let J=X.now??Date.now;return{paths:X.paths,slot:X.slot,now:J,sleep:X.sleep??(($)=>new Promise((Y)=>setTimeout(Y,$))),newId:X.newId??(()=>crypto.randomUUID()),log:X.log??Z0("pool-migration"),...X.vaultServes?{vaultServes:X.vaultServes}:{},locks:{...u7,...X.legacyLocks},leaseWait:X.leaseWait??{timeoutMs:4000,pollMs:50},store:z8({provider:Z4,configPath:X.paths.configPath,statePath:X.paths.statePath,quota:m8,now:J,...X.store}),onStep:async($)=>{await X.onStep?.($)}}}async function B4(X){let J;try{J=await U_(X,"utf8")}catch(Y){if(Y.code==="ENOENT")return{};throw Y}let $=JSON.parse(J);if(!X8($))throw Error("config root is not an object");return $}async function _3(X,J,$,Y){let G=performance.now();for(;;){let Q=await g0({name:J,path:$,ttlMs:Y,now:X.now,renew:X.locks.renew,...X.locks.renewIntervalMs!==void 0?{renewIntervalMs:X.locks.renewIntervalMs}:{}});if(Q)return Q;if(performance.now()-G>=X.locks.timeoutMs)throw new M3(J);await X.sleep(X.locks.retryMs)}}async function YH(X,J,$={}){let Y={...u7,...$},G=performance.now();for(;;){let Q=await g0({name:g8,path:X,ttlMs:Y.mainRefreshTtlMs,renew:Y.renew,...Y.renewIntervalMs!==void 0?{renewIntervalMs:Y.renewIntervalMs}:{}});if(Q)try{return await J()}finally{await Q.release().catch(()=>{})}if(performance.now()-G>=Y.timeoutMs)throw new M3(g8);await new Promise((z)=>setTimeout(z,Y.retryMs))}}async function T3(X,J){let $=X.locks.saveTtlMs,Y=await _3(X,"save",X.paths.configPath,$);try{let G=await _3(X,"save",X.paths.statePath,$);try{let Q=await B4(X.paths.configPath);if(!await J(Q))return;await M6(X.paths.configPath,Q,{beforeRename:async()=>{await Y.assertOwned(),await G.assertOwned()}})}finally{await G.release().catch(()=>{})}}finally{await Y.release().catch(()=>{})}}function L_(X){if(!X8(X))return;let{rowId:J,operation:$,rowFingerprint:Y,slotFingerprint:G}=X,{credentialFingerprint:Q,carryLegacyMain:z,recordedAt:Z,identity:W}=X;if(typeof J!=="string"||!J)return;if($!=="add"&&$!=="rotate"&&$!=="replace")return;if(Y!==null&&typeof Y!=="string")return;if(typeof G!=="string")return;if(typeof Q!=="string")return;return{rowId:J,operation:$,rowFingerprint:Y,slotFingerprint:G,credentialFingerprint:Q,...typeof W==="string"&&W?{identity:W}:{},carryLegacyMain:z===!0,recordedAt:typeof Z==="number"?Z:0}}function GH(X,J){if(!X8(X)||!J)return!1;return N6(X).pending?.credentialFingerprint===Y8({type:"oauth",refresh:J})}function QH(X,J){let $;try{$=JSON.parse(V_(X,"utf8"))}catch{return!1}return GH($,J)}class p7 extends Error{constructor(){super("the account-pool migration is moving this token; not refreshing it");this.name="PoolTransferPendingError"}}var D_=600000;async function zH(X,J,$={}){let Y=$.now??Date.now,G=(W)=>{let B=N6(W).pending;return B&&GH(W,J)&&Y()-B.recordedAt>=D_?B:void 0},Q=G(await B4(X.configPath));if(!Q)return!1;let z={...u7,...$.legacyLocks},Z=await g0({name:$H,path:X.configPath,ttlMs:z.mainRefreshTtlMs,now:Y});if(!Z)return!1;try{let W=await B4(X.configPath),B=N6(W).migratedAt!==void 0,H=await z8({provider:Z4,configPath:X.configPath,statePath:X.statePath,quota:m8,now:Y}).read();if(B&&H.status!=="ready")return!1;let U;if(H.status==="ready"){let N=H.rows.find((q)=>q.id===Q.rowId&&!q.invalid),K=N?.fingerprint??null;if(B&&N&&K===Q.credentialFingerprint)return!1;if(N&&K!==Q.credentialFingerprint&&K!==Q.rowFingerprint)U=$.slotAccess!==void 0?g$({type:"oauth",access:$.slotAccess,refresh:J}):Q.slotFingerprint}let j=!1;if(await T3({paths:X,now:Y,locks:z,sleep:(N)=>new Promise((K)=>setTimeout(K,N))},(N)=>{let K=N6(N),q=G(N);if(!q||q.recordedAt!==Q.recordedAt)return!1;let{pending:F,...O}=K;return c7(N,U!==void 0?{...O,declinedSlotFingerprint:U}:O),j=!0,!0}),j)($.log??Z0("pool-migration")).warn(U!==void 0?"dropped an expired account-pool transfer record whose row was rotated since; the slot login is not adopted unless its refresh renews it":"dropped an expired account-pool transfer record so the slot refresh can resume",{rowId:Q.rowId,recordedAt:Q.recordedAt});return j}finally{await Z.release().catch(()=>{})}}function N6(X){let J=X[g7];if(!X8(J))return{};let $=L_(J.pending);return{...typeof J.migratedAt==="number"?{migratedAt:J.migratedAt}:{},...$?{pending:$}:{},...typeof J.declinedSlotFingerprint==="string"?{declinedSlotFingerprint:J.declinedSlotFingerprint}:{}}}function c7(X,J){let Y={...X8(X[g7])?X[g7]:{}};for(let G of["migratedAt","pending","declinedSlotFingerprint"])delete Y[G];Object.assign(Y,J),X[g7]=Y}function F_(X){let J=X?V6(X):void 0;return J?U6(J):void 0}function P_(X){let J=g$({type:"oauth",...X}),$=F_(X.access);return{kind:"real",credential:X,fingerprint:J,credentialFingerprint:Y8({type:"oauth",refresh:X.refresh}),...$?{identity:$}:{}}}function ZH(X){if(A3(X))return{kind:"placeholder",...X8(X)&&typeof X.accountId==="string"?{origin:X.accountId}:{}};let J=jH(X);if(!J?.refresh.trim())return{kind:"empty"};return P_(J)}async function R3(X){let J=await NH({client:{auth:{get:($)=>X.slot.get($),all:()=>X.slot.all()}},now:X.now,sleep:X.sleep});if(J.kind==="real")return ZH(J.oauth);return J.kind==="slot-absent"||J.kind==="indeterminate"?{kind:J.kind}:{kind:J.kind}}async function l7(X,J){if(!A3(J))return!1;let $=await B4(X.configPath),Y=await z8({provider:Z4,configPath:X.configPath,statePath:X.statePath,quota:m8}).read();if(Y.status==="error")return!1;let G=Y.status==="ready"?Y.rows.some((Q)=>Q.id==="main"):Y.roster.some((Q)=>X8(Q)&&Q.id==="main");return m7({kind:"placeholder"},G,N6($))}async function O_(X){let J=X.now()+X.leaseWait.timeoutMs;for(;;){let $=await R3(X);if($.kind!=="real")return $;if(!await WH(X,$.credential.refresh))return $;if(X.now()>=J)return{kind:"retry"};await X.sleep(X.leaseWait.pollMs)}}async function WH(X,J){let $=await b0(X.paths),Y=$?.refresh?.mainRefreshLeaseUntil;return Boolean(Y&&Y>X.now()&&$?.refresh?.mainRefreshLeaseTokenHash===s6(J))}function M_(X){return X.length>0&&X.trim()===X&&!["__proto__","constructor","prototype","main"].includes(X)}function __(X,J,$,Y,G){let Q=$.identity?{identity:$.identity}:{},z=J.find((H)=>!H.invalid&&H.fingerprint===$.credentialFingerprint);if(z)return{rowId:z.id,operation:"rotate",rowFingerprint:z.fingerprint??null,...Q,carryLegacyMain:X==="migrate"&&z.id==="main"};let Z=J.find((H)=>H.id==="main");if(!Z||!Z.invalid&&!Z.credential)return{rowId:"main",operation:"add",rowFingerprint:null,...Q,carryLegacyMain:X==="migrate"};if($.identity){let H=J.find((U)=>!U.invalid&&U.type==="oauth"&&U.enabled&&U.identity===$.identity);if(H)return{rowId:H.id,operation:"replace",rowFingerprint:H.fingerprint??null,...Q,carryLegacyMain:X==="migrate"&&H.id==="main"}}let W=new Set(J.map((H)=>H.id));return{rowId:Y??($.identity&&M_($.identity)&&!W.has($.identity)?$.identity:G()),operation:"add",rowFingerprint:null,...Q,carryLegacyMain:!1}}function A_(X,J,$,Y,G,Q,z){let Z=J.pending;if(Z){let W=$.find((U)=>U.id===Z.rowId&&!U.invalid),B=W?.fingerprint??null,H=Y.kind==="real"&&Y.fingerprint===Z.slotFingerprint;if(W&&B===Z.credentialFingerprint)return{kind:"finish",record:Z};if((W||Z.rowFingerprint===null)&&B===Z.rowFingerprint)return H&&Y.kind==="real"?{kind:"transfer",record:Z,credential:Y.credential,fresh:!1}:{kind:"drop-record"};if(!W)return{kind:"drop-record"};return H?{kind:"ambiguous",record:Z}:{kind:"drop-record"}}if(Y.kind==="indeterminate")return{kind:"drop-record"};if(Y.kind!=="real")return{kind:"nothing",slot:Y.kind};if(J.declinedSlotFingerprint===Y.fingerprint)return{kind:"nothing",slot:"declined"};return{kind:"transfer",record:{...__(X,$,Y,G,z),slotFingerprint:Y.fingerprint,credentialFingerprint:Y.credentialFingerprint,recordedAt:Q},credential:Y.credential,fresh:!0}}async function T_(X,J,$){let Y={type:"oauth",access:$.access,refresh:$.refresh,...$.expires!==void 0?{expires:$.expires}:{}},G=J.identity?{identity:J.identity}:{},Q={extraLocks:f8(X.paths,J.rowId,X.locks)};if(J.operation==="add")await X.store.add({id:J.rowId,credential:Y,...G},Q);else if(J.operation==="replace")await X.store.replace(J.rowId,Y,G,Q);else{let z=await X.store.read(),Z=z.status==="ready"?z.rows.find((W)=>W.id===J.rowId):void 0;await X.store.rotate(J.rowId,Y,Z?.identity===void 0?G:{},Q)}}async function R_(X,J){let $=await X.store.read();if($.status!=="ready")return;let Y=$.rows.find((G)=>G.id===J.rowId&&!G.invalid);return Y?.fingerprint===J.credentialFingerprint?Y:void 0}function C_(X,J){let $=[],Y=[["primary",X.primary],["secondary",X.secondary]],G=0;for(let[Z,W]of Y){if(!W||!Number.isFinite(W.checkedAt)||!Number.isFinite(W.usedPercent))continue;G=Math.max(G,W.checkedAt),$.push({checkedAt:W.checkedAt,readings:[{label:Z,usedPercent:W.usedPercent,...typeof W.resetsAt==="string"?{resetsAt:W.resetsAt}:{},...Number.isFinite(W.windowMinutes)?{windowMinutes:W.windowMinutes}:{}}]})}let Q=J??(G||void 0),z=X.spendControl;if(Q!==void 0&&z)$.push({checkedAt:Q,budget:{kind:"reading",reached:z.reached,remainingPercent:z.remainingPercent,usedPercent:z.usedPercent,limit:z.limit,used:z.used,remaining:z.remaining,...z.resetsAt!==void 0?{resetsAt:z.resetsAt}:{},...z.unit!==void 0?{unit:z.unit}:{}}});else if(Q!==void 0&&X.spendControlCleared)$.push({checkedAt:Q,budget:{kind:"cleared"}});return $.sort((Z,W)=>Z.checkedAt-W.checkedAt)}async function E_(X,J){let $=await b0(X.paths);if(!$)return;let Y=$.quota?.mainQuotaToken,G=J.credential?.type==="oauth"?J.credential.access:void 0,z=!Y||G!==void 0&&Y===x6(G)?$.quota?.mainQuota:void 0;if(z&&J.credentialEpoch!==void 0){let H={credentialEpoch:J.credentialEpoch,...J.identity!==void 0?{identity:J.identity}:{}};for(let U of C_(z,$.quota?.mainQuotaCheckedAt))try{await X.store.recordQuota(J.id,H,U)}catch(j){X.log.warn("legacy main quota not carried to the pool row",{rowId:J.id,error:j instanceof Error?j.message:String(j)})}}let Z=$.refresh?.mainLastRefreshError,W=$.accounts.find((H)=>H.id===J.id);if(!W||!v0(W)||W.corrupt)return;if(!Z&&!z)return;let B={...$,accounts:[{...W,...W.lastRefreshError||!Z?{}:{lastRefreshError:Z},...W.quota||!z?{}:{quota:z}}]};try{await nJ(B,X.paths,{accounts:[J.id]})}catch(H){X.log.warn("legacy main backoff not carried to the pool row",{rowId:J.id,error:H instanceof Error?H.message:String(H)})}}async function W4(X,J,$={}){await T3(X,(Y)=>{let G=N6(Y);if(delete Y.mainAccountId,J==="migrate"&&G.migratedAt===void 0)S_(Y);return c7(Y,{...G.migratedAt!==void 0||J==="migrate"?{migratedAt:G.migratedAt??X.now()}:{},...$.declinedSlotFingerprint!==void 0?{declinedSlotFingerprint:$.declinedSlotFingerprint}:G.declinedSlotFingerprint!==void 0?{declinedSlotFingerprint:G.declinedSlotFingerprint}:{}}),!0})}function S_(X){let J=X.routing;if(J===void 0)X.routing={mode:"main-first"};else if(X8(J)&&J.mode===void 0)X.routing={...J,mode:"main-first"}}async function h$(X){await T3(X,(J)=>{let $=N6(J);if(!$.pending)return!1;let{pending:Y,...G}=$;return c7(J,G),!0})}async function I_(X,J){await T3(X,($)=>{let Y=N6($);if(J.identity)$.mainAccountId=J.identity;return c7($,{...Y,pending:J}),!0})}async function b_(X,J,$,Y){let G=await _3(X,g8,X.paths.configPath,X.locks.mainRefreshTtlMs);try{return await k_(X,J,$,Y)}finally{await G.release().catch(()=>{})}}async function k_(X,J,$,Y){let G=(B)=>({status:"completed",rowId:$.rowId,operation:Y,placeholder:B}),Q=await R3(X);if(Q.kind==="indeterminate")return{status:"retry",reason:"host-slot-indeterminate"};if(Q.kind==="placeholder"){if(Q.origin===void 0)return{status:"untagged-placeholder"};if(Q.origin!==w$(X))return{status:"foreign-placeholder"};return await W4(X,J),await X.onStep("after-record-clear"),G("already-present")}if(Object.keys(await X.slot.all()).length===0)return{status:"retry",reason:"torn-read"};if(Q.kind==="real"&&Q.fingerprint!==$.slotFingerprint&&$.identity!==void 0&&Q.identity===$.identity)return await h$(X),await X.onStep("after-record-clear"),{status:"restart"};if(Q.kind!=="real"||Q.fingerprint!==$.slotFingerprint)return await W4(X,J),await X.onStep("after-record-clear"),G("slot-moved-on");await X.onStep("before-placeholder-write");let z=await X.slot.get({path:{id:Z4}}),Z=z===void 0||z===null?void 0:ZH(z);if(Z?.kind!=="real"||Z.fingerprint!==$.slotFingerprint)return{status:"retry",reason:"slot-changed"};try{await X.slot.set({path:{id:Z4},body:{...N1,accountId:w$(X)}})}catch(B){if(B instanceof n7)return{status:"retry",reason:"slot-changed"};throw B}await X.onStep("after-placeholder-write");let W=await X.slot.get({path:{id:Z4}});if(!A3(W))return{status:"retry",reason:"placeholder-overwritten"};if(X8(W)&&W.accountId===void 0)return{status:"untagged-placeholder"};if(X8(W)&&W.accountId!==w$(X))return{status:"foreign-placeholder"};return await W4(X,J),await X.onStep("after-record-clear"),G("written")}async function x_(X,J,$){let{record:Y}=$;if($.fresh)await I_(X,Y),await X.onStep("after-record-write");if(await WH(X,$.credential.refresh))return{status:"restart"};let G=await R3(X);if(G.kind!=="real"||G.fingerprint!==Y.slotFingerprint)return{status:"restart"};return await T_(X,Y,$.credential),await X.onStep("after-row-write"),BH(X,J,Y,$.fresh?Y.operation:"resumed")}async function BH(X,J,$,Y){let G=await R_(X,$);if(!G)return{status:"retry",reason:"verify-failed"};if(await X.onStep("after-verify"),$.carryLegacyMain)await E_(X,G),await X.onStep("after-carry-over");let Q=await b_(X,J,$,Y);if(Q.status==="untagged-placeholder"){await X.store.disable($.rowId,v$,{extraLocks:f8(X.paths,$.rowId,X.locks),attribution:{credentialEpoch:G.credentialEpoch,...G.identity!==void 0?{identity:G.identity}:{}}}),await W4(X,J);let z=`${X.paths.configPath}\x00${$.rowId}`;if(!JH.has(z))JH.add(z),X.log.warn(`Interrupted account transfer has an untagged placeholder; its credential was preserved disabled. ${y$}`,{rowId:$.rowId});return{status:"refused",reason:"placeholder-origin-unknown"}}if(Q.status!=="foreign-placeholder")return Q;return await X.store.remove($.rowId,{extraLocks:f8(X.paths,$.rowId,X.locks),protect:(z,Z)=>Z.row?.fingerprint!==$.credentialFingerprint?"the transfer row changed before rollback":void 0}),await h$(X),await f$(X),{status:"refused",reason:"placeholder-without-main"}}var eB=new Set,XH=new Set,JH=new Set;function w$(X){return`openai-auth-pool:${H_("sha256").update(K_(X.paths.configPath)).digest("hex")}`}async function w_(X){try{let J=await X();return J.open?[]:J.blockers}catch(J){return[{pid:"unknown",version:"unknown",detail:J instanceof Error?J.message:String(J)}]}}async function HH(X,J,$){let Y=q_(X),G=Y.slot.migrationDisabledReason?.();if(G){let B=Y.slot.path??H4();if(!XH.has(B))XH.add(B),Y.log.info("account pool migration is off: the host login slot is read-only",{reason:G});return{status:"slot-read-only",reason:G}}let Q;try{Q=await B4(Y.paths.configPath)}catch(B){return{status:"error",reason:B instanceof Error?B.message:String(B)}}let z=await VH(Y,J,Q);if(z){if(z.status==="already-migrated"&&"mainAccountId"in Q)await f$(Y);return z}if($){let B=await w_($);if(B.length>0){let H=`${Y.paths.configPath}\x00${B.map((U)=>`${U.pid}@${U.version}`).join(",")}`;if(!eB.has(H))eB.add(H),Y.log.info("account pool migration deferred: an older openai-auth version is running",{blockers:B});return{status:"deferred",reason:"older-version-running",blockers:B}}}let Z,W;try{W=await _3(Y,"pool-slot-transfer",Y.slot.path??H4(),Y.locks.mainRefreshTtlMs),Z=await _3(Y,$H,Y.paths.configPath,Y.locks.mainRefreshTtlMs)}catch(B){if(await W?.release().catch(()=>{}),B instanceof M3)return{status:"retry",reason:"lock-contention"};throw B}try{return await v_(Y,J)}catch(B){if(B instanceof M3)return{status:"retry",reason:"lock-contention"};if(B instanceof K0)return{status:"retry",reason:B.kind==="lock-contention"?"lock-contention":`store-${B.kind}`};throw B}finally{await Z?.release().catch(()=>{}),await W?.release().catch(()=>{})}}async function VH(X,J,$){let Y=N6($);if(Y.pending)return;if(J==="migrate"&&Y.migratedAt!==void 0){let G=await X.store.read();if(G.status==="ready"&&!G.rows.some((Q)=>Q.id==="main")&&!Y.pending&&m7(await R3(X),G.rows.some((Q)=>Q.id==="main"),Y))return{status:"refused",reason:"placeholder-without-main"};return{status:"already-migrated"}}if(J==="adopt"&&Y.migratedAt===void 0)return{status:"not-migrated"};return}async function v_(X,J){let $;for(let Y=0;Y<4;Y++){let G=await B4(X.paths.configPath),Q=await VH(X,J,G);if(Q){if(Q.status==="already-migrated")await f$(X);return Q}let z=await X.store.read(),Z=N6(G);if(z.status==="pending-migration"){if(m7(await R3(X),z.roster.some((U)=>X8(U)&&U.id==="main"),Z))return{status:"refused",reason:"placeholder-without-main"};await X.store.initialize(),await X.onStep("after-pool-key-write"),z=await X.store.read()}if(z.status!=="ready")return{status:"error",reason:z.status==="error"?`${z.file}: ${z.reason}`:"pool still pending migration"};let W=await O_(X);if(W.kind==="retry")return{status:"retry",reason:"legacy-refresh-in-progress"};if(W.kind==="indeterminate")return{status:"retry",reason:"host-slot-indeterminate"};if(m7(W,z.rows.some((U)=>U.id==="main"),Z))return{status:"refused",reason:"placeholder-without-main"};let B=A_(J,Z,z.rows,W,$,X.now(),X.newId);if(B.kind==="nothing"){if(J==="migrate")await W4(X,J),await X.onStep("after-marker-write");return{status:"nothing-to-import",slot:B.slot}}if(B.kind==="drop-record"){await h$(X),await X.onStep("after-record-clear");continue}if(B.kind==="ambiguous")return await W4(X,J,{declinedSlotFingerprint:B.record.slotFingerprint}),await X.onStep("after-record-clear"),X.log.warn("interrupted slot transfer left alone: the row was rotated since, so the slot copy may be stale; the next login resolves it",{rowId:B.record.rowId}),{status:"ambiguous",rowId:B.record.rowId};if(B.kind==="transfer"&&B.fresh)$=B.record.rowId;let H=B.kind==="finish"?await BH(X,J,B.record,"resumed"):await x_(X,J,B);if(H.status!=="restart")return H}return{status:"retry",reason:"unsettled"}}async function f$(X){await T3(X,(J)=>{if(!("mainAccountId"in J))return!1;if(N6(J).pending)return!1;return delete J.mainAccountId,!0})}function d7(X){return HH(X,"migrate",X.fence)}function i7(X){return HH(X,"adopt")}class UH extends Error{constructor(){super("an older build holds a refresh lease on this token; not refreshing it here");this.name="LegacyMainRefreshInFlightError"}}function f8(X,J,$={}){let Y={...u7,...$},G={renew:Y.renew,timeoutMs:Y.timeoutMs,retryMs:Y.retryMs,...Y.renewIntervalMs!==void 0?{renewIntervalMs:Y.renewIntervalMs}:{}};return[{name:g8,path:X.configPath,ttlMs:Y.mainRefreshTtlMs,...G},{name:tJ(J),path:X.configPath,ttlMs:Y.fallbackTtlMs,...G}]}async function KH(X,J,$,Y={}){let G=X.now??Date.now,Q=X.sleep??((W)=>new Promise((B)=>setTimeout(B,W))),z=X.leaseWait??{timeoutMs:4000,pollMs:50},Z=async(W,B)=>{let H=s6(W.refresh),U=async()=>{let j=await b0(X.paths),N=j?.refresh?.mainRefreshLeaseUntil;return Boolean(N&&N>G()&&j?.refresh?.mainRefreshLeaseTokenHash===H)};if(await U()){let j=G()+z.timeoutMs;while(G()<j&&await U())await Q(z.pollMs);throw new UH}return $(W,B)};return X.store.refresh(J,Z,{...Y,extraLocks:f8(X.paths,J,X.legacyLocks)})}var m_="openai",LH=250,g8="main-refresh";function g$(X){if(typeof X.access!=="string"||typeof X.refresh!=="string")return;let J=Buffer.from(X.access),$=Buffer.from(X.refresh),Y=(G)=>{let Q=Buffer.alloc(4);return Q.writeUInt32BE(G.length),Q};return y_("sha256").update(Y(J)).update(J).update(Y($)).update($).digest("hex")}function MH(X){if(!X||typeof X!=="object")return;let J=X;if(J.type!=="oauth")return;return{type:"oauth",...typeof J.access==="string"?{access:J.access}:{},...typeof J.refresh==="string"?{refresh:J.refresh}:{},...typeof J.expires==="number"?{expires:J.expires}:{},...typeof J.accountId==="string"?{accountId:J.accountId}:{}}}function jH(X){let J=MH(X);if(typeof J?.access!=="string"||typeof J.refresh!=="string")return;return{access:J.access,refresh:J.refresh,...typeof J.expires==="number"?{expires:J.expires}:{}}}function C3(X){if(q1(X)&&X.type==="api"&&typeof X.key==="string")return{kind:"api"};let J=MH(X);if(!J)return{kind:"indeterminate"};return T0(J)?{kind:"tombstone",oauth:J}:{kind:"real",oauth:J}}async function DH(X){return X.auth.get({path:{id:m_}})}async function FH(X){return Object.keys(await X.auth.all()).length>0}async function NH(X){let J=await DH(X.client);if(J!==void 0)return C3(J);let $=await FH(X.client),Y=X.now();if(await X.sleep(LH),X.now()-Y<LH)return{kind:"indeterminate"};let G=await DH(X.client);if(G!==void 0)return C3(G);let Q=await FH(X.client);return $&&Q?{kind:"slot-absent"}:{kind:"indeterminate"}}function H4(X=process.env,J=f_()){let $=X.XDG_DATA_HOME||qH(J,".local","share");return qH($,"opencode","auth.json")}function q1(X){return!!X&&typeof X==="object"&&!Array.isArray(X)}var PH=(X)=>X===void 0||typeof X==="string";function u_(X){if(!q1(X))return!1;switch(X.type){case"oauth":return typeof X.refresh==="string"&&typeof X.access==="string"&&typeof X.expires==="number"&&Number.isSafeInteger(X.expires)&&X.expires>=0&&PH(X.accountId)&&PH(X.enterpriseUrl);case"api":return typeof X.key==="string"&&(X.metadata===void 0||q1(X.metadata)&&Object.values(X.metadata).every((J)=>typeof J==="string"));case"wellknown":return typeof X.key==="string"&&typeof X.token==="string";default:return!1}}async function m$(X,J=process.env){let $=J.OPENCODE_AUTH_CONTENT;if($)try{let G=JSON.parse($);return q1(G)?G:{}}catch{}let Y;try{Y=JSON.parse(await h_(X,"utf8"))}catch{return{}}if(!q1(Y))return{};return Object.fromEntries(Object.entries(Y).filter(([,G])=>u_(G)))}function OH(X){if(!X.OPENCODE_AUTH_CONTENT)return!1;try{return JSON.parse(X.OPENCODE_AUTH_CONTENT),!0}catch{return!1}}class n7 extends Error{constructor(){super("OpenCode openai login changed after the account-pool migration read it; nothing was written");this.name="HostSlotChangedError"}}function p_(X){let J=X.env??process.env,$=X.path??H4(J),Y=new Map;return{path:g_($),migrationDisabledReason:()=>OH(J)?"OPENCODE_AUTH_CONTENT supplies the login; the environment-backed slot is read-only":void 0,async get(G){let Q=(await m$($,J))[G.path.id];return Y.set(G.path.id,JSON.stringify(Q)),Q},async all(){return m$($,J)},async set(G){if(OH(J))throw Error("OPENCODE_AUTH_CONTENT supplies a read-only login slot");let Q=(await m$($,J))[G.path.id];if(A3(G.body)&&(!Y.has(G.path.id)||Y.get(G.path.id)!==JSON.stringify(Q)))throw new n7;let z=await X.set(G);if(q1(z)&&"error"in z&&z.error!==void 0)throw Error(`OpenCode refused the write of its ${G.path.id} login: ${JSON.stringify(z.error)}`);return z}}}function _H(X,J={}){let $=q1(X)?X.auth:void 0,Y=$&&typeof $==="object"?$.set:void 0;if(typeof Y!=="function")return{reason:"the OpenCode client has no auth.set to write its login slot with"};return{slot:p_({...J,set:(G)=>Y.call($,G)})}}import{readFileSync as c_}from"node:fs";var l_="The `main` account holds the login OpenCode signs in with (its login slot only points at it), so it cannot be removed. Sign in with another account through `opencode auth login` to replace it.";function d_(X){return`The account-pool migration is moving OpenCode's login into \`${X}\` right now, so it cannot be removed yet. Try again once the migration has finished.`}function V4(X,J={}){return z8({provider:"openai",configPath:X.configPath,statePath:X.statePath,quota:m8,...J})}function u$(X){try{let J=JSON.parse(c_(X,"utf8"));if(!J||typeof J!=="object"||Array.isArray(J))return!1;return N6(J).migratedAt!==void 0}catch{return!1}}async function s7(X,J){if(!u$(X.configPath))return;let $=await J.read();return $.status==="ready"?$.rows:void 0}function a7(X,J){if(X===U8)return l_;if(N6(J.config).pending?.rowId===X)return d_(X);return}function i_(X,J){return f8(X,U8,J.legacyLocks).filter(($)=>$.name===g8)}function B9(X,J={}){return i_(X,J)}var U4="This setup has no OpenAI login in its account store. Sign in for this setup with opencode auth login, or point OPENCODE_OPENAI_AUTH_FILE and OPENCODE_OPENAI_AUTH_STATE_FILE at the store that holds the login.";class L1 extends Error{constructor(){super("The main OpenAI account lives in the account pool");this.name="MainAccountInPoolError"}}async function AH(X){let J=X.storage,$=Z9(J);if(!J||!$||T0($))return;let Y=$,G=X.now(),Q=(J.refresh?.refreshBeforeExpiryMinutes??240)*60000;if((!Y.access||!Y.expires||Y.expires-G<=Q)&&!r0(Y.lastRefreshError,Y.refresh,G))try{Y=await X.refreshAccount(Y,J)}catch(W){X.warn?.("pool main row refresh failed",{error:W instanceof Error?W.message:String(W)})}let Z=Y.access?.trim();if(!Z)return;if(typeof Y.expires!=="number"||Y.expires<=X.now())return;return{account:Y,token:Z}}import{readdir as n_,readFile as s_}from"node:fs/promises";import{homedir as a_}from"node:os";import{join as K4}from"node:path";function RH(){return process.env.XDG_STATE_HOME||K4(a_(),".local","state")}function o_(X=RH()){return K4(X,"cortexkit","openai-auth","processes")}function r_(X=RH()){return K4(X,"cortexkit","openai-auth","rpc")}function t_(X){try{return process.kill(X,0),!0}catch(J){return J.code==="EPERM"}}function TH(X){let J=/^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z.-]+)?$/.exec(X.trim());if(!J)return;return{core:[Number(J[1]),Number(J[2]),Number(J[3])],pre:J[4]?J[4].split("."):[]}}function e_(X,J){let $=TH(X),Y=TH(J);if(!$||!Y)return;for(let G=0;G<3;G++){let Q=$.core[G]-Y.core[G];if(Q!==0)return Math.sign(Q)}if($.pre.length===0||Y.pre.length===0)return Math.sign(Y.pre.length-$.pre.length);for(let G=0;G<Math.max($.pre.length,Y.pre.length);G++){let Q=$.pre[G],z=Y.pre[G];if(Q===void 0)return-1;if(z===void 0)return 1;let Z=/^\d+$/.test(Q),W=/^\d+$/.test(z);if(Z&&W){let B=Number(Q)-Number(z);if(B!==0)return Math.sign(B)}else if(Z!==W)return Z?-1:1;else if(Q!==z)return Q<z?-1:1}return 0}async function p$(X){try{return{ok:!0,names:await n_(X)}}catch(J){let $=J.code;if($==="ENOENT")return{ok:!0,names:[]};return{ok:!1,code:$,error:`${X}: ${String(J)}`}}}async function XA(X,J){let $;try{$=await s_(X,"utf8")}catch(Y){if(Y.code==="ENOENT")return{kind:"gone"};return{kind:"unreadable"}}try{let Y=JSON.parse($);if(Y!==null&&typeof Y==="object"&&Y.pid===J&&typeof Y.version==="string")return{kind:"ok",version:Y.version}}catch{}return{kind:"unreadable"}}async function j4(X){let J=X.isAlive??t_,$=X.selfPid??process.pid,Y=new Map,G=(N)=>{let K=N.pid==="unknown"?`dir:${N.detail}`:N.pid;if(!Y.has(K))Y.set(K,N)},Q=(N)=>{try{return J(N)}catch{return!0}},z=(N,K)=>{let q=K.exec(N),F=q?Number(q[1]):Number.NaN;return Number.isSafeInteger(F)&&F>=1?F:void 0},Z=o_(X.stateHome),W=new Set,B=await p$(Z);if(!B.ok)G({pid:"unknown",version:"unknown",detail:B.error});for(let N of B.ok?B.names:[]){let K=z(N,/^(\d+)\.json$/);if(K===void 0||K===$)continue;let q=K4(Z,N),F=await XA(q,K);if(F.kind==="gone")continue;if(W.add(K),!Q(K))continue;if(F.kind==="unreadable"){G({pid:K,version:"unknown",detail:q});continue}let O=e_(F.version,X.currentVersion);if(O===void 0||O<0)G({pid:K,version:F.version,detail:q})}let H=X.rpcDir??r_(X.stateHome),U=await p$(H);if(!U.ok)G({pid:"unknown",version:"unknown",detail:U.error});for(let N of U.ok?U.names:[]){if(!o7(N))continue;let K=K4(H,N),q=await p$(K);if(!q.ok){if(q.code==="ENOTDIR")continue;G({pid:"unknown",version:"unknown",detail:q.error});continue}for(let F of q.names){let O=z(F,/^port-(\d+)\.json$/);if(O===void 0||O===$||W.has(O))continue;if(Q(O))G({pid:O,version:"unknown",detail:K4(K,F)})}}let j=(N)=>N.pid==="unknown"?Number.POSITIVE_INFINITY:N.pid;return Y.size===0?{open:!0}:{open:!1,blockers:[...Y.values()].sort((N,K)=>j(N)-j(K))}}var k9="1.0.3";import{readFile as EH}from"node:fs/promises";function r7(X){return typeof X==="object"&&X!==null&&!Array.isArray(X)}async function SH(X){let J=await dJ(X.configPath),$=[];try{let G=JSON.parse(await EH(X.statePath,"utf8"));if(r7(G)){let Q=G.accounts;if(r7(Q))$=Object.keys(Q)}}catch(G){if(G.code!=="ENOENT")throw G}return{rosterIds:J?[...J]:[],stateIds:$,orphanStateIds:J?$.filter((G)=>!J.has(G)):[]}}async function JA(X){try{let J=JSON.parse(await EH(X.configPath,"utf8"));return r7(J)&&r7(J.claustrum)&&J.claustrum.mode==="claustrum"}catch{return!1}}var CH="Connect this host to the Claustrum vault (`opencode auth login` > Connect to the Claustrum vault, or the Vault section of `/openai`) if the vault holds the account, or sign in to the account again.";function IH(X){if(!X)return;let J=X.accounts.find(($)=>$.id==="main"&&v0($));if(J)return J;if(!X.mainAccountId)return;return X.accounts.find(($)=>v0($)&&$.accountId===X.mainAccountId)}function $A(X,J){let $=X.lastRefreshError;return r0($,X.refresh,J)&&$!==void 0&&$.nextRetryAt!==void 0&&$.nextRetryAt-$.checkedAt>=I5}function YA(X){let J=[],$=[],Y=X.now??Date.now(),G=IH(X.storage),Q=!1;if(T0(X.auth))J.push({code:"tombstoned-host-slot",message:`OpenCode's OpenAI slot holds a tombstone left by the vault custody of an older version, not a credential; it is never sent. ${CH}`});else if(C6(X.auth)){if(!Z9(X.storage))J.push({code:"main-pool-row-missing",message:"The main account was moved into the account pool, but the pool has no usable `main` row."})}else if(!X.auth)J.push({code:"auth-slot-missing",message:"OpenCode's OpenAI auth slot is missing."}),Q=!0;else if(X.auth.type!=="oauth")J.push({code:"auth-slot-not-oauth",message:"OpenCode's OpenAI auth slot is not OAuth."}),Q=!0;else if(G&&(!X.auth.refresh||G.refresh!==X.auth.refresh))J.push({code:"main-refresh-not-in-store",message:"OpenCode's main credential does not match the copy in the account store."}),Q=!0;if(Q&&G){let W={type:"restore-main-credential"};$.push(W);let B=J.find((H)=>H.code==="auth-slot-missing"||H.code==="auth-slot-not-oauth"||H.code==="main-refresh-not-in-store");if(B)B.repair=W}let z=X.storage?.accounts??[];if(z.length===0)J.push({code:"no-accounts",message:"The account store has no accounts."});else if(!z.some((W)=>W.enabled!==!1))J.push({code:"no-enabled-accounts",message:"The account store has no enabled accounts."});for(let W of z){if(!v0(W)||!T0(W))continue;J.push({code:"tombstoned-account",accountId:W.id,message:`Account ${W.id} holds a tombstone left by the vault custody of an older version, not a credential; it is never sent. ${CH}`})}if(X.retiredCustodyMode)J.push({code:"retired-custody-mode",message:"The config still selects the vault custody mode of an older version (`claustrum.mode`). It is ignored, and dropped at the next settings write; vault accounts are served once this host is connected to the Claustrum vault."});for(let W of z){if(!v0(W))continue;if(!$A(W,Y))continue;let B={type:"clear-refresh-backoff",accountId:W.id};$.push(B),J.push({code:"armed-non-transient-refresh-backoff",accountId:W.id,message:`Account ${W.id} has an armed non-transient refresh backoff.`,repair:B})}let Z=[...X.orphanStateIds??[]];if(Z.length>0){let W={type:"prune-orphan-state-ids",ids:Z};$.push(W),J.push({code:"orphan-state-ids",message:`State contains ids absent from the config roster: ${Z.join(", ")}.`,repair:W})}return{findings:J,repairs:$}}function bH(X){let J=($)=>{if($.type==="restore-main-credential")return{label:"Copy the stored main credential back into OpenCode's slot",apply:async()=>{if(C6(await X.readAuth()))return;let Y=IH(await X.loadAccounts(X.paths));if(!Y)return;await X.setMainAuth({refresh:Y.refresh,access:Y.access??"",expires:Y.expires??0})}};if(X.migrated)return;if($.type==="prune-orphan-state-ids")return{label:`Drop the state entries of ${$.ids.join(", ")}`,apply:async()=>{await X.mutateAccounts((Y)=>Y,X.paths)}};return{label:`Clear the refresh backoff of ${$.accountId}`,apply:async()=>{await X.mutateAccounts((Y)=>{let G=Y.accounts.find((Q)=>Q.id===$.accountId&&v0(Q));if(G)G.lastRefreshError=void 0;return Y},X.paths)}}};return[{id:"openai-auth",run:async()=>{let[$,Y,G,Q]=await Promise.all([X.loadAccounts(X.paths),X.readStoreIds(X.paths),X.readAuth(),JA(X.paths)]),z=YA({auth:G.type==="missing"?void 0:G,storage:$,orphanStateIds:Y.orphanStateIds,retiredCustodyMode:Q,now:X.now()}),Z=await z8({provider:"openai",quota:m8,configPath:X.paths.configPath,statePath:X.paths.statePath}).read();if(Z.status==="ready")for(let W of Z.rows){if(W.disabledReason!==v$)continue;z.findings.push({code:"slot-transfer-origin-unknown",accountId:W.id,message:`Account ${W.id} was preserved disabled after an interrupted transfer with an untagged placeholder; sole ownership could not be established. ${y$}`})}return z.findings.map((W)=>{let B=W.repair?J(W.repair):void 0;return{code:W.code,message:W.message,...W.accountId!==void 0?{accountId:W.accountId}:{},...B?{repair:B}:{}}})}}]}var QA=xH,kH="OpenAI accounts",zA="ChatGPT accounts in the vault",ZA="Uses the ChatGPT accounts in the Claustrum vault, with no sign-in. This works only while this host is connected to the vault and OpenCode has no OpenAI login stored; otherwise it fails and changes nothing.";async function WA(){let{redirectUri:X}=await f5(),J=await y5(),$=w2(crypto.getRandomValues(new Uint8Array(32)).buffer),Y=h5(X,J,$),G=g5(J,$);return{url:Y,instructions:"Complete authorization in your browser. This window will close automatically.",method:"auto",callback:async()=>{try{let Q=await G;return{type:"success",refresh:Q.refresh_token,access:Q.access_token,expires:Date.now()+(Q.expires_in??3600)*1000,accountId:Z8(Q)}}finally{$9($)}}}}async function BA(X){let{deviceData:J,url:$,instructions:Y}=await m5(X);return{url:$,instructions:Y,method:"auto",async callback(){try{let G=await u5(J,X);return{type:"success",refresh:G.refresh_token,access:G.access_token,expires:Date.now()+(G.expires_in??3600)*1000,accountId:Z8(G)}}catch{return{type:"failed"}}}}}function wH({client:X,getAuth:J,getPaths:$=()=>M0(V0()),fetchImpl:Y=fetch,packageVersion:G=k9,dependencies:Q,onMainSlotWritten:z,vault:Z}){let W={authorizeBrowser:Q?.authorizeBrowser??WA,authorizeHeadless:Q?.authorizeHeadless??(()=>BA(G)),beginAccountLogin:Q?.beginAccountLogin??v2,loadAccounts:Q?.loadAccounts??b0,mutateAccounts:Q?.mutateAccounts??F7,readStoreIds:Q?.readStoreIds??SH,openBrowser:Q?.openBrowser??QA,now:Q?.now??Date.now,openAccountPool:Q?.openAccountPool??V4,migrationBlockers:Q?.migrationBlockers??(async()=>{let L=await j4({currentVersion:G});return L.open?[]:L.blockers.map((P)=>({pid:P.pid,version:P.version}))}),...Q?.terminal?{terminal:Q.terminal}:{},...Q?.vaultWait?{vaultWait:Q.vaultWait}:{}},B=async()=>await J?.().catch(()=>{return})??{type:"missing"},H=async()=>{if(Z&&await Z.authority()!=="local")return!0;if((await B()).type!=="missing")return!0;let L=$(),P=W.openAccountPool(L);if((await P.read()).status==="ready")return K$(P);return((await W.loadAccounts(L))?.accounts.length??0)>0},U=async(L)=>{if(await YH($().configPath,async()=>{if(Z&&await Z.authority()!=="local")return!1;if(C6(await B()))return!1;return await X.auth.set({path:{id:"openai"},body:{type:"oauth",...L}}),!0}))await z?.().catch(()=>{})},j=(L)=>({begin:async({headless:P,signal:A})=>{if(Z&&await Z.authority()!=="local")throw Error(h8);let T=await W.beginAccountLogin({version:G,headless:P,...A?{signal:A}:{}});return{url:T.url,instructions:T.instructions,completion:T.completion.then(async(k)=>{if(Z&&await Z.authority()!=="local")throw Error(h8);let p=await L.read(),i=p.status==="ready"?p.rows.find((w)=>w.id===U8)?.identity:void 0;if(k.accountId&&i&&k.accountId===i)throw Error("that account is already the OpenCode main credential");return{id:k.id,credential:{type:"oauth",refresh:k.refresh,...k.access!==void 0?{access:k.access}:{},...k.expires!==void 0?{expires:k.expires}:{}},...k.accountId!==void 0?{identity:k.accountId}:{},...k.label!==void 0?{label:k.label}:{}}})}},openBrowser:(P)=>W.openBrowser(P)}),N=async(L)=>{if(Z&&await Z.authority()!=="local")throw Error(h8);let P=L.credential;if(P?.type!=="oauth"||!P.access)throw Error("no usable access token for a quota check");let A=await b8({accessToken:P.access,fetchImpl:Y,now:W.now,...L.identity?{accountId:L.identity}:{},accountKey:L.id});return I9(A,W.now(),!0)},K=(L)=>bH({paths:$(),migrated:L,readAuth:B,loadAccounts:W.loadAccounts,readStoreIds:W.readStoreIds,mutateAccounts:W.mutateAccounts,setMainAuth:U,now:W.now}),q=(L,P)=>({title:kH,store:b7(P,{rowLocks:(A)=>f8(L,A)}),...W.terminal?{terminal:W.terminal}:{},login:j(P),protect:(A,T)=>a7(A,T),extraLocks:B9(L),pollQuota:N,doctor:K(!0),status:async()=>{let A=await Z?.status();if(Z&&await Z.authority()!=="local"&&A)return[N3(Z.host,Z.name,A.enrollment)];return[`Routing: ${(await W.loadAccounts(L))?.routing?.mode??"main-first"}`,...Z?[N3(Z.host,Z.name,(await Z.status()).enrollment)]:[]]},...Z?{extraActions:[F(Z)]}:{}}),F=(L)=>{let P=L.enrolled();return{id:P?"vault-disconnect":"vault-connect",label:P?"Disconnect from the Claustrum vault":"Connect to the Claustrum vault",hint:"serve OpenAI accounts held in the vault",run:async(A)=>{let T=await L.authority();if(P){if(T!=="local")await L.disconnect();A.print("Disconnected from the Claustrum vault.");return}if(T!=="local"){A.print("Nothing was changed: this host is already connected or its enrollment is unreadable. Reopen the menu to disconnect.");return}A.print(`Asking the Claustrum vault to enroll ${L.name}…`);let k,p=await L.waitForApproval({...W.vaultWait,onPending:(i)=>{let X0=i.state==="pending"?i.requestId??i.retryCode??"":i.state;if(X0===k)return;k=X0;for(let w of J4(L.name,i))A.print(w);A.print("Waiting for the approval… (stop with Ctrl-C; Connect picks the request up again)")}});A.print(q3(L,p).text)}}},O=async()=>{let L=await W.migrationBlockers();return V1({title:kH,status:["Accounts move to the new account layout once every OpenCode process on this machine runs this version of OpenAI auth. Account management opens after the move.",...L.length>0?["These processes still hold the move back:",...L.map((P)=>`  ${P.pid==="unknown"?"processes that could not be read":`pid ${P.pid}`}: version ${P.version}`)]:[]],actions:[L3({checks:K(!1)})],...W.terminal?{terminal:W.terminal}:{}})},_=async(L)=>{let P=$(),A=W.openAccountPool(P);if(Z&&await Z.authority()!=="local")return F3(q(P,A),Z);if(await s7(P,A)===void 0)return O();let T=q(P,A);return Z?F3(T,Z):L$(T)},C=(L)=>async()=>{if(Z&&await Z.authority()!=="local")throw Error(h8);let P=await L();if(P.method!=="auto")return P;return{...P,callback:async()=>{let A=await P.callback();if(Z&&await Z.authority()!=="local")return{type:"failed"};return A}}};return[{label:"ChatGPT Pro/Plus (browser)",type:"oauth",authorize:F$({hasCredential:H,openMenu:_,login:C(()=>W.authorizeBrowser())})},{label:"ChatGPT Pro/Plus (headless)",type:"oauth",authorize:C(()=>W.authorizeHeadless())},{label:"Manually enter API Key",type:"api"},...Z?.enrolled()?[{label:zA,type:"oauth",authorize:async()=>({url:"",instructions:ZA,method:"auto",callback:async()=>{if(await $3(Z.paths,Z.name)!=="vault")return{type:"failed"};try{let L=JSON.parse(await GA(H4(),"utf8"));if(!L||typeof L!=="object"||Array.isArray(L)||Object.hasOwn(L,"openai"))return{type:"failed"}}catch(L){if(L.code!=="ENOENT")return{type:"failed"}}return{...N1,type:"success"}}})}]:[]]}var c$={rpcRoot:"openai-auth",directoryPrefix:fH,registrationSessionId:"process"};function t7(X,J){vH(c$,X,J)}function gH(X=0,J){return yH(c$,X,J)}function mH(X){return hH(c$,X)}var e7=Z0("commands");function N4(X){return{configPath:X.accountStoragePath,statePath:X.accountStatePath}}function l$(X){return`${String(X.startHour).padStart(2,"0")}-${String(X.endHour).padStart(2,"0")}`}function HA(X){let J=/^(\d{1,2})-(\d{1,2})$/.exec(X.trim());if(!J)return{ok:!1,reason:"expected HH-HH, e.g. 9-18 or 22-6"};let $=Number(J[1]),Y=Number(J[2]);if($>23||Y>23||$===Y)return{ok:!1,reason:"hours must be integers 0-23 and start ≠ end"};return{ok:!0,startHour:$,endHour:Y}}var VA="Sustain keeps main-agent sessions warming past the idle cap for this process. Clock windows still apply.\n\nBefore enabling sustain with Magic Context, set a non-expiring `cache_ttl` for models used by main sessions; elapsed-time cold-cache assumptions are no longer valid.";function UA(X){let J=($)=>K1(X.store(),B9(N4(X)),(Y)=>{let G={...Y.cacheKeep??{}};$(G),Y.cacheKeep=G});return{title:"Cache",build:async()=>{let $=X.cacheKeepManager;if(!$)return{lines:["Keep-warm unavailable"]};let Y=P7(await X.loadAccounts(N4(X))),G=Y?.enabled===!0,Q=Y?.subagents===!0,z=$.status(),Z=z.window?l$(z.window):"always (no window)";return{lines:[`Keep-warm ${G?"on":"off"} · ${z.tracked===0?"no sessions":`${z.tracked} session${z.tracked===1?"":"s"}`}`,`Timer ${z.running?"armed":"idle"} · subagents ${Q?"on":"off"} · sustain ${z.sustain?"on":"off"}`,`Window ${Z}`,`TTL ${Math.round(z.ttlMs/1000)}s · lead ${Math.round(z.leadMs/1000)}s · idle cap ${Math.round(z.maxIdleWarmMs/60000)}min (subagents ${Math.round(z.maxSubagentIdleMs/60000)}min)`],items:z.targets.map((W)=>({id:W.sessionKey,label:W.sessionKey,group:"Sessions",detail:[W.accountId??"main",`expires in ${Math.ceil((W.cacheExpiresAt-z.generatedAt)/1000)}s`,...W.lastWarmedAt?[`last warm ${Math.ceil((z.generatedAt-W.lastWarmedAt)/1000)}s ago`]:[],...W.backoffUntil&&W.backoffUntil>z.generatedAt?[`backoff ${Math.ceil((W.backoffUntil-z.generatedAt)/1000)}s`]:[]].join(" · ")})),actions:[{id:"enabled",label:G?"Turn keep-warm off":"Turn keep-warm on",knobs:[{kind:"toggle",id:"enabled",label:"Keep-warm",value:!G}],run:async({values:W})=>{let B=W.enabled===!0;if(await J((H)=>{H.enabled=B}),X.setCacheKeepEnabled?.(B),B)$.start();else $.stop();return e7.info(B?"cachekeep enabled":"cachekeep disabled"),B?`Keep-warm is on. TTL ${Math.round(z.ttlMs/1000)}s, idle cap ${Math.round(z.maxIdleWarmMs/60000)}min.`:"Keep-warm is off."}},{id:"subagents",label:Q?"Stop warming subagent sessions":"Warm subagent sessions too",knobs:[{kind:"toggle",id:"subagents",label:"Subagent warming",value:!Q}],run:async({values:W})=>{let B=W.subagents===!0;return await J((H)=>{H.subagents=B}),X.setCacheKeepSubagents?.(B),`Subagent warming is ${B?"on":"off"}.`}},{id:"sustain",label:z.sustain?"Stop sustaining main sessions":"Sustain main sessions past the idle cap",knobs:[{kind:"toggle",id:"sustain",label:"Sustain",value:!z.sustain}],run:async({values:W})=>{let B=W.sustain===!0;return await J((H)=>{H.sustain=B}),X.setCacheKeepSustain?.(B),B?VA:"Main-agent sessions again stop warming at the configured idle cap."}},{id:"window",label:"Set the warm window",description:"Warm only between these local hours, e.g. 9-18 or 22-6. Leave it empty to warm at any hour.",knobs:[{kind:"text",id:"window",label:"Window (HH-HH)",placeholder:"9-18",...z.window?{value:l$(z.window)}:{}}],run:async({values:W})=>{let B=W.window;if(typeof B!=="string"||B.trim()==="")return await J((N)=>{delete N.startHour,delete N.endHour}),X.setCacheKeepWindow?.(void 0),"Warm window cleared: keep-warm warms at any hour (within idle caps).";let H=HA(B);if(!H.ok)return{ok:!1,text:`Invalid window: ${H.reason}`};let{startHour:U,endHour:j}=H;return await J((N)=>{N.startHour=U,N.endHour=j}),X.setCacheKeepWindow?.({startHour:U,endHour:j}),`Warming limited to ${l$(H)} local hours.`}}]}}}}var uH=["error","warn","info","debug","trace"];function KA(X){return{title:"Diagnostics",build:async()=>{let J=c6(),Y=(await X.loadAccounts(N4(X)))?.logging?.level??"info";return{lines:[`Dumps ${J.dump?"on":"off"}`,`Dump directory: ${J.dumpDir}`,`Log level: ${Y}`],actions:[{id:"dump",label:J.dump?"Turn request dumps off":"Turn request dumps on",knobs:[{kind:"toggle",id:"enabled",label:"Request dumps",value:!J.dump}],run:async({values:G})=>{let Q=G.enabled===!0;await K1(X.store(),B9(N4(X)),(Z)=>{Z.dump={...Z.dump??{},enabled:Q}});let z=sB();return e7.info(Q?"request dump enabled":"request dump disabled"),Q?`Request dumps are on, written to ${z.dumpDir}.
-
-Body dumps may contain prompt and session content. Turn this off after debugging.`:"Request dumps are off."}},{id:"logging",label:"Set the log level",knobs:[{kind:"choice",id:"level",label:"Level",choices:uH.map((G)=>({value:G,label:G})),value:uH.includes(Y)?Y:"info"}],run:async({values:G})=>{let Q=String(G.level);return await K1(X.store(),B9(N4(X)),(z)=>{z.logging={...z.logging??{},level:Q}}),XX(Q),e7.info("log level changed",{level:Q}),`Log level set to ${Q}.`}}]}}}}async function jA(X){let J=await X.store().read(),$=J.status==="ready"?J.rows:[];return[...new Set(["main",...$.filter((Y)=>Y.enabled&&Y.type==="oauth").map((Y)=>Y.id)])]}function pH(X){let J=N4(X),$=B9(J),Y=X.resolveResetTarget&&X.refreshResetTargetQuota&&X.fetchImpl&&X.now&&X.randomUUID?C$({configPath:J.configPath,statePath:J.statePath,quotaManager:X.quotaManager,loadAccounts:X.loadAccounts,mutateAccounts:A$(X.store(),$),resolveResetTarget:X.resolveResetTarget,refreshResetTargetQuota:X.refreshResetTargetQuota,fetchImpl:X.fetchImpl,now:X.now,randomUUID:X.randomUUID,accountKeys:()=>jA(X)}):void 0,G=X.beginAccountLogin;return E$({store:X.store(),...X.vault?{vault:X.vault}:{},...X.now?{now:X.now}:{},extraLocks:$,rowLocks:(Q)=>f8(J,Q),migration:X.migration,...G?{login:{begin:(Q)=>G({...Q,version:X.packageVersion}),mainIdentity:async()=>{let Q=await X.store().read();if(Q.status!=="ready")return;return Q.rows.find((z)=>z.id==="main")?.identity}}}:{},protect:(Q,z)=>a7(Q,z),...X.refreshAllQuota?{quotaCheck:async(Q)=>{if(Q.length===1){let W=X.store();for(let B of Q)await W.requestReading(B);await W.pullsSettled();return}let Z=(await X.refreshAllQuota?.()??[]).filter((W)=>!W.ok);if(Z.length>0)throw new k6("quota-check-failed",Z.map((W)=>W.permanent?`${W.account}: sign-in no longer accepted — remove and add this account again`:`${W.account}: fetch failed — check again to retry`).join(`
-`))}}:{},cache:UA(X),diagnostics:KA(X),extras:[...Y?[Y]:[],T$({...X.getStickyRouting?{getPin:X.getStickyRouting}:{},...X.clearStickyRouting?{clearPin:X.clearStickyRouting}:{}}),...X.vault?[R$({vault:X.vault,changed:X.afterWrite})]:[]],afterApply:async()=>{await X.afterWrite?.(),await X.refreshSidebar?.().catch(()=>{})}})}function cH(X){return(J,$="info")=>{e7.info("menu notification",{sessionId:X,kind:$}),t7({command:p6,notify:{message:J,kind:$}},X)}}function lH(X,J){return pH(X).open({...J!==void 0?{sessionId:J}:{},notify:cH(J)})}function dH(X,J){return pH(X).apply(J,{...J.sessionId!==void 0?{sessionId:J.sessionId}:{},notify:cH(J.sessionId)})}function iH(X){let J=[`## ${X.title}`];for(let $ of X.sections){J.push("",`### ${$.title}`);for(let Y of $.lines)J.push(Y);for(let Y of $.items){let G=Y.detail??Y.status;J.push(`- ${Y.label}${G?`: ${G}`:""}`)}}return J.push("","Open the OpenCode TUI to change these settings."),J.join(`
-`)}var NA=300000,qA=30000,nH=240000,LA="bg-quota-refresh",DA=120000;function d$(X,J){return g0({name:LA,ttlMs:DA,path:X,renew:!0,...J})}function sH(X,J=G4,$=()=>d$(X.paths.configPath)){return FA(X,J,$)}function FA(X,J,$){return aH(async()=>J({...X,respectBackoff:!0,skipFresherThanMs:nH}),$,[])}async function aH(X,J,$){let Y;try{Y=await J()}catch{Y=void 0}if(Y===null)return $;try{return await X()}finally{await Y?.release().catch(()=>{})}}function oH(X,J,$){return aH(async()=>{return await X.refreshDueTokens(J),X.pollRows(J,{skipReadWithinMs:nH})},$,[])}class i${setIntervalFn;clearIntervalFn;random;onError;run;timer;tickPromise;stopped=!1;constructor(X={}){this.setIntervalFn=X.setIntervalFn??setInterval,this.clearIntervalFn=X.clearIntervalFn??clearInterval,this.random=X.random??Math.random,this.onError=X.onError}start(X,J=this.onError){if(this.run=X,this.onError=J,this.stopped=!1,this.timer)return;let $=Math.round((this.random()*2-1)*qA);if(this.timer=this.setIntervalFn(()=>{let Y=this.run;if(this.stopped||!Y||this.tickPromise)return;let G=Y().catch((Q)=>{try{this.onError?.(Q)}catch{}}).finally(()=>{if(this.tickPromise===G)this.tickPromise=void 0});this.tickPromise=G},NA+$),"unref"in this.timer)this.timer.unref()}stop(){if(this.stopped=!0,this.run=void 0,!this.timer)return;this.clearIntervalFn(this.timer),this.timer=void 0}isStopped(){return this.stopped}}function n$(X){if(!X||typeof X!=="object")return;let J=X,$=Number(J.startHour),Y=Number(J.endHour);if(!Number.isInteger($)||!Number.isInteger(Y)||$<0||$>23||Y<0||Y>23||$===Y)return;return{startHour:$,endHour:Y}}function E3(X,J=new Date){if(!X)return!1;let $=J.getHours();if(X.startHour<X.endHour)return $>=X.startHour&&$<X.endHour;return $>=X.startHour||$<X.endHour}var PA=300000,OA=3600000,MA=1800000,_A=60000,AA=32,TA=8388608,RA=30000,CA=600000;function u8(X,J){return typeof X==="number"&&Number.isFinite(X)&&X>0?X:J}function JX(X){return X instanceof Error?X.message:String(X)}class S3{targets=new Map;adapter;now;log;ttlMs;leadMs;maxIdleWarmMs;maxSubagentIdleMs;tickIntervalMs;maxTargets;maxBytes;warmTimeoutMs;backoff;getWindow;getSustain;setIntervalImpl;clearIntervalImpl;timer=null;startedAt=null;totalBytes=0;tickPromise=null;disposed=!1;abortController=new AbortController;constructor(X){this.adapter=X.adapter,this.now=X.now,this.log=X.logger,this.ttlMs=u8(X.ttlMs,PA),this.tickIntervalMs=u8(X.tickIntervalMs,_A),this.leadMs=u8(X.leadMs,this.tickIntervalMs+15000),this.maxIdleWarmMs=u8(X.maxIdleWarmMs,OA),this.maxSubagentIdleMs=u8(X.maxSubagentIdleMs,MA),this.maxTargets=u8(X.maxTargets,AA),this.maxBytes=u8(X.maxBytes,TA),this.warmTimeoutMs=u8(X.warmTimeoutMs,RA),this.backoff=X.backoffMs??CA,this.getWindow=X.getWindow,this.getSustain=X.getSustain,this.setIntervalImpl=X.setIntervalImpl??globalThis.setInterval,this.clearIntervalImpl=X.clearIntervalImpl??globalThis.clearInterval}track(X){let{sessionKey:J,bodyText:$}=X;this.pruneStale();let Y=Buffer.byteLength($,"utf8");if(Y>this.maxBytes)return this.log?.debug("cachekeep track skipped (body exceeds maxBytes)",{sessionKey:J,bodyBytes:Y,maxBytes:this.maxBytes}),{tracked:!1,reason:"body-exceeds-max-bytes"};let G=this.getWindow?.();if(G&&!E3(G,new Date(this.now())))return this.log?.debug("cachekeep track skipped (outside window)",{sessionKey:J,startHour:G.startHour,endHour:G.endHour}),{tracked:!1,reason:"outside-window"};this.drop(J);while(this.targets.size>=this.maxTargets||this.totalBytes+Y>this.maxBytes&&this.targets.size>0){let H=this.leastRecentlyTouched();if(H===void 0)break;this.log?.debug("cachekeep evicted least recently used target",{sessionKey:H}),this.drop(H)}let Q=X.isSubagent===!0,z=X.accountId||void 0,Z=this.adapter.profile?.({bodyText:$,isSubagent:Q,accountId:z,meta:X.meta}),W=u8(Z?.ttlMs,this.ttlMs),B=this.now();return this.targets.set(J,{bodyText:$,bodyBytes:Y,accountId:z,isSubagent:Q,meta:X.meta,ttlMs:W,maxWarms:Z?.maxWarms!==void 0&&Z.maxWarms>0?Math.floor(Z.maxWarms):void 0,maxIdleMs:Z?.maxIdleMs!==void 0?u8(Z.maxIdleMs,this.idleDefault(Q)):void 0,cacheExpiresAt:B+W,lastRealRequestAt:B,failures:0,warmCount:0}),this.totalBytes+=Y,this.log?.debug("cachekeep captured target",{sessionKey:J,accountId:z}),this.start(),{tracked:!0}}remove(X){if(this.drop(X))this.log?.debug("cachekeep removed target",{sessionKey:X})}start(){if(this.disposed=!1,this.timer)return;if(this.startedAt=this.now(),this.timer=this.setIntervalImpl(()=>{this.tick().catch((X)=>{this.log?.warn("cachekeep tick failed",{error:JX(X)})})},this.tickIntervalMs),typeof this.timer==="object"&&"unref"in this.timer)this.timer.unref();this.log?.debug("cachekeep started",{ttlMs:this.ttlMs,leadMs:this.leadMs,maxIdleWarmMs:this.maxIdleWarmMs})}stop(){if(this.disposed=!0,this.abortController.abort(),this.abortController=new AbortController,this.timer)this.clearIntervalImpl(this.timer),this.timer=null;this.startedAt=null,this.targets.clear(),this.totalBytes=0,this.log?.debug("cachekeep stopped")}status(){let X=this.getWindow?.();return{running:this.timer!==null,tracked:this.targets.size,totalBytes:this.totalBytes,generatedAt:this.now(),startedAt:this.startedAt,ttlMs:this.ttlMs,leadMs:this.leadMs,maxIdleWarmMs:this.maxIdleWarmMs,maxSubagentIdleMs:this.maxSubagentIdleMs,sustain:this.getSustain?.()===!0,...X?{window:X}:{},targets:[...this.targets].map(([J,$])=>({sessionKey:J,accountId:$.accountId,isSubagent:$.isSubagent,cacheExpiresAt:$.cacheExpiresAt,lastRealRequestAt:$.lastRealRequestAt,...$.lastWarmedAt!==void 0?{lastWarmedAt:$.lastWarmedAt}:{},...$.backoffUntil!==void 0?{backoffUntil:$.backoffUntil}:{},failures:$.failures,warmCount:$.warmCount,ttlMs:$.ttlMs,bodyBytes:$.bodyBytes}))}}tick(){if(this.tickPromise)return this.tickPromise;let X=this.runTick().finally(()=>{if(this.tickPromise===X)this.tickPromise=null});return this.tickPromise=X,X}async runTick(){this.pruneStale();let X=this.getWindow?.();if(X&&!E3(X,new Date(this.now())))return;let J=this.now(),$=J+this.leadMs;for(let[Y,G]of[...this.targets]){if(this.disposed)return;if(this.targets.get(Y)!==G)continue;if(G.backoffUntil!==void 0&&J<G.backoffUntil)continue;if(G.cacheExpiresAt>$)continue;await this.warm(Y,G)}}retireIfExpired(X,J){if(this.now()<J.cacheExpiresAt)return!1;return this.log?.debug("cachekeep retired target (cache lifetime ended)",{sessionKey:X,accountId:J.accountId,cacheExpiresAt:J.cacheExpiresAt,failures:J.failures}),this.drop(X),!0}isCurrent(X,J){return!this.disposed&&this.targets.get(X)===J}view(X,J){return{sessionKey:X,accountId:J.accountId,bodyText:J.bodyText,isSubagent:J.isSubagent,meta:J.meta,warmCount:J.warmCount,ttlMs:J.ttlMs}}fail(X,J,$,Y={}){if(!this.isCurrent(X,J))return;J.failures+=1;let G=typeof this.backoff==="function"?this.backoff({sessionKey:X,failures:J.failures}):this.backoff;J.backoffUntil=this.now()+(Number.isFinite(G)&&G>0?G:0),this.log?.warn($,{sessionKey:X,accountId:J.accountId,failures:J.failures,backoffUntil:J.backoffUntil,...Y})}async warm(X,J){if(this.retireIfExpired(X,J))return;let $=this.view(X,J);if(this.adapter.activeAccount){let H;try{H=await this.adapter.activeAccount(X,$)}catch(U){this.fail(X,J,"cachekeep skip (active account unknown)",{error:JX(U)});return}if(!this.isCurrent(X,J))return;if(H!==void 0&&H!==J.accountId){this.log?.debug("cachekeep dropped target (session changed account)",{sessionKey:X,accountId:J.accountId,activeAccountId:H}),this.drop(X);return}}let Y;try{Y=await this.adapter.buildBody($)}catch(H){this.fail(X,J,"cachekeep skip (replay body unbuildable)",{error:JX(H)});return}if(!this.isCurrent(X,J))return;if(this.retireIfExpired(X,J))return;let G=e4([AbortSignal.timeout(this.warmTimeoutMs),this.abortController.signal]),Q=G.signal,z,Z="";try{z=await this.adapter.send({target:$,body:Y,signal:Q}),Z=await z.text().catch(()=>"")}catch(H){this.fail(X,J,"cachekeep failed",{error:JX(H)});return}finally{G.dispose()}if(!this.isCurrent(X,J))return;if(!z.ok){this.fail(X,J,"cachekeep failed",{status:z.status,responseBody:Z.slice(0,600)});return}let W;try{W=this.adapter.readUsage?.({target:$,response:z,text:Z})}catch{}let B=this.now();if(J.cacheExpiresAt=B+J.ttlMs,J.lastWarmedAt=B,J.backoffUntil=void 0,J.failures=0,J.warmCount+=1,this.log?.debug("cachekeep fired",{sessionKey:X,accountId:J.accountId,warmCount:J.warmCount,...W}),J.maxWarms!==void 0&&J.warmCount>=J.maxWarms)this.log?.debug("cachekeep retired target (warm cap reached)",{sessionKey:X,warmCount:J.warmCount}),this.drop(X)}idleDefault(X){return X?this.maxSubagentIdleMs:this.maxIdleWarmMs}pruneStale(){let X=this.now(),J=this.getSustain?.()===!0;for(let[$,Y]of[...this.targets]){if(this.retireIfExpired($,Y))continue;if(J&&!Y.isSubagent)continue;let G=Y.maxIdleMs??this.idleDefault(Y.isSubagent);if(Y.lastRealRequestAt>=X-G)continue;this.log?.debug("cachekeep pruned idle target",{sessionKey:$,accountId:Y.accountId,lastRealRequestAt:Y.lastRealRequestAt,maxIdleMs:G}),this.drop($)}}leastRecentlyTouched(){let X,J=Number.POSITIVE_INFINITY;for(let[$,Y]of this.targets){let G=Math.max(Y.lastRealRequestAt,Y.lastWarmedAt??0);if(G<J)X=$,J=G}return X}drop(X){let J=this.targets.get(X);if(!J)return!1;return this.totalBytes-=J.bodyBytes,this.targets.delete(X),!0}}function s$(X){if(typeof X!=="string")return!1;try{let J=JSON.parse(X);return s(J)&&s(J.client_metadata)&&J.client_metadata.ws_request_header_x_openai_internal_codex_responses_lite==="true"}catch{return!1}}function a$(X){if(typeof X!=="string")return X;try{let J=JSON.parse(X);if(!s(J)||!s(J.client_metadata))return X;if(!(("x-codex-turn-metadata"in J.client_metadata)||("x-codex-ws-stream-request-start-ms"in J.client_metadata)||("ws_request_header_x_openai_internal_codex_responses_lite"in J.client_metadata)))return X;let $={...J.client_metadata};return delete $["x-codex-turn-metadata"],delete $["x-codex-ws-stream-request-start-ms"],delete $.ws_request_header_x_openai_internal_codex_responses_lite,JSON.stringify({...J,client_metadata:$})}catch{return X}}function $X(X){if(X?.method?.toUpperCase()!=="POST")return X;let J=new Headers(X.headers);if(J.set("accept","text/event-stream"),J.set("content-type","application/json"),s$(X.body))J.set("x-openai-internal-codex-responses-lite","true");return{...X,headers:J,body:a$(X.body)}}function tH(X){if(!X.enabled||typeof X.body!=="string")return;let J=X.headers.has("x-parent-session-id");if(J&&!X.includeSubagents)return;let $=X.headers.get("session-id")??X.headers.get("x-opencode-session")??X.headers.get("x-session-affinity")??void 0;if(!$)return;let Y={};for(let G of["session-id","x-session-affinity","x-parent-session-id","user-agent","version","x-codex-beta-features","x-codex-turn-metadata","x-codex-window-id","x-client-request-id","thread-id","x-openai-internal-codex-responses-lite"]){let Q=X.headers.get(G);if(Q)Y[G]=Q}return{sessionKey:$,bodyText:X.body,replayHeaders:Y,isSubagent:J}}function eH(X){return n$(X?.cachekeep)}var o$=1800000,EA=2,SA=2*o$+900000,IA=/^gpt-(\d+)(?:\.(\d+))?(?:-|$)/;function bA(X){try{let $=JSON.parse(X).model;if(typeof $!=="string")return!1;let Y=IA.exec($);if(!Y)return!1;let G=Number(Y[1]),Q=Y[2]===void 0?0:Number(Y[2]);return G>5||G===5&&Q>=6}catch{return!1}}function kA(X){if(!bA(X.bodyText))return;if(!X.isSubagent)return{ttlMs:o$};return{ttlMs:o$,maxWarms:EA,maxIdleMs:SA}}function xA(X){let $=JSON.parse(X);return $.store=!1,delete $.max_output_tokens,delete $.max_tokens,delete $.max_completion_tokens,JSON.stringify($)}function r$(){return{input_tokens:0,output_tokens:0,cached_tokens:0,hit_rate:null}}function XV(X){if(!X||typeof X!=="object")return r$();let J=X,$=Number(J.input_tokens)||Number(J.prompt_tokens)||0,Y=Number(J.output_tokens)||Number(J.completion_tokens)||0,G=J.input_tokens_details??J.prompt_tokens_details,Q=Number(G?.cached_tokens)||Number(J.cached_tokens)||0,z=$>0?Q/$:null;return{input_tokens:$,output_tokens:Y,cached_tokens:Q,hit_rate:z}}function wA(X){try{let J=JSON.parse(X);return XV(J.usage)}catch{return r$()}}function vA(X){let J,$=[],Y,G=()=>{if(!$.length)return;let Q=$.join(`
-`).trim();$=[];let z=J;if(J=void 0,!Q||Q==="[DONE]")return;try{let Z=JSON.parse(Q),W=Z.type??z;if(W!=="response.completed"&&W!=="response.done")return;let B=Z.response;Y=XV(B?.usage??Z.usage)}catch{}};for(let Q of X.split(/\r?\n/)){if(Q===""){G();continue}if(Q.startsWith("event:")){J=Q.slice(6).trim();continue}if(Q.startsWith("data:"))$.push(Q.slice(5).trim())}return G(),Y??r$()}function JV(X,J,$=Date.now()){if(!J)return;if(X.route==="sticky-balanced"){let G=X.stickyAssignments?.[p8(J)];if(!G)return;if(G.lastSeenAt<$-rH)return;return G.accountId}let Y=X.activeRouting?.[J];if(!Y||Y.route!==X.route)return;return Y.activeId}function yA(X){let{logger:J,activeAccount:$}=X;return{buildBody:(Y)=>xA(Y.bodyText),async send({target:Y,body:G,signal:Q}){let z=async(H)=>{Q.throwIfAborted();let U={...Y.meta.replayHeaders,authorization:`Bearer ${H}`,"content-type":"application/json"};if(Y.meta.chatgptAccountId)U["ChatGPT-Account-Id"]=Y.meta.chatgptAccountId;else delete U["ChatGPT-Account-Id"];let j;try{let N=JSON.parse(G);j={warmBodyKeys:Object.keys(N),stream:N.stream,max_output_tokens:N.max_output_tokens,store:N.store,has_stream_options:"stream_options"in N,has_max_tokens:"max_tokens"in N,model:N.model}}catch{}J?.debug("cachekeep warm request",{...j,headerKeys:Object.keys(U),hasChatGptAccountId:"ChatGPT-Account-Id"in U});try{let N=await X.fetchImpl(X.codexResponsesUrl,$X({method:"POST",headers:U,body:G,signal:Q}));return await j1(N,H,"event-stream")}catch(N){throw j8(N,H)}};if(Y.accountId&&X.vault?.owns(Y.accountId)){let H=await X.vault.send(Y.accountId,z,{site:"cachekeep",signal:Q});if(!H)throw Error(`vault refused warm for ${Y.accountId}`);return H}if(X.vault&&await X.vault.authority()!=="local")throw Error("local accounts are not warmed while this host is connected to the vault");let Z,W;if(Y.accountId&&Y.accountId!=="main"){let H=await X.refreshFallback(Y.accountId);if(typeof H==="string")Z=H;else Z=H.token,W=H.onAuthFailure}else Z=await X.getMainToken();if(X.vault&&await X.vault.authority()!=="local")throw Error("local accounts are not warmed while this host is connected to the vault");let B=await z(Z);if(B.status===401)await W?.(B.status);return B},readUsage({response:Y,text:G}){let Q=Y.headers.get("content-type")??"",z=Q.includes("text/event-stream")||/(^|\n)(data:|event:)/.test(G.slice(0,200));J?.debug("cachekeep warm response",{status:Y.status,contentType:Q,bodyLen:G.length,isSse:z});let Z=z?vA(G):wA(G),W=o9(Y.headers);return{...Z,quota_primary_pct:W.primary?.usedPercent??null,quota_secondary_pct:W.secondary?.usedPercent??null}},profile:kA,...$?{activeAccount:(Y,G)=>$(G.meta.routingSessionId)}:{}}}function $V(X){let{fetchImpl:J,getMainToken:$,refreshFallback:Y,vault:G,codexResponsesUrl:Q,activeAccount:z,logger:Z,...W}=X;return new S3({...W,logger:Z,adapter:yA({fetchImpl:J,getMainToken:$,refreshFallback:Y,vault:G,codexResponsesUrl:Q,activeAccount:z,logger:Z})})}import{readFileSync as hA}from"node:fs";var fA=60000,gA=15000,t$=2000,e$=1e4;async function I3(X,J){let $,Y=await Promise.race([X.then(()=>!0,()=>!0),new Promise((G)=>{$=setTimeout(()=>G(!1),J),$.unref?.()})]);return clearTimeout($),Y}function mA(X){if(!G6(X.quota))return;let J=f0(X.quota);return J.limits.some(($)=>$.kind==="reading")?J.checkedAt:void 0}function uA(X){if(!X)return;let J=V6(X);return J?U6(J):void 0}function pA(X){try{let J=JSON.parse(hA(X,"utf8"));if(!J||typeof J!=="object"||Array.isArray(J))return;return N6(J).migratedAt}catch{return}}function cA(X){if(X.type!=="oauth")return!1;return X.candidate||X.torn===!0&&X.enabled}class XY{deps;now;log;snapshot={active:!1,rows:[],key:void 0,readAt:0};inflightRead;store;refreshing=new Map;backoff=new Map;rotated=new Map;pending=new Map;writes=new Map;marks=new Map;lastPull=new Map;quotaPulls=new Map;polled=new Set;pollOutcomes=new Map;disposed=!1;vaultRosterSettled;pollsAwaitVault=!1;constructor(X){this.deps=X,this.now=X.now??Date.now,this.log=X.log??Z0("pool"),this.vaultRosterSettled=X.vaultFirstRoster===void 0;let J=()=>{this.vaultRosterSettled=!0};X.vaultFirstRoster?.then(J,J)}async awaitVaultRoster(X){let J=this.deps.vaultFirstRoster;if(this.vaultRosterSettled||!J)return;await I3(J,X)}peek(){return{active:this.snapshot.active,rows:this.snapshot.rows}}async current(){if(this.disposed)return this.peek();let X=this.filesKey();if(this.snapshot.key===X)return this.peek();let J=this.startRead(X),$=await GX(J,this.deps.readBudgetMs??YX,()=>this.snapshot);return{active:$.active,rows:$.rows}}async load(){if(this.disposed)return this.peek();if(await this.deps.vaultAuthority?.(),this.disposed)return this.peek();let X=await this.startRead(this.filesKey());return{active:X.active,rows:X.rows}}filesKey(){let X=this.deps.paths();return`${X.configPath}|${S$(X.configPath)}|${S$(X.statePath)}`}storeFor(X){if(this.store?.configPath===X.configPath)return this.store.store;let J=z8({provider:"openai",configPath:X.configPath,statePath:X.statePath,quota:m8,now:this.now,pull:($)=>this.coalescedPull($),onPullFailure:($,Y)=>{this.pollOutcomes.set($,{id:$,ok:!1,error:Y.message}),this.log.warn("pool quota poll failed",{rowId:$,kind:Y.kind,error:Y.message})},logger:this.log,...this.deps.store,onStep:async($,Y)=>{if(await this.deps.store?.onStep?.($,Y),Y.operation!=="updateSettings"&&$.startsWith("before-")&&this.deps.vaultAuthority&&await this.deps.vaultAuthority()!=="local")throw Error("Local account writes are disabled while connected to the vault.")}});return this.store={configPath:X.configPath,store:J},J}startRead(X){if(this.disposed)return Promise.resolve(this.snapshot);if(this.inflightRead?.key===X)return this.inflightRead.promise;let J=this.now(),$=this.read(X,J),Y={key:X,promise:$};this.inflightRead=Y;let G=()=>{if(this.inflightRead===Y)this.inflightRead=void 0};return $.then(G,G),$}async read(X,J){let $=this.deps.paths(),Y={active:!1,rows:[],key:X,readAt:J};try{if(pA($.configPath)!==void 0){let z=await this.storeFor($).read();if(z.status==="ready")Y={active:!0,rows:z.rows,key:X,readAt:J};else this.log.warn("migrated install has no readable account pool",{status:z.status,...z.status==="error"?{reason:z.reason}:{}})}}catch(Q){return this.log.warn("account pool read failed",{error:Q instanceof Error?Q.message:String(Q)}),this.snapshot}if(this.disposed)return this.snapshot;let G=this.snapshot.active;if(J>=this.snapshot.readAt)this.snapshot={...Y,rows:this.withLocalState(Y.rows)};if(this.snapshot.active){if(!G)this.log.info("account pool serves requests");this.pollUnseenRows()}return this.snapshot}withLocalState(X){let J=this.now();return X.map(($)=>{let Y=$,G=this.rotated.get($.id),Q=G?.credential;if(G&&G.credentialEpoch!==$.credentialEpoch)this.rotated.delete($.id);else if(Q?.type==="oauth"&&$.credential?.type==="oauth"){let z=$.credential.lastRefreshedAt??0,Z=Q.lastRefreshedAt??0;if(z>=Z)this.rotated.delete($.id);else Y={...Y,credential:Q}}return fB(Y,this.pending,J)})}replaceRow(X,J){this.snapshot={...this.snapshot,rows:this.snapshot.rows.map(($)=>$.id===X?J($):$)}}vaultOwned(X){if(this.deps.vaultMode?.())return!0;return X.identity!==void 0&&(this.deps.vaultIdentities?.().has(X.identity)??!1)}pollUnseenRows(){if(this.disposed)return;let X=this.deps.vaultFirstRoster;if(!this.vaultRosterSettled&&X&&!this.deps.vaultMode?.()){if(this.pollsAwaitVault)return;this.pollsAwaitVault=!0,I3(X,this.deps.vaultFirstRosterBackgroundWaitMs??e$).then((J)=>{if(this.pollsAwaitVault=!1,J)this.pollUnseenRows();else this.log.info("first quota polls skipped: the vault has not read its accounts yet")});return}for(let J of this.snapshot.rows){if(!cA(J)||this.vaultOwned(J))continue;let $=`${J.id}\x00${J.credentialEpoch??0}\x00${J.identity??""}`;if(this.polled.has($))continue;this.polled.add($),this.requestReading(J.id,!0)}}requestReading(X,J=!1){if(this.disposed||this.deps.vaultMode?.())return;let $=this.now(),Y=this.lastPull.get(X);if(!J&&Y!==void 0&&$-Y<(this.deps.pullRetryMs??gA))return this.storeFor(this.deps.paths()).pullsSettled();this.lastPull.set(X,$);let G=this.storeFor(this.deps.paths());return G.requestReading(X),G.pullsSettled()}coalescedPull(X){let J=JSON.stringify([this.deps.paths().configPath,X.id,X.credentialEpoch,X.identity]),$=this.quotaPulls.get(J);if($)return $;let Y=this.pull(X).finally(()=>this.quotaPulls.delete(J));return this.quotaPulls.set(J,Y),Y}async pull(X){if(this.deps.vaultAuthority&&await this.deps.vaultAuthority()!=="local")throw Error("local accounts are not polled while this host is connected to the vault");let J;try{if(J=await this.deps.pullQuota(X),!J)throw Error("the quota poll returned no reading")}catch(Y){throw this.pollOutcomes.set(X.id,{id:X.id,ok:!1,error:Y instanceof Error?Y.message:String(Y)}),Y}this.pollOutcomes.set(X.id,{id:X.id,ok:!0});let $=this.snapshot.rows.find((Y)=>Y.id===X.id);if($&&$.credentialEpoch===X.credentialEpoch&&$.identity===X.identity)this.applyObservation($,J);return J}applyObservation(X,J){hB(this.pending,X,J),this.replaceRow(X.id,($)=>({...$,quota:I$($.quota,J),needsFirstReading:!1}))}recordSnapshot(X,J,$,Y){if(!this.snapshot.active||this.disposed||this.deps.vaultMode?.())return;let G=this.snapshot.rows.find((j)=>j.id===X);if(G?.type!=="oauth")return;let Q=uA($);if(!(Q&&G.identity?Q===G.identity:Y4(G)?.access===$))return;let Z=I9(J,this.now(),Y);if(!Z)return;if(this.applyObservation(G,Z),G.credentialEpoch===void 0)return;let W={credentialEpoch:G.credentialEpoch,...G.identity!==void 0?{identity:G.identity}:{}},B=this.storeFor(this.deps.paths()),U=(this.writes.get(G.id)??Promise.resolve()).then(async()=>{if(this.deps.vaultAuthority&&await this.deps.vaultAuthority()!=="local")return;return B.recordQuota(G.id,W,Z)}).catch((j)=>{this.log.warn("pool quota not recorded",{rowId:G.id,error:j instanceof Error?j.message:String(j)})});this.writes.set(G.id,U),U.finally(()=>{if(this.writes.get(G.id)===U)this.writes.delete(G.id)})}markRateLimited(X,J){let $=this.snapshot.rows.find((Q)=>Q.id===X);if(!$)return;let Y=P3($),G=this.marks.get(Y);if(G!==void 0&&G>J)return;this.marks.set(Y,J)}rateLimitMarks(X){let J=new Map;for(let $ of X){let Y=this.marks.get(P3($));if(Y!==void 0)J.set($.id,Y)}return J}async prepareTokens(X,J,$={}){if(this.deps.vaultAuthority&&await this.deps.vaultAuthority()!=="local")return;if(!this.deps.vaultMode?.())await this.awaitVaultRoster(this.deps.vaultFirstRosterWaitMs??t$);let Y=this.now(),G=aJ(J),Q=[];for(let z of X){if(!z.candidate||this.vaultOwned(z))continue;let Z=Y4(z);if(!Z)continue;let W=(Z.expires??0)-Y;if(!(!Z.access||!Z.expires||W<=G)||this.refreshBackedOff(z,J,Y))continue;let H=this.refresh(z.id);if($.waitForAll||!Z.access||!Z.expires||W<=fA)Q.push(H)}await Promise.all(Q)}refreshBackedOff(X,J,$=this.now()){let Y=Y4(X);if(!Y)return!1;let G=s6(Y.refresh),Q=this.backoff.get(X.id);if(Q&&Q.tokenHash===G&&Q.nextRetryAt>$)return!0;let z=J?.accounts.find((Z)=>Z.id===X.id);return Boolean(z?.type==="oauth"&&z.corrupt!==!0&&r0(z.lastRefreshError,Y.refresh,$))}usableToken(X,J=this.now()){let $=this.snapshot.rows.find((G)=>G.id===X.id);if(!$?.enabled||!$.candidate||$.type!=="oauth"||$.identity!==X.identity||$.credentialEpoch!==X.credentialEpoch||this.vaultOwned($))return;let Y=Y4($);if(!Y?.access.trim())return;if(typeof Y.expires!=="number"||Y.expires<=J)return;return Y.access}refresh(X){let J=this.refreshing.get(X);if(J)return J;let $=this.runRefresh(X).finally(()=>{if(this.refreshing.get(X)===$)this.refreshing.delete(X)});return this.refreshing.set(X,$),$}async runRefresh(X){if(this.deps.vaultAuthority&&await this.deps.vaultAuthority()!=="local")return;let J=this.deps.paths(),$=this.snapshot.rows.find((z)=>z.id===X),Y=$?Y4($)?.refresh:void 0,G,Q=(z,Z)=>{return G=Z.credentialEpoch,this.deps.refreshProvider(z,Z)};try{let z=await KH({paths:J,store:this.storeFor(J),now:this.now,...this.deps.legacyLocks?{legacyLocks:this.deps.legacyLocks}:{}},X,Q);if(z.status==="rotated"){this.backoff.delete(X),this.rotated.set(X,{credential:z.credential,credentialEpoch:G}),this.replaceRow(X,(Z)=>Z.credentialEpoch!==G?Z:{...Z,credential:z.credential,...z.identity!==void 0&&Z.identity===void 0?{identity:z.identity}:{}});return}if(z.status==="identity-contradicted"){this.backoff.delete(X),this.replaceRow(X,(Z)=>({...Z,enabled:!1,candidate:!1})),this.log.warn("pool row disabled: its refresh returned a different account",{rowId:X});return}this.recordRefreshFailure(X,Y,Error(z.reason))}catch(z){this.recordRefreshFailure(X,Y,z)}}recordRefreshFailure(X,J,$){if(this.log.warn("pool row refresh failed",{rowId:X,error:$ instanceof Error?$.message:String($)}),!J)return;this.backoff.set(X,gB(J,$,this.now(),this.backoff.get(X)))}refreshBackoffFor(X){return mB(X,this.backoff,this.now(),(J,$)=>this.usableToken(J,$))}async active(){return(await this.current()).active}poolStore(){return this.storeFor(this.deps.paths())}async refreshDueTokens(X){let J=await this.current();if(!J.active||this.disposed)return;await this.prepareTokens(J.rows,X,{waitForAll:!0})}async pollRows(X,J={}){let $=await this.load();if(!$.active||this.disposed)return[];let Y=this.now(),G=$.rows.filter((Q)=>{if(!Q.candidate||Q.type!=="oauth"||this.vaultOwned(Q))return!1;if(J.ids&&!J.ids.includes(Q.id))return!1;if(J.skipReadWithinMs===void 0)return!0;let z=mA(Q);return z===void 0||Y-z>=J.skipReadWithinMs});if(G.length===0)return[];await this.prepareTokens(G,X,{waitForAll:!0});for(let Q of G)this.pollOutcomes.delete(Q.id),this.requestReading(Q.id,!0);return await this.poolStore().pullsSettled(),G.map((Q)=>this.pollOutcomes.get(Q.id)??{id:Q.id,ok:!1,error:"the quota poll did not run"})}async accessFor(X,J){let $=await this.current();if(!$.active)return;let Y=$.rows.find((z)=>z.id===X);if(!Y?.candidate)return;await this.prepareTokens([Y],J);let G=this.snapshot.rows.find((z)=>z.id===X)??Y;if(!G.candidate)return;let Q=this.usableToken(G);return Q?{row:G,token:Q}:void 0}async rowAccess(X,J){let $=await this.current();if(!$.active)return;let Y=$.rows.find((Q)=>Q.id===X);if(!Y)return{};let G=await this.accessFor(X,J);return{row:{id:Y.id,type:Y.type,enabled:Y.enabled,...Y.label!==void 0?{label:Y.label}:{},...Y.identity!==void 0?{identity:Y.identity}:{}},...G?{token:G.token}:{}}}dispose(){this.disposed=!0}async settled(){for(;;){let X=[...this.writes.values(),...this.refreshing.values(),...this.inflightRead?[this.inflightRead.promise]:[]];if(await Promise.allSettled(X),await this.store?.store.pullsSettled(),this.writes.size===0&&this.refreshing.size===0&&!this.inflightRead)return}}}var YV=60000,JY=900000,lA={set(X,J){let $=setTimeout(X,J);return $.unref?.(),$},clear(X){clearTimeout(X)}};function dA(X){return X.status==="completed"||X.status==="already-migrated"||X.status==="nothing-to-import"||X.status==="ambiguous"}function GV(X){return X.status==="deferred"||X.status==="retry"||X.status==="error"}function QV(X){let J=X.log??Z0("pool-migration"),$=X.timers??lA,Y=X.random??Math.random,G=X.migrate??d7,Q=X.adopt??i7,z=X.fence??(()=>j4({currentVersion:X.version})),Z=!1,W=!1,B=!1,H=0,U,j=Promise.resolve(),N,K,q,F=!1;function O(){if(F)return;F=!0,J.warn(U4,{reason:"placeholder-without-main"})}let _=()=>({paths:X.paths(),slot:X.slot,log:J,...X.runDeps});function C(w){let J0=j.then(w).catch((G0)=>{J.warn("account pool background run failed",{error:G0 instanceof Error?G0.message:String(G0)})});return j=J0,J0}function L(w){if(W)return;if(U!==void 0)$.clear(U);U=$.set(()=>{U=void 0,C(i)},w)}function P(){let w=Math.min(YV*2**Math.min(H,10),JY);return H++,A(w)}let A=(w)=>Math.round(w*(1-0.2*Y()));async function T(){if(!await X.paused?.())return!1;return L(A(YV)),!0}async function k(){if(W||await T()||W)return;let w;try{w=await G({..._(),fence:z})}catch(J0){J.warn("account pool migration failed; it will be tried again",{error:J0 instanceof Error?J0.message:String(J0)}),L(P());return}if(w.status==="refused"){if(w.reason==="placeholder-without-main")O();L(A(JY));return}if(dA(w)){if(B=!0,H=0,w.status==="completed")J.info("account pool migration completed",{rowId:w.rowId});await p();return}if(GV(w)){if(w.status!=="deferred")J.warn("account pool migration will be tried again",{outcome:w});L(P())}}async function p(){if(W||await T()||W)return;let w;try{let J0=await z();if(W)return;if(!J0.open){let G0=JSON.stringify(J0.blockers);if(G0!==q)q=G0,J.info("host login adoption waits for older plugin versions",{blockers:J0.blockers});L(P());return}w=await Q(_())}catch(J0){J.warn("adopting the host login into the account pool failed",{error:J0 instanceof Error?J0.message:String(J0)}),L(P());return}if(w.status==="not-migrated")return;if(w.status==="slot-read-only")return;if(B=!0,w.status==="completed")J.info("host login adopted into the account pool",{rowId:w.rowId,operation:w.operation});if(GV(w)){J.warn("host login adoption will be tried again",{outcome:w}),L(P());return}if(H=0,B)L(A(JY))}async function i(){if(W)return;if(B)await p();else await k()}function X0(){if(N)return N;let w=C(async()=>{if(N=void 0,!W)if(B)await p();else await k()});return N=w,w}return{start(){if(Z||W)return;Z=!0,C(k)},requestAdoption:X0,noticePlaceholderWithoutMain:O,noticeRealSlot(w){if(!B||W||w===K)return;K=w,X0()},dispose(){if(W=!0,U!==void 0)$.clear(U);U=void 0},idle:async()=>{for(;;){let w=j;if(await w,w===j)return}},migrated:()=>B}}var E6="main";function ZV(X,J,$){let Y=new Map;if(z9(J))for(let G of X)Y.set(G.id,Z1(K8(G.quota),J,G.id===E6?void 0:G.id,$));return Y}var WV=5,iA=5000;function BV(X){if(X==="ordered")return"roster";return X==="fallback-first"?"fallback-first":"main-first"}function HV(X,J=iA){let $=X.rows.filter((z)=>z.kind==="oauth"&&X.killswitch.get(z.id)!==!1&&f0(z.quota).limits.length===0);if($.length===0)return;if(a8({rows:X.rows,now:X.now,rateLimitMarks:X.rateLimitMarks,refreshBackoff:X.refreshBackoff,requestPull:()=>{}}).admitted.some((z)=>X.killswitch.get(z.id)!==!1))return;let G=[];if(a8({rows:$,now:X.now,rateLimitMarks:X.rateLimitMarks,refreshBackoff:X.refreshBackoff,requestPull:(z)=>{let Z=X.requestPull(z);if(Z)G.push(Z.catch(()=>{}))}}),G.length===0)return;let Q;return Promise.race([Promise.all(G),new Promise((z)=>{Q=setTimeout(z,J)})]).then(()=>{}).finally(()=>clearTimeout(Q))}function $Y(X){return X.reason==="exhausted"||X.reason==="budget-spent"}function VV(X,J,$){if(X===void 0)return{reason:"no-credential"};if($.get(X)===!1)return{reason:"killswitch"};let Y=J.excluded.find((Q)=>Q.id===X);if(Y?.reason==="rate-limited")return{reason:"mid-stream-rate-limit",resetAtMs:Y.until};if(Y)return{reason:"no-credential"};let G=J.refused.find((Q)=>Q.id===X);if(G&&"resetAtMs"in G)return{reason:"quota-exhausted",resetAtMs:G.resetAtMs};if(G)return{reason:"quota-unknown"};return{reason:"no-credential"}}function zV(X,J,$){if(J.refused.find((G)=>!$Y(G)&&$.get(G.id)!==!1))return{reason:"quota-unknown"};return VV(X[0],J,$)}function UV(X){let J=X.replayable!==!1,$=J?X.placement:"main-first",Y=tX({rows:X.rows,placement:$,formerMainId:E6,killswitch:X.killswitch,rateLimitMarks:X.rateLimitMarks,refreshBackoff:X.refreshBackoff,now:X.now,requestPull:X.requestPull}),G=k1(X.rows.map((Z)=>Z.id),$,E6),Q=new Set(Y.admission.refused.filter((Z)=>$Y(Z)&&X.killswitch.get(Z.id)!==!1).map((Z)=>Z.id)),z=G.filter((Z)=>Q.has(Z));if(!J){let Z=G.includes(E6),W=Z?E6:Y.order[0]??z[0];if(W!==void 0&&Y.order.includes(W))return{kind:"send",order:[W],lastPath:!1};if(W!==void 0&&Q.has(W))return{kind:"send",order:[W],lastPath:!0};return{kind:"block",block:Z?VV(E6,Y.admission,X.killswitch):zV(G,Y.admission,X.killswitch)}}if(Y.order.length>0)return{kind:"send",order:Y.order,lastPath:!1};if(z.length>0)return{kind:"send",order:z,lastPath:!0};return{kind:"block",block:zV(G,Y.admission,X.killswitch)}}function YY(X){let J=a8({rows:X.rows,rateLimitMarks:X.rateLimitMarks,refreshBackoff:X.refreshBackoff,now:X.now,requestPull:X.requestPull}),$=new Map;for(let Y of X.rows)$.set(Y.id,f0(Y.quota));for(let Y of J.admitted)if(Y.projection)$.set(Y.id,Y.projection);return{projections:$,excluded:new Set(J.excluded.map((Y)=>Y.id))}}function KV(X,J,$){let Y=$.exclude,G=Y?X.rows.filter((z)=>!Y.has(z.id)):X.rows,Q=new Map;for(let z of G){let Z=J.resetCredits(z.id);if(Z!==void 0)Q.set(z.id,Z)}return Q5({rows:G,now:X.now,rateLimitMarks:X.rateLimitMarks,refreshBackoff:X.refreshBackoff,requestPull:X.requestPull,killswitch:X.killswitch,requestBytes:J.requestBytes,...$.pendingBytes?{pendingBytes:$.pendingBytes}:{},rowReservePercent:(z)=>J.reservePercent(z.id),refusedPinPolicy:"move-on-confirmed-exhaustion",resetCreditsApplicable:Q,...$.pin===void 0?{}:{pin:{accountId:$.pin}},...J.onEmptyWeightedSet?{onEmptyWeightedSet:J.onEmptyWeightedSet}:{}})}function jV(X,J,$,Y){let G=KV(X,J,{exclude:$,pendingBytes:Y});if(G.outcome!=="dispatch"||G.source==="pin")return;return{accountId:G.accountId,source:G.source,...G.quotaCheckedAt===void 0?{}:{quotaCheckedAt:G.quotaCheckedAt}}}function NV(X,J,$){let Y=X.killswitch.get($)===!1,G=KV(X,J,{pin:$});if(G.outcome==="dispatch"){if(G.pin.action==="assign")return{kind:"move",reason:Y?"killswitch":"exhausted"};return G.accountId===$?{kind:"serve"}:{kind:"detour"}}let Q=G.admission.refused.find((z)=>z.id===$);if(!Y&&Q&&$Y(Q))return{kind:"last-path"};return{kind:"none"}}function qV(X,J,$,Y){let G=X.killswitch.get($);return G5({quota:J.projections.get($),now:X.now,...Y===void 0?{}:{status:Y},...G===void 0?{}:{killswitchPasses:G}})}var D1={"missing-main":"Request refused locally: this setup has no main login in its account store. Sign in with opencode auth login.","no-accounts":"Request refused locally: no eligible account is configured. Sign in with opencode auth login.",unusable:"Request refused locally: no usable account credential. Sign in with opencode auth login.",...Q$};function zY(X){return X!==void 0&&X in Q$}function nA(X,J,$,Y=new Set){return X.filter((G)=>{if(!G.enabled||!G.candidate||G.type!=="oauth")return!1;if(G.credential?.type!=="oauth")return!1;if(T0(G.credential))return!1;if(G.identity!==void 0&&Y.has(G.identity))return!1;if(G.id===E6)return!0;if(Q9(J,{accountId:G.identity}))return!1;return U3(K8(G.quota),J,$)})}function GY(X){let J=X.vault;return[...(J?[]:nA(X.source.peek().rows,X.storage,X.now())).map((Y)=>({id:Y.id,kind:"oauth",...Y.identity!==void 0?{identity:Y.identity}:{},...Y.quota!==void 0?{quota:Y.quota}:{},row:Y})),...(J?.routes()??[]).filter((Y)=>U3(K8(Y.quota),X.storage,X.now())).map((Y)=>({id:Y.id,kind:Y.kind,...Y.identity!==void 0?{identity:Y.identity}:{},...Y.quota!==void 0?{quota:Y.quota}:{}}))]}function sA(X){return X.flatMap((J)=>J.row?[J.row]:[])}function QX(X,J){let $=X.now(),Y=ZV(J,X.storage,$),G=J.map((W)=>({id:W.id,kind:W.kind,...G6(W.quota)?{quota:W.quota}:{}})),Q=sA(J),z=new Set(J.filter((W)=>!W.row).map((W)=>W.id)),Z=X.source.rateLimitMarks(Q);for(let[W,B]of X.vault?.rateLimitMarks?.()??[])if(z.has(W)&&B>$)Z.set(W,B);return{rows:G,now:$,rateLimitMarks:Z,refreshBackoff:X.source.refreshBackoffFor(Q),killswitch:Y,requestPull:(W)=>z.has(W)?X.vault?.requestReading(W):X.source.requestReading(W)}}function LV(X){let J=X.find(($)=>$.id===E6);return{main:J?K8(J.quota):void 0,fallbacks:X.filter(($)=>$.id!==E6).map(($)=>{let Y=K8($.quota);return{accountId:$.id,...Y?{quota:Y}:{}}})}}async function QY(X,J){if(J.row){let $=X.source.usableToken(J.row);if(!$)return;let Y=await X.send(J,$);return X.recordQuota(Y,J,$),Y}return X.vault?.send(J.id,async($,Y)=>{let G=await X.send(J,$,Y);return X.recordQuota(G,J,$,Y),G})}async function DV(X){if(X.vault)await X.vault.awaitRoster();else await X.source.current(),await X.source.prepareTokens(X.source.peek().rows,X.storage);let J=GY(X),$=X.replayable===!1&&J.some((G)=>G.id===E6)?J.filter((G)=>G.id===E6):J,Y=HV(QX(X,$));if(Y)await Y,J=GY(X);if(X.mode==="sticky-balanced"&&X.sessionId&&X.replayable&&X.body!==void 0){let G=await oA(X,J,X.sessionId,X.body);if(G)return G}return aA(X,J)}async function aA(X,J){let $=BV(X.mode),Y=UV({...QX(X,J),placement:$,replayable:X.replayable});if(Y.kind==="block")return X.log.debug("pool admission blocked the request",{pid:process.pid,reason:Y.block.reason}),{response:X.blocked(Y.block,LV(J),X.vault?J.length===0?X.vault.noRouteCause():void 0:J.length===0?"no-accounts":"unusable"),servedId:E6};if(Y.lastPath)X.log.debug("pool admission: every account is exhausted; probing anyway",{pid:process.pid,order:Y.order});let G=new Map(J.map((H)=>[H.id,H])),Q=sJ(X.storage),z=[],Z=new Set,W,B=!1;for(;;){let H=eX(Y.order.filter((N)=>!Z.has(N)),z,Q),U=H===void 0?void 0:G.get(H);if(!U)break;let j;try{j=await QY(X,U)}catch(N){if(X.isAbort(N)||!W||X.mode==="fallback-first")throw N;return X.log.debug("pool fallback attempt threw; stopping",{pid:process.pid,accountId:U.id}),W}if(!j){if(!U.row)B=!0;Z.add(U.id);continue}W?.response.body?.cancel().catch(()=>{}),W={response:j,servedId:U.id},z.push({id:U.id,status:j.status})}if(W)return W;return{response:X.blocked({reason:"no-credential"},LV(J),B?"vault-refused":X.vault?"vault-empty":"unusable"),servedId:E6}}async function oA(X,J,$,Y){let G=Buffer.byteLength(Y,"utf8"),Q=new Map(J.map((O)=>[O.id,O])),z=QX(X,J),Z=YY(z),W={requestBytes:G,reservePercent:(O)=>a6(X.storage,O===E6?void 0:O),resetCredits:X.resetCredits,onEmptyWeightedSet:()=>{X.log.debug("sticky routing: no fresh weighted candidates; using configured order")}},B=(O,_)=>(C,L)=>{let P=new Set(C);return X.placePin({sessionId:$,requestBytes:G,now:O.now,validPinnedAccountIds:O.rows.map((A)=>A.id).filter((A)=>!_.excluded.has(A)),excludeAccountIds:C,quotaCheckedAtByAccount:Object.fromEntries(O.rows.map((A)=>[A.id,_.projections.get(A.id)?.checkedAt])),wireAccountIdByAccount:Object.fromEntries(J.map((A)=>[A.id,A.identity])),select:(A)=>jV(O,W,P,A),persist:L})},H=B(z,Z),U=H([],!0);if(!U)return;let j=U.accountId,N=(O)=>{let _=H([j],!0);if(!_)return!1;return X.log.debug("sticky routing: migrated session pin",{pid:process.pid,fromAccountId:j,toAccountId:_.accountId,reason:O}),j=_.accountId,!0},K=NV(z,W,j);if(K.kind==="none")return;if(K.kind==="move"){if(!N(K.reason)&&K.reason==="killswitch")return}else if(K.kind==="detour"){let O=H([j],!1);if(!O)return;X.log.debug("sticky routing: pinned account awaits a quota reading",{pid:process.pid,pinnedAccountId:j,servedAccountId:O.accountId}),j=O.accountId}let q=Q.get(j);if(!q)return;let F=await QY(X,q);if(!F)return;if(F.status===401||F.status===403||F.status===429){let O=GY(X);z=QX(X,O),Z=YY(z),H=B(z,Z);let _=qV(z,Z,j,F.status);if(_.action==="migrate"){let C=j;if(N(_.reason)&&j!==C){let L=O.find((A)=>A.id===j),P=L?await QY(X,L):void 0;if(L&&P){let A=F;F=P,A.body?.cancel().catch(()=>{}),q=L}else j=C}}}return{response:F,servedId:q.id}}function b3(X){return typeof X==="number"&&Number.isFinite(X)}function rA(X){if(!G6(X))return;let J=X.budget;if(J?.kind!=="reading")return;let{limit:$,used:Y,remaining:G,usedPercent:Q,remainingPercent:z}=J;if(!b3($)||!b3(Y)||!b3(G)||!b3(Q)||!b3(z))return;return{limit:$,used:Y,remaining:G,usedPercent:Q,remainingPercent:z,reached:J.reached,...J.resetsAt!==void 0?{resetsAt:J.resetsAt}:{},...J.unit!==void 0?{unit:J.unit}:{}}}function ZY(X,J){let $=K8(X),Y=rA(X);if(!$&&!Y)return null;let G=G6(X)?f0(X).checkedAt:void 0;return{...G!==void 0?{checkedAt:G}:{},...$?.primary?{primary:$.primary}:{},...$?.secondary?{secondary:$.secondary}:{},...Y?{spendControl:Y}:{},...J!==void 0?{resetCreditsAvailable:J}:{}}}function FV(X,J,$,Y){return{main:{quota:null,killed:!1},fallbacks:[],vaultAccounts:X.map((G)=>({id:G.routeId,label:G.email||G.label||G.routeId,...G.accountIdentity!==void 0?{accountId:G.accountIdentity}:{},quota:ZY(G.quota),killed:!1,enabled:J.has(G.routeId)})),route:$?.routing?.mode??"main-first",lastUpdated:Y}}function PV(X,J,$,Y=()=>{return}){let G=X.find((z)=>z.id===U8),Q=G?Y(G.id):void 0;return{main:{quota:G?ZY(G.quota,Q):null,...G?.identity!==void 0?{mainAccountId:G.identity}:{},killed:!1,...Q!==void 0?{resetCredits:Q}:{}},fallbacks:X.filter((z)=>z.id!==U8&&z.enabled).map((z)=>{let Z=Y(z.id);return{id:z.id,label:z.label,...z.identity!==void 0?{accountId:z.identity}:{},quota:ZY(z.quota,Z),killed:!1,enabled:!0,...Z!==void 0?{resetCredits:Z}:{}}}),route:J?.routing?.mode??"main-first",lastUpdated:$,accountPool:!0}}import{randomUUID as tA}from"node:crypto";import{chmod as eA,mkdir as XT,rename as JT,rm as MV,writeFile as $T}from"node:fs/promises";import{homedir as YT}from"node:os";import{join as WY}from"node:path";function _V(){let X=process.env.XDG_STATE_HOME||WY(YT(),".local","state");return WY(X,"cortexkit","openai-auth","processes")}function AV(X=process.pid,J=_V()){return WY(J,`${X}.json`)}var zX=0,OV;async function GT(X,J){await XT(X,{recursive:!0,mode:448}),await eA(X,448);let $=AV(J.pid,X),Y=`${$}.${tA()}.tmp`;try{await $T(Y,`${JSON.stringify(J)}
-`,{mode:384}),await JT(Y,$)}catch(G){throw await MV(Y,{force:!0}).catch(()=>{}),G}return $}async function TV(X){let J=X.pid??process.pid,$=X.dir??_V();OV??=(X.now??Date.now)(),zX++;let Y;try{Y=await GT($,{pid:J,version:X.version,startedAt:OV})}catch(Q){X.logger.warn("process heartbeat not written",{dir:$,error:Q instanceof Error?Q.message:String(Q)})}let G=!1;return{path:Y,async release(){if(G)return;if(G=!0,zX=Math.max(0,zX-1),zX>0)return;await MV(AV(J,$),{force:!0}).catch((Q)=>{X.logger.warn("process heartbeat not removed",{dir:$,error:Q instanceof Error?Q.message:String(Q)})})}}}import{resolve as ZX}from"node:path";var QT=60000,zT=240000,RV=Symbol.for("@cortexkit/openai-auth/opencode-vaults"),CV=globalThis,k3=CV[RV]??new Map;CV[RV]=k3;function EV(X,J){let $=Boolean(X.connectScoped||X.connectEnrollment),Y=ZX(X.stateDir),G=ZX((X.connectionFile??e9)()),Q=JSON.stringify([X.host,Y,G,ZX(J.configPath),ZX(J.statePath)]),z={reservedRouteIds:X.reservedRouteIds??(()=>[])},Z=$?void 0:k3.get(Q);if(!Z){let H=new Set;if(Z={vault:new z$({...X,stateDir:Y,connectionFile:()=>G,...!$?{projectRoot:Y}:{},reservedRouteIds:()=>new Set([...H].flatMap((j)=>[...j.reservedRouteIds()]))}),holders:H,firstRoster:Promise.withResolvers(),started:!1},!$)k3.set(Q,Z)}Z.holders.add(z);let W=Z,B=!1;return{vault:W.vault,firstRoster:W.firstRoster.promise,start(){if(B||W.started)return;W.started=!0;let H=async()=>{if(W.holders.size&&await W.vault.authority()!=="local")await W.vault.pollStale(zT)};W.vault.start(),W.vault.firstRoster().finally(()=>{W.firstRoster.resolve(),H()}),W.quotaPoll=setInterval(H,QT),W.quotaPoll.unref?.()},release(){if(B)return;if(B=!0,W.holders.delete(z),W.holders.size!==0)return;if(W.quotaPoll)clearInterval(W.quotaPoll);if(W.vault.close(),W.firstRoster.resolve(),!$&&k3.get(Q)===W)k3.delete(Q)}}}var xV=900000,ZT=0.016666666666666666,SV=0.000001;function HY(X,J){for(let $ of[X?.primary?.checkedAt,X?.checkedAt,J])if(typeof $==="number"&&Number.isFinite($))return $;return}function VY(X){if(X.status===401||X.status===403)return{action:"migrate",reason:"permanent"};if(!X.quota)return{action:"retain",reason:"unknown"};let J=HY(X.quota,X.quotaCheckedAt);if(J===void 0||!Number.isFinite(J)||X.now-J>xV)return{action:"retain",reason:"stale"};if(X.killswitchPasses===!1)return{action:"migrate",reason:"killswitch"};let $=BY(X.quota).sort((G,Q)=>{let z=G.windowMs,Z=Q.windowMs,W=typeof z==="number"&&Number.isFinite(z),B=typeof Z==="number"&&Number.isFinite(Z);if(W!==B)return W?-1:1;if(W&&B)return Z-z;return 0});for(let{key:G,window:Q}of $)if(Number.isFinite(Q.remainingPercent)&&Q.remainingPercent<=0)return{action:"migrate",reason:"exhausted",windowKey:G,...typeof Q.resetsAt==="string"?{resetsAt:Q.resetsAt}:{}};let Y=kV(X.quota,X.now);if(Y)return{action:"migrate",reason:"exhausted",resetsAt:Y.resetsAt};if(X.status===void 0||X.status===0||!Number.isFinite(X.status)||X.status>=500&&X.status<=599||X.status===429)return{action:"retain",reason:"transient"};return{action:"retain",reason:"healthy"}}function IV(X,J,$){let Y=Math.max(0,X.remainingPercent-J);if(Y<=0)return 0;if(!X.resetsAt)return Y;let G=Date.parse(X.resetsAt);if(!Number.isFinite(G)||G<=$)return Y;let Q=Math.max((G-$)/3600000,ZT);return Y/Q}function bV(X,J){if(X<J)return-1;if(X>J)return 1;return 0}function WT(X,J){if(!X.quota)return;let $=HY(X.quota,X.quotaCheckedAt);if($===void 0||J-$>xV)return;let Y=BY(X.quota).map(({key:z,window:Z})=>{return IV(Z,X.reservePercent[z]??0,J)}),G=X.quota.spendControl;if(G&&Number.isFinite(G.remainingPercent))Y.push(IV(G,0,J));let Q=Y.length>0?Math.min(...Y):0;return Q>0?{candidate:X,quotaCheckedAt:$,weight:Q}:void 0}function wV(X){let J=X.candidates.filter((G)=>G.killswitchPasses!==!1);if(X.candidates.length===0)throw Error("Cannot select a sticky candidate: input.candidates is empty");if(J.length===0)return;let $=J.map((G)=>WT(G,X.now)).filter((G)=>G!==void 0);if($.length>0){$.sort((Q,z)=>{let Z=((X.pendingBytes.get(Q.candidate.accountId)??0)+X.requestBytes)/Math.max(Q.weight,SV),W=((X.pendingBytes.get(z.candidate.accountId)??0)+X.requestBytes)/Math.max(z.weight,SV);return Z-W||Q.candidate.configuredOrder-z.candidate.configuredOrder||bV(Q.candidate.accountId,z.candidate.accountId)});let G=$[0];if(G)return{accountId:G.candidate.accountId,quotaCheckedAt:G.quotaCheckedAt,source:"weighted"}}X.onEmptyWeightedSet?.();let Y=[...J].sort((G,Q)=>{let z=(G.resetCreditsApplicable??0)>0?1:0;return((Q.resetCreditsApplicable??0)>0?1:0)-z||G.configuredOrder-Q.configuredOrder||bV(G.accountId,Q.accountId)})[0];if(!Y)throw Error("Cannot select a sticky candidate: input.candidates is empty");return{accountId:Y.accountId,quotaCheckedAt:HY(Y.quota,Y.quotaCheckedAt),source:"mode-fallback"}}import{createHash as ET}from"node:crypto";import{createHash as BT,randomBytes as HT}from"node:crypto";import{chmod as VT,lstat as vV,mkdir as UT,open as KT,readdir as mV,readFile as yV,rename as jT,unlink as NY,writeFile as NT}from"node:fs/promises";import{join as WX,resolve as UY}from"node:path";var qT=100,KY="session-unknown",LT=300000,DT=60000,FT=600000,PT=/\.(body|meta|request|response)\.json$/,OT=/^\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z-\d+-\d{6,}-[a-zA-Z0-9._-]+$/,MT=/\.[a-f0-9]{24}\.partial$/;function uV(X){let J=X.replace(PT,"");if(J===X||!OT.test(J))return;return J}function _T(X){let J=X.replace(MT,"");return J!==X&&uV(J)!==void 0}async function hV(X){let{dir:J,maxBytes:$}=X,Y=X.now??Date.now(),G=X.minAgeMs??DT,Q=X.partialStaleMs??FT,z={removed:0,freedBytes:0};if(!($>0))return z;try{if((await vV(J)).isSymbolicLink())return z;let Z=new Set((X.protectedPaths??[]).map((F)=>UY(F))),W=await mV(J,{withFileTypes:!0}),B=[];await Promise.all(W.map(async(F)=>{if(!F.isFile())return;let O=_T(F.name),_=O?void 0:uV(F.name);if(!O&&_===void 0)return;let C=WX(J,F.name);try{let L=await vV(C);if(!L.isFile())return;B.push({path:C,size:L.size,mtimeMs:L.mtimeMs,group:_})}catch{}}));let H=B.reduce((F,O)=>F+O.size,0),U=0,j=0,N=async(F)=>{try{await NY(F.path),H-=F.size,j+=F.size,U+=1}catch{}};for(let F of B){if(F.group!==void 0)continue;if(Z.has(UY(F.path)))continue;if(Y-F.mtimeMs<Q)continue;await N(F)}let K=new Map;for(let F of B){if(F.group===void 0)continue;let O=K.get(F.group)??{files:[],newest:0};O.files.push(F),O.newest=Math.max(O.newest,F.mtimeMs),K.set(F.group,O)}let q=[...K.entries()].sort(([F,O],[_,C])=>O.newest-C.newest||F.localeCompare(_));for(let[,F]of q){if(H<=$)break;if(Y-F.newest<G)continue;if(F.files.some((O)=>Z.has(UY(O.path))))continue;for(let O of F.files)await N(O)}if(U>0)X.logger?.debug("removed old dump files",{removed:U,freedBytes:j});return{removed:U,freedBytes:j}}catch{return z}}async function AT(X,J,$){for(let Y=0;;Y+=1){let G=`${X}.${$?$():HT(12).toString("hex")}.partial`,Q=!1,z;try{z=await KT(G,"wx",384),Q=!0,await z.writeFile(J,"utf8"),await z.chmod(384),await z.close(),z=void 0,await jT(G,X);return}catch(Z){if(await z?.close().catch(()=>{}),Q)await NY(G).catch(()=>{});if(Z.code==="EEXIST"&&Y===0)continue;throw Z}}}function jY(X){return X.length<=16?X:`${X.slice(0,12)}…`}function x3(X,J){let $=X.trim().replace(/[^a-zA-Z0-9._-]+/g,"-").replace(/^-+|-+$/g,"");if(!$)return J;return $.slice(0,80)}function fV(X){return BT("sha256").update(X).digest("hex")}function TT(X){return X.toLowerCase().replace(/[-_]/g,"")}function gV(X){return X!==null&&typeof X==="object"&&!Array.isArray(X)}function RT(X,J){if(X===void 0)return null;if(X===J)return{changed:!1,firstByte:-1,lastPreviousByte:-1,lastCurrentByte:-1,previousBytes:X.length,currentBytes:J.length};let $=0;while($<X.length&&$<J.length&&X[$]===J[$])$++;let Y=X.length-1,G=J.length-1;while(Y>=$&&G>=$&&X[Y]===J[G])Y--,G--;return{changed:!0,firstByte:$,lastPreviousByte:Y,lastCurrentByte:G,changedPreviousBytes:Y-$+1,changedCurrentBytes:G-$+1,previousBytes:X.length,currentBytes:J.length}}var CT=0;function pV(X){let J=X.enabled===!0,$=X.pid??process.pid,Y=X.now??Date.now,G=X.logger,Q=new Set((X.secretKeys??[]).map(TT)),z=C2({extraSecretKeys:(T)=>Q.has(T),extraValuePatterns:[...X.secretPatterns??[]]}),Z=new Set(X.schemaKeys??["tools"]),W=new Map,B=()=>typeof X.dir==="function"?X.dir():X.dir;function H(T){let k=z.redact({[T]:null})[T];return k===null?void 0:k}function U(T){if(Array.isArray(T))return T.map(U);if(gV(T)){let k={};for(let[p,i]of Object.entries(T)){let X0=H(p);if(Z.has(p))k[p]=z.redactStrings(i);else if(X0!==void 0)k[p]=X0;else k[p]=U(i)}return k}return z.redactStrings(T)}function j(T){let k;try{k=JSON.parse(T)}catch{return{text:z.redactStrings(T),parsed:void 0}}let p=U(k),i=JSON.stringify(p);return{text:JSON.stringify(k)===i?T:i,parsed:gV(p)?p:void 0}}async function N(T,k,p,i){let X0=`-${x3(k,KY)}-${x3(p,"channel")}`,w;try{w=await mV(T)}catch{return}let J0=w.filter((G0)=>G0.endsWith(".meta.json")&&G0.includes(X0)).sort().reverse();for(let G0 of J0)try{if(JSON.parse(await yV(WX(T,G0),"utf8"))?.baselineKey!==i)continue;return await yV(WX(T,G0.replace(/\.meta\.json$/,".body.json")),"utf8")}catch{}return}function K(T,k){if(!W.has(T))while(W.size>=qT){let p=W.keys().next().value;if(p===void 0)break;W.delete(p)}W.set(T,k)}async function q(T){if(!J)return;let k=++CT,p=T.session?.trim()||KY,i=B(),X0=new Date(Y()).toISOString(),w=[X0.replace(/[:.]/g,"-"),String($),String(k).padStart(6,"0"),x3(p,KY),x3(T.channel,"channel"),...T.phase?[x3(T.phase,"phase")]:[]].join("-"),J0=WX(i,w),G0={body:`${J0}.body.json`,metadata:`${J0}.meta.json`,request:`${J0}.request.json`},L0=fV(`${T.channel}\x00${p}`);try{await UT(i,{recursive:!0,mode:448}),await VT(i,448);let m=W.get(L0),c0=m===void 0?void 0:"memory";if(m===void 0){if(m=await N(i,p,T.channel,L0),m!==void 0)c0="disk"}let m0=j(T.bodyText),r={id:w,createdAt:X0,pid:$,session:jY(p),channel:T.channel,...T.phase?{phase:T.phase}:{},accountId:T.accountId,status:T.status,error:T.error===void 0?void 0:z.redactStrings(T.error),baselineKey:L0,bodyBytes:Buffer.byteLength(T.bodyText,"utf8"),bodyHash:fV(T.bodyText),diff:RT(m,m0.text),baselineSource:c0,body:m0.parsed?{parseable:!0,...X.summarize?.(m0.parsed)}:{parseable:!1},...T.meta?{extra:U(T.meta)}:{},files:G0},a=U({url:T.url,method:T.method,accountId:T.accountId,headers:T.headers===void 0?void 0:Object.fromEntries(new Headers(T.headers).entries())}),u0=(e,c)=>NT(e,c,{encoding:"utf8",mode:384,flag:"wx"}),t=[[G0.body,m0.text],[G0.metadata,`${JSON.stringify(r,null,2)}
-`],[G0.request,`${JSON.stringify(a,null,2)}
-`]],h=await Promise.allSettled(t.map(([e,c])=>u0(e,c))),o=h.find((e)=>e.status==="rejected");if(o){if(X.cleanupFailedDumps)await F(t,h);throw o.reason}return K(L0,m0.text),G?.debug("dumped request",{id:w,session:jY(p),body:G0.body}),P(i,Object.values(G0)),{id:w,files:G0,responseFile:`${J0}.response.json`}}catch(m){G?.warn("request dump failed",{session:jY(p),error:m instanceof Error?m.message:String(m)});return}}async function F(T,k){await Promise.all(T.map(async([p],i)=>{let X0=k[i];if(X0?.status==="rejected"&&X0.reason?.code==="EEXIST")return;await NY(p).catch(()=>{})}))}let O=X.maxBytes??0,_=X.sweepIntervalMs??LT,C=0;function L(T,k){return{dir:T,maxBytes:O,protectedPaths:k,now:Y(),minAgeMs:X.sweepMinAgeMs,partialStaleMs:X.partialStaleMs,logger:G}}function P(T,k){if(!(O>0))return;let p=Y();if(p-C<_)return;C=p,hV(L(T,k))}async function A(T,k){if(!T)return;let p=U({status:k.status,requestId:k.requestId,usage:k.usage,...k.fields,complete:k.complete??!0});try{return await AT(T.responseFile,`${JSON.stringify(p,null,2)}
-`,X.stageName),T.responseFile}catch(i){G?.warn("response dump failed",{id:T.id,error:i instanceof Error?i.message:String(i)});return}}return{isEnabled:()=>J,setEnabled:(T)=>{J=T},dump:q,dumpResponse:A,sweep:(T)=>hV(L(B(),T))}}var lV=Z0("dump"),x9="x-cortexkit-openai-auth-dump-session",ST=["chatgpt-account-id","email","org_name","organization_name"],IT=["tools"];function qY(X){return ET("sha256").update(JSON.stringify(X)).digest("hex")}function bT(X){return X!=null&&typeof X==="object"&&"type"in X&&typeof X.type==="string"?X.type:"unknown"}function kT(X){let J=Array.isArray(X.input)?X.input:[],$=Array.isArray(X.tools)?X.tools:[],Y=X.client_metadata!=null&&typeof X.client_metadata==="object"&&!Array.isArray(X.client_metadata)?X.client_metadata:void 0;return{model:typeof X.model==="string"?X.model:void 0,stream:X.stream,generate:X.generate,store:X.store,previousResponseID:typeof X.previous_response_id==="string"?X.previous_response_id:void 0,promptCacheKey:typeof X.prompt_cache_key==="string"?X.prompt_cache_key:void 0,reasoning:X.reasoning,inputCount:J.length,inputHash:qY(J),inputBytes:JSON.stringify(J).length,firstInputHash:J[0]===void 0?null:qY(J[0]),toolsCount:$.length,toolTypes:$.map(bT),toolsHash:qY($),clientMetadataKeys:Y?Object.keys(Y).sort():[]}}function xT(){return pV({dir:()=>c6().dumpDir,logger:lV,secretKeys:ST,schemaKeys:IT,summarize:kT})}var cV=xT();async function q4(X){let J=c6().dump===!0;if(cV.setEnabled(J),!J)return;let $=typeof X.bodyText==="function"?X.bodyText():X.bodyText;await cV.dump({session:X.sessionID,channel:X.transport,phase:X.phase,bodyText:$,accountId:X.accountId,url:X.url,method:X.method,headers:X.headers,status:X.status,error:X.error})}async function F1(X){if(!c6().dump)return;lV.debug("diagnostic",X)}import{readFile as wT}from"node:fs/promises";import{homedir as vT}from"node:os";import{join as dV}from"node:path";var yT="https://models.dev/api.json",hT="OPENCODE_OPENAI_AUTH_MODELS_CACHE",fT="OPENCODE_MODELS_PATH",gT="OPENCODE_DISABLE_MODELS_FETCH",mT=1e4,uT=300000;function w9(X){return X!==null&&typeof X==="object"&&!Array.isArray(X)?X:null}function iV(X){if(X===void 0)return 0;return typeof X==="number"&&Number.isFinite(X)&&X>=0?X:null}function LY(X){let{input:J,output:$}=X;if(typeof J!=="number"||!Number.isFinite(J)||J<0)return null;if(typeof $!=="number"||!Number.isFinite($)||$<0)return null;let Y=iV(X.cache_read),G=iV(X.cache_write);if(Y===null||G===null)return null;return{input:J,output:$,cache:{read:Y,write:G}}}function pT(X){let J=w9(X);if(!J)return null;let $=LY(J);if(!$)return null;let Y=$;if(Array.isArray(J.tiers)){let z=[];for(let Z of J.tiers){let W=w9(Z);if(!W)continue;let B=w9(W.tier),H=B?.size;if(B?.type!=="context")continue;if(typeof H!=="number"||!Number.isFinite(H)||H<=0)continue;let U=LY(W);if(!U)continue;z.push({...U,tier:{type:"context",size:H}})}if(z.length>0)Y.tiers=z}let G=w9(J.context_over_200k),Q=G?LY(G):null;if(Q)Y.experimentalOver200K=Q;return Y}function nV(X){let J=w9(X),$=w9(J?.openai),Y=w9($?.models);if(!Y)return null;let G={};for(let[Q,z]of Object.entries(Y)){let Z=w9(z),W=pT(Z?.cost);if(W)G[Q]=W}return Object.keys(G).length>0?G:null}function cT(){let X=process.env[hT]?.trim();if(X)return X;let J=process.env[fT]?.trim();if(J)return J;let $=process.env.XDG_CACHE_HOME?.trim()||(process.platform==="win32"?process.env.LOCALAPPDATA?.trim():void 0)||dV(vT(),".cache");return dV($,"opencode","models.json")}function lT(){let X=process.env[gT]?.toLowerCase();return X==="true"||X==="1"}async function dT(){try{let X=nV(JSON.parse(await wT(cT(),"utf8")));if(X)return X}catch{}if(lT())return null;try{let X=await fetch(yT,{signal:AbortSignal.timeout(mT)});if(!X.ok)return null;return nV(await X.json())}catch{return null}}var L4;function sV(){let X=Date.now();if(L4&&L4.expiresAt>X)return L4.promise;let J={expiresAt:X+uT,promise:dT()};return L4=J,J.promise.then(($)=>{if($===null&&L4===J)L4=void 0}),J.promise}function D4(X){return typeof X==="object"&&X!==null}function iT(X){if(Array.isArray(X))return X;if(D4(X)&&Array.isArray(X.data))return X.data;return[]}function nT(X){if(!D4(X)||!D4(X.info))return;return typeof X.info.role==="string"?X.info.role:void 0}function aV(X){if(!D4(X)||!D4(X.info))return null;let J=X.info,$=D4(J.model)?J.model:void 0,Y=typeof J.agent==="string"?J.agent:void 0,G=typeof $?.providerID==="string"?$.providerID:typeof J.providerID==="string"?J.providerID:void 0,Q=typeof $?.modelID==="string"?$.modelID:typeof J.modelID==="string"?J.modelID:void 0,z=typeof $?.variant==="string"?$.variant:typeof J.variant==="string"?J.variant:void 0;if(!Y&&(!G||!Q)&&!z)return null;let Z={};if(Y)Z.agent=Y;if(G&&Q)Z.model={providerID:G,modelID:Q};if(z)Z.variant=z;return Z}function oV(X,J){return{agent:X.agent??J.agent,model:X.model??J.model,variant:X.variant??J.variant}}function rV(X){return Boolean(X.agent&&X.model&&X.variant)}async function tV(X,J){if(!X||!J)return null;let $=X;if(typeof $.session?.messages!=="function")return null;let Y=[];try{Y=iT(await Promise.resolve($.session.messages({path:{id:J},query:{limit:100}})))}catch{return null}if(Y.length===0)return null;let G={};for(let Q=Y.length-1;Q>=0;Q--){if(nT(Y[Q])!=="assistant")continue;let z=aV(Y[Q]);if(!z)continue;if(G=oV(G,z),rV(G))return G}for(let Q=Y.length-1;Q>=0;Q--){let z=aV(Y[Q]);if(!z)continue;if(G=oV(G,z),rV(G))return G}if(!G.agent&&!G.model&&!G.variant)return null;return G}var sT=Z0("rpc"),XU="__openaiAuthRpcServers";function JU(X){return eV({...X,isManagedDir:o7,log:sT,drain:(J,$)=>X.drain(J,$),apply:async(J)=>await X.apply(J)})}function F4(X){return JSON.stringify(DY(X))??"undefined"}function DY(X){if(Array.isArray(X))return X.map(DY);if(!s(X))return X;return Object.fromEntries(Object.keys(X).sort().map((J)=>[J,DY(X[J])]))}var aT=512,oT=2097152;function FY(X,J){if(typeof X==="function"||typeof J==="function")return!1;if(J!==null&&typeof J==="object"&&Object.hasOwn(J,"toJSON")&&typeof J.toJSON==="function")return!1;if(X===J)return!0;if(Array.isArray(X))return Array.isArray(J)&&X.length===J.length&&X.every((Q,z)=>FY(Q,J[z]));if(X===null||J===null||typeof X!=="object"||typeof J!=="object"||Array.isArray(J))return!1;let $=X,Y=J,G=Object.keys($);return G.length===Object.keys(Y).length&&G.every((Q)=>Object.prototype.propertyIsEnumerable.call(Y,Q)&&FY($[Q],Y[Q]))}function P1(X,J){let $=[],Y=[],G=0;for(let Q=0;Q<X.length;Q++){let z=J?.texts[Q],Z=z!==void 0&&FY(J?.snapshots[Q],X[Q]),W=Z?z:F4(X[Q]);$.push(W),Y.push(Z?J?.snapshots[Q]:W==="undefined"?void 0:JSON.parse(W)),G+=W.length}return{texts:$,snapshots:Y,retainable:X.length<=aT&&G<=oT}}function w3(X){return X.retainable?X:void 0}function v3(X,J){if(X.texts.length>J.texts.length)return;for(let $=0;$<X.texts.length;$++)if(X.texts[$]!==J.texts[$])return;return X.texts.length}function O1(){let X=crypto.getRandomValues(new Uint8Array(16)),J=Date.now();X[0]=J/1099511627776&255,X[1]=J/4294967296&255,X[2]=J/16777216&255,X[3]=J/65536&255,X[4]=J/256&255,X[5]=J&255,X[6]=(X[6]??0)&15|112,X[8]=(X[8]??0)&63|128;let $=Array.from(X,(Y)=>Y.toString(16).padStart(2,"0")).join("");return`${$.slice(0,8)}-${$.slice(8,12)}-${$.slice(12,16)}-${$.slice(16,20)}-${$.slice(20)}`}var N9={};MY(N9,{withoutInternalHeaders:()=>aq,sanitizeHttpFallbackBody:()=>a$,orderCodexBody:()=>t3,hasWebSocketResponsesLiteMetadata:()=>s$,createWebSocketFetch:()=>xI,applyTurnId:()=>cq,advanceTurn:()=>LG,TITLE_HEADER:()=>qG,QUOTA_ACCOUNT_HEADER:()=>xX,OpenAIWebSocketPool:()=>N9,CODEX_BODY_KEY_ORDER:()=>uq});import{createHash as EI}from"node:crypto";var rT=Symbol.for("vercel.ai.error"),H9=class X extends Error{constructor({name:J,message:$,cause:Y}){super($);this[rT]=!0,this.name=J,this.cause=Y}static isInstance(J){return X.hasMarker(J,"vercel.ai.error")}static hasMarker(J,$){let Y=Symbol.for($);return J!=null&&typeof J==="object"&&Y in J&&typeof J[Y]==="boolean"&&J[Y]===!0}},$U="AI_APICallError",YU=`vercel.ai.error.${$U}`,tT=Symbol.for(YU),M1=class extends H9{constructor({message:X,url:J,requestBodyValues:$,statusCode:Y,responseHeaders:G,responseBody:Q,cause:z,isRetryable:Z=Y!=null&&(Y===408||Y===409||Y===429||Y>=500),data:W}){super({name:$U,message:X,cause:z});this[tT]=!0,this.url=J,this.requestBodyValues=$,this.statusCode=Y,this.responseHeaders=G,this.responseBody=Q,this.isRetryable=Z,this.data=W}static isInstance(X){return H9.hasMarker(X,YU)}},eT="AI_EmptyResponseBodyError",fp=`vercel.ai.error.${eT}`;var XR="AI_EvaluationUnsupportedQuestionTypeError",gp=`vercel.ai.error.${XR}`;var GU="AI_InvalidArgumentError",QU=`vercel.ai.error.${GU}`,JR=Symbol.for(QU),PY=class extends H9{constructor({message:X,cause:J,argument:$}){super({name:GU,message:X,cause:J});this[JR]=!0,this.argument=$}static isInstance(X){return H9.hasMarker(X,QU)}},$R="AI_InvalidPromptError",mp=`vercel.ai.error.${$R}`;var YR="AI_InvalidResponseDataError",up=`vercel.ai.error.${YR}`;var GR="AI_JSONParseError",pp=`vercel.ai.error.${GR}`;var QR="AI_LoadAPIKeyError",cp=`vercel.ai.error.${QR}`;var zR="AI_LoadSettingError",lp=`vercel.ai.error.${zR}`;var ZR="AI_NoContentGeneratedError",dp=`vercel.ai.error.${ZR}`;var WR="AI_NoSuchModelError",ip=`vercel.ai.error.${WR}`;var BR="AI_NoSuchProviderReferenceError",np=`vercel.ai.error.${BR}`;var HR="AI_TooManyEmbeddingValuesForCallError",sp=`vercel.ai.error.${HR}`;var VR="AI_TypeValidationError",ap=`vercel.ai.error.${VR}`;var UR="AI_UnsupportedFunctionalityError",op=`vercel.ai.error.${UR}`;var Xc=Object.freeze({status:"aborted"});function E(X,J,$){function Y(Z,W){var B;Object.defineProperty(Z,"_zod",{value:Z._zod??{},enumerable:!1}),(B=Z._zod).traits??(B.traits=new Set),Z._zod.traits.add(X),J(Z,W);for(let H in z.prototype)if(!(H in Z))Object.defineProperty(Z,H,{value:z.prototype[H].bind(Z)});Z._zod.constr=z,Z._zod.def=W}let G=$?.Parent??Object;class Q extends G{}Object.defineProperty(Q,"name",{value:X});function z(Z){var W;let B=$?.Parent?new Q:this;Y(B,Z),(W=B._zod).deferred??(W.deferred=[]);for(let H of B._zod.deferred)H();return B}return Object.defineProperty(z,"init",{value:Y}),Object.defineProperty(z,Symbol.hasInstance,{value:(Z)=>{if($?.Parent&&Z instanceof $.Parent)return!0;return Z?._zod?.traits?.has(X)}}),Object.defineProperty(z,"name",{value:X}),z}var Jc=Symbol("zod_brand");class V9 extends Error{constructor(){super("Encountered Promise during synchronous parse. Use .parseAsync() instead.")}}class y3 extends Error{constructor(X){super(`Encountered unidirectional transform during encode: ${X}`);this.name="ZodEncodeError"}}var BX={};function c8(X){if(X)Object.assign(BX,X);return BX}var j0={};MY(j0,{unwrapMessage:()=>h3,uint8ArrayToHex:()=>fR,uint8ArrayToBase64url:()=>yR,uint8ArrayToBase64:()=>KU,stringifyPrimitive:()=>BU,shallowClone:()=>ZU,safeExtend:()=>IR,required:()=>xR,randomString:()=>_R,propertyKeyTypes:()=>TY,promiseAllObject:()=>MR,primitiveTypes:()=>WU,prefixIssues:()=>K9,pick:()=>CR,partial:()=>kR,optionalKeys:()=>RY,omit:()=>ER,objectClone:()=>FR,numKeys:()=>AR,nullish:()=>g3,normalizeParams:()=>Y0,mergeDefs:()=>y9,merge:()=>bR,jsonStringifyReplacer:()=>P4,joinValues:()=>DR,issue:()=>M4,isPlainObject:()=>h9,isObject:()=>_1,hexToUint8Array:()=>hR,getSizableOrigin:()=>VU,getParsedType:()=>TR,getLengthableOrigin:()=>u3,getEnumValues:()=>f3,getElementAtPath:()=>OR,floatSafeRemainder:()=>_Y,finalizeIssue:()=>q8,extend:()=>SR,escapeRegex:()=>U9,esc:()=>HX,defineLazy:()=>q0,createTransparentProxy:()=>RR,cloneDef:()=>PR,clone:()=>N8,cleanRegex:()=>m3,cleanEnum:()=>wR,captureStackTrace:()=>VX,cached:()=>O4,base64urlToUint8Array:()=>vR,base64ToUint8Array:()=>UU,assignProp:()=>v9,assertNotEqual:()=>jR,assertNever:()=>qR,assertIs:()=>NR,assertEqual:()=>KR,assert:()=>LR,allowsEval:()=>AY,aborted:()=>f9,NUMBER_FORMAT_RANGES:()=>CY,Class:()=>jU,BIGINT_FORMAT_RANGES:()=>HU});function KR(X){return X}function jR(X){return X}function NR(X){}function qR(X){throw Error()}function LR(X){}function f3(X){let J=Object.values(X).filter((Y)=>typeof Y==="number");return Object.entries(X).filter(([Y,G])=>J.indexOf(+Y)===-1).map(([Y,G])=>G)}function DR(X,J="|"){return X.map(($)=>BU($)).join(J)}function P4(X,J){if(typeof J==="bigint")return J.toString();return J}function O4(X){return{get value(){{let $=X();return Object.defineProperty(this,"value",{value:$}),$}throw Error("cached value already set")}}}function g3(X){return X===null||X===void 0}function m3(X){let J=X.startsWith("^")?1:0,$=X.endsWith("$")?X.length-1:X.length;return X.slice(J,$)}function _Y(X,J){let $=(X.toString().split(".")[1]||"").length,Y=J.toString(),G=(Y.split(".")[1]||"").length;if(G===0&&/\d?e-\d?/.test(Y)){let W=Y.match(/\d?e-(\d?)/);if(W?.[1])G=Number.parseInt(W[1])}let Q=$>G?$:G,z=Number.parseInt(X.toFixed(Q).replace(".","")),Z=Number.parseInt(J.toFixed(Q).replace(".",""));return z%Z/10**Q}var zU=Symbol("evaluating");function q0(X,J,$){let Y=void 0;Object.defineProperty(X,J,{get(){if(Y===zU)return;if(Y===void 0)Y=zU,Y=$();return Y},set(G){Object.defineProperty(X,J,{value:G})},configurable:!0})}function FR(X){return Object.create(Object.getPrototypeOf(X),Object.getOwnPropertyDescriptors(X))}function v9(X,J,$){Object.defineProperty(X,J,{value:$,writable:!0,enumerable:!0,configurable:!0})}function y9(...X){let J={};for(let $ of X){let Y=Object.getOwnPropertyDescriptors($);Object.assign(J,Y)}return Object.defineProperties({},J)}function PR(X){return y9(X._zod.def)}function OR(X,J){if(!J)return X;return J.reduce(($,Y)=>$?.[Y],X)}function MR(X){let J=Object.keys(X),$=J.map((Y)=>X[Y]);return Promise.all($).then((Y)=>{let G={};for(let Q=0;Q<J.length;Q++)G[J[Q]]=Y[Q];return G})}function _R(X=10){let $="";for(let Y=0;Y<X;Y++)$+="abcdefghijklmnopqrstuvwxyz"[Math.floor(Math.random()*26)];return $}function HX(X){return JSON.stringify(X)}var VX="captureStackTrace"in Error?Error.captureStackTrace:(...X)=>{};function _1(X){return typeof X==="object"&&X!==null&&!Array.isArray(X)}var AY=O4(()=>{if(typeof navigator<"u"&&navigator?.userAgent?.includes("Cloudflare"))return!1;try{return new Function(""),!0}catch(X){return!1}});function h9(X){if(_1(X)===!1)return!1;let J=X.constructor;if(J===void 0)return!0;let $=J.prototype;if(_1($)===!1)return!1;if(Object.prototype.hasOwnProperty.call($,"isPrototypeOf")===!1)return!1;return!0}function ZU(X){if(h9(X))return{...X};if(Array.isArray(X))return[...X];return X}function AR(X){let J=0;for(let $ in X)if(Object.prototype.hasOwnProperty.call(X,$))J++;return J}var TR=(X)=>{let J=typeof X;switch(J){case"undefined":return"undefined";case"string":return"string";case"number":return Number.isNaN(X)?"nan":"number";case"boolean":return"boolean";case"function":return"function";case"bigint":return"bigint";case"symbol":return"symbol";case"object":if(Array.isArray(X))return"array";if(X===null)return"null";if(X.then&&typeof X.then==="function"&&X.catch&&typeof X.catch==="function")return"promise";if(typeof Map<"u"&&X instanceof Map)return"map";if(typeof Set<"u"&&X instanceof Set)return"set";if(typeof Date<"u"&&X instanceof Date)return"date";if(typeof File<"u"&&X instanceof File)return"file";return"object";default:throw Error(`Unknown data type: ${J}`)}},TY=new Set(["string","number","symbol"]),WU=new Set(["string","number","bigint","boolean","symbol","undefined"]);function U9(X){return X.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function N8(X,J,$){let Y=new X._zod.constr(J??X._zod.def);if(!J||$?.parent)Y._zod.parent=X;return Y}function Y0(X){let J=X;if(!J)return{};if(typeof J==="string")return{error:()=>J};if(J?.message!==void 0){if(J?.error!==void 0)throw Error("Cannot specify both `message` and `error` params");J.error=J.message}if(delete J.message,typeof J.error==="string")return{...J,error:()=>J.error};return J}function RR(X){let J;return new Proxy({},{get($,Y,G){return J??(J=X()),Reflect.get(J,Y,G)},set($,Y,G,Q){return J??(J=X()),Reflect.set(J,Y,G,Q)},has($,Y){return J??(J=X()),Reflect.has(J,Y)},deleteProperty($,Y){return J??(J=X()),Reflect.deleteProperty(J,Y)},ownKeys($){return J??(J=X()),Reflect.ownKeys(J)},getOwnPropertyDescriptor($,Y){return J??(J=X()),Reflect.getOwnPropertyDescriptor(J,Y)},defineProperty($,Y,G){return J??(J=X()),Reflect.defineProperty(J,Y,G)}})}function BU(X){if(typeof X==="bigint")return X.toString()+"n";if(typeof X==="string")return`"${X}"`;return`${X}`}function RY(X){return Object.keys(X).filter((J)=>{return X[J]._zod.optin==="optional"&&X[J]._zod.optout==="optional"})}var CY={safeint:[Number.MIN_SAFE_INTEGER,Number.MAX_SAFE_INTEGER],int32:[-2147483648,2147483647],uint32:[0,4294967295],float32:[-340282346638528860000000000000000000000,340282346638528860000000000000000000000],float64:[-Number.MAX_VALUE,Number.MAX_VALUE]},HU={int64:[BigInt("-9223372036854775808"),BigInt("9223372036854775807")],uint64:[BigInt(0),BigInt("18446744073709551615")]};function CR(X,J){let $=X._zod.def,Y=y9(X._zod.def,{get shape(){let G={};for(let Q in J){if(!(Q in $.shape))throw Error(`Unrecognized key: "${Q}"`);if(!J[Q])continue;G[Q]=$.shape[Q]}return v9(this,"shape",G),G},checks:[]});return N8(X,Y)}function ER(X,J){let $=X._zod.def,Y=y9(X._zod.def,{get shape(){let G={...X._zod.def.shape};for(let Q in J){if(!(Q in $.shape))throw Error(`Unrecognized key: "${Q}"`);if(!J[Q])continue;delete G[Q]}return v9(this,"shape",G),G},checks:[]});return N8(X,Y)}function SR(X,J){if(!h9(J))throw Error("Invalid input to extend: expected a plain object");let $=X._zod.def.checks;if($&&$.length>0)throw Error("Object schemas containing refinements cannot be extended. Use `.safeExtend()` instead.");let G=y9(X._zod.def,{get shape(){let Q={...X._zod.def.shape,...J};return v9(this,"shape",Q),Q},checks:[]});return N8(X,G)}function IR(X,J){if(!h9(J))throw Error("Invalid input to safeExtend: expected a plain object");let $={...X._zod.def,get shape(){let Y={...X._zod.def.shape,...J};return v9(this,"shape",Y),Y},checks:X._zod.def.checks};return N8(X,$)}function bR(X,J){let $=y9(X._zod.def,{get shape(){let Y={...X._zod.def.shape,...J._zod.def.shape};return v9(this,"shape",Y),Y},get catchall(){return J._zod.def.catchall},checks:[]});return N8(X,$)}function kR(X,J,$){let Y=y9(J._zod.def,{get shape(){let G=J._zod.def.shape,Q={...G};if($)for(let z in $){if(!(z in G))throw Error(`Unrecognized key: "${z}"`);if(!$[z])continue;Q[z]=X?new X({type:"optional",innerType:G[z]}):G[z]}else for(let z in G)Q[z]=X?new X({type:"optional",innerType:G[z]}):G[z];return v9(this,"shape",Q),Q},checks:[]});return N8(J,Y)}function xR(X,J,$){let Y=y9(J._zod.def,{get shape(){let G=J._zod.def.shape,Q={...G};if($)for(let z in $){if(!(z in Q))throw Error(`Unrecognized key: "${z}"`);if(!$[z])continue;Q[z]=new X({type:"nonoptional",innerType:G[z]})}else for(let z in G)Q[z]=new X({type:"nonoptional",innerType:G[z]});return v9(this,"shape",Q),Q},checks:[]});return N8(J,Y)}function f9(X,J=0){if(X.aborted===!0)return!0;for(let $=J;$<X.issues.length;$++)if(X.issues[$]?.continue!==!0)return!0;return!1}function K9(X,J){return J.map(($)=>{var Y;return(Y=$).path??(Y.path=[]),$.path.unshift(X),$})}function h3(X){return typeof X==="string"?X:X?.message}function q8(X,J,$){let Y={...X,path:X.path??[]};if(!X.message){let G=h3(X.inst?._zod.def?.error?.(X))??h3(J?.error?.(X))??h3($.customError?.(X))??h3($.localeError?.(X))??"Invalid input";Y.message=G}if(delete Y.inst,delete Y.continue,!J?.reportInput)delete Y.input;return Y}function VU(X){if(X instanceof Set)return"set";if(X instanceof Map)return"map";if(X instanceof File)return"file";return"unknown"}function u3(X){if(Array.isArray(X))return"array";if(typeof X==="string")return"string";return"unknown"}function M4(...X){let[J,$,Y]=X;if(typeof J==="string")return{message:J,code:"custom",input:$,inst:Y};return{...J}}function wR(X){return Object.entries(X).filter(([J,$])=>{return Number.isNaN(Number.parseInt(J,10))}).map((J)=>J[1])}function UU(X){let J=atob(X),$=new Uint8Array(J.length);for(let Y=0;Y<J.length;Y++)$[Y]=J.charCodeAt(Y);return $}function KU(X){let J="";for(let $=0;$<X.length;$++)J+=String.fromCharCode(X[$]);return btoa(J)}function vR(X){let J=X.replace(/-/g,"+").replace(/_/g,"/"),$="=".repeat((4-J.length%4)%4);return UU(J+$)}function yR(X){return KU(X).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function hR(X){let J=X.replace(/^0x/,"");if(J.length%2!==0)throw Error("Invalid hex string length");let $=new Uint8Array(J.length/2);for(let Y=0;Y<J.length;Y+=2)$[Y/2]=Number.parseInt(J.slice(Y,Y+2),16);return $}function fR(X){return Array.from(X).map((J)=>J.toString(16).padStart(2,"0")).join("")}class jU{constructor(...X){}}var NU=(X,J)=>{X.name="$ZodError",Object.defineProperty(X,"_zod",{value:X._zod,enumerable:!1}),Object.defineProperty(X,"issues",{value:J,enumerable:!1}),X.message=JSON.stringify(J,P4,2),Object.defineProperty(X,"toString",{value:()=>X.message,enumerable:!1})},UX=E("$ZodError",NU),EY=E("$ZodError",NU,{Parent:Error});function qU(X,J=($)=>$.message){let $={},Y=[];for(let G of X.issues)if(G.path.length>0)$[G.path[0]]=$[G.path[0]]||[],$[G.path[0]].push(J(G));else Y.push(J(G));return{formErrors:Y,fieldErrors:$}}function LU(X,J){let $=J||function(Q){return Q.message},Y={_errors:[]},G=(Q)=>{for(let z of Q.issues)if(z.code==="invalid_union"&&z.errors.length)z.errors.map((Z)=>G({issues:Z}));else if(z.code==="invalid_key")G({issues:z.issues});else if(z.code==="invalid_element")G({issues:z.issues});else if(z.path.length===0)Y._errors.push($(z));else{let Z=Y,W=0;while(W<z.path.length){let B=z.path[W];if(W!==z.path.length-1)Z[B]=Z[B]||{_errors:[]};else Z[B]=Z[B]||{_errors:[]},Z[B]._errors.push($(z));Z=Z[B],W++}}};return G(X),Y}var KX=(X)=>(J,$,Y,G)=>{let Q=Y?Object.assign(Y,{async:!1}):{async:!1},z=J._zod.run({value:$,issues:[]},Q);if(z instanceof Promise)throw new V9;if(z.issues.length){let Z=new(G?.Err??X)(z.issues.map((W)=>q8(W,Q,c8())));throw VX(Z,G?.callee),Z}return z.value};var jX=(X)=>async(J,$,Y,G)=>{let Q=Y?Object.assign(Y,{async:!0}):{async:!0},z=J._zod.run({value:$,issues:[]},Q);if(z instanceof Promise)z=await z;if(z.issues.length){let Z=new(G?.Err??X)(z.issues.map((W)=>q8(W,Q,c8())));throw VX(Z,G?.callee),Z}return z.value};var p3=(X)=>(J,$,Y)=>{let G=Y?{...Y,async:!1}:{async:!1},Q=J._zod.run({value:$,issues:[]},G);if(Q instanceof Promise)throw new V9;return Q.issues.length?{success:!1,error:new(X??UX)(Q.issues.map((z)=>q8(z,G,c8())))}:{success:!0,data:Q.value}},DU=p3(EY),c3=(X)=>async(J,$,Y)=>{let G=Y?Object.assign(Y,{async:!0}):{async:!0},Q=J._zod.run({value:$,issues:[]},G);if(Q instanceof Promise)Q=await Q;return Q.issues.length?{success:!1,error:new X(Q.issues.map((z)=>q8(z,G,c8())))}:{success:!0,data:Q.value}},FU=c3(EY),PU=(X)=>(J,$,Y)=>{let G=Y?Object.assign(Y,{direction:"backward"}):{direction:"backward"};return KX(X)(J,$,G)};var OU=(X)=>(J,$,Y)=>{return KX(X)(J,$,Y)};var MU=(X)=>async(J,$,Y)=>{let G=Y?Object.assign(Y,{direction:"backward"}):{direction:"backward"};return jX(X)(J,$,G)};var _U=(X)=>async(J,$,Y)=>{return jX(X)(J,$,Y)};var AU=(X)=>(J,$,Y)=>{let G=Y?Object.assign(Y,{direction:"backward"}):{direction:"backward"};return p3(X)(J,$,G)};var TU=(X)=>(J,$,Y)=>{return p3(X)(J,$,Y)};var RU=(X)=>async(J,$,Y)=>{let G=Y?Object.assign(Y,{direction:"backward"}):{direction:"backward"};return c3(X)(J,$,G)};var CU=(X)=>async(J,$,Y)=>{return c3(X)(J,$,Y)};var EU=/^[cC][^\s-]{8,}$/,SU=/^[0-9a-z]+$/,IU=/^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/,bU=/^[0-9a-vA-V]{20}$/,kU=/^[A-Za-z0-9]{27}$/,xU=/^[a-zA-Z0-9_-]{21}$/,wU=/^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/;var vU=/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/,SY=(X)=>{if(!X)return/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${X}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`)};var yU=/^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/;function hU(){return new RegExp("^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$","u")}var fU=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,gU=/^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/,mU=/^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/,uU=/^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,pU=/^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/,IY=/^[A-Za-z0-9_-]*$/,cU=/^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;var lU=/^\+(?:[0-9]){6,14}[0-9]$/,dU="(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))",iU=new RegExp(`^${dU}$`);function nU(X){return typeof X.precision==="number"?X.precision===-1?"(?:[01]\\d|2[0-3]):[0-5]\\d":X.precision===0?"(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d":`(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d\\.\\d{${X.precision}}`:"(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?"}function sU(X){return new RegExp(`^${nU(X)}$`)}function aU(X){let J=nU({precision:X.precision}),$=["Z"];if(X.local)$.push("");if(X.offset)$.push("([+-](?:[01]\\d|2[0-3]):[0-5]\\d)");let Y=`${J}(?:${$.join("|")})`;return new RegExp(`^${dU}T(?:${Y})$`)}var oU=(X)=>{let J=X?`[\\s\\S]{${X?.minimum??0},${X?.maximum??""}}`:"[\\s\\S]*";return new RegExp(`^${J}$`)};var rU=/^-?\d+$/,tU=/^-?\d+(?:\.\d+)?/,eU=/^(?:true|false)$/i,XK=/^null$/i;var JK=/^[^A-Z]*$/,$K=/^[^a-z]*$/;var Z6=E("$ZodCheck",(X,J)=>{var $;X._zod??(X._zod={}),X._zod.def=J,($=X._zod).onattach??($.onattach=[])}),YK={number:"number",bigint:"bigint",object:"date"},bY=E("$ZodCheckLessThan",(X,J)=>{Z6.init(X,J);let $=YK[typeof J.value];X._zod.onattach.push((Y)=>{let G=Y._zod.bag,Q=(J.inclusive?G.maximum:G.exclusiveMaximum)??Number.POSITIVE_INFINITY;if(J.value<Q)if(J.inclusive)G.maximum=J.value;else G.exclusiveMaximum=J.value}),X._zod.check=(Y)=>{if(J.inclusive?Y.value<=J.value:Y.value<J.value)return;Y.issues.push({origin:$,code:"too_big",maximum:J.value,input:Y.value,inclusive:J.inclusive,inst:X,continue:!J.abort})}}),kY=E("$ZodCheckGreaterThan",(X,J)=>{Z6.init(X,J);let $=YK[typeof J.value];X._zod.onattach.push((Y)=>{let G=Y._zod.bag,Q=(J.inclusive?G.minimum:G.exclusiveMinimum)??Number.NEGATIVE_INFINITY;if(J.value>Q)if(J.inclusive)G.minimum=J.value;else G.exclusiveMinimum=J.value}),X._zod.check=(Y)=>{if(J.inclusive?Y.value>=J.value:Y.value>J.value)return;Y.issues.push({origin:$,code:"too_small",minimum:J.value,input:Y.value,inclusive:J.inclusive,inst:X,continue:!J.abort})}}),GK=E("$ZodCheckMultipleOf",(X,J)=>{Z6.init(X,J),X._zod.onattach.push(($)=>{var Y;(Y=$._zod.bag).multipleOf??(Y.multipleOf=J.value)}),X._zod.check=($)=>{if(typeof $.value!==typeof J.value)throw Error("Cannot mix number and bigint in multiple_of check.");if(typeof $.value==="bigint"?$.value%J.value===BigInt(0):_Y($.value,J.value)===0)return;$.issues.push({origin:typeof $.value,code:"not_multiple_of",divisor:J.value,input:$.value,inst:X,continue:!J.abort})}}),QK=E("$ZodCheckNumberFormat",(X,J)=>{Z6.init(X,J),J.format=J.format||"float64";let $=J.format?.includes("int"),Y=$?"int":"number",[G,Q]=CY[J.format];X._zod.onattach.push((z)=>{let Z=z._zod.bag;if(Z.format=J.format,Z.minimum=G,Z.maximum=Q,$)Z.pattern=rU}),X._zod.check=(z)=>{let Z=z.value;if($){if(!Number.isInteger(Z)){z.issues.push({expected:Y,format:J.format,code:"invalid_type",continue:!1,input:Z,inst:X});return}if(!Number.isSafeInteger(Z)){if(Z>0)z.issues.push({input:Z,code:"too_big",maximum:Number.MAX_SAFE_INTEGER,note:"Integers must be within the safe integer range.",inst:X,origin:Y,continue:!J.abort});else z.issues.push({input:Z,code:"too_small",minimum:Number.MIN_SAFE_INTEGER,note:"Integers must be within the safe integer range.",inst:X,origin:Y,continue:!J.abort});return}}if(Z<G)z.issues.push({origin:"number",input:Z,code:"too_small",minimum:G,inclusive:!0,inst:X,continue:!J.abort});if(Z>Q)z.issues.push({origin:"number",input:Z,code:"too_big",maximum:Q,inst:X})}});var zK=E("$ZodCheckMaxLength",(X,J)=>{var $;Z6.init(X,J),($=X._zod.def).when??($.when=(Y)=>{let G=Y.value;return!g3(G)&&G.length!==void 0}),X._zod.onattach.push((Y)=>{let G=Y._zod.bag.maximum??Number.POSITIVE_INFINITY;if(J.maximum<G)Y._zod.bag.maximum=J.maximum}),X._zod.check=(Y)=>{let G=Y.value;if(G.length<=J.maximum)return;let z=u3(G);Y.issues.push({origin:z,code:"too_big",maximum:J.maximum,inclusive:!0,input:G,inst:X,continue:!J.abort})}}),ZK=E("$ZodCheckMinLength",(X,J)=>{var $;Z6.init(X,J),($=X._zod.def).when??($.when=(Y)=>{let G=Y.value;return!g3(G)&&G.length!==void 0}),X._zod.onattach.push((Y)=>{let G=Y._zod.bag.minimum??Number.NEGATIVE_INFINITY;if(J.minimum>G)Y._zod.bag.minimum=J.minimum}),X._zod.check=(Y)=>{let G=Y.value;if(G.length>=J.minimum)return;let z=u3(G);Y.issues.push({origin:z,code:"too_small",minimum:J.minimum,inclusive:!0,input:G,inst:X,continue:!J.abort})}}),WK=E("$ZodCheckLengthEquals",(X,J)=>{var $;Z6.init(X,J),($=X._zod.def).when??($.when=(Y)=>{let G=Y.value;return!g3(G)&&G.length!==void 0}),X._zod.onattach.push((Y)=>{let G=Y._zod.bag;G.minimum=J.length,G.maximum=J.length,G.length=J.length}),X._zod.check=(Y)=>{let G=Y.value,Q=G.length;if(Q===J.length)return;let z=u3(G),Z=Q>J.length;Y.issues.push({origin:z,...Z?{code:"too_big",maximum:J.length}:{code:"too_small",minimum:J.length},inclusive:!0,exact:!0,input:Y.value,inst:X,continue:!J.abort})}}),l3=E("$ZodCheckStringFormat",(X,J)=>{var $,Y;if(Z6.init(X,J),X._zod.onattach.push((G)=>{let Q=G._zod.bag;if(Q.format=J.format,J.pattern)Q.patterns??(Q.patterns=new Set),Q.patterns.add(J.pattern)}),J.pattern)($=X._zod).check??($.check=(G)=>{if(J.pattern.lastIndex=0,J.pattern.test(G.value))return;G.issues.push({origin:"string",code:"invalid_format",format:J.format,input:G.value,...J.pattern?{pattern:J.pattern.toString()}:{},inst:X,continue:!J.abort})});else(Y=X._zod).check??(Y.check=()=>{})}),BK=E("$ZodCheckRegex",(X,J)=>{l3.init(X,J),X._zod.check=($)=>{if(J.pattern.lastIndex=0,J.pattern.test($.value))return;$.issues.push({origin:"string",code:"invalid_format",format:"regex",input:$.value,pattern:J.pattern.toString(),inst:X,continue:!J.abort})}}),HK=E("$ZodCheckLowerCase",(X,J)=>{J.pattern??(J.pattern=JK),l3.init(X,J)}),VK=E("$ZodCheckUpperCase",(X,J)=>{J.pattern??(J.pattern=$K),l3.init(X,J)}),UK=E("$ZodCheckIncludes",(X,J)=>{Z6.init(X,J);let $=U9(J.includes),Y=new RegExp(typeof J.position==="number"?`^.{${J.position}}${$}`:$);J.pattern=Y,X._zod.onattach.push((G)=>{let Q=G._zod.bag;Q.patterns??(Q.patterns=new Set),Q.patterns.add(Y)}),X._zod.check=(G)=>{if(G.value.includes(J.includes,J.position))return;G.issues.push({origin:"string",code:"invalid_format",format:"includes",includes:J.includes,input:G.value,inst:X,continue:!J.abort})}}),KK=E("$ZodCheckStartsWith",(X,J)=>{Z6.init(X,J);let $=new RegExp(`^${U9(J.prefix)}.*`);J.pattern??(J.pattern=$),X._zod.onattach.push((Y)=>{let G=Y._zod.bag;G.patterns??(G.patterns=new Set),G.patterns.add($)}),X._zod.check=(Y)=>{if(Y.value.startsWith(J.prefix))return;Y.issues.push({origin:"string",code:"invalid_format",format:"starts_with",prefix:J.prefix,input:Y.value,inst:X,continue:!J.abort})}}),jK=E("$ZodCheckEndsWith",(X,J)=>{Z6.init(X,J);let $=new RegExp(`.*${U9(J.suffix)}$`);J.pattern??(J.pattern=$),X._zod.onattach.push((Y)=>{let G=Y._zod.bag;G.patterns??(G.patterns=new Set),G.patterns.add($)}),X._zod.check=(Y)=>{if(Y.value.endsWith(J.suffix))return;Y.issues.push({origin:"string",code:"invalid_format",format:"ends_with",suffix:J.suffix,input:Y.value,inst:X,continue:!J.abort})}});var NK=E("$ZodCheckOverwrite",(X,J)=>{Z6.init(X,J),X._zod.check=($)=>{$.value=J.tx($.value)}});class xY{constructor(X=[]){if(this.content=[],this.indent=0,this)this.args=X}indented(X){this.indent+=1,X(this),this.indent-=1}write(X){if(typeof X==="function"){X(this,{execution:"sync"}),X(this,{execution:"async"});return}let $=X.split(`
-`).filter((Q)=>Q),Y=Math.min(...$.map((Q)=>Q.length-Q.trimStart().length)),G=$.map((Q)=>Q.slice(Y)).map((Q)=>" ".repeat(this.indent*2)+Q);for(let Q of G)this.content.push(Q)}compile(){let X=Function,J=this?.args,Y=[...(this?.content??[""]).map((G)=>`  ${G}`)];return new X(...J,Y.join(`
-`))}}var LK={major:4,minor:1,patch:8};var S0=E("$ZodType",(X,J)=>{var $;X??(X={}),X._zod.def=J,X._zod.bag=X._zod.bag||{},X._zod.version=LK;let Y=[...X._zod.def.checks??[]];if(X._zod.traits.has("$ZodCheck"))Y.unshift(X);for(let G of Y)for(let Q of G._zod.onattach)Q(X);if(Y.length===0)($=X._zod).deferred??($.deferred=[]),X._zod.deferred?.push(()=>{X._zod.run=X._zod.parse});else{let G=(z,Z,W)=>{let B=f9(z),H;for(let U of Z){if(U._zod.def.when){if(!U._zod.def.when(z))continue}else if(B)continue;let j=z.issues.length,N=U._zod.check(z);if(N instanceof Promise&&W?.async===!1)throw new V9;if(H||N instanceof Promise)H=(H??Promise.resolve()).then(async()=>{if(await N,z.issues.length===j)return;if(!B)B=f9(z,j)});else{if(z.issues.length===j)continue;if(!B)B=f9(z,j)}}if(H)return H.then(()=>{return z});return z},Q=(z,Z,W)=>{if(f9(z))return z.aborted=!0,z;let B=G(Z,Y,W);if(B instanceof Promise){if(W.async===!1)throw new V9;return B.then((H)=>X._zod.parse(H,W))}return X._zod.parse(B,W)};X._zod.run=(z,Z)=>{if(Z.skipChecks)return X._zod.parse(z,Z);if(Z.direction==="backward"){let B=X._zod.parse({value:z.value,issues:[]},{...Z,skipChecks:!0});if(B instanceof Promise)return B.then((H)=>{return Q(H,z,Z)});return Q(B,z,Z)}let W=X._zod.parse(z,Z);if(W instanceof Promise){if(Z.async===!1)throw new V9;return W.then((B)=>G(B,Y,Z))}return G(W,Y,Z)}}X["~standard"]={validate:(G)=>{try{let Q=DU(X,G);return Q.success?{value:Q.data}:{issues:Q.error?.issues}}catch(Q){return FU(X,G).then((z)=>z.success?{value:z.data}:{issues:z.error?.issues})}},vendor:"zod",version:1}}),DX=E("$ZodString",(X,J)=>{S0.init(X,J),X._zod.pattern=[...X?._zod.bag?.patterns??[]].pop()??oU(X._zod.bag),X._zod.parse=($,Y)=>{if(J.coerce)try{$.value=String($.value)}catch(G){}if(typeof $.value==="string")return $;return $.issues.push({expected:"string",code:"invalid_type",input:$.value,inst:X}),$}}),k0=E("$ZodStringFormat",(X,J)=>{l3.init(X,J),DX.init(X,J)}),RK=E("$ZodGUID",(X,J)=>{J.pattern??(J.pattern=vU),k0.init(X,J)}),CK=E("$ZodUUID",(X,J)=>{if(J.version){let Y={v1:1,v2:2,v3:3,v4:4,v5:5,v6:6,v7:7,v8:8}[J.version];if(Y===void 0)throw Error(`Invalid UUID version: "${J.version}"`);J.pattern??(J.pattern=SY(Y))}else J.pattern??(J.pattern=SY());k0.init(X,J)}),EK=E("$ZodEmail",(X,J)=>{J.pattern??(J.pattern=yU),k0.init(X,J)}),SK=E("$ZodURL",(X,J)=>{k0.init(X,J),X._zod.check=($)=>{try{let Y=$.value.trim(),G=new URL(Y);if(J.hostname){if(J.hostname.lastIndex=0,!J.hostname.test(G.hostname))$.issues.push({code:"invalid_format",format:"url",note:"Invalid hostname",pattern:cU.source,input:$.value,inst:X,continue:!J.abort})}if(J.protocol){if(J.protocol.lastIndex=0,!J.protocol.test(G.protocol.endsWith(":")?G.protocol.slice(0,-1):G.protocol))$.issues.push({code:"invalid_format",format:"url",note:"Invalid protocol",pattern:J.protocol.source,input:$.value,inst:X,continue:!J.abort})}if(J.normalize)$.value=G.href;else $.value=Y;return}catch(Y){$.issues.push({code:"invalid_format",format:"url",input:$.value,inst:X,continue:!J.abort})}}}),IK=E("$ZodEmoji",(X,J)=>{J.pattern??(J.pattern=hU()),k0.init(X,J)}),bK=E("$ZodNanoID",(X,J)=>{J.pattern??(J.pattern=xU),k0.init(X,J)}),kK=E("$ZodCUID",(X,J)=>{J.pattern??(J.pattern=EU),k0.init(X,J)}),xK=E("$ZodCUID2",(X,J)=>{J.pattern??(J.pattern=SU),k0.init(X,J)}),wK=E("$ZodULID",(X,J)=>{J.pattern??(J.pattern=IU),k0.init(X,J)}),vK=E("$ZodXID",(X,J)=>{J.pattern??(J.pattern=bU),k0.init(X,J)}),yK=E("$ZodKSUID",(X,J)=>{J.pattern??(J.pattern=kU),k0.init(X,J)}),hK=E("$ZodISODateTime",(X,J)=>{J.pattern??(J.pattern=aU(J)),k0.init(X,J)}),fK=E("$ZodISODate",(X,J)=>{J.pattern??(J.pattern=iU),k0.init(X,J)}),gK=E("$ZodISOTime",(X,J)=>{J.pattern??(J.pattern=sU(J)),k0.init(X,J)}),mK=E("$ZodISODuration",(X,J)=>{J.pattern??(J.pattern=wU),k0.init(X,J)}),uK=E("$ZodIPv4",(X,J)=>{J.pattern??(J.pattern=fU),k0.init(X,J),X._zod.onattach.push(($)=>{let Y=$._zod.bag;Y.format="ipv4"})}),pK=E("$ZodIPv6",(X,J)=>{J.pattern??(J.pattern=gU),k0.init(X,J),X._zod.onattach.push(($)=>{let Y=$._zod.bag;Y.format="ipv6"}),X._zod.check=($)=>{try{new URL(`http://[${$.value}]`)}catch{$.issues.push({code:"invalid_format",format:"ipv6",input:$.value,inst:X,continue:!J.abort})}}}),cK=E("$ZodCIDRv4",(X,J)=>{J.pattern??(J.pattern=mU),k0.init(X,J)}),lK=E("$ZodCIDRv6",(X,J)=>{J.pattern??(J.pattern=uU),k0.init(X,J),X._zod.check=($)=>{let Y=$.value.split("/");try{if(Y.length!==2)throw Error();let[G,Q]=Y;if(!Q)throw Error();let z=Number(Q);if(`${z}`!==Q)throw Error();if(z<0||z>128)throw Error();new URL(`http://[${G}]`)}catch{$.issues.push({code:"invalid_format",format:"cidrv6",input:$.value,inst:X,continue:!J.abort})}}});function dK(X){if(X==="")return!0;if(X.length%4!==0)return!1;try{return atob(X),!0}catch{return!1}}var iK=E("$ZodBase64",(X,J)=>{J.pattern??(J.pattern=pU),k0.init(X,J),X._zod.onattach.push(($)=>{$._zod.bag.contentEncoding="base64"}),X._zod.check=($)=>{if(dK($.value))return;$.issues.push({code:"invalid_format",format:"base64",input:$.value,inst:X,continue:!J.abort})}});function mR(X){if(!IY.test(X))return!1;let J=X.replace(/[-_]/g,(Y)=>Y==="-"?"+":"/"),$=J.padEnd(Math.ceil(J.length/4)*4,"=");return dK($)}var nK=E("$ZodBase64URL",(X,J)=>{J.pattern??(J.pattern=IY),k0.init(X,J),X._zod.onattach.push(($)=>{$._zod.bag.contentEncoding="base64url"}),X._zod.check=($)=>{if(mR($.value))return;$.issues.push({code:"invalid_format",format:"base64url",input:$.value,inst:X,continue:!J.abort})}}),sK=E("$ZodE164",(X,J)=>{J.pattern??(J.pattern=lU),k0.init(X,J)});function uR(X,J=null){try{let $=X.split(".");if($.length!==3)return!1;let[Y]=$;if(!Y)return!1;let G=JSON.parse(atob(Y));if("typ"in G&&G?.typ!=="JWT")return!1;if(!G.alg)return!1;if(J&&(!("alg"in G)||G.alg!==J))return!1;return!0}catch{return!1}}var aK=E("$ZodJWT",(X,J)=>{k0.init(X,J),X._zod.check=($)=>{if(uR($.value,J.alg))return;$.issues.push({code:"invalid_format",format:"jwt",input:$.value,inst:X,continue:!J.abort})}});var vY=E("$ZodNumber",(X,J)=>{S0.init(X,J),X._zod.pattern=X._zod.bag.pattern??tU,X._zod.parse=($,Y)=>{if(J.coerce)try{$.value=Number($.value)}catch(z){}let G=$.value;if(typeof G==="number"&&!Number.isNaN(G)&&Number.isFinite(G))return $;let Q=typeof G==="number"?Number.isNaN(G)?"NaN":!Number.isFinite(G)?"Infinity":void 0:void 0;return $.issues.push({expected:"number",code:"invalid_type",input:G,inst:X,...Q?{received:Q}:{}}),$}}),oK=E("$ZodNumber",(X,J)=>{QK.init(X,J),vY.init(X,J)}),rK=E("$ZodBoolean",(X,J)=>{S0.init(X,J),X._zod.pattern=eU,X._zod.parse=($,Y)=>{if(J.coerce)try{$.value=Boolean($.value)}catch(Q){}let G=$.value;if(typeof G==="boolean")return $;return $.issues.push({expected:"boolean",code:"invalid_type",input:G,inst:X}),$}});var tK=E("$ZodNull",(X,J)=>{S0.init(X,J),X._zod.pattern=XK,X._zod.values=new Set([null]),X._zod.parse=($,Y)=>{let G=$.value;if(G===null)return $;return $.issues.push({expected:"null",code:"invalid_type",input:G,inst:X}),$}});var eK=E("$ZodUnknown",(X,J)=>{S0.init(X,J),X._zod.parse=($)=>$}),Xj=E("$ZodNever",(X,J)=>{S0.init(X,J),X._zod.parse=($,Y)=>{return $.issues.push({expected:"never",code:"invalid_type",input:$.value,inst:X}),$}});function DK(X,J,$){if(X.issues.length)J.issues.push(...K9($,X.issues));J.value[$]=X.value}var Jj=E("$ZodArray",(X,J)=>{S0.init(X,J),X._zod.parse=($,Y)=>{let G=$.value;if(!Array.isArray(G))return $.issues.push({expected:"array",code:"invalid_type",input:G,inst:X}),$;$.value=Array(G.length);let Q=[];for(let z=0;z<G.length;z++){let Z=G[z],W=J.element._zod.run({value:Z,issues:[]},Y);if(W instanceof Promise)Q.push(W.then((B)=>DK(B,$,z)));else DK(W,$,z)}if(Q.length)return Promise.all(Q).then(()=>$);return $}});function LX(X,J,$,Y){if(X.issues.length)J.issues.push(...K9($,X.issues));if(X.value===void 0){if($ in Y)J.value[$]=void 0}else J.value[$]=X.value}function $j(X){let J=Object.keys(X.shape);for(let Y of J)if(!X.shape?.[Y]?._zod?.traits?.has("$ZodType"))throw Error(`Invalid element at key "${Y}": expected a Zod schema`);let $=RY(X.shape);return{...X,keys:J,keySet:new Set(J),numKeys:J.length,optionalKeys:new Set($)}}function Yj(X,J,$,Y,G,Q){let z=[],Z=G.keySet,W=G.catchall._zod,B=W.def.type;for(let H of Object.keys(J)){if(Z.has(H))continue;if(B==="never"){z.push(H);continue}let U=W.run({value:J[H],issues:[]},Y);if(U instanceof Promise)X.push(U.then((j)=>LX(j,$,H,J)));else LX(U,$,H,J)}if(z.length)$.issues.push({code:"unrecognized_keys",keys:z,input:J,inst:Q});if(!X.length)return $;return Promise.all(X).then(()=>{return $})}var pR=E("$ZodObject",(X,J)=>{S0.init(X,J);let $=O4(()=>$j(J));q0(X._zod,"propValues",()=>{let z=J.shape,Z={};for(let W in z){let B=z[W]._zod;if(B.values){Z[W]??(Z[W]=new Set);for(let H of B.values)Z[W].add(H)}}return Z});let Y=_1,G=J.catchall,Q;X._zod.parse=(z,Z)=>{Q??(Q=$.value);let W=z.value;if(!Y(W))return z.issues.push({expected:"object",code:"invalid_type",input:W,inst:X}),z;z.value={};let B=[],H=Q.shape;for(let U of Q.keys){let N=H[U]._zod.run({value:W[U],issues:[]},Z);if(N instanceof Promise)B.push(N.then((K)=>LX(K,z,U,W)));else LX(N,z,U,W)}if(!G)return B.length?Promise.all(B).then(()=>z):z;return Yj(B,W,z,Z,$.value,X)}}),Gj=E("$ZodObjectJIT",(X,J)=>{pR.init(X,J);let $=X._zod.parse,Y=O4(()=>$j(J)),G=(j)=>{let N=new xY(["shape","payload","ctx"]),K=Y.value,q=(C)=>{let L=HX(C);return`shape[${L}]._zod.run({ value: input[${L}], issues: [] }, ctx)`};N.write("const input = payload.value;");let F=Object.create(null),O=0;for(let C of K.keys)F[C]=`key_${O++}`;N.write("const newResult = {};");for(let C of K.keys){let L=F[C],P=HX(C);N.write(`const ${L} = ${q(C)};`),N.write(`
-        if (${L}.issues.length) {
-          payload.issues = payload.issues.concat(${L}.issues.map(iss => ({
-            ...iss,
-            path: iss.path ? [${P}, ...iss.path] : [${P}]
-          })));
-        }
-        
-        
-        if (${L}.value === undefined) {
-          if (${P} in input) {
-            newResult[${P}] = undefined;
-          }
-        } else {
-          newResult[${P}] = ${L}.value;
-        }
-        
-      `)}N.write("payload.value = newResult;"),N.write("return payload;");let _=N.compile();return(C,L)=>_(j,C,L)},Q,z=_1,Z=!BX.jitless,B=Z&&AY.value,H=J.catchall,U;X._zod.parse=(j,N)=>{U??(U=Y.value);let K=j.value;if(!z(K))return j.issues.push({expected:"object",code:"invalid_type",input:K,inst:X}),j;if(Z&&B&&N?.async===!1&&N.jitless!==!0){if(!Q)Q=G(J.shape);if(j=Q(j,N),!H)return j;return Yj([],K,j,N,U,X)}return $(j,N)}});function FK(X,J,$,Y){for(let Q of X)if(Q.issues.length===0)return J.value=Q.value,J;let G=X.filter((Q)=>!f9(Q));if(G.length===1)return J.value=G[0].value,G[0];return J.issues.push({code:"invalid_union",input:J.value,inst:$,errors:X.map((Q)=>Q.issues.map((z)=>q8(z,Y,c8())))}),J}var yY=E("$ZodUnion",(X,J)=>{S0.init(X,J),q0(X._zod,"optin",()=>J.options.some((G)=>G._zod.optin==="optional")?"optional":void 0),q0(X._zod,"optout",()=>J.options.some((G)=>G._zod.optout==="optional")?"optional":void 0),q0(X._zod,"values",()=>{if(J.options.every((G)=>G._zod.values))return new Set(J.options.flatMap((G)=>Array.from(G._zod.values)));return}),q0(X._zod,"pattern",()=>{if(J.options.every((G)=>G._zod.pattern)){let G=J.options.map((Q)=>Q._zod.pattern);return new RegExp(`^(${G.map((Q)=>m3(Q.source)).join("|")})$`)}return});let $=J.options.length===1,Y=J.options[0]._zod.run;X._zod.parse=(G,Q)=>{if($)return Y(G,Q);let z=!1,Z=[];for(let W of J.options){let B=W._zod.run({value:G.value,issues:[]},Q);if(B instanceof Promise)Z.push(B),z=!0;else{if(B.issues.length===0)return B;Z.push(B)}}if(!z)return FK(Z,G,X,Q);return Promise.all(Z).then((W)=>{return FK(W,G,X,Q)})}}),Qj=E("$ZodDiscriminatedUnion",(X,J)=>{yY.init(X,J);let $=X._zod.parse;q0(X._zod,"propValues",()=>{let G={};for(let Q of J.options){let z=Q._zod.propValues;if(!z||Object.keys(z).length===0)throw Error(`Invalid discriminated union option at index "${J.options.indexOf(Q)}"`);for(let[Z,W]of Object.entries(z)){if(!G[Z])G[Z]=new Set;for(let B of W)G[Z].add(B)}}return G});let Y=O4(()=>{let G=J.options,Q=new Map;for(let z of G){let Z=z._zod.propValues?.[J.discriminator];if(!Z||Z.size===0)throw Error(`Invalid discriminated union option at index "${J.options.indexOf(z)}"`);for(let W of Z){if(Q.has(W))throw Error(`Duplicate discriminator value "${String(W)}"`);Q.set(W,z)}}return Q});X._zod.parse=(G,Q)=>{let z=G.value;if(!_1(z))return G.issues.push({code:"invalid_type",expected:"object",input:z,inst:X}),G;let Z=Y.value.get(z?.[J.discriminator]);if(Z)return Z._zod.run(G,Q);if(J.unionFallback)return $(G,Q);return G.issues.push({code:"invalid_union",errors:[],note:"No matching discriminator",discriminator:J.discriminator,input:z,path:[J.discriminator],inst:X}),G}}),zj=E("$ZodIntersection",(X,J)=>{S0.init(X,J),X._zod.parse=($,Y)=>{let G=$.value,Q=J.left._zod.run({value:G,issues:[]},Y),z=J.right._zod.run({value:G,issues:[]},Y);if(Q instanceof Promise||z instanceof Promise)return Promise.all([Q,z]).then(([W,B])=>{return PK($,W,B)});return PK($,Q,z)}});function wY(X,J){if(X===J)return{valid:!0,data:X};if(X instanceof Date&&J instanceof Date&&+X===+J)return{valid:!0,data:X};if(h9(X)&&h9(J)){let $=Object.keys(J),Y=Object.keys(X).filter((Q)=>$.indexOf(Q)!==-1),G={...X,...J};for(let Q of Y){let z=wY(X[Q],J[Q]);if(!z.valid)return{valid:!1,mergeErrorPath:[Q,...z.mergeErrorPath]};G[Q]=z.data}return{valid:!0,data:G}}if(Array.isArray(X)&&Array.isArray(J)){if(X.length!==J.length)return{valid:!1,mergeErrorPath:[]};let $=[];for(let Y=0;Y<X.length;Y++){let G=X[Y],Q=J[Y],z=wY(G,Q);if(!z.valid)return{valid:!1,mergeErrorPath:[Y,...z.mergeErrorPath]};$.push(z.data)}return{valid:!0,data:$}}return{valid:!1,mergeErrorPath:[]}}function PK(X,J,$){if(J.issues.length)X.issues.push(...J.issues);if($.issues.length)X.issues.push(...$.issues);if(f9(X))return X;let Y=wY(J.value,$.value);if(!Y.valid)throw Error(`Unmergable intersection. Error path: ${JSON.stringify(Y.mergeErrorPath)}`);return X.value=Y.data,X}var Zj=E("$ZodRecord",(X,J)=>{S0.init(X,J),X._zod.parse=($,Y)=>{let G=$.value;if(!h9(G))return $.issues.push({expected:"record",code:"invalid_type",input:G,inst:X}),$;let Q=[];if(J.keyType._zod.values){let z=J.keyType._zod.values;$.value={};for(let W of z)if(typeof W==="string"||typeof W==="number"||typeof W==="symbol"){let B=J.valueType._zod.run({value:G[W],issues:[]},Y);if(B instanceof Promise)Q.push(B.then((H)=>{if(H.issues.length)$.issues.push(...K9(W,H.issues));$.value[W]=H.value}));else{if(B.issues.length)$.issues.push(...K9(W,B.issues));$.value[W]=B.value}}let Z;for(let W in G)if(!z.has(W))Z=Z??[],Z.push(W);if(Z&&Z.length>0)$.issues.push({code:"unrecognized_keys",input:G,inst:X,keys:Z})}else{$.value={};for(let z of Reflect.ownKeys(G)){if(z==="__proto__")continue;let Z=J.keyType._zod.run({value:z,issues:[]},Y);if(Z instanceof Promise)throw Error("Async schemas not supported in object keys currently");if(Z.issues.length){$.issues.push({code:"invalid_key",origin:"record",issues:Z.issues.map((B)=>q8(B,Y,c8())),input:z,path:[z],inst:X}),$.value[Z.value]=Z.value;continue}let W=J.valueType._zod.run({value:G[z],issues:[]},Y);if(W instanceof Promise)Q.push(W.then((B)=>{if(B.issues.length)$.issues.push(...K9(z,B.issues));$.value[Z.value]=B.value}));else{if(W.issues.length)$.issues.push(...K9(z,W.issues));$.value[Z.value]=W.value}}}if(Q.length)return Promise.all(Q).then(()=>$);return $}});var Wj=E("$ZodEnum",(X,J)=>{S0.init(X,J);let $=f3(J.entries),Y=new Set($);X._zod.values=Y,X._zod.pattern=new RegExp(`^(${$.filter((G)=>TY.has(typeof G)).map((G)=>typeof G==="string"?U9(G):G.toString()).join("|")})$`),X._zod.parse=(G,Q)=>{let z=G.value;if(Y.has(z))return G;return G.issues.push({code:"invalid_value",values:$,input:z,inst:X}),G}}),Bj=E("$ZodLiteral",(X,J)=>{if(S0.init(X,J),J.values.length===0)throw Error("Cannot create literal schema with no valid values");X._zod.values=new Set(J.values),X._zod.pattern=new RegExp(`^(${J.values.map(($)=>typeof $==="string"?U9($):$?U9($.toString()):String($)).join("|")})$`),X._zod.parse=($,Y)=>{let G=$.value;if(X._zod.values.has(G))return $;return $.issues.push({code:"invalid_value",values:J.values,input:G,inst:X}),$}});var Hj=E("$ZodTransform",(X,J)=>{S0.init(X,J),X._zod.parse=($,Y)=>{if(Y.direction==="backward")throw new y3(X.constructor.name);let G=J.transform($.value,$);if(Y.async)return(G instanceof Promise?G:Promise.resolve(G)).then((z)=>{return $.value=z,$});if(G instanceof Promise)throw new V9;return $.value=G,$}});function OK(X,J){if(X.issues.length&&J===void 0)return{issues:[],value:void 0};return X}var Vj=E("$ZodOptional",(X,J)=>{S0.init(X,J),X._zod.optin="optional",X._zod.optout="optional",q0(X._zod,"values",()=>{return J.innerType._zod.values?new Set([...J.innerType._zod.values,void 0]):void 0}),q0(X._zod,"pattern",()=>{let $=J.innerType._zod.pattern;return $?new RegExp(`^(${m3($.source)})?$`):void 0}),X._zod.parse=($,Y)=>{if(J.innerType._zod.optin==="optional"){let G=J.innerType._zod.run($,Y);if(G instanceof Promise)return G.then((Q)=>OK(Q,$.value));return OK(G,$.value)}if($.value===void 0)return $;return J.innerType._zod.run($,Y)}}),Uj=E("$ZodNullable",(X,J)=>{S0.init(X,J),q0(X._zod,"optin",()=>J.innerType._zod.optin),q0(X._zod,"optout",()=>J.innerType._zod.optout),q0(X._zod,"pattern",()=>{let $=J.innerType._zod.pattern;return $?new RegExp(`^(${m3($.source)}|null)$`):void 0}),q0(X._zod,"values",()=>{return J.innerType._zod.values?new Set([...J.innerType._zod.values,null]):void 0}),X._zod.parse=($,Y)=>{if($.value===null)return $;return J.innerType._zod.run($,Y)}}),Kj=E("$ZodDefault",(X,J)=>{S0.init(X,J),X._zod.optin="optional",q0(X._zod,"values",()=>J.innerType._zod.values),X._zod.parse=($,Y)=>{if(Y.direction==="backward")return J.innerType._zod.run($,Y);if($.value===void 0)return $.value=J.defaultValue,$;let G=J.innerType._zod.run($,Y);if(G instanceof Promise)return G.then((Q)=>MK(Q,J));return MK(G,J)}});function MK(X,J){if(X.value===void 0)X.value=J.defaultValue;return X}var jj=E("$ZodPrefault",(X,J)=>{S0.init(X,J),X._zod.optin="optional",q0(X._zod,"values",()=>J.innerType._zod.values),X._zod.parse=($,Y)=>{if(Y.direction==="backward")return J.innerType._zod.run($,Y);if($.value===void 0)$.value=J.defaultValue;return J.innerType._zod.run($,Y)}}),Nj=E("$ZodNonOptional",(X,J)=>{S0.init(X,J),q0(X._zod,"values",()=>{let $=J.innerType._zod.values;return $?new Set([...$].filter((Y)=>Y!==void 0)):void 0}),X._zod.parse=($,Y)=>{let G=J.innerType._zod.run($,Y);if(G instanceof Promise)return G.then((Q)=>_K(Q,X));return _K(G,X)}});function _K(X,J){if(!X.issues.length&&X.value===void 0)X.issues.push({code:"invalid_type",expected:"nonoptional",input:X.value,inst:J});return X}var qj=E("$ZodCatch",(X,J)=>{S0.init(X,J),q0(X._zod,"optin",()=>J.innerType._zod.optin),q0(X._zod,"optout",()=>J.innerType._zod.optout),q0(X._zod,"values",()=>J.innerType._zod.values),X._zod.parse=($,Y)=>{if(Y.direction==="backward")return J.innerType._zod.run($,Y);let G=J.innerType._zod.run($,Y);if(G instanceof Promise)return G.then((Q)=>{if($.value=Q.value,Q.issues.length)$.value=J.catchValue({...$,error:{issues:Q.issues.map((z)=>q8(z,Y,c8()))},input:$.value}),$.issues=[];return $});if($.value=G.value,G.issues.length)$.value=J.catchValue({...$,error:{issues:G.issues.map((Q)=>q8(Q,Y,c8()))},input:$.value}),$.issues=[];return $}});var Lj=E("$ZodPipe",(X,J)=>{S0.init(X,J),q0(X._zod,"values",()=>J.in._zod.values),q0(X._zod,"optin",()=>J.in._zod.optin),q0(X._zod,"optout",()=>J.out._zod.optout),q0(X._zod,"propValues",()=>J.in._zod.propValues),X._zod.parse=($,Y)=>{if(Y.direction==="backward"){let Q=J.out._zod.run($,Y);if(Q instanceof Promise)return Q.then((z)=>qX(z,J.in,Y));return qX(Q,J.in,Y)}let G=J.in._zod.run($,Y);if(G instanceof Promise)return G.then((Q)=>qX(Q,J.out,Y));return qX(G,J.out,Y)}});function qX(X,J,$){if(X.issues.length)return X.aborted=!0,X;return J._zod.run({value:X.value,issues:X.issues},$)}var Dj=E("$ZodReadonly",(X,J)=>{S0.init(X,J),q0(X._zod,"propValues",()=>J.innerType._zod.propValues),q0(X._zod,"values",()=>J.innerType._zod.values),q0(X._zod,"optin",()=>J.innerType._zod.optin),q0(X._zod,"optout",()=>J.innerType._zod.optout),X._zod.parse=($,Y)=>{if(Y.direction==="backward")return J.innerType._zod.run($,Y);let G=J.innerType._zod.run($,Y);if(G instanceof Promise)return G.then(AK);return AK(G)}});function AK(X){return X.value=Object.freeze(X.value),X}var Fj=E("$ZodLazy",(X,J)=>{S0.init(X,J),q0(X._zod,"innerType",()=>J.getter()),q0(X._zod,"pattern",()=>X._zod.innerType._zod.pattern),q0(X._zod,"propValues",()=>X._zod.innerType._zod.propValues),q0(X._zod,"optin",()=>X._zod.innerType._zod.optin??void 0),q0(X._zod,"optout",()=>X._zod.innerType._zod.optout??void 0),X._zod.parse=($,Y)=>{return X._zod.innerType._zod.run($,Y)}}),Pj=E("$ZodCustom",(X,J)=>{Z6.init(X,J),S0.init(X,J),X._zod.parse=($,Y)=>{return $},X._zod.check=($)=>{let Y=$.value,G=J.fn(Y);if(G instanceof Promise)return G.then((Q)=>TK(Q,$,Y,X));TK(G,$,Y,X);return}});function TK(X,J,$,Y){if(!X){let G={code:"custom",input:$,inst:Y,path:[...Y._zod.def.path??[]],continue:!Y._zod.def.abort};if(Y._zod.def.params)G.params=Y._zod.def.params;J.issues.push(M4(G))}}var qc=Symbol("ZodOutput"),Lc=Symbol("ZodInput");class FX{constructor(){this._map=new WeakMap,this._idmap=new Map}add(X,...J){let $=J[0];if(this._map.set(X,$),$&&typeof $==="object"&&"id"in $){if(this._idmap.has($.id))throw Error(`ID ${$.id} already exists in the registry`);this._idmap.set($.id,X)}return this}clear(){return this._map=new WeakMap,this._idmap=new Map,this}remove(X){let J=this._map.get(X);if(J&&typeof J==="object"&&"id"in J)this._idmap.delete(J.id);return this._map.delete(X),this}get(X){let J=X._zod.parent;if(J){let $={...this.get(J)??{}};delete $.id;let Y={...$,...this._map.get(X)};return Object.keys(Y).length?Y:void 0}return this._map.get(X)}has(X){return this._map.has(X)}}function cR(){return new FX}var A1=cR();function Oj(X,J){return new X({type:"string",...Y0(J)})}function Mj(X,J){return new X({type:"string",format:"email",check:"string_format",abort:!1,...Y0(J)})}function hY(X,J){return new X({type:"string",format:"guid",check:"string_format",abort:!1,...Y0(J)})}function _j(X,J){return new X({type:"string",format:"uuid",check:"string_format",abort:!1,...Y0(J)})}function Aj(X,J){return new X({type:"string",format:"uuid",check:"string_format",abort:!1,version:"v4",...Y0(J)})}function Tj(X,J){return new X({type:"string",format:"uuid",check:"string_format",abort:!1,version:"v6",...Y0(J)})}function Rj(X,J){return new X({type:"string",format:"uuid",check:"string_format",abort:!1,version:"v7",...Y0(J)})}function Cj(X,J){return new X({type:"string",format:"url",check:"string_format",abort:!1,...Y0(J)})}function Ej(X,J){return new X({type:"string",format:"emoji",check:"string_format",abort:!1,...Y0(J)})}function Sj(X,J){return new X({type:"string",format:"nanoid",check:"string_format",abort:!1,...Y0(J)})}function Ij(X,J){return new X({type:"string",format:"cuid",check:"string_format",abort:!1,...Y0(J)})}function bj(X,J){return new X({type:"string",format:"cuid2",check:"string_format",abort:!1,...Y0(J)})}function kj(X,J){return new X({type:"string",format:"ulid",check:"string_format",abort:!1,...Y0(J)})}function xj(X,J){return new X({type:"string",format:"xid",check:"string_format",abort:!1,...Y0(J)})}function wj(X,J){return new X({type:"string",format:"ksuid",check:"string_format",abort:!1,...Y0(J)})}function vj(X,J){return new X({type:"string",format:"ipv4",check:"string_format",abort:!1,...Y0(J)})}function yj(X,J){return new X({type:"string",format:"ipv6",check:"string_format",abort:!1,...Y0(J)})}function hj(X,J){return new X({type:"string",format:"cidrv4",check:"string_format",abort:!1,...Y0(J)})}function fj(X,J){return new X({type:"string",format:"cidrv6",check:"string_format",abort:!1,...Y0(J)})}function gj(X,J){return new X({type:"string",format:"base64",check:"string_format",abort:!1,...Y0(J)})}function mj(X,J){return new X({type:"string",format:"base64url",check:"string_format",abort:!1,...Y0(J)})}function uj(X,J){return new X({type:"string",format:"e164",check:"string_format",abort:!1,...Y0(J)})}function pj(X,J){return new X({type:"string",format:"jwt",check:"string_format",abort:!1,...Y0(J)})}function cj(X,J){return new X({type:"string",format:"datetime",check:"string_format",offset:!1,local:!1,precision:null,...Y0(J)})}function lj(X,J){return new X({type:"string",format:"date",check:"string_format",...Y0(J)})}function dj(X,J){return new X({type:"string",format:"time",check:"string_format",precision:null,...Y0(J)})}function ij(X,J){return new X({type:"string",format:"duration",check:"string_format",...Y0(J)})}function nj(X,J){return new X({type:"number",checks:[],...Y0(J)})}function sj(X,J){return new X({type:"number",check:"number_format",abort:!1,format:"safeint",...Y0(J)})}function aj(X,J){return new X({type:"boolean",...Y0(J)})}function oj(X,J){return new X({type:"null",...Y0(J)})}function rj(X){return new X({type:"unknown"})}function tj(X,J){return new X({type:"never",...Y0(J)})}function PX(X,J){return new bY({check:"less_than",...Y0(J),value:X,inclusive:!1})}function d3(X,J){return new bY({check:"less_than",...Y0(J),value:X,inclusive:!0})}function OX(X,J){return new kY({check:"greater_than",...Y0(J),value:X,inclusive:!1})}function i3(X,J){return new kY({check:"greater_than",...Y0(J),value:X,inclusive:!0})}function MX(X,J){return new GK({check:"multiple_of",...Y0(J),value:X})}function _X(X,J){return new zK({check:"max_length",...Y0(J),maximum:X})}function _4(X,J){return new ZK({check:"min_length",...Y0(J),minimum:X})}function AX(X,J){return new WK({check:"length_equals",...Y0(J),length:X})}function fY(X,J){return new BK({check:"string_format",format:"regex",...Y0(J),pattern:X})}function gY(X){return new HK({check:"string_format",format:"lowercase",...Y0(X)})}function mY(X){return new VK({check:"string_format",format:"uppercase",...Y0(X)})}function uY(X,J){return new UK({check:"string_format",format:"includes",...Y0(J),includes:X})}function pY(X,J){return new KK({check:"string_format",format:"starts_with",...Y0(J),prefix:X})}function cY(X,J){return new jK({check:"string_format",format:"ends_with",...Y0(J),suffix:X})}function T1(X){return new NK({check:"overwrite",tx:X})}function lY(X){return T1((J)=>J.normalize(X))}function dY(){return T1((X)=>X.trim())}function iY(){return T1((X)=>X.toLowerCase())}function nY(){return T1((X)=>X.toUpperCase())}function ej(X,J,$){return new X({type:"array",element:J,...Y0($)})}function XN(X,J,$){let Y=Y0($);return Y.abort??(Y.abort=!0),new X({type:"custom",check:"custom",fn:J,...Y})}function JN(X,J,$){return new X({type:"custom",check:"custom",fn:J,...Y0($)})}function $N(X){let J=lR(($)=>{return $.addIssue=(Y)=>{if(typeof Y==="string")$.issues.push(M4(Y,$.value,J._zod.def));else{let G=Y;if(G.fatal)G.continue=!1;G.code??(G.code="custom"),G.input??(G.input=$.value),G.inst??(G.inst=J),G.continue??(G.continue=!J._zod.def.abort),$.issues.push(M4(G))}},X($.value,$)});return J}function lR(X,J){let $=new Z6({check:"custom",...Y0(J)});return $._zod.check=X,$}class sY{constructor(X){this.counter=0,this.metadataRegistry=X?.metadata??A1,this.target=X?.target??"draft-2020-12",this.unrepresentable=X?.unrepresentable??"throw",this.override=X?.override??(()=>{}),this.io=X?.io??"output",this.seen=new Map}process(X,J={path:[],schemaPath:[]}){var $;let Y=X._zod.def,G={guid:"uuid",url:"uri",datetime:"date-time",json_string:"json-string",regex:""},Q=this.seen.get(X);if(Q){if(Q.count++,J.schemaPath.includes(X))Q.cycle=J.path;return Q.schema}let z={schema:{},count:1,cycle:void 0,path:J.path};this.seen.set(X,z);let Z=X._zod.toJSONSchema?.();if(Z)z.schema=Z;else{let H={...J,schemaPath:[...J.schemaPath,X],path:J.path},U=X._zod.parent;if(U)z.ref=U,this.process(U,H),this.seen.get(U).isParent=!0;else{let j=z.schema;switch(Y.type){case"string":{let N=j;N.type="string";let{minimum:K,maximum:q,format:F,patterns:O,contentEncoding:_}=X._zod.bag;if(typeof K==="number")N.minLength=K;if(typeof q==="number")N.maxLength=q;if(F){if(N.format=G[F]??F,N.format==="")delete N.format}if(_)N.contentEncoding=_;if(O&&O.size>0){let C=[...O];if(C.length===1)N.pattern=C[0].source;else if(C.length>1)z.schema.allOf=[...C.map((L)=>({...this.target==="draft-7"||this.target==="draft-4"||this.target==="openapi-3.0"?{type:"string"}:{},pattern:L.source}))]}break}case"number":{let N=j,{minimum:K,maximum:q,format:F,multipleOf:O,exclusiveMaximum:_,exclusiveMinimum:C}=X._zod.bag;if(typeof F==="string"&&F.includes("int"))N.type="integer";else N.type="number";if(typeof C==="number")if(this.target==="draft-4"||this.target==="openapi-3.0")N.minimum=C,N.exclusiveMinimum=!0;else N.exclusiveMinimum=C;if(typeof K==="number"){if(N.minimum=K,typeof C==="number"&&this.target!=="draft-4")if(C>=K)delete N.minimum;else delete N.exclusiveMinimum}if(typeof _==="number")if(this.target==="draft-4"||this.target==="openapi-3.0")N.maximum=_,N.exclusiveMaximum=!0;else N.exclusiveMaximum=_;if(typeof q==="number"){if(N.maximum=q,typeof _==="number"&&this.target!=="draft-4")if(_<=q)delete N.maximum;else delete N.exclusiveMaximum}if(typeof O==="number")N.multipleOf=O;break}case"boolean":{let N=j;N.type="boolean";break}case"bigint":{if(this.unrepresentable==="throw")throw Error("BigInt cannot be represented in JSON Schema");break}case"symbol":{if(this.unrepresentable==="throw")throw Error("Symbols cannot be represented in JSON Schema");break}case"null":{if(this.target==="openapi-3.0")j.type="string",j.nullable=!0,j.enum=[null];else j.type="null";break}case"any":break;case"unknown":break;case"undefined":{if(this.unrepresentable==="throw")throw Error("Undefined cannot be represented in JSON Schema");break}case"void":{if(this.unrepresentable==="throw")throw Error("Void cannot be represented in JSON Schema");break}case"never":{j.not={};break}case"date":{if(this.unrepresentable==="throw")throw Error("Date cannot be represented in JSON Schema");break}case"array":{let N=j,{minimum:K,maximum:q}=X._zod.bag;if(typeof K==="number")N.minItems=K;if(typeof q==="number")N.maxItems=q;N.type="array",N.items=this.process(Y.element,{...H,path:[...H.path,"items"]});break}case"object":{let N=j;N.type="object",N.properties={};let K=Y.shape;for(let O in K)N.properties[O]=this.process(K[O],{...H,path:[...H.path,"properties",O]});let q=new Set(Object.keys(K)),F=new Set([...q].filter((O)=>{let _=Y.shape[O]._zod;if(this.io==="input")return _.optin===void 0;else return _.optout===void 0}));if(F.size>0)N.required=Array.from(F);if(Y.catchall?._zod.def.type==="never")N.additionalProperties=!1;else if(!Y.catchall){if(this.io==="output")N.additionalProperties=!1}else if(Y.catchall)N.additionalProperties=this.process(Y.catchall,{...H,path:[...H.path,"additionalProperties"]});break}case"union":{let N=j,K=Y.options.map((q,F)=>this.process(q,{...H,path:[...H.path,"anyOf",F]}));N.anyOf=K;break}case"intersection":{let N=j,K=this.process(Y.left,{...H,path:[...H.path,"allOf",0]}),q=this.process(Y.right,{...H,path:[...H.path,"allOf",1]}),F=(_)=>("allOf"in _)&&Object.keys(_).length===1,O=[...F(K)?K.allOf:[K],...F(q)?q.allOf:[q]];N.allOf=O;break}case"tuple":{let N=j;N.type="array";let K=this.target==="draft-2020-12"?"prefixItems":"items",q=this.target==="draft-2020-12"?"items":this.target==="openapi-3.0"?"items":"additionalItems",F=Y.items.map((L,P)=>this.process(L,{...H,path:[...H.path,K,P]})),O=Y.rest?this.process(Y.rest,{...H,path:[...H.path,q,...this.target==="openapi-3.0"?[Y.items.length]:[]]}):null;if(this.target==="draft-2020-12"){if(N.prefixItems=F,O)N.items=O}else if(this.target==="openapi-3.0"){if(N.items={anyOf:F},O)N.items.anyOf.push(O);if(N.minItems=F.length,!O)N.maxItems=F.length}else if(N.items=F,O)N.additionalItems=O;let{minimum:_,maximum:C}=X._zod.bag;if(typeof _==="number")N.minItems=_;if(typeof C==="number")N.maxItems=C;break}case"record":{let N=j;if(N.type="object",this.target==="draft-7"||this.target==="draft-2020-12")N.propertyNames=this.process(Y.keyType,{...H,path:[...H.path,"propertyNames"]});N.additionalProperties=this.process(Y.valueType,{...H,path:[...H.path,"additionalProperties"]});break}case"map":{if(this.unrepresentable==="throw")throw Error("Map cannot be represented in JSON Schema");break}case"set":{if(this.unrepresentable==="throw")throw Error("Set cannot be represented in JSON Schema");break}case"enum":{let N=j,K=f3(Y.entries);if(K.every((q)=>typeof q==="number"))N.type="number";if(K.every((q)=>typeof q==="string"))N.type="string";N.enum=K;break}case"literal":{let N=j,K=[];for(let q of Y.values)if(q===void 0){if(this.unrepresentable==="throw")throw Error("Literal `undefined` cannot be represented in JSON Schema")}else if(typeof q==="bigint")if(this.unrepresentable==="throw")throw Error("BigInt literals cannot be represented in JSON Schema");else K.push(Number(q));else K.push(q);if(K.length===0);else if(K.length===1){let q=K[0];if(N.type=q===null?"null":typeof q,this.target==="draft-4"||this.target==="openapi-3.0")N.enum=[q];else N.const=q}else{if(K.every((q)=>typeof q==="number"))N.type="number";if(K.every((q)=>typeof q==="string"))N.type="string";if(K.every((q)=>typeof q==="boolean"))N.type="string";if(K.every((q)=>q===null))N.type="null";N.enum=K}break}case"file":{let N=j,K={type:"string",format:"binary",contentEncoding:"binary"},{minimum:q,maximum:F,mime:O}=X._zod.bag;if(q!==void 0)K.minLength=q;if(F!==void 0)K.maxLength=F;if(O)if(O.length===1)K.contentMediaType=O[0],Object.assign(N,K);else N.anyOf=O.map((_)=>{return{...K,contentMediaType:_}});else Object.assign(N,K);break}case"transform":{if(this.unrepresentable==="throw")throw Error("Transforms cannot be represented in JSON Schema");break}case"nullable":{let N=this.process(Y.innerType,H);if(this.target==="openapi-3.0")z.ref=Y.innerType,j.nullable=!0;else j.anyOf=[N,{type:"null"}];break}case"nonoptional":{this.process(Y.innerType,H),z.ref=Y.innerType;break}case"success":{let N=j;N.type="boolean";break}case"default":{this.process(Y.innerType,H),z.ref=Y.innerType,j.default=JSON.parse(JSON.stringify(Y.defaultValue));break}case"prefault":{if(this.process(Y.innerType,H),z.ref=Y.innerType,this.io==="input")j._prefault=JSON.parse(JSON.stringify(Y.defaultValue));break}case"catch":{this.process(Y.innerType,H),z.ref=Y.innerType;let N;try{N=Y.catchValue(void 0)}catch{throw Error("Dynamic catch values are not supported in JSON Schema")}j.default=N;break}case"nan":{if(this.unrepresentable==="throw")throw Error("NaN cannot be represented in JSON Schema");break}case"template_literal":{let N=j,K=X._zod.pattern;if(!K)throw Error("Pattern not found in template literal");N.type="string",N.pattern=K.source;break}case"pipe":{let N=this.io==="input"?Y.in._zod.def.type==="transform"?Y.out:Y.in:Y.out;this.process(N,H),z.ref=N;break}case"readonly":{this.process(Y.innerType,H),z.ref=Y.innerType,j.readOnly=!0;break}case"promise":{this.process(Y.innerType,H),z.ref=Y.innerType;break}case"optional":{this.process(Y.innerType,H),z.ref=Y.innerType;break}case"lazy":{let N=X._zod.innerType;this.process(N,H),z.ref=N;break}case"custom":{if(this.unrepresentable==="throw")throw Error("Custom types cannot be represented in JSON Schema");break}case"function":{if(this.unrepresentable==="throw")throw Error("Function types cannot be represented in JSON Schema");break}default:}}}let W=this.metadataRegistry.get(X);if(W)Object.assign(z.schema,W);if(this.io==="input"&&a0(X))delete z.schema.examples,delete z.schema.default;if(this.io==="input"&&z.schema._prefault)($=z.schema).default??($.default=z.schema._prefault);return delete z.schema._prefault,this.seen.get(X).schema}emit(X,J){let $={cycles:J?.cycles??"ref",reused:J?.reused??"inline",external:J?.external??void 0},Y=this.seen.get(X);if(!Y)throw Error("Unprocessed schema. This is a bug in Zod.");let G=(B)=>{let H=this.target==="draft-2020-12"?"$defs":"definitions";if($.external){let K=$.external.registry.get(B[0])?.id,q=$.external.uri??((O)=>O);if(K)return{ref:q(K)};let F=B[1].defId??B[1].schema.id??`schema${this.counter++}`;return B[1].defId=F,{defId:F,ref:`${q("__shared")}#/${H}/${F}`}}if(B[1]===Y)return{ref:"#"};let j=`${"#"}/${H}/`,N=B[1].schema.id??`__schema${this.counter++}`;return{defId:N,ref:j+N}},Q=(B)=>{if(B[1].schema.$ref)return;let H=B[1],{ref:U,defId:j}=G(B);if(H.def={...H.schema},j)H.defId=j;let N=H.schema;for(let K in N)delete N[K];N.$ref=U};if($.cycles==="throw")for(let B of this.seen.entries()){let H=B[1];if(H.cycle)throw Error(`Cycle detected: #/${H.cycle?.join("/")}/<root>
-
-Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let B of this.seen.entries()){let H=B[1];if(X===B[0]){Q(B);continue}if($.external){let j=$.external.registry.get(B[0])?.id;if(X!==B[0]&&j){Q(B);continue}}if(this.metadataRegistry.get(B[0])?.id){Q(B);continue}if(H.cycle){Q(B);continue}if(H.count>1){if($.reused==="ref"){Q(B);continue}}}let z=(B,H)=>{let U=this.seen.get(B),j=U.def??U.schema,N={...j};if(U.ref===null)return;let K=U.ref;if(U.ref=null,K){z(K,H);let q=this.seen.get(K).schema;if(q.$ref&&(H.target==="draft-7"||H.target==="draft-4"||H.target==="openapi-3.0"))j.allOf=j.allOf??[],j.allOf.push(q);else Object.assign(j,q),Object.assign(j,N)}if(!U.isParent)this.override({zodSchema:B,jsonSchema:j,path:U.path??[]})};for(let B of[...this.seen.entries()].reverse())z(B[0],{target:this.target});let Z={};if(this.target==="draft-2020-12")Z.$schema="https://json-schema.org/draft/2020-12/schema";else if(this.target==="draft-7")Z.$schema="http://json-schema.org/draft-07/schema#";else if(this.target==="draft-4")Z.$schema="http://json-schema.org/draft-04/schema#";else if(this.target==="openapi-3.0");else console.warn(`Invalid target: ${this.target}`);if($.external?.uri){let B=$.external.registry.get(X)?.id;if(!B)throw Error("Schema is missing an `id` property");Z.$id=$.external.uri(B)}Object.assign(Z,Y.def);let W=$.external?.defs??{};for(let B of this.seen.entries()){let H=B[1];if(H.def&&H.defId)W[H.defId]=H.def}if($.external);else if(Object.keys(W).length>0)if(this.target==="draft-2020-12")Z.$defs=W;else Z.definitions=W;try{return JSON.parse(JSON.stringify(Z))}catch(B){throw Error("Error converting schema to JSON.")}}}function YN(X,J){if(X instanceof FX){let Y=new sY(J),G={};for(let Z of X._idmap.entries()){let[W,B]=Z;Y.process(B)}let Q={},z={registry:X,uri:J?.uri,defs:G};for(let Z of X._idmap.entries()){let[W,B]=Z;Q[W]=Y.emit(B,{...J,external:z})}if(Object.keys(G).length>0){let Z=Y.target==="draft-2020-12"?"$defs":"definitions";Q.__shared={[Z]:G}}return{schemas:Q}}let $=new sY(J);return $.process(X),$.emit(X,J)}function a0(X,J){let $=J??{seen:new Set};if($.seen.has(X))return!1;$.seen.add(X);let G=X._zod.def;switch(G.type){case"string":case"number":case"bigint":case"boolean":case"date":case"symbol":case"undefined":case"null":case"any":case"unknown":case"never":case"void":case"literal":case"enum":case"nan":case"file":case"template_literal":return!1;case"array":return a0(G.element,$);case"object":{for(let Q in G.shape)if(a0(G.shape[Q],$))return!0;return!1}case"union":{for(let Q of G.options)if(a0(Q,$))return!0;return!1}case"intersection":return a0(G.left,$)||a0(G.right,$);case"tuple":{for(let Q of G.items)if(a0(Q,$))return!0;if(G.rest&&a0(G.rest,$))return!0;return!1}case"record":return a0(G.keyType,$)||a0(G.valueType,$);case"map":return a0(G.keyType,$)||a0(G.valueType,$);case"set":return a0(G.valueType,$);case"promise":case"optional":case"nonoptional":case"nullable":case"readonly":return a0(G.innerType,$);case"lazy":return a0(G.getter(),$);case"default":return a0(G.innerType,$);case"prefault":return a0(G.innerType,$);case"custom":return!1;case"transform":return!0;case"pipe":return a0(G.in,$)||a0(G.out,$);case"success":return!1;case"catch":return!1;case"function":return!1;default:}throw Error(`Unknown schema type: ${G.type}`)}var oR=E("ZodISODateTime",(X,J)=>{hK.init(X,J),y0.init(X,J)});function GN(X){return cj(oR,X)}var rR=E("ZodISODate",(X,J)=>{fK.init(X,J),y0.init(X,J)});function QN(X){return lj(rR,X)}var tR=E("ZodISOTime",(X,J)=>{gK.init(X,J),y0.init(X,J)});function zN(X){return dj(tR,X)}var eR=E("ZodISODuration",(X,J)=>{mK.init(X,J),y0.init(X,J)});function ZN(X){return ij(eR,X)}var WN=(X,J)=>{UX.init(X,J),X.name="ZodError",Object.defineProperties(X,{format:{value:($)=>LU(X,$)},flatten:{value:($)=>qU(X,$)},addIssue:{value:($)=>{X.issues.push($),X.message=JSON.stringify(X.issues,P4,2)}},addIssues:{value:($)=>{X.issues.push(...$),X.message=JSON.stringify(X.issues,P4,2)}},isEmpty:{get(){return X.issues.length===0}}})},nc=E("ZodError",WN),l6=E("ZodError",WN,{Parent:Error});var BN=KX(l6),HN=jX(l6),VN=p3(l6),RX=c3(l6),UN=PU(l6),KN=OU(l6),jN=MU(l6),NN=_U(l6),qN=AU(l6),LN=TU(l6),DN=RU(l6),FN=CU(l6);var h0=E("ZodType",(X,J)=>{return S0.init(X,J),X.def=J,X.type=J.type,Object.defineProperty(X,"_def",{value:J}),X.check=(...$)=>{return X.clone({...J,checks:[...J.checks??[],...$.map((Y)=>typeof Y==="function"?{_zod:{check:Y,def:{check:"custom"},onattach:[]}}:Y)]})},X.clone=($,Y)=>N8(X,$,Y),X.brand=()=>X,X.register=($,Y)=>{return $.add(X,Y),X},X.parse=($,Y)=>BN(X,$,Y,{callee:X.parse}),X.safeParse=($,Y)=>VN(X,$,Y),X.parseAsync=async($,Y)=>HN(X,$,Y,{callee:X.parseAsync}),X.safeParseAsync=async($,Y)=>RX(X,$,Y),X.spa=X.safeParseAsync,X.encode=($,Y)=>UN(X,$,Y),X.decode=($,Y)=>KN(X,$,Y),X.encodeAsync=async($,Y)=>jN(X,$,Y),X.decodeAsync=async($,Y)=>NN(X,$,Y),X.safeEncode=($,Y)=>qN(X,$,Y),X.safeDecode=($,Y)=>LN(X,$,Y),X.safeEncodeAsync=async($,Y)=>DN(X,$,Y),X.safeDecodeAsync=async($,Y)=>FN(X,$,Y),X.refine=($,Y)=>X.check(iC($,Y)),X.superRefine=($)=>X.check(nC($)),X.overwrite=($)=>X.check(T1($)),X.optional=()=>MN(X),X.nullable=()=>_N(X),X.nullish=()=>MN(_N(X)),X.nonoptional=($)=>gC(X,$),X.array=()=>rY(X),X.or=($)=>tY([X,$]),X.and=($)=>SC(X,$),X.transform=($)=>AN(X,xC($)),X.default=($)=>yC(X,$),X.prefault=($)=>fC(X,$),X.catch=($)=>uC(X,$),X.pipe=($)=>AN(X,$),X.readonly=()=>lC(X),X.describe=($)=>{let Y=X.clone();return A1.add(Y,{description:$}),Y},Object.defineProperty(X,"description",{get(){return A1.get(X)?.description},configurable:!0}),X.meta=(...$)=>{if($.length===0)return A1.get(X);let Y=X.clone();return A1.add(Y,$[0]),Y},X.isOptional=()=>X.safeParse(void 0).success,X.isNullable=()=>X.safeParse(null).success,X}),TN=E("_ZodString",(X,J)=>{DX.init(X,J),h0.init(X,J);let $=X._zod.bag;X.format=$.format??null,X.minLength=$.minimum??null,X.maxLength=$.maximum??null,X.regex=(...Y)=>X.check(fY(...Y)),X.includes=(...Y)=>X.check(uY(...Y)),X.startsWith=(...Y)=>X.check(pY(...Y)),X.endsWith=(...Y)=>X.check(cY(...Y)),X.min=(...Y)=>X.check(_4(...Y)),X.max=(...Y)=>X.check(_X(...Y)),X.length=(...Y)=>X.check(AX(...Y)),X.nonempty=(...Y)=>X.check(_4(1,...Y)),X.lowercase=(Y)=>X.check(gY(Y)),X.uppercase=(Y)=>X.check(mY(Y)),X.trim=()=>X.check(dY()),X.normalize=(...Y)=>X.check(lY(...Y)),X.toLowerCase=()=>X.check(iY()),X.toUpperCase=()=>X.check(nY())}),YC=E("ZodString",(X,J)=>{DX.init(X,J),TN.init(X,J),X.email=($)=>X.check(Mj(GC,$)),X.url=($)=>X.check(Cj(QC,$)),X.jwt=($)=>X.check(pj(PC,$)),X.emoji=($)=>X.check(Ej(zC,$)),X.guid=($)=>X.check(hY(PN,$)),X.uuid=($)=>X.check(_j(CX,$)),X.uuidv4=($)=>X.check(Aj(CX,$)),X.uuidv6=($)=>X.check(Tj(CX,$)),X.uuidv7=($)=>X.check(Rj(CX,$)),X.nanoid=($)=>X.check(Sj(ZC,$)),X.guid=($)=>X.check(hY(PN,$)),X.cuid=($)=>X.check(Ij(WC,$)),X.cuid2=($)=>X.check(bj(BC,$)),X.ulid=($)=>X.check(kj(HC,$)),X.base64=($)=>X.check(gj(LC,$)),X.base64url=($)=>X.check(mj(DC,$)),X.xid=($)=>X.check(xj(VC,$)),X.ksuid=($)=>X.check(wj(UC,$)),X.ipv4=($)=>X.check(vj(KC,$)),X.ipv6=($)=>X.check(yj(jC,$)),X.cidrv4=($)=>X.check(hj(NC,$)),X.cidrv6=($)=>X.check(fj(qC,$)),X.e164=($)=>X.check(uj(FC,$)),X.datetime=($)=>X.check(GN($)),X.date=($)=>X.check(QN($)),X.time=($)=>X.check(zN($)),X.duration=($)=>X.check(ZN($))});function RN(X){return Oj(YC,X)}var y0=E("ZodStringFormat",(X,J)=>{k0.init(X,J),TN.init(X,J)}),GC=E("ZodEmail",(X,J)=>{EK.init(X,J),y0.init(X,J)});var PN=E("ZodGUID",(X,J)=>{RK.init(X,J),y0.init(X,J)});var CX=E("ZodUUID",(X,J)=>{CK.init(X,J),y0.init(X,J)});var QC=E("ZodURL",(X,J)=>{SK.init(X,J),y0.init(X,J)});var zC=E("ZodEmoji",(X,J)=>{IK.init(X,J),y0.init(X,J)});var ZC=E("ZodNanoID",(X,J)=>{bK.init(X,J),y0.init(X,J)});var WC=E("ZodCUID",(X,J)=>{kK.init(X,J),y0.init(X,J)});var BC=E("ZodCUID2",(X,J)=>{xK.init(X,J),y0.init(X,J)});var HC=E("ZodULID",(X,J)=>{wK.init(X,J),y0.init(X,J)});var VC=E("ZodXID",(X,J)=>{vK.init(X,J),y0.init(X,J)});var UC=E("ZodKSUID",(X,J)=>{yK.init(X,J),y0.init(X,J)});var KC=E("ZodIPv4",(X,J)=>{uK.init(X,J),y0.init(X,J)});var jC=E("ZodIPv6",(X,J)=>{pK.init(X,J),y0.init(X,J)});var NC=E("ZodCIDRv4",(X,J)=>{cK.init(X,J),y0.init(X,J)});var qC=E("ZodCIDRv6",(X,J)=>{lK.init(X,J),y0.init(X,J)});var LC=E("ZodBase64",(X,J)=>{iK.init(X,J),y0.init(X,J)});var DC=E("ZodBase64URL",(X,J)=>{nK.init(X,J),y0.init(X,J)});var FC=E("ZodE164",(X,J)=>{sK.init(X,J),y0.init(X,J)});var PC=E("ZodJWT",(X,J)=>{aK.init(X,J),y0.init(X,J)});var CN=E("ZodNumber",(X,J)=>{vY.init(X,J),h0.init(X,J),X.gt=(Y,G)=>X.check(OX(Y,G)),X.gte=(Y,G)=>X.check(i3(Y,G)),X.min=(Y,G)=>X.check(i3(Y,G)),X.lt=(Y,G)=>X.check(PX(Y,G)),X.lte=(Y,G)=>X.check(d3(Y,G)),X.max=(Y,G)=>X.check(d3(Y,G)),X.int=(Y)=>X.check(ON(Y)),X.safe=(Y)=>X.check(ON(Y)),X.positive=(Y)=>X.check(OX(0,Y)),X.nonnegative=(Y)=>X.check(i3(0,Y)),X.negative=(Y)=>X.check(PX(0,Y)),X.nonpositive=(Y)=>X.check(d3(0,Y)),X.multipleOf=(Y,G)=>X.check(MX(Y,G)),X.step=(Y,G)=>X.check(MX(Y,G)),X.finite=()=>X;let $=X._zod.bag;X.minValue=Math.max($.minimum??Number.NEGATIVE_INFINITY,$.exclusiveMinimum??Number.NEGATIVE_INFINITY)??null,X.maxValue=Math.min($.maximum??Number.POSITIVE_INFINITY,$.exclusiveMaximum??Number.POSITIVE_INFINITY)??null,X.isInt=($.format??"").includes("int")||Number.isSafeInteger($.multipleOf??0.5),X.isFinite=!0,X.format=$.format??null});function EN(X){return nj(CN,X)}var OC=E("ZodNumberFormat",(X,J)=>{oK.init(X,J),CN.init(X,J)});function ON(X){return sj(OC,X)}var MC=E("ZodBoolean",(X,J)=>{rK.init(X,J),h0.init(X,J)});function SN(X){return aj(MC,X)}var _C=E("ZodNull",(X,J)=>{tK.init(X,J),h0.init(X,J)});function IN(X){return oj(_C,X)}var AC=E("ZodUnknown",(X,J)=>{eK.init(X,J),h0.init(X,J)});function n3(){return rj(AC)}var TC=E("ZodNever",(X,J)=>{Xj.init(X,J),h0.init(X,J)});function oY(X){return tj(TC,X)}var RC=E("ZodArray",(X,J)=>{Jj.init(X,J),h0.init(X,J),X.element=J.element,X.min=($,Y)=>X.check(_4($,Y)),X.nonempty=($)=>X.check(_4(1,$)),X.max=($,Y)=>X.check(_X($,Y)),X.length=($,Y)=>X.check(AX($,Y)),X.unwrap=()=>X.element});function rY(X,J){return ej(RC,X,J)}var bN=E("ZodObject",(X,J)=>{Gj.init(X,J),h0.init(X,J),j0.defineLazy(X,"shape",()=>J.shape),X.keyof=()=>eY(Object.keys(X._zod.def.shape)),X.catchall=($)=>X.clone({...X._zod.def,catchall:$}),X.passthrough=()=>X.clone({...X._zod.def,catchall:n3()}),X.loose=()=>X.clone({...X._zod.def,catchall:n3()}),X.strict=()=>X.clone({...X._zod.def,catchall:oY()}),X.strip=()=>X.clone({...X._zod.def,catchall:void 0}),X.extend=($)=>{return j0.extend(X,$)},X.safeExtend=($)=>{return j0.safeExtend(X,$)},X.merge=($)=>j0.merge(X,$),X.pick=($)=>j0.pick(X,$),X.omit=($)=>j0.omit(X,$),X.partial=(...$)=>j0.partial(fN,X,$[0]),X.required=(...$)=>j0.required(gN,X,$[0])});function kN(X,J){let $={type:"object",get shape(){return j0.assignProp(this,"shape",X?j0.objectClone(X):{}),this.shape},...j0.normalizeParams(J)};return new bN($)}function xN(X,J){return new bN({type:"object",get shape(){return j0.assignProp(this,"shape",j0.objectClone(X)),this.shape},catchall:n3(),...j0.normalizeParams(J)})}var wN=E("ZodUnion",(X,J)=>{yY.init(X,J),h0.init(X,J),X.options=J.options});function tY(X,J){return new wN({type:"union",options:X,...j0.normalizeParams(J)})}var CC=E("ZodDiscriminatedUnion",(X,J)=>{wN.init(X,J),Qj.init(X,J)});function vN(X,J,$){return new CC({type:"union",options:J,discriminator:X,...j0.normalizeParams($)})}var EC=E("ZodIntersection",(X,J)=>{zj.init(X,J),h0.init(X,J)});function SC(X,J){return new EC({type:"intersection",left:X,right:J})}var IC=E("ZodRecord",(X,J)=>{Zj.init(X,J),h0.init(X,J),X.keyType=J.keyType,X.valueType=J.valueType});function yN(X,J,$){return new IC({type:"record",keyType:X,valueType:J,...j0.normalizeParams($)})}var aY=E("ZodEnum",(X,J)=>{Wj.init(X,J),h0.init(X,J),X.enum=J.entries,X.options=Object.values(J.entries);let $=new Set(Object.keys(J.entries));X.extract=(Y,G)=>{let Q={};for(let z of Y)if($.has(z))Q[z]=J.entries[z];else throw Error(`Key ${z} not found in enum`);return new aY({...J,checks:[],...j0.normalizeParams(G),entries:Q})},X.exclude=(Y,G)=>{let Q={...J.entries};for(let z of Y)if($.has(z))delete Q[z];else throw Error(`Key ${z} not found in enum`);return new aY({...J,checks:[],...j0.normalizeParams(G),entries:Q})}});function eY(X,J){let $=Array.isArray(X)?Object.fromEntries(X.map((Y)=>[Y,Y])):X;return new aY({type:"enum",entries:$,...j0.normalizeParams(J)})}var bC=E("ZodLiteral",(X,J)=>{Bj.init(X,J),h0.init(X,J),X.values=new Set(J.values),Object.defineProperty(X,"value",{get(){if(J.values.length>1)throw Error("This schema contains multiple valid literal values. Use `.values` instead.");return J.values[0]}})});function hN(X,J){return new bC({type:"literal",values:Array.isArray(X)?X:[X],...j0.normalizeParams(J)})}var kC=E("ZodTransform",(X,J)=>{Hj.init(X,J),h0.init(X,J),X._zod.parse=($,Y)=>{if(Y.direction==="backward")throw new y3(X.constructor.name);$.addIssue=(Q)=>{if(typeof Q==="string")$.issues.push(j0.issue(Q,$.value,J));else{let z=Q;if(z.fatal)z.continue=!1;z.code??(z.code="custom"),z.input??(z.input=$.value),z.inst??(z.inst=X),$.issues.push(j0.issue(z))}};let G=J.transform($.value,$);if(G instanceof Promise)return G.then((Q)=>{return $.value=Q,$});return $.value=G,$}});function xC(X){return new kC({type:"transform",transform:X})}var fN=E("ZodOptional",(X,J)=>{Vj.init(X,J),h0.init(X,J),X.unwrap=()=>X._zod.def.innerType});function MN(X){return new fN({type:"optional",innerType:X})}var wC=E("ZodNullable",(X,J)=>{Uj.init(X,J),h0.init(X,J),X.unwrap=()=>X._zod.def.innerType});function _N(X){return new wC({type:"nullable",innerType:X})}var vC=E("ZodDefault",(X,J)=>{Kj.init(X,J),h0.init(X,J),X.unwrap=()=>X._zod.def.innerType,X.removeDefault=X.unwrap});function yC(X,J){return new vC({type:"default",innerType:X,get defaultValue(){return typeof J==="function"?J():j0.shallowClone(J)}})}var hC=E("ZodPrefault",(X,J)=>{jj.init(X,J),h0.init(X,J),X.unwrap=()=>X._zod.def.innerType});function fC(X,J){return new hC({type:"prefault",innerType:X,get defaultValue(){return typeof J==="function"?J():j0.shallowClone(J)}})}var gN=E("ZodNonOptional",(X,J)=>{Nj.init(X,J),h0.init(X,J),X.unwrap=()=>X._zod.def.innerType});function gC(X,J){return new gN({type:"nonoptional",innerType:X,...j0.normalizeParams(J)})}var mC=E("ZodCatch",(X,J)=>{qj.init(X,J),h0.init(X,J),X.unwrap=()=>X._zod.def.innerType,X.removeCatch=X.unwrap});function uC(X,J){return new mC({type:"catch",innerType:X,catchValue:typeof J==="function"?J:()=>J})}var pC=E("ZodPipe",(X,J)=>{Lj.init(X,J),h0.init(X,J),X.in=J.in,X.out=J.out});function AN(X,J){return new pC({type:"pipe",in:X,out:J})}var cC=E("ZodReadonly",(X,J)=>{Dj.init(X,J),h0.init(X,J),X.unwrap=()=>X._zod.def.innerType});function lC(X){return new cC({type:"readonly",innerType:X})}var dC=E("ZodLazy",(X,J)=>{Fj.init(X,J),h0.init(X,J),X.unwrap=()=>X._zod.def.getter()});function mN(X){return new dC({type:"lazy",getter:X})}var XG=E("ZodCustom",(X,J)=>{Pj.init(X,J),h0.init(X,J)});function uN(X,J){return XN(XG,X??(()=>!0),J)}function iC(X,J={}){return JN(XG,X,J)}function nC(X){return $N(X)}function pN(X,J={error:`Input not instance of ${X.name}`}){let $=new XG({type:"custom",check:"custom",fn:(Y)=>Y instanceof X,abort:!0,...j0.normalizeParams(J)});return $._zod.bag.Class=X,$}function tN(X=globalThis){if(X.navigator?.userAgent)return X.navigator.userAgent.toLowerCase();if(X.process?.versions?.node)return`node.js/${X.process.version}`;if(X.EdgeRuntime)return"vercel-edge";return""}function eN(X){if(X==null)return{};let J={};if(X instanceof Headers)X.forEach(($,Y)=>{J[Y.toLowerCase()]=$});else{if(!Array.isArray(X))X=Object.entries(X);for(let[$,Y]of X)if(Y!=null)J[$.toLowerCase()]=Y}return J}function Xq(X,...J){let $=new Headers(eN(X)),Y=$.get("user-agent")||"";return $.set("user-agent",[Y,...J].filter(Boolean).join(" ")),Object.fromEntries($.entries())}var rC=[{mediaType:"audio/aac",bytesPrefix:[255,240]},{mediaType:"audio/aac",bytesPrefix:[255,241]},{mediaType:"audio/aac",bytesPrefix:[255,248]},{mediaType:"audio/aac",bytesPrefix:[255,249]},{mediaType:"audio/mpeg",bytesPrefix:[255,251]},{mediaType:"audio/mpeg",bytesPrefix:[255,250]},{mediaType:"audio/mpeg",bytesPrefix:[255,243]},{mediaType:"audio/mpeg",bytesPrefix:[255,242]},{mediaType:"audio/mpeg",bytesPrefix:[255,227]},{mediaType:"audio/mpeg",bytesPrefix:[255,226]},{mediaType:"audio/wav",bytesPrefix:[82,73,70,70,null,null,null,null,87,65,86,69]},{mediaType:"audio/ogg",bytesPrefix:[79,103,103,83]},{mediaType:"audio/flac",bytesPrefix:[102,76,97,67]},{mediaType:"audio/aac",bytesPrefix:[64,21,0,0]},{mediaType:"audio/webm",bytesPrefix:[26,69,223,163]}],fl=[...rC,{mediaType:"audio/mp4",bytesPrefix:[0,0,0,null,102,116,121,112]}];async function EX(X){try{await X.body?.cancel()}catch{}}var Jq="AI_DownloadError",$q=`vercel.ai.error.${Jq}`,tC=Symbol.for($q),q6=class extends H9{constructor({url:X,statusCode:J,statusText:$,cause:Y,message:G=Y==null?`Failed to download ${X}: ${J} ${$}`:`Failed to download ${X}: ${Y}`}){super({name:Jq,message:G,cause:Y});this[tC]=!0,this.url=X,this.statusCode=J,this.statusText=$}static isInstance(X){return H9.hasMarker(X,$q)}};function eC(X=globalThis){return X.window!=null}function YG(X,J){try{return new URL(X).origin===new URL(J).origin}catch{return!1}}function XE(X){let J;try{J=new URL(X)}catch{throw new q6({url:X,message:`Invalid URL: ${X}`})}if(J.protocol==="data:")return;if(J.protocol!=="http:"&&J.protocol!=="https:")throw new q6({url:X,message:`URL scheme must be http, https, or data, got ${J.protocol}`});let $=J.hostname.toLowerCase().replace(/\.+$/,"");if(!$)throw new q6({url:X,message:"URL must have a hostname"});if($==="localhost"||$.endsWith(".local")||$.endsWith(".localhost"))throw new q6({url:X,message:`URL with hostname ${$} is not allowed`});if($.startsWith("[")&&$.endsWith("]")){if(Yq($.slice(1,-1)))throw new q6({url:X,message:`URL with IPv6 address ${$} is not allowed`});return}if(QG($)){if(zG($))throw new q6({url:X,message:`URL with IP address ${$} is not allowed`})}}function JE({address:X,family:J,hostname:$}){if(J===4?!QG(X)||zG(X):J===6?Yq(X):!0)throw new q6({url:$,message:`Hostname ${$} resolved to disallowed IP address ${X}`})}function QG(X){let J=X.split(".");if(J.length!==4)return!1;return J.every(($)=>{let Y=Number($);return Number.isInteger(Y)&&Y>=0&&Y<=255&&String(Y)===$})}function zG(X){let[J,$,Y]=X.split(".").map(Number);if(J===0)return!0;if(J===10)return!0;if(J===100&&$>=64&&$<=127)return!0;if(J===127)return!0;if(J===169&&$===254)return!0;if(J===172&&$>=16&&$<=31)return!0;if(J===192&&$===0&&Y===0)return!0;if(J===192&&$===0&&Y===2)return!0;if(J===192&&$===168)return!0;if(J===198&&($===18||$===19))return!0;if(J===198&&$===51&&Y===100)return!0;if(J===203&&$===0&&Y===113)return!0;if(J>=224)return!0;return!1}function $E(X){let J=X.toLowerCase(),$=J.indexOf("%");if($!==-1)J=J.slice(0,$);let Y=J.split("::");if(Y.length>2)return null;let G=(z)=>{if(z==="")return[];let Z=[],W=z.split(":");for(let B=0;B<W.length;B++){let H=W[B];if(H.includes(".")){if(B!==W.length-1||!QG(H))return null;let[U,j,N,K]=H.split(".").map(Number);Z.push(U<<8|j,N<<8|K);continue}if(!/^[0-9a-f]{1,4}$/.test(H))return null;Z.push(parseInt(H,16))}return Z},Q=G(Y[0]);if(Q===null)return null;if(Y.length===2){let z=G(Y[1]);if(z===null)return null;let Z=8-Q.length-z.length;if(Z<0)return null;return[...Q,...Array(Z).fill(0),...z]}return Q.length===8?Q:null}function Yq(X){let J=$E(X);if(J===null)return!0;let $=(Y)=>J.slice(0,Y).every((G)=>G===0);if($(7)&&(J[7]===0||J[7]===1))return!0;if((J[0]&65024)===64512)return!0;if((J[0]&65472)===65152)return!0;if((J[0]&65472)===65216)return!0;if((J[0]&65280)===65280)return!0;if(J[0]===8193&&J[1]===3512)return!0;if(J[0]===16383&&(J[1]&61440)===0)return!0;if($(6)||$(5)&&J[5]===65535||$(4)&&J[4]===65535&&J[5]===0||J[0]===100&&J[1]===65435&&J[2]===0&&J[3]===0&&J[4]===0&&J[5]===0||J[0]===100&&J[1]===65435&&J[2]===1)return zG(`${J[6]>>8&255}.${J[6]&255}.${J[7]>>8&255}.${J[7]&255}`);return!1}function YE(X){return(J,$,Y)=>{X(J,{...$,all:!0},(G,Q)=>{if(G){Y(G);return}try{let[z]=Q;if(z==null)throw Error(`Hostname ${J} did not resolve to an address`);for(let{address:Z,family:W}of Q)JE({address:Z,family:W,hostname:J});if($.all===!0)Y(null,Q);else Y(null,z.address,z.family)}catch(z){Y(z instanceof Error?z:Error(String(z)))}})}}var GE;function QE(){let X=globalThis.process;return X?.release?.name==="node"&&X.versions?.bun==null&&X.versions?.deno==null&&X.title!=="workerd"&&globalThis.EdgeRuntime==null}async function zE(){if(!QE())return globalThis.fetch;return GE??=Promise.resolve().then(ZE)}function ZE(){let X=cN("node:module"),{lookup:J}=cN("node:dns"),{Agent:$,fetch:Y}=X.createRequire(Gq())("undici"),G=new $({connect:{lookup:YE(J)}});return(Q,z)=>Y(Q,{...z,dispatcher:G})}function cN(X){let J=globalThis.process?.getBuiltinModule?.(X);if(J==null)throw Error(`Node.js built-in module ${X} is unavailable`);return J}function Gq(){let X=Error.prepareStackTrace;try{Error.prepareStackTrace=(G,Q)=>Q;let J=Error("Capture current module path");Error.captureStackTrace(J,Gq);let[$]=J.stack,Y=$?.getFileName();if(Y==null)throw Error("Unable to determine the current module path");return Y}finally{Error.prepareStackTrace=X}}var WE=["connection","keep-alive","te","trailer","transfer-encoding","upgrade","host","forwarded","proxy-authorization","via","x-forwarded-for","x-forwarded-host","x-forwarded-proto","x-real-ip","metadata","metadata-flavor","x-aws-ec2-metadata-token","x-metadata-token","cookie","set-cookie"];function Qq(X){let J=new Headers(X);for(let $ of WE)J.delete($);return J}var BE=10,HE=new Set([301,302,303,307,308]);async function VE(X){return X==null||X===globalThis.fetch?await zE():X}async function UE({url:X,headers:J,abortSignal:$,maxRedirects:Y=BE,fetch:G,trustedOrigin:Q}){let z=J===void 0?void 0:Qq(J),Z=(B)=>{let H={signal:$,redirect:B};if(z!==void 0)H.headers=new Headers(z);return H},W=X;for(let B=0;B<=Y;B++){let H=Q!==void 0&&YG(W,Q);if(!H)XE(W);let U=H&&G!=null?G:H?globalThis.fetch:await VE(G),j=await U(W,Z("manual"));if(j.type==="opaqueredirect"){if(!eC())throw new q6({url:X,message:`Redirect from ${W} could not be validated and was blocked`});return await U(W,Z("follow"))}let N=j.headers?.get("location");if(HE.has(j.status)&&N){EX(j);let K=new URL(N,W).toString();if(z!==void 0&&!YG(K,W)){let q=z.get("user-agent");z=new Headers(q==null?void 0:{"user-agent":q})}W=K;continue}return j}throw new q6({url:X,message:`Too many redirects (max ${Y})`})}var KE=new Set(["accept","accept-language","baggage","cache-control","idempotency-key","if-match","if-modified-since","if-none-match","if-range","if-unmodified-since","pragma","range","traceparent","tracestate","user-agent","x-correlation-id","x-request-id"]);async function zq({headers:X,credentialedOrigin:J,untrustedFirstHopHeaders:$,...Y}){let G;if(X!==void 0){G=Qq(X);let Q=J??Y.trustedOrigin;if(Q===void 0||!YG(Y.url,Q)){let z=new Set([...KE,...($??[]).map((Z)=>Z.toLowerCase())]);G=new Headers([...G].filter(([Z])=>z.has(Z)))}}return UE({...Y,headers:G})}var ZG=2147483648;async function Zq({response:X,url:J,maxBytes:$=ZG}){let Y=X.headers.get("content-length");if(Y!=null){let H=parseInt(Y,10);if(!isNaN(H)&&H>$)throw await EX(X),new q6({url:J,message:`Download of ${J} exceeded maximum size of ${$} bytes (Content-Length: ${H}).`})}let G=X.body;if(G==null)return new Uint8Array(0);let Q=G.getReader(),z=[],Z=0;try{while(!0){let{done:H,value:U}=await Q.read();if(H)break;if(Z+=U.length,Z>$)throw new q6({url:J,message:`Download of ${J} exceeded maximum size of ${$} bytes.`});z.push(U)}}finally{try{await Q.cancel()}catch{}finally{Q.releaseLock()}}let W=new Uint8Array(Z),B=0;for(let H of z)W.set(H,B),B+=H.length;return W}var J6=({prefix:X,size:J=16,alphabet:$="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",separator:Y="-"}={})=>{let G=()=>{let Q=$.length,z=Array(J);for(let Z=0;Z<J;Z++)z[Z]=$[Math.random()*Q|0];return z.join("")};if(X==null)return G;if($.includes(Y))throw new PY({argument:"separator",message:`The separator "${Y}" must not be part of the alphabet "${$}".`});return()=>`${X}${Y}${G()}`},Wq=J6();function Bq(X){return globalThis.Buffer?.isBuffer(X)??!1}function Hq(X){if(X.type==="object"||Array.isArray(X.type)&&X.type.includes("object")){let{additionalProperties:$}=X;X.additionalProperties=$!=null&&typeof $!=="boolean"?g9($):!1;let{properties:Y}=X;if(Y!=null)for(let G of Object.keys(Y))Y[G]=g9(Y[G])}if(X.items!=null)X.items=Array.isArray(X.items)?X.items.map(g9):g9(X.items);if(X.anyOf!=null)X.anyOf=X.anyOf.map(g9);if(X.allOf!=null)X.allOf=X.allOf.map(g9);if(X.oneOf!=null)X.oneOf=X.oneOf.map(g9);let{definitions:J}=X;if(J!=null)for(let $ of Object.keys(J))J[$]=g9(J[$]);return X}function g9(X){if(typeof X==="boolean")return X;return Hq(X)}var jE=Symbol("Let zodToJsonSchema decide on which parser to use"),lN={name:void 0,$refStrategy:"root",basePath:["#"],effectStrategy:"input",pipeStrategy:"all",dateStrategy:"format:date-time",mapStrategy:"entries",removeAdditionalStrategy:"passthrough",allowedAdditionalProperties:!0,rejectedAdditionalProperties:!1,definitionPath:"definitions",strictUnions:!1,definitions:{},errorMessages:!1,patternStrategy:"escape",applyRegexFlags:!1,emailStrategy:"format:email",base64Strategy:"contentEncoding:base64",nameStrategy:"ref"},NE=(X)=>typeof X==="string"?{...lN,name:X}:{...lN,...X};function d6(){return{}}function qE(X,J){let $={type:"array"};if(X.type?._def&&X.type?._def?.typeName!=="ZodAny")$.items=A0(X.type._def,{...J,currentPath:[...J.currentPath,"items"]});if(X.minLength)$.minItems=X.minLength.value;if(X.maxLength)$.maxItems=X.maxLength.value;if(X.exactLength)$.minItems=X.exactLength.value,$.maxItems=X.exactLength.value;return $}function LE(X){let J={type:"integer",format:"int64"};if(!X.checks)return J;for(let $ of X.checks)switch($.kind){case"min":if($.inclusive)J.minimum=$.value;else J.exclusiveMinimum=$.value;break;case"max":if($.inclusive)J.maximum=$.value;else J.exclusiveMaximum=$.value;break;case"multipleOf":J.multipleOf=$.value}return J}function DE(){return{type:"boolean"}}function Vq(X,J){return A0(X.type._def,J)}var FE=(X,J)=>{return A0(X.innerType._def,J)};function Uq(X,J,$){let Y=$??J.dateStrategy;if(Array.isArray(Y))return{anyOf:Y.map((G)=>Uq(X,J,G))};switch(Y){case"string":case"format:date-time":return{type:"string",format:"date-time"};case"format:date":return{type:"string",format:"date"};case"integer":return PE(X)}}var PE=(X)=>{let J={type:"integer",format:"unix-time"};for(let $ of X.checks)switch($.kind){case"min":J.minimum=$.value;break;case"max":J.maximum=$.value}return J};function OE(X,J){return{...A0(X.innerType._def,J),default:X.defaultValue()}}function ME(X,J){return J.effectStrategy==="input"?A0(X.schema._def,J):d6()}function _E(X){return{type:"string",enum:Array.from(X.values)}}var AE=(X)=>{if("type"in X&&X.type==="string")return!1;return"allOf"in X};function TE(X,J){let $=[A0(X.left._def,{...J,currentPath:[...J.currentPath,"allOf","0"]}),A0(X.right._def,{...J,currentPath:[...J.currentPath,"allOf","1"]})].filter((G)=>!!G),Y=[];return $.forEach((G)=>{if(AE(G))Y.push(...G.allOf);else{let Q=G;if("additionalProperties"in G&&G.additionalProperties===!1){let{additionalProperties:z,...Z}=G;Q=Z}Y.push(Q)}}),Y.length?{allOf:Y}:void 0}function RE(X){let J=typeof X.value;if(J!=="bigint"&&J!=="number"&&J!=="boolean"&&J!=="string")return{type:Array.isArray(X.value)?"array":"object"};return{type:J==="bigint"?"integer":J,const:X.value}}var JG=void 0,L8={cuid:/^[cC][^\s-]{8,}$/,cuid2:/^[0-9a-z]+$/,ulid:/^[0-9A-HJKMNP-TV-Z]{26}$/,email:/^(?!\.)(?!.*\.\.)([a-zA-Z0-9_'+\-.]*)[a-zA-Z0-9_+-]@([a-zA-Z0-9][a-zA-Z0-9-]*\.)+[a-zA-Z]{2,}$/,emoji:()=>{if(JG===void 0)JG=RegExp("^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$","u");return JG},uuid:/^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$/,ipv4:/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,ipv4Cidr:/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/(3[0-2]|[12]?[0-9])$/,ipv6:/^(([a-f0-9]{1,4}:){7}|::([a-f0-9]{1,4}:){0,6}|([a-f0-9]{1,4}:){1}:([a-f0-9]{1,4}:){0,5}|([a-f0-9]{1,4}:){2}:([a-f0-9]{1,4}:){0,4}|([a-f0-9]{1,4}:){3}:([a-f0-9]{1,4}:){0,3}|([a-f0-9]{1,4}:){4}:([a-f0-9]{1,4}:){0,2}|([a-f0-9]{1,4}:){5}:([a-f0-9]{1,4}:){0,1})([a-f0-9]{1,4}|(((25[0-5])|(2[0-4][0-9])|(1[0-9]{2})|([0-9]{1,2}))\.){3}((25[0-5])|(2[0-4][0-9])|(1[0-9]{2})|([0-9]{1,2})))$/,ipv6Cidr:/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,base64:/^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$/,base64url:/^([0-9a-zA-Z-_]{4})*(([0-9a-zA-Z-_]{2}(==)?)|([0-9a-zA-Z-_]{3}(=)?))?$/,nanoid:/^[a-zA-Z0-9_-]{21}$/,jwt:/^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$/};function Kq(X,J){let $={type:"string"};if(X.checks)for(let Y of X.checks)switch(Y.kind){case"min":$.minLength=typeof $.minLength==="number"?Math.max($.minLength,Y.value):Y.value;break;case"max":$.maxLength=typeof $.maxLength==="number"?Math.min($.maxLength,Y.value):Y.value;break;case"email":switch(J.emailStrategy){case"format:email":D8($,"email",Y.message,J);break;case"format:idn-email":D8($,"idn-email",Y.message,J);break;case"pattern:zod":S6($,L8.email,Y.message,J)}break;case"url":D8($,"uri",Y.message,J);break;case"uuid":D8($,"uuid",Y.message,J);break;case"regex":S6($,Y.regex,Y.message,J);break;case"cuid":S6($,L8.cuid,Y.message,J);break;case"cuid2":S6($,L8.cuid2,Y.message,J);break;case"startsWith":S6($,RegExp(`^${$G(Y.value,J)}`),Y.message,J);break;case"endsWith":S6($,RegExp(`${$G(Y.value,J)}$`),Y.message,J);break;case"datetime":D8($,"date-time",Y.message,J);break;case"date":D8($,"date",Y.message,J);break;case"time":D8($,"time",Y.message,J);break;case"duration":D8($,"duration",Y.message,J);break;case"length":$.minLength=typeof $.minLength==="number"?Math.max($.minLength,Y.value):Y.value,$.maxLength=typeof $.maxLength==="number"?Math.min($.maxLength,Y.value):Y.value;break;case"includes":S6($,RegExp($G(Y.value,J)),Y.message,J);break;case"ip":if(Y.version!=="v6")D8($,"ipv4",Y.message,J);if(Y.version!=="v4")D8($,"ipv6",Y.message,J);break;case"base64url":S6($,L8.base64url,Y.message,J);break;case"jwt":S6($,L8.jwt,Y.message,J);break;case"cidr":if(Y.version!=="v6")S6($,L8.ipv4Cidr,Y.message,J);if(Y.version!=="v4")S6($,L8.ipv6Cidr,Y.message,J);break;case"emoji":S6($,L8.emoji(),Y.message,J);break;case"ulid":S6($,L8.ulid,Y.message,J);break;case"base64":switch(J.base64Strategy){case"format:binary":D8($,"binary",Y.message,J);break;case"contentEncoding:base64":$.contentEncoding="base64";break;case"pattern:zod":S6($,L8.base64,Y.message,J)}break;case"nanoid":S6($,L8.nanoid,Y.message,J)}return $}function $G(X,J){return J.patternStrategy==="escape"?EE(X):X}var CE=new Set("ABCDEFGHIJKLMNOPQRSTUVXYZabcdefghijklmnopqrstuvxyz0123456789");function EE(X){let J="";for(let $=0;$<X.length;$++){if(!CE.has(X[$]))J+="\\";J+=X[$]}return J}function D8(X,J,$,Y){if(X.format||X.anyOf?.some((G)=>G.format)){if(!X.anyOf)X.anyOf=[];if(X.format)X.anyOf.push({format:X.format}),delete X.format;X.anyOf.push({format:J,...$&&Y.errorMessages&&{errorMessage:{format:$}}})}else X.format=J}function S6(X,J,$,Y){if(X.pattern||X.allOf?.some((G)=>G.pattern)){if(!X.allOf)X.allOf=[];if(X.pattern)X.allOf.push({pattern:X.pattern}),delete X.pattern;X.allOf.push({pattern:dN(J,Y),...$&&Y.errorMessages&&{errorMessage:{pattern:$}}})}else X.pattern=dN(J,Y)}function dN(X,J){if(!J.applyRegexFlags||!X.flags)return X.source;let $={i:X.flags.includes("i"),m:X.flags.includes("m"),s:X.flags.includes("s")},Y=$.i?X.source.toLowerCase():X.source,G="",Q=!1,z=!1,Z=!1;for(let W=0;W<Y.length;W++){if(Q){G+=Y[W],Q=!1;continue}if($.i){if(z){if(Y[W].match(/[a-z]/)){if(Z)G+=Y[W],G+=`${Y[W-2]}-${Y[W]}`.toUpperCase(),Z=!1;else if(Y[W+1]==="-"&&Y[W+2]?.match(/[a-z]/))G+=Y[W],Z=!0;else G+=`${Y[W]}${Y[W].toUpperCase()}`;continue}}else if(Y[W].match(/[a-z]/)){G+=`[${Y[W]}${Y[W].toUpperCase()}]`;continue}}if($.m){if(Y[W]==="^"){G+=`(^|(?<=[\r
-]))`;continue}else if(Y[W]==="$"){G+=`($|(?=[\r
-]))`;continue}}if($.s&&Y[W]==="."){G+=z?`${Y[W]}\r
-`:`[${Y[W]}\r
-]`;continue}if(G+=Y[W],Y[W]==="\\")Q=!0;else if(z&&Y[W]==="]")z=!1;else if(!z&&Y[W]==="[")z=!0}try{new RegExp(G)}catch{return console.warn(`Could not convert regex pattern at ${J.currentPath.join("/")} to a flag-independent form! Falling back to the flag-ignorant source`),X.source}return G}function jq(X,J){let $={type:"object",additionalProperties:A0(X.valueType._def,{...J,currentPath:[...J.currentPath,"additionalProperties"]})??J.allowedAdditionalProperties};if(X.keyType?._def.typeName==="ZodString"&&X.keyType._def.checks?.length){let{type:Y,...G}=Kq(X.keyType._def,J);return{...$,propertyNames:G}}else if(X.keyType?._def.typeName==="ZodEnum")return{...$,propertyNames:{enum:X.keyType._def.values}};else if(X.keyType?._def.typeName==="ZodBranded"&&X.keyType._def.type._def.typeName==="ZodString"&&X.keyType._def.type._def.checks?.length){let{type:Y,...G}=Vq(X.keyType._def,J);return{...$,propertyNames:G}}return $}function SE(X,J){if(J.mapStrategy==="record")return jq(X,J);return{type:"array",maxItems:125,items:{type:"array",items:[A0(X.keyType._def,{...J,currentPath:[...J.currentPath,"items","items","0"]})||d6(),A0(X.valueType._def,{...J,currentPath:[...J.currentPath,"items","items","1"]})||d6()],minItems:2,maxItems:2}}}function IE(X){let J=X.values,$=Object.keys(X.values).filter((G)=>{return typeof J[J[G]]!=="number"}).map((G)=>J[G]),Y=Array.from(new Set($.map((G)=>typeof G)));return{type:Y.length===1?Y[0]==="string"?"string":"number":["string","number"],enum:$}}function bE(){return{not:d6()}}function kE(){return{type:"null"}}var GG={ZodString:"string",ZodNumber:"number",ZodBigInt:"integer",ZodBoolean:"boolean",ZodNull:"null"};function xE(X,J){let $=X.options instanceof Map?Array.from(X.options.values()):X.options;if($.every((Y)=>(Y._def.typeName in GG)&&(!Y._def.checks||!Y._def.checks.length))){let Y=$.reduce((G,Q)=>{let z=GG[Q._def.typeName];return z&&!G.includes(z)?[...G,z]:G},[]);return{type:Y.length>1?Y:Y[0]}}else if($.every((Y)=>Y._def.typeName==="ZodLiteral"&&!Y.description)){let Y=$.reduce((G,Q)=>{let z=typeof Q._def.value;switch(z){case"string":case"number":case"boolean":return[...G,z];case"bigint":return[...G,"integer"];case"object":if(Q._def.value===null)return[...G,"null"];default:return G}},[]);if(Y.length===$.length){let G=Y.filter((Q,z,Z)=>Z.indexOf(Q)===z);return{type:G.length>1?G:G[0],enum:$.reduce((Q,z)=>{return Q.includes(z._def.value)?Q:[...Q,z._def.value]},[])}}}else if($.every((Y)=>Y._def.typeName==="ZodEnum"))return{type:"string",enum:$.reduce((Y,G)=>[...Y,...G._def.values.filter((Q)=>!Y.includes(Q))],[])};return wE(X,J)}var wE=(X,J)=>{let $=(X.options instanceof Map?Array.from(X.options.values()):X.options).map((Y,G)=>A0(Y._def,{...J,currentPath:[...J.currentPath,"anyOf",`${G}`]})).filter((Y)=>!!Y&&(!J.strictUnions||typeof Y==="object"&&Object.keys(Y).length>0));return $.length?{anyOf:$}:void 0};function vE(X,J){if(["ZodString","ZodNumber","ZodBigInt","ZodBoolean","ZodNull"].includes(X.innerType._def.typeName)&&(!X.innerType._def.checks||!X.innerType._def.checks.length))return{type:[GG[X.innerType._def.typeName],"null"]};let $=A0(X.innerType._def,{...J,currentPath:[...J.currentPath,"anyOf","0"]});return $&&{anyOf:[$,{type:"null"}]}}function yE(X){let J={type:"number"};if(!X.checks)return J;for(let $ of X.checks)switch($.kind){case"int":J.type="integer";break;case"min":if($.inclusive)J.minimum=$.value;else J.exclusiveMinimum=$.value;break;case"max":if($.inclusive)J.maximum=$.value;else J.exclusiveMaximum=$.value;break;case"multipleOf":J.multipleOf=$.value}return J}function hE(X,J){let $={type:"object",properties:{}},Y=[],G=X.shape();for(let z in G){let Z=G[z];if(Z===void 0||Z._def===void 0)continue;let W=gE(Z),B=A0(Z._def,{...J,currentPath:[...J.currentPath,"properties",z],propertyPath:[...J.currentPath,"properties",z]});if(B===void 0)continue;if($.properties[z]=B,!W)Y.push(z)}if(Y.length)$.required=Y;let Q=fE(X,J);if(Q!==void 0)$.additionalProperties=Q;return $}function fE(X,J){if(X.catchall._def.typeName!=="ZodNever")return A0(X.catchall._def,{...J,currentPath:[...J.currentPath,"additionalProperties"]});switch(X.unknownKeys){case"passthrough":return J.allowedAdditionalProperties;case"strict":return J.rejectedAdditionalProperties;case"strip":return J.removeAdditionalStrategy==="strict"?J.allowedAdditionalProperties:J.rejectedAdditionalProperties}}function gE(X){try{return X.isOptional()}catch{return!0}}var mE=(X,J)=>{if(J.currentPath.toString()===J.propertyPath?.toString())return A0(X.innerType._def,J);let $=A0(X.innerType._def,{...J,currentPath:[...J.currentPath,"anyOf","1"]});return $?{anyOf:[{not:d6()},$]}:d6()},uE=(X,J)=>{if(J.pipeStrategy==="input")return A0(X.in._def,J);else if(J.pipeStrategy==="output")return A0(X.out._def,J);let $=A0(X.in._def,{...J,currentPath:[...J.currentPath,"allOf","0"]});return{allOf:[$,A0(X.out._def,{...J,currentPath:[...J.currentPath,"allOf",$?"1":"0"]})].filter((Y)=>Y!==void 0)}};function pE(X,J){return A0(X.type._def,J)}function cE(X,J){let $={type:"array",uniqueItems:!0,items:A0(X.valueType._def,{...J,currentPath:[...J.currentPath,"items"]})};if(X.minSize)$.minItems=X.minSize.value;if(X.maxSize)$.maxItems=X.maxSize.value;return $}function lE(X,J){if(X.rest)return{type:"array",minItems:X.items.length,items:X.items.map(($,Y)=>A0($._def,{...J,currentPath:[...J.currentPath,"items",`${Y}`]})).reduce(($,Y)=>Y===void 0?$:[...$,Y],[]),additionalItems:A0(X.rest._def,{...J,currentPath:[...J.currentPath,"additionalItems"]})};else return{type:"array",minItems:X.items.length,maxItems:X.items.length,items:X.items.map(($,Y)=>A0($._def,{...J,currentPath:[...J.currentPath,"items",`${Y}`]})).reduce(($,Y)=>Y===void 0?$:[...$,Y],[])}}function dE(){return{not:d6()}}function iE(){return d6()}var nE=(X,J)=>{return A0(X.innerType._def,J)},sE=(X,J,$)=>{switch(J){case"ZodString":return Kq(X,$);case"ZodNumber":return yE(X);case"ZodObject":return hE(X,$);case"ZodBigInt":return LE(X);case"ZodBoolean":return DE();case"ZodDate":return Uq(X,$);case"ZodUndefined":return dE();case"ZodNull":return kE();case"ZodArray":return qE(X,$);case"ZodUnion":case"ZodDiscriminatedUnion":return xE(X,$);case"ZodIntersection":return TE(X,$);case"ZodTuple":return lE(X,$);case"ZodRecord":return jq(X,$);case"ZodLiteral":return RE(X);case"ZodEnum":return _E(X);case"ZodNativeEnum":return IE(X);case"ZodNullable":return vE(X,$);case"ZodOptional":return mE(X,$);case"ZodMap":return SE(X,$);case"ZodSet":return cE(X,$);case"ZodLazy":return()=>X.getter()._def;case"ZodPromise":return pE(X,$);case"ZodNaN":case"ZodNever":return bE();case"ZodEffects":return ME(X,$);case"ZodAny":return d6();case"ZodUnknown":return iE();case"ZodDefault":return OE(X,$);case"ZodBranded":return Vq(X,$);case"ZodReadonly":return nE(X,$);case"ZodCatch":return FE(X,$);case"ZodPipeline":return uE(X,$);case"ZodFunction":case"ZodVoid":case"ZodSymbol":return;default:return((Y)=>{return})(J)}},aE=(X,J)=>{let $=0;for(;$<X.length&&$<J.length;$++)if(X[$]!==J[$])break;return[(X.length-$).toString(),...J.slice($)].join("/")};function A0(X,J,$=!1){let Y=J.seen.get(X);if(J.override){let Z=J.override?.(X,J,Y,$);if(Z!==jE)return Z}if(Y&&!$){let Z=oE(Y,J);if(Z!==void 0)return Z}let G={def:X,path:J.currentPath,jsonSchema:void 0};J.seen.set(X,G);let Q=sE(X,X.typeName,J),z=typeof Q==="function"?A0(Q(),J):Q;if(z)rE(X,J,z);if(J.postProcess){let Z=J.postProcess(z,X,J);return G.jsonSchema=z,Z}return G.jsonSchema=z,z}var oE=(X,J)=>{switch(J.$refStrategy){case"root":return{$ref:X.path.join("/")};case"relative":return{$ref:aE(J.currentPath,X.path)};case"none":case"seen":if(X.path.length<J.currentPath.length&&X.path.every(($,Y)=>J.currentPath[Y]===$))return console.warn(`Recursive reference detected at ${J.currentPath.join("/")}! Defaulting to any`),d6();return J.$refStrategy==="seen"?d6():void 0}},rE=(X,J,$)=>{if(X.description)$.description=X.description;return $},tE=(X)=>{let J=NE(X),$=J.name!==void 0?[...J.basePath,J.definitionPath,J.name]:J.basePath;return{...J,currentPath:$,propertyPath:void 0,seen:new Map(Object.entries(J.definitions).map(([Y,G])=>[G._def,{def:G._def,path:[...J.basePath,J.definitionPath,Y],jsonSchema:void 0}]))}},eE=(X,J)=>{let $=tE(J),Y=typeof J==="object"&&J.definitions?Object.entries(J.definitions).reduce((W,[B,H])=>({...W,[B]:A0(H._def,{...$,currentPath:[...$.basePath,$.definitionPath,B]},!0)??d6()}),{}):void 0,G=typeof J==="string"?J:J?.nameStrategy==="title"?void 0:J?.name,Q=A0(X._def,G===void 0?$:{...$,currentPath:[...$.basePath,$.definitionPath,G]},!1)??d6(),z=typeof J==="object"&&J.name!==void 0&&J.nameStrategy==="title"?J.name:void 0;if(z!==void 0)Q.title=z;let Z=G===void 0?Y?{...Q,[$.definitionPath]:Y}:Q:{$ref:[...$.$refStrategy==="relative"?[]:$.basePath,$.definitionPath,G].join("/"),[$.definitionPath]:{...Y,[G]:Q}};return Z.$schema="http://json-schema.org/draft-07/schema#",Z},XS=Symbol.for("vercel.ai.schema");function WG(X){let J;return()=>{if(J==null)J=X();return J}}function SX(X,{validate:J}={}){return{[XS]:!0,_type:void 0,get jsonSchema(){if(typeof X==="function")X=X();return X},validate:J}}function JS(X,J){let $=J?.useReferences??!1;return SX(()=>eE(X,{$refStrategy:$?"root":"none"}),{validate:async(Y)=>{let G=await X.safeParseAsync(Y);return G.success?{success:!0,value:G.data}:{success:!1,error:G.error}}})}function $S(X,J){let $=J?.useReferences??!1;return SX(()=>Hq(YN(X,{target:"draft-7",io:"input",reused:$?"ref":"inline"})),{validate:async(Y)=>{let G=await RX(X,Y);return G.success?{success:!0,value:G.data}:{success:!1,error:G.error}}})}function YS(X){return"_zod"in X}function IX(X,J){if(YS(X))return $S(X,J);else return JS(X,J)}var GS="AI_SerializationError",gl=`vercel.ai.error.${GS}`;var VS="AI_InvalidArgumentError",Pd=`vercel.ai.error.${VS}`;var US="AI_InvalidStreamPartError",Od=`vercel.ai.error.${US}`;var KS="AI_InvalidToolApprovalError",Md=`vercel.ai.error.${KS}`;var jS="AI_InvalidToolApprovalSignatureError",_d=`vercel.ai.error.${jS}`;var NS="AI_InvalidToolInputError",Ad=`vercel.ai.error.${NS}`;var qS="AI_ToolCallNotFoundForApprovalError",Td=`vercel.ai.error.${qS}`;var LS="AI_MissingToolResultsError",Rd=`vercel.ai.error.${LS}`;var DS="AI_NoImageGeneratedError",Cd=`vercel.ai.error.${DS}`;var FS="AI_NoObjectGeneratedError",Ed=`vercel.ai.error.${FS}`;var PS="AI_NoOutputGeneratedError",Sd=`vercel.ai.error.${PS}`;var OS="AI_NoSpeechGeneratedError",Id=`vercel.ai.error.${OS}`;var MS="AI_NoTranscriptGeneratedError",bd=`vercel.ai.error.${MS}`;var _S="AI_NoTranslationGeneratedError",kd=`vercel.ai.error.${_S}`;var AS="AI_NoVideoGeneratedError",xd=`vercel.ai.error.${AS}`;var TS="AI_NoSuchToolError",wd=`vercel.ai.error.${TS}`;var RS="AI_StreamProviderError",vd=`vercel.ai.error.${RS}`;var CS="AI_ToolCallRepairError",yd=`vercel.ai.error.${CS}`;var ES="AI_ToolChoiceViolationError",hd=`vercel.ai.error.${ES}`;var SS="AI_UIMessageStreamError",fd=`vercel.ai.error.${SS}`;var IS="AI_InvalidDataContentError",gd=`vercel.ai.error.${IS}`;var bS="AI_InvalidMessageRoleError",md=`vercel.ai.error.${bS}`;var kS="AI_MessageConversionError",ud=`vercel.ai.error.${kS}`;var xS="AI_RetryError",pd=`vercel.ai.error.${xS}`;var wS="7.0.127",vS=async({url:X,maxBytes:J,abortSignal:$})=>{let Y=X.toString();try{let G=Xq({},`ai-sdk/${wS}`,tN()),Q=await zq({url:Y,headers:G,abortSignal:$});if(!Q.ok)throw await EX(Q),new q6({url:Y,statusCode:Q.status,statusText:Q.statusText});return{data:await Zq({response:Q,url:Y,maxBytes:J??ZG}),mediaType:Q.headers.get("content-type")??void 0}}catch(G){if(q6.isInstance(G))throw G;throw new q6({url:Y,cause:G})}};var V={array:rY,boolean:SN,custom:uN,discriminatedUnion:vN,enum:eY,instanceof:pN,lazy:mN,literal:hN,looseObject:xN,never:oY,null:IN,number:EN,object:kN,record:yN,string:RN,union:tY,unknown:n3},R1=V.lazy(()=>V.union([V.null(),V.string(),V.number(),V.boolean(),V.record(V.string(),R1.optional()),V.array(R1)])),g=V.record(V.string(),V.record(V.string(),R1.optional())),a3=V.union([V.string(),V.instanceof(Uint8Array),V.instanceof(ArrayBuffer),V.custom(Bq,{message:"Must be a Buffer"})]),BG=V.record(V.string(),V.string()),Nq=V.object({type:V.literal("text"),text:V.string(),providerOptions:g.optional()}),yS=V.object({type:V.literal("image"),image:V.union([a3,V.instanceof(URL),BG]),mediaType:V.string().optional(),providerOptions:g.optional()}),qq=V.discriminatedUnion("type",[V.object({type:V.literal("data"),data:a3}),V.object({type:V.literal("url"),url:V.instanceof(URL)}),V.object({type:V.literal("reference"),reference:BG}),V.object({type:V.literal("text"),text:V.string()})]),hS=V.discriminatedUnion("type",[V.object({type:V.literal("data"),data:a3}),V.object({type:V.literal("url"),url:V.instanceof(URL)})]),Lq=V.object({type:V.literal("file"),data:V.union([qq,a3,V.instanceof(URL),BG]),filename:V.string().optional(),mediaType:V.string(),providerOptions:g.optional()}),fS=V.object({type:V.literal("reasoning"),text:V.string(),providerOptions:g.optional()}),gS=V.object({type:V.literal("custom"),kind:V.string().transform((X)=>X),providerOptions:g.optional()}),mS=V.object({type:V.literal("reasoning-file"),data:V.union([hS,a3,V.instanceof(URL)]),mediaType:V.string(),providerOptions:g.optional()}),uS=V.object({type:V.literal("tool-call"),toolCallId:V.string(),toolName:V.string(),input:V.unknown(),providerOptions:g.optional(),providerExecuted:V.boolean().optional()}),pS=V.discriminatedUnion("type",[V.object({type:V.literal("text"),value:V.string(),providerOptions:g.optional()}),V.object({type:V.literal("json"),value:R1,providerOptions:g.optional()}),V.object({type:V.literal("execution-denied"),reason:V.string().optional(),providerOptions:g.optional()}),V.object({type:V.literal("error-text"),value:V.string(),providerOptions:g.optional()}),V.object({type:V.literal("error-json"),value:R1,providerOptions:g.optional()}),V.object({type:V.literal("content"),value:V.array(V.union([V.object({type:V.literal("text"),text:V.string(),providerOptions:g.optional()}),V.object({type:V.literal("file"),data:qq,mediaType:V.string(),filename:V.string().optional(),providerOptions:g.optional()}),V.object({type:V.literal("file-data"),data:V.string(),mediaType:V.string(),filename:V.string().optional(),providerOptions:g.optional()}),V.object({type:V.literal("file-url"),url:V.string(),mediaType:V.string().optional(),providerOptions:g.optional()}),V.object({type:V.literal("file-id"),fileId:V.union([V.string(),V.record(V.string(),V.string())]),providerOptions:g.optional()}),V.object({type:V.literal("file-reference"),providerReference:V.record(V.string(),V.string()),providerOptions:g.optional()}),V.object({type:V.literal("image-data"),data:V.string(),mediaType:V.string(),providerOptions:g.optional()}),V.object({type:V.literal("image-url"),url:V.string(),providerOptions:g.optional()}),V.object({type:V.literal("image-file-id"),fileId:V.union([V.string(),V.record(V.string(),V.string())]),providerOptions:g.optional()}),V.object({type:V.literal("image-file-reference"),providerReference:V.record(V.string(),V.string()),providerOptions:g.optional()}),V.object({type:V.literal("custom"),providerOptions:g.optional()})]))})]),Dq=V.object({type:V.literal("tool-result"),toolCallId:V.string(),toolName:V.string(),output:pS,providerOptions:g.optional()}),cS=V.object({type:V.literal("tool-approval-request"),approvalId:V.string(),toolCallId:V.string(),reason:V.string().optional(),isAutomatic:V.boolean().optional(),signature:V.string().optional(),inputSchemaInput:V.unknown().optional()}),lS=V.object({type:V.literal("tool-approval-response"),approvalId:V.string(),approved:V.boolean(),reason:V.string().optional()}),dS=V.object({role:V.literal("system"),content:V.string(),providerOptions:g.optional()}),iS=V.object({role:V.literal("user"),content:V.union([V.string(),V.array(V.union([Nq,yS,Lq]))]),providerOptions:g.optional()}),nS=V.object({role:V.literal("assistant"),content:V.union([V.string(),V.array(V.union([Nq,gS,Lq,fS,mS,uS,Dq,cS]))]),providerOptions:g.optional()}),sS=V.object({role:V.literal("tool"),content:V.array(V.union([Dq,lS])),providerOptions:g.optional()}),cd=V.union([dS,iS,nS,sS]);var ld=Symbol("ai-sdk-tool-call-input-schema-input");var dd=J6({prefix:"aitxt",size:24}),id=J6({prefix:"call",size:24});var nd=class extends TransformStream{constructor(){super({transform(X,J){J.enqueue(`data: ${JSON.stringify(X)}
-
-`)},flush(X){X.enqueue(`data: [DONE]
-
-`)}})}};var s3=V.record(V.string(),R1.optional()),sd=WG(()=>IX(V.union([V.looseObject({type:V.literal("text-start"),id:V.string(),providerMetadata:g.optional()}),V.looseObject({type:V.literal("text-delta"),id:V.string(),delta:V.string(),providerMetadata:g.optional()}),V.looseObject({type:V.literal("text-end"),id:V.string(),providerMetadata:g.optional()}),V.looseObject({type:V.literal("error"),errorText:V.string()}),V.looseObject({type:V.literal("tool-input-start"),toolCallId:V.string(),toolName:V.string(),providerExecuted:V.boolean().optional(),providerMetadata:g.optional(),toolMetadata:s3.optional(),dynamic:V.boolean().optional(),title:V.string().optional()}),V.looseObject({type:V.literal("tool-input-delta"),toolCallId:V.string(),inputTextDelta:V.string()}),V.looseObject({type:V.literal("tool-input-available"),toolCallId:V.string(),toolName:V.string(),input:V.unknown(),providerExecuted:V.boolean().optional(),providerMetadata:g.optional(),toolMetadata:s3.optional(),dynamic:V.boolean().optional(),title:V.string().optional()}),V.looseObject({type:V.literal("tool-input-error"),toolCallId:V.string(),toolName:V.string(),input:V.unknown(),providerExecuted:V.boolean().optional(),providerMetadata:g.optional(),toolMetadata:s3.optional(),dynamic:V.boolean().optional(),errorText:V.string(),title:V.string().optional()}),V.looseObject({type:V.literal("tool-approval-request"),approvalId:V.string(),toolCallId:V.string(),approvalDescriptor:V.unknown().optional(),inputSchemaInput:V.unknown().optional(),reason:V.string().optional(),isAutomatic:V.boolean().optional(),signature:V.string().optional()}),V.looseObject({type:V.literal("tool-approval-response"),approvalId:V.string(),approved:V.boolean(),reason:V.string().optional(),providerExecuted:V.boolean().optional(),providerMetadata:g.optional()}),V.looseObject({type:V.literal("tool-output-available"),toolCallId:V.string(),output:V.unknown(),providerExecuted:V.boolean().optional(),providerMetadata:g.optional(),toolMetadata:s3.optional(),dynamic:V.boolean().optional(),preliminary:V.boolean().optional()}),V.looseObject({type:V.literal("tool-output-error"),toolCallId:V.string(),errorText:V.string(),providerExecuted:V.boolean().optional(),providerMetadata:g.optional(),toolMetadata:s3.optional(),dynamic:V.boolean().optional()}),V.looseObject({type:V.literal("tool-output-denied"),toolCallId:V.string()}),V.looseObject({type:V.literal("reasoning-start"),id:V.string(),providerMetadata:g.optional()}),V.looseObject({type:V.literal("reasoning-delta"),id:V.string(),delta:V.string(),providerMetadata:g.optional()}),V.looseObject({type:V.literal("reasoning-end"),id:V.string(),providerMetadata:g.optional()}),V.looseObject({type:V.literal("custom"),kind:V.string().transform((X)=>X),providerMetadata:g.optional()}),V.looseObject({type:V.literal("source-url"),sourceId:V.string(),url:V.string(),title:V.string().optional(),providerMetadata:g.optional()}),V.looseObject({type:V.literal("source-document"),sourceId:V.string(),mediaType:V.string(),title:V.string(),filename:V.string().optional(),providerMetadata:g.optional()}),V.looseObject({type:V.literal("file"),url:V.string(),mediaType:V.string(),providerMetadata:g.optional()}),V.looseObject({type:V.literal("reasoning-file"),url:V.string(),mediaType:V.string(),providerMetadata:g.optional()}),V.looseObject({type:V.custom((X)=>typeof X==="string"&&X.startsWith("data-"),{message:'Type must start with "data-"'}),id:V.string().optional(),data:V.unknown(),transient:V.boolean().optional()}),V.looseObject({type:V.literal("start-step")}),V.looseObject({type:V.literal("finish-step")}),V.looseObject({type:V.literal("reset-step")}),V.looseObject({type:V.literal("start"),messageId:V.string().optional(),messageMetadata:V.unknown().optional()}),V.looseObject({type:V.literal("finish"),finishReason:V.enum(["stop","length","content-filter","tool-calls","error","other"]).optional(),messageMetadata:V.unknown().optional()}),V.looseObject({type:V.literal("abort"),reason:V.string().optional()}),V.looseObject({type:V.literal("message-metadata"),messageMetadata:V.unknown()})])));var ad=Symbol("streamRetryAttemptBoundary");var od=J6({prefix:"aitxt",size:24}),rd=J6({prefix:"call",size:24});var td=J6({prefix:"aitxt",size:24}),ed=J6({prefix:"call",size:24});var Xi=Symbol("streamRetryBoundary");var v6=V.record(V.string(),R1.optional()),aS=V.record(V.string(),V.string());var Ji=WG(()=>{let X=V.object({id:V.string(),approved:V.never().optional(),descriptor:V.unknown().optional(),requestReason:V.string().optional(),reason:V.never().optional(),isAutomatic:V.boolean().optional(),signature:V.string().optional(),inputSchemaInput:V.unknown().optional()}),J=X.extend({approved:V.boolean(),reason:V.string().optional()}),$=J.extend({approved:V.literal(!0)}),Y=J.extend({approved:V.literal(!1)});return IX(V.array(V.object({id:V.string(),role:V.enum(["system","user","assistant"]),metadata:V.unknown().optional(),parts:V.array(V.union([V.object({type:V.literal("text"),text:V.string(),state:V.enum(["streaming","done"]).optional(),providerMetadata:g.optional()}),V.object({type:V.literal("reasoning"),id:V.string().optional(),text:V.string(),state:V.enum(["streaming","done"]).optional(),providerMetadata:g.optional()}),V.object({type:V.literal("custom"),kind:V.string(),providerMetadata:g.optional()}),V.object({type:V.literal("source-url"),sourceId:V.string(),url:V.string(),title:V.string().optional(),providerMetadata:g.optional()}),V.object({type:V.literal("source-document"),sourceId:V.string(),mediaType:V.string(),title:V.string(),filename:V.string().optional(),providerMetadata:g.optional()}),V.object({type:V.literal("file"),mediaType:V.string(),filename:V.string().optional(),url:V.string(),providerReference:aS.optional(),providerMetadata:g.optional()}),V.object({type:V.literal("reasoning-file"),mediaType:V.string(),url:V.string(),providerMetadata:g.optional()}),V.object({type:V.literal("step-start")}),V.object({type:V.string().startsWith("data-"),id:V.string().optional(),data:V.unknown()}),V.object({type:V.literal("dynamic-tool"),toolName:V.string(),toolCallId:V.string(),title:V.string().optional(),toolMetadata:v6.optional(),state:V.literal("input-streaming"),input:V.unknown().optional(),rawInput:V.string().optional(),providerExecuted:V.boolean().optional(),callProviderMetadata:g.optional(),output:V.never().optional(),errorText:V.never().optional(),approval:V.never().optional()}),V.object({type:V.literal("dynamic-tool"),toolName:V.string(),toolCallId:V.string(),title:V.string().optional(),toolMetadata:v6.optional(),state:V.literal("input-available"),input:V.unknown(),providerExecuted:V.boolean().optional(),output:V.never().optional(),errorText:V.never().optional(),callProviderMetadata:g.optional(),approval:V.never().optional()}),V.object({type:V.literal("dynamic-tool"),toolName:V.string(),toolCallId:V.string(),title:V.string().optional(),toolMetadata:v6.optional(),state:V.literal("approval-requested"),input:V.unknown(),providerExecuted:V.boolean().optional(),output:V.never().optional(),errorText:V.never().optional(),callProviderMetadata:g.optional(),approval:X}),V.object({type:V.literal("dynamic-tool"),toolName:V.string(),toolCallId:V.string(),title:V.string().optional(),toolMetadata:v6.optional(),state:V.literal("approval-responded"),input:V.unknown(),providerExecuted:V.boolean().optional(),output:V.never().optional(),errorText:V.never().optional(),callProviderMetadata:g.optional(),approval:J}),V.object({type:V.literal("dynamic-tool"),toolName:V.string(),toolCallId:V.string(),title:V.string().optional(),toolMetadata:v6.optional(),state:V.literal("output-available"),input:V.unknown(),providerExecuted:V.boolean().optional(),output:V.unknown(),errorText:V.never().optional(),callProviderMetadata:g.optional(),resultProviderMetadata:g.optional(),preliminary:V.boolean().optional(),approval:$.optional()}),V.object({type:V.literal("dynamic-tool"),toolName:V.string(),toolCallId:V.string(),title:V.string().optional(),toolMetadata:v6.optional(),state:V.literal("output-error"),input:V.unknown().optional(),rawInput:V.unknown().optional(),providerExecuted:V.boolean().optional(),output:V.never().optional(),errorText:V.string(),callProviderMetadata:g.optional(),resultProviderMetadata:g.optional(),approval:$.optional()}),V.object({type:V.literal("dynamic-tool"),toolName:V.string(),toolCallId:V.string(),title:V.string().optional(),toolMetadata:v6.optional(),state:V.literal("output-denied"),input:V.unknown(),providerExecuted:V.boolean().optional(),output:V.never().optional(),errorText:V.never().optional(),callProviderMetadata:g.optional(),approval:Y}),V.object({type:V.string().startsWith("tool-"),toolCallId:V.string(),title:V.string().optional(),toolMetadata:v6.optional(),state:V.literal("input-streaming"),providerExecuted:V.boolean().optional(),callProviderMetadata:g.optional(),input:V.unknown().optional(),rawInput:V.string().optional(),output:V.never().optional(),errorText:V.never().optional(),approval:V.never().optional()}),V.object({type:V.string().startsWith("tool-"),toolCallId:V.string(),title:V.string().optional(),toolMetadata:v6.optional(),state:V.literal("input-available"),providerExecuted:V.boolean().optional(),input:V.unknown(),output:V.never().optional(),errorText:V.never().optional(),callProviderMetadata:g.optional(),approval:V.never().optional()}),V.object({type:V.string().startsWith("tool-"),toolCallId:V.string(),title:V.string().optional(),toolMetadata:v6.optional(),state:V.literal("approval-requested"),input:V.unknown(),providerExecuted:V.boolean().optional(),output:V.never().optional(),errorText:V.never().optional(),callProviderMetadata:g.optional(),approval:X}),V.object({type:V.string().startsWith("tool-"),toolCallId:V.string(),title:V.string().optional(),toolMetadata:v6.optional(),state:V.literal("approval-responded"),input:V.unknown(),providerExecuted:V.boolean().optional(),output:V.never().optional(),errorText:V.never().optional(),callProviderMetadata:g.optional(),approval:J}),V.object({type:V.string().startsWith("tool-"),toolCallId:V.string(),title:V.string().optional(),toolMetadata:v6.optional(),state:V.literal("output-available"),providerExecuted:V.boolean().optional(),input:V.unknown(),output:V.unknown(),errorText:V.never().optional(),callProviderMetadata:g.optional(),resultProviderMetadata:g.optional(),preliminary:V.boolean().optional(),approval:$.optional()}),V.object({type:V.string().startsWith("tool-"),toolCallId:V.string(),title:V.string().optional(),toolMetadata:v6.optional(),state:V.literal("output-error"),providerExecuted:V.boolean().optional(),input:V.unknown().optional(),rawInput:V.unknown().optional(),output:V.never().optional(),errorText:V.string(),callProviderMetadata:g.optional(),resultProviderMetadata:g.optional(),approval:$.optional()}),V.object({type:V.string().startsWith("tool-"),toolCallId:V.string(),title:V.string().optional(),toolMetadata:v6.optional(),state:V.literal("output-denied"),providerExecuted:V.boolean().optional(),input:V.unknown(),output:V.never().optional(),errorText:V.never().optional(),callProviderMetadata:g.optional(),approval:Y})]))}).superRefine((G,Q)=>{if(G.role!=="assistant"&&G.parts.length===0)Q.addIssue({origin:"array",code:"too_small",minimum:1,inclusive:!0,input:G.parts,path:["parts"],message:"Message must contain at least one part"})})).nonempty("Messages array must not be empty"))});var $i=J6({prefix:"call",size:24});var Yi=J6({prefix:"call",size:24});var Gi=J6({prefix:"call",size:24});var Qi=J6({prefix:"aiobj",size:24});function Fq(X){return({url:J,abortSignal:$})=>vS({url:J,maxBytes:X?.maxBytes,abortSignal:$})}var zi=J6({prefix:"aiobj",size:24});var Zi=J6({prefix:"call",size:24});var Wi=Fq();var Bi=V.object({token:V.string().refine((X)=>X.trim().length>0),url:V.string().refine((X)=>{try{let J=new URL(X);return(J.protocol==="ws:"||J.protocol==="wss:")&&J.hostname!==""}catch{return!1}}),expiresAt:V.number().positive().max(Number.MAX_SAFE_INTEGER).optional(),tools:V.array(V.object({type:V.literal("function"),name:V.string().min(1),description:V.string().optional(),parameters:V.record(V.string(),V.unknown())})).optional()});var oS="AI_NoSuchProviderError",Hi=`vercel.ai.error.${oS}`;var Vi=J6({prefix:"call",size:24});var Ui=J6({prefix:"call",size:24}),Ki=Fq();var ji=J6({prefix:"call",size:24});class y6 extends M1{name="ProviderResponseStreamError";constructor(X,J){super({message:X,url:"",requestBodyValues:void 0,cause:J?.cause,isRetryable:J?.retryable??!0})}}var L6={};MY(L6,{toWebSocketUrl:()=>jI,streamResponsesWebSocket:()=>FI,parseRateLimitSignal:()=>r3,normalizeHeaders:()=>NI,markOversizedFrame:()=>Iq,isUpgradeFailure:()=>qI,isOversizedFrame:()=>LI,isNonEmittingFrame:()=>kq,isAbortError:()=>jG,connectResponsesWebSocket:()=>DI,TERMINAL_AFTER_OUTPUT_MESSAGE:()=>KG,PROTOCOL_HEADER:()=>Cq,OpenAIWebSocket:()=>L6,OVERSIZED_FRAME_MESSAGE:()=>xq});function o3(X){let J=Number(X.match(/^HTTP\/\d(?:\.\d)?\s+(\d{3})/)?.[1]);return Number.isFinite(J)?J:void 0}function bX(X,J,$=!1){let G=Buffer.from(X.slice(0,J)).toString("latin1").split(`\r
-`),Q=G[0]??"",z=o3(Q);if(z===void 0||z===101)return;let Z=Object.fromEntries(G.slice(1).flatMap((N)=>{let K=N.indexOf(":");return K===-1?[]:[[N.slice(0,K).trim().toLowerCase(),N.slice(K+1).trim()]]})),W=X.slice(J+4),B=Z["content-length"],H=Number(B);if(!$&&(B===void 0||Number.isFinite(H)&&W.length<H))return;let U=Buffer.from(W).toString("utf8"),j=(()=>{try{let N=JSON.parse(U);return s(N)?N:void 0}catch{return}})();return{message:`WS upgrade failed: ${Q}`,status:z,status_code:z,headers:Z,body:U,...s(j?.error)?{error:j.error}:{}}}var rS="258EAFA5-E914-47DA-95CA-C5AB0DC85B11",Pq=["chatgpt-account-id","authorization","user-agent","originator","openai-beta","version","x-codex-beta-features","x-codex-turn-metadata","x-client-request-id","session-id","thread-id","x-codex-window-id"];class HG{url;readyState=0;socket;sessionID;listeners={open:new Set,message:new Set,error:new Set,close:new Set};rxBuffer=new Uint8Array(0);handshakeDone=!1;upgradeFailureEmitted=!1;expectedAccept="";fragOpcode=0;fragChunks=[];writeQueue=[];constructor(X,J,$){this.url=X,this.sessionID=$?.sessionID,this.connect(X,J)}addEventListener(X,J,$){this.listeners[X]?.add(J)}removeEventListener(X,J){this.listeners[X]?.delete(J)}peerClose;closeEmitted=!1;emitClose(X,J){if(this.closeEmitted)return;this.closeEmitted=!0,this.emit("close",{code:X,reason:J})}emit(X,J){for(let $ of[...this.listeners[X]??[]])try{$(J)}catch{}}async connect(X,J){let $=new URL(X.replace(/^ws:/,"http:").replace(/^wss:/,"https:")),Y=$.hostname,G=$.port?Number($.port):$.protocol==="https:"?443:80,Q=`${$.pathname}${$.search}`,z=crypto.getRandomValues(new Uint8Array(16)),Z=Buffer.from(z).toString("base64"),W=await crypto.subtle.digest("SHA-1",new TextEncoder().encode(Z+rS));this.expectedAccept=Buffer.from(new Uint8Array(W)).toString("base64");let B={};for(let[j,N]of Object.entries(J))B[j.toLowerCase()]=N;let H=[`GET ${Q} HTTP/1.1`,`Host: ${Y}`,"Connection: Upgrade","Upgrade: websocket","Sec-WebSocket-Version: 13",`Sec-WebSocket-Key: ${Z}`];for(let j of Pq)if(B[j]!==void 0)H.push(`${tS(j)}: ${B[j]}`);for(let[j,N]of Object.entries(J))if(!Pq.includes(j.toLowerCase())&&j.toLowerCase()!=="content-length")H.push(`${j}: ${N}`);let U=`${H.join(`\r
-`)}\r
-\r
-`;try{this.log("connect_start",{host:Y,port:G,tls:$.protocol==="https:"});let j=globalThis.Bun?.connect;if(!j)throw Error("Bun.connect is not available");this.socket=await j({hostname:Y,port:G,tls:$.protocol==="https:"?{serverName:Y}:void 0,socket:{open:(N)=>{this.socket=N,this.enqueueWrite(new TextEncoder().encode(U))},data:(N,K)=>this.onData(K),drain:()=>this.flushWrites(),error:(N,K)=>{if(this.emitRejectedUpgrade(!0))return;this.readyState=3;let q=K instanceof Error?K.message:String(K);this.log("socket_error",{message:q}),this.emit("error",{message:q})},close:()=>{if(this.emitRejectedUpgrade(!0))return;this.readyState=3,this.log("socket_close"),this.emitClose(this.peerClose?.code??1006,this.peerClose?.reason??"socket closed")}}})}catch(j){this.readyState=3;let N=j instanceof Error?j.message:String(j);this.log("connect_exception",{message:N}),this.emit("error",{message:N})}}onData(X){if(this.rxBuffer=eS(this.rxBuffer,X),!this.handshakeDone){let J=Buffer.from(this.rxBuffer).toString("latin1"),$=J.indexOf(`\r
-\r
-`);if($===-1)return;let Y=J.slice(0,$),G=Y.split(`\r
-`)[0]??"",Q=Y.match(/sec-websocket-accept:\s*(\S+)/i),z=o3(G);if(z!==101){if(z===void 0){this.readyState=3;try{this.socket?.end()}catch{}this.log("upgrade_failed",{statusLine:G}),this.emit("error",{message:`WS upgrade failed: ${G}`});return}if(!this.emitRejectedUpgrade())return;try{this.socket?.end()}catch{}return}if(!Q||Q[1]!==this.expectedAccept){this.readyState=3;try{this.socket?.end()}catch{}this.log("accept_mismatch",{statusLine:G}),this.emit("error",{message:"WS upgrade Sec-WebSocket-Accept mismatch"});return}this.handshakeDone=!0,this.readyState=1,this.rxBuffer=this.rxBuffer.slice($+4),this.log("open",{statusLine:G}),this.emit("open",{})}this.drainFrames()}emitRejectedUpgrade(X=!1){if(this.upgradeFailureEmitted)return!0;if(this.handshakeDone)return!1;let J=Buffer.from(this.rxBuffer).indexOf(`\r
-\r
-`);if(J===-1)return!1;let $=bX(this.rxBuffer,J,X);if(!$)return!1;return this.upgradeFailureEmitted=!0,this.readyState=3,this.log("upgrade_failed",{status:$.status,partial:X}),this.emit("error",$),!0}drainFrames(){for(;;){let X=this.rxBuffer;if(X.length<2)return;let J=X[0],$=X[1],Y=(J&128)!==0,G=J&15,Q=($&128)!==0,z=$&127,Z=2;if(z===126){if(X.length<4)return;z=X[2]<<8|X[3],Z=4}else if(z===127){if(X.length<10)return;z=0;for(let B=0;B<8;B++)z=z*256+X[2+B];Z=10}if(Q)Z+=4;if(X.length<Z+z)return;let W=X.slice(Z,Z+z);this.rxBuffer=X.slice(Z+z),this.handleFrame(Y,G,W)}}handleFrame(X,J,$){if(J===9){this.writeFrame(10,$);return}if(J===10)return;if(J===8){let G=1005,Q="";if($.length>=2)G=$[0]<<8|$[1],Q=Buffer.from($.slice(2)).toString("utf-8");this.readyState=3,this.peerClose={code:G,reason:Q};try{this.socket?.end()}catch{}this.log("close_frame",{code:G,reason:Q}),this.emitClose(G,Q);return}if(J===1||J===2)this.fragOpcode=J,this.fragChunks=[$];else if(J===0)this.fragChunks.push($);if(!X)return;let Y=XI(this.fragChunks);if(this.fragChunks=[],this.fragOpcode===1){let G=Buffer.from(Y).toString("utf-8");this.emit("message",{data:G})}}send(X){if(this.readyState!==1)return;this.writeFrame(1,new TextEncoder().encode(X))}writeFrame(X,J){let $=J.length,Y=crypto.getRandomValues(new Uint8Array(4)),G;if($<126)G=[128|X,128|$];else if($<65536)G=[128|X,254,$>>8&255,$&255];else{G=[128|X,255];for(let Z=7;Z>=0;Z--)G.push($/2**(8*Z)&255)}let Q=new Uint8Array($);for(let Z=0;Z<$;Z++)Q[Z]=J[Z]^Y[Z%4];let z=new Uint8Array(G.length+4+$);z.set(G,0),z.set(Y,G.length),z.set(Q,G.length+4);try{this.enqueueWrite(z)}catch{}}enqueueWrite(X){this.writeQueue.push(X),this.flushWrites()}flushWrites(){let X=this.socket;if(!X)return;while(this.writeQueue.length>0){let J=this.writeQueue[0],$=X.write(J);if($<J.length){this.writeQueue[0]=J.slice($),this.log("write_backpressure",{written:$,remaining:J.length-$});return}this.writeQueue.shift()}}close(){if(this.readyState===3)return;this.readyState=2;try{this.writeFrame(8,new Uint8Array([3,232])),this.socket?.end()}catch{}this.readyState=3}log(X,J){return F1({component:"raw-ws-bun",event:X,sessionID:this.sessionID,url:this.url,...J})}}function tS(X){return X}function eS(X,J){let $=new Uint8Array(X.length+J.length);return $.set(X,0),$.set(J,X.length),$}function XI(X){let J=0;for(let G of X)J+=G.length;let $=new Uint8Array(J),Y=0;for(let G of X)$.set(G,Y),Y+=G.length;return $}import{connect as JI}from"node:net";import{connect as $I}from"node:tls";var YI="258EAFA5-E914-47DA-95CA-C5AB0DC85B11",Oq=["chatgpt-account-id","authorization","user-agent","originator","openai-beta","version","x-codex-beta-features","x-codex-turn-metadata","x-client-request-id","session-id","thread-id","x-codex-window-id"];class VG{url;readyState=0;socket;sessionID;listeners={open:new Set,message:new Set,error:new Set,close:new Set};rxBuffer=new Uint8Array(0);handshakeDone=!1;upgradeFailureEmitted=!1;expectedAccept="";fragOpcode=0;fragChunks=[];constructor(X,J,$){this.url=X,this.sessionID=$?.sessionID,this.connect(X,J)}addEventListener(X,J,$){this.listeners[X]?.add(J)}removeEventListener(X,J){this.listeners[X]?.delete(J)}peerClose;closeEmitted=!1;emitClose(X,J){if(this.closeEmitted)return;this.closeEmitted=!0,this.emit("close",{code:X,reason:J})}emit(X,J){for(let $ of[...this.listeners[X]??[]])try{$(J)}catch{}}async connect(X,J){let $=new URL(X.replace(/^ws:/,"http:").replace(/^wss:/,"https:")),Y=$.hostname,G=$.port?Number($.port):$.protocol==="https:"?443:80,Q=`${$.pathname}${$.search}`,z=crypto.getRandomValues(new Uint8Array(16)),Z=Buffer.from(z).toString("base64"),W=await crypto.subtle.digest("SHA-1",new TextEncoder().encode(Z+YI));this.expectedAccept=Buffer.from(new Uint8Array(W)).toString("base64");let B={};for(let[j,N]of Object.entries(J))B[j.toLowerCase()]=N;let H=[`GET ${Q} HTTP/1.1`,`Host: ${Y}`,"Connection: Upgrade","Upgrade: websocket","Sec-WebSocket-Version: 13",`Sec-WebSocket-Key: ${Z}`];for(let j of Oq)if(B[j]!==void 0)H.push(`${GI(j)}: ${B[j]}`);for(let[j,N]of Object.entries(J))if(!Oq.includes(j.toLowerCase())&&j.toLowerCase()!=="content-length")H.push(`${j}: ${N}`);let U=`${H.join(`\r
-`)}\r
-\r
-`;try{this.log("connect_start",{host:Y,port:G,tls:$.protocol==="https:"});let j=()=>{this.socket?.write(U)},N=$.protocol==="https:"?$I({host:Y,port:G,servername:Y},j):JI({host:Y,port:G},j);this.socket=N,N.on("data",(K)=>{this.onData(typeof K==="string"?Buffer.from(K,"binary"):K)}),N.on("error",(K)=>{if(this.emitRejectedUpgrade(!0))return;this.readyState=3;let q=K instanceof Error?K.message:String(K);this.log("socket_error",{message:q}),this.emit("error",{message:q})}),N.on("close",(K)=>{if(this.emitRejectedUpgrade(!0))return;this.readyState=3,this.log("socket_close",{hadError:K}),this.emitClose(this.peerClose?.code??1006,this.peerClose?.reason??"socket closed")})}catch(j){this.readyState=3,this.log("connect_exception",{message:j instanceof Error?j.message:String(j)}),this.emit("error",{message:j instanceof Error?j.message:String(j)})}}onData(X){if(this.rxBuffer=QI(this.rxBuffer,X),!this.handshakeDone){let J=Buffer.from(this.rxBuffer).toString("latin1"),$=J.indexOf(`\r
-\r
-`);if($===-1)return;let Y=J.slice(0,$),G=Y.split(`\r
-`)[0]??"",Q=Y.match(/sec-websocket-accept:\s*(\S+)/i),z=o3(G);if(z!==101){if(z===void 0){this.readyState=3,this.socket?.destroy?.(),this.log("upgrade_failed",{statusLine:G}),this.emit("error",{message:`WS upgrade failed: ${G}`});return}if(!this.emitRejectedUpgrade())return;this.socket?.destroy?.();return}if(!Q||Q[1]!==this.expectedAccept){this.readyState=3,this.socket?.destroy?.(),this.log("accept_mismatch",{statusLine:G}),this.emit("error",{message:"WS upgrade Sec-WebSocket-Accept mismatch"});return}this.handshakeDone=!0,this.readyState=1,this.rxBuffer=this.rxBuffer.slice($+4),this.log("open",{statusLine:G}),this.emit("open",{})}this.drainFrames()}emitRejectedUpgrade(X=!1){if(this.upgradeFailureEmitted)return!0;if(this.handshakeDone)return!1;let J=Buffer.from(this.rxBuffer).indexOf(`\r
-\r
-`);if(J===-1)return!1;let $=bX(this.rxBuffer,J,X);if(!$)return!1;return this.upgradeFailureEmitted=!0,this.readyState=3,this.log("upgrade_failed",{status:$.status,partial:X}),this.emit("error",$),!0}drainFrames(){for(;;){let X=this.rxBuffer;if(X.length<2)return;let J=X[0],$=X[1],Y=(J&128)!==0,G=J&15,Q=($&128)!==0,z=$&127,Z=2;if(z===126){if(X.length<4)return;z=X[2]<<8|X[3],Z=4}else if(z===127){if(X.length<10)return;z=0;for(let B=0;B<8;B++)z=z*256+X[2+B];Z=10}if(Q)Z+=4;if(X.length<Z+z)return;let W=X.slice(Z,Z+z);this.rxBuffer=X.slice(Z+z),this.handleFrame(Y,G,W)}}handleFrame(X,J,$){if(J===9){this.writeFrame(10,$);return}if(J===10)return;if(J===8){let G=1005,Q="";if($.length>=2)G=$[0]<<8|$[1],Q=Buffer.from($.slice(2)).toString("utf-8");this.readyState=3,this.peerClose={code:G,reason:Q};try{this.socket?.end()}catch{}this.log("close_frame",{code:G,reason:Q}),this.emitClose(G,Q);return}if(J===1||J===2)this.fragOpcode=J,this.fragChunks=[$];else if(J===0)this.fragChunks.push($);if(!X)return;let Y=zI(this.fragChunks);if(this.fragChunks=[],this.fragOpcode===1){let G=Buffer.from(Y).toString("utf-8");this.emit("message",{data:G})}}send(X){if(this.readyState!==1)return;this.writeFrame(1,new TextEncoder().encode(X))}writeFrame(X,J){let $=J.length,Y=crypto.getRandomValues(new Uint8Array(4)),G;if($<126)G=[128|X,128|$];else if($<65536)G=[128|X,254,$>>8&255,$&255];else{G=[128|X,255];for(let Z=7;Z>=0;Z--)G.push($/2**(8*Z)&255)}let Q=new Uint8Array($);for(let Z=0;Z<$;Z++)Q[Z]=J[Z]^Y[Z%4];let z=new Uint8Array(G.length+4+$);z.set(G,0),z.set(Y,G.length),z.set(Q,G.length+4);try{this.socket?.write(z)}catch{}}close(){if(this.readyState===3)return;this.readyState=2;try{this.writeFrame(8,new Uint8Array([3,232])),this.socket?.end()}catch{}this.readyState=3}log(X,J){return F1({component:"raw-ws-node",event:X,sessionID:this.sessionID,url:this.url,...J})}}function GI(X){return X}function QI(X,J){let $=new Uint8Array(X.length+J.length);return $.set(X,0),$.set(J,X.length),$}function zI(X){let J=0;for(let G of X)J+=G.length;let $=new Uint8Array(J),Y=0;for(let G of X)$.set(G,Y),Y+=G.length;return $}function ZI(){return typeof globalThis.Bun?.connect==="function"}var Mq=ZI()?HG:VG;function kX(X){return process.env[X]??process.env[X.toLowerCase()]}function WI(X){let J=kX("NO_PROXY");if(!J)return!1;let $=X.hostname.toLowerCase(),Y=J.split(",").map((G)=>G.trim().toLowerCase()).filter(Boolean);for(let G of Y){if(G==="*")return!0;if(G.startsWith(".")){if($===G.slice(1)||$.endsWith(G))return!0}else if($===G||$.endsWith(`.${G}`))return!0}return!1}function BI(X){let J=new URL(X);if(WI(J))return;if(J.protocol==="http:")return kX("HTTP_PROXY");if(J.protocol==="https:")return kX("HTTPS_PROXY")??kX("HTTP_PROXY");return}var _q={getProxyForUrl:BI};var HI=Z0("quota"),m9=Z0("transport"),Cq="responses_websockets=2026-02-06",Aq=["chatgpt-account-id","authorization","user-agent","originator","openai-beta","version","x-codex-beta-features","x-codex-turn-metadata","x-client-request-id","session-id","thread-id","x-codex-window-id"],VI=new Set([x9,"x-opencode-title"]);function UI(X){let J=new Map;for(let Y of Object.keys(X))J.set(Y.toLowerCase(),Y);let $={};for(let Y of Aq){let G=J.get(Y),Q=G===void 0?void 0:X[G];if(G!==void 0&&Q!==void 0)$[G]=Q}for(let[Y,G]of Object.entries(X))if(!Aq.includes(Y.toLowerCase()))$[Y]=G;return $}function KI(X){let J={};for(let[$,Y]of Object.entries(X)){if(VI.has($.toLowerCase()))continue;J[$]=Y}return J}function jI(X){return X.replace(/^http/,"ws")}function NI(X){let J={};if(!X)return J;if(X instanceof Headers)return X.forEach(($,Y)=>{J[Y.toLowerCase()]=$}),J;if(Array.isArray(X)){for(let[$,Y]of X)J[$.toLowerCase()]=Y;return J}for(let[$,Y]of Object.entries(X))if(Y!=null)J[$.toLowerCase()]=String(Y);return J}function jG(X){return X instanceof DOMException&&X.name==="AbortError"}var Eq=new WeakSet;function qI(X){return typeof X==="object"&&X!==null&&Eq.has(X)}var Sq=new WeakSet;function LI(X){return typeof X==="object"&&X!==null&&Sq.has(X)}function Iq(X){return Sq.add(X),X}function Tq(X,J){let $=Error(X,J===void 0?void 0:{cause:J});return Eq.add($),$}function DI(X){return new Promise((J,$)=>{if(X.signal?.aborted){$(UG(X.signal));return}let Y={...X.headers,"openai-beta":X.headers["openai-beta"]??Cq},G=Y[x9]??Y["session-id"];delete Y["content-length"],Y=UI(KI(Y));let Q=typeof Bun>"u"?void 0:_q.getProxyForUrl(X.url.replace(/^wss:/,"https:").replace(/^ws:/,"http:")),z=!0,Z=X.rawWebSocket?new Mq(X.url,Y,{sessionID:G}):new globalThis.WebSocket(X.url,{headers:Y,...Q?{proxy:Q}:{},perMessageDeflate:z}),W=X.timeout?setTimeout(()=>{B(),Z.close(),$(Error("WebSocket connect timed out"))},X.timeout):void 0;function B(){if(W)clearTimeout(W);Z.removeEventListener("open",H),Z.removeEventListener("error",U),Z.removeEventListener("close",j),X.signal?.removeEventListener("abort",N)}function H(){B(),J(Z)}function U(K){B(),$(Tq(e0(K),K))}function j(K){B(),$(Tq(wq("WebSocket closed before open",K.code,K.reason)))}function N(){B(),Z.close(),$(UG(X.signal))}Z.addEventListener("open",H,{once:!0}),Z.addEventListener("error",U,{once:!0}),Z.addEventListener("close",j,{once:!0}),X.signal?.addEventListener("abort",N,{once:!0})})}function FI(X){let J=new TextEncoder,$=X.socket,Y,G=()=>{},Q=!1,z=0,Z=!1,W=!1,B,H=[],U=12,j=[],N=typeof X.body.previous_response_id==="string"?X.body.previous_response_id:void 0,K=typeof X.body.prompt_cache_key==="string"?X.body.prompt_cache_key:void 0,q={sessionID:X.sessionID,codexSessionID:K},F,O=0,_,C=new Set,L={addedItemIds:new Set,reasoningItemIds:new Set,finished:!1,other:!1};function P(){if(B)clearTimeout(B);G(),X.signal?.removeEventListener("abort",c0)}function A(a=$){a.close()}function T(){P(),Y?.enqueue(J.encode(`data: [DONE]
-
-`)),Y?.close()}function k(a){w(a,a)}function p(){if(!W)return"none";if(L.other)return"other";if(L.finished)return L.reasoningItemIds.size>0?"other":"finished-calls";return L.addedItemIds.size>0?"unfinished-calls":"none"}function i(){Y?.enqueue(J.encode(`data: ${JSON.stringify(CI)}
-
-`)),T()}function X0(a){let u0={...q,openingFrameTypes:H,openingItemTypes:j,responseID:F,previousResponseID:N,hasContinuation:N!==void 0,framesSinceCreated:O,msSinceLastFrame:_===void 0?void 0:Date.now()-_},t=p();if(t==="finished-calls"){if(Q)return;m9.warn("stream failed after finished function calls only; ended as completed",{reason:a.message,emittedOutput:!0,outputShape:t,...u0}),Q=!0,P(),X.onConnectionInvalid?.(a),i();return}if(t==="other"){let o=KG;m9.warn("stream failed after output; not retried",{reason:a.message,emittedOutput:!0,outputShape:t,...u0}),w(Error(o,{cause:a}),new y6(o,{cause:a}));return}let h=L.reasoningItemIds.size;m9.warn(t==="unfinished-calls"?"stream failed after unfinished function calls only; retryable":h>0?"stream failed after reasoning without text only; retryable":"stream failed before output; retryable",{reason:a.message,emittedOutput:W,outputShape:t,emptyReasoningItems:h,...u0}),k(a)}function w(a,u0){if(Q)return;Q=!0,P(),X.onConnectionInvalid?.(u0),Y?.error(a)}function J0(a){if(Q)return;if(!X.idleTimeout)return;if(B)clearTimeout(B);B=setTimeout(()=>X0(new y6(a)),X.idleTimeout)}async function G0(a){if(Q)return;if(typeof a.data!=="string"){X0(new y6("Unexpected binary WebSocket frame"));return}let u0=a.data,t=(()=>{try{let c=JSON.parse(u0);return typeof c==="object"&&c!==null?c:void 0}catch{return}})();if(t?.type==="codex.rate_limits"){HI.debug("codex.rate_limits frame received",{pid:process.pid}),J0("idle timeout waiting for websocket");let c=Iz(t);X.onQuota?.(c);return}let h=p(),o=h==="none"||h==="unfinished-calls"?r3(t):void 0;if(o&&t){Q=!0,P(),X.onRateLimitReached?.(o.window,o.resetAt),X.onTerminal?.(t),X.onFirstEvent?.(),Y?.error(new y6(`OpenAI account rate limit reached at admission (${o.window})`));return}if(t?.type==="error"&&X.onRetryableTerminal){if(G(),B)clearTimeout(B);B=void 0;try{let c=await X.onRetryableTerminal(t);if(Q){if(c)A(c);return}if(c){r(c);return}}catch(c){X0(new y6(c instanceof Error?c.message:String(c),{cause:c}));return}}let e=MI(t,u0);if(e&&t){if(!Z)X.onFirstEvent?.(e);Q=!0,P(),X.onTerminal?.(t);let c=new M1({message:e.message,url:$.url,requestBodyValues:X.body,statusCode:e.status,responseHeaders:e.headers,responseBody:e.body}),D0=p();if(D0==="none"||D0==="unfinished-calls"){if(D0==="unfinished-calls")m9.warn("protocol error after unfinished function calls only; surfaced as before output",{...q,status:e.status,reason:e.message,outputShape:D0,responseID:F,previousResponseID:N});Y?.error(c);return}if(m9.warn(D0==="finished-calls"?"protocol error after finished function calls only; ended as completed":"protocol error after output; not retried",{...q,status:e.status,reason:e.message,outputShape:D0,responseID:F,previousResponseID:N}),D0==="finished-calls"){i();return}Y?.error(Error(KG,{cause:c}));return}if(s(t)&&t.type==="response.failed"){let c=s(t.response)?t.response.failed:void 0,D0=s(c)?c.rate_limit_reached_type:void 0;if(typeof D0==="string"){Q=!0,P(),X.onRateLimitReached?.(D0),X.onTerminal?.(t);let l0=p();if(l0!=="none")m9.warn(l0==="other"?"rate limit reached after output; ended without retry":l0==="finished-calls"?"rate limit reached after finished function calls only; ended as completed":"rate limit reached after unfinished function calls only; retryable",{...q,outputShape:l0,responseID:F,previousResponseID:N});if(l0==="none"||l0==="unfinished-calls")X.onFirstEvent?.(),Y?.error(new y6(`OpenAI account rate limit reached mid-stream (${D0})`));else if(l0==="finished-calls")i();else T();return}}if(!t){if(!Z)X.onFirstEvent?.();J0("idle timeout waiting for websocket");return}if(PI(t,C),!Z)X.onFirstEvent?.();if(Y?.enqueue(J.encode(`${u0.split(/\r?\n/).map((c)=>`data: ${c}`).join(`
-`)}
-
-`)),Z=!0,_=Date.now(),F!==void 0)O++;if(H.length<U)H.push(String(t.type));if(t.type==="response.output_item.added"&&j.length<U)j.push(s(t.item)?String(t.item.type):"unknown");if(t.type==="response.created")F=TI(t),m9.debug("response created",{...q,responseID:F,previousResponseID:N,hasContinuation:N!==void 0});if(!kq(t.type))W=!0,RI(t,L);if(J0("idle timeout waiting for websocket"),t.type==="response.completed"||t.type==="response.done"){Q=!0,OI(t,C),X.onComplete?.(t,C),X.onTerminal?.(t),T();return}if(t.type==="response.failed"||t.type==="response.incomplete"||t.type==="error")Q=!0,X.onTerminal?.(t),T()}function L0(a){X0(new y6(e0(a),{cause:a}))}function m(a){if(Q)return;let u0=a.code===1009,t=new y6(u0?xq:wq("WebSocket closed before response.completed",a.code,a.reason),{retryable:!u0});if(u0)m9.warn("websocket peer refused the request size",{...q,requestBytes:z,reason:a.reason.toString()});X0(u0?Iq(t):t)}function c0(){let a=UG(X.signal);if(Q)return;Q=!0,P(),A(),X.onAbort?.(a),Y?.error(a)}function m0(a){if(Q)return;Q=!0,P(),A(),X.onAbort?.(_I(a))}function r(a){G(),$=a,$.addEventListener("message",G0),$.addEventListener("error",L0,{once:!0}),$.addEventListener("close",m,{once:!0}),G=()=>{$.removeEventListener("message",G0),$.removeEventListener("error",L0),$.removeEventListener("close",m)};let{background:u0,...t}=X.body;J0("idle timeout sending websocket request");try{let h=JSON.stringify({type:"response.create",...t});z=h.length,$.send(h),J0("idle timeout waiting for websocket")}catch(h){if(Q)return;k(new y6(h instanceof Error?h.message:String(h),{cause:h}))}}return new Response(new ReadableStream({start(a){if(Y=a,X.signal?.addEventListener("abort",c0,{once:!0}),X.signal?.aborted){c0();return}r($)},cancel(a){m0(a)}}),{status:200,headers:{"content-type":"text/event-stream"}})}function PI(X,J){if(X.type!=="response.output_item.done")return;if(!s(X.item))return;bq(X.item,J)}function OI(X,J){let $=X.response;if(!s($)||!Array.isArray($.output))return;for(let Y of $.output)if(s(Y))bq(Y,J)}function bq(X,J){if(X.type!=="function_call"&&X.type!=="custom_tool_call")return;let $=typeof X.call_id==="string"?X.call_id:typeof X.id==="string"?X.id:void 0;if($)J.add($)}function MI(X,J){if(X?.type!=="error")return;let $=X.status??X.status_code;if(typeof $!=="number"||$>=200&&$<300)return;return{status:$,headers:s(X.headers)?Object.fromEntries(Object.entries(X.headers).flatMap(([Y,G])=>typeof G==="string"||typeof G==="number"||typeof G==="boolean"?[[Y,String(G)]]:[])):void 0,body:J,message:s(X.error)&&typeof X.error.message==="string"?X.error.message:`${$}`}}function r3(X){if(typeof X==="string")try{return r3(JSON.parse(X))}catch{return}if(!s(X))return;let J=r3(X.cause);if(J)return J;let $=r3(X.body);if($)return $;let Y=s(X.error)?X.error:X,G=typeof Y.type==="string"?Y.type:void 0,Q=X.status??X.status_code;if(G!=="usage_limit_reached"&&Q!==429)return;let{resets_at:z,resets_in_seconds:Z}=Y,W=typeof z==="number"&&Number.isFinite(z)&&z>0?z*1000:typeof Z==="number"&&Number.isFinite(Z)&&Z>0?Date.now()+Z*1000:void 0;return{window:G??"primary",resetAt:W}}function _I(X){if(jG(X))return X;if(X instanceof Error)return X;return new DOMException(typeof X==="string"?X:"Aborted","AbortError")}function UG(X){let J=X?.reason;if(jG(J))return J;if(AI(J))return J;return new DOMException(J instanceof Error?J.message:"Aborted","AbortError")}function AI(X){return X instanceof Error&&(X.name==="ProviderHeaderTimeoutError"||X.name==="ProviderResponseStreamError")}function TI(X){let J=X.response;if(!s(J))return;return typeof J.id==="string"?J.id:void 0}function RI(X,J){let $=s(X.item)?X.item:void 0;switch(X.type){case"response.output_item.added":if($?.type==="function_call"&&typeof $.id==="string"){J.addedItemIds.add($.id);return}if(Rq($)&&typeof $?.id==="string"){J.reasoningItemIds.add($.id);return}break;case"response.function_call_arguments.delta":case"response.function_call_arguments.done":if(typeof X.item_id==="string"&&J.addedItemIds.has(X.item_id))return;break;case"response.output_item.done":if($?.type==="function_call"&&$.status==="completed"&&typeof $.id==="string"&&typeof $.call_id==="string"&&typeof $.name==="string"&&typeof $.arguments==="string"){J.finished=!0;return}if(Rq($)&&typeof $?.id==="string"&&J.reasoningItemIds.has($.id))return;break}J.other=!0}function Rq(X){if(X?.type!=="reasoning")return!1;let J=($)=>$===void 0||$===null||Array.isArray($)&&$.length===0;return J(X.summary)&&J(X.content)}var CI={type:"response.completed",response:{status:"completed",incomplete_details:null,usage:{input_tokens:0,output_tokens:0,total_tokens:0}}};function kq(X){return X==="response.created"||X==="response.in_progress"||X.startsWith("codex.")}var KG="The response ended early after part of it had already been shown. It was not sent again, because repeating it would duplicate that output and re-run any tools it had started. The transport log records what ended it.",xq="The request was larger than the websocket would carry, so it was sent over HTTP instead. Resending it unchanged over the same socket cannot succeed. The transport log records the size.";function wq(X,J,$){let Y=[`code ${J}`];if($.length>0)Y.push($.toString());return`${X} (${Y.join(": ")})`}var qG="x-opencode-title",xX="x-openai-auth-quota-account",NG=new Set([qG,x9,xX,"x-opencode-session"]),SI=15000,II=300000,bI=3300000,vq="websocket_connection_limit_reached";function kI(X){let J=typeof X["chatgpt-account-id"]==="string"?X["chatgpt-account-id"]:"",$=typeof X.authorization==="string"&&X.authorization.startsWith("Bearer ")?X.authorization.slice(7):"",Y=J?`acct:${J}`:`tok:${$}`;return EI("sha256").update(Y).digest("hex").slice(0,12)}function xI(X){let J=X?.httpFetch??globalThis.fetch,$=new Map,Y=X?.connectTimeout??SI,G=X?.idleTimeout??II,Q=X?.maxConnectionAge??bI,z=X?.streamRetries??5,Z=X?.firstEventGraceMs??250,W=X?.rawWebSocket??!1,B=X?.onQuota,H=X?.onRateLimitReached,U=setInterval(()=>q(),Math.min(G,60000));if(typeof U==="object"&&"unref"in U&&typeof U.unref==="function")U.unref();function j(_,C,L,P){if(!C||!L)return L;LG(_,yq(C),void 0,P);let A=new Headers(L.headers),T=A.get("x-codex-turn-metadata");if(!T)return L;let k=lq(T,_.turnID,_.turnStartedAt);if(!k)return L;return A.set("x-codex-turn-metadata",k),{...L,headers:A}}async function N(_,C){let L=_ instanceof URL?_.toString():typeof _==="string"?_:_.url,P=L6.normalizeHeaders(C?.headers),A=aq(C),T=$X(A);if(C?.method!=="POST"||!new URL(L).pathname.endsWith("/responses"))return J(_,T);let k=(()=>{try{if(typeof C?.body!=="string")return;let r=JSON.parse(C.body);return typeof r==="object"&&r!==null?r:void 0}catch{return}})();if(!k?.stream)return J(_,T);if(P[qG]==="true")return J(_,T);let p=P[x9]??P["x-session-affinity"]??P["session-id"],i=p;if(!p)return J(_,T);let X0=L6.normalizeHeaders(A?.headers),w=kI(X0),J0=`${p}:${w}:conversation`,G0=typeof P[xX]==="string"?P[xX]:void 0,L0=H?(r,a)=>H(r,G0,a):void 0,m=$.get(J0)??{lastUsedAt:Date.now(),busy:!1,fallback:!1,streamFailures:0};$.set(J0,m);let c0=yq(k),m0;if(m.fallback)return J(_,j(m,k,T,m0));if(m.busy)return J(_,j(m,k,T,m0));m.busy=!0,m.lastUsedAt=Date.now();try{m0=A4(m,c0);let r=L6.normalizeHeaders(A?.headers),a=typeof r.authorization==="string"&&r.authorization.startsWith("Bearer ")?r.authorization.slice(7):"",u0=typeof r["chatgpt-account-id"]==="string"?r["chatgpt-account-id"]:void 0,t=B?(p0)=>B(p0,a,G0,u0):void 0,h=!m.socket&&!m.continuation?pI(r):r;if(m.socket=await hI(m,X?.url??L,h,Y,Q,W,C?.signal),dI(m,c0,m0))await fI(m,c0,G,{signal:C?.signal??void 0,sessionID:i,url:X?.url??L,headers:A?.headers,onRateLimitReached:L0});let o=()=>{},e=()=>{},c=new Promise((p0,F8)=>{o=p0,e=F8}),D0=lI(m,c0,m0),l0=t3(cq(m,D0,c0,m0)),i6=typeof l0.previous_response_id==="string";await q4({sessionID:i,transport:"websocket",phase:"main",bodyText:()=>JSON.stringify(l0),url:X?.url??L,method:A?.method,headers:A?.headers});let n0=L6.streamResponsesWebSocket({socket:m.socket,body:l0,sessionID:i??void 0,idleTimeout:G,signal:C?.signal??void 0,onQuota:t,onRateLimitReached:L0,onFirstEvent:(p0)=>o(p0??!0),onComplete:(p0,F8)=>{let T4=gq(p0);F1({component:"ws-pool",event:"main_completed",sessionID:i,responseID:fq(p0),usage:T4}),pq(m,c0,p0,F8,i6,m0)},onTerminal:(p0)=>{if(m.busy=!1,m.lastUsedAt=Date.now(),m.streamFailures=0,p0.type!=="response.completed"&&p0.type!=="response.done")m.continuation=void 0,j9(m)},onConnectionInvalid:(p0)=>{if(m.busy=!1,m.lastUsedAt=Date.now(),L6.isOversizedFrame(p0))m.fallback=!0;if(!m.fallback)K(m);m.continuation=void 0,j9(m),o(!1)},onAbort:(p0)=>{m.busy=!1,m.lastUsedAt=Date.now(),m.streamFailures=0,m.continuation=void 0,j9(m),e(p0)},onRetryableTerminal:async(p0)=>{let F8=hq(p0);if(!F8)return;throw m.fallback=!0,F8}}),F6=await wI(c,Z);if(F6!==!1){if(F6===!0||F6.status<200||F6.status>599)return n0;return new Response(F6.body,{status:F6.status,headers:{"content-type":"application/json",...F6.headers}})}let h6=()=>J(_,j(m,k,T,m0));if(!m.fallback)return vI(n0,h6);return h6()}catch(r){if(m.busy=!1,m.lastUsedAt=Date.now(),L6.isAbortError(r))throw m.streamFailures=0,m.continuation=void 0,j9(m),r;let a=L6.parseRateLimitSignal(r);if(a)L0?.(a.window,a.resetAt);if(L6.isUpgradeFailure(r)&&!W)m.fallback=!0;if(K(m),m.continuation=void 0,j9(m),m.fallback)return J(_,j(m,k,T,m0));return yI(new y6(r instanceof Error?r.message:String(r),{cause:r}))}}function K(_){if(_.streamFailures++,_.streamFailures>z)_.fallback=!0}function q(){let _=Date.now();for(let[C,L]of $){if(L.busy)continue;if(_-L.lastUsedAt<G)continue;j9(L),$.delete(C)}}function F(){clearInterval(U);for(let _ of $.values())j9(_);$.clear()}function O(_){let C=`${_}:`;for(let[L,P]of $){if(!L.startsWith(C))continue;j9(P),$.delete(L)}}return Object.assign(N,{close:F,remove:O})}function hq(X){if(X.type!=="error"||!s(X.error)||X.error.code!==vq)return;return Error(typeof X.error.message==="string"?X.error.message:vq)}async function wI(X,J){if(J<=0)return!1;return new Promise(($,Y)=>{let G=setTimeout(()=>$(!1),J);X.then((Q)=>{clearTimeout(G),$(Q)},(Q)=>{clearTimeout(G),Y(Q)})})}function vI(X,J){let $=X.body;if(!$)return X;let Y=!1,G=new ReadableStream({async start(Q){let z=$.getReader(),Z=async(W)=>{while(!0){let{done:B,value:H}=await W.read();if(B)return;if(H&&H.length>0)Y=!0,Q.enqueue(H)}};try{await Z(z),Q.close()}catch(W){if(Y||!L6.isOversizedFrame(W)){Q.error(W);return}try{let B=await J();if(!B.ok){Q.error(new y6(`HTTP fallback after an oversized WebSocket frame failed with ${B.status}`));return}if(B.body)await Z(B.body.getReader());Q.close()}catch(B){Q.error(B)}}},cancel(Q){$.cancel(Q)}});return new Response(G,{status:X.status,headers:X.headers})}function yI(X){return new Response(new ReadableStream({start(J){J.error(X)}}),{status:200,headers:{"content-type":"text/event-stream"}})}async function hI(X,J,$,Y,G,Q,z){if(X.socket?.readyState===WebSocket.OPEN&&X.connectedAt&&Date.now()-X.connectedAt<G)return X.socket;j9(X);let Z=await L6.connectResponsesWebSocket({url:L6.toWebSocketUrl(J),headers:$,timeout:Y,rawWebSocket:Q,signal:z??void 0});return X.connectedAt=Date.now(),Z}function j9(X){if(X.socket)X.socket.close(),X.socket=void 0;X.connectedAt=void 0,X.continuation=void 0}async function fI(X,J,$,Y){if(!X.socket||!Array.isArray(J.input)||J.input.length===0)return;let G=mI(J);await q4({sessionID:Y.sessionID,transport:"websocket",phase:"prewarm",bodyText:()=>JSON.stringify(G),url:Y.url,method:"POST",headers:Y.headers});let Q=L6.streamResponsesWebSocket({socket:X.socket,body:G,sessionID:Y.sessionID,idleTimeout:$,signal:Y.signal,onRateLimitReached:Y.onRateLimitReached,onComplete:(z,Z)=>{F1({component:"ws-pool",event:"prewarm_completed",sessionID:Y.sessionID,responseID:fq(z),usage:gq(z)}),pq(X,G,z,Z,!1,{input:P1([]),signature:nq(G),priorInputs:new Map})},onTerminal:(z)=>{if(z.type!=="response.completed"&&z.type!=="response.done")X.continuation=void 0},onConnectionInvalid:()=>{X.continuation=void 0},onAbort:()=>{X.continuation=void 0},onRetryableTerminal:async(z)=>{let Z=hq(z);if(!Z)return;throw X.fallback=!0,Z}});await gI(Q)}function fq(X){let J=X.response;if(!s(J))return;return typeof J.id==="string"?J.id:void 0}function gq(X){let J=X.response;if(!s(J))return;return s(J.usage)?J.usage:void 0}async function gI(X){let J=X.body?.getReader();if(!J)return;while(!0)if((await J.read()).done)return}function mI(X){return t3({...X,generate:!1,input:[],previous_response_id:void 0,client_metadata:uI(X.client_metadata)})}function mq(X){return JSON.stringify({session_id:X.session_id,thread_id:X.thread_id,thread_source:X.thread_source,turn_id:"",sandbox:X.sandbox,request_kind:"prewarm",window_id:X.window_id})}function uI(X){if(!s(X))return X;if(typeof X["x-codex-turn-metadata"]!=="string")return X;try{let J=JSON.parse(X["x-codex-turn-metadata"]);if(!s(J))return X;return{...X,"x-codex-turn-metadata":mq(J),"x-codex-ws-stream-request-start-ms":String(Date.now())}}catch{return X}}function pI(X){let J=X["x-codex-turn-metadata"];if(!J)return X;try{let $=JSON.parse(J);if(!s($))return X;return{...X,"x-codex-turn-metadata":mq($)}}catch{return X}}var uq=["type","model","instructions","previous_response_id","input","tools","tool_choice","parallel_tool_calls","reasoning","store","stream","include","prompt_cache_key","text","generate","client_metadata"];function yq(X){let J={...X};if(Array.isArray(X.input))J.input=X.input.map(cI);return J}function t3(X){let J={};for(let $ of uq)if($ in X)J[$]=X[$];for(let $ of Object.keys(X))if(!($ in J))J[$]=X[$];return J}function cI(X){if(!s(X))return X;if(typeof X.type==="string")return X;if(typeof X.role!=="string")return X;if(!("content"in X))return X;return{...X,type:"message"}}function pq(X,J,$,Y,G,Q=A4(X,J)){let z=$.response,Z=s(z)&&typeof z.id==="string"?z.id:void 0;if(!Z||!Array.isArray(J.input)){X.continuation=void 0;return}let W=G?new Set(X.continuation?.finalizedCallIds):new Set;for(let B of Y)W.add(B);X.continuation={responseID:Z,input:J.input,signature:Q.signature,canonical:w3(Q.input),finalizedCallIds:W}}function LG(X,J,$=J,Y=A4(X,{...$,input:Array.isArray($.input)?$.input:J.input})){let G=Array.isArray(J.input)?J.input:[],Q=Array.isArray($.input)?$.input:G,z=Y.signature,Z=X.turnInput&&X.turnSignature===z?v3(dq(Y,X.turnInput),Y.input):void 0,W=Z===void 0?G:Q.slice(Z);if(W.length>0&&W.some(iq)||!X.turnID)X.turnID=O1(),X.turnStartedAt=Date.now();X.turnInput=Q.slice(),Y.priorInputs.set(X.turnInput,Y.input),X.turnSignature=z,X.turnCanonical=w3(Y.input)}function cq(X,J,$=J,Y=A4(X,{...$,input:Array.isArray($.input)?$.input:J.input})){LG(X,J,$,Y);let G=J.client_metadata;if(!s(G)||typeof G["x-codex-turn-metadata"]!=="string")return J;let Q=lq(G["x-codex-turn-metadata"],X.turnID,X.turnStartedAt);if(!Q)return J;return{...J,client_metadata:{...G,"x-codex-turn-metadata":Q}}}function lq(X,J,$){let Y;try{Y=JSON.parse(X)}catch{return}if(!s(Y))return;return JSON.stringify({session_id:Y.session_id,thread_id:Y.thread_id,thread_source:Y.thread_source,turn_id:J,sandbox:Y.sandbox,turn_started_at_unix_ms:$,request_kind:"turn",window_id:Y.window_id})}function A4(X,J){let $=Array.isArray(J.input)?J.input:[],Y=new Map;if(X.turnInput&&X.turnCanonical)Y.set(X.turnInput,X.turnCanonical);if(X.continuation?.canonical)Y.set(X.continuation.input,X.continuation.canonical);let G=P1($,X.turnCanonical??X.continuation?.canonical);return Y.set($,G),{input:G,signature:nq(J),priorInputs:Y}}function dq(X,J){let $=X.priorInputs.get(J);if(!$){for(let[Y,G]of X.priorInputs)if(Y.length===J.length&&Y.every((Q,z)=>Q===J[z])){$=G;break}$??=P1(J),X.priorInputs.set(J,$)}return $}function lI(X,J,$=A4(X,J)){let Y=Array.isArray(J.input)?J.input:void 0;if(!Y||!X.continuation)return J;if(X.continuation.signature!==$.signature)return X.continuation=void 0,J;if(!sq(X.continuation,$))return X.continuation=void 0,J;if(X.continuation.input.length===0)return{...J,previous_response_id:X.continuation.responseID};let G=Y.slice(X.continuation.input.length),Q=iI(G,X.continuation.finalizedCallIds);if(Q.length===0)return J;return{...J,previous_response_id:X.continuation.responseID,input:Q}}function dI(X,J,$=A4(X,J)){let Y=Array.isArray(J.input)?J.input:void 0;if(!X.continuation)return!0;if(!Y)return!1;if(!sq(X.continuation,$))return!0;return Y.slice(X.continuation.input.length).some(iq)}function iq(X){if(!s(X))return!1;if(!(X.type==="message"||("role"in X)))return!1;return X.role==="user"||X.role==="developer"}function iI(X,J){return X.filter(($)=>{if(!s($))return!0;if(typeof $.type==="string"&&$.type.endsWith("_output"))return!0;if($.type==="function_call_output"||$.type==="custom_tool_call_output")return!0;if($.type==="function_call"||$.type==="custom_tool_call"){let Y=typeof $.call_id==="string"?$.call_id:typeof $.id==="string"?$.id:void 0;return Y?!J.has(Y):!0}if($.type==="message")return $.role!=="assistant";if(typeof $.role==="string")return $.role!=="assistant";return!1})}function nq(X){return F4(nI(Object.fromEntries(Object.entries(X).filter(([J])=>J!=="input"&&J!=="stream"&&J!=="background"&&J!=="previous_response_id"&&J!=="generate"))))}function nI(X){if(!s(X.client_metadata))return X;let J=Object.fromEntries(Object.entries(X.client_metadata).filter(([$])=>$!=="x-codex-turn-metadata"&&$!=="x-codex-ws-stream-request-start-ms"));return{...X,client_metadata:J}}function sq(X,J){if(X.input.length>=J.input.texts.length)return!1;return v3(dq(J,X.input),J.input)!==void 0}function aq(X){if(!X?.headers)return X;if(X.headers instanceof Headers){let J=new Headers(X.headers);for(let $ of NG)J.delete($);return{...X,headers:J}}if(Array.isArray(X.headers))return{...X,headers:X.headers.filter((J)=>!NG.has(J[0].toLowerCase()))};return{...X,headers:Object.fromEntries(Object.entries(X.headers).filter(([J])=>!NG.has(J.toLowerCase())))}}var $b=new Set(["gpt-5.5","gpt-5.3-codex-spark","gpt-5.4","gpt-5.4-mini"]),Yb=new Set(["gpt-5.6","gpt-6","gpt-6.1"]);function Gb(X){if($b.has(X))return!0;if(Yb.has(X))return!1;let $=X.match(/^gpt-(\d+(?:\.\d+)?)/)?.[1];return $?parseFloat($)>5.4:!1}function Qb(X){if(X.includes("gpt-5.5"))return{context:400000,input:272000,output:128000};if(X.includes("gpt-6-astra"))return{context:872000,input:744000,output:128000};if(X.includes("gpt-5.6")||X.includes("gpt-6-sol")||X.includes("gpt-6-luna")||X.includes("gpt-6.1-sol"))return{context:372000,input:244000,output:128000};return}var zb="Refusing to send a request with no access token. This is a defect in the plugin, not a problem with the provider or the account; the transport log names the account and the path that produced it.",Zb=new Set(["gpt-5.6-sol","gpt-5.6-terra","gpt-5.6-luna","gpt-6-astra","gpt-6-sol","gpt-6-luna","gpt-6.1-sol"]),Wb="opencode-oauth-dummy-key",Bb="terminal_resize_reflow",MG="0.159.0",Hb=`codex_exec/${MG} (Debian 12.0.0; aarch64) unknown (codex_exec; ${MG})`,Vb="seccomp",hn=()=>g8,Ub=120000,Kb=90000,jb=4000,oq=50,rq=3,Nb=25,qb=60000,Lb="__OPENCODE_OPENAI_AUTH_COMMAND_HANDLED__",_G=!1,hX;function fn(){return hX}function gn(){_G=!1,hX=void 0}var tq=Z0("models"),eq=!1,XL=!1;class TG extends Error{code="OPENAI_AUTH_PERSIST_FAILED";constructor(X){super("OpenAI OAuth token refreshed but could not be persisted; re-login required",{cause:X});this.name="AuthPersistError"}}class D6 extends Error{code;constructor(X,J){super(J);this.name="ResetTargetResolutionError",this.code=X}}function FG(X,J,$,Y){let G=($?.refresh?.refreshBeforeExpiryMinutes??240)*60000;return!X||!J||J-Y<=G}function Db(X,J){let $=X==="main",Y=J.row,G=()=>new D6("token_unavailable",$?"Main OpenAI account has no usable access token.":`Fallback account ${X} has no usable access token.`);if(!Y){if($)throw G();throw new D6("unknown_account",`Fallback account ${X} was not found.`)}if(!Y.enabled)throw new D6("disabled_account",`${$?"Main":"Fallback"} account ${X} is disabled.`);if(Y.type!=="oauth")throw new D6("non_oauth_account",`${$?"Main":"Fallback"} account ${X} is not an OAuth account.`);if(!J.token)throw G();let Q=V6(J.token);return{accountKey:X,label:$?"Main account":Y.label??X,accessToken:J.token,chatgptAccountId:Y.identity??(Q?U6(Q):void 0)}}function Fb(X){async function J(){let $=await X.loadAccounts({configPath:X.accountStoragePath,statePath:X.accountStatePath}),Y=Z9($);if(!$||!Y||T0(Y))throw new D6("token_unavailable","Main OpenAI account has no usable access token.");let G=Y;if(FG(G.access,G.expires,$,X.now()))G=await(X.refreshPoolMainRow??X.refreshFallbackAccount)(G,$);if(!G.access)throw new D6("token_unavailable","Main OpenAI account has no usable access token.");let Q=V6(G.access);return{accountKey:"main",label:"Main account",accessToken:G.access,chatgptAccountId:G.accountId??(Q?U6(Q):void 0)}}return async($)=>{let Y=await X.poolAccess?.($);if(Y)return Db($,Y);if($==="main"){let H=await X.loadAccounts({configPath:X.accountStoragePath,statePath:X.accountStatePath}),U=await X.getAuth();if(C6(U))return J();if(U.type!=="oauth")throw new D6("non_oauth_account","Main OpenAI account is not authenticated with OAuth.");if(FG(U.access,U.expires,H,X.now()))try{U={type:"oauth",...await X.refreshMainWithLease()}}catch(q){if(q instanceof L1)return J();throw q}if(!U.access)throw new D6("token_unavailable","Main OpenAI account has no usable access token.");let j=V6(U.access),N=j?U6(j):void 0,K=await X.loadAccounts({configPath:X.accountStoragePath,statePath:X.accountStatePath});return{accountKey:$,label:"Main account",accessToken:U.access,chatgptAccountId:N??K?.mainAccountId}}let G=await X.loadAccounts({configPath:X.accountStoragePath,statePath:X.accountStatePath}),Q=G?.accounts.find((H)=>H.id===$);if(!G||!Q)throw new D6("unknown_account",`Fallback account ${$} was not found.`);if(Q.enabled===!1)throw new D6("disabled_account",`Fallback account ${$} is disabled.`);if(!v0(Q))throw new D6("non_oauth_account",`Fallback account ${$} is not an OAuth account.`);let z=()=>new D6("token_unavailable",`Fallback account ${$} has no usable access token.`);if(T0(Q))throw z();let Z=Q;if(FG(Z.access,Z.expires,G,X.now()))Z=await X.refreshFallbackAccount(Z,G);if(!Z.access)throw z();let W=await X.loadAccounts({configPath:X.accountStoragePath,statePath:X.accountStatePath}),B=W?.accounts.find((H)=>H.id===$);if(!W||!B)throw new D6("unknown_account",`Fallback account ${$} was not found.`);if(B.enabled===!1)throw new D6("disabled_account",`Fallback account ${$} is disabled.`);if(!v0(B))throw new D6("non_oauth_account",`Fallback account ${$} is not an OAuth account.`);return{accountKey:$,label:Z.label??$,accessToken:Z.access,chatgptAccountId:B.accountId}}}function Pb(){return{fetchImpl:fetch,now:Date.now,randomUUID:()=>crypto.randomUUID()}}function PG(X){return X instanceof TG}function JL(){throw Error(Lb)}async function Ob(X,J={}){let $=M0(V0());if(u$($.configPath)){await K1(V4($),J.holdsMainRefreshLock?void 0:B9($),(Y)=>{if(J.canWrite&&!J.canWrite())throw Error(D1["vault-refused"]);X(Y)});return}await F7((Y)=>{return X(Y),Y},$,{canWrite:J.canWrite})}var PL=null;function mn(){return PL}function Mb(X){return Math.floor(Math.random()*X)}var _b=!0;function Ab(X){if(typeof X!=="string")return;try{let J=JSON.parse(X);return typeof J==="object"&&J!==null&&!Array.isArray(J)?J:void 0}catch{return}}function Tb(X,J,$){let Y=X.get(J);if(Y)return Y;let G=O1(),Q={threadID:G,turnID:O1(),windowID:`${G}:0`};return X.set(J,Q),$?.(),Q}function OL(){return Jb(y7(),"openai-auth-sessions.json")}function Rb(){let X=new Map;try{let J=JSON.parse(rI(OL(),"utf8"));if(!s(J.sessions))return X;for(let[$,Y]of Object.entries(J.sessions)){if(!s(Y)||typeof Y.threadID!=="string")continue;X.set($,{threadID:Y.threadID,turnID:O1(),windowID:`${Y.threadID}:0`})}}catch{}return X}function Cb(X){let J=OL(),$=`${J}.tmp-${process.pid}`;try{oI(y7(),{recursive:!0});let Y={version:1,sessions:Object.fromEntries([...X.entries()].map(([G,Q])=>[G,{threadID:Q.threadID}]))};Xb($,`${JSON.stringify(Y,null,2)}
-`,"utf8"),tI($,J)}catch{}}function fX(X,J){return s(X)&&(X.type==="message"||("role"in X))&&X.role===J}function Eb(X,J,$){if(!X.input)return J.length>0;let Y=X.canonicalInput??P1(X.input);if(v3(Y,$)===void 0)return!0;return J.slice(X.input.length).some((Q)=>fX(Q,"user")||fX(Q,"developer"))}function Sb(X,J){let $=Array.isArray(J?.input)?J.input:void 0,Y=$?P1($,X.canonicalInput):void 0;if($&&Y&&(Eb(X,$,Y)||!X.turnID))X.turnID=O1(),X.turnStartedAt=Date.now();else if(!X.turnStartedAt)X.turnStartedAt=Date.now();if($&&Y)X.input=$.slice(),X.canonicalInput=w3(Y)}function Ib(X){let J=X.headers.get(gX);if(X.headers.delete(gX),!X.metadata)return{init:X.init};let $=Ab(X.init?.body);if(!X.websocket)Sb(X.metadata,$);else if(!X.metadata.turnStartedAt)X.metadata.turnStartedAt=Date.now();if(!X.metadata.turnStartedAt)X.metadata.turnStartedAt=Date.now();let Y=JSON.stringify({session_id:X.metadata.threadID,thread_id:X.metadata.threadID,thread_source:"user",turn_id:X.metadata.turnID,sandbox:Vb,turn_started_at_unix_ms:X.metadata.turnStartedAt,request_kind:"turn",window_id:X.metadata.windowID});if(X.headers.set("originator","codex_exec"),X.websocket)X.headers.delete("accept"),X.headers.delete("content-type");else X.headers.set("accept","text/event-stream");if(X.headers.set("session-id",X.metadata.threadID),X.headers.delete("x-session-id"),X.headers.delete("x-session-affinity"),X.headers.set("thread-id",X.metadata.threadID),X.headers.set("x-codex-window-id",X.metadata.windowID),X.headers.set("x-client-request-id",X.metadata.threadID),X.headers.set("x-codex-beta-features",Bb),X.headers.set("x-codex-turn-metadata",Y),X.headers.set("user-agent",Hb),X.headers.set("version",MG),X.dumpSessionID)X.headers.set(x9,X.dumpSessionID);let G=$;if(!G)return{init:X.init};let Q=X.responsesLite&&typeof G.model==="string"&&Zb.has(G.model);if(Q&&!X.websocket)X.headers.set("x-openai-internal-codex-responses-lite","true");if(G.prompt_cache_key=X.metadata.threadID,G.parallel_tool_calls??=!0,Array.isArray(G.tools))G.tools=G.tools.map(yb);if(wb(G,X.metadata,J),Q)vb(G);let z={...typeof G.client_metadata==="object"&&G.client_metadata!==null?G.client_metadata:{},"x-codex-installation-id":X.installationID,"x-codex-window-id":X.metadata.windowID};if(X.websocket){if(z["x-codex-turn-metadata"]=Y,z["x-codex-ws-stream-request-start-ms"]=String(Date.now()),Q)z.ws_request_header_x_openai_internal_codex_responses_lite="true"}return G.client_metadata=z,X.headers.delete("content-length"),X.headers.delete("Content-Length"),{init:{...X.init,body:JSON.stringify(t3(G))}}}function bb(X,J){return X.find(($)=>$.enabled!==!1&&v0($)&&($.id===J||$.accountId===J))}function $L(X,J){if(!J)return X;let $={...X};for(let Y of["resetCreditsAvailable","resetCreditsApplicable"]){let G=J[Y];if($[Y]===void 0&&G!==void 0)$[Y]=G}if($.spendControl===void 0&&$.spendControlCleared!==!0&&J.spendControl!==void 0)$.spendControl=J.spendControl;return $}function wX(X,J){if(!X)return X;if(typeof X.checkedAt==="number"&&Number.isFinite(X.checkedAt))return X;return{...X,checkedAt:J}}function ML(X,J,$=Date.now(),Y=J.mainAccountId){let G=X.getMain(),Q=G?.quota;return{main:{quota:Q?{...Q,checkedAt:G.checkedAt,primary:wX(Q.primary,G.checkedAt),secondary:wX(Q.secondary,G.checkedAt)}:null,...typeof Y==="string"?{mainAccountId:Y}:{},killed:!1,...Q?.resetCreditsAvailable!==void 0?{resetCredits:Q.resetCreditsAvailable}:{}},fallbacks:J.accounts.filter((z)=>z.enabled).map((z)=>{let Z=X.getFallback(z.id),W=Z?.quota;return{id:z.id,label:z.label,accountId:Z?.accountId??z.accountId,quota:W?{...W,checkedAt:Z.checkedAt,primary:wX(W.primary,Z.checkedAt),secondary:wX(W.secondary,Z.checkedAt)}:null,killed:!1,enabled:!0,...W?.resetCreditsAvailable!==void 0?{resetCredits:W.resetCreditsAvailable}:{}}}),route:J.routing?.mode??"main-first",lastUpdated:$}}function un(X,J,$,Y=Date.now()){return{...ML(X,J,Y),activeId:$}}function YL(X,J){if(J?.headers!==void 0)return new Headers(J.headers);if(X instanceof Request)return new Headers(X.headers);return new Headers}async function OG(X,J){if(!(X instanceof Request))return J;let $=new Request(X,J),Y=$.method.toUpperCase(),G=Y==="GET"||Y==="HEAD"||$.body===null?void 0:await $.text();return{method:$.method,headers:new Headers($.headers),body:G,signal:$.signal,cache:$.cache,credentials:$.credentials,integrity:$.integrity,keepalive:$.keepalive,mode:$.mode,redirect:$.redirect,referrer:$.referrer,referrerPolicy:$.referrerPolicy}}function GL(X){return X.get("x-session-affinity")??X.get("x-opencode-session")??X.get("x-session-id")??X.get("session-id")??void 0}function AG(X){if(Array.isArray(X)){let $=X;for(let Y=0;Y<X.length;Y++){let G=AG(X[Y]);if(G===X[Y])continue;if($===X)$=X.slice();$[Y]=G}return $}if(!s(X))return X;let J=X;for(let $ of Object.keys(X)){if(X.type==="input_image"&&$==="detail"){if(J===X)J={...X};delete J[$];continue}let Y=AG(X[$]);if(Y===X[$])continue;if(J===X)J={...X};J[$]=Y}return J}var kb=new Set(["gpt-6-astra","gpt-6-sol","gpt-6-luna","gpt-6.1-sol"]),gX="x-openai-auth-agent",xb=new Set(["title","compaction","summary"]);function wb(X,J,$){if($!==null&&xb.has($))return;let Y=typeof X.model==="string"?X.model:"";if(!kb.has(Y))return;let G=s(X.reasoning)?X.reasoning:void 0,Q=typeof G?.effort==="string"?G.effort:void 0;if(!Q)return;let z=Array.isArray(X.input)?X.input:void 0;J.effortUpdates??=[];let Z=J.effortUpdates,W=(j)=>sI("sha256").update(F4(j)).digest("hex").slice(0,16);if(J.pinnedEffort===void 0||Z.some((j)=>!z||!fX(z[j.anchor],"user")||W(z[j.anchor])!==j.fingerprint)){J.pinnedEffort=Q,J.effortUpdates=[];return}if(!z||z.length===0)return;let B=z.findLastIndex((j)=>fX(j,"user")),H=Z.at(-1),U=H?.effort??J.pinnedEffort;if(B>=0&&Q!==U)if(H?.anchor===B){let j=Z.at(-2)?.effort??J.pinnedEffort;if(Q===j)Z.pop();else H.effort=Q}else Z.push({anchor:B,fingerprint:W(z[B]),effort:Q});else if(B<0&&Q!==U)return;if(Z.some((j,N)=>N>0&&j.anchor<=(Z[N-1]?.anchor??-1))){J.pinnedEffort=Q,J.effortUpdates=[];return}X.reasoning={...G,effort:J.pinnedEffort};for(let j=Z.length-1;j>=0;j--){let N=Z[j];if(!N)continue;z.splice(N.anchor,0,{type:"configuration_update",reasoning:{effort:N.effort}})}}function vb(X){let J=s(X.reasoning)?{...X.reasoning}:{};J.context="all_turns",X.reasoning=J,X.parallel_tool_calls=!1;let $=AG(Array.isArray(X.input)?X.input:[]),G=[{type:"additional_tools",role:"developer",tools:Array.isArray(X.tools)?X.tools.filter((Q)=>!(s(Q)&&Q.type==="web_search")):[]}];if(typeof X.instructions==="string"&&X.instructions.length>0)G.push({type:"message",role:"developer",content:[{type:"input_text",text:X.instructions}]});X.input=[...G,...$],delete X.tools,delete X.instructions}function yb(X){if(!s(X))return X;if(X.type!=="function")return X;let J=s(X.parameters)&&"$schema"in X.parameters?(()=>{let{$schema:W,...B}=X.parameters;return B})():X.parameters,{type:$,name:Y,description:G,strict:Q,parameters:z,...Z}=X;return{type:$,name:Y,description:G,strict:Q??!1,parameters:J,...Z}}async function hb(X,J={}){let $=J.codexApiEndpoint??c6().codexApiEndpoint,Y=crypto.randomUUID(),G=Rb(),Q=()=>Cb(G),z=!1,Z=!1,W=[],B=null,H=_H(X.client),U=new Map,j=new Map,N,K=!1,q,F=new Map,O,_,C=EV({host:"opencode",stateDir:J.vault?.stateDir??sW(M0(V0()).statePath),...X.directory?{projectRoot:X.directory}:{},reservedRouteIds:()=>i?.peek().rows.map((h)=>h.id)??[],...J.vault?.connectionFile?{connectionFile:J.vault.connectionFile}:{},...J.vault?.connectScoped?{connectScoped:J.vault.connectScoped}:{},...J.vault?.connectEnrollment?{connectEnrollment:J.vault.connectEnrollment}:{},...J.vault?.pollIntervalMs!==void 0?{pollIntervalMs:J.vault.pollIntervalMs}:{},fetchImpl:()=>fetch},M0(V0())),L=C.vault;await L.authority();let P=C.firstRoster,A=Promise.withResolvers(),T=Promise.race([P,A.promise]),k=J.vault?.firstRosterWaitMs??e$,p,i,{enabled:X0,...w}=J.poolMigration??{},J0=X0??_b;if(J0&&"reason"in H)(w.log??Z0("pool")).warn("account pool migration is off for this OpenCode client",{reason:H.reason});let G0=J0&&"slot"in H?QV({paths:()=>M0(V0()),slot:H.slot,version:k9,...w,runDeps:{vaultServes:()=>L.serves(),...w.runDeps},paused:async()=>await L.authority()!=="local",migrate:async(h)=>{let o=await(w.migrate??d7)(h);return i?.load(),o},adopt:async(h)=>{if(!await I3(T,k))return{status:"retry",reason:"vault-roster-pending"};let o=await(w.adopt??i7)(h);return i?.load(),o}}):void 0,L0=(h,o="")=>h?async()=>{let e=await h();return{url:e.url,instructions:e.instructions??o,method:"auto",callback:async()=>{try{let c=await e.tokens;return{type:"success",refresh:c.refresh_token,access:c.access_token,expires:Date.now()+(c.expires_in??3600)*1000,accountId:Z8(c)}}finally{e.cleanup?.()}}}}:void 0,m=new i$(J.backgroundQuota),c0,m0=wH({client:X.client,getAuth:async()=>c0?.(),fetchImpl:fetch,dependencies:{...J.login?.authorize?{authorizeBrowser:L0(J.login.authorize.browser,"Complete authorization in your browser. This window will close automatically."),authorizeHeadless:L0(J.login.authorize.headless)}:{}},vault:L,onMainSlotWritten:async()=>{await G0?.requestAdoption()}}),r=(h)=>async(o)=>{let e=await h(o);if(e.method!=="auto")return e;return{...e,callback:async()=>{let c=await e.callback();if(c.type==="success"&&"refresh"in c)a(c.refresh);return c}}};async function a(h){if(!G0||!("slot"in H))return;let o=J.login?.sleep??((e)=>Bun.sleep(e));for(let e=0;e<5000;e+=100){try{let c=await H.slot.get({path:{id:"openai"}});if(s(c)&&c.refresh===h){await G0.requestAdoption();return}}catch{}await o(100)}}let u0=m0.map((h)=>h.type==="oauth"?{...h,authorize:r(h.authorize)}:h);async function t(h,o){let e=X.client.session;if(typeof e?.promptAsync==="function"){let c=await tV(X.client,h),D0={noReply:!0,parts:[{type:"text",text:o,ignored:!0}]};if(c?.agent)D0.agent=c.agent;if(c?.model)D0.model=c.model;if(c?.variant)D0.variant=c.variant;await e.promptAsync({path:{id:h},body:D0});return}}return{async dispose(){C.release(),G0?.dispose(),i?.dispose(),m.stop(),_?.stop(),N?.stopBackgroundRefresh(),N=void 0;for(let e of W)e.close();W.length=0;let h=globalThis;for(let[e,c]of U)if(h.__openaiAuthCacheKeepManagers?.get(e)===c)c.stop(),h.__openaiAuthCacheKeepManagers.delete(e);U.clear();for(let e of j.values())await e.release().catch(()=>{});j.clear();let o=p;p=void 0,await(await o)?.release()},async event(h){if(h.event.type!=="session.deleted")return;let o=h.event.properties.info,e=G.get(o.id);if(e)B?.cacheKeepManager?.remove(e.threadID);if(G.delete(o.id))Q();let c=p8(o.id);if(F.delete(c),_?.cancel(`pin:${c}`),q){let D0=(await b0(M0(V0())))?.accounts;await KL(o.id,D0,q).catch(()=>{})}for(let D0 of W)D0.remove(o.id)},provider:{id:"openai",async models(h,o){if(o.auth?.type!=="oauth")return h.models;let e=await b0(M0(V0())),c=!e||UW(e),D0=c?null:await sV();if(!c&&D0&&!eq)eq=!0,tq.debug("restoring OAuth model costs from models.dev catalog");if(!c&&!D0&&!XL)XL=!0,tq.warn("models.dev catalog unavailable; OAuth model costs could not be restored");return Object.fromEntries(Object.entries(h.models).filter(([,l0])=>l0.options.reasoningMode!=="pro"&&Gb(l0.api.id)).map(([l0,i6])=>[l0,{...i6,cost:c?{input:0,output:0,cache:{read:0,write:0}}:D0?.[i6.api.id]??D0?.[l0]??i6.cost,limit:Qb(i6.id)??i6.limit}]))}},auth:{provider:"openai",async loader(h){await L.authority(),c0=h,p??=TV({version:k9,logger:Z0("heartbeat")}),await p,G0?.start();let o=await h();if(o.type!=="oauth")return A.resolve(),{};let e=C3(o).kind==="tombstone";C.start();let c=X.directory?await zL(X.directory):void 0,D0=c?.dir??V0();async function l0(D,M={}){if(await L.authority()!=="local")return;return Ob(D,{...M,canWrite:()=>!L.enrolled()})}let i6=await L.authority()!=="local";if(!e&&!i6)await MW({type:"oauth",access:o.access??"",refresh:o.refresh??"",expires:o.expires??0},M0(V0()));let n0=await b0(M0(V0())).catch(async(D)=>{if(await L.authority()!=="local")return null;let M=V0();throw Error(`OpenAI auth store at ${M} is corrupt or unreadable: ${D instanceof Error?D.message:String(D)}. Fix or remove it to continue.`,{cause:D})});if(!i6&&await l7(M0(V0()),o)){if(G0)G0.noticePlaceholderWithoutMain();else if(!K)K=!0,Z0("pool-migration").warn(U4,{reason:"placeholder-without-main"})}let F6,h6=n0;async function p0(){let D=V0(),M;try{M=eI(D)}catch{M=void 0}if(M&&F6?.path===D&&F6.mtimeMs===M.mtimeMs&&F6.size===M.size)return F6.storage;if(!M)F6=void 0;let R=b0(M0(D)).catch(async(I)=>{if(await L.authority()!=="local")return h6;throw I}).then((I)=>{if(M)F6={path:D,mtimeMs:M.mtimeMs,size:M.size,storage:I};return h6=I,I});return GX(R,YX,()=>h6)}function F8(){F6=void 0}if(n0&&o.access&&!e&&!i6){let D=Z8({id_token:"",access_token:o.access,refresh_token:o.refresh??""});if(D&&D!==n0.mainAccountId)await l0((M)=>{M.mainAccountId=D}),n0.mainAccountId=D,F8()}let T4=n0?.logging?.level;if(T4&&typeof T4==="string")XX(T4);let R4=Z0("transport"),J8=Z0("quota"),e3=Z0("refresh"),P8=Z0("accounts");R4.info("codex auth loader ready",{codexApiEndpoint:$,transport:c6().rawWebSocket?"raw-websocket":c6().webSockets?"websocket":"http"});let U0=new k8({storage:n0,configPath:V0(),fetchQuotaFn:void 0}),C4,E4=0;i?.dispose();let d0=new XY({paths:()=>M0(V0()),refreshProvider:async(D)=>{let M=await Q3({refreshToken:D.refresh,fetchImpl:fetch,now:Date.now}),R=Z8({id_token:"",access_token:M.access,refresh_token:M.refresh});return{...M,...R?{identity:R}:{}}},pullQuota:async(D)=>{let M=D.credential;if(M.type!=="oauth"||!M.access)throw Error("the row holds no access token to poll with");let R=await b8({accessToken:M.access,fetchImpl:fetch,now:Date.now,...D.identity?{accountId:D.identity}:{},accountKey:D.id,logger:J8}),I=Date.now(),S={quota:R,refreshAfter:I+300000,checkedAt:I};if(D.id==="main")U0.setMain(M.access,S,D.identity,!0);else U0.setFallback(D.id,S,M.access,!0,D.identity);return I9(R,I,!0)},vaultIdentities:()=>L.identities(),vaultMode:()=>L.enrolled(),vaultAuthority:()=>L.authority(),vaultFirstRoster:P,vaultFirstRosterBackgroundWaitMs:k,log:Z0("pool")});if(i=d0,!i6)await d0.load();let n6=new eJ({paths:M0(V0()),refreshFn:async(D)=>{if(await L.authority()!=="local")throw Error(D1["vault-refused"]);return Q3({refreshToken:D.refreshToken,fetchImpl:D.fetchImpl,now:D.now})},quotaManager:U0,canWrite:()=>!L.enrolled(),onFallbackStorageChanged:F8,backgroundRefreshPaused:async()=>L.enrolled()||await d0.active()});if(n0&&n0.accounts.length>0)n6.startBackgroundRefresh();function mX(D){if(T0(D))return;return D.access||void 0}function X2(D={}){let{readSidebarState:M,respectBackoff:R,skipFresherThanMs:I}=D;return{getAuth:h,codexRefreshFn:Q3,refreshMainWithLease:yG,fallbackManager:n6,quotaManager:U0,loadAccounts:b0,writeSidebarState:O8,client:X.client,fetchImpl:fetch,now:Date.now,paths:M0(V0()),readSidebarState:M??(()=>WL(I6)),storageMainAccountId:n0?.mainAccountId,isOAuthAccountFn:v0,whamFn:b8,...R===void 0?{}:{respectBackoff:R},...I===void 0?{}:{skipFresherThanMs:I}}}async function RG(D){return(await d0.pollRows(await b0(M0(V0())),D?{ids:D}:{})).map((R)=>({account:R.id,ok:R.ok,...R.error!==void 0?{error:R.error}:{}}))}async function CG(D){return d0.accessFor(D,await b0(M0(V0())))}let EG=Z0("cachekeep"),J2=P7(n0),SG=J2?.enabled===!0,IG=J2?.subagents===!0,bG=J2?.sustain===!0,kG=eH(n0?{...n0,cachekeep:J2}:n0),$2;async function _L(D){await new Promise((M)=>setTimeout(M,D))}async function AL(D){let M;for(let R=1;R<=rq;R++){if(await L.authority()!=="local")throw Error(D1["vault-refused"]);try{await X.client.auth.set({path:{id:"openai"},body:{type:"oauth",refresh:D.refresh,access:D.access,expires:D.expires}});return}catch(I){if(M=I,R<rq)await _L(Nb*R)}}throw new TG(M)}async function Y2(D){await l0((M)=>{M.refresh=M.refresh??{},D(M)},{holdsMainRefreshLock:!0}),F8()}async function uX(D){let M=Date.now()+jb;while(Date.now()<M){await new Promise((S)=>setTimeout(S,oq+Mb(oq)));let R=await h();if(C6(R))throw new L1;if(R.type!=="oauth"||!R.access)continue;if((R.access!==D.access||R.refresh!==D.refresh||(R.expires??0)>(D.expires??0)+60000)&&(!R.expires||R.expires>Date.now()))return e3.debug("joined concurrent main refresh",{pid:process.pid,expiresInMs:R.expires?R.expires-Date.now():void 0}),{access:R.access,refresh:R.refresh??D.refresh??"",expires:R.expires??0}}return null}function xG(D){if(C6(D))throw new L1;if(D.type!=="oauth")throw Error("not oauth");if(T0(D))throw new G1;if(!D.refresh)throw Error("Token refresh failed: missing refresh token");return D.refresh}async function pX(){if(!$2)$2=(async()=>{let D=await h(),M=xG(D);if(D.type!=="oauth")throw Error("not oauth");let R=s6(M),I=await b0(M0(V0())),S=I?.refresh?.mainLastRefreshError;if(S&&r0(S,M,Date.now()))throw Error(X9(S,Date.now()));if(I?.refresh?.mainRefreshLeaseUntil&&I.refresh.mainRefreshLeaseUntil>Date.now()&&I.refresh.mainRefreshLeaseTokenHash===R){let d=await uX(D);if(d)return d;throw Error("Codex OAuth refresh is already in progress")}let f=await g0({name:g8,ttlMs:Ub,path:V0(),renew:!0});if(!f){let d=await uX(D);if(d)return d;throw Error("Codex OAuth refresh is already in progress")}let b;try{let d=await h(),H0=xG(d);if(d.type!=="oauth")throw Error("not oauth");if(H0!==M){if(d.access&&(d.expires??0)>Date.now())return e3.debug("main token rotated while awaiting the lock",{pid:process.pid}),await f.release().catch(()=>{}),{access:d.access,refresh:H0,expires:d.expires??0};let W6=(await b0(M0(V0())))?.refresh?.mainLastRefreshError;if(W6&&r0(W6,H0,Date.now()))throw Error(X9(W6,Date.now()))}b={...d,refresh:H0}}catch(d){throw await f.release().catch(()=>{}),d}await zH(M0(V0()),b.refresh,b.access!==void 0?{slotAccess:b.access}:{}).catch(()=>!1);let v=s6(b.refresh),n=crypto.randomUUID(),z0=v;try{await Y2((F0)=>{if(QH(V0(),b.refresh))throw new p7;F0.refresh=F0.refresh??{},F0.refresh.mainRefreshLeaseId=n,F0.refresh.mainRefreshLeaseUntil=Date.now()+Kb,F0.refresh.mainRefreshLeaseTokenHash=v});let d=await b0(M0(V0()));if(d?.refresh?.mainRefreshLeaseId!==n||d.refresh.mainRefreshLeaseTokenHash!==v)throw Error("Codex OAuth refresh is already in progress");if(await L.authority()!=="local")throw Error(D1["vault-refused"]);let H0=await Q3({refreshToken:b.refresh,fetchImpl:fetch,now:Date.now});return await AL(H0),await Y2((F0)=>{if(F0.refresh=F0.refresh??{},F0.refresh.mainLastRefreshError=void 0,F0.refresh.mainRefreshLeaseId===n)F0.refresh.mainRefreshLeaseId=void 0,F0.refresh.mainRefreshLeaseUntil=void 0,F0.refresh.mainRefreshLeaseTokenHash=void 0}).catch(()=>{}),z0=void 0,H0}catch(d){if(!(d instanceof p7)){if(!PG(d))await Y2((H0)=>{H0.refresh=H0.refresh??{},H0.refresh.mainLastRefreshError=p1({error:d,now:Date.now(),refreshToken:b.refresh,previous:H0.refresh.mainLastRefreshError})}).catch(()=>{});throw d}}finally{if(z0)await Y2((d)=>{if(d.refresh?.mainRefreshLeaseId===n&&d.refresh.mainRefreshLeaseTokenHash===z0)d.refresh.mainRefreshLeaseId=void 0,d.refresh.mainRefreshLeaseUntil=void 0,d.refresh.mainRefreshLeaseTokenHash=void 0}).catch(()=>{});await f.release().catch(()=>{})}let l=await uX(b);if(l)return l;throw Error("Codex OAuth refresh is already in progress")})().finally(()=>{$2=void 0});return $2}function wG(D){return AH({storage:D,now:Date.now,refreshAccount:(M,R)=>n6.refreshAccount(M,R,{asPoolMain:!0}),warn:(M,R)=>e3.warn(M,{pid:process.pid,...R})})}async function vG(){let D=await wG(await b0(M0(V0())));if(!D)throw Error("The main OpenAI account has no usable token in the account pool");return{access:D.token,refresh:D.account.refresh,expires:D.account.expires??0}}async function yG(){try{return await pX()}catch(D){if(D instanceof L1)return vG();throw D}}let hG=globalThis,cX=hG.__openaiAuthCacheKeepManagers??new Map;hG.__openaiAuthCacheKeepManagers=cX,cX.get(D0)?.stop();let S4=$V({fetchImpl:fetch,vault:L,getMainToken:async()=>{if(await L.authority()!=="local")throw Error("local accounts are not warmed while this host is connected to the vault");if(await d0.active()){let M=await CG("main");if(!M)throw Error("main pool row has no usable token");return M.token}let D=await h();if(await L.authority()!=="local")throw Error("local accounts are not warmed while this host is connected to the vault");if(C6(D))return(await vG()).access;if(D.type!=="oauth")throw Error("not oauth");if(!D.access||(D.expires??0)<Date.now())try{return(await yG()).access}catch(M){if(PG(M))throw M;if(D.access)return D.access;throw Error("main token refresh failed")}return D.access},refreshFallback:async(D)=>{if(await L.authority()!=="local")throw Error("local accounts are not warmed while this host is connected to the vault");if(await d0.active()){let b=await CG(D);if(!b)throw Error(`no access token for ${D}`);return{token:b.token}}let M=await p0(),R=M?bb(M.accounts,D):void 0;if(!R)throw Error(`fallback account ${D} not found`);let I=M??{version:1,accounts:[R]},S=T0(R)?R:await n6.refreshAccount(R,I),f=mX(S);if(!f)throw Error(`no access token for ${D}`);return{token:f}},codexResponsesUrl:$,activeAccount:async(D)=>JV(C1(await u9.read(),F),D),logger:EG,now:Date.now,getWindow:()=>kG,getSustain:()=>bG});cX.set(D0,S4),U.set(D0,S4);function E1(D,M,R,I,S=!1){try{TL(D,M,R,I,S)}catch(f){J8.warn("quota push failed",{pid:process.pid,accountId:R??"main",error:e0(f)})}}function TL(D,M,R,I,S){if(Object.keys(D).length===0&&!S)return;let f=Date.now(),b=D,v={quota:b,refreshAfter:f+300000,checkedAt:f},n;if(R&&R!=="main"){let l=M?V6(M):null,d=l?U6(l):void 0,H0=U0.peekFallbackForPolicy(R)?.quota,F0=$L(b,H0);v={...v,quota:F0},U0.setFallback(R,v,M,S,d)}else{if(n=I,!n&&M){let H0=V6(M);n=H0?U6(H0):void 0}if(n&&C4&&n!==C4){J8.debug("stale main quota frame dropped",{pid:process.pid,frameAccountId:n,currentMainIdentity:C4});return}let l=U0.peekMainForPolicy(n)?.quota,d=$L(b,l);v={...v,quota:d},U0.setMain(M,v,n,S)}J8.debug("quota pushed",{pid:process.pid,accountId:R??"main",snapshot:v.quota}),d0.recordSnapshot(R&&R!=="main"?R:"main",D,M,S);let z0=Boolean(R&&R!=="main");l8.enqueue("machine-state","quota",()=>{let l=h6;return O8(U0,l,z0?l?.mainAccountId:n)})}function RL(D,M,R){let I=K8(L.routes().find((S)=>S.id===D)?.quota)??(D==="main"?U0.peekMainForPolicy()?.quota:U0.peekFallbackForPolicy(D)?.quota);return $W(I,M,Date.now(),qb,R)}let G2=new Map,I4=new Map;function fG(){if(!L.enrolled())return;l8.enqueue("machine-state","quota",()=>O8(U0,h6))}let S1=J.experimentalWebSockets?N9.createWebSocketFetch({httpFetch:fetch,rawWebSocket:c6().rawWebSocket,onQuota:(D,M,R,I)=>{let S=R?G2.get(R):void 0;if(S){L.recordSnapshot(S.id,D,!0,S.receipt).then(fG);return}E1(D,M,R,!R||R==="main"?I:void 0,!0)},onRateLimitReached:(D,M,R)=>{if(!M)J8.warn("mid-stream rate-limit mark missing internal account id; defaulting to main",{pid:process.pid,window:D});let I=M?G2.get(M):void 0,S=I?.id??M??"main",f=RL(S,D,R);if(U0.markRateLimited(S,f),I)I4.set(S,Math.max(I4.get(S)??0,f));else d0.markRateLimited(S,f);J8.debug("mid-stream rate limit mark",{pid:process.pid,accountId:S,window:D})}}):void 0;if(S1)W.push(S1),z=!0;let I6=ZL();q=I6;async function O8(D,M,R=M?.mainAccountId){if(L.enrolled()){await vX(FV(L.snapshot()?.rows??[],new Set(L.routes().map((S)=>S.id)),M,Date.now()),I6,{canWrite:()=>L.enrolled()});return}let I=await d0.current();if(I.active){await vX(PV(I.rows,M,Date.now(),(S)=>(S==="main"?D.getMain():D.getFallback(S))?.quota?.resetCreditsAvailable),I6,{canWrite:()=>!L.enrolled()});return}if(!M)return;await vX(ML(D,M,Date.now(),R),I6,{canWrite:()=>!L.enrolled()})}let u9=LL(I6);u9.read(),_?.stop();let l8=FL({logger:R4,onWritten:()=>u9.refreshInBackground()});if(_=l8,O!==I6)F.clear(),O=I6;function lX(D,M,R,I,S,f,b=!1){let v={canWrite:()=>L.enrolled()===b},n={activeId:R,route:I,updatedAt:Date.now()};if(!D){l8.enqueue("routing:legacy","routing",()=>UL(n,I6,v));return}if(l8.enqueue(`routing:${D}`,"routing",()=>yX({sessionId:D,...n},S,I6,v)),!M||M===D)return;if(I==="sticky-balanced"){let z0=f.stickyAssignments?.[p8(M)]?.accountId,l=S===void 0||z0==="main"||S.some((d)=>d.enabled!==!1&&d.id===z0);if(!z0||!l)return;l8.enqueue(`routing:${M}`,"routing",()=>yX({sessionId:M,activeId:z0,route:I,updatedAt:Date.now()},S,I6,v));return}l8.enqueue(`routing:${M}`,"routing",()=>yX({sessionId:M,...n},S,I6,v))}N?.stopBackgroundRefresh(),N=n6;let b4=M0(V0());if(B=PL={accountStoragePath:b4.configPath,accountStatePath:b4.statePath,packageVersion:k9,quotaManager:U0,loadAccounts:b0,beginAccountLogin:v2,store:()=>V4(b4),migration:async()=>{if(await s7(b4,V4(b4))!==void 0)return{migrated:!0};let D=await(w.fence??(()=>j4({currentVersion:k9})))();return{migrated:!1,blockers:D.open?[]:D.blockers.map((M)=>({pid:M.pid,version:M.version}))}},afterWrite:()=>d0.load(),vault:L,resolveResetTarget:Fb({getAuth:h,refreshMainWithLease:pX,refreshFallbackAccount:(D,M)=>n6.refreshAccount(D,M),refreshPoolMainRow:(D,M)=>n6.refreshAccount(D,M,{asPoolMain:!0}),poolAccess:async(D)=>d0.rowAccess(D,await b0(M0(V0()))),loadAccounts:b0,accountStoragePath:V0(),accountStatePath:x$(V0()),now:Date.now}),...Pb(),cacheKeepManager:S4,setCacheKeepEnabled:(D)=>{SG=D},setCacheKeepSubagents:(D)=>{IG=D},setCacheKeepSustain:(D)=>{bG=D},setCacheKeepWindow:(D)=>{kG=D},clearStickyRouting:async(D)=>{let M=p8(D),R=F.delete(M);return l8.cancel(`pin:${M}`),await qL(D,I6)||R},getStickyRouting:async(D)=>VL(C1(await u9.read(),F),D),refreshSidebar:async()=>{let D=await b0(M0(V0()));await O8(U0,D)},refreshAllQuota:async()=>{if(await L.authority(),L.enrolled()){let D=await L.pollStale(0);return await O8(U0,h6),D.map((M)=>({account:M.id,ok:M.ok,...M.error!==void 0?{error:M.error}:{}}))}if(await d0.active()){let[D,M]=await Promise.all([RG(),L.pollStale(0)]);return await O8(U0,h6),[...D,...M.map((R)=>({account:R.id,ok:R.ok,...R.error!==void 0?{error:R.error}:{}}))]}return G4(X2())},refreshResetTargetQuota:async(D)=>{if(await L.authority(),L.enrolled())return{account:D,ok:!1,error:"local accounts are not polled while this host is connected to the vault"};if(await d0.active()){let[R]=await RG([D]);return R??{account:D,ok:!1,error:"targeted quota refresh returned no result"}}return(await G4(X2({respectBackoff:!1}),{accountKey:D})).find((R)=>R.account===D)??{account:D,ok:!1,error:"targeted quota refresh returned no result"}}},c){let D=c;try{let M=await QL(XU,D.dir,()=>JU({dir:D.dir,secureDir:D.secureDir,sweepRoot:D.sweepRoot,drain:gH,apply:async(R)=>{let I=S5(R);if(!I)throw Error("not an /openai apply request");return dH(B,I)}}));j.set(D.dir,M)}catch{}}async function I1(D,M,R,I,S="main",f){if(!R.trim())throw R4.warn("refusing to send a request with no access token",{account:S,accountId:I}),Error(zb);if(!f&&await L.authority()!=="local")return Response.json({error:{message:D1["vault-refused"]}},{status:400});let b=YL(D,M);if(b.delete("x-api-key"),b.delete("api-key"),b.set("authorization",`Bearer ${R}`),I)b.set("ChatGPT-Account-Id",I);b.set(N9.QUOTA_ACCOUNT_HEADER,S);let v=GL(b),n=v?Tb(G,v,Q):void 0,z0=D instanceof URL?D:new URL(typeof D==="string"?D:D.url),l=z0.pathname.includes("/v1/responses")||z0.pathname.includes("/chat/completions")?new URL($):z0,H0=Ib({init:{...M,headers:b},headers:b,metadata:n,installationID:Y,websocket:Boolean(S1&&z0.pathname.endsWith("/responses")),responsesLite:J.responsesLite??!1,dumpSessionID:v}).init,F0=SG,W6=new Headers(H0?.headers),W0=tH({enabled:F0,includeSubagents:IG,headers:W6,body:H0?.body});if(F0)EG.trace("cachekeep headers",{pid:process.pid,hasParent:W6.has("x-parent-session-id"),sessionKey:W0?.sessionKey,captured:Boolean(W0),affinity:W6.get("x-session-affinity"),opencodeSession:W6.get("x-opencode-session"),sessionId:W6.get("session-id")});if(S1&&z0.pathname.endsWith("/responses")){if(R4.debug("WS transport",{pid:process.pid,pathname:z0.pathname,accountId:S}),W0)S4.track({sessionKey:W0.sessionKey,bodyText:W0.bodyText,accountId:S,isSubagent:W0.isSubagent,meta:{replayHeaders:W0.replayHeaders,chatgptAccountId:I,routingSessionId:v}});if(!f)try{return await j1(await S1(l,H0),R,"event-stream")}catch(i0){throw j8(i0,R)}let P0=`vault-stream:${aI()}`;G2.set(P0,{id:S,receipt:f});let M8=new Headers(H0?.headers);M8.set(N9.QUOTA_ACCOUNT_HEADER,P0);let P6=()=>G2.delete(P0);try{let i0=await S1(l,{...H0,headers:M8});if(!i0.body)return P6(),i0;let d8=i0.body.getReader();return await j1(new Response(new ReadableStream({async pull(i8){try{let n8=await d8.read();if(n8.done)P6(),i8.close();else i8.enqueue(n8.value)}catch(n8){P6(),i8.error(j8(n8,R))}},cancel(i8){return P6(),d8.cancel(i8)}}),{status:i0.status,statusText:i0.statusText,headers:i0.headers}),R,"event-stream")}catch(i0){throw P6(),j8(i0,R)}}let R0=N9.withoutInternalHeaders(H0);if(typeof R0?.body!=="string")try{return await j1(await fetch(l,R0),R,"event-stream")}catch(P0){throw j8(P0,R)}if(W0)S4.track({sessionKey:W0.sessionKey,bodyText:W0.bodyText,accountId:S,isSubagent:W0.isSubagent,meta:{replayHeaders:W0.replayHeaders,chatgptAccountId:I,routingSessionId:v}});R4.debug("HTTP transport",{pid:process.pid,pathname:z0.pathname,accountId:S});try{let P0=await fetch(l,R0);return await q4({sessionID:v,transport:"http",phase:"http",bodyText:R0.body,accountId:S,url:l.toString(),method:R0.method,headers:R0.headers,status:P0.status}),await j1(P0,R,"event-stream")}catch(P0){throw await q4({sessionID:v,transport:"http",phase:"http",bodyText:R0.body,accountId:S,url:l.toString(),method:R0.method,headers:R0.headers,error:P0 instanceof Error?P0.message:String(P0)}),j8(P0,R)}}function k4(D,M){if((M?.method??(D instanceof Request?D.method:"GET")).toUpperCase()!=="POST")return!1;if(typeof M?.body!=="string")return!1;try{let I=D instanceof URL?D.toString():typeof D==="string"?D:D.url;return new URL(I).pathname.endsWith("/responses")}catch{return!1}}function CL(D){return U0.peekMainForPolicy(D)?.quota}function gG(D,M){for(let R of[D?.primary?.checkedAt,D?.secondary?.checkedAt,D?.checkedAt,M])if(typeof R==="number"&&Number.isFinite(R))return R;return}function x4(D,M,R,I,S){let f=gG(D,M),b=gG(R),v=I===S&&R!=null&&(D===void 0||b!==void 0&&(f===void 0||b>f));return{quota:v?R:D,quotaCheckedAt:v?b:f,source:v?"file":"memory"}}function mG(D,M,R,I,S){let f=D?.quota,b=x4(f,D?.checkedAt,M,I,S),v=b.source,n=b.quota;if(!HL(n,R))return{exhausted:!1};let z0=BL(n,R);if(!z0)return{exhausted:!1};return{exhausted:!0,source:v,...z0}}function uG(D,M){J8.debug("admission skip: exhausted account",{accountId:D,source:M.source,resetsAt:M.resetsAt})}function pG(D,M="killswitch",R,I){let S=Date.now(),f=I?I.main:U0.getMain()?.quota,b=I?I.fallbacks:(D?.accounts??[]).filter((d)=>d.enabled!==!1&&v0(d)).map((d)=>({accountId:d.id,quota:U0.getFallback(d.id)?.quota})),v=OW(f,b,S,D);if(M==="quota-unknown")v=WV;else if(M==="quota-exhausted"&&R!==void 0)v=Math.max(1,Math.ceil((R-S)/1000));else if(M==="mid-stream-rate-limit"&&R!==void 0){let d=Math.max(1,Math.ceil((R-S)/1000));v=Math.min(v,d)}let n=Math.floor(v/60),z0=v%60,l=M==="mid-stream-rate-limit"?`OpenAI rate limit reached — retrying on another account. Retry in ${n}m ${z0}s.`:M==="quota-exhausted"?`OpenAI quota exhausted — retrying on another account. Retry in ${n}m ${z0}s.`:M==="quota-unknown"?`OpenAI quota is not known yet for any available account; checking it now. Retry in ${n}m ${z0}s.`:`Killswitch: all OpenAI accounts are below their configured quota threshold. Retry in ${n}m ${z0}s.`;return new Response(JSON.stringify({error:{message:l,type:"rate_limit_exceeded",code:"rate_limit_exceeded"}}),{status:429,headers:{"content-type":"application/json","retry-after":String(v)}})}function dX(D){let M=D?.resetCreditsAvailable;return typeof M==="number"&&Number.isFinite(M)?M:void 0}async function EL(D){let M=z9(D.storage),R=Date.now(),I=U0.peekMainForPolicy(D.mainAccountIdentity),S=x4(I?.quota,I?.checkedAt,D.sidebarState.main.quota,D.sidebarState.main.mainAccountId,D.mainAccountIdentity),f=M?Z1(I?.quota,D.storage,void 0,R):void 0,b=D.mainUnavailable?[]:[{accountId:"main",wireAccountId:D.mainAccountIdentity,access:D.primaryAccess,keepwarmAccountKey:"main",quota:S.quota,quotaCheckedAt:S.quotaCheckedAt,reservePercent:a6(D.storage),configuredOrder:0,resetCreditsApplicable:dX(S.quota),killswitchPasses:f}],v=await n6.getUsableFallbackAccounts(D.storage);if(!D.storage)return b;for(let n of v){let z0=mX(n);if(!z0)continue;let l=D.sidebarState.fallbacks.find((W6)=>W6.id===n.id),d=U0.peekFallbackForPolicy(n.id,n.accountId),H0=x4(d?.quota,d?.checkedAt,l?.quota,l?.accountId,n.accountId),F0=M?Z1(d?.quota,D.storage,n.id,R):void 0;b.push({accountId:n.id,wireAccountId:n.accountId,access:z0,keepwarmAccountKey:n.id,fallback:n,quota:H0.quota,quotaCheckedAt:H0.quotaCheckedAt,reservePercent:a6(D.storage,n.id),configuredOrder:b.length,resetCreditsApplicable:dX(H0.quota),killswitchPasses:F0})}return b}function cG(D,M,R,I,S){let f=z9(S)?D.killswitchPasses:void 0;if(D.accountId==="main"){let z0=U0.peekMainForPolicy(D.wireAccountId),l=x4(z0?.quota,z0?.checkedAt,M.main.quota,M.main.mainAccountId,D.wireAccountId);return VY({quota:l.quota,quotaCheckedAt:l.quotaCheckedAt,status:R,now:I,killswitchPasses:f})}let b=M.fallbacks.find((z0)=>z0.id===D.accountId),v=U0.peekFallbackForPolicy(D.accountId,D.wireAccountId),n=x4(v?.quota,v?.checkedAt,b?.quota,b?.accountId,D.wireAccountId);return VY({quota:n.quota,quotaCheckedAt:n.quotaCheckedAt,status:R,now:I,killswitchPasses:f})}function SL(D){return D.accountId==="main"?"main":D.keepwarmAccountKey}function lG(D){return U0.isRateLimited(SL(D))}function iX(D){let M=D.candidates.filter((f)=>!lG(f)),R=new Map(M.map((f)=>[f.accountId,f])),I=new Set(D.excludeAccountIds),S=dG({sessionId:D.sessionId,requestBytes:D.requestBytes,sidebarSnapshot:D.sidebarSnapshot,now:D.now,validPinnedAccountIds:[...R.keys()],excludeAccountIds:D.excludeAccountIds??[],quotaCheckedAtByAccount:Object.fromEntries(M.map((f)=>[f.accountId,f.quotaCheckedAt])),wireAccountIdByAccount:Object.fromEntries(M.map((f)=>[f.accountId,f.wireAccountId])),select:(f)=>{let b=M.filter((v)=>!I.has(v.accountId));if(b.length===0)return;return wV({candidates:b,pendingBytes:f,requestBytes:D.requestBytes,now:D.now,onEmptyWeightedSet:()=>{P8.debug("sticky routing: no fresh weighted candidates; using configured order")}})},persist:!0});return S?R.get(S.accountId):void 0}function dG(D){let M=void 0,R=D.validPinnedAccountIds,I=jL(C1(D.sidebarSnapshot,F),{sessionId:D.sessionId,requestBytes:D.requestBytes,now:D.now,validPinnedAccountIds:R,excludeAccountIds:D.excludeAccountIds,quotaCheckedAtByAccount:D.quotaCheckedAtByAccount,wireAccountIdByAccount:D.wireAccountIdByAccount,choose:(f)=>{let b=D.select(f);if(!b)return;return M={accountId:b.accountId,source:b.source,pendingBytes:f.get(b.accountId)??0},b}}),S=I.assignment;if(!D.persist)return S;if(M&&S?.accountId===M.accountId)P8.debug("sticky routing: placed session pin",{pid:process.pid,sessionHash:p8(D.sessionId),accountId:M.accountId,source:M.source,requestBytes:D.requestBytes,pendingBytes:M.pendingBytes});if(S&&I.next!==void 0){let f=p8(D.sessionId),b=DL(F,f,S);l8.enqueue(`pin:${f}`,"sticky-pin",async()=>{await NL({sessionId:D.sessionId,assignment:S,validPinnedAccountIds:R},I6),b.persistedAt=Date.now()})}return S}async function IL(D,M){let R=await n6.getUsableFallbackAccounts(D),I=[];if(!D)return{current:[],retained:[],skipped:[]};for(let l of R){let d=mX(l);if(!d)continue;I.push({access:d,accountId:l.accountId,keepwarmAccountKey:l.id,quotaAccountId:l.id,fallback:l})}let S=I.filter((l)=>!U0.isRateLimited(l.quotaAccountId)),f=z9(D)?S.filter((l)=>Z1(U0.peekFallbackForPolicy(l.quotaAccountId,l.accountId)?.quota,D,l.quotaAccountId,Date.now())):S,b=new Map(M.fallbacks.map((l)=>[l.id,{quota:l.quota,accountId:l.accountId}])),v=[],n=[],z0=Date.now();for(let l of f){let d=b.get(l.quotaAccountId),H0=mG(U0.peekFallbackForPolicy(l.quotaAccountId,l.accountId),d?.quota,z0,d?.accountId,l.accountId);if(H0.exhausted)n.push({candidate:l,decision:H0});else v.push(l)}return{current:f,retained:v,skipped:n}}function iG(D,M){if(D.retained.length===0&&!M)return D.current;for(let{candidate:R,decision:I}of D.skipped)uG(R.quotaAccountId,I);return D.retained}function nG(D,M){try{let R=o9(D.headers);E1(R,M.access,M.quotaAccountId,void 0,d1(D.headers))}catch{}}async function bL(D,M,R,I){for(let S of I){let f;try{f=await I1(D,M,S.access,S.accountId,S.keepwarmAccountKey)}catch(b){if((b instanceof Error||b instanceof DOMException)&&b.name==="AbortError")throw b;if(M?.signal?.aborted)throw b;throw P8.debug("fallback-first transport failed; request not replayed",{pid:process.pid,accountId:S.quotaAccountId}),b}if(!V3(f.status,R))return n6.markUsed(S.fallback),{response:f,accessToken:S.access,quotaAccountId:S.quotaAccountId,activeId:S.keepwarmAccountKey};nG(f,S),f.body?.cancel().catch(()=>{})}return}async function kL(D,M,R,I,S){if(!k4(D,M))return{response:R};if(!S.length)return{response:R};let f=R,b;for(let v of S){let n;try{n=await I1(D,M,v.access,v.accountId,v.keepwarmAccountKey)}catch(z0){if((z0 instanceof Error||z0 instanceof DOMException)&&z0.name==="AbortError")throw z0;if(M?.signal?.aborted)throw z0;return P8.debug("reactive fallback candidate threw; stopping",{pid:process.pid,accountId:v.quotaAccountId}),{response:f,...b}}if(f.body?.cancel().catch(()=>{}),f=n,b={accessToken:v.access,accountId:v.quotaAccountId},!V3(n.status,I))return n6.markUsed(v.fallback),{response:n,...b};nG(n,v)}return{response:f,...b}}if(n0){let D=[];for(let M of n0.accounts)if(v0(M))D.push(M);U0.seedFallbacksFromAccounts(D)}if(!_G)if(_G=!0,O8(U0,n0).catch(()=>{}),P.then(()=>L.enrolled()?O8(U0,h6):void 0).catch(()=>{}),!L.enrolled()&&!await d0.active())hX=G4(X2({respectBackoff:!0})).catch((D)=>J8.warn("boot quota seed failed",{pid:process.pid,error:e0(D)}));else hX=Promise.resolve();m.start(async()=>{if(await L.authority(),L.enrolled()){await O8(U0,h6);return}if(await d0.active()){let R=await oH(d0,await b0(M0(V0())),()=>d$(V0()));if(R.length>0)await O8(U0,h6);let I=R.filter((S)=>!S.ok);if(I.length>0)J8.warn("background pool quota poll completed with failures",{pid:process.pid,failures:I});return}let M=(await sH(X2({readSidebarState:async()=>(await u9.read()).state}))).filter((R)=>!R.ok);if(M.length>0)J8.warn("background quota refresh completed with failures",{pid:process.pid,failures:M})},(D)=>{J8.warn("background quota refresh failed",{pid:process.pid,error:D instanceof Error?D.message:String(D)})});async function nX(D,M,R,I,S,f){let b=R?.routing?.mode??"main-first",v=L.enrolled(),n=v?void 0:d0.peek().rows.find((W0)=>W0.id==="main"),z0=!n&&!v?await h():void 0,l=!n&&z0?.type==="oauth"&&T0(z0),d=!n&&!v&&await l7(M0(V0()),z0);if(f===E4)C4=n?.identity;let H0=await u9.get(),{response:F0,servedId:W6}=await DV({source:d0,...v?{vault:{routes:()=>L.routes(),awaitRoster:async()=>{await I3(P,t$)},noRouteCause:()=>oW(L),send:(W0,R0)=>L.send(W0,R0,{site:"model",...M?.signal?{signal:M.signal}:{}}),requestReading:(W0)=>L.requestReading(W0),rateLimitMarks:()=>{for(let[W0,R0]of I4)if(R0<=Date.now())I4.delete(W0);return I4}}}:{},storage:R,mode:b,sessionId:I,body:typeof M?.body==="string"?M.body:void 0,replayable:k4(D,M),now:Date.now,send:(W0,R0,P0)=>I1(D,M,R0,W0.identity,W0.id,P0),recordQuota:(W0,R0,P0,M8)=>{try{let P6=o9(W0.headers),i0=d1(W0.headers);if(!R0.row){if(M8)L.recordSnapshot(R0.id,P6,i0,M8).then(fG);return}E1(P6,P0,R0.id==="main"?void 0:R0.id,R0.id==="main"?R0.identity:void 0,i0)}catch{}},placePin:(W0)=>dG({...W0,sidebarSnapshot:H0}),blocked:(W0,R0,P0)=>{if(W0.reason==="no-credential"){if(d&&!zY(P0))throw Error(U4);return new Response(D1[zY(P0)?P0:l?"missing-main":P0??"unusable"],{status:401,headers:{"content-type":"text/plain; charset=utf-8"}})}return pG(R,W0.reason,W0.resetAtMs,R0)},resetCredits:(W0)=>dX(W0==="main"?U0.peekMainForPolicy(n?.identity)?.quota:U0.peekFallbackForPolicy(W0)?.quota),isAbort:(W0)=>(W0 instanceof Error||W0 instanceof DOMException)&&W0.name==="AbortError"||Boolean(M?.signal?.aborted),log:P8});return lX(I,S,W6,b,v?L.routes().map((W0)=>({id:W0.id})):R?.accounts,C1(H0,F),v),F0}return Z=!0,{apiKey:Wb,async fetch(D,M){let R=await L.authority(),I=YL(D,M),S=GL(I),f=I.get("x-parent-session-id")?.trim()||void 0,b=await p0();if(R!=="local")return M=await OG(D,M),nX(D,M,b,S,f,++E4);let v=await h();if(await L.authority()!=="local")return M=await OG(D,M),nX(D,M,b,S,f,++E4);let n=++E4;if(v.type!=="oauth")return I.delete(gX),fetch(D,{...M,headers:I});M=await OG(D,M);let z0=(await d0.current()).active;if(C6(v)&&z0)return nX(D,M,b,S,f,n);if(z0)L.assertHostSlot(v);let l="",d=!1,H0,F0=C6(v);if(G0?.migrated()&&!F0&&v.refresh?.trim()&&C3(v).kind==="real")G0.noticeRealSlot(v.refresh);let W6=async(C0=b)=>{if(F0=!0,H0=await wG(C0),H0)l=H0.token;else l="",d=!0,P8.warn("main account in the pool has no usable token",{pid:process.pid})};if(F0)await W6();else if(T0(v))d=!0;else{if(!v.access||(v.expires??0)<Date.now()){e3.debug("token refresh triggered",{pid:process.pid,hasAccess:Boolean(v.access),expiresInMs:v.expires?v.expires-Date.now():void 0});try{let C0=await pX();v.access=C0.access,v.refresh=C0.refresh,v.expires=C0.expires}catch(C0){if(PG(C0))throw C0;if(C0 instanceof L1)await W6(await b0(M0(V0())))}}if(!F0)l=v.access??""}let W0=F0?oJ(b):b,R0=v,P0=H0?.account.accountId??(F0?void 0:R0.accountId)??(l?U6(V6(l)??{}):void 0);if(n===E4)C4=P0;let M8=b?.routing?.mode??"main-first",P6=await u9.get(),i0=P6.state;if(M8==="sticky-balanced"&&S&&k4(D,M)&&typeof M?.body==="string"){let C0=Buffer.byteLength(M.body,"utf8"),$6=await EL({storage:W0,sidebarState:i0,primaryAccess:l,mainAccountIdentity:P0,mainUnavailable:d}),o0=iX({sessionId:S,requestBytes:C0,candidates:$6,sidebarSnapshot:P6,now:Date.now()});if(o0){let eG=lG(o0)?{action:"migrate",reason:"exhausted"}:cG(o0,i0,void 0,Date.now(),b);if(eG.action==="migrate"){let f6=iX({sessionId:S,requestBytes:C0,candidates:$6,sidebarSnapshot:P6,excludeAccountIds:[o0.accountId],now:Date.now()});if(f6)P8.debug("sticky routing: migrated session pin",{pid:process.pid,sessionHash:p8(S),fromAccountId:o0.accountId,toAccountId:f6.accountId,reason:eG.reason}),o0=f6}let _8=await I1(D,M,o0.access,o0.wireAccountId,o0.keepwarmAccountKey),XQ=(f6,p9)=>{try{let xL=o9(f6.headers);E1(xL,p9.access,p9.accountId==="main"?void 0:p9.accountId,p9.accountId==="main"?p9.wireAccountId:void 0,d1(f6.headers))}catch{}};XQ(_8,o0);let JQ=cG(o0,i0,_8.status,Date.now(),b);if((_8.status===401||_8.status===403||_8.status===429)&&JQ.action==="migrate"){let f6=iX({sessionId:S,requestBytes:C0,candidates:$6,sidebarSnapshot:P6,excludeAccountIds:[o0.accountId],now:Date.now()});if(f6){P8.debug("sticky routing: migrated session pin",{pid:process.pid,sessionHash:p8(S),fromAccountId:o0.accountId,toAccountId:f6.accountId,reason:JQ.reason});let p9=_8;_8=await I1(D,M,f6.access,f6.wireAccountId,f6.keepwarmAccountKey),p9.body?.cancel().catch(()=>{}),o0=f6,XQ(_8,o0)}}if(o0.fallback&&!V3(_8.status,b))n6.markUsed(o0.fallback);return lX(S,f,o0.accountId,M8,b?.accounts,C1(P6,F)),_8}}let d8=mG(U0.peekMainForPolicy(P0),i0.main.quota,Date.now(),i0.main.mainAccountId,P0),i8=z9(b)&&!Z1(CL(P0),b,void 0,Date.now()),n8=U0.isRateLimited("main"),sG,sX=()=>{return sG??=IL(W0,i0),sG},s8,b1,aG=!1,Q2;if(M8==="fallback-first"&&k4(D,M)){aG=!0;let C0=await sX();Q2=iG(C0,!i8&&!n8&&!d8.exhausted);let $6=await bL(D,M,b,Q2);if($6)s8=$6.response,b1={accessToken:$6.accessToken,accountId:$6.quotaAccountId,activeId:$6.activeId}}if(!s8){let C0=d8.exhausted&&k4(D,M)&&(await sX()).retained.length>0;if(i8||n8||C0){let $6=i8?"killswitch":n8?"mid-stream-rate-limit":"quota-exhausted";if($6==="quota-exhausted"&&d8.exhausted)uG("main",d8);P8.debug("admission blocked primary",{pid:process.pid,activeId:"main",reason:$6}),s8=pG(b,$6,$6==="quota-exhausted"&&d8.exhausted?d8.resetAtMs:n8?U0.rateLimitedUntil("main"):void 0)}else s8=d?new Response(null,{status:401}):await I1(D,M,l,P0,"main")}let aX=Boolean(b1),w4=s8,oG=b1?.accessToken??l,rG=b1?.accountId,tG=b1?.activeId??"main";if(!b1&&!aG&&V3(s8.status,b)){P8.debug("reactive fallback triggered",{pid:process.pid,status:s8.status}),Q2??=iG(await sX(),!1);let C0=await kL(D,M,s8,b,Q2),$6=C0.response;if($6!==s8){if(aX=!0,w4=$6,oG=C0.accessToken??l,rG=C0.accountId,C0.accountId)tG=C0.accountId}}if(F0&&d&&!aX&&await l7(M0(V0()),await h()))throw Error(U4);try{let C0=o9(w4.headers);if(aX)E1(C0,oG,rG,void 0,d1(w4.headers));else E1(C0,l,void 0,P0,d1(w4.headers))}catch{}return lX(S,f,tG,M8,b?.accounts,C1(P6,F)),w4}}},methods:u0},"chat.headers":async(h,o)=>{if(h.model.providerID!=="openai")return;if(o.headers.originator="opencode",o.headers["User-Agent"]=`${x2(k9)} (${DG.platform()} ${DG.release()}; ${DG.arch()})`,o.headers["session-id"]=h.sessionID,Z)o.headers[gX]=h.agent;if(z&&h.agent==="title")o.headers[N9.TITLE_HEADER]="true"},"chat.params":async(h,o)=>{if(h.model.providerID!=="openai")return;o.maxOutputTokens=void 0},config:async(h)=>{Z0("commands").info("registering commands",{existing:Object.keys(h.command??{}).length,pid:process.pid}),h.command={...h.command??{},[p6]:{template:p6,description:"OpenAI accounts: quota, routing, limits, cache keep-warm, diagnostics and reset credits."}}},"command.execute.before":async(h)=>{if(Z0("commands").info("command hook entered",{command:h.command,hasCmdCtx:B!==null,pid:process.pid}),h.command!==p6)return;if(!B)Z0("commands").warn("command rejected: context not loaded",{command:h.command,pid:process.pid}),await t(h.sessionID,"OpenAI auth plugin is still initializing. Send a request first, then try again."),JL();let o=await lH(B,h.sessionID);if(mH(h.sessionID))t7(o,h.sessionID);else await t(h.sessionID,iH(o.menu));JL()}}}var fb=async(X)=>{let J=c6();return hb(X,{codexApiEndpoint:J.codexApiEndpoint,experimentalWebSockets:J.webSockets,responsesLite:J.responsesLite})},pn={id:"cortexkit-openai-auth",server:fb};
-export{V6 as c,U6 as d,Z8 as e,v2 as f,o9 as g,d1 as h,Iz as i,$3 as j,T0 as k,Q3 as l,b8 as m,$W as n,b0 as o,U3 as p,z9 as q,a6 as r,Z1 as s,U8 as t,I9 as u,K8 as v,sW as w,Q$ as x,oW as y,b7 as z,sf as A,Q4 as B,j8 as C,dM as D,j1 as E,V0 as F,c6 as G,M0 as H,j_ as I,l7 as J,d7 as K,i7 as L,f8 as M,H4 as N,n7 as O,u$ as P,U4 as Q,j4 as R,k9 as S,t$ as T,e$ as U,I3 as V,XY as W,QV as X,E6 as Y,BV as Z,HV as _,UV as $,YY as aa,jV as ba,NV as ca,nA as da,TV as ea,EV as fa,r3 as ga,kq as ha,$b as ia,Yb as ja,Gb as ka,Qb as la,zb as ma,Zb as na,MG as oa,Hb as pa,hn as qa,Ub as ra,Kb as sa,fn as ta,gn as ua,TG as va,D6 as wa,Fb as xa,Pb as ya,mn as za,_b as Aa,bb as Ba,$L as Ca,ML as Da,un as Ea,GL as Fa,kb as Ga,vb as Ha,hb as Ia,fb as Ja,pn as Ka};