@cortexkit/opencode-openai-auth 1.0.5 → 1.2.0

package/dist/v2/server.d.ts

@@ -1,8 +1,163 @@
-import { c as BeginAccountLoginOptions, h as AccountPaths, l as BeginAccountLoginResult, n as HostSlotAdapter, s as OpenAiVaultOptions, t as PoolLifecycleDeps } from "../pool-lifecycle-C_6YRmsh.js";
+import { h as BeginAccountLoginResult, i as CodexSessionMetadata, m as BeginAccountLoginOptions, o as PoolLifecycleDeps, p as OpenAiVaultOptions, r as CodexRequestRuntime, s as HostSlotAdapter, x as AccountPaths } from "../codex-request-CjXETpTA.js";
+import { i as OpenDialogPayload, n as ApplyResult } from "../protocol-C-kagE6O.js";
 import { Plugin } from "@opencode/plugin";
 import "@opencode/plugin/promise/session";
 import "@opencode/plugin/promise/integration";
 import "@opencode/plugin/promise/registration";
+//#region src/v2/frame-turn.d.ts
+/** The turn a frame is sent in. */
+interface FrameTurn {
+  readonly turnID: string;
+  readonly turnStartedAt: number;
+}
+/** What is kept for one session; exposed read-only for tests and diagnostics. */
+interface FrameTurnRecord extends FrameTurn {
+  /** Whether the session's last frame got `response.completed`. */
+  readonly completed: boolean;
+  /** SHA-256 (hex) of `JSON.stringify` of the conversation's last user message. */
+  readonly fingerprint: string | undefined;
+  /** The conversation's user-message count; undefined when not known. */
+  readonly userCount: number | undefined;
+}
+/**
+ * The frame turn of each session.
+ *
+ * Call `advance` once for every `response.create` frame sent, with the
+ * host's frame body, and `completed` when that frame's `response.completed`
+ * arrives. The rule:
+ *
+ * - A chained frame (one with `previous_response_id`) starts a new turn
+ *   exactly when its `input` holds a user message. The host's deltas carry
+ *   only newly appended items, so two consecutive identical user messages
+ *   each start a turn, and a delta of tool outputs never does.
+ * - A full frame starts a new turn when its last user message comes after
+ *   every model and tool item, unless it is a resend: the session's previous
+ *   frame got no `response.completed`, and the frame's last user message has
+ *   the recorded fingerprint and its user-message count equals the recorded
+ *   count. A full frame with no recorded state is not a resend.
+ * - A full frame that ends on tool output keeps the current turn.
+ * - A session with no turn yet (new, forgotten or evicted) starts one on its
+ *   first frame.
+ *
+ * A full frame records its own fingerprint and count. A chained frame
+ * records its delta's last user message, if any, and adds its delta's user
+ * messages to the recorded count; an unknown count stays unknown.
+ */
+declare class FrameTurnState {
+  #private;
+  readonly runtime?: CodexRequestRuntime | undefined;
+  readonly maxSessions: number;
+  constructor(runtime?: CodexRequestRuntime | undefined, maxSessions?: number);
+  /**
+   * Applies the rule to one frame about to be sent and returns its turn.
+   * `runtime` mints a new turn's id and start time; it defaults to the one
+   * given to the constructor, so a process-wide instance can serve callers
+   * that each bring their own clock.
+   */
+  advance(sessionID: string, frame: Record<string, unknown>, runtime?: CodexRequestRuntime | undefined): FrameTurn;
+  /** Records that the session's last frame got `response.completed`. */
+  completed(sessionID: string): void;
+  get(sessionID: string): FrameTurnRecord | undefined;
+  /** Drops a deleted host session; its next frame starts a new turn. */
+  forget(sessionID: string): void;
+}
+//#endregion
+//#region src/v2/codex-sessions.d.ts
+interface CodexSessionStoreOptions {
+  /** Mints the turn ids of loaded sessions; UUIDv7 by default. */
+  uuid?: () => string;
+  /** Test seam: runs while the lock is held, after the file was re-read. */
+  afterRead?: () => Promise<void>;
+  /** Test seam: the lock wait; `LOCK_WAIT_MS` by default. */
+  lockWaitMs?: number;
+}
+declare class CodexSessionStore {
+  #private;
+  readonly path: string;
+  readonly options: CodexSessionStoreOptions;
+  readonly sessions: Map<string, CodexSessionMetadata>;
+  /**
+   * Each session's WebSocket frame turn, kept next to its Codex metadata.
+   * Every location in this process gets this same store, so they all share
+   * one frame turn per session. It lives in memory only and is never written
+   * to the session file at `path`.
+   */
+  readonly frameTurns: FrameTurnState;
+  constructor(path: string, options?: CodexSessionStoreOptions);
+  /** The session's metadata; a new session gets a new thread id and is saved. */
+  get(sessionID: string, uuid?: () => string): CodexSessionMetadata;
+  /** Forgets a deleted host session here and, on the next save, in the file. */
+  delete(sessionID: string): void;
+  /**
+   * Saves this process's changes. Saves run one at a time; changes made while
+   * one runs go in the next. Never rejects: a lock timeout or write failure
+   * keeps the changes for the next save.
+   */
+  save(): Promise<void>;
+  /** Resolves once every save started so far has finished. */
+  settled(): Promise<void>;
+}
+//#endregion
+//#region src/v2/codex-wire.d.ts
+/**
+ * HTTP requests and WebSocket cache keys share each host session's thread
+ * identity. With a store, sessions are the store's process-wide map and new
+ * or deleted sessions are saved to its file; without one they live only in
+ * this object.
+ */
+declare class CodexHttpState {
+  readonly runtime?: CodexRequestRuntime | undefined;
+  readonly store?: CodexSessionStore | undefined;
+  readonly sessions: Map<string, CodexSessionMetadata>;
+  /**
+   * Each session's WebSocket frame turn (see `frame-turn.ts`). With a store
+   * this is the store's process-wide state; without a store it is this
+   * object's own. Only WebSocket frames update it; HTTP requests of every
+   * kind leave it alone.
+   */
+  readonly frameTurns: FrameTurnState;
+  readonly installationID: string;
+  constructor(runtime?: CodexRequestRuntime | undefined, installationID?: string, store?: CodexSessionStore | undefined);
+  get(sessionID: string): CodexSessionMetadata;
+  /**
+   * Applies the frame turn rule to one `response.create` frame the host is
+   * about to send, as the host built it, and returns the frame's turn.
+   */
+  advanceFrame(sessionID: string, frame: Record<string, unknown>): FrameTurn;
+  /**
+   * Reads one WebSocket frame the server sent on an owned socket. A
+   * `response.completed` marks the session's last sent frame as completed,
+   * so resending that same full frame afterwards starts a new turn instead
+   * of counting as a resend. Every other frame changes nothing.
+   */
+  frameReceived(sessionID: string, frame: string): void;
+  /** Drops a deleted host session; a later request with its id starts a new thread. */
+  forget(sessionID: string): void;
+}
+//#endregion
+//#region src/v2/cache-keep.d.ts
+/**
+ * How the store's manager is built. Only the first location to acquire a
+ * store's manager supplies these; in production every location passes the
+ * same clock and timers.
+ */
+interface CacheKeepManagerSetup {
+  now: () => number;
+  /** Where a warm goes when its capture has no URL; captures always have one. */
+  codexResponsesUrl: string;
+  setIntervalImpl?: typeof globalThis.setInterval;
+  clearIntervalImpl?: typeof globalThis.clearInterval;
+  /** How long the last release waits for a warm in flight. */
+  joinTimeoutMs?: number;
+}
+//#endregion
+//#region src/v2/control-plane.d.ts
+/** Server-owned menu callbacks shared by command dispatch and loopback RPC. */
+interface ControlPlaneMenu {
+  open(sessionId: string): Promise<OpenDialogPayload>;
+  apply(request: unknown): Promise<ApplyResult>;
+}
+//#endregion
 //#region src/v2/login.d.ts
 type BeginLogin = (options: BeginAccountLoginOptions) => Promise<BeginAccountLoginResult>;
 //#endregion
@@ -14,6 +169,25 @@ type BeginLogin = (options: BeginAccountLoginOptions) => Promise<BeginAccountLog
 export declare const OPENAI_AUTH_PLUGIN_ID = "cortexkit-openai-auth";
 /** Test and embedding seams; every field has a production default. */
 interface OpenAIAuthV2Options {
+  /** Overrides HTTP identity and clock sources for deterministic wire fixtures. */
+  codex?: CodexHttpState;
+  /** Binds this location's sidebar output; defaults to the shared sidebar state file. */
+  sidebarStateFile?: string;
+  /**
+   * Test-only interval in milliseconds for checking settings/enrollment file
+   * metadata and cached vault rosters. Tests can shorten the 2,000 ms default
+   * to observe changes quickly.
+   */
+  sidebarObservationIntervalMs?: number;
+  /** Overrides the production menu for transport fixtures. */
+  controlPlane?: ControlPlaneMenu;
+  /**
+   * Test overrides for the keep-warm manager: its interval timer, and how
+   * long the last location's release waits for a warm request in flight.
+   * Only the location that builds the store's manager applies them;
+   * production uses the global timers and `CACHE_KEEP_JOIN_MS`.
+   */
+  cacheKeep?: Pick<CacheKeepManagerSetup, 'setIntervalImpl' | 'clearIntervalImpl' | 'joinTimeoutMs'>;
   /** The account config and state files; read on every use. */
   paths?: () => AccountPaths;
   /** OpenCode 1's login slot the migration reads; its `auth.json` by default. */
@@ -22,6 +196,11 @@ interface OpenAIAuthV2Options {
   version?: string;
   /** Used for token refreshes and quota polls. */
   fetch?: typeof fetch;
+  /**
+   * The clock for token refreshes, quota polls and the readings they record,
+   * rate-limit marks, and reset credits; `Date.now` by default.
+   */
+  now?: () => number;
   /** Starts one ChatGPT login (`beginAccountLogin`). */
   beginLogin?: BeginLogin;
   /** The migration's version fence; `migrationFenceOpen` for `version` by default. */

package/dist/v2/server.js

@@ -1,3 +1,3 @@
-import{c as H$}from"../index-fsxbncpw.js";import{C as b1,D as y1,F as n2,G as a2,H as s2,S as W$,Y as o2,Z as r2,aa as U$,d as e1,e as k2,f as G2,g as C2,h as z$,i as J$,j as X$,k as j$,l as w2,m as G$,n as Q$,o as R2,p as U1,q as C1,r as N1,s as F1,t as P1,u as T1,v as M1,w as B$,x as V$,y as W2,z as L1}from"../index-4fnghj9e.js";import{$a as V1,$b as t1,Ba as l1,Ca as z1,Da as J1,Ea as X1,Hb as E1,Ia as q1,Ka as x1,Ma as c1,Na as d1,Oa as j1,Ob as w1,Ta as i1,Xa as G1,Ya as Q1,Yb as s1,Zb as o1,_a as B1,_b as r1,bc as $$,cc as S1,eb as N2,kb as n1,lb as V2,lc as Y$,mc as K$,nc as Z$,ob as a1,oc as R1,pb as W1,qb as H1,sa as H2,ta as U2,ua as p1}from"../index-h263aftt.js";import"../index-ydz3hbhc.js";import{md as Z1}from"../index-a69gr76b.js";import"../index-ssj7m2rd.js";import"../index-826s1yxa.js";import"../index-fsky1rsh.js";import{Ud as j2}from"../index-y4gxyxqd.js";import"../index-116q849r.js";import"../index-pg305s90.js";import{se as g1,te as u1}from"../index-66asrje2.js";class c extends Error{kind;providerID;sessionID;requestKind;constructor($){super($.message??`${$.providerID} ${$.requestKind} request refused (${$.kind})`);this.name="OpenCode2AuthError",this.kind=$.kind,this.providerID=$.providerID,this.sessionID=$.sessionID,this.requestKind=$.requestKind}}function s($){return`common-auth-placeholder.${$}`}function c2($){let K=s($.integrationID);return{type:"oauth",methodID:$.methodID,access:K,refresh:K,expires:$.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function J2($,K){if($?.type!=="oauth")return!1;let J=K===void 0?void 0:s(K),X=(j)=>J===void 0?j.startsWith("common-auth-placeholder."):j===J;return X($.access)&&X($.refresh)}var d2="No browser sign-in: this connects the plugin to the accounts in its vault.";async function M2($,K){let J=K.now??Date.now,{integrationID:X}=K,j=(T)=>c2({integrationID:X,methodID:T,now:J()}),B=async(T,O)=>{return await K.onLogin(T,{integrationID:X,methodID:O}),j(O)},R=(T)=>async(O)=>{let H=T.method.id,W=await T.authorize(O),y={url:W.url,instructions:W.instructions,...W.expiresAt===void 0?{}:{expiresAt:W.expiresAt}};if(W.mode==="auto")return{...y,mode:"auto",callback:W.callback.then((E)=>B(E,H))};let b=W.callback;return{...y,mode:"code",callback:async(E)=>B(await b(E),H)}};return $.integration.transform((T)=>{let O=K.label===void 0?{}:{label:()=>K.label};for(let y of K.methods)T.method.update({integrationID:X,method:y.method,authorize:R(y),refresh:async(b)=>{if(!J2(b,X))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return j(b.methodID)},...O});let H=K.vault;if(H===void 0)return;let W=H.method.id;T.method.update({integrationID:X,method:H.method,authorize:async()=>({url:"",instructions:H.instructions??d2,mode:"auto",callback:Promise.resolve().then(()=>H.activate({integrationID:X,methodID:W})).then(()=>j(W))}),refresh:async(y)=>{if(!J2(y,X)||y.methodID!==W)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return j(W)},...O})})}function P$($){let K=[],J;for(let X of $.split(/\r?\n/))if(X.startsWith("data:"))K.push(X.slice(5).replace(/^ /,""));else if(X.startsWith("event:"))J=X.slice(6).trim();if(K.length===0)return;return J===void 0?{data:K.join(`
-`)}:{event:J,data:K.join(`
-`)}}function L2($,K){let J=new TextDecoder,X="",j=(R)=>{let T=P$(R);if(!T)return;try{$(T)}catch(O){K(O)}},B=()=>{for(;;){let R=/\r?\n\r?\n/.exec(X);if(!R)return;let T=X.slice(0,R.index);X=X.slice(R.index+R[0].length),j(T)}};return new TransformStream({transform(R,T){T.enqueue(R),X+=J.decode(R,{stream:!0}),B()},flush(){if(X+=J.decode(),B(),X.trim()!=="")j(X);X=""}})}var i2=512,Y2="x-common-auth-attempt",e=($,K)=>JSON.stringify([$,K]),o=($)=>({providerID:$.model.providerID,modelID:$.model.id,sessionID:$.sessionID,agent:$.agent,kind:$.kind});function T$($){let K=$.headers;return typeof K==="object"&&K!==null}function M$($,K){let J=$.getReader();return new ReadableStream({async pull(X){let j;try{j=await J.read()}catch(B){K({reason:"failed",message:B instanceof Error?B.message:String(B)}),X.error(B);return}if(j.done)K(),X.close();else X.enqueue(j.value)},async cancel(X){K({reason:"cancelled",...X===void 0?{}:{message:String(X)}}),await J.cancel(X)}})}function _2($,K){for(let[J,X]of Object.entries(K)){let j=J.toLowerCase();for(let B of Object.keys($))if(B.toLowerCase()===j)delete $[B];if(X!==null)$[J]=X}}function L$($,K){for(let[J,X]of Object.entries(K))if(X===null)$.delete(J);else $.set(J,X)}async function q2($,K,J={}){let{providerID:X}=K,j=J.gateOnPlaceholder,B=(Y)=>j===void 0||j.credential(Y)===s(X),R=J.logger,T=Math.max(1,J.maxRecords??i2),O=[...J.hostCredentials??[s(X)],...j?[s(X)]:[]].filter((Y)=>Y!==""),H=new Map,W=new WeakMap,y=new Map,b=new Set,E=new Map,v=!1,f=!1,d=new Map,I=0,u=!1,g=new Map,h=(Y,Z)=>{try{R?.warn(Y,Z)}catch{}},z=(Y)=>Y instanceof Error?Y.message:String(Y),V=async(Y,Z)=>{let G=d.get(Y);if(!G||G.size===0)return;await Promise.all([...G].map(async(Q)=>{try{await Q(Z)}catch(M){h("opencode2 auth listener threw; the request is unaffected",{event:Y,error:z(M)})}}))},F=async(Y,Z)=>{try{await K.onAttemptEnd?.(Y,Z)}catch(G){h("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:Y.attemptId,error:z(G)})}},C=(Y,Z)=>{if(Y.ended||!Y.attempt)return;let G={...Y.status===void 0?{}:{status:Y.status},outputStarted:Y.outputStarted,...Y.limit?{limit:Y.limit.signal}:{},...Z?{error:Z}:{}};if(Z)Y.endError=Z;Y.ended=F(Y.attempt,G)},A=(Y,Z)=>C(Y,{reason:"abandoned",message:Z}),P=(Y)=>[...H.values()].filter((Z)=>Z.key===Y),D=(Y)=>P(Y).at(-1),k=(Y)=>{if(H.delete(Y.id),!P(Y.key).length)y.delete(Y.key)},q=(Y)=>{H.set(Y.id,Y);while(H.size>T){let Z=H.values().next().value;if(Z===void 0)break;A(Z,"dropped to keep the record bound"),k(Z)}},m=(Y)=>Y.accountId===void 0?void 0:{...Y.scope,accountId:Y.accountId},i=(Y,Z)=>new c({kind:"no-account",providerID:X,sessionID:Y.sessionID,requestKind:Y.kind,...Z===void 0?{}:{message:Z}}),l=(Y)=>{g.get(Y)?.clear(),g.delete(Y)},p=async(Y,Z)=>{let G=()=>i(Y,`${X} ${Y.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(u)throw G();let Q=g.get(Y.sessionID);if(!Q)Q=new Set,g.set(Y.sessionID,Q);let M={};Q.add(M);let x=()=>{if(!Q.has(M))throw G()};try{return await Z(x)}finally{if(Q.delete(M),Q.size===0&&g.get(Y.sessionID)===Q)g.delete(Y.sessionID)}},U=(Y,Z)=>{for(let[G,Q]of Z)if(O.some((M)=>Q.includes(M)))throw new c({kind:"host-credential-on-wire",providerID:X,sessionID:Y.sessionID,requestKind:Y.kind,message:`${X} ${Y.kind} request still carries the host's placeholder credential in ${G}; the adapter's account headers must replace it`})},L=(Y)=>{for(let Z of P(Y))if(Z.ended||!Z.attempt)k(Z);else if(Z.transport==="ws"||Z.judged)A(Z,"a newer attempt of its session and kind began"),k(Z)},S=async(Y,Z,G,Q)=>{let M=e(Y.sessionID,Y.kind),x=y.get(M);y.delete(M);let N=x?.accountId??D(M)?.accountId;L(M);let _={...Y,...N===void 0?{}:{previousAccountId:N},...x?.rerouteFrom===void 0?{}:{rerouteFrom:x.rerouteFrom}},w=await K.chooseAccount(_);G();let a={},p2;if(w!==void 0){let Q2=await K.accountHeaders({...Y,accountId:w});if(G(),T$(Q2))a=Q2.headers,p2=Q2.attempt;else a=Q2}let l2=`attempt-${++I}`,z2={id:l2,key:M,scope:Y,accountId:w,headers:a,attempt:w===void 0?void 0:{...Y,accountId:w,attemptId:l2,transport:Q,data:p2},...Q===void 0?{}:{transport:Q},outputStarted:!1};if(q(z2),z2.attempt)V("select",{...Y,accountId:z2.attempt.accountId,hook:Z,..._.previousAccountId===void 0?{}:{previousAccountId:_.previousAccountId},..._.rerouteFrom===void 0?{}:{rerouteFrom:_.rerouteFrom},handle:z2.attempt});return z2},Z2=async(Y,Z,G,Q,M)=>{let x=e(Y.sessionID,Y.kind),N=Q===void 0?void 0:H.get(Q);if(N?.key!==x)N=void 0;if(!N){if(N=D(x),P(x).filter((w)=>w.transport===void 0&&!w.ended).length>1&&!f)f=!0,h("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:Y.sessionID,kind:Y.kind})}if(!N||N.transport!==void 0||N.ended)N=await S(Y,Z,M,G);else if(N.transport=G,N.attempt)N.attempt.transport=G;if(G==="ws"){for(let _ of P(x))if(_!==N&&_.transport==="ws")A(_,"a newer attempt of its session and kind went out over WebSocket")}return N},$2=async(Y,Z)=>{try{return await Z()}catch(G){throw C(Y,{reason:"failed",message:z(G)}),G}},h2=(Y,Z)=>{let G=P(e(Y,Z)).filter((Q)=>Q.transport==="ws").at(-1);return G?.attempt!==void 0&&!G.ended?G:void 0},P2=(Y,Z,G)=>{let Q=m(Y);if(!Q||!Y.attempt||Y.limit)return;Y.limit={signal:Z,delivered:V("limit",{...Q,via:G,limit:Z,outputStarted:Y.outputStarted,handle:Y.attempt})}},v2=(Y,Z,G,Q)=>{let M=m(Y);if(!M||!Y.attempt)return;V("quota",{...M,transport:Z,...Q===void 0?{}:{status:Q},quota:G,handle:Y.attempt})},m2=(Y,Z,G,Q)=>{let M=Y.attempt;if(!M)return;let x=K.inspectEvent?.(Q===void 0?{transport:Z,data:G,attempt:M}:{transport:Z,data:G,event:Q,attempt:M});if(!x)return;if(x.quota!==void 0)v2(Y,Z,x.quota);if(x.outputStarted)Y.outputStarted=!0;if(x.limit)P2(Y,x.limit,Z);if(x.error!==void 0)C(Y,{reason:"failed",message:x.error});else if(x.done)C(Y)},C$=(Y,Z)=>{let G=Y.attempt;if(!G||Z.accountId===Y.accountId)return;if(G.reboundFrom??=G.accountId,G.accountId=Z.accountId,"data"in Z)G.data=Z.data;Y.accountId=Z.accountId},N$=(Y)=>!Y.attempt||Y.endError!==void 0||Y.status!==void 0&&Y.status>=400,F$=(Y)=>{let Z=[...H.values()].filter((_)=>_.scope.sessionID===Y),G=Z.filter((_)=>_.limit&&!_.rerouted).at(-1);if(G)return G;let Q=Z.filter((_)=>_.scope.kind==="primary"),M=Q.length>0?Q:Z;if(M.length<=1)return M[0];let x=M.filter((_)=>!_.judged&&N$(_)).at(-1);if(x)return x;let N=M.filter((_)=>_.attempt&&!_.ended);if(N.length>1)return"ambiguous";return N[0]??M.at(-1)},t={providerID:X},r=[];r.push(await $.session.hook("model.request",(Y)=>{if(j)return;return p(o(Y),async(Z)=>{let G=await S(o(Y),"model.request",Z);if(Z(),G.accountId===void 0)throw i(G.scope);_2(Y.headers,{...G.headers,[Y2]:G.id})})},t)),r.push(await $.session.hook("http.request",(Y)=>{if(j){let Z=B(Y.request.headers);if(E.set(Y.sessionID,Z),!Z)return}return p(o(Y),async(Z)=>{let G=Y.request.headers.get(Y2)??void 0,Q=j?await S(o(Y),"http.request",Z,"http"):await Z2(o(Y),"http.request","http",G,Z);Z();let M=m(Q),x=Q.attempt;if(!M||!x)throw i(Q.scope);await $2(Q,async()=>{let N=Y.request;if(K.rewriteRequest){if(G!==void 0){let a=new Headers(N.headers);a.delete(Y2),N=new Request(N,{headers:a})}N=await K.rewriteRequest({...M,request:N,attempt:x})??N,Z()}let _=new Headers(N.headers);_.delete(Y2),L$(_,Q.headers),U(Q.scope,_.entries());let w=new Request(N,{headers:_});W.set(w,Q),Y.request=w})})},t)),r.push(await $.session.hook("http.response",async(Y)=>{let Z=W.get(Y.request);if(!Z){if(j)return;if(!v)v=!0,h("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:Y.sessionID,kind:Y.kind});return}let G=Y.response;if(K.answeredBy&&Z.attempt){let _=Z.attempt,w=await $2(Z,async()=>K.answeredBy?.({request:Y.request,response:G,attempt:_}));if(w)C$(Z,w)}let Q=m(Z),M=Z.attempt;if(!Q||!M)return;Z.status=G.status;let x=K.quotaFromHeaders?.(G.headers,G.status,M);if(x!==void 0)v2(Z,"http",x,G.status);if(!G.ok&&K.limitFromResponse){let _=await K.limitFromResponse({status:G.status,headers:G.headers,body:()=>G.clone().text(),attempt:M});if(_)P2(Z,_,"http")}if(!G.ok||!G.body)C(Z);let N=G;if(G.body&&(K.inspectEvent||K.onAttemptEnd)){let _=G.body;if(K.inspectEvent)_=_.pipeThrough(L2((w)=>m2(Z,"http",w.data,w.event),(w)=>h("opencode2 auth event inspection threw",{error:z(w)})));N=new Response(M$(_,(w)=>C(Z,w)),{status:G.status,statusText:G.statusText,headers:G.headers})}if(K.rewriteResponse)N=await K.rewriteResponse({...Q,request:Y.request,response:N,attempt:M})??N;if(N!==G)Y.response=N},t)),r.push(await $.session.hook("experimental.ws.handshake",(Y)=>{if(j){let Z=B(new Headers(Y.headers)),G=e(Y.sessionID,Y.kind);if(E.set(Y.sessionID,Z),b.delete(G),!Z)return}return p(o(Y),async(Z)=>{let G;for(let N of Object.keys(Y.headers)){if(N.toLowerCase()!==Y2)continue;G??=Y.headers[N],delete Y.headers[N]}let Q=j?await S(o(Y),"experimental.ws.handshake",Z,"ws"):await Z2(o(Y),"experimental.ws.handshake","ws",G,Z);Z();let M=m(Q),x=Q.attempt;if(!M||!x)throw i(Q.scope);await $2(Q,async()=>{_2(Y.headers,Q.headers);let N=K.rewriteHandshakeURL?.({...M,url:Y.url,attempt:x});if(N!==void 0)Y.url=N;if(U(Q.scope,Object.entries(Y.headers)),j)b.add(Q.key)})})},t));let f2=K.rewriteWebSocketFrame?.bind(K);if(f2)r.push(await $.session.hook("experimental.ws.send",async(Y)=>{let Z=o(Y);if(j&&!b.has(e(Z.sessionID,Z.kind)))return;let G=h2(Z.sessionID,Z.kind),Q=await f2({...Z,attempt:G?.attempt,frame:Y.frame});if(Q!==void 0)Y.frame=Q},t));r.push(await $.session.hook("experimental.ws.receive",(Y)=>{if(j&&!b.has(e(Y.sessionID,Y.kind)))return;let Z=h2(Y.sessionID,Y.kind);if(!Z)return;try{m2(Z,"ws",Y.frame)}catch(G){h("opencode2 auth frame inspection threw",{error:z(G)})}},t)),r.push(await $.session.hook("retry",async(Y)=>{if(j&&E.get(Y.sessionID)!==!0)return;let Z=F$(Y.sessionID);if(!Z)return;let G=Y.decision;if(Z==="ambiguous"){await V("retry",{sessionID:Y.sessionID,attempt:Y.attempt,reason:"host-decides",hostDecision:G,decision:G});return}let Q=Z;await p(Q.scope,async(M)=>{Q.judged=!0;let x=G,N,_,w=Q.attempt;if(Q.accountId===void 0||!w)x={retry:!1},N="no-account";else if(Q.outputStarted)x={retry:!1},N="output-started";else{if(!Q.limit){let a=K.limitFromError?.(Y.error,w);if(a)P2(Q,a,"error")}if(Q.ended)await Q.ended,M();if(Q.limit)await Q.limit.delivered,M(),Q.rerouted=!0,_={accountId:Q.accountId,limit:Q.limit.signal},x={retry:!0,delay:0},N="reroute";else N="host-decides"}if(Y.decision=x,x.retry&&Q.accountId!==void 0)y.set(Q.key,{sessionID:Q.scope.sessionID,accountId:Q.accountId,..._===void 0?{}:{rerouteFrom:_}});await V("retry",{sessionID:Y.sessionID,...Q.accountId===void 0?{}:{accountId:Q.accountId},kind:Q.scope.kind,attempt:Y.attempt,reason:N,hostDecision:G,decision:x,...w===void 0?{}:{handle:w}})})},t));let g2=(Y)=>{l(Y),E.delete(Y);for(let Z of b)if(JSON.parse(Z)[0]===Y)b.delete(Z);for(let Z of[...H.values()]){if(Z.scope.sessionID!==Y)continue;A(Z,"its session was forgotten"),H.delete(Z.id)}for(let[Z,G]of y)if(G.sessionID===Y)y.delete(Z)},T2=new AbortController,u2=$.event;if(u2)(async()=>{try{for await(let Y of u2.subscribe({signal:T2.signal}))if(Y.type==="session.deleted")g2(Y.data.sessionID)}catch(Y){if(!T2.signal.aborted)h("opencode2 auth stopped listening for session deletion",{error:z(Y)})}})();return{on(Y,Z){let G=d.get(Y);if(!G)G=new Set,d.set(Y,G);let Q=Z;return G.add(Q),()=>{G.delete(Q)}},accountFor(Y,Z){return D(e(Y,Z))?.accountId},forgetSession:g2,get size(){return H.size},async dispose(){if(u)return;u=!0;for(let Y of g.keys())l(Y);T2.abort();for(let Y of H.values())A(Y,"the installation was disposed");H.clear(),y.clear(),b.clear(),E.clear(),d.clear(),await Promise.all(r.map(async(Y)=>{try{await Y.dispose()}catch(Z){h("opencode2 auth hook did not dispose cleanly",{error:z(Z)})}}))}}}var x2={version:a2,"user-agent":s2,originator:"codex_exec"},_$="x-openai-internal-codex-responses-lite",q$=1024,x$=/(?:^|\/)gpt-6-(?:astra|sol|luna)$/i,B2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($),E$=($)=>B2($)&&($.type==="message"||("role"in $))&&$.role==="user",S$=($)=>B2($)&&$.type==="configuration_update";class E2{#$=new Map;apply($,K,J){if(K.kind!=="primary")return!1;let X=typeof $.model==="string"?$.model:"";if(!o2.has(X))return!1;if(x$.test(X))return!1;let j=B2($.reasoning)?$.reasoning:void 0,B=typeof j?.effort==="string"?j.effort:void 0;if(!B)return!1;let R=this.#$.get(K.sessionID);if(R===void 0)return this.#Y(K.sessionID,B),!1;if(B===R)return!1;let T=Array.isArray($.input)?$.input:void 0;if(!T||T.length===0)return!1;let O=T.findLastIndex(E$);if(O<0){if(J==="http")return!1;return $.reasoning={...j,effort:R},!0}if($.reasoning={...j,effort:R},!S$(T[O-1]))T.splice(O,0,{type:"configuration_update",reasoning:{effort:B}});return!0}forget($){this.#$.delete($)}#Y($,K){this.#$.set($,K);while(this.#$.size>q$){let J=this.#$.keys().next().value;if(J===void 0)break;this.#$.delete(J)}}}function R$($){if(typeof $.model!=="string"||!n2.has($.model))return!1;return r2($),!0}function t2($){try{let K=JSON.parse($);return B2(K)?K:void 0}catch{return}}async function e2($,K,J,X){if($.method.toUpperCase()!=="POST"||$.body===null)return;if(!/\/responses\/?$/.test(new URL($.url).pathname))return;let j=t2(await $.clone().text());if(!j)return;let B="max_output_tokens"in j;delete j.max_output_tokens;let R=J.apply(j,K,"http"),T=X&&R$(j);if(!B&&!R&&!T)return;let O=new Headers($.headers);if(O.delete("content-length"),T)O.set(_$,"true");return new Request($,{headers:O,body:JSON.stringify(j)})}function $1($,K,J){let X=t2($);if(X?.type!=="response.create")return;let j="max_output_tokens"in X;delete X.max_output_tokens;let B=J.apply(X,K,"ws");return j||B?JSON.stringify(X):void 0}function A$($){return $.replace(/\/responses\/?$/,"").replace(/\/$/,"")}function S2($,K){let J=new URL($);if(J.origin!=="https://api.openai.com"&&J.origin!=="wss://api.openai.com"||!/\/responses\/?$/.test(J.pathname))return $;let X=new URL(`${A$(K)}/responses`);if(X.search=J.search,J.protocol==="ws:"||J.protocol==="wss:")X.protocol=X.protocol==="https:"?"wss:":"ws:";return X.href}var n="openai",D$=60000,Y1=1,O$="request refused: no account with a usable credential",b$=1024,K2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($);function A2($){try{return JSON.parse($)}catch{return}}function K1($){let K=H2($);return K?U2(K):void 0}var y$=new Set(["usage_limit_reached","rate_limit_exceeded"]);function D2($,K,J){return{reason:$.window,...J!==void 0?{status:J}:{},...$.resetAt!==void 0?{retryAfterMs:Math.max(0,$.resetAt-K)}:{}}}function k$($,K){let J=W2($);if(J){let B=typeof $.status==="number"?$.status:void 0;return D2(J,K,B)}if($.type!=="response.failed"||!K2($.response))return;let X=$.response.failed;if(K2(X)&&typeof X.rate_limit_reached_type==="string")return{reason:X.rate_limit_reached_type};let j=$.response.error;if(K2(j)){let B=typeof j.code==="string"?j.code:typeof j.type==="string"?j.type:void 0;if(B&&y$.has(B))return{reason:B}}return}function w$($,K){let J=A2($);if(!K2(J))return;let X=typeof J.type==="string"?J.type:void 0;if(X==="codex.rate_limits")return{quota:{snapshot:X1(J),complete:!0}};let j=k$(J,K);if(j)return{limit:j};if(X===void 0||X==="error")return;return L1(X)?void 0:{outputStarted:!0}}function I$($){let K=!1;for(let J of $.keys())if(J.toLowerCase().startsWith("x-codex-")){K=!0;break}if(!K)return;return{snapshot:z1($),complete:J1($)}}function h$($){let K=$.get("retry-after");if(K===null)return;let J=Number(K);return Number.isFinite(J)&&J>=0?J*1000:void 0}function _1($){let{source:K,pins:J}=$,X=$.now??Date.now,j=$.log,B=$.vault,R=new E2,T=new Map,O=(z)=>`${z.sessionID}\x00${z.kind}\x00${z.accountId}`,H=new Map,W=new Map,y=(z,V)=>{W.delete(z),W.set(z,V);while(W.size>b$){let F=W.keys().next().value;if(F===void 0)break;W.delete(F)}},b=(z,V,F)=>{let C=F?[]:M1(K.peek().rows,z,V,B?.identities()??new Set),A=(B?.routes()??[]).filter((P)=>P.kind==="oauth"&&G1(V2(P.quota),z,V));return[...C.map((P)=>({id:P.id,...P.identity!==void 0?{identity:P.identity}:{},quota:P.quota,row:P})),...A.map((P)=>({id:P.id,...P.identity!==void 0?{identity:P.identity}:{},quota:P.quota}))]},E=(z,V,F)=>{let C=new Map;if(Q1(V))for(let q of z)C.set(q.id,V1(V2(q.quota),V,q.id===R2?void 0:q.id,F));let A=z.map((q)=>({id:q.id,kind:"oauth",...Z1(q.quota)?{quota:q.quota}:{}})),P=z.flatMap((q)=>q.row?[q.row]:[]),D=new Set(z.filter((q)=>!q.row).map((q)=>q.id)),k=K.rateLimitMarks(P);for(let q of D){let m=H.get(q);if(m===void 0)continue;if(m<=F)H.delete(q);else k.set(q,m)}return{rows:A,now:F,rateLimitMarks:k,refreshBackoff:K.refreshBackoffFor(P),killswitch:C,requestPull:(q)=>D.has(q)?B?.requestReading(q):K.requestReading(q)}},v=(z,V,F,C)=>{let A=N1({...z,placement:U1(V)});if(A.kind==="block"){j?.debug("pool admission refused the request",{reason:A.block.reason});return}let P=A.order.filter((D)=>!F.has(D));if(C!==void 0&&P.includes(C))return C;return P[0]},f=(z,V,F,C,A,P)=>{let D={requestBytes:Y1,reservePercent:(U)=>B1(F,U===R2?void 0:U),resetCredits:()=>{return}},k=F1(z),q=(U,L)=>J.place({sessionId:C,requestBytes:Y1,validPinnedAccountIds:z.rows.map((S)=>S.id).filter((S)=>!k.excluded.has(S)),excludeAccountIds:U,quotaCheckedAtByAccount:Object.fromEntries(z.rows.map((S)=>[S.id,k.projections.get(S.id)?.checkedAt])),wireAccountIdByAccount:Object.fromEntries(V.map((S)=>[S.id,S.identity])),select:(S)=>P1(z,D,new Set(U),S),persist:L}),m=[...A],i=q(m,P);if(!i)return;let l=i.accountId,p=T1(z,D,l);if(p.kind==="none")return;if(p.kind==="move"){let U=q([...m,l],P);if(U)return U.accountId;return p.reason==="killswitch"?void 0:l}if(p.kind==="detour")return q([...m,l],!1)?.accountId;return l},u={providerID:n,chooseAccount:async(z)=>{let V=await B?.authority(),F=await $.storage(),C=V!==void 0&&V!=="local",A=()=>{throw new c({kind:"no-account",providerID:n,sessionID:z.sessionID,requestKind:z.kind,message:C2})};if(C)await $.awaitVaultRoster?.();else{if(!(await K.current()).active){if(await $.slotPlaceholderWithoutMain?.())A();j?.warn("the account pool does not serve requests yet; refusing the request",{kind:z.kind});return}await K.prepareTokens(K.peek().rows,F)}let P=X(),D=b(F,P,C),k=C1(E(D.filter((S)=>S.id!==z.rerouteFrom?.accountId),F,P));if(k)await k,P=X(),D=b(F,P,C);let q=new Map(D.map((S)=>[S.id,S])),m=E(D,F,P),i=new Set(z.rerouteFrom?[z.rerouteFrom.accountId]:[]),l=F?.routing?.mode??"main-first",p=z.kind==="primary",U=new Set,L;for(;;){let S=new Set([...i,...U]);if(L=void 0,l==="sticky-balanced")L=f(m,D,F,z.sessionID,S,p&&U.size===0);if(L??=v(m,l,S,p?void 0:W.get(z.sessionID)),L===void 0||U.has(L)){L=void 0;break}let Z2=q.get(L)?.row;if(Z2){if(K.usableToken(Z2)!==void 0)break;j?.debug("pool row holds no usable token; choosing again",{accountId:L})}else{if(!B)break;let $2=await B.authorize(L);if($2){T.set(O({...z,accountId:L}),$2);break}j?.debug("the vault refused to serve an account; choosing again",{accountId:L})}U.add(L)}if(L===void 0&&!C&&D.length===0&&await $.slotPlaceholderWithoutMain?.())A();if(L===void 0&&C&&B&&(D.length===0||U.size>0)){let S=U.size>0?"vault-refused":H1(B);throw j?.warn("vault mode: no vault account can serve; refusing the request",{cause:S}),new c({kind:"no-account",providerID:n,sessionID:z.sessionID,requestKind:z.kind,message:W1[S]})}if(L!==void 0&&p)y(z.sessionID,L);return j?.debug("pool account chosen",{kind:z.kind,accountId:L,mode:l,...z.rerouteFrom?{rerouteFrom:z.rerouteFrom.accountId}:{}}),L},accountHeaders:async(z)=>{let{accountId:V}=z,F=()=>new c({kind:"no-account",providerID:n,sessionID:z.sessionID,requestKind:z.kind,message:O$}),C=B&&await B.authority()!=="local"?void 0:K.peek().rows.find((D)=>D.id===V);if(!C&&B){let D=O(z),k=T.get(D)??await B.authorize(V);if(T.delete(D),!k)throw j?.warn("the vault refused to serve an account; refusing the request",{accountId:V}),F();return{headers:{...x2,"session-id":z.sessionID,authorization:`Bearer ${k.accessToken}`,"chatgpt-account-id":k.accountIdentity??K1(k.accessToken)??null},attempt:{kind:"vault",routeId:V,receipt:k}}}let A=C?K.usableToken(C):void 0;if(!C||!A)throw j?.warn("pool row holds no usable token; refusing the request",{accountId:V}),F();let P=C.identity??K1(A);return{headers:{...x2,"session-id":z.sessionID,authorization:`Bearer ${A}`,"chatgpt-account-id":P??null},attempt:{kind:"pool",token:A,credentialEpoch:C.credentialEpoch}}},async rewriteRequest({request:z,sessionID:V,kind:F}){let C=$.codexEndpoint?S2(z.url,$.codexEndpoint()):z.url,A=C===z.url?z:new Request(C,z);return await e2(A,{sessionID:V,kind:F},R,$.responsesLite?.()??!1)??A},rewriteHandshakeURL:({url:z})=>$.codexEndpoint?S2(z,$.codexEndpoint()):void 0,rewriteWebSocketFrame:({frame:z,sessionID:V,kind:F})=>$1(z,{sessionID:V,kind:F},R),quotaFromHeaders:(z)=>I$(z),async limitFromResponse({status:z,headers:V,body:F}){if(z<400)return;let C=A2(await F().catch(()=>"")),A=W2({...K2(C)?C:{},status:z});if(!A)return;let P=X(),D=D2(A,P,z);if(D.retryAfterMs!==void 0)return D;let k=h$(V);return k===void 0?D:{...D,retryAfterMs:k}},inspectEvent:({data:z})=>w$(z,X()),limitFromError(z){let V=A2(z.message),F=W2({...K2(V)?V:{},...z.status!==void 0?{status:z.status}:{}})??(z.message.includes("usage_limit_reached")?{window:"usage_limit_reached"}:void 0);return F?D2(F,X(),z.status):void 0},async onAttemptEnd(z,V){let F=z.data;if(F?.kind!=="vault"||V.status!==401)return;j?.warn("a vault account answered 401; reporting it to the vault",{accountId:z.accountId}),await B?.reportFailure(F.receipt,401)}},g=(z,V,F)=>{let C=F.data;if(C?.kind==="vault"){B?.recordSnapshot(z,V.snapshot,V.complete,C.receipt);return}if(C?.kind!=="pool")return;if(K.peek().rows.find((P)=>P.id===z)?.credentialEpoch!==C.credentialEpoch){j?.debug("quota reading dropped: the row holds another credential",{accountId:z});return}K.recordSnapshot(z,V.snapshot,C.token,V.complete)},h=(z,V,F)=>{let C=X(),A=F.data?.kind==="vault",P=A?B?.routes().find((q)=>q.id===z)?.quota:K.peek().rows.find((q)=>q.id===z)?.quota,D=j1(V2(P),V.reason,C,D$,V.retryAfterMs!==void 0?C+V.retryAfterMs:void 0);if(!A){K.markRateLimited(z,D);return}let k=H.get(z);if(k===void 0||k<D)H.set(z,D)};return{adapter:u,attach(z){z.on("quota",(V)=>g(V.accountId,V.quota,V.handle)),z.on("limit",(V)=>{h(V.accountId,V.limit,V.handle),j?.debug("pool row refused the request",{accountId:V.accountId,via:V.via,reason:V.limit.reason,outputStarted:V.outputStarted})})},forgetSession(z){J.forget(z),W.delete(z),R.forget(z)}}}var v$="openai-auth-pool-browser",m$="openai-auth-pool-headless",f$="openai-auth-vault",g$="Vault login requires this OpenCode host to be enrolled in the Claustrum vault. Connect to the vault or disconnect this host before trying again.";async function X2($){if(await $.authority()!=="local")throw Error("This host is connected to the credential vault or its enrollment is unreadable; the login was not stored. Disconnect this host from the vault to add a local login.")}function A1($){return{method:{id:f$,type:"oauth",label:"ChatGPT accounts in the vault"},async activate(){if(await q1($.paths,$.name)!=="vault")throw Error(g$)}}}function D1($){let K=(J,X,j)=>({method:{id:J,type:"oauth",label:X},async authorize(){if($.vault)await X2($.vault);let B=await $.beginLogin({version:$.version,headless:j});return{url:B.url,instructions:B.instructions,mode:"auto",callback:B.completion}}});return[K(v$,"ChatGPT (openai-auth pool, browser)",!1),K(m$,"ChatGPT (openai-auth pool, headless)",!0)]}function O2($){let K=(J)=>typeof J==="string"?J:"";return J2({type:"oauth",access:K($.access),refresh:K($.refresh)})||$.refresh===S1||x1($)}function u$($){if($.accountId)return $.accountId;let K=$.access?H2($.access):void 0;return K?U2(K):void 0}async function O1($,K,J,X={}){if(X.vault)await X2(X.vault);if(O2(J))throw Error("the credential is not a ChatGPT login (a placeholder or a tombstone); it was not stored");let j=E1($,{rowLocks:(E)=>R1(K,E)}),B=await j.read();if(B.status!=="ready")throw Error(`the account pool cannot be read (${B.status}); the login was not stored`);let R={type:"oauth",refresh:J.refresh,...J.access!==void 0?{access:J.access}:{},...J.expires!==void 0?{expires:J.expires}:{}},T=u$(J);if(X.vault)await X2(X.vault);let O=T!==void 0?{identity:T}:{};if(X.origin==="import"){let E=B.rows.find((v)=>T!==void 0&&v.identity===T||v.credential?.type==="oauth"&&v.credential.refresh===J.refresh);if(E)return{id:E.id,operation:"kept"}}let H=B.rows.filter((E)=>E.type==="oauth"&&!E.invalid),W=T?H.find((E)=>E.identity===T):void 0,y=B.rows.find((E)=>E.id===N2);if(W)return{id:(await j.replace(W.id,R,O)).id,operation:"replaced"};if(!y){let E=await j.add({id:N2,credential:R,...O,...J.label!==void 0?{label:J.label}:{}});return{id:E.id,operation:E.outcome==="added-disabled"?"added-disabled":"added"}}if(!y.invalid&&!y.credential)return{id:(await j.replace(N2,R,O)).id,operation:"replaced"};let b=await j.add({id:J.id,credential:R,...O,...J.label!==void 0?{label:J.label}:{}});return{id:b.id,operation:b.outcome==="added-disabled"?"added-disabled":b.outcome==="rotated"?"replaced":"added"}}function p$($){if(!b1($.modelID??$.id)){$.enabled=!1;return}let K=y1($.id);if(K)$.limit={...K}}function k1($){return $.model.transform((K)=>{for(let J of K.list(n))K.update(n,String(J.id),(X)=>p$(X))})}import{resolve as I1}from"node:path";var l$=1024;class b2{pins=new Map;limit;constructor($=l$){this.limit=Math.max(1,$)}get($){return this.pins.get($)?.accountId}forget($){this.pins.delete($)}get size(){return this.pins.size}set($,K){this.pins.delete($),this.pins.set($,K);while(this.pins.size>this.limit){let J=this.pins.keys().next().value;if(J===void 0)break;this.pins.delete(J)}}place($){return w1(this.pins,$,(K,J)=>this.set(K,J))}}var h1=Symbol.for("@cortexkit/openai-auth/opencode2-pins"),v1=globalThis,y2=v1[h1]??new Map;v1[h1]=y2;function m1($){let K=JSON.stringify([I1($.configPath),I1($.statePath)]),J=y2.get(K);if(!J)J=new b2,y2.set(K,J);return J}var F2="cortexkit-openai-auth",c$=5000;async function f1($,K,J){let X=new Map,j=new Map,B=(H)=>{j.delete(H);for(let W of X.keys())if(W.startsWith(`${H}:`))X.delete(W)},T=await q2({session:{hook:(H,W,y)=>$.session.hook(H,async(b)=>{let E=H==="http.request"?b:void 0,v=H==="experimental.ws.handshake"?b:void 0,d=(E?E.request.headers:v?new Headers(v.headers):void 0)?.get("authorization")===`Bearer ${s(K.providerID)}`;try{await W(b)}catch(I){if(d&&!(I instanceof c))throw o1(I);throw I}if(E||v){let I=E??v;if(!I)return;let g=(E?E.request.headers:new Headers(I.headers)).get("authorization")?.replace(/^Bearer /,"");if(d&&g)j.set(I.sessionID,g);else j.delete(I.sessionID);if(v){let h=`${v.sessionID}:${v.kind}`;if(d&&g)X.set(h,g);else X.delete(h)}if(j.size>512){let h=j.keys().next().value;if(h)j.delete(h)}if(X.size>512){let h=X.keys().next().value;if(h)X.delete(h)}}else if(H==="experimental.ws.receive"){let I=b,u=X.get(`${I.sessionID}:${I.kind}`);if(u)I.frame=r1(I.frame,u)}else if(H==="retry"){let I=b,u=j.get(I.sessionID);if(u)Object.assign(I.error,{message:s1(I.error.message,u)})}},y)},event:{subscribe:(H)=>async function*(){for await(let W of $.event.subscribe(H)){if(W.type==="session.deleted")B(W.data.sessionID);yield W}}()}},{...K,rewriteResponse:async(H)=>{let W=await K.rewriteResponse?.(H)??H.response;return t1(W,H.request.headers.get("authorization")?.replace(/^Bearer /,""),"event-stream")}},{gateOnPlaceholder:{credential:(H)=>{let W=H.get("authorization");return W?.startsWith("Bearer ")?W.slice(7):void 0}},logger:{warn:(H,W)=>J.warn(H,{data:W})}}),O=T.dispose;return{...T,dispose:async()=>{j.clear(),X.clear(),await O()}}}function I2($={}){return{id:F2,setup:(K)=>d$(K,$)}}async function d$($,K={}){let m=[];try{let J=j2("opencode2");let X=j2("quota");let j=K.paths??(()=>$$(e1()));let B=K.fetch??fetch;let R=K.version??J$;let T=K.poolMigration??W$;if(!T&&!G2(j().configPath)){J.info("openai-auth stands aside on OpenCode 2: this install has not moved into the account pool and the migration is switched off, so OpenCode 2 serves its own ChatGPT login");let U=(S)=>{throw new c({kind:"no-account",providerID:n,sessionID:S.sessionID,requestKind:S.kind,message:C2})},L=await f1($,{providerID:n,chooseAccount:U,accountHeaders:U},J);return()=>L.dispose()}let O=K.vault?.firstRosterWaitMs??j$;let H=V$({host:"opencode",stateDir:K.vault?.stateDir??a1(j().statePath),reservedRouteIds:()=>f.peek().rows.map((U)=>U.id),...K.vault?.connectionFile?{connectionFile:K.vault.connectionFile}:{},...K.vault?.connectScoped?{connectScoped:K.vault.connectScoped}:{},...K.vault?.connectEnrollment?{connectEnrollment:K.vault.connectEnrollment}:{},...K.vault?.pollIntervalMs!==void 0?{pollIntervalMs:K.vault.pollIntervalMs}:{},fetchImpl:()=>B},j());let W=H.vault;let y=!1;let b=!1;const E=g1(m,{[Symbol.dispose](){if(!y)H.release()}},0);await W.authority();let v=H.firstRoster;let f=new G$({paths:j,refreshProvider:async(U)=>{let L=await c1({refreshToken:U.refresh,fetchImpl:B,now:Date.now}),S=p1({id_token:"",access_token:L.access,refresh_token:L.refresh});return{...L,...S?{identity:S}:{}}},pullQuota:async(U)=>{let L=U.credential;if(L.type!=="oauth"||!L.access)throw Error("the row holds no access token to poll with");let S=await d1({accessToken:L.access,fetchImpl:B,now:Date.now,...U.identity?{accountId:U.identity}:{},accountKey:U.id,logger:X});return n1(S,Date.now(),!0)},vaultIdentities:()=>W.identities(),vaultMode:()=>W.enrolled(),vaultAuthority:()=>W.authority(),vaultFirstRoster:v,vaultFirstRosterBackgroundWaitMs:O,log:j2("pool")});await f.load();let d=K.heartbeat===!1?void 0:await B$({version:R,logger:j2("heartbeat")});let I=K.fence??(()=>z$({currentVersion:R}));let u=K.slot??H$();let g=async()=>Y$(j(),await u.get({path:{id:"openai"}}));let h=!1;let z=T?Q$({paths:j,slot:u,version:R,fence:I,runDeps:{vaultServes:()=>W.serves()},paused:async()=>await W.authority()!=="local",migrate:async(U)=>{let L=await K$(U);if(h=L.status==="refused",!b)await f.load();return L},adopt:async(U)=>{if(b)return{status:"retry",reason:"unsettled"};if(!await w2(v,O))return{status:"retry",reason:"vault-roster-pending"};if(b)return{status:"retry",reason:"unsettled"};let L=await Z$(U);if(!b)await f.load();return L}}):void 0;z?.start();H.start();let V=m1(j());let F=_1({source:f,slotPlaceholderWithoutMain:g,storage:()=>i1(j()),pins:V,vault:W,awaitVaultRoster:async()=>{await w2(W.awaitRequestRoster(),X$)},responsesLite:()=>k2().responsesLite,codexEndpoint:()=>k2().codexApiEndpoint,log:J});let C=await f1($,F.adapter,J);F.attach(C);let A=async(U)=>{if(await X2(W),G2(j().configPath))return;if(await z?.idle(),G2(j().configPath))return;if(h&&!O2(U)&&(await I()).open){await f.poolStore().initialize();return}throw Error("OpenAI accounts move to the shared account pool once every OpenCode process on this machine runs this version of openai-auth; the login was not stored. Update or close the older processes and sign in again.")};let P=async(U)=>{await A(U);let L=await O1(f.poolStore(),j(),U,{vault:W});if(!G2(j().configPath))await z?.requestAdoption();await f.load(),J.info("ChatGPT login stored in the account pool",L)};let D=await M2($,{integrationID:n,methods:D1({beginLogin:K.beginLogin??l1,version:R,vault:W}),onLogin:(U)=>P(U),label:"ChatGPT (openai-auth account pool)",vault:A1(W)});let k=await k1($);let q=new AbortController;(async()=>{try{for await(let U of $.event.subscribe({signal:q.signal}))if(U.type==="session.deleted")F.forgetSession(U.data.sessionID)}catch(U){if(!q.signal.aborted)J.warn("stopped listening for session deletion",{error:U instanceof Error?U.message:String(U)})}})();y=!0;return async()=>{b=!0,q.abort(),z?.dispose(),f.dispose(),await Promise.allSettled([C.dispose(),D.dispose(),k.dispose()]);let U;try{await Promise.race([Promise.all([z?.idle(),f.settled()]),new Promise((L)=>{U=setTimeout(L,c$),U.unref?.()})])}finally{clearTimeout(U),H.release(),await d?.release()}}}catch(i){var l=i,p=1}finally{u1(m,l,p)}}var i$=I2(),jK={id:F2,setup:i$.setup,server:U$.server};export{jK as default,I2 as createOpenAIAuthPlugin,F2 as OPENAI_AUTH_PLUGIN_ID};
+import{c as uZ}from"../index-qp5hdpw8.js";import{$ as s$,A as W$,B as U$,C as IZ,D as fZ,E as W1,F as vZ,G as hZ,H as Z$,I as UZ,J as HZ,K as mZ,L as gZ,M as D$,N as w$,O as S2,P as J$,S as i$,T as a$,aa as t$,d as L$,e as SZ,ea as lZ,f as V2,g as B2,h as b2,i as wZ,j as yZ,k as I2,ka as R1,l as Y2,la as A1,n as E1,o as O1,oa as pZ,p as _1,q as R2,r as C$,s as T$,t as _$,u as q$,v as k$,w as b$,x as p$,y as c$,z as D2}from"../index-rwbrhkse.js";import{Qa as v$,Xa as ZZ,fb as f2,gb as RZ,hb as AZ,ib as xZ,kb as qZ,lb as h$,ub as kZ,va as OZ,vb as bZ,wb as DZ,xb as m$,ya as c1,za as d1}from"../index-03em8hv1.js";import{$b as VZ,Lb as QZ,_b as jZ,bc as BZ,fc as WZ}from"../index-6n4pnfkg.js";import{$c as B1,$d as n1,Cd as Z2,Hd as u1,Jd as B$,Kd as p1,Qd as y2,Sc as q2,Tc as k2,Uc as MZ,Xd as r$,Yd as K2,Zd as i1,_d as a1,ad as h1,bd as m1,be as o1,cd as g1,ce as r1,de as s1,ee as t1,fe as e1,ge as $$,jd as I$,pd as f$,rd as EZ,sd as o$,td as l1,vc as v1}from"../index-f21addzm.js";import{me as K$}from"../index-qxbchh2d.js";import{ve as x$}from"../index-htvcmtcx.js";import"../index-ffg0sgg5.js";import{Fe as _Z,He as J2}from"../index-ehjj89rx.js";import"../index-r2s51ac1.js";import{bf as S$}from"../index-bc89akak.js";import{ff as v2,gf as TZ}from"../index-xwvze96g.js";import{AsyncLocalStorage as p0}from"node:async_hooks";import{randomUUID as c0}from"node:crypto";class n extends Error{kind;providerID;sessionID;requestKind;constructor($){super($.message??`${$.providerID} ${$.requestKind} request refused (${$.kind})`);this.name="OpenCode2AuthError",this.kind=$.kind,this.providerID=$.providerID,this.sessionID=$.sessionID,this.requestKind=$.requestKind}}function t($){return`common-auth-placeholder.${$}`}function K1($){let Z=t($.integrationID);return{type:"oauth",methodID:$.methodID,access:Z,refresh:Z,expires:$.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function N2($,Z){if($?.type!=="oauth")return!1;let J=Z===void 0?void 0:t(Z),z=(X)=>J===void 0?X.startsWith("common-auth-placeholder."):X===J;return z($.access)&&z($.refresh)}var L1="No browser sign-in: this connects the plugin to the accounts in its vault.";async function p2($,Z){let J=Z.now??Date.now,{integrationID:z}=Z,X=(H)=>K1({integrationID:z,methodID:H,now:J()}),Y=async(H,W)=>{return await Z.onLogin(H,{integrationID:z,methodID:W}),X(W)},F=(H)=>async(W)=>{let B=H.method.id,V=await H.authorize(W),L={url:V.url,instructions:V.instructions,...V.expiresAt===void 0?{}:{expiresAt:V.expiresAt}};if(V.mode==="auto")return{...L,mode:"auto",callback:V.callback.then((T)=>Y(T,B))};let x=V.callback;return{...L,mode:"code",callback:async(T)=>Y(await x(T),B)}};return $.integration.transform((H)=>{let W=Z.label===void 0?{}:{label:()=>Z.label};for(let L of Z.methods)H.method.update({integrationID:z,method:L.method,authorize:F(L),refresh:async(x)=>{if(!N2(x,z))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return X(x.methodID)},...W});let B=Z.vault;if(B===void 0)return;let V=B.method.id;H.method.update({integrationID:z,method:B.method,authorize:async()=>({url:"",instructions:B.instructions??L1,mode:"auto",callback:Promise.resolve().then(()=>B.activate({integrationID:z,methodID:V})).then(()=>X(V))}),refresh:async(L)=>{if(!N2(L,z)||L.methodID!==V)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return X(V)},...W})})}function cZ($){let Z=[],J;for(let z of $.split(/\r?\n/))if(z.startsWith("data:"))Z.push(z.slice(5).replace(/^ /,""));else if(z.startsWith("event:"))J=z.slice(6).trim();if(Z.length===0)return;return J===void 0?{data:Z.join(`
+`)}:{event:J,data:Z.join(`
+`)}}function c2($,Z){let J=new TextDecoder,z="",X=(F)=>{let H=cZ(F);if(!H)return;try{$(H)}catch(W){Z(W)}},Y=()=>{for(;;){let F=/\r?\n\r?\n/.exec(z);if(!F)return;let H=z.slice(0,F.index);z=z.slice(F.index+F[0].length),X(H)}};return new TransformStream({transform(F,H){H.enqueue(F),z+=J.decode(F,{stream:!0}),Y()},flush(){if(z+=J.decode(),Y(),z.trim()!=="")X(z);z=""}})}var C1=512,j2="x-common-auth-attempt",X2=($,Z)=>JSON.stringify([$,Z]),e=($)=>({providerID:$.model.providerID,modelID:$.model.id,sessionID:$.sessionID,agent:$.agent,kind:$.kind});function dZ($){let Z=$.headers;return typeof Z==="object"&&Z!==null}function iZ($,Z){let J=$.getReader();return new ReadableStream({async pull(z){let X;try{X=await J.read()}catch(Y){Z({reason:"failed",message:Y instanceof Error?Y.message:String(Y)}),z.error(Y);return}if(X.done)Z(),z.close();else z.enqueue(X.value)},async cancel(z){Z({reason:"cancelled",...z===void 0?{}:{message:String(z)}}),await J.cancel(z)}})}function d2($,Z){for(let[J,z]of Object.entries(Z)){let X=J.toLowerCase();for(let Y of Object.keys($))if(Y.toLowerCase()===X)delete $[Y];if(z!==null)$[J]=z}}function aZ($,Z){for(let[J,z]of Object.entries(Z))if(z===null)$.delete(J);else $.set(J,z)}async function i2($,Z,J={}){let{providerID:z}=Z,X=J.gateOnPlaceholder,Y=(G)=>X===void 0||X.credential(G)===t(z),F=J.logger,H=Math.max(1,J.maxRecords??C1),W=[...J.hostCredentials??[t(z)],...X?[t(z)]:[]].filter((G)=>G!==""),B=new Map,V=new WeakMap,L=new Map,x=new Set,T=new Map,v=!1,d=!1,S=new Map,y=0,a=!1,I=new Map,j=(G,Q)=>{try{F?.warn(G,Q)}catch{}},K=(G)=>G instanceof Error?G.message:String(G),R=async(G,Q)=>{let U=S.get(G);if(!U||U.size===0)return;await Promise.all([...U].map(async(P)=>{try{await P(Q)}catch(q){j("opencode2 auth listener threw; the request is unaffected",{event:G,error:K(q)})}}))},M=async(G,Q)=>{try{await Z.onAttemptEnd?.(G,Q)}catch(U){j("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:G.attemptId,error:K(U)})}},A=(G,Q)=>{if(G.ended||!G.attempt)return;let U={...G.status===void 0?{}:{status:G.status},outputStarted:G.outputStarted,...G.limit?{limit:G.limit.signal}:{},...Q?{error:Q}:{}};if(Q)G.endError=Q;G.ended=M(G.attempt,U)},N=(G,Q)=>A(G,{reason:"abandoned",message:Q}),_=(G)=>[...B.values()].filter((Q)=>Q.key===G),k=(G)=>_(G).at(-1),E=(G)=>{if(B.delete(G.id),!_(G.key).length)L.delete(G.key)},l=(G)=>{B.set(G.id,G);while(B.size>H){let Q=B.values().next().value;if(Q===void 0)break;N(Q,"dropped to keep the record bound"),E(Q)}},i=(G)=>G.accountId===void 0?void 0:{...G.scope,accountId:G.accountId},c=(G,Q)=>new n({kind:"no-account",providerID:z,sessionID:G.sessionID,requestKind:G.kind,...Q===void 0?{}:{message:Q}}),m=(G)=>{I.get(G)?.clear(),I.delete(G)},p=async(G,Q)=>{let U=()=>c(G,`${z} ${G.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(a)throw U();let P=I.get(G.sessionID);if(!P)P=new Set,I.set(G.sessionID,P);let q={};P.add(q);let w=()=>{if(!P.has(q))throw U()};try{return await Q(w)}finally{if(P.delete(q),P.size===0&&I.get(G.sessionID)===P)I.delete(G.sessionID)}},b=(G,Q)=>{for(let[U,P]of Q)if(W.some((q)=>P.includes(q)))throw new n({kind:"host-credential-on-wire",providerID:z,sessionID:G.sessionID,requestKind:G.kind,message:`${z} ${G.kind} request still carries the host's placeholder credential in ${U}; the adapter's account headers must replace it`})},u=(G)=>{for(let Q of _(G))if(Q.ended||!Q.attempt)E(Q);else if(Q.transport==="ws"||Q.judged)N(Q,"a newer attempt of its session and kind began"),E(Q)},g=async(G,Q,U,P)=>{let q=X2(G.sessionID,G.kind),w=L.get(q);L.delete(q);let O=w?.accountId??k(q)?.accountId;u(q);let D={...G,...O===void 0?{}:{previousAccountId:O},...w?.rerouteFrom===void 0?{}:{rerouteFrom:w.rerouteFrom}},h=await Z.chooseAccount(D);U();let s={},F1;if(h!==void 0){let E2=await Z.accountHeaders({...G,accountId:h});if(U(),dZ(E2))s=E2.headers,F1=E2.attempt;else s=E2}let P1=`attempt-${++y}`,H2={id:P1,key:q,scope:G,accountId:h,headers:s,attempt:h===void 0?void 0:{...G,accountId:h,attemptId:P1,transport:P,data:F1},...P===void 0?{}:{transport:P},outputStarted:!1};if(l(H2),H2.attempt)R("select",{...G,accountId:H2.attempt.accountId,hook:Q,...D.previousAccountId===void 0?{}:{previousAccountId:D.previousAccountId},...D.rerouteFrom===void 0?{}:{rerouteFrom:D.rerouteFrom},handle:H2.attempt});return H2},z2=async(G,Q,U,P,q)=>{let w=X2(G.sessionID,G.kind),O=P===void 0?void 0:B.get(P);if(O?.key!==w)O=void 0;if(!O){if(O=k(w),_(w).filter((h)=>h.transport===void 0&&!h.ended).length>1&&!d)d=!0,j("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:G.sessionID,kind:G.kind})}if(!O||O.transport!==void 0||O.ended)O=await g(G,Q,q,U);else if(O.transport=U,O.attempt)O.attempt.transport=U;if(U==="ws"){for(let D of _(w))if(D!==O&&D.transport==="ws")N(D,"a newer attempt of its session and kind went out over WebSocket")}return O},W2=async(G,Q)=>{try{return await Q()}catch(U){throw A(G,{reason:"failed",message:K(U)}),U}},M2=(G,Q)=>{let U=_(X2(G,Q)).filter((P)=>P.transport==="ws").at(-1);return U?.attempt!==void 0&&!U.ended?U:void 0},U2=(G,Q,U)=>{let P=i(G);if(!P||!G.attempt||G.limit)return;G.limit={signal:Q,delivered:R("limit",{...P,via:U,limit:Q,outputStarted:G.outputStarted,handle:G.attempt})}},Q2=(G,Q,U,P)=>{let q=i(G);if(!q||!G.attempt)return;R("quota",{...q,transport:Q,...P===void 0?{}:{status:P},quota:U,handle:G.attempt})},G2=(G,Q,U,P)=>{let q=G.attempt;if(!q)return;let w=Z.inspectEvent?.(P===void 0?{transport:Q,data:U,attempt:q}:{transport:Q,data:U,event:P,attempt:q});if(!w)return;if(w.quota!==void 0)Q2(G,Q,w.quota);if(w.outputStarted)G.outputStarted=!0;if(w.limit)U2(G,w.limit,Q);if(w.error!==void 0)A(G,{reason:"failed",message:w.error});else if(w.done)A(G)},m2=(G,Q)=>{let U=G.attempt;if(!U||Q.accountId===G.accountId)return;if(U.reboundFrom??=U.accountId,U.accountId=Q.accountId,"data"in Q)U.data=Q.data;G.accountId=Q.accountId},g2=(G)=>!G.attempt||G.endError!==void 0||G.status!==void 0&&G.status>=400,l2=(G)=>{let Q=[...B.values()].filter((D)=>D.scope.sessionID===G),U=Q.filter((D)=>D.limit&&!D.rerouted).at(-1);if(U)return U;let P=Q.filter((D)=>D.scope.kind==="primary"),q=P.length>0?P:Q;if(q.length<=1)return q[0];let w=q.filter((D)=>!D.judged&&g2(D)).at(-1);if(w)return w;let O=q.filter((D)=>D.attempt&&!D.ended);if(O.length>1)return"ambiguous";return O[0]??q.at(-1)},C={providerID:z},f=[];f.push(await $.session.hook("model.request",(G)=>{if(X)return;return p(e(G),async(Q)=>{let U=await g(e(G),"model.request",Q);if(Q(),U.accountId===void 0)throw c(U.scope);d2(G.headers,{...U.headers,[j2]:U.id})})},C)),f.push(await $.session.hook("http.request",(G)=>{if(X){let Q=Y(G.request.headers);if(T.set(G.sessionID,Q),!Q)return}return p(e(G),async(Q)=>{let U=G.request.headers.get(j2)??void 0,P=X?await g(e(G),"http.request",Q,"http"):await z2(e(G),"http.request","http",U,Q);Q();let q=i(P),w=P.attempt;if(!q||!w)throw c(P.scope);await W2(P,async()=>{let O=G.request;if(Z.rewriteRequest){if(U!==void 0){let s=new Headers(O.headers);s.delete(j2),O=new Request(O,{headers:s})}O=await Z.rewriteRequest({...q,request:O,attempt:w})??O,Q()}let D=new Headers(O.headers);D.delete(j2),aZ(D,P.headers),b(P.scope,D.entries());let h=new Request(O,{headers:D});V.set(h,P),G.request=h})})},C)),f.push(await $.session.hook("http.response",async(G)=>{let Q=V.get(G.request);if(!Q){if(X)return;if(!v)v=!0,j("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:G.sessionID,kind:G.kind});return}let U=G.response;if(Z.answeredBy&&Q.attempt){let D=Q.attempt,h=await W2(Q,async()=>Z.answeredBy?.({request:G.request,response:U,attempt:D}));if(h)m2(Q,h)}let P=i(Q),q=Q.attempt;if(!P||!q)return;Q.status=U.status;let w=Z.quotaFromHeaders?.(U.headers,U.status,q);if(w!==void 0)Q2(Q,"http",w,U.status);if(!U.ok&&Z.limitFromResponse){let D=await Z.limitFromResponse({status:U.status,headers:U.headers,body:()=>U.clone().text(),attempt:q});if(D)U2(Q,D,"http")}if(!U.ok||!U.body)A(Q);let O=U;if(U.body&&(Z.inspectEvent||Z.onAttemptEnd)){let D=U.body;if(Z.inspectEvent)D=D.pipeThrough(c2((h)=>G2(Q,"http",h.data,h.event),(h)=>j("opencode2 auth event inspection threw",{error:K(h)})));O=new Response(iZ(D,(h)=>A(Q,h)),{status:U.status,statusText:U.statusText,headers:U.headers})}if(Z.rewriteResponse)O=await Z.rewriteResponse({...P,request:G.request,response:O,attempt:q})??O;if(O!==U)G.response=O},C)),f.push(await $.session.hook("experimental.ws.handshake",(G)=>{if(X){let Q=Y(new Headers(G.headers)),U=X2(G.sessionID,G.kind);if(T.set(G.sessionID,Q),x.delete(U),!Q)return}return p(e(G),async(Q)=>{let U;for(let O of Object.keys(G.headers)){if(O.toLowerCase()!==j2)continue;U??=G.headers[O],delete G.headers[O]}let P=X?await g(e(G),"experimental.ws.handshake",Q,"ws"):await z2(e(G),"experimental.ws.handshake","ws",U,Q);Q();let q=i(P),w=P.attempt;if(!q||!w)throw c(P.scope);await W2(P,async()=>{d2(G.headers,P.headers);let O=Z.rewriteHandshakeURL?.({...q,url:G.url,attempt:w});if(O!==void 0)G.url=O;if(b(P.scope,Object.entries(G.headers)),X)x.add(P.key)})})},C));let r=Z.rewriteWebSocketFrame?.bind(Z);if(r)f.push(await $.session.hook("experimental.ws.send",async(G)=>{let Q=e(G);if(X&&!x.has(X2(Q.sessionID,Q.kind)))return;let U=M2(Q.sessionID,Q.kind),P=await r({...Q,attempt:U?.attempt,frame:G.frame});if(P!==void 0)G.frame=P},C));f.push(await $.session.hook("experimental.ws.receive",(G)=>{if(X&&!x.has(X2(G.sessionID,G.kind)))return;let Q=M2(G.sessionID,G.kind);if(!Q)return;try{G2(Q,"ws",G.frame)}catch(U){j("opencode2 auth frame inspection threw",{error:K(U)})}},C)),f.push(await $.session.hook("retry",async(G)=>{if(X&&T.get(G.sessionID)!==!0)return;let Q=l2(G.sessionID);if(!Q)return;let U=G.decision;if(Q==="ambiguous"){await R("retry",{sessionID:G.sessionID,attempt:G.attempt,reason:"host-decides",hostDecision:U,decision:U});return}let P=Q;await p(P.scope,async(q)=>{P.judged=!0;let w=U,O,D,h=P.attempt;if(P.accountId===void 0||!h)w={retry:!1},O="no-account";else if(P.outputStarted)w={retry:!1},O="output-started";else{if(!P.limit){let s=Z.limitFromError?.(G.error,h);if(s)U2(P,s,"error")}if(P.ended)await P.ended,q();if(P.limit)await P.limit.delivered,q(),P.rerouted=!0,D={accountId:P.accountId,limit:P.limit.signal},w={retry:!0,delay:0},O="reroute";else O="host-decides"}if(G.decision=w,w.retry&&P.accountId!==void 0)L.set(P.key,{sessionID:P.scope.sessionID,accountId:P.accountId,...D===void 0?{}:{rerouteFrom:D}});await R("retry",{sessionID:G.sessionID,...P.accountId===void 0?{}:{accountId:P.accountId},kind:P.scope.kind,attempt:G.attempt,reason:O,hostDecision:U,decision:w,...h===void 0?{}:{handle:h}})})},C));let H1=(G)=>{m(G),T.delete(G);for(let Q of x)if(JSON.parse(Q)[0]===G)x.delete(Q);for(let Q of[...B.values()]){if(Q.scope.sessionID!==G)continue;N(Q,"its session was forgotten"),B.delete(Q.id)}for(let[Q,U]of L)if(U.sessionID===G)L.delete(Q)},u2=new AbortController,N1=$.event;if(N1)(async()=>{try{for await(let G of N1.subscribe({signal:u2.signal}))if(G.type==="session.deleted")H1(G.data.sessionID)}catch(G){if(!u2.signal.aborted)j("opencode2 auth stopped listening for session deletion",{error:K(G)})}})();return{on(G,Q){let U=S.get(G);if(!U)U=new Set,S.set(G,U);let P=Q;return U.add(P),()=>{U.delete(P)}},accountFor(G,Q){return k(X2(G,Q))?.accountId},forgetSession:H1,get size(){return B.size},async dispose(){if(a)return;a=!0;for(let G of I.keys())m(G);u2.abort();for(let G of B.values())N(G,"the installation was disposed");B.clear(),L.clear(),x.clear(),T.clear(),S.clear(),await Promise.all(f.map(async(G)=>{try{await G.dispose()}catch(Q){j("opencode2 auth hook did not dispose cleanly",{error:K(Q)})}}))}}}import{createHash as nZ}from"node:crypto";var oZ=1024,rZ=($)=>typeof $==="object"&&$!==null&&!Array.isArray($),T1=($)=>_1($,"user"),sZ=($)=>rZ($)&&($.role==="assistant"||typeof $.type==="string"&&$.type!=="message"&&$.type!=="configuration_update");function tZ($){return nZ("sha256").update(JSON.stringify($)).digest("hex")}class F2{runtime;maxSessions;#$=new Map;constructor($,Z=oZ){this.runtime=$;this.maxSessions=Z}advance($,Z,J=this.runtime){let z=this.#$.get($),X=Array.isArray(Z.input)?Z.input:[],Y=X.filter(T1),F=X.findLastIndex(T1),H=F<0?void 0:tZ(X[F]),W=typeof Z.previous_response_id==="string"&&Z.previous_response_id.length>0,B,V,L;if(W)B=Y.length>0,V=H??z?.fingerprint,L=z?.userCount===void 0?void 0:z.userCount+Y.length;else{V=H,L=Y.length;let T=F>=0&&F>X.findLastIndex(sZ),v=z!==void 0&&!z.completed&&z.fingerprint===V&&z.userCount===L;B=T&&!v}let x=B||!z?{turnID:(J?.uuid??Y2)(),turnStartedAt:(J?.now??Date.now)()}:{turnID:z.turnID,turnStartedAt:z.turnStartedAt};return this.#Z($,{...x,completed:!1,fingerprint:V,userCount:L}),x}completed($){let Z=this.#$.get($);if(Z)this.#Z($,{...Z,completed:!0})}get($){return this.#$.get($)}forget($){this.#$.delete($)}#Z($,Z){this.#$.delete($),this.#$.set($,Z);while(this.#$.size>this.maxSessions){let J=this.#$.keys().next().value;if(J===void 0)break;this.#$.delete(J)}}}function a2($,Z){return{threadID:$.threadID,windowID:$.windowID,turnID:Z.turnID,turnStartedAt:Z.turnStartedAt}}var M1=Symbol.for("@cortexkit/openai-auth/opencode2/codex-installation");function eZ(){let $=globalThis;return $[M1]??=crypto.randomUUID(),$[M1]}class P2{runtime;store;sessions;frameTurns;installationID;constructor($,Z,J){this.runtime=$;this.store=J;this.installationID=Z??eZ(),this.sessions=J?.sessions??new Map,this.frameTurns=J?.frameTurns??new F2}get($){let Z=this.runtime?.uuid??Y2;if(this.store)return this.store.get($,Z);let J=this.sessions.get($);if(!J){let z=Z();J={threadID:z,turnID:Z(),windowID:`${z}:0`},this.sessions.set($,J)}return J}advanceFrame($,Z){return this.frameTurns.advance($,Z,this.runtime)}frameReceived($,Z){if(!Z.includes("response.completed"))return;if(O2(Z)?.type==="response.completed")this.frameTurns.completed($)}forget($){if(this.store)this.store.delete($);else this.sessions.delete($),this.frameTurns.forget($)}}var n2={version:E1,"user-agent":O1,originator:"codex_exec"};var $0=1024,Z0=/(?:^|\/)gpt-6-(?:astra|sol|luna)$/i,A2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($),x1=($)=>A2($)&&($.type==="message"||("role"in $))&&$.role==="user",S1=($)=>A2($)&&$.type==="configuration_update";class o2{http;#$=new Map;constructor($=new P2){this.http=$}apply($,Z,J){if(Z.kind!=="primary")return!1;let z=typeof $.model==="string"?$.model:"";if(!R1.has(z))return!1;if(Z0.test(z))return!1;let X=A2($.reasoning)?$.reasoning:void 0,Y=typeof X?.effort==="string"?X.effort:void 0;if(!Y)return!1;let F=this.#$.get(Z.sessionID);if(F===void 0)return this.#Z(Z.sessionID,Y),!1;if(Y===F)return!1;let H=Array.isArray($.input)?$.input:void 0;if(!H||H.length===0)return!1;let W=H.findLastIndex(x1);if(W<0){if(J==="http")return!1;return $.reasoning={...X,effort:F},!0}if($.reasoning={...X,effort:F},!S1(H[W-1]))H.splice(W,0,{type:"configuration_update",reasoning:{effort:Y}});return!0}forget($){this.#$.delete($),this.http.forget($)}#Z($,Z){this.#$.set($,Z);while(this.#$.size>$0){let J=this.#$.keys().next().value;if(J===void 0)break;this.#$.delete(J)}}}function O2($){try{let Z=JSON.parse($);return A2(Z)?Z:void 0}catch{return}}async function q1($,Z,J,z,X=J.http){if($.method.toUpperCase()!=="POST")return;if(!/\/responses\/?$/.test(new URL($.url).pathname))return;let Y=await $.clone().text(),F=O2(Y);if(F)delete F.max_output_tokens;let H=new Headers($.headers),W=R2({rewriteLite:A1,init:{body:F?JSON.stringify(F):$.body===null?void 0:Y},headers:H,metadata:X.get(Z.sessionID),installationID:X.installationID,runtime:X.runtime,websocket:!1,responsesLite:z,applyEffort:(B)=>{J.apply(B,Z,"http")}});return new Request($,{headers:H,body:W.init?.body})}function k1($,Z,J,z){let X=z.sessions.get($.sessionID),Y=z.frameTurns.get($.sessionID);if(!X||!Y)return;let F=a2(X,Y),H=new Headers({"content-type":"application/json"});for(let B of["chatgpt-account-id","x-opencode-parent-session-id","x-parent-session-id"]){let V=J.get(B);if(V!==null)H.set(B,V)}R2({init:{body:$.bodyText},headers:H,metadata:F,installationID:z.installationID,runtime:z.runtime,websocket:!1,skipTurnUpdate:!0,responsesLite:!1,rewriteLite:()=>{}});let W=new URL(Z);if(W.protocol==="wss:")W.protocol="https:";if(W.protocol==="ws:")W.protocol="http:";return new Request(W,{method:"POST",headers:H,body:$.bodyText})}function J0($,Z){if(JSON.stringify($)===JSON.stringify(Z))return!0;if(!Array.isArray($)||!Array.isArray(Z)||Z.length!==$.length+1)return!1;let J=Z.findIndex((z,X)=>JSON.stringify(z)!==JSON.stringify($[X]));return J>=0&&S1(Z[J])&&x1(Z[J+1])&&JSON.stringify(Z.slice(J+1))===JSON.stringify($.slice(J))}function b1($,Z,J){let z=O2($);if(z?.type!=="response.create")return;let X=J.http.advanceFrame(Z.sessionID,z),Y=J.http.get(Z.sessionID);delete z.max_output_tokens;let F=R2({rewriteLite:()=>{},init:{body:JSON.stringify(z)},headers:new Headers,metadata:a2(Y,X),installationID:J.http.installationID,runtime:J.http.runtime,websocket:!0,responsesLite:!1,applyEffort:(W)=>{J.apply(W,Z,"ws")}}),H=O2(String(F.init?.body));if(!H)return;if(!J0(z.input,H.input)){if("input"in z)H.input=z.input;else delete H.input;return JSON.stringify(H)}return String(F.init?.body)}function z0($){return $.replace(/\/responses\/?$/,"").replace(/\/$/,"")}function r2($,Z){let J=new URL($);if(J.origin!=="https://api.openai.com"&&J.origin!=="wss://api.openai.com"||!/\/responses\/?$/.test(J.pathname))return $;let z=new URL(`${z0(Z)}/responses`);if(z.search=J.search,J.protocol==="ws:"||J.protocol==="wss:")z.protocol=z.protocol==="https:"?"wss:":"ws:";return z.href}import{resolve as D1}from"node:path";var G0=1024;class x2{accounts=new Map;limit;constructor($=G0){this.limit=Math.max(1,$)}record($,Z){this.accounts.delete($),this.accounts.set($,Z);while(this.accounts.size>this.limit){let J=this.accounts.keys().next().value;if(J===void 0)break;this.accounts.delete(J)}}activeAccount($){return this.accounts.get($)}forget($){this.accounts.delete($)}get size(){return this.accounts.size}}var w1=Symbol.for("@cortexkit/openai-auth/opencode2-session-accounts"),y1=globalThis,s2=y1[w1]??new Map;y1[w1]=s2;function t2($){let Z=JSON.stringify([D1($.configPath),D1($.statePath)]),J=s2.get(Z);if(!J)J=new x2,s2.set(Z,J);return J}var o="openai",X0=60000,I1=1,Y0="request refused: no account with a usable credential",$2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($);function Q0($){let Z=$2($)?$.counters:void 0,J=$2(Z)?Z.resetCredits:void 0,z=$2(J)?J.value:void 0;return typeof z==="number"&&Number.isFinite(z)?z:void 0}function e2($){try{return JSON.parse($)}catch{return}}function f1($){let Z=q2($);return Z?k2(Z):void 0}var j0=new Set(["usage_limit_reached","rate_limit_exceeded"]);function $1($,Z,J){return{reason:$.window,...J!==void 0?{status:J}:{},...$.resetAt!==void 0?{retryAfterMs:Math.max(0,$.resetAt-Z)}:{}}}function V0($,Z){let J=S2($);if(J){let Y=typeof $.status==="number"?$.status:void 0;return $1(J,Z,Y)}if($.type!=="response.failed"||!$2($.response))return;let z=$.response.failed;if($2(z)&&typeof z.rate_limit_reached_type==="string")return{reason:z.rate_limit_reached_type};let X=$.response.error;if($2(X)){let Y=typeof X.code==="string"?X.code:typeof X.type==="string"?X.type:void 0;if(Y&&j0.has(Y))return{reason:Y}}return}function B0($,Z){let J=e2($);if(!$2(J))return;let z=typeof J.type==="string"?J.type:void 0;if(z==="codex.rate_limits")return{quota:{snapshot:g1(J),complete:!0}};let X=V0(J,Z);if(X)return{limit:X};if(z===void 0||z==="error")return;return J$(z)?void 0:{outputStarted:!0}}function W0($){let Z=!1;for(let J of $.keys())if(J.toLowerCase().startsWith("x-codex-")){Z=!0;break}if(!Z)return;return{snapshot:h1($),complete:m1($)}}function U0($){let Z=$.get("retry-after");if(Z===null)return;let J=Number(Z);return Number.isFinite(J)&&J>=0?J*1000:void 0}function z$($){let{source:Z,pins:J}=$,z=$.now??Date.now,X=$.log,Y=$.vault,F=new o2($.codex),H=new Map,W=(j)=>`${j.sessionID}\x00${j.kind}\x00${j.accountId}`,B=new Map,V=$.sessionAccounts??new x2,L=(j,K,R)=>{let M=R?[]:Z$(Z.peek().rows,j,K,Y?.identities()??new Set),A=(Y?.routes()??[]).filter((N)=>N.kind==="oauth"&&u1(K2(N.quota),j,K));return[...M.map((N)=>({id:N.id,...N.identity!==void 0?{identity:N.identity}:{},quota:N.quota,row:N})),...A.map((N)=>({id:N.id,...N.identity!==void 0?{identity:N.identity}:{},quota:N.quota}))]},x=(j,K,R)=>{let M=n1(j,K,R),A=j.map((E)=>({id:E.id,kind:"oauth",...v1(E.quota)?{quota:E.quota}:{}})),N=j.flatMap((E)=>E.row?[E.row]:[]),_=new Set(j.filter((E)=>!E.row).map((E)=>E.id)),k=Z.rateLimitMarks(N);for(let E of _){let l=B.get(E);if(l===void 0)continue;if(l<=R)B.delete(E);else k.set(E,l)}return{rows:A,now:R,rateLimitMarks:k,refreshBackoff:Z.refreshBackoffFor(N),killswitch:M,requestPull:(E)=>_.has(E)?Y?.requestReading(E):Z.requestReading(E)}},T=(j,K,R,M,A)=>{let N=s1({...j,placement:o1(K),mainId:A});if(N.kind==="block"){X?.debug("pool admission refused the request",{reason:N.block.reason});return}let _=N.order.filter((k)=>!R.has(k));if(M!==void 0&&_.includes(M))return M;return _[0]},v=(j,K,R,M,A,N)=>{let _=new Map(K.map((b)=>[b.id,b.quota])),k={requestBytes:I1,reservePercent:(b)=>p1(R,b===i1?void 0:b),resetCredits:(b)=>Q0(_.get(b))},E=t1(j),l=(b,u)=>J.place({sessionId:M,requestBytes:I1,validPinnedAccountIds:j.rows.map((g)=>g.id).filter((g)=>!E.excluded.has(g)),excludeAccountIds:b,quotaCheckedAtByAccount:Object.fromEntries(j.rows.map((g)=>[g.id,E.projections.get(g.id)?.checkedAt])),wireAccountIdByAccount:Object.fromEntries(K.map((g)=>[g.id,g.identity])),select:(g)=>e1(j,k,new Set(b),g),persist:u}),i=[...A],c=l(i,N);if(!c)return;let m=c.accountId,p=$$(j,k,m);if(p.kind==="none")return;if(p.kind==="move"){let b=l([...i,m],N);if(b)return b.accountId;return p.reason==="killswitch"?void 0:m}if(p.kind==="detour")return l([...i,m],!1)?.accountId;return m},y={providerID:o,chooseAccount:async(j)=>{let K=await Y?.authority(),R=await $.storage(),M=K!==void 0&&K!=="local",A=()=>{throw new n({kind:"no-account",providerID:o,sessionID:j.sessionID,requestKind:j.kind,message:b2})};if(M)await $.awaitVaultRoster?.();else{if(!(await Z.current()).active){if(await $.slotPlaceholderWithoutMain?.())A();X?.warn("the account pool does not serve requests yet; refusing the request",{kind:j.kind});return}await Z.prepareTokens(Z.peek().rows,R)}let N=z(),_=L(R,N,M),k=r1(x(_.filter((u)=>u.id!==j.rerouteFrom?.accountId),R,N));if(k)await k,N=z(),_=L(R,N,M);let E=new Map(_.map((u)=>[u.id,u])),l=x(_,R,N),i=new Set(j.rerouteFrom?[j.rerouteFrom.accountId]:[]),c=R?.routing?.mode??"main-first",m=j.kind==="primary",p=new Set,b;for(;;){let u=new Set([...i,...p]);if(b=void 0,c==="sticky-balanced")b=v(l,_,R,j.sessionID,u,m&&p.size===0);if(b??=T(l,c,u,m?void 0:V.activeAccount(j.sessionID),M?c==="sticky-balanced"?null:a1(Y?.routes()??[]):void 0),b===void 0||p.has(b)){b=void 0;break}let g=E.get(b)?.row;if(g){if(Z.usableToken(g)!==void 0)break;X?.debug("pool row holds no usable token; choosing again",{accountId:b})}else{if(!Y)break;let z2=await Y.authorize(b);if(z2){H.set(W({...j,accountId:b}),z2);break}X?.debug("the vault refused to serve an account; choosing again",{accountId:b})}p.add(b)}if(b===void 0&&!M&&_.length===0&&await $.slotPlaceholderWithoutMain?.())A();if(b===void 0&&M&&Y&&(_.length===0||p.size>0)){let u=p.size>0?"vault-refused":d1(Y);throw X?.warn("vault mode: no vault account can serve; refusing the request",{cause:u}),new n({kind:"no-account",providerID:o,sessionID:j.sessionID,requestKind:j.kind,message:c1(u,Y.name)})}if(b!==void 0&&m)V.record(j.sessionID,b),$.onRoute?.(j.sessionID,b,c);return X?.debug("pool account chosen",{kind:j.kind,accountId:b,mode:c,...j.rerouteFrom?{rerouteFrom:j.rerouteFrom.accountId}:{}}),b},accountHeaders:async(j)=>{let{accountId:K}=j,R=()=>new n({kind:"no-account",providerID:o,sessionID:j.sessionID,requestKind:j.kind,message:Y0}),M=Y&&await Y.authority()!=="local"?void 0:Z.peek().rows.find((_)=>_.id===K);if(!M&&Y){let _=W(j),k=H.get(_)??await Y.authorize(K);if(H.delete(_),!k)throw X?.warn("the vault refused to serve an account; refusing the request",{accountId:K}),R();return{headers:{...n2,"session-id":j.sessionID,authorization:`Bearer ${k.accessToken}`,"chatgpt-account-id":k.accountIdentity??f1(k.accessToken)??null},attempt:{kind:"vault",routeId:K,receipt:k}}}let A=M?Z.usableToken(M):void 0;if(!M||!A)throw X?.warn("pool row holds no usable token; refusing the request",{accountId:K}),R();let N=M.identity??f1(A);return{headers:{...n2,"session-id":j.sessionID,authorization:`Bearer ${A}`,"chatgpt-account-id":N??null},attempt:{kind:"pool",token:A,credentialEpoch:M.credentialEpoch}}},async rewriteRequest({request:j,sessionID:K,kind:R}){let M=$.codexEndpoint?r2(j.url,$.codexEndpoint()):j.url,A=M===j.url?j:new Request(M,j);return await q1(A,{sessionID:K,kind:R},F,$.responsesLite?.()??!1)??A},rewriteHandshakeURL:({url:j})=>$.codexEndpoint?r2(j,$.codexEndpoint()):void 0,rewriteWebSocketFrame:({frame:j,sessionID:K,kind:R})=>b1(j,{sessionID:K,kind:R},F),quotaFromHeaders:(j)=>W0(j),async limitFromResponse({status:j,headers:K,body:R}){if(j<400)return;let M=e2(await R().catch(()=>"")),A=S2({...$2(M)?M:{},status:j});if(!A)return;let N=z(),_=$1(A,N,j);if(_.retryAfterMs!==void 0)return _;let k=U0(K);return k===void 0?_:{..._,retryAfterMs:k}},inspectEvent:({data:j})=>B0(j,z()),limitFromError(j){let K=e2(j.message),R=S2({...$2(K)?K:{},...j.status!==void 0?{status:j.status}:{}})??(j.message.includes("usage_limit_reached")?{window:"usage_limit_reached"}:void 0);return R?$1(R,z(),j.status):void 0},async onAttemptEnd(j,K){let R=j.data;if(R?.kind!=="vault"||K.status!==401)return;X?.warn("a vault account answered 401; reporting it to the vault",{accountId:j.accountId}),await Y?.reportFailure(R.receipt,401)}},a=(j,K,R)=>{let M=R.data;if(M?.kind==="vault"){Y?.recordSnapshot(j,K.snapshot,K.complete,M.receipt);return}if(M?.kind!=="pool")return;if(Z.peek().rows.find((N)=>N.id===j)?.credentialEpoch!==M.credentialEpoch){X?.debug("quota reading dropped: the row holds another credential",{accountId:j});return}Z.recordSnapshot(j,K.snapshot,M.token,K.complete)},I=(j,K,R)=>{let M=z(),A=R.data?.kind==="vault",N=A?Y?.routes().find((E)=>E.id===j)?.quota:Z.peek().rows.find((E)=>E.id===j)?.quota,_=l1(K2(N),K.reason,M,X0,K.retryAfterMs!==void 0?M+K.retryAfterMs:void 0);if(!A){Z.markRateLimited(j,_);return}let k=B.get(j);if(k===void 0||k<_)B.set(j,_)};return{adapter:y,attach(j){j.on("quota",(K)=>a(K.accountId,K.quota,K.handle)),j.on("limit",(K)=>{I(K.accountId,K.limit,K.handle),X?.debug("pool row refused the request",{accountId:K.accountId,via:K.via,reason:K.limit.reason,outputStarted:K.outputStarted})})},forgetSession(j){J.forget(j),V.forget(j),F.forget(j)},activeAccount:(j)=>V.activeAccount(j)}}import{resolve as V$}from"node:path";import{Buffer as H0}from"node:buffer";import{resolve as G$}from"node:path";function L2($){return H0.byteLength(JSON.stringify($))}function N0($){return $.reduce((Z,J)=>Z+L2(J),0)}function Z1($,Z){return 2+$+Math.max(0,Z-1)}function F0($){let{head:Z,pending:J}=$;return 10+$.fieldsBytes+1+(Z?22+Z.responseIDBytes+9+Z1(Z.inputBytes,Z.input.length)+1:0)+(J?20+Z1(J.inputBytes,J.input.length)+10+Z1(J.outputBytes,J.output.length)+(J.responseID===void 0?0:14+J.responseIDBytes)+1:0)}function X$($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z))return Z}catch{}return}class Y${enabled;caps=D2;entries=new Map;bytes=0;constructor($=!1){this.enabled=$}setEnabled($){if(this.enabled=$,!$)this.entries.clear(),this.bytes=0}send($,Z){if(!this.enabled)return;let J=X$(Z);if(J?.type!=="response.create")return;if(!Array.isArray(J.input)){this.forget($);return}let z=J.previous_response_id,X=this.entries.get($),Y=X?.head;if(z&&z!==Y?.responseID){this.forget($);return}let{type:F,previous_response_id:H,input:W,...B}=J;this.keep($,{fields:z&&X?X.fields:B,fieldsBytes:z&&X?X.fieldsBytes:L2(B),...z&&Y?{head:Y}:{},pending:{input:W,inputBytes:N0(W),output:[],outputBytes:0,responseIDBytes:0},bytes:0})}receive($,Z,J){if(!this.enabled||!Z.includes("response.created")&&!Z.includes("response.output_item.done")&&!Z.includes("response.completed"))return;let z=this.entries.get($);if(!z?.pending)return;let X=X$(Z);if(!X)return;let Y=z.pending,F=X.response;if(X.type==="response.created"&&typeof F?.id==="string")Y.responseID=F.id,Y.responseIDBytes=L2(F.id),this.keep($,z);else if(X.type==="response.output_item.done"&&X.item){if(typeof X.response_id==="string"&&Y.responseID!==void 0&&X.response_id!==Y.responseID)return;Y.output.push(X.item),Y.outputBytes+=L2(X.item),this.keep($,z)}else if(X.type==="response.completed"&&typeof F?.id==="string"){if(F.id===z.head?.responseID||Y.responseID!==void 0&&F.id!==Y.responseID)return;let H={responseID:F.id,responseIDBytes:Y.responseID===F.id?Y.responseIDBytes:L2(F.id),input:[...z.head?.input??[],...Y.input,...Y.output],inputBytes:(z.head?.inputBytes??0)+Y.inputBytes+Y.outputBytes},W={...z,head:H,pending:void 0};if(!this.keep($,W))return;J?.({sessionID:$,responseID:H.responseID,bodyText:this.body(z.fields,H)})}}replay($){let Z=this.entries.get($);if(!Z?.head)return;return this.entries.delete($),this.entries.set($,Z),this.body(Z.fields,Z.head)}forget($){let Z=this.entries.get($);if(Z)this.bytes-=Z.bytes;this.entries.delete($)}status(){return{bytes:this.bytes,sessions:[...this.entries].map(([$,Z])=>({sessionID:$,bytes:Z.bytes,responseID:Z.head?.responseID,pending:Z.pending!==void 0}))}}body($,Z){return JSON.stringify({...$,input:Z.input,stream:!0})}keep($,Z){let J=F0(Z);if(this.forget($),J>this.caps.maxBytes)return!1;Z.bytes=J,this.entries.set($,Z),this.bytes+=J;while(this.entries.size>this.caps.maxTargets||this.bytes>this.caps.maxBytes){let z=this.entries.keys().next().value;if(z===void 0)break;this.forget(z)}return this.entries.has($)}}var Q$=Symbol.for("@cortexkit/openai-auth/opencode2-frame-mirror"),j$=globalThis,J1=j$[Q$]??new Map;j$[Q$]=J1;function w2($){let Z=JSON.stringify([G$($.configPath),G$($.statePath)]),J=J1.get(Z);if(!J)J=new Y$,J1.set(Z,J);return J}var P0=5000,K0=["accept","originator","session-id","thread-id","user-agent","version","x-client-request-id","x-codex-beta-features","x-codex-turn-metadata","x-codex-window-id","x-openai-internal-codex-responses-lite","x-opencode-parent-session-id","x-parent-session-id"],L0=["x-opencode-parent-session-id","x-parent-session-id"];function H$($){let Z=B$($);return{enabled:Z?.enabled===!0,subagents:Z?.subagents===!0,sustain:Z?.sustain===!0,window:W$($?{...$,cachekeep:Z}:$)}}var N$=Symbol.for("@cortexkit/openai-auth/opencode2-cache-keep"),F$=globalThis,C2=F$[N$]??new Map;F$[N$]=C2;function C0($,Z){let J=[],z=()=>J.at(-1)?.location,X=()=>{let W=z();if(!W)throw Error("no location holds keep-warm");return W},Y=(W,B)=>{H.remove(W),z()?.log?.debug(`cachekeep dropped target (${B})`,{sessionKey:W})},F=async(W)=>{if(W.meta.credentialMode!=="local")throw Error("a target captured in vault mode is not warmed with a local credential");let B=W.accountId??"main",V=X(),L=await V.source.accessFor(B,await V.storage());if(!L)throw Error(`pool row ${B} has no usable token`);return{token:L.token,identity:L.row.identity}},H=U$({...D2,now:$.now,...$.setIntervalImpl?{setIntervalImpl:$.setIntervalImpl}:{},...$.clearIntervalImpl?{clearIntervalImpl:$.clearIntervalImpl}:{},codexResponsesUrl:$.codexResponsesUrl,fetchImpl:(W,B)=>X().fetch(W,B),logger:{debug:(W,B)=>z()?.log?.debug(W,B),warn:(W,B)=>z()?.log?.warn(W,B)},getWindow:()=>z()?.settings().window,getSustain:()=>z()?.settings().sustain===!0,resolveLocal:F,vault:{owns:(W)=>z()?.vault.owns(W)===!0,authority:()=>X().vault.authority(),send:async(W,B,V)=>{let L=X();if(await L.vault.authority()!=="vault")return;return L.vault.send(W,B,V)}},activeAccount:(W)=>{if(W===void 0)throw Error("target has no session");let B=z(),V=B?.settings();if(!B||!V?.enabled){Y(W,"keep-warm is off");return}if(!V.subagents&&H.status().targets.some((x)=>x.sessionKey===W&&x.isSubagent)){Y(W,"subagent warming is off");return}let L=B.accounts.activeAccount(W);if(L===void 0){Y(W,"no account recorded for the session");return}return L},verifyCredential:({target:W,mode:B,identity:V})=>{if(W.meta.credentialMode!==B)throw Error(`a target captured in ${W.meta.credentialMode??"an unknown"} mode is not warmed with a ${B} credential`);if(V!==W.meta.chatgptAccountId)throw Y(W.sessionKey,"the account signs in as another login now"),Error("the account signs in as another login now")}});return{manager:H,settings:Z,holders:J,joinTimeoutMs:$.joinTimeoutMs??P0}}function T0($){try{let Z=JSON.parse($),J=Array.isArray(Z.input)?Z.input.at(-1):void 0;if(J?.role!=="user")return!1;return(typeof J.content==="string"?J.content:Array.isArray(J.content)?J.content.map((X)=>typeof X?.text==="string"?X.text:"").join(""):"").startsWith("This is a keep-alive request.")}catch{return!1}}function _0($){let Z={};for(let J of K0){let z=$.get(J);if(z)Z[J]=z}return Z}function P$($,Z,J){let z=JSON.stringify([V$($.configPath),V$($.statePath)]),X=C2.get(z);if(!X)X=C0(J,Z.settings()),C2.set(z,X);let Y=X,F=w2($);F.setEnabled(Y.settings.enabled);let H={location:{...Z,settings:()=>Y.settings}};Y.holders.push(H);let W=!1,B=async(V)=>{try{let L=H.location.settings();if(W||!L.enabled)return;if(V.kind!=="primary"){if(V.kind==="generate"&&T0(await V.request.clone().text())){if(W)return;Y.manager.remove(V.sessionID)}return}let x=V.attempt.data,T=x?.kind==="pool"?"local":x?.kind==="vault"?"vault":void 0;if(!T)return;let v=V.request.headers,d=L0.some((a)=>v.has(a))||Z.parentOf!==void 0&&await Z.parentOf(V.sessionID)!==void 0;if(d&&!L.subagents)return;let S=await V.request.clone().text();if(W)return;let y=v.get("chatgpt-account-id")??void 0;Y.manager.track({sessionKey:V.sessionID,bodyText:S,accountId:V.attempt.accountId,isSubagent:d,meta:{replayHeaders:_0(v),...y?{chatgptAccountId:y}:{},routingSessionId:V.sessionID,url:V.request.url,credentialMode:T}})}catch(L){Z.log?.warn("cachekeep capture failed",{error:L instanceof Error?L.message:String(L)})}};return{manager:Y.manager,configure:(V)=>{Object.assign(Y.settings,V),F.setEnabled(Y.settings.enabled)},capture:B,forget:(V)=>Y.manager.remove(V),async release(){if(W)return;W=!0;let V=Y.holders.indexOf(H);if(V>=0)Y.holders.splice(V,1);if(Y.holders.length>0)return;if(C2.get(z)===Y)C2.delete(z);Y.manager.stop();let L;try{await Promise.race([Y.manager.tick().catch(()=>{}),new Promise((x)=>{L=setTimeout(x,Y.joinTimeoutMs),L.unref?.()})])}finally{clearTimeout(L)}}}}import{mkdirSync as M0}from"node:fs";import{dirname as E0,join as O0,resolve as R0}from"node:path";var A0="openai-auth-sessions-opencode2.json";function x0(){return O0(L$(),A0)}var S0="sessions",q0=1e4,k0=5000,b0=25;class M${path;options;sessions;frameTurns=new F2;#$=new Set;#Z=new Set;#J=Promise.resolve();#z=!1;constructor($,Z={}){this.path=$;this.options=Z;this.sessions=T$($,Z.uuid??Y2)}get($,Z=Y2){let J=this.sessions.get($);if(!J){let z=Z();J={threadID:z,turnID:Z(),windowID:`${z}:0`},this.sessions.set($,J),this.#Z.delete($),this.#$.add($),this.save()}return J}delete($){this.sessions.delete($),this.frameTurns.forget($),this.#$.delete($),this.#Z.add($),this.save()}save(){if(!this.#z)this.#z=!0,this.#J=this.#J.then(()=>{return this.#z=!1,this.#G()});return this.#J}settled(){return this.#J}async#G(){if(this.#$.size===0&&this.#Z.size===0)return;let $=[...this.#$].flatMap((z)=>{let X=this.sessions.get(z);return X?[[z,X]]:[]}),Z=[...this.#Z],J=null;try{if(M0(E0(this.path),{recursive:!0}),J=await this.#X(),!J)return;let z;try{z=C$(this.path)}catch{z=new Map}await this.options.afterRead?.();for(let X of Z)z.delete(X);for(let[X,Y]of $)z.set(X,Y.threadID);_$(this.path,z)}catch{return}finally{await J?.release().catch(()=>{})}for(let[z,X]of $)if(this.sessions.get(z)===X)this.#$.delete(z);for(let z of Z)if(!this.sessions.has(z))this.#Z.delete(z)}async#X(){let $=performance.now()+(this.options.lockWaitMs??k0);for(;;){let Z=await K$({name:S0,path:this.path,ttlMs:q0});if(Z||performance.now()>=$)return Z;await new Promise((J)=>setTimeout(J,b0))}}}var E$=Symbol.for("@cortexkit/openai-auth/opencode2-codex-sessions"),O$=globalThis,z1=O$[E$]??new Map;O$[E$]=z1;function R$($=x0()){let Z=R0($),J=z1.get(Z);if(!J)J=new M$(Z),z1.set(Z,J);return J}var A$=Symbol.for("cortexkit.openai-auth.v2.commands");function D0(){let $=globalThis;return $[A$]??={locations:new Map},$[A$]}async function y$($,Z){let J=D0(),z=$.location.directory,X={menu:Z,session:$.session},Y=await S$(z),F=await x$(D$,Y.dir,()=>w$({...Y,drain:k$,apply:(V)=>{let L=J.locations.get(z);if(!L)throw Error("The OpenAI menu location was closed");return L.menu.apply(V)}})),H=J.locations.get(z);J.locations.set(z,X),await H?.registration?.dispose(),J.command??={name:"openai",description:"OpenAI account menu",async execute(V){let L=J.locations.values().next().value?.session;if(!L)return;let x=await L.get({sessionID:V.sessionID}),T=J.locations.get(x.location.directory);if(!T||!b$(V.sessionID))return;let v=await T.menu.open(V.sessionID);q$(v,V.sessionID)}};let W=J.command;try{X.registration=await $.command.transform((V)=>{V.add(W)})}catch(V){if(J.locations.get(z)===X)J.locations.delete(z);throw await F.release(),V}let B=!1;return async()=>{if(B)return;if(B=!0,J.locations.get(z)===X)J.locations.delete(z);await F.release(),await X.registration?.dispose()}}var w0="openai-auth-pool-browser",y0="openai-auth-pool-headless",I0="openai-auth-vault",f0="Vault login requires this OpenCode host to be enrolled in the Claustrum vault. Connect to the vault or disconnect this host before trying again.";async function T2($){if(await $.authority()!=="local")throw Error("This host is connected to the credential vault or its enrollment is unreadable; the login was not stored. Disconnect this host from the vault to add a local login.")}function g$($){return{method:{id:I0,type:"oauth",label:"ChatGPT accounts in the vault"},async activate(){if(await I$($.paths,$.name)!=="vault")throw Error(f0)}}}function l$($){let Z=(J,z,X)=>({method:{id:J,type:"oauth",label:z},async authorize(){if($.vault)await T2($.vault);let Y=await $.beginLogin({version:$.version,headless:X});return{url:Y.url,instructions:Y.instructions,mode:"auto",callback:Y.completion}}});return[Z(w0,"ChatGPT (openai-auth pool, browser)",!1),Z(y0,"ChatGPT (openai-auth pool, headless)",!0)]}function G1($){let Z=(J)=>typeof J==="string"?J:"";return N2({type:"oauth",access:Z($.access),refresh:Z($.refresh)})||$.refresh===h$||f$($)}function v0($){if($.accountId)return $.accountId;let Z=$.access?q2($.access):void 0;return Z?k2(Z):void 0}async function u$($,Z,J,z={}){if(z.vault)await T2(z.vault);if(G1(J))throw Error("the credential is not a ChatGPT login (a placeholder or a tombstone); it was not stored");let X=v$($,{rowLocks:(T)=>m$(Z,T)}),Y=await X.read();if(Y.status!=="ready")throw Error(`the account pool cannot be read (${Y.status}); the login was not stored`);let F={type:"oauth",refresh:J.refresh,...J.access!==void 0?{access:J.access}:{},...J.expires!==void 0?{expires:J.expires}:{}},H=v0(J);if(z.vault)await T2(z.vault);let W=H!==void 0?{identity:H}:{};if(z.origin==="import"){let T=Y.rows.find((v)=>H!==void 0&&v.identity===H||v.credential?.type==="oauth"&&v.credential.refresh===J.refresh);if(T)return{id:T.id,operation:"kept"}}let B=Y.rows.filter((T)=>T.type==="oauth"&&!T.invalid),V=H?B.find((T)=>T.identity===H):void 0,L=Y.rows.find((T)=>T.id===y2);if(V)return{id:(await X.replace(V.id,F,W)).id,operation:"replaced"};if(!L){let T=await X.add({id:y2,credential:F,...W,...J.label!==void 0?{label:J.label}:{}});return{id:T.id,operation:T.outcome==="added-disabled"?"added-disabled":"added"}}if(!L.invalid&&!L.credential)return{id:(await X.replace(y2,F,W)).id,operation:"replaced"};let x=await X.add({id:J.id,credential:F,...W,...J.label!==void 0?{label:J.label}:{}});return{id:x.id,operation:x.outcome==="added-disabled"?"added-disabled":x.outcome==="rotated"?"replaced":"added"}}function h0($){let Z=$.itemId!==void 0;switch($.sectionId){case"accounts":return Z?["enable","disable","remove","move"].includes($.actionId):$.actionId==="add";case"routing":return!Z&&["order","mode"].includes($.actionId);case"quota":return $.actionId==="check";case"limits":return Z?$.actionId==="floors":$.actionId==="killswitch";case"session":return!Z&&$.actionId==="clear-pin";case"diagnostics":return!Z&&["logging","dump"].includes($.actionId);case"cache":return!Z&&["enabled","subagents","sustain","window"].includes($.actionId);case"reset":return Z&&["preview","spend","retry"].includes($.actionId);default:return!1}}function d$($){let Z={...$,allowAction:h0,unavailableSections:[]};return{open:(J)=>p$(Z,J),apply:(J)=>{let z=J!==null&&typeof J==="object"?J:{},X=z.values&&typeof z.values==="object"&&!Array.isArray(z.values)?Object.fromEntries(Object.entries(z.values).filter(([,Y])=>Y===null||["string","number","boolean"].includes(typeof Y))):void 0;return c$(Z,{command:"openai",sectionId:typeof z.sectionId==="string"?z.sectionId:"",actionId:typeof z.actionId==="string"?z.actionId:"",...X?{values:X}:{},...z.confirmed===!0?{confirmed:!0}:{},...typeof z.itemId==="string"?{itemId:z.itemId}:{},...typeof z.sessionId==="string"?{sessionId:z.sessionId}:{}})}}}function m0($){if(!i$($.modelID??$.id)){$.enabled=!1;return}let Z=a$($.id);if(Z)$.limit={...Z}}function n$($){return $.model.transform((Z)=>{for(let J of Z.list(o))Z.update(o,String(J.id),(z)=>m0(z))})}class X1{log;pending=new Map;requests=new Map;writing=new Set;constructor($){this.log=$}async safely($){let Z=(async()=>{try{await $()}catch{this.log.warn("request dump failed")}})();this.writing.add(Z);try{await Z}finally{this.writing.delete(Z)}}async captureHttp($,Z){await this.safely(async()=>{if(!V2().dump)return;let J={sessionID:Z.sessionID,accountId:Z.accountId,transport:"http",phase:"http",url:$.url,method:$.method,headers:new Headers($.headers),bodyText:await $.clone().text()};if(this.pending.set($,{attemptId:Z.attemptId,input:J}),this.requests.set(Z.attemptId,$),this.pending.size>512){let z=this.pending.keys().next().value;if(z)this.take(z)}})}take($){let Z=this.pending.get($);if(Z)this.pending.delete($),this.requests.delete(Z.attemptId);return Z?.input}async response($,Z){let J=this.take($);if(J)await this.safely(()=>I2({...J,status:Z}))}async end($,Z){if(Z.status!==void 0||!Z.error)return;let J=this.requests.get($.attemptId),z=J&&this.take(J);if(!z)return;let{reason:X,message:Y}=Z.error,F=Y?`${X}: ${Y}`:X;await this.safely(()=>I2({...z,error:f2(F,J?.headers.get("authorization")?.replace(/^Bearer /,""))}))}async frame($,Z){await this.safely(()=>I2({sessionID:Z.sessionID,accountId:Z.accountId,transport:"websocket",phase:"observed",bodyText:$}))}clear(){this.pending.clear(),this.requests.clear()}async settle(){await Promise.all(this.writing)}}class Y1{counts=new Map;record($,Z){let J=Z.resetCreditsApplicable;this.counts.set($.id,{credentialEpoch:$.credentialEpoch,identity:$.identity,applicable:typeof J==="number"&&Number.isFinite(J)?J:void 0})}applicable($){let Z=this.counts.get($.id);if(!Z||Z.credentialEpoch!==$.credentialEpoch||Z.identity!==$.identity)return;return Z.applicable}}function e$($){return async(Z)=>{let J=Z.credential;if(J.type!=="oauth"||!J.access)throw Error("the row holds no access token to poll with");let z=await o$({accessToken:J.access,fetchImpl:$.fetchImpl,now:$.now,...Z.identity?{accountId:Z.identity}:{},accountKey:Z.id,...$.logger?{logger:$.logger}:{}});return $.counts.record(Z,z),r$(z,$.now(),!0)}}function $Z($){let{source:Z,counts:J,now:z}=$,X=async(B)=>{let V=await Z.rowAccess(B,await $.storage());if(!V?.row)throw new s$("unknown_account",`${B==="main"?"Main":"Fallback"} account ${B} was not found.`);return t$(B,V)},Y=async(B)=>{if($.authority&&await $.authority()!=="local")return{account:B,ok:!1,error:"local accounts are not polled while this host is connected to the vault"};let[V]=await Z.pollRows(await $.storage(),{ids:[B]});if(!V)return{account:B,ok:!1,error:"targeted quota refresh returned no result"};return{account:V.id,ok:V.ok,...V.error!==void 0?{error:V.error}:{}}},F=(B)=>Z.peek().rows.find((V)=>V.id===B),H=(B)=>{let V=F(B);if(!V)return null;let L=K2(V.quota)??{},x=J.applicable(V),T=Math.max(0,...[L.primary?.checkedAt,L.secondary?.checkedAt].filter((v)=>typeof v==="number"));return{quota:{...L,...x!==void 0?{resetCreditsApplicable:x}:{}},checkedAt:T,refreshAfter:T,...V.identity!==void 0?{accountId:V.identity}:{}}};return{resolveResetTarget:X,refreshResetTargetQuota:Y,quotaManager:{isRateLimited:(B)=>{let V=F(B);if(!V)return!1;let L=Z.rateLimitMarks([V]).get(V.id);return L!==void 0&&L>z()},getMain:()=>H("main"),getFallback:(B)=>H(B)}}}import{resolve as JZ}from"node:path";var g0=1024;class Q1{pins=new Map;listeners=new Set;limit;constructor($=g0){this.limit=Math.max(1,$)}get($){return this.pins.get($)?.accountId}forget($){this.pins.delete($);for(let Z of this.listeners)Z($)}subscribe($){return this.listeners.add($),()=>{this.listeners.delete($)}}snapshot(){return new Map(this.pins)}get size(){return this.pins.size}set($,Z){this.pins.delete($),this.pins.set($,Z);for(let J of this.listeners)J($,Z);while(this.pins.size>this.limit){let J=this.pins.keys().next().value;if(J===void 0)break;this.forget(J)}}place($){return ZZ(this.pins,$,(Z,J)=>this.set(Z,J))}}var zZ=Symbol.for("@cortexkit/openai-auth/opencode2-pins"),GZ=globalThis,j1=GZ[zZ]??new Map;GZ[zZ]=j1;function XZ($){let Z=JSON.stringify([JZ($.configPath),JZ($.statePath)]),J=j1.get(Z);if(!J)J=new Q1,j1.set(Z,J);return J}import{statSync as l0}from"node:fs";import{resolve as u0}from"node:path";function NZ($){return $.map((Z)=>{try{let J=l0(Z);return`${J.ino}:${J.size}:${J.mtimeMs}:${J.ctimeMs}`}catch{return"?"}}).join("|")}function V1($){return NZ([$.vault.paths.tokenPath,$.vault.paths.statePath])}function YZ($){return NZ([$.paths.configPath,$.paths.statePath,$.vault.paths.rosterPath])+V1($)}class FZ{file;observationIntervalMs;producers=new Set;subscriptions=new Map;observations=new Map;chain=Promise.resolve();timer;constructor($,Z){this.file=$;this.observationIntervalMs=Z}add($){this.producers.add($),this.observations.set($,{stamp:YZ($),roster:$.vault.snapshot()});let Z=$.source.subscribe(()=>{this.publish($)}),J=this.subscriptions.get($.pins);if(!J){let z=new Set;J={producers:z,stop:$.pins.subscribe((X,Y)=>{let F=z.values().next().value;if(F)this.publish(F,{sessionId:X,pin:Y,accountId:Y?.accountId,route:"sticky-balanced"})})},this.subscriptions.set($.pins,J)}return J.producers.add($),this.timer??=setInterval(()=>{for(let z of this.producers){let X={stamp:YZ(z),roster:z.vault.snapshot()},Y=this.observations.get(z);if(X.stamp!==Y?.stamp||X.roster!==Y?.roster)this.observations.set(z,X),this.publish(z)}},this.observationIntervalMs),this.timer.unref?.(),()=>{if(Z(),this.producers.delete($),this.observations.delete($),J.producers.delete($),!J.producers.size)J.stop(),this.subscriptions.delete($.pins);if(!this.producers.size)clearInterval(this.timer),this.timer=void 0}}publish($,Z){return this.chain=this.chain.then(async()=>{if(!this.producers.has($))return;let z=await $.vault.authority()!=="local",X=V1($),Y=()=>this.producers.has($)&&$.vault.enrolled()===z&&V1($)===X,F=await Z2($.paths),H=z?UZ($.vault.snapshot()?.rows??[],new Set($.vault.routes().map((B)=>B.id)),F,Date.now()):HZ((await $.source.sidebarView()).rows,F,Date.now());if(await jZ(H,this.file,{canWrite:Y}),!Y()||!Z)return;let W=H.vaultAccounts??H.fallbacks;if(Z.accountId===void 0){await BZ(Z.sessionId,W,this.file,{canWrite:Y});return}if(Z.pin){let B=Date.now();await WZ({sessionId:Z.sessionId,assignment:{accountId:Z.pin.accountId,wireAccountId:Z.pin.wireIdentity,inputBytes:Z.pin.inputBytes??0,quotaCheckedAt:Z.pin.quotaCheckedAt,assignedAt:B,lastSeenAt:B},validPinnedAccountIds:[...z?[]:["main"],...W.filter((V)=>V.enabled).map((V)=>V.id)]},this.file)}await VZ({sessionId:Z.sessionId,activeId:Z.accountId,route:Z.route??H.route,updatedAt:Date.now()},W,this.file,{canWrite:Y})}).catch(()=>{J2("opencode2").warn("sidebar publication failed")}),this.chain}settled(){return this.chain}get empty(){return this.producers.size===0}}var PZ=Symbol.for("@cortexkit/openai-auth/opencode2-sidebar-publishers"),KZ=globalThis,_2=KZ[PZ]??new Map;KZ[PZ]=_2;function LZ($,Z=QZ(),J=2000){let z=u0(Z),X=_2.get(z);if(!X)X=new FZ(z,J),_2.set(z,X);let Y=X,F=Y.add($),H=!1;for(let[W,B]of $.pins.snapshot())Y.publish($,{sessionId:W,pin:B,accountId:B.accountId,route:"sticky-balanced"});return{publish:()=>Y.publish($),route:(W,B,V)=>{Y.publish($,{sessionId:W,accountId:B,route:V})},async release(){if(H)return;if(H=!0,F(),await Y.settled(),Y.empty&&_2.get(z)===Y)_2.delete(z)}}}var h2="cortexkit-openai-auth",d0=5000;async function CZ($,Z,J,z=new P2,X,Y,F){let H=new X1(J),W=new p0,B=new Map,V=new Map,L=(S)=>{V.delete(S);for(let y of B.keys())if(y.startsWith(`${S}:`))B.delete(y)},x=(S)=>{F?.(S.sessionID),Y?.send(S.sessionID,S.frame)},v=await i2({session:{hook:(S,y,a)=>$.session.hook(S,async(I)=>{let j=S==="http.request"?I:void 0,K=S==="experimental.ws.handshake"?I:void 0,M=(j?j.request.headers:K?new Headers(K.headers):void 0)?.get("authorization")===`Bearer ${t(Z.providerID)}`,A={};if(K)B.delete(`${K.sessionID}:${K.kind}`);try{await W.run(A,()=>y(I))}catch(N){if(M&&!(N instanceof n))throw RZ(N);throw N}if(j&&M&&A.attempt){let N=j.request.headers.get("thread-id");if(N)j.request.headers.set("session-id",N)}if(j&&M&&A.attempt)await H.captureHttp(j.request,A.attempt);if(j&&M&&A.attempt)await X?.({sessionID:j.sessionID,kind:j.kind,request:j.request,attempt:A.attempt});if(K&&M&&A.attempt)K.headers["session-id"]=z.get(K.sessionID).threadID;if(S==="experimental.ws.send"){let N=I,_=B.get(`${N.sessionID}:${N.kind}`);if(_)await H.frame(N.frame,_.attempt);if(_&&N.kind==="primary")x(N)}if(j||K){let N=j??K;if(!N)return;let k=(j?j.request.headers:new Headers(N.headers)).get("authorization")?.replace(/^Bearer /,"");if(M&&k)V.set(N.sessionID,k);else V.delete(N.sessionID);if(K){let E=`${K.sessionID}:${K.kind}`;if(M&&k&&A.attempt)B.set(E,{bearer:k,attempt:A.attempt,url:K.url,headers:new Headers(Object.entries(K.headers).filter(([l])=>["chatgpt-account-id","x-opencode-parent-session-id","x-parent-session-id"].includes(l.toLowerCase())))});else B.delete(E)}if(V.size>512){let E=V.keys().next().value;if(E)V.delete(E)}if(B.size>512){let E=B.keys().next().value;if(E)B.delete(E)}}else if(S==="experimental.ws.receive"){let N=I,_=B.get(`${N.sessionID}:${N.kind}`);if(_){if(z.frameReceived(N.sessionID,N.frame),N.kind==="primary"){let k;if(Y?.receive(N.sessionID,N.frame,(E)=>{k=E}),k)try{let E=k1(k,_.url,_.headers,z);if(E)await X?.({sessionID:N.sessionID,kind:"primary",request:E,attempt:_.attempt})}catch(E){J.warn("cachekeep WebSocket capture failed",{error:E instanceof Error?E.message:String(E)})}}N.frame=AZ(N.frame,_.bearer)}}else if(S==="retry"){let N=I,_=V.get(N.sessionID);if(_)Object.assign(N.error,{message:f2(N.error.message,_)})}},a)},event:{subscribe:(S)=>async function*(){for await(let y of $.event.subscribe(S)){if(y.type==="session.deleted")L(y.data.sessionID);yield y}}()}},{...Z,rewriteRequest:async(S)=>{let y=W.getStore();if(y)y.attempt=S.attempt;return Z.rewriteRequest?.(S)},rewriteHandshakeURL:(S)=>{let y=W.getStore();if(y)y.attempt=S.attempt;return Z.rewriteHandshakeURL?.(S)},onAttemptEnd:async(S,y)=>{await H.end(S,y),await Z.onAttemptEnd?.(S,y)},rewriteResponse:async(S)=>{await H.response(S.request,S.response.status);let y=await Z.rewriteResponse?.(S)??S.response;return xZ(y,S.request.headers.get("authorization")?.replace(/^Bearer /,""),"event-stream")}},{gateOnPlaceholder:{credential:(S)=>{let y=S.get("authorization");return y?.startsWith("Bearer ")?y.slice(7):void 0}},logger:{warn:(S,y)=>J.warn(S,{data:y})}}),d=v.dispose;return{...v,dispose:async()=>{V.clear(),B.clear(),await d(),await H.settle(),H.clear()}}}function U1($={}){return{id:h2,setup:(Z)=>i0(Z,$)}}async function i0($,Z={}){let G2=[];try{let J=J2("opencode2");let z=J2("quota");let X=Z.paths??(()=>qZ(SZ()));let Y=await Z2(X());let F=Y?.logging?.level;if(F&&typeof F==="string")_Z(F);let H=Z.fetch??fetch;let W=Z.now??Date.now;let B=Z.version??yZ;let V=Z.poolMigration??lZ;if(!V&&!B2(X().configPath)){J.info("openai-auth stands aside on OpenCode 2: this install has not moved into the account pool and the migration is switched off, so OpenCode 2 serves its own ChatGPT login");let C=(r)=>{throw new n({kind:"no-account",providerID:o,sessionID:r.sessionID,requestKind:r.kind,message:b2})},f=await CZ($,{providerID:o,chooseAccount:C,accountHeaders:C},J);return()=>f.dispose()}let L=Z.vault?.firstRosterWaitMs??fZ;let x=gZ({host:"opencode",stateDir:Z.vault?.stateDir??OZ(X().statePath),reservedRouteIds:()=>I.peek().rows.map((C)=>C.id),...Z.vault?.connectionFile?{connectionFile:Z.vault.connectionFile}:{},...Z.vault?.connectScoped?{connectScoped:Z.vault.connectScoped}:{},...Z.vault?.connectEnrollment?{connectEnrollment:Z.vault.connectEnrollment}:{},...Z.vault?.pollIntervalMs!==void 0?{pollIntervalMs:Z.vault.pollIntervalMs}:{},fetchImpl:()=>H},X());let T=x.vault;let v=!1;let d=!1;const S=v2(G2,{[Symbol.dispose](){if(!v)x.release()}},0);await T.authority();let y=x.firstRoster;let a=new Y1;let I=new vZ({paths:X,refreshProvider:async(C)=>{let f=await EZ({refreshToken:C.refresh,fetchImpl:H,now:W}),r=MZ({id_token:"",access_token:f.access,refresh_token:f.refresh});return{...f,...r?{identity:r}:{}}},pullQuota:e$({fetchImpl:H,now:W,counts:a,logger:z}),now:W,vaultIdentities:()=>T.identities(),vaultMode:()=>T.enrolled(),vaultAuthority:()=>T.authority(),vaultFirstRoster:y,vaultFirstRosterBackgroundWaitMs:L,log:J2("pool")});await I.load();let j=Z.heartbeat===!1?void 0:await mZ({version:B,logger:J2("heartbeat")});let K=Z.fence??(()=>wZ({currentVersion:B}));let R=Z.slot??uZ();let M=async()=>kZ(X(),await R.get({path:{id:"openai"}}));let A=!1;let N=V?hZ({paths:X,slot:R,version:B,fence:K,runDeps:{vaultServes:()=>T.serves()},paused:async()=>await T.authority()!=="local",migrate:async(C)=>{let f=await bZ(C);if(A=f.status==="refused",!d)await I.load();return f},adopt:async(C)=>{if(d)return{status:"retry",reason:"unsettled"};if(!await W1(y,L))return{status:"retry",reason:"vault-roster-pending"};if(d)return{status:"retry",reason:"unsettled"};let f=await DZ(C);if(!d)await I.load();return f}}):void 0;N?.start();x.start();let _=XZ(X());let k=LZ({paths:X(),source:I,pins:_,vault:T},Z.sidebarStateFile,Z.sidebarObservationIntervalMs);const E=v2(G2,{[Symbol.dispose](){if(!v)k.release()}},0);k.publish();let l=Z.codex??new P2(void 0,void 0,R$());let i=H$(Y);let c=w2(X());let m=P$(X(),{source:I,storage:()=>Z2(X()),vault:T,accounts:t2(X()),settings:()=>i,parentOf:async(C)=>(await $.session.get({sessionID:C}))?.parentID??void 0,fetch:H,log:J2("cachekeep")},{now:W,codexResponsesUrl:V2().codexApiEndpoint,...Z.cacheKeep});const p=v2(G2,{[Symbol.dispose](){if(!v)m.release()}},0);let b=z$({codex:l,onRoute:k.route,source:I,slotPlaceholderWithoutMain:M,storage:()=>Z2(X()),pins:_,sessionAccounts:t2(X()),vault:T,awaitVaultRoster:async()=>{await W1(T.awaitRequestRoster(),IZ)},responsesLite:()=>V2().responsesLite,codexEndpoint:()=>V2().codexApiEndpoint,now:W,log:J});let u=await CZ($,b.adapter,J,l,(C)=>m.capture(C),c,(C)=>m.forget(C));b.attach(u);let g=async(C)=>{if(await T2(T),B2(X().configPath))return;if(await N?.idle(),B2(X().configPath))return;if(A&&!G1(C)&&(await K()).open){await I.poolStore().initialize();return}throw Error("OpenAI accounts move to the shared account pool once every OpenCode process on this machine runs this version of openai-auth; the login was not stored. Update or close the older processes and sign in again.")};let z2=async(C)=>{await g(C);let f=await u$(I.poolStore(),X(),C,{vault:T});if(!B2(X().configPath))await N?.requestAdoption();await I.load(),J.info("ChatGPT login stored in the account pool",f)};let W2=await p2($,{integrationID:o,methods:l$({beginLogin:Z.beginLogin??B1,version:B,vault:T}),onLogin:(C)=>z2(C),label:"ChatGPT (openai-auth account pool)",vault:g$(T)});let M2=await n$($);if(Z.controlPlane&&(!$.command||!$.location))throw Error("OpenCode 2 control plane requires command and location APIs");let U2=$.command&&$.location?await y$({session:$.session,command:$.command,location:$.location},Z.controlPlane??d$({...$Z({source:I,storage:()=>Z2(X()),counts:a,now:W,authority:()=>T.authority()}),fetchImpl:H,now:W,randomUUID:c0,accountStoragePath:X().configPath,accountStatePath:X().statePath,packageVersion:B,loadAccounts:Z2,store:()=>I.poolStore(),migration:async()=>{if(B2(X().configPath))return{migrated:!0};let C=await K();return{migrated:!1,blockers:C.open?[]:C.blockers}},beginAccountLogin:Z.beginLogin??B1,refreshAllQuota:async()=>(await I.pollRows(await Z2(X()))).map((C)=>({...C,account:C.id})),getStickyRouting:async(C)=>_.get(C),cacheKeepManager:m.manager,setCacheKeepEnabled:(C)=>m.configure({enabled:C}),setCacheKeepSubagents:(C)=>m.configure({subagents:C}),setCacheKeepSustain:(C)=>m.configure({sustain:C}),setCacheKeepWindow:(C)=>m.configure({window:C}),afterWrite:()=>I.load(),refreshSidebar:()=>k.publish(),clearStickyRouting:async(C)=>{let f=_.get(C)!==void 0;return _.forget(C),f},vault:T})):void 0;let Q2=new AbortController;(async()=>{try{for await(let C of $.event.subscribe({signal:Q2.signal}))if(C.type==="session.deleted")b.forgetSession(C.data.sessionID),m.forget(C.data.sessionID),c.forget(C.data.sessionID)}catch(C){if(!Q2.signal.aborted)J.warn("stopped listening for session deletion",{error:C instanceof Error?C.message:String(C)})}})();v=!0;return async()=>{d=!0,Q2.abort();let C=m.release();await U2?.(),N?.dispose(),I.dispose(),await k.release(),await Promise.allSettled([u.dispose(),W2.dispose(),M2.dispose()]);let f;try{await Promise.race([Promise.all([N?.idle(),I.settled(),l.store?.settled(),C]),new Promise((r)=>{f=setTimeout(r,d0),f.unref?.()})])}finally{clearTimeout(f),x.release(),await j?.release()}}}catch(m2){var g2=m2,l2=1}finally{TZ(G2,g2,l2)}}var a0=U1(),F6={id:h2,setup:a0.setup,server:pZ.server};export{F6 as default,U1 as createOpenAIAuthPlugin,h2 as OPENAI_AUTH_PLUGIN_ID};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/opencode-openai-auth",
-  "version": "1.0.5",
+  "version": "1.2.0",
   "license": "MIT",
   "type": "module",
   "repository": {
@@ -66,12 +66,12 @@
   },
   "devDependencies": {
     "@ai-sdk/openai": "3.0.88",
-    "@cortexkit/common-auth": "^0.17.1",
+    "@cortexkit/common-auth": "^0.19.0",
     "@cortexkit/openai-auth-core": "workspace:*",
     "@opencode/plugin": "2.0.27"
   },
   "dependencies": {
-    "@cortexkit/claustrum-client": "^0.9.0",
+    "@cortexkit/claustrum-client": "^0.10.0",
     "@cortexkit/private-files": "^0.2.1",
     "@cortexkit/subc-client": "^0.16.0",
     "@opentui/core": ">=0.6.1",