@cortexkit/opencode-openai-auth 1.1.0 → 1.3.0

package/dist/bin.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
-import{c as R1}from"./index-j8v2xwq6.js";import{Aa as S,Ba as X,Ca as P,eb as C1,pa as B1,qa as E,ra as i,wb as M1,za as O1}from"./index-0yh85bwb.js";import{$c as N1,Rc as V1,Yc as v,Zc as A,ad as b1}from"./index-7eb3dw37.js";import"./index-msx2m78k.js";import{Ae as D1,Be as H1,Ee as Y1,ue as Q1}from"./index-7c6sxtd6.js";import"./index-m5qmvr6c.js";import"./index-csky2xpg.js";import{spawn as _1}from"node:child_process";var Y=4096,A1=1048576;class s{buffer=Buffer.alloc(Y);start=0;length=0;truncated=!1;get didTruncate(){return this.truncated}push(G){if(G.length>=Y){if(G.length>Y||this.length>0)this.truncated=!0;G.copy(this.buffer,0,G.length-Y),this.start=0,this.length=Y;return}let b=Math.max(0,this.length+G.length-Y);if(b>0)this.truncated=!0;this.start=(this.start+b)%Y,this.length-=b;let z=(this.start+this.length)%Y,J=Math.min(G.length,Y-z);if(G.copy(this.buffer,z,0,J),J<G.length)G.copy(this.buffer,0,J);this.length+=G.length}toString(){let G=Buffer.alloc(this.length),b=Math.min(this.length,Y-this.start);if(this.buffer.copy(G,0,this.start,this.start+b),b<this.length)this.buffer.copy(G,b,0,this.length-b);let z=0;while(z<G.length){let J=G[z];if(J===void 0||(J&192)!==128)break;z++}return G.subarray(z).toString("utf8")}}var w={run(G,b,z={}){return new Promise((J)=>{let Q=performance.now(),Z=z.timeoutMs??15000,K=new s,O=[],U=0,$=!1,W=!1,x=!1,q;try{q=_1(G,[...b],{env:z.env??process.env,windowsHide:!0,windowsVerbatimArguments:z.windowsVerbatimArguments,stdio:["ignore","pipe","pipe"]})}catch{J({exitCode:1,stdout:"",stderr:"",spawnError:!0,signal:null,timedOut:!1,durationMs:performance.now()-Q});return}let F=Z>0?setTimeout(()=>{x=!0,q.kill("SIGTERM")},Z):void 0;q.stdout?.on("data",(j)=>{let M=A1-U,D=Math.min(M,j.length);if(D>0)O.push(j.subarray(0,D)),U+=D;if(j.length>M)$=!0,q.kill("SIGTERM")}),q.stderr?.on("data",(j)=>K.push(j));let H=!1,V=(j,M)=>{if(H)return;if(H=!0,F)clearTimeout(F);J({exitCode:W?1:$?1:j??1,stdout:Buffer.concat(O,U).toString("utf8"),stderr:K.toString(),stderrTruncated:K.didTruncate,...W?{spawnError:!0}:{},signal:M??null,timedOut:x,durationMs:performance.now()-Q})};q.once("error",()=>{if(W=!0,q.pid===void 0)V(null,null)}),q.once("close",(j,M)=>V(j,M))})}};function y(G,b,z,J,Q,Z=15000){if(b==="win32"&&/\.(cmd|bat)$/i.test(z)){if(/["%!\r\n]/.test(z)||J.some((K)=>!/^[a-zA-Z0-9@:/._+-]+$/.test(K)))throw Error("Unsafe batch launcher or argument; use an executable instead.");return G.run("cmd.exe",["/d","/s","/c",`""${z}" ${J.join(" ")}"`],{env:Q,timeoutMs:Z,windowsVerbatimArguments:!0})}return G.run(z,J,{env:Q,timeoutMs:Z})}import{accessSync as S1,constants as E1,existsSync as y1,readFileSync as v1,realpathSync as f1,statSync as g1}from"node:fs";import{mkdtemp as d1,rm as m1}from"node:fs/promises";import{tmpdir as c1}from"node:os";import{join as h1}from"node:path";import{parse as u1}from"jsonc-parser";import{homedir as I1}from"node:os";import{posix as T1,win32 as L1}from"node:path";import{fileURLToPath as P1}from"node:url";function C(G={}){let b=G.env??process.env,z=G.platform??process.platform,J=z==="win32"?L1:T1,Q=G.home??(z==="win32"?b.USERPROFILE:b.HOME)??I1(),Z=G.cwd??process.cwd(),K=(W)=>J.resolve(Z,W),O=b.OPENCODE_CONFIG_DIR?.trim(),U=b.XDG_CONFIG_HOME?.trim(),$=b.PI_CODING_AGENT_DIR?.trim()||J.join(Q,".pi","agent");if($==="~")$=Q;else if(/^~[/\\]/.test($))$=J.join(Q,$.slice(2));if($.startsWith("file://"))$=P1($);return{env:b,platform:z,path:J,home:Q,cwd:Z,opencode:O?K(O):U?J.join(K(U),"opencode"):J.join(Q,".config","opencode"),pi:K($)}}function d(G,b){try{return g1(G)[b]()}catch{return!1}}var k={exists:y1,isFile:(G)=>d(G,"isFile"),isDirectory:(G)=>d(G,"isDirectory"),isExecutable(G){try{return S1(G,E1.X_OK),d(G,"isFile")}catch{return!1}},readText:(G)=>v1(G,"utf8"),realpath:f1};function R(G,b={}){let{env:z,platform:J,path:Q,cwd:Z}=C(b),K=b.fs??k,O=Object.entries(z).find(([$])=>J==="win32"?$.toUpperCase()==="PATH":$==="PATH")?.[1]??"",U=J==="win32"?[".exe",".cmd",".bat",""]:[""];for(let $ of O.split(J==="win32"?";":":")){let W=$.trim().replace(/^"|"$/g,"");if(!W)continue;for(let x of U){let q=Q.resolve(Z,W,G+x);if(J==="win32"?K.isFile(q):K.isExecutable(q))return q}}return null}function o(G={}){let{platform:b,home:z,env:J,path:Q}=C(G);if(b==="darwin")return["/Applications/OpenCode.app","/Applications/OpenCode Beta.app",Q.join(z,"Applications","OpenCode.app"),Q.join(z,"Applications","OpenCode Beta.app")];if(b==="win32"){let Z=J.LOCALAPPDATA||Q.join(z,"AppData","Local");return[Q.join(Z,"Programs","opencode"),Q.join(Z,"opencode")]}return["/opt/OpenCode","/usr/lib/opencode",Q.join(z,".local","share","applications","opencode.desktop")]}function m(G,b){let z=b.fs??k,{path:J}=C(b);try{let Q=z.readText(G);if(Q.length>65536)return G;let Z=[...Q.matchAll(/"%~?dp0%?\\([^"%\r\n]+)"/g)];if(!Z.length)Z.push(...Q.matchAll(/"\$basedir\/([^"$\r\n]+)"/g));let K=Z.at(-1)?.[1];if(K){let O=J.join(J.dirname(G),...K.split(/[/\\]+/));if(z.isFile(O))return z.realpath(O)}return z.realpath(G)}catch{return G}}function p1(G,b){let z=b.fs??k,{path:J}=C(b),Q=J.dirname(m(G,b));for(;;){try{let K=JSON.parse(z.readText(J.join(Q,"package.json")));if(["@opencode/cli","@opencode-ai/cli"].includes(K.name))return"2";if(K.name==="opencode-ai")return/^(?:[2-9]\d*|1\d+)\.|^0\.0\.0-(?:beta|dev)-/.test(K.version??"")?"2":"1"}catch{}let Z=J.dirname(Q);if(Z===Q)return null;Q=Z}}function n(G={}){let b=R("opencode",G),z=R("opencode2",G),J=b&&z&&m(b,G)===m(z,G),Q=G.fs??k,{path:Z,opencode:K}=C(G),O="1";for(let $ of["jsonc","json"]){let W=Z.join(K,`opencode.${$}`);if(!Q.exists(W))continue;try{if(Object.hasOwn(u1(Q.readText(W))??{},"plugins"))O="2"}catch{}break}let U=b?p1(b,G)??(J?"2":O):null;if(z&&U==="1"&&!J)return"ambiguous";return z||J?"2":U??O}async function c(G,b={}){let z=b.fs??k,{env:J,platform:Q,opencode:Z,pi:K}=C(b),O=b.runner??w,U=R("opencode",b)??R("opencode2",b),$=R("pi",b),W=R("ck",b),x=async(V)=>{if(!V)return null;let j;try{j=await d1(h1(c1(),"common-auth-setup-version-"));let M={...J,HOME:j,USERPROFILE:j,XDG_CONFIG_HOME:j,XDG_DATA_HOME:j,XDG_STATE_HOME:j,XDG_CACHE_HOME:j,OPENCODE_CONFIG_DIR:j,OPENCODE_CONFIG:void 0,OPENCODE_CONFIG_CONTENT:void 0,OPENCODE_AUTH_CONTENT:void 0,PI_CODING_AGENT_DIR:j},D=await y(O,Q,V,["--version"],M,2000);return D.exitCode===0?/\b\d+\.\d+\.\d+(?:-[\w.-]+)?/.exec(D.stdout)?.[0]??null:null}catch{return null}finally{if(j)await m1(j,{recursive:!0,force:!0}).catch(()=>{})}},q=!1;if(W&&z.exists(G.vault.connectionFile))try{(await(b.connect??v)({connectionFile:G.vault.connectionFile,handshakeTimeoutMs:2000})).close(),q=!0}catch{q=!1}let[F,H]=await Promise.all([x(U),x($)]);return{opencode:{installed:z.isDirectory(Z)||o(b).some((V)=>z.exists(V))||U!==null,executable:U,version:F,directory:Z,generation:n(b)},pi:{installed:$!==null||z.isDirectory(K),executable:$,version:H,directory:K},claustrum:{available:q,executable:W}}}import{setTimeout as t1}from"node:timers/promises";import{writeEnrollmentTokenFile as e1}from"@cortexkit/claustrum-client";var l1=45000,t=new Set(["opencode","litecode","opencode2","pi"]),a1=new Set(["node","bun"]),r1=/(?:^|[/\\])pi-coding-agent[/\\]dist[/\\](?:(?:bundle|bun)[/\\])?cli\.m?js$/i;function i1(G){return[...G.matchAll(/"([^"]*)"|(\S+)/g)].map((b)=>b[1]??b[2]??"")}function e(G){return(G.split(/[/\\]/).pop()??"").toLowerCase().replace(/\.(?:exe|cmd|bat|m?js)$/,"")}var s1=new Set(["-r","--require","--import","--loader","--experimental-loader","-C","--conditions","--env-file","--title","--input-type","--preload","--cwd","-c","--config","--tsconfig-override","-d","--define","-l","--main-fields"]),o1=new Set(["-e","--eval","-p","--print"]);function n1(G,b){for(let z=0;z<b.length;z++){let J=b[z]??"";if(J==="--")return b[z+1];if(o1.has(J))return;if(J.startsWith("-")){if(!J.includes("=")&&s1.has(J))z++;continue}if(G==="bun"&&J==="run")continue;return J}return}function G1(G){let[b,...z]=i1(G);if(b===void 0)return null;let J=e(b);if(t.has(J))return J;if(!a1.has(J))return null;let Q=n1(J,z);if(Q===void 0)return null;let Z=e(Q);if(t.has(Z))return Z;return r1.test(Q)?"pi":null}class N extends Error{code="process-inspection-failed";step;exitCode;signal;timedOut;durationMs;constructor(G){super("Process inspection failed; setup cannot prove hosts are stopped.");this.name="ProcessInspectionError",this.step=G.step,this.exitCode=G.exitCode,this.signal=G.signal,this.timedOut=G.timedOut,this.durationMs=G.durationMs}get refusalText(){let G=this.timedOut?"timed out":this.signal?`signal ${this.signal}`:this.exitCode===null?"could not start or complete":this.exitCode===0?"invalid output (exit code 0)":`exit code ${this.exitCode}`;return`${this.message} ${this.step}: ${G} after ${Math.round(this.durationMs)} ms.`}}class _ extends Error{activeHosts;constructor(G){let b=G.map((z)=>({pid:z.pid,command:G1(z.command)??"host"}));super(`OpenCode or Pi processes are currently running:
+import{c as _0}from"./index-m3ctrabv.js";import{Cb as I0,Fa as j0,Ga as E,Ha as O,Ia as v,kb as A0,ta as k0,ua as f,va as o}from"./index-psjyexj3.js";import{$c as R0,gd as m,hd as P,jd as c,kd as q0}from"./index-tn8x5tz8.js";import"./index-gn2b097f.js";import{Ee as e,Ke as Y0,Le as C0,Oe as w0}from"./index-1mbgsxsr.js";import"./index-8x1aj7q3.js";import"./index-xwvze96g.js";import{spawn as L0}from"node:child_process";var M=4096,S0=1048576;class t{buffer=Buffer.alloc(M);start=0;length=0;truncated=!1;get didTruncate(){return this.truncated}push(G){if(G.length>=M){if(G.length>M||this.length>0)this.truncated=!0;G.copy(this.buffer,0,G.length-M),this.start=0,this.length=M;return}let b=Math.max(0,this.length+G.length-M);if(b>0)this.truncated=!0;this.start=(this.start+b)%M,this.length-=b;let z=(this.start+this.length)%M,J=Math.min(G.length,M-z);if(G.copy(this.buffer,z,0,J),J<G.length)G.copy(this.buffer,0,J);this.length+=G.length}toString(){let G=Buffer.alloc(this.length),b=Math.min(this.length,M-this.start);if(this.buffer.copy(G,0,this.start,this.start+b),b<this.length)this.buffer.copy(G,b,0,this.length-b);let z=0;while(z<G.length){let J=G[z];if(J===void 0||(J&192)!==128)break;z++}return G.subarray(z).toString("utf8")}}var A={run(G,b,z={}){return new Promise((J)=>{let K=performance.now(),Q=z.timeoutMs??15000,$=new t,W=[],q=0,Z=!1,x=!1,D=!1,U;try{U=L0(G,[...b],{env:z.env??process.env,windowsHide:!0,windowsVerbatimArguments:z.windowsVerbatimArguments,stdio:["ignore","pipe","pipe"]})}catch{J({exitCode:1,stdout:"",stderr:"",spawnError:!0,signal:null,timedOut:!1,durationMs:performance.now()-K});return}let j=Q>0?setTimeout(()=>{D=!0,U.kill("SIGTERM")},Q):void 0;U.stdout?.on("data",(X)=>{let R=S0-q,F=Math.min(R,X.length);if(F>0)W.push(X.subarray(0,F)),q+=F;if(X.length>R)Z=!0,U.kill("SIGTERM")}),U.stderr?.on("data",(X)=>$.push(X));let V=!1,B=(X,R)=>{if(V)return;if(V=!0,j)clearTimeout(j);J({exitCode:x?1:Z?1:X??1,stdout:Buffer.concat(W,q).toString("utf8"),stderr:$.toString(),stderrTruncated:$.didTruncate,...x?{spawnError:!0}:{},signal:R??null,timedOut:D,durationMs:performance.now()-K})};U.once("error",()=>{if(x=!0,U.pid===void 0)B(null,null)}),U.once("close",(X,R)=>B(X,R))})}};function g(G,b,z,J,K,Q=15000){if(b==="win32"&&/\.(cmd|bat)$/i.test(z)){if(/["%!\r\n]/.test(z)||J.some(($)=>!/^[a-zA-Z0-9@:/._+-]+$/.test($)))throw Error("Unsafe batch launcher or argument; use an executable instead.");return G.run("cmd.exe",["/d","/s","/c",`""${z}" ${J.join(" ")}"`],{env:K,timeoutMs:Q,windowsVerbatimArguments:!0})}return G.run(z,J,{env:K,timeoutMs:Q})}var y0="Pi install failed; run pi install after checking your npm connection.";function v0(G){let b=Buffer.from(G,"utf8");if(b.length<=M)return G;let z=b.length-M;while(z<b.length){let J=b[z];if(J===void 0||(J&192)!==128)break;z++}return b.subarray(z).toString("utf8")}function E0(G){let b=G.indexOf(`
+`);return b<0?"":G.slice(b+1)}class d extends Error{step="pi-install";exitCode;signal;stderrTail;constructor(G){super(y0);this.name="SetupCommandError",this.exitCode=G.exitCode,this.signal=G.signal;let b=G.stderrTruncated?E0(G.stderrTail):G.stderrTail,z=e(b);this.stderrTail=v0(typeof z==="string"?z:"")}}var f0={opencode:"OpenCode",pi:"Pi"},g0={enrolled:"connected to the vault","not-enrolled":"not connected",unknown:"unknown, check with ck auth status"};function G0({host:G,outcome:b}){return`${f0[G]}: ${g0[b]}`}var d0=new WeakMap;function b0(G,b){if(typeof G!=="object"&&typeof G!=="function"||!G)return;d0.set(G,Object.freeze(b.map((z)=>Object.freeze({...z}))))}import{accessSync as p0,constants as l0,existsSync as a0,readFileSync as i0,realpathSync as s0,statSync as r0}from"node:fs";import{mkdtemp as n0,rm as o0}from"node:fs/promises";import{tmpdir as t0}from"node:os";import{join as e0}from"node:path";import{parse as G1}from"jsonc-parser";import{homedir as m0}from"node:os";import{posix as c0,win32 as h0}from"node:path";import{fileURLToPath as u0}from"node:url";function N(G={}){let b=G.env??process.env,z=G.platform??process.platform,J=z==="win32"?h0:c0,K=G.home??(z==="win32"?b.USERPROFILE:b.HOME)??m0(),Q=G.cwd??process.cwd(),$=(x)=>J.resolve(Q,x),W=b.OPENCODE_CONFIG_DIR?.trim(),q=b.XDG_CONFIG_HOME?.trim(),Z=b.PI_CODING_AGENT_DIR?.trim()||J.join(K,".pi","agent");if(Z==="~")Z=K;else if(/^~[/\\]/.test(Z))Z=J.join(K,Z.slice(2));if(Z.startsWith("file://"))Z=u0(Z);return{env:b,platform:z,path:J,home:K,cwd:Q,opencode:W?$(W):q?J.join($(q),"opencode"):J.join(K,".config","opencode"),pi:$(Z)}}function h(G,b){try{return r0(G)[b]()}catch{return!1}}var _={exists:a0,isFile:(G)=>h(G,"isFile"),isDirectory:(G)=>h(G,"isDirectory"),isExecutable(G){try{return p0(G,l0.X_OK),h(G,"isFile")}catch{return!1}},readText:(G)=>i0(G,"utf8"),realpath:s0};function k(G,b={}){let{env:z,platform:J,path:K,cwd:Q}=N(b),$=b.fs??_,W=Object.entries(z).find(([Z])=>J==="win32"?Z.toUpperCase()==="PATH":Z==="PATH")?.[1]??"",q=J==="win32"?[".exe",".cmd",".bat",""]:[""];for(let Z of W.split(J==="win32"?";":":")){let x=Z.trim().replace(/^"|"$/g,"");if(!x)continue;for(let D of q){let U=K.resolve(Q,x,G+D);if(J==="win32"?$.isFile(U):$.isExecutable(U))return U}}return null}function z0(G={}){let{platform:b,home:z,env:J,path:K}=N(G);if(b==="darwin")return["/Applications/OpenCode.app","/Applications/OpenCode Beta.app",K.join(z,"Applications","OpenCode.app"),K.join(z,"Applications","OpenCode Beta.app")];if(b==="win32"){let Q=J.LOCALAPPDATA||K.join(z,"AppData","Local");return[K.join(Q,"Programs","opencode"),K.join(Q,"opencode")]}return["/opt/OpenCode","/usr/lib/opencode",K.join(z,".local","share","applications","opencode.desktop")]}function u(G,b){let z=b.fs??_,{path:J}=N(b);try{let K=z.readText(G);if(K.length>65536)return G;let Q=[...K.matchAll(/"%~?dp0%?\\([^"%\r\n]+)"/g)];if(!Q.length)Q.push(...K.matchAll(/"\$basedir\/([^"$\r\n]+)"/g));let $=Q.at(-1)?.[1];if($){let W=J.join(J.dirname(G),...$.split(/[/\\]+/));if(z.isFile(W))return z.realpath(W)}return z.realpath(G)}catch{return G}}function b1(G,b){let z=b.fs??_,{path:J}=N(b),K=J.dirname(u(G,b));for(;;){try{let $=JSON.parse(z.readText(J.join(K,"package.json")));if(["@opencode/cli","@opencode-ai/cli"].includes($.name))return"2";if($.name==="opencode-ai")return/^(?:[2-9]\d*|1\d+)\.|^0\.0\.0-(?:beta|dev)-/.test($.version??"")?"2":"1"}catch{}let Q=J.dirname(K);if(Q===K)return null;K=Q}}function J0(G={}){let b=k("opencode",G),z=k("opencode2",G),J=b&&z&&u(b,G)===u(z,G),K=G.fs??_,{path:Q,opencode:$}=N(G),W="1";for(let Z of["jsonc","json"]){let x=Q.join($,`opencode.${Z}`);if(!K.exists(x))continue;try{if(Object.hasOwn(G1(K.readText(x))??{},"plugins"))W="2"}catch{}break}let q=b?b1(b,G)??(J?"2":W):null;if(z&&q==="1"&&!J)return"ambiguous";return z||J?"2":q??W}async function p(G,b={}){let z=b.fs??_,{env:J,platform:K,opencode:Q,pi:$}=N(b),W=b.runner??A,q=k("opencode",b)??k("opencode2",b),Z=k("pi",b),x=k("ck",b),D=async(B)=>{if(!B)return null;let X;try{X=await n0(e0(t0(),"common-auth-setup-version-"));let R={...J,HOME:X,USERPROFILE:X,XDG_CONFIG_HOME:X,XDG_DATA_HOME:X,XDG_STATE_HOME:X,XDG_CACHE_HOME:X,OPENCODE_CONFIG_DIR:X,OPENCODE_CONFIG:void 0,OPENCODE_CONFIG_CONTENT:void 0,OPENCODE_AUTH_CONTENT:void 0,PI_CODING_AGENT_DIR:X},F=await g(W,K,B,["--version"],R,2000);return F.exitCode===0?/\b\d+\.\d+\.\d+(?:-[\w.-]+)?/.exec(F.stdout)?.[0]??null:null}catch{return null}finally{if(X)await o0(X,{recursive:!0,force:!0}).catch(()=>{})}},U=!1;if(x&&z.exists(G.vault.connectionFile))try{(await(b.connect??m)({connectionFile:G.vault.connectionFile,handshakeTimeoutMs:2000})).close(),U=!0}catch{U=!1}let[j,V]=await Promise.all([D(q),D(Z)]);return{opencode:{installed:z.isDirectory(Q)||z0(b).some((B)=>z.exists(B))||q!==null,executable:q,version:j,directory:Q,generation:J0(b)},pi:{installed:Z!==null||z.isDirectory($),executable:Z,version:V,directory:$},claustrum:{available:U,executable:x}}}import{setTimeout as U1}from"node:timers/promises";import{writeEnrollmentTokenFile as W1}from"@cortexkit/claustrum-client";var z1=45000,K0=new Set(["opencode","litecode","opencode2","pi"]),J1=new Set(["node","bun"]),K1=/(?:^|[/\\])pi-coding-agent[/\\]dist[/\\](?:(?:bundle|bun)[/\\])?cli\.m?js$/i;function Q1(G){return[...G.matchAll(/"([^"]*)"|(\S+)/g)].map((b)=>b[1]??b[2]??"")}function Q0(G){return(G.split(/[/\\]/).pop()??"").toLowerCase().replace(/\.(?:exe|cmd|bat|m?js)$/,"")}var Z1=new Set(["-r","--require","--import","--loader","--experimental-loader","-C","--conditions","--env-file","--title","--input-type","--preload","--cwd","-c","--config","--tsconfig-override","-d","--define","-l","--main-fields"]),$1=new Set(["-e","--eval","-p","--print"]);function q1(G,b){for(let z=0;z<b.length;z++){let J=b[z]??"";if(J==="--")return b[z+1];if($1.has(J))return;if(J.startsWith("-")){if(!J.includes("=")&&Z1.has(J))z++;continue}if(G==="bun"&&J==="run")continue;return J}return}function Z0(G){let[b,...z]=Q1(G);if(b===void 0)return null;let J=Q0(b);if(K0.has(J))return J;if(!J1.has(J))return null;let K=q1(J,z);if(K===void 0)return null;let Q=Q0(K);if(K0.has(Q))return Q;return K1.test(K)?"pi":null}class Y extends Error{code="process-inspection-failed";step;exitCode;signal;timedOut;durationMs;constructor(G){super("Process inspection failed; setup cannot prove hosts are stopped.");this.name="ProcessInspectionError",this.step=G.step,this.exitCode=G.exitCode,this.signal=G.signal,this.timedOut=G.timedOut,this.durationMs=G.durationMs}get refusalText(){let G=this.timedOut?"timed out":this.signal?`signal ${this.signal}`:this.exitCode===null?"could not start or complete":this.exitCode===0?"invalid output (exit code 0)":`exit code ${this.exitCode}`;return`${this.message} ${this.step}: ${G} after ${Math.round(this.durationMs)} ms.`}}class T extends Error{activeHosts;constructor(G){let b=G.map((z)=>({pid:z.pid,command:Z0(z.command)??"host"}));super(`OpenCode or Pi processes are currently running:
 ${b.map((z)=>`  - PID ${z.pid}: ${z.command}`).join(`
 `)}
 
-Please quit all OpenCode, LiteCode, and Pi processes before running setup.`);this.activeHosts=b,this.name="ProcessFenceViolationError"}}async function h(G=w,b={}){let z=(b.platform??process.platform)==="win32",J={step:z?"tasklist":"ps",exitCode:null,signal:null,timedOut:!1,durationMs:0},Q=async(Z,K,O,U)=>{let $=performance.now();J={step:Z,exitCode:null,signal:null,timedOut:!1,durationMs:0};try{let W=await G.run(K,O,{env:b.env,timeoutMs:U});return J={step:Z,exitCode:W.exitCode,signal:W.signal??null,timedOut:W.timedOut??!1,durationMs:W.durationMs??performance.now()-$},W}finally{if(J.exitCode===null)J.durationMs=performance.now()-$;b.onStep?.({...J})}};try{let Z=await Q(z?"tasklist":"ps",z?"tasklist.exe":"ps",z?["/fo","csv","/nh"]:["-eo","pid,command"]);if(Z.exitCode!==0)throw new N(J);let K=[];for(let U of Z.stdout.split(/\r?\n/)){let $=U.trim();if(!$)continue;let W,x;if(z){let q=/^"([^"]+)","(\d+)"(?:,|$)/.exec($);if(!q)throw new N(J);x=q[1]??"",W=Number(q[2])}else{let q=/^(\d+)\s+(.+)$/.exec($);if(!q){if(/^PID\s+COMMAND$/i.test($))continue;throw new N(J)}W=Number(q[1]),x=q[2]??""}if(!Number.isSafeInteger(W)||W<0)throw new N(J);K.push({pid:W,command:x})}if(!K.length)throw new N(J);let O=K.filter((U)=>U.pid!==process.pid&&/^(?:node|bun)\.exe$/i.test(U.command));if(z&&O.length&&b.inspectRuntimes!==!1){let U=await Q("CIM","powershell.exe",["-NoProfile","-NonInteractive","-Command",`$ErrorActionPreference = 'Stop'; Get-CimInstance Win32_Process -Filter "Name = 'node.exe' OR Name = 'bun.exe'" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress`],l1);if(U.exitCode!==0)throw new N(J);let $=JSON.parse(U.stdout||"null"),W=$===null?[]:Array.isArray($)?$:[$],x=new Map;for(let q of W){if(!q||typeof q!=="object"||!("ProcessId"in q)||!("CommandLine"in q)||!Number.isSafeInteger(q.ProcessId))throw new N(J);if(typeof q.CommandLine==="string")x.set(Number(q.ProcessId),q.CommandLine);else if(O.some((F)=>F.pid===q.ProcessId))throw new N(J)}for(let q of O)q.command=x.get(q.pid)??""}return K}catch(Z){if(Z instanceof N)throw Z;throw new N(J)}}function T(G=w,b={}){let z=(J)=>J.pid!==process.pid&&G1(J.command)!==null;return{async listRunningHosts(J){return(await h(G,{...b,env:J})).filter(z)},async previewRunningHosts(J){let Q=await h(G,{...b,env:J,inspectRuntimes:!1}),Z=(b.platform??process.platform)==="win32";return{hosts:Q.filter(z),uncheckedRuntimes:Z?Q.filter((K)=>K.pid!==process.pid&&/^(?:node|bun)\.exe$/i.test(K.command)).length:0}}}}async function L(G,b){let z=await G.listRunningHosts(b);if(z.length)throw new _(z)}async function z1(G,b,z,J,Q){let{name:Z,paths:K}=G.vault.hosts[b],O=A(K);await Q();let U=await(z.connect??v)({connectionFile:G.vault.connectionFile,handshakeTimeoutMs:2000}).catch(()=>{throw Error("Claustrum connection failed; start ck and rerun setup.")});try{let $=new b1({proposedName:Z,paths:O,client:{enrollPropose:async(x)=>{return await Q(),U.enrollPropose(x)},enrollPoll:async(x)=>{return await Q(),U.enrollPoll(x)}},writeTokenFile:async(x,q)=>{await Q(),await e1(x,q)}}),W;for(let x=0;x<300;x++){await Q();let q=await $.reconcile();if(q.state==="approved"){X(J,`Connected ${b} to Claustrum.`);return}if(q.state!=="pending"&&q.state!=="busy")throw Error("Claustrum enrollment refused; inspect its status with ck before rerunning setup.");if(q.state==="pending"&&q.requestId&&q.requestId!==W){if(!/^[a-zA-Z0-9_-]+$/.test(q.requestId))throw Error("Invalid enrollment request id.");W=q.requestId,X(J,"Waiting for approval. In another terminal, run:"),X(J,`  ck auth enroll approve --request-id ${q.requestId} --name ${Z}`),X(J,`Enrollment files: ${O.statePath}, ${O.tokenPath}`)}await(z.wait??t1)(1000)}throw Error("Claustrum approval is still pending; approve with ck and rerun setup.")}catch($){if($ instanceof _||$ instanceof N)throw $;throw Error("Claustrum enrollment did not complete. Inspect and approve with ck, then rerun setup.")}finally{U.close()}}async function J1(G,b){let z=new Set(b);for(;;){let J=await P(G,[...["opencode","pi"].map((Q)=>({value:Q,label:`[${z.has(Q)?"x":" "}] ${Q==="opencode"?"OpenCode":"Pi"}`,hint:b.includes(Q)?"found":"not found"})),{value:"done",label:"Continue with selected hosts"}],{message:"Select hosts to set up",subtitle:"Enter toggles a host; choose Continue when ready."});if(J===null)return null;if(J==="done")return[...z];if(z.has(J))z.delete(J);else z.add(J)}}import{applyEdits as u,createScanner as D0,findNodeAtLocation as H0,modify as $1,parse as j0,parseTree as F0}from"jsonc-parser";var G0="Pi install failed; run pi install after checking your npm connection.";function b0(G){let b=Buffer.from(G,"utf8");if(b.length<=Y)return G;let z=b.length-Y;while(z<b.length){let J=b[z];if(J===void 0||(J&192)!==128)break;z++}return b.subarray(z).toString("utf8")}function z0(G){let b=G.indexOf(`
-`);return b<0?"":G.slice(b+1)}class f extends Error{step="pi-install";exitCode;signal;stderrTail;constructor(G){super(G0);this.name="SetupCommandError",this.exitCode=G.exitCode,this.signal=G.signal;let b=G.stderrTruncated?z0(G.stderrTail):G.stderrTail,z=Q1(b);this.stderrTail=b0(typeof z==="string"?z:"")}}import{randomUUID as J0}from"node:crypto";import{mkdir as Q0,open as Z0,rename as $0,stat as K0,unlink as q0}from"node:fs/promises";import{basename as U0,dirname as O0,join as W0}from"node:path";import{setTimeout as x0}from"node:timers/promises";async function Z1(G,b,z={}){let J=(z.platform??process.platform)==="win32",Q=O0(G);await Q0(Q,{recursive:!0});let Z;if(!J)try{Z=(await K0(G)).mode&4095}catch(U){if(U.code!=="ENOENT")throw U}let K=W0(Q,`.${U0(G)}.${(z.stageName??J0)()}.tmp`),O=!1;try{let U=await Z0(K,"wx",Z??438);O=!0;try{if(await U.writeFile(b,"utf8"),Z!==void 0)await U.chmod(Z)}finally{await U.close()}let $=z.now??(()=>performance.now()),W=$();for(let x=0;;x++){await z.beforeRename?.();try{await(z.rename??$0)(K,G),O=!1;return}catch(q){let F=q.code,H=2000-($()-W);if(!J||!["EPERM","EBUSY","EACCES"].includes(F??"")||H<=0||x>=40)throw Error(`Unable to replace host config ${G}. Close editors or other programs using the file, then rerun setup.`);await(z.wait??x0)(Math.min(H,25*2**Math.min(x,2)))}}}finally{if(O)await q0(K).catch(()=>{})}}function K1(G){let b=typeof G==="string"?G:Array.isArray(G)?G[0]:G&&typeof G==="object"&&("package"in G)?G.package:null;if(typeof b!=="string")return null;let z=b.indexOf("@",b.startsWith("@")?1:0);return z<0?b:b.slice(0,z)}function q1(G,b,z){let J=F0(G),Q=J&&H0(J,[b]),Z=Q?.children??[],K=Z[z];if(!K||!Q)throw Error("Invalid plugin array edit.");let O=[{offset:K.offset,length:K.length,content:""}],U=($,W)=>{let x=D0(G.slice($,W),!0);if(x.scan(),G[$+x.getTokenOffset()]===",")O.push({offset:$+x.getTokenOffset(),length:1,content:""})};if(z===Z.length-1){let $=Z[z-1];if($)U($.offset+$.length,K.offset);U(K.offset+K.length,Q.offset+Q.length-1)}else U(K.offset+K.length,Z[z+1]?.offset??K.offset+K.length);return u(G,O)}function U1(G,b,z,J){let Q=[],Z=j0(G,Q,{allowTrailingComma:!0});if(Q.length||!Z||typeof Z!=="object"||Array.isArray(Z))throw Error("Invalid OpenCode config; refusing to overwrite it.");let K={formattingOptions:{insertSpaces:!/^\t+/m.test(G),tabSize:/^([ ]+)"/m.exec(G)?.[1]?.length??2,eol:G.includes(`\r
+Please quit all OpenCode, LiteCode, and Pi processes before running setup.`);this.activeHosts=b,this.name="ProcessFenceViolationError"}}async function l(G=A,b={}){let z=(b.platform??process.platform)==="win32",J={step:z?"tasklist":"ps",exitCode:null,signal:null,timedOut:!1,durationMs:0},K=async(Q,$,W,q)=>{let Z=performance.now();J={step:Q,exitCode:null,signal:null,timedOut:!1,durationMs:0};try{let x=await G.run($,W,{env:b.env,timeoutMs:q});return J={step:Q,exitCode:x.exitCode,signal:x.signal??null,timedOut:x.timedOut??!1,durationMs:x.durationMs??performance.now()-Z},x}finally{if(J.exitCode===null)J.durationMs=performance.now()-Z;b.onStep?.({...J})}};try{let Q=await K(z?"tasklist":"ps",z?"tasklist.exe":"ps",z?["/fo","csv","/nh"]:["-eo","pid,command"]);if(Q.exitCode!==0)throw new Y(J);let $=[];for(let q of Q.stdout.split(/\r?\n/)){let Z=q.trim();if(!Z)continue;let x,D;if(z){let U=/^"([^"]+)","(\d+)"(?:,|$)/.exec(Z);if(!U)throw new Y(J);D=U[1]??"",x=Number(U[2])}else{let U=/^(\d+)\s+(.+)$/.exec(Z);if(!U){if(/^PID\s+COMMAND$/i.test(Z))continue;throw new Y(J)}x=Number(U[1]),D=U[2]??""}if(!Number.isSafeInteger(x)||x<0)throw new Y(J);$.push({pid:x,command:D})}if(!$.length)throw new Y(J);let W=$.filter((q)=>q.pid!==process.pid&&/^(?:node|bun)\.exe$/i.test(q.command));if(z&&W.length&&b.inspectRuntimes!==!1){let q=await K("CIM","powershell.exe",["-NoProfile","-NonInteractive","-Command",`$ErrorActionPreference = 'Stop'; Get-CimInstance Win32_Process -Filter "Name = 'node.exe' OR Name = 'bun.exe'" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress`],z1);if(q.exitCode!==0)throw new Y(J);let Z=JSON.parse(q.stdout||"null"),x=Z===null?[]:Array.isArray(Z)?Z:[Z],D=new Map;for(let U of x){if(!U||typeof U!=="object"||!("ProcessId"in U)||!("CommandLine"in U)||!Number.isSafeInteger(U.ProcessId))throw new Y(J);if(typeof U.CommandLine==="string")D.set(Number(U.ProcessId),U.CommandLine);else if(W.some((j)=>j.pid===U.ProcessId))throw new Y(J)}for(let U of W)U.command=D.get(U.pid)??""}return $}catch(Q){if(Q instanceof Y)throw Q;throw new Y(J)}}function S(G=A,b={}){let z=(J)=>J.pid!==process.pid&&Z0(J.command)!==null;return{async listRunningHosts(J){return(await l(G,{...b,env:J})).filter(z)},async previewRunningHosts(J){let K=await l(G,{...b,env:J,inspectRuntimes:!1}),Q=(b.platform??process.platform)==="win32";return{hosts:K.filter(z),uncheckedRuntimes:Q?K.filter(($)=>$.pid!==process.pid&&/^(?:node|bun)\.exe$/i.test($.command)).length:0}}}}async function y(G,b){let z=await G.listRunningHosts(b);if(z.length)throw new T(z)}var $0="Claustrum enrollment did not complete. Inspect and approve with ck, then rerun setup.";class I extends Error{}async function U0(G,b,z,J,K){let{name:Q,paths:$}=G.vault.hosts[b],W=P($);await K();let q=await(z.connect??m)({connectionFile:G.vault.connectionFile,handshakeTimeoutMs:2000}).catch(()=>{throw new I("Claustrum connection failed; start ck and rerun setup.")});try{let Z=new q0({proposedName:Q,paths:W,client:{enrollPropose:async(D)=>{return await K(),q.enrollPropose(D)},enrollPoll:async(D)=>{return await K(),q.enrollPoll(D)}},writeTokenFile:async(D,U)=>{await K(),await W1(D,U)}}),x;for(let D=0;D<300;D++){await K();let U=await Z.reconcile();if(U.state==="approved"){O(J,`Connected ${b} to Claustrum.`);return}if(U.state!=="pending"&&U.state!=="busy")throw new I("Claustrum enrollment refused; inspect its status with ck before rerunning setup.");if(U.state==="pending"&&U.requestId&&U.requestId!==x){if(!/^[a-zA-Z0-9_-]+$/.test(U.requestId))throw new I("Invalid enrollment request id.");x=U.requestId,O(J,"Waiting for approval. In another terminal, run:"),O(J,`  ck auth enroll approve --request-id ${U.requestId} --name ${Q}`),O(J,`Enrollment files: ${W.statePath}, ${W.tokenPath}`)}await(z.wait??U1)(1000)}throw new I("Claustrum approval is still pending; approve with ck and rerun setup.")}catch(Z){if(Z instanceof T||Z instanceof Y)throw Z;if(Z instanceof I)throw new I($0);throw Error($0)}finally{q.close()}}async function W0(G,b){let z=new Set(b);for(;;){let J=await v(G,[...["opencode","pi"].map((K)=>({value:K,label:`[${z.has(K)?"x":" "}] ${K==="opencode"?"OpenCode":"Pi"}`,hint:b.includes(K)?"found":"not found"})),{value:"done",label:"Continue with selected hosts"}],{message:"Select hosts to set up",subtitle:"Enter toggles a host; choose Continue when ready."});if(J===null)return null;if(J==="done")return[...z];if(z.has(J))z.delete(J);else z.add(J)}}import{applyEdits as a,createScanner as H1,findNodeAtLocation as M1,modify as D0,parse as N1,parseTree as R1}from"jsonc-parser";import{randomUUID as x1}from"node:crypto";import{mkdir as D1,open as F1,rename as V1,stat as X1,unlink as j1}from"node:fs/promises";import{basename as O1,dirname as B1,join as Y1}from"node:path";import{setTimeout as C1}from"node:timers/promises";async function x0(G,b,z={}){let J=(z.platform??process.platform)==="win32",K=B1(G);await D1(K,{recursive:!0});let Q;if(!J)try{Q=(await X1(G)).mode&4095}catch(q){if(q.code!=="ENOENT")throw q}let $=Y1(K,`.${O1(G)}.${(z.stageName??x1)()}.tmp`),W=!1;try{let q=await F1($,"wx",Q??438);W=!0;try{if(await q.writeFile(b,"utf8"),Q!==void 0)await q.chmod(Q)}finally{await q.close()}let Z=z.now??(()=>performance.now()),x=Z();for(let D=0;;D++){await z.beforeRename?.();try{await(z.rename??V1)($,G),W=!1;return}catch(U){let j=U.code,V=2000-(Z()-x);if(!J||!["EPERM","EBUSY","EACCES"].includes(j??"")||V<=0||D>=40)throw Error(`Unable to replace host config ${G}. Close editors or other programs using the file, then rerun setup.`);await(z.wait??C1)(Math.min(V,25*2**Math.min(D,2)))}}}finally{if(W)await j1($).catch(()=>{})}}function F0(G){let b=typeof G==="string"?G:Array.isArray(G)?G[0]:G&&typeof G==="object"&&("package"in G)?G.package:null;if(typeof b!=="string")return null;let z=b.indexOf("@",b.startsWith("@")?1:0);return z<0?b:b.slice(0,z)}function V0(G,b,z){let J=R1(G),K=J&&M1(J,[b]),Q=K?.children??[],$=Q[z];if(!$||!K)throw Error("Invalid plugin array edit.");let W=[{offset:$.offset,length:$.length,content:""}],q=(Z,x)=>{let D=H1(G.slice(Z,x),!0);if(D.scan(),G[Z+D.getTokenOffset()]===",")W.push({offset:Z+D.getTokenOffset(),length:1,content:""})};if(z===Q.length-1){let Z=Q[z-1];if(Z)q(Z.offset+Z.length,$.offset);q($.offset+$.length,K.offset+K.length-1)}else q($.offset+$.length,Q[z+1]?.offset??$.offset+$.length);return a(G,W)}function X0(G,b,z,J){let K=[],Q=N1(G,K,{allowTrailingComma:!0});if(K.length||!Q||typeof Q!=="object"||Array.isArray(Q))throw Error("Invalid OpenCode config; refusing to overwrite it.");let $={formattingOptions:{insertSpaces:!/^\t+/m.test(G),tabSize:/^([ ]+)"/m.exec(G)?.[1]?.length??2,eol:G.includes(`\r
 `)?`\r
 `:`
-`}},O=G,U=Z[b];if(U!==void 0&&!Array.isArray(U))throw Error(`OpenCode ${b} must be an array.`);let $=Array.isArray(U)?[...U]:[],W=$.flatMap((F,H)=>K1(F)===z?[H]:[]),x=`${z}@${J}`;if(!W.length)O=u(O,$1(O,U===void 0?[b]:[b,$.length],U===void 0?[x]:x,K));else{let F=W[0],H=$[F],V=Array.isArray(H)?[x,...H.slice(1)]:H&&typeof H==="object"?{...H,package:x}:x;if(JSON.stringify(H)!==JSON.stringify(V))O=u(O,$1(O,[b,F],V,K));for(let j of W.slice(1).reverse())O=q1(O,b,j)}let q=b==="plugin"?"plugins":"plugin";if(Array.isArray(Z[q])){let F=Z[q];for(let H=F.length-1;H>=0;H--)if(K1(F[H])===z)O=q1(O,q,H)}return O}function p(G,b,z={}){let J=z.fs??k,{path:Q,opencode:Z}=C(z),K=b==="2"?"plugins":"plugin";return(b==="2"?["opencode"]:["opencode","tui"]).map((U)=>{let $=Q.join(Z,`${U}.jsonc`),W=Q.join(Z,`${U}.json`),x=J.exists($)?$:J.exists(W)?W:$,q=J.exists(x),F=q?J.readText(x):`${JSON.stringify({$schema:`https://opencode.ai/${U==="tui"?"tui":"config"}.json`},null,2)}
-`,H=U1(F,K,G.packages.opencode,G.version);return{path:x,content:H,changed:!q||H!==F}})}async function l(G,b){for(let z of G){if(!z.changed)continue;await b?.(),await Z1(z.path,z.content,{beforeRename:b})}}async function a(G,b,z={}){let{platform:J,env:Q}=C(z),Z=await y(z.runner??w,J,b,["install",`npm:${G.packages.pi}@${G.version}`],Q);if(Z.exitCode!==0||Z.timedOut)throw new f({exitCode:Z.spawnError?null:Z.exitCode,signal:Z.signal??null,stderrTail:Z.stderr,stderrTruncated:Z.stderrTruncated??!1})}var W1="Multiple OpenCode generations found. Choose --opencode=1|2|both before running noninteractive setup.";function X0(G){let b={yes:!1,dryRun:!1,claustrum:!1,noClaustrum:!1,login:!1,opencode:void 0};for(let z of G)if(z==="--yes")b.yes=!0;else if(z==="--dry-run")b.dryRun=!0;else if(z==="--claustrum")b.claustrum=!0;else if(z==="--no-claustrum")b.noClaustrum=!0;else if(z==="--login")b.login=!0;else if(/^--opencode=(1|2|both)$/.test(z))b.opencode=z.slice(11);else throw Error(`Unknown setup argument: ${z}`);if(b.claustrum&&b.noClaustrum)throw Error("--claustrum and --no-claustrum cannot be used together.");if(b.login&&b.claustrum)throw Error("--login and --claustrum cannot be used together.");return b}function V0(G){for(let b of Object.values(G.packages))if(!/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/.test(b))throw Error("Setup requires npm package names.");if(!/^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?(?:\+[a-zA-Z0-9.-]+)?$/.test(G.version))throw Error("Setup requires a concrete package version.");for(let b of Object.values(G.vault.hosts))if(!/^[a-z0-9][a-z0-9-]*$/.test(b.name))throw Error("Setup requires lowercase vault names containing only letters, digits and dashes.")}async function r(G,b=[],z={}){let J=X0(b);V0(G);let Q=z.terminal??O1(),Z=await c(G,z);X(Q,`${G.displayName} setup`);for(let[D,B]of[["OpenCode",Z.opencode],["Pi",Z.pi]])X(Q,`${D}: ${B.installed?`found (version ${B.version??"unknown"})`:"not found"} — ${B.directory}`);X(Q,`Claustrum: ${Z.claustrum.available?"available":"not available"}`);let K=Z.pi.installed&&!Z.pi.executable;if(K)X(Q,"Pi: skipped, because its folder exists but pi is not on PATH. Install the Pi CLI and rerun setup to add it.");let O=["opencode","pi"].filter((D)=>Z[D].installed&&!(D==="pi"&&K)),U=J.yes||J.dryRun&&!S(Q);if(!U&&!S(Q))throw Error("Setup requires a TTY or --yes.");let $=U?O:await J1(Q,O)??[],W=J.opencode??(Z.opencode.generation==="ambiguous"?"1":Z.opencode.generation);if($.includes("opencode")&&!J.opencode&&Z.opencode.generation==="ambiguous"){if(U||!S(Q))throw Error(W1);let D=await P(Q,[{value:"1",label:"OpenCode 1"},{value:"2",label:"OpenCode 2"},{value:"both",label:"Both (one compatible registration)"}],{message:"Which OpenCode generation should be registered?"});if(D===null)return{hosts:[],dryRun:J.dryRun,mode:"local",detection:Z};W=D}if(!$.length)return X(Q,"No hosts selected. Install OpenCode or Pi and rerun setup."),{hosts:$,dryRun:J.dryRun,mode:"local",detection:Z};let{env:x,platform:q}=C(z),F=z.fence??T(z.runner??w,{platform:q}),H=async()=>{try{await L(F,x)}catch(D){if(D instanceof N)X(Q,D.refusalText);throw D}};if(X(Q,"Checking that OpenCode and Pi are not running…"),J.dryRun)try{let D=F.previewRunningHosts?await F.previewRunningHosts(x):{hosts:await F.listRunningHosts(x),uncheckedRuntimes:0},B=D.hosts;if(D.uncheckedRuntimes>0)X(Q,"Node or Bun programs are running; a real run checks whether any of them is OpenCode or Pi.");let k1=new Set(new _(B).activeHosts.map((g)=>g.command.toLowerCase()==="pi"?"Pi":"OpenCode"));for(let g of k1)X(Q,`${g} is running; setup will ask you to quit it.`)}catch(D){if(X(Q,"Process inspection failed; real setup will require successful inspection and stopped OpenCode/Pi hosts."),D instanceof N)X(Q,D.refusalText)}else await H();if(J.claustrum&&!Z.claustrum.available)throw Error("Claustrum is not available. Start ck or use --no-claustrum for local sign-in.");let V=Boolean(J.claustrum);if(!V&&!J.login&&!J.noClaustrum&&!U&&Z.claustrum.available&&S(Q)){let D=await P(Q,[{label:"No",value:!1},{label:"Yes",value:!0}],{message:"Connect these hosts to the Claustrum vault?"});if(D===null)return X(Q,"Setup cancelled. Nothing was changed."),{hosts:[],dryRun:J.dryRun,mode:"local",detection:Z};V=D===!0}let j=V?"claustrum":"local",M=$.includes("opencode")?p(G,W,z):[];if(J.dryRun){X(Q,"Dry run: no registrations, enrollment, sign-in or migration will be performed.");for(let D of $){if(G.beforeSignIn)X(Q,`Would run beforeSignIn(${D}, ${j}).`);if(V){let B=A(G.vault.hosts[D].paths);X(Q,`Would Connect ${D}: write ${B.statePath} and ${B.tokenPath}; wait for ck auth enroll approve.`)}else X(Q,`Would sign in locally for ${D}.`);if(G.beforeRegister)X(Q,`Would run beforeRegister(${D}, ${j}).`)}for(let D of M)X(Q,`${D.changed?"Would write":"Unchanged"} ${D.path}:
-${D.content}`);if($.includes("pi"))X(Q,`Would run ${Z.pi.executable} install npm:${G.packages.pi}@${G.version}`);for(let D of $)X(Q,`Would migrate ${D} using the plugin callback (provider-specific writes).`)}else{let D={opencodeGeneration:W,mode:j,hosts:Object.freeze([...$]),piAgentDir:Z.pi.directory};for(let B of $){if(await H(),await G.beforeSignIn?.(B,D),await H(),V)await z1(G,B,z,Q,H);else await G.signInLocal(B,D);if(await H(),await G.beforeRegister?.(B,j,D),await H(),B==="opencode")await l(M,H);else await a(G,Z.pi.executable,z);await H(),await G.migrate(B,D)}}return X(Q,`${J.dryRun?"Planned":"Configured"} ${G.displayName} for ${$.join(", ")} (${j}).`),X(Q,`Next: ${$.includes("opencode")?"start OpenCode":"start Pi"} and run ${G.slashCommand}.`),{hosts:$,dryRun:J.dryRun,mode:j,detection:Z}}import{basename as R0}from"node:path";import{resolveClaustrumConnectionPath as w0}from"@cortexkit/claustrum-client";var x1={name:"@cortexkit/pi-openai-auth",version:"1.1.0",license:"MIT",type:"module",repository:{type:"git",url:"git+https://github.com/cortexkit/openai-auth.git",directory:"packages/pi"},main:"./dist/index.js",types:"./dist/index.d.ts",exports:{".":{import:"./dist/index.js",types:"./dist/index.d.ts"}},files:["dist","README.md","LICENSE"],keywords:["pi-package"],pi:{extensions:["./dist/index.js"]},scripts:{build:"rm -rf dist && bun build src/index.ts --outdir dist --target node --format esm --external '@earendil-works/pi-ai' --external '@earendil-works/pi-ai/*' --external '@earendil-works/pi-coding-agent' --external '@earendil-works/pi-coding-agent/*' --external '@earendil-works/pi-tui' --external '@earendil-works/pi-tui/*' --external @cortexkit/private-files --external @cortexkit/claustrum-client --external @cortexkit/subc-client --minify && bun run build:types","build:types":"cd ../core && bun run build && cd ../pi && tsdown --config tsdown.config.ts --config-loader native",test:"bun test src/tests",typecheck:"tsc",types:"tsc",prepublishOnly:"bun run build"},devDependencies:{"@cortexkit/common-auth":"^0.18.0","@cortexkit/openai-auth-core":"workspace:*"},dependencies:{"@cortexkit/claustrum-client":"^0.9.0","@cortexkit/private-files":"^0.2.1","@cortexkit/subc-client":"^0.16.0"},peerDependencies:{"@earendil-works/pi-ai":">=1.0.1","@earendil-works/pi-coding-agent":">=1.0.1","@earendil-works/pi-tui":">=1.0.1"}};import{homedir as B0}from"node:os";import{join as j1}from"node:path";function Y0(){return process.env.PI_AGENT_DIR?.trim()||j1(B0(),".pi","agent")}function F1(){return process.env.PI_OPENAI_AUTH_FILE?.trim()||j1(Y0(),D1)}function C0(G=F1()){return process.env.PI_OPENAI_AUTH_STATE_FILE?.trim()||H1(G)}function X1(G=F1()){return{configPath:G,statePath:C0(G)}}var I={name:"@cortexkit/opencode-openai-auth",version:"1.1.0",license:"MIT",type:"module",repository:{type:"git",url:"git+https://github.com/cortexkit/openai-auth.git",directory:"packages/opencode"},main:"./dist/index.js",types:"./dist/index.d.ts",bin:{"opencode-openai-auth":"./dist/bin.js"},exports:{".":{import:"./dist/index.js",types:"./dist/index.d.ts"},"./tui":{types:"./dist/tui.d.ts",import:"./src/tui/entry.mjs"},"./tui-prefs":{types:"./dist/tui-preferences.d.ts",import:"./dist/tui-preferences.js"},"./server":{types:"./dist/v2/server.d.ts",import:"./dist/v2/server.js"}},"oc-plugin":["server","tui"],engines:{bun:"1.3.14"},files:["dist","src/tui/entry.mjs","src/tui-compiled","README.md","LICENSE"],scripts:{build:"rm -rf dist && bun build src/index.ts src/v2/server.ts src/sidebar-state.ts src/tui-preferences.ts src/rpc/rpc-client.ts src/rpc/port-file.ts src/rpc/protocol.ts src/rpc/rpc-dir.ts src/bin.ts --root src --outdir dist --target node --format esm --splitting --external @opencode-ai/plugin --external @opencode/plugin --external @cortexkit/private-files --external jsonc-parser --external @cortexkit/claustrum-client --external @cortexkit/subc-client --minify && bun run build:types && bun run build:tui","build:tui":"bun scripts/build-tui.ts","build:types":"cd ../core && bun run build && cd ../opencode && tsdown --config tsdown.config.ts --config-loader native","build:dev":"rm -rf dist && tsc -p tsconfig.build.json",test:"bun test src/tests",typecheck:"tsc",types:"tsc",prepublishOnly:"bun run build"},peerDependencies:{"@opencode-ai/plugin":"*","@opencode/plugin":">=2.0.21"},peerDependenciesMeta:{"@opencode/plugin":{optional:!0}},devDependencies:{"@ai-sdk/openai":"3.0.88","@cortexkit/common-auth":"^0.18.0","@cortexkit/openai-auth-core":"workspace:*","@opencode/plugin":"2.0.27"},dependencies:{"@cortexkit/claustrum-client":"^0.9.0","@cortexkit/private-files":"^0.2.1","@cortexkit/subc-client":"^0.16.0","@opentui/core":">=0.6.1","@opentui/solid":">=0.6.1",ai:"^7.0.137","jsonc-parser":"^3.3.1","solid-js":"1.9.12"}};function w1(G={}){let b=G.print??console.log,z=G.fence??T(),J={opencode:{stateDir:i(C1().statePath),host:"opencode"},pi:{stateDir:i(X1().statePath),host:"pi"}},Q=async(Z)=>{if(await N1(A(J[Z]),E(Z))!=="local")throw Error(`${Z} is enrolled in Claustrum or its enrollment is unreadable. Disconnect it from the vault before using local sign-in.`)};return{packages:{opencode:I.name,pi:x1.name},version:I.version,displayName:"OpenAI Auth",slashCommand:"/openai",vault:{connectionFile:w0(),hosts:{opencode:{name:E("opencode"),paths:J.opencode},pi:{name:E("pi"),paths:J.pi}}},async beforeRegister(Z,K){if(K==="claustrum"){if(b(`Allow this host to read OpenAI accounts with:
-  ck auth grant --principal enrolled:${E(Z)} --selector-kind category --selector ${B1.category} --operation read`),Z==="opencode")b("Then run opencode auth login and choose ChatGPT accounts in the vault to activate vault routing without local sign-in.");return}await Q(Z)},async signInLocal(Z,K){if(await Q(Z),Z==="pi"){b("Start Pi and run /login openai-codex to sign in with Pi itself.");return}if(K.opencodeGeneration!=="1"){let j=R0(R("opencode2",G.io)??R("opencode",G.io)??"opencode");b(`In OpenCode 2, run ${j} auth login openai and choose "ChatGPT (openai-auth pool, browser)" or "ChatGPT (openai-auth pool, headless)" to sign in to the account pool and activate it.`)}if(K.opencodeGeneration==="2")return;if(M1(process.env))throw Error("Unset OPENCODE_AUTH_CONTENT before local setup sign-in.");let O=R1(),U={path:{id:"openai"}};if(await O.get(U)!==void 0){b("OpenCode already has an OpenAI login. Use opencode auth login to change it.");return}let $=G.beginLogin??V1,W=new AbortController,x=Boolean(process.env.SSH_CONNECTION||process.env.SSH_TTY||process.platform==="linux"&&!process.env.DISPLAY&&!process.env.WAYLAND_DISPLAY),q={version:I.version,signal:W.signal},F,H=!x;try{F=await $({...q,headless:x})}catch(j){if(x)throw j;H=!1,b("Browser callback unavailable; using device-code sign-in."),F=await $({version:I.version,headless:!0})}if(H){if(!(G.openBrowser??Y1)(F.url))W.abort(),await F.completion.catch(()=>{}),b("Browser unavailable; using device-code sign-in."),F=await $({version:I.version,headless:!0})}b(`${F.url}
-${F.instructions}`);let V=await F.completion;await L(z),await Q(Z),await O.set({...U,body:{type:"oauth",access:V.access,refresh:V.refresh,expires:V.expires,...V.accountId?{accountId:V.accountId}:{}}}),b("Signed in to OpenCode. The first plugin start adopts this login into the account pool.")},async migrate(Z){b(`${Z}: account migration runs on first plugin start; setup leaves existing credentials unchanged.`)}}}if(process.argv[2]!=="setup")console.log("Usage: opencode-openai-auth setup [options]");else try{await r(w1(),process.argv.slice(3))}catch(G){console.error(G instanceof Error?G.message:String(G)),process.exitCode=1}
+`}},W=G,q=Q[b];if(q!==void 0&&!Array.isArray(q))throw Error(`OpenCode ${b} must be an array.`);let Z=Array.isArray(q)?[...q]:[],x=Z.flatMap((j,V)=>F0(j)===z?[V]:[]),D=`${z}@${J}`;if(!x.length)W=a(W,D0(W,q===void 0?[b]:[b,Z.length],q===void 0?[D]:D,$));else{let j=x[0],V=Z[j],B=Array.isArray(V)?[D,...V.slice(1)]:V&&typeof V==="object"?{...V,package:D}:D;if(JSON.stringify(V)!==JSON.stringify(B))W=a(W,D0(W,[b,j],B,$));for(let X of x.slice(1).reverse())W=V0(W,b,X)}let U=b==="plugin"?"plugins":"plugin";if(Array.isArray(Q[U])){let j=Q[U];for(let V=j.length-1;V>=0;V--)if(F0(j[V])===z)W=V0(W,U,V)}return W}function i(G,b,z={}){let J=z.fs??_,{path:K,opencode:Q}=N(z),$=b==="2"?"plugins":"plugin";return(b==="2"?["opencode"]:["opencode","tui"]).map((q)=>{let Z=K.join(Q,`${q}.jsonc`),x=K.join(Q,`${q}.json`),D=J.exists(Z)?Z:J.exists(x)?x:Z,U=J.exists(D),j=U?J.readText(D):`${JSON.stringify({$schema:`https://opencode.ai/${q==="tui"?"tui":"config"}.json`},null,2)}
+`,V=X0(j,$,G.packages.opencode,G.version);return{path:D,content:V,changed:!U||V!==j}})}async function s(G,b){for(let z of G){if(!z.changed)continue;await b?.(),await x0(z.path,z.content,{beforeRename:b})}}async function r(G,b,z={}){let{platform:J,env:K}=N(z),Q=await g(z.runner??A,J,b,["install",`npm:${G.packages.pi}@${G.version}`],K);if(Q.exitCode!==0||Q.timedOut)throw new d({exitCode:Q.spawnError?null:Q.exitCode,signal:Q.signal??null,stderrTail:Q.stderr,stderrTruncated:Q.stderrTruncated??!1})}var O0="Multiple OpenCode generations found. Choose --opencode=1|2|both before running noninteractive setup.";function k1(G){let b={yes:!1,dryRun:!1,claustrum:!1,noClaustrum:!1,login:!1,opencode:void 0};for(let z of G)if(z==="--yes")b.yes=!0;else if(z==="--dry-run")b.dryRun=!0;else if(z==="--claustrum")b.claustrum=!0;else if(z==="--no-claustrum")b.noClaustrum=!0;else if(z==="--login")b.login=!0;else if(/^--opencode=(1|2|both)$/.test(z))b.opencode=z.slice(11);else throw Error(`Unknown setup argument: ${z}`);if(b.claustrum&&b.noClaustrum)throw Error("--claustrum and --no-claustrum cannot be used together.");if(b.login&&b.claustrum)throw Error("--login and --claustrum cannot be used together.");return b}function w1(G){for(let b of Object.values(G.packages))if(!/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/.test(b))throw Error("Setup requires npm package names.");if(!/^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?(?:\+[a-zA-Z0-9.-]+)?$/.test(G.version))throw Error("Setup requires a concrete package version.");for(let b of Object.values(G.vault.hosts))if(!/^[a-z0-9][a-z0-9-]*$/.test(b.name))throw Error("Setup requires lowercase vault names containing only letters, digits and dashes.")}async function A1(G,b,z){let J=[];for(let K of b){let Q=z.get(K)??"not-enrolled";if(Q==="unknown"){let{name:$,paths:W}=G.vault.hosts[K],q=await c(P(W),$).catch(()=>"unreadable");if(q==="vault")Q="enrolled";else if(q==="local")Q="not-enrolled"}J.push({host:K,outcome:Q})}return J}async function n(G,b=[],z={}){let J=k1(b);w1(G);let K=z.terminal??j0(),Q=await p(G,z);O(K,`${G.displayName} setup`);for(let[F,H]of[["OpenCode",Q.opencode],["Pi",Q.pi]])O(K,`${F}: ${H.installed?`found (version ${H.version??"unknown"})`:"not found"} — ${H.directory}`);O(K,`Claustrum: ${Q.claustrum.available?"available":"not available"}`);let $=Q.pi.installed&&!Q.pi.executable;if($)O(K,"Pi: skipped, because its folder exists but pi is not on PATH. Install the Pi CLI and rerun setup to add it.");let W=["opencode","pi"].filter((F)=>Q[F].installed&&!(F==="pi"&&$)),q=J.yes||J.dryRun&&!E(K);if(!q&&!E(K))throw Error("Setup requires a TTY or --yes.");let Z=q?W:await W0(K,W)??[],x=J.opencode??(Q.opencode.generation==="ambiguous"?"1":Q.opencode.generation);if(Z.includes("opencode")&&!J.opencode&&Q.opencode.generation==="ambiguous"){if(q||!E(K))throw Error(O0);let F=await v(K,[{value:"1",label:"OpenCode 1"},{value:"2",label:"OpenCode 2"},{value:"both",label:"Both (one compatible registration)"}],{message:"Which OpenCode generation should be registered?"});if(F===null)return{hosts:[],dryRun:J.dryRun,mode:"local",detection:Q};x=F}if(!Z.length)return O(K,"No hosts selected. Install OpenCode or Pi and rerun setup."),{hosts:Z,dryRun:J.dryRun,mode:"local",detection:Q};let{env:D,platform:U}=N(z),j=z.fence??S(z.runner??A,{platform:U}),V=async()=>{try{await y(j,D)}catch(F){if(F instanceof Y)O(K,F.refusalText);throw F}};if(O(K,"Checking that OpenCode and Pi are not running…"),J.dryRun)try{let F=j.previewRunningHosts?await j.previewRunningHosts(D):{hosts:await j.listRunningHosts(D),uncheckedRuntimes:0},H=F.hosts;if(F.uncheckedRuntimes>0)O(K,"Node or Bun programs are running; a real run checks whether any of them is OpenCode or Pi.");let C=new Set(new T(H).activeHosts.map((w)=>w.command.toLowerCase()==="pi"?"Pi":"OpenCode"));for(let w of C)O(K,`${w} is running; setup will ask you to quit it.`)}catch(F){if(O(K,"Process inspection failed; real setup will require successful inspection and stopped OpenCode/Pi hosts."),F instanceof Y)O(K,F.refusalText)}else await V();if(J.claustrum&&!Q.claustrum.available)throw Error("Claustrum is not available. Start ck or use --no-claustrum for local sign-in.");let B=Boolean(J.claustrum);if(!B&&!J.login&&!J.noClaustrum&&!q&&Q.claustrum.available&&E(K)){let F=await v(K,[{label:"No",value:!1},{label:"Yes",value:!0}],{message:"Connect these hosts to the Claustrum vault?"});if(F===null)return O(K,"Setup cancelled. Nothing was changed."),{hosts:[],dryRun:J.dryRun,mode:"local",detection:Q};B=F===!0}let X=B?"claustrum":"local",R=Z.includes("opencode")?i(G,x,z):[];if(J.dryRun){O(K,"Dry run: no registrations, enrollment, sign-in or migration will be performed.");for(let F of Z){if(G.beforeSignIn)O(K,`Would run beforeSignIn(${F}, ${X}).`);if(B){let H=P(G.vault.hosts[F].paths);O(K,`Would Connect ${F}: write ${H.statePath} and ${H.tokenPath}; wait for ck auth enroll approve.`)}else O(K,`Would sign in locally for ${F}.`);if(G.beforeRegister)O(K,`Would run beforeRegister(${F}, ${X}).`)}for(let F of R)O(K,`${F.changed?"Would write":"Unchanged"} ${F.path}:
+${F.content}`);if(Z.includes("pi"))O(K,`Would run ${Q.pi.executable} install npm:${G.packages.pi}@${G.version}`);for(let F of Z)O(K,`Would migrate ${F} using the plugin callback (provider-specific writes).`)}else{let F={opencodeGeneration:x,mode:X,hosts:Object.freeze([...Z]),piAgentDir:Q.pi.directory},H=new Map;try{for(let C of Z){if(await V(),await G.beforeSignIn?.(C,F),await V(),B){H.set(C,"unknown");try{await U0(G,C,z,K,V)}catch(w){if(w instanceof I)H.set(C,"not-enrolled");throw w}H.set(C,"enrolled")}else await G.signInLocal(C,F);if(await V(),await G.beforeRegister?.(C,X,F),await V(),C==="opencode")await s(R,V);else await r(G,Q.pi.executable,z);await V(),await G.migrate(C,F)}}catch(C){if(H.size===0)throw C;try{let w=await A1(G,Z,H);b0(C,w);for(let P0 of w)O(K,G0(P0))}catch{}throw C}}return O(K,`${J.dryRun?"Planned":"Configured"} ${G.displayName} for ${Z.join(", ")} (${X}).`),O(K,`Next: ${Z.includes("opencode")?"start OpenCode":"start Pi"} and run ${G.slashCommand}.`),{hosts:Z,dryRun:J.dryRun,mode:X,detection:Q}}import{basename as S1}from"node:path";import{resolveClaustrumConnectionPath as y1}from"@cortexkit/claustrum-client";var B0={name:"@cortexkit/pi-openai-auth",version:"1.3.0",license:"MIT",type:"module",repository:{type:"git",url:"git+https://github.com/cortexkit/openai-auth.git",directory:"packages/pi"},main:"./dist/index.js",types:"./dist/index.d.ts",exports:{".":{import:"./dist/index.js",types:"./dist/index.d.ts"}},files:["dist","README.md","LICENSE"],keywords:["pi-package"],pi:{extensions:["./dist/index.js"]},scripts:{build:"rm -rf dist && bun build src/index.ts --outdir dist --target node --format esm --external '@earendil-works/pi-ai' --external '@earendil-works/pi-ai/*' --external '@earendil-works/pi-coding-agent' --external '@earendil-works/pi-coding-agent/*' --external '@earendil-works/pi-tui' --external '@earendil-works/pi-tui/*' --external @cortexkit/private-files --external @cortexkit/claustrum-client --external @cortexkit/subc-client --minify && bun run build:types","build:types":"cd ../core && bun run build && cd ../pi && tsdown --config tsdown.config.ts --config-loader native",test:"bun test src/tests",typecheck:"tsc",types:"tsc",prepublishOnly:"bun run build"},devDependencies:{"@cortexkit/common-auth":"^0.21.0","@cortexkit/openai-auth-core":"workspace:*"},dependencies:{"@cortexkit/claustrum-client":"^0.12.0","@cortexkit/private-files":"^0.2.1","@cortexkit/subc-client":"^0.22.0"},peerDependencies:{"@earendil-works/pi-ai":">=1.0.1","@earendil-works/pi-coding-agent":">=1.0.1","@earendil-works/pi-tui":">=1.0.1"}};import{homedir as _1}from"node:os";import{join as H0}from"node:path";function T1(){return process.env.PI_AGENT_DIR?.trim()||H0(_1(),".pi","agent")}function M0(){return process.env.PI_OPENAI_AUTH_FILE?.trim()||H0(T1(),Y0)}function P1(G=M0()){return process.env.PI_OPENAI_AUTH_STATE_FILE?.trim()||C0(G)}function N0(G=M0()){return{configPath:G,statePath:P1(G)}}var L={name:"@cortexkit/opencode-openai-auth",version:"1.3.0",license:"MIT",type:"module",repository:{type:"git",url:"git+https://github.com/cortexkit/openai-auth.git",directory:"packages/opencode"},main:"./dist/index.js",types:"./dist/index.d.ts",bin:{"opencode-openai-auth":"./dist/bin.js"},exports:{".":{import:"./dist/index.js",types:"./dist/index.d.ts"},"./tui":{types:"./dist/tui.d.ts",import:"./src/tui/entry.mjs"},"./tui-prefs":{types:"./dist/tui-preferences.d.ts",import:"./dist/tui-preferences.js"},"./server":{types:"./dist/v2/server.d.ts",import:"./dist/v2/server.js"}},"oc-plugin":["server","tui"],engines:{bun:"1.3.14"},files:["dist","src/tui/entry.mjs","src/tui-compiled","README.md","LICENSE"],scripts:{build:"rm -rf dist && bun build src/index.ts src/v2/server.ts src/sidebar-state.ts src/tui-preferences.ts src/rpc/rpc-client.ts src/rpc/port-file.ts src/rpc/protocol.ts src/rpc/rpc-dir.ts src/bin.ts --root src --outdir dist --target node --format esm --splitting --external @opencode-ai/plugin --external @opencode/plugin --external @cortexkit/private-files --external jsonc-parser --external @cortexkit/claustrum-client --external @cortexkit/subc-client --minify && bun run build:types && bun run build:tui","build:tui":"bun scripts/build-tui.ts","build:types":"cd ../core && bun run build && cd ../opencode && tsdown --config tsdown.config.ts --config-loader native","build:dev":"rm -rf dist && tsc -p tsconfig.build.json",test:"bun test src/tests",typecheck:"tsc",types:"tsc",prepublishOnly:"bun run build"},peerDependencies:{"@opencode-ai/plugin":"*","@opencode/plugin":">=2.0.21"},peerDependenciesMeta:{"@opencode/plugin":{optional:!0}},devDependencies:{"@ai-sdk/openai":"3.0.88","@cortexkit/common-auth":"^0.21.0","@cortexkit/openai-auth-core":"workspace:*","@opencode/plugin":"2.0.27"},dependencies:{"@cortexkit/claustrum-client":"^0.12.0","@cortexkit/private-files":"^0.2.1","@cortexkit/subc-client":"^0.22.0","@opentui/core":">=0.6.1","@opentui/solid":">=0.6.1",ai:"^7.0.137","jsonc-parser":"^3.3.1","solid-js":"1.9.12"}};function T0(G={}){let b=G.print??console.log,z=G.fence??S(),J={opencode:{stateDir:o(A0().statePath),host:"opencode"},pi:{stateDir:o(N0().statePath),host:"pi"}},K=async(Q)=>{if(await c(P(J[Q]),f(Q))!=="local")throw Error(`${Q} is enrolled in Claustrum or its enrollment is unreadable. Disconnect it from the vault before using local sign-in.`)};return{packages:{opencode:L.name,pi:B0.name},version:L.version,displayName:"OpenAI Auth",slashCommand:"/openai",vault:{connectionFile:y1(),hosts:{opencode:{name:f("opencode"),paths:J.opencode},pi:{name:f("pi"),paths:J.pi}}},async beforeRegister(Q,$){if($==="claustrum"){if(b(`Allow this host to read OpenAI accounts with:
+  ck auth grant --principal enrolled:${f(Q)} --selector-kind category --selector ${k0.category} --operation read`),Q==="opencode")b("Then run opencode auth login and choose ChatGPT accounts in the vault to activate vault routing without local sign-in.");return}await K(Q)},async signInLocal(Q,$){if(await K(Q),Q==="pi"){b("Start Pi and run /login openai-codex to sign in with Pi itself.");return}if($.opencodeGeneration!=="1"){let X=S1(k("opencode2",G.io)??k("opencode",G.io)??"opencode");b(`In OpenCode 2, run ${X} auth login openai and choose "ChatGPT (openai-auth pool, browser)" or "ChatGPT (openai-auth pool, headless)" to sign in to the account pool and activate it.`)}if($.opencodeGeneration==="2")return;if(I0(process.env))throw Error("Unset OPENCODE_AUTH_CONTENT before local setup sign-in.");let W=_0(),q={path:{id:"openai"}};if(await W.get(q)!==void 0){b("OpenCode already has an OpenAI login. Use opencode auth login to change it.");return}let Z=G.beginLogin??R0,x=new AbortController,D=Boolean(process.env.SSH_CONNECTION||process.env.SSH_TTY||process.platform==="linux"&&!process.env.DISPLAY&&!process.env.WAYLAND_DISPLAY),U={version:L.version,signal:x.signal},j,V=!D;try{j=await Z({...U,headless:D})}catch(X){if(D)throw X;V=!1,b("Browser callback unavailable; using device-code sign-in."),j=await Z({version:L.version,headless:!0})}if(V){if(!(G.openBrowser??w0)(j.url))x.abort(),await j.completion.catch(()=>{}),b("Browser unavailable; using device-code sign-in."),j=await Z({version:L.version,headless:!0})}b(`${j.url}
+${j.instructions}`);let B=await j.completion;await y(z),await K(Q),await W.set({...q,body:{type:"oauth",access:B.access,refresh:B.refresh,expires:B.expires,...B.accountId?{accountId:B.accountId}:{}}}),b("Signed in to OpenCode. The first plugin start adopts this login into the account pool.")},async migrate(Q){b(`${Q}: account migration runs on first plugin start; setup leaves existing credentials unchanged.`)}}}if(process.argv[2]!=="setup")console.log("Usage: opencode-openai-auth setup [options]");else try{await n(T0(),process.argv.slice(3))}catch(G){console.error(G instanceof Error?G.message:String(G)),process.exitCode=1}

package/dist/{codex-request-BXDXToyt.d.ts → codex-request-B9D0e97Q.d.ts}

@@ -1,8 +1,8 @@
-import { a as KnobValues, c as PluginExtraSection, i as CommandInvocation, l as PluginSection, o as MenuKnob, t as CommandApplyRequest } from "./model-YRg7Uowo.js";
-import { n as QuotaMap } from "./map-Buq-GW7l.js";
+import { a as KnobValues, c as PluginExtraSection, i as CommandInvocation, l as PluginSection, o as MenuKnob, t as CommandApplyRequest } from "./model-BdITTmeb.js";
+import { mt as QuotaMap } from "./sidebar-state-CVSok7zv.js";
 import { ClaustrumClient, EnrollmentPollOutcome } from "@cortexkit/claustrum-client";
 import "@cortexkit/private-files";
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/schema.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/store/schema.d.ts
 type OAuthCredential = {
   type: 'oauth';
   access?: string;
@@ -191,7 +191,7 @@ interface PoolRow {
   unbound?: true;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/errors.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/store/errors.d.ts
 /** Every library operation that can fail, as named in the failure value. */
 type PoolOperation = 'initialize' | 'add' | 'replace' | 'rotate' | 'disable' | 'enable' | 'remove' | 'reorder' | 'updateSettings' | 'recordIdentity' | 'updateProviderState' | 'refresh' | 'pull' | 'publishRoster';
 /**
@@ -238,12 +238,12 @@ declare class PoolOperationError extends Error {
   });
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/hooks.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/store/hooks.d.ts
 interface PoolLogger {
   warn(message: string, data?: unknown): void;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.d.ts
 interface LockLoss {
   readonly reason: 'taken-over' | 'expired' | 'unreadable' | 'renewal-failed' | 'marker-lost';
   readonly expectedOwnerId: string;
@@ -278,7 +278,7 @@ type RefreshFileLockOptions = {
 /** Filesystem leases share wall time across all callers and processes. */
 declare function acquireRefreshFileLock(options: RefreshFileLockOptions): Promise<RefreshFileLock | null>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.d.ts
 type LockStep = NonNullable<Parameters<typeof acquireRefreshFileLock>[0]['onStep']> extends ((step: infer S) => unknown) ? S : never;
 /** Tuning shared by every lock the store takes; each field is overridable. */
 interface PoolLockOptions {
@@ -310,7 +310,7 @@ interface LockEnvironment {
   }, event: 'scheduled' | 'cancelled') => void;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/mutate.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/store/mutate.d.ts
 /** Named points on the write path, for crash and ownership injection. */
 type WriteStep = 'before-config-write' | 'after-config-write' | 'before-state-write' | 'after-state-write';
 /** Awaitable pause points on the pull and refresh paths. */
@@ -345,11 +345,11 @@ interface StoreContext {
 /** What `initializePool` did. */
 type InitializeOutcome = 'initialized' | 'already-ready';
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/runtime.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/store/runtime.d.ts
 /** Where a pull was fired from; `load` fires at most once per process per row. */
 type PullReason = 'load' | 'add' | 'replace' | 'admission';
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/attribution.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/store/attribution.d.ts
 /**
  * What a pull or refresh captured about its row (named by id alongside) when
  * it was issued. A result applies only while the row with that id still has
@@ -372,7 +372,7 @@ interface Attribution {
   identity?: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/rows.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/store/rows.d.ts
 type FailureHook = (rowId: string, error: PoolOperationError) => void | Promise<void>;
 interface RowOperationOptions {
   /** Called once, awaited, on every non-success path, before locks release. */
@@ -588,7 +588,7 @@ interface RowTransitionResult {
   providerState?: unknown;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/provider-state.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/store/provider-state.d.ts
 /**
  * Receives a private copy of the row's provider state (undefined when the row
  * shows none) and the row as loaded under the locks, and returns the next
@@ -624,7 +624,7 @@ declare const DECLINE_TRANSITION: unique symbol;
  */
 type RowTransitionMutator = (current: unknown | undefined, row: PoolRow) => unknown | typeof DECLINE_TRANSITION | Promise<unknown | typeof DECLINE_TRANSITION>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/publication.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/store/publication.d.ts
 interface PublishPlan {
   operationId: string;
   remove: Array<{
@@ -667,7 +667,7 @@ interface PublishResult {
   receipt: PublicationReceipt;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/pull.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/store/pull.d.ts
 /** What a pull is issued with: the credential and its attribution tuple. */
 interface PullRequest {
   id: string;
@@ -678,7 +678,7 @@ interface PullRequest {
 }
 type PullHook = (request: PullRequest) => Promise<unknown>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/refresh.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/store/refresh.d.ts
 /** What the injected provider refresh function returns. */
 interface ProviderRefreshResult {
   access: string;
@@ -741,7 +741,7 @@ type RefreshOutcome = {
   reason: string;
 };
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/settings.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/store/settings.d.ts
 /** The plugin's settings: every top-level config key except the pool-owned ones. */
 type PoolSettings = Record<string, unknown>;
 type SettingsRead = {
@@ -785,7 +785,7 @@ type UpdateSettingsResult = {
   outcome: 'updated' | 'unchanged';
 };
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/pool.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/store/pool.d.ts
 interface OpenPoolStoreOptions {
   /** The provider every row of this pool belongs to; keys the provider-wide lock. */
   provider: string;
@@ -971,13 +971,13 @@ interface PoolStore {
   pullsSettled(): Promise<void>;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/commands/seam.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/commands/seam.d.ts
 /** Where a dropped field is reported. Names only, never values. */
 interface SeamLogger {
   warn(message: string, data?: unknown): void;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/commands/builtins.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/commands/builtins.d.ts
 /**
  * What a plugin's login hands back. `ready` adds the account now. `pending`
  * means the user must finish somewhere else (a browser, a device code):
@@ -1097,17 +1097,92 @@ interface BeginAccountLoginResult {
  */
 declare function beginAccountLogin(opts: BeginAccountLoginOptions): Promise<BeginAccountLoginResult>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/insula.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/claustrum/watch.d.ts
+/**
+ * How a host currently learns about changes, for logs and status displays.
+ * `watching`: a watch was accepted and is open, so polling is reduced to a
+ * slow safety read. `polling`: no watch is open yet (not started, opening, or
+ * re-subscribing after a close), so the host polls at its usual interval.
+ * `fallback`: the watch is unavailable (an older module or client, a refusal,
+ * the watch limit, or repeated failures), so the host polls at its usual
+ * interval and may try a watch again later. Never carries secrets.
+ */
+type WatchMode = 'watching' | 'polling' | 'fallback';
+/**
+ * The fields every change notice carries, from the vault's watchScoped and
+ * insula's usage.watch alike.
+ */
+interface ChangeNotice {
+  readonly kind: string;
+  readonly epoch: string;
+  readonly seq: number;
+}
+/** A vault watch notice: `view` is the same digest `list_scoped` returns. */
+interface ScopedWatchNoticeShape extends ChangeNotice {
+  readonly view: string;
+}
+/**
+ * How a vault watch ended, as claustrum-client 0.12.0 reports it. `refused`
+ * and `not_accepting` both mean the watch closed before its first notice; the
+ * client then made one `list_scoped` read to learn why, and `refused` carries
+ * that read's refusal.
+ */
+type ScopedWatchEnd = {
+  readonly kind: 'refused';
+  readonly error: unknown;
+} | {
+  readonly kind: 'transport_lost';
+  readonly error: unknown;
+} | {
+  readonly kind: 'ended' | 'not_accepting' | 'unsupported' | 'stopped';
+};
+interface ScopedWatchHandle {
+  stop(): void;
+  readonly closed: Promise<ScopedWatchEnd>;
+}
+/**
+ * The part of a vault client that can watch. claustrum-client added
+ * `watchScoped` in 0.12.0; the peer range still admits 0.6.2, so it is
+ * optional and detected at run time.
+ */
+interface ScopedWatchSource {
+  watchScoped?(onNotice: (notice: ScopedWatchNoticeShape) => void, options?: {
+    enrollmentToken?: string;
+  }): ScopedWatchHandle;
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/claustrum/insula.d.ts
+/**
+ * A held-open `usage.watch` stream. `closed` resolves when insula ends the
+ * stream (STREAM_END at shutdown, or a reply that ends it) or after `stop()`,
+ * and rejects with insula's refusal (an error with a `code`, such as
+ * `unknown_method` from an insula that predates the method, or
+ * `usage_watch_limit` when 64 watches are already open) or with the
+ * transport failure.
+ */
+interface InsulaUsageWatch {
+  stop(): void;
+  readonly closed: Promise<void>;
+}
 /** Optional transport for custom scoped clients; getUsage must not retry refusals. */
 interface InsulaUsageTransport {
   connectionFile: string;
   getUsage(): Promise<unknown>;
+  /**
+   * Open a `usage.watch` stream, passing each notice's raw JSON body to
+   * `onNotice`. Optional: a transport without it is polled as before.
+   */
+  watchUsage?(onNotice: (body: Uint8Array) => void): InsulaUsageWatch;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/custody.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/claustrum/custody.d.ts
+/**
+ * `watchScoped` is present from claustrum-client 0.12.0. Hosts detect it at
+ * run time and keep polling without it.
+ */
 type ClaustrumScopedClient = Pick<ClaustrumClient, 'listScoped' | 'getScoped' | 'reportAuthFailureScoped' | 'close'> & {
   insula?: InsulaUsageTransport;
-};
+} & ScopedWatchSource;
 /** The two credential types a plugin's family can hold; routing differs by type. */
 type VaultCredentialType = 'oauth' | 'api_key';
 /**
@@ -1124,6 +1199,30 @@ interface SkippedVaultRecord {
   readonly credentialId?: string;
   readonly reason: SkippedVaultReason;
 }
+/**
+ * One grant this consumer's enrollment holds, as the vault's list reply names
+ * it: for example `{ selectorKind: 'category', selector: 'openai-native',
+ * operation: 'read' }`. `selectorKind` is `exact` (the selector is a credential
+ * id) or `category` (a bare category name); both open strings.
+ */
+interface VaultGrantTuple {
+  readonly selectorKind: string;
+  readonly selector: string;
+  readonly operation: string;
+}
+/**
+ * What this consumer is granted, independent of what those grants currently
+ * reach. It is what tells two empty listings apart: no rows with `grants === 0`
+ * means no grant at all (the fix is `ck auth grant`), while no rows with
+ * `grants > 0` means a grant that reaches no credential, usually logins that
+ * lack the category (`ck auth reclassify --from-registry`); `tuples` names the
+ * selector that matched nothing. Never written to the roster file.
+ */
+interface VaultGrantReach {
+  /** How many grants the consumer holds, deposit grants excluded. */
+  readonly grants: number;
+  readonly tuples: readonly VaultGrantTuple[];
+}
 /**
  * Where a receipt's `accountIdentity` came from: the vault asserted it in the
  * served reply, the plugin's `parseIdentity` read it from the served token, or
@@ -1168,9 +1267,20 @@ interface ClaustrumScopedAttempt {
   readonly accessToken: string;
   readonly recordVersion: number;
   readonly expiresAtMs: number | null;
+  /**
+   * True when this receipt was not freshly served but is the last token kept
+   * from an earlier read, used because the vault could not be reached. A 401
+   * with such a receipt must not be retried and is not reported to the vault,
+   * which is unreachable.
+   */
+  readonly fromKeptReceipt?: true;
+}
+interface KeptReceiptState {
+  readonly active: boolean;
+  readonly since: number | null;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.d.ts
 /**
  * The declined-account interlock: the user's "do not use this vault account",
  * kept on the consumer side because the vault has no notion of it.
@@ -1189,7 +1299,7 @@ interface DeclinedAccount {
   readonly accountIdentity?: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/roster.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/claustrum/roster.d.ts
 /**
  * One vault account as the pool sees it. It carries no bearer material: the
  * access token is fetched from the vault for every send. Several vault
@@ -1244,7 +1354,18 @@ interface VaultRosterFile {
  */
 type QuotaReceipt = Pick<ClaustrumScopedAttempt, 'credentialId' | 'accountIdentity' | 'accountIdentitySource' | 'expectedAccountIdentity'>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.18.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/claustrum/consumer.d.ts
+/**
+ * How a started consumer learns about changes, for logs and status displays.
+ * `insula` is present when the consumer was given an insula source. Never
+ * carries secrets.
+ */
+interface ClaustrumWatchState {
+  readonly vault: WatchMode;
+  readonly insula?: WatchMode;
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.21.0+ceea0b545671e3e4/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.d.ts
 interface ClaustrumEnrollmentClient {
   enrollPropose(input: {
     name: string;
@@ -1345,6 +1466,12 @@ interface OpenAiVaultOptions {
   pollIntervalMs?: number;
   fetchImpl?: () => typeof fetch;
   now?: () => number;
+  /**
+   * Replace the timers behind the background poll, the vault and insula
+   * watches' retries and the outage probe (tests).
+   */
+  setTimeoutImpl?: typeof setTimeout;
+  clearTimeoutImpl?: typeof clearTimeout;
 }
 /** One host's view of its OpenAI accounts in the vault. */
 declare class OpenAiVault {
@@ -1363,9 +1490,13 @@ declare class OpenAiVault {
    */
   enrolled(): boolean;
   /**
-   * Polls enrollment files and the vault's accounts. With local authority the
-   * consumer sends no vault request. A new enrollment completed by another
-   * process is detected on the next poll.
+   * Starts the consumer's background poll and its vault and insula watches.
+   * With local authority the consumer sends no vault request. A new
+   * enrollment completed by another process is detected on the next poll.
+   * While the vault watch is open the poll lists the vault only every five
+   * minutes, and a notice that the visible accounts changed starts a
+   * discovery at once; without a watch (an older vault or client, or a
+   * refusal) every poll lists the vault as before.
    */
   start(): void;
   /**
@@ -1390,6 +1521,22 @@ declare class OpenAiVault {
    */
   refresh(): Promise<VaultRosterFile | undefined>;
   snapshot(): VaultRosterFile | undefined;
+  /**
+   * Whether the consumer learns about vault and insula changes from a watch
+   * or by polling, without any I/O.
+   */
+  watchState(): ClaustrumWatchState;
+  /**
+   * Whether any account is being served the last token the vault gave it
+   * because the vault cannot be reached, without any I/O.
+   */
+  keptReceiptState(): KeptReceiptState;
+  /**
+   * What the vault says this host is granted, from the latest list, without
+   * any I/O. Undefined is unknown (a vault that does not report grants, or
+   * nothing listed yet), never zero grants.
+   */
+  grantReach(): VaultGrantReach | undefined;
   /** Whether the vault serves this host any account (whatever its state). */
   serves(): boolean;
   /**
@@ -1666,6 +1813,8 @@ interface LegacyLockOptions {
 interface PoolMigrationDeps {
   paths: AccountPaths;
   slot: HostSlotAdapter;
+  /** Stop waiting for transfer locks; a transfer already holding them finishes. */
+  signal?: AbortSignal;
   now?: () => number;
   sleep?: (ms: number) => Promise<void>;
   /** Id for a new row whose login carries no usable wire identity. */