@cortexkit/opencode-openai-auth 1.4.0 → 1.6.0

package/dist/v2/server.js

@@ -1,3 +1,3 @@
-import{c as pZ}from"../index-1tdnrt68.js";import{$ as t$,A as U$,B as H$,C as fZ,D as vZ,E as W1,F as hZ,G as mZ,H as J$,I as HZ,J as NZ,K as gZ,L as lZ,M as w$,N as y$,O as S2,P as z$,S as a$,T as n$,aa as e$,d as C$,e as qZ,ea as uZ,f as B2,g as W2,h as b2,i as yZ,j as IZ,k as I2,ka as R1,l as Q2,la as A1,n as E1,o as O1,oa as cZ,p as _1,q as R2,r as T$,s as _$,t as M$,u as k$,v as b$,w as D$,x as c$,y as d$,z as D2}from"../index-jcyrm58f.js";import{Qa as h$,Xa as JZ,fb as f2,gb as AZ,hb as xZ,ib as SZ,kb as kZ,lb as m$,ub as bZ,va as RZ,vb as DZ,wb as wZ,xb as g$,ya as c1,za as d1}from"../index-vy729a0b.js";import{Nb as jZ,ac as VZ,bc as BZ,dc as WZ,hc as UZ}from"../index-1eq2s1cp.js";import{$d as K2,Fd as z2,Kd as u1,Md as W$,Nd as p1,Td as y2,Vc as q2,Wc as k2,Xc as EZ,_d as s$,ae as i1,be as a1,cd as B1,ce as n1,dd as h1,ed as m1,ee as o1,fd as g1,fe as r1,he as s1,ie as t1,je as e1,ke as $$,le as Z$,md as f$,sd as v$,ud as OZ,vd as r$,wd as l1,xc as v1}from"../index-brbqqer5.js";import{re as L$}from"../index-ag04nyv7.js";import{Ae as S$}from"../index-rsvnabbe.js";import"../index-yhw3hnsh.js";import{Ke as MZ,Me as G2}from"../index-wgwze391.js";import"../index-5230x6s8.js";import{gf as q$}from"../index-t5m0dhmq.js";import{kf as v2,lf as _Z}from"../index-d98f1xdp.js";import{AsyncLocalStorage as c0}from"node:async_hooks";import{randomUUID as d0}from"node:crypto";class o extends Error{kind;providerID;sessionID;requestKind;constructor($){super($.message??`${$.providerID} ${$.requestKind} request refused (${$.kind})`);this.name="OpenCode2AuthError",this.kind=$.kind,this.providerID=$.providerID,this.sessionID=$.sessionID,this.requestKind=$.requestKind}}function $2($){return`common-auth-placeholder.${$}`}function K1($){let Z=$2($.integrationID);return{type:"oauth",methodID:$.methodID,access:Z,refresh:Z,expires:$.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function N2($,Z){if($?.type!=="oauth")return!1;let J=Z===void 0?void 0:$2(Z),z=(X)=>J===void 0?X.startsWith("common-auth-placeholder."):X===J;return z($.access)&&z($.refresh)}var L1="No browser sign-in: this connects the plugin to the accounts in its vault.";async function p2($,Z){let J=Z.now??Date.now,{integrationID:z}=Z,X=(H)=>K1({integrationID:z,methodID:H,now:J()}),Y=async(H,W)=>{return await Z.onLogin(H,{integrationID:z,methodID:W}),X(W)},N=(H)=>async(W)=>{let B=H.method.id,V=await H.authorize(W),K={url:V.url,instructions:V.instructions,...V.expiresAt===void 0?{}:{expiresAt:V.expiresAt}};if(V.mode==="auto")return{...K,mode:"auto",callback:V.callback.then((_)=>Y(_,B))};let x=V.callback;return{...K,mode:"code",callback:async(_)=>Y(await x(_),B)}};return $.integration.transform((H)=>{let W=Z.label===void 0?{}:{label:()=>Z.label};for(let K of Z.methods)H.method.update({integrationID:z,method:K.method,authorize:N(K),refresh:async(x)=>{if(!N2(x,z))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return X(x.methodID)},...W});let B=Z.vault;if(B===void 0)return;let V=B.method.id;H.method.update({integrationID:z,method:B.method,authorize:async()=>({url:"",instructions:B.instructions??L1,mode:"auto",callback:Promise.resolve().then(()=>B.activate({integrationID:z,methodID:V})).then(()=>X(V))}),refresh:async(K)=>{if(!N2(K,z)||K.methodID!==V)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return X(V)},...W})})}function dZ($){let Z=[],J;for(let z of $.split(/\r?\n/))if(z.startsWith("data:"))Z.push(z.slice(5).replace(/^ /,""));else if(z.startsWith("event:"))J=z.slice(6).trim();if(Z.length===0)return;return J===void 0?{data:Z.join(`
+import{c as sZ}from"../index-79y7w9bz.js";import{A as u2,B as _$,C as M$,D as cZ,E as dZ,F as C1,G as iZ,H as aZ,I as B$,J as MZ,K as CZ,L as nZ,M as oZ,N as l$,O as u$,P as v2,Q as U$,T as ZZ,U as JZ,aa as QZ,ba as jZ,d as S$,e as vZ,f as GZ,fa as rZ,g as n2,h as C2,i as l2,j as uZ,k as pZ,l as d2,la as f1,m as P2,ma as I1,o as w1,p as y1,pa as tZ,q as D1,r as y2,s as x$,t as q$,u as b$,v as h$,w as m$,x as g$,y as t$,z as e$}from"../index-agaatt62.js";import{Aa as $$,Ra as i$,Ya as g2,gb as i2,hb as yZ,ib as fZ,jb as IZ,lb as hZ,mb as a$,vb as mZ,wa as wZ,wb as gZ,xb as lZ,yb as n$,za as e1}from"../index-k5anexvs.js";import{Ob as KZ,bc as LZ,cc as PZ,ec as TZ,ic as _Z}from"../index-1qxz4s8a.js";import{Hd as B2,Md as s1,Od as T$,Pd as t1,Vd as c2,Wc as h2,Xc as m2,Yc as DZ,ae as YZ,be as S2,ce as Z$,dd as M1,de as J$,ed as a1,ee as z$,fd as n1,gd as o1,ge as G$,he as X$,je as Y$,ke as Q$,le as V1,me as j$,ne as V$,od as c$,ud as d$,wd as kZ,xd as XZ,yc as i1,yd as r1}from"../index-ge60xry3.js";import{te as R$}from"../index-8xq099qf.js";import{Ce as I$}from"../index-z8bptbrk.js";import"../index-rf0ht3gc.js";import{Me as bZ,Oe as N2}from"../index-b0ty9qam.js";import"../index-7nmdsmpp.js";import{if as v$}from"../index-x9nffaye.js";import{mf as a2,nf as qZ}from"../index-ya9c5e4m.js";import{AsyncLocalStorage as $4}from"node:async_hooks";import{randomUUID as Z4}from"node:crypto";class J2 extends Error{kind;providerID;sessionID;requestKind;constructor($){super($.message??`${$.providerID} ${$.requestKind} request refused (${$.kind})`);this.name="OpenCode2AuthError",this.kind=$.kind,this.providerID=$.providerID,this.sessionID=$.sessionID,this.requestKind=$.requestKind}}function Q2($){return`common-auth-placeholder.${$}`}function S1($){let Z=Q2($.integrationID);return{type:"oauth",methodID:$.methodID,access:Z,refresh:Z,expires:$.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function O2($,Z){if($?.type!=="oauth")return!1;let J=Z===void 0?void 0:Q2(Z),z=(X)=>J===void 0?X.startsWith("common-auth-placeholder."):X===J;return z($.access)&&z($.refresh)}var x1="No browser sign-in: this connects the plugin to the accounts in its vault.";async function t2($,Z){let J=Z.now??Date.now,{integrationID:z}=Z,X=(N)=>S1({integrationID:z,methodID:N,now:J()}),Y=async(N,U)=>{return await Z.onLogin(N,{integrationID:z,methodID:U}),X(U)},F=(N)=>async(U)=>{let j=N.method.id,B=await N.authorize(U),L={url:B.url,instructions:B.instructions,...B.expiresAt===void 0?{}:{expiresAt:B.expiresAt}};if(B.mode==="auto")return{...L,mode:"auto",callback:B.callback.then((_)=>Y(_,j))};let S=B.callback;return{...L,mode:"code",callback:async(_)=>Y(await S(_),j)}};return $.integration.transform((N)=>{let U=Z.label===void 0?{}:{label:()=>Z.label};for(let L of Z.methods)N.method.update({integrationID:z,method:L.method,authorize:F(L),refresh:async(S)=>{if(!O2(S,z))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return X(S.methodID)},...U});let j=Z.vault;if(j===void 0)return;let B=j.method.id;N.method.update({integrationID:z,method:j.method,authorize:async()=>({url:"",instructions:j.instructions??x1,mode:"auto",callback:Promise.resolve().then(()=>j.activate({integrationID:z,methodID:B})).then(()=>X(B))}),refresh:async(L)=>{if(!O2(L,z)||L.methodID!==B)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return X(B)},...U})})}function Z0($){let Z=[],J;for(let z of $.split(/\r?\n/))if(z.startsWith("data:"))Z.push(z.slice(5).replace(/^ /,""));else if(z.startsWith("event:"))J=z.slice(6).trim();if(Z.length===0)return;return J===void 0?{data:Z.join(`
 `)}:{event:J,data:Z.join(`
-`)}}function c2($,Z){let J=new TextDecoder,z="",X=(N)=>{let H=dZ(N);if(!H)return;try{$(H)}catch(W){Z(W)}},Y=()=>{for(;;){let N=/\r?\n\r?\n/.exec(z);if(!N)return;let H=z.slice(0,N.index);z=z.slice(N.index+N[0].length),X(H)}};return new TransformStream({transform(N,H){H.enqueue(N),z+=J.decode(N,{stream:!0}),Y()},flush(){if(z+=J.decode(),Y(),z.trim()!=="")X(z);z=""}})}var C1=512,V2="x-common-auth-attempt",Y2=($,Z)=>JSON.stringify([$,Z]),Z2=($)=>({providerID:$.model.providerID,modelID:$.model.id,sessionID:$.sessionID,agent:$.agent,kind:$.kind});function iZ($){let Z=$.headers;return typeof Z==="object"&&Z!==null}function aZ($,Z){let J=$.getReader();return new ReadableStream({async pull(z){let X;try{X=await J.read()}catch(Y){Z({reason:"failed",message:Y instanceof Error?Y.message:String(Y)}),z.error(Y);return}if(X.done)Z(),z.close();else z.enqueue(X.value)},async cancel(z){Z({reason:"cancelled",...z===void 0?{}:{message:String(z)}}),await J.cancel(z)}})}function d2($,Z){for(let[J,z]of Object.entries(Z)){let X=J.toLowerCase();for(let Y of Object.keys($))if(Y.toLowerCase()===X)delete $[Y];if(z!==null)$[J]=z}}function nZ($,Z){for(let[J,z]of Object.entries(Z))if(z===null)$.delete(J);else $.set(J,z)}async function i2($,Z,J={}){let{providerID:z}=Z,X=J.gateOnPlaceholder,Y=(G)=>X===void 0||X.credential(G)===$2(z),N=J.logger,H=Math.max(1,J.maxRecords??C1),W=[...J.hostCredentials??[$2(z)],...X?[$2(z)]:[]].filter((G)=>G!==""),B=new Map,V=new WeakMap,K=new Map,x=new Set,_=new Map,h=!1,d=!1,S=new Map,y=0,n=!1,I=new Map,f=(G,Q)=>{try{N?.warn(G,Q)}catch{}},j=(G)=>G instanceof Error?G.message:String(G),T=async(G,Q)=>{let U=S.get(G);if(!U||U.size===0)return;await Promise.all([...U].map(async(F)=>{try{await F(Q)}catch(q){f("opencode2 auth listener threw; the request is unaffected",{event:G,error:j(q)})}}))},E=async(G,Q)=>{try{await Z.onAttemptEnd?.(G,Q)}catch(U){f("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:G.attemptId,error:j(U)})}},M=(G,Q)=>{if(G.ended||!G.attempt)return;let U={...G.status===void 0?{}:{status:G.status},outputStarted:G.outputStarted,...G.limit?{limit:G.limit.signal}:{},...Q?{error:Q}:{}};if(Q)G.endError=Q;G.ended=E(G.attempt,U)},P=(G,Q)=>M(G,{reason:"abandoned",message:Q}),L=(G)=>[...B.values()].filter((Q)=>Q.key===G),O=(G)=>L(G).at(-1),A=(G)=>{if(B.delete(G.id),!L(G.key).length)K.delete(G.key)},w=(G)=>{B.set(G.id,G);while(B.size>H){let Q=B.values().next().value;if(Q===void 0)break;P(Q,"dropped to keep the record bound"),A(Q)}},p=(G)=>G.accountId===void 0?void 0:{...G.scope,accountId:G.accountId},a=(G,Q)=>new o({kind:"no-account",providerID:z,sessionID:G.sessionID,requestKind:G.kind,...Q===void 0?{}:{message:Q}}),l=(G)=>{I.get(G)?.clear(),I.delete(G)},i=async(G,Q)=>{let U=()=>a(G,`${z} ${G.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(n)throw U();let F=I.get(G.sessionID);if(!F)F=new Set,I.set(G.sessionID,F);let q={};F.add(q);let D=()=>{if(!F.has(q))throw U()};try{return await Q(D)}finally{if(F.delete(q),F.size===0&&I.get(G.sessionID)===F)I.delete(G.sessionID)}},c=(G,Q)=>{for(let[U,F]of Q)if(W.some((q)=>F.includes(q)))throw new o({kind:"host-credential-on-wire",providerID:z,sessionID:G.sessionID,requestKind:G.kind,message:`${z} ${G.kind} request still carries the host's placeholder credential in ${U}; the adapter's account headers must replace it`})},k=(G)=>{for(let Q of L(G))if(Q.ended||!Q.attempt)A(Q);else if(Q.transport==="ws"||Q.judged)P(Q,"a newer attempt of its session and kind began"),A(Q)},g=async(G,Q,U,F)=>{let q=Y2(G.sessionID,G.kind),D=K.get(q);K.delete(q);let R=D?.accountId??O(q)?.accountId;k(q);let b={...G,...R===void 0?{}:{previousAccountId:R},...D?.rerouteFrom===void 0?{}:{rerouteFrom:D.rerouteFrom}},m=await Z.chooseAccount(b);U();let e={},F1;if(m!==void 0){let E2=await Z.accountHeaders({...G,accountId:m});if(U(),iZ(E2))e=E2.headers,F1=E2.attempt;else e=E2}let P1=`attempt-${++y}`,H2={id:P1,key:q,scope:G,accountId:m,headers:e,attempt:m===void 0?void 0:{...G,accountId:m,attemptId:P1,transport:F,data:F1},...F===void 0?{}:{transport:F},outputStarted:!1};if(w(H2),H2.attempt)T("select",{...G,accountId:H2.attempt.accountId,hook:Q,...b.previousAccountId===void 0?{}:{previousAccountId:b.previousAccountId},...b.rerouteFrom===void 0?{}:{rerouteFrom:b.rerouteFrom},handle:H2.attempt});return H2},u=async(G,Q,U,F,q)=>{let D=Y2(G.sessionID,G.kind),R=F===void 0?void 0:B.get(F);if(R?.key!==D)R=void 0;if(!R){if(R=O(D),L(D).filter((m)=>m.transport===void 0&&!m.ended).length>1&&!d)d=!0,f("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:G.sessionID,kind:G.kind})}if(!R||R.transport!==void 0||R.ended)R=await g(G,Q,q,U);else if(R.transport=U,R.attempt)R.attempt.transport=U;if(U==="ws"){for(let b of L(D))if(b!==R&&b.transport==="ws")P(b,"a newer attempt of its session and kind went out over WebSocket")}return R},s=async(G,Q)=>{try{return await Q()}catch(U){throw M(G,{reason:"failed",message:j(U)}),U}},M2=(G,Q)=>{let U=L(Y2(G,Q)).filter((F)=>F.transport==="ws").at(-1);return U?.attempt!==void 0&&!U.ended?U:void 0},U2=(G,Q,U)=>{let F=p(G);if(!F||!G.attempt||G.limit)return;G.limit={signal:Q,delivered:T("limit",{...F,via:U,limit:Q,outputStarted:G.outputStarted,handle:G.attempt})}},j2=(G,Q,U,F)=>{let q=p(G);if(!q||!G.attempt)return;T("quota",{...q,transport:Q,...F===void 0?{}:{status:F},quota:U,handle:G.attempt})},X2=(G,Q,U,F)=>{let q=G.attempt;if(!q)return;let D=Z.inspectEvent?.(F===void 0?{transport:Q,data:U,attempt:q}:{transport:Q,data:U,event:F,attempt:q});if(!D)return;if(D.quota!==void 0)j2(G,Q,D.quota);if(D.outputStarted)G.outputStarted=!0;if(D.limit)U2(G,D.limit,Q);if(D.error!==void 0)M(G,{reason:"failed",message:D.error});else if(D.done)M(G)},m2=(G,Q)=>{let U=G.attempt;if(!U||Q.accountId===G.accountId)return;if(U.reboundFrom??=U.accountId,U.accountId=Q.accountId,"data"in Q)U.data=Q.data;G.accountId=Q.accountId},g2=(G)=>!G.attempt||G.endError!==void 0||G.status!==void 0&&G.status>=400,l2=(G)=>{let Q=[...B.values()].filter((b)=>b.scope.sessionID===G),U=Q.filter((b)=>b.limit&&!b.rerouted).at(-1);if(U)return U;let F=Q.filter((b)=>b.scope.kind==="primary"),q=F.length>0?F:Q;if(q.length<=1)return q[0];let D=q.filter((b)=>!b.judged&&g2(b)).at(-1);if(D)return D;let R=q.filter((b)=>b.attempt&&!b.ended);if(R.length>1)return"ambiguous";return R[0]??q.at(-1)},C={providerID:z},v=[];v.push(await $.session.hook("model.request",(G)=>{if(X)return;return i(Z2(G),async(Q)=>{let U=await g(Z2(G),"model.request",Q);if(Q(),U.accountId===void 0)throw a(U.scope);d2(G.headers,{...U.headers,[V2]:U.id})})},C)),v.push(await $.session.hook("http.request",(G)=>{if(X){let Q=Y(G.request.headers);if(_.set(G.sessionID,Q),!Q)return}return i(Z2(G),async(Q)=>{let U=G.request.headers.get(V2)??void 0,F=X?await g(Z2(G),"http.request",Q,"http"):await u(Z2(G),"http.request","http",U,Q);Q();let q=p(F),D=F.attempt;if(!q||!D)throw a(F.scope);await s(F,async()=>{let R=G.request;if(Z.rewriteRequest){if(U!==void 0){let e=new Headers(R.headers);e.delete(V2),R=new Request(R,{headers:e})}R=await Z.rewriteRequest({...q,request:R,attempt:D})??R,Q()}let b=new Headers(R.headers);b.delete(V2),nZ(b,F.headers),c(F.scope,b.entries());let m=new Request(R,{headers:b});V.set(m,F),G.request=m})})},C)),v.push(await $.session.hook("http.response",async(G)=>{let Q=V.get(G.request);if(!Q){if(X)return;if(!h)h=!0,f("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:G.sessionID,kind:G.kind});return}let U=G.response;if(Z.answeredBy&&Q.attempt){let b=Q.attempt,m=await s(Q,async()=>Z.answeredBy?.({request:G.request,response:U,attempt:b}));if(m)m2(Q,m)}let F=p(Q),q=Q.attempt;if(!F||!q)return;Q.status=U.status;let D=Z.quotaFromHeaders?.(U.headers,U.status,q);if(D!==void 0)j2(Q,"http",D,U.status);if(!U.ok&&Z.limitFromResponse){let b=await Z.limitFromResponse({status:U.status,headers:U.headers,body:()=>U.clone().text(),attempt:q});if(b)U2(Q,b,"http")}if(!U.ok||!U.body)M(Q);let R=U;if(U.body&&(Z.inspectEvent||Z.onAttemptEnd)){let b=U.body;if(Z.inspectEvent)b=b.pipeThrough(c2((m)=>X2(Q,"http",m.data,m.event),(m)=>f("opencode2 auth event inspection threw",{error:j(m)})));R=new Response(aZ(b,(m)=>M(Q,m)),{status:U.status,statusText:U.statusText,headers:U.headers})}if(Z.rewriteResponse)R=await Z.rewriteResponse({...F,request:G.request,response:R,attempt:q})??R;if(R!==U)G.response=R},C)),v.push(await $.session.hook("experimental.ws.handshake",(G)=>{if(X){let Q=Y(new Headers(G.headers)),U=Y2(G.sessionID,G.kind);if(_.set(G.sessionID,Q),x.delete(U),!Q)return}return i(Z2(G),async(Q)=>{let U;for(let R of Object.keys(G.headers)){if(R.toLowerCase()!==V2)continue;U??=G.headers[R],delete G.headers[R]}let F=X?await g(Z2(G),"experimental.ws.handshake",Q,"ws"):await u(Z2(G),"experimental.ws.handshake","ws",U,Q);Q();let q=p(F),D=F.attempt;if(!q||!D)throw a(F.scope);await s(F,async()=>{d2(G.headers,F.headers);let R=Z.rewriteHandshakeURL?.({...q,url:G.url,attempt:D});if(R!==void 0)G.url=R;if(c(F.scope,Object.entries(G.headers)),X)x.add(F.key)})})},C));let t=Z.rewriteWebSocketFrame?.bind(Z);if(t)v.push(await $.session.hook("experimental.ws.send",async(G)=>{let Q=Z2(G);if(X&&!x.has(Y2(Q.sessionID,Q.kind)))return;let U=M2(Q.sessionID,Q.kind),F=await t({...Q,attempt:U?.attempt,frame:G.frame});if(F!==void 0)G.frame=F},C));v.push(await $.session.hook("experimental.ws.receive",(G)=>{if(X&&!x.has(Y2(G.sessionID,G.kind)))return;let Q=M2(G.sessionID,G.kind);if(!Q)return;try{X2(Q,"ws",G.frame)}catch(U){f("opencode2 auth frame inspection threw",{error:j(U)})}},C)),v.push(await $.session.hook("retry",async(G)=>{if(X&&_.get(G.sessionID)!==!0)return;let Q=l2(G.sessionID);if(!Q)return;let U=G.decision;if(Q==="ambiguous"){await T("retry",{sessionID:G.sessionID,attempt:G.attempt,reason:"host-decides",hostDecision:U,decision:U});return}let F=Q;await i(F.scope,async(q)=>{F.judged=!0;let D=U,R,b,m=F.attempt;if(F.accountId===void 0||!m)D={retry:!1},R="no-account";else if(F.outputStarted)D={retry:!1},R="output-started";else{if(!F.limit){let e=Z.limitFromError?.(G.error,m);if(e)U2(F,e,"error")}if(F.ended)await F.ended,q();if(F.limit)await F.limit.delivered,q(),F.rerouted=!0,b={accountId:F.accountId,limit:F.limit.signal},D={retry:!0,delay:0},R="reroute";else R="host-decides"}if(G.decision=D,D.retry&&F.accountId!==void 0)K.set(F.key,{sessionID:F.scope.sessionID,accountId:F.accountId,...b===void 0?{}:{rerouteFrom:b}});await T("retry",{sessionID:G.sessionID,...F.accountId===void 0?{}:{accountId:F.accountId},kind:F.scope.kind,attempt:G.attempt,reason:R,hostDecision:U,decision:D,...m===void 0?{}:{handle:m}})})},C));let H1=(G)=>{l(G),_.delete(G);for(let Q of x)if(JSON.parse(Q)[0]===G)x.delete(Q);for(let Q of[...B.values()]){if(Q.scope.sessionID!==G)continue;P(Q,"its session was forgotten"),B.delete(Q.id)}for(let[Q,U]of K)if(U.sessionID===G)K.delete(Q)},u2=new AbortController,N1=$.event;if(N1)(async()=>{try{for await(let G of N1.subscribe({signal:u2.signal}))if(G.type==="session.deleted")H1(G.data.sessionID)}catch(G){if(!u2.signal.aborted)f("opencode2 auth stopped listening for session deletion",{error:j(G)})}})();return{on(G,Q){let U=S.get(G);if(!U)U=new Set,S.set(G,U);let F=Q;return U.add(F),()=>{U.delete(F)}},accountFor(G,Q){return O(Y2(G,Q))?.accountId},forgetSession:H1,get size(){return B.size},async dispose(){if(n)return;n=!0;for(let G of I.keys())l(G);u2.abort();for(let G of B.values())P(G,"the installation was disposed");B.clear(),K.clear(),x.clear(),_.clear(),S.clear(),await Promise.all(v.map(async(G)=>{try{await G.dispose()}catch(Q){f("opencode2 auth hook did not dispose cleanly",{error:j(Q)})}}))}}}import{createHash as oZ}from"node:crypto";var rZ=1024,sZ=($)=>typeof $==="object"&&$!==null&&!Array.isArray($),T1=($)=>_1($,"user"),tZ=($)=>sZ($)&&($.role==="assistant"||typeof $.type==="string"&&$.type!=="message"&&$.type!=="configuration_update");function eZ($){return oZ("sha256").update(JSON.stringify($)).digest("hex")}class F2{runtime;maxSessions;#$=new Map;constructor($,Z=rZ){this.runtime=$;this.maxSessions=Z}advance($,Z,J=this.runtime){let z=this.#$.get($),X=Array.isArray(Z.input)?Z.input:[],Y=X.filter(T1),N=X.findLastIndex(T1),H=N<0?void 0:eZ(X[N]),W=typeof Z.previous_response_id==="string"&&Z.previous_response_id.length>0,B,V,K;if(W)B=Y.length>0,V=H??z?.fingerprint,K=z?.userCount===void 0?void 0:z.userCount+Y.length;else{V=H,K=Y.length;let _=N>=0&&N>X.findLastIndex(tZ),h=z!==void 0&&!z.completed&&z.fingerprint===V&&z.userCount===K;B=_&&!h}let x=B||!z?{turnID:(J?.uuid??Q2)(),turnStartedAt:(J?.now??Date.now)()}:{turnID:z.turnID,turnStartedAt:z.turnStartedAt};return this.#Z($,{...x,completed:!1,fingerprint:V,userCount:K}),x}completed($){let Z=this.#$.get($);if(Z)this.#Z($,{...Z,completed:!0})}get($){return this.#$.get($)}forget($){this.#$.delete($)}#Z($,Z){this.#$.delete($),this.#$.set($,Z);while(this.#$.size>this.maxSessions){let J=this.#$.keys().next().value;if(J===void 0)break;this.#$.delete(J)}}}function a2($,Z){return{threadID:$.threadID,windowID:$.windowID,turnID:Z.turnID,turnStartedAt:Z.turnStartedAt}}var M1=Symbol.for("@cortexkit/openai-auth/opencode2/codex-installation");function $0(){let $=globalThis;return $[M1]??=crypto.randomUUID(),$[M1]}class P2{runtime;store;sessions;frameTurns;installationID;constructor($,Z,J){this.runtime=$;this.store=J;this.installationID=Z??$0(),this.sessions=J?.sessions??new Map,this.frameTurns=J?.frameTurns??new F2}get($){let Z=this.runtime?.uuid??Q2;if(this.store)return this.store.get($,Z);let J=this.sessions.get($);if(!J){let z=Z();J={threadID:z,turnID:Z(),windowID:`${z}:0`},this.sessions.set($,J)}return J}advanceFrame($,Z){return this.frameTurns.advance($,Z,this.runtime)}frameReceived($,Z){if(!Z.includes("response.completed"))return;if(O2(Z)?.type==="response.completed")this.frameTurns.completed($)}forget($){if(this.store)this.store.delete($);else this.sessions.delete($),this.frameTurns.forget($)}}var n2={version:E1,"user-agent":O1,originator:"codex_exec"};var Z0=1024,J0=/(?:^|\/)gpt-6-(?:astra|sol|luna)$/i,A2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($),x1=($)=>A2($)&&($.type==="message"||("role"in $))&&$.role==="user",S1=($)=>A2($)&&$.type==="configuration_update";class o2{http;#$=new Map;constructor($=new P2){this.http=$}apply($,Z,J){if(Z.kind!=="primary")return!1;let z=typeof $.model==="string"?$.model:"";if(!R1.has(z))return!1;if(J0.test(z))return!1;let X=A2($.reasoning)?$.reasoning:void 0,Y=typeof X?.effort==="string"?X.effort:void 0;if(!Y)return!1;let N=this.#$.get(Z.sessionID);if(N===void 0)return this.#Z(Z.sessionID,Y),!1;if(Y===N)return!1;let H=Array.isArray($.input)?$.input:void 0;if(!H||H.length===0)return!1;let W=H.findLastIndex(x1);if(W<0){if(J==="http")return!1;return $.reasoning={...X,effort:N},!0}if($.reasoning={...X,effort:N},!S1(H[W-1]))H.splice(W,0,{type:"configuration_update",reasoning:{effort:Y}});return!0}forget($){this.#$.delete($),this.http.forget($)}#Z($,Z){this.#$.set($,Z);while(this.#$.size>Z0){let J=this.#$.keys().next().value;if(J===void 0)break;this.#$.delete(J)}}}function O2($){try{let Z=JSON.parse($);return A2(Z)?Z:void 0}catch{return}}async function q1($,Z,J,z,X=J.http){if($.method.toUpperCase()!=="POST")return;if(!/\/responses\/?$/.test(new URL($.url).pathname))return;let Y=await $.clone().text(),N=O2(Y);if(N)delete N.max_output_tokens;let H=new Headers($.headers),W=R2({rewriteLite:A1,init:{body:N?JSON.stringify(N):$.body===null?void 0:Y},headers:H,metadata:X.get(Z.sessionID),installationID:X.installationID,runtime:X.runtime,websocket:!1,responsesLite:z,applyEffort:(B)=>{J.apply(B,Z,"http")}});return new Request($,{headers:H,body:W.init?.body})}function k1($,Z,J,z){let X=z.sessions.get($.sessionID),Y=z.frameTurns.get($.sessionID);if(!X||!Y)return;let N=a2(X,Y),H=new Headers({"content-type":"application/json"});for(let B of["chatgpt-account-id","x-opencode-parent-session-id","x-parent-session-id"]){let V=J.get(B);if(V!==null)H.set(B,V)}R2({init:{body:$.bodyText},headers:H,metadata:N,installationID:z.installationID,runtime:z.runtime,websocket:!1,skipTurnUpdate:!0,responsesLite:!1,rewriteLite:()=>{}});let W=new URL(Z);if(W.protocol==="wss:")W.protocol="https:";if(W.protocol==="ws:")W.protocol="http:";return new Request(W,{method:"POST",headers:H,body:$.bodyText})}function z0($,Z){if(JSON.stringify($)===JSON.stringify(Z))return!0;if(!Array.isArray($)||!Array.isArray(Z)||Z.length!==$.length+1)return!1;let J=Z.findIndex((z,X)=>JSON.stringify(z)!==JSON.stringify($[X]));return J>=0&&S1(Z[J])&&x1(Z[J+1])&&JSON.stringify(Z.slice(J+1))===JSON.stringify($.slice(J))}function b1($,Z,J){let z=O2($);if(z?.type!=="response.create")return;let X=J.http.advanceFrame(Z.sessionID,z),Y=J.http.get(Z.sessionID);delete z.max_output_tokens;let N=R2({rewriteLite:()=>{},init:{body:JSON.stringify(z)},headers:new Headers,metadata:a2(Y,X),installationID:J.http.installationID,runtime:J.http.runtime,websocket:!0,responsesLite:!1,applyEffort:(W)=>{J.apply(W,Z,"ws")}}),H=O2(String(N.init?.body));if(!H)return;if(!z0(z.input,H.input)){if("input"in z)H.input=z.input;else delete H.input;return JSON.stringify(H)}return String(N.init?.body)}function G0($){return $.replace(/\/responses\/?$/,"").replace(/\/$/,"")}function r2($,Z){let J=new URL($);if(J.origin!=="https://api.openai.com"&&J.origin!=="wss://api.openai.com"||!/\/responses\/?$/.test(J.pathname))return $;let z=new URL(`${G0(Z)}/responses`);if(z.search=J.search,J.protocol==="ws:"||J.protocol==="wss:")z.protocol=z.protocol==="https:"?"wss:":"ws:";return z.href}import{resolve as D1}from"node:path";var X0=1024;class x2{accounts=new Map;limit;constructor($=X0){this.limit=Math.max(1,$)}record($,Z){this.accounts.delete($),this.accounts.set($,Z);while(this.accounts.size>this.limit){let J=this.accounts.keys().next().value;if(J===void 0)break;this.accounts.delete(J)}}activeAccount($){return this.accounts.get($)}forget($){this.accounts.delete($)}get size(){return this.accounts.size}}var w1=Symbol.for("@cortexkit/openai-auth/opencode2-session-accounts"),y1=globalThis,s2=y1[w1]??new Map;y1[w1]=s2;function t2($){let Z=JSON.stringify([D1($.configPath),D1($.statePath)]),J=s2.get(Z);if(!J)J=new x2,s2.set(Z,J);return J}var r="openai",Y0=60000,I1=1,Q0="request refused: no account with a usable credential",J2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($);function j0($){let Z=J2($)?$.counters:void 0,J=J2(Z)?Z.resetCredits:void 0,z=J2(J)?J.value:void 0;return typeof z==="number"&&Number.isFinite(z)?z:void 0}function e2($){try{return JSON.parse($)}catch{return}}function f1($){let Z=q2($);return Z?k2(Z):void 0}var V0=new Set(["usage_limit_reached","rate_limit_exceeded"]);function $1($,Z,J){return{reason:$.window,...J!==void 0?{status:J}:{},...$.resetAt!==void 0?{retryAfterMs:Math.max(0,$.resetAt-Z)}:{}}}function B0($,Z){let J=S2($);if(J){let Y=typeof $.status==="number"?$.status:void 0;return $1(J,Z,Y)}if($.type!=="response.failed"||!J2($.response))return;let z=$.response.failed;if(J2(z)&&typeof z.rate_limit_reached_type==="string")return{reason:z.rate_limit_reached_type};let X=$.response.error;if(J2(X)){let Y=typeof X.code==="string"?X.code:typeof X.type==="string"?X.type:void 0;if(Y&&V0.has(Y))return{reason:Y}}return}function W0($,Z){let J=e2($);if(!J2(J))return;let z=typeof J.type==="string"?J.type:void 0;if(z==="codex.rate_limits")return{quota:{snapshot:g1(J),complete:!0}};let X=B0(J,Z);if(X)return{limit:X};if(z===void 0||z==="error")return;return z$(z)?void 0:{outputStarted:!0}}function U0($){let Z=!1;for(let J of $.keys())if(J.toLowerCase().startsWith("x-codex-")){Z=!0;break}if(!Z)return;return{snapshot:h1($),complete:m1($)}}function H0($){let Z=$.get("retry-after");if(Z===null)return;let J=Number(Z);return Number.isFinite(J)&&J>=0?J*1000:void 0}function G$($){let{source:Z,pins:J}=$,z=$.now??Date.now,X=$.log,Y=$.vault,N=new o2($.codex),H=new Map,W=(j)=>`${j.sessionID}\x00${j.kind}\x00${j.accountId}`,B=new Map,V=$.sessionAccounts??new x2,K=new s1,x=(j,T,E)=>{let M=E?[]:J$(Z.peek().rows,j,T,Y?.identities()??new Set),P=(Y?.routes()??[]).filter((L)=>L.kind==="oauth"&&u1(K2(L.quota),j,T));return[...M.map((L)=>({id:L.id,...L.identity!==void 0?{identity:L.identity}:{},quota:L.quota,row:L})),...P.map((L)=>({id:L.id,...L.identity!==void 0?{identity:L.identity}:{},quota:L.quota}))]},_=(j,T,E)=>{let M=n1(j,T,E),P=j.map((w)=>({id:w.id,kind:"oauth",...v1(w.quota)?{quota:w.quota}:{}})),L=j.flatMap((w)=>w.row?[w.row]:[]),O=new Set(j.filter((w)=>!w.row).map((w)=>w.id)),A=Z.rateLimitMarks(L);for(let w of O){let p=B.get(w);if(p===void 0)continue;if(p<=E)B.delete(w);else A.set(w,p)}return{rows:P,now:E,rateLimitMarks:A,refreshBackoff:Z.refreshBackoffFor(L),killswitch:M,requestPull:(w)=>O.has(w)?Y?.requestReading(w):Z.requestReading(w)}},h=(j,T,E,M,P)=>{let L=t1({...j,placement:o1(T),mainId:P});if(L.kind==="block"){X?.debug("pool admission refused the request",{reason:L.block.reason});return}let O=L.order.filter((A)=>!E.has(A));if(M!==void 0&&O.includes(M))return M;return O[0]},d=(j,T,E,M,P,L)=>{let O=new Map(T.map((k)=>[k.id,k.quota])),A={requestBytes:I1,reservePercent:(k)=>p1(E,k===i1?void 0:k),resetCredits:(k)=>j0(O.get(k))},w=e1(j),p=(k,g)=>J.place({sessionId:M,requestBytes:I1,validPinnedAccountIds:j.rows.map((u)=>u.id).filter((u)=>!w.excluded.has(u)),excludeAccountIds:k,quotaCheckedAtByAccount:Object.fromEntries(j.rows.map((u)=>[u.id,w.projections.get(u.id)?.checkedAt])),wireAccountIdByAccount:Object.fromEntries(T.map((u)=>[u.id,u.identity])),select:(u)=>$$(j,A,new Set(k),u),persist:g}),a=[...P],l=p(a,L);if(!l)return;let i=l.accountId,c=Z$(j,A,i);if(c.kind==="none")return;if(c.kind==="move"){let k=p([...a,i],L);if(k)return k.accountId;return c.reason==="killswitch"?void 0:i}if(c.kind==="detour")return p([...a,i],!1)?.accountId;return i},n={providerID:r,chooseAccount:async(j)=>{let T=await Y?.authority(),E=await $.storage(),M=T!==void 0&&T!=="local",P=()=>{throw new o({kind:"no-account",providerID:r,sessionID:j.sessionID,requestKind:j.kind,message:b2})};if(M)await $.awaitVaultRoster?.();else{if(!(await Z.current()).active){if(await $.slotPlaceholderWithoutMain?.())P();X?.warn("the account pool does not serve requests yet; refusing the request",{kind:j.kind});return}await Z.prepareTokens(Z.peek().rows,E)}let L=z(),O=x(E,L,M),A=r1(_(O.filter((g)=>g.id!==j.rerouteFrom?.accountId),E,L));if(A)await A,L=z(),O=x(E,L,M);let w=new Map(O.map((g)=>[g.id,g])),p=_(O,E,L),a=new Set(j.rerouteFrom?[j.rerouteFrom.accountId]:[]),l=E?.routing?.mode??"main-first",i=j.kind==="primary",c=new Set,k;for(;;){let g=new Set([...a,...c]);if(k=void 0,l==="sticky-balanced")k=d(p,O,E,j.sessionID,g,i&&c.size===0);if(k??=h(p,l,g,i?void 0:V.activeAccount(j.sessionID),M?l==="sticky-balanced"?null:a1(Y?.routes()??[]):void 0),k===void 0||c.has(k)){k=void 0;break}let u=w.get(k)?.row;if(u){if(Z.usableToken(u)!==void 0)break;X?.debug("pool row holds no usable token; choosing again",{accountId:k})}else{if(!Y)break;let s=await Y.authorize(k);if(s){H.set(W({...j,accountId:k}),s);break}X?.debug("the vault refused to serve an account; choosing again",{accountId:k})}c.add(k)}if(k===void 0&&!M&&O.length===0&&await $.slotPlaceholderWithoutMain?.())P();if(k===void 0&&M&&Y&&(O.length===0||c.size>0)){let g=c.size>0?"vault-refused":d1(Y);throw X?.warn("vault mode: no vault account can serve; refusing the request",{cause:g}),new o({kind:"no-account",providerID:r,sessionID:j.sessionID,requestKind:j.kind,message:c1(g,Y.name)})}if(k!==void 0&&i)V.record(j.sessionID,k),$.onRoute?.(j.sessionID,k,l);if(k!==void 0){let g=X?.info;K.served(p,k,X&&g?{info:(u,s)=>g.call(X,u,s)}:void 0)}return X?.debug("pool account chosen",{kind:j.kind,accountId:k,mode:l,...j.rerouteFrom?{rerouteFrom:j.rerouteFrom.accountId}:{}}),k},accountHeaders:async(j)=>{let{accountId:T}=j,E=()=>new o({kind:"no-account",providerID:r,sessionID:j.sessionID,requestKind:j.kind,message:Q0}),M=Y&&await Y.authority()!=="local"?void 0:Z.peek().rows.find((O)=>O.id===T);if(!M&&Y){let O=W(j),A=H.get(O)??await Y.authorize(T);if(H.delete(O),!A)throw X?.warn("the vault refused to serve an account; refusing the request",{accountId:T}),E();return{headers:{...n2,"session-id":j.sessionID,authorization:`Bearer ${A.accessToken}`,"chatgpt-account-id":A.accountIdentity??f1(A.accessToken)??null},attempt:{kind:"vault",routeId:T,receipt:A}}}let P=M?Z.usableToken(M):void 0;if(!M||!P)throw X?.warn("pool row holds no usable token; refusing the request",{accountId:T}),E();let L=M.identity??f1(P);return{headers:{...n2,"session-id":j.sessionID,authorization:`Bearer ${P}`,"chatgpt-account-id":L??null},attempt:{kind:"pool",token:P,credentialEpoch:M.credentialEpoch}}},async rewriteRequest({request:j,sessionID:T,kind:E}){let M=$.codexEndpoint?r2(j.url,$.codexEndpoint()):j.url,P=M===j.url?j:new Request(M,j);return await q1(P,{sessionID:T,kind:E},N,$.responsesLite?.()??!1)??P},rewriteHandshakeURL:({url:j})=>$.codexEndpoint?r2(j,$.codexEndpoint()):void 0,rewriteWebSocketFrame:({frame:j,sessionID:T,kind:E})=>b1(j,{sessionID:T,kind:E},N),quotaFromHeaders:(j)=>U0(j),async limitFromResponse({status:j,headers:T,body:E}){if(j<400)return;let M=e2(await E().catch(()=>"")),P=S2({...J2(M)?M:{},status:j});if(!P)return;let L=z(),O=$1(P,L,j);if(O.retryAfterMs!==void 0)return O;let A=H0(T);return A===void 0?O:{...O,retryAfterMs:A}},inspectEvent:({data:j})=>W0(j,z()),limitFromError(j){let T=e2(j.message),E=S2({...J2(T)?T:{},...j.status!==void 0?{status:j.status}:{}})??(j.message.includes("usage_limit_reached")?{window:"usage_limit_reached"}:void 0);return E?$1(E,z(),j.status):void 0},async onAttemptEnd(j,T){let E=j.data;if(E?.kind!=="vault"||T.status!==401)return;X?.warn("a vault account answered 401; reporting it to the vault",{accountId:j.accountId}),await Y?.reportFailure(E.receipt,401)}},I=(j,T,E)=>{let M=E.data;if(M?.kind==="vault"){Y?.recordSnapshot(j,T.snapshot,T.complete,M.receipt);return}if(M?.kind!=="pool")return;if(Z.peek().rows.find((L)=>L.id===j)?.credentialEpoch!==M.credentialEpoch){X?.debug("quota reading dropped: the row holds another credential",{accountId:j});return}Z.recordSnapshot(j,T.snapshot,M.token,T.complete)},f=(j,T,E)=>{let M=z(),P=E.data?.kind==="vault",L=P?Y?.routes().find((w)=>w.id===j)?.quota:Z.peek().rows.find((w)=>w.id===j)?.quota,O=l1(K2(L),T.reason,M,Y0,T.retryAfterMs!==void 0?M+T.retryAfterMs:void 0);if(!P){Z.markRateLimited(j,O);return}let A=B.get(j);if(A===void 0||A<O)B.set(j,O)};return{adapter:n,attach(j){j.on("quota",(T)=>I(T.accountId,T.quota,T.handle)),j.on("limit",(T)=>{f(T.accountId,T.limit,T.handle),X?.debug("pool row refused the request",{accountId:T.accountId,via:T.via,reason:T.limit.reason,outputStarted:T.outputStarted})})},forgetSession(j){J.forget(j),V.forget(j),N.forget(j)},activeAccount:(j)=>V.activeAccount(j)}}import{resolve as B$}from"node:path";import{Buffer as N0}from"node:buffer";import{resolve as X$}from"node:path";function L2($){return N0.byteLength(JSON.stringify($))}function F0($){return $.reduce((Z,J)=>Z+L2(J),0)}function Z1($,Z){return 2+$+Math.max(0,Z-1)}function P0($){let{head:Z,pending:J}=$;return 10+$.fieldsBytes+1+(Z?22+Z.responseIDBytes+9+Z1(Z.inputBytes,Z.input.length)+1:0)+(J?20+Z1(J.inputBytes,J.input.length)+10+Z1(J.outputBytes,J.output.length)+(J.responseID===void 0?0:14+J.responseIDBytes)+1:0)}function Y$($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z))return Z}catch{}return}class Q${enabled;caps=D2;entries=new Map;bytes=0;constructor($=!1){this.enabled=$}setEnabled($){if(this.enabled=$,!$)this.entries.clear(),this.bytes=0}send($,Z){if(!this.enabled)return;let J=Y$(Z);if(J?.type!=="response.create")return;if(!Array.isArray(J.input)){this.forget($);return}let z=J.previous_response_id,X=this.entries.get($),Y=X?.head;if(z&&z!==Y?.responseID){this.forget($);return}let{type:N,previous_response_id:H,input:W,...B}=J;this.keep($,{fields:z&&X?X.fields:B,fieldsBytes:z&&X?X.fieldsBytes:L2(B),...z&&Y?{head:Y}:{},pending:{input:W,inputBytes:F0(W),output:[],outputBytes:0,responseIDBytes:0},bytes:0})}receive($,Z,J){if(!this.enabled||!Z.includes("response.created")&&!Z.includes("response.output_item.done")&&!Z.includes("response.completed"))return;let z=this.entries.get($);if(!z?.pending)return;let X=Y$(Z);if(!X)return;let Y=z.pending,N=X.response;if(X.type==="response.created"&&typeof N?.id==="string")Y.responseID=N.id,Y.responseIDBytes=L2(N.id),this.keep($,z);else if(X.type==="response.output_item.done"&&X.item){if(typeof X.response_id==="string"&&Y.responseID!==void 0&&X.response_id!==Y.responseID)return;Y.output.push(X.item),Y.outputBytes+=L2(X.item),this.keep($,z)}else if(X.type==="response.completed"&&typeof N?.id==="string"){if(N.id===z.head?.responseID||Y.responseID!==void 0&&N.id!==Y.responseID)return;let H={responseID:N.id,responseIDBytes:Y.responseID===N.id?Y.responseIDBytes:L2(N.id),input:[...z.head?.input??[],...Y.input,...Y.output],inputBytes:(z.head?.inputBytes??0)+Y.inputBytes+Y.outputBytes},W={...z,head:H,pending:void 0};if(!this.keep($,W))return;J?.({sessionID:$,responseID:H.responseID,bodyText:this.body(z.fields,H)})}}replay($){let Z=this.entries.get($);if(!Z?.head)return;return this.entries.delete($),this.entries.set($,Z),this.body(Z.fields,Z.head)}forget($){let Z=this.entries.get($);if(Z)this.bytes-=Z.bytes;this.entries.delete($)}status(){return{bytes:this.bytes,sessions:[...this.entries].map(([$,Z])=>({sessionID:$,bytes:Z.bytes,responseID:Z.head?.responseID,pending:Z.pending!==void 0}))}}body($,Z){return JSON.stringify({...$,input:Z.input,stream:!0})}keep($,Z){let J=P0(Z);if(this.forget($),J>this.caps.maxBytes)return!1;Z.bytes=J,this.entries.set($,Z),this.bytes+=J;while(this.entries.size>this.caps.maxTargets||this.bytes>this.caps.maxBytes){let z=this.entries.keys().next().value;if(z===void 0)break;this.forget(z)}return this.entries.has($)}}var j$=Symbol.for("@cortexkit/openai-auth/opencode2-frame-mirror"),V$=globalThis,J1=V$[j$]??new Map;V$[j$]=J1;function w2($){let Z=JSON.stringify([X$($.configPath),X$($.statePath)]),J=J1.get(Z);if(!J)J=new Q$,J1.set(Z,J);return J}var K0=5000,L0=["accept","originator","session-id","thread-id","user-agent","version","x-client-request-id","x-codex-beta-features","x-codex-turn-metadata","x-codex-window-id","x-openai-internal-codex-responses-lite","x-opencode-parent-session-id","x-parent-session-id"],C0=["x-opencode-parent-session-id","x-parent-session-id"];function N$($){let Z=W$($);return{enabled:Z?.enabled===!0,subagents:Z?.subagents===!0,sustain:Z?.sustain===!0,window:U$($?{...$,cachekeep:Z}:$)}}var F$=Symbol.for("@cortexkit/openai-auth/opencode2-cache-keep"),P$=globalThis,C2=P$[F$]??new Map;P$[F$]=C2;function T0($,Z){let J=[],z=()=>J.at(-1)?.location,X=()=>{let W=z();if(!W)throw Error("no location holds keep-warm");return W},Y=(W,B)=>{H.remove(W),z()?.log?.debug(`cachekeep dropped target (${B})`,{sessionKey:W})},N=async(W)=>{if(W.meta.credentialMode!=="local")throw Error("a target captured in vault mode is not warmed with a local credential");let B=W.accountId??"main",V=X(),K=await V.source.accessFor(B,await V.storage());if(!K)throw Error(`pool row ${B} has no usable token`);return{token:K.token,identity:K.row.identity}},H=H$({...D2,now:$.now,...$.setIntervalImpl?{setIntervalImpl:$.setIntervalImpl}:{},...$.clearIntervalImpl?{clearIntervalImpl:$.clearIntervalImpl}:{},codexResponsesUrl:$.codexResponsesUrl,fetchImpl:(W,B)=>X().fetch(W,B),logger:{debug:(W,B)=>z()?.log?.debug(W,B),warn:(W,B)=>z()?.log?.warn(W,B)},getWindow:()=>z()?.settings().window,getSustain:()=>z()?.settings().sustain===!0,resolveLocal:N,vault:{owns:(W)=>z()?.vault.owns(W)===!0,authority:()=>X().vault.authority(),send:async(W,B,V)=>{let K=X();if(await K.vault.authority()!=="vault")return;return K.vault.send(W,B,V)}},activeAccount:(W)=>{if(W===void 0)throw Error("target has no session");let B=z(),V=B?.settings();if(!B||!V?.enabled){Y(W,"keep-warm is off");return}if(!V.subagents&&H.status().targets.some((x)=>x.sessionKey===W&&x.isSubagent)){Y(W,"subagent warming is off");return}let K=B.accounts.activeAccount(W);if(K===void 0){Y(W,"no account recorded for the session");return}return K},verifyCredential:({target:W,mode:B,identity:V})=>{if(W.meta.credentialMode!==B)throw Error(`a target captured in ${W.meta.credentialMode??"an unknown"} mode is not warmed with a ${B} credential`);if(V!==W.meta.chatgptAccountId)throw Y(W.sessionKey,"the account signs in as another login now"),Error("the account signs in as another login now")}});return{manager:H,settings:Z,holders:J,joinTimeoutMs:$.joinTimeoutMs??K0}}function _0($){try{let Z=JSON.parse($),J=Array.isArray(Z.input)?Z.input.at(-1):void 0;if(J?.role!=="user")return!1;return(typeof J.content==="string"?J.content:Array.isArray(J.content)?J.content.map((X)=>typeof X?.text==="string"?X.text:"").join(""):"").startsWith("This is a keep-alive request.")}catch{return!1}}function M0($){let Z={};for(let J of L0){let z=$.get(J);if(z)Z[J]=z}return Z}function K$($,Z,J){let z=JSON.stringify([B$($.configPath),B$($.statePath)]),X=C2.get(z);if(!X)X=T0(J,Z.settings()),C2.set(z,X);let Y=X,N=w2($);N.setEnabled(Y.settings.enabled);let H={location:{...Z,settings:()=>Y.settings}};Y.holders.push(H);let W=!1,B=async(V)=>{try{let K=H.location.settings();if(W||!K.enabled)return;if(V.kind!=="primary"){if(V.kind==="generate"&&_0(await V.request.clone().text())){if(W)return;Y.manager.remove(V.sessionID)}return}let x=V.attempt.data,_=x?.kind==="pool"?"local":x?.kind==="vault"?"vault":void 0;if(!_)return;let h=V.request.headers,d=C0.some((n)=>h.has(n))||Z.parentOf!==void 0&&await Z.parentOf(V.sessionID)!==void 0;if(d&&!K.subagents)return;let S=await V.request.clone().text();if(W)return;let y=h.get("chatgpt-account-id")??void 0;Y.manager.track({sessionKey:V.sessionID,bodyText:S,accountId:V.attempt.accountId,isSubagent:d,meta:{replayHeaders:M0(h),...y?{chatgptAccountId:y}:{},routingSessionId:V.sessionID,url:V.request.url,credentialMode:_}})}catch(K){Z.log?.warn("cachekeep capture failed",{error:K instanceof Error?K.message:String(K)})}};return{manager:Y.manager,configure:(V)=>{Object.assign(Y.settings,V),N.setEnabled(Y.settings.enabled)},capture:B,forget:(V)=>Y.manager.remove(V),async release(){if(W)return;W=!0;let V=Y.holders.indexOf(H);if(V>=0)Y.holders.splice(V,1);if(Y.holders.length>0)return;if(C2.get(z)===Y)C2.delete(z);Y.manager.stop();let K;try{await Promise.race([Y.manager.tick().catch(()=>{}),new Promise((x)=>{K=setTimeout(x,Y.joinTimeoutMs),K.unref?.()})])}finally{clearTimeout(K)}}}}import{mkdirSync as E0}from"node:fs";import{dirname as O0,join as R0,resolve as A0}from"node:path";var x0="openai-auth-sessions-opencode2.json";function S0(){return R0(C$(),x0)}var q0="sessions",k0=1e4,b0=5000,D0=25;class E${path;options;sessions;frameTurns=new F2;#$=new Set;#Z=new Set;#J=Promise.resolve();#z=!1;constructor($,Z={}){this.path=$;this.options=Z;this.sessions=_$($,Z.uuid??Q2)}get($,Z=Q2){let J=this.sessions.get($);if(!J){let z=Z();J={threadID:z,turnID:Z(),windowID:`${z}:0`},this.sessions.set($,J),this.#Z.delete($),this.#$.add($),this.save()}return J}delete($){this.sessions.delete($),this.frameTurns.forget($),this.#$.delete($),this.#Z.add($),this.save()}save(){if(!this.#z)this.#z=!0,this.#J=this.#J.then(()=>{return this.#z=!1,this.#G()});return this.#J}settled(){return this.#J}async#G(){if(this.#$.size===0&&this.#Z.size===0)return;let $=[...this.#$].flatMap((z)=>{let X=this.sessions.get(z);return X?[[z,X]]:[]}),Z=[...this.#Z],J=null;try{if(E0(O0(this.path),{recursive:!0}),J=await this.#X(),!J)return;let z;try{z=T$(this.path)}catch{z=new Map}await this.options.afterRead?.();for(let X of Z)z.delete(X);for(let[X,Y]of $)z.set(X,Y.threadID);M$(this.path,z)}catch{return}finally{await J?.release().catch(()=>{})}for(let[z,X]of $)if(this.sessions.get(z)===X)this.#$.delete(z);for(let z of Z)if(!this.sessions.has(z))this.#Z.delete(z)}async#X(){let $=performance.now()+(this.options.lockWaitMs??b0);for(;;){let Z=await L$({name:q0,path:this.path,ttlMs:k0});if(Z||performance.now()>=$)return Z;await new Promise((J)=>setTimeout(J,D0))}}}var O$=Symbol.for("@cortexkit/openai-auth/opencode2-codex-sessions"),R$=globalThis,z1=R$[O$]??new Map;R$[O$]=z1;function A$($=S0()){let Z=A0($),J=z1.get(Z);if(!J)J=new E$(Z),z1.set(Z,J);return J}var x$=Symbol.for("cortexkit.openai-auth.v2.commands");function w0(){let $=globalThis;return $[x$]??={locations:new Map},$[x$]}async function I$($,Z){let J=w0(),z=$.location.directory,X={menu:Z,session:$.session},Y=await q$(z),N=await S$(w$,Y.dir,()=>y$({...Y,drain:b$,apply:(V)=>{let K=J.locations.get(z);if(!K)throw Error("The OpenAI menu location was closed");return K.menu.apply(V)}})),H=J.locations.get(z);J.locations.set(z,X),await H?.registration?.dispose(),J.command??={name:"openai",description:"OpenAI account menu",async execute(V){let K=J.locations.values().next().value?.session;if(!K)return;let x=await K.get({sessionID:V.sessionID}),_=J.locations.get(x.location.directory);if(!_||!D$(V.sessionID))return;let h=await _.menu.open(V.sessionID);k$(h,V.sessionID)}};let W=J.command;try{X.registration=await $.command.transform((V)=>{V.add(W)})}catch(V){if(J.locations.get(z)===X)J.locations.delete(z);throw await N.release(),V}let B=!1;return async()=>{if(B)return;if(B=!0,J.locations.get(z)===X)J.locations.delete(z);await N.release(),await X.registration?.dispose()}}var y0="openai-auth-pool-browser",I0="openai-auth-pool-headless",f0="openai-auth-vault",v0="Vault login requires this OpenCode host to be enrolled in the Claustrum vault. Connect to the vault or disconnect this host before trying again.";async function T2($){if(await $.authority()!=="local")throw Error("This host is connected to the credential vault or its enrollment is unreadable; the login was not stored. Disconnect this host from the vault to add a local login.")}function l$($){return{method:{id:f0,type:"oauth",label:"ChatGPT accounts in the vault"},async activate(){if(await f$($.paths,$.name)!=="vault")throw Error(v0)}}}function u$($){let Z=(J,z,X)=>({method:{id:J,type:"oauth",label:z},async authorize(){if($.vault)await T2($.vault);let Y=await $.beginLogin({version:$.version,headless:X});return{url:Y.url,instructions:Y.instructions,mode:"auto",callback:Y.completion}}});return[Z(y0,"ChatGPT (openai-auth pool, browser)",!1),Z(I0,"ChatGPT (openai-auth pool, headless)",!0)]}function G1($){let Z=(J)=>typeof J==="string"?J:"";return N2({type:"oauth",access:Z($.access),refresh:Z($.refresh)})||$.refresh===m$||v$($)}function h0($){if($.accountId)return $.accountId;let Z=$.access?q2($.access):void 0;return Z?k2(Z):void 0}async function p$($,Z,J,z={}){if(z.vault)await T2(z.vault);if(G1(J))throw Error("the credential is not a ChatGPT login (a placeholder or a tombstone); it was not stored");let X=h$($,{rowLocks:(_)=>g$(Z,_)}),Y=await X.read();if(Y.status!=="ready")throw Error(`the account pool cannot be read (${Y.status}); the login was not stored`);let N={type:"oauth",refresh:J.refresh,...J.access!==void 0?{access:J.access}:{},...J.expires!==void 0?{expires:J.expires}:{}},H=h0(J);if(z.vault)await T2(z.vault);let W=H!==void 0?{identity:H}:{};if(z.origin==="import"){let _=Y.rows.find((h)=>H!==void 0&&h.identity===H||h.credential?.type==="oauth"&&h.credential.refresh===J.refresh);if(_)return{id:_.id,operation:"kept"}}let B=Y.rows.filter((_)=>_.type==="oauth"&&!_.invalid),V=H?B.find((_)=>_.identity===H):void 0,K=Y.rows.find((_)=>_.id===y2);if(V)return{id:(await X.replace(V.id,N,W)).id,operation:"replaced"};if(!K){let _=await X.add({id:y2,credential:N,...W,...J.label!==void 0?{label:J.label}:{}});return{id:_.id,operation:_.outcome==="added-disabled"?"added-disabled":"added"}}if(!K.invalid&&!K.credential)return{id:(await X.replace(y2,N,W)).id,operation:"replaced"};let x=await X.add({id:J.id,credential:N,...W,...J.label!==void 0?{label:J.label}:{}});return{id:x.id,operation:x.outcome==="added-disabled"?"added-disabled":x.outcome==="rotated"?"replaced":"added"}}function m0($){let Z=$.itemId!==void 0;switch($.sectionId){case"accounts":return Z?["enable","disable","remove","move"].includes($.actionId):$.actionId==="add";case"routing":return!Z&&["order","mode"].includes($.actionId);case"quota":return $.actionId==="check";case"limits":return Z?$.actionId==="floors":$.actionId==="killswitch";case"session":return!Z&&$.actionId==="clear-pin";case"diagnostics":return!Z&&["logging","dump"].includes($.actionId);case"cache":return!Z&&["enabled","subagents","sustain","window"].includes($.actionId);case"reset":return Z&&["preview","spend","retry"].includes($.actionId);default:return!1}}function i$($){let Z={...$,allowAction:m0,unavailableSections:[]};return{open:(J)=>c$(Z,J),apply:(J)=>{let z=J!==null&&typeof J==="object"?J:{},X=z.values&&typeof z.values==="object"&&!Array.isArray(z.values)?Object.fromEntries(Object.entries(z.values).filter(([,Y])=>Y===null||["string","number","boolean"].includes(typeof Y))):void 0;return d$(Z,{command:"openai",sectionId:typeof z.sectionId==="string"?z.sectionId:"",actionId:typeof z.actionId==="string"?z.actionId:"",...X?{values:X}:{},...z.confirmed===!0?{confirmed:!0}:{},...typeof z.itemId==="string"?{itemId:z.itemId}:{},...typeof z.sessionId==="string"?{sessionId:z.sessionId}:{}})}}}function g0($){if(!a$($.modelID??$.id)){$.enabled=!1;return}let Z=n$($.id);if(Z)$.limit={...Z}}function o$($){return $.model.transform((Z)=>{for(let J of Z.list(r))Z.update(r,String(J.id),(z)=>g0(z))})}class X1{log;pending=new Map;requests=new Map;writing=new Set;constructor($){this.log=$}async safely($){let Z=(async()=>{try{await $()}catch{this.log.warn("request dump failed")}})();this.writing.add(Z);try{await Z}finally{this.writing.delete(Z)}}async captureHttp($,Z){await this.safely(async()=>{if(!B2().dump)return;let J={sessionID:Z.sessionID,accountId:Z.accountId,transport:"http",phase:"http",url:$.url,method:$.method,headers:new Headers($.headers),bodyText:await $.clone().text()};if(this.pending.set($,{attemptId:Z.attemptId,input:J}),this.requests.set(Z.attemptId,$),this.pending.size>512){let z=this.pending.keys().next().value;if(z)this.take(z)}})}take($){let Z=this.pending.get($);if(Z)this.pending.delete($),this.requests.delete(Z.attemptId);return Z?.input}async response($,Z){let J=this.take($);if(J)await this.safely(()=>I2({...J,status:Z}))}async end($,Z){if(Z.status!==void 0||!Z.error)return;let J=this.requests.get($.attemptId),z=J&&this.take(J);if(!z)return;let{reason:X,message:Y}=Z.error,N=Y?`${X}: ${Y}`:X;await this.safely(()=>I2({...z,error:f2(N,J?.headers.get("authorization")?.replace(/^Bearer /,""))}))}async frame($,Z){await this.safely(()=>I2({sessionID:Z.sessionID,accountId:Z.accountId,transport:"websocket",phase:"observed",bodyText:$}))}clear(){this.pending.clear(),this.requests.clear()}async settle(){await Promise.all(this.writing)}}class Y1{counts=new Map;record($,Z){let J=Z.resetCreditsApplicable;this.counts.set($.id,{credentialEpoch:$.credentialEpoch,identity:$.identity,applicable:typeof J==="number"&&Number.isFinite(J)?J:void 0})}applicable($){let Z=this.counts.get($.id);if(!Z||Z.credentialEpoch!==$.credentialEpoch||Z.identity!==$.identity)return;return Z.applicable}}function $Z($){return async(Z)=>{let J=Z.credential;if(J.type!=="oauth"||!J.access)throw Error("the row holds no access token to poll with");let z=await r$({accessToken:J.access,fetchImpl:$.fetchImpl,now:$.now,...Z.identity?{accountId:Z.identity}:{},accountKey:Z.id,...$.logger?{logger:$.logger}:{}});return $.counts.record(Z,z),s$(z,$.now(),!0)}}function ZZ($){let{source:Z,counts:J,now:z}=$,X=async(B)=>{let V=await Z.rowAccess(B,await $.storage());if(!V?.row)throw new t$("unknown_account",`${B==="main"?"Main":"Fallback"} account ${B} was not found.`);return e$(B,V)},Y=async(B)=>{if($.authority&&await $.authority()!=="local")return{account:B,ok:!1,error:"local accounts are not polled while this host is connected to the vault"};let[V]=await Z.pollRows(await $.storage(),{ids:[B]});if(!V)return{account:B,ok:!1,error:"targeted quota refresh returned no result"};return{account:V.id,ok:V.ok,...V.error!==void 0?{error:V.error}:{}}},N=(B)=>Z.peek().rows.find((V)=>V.id===B),H=(B)=>{let V=N(B);if(!V)return null;let K=K2(V.quota)??{},x=J.applicable(V),_=Math.max(0,...[K.primary?.checkedAt,K.secondary?.checkedAt].filter((h)=>typeof h==="number"));return{quota:{...K,...x!==void 0?{resetCreditsApplicable:x}:{}},checkedAt:_,refreshAfter:_,...V.identity!==void 0?{accountId:V.identity}:{}}};return{resolveResetTarget:X,refreshResetTargetQuota:Y,quotaManager:{isRateLimited:(B)=>{let V=N(B);if(!V)return!1;let K=Z.rateLimitMarks([V]).get(V.id);return K!==void 0&&K>z()},getMain:()=>H("main"),getFallback:(B)=>H(B)}}}import{resolve as zZ}from"node:path";var l0=1024;class Q1{pins=new Map;listeners=new Set;limit;constructor($=l0){this.limit=Math.max(1,$)}get($){return this.pins.get($)?.accountId}forget($){this.pins.delete($);for(let Z of this.listeners)Z($)}subscribe($){return this.listeners.add($),()=>{this.listeners.delete($)}}snapshot(){return new Map(this.pins)}get size(){return this.pins.size}set($,Z){this.pins.delete($),this.pins.set($,Z);for(let J of this.listeners)J($,Z);while(this.pins.size>this.limit){let J=this.pins.keys().next().value;if(J===void 0)break;this.forget(J)}}place($){return JZ(this.pins,$,(Z,J)=>this.set(Z,J))}}var GZ=Symbol.for("@cortexkit/openai-auth/opencode2-pins"),XZ=globalThis,j1=XZ[GZ]??new Map;XZ[GZ]=j1;function YZ($){let Z=JSON.stringify([zZ($.configPath),zZ($.statePath)]),J=j1.get(Z);if(!J)J=new Q1,j1.set(Z,J);return J}import{statSync as u0}from"node:fs";import{resolve as p0}from"node:path";function FZ($){return $.map((Z)=>{try{let J=u0(Z);return`${J.ino}:${J.size}:${J.mtimeMs}:${J.ctimeMs}`}catch{return"?"}}).join("|")}function V1($){return FZ([$.vault.paths.tokenPath,$.vault.paths.statePath])}function QZ($){return FZ([$.paths.configPath,$.paths.statePath,$.vault.paths.rosterPath])+V1($)}class PZ{file;observationIntervalMs;producers=new Set;subscriptions=new Map;observations=new Map;chain=Promise.resolve();timer;constructor($,Z){this.file=$;this.observationIntervalMs=Z}add($){this.producers.add($),this.observations.set($,{stamp:QZ($),roster:$.vault.snapshot()});let Z=$.source.subscribe(()=>{this.publish($)}),J=this.subscriptions.get($.pins);if(!J){let z=new Set;J={producers:z,stop:$.pins.subscribe((X,Y)=>{let N=z.values().next().value;if(N)this.publish(N,{sessionId:X,pin:Y,accountId:Y?.accountId,route:"sticky-balanced"})})},this.subscriptions.set($.pins,J)}return J.producers.add($),this.timer??=setInterval(()=>{for(let z of this.producers){let X={stamp:QZ(z),roster:z.vault.snapshot()},Y=this.observations.get(z);if(X.stamp!==Y?.stamp||X.roster!==Y?.roster)this.observations.set(z,X),this.publish(z)}},this.observationIntervalMs),this.timer.unref?.(),()=>{if(Z(),this.producers.delete($),this.observations.delete($),J.producers.delete($),!J.producers.size)J.stop(),this.subscriptions.delete($.pins);if(!this.producers.size)clearInterval(this.timer),this.timer=void 0}}publish($,Z){return this.chain=this.chain.then(async()=>{if(!this.producers.has($))return;let z=await $.vault.authority()!=="local",X=V1($),Y=()=>this.producers.has($)&&$.vault.enrolled()===z&&V1($)===X,N=await z2($.paths),H=z?HZ($.vault.snapshot()?.rows??[],new Set($.vault.routes().map((B)=>B.id)),N,Date.now()):NZ((await $.source.sidebarView()).rows,N,Date.now());if(await VZ(H,this.file,{canWrite:Y}),!Y()||!Z)return;let W=H.vaultAccounts??H.fallbacks;if(Z.accountId===void 0){await WZ(Z.sessionId,W,this.file,{canWrite:Y});return}if(Z.pin){let B=Date.now();await UZ({sessionId:Z.sessionId,assignment:{accountId:Z.pin.accountId,wireAccountId:Z.pin.wireIdentity,inputBytes:Z.pin.inputBytes??0,quotaCheckedAt:Z.pin.quotaCheckedAt,assignedAt:B,lastSeenAt:B},validPinnedAccountIds:[...z?[]:["main"],...W.filter((V)=>V.enabled).map((V)=>V.id)]},this.file)}await BZ({sessionId:Z.sessionId,activeId:Z.accountId,route:Z.route??H.route,updatedAt:Date.now()},W,this.file,{canWrite:Y})}).catch(()=>{G2("opencode2").warn("sidebar publication failed")}),this.chain}settled(){return this.chain}get empty(){return this.producers.size===0}}var KZ=Symbol.for("@cortexkit/openai-auth/opencode2-sidebar-publishers"),LZ=globalThis,_2=LZ[KZ]??new Map;LZ[KZ]=_2;function CZ($,Z=jZ(),J=2000){let z=p0(Z),X=_2.get(z);if(!X)X=new PZ(z,J),_2.set(z,X);let Y=X,N=Y.add($),H=!1;for(let[W,B]of $.pins.snapshot())Y.publish($,{sessionId:W,pin:B,accountId:B.accountId,route:"sticky-balanced"});return{publish:()=>Y.publish($),route:(W,B,V)=>{Y.publish($,{sessionId:W,accountId:B,route:V})},async release(){if(H)return;if(H=!0,N(),await Y.settled(),Y.empty&&_2.get(z)===Y)_2.delete(z)}}}var h2="cortexkit-openai-auth",i0=5000;async function TZ($,Z,J,z=new P2,X,Y,N){let H=new X1(J),W=new c0,B=new Map,V=new Map,K=(S)=>{V.delete(S);for(let y of B.keys())if(y.startsWith(`${S}:`))B.delete(y)},x=(S)=>{N?.(S.sessionID),Y?.send(S.sessionID,S.frame)},h=await i2({session:{hook:(S,y,n)=>$.session.hook(S,async(I)=>{let f=S==="http.request"?I:void 0,j=S==="experimental.ws.handshake"?I:void 0,E=(f?f.request.headers:j?new Headers(j.headers):void 0)?.get("authorization")===`Bearer ${$2(Z.providerID)}`,M={};if(j)B.delete(`${j.sessionID}:${j.kind}`);try{await W.run(M,()=>y(I))}catch(P){if(E&&!(P instanceof o))throw AZ(P);throw P}if(f&&E&&M.attempt){let P=f.request.headers.get("thread-id");if(P)f.request.headers.set("session-id",P)}if(f&&E&&M.attempt)await H.captureHttp(f.request,M.attempt);if(f&&E&&M.attempt)await X?.({sessionID:f.sessionID,kind:f.kind,request:f.request,attempt:M.attempt});if(j&&E&&M.attempt)j.headers["session-id"]=z.get(j.sessionID).threadID;if(S==="experimental.ws.send"){let P=I,L=B.get(`${P.sessionID}:${P.kind}`);if(L)await H.frame(P.frame,L.attempt);if(L&&P.kind==="primary")x(P)}if(f||j){let P=f??j;if(!P)return;let O=(f?f.request.headers:new Headers(P.headers)).get("authorization")?.replace(/^Bearer /,"");if(E&&O)V.set(P.sessionID,O);else V.delete(P.sessionID);if(j){let A=`${j.sessionID}:${j.kind}`;if(E&&O&&M.attempt)B.set(A,{bearer:O,attempt:M.attempt,url:j.url,headers:new Headers(Object.entries(j.headers).filter(([w])=>["chatgpt-account-id","x-opencode-parent-session-id","x-parent-session-id"].includes(w.toLowerCase())))});else B.delete(A)}if(V.size>512){let A=V.keys().next().value;if(A)V.delete(A)}if(B.size>512){let A=B.keys().next().value;if(A)B.delete(A)}}else if(S==="experimental.ws.receive"){let P=I,L=B.get(`${P.sessionID}:${P.kind}`);if(L){if(z.frameReceived(P.sessionID,P.frame),P.kind==="primary"){let O;if(Y?.receive(P.sessionID,P.frame,(A)=>{O=A}),O)try{let A=k1(O,L.url,L.headers,z);if(A)await X?.({sessionID:P.sessionID,kind:"primary",request:A,attempt:L.attempt})}catch(A){J.warn("cachekeep WebSocket capture failed",{error:A instanceof Error?A.message:String(A)})}}P.frame=xZ(P.frame,L.bearer)}}else if(S==="retry"){let P=I,L=V.get(P.sessionID);if(L)Object.assign(P.error,{message:f2(P.error.message,L)})}},n)},event:{subscribe:(S)=>async function*(){for await(let y of $.event.subscribe(S)){if(y.type==="session.deleted")K(y.data.sessionID);yield y}}()}},{...Z,rewriteRequest:async(S)=>{let y=W.getStore();if(y)y.attempt=S.attempt;return Z.rewriteRequest?.(S)},rewriteHandshakeURL:(S)=>{let y=W.getStore();if(y)y.attempt=S.attempt;return Z.rewriteHandshakeURL?.(S)},onAttemptEnd:async(S,y)=>{await H.end(S,y),await Z.onAttemptEnd?.(S,y)},rewriteResponse:async(S)=>{await H.response(S.request,S.response.status);let y=await Z.rewriteResponse?.(S)??S.response;return SZ(y,S.request.headers.get("authorization")?.replace(/^Bearer /,""),"event-stream")}},{gateOnPlaceholder:{credential:(S)=>{let y=S.get("authorization");return y?.startsWith("Bearer ")?y.slice(7):void 0}},logger:{warn:(S,y)=>J.warn(S,{data:y})}}),d=h.dispose;return{...h,dispose:async()=>{V.clear(),B.clear(),await d(),await H.settle(),H.clear()}}}function U1($={}){return{id:h2,setup:(Z)=>a0(Z,$)}}async function a0($,Z={}){let X2=[];try{let J=G2("opencode2");let z=G2("quota");let X=Z.paths??(()=>kZ(qZ()));let Y=await z2(X());let N=Y?.logging?.level;if(N&&typeof N==="string")MZ(N);let H=Z.fetch??fetch;let W=Z.now??Date.now;let B=Z.version??IZ;let V=Z.poolMigration??uZ;if(!V&&!W2(X().configPath)){J.info("openai-auth stands aside on OpenCode 2: this install has not moved into the account pool and the migration is switched off, so OpenCode 2 serves its own ChatGPT login");let C=(t)=>{throw new o({kind:"no-account",providerID:r,sessionID:t.sessionID,requestKind:t.kind,message:b2})},v=await TZ($,{providerID:r,chooseAccount:C,accountHeaders:C},J);return()=>v.dispose()}let K=Z.vault?.firstRosterWaitMs??vZ;let x=lZ({host:"opencode",stateDir:Z.vault?.stateDir??RZ(X().statePath),reservedRouteIds:()=>I.peek().rows.map((C)=>C.id),...Z.vault?.connectionFile?{connectionFile:Z.vault.connectionFile}:{},...Z.vault?.connectScoped?{connectScoped:Z.vault.connectScoped}:{},...Z.vault?.connectEnrollment?{connectEnrollment:Z.vault.connectEnrollment}:{},...Z.vault?.pollIntervalMs!==void 0?{pollIntervalMs:Z.vault.pollIntervalMs}:{},fetchImpl:()=>H},X());let _=x.vault;let h=!1;let d=!1;const S=v2(X2,{[Symbol.dispose](){if(!h)x.release()}},0);await _.authority();let y=x.firstRoster;let n=new Y1;let I=new hZ({paths:X,refreshProvider:async(C)=>{let v=await OZ({refreshToken:C.refresh,fetchImpl:H,now:W}),t=EZ({id_token:"",access_token:v.access,refresh_token:v.refresh});return{...v,...t?{identity:t}:{}}},pullQuota:$Z({fetchImpl:H,now:W,counts:n,logger:z}),now:W,vaultIdentities:()=>_.identities(),vaultMode:()=>_.enrolled(),vaultAuthority:()=>_.authority(),vaultFirstRoster:y,vaultFirstRosterBackgroundWaitMs:K,log:G2("pool")});await I.load();let f=Z.heartbeat===!1?void 0:await gZ({version:B,logger:G2("heartbeat")});let j=Z.fence??(()=>yZ({currentVersion:B}));let T=Z.slot??pZ();let E=async()=>bZ(X(),await T.get({path:{id:"openai"}}));let M=!1;let P=V?mZ({paths:X,slot:T,version:B,fence:j,runDeps:{vaultServes:()=>_.serves()},paused:async()=>await _.authority()!=="local",migrate:async(C)=>{let v=await DZ(C);if(M=v.status==="refused",!d)await I.load();return v},adopt:async(C)=>{if(d)return{status:"retry",reason:"unsettled"};if(!await W1(y,K))return{status:"retry",reason:"vault-roster-pending"};if(d)return{status:"retry",reason:"unsettled"};let v=await wZ(C);if(!d)await I.load();return v}}):void 0;P?.start();x.start();let L=YZ(X());let O=CZ({paths:X(),source:I,pins:L,vault:_},Z.sidebarStateFile,Z.sidebarObservationIntervalMs);const A=v2(X2,{[Symbol.dispose](){if(!h)O.release()}},0);O.publish();let w=Z.codex??new P2(void 0,void 0,A$());let p=N$(Y);let a=w2(X());let l=K$(X(),{source:I,storage:()=>z2(X()),vault:_,accounts:t2(X()),settings:()=>p,parentOf:async(C)=>(await $.session.get({sessionID:C}))?.parentID??void 0,fetch:H,log:G2("cachekeep")},{now:W,codexResponsesUrl:B2().codexApiEndpoint,...Z.cacheKeep});const i=v2(X2,{[Symbol.dispose](){if(!h)l.release()}},0);let c=G$({codex:w,onRoute:O.route,source:I,slotPlaceholderWithoutMain:E,storage:()=>z2(X()),pins:L,sessionAccounts:t2(X()),vault:_,awaitVaultRoster:async()=>{await W1(_.awaitRequestRoster(),fZ)},responsesLite:()=>B2().responsesLite,codexEndpoint:()=>B2().codexApiEndpoint,now:W,log:J});let k=await TZ($,c.adapter,J,w,(C)=>l.capture(C),a,(C)=>l.forget(C));c.attach(k);let g=async(C)=>{if(await T2(_),W2(X().configPath))return;if(await P?.idle(),W2(X().configPath))return;if(M&&!G1(C)&&(await j()).open){await I.poolStore().initialize();return}throw Error("OpenAI accounts move to the shared account pool once every OpenCode process on this machine runs this version of openai-auth; the login was not stored. Update or close the older processes and sign in again.")};let u=async(C)=>{await g(C);let v=await p$(I.poolStore(),X(),C,{vault:_});if(!W2(X().configPath))await P?.requestAdoption();await I.load(),J.info("ChatGPT login stored in the account pool",v)};let s=await p2($,{integrationID:r,methods:u$({beginLogin:Z.beginLogin??B1,version:B,vault:_}),onLogin:(C)=>u(C),label:"ChatGPT (openai-auth account pool)",vault:l$(_)});let M2=await o$($);if(Z.controlPlane&&(!$.command||!$.location))throw Error("OpenCode 2 control plane requires command and location APIs");let U2=$.command&&$.location?await I$({session:$.session,command:$.command,location:$.location},Z.controlPlane??i$({...ZZ({source:I,storage:()=>z2(X()),counts:n,now:W,authority:()=>_.authority()}),fetchImpl:H,now:W,randomUUID:d0,accountStoragePath:X().configPath,accountStatePath:X().statePath,packageVersion:B,loadAccounts:z2,store:()=>I.poolStore(),migration:async()=>{if(W2(X().configPath))return{migrated:!0};let C=await j();return{migrated:!1,blockers:C.open?[]:C.blockers}},beginAccountLogin:Z.beginLogin??B1,refreshAllQuota:async()=>(await I.pollRows(await z2(X()))).map((C)=>({...C,account:C.id})),getStickyRouting:async(C)=>L.get(C),cacheKeepManager:l.manager,setCacheKeepEnabled:(C)=>l.configure({enabled:C}),setCacheKeepSubagents:(C)=>l.configure({subagents:C}),setCacheKeepSustain:(C)=>l.configure({sustain:C}),setCacheKeepWindow:(C)=>l.configure({window:C}),afterWrite:()=>I.load(),refreshSidebar:()=>O.publish(),clearStickyRouting:async(C)=>{let v=L.get(C)!==void 0;return L.forget(C),v},vault:_})):void 0;let j2=new AbortController;(async()=>{try{for await(let C of $.event.subscribe({signal:j2.signal}))if(C.type==="session.deleted")c.forgetSession(C.data.sessionID),l.forget(C.data.sessionID),a.forget(C.data.sessionID)}catch(C){if(!j2.signal.aborted)J.warn("stopped listening for session deletion",{error:C instanceof Error?C.message:String(C)})}})();h=!0;return async()=>{d=!0,j2.abort();let C=l.release();await U2?.(),P?.dispose(),I.dispose(),await O.release(),await Promise.allSettled([k.dispose(),s.dispose(),M2.dispose()]);let v;try{await Promise.race([Promise.all([P?.idle(),I.settled(),w.store?.settled(),C]),new Promise((t)=>{v=setTimeout(t,i0),v.unref?.()})])}finally{clearTimeout(v),x.release(),await f?.release()}}}catch(m2){var g2=m2,l2=1}finally{_Z(X2,g2,l2)}}var n0=U1(),P6={id:h2,setup:n0.setup,server:cZ.server};export{P6 as default,U1 as createOpenAIAuthPlugin,h2 as OPENAI_AUTH_PLUGIN_ID};
+`)}}function e2($,Z){let J=new TextDecoder,z="",X=(F)=>{let N=Z0(F);if(!N)return;try{$(N)}catch(U){Z(U)}},Y=()=>{for(;;){let F=/\r?\n\r?\n/.exec(z);if(!F)return;let N=z.slice(0,F.index);z=z.slice(F.index+F[0].length),X(N)}};return new TransformStream({transform(F,N){N.enqueue(F),z+=J.decode(F,{stream:!0}),Y()},flush(){if(z+=J.decode(),Y(),z.trim()!=="")X(z);z=""}})}var q1=512,M2="x-common-auth-attempt",L2=($,Z)=>JSON.stringify([$,Z]),j2=($)=>({providerID:$.model.providerID,modelID:$.model.id,sessionID:$.sessionID,agent:$.agent,kind:$.kind});function J0($){let Z=$.headers;return typeof Z==="object"&&Z!==null}function z0($,Z){let J=$.getReader();return new ReadableStream({async pull(z){let X;try{X=await J.read()}catch(Y){Z({reason:"failed",message:Y instanceof Error?Y.message:String(Y)}),z.error(Y);return}if(X.done)Z(),z.close();else z.enqueue(X.value)},async cancel(z){Z({reason:"cancelled",...z===void 0?{}:{message:String(z)}}),await J.cancel(z)}})}function $1($,Z){for(let[J,z]of Object.entries(Z)){let X=J.toLowerCase();for(let Y of Object.keys($))if(Y.toLowerCase()===X)delete $[Y];if(z!==null)$[J]=z}}function G0($,Z){for(let[J,z]of Object.entries(Z))if(z===null)$.delete(J);else $.set(J,z)}async function Z1($,Z,J={}){let{providerID:z}=Z,X=J.gateOnPlaceholder,Y=(G)=>X===void 0||X.credential(G)===Q2(z),F=J.logger,N=Math.max(1,J.maxRecords??q1),U=[...J.hostCredentials??[Q2(z)],...X?[Q2(z)]:[]].filter((G)=>G!==""),j=new Map,B=new WeakMap,L=new Map,S=new Set,_=new Map,u=!1,o=!1,R=new Map,k=0,z2=!1,w=new Map,h=(G,Q)=>{try{F?.warn(G,Q)}catch{}},v=(G)=>G instanceof Error?G.message:String(G),V=new Map,P=(G,Q)=>{let W=(V.get(G)??Promise.resolve()).then(Q),H=W.then(()=>{},()=>{});return V.set(G,H),H.then(()=>{if(V.get(G)===H)V.delete(G)}),W},E=(G,Q)=>{let W=V.get(G);return W?W.then(()=>E(G,Q)):Q()},K=async(G)=>{try{await Z.dropChoice?.({...G.input,accountId:G.accountId})}catch(Q){h("opencode2 auth dropChoice threw; the request is unaffected",{sessionID:G.input.sessionID,error:v(Q)})}},A=(G)=>{let Q=L.get(G);if(L.delete(G),Q?.next){let W=Q.next;P(Q.sessionID,()=>K(W))}},T=async(G,Q)=>{let W=R.get(G);if(!W||W.size===0)return;await Promise.all([...W].map(async(H)=>{try{await H(Q)}catch(x){h("opencode2 auth listener threw; the request is unaffected",{event:G,error:v(x)})}}))},C=async(G,Q)=>{try{await Z.onAttemptEnd?.(G,Q)}catch(W){h("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:G.attemptId,error:v(W)})}},y=(G,Q)=>{if(G.ended||!G.attempt)return;let W={...G.status===void 0?{}:{status:G.status},outputStarted:G.outputStarted,...G.limit?{limit:G.limit.signal}:{},...Q?{error:Q}:{}};if(Q)G.endError=Q;G.ended=C(G.attempt,W)},b=(G,Q)=>y(G,{reason:"abandoned",message:Q}),m=(G)=>[...j.values()].filter((Q)=>Q.key===G),g=(G)=>m(G).at(-1),r=(G)=>{if(j.delete(G.id),L.get(G.key)?.attemptId===G.id||!m(G.key).length)A(G.key)},e=(G)=>{j.set(G.id,G);while(j.size>N){let Q=j.values().next().value;if(Q===void 0)break;b(Q,"dropped to keep the record bound"),r(Q)}},c=(G)=>G.accountId===void 0?void 0:{...G.scope,accountId:G.accountId},s=(G,Q)=>new J2({kind:"no-account",providerID:z,sessionID:G.sessionID,requestKind:G.kind,...Q===void 0?{}:{message:Q}}),l=(G)=>{w.get(G)?.clear(),w.delete(G)},f=async(G,Q)=>{let W=()=>s(G,`${z} ${G.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(z2)throw W();let H=w.get(G.sessionID);if(!H)H=new Set,w.set(G.sessionID,H);let x={};H.add(x);let q=()=>{if(!H.has(x))throw W()};try{return await Q(q)}finally{if(H.delete(x),H.size===0&&w.get(G.sessionID)===H)w.delete(G.sessionID)}},I=(G,Q)=>{for(let[W,H]of Q)if(U.some((x)=>H.includes(x)))throw new J2({kind:"host-credential-on-wire",providerID:z,sessionID:G.sessionID,requestKind:G.kind,message:`${z} ${G.kind} request still carries the host's placeholder credential in ${W}; the adapter's account headers must replace it`})},$2=(G)=>{for(let Q of m(G))if(Q.ended||!Q.attempt)r(Q);else if(Q.transport==="ws"||Q.judged)b(Q,"a newer attempt of its session and kind began"),r(Q)},p=async(G,Q,W,H)=>{let x=L2(G.sessionID,G.kind),{input:q,accountId:O}=await E(G.sessionID,async()=>{W();let n=L.get(x);L.delete(x);let _2=n?.accountId??g(x)?.accountId;$2(x);let t=n?.next,E2=t!==void 0&&t.input.modelID===G.modelID&&t.input.agent===G.agent,H2={...G,phase:"request",..._2===void 0?{}:{previousAccountId:_2},...n?.rerouteFrom?{rerouteFrom:n.rerouteFrom}:{}};if(t&&!E2)await P(G.sessionID,()=>K(t)),W();let k2=E2?t.accountId:await Z.chooseAccount(H2);return{input:H2,accountId:k2}});W();let D={},i;if(O!==void 0){let n=await Z.accountHeaders({...G,accountId:O});if(W(),J0(n))D=n.headers,i=n.attempt;else D=n}let G2=`attempt-${++k}`,Z2={id:G2,key:x,scope:G,accountId:O,headers:D,attempt:O===void 0?void 0:{...G,accountId:O,attemptId:G2,transport:H,data:i},...H===void 0?{}:{transport:H},outputStarted:!1};if(e(Z2),Z2.attempt)T("select",{...G,accountId:Z2.attempt.accountId,hook:Q,...q.previousAccountId===void 0?{}:{previousAccountId:q.previousAccountId},...q.rerouteFrom===void 0?{}:{rerouteFrom:q.rerouteFrom},handle:Z2.attempt});return Z2},a=async(G,Q,W,H,x)=>{let q=L2(G.sessionID,G.kind),O=H===void 0?void 0:j.get(H);if(O?.key!==q)O=void 0;if(!O){if(O=g(q),m(q).filter((i)=>i.transport===void 0&&!i.ended).length>1&&!o)o=!0,h("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:G.sessionID,kind:G.kind})}if(!O||O.transport!==void 0||O.ended)O=await p(G,Q,x,W);else if(O.transport=W,O.attempt)O.attempt.transport=W;if(W==="ws"){for(let D of m(q))if(D!==O&&D.transport==="ws")b(D,"a newer attempt of its session and kind went out over WebSocket")}return O},U2=async(G,Q)=>{try{return await Q()}catch(W){throw y(G,{reason:"failed",message:v(W)}),W}},T2=(G,Q)=>{let W=m(L2(G,Q)).filter((H)=>H.transport==="ws").at(-1);return W?.attempt!==void 0&&!W.ended?W:void 0},F2=(G,Q,W)=>{let H=c(G);if(!H||!G.attempt||G.limit)return;G.limit={signal:Q,delivered:T("limit",{...H,via:W,limit:Q,outputStarted:G.outputStarted,handle:G.attempt})}},M=(G,Q,W,H)=>{let x=c(G);if(!x||!G.attempt)return;T("quota",{...x,transport:Q,...H===void 0?{}:{status:H},quota:W,handle:G.attempt})},d=(G,Q,W,H)=>{let x=G.attempt;if(!x)return;let q=Z.inspectEvent?.(H===void 0?{transport:Q,data:W,attempt:x}:{transport:Q,data:W,event:H,attempt:x});if(!q)return;if(q.quota!==void 0)M(G,Q,q.quota);if(q.outputStarted)G.outputStarted=!0;if(q.limit)F2(G,q.limit,Q);if(q.error!==void 0)y(G,{reason:"failed",message:q.error});else if(q.done)y(G)},Y2=(G,Q)=>{let W=G.attempt;if(!W||Q.accountId===G.accountId)return;if(W.reboundFrom??=W.accountId,W.accountId=Q.accountId,"data"in Q)W.data=Q.data;G.accountId=Q.accountId},eZ=(G)=>!G.attempt||G.endError!==void 0||G.status!==void 0&&G.status>=400,$0=(G)=>{let Q=[...j.values()].filter((D)=>D.scope.sessionID===G),W=Q.filter((D)=>D.limit&&!D.rerouted).at(-1);if(W)return W;let H=Q.filter((D)=>D.scope.kind==="primary"),x=H.length>0?H:Q;if(x.length<=1)return x[0];let q=x.filter((D)=>!D.judged&&eZ(D)).at(-1);if(q)return q;let O=x.filter((D)=>D.attempt&&!D.ended);if(O.length>1)return"ambiguous";return O[0]??x.at(-1)},K2={providerID:z},W2=[];W2.push(await $.session.hook("model.request",(G)=>{if(X)return;return f(j2(G),async(Q)=>{let W=await p(j2(G),"model.request",Q);if(Q(),W.accountId===void 0)throw s(W.scope);$1(G.headers,{...W.headers,[M2]:W.id})})},K2)),W2.push(await $.session.hook("http.request",(G)=>{if(X){let Q=Y(G.request.headers);if(_.set(G.sessionID,Q),!Q)return}return f(j2(G),async(Q)=>{let W=G.request.headers.get(M2)??void 0,H=X?await p(j2(G),"http.request",Q,"http"):await a(j2(G),"http.request","http",W,Q);Q();let x=c(H),q=H.attempt;if(!x||!q)throw s(H.scope);await U2(H,async()=>{let O=G.request;if(Z.rewriteRequest){if(W!==void 0){let G2=new Headers(O.headers);G2.delete(M2),O=new Request(O,{headers:G2})}O=await Z.rewriteRequest({...x,request:O,attempt:q})??O,Q()}let D=new Headers(O.headers);D.delete(M2),G0(D,H.headers),I(H.scope,D.entries());let i=new Request(O,{headers:D});B.set(i,H),G.request=i})})},K2)),W2.push(await $.session.hook("http.response",async(G)=>{let Q=B.get(G.request);if(!Q){if(X)return;if(!u)u=!0,h("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:G.sessionID,kind:G.kind});return}let W=G.response;if(Z.answeredBy&&Q.attempt){let D=Q.attempt,i=await U2(Q,async()=>Z.answeredBy?.({request:G.request,response:W,attempt:D}));if(i)Y2(Q,i)}let H=c(Q),x=Q.attempt;if(!H||!x)return;Q.status=W.status;let q=Z.quotaFromHeaders?.(W.headers,W.status,x);if(q!==void 0)M(Q,"http",q,W.status);if(!W.ok&&Z.limitFromResponse){let D=await Z.limitFromResponse({status:W.status,headers:W.headers,body:()=>W.clone().text(),attempt:x});if(D)F2(Q,D,"http")}if(!W.ok||!W.body)y(Q);let O=W;if(W.body&&(Z.inspectEvent||Z.onAttemptEnd)){let D=W.body;if(Z.inspectEvent)D=D.pipeThrough(e2((i)=>d(Q,"http",i.data,i.event),(i)=>h("opencode2 auth event inspection threw",{error:v(i)})));O=new Response(z0(D,(i)=>y(Q,i)),{status:W.status,statusText:W.statusText,headers:W.headers})}if(Z.rewriteResponse)O=await Z.rewriteResponse({...H,request:G.request,response:O,attempt:x})??O;if(O!==W)G.response=O},K2)),W2.push(await $.session.hook("experimental.ws.handshake",(G)=>{if(X){let Q=Y(new Headers(G.headers)),W=L2(G.sessionID,G.kind);if(_.set(G.sessionID,Q),S.delete(W),!Q)return}return f(j2(G),async(Q)=>{let W;for(let O of Object.keys(G.headers)){if(O.toLowerCase()!==M2)continue;W??=G.headers[O],delete G.headers[O]}let H=X?await p(j2(G),"experimental.ws.handshake",Q,"ws"):await a(j2(G),"experimental.ws.handshake","ws",W,Q);Q();let x=c(H),q=H.attempt;if(!x||!q)throw s(H.scope);await U2(H,async()=>{$1(G.headers,H.headers);let O=Z.rewriteHandshakeURL?.({...x,url:G.url,attempt:q});if(O!==void 0)G.url=O;if(I(H.scope,Object.entries(G.headers)),X)S.add(H.key)})})},K2));let O1=Z.rewriteWebSocketFrame?.bind(Z);if(O1)W2.push(await $.session.hook("experimental.ws.send",async(G)=>{let Q=j2(G);if(X&&!S.has(L2(Q.sessionID,Q.kind)))return;let W=T2(Q.sessionID,Q.kind),H=await O1({...Q,attempt:W?.attempt,frame:G.frame});if(H!==void 0)G.frame=H},K2));W2.push(await $.session.hook("experimental.ws.receive",(G)=>{if(X&&!S.has(L2(G.sessionID,G.kind)))return;let Q=T2(G.sessionID,G.kind);if(!Q)return;try{d(Q,"ws",G.frame)}catch(W){h("opencode2 auth frame inspection threw",{error:v(W)})}},K2)),W2.push(await $.session.hook("retry",async(G)=>{if(X&&_.get(G.sessionID)!==!0)return;let Q=$0(G.sessionID);if(!Q)return;let W=G.decision;if(Q==="ambiguous"){await T("retry",{sessionID:G.sessionID,attempt:G.attempt,reason:"host-decides",hostDecision:W,decision:W});return}let H=Q;await f(H.scope,async(x)=>{let q=x;H.judged=!0;let O=H.attempt;if(O&&!H.outputStarted){if(!H.limit){let G2=Z.limitFromError?.(G.error,O);if(G2)F2(H,G2,"error")}if(H.ended)await H.ended;if(H.limit)await H.limit.delivered}q();let{decision:D,reason:i}=await P(H.scope.sessionID,async()=>{q();let G2=L.get(H.key);if(L.delete(H.key),G2?.next)await K(G2.next);q();let Z2=W,n,_2,t;if(H.accountId===void 0||!O)Z2={retry:!1},n="no-account";else if(H.outputStarted)Z2={retry:!1},n="output-started";else if(H.limit){let E2={accountId:H.accountId,limit:H.limit.signal},H2,k2={...H.scope,phase:"retry",previousAccountId:H.accountId,rerouteFrom:E2};try{H2=await Z.chooseAccount(k2)}catch(s2){h("opencode2 auth chooseAccount threw while the retry hook looked for another account; the host decides the retry",{sessionID:H.scope.sessionID,error:v(s2)})}if(H2!==void 0)t={accountId:H2,input:k2};try{q()}catch(s2){if(t)await K(t);throw s2}if(H2!==void 0&&H2!==H.accountId)H.rerouted=!0,_2=E2,Z2={retry:!0,delay:0},n="reroute";else n="host-decides-last-account"}else n="host-decides";if(G.decision=Z2,Z2.retry&&H.accountId!==void 0&&j.has(H.id))L.set(H.key,{attemptId:H.id,sessionID:H.scope.sessionID,accountId:H.accountId,..._2===void 0?{}:{rerouteFrom:_2},...t===void 0?{}:{next:t}});else if(t)await K(t);return{decision:Z2,reason:n}});q(),await T("retry",{sessionID:G.sessionID,...H.accountId===void 0?{}:{accountId:H.accountId},kind:H.scope.kind,attempt:G.attempt,reason:i,hostDecision:W,decision:D,...O===void 0?{}:{handle:O}})})},K2));let A1=(G)=>{l(G),_.delete(G);for(let Q of S)if(JSON.parse(Q)[0]===G)S.delete(Q);for(let Q of[...j.values()]){if(Q.scope.sessionID!==G)continue;b(Q,"its session was forgotten"),j.delete(Q.id)}for(let[Q,W]of L)if(W.sessionID===G)A(Q)},r2=new AbortController,R1=$.event;if(R1)(async()=>{try{for await(let G of R1.subscribe({signal:r2.signal}))if(G.type==="session.deleted")A1(G.data.sessionID)}catch(G){if(!r2.signal.aborted)h("opencode2 auth stopped listening for session deletion",{error:v(G)})}})();return{on(G,Q){let W=R.get(G);if(!W)W=new Set,R.set(G,W);let H=Q;return W.add(H),()=>{W.delete(H)}},accountFor(G,Q){return g(L2(G,Q))?.accountId},forgetSession:A1,get size(){return j.size},async dispose(){if(z2)return;z2=!0;for(let G of w.keys())l(G);r2.abort();for(let G of j.values())b(G,"the installation was disposed");j.clear();for(let G of L.keys())A(G);S.clear(),_.clear(),R.clear(),await Promise.all(V.values()),await Promise.all(W2.map(async(G)=>{try{await G.dispose()}catch(Q){h("opencode2 auth hook did not dispose cleanly",{error:v(Q)})}}))}}}import{createHash as X0}from"node:crypto";var Y0=1024,Q0=($)=>typeof $==="object"&&$!==null&&!Array.isArray($),b1=($)=>D1($,"user"),j0=($)=>Q0($)&&($.role==="assistant"||typeof $.type==="string"&&$.type!=="message"&&$.type!=="configuration_update");function V0($){return X0("sha256").update(JSON.stringify($)).digest("hex")}class A2{runtime;maxSessions;#$=new Map;constructor($,Z=Y0){this.runtime=$;this.maxSessions=Z}advance($,Z,J=this.runtime){let z=this.#$.get($),X=Array.isArray(Z.input)?Z.input:[],Y=X.filter(b1),F=X.findLastIndex(b1),N=F<0?void 0:V0(X[F]),U=typeof Z.previous_response_id==="string"&&Z.previous_response_id.length>0,j,B,L;if(U)j=Y.length>0,B=N??z?.fingerprint,L=z?.userCount===void 0?void 0:z.userCount+Y.length;else{B=N,L=Y.length;let _=F>=0&&F>X.findLastIndex(j0),u=z!==void 0&&!z.completed&&z.fingerprint===B&&z.userCount===L;j=_&&!u}let S=j||!z?{turnID:(J?.uuid??P2)(),turnStartedAt:(J?.now??Date.now)()}:{turnID:z.turnID,turnStartedAt:z.turnStartedAt};return this.#Z($,{...S,completed:!1,fingerprint:B,userCount:L}),S}completed($){let Z=this.#$.get($);if(Z)this.#Z($,{...Z,completed:!0})}get($){return this.#$.get($)}forget($){this.#$.delete($)}#Z($,Z){this.#$.delete($),this.#$.set($,Z);while(this.#$.size>this.maxSessions){let J=this.#$.keys().next().value;if(J===void 0)break;this.#$.delete(J)}}}function J1($,Z){return{threadID:$.threadID,windowID:$.windowID,turnID:Z.turnID,turnStartedAt:Z.turnStartedAt}}var k1=Symbol.for("@cortexkit/openai-auth/opencode2/codex-installation");function B0(){let $=globalThis;return $[k1]??=crypto.randomUUID(),$[k1]}class R2{runtime;store;sessions;frameTurns;installationID;constructor($,Z,J){this.runtime=$;this.store=J;this.installationID=Z??B0(),this.sessions=J?.sessions??new Map,this.frameTurns=J?.frameTurns??new A2}get($){let Z=this.runtime?.uuid??P2;if(this.store)return this.store.get($,Z);let J=this.sessions.get($);if(!J){let z=Z();J={threadID:z,turnID:Z(),windowID:`${z}:0`},this.sessions.set($,J)}return J}advanceFrame($,Z){return this.frameTurns.advance($,Z,this.runtime)}frameReceived($,Z){if(!Z.includes("response.completed"))return;if(w2(Z)?.type==="response.completed")this.frameTurns.completed($)}forget($){if(this.store)this.store.delete($);else this.sessions.delete($),this.frameTurns.forget($)}}var z1={version:w1,"user-agent":y1,originator:"codex_exec"};var U0=1024,W0=/(?:^|\/)gpt-6-(?:astra|sol|luna)$/i,f2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($),v1=($)=>f2($)&&($.type==="message"||("role"in $))&&$.role==="user",h1=($)=>f2($)&&$.type==="configuration_update";class G1{http;#$=new Map;constructor($=new R2){this.http=$}apply($,Z,J){if(Z.kind!=="primary")return!1;let z=typeof $.model==="string"?$.model:"";if(!f1.has(z))return!1;if(W0.test(z))return!1;let X=f2($.reasoning)?$.reasoning:void 0,Y=typeof X?.effort==="string"?X.effort:void 0;if(!Y)return!1;let F=this.#$.get(Z.sessionID);if(F===void 0)return this.#Z(Z.sessionID,Y),!1;if(Y===F)return!1;let N=Array.isArray($.input)?$.input:void 0;if(!N||N.length===0)return!1;let U=N.findLastIndex(v1);if(U<0){if(J==="http")return!1;return $.reasoning={...X,effort:F},!0}if($.reasoning={...X,effort:F},!h1(N[U-1]))N.splice(U,0,{type:"configuration_update",reasoning:{effort:Y}});return!0}forget($){this.#$.delete($),this.http.forget($)}#Z($,Z){this.#$.set($,Z);while(this.#$.size>U0){let J=this.#$.keys().next().value;if(J===void 0)break;this.#$.delete(J)}}}function w2($){try{let Z=JSON.parse($);return f2(Z)?Z:void 0}catch{return}}async function m1($,Z,J,z,X=J.http){if($.method.toUpperCase()!=="POST")return;if(!/\/responses\/?$/.test(new URL($.url).pathname))return;let Y=await $.clone().text(),F=w2(Y);if(F)delete F.max_output_tokens;let N=new Headers($.headers),U=y2({rewriteLite:I1,init:{body:F?JSON.stringify(F):$.body===null?void 0:Y},headers:N,metadata:X.get(Z.sessionID),installationID:X.installationID,runtime:X.runtime,websocket:!1,responsesLite:z,applyEffort:(j)=>{J.apply(j,Z,"http")}});return new Request($,{headers:N,body:U.init?.body})}function g1($,Z,J,z){let X=z.sessions.get($.sessionID),Y=z.frameTurns.get($.sessionID);if(!X||!Y)return;let F=J1(X,Y),N=new Headers({"content-type":"application/json"});for(let j of["chatgpt-account-id","x-opencode-parent-session-id","x-parent-session-id"]){let B=J.get(j);if(B!==null)N.set(j,B)}y2({init:{body:$.bodyText},headers:N,metadata:F,installationID:z.installationID,runtime:z.runtime,websocket:!1,skipTurnUpdate:!0,responsesLite:!1,rewriteLite:()=>{}});let U=new URL(Z);if(U.protocol==="wss:")U.protocol="https:";if(U.protocol==="ws:")U.protocol="http:";return new Request(U,{method:"POST",headers:N,body:$.bodyText})}function H0($,Z){if(JSON.stringify($)===JSON.stringify(Z))return!0;if(!Array.isArray($)||!Array.isArray(Z)||Z.length!==$.length+1)return!1;let J=Z.findIndex((z,X)=>JSON.stringify(z)!==JSON.stringify($[X]));return J>=0&&h1(Z[J])&&v1(Z[J+1])&&JSON.stringify(Z.slice(J+1))===JSON.stringify($.slice(J))}function l1($,Z,J){let z=w2($);if(z?.type!=="response.create")return;let X=J.http.advanceFrame(Z.sessionID,z),Y=J.http.get(Z.sessionID);delete z.max_output_tokens;let F=y2({rewriteLite:()=>{},init:{body:JSON.stringify(z)},headers:new Headers,metadata:J1(Y,X),installationID:J.http.installationID,runtime:J.http.runtime,websocket:!0,responsesLite:!1,applyEffort:(U)=>{J.apply(U,Z,"ws")}}),N=w2(String(F.init?.body));if(!N)return;if(!H0(z.input,N.input)){if("input"in z)N.input=z.input;else delete N.input;return JSON.stringify(N)}return String(F.init?.body)}function N0($){return $.replace(/\/responses\/?$/,"").replace(/\/$/,"")}function X1($,Z){let J=new URL($);if(J.origin!=="https://api.openai.com"&&J.origin!=="wss://api.openai.com"||!/\/responses\/?$/.test(J.pathname))return $;let z=new URL(`${N0(Z)}/responses`);if(z.search=J.search,J.protocol==="ws:"||J.protocol==="wss:")z.protocol=z.protocol==="https:"?"wss:":"ws:";return z.href}import{resolve as u1}from"node:path";var F0=1024;class I2{accounts=new Map;limit;constructor($=F0){this.limit=Math.max(1,$)}record($,Z){this.accounts.delete($),this.accounts.set($,Z);while(this.accounts.size>this.limit){let J=this.accounts.keys().next().value;if(J===void 0)break;this.accounts.delete(J)}}activeAccount($){return this.accounts.get($)}forget($){this.accounts.delete($)}get size(){return this.accounts.size}}var p1=Symbol.for("@cortexkit/openai-auth/opencode2-session-accounts"),c1=globalThis,Y1=c1[p1]??new Map;c1[p1]=Y1;function Q1($){let Z=JSON.stringify([u1($.configPath),u1($.statePath)]),J=Y1.get(Z);if(!J)J=new I2,Y1.set(Z,J);return J}var X2="openai",K0=60000,j1=1,L0="request refused: no account with a usable credential",V2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($);function P0($){let Z=V2($)?$.counters:void 0,J=V2(Z)?Z.resetCredits:void 0,z=V2(J)?J.value:void 0;return typeof z==="number"&&Number.isFinite(z)?z:void 0}function B1($){try{return JSON.parse($)}catch{return}}function d1($){let Z=h2($);return Z?m2(Z):void 0}var T0=new Set(["usage_limit_reached","rate_limit_exceeded"]);function U1($,Z,J){return{reason:$.window,...J!==void 0?{status:J}:{},...$.resetAt!==void 0?{retryAfterMs:Math.max(0,$.resetAt-Z)}:{}}}function _0($,Z){let J=v2($);if(J){let Y=typeof $.status==="number"?$.status:void 0;return U1(J,Z,Y)}if($.type!=="response.failed"||!V2($.response))return;let z=$.response.failed;if(V2(z)&&typeof z.rate_limit_reached_type==="string")return{reason:z.rate_limit_reached_type};let X=$.response.error;if(V2(X)){let Y=typeof X.code==="string"?X.code:typeof X.type==="string"?X.type:void 0;if(Y&&T0.has(Y))return{reason:Y}}return}function M0($,Z){let J=B1($);if(!V2(J))return;let z=typeof J.type==="string"?J.type:void 0;if(z==="codex.rate_limits")return{quota:{snapshot:o1(J),complete:!0}};let X=_0(J,Z);if(X)return{limit:X};if(z===void 0||z==="error")return;return U$(z)?void 0:{outputStarted:!0}}function C0($){let Z=!1;for(let J of $.keys())if(J.toLowerCase().startsWith("x-codex-")){Z=!0;break}if(!Z)return;return{snapshot:a1($),complete:n1($)}}function E0($){let Z=$.get("retry-after");if(Z===null)return;let J=Number(Z);return Number.isFinite(J)&&J>=0?J*1000:void 0}function W$($){let{source:Z,pins:J}=$,z=$.now??Date.now,X=$.log,Y=$.vault,F=new G1($.codex),N=new Map,U=new Map,j=(V)=>`${V.sessionID}\x00${V.kind}\x00${V.accountId}`,B=new Map,L=$.sessionAccounts??new I2,S=new Y$,_=(V,P,E)=>{let K=E?[]:B$(Z.peek().rows,V,P,Y?.identities()??new Set),A=(Y?.routes()??[]).filter((T)=>T.kind==="oauth"&&s1(S2(T.quota),V,P));return[...K.map((T)=>({id:T.id,...T.identity!==void 0?{identity:T.identity}:{},quota:T.quota,row:T})),...A.map((T)=>({id:T.id,...T.identity!==void 0?{identity:T.identity}:{},quota:T.quota}))]},u=(V,P,E)=>{let K=z$(V,P,E),A=V.map((b)=>({id:b.id,kind:"oauth",...i1(b.quota)?{quota:b.quota}:{}})),T=V.flatMap((b)=>b.row?[b.row]:[]),C=new Set(V.filter((b)=>!b.row).map((b)=>b.id)),y=Z.rateLimitMarks(T);for(let b of C){let m=B.get(b);if(m===void 0)continue;if(m<=E)B.delete(b);else y.set(b,m)}return{rows:A,now:E,rateLimitMarks:y,refreshBackoff:Z.refreshBackoffFor(T),killswitch:K,requestPull:(b)=>C.has(b)?Y?.requestReading(b):Z.requestReading(b)}},o=(V,P,E,K,A)=>{let T=Q$({...V,placement:G$(P),mainId:A});if(T.kind==="block"){X?.debug("pool admission refused the request",{reason:T.block.reason});return}let C=T.order.filter((y)=>!E.has(y));if(K!==void 0&&C.includes(K))return K;return C[0]},R=(V,P,E,K,A,T,C)=>{let y=new Map(P.map((l)=>[l.id,l.quota])),b={requestBytes:j1,reservePercent:(l)=>t1(E,l===Z$?void 0:l),resetCredits:(l)=>P0(y.get(l))},m=V1(V),g=(l,f)=>g2(C,{sessionId:K,requestBytes:j1,validPinnedAccountIds:V.rows.map((I)=>I.id).filter((I)=>!m.excluded.has(I)),excludeAccountIds:l,quotaCheckedAtByAccount:Object.fromEntries(V.rows.map((I)=>[I.id,m.projections.get(I.id)?.checkedAt])),wireAccountIdByAccount:Object.fromEntries(P.map((I)=>[I.id,I.identity])),select:(I)=>j$(V,b,new Set(l),I),persist:f},(I,$2)=>C.set(I,$2)),r=[...A],e=g(r,T);if(!e)return;let c=e.accountId,s=V$(V,b,c);if(s.kind==="none")return;if(s.kind==="move"){let l=g([...r,c],T);if(l)return l.accountId;return s.reason==="killswitch"?void 0:c}if(s.kind==="detour")return g([...r,c],!1)?.accountId;return c},w={providerID:X2,dropChoice(V){let P=j(V);U.get(P)?.drop(),U.delete(P),N.delete(P)},chooseAccount:async(V)=>{let P=await Y?.authority(),E=await $.storage(),K=P!==void 0&&P!=="local",A=()=>{throw new J2({kind:"no-account",providerID:X2,sessionID:V.sessionID,requestKind:V.kind,message:l2})};if(K)await $.awaitVaultRoster?.();else{if(!(await Z.current()).active){if(await $.slotPlaceholderWithoutMain?.())A();X?.warn("the account pool does not serve requests yet; refusing the request",{kind:V.kind});return}await Z.prepareTokens(Z.peek().rows,E)}let T=z(),C=_(E,T,K),y=X$(u(C.filter((I)=>I.id!==V.rerouteFrom?.accountId),E,T));if(y)await y,T=z(),C=_(E,T,K);let b=new Map(C.map((I)=>[I.id,I])),m=u(C,E,T),g=new Set(V.rerouteFrom?[V.rerouteFrom.accountId]:[]),r=E?.routing?.mode??"main-first",e=V.kind==="primary",c=new Set,s,l,f;try{for(;;){let I=new Set([...g,...c]);if(f=void 0,s=void 0,r==="sticky-balanced"){let p=new Map(J.placementSnapshot(V.sessionID)),a=p.get(V.sessionID);if(f=R(m,C,E,V.sessionID,I,e&&c.size===0,p),f!==void 0&&p.get(V.sessionID)!==a)s=p.get(V.sessionID)}if(f??=o(m,r,I,e?void 0:L.activeAccount(V.sessionID),K?r==="sticky-balanced"?null:J$(Y?.routes()??[]):void 0),f===void 0||c.has(f)){if(g.size>0){let p=new Map(m.rateLimitMarks);for(let a of g)p.delete(a);m={...m,rateLimitMarks:p},g.clear();continue}f=void 0;break}if(e&&r==="sticky-balanced"){let p=V1(m).projections.get(f)?.checkedAt,a=b.get(f)?.identity;l=J.reserve(V.sessionID,{accountId:f,inputBytes:j1,...p!==void 0?{quotaCheckedAt:p}:{},...a!==void 0?{wireIdentity:a}:{}})}let $2=b.get(f)?.row;if($2){if(Z.usableToken($2)!==void 0)break;X?.debug("pool row holds no usable token; choosing again",{accountId:f})}else{if(!Y)break;let p=await Y.authorize(f);if(p){N.set(j({...V,accountId:f}),p);break}X?.debug("the vault refused to serve an account; choosing again",{accountId:f})}if(l)J.rollback(l);l=void 0,c.add(f)}if(f===void 0&&!K&&C.length===0&&await $.slotPlaceholderWithoutMain?.())A();if(f===void 0&&K&&Y&&(C.length===0||c.size>0)){let I=c.size>0?"vault-refused":$$(Y);throw X?.warn("vault mode: no vault account can serve; refusing the request",{cause:I}),new J2({kind:"no-account",providerID:X2,sessionID:V.sessionID,requestKind:V.kind,message:e1(I,Y.name)})}if(f!==void 0){let I=f,$2=l,p=s,a=()=>{if($2)J.finish($2,p);if(e)L.record(V.sessionID,I),$.onRoute?.(V.sessionID,I,r)};if(V.phase==="retry")U.set(j({...V,accountId:f}),{commit:a,drop:()=>{if($2)J.rollback($2)}}),l=void 0;else a();let U2=X?.info;S.served(m,f,X&&U2?{info:(T2,F2)=>U2.call(X,T2,F2)}:void 0)}return X?.debug("pool account chosen",{kind:V.kind,accountId:f,mode:r,...V.rerouteFrom?{rerouteFrom:V.rerouteFrom.accountId}:{}}),f}finally{if(l)J.rollback(l)}},accountHeaders:async(V)=>{let{accountId:P}=V,E=j(V),K=U.get(E);U.delete(E);let A=()=>{K?.commit()};try{let T=()=>new J2({kind:"no-account",providerID:X2,sessionID:V.sessionID,requestKind:V.kind,message:L0}),C=Y&&await Y.authority()!=="local"?void 0:Z.peek().rows.find((m)=>m.id===P);if(!C&&Y){let m=j(V),g=N.get(m)??await Y.authorize(P);if(N.delete(m),!g)throw X?.warn("the vault refused to serve an account; refusing the request",{accountId:P}),T();return A(),{headers:{...z1,"session-id":V.sessionID,authorization:`Bearer ${g.accessToken}`,"chatgpt-account-id":g.accountIdentity??d1(g.accessToken)??null},attempt:{kind:"vault",routeId:P,receipt:g}}}let y=C?Z.usableToken(C):void 0;if(!C||!y)throw X?.warn("pool row holds no usable token; refusing the request",{accountId:P}),T();let b=C.identity??d1(y);return A(),{headers:{...z1,"session-id":V.sessionID,authorization:`Bearer ${y}`,"chatgpt-account-id":b??null},attempt:{kind:"pool",token:y,credentialEpoch:C.credentialEpoch}}}finally{K?.drop()}},async rewriteRequest({request:V,sessionID:P,kind:E}){let K=$.codexEndpoint?X1(V.url,$.codexEndpoint()):V.url,A=K===V.url?V:new Request(K,V);return await m1(A,{sessionID:P,kind:E},F,$.responsesLite?.()??!1)??A},rewriteHandshakeURL:({url:V})=>$.codexEndpoint?X1(V,$.codexEndpoint()):void 0,rewriteWebSocketFrame:({frame:V,sessionID:P,kind:E})=>l1(V,{sessionID:P,kind:E},F),quotaFromHeaders:(V)=>C0(V),async limitFromResponse({status:V,headers:P,body:E}){if(V<400)return;let K=B1(await E().catch(()=>"")),A=v2({...V2(K)?K:{},status:V});if(!A)return;let T=z(),C=U1(A,T,V);if(C.retryAfterMs!==void 0)return C;let y=E0(P);return y===void 0?C:{...C,retryAfterMs:y}},inspectEvent:({data:V})=>M0(V,z()),limitFromError(V){let P=B1(V.message),E=v2({...V2(P)?P:{},...V.status!==void 0?{status:V.status}:{}})??(V.message.includes("usage_limit_reached")?{window:"usage_limit_reached"}:void 0);return E?U1(E,z(),V.status):void 0},async onAttemptEnd(V,P){let E=V.data;if(E?.kind!=="vault"||P.status!==401)return;X?.warn("a vault account answered 401; reporting it to the vault",{accountId:V.accountId}),await Y?.reportFailure(E.receipt,401)}},h=(V,P,E)=>{let K=E.data;if(K?.kind==="vault"){Y?.recordSnapshot(V,P.snapshot,P.complete,K.receipt);return}if(K?.kind!=="pool")return;if(Z.peek().rows.find((T)=>T.id===V)?.credentialEpoch!==K.credentialEpoch){X?.debug("quota reading dropped: the row holds another credential",{accountId:V});return}Z.recordSnapshot(V,P.snapshot,K.token,P.complete)},v=(V,P,E)=>{let K=z(),A=E.data?.kind==="vault",T=A?Y?.routes().find((b)=>b.id===V)?.quota:Z.peek().rows.find((b)=>b.id===V)?.quota,C=r1(S2(T),P.reason,K,K0,P.retryAfterMs!==void 0?K+P.retryAfterMs:void 0);if(!A){Z.markRateLimited(V,C);return}let y=B.get(V);if(y===void 0||y<C)B.set(V,C)};return{adapter:w,attach(V){V.on("quota",(P)=>h(P.accountId,P.quota,P.handle)),V.on("limit",(P)=>{v(P.accountId,P.limit,P.handle),X?.debug("pool row refused the request",{accountId:P.accountId,via:P.via,reason:P.limit.reason,outputStarted:P.outputStarted})})},forgetSession(V){J.forget(V),L.forget(V),F.forget(V)},activeAccount:(V)=>L.activeAccount(V)}}import{resolve as P$}from"node:path";import{Buffer as O0}from"node:buffer";import{resolve as H$}from"node:path";function x2($){return O0.byteLength(JSON.stringify($))}function A0($){return $.reduce((Z,J)=>Z+x2(J),0)}function W1($,Z){return 2+$+Math.max(0,Z-1)}function R0($){let{head:Z,pending:J}=$;return 10+$.fieldsBytes+1+(Z?22+Z.responseIDBytes+9+W1(Z.inputBytes,Z.input.length)+1:0)+(J?20+W1(J.inputBytes,J.input.length)+10+W1(J.outputBytes,J.output.length)+(J.responseID===void 0?0:14+J.responseIDBytes)+1:0)}function N$($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z))return Z}catch{}return}class F${enabled;caps=u2;entries=new Map;bytes=0;constructor($=!1){this.enabled=$}setEnabled($){if(this.enabled=$,!$)this.entries.clear(),this.bytes=0}send($,Z){if(!this.enabled)return;let J=N$(Z);if(J?.type!=="response.create")return;if(!Array.isArray(J.input)){this.forget($);return}let z=J.previous_response_id,X=this.entries.get($),Y=X?.head;if(z&&z!==Y?.responseID){this.forget($);return}let{type:F,previous_response_id:N,input:U,...j}=J;this.keep($,{fields:z&&X?X.fields:j,fieldsBytes:z&&X?X.fieldsBytes:x2(j),...z&&Y?{head:Y}:{},pending:{input:U,inputBytes:A0(U),output:[],outputBytes:0,responseIDBytes:0},bytes:0})}receive($,Z,J){if(!this.enabled||!Z.includes("response.created")&&!Z.includes("response.output_item.done")&&!Z.includes("response.completed"))return;let z=this.entries.get($);if(!z?.pending)return;let X=N$(Z);if(!X)return;let Y=z.pending,F=X.response;if(X.type==="response.created"&&typeof F?.id==="string")Y.responseID=F.id,Y.responseIDBytes=x2(F.id),this.keep($,z);else if(X.type==="response.output_item.done"&&X.item){if(typeof X.response_id==="string"&&Y.responseID!==void 0&&X.response_id!==Y.responseID)return;Y.output.push(X.item),Y.outputBytes+=x2(X.item),this.keep($,z)}else if(X.type==="response.completed"&&typeof F?.id==="string"){if(F.id===z.head?.responseID||Y.responseID!==void 0&&F.id!==Y.responseID)return;let N={responseID:F.id,responseIDBytes:Y.responseID===F.id?Y.responseIDBytes:x2(F.id),input:[...z.head?.input??[],...Y.input,...Y.output],inputBytes:(z.head?.inputBytes??0)+Y.inputBytes+Y.outputBytes},U={...z,head:N,pending:void 0};if(!this.keep($,U))return;J?.({sessionID:$,responseID:N.responseID,bodyText:this.body(z.fields,N)})}}replay($){let Z=this.entries.get($);if(!Z?.head)return;return this.entries.delete($),this.entries.set($,Z),this.body(Z.fields,Z.head)}forget($){let Z=this.entries.get($);if(Z)this.bytes-=Z.bytes;this.entries.delete($)}status(){return{bytes:this.bytes,sessions:[...this.entries].map(([$,Z])=>({sessionID:$,bytes:Z.bytes,responseID:Z.head?.responseID,pending:Z.pending!==void 0}))}}body($,Z){return JSON.stringify({...$,input:Z.input,stream:!0})}keep($,Z){let J=R0(Z);if(this.forget($),J>this.caps.maxBytes)return!1;Z.bytes=J,this.entries.set($,Z),this.bytes+=J;while(this.entries.size>this.caps.maxTargets||this.bytes>this.caps.maxBytes){let z=this.entries.keys().next().value;if(z===void 0)break;this.forget(z)}return this.entries.has($)}}var K$=Symbol.for("@cortexkit/openai-auth/opencode2-frame-mirror"),L$=globalThis,H1=L$[K$]??new Map;L$[K$]=H1;function p2($){let Z=JSON.stringify([H$($.configPath),H$($.statePath)]),J=H1.get(Z);if(!J)J=new F$,H1.set(Z,J);return J}var S0=5000,x0=["accept","originator","session-id","thread-id","user-agent","version","x-client-request-id","x-codex-beta-features","x-codex-turn-metadata","x-codex-window-id","x-openai-internal-codex-responses-lite","x-opencode-parent-session-id","x-parent-session-id"],q0=["x-opencode-parent-session-id","x-parent-session-id"];function C$($){let Z=T$($);return{enabled:Z?.enabled===!0,subagents:Z?.subagents===!0,sustain:Z?.sustain===!0,window:_$($?{...$,cachekeep:Z}:$)}}var E$=Symbol.for("@cortexkit/openai-auth/opencode2-cache-keep"),O$=globalThis,q2=O$[E$]??new Map;O$[E$]=q2;function b0($,Z){let J=[],z=()=>J.at(-1)?.location,X=()=>{let U=z();if(!U)throw Error("no location holds keep-warm");return U},Y=(U,j)=>{N.remove(U),z()?.log?.debug(`cachekeep dropped target (${j})`,{sessionKey:U})},F=async(U)=>{if(U.meta.credentialMode!=="local")throw Error("a target captured in vault mode is not warmed with a local credential");let j=U.accountId??"main",B=X(),L=await B.source.accessFor(j,await B.storage());if(!L)throw Error(`pool row ${j} has no usable token`);return{token:L.token,identity:L.row.identity}},N=M$({...u2,now:$.now,...$.setIntervalImpl?{setIntervalImpl:$.setIntervalImpl}:{},...$.clearIntervalImpl?{clearIntervalImpl:$.clearIntervalImpl}:{},codexResponsesUrl:$.codexResponsesUrl,fetchImpl:(U,j)=>X().fetch(U,j),logger:{debug:(U,j)=>z()?.log?.debug(U,j),warn:(U,j)=>z()?.log?.warn(U,j)},getWindow:()=>z()?.settings().window,getSustain:()=>z()?.settings().sustain===!0,resolveLocal:F,vault:{owns:(U)=>z()?.vault.owns(U)===!0,authority:()=>X().vault.authority(),send:async(U,j,B)=>{let L=X();if(await L.vault.authority()!=="vault")return;return L.vault.send(U,j,B)}},activeAccount:(U)=>{if(U===void 0)throw Error("target has no session");let j=z(),B=j?.settings();if(!j||!B?.enabled){Y(U,"keep-warm is off");return}if(!B.subagents&&N.status().targets.some((S)=>S.sessionKey===U&&S.isSubagent)){Y(U,"subagent warming is off");return}let L=j.accounts.activeAccount(U);if(L===void 0){Y(U,"no account recorded for the session");return}return L},verifyCredential:({target:U,mode:j,identity:B})=>{if(U.meta.credentialMode!==j)throw Error(`a target captured in ${U.meta.credentialMode??"an unknown"} mode is not warmed with a ${j} credential`);if(B!==U.meta.chatgptAccountId)throw Y(U.sessionKey,"the account signs in as another login now"),Error("the account signs in as another login now")}});return{manager:N,settings:Z,holders:J,joinTimeoutMs:$.joinTimeoutMs??S0}}function D0($){try{let Z=JSON.parse($),J=Array.isArray(Z.input)?Z.input.at(-1):void 0;if(J?.role!=="user")return!1;return(typeof J.content==="string"?J.content:Array.isArray(J.content)?J.content.map((X)=>typeof X?.text==="string"?X.text:"").join(""):"").startsWith("This is a keep-alive request.")}catch{return!1}}function k0($){let Z={};for(let J of x0){let z=$.get(J);if(z)Z[J]=z}return Z}function A$($,Z,J){let z=JSON.stringify([P$($.configPath),P$($.statePath)]),X=q2.get(z);if(!X)X=b0(J,Z.settings()),q2.set(z,X);let Y=X,F=p2($);F.setEnabled(Y.settings.enabled);let N={location:{...Z,settings:()=>Y.settings}};Y.holders.push(N);let U=!1,j=async(B)=>{try{let L=N.location.settings();if(U||!L.enabled)return;if(B.kind!=="primary"){if(B.kind==="generate"&&D0(await B.request.clone().text())){if(U)return;Y.manager.remove(B.sessionID)}return}let S=B.attempt.data,_=S?.kind==="pool"?"local":S?.kind==="vault"?"vault":void 0;if(!_)return;let u=B.request.headers,o=q0.some((z2)=>u.has(z2))||Z.parentOf!==void 0&&await Z.parentOf(B.sessionID)!==void 0;if(o&&!L.subagents)return;let R=await B.request.clone().text();if(U)return;let k=u.get("chatgpt-account-id")??void 0;Y.manager.track({sessionKey:B.sessionID,bodyText:R,accountId:B.attempt.accountId,isSubagent:o,meta:{replayHeaders:k0(u),...k?{chatgptAccountId:k}:{},routingSessionId:B.sessionID,url:B.request.url,credentialMode:_}})}catch(L){Z.log?.warn("cachekeep capture failed",{error:L instanceof Error?L.message:String(L)})}};return{manager:Y.manager,configure:(B)=>{Object.assign(Y.settings,B),F.setEnabled(Y.settings.enabled)},capture:j,forget:(B)=>Y.manager.remove(B),async release(){if(U)return;U=!0;let B=Y.holders.indexOf(N);if(B>=0)Y.holders.splice(B,1);if(Y.holders.length>0)return;if(q2.get(z)===Y)q2.delete(z);Y.manager.stop();let L;try{await Promise.race([Y.manager.tick().catch(()=>{}),new Promise((S)=>{L=setTimeout(S,Y.joinTimeoutMs),L.unref?.()})])}finally{clearTimeout(L)}}}}import{mkdirSync as w0}from"node:fs";import{dirname as y0,join as f0,resolve as I0}from"node:path";var v0="openai-auth-sessions-opencode2.json";function h0(){return f0(S$(),v0)}var m0="sessions",g0=1e4,l0=5000,u0=25;class D${path;options;sessions;frameTurns=new A2;#$=new Set;#Z=new Set;#J=Promise.resolve();#z=!1;constructor($,Z={}){this.path=$;this.options=Z;this.sessions=q$($,Z.uuid??P2)}get($,Z=P2){let J=this.sessions.get($);if(!J){let z=Z();J={threadID:z,turnID:Z(),windowID:`${z}:0`},this.sessions.set($,J),this.#Z.delete($),this.#$.add($),this.save()}return J}delete($){this.sessions.delete($),this.frameTurns.forget($),this.#$.delete($),this.#Z.add($),this.save()}save(){if(!this.#z)this.#z=!0,this.#J=this.#J.then(()=>{return this.#z=!1,this.#G()});return this.#J}settled(){return this.#J}async#G(){if(this.#$.size===0&&this.#Z.size===0)return;let $=[...this.#$].flatMap((z)=>{let X=this.sessions.get(z);return X?[[z,X]]:[]}),Z=[...this.#Z],J=null;try{if(w0(y0(this.path),{recursive:!0}),J=await this.#X(),!J)return;let z;try{z=x$(this.path)}catch{z=new Map}await this.options.afterRead?.();for(let X of Z)z.delete(X);for(let[X,Y]of $)z.set(X,Y.threadID);b$(this.path,z)}catch{return}finally{await J?.release().catch(()=>{})}for(let[z,X]of $)if(this.sessions.get(z)===X)this.#$.delete(z);for(let z of Z)if(!this.sessions.has(z))this.#Z.delete(z)}async#X(){let $=performance.now()+(this.options.lockWaitMs??l0);for(;;){let Z=await R$({name:m0,path:this.path,ttlMs:g0});if(Z||performance.now()>=$)return Z;await new Promise((J)=>setTimeout(J,u0))}}}var k$=Symbol.for("@cortexkit/openai-auth/opencode2-codex-sessions"),w$=globalThis,N1=w$[k$]??new Map;w$[k$]=N1;function y$($=h0()){let Z=I0($),J=N1.get(Z);if(!J)J=new D$(Z),N1.set(Z,J);return J}var f$=Symbol.for("cortexkit.openai-auth.v2.commands");function p0(){let $=globalThis;return $[f$]??={locations:new Map},$[f$]}async function p$($,Z){let J=p0(),z=$.location.directory,X={menu:Z,session:$.session},Y=await v$(z),F=await I$(l$,Y.dir,()=>u$({...Y,drain:m$,apply:(B)=>{let L=J.locations.get(z);if(!L)throw Error("The OpenAI menu location was closed");return L.menu.apply(B)}})),N=J.locations.get(z);J.locations.set(z,X),await N?.registration?.dispose(),J.command??={name:"openai",description:"OpenAI account menu",async execute(B){let L=J.locations.values().next().value?.session;if(!L)return;let S=await L.get({sessionID:B.sessionID}),_=J.locations.get(S.location.directory);if(!_||!g$(B.sessionID))return;let u=await _.menu.open(B.sessionID);h$(u,B.sessionID)}};let U=J.command;try{X.registration=await $.command.transform((B)=>{B.add(U)})}catch(B){if(J.locations.get(z)===X)J.locations.delete(z);throw await F.release(),B}let j=!1;return async()=>{if(j)return;if(j=!0,J.locations.get(z)===X)J.locations.delete(z);await F.release(),await X.registration?.dispose()}}var c0="openai-auth-pool-browser",d0="openai-auth-pool-headless",i0="openai-auth-vault",a0="Vault login requires this OpenCode host to be enrolled in the Claustrum vault. Connect to the vault or disconnect this host before trying again.";async function b2($){if(await $.authority()!=="local")throw Error("This host is connected to the credential vault or its enrollment is unreadable; the login was not stored. Disconnect this host from the vault to add a local login.")}function o$($){return{method:{id:i0,type:"oauth",label:"ChatGPT accounts in the vault"},async activate(){if(await c$($.paths,$.name)!=="vault")throw Error(a0)}}}function r$($){let Z=(J,z,X)=>({method:{id:J,type:"oauth",label:z},async authorize(){if($.vault)await b2($.vault);let Y=await $.beginLogin({version:$.version,headless:X});return{url:Y.url,instructions:Y.instructions,mode:"auto",callback:Y.completion}}});return[Z(c0,"ChatGPT (openai-auth pool, browser)",!1),Z(d0,"ChatGPT (openai-auth pool, headless)",!0)]}function F1($){let Z=(J)=>typeof J==="string"?J:"";return O2({type:"oauth",access:Z($.access),refresh:Z($.refresh)})||$.refresh===a$||d$($)}function n0($){if($.accountId)return $.accountId;let Z=$.access?h2($.access):void 0;return Z?m2(Z):void 0}async function s$($,Z,J,z={}){if(z.vault)await b2(z.vault);if(F1(J))throw Error("the credential is not a ChatGPT login (a placeholder or a tombstone); it was not stored");let X=i$($,{rowLocks:(_)=>n$(Z,_)}),Y=await X.read();if(Y.status!=="ready")throw Error(`the account pool cannot be read (${Y.status}); the login was not stored`);let F={type:"oauth",refresh:J.refresh,...J.access!==void 0?{access:J.access}:{},...J.expires!==void 0?{expires:J.expires}:{}},N=n0(J);if(z.vault)await b2(z.vault);let U=N!==void 0?{identity:N}:{};if(z.origin==="import"){let _=Y.rows.find((u)=>N!==void 0&&u.identity===N||u.credential?.type==="oauth"&&u.credential.refresh===J.refresh);if(_)return{id:_.id,operation:"kept"}}let j=Y.rows.filter((_)=>_.type==="oauth"&&!_.invalid),B=N?j.find((_)=>_.identity===N):void 0,L=Y.rows.find((_)=>_.id===c2);if(B)return{id:(await X.replace(B.id,F,U)).id,operation:"replaced"};if(!L){let _=await X.add({id:c2,credential:F,...U,...J.label!==void 0?{label:J.label}:{}});return{id:_.id,operation:_.outcome==="added-disabled"?"added-disabled":"added"}}if(!L.invalid&&!L.credential)return{id:(await X.replace(c2,F,U)).id,operation:"replaced"};let S=await X.add({id:J.id,credential:F,...U,...J.label!==void 0?{label:J.label}:{}});return{id:S.id,operation:S.outcome==="added-disabled"?"added-disabled":S.outcome==="rotated"?"replaced":"added"}}function o0($){let Z=$.itemId!==void 0;switch($.sectionId){case"accounts":return Z?["enable","disable","remove","move"].includes($.actionId):$.actionId==="add";case"routing":return!Z&&["order","mode"].includes($.actionId);case"quota":return $.actionId==="check";case"limits":return Z?$.actionId==="floors":$.actionId==="killswitch";case"session":return!Z&&$.actionId==="clear-pin";case"diagnostics":return!Z&&["logging","dump"].includes($.actionId);case"cache":return!Z&&["enabled","subagents","sustain","window"].includes($.actionId);case"reset":return Z&&["preview","spend","retry"].includes($.actionId);default:return!1}}function $Z($){let Z={...$,allowAction:o0,unavailableSections:[]};return{open:(J)=>t$(Z,J),apply:(J)=>{let z=J!==null&&typeof J==="object"?J:{},X=z.values&&typeof z.values==="object"&&!Array.isArray(z.values)?Object.fromEntries(Object.entries(z.values).filter(([,Y])=>Y===null||["string","number","boolean"].includes(typeof Y))):void 0;return e$(Z,{command:"openai",sectionId:typeof z.sectionId==="string"?z.sectionId:"",actionId:typeof z.actionId==="string"?z.actionId:"",...X?{values:X}:{},...z.confirmed===!0?{confirmed:!0}:{},...typeof z.itemId==="string"?{itemId:z.itemId}:{},...typeof z.sessionId==="string"?{sessionId:z.sessionId}:{}})}}}function r0($){if(!ZZ($.modelID??$.id)){$.enabled=!1;return}let Z=JZ($.id);if(Z)$.limit={...Z}}function zZ($){return $.model.transform((Z)=>{for(let J of Z.list(X2))Z.update(X2,String(J.id),(z)=>r0(z))})}class K1{log;pending=new Map;requests=new Map;writing=new Set;constructor($){this.log=$}async safely($){let Z=(async()=>{try{await $()}catch{this.log.warn("request dump failed")}})();this.writing.add(Z);try{await Z}finally{this.writing.delete(Z)}}async captureHttp($,Z){if(!GZ())return;await this.safely(async()=>{let J={sessionID:Z.sessionID,accountId:Z.accountId,transport:"http",phase:"http",url:$.url,method:$.method,headers:new Headers($.headers),bodyText:await $.clone().text()};if(this.pending.set($,{attemptId:Z.attemptId,input:J}),this.requests.set(Z.attemptId,$),this.pending.size>512){let z=this.pending.keys().next().value;if(z)this.take(z)}})}take($){let Z=this.pending.get($);if(Z)this.pending.delete($),this.requests.delete(Z.attemptId);return Z?.input}async response($,Z){let J=this.take($);if(J)await this.safely(()=>d2({...J,status:Z}))}async end($,Z){if(Z.status!==void 0||!Z.error)return;let J=this.requests.get($.attemptId),z=J&&this.take(J);if(!z)return;let{reason:X,message:Y}=Z.error,F=Y?`${X}: ${Y}`:X;await this.safely(()=>d2({...z,error:i2(F,J?.headers.get("authorization")?.replace(/^Bearer /,""))}))}async frame($,Z){await this.safely(()=>d2({sessionID:Z.sessionID,accountId:Z.accountId,transport:"websocket",phase:"observed",bodyText:$}))}clear(){this.pending.clear(),this.requests.clear()}async settle(){await Promise.all(this.writing)}}class L1{counts=new Map;record($,Z){let J=Z.resetCreditsApplicable;this.counts.set($.id,{credentialEpoch:$.credentialEpoch,identity:$.identity,applicable:typeof J==="number"&&Number.isFinite(J)?J:void 0})}applicable($){let Z=this.counts.get($.id);if(!Z||Z.credentialEpoch!==$.credentialEpoch||Z.identity!==$.identity)return;return Z.applicable}}function VZ($){return async(Z)=>{let J=Z.credential;if(J.type!=="oauth"||!J.access)throw Error("the row holds no access token to poll with");let z=await XZ({accessToken:J.access,fetchImpl:$.fetchImpl,now:$.now,...Z.identity?{accountId:Z.identity}:{},accountKey:Z.id,...$.logger?{logger:$.logger}:{}});return $.counts.record(Z,z),YZ(z,$.now(),!0)}}function BZ($){let{source:Z,counts:J,now:z}=$,X=async(j)=>{let B=await Z.rowAccess(j,await $.storage());if(!B?.row)throw new QZ("unknown_account",`${j==="main"?"Main":"Fallback"} account ${j} was not found.`);return jZ(j,B)},Y=async(j)=>{if($.authority&&await $.authority()!=="local")return{account:j,ok:!1,error:"local accounts are not polled while this host is connected to the vault"};let[B]=await Z.pollRows(await $.storage(),{ids:[j]});if(!B)return{account:j,ok:!1,error:"targeted quota refresh returned no result"};return{account:B.id,ok:B.ok,...B.error!==void 0?{error:B.error}:{}}},F=(j)=>Z.peek().rows.find((B)=>B.id===j),N=(j)=>{let B=F(j);if(!B)return null;let L=S2(B.quota)??{},S=J.applicable(B),_=Math.max(0,...[L.primary?.checkedAt,L.secondary?.checkedAt].filter((u)=>typeof u==="number"));return{quota:{...L,...S!==void 0?{resetCreditsApplicable:S}:{}},checkedAt:_,refreshAfter:_,...B.identity!==void 0?{accountId:B.identity}:{}}};return{resolveResetTarget:X,refreshResetTargetQuota:Y,quotaManager:{isRateLimited:(j)=>{let B=F(j);if(!B)return!1;let L=Z.rateLimitMarks([B]).get(B.id);return L!==void 0&&L>z()},getMain:()=>N("main"),getFallback:(j)=>N(j)}}}import{resolve as UZ}from"node:path";var s0=1024;class P1{pins=new Map;reservations=new Map;listeners=new Set;limit;constructor($=s0){this.limit=Math.max(1,$)}get($){return this.pins.get($)?.accountId}forget($){this.reservations.delete($),this.pins.delete($);for(let Z of this.listeners)Z($)}subscribe($){return this.listeners.add($),()=>{this.listeners.delete($)}}snapshot(){return new Map(this.pins)}placementSnapshot($){let Z=new Map(this.pins);for(let J of this.reservations.values())if(J.sessionId!==$)Z.set(J.sessionId,J.pin);return Z}reserve($,Z){let J={sessionId:$,previous:this.pins.get($),pin:Z};return this.reservations.set($,J),J}rollback($){if(this.reservations.get($.sessionId)===$)this.reservations.delete($.sessionId)}finish($,Z){if(this.reservations.get($.sessionId)!==$)return;if(this.rollback($),Z&&this.pins.get($.sessionId)===$.previous)this.set($.sessionId,Z)}get size(){return this.pins.size}set($,Z){this.reservations.delete($),this.pins.delete($),this.pins.set($,Z);for(let J of this.listeners)J($,Z);while(this.pins.size>this.limit){let J=this.pins.keys().next().value;if(J===void 0)break;this.forget(J)}}place($){return g2(this.placementSnapshot($.sessionId),$,(Z,J)=>this.set(Z,J))}}var WZ=Symbol.for("@cortexkit/openai-auth/opencode2-pins"),HZ=globalThis,T1=HZ[WZ]??new Map;HZ[WZ]=T1;function NZ($){let Z=JSON.stringify([UZ($.configPath),UZ($.statePath)]),J=T1.get(Z);if(!J)J=new P1,T1.set(Z,J);return J}import{statSync as t0}from"node:fs";import{resolve as e0}from"node:path";function EZ($){return $.map((Z)=>{try{let J=t0(Z);return`${J.ino}:${J.size}:${J.mtimeMs}:${J.ctimeMs}`}catch{return"?"}}).join("|")}function _1($){return EZ([$.vault.paths.tokenPath,$.vault.paths.statePath])}function FZ($){return EZ([$.paths.configPath,$.paths.statePath,$.vault.paths.rosterPath])+_1($)}class OZ{file;observationIntervalMs;producers=new Set;subscriptions=new Map;observations=new Map;chain=Promise.resolve();timer;constructor($,Z){this.file=$;this.observationIntervalMs=Z}add($){this.producers.add($),this.observations.set($,{stamp:FZ($),roster:$.vault.snapshot()});let Z=$.source.subscribe(()=>{this.publish($)}),J=this.subscriptions.get($.pins);if(!J){let z=new Set;J={producers:z,stop:$.pins.subscribe((X,Y)=>{let F=z.values().next().value;if(F)this.publish(F,{sessionId:X,pin:Y,accountId:Y?.accountId,route:"sticky-balanced"})})},this.subscriptions.set($.pins,J)}return J.producers.add($),this.timer??=setInterval(()=>{for(let z of this.producers){let X={stamp:FZ(z),roster:z.vault.snapshot()},Y=this.observations.get(z);if(X.stamp!==Y?.stamp||X.roster!==Y?.roster)this.observations.set(z,X),this.publish(z)}},this.observationIntervalMs),this.timer.unref?.(),()=>{if(Z(),this.producers.delete($),this.observations.delete($),J.producers.delete($),!J.producers.size)J.stop(),this.subscriptions.delete($.pins);if(!this.producers.size)clearInterval(this.timer),this.timer=void 0}}publish($,Z){return this.chain=this.chain.then(async()=>{if(!this.producers.has($))return;let z=await $.vault.authority()!=="local",X=_1($),Y=()=>this.producers.has($)&&$.vault.enrolled()===z&&_1($)===X,F=await B2($.paths),N=z?MZ($.vault.snapshot()?.rows??[],new Set($.vault.routes().map((j)=>j.id)),F,Date.now()):CZ((await $.source.sidebarView()).rows,F,Date.now());if(await LZ(N,this.file,{canWrite:Y}),!Y()||!Z)return;let U=N.vaultAccounts??N.fallbacks;if(Z.accountId===void 0){await TZ(Z.sessionId,U,this.file,{canWrite:Y});return}if(Z.pin){let j=Date.now();await _Z({sessionId:Z.sessionId,assignment:{accountId:Z.pin.accountId,wireAccountId:Z.pin.wireIdentity,inputBytes:Z.pin.inputBytes??0,quotaCheckedAt:Z.pin.quotaCheckedAt,assignedAt:j,lastSeenAt:j},validPinnedAccountIds:[...z?[]:["main"],...U.filter((B)=>B.enabled).map((B)=>B.id)]},this.file)}await PZ({sessionId:Z.sessionId,activeId:Z.accountId,route:Z.route??N.route,updatedAt:Date.now()},U,this.file,{canWrite:Y})}).catch(()=>{N2("opencode2").warn("sidebar publication failed")}),this.chain}settled(){return this.chain}get empty(){return this.producers.size===0}}var AZ=Symbol.for("@cortexkit/openai-auth/opencode2-sidebar-publishers"),RZ=globalThis,D2=RZ[AZ]??new Map;RZ[AZ]=D2;function SZ($,Z=KZ(),J=2000){let z=e0(Z),X=D2.get(z);if(!X)X=new OZ(z,J),D2.set(z,X);let Y=X,F=Y.add($),N=!1;for(let[U,j]of $.pins.snapshot())Y.publish($,{sessionId:U,pin:j,accountId:j.accountId,route:"sticky-balanced"});return{publish:()=>Y.publish($),route:(U,j,B)=>{Y.publish($,{sessionId:U,accountId:j,route:B})},async release(){if(N)return;if(N=!0,F(),await Y.settled(),Y.empty&&D2.get(z)===Y)D2.delete(z)}}}var o2="cortexkit-openai-auth",J4=5000;async function xZ($,Z,J,z=new R2,X,Y,F){let N=new K1(J),U=new $4,j=new Map,B=new Map,L=(R)=>{B.delete(R);for(let k of j.keys())if(k.startsWith(`${R}:`))j.delete(k)},S=(R)=>{F?.(R.sessionID),Y?.send(R.sessionID,R.frame)},u=await Z1({session:{hook:(R,k,z2)=>$.session.hook(R,async(w)=>{let h=R==="http.request"?w:void 0,v=R==="experimental.ws.handshake"?w:void 0,P=(h?h.request.headers:v?new Headers(v.headers):void 0)?.get("authorization")===`Bearer ${Q2(Z.providerID)}`,E={};if(v)j.delete(`${v.sessionID}:${v.kind}`);try{await U.run(E,()=>k(w))}catch(K){if(P&&!(K instanceof J2))throw yZ(K);throw K}if(h&&P&&E.attempt){let K=h.request.headers.get("thread-id");if(K)h.request.headers.set("session-id",K)}if(h&&P&&E.attempt)await N.captureHttp(h.request,E.attempt);if(h&&P&&E.attempt)await X?.({sessionID:h.sessionID,kind:h.kind,request:h.request,attempt:E.attempt});if(v&&P&&E.attempt)v.headers["session-id"]=z.get(v.sessionID).threadID;if(R==="experimental.ws.send"){let K=w,A=j.get(`${K.sessionID}:${K.kind}`);if(A)await N.frame(K.frame,A.attempt);if(A&&K.kind==="primary")S(K)}if(h||v){let K=h??v;if(!K)return;let T=(h?h.request.headers:new Headers(K.headers)).get("authorization")?.replace(/^Bearer /,"");if(P&&T)B.set(K.sessionID,T);else B.delete(K.sessionID);if(v){let C=`${v.sessionID}:${v.kind}`;if(P&&T&&E.attempt)j.set(C,{bearer:T,attempt:E.attempt,url:v.url,headers:new Headers(Object.entries(v.headers).filter(([y])=>["chatgpt-account-id","x-opencode-parent-session-id","x-parent-session-id"].includes(y.toLowerCase())))});else j.delete(C)}if(B.size>512){let C=B.keys().next().value;if(C)B.delete(C)}if(j.size>512){let C=j.keys().next().value;if(C)j.delete(C)}}else if(R==="experimental.ws.receive"){let K=w,A=j.get(`${K.sessionID}:${K.kind}`);if(A){if(z.frameReceived(K.sessionID,K.frame),K.kind==="primary"){let T;if(Y?.receive(K.sessionID,K.frame,(C)=>{T=C}),T)try{let C=g1(T,A.url,A.headers,z);if(C)await X?.({sessionID:K.sessionID,kind:"primary",request:C,attempt:A.attempt})}catch(C){J.warn("cachekeep WebSocket capture failed",{error:C instanceof Error?C.message:String(C)})}}K.frame=fZ(K.frame,A.bearer)}}else if(R==="retry"){let K=w,A=B.get(K.sessionID);if(A)Object.assign(K.error,{message:i2(K.error.message,A)})}},z2)},event:{subscribe:(R)=>async function*(){for await(let k of $.event.subscribe(R)){if(k.type==="session.deleted")L(k.data.sessionID);yield k}}()}},{...Z,rewriteRequest:async(R)=>{let k=U.getStore();if(k)k.attempt=R.attempt;return Z.rewriteRequest?.(R)},rewriteHandshakeURL:(R)=>{let k=U.getStore();if(k)k.attempt=R.attempt;return Z.rewriteHandshakeURL?.(R)},onAttemptEnd:async(R,k)=>{await N.end(R,k),await Z.onAttemptEnd?.(R,k)},rewriteResponse:async(R)=>{await N.response(R.request,R.response.status);let k=await Z.rewriteResponse?.(R)??R.response;return IZ(k,R.request.headers.get("authorization")?.replace(/^Bearer /,""),"event-stream")}},{gateOnPlaceholder:{credential:(R)=>{let k=R.get("authorization");return k?.startsWith("Bearer ")?k.slice(7):void 0}},logger:{warn:(R,k)=>J.warn(R,{data:k})}}),o=u.dispose;return{...u,dispose:async()=>{B.clear(),j.clear(),await o(),await N.settle(),N.clear()}}}function E1($={}){return{id:o2,setup:(Z)=>z4(Z,$)}}async function z4($,Z={}){let a=[];try{let J=N2("opencode2");let z=N2("quota");let X=Z.paths??(()=>hZ(vZ()));let Y=await B2(X());let F=Y?.logging?.level;if(F&&typeof F==="string")bZ(F);let N=Z.fetch??fetch;let U=Z.now??Date.now;let j=Z.version??pZ;let B=Z.poolMigration??rZ;if(!B&&!C2(X().configPath)){J.info("openai-auth stands aside on OpenCode 2: this install has not moved into the account pool and the migration is switched off, so OpenCode 2 serves its own ChatGPT login");let M=(Y2)=>{throw new J2({kind:"no-account",providerID:X2,sessionID:Y2.sessionID,requestKind:Y2.kind,message:l2})},d=await xZ($,{providerID:X2,chooseAccount:M,accountHeaders:M},J);return()=>d.dispose()}let L=Z.vault?.firstRosterWaitMs??dZ;let S=oZ({host:"opencode",stateDir:Z.vault?.stateDir??wZ(X().statePath),reservedRouteIds:()=>w.peek().rows.map((M)=>M.id),...Z.vault?.connectionFile?{connectionFile:Z.vault.connectionFile}:{},...Z.vault?.connectScoped?{connectScoped:Z.vault.connectScoped}:{},...Z.vault?.connectEnrollment?{connectEnrollment:Z.vault.connectEnrollment}:{},...Z.vault?.pollIntervalMs!==void 0?{pollIntervalMs:Z.vault.pollIntervalMs}:{},fetchImpl:()=>N},X());let _=S.vault;let u=!1;let o=!1;const R=a2(a,{[Symbol.dispose](){if(!u)S.release()}},0);await _.authority();let k=S.firstRoster;let z2=new L1;let w=new iZ({paths:X,refreshProvider:async(M)=>{let d=await kZ({refreshToken:M.refresh,fetchImpl:N,now:U}),Y2=DZ({id_token:"",access_token:d.access,refresh_token:d.refresh});return{...d,...Y2?{identity:Y2}:{}}},pullQuota:VZ({fetchImpl:N,now:U,counts:z2,logger:z}),now:U,vaultIdentities:()=>_.identities(),vaultMode:()=>_.enrolled(),vaultAuthority:()=>_.authority(),vaultFirstRoster:k,vaultFirstRosterBackgroundWaitMs:L,log:N2("pool")});await w.load();let h=Z.heartbeat===!1?void 0:await nZ({version:j,logger:N2("heartbeat")});let v=Z.fence??(()=>uZ({currentVersion:j}));let V=Z.slot??sZ();let P=async()=>mZ(X(),await V.get({path:{id:"openai"}}));let E=!1;let K=B?aZ({paths:X,slot:V,version:j,fence:v,runDeps:{vaultServes:()=>_.serves()},paused:async()=>await _.authority()!=="local",migrate:async(M)=>{let d=await gZ(M);if(E=d.status==="refused",!o)await w.load();return d},adopt:async(M)=>{if(o)return{status:"retry",reason:"unsettled"};if(!await C1(k,L))return{status:"retry",reason:"vault-roster-pending"};if(o)return{status:"retry",reason:"unsettled"};let d=await lZ(M);if(!o)await w.load();return d}}):void 0;K?.start();S.start();let A=NZ(X());let T=SZ({paths:X(),source:w,pins:A,vault:_},Z.sidebarStateFile,Z.sidebarObservationIntervalMs);const C=a2(a,{[Symbol.dispose](){if(!u)T.release()}},0);T.publish();let y=Z.codex??new R2(void 0,void 0,y$());let b=C$(Y);let m=p2(X());let g=A$(X(),{source:w,storage:()=>B2(X()),vault:_,accounts:Q1(X()),settings:()=>b,parentOf:async(M)=>(await $.session.get({sessionID:M}))?.parentID??void 0,fetch:N,log:N2("cachekeep")},{now:U,codexResponsesUrl:n2().codexApiEndpoint,...Z.cacheKeep});const r=a2(a,{[Symbol.dispose](){if(!u)g.release()}},0);let e=W$({codex:y,onRoute:T.route,source:w,slotPlaceholderWithoutMain:P,storage:()=>B2(X()),pins:A,sessionAccounts:Q1(X()),vault:_,awaitVaultRoster:async()=>{await C1(_.awaitRequestRoster(),cZ)},responsesLite:()=>n2().responsesLite,codexEndpoint:()=>n2().codexApiEndpoint,now:U,log:J});let c=await xZ($,e.adapter,J,y,(M)=>g.capture(M),m,(M)=>g.forget(M));e.attach(c);let s=async(M)=>{if(await b2(_),C2(X().configPath))return;if(await K?.idle(),C2(X().configPath))return;if(E&&!F1(M)&&(await v()).open){await w.poolStore().initialize();return}throw Error("OpenAI accounts move to the shared account pool once every OpenCode process on this machine runs this version of openai-auth; the login was not stored. Update or close the older processes and sign in again.")};let l=async(M)=>{await s(M);let d=await s$(w.poolStore(),X(),M,{vault:_});if(!C2(X().configPath))await K?.requestAdoption();await w.load(),J.info("ChatGPT login stored in the account pool",d)};let f=await t2($,{integrationID:X2,methods:r$({beginLogin:Z.beginLogin??M1,version:j,vault:_}),onLogin:(M)=>l(M),label:"ChatGPT (openai-auth account pool)",vault:o$(_)});let I=await zZ($);if(Z.controlPlane&&(!$.command||!$.location))throw Error("OpenCode 2 control plane requires command and location APIs");let $2=$.command&&$.location?await p$({session:$.session,command:$.command,location:$.location},Z.controlPlane??$Z({...BZ({source:w,storage:()=>B2(X()),counts:z2,now:U,authority:()=>_.authority()}),fetchImpl:N,now:U,randomUUID:Z4,accountStoragePath:X().configPath,accountStatePath:X().statePath,packageVersion:j,loadAccounts:B2,store:()=>w.poolStore(),migration:async()=>{if(C2(X().configPath))return{migrated:!0};let M=await v();return{migrated:!1,blockers:M.open?[]:M.blockers}},beginAccountLogin:Z.beginLogin??M1,refreshAllQuota:async()=>(await w.pollRows(await B2(X()))).map((M)=>({...M,account:M.id})),getStickyRouting:async(M)=>A.get(M),cacheKeepManager:g.manager,setCacheKeepEnabled:(M)=>g.configure({enabled:M}),setCacheKeepSubagents:(M)=>g.configure({subagents:M}),setCacheKeepSustain:(M)=>g.configure({sustain:M}),setCacheKeepWindow:(M)=>g.configure({window:M}),afterWrite:()=>w.load(),refreshSidebar:()=>T.publish(),clearStickyRouting:async(M)=>{let d=A.get(M)!==void 0;return A.forget(M),d},vault:_})):void 0;let p=new AbortController;(async()=>{try{for await(let M of $.event.subscribe({signal:p.signal}))if(M.type==="session.deleted")e.forgetSession(M.data.sessionID),g.forget(M.data.sessionID),m.forget(M.data.sessionID)}catch(M){if(!p.signal.aborted)J.warn("stopped listening for session deletion",{error:M instanceof Error?M.message:String(M)})}})();u=!0;return async()=>{o=!0,p.abort();let M=g.release();await $2?.(),K?.dispose(),await w.dispose(),await T.release(),await Promise.allSettled([c.dispose(),f.dispose(),I.dispose()]);let d;try{await Promise.race([Promise.all([K?.idle(),w.settled(),y.store?.settled(),M]),new Promise((Y2)=>{d=setTimeout(Y2,J4),d.unref?.()})])}finally{clearTimeout(d),S.release(),await h?.release()}}}catch(U2){var T2=U2,F2=1}finally{qZ(a,T2,F2)}}var G4=E1(),R6={id:o2,setup:G4.setup,server:tZ.server};export{R6 as default,E1 as createOpenAIAuthPlugin,o2 as OPENAI_AUTH_PLUGIN_ID};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/opencode-openai-auth",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "license": "MIT",
   "type": "module",
   "repository": {
@@ -66,12 +66,12 @@
   },
   "devDependencies": {
     "@ai-sdk/openai": "3.0.88",
-    "@cortexkit/common-auth": "^0.23.0",
+    "@cortexkit/common-auth": "^0.26.0",
     "@cortexkit/openai-auth-core": "workspace:*",
     "@opencode/plugin": "2.0.32"
   },
   "dependencies": {
-    "@cortexkit/claustrum-client": "^0.12.0",
+    "@cortexkit/claustrum-client": "^0.13.0",
     "@cortexkit/private-files": "^0.2.1",
     "@cortexkit/subc-client": "^0.22.0",
     "@opentui/core": ">=0.6.1",

package/src/tui-compiled/raw/shared/169b2b4bf30909bc-consumer.js

@@ -5,7 +5,7 @@ import { readClaustrumEnrollmentToken } from "./b9588ad4725c1d10-enrollment.js";
 import { ClaustrumConsumerError } from "./ca0fccaba1d87af4-errors.js";
 import { acquireInsulaQuotaSource, } from "./d0f0b6be200311af-insula.js";
 import { pendingVaultQuota, retainVaultQuotaWriter } from "./81dddd203f1b92a3-quota-writer.js";
-import { acceptVaultRoute, applyVaultQuota, declineVaultRoute, forgetPendingVaultDiscovery, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, vaultRoutingRows, } from "./30f5bc480f31f51c-roster.js";
+import { acceptVaultRoute, applyVaultQuota, declineVaultRoute, forgetPendingVaultDiscovery, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, reorderVaultRoster, vaultRoutingRows, } from "./30f5bc480f31f51c-roster.js";
 import { SAFETY_POLL_MS } from "./dc9290c2a7552ba6-watch.js";
 /**
  * One plugin host's view of its vault accounts. It turns vault credentials
@@ -485,8 +485,12 @@ export class ClaustrumConsumer {
             let current;
             try {
                 current = await this.authorize(routeId, signal);
+                // Cancellation can land after authorize settles, before this continuation.
+                signal?.throwIfAborted();
             }
-            catch {
+            catch (error) {
+                if (signal?.aborted)
+                    throw error;
                 // Re-authorization failed: keep this 401 and report it against the
                 // receipt (served record version) this request was sent with.
             }
@@ -522,6 +526,17 @@ export class ClaustrumConsumer {
         await acceptVaultRoute(this.#options.rosterPath, routeId);
         this.#roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
     }
+    /**
+     * Set the order vault accounts are tried in (`reorderVaultRoster`), then
+     * re-read the roster, so the next routing decision in this process uses
+     * the new order without waiting for a discovery. Never contacts the vault.
+     */
+    async reorder(routeIds) {
+        this.#assertOpen();
+        const result = await reorderVaultRoster(this.#options.rosterPath, routeIds);
+        this.#roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
+        return result;
+    }
     /**
      * Store a quota or profile observation for a vault route. The receipt the
      * reading was taken with is required: the observation lands only while the

package/src/tui-compiled/raw/shared/30f5bc480f31f51c-roster.js

@@ -378,6 +378,78 @@ export function acceptVaultRoute(path, routeId) {
         };
     });
 }
+function invalidOrder(message) {
+    return new ClaustrumConsumerError('invalid-order', message);
+}
+/**
+ * Why `routeIds` is not an order of these rows: it must name every distinct
+ * route id exactly once and nothing else. The message quotes only ids the
+ * caller supplied; route ids it left out are counted, not named.
+ */
+function vaultOrderProblem(rows, routeIds) {
+    if (!Array.isArray(routeIds))
+        return 'route ids must be an array of route ids';
+    const rosterIds = new Set(rows.map((row) => row.routeId));
+    const given = new Set();
+    for (const id of routeIds) {
+        if (typeof id !== 'string')
+            return 'route ids must be an array of route ids';
+        if (given.has(id))
+            return `route id ${id} appears more than once`;
+        if (!rosterIds.has(id))
+            return `route id ${id} is not in the roster`;
+        given.add(id);
+    }
+    const missing = [...rosterIds].filter((id) => !given.has(id)).length;
+    if (missing > 0)
+        return `the order leaves out ${missing} roster route id${missing === 1 ? '' : 's'}`;
+    return undefined;
+}
+/**
+ * Set the order vault accounts are tried in. Routing reads that order from
+ * the roster's row order (`vaultRoutingRows`), and a later discovery keeps
+ * each account at its position, so the order lasts until the next reorder.
+ * The order is this host's routing preference: the vault has no order of its
+ * own, and this never contacts it.
+ *
+ * `routeIds` must name every roster route id exactly once; anything else
+ * (an unknown, missing or repeated id) refuses with `invalid-order` and
+ * writes nothing. It runs under the roster's write lock, like every other
+ * roster write, so a quota reading or decline committed meanwhile is kept.
+ * Each row is kept as the same object, so only the positions change: every
+ * row's fields and the rest of the file stay as they were. An order equal to
+ * the current one writes nothing. A host with no roster file yet has no
+ * routes, so only the empty order is accepted.
+ *
+ * A `ClaustrumConsumer` in the same process does not see the new order until
+ * it re-reads the file: call `consumer.reorder` instead to update both.
+ */
+export function reorderVaultRoster(path, routeIds, options = {}) {
+    return mutateVaultRoster(path, (current) => {
+        const rows = current?.rows ?? [];
+        const problem = vaultOrderProblem(rows, routeIds);
+        if (problem)
+            throw invalidOrder(problem);
+        // Group by route id so a hand-edited file that repeats one keeps every
+        // copy: the later copies travel right after the first.
+        const byId = new Map();
+        for (const row of rows) {
+            const group = byId.get(row.routeId);
+            if (group)
+                group.push(row);
+            else
+                byId.set(row.routeId, [row]);
+        }
+        const ids = [...routeIds];
+        const next = ids.flatMap((id) => byId.get(id) ?? []);
+        if (!current || next.every((row, index) => row === rows[index]))
+            return { result: { ids, outcome: 'unchanged' } };
+        return {
+            next: { ...current, rows: next },
+            result: { ids, outcome: 'reordered' },
+        };
+    }, { ...(options.signal && { signal: options.signal }) });
+}
 /**
  * What a receipt may do to a row's quota: `hold` (the row holds the receipt's
  * credential and account), `bind` (the row has never had a known account and

package/src/tui-compiled/raw/shared/375d9cca2def037d-private-files.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { lstat, readFile, rename, unlink } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
 export const windowsPrivateFiles = process.platform === 'win32';
 const migrationNotices = new Set();
 function ioCode(detail) {
@@ -20,8 +21,51 @@ let backend;
 export function setPrivateFilesBackendForTest(api) {
     backend = api ? Promise.resolve(api) : undefined;
 }
+/** The fixed `reason` of a refusal because the Windows native addon did not load. */
+export const PRIVATE_FILES_UNAVAILABLE_REASON = 'native-addon-unavailable';
+function privateFilesUnavailable(cause) {
+    return Object.assign(new Error('Windows private-files native addon is unavailable', { cause }), {
+        code: 'ERR_PRIVATE_FILES_UNAVAILABLE',
+        reason: PRIVATE_FILES_UNAVAILABLE_REASON,
+    });
+}
+function isUnavailable(api, error) {
+    return (error instanceof api.PrivateFilesUnavailableError ||
+        error?.code ===
+            'ERR_PRIVATE_FILES_UNAVAILABLE');
+}
+/**
+ * Importing @cortexkit/private-files succeeds even when its Windows addon
+ * cannot load: the package loads the addon on first use, and some of its
+ * checks then report the failure as an ordinary refusal such as
+ * `unsupported-filesystem`. So prove the addon loads before handing the
+ * package out. Verifying a path that does not exist loads the addon first and
+ * then fails harmlessly; only the package's own "unavailable" error means the
+ * addon is missing.
+ */
+async function assertNativeAddonLoads(api) {
+    try {
+        await api.verifyPrivatePath(join(tmpdir(), `.common-auth-private-files-probe-${randomUUID()}`), 'file');
+    }
+    catch (error) {
+        if (isUnavailable(api, error))
+            throw privateFilesUnavailable(error);
+    }
+}
+/**
+ * Load the package once per process. On Windows a failed import or addon load
+ * is kept, so every later private-file operation refuses at once with
+ * ERR_PRIVATE_FILES_UNAVAILABLE. There is no fallback to permission bits:
+ * they do not protect files on Windows.
+ */
 function loadBackend() {
-    backend ??= import("@cortexkit/private-files");
+    backend ??= import("@cortexkit/private-files").then(async (api) => {
+        if (windowsPrivateFiles)
+            await assertNativeAddonLoads(api);
+        return api;
+    }, (cause) => {
+        throw windowsPrivateFiles ? privateFilesUnavailable(cause) : cause;
+    });
     return backend;
 }
 export class PrivateFileError extends Error {
@@ -38,7 +82,9 @@ export class PrivateFileError extends Error {
     orphanPath;
     constructor(path, stage, cause) {
         const detail = cause;
-        super(`Private file refused at ${stage}: ${path} (${detail?.reason ?? detail?.code ?? 'io-error'}). Use a safe parent directory. Repair only a named secret file in safe ancestry whose owner the published policy trusts, without changing its owner or any existing directory. Previously exposed credentials may need rotation. Windows requires the private-files native prebuild and an ACL-persisting local filesystem such as NTFS.`, { cause });
+        super(detail?.code === 'ERR_PRIVATE_FILES_UNAVAILABLE'
+            ? `Private file refused at ${stage}: ${path} (${PRIVATE_FILES_UNAVAILABLE_REASON}). The Windows native addon of @cortexkit/private-files could not be loaded, so owner-only access cannot be enforced and nothing was read or written. Reinstall the plugin so the private-files Windows prebuild for this architecture is present; Windows has no safe fallback to permission bits.`
+            : `Private file refused at ${stage}: ${path} (${detail?.reason ?? detail?.code ?? 'io-error'}). Keep this file in a folder that only you, the system or administrators can change, such as a folder in your home directory. If other users could read the file before, sign in again to replace the credentials it held. On Windows the file must also be on a local drive that keeps Windows file permissions, such as NTFS.`, { cause });
         this.path = path;
         this.stage = stage;
         this.name = 'PrivateFileError';