npm - @cortexkit/pi-openai-auth - Versions diffs - 1.0.3 → 1.0.5 - Mend

@cortexkit/pi-openai-auth 1.0.3 → 1.0.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/dist/index.js CHANGED Viewed

@@ -1,12 +1,13 @@
-import{createAssistantMessageEventStream as CB}from"@earendil-works/pi-ai";import{streamSimple as TB}from"@earendil-works/pi-ai/compat";var G0="all",s6=Object.freeze(["primary"]);function k4($){return $.kind==="retired"?$.retiredAt:$.checkedAt}function d1($,Z){return JSON.stringify([$,Z])}function i6($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function T0($){return typeof $==="number"&&Number.isFinite($)}function E4($){return typeof $==="string"&&$.length>0}function y0($,Z,X){return $[Z]===void 0||X($[Z])}function EX($){return T0($)&&$>0}function c6($){return typeof $==="string"}function kX($){if(!i6($)||!E4($.scope)||!E4($.label))return!1;switch($.kind){case"reading":return T0($.checkedAt)&&T0($.usedPercent)&&y0($,"resetsAt",c6)&&y0($,"windowMinutes",EX);case"retired":return T0($.retiredAt);case"absent":return T0($.checkedAt);default:return!1}}function fX($){if(!i6($)||!T0($.checkedAt))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&y0($,"remainingPercent",T0)&&y0($,"usedPercent",T0)&&y0($,"resetsAt",c6)&&y0($,"limit",T0)&&y0($,"used",T0)&&y0($,"remaining",T0)&&y0($,"unit",c6)}function t($){if(!i6($)||!Array.isArray($.limits))return!1;let Z=new Set;for(let X of $.limits){if(!kX(X))return!1;let J=d1(X.scope,X.label);if(Z.has(J))return!1;Z.add(J)}return y0($,"budget",fX)}class K3 extends TypeError{constructor($){super($);this.name="QuotaCodecError"}}function D3($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function q3($){return typeof $==="number"&&Number.isFinite($)}function f4($){return $===void 0||typeof $==="string"&&$!==""}function y4($){return typeof $==="string"&&$!==""}function O$($,Z){return $[Z]===void 0||q3($[Z])}function a6($,Z){return $[Z]===void 0||typeof $[Z]==="string"}function yX($){return D3($)&&f4($.scope)&&y4($.label)&&q3($.usedPercent)&&a6($,"resetsAt")&&($.windowMinutes===void 0||q3($.windowMinutes)&&$.windowMinutes>0)}function vX($){return D3($)&&f4($.scope)&&y4($.label)}function gX($){if(!D3($))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&O$($,"remainingPercent")&&O$($,"usedPercent")&&a6($,"resetsAt")&&O$($,"limit")&&O$($,"used")&&O$($,"remaining")&&a6($,"unit")}function v4($){if(!D3($)||!q3($.checkedAt))return!1;let Z=$.readings??[],X=$.coverage??[];if(!Array.isArray(Z)||!Array.isArray(X))return!1;let J=new Set;for(let z of Z){if(!yX(z))return!1;let G=d1(z.scope??G0,z.label);if(J.has(G))return!1;J.add(G)}if(!X.every(vX))return!1;return $.budget===void 0||gX($.budget)}function hX($,Z){if($.scope!==Z.scope)return $.scope<Z.scope?-1:1;if($.label!==Z.label)return $.label<Z.label?-1:1;return 0}function wX($,Z,X){if(Z===void 0)return $;if($!==void 0&&X<$.checkedAt)return $;return{...Z,checkedAt:X}}function s0($,Z){if($!==void 0&&!t($))throw new K3("stored quota map is malformed");if(!v4(Z))throw new K3("quota observation is malformed");let X=$??{limits:[]},J=Z.checkedAt,z=new Map;for(let V of X.limits)z.set(d1(V.scope,V.label),V);let G=(V)=>{let U=z.get(V);return U===void 0||J>=k4(U)},Q=new Set;for(let V of Z.readings??[]){let U=V.scope??G0,K=d1(U,V.label);if(Q.add(K),!G(K))continue;z.set(K,{scope:U,label:V.label,kind:"reading",checkedAt:J,usedPercent:V.usedPercent,...V.resetsAt===void 0?{}:{resetsAt:V.resetsAt},...V.windowMinutes===void 0?{}:{windowMinutes:V.windowMinutes}})}for(let V of Z.coverage??[]){let U=V.scope??G0,K=d1(U,V.label);if(Q.has(K)||!G(K))continue;let j=z.get(K);z.set(K,j===void 0||j.kind==="absent"?{scope:U,label:V.label,kind:"absent",checkedAt:J}:{scope:U,label:V.label,kind:"retired",retiredAt:J})}let{limits:Y,budget:W,...H}=X,B=wX(X.budget,Z.budget,J);return{...H,limits:[...z.values()].sort(hX),...B===void 0?{}:{budget:B}}}var n6=Object.freeze({validate:t,merge:s0});var w4=900000,m4="no quota reading yet",p4="no limits reported";function u4($){let Z=Math.max(1,Math.round($/60000));if(Z<60)return`${Z}m`;let X=Math.round(Z/60);if(X<24)return`${X}h`;return`${Math.max(1,Math.round(Z/1440))}d`}function mX($){if($%1440===0)return`${$/1440}d`;if($%60===0)return`${$/60}h`;return`${$}m`}function N3($){if($.scope!==G0||$.windowMinutes===void 0)return $.label;return mX($.windowMinutes)}function g4($){return`${Math.round(Math.min(100,Math.max(0,$)))}% left`}function h4($,Z){if($===void 0)return"";let X=Date.parse($);if(!Number.isFinite(X)||X<=Z)return"";return`, resets ${u4(X-Z)}`}function pX($,Z){let X=$.windowMinutes,J=Z.windowMinutes;if(X!==void 0&&J!==void 0&&X!==J)return X-J;if(X===void 0!==(J===void 0))return X===void 0?1:-1;if($.scope!==Z.scope){if($.scope===G0)return-1;if(Z.scope===G0)return 1;return $.scope<Z.scope?-1:1}return $.label<Z.label?-1:$.label>Z.label?1:0}function c1($,Z){if(!$)return[];let{now:X}=Z,J=(Z.form??"full")==="full",z=[],G=[],Q=$.limits.filter((W)=>W.kind==="reading"&&W.remainingPercent!==void 0).sort(pX);for(let W of Q)G.push(W.checkedAt),z.push(`${N3(W)} ${g4(W.remainingPercent??0)}${J?h4(W.resetsAt,X):""}`);let Y=$.budget;if(Y){G.push(Y.checkedAt);let W=Y.reached?"credits spent":Y.remainingPercent!==void 0?`credits ${g4(Y.remainingPercent)}`:"credits available";z.push(`${W}${J?h4(Y.resetsAt,X):""}`)}if(G.length>0){let W=X-Math.min(...G);if(W>(Z.staleAfterMs??w4))z.push(`checked ${u4(W)} ago`)}return z}function A0($,Z){let X=c1($,Z);if(X.length>0)return X.join(" · ");return $&&$.limits.length>0?p4:m4}function uX($){if($.kind==="retired")return{scope:$.scope,label:$.label,kind:"retired",checkedAt:$.retiredAt};if($.kind==="absent")return{scope:$.scope,label:$.label,kind:"absent",checkedAt:$.checkedAt};return{scope:$.scope,label:$.label,kind:"reading",checkedAt:$.checkedAt,usedPercent:$.usedPercent,remainingPercent:100-$.usedPercent,...$.windowMinutes===void 0?{}:{windowMinutes:$.windowMinutes},...$.resetsAt===void 0?{}:{resetsAt:$.resetsAt}}}function lX($,Z){let X=$.windowMinutes!==void 0,J=Z.windowMinutes!==void 0;if(X!==J)return X?-1:1;if(X&&J&&$.windowMinutes!==Z.windowMinutes)return(Z.windowMinutes??0)-($.windowMinutes??0);if($.label!==Z.label)return $.label<Z.label?-1:1;return 0}function dX($){return{checkedAt:$.checkedAt,reached:$.reached,...$.remainingPercent===void 0?{}:{remainingPercent:$.remainingPercent},...$.resetsAt===void 0?{}:{resetsAt:$.resetsAt}}}function d($,Z=G0){let X=new Map;for(let W of $?.limits??[]){if(W.scope!==Z&&W.scope!==G0)continue;let H=X.get(W.label);if(H===void 0){X.set(W.label,W);continue}let B=W.scope===G0?H:W,V=W.scope===G0?W:H;X.set(W.label,B.kind==="reading"?B:V)}let J=[...X.values()].map(uX).sort(lX),z=J.filter((W)=>W.kind==="reading"),G=z.length>0?z:J,Q=G.length>0?Math.min(...G.map((W)=>W.checkedAt)):void 0,Y=$?.budget?.kind==="reading"?dX($.budget):void 0;return{scope:Z,limits:J,...Q===void 0?{}:{checkedAt:Q},...Y===void 0?{}:{budget:Y}}}function _$($,Z){let X=$?.budget;if(X?.reached!==!0||typeof X.resetsAt!=="string")return;let J=Date.parse(X.resetsAt);if(!Number.isFinite(J)||J<=Z)return;return{resetsAt:X.resetsAt,resetAtMs:J}}function r6($){return $.kind==="reading"&&typeof $.usedPercent==="number"&&Number.isFinite($.usedPercent)&&$.usedPercent>=100}function M3($,Z){if(typeof $.resetsAt!=="string")return;let X=Date.parse($.resetsAt);return Number.isFinite(X)&&X>Z?X:void 0}function l4($,Z,X){let J=Z.rateLimitMarks?.get($);if(J!==void 0&&X<J)return{id:$,reason:"rate-limited",until:J};let z=Z.refreshBackoff?.get($);if(z!==void 0&&X<z)return{id:$,reason:"refresh-backoff",until:z};return}function cX($,Z,X,J){if(Z.limits.length===0)return{id:$,stage:1,gate:2,reason:"needs-first-reading",pullRequested:!0};for(let G of X)if(!Z.limits.some((Q)=>Q.label===G))return{id:$,stage:1,gate:3,reason:"unknown-window",window:{scope:Z.scope,label:G},pullRequested:!0};let z=Z.limits.filter(r6);for(let G of z)if(M3(G,J)===void 0)return{id:$,stage:1,gate:4,reason:"unknown-reset",window:{scope:G.scope,label:G.label},pullRequested:!0};for(let G of z){let Q=M3(G,J);if(Q!==void 0&&typeof G.resetsAt==="string")return{id:$,stage:1,gate:5,reason:"exhausted",window:{scope:G.scope,label:G.label},resetsAt:G.resetsAt,resetAtMs:Q}}return}function i0($){let Z=$.scope??G0,X=$.requiredLabels??s6,J=[],z=[],G=[];for(let U of $.rows){let K=l4(U.id,$,$.now);if(K){J.push(K);continue}if(U.kind==="api-key"){G.push({id:U.id,kind:U.kind});continue}let j=d(U.quota,Z),M=cX(U.id,j,X,$.now);if(M){z.push(M);continue}G.push({id:U.id,kind:U.kind,projection:j})}let Q=new Map(G.flatMap((U)=>{let K=_$(U.projection,$.now);return K?[[U.id,K]]:[]})),Y=Q.size>0&&Q.size===G.length,W=[];for(let U of G){let K=Q.get(U.id);if(K===void 0)W.push(U);else if(Y)W.push({...U,lastPath:!0});else z.push({id:U.id,stage:2,reason:"budget-spent",...K})}let H=new Map($.rows.map((U,K)=>[U.id,K])),B=(U,K)=>(H.get(U.id)??0)-(H.get(K.id)??0);z.sort(B);let V=z.filter((U)=>("pullRequested"in U)).map((U)=>U.id);for(let U of V)$.requestPull?.(U);return{admitted:W,refused:z,excluded:J,pulls:V}}var L3="main";function o6($){switch($){case"sticky-balanced":return{mode:"sticky-balanced",placement:"roster"};case"main-first":return{mode:"ordered",placement:"main-first"};case"fallback-first":return{mode:"ordered",placement:"fallback-first"};default:return{mode:"ordered",placement:"roster"}}}function s1($,Z,X=L3){if(Z==="roster"||!$.includes(X))return[...$];let J=$.filter((z)=>z!==X);return Z==="main-first"?[X,...J]:[...J,X]}function t6($){let Z=i0($),X=new Set(Z.admitted.map((z)=>z.id));return{order:s1($.rows.map((z)=>z.id),$.placement??"roster",$.formerMainId).filter((z)=>X.has(z)&&$.killswitch?.get(z)!==!1),admission:Z}}function e6($,Z,X){let J=Z.at(-1);if(J!==void 0){if(J.status===void 0||!X.includes(J.status))return}let z=new Set(Z.map((G)=>G.id));return $.find((G)=>!z.has(G))}function C$($,Z,X){if(!Z.has($.accountId))return!1;return!(typeof $.wireIdentity==="string"&&typeof X==="string"&&$.wireIdentity!==X)}function $8($,Z,X){let J=new Map;for(let[z,G]of $){if(z===X)continue;if(G.quotaCheckedAt!==Z.get(G.accountId))continue;J.set(G.accountId,(J.get(G.accountId)??0)+(G.inputBytes??0))}return J}var J8=900000,c4=0.016666666666666666,Z8=0.000001;function F3($,Z){for(let X of[$?.checkedAt,Z])if(typeof X==="number"&&Number.isFinite(X))return X;return}function s4($){if($===401||$===403)return"permanent";if($===void 0||$===0||!Number.isFinite($)||$>=500&&$<=599||$===429)return"transient";return"healthy"}function i4($){return $.limits.filter((Z)=>Z.kind==="reading").sort((Z,X)=>{let J=Z.windowMinutes!==void 0,z=X.windowMinutes!==void 0;if(J!==z)return J?-1:1;if(J&&z)return(X.windowMinutes??0)-(Z.windowMinutes??0);return 0})}function z8($){let Z=($.classifyStatus??s4)($.status);if(Z==="permanent")return{action:"migrate",reason:"permanent"};if(!$.quota)return{action:"retain",reason:"unknown"};let X=F3($.quota,$.quotaCheckedAt);if(X===void 0||!Number.isFinite(X)||$.now-X>J8)return{action:"retain",reason:"stale"};if($.killswitchPasses===!1)return{action:"migrate",reason:"killswitch"};for(let z of i4($.quota)){let G=z.remainingPercent;if(typeof G==="number"&&Number.isFinite(G)&&G<=0)return{action:"migrate",reason:"exhausted",window:{scope:z.scope,label:z.label},...typeof z.resetsAt==="string"?{resetsAt:z.resetsAt}:{}}}let J=_$($.quota,$.now);if(J)return{action:"migrate",reason:"exhausted",resetsAt:J.resetsAt};return{action:"retain",reason:Z}}function X8($,Z,X){let J=Math.max(0,$.remainingPercent-Z);if(J<=0)return 0;if(!$.resetsAt)return J;let z=Date.parse($.resetsAt);if(!Number.isFinite(z)||z<=X)return J;let G=Math.max((z-X)/3600000,c4);return J/G}function d4($,Z){if($<Z)return-1;if($>Z)return 1;return 0}function sX($,Z){if(!$.quota)return;let X=F3($.quota,$.quotaCheckedAt);if(X===void 0||Z-X>J8)return;let J=i4($.quota).map((Q)=>X8({remainingPercent:Q.remainingPercent??Number.NaN,...Q.resetsAt===void 0?{}:{resetsAt:Q.resetsAt}},$.reservePercent[Q.label]??0,Z)),z=$.quota.budget;if(z&&typeof z.remainingPercent==="number"&&Number.isFinite(z.remainingPercent))J.push(X8({remainingPercent:z.remainingPercent,...z.resetsAt===void 0?{}:{resetsAt:z.resetsAt}},0,Z));let G=J.length>0?Math.min(...J):0;return G>0?{candidate:$,quotaCheckedAt:X,weight:G}:void 0}function a4($){let Z=$.candidates.filter((z)=>z.killswitchPasses!==!1);if($.candidates.length===0)throw Error("Cannot select a sticky candidate: input.candidates is empty");if(Z.length===0)return;let X=Z.map((z)=>sX(z,$.now)).filter((z)=>z!==void 0);if(X.length>0){X.sort((G,Q)=>{let Y=(($.pendingBytes.get(G.candidate.accountId)??0)+$.requestBytes)/Math.max(G.weight,Z8),W=(($.pendingBytes.get(Q.candidate.accountId)??0)+$.requestBytes)/Math.max(Q.weight,Z8);return Y-W||G.candidate.configuredOrder-Q.candidate.configuredOrder||d4(G.candidate.accountId,Q.candidate.accountId)});let z=X[0];if(z)return{accountId:z.candidate.accountId,quotaCheckedAt:z.quotaCheckedAt,source:"weighted"}}$.onEmptyWeightedSet?.();let J=[...Z].sort((z,G)=>{let Q=(z.resetCreditsApplicable??0)>0?1:0;return((G.resetCreditsApplicable??0)>0?1:0)-Q||z.configuredOrder-G.configuredOrder||d4(z.accountId,G.accountId)})[0];if(!J)throw Error("Cannot select a sticky candidate: input.candidates is empty");return{accountId:J.accountId,quotaCheckedAt:F3(J.quota,J.quotaCheckedAt),source:"mode-fallback"}}function G8($){let Z=i0($),X=new Map(Z.admitted.map((j)=>[j.id,j])),J=new Map(Z.refused.map((j)=>[j.id,j])),z=new Set(Z.excluded.map((j)=>j.id)),G=new Set($.rows.map((j)=>j.id)),Q=$.pin!==void 0&&C$($.pin,G,$.identities?.get($.pin.accountId));if(Q&&$.pin){let j=X.get($.pin.accountId);if(j&&$.killswitch?.get(j.id)!==!1)return{outcome:"dispatch",accountId:j.id,source:"pin",...j.projection?.checkedAt===void 0?{}:{quotaCheckedAt:j.projection.checkedAt},pin:{action:"retain"},refusedSelections:[],admission:Z}}let Y=$.pin?J.get($.pin.accountId):void 0,W=Q&&$.pin!==void 0&&$.refusedPinPolicy==="move-on-confirmed-exhaustion"&&($.killswitch?.get($.pin.accountId)===!1||Y?.reason==="exhausted"||Y?.reason==="budget-spent"),H=(j)=>{return(typeof $.rowReservePercent==="function"?$.rowReservePercent(j):$.rowReservePercent?.get(j.id))??$.reservePercent??{}},B=$.scope,V=$.rows.map((j,M)=>({row:j,configuredOrder:M})).filter(({row:j})=>!z.has(j.id)).map(({row:j,configuredOrder:M})=>{let D=$.killswitch?.get(j.id),q=$.resetCreditsApplicable?.get(j.id);return{accountId:j.id,quota:j.kind==="api-key"?void 0:X.get(j.id)?.projection??d(j.quota,B),reservePercent:H(j),configuredOrder:M,...q===void 0?{}:{resetCreditsApplicable:q},...D===void 0?{}:{killswitchPasses:D}}}),U=[],K=Q?{action:"retain"}:$.pin?{action:"clear"}:{action:"none"};while(V.length>0){let j=a4({candidates:V,pendingBytes:$.pendingBytes??new Map,requestBytes:$.requestBytes,now:$.now,...$.onEmptyWeightedSet?{onEmptyWeightedSet:$.onEmptyWeightedSet}:{}});if(!j)break;let M=J.get(j.accountId);if(M){U.push(M),V=V.filter((q)=>q.accountId!==j.accountId);continue}let D=$.identities?.get(j.accountId);return{outcome:"dispatch",accountId:j.accountId,source:j.source,...j.quotaCheckedAt===void 0?{}:{quotaCheckedAt:j.quotaCheckedAt},pin:Q&&!W?{action:"retain"}:{action:"assign",pin:{accountId:j.accountId,inputBytes:$.requestBytes,...D===void 0?{}:{wireIdentity:D},...j.quotaCheckedAt===void 0?{}:{quotaCheckedAt:j.quotaCheckedAt}}},refusedSelections:U,admission:Z}}return{outcome:"no-admissible-account",pin:K,refusedSelections:U,admission:Z}}import{appendFileSync as tX,chmodSync as eX,existsSync as Q8,renameSync as r4,statSync as $J}from"node:fs";var iX=/^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i,aX=/\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g;function nX($){return $ instanceof Error||Object.prototype.toString.call($)==="[object Error]"}function v0($={}){let Z=[aX,...$.extraValuePatterns??[]].map((G)=>new RegExp(G.source,G.flags.includes("g")?G.flags:`${G.flags}g`));function X(G){let Q=G.toLowerCase().replace(/[-_]/g,"");return iX.test(G)||Q.includes("apikey")||Q.endsWith("secret")||Q.endsWith("password")||Q.endsWith("token")&&!Q.endsWith("tokens")||!!$.extraSecretKeys?.(Q)}function J(G){let Q=G,Y=[["name",G.name],["message",G.message],["stack",G.stack]];for(let H of["code","status","cause"])if(Q[H]!==void 0)Y.push([H,Q[H]]);let W=new Set(Y.map(([H])=>H));for(let H of Object.entries(G))if(!W.has(H[0]))Y.push(H);return Y}function z(G,Q,Y,W=0){if(typeof G==="string")return Z.reduce((H,B)=>H.replace(B,"***REDACTED***"),G);if(!G||typeof G!=="object")return G;if(Y.has(G))return"[Circular]";Y.add(G);try{if(Array.isArray(G))return G.map((V)=>z(V,Q,Y,W));let H=nX(G);if(H&&W>=8)return"[Truncated]";let B=H?W+1:W;return Object.fromEntries((H?J(G):Object.entries(G)).map(([V,U])=>[V,Q&&X(V)?"***REDACTED***":z(U,Q,Y,B)]))}finally{Y.delete(G)}}return{redact:(G)=>z(G,!0,new WeakSet),redactStrings:(G)=>z(G,!1,new WeakSet)}}var n4=v0(),rX=n4.redact,oX=n4.redactStrings;var P3={error:0,warn:1,info:2,debug:3,trace:4},ZJ=5242880,XJ=3;function Y8($){try{eX($,384)}catch{}}function JJ($){try{if(!(Q8($)&&$J($).size>=ZJ))return;for(let X=XJ-1;X>=1;X--)if(Q8(`${$}.${X}`)){let J=`${$}.${X+1}`;r4(`${$}.${X}`,J),Y8(J)}let Z=`${$}.1`;r4($,Z),Y8(Z)}catch{}}function zJ($){try{return` ${JSON.stringify($)}`}catch{return" [unserializable]"}}function GJ($){let Z,X,J,z=v0(),G,Q=[],Y;function W(q){Z=q.file,X=q.level,z=v0(q),G=q.captureSink}function H(q){if(q===void 0||q in P3)J=q}function B(){if(Z===void 0)return;return(typeof Z==="function"?Z():Z)||void 0}function V(){if(J)return J;let q=typeof X==="function"?X():X;if(q&&q in P3)return q;return"info"}function U(){if(Y)clearTimeout(Y),Y=void 0;if(!Q.length)return;let q;try{q=B()}catch{Q=[];return}let F=Q.join("");if(Q=[],!q)return;try{if(JJ(q),Q8(q))Y8(q);tX(q,F,{encoding:"utf8",mode:384})}catch{}}function K(){if(!Y)Y=setTimeout(()=>{Y=void 0,U()},500)}function j(q,F,C,L){if(Z===void 0&&G===void 0)return;try{if(P3[F]>P3[V()])return;let N=z.redactStrings(C),P;try{P=z.redact(L)}catch{P="[unserializable]"}let S=`[${new Date().toISOString()}] ${F.toUpperCase()} [${q}] ${N}`+(L===void 0?"":zJ(P))+`
-`;try{G?.({channel:q,level:F,message:N,data:P})}catch{}if(Z===void 0)return;if(Q.push(S),Q.length>=50)U();else K()}catch{}}function M(q){return{error:(F,C)=>j(q,"error",F,C),warn:(F,C)=>j(q,"warn",F,C),info:(F,C)=>j(q,"info",F,C),debug:(F,C)=>j(q,"debug",F,C),trace:(F,C)=>j(q,"trace",F,C)}}function D(){if(Q=[],Y)clearTimeout(Y),Y=void 0;Z=void 0,X=void 0,J=void 0,z=v0(),G=void 0}if($)W($);return{configure:W,createLogger:M,setLogLevel:H,flushLogs:U,reset:D}}var QJ=GJ();function s($){return QJ.createLogger($)}class E extends Error{operation;rowId;phase;retryable;kind;committed;constructor($){super($.message??`${$.operation} failed (${$.kind}, ${$.phase})`,$.cause===void 0?void 0:{cause:$.cause});this.name="PoolOperationError",this.operation=$.operation,this.rowId=$.rowId,this.phase=$.phase,this.retryable=$.retryable,this.kind=$.kind,this.committed=$.committed}}class O3 extends Error{operation;constructor($){super(`${$} was called from inside a store hook; hand it to the caller's continuation instead`);this.name="PoolReentryError",this.operation=$}}var i1="identity-contradicted: ",W8="duplicate-identity";function G1($,Z,X){let J=$.rosterRow(Z);if(!J)return;J.enabled=!1;let z=$.entry(Z)??{credentialEpoch:1,needsFirstReading:!0},G=typeof z.disabledReason==="string"&&z.disabledReason.startsWith("identity-contradicted: ");$.setEntry(Z,{...z,disabledReason:G?z.disabledReason:X})}function T$($,Z){let X=$.rosterRow(Z);if(!X)return;X.enabled=!0;let J=$.entry(Z);if(J&&"disabledReason"in J){let z={...J};delete z.disabledReason,$.setEntry(Z,z)}}function a1($,Z){let X=$.rows().filter((z)=>z.invalid===void 0&&!z.staged&&z.type==="oauth"&&z.enabled&&z.identity===Z),J=[];for(let z of X.slice(1))G1($,z.id,"duplicate-identity"),J.push(z.id);return J}function A1($,Z,X){let J=$.rosterRow(Z);if(!J)return[];return J.accountId=X,a1($,X)}import{readFile as gJ}from"node:fs/promises";import{setTimeout as hJ}from"node:timers/promises";import{randomUUID as jJ}from"node:crypto";import{mkdir as UJ,open as _3,rename as KJ,rm as qJ}from"node:fs/promises";import{dirname as B8}from"node:path";class A$ extends Error{constructor($){super("file or directory sync failed",{cause:$});this.name="AtomicSyncError"}}async function O0($,Z,X={}){await H8($,Z,X)}async function H8($,Z,X,J){await UJ(B8($),{recursive:!0});let z=`${$}.${(X.stageName??jJ)()}.tmp`,G,Q=!1;try{if(G=await _3(z,"wx",384),Q=!0,await G.writeFile(X.serialize?X.serialize(Z):`${JSON.stringify(Z,null,2)}
-`,"utf8"),await G.chmod(384),X.durable)try{await G.sync()}catch(Y){throw new A$(Y)}if(await G.close(),G=void 0,await X.beforeRename?.(),await KJ(z,$),Q=!1,J?.(),X.durable){let Y=await _3(B8($),"r");try{await Y.sync()}catch(W){throw new A$(W)}finally{await Y.close()}}}finally{if(await G?.close().catch(()=>{}),Q)await qJ(z,{force:!0}).catch(()=>{})}}async function V8($){let Z=await _3($,"r");try{await Z.sync()}finally{await Z.close()}let X=await _3(B8($),"r");try{await X.sync()}finally{await X.close()}}import{randomUUID as C3}from"node:crypto";import{mkdir as o4,open as DJ,readFile as j8,rename as t4,rm as n1,stat as e4,writeFile as U8}from"node:fs/promises";import{dirname as NJ,join as $9}from"node:path";var MJ=globalThis.setTimeout.bind(globalThis),LJ=globalThis.clearTimeout.bind(globalThis);function K8($){let Z=$?.code;return Z==="ENOENT"||Z==="EINVAL"||Z==="ENOTDIR"}async function e($){let Z=q8($.path,$.name),X=$9(Z,"owner.json"),J=C3(),z=$.now??Date.now,G=null,Q=!1,Y,W,H=new Promise((A)=>{W=A});function B(A){try{let x=$.onRenewalTimer?.(A);if(x&&(typeof x==="object"||typeof x==="function")&&"then"in x&&typeof x.then==="function")Promise.resolve(x).catch(()=>{})}catch{}}function V(){if(!G)return;LJ(G),G=null,B("cancelled")}function U(A,x){if(Y||Q)return;Y=Object.freeze({reason:A,expectedOwnerId:J,...typeof x?.ownerId==="string"?{observedOwnerId:x.ownerId}:{},...typeof x?.expiresAt==="number"?{observedExpiresAt:x.expiresAt}:{}}),V(),W(Y)}let K=null,j=`${Z}.evicting`,M=$9(j,"owner.json"),D=C3(),q=5000,F=8;async function C(){try{return JSON.parse(await j8(Z,"utf8"))}catch(A){if(A.code!=="EISDIR")throw A;return JSON.parse(await j8(X,"utf8"))}}async function L(){let A=`${Z}.${C3()}.tmp`,x,I=!1;try{x=await DJ(A,"wx",384),I=!0,await x.writeFile(`${JSON.stringify({ownerId:J,expiresAt:z()+$.ttlMs})}
-`,"utf8"),await x.chmod(384),await x.close(),x=void 0,await t4(A,Z),I=!1}finally{if(await x?.close().catch(()=>{}),I)await n1(A,{force:!0}).catch(()=>{})}}async function N(){try{return await U8(Z,`${JSON.stringify({ownerId:J,expiresAt:z()+$.ttlMs})}
-`,{encoding:"utf8",mode:384,flag:"wx"}),!0}catch(A){let x=A.code;if(x==="EEXIST"||x==="EISDIR")return!1;if(x==="ENOENT"){await o4(NJ(Z),{recursive:!0});try{return await U8(Z,`${JSON.stringify({ownerId:J,expiresAt:z()+$.ttlMs})}
-`,{encoding:"utf8",mode:384,flag:"wx"}),!0}catch(I){let z0=I.code;if(z0==="EEXIST"||z0==="EISDIR")return!1;throw I}}throw A}}async function P(){await new Promise((A)=>setTimeout(A,Math.floor(Math.random()*4)))}async function S(){try{let A=await C();return Number(A?.expiresAt)>z()}catch{try{return(await e4(Z)).mtimeMs+$.ttlMs>z()}catch{return!1}}}async function f(){try{return JSON.parse(await j8(M,"utf8"))?.ownerId===D}catch{return!1}}async function n(){if(await f())await n1(j,{recursive:!0,force:!0}).catch(()=>{})}async function C0(){await o4(j);try{await U8(M,`${JSON.stringify({ownerId:D,createdAt:z()})}
-`,{encoding:"utf8",mode:384,flag:"wx"})}catch(A){if(K8(A))return!1;throw await n(),A}if($.onStep)await $.onStep("eviction-marker-acquired");return!0}async function h(){let A;try{A=await e4(j)}catch(I){if(I.code==="ENOENT")return"missing";throw I}if(A.mtimeMs+q>z())return"fresh";if($.onStep)await $.onStep("stale-marker-stat");let x=`${j}.${C3()}`;try{await t4(j,x)}catch(I){if(I.code==="ENOENT")return"missing";throw I}if($.onStep)await $.onStep("stale-marker-claimed");return await n1(x,{recursive:!0,force:!0}).catch(()=>{}),"recovered"}async function g(A){try{if(!await C0())return!1}catch(x){if(x.code==="EEXIST")return!1;throw x}try{await A()}finally{await n()}return!0}async function l(){for(let A=0;A<F;A++){if($.onStep)await $.onStep("relinquish-read");let x;try{x=await C()}catch{return}if(x?.ownerId!==J)return;try{await n1(Z,{recursive:!0,force:!0});return}catch{await P()}}}function J0(){if(!$.renew||Q||Y)return;let A=$.renewIntervalMs??Math.max(1000,Math.floor($.ttlMs/3));if(G=MJ(()=>{G=null;let x=(async()=>{let I=!Q;try{if(!await g(async()=>{let U3=await C(),bX=z();if(Q||Y){I=!1;return}if(U3?.ownerId!==J){U("taken-over",U3),I=!1;return}if(!(Number(U3?.expiresAt)>bX)){U("expired",U3),I=!1;return}if($.onStep)await $.onStep("renewal-owner-confirmed");if(Q||Y){I=!1;return}if(!await f())return;if($.onStep)await $.onStep("renewal-write-fenced");if(Q||Y){I=!1;return}if(!await f())return;if($.onStep)await $.onStep("renewal-write-ready");if(Q||Y){I=!1;return}if(await L(),!await f()){U("marker-lost"),I=!1,await l();return}})&&$.onStep)await $.onStep("renewal-marker-unavailable")}catch{try{let z0=await C();if(z0?.ownerId!==J)U("taken-over",z0);else if(!(Number(z0?.expiresAt)>z()))U("expired",z0)}catch{U("renewal-failed")}}finally{if($.onStep)try{await $.onStep("renewal-finished")}catch{}if(I&&!Q&&!Y)J0()}})();K=x,x.finally(()=>{if(K===x)K=null})},A),"unref"in G)G.unref();B("scheduled")}function c(){try{let A=$.onContended?.();if(A&&(typeof A==="object"||typeof A==="function")&&"then"in A&&typeof A.then==="function")Promise.resolve(A).catch(()=>{})}catch{}return null}let c0=await N();if(!c0)for(let A=0;A<F;A++){if(c0=await N(),c0)break;if(await S())return c();if($.onStep)await $.onStep("stale-lock-observed");try{if(!await C0()){await P();continue}}catch(x){if(x.code!=="EEXIST")throw x;if(await h()==="fresh")return null;await P();continue}try{if(await S())return c();if(!await f())return null;if($.onStep)await $.onStep("stale-lock-confirmed");if(!await f())return null;if(await n1(Z,{recursive:!0,force:!0}).catch(()=>{}),!await f())return null;if($.onStep)await $.onStep("stale-lock-removed");if(c0=await N(),!c0)return null;if($.onStep)await $.onStep("stale-lock-recreated");if(!await f())return await l(),c0=!1,null;break}finally{await n()}}if(!c0)return null;return J0(),{ownerId:J,whenLost:()=>H,hasLost:()=>Y!==void 0,assertOwned:async()=>{let A;try{let x=await C();if(A=x,!Q&&!Y&&x?.ownerId===J&&Number(x?.expiresAt)>z())return;U(x?.ownerId!==J?"taken-over":"expired",x)}catch{U("unreadable")}throw new r1({target:$.path,name:$.name,expectedOwnerId:J,...typeof A?.ownerId==="string"?{observedOwnerId:A.ownerId}:{},...typeof A?.expiresAt==="number"?{observedExpiresAt:A.expiresAt}:{}})},release:async()=>{Q=!0,V(),await K;for(let A=0;A<F;A++){try{if(await g(async()=>{if((await C())?.ownerId!==J)return;if($.onStep)await $.onStep("release-owner-confirmed");if(!await f())return;await n1(Z,{recursive:!0,force:!0}).catch(()=>{})}))return;await h()}catch{return}await P()}}}}function q8($,Z){return`${$}.${Z}.lock`}class R1 extends Error{details;constructor($){super(`Timed out acquiring ${$.name} lock for ${$.target}`);this.name="LockContentionError",this.details=$}}class r1 extends Error{details;constructor($){super(`Lost ${$.name} lock for ${$.target}`);this.name="LockOwnershipError",this.details=$}}async function D8($,Z,X){let J=performance.now();for(;;){let z=await e({path:$,name:Z.name,ttlMs:Z.ttlMs,renew:Z.renew??!1});if(z)try{return await X(z)}finally{await z.release()}let G=Z.timeoutMs-(performance.now()-J);if(G<=0)throw new R1({target:$,name:Z.name,timeoutMs:Z.timeoutMs});await new Promise((Q)=>setTimeout(Q,Math.min(25,Math.ceil(G))))}}import{AsyncLocalStorage as FJ}from"node:async_hooks";var Z9=new FJ;function Q0($){if(Z9.getStore()!==void 0)throw new O3($)}function g0($,Z){return Z9.run($,async()=>await Z())}async function X9($,Z,X,J,z){if(!Z)return;try{await g0($,()=>Z(X,J))}catch(G){z?.warn("store failure hook threw; the original failure stands",{operation:$,rowId:X,error:G instanceof Error?G.message:String(G)})}}var N8=Object.freeze({ttlMs:1e4,timeoutMs:15000,retryMs:50,renew:!0});async function PJ($,Z,X){let J=(Q)=>{try{let Y=X.onLockEvent?.({type:Q,name:$.name,path:$.path});if(Y&&(typeof Y==="object"||typeof Y==="function")&&"then"in Y&&typeof Y.then==="function")Promise.resolve(Y).catch(()=>{})}catch{}},z={...Z,...OJ($)},G=performance.now();for(;;){let Q=await e({name:$.name,path:$.path,ttlMs:z.ttlMs,now:X.now,renew:z.renew,onContended:()=>J("contended"),...z.renewIntervalMs!==void 0?{renewIntervalMs:z.renewIntervalMs}:{},...X.onLockStep?{onStep:(H)=>X.onLockStep?.({name:$.name,path:$.path},H)}:{}});if(Q){J("acquired");let H={name:$.name,path:$.path,assertOwned:()=>Q.assertOwned(),release:async()=>{await Q.release(),J("released")}};try{await H.assertOwned()}catch(B){throw await H.release(),B}return H}let Y=z.timeoutMs-(performance.now()-G);if(Y<=0)throw new R1({target:$.path,name:$.name,timeoutMs:z.timeoutMs});let W=Math.floor(Math.random()*(z.retryMs+1));await new Promise((H)=>setTimeout(H,Math.min(z.retryMs+W,Y)))}}function OJ($){let Z={};if($.ttlMs!==void 0)Z.ttlMs=$.ttlMs;if($.timeoutMs!==void 0)Z.timeoutMs=$.timeoutMs;if($.retryMs!==void 0)Z.retryMs=$.retryMs;if($.renew!==void 0)Z.renew=$.renew;if($.renewIntervalMs!==void 0)Z.renewIntervalMs=$.renewIntervalMs;return Z}class Q1{defaults;env;held=[];constructor($,Z){this.defaults=$,this.env=Z}async acquire($){let Z=await PJ($,this.defaults,this.env);return this.held.push(Z),await this.assertAll(),Z}async assertAll(){for(let $ of this.held)await $.assertOwned()}async releaseTo($){while(this.held.length>$)await this.held.pop()?.release().catch(()=>{})}async releaseAll(){await this.releaseTo(0)}}function S1($,Z,X){if(X!==void 0)throw new E({operation:$,rowId:Z,kind:"row-staged",phase:$==="pull"?"pull":"before-first-write",retryable:!1,message:`row ${Z} is reserved for roster publication`})}import{createHash as R$}from"node:crypto";var w="commonAuthPool",Y1=1,R0="rows",T3="retiredEpochs",S$=1,M8=300000,v=w;function _J($){let Z=JSON.parse(JSON.stringify($)),X=(J)=>{if(Array.isArray(J))return`[${J.map(X).join(",")}]`;if(_(J))return`{${Object.keys(J).sort().map((z)=>`${JSON.stringify(z)}:${X(J[z])}`).join(",")}}`;return JSON.stringify(J)};return X(Z)}function I1($){return R$("sha256").update(_J($)).digest("hex")}function J9($){if(!_($)||Object.keys($).length!==1||typeof $.reservation!=="string"||!$.reservation)return;return{reservation:$.reservation}}function CJ($){if(!_($)||typeof $.reservation!=="string"||!$.reservation||typeof $.disabledReason!=="string")return;if(Object.keys($).some((Z)=>!["reservation","label","disabledReason","providerState"].includes(Z)))return;if("label"in $&&typeof $.label!=="string")return;if("providerState"in $&&(typeof $.providerState!=="string"||!/^[a-f0-9]{64}$/.test($.providerState)))return;return $}var H0="commonAuthProviderState";function _($){return $!=null&&typeof $==="object"&&!Array.isArray($)}var TJ=new Set(["__proto__","constructor","prototype"]);function o1($){if(typeof $!=="string"||$.length===0)return"id must be non-empty";if($.trim()!==$)return"id must not carry surrounding whitespace";if(TJ.has($))return"id is a reserved object key";return}function L8($){let Z=typeof $==="string"?$.trim():"";if(!Z)return!1;try{let X=new URL(Z);return(X.protocol==="http:"||X.protocol==="https:")&&!X.username&&!X.password}catch{return!1}}function z9($){return $.type==="oauth"?`oauth\x00${$.refresh}`:`api\x00${$.apiKey}`}function W1($){return R$("sha256").update(z9($)).digest("hex")}function h0($){return R$("sha256").update(`credential-stamp\x00${z9($)}`).digest("hex")}function a0($){let Z=$.type==="oauth"?["oauth",typeof $.access==="string"?$.access:null,$.refresh,typeof $.expires==="number"&&Number.isFinite($.expires)?$.expires:null]:["api",$.apiKey,$.baseURL.trim(),$.authHeader??"authorization-bearer"];return R$("sha256").update(`credential-dispatch\x00${JSON.stringify(Z)}`).digest("hex")}function F8($,Z,X,J={}){return{credentialEpoch:Z,digest:h0($),dispatch:a0($),binding:{...X},...J.replace?{replace:!0}:{},...J.providerState!==void 0?{providerState:J.providerState}:{}}}function t1($,Z){let X=$?.credentialBound?$.credentialBound(Z):Z;return R$("sha256").update(`provider-state\x00${JSON.stringify(X??null)}`).digest("hex")}function I$($,Z,X,J){if(!Z||X===void 0)return;if(!_($)||!Object.hasOwn($,H0))return;let z=N0($[v]);if(!z||z.providerState===void 0||z.digest!==h0(Z)||z.credentialEpoch!==X||z.binding?.identity!==J)return;return z.providerState}function $0($){return Number.isSafeInteger($)&&$>=1}function N0($){if(!_($))return;let Z=$.credentialEpoch;if(!$0(Z))return;if(typeof $.digest!=="string")return;if("dispatch"in $&&typeof $.dispatch!=="string")return;if("replace"in $&&$.replace!==!0)return;if("providerState"in $&&typeof $.providerState!=="string")return;let X="staged"in $?CJ($.staged):void 0;if("staged"in $&&!X)return;let J={...X?{staged:X}:{},...typeof $.dispatch==="string"?{dispatch:$.dispatch}:{},...$.replace===!0?{replace:!0}:{},...typeof $.providerState==="string"?{providerState:$.providerState}:{}};if(!("binding"in $))return"dispatch"in $||"replace"in $||"providerState"in $||"staged"in $?void 0:{credentialEpoch:Z,digest:$.digest};let z=$.binding;if(!_(z))return;if("identity"in z&&(typeof z.identity!=="string"||!z.identity))return;if("baseURL"in z&&!L8(z.baseURL))return;if("authHeader"in z&&z.authHeader!=="authorization-bearer"&&z.authHeader!=="x-api-key")return;return{credentialEpoch:Z,digest:$.digest,...J,binding:{...typeof z.identity==="string"?{identity:z.identity}:{},...typeof z.baseURL==="string"?{baseURL:z.baseURL.trim()}:{},...z.authHeader==="authorization-bearer"||z.authHeader==="x-api-key"?{authHeader:z.authHeader}:{}}}}function AJ($,Z,X){if($.identity!==X)return!1;if($.baseURL!==void 0&&(Z.type!=="api"||Z.baseURL!==$.baseURL))return!1;if($.authHeader!==void 0&&(Z.type!=="api"||Z.authHeader!==$.authHeader))return!1;return!0}function RJ($,Z,X,J){if(!$)return"none";if(!_(J)||!Object.hasOwn(J,v))return"missing";let z=N0(J[v]);if(!z)return"malformed";if(z.digest!==h0($))return"mismatched";if(z.dispatch===void 0)return"legacy";if(z.credentialEpoch!==Z)return"mismatched";if(!z.binding||!AJ(z.binding,$,X))return"mismatched";if(z.dispatch!==a0($))return"mismatched";return"bound"}function G9($){if(!$.exists)return{status:"ready",exists:!1,config:{}};if("parseError"in $)return{status:"error",reason:"config file is not valid JSON"};let Z=$.value;if(!_(Z))return{status:"error",reason:"config root is not an object"};if("accounts"in Z&&!Array.isArray(Z.accounts))return{status:"error",reason:"config accounts is not an array"};if(!(w in Z))return Array.isArray(Z.accounts)?{status:"pending-migration",config:Z}:{status:"ready",exists:!0,config:Z};let X=Z[w];if(!_(X))return{status:"error",reason:`${w} is not an object`};let J=X.schemaVersion;if(typeof J!=="number"||!Number.isInteger(J)||J<1)return{status:"error",reason:`${w}.schemaVersion is invalid`};if(J>Y1)return{status:"error",reason:`${w}.schemaVersion ${J} is newer than ${Y1}`};if(R0 in X&&!_(X[R0]))return{status:"error",reason:`${w}.${R0} is not an object`};return{status:"ready",exists:!0,config:Z}}function Q9($){if(!$.exists)return{status:"ready",exists:!1,state:{}};if("parseError"in $)return{status:"error",reason:"state file is not valid JSON"};if(!_($.value))return{status:"error",reason:"state root is not an object"};if("accounts"in $.value&&!_($.value.accounts))return{status:"error",reason:"state accounts is not an object"};return{status:"ready",exists:!0,state:$.value}}function e1($){return Array.isArray($.accounts)?$.accounts:[]}function Y9($){let Z=$[w];if(!_(Z))return{};let X=Z[R0];return _(X)?X:{}}function SJ($){return _($.accounts)?$.accounts:{}}function IJ($){if(!_($))return"not an object";let Z=o1($.id);if(Z)return Z;if($.type==="api")return L8($.baseURL)?void 0:"invalid baseURL";if($.type==="oauth")return;return"unknown type"}function xJ($,Z){if(!_($))return;let X=$.credentialEpoch;if(!$0(X))return;if("needsFirstReading"in $&&typeof $.needsFirstReading!=="boolean")return;if("disabledReason"in $&&typeof $.disabledReason!=="string")return;if("quota"in $&&!Z.validate($.quota))return;if("staged"in $&&!J9($.staged))return;return{credentialEpoch:X,needsFirstReading:$.needsFirstReading===!0,...typeof $.disabledReason==="string"?{disabledReason:$.disabledReason}:{},..."quota"in $?{quota:$.quota}:{}}}function bJ($,Z){if(!_(Z))return;if($.type==="api"){let J=typeof Z.apiKey==="string"?Z.apiKey.trim():"";if(!J)return;return{type:"api",apiKey:J,baseURL:String($.baseURL).trim(),authHeader:$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer"}}if($.corrupt===!0)return;let X=Z.refresh;if(typeof X!=="string"||!X.trim())return;return{type:"oauth",refresh:X,...typeof Z.access==="string"?{access:Z.access}:{},...typeof Z.expires==="number"?{expires:Z.expires}:{},...typeof Z.lastRefreshedAt==="number"?{lastRefreshedAt:Z.lastRefreshedAt}:{}}}function A3($,Z){return e1($).find((X)=>_(X)&&X.id===Z)}function W9($){if(!_($[w]))$[w]={};return $[w]}function P8($){let Z=W9($);if(!_(Z[R0]))Z[R0]={};return Z[R0]}function B1($,Z){let X=Y9($),J=Object.hasOwn(X,Z)?X[Z]:void 0;return _(J)?J:void 0}function R3($,Z,X){Object.defineProperty(P8($),Z,{value:X,enumerable:!0,writable:!0,configurable:!0})}function B9($,Z){let X=$[w];if(!_(X))return;let J=X[T3];if(!_(J)||!Object.hasOwn(J,Z))return;let z=J[Z];return $0(z)?z:void 0}function H9($,Z){let X=B1($,Z)?.credentialEpoch;return $0(X)?X:void 0}function S3($,Z){return Math.max(B9($,Z)??0,H9($,Z)??0)+1}function V9($,Z){let X=[...Z];if(X.length===0)return;let J=W9($),z=_(J[T3])?J[T3]:{},G={},Q=(Y,W)=>Object.defineProperty(G,Y,{value:W,enumerable:!0,writable:!0,configurable:!0});for(let[Y,W]of Object.entries(z))if($0(W))Q(Y,W);for(let Y of X)Q(Y,Math.max(B9($,Y)??0,H9($,Y)??1));J[T3]=G}function H1($,Z,X,J){let z=Y9($),G=SJ(Z),Q=new Set,Y=[];for(let W of e1($)){let H=IJ(W),B=_(W)&&typeof W.id==="string"?W.id:void 0,V=B===void 0?void 0:z[B],U=_(V)&&Object.hasOwn(V,"staged"),K=U?J9(V.staged):void 0;if(H||!_(W)||B===void 0||Q.has(B)){if(B!==void 0&&!Q.has(B))Q.add(B);if(B!==void 0)Y.push({id:B,type:_(W)&&W.type==="api"?"api":"oauth",enabled:!1,needsFirstReading:!0,hasEntry:Object.hasOwn(z,B),candidate:!1,invalid:"roster",stamp:"none",...K?{staged:K}:{}});continue}Q.add(B);let j=W.type==="api"?"api":"oauth",M=Object.hasOwn(z,B),D=M?xJ(z[B],X):void 0,q=bJ(W,G[B]),F=W.enabled!==!1,C=D?D.credentialEpoch:M?void 0:1,L=typeof W.accountId==="string"&&W.accountId?W.accountId:void 0,N={id:B,type:j,enabled:F,needsFirstReading:D?D.needsFirstReading:j==="oauth",hasEntry:M,candidate:!1,...typeof W.label==="string"?{label:W.label}:{},...typeof W.addedAt==="number"?{addedAt:W.addedAt}:{},...L!==void 0?{identity:L}:{},...q?{credential:q,fingerprint:W1(q)}:{},...D?{credentialEpoch:D.credentialEpoch}:{},...K?{staged:K}:{},...D?.disabledReason!==void 0?{disabledReason:D.disabledReason}:{},...D&&"quota"in D?{quota:D.quota}:{},...EJ(G[B],q,C,L,J),stamp:RJ(q,C,L,G[B])};if(M&&!D)N.invalid="entry";else N.candidate=F&&q!==void 0&&!U;Y.push(N)}return Y}function EJ($,Z,X,J,z){if(!_($)||!Object.hasOwn($,H0))return{};let G=I$($,Z,X,J);if(G===void 0)return{providerStateDropped:"uncovered"};let Q=$[H0];if(!z?.validate(Q))return{providerStateDropped:"invalid"};if(t1(z,Q)!==G)return{providerStateDropped:"uncovered"};return{providerState:Q}}function p($){return $.identity??$.id}function x$($,Z){if($===void 0||$>Z+M8)return Z;return Math.max(Z,$+1)}function O8($,Z){return x$($,Z)>Z+M8}function $$($){let{id:Z,credential:X,identity:J,label:z,addedAt:G}=$;return{id:Z,...z!==void 0?{label:z}:{},type:X.type,addedAt:G,...J!==void 0?{accountId:J}:{},...X.type==="api"?{baseURL:X.baseURL.trim(),authHeader:X.authHeader??"authorization-bearer"}:{}}}function j9($,Z){if($.type==="api")return{apiKey:$.apiKey};return{...$.access!==void 0?{access:$.access}:{},refresh:$.refresh,...$.expires!==void 0?{expires:$.expires}:{},...Z!==void 0?{lastRefreshedAt:Z}:{}}}function U9($,Z){if($.type==="api")return{...$,baseURL:$.baseURL.trim(),authHeader:$.authHeader??"authorization-bearer"};return{...$,...Z!==void 0?{lastRefreshedAt:Z}:{}}}function K9($,Z={}){if(!_($))return"credential must be an object";if($.type==="oauth"){if(typeof $.refresh!=="string"||!$.refresh.trim())return"oauth credential needs a refresh token";return}if($.type==="api"){if(typeof $.apiKey!=="string"||!$.apiKey.trim())return"api credential needs an api key";if($.apiKey.trim()!==$.apiKey)return"api key must not carry surrounding whitespace";if(!(Z.baseURLOptional&&$.baseURL===void 0)&&!L8($.baseURL))return"api credential needs a valid baseURL";return}return"credential type must be oauth or api"}var I3="transition",q9="transitionMark";function kJ($){if(!_($))return;let Z=$[I3];if(!_(Z))return;if(typeof Z.mark!=="string"||Z.mark.length===0)return;if(Z.enabled===!0)return{mark:Z.mark,enabled:!0};if(Z.enabled===!1&&typeof Z.reason==="string")return{mark:Z.mark,enabled:!1,reason:Z.reason};return}function b$($,Z,X){if(X.enabled)T$($,Z);else G1($,Z,X.reason??"");if(!$.rosterRow(Z))return;let J=$.entry(Z)??{credentialEpoch:1,needsFirstReading:!0};if($.setEntry(Z,{...J,[q9]:X.mark}),!X.enabled)return;let z=$.rows().find((G)=>G.id===Z);if(z?.type==="oauth"&&z.identity!==void 0)a1($,z.identity)}function fJ($,Z){if($.type!=="api")return $;return{...$,...Z.baseURL!==void 0?{baseURL:Z.baseURL}:{},...Z.authHeader!==void 0?{authHeader:Z.authHeader}:{}}}function yJ($){if(!$.binding)return!1;return $.replace===!0||$.dispatch===void 0}function vJ($,Z,X,J={}){let z=_(Z.accounts)?Z.accounts:{},G=new Map;for(let Q of H1($,Z,X)){if(Q.invalid||Q.staged||!Q.credential)continue;let Y=Object.hasOwn(z,Q.id)?z[Q.id]:void 0;if(!_(Y))continue;let W=N0(Y[v]);if(!W?.binding)continue;if(W.digest!==h0(Q.credential))continue;let H=Q.credentialEpoch??1;if(W.credentialEpoch>H){if(!yJ(W))continue;if(J.requireCredentialStamps){if(W.dispatch===void 0)continue;if(W.dispatch!==a0(fJ(Q.credential,W.binding)))continue}G.set(Q.id,{kind:"replace",stamp:{...W,binding:W.binding}})}else if(W.credentialEpoch===H&&W.dispatch!==void 0&&W.dispatch===a0(Q.credential)&&W.binding.identity!==void 0&&Q.identity===void 0)G.set(Q.id,{kind:"identity",identity:W.binding.identity});else if(W.credentialEpoch===H&&W.binding.identity===Q.identity){if(J.requireCredentialStamps&&W.dispatch!==a0(Q.credential))continue;let B=kJ(Y[v]);if(B&&B1($,Q.id)?.[q9]!==B.mark)G.set(Q.id,{kind:"transition",transition:B})}}return G}function _8($,Z,X,J){let G={...$.entry(Z)??{},credentialEpoch:X,needsFirstReading:!0};if(delete G.quota,J.identity!==void 0&&typeof G.disabledReason==="string"&&G.disabledReason.startsWith(i1))delete G.disabledReason;$.setEntry(Z,G);let Q=$.rosterRow(Z);if(!Q)return;if(J.identity!==void 0)Q.accountId=J.identity;else delete Q.accountId;if(J.baseURL!==void 0)Q.baseURL=J.baseURL;if(J.authHeader!==void 0)Q.authHeader=J.authHeader}function C8($,Z,X,J={}){let z=vJ($,Z,X,J);if(z.size===0)return{config:$,torn:[]};let G=structuredClone($),Q={rows:()=>H1(G,Z,X),rosterRow:(Y)=>A3(G,Y),entry:(Y)=>B1(G,Y),setEntry:(Y,W)=>R3(G,Y,W)};for(let[Y,W]of z)if(W.kind==="replace")_8(Q,Y,W.stamp.credentialEpoch,W.stamp.binding);for(let[Y,W]of z)if(W.kind==="identity")A1(Q,Y,W.identity);else if(W.kind==="transition")b$(Q,Y,W.transition);else if(W.stamp.binding.identity!==void 0)a1(Q,W.stamp.binding.identity);return{config:G,torn:[...z.keys()]}}function T8($,Z,X,J={}){let{config:z,torn:G}=C8($,Z,X,J),Q=H1(z,Z,X,J.providerState);for(let Y of Q){if(G.includes(Y.id))Y.torn=!0,Y.candidate=!1;if(J.requireCredentialStamps&&Y.stamp!=="bound")Y.unbound=!0,Y.candidate=!1}return Q}async function A8($){try{return await gJ($,"utf8")}catch(Z){if(Z.code==="ENOENT")return;throw Z}}function D9($){if($===void 0)return{exists:!1};try{return{exists:!0,value:JSON.parse($)}}catch(Z){return{exists:!0,parseError:Z}}}async function V0($){for(let Z=0;Z<3;Z++){let X=await A8($.configPath),J=await A8($.statePath),z=await A8($.configPath);if(X!==z){if(Z<2)await hJ(2+Math.floor(Math.random()*4));continue}let G=G9(D9(X));if(G.status==="error")return{status:"error",file:"config",reason:G.reason};let Q=Q9(D9(J));if(Q.status==="error")return{status:"error",file:"state",reason:Q.reason};if(G.status==="pending-migration")return{status:"pending-migration",config:G.config};return{status:"ready",configExists:G.exists,stateExists:Q.exists,config:G.config,state:Q.state,rows:T8(G.config,Q.state,$.codec,{requireCredentialStamps:$.requireCredentialStamps===!0,...$.providerState?{providerState:$.providerState}:{}})}}return{status:"error",file:"config",kind:"snapshot-contended",retryable:!0,reason:"The store was changing; retry the operation once writes settle."}}function S0($,Z,X,J="before-first-write"){if($.status==="error"&&$.kind==="snapshot-contended")return new E({operation:Z,...X!==void 0?{rowId:X}:{},phase:J,kind:"snapshot-contended",retryable:!0,message:$.reason});return new E({operation:Z,...X!==void 0?{rowId:X}:{},phase:J,retryable:!1,kind:$.status==="pending-migration"?"pending-migration":"load-error",message:$.status==="pending-migration"?"the config holds a legacy roster that has not been migrated into the pool":`${$.file} file cannot be loaded: ${$.reason}`})}class N9{ctx;snapshot;locks;progress;info;config;state;constructor($,Z,X,J,z){this.ctx=$,this.snapshot=Z,this.locks=X,this.progress=J,this.info=z,this.config=structuredClone(Z.config),this.state=structuredClone(Z.state)}rows(){return T8(this.config,this.state,this.ctx.codec,{requireCredentialStamps:this.ctx.requireCredentialStamps===!0,...this.ctx.providerState?{providerState:this.ctx.providerState}:{}})}row($){return this.rows().find((Z)=>Z.id===$)}reservation($){if(this.rosterRow($)){let X=this.entry($);return X&&Object.hasOwn(X,"staged")?X.staged:void 0}let Z=this.stateAccount($)?.[v];return _(Z)&&Object.hasOwn(Z,"staged")?Z.staged:void 0}assertNotStaged($){S1(this.info.operation,$,this.reservation($))}roster(){if(!Array.isArray(this.config.accounts))this.config.accounts=[];return this.config.accounts}rosterRow($){return this.roster(),A3(this.config,$)}dropRosterRows($){let Z=this.roster(),X=Z.filter((J)=>!(_(J)&&J.id===$));return this.config.accounts=X,Z.length-X.length}entries(){return P8(this.config)}entry($){return this.entries(),B1(this.config,$)}setEntry($,Z){R3(this.config,$,Z)}async completeTorn(){let{config:$,torn:Z}=C8(this.config,this.state,this.ctx.codec,{requireCredentialStamps:this.ctx.requireCredentialStamps===!0});if(Z.length===0)return;this.config=$,await this.commitConfig({counted:!1})}stateAccount($){let Z=_(this.state.accounts)?this.state.accounts:{},X=Object.hasOwn(Z,$)?Z[$]:void 0;return _(X)?X:void 0}dropStateAccount($){if(_(this.state.accounts)&&Object.hasOwn(this.state.accounts,$))delete this.state.accounts[$]}setStateAccount($,Z){if(!_(this.state.accounts))this.state.accounts={};Object.defineProperty(this.state.accounts,$,{value:Z,enumerable:!0,writable:!0,configurable:!0})}async commitConfig($={}){let Z=this.roster(),X=new Set;for(let W of Z)if(_(W)&&typeof W.id==="string")X.add(W.id);let J=new Set;for(let W of e1(this.snapshot.config))if(_(W)&&typeof W.id==="string"&&!X.has(W.id))J.add(W.id);for(let W of Object.keys(this.entries()))if(!X.has(W))J.add(W);V9(this.config,J);let z=this.entries(),G={};for(let[W,H]of Object.entries(z))if(X.has(W))Object.defineProperty(G,W,{value:H,enumerable:!0,writable:!0,configurable:!0});let Q=this.config[w],Y={...this.config,version:S$,accounts:Z,[w]:{...Q,schemaVersion:Y1,[R0]:G}};await this.write(this.ctx.configPath,Y,"config",$.counted??!0,$.durable??!1,()=>{if($.publicationDecision)this.markPublicationDecision();for(let W of J)this.ctx.removedIds.add(W);this.config=Y}),this.config=Y}async commitState($,Z={}){let X={...this.state,version:S$,accounts:_(this.state.accounts)?this.state.accounts:{}};if(await this.write(this.ctx.statePath,X,"state",!0,Z.durable??!1),this.state=X,$)this.progress.committed=$}async assertAll(){await this.locks.assertAll()}async syncState(){await this.assertAll();try{if(this.snapshot.stateExists)await V8(this.ctx.statePath)}catch($){throw new E({operation:this.info.operation,rowId:this.info.rowId,phase:"before-first-write",kind:"publication-sync",retryable:!0,message:"Publication sync failed before the decision; nothing was written. Retry the same plan.",cause:$})}}markPublicationDecision(){this.progress.publicationDecided=!0}async syncConfig(){await this.assertAll(),await V8(this.ctx.configPath)}async write($,Z,X,J=!0,z=!1,G){await H8($,Z,{durable:z,beforeRename:async()=>{await this.ctx.onStep?.(`before-${X}-write`,this.info),await this.locks.assertAll()}},()=>{if(J)this.progress.writes++;G?.()}),await this.ctx.onStep?.(`after-${X}-write`,this.info)}}async function M9($,Z){let X=new Q1($.lockDefaults,$.lockEnv),J={writes:0};try{for(let Y of $.storeLocks)await X.acquire(Y);let z=await V0($);if(z.status==="error")throw S0(z,"initialize",void 0);if(z.status==="ready")return"already-ready";let G={};for(let[Y,W]of Object.entries(z.config))if(!Z.includes(Y))G[Y]=W;G.version=S$,G[w]={schemaVersion:Y1,[R0]:{}};let Q={operation:"initialize",rowId:void 0};return await O0($.configPath,G,{beforeRename:async()=>{await $.onStep?.("before-config-write",Q),await X.assertAll()}}),J.writes++,await $.onStep?.("after-config-write",Q),"initialized"}catch(z){throw Z$(z,"initialize",void 0,J)}finally{await X.releaseAll()}}async function i($,Z,X,J,z,G={}){let Q=Z.held.length;try{for(let H of $.storeLocks)await Z.acquire(H);let Y=await V0($);if(Y.status!=="ready")throw S0(Y,J.operation,J.rowId,X.writes>0?"after-first-write":"before-first-write");let W=new N9($,Y,Z,X,J);if(J.rowId!==void 0&&!["add","remove","pull","publishRoster","enable","disable"].includes(J.operation))W.assertNotStaged(J.rowId);if(G.completeTorn??!0)await W.completeTorn();return await z(W)}finally{await Z.releaseTo(Q)}}function Z$($,Z,X,J){let z=Z==="pull"?"pull":J.writes>0?"after-first-write":"before-first-write",G=z==="after-first-write"?J.committed:void 0;if(Z==="publishRoster"&&J.publicationDecided)return new E({operation:Z,...X!==void 0?{rowId:X}:{},phase:z,kind:"publication-incomplete",retryable:!0,message:"The publication may already be decided. Replay the same plan or check publication(operationId).",cause:$});if(Z==="publishRoster"&&$ instanceof A$)return new E({operation:Z,...X!==void 0?{rowId:X}:{},phase:z,kind:"publication-sync",retryable:!0,message:"Publication sync failed before the decision; nothing was written. Retry the same plan.",cause:$});if($ instanceof E){if($.phase===z&&$.rowId===X&&$.operation===Z&&$.committed===G)return $;return new E({operation:Z,...X!==void 0?{rowId:X}:{},phase:$.kind==="after-persist-hook"?$.phase:z,retryable:$.retryable,kind:$.kind,...$.committed??G?{committed:$.committed??G}:{},message:$.message,...$.cause!==void 0?{cause:$.cause}:{}})}let Q={operation:Z,...X!==void 0?{rowId:X}:{},phase:z,...G?{committed:G}:{},cause:$};if($ instanceof r1)return new E({...Q,retryable:!0,kind:"lock-ownership",message:z==="after-first-write"?`${Z} lost a lease after its first write; the intermediate stays on disk`:`${Z} lost a lease before writing; nothing was written`});if($ instanceof R1)return new E({...Q,retryable:!0,kind:"lock-contention",message:$.message});return new E({...Q,retryable:!1,kind:"unexpected",message:$ instanceof Error?$.message:String($)})}async function Y0($,Z,X,J,z){let G=new Q1($.lockDefaults,$.lockEnv),Q={writes:0};try{return await z(G,Q)}catch(Y){let W=Z$(Y,Z,X,Q);if(W.kind!=="after-persist-hook")await X9(Z,J,X,W,$.logger);throw W}finally{await G.releaseAll()}}function L0($,Z){return{...$.rowLockOptions,name:`row-${encodeURIComponent(p(Z))}`,path:$.ctx.statePath}}async function n0($,Z,X){let J=await V0($.ctx);if(J.status!=="ready")throw S0(J,Z,X);let z=J.rows.find((H)=>H.id===X),G=B1(J.config,X),Q=J.state.accounts,Y=_(Q)&&Object.hasOwn(Q,X)?Q[X]:void 0,W=_(Y)?Y[v]:void 0;if(z&&!["enable","disable"].includes(Z)&&G&&Object.hasOwn(G,"staged"))S1(Z,X,G.staged);if(!z&&_(W)&&Object.hasOwn(W,"staged"))S1(Z,X,W.staged);if(!z)throw I0(Z,X);return{result:J,row:z}}function I0($,Z){return new E({operation:$,rowId:Z,phase:$==="pull"?"pull":"before-first-write",retryable:!1,kind:"unknown-row",message:`no row ${Z} in the pool`})}function j0($,Z){if(Z.unbound)throw O($,Z.id,"unbound-credential",`row ${Z.id}'s credential is not the one this store stamped for it (stamp ${Z.stamp}); replace it with fresh material`)}function O($,Z,X,J,z=!1){return new E({operation:$,rowId:Z,phase:$==="pull"?"pull":"before-first-write",retryable:z,kind:X,message:J})}async function x3($,Z,X,J){let{ctx:z}=$,G=new Q1(z.lockDefaults,z.lockEnv),Q={writes:0};try{if(!$0(X?.credentialEpoch))throw O("pull",Z,"invalid-input","the credential epoch the reading was issued for must be a positive safe integer");await i(z,G,Q,{operation:"pull",rowId:Z},async(Y)=>{Y.assertNotStaged(Z);let W=Y.row(Z);if(!W)throw I0("pull",Z);if(W.invalid)throw O("pull",Z,"invalid-row",`row ${Z} is invalid`);if(!W.credential)throw O("pull",Z,"no-credential",`row ${Z} holds no credential`);j0("pull",W);let H=Y.entry(Z);if(W.torn||!H||H.credentialEpoch!==X.credentialEpoch||W.identity!==X.identity)throw new E({operation:"pull",rowId:Z,phase:"pull",retryable:!0,kind:"attribution",message:`quota for ${Z} was issued for a credential the row no longer holds`});let B=z.codec.merge(H.quota,J);if(!z.codec.validate(B))throw O("pull",Z,"invalid-quota","the quota codec rejected the merged map");Y.setEntry(Z,{...H,quota:B,needsFirstReading:!1}),await Y.commitConfig()},{completeTorn:!1})}catch(Y){throw Z$(Y,"pull",Z,Q)}finally{await G.releaseAll()}}function r0($,Z,X,J,z="the provider state"){if(!$)throw O(Z,X,"invalid-input","the store was opened without a provider-state codec");let G;try{let Q=JSON.stringify(J);G=Q===void 0?void 0:JSON.parse(Q)}catch{G=void 0}if(G===void 0)throw O(Z,X,"invalid-provider-state",`${z} cannot be stored as JSON`);if(!$.validate(G))throw O(Z,X,"invalid-provider-state",`the provider-state codec rejected ${z}`);return G}function E$($,Z,X,J,z){if(J===void 0||!$?.merge)return{kind:"set",value:z};return{kind:"set",value:r0($,Z,X,$.merge(structuredClone(J),structuredClone(z)),"the merged provider state")}}function L9($,Z,X,J,z){let G=$?.onReplace,Q=G?G(Z.providerState===void 0?void 0:structuredClone(Z.providerState),{id:Z.id,credentialEpoch:X,...Z.identity!==void 0?{previousIdentity:Z.identity}:{},...J!==void 0?{identity:J}:{},...z!==void 0?{incoming:structuredClone(z)}:{}}):z;if(Q===void 0)return{kind:"clear"};if(!G)return{kind:"set",value:Q};return{kind:"set",value:r0($,"replace",Z.id,Q,"the provider state onReplace returned")}}function F9($,Z,X,J,z){if(Z.kind==="set")return t1($,Z.value);if(Z.kind==="clear")return;return I$(X,J?.credential,z,J?.identity)}async function P9($,Z,X,J,z={}){Q0("updateProviderState");let{ctx:G}=$,Q="updateProviderState";return Y0(G,Q,Z,z.onFailure,async(Y,W)=>{let H=G.providerState;if(!H)throw O(Q,Z,"invalid-input","the store was opened without a provider-state codec");if(typeof J!=="function")throw O(Q,Z,"invalid-input","a mutator is required");let B=_(X)?X.credentialEpoch:void 0;if(!$0(B))throw O(Q,Z,"invalid-input","the credential epoch the provider state was read at is required");let{row:V}=await n0($,Q,Z);await Y.acquire(L0($,V));for(let U of z.extraLocks??[])await Y.acquire(U);return i(G,Y,W,{operation:Q,rowId:Z},async(U)=>{let K=U.row(Z);if(!K)throw I0(Q,Z);if(p(K)!==p(V))throw O(Q,Z,"row-key-changed",`row ${Z}'s wire identity changed while its lock was being taken`,!0);if(K.invalid)throw O(Q,Z,"invalid-row",`row ${Z} failed validation`);if(!K.credential)throw O(Q,Z,"no-credential",`row ${Z} holds no credential`);if(j0(Q,K),(K.credentialEpoch??1)!==B||K.identity!==X.identity)throw O(Q,Z,"attribution",`the provider state for ${Z} was read for a credential or account the row no longer holds`,!0);let M=await R8(U,H,Q,K,J);if(M.kind!=="changed")return{id:Z,outcome:"unchanged",...M.kind==="unchanged"&&M.value!==void 0?{providerState:M.value}:{}};return U.setStateAccount(Z,M.account),await U.commitState(),M.value===void 0?{id:Z,outcome:"cleared"}:{id:Z,outcome:"updated",providerState:M.value}})})}var O9=Symbol.for("@cortexkit/common-auth/store/decline-transition");async function R8($,Z,X,J,z,G=!1){let{id:Q,credential:Y}=J;if(!Y)throw O(X,Q,"no-credential",`row ${Q} holds no credential`);let W=J.credentialEpoch??1,H=$.stateAccount(Q),B=H?.[v],V=N0(B);if(!_(B)||!V?.binding||V.digest!==h0(Y)||V.credentialEpoch!==W||V.binding.identity!==J.identity)throw O(X,Q,"unbound-credential",`row ${Q}'s credential carries no stamp of this store to bind a provider state to (stamp ${J.stamp}); rotate or replace it first`);let U=J.providerState===void 0?void 0:structuredClone(J.providerState),K=await g0(X,()=>z(U,J));if(G&&K===O9)return{kind:"declined"};let j=K===void 0?void 0:r0(Z,X,Q,K,"the provider state the mutator returned"),M=H!==void 0&&Object.hasOwn(H,H0);if(j===void 0?!M:J.providerState!==void 0&&JSON.stringify(J.providerState)===JSON.stringify(j))return{kind:"unchanged",...j!==void 0?{value:j}:{}};let D={...H};if(j===void 0){delete D[H0];let q={...B};delete q.providerState,D[v]=q}else{D[H0]=j;let q=t1(Z,j);if(V.providerState!==q)D[v]={...B,providerState:q}}return{kind:"changed",...j!==void 0?{value:j}:{},account:D}}import{randomUUID as _9}from"node:crypto";async function f3($,Z,X){if(!X)return;let J=$.rows().map((G)=>{let{id:Q,type:Y,label:W,enabled:H,disabledReason:B,identity:V,credentialEpoch:U,stamp:K,staged:j,torn:M,invalid:D}=G;return{id:Q,type:Y,label:W,enabled:H,disabledReason:B,identity:V,credentialEpoch:U,stamp:K,staged:j,torn:M,invalid:D}}),z=await g0($.info.operation,()=>X({id:Z,row:J.find((G)=>G.id===Z),rows:J,config:structuredClone($.snapshot.config)}));if(z!==void 0)throw O($.info.operation,Z,"row-protected",z)}var wJ=["access","refresh","expires","lastRefreshedAt","apiKey"];function mJ($){return{baseURL:String($.baseURL).trim(),authHeader:$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer"}}function pJ($,Z,X){if(X.type!=="api")return X;let J=$.rosterRow(Z);if(!_(J)){if(X.baseURL===void 0)throw O($.info.operation,Z,"invalid-input","api credential needs a valid baseURL");return{...X,baseURL:X.baseURL}}let z=$.row(Z)?.credential,G=z?.type==="api"?{baseURL:z.baseURL.trim(),authHeader:z.authHeader??"authorization-bearer"}:mJ(J),Q=X.baseURL?.trim()??G.baseURL,Y=X.authHeader??G.authHeader;if(Q!==G.baseURL||Y!==G.authHeader)throw O($.info.operation,Z,"endpoint-mismatch",`row ${Z} sends its key to another endpoint or header; a key for another endpoint is a replacement`);return{...X,baseURL:Q,authHeader:Y}}function C9($,Z,X,J){let z=$.rosterRow(Z),G=$.row(Z),Q=J??(G?G.identity:_(z)&&typeof z.accountId==="string"&&z.accountId?z.accountId:void 0);return{...Q!==void 0?{identity:Q}:{},...X.type==="api"?{baseURL:X.baseURL,authHeader:X.authHeader??"authorization-bearer"}:{}}}function b3($,Z,X,J,z={}){let G=pJ(Z,X,J),Q=Z.stateAccount(X),Y=z.providerState??{kind:"keep"},W=Z.row(X)?.credentialEpoch??Z.entry(X)?.credentialEpoch,H=typeof W==="number"?W:1,B=F9($.ctx.providerState,Y,Q,Q&&Object.hasOwn(Q,H0)?Z.row(X):void 0,H),V=typeof Q?.lastRefreshedAt==="number"?Q.lastRefreshedAt:void 0,U=G.type==="oauth"?z.stamp??x$(V,$.ctx.now()):void 0,K={...Q??{}};for(let D of wJ)delete K[D];if(z.clearErrors)delete K.lastRefreshError,delete K.lastQuotaRefreshError,delete K.quota;if(Y.kind==="clear")delete K[H0];else if(Y.kind==="set")K[H0]=Y.value;let j=U9(G,U),M={...K,...j9(G,U),[v]:{...z.staged?{staged:z.staged}:{},...z.transition!==void 0?{[I3]:z.transition}:{},...F8(j,H,z.binding??C9(Z,X,j,z.identity),{replace:z.binding!==void 0,...B!==void 0?{providerState:B}:{}})}};return{stored:j,account:M}}async function E3($,Z,X){return $.setStateAccount(Z,X.account),await $.commitState(X.stored),X.stored}async function y3($,Z,X,J,z={}){return E3(Z,X,b3($,Z,X,J,z))}async function uJ($,Z,X){if(!Z.credential||Z.stamp!=="bound")return;let J=$.stateAccount(Z.id),z=I$(J,Z.credential,Z.credentialEpoch??1,Z.identity);$.setStateAccount(Z.id,{...J??{},[v]:F8(Z.credential,Z.credentialEpoch??1,C9($,Z.id,Z.credential,X),z!==void 0?{providerState:z}:{})}),await $.commitState()}function I8($,Z,X){let J=$==="add"?o1(Z):void 0;if(J)throw O($,Z,"invalid-input",J);let z=K9(X,{baseURLOptional:$==="rotate"});if(z)throw O($,Z,"invalid-input",z)}function v3($,Z,X,J){if(!X)throw I0($,Z);if(X.invalid)throw O($,Z,"invalid-row",`row ${Z} failed validation`);if(J&&J.type!==X.type)throw O($,Z,"type-mismatch",`row ${Z} holds a ${X.type} credential`);return X}function J$($,Z,X){if(X!==void 0&&!$0(_(X)?X.credentialEpoch:void 0))throw O($,Z,"invalid-input","the attribution must name a credential epoch that is a positive safe integer")}function g3($,Z,X,J){if(!X)throw I0($,Z);if(X.invalid)throw O($,Z,"invalid-row",`row ${Z} failed validation`);if((X.credentialEpoch??1)!==J.credentialEpoch||X.identity!==J.identity)throw O($,Z,"attribution",`the ${$} of ${Z} was issued for a credential or account the row no longer holds`,!0)}function k3($,Z){return O($,Z,"identity-mismatch",`row ${Z} is recorded for another account; a credential of a different account is a replacement`)}function k$($,Z){return O($,Z,"row-key-changed",`row ${Z}'s wire identity changed while its lock was being taken`,!0)}function lJ($,Z,X,J){let{id:z,credential:G,identity:Q}=X;if(!$.ctx.requireCredentialStamps||Z.rosterRow(z)||!X$(Z.state,z))return;let Y=()=>{throw O("add",z,"unbound-credential",`orphan ${z} cannot be bound to this add's material; remove it explicitly before adding different material`)},W=Z.stateAccount(z),H=N0(W?.[v]);if(!H?.binding||H.dispatch===void 0||H.replace)return Y();if(G.type==="api"&&(H.binding.baseURL===void 0||H.binding.authHeader===void 0))return Y();let B=G.type==="api"?{...G,baseURL:H.binding.baseURL,authHeader:H.binding.authHeader}:G,[V]=H1({accounts:[$$({id:z,credential:B,identity:H.binding.identity,addedAt:0})],[w]:{rows:{[z]:{credentialEpoch:S3(Z.config,z)}}}},Z.state,$.ctx.codec,$.ctx.providerState);if(!V?.credential||V.invalid||V.stamp!=="bound")return Y();if(Q!==void 0&&Q!==V.identity)return Y();if(h0(G)!==H.digest)return Y();if(G.type==="api"){if(G.baseURL.trim()!==H.binding.baseURL)return Y();if((G.authHeader??"authorization-bearer")!==H.binding.authHeader)return Y()}else if(a0(G)!==H.dispatch)return Y();if(H.providerState!==void 0&&V.providerState===void 0)return Y();if(J!==void 0&&t1($.ctx.providerState,J)!==H.providerState)return Y();return V}function dJ($,Z,X,J){let{id:z,credential:G,identity:Q,label:Y}=X,W=Z.rosterRow(z),H=()=>{throw O("add",z,W?"id-exists":"unbound-credential",`row ${z} does not match this staged add`)},B=Z.stateAccount(z),V=N0(B?.[v]),U=V?.staged;if(!V?.binding||!U||V.replace||V.dispatch===void 0)return H();if(W&&(W.type!==G.type||W.label!==Y||W.accountId!==Q))return H();if(U.reservation!==X.stage?.reservation||U.label!==Y||U.disabledReason!==X.disabled?.reason||V.binding.identity!==Q)return H();let K=J===void 0?void 0:I1(J),j=B?.[H0],M=j===void 0?void 0:I1(j);if(U.providerState!==K||U.providerState!==M)return H();if(h0(G)!==V.digest||a0(G)!==V.dispatch)return H();let D=W?Z.config:{accounts:[{...$$({id:z,credential:G.type==="api"?{...G,baseURL:V.binding.baseURL??"",authHeader:V.binding.authHeader}:G,identity:V.binding.identity,label:U.label,addedAt:0}),enabled:!1}],[w]:{rows:{[z]:{credentialEpoch:V.credentialEpoch,disabledReason:U.disabledReason,staged:{reservation:U.reservation}}}}},q=H1(D,Z.state,$.ctx.codec,$.ctx.providerState).find((F)=>F.id===z);if(!q?.credential||q.invalid||q.stamp!=="bound"||q.type!==G.type||q.enabled||q.label!==U.label||q.identity!==V.binding.identity||q.disabledReason!==U.disabledReason||q.staged?.reservation!==U.reservation)return H();if(W)return{id:z,outcome:"exists",credential:q.credential,credentialEpoch:V.credentialEpoch};if(S3(Z.config,z)!==V.credentialEpoch)return H();return Z.roster().push({...$$({id:z,credential:G,identity:Q,label:Y,addedAt:$.ctx.now()}),enabled:!1}),Z.setEntry(z,{credentialEpoch:V.credentialEpoch,needsFirstReading:G.type==="oauth",disabledReason:U.disabledReason,staged:{reservation:U.reservation}}),Z.commitConfig().then(()=>({id:z,outcome:"completed",credential:q.credential,credentialEpoch:V.credentialEpoch}))}async function T9($,Z,X={}){Q0("add");let{ctx:J}=$,{id:z,credential:G,identity:Q,label:Y}=Z,W=Z.stage!==void 0||Z.disabled!==void 0,H=await Y0(J,"add",z,X.onFailure,async(B,V)=>{I8("add",z,G);let U=X.onExisting??"rotate";if(Z.stage!==void 0&&U==="rotate")throw O("add",z,"invalid-input","a staged add needs onExisting: 'refuse' or 'stage-duplicate'");if(!["rotate","refuse","stage-duplicate"].includes(U)||Z.stage!==void 0&&(Y!==void 0&&typeof Y!=="string"||Q!==void 0&&(typeof Q!=="string"||!Q))||Z.disabled!==void 0&&(!_(Z.disabled)||typeof Z.disabled.reason!=="string")||Z.stage!==void 0&&(!_(Z.stage)||typeof Z.stage.reservation!=="string"||!Z.stage.reservation||!Z.disabled)||U==="stage-duplicate"&&(!Z.disabled||!Z.stage))throw O("add",z,"invalid-input","staging requires a reservation and a disabled reason");let K=Z.providerState===void 0?void 0:r0(J.providerState,"add",z,Z.providerState);if(await B.acquire(L0($,{id:z,identity:Q})),G.type==="oauth")await B.acquire(X.providerLock??$.providerLock);for(let j of X.extraLocks??[])await B.acquire(j);return i(J,B,V,{operation:"add",rowId:z},async(j)=>{await f3(j,z,X.protect);let M=_(j.state.accounts)?j.state.accounts:{},D=Object.entries(M).find(([h,g])=>{if(h===z||j.rosterRow(h)||!_(g))return!1;let l=g[v];if(!_(l)||!Object.hasOwn(l,"staged"))return!1;return G.type==="oauth"?g.refresh===G.refresh:typeof g.apiKey==="string"&&g.apiKey.trim()===G.apiKey.trim()});if(D)throw O("add",D[0],"row-staged",`orphan ${D[0]} reserves this secret until its staged add is replayed or removed`);if(J.removedIds.has(z))throw O("add",z,"id-removed",`id ${z} was removed from the roster in this process and is not reused`);if(Z.stage&&U!=="rotate"&&(j.rosterRow(z)||X$(j.state,z)))return dJ($,j,Z,K);if(U==="rotate"){j.assertNotStaged(z);let h=j.rows().find((g)=>g.fingerprint===W1(G));if(h)j.assertNotStaged(h.id)}if(U==="refuse"){let h=j.rows().find((c)=>c.fingerprint===W1(G)||c.id===z&&c.credential),g=_(j.state.accounts)?j.state.accounts:{},l=Object.entries(g).find(([,c])=>{if(!_(c))return!1;if(G.type==="oauth")return c.refresh===G.refresh;return typeof c.apiKey==="string"&&c.apiKey.trim()===G.apiKey.trim()})?.[0],J0=h?.id??l??z;if(h||l!==void 0||X$(j.state,z))throw O("add",J0,"credential-exists",`row ${J0} already holds this secret or id`)}if(U==="stage-duplicate"&&(j.rosterRow(z)||X$(j.state,z)))throw O("add",z,"id-exists",`row ${z} already exists`);let q=lJ($,j,Z,K),F=j.rows(),C=W1(G),L=U==="rotate"&&!q&&F.find((h)=>h.invalid===void 0&&h.fingerprint===C);if(L){if(j.assertNotStaged(L.id),j0("add",L),Q!==void 0&&L.identity!==void 0&&Q!==L.identity)throw k3("add",L.id);let h=b3($,j,L.id,G,{...K!==void 0?{providerState:E$(J.providerState,"add",L.id,L.providerState,K)}:{}});await j.completeTorn(),j.assertNotStaged(L.id);let g=await E3(j,L.id,h);return{id:L.id,outcome:"rotated",credential:g,credentialEpoch:L.credentialEpoch??1}}let N=F.find((h)=>h.id===z);if(N){if(N.invalid)throw O("add",z,"invalid-row",`row ${z} is invalid`);if(N.credential)throw O("add",z,"id-exists",`row ${z} already holds a credential`);if(j0("add",N),N.type!==G.type)throw O("add",z,"type-mismatch",`row ${z} is a ${N.type} row`);if(Q!==void 0&&N.identity!==void 0&&Q!==N.identity)throw k3("add",z);if(!N.hasEntry)j.setEntry(z,{credentialEpoch:1,needsFirstReading:G.type==="oauth"});let h=b3($,j,z,G,{clearErrors:!0,...K!==void 0?{providerState:{kind:"set",value:K}}:{}});await j.completeTorn();let g=await E3(j,z,h);if(!N.hasEntry)await j.commitConfig();return{id:z,outcome:"completed",credential:g,credentialEpoch:N.credentialEpoch??1}}let P=S3(j.config,z);if(!$0(P))throw O("add",z,"id-removed",`id ${z} has held every credential epoch and is not reused; add the credential under another id`);let S=q?.identity??Q;j.roster().push($$({id:z,credential:G,...S!==void 0?{identity:S}:{},...Y!==void 0?{label:Y}:{},addedAt:J.now()})),j.setEntry(z,{credentialEpoch:P,needsFirstReading:G.type==="oauth",...Z.stage?{staged:{reservation:Z.stage.reservation}}:{}});let f="added";if(Z.disabled)G1(j,z,Z.disabled.reason),f="added-disabled";if(!Z.disabled&&S!==void 0&&G.type==="oauth"){if(F.find((g)=>g.invalid===void 0&&g.type==="oauth"&&g.enabled&&g.identity===S))G1(j,z,W8),f="added-disabled"}if(q?.credential)return await j.commitConfig(),{id:z,outcome:f,credential:q.credential,credentialEpoch:q.credentialEpoch??P};j.dropStateAccount(z);let n=b3($,j,z,G,{...Z.stage&&Z.disabled?{staged:{reservation:Z.stage.reservation,disabledReason:Z.disabled.reason,...Y!==void 0?{label:Y}:{},...K!==void 0?{providerState:I1(K)}:{}}}:{},...K!==void 0?{providerState:{kind:"set",value:K}}:{}});if(U==="rotate")await j.completeTorn();let C0=await E3(j,z,n);return await j.commitConfig(),{id:z,outcome:f,credential:C0,credentialEpoch:P}},{completeTorn:!1})});if(!W&&G.type==="oauth"&&(H.outcome==="added"||H.outcome==="completed"))$.firePull(H.id,"add");return H}async function A9($,Z,X,J={},z={}){Q0("replace");let{ctx:G}=$,Q=await Y0(G,"replace",Z,z.onFailure,async(Y,W)=>{I8("replace",Z,X),J$("replace",Z,z.attribution);let H=J.providerState===void 0?void 0:r0(G.providerState,"replace",Z,J.providerState),{row:B}=await n0($,"replace",Z);if(await Y.acquire(L0($,B)),X.type==="oauth")await Y.acquire(z.providerLock??$.providerLock);for(let V of z.extraLocks??[])await Y.acquire(V);return i(G,Y,W,{operation:"replace",rowId:Z},async(V)=>{if(z.attribution!==void 0)g3("replace",Z,V.row(Z),z.attribution),await V.completeTorn();let U=v3("replace",Z,V.row(Z),X);if(p(U)!==p(B))throw k$("replace",Z);let K=V.entry(Z)?.credentialEpoch,j=(typeof K==="number"?K:1)+1;if(!$0(j))throw O("replace",Z,"invalid-row",`row ${Z}'s credential epoch cannot advance past ${Number.MAX_SAFE_INTEGER}; remove the row and add the new credential as a new row`);let M=L9(G.providerState,U,j,J.identity,H),D={...J.identity!==void 0?{identity:J.identity}:{},...X.type==="api"?{baseURL:X.baseURL.trim(),authHeader:X.authHeader??"authorization-bearer"}:{}};if(_8(V,Z,j,D),J.identity!==void 0)a1(V,J.identity);let q=await y3($,V,Z,X,{clearErrors:!0,binding:D,providerState:M});return await V.commitConfig(),{id:Z,credential:q,credentialEpoch:j}},{completeTorn:z.attribution===void 0})});if(X.type==="oauth")$.firePull(Z,"replace");return Q}async function R9($,Z,X,J={},z={}){Q0("rotate");let{ctx:G}=$;return Y0(G,"rotate",Z,z.onFailure,async(Q,Y)=>{I8("rotate",Z,X),J$("rotate",Z,z.attribution);let W=J.providerState===void 0?void 0:r0(G.providerState,"rotate",Z,J.providerState),{row:H}=await n0($,"rotate",Z);if(await Q.acquire(L0($,H)),J.identity!==void 0&&X.type==="oauth")await Q.acquire(z.providerLock??$.providerLock);for(let B of z.extraLocks??[])await Q.acquire(B);return i(G,Q,Y,{operation:"rotate",rowId:Z},async(B)=>{if(z.attribution!==void 0)g3("rotate",Z,B.row(Z),z.attribution),await B.completeTorn();let V=v3("rotate",Z,B.row(Z),X);if(p(V)!==p(H))throw k$("rotate",Z);if(j0("rotate",V),J.identity!==void 0&&V.identity!==void 0&&J.identity!==V.identity)throw k3("rotate",Z);let U=J.identity!==void 0&&V.identity===void 0?J.identity:void 0,K=await y3($,B,Z,X,{identity:U,...W!==void 0?{providerState:E$(G.providerState,"rotate",Z,V.providerState,W)}:{}}),j=!1;if(!V.hasEntry)B.setEntry(Z,{credentialEpoch:1,needsFirstReading:V.type==="oauth"}),j=!0;if(J.identity!==void 0&&V.identity!==J.identity)A1(B,Z,J.identity),j=!0;if(j)await B.commitConfig();return{id:Z,credential:K}},{completeTorn:z.attribution===void 0})})}async function S9($,Z,X,J,z){Q0(Z);let{ctx:G}=$,Q=G.providerState,Y=z.attribution,W=z.providerState;return Y0(G,Z,X,z.onFailure,async(H,B)=>{if(J$(Z,X,Y),W!==void 0){if(typeof W!=="function")throw O(Z,X,"invalid-input","the provider-state mutator must be a function");if(Y===void 0)throw O(Z,X,"invalid-input","a provider-state change needs the attribution of the credential it is for");if(!Q)throw O(Z,X,"invalid-input","the store was opened without a provider-state codec")}let{row:V}=await n0($,Z,X);await H.acquire(L0($,V));for(let U of z.extraLocks??[])await H.acquire(U);return i(G,H,B,{operation:Z,rowId:X},async(U)=>{await f3(U,X,z.protect),U.assertNotStaged(X);let K=U.row(X),j=J.enabled?v3("enable",X,K):K;if(!j||!U.rosterRow(X))throw I0(Z,X);if(p(j)!==p(V))throw k$(Z,X);if(Y!==void 0)g3(Z,X,j,Y);if(J.enabled&&j.disabledReason?.startsWith(i1))throw O("enable",X,"identity-contradicted",`row ${X} needs an identity-validated credential replacement before it can be enabled`);let M=!J.enabled||!j.enabled||j.disabledReason!==void 0;if(J.enabled&&M&&j.type==="oauth"){let L=j.identity===void 0?void 0:U.rows().find((N)=>N.id!==X&&N.invalid===void 0&&N.type==="oauth"&&N.enabled&&N.identity===j.identity);if(L)throw O("enable",X,"duplicate-identity",`row ${L.id} is enabled with the same identity as row ${X}`)}if(W===void 0||Q===void 0){if(await U.completeTorn(),!M)return{id:X};if(J.enabled)T$(U,X);else G1(U,X,J.reason);return await U.commitConfig(),{id:X}}if(!j.credential)throw O(Z,X,"no-credential",`row ${X} holds no credential`);j0(Z,j);let D=await R8(U,Q,Z,j,W,!0);if(D.kind==="declined")return{id:X,declined:!0};await U.completeTorn();let q={id:X,providerStateOutcome:D.kind==="unchanged"?"unchanged":D.value===void 0?"cleared":"updated",...D.value!==void 0?{providerState:D.value}:{}};if(D.kind==="unchanged"){if(M){if(J.enabled)T$(U,X);else G1(U,X,J.reason);await U.commitConfig()}return q}if(!M)return U.setStateAccount(X,D.account),await U.commitState(),q;let F=J.enabled?{mark:_9(),enabled:!0}:{mark:_9(),enabled:!1,reason:J.reason},C=D.account[v];return U.setStateAccount(X,{...D.account,[v]:{...C,[I3]:F}}),await U.commitState(),b$(U,X,F),await U.commitConfig(),q},{completeTorn:!1})})}function I9($,Z,X,J={}){return S9($,"disable",Z,{enabled:!1,reason:X},J)}function x9($,Z,X={}){return S9($,"enable",Z,{enabled:!0},X)}async function b9($,Z,X={}){Q0("remove");let{ctx:J}=$;return Y0(J,"remove",Z,X.onFailure,async(z,G)=>{if(typeof Z!=="string"||Z.length===0)throw O("remove",Z,"invalid-input","id must be non-empty");let Q=X.attribution;if(J$("remove",Z,Q),X.staged!==void 0&&(!_(X.staged)||typeof X.staged.reservation!=="string"||!X.staged.reservation))throw O("remove",Z,"invalid-input","a staged removal needs a reservation");let Y=await V0(J);if(Y.status!=="ready")throw S0(Y,"remove",Z);let W=Y.rows.find((B)=>B.id===Z);if(!W&&!X$(Y.state,Z))throw I0("remove",Z);let H=p(W??{id:Z});await z.acquire(L0($,W??{id:Z}));for(let B of X.extraLocks??[])await z.acquire(B);return i(J,z,G,{operation:"remove",rowId:Z},async(B)=>{let V=B.reservation(Z);if(V!==void 0){if(!_(V)||!X.staged||V.reservation!==X.staged.reservation)throw O("remove",Z,"row-staged",`row ${Z} is reserved for roster publication`)}else if(X.staged)throw O("remove",Z,"attribution",`row ${Z} is no longer reserved`);let U=B.row(Z),K=X$(B.state,Z);if(!U&&!K)throw I0("remove",Z);if(p(U??{id:Z})!==H)throw k$("remove",Z);if(Q!==void 0)if(U)h3(Z,U,Q);else cJ($,B,Z,Q);let j=X.protect;if(j){let M={row:U,config:B.snapshot.config,state:B.snapshot.state},D=await g0("remove",()=>j(Z,M));if(D!==void 0)throw O("remove",Z,"row-protected",D)}if(U){if(Q===void 0)await B.completeTorn();B.dropRosterRows(Z),await B.commitConfig()}if(K)B.dropStateAccount(Z),await B.commitState();return{id:Z,outcome:U?"removed":"completed"}},{completeTorn:!1})})}function h3($,Z,X,J="remove"){if(g3(J,$,Z,X),Z.torn)throw O(J,$,"attribution",`row ${$} is between the writes of another operation; retry once it completes`,!0);if(Z.stamp!=="bound")throw O(J,$,"unbound-credential",`row ${$}'s credential is not bound to its stamp, so the removal cannot be attributed to it`)}function cJ($,Z,X,J){let z=()=>O("remove",X,"unbound-credential",`orphan ${X} has no credential stamp this store can bind, so the removal cannot be attributed to it`),G=Z.stateAccount(X),Q=N0(G?.[v]);if(!G||!Q?.binding||Q.dispatch===void 0||Q.replace)throw z();let Y;if(typeof G.apiKey==="string"){if(Q.binding.baseURL===void 0||Q.binding.authHeader===void 0)throw z();Y={type:"api",apiKey:G.apiKey,baseURL:Q.binding.baseURL,authHeader:Q.binding.authHeader}}else if(typeof G.refresh==="string")Y={type:"oauth",refresh:G.refresh};else throw z();let[W]=H1({accounts:[$$({id:X,credential:Y,identity:Q.binding.identity,addedAt:0})],[w]:{rows:{[X]:{credentialEpoch:Q.credentialEpoch}}}},Z.state,$.ctx.codec,$.ctx.providerState);if(!W?.credential||W.invalid||W.stamp!=="bound")throw z();if(Q.credentialEpoch!==J.credentialEpoch||Q.binding.identity!==J.identity)throw O("remove",X,"attribution",`orphan ${X} was written for a credential or account other than the one this removal was decided for`,!0)}function X$($,Z){let X=$.accounts;return _(X)&&Object.hasOwn(X,Z)}function S8($){return _($)&&typeof $.id==="string"?$.id:void 0}function sJ($,Z){if(!Array.isArray(Z))return"ids must be an array of roster ids";let X=new Set;for(let G of $){let Q=S8(G);if(Q!==void 0)X.add(Q)}let J=new Set;for(let G of Z){if(typeof G!=="string")return"ids must be an array of roster ids";if(J.has(G))return`id ${G} appears more than once`;if(!X.has(G))return`id ${G} is not in the roster`;J.add(G)}let z=[...X].filter((G)=>!J.has(G));if(z.length>0)return`the order leaves out roster id(s) ${z.join(", ")}`;return}function iJ($,Z){let X=new Map;for(let G of $){let Q=S8(G);if(Q===void 0)continue;let Y=X.get(Q);if(Y)Y.push(G);else X.set(Q,[G])}let J=Z.flatMap((G)=>X.get(G)??[]),z=0;return $.map((G)=>S8(G)===void 0?G:J[z++])}async function E9($,Z,X={}){Q0("reorder");let{ctx:J}=$,z=X.onFailure;return Y0(J,"reorder",void 0,z&&((G,Q)=>z(Q)),async(G,Q)=>{for(let Y of X.extraLocks??[])await G.acquire(Y);return i(J,G,Q,{operation:"reorder",rowId:void 0},async(Y)=>{let W=Y.roster(),H=sJ(W,Z);if(H)throw new E({operation:"reorder",phase:"before-first-write",retryable:!1,kind:"invalid-order",message:H});let B=[...Z],V=iJ(W,B);if(V.every((U,K)=>U===W[K]))return{ids:B,outcome:"unchanged"};return Y.config.accounts=V,await Y.commitConfig(),{ids:B,outcome:"reordered"}},{completeTorn:!1})})}async function k9($,Z,X,J,z={}){return Q0("recordIdentity"),Y0($.ctx,"recordIdentity",Z,z.onFailure,async(G,Q)=>{if(typeof X!=="string"||X.length===0)throw O("recordIdentity",Z,"invalid-input","identity must be non-empty");let Y=_(J)?J.credentialEpoch:void 0;if(!$0(Y))throw O("recordIdentity",Z,"invalid-input","the credential epoch the identity lookup was issued for is required");let{row:W}=await n0($,"recordIdentity",Z);await G.acquire(L0($,W)),await G.acquire(z.providerLock??$.providerLock);for(let H of z.extraLocks??[])await G.acquire(H);return i($.ctx,G,Q,{operation:"recordIdentity",rowId:Z},async(H)=>{let B=v3("recordIdentity",Z,H.row(Z));if(p(B)!==p(W))throw k$("recordIdentity",Z);if(j0("recordIdentity",B),(B.credentialEpoch??1)!==Y)throw O("recordIdentity",Z,"attribution",`the identity for ${Z} was looked up for a credential the row no longer holds`,!0);if(B.identity!==void 0&&B.identity!==X)throw k3("recordIdentity",Z);if(B.identity===void 0)await uJ(H,B,X);let V=A1(H,Z,X);return await H.commitConfig(),{id:Z,disabled:V}})})}function y9($){let Z=$[w];return _(Z)&&_(Z.publications)?Z.publications:{}}function v9($,Z){let X=y9($);if(!Object.hasOwn(X,Z))return;let J=X[Z];if(!_(J)||J.operationId!==Z||typeof J.planDigest!=="string"||!/^[a-f0-9]{64}$/.test(J.planDigest)||!["committed","cleaned"].includes(String(J.phase))||!Array.isArray(J.removed)||!Array.isArray(J.finalized)||J.removed.some((z)=>!_(z)||typeof z.id!=="string"||!$0(z.credentialEpoch))||J.finalized.some((z)=>!_(z)||typeof z.id!=="string"||!$0(z.credentialEpoch)||typeof z.reservation!=="string"||!z.reservation||typeof z.enabled!=="boolean"))throw O("publishRoster",Z,"invalid-input","the stored publication receipt is malformed");return structuredClone(J)}async function g9($,Z){let X=await V0($.ctx);if(X.status!=="ready")throw S0(X,"publishRoster",Z);return v9(X.config,Z)}function aJ($,Z){let X=()=>{throw O("publishRoster",Z?.operationId??"","invalid-input","the publication plan is invalid")};if(!_(Z)||typeof Z.operationId!=="string"||!Z.operationId||!Array.isArray(Z.remove)||!Array.isArray(Z.finalize)||!Array.isArray(Z.order))X();let J=new Set;for(let z of[...Z.remove,...Z.finalize]){if(!_(z)||typeof z.id!=="string"||o1(z.id)||J.has(z.id)||!z.attribution)X();if(J.add(z.id),J$("publishRoster",z.id,z.attribution),z.attribution.identity!==void 0&&(typeof z.attribution.identity!=="string"||!z.attribution.identity))X()}for(let z of Z.remove)if($.ctx.requireRemovedFingerprint&&!z.fingerprint||z.fingerprint!==void 0&&typeof z.fingerprint!=="string")X();for(let z of Z.finalize)if(typeof z.reservation!=="string"||!z.reservation||typeof z.enabled!=="boolean"||(z.enabled?z.disabledReason!==void 0:typeof z.disabledReason!=="string"))X();if(Z.order.some((z)=>typeof z!=="string"||o1(z))||new Set(Z.order).size!==Z.order.length)X()}function h9($,Z){$.entries();let X=$.config[w],J={...y9($.config)};Object.defineProperty(J,Z.operationId,{value:Z,enumerable:!0,writable:!0,configurable:!0}),X.publications=J,delete X.publicationOrder}function nJ($,Z,X){let J=new Set;for(let Q of e1($.config)){if(!_(Q)||typeof Q.id!=="string")continue;if(J.has(Q.id))throw O("publishRoster",Z.operationId,"invalid-input","publication needs a roster of unique named rows");J.add(Q.id)}let z=new Set(Z.remove.map((Q)=>Q.id)),G=X.filter((Q)=>Q.invalid!=="roster"&&!z.has(Q.id));if(G.length!==Z.order.length||Z.order.some((Q)=>!G.some((Y)=>Y.id===Q))||G.some((Q)=>!Z.order.includes(Q.id)))throw O("publishRoster",Z.operationId,"invalid-input","order must name exactly the surviving roster");return G}async function f9($,Z){await $.assertAll();for(let J of Z.removed)if(N0($.stateAccount(J.id)?.[v])?.credentialEpoch===J.credentialEpoch&&!$.rosterRow(J.id))$.dropStateAccount(J.id);for(let J of Z.finalized){let z=$.stateAccount(J.id),G=N0(z?.[v]);if(z&&G?.credentialEpoch===J.credentialEpoch&&G.staged?.reservation===J.reservation){let Q={...z[v]};delete Q.staged,$.setStateAccount(J.id,{...z,[v]:Q})}}await $.commitState(void 0,{durable:!0});let X={...Z,phase:"cleaned"};return h9($,X),await $.commitConfig({durable:!0}),X}async function w9($,Z,X={}){return Q0("publishRoster"),Y0($.ctx,"publishRoster",Z?.operationId??"",X.onFailure,async(J,z)=>{if(!_(Z)||typeof Z.operationId!=="string"||!Z.operationId)throw O("publishRoster",Z?.operationId??"","invalid-input","the publication needs an operation id");Z=structuredClone(Z);let G=I1(Z),Q=[...Array.isArray(Z.remove)?Z.remove:[],...Array.isArray(Z.finalize)?Z.finalize:[]].filter((Y)=>_(Y)&&typeof Y.id==="string");for(let Y=0;;Y++){let W=await V0($.ctx);if(W.status!=="ready")throw S0(W,"publishRoster",Z.operationId);let H=new Map(Q.map(({id:V})=>[V,p(W.rows.find((U)=>U.id===V)??{id:V})]));for(let V of[...new Set(H.values())].sort())await J.acquire(L0($,{id:V}));await J.acquire(X.providerLock??$.providerLock);for(let V of X.extraLocks??[])await J.acquire(V);let B=await i($.ctx,J,z,{operation:"publishRoster",rowId:Z.operationId},async(V)=>{let U=V.rows();if(Q.some(({id:N})=>p(U.find((P)=>P.id===N)??{id:N})!==H.get(N)))return;let K=v9(V.config,Z.operationId);if(K){if(K.planDigest!==G)throw O("publishRoster",Z.operationId,"publication-mismatch","the operation id belongs to a different publication plan");if(K.phase==="cleaned")return{outcome:"already-cleaned",receipt:K};return V.markPublicationDecision(),await V.syncConfig(),{outcome:"cleaned",receipt:await f9(V,K)}}aJ($,Z);let j=nJ(V,Z,U),M=[];for(let N of Z.remove){V.assertNotStaged(N.id);let P=U.find((S)=>S.id===N.id);if(!P)throw O("publishRoster",N.id,"attribution","the removed row no longer exists");if(h3(N.id,P,N.attribution,"publishRoster"),!P.credential||N.fingerprint!==void 0&&W1(P.credential)!==N.fingerprint)throw O("publishRoster",N.id,"attribution","the removed secret no longer matches");M.push(P)}let D=[];for(let N of Z.finalize){let P=U.find((g)=>g.id===N.id),S=N0(V.stateAccount(N.id)?.[v]);if(!P||P.staged?.reservation!==N.reservation||S?.staged?.reservation!==N.reservation||P.enabled)throw O("publishRoster",N.id,"row-staged","the finalized row is not disabled under this reservation");let f=V.stateAccount(N.id),n=V.rosterRow(N.id),C0=f?.[H0],h=C0===void 0?void 0:I1(C0);if(!S?.staged||S.staged.label!==n?.label||S.staged.disabledReason!==P.disabledReason||S.staged.providerState!==h)throw O("publishRoster",N.id,"row-staged","the staged label, disabled reason or full provider state no longer matches its stamp");h3(N.id,P,N.attribution,"publishRoster"),D.push(P)}let q=j.find((N)=>N.torn);if(q)throw O("publishRoster",Z.operationId,"attribution",`Row ${q.id} has an interrupted write; complete it with a normal store operation before publishing.`,!1);let F=new Set;for(let N of j){if(!(Z.finalize.find((S)=>S.id===N.id)?.enabled??N.enabled)||N.type!=="oauth"||N.identity===void 0)continue;if(F.has(N.identity))throw O("publishRoster",N.id,"invalid-input","the final enabled roster repeats a known identity");F.add(N.identity)}for(let N of j)if(N.identity!==void 0&&N.fingerprint!==void 0&&j.some((P)=>P.id!==N.id&&P.identity!==void 0&&P.identity!==N.identity&&P.fingerprint===N.fingerprint))throw O("publishRoster",N.id,"attribution","the resulting pool gives the same secret different known identities");for(let N of D)if(N.identity!==void 0&&M.some((P)=>P.identity!==void 0&&P.identity!==N.identity&&P.fingerprint===N.fingerprint))throw O("publishRoster",N.id,"attribution","the staged secret belonged to a different known identity");await f3(V,Z.operationId,X.protect);let C={operationId:Z.operationId,planDigest:G,phase:"committed",removed:M.map((N)=>({id:N.id,credentialEpoch:N.credentialEpoch??1})),finalized:Z.finalize.map((N,P)=>({id:N.id,credentialEpoch:D[P]?.credentialEpoch??1,reservation:N.reservation,enabled:N.enabled}))};for(let N of Z.remove)V.dropRosterRows(N.id);for(let N of Z.finalize){let P=V.rosterRow(N.id);P.enabled=N.enabled;let S={...V.entry(N.id)};if(delete S.staged,N.enabled)delete S.disabledReason;else S.disabledReason=N.disabledReason;V.setEntry(N.id,S)}let L=V.roster().filter((N)=>!_(N)||typeof N.id!=="string"||U.find((P)=>P.id===N.id)?.invalid==="roster");return V.config.accounts=[...Z.order.map((N)=>V.rosterRow(N)),...L],h9(V,C),await V.syncState(),await V.commitConfig({durable:!0,publicationDecision:!0}),{outcome:"published",receipt:await f9(V,C)}},{completeTorn:!1});if(B)return B;if(await J.releaseAll(),Y>=1)throw O("publishRoster",Z.operationId,"row-key-changed","a named row changed lock key twice during publication",!0)}})}class x8{rt;hook;onFailure;firedAtLoad;logger;inflight=new Set;constructor($,Z,X,J,z){this.rt=$,this.hook=Z,this.onFailure=X,this.firedAtLoad=J,this.logger=z}fire($,Z){if(!this.hook)return;if(Z==="load"){if(this.firedAtLoad.has($))return;this.firedAtLoad.add($)}let X=this.run($,Z);this.inflight.add(X),X.finally(()=>this.inflight.delete(X))}async settled(){while(this.inflight.size>0)await Promise.allSettled([...this.inflight])}async run($,Z){let X=this.rt(),{ctx:J}=X,z=new Q1(J.lockDefaults,J.lockEnv),G={writes:0};try{let Q=await i(J,z,G,{operation:"pull",rowId:$},async(W)=>{if(W.reservation($)!==void 0)return;await W.completeTorn();let H=W.row($);if(H?.unbound&&H.enabled&&H.type==="oauth"&&H.credential&&!H.invalid)j0("pull",H);if(!H?.candidate||H.type!=="oauth")return;if(!H.hasEntry)W.setEntry($,{credentialEpoch:1,needsFirstReading:!0}),await W.commitConfig();let B=W.row($);if(!B?.credential||B.credentialEpoch===void 0)return;return{id:$,credential:B.credential,credentialEpoch:B.credentialEpoch,...B.identity!==void 0?{identity:B.identity}:{},reason:Z}},{completeTorn:!1});if(await z.releaseAll(),!Q){this.firedAtLoad.delete($);return}await J.hold?.("pull-before-request",$);let Y;try{Y=await this.hook?.(Q)}catch(W){throw new E({operation:"pull",rowId:$,phase:"pull",retryable:!0,kind:"pull",message:"the quota pull rejected",cause:W})}await x3(X,$,{credentialEpoch:Q.credentialEpoch,...Q.identity!==void 0?{identity:Q.identity}:{}},Y)}catch(Q){this.firedAtLoad.delete($);let Y=Z$(Q,"pull",$,G);if(this.onFailure)try{await this.onFailure($,Y)}catch(W){this.logger?.warn("pull failure hook threw",{rowId:$,error:W instanceof Error?W.message:String(W)})}else this.logger?.warn("quota pull failed",{rowId:$,kind:Y.kind})}finally{await z.releaseAll()}}}import{randomUUID as rJ}from"node:crypto";function b8($,Z){if(S1("refresh",$,Z?.staged),!Z)throw O("refresh",$,"unknown-row",`no row ${$} in the pool`);if(Z.invalid)throw O("refresh",$,"invalid-row",`row ${$} is invalid`);if(Z.type!=="oauth"||Z.credential?.type!=="oauth")throw O("refresh",$,"no-credential",`row ${$} holds no OAuth credential`);if(!Z.enabled)throw O("refresh",$,"row-disabled",`row ${$} is disabled`);return Z}function m9($){return O("refresh",$,"refresh-stamp-ahead",`row ${$}'s stored refresh stamp is ahead of the clock; a rotation now could not be stamped newer within the trust bound`,!0)}async function p9($,Z,X,J={}){Q0("refresh");let{ctx:z}=$;return Y0(z,"refresh",Z,J.onFailure,async(G,Q)=>{let{row:Y}=await n0($,"refresh",Z);b8(Z,Y);let W=await J.refuse?.(Y);if(W!==void 0)return{status:"refused",rowId:Z,reason:W};let H=p(Y),B;for(let j=0;;j++){await G.acquire(L0($,{id:Z,identity:H===Z?void 0:H})),await G.acquire(J.providerLock??$.providerLock);for(let q of J.extraLocks??[])await G.acquire(q);let D=await i(z,G,{writes:0},{operation:"refresh",rowId:Z},async(q)=>{let F=b8(Z,q.row(Z));if(j0("refresh",F),!F.hasEntry)q.setEntry(Z,{credentialEpoch:1,needsFirstReading:!0}),await q.commitConfig(),F=b8(Z,q.row(Z));if(p(F)!==H)return{keyNow:p(F)};let C=await J.refuse?.(F);if(C!==void 0)return{refused:C};return{row:F,credential:F.credential,credentialEpoch:F.credentialEpoch,identity:F.identity}});if("refused"in D)return{status:"refused",rowId:Z,reason:D.refused};if("keyNow"in D){if(await G.releaseAll(),j>=1)throw O("refresh",Z,"row-key-changed",`row ${Z}'s wire identity changed twice while its lock was held`,!0);H=D.keyNow;continue}B=D;break}if(O8(B.credential.lastRefreshedAt,z.now()))throw m9(Z);await z.hold?.("refresh-before-provider",Z),await G.assertAll();let V;try{V=await X(B.credential,B.row)}catch(j){throw new E({operation:"refresh",rowId:Z,phase:"before-first-write",retryable:!0,kind:"provider",message:"the provider refresh failed",cause:j})}if(typeof V?.refresh!=="string"||!V.refresh.trim())throw O("refresh",Z,"provider","the provider returned no refresh token",!0);let U=V.providerState===void 0?void 0:r0(z.providerState,"refresh",Z,V.providerState,"the provider state the provider returned"),K=await i(z,G,Q,{operation:"refresh",rowId:Z},async(j)=>{let M=j.row(Z),D=j.entry(Z);if(!M||M.invalid||!D||D.credentialEpoch!==B.credentialEpoch||M.identity!==B.identity)throw new E({operation:"refresh",rowId:Z,phase:"before-first-write",retryable:!0,kind:"attribution",message:`row ${Z} changed credential while its refresh was in flight; the rotation is discarded`});j0("refresh",M);let q=await J.refuse?.(M);if(q!==void 0)return{refused:q};let F=z.now(),C=M.credential?.type==="oauth"?M.credential.lastRefreshedAt:void 0;if(O8(C,F))throw m9(Z);let L={type:"oauth",access:V.access,refresh:V.refresh,expires:V.expires},N=M.identity!==void 0&&V.identity!==void 0&&M.identity!==V.identity?{expectedIdentity:M.identity,returnedIdentity:V.identity}:void 0,P=N?{mark:rJ(),enabled:!1,reason:`${i1}${JSON.stringify(N)}`}:void 0,S=M.identity===void 0&&V.identity?V.identity:void 0,f=await y3($,j,Z,L,{stamp:x$(C,F),transition:P,identity:S,...U!==void 0?{providerState:E$(z.providerState,"refresh",Z,M.providerState,U)}:{}});if(P!==void 0)b$(j,Z,P),await j.commitConfig();let n=M.identity;if(S!==void 0)A1(j,Z,S),n=S,await j.commitConfig();return{stored:f,identity:n,contradiction:N,refused:void 0}});if(K.refused!==void 0)return{status:"refused",rowId:Z,reason:K.refused};if(K.contradiction!==void 0)return{status:"identity-contradicted",rowId:Z,...K.contradiction,credential:K.stored};if(J.onPersisted)try{let j=J.onPersisted;await g0("refresh",()=>j(Z,K.stored))}catch(j){throw new E({operation:"refresh",rowId:Z,phase:"after-first-write",retryable:!1,kind:"after-persist-hook",committed:K.stored,message:"the after-persist hook threw; the rotation stays committed",cause:j})}return{status:"rotated",rowId:Z,credential:K.stored,...K.identity!==void 0?{identity:K.identity}:{}}})}import{isDeepStrictEqual as oJ}from"node:util";var m3=Object.freeze(["version","accounts",w]);function E8($){let Z={};for(let[X,J]of Object.entries($))if(!m3.includes(X))w3(Z,X,J);return Z}function w3($,Z,X){Object.defineProperty($,Z,{value:X,enumerable:!0,writable:!0,configurable:!0})}function tJ($,Z){let X={};for(let[J,z]of Object.entries($))if(m3.includes(J))w3(X,J,z);else if(Object.hasOwn(Z,J))w3(X,J,Z[J]);for(let[J,z]of Object.entries(Z))if(!Object.hasOwn($,J))w3(X,J,z);return X}function u9($){return new E({operation:"updateSettings",phase:"before-first-write",retryable:!1,kind:"invalid-input",message:$})}async function l9($){let Z=await V0($.ctx);if(Z.status==="error")return Z;return{status:Z.status,settings:E8(Z.config)}}async function d9($,Z,X={}){Q0("updateSettings");let{ctx:J}=$,z=X.onFailure;return Y0(J,"updateSettings",void 0,z&&((G,Q)=>z(Q)),async(G,Q)=>{for(let W of X.extraLocks??[])await G.acquire(W);let Y=G.held.length;try{for(let D of J.storeLocks)await G.acquire(D);let W=await V0(J);if(W.status!=="ready")throw S0(W,"updateSettings",void 0);let H=E8(W.config),B=structuredClone(H),V=await g0("updateSettings",()=>Z(B)),U=V===void 0?B:V;if(!_(U))throw u9("the settings mutator must produce an object");let K=m3.filter((D)=>Object.hasOwn(U,D));if(K.length>0)throw u9(`settings cannot set the pool-owned key(s) ${K.join(", ")}`);if(oJ(U,H))return{settings:H,outcome:"unchanged"};let j=tJ(W.config,U),M={operation:"updateSettings",rowId:void 0};return await O0(J.configPath,j,{beforeRename:async()=>{await J.onStep?.("before-config-write",M),await G.assertAll()}}),Q.writes++,await J.onStep?.("after-config-write",M),{settings:E8(j),outcome:"updated"}}finally{await G.releaseTo(Y)}})}var c9=new Map;function eJ($){let Z=c9.get($);if(!Z)Z={removedIds:new Set,firedAtLoad:new Set},c9.set($,Z);return Z}function s9($){if($.status==="ready")return{status:"ready",schemaVersion:Y1,rows:$.rows};if($.status==="pending-migration")return{status:"pending-migration",roster:Array.isArray($.config.accounts)?$.config.accounts:[]};return $}function k8($){let Z=eJ($.configPath),X={...N8,...$.lockOptions},J={provider:$.provider,configPath:$.configPath,statePath:$.statePath,codec:$.quota,...$.providerState?{providerState:$.providerState}:{},now:$.now??Date.now,storeLocks:$.storeLocks??[{name:"save",path:$.configPath},{name:"save",path:$.statePath}],lockDefaults:X,lockEnv:{now:$.now??Date.now,...$.onLockEvent?{onLockEvent:$.onLockEvent}:{},...$.onLockStep?{onLockStep:$.onLockStep}:{}},removedIds:Z.removedIds,requireCredentialStamps:$.requireCredentialStamps===!0,requireRemovedFingerprint:$.requireRemovedFingerprint===!0,...$.logger?{logger:$.logger}:{},...$.onStep?{onStep:$.onStep}:{},...$.hold?{hold:$.hold}:{}},z=new x8(()=>G,$.pull,$.onPullFailure,Z.firedAtLoad,$.logger),G={ctx:J,providerLock:$.providerLock??{name:`provider-${encodeURIComponent($.provider)}`,path:$.statePath},rowLockOptions:$.rowLockOptions??{},firePull:(Q,Y)=>z.fire(Q,Y)};return{async load(){let Q=await V0(J);if(Q.status==="ready"){for(let Y of Q.rows)if((Y.candidate||Y.torn&&Y.enabled)&&Y.type==="oauth"&&Y.needsFirstReading)z.fire(Y.id,"load")}return s9(Q)},async read(){return s9(await V0(J))},async initialize(Q={}){return{status:await M9(J,Q.dropKeys??[])}},add:(Q,Y)=>T9(G,Q,Y),publishRoster:(Q,Y)=>w9(G,Q,Y),publication:(Q)=>g9(G,Q),replace:(Q,Y,W,H)=>A9(G,Q,Y,W,H),rotate:(Q,Y,W,H)=>R9(G,Q,Y,W,H),updateProviderState:(Q,Y,W,H)=>P9(G,Q,Y,W,H),disable:(Q,Y,W)=>I9(G,Q,Y,W),enable:(Q,Y)=>x9(G,Q,Y),remove:(Q,Y)=>b9(G,Q,Y),reorder:(Q,Y)=>E9(G,Q,Y),readSettings:()=>l9(G),updateSettings:(Q,Y)=>d9(G,Q,Y),recordIdentity:(Q,Y,W,H)=>k9(G,Q,Y,W,H),refresh:(Q,Y,W)=>p9(G,Q,Y,W),recordQuota:(Q,Y,W)=>x3(G,Q,Y,W),requestReading:(Q)=>z.fire(Q,"admission"),pullsSettled:()=>z.settled()}}var $z=[/\b[\w-]*(?:secret|token|password|passwd|api[_-]?key|authorization|verifier)["']?\s*[:=]\s*["']?(?:(?:Bearer|Basic)\s+)?[^\s"'&,;}]+/gi,/\b[0-9a-fA-F]{32,}\b/g];function v8($={}){let{redactStrings:Z}=v0({...$,extraValuePatterns:[...$z,...$.extraValuePatterns??[]]});return(X)=>Z(X)}class U0 extends Error{code;constructor($,Z,X){super(Z,X);this.name="CommandError",this.code=$}}var i9=/^[a-z][a-z0-9-]{0,63}$/,f8={code:"action-failed",text:"That action failed."},Zz=new Set(["unknown-row","invalid-row","invalid-input","id-exists","id-removed","type-mismatch","no-credential","row-disabled","row-protected","duplicate-identity","row-key-changed","invalid-order","pending-migration","provider","pull","attribution"]);function f$($){if($ instanceof U0)return{code:i9.test($.code)?$.code:f8.code,text:$.message};if($ instanceof E)return{code:`pool-${$.kind}`,text:Zz.has($.kind)?$.message:`The account pool could not do that (${$.kind}).`};return f8}var a9="This cannot be undone. Continue?",Xz=new Set(["access","refresh","apikey","password","authheader","credential","credentials"]);function Jz($){let Z=$.toLowerCase().replace(/[-_]/g,"");return Xz.has(Z)||Z.endsWith("token")||Z.endsWith("key")||Z.endsWith("secret")}function zz($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function y8($,Z,X){if(typeof $==="string"){let z=X.redact($);if(z!==$)X.redacted.push(Z);return z}if(Array.isArray($))return $.map((z,G)=>y8(z,`${Z}[${G}]`,X));if(!zz($))return $;let J={};for(let[z,G]of Object.entries($)){if(Jz(z)){X.dropped.push(`${Z}.${z}`);continue}Object.defineProperty(J,z,{value:y8(G,`${Z}.${z}`,X),enumerable:!0,writable:!0,configurable:!0})}return J}function n9($,Z,X){let J={redact:X.redact,dropped:[],redacted:[]},z=y8($,"payload",J);if(J.dropped.length>0)X.logger.warn("credential-shaped field dropped from a command payload",{command:Z,fields:J.dropped});if(J.redacted.length>0)X.logger.warn("secret-shaped text masked in a command payload",{command:Z,fields:J.redacted});return z}function Gz($){return{value:String($.value),label:String($.label)}}function Qz($){switch($.kind){case"choice":return{kind:"choice",id:$.id,label:$.label,choices:($.choices??[]).map(Gz),...$.value!==void 0?{value:$.value}:{}};case"toggle":return{kind:"toggle",id:$.id,label:$.label,value:$.value===!0};case"number":return{kind:"number",id:$.id,label:$.label,...$.value!==void 0?{value:$.value}:{},...$.min!==void 0?{min:$.min}:{},...$.max!==void 0?{max:$.max}:{},...$.required?{required:!0}:{}};case"text":return{kind:"text",id:$.id,label:$.label,...$.value!==void 0&&!$.masked?{value:$.value}:{},...$.placeholder!==void 0?{placeholder:$.placeholder}:{},...$.masked?{masked:!0}:{},...$.required?{required:!0}:{}}}}function g8($){if($.irreversible===!0)return{message:$.confirm||a9,irreversible:!0};if($.confirm)return{message:$.confirm,irreversible:!1};return}function r9($){let Z=g8($);return{id:$.id,label:$.label,...$.description!==void 0?{description:$.description}:{},...$.group!==void 0?{group:String($.group)}:{},knobs:($.knobs??[]).map(Qz),...Z?{confirm:Z}:{}}}function Yz($){return{id:$.id,...$.label!==void 0?{label:$.label}:{},enabled:$.enabled,type:$.type,...$.identity!==void 0?{identity:$.identity}:{}}}function Wz($){return{id:$.id,label:$.label,...$.detail!==void 0?{detail:$.detail}:{},...$.group!==void 0?{group:String($.group)}:{},...$.status!==void 0?{status:String($.status)}:{},...$.account?{account:Yz($.account)}:{},...$.facts!==void 0?{facts:$.facts}:{},actions:($.actions??[]).map(r9)}}function Bz($){let{content:Z}=$;return{id:$.id,slot:$.slot,title:$.title,lines:(Z.lines??[]).map(String),items:(Z.items??[]).map(Wz),actions:(Z.actions??[]).map(r9),...Z.facts!==void 0?{facts:Z.facts}:{}}}function o9($,Z,X){return{command:$,title:Z,sections:X.map(Bz)}}function t9($,Z,X,J){return n9({command:$,menu:o9($,Z,X)},$,J)}function e9($,Z,X,J,z){return n9({command:$,ok:J.ok,text:String(J.text),...!J.ok&&J.code!==void 0?{code:i9.test(J.code)?J.code:"refused"}:{},...J.needsConfirmation?{needsConfirmation:!0}:{},menu:o9($,Z,X)},$,z)}var XZ="disabled from the command menu";function Hz($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function o0($){return Hz($)?{...$}:{}}function Vz($){if($.status!=="ready")return[];let Z=new Set;return $.rows.filter((X)=>{if(Z.has(X.id))return!1;return Z.add(X.id),!0})}function jz($,Z){return $.label??Z??$.id}function p3($,Z){return t($.quota)?d($.quota,Z):void 0}function JZ($,Z){return`${$} ${Z}${$===1?"":"s"}`}var y$="Actions";function Uz($){if($.status==="pending-migration")return"The account pool has not been migrated yet.";if($.status==="error")return`The ${$.file} file cannot be read: ${$.reason}`;return}function $Z($,Z){switch(Z.outcome){case"added":return`Added ${$}.`;case"added-disabled":return`Added ${$}, disabled: another enabled account has the same identity.`;case"completed":return`Finished adding ${$}.`;case"rotated":return`${$} was already in the pool; its credential was updated.`;case"exists":return`${$} was already in the pool; its credential is unchanged.`}}function ZZ($){return f$($).text}async function Kz($){let Z=await $.read(),X=await $.readSettings();return{load:Z,rows:Vz(Z),settings:X.status==="error"?{}:X.settings}}function u3($,Z){let X=Z.accounts?.describeIdentity?Z.accounts.describeIdentity($):$.identity;return{account:{id:$.id,...$.label!==void 0?{label:$.label}:{},enabled:$.enabled,type:$.type,...X!==void 0?{identity:X}:{}},name:jz($,X)}}function qz($,Z){let{store:X,extraLocks:J}=$,z=J?{extraLocks:J}:{},G=Z.rows.map((V)=>V.id),Q=Uz(Z.load),Y=Z.rows.filter((V)=>V.enabled).length,W=Z.rows.map((V,U)=>{let{account:K,name:j}=u3(V,$),M=[V.type==="api"?"API key":"OAuth",...K.identity!==void 0?[K.identity]:[],...!V.invalid&&!V.enabled&&V.disabledReason?[`disabled: ${V.disabledReason}`]:[]].join(" · "),D=V.invalid?"invalid":V.enabled?"enabled":"disabled",q=[];if(!V.invalid&&V.enabled)q.push({id:"disable",label:"Disable",run:async()=>{return await X.disable(V.id,XZ,z),`Disabled ${j}.`}});if(!V.invalid&&!V.enabled)q.push({id:"enable",label:"Enable",run:async()=>{return await X.enable(V.id,z),`Enabled ${j}.`}});if(G.length>1)q.push({id:"move",label:"Move",knobs:[{kind:"choice",id:"position",label:"Position",choices:G.map((F,C)=>({value:String(C+1),label:String(C+1)})),value:String(U+1)}],run:async({values:F})=>{let C=Number(F.position),L=G.filter((P)=>P!==V.id);return L.splice(C-1,0,V.id),(await X.reorder(L,z)).outcome==="unchanged"?`${j} is already at position ${C}.`:`Moved ${j} to position ${C}.`}});return q.push({id:"remove",label:"Remove",irreversible:!0,confirm:`Remove ${j}? Its stored credential is deleted.`,run:async()=>{return await X.remove(V.id,{...z,...$.accounts?.protect?{protect:$.accounts.protect}:{}}),`Removed ${j}.`}}),{id:V.id,label:j,detail:M,group:"Accounts",status:D,account:K,actions:q}}),H=$.accounts?.login,B=[];if(H&&!Q)B.push({id:"add",label:H.label??"Add account",group:y$,knobs:H.knobs??[],run:async({values:V,invocation:U})=>{let K=await H.run(V,U);if(K.status==="cancelled")return{ok:!1,text:K.message??"Login cancelled."};if(K.status==="ready"){let j=await X.add(K.account,z);return $Z(K.account.label??j.id,j)}return K.completion.then(async(j)=>{if(!j){U.notify("Login cancelled.","warning");return}let M=await X.add(j,z);U.notify($Z(j.label??M.id,M))},(j)=>{U.notify(`Adding the account failed: ${ZZ(j)}`,"error")}).catch((j)=>{U.notify(`Adding the account failed: ${ZZ(j)}`,"error")}),K.message}});return{id:"accounts",slot:"accounts",title:"Accounts",content:{lines:Q?[Q]:[Z.rows.length===0?"No accounts yet":`${JZ(Z.rows.length,"account")}, ${Y} enabled`],items:Q?[]:W,actions:B}}}function Dz($,Z){let X=$.quota?.scope??"all",J=$.now(),z=X==="all"?"Accounts":`Accounts · ${X}`,G=async(B,V)=>{if($.quota?.check)await $.quota.check(B,V);else{for(let U of B)$.store.requestReading(U);await $.store.pullsSettled()}},Q=Z.rows.filter((B)=>B.candidate),Y=Q.map((B)=>{let{account:V,name:U}=u3(B,$),K=p3(B,X);return{id:B.id,label:U,group:z,status:A0(K,{now:J,form:"compact"}),detail:A0(K,{now:J,form:"full"}),account:V,actions:[{id:"check",label:"Check this account",run:async({invocation:j})=>{return await G([B.id],j),`Checked quota for ${U}.`}}]}}),W=Z.rows.filter((B)=>!B.candidate).map((B)=>{let{name:V}=u3(B,$),U=B.invalid?"invalid":!B.enabled?"disabled":B.credential===void 0?"no credential":"unavailable",K=A0(p3(B,X),{now:J,form:"compact"});return`${V} (${U}): ${K}`}),H=[];if(Q.length>0)H.push({id:"check",label:"Check now",description:"Checks every account that can be checked.",group:y$,run:async({invocation:B})=>{let V=Q.map((U)=>U.id);return await G(V,B),`Checked quota for ${JZ(V.length,"account")}.`}});return{id:"quota",slot:"quota",title:"Quota",content:{lines:Z.rows.length===0?["No accounts yet"]:W,items:Y,actions:H}}}function Nz($,Z){let{store:X,extraLocks:J}=$,z=J?{extraLocks:J}:{},G=[{value:"ordered",label:"Ordered (roster order)"},...$.routing?.orderedVariants??[],{value:"sticky-balanced",label:"Sticky balanced"}],Q=o0(Z.settings.routing).mode,Y=typeof Q==="string"&&G.some((j)=>j.value===Q)?Q:"ordered",W=o6(Y),H=Z.rows.map((j)=>j.id),B=s1(H,W.placement,$.routing?.formerMainId??L3),U=[`Mode: ${G.find((j)=>j.value===Y)?.label??Y}`];if(H.length>0)U.push(`Roster order: ${H.join(", ")}`);if(W.mode==="ordered"&&B.join()!==H.join())U.push(`Tried in order: ${B.join(", ")}`);let K=[{id:"mode",label:"Change mode",group:y$,knobs:[{kind:"choice",id:"mode",label:"Mode",choices:G,value:Y}],run:async({values:j})=>{let M=String(j.mode);return await X.updateSettings((D)=>{D.routing={...o0(D.routing),mode:M};return},z),`Routing mode set to ${G.find((D)=>D.value===M)?.label??M}.`}}];if(H.length>1)K.push({id:"order",label:"Set order",group:y$,knobs:[{kind:"text",id:"order",label:"Account ids, first to last",value:H.join(", "),required:!0}],run:async({values:j})=>{let M=String(j.order).split(/[\s,]+/).filter((q)=>q.length>0),D=await X.reorder(M,z);return D.outcome==="unchanged"?"The order is unchanged.":`Order set to ${D.ids.join(", ")}.`}});return{id:"routing",slot:"routing",title:"Routing",content:{lines:U,actions:K}}}function Mz($,Z){if($.limits?.labels)return[...$.limits.labels];let X=$.quota?.scope??"all",J=[];for(let z of Z.rows)for(let G of p3(z,X)?.limits??[])if(!J.includes(G.label))J.push(G.label);return J.length>0?J:["primary"]}function Lz($,Z){let X=$.quota?.scope??"all",J=new Map;for(let z of Z.rows)for(let G of p3(z,X)?.limits??[])if(G.windowMinutes!==void 0&&!J.has(G.label))J.set(G.label,N3(G));return(z)=>J.get(z)??z}function Fz($,Z){let{store:X,extraLocks:J}=$,z=J?{extraLocks:J}:{},G=o0(Z.settings.killswitch),Q=G.enabled===!0,Y=o0(G.accounts),W=Mz($,Z),H=Lz($,Z),B=Q?"on":"off",V=Z.rows.map((U)=>{let{account:K,name:j}=u3(U,$),M=o0(Y[U.id]),D=W.filter((q)=>typeof M[q]==="number");return{id:U.id,label:j,group:`Floors · killswitch ${B}`,status:D.length===0?"no floors":D.map((q)=>`${H(q)} ≥${M[q]}%`).join(" · "),account:K,actions:[{id:"floors",label:"Set floors",knobs:W.map((q)=>({kind:"number",id:q,label:`Minimum % left for ${H(q)}`,min:0,max:100,...typeof M[q]==="number"?{value:M[q]}:{}})),run:async({values:q})=>{return await X.updateSettings((F)=>{let C=o0(F.killswitch),L=o0(C.accounts),N=o0(L[U.id]);for(let P of W){let S=q[P];if(typeof S==="number")N[P]=S;else if(S===null)delete N[P]}if(Object.keys(N).length>0)L[U.id]=N;else delete L[U.id];if(Object.keys(L).length>0)C.accounts=L;else delete C.accounts;F.killswitch=C;return},z),`Floors updated for ${j}.`}}]}});return{id:"limits",slot:"limits",title:"Limits",content:{lines:[`Killswitch ${B}`],items:V,actions:[{id:"killswitch",label:Q?"Turn killswitch off":"Turn killswitch on",description:"With the killswitch on, an account whose quota falls below one of its floors is not used.",group:y$,knobs:[{kind:"toggle",id:"enabled",label:"Killswitch",value:!Q}],run:async({values:U})=>{let K=U.enabled===!0;return await X.updateSettings((j)=>{j.killswitch={...o0(j.killswitch),enabled:K};return},z),`Killswitch ${K?"on":"off"}.`}}]}}}async function zZ($){let Z=await Kz($.store);return[qz($,Z),Dz($,Z),Nz($,Z),Fz($,Z)]}var Pz=new Set(["accounts","quota","routing","limits","cache","diagnostics"]),h8=["accounts","quota","routing","limits"];function GZ($,Z){let{sessionId:X}=$,J=$.notify.bind($);return Object.freeze({...X!==void 0?{sessionId:X}:{},notify:(z,G)=>G===void 0?J(Z(String(z))):J(Z(String(z)),G)})}function Oz($,Z){switch($.kind){case"choice":{let X=Z??$.value;if(typeof X==="string"&&$.choices.some((J)=>J.value===X))return{value:X};return{problem:`Choose one of the options for ${$.label}.`}}case"toggle":{let X=Z??$.value;return typeof X==="boolean"?{value:X}:{problem:`${$.label} must be on or off.`}}case"number":{let X=Z===void 0?$.value??null:Z;if(X===null||X==="")return $.required?{problem:`${$.label} needs a number.`}:{value:null};let J=typeof X==="number"?X:Number(X);if(typeof X==="boolean"||!Number.isFinite(J))return{problem:`${$.label} needs a number.`};if($.min!==void 0&&J<$.min)return{problem:`${$.label} must be at least ${$.min}.`};if($.max!==void 0&&J>$.max)return{problem:`${$.label} must be at most ${$.max}.`};return{value:J}}case"text":{let X=Z===void 0?$.value??null:Z;if(X===null||X==="")return $.required?{problem:`${$.label} cannot be empty.`}:{value:null};return typeof X==="string"?{value:X}:{problem:`${$.label} must be text.`}}}}function _z($,Z){let X={};for(let J of $){let z=Z&&Object.hasOwn(Z,J.id)?Z[J.id]:void 0,G=Oz(J,z);if("problem"in G)return G;X[J.id]=G.value}return{values:X}}function Cz($,Z){let X=$.find((z)=>z.id===Z.sectionId);if(!X)return;return(Z.itemId===void 0?X.content.actions:X.content.items?.find((z)=>z.id===Z.itemId)?.actions)?.find((z)=>z.id===Z.actionId)}function x1($){let Z=$.logger??s("commands"),X=v8($.redaction),J={logger:Z,redact:X},z=$.now??Date.now,G=$.extras??[],Q=$.replace??{},Y=h8.filter((U)=>!Q[U]);for(let U of h8)if(Q[U]&&$[U]!==void 0)throw Error(`the ${U} section is replaced; its built-in options cannot also be given`);let W=$.store;if(Y.length>0&&!W)throw Error(`a store is required for the built-in ${Y.join(", ")} section${Y.length>1?"s":""}`);let H=new Set;for(let U of G){if(Pz.has(U.id)||H.has(U.id))throw Error(`extra section id ${U.id} is taken`);H.add(U.id)}async function B(U,K,j,M){try{return{id:U,slot:K,title:j.title,content:await j.build(M)}}catch(D){return Z.warn("command menu section failed to build",{command:$.command,section:U,error:X(D instanceof Error?D.message:String(D))}),{id:U,slot:K,title:j.title,content:{lines:["This section could not be loaded."]}}}}async function V(U){let K=W&&Y.length>0?await zZ({store:W,now:z,...$.extraLocks?{extraLocks:$.extraLocks}:{},...$.accounts?{accounts:$.accounts}:{},...$.quota?{quota:$.quota}:{},...$.routing?{routing:$.routing}:{},...$.limits?{limits:$.limits}:{}}):[],j=[];for(let M of h8){let D=Q[M];if(D)j.push(await B(M,M,D,U));else{let q=K.find((F)=>F.slot===M);if(q)j.push(q)}}if($.cache)j.push(await B("cache","cache",$.cache,U));if($.diagnostics)j.push(await B("diagnostics","diagnostics",$.diagnostics,U));for(let M of G)j.push(await B(M.id,"extra",M,U));return j}return{command:$.command,async open(U){let K=GZ(U,X);return t9($.command,$.title,await V(K),J)},async apply(U,K){let j=GZ(K,X),M=async(L)=>e9($.command,$.title,await V(j),L,J),D=U.command===$.command?Cz(await V(j),U):void 0;if(!D)return M({ok:!1,code:"unavailable",text:"That action is no longer available."});let q=g8(D);if(q&&U.confirmed!==!0)return M({ok:!1,code:"needs-confirmation",text:q.message,needsConfirmation:!0});let F=_z(D.knobs??[],U.values);if("problem"in F)return M({ok:!1,code:"invalid-input",text:F.problem});let C;try{let L=await D.run({values:F.values,...U.itemId!==void 0?{itemId:U.itemId}:{},invocation:j});C=typeof L==="string"?{ok:!0,text:L}:{ok:L.ok,text:L.text,...L.ok?{}:{code:L.code??"refused"}}}catch(L){let N=f$(L);Z.warn("command menu action failed",{command:$.command,section:U.sectionId,action:U.actionId,code:N.code,error:X(L instanceof Error?L.message:String(L))}),C={ok:!1,...N}}return M(C)}}}async function v$($,Z,X){let J=new Map,z=[];for(let Q of X){let Y=Q.label;for(let W=2;J.has(Y);W++)Y=`${Q.label} (${W})`;J.set(Y,Q.value),z.push(Y)}let G=await $.select(Z,z);return G===void 0?void 0:J.get(G)}function QZ($,Z){return Z.length>0?`${$}
+import{createRequire as H5}from"node:module";var W5=H5(import.meta.url);import{createAssistantMessageEventStream as oB}from"@earendil-works/pi-ai";import{streamSimple as tB}from"@earendil-works/pi-ai/compat";var X0="all",WZ=Object.freeze(["primary"]);function f8($){return $.kind==="retired"?$.retiredAt:$.checkedAt}function x1($,Z){return JSON.stringify([$,Z])}function K1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function D0($){return typeof $==="number"&&Number.isFinite($)}function y8($){return typeof $==="string"&&$.length>0}function C0($,Z,X){return $[Z]===void 0||X($[Z])}function V5($){return D0($)&&$>0}function HZ($){return typeof $==="string"}function U5($){if(!K1($)||!y8($.scope)||!y8($.label))return!1;switch($.kind){case"reading":return D0($.checkedAt)&&D0($.usedPercent)&&C0($,"resetsAt",HZ)&&C0($,"windowMinutes",V5);case"retired":return D0($.retiredAt);case"absent":return D0($.checkedAt);default:return!1}}function j5($){if(!K1($)||!D0($.checkedAt))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&C0($,"remainingPercent",D0)&&C0($,"usedPercent",D0)&&C0($,"resetsAt",HZ)&&C0($,"limit",D0)&&C0($,"used",D0)&&C0($,"remaining",D0)&&C0($,"unit",HZ)}function g8($){return K1($)&&D0($.value)&&Number.isInteger($.value)&&$.value>=0&&D0($.checkedAt)}function VZ($){return K1($)&&Object.values($).every(g8)}function UZ($){if(!K1($))return;let Z=Object.entries($).filter(([,X])=>g8(X));return Z.length===0?void 0:Object.fromEntries(Z)}function q1($){if(B0($))return $;if(!K1($))return;let{counters:Z,...X}=$;if(!B0(X))return;let J=UZ(Z);return{...X,...J===void 0?{}:{counters:J}}}function B0($){if(!K1($)||!Array.isArray($.limits))return!1;let Z=new Set;for(let X of $.limits){if(!U5(X))return!1;let J=x1(X.scope,X.label);if(Z.has(J))return!1;Z.add(J)}return C0($,"budget",j5)&&C0($,"counters",VZ)}class t$ extends TypeError{constructor($){super($);this.name="QuotaCodecError"}}function $6($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function e$($){return typeof $==="number"&&Number.isFinite($)}function h8($){return $===void 0||typeof $==="string"&&$!==""}function v8($){return typeof $==="string"&&$!==""}function Y$($,Z){return $[Z]===void 0||e$($[Z])}function jZ($,Z){return $[Z]===void 0||typeof $[Z]==="string"}function D5($){return $6($)&&h8($.scope)&&v8($.label)&&e$($.usedPercent)&&jZ($,"resetsAt")&&($.windowMinutes===void 0||e$($.windowMinutes)&&$.windowMinutes>0)}function K5($){return $6($)&&h8($.scope)&&v8($.label)}function q5($){if(!$6($))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&Y$($,"remainingPercent")&&Y$($,"usedPercent")&&jZ($,"resetsAt")&&Y$($,"limit")&&Y$($,"used")&&Y$($,"remaining")&&jZ($,"unit")}function m8($){if(!$6($)||!e$($.checkedAt))return!1;let Z=$.readings??[],X=$.coverage??[];if(!Array.isArray(Z)||!Array.isArray(X))return!1;let J=new Set;for(let G of Z){if(!D5(G))return!1;let z=x1(G.scope??X0,G.label);if(J.has(z))return!1;J.add(z)}if(!X.every(K5))return!1;return($.budget===void 0||q5($.budget))&&($.counters===void 0||VZ($.counters))}function N5($,Z){if($.scope!==Z.scope)return $.scope<Z.scope?-1:1;if($.label!==Z.label)return $.label<Z.label?-1:1;return 0}function M5($,Z,X){if(Z===void 0)return $;if($!==void 0&&X<$.checkedAt)return $;return{...Z,checkedAt:X}}function F5($,Z){let X=new Map(Object.entries($??{}));for(let[J,G]of Object.entries(Z??{})){let z=X.get(J);if(z===void 0||G.checkedAt>=z.checkedAt)X.set(J,G)}return X.size===0?void 0:Object.fromEntries(X)}function E0($,Z){let X=$===void 0?void 0:q1($);if($!==void 0&&X===void 0)throw new t$("stored quota map is malformed");if(!m8(Z))throw new t$("quota observation is malformed");let J=X??{limits:[]},G=Z.checkedAt,z=new Map;for(let V of J.limits)z.set(x1(V.scope,V.label),V);let B=(V)=>{let N=z.get(V);return N===void 0||G>=f8(N)},Q=new Set;for(let V of Z.readings??[]){let N=V.scope??X0,q=x1(N,V.label);if(Q.add(q),!B(q))continue;z.set(q,{scope:N,label:V.label,kind:"reading",checkedAt:G,usedPercent:V.usedPercent,...V.resetsAt===void 0?{}:{resetsAt:V.resetsAt},...V.windowMinutes===void 0?{}:{windowMinutes:V.windowMinutes}})}for(let V of Z.coverage??[]){let N=V.scope??X0,q=x1(N,V.label);if(Q.has(q)||!B(q))continue;let M=z.get(q);z.set(q,M===void 0||M.kind==="absent"?{scope:N,label:V.label,kind:"absent",checkedAt:G}:{scope:N,label:V.label,kind:"retired",retiredAt:G})}let{limits:Y,budget:H,counters:W,...U}=J,j=M5(J.budget,Z.budget,G),K=F5(J.counters,Z.counters);return{...U,limits:[...z.values()].sort(N5),...j===void 0?{}:{budget:j},...K===void 0?{}:{counters:K}}}var DZ=Object.freeze({validate:B0,decode:q1,merge:E0});var u8=900000,l8="no quota reading yet",d8="no limits reported";function c8($){let Z=Math.max(1,Math.round($/60000));if(Z<60)return`${Z}m`;let X=Math.round(Z/60);if(X<24)return`${X}h`;return`${Math.max(1,Math.round(Z/1440))}d`}function L5($){if($%1440===0)return`${$/1440}d`;if($%60===0)return`${$/60}h`;return`${$}m`}function Z6($){if($.scope!==X0||$.windowMinutes===void 0)return $.label;return L5($.windowMinutes)}function KZ($){return Math.min(100,Math.max(0,$))}function w8($){return`${Math.round(KZ($))}% left`}function p8($,Z,X){let J=$===void 0?Number.NaN:Date.parse($);return{...Number.isFinite(J)&&J>X?{resetIn:c8(J-X)}:{},resetSinceReading:Number.isFinite(J)&&J>Z&&J<=X}}function _5($,Z){let X=$.windowMinutes,J=Z.windowMinutes;if(X!==void 0&&J!==void 0&&X!==J)return X-J;if(X===void 0!==(J===void 0))return X===void 0?1:-1;if($.scope!==Z.scope){if($.scope===X0)return-1;if(Z.scope===X0)return 1;return $.scope<Z.scope?-1:1}return $.label<Z.label?-1:$.label>Z.label?1:0}function s8($,Z){if(!$)return{windows:[]};let{now:X}=Z,G=$.limits.filter((B)=>B.kind==="reading"&&B.remainingPercent!==void 0).sort(_5).map((B)=>{let Q=KZ(B.remainingPercent??0);return{kind:"window",name:Z6(B),figure:w8(B.remainingPercent??0),remainingPercent:Q,checkedAt:B.checkedAt,...p8(B.resetsAt,B.checkedAt,X)}}),z=$.budget;if(z){let B=z.remainingPercent,Q=z.reached?"credits spent":B!==void 0?`credits ${w8(B)}`:"credits available";G.push({kind:"budget",name:"credits",figure:Q,...B===void 0?{}:{remainingPercent:KZ(B)},checkedAt:z.checkedAt,...p8(z.resetsAt,z.checkedAt,X)})}if(G.length>0){let B=X-Math.min(...G.map((Q)=>Q.checkedAt));if(B>(Z.staleAfterMs??u8))return{windows:G,age:`checked ${c8(B)} ago`}}return{windows:G}}function k1($,Z){let X=s8($,Z),J=(Z.form??"full")==="full",G=X.windows.map((z)=>{let B=J&&z.resetIn?`, resets ${z.resetIn}`:"";return`${z.kind==="budget"?"":`${z.name} `}${z.figure}${B}`});return X.age===void 0?G:[...G,X.age]}function P0($,Z){let X=k1($,Z);if(X.length>0)return X.join(" · ");return $&&$.limits.length>0?d8:l8}function O5($){if($.kind==="retired")return{scope:$.scope,label:$.label,kind:"retired",checkedAt:$.retiredAt};if($.kind==="absent")return{scope:$.scope,label:$.label,kind:"absent",checkedAt:$.checkedAt};return{scope:$.scope,label:$.label,kind:"reading",checkedAt:$.checkedAt,usedPercent:$.usedPercent,remainingPercent:100-$.usedPercent,...$.windowMinutes===void 0?{}:{windowMinutes:$.windowMinutes},...$.resetsAt===void 0?{}:{resetsAt:$.resetsAt}}}function C5($,Z){let X=$.windowMinutes!==void 0,J=Z.windowMinutes!==void 0;if(X!==J)return X?-1:1;if(X&&J&&$.windowMinutes!==Z.windowMinutes)return(Z.windowMinutes??0)-($.windowMinutes??0);if($.label!==Z.label)return $.label<Z.label?-1:1;return 0}function P5($){return{checkedAt:$.checkedAt,reached:$.reached,...$.remainingPercent===void 0?{}:{remainingPercent:$.remainingPercent},...$.resetsAt===void 0?{}:{resetsAt:$.resetsAt}}}function c($,Z=X0){let X=new Map;for(let H of $?.limits??[]){if(H.scope!==Z&&H.scope!==X0)continue;let W=X.get(H.label);if(W===void 0){X.set(H.label,H);continue}let U=H.scope===X0?W:H,j=H.scope===X0?H:W;X.set(H.label,U.kind==="reading"?U:j)}let J=[...X.values()].map(O5).sort(C5),G=J.filter((H)=>H.kind==="reading"),z=G.length>0?G:J,B=z.length>0?Math.min(...z.map((H)=>H.checkedAt)):void 0,Q=$?.budget?.kind==="reading"?P5($.budget):void 0,Y=UZ($?.counters);return{scope:Z,limits:J,...B===void 0?{}:{checkedAt:B},...Q===void 0?{}:{budget:Q},...Y===void 0?{}:{counters:Y}}}function H$($,Z){let X=$?.budget;if(X?.reached!==!0||typeof X.resetsAt!=="string")return;let J=Date.parse(X.resetsAt);if(!Number.isFinite(J)||J<=Z)return;return{resetsAt:X.resetsAt,resetAtMs:J}}function qZ($){return $.kind==="reading"&&typeof $.usedPercent==="number"&&Number.isFinite($.usedPercent)&&$.usedPercent>=100}function X6($,Z){if(typeof $.resetsAt!=="string")return;let X=Date.parse($.resetsAt);return Number.isFinite(X)&&X>Z?X:void 0}function i8($,Z,X){let J=Z.rateLimitMarks?.get($);if(J!==void 0&&X<J)return{id:$,reason:"rate-limited",until:J};let G=Z.refreshBackoff?.get($);if(G!==void 0&&X<G)return{id:$,reason:"refresh-backoff",until:G};return}function T5($,Z,X,J){if(Z.limits.length===0)return{id:$,stage:1,gate:2,reason:"needs-first-reading",pullRequested:!0};for(let z of X)if(!Z.limits.some((B)=>B.label===z))return{id:$,stage:1,gate:3,reason:"unknown-window",window:{scope:Z.scope,label:z},pullRequested:!0};let G=Z.limits.filter(qZ);for(let z of G)if(X6(z,J)===void 0)return{id:$,stage:1,gate:4,reason:"unknown-reset",window:{scope:z.scope,label:z.label},pullRequested:!0};for(let z of G){let B=X6(z,J);if(B!==void 0&&typeof z.resetsAt==="string")return{id:$,stage:1,gate:5,reason:"exhausted",window:{scope:z.scope,label:z.label},resetsAt:z.resetsAt,resetAtMs:B}}return}function h0($){let Z=$.scope??X0,X=$.requiredLabels??WZ,J=[],G=[],z=[];for(let j of $.rows){let K=i8(j.id,$,$.now);if(K){J.push(K);continue}if(j.kind==="api-key"){z.push({id:j.id,kind:j.kind});continue}let V=c(j.quota,Z),N=T5(j.id,V,X,$.now);if(N){G.push(N);continue}z.push({id:j.id,kind:j.kind,projection:V})}let B=new Map(z.flatMap((j)=>{let K=H$(j.projection,$.now);return K?[[j.id,K]]:[]})),Q=B.size>0&&B.size===z.length,Y=[];for(let j of z){let K=B.get(j.id);if(K===void 0)Y.push(j);else if(Q)Y.push({...j,lastPath:!0});else G.push({id:j.id,stage:2,reason:"budget-spent",...K})}let H=new Map($.rows.map((j,K)=>[j.id,K])),W=(j,K)=>(H.get(j.id)??0)-(H.get(K.id)??0);G.sort(W);let U=G.filter((j)=>("pullRequested"in j)).map((j)=>j.id);for(let j of U)$.requestPull?.(j);return{admitted:Y,refused:G,excluded:J,pulls:U}}var J6="main";function NZ($){switch($){case"sticky-balanced":return{mode:"sticky-balanced",placement:"roster"};case"main-first":return{mode:"ordered",placement:"main-first"};case"fallback-first":return{mode:"ordered",placement:"fallback-first"};default:return{mode:"ordered",placement:"roster"}}}function y1($,Z,X=J6){if(Z==="roster"||!$.includes(X))return[...$];let J=$.filter((G)=>G!==X);return Z==="main-first"?[X,...J]:[...J,X]}function MZ($){let Z=h0($),X=new Set(Z.admitted.map((G)=>G.id));return{order:y1($.rows.map((G)=>G.id),$.placement??"roster",$.formerMainId).filter((G)=>X.has(G)&&$.killswitch?.get(G)!==!1),admission:Z}}function FZ($,Z,X){let J=Z.at(-1);if(J!==void 0){if(J.status===void 0||!X.includes(J.status))return}let G=new Set(Z.map((z)=>z.id));return $.find((z)=>!G.has(z))}function W$($,Z,X){if(!Z.has($.accountId))return!1;return!(typeof $.wireIdentity==="string"&&typeof X==="string"&&$.wireIdentity!==X)}function LZ($,Z,X){let J=new Map;for(let[G,z]of $){if(G===X)continue;if(z.quotaCheckedAt!==Z.get(z.accountId))continue;J.set(z.accountId,(J.get(z.accountId)??0)+(z.inputBytes??0))}return J}var CZ=900000,n8=0.016666666666666666,_Z=0.000001;function G6($,Z){for(let X of[$?.checkedAt,Z])if(typeof X==="number"&&Number.isFinite(X))return X;return}function r8($){if($===401||$===403)return"permanent";if($===void 0||$===0||!Number.isFinite($)||$>=500&&$<=599||$===429)return"transient";return"healthy"}function o8($){return $.limits.filter((Z)=>Z.kind==="reading").sort((Z,X)=>{let J=Z.windowMinutes!==void 0,G=X.windowMinutes!==void 0;if(J!==G)return J?-1:1;if(J&&G)return(X.windowMinutes??0)-(Z.windowMinutes??0);return 0})}function PZ($){let Z=($.classifyStatus??r8)($.status);if(Z==="permanent")return{action:"migrate",reason:"permanent"};if(!$.quota)return{action:"retain",reason:"unknown"};let X=G6($.quota,$.quotaCheckedAt);if(X===void 0||!Number.isFinite(X)||$.now-X>CZ)return{action:"retain",reason:"stale"};if($.killswitchPasses===!1)return{action:"migrate",reason:"killswitch"};for(let G of o8($.quota)){let z=G.remainingPercent;if(typeof z==="number"&&Number.isFinite(z)&&z<=0)return{action:"migrate",reason:"exhausted",window:{scope:G.scope,label:G.label},...typeof G.resetsAt==="string"?{resetsAt:G.resetsAt}:{}}}let J=H$($.quota,$.now);if(J)return{action:"migrate",reason:"exhausted",resetsAt:J.resetsAt};return{action:"retain",reason:Z}}function OZ($,Z,X){let J=Math.max(0,$.remainingPercent-Z);if(J<=0)return 0;if(!$.resetsAt)return J;let G=Date.parse($.resetsAt);if(!Number.isFinite(G)||G<=X)return J;let z=Math.max((G-X)/3600000,n8);return J/z}function a8($,Z){if($<Z)return-1;if($>Z)return 1;return 0}function A5($,Z){if(!$.quota)return;let X=G6($.quota,$.quotaCheckedAt);if(X===void 0||Z-X>CZ)return;let J=o8($.quota).map((B)=>OZ({remainingPercent:B.remainingPercent??Number.NaN,...B.resetsAt===void 0?{}:{resetsAt:B.resetsAt}},$.reservePercent[B.label]??0,Z)),G=$.quota.budget;if(G&&typeof G.remainingPercent==="number"&&Number.isFinite(G.remainingPercent))J.push(OZ({remainingPercent:G.remainingPercent,...G.resetsAt===void 0?{}:{resetsAt:G.resetsAt}},0,Z));let z=J.length>0?Math.min(...J):0;return z>0?{candidate:$,quotaCheckedAt:X,weight:z}:void 0}function t8($){let Z=$.candidates.filter((G)=>G.killswitchPasses!==!1);if($.candidates.length===0)throw Error("Cannot select a sticky candidate: input.candidates is empty");if(Z.length===0)return;let X=Z.map((G)=>A5(G,$.now)).filter((G)=>G!==void 0);if(X.length>0){X.sort((z,B)=>{let Q=(($.pendingBytes.get(z.candidate.accountId)??0)+$.requestBytes)/Math.max(z.weight,_Z),Y=(($.pendingBytes.get(B.candidate.accountId)??0)+$.requestBytes)/Math.max(B.weight,_Z);return Q-Y||z.candidate.configuredOrder-B.candidate.configuredOrder||a8(z.candidate.accountId,B.candidate.accountId)});let G=X[0];if(G)return{accountId:G.candidate.accountId,quotaCheckedAt:G.quotaCheckedAt,source:"weighted"}}$.onEmptyWeightedSet?.();let J=[...Z].sort((G,z)=>{let B=(G.resetCreditsApplicable??0)>0?1:0;return((z.resetCreditsApplicable??0)>0?1:0)-B||G.configuredOrder-z.configuredOrder||a8(G.accountId,z.accountId)})[0];if(!J)throw Error("Cannot select a sticky candidate: input.candidates is empty");return{accountId:J.accountId,quotaCheckedAt:G6(J.quota,J.quotaCheckedAt),source:"mode-fallback"}}function TZ($){let Z=h0($),X=new Map(Z.admitted.map((V)=>[V.id,V])),J=new Map(Z.refused.map((V)=>[V.id,V])),G=new Set(Z.excluded.map((V)=>V.id)),z=new Set($.rows.map((V)=>V.id)),B=$.pin!==void 0&&W$($.pin,z,$.identities?.get($.pin.accountId));if(B&&$.pin){let V=X.get($.pin.accountId);if(V&&$.killswitch?.get(V.id)!==!1)return{outcome:"dispatch",accountId:V.id,source:"pin",...V.projection?.checkedAt===void 0?{}:{quotaCheckedAt:V.projection.checkedAt},pin:{action:"retain"},refusedSelections:[],admission:Z}}let Q=$.pin?J.get($.pin.accountId):void 0,Y=B&&$.pin!==void 0&&$.refusedPinPolicy==="move-on-confirmed-exhaustion"&&($.killswitch?.get($.pin.accountId)===!1||Q?.reason==="exhausted"||Q?.reason==="budget-spent"),H=(V)=>{return(typeof $.rowReservePercent==="function"?$.rowReservePercent(V):$.rowReservePercent?.get(V.id))??$.reservePercent??{}},W=$.scope,U=$.rows.map((V,N)=>({row:V,configuredOrder:N})).filter(({row:V})=>!G.has(V.id)).map(({row:V,configuredOrder:N})=>{let q=$.killswitch?.get(V.id),M=$.resetCreditsApplicable?.get(V.id);return{accountId:V.id,quota:V.kind==="api-key"?void 0:X.get(V.id)?.projection??c(V.quota,W),reservePercent:H(V),configuredOrder:N,...M===void 0?{}:{resetCreditsApplicable:M},...q===void 0?{}:{killswitchPasses:q}}}),j=[],K=B?{action:"retain"}:$.pin?{action:"clear"}:{action:"none"};while(U.length>0){let V=t8({candidates:U,pendingBytes:$.pendingBytes??new Map,requestBytes:$.requestBytes,now:$.now,...$.onEmptyWeightedSet?{onEmptyWeightedSet:$.onEmptyWeightedSet}:{}});if(!V)break;let N=J.get(V.accountId);if(N){j.push(N),U=U.filter((M)=>M.accountId!==V.accountId);continue}let q=$.identities?.get(V.accountId);return{outcome:"dispatch",accountId:V.accountId,source:V.source,...V.quotaCheckedAt===void 0?{}:{quotaCheckedAt:V.quotaCheckedAt},pin:B&&!Y?{action:"retain"}:{action:"assign",pin:{accountId:V.accountId,inputBytes:$.requestBytes,...q===void 0?{}:{wireIdentity:q},...V.quotaCheckedAt===void 0?{}:{quotaCheckedAt:V.quotaCheckedAt}}},refusedSelections:j,admission:Z}}return{outcome:"no-admissible-account",pin:K,refusedSelections:j,admission:Z}}import{appendFileSync as f5,chmodSync as g5,existsSync as EZ,renameSync as B9,statSync as h5}from"node:fs";import{open as v5}from"node:fs/promises";import{dirname as m5,resolve as w5}from"node:path";import{randomUUID as S5}from"node:crypto";import{lstat as X9,readFile as J9,rename as R5,unlink as e8}from"node:fs/promises";import{dirname as i0,resolve as M0}from"node:path";var R=process.platform==="win32",$9=new Set;function AZ($){if($?.reason==="io-error"){if($.win32Code===2||$.win32Code===3)return"ENOENT";if($.win32Code===80||$.win32Code===183)return"EEXIST"}return $?.code??"ERR_PRIVATE_FILE"}var Z9;function f1(){return Z9??=import("@cortexkit/private-files"),Z9}class l extends Error{path;stage;code;win32Code;reason;published=!1;durabilityConfirmed=!1;fileDurable=!1;attempts=0;elapsedMs=0;orphanPath;constructor($,Z,X){let J=X;super(`Private file refused at ${Z}: ${$} (${J?.reason??J?.code??"io-error"}). Use a safe parent directory. Repair only a named secret file in safe ancestry whose owner the published policy trusts, without changing its owner or any existing directory. Previously exposed credentials may need rotation. Windows requires the private-files native prebuild and an ACL-persisting local filesystem such as NTFS.`,{cause:X});this.path=$,this.stage=Z,this.name="PrivateFileError",this.code=AZ(J),this.win32Code=J?.win32Code,this.reason=J?.reason}}async function K0($,Z,X){try{return await X()}catch(J){if(J instanceof l)throw J;throw new l($,Z,J)}}var E5;async function v0($,Z){$=M0($),Z??=E5,await K0($,"safe-parent",async()=>{let X=await(await f1()).verifySafeParent($,Z);if(X.ok===!1){if(X.reason==="io-error"||X.reason==="wrong-kind")await X9($);throw new l(X.level??X.path,"safe-parent",{...X,code:"ERR_PRIVATE_FILES_SECURITY"})}})}async function J0($,Z,X=!1){if($=M0($),Z==="directory")return v0($);await K0($,"verify",async()=>{let J=await f1(),G=await J.verifyOwnerOnly($),z=!1;if(!G.ok){let{reason:B}=G.refusal;if(B==="io-error")await J.verifyPrivatePath($,Z);if(X&&[J.EXTRA_ACE,J.NOT_PROTECTED,J.NULL_DACL,J.EMPTY_DACL].includes(B))await v0(i0($)),await J.securePrivatePath($,Z),z=!0;else throw Object.assign(Error("Owner-only verification refused"),{reason:B,code:"ERR_PRIVATE_FILES_SECURITY"})}if(await J.verifyPrivatePath($,Z),z&&!$9.has($))$9.add($),process.emitWarning(`Private permissions tightened: ${$}. This object may have been readable before; rotate credentials if needed.`,"PrivateFileMigration")})}async function q0($,Z=!1,X){$=M0($),await K0($,"directory",async()=>{let J=await f1();try{return await X9($),await v0($,X)}catch(z){if(AZ(z)!=="ENOENT")throw z}let G=i0($);if(G===$)throw Object.assign(Error("Missing root"),{code:"ENOENT"});await q0(G,!1,X);try{await J.createOwnerOnly($,{kind:"dir"})}catch(z){if(AZ(z)!=="EEXIST")throw z}await v0($,X)})}async function F0($,Z=!1){if(!R)return J9($,"utf8");return(await SZ($,Z)).toString("utf8")}async function SZ($,Z=!1){if(!R)return J9($);if($=M0($),Z)await v0(i0($)),await J0($,"file",!0);return K0($,"read",async()=>(await f1()).readOwnerOnly($))}async function g1($,Z){await v0(i0(M0($))),await K0($,"create",async()=>{await(await f1()).createPrivateFile(M0($),Z)})}async function G9($){await v0(i0(M0($))),await K0($,"directory-create",async()=>{await(await f1()).createOwnerOnly(M0($),{kind:"dir"})})}async function RZ($,Z,X={}){$=M0($),Z=M0(Z);let J=X.now??(()=>performance.now()),G=J(),z=Math.min(G+500,X.deadline??1/0),B=[0,10,20,40,80,100],Q,Y=0;for(let W of B){if(J()>=z)break;if(W)await(X.sleep??((U)=>new Promise((j)=>setTimeout(j,U))))(Math.min(W,Math.max(0,z-J())));if(J()>=z)break;if(await X.beforeRename?.(),J()>=z)break;Y++;try{return await(X.rename??R5)($,Z),{attempts:Y,elapsedMs:J()-G}}catch(U){Q??=U;let j=U;if(!(j.win32Code!==void 0?j.win32Code===32||j.win32Code===33:["EBUSY","EPERM","EACCES"].includes(j.code??"")&&!j.reason))break}}let H=new l(Z,"rename",Q??Object.assign(Error("Publication deadline expired"),{code:"ETIMEDOUT"}));throw H.attempts=Y,H.elapsedMs=J()-G,H}async function h1($,Z,X={}){$=M0($),await q0(i0($));try{await J0($,"file",!0)}catch(H){if(H.code!=="ENOENT")throw H}let J=M0(X.stagePath??`${$}.${S5()}.tmp`);if(i0(J)!==i0($))throw new l($,"stage-directory",{code:"EXDEV"});let G=!1,z=!1,B={attempts:0,elapsedMs:0},Q="stage-create",Y=(H)=>{try{X.onOutcome?.({path:$,stage:H?.stage??"published",published:z,fileDurable:z,durabilityConfirmed:!1,attempts:H?.attempts??B.attempts,elapsedMs:H?.elapsedMs??B.elapsedMs,...H&&{code:H.code,win32Code:H.win32Code}})}catch{}};try{if(await g1(J,Z),G=!0,Q="before-rename",B=await RZ(J,$,X),G=!1,z=!0,Q="published-callback",X.onRenamed?.(),Q="published-verify",await J0($,"file"),X.durable&&X.durability!=="file-only-on-windows")throw new l($,"directory-sync-unsupported",{code:"ENOTSUP"});Y()}catch(H){let W=H instanceof l?H:new l($,Q,H);if(W.published=z,W.fileDurable=z,z)Object.assign(W,B);if(G){try{await e8(J)}catch{W.orphanPath=J}G=!1}throw Y(W),W}finally{if(G)await e8(J).catch(()=>{})}}var I5=/^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i,b5=/\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g;function x5($){return $ instanceof Error||Object.prototype.toString.call($)==="[object Error]"}function I0($={}){let Z=[b5,...$.extraValuePatterns??[]].map((z)=>new RegExp(z.source,z.flags.includes("g")?z.flags:`${z.flags}g`));function X(z){let B=z.toLowerCase().replace(/[-_]/g,"");return I5.test(z)||B.includes("apikey")||B.endsWith("secret")||B.endsWith("password")||B.endsWith("token")&&!B.endsWith("tokens")||!!$.extraSecretKeys?.(B)}function J(z){let B=z,Q=[["name",z.name],["message",z.message],["stack",z.stack]];for(let H of["code","status","cause"])if(B[H]!==void 0)Q.push([H,B[H]]);let Y=new Set(Q.map(([H])=>H));for(let H of Object.entries(z))if(!Y.has(H[0]))Q.push(H);return Q}function G(z,B,Q,Y=0){if(typeof z==="string")return Z.reduce((H,W)=>H.replace(W,"***REDACTED***"),z);if(!z||typeof z!=="object")return z;if(Q.has(z))return"[Circular]";Q.add(z);try{if(Array.isArray(z))return z.map((U)=>G(U,B,Q,Y));let H=x5(z);if(H&&Y>=8)return"[Truncated]";let W=H?Y+1:Y;return Object.fromEntries((H?J(z):Object.entries(z)).map(([U,j])=>[U,B&&X(U)?"***REDACTED***":G(j,B,Q,W)]))}finally{Q.delete(z)}}return{redact:(z)=>G(z,!0,new WeakSet),redactStrings:(z)=>G(z,!1,new WeakSet)}}var z9=I0(),k5=z9.redact,y5=z9.redactStrings;var z6={error:0,warn:1,info:2,debug:3,trace:4},Y9=5242880,H9=3;function IZ($){try{g5($,384)}catch{}}function p5($){try{if(!(EZ($)&&h5($).size>=Y9))return;for(let X=H9-1;X>=1;X--)if(EZ(`${$}.${X}`)){let J=`${$}.${X+1}`;B9(`${$}.${X}`,J),IZ(J)}let Z=`${$}.1`;B9($,Z),IZ(Z)}catch{}}async function m0($){let{file:Z,handle:X}=$;if($.file=void 0,$.handle=void 0,Z&&X)await K0(Z,"log-close",()=>X.close())}async function Q9($,Z){await q0(m5(Z));try{await J0(Z,"file",!0)}catch(X){if(X.code!=="ENOENT")throw X;try{await g1(Z,"")}catch(J){if(J.code!=="EEXIST")throw J;await J0(Z,"file",!0)}}return $.handle=await K0(Z,"log-open",()=>v5(Z,"a")),$.file=Z,$.handle}async function u5($,Z,X){Z=w5(Z);try{if($.file!==Z)await m0($);let J=$.handle??await Q9($,Z);if((await K0(Z,"log-stat",()=>J.stat())).size>=Y9){await m0($);for(let z=H9-1;z>=0;z--){let B=z===0?Z:`${Z}.${z}`,Q=`${Z}.${z+1}`;try{await J0(B,"file",!0)}catch(Y){if(Y.code==="ENOENT")continue;throw Y}try{await J0(Q,"file",!0)}catch(Y){if(Y.code!=="ENOENT")throw Y}await RZ(B,Q),await J0(Q,"file")}J=await Q9($,Z)}await K0(Z,"log-append",()=>J.appendFile(X,"utf8"))}catch(J){throw await m0($).catch(()=>{}),J}}function l5($){try{return` ${JSON.stringify($)}`}catch{return" [unserializable]"}}function d5($){let Z,X,J,G=I0(),z,B=[],Q,Y=Promise.resolve(),H,W={};function U(D){let L=Y.then(D);return Y=L.catch((A)=>{H=A}),L}function j(D){if(R&&D.file!==Z)U(()=>m0(W)).catch(()=>{});Z=D.file,X=D.level,G=I0(D),z=D.captureSink}function K(D){if(D===void 0||D in z6)J=D}function V(){if(Z===void 0)return;return(typeof Z==="function"?Z():Z)||void 0}function N(){if(J)return J;let D=typeof X==="function"?X():X;if(D&&D in z6)return D;return"info"}function q(D=!0){if(Q)clearTimeout(Q),Q=void 0;if(!B.length){if(R)return U(async()=>{if(D)await m0(W);if(H)throw H});return}let L;try{L=V()}catch{if(B=[],R&&D)return U(()=>m0(W));return}let A=B.join("");if(B=[],!L){if(R&&D)return U(()=>m0(W));return}if(R)return U(async()=>{try{await u5(W,L,A)}finally{if(D)await m0(W)}});try{if(p5(L),EZ(L))IZ(L);f5(L,A,{encoding:"utf8",mode:384})}catch{}}function M(){if(!Q)Q=setTimeout(()=>{Q=void 0;let D=q(!1);if(D instanceof Promise)D.catch(()=>{})},500)}function P(D,L,A,v){if(Z===void 0&&z===void 0)return;try{if(z6[L]>z6[N()])return;let u=G.redactStrings(A),n;try{n=G.redact(v)}catch{n="[unserializable]"}let f=`[${new Date().toISOString()}] ${L.toUpperCase()} [${D}] ${u}`+(v===void 0?"":l5(n))+`
+`;try{z?.({channel:D,level:L,message:u,data:n})}catch{}if(Z===void 0)return;if(B.push(f),B.length>=50){let k=q(!1);if(k instanceof Promise)k.catch(()=>{})}else M()}catch{}}function E(D){return{error:(L,A)=>P(D,"error",L,A),warn:(L,A)=>P(D,"warn",L,A),info:(L,A)=>P(D,"info",L,A),debug:(L,A)=>P(D,"debug",L,A),trace:(L,A)=>P(D,"trace",L,A)}}function F(){if(R)U(()=>m0(W)).catch(()=>{});if(H=void 0,B=[],Q)clearTimeout(Q),Q=void 0;Z=void 0,X=void 0,J=void 0,G=I0(),z=void 0}if($)j($);return{configure:j,createLogger:E,setLogLevel:K,flushLogs:q,reset:F}}var c5=d5();function i($){return c5.createLogger($)}class x extends Error{operation;rowId;phase;retryable;kind;committed;constructor($){super($.message??`${$.operation} failed (${$.kind}, ${$.phase})`,$.cause===void 0?void 0:{cause:$.cause});this.name="PoolOperationError",this.operation=$.operation,this.rowId=$.rowId,this.phase=$.phase,this.retryable=$.retryable,this.kind=$.kind,this.committed=$.committed}}class B6 extends Error{operation;constructor($){super(`${$} was called from inside a store hook; hand it to the caller's continuation instead`);this.name="PoolReentryError",this.operation=$}}var v1="identity-contradicted: ",bZ="duplicate-identity";function a0($,Z,X){let J=$.rosterRow(Z);if(!J)return;J.enabled=!1;let G=$.entry(Z)??{credentialEpoch:1,needsFirstReading:!0},z=typeof G.disabledReason==="string"&&G.disabledReason.startsWith("identity-contradicted: ");$.setEntry(Z,{...G,disabledReason:z?G.disabledReason:X})}function V$($,Z){let X=$.rosterRow(Z);if(!X)return;X.enabled=!0;let J=$.entry(Z);if(J&&"disabledReason"in J){let G={...J};delete G.disabledReason,$.setEntry(Z,G)}}function m1($,Z){let X=$.rows().filter((G)=>G.invalid===void 0&&!G.staged&&G.type==="oauth"&&G.enabled&&G.identity===Z),J=[];for(let G of X.slice(1))a0($,G.id,"duplicate-identity"),J.push(G.id);return J}function N1($,Z,X){let J=$.rosterRow(Z);if(!J)return[];return J.accountId=X,m1($,X)}import{setTimeout as LX}from"node:timers/promises";import{randomUUID as W9}from"node:crypto";import{mkdir as o5,open as Q6,rename as t5,rm as e5}from"node:fs/promises";import{dirname as xZ}from"node:path";class U$ extends Error{constructor($){super("file or directory sync failed",{cause:$});this.name="AtomicSyncError"}}async function L0($,Z,X={}){await kZ($,Z,X)}async function kZ($,Z,X,J){if(R)return h1($,X.serialize?X.serialize(Z):`${JSON.stringify(Z,null,2)}
+`,{beforeRename:X.beforeRename,stagePath:`${$}.${(X.stageName??W9)()}.tmp`,onRenamed:J,durable:X.durable,durability:X.durability,onOutcome:X.onOutcome});await o5(xZ($),{recursive:!0});let G=`${$}.${(X.stageName??W9)()}.tmp`,z,B=!1;try{if(z=await Q6(G,"wx",384),B=!0,await z.writeFile(X.serialize?X.serialize(Z):`${JSON.stringify(Z,null,2)}
+`,"utf8"),await z.chmod(384),X.durable)try{await z.sync()}catch(Q){throw new U$(Q)}if(await z.close(),z=void 0,await X.beforeRename?.(),await t5(G,$),B=!1,J?.(),X.durable){let Q=await Q6(xZ($),"r");try{await Q.sync()}catch(Y){throw new U$(Y)}finally{await Q.close()}}}finally{if(await z?.close().catch(()=>{}),B)await e5(G,{force:!0}).catch(()=>{})}}async function yZ($){if(R){await J0($,"file");let J=new l($,"directory-sync-unsupported",{code:"ENOTSUP"});throw J.published=!0,J}let Z=await Q6($,"r");try{await Z.sync()}finally{await Z.close()}let X=await Q6(xZ($),"r");try{await X.sync()}finally{await X.close()}}import{randomUUID as Y6}from"node:crypto";import{mkdir as V9,open as $X,readFile as U9,rename as j9,rm as H6,stat as D9,writeFile as K9}from"node:fs/promises";import{dirname as fZ,join as q9}from"node:path";var ZX=globalThis.setTimeout.bind(globalThis),XX=globalThis.clearTimeout.bind(globalThis);function gZ($){let Z=$?.code;return Z==="ENOENT"||!R&&(Z==="EINVAL"||Z==="ENOTDIR")}async function e($){let Z=hZ($.path,$.name),X=q9(Z,"owner.json"),J=Y6(),G=$.now??Date.now,z=null,B=!1,Q=!1,Y,H,W=new Promise((C)=>{H=C});function U(C){try{let T=$.onRenewalTimer?.(C);if(T&&(typeof T==="object"||typeof T==="function")&&"then"in T&&typeof T.then==="function")Promise.resolve(T).catch(()=>{})}catch{}}function j(){if(!z)return;XX(z),z=null,U("cancelled")}function K(C,T){if(Y||B)return;Y=Object.freeze({reason:C,expectedOwnerId:J,...typeof T?.ownerId==="string"?{observedOwnerId:T.ownerId}:{},...typeof T?.expiresAt==="number"?{observedExpiresAt:T.expiresAt}:{}}),j(),H(Y)}let V,N=null,q=`${Z}.evicting`,M=q9(q,"owner.json"),P=Y6(),E=5000,F=8;async function D(){if(R)try{return JSON.parse(await F0(Z,!0))}catch(C){if(C.code!=="EISDIR"&&C.reason!=="wrong-kind")throw C;return await J0(Z,"directory",!0),JSON.parse(await F0(X,!0))}try{return JSON.parse(await U9(Z,"utf8"))}catch(C){if(C.code!=="EISDIR")throw C;return JSON.parse(await U9(X,"utf8"))}}async function L(){if(R){let w=await D(),o=Number(w?.expiresAt)-G();await h1(Z,`${JSON.stringify({ownerId:J,expiresAt:G()+$.ttlMs})}
+`,{deadline:performance.now()+Math.max(0,o),beforeRename:async()=>{let o$=await D();if(o$?.ownerId!==J||!(Number(o$?.expiresAt)>G())||!await y())throw new n0({target:$.path,name:$.name})}});return}let C=`${Z}.${Y6()}.tmp`,T,I=!1;try{T=await $X(C,"wx",384),I=!0,await T.writeFile(`${JSON.stringify({ownerId:J,expiresAt:G()+$.ttlMs})}
+`,"utf8"),await T.chmod(384),await T.close(),T=void 0;let w=await D();if(w?.ownerId!==J||!(Number(w?.expiresAt)>G())||!await y())throw new n0({target:$.path,name:$.name});await j9(C,Z),I=!1}finally{if(await T?.close().catch(()=>{}),I)await H6(C,{force:!0}).catch(()=>{})}}async function A(){let C=`${JSON.stringify({ownerId:J,expiresAt:G()+$.ttlMs})}
+`;if(R)await g1(Z,C);else await K9(Z,C,{encoding:"utf8",mode:384,flag:"wx"})}async function v(C){let T=C.code;if(T==="EEXIST"){if(R)await D();return!0}if(T==="EISDIR"){if(R)await J0(Z,"directory",!0),await F0(X,!0);return!0}return!1}async function u(){if(R)await q0(fZ(Z));try{return await A(),!0}catch(C){let T=C.code;if(await v(C))return!1;if(T==="ENOENT"){if(R)await q0(fZ(Z));else await V9(fZ(Z),{recursive:!0});try{return await A(),!0}catch(I){if(await v(I))return!1;throw I}}throw C}}async function n(){await new Promise((C)=>setTimeout(C,Math.floor(Math.random()*4)))}async function f(C=!0){if(C&&$.onStep)await $.onStep("lock-read-ready");let T;try{T=await D()}catch(w){if(R&&w.code!=="ENOENT")throw w}let I=Number(T?.expiresAt);if(Number.isFinite(I)&&I>G())return{status:"live"};if(typeof T?.ownerId==="string"&&Number.isFinite(I))return{status:"stale",identity:{kind:"owner",ownerId:T.ownerId,expiresAt:I}};try{let w=await D9(Z),o=Number.isFinite(I)?I:w.mtimeMs+$.ttlMs;if(o>G())return{status:"live"};return{status:"stale",identity:{kind:"stat",dev:w.dev,ino:w.ino,mtimeMs:w.mtimeMs,expiresAt:o}}}catch(w){if(w.code==="ENOENT"){if($.onStep)await $.onStep("lock-missing");return{status:"missing"}}throw w}}function k(C,T){if(T.status!=="stale")return!1;let I=T.identity;if(C.kind==="owner"&&I.kind==="owner")return C.ownerId===I.ownerId&&C.expiresAt===I.expiresAt;return C.kind==="stat"&&I.kind==="stat"&&C.dev===I.dev&&C.ino===I.ino&&C.mtimeMs===I.mtimeMs&&C.expiresAt===I.expiresAt}async function y(){try{return JSON.parse(await F0(M,R))?.ownerId===P}catch(C){if(R&&C.code!=="ENOENT")throw C;return!1}}async function r(C){if(R)await K0(C,"remove",()=>H6(C,{recursive:!0,force:!0}));else await H6(C,{recursive:!0,force:!0}).catch(()=>{})}async function d(){if(await y())await r(q)}async function n$(){if(R)await G9(q);else await V9(q);try{let C=`${JSON.stringify({ownerId:P,createdAt:G()})}
+`;if(R)await g1(M,C);else await K9(M,C,{encoding:"utf8",mode:384,flag:"wx"})}catch(C){if(gZ(C))return!1;throw await d(),C}if($.onStep)await $.onStep("eviction-marker-acquired");return!0}async function b1(){let C;try{C=await D9(q)}catch(I){if(I.code==="ENOENT")return"missing";throw I}if(R)await J0(q,"directory",!0);if(C.mtimeMs+E>G())return"fresh";if($.onStep)await $.onStep("stale-marker-stat");let T=`${q}.${Y6()}`;try{await j9(q,T)}catch(I){if(I.code==="ENOENT")return"missing";throw I}if($.onStep)await $.onStep("stale-marker-claimed");return await r(T),"recovered"}async function r$(C){try{if(!await n$())return!1}catch(T){if(T.code==="EEXIST"){if(R){await J0(q,"directory",!0);try{await F0(M,!0)}catch(I){if(I.code!=="ENOENT")throw I}}return!1}throw T}try{await C()}finally{await d()}return!0}async function g(){for(let C=0;C<F;C++){if($.onStep)await $.onStep("relinquish-read");let T;try{T=await D()}catch(I){if(R)throw I;return}if(T?.ownerId!==J)return;try{await H6(Z,{recursive:!0,force:!0});return}catch(I){if(R)throw I;await n()}}}function g0(){if(!$.renew||B||Y)return;let C=$.renewIntervalMs??Math.max(1000,Math.floor($.ttlMs/3));if(z=ZX(()=>{z=null;let T=(async()=>{let I=!B;try{if(!await r$(async()=>{let o=await D(),o$=G();if(B||Y){I=!1;return}if(o?.ownerId!==J){K("taken-over",o),I=!1;return}if(!(Number(o?.expiresAt)>o$)){K("expired",o),I=!1;return}if($.onStep)await $.onStep("renewal-owner-confirmed");if(B||Y){I=!1;return}if(!await y())return;if($.onStep)await $.onStep("renewal-write-fenced");if(B||Y){I=!1;return}if(!await y())return;if($.onStep)await $.onStep("renewal-write-ready");if(B||Y){I=!1;return}if(await L(),$.onStep)await $.onStep("renewal-write-finished");if(!await y()){K("marker-lost"),I=!1,await g();return}})&&$.onStep)await $.onStep("renewal-marker-unavailable")}catch(w){if(R&&w instanceof l)V=w,K("renewal-failed"),I=!1;try{let o=await D();if(o?.ownerId!==J)K("taken-over",o);else if(!(Number(o?.expiresAt)>G()))K("expired",o)}catch{K("renewal-failed")}}finally{if($.onStep)try{await $.onStep("renewal-finished")}catch{}if(I&&!B&&!Y)g0()}})();N=T,T.finally(()=>{if(N===T)N=null})},C),"unref"in z)z.unref();U("scheduled")}function k8(){try{let C=$.onContended?.();if(C&&(typeof C==="object"||typeof C==="function")&&"then"in C&&typeof C.then==="function")Promise.resolve(C).catch(()=>{})}catch{}return null}let D1=await u();if(!D1)for(let C=0;C<F;C++){if(D1=await u(),D1)break;let T=await f();if(T.status==="live")return k8();if(T.status==="missing")continue;if($.onStep)await $.onStep("stale-lock-observed");try{if(!await n$()){await n();continue}}catch(I){if(I.code!=="EEXIST")throw I;if(await b1()==="fresh")return null;await n();continue}try{let I=await f();if(I.status==="live")return k8();if(!k(T.identity,I))continue;if(!await y())return null;if($.onStep)await $.onStep("stale-lock-confirmed");if(!await y())return null;let w=await f(!1);if(!k(T.identity,w))continue;if(await r(Z),!await y())return null;if($.onStep)await $.onStep("stale-lock-removed");if(D1=await u(),!D1)return null;if($.onStep)await $.onStep("stale-lock-recreated");if(!await y())return await g(),D1=!1,null;break}finally{await d()}}if(!D1)return null;return g0(),{ownerId:J,whenLost:()=>W,hasLost:()=>Y!==void 0,assertOwned:async()=>{if(V)throw V;let C;try{let T=await D();if(C=T,!B&&!Y&&T?.ownerId===J&&Number(T?.expiresAt)>G())return;K(T?.ownerId!==J?"taken-over":"expired",T)}catch(T){if(K("unreadable"),R&&T instanceof l)throw T}throw new n0({target:$.path,name:$.name,expectedOwnerId:J,...typeof C?.ownerId==="string"?{observedOwnerId:C.ownerId}:{},...typeof C?.expiresAt==="number"?{observedExpiresAt:C.expiresAt}:{}})},release:async()=>{if(R&&Q)return;B=!0,j(),await N;for(let C=0;C<F;C++){try{let T=!1;if(await r$(async()=>{let w;try{w=await D()}catch(o){if(R&&o.code==="ENOENT"){T=!0;return}throw o}if(w?.ownerId!==J){T=!0;return}if($.onStep)await $.onStep("release-owner-confirmed");if(!await y())return;await r(Z),T=!0})){if(R&&!T)throw new l(Z,"release-not-confirmed",{code:"EIO"});Q=T;return}await b1()}catch(T){if(R)throw T;return}await n()}if(R)throw new l(Z,"release-not-confirmed",{code:"ETIMEDOUT"})}}}function hZ($,Z){return`${$}.${Z}.lock`}class M1 extends Error{details;constructor($){super(`Timed out acquiring ${$.name} lock for ${$.target}`);this.name="LockContentionError",this.details=$}}class n0 extends Error{details;constructor($){super(`Lost ${$.name} lock for ${$.target}`);this.name="LockOwnershipError",this.details=$}}async function vZ($,Z,X){let J=performance.now();for(;;){let G=await e({path:$,name:Z.name,ttlMs:Z.ttlMs,renew:Z.renew??!1,...Z.onStep?{onStep:Z.onStep}:{},...Z.onRenewalTimer?{onRenewalTimer:Z.onRenewalTimer}:{}});if(G)try{return await X(G)}finally{await G.release()}let z=Z.timeoutMs-(performance.now()-J);if(z<=0)throw new M1({target:$,name:Z.name,timeoutMs:Z.timeoutMs});await new Promise((B)=>setTimeout(B,Math.min(25,Math.ceil(z))))}}import{AsyncLocalStorage as JX}from"node:async_hooks";var N9=new JX;function G0($){if(N9.getStore()!==void 0)throw new B6($)}function b0($,Z){return N9.run($,async()=>await Z())}async function M9($,Z,X,J,G){if(!Z)return;try{await b0($,()=>Z(X,J))}catch(z){G?.warn("store failure hook threw; the original failure stands",{operation:$,rowId:X,error:z instanceof Error?z.message:String(z)})}}var mZ=Object.freeze({ttlMs:1e4,timeoutMs:15000,retryMs:50,renew:!0});async function GX($,Z,X){let J=(B)=>{try{let Q=X.onLockEvent?.({type:B,name:$.name,path:$.path});if(Q&&(typeof Q==="object"||typeof Q==="function")&&"then"in Q&&typeof Q.then==="function")Promise.resolve(Q).catch(()=>{})}catch{}},G={...Z,...zX($)},z=performance.now();for(;;){let B=await e({name:$.name,path:$.path,ttlMs:G.ttlMs,now:X.now,renew:G.renew,onContended:()=>J("contended"),...X.onRenewalTimer?{onRenewalTimer:(H)=>X.onRenewalTimer?.({name:$.name,path:$.path},H)}:{},...G.renewIntervalMs!==void 0?{renewIntervalMs:G.renewIntervalMs}:{},...X.onLockStep?{onStep:(H)=>X.onLockStep?.({name:$.name,path:$.path},H)}:{}});if(B){J("acquired");let H={name:$.name,path:$.path,assertOwned:()=>B.assertOwned(),release:async()=>{await B.release(),J("released")}};try{await H.assertOwned()}catch(W){throw await H.release(),W}return H}let Q=G.timeoutMs-(performance.now()-z);if(Q<=0)throw new M1({target:$.path,name:$.name,timeoutMs:G.timeoutMs});let Y=Math.floor(Math.random()*(G.retryMs+1));await new Promise((H)=>setTimeout(H,Math.min(G.retryMs+Y,Q)))}}function zX($){let Z={};if($.ttlMs!==void 0)Z.ttlMs=$.ttlMs;if($.timeoutMs!==void 0)Z.timeoutMs=$.timeoutMs;if($.retryMs!==void 0)Z.retryMs=$.retryMs;if($.renew!==void 0)Z.renew=$.renew;if($.renewIntervalMs!==void 0)Z.renewIntervalMs=$.renewIntervalMs;return Z}class r0{defaults;env;held=[];constructor($,Z){this.defaults=$,this.env=Z}async acquire($){let Z=await GX($,this.defaults,this.env);return this.held.push(Z),await this.assertAll(),Z}async assertAll(){for(let $ of this.held)await $.assertOwned()}async releaseTo($){while(this.held.length>$)await this.held.pop()?.release().catch(()=>{})}async releaseAll(){await this.releaseTo(0)}}function F1($,Z,X){if(X!==void 0)throw new x({operation:$,rowId:Z,kind:"row-staged",phase:$==="pull"?"pull":"before-first-write",retryable:!1,message:`row ${Z} is reserved for roster publication`})}import{createHash as j$}from"node:crypto";var m="commonAuthPool",o0=1,T0="rows",W6="retiredEpochs",D$=1,wZ=300000,h=m;function BX($){let Z=JSON.parse(JSON.stringify($)),X=(J)=>{if(Array.isArray(J))return`[${J.map(X).join(",")}]`;if(O(J))return`{${Object.keys(J).sort().map((G)=>`${JSON.stringify(G)}:${X(J[G])}`).join(",")}}`;return JSON.stringify(J)};return X(Z)}function L1($){return j$("sha256").update(BX($)).digest("hex")}function F9($){if(!O($)||Object.keys($).length!==1||typeof $.reservation!=="string"||!$.reservation)return;return{reservation:$.reservation}}function QX($){if(!O($)||typeof $.reservation!=="string"||!$.reservation||typeof $.disabledReason!=="string")return;if(Object.keys($).some((Z)=>!["reservation","label","disabledReason","providerState"].includes(Z)))return;if("label"in $&&typeof $.label!=="string")return;if("providerState"in $&&(typeof $.providerState!=="string"||!/^[a-f0-9]{64}$/.test($.providerState)))return;return $}var Q0="commonAuthProviderState";function O($){return $!=null&&typeof $==="object"&&!Array.isArray($)}var YX=new Set(["__proto__","constructor","prototype"]);function w1($){if(typeof $!=="string"||$.length===0)return"id must be non-empty";if($.trim()!==$)return"id must not carry surrounding whitespace";if(YX.has($))return"id is a reserved object key";return}function pZ($){let Z=typeof $==="string"?$.trim():"";if(!Z)return!1;try{let X=new URL(Z);return(X.protocol==="http:"||X.protocol==="https:")&&!X.username&&!X.password}catch{return!1}}function L9($){return $.type==="oauth"?`oauth\x00${$.refresh}`:`api\x00${$.apiKey}`}function t0($){return j$("sha256").update(L9($)).digest("hex")}function x0($){return j$("sha256").update(`credential-stamp\x00${L9($)}`).digest("hex")}function w0($){let Z=$.type==="oauth"?["oauth",typeof $.access==="string"?$.access:null,$.refresh,typeof $.expires==="number"&&Number.isFinite($.expires)?$.expires:null]:["api",$.apiKey,$.baseURL.trim(),$.authHeader??"authorization-bearer"];return j$("sha256").update(`credential-dispatch\x00${JSON.stringify(Z)}`).digest("hex")}function uZ($,Z,X,J={}){return{credentialEpoch:Z,digest:x0($),dispatch:w0($),binding:{...X},...J.replace?{replace:!0}:{},...J.providerState!==void 0?{providerState:J.providerState}:{}}}function p1($,Z){let X=$?.credentialBound?$.credentialBound(Z):Z;return j$("sha256").update(`provider-state\x00${JSON.stringify(X??null)}`).digest("hex")}function K$($,Z,X,J){if(!Z||X===void 0)return;if(!O($)||!Object.hasOwn($,Q0))return;let G=U0($[h]);if(!G||G.providerState===void 0||G.digest!==x0(Z)||G.credentialEpoch!==X||G.binding?.identity!==J)return;return G.providerState}function $0($){return Number.isSafeInteger($)&&$>=1}function U0($){if(!O($))return;let Z=$.credentialEpoch;if(!$0(Z))return;if(typeof $.digest!=="string")return;if("dispatch"in $&&typeof $.dispatch!=="string")return;if("replace"in $&&$.replace!==!0)return;if("providerState"in $&&typeof $.providerState!=="string")return;let X="staged"in $?QX($.staged):void 0;if("staged"in $&&!X)return;let J={...X?{staged:X}:{},...typeof $.dispatch==="string"?{dispatch:$.dispatch}:{},...$.replace===!0?{replace:!0}:{},...typeof $.providerState==="string"?{providerState:$.providerState}:{}};if(!("binding"in $))return"dispatch"in $||"replace"in $||"providerState"in $||"staged"in $?void 0:{credentialEpoch:Z,digest:$.digest};let G=$.binding;if(!O(G))return;if("identity"in G&&(typeof G.identity!=="string"||!G.identity))return;if("baseURL"in G&&!pZ(G.baseURL))return;if("authHeader"in G&&G.authHeader!=="authorization-bearer"&&G.authHeader!=="x-api-key")return;return{credentialEpoch:Z,digest:$.digest,...J,binding:{...typeof G.identity==="string"?{identity:G.identity}:{},...typeof G.baseURL==="string"?{baseURL:G.baseURL.trim()}:{},...G.authHeader==="authorization-bearer"||G.authHeader==="x-api-key"?{authHeader:G.authHeader}:{}}}}function HX($,Z,X){if($.identity!==X)return!1;if($.baseURL!==void 0&&(Z.type!=="api"||Z.baseURL!==$.baseURL))return!1;if($.authHeader!==void 0&&(Z.type!=="api"||Z.authHeader!==$.authHeader))return!1;return!0}function WX($,Z,X,J){if(!$)return"none";if(!O(J)||!Object.hasOwn(J,h))return"missing";let G=U0(J[h]);if(!G)return"malformed";if(G.digest!==x0($))return"mismatched";if(G.dispatch===void 0)return"legacy";if(G.credentialEpoch!==Z)return"mismatched";if(!G.binding||!HX(G.binding,$,X))return"mismatched";if(G.dispatch!==w0($))return"mismatched";return"bound"}function _9($){if(!$.exists)return{status:"ready",exists:!1,config:{}};if("parseError"in $)return{status:"error",reason:"config file is not valid JSON"};let Z=$.value;if(!O(Z))return{status:"error",reason:"config root is not an object"};if("accounts"in Z&&!Array.isArray(Z.accounts))return{status:"error",reason:"config accounts is not an array"};if(!(m in Z))return Array.isArray(Z.accounts)?{status:"pending-migration",config:Z}:{status:"ready",exists:!0,config:Z};let X=Z[m];if(!O(X))return{status:"error",reason:`${m} is not an object`};let J=X.schemaVersion;if(typeof J!=="number"||!Number.isInteger(J)||J<1)return{status:"error",reason:`${m}.schemaVersion is invalid`};if(J>o0)return{status:"error",reason:`${m}.schemaVersion ${J} is newer than ${o0}`};if(T0 in X&&!O(X[T0]))return{status:"error",reason:`${m}.${T0} is not an object`};return{status:"ready",exists:!0,config:Z}}function O9($){if(!$.exists)return{status:"ready",exists:!1,state:{}};if("parseError"in $)return{status:"error",reason:"state file is not valid JSON"};if(!O($.value))return{status:"error",reason:"state root is not an object"};if("accounts"in $.value&&!O($.value.accounts))return{status:"error",reason:"state accounts is not an object"};return{status:"ready",exists:!0,state:$.value}}function u1($){return Array.isArray($.accounts)?$.accounts:[]}function C9($){let Z=$[m];if(!O(Z))return{};let X=Z[T0];return O(X)?X:{}}function VX($){return O($.accounts)?$.accounts:{}}function UX($){if(!O($))return"not an object";let Z=w1($.id);if(Z)return Z;if($.type==="api")return pZ($.baseURL)?void 0:"invalid baseURL";if($.type==="oauth")return;return"unknown type"}function jX($,Z){if(!O($))return;let X=$.credentialEpoch;if(!$0(X))return;if("needsFirstReading"in $&&typeof $.needsFirstReading!=="boolean")return;if("disabledReason"in $&&typeof $.disabledReason!=="string")return;let J="quota"in $&&Z.decode?Z.decode($.quota):$.quota;if("quota"in $&&!Z.validate(J))return;if("staged"in $&&!F9($.staged))return;return{credentialEpoch:X,needsFirstReading:$.needsFirstReading===!0,...typeof $.disabledReason==="string"?{disabledReason:$.disabledReason}:{},..."quota"in $?{quota:J}:{}}}function DX($,Z){if(!O(Z))return;if($.type==="api"){let J=typeof Z.apiKey==="string"?Z.apiKey.trim():"";if(!J)return;return{type:"api",apiKey:J,baseURL:String($.baseURL).trim(),authHeader:$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer"}}if($.corrupt===!0)return;let X=Z.refresh;if(typeof X!=="string"||!X.trim())return;return{type:"oauth",refresh:X,...typeof Z.access==="string"?{access:Z.access}:{},...typeof Z.expires==="number"?{expires:Z.expires}:{},...typeof Z.lastRefreshedAt==="number"?{lastRefreshedAt:Z.lastRefreshedAt}:{}}}function V6($,Z){return u1($).find((X)=>O(X)&&X.id===Z)}function P9($){if(!O($[m]))$[m]={};return $[m]}function lZ($){let Z=P9($);if(!O(Z[T0]))Z[T0]={};return Z[T0]}function e0($,Z){let X=C9($),J=Object.hasOwn(X,Z)?X[Z]:void 0;return O(J)?J:void 0}function U6($,Z,X){Object.defineProperty(lZ($),Z,{value:X,enumerable:!0,writable:!0,configurable:!0})}function T9($,Z){let X=$[m];if(!O(X))return;let J=X[W6];if(!O(J)||!Object.hasOwn(J,Z))return;let G=J[Z];return $0(G)?G:void 0}function A9($,Z){let X=e0($,Z)?.credentialEpoch;return $0(X)?X:void 0}function j6($,Z){return Math.max(T9($,Z)??0,A9($,Z)??0)+1}function S9($,Z){let X=[...Z];if(X.length===0)return;let J=P9($),G=O(J[W6])?J[W6]:{},z={},B=(Q,Y)=>Object.defineProperty(z,Q,{value:Y,enumerable:!0,writable:!0,configurable:!0});for(let[Q,Y]of Object.entries(G))if($0(Y))B(Q,Y);for(let Q of X)B(Q,Math.max(T9($,Q)??0,A9($,Q)??1));J[W6]=z}function $1($,Z,X,J){let G=C9($),z=VX(Z),B=new Set,Q=[];for(let Y of u1($)){let H=UX(Y),W=O(Y)&&typeof Y.id==="string"?Y.id:void 0,U=W===void 0?void 0:G[W],j=O(U)&&Object.hasOwn(U,"staged"),K=j?F9(U.staged):void 0;if(H||!O(Y)||W===void 0||B.has(W)){if(W!==void 0&&!B.has(W))B.add(W);if(W!==void 0)Q.push({id:W,type:O(Y)&&Y.type==="api"?"api":"oauth",enabled:!1,needsFirstReading:!0,hasEntry:Object.hasOwn(G,W),candidate:!1,invalid:"roster",stamp:"none",...K?{staged:K}:{}});continue}B.add(W);let V=Y.type==="api"?"api":"oauth",N=Object.hasOwn(G,W),q=N?jX(G[W],X):void 0,M=DX(Y,z[W]),P=Y.enabled!==!1,E=q?q.credentialEpoch:N?void 0:1,F=typeof Y.accountId==="string"&&Y.accountId?Y.accountId:void 0,D={id:W,type:V,enabled:P,needsFirstReading:q?q.needsFirstReading:V==="oauth",hasEntry:N,candidate:!1,...typeof Y.label==="string"?{label:Y.label}:{},...typeof Y.addedAt==="number"?{addedAt:Y.addedAt}:{},...F!==void 0?{identity:F}:{},...M?{credential:M,fingerprint:t0(M)}:{},...q?{credentialEpoch:q.credentialEpoch}:{},...K?{staged:K}:{},...q?.disabledReason!==void 0?{disabledReason:q.disabledReason}:{},...q&&"quota"in q?{quota:q.quota}:{},...KX(z[W],M,E,F,J),stamp:WX(M,E,F,z[W])};if(N&&!q)D.invalid="entry";else D.candidate=P&&M!==void 0&&!j;Q.push(D)}return Q}function KX($,Z,X,J,G){if(!O($)||!Object.hasOwn($,Q0))return{};let z=K$($,Z,X,J);if(z===void 0)return{providerStateDropped:"uncovered"};let B=$[Q0];if(!G?.validate(B))return{providerStateDropped:"invalid"};if(p1(G,B)!==z)return{providerStateDropped:"uncovered"};return{providerState:B}}function p($){return $.identity??$.id}function q$($,Z){if($===void 0||$>Z+wZ)return Z;return Math.max(Z,$+1)}function dZ($,Z){return q$($,Z)>Z+wZ}function l1($){let{id:Z,credential:X,identity:J,label:G,addedAt:z}=$;return{id:Z,...G!==void 0?{label:G}:{},type:X.type,addedAt:z,...J!==void 0?{accountId:J}:{},...X.type==="api"?{baseURL:X.baseURL.trim(),authHeader:X.authHeader??"authorization-bearer"}:{}}}function R9($,Z){if($.type==="api")return{apiKey:$.apiKey};return{...$.access!==void 0?{access:$.access}:{},refresh:$.refresh,...$.expires!==void 0?{expires:$.expires}:{},...Z!==void 0?{lastRefreshedAt:Z}:{}}}function E9($,Z){if($.type==="api")return{...$,baseURL:$.baseURL.trim(),authHeader:$.authHeader??"authorization-bearer"};return{...$,...Z!==void 0?{lastRefreshedAt:Z}:{}}}function I9($,Z={}){if(!O($))return"credential must be an object";if($.type==="oauth"){if(typeof $.refresh!=="string"||!$.refresh.trim())return"oauth credential needs a refresh token";return}if($.type==="api"){if(typeof $.apiKey!=="string"||!$.apiKey.trim())return"api credential needs an api key";if($.apiKey.trim()!==$.apiKey)return"api key must not carry surrounding whitespace";if(!(Z.baseURLOptional&&$.baseURL===void 0)&&!pZ($.baseURL))return"api credential needs a valid baseURL";return}return"credential type must be oauth or api"}var D6="transition",b9="transitionMark";function qX($){if(!O($))return;let Z=$[D6];if(!O(Z))return;if(typeof Z.mark!=="string"||Z.mark.length===0)return;if(Z.enabled===!0)return{mark:Z.mark,enabled:!0};if(Z.enabled===!1&&typeof Z.reason==="string")return{mark:Z.mark,enabled:!1,reason:Z.reason};return}function N$($,Z,X){if(X.enabled)V$($,Z);else a0($,Z,X.reason??"");if(!$.rosterRow(Z))return;let J=$.entry(Z)??{credentialEpoch:1,needsFirstReading:!0};if($.setEntry(Z,{...J,[b9]:X.mark}),!X.enabled)return;let G=$.rows().find((z)=>z.id===Z);if(G?.type==="oauth"&&G.identity!==void 0)m1($,G.identity)}function NX($,Z){if($.type!=="api")return $;return{...$,...Z.baseURL!==void 0?{baseURL:Z.baseURL}:{},...Z.authHeader!==void 0?{authHeader:Z.authHeader}:{}}}function MX($){if(!$.binding)return!1;return $.replace===!0||$.dispatch===void 0}function FX($,Z,X,J={}){let G=O(Z.accounts)?Z.accounts:{},z=new Map;for(let B of $1($,Z,X)){if(B.invalid||B.staged||!B.credential)continue;let Q=Object.hasOwn(G,B.id)?G[B.id]:void 0;if(!O(Q))continue;let Y=U0(Q[h]);if(!Y?.binding)continue;if(Y.digest!==x0(B.credential))continue;let H=B.credentialEpoch??1;if(Y.credentialEpoch>H){if(!MX(Y))continue;if(J.requireCredentialStamps){if(Y.dispatch===void 0)continue;if(Y.dispatch!==w0(NX(B.credential,Y.binding)))continue}z.set(B.id,{kind:"replace",stamp:{...Y,binding:Y.binding}})}else if(Y.credentialEpoch===H&&Y.dispatch!==void 0&&Y.dispatch===w0(B.credential)&&Y.binding.identity!==void 0&&B.identity===void 0)z.set(B.id,{kind:"identity",identity:Y.binding.identity});else if(Y.credentialEpoch===H&&Y.binding.identity===B.identity){if(J.requireCredentialStamps&&Y.dispatch!==w0(B.credential))continue;let W=qX(Q[h]);if(W&&e0($,B.id)?.[b9]!==W.mark)z.set(B.id,{kind:"transition",transition:W})}}return z}function cZ($,Z,X,J){let z={...$.entry(Z)??{},credentialEpoch:X,needsFirstReading:!0};if(delete z.quota,J.identity!==void 0&&typeof z.disabledReason==="string"&&z.disabledReason.startsWith(v1))delete z.disabledReason;$.setEntry(Z,z);let B=$.rosterRow(Z);if(!B)return;if(J.identity!==void 0)B.accountId=J.identity;else delete B.accountId;if(J.baseURL!==void 0)B.baseURL=J.baseURL;if(J.authHeader!==void 0)B.authHeader=J.authHeader}function sZ($,Z,X,J={}){let G=FX($,Z,X,J);if(G.size===0)return{config:$,torn:[]};let z=structuredClone($),B={rows:()=>$1(z,Z,X),rosterRow:(Q)=>V6(z,Q),entry:(Q)=>e0(z,Q),setEntry:(Q,Y)=>U6(z,Q,Y)};for(let[Q,Y]of G)if(Y.kind==="replace")cZ(B,Q,Y.stamp.credentialEpoch,Y.stamp.binding);for(let[Q,Y]of G)if(Y.kind==="identity")N1(B,Q,Y.identity);else if(Y.kind==="transition")N$(B,Q,Y.transition);else if(Y.stamp.binding.identity!==void 0)m1(B,Y.stamp.binding.identity);return{config:z,torn:[...G.keys()]}}function iZ($,Z,X,J={}){let{config:G,torn:z}=sZ($,Z,X,J),B=$1(G,Z,X,J.providerState);for(let Q of B){if(z.includes(Q.id))Q.torn=!0,Q.candidate=!1;if(J.requireCredentialStamps&&Q.stamp!=="bound")Q.unbound=!0,Q.candidate=!1}return B}async function aZ($){try{return await F0($,R)}catch(Z){if(Z.code==="ENOENT")return;throw Z}}function x9($){if($===void 0)return{exists:!1};try{return{exists:!0,value:JSON.parse($)}}catch(Z){return{exists:!0,parseError:Z}}}async function Y0($){for(let Z=0;Z<3;Z++){let X=await aZ($.configPath),J=await aZ($.statePath),G=await aZ($.configPath);if(X!==G){if(Z<2)await LX(2+Math.floor(Math.random()*4));continue}let z=_9(x9(X));if(z.status==="error")return{status:"error",file:"config",reason:z.reason};let B=O9(x9(J));if(B.status==="error")return{status:"error",file:"state",reason:B.reason};if(z.status==="pending-migration")return{status:"pending-migration",config:z.config};return{status:"ready",configExists:z.exists,stateExists:B.exists,config:z.config,state:B.state,rows:iZ(z.config,B.state,$.codec,{requireCredentialStamps:$.requireCredentialStamps===!0,...$.providerState?{providerState:$.providerState}:{}})}}return{status:"error",file:"config",kind:"snapshot-contended",retryable:!0,reason:"The store was changing; retry the operation once writes settle."}}function A0($,Z,X,J="before-first-write"){if($.status==="error"&&$.kind==="snapshot-contended")return new x({operation:Z,...X!==void 0?{rowId:X}:{},phase:J,kind:"snapshot-contended",retryable:!0,message:$.reason});return new x({operation:Z,...X!==void 0?{rowId:X}:{},phase:J,retryable:!1,kind:$.status==="pending-migration"?"pending-migration":"load-error",message:$.status==="pending-migration"?"the config holds a legacy roster that has not been migrated into the pool":`${$.file} file cannot be loaded: ${$.reason}`})}class k9{ctx;snapshot;locks;progress;info;config;state;constructor($,Z,X,J,G){this.ctx=$,this.snapshot=Z,this.locks=X,this.progress=J,this.info=G,this.config=structuredClone(Z.config),this.state=structuredClone(Z.state)}rows(){return iZ(this.config,this.state,this.ctx.codec,{requireCredentialStamps:this.ctx.requireCredentialStamps===!0,...this.ctx.providerState?{providerState:this.ctx.providerState}:{}})}row($){return this.rows().find((Z)=>Z.id===$)}reservation($){if(this.rosterRow($)){let X=this.entry($);return X&&Object.hasOwn(X,"staged")?X.staged:void 0}let Z=this.stateAccount($)?.[h];return O(Z)&&Object.hasOwn(Z,"staged")?Z.staged:void 0}assertNotStaged($){F1(this.info.operation,$,this.reservation($))}roster(){if(!Array.isArray(this.config.accounts))this.config.accounts=[];return this.config.accounts}rosterRow($){return this.roster(),V6(this.config,$)}dropRosterRows($){let Z=this.roster(),X=Z.filter((J)=>!(O(J)&&J.id===$));return this.config.accounts=X,Z.length-X.length}entries(){return lZ(this.config)}entry($){return this.entries(),e0(this.config,$)}setEntry($,Z){U6(this.config,$,Z)}async completeTorn(){let{config:$,torn:Z}=sZ(this.config,this.state,this.ctx.codec,{requireCredentialStamps:this.ctx.requireCredentialStamps===!0});if(Z.length===0)return;this.config=$,await this.commitConfig({counted:!1})}stateAccount($){let Z=O(this.state.accounts)?this.state.accounts:{},X=Object.hasOwn(Z,$)?Z[$]:void 0;return O(X)?X:void 0}dropStateAccount($){if(O(this.state.accounts)&&Object.hasOwn(this.state.accounts,$))delete this.state.accounts[$]}setStateAccount($,Z){if(!O(this.state.accounts))this.state.accounts={};Object.defineProperty(this.state.accounts,$,{value:Z,enumerable:!0,writable:!0,configurable:!0})}async commitConfig($={}){let Z=this.roster(),X=new Set;for(let Y of Z)if(O(Y)&&typeof Y.id==="string")X.add(Y.id);let J=new Set;for(let Y of u1(this.snapshot.config))if(O(Y)&&typeof Y.id==="string"&&!X.has(Y.id))J.add(Y.id);for(let Y of Object.keys(this.entries()))if(!X.has(Y))J.add(Y);S9(this.config,J);let G=this.entries(),z={};for(let[Y,H]of Object.entries(G))if(X.has(Y))Object.defineProperty(z,Y,{value:H,enumerable:!0,writable:!0,configurable:!0});let B=this.config[m],Q={...this.config,version:D$,accounts:Z,[m]:{...B,schemaVersion:o0,[T0]:z}};await this.write(this.ctx.configPath,Q,"config",$.counted??!0,$.durable??!1,()=>{if($.publicationDecision)this.markPublicationDecision();for(let Y of J)this.ctx.removedIds.add(Y);this.config=Q}),this.config=Q}async commitState($,Z={}){let X={...this.state,version:D$,accounts:O(this.state.accounts)?this.state.accounts:{}};if(await this.write(this.ctx.statePath,X,"state",!0,Z.durable??!1),this.state=X,$)this.progress.committed=$}async assertAll(){await this.locks.assertAll()}async syncState(){await this.assertAll();try{if(this.snapshot.stateExists)await yZ(this.ctx.statePath)}catch($){throw new x({operation:this.info.operation,rowId:this.info.rowId,phase:"before-first-write",kind:"publication-sync",retryable:!0,message:"Publication sync failed before the decision; nothing was written. Retry the same plan.",cause:$})}}markPublicationDecision(){this.progress.publicationDecided=!0}async syncConfig(){await this.assertAll(),await yZ(this.ctx.configPath)}async write($,Z,X,J=!0,G=!1,z){await kZ($,Z,{durable:G,beforeRename:async()=>{await this.ctx.onStep?.(`before-${X}-write`,this.info),await this.locks.assertAll()}},()=>{if(J)this.progress.writes++;z?.()}),await this.ctx.onStep?.(`after-${X}-write`,this.info)}}async function y9($,Z){let X=new r0($.lockDefaults,$.lockEnv),J={writes:0};try{for(let Q of $.storeLocks)await X.acquire(Q);let G=await Y0($);if(G.status==="error")throw A0(G,"initialize",void 0);if(G.status==="ready")return"already-ready";let z={};for(let[Q,Y]of Object.entries(G.config))if(!Z.includes(Q))z[Q]=Y;z.version=D$,z[m]={schemaVersion:o0,[T0]:{}};let B={operation:"initialize",rowId:void 0};return await L0($.configPath,z,{beforeRename:async()=>{await $.onStep?.("before-config-write",B),await X.assertAll()}}),J.writes++,await $.onStep?.("after-config-write",B),"initialized"}catch(G){throw d1(G,"initialize",void 0,J)}finally{await X.releaseAll()}}async function a($,Z,X,J,G,z={}){let B=Z.held.length;try{for(let H of $.storeLocks)await Z.acquire(H);let Q=await Y0($);if(Q.status!=="ready")throw A0(Q,J.operation,J.rowId,X.writes>0?"after-first-write":"before-first-write");let Y=new k9($,Q,Z,X,J);if(J.rowId!==void 0&&!["add","remove","pull","publishRoster","enable","disable"].includes(J.operation))Y.assertNotStaged(J.rowId);if(z.completeTorn??!0)await Y.completeTorn();return await G(Y)}finally{await Z.releaseTo(B)}}function d1($,Z,X,J){let G=Z==="pull"?"pull":J.writes>0?"after-first-write":"before-first-write",z=G==="after-first-write"?J.committed:void 0;if(Z==="publishRoster"&&J.publicationDecided)return new x({operation:Z,...X!==void 0?{rowId:X}:{},phase:G,kind:"publication-incomplete",retryable:!0,message:"The publication may already be decided. Replay the same plan or check publication(operationId).",cause:$});if(Z==="publishRoster"&&$ instanceof U$)return new x({operation:Z,...X!==void 0?{rowId:X}:{},phase:G,kind:"publication-sync",retryable:!0,message:"Publication sync failed before the decision; nothing was written. Retry the same plan.",cause:$});if($ instanceof x){if($.phase===G&&$.rowId===X&&$.operation===Z&&$.committed===z)return $;return new x({operation:Z,...X!==void 0?{rowId:X}:{},phase:$.kind==="after-persist-hook"?$.phase:G,retryable:$.retryable,kind:$.kind,...$.committed??z?{committed:$.committed??z}:{},message:$.message,...$.cause!==void 0?{cause:$.cause}:{}})}let B={operation:Z,...X!==void 0?{rowId:X}:{},phase:G,...z?{committed:z}:{},cause:$};if($ instanceof n0)return new x({...B,retryable:!0,kind:"lock-ownership",message:G==="after-first-write"?`${Z} lost a lease after its first write; the intermediate stays on disk`:`${Z} lost a lease before writing; nothing was written`});if($ instanceof M1)return new x({...B,retryable:!0,kind:"lock-contention",message:$.message});return new x({...B,retryable:!1,kind:"unexpected",message:$ instanceof Error?$.message:String($)})}async function z0($,Z,X,J,G){let z=new r0($.lockDefaults,$.lockEnv),B={writes:0};try{return await G(z,B)}catch(Q){let Y=d1(Q,Z,X,B);if(Y.kind!=="after-persist-hook")await M9(Z,J,X,Y,$.logger);throw Y}finally{await z.releaseAll()}}function N0($,Z){return{...$.rowLockOptions,name:`row-${encodeURIComponent(p(Z))}`,path:$.ctx.statePath}}async function p0($,Z,X){let J=await Y0($.ctx);if(J.status!=="ready")throw A0(J,Z,X);let G=J.rows.find((H)=>H.id===X),z=e0(J.config,X),B=J.state.accounts,Q=O(B)&&Object.hasOwn(B,X)?B[X]:void 0,Y=O(Q)?Q[h]:void 0;if(G&&!["enable","disable"].includes(Z)&&z&&Object.hasOwn(z,"staged"))F1(Z,X,z.staged);if(!G&&O(Y)&&Object.hasOwn(Y,"staged"))F1(Z,X,Y.staged);if(!G)throw S0(Z,X);return{result:J,row:G}}function S0($,Z){return new x({operation:$,rowId:Z,phase:$==="pull"?"pull":"before-first-write",retryable:!1,kind:"unknown-row",message:`no row ${Z} in the pool`})}function H0($,Z){if(Z.unbound)throw _($,Z.id,"unbound-credential",`row ${Z.id}'s credential is not the one this store stamped for it (stamp ${Z.stamp}); replace it with fresh material`)}function _($,Z,X,J,G=!1){return new x({operation:$,rowId:Z,phase:$==="pull"?"pull":"before-first-write",retryable:G,kind:X,message:J})}async function K6($,Z,X,J){let{ctx:G}=$,z=new r0(G.lockDefaults,G.lockEnv),B={writes:0};try{if(!$0(X?.credentialEpoch))throw _("pull",Z,"invalid-input","the credential epoch the reading was issued for must be a positive safe integer");await a(G,z,B,{operation:"pull",rowId:Z},async(Q)=>{Q.assertNotStaged(Z);let Y=Q.row(Z);if(!Y)throw S0("pull",Z);if(Y.invalid)throw _("pull",Z,"invalid-row",`row ${Z} is invalid`);if(!Y.credential)throw _("pull",Z,"no-credential",`row ${Z} holds no credential`);H0("pull",Y);let H=Q.entry(Z);if(Y.torn||!H||H.credentialEpoch!==X.credentialEpoch||Y.identity!==X.identity)throw new x({operation:"pull",rowId:Z,phase:"pull",retryable:!0,kind:"attribution",message:`quota for ${Z} was issued for a credential the row no longer holds`});let W=G.codec.merge(H.quota,J);if(!G.codec.validate(W))throw _("pull",Z,"invalid-quota","the quota codec rejected the merged map");Q.setEntry(Z,{...H,quota:W,needsFirstReading:!1}),await Q.commitConfig()},{completeTorn:!1})}catch(Q){throw d1(Q,"pull",Z,B)}finally{await z.releaseAll()}}function u0($,Z,X,J,G="the provider state"){if(!$)throw _(Z,X,"invalid-input","the store was opened without a provider-state codec");let z;try{let B=JSON.stringify(J);z=B===void 0?void 0:JSON.parse(B)}catch{z=void 0}if(z===void 0)throw _(Z,X,"invalid-provider-state",`${G} cannot be stored as JSON`);if(!$.validate(z))throw _(Z,X,"invalid-provider-state",`the provider-state codec rejected ${G}`);return z}function M$($,Z,X,J,G){if(J===void 0||!$?.merge)return{kind:"set",value:G};return{kind:"set",value:u0($,Z,X,$.merge(structuredClone(J),structuredClone(G)),"the merged provider state")}}function f9($,Z,X,J,G){let z=$?.onReplace,B=z?z(Z.providerState===void 0?void 0:structuredClone(Z.providerState),{id:Z.id,credentialEpoch:X,...Z.identity!==void 0?{previousIdentity:Z.identity}:{},...J!==void 0?{identity:J}:{},...G!==void 0?{incoming:structuredClone(G)}:{}}):G;if(B===void 0)return{kind:"clear"};if(!z)return{kind:"set",value:B};return{kind:"set",value:u0($,"replace",Z.id,B,"the provider state onReplace returned")}}function g9($,Z,X,J,G){if(Z.kind==="set")return p1($,Z.value);if(Z.kind==="clear")return;return K$(X,J?.credential,G,J?.identity)}async function h9($,Z,X,J,G={}){G0("updateProviderState");let{ctx:z}=$,B="updateProviderState";return z0(z,B,Z,G.onFailure,async(Q,Y)=>{let H=z.providerState;if(!H)throw _(B,Z,"invalid-input","the store was opened without a provider-state codec");if(typeof J!=="function")throw _(B,Z,"invalid-input","a mutator is required");let W=O(X)?X.credentialEpoch:void 0;if(!$0(W))throw _(B,Z,"invalid-input","the credential epoch the provider state was read at is required");let{row:U}=await p0($,B,Z);await Q.acquire(N0($,U));for(let j of G.extraLocks??[])await Q.acquire(j);return a(z,Q,Y,{operation:B,rowId:Z},async(j)=>{let K=j.row(Z);if(!K)throw S0(B,Z);if(p(K)!==p(U))throw _(B,Z,"row-key-changed",`row ${Z}'s wire identity changed while its lock was being taken`,!0);if(K.invalid)throw _(B,Z,"invalid-row",`row ${Z} failed validation`);if(!K.credential)throw _(B,Z,"no-credential",`row ${Z} holds no credential`);if(H0(B,K),(K.credentialEpoch??1)!==W||K.identity!==X.identity)throw _(B,Z,"attribution",`the provider state for ${Z} was read for a credential or account the row no longer holds`,!0);let N=await nZ(j,H,B,K,J);if(N.kind!=="changed")return{id:Z,outcome:"unchanged",...N.kind==="unchanged"&&N.value!==void 0?{providerState:N.value}:{}};return j.setStateAccount(Z,N.account),await j.commitState(),N.value===void 0?{id:Z,outcome:"cleared"}:{id:Z,outcome:"updated",providerState:N.value}})})}var v9=Symbol.for("@cortexkit/common-auth/store/decline-transition");async function nZ($,Z,X,J,G,z=!1){let{id:B,credential:Q}=J;if(!Q)throw _(X,B,"no-credential",`row ${B} holds no credential`);let Y=J.credentialEpoch??1,H=$.stateAccount(B),W=H?.[h],U=U0(W);if(!O(W)||!U?.binding||U.digest!==x0(Q)||U.credentialEpoch!==Y||U.binding.identity!==J.identity)throw _(X,B,"unbound-credential",`row ${B}'s credential carries no stamp of this store to bind a provider state to (stamp ${J.stamp}); rotate or replace it first`);let j=J.providerState===void 0?void 0:structuredClone(J.providerState),K=await b0(X,()=>G(j,J));if(z&&K===v9)return{kind:"declined"};let V=K===void 0?void 0:u0(Z,X,B,K,"the provider state the mutator returned"),N=H!==void 0&&Object.hasOwn(H,Q0);if(V===void 0?!N:J.providerState!==void 0&&JSON.stringify(J.providerState)===JSON.stringify(V))return{kind:"unchanged",...V!==void 0?{value:V}:{}};let q={...H};if(V===void 0){delete q[Q0];let M={...W};delete M.providerState,q[h]=M}else{q[Q0]=V;let M=p1(Z,V);if(U.providerState!==M)q[h]={...W,providerState:M}}return{kind:"changed",...V!==void 0?{value:V}:{},account:q}}import{randomUUID as m9}from"node:crypto";async function F6($,Z,X){if(!X)return;let J=$.rows().map((z)=>{let{id:B,type:Q,label:Y,enabled:H,disabledReason:W,identity:U,credentialEpoch:j,stamp:K,staged:V,torn:N,invalid:q}=z;return{id:B,type:Q,label:Y,enabled:H,disabledReason:W,identity:U,credentialEpoch:j,stamp:K,staged:V,torn:N,invalid:q}}),G=await b0($.info.operation,()=>X({id:Z,row:J.find((z)=>z.id===Z),rows:J,config:structuredClone($.snapshot.config)}));if(G!==void 0)throw _($.info.operation,Z,"row-protected",G)}var _X=["access","refresh","expires","lastRefreshedAt","apiKey"];function OX($){return{baseURL:String($.baseURL).trim(),authHeader:$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer"}}function CX($,Z,X){if(X.type!=="api")return X;let J=$.rosterRow(Z);if(!O(J)){if(X.baseURL===void 0)throw _($.info.operation,Z,"invalid-input","api credential needs a valid baseURL");return{...X,baseURL:X.baseURL}}let G=$.row(Z)?.credential,z=G?.type==="api"?{baseURL:G.baseURL.trim(),authHeader:G.authHeader??"authorization-bearer"}:OX(J),B=X.baseURL?.trim()??z.baseURL,Q=X.authHeader??z.authHeader;if(B!==z.baseURL||Q!==z.authHeader)throw _($.info.operation,Z,"endpoint-mismatch",`row ${Z} sends its key to another endpoint or header; a key for another endpoint is a replacement`);return{...X,baseURL:B,authHeader:Q}}function w9($,Z,X,J){let G=$.rosterRow(Z),z=$.row(Z),B=J??(z?z.identity:O(G)&&typeof G.accountId==="string"&&G.accountId?G.accountId:void 0);return{...B!==void 0?{identity:B}:{},...X.type==="api"?{baseURL:X.baseURL,authHeader:X.authHeader??"authorization-bearer"}:{}}}function q6($,Z,X,J,G={}){let z=CX(Z,X,J),B=Z.stateAccount(X),Q=G.providerState??{kind:"keep"},Y=Z.row(X)?.credentialEpoch??Z.entry(X)?.credentialEpoch,H=typeof Y==="number"?Y:1,W=g9($.ctx.providerState,Q,B,B&&Object.hasOwn(B,Q0)?Z.row(X):void 0,H),U=typeof B?.lastRefreshedAt==="number"?B.lastRefreshedAt:void 0,j=z.type==="oauth"?G.stamp??q$(U,$.ctx.now()):void 0,K={...B??{}};for(let q of _X)delete K[q];if(G.clearErrors)delete K.lastRefreshError,delete K.lastQuotaRefreshError,delete K.quota;if(Q.kind==="clear")delete K[Q0];else if(Q.kind==="set")K[Q0]=Q.value;let V=E9(z,j),N={...K,...R9(z,j),[h]:{...G.staged?{staged:G.staged}:{},...G.transition!==void 0?{[D6]:G.transition}:{},...uZ(V,H,G.binding??w9(Z,X,V,G.identity),{replace:G.binding!==void 0,...W!==void 0?{providerState:W}:{}})}};return{stored:V,account:N}}async function N6($,Z,X){return $.setStateAccount(Z,X.account),await $.commitState(X.stored),X.stored}async function L6($,Z,X,J,G={}){return N6(Z,X,q6($,Z,X,J,G))}async function PX($,Z,X){if(!Z.credential||Z.stamp!=="bound")return;let J=$.stateAccount(Z.id),G=K$(J,Z.credential,Z.credentialEpoch??1,Z.identity);$.setStateAccount(Z.id,{...J??{},[h]:uZ(Z.credential,Z.credentialEpoch??1,w9($,Z.id,Z.credential,X),G!==void 0?{providerState:G}:{})}),await $.commitState()}function oZ($,Z,X){let J=$==="add"?w1(Z):void 0;if(J)throw _($,Z,"invalid-input",J);let G=I9(X,{baseURLOptional:$==="rotate"});if(G)throw _($,Z,"invalid-input",G)}function _6($,Z,X,J){if(!X)throw S0($,Z);if(X.invalid)throw _($,Z,"invalid-row",`row ${Z} failed validation`);if(J&&J.type!==X.type)throw _($,Z,"type-mismatch",`row ${Z} holds a ${X.type} credential`);return X}function s1($,Z,X){if(X!==void 0&&!$0(O(X)?X.credentialEpoch:void 0))throw _($,Z,"invalid-input","the attribution must name a credential epoch that is a positive safe integer")}function O6($,Z,X,J){if(!X)throw S0($,Z);if(X.invalid)throw _($,Z,"invalid-row",`row ${Z} failed validation`);if((X.credentialEpoch??1)!==J.credentialEpoch||X.identity!==J.identity)throw _($,Z,"attribution",`the ${$} of ${Z} was issued for a credential or account the row no longer holds`,!0)}function M6($,Z){return _($,Z,"identity-mismatch",`row ${Z} is recorded for another account; a credential of a different account is a replacement`)}function F$($,Z){return _($,Z,"row-key-changed",`row ${Z}'s wire identity changed while its lock was being taken`,!0)}function TX($,Z,X,J){let{id:G,credential:z,identity:B}=X;if(!$.ctx.requireCredentialStamps||Z.rosterRow(G)||!c1(Z.state,G))return;let Q=()=>{throw _("add",G,"unbound-credential",`orphan ${G} cannot be bound to this add's material; remove it explicitly before adding different material`)},Y=Z.stateAccount(G),H=U0(Y?.[h]);if(!H?.binding||H.dispatch===void 0||H.replace)return Q();if(z.type==="api"&&(H.binding.baseURL===void 0||H.binding.authHeader===void 0))return Q();let W=z.type==="api"?{...z,baseURL:H.binding.baseURL,authHeader:H.binding.authHeader}:z,[U]=$1({accounts:[l1({id:G,credential:W,identity:H.binding.identity,addedAt:0})],[m]:{rows:{[G]:{credentialEpoch:j6(Z.config,G)}}}},Z.state,$.ctx.codec,$.ctx.providerState);if(!U?.credential||U.invalid||U.stamp!=="bound")return Q();if(B!==void 0&&B!==U.identity)return Q();if(x0(z)!==H.digest)return Q();if(z.type==="api"){if(z.baseURL.trim()!==H.binding.baseURL)return Q();if((z.authHeader??"authorization-bearer")!==H.binding.authHeader)return Q()}else if(w0(z)!==H.dispatch)return Q();if(H.providerState!==void 0&&U.providerState===void 0)return Q();if(J!==void 0&&p1($.ctx.providerState,J)!==H.providerState)return Q();return U}function AX($,Z,X,J){let{id:G,credential:z,identity:B,label:Q}=X,Y=Z.rosterRow(G),H=()=>{throw _("add",G,Y?"id-exists":"unbound-credential",`row ${G} does not match this staged add`)},W=Z.stateAccount(G),U=U0(W?.[h]),j=U?.staged;if(!U?.binding||!j||U.replace||U.dispatch===void 0)return H();if(Y&&(Y.type!==z.type||Y.label!==Q||Y.accountId!==B))return H();if(j.reservation!==X.stage?.reservation||j.label!==Q||j.disabledReason!==X.disabled?.reason||U.binding.identity!==B)return H();let K=J===void 0?void 0:L1(J),V=W?.[Q0],N=V===void 0?void 0:L1(V);if(j.providerState!==K||j.providerState!==N)return H();if(x0(z)!==U.digest||w0(z)!==U.dispatch)return H();let q=Y?Z.config:{accounts:[{...l1({id:G,credential:z.type==="api"?{...z,baseURL:U.binding.baseURL??"",authHeader:U.binding.authHeader}:z,identity:U.binding.identity,label:j.label,addedAt:0}),enabled:!1}],[m]:{rows:{[G]:{credentialEpoch:U.credentialEpoch,disabledReason:j.disabledReason,staged:{reservation:j.reservation}}}}},M=$1(q,Z.state,$.ctx.codec,$.ctx.providerState).find((P)=>P.id===G);if(!M?.credential||M.invalid||M.stamp!=="bound"||M.type!==z.type||M.enabled||M.label!==j.label||M.identity!==U.binding.identity||M.disabledReason!==j.disabledReason||M.staged?.reservation!==j.reservation)return H();if(Y)return{id:G,outcome:"exists",credential:M.credential,credentialEpoch:U.credentialEpoch};if(j6(Z.config,G)!==U.credentialEpoch)return H();return Z.roster().push({...l1({id:G,credential:z,identity:B,label:Q,addedAt:$.ctx.now()}),enabled:!1}),Z.setEntry(G,{credentialEpoch:U.credentialEpoch,needsFirstReading:z.type==="oauth",disabledReason:j.disabledReason,staged:{reservation:j.reservation}}),Z.commitConfig().then(()=>({id:G,outcome:"completed",credential:M.credential,credentialEpoch:U.credentialEpoch}))}async function p9($,Z,X={}){G0("add");let{ctx:J}=$,{id:G,credential:z,identity:B,label:Q}=Z,Y=Z.stage!==void 0||Z.disabled!==void 0,H=await z0(J,"add",G,X.onFailure,async(W,U)=>{oZ("add",G,z);let j=X.onExisting??"rotate";if(Z.stage!==void 0&&j==="rotate")throw _("add",G,"invalid-input","a staged add needs onExisting: 'refuse' or 'stage-duplicate'");if(!["rotate","refuse","stage-duplicate"].includes(j)||Z.stage!==void 0&&(Q!==void 0&&typeof Q!=="string"||B!==void 0&&(typeof B!=="string"||!B))||Z.disabled!==void 0&&(!O(Z.disabled)||typeof Z.disabled.reason!=="string")||Z.stage!==void 0&&(!O(Z.stage)||typeof Z.stage.reservation!=="string"||!Z.stage.reservation||!Z.disabled)||j==="stage-duplicate"&&(!Z.disabled||!Z.stage))throw _("add",G,"invalid-input","staging requires a reservation and a disabled reason");let K=Z.providerState===void 0?void 0:u0(J.providerState,"add",G,Z.providerState);if(await W.acquire(N0($,{id:G,identity:B})),z.type==="oauth")await W.acquire(X.providerLock??$.providerLock);for(let V of X.extraLocks??[])await W.acquire(V);return a(J,W,U,{operation:"add",rowId:G},async(V)=>{await F6(V,G,X.protect);let N=O(V.state.accounts)?V.state.accounts:{},q=Object.entries(N).find(([f,k])=>{if(f===G||V.rosterRow(f)||!O(k))return!1;let y=k[h];if(!O(y)||!Object.hasOwn(y,"staged"))return!1;return z.type==="oauth"?k.refresh===z.refresh:typeof k.apiKey==="string"&&k.apiKey.trim()===z.apiKey.trim()});if(q)throw _("add",q[0],"row-staged",`orphan ${q[0]} reserves this secret until its staged add is replayed or removed`);if(J.removedIds.has(G))throw _("add",G,"id-removed",`id ${G} was removed from the roster in this process and is not reused`);if(Z.stage&&j!=="rotate"&&(V.rosterRow(G)||c1(V.state,G)))return AX($,V,Z,K);if(j==="rotate"){V.assertNotStaged(G);let f=V.rows().find((k)=>k.fingerprint===t0(z));if(f)V.assertNotStaged(f.id)}if(j==="refuse"){let f=V.rows().find((d)=>d.fingerprint===t0(z)||d.id===G&&d.credential),k=O(V.state.accounts)?V.state.accounts:{},y=Object.entries(k).find(([,d])=>{if(!O(d))return!1;if(z.type==="oauth")return d.refresh===z.refresh;return typeof d.apiKey==="string"&&d.apiKey.trim()===z.apiKey.trim()})?.[0],r=f?.id??y??G;if(f||y!==void 0||c1(V.state,G))throw _("add",r,"credential-exists",`row ${r} already holds this secret or id`)}if(j==="stage-duplicate"&&(V.rosterRow(G)||c1(V.state,G)))throw _("add",G,"id-exists",`row ${G} already exists`);let M=TX($,V,Z,K),P=V.rows(),E=t0(z),F=j==="rotate"&&!M&&P.find((f)=>f.invalid===void 0&&f.fingerprint===E);if(F){if(V.assertNotStaged(F.id),H0("add",F),B!==void 0&&F.identity!==void 0&&B!==F.identity)throw M6("add",F.id);let f=q6($,V,F.id,z,{...K!==void 0?{providerState:M$(J.providerState,"add",F.id,F.providerState,K)}:{}});await V.completeTorn(),V.assertNotStaged(F.id);let k=await N6(V,F.id,f);return{id:F.id,outcome:"rotated",credential:k,credentialEpoch:F.credentialEpoch??1}}let D=P.find((f)=>f.id===G);if(D){if(D.invalid)throw _("add",G,"invalid-row",`row ${G} is invalid`);if(D.credential)throw _("add",G,"id-exists",`row ${G} already holds a credential`);if(H0("add",D),D.type!==z.type)throw _("add",G,"type-mismatch",`row ${G} is a ${D.type} row`);if(B!==void 0&&D.identity!==void 0&&B!==D.identity)throw M6("add",G);if(!D.hasEntry)V.setEntry(G,{credentialEpoch:1,needsFirstReading:z.type==="oauth"});let f=q6($,V,G,z,{clearErrors:!0,...K!==void 0?{providerState:{kind:"set",value:K}}:{}});await V.completeTorn();let k=await N6(V,G,f);if(!D.hasEntry)await V.commitConfig();return{id:G,outcome:"completed",credential:k,credentialEpoch:D.credentialEpoch??1}}let L=j6(V.config,G);if(!$0(L))throw _("add",G,"id-removed",`id ${G} has held every credential epoch and is not reused; add the credential under another id`);let A=M?.identity??B;V.roster().push(l1({id:G,credential:z,...A!==void 0?{identity:A}:{},...Q!==void 0?{label:Q}:{},addedAt:J.now()})),V.setEntry(G,{credentialEpoch:L,needsFirstReading:z.type==="oauth",...Z.stage?{staged:{reservation:Z.stage.reservation}}:{}});let v="added";if(Z.disabled)a0(V,G,Z.disabled.reason),v="added-disabled";if(!Z.disabled&&A!==void 0&&z.type==="oauth"){if(P.find((k)=>k.invalid===void 0&&k.type==="oauth"&&k.enabled&&k.identity===A))a0(V,G,bZ),v="added-disabled"}if(M?.credential)return await V.commitConfig(),{id:G,outcome:v,credential:M.credential,credentialEpoch:M.credentialEpoch??L};V.dropStateAccount(G);let u=q6($,V,G,z,{...Z.stage&&Z.disabled?{staged:{reservation:Z.stage.reservation,disabledReason:Z.disabled.reason,...Q!==void 0?{label:Q}:{},...K!==void 0?{providerState:L1(K)}:{}}}:{},...K!==void 0?{providerState:{kind:"set",value:K}}:{}});if(j==="rotate")await V.completeTorn();let n=await N6(V,G,u);return await V.commitConfig(),{id:G,outcome:v,credential:n,credentialEpoch:L}},{completeTorn:!1})});if(!Y&&z.type==="oauth"&&(H.outcome==="added"||H.outcome==="completed"))$.firePull(H.id,"add");return H}async function u9($,Z,X,J={},G={}){G0("replace");let{ctx:z}=$,B=await z0(z,"replace",Z,G.onFailure,async(Q,Y)=>{oZ("replace",Z,X),s1("replace",Z,G.attribution);let H=J.providerState===void 0?void 0:u0(z.providerState,"replace",Z,J.providerState),{row:W}=await p0($,"replace",Z);if(await Q.acquire(N0($,W)),X.type==="oauth")await Q.acquire(G.providerLock??$.providerLock);for(let U of G.extraLocks??[])await Q.acquire(U);return a(z,Q,Y,{operation:"replace",rowId:Z},async(U)=>{if(G.attribution!==void 0)O6("replace",Z,U.row(Z),G.attribution),await U.completeTorn();let j=_6("replace",Z,U.row(Z),X);if(p(j)!==p(W))throw F$("replace",Z);let K=U.entry(Z)?.credentialEpoch,V=(typeof K==="number"?K:1)+1;if(!$0(V))throw _("replace",Z,"invalid-row",`row ${Z}'s credential epoch cannot advance past ${Number.MAX_SAFE_INTEGER}; remove the row and add the new credential as a new row`);let N=f9(z.providerState,j,V,J.identity,H),q={...J.identity!==void 0?{identity:J.identity}:{},...X.type==="api"?{baseURL:X.baseURL.trim(),authHeader:X.authHeader??"authorization-bearer"}:{}};if(cZ(U,Z,V,q),J.identity!==void 0)m1(U,J.identity);let M=await L6($,U,Z,X,{clearErrors:!0,binding:q,providerState:N});return await U.commitConfig(),{id:Z,credential:M,credentialEpoch:V}},{completeTorn:G.attribution===void 0})});if(X.type==="oauth")$.firePull(Z,"replace");return B}async function l9($,Z,X,J={},G={}){G0("rotate");let{ctx:z}=$;return z0(z,"rotate",Z,G.onFailure,async(B,Q)=>{oZ("rotate",Z,X),s1("rotate",Z,G.attribution);let Y=J.providerState===void 0?void 0:u0(z.providerState,"rotate",Z,J.providerState),{row:H}=await p0($,"rotate",Z);if(await B.acquire(N0($,H)),J.identity!==void 0&&X.type==="oauth")await B.acquire(G.providerLock??$.providerLock);for(let W of G.extraLocks??[])await B.acquire(W);return a(z,B,Q,{operation:"rotate",rowId:Z},async(W)=>{if(G.attribution!==void 0)O6("rotate",Z,W.row(Z),G.attribution),await W.completeTorn();let U=_6("rotate",Z,W.row(Z),X);if(p(U)!==p(H))throw F$("rotate",Z);if(H0("rotate",U),J.identity!==void 0&&U.identity!==void 0&&J.identity!==U.identity)throw M6("rotate",Z);let j=J.identity!==void 0&&U.identity===void 0?J.identity:void 0,K=await L6($,W,Z,X,{identity:j,...Y!==void 0?{providerState:M$(z.providerState,"rotate",Z,U.providerState,Y)}:{}}),V=!1;if(!U.hasEntry)W.setEntry(Z,{credentialEpoch:1,needsFirstReading:U.type==="oauth"}),V=!0;if(J.identity!==void 0&&U.identity!==J.identity)N1(W,Z,J.identity),V=!0;if(V)await W.commitConfig();return{id:Z,credential:K}},{completeTorn:G.attribution===void 0})})}async function d9($,Z,X,J,G){G0(Z);let{ctx:z}=$,B=z.providerState,Q=G.attribution,Y=G.providerState;return z0(z,Z,X,G.onFailure,async(H,W)=>{if(s1(Z,X,Q),Y!==void 0){if(typeof Y!=="function")throw _(Z,X,"invalid-input","the provider-state mutator must be a function");if(Q===void 0)throw _(Z,X,"invalid-input","a provider-state change needs the attribution of the credential it is for");if(!B)throw _(Z,X,"invalid-input","the store was opened without a provider-state codec")}let{row:U}=await p0($,Z,X);await H.acquire(N0($,U));for(let j of G.extraLocks??[])await H.acquire(j);return a(z,H,W,{operation:Z,rowId:X},async(j)=>{await F6(j,X,G.protect),j.assertNotStaged(X);let K=j.row(X),V=J.enabled?_6("enable",X,K):K;if(!V||!j.rosterRow(X))throw S0(Z,X);if(p(V)!==p(U))throw F$(Z,X);if(Q!==void 0)O6(Z,X,V,Q);if(J.enabled&&V.disabledReason?.startsWith(v1))throw _("enable",X,"identity-contradicted",`row ${X} needs an identity-validated credential replacement before it can be enabled`);let N=!J.enabled||!V.enabled||V.disabledReason!==void 0;if(J.enabled&&N&&V.type==="oauth"){let F=V.identity===void 0?void 0:j.rows().find((D)=>D.id!==X&&D.invalid===void 0&&D.type==="oauth"&&D.enabled&&D.identity===V.identity);if(F)throw _("enable",X,"duplicate-identity",`row ${F.id} is enabled with the same identity as row ${X}`)}if(Y===void 0||B===void 0){if(await j.completeTorn(),!N)return{id:X};if(J.enabled)V$(j,X);else a0(j,X,J.reason);return await j.commitConfig(),{id:X}}if(!V.credential)throw _(Z,X,"no-credential",`row ${X} holds no credential`);H0(Z,V);let q=await nZ(j,B,Z,V,Y,!0);if(q.kind==="declined")return{id:X,declined:!0};await j.completeTorn();let M={id:X,providerStateOutcome:q.kind==="unchanged"?"unchanged":q.value===void 0?"cleared":"updated",...q.value!==void 0?{providerState:q.value}:{}};if(q.kind==="unchanged"){if(N){if(J.enabled)V$(j,X);else a0(j,X,J.reason);await j.commitConfig()}return M}if(!N)return j.setStateAccount(X,q.account),await j.commitState(),M;let P=J.enabled?{mark:m9(),enabled:!0}:{mark:m9(),enabled:!1,reason:J.reason},E=q.account[h];return j.setStateAccount(X,{...q.account,[h]:{...E,[D6]:P}}),await j.commitState(),N$(j,X,P),await j.commitConfig(),M},{completeTorn:!1})})}function c9($,Z,X,J={}){return d9($,"disable",Z,{enabled:!1,reason:X},J)}function s9($,Z,X={}){return d9($,"enable",Z,{enabled:!0},X)}async function i9($,Z,X={}){G0("remove");let{ctx:J}=$;return z0(J,"remove",Z,X.onFailure,async(G,z)=>{if(typeof Z!=="string"||Z.length===0)throw _("remove",Z,"invalid-input","id must be non-empty");let B=X.attribution;if(s1("remove",Z,B),X.staged!==void 0&&(!O(X.staged)||typeof X.staged.reservation!=="string"||!X.staged.reservation))throw _("remove",Z,"invalid-input","a staged removal needs a reservation");let Q=await Y0(J);if(Q.status!=="ready")throw A0(Q,"remove",Z);let Y=Q.rows.find((W)=>W.id===Z);if(!Y&&!c1(Q.state,Z))throw S0("remove",Z);let H=p(Y??{id:Z});await G.acquire(N0($,Y??{id:Z}));for(let W of X.extraLocks??[])await G.acquire(W);return a(J,G,z,{operation:"remove",rowId:Z},async(W)=>{let U=W.reservation(Z);if(U!==void 0){if(!O(U)||!X.staged||U.reservation!==X.staged.reservation)throw _("remove",Z,"row-staged",`row ${Z} is reserved for roster publication`)}else if(X.staged)throw _("remove",Z,"attribution",`row ${Z} is no longer reserved`);let j=W.row(Z),K=c1(W.state,Z);if(!j&&!K)throw S0("remove",Z);if(p(j??{id:Z})!==H)throw F$("remove",Z);if(B!==void 0)if(j)C6(Z,j,B);else SX($,W,Z,B);let V=X.protect;if(V){let N={row:j,config:W.snapshot.config,state:W.snapshot.state},q=await b0("remove",()=>V(Z,N));if(q!==void 0)throw _("remove",Z,"row-protected",q)}if(j){if(B===void 0)await W.completeTorn();W.dropRosterRows(Z),await W.commitConfig()}if(K)W.dropStateAccount(Z),await W.commitState();return{id:Z,outcome:j?"removed":"completed"}},{completeTorn:!1})})}function C6($,Z,X,J="remove"){if(O6(J,$,Z,X),Z.torn)throw _(J,$,"attribution",`row ${$} is between the writes of another operation; retry once it completes`,!0);if(Z.stamp!=="bound")throw _(J,$,"unbound-credential",`row ${$}'s credential is not bound to its stamp, so the removal cannot be attributed to it`)}function SX($,Z,X,J){let G=()=>_("remove",X,"unbound-credential",`orphan ${X} has no credential stamp this store can bind, so the removal cannot be attributed to it`),z=Z.stateAccount(X),B=U0(z?.[h]);if(!z||!B?.binding||B.dispatch===void 0||B.replace)throw G();let Q;if(typeof z.apiKey==="string"){if(B.binding.baseURL===void 0||B.binding.authHeader===void 0)throw G();Q={type:"api",apiKey:z.apiKey,baseURL:B.binding.baseURL,authHeader:B.binding.authHeader}}else if(typeof z.refresh==="string")Q={type:"oauth",refresh:z.refresh};else throw G();let[Y]=$1({accounts:[l1({id:X,credential:Q,identity:B.binding.identity,addedAt:0})],[m]:{rows:{[X]:{credentialEpoch:B.credentialEpoch}}}},Z.state,$.ctx.codec,$.ctx.providerState);if(!Y?.credential||Y.invalid||Y.stamp!=="bound")throw G();if(B.credentialEpoch!==J.credentialEpoch||B.binding.identity!==J.identity)throw _("remove",X,"attribution",`orphan ${X} was written for a credential or account other than the one this removal was decided for`,!0)}function c1($,Z){let X=$.accounts;return O(X)&&Object.hasOwn(X,Z)}function rZ($){return O($)&&typeof $.id==="string"?$.id:void 0}function RX($,Z){if(!Array.isArray(Z))return"ids must be an array of roster ids";let X=new Set;for(let z of $){let B=rZ(z);if(B!==void 0)X.add(B)}let J=new Set;for(let z of Z){if(typeof z!=="string")return"ids must be an array of roster ids";if(J.has(z))return`id ${z} appears more than once`;if(!X.has(z))return`id ${z} is not in the roster`;J.add(z)}let G=[...X].filter((z)=>!J.has(z));if(G.length>0)return`the order leaves out roster id(s) ${G.join(", ")}`;return}function EX($,Z){let X=new Map;for(let z of $){let B=rZ(z);if(B===void 0)continue;let Q=X.get(B);if(Q)Q.push(z);else X.set(B,[z])}let J=Z.flatMap((z)=>X.get(z)??[]),G=0;return $.map((z)=>rZ(z)===void 0?z:J[G++])}async function a9($,Z,X={}){G0("reorder");let{ctx:J}=$,G=X.onFailure;return z0(J,"reorder",void 0,G&&((z,B)=>G(B)),async(z,B)=>{for(let Q of X.extraLocks??[])await z.acquire(Q);return a(J,z,B,{operation:"reorder",rowId:void 0},async(Q)=>{let Y=Q.roster(),H=RX(Y,Z);if(H)throw new x({operation:"reorder",phase:"before-first-write",retryable:!1,kind:"invalid-order",message:H});let W=[...Z],U=EX(Y,W);if(U.every((j,K)=>j===Y[K]))return{ids:W,outcome:"unchanged"};return Q.config.accounts=U,await Q.commitConfig(),{ids:W,outcome:"reordered"}},{completeTorn:!1})})}async function n9($,Z,X,J,G={}){return G0("recordIdentity"),z0($.ctx,"recordIdentity",Z,G.onFailure,async(z,B)=>{if(typeof X!=="string"||X.length===0)throw _("recordIdentity",Z,"invalid-input","identity must be non-empty");let Q=O(J)?J.credentialEpoch:void 0;if(!$0(Q))throw _("recordIdentity",Z,"invalid-input","the credential epoch the identity lookup was issued for is required");let{row:Y}=await p0($,"recordIdentity",Z);await z.acquire(N0($,Y)),await z.acquire(G.providerLock??$.providerLock);for(let H of G.extraLocks??[])await z.acquire(H);return a($.ctx,z,B,{operation:"recordIdentity",rowId:Z},async(H)=>{let W=_6("recordIdentity",Z,H.row(Z));if(p(W)!==p(Y))throw F$("recordIdentity",Z);if(H0("recordIdentity",W),(W.credentialEpoch??1)!==Q)throw _("recordIdentity",Z,"attribution",`the identity for ${Z} was looked up for a credential the row no longer holds`,!0);if(W.identity!==void 0&&W.identity!==X)throw M6("recordIdentity",Z);if(W.identity===void 0)await PX(H,W,X);let U=N1(H,Z,X);return await H.commitConfig(),{id:Z,disabled:U}})})}function o9($){let Z=$[m];return O(Z)&&O(Z.publications)?Z.publications:{}}function t9($,Z){let X=o9($);if(!Object.hasOwn(X,Z))return;let J=X[Z];if(!O(J)||J.operationId!==Z||typeof J.planDigest!=="string"||!/^[a-f0-9]{64}$/.test(J.planDigest)||!["committed","cleaned"].includes(String(J.phase))||!Array.isArray(J.removed)||!Array.isArray(J.finalized)||J.removed.some((G)=>!O(G)||typeof G.id!=="string"||!$0(G.credentialEpoch))||J.finalized.some((G)=>!O(G)||typeof G.id!=="string"||!$0(G.credentialEpoch)||typeof G.reservation!=="string"||!G.reservation||typeof G.enabled!=="boolean"))throw _("publishRoster",Z,"invalid-input","the stored publication receipt is malformed");return structuredClone(J)}async function e9($,Z){let X=await Y0($.ctx);if(X.status!=="ready")throw A0(X,"publishRoster",Z);return t9(X.config,Z)}function IX($,Z){let X=()=>{throw _("publishRoster",Z?.operationId??"","invalid-input","the publication plan is invalid")};if(!O(Z)||typeof Z.operationId!=="string"||!Z.operationId||!Array.isArray(Z.remove)||!Array.isArray(Z.finalize)||!Array.isArray(Z.order))X();let J=new Set;for(let G of[...Z.remove,...Z.finalize]){if(!O(G)||typeof G.id!=="string"||w1(G.id)||J.has(G.id)||!G.attribution)X();if(J.add(G.id),s1("publishRoster",G.id,G.attribution),G.attribution.identity!==void 0&&(typeof G.attribution.identity!=="string"||!G.attribution.identity))X()}for(let G of Z.remove)if($.ctx.requireRemovedFingerprint&&!G.fingerprint||G.fingerprint!==void 0&&typeof G.fingerprint!=="string")X();for(let G of Z.finalize)if(typeof G.reservation!=="string"||!G.reservation||typeof G.enabled!=="boolean"||(G.enabled?G.disabledReason!==void 0:typeof G.disabledReason!=="string"))X();if(Z.order.some((G)=>typeof G!=="string"||w1(G))||new Set(Z.order).size!==Z.order.length)X()}function $4($,Z){$.entries();let X=$.config[m],J={...o9($.config)};Object.defineProperty(J,Z.operationId,{value:Z,enumerable:!0,writable:!0,configurable:!0}),X.publications=J,delete X.publicationOrder}function bX($,Z,X){let J=new Set;for(let B of u1($.config)){if(!O(B)||typeof B.id!=="string")continue;if(J.has(B.id))throw _("publishRoster",Z.operationId,"invalid-input","publication needs a roster of unique named rows");J.add(B.id)}let G=new Set(Z.remove.map((B)=>B.id)),z=X.filter((B)=>B.invalid!=="roster"&&!G.has(B.id));if(z.length!==Z.order.length||Z.order.some((B)=>!z.some((Q)=>Q.id===B))||z.some((B)=>!Z.order.includes(B.id)))throw _("publishRoster",Z.operationId,"invalid-input","order must name exactly the surviving roster");return z}async function r9($,Z){await $.assertAll();for(let J of Z.removed)if(U0($.stateAccount(J.id)?.[h])?.credentialEpoch===J.credentialEpoch&&!$.rosterRow(J.id))$.dropStateAccount(J.id);for(let J of Z.finalized){let G=$.stateAccount(J.id),z=U0(G?.[h]);if(G&&z?.credentialEpoch===J.credentialEpoch&&z.staged?.reservation===J.reservation){let B={...G[h]};delete B.staged,$.setStateAccount(J.id,{...G,[h]:B})}}await $.commitState(void 0,{durable:!0});let X={...Z,phase:"cleaned"};return $4($,X),await $.commitConfig({durable:!0}),X}async function Z4($,Z,X={}){return G0("publishRoster"),z0($.ctx,"publishRoster",Z?.operationId??"",X.onFailure,async(J,G)=>{if(!O(Z)||typeof Z.operationId!=="string"||!Z.operationId)throw _("publishRoster",Z?.operationId??"","invalid-input","the publication needs an operation id");Z=structuredClone(Z);let z=L1(Z),B=[...Array.isArray(Z.remove)?Z.remove:[],...Array.isArray(Z.finalize)?Z.finalize:[]].filter((Q)=>O(Q)&&typeof Q.id==="string");for(let Q=0;;Q++){let Y=await Y0($.ctx);if(Y.status!=="ready")throw A0(Y,"publishRoster",Z.operationId);let H=new Map(B.map(({id:U})=>[U,p(Y.rows.find((j)=>j.id===U)??{id:U})]));for(let U of[...new Set(H.values())].sort())await J.acquire(N0($,{id:U}));await J.acquire(X.providerLock??$.providerLock);for(let U of X.extraLocks??[])await J.acquire(U);let W=await a($.ctx,J,G,{operation:"publishRoster",rowId:Z.operationId},async(U)=>{let j=U.rows();if(B.some(({id:D})=>p(j.find((L)=>L.id===D)??{id:D})!==H.get(D)))return;let K=t9(U.config,Z.operationId);if(K){if(K.planDigest!==z)throw _("publishRoster",Z.operationId,"publication-mismatch","the operation id belongs to a different publication plan");if(K.phase==="cleaned")return{outcome:"already-cleaned",receipt:K};return U.markPublicationDecision(),await U.syncConfig(),{outcome:"cleaned",receipt:await r9(U,K)}}IX($,Z);let V=bX(U,Z,j),N=[];for(let D of Z.remove){U.assertNotStaged(D.id);let L=j.find((A)=>A.id===D.id);if(!L)throw _("publishRoster",D.id,"attribution","the removed row no longer exists");if(C6(D.id,L,D.attribution,"publishRoster"),!L.credential||D.fingerprint!==void 0&&t0(L.credential)!==D.fingerprint)throw _("publishRoster",D.id,"attribution","the removed secret no longer matches");N.push(L)}let q=[];for(let D of Z.finalize){let L=j.find((k)=>k.id===D.id),A=U0(U.stateAccount(D.id)?.[h]);if(!L||L.staged?.reservation!==D.reservation||A?.staged?.reservation!==D.reservation||L.enabled)throw _("publishRoster",D.id,"row-staged","the finalized row is not disabled under this reservation");let v=U.stateAccount(D.id),u=U.rosterRow(D.id),n=v?.[Q0],f=n===void 0?void 0:L1(n);if(!A?.staged||A.staged.label!==u?.label||A.staged.disabledReason!==L.disabledReason||A.staged.providerState!==f)throw _("publishRoster",D.id,"row-staged","the staged label, disabled reason or full provider state no longer matches its stamp");C6(D.id,L,D.attribution,"publishRoster"),q.push(L)}let M=V.find((D)=>D.torn);if(M)throw _("publishRoster",Z.operationId,"attribution",`Row ${M.id} has an interrupted write; complete it with a normal store operation before publishing.`,!1);let P=new Set;for(let D of V){if(!(Z.finalize.find((A)=>A.id===D.id)?.enabled??D.enabled)||D.type!=="oauth"||D.identity===void 0)continue;if(P.has(D.identity))throw _("publishRoster",D.id,"invalid-input","the final enabled roster repeats a known identity");P.add(D.identity)}for(let D of V)if(D.identity!==void 0&&D.fingerprint!==void 0&&V.some((L)=>L.id!==D.id&&L.identity!==void 0&&L.identity!==D.identity&&L.fingerprint===D.fingerprint))throw _("publishRoster",D.id,"attribution","the resulting pool gives the same secret different known identities");for(let D of q)if(D.identity!==void 0&&N.some((L)=>L.identity!==void 0&&L.identity!==D.identity&&L.fingerprint===D.fingerprint))throw _("publishRoster",D.id,"attribution","the staged secret belonged to a different known identity");await F6(U,Z.operationId,X.protect);let E={operationId:Z.operationId,planDigest:z,phase:"committed",removed:N.map((D)=>({id:D.id,credentialEpoch:D.credentialEpoch??1})),finalized:Z.finalize.map((D,L)=>({id:D.id,credentialEpoch:q[L]?.credentialEpoch??1,reservation:D.reservation,enabled:D.enabled}))};for(let D of Z.remove)U.dropRosterRows(D.id);for(let D of Z.finalize){let L=U.rosterRow(D.id);L.enabled=D.enabled;let A={...U.entry(D.id)};if(delete A.staged,D.enabled)delete A.disabledReason;else A.disabledReason=D.disabledReason;U.setEntry(D.id,A)}let F=U.roster().filter((D)=>!O(D)||typeof D.id!=="string"||j.find((L)=>L.id===D.id)?.invalid==="roster");return U.config.accounts=[...Z.order.map((D)=>U.rosterRow(D)),...F],$4(U,E),await U.syncState(),await U.commitConfig({durable:!0,publicationDecision:!0}),{outcome:"published",receipt:await r9(U,E)}},{completeTorn:!1});if(W)return W;if(await J.releaseAll(),Q>=1)throw _("publishRoster",Z.operationId,"row-key-changed","a named row changed lock key twice during publication",!0)}})}class tZ{rt;hook;onFailure;firedAtLoad;logger;inflight=new Set;constructor($,Z,X,J,G){this.rt=$,this.hook=Z,this.onFailure=X,this.firedAtLoad=J,this.logger=G}fire($,Z){if(!this.hook)return;if(Z==="load"){if(this.firedAtLoad.has($))return;this.firedAtLoad.add($)}let X=this.run($,Z);this.inflight.add(X),X.finally(()=>this.inflight.delete(X))}async settled(){while(this.inflight.size>0)await Promise.allSettled([...this.inflight])}async run($,Z){let X=this.rt(),{ctx:J}=X,G=new r0(J.lockDefaults,J.lockEnv),z={writes:0};try{let B=await a(J,G,z,{operation:"pull",rowId:$},async(Y)=>{if(Y.reservation($)!==void 0)return;await Y.completeTorn();let H=Y.row($);if(H?.unbound&&H.enabled&&H.type==="oauth"&&H.credential&&!H.invalid)H0("pull",H);if(!H?.candidate||H.type!=="oauth")return;if(!H.hasEntry)Y.setEntry($,{credentialEpoch:1,needsFirstReading:!0}),await Y.commitConfig();let W=Y.row($);if(!W?.credential||W.credentialEpoch===void 0)return;return{id:$,credential:W.credential,credentialEpoch:W.credentialEpoch,...W.identity!==void 0?{identity:W.identity}:{},reason:Z}},{completeTorn:!1});if(await G.releaseAll(),!B){this.firedAtLoad.delete($);return}await J.hold?.("pull-before-request",$);let Q;try{Q=await this.hook?.(B)}catch(Y){throw new x({operation:"pull",rowId:$,phase:"pull",retryable:!0,kind:"pull",message:"the quota pull rejected",cause:Y})}await K6(X,$,{credentialEpoch:B.credentialEpoch,...B.identity!==void 0?{identity:B.identity}:{}},Q)}catch(B){this.firedAtLoad.delete($);let Q=d1(B,"pull",$,z);if(this.onFailure)try{await this.onFailure($,Q)}catch(Y){this.logger?.warn("pull failure hook threw",{rowId:$,error:Y instanceof Error?Y.message:String(Y)})}else this.logger?.warn("quota pull failed",{rowId:$,kind:Q.kind})}finally{await G.releaseAll()}}}import{randomUUID as xX}from"node:crypto";function eZ($,Z){if(F1("refresh",$,Z?.staged),!Z)throw _("refresh",$,"unknown-row",`no row ${$} in the pool`);if(Z.invalid)throw _("refresh",$,"invalid-row",`row ${$} is invalid`);if(Z.type!=="oauth"||Z.credential?.type!=="oauth")throw _("refresh",$,"no-credential",`row ${$} holds no OAuth credential`);if(!Z.enabled)throw _("refresh",$,"row-disabled",`row ${$} is disabled`);return Z}function X4($){return _("refresh",$,"refresh-stamp-ahead",`row ${$}'s stored refresh stamp is ahead of the clock; a rotation now could not be stamped newer within the trust bound`,!0)}async function J4($,Z,X,J={}){G0("refresh");let{ctx:G}=$;return z0(G,"refresh",Z,J.onFailure,async(z,B)=>{let{row:Q}=await p0($,"refresh",Z);eZ(Z,Q);let Y=await J.refuse?.(Q);if(Y!==void 0)return{status:"refused",rowId:Z,reason:Y};let H=p(Q),W;for(let V=0;;V++){await z.acquire(N0($,{id:Z,identity:H===Z?void 0:H})),await z.acquire(J.providerLock??$.providerLock);for(let M of J.extraLocks??[])await z.acquire(M);let q=await a(G,z,{writes:0},{operation:"refresh",rowId:Z},async(M)=>{let P=eZ(Z,M.row(Z));if(H0("refresh",P),!P.hasEntry)M.setEntry(Z,{credentialEpoch:1,needsFirstReading:!0}),await M.commitConfig(),P=eZ(Z,M.row(Z));if(p(P)!==H)return{keyNow:p(P)};let E=await J.refuse?.(P);if(E!==void 0)return{refused:E};return{row:P,credential:P.credential,credentialEpoch:P.credentialEpoch,identity:P.identity}});if("refused"in q)return{status:"refused",rowId:Z,reason:q.refused};if("keyNow"in q){if(await z.releaseAll(),V>=1)throw _("refresh",Z,"row-key-changed",`row ${Z}'s wire identity changed twice while its lock was held`,!0);H=q.keyNow;continue}W=q;break}if(dZ(W.credential.lastRefreshedAt,G.now()))throw X4(Z);await G.hold?.("refresh-before-provider",Z),await z.assertAll();let U;try{U=await X(W.credential,W.row)}catch(V){throw new x({operation:"refresh",rowId:Z,phase:"before-first-write",retryable:!0,kind:"provider",message:"the provider refresh failed",cause:V})}if(typeof U?.refresh!=="string"||!U.refresh.trim())throw _("refresh",Z,"provider","the provider returned no refresh token",!0);let j=U.providerState===void 0?void 0:u0(G.providerState,"refresh",Z,U.providerState,"the provider state the provider returned"),K=await a(G,z,B,{operation:"refresh",rowId:Z},async(V)=>{let N=V.row(Z),q=V.entry(Z);if(!N||N.invalid||!q||q.credentialEpoch!==W.credentialEpoch||N.identity!==W.identity)throw new x({operation:"refresh",rowId:Z,phase:"before-first-write",retryable:!0,kind:"attribution",message:`row ${Z} changed credential while its refresh was in flight; the rotation is discarded`});H0("refresh",N);let M=await J.refuse?.(N);if(M!==void 0)return{refused:M};let P=G.now(),E=N.credential?.type==="oauth"?N.credential.lastRefreshedAt:void 0;if(dZ(E,P))throw X4(Z);let F={type:"oauth",access:U.access,refresh:U.refresh,expires:U.expires},D=N.identity!==void 0&&U.identity!==void 0&&N.identity!==U.identity?{expectedIdentity:N.identity,returnedIdentity:U.identity}:void 0,L=D?{mark:xX(),enabled:!1,reason:`${v1}${JSON.stringify(D)}`}:void 0,A=N.identity===void 0&&U.identity?U.identity:void 0,v=await L6($,V,Z,F,{stamp:q$(E,P),transition:L,identity:A,...j!==void 0?{providerState:M$(G.providerState,"refresh",Z,N.providerState,j)}:{}});if(L!==void 0)N$(V,Z,L),await V.commitConfig();let u=N.identity;if(A!==void 0)N1(V,Z,A),u=A,await V.commitConfig();return{stored:v,identity:u,contradiction:D,refused:void 0}});if(K.refused!==void 0)return{status:"refused",rowId:Z,reason:K.refused};if(K.contradiction!==void 0)return{status:"identity-contradicted",rowId:Z,...K.contradiction,credential:K.stored};if(J.onPersisted)try{let V=J.onPersisted;await b0("refresh",()=>V(Z,K.stored))}catch(V){throw new x({operation:"refresh",rowId:Z,phase:"after-first-write",retryable:!1,kind:"after-persist-hook",committed:K.stored,message:"the after-persist hook threw; the rotation stays committed",cause:V})}return{status:"rotated",rowId:Z,credential:K.stored,...K.identity!==void 0?{identity:K.identity}:{}}})}import{isDeepStrictEqual as kX}from"node:util";var T6=Object.freeze(["version","accounts",m]);function $3($){let Z={};for(let[X,J]of Object.entries($))if(!T6.includes(X))P6(Z,X,J);return Z}function P6($,Z,X){Object.defineProperty($,Z,{value:X,enumerable:!0,writable:!0,configurable:!0})}function yX($,Z){let X={};for(let[J,G]of Object.entries($))if(T6.includes(J))P6(X,J,G);else if(Object.hasOwn(Z,J))P6(X,J,Z[J]);for(let[J,G]of Object.entries(Z))if(!Object.hasOwn($,J))P6(X,J,G);return X}function G4($){return new x({operation:"updateSettings",phase:"before-first-write",retryable:!1,kind:"invalid-input",message:$})}async function z4($){let Z=await Y0($.ctx);if(Z.status==="error")return Z;return{status:Z.status,settings:$3(Z.config)}}async function B4($,Z,X={}){G0("updateSettings");let{ctx:J}=$,G=X.onFailure;return z0(J,"updateSettings",void 0,G&&((z,B)=>G(B)),async(z,B)=>{for(let Y of X.extraLocks??[])await z.acquire(Y);let Q=z.held.length;try{for(let q of J.storeLocks)await z.acquire(q);let Y=await Y0(J);if(Y.status!=="ready")throw A0(Y,"updateSettings",void 0);let H=$3(Y.config),W=structuredClone(H),U=await b0("updateSettings",()=>Z(W)),j=U===void 0?W:U;if(!O(j))throw G4("the settings mutator must produce an object");let K=T6.filter((q)=>Object.hasOwn(j,q));if(K.length>0)throw G4(`settings cannot set the pool-owned key(s) ${K.join(", ")}`);if(kX(j,H))return{settings:H,outcome:"unchanged"};let V=yX(Y.config,j),N={operation:"updateSettings",rowId:void 0};return await L0(J.configPath,V,{beforeRename:async()=>{await J.onStep?.("before-config-write",N),await z.assertAll()}}),B.writes++,await J.onStep?.("after-config-write",N),{settings:$3(V),outcome:"updated"}}finally{await z.releaseTo(Q)}})}var Q4=new Map;function fX($){let Z=Q4.get($);if(!Z)Z={removedIds:new Set,firedAtLoad:new Set},Q4.set($,Z);return Z}function Y4($){if($.status==="ready")return{status:"ready",schemaVersion:o0,rows:$.rows};if($.status==="pending-migration")return{status:"pending-migration",roster:Array.isArray($.config.accounts)?$.config.accounts:[]};return $}function Z3($){let Z=fX($.configPath),X={...mZ,...$.lockOptions},J={provider:$.provider,configPath:$.configPath,statePath:$.statePath,codec:$.quota,...$.providerState?{providerState:$.providerState}:{},now:$.now??Date.now,storeLocks:$.storeLocks??[{name:"save",path:$.configPath},{name:"save",path:$.statePath}],lockDefaults:X,lockEnv:{now:$.now??Date.now,...$.onLockEvent?{onLockEvent:$.onLockEvent}:{},...$.onLockStep?{onLockStep:$.onLockStep}:{},...$.onRenewalTimer?{onRenewalTimer:$.onRenewalTimer}:{}},removedIds:Z.removedIds,requireCredentialStamps:$.requireCredentialStamps===!0,requireRemovedFingerprint:$.requireRemovedFingerprint===!0,...$.logger?{logger:$.logger}:{},...$.onStep?{onStep:$.onStep}:{},...$.hold?{hold:$.hold}:{}},G=new tZ(()=>z,$.pull,$.onPullFailure,Z.firedAtLoad,$.logger),z={ctx:J,providerLock:$.providerLock??{name:`provider-${encodeURIComponent($.provider)}`,path:$.statePath},rowLockOptions:$.rowLockOptions??{},firePull:(B,Q)=>G.fire(B,Q)};return{async load(){let B=await Y0(J);if(B.status==="ready"){for(let Q of B.rows)if((Q.candidate||Q.torn&&Q.enabled)&&Q.type==="oauth"&&Q.needsFirstReading)G.fire(Q.id,"load")}return Y4(B)},async read(){return Y4(await Y0(J))},async initialize(B={}){return{status:await y9(J,B.dropKeys??[])}},add:(B,Q)=>p9(z,B,Q),publishRoster:(B,Q)=>Z4(z,B,Q),publication:(B)=>e9(z,B),replace:(B,Q,Y,H)=>u9(z,B,Q,Y,H),rotate:(B,Q,Y,H)=>l9(z,B,Q,Y,H),updateProviderState:(B,Q,Y,H)=>h9(z,B,Q,Y,H),disable:(B,Q,Y)=>c9(z,B,Q,Y),enable:(B,Q)=>s9(z,B,Q),remove:(B,Q)=>i9(z,B,Q),reorder:(B,Q)=>a9(z,B,Q),readSettings:()=>z4(z),updateSettings:(B,Q)=>B4(z,B,Q),recordIdentity:(B,Q,Y,H)=>n9(z,B,Q,Y,H),refresh:(B,Q,Y)=>J4(z,B,Q,Y),recordQuota:(B,Q,Y)=>K6(z,B,Q,Y),requestReading:(B)=>G.fire(B,"admission"),pullsSettled:()=>G.settled()}}var gX=[/\b[\w-]*(?:secret|token|password|passwd|api[_-]?key|authorization|verifier)["']?\s*[:=]\s*["']?(?:(?:Bearer|Basic)\s+)?[^\s"'&,;}]+/gi,/\b[0-9a-fA-F]{32,}\b/g];function G3($={}){let{redactStrings:Z}=I0({...$,extraValuePatterns:[...gX,...$.extraValuePatterns??[]]});return(X)=>Z(X)}class W0 extends Error{code;constructor($,Z,X){super(Z,X);this.name="CommandError",this.code=$}}var H4=/^[a-z][a-z0-9-]{0,63}$/,X3={code:"action-failed",text:"That action failed."},hX=new Set(["unknown-row","invalid-row","invalid-input","id-exists","id-removed","type-mismatch","no-credential","row-disabled","row-protected","duplicate-identity","row-key-changed","invalid-order","pending-migration","provider","pull","attribution"]);function L$($){if($ instanceof W0)return{code:H4.test($.code)?$.code:X3.code,text:$.message};if($ instanceof x)return{code:`pool-${$.kind}`,text:hX.has($.kind)?$.message:`The account pool could not do that (${$.kind}).`};return X3}var W4="This cannot be undone. Continue?",vX=new Set(["access","refresh","apikey","password","authheader","credential","credentials"]);function mX($){let Z=$.toLowerCase().replace(/[-_]/g,"");return vX.has(Z)||Z.endsWith("token")||Z.endsWith("key")||Z.endsWith("secret")}function wX($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function J3($,Z,X){if(typeof $==="string"){let G=X.redact($);if(G!==$)X.redacted.push(Z);return G}if(Array.isArray($))return $.map((G,z)=>J3(G,`${Z}[${z}]`,X));if(!wX($))return $;let J={};for(let[G,z]of Object.entries($)){if(mX(G)){X.dropped.push(`${Z}.${G}`);continue}Object.defineProperty(J,G,{value:J3(z,`${Z}.${G}`,X),enumerable:!0,writable:!0,configurable:!0})}return J}function V4($,Z,X){let J={redact:X.redact,dropped:[],redacted:[]},G=J3($,"payload",J);if(J.dropped.length>0)X.logger.warn("credential-shaped field dropped from a command payload",{command:Z,fields:J.dropped});if(J.redacted.length>0)X.logger.warn("secret-shaped text masked in a command payload",{command:Z,fields:J.redacted});return G}function pX($){return{value:String($.value),label:String($.label)}}function uX($){switch($.kind){case"choice":return{kind:"choice",id:$.id,label:$.label,choices:($.choices??[]).map(pX),...$.value!==void 0?{value:$.value}:{}};case"toggle":return{kind:"toggle",id:$.id,label:$.label,value:$.value===!0};case"number":return{kind:"number",id:$.id,label:$.label,...$.value!==void 0?{value:$.value}:{},...$.min!==void 0?{min:$.min}:{},...$.max!==void 0?{max:$.max}:{},...$.required?{required:!0}:{}};case"text":return{kind:"text",id:$.id,label:$.label,...$.value!==void 0&&!$.masked?{value:$.value}:{},...$.placeholder!==void 0?{placeholder:$.placeholder}:{},...$.masked?{masked:!0}:{},...$.required?{required:!0}:{}}}}function z3($){if($.irreversible===!0)return{message:$.confirm||W4,irreversible:!0};if($.confirm)return{message:$.confirm,irreversible:!1};return}function U4($){let Z=z3($);return{id:$.id,label:$.label,...$.description!==void 0?{description:$.description}:{},...$.group!==void 0?{group:String($.group)}:{},knobs:($.knobs??[]).map(uX),...Z?{confirm:Z}:{}}}function lX($){return{id:$.id,...$.label!==void 0?{label:$.label}:{},enabled:$.enabled,type:$.type,...$.identity!==void 0?{identity:$.identity}:{}}}function dX($){return{id:$.id,label:$.label,...$.detail!==void 0?{detail:$.detail}:{},...$.group!==void 0?{group:String($.group)}:{},...$.status!==void 0?{status:String($.status)}:{},...$.account?{account:lX($.account)}:{},...$.facts!==void 0?{facts:$.facts}:{},actions:($.actions??[]).map(U4)}}function cX($){let{content:Z}=$;return{id:$.id,slot:$.slot,title:$.title,lines:(Z.lines??[]).map(String),items:(Z.items??[]).map(dX),actions:(Z.actions??[]).map(U4),...Z.facts!==void 0?{facts:Z.facts}:{}}}function j4($,Z,X){return{command:$,title:Z,sections:X.map(cX)}}function D4($,Z,X,J){return V4({command:$,menu:j4($,Z,X)},$,J)}function K4($,Z,X,J,G){return V4({command:$,ok:J.ok,text:String(J.text),...!J.ok&&J.code!==void 0?{code:H4.test(J.code)?J.code:"refused"}:{},...J.needsConfirmation?{needsConfirmation:!0}:{},menu:j4($,Z,X)},$,G)}var M4="disabled from the command menu";function sX($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function l0($){return sX($)?{...$}:{}}function iX($){if($.status!=="ready")return[];let Z=new Set;return $.rows.filter((X)=>{if(Z.has(X.id))return!1;return Z.add(X.id),!0})}function aX($,Z){return $.label??Z??$.id}function A6($,Z){return B0($.quota)?c($.quota,Z):void 0}function F4($,Z){return`${$} ${Z}${$===1?"":"s"}`}var _$="Actions";function nX($){if($.status==="pending-migration")return"The account pool has not been migrated yet.";if($.status==="error")return`The ${$.file} file cannot be read: ${$.reason}`;return}function q4($,Z){switch(Z.outcome){case"added":return`Added ${$}.`;case"added-disabled":return`Added ${$}, disabled: another enabled account has the same identity.`;case"completed":return`Finished adding ${$}.`;case"rotated":return`${$} was already in the pool; its credential was updated.`;case"exists":return`${$} was already in the pool; its credential is unchanged.`}}function N4($){return L$($).text}async function rX($){let Z=await $.read(),X=await $.readSettings();return{load:Z,rows:iX(Z),settings:X.status==="error"?{}:X.settings}}function S6($,Z){let X=Z.accounts?.describeIdentity?Z.accounts.describeIdentity($):$.identity;return{account:{id:$.id,...$.label!==void 0?{label:$.label}:{},enabled:$.enabled,type:$.type,...X!==void 0?{identity:X}:{}},name:aX($,X)}}function oX($,Z){let{store:X,extraLocks:J}=$,G=J?{extraLocks:J}:{},z=Z.rows.map((U)=>U.id),B=nX(Z.load),Q=Z.rows.filter((U)=>U.enabled).length,Y=Z.rows.map((U,j)=>{let{account:K,name:V}=S6(U,$),N=[U.type==="api"?"API key":"OAuth",...K.identity!==void 0?[K.identity]:[],...!U.invalid&&!U.enabled&&U.disabledReason?[`disabled: ${U.disabledReason}`]:[]].join(" · "),q=U.invalid?"invalid":U.enabled?"enabled":"disabled",M=[];if(!U.invalid&&U.enabled)M.push({id:"disable",label:"Disable",run:async()=>{return await X.disable(U.id,M4,G),`Disabled ${V}.`}});if(!U.invalid&&!U.enabled)M.push({id:"enable",label:"Enable",run:async()=>{return await X.enable(U.id,G),`Enabled ${V}.`}});if(z.length>1)M.push({id:"move",label:"Move",knobs:[{kind:"choice",id:"position",label:"Position",choices:z.map((P,E)=>({value:String(E+1),label:String(E+1)})),value:String(j+1)}],run:async({values:P})=>{let E=Number(P.position),F=z.filter((L)=>L!==U.id);return F.splice(E-1,0,U.id),(await X.reorder(F,G)).outcome==="unchanged"?`${V} is already at position ${E}.`:`Moved ${V} to position ${E}.`}});return M.push({id:"remove",label:"Remove",irreversible:!0,confirm:`Remove ${V}? Its stored credential is deleted.`,run:async()=>{return await X.remove(U.id,{...G,...$.accounts?.protect?{protect:$.accounts.protect}:{}}),`Removed ${V}.`}}),{id:U.id,label:V,detail:N,group:"Accounts",status:q,account:K,actions:M}}),H=$.accounts?.login,W=[];if(H&&!B)W.push({id:"add",label:H.label??"Add account",group:_$,knobs:H.knobs??[],run:async({values:U,invocation:j})=>{let K=await H.run(U,j);if(K.status==="cancelled")return{ok:!1,text:K.message??"Login cancelled."};if(K.status==="ready"){let V=await X.add(K.account,G);return q4(K.account.label??V.id,V)}return K.completion.then(async(V)=>{if(!V){j.notify("Login cancelled.","warning");return}let N=await X.add(V,G);j.notify(q4(V.label??N.id,N))},(V)=>{j.notify(`Adding the account failed: ${N4(V)}`,"error")}).catch((V)=>{j.notify(`Adding the account failed: ${N4(V)}`,"error")}),K.message}});return{id:"accounts",slot:"accounts",title:"Accounts",content:{lines:B?[B]:[Z.rows.length===0?"No accounts yet":`${F4(Z.rows.length,"account")}, ${Q} enabled`],items:B?[]:Y,actions:W}}}function tX($,Z){let X=$.quota?.scope??"all",J=$.now(),G=X==="all"?"Accounts":`Accounts · ${X}`,z=async(W,U)=>{if($.quota?.check)await $.quota.check(W,U);else{for(let j of W)$.store.requestReading(j);await $.store.pullsSettled()}},B=Z.rows.filter((W)=>W.candidate),Q=B.map((W)=>{let{account:U,name:j}=S6(W,$),K=A6(W,X);return{id:W.id,label:j,group:G,status:P0(K,{now:J,form:"compact"}),detail:P0(K,{now:J,form:"full"}),account:U,actions:[{id:"check",label:"Check this account",run:async({invocation:V})=>{return await z([W.id],V),`Checked quota for ${j}.`}}]}}),Y=Z.rows.filter((W)=>!W.candidate).map((W)=>{let{name:U}=S6(W,$),j=W.invalid?"invalid":!W.enabled?"disabled":W.credential===void 0?"no credential":"unavailable",K=P0(A6(W,X),{now:J,form:"compact"});return`${U} (${j}): ${K}`}),H=[];if(B.length>0)H.push({id:"check",label:"Check now",description:"Checks every account that can be checked.",group:_$,run:async({invocation:W})=>{let U=B.map((j)=>j.id);return await z(U,W),`Checked quota for ${F4(U.length,"account")}.`}});return{id:"quota",slot:"quota",title:"Quota",content:{lines:Z.rows.length===0?["No accounts yet"]:Y,items:Q,actions:H}}}function eX($,Z){let{store:X,extraLocks:J}=$,G=J?{extraLocks:J}:{},z=[{value:"ordered",label:"Ordered (roster order)"},...$.routing?.orderedVariants??[],{value:"sticky-balanced",label:"Sticky balanced"}],B=l0(Z.settings.routing).mode,Q=typeof B==="string"&&z.some((V)=>V.value===B)?B:"ordered",Y=NZ(Q),H=Z.rows.map((V)=>V.id),W=y1(H,Y.placement,$.routing?.formerMainId??J6),j=[`Mode: ${z.find((V)=>V.value===Q)?.label??Q}`];if(H.length>0)j.push(`Roster order: ${H.join(", ")}`);if(Y.mode==="ordered"&&W.join()!==H.join())j.push(`Tried in order: ${W.join(", ")}`);let K=[{id:"mode",label:"Change mode",group:_$,knobs:[{kind:"choice",id:"mode",label:"Mode",choices:z,value:Q}],run:async({values:V})=>{let N=String(V.mode);return await X.updateSettings((q)=>{q.routing={...l0(q.routing),mode:N};return},G),`Routing mode set to ${z.find((q)=>q.value===N)?.label??N}.`}}];if(H.length>1)K.push({id:"order",label:"Set order",group:_$,knobs:[{kind:"text",id:"order",label:"Account ids, first to last",value:H.join(", "),required:!0}],run:async({values:V})=>{let N=String(V.order).split(/[\s,]+/).filter((M)=>M.length>0),q=await X.reorder(N,G);return q.outcome==="unchanged"?"The order is unchanged.":`Order set to ${q.ids.join(", ")}.`}});return{id:"routing",slot:"routing",title:"Routing",content:{lines:j,actions:K}}}function $J($,Z){if($.limits?.labels)return[...$.limits.labels];let X=$.quota?.scope??"all",J=[];for(let G of Z.rows)for(let z of A6(G,X)?.limits??[])if(!J.includes(z.label))J.push(z.label);return J.length>0?J:["primary"]}function ZJ($,Z){let X=$.quota?.scope??"all",J=new Map;for(let G of Z.rows)for(let z of A6(G,X)?.limits??[])if(z.windowMinutes!==void 0&&!J.has(z.label))J.set(z.label,Z6(z));return(G)=>J.get(G)??G}function XJ($,Z){let{store:X,extraLocks:J}=$,G=J?{extraLocks:J}:{},z=l0(Z.settings.killswitch),B=z.enabled===!0,Q=l0(z.accounts),Y=$J($,Z),H=ZJ($,Z),W=B?"on":"off",U=Z.rows.map((j)=>{let{account:K,name:V}=S6(j,$),N=l0(Q[j.id]),q=Y.filter((M)=>typeof N[M]==="number");return{id:j.id,label:V,group:`Floors · killswitch ${W}`,status:q.length===0?"no floors":q.map((M)=>`${H(M)} ≥${N[M]}%`).join(" · "),account:K,actions:[{id:"floors",label:"Set floors",knobs:Y.map((M)=>({kind:"number",id:M,label:`Minimum % left for ${H(M)}`,min:0,max:100,...typeof N[M]==="number"?{value:N[M]}:{}})),run:async({values:M})=>{return await X.updateSettings((P)=>{let E=l0(P.killswitch),F=l0(E.accounts),D=l0(F[j.id]);for(let L of Y){let A=M[L];if(typeof A==="number")D[L]=A;else if(A===null)delete D[L]}if(Object.keys(D).length>0)F[j.id]=D;else delete F[j.id];if(Object.keys(F).length>0)E.accounts=F;else delete E.accounts;P.killswitch=E;return},G),`Floors updated for ${V}.`}}]}});return{id:"limits",slot:"limits",title:"Limits",content:{lines:[`Killswitch ${W}`],items:U,actions:[{id:"killswitch",label:B?"Turn killswitch off":"Turn killswitch on",description:"With the killswitch on, an account whose quota falls below one of its floors is not used.",group:_$,knobs:[{kind:"toggle",id:"enabled",label:"Killswitch",value:!B}],run:async({values:j})=>{let K=j.enabled===!0;return await X.updateSettings((V)=>{V.killswitch={...l0(V.killswitch),enabled:K};return},G),`Killswitch ${K?"on":"off"}.`}}]}}}async function L4($){let Z=await rX($.store);return[oX($,Z),tX($,Z),eX($,Z),XJ($,Z)]}var JJ=new Set(["accounts","quota","routing","limits","cache","diagnostics"]),B3=["accounts","quota","routing","limits"];function _4($,Z){let{sessionId:X}=$,J=$.notify.bind($);return Object.freeze({...X!==void 0?{sessionId:X}:{},notify:(G,z)=>z===void 0?J(Z(String(G))):J(Z(String(G)),z)})}function GJ($,Z){switch($.kind){case"choice":{let X=Z??$.value;if(typeof X==="string"&&$.choices.some((J)=>J.value===X))return{value:X};return{problem:`Choose one of the options for ${$.label}.`}}case"toggle":{let X=Z??$.value;return typeof X==="boolean"?{value:X}:{problem:`${$.label} must be on or off.`}}case"number":{let X=Z===void 0?$.value??null:Z;if(X===null||X==="")return $.required?{problem:`${$.label} needs a number.`}:{value:null};let J=typeof X==="number"?X:Number(X);if(typeof X==="boolean"||!Number.isFinite(J))return{problem:`${$.label} needs a number.`};if($.min!==void 0&&J<$.min)return{problem:`${$.label} must be at least ${$.min}.`};if($.max!==void 0&&J>$.max)return{problem:`${$.label} must be at most ${$.max}.`};return{value:J}}case"text":{let X=Z===void 0?$.value??null:Z;if(X===null||X==="")return $.required?{problem:`${$.label} cannot be empty.`}:{value:null};return typeof X==="string"?{value:X}:{problem:`${$.label} must be text.`}}}}function zJ($,Z){let X={};for(let J of $){let G=Z&&Object.hasOwn(Z,J.id)?Z[J.id]:void 0,z=GJ(J,G);if("problem"in z)return z;X[J.id]=z.value}return{values:X}}function BJ($,Z){let X=$.find((G)=>G.id===Z.sectionId);if(!X)return;return(Z.itemId===void 0?X.content.actions:X.content.items?.find((G)=>G.id===Z.itemId)?.actions)?.find((G)=>G.id===Z.actionId)}function _1($){let Z=$.logger??i("commands"),X=G3($.redaction),J={logger:Z,redact:X},G=$.now??Date.now,z=$.extras??[],B=$.replace??{},Q=B3.filter((j)=>!B[j]);for(let j of B3)if(B[j]&&$[j]!==void 0)throw Error(`the ${j} section is replaced; its built-in options cannot also be given`);let Y=$.store;if(Q.length>0&&!Y)throw Error(`a store is required for the built-in ${Q.join(", ")} section${Q.length>1?"s":""}`);let H=new Set;for(let j of z){if(JJ.has(j.id)||H.has(j.id))throw Error(`extra section id ${j.id} is taken`);H.add(j.id)}async function W(j,K,V,N){try{return{id:j,slot:K,title:V.title,content:await V.build(N)}}catch(q){return Z.warn("command menu section failed to build",{command:$.command,section:j,error:X(q instanceof Error?q.message:String(q))}),{id:j,slot:K,title:V.title,content:{lines:["This section could not be loaded."]}}}}async function U(j){let K=Y&&Q.length>0?await L4({store:Y,now:G,...$.extraLocks?{extraLocks:$.extraLocks}:{},...$.accounts?{accounts:$.accounts}:{},...$.quota?{quota:$.quota}:{},...$.routing?{routing:$.routing}:{},...$.limits?{limits:$.limits}:{}}):[],V=[];for(let N of B3){let q=B[N];if(q)V.push(await W(N,N,q,j));else{let M=K.find((P)=>P.slot===N);if(M)V.push(M)}}if($.cache)V.push(await W("cache","cache",$.cache,j));if($.diagnostics)V.push(await W("diagnostics","diagnostics",$.diagnostics,j));for(let N of z)V.push(await W(N.id,"extra",N,j));return V}return{command:$.command,async open(j){let K=_4(j,X);return D4($.command,$.title,await U(K),J)},async apply(j,K){let V=_4(K,X),N=async(F)=>K4($.command,$.title,await U(V),F,J),q=j.command===$.command?BJ(await U(V),j):void 0;if(!q)return N({ok:!1,code:"unavailable",text:"That action is no longer available."});let M=z3(q);if(M&&j.confirmed!==!0)return N({ok:!1,code:"needs-confirmation",text:M.message,needsConfirmation:!0});let P=zJ(q.knobs??[],j.values);if("problem"in P)return N({ok:!1,code:"invalid-input",text:P.problem});let E;try{let F=await q.run({values:P.values,...j.itemId!==void 0?{itemId:j.itemId}:{},invocation:V});E=typeof F==="string"?{ok:!0,text:F}:{ok:F.ok,text:F.text,...F.ok?{}:{code:F.code??"refused"}}}catch(F){let D=L$(F);Z.warn("command menu action failed",{command:$.command,section:j.sectionId,action:j.actionId,code:D.code,error:X(F instanceof Error?F.message:String(F))}),E={ok:!1,...D}}return N(E)}}}async function O$($,Z,X){let J=new Map,G=[];for(let B of X){let Q=B.label;for(let Y=2;J.has(Q);Y++)Q=`${B.label} (${Y})`;J.set(Q,B.value),G.push(Q)}let z=await $.select(Z,G);return z===void 0?void 0:J.get(z)}function O4($,Z){return Z.length>0?`${$}
 ${Z.join(`
-`)}`:$}function l3($){return $.status?`${$.label} · ${$.status}`:$.label}function Tz($){let Z=[...$.lines],X;for(let J of $.items){if(J.actions.length>0)continue;if(J.group!==void 0&&J.group!==X)Z.push(J.group);X=J.group,Z.push(J.group!==void 0?`  ${l3(J)}`:l3(J))}return Z}function Az($){let Z=$.detail?[$.detail]:[];for(let[X,J]of Object.entries($.facts??{}))Z.push(`${X}: ${String(J)}`);return QZ(l3($),Z)}async function Rz($,Z){switch(Z.kind){case"choice":{let X=await v$($,Z.label,Z.choices.map((J)=>({label:J.value===Z.value?`${J.label} (current)`:J.label,value:J.value})));return X===void 0?void 0:{value:X}}case"toggle":{let X=await v$($,Z.label,[{label:Z.value?"On (current)":"On",value:!0},{label:Z.value?"Off":"Off (current)",value:!1}]);return X===void 0?void 0:{value:X}}case"number":{let X=Z.min!==void 0&&Z.max!==void 0?` (${Z.min}-${Z.max}${Z.required?"":", empty clears"})`:Z.required?"":" (empty clears)",J=await $.input(`${Z.label}${X}`,Z.value!==void 0?String(Z.value):void 0);if(J===void 0)return;let z=J.trim();if(z==="")return Z.required&&Z.value!==void 0?{value:Z.value}:{value:null};let G=Number(z);if(!Number.isFinite(G)){$.notify(`${Z.label} needs a number.`,"error");return}return{value:G}}case"text":{let X=await $.input(Z.label,Z.value??Z.placeholder);if(X===void 0)return;let J=X.trim();if(J==="")return Z.required&&Z.value!==void 0?{value:Z.value}:{value:null};return{value:J}}}}async function Sz($,Z){let X={};for(let J of Z.knobs){let z=await Rz($,J);if(!z)return;X[J.id]=z.value}return X}async function w8($,Z,X={}){let J={...X.sessionId!==void 0?{sessionId:X.sessionId}:{},notify:(G,Q)=>Z.notify(G,Q)},z=(await $.open(J)).menu;for(;;){let G=await v$(Z,z.title,z.sections.map((Q)=>({label:Q.lines[0]?`${Q.title}: ${Q.lines[0]}`:Q.title,value:Q.id})));if(G===void 0)return;for(;;){let Q=z.sections.find((j)=>j.id===G);if(!Q)break;let Y=[...Q.items.filter((j)=>j.actions.length>0).map((j)=>({label:l3(j),value:{kind:"item",item:j}})),...Q.actions.map((j)=>({label:j.label,value:{kind:"action",action:j}}))],W=Tz(Q);if(Y.length===0&&W.length===0){Z.notify("Nothing to do here.");break}let H=await v$(Z,QZ(Q.title,W),[...Y,{label:"Back",value:{kind:"back"}}]);if(!H||H.kind==="back")break;let B,V;if(H.kind==="item"){if(V=H.item,B=await v$(Z,Az(V),V.actions.map((j)=>({label:j.label,value:j}))),!B)continue}else B=H.action;let U=await Sz(Z,B);if(!U)continue;if(B.confirm){if(!await Z.confirm(B.label,B.confirm.message)){Z.notify("Cancelled.");continue}}let K=await $.apply({command:z.command,sectionId:Q.id,...V?{itemId:V.id}:{},actionId:B.id,values:U,...B.confirm?{confirmed:!0}:{},...X.sessionId!==void 0?{sessionId:X.sessionId}:{}},J);Z.notify(K.text,K.ok?"info":"error"),z=K.menu}}}import{createHash as zY,randomUUID as GY}from"node:crypto";import{setTimeout as QY}from"node:timers/promises";var Iz=Object.freeze({sidebar:Object.freeze({name:"sidebar-write",ttlMs:1e4,timeoutMs:15000,renew:!0}),preferences:Object.freeze({name:"preferences",ttlMs:1e4,timeoutMs:2000,renew:!0})});import{createHash as xz}from"node:crypto";var bz=86400000,Ez=300000,kz=3600000,fz=60000,yz=900000,vz=300000;function m8($){return $ instanceof Error?$.message:String($)}function p8($){let Z=$?.status;if(typeof Z==="number")return Z===429||Z>=500;if(!($ instanceof Error))return!1;return $.name==="AbortError"||$.name==="TimeoutError"||$.message.includes("fetch failed")||"code"in $&&($.code==="ECONNRESET"||$.code==="ECONNREFUSED"||$.code==="ETIMEDOUT"||$.code==="UND_ERR_CONNECT_TIMEOUT")}function u8($){let Z=m8($),X=$?.status;if(typeof X==="number")return X===429||X>=500;if(!($ instanceof Error))return!1;let J=$.code;return $.name==="AbortError"||$.name==="TimeoutError"||Z.includes("fetch failed")||J==="ECONNRESET"||J==="ECONNREFUSED"||J==="ETIMEDOUT"||J==="UND_ERR_CONNECT_TIMEOUT"}function z$($){return xz("sha256").update($).digest("hex")}function d3($){let Z=z$($.refreshToken),J=($.previous?.tokenHash===Z?$.previous.retryCount??0:0)+1,z,G=$.error?.retryAfter;if(typeof G==="number"&&G>0)z=G*1000;else if(p8($.error))z=Math.min(kz,Ez*2**Math.min(J-1,6));else z=bz;return{message:m8($.error),checkedAt:$.now,nextRetryAt:$.now+z,retryCount:J,tokenHash:Z}}function V1($,Z,X){if(!$?.nextRetryAt||$.nextRetryAt<=X)return!1;if(!Z)return!0;return $.tokenHash===z$(Z)}function g$($,Z){return`Codex OAuth refresh is backed off for ${Math.max(1,Math.ceil((($.nextRetryAt??Z)-Z)/1000))}s after: ${$.message}`}function h$($){let X=($.previous?.retryCount??0)+1,J,z=$.error?.retryAfter;if(typeof z==="number"&&z>0)J=z*1000;else if(u8($.error))J=Math.min(yz,fz*2**Math.min(X-1,6));else J=vz;return{message:m8($.error),checkedAt:$.now,nextRetryAt:$.now+J,retryCount:X}}function G$($,Z){if(!$?.nextRetryAt||$.nextRetryAt<=Z)return!1;return!0}function l8($){if(!$)return;let Z=Number($);if(Number.isFinite(Z)&&Z>0)return Math.ceil(Z);let X=Date.parse($);if(Number.isFinite(X)){let J=Math.ceil((X-Date.now())/1000);return J>0?J:void 0}return}function gz($){return $==="chatgptaccountid"||$==="email"||$==="orgname"||$==="organizationname"}var YZ=v0({extraSecretKeys:gz}),XU=YZ.redact,WZ=YZ.redactStrings;import{createServer as BZ}from"node:http";import{setTimeout as hz}from"node:timers/promises";var i3="app_EMoamEEZ73f0CkXaXp7hrann",k1="https://auth.openai.com",m$=1455,wz=3000,mz="cortexkit-opencode-openai-auth";function VZ($){return`${mz}/${$}`}var jZ="main",pz=`"${jZ}" is a reserved account id; choose a different label.`;function UZ($){let Z=new Uint8Array($),X=String.fromCharCode(...Z);return btoa(X).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function uz(){let Z=Array.from(crypto.getRandomValues(new Uint8Array(43))).map((J)=>"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"[J%66]).join(""),X=UZ(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(Z)));return{verifier:Z,challenge:X}}function Q$($){if($.length>16384)return;let Z=$.split(".");if(Z.length!==3)return;let X=Z[1];if(!X||X.length>8192)return;try{return JSON.parse(Buffer.from(X,"base64url").toString())}catch{return}}function Y$($){let Z=$.chatgpt_account_id;if(typeof Z==="string"&&Z.length>0)return Z;let X=$["https://api.openai.com/auth"];if(X&&typeof X==="object"&&!Array.isArray(X)&&typeof X.chatgpt_account_id==="string"&&X.chatgpt_account_id.length>0)return X.chatgpt_account_id;let J=$.organizations;if(Array.isArray(J)){let z=J[0];if(z&&typeof z==="object"&&!Array.isArray(z)&&typeof z.id==="string"&&z.id.length>0)return z.id}return}function p$($){if($.id_token){let Z=Q$($.id_token),X=Z&&Y$(Z);if(X)return X}if($.access_token){let Z=Q$($.access_token);return Z?Y$(Z):void 0}return}function lz($){return typeof $==="string"&&$.toLowerCase()===jZ}function d8($){if(lz($))throw Error(pz);return $}function dz($,Z,X){let J=new URLSearchParams({response_type:"code",client_id:i3,redirect_uri:$,scope:"openid profile email offline_access",code_challenge:Z.challenge,code_challenge_method:"S256",id_token_add_organizations:"true",codex_cli_simplified_flow:"true",state:X,originator:"opencode"});return`${k1}/oauth/authorize?${J.toString()}`}async function cz($,Z,X){let J=await fetch(`${k1}/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:$,redirect_uri:Z,client_id:i3,code_verifier:X.verifier}).toString()});if(!J.ok)throw Error(`Token exchange failed: ${J.status}`);return await J.json()}function sz($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&#39;")}var iz=`<!doctype html>
+`)}`:$}function R6($){return $.status?`${$.label} · ${$.status}`:$.label}function QJ($){let Z=[...$.lines],X;for(let J of $.items){if(J.actions.length>0)continue;if(J.group!==void 0&&J.group!==X)Z.push(J.group);X=J.group,Z.push(J.group!==void 0?`  ${R6(J)}`:R6(J))}return Z}function YJ($){let Z=$.detail?[$.detail]:[];for(let[X,J]of Object.entries($.facts??{}))Z.push(`${X}: ${String(J)}`);return O4(R6($),Z)}async function HJ($,Z){switch(Z.kind){case"choice":{let X=await O$($,Z.label,Z.choices.map((J)=>({label:J.value===Z.value?`${J.label} (current)`:J.label,value:J.value})));return X===void 0?void 0:{value:X}}case"toggle":{let X=await O$($,Z.label,[{label:Z.value?"On (current)":"On",value:!0},{label:Z.value?"Off":"Off (current)",value:!1}]);return X===void 0?void 0:{value:X}}case"number":{let X=Z.min!==void 0&&Z.max!==void 0?` (${Z.min}-${Z.max}${Z.required?"":", empty clears"})`:Z.required?"":" (empty clears)",J=await $.input(`${Z.label}${X}`,Z.value!==void 0?String(Z.value):void 0);if(J===void 0)return;let G=J.trim();if(G==="")return Z.required&&Z.value!==void 0?{value:Z.value}:{value:null};let z=Number(G);if(!Number.isFinite(z)){$.notify(`${Z.label} needs a number.`,"error");return}return{value:z}}case"text":{let X=await $.input(Z.label,Z.value??Z.placeholder);if(X===void 0)return;let J=X.trim();if(J==="")return Z.required&&Z.value!==void 0?{value:Z.value}:{value:null};return{value:J}}}}async function WJ($,Z){let X={};for(let J of Z.knobs){let G=await HJ($,J);if(!G)return;X[J.id]=G.value}return X}async function Q3($,Z,X={}){let J={...X.sessionId!==void 0?{sessionId:X.sessionId}:{},notify:(z,B)=>Z.notify(z,B)},G=(await $.open(J)).menu;for(;;){let z=await O$(Z,G.title,G.sections.map((B)=>({label:B.lines[0]?`${B.title}: ${B.lines[0]}`:B.title,value:B.id})));if(z===void 0)return;for(;;){let B=G.sections.find((V)=>V.id===z);if(!B)break;let Q=[...B.items.filter((V)=>V.actions.length>0).map((V)=>({label:R6(V),value:{kind:"item",item:V}})),...B.actions.map((V)=>({label:V.label,value:{kind:"action",action:V}}))],Y=QJ(B);if(Q.length===0&&Y.length===0){Z.notify("Nothing to do here.");break}let H=await O$(Z,O4(B.title,Y),[...Q,{label:"Back",value:{kind:"back"}}]);if(!H||H.kind==="back")break;let W,U;if(H.kind==="item"){if(U=H.item,W=await O$(Z,YJ(U),U.actions.map((V)=>({label:V.label,value:V}))),!W)continue}else W=H.action;let j=await WJ(Z,W);if(!j)continue;if(W.confirm){if(!await Z.confirm(W.label,W.confirm.message)){Z.notify("Cancelled.");continue}}let K=await $.apply({command:G.command,sectionId:B.id,...U?{itemId:U.id}:{},actionId:W.id,values:j,...W.confirm?{confirmed:!0}:{},...X.sessionId!==void 0?{sessionId:X.sessionId}:{}},J);Z.notify(K.text,K.ok?"info":"error"),G=K.menu}}}import{createHash as EG,randomUUID as IG}from"node:crypto";import{setTimeout as bG}from"node:timers/promises";var VJ=Object.freeze({sidebar:Object.freeze({name:"sidebar-write",ttlMs:1e4,timeoutMs:15000,renew:!0}),preferences:Object.freeze({name:"preferences",ttlMs:1e4,timeoutMs:2000,renew:!0})});import{createHash as UJ}from"node:crypto";var jJ=86400000,DJ=300000,KJ=3600000,qJ=60000,NJ=900000,MJ=300000;function Y3($){return $ instanceof Error?$.message:String($)}function H3($){let Z=$?.status;if(typeof Z==="number")return Z===429||Z>=500;if(!($ instanceof Error))return!1;return $.name==="AbortError"||$.name==="TimeoutError"||$.message.includes("fetch failed")||"code"in $&&($.code==="ECONNRESET"||$.code==="ECONNREFUSED"||$.code==="ETIMEDOUT"||$.code==="UND_ERR_CONNECT_TIMEOUT")}function W3($){let Z=Y3($),X=$?.status;if(typeof X==="number")return X===429||X>=500;if(!($ instanceof Error))return!1;let J=$.code;return $.name==="AbortError"||$.name==="TimeoutError"||Z.includes("fetch failed")||J==="ECONNRESET"||J==="ECONNREFUSED"||J==="ETIMEDOUT"||J==="UND_ERR_CONNECT_TIMEOUT"}function i1($){return UJ("sha256").update($).digest("hex")}function E6($){let Z=i1($.refreshToken),J=($.previous?.tokenHash===Z?$.previous.retryCount??0:0)+1,G,z=$.error?.retryAfter;if(typeof z==="number"&&z>0)G=z*1000;else if(H3($.error))G=Math.min(KJ,DJ*2**Math.min(J-1,6));else G=jJ;return{message:Y3($.error),checkedAt:$.now,nextRetryAt:$.now+G,retryCount:J,tokenHash:Z}}function Z1($,Z,X){if(!$?.nextRetryAt||$.nextRetryAt<=X)return!1;if(!Z)return!0;return $.tokenHash===i1(Z)}function C$($,Z){return`Codex OAuth refresh is backed off for ${Math.max(1,Math.ceil((($.nextRetryAt??Z)-Z)/1000))}s after: ${$.message}`}function P$($){let X=($.previous?.retryCount??0)+1,J,G=$.error?.retryAfter;if(typeof G==="number"&&G>0)J=G*1000;else if(W3($.error))J=Math.min(NJ,qJ*2**Math.min(X-1,6));else J=MJ;return{message:Y3($.error),checkedAt:$.now,nextRetryAt:$.now+J,retryCount:X}}function a1($,Z){if(!$?.nextRetryAt||$.nextRetryAt<=Z)return!1;return!0}function V3($){if(!$)return;let Z=Number($);if(Number.isFinite(Z)&&Z>0)return Math.ceil(Z);let X=Date.parse($);if(Number.isFinite(X)){let J=Math.ceil((X-Date.now())/1000);return J>0?J:void 0}return}function FJ($){return $==="chatgptaccountid"||$==="email"||$==="orgname"||$==="organizationname"}var C4=I0({extraSecretKeys:FJ}),pW=C4.redact,P4=C4.redactStrings;import{createServer as T4}from"node:http";import{setTimeout as LJ}from"node:timers/promises";var x6="app_EMoamEEZ73f0CkXaXp7hrann",P1="https://auth.openai.com",A$=1455,_J=3000,OJ="cortexkit-opencode-openai-auth";function S4($){return`${OJ}/${$}`}var R4="main",CJ=`"${R4}" is a reserved account id; choose a different label.`;function E4($){let Z=new Uint8Array($),X=String.fromCharCode(...Z);return btoa(X).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function PJ(){let Z=Array.from(crypto.getRandomValues(new Uint8Array(43))).map((J)=>"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"[J%66]).join(""),X=E4(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(Z)));return{verifier:Z,challenge:X}}function n1($){if($.length>16384)return;let Z=$.split(".");if(Z.length!==3)return;let X=Z[1];if(!X||X.length>8192)return;try{return JSON.parse(Buffer.from(X,"base64url").toString())}catch{return}}function r1($){let Z=$.chatgpt_account_id;if(typeof Z==="string"&&Z.length>0)return Z;let X=$["https://api.openai.com/auth"];if(X&&typeof X==="object"&&!Array.isArray(X)&&typeof X.chatgpt_account_id==="string"&&X.chatgpt_account_id.length>0)return X.chatgpt_account_id;let J=$.organizations;if(Array.isArray(J)){let G=J[0];if(G&&typeof G==="object"&&!Array.isArray(G)&&typeof G.id==="string"&&G.id.length>0)return G.id}return}function S$($){if($.id_token){let Z=n1($.id_token),X=Z&&r1(Z);if(X)return X}if($.access_token){let Z=n1($.access_token);return Z?r1(Z):void 0}return}function TJ($){return typeof $==="string"&&$.toLowerCase()===R4}function U3($){if(TJ($))throw Error(CJ);return $}function AJ($,Z,X){let J=new URLSearchParams({response_type:"code",client_id:x6,redirect_uri:$,scope:"openid profile email offline_access",code_challenge:Z.challenge,code_challenge_method:"S256",id_token_add_organizations:"true",codex_cli_simplified_flow:"true",state:X,originator:"opencode"});return`${P1}/oauth/authorize?${J.toString()}`}async function SJ($,Z,X){let J=await fetch(`${P1}/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:$,redirect_uri:Z,client_id:x6,code_verifier:X.verifier}).toString()});if(!J.ok)throw Error(`Token exchange failed: ${J.status}`);return await J.json()}function RJ($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&#39;")}var EJ=`<!doctype html>
 <html>
   <head>
     <title>CortexKit OpenAI Auth - Authorization Successful</title>
@@ -46,7 +47,7 @@ ${Z.join(`
       setTimeout(() => window.close(), 2000)
     </script>
   </body>
-</html>`,c3=($)=>`<!doctype html>
+</html>`,I6=($)=>`<!doctype html>
 <html>
   <head>
     <title>CortexKit OpenAI Auth - Authorization Failed</title>
@@ -89,35 +90,33 @@ ${Z.join(`
     <div class="container">
       <h1>Authorization Failed</h1>
       <p>An error occurred during authorization.</p>
-      <div class="error">${sz($)}</div>
+      <div class="error">${RJ($)}</div>
     </div>
   </body>
-</html>`,s3=[],w$,t0=new Map;function HZ($,Z){return new Promise((X,J)=>{let z=(Q)=>{$.off("listening",G),J(Q)},G=()=>{$.off("error",z),X()};$.once("error",z),$.once("listening",G),$.listen(m$,Z)})}function KZ($){$.close(()=>{}),$.closeIdleConnections?.(),setTimeout(()=>{$.closeAllConnections?.()},25).unref?.()}function b1(){return t0.size}function f1($){if(t0.delete($),b1()===0)E1()}async function az(){let $=`http://localhost:${m$}/auth/callback`;if(s3.length>0)return{port:m$,redirectUri:$};if(w$)return w$;w$=(async()=>{let Z=(G,Q)=>{let Y=new URL(G.url||"/",`http://127.0.0.1:${m$}`);if(Y.pathname==="/auth/callback"){let W=Y.searchParams.get("code"),H=Y.searchParams.get("state"),B=Y.searchParams.get("error"),V=Y.searchParams.get("error_description");if(B){let K=V||B;if(H){let j=t0.get(H);if(j)j.reject(Error(K)),f1(H);else if(b1()===0)E1()}else if(b1()===0)E1();Q.writeHead(200,{"Content-Type":"text/html"}),Q.end(c3(K));return}if(!H){if(b1()===0)E1();Q.writeHead(400,{"Content-Type":"text/html"}),Q.end(c3("Missing state parameter"));return}if(!W){if(b1()===0)E1();Q.writeHead(400,{"Content-Type":"text/html"}),Q.end(c3("Missing authorization code"));return}let U=t0.get(H);if(!U){if(b1()===0)E1();Q.writeHead(400,{"Content-Type":"text/html"}),Q.end(c3("Unknown state — authorization may have expired"));return}f1(H),cz(W,$,U.pkce).then((K)=>U.resolve(K)).catch((K)=>U.reject(K)),Q.writeHead(200,{"Content-Type":"text/html"}),Q.end(iz);return}if(Y.pathname==="/cancel"){let W=Y.searchParams.get("state"),H=W?[W]:[...t0.keys()];Q.writeHead(200),Q.end("Login cancelled");for(let B of H){let V=t0.get(B);if(!V)continue;V.reject(Error("Login cancelled")),f1(B)}if(b1()===0)E1();return}Q.writeHead(404),Q.end("Not found")},X=BZ(Z);await HZ(X,"127.0.0.1");let J=[X],z=BZ(Z);try{await HZ(z,"::1"),J.push(z)}catch(G){let Q=G.code;if(Q!=="EADDRNOTAVAIL"&&Q!=="EAFNOSUPPORT")throw KZ(X),G}return s3=J,{port:m$,redirectUri:$}})();try{return await w$}finally{w$=void 0}}function E1(){let $=s3;s3=[];for(let Z of $)KZ(Z)}function nz($,Z,X=300000,J){return new Promise((z,G)=>{if(J?.aborted){f1(Z),G(Error("Login cancelled"));return}let Q=setTimeout(()=>{if(t0.get(Z))f1(Z),G(Error("OAuth callback timeout — authorization took too long"))},X),Y=()=>{if(clearTimeout(Q),t0.get(Z))f1(Z),G(Error("Login cancelled"))};if(J)J.addEventListener("abort",Y);t0.set(Z,{pkce:$,state:Z,resolve:(W)=>{if(clearTimeout(Q),J)J.removeEventListener("abort",Y);z(W)},reject:(W)=>{if(clearTimeout(Q),J)J.removeEventListener("abort",Y);G(W)}})})}async function rz($){let Z=await fetch(`${k1}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"Content-Type":"application/json","User-Agent":VZ($)},body:JSON.stringify({client_id:i3})});if(!Z.ok)throw Error("Failed to initiate device authorization");let X=await Z.json();return{deviceData:X,url:`${k1}/codex/device`,instructions:`Enter code: ${X.user_code}`}}async function oz($,Z,X){let J=Math.max(parseInt($.interval,10)||5,1)*1000,z=typeof $.expires_in==="number"?$.expires_in:parseInt($.expires_in||"",10),G=!Number.isNaN(z)&&z>0?z*1000:900000,Q=Date.now();while(!0){if(X?.aborted)throw Error("Device authorization cancelled");if(Date.now()-Q>G)throw Error("Device authorization expired");let Y=await fetch(`${k1}/api/accounts/deviceauth/token`,{method:"POST",headers:{"Content-Type":"application/json","User-Agent":VZ(Z)},body:JSON.stringify({device_auth_id:$.device_auth_id,user_code:$.user_code})});if(Y.ok){let B=await Y.json(),V=await fetch(`${k1}/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:B.authorization_code,redirect_uri:`${k1}/deviceauth/callback`,client_id:i3,code_verifier:B.code_verifier}).toString()});if(!V.ok)throw Error(`Token exchange failed: ${V.status}`);return await V.json()}if(Y.status!==403&&Y.status!==404)throw Error(`Device authorization failed: ${Y.status}`);let W=G-(Date.now()-Q);if(W<=0)throw Error("Device authorization expired");let H=Math.min(J+wz,W);try{await hz(H,void 0,{signal:X})}catch(B){if(B instanceof Error&&B.name==="AbortError")throw Error("Device authorization cancelled");throw B}}}async function qZ($){let{label:Z,headless:X=!1,signal:J,version:z}=$;if(d8(Z),X){let{deviceData:B,url:V,instructions:U}=await rz(z),K=(async()=>{let j=await oz(B,z,J),M=Date.now(),D=p$(j);return{id:d8(Z||D||crypto.randomUUID()),label:Z||void 0,type:"oauth",access:j.access_token,refresh:j.refresh_token,expires:M+(j.expires_in??3600)*1000,enabled:!0,addedAt:M,lastUsed:M,lastRefreshedAt:M,accountId:D}})();return{url:V,instructions:U,completion:K}}let{redirectUri:G}=await az(),Q=await uz(),Y=UZ(crypto.getRandomValues(new Uint8Array(32)).buffer),W=dz(G,Q,Y),H=(async()=>{try{if(J?.aborted)throw Error("Login cancelled");let B=await nz(Q,Y,void 0,J),V=Date.now(),U=p$(B);return{id:d8(Z||U||crypto.randomUUID()),label:Z||void 0,type:"oauth",access:B.access_token,refresh:B.refresh_token,expires:V+(B.expires_in??3600)*1000,enabled:!0,addedAt:V,lastUsed:V,lastRefreshedAt:V,accountId:U}}finally{f1(Y)}})();return{url:W,instructions:"Complete authorization in your browser. This window will close automatically.",completion:H}}import{basename as tz,dirname as ez,join as $G}from"node:path";var a3="openai-auth.json",DZ="openai-auth-state.json";function c8($){return tz($)===a3?$G(ez($),DZ):`${$}.state.json`}function n3($){if($==null||$==="")return;let Z=typeof $==="number"?$:Number($);if(Number.isFinite(Z)){let J=Z<100000000000?Z*1000:Z,z=new Date(J);return Number.isNaN(z.getTime())?void 0:z.toISOString()}let X=new Date($);return Number.isNaN(X.getTime())?void 0:X.toISOString()}function s8($){let Z=Number($);return Number.isFinite(Z)&&Z>0?Z:void 0}function NZ($){return typeof $==="number"&&Number.isFinite($)&&$>=0?$:void 0}function MZ($,Z){let X=$.get(Z);if(X===null||X.trim()==="")return;let J=Number(X);if(!Number.isFinite(J)||J<0||J>100)return;let z=Z.slice(0,-13),G=s8($.get(`${z}-window-minutes`)),Q=n3($.get(`${z}-reset-at`)??void 0);if(J===0&&$.get(`${z}-window-minutes`)==="0"&&!Q)return;return{usedPercent:J,remainingPercent:100-J,resetsAt:Q,checkedAt:Date.now(),...G!==void 0?{windowMinutes:G}:{}}}var PZ=["x-codex-primary-used-percent","x-codex-secondary-used-percent"];function OZ($,Z){let X=$.get(Z);if(X===null)return"absent";if(X.trim()==="")return"invalid";let J=Number(X);return Number.isFinite(J)&&J>=0&&J<=100?"valid":"invalid"}function _Z($){if(PZ.some((z)=>OZ($,z)==="invalid"))return{};let Z={},X=MZ($,"x-codex-primary-used-percent");if(X)Z.primary=X;let J=MZ($,"x-codex-secondary-used-percent");if(J)Z.secondary=J;return Z}function CZ($){let Z=PZ.map((X)=>OZ($,X));return Z.includes("valid")&&!Z.includes("invalid")}function LZ($){if(!$)return;if(!Number.isFinite($.used_percent)||$.used_percent<0||$.used_percent>100)return;let Z=s8($.window_minutes),X=n3($.reset_at);if($.used_percent===0&&Z===void 0&&!X)return;return{usedPercent:$.used_percent,remainingPercent:100-$.used_percent,resetsAt:X,checkedAt:Date.now(),...Z!==void 0?{windowMinutes:Z}:{}}}function TZ($){let Z={},X=LZ($.rate_limits?.primary);if(X)Z.primary=X;let J=LZ($.rate_limits?.secondary);if(J)Z.secondary=J;return Z}function W$($){if($==null||$==="")return;let Z=Number($);return Number.isFinite(Z)&&Z>=0?Z:void 0}function FZ($){if(!$)return;if(!Number.isFinite($.used_percent)||$.used_percent<0||$.used_percent>100)return;let Z=s8($.limit_window_seconds),X=n3($.reset_at);if($.used_percent===0&&Z===void 0&&!X)return;return{usedPercent:$.used_percent,remainingPercent:100-$.used_percent,resetsAt:X,checkedAt:Date.now(),...Z!==void 0?{windowMinutes:Z/60}:{}}}function AZ($){let Z={},X=FZ($.rate_limit?.primary_window);if(X)Z.primary=X;let J=FZ($.rate_limit?.secondary_window);if(J)Z.secondary=J;let z=NZ($.rate_limit_reset_credits?.available_count);if(z!==void 0)Z.resetCreditsAvailable=z;let G=NZ($.rate_limit_reset_credits?.applicable_available_count);if(G!==void 0)Z.resetCreditsApplicable=G;let Q=$.spend_control?.individual_limit;if($.spend_control===null||Q===null)Z.spendControlCleared=!0;if(Q&&typeof $.spend_control?.reached==="boolean"){let W=W$(Q.limit),H=W$(Q.used),B=W$(Q.remaining),V=W$(Q.used_percent),U=W$(Q.remaining_percent);if(W!==void 0&&H!==void 0&&B!==void 0&&V!==void 0&&U!==void 0)Z.spendControl={limit:W,used:H,remaining:B,usedPercent:V,remainingPercent:U,resetsAt:n3(Q.reset_at),unit:Q.unit,source:Q.source,reached:$.spend_control.reached}}let Y=$.credits;if(Y&&typeof Y.has_credits==="boolean"&&typeof Y.unlimited==="boolean"&&typeof Y.overage_limit_reached==="boolean"){let W=W$(Y.balance);Z.credits={hasCredits:Y.has_credits,unlimited:Y.unlimited,overageLimitReached:Y.overage_limit_reached,...W!==void 0?{balance:W}:{}}}return Z}import{readdirSync as wG,statSync as mG}from"node:fs";import{tmpdir as G7,userInfo as pG}from"node:os";import{join as j$}from"node:path";import{debuglog as jG}from"node:util";import{createHmac as zG,randomBytes as GG,timingSafeEqual as QG}from"node:crypto";import JG from"node:net";var F0=2,r3=21,o3=5,i8=67108864,T;(function($){$[$.Request=0]="Request",$[$.Response=1]="Response",$[$.Push=2]="Push",$[$.StreamData=3]="StreamData",$[$.StreamEnd=4]="StreamEnd",$[$.Error=5]="Error",$[$.Cancel=6]="Cancel",$[$.Ping=7]="Ping",$[$.Pong=8]="Pong",$[$.Hello=9]="Hello",$[$.HelloAck=10]="HelloAck",$[$.Goodbye=11]="Goodbye"})(T||(T={}));var RZ=T.Goodbye;function SZ($){return $===T.Cancel||$===T.Ping||$===T.Pong||$===T.Goodbye}var r;(function($){$[$.Passive=0]="Passive",$[$.Interactive=1]="Interactive",$[$.Background=2]="Background"})(r||(r={}));var W0;(function($){$[$.Normal=0]="Normal",$[$.Expedite=1]="Expedite",$[$.Sheddable=2]="Sheddable"})(W0||(W0={}));var IZ=1,xZ=6,a8=1,ZG=8,bZ=48,n8=4;var EZ=0;function K0($,Z,X,J=W0.Normal){let z=0;if($)z|=IZ;if(z|=Z<<a8,X)z|=ZG;return z|=J<<n8,z}function r8($){return($&IZ)!==0}function kZ($){let Z=new Uint8Array(21),X=new DataView(Z.buffer);return X.setUint32(0,$.len,!0),Z[4]=$.ver,Z[5]=$.ty,Z[6]=$.flags,X.setUint16(7,$.channel,!0),X.setUint32(9,$.epoch,!0),X.setBigUint64(13,$.corr,!0),Z}class m extends Error{code;constructor($,Z){super($);this.code=Z,this.name="DecodeError"}}function XG($){let Z=$.len>>>0,X=$.ver>>>0&255,J=$.ty>>>0&255,z=$.flags>>>0&255,G=$.channel>>>0&65535,Q=$.epoch>>>0;if(BigInt.asUintN(64,$.corr),X!==2)throw new m(`unsupported envelope version ${X}`,"unsupported_version");if(J>RZ)throw new m(`unknown frame type byte ${J}`,"unknown_frame_type");let Y=J;if((z&EZ)!==0)throw new m(`reserved flag bits set in flags 0b${z.toString(2).padStart(8,"0")}`,"reserved_flag_bits");if((z&xZ)>>a8===3)throw new m(`reserved priority bits set in flags 0b${z.toString(2).padStart(8,"0")}`,"reserved_priority_bits");let W=(z&bZ)>>n8;if(W===3)throw new m(`reserved admission class set in flags 0b${z.toString(2).padStart(8,"0")}`,"reserved_admission_class");if(W===W0.Sheddable&&Y!==T.Push&&Y!==T.StreamData)throw new m(`SHEDDABLE admission class is illegal on ${T[Y]} in flags 0b${z.toString(2).padStart(8,"0")}`,"sheddable_illegal_frame_type");if(G===0&&Q!==0)throw new m(`control channel carried nonzero epoch ${Q}`,"nonzero_epoch_on_control_channel");if(SZ(Y)&&Z!==0)throw new m(`pure-header frame ${T[Y]} declared non-zero body length ${Z}`,"pure_header_frame_with_body")}function o8($){if($.length<5)throw new m(`header shorter than frozen prefix: have ${$.length} bytes`,"too_short_for_prefix");let Z=$[4];if(Z!==2)throw new m(`unsupported envelope version ${Z}`,"unsupported_version");if($.length<21)throw new m(`header too short for version: have ${$.length} bytes, need 21`,"too_short_for_header");let X=new DataView($.buffer,$.byteOffset,$.byteLength),J=X.getUint32(0,!0),z=$[5];if(z>RZ)throw new m(`unknown frame type byte ${z}`,"unknown_frame_type");let G=z,Q=$[6];if((Q&EZ)!==0)throw new m(`reserved flag bits set in flags 0b${Q.toString(2).padStart(8,"0")}`,"reserved_flag_bits");if((Q&xZ)>>a8===3)throw new m(`reserved priority bits set in flags 0b${Q.toString(2).padStart(8,"0")}`,"reserved_priority_bits");let Y=(Q&bZ)>>n8;if(Y===3)throw new m(`reserved admission class set in flags 0b${Q.toString(2).padStart(8,"0")}`,"reserved_admission_class");if(Y===W0.Sheddable&&G!==T.Push&&G!==T.StreamData)throw new m(`SHEDDABLE admission class is illegal on ${T[G]} in flags 0b${Q.toString(2).padStart(8,"0")}`,"sheddable_illegal_frame_type");let W=X.getUint16(7,!0),H=X.getUint32(9,!0);if(W===0&&H!==0)throw new m(`control channel carried nonzero epoch ${H}`,"nonzero_epoch_on_control_channel");if(SZ(G)&&J!==0)throw new m(`pure-header frame ${T[G]} declared non-zero body length ${J}`,"pure_header_frame_with_body");return{len:J,ver:Z,ty:G,flags:Q,channel:W,epoch:H,corr:X.getBigUint64(13,!0)}}function B0($,Z,X,J,z,G){return w0(2,$,Z,X,J,z,G)}function w0($,Z,X,J,z,G,Q){if(Q.length>67108864)throw new m(`frame body ${Q.length} exceeds max 67108864`,"frame_body_too_large");let Y={len:Q.length,ver:$,ty:Z,flags:X,channel:J,epoch:z,corr:G};return XG(Y),{header:Y,body:Q}}function x0($){if($.header.len!==$.body.length)throw new m(`frame header length ${$.header.len} does not match body length ${$.body.length}`,"frame_length_mismatch");let Z=kZ($.header),X=new Uint8Array(Z.length+$.body.length);return X.set(Z,0),X.set($.body,Z.length),X}class e0 extends Error{}class b0 extends Error{}class m0 extends Error{cause;constructor($,Z){super($);this.cause=Z}}class j1 extends Error{cause;constructor($,Z){super($);this.cause=Z}}function fZ($){return Buffer.from($.buffer,$.byteOffset,$.byteLength)}var yZ=Symbol("subc.socket.writeBorrowed"),vZ=Symbol("subc.socket.writeTrackedBorrowed");function E0($,Z,X){let J=$[yZ];return J?J.call($,Z,X):$.write(Z,X)}function t8($,Z,X){let J=$[vZ];return J?J.call($,Z,X):$.writeTracked(Z,X)}class y1{sock;chunks=[];buffered=0;waiter=null;closedErr=null;bufferedBytes(){return this.buffered}constructor($){this.sock=$,$.on("data",(X)=>{this.chunks.push(X),this.buffered+=X.length,this.tryServe()});let Z=(X)=>{if(!this.closedErr)this.closedErr=X;this.tryServe()};$.on("error",(X)=>Z(X instanceof Error?X:Error(String(X)))),$.on("end",()=>Z(new e0("subc closed the connection"))),$.on("close",()=>Z(new e0("subc connection closed")))}localPort(){return this.sock.localPort??null}static connect($,Z,X){return new Promise((J,z)=>{let G=JG.connect({host:$,port:Z});G.setNoDelay(!0);let Q=setTimeout(()=>{G.destroy(),z(new b0(`timed out connecting to ${$}:${Z}`))},Math.max(0,X-Date.now()));G.once("connect",()=>{clearTimeout(Q),J(new y1(G))}),G.once("error",(Y)=>{clearTimeout(Q),z(Y)})})}async readFrame($,Z,X){let J=await this.readExact(o3,$),z=J[4];if(z!==F0)throw new m(`unsupported envelope version ${z}`,"unsupported_version");let G=await this.readExact(r3-o3,$),Q=new Uint8Array(r3);Q.set(J),Q.set(G,o3);let Y=o8(Q);if(Y.len>i8)throw new m(`frame body ${Y.len} exceeds max ${i8}`,"frame_body_too_large");X?.();let W=typeof Z==="number"?Z:Date.now()+Z.afterHeaderMs,H=Y.len===0?new Uint8Array(0):await this.readExact(Y.len,W);return{header:Y,body:H}}readExact($,Z){if(this.waiter)return Promise.reject(Error("concurrent readExact is not supported"));if($===0)return Promise.resolve(new Uint8Array(0));return new Promise((X,J)=>{let z=null;if(Number.isFinite(Z)){let G=Z-Date.now();if(G<=0){J(new b0(`timed out waiting for ${$} bytes`));return}z=setTimeout(()=>{this.waiter=null,J(new b0(`timed out waiting for ${$} bytes`))},G)}this.waiter={need:$,resolve:X,reject:J,timer:z},this.tryServe()})}async write($,Z){await this.writeBuffer(Buffer.from($),Z)}writeTracked($,Z){return this.writeTrackedBuffer(Buffer.from($),Z)}async[yZ]($,Z){await this.writeBuffer(fZ($),Z)}[vZ]($,Z){return this.writeTrackedBuffer(fZ($),Z)}async writeBuffer($,Z){try{await this.writeTrackedBuffer($,Z).completed}catch(X){if(X instanceof m0||X instanceof j1)throw X.cause??X;throw X}}writeTrackedBuffer($,Z){if(this.closedErr)return{queued:!1,completed:Promise.reject(new m0("subc socket was closed before bytes could be queued",this.closedErr))};let X=!1,J=!1,z=null,G=new Promise((Q,Y)=>{let W=(B)=>{if(J)return;if(J=!0,z)clearTimeout(z);B()},H=Z-Date.now();if(H<=0){W(()=>Y(new m0("timed out before bytes could be queued to subc",new b0("timed out writing to subc"))));return}z=setTimeout(()=>{let B=new b0("timed out writing to subc");W(()=>Y(X?new j1("timed out after bytes were handed to the subc socket",B):new m0("timed out before bytes could be queued to subc",B)))},H);try{this.sock.write($,(B)=>{W(()=>{if(B)Y(new j1("subc socket reported a write error after bytes were handed to the socket",B instanceof Error?B:Error(String(B))));else Q()})}),X=!0}catch(B){W(()=>Y(new m0("subc socket write threw before bytes could be queued",B instanceof Error?B:Error(String(B)))))}});return{queued:X,completed:G}}close(){this.sock.destroy()}tryServe(){let $=this.waiter;if(!$)return;if(this.buffered>=$.need){let Z=this.take($.need);if(this.waiter=null,$.timer)clearTimeout($.timer);$.resolve(Z);return}if(this.closedErr){if(this.waiter=null,$.timer)clearTimeout($.timer);$.reject(this.closedErr)}}take($){let Z=Buffer.allocUnsafe($),X=0;while(X<$){let J=this.chunks[0],z=$-X;if(J.length<=z)J.copy(Z,X),X+=J.length,this.chunks.shift();else J.copy(Z,X,0,z),this.chunks[0]=J.subarray(z),X+=z}return this.buffered-=$,Z}}var wZ=32;var t3=4096,mZ="subc-server-v1",pZ="subc-client-v1",YG="client";class q0 extends Error{}function $2($,Z,X,J,z){let G=zG("sha256",Buffer.from($));return G.update(Buffer.from(Z,"utf8")),G.update(Buffer.from(X)),G.update(Buffer.from(J)),G.update(Buffer.from(z)),new Uint8Array(G.digest())}function gZ($,Z){if($.length!==Z.length)return!1;return QG(Buffer.from($),Buffer.from(Z))}async function hZ($,Z,X){let J=Buffer.from(JSON.stringify(Z),"utf8");if(J.length>t3)throw new q0(`auth message too large: ${J.length} > ${t3}`);let z=new Uint8Array(4);new DataView(z.buffer).setUint32(0,J.length,!0),await E0($,z,X),await E0($,J,X)}async function WG($,Z){let X=await $.readExact(4,Z),J=new DataView(X.buffer,X.byteOffset,4).getUint32(0,!0);if(J>t3)throw new q0(`auth message too large: ${J} > ${t3}`);let z=J===0?new Uint8Array(0):await $.readExact(J,Z);try{return JSON.parse(Buffer.from(z).toString("utf8"))}catch(G){throw new q0(`auth message JSON decode failed: ${String(G)}`)}}function e8($,Z){if(!Array.isArray($))throw new q0(`auth field '${Z}' must be a byte array`);for(let X of $)if(typeof X!=="number"||!Number.isInteger(X)||X<0||X>255)throw new q0(`auth field '${Z}' has invalid byte ${String(X)}`);return Uint8Array.from($)}async function u$($,Z,X){let J=new Uint8Array(GG(wZ));await hZ($,{client_nonce:Array.from(J),role:YG},X);let z=await WG($,X),G=e8(z.server_nonce,"server_nonce"),Q=e8(z.daemon_id,"daemon_id"),Y=e8(z.server_proof,"server_proof"),W=$2(Z.key,mZ,J,G,Q);if(!gZ(W,Y))throw new q0("server proof mismatch — wrong key or impostor daemon");if(!gZ(Q,Z.daemonId))throw new q0("daemon id mismatch — connection file points at a different daemon");let H=$2(Z.key,pZ,J,G,Q);await hZ($,{client_auth:Array.from(H)},X)}import{promises as Z2}from"node:fs";var uZ=1,lZ=32,dZ=16;class Z0 extends Error{}function cZ($,Z){if(!Array.isArray($))throw new Z0(`connection file field '${Z}' must be a JSON array of bytes`);for(let X of $)if(typeof X!=="number"||!Number.isInteger(X)||X<0||X>255)throw new Z0(`connection file field '${Z}' has invalid byte ${String(X)}`);return Uint8Array.from($)}function BG($){if($.schema!==uZ)throw new Z0(`unsupported connection file schema ${$.schema}; expected ${uZ}`);if($.endpoints.length===0)throw new Z0("connection file must include at least one endpoint");if($.key.length<lZ)throw new Z0(`connection file key is too short: ${$.key.length} bytes, need at least ${lZ}`);if($.daemonId.length!==dZ)throw new Z0(`connection file daemon_id must be ${dZ} bytes, got ${$.daemonId.length}`)}async function HG($){if(process.platform==="win32")return;let X=(await Z2.stat($)).mode&511;if((X&63)!==0)throw new Z0(`connection file ${$} has insecure permissions 0o${X.toString(8)}; expected owner-only 0600`)}async function B$($){await HG($);let Z=await Z2.readFile($,"utf8"),X;try{X=JSON.parse(Z)}catch(Y){throw new Z0(`connection file JSON read failed for ${$}: ${String(Y)}`)}let J=X.wire_version;if(J!==void 0&&J!==F0)throw new Z0(`connection file wire_version ${String(J)} but this client speaks ${F0}; the client library must be upgraded`);let z=X.endpoints;if(!Array.isArray(z))throw new Z0("connection file 'endpoints' must be an array");let G=z.map((Y)=>{let W=Y;if(typeof W.host!=="string"||typeof W.port!=="number")throw new Z0("connection file endpoint must be { host: string, port: number }");return{host:W.host,port:W.port}}),Q={schema:X.schema,endpoints:G,key:cZ(X.key,"key"),daemonId:cZ(X.daemon_id,"daemon_id"),pid:X.pid,daemonVer:X.daemon_ver??""};return BG(Q),Q}var sZ=new WeakMap,X2=new WeakMap;class J2 extends Error{methodFamily;code="reverse_request_capability_not_declared";constructor($){super(`reverse-request capability ${JSON.stringify($)} was not registered before route.open`);this.methodFamily=$,this.name="ReverseRequestRegistrationError"}}class U1{handlers=new Map;declaredFamilies=null;onRequest($,Z){if(!VG($))throw TypeError(`reverse-request method family must be a capability identifier, got ${JSON.stringify($)}`);if(typeof Z!=="function")throw TypeError("reverse-request handler must be a function");if(this.declaredFamilies&&!this.declaredFamilies.has($))throw new J2($);this.handlers.set($,Z)}capabilities(){return[...this.handlers.keys()].sort()}handler($){return this.handlers.get($)}seal(){this.declaredFamilies??=new Set(this.handlers.keys())}}class e3{channel;epoch;constructor($,Z,X,J){if(!Number.isInteger($)||$<=0||$>65535)throw RangeError(`route channel must be an integer in 1..65535, got ${$}`);if(!Number.isInteger(Z)||Z<=0||Z>4294967295)throw RangeError(`route epoch must be an integer in 1..4294967295, got ${Z}`);this.channel=$,this.epoch=Z,J.seal(),sZ.set(this,X),X2.set(this,J),Object.freeze(this)}onRequest($,Z){X2.get(this).onRequest($,Z)}static create($,Z,X,J){return new e3($,Z,X,J)}}function $6($,Z,X,J=new U1){return e3.create($,Z,X,J)}function iZ($,Z){return X2.get($)?.handler(Z)}function VG($){return/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/.test($)}class $1 extends Error{handle;code="stale_route_handle";constructor($){super(`route handle (${$.channel}, ${$.epoch}) is not live on the current connection`);this.handle=$,this.name="StaleRouteHandleError"}}function H$(){return Object.freeze({})}function l$($,Z){return sZ.get($)===Z}function Z6($,Z){return $===Z}var aZ=jG("subc-client"),UG=1e4,V$=30000,KG=50,qG=2000,nZ="request_deadline",z2="deadline_exceeded_no_drop_observed",DG=30000,NG=30000,rZ=new Uint8Array(0),MG="management_surface",G6="SUBC_MODULE_ID",Q6="SUBC_LAUNCH_NONCE",Y6={baseMs:100,capMs:2000,maxAttempts:6};class X0 extends Error{kind;code;cause;constructor($,Z,X,J){super(Z);this.kind=$,this.code=X,this.cause=J,this.name="SubcCallError"}get detail(){return this.cause instanceof k?this.cause.detail:void 0}}class k extends Error{code;detail;constructor($,Z,X){super($);this.code=Z,this.detail=X}}var oZ=new WeakMap;function G2($){if($ instanceof Uint8Array)return $;let Z=$===null?"null":Array.isArray($)?"array":typeof $;throw new k(`binary request body must be a Uint8Array; got ${Z}`,"binary_body_required")}class v1{sock;currentConn;opts;nextCorr=1n;pending=new Map;lateResponses=new Map;routes=new Map;liveRoutes=new Map;connectionToken=H$();ingressEpochDropCount=0;closedErr=null;closeStarted=!1;reconnecting=null;generation=1;readerActive=!1;constructor($,Z,X){this.sock=$,this.currentConn=Z,this.opts=X,this.readLoop($,this.generation)}get conn(){return this.currentConn}static async connect($){let Z=PG($),X=await v1.openConnection(Z);return new v1(X.sock,X.conn,Z)}async catalogList($){let Z=this.encode($===void 0?{op:"catalog.list"}:{op:"catalog.list",module_id:$}),X=await this.controlRpc(Z);return this.parseJson(X).modules??[]}async resolveProvider($){let Z=await this.resolveProviders($);if(Z.length===0)throw new k(`no catalog claimant for capability ${$}`,"capability_unprovided");if(Z.length>1)throw new k(`multiple catalog claimants for capability ${$}: ${Z.join(", ")}`,"capability_ambiguous");return Z[0]}async resolveProviders($){if(!Z7($))throw new k(`malformed capability identifier ${JSON.stringify($)}`,"invalid_capability_identifier");return(await this.catalogList()).filter((X)=>X.capabilities?.provides.includes($)??!1).map((X)=>X.module_id).sort()}async routeOpen($,Z,X={}){let J=Q2(X),z=X.reverseRequests??new U1;z.seal();let G=z.capabilities(),Q=this.encode({op:"route.open",target:$,identity:Z,...J?{consumer_identity:J}:{},...G.length>0?{consumer_capabilities:G}:{}}),Y=null,W=(B)=>{if(B.header.ty!==T.Response)return!0;let V=this.parseJson(B);if(typeof V.route_channel!=="number"||typeof V.route_epoch!=="number")throw new k(`route.open returned no route handle: ${JSON.stringify(V)}`);return Y=this.installRoute(V.route_channel,V.route_epoch,z),!0},H=(B)=>{if(B.header.ty!==T.Response)return;try{let V=this.parseJson(B);if(typeof V.route_channel!=="number"||typeof V.route_epoch!=="number")return;let U=this.installRoute(V.route_channel,V.route_epoch);this.failHandle(U,new k("late route.open was closed","route_closed")),this.liveRoutes.delete(U.channel),this.sendRouteGoodbye(U,!0)}catch{this.closeConnectionAfterCleanupFailure()}};if(await this.controlRpc(Q,W,H),!Y)throw new k("route.open response was not installed");return Y}async request($,Z,X={}){this.assertLiveHandle($);let J=X.binary??!1,z=J?G2(Z):Z instanceof Uint8Array?Z:this.encode(Z),G=X.priority??r.Interactive,Q=X.admissionClass??W0.Normal,Y=await this.send($,z,G,Q,X.timeoutMs,X.onProgress,void 0,void 0,J,X.signal);return this.decodeReply(Y)}async call($,Z,X,J={}){if(J.binary)throw new k("call() builds a JSON body and cannot send a binary request; use callBinary(moduleId, body, opts) with a Uint8Array","binary_call_requires_call_binary");let z=X===void 0?{method:Z}:{method:Z,params:X};return await this.managedCall($,z,J)}async callBinary($,Z,X={}){let J=G2(Z);return this.managedCall($,J,{...X,binary:!0})}async managedCall($,Z,X){let J=!1;for(;;){let z=await this.cachedRouteHandle($,X);try{return await this.managedRequest(z,Z,X)}catch(G){if(!(G instanceof X0))throw this.terminalCallError("managed call failed",G);let Q=W6(G.cause instanceof k?oZ.get(G.cause)??0:0,G.code);if(Q&&!J&&!this.closeStarted){J=!0,this.evictRouteHandle(z);continue}if(Q&&J)this.evictRouteHandle(z);if(G.code==="route_closed")throw this.evictRouteHandle(z),G;if(G.kind==="not_sent"){if(!this.closedErr)throw G;try{await this.reconnectAfterDrop(G)}catch(Y){throw this.notSentRecoveryError("managed call was not sent",Y)}continue}if(G.kind==="outcome_unknown"&&G.code!==z2){if(this.closedErr)this.scheduleReconnectAfterDrop(G)}else if(G.kind==="outcome_unknown"&&G.code===z2)this.probeLivenessAfterDeadline();throw G}}}subscribe($,Z,X,J={}){this.assertLiveHandle($);let z=Z instanceof Uint8Array?Z:this.encode(Z),G=J.priority??r.Interactive,Q=J.admissionClass??W0.Normal,Y=this.allocateCorr(),W=X6($,Y),H=null,B=null,V=new Promise((j,M)=>{if(this.closedErr){M(this.closedErr);return}B=j,H={handle:$,resolve:()=>j(),reject:M,onProgress:X,timer:null,subscription:!0},this.pending.set(W,H);let D=B0(T.Request,K0(!1,G,!1,Q),$.channel,$.epoch,Y,z);E0(this.sock,x0(D),Date.now()+V$).catch((q)=>{let F=this.pending.get(W);if(F)this.rejectPending(W,F,q instanceof Error?q:new k(String(q)))})}),U=!1;return{unsubscribe:()=>{if(U)return;if(U=!0,H&&B)this.settle(W,H,B);if(this.isLiveHandle($))this.cancel($,Y,G)},closed:V}}attachCancelSignal($,Z,X,J,z){if(!X)return;let G=()=>{if(!this.pending.has(Z))return;try{this.cancel(X,J,z)}catch{}};if($.aborted){G();return}$.addEventListener("abort",G,{once:!0});let Q=this.pending.get(Z);if(Q){let Y=Q.onSettle;Q.onSettle=()=>{Y?.(),$.removeEventListener("abort",G)}}}cancel($,Z,X=r.Interactive){this.assertLiveHandle($);let J=B0(T.Cancel,K0(!1,X,!1),$.channel,$.epoch,Z,rZ);E0(this.sock,x0(J),Date.now()+V$).catch(()=>{return})}async routePoll($,Z){this.assertLiveHandle($);let X=this.encode({op:"route.poll",route_channel:$.channel,route_epoch:$.epoch,kind:Z}),J=await this.controlRpc(X,(z)=>{if(z.header.ty!==T.Response)return!0;let G=this.parseJson(z);return G.route_channel===$.channel&&G.route_epoch===$.epoch});return this.parseJson(J)}async closeRoute($,Z={}){this.assertLiveHandle($);for(let[X,J]of this.routes)if(J.handle&&Z6(J.handle,$))J.closed=!0,J.handle=null,this.routes.delete(X);if(Z.drain)await this.drainUnaryOnHandle($);if(this.failHandle($,new k("route closed by closeRoute","route_closed")),this.liveRoutes.get($.channel)===$)this.liveRoutes.delete($.channel);this.sendRouteGoodbye($)}async closeManagedRoute($,Z,X={}){let J=tZ($,Z,Q2(X),(X.reverseRequests??new U1).capabilities()),z=this.routes.get(J);if(!z)return;z.closed=!0,this.routes.delete(J);let G=z.handle;if(z.handle=null,G)await this.closeRoute(G,X)}async closeRouteChannel($,Z={}){await this.closeRoute($,Z)}close(){this.closeStarted=!0,this.fail(new k("client closed")),this.sock.close()}drainUnaryOnHandle($){let Z=[];for(let X of this.pending.values())if(X.handle===$&&!X.subscription)Z.push(new Promise((J)=>{let z=X.onSettle;X.onSettle=()=>{z?.(),J()}}));return Promise.all(Z).then(()=>{return})}sendRouteGoodbye($,Z=!1){if(this.assertLiveConnection($),this.closedErr){if(Z)this.closeConnectionAfterCleanupFailure();return}let X=B0(T.Goodbye,K0(!1,r.Interactive,!1),$.channel,$.epoch,0n,rZ),J=t8(this.sock,x0(X),Date.now()+V$);if(!J.queued&&Z)this.closeConnectionAfterCleanupFailure();J.completed.catch(()=>{if(Z&&!J.queued)this.closeConnectionAfterCleanupFailure()})}static async openConnection($){let Z=await B$($.connectionFile),X=Date.now()+($.handshakeTimeoutMs??UG),J=Z.endpoints[0],z=await y1.connect(J.host,J.port,X);try{await u$(z,Z,X)}catch(G){throw z.close(),G}return{sock:z,conn:Z}}async controlRpc($,Z,X){return this.send(null,$,r.Interactive,W0.Normal,void 0,void 0,Z,X)}send($,Z,X,J,z,G,Q,Y,W=!1,H){if($)this.assertLiveHandle($);if(this.closedErr)return Promise.reject(this.closedErr);let B;try{B=this.allocateCorr()}catch(M){return Promise.reject(M)}let V=X6($,B),U=$?.channel??0,K=$?.epoch??0,j=B0(T.Request,K0(W,X,!1,J),U,K,B,Z);return new Promise((M,D)=>{let q=z??V$,F={handle:$,resolve:M,reject:D,onProgress:G,timer:null,acceptFrame:Q,onLateResponse:Y};if(F.timer=setTimeout(()=>this.arbitrateTimeout(V,F,U,B,q),q),this.pending.set(V,F),H)this.attachCancelSignal(H,V,$,B,X);E0(this.sock,x0(j),Date.now()+q).catch((C)=>{let L=this.pending.get(V);if(L)this.rejectPending(V,L,C instanceof Error?C:new k(String(C)))})})}arbitrateTimeout($,Z,X,J,z){let G=()=>{if(Z.onLateResponse)this.lateResponses.set($,Z.onLateResponse);this.rejectPending($,Z,new k(this.timeoutMessage(X,J,z),nZ))},Q=Date.now()+this.opts.timeoutArbitrationGraceMs,Y=()=>{if(this.pending.get($)!==Z)return;if((this.readerActive||this.sock.bufferedBytes()>0)&&Date.now()<Q){setImmediate(Y);return}G()};setImmediate(Y)}async managedRequest($,Z,X){let J=X.binary??!1,z=J?G2(Z):Z instanceof Uint8Array?Z:this.encode(Z),G=X.priority??r.Interactive,Q=X.admissionClass??W0.Normal;try{let Y=await this.sendManaged($,z,G,Q,X.timeoutMs,X.onProgress,J,X.signal);return this.decodeReply(Y)}catch(Y){if(Y instanceof X0)throw Y;throw this.terminalCallError("managed call failed",Y)}}sendManaged($,Z,X,J,z,G,Q=!1,Y){try{this.assertLiveHandle($)}catch(K){return Promise.reject(this.notSentCallError("request used a stale route handle",K))}if(this.closedErr)return Promise.reject(this.notSentCallError("request was not sent because the subc connection was already closed",this.closedErr));let W;try{W=this.allocateCorr()}catch(K){return Promise.reject(this.notSentCallError("request correlation allocator was exhausted",K))}let H=X6($,W),B=B0(T.Request,K0(Q,X,!1,J),$.channel,$.epoch,W,Z),V=!1,U=(K)=>{if(!V)return this.notSentCallError("request bytes were not queued to the subc socket",K);if(K instanceof k&&K.code===nZ)return new X0("outcome_unknown",`managed call deadline exceeded after request bytes were queued to the local socket; no terminal response was observed; outcome unknown${d$(K)}`,z2,K);return this.outcomeUnknownCallError("connection dropped before the managed call returned a response",K)};return new Promise((K,j)=>{let M=z??V$,D={handle:$,resolve:K,reject:j,onProgress:G,timer:null,classifyFailure:U};if(D.timer=setTimeout(()=>this.arbitrateTimeout(H,D,$.channel,W,M),M),this.pending.set(H,D),Y)this.attachCancelSignal(Y,H,$,W,X);let q=t8(this.sock,x0(B),Date.now()+M);V=q.queued,q.completed.catch((F)=>{let C=this.pending.get(H);if(C)this.rejectPending(H,C,F instanceof Error?F:new k(String(F)))})})}async cachedRouteHandle($,Z){let X=Z.identity??this.opts.identity;if(!X)throw new X0("terminal","managed call requires a BindIdentity in SubcClient.connect({ identity }) or call(..., { identity })","missing_identity");let J={kind:Z.targetKind??this.opts.targetKind,module_id:$},z=Q2(Z),G=Z.reverseRequests??new U1;G.seal();let Q=tZ(J,X,z,G.capabilities()),Y=this.routes.get(Q);if(!Y)Y={key:Q,moduleId:$,target:J,identity:X,consumerIdentity:z,reverseRequests:G,handle:null,opening:null},this.routes.set(Q,Y);if(Y.handle&&this.isLiveHandle(Y.handle))return Y.handle;if(!Y.opening)Y.opening=this.openCachedRoute(Y).finally(()=>{Y.opening=null});return Y.opening}async openCachedRoute($){let Z=Date.now()+this.opts.routeOpenRetryDeadlineMs,X=this.opts.reconnectBackoff.baseMs,J=0;for(;;){if($.closed)throw this.routeClosedDuringOpen();try{await this.ensureConnectedForManaged()}catch(z){throw this.notSentRecoveryError("route.open could not run because reconnect failed",z)}if($.handle&&this.isLiveHandle($.handle))return $.handle;try{let z=await this.routeOpen($.target,$.identity,{consumerIdentity:$.consumerIdentity??null,reverseRequests:$.reverseRequests});if($.closed)throw this.liveRoutes.delete(z.channel),this.sendRouteGoodbye(z),this.routeClosedDuringOpen();return $.handle=z,z}catch(z){if(z instanceof X0&&z.code==="route_closed")throw z;if(!this.closeStarted&&J6(z)){try{await this.reconnectAfterDrop(z)}catch(G){throw this.notSentRecoveryError("route.open was not sent and reconnect failed",G)}continue}if(!this.closeStarted&&z instanceof k&&FG(z.code)){if(J+=1,Date.now()<Z){await this.opts.sleep(X),X=Math.min(X*2,this.opts.reconnectBackoff.capMs);continue}throw this.notSentCallError(`route.open failed for module ${$.moduleId}: ${z.code} (retry deadline exhausted after ${J} attempts)`,z)}throw this.terminalCallError(`route.open failed for module ${$.moduleId}`,z)}}}lastInboundAtMs=0;livenessProbe=null;hasControlPending(){for(let $ of this.pending.values())if($.handle===null)return!0;return!1}probeLivenessAfterDeadline(){if(this.livenessProbe||this.closeStarted||this.closedErr)return;if(this.hasControlPending())return;let $=this.sock,Z=this.generation,X;try{X=this.allocateCorr()}catch{return}let J=Date.now(),z=B0(T.Ping,K0(!1,r.Interactive,!1,W0.Normal),0,0,X,new Uint8Array),G=(async()=>{if(await E0($,x0(z),J+this.opts.livenessProbeWindowMs).catch(()=>{}),await this.opts.sleep(this.opts.livenessProbeWindowMs),this.sock!==$||this.generation!==Z||this.closeStarted)return;if(this.lastInboundAtMs>=J)return;if(this.hasControlPending())return;this.fail(new e0(`liveness probe convicted a half-open socket: no inbound frame for ${this.opts.livenessProbeWindowMs}ms after a channel-0 Ping (deadline-no-drop settles preceded this); closing so the next call reconnects`)),$.close()})().finally(()=>{this.livenessProbe=null});this.livenessProbe=G}async ensureConnectedForManaged(){if(this.closeStarted)throw new k("client closed");if(this.reconnecting)await this.reconnecting;if(this.closedErr)await this.reconnectAfterDrop(this.closedErr)}scheduleReconnectAfterDrop($){if(this.closeStarted||this.reconnecting)return;this.reconnectAfterDrop($).catch(()=>{})}reconnectAfterDrop($){if(this.closeStarted)return Promise.reject(new k("client closed"));if(this.reconnecting)return this.reconnecting;let Z=this.reconnectWithRetry($).finally(()=>{if(this.reconnecting===Z)this.reconnecting=null});return this.reconnecting=Z,Z}async reconnectWithRetry($){let Z=0,X=this.opts.reconnectBackoff.baseMs;for(;;){if(this.closeStarted)throw new k("client closed");Z+=1;try{let J=await v1.openConnection(this.opts);if(this.closeStarted)throw J.sock.close(),new k("client closed");this.replaceConnection(J),await this.reopenCachedRoutes();return}catch(J){if(!J6(J)||Z>=this.opts.reconnectBackoff.maxAttempts){if(J instanceof q0&&Z>1)throw new q0(`reconnect gave up after ${Z} attempts: ${J.message} — the connection file and the daemon's key disagree persistently `+"(daemon restarting in a loop, split connection-file paths, or a genuinely foreign daemon on this port); check the daemon, then restart this host app");throw J}await this.opts.sleep(X),X=Math.min(X*2,this.opts.reconnectBackoff.capMs)}}}replaceConnection($){this.fail(new k("subc connection replaced")),this.sock.close(),this.sock=$.sock,this.currentConn=$.conn,this.closedErr=null,this.generation+=1,this.connectionToken=H$(),this.liveRoutes.clear(),this.lateResponses.clear(),this.nextCorr=1n,this.readLoop($.sock,this.generation)}async reopenCachedRoutes(){let $=[...this.routes.keys()];for(let Z of $){let X=this.routes.get(Z);if(X)X.handle=null}for(let Z of $){let X=this.routes.get(Z);if(!X||X.closed)continue;try{let J=await this.routeOpen(X.target,X.identity,{consumerIdentity:X.consumerIdentity??null,reverseRequests:X.reverseRequests});if(X.closed){this.liveRoutes.delete(J.channel),this.sendRouteGoodbye(J);continue}X.handle=J}catch(J){if(LG(J)){this.routes.delete(Z);continue}throw J}}}timeoutMessage($,Z,X){let J=this.sock.localPort();return`request on ${J===null?"channel":`local_port=${J} channel`} ${$} corr ${Z} timed out after ${X}ms`}routeClosedDuringOpen(){return new X0("not_sent","route was closed before route.open completed","route_closed")}async readLoop($,Z){try{for(;;){this.readerActive=!1;let X=await $.readFrame(Number.POSITIVE_INFINITY,{afterHeaderMs:NG},()=>{this.readerActive=!0});try{if(this.sock===$&&this.generation===Z)this.dispatch(X)}finally{this.readerActive=!1}}}catch(X){if(this.sock===$&&this.generation===Z)this.fail(X instanceof Error?X:new k(String(X)))}}dispatch($){if(this.lastInboundAtMs=Date.now(),$.header.channel===0&&$.header.ty===T.Push){let G=this.opts.onControlPush;if(G){let Q=null;try{let Y=this.parseJson($);if(Y&&typeof Y.op==="string")Q={op:Y.op,body:Y}}catch{}if(Q)try{G(Q)}catch{}}return}let Z=null;if($.header.channel!==0){if(Z=this.liveRoutes.get($.header.channel)??null,!Z||Z.epoch!==$.header.epoch){this.ingressEpochDropCount+=1;return}}if($.header.ty===T.Request&&Z){this.dispatchReverseRequest($,Z);return}let X=X6(Z,$.header.corr),J=this.pending.get(X);if(J){if(J.acceptFrame&&!J.acceptFrame($))return;switch($.header.ty){case T.Push:case T.StreamData:try{J.onProgress?.($.body)}catch{}return;case T.Response:case T.StreamEnd:this.settle(X,J,()=>J.resolve($));return;case T.Error:this.settle(X,J,()=>J.reject(this.errorFromFrame($)));return;default:return}}let z=this.lateResponses.get(X);if(z&&($.header.ty===T.Response||$.header.ty===T.Error)){this.lateResponses.delete(X),z($);return}if($.header.ty===T.Goodbye&&Z){if(this.failHandle(Z,new k("route closed by subc (GOODBYE)","route_closed")),this.liveRoutes.get(Z.channel)===Z)this.liveRoutes.delete(Z.channel);this.evictRouteHandle(Z);return}if($.header.ty===T.Response||$.header.ty===T.Error||$.header.ty===T.StreamEnd)aZ("dropped terminal frame with no waiter: type=%d channel=%d epoch=%d corr=%s port=%s",$.header.ty,$.header.channel,$.header.epoch,$.header.corr,this.sock.localPort()??"?")}settle($,Z,X){if(this.pending.get($)!==Z)return!1;if(this.pending.delete($),Z.timer)clearTimeout(Z.timer);return X(),Z.onSettle?.(),!0}rejectPending($,Z,X){this.settle($,Z,()=>Z.reject(Z.classifyFailure?.(X)??X))}dispatchReverseRequest($,Z){let X=OG($.body),J=X?.split("/",1)[0],z=J?iZ(Z,J):void 0,G=this.sock,Q=this.generation;(async()=>{if(!z||!X){await this.sendReverseError($,Z,"reverse_request_unhandled",J?`no reverse-request handler is registered for ${J}`:"reverse request has no valid method",G,Q);return}let W;try{if(W=await z($.body,{corr:$.header.corr,method:X}),!(W instanceof Uint8Array))throw TypeError("reverse-request handler must return a Uint8Array")}catch(H){await this.sendReverseError($,Z,"reverse_request_unhandled",H instanceof Error?H.message:String(H),G,Q);return}await this.sendReverseReply($,Z,T.Response,W,G,Q)})().catch((W)=>{if(this.sock===G&&this.generation===Q&&!this.closeStarted)aZ("failed to answer reverse request: %s",d$(W))})}async sendReverseError($,Z,X,J,z,G){await this.sendReverseReply($,Z,T.Error,this.encode({code:X,message:J}),z,G)}async sendReverseReply($,Z,X,J,z,G){if(this.sock!==z||this.generation!==G||!this.isLiveHandle(Z)||this.closeStarted||this.closedErr)return;let Q=B0(X,K0(!1,r.Interactive,!1),Z.channel,Z.epoch,$.header.corr,J);await E0(z,x0(Q),Date.now()+V$)}errorFromFrame($){try{let Z=JSON.parse(Buffer.from($.body).toString("utf8")),X=new k(Z.message??"subc error",Z.code,Z.detail);return oZ.set(X,$.header.flags),X}catch{return new k(Buffer.from($.body).toString("utf8")||"subc error")}}evictRouteHandle($){for(let Z of this.routes.values())if(Z.handle&&Z6(Z.handle,$))Z.handle=null}failHandle($,Z){for(let[X,J]of this.pending)if(J.handle&&Z6(J.handle,$))this.rejectPending(X,J,Z)}fail($){if(!this.closedErr)this.closedErr=$;for(let[Z,X]of this.pending)this.rejectPending(Z,X,$)}notSentCallError($,Z){return new X0("not_sent",`${$}${d$(Z)}`,z6(Z),Z)}outcomeUnknownCallError($,Z){return new X0("outcome_unknown",`${$}${d$(Z)}`,z6(Z),Z)}terminalCallError($,Z){if(Z instanceof X0)return Z;return new X0("terminal",`${$}${d$(Z)}`,z6(Z),Z)}notSentRecoveryError($,Z){if(Z instanceof X0)return Z;if(J6(Z))return this.notSentCallError($,Z);return this.terminalCallError($,Z)}get droppedIngressFrames(){return this.ingressEpochDropCount}installRoute($,Z,X=new U1){let J=$6($,Z,this.connectionToken,X);return this.liveRoutes.set($,J),J}isLiveHandle($){return l$($,this.connectionToken)&&this.liveRoutes.get($.channel)===$}assertLiveConnection($){if(!l$($,this.connectionToken))throw new $1($)}assertLiveHandle($){if(!this.isLiveHandle($))throw new $1($)}allocateCorr(){let $=0xffffffffffffffffn;if(this.nextCorr>$){let X=new k("channel-0 correlation id allocator exhausted","corr_exhausted");throw this.fail(X),this.sock.close(),this.scheduleReconnectAfterDrop(X),X}let Z=this.nextCorr;return this.nextCorr+=1n,Z}closeConnectionAfterCleanupFailure(){let $=new k("late route cleanup could not be queued","late_route_cleanup_failed");this.fail($),this.sock.close(),this.scheduleReconnectAfterDrop($)}encode($){return Buffer.from(JSON.stringify($),"utf8")}decodeReply($){return r8($.header.flags)?$.body:this.parseJson($)}parseJson($){let Z=$.body;return JSON.parse(Buffer.from(Z.buffer,Z.byteOffset,Z.byteLength).toString("utf8"))}}function J6($){if($ instanceof e0||$ instanceof b0)return!0;if($ instanceof m0||$ instanceof j1)return!0;if($ instanceof X0)return $.kind==="not_sent"||$.kind==="outcome_unknown";if($ instanceof q0)return!0;if($ instanceof k||$ instanceof Z0)return!1;let Z=z6($);return Z==="ECONNREFUSED"||Z==="ECONNRESET"||Z==="EPIPE"||Z==="ETIMEDOUT"||Z==="ENOENT"}function LG($){return $ instanceof k&&typeof $.code==="string"}function FG($){if($==="capability_forbidden")return!1;return $==="module_reloading"||$==="module_warming"||$==="target_unavailable"||$==="module_timeout"}var eZ="unknown_channel",$7="stale_route_epoch";function W6($,Z){return Z===eZ||Z===$7}function PG($){return{connectionFile:$.connectionFile,handshakeTimeoutMs:$.handshakeTimeoutMs,identity:$.identity,targetKind:$.targetKind??MG,reconnectBackoff:$.reconnectBackoff??Y6,sleep:$.sleep??((Z)=>new Promise((X)=>setTimeout(X,Z))),routeOpenRetryDeadlineMs:$.routeOpenRetryDeadlineMs??DG,timeoutArbitrationGraceMs:$.timeoutArbitrationGraceMs??KG,livenessProbeWindowMs:$.livenessProbeWindowMs??qG,onControlPush:$.onControlPush}}function Z7($){if(/\s/u.test($))return!1;let Z=$.indexOf("/v");if(Z<=0||$.indexOf("/v",Z+1)!==-1)return!1;let X=$.slice(0,Z),J=$.slice(Z+2);if(new TextEncoder().encode(X).byteLength>64||J.length===0)return!1;if(!/^[a-z][a-z0-9-]*[a-z0-9]$/u.test(X)&&!/^[a-z]$/u.test(X))return!1;if(X.includes("--"))return!1;if(!/^\d+$/u.test(J)||J.length>1&&J.startsWith("0"))return!1;let z=Number(J);return Number.isSafeInteger(z)&&z>=1&&z<=4294967295}function tZ($,Z,X,J){let z=X?`${X.module_id}\x00${X.launch_nonce}`:"",G=[...J].sort().join("\x00");return`${$.kind}\x00${$.module_id}\x00${Z.project_root}\x00${Z.harness}\x00${Z.session}\x00${z}\x00${G}`}function Q2($={}){if($.consumerIdentity!==void 0)return $.consumerIdentity??void 0;let Z=process.env[G6],X=process.env[Q6];if(!Z||!X)return;return{module_id:Z,launch_nonce:X}}function z6($){if(typeof $==="object"&&$!==null&&"code"in $){let Z=$.code;if(typeof Z==="string")return Z}return}function d$($){if($===void 0)return"";return`: ${$ instanceof Error?$.message:String($)}`}function X6($,Z){return $?`${$.channel}:${$.epoch}:${Z}`:`0:0:${Z}`}function OG($){try{let Z=JSON.parse(Buffer.from($).toString("utf8"));return typeof Z.method==="string"&&Z.method.length>0?Z.method:void 0}catch{return}}import{Buffer as j2}from"node:buffer";var _G=1e4,CG=30000,J7=30000,TG=250,Y2=64,H2="health.check",z7=1n,AG=/^[0-9a-f]{32}$/;function V2($){let Z=$.machine_id;return typeof Z==="string"&&AG.test(Z)?Z:void 0}class H6{available;waiters=[];constructor($){if(!Number.isInteger($)||$<=0)throw new u("provider handler capacity must be a positive integer","invalid_handler_capacity");this.available=$}async acquire(){if(this.available>0)return this.available-=1,this.releaseOnce();return await new Promise(($)=>{this.waiters.push($)}),this.releaseOnce()}releaseOnce(){let $=!1;return()=>{if($)return;$=!0;let Z=this.waiters.shift();if(Z)Z();else this.available+=1}}}class u extends Error{code;kind;detail;constructor($,Z,X="terminal",J){super($);this.code=Z,this.kind=X,this.detail=J}}class c${sock;currentConn;opts;closed;resolveClosed=()=>{return};closeStarted=!1;closedErr=null;inflight=new Map;pending=new Map;liveRoutes=new Map;connectionToken=H$();nextCorr=1n;ingressEpochDropCount=0;requestGate=new H6(Y2);reconnecting=null;generation=1;connectionEpoch=1;stateQueue=[];drainingStateQueue=!1;restoredDebounceToken=0;storage;machineId;constructor($,Z,X,J){this.sock=$,this.currentConn=Z,this.opts=X,this.storage=J.storage,this.machineId=V2(J),this.closed=new Promise((z)=>{this.resolveClosed=z}),this.readLoop($,this.generation),this.enqueueConnectionState({state:"connected",epoch:this.connectionEpoch})}get droppedIngressFrames(){return this.ingressEpochDropCount}get conn(){return this.currentConn}currentEpoch(){return this.connectionEpoch}async request($,Z,X={}){this.assertLiveHandle($);let J=this.allocateCorr(),z=B6($,J),G=X.timeoutMs??J7,Q=B0(T.Request,K0(!1,X.priority??r.Interactive,!1,X.admissionClass??W0.Normal),$.channel,$.epoch,J,Z);return await new Promise((Y,W)=>{let H=setTimeout(()=>{if(this.pending.delete(z))W(new u("reverse request timed out","request_timeout"))},G);this.pending.set(z,{resolve:(B)=>Y(B.body),reject:W,timer:H}),this.sendOn(this.sock,this.generation,Q).catch((B)=>{let V=this.pending.get(z);if(!V)return;this.pending.delete(z),clearTimeout(V.timer),W(B instanceof Error?B:new u(String(B)))})})}async push($,Z,X={}){this.assertLiveHandle($),await this.sendOn(this.sock,this.generation,B0(T.Push,K0(!1,X.priority??r.Interactive,!1,X.admissionClass??W0.Normal),$.channel,$.epoch,0n,Z))}cancel($,Z){this.assertLiveHandle($),this.sendOn(this.sock,this.generation,B0(T.Cancel,p0(),$.channel,$.epoch,Z,new Uint8Array(0))).catch(()=>{return})}closeRoute($){this.assertLiveHandle($),this.liveRoutes.delete($.channel),this.abortHandle($),this.sendOn(this.sock,this.generation,B0(T.Goodbye,p0(),$.channel,$.epoch,0n,new Uint8Array(0))).catch(()=>{return})}static async connect($){if($.manifest.protocol_ver!==F0)throw new u(`manifest protocol_ver ${$.manifest.protocol_ver} does not match client protocol ${F0}`,"invalid_manifest");let Z=SG($),X=await c$.openConnection(Z);return new c$(X.sock,X.conn,Z,X.ack)}async close(){if(!this.closeStarted){this.closeStarted=!0,this.cancelRestoredDebounce();let $=this.sock;try{await B2($,B0(T.Goodbye,p0(),0,0,0n,new Uint8Array(0)))}catch{}finally{$.close(),this.finishClosed()}}await this.closed}static async openConnection($,Z){let X=await B$($.connectionFile),J=Date.now()+($.handshakeTimeoutMs??_G),z=X.endpoints[0],G=await y1.connect(z.host,z.port,J);try{Z?.(G),await u$(G,X,J),await B2(G,xG($));let Q=await fG(G,J);return{sock:G,conn:X,ack:Q}}catch(Q){throw G.close(),Q}}async readLoop($,Z){try{for(;;){let X=await $.readFrame(Number.POSITIVE_INFINITY,{afterHeaderMs:CG});if(!await this.dispatch(X,$,Z)){if(this.sock===$&&this.generation===Z)this.closeStarted=!0;break}}}catch(X){if(this.sock===$&&this.generation===Z&&!this.closeStarted){this.handleUnexpectedDrop($,Z,X instanceof Error?X:new u(String(X)));return}}finally{if(this.sock===$&&this.generation===Z){if($.close(),this.closeStarted)this.finishClosed()}}}async dispatch($,Z,X){let J=null;if($.header.channel!==0){if(J=this.liveRoutes.get($.header.channel)??null,!J||J.epoch!==$.header.epoch)return this.ingressEpochDropCount+=1,!0}if(J){let z=B6(J,$.header.corr),G=this.pending.get(z);if(G){if($.header.ty===T.Push||$.header.ty===T.StreamData)return!0;if($.header.ty===T.Response||$.header.ty===T.StreamEnd)return this.pending.delete(z),clearTimeout(G.timer),G.resolve($),!0;if($.header.ty===T.Error)return this.pending.delete(z),clearTimeout(G.timer),G.reject(RG($)),!0}}switch($.header.ty){case T.Ping:if($.header.channel===0)await this.sendOn(Z,X,w0($.header.ver,T.Pong,$.header.flags,0,0,$.header.corr,new Uint8Array(0)));return!0;case T.Goodbye:if(!J)return!1;return this.liveRoutes.delete(J.channel),this.abortHandle(J),await this.reportRouteGone(J),!0;case T.Cancel:if(J)this.inflight.get(B6(J,$.header.corr))?.abort();return!0;case T.Request:if($.header.channel===0)await this.handleControlRequest($,Z,X);else if(J)this.handleDataRequest($,J,Z,X).catch((z)=>{if(!this.closeStarted&&this.sock===Z&&this.generation===X)console.warn("SubcProvider handler failed after its request was dispatched",z)});return!0;default:return!0}}async reportRouteBound($){if(!this.opts.onBound)return;try{await this.opts.onBound($)}catch(Z){console.warn("SubcProvider bound callback failed",Z)}}async reportRouteGone($){if(!this.opts.onRouteGone)return;try{await this.opts.onRouteGone($)}catch(Z){console.warn("SubcProvider route-gone callback failed",Z)}}abortHandle($){let Z=`${$.channel}:${$.epoch}:`;for(let[X,J]of this.inflight)if(X.startsWith(Z))J.abort();for(let[X,J]of this.pending){if(!X.startsWith(Z))continue;this.pending.delete(X),clearTimeout(J.timer),J.reject(new $1($))}}abortGeneration($){this.abortAllInflight();for(let[Z,X]of this.pending)this.pending.delete(Z),clearTimeout(X.timer),X.reject(new u("provider connection dropped","connection_dropped"));this.liveRoutes.clear()}abortAllInflight(){for(let $ of this.inflight.values())$.abort()}async handleControlRequest($,Z,X){let J=j6($.body);if(J.op===H2){this.handleHealthRequest($,Z,X).catch((V)=>{if(!this.closeStarted&&this.sock===Z&&this.generation===X)console.warn("SubcProvider health handler failed after its request was dispatched",V)});return}if(J.op!=="route.bind")throw new u(`unsupported module control request ${J.op??"<missing op>"}`);let z=X7(J.route_channel,"route_channel"),G=X7(J.epoch,"epoch"),Q=this.liveRoutes.get(z);if(Q){if(G<=Q.epoch){await this.sendError($,"route_rejected",`route.bind epoch ${G} does not supersede installed epoch ${Q.epoch} on channel ${z}`,p0(),Z,X);return}this.liveRoutes.delete(Q.channel),this.abortHandle(Q),await this.reportRouteGone(Q)}let Y=$6(z,G,this.connectionToken),W={handle:Y,target:J.target,identity:J.identity,principal:J.principal,consumer_capabilities:J.consumer_capabilities},H;try{H=await this.opts.onBind?.(W)}catch(V){try{await this.sendError($,"route_rejected",V instanceof Error?V.message:String(V),p0(),Z,X)}finally{await this.reportRouteGone(Y)}return}let B=yG(H);if(B){try{await this.sendError($,B.code,B.message,p0(),Z,X)}finally{await this.reportRouteGone(Y)}return}try{await this.sendOn(Z,X,w0($.header.ver,T.Response,p0(),0,0,$.header.corr,V6({op:"route.bind"})))}catch(V){throw await this.reportRouteGone(Y),V}if(this.sock!==Z||this.generation!==X||this.closeStarted||this.closedErr){await this.reportRouteGone(Y);return}this.liveRoutes.set(Y.channel,Y),await this.reportRouteBound(Y)}async handleDataRequest($,Z,X,J){let{corr:z,ver:G}=$.header,Q=B6(Z,z),Y=new AbortController;this.inflight.set(Q,Y);let W={handle:Z,signal:Y.signal,currentEpoch:()=>this.connectionEpoch,emit:async(V,U={})=>{if(this.assertLiveHandle(Z),Y.signal.aborted)return;await this.sendOn(X,J,w0(G,T.StreamData,K0(!1,U.priority??r.Interactive,!1,U.admissionClass??W0.Normal),Z.channel,Z.epoch,z,V))}},H=await(this.requestGate??new H6(Y2)).acquire(),B=K0(!1,r.Interactive,!1);try{if(Y.signal.aborted){await this.sendError($,"cancelled","request cancelled",B,X,J);return}let V=await this.opts.handler(Z,$.body,W);if(Y.signal.aborted){await this.sendError($,"cancelled","request cancelled",B,X,J);return}if(this.assertLiveHandle(Z),V===void 0)await this.sendOn(X,J,w0(G,T.StreamEnd,B,Z.channel,Z.epoch,z,new Uint8Array(0)));else if(V instanceof Uint8Array)await this.sendOn(X,J,w0(G,T.Response,B,Z.channel,Z.epoch,z,V));else throw new u("provider handler must return a Uint8Array or void","invalid_handler_response")}catch(V){if(V instanceof $1)return;if(Y.signal.aborted){await this.sendError($,"cancelled","request cancelled",B,X,J);return}await this.sendError($,V instanceof u&&V.code?V.code:"handler_error",V instanceof Error?V.message:String(V),B,X,J)}finally{if(H(),this.inflight.get(Q)===Y)this.inflight.delete(Q)}}async handleHealthRequest($,Z,X){let{corr:J,ver:z}=$.header,G=`control:${X}:${J}`,Q=new AbortController;this.inflight.set(G,Q);let Y=await(this.requestGate??new H6(Y2)).acquire();try{if(Q.signal.aborted)return;let W=await this.opts.health();await this.sendOn(Z,X,w0(z,T.Response,p0(),0,0,J,V6({op:H2,status:W.status,...W.detail===void 0?{}:{detail:W.detail},...W.metrics===void 0?{}:{metrics:W.metrics}})))}catch(W){await this.sendError($,W instanceof u&&W.code?W.code:"health_error",W instanceof Error?W.message:String(W),p0(),Z,X)}finally{if(Y(),this.inflight.get(G)===Q)this.inflight.delete(G)}}async sendError($,Z,X,J,z,G){if($.header.channel!==0){let Q=this.liveRoutes.get($.header.channel);if(!Q||Q.epoch!==$.header.epoch||!this.isLiveHandle(Q))return}await this.sendOn(z,G,w0($.header.ver,T.Error,J,$.header.channel,$.header.epoch,$.header.corr,V6({code:Z,message:X})))}async sendOn($,Z,X){if(this.sock!==$||this.generation!==Z||this.closeStarted||this.closedErr)return;await B2($,X)}handleUnexpectedDrop($,Z,X){if(this.closeStarted||this.sock!==$||this.generation!==Z)return;if(!this.opts.reconnectOnDrop){this.failFatal(X);return}this.cancelRestoredDebounce(),this.abortGeneration(Z),this.generation+=1,$.close(),this.scheduleReconnectAfterDrop(X,this.generation,$)}scheduleReconnectAfterDrop($,Z,X){if(this.closeStarted)return;let J=this.reconnecting;if(J){if(!this.shouldSupersedeReconnect(J,Z,X))return;J.superseded=!0,J.socket?.close()}let z={generation:Z,socket:null,socketDied:!1,superseded:!1};this.reconnecting=z,this.enqueueConnectionState({state:"down",cause:$}),this.reconnectWithRetry(z).catch((G)=>{if(this.isCurrentReconnect(z)&&!this.closeStarted)this.failFatal(G instanceof Error?G:new u(String(G)))}).finally(()=>{if(this.isCurrentReconnect(z))this.reconnecting=null})}async reconnectWithRetry($){let Z=0,X=this.opts.reconnectBackoff.baseMs;for(;;){if(!this.isCurrentReconnect($))return;if(this.closeStarted)throw new u("provider closed");$.socket=null,$.socketDied=!1,Z+=1,this.enqueueReconnectState($,Z);try{let J=await c$.openConnection(this.opts,(G)=>{if(!this.isCurrentReconnect($)){G.close();return}$.socket=G});if(!this.isCurrentReconnect($)||this.closeStarted){if(J.sock.close(),this.closeStarted)throw new u("provider closed");return}let z=this.replaceConnection(J,$.generation);if(this.reconnecting=null,this.reconnecting!==null)throw new u("reconnect state must clear before restored","reconnect_state");this.scheduleRestored($.generation,z);return}catch(J){if(!this.isCurrentReconnect($))return;if($.socket)$.socketDied=!0;if(this.closeStarted)throw J;if(!bG(J))throw J;await this.opts.sleep(X),X=Math.min(X*2,this.opts.reconnectBackoff.capMs)}}}isCurrentReconnect($){return!$.superseded&&this.reconnecting===$&&this.generation===$.generation}shouldSupersedeReconnect($,Z,X){return $.generation<Z||$.socketDied||$.socket===X}enqueueReconnectState($,Z){if(!this.isCurrentReconnect($))return;this.enqueueConnectionState({state:"reconnecting",attempt:Z},$.generation,$)}replaceConnection($,Z){return this.sock.close(),this.sock=$.sock,this.currentConn=$.conn,this.storage=$.ack.storage,this.machineId=V2($.ack),this.closedErr=null,this.connectionEpoch+=1,this.connectionToken=H$(),this.liveRoutes.clear(),this.nextCorr=1n,this.readLoop($.sock,Z),this.connectionEpoch}scheduleRestored($,Z){if(!this.opts.onConnectionState)return;let X=++this.restoredDebounceToken;this.opts.sleep(this.opts.restoredDebounceMs).then(()=>{if(X===this.restoredDebounceToken&&!this.closeStarted&&this.sock&&this.generation===$&&this.connectionEpoch===Z)this.enqueueConnectionState({state:"restored",epoch:Z},$)}).catch((J)=>{if(X===this.restoredDebounceToken&&!this.closeStarted)console.warn("SubcProvider restored debounce timer failed",J)})}cancelRestoredDebounce(){this.restoredDebounceToken+=1}enqueueConnectionState($,Z,X){if(!this.opts.onConnectionState)return;if(this.stateQueue.push({event:$,generation:Z,reconnect:X}),!this.drainingStateQueue)this.drainConnectionStateQueue()}async drainConnectionStateQueue(){if(this.drainingStateQueue)return;this.drainingStateQueue=!0;try{while(this.stateQueue.length>0){let $=this.stateQueue[0];if(this.closeStarted||$.generation!==void 0&&$.generation!==this.generation||$.reconnect?.superseded){this.stateQueue.shift();continue}let{event:Z}=$;try{await this.opts.onConnectionState?.(Z),this.stateQueue.shift()}catch(X){if(Z.state==="restored"){console.warn("SubcProvider restored callback failed; retrying delivery",X),await kG();continue}console.warn("SubcProvider connection-state callback failed",X),this.stateQueue.shift()}}}finally{if(this.drainingStateQueue=!1,this.stateQueue.length>0)this.drainConnectionStateQueue()}}isLiveHandle($){return l$($,this.connectionToken)&&this.liveRoutes.get($.channel)===$}assertLiveHandle($){if(!this.isLiveHandle($))throw new $1($)}allocateCorr(){let $=0xffffffffffffffffn;if(this.nextCorr>$){let X=new u("channel-0 correlation id allocator exhausted","corr_exhausted");throw this.handleUnexpectedDrop(this.sock,this.generation,X),X}let Z=this.nextCorr;return this.nextCorr+=1n,Z}failFatal($){if(!this.closedErr)this.closedErr=$;this.closeStarted=!0,this.cancelRestoredDebounce(),this.abortAllInflight(),this.sock.close(),this.finishClosed()}finishClosed(){this.resolveClosed()}}function B6($,Z){return`${$.channel}:${$.epoch}:${Z}`}function RG($){try{let Z=j6($.body);return new u(Z.message??"subc error",Z.code,W6($.header.flags,Z.code)?"not_sent":"terminal",Z.detail)}catch{return new u(j2.from($.body).toString("utf8")||"subc error")}}function W2($){return $&&$.length>0?$:void 0}function SG($){let Z=W2(process.env[G6]),X=W2(process.env[Q6]),J=Z!==void 0&&X!==void 0;return{connectionFile:$.connectionFile,manifest:$.manifest,handler:$.handler,health:$.health??(()=>({status:"ok"})),handshakeTimeoutMs:$.handshakeTimeoutMs,controlOps:$.controlOps,onBind:$.onBind,onBound:$.onBound,onRouteGone:$.onRouteGone,reconnectBackoff:$.reconnectBackoff??Y6,sleep:$.sleep??((z)=>new Promise((G)=>setTimeout(G,z))),restoredDebounceMs:$.restoredDebounceMs??TG,onConnectionState:$.onConnectionState,launchNonce:W2($.launchNonce??X),reconnectOnDrop:$.reconnectOnDrop??!J}}function IG($){if($===null)return null;let Z=new Set($??[]);return Z.add(H2),[...Z]}function xG($){let Z=$.launchNonce;return B0(T.Hello,p0(),0,0,z7,V6({manifest:vG($.manifest),protocol_ver:F0,control_ops:IG($.controlOps),...Z?{launch_nonce:Z}:{}}))}function bG($){if($ instanceof u)return $.code==="duplicate_module_id";if($ instanceof e0||$ instanceof b0)return!0;if($ instanceof m0||$ instanceof j1)return!0;if($ instanceof q0)return!0;if($ instanceof Z0)return!1;let Z=EG($);return Z==="ECONNREFUSED"||Z==="ECONNRESET"||Z==="EPIPE"||Z==="ETIMEDOUT"||Z==="ENOENT"}function EG($){if(typeof $==="object"&&$!==null&&"code"in $){let Z=$.code;if(typeof Z==="string")return Z}return}async function kG(){await new Promise(($)=>setTimeout($,0))}function p0(){return K0(!1,r.Passive,!1)}async function B2($,Z){await E0($,x0(Z),Date.now()+J7)}async function fG($,Z){let X=await $.readFrame(Z,Z);switch(X.header.ty){case T.HelloAck:{let J=j6(X.body);if(J.negotiated_ver!==F0)throw new u(`subc negotiated protocol ${J.negotiated_ver}; expected exactly ${F0}`,"unsupported_version");return J}case T.Error:{let J=j6(X.body);throw new u(`subc rejected HELLO: ${J.code??"unknown"} — ${J.message??"subc error"}`,J.code)}default:throw new u(`unexpected frame ${T[X.header.ty]} awaiting HELLO_ACK`)}}function V6($){return new Uint8Array(j2.from(JSON.stringify($),"utf8"))}function j6($){return JSON.parse(j2.from($).toString("utf8"))}function X7($,Z){if(typeof $!=="number"||!Number.isInteger($))throw new u(`route.bind ${Z} must be an integer`);return $}function yG($){if($===void 0||$===!0)return null;if($===!1)return{code:"route_rejected",message:"route.bind rejected by provider"};if($.accept)return null;return{code:$.code??"route_rejected",message:$.message??"route.bind rejected by provider"}}function vG($){return{module_id:$.module_id,module_version:$.module_version,protocol_ver:$.protocol_ver,trust_tier:$.trust_tier,provides:$.provides.map(gG),consumes:$.consumes.map(hG),bindings:{storage:{kind:$.bindings.storage.kind,scope:$.bindings.storage.scope,owns_schema:$.bindings.storage.owns_schema},vault_grants:$.bindings.vault_grants.map((Z)=>({secret:Z.secret,reason:Z.reason})),identity:{requires:[...$.bindings.identity.requires],optional:[...$.bindings.identity.optional]}}}}function gG($){switch($.role){case"tool_provider":return{role:"tool_provider",tools:$.tools.map((Z)=>({name:Z.name,...Z.description===void 0?{}:{description:Z.description},execution_mode:Z.execution_mode,schema:Z.schema})),identity_scope:[...$.identity_scope],concurrency:$.concurrency,emits_push:$.emits_push,sub_supervises:$.sub_supervises};case"pipeline_stage":return{role:"pipeline_stage",stage:$.stage,applies_to:{provider:$.applies_to.provider,model:$.applies_to.model},interface:$.interface,declares_frozen_floor:$.declares_frozen_floor,needs_signals:[...$.needs_signals],conformance_class:$.conformance_class};case"management_surface":return{role:"management_surface",operations:$.operations.map((Z)=>({name:Z.name,kind:Z.kind})),config_schema:$.config_schema,observability:$.observability.map((Z)=>({name:Z.name,kind:Z.kind})),identity_scope:[...$.identity_scope],concurrency:$.concurrency};case"internal_service":return{role:"internal_service",service_id:$.service_id,transport:$.transport,agent_facing:$.agent_facing,operations:[...$.operations]}}}function hG($){switch($.role){case"tool_client":return{role:"tool_client",of:[...$.of]};case"llm_client":return{role:"llm_client",via:$.via,auth:$.auth};case"service_client":return{role:"service_client",of:[...$.of]}}}var K6="subc-connection.json",Q7="subc-",Y7=".connection.json";function W7(){let $=process.env.HOME;return $?j$($,".local","share","cortexkit","run",K6):void 0}function uG(){let $=process.env.XDG_RUNTIME_DIR;if($)return j$($,K6);let Z=W7();if(Z)return Z;return j$(pG().homedir,".local","share","cortexkit","run",K6)}function lG(){if(process.env.SUBC_CONNECTION_FILE)return process.env.SUBC_CONNECTION_FILE;let $=process.env.XDG_RUNTIME_DIR;if($){let z=j$($,K6);if(U6(z))return z}let Z=W7();if(Z&&U6(Z))return Z;let X=j$(G7(),`${Q7}${dG()}${Y7}`);if(U6(X))return X;let J=cG(G7());return J.length===1?J[0]:void 0}function dG($=process.getuid??null,Z=process.env){if($)return String($());for(let X of["USER","USERNAME","HOME","USERPROFILE"]){let J=Z[X];if(J)return Array.from(J,(z)=>/^[a-zA-Z0-9_-]$/.test(z)?z:"_").join("")}return"unknown"}function B7(){return lG()??uG()}function s$($){return $?.trim()||process.env.SUBC_CONNECTION_FILE||process.env.CLAUSTRUM_SUBC_CONNECTION?.trim()||B7()}function U6($){try{return mG($).isFile()}catch{return!1}}function cG($){let Z;try{Z=wG($)}catch{return[]}let X=[];for(let J of Z){if(typeof J!=="string")continue;if(!J.startsWith(Q7)||!J.endsWith(Y7))continue;let z=j$($,J);if(U6(z))X.push(z)}return X.sort(),X}import{createHash as sG}from"node:crypto";import{existsSync as iG,realpathSync as H7}from"node:fs";import{dirname as aG,relative as nG,resolve as rG}from"node:path";function V7($){let Z=$,X;try{X=H7(Z)}catch(J){if(J.code!=="ENOENT")throw J;let z=Z;while(!iG(z)){let G=aG(z);if(G===z)break;z=G}X=rG(H7(z),nG(z,Z))}return sG("sha256").update(X).digest("hex")}function U2($,Z){return{project_root:$,harness:"opencode",session:`store-${V7(Z)}`}}import{AsyncLocalStorage as oG}from"node:async_hooks";import{readFile as j7}from"node:fs/promises";var tG=new oG;function U7($,Z){return $.split(`
-`).filter((X)=>X.trim()!==""&&!X.trimStart().startsWith("#")).map((X)=>{let J=X.split(":");if(J.length!==Z||!J[0]||/\s/.test(J[0])||!/^\d+$/.test(J[2])||!Number.isSafeInteger(Number(J[2]))||Number(J[2])>4294967295||Z===7&&(!/^\d+$/.test(J[3])||!Number.isSafeInteger(Number(J[3]))||Number(J[3])>4294967295))throw Error("malformed account record");if(Z===4&&J[3]!==""&&J[3].split(",").some((z)=>z===""||/\s/.test(z)))throw Error("malformed group members");return J})}async function q6($,Z=tG.getStore()??{euid:process.geteuid?.(),egid:process.getegid?.(),passwdPath:"/etc/passwd",groupPath:"/etc/group"}){if(($.mode&18)===0||($.mode&512)!==0)return!0;if(($.mode&2)!==0||Z.euid===void 0||Z.egid===void 0||$.uid!==Z.euid||$.gid!==Z.egid)return!1;try{let X=U7(new TextDecoder("utf-8",{fatal:!0}).decode(await j7(Z.passwdPath)),7),J=U7(new TextDecoder("utf-8",{fatal:!0}).decode(await j7(Z.groupPath)),4),z=X.filter((Y)=>Number(Y[2])===Z.euid),G=J.filter((Y)=>Number(Y[2])===Z.egid);if(z.length!==1||G.length!==1)return!1;let Q=z[0][0];return(G[0][3]===""||G[0][3].split(",").every((Y)=>Y===Q))&&!X.some((Y)=>Number(Y[2])!==Z.euid&&Number(Y[3])===Z.egid)}catch{return!1}}import{randomBytes as eG}from"node:crypto";import{chmod as $Q,mkdir as ZQ,open as XQ,realpath as JQ,rename as zQ,stat as GQ,unlink as QQ}from"node:fs/promises";import{basename as YQ,dirname as K7,join as WQ}from"node:path";var BQ=/^[0-9a-f]{64}$/;function HQ($){if(!BQ.test($.token))throw Error("enrollment token must be exactly 64 lowercase hex characters");if(!Number.isSafeInteger($.token_generation)||$.token_generation<1)throw Error("enrollment token generation must be a positive safe integer")}async function VQ($){let Z;try{Z=await JQ($)}catch{return}for(;;){let X=await GQ(Z).catch(()=>{return});if(X&&!await q6(X))throw Error(`enrollment token ancestor ${Z} is group- or world-writable without sticky bit`);let J=K7(Z);if(J===Z)return;Z=J}}async function K2($,Z){HQ(Z);let X=K7($);await ZQ(X,{recursive:!0,mode:448}),await VQ(X);let J=WQ(X,`.${YQ($)}.${process.pid}.${eG(12).toString("hex")}.tmp`),z=!1;try{let G=await XQ(J,"wx",384);z=!0;try{await G.writeFile(`${JSON.stringify(Z)}
-`,"utf8"),await G.sync(),await $Q(J,384)}finally{await G.close()}await zQ(J,$),z=!1}finally{if(z)await QQ(J).catch(()=>{return})}}var q7=["transient","permanent","auth_required","context_overflow"];class k0 extends Error{code;action;["class"];constructor($,Z,X){super(`Claustrum credential request failed: ${$}`);this.code=$,this.action=X,this.name="ClaustrumCredentialError",this.class=Z}}function U$($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function D7($){switch($){case"permanent":return"gone";case"auth_required":return"reauth";case"context_overflow":return"reduce_and_retry";case"transient":return"retry"}}function y($,Z="invalid_response",X=(J)=>console.warn(J)){let J=U$($)&&U$($.result)?$.result:void 0,z=J&&U$(J.error)?J.error:void 0,G=z?.class,Q=z?.code,Y=typeof G==="string"&&q7.includes(G),W=typeof Q==="string",B=Y&&W?G:"transient";if(typeof G!=="string")X("unknown");else if(!Y)X(G);return new k0(W?Q:Z,B,D7(B))}function g1($){return U$($)&&U$($.result)&&U$($.result.error)}var N7="claustrum",KQ=60000;function P0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function D2($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0?$:void 0}function u0($){return $===void 0||typeof $==="string"}function M7($,Z){if(g1($))throw y($,"invalid_response",Z);let X=P0($)&&P0($.result)?$.result:void 0,J=X?.payload;if(!Array.isArray(J)||J.length===0||!J.every((K)=>typeof K==="number"&&Number.isInteger(K)&&K>=0&&K<=255))throw y($,"invalid_response",Z);let z=D2(X?.record_version);if(z===void 0)throw y($,"invalid_record_version",Z);let G=X?.expires_at_ms,Q=G===void 0||G===null?null:typeof G==="number"&&Number.isFinite(G)?G:void 0;if(Q===void 0)throw y($,"invalid_expiry",Z);let Y=X?.credential_id,W=X?.project_id,H=X?.account_id,B=X?.email,V=X?.org_name;if(!u0(Y)||!u0(W)||!u0(H)||!u0(B)||!u0(V))throw y($,"invalid_response",Z);let U;try{U=new TextDecoder("utf-8",{fatal:!0}).decode(Uint8Array.from(J))}catch{throw y($,"invalid_response",Z)}return{material:U,recordVersion:z,expiresAtMs:Q,credentialId:Y,projectId:W,accountId:H,email:B,orgName:V}}function qQ($,Z){if(g1($))throw y($,"invalid_response",Z);let X=P0($)&&P0($.result)?$.result:void 0,J=X?.record_version,z=J===void 0?void 0:D2(J),G=X?.credential_id;if(typeof X?.ready!=="boolean"||X?.last_error_code!==void 0&&X?.last_error_code!==null&&typeof X?.last_error_code!=="string"||typeof X?.lease_held!=="boolean"||J!==void 0&&z===void 0||!u0(G)||X?.stale_pending!==void 0&&typeof X.stale_pending!=="boolean")throw y($,"invalid_status",Z);return{ready:X.ready,lastErrorCode:X.last_error_code??null,leaseHeld:X.lease_held,...G===void 0?{}:{credentialId:G},...z===void 0?{}:{recordVersion:z},...X.stale_pending===void 0?{}:{stalePending:X.stale_pending}}}class h1{#$;#Z;#W;#G;#Q;#J;#X=null;#B=0;#H=!1;constructor($,Z,X,J,z,G){this.#$=$,this.#Z=Z,this.#W=X,this.#G=J,this.#Q=z,this.#J=G}static async connect($={}){let Z=s$($.connectionFile),X=$.connector??((G)=>v1.connect(G)),J=$.identity??U2($.projectRoot??process.cwd(),$.storagePath??process.cwd()),z=await X({connectionFile:Z,handshakeTimeoutMs:$.handshakeTimeoutMs});return new h1(z,X,Z,$.handshakeTimeoutMs,J,$.logger??((G)=>console.warn(G)))}async getCredential($,Z){let X=await this.#z("credential.get",{handle:$,min_ttl_ms:Z,force_refresh:!1});return M7(X,this.#J)}async statusCredential($){let Z=await this.#z("credential.status",{handle:$});return qQ(Z,this.#J)}async reportAuthFailure($){let Z=await this.#z("credential.report_auth_failure",{handle:$.handle,provider_status:$.providerStatus,record_version:$.recordVersion,reporter_source:$.reporterSource});if(g1(Z))throw y(Z,"invalid_response",this.#J);if((P0(Z)&&P0(Z.result)?Z.result:void 0)?.accepted!==!0)throw y(Z,"invalid_response",this.#J)}async listScoped($){let Z=await this.#z("credential.list_scoped",$===void 0?{}:{enrollment_token:$});return DQ(Z,this.#J)}async getScoped($){let Z=await this.#z("credential.get_scoped",{credential_id:$.credentialId,enrollment_token:$.enrollmentToken,min_ttl_ms:$.minTtlMs});return M7(Z,this.#J)}async reportAuthFailureScoped($){let Z=await this.#z("credential.report_auth_failure",{credential_id:$.credentialId,enrollment_token:$.enrollmentToken,provider_status:$.providerStatus,record_version:$.recordVersion,reporter_source:$.reporterSource});if(g1(Z))throw y(Z,"invalid_response",this.#J);if((P0(Z)&&P0(Z.result)?Z.result:void 0)?.accepted!==!0)throw y(Z,"invalid_response",this.#J)}async enrollPropose($){let Z=await this.#z("auth.enroll_propose",{proposed_name:$.name,request_secret_hash:$.requestSecretHash}),J=q2(Z,this.#J).request_id;if(typeof J!=="string"||J.length===0)throw y(Z,"invalid_response",this.#J);return{requestId:J}}async enrollPoll($){let Z=await this.#z("auth.enroll_poll",{request_id:$.requestId,request_secret:$.requestSecret});return NQ(Z,this.#J)}async enrollRotate($){let Z=await this.#z("auth.enroll_rotate",{token:$.token,expected_token_generation:$.expectedTokenGeneration}),X=q2(Z,this.#J),J=X.token,z=X.token_generation;if(typeof J!=="string"||J.length===0||typeof z!=="number"||!Number.isInteger(z)||z<0)throw y(Z,"invalid_response",this.#J);return{token:J,tokenGeneration:z}}close(){this.#H=!0,this.#$.close()}async#z($,Z){let X=this.#$;try{return await X.call(N7,$,Z,{identity:this.#Q,consumerIdentity:null})}catch(J){if(this.#V(J)){try{if(this.#$===X)await this.#j()}catch(z){throw this.#Y(z)}try{return await this.#$.call(N7,$,Z,{identity:this.#Q,consumerIdentity:null})}catch(z){throw this.#Y(z)}}throw this.#Y(J)}}#Y($){if($ instanceof k0)return $;let Z=$ instanceof X0&&$.code?$.code:"transport_error";return new k0(Z,"transient","retry")}#V($){return!this.#H&&$ instanceof X0&&$.kind==="terminal"&&$.code!=="missing_identity"&&$.code!=="invalid_control_body"&&$.code!=="unknown_module"}async#j(){if(this.#H)throw Error("Claustrum client is closed");if(this.#X){await this.#X;return}let $=Date.now();if($<this.#B)throw Error("Claustrum client reconnect is backed off");this.#B=$+KQ,this.#X=this.#Z({connectionFile:this.#W,handshakeTimeoutMs:this.#G}).then((Z)=>{if(this.#H)throw Z.close(),Error("Claustrum client is closed");let X=this.#$;this.#$=Z,X.close()}).finally(()=>{this.#X=null}),await this.#X}}function DQ($,Z){if(g1($))throw y($,"invalid_response",Z);let X=P0($)&&P0($.result)?$.result:void 0,J=X?.credentials;if(!Array.isArray(J))throw y($,"invalid_response",Z);let z=X?.view;if(typeof z!=="string"||z.length===0)throw y($,"invalid_response",Z);return{rows:J.map((Q)=>{if(!P0(Q))throw y($,"invalid_response",Z);let Y=D2(Q.record_version);if(Y===void 0)throw y($,"invalid_record_version",Z);let W=(V)=>{if(!Array.isArray(V)||!V.every((U)=>typeof U==="string"))throw y($,"invalid_response",Z);return V};if(typeof Q.id!=="string"||typeof Q.type!=="string"||typeof Q.state!=="string")throw y($,"invalid_response",Z);let H=Q.created_at_ms===void 0||Q.created_at_ms===null?null:typeof Q.created_at_ms==="number"&&Number.isFinite(Q.created_at_ms)?Q.created_at_ms:void 0;if(H===void 0)throw y($,"invalid_response",Z);let B=Q.auth_method;if(B!==void 0&&B!=="apikey"&&B!=="chatgpt"&&B!=="antigravity"&&B!=="oauth")throw y($,"invalid_response",Z);if(!u0(Q.refresh_adapter))throw y($,"invalid_response",Z);if(!u0(Q.account_id)||!u0(Q.email)||!u0(Q.org_name))throw y($,"invalid_response",Z);return{id:Q.id,categories:W(Q.categories),credentialType:Q.type,serves:W(Q.serves),providerIds:Q.provider_ids===void 0?[]:W(Q.provider_ids),authMethod:B,state:Q.state,refreshAdapter:Q.refresh_adapter,recordVersion:Y,operations:W(Q.operations),createdAtMs:H,accountId:Q.account_id,email:Q.email,orgName:Q.org_name}}),view:z}}function q2($,Z){if(g1($))throw y($,"invalid_response",Z);let X=P0($)&&P0($.result)?$.result:void 0;if(X===void 0)throw y($,"invalid_response",Z);return X}function NQ($,Z){let X=q2($,Z),J=X.status;if(J==="pending")return{status:"pending"};if(J==="denied")return{status:"denied"};if(J!=="approved")throw y($,"invalid_response",Z);let{name:z,token:G,token_generation:Q}=X;if(typeof z!=="string"||typeof G!=="string"||G.length===0||typeof Q!=="number"||!Number.isInteger(Q))throw y($,"invalid_response",Z);return{status:"approved",name:z,token:G,tokenGeneration:Q}}function N2($){let Z=new AbortController,X=[],J=!1,z=()=>{if(J)return;J=!0;for(let{source:Y,listener:W}of X)Y.removeEventListener("abort",W);X.length=0},G=(Y)=>{if(J||Z.signal.aborted)return;Z.abort(Y),z()},Q=$.find((Y)=>Y.aborted);if(Q)return Z.abort(Q.reason),{signal:Z.signal,dispose:z};for(let Y of $){if(Z.signal.aborted)break;let W=()=>G(Y.reason);if(X.push({source:Y,listener:W}),Y.addEventListener("abort",W,{once:!0}),Y.aborted)G(Y.reason)}return{signal:Z.signal,dispose:z}}import{createHash as MQ,randomBytes as LQ,randomUUID as FQ}from"node:crypto";import{constants as L7}from"node:fs";import{chmod as PQ,mkdir as OQ,open as C7,readFile as F7,realpath as _Q,rename as CQ,stat as T7,unlink as A7}from"node:fs/promises";import{basename as R7,dirname as m1,extname as P7,isAbsolute as O7,join as F2,resolve as TQ}from"node:path";class R extends Error{kind;constructor($,Z){super(Z);this.name="ClaustrumConsumerError",this.kind=$}}var AQ=1,M2=16384,S7=30000,P2=/^[0-9a-f]{64}$/,I7=new Set(["invalid_params","pending_exists","not_found","already_consumed","superseded","stale_generation"]),x7=new Set(["pending_queue_full"]);function L2($){if(!($ instanceof k0))return;if(I7.has($.code))return{code:$.code,disposition:"terminal"};if(x7.has($.code))return{code:$.code,disposition:"retry"};return{code:$.code,disposition:$.action==="retry"?"retry":"terminal"}}function O2($,Z){if(!/^[a-z0-9][a-z0-9-]*$/.test($)||!/^[a-z0-9][a-z0-9-]*$/.test(Z))throw new R("invalid-state","Claustrum enrollment names use lowercase letters, digits and dashes");return`${$}-${Z}`}function _2($){return h1.connect($)}function b7($){let Z=P7($)||".json",X=R7($,P7($));return{statePath:F2(m1($),`${X}-state${Z}`),tokenPath:$}}function C2($){let Z=$.override?.trim();if(Z&&!O7(Z)&&!$.cwd)throw new R("invalid-state","A relative Claustrum enrollment override needs a base directory");let X=Z?O7(Z)?Z:TQ($.cwd,Z):F2($.stateDir,`${$.host}-enrollment.json`);return b7(X)}function E7($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function D6($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0}function k7($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=1}function i$(){return new R("invalid-state","invalid Claustrum enrollment state")}function M6($){if(!E7($)||$.version!==AQ||typeof $.proposedName!=="string"||$.proposedName.length===0)throw i$();if($.phase==="pending"){if(!P2.test(String($.requestSecret??""))||$.requestId!==void 0&&(typeof $.requestId!=="string"||$.requestId.length===0)||!D6($.createdAt)||!D6($.updatedAt))throw i$();return{version:1,phase:"pending",proposedName:$.proposedName,requestSecret:$.requestSecret,...$.requestId!==void 0&&{requestId:$.requestId},createdAt:$.createdAt,updatedAt:$.updatedAt}}if($.phase==="approved"){if($.approvedName!==void 0&&(typeof $.approvedName!=="string"||$.approvedName.length===0)||!k7($.tokenGeneration)||!D6($.updatedAt))throw i$();return{version:1,phase:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration,updatedAt:$.updatedAt}}if($.phase==="denied"||$.phase==="blocked"){if($.errorCode!==void 0&&typeof $.errorCode!=="string"||!D6($.updatedAt))throw i$();return{version:1,phase:$.phase,proposedName:$.proposedName,...$.errorCode!==void 0&&{errorCode:$.errorCode},updatedAt:$.updatedAt}}throw i$()}function T2($){if(!E7($)||!P2.test(String($.token??""))||!k7($.token_generation))throw new R("invalid-token","invalid Claustrum enrollment token file");return{token:$.token,token_generation:$.token_generation}}function RQ($){if(!$.isFile())throw new R("unsafe-file","Claustrum enrollment file must be a regular file");if(($.mode&63)!==0)throw new R("unsafe-file","Claustrum enrollment file must be owner-only");let Z=process.geteuid?.();if(Z!==void 0&&$.uid!==Z)throw new R("unsafe-file","Claustrum enrollment file must be owned by the current user")}function SQ($){try{return JSON.parse($)}catch{throw new R("invalid-state","Claustrum enrollment file is not valid JSON")}}async function q1($){let Z;try{Z=await C7($,L7.O_RDONLY|L7.O_NOFOLLOW)}catch(X){if(X.code==="ENOENT")return;throw new R("unsafe-file","Claustrum enrollment file could not be opened safely")}try{RQ(await Z.stat());let X=Buffer.alloc(M2+1),{bytesRead:J}=await Z.read(X,0,X.byteLength,0);if(J>M2)throw new R("unsafe-file","Claustrum enrollment file is too large");return SQ(X.subarray(0,J).toString("utf8"))}finally{await Z.close()}}function _7($,Z){let X=[];for(let J of $.split(`
-`)){if(J.trim()===""||J.startsWith("#"))continue;let z=J.split(":");if(z.length!==Z||!/^[^\s:,]+$/.test(z[0]??"")||!/^\d+$/.test(z[2]??"")||!Number.isSafeInteger(Number(z[2]))||Z===7&&(!/^\d+$/.test(z[3]??"")||!Number.isSafeInteger(Number(z[3])))||Z===4&&z[3]!==""&&!/^[^\s:,]+(?:,[^\s:,]+)*$/.test(z[3]??""))return;X.push(z)}return X}async function IQ($,Z,X){try{let[J,z]=await Promise.all([F7(X.passwdPath??"/etc/passwd","utf8"),F7(X.groupPath??"/etc/group","utf8")]),G=_7(J,7),Q=_7(z,4);if(!G||!Q)return!1;let Y=G.filter((V)=>Number(V[2])===$),W=Q.filter((V)=>Number(V[2])===Z);if(Y.length!==1||W.length!==1)return!1;let H=Y[0]?.[0],B=W[0]?.[3]??"";return(B===""||B.split(",").every((V)=>V===H))&&!G.some((V)=>Number(V[2])!==$&&Number(V[3])===Z)}catch{return!1}}async function f7($,Z={}){let X=process.geteuid?.();if(X===void 0)return;let J=process.getegid?.(),z;try{z=await _Q($)}catch{return}let G;for(;;){let Q=await T7(z).catch(()=>{return});if(Q&&(Q.mode&18)!==0&&(Q.mode&512)===0){if(G===void 0)G=J!==void 0&&await IQ(X,J,Z);if((Q.mode&2)!==0||Q.uid!==X||Q.gid!==J||!G)throw new R("unsafe-file",`Claustrum enrollment path has a writable ancestor: ${z}. Another user could replace it. Run: chmod g-w,o-w ${z}`)}let Y=m1(z);if(Y===z)return;z=Y}}async function N6($){await OQ($,{recursive:!0,mode:448});let Z=await T7($),X=process.geteuid?.();if(X!==void 0&&Z.uid!==X)throw new R("unsafe-file","Claustrum enrollment directory must be owned by the current user");if((Z.mode&63)!==0)await PQ($,448)}async function w1($,Z,X={}){let J=m1($);await N6(J),await f7(J,X);let z=`${JSON.stringify(Z)}
-`;if(Buffer.byteLength(z)>M2)throw new R("invalid-state","Claustrum enrollment state is too large");let G=F2(J,`.${R7($)}.${process.pid}.${FQ()}.tmp`),Q,Y=!1;try{Q=await C7(G,"wx",384),Y=!0,await Q.writeFile(z,"utf8"),await Q.chmod(384),await Q.sync(),await Q.close(),Q=void 0,await CQ(G,$),Y=!1}finally{if(await Q?.close().catch(()=>{}),Y)await A7(G).catch(()=>{})}}async function a$($,Z){let X=await q1($.tokenPath),J=X===void 0?void 0:T2(X),z=await q1($.statePath),G=z===void 0?void 0:M6(z);if(J)return{state:"approved",proposedName:G?.proposedName??Z,...G?.phase==="approved"&&G.approvedName!==void 0&&{approvedName:G.approvedName},tokenGeneration:J.token_generation};if(!G)return{state:"idle"};if(G.phase==="approved")return{state:"blocked",proposedName:G.proposedName,code:"missing_token"};return K1(G)}async function A2($,Z){let X;try{X=await a$($,Z)}catch(J){if(!(J instanceof R)||J.kind!=="invalid-state"&&J.kind!=="invalid-token")return"unreadable";try{let z=await q1($.statePath);if(z===void 0)return"unreadable";let G=M6(z);return G.phase==="approved"&&G.proposedName===Z?"vault":"unreadable"}catch{return"unreadable"}}if("proposedName"in X&&X.proposedName!==Z)return"unreadable";if(X.state==="approved"||X.state==="blocked"&&X.code==="missing_token")return"vault";return"local"}async function R2($){let Z=await q1($);if(Z===void 0)throw new R("not-enrolled","Claustrum enrollment is not configured");return T2(Z)}function K1($){if($.phase==="pending")return{state:"pending",proposedName:$.proposedName,...$.requestId!==void 0&&{requestId:$.requestId}};if($.phase==="approved")return{state:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration};if($.phase==="denied")return{state:"denied",proposedName:$.proposedName};return{state:"blocked",proposedName:$.proposedName,code:$.errorCode??"unknown"}}function y7(){return new R("wrong-consumer","Claustrum enrollment state belongs to a different consumer")}class L6{#$;#Z;#W;#G;#Q;#J;#X;constructor($){this.#X=$.ancestorOptions??{},this.#$=$.client,this.#Z=$.paths,this.#W=$.proposedName,this.#G=$.now??Date.now,this.#Q=$.mintSecret??(()=>LQ(32).toString("hex")),this.#J=$.writeTokenFile??K2}async status(){return a$(this.#Z,this.#W)}async resetTerminal(){return v7(this.#Z,this.#W)}async#B($,Z){let X={version:1,phase:"blocked",proposedName:$.proposedName,errorCode:Z,updatedAt:this.#G()};return await w1(this.#Z.statePath,X,this.#X),K1(X)}async reconcile(){await N6(m1(this.#Z.statePath));let $=await e({name:"ceremony",path:this.#Z.statePath,ttlMs:S7,renew:!0});if(!$)return{state:"busy"};try{let Z=await q1(this.#Z.tokenPath),X=Z===void 0?void 0:T2(Z),J=await q1(this.#Z.statePath),z=J===void 0?void 0:M6(J);if(z&&z.proposedName!==this.#W)throw y7();if(X){if(!z||z.phase==="pending"){let Q={version:1,phase:"approved",proposedName:z?.proposedName??this.#W,tokenGeneration:X.token_generation,updatedAt:this.#G()};await w1(this.#Z.statePath,Q,this.#X),z=Q}return{state:"approved",proposedName:z.proposedName,...z.phase==="approved"&&z.approvedName!==void 0&&{approvedName:z.approvedName},tokenGeneration:X.token_generation}}if(z?.phase==="approved"){let Q={version:1,phase:"blocked",proposedName:z.proposedName,errorCode:"missing_token",updatedAt:this.#G()};return await w1(this.#Z.statePath,Q,this.#X),K1(Q)}if(z&&z.phase!=="pending")return K1(z);if(!z){let Q=this.#G();if(z={version:1,phase:"pending",proposedName:this.#W,requestSecret:this.#Q(),createdAt:Q,updatedAt:Q},!P2.test(z.requestSecret))throw new R("invalid-state","invalid minted Claustrum enrollment secret");await w1(this.#Z.statePath,z,this.#X)}if(!z.requestId)try{let Q=MQ("sha256").update(Buffer.from(z.requestSecret,"hex")).digest("hex"),Y=await this.#$.enrollPropose({name:z.proposedName,requestSecretHash:Q});z={...z,requestId:Y.requestId,updatedAt:this.#G()},await w1(this.#Z.statePath,z,this.#X)}catch(Q){let Y=L2(Q);if(!Y)throw Q;if(Y.disposition==="retry")return{state:"pending",proposedName:z.proposedName,retryCode:Y.code};return this.#B(z,Y.code)}let G=z.requestId;if(!G)return K1(z);try{let Q=await this.#$.enrollPoll({requestId:G,requestSecret:z.requestSecret});if(Q.status==="pending")return K1(z);if(Q.status==="denied"){let W={version:1,phase:"denied",proposedName:z.proposedName,updatedAt:this.#G()};return await w1(this.#Z.statePath,W,this.#X),K1(W)}await N6(m1(this.#Z.tokenPath)),await f7(m1(this.#Z.tokenPath),this.#X),await this.#J(this.#Z.tokenPath,{token:Q.token,token_generation:Q.tokenGeneration});let Y={version:1,phase:"approved",proposedName:z.proposedName,approvedName:Q.name,tokenGeneration:Q.tokenGeneration,updatedAt:this.#G()};return await w1(this.#Z.statePath,Y,this.#X),K1(Y)}catch(Q){let Y=L2(Q);if(!Y)throw Q;if(Y.disposition==="retry")return{state:"pending",proposedName:z.proposedName,requestId:G,retryCode:Y.code};return this.#B(z,Y.code)}}finally{await $.release()}}}async function v7($,Z){await N6(m1($.statePath));let X=await e({name:"ceremony",path:$.statePath,ttlMs:S7,renew:!0});if(!X)return"busy";try{if(await q1($.tokenPath)!==void 0)return"refused-approved";let J=await q1($.statePath);if(J===void 0)return"idle";let z=M6(J);if(z.proposedName!==Z)throw y7();if(z.phase==="pending")return"refused-pending";return await X.assertOwned(),await A7($.statePath),"reset"}finally{await X.release()}}var n$="claustrum-tombstone:v1:";function F6($){return`${n$}${$}`}function S2($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function P6($){return typeof $==="string"&&$.startsWith(n$)}function g7($,Z){if(!S2($)||$.type!=="oauth")return!1;return $.refresh===F6(Z)}function h7($,Z){if(g7($,Z))return"placeholder";if(S2($)&&$.type==="oauth"&&typeof $.refresh==="string"&&$.refresh.length>0&&!P6($.refresh))return"login";if(S2($)&&$.type==="api"&&typeof $.key==="string"&&$.key.length>0)return"login";return"empty"}function I2($){let Z=h7($.auth,$.provider);if($.mode==="custody"&&Z==="login")throw new R("host-slot-login",`${$.provider} has a host login while its accounts are vault-custodied; refusing to serve until one is removed`);if($.mode==="local"&&Z==="placeholder")throw new R("host-slot-placeholder",`${$.provider} host slot holds the vault placeholder; sign in to use local accounts`);return Z}function w7($,Z){return Z!==void 0&&Z.credentialId===$.credentialId&&Z.accountIdentity===$.accountIdentity&&Z.recordVersion!==$.recordVersion}function xQ($,Z){if(Z===void 0)return"reauthorize-failed";if(Z.credentialId!==$.credentialId)return"credential-changed";if(Z.accountIdentity!==$.accountIdentity)return"account-changed";if(Z.recordVersion===$.recordVersion)return"version-unchanged";return"rotated"}var m7=s("claustrum");function E2($,Z,X,J=m7){let z=w7(Z,X);return J.debug("scoped 401 re-authorized",{site:$,credentialId:Z.credentialId,servedVersion:Z.recordVersion,currentVersion:X?.recordVersion??null,retry:z,reason:xQ(Z,X)}),z}var b2=300000;function x2(){return new R("invalid-material","Claustrum returned invalid credential material")}function bQ($){let Z=$.trim();if(Z.startsWith("{")){let X;try{X=JSON.parse(Z)}catch{throw x2()}if(!X||typeof X!=="object")throw x2();let J=X,z=J.access_token??J.access;Z=typeof z==="string"?z:""}if(!/^[\x21-\x7e]+$/.test(Z)||Z.startsWith(n$))throw x2();return Z}function EQ($,Z){if(!$.operations.includes("read"))return;if(!$.categories.includes(Z.category))return;if($.credentialType==="oauth")return $.refreshAdapter===Z.refreshAdapter?"oauth":void 0;if($.credentialType==="api_key"&&Z.apiKeys)return $.refreshAdapter===void 0?"api_key":void 0;return}class O6{#$;#Z;#W;#G;#Q;#J;#X;#B=new WeakMap;#H=new WeakMap;#z=!1;constructor($){let Z=$.tokenPath;if($.readToken)this.#Z=$.readToken;else if(Z)this.#Z=()=>R2(Z);else throw new R("not-enrolled","Claustrum enrollment token path is required");this.#$=$.client,this.#G=$.family,this.#Q=$.parseIdentity,this.#J=$.requireAssertion??!1,this.#W=$.now??Date.now,this.#X=$.logger??m7}#Y($){if(this.#z)throw new R("closed","Claustrum scoped custody is closed");$?.throwIfAborted()}async#V($){this.#Y($);let Z=await this.#Z();if(this.#Y($),!/^[0-9a-f]{64}$/.test(Z.token)||!Number.isSafeInteger(Z.token_generation)||Z.token_generation<1)throw new R("invalid-token","Invalid Claustrum enrollment token");return Z.token}async#j($,Z){this.#Y(Z);let X,J;try{let z=$();X=Z?await Promise.race([z,new Promise((G,Q)=>{let Y=()=>Q(Z.reason);if(Z.addEventListener("abort",Y,{once:!0}),J=()=>Z.removeEventListener("abort",Y),Z.aborted)Y()})]):await z}catch(z){if(this.#Y(Z),z instanceof k0)throw z;throw new R("unavailable","Claustrum scoped operation unavailable")}finally{J?.()}return this.#Y(Z),X}async discover($){let Z=await this.#V($),X=await this.#j(()=>this.#$.listScoped(Z),$),J=[],z=[],G=new Map;for(let Y of X.rows){let W=EQ(Y,this.#G);if(!W)continue;z.push({row:Y,type:W}),G.set(Y.id,(G.get(Y.id)??0)+1)}let Q=[];for(let{row:Y,type:W}of z){let H;if(!Y.id.trim())H="empty credential id";else if((G.get(Y.id)??0)>1)H="duplicate credential id";else if(Y.accountId!==void 0&&!Y.accountId.trim())H="blank account identity";else if(!Y.state.trim())H="empty state";if(H){J.push({...Y.id.trim()&&{credentialId:Y.id},reason:H});continue}Q.push(Object.freeze({credentialId:Y.id,credentialType:W,...Y.accountId!==void 0&&{accountIdentity:Y.accountId},state:Y.state,...Y.email!==void 0&&{email:Y.email},...Y.orgName!==void 0&&{orgName:Y.orgName}}))}for(let Y of J)this.#X.warn("skipped malformed vault record",Y);return{view:X.view,credentials:Object.freeze(Q),skipped:Object.freeze(J)}}async authorize($,Z){if(!$.credentialId)throw new R("route-unavailable","Claustrum dispatch requires a credential id");let{credentialId:X,credentialType:J,accountIdentity:z}=$;if(this.#J&&z===void 0)throw new R("identity-unasserted","Claustrum dispatch requires a known account identity");let G=await this.#V(Z),Q=await this.#j(()=>this.#$.getScoped({credentialId:X,enrollmentToken:G,...J==="oauth"&&{minTtlMs:b2}}),Z);if(Q.credentialId!==void 0&&Q.credentialId!==X)throw new R("identity-changed","Claustrum served credential identity changed");let Y=Q.expiresAtMs;if(!Number.isSafeInteger(Q.recordVersion)||Q.recordVersion<0||Y===null&&J==="oauth"||Y!==null&&(!Number.isFinite(Y)||Y-this.#W()<b2))throw new R("insufficient-validity","Claustrum served credential has insufficient validity");let W=bQ(Q.material),H=Q.accountId?.trim()?Q.accountId:void 0;if(this.#J&&(Q.credentialId===void 0||H===void 0))throw new R("identity-unasserted","Claustrum served credential did not assert its identity");let B=H===void 0?this.#Q?.(W):void 0,V=H??B;if(z!==void 0&&V!==void 0&&V!==z)throw new R("identity-changed","Claustrum served credential identity changed");let U=V??z,j=Object.freeze(Object.defineProperty({credentialId:X,credentialType:J,...U!==void 0&&{accountIdentity:U},accountIdentitySource:H!==void 0?"asserted":B!==void 0?"parsed":z!==void 0?"expected":"none",...z!==void 0&&{expectedAccountIdentity:z},...Q.credentialId!==void 0&&{assertedCredentialId:Q.credentialId},...H!==void 0&&{assertedAccountIdentity:H},...Q.projectId!==void 0&&{projectId:Q.projectId},recordVersion:Q.recordVersion,expiresAtMs:Y},"accessToken",{value:W,enumerable:!1}));return this.#B.set(j,G),j}async reportFailure($,Z,X){if(Z!==401)return;this.#Y();let J=this.#B.get($);if(!J)throw new R("no-receipt","Claustrum failure report requires an original dispatch receipt");let z=this.#H.get($);if(z)return z;let G=this.#j(()=>this.#$.reportAuthFailureScoped({credentialId:$.credentialId,enrollmentToken:J,providerStatus:401,recordVersion:$.recordVersion,reporterSource:X}));this.#H.set($,G);try{await G,this.#X.debug("scoped 401 reported",{credentialId:$.credentialId,recordVersion:$.recordVersion,reporterSource:X})}catch(Q){throw this.#H.delete($),Q}}close(){if(this.#z)return;this.#z=!0,this.#$.close()}}import{createHash as kQ}from"node:crypto";import{readFile as fQ}from"node:fs/promises";function p7($,Z,X){if($.accountIdentity!==void 0&&X!==void 0)return $.accountIdentity===X;return $.credentialId===Z}function k2($,Z,X){return $.some((J)=>p7(J,Z,X))}function f2($,Z,X){let J={credentialId:Z,...X!==void 0&&{accountIdentity:X}};return[...$.filter((z)=>z.credentialId!==Z||z.accountIdentity!==X),J]}function y2($,Z,X){return $.filter((J)=>!Z.some((z)=>p7(J,z,X)))}var l7="vault:";function yQ($){return kQ("sha256").update($).digest("hex")}function vQ($){let Z=$.credentialId.split(":");return(Z.length>=3?Z.slice(2).join(":").trim():void 0)||$.email||$.credentialId}function gQ($){return $.identity!==void 0?`identity:${$.identity}`:`credential:${$.credential.credentialId}`}function D1($){return[$.credentialId,...$.aliases??[]]}function d7($,Z,X={}){let J=X.now??Date.now(),z=X.routePrefix??l7,G=X.reservedRouteIds??new Set,Q=$?.rows??[],Y=[...$?.declined??[]],W=Z.skipped.length===0,H=new Set(Z.credentials.map((L)=>L.credentialId)),B=new Set(Z.skipped.flatMap((L)=>L.credentialId===void 0?[]:[L.credentialId])),V=Z.skipped.some((L)=>L.credentialId===void 0),U=(L)=>!H.has(L)&&(B.has(L)||V),K=new Map;for(let L of Q){if(L.accountIdentity===void 0)continue;for(let N of D1(L))if(!K.has(N))K.set(N,L.accountIdentity)}let j=new Map;for(let L of Z.credentials){let N=L.accountIdentity!==void 0?{credential:L,identity:L.accountIdentity,claimed:!0}:{credential:L,identity:K.get(L.credentialId),claimed:!1},P=gQ(N),S=j.get(P)??[];S.push(N),j.set(P,S)}let M=new Set,D=new Set(G),q=[],F=(L,N)=>L.credential.credentialId.localeCompare(N.credential.credentialId),C=[...j.values()].map((L)=>L.toSorted(F)).sort((L,N)=>L[0]&&N[0]?F(L[0],N[0]):0);for(let L of C){let N=L[0]?.identity,P=L.filter((I)=>I.credential.state==="active"),S=P.length?P:L,f=S.filter((I)=>I.claimed),n=f.length?f:S,C0=new Set(L.map((I)=>I.credential.credentialId)),h=Q.find((I)=>!M.has(I)&&D1(I).some((z0)=>C0.has(z0))&&(I.accountIdentity===void 0||I.accountIdentity===N)),g=n.find((I)=>I.credential.credentialId===h?.credentialId)??n[0];if(!g)continue;let l=g.credential,J0=h??(N===void 0?void 0:Q.find((I)=>!M.has(I)&&I.accountIdentity===N));if(J0)M.add(J0);let c=J0?.routeId;if(!c||G.has(c)){let I=`${z}${l.credentialId}${N===void 0?"":`~${yQ(N).slice(0,10)}`}`;c=I;for(let z0=2;D.has(c);z0++)c=`${I}~${z0}`}D.add(c);let c0=J0?D1(J0).filter(U):[],A=[...new Set([...L.map((I)=>I.credential.credentialId),...c0])].filter((I)=>I!==l.credentialId).sort((I,z0)=>I.localeCompare(z0)),x=X.mapAccount?.(l)??{};q.push({previousIndex:J0?Q.indexOf(J0):1/0,row:{routeId:c,credentialId:l.credentialId,credentialType:l.credentialType,...N!==void 0&&{accountIdentity:N},...A.length&&{aliases:A},state:l.state,label:x.label?.trim()||vQ(l),...l.email!==void 0&&{email:l.email},...l.orgName!==void 0&&{orgName:l.orgName},enabled:![l.credentialId,...A].some((I)=>k2(Y,I,N)),addedAt:J0?.addedAt??J,...J0?.quota!==void 0&&{quota:J0.quota},...!g.claimed&&N!==void 0&&{unclaimed:!0}}})}return Q.forEach((L,N)=>{if(M.has(L)||!D1(L).some(U))return;if(D.has(L.routeId))return;let[P,...S]=D1(L).filter((C0)=>!H.has(C0));if(P===void 0)return;D.add(L.routeId);let{aliases:f,...n}=L;q.push({previousIndex:N,row:{...n,credentialId:P,...S.length&&{aliases:S},stale:!0}})}),q.sort((L,N)=>L.previousIndex===N.previousIndex?L.row.credentialId.localeCompare(N.row.credentialId):L.previousIndex-N.previousIndex),{version:1,view:Z.view,complete:W,...!W&&{rejected:Z.skipped.map((L)=>({...L.credentialId!==void 0&&{credentialId:L.credentialId},reason:L.reason}))},rows:q.map((L)=>L.row),declined:Y}}function v2($){return($?.rows??[]).filter((Z)=>Z.enabled&&Z.state==="active").map((Z)=>({id:Z.routeId,kind:Z.credentialType==="oauth"?"oauth":"api-key",...Z.quota!==void 0&&{quota:Z.quota}}))}function _6($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function K$($){return $===void 0||typeof $==="string"}function hQ($){if(!_6($)||typeof $.routeId!=="string"||typeof $.credentialId!=="string"||$.credentialType!=="oauth"&&$.credentialType!=="api_key"||typeof $.state!=="string"||typeof $.label!=="string"||typeof $.enabled!=="boolean"||typeof $.addedAt!=="number"||!K$($.accountIdentity)||!K$($.email)||!K$($.orgName)||$.aliases!==void 0&&(!Array.isArray($.aliases)||!$.aliases.every((Z)=>typeof Z==="string"))||$.quota!==void 0&&!t($.quota)||$.stale!==void 0&&$.stale!==!0||$.unclaimed!==void 0&&$.unclaimed!==!0)return;return $}var wQ=new Set(["empty credential id","duplicate credential id","blank account identity","empty state"]);function u7($){if(!Array.isArray($))return;let Z=[];for(let X of $){if(!_6(X)||!K$(X.credentialId)||typeof X.reason!=="string"||!wQ.has(X.reason))return;Z.push(X)}return Z}function mQ($){if(!_6($)||$.version!==1||!K$($.view)||!Array.isArray($.rows)||!Array.isArray($.declined)||$.complete!==void 0&&typeof $.complete!=="boolean"||$.rejected!==void 0&&!u7($.rejected))throw new R("invalid-state","Claustrum roster file is not valid");let Z=[];for(let z of $.rows){let G=hQ(z);if(!G)throw new R("invalid-state","Claustrum roster file is not valid");Z.push(G)}let X=[];for(let z of $.declined){if(!_6(z)||typeof z.credentialId!=="string"||!K$(z.accountIdentity))throw new R("invalid-state","Claustrum roster file is not valid");X.push(z)}let J=u7($.rejected);return{version:1,...typeof $.view==="string"&&{view:$.view},complete:$.complete!==!1,...J&&{rejected:J},rows:Z,declined:X}}async function N1($){let Z;try{Z=await fQ($,"utf8")}catch(J){if(J.code==="ENOENT")return;throw J}let X;try{X=JSON.parse(Z)}catch{throw new R("invalid-state","Claustrum roster file is not valid")}return mQ(X)}var pQ={name:"claustrum-roster-write",ttlMs:1e4,timeoutMs:5000},uQ={name:"claustrum-roster",ttlMs:30000};async function r$($,Z,X={}){return D8($,pQ,async(J)=>{let z=await N1($),{next:G,result:Q}=await Z(z,{assertOwned:()=>J.assertOwned()});if(G)await J.assertOwned(),await O0($,G,{beforeRename:async()=>{await X.beforePublish?.(),await J.assertOwned()}});return Q})}function g2($,Z){return r$($,(X)=>{let J=X?.rows.find((G)=>G.routeId===Z);if(!X||!J)throw new R("route-unavailable","Claustrum route is not in the roster");let z=f2(X.declined,J.credentialId,J.accountIdentity);return{next:{...X,declined:z,rows:X.rows.map((G)=>G===J?{...G,enabled:!1}:G)},result:void 0}})}function h2($,Z){return r$($,(X)=>{let J=X?.rows.find((z)=>z.routeId===Z);if(!X||!J)throw new R("route-unavailable","Claustrum route is not in the roster");return{next:{...X,declined:y2(X.declined,D1(J),J.accountIdentity),rows:X.rows.map((z)=>z===J?{...z,enabled:!0}:z)},result:void 0}})}function lQ($,Z){if(!D1($).includes(Z.credentialId))return"refuse";if($.unclaimed&&(Z.accountIdentitySource==="expected"||Z.accountIdentitySource==="none"))return"refuse";if($.accountIdentity===Z.accountIdentity)return"hold";if($.accountIdentity===void 0&&Z.expectedAccountIdentity===void 0&&Z.accountIdentity!==void 0&&(Z.accountIdentitySource==="asserted"||Z.accountIdentitySource==="parsed")&&D1($).length===1)return"bind";return"refuse"}function w2($,Z){return r$($,(X)=>{let J=X?.rows.find((Y)=>Y.routeId===Z.routeId),z=!X||!J?"refuse":lQ(J,Z);if(!X||!J||z==="refuse")return{result:!1};let G=s0(J.quota,Z.observation),Q=z==="bind"?{accountIdentity:Z.accountIdentity,unclaimed:!0}:{};return{next:{...X,rows:X.rows.map((Y)=>Y===J?{...Y,...Q,quota:G}:Y)},result:!0}})}async function m2($){$.signal?.throwIfAborted();let Z=async()=>await $.isActive?.()??!0;if(!await Z())return;let X=await e({...uQ,path:$.path,renew:!0});if(!X){let J=await N1($.path);if($.signal?.throwIfAborted(),!J?.view)throw new R("roster-busy","Claustrum account discovery is already in progress");return J}try{let J=await $.custody.discover($.signal);return $.signal?.throwIfAborted(),await r$($.path,async(z)=>{if(!await Z())return{result:void 0};$.signal?.throwIfAborted(),await X.assertOwned();let G=typeof $.projection==="function"?$.projection():$.projection,Q=d7(z,J,G);return{...JSON.stringify(z)!==JSON.stringify(Q)&&{next:Q},result:Q}})}finally{await X.release()}}class C6{#$;#Z=new AbortController;#W;#G;#Q;#J;#X;#B;#H=!1;constructor($){this.#$=$,this.#W=$.logger??s("claustrum")}#z($){this.#Z.signal.throwIfAborted(),$?.throwIfAborted()}async#Y(){return await this.#$.isCustodyActive?.()??!0}#V($,Z){let X=N2([this.#Z.signal,...Z?[Z]:[]]);return new Promise((J,z)=>{let G=()=>{X.signal.removeEventListener("abort",Q),X.dispose()},Q=()=>{G(),z(X.signal.reason)};if(X.signal.addEventListener("abort",Q,{once:!0}),$.then((Y)=>{if(G(),X.signal.aborted)z(X.signal.reason);else J(Y)},(Y)=>{G(),z(Y)}),X.signal.aborted)Q()})}async#j(){if(this.#z(),this.#G)return this.#G;if(!this.#Q)this.#Q=this.#$.connect().then(($)=>{if(this.#Z.signal.aborted)$.close(),this.#z();return this.#G=new O6({client:$,family:this.#$.family,tokenPath:this.#$.tokenPath,parseIdentity:this.#$.parseIdentity,requireAssertion:this.#$.requireAssertion,now:this.#$.now,logger:this.#W}),this.#G}).finally(()=>{this.#Q=void 0});return this.#V(this.#Q)}snapshot(){return this.#X}routingRows(){return v2(this.#X)}refresh(){if(this.#z(),this.#J)return this.#J;return this.#J=(async()=>{if(!await this.#Y()){this.#X=void 0,this.#G?.close(),this.#G=void 0;return}let $=await this.#j(),Z=await m2({path:this.#$.rosterPath,custody:$,isActive:()=>this.#Y(),signal:this.#Z.signal,projection:()=>({reservedRouteIds:new Set(this.#$.reservedRouteIds?.()??[]),routePrefix:this.#$.routePrefix,mapAccount:this.#$.mapAccount,now:(this.#$.now??Date.now)()})});this.#z();let X=Z?.view!==this.#X?.view;if(this.#X=Z,Z&&X)this.#$.onRoster?.(Z);return Z})().finally(()=>{this.#J=void 0}),this.#J}start(){if(this.#H)return;this.#z(),this.#H=!0;let $=async()=>{try{await this.refresh()}catch(X){if(!this.#Z.signal.aborted)this.#$.onError?.(X)}if(this.#Z.signal.aborted)return;let Z=this.#$.pollIntervalMs??5000;if(Z<=0)return;this.#B=(this.#$.setTimeoutImpl??setTimeout)(()=>{this.#B=void 0,$()},Z),this.#B.unref?.()};$()}async authorize($,Z){this.#z(Z);let X=this.#X??await this.#V(this.refresh(),Z);if(!X||!await this.#Y())throw new R("not-active","Claustrum scoped custody is not active");let J=await N1(this.#$.rosterPath);this.#z(Z);let z=X.rows.find((W)=>W.routeId===$),G=J?.rows.find((W)=>W.routeId===$);if(G&&!G.enabled)throw new R("route-declined","Claustrum route is disabled");if(!z||!G||G.state!=="active"||G.credentialId!==z.credentialId||G.accountIdentity!==z.accountIdentity)throw new R("route-unavailable","Claustrum route is disabled, removed or changed");let Q=await this.#V(this.#j(),Z),Y=N2([this.#Z.signal,...Z?[Z]:[]]);try{return await Q.authorize({credentialId:G.credentialId,credentialType:G.credentialType,...G.accountIdentity!==void 0&&{accountIdentity:G.accountIdentity}},Y.signal)}finally{Y.dispose()}}async reportFailure($,Z,X){if(this.#z(),!this.#G)throw new R("no-receipt","Claustrum dispatch receipt has no active owner");await this.#G.reportFailure($,Z,X)}async send($,Z,X){let J=X.signal,z=await this.authorize($,J),G=await Z(z,J);if(G.status===401&&!J?.aborted){let Q;try{Q=await this.authorize($,J)}catch{}if(E2(X.site,z,Q,this.#W))await G.body?.cancel().catch(()=>{}),z=Q,G=await Z(Q,J)}if(G.status===401)await this.reportFailure(z,401,X.reporterSource??"direct").catch((Q)=>this.#$.onError?.(Q)),Promise.resolve().then(()=>this.refresh()).catch((Q)=>{if(!this.#Z.signal.aborted)this.#$.onError?.(Q)});return G}async decline($){this.#z(),await g2(this.#$.rosterPath,$),this.#X=await N1(this.#$.rosterPath)}async accept($){this.#z(),await h2(this.#$.rosterPath,$),this.#X=await N1(this.#$.rosterPath)}async recordQuota($,Z,X){this.#z();let J=await w2(this.#$.rosterPath,{routeId:$,observation:Z,credentialId:X.credentialId,accountIdentitySource:X.accountIdentitySource,...X.accountIdentity!==void 0&&{accountIdentity:X.accountIdentity},...X.expectedAccountIdentity!==void 0&&{expectedAccountIdentity:X.expectedAccountIdentity}});if(J)this.#X=await N1(this.#$.rosterPath);return J}close(){if(this.#Z.signal.aborted)return;if(this.#Z.abort(new R("closed","Claustrum consumer is closed")),this.#B)(this.#$.clearTimeoutImpl??clearTimeout)(this.#B);this.#B=void 0,this.#G?.close(),this.#X=void 0}}function c7($){return h1.connect($)}var dQ=F6("openai");function s7($){return P6($)}function l0($){if(!$||$.corrupt===!0)return!1;return s7($.refresh)}class o$ extends Error{code="tombstone-refresh";constructor(){super("This OpenAI account was moved into the Claustrum vault by an older version of OpenAI auth and holds no local credential. Connect the vault, or sign in to the account again.");this.name="TombstoneRefreshError"}}function T6($){if(s7($))throw new o$}function Z1($){if($ instanceof Error)return $.message;if(typeof $==="string")return $;try{return JSON.stringify($)}catch{return String($)}}var cQ=s("quota");var sQ="app_EMoamEEZ73f0CkXaXp7hrann",iQ="https://auth.openai.com";async function i7($){T6($.refreshToken);let Z=await $.fetchImpl(`${iQ}/oauth/token`,{method:"POST",signal:AbortSignal.timeout(15000),headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"refresh_token",refresh_token:$.refreshToken,client_id:sQ}).toString()});if(!Z.ok){let z=l8(Z.headers.get("retry-after"));throw Object.assign(Error(`Token refresh failed: ${Z.status}`),{status:Z.status,retryAfter:z,isRefreshError:!0})}let X=await Z.json();if(!X||typeof X.access_token!=="string"||!X.access_token||typeof X.expires_in!=="number")throw Object.assign(Error("Token refresh failed: malformed response"),{status:Z.status,isRefreshError:!0});if(X.refresh_token!==void 0&&typeof X.refresh_token!=="string")throw Object.assign(Error("Token refresh failed: malformed response"),{status:Z.status,isRefreshError:!0});let J=typeof X.refresh_token==="string"&&X.refresh_token?X.refresh_token:$.refreshToken;return{access:X.access_token,refresh:J,expires:$.now()+X.expires_in*1000,expiresIn:X.expires_in}}var aQ="https://chatgpt.com/backend-api/wham/usage";async function q$($){let Z=$.logger??cQ,X=$.accountKey??"unknown",J=Date.now();Z.debug("wham usage fetch started",{pid:process.pid,accountId:X});try{let z=await $.fetchImpl(aQ,{signal:AbortSignal.timeout(15000),headers:{authorization:`Bearer ${$.accessToken}`,"chatgpt-account-id":$.accountId??"","oai-client-platform":"web","oai-client-version":"0","x-openai-target-path":"/backend-api/wham/usage"}});if(!z.ok){let Q=l8(z.headers.get("retry-after"));throw Object.assign(Error(`wham usage check failed: ${z.status}`),{status:z.status,retryAfter:Q})}let G=AZ(await z.json());return Z.debug("wham usage fetch succeeded",{pid:process.pid,accountId:X,status:z.status,elapsedMs:Date.now()-J}),G}catch(z){throw Z.warn("wham usage fetch failed",{pid:process.pid,accountId:X,status:typeof z?.status==="number"?z.status:"error",elapsedMs:Date.now()-J,error:Z1(z)}),z}}import{createHash as oQ}from"node:crypto";var tQ=globalThis.setTimeout,eQ=5;function t$($){let Z=$?.quota?.checkIntervalMinutes??eQ;return Math.max(1,Z)*60000}function $Y($){return $?.quota?.enabled!==!1}function u2($,Z){if(!$?.resetsAt)return!1;let X=Date.parse($.resetsAt);return Number.isFinite(X)&&X<=Z}function ZY($){let Z=$?.quota?.minimumRemaining||{};return{primary:Z.primary??Z["5h"]??15,secondary:Z.secondary??Z["1w"]??10}}function a7($,Z,X){if(!$Y(Z))return X+t$(Z);let J=ZY(Z),z=[];for(let G of["primary","secondary"]){let Q=$?.[G];if(!Q)continue;if(Q.remainingPercent>=J[G])continue;let Y=Q.resetsAt?Date.parse(Q.resetsAt):Number.NaN;if(!Number.isFinite(Y)||Y<=X)return X+t$(Z);z.push(Y)}if(!z.length)return X+t$(Z);return Math.min(...z)+60000}function XY($){if(!$?.quota?.mainQuota||!$.quota.mainQuotaCheckedAt)return null;return{quota:$.quota.mainQuota,checkedAt:$.quota.mainQuotaCheckedAt,tokenFingerprint:$.quota.mainQuotaToken}}function JY($){let Z=$?.quota?.refreshEveryNRequests;return typeof Z==="number"&&Number.isFinite(Z)&&Z>0?Math.floor(Z):0}function _0($){return oQ("sha256").update($).digest("hex").slice(0,16)}class M1{main=null;mainTokenFp=null;mainQuotaAccountId=null;fallbacks=new Map;fallbackTokenFps=new Map;inflightMain=null;inflightMainFp=null;inflightFallbacks=new Map;mainLastApiError=void 0;fallbackApiErrors=new Map;fallbackErrorTokenFps=new Map;rateLimitedUntilMap=new Map;apiGate=Promise.resolve();lastApiCallAt=0;storage;fetchImpl;now;fetchQuotaFn;onMainQuotaFetched;onApiError;configPath;constructor($){this.storage=$.storage,this.fetchImpl=$.fetchImpl??fetch,this.configPath=$.configPath,this.now=$.now??Date.now,this.fetchQuotaFn=$.fetchQuotaFn,this.onMainQuotaFetched=$.onMainQuotaFetched,this.onApiError=$.onApiError,this.seedMainFromStorage($.storage),this.seedMainBackoffFromStorage($.storage)}getMain($){if($&&this.main&&this.mainTokenFp&&this.mainTokenFp!==_0($))this.main=null,this.mainTokenFp=null;return this.main}getFallback($,Z){let X=this.fallbacks.get($)??null;if(!Z||!X)return X;if(this.fallbackTokenFps.get($)!==_0(Z))return this.fallbacks.delete($),this.fallbackTokenFps.delete($),null;return X}getAllFallbacks(){return this.fallbacks}setMain($,Z,X,J=!1){if(!J&&!n7(Z.quota))return;if(this.mainTokenFp=_0($),X&&this.mainQuotaAccountId&&this.mainQuotaAccountId!==X)this.clearRateLimited("main");if(X)this.mainQuotaAccountId=X;if(this.main=Z,p2(Z.quota))this.clearRateLimited("main")}peekMainForPolicy($){if($&&this.mainQuotaAccountId&&this.mainQuotaAccountId!==$)return null;return this.main}peekFallbackForPolicy($,Z){let X=this.fallbacks.get($)??null;if(Z&&X?.accountId&&X.accountId!==Z)return null;return X}setFallback($,Z,X,J=!1,z){if(!J&&!n7(Z.quota))return;let G=this.fallbacks.get($)?.accountId;if(z&&G&&z!==G)this.clearRateLimited($);let Q=z??G;if(this.fallbacks.set($,{...Z,accountId:Q}),X)this.fallbackTokenFps.set($,_0(X));else this.fallbackTokenFps.delete($);if(p2(Z.quota))this.clearRateLimited($)}markRateLimited($,Z){let X=this.rateLimitedUntilMap.get($);if(X!==void 0&&X>Z)return;this.rateLimitedUntilMap.set($,Z)}isRateLimited($){let Z=this.rateLimitedUntilMap.get($);return Z!==void 0&&this.now()<Z}rateLimitedUntil($){return this.rateLimitedUntilMap.get($)}clearRateLimited($){this.rateLimitedUntilMap.delete($)}async refreshMain($){let Z=_0($);if(this.mainTokenFp&&this.mainTokenFp!==Z)this.main=null,this.mainTokenFp=null;if(this.inflightMain&&this.inflightMainFp===Z)return this.inflightMain;if(this.isBackedOff()){if(this.main)return this.main.quota;throw Error("Quota API rate-limited — try again later")}return this.inflightMainFp=Z,this.inflightMain=this._fetchMain($),this.inflightMain}async refreshFallback($,Z){let X=M1.fallbackInflightKey($,Z),J=this.inflightFallbacks.get(X);if(J)return J;if(this.isFallbackBackedOff($,Z)){let G=this.getFallback($,Z);if(G)return G.quota;throw Error("Quota API rate-limited — try again later")}let z=this._fetchFallback($,Z);return this.inflightFallbacks.set(X,z),z}async refreshAllFallbacks($){let Z=this.now();for(let X of $){if(X.enabled===!1)continue;if(l0(X)||!X.access)continue;let J=this.getFallback(X.id,X.access);if(J&&Z<J.refreshAfter)continue;try{await this.refreshFallback(X.id,X.access)}catch{}}}refreshMainInBackground($){let Z=_0($);if(this.inflightMain&&this.inflightMainFp===Z)return;if(this.isBackedOff())return;this.refreshMain($).catch(()=>{})}isMainStale(){if(!this.main)return!0;return this.now()>=this.main.refreshAfter}isFallbackStale($,Z){let X=this.getFallback($,Z);if(!X)return!0;return this.now()>=X.refreshAfter}shouldRefreshOnRequestCount($){let Z=JY(this.storage);if(Z<=0)return!1;return $>0&&$%Z===0}needsRefresh($){return this.isMainStale()||this.shouldRefreshOnRequestCount($)}updateStorage($){this.storage=$,this.seedMainFromStorage($),this.seedMainBackoffFromStorage($)}seedMainFromStorage($,Z){let X=XY($);if(!X)return;let J=Z?_0(Z):null;if(J&&X.tokenFingerprint&&X.tokenFingerprint!==J)return;let z={quota:X.quota,refreshAfter:a7(X.quota,$,X.checkedAt),checkedAt:X.checkedAt};if(this.main&&this.main.checkedAt>=z.checkedAt&&(!J||!this.mainTokenFp||this.mainTokenFp===J))return;if(this.main=z,this.mainTokenFp=X.tokenFingerprint??null,$?.mainAccountId){if(this.mainQuotaAccountId&&this.mainQuotaAccountId!==$.mainAccountId)this.clearRateLimited("main");this.mainQuotaAccountId=$.mainAccountId}}seedMainBackoffFromStorage($){let Z=$?.quota?.mainLastQuotaApiError;this.mainLastApiError=Z&&G$(Z,this.now())?Z:void 0}seedFallbacksFromAccounts($){let Z=t$(this.storage);for(let X of $){if(X.enabled===!1)continue;if(!X.quota)continue;let J=Math.max(X.quota.primary?.checkedAt??0,X.quota.secondary?.checkedAt??0);if(J<=0)continue;let z=this.getFallback(X.id,X.access);if(z&&z.checkedAt>=J)continue;this.setFallback(X.id,{quota:X.quota,refreshAfter:J+Z,checkedAt:J},X.access,!1,X.accountId)}}isBackedOff(){return G$(this.mainLastApiError,this.now())}isFallbackBackedOff($,Z){if(Z){if(this.fallbackErrorTokenFps.get($)!==_0(Z))return!1}return G$(this.fallbackApiErrors.get($),this.now())}getLastApiError(){return this.mainLastApiError}static API_CALL_GAP_MS=1000;static fallbackInflightKey($,Z){return JSON.stringify([$,_0(Z)])}static quotaLockName($){return`opencode-fallback-quota-refresh-${$.replace(/[^a-zA-Z0-9._-]+/g,"-")||"account"}`}_enqueueApiFetch($){let Z=async()=>{let J=this.now()-this.lastApiCallAt;if(J<M1.API_CALL_GAP_MS)await new Promise((z)=>{let G=tQ(z,M1.API_CALL_GAP_MS-J);if(typeof G==="object"&&"unref"in G)G.unref()});return this.lastApiCallAt=this.now(),$()},X=this.apiGate.then(Z,Z);return this.apiGate=X.catch(()=>{}),X}async _fetchMain($){let Z=_0($);return this._enqueueApiFetch(async()=>{try{if(this.isBackedOff()){if(this.main)return this.main.quota;throw Error("Quota API rate-limited — try again later")}let X=await e({name:"opencode-main-quota-refresh",ttlMs:30000,path:this.configPath});if(!X){let J=this.main;if(J&&this.now()<J.refreshAfter)return J.quota;throw Error("Quota refresh is already in progress")}try{let J=this.now(),z=await this._fetchQuota($),G=this.now();if(this.mainTokenFp=_0($),this.main={quota:z,refreshAfter:a7(z,this.storage,G),checkedAt:G},p2(z))this.clearRateLimited("main");return this.mainLastApiError=void 0,this.onMainQuotaFetched?.(z,G,this.mainTokenFp,J),z}catch(J){throw this._handleMainFetchError(J),J}finally{await X.release()}}finally{if(this.inflightMainFp===Z)this.inflightMain=null,this.inflightMainFp=null}})}async _fetchFallback($,Z){return this._enqueueApiFetch(async()=>{try{if(this.isFallbackBackedOff($,Z)){let J=this.getFallback($,Z);if(J)return J.quota;throw Error("Quota API rate-limited — try again later")}let X=await e({name:M1.quotaLockName($),ttlMs:30000,path:this.configPath});if(!X){let J=this.getFallback($,Z);if(J&&this.now()<J.refreshAfter)return J.quota;throw Error("Quota refresh is already in progress")}try{let J=await this._fetchQuota(Z),z=this.now();return this.setFallback($,{quota:J,refreshAfter:z+t$(this.storage),checkedAt:z},Z,!0),this.fallbackApiErrors.delete($),this.fallbackErrorTokenFps.delete($),J}finally{await X.release()}}catch(X){throw this._handleFallbackFetchError($,Z,X),X}finally{this.inflightFallbacks.delete(M1.fallbackInflightKey($,Z))}})}async _fetchQuota($){if(!this.fetchQuotaFn)throw Error("Quota fetch not available — no fetchQuotaFn injected (push-only mode)");return this.fetchQuotaFn({accessToken:$,fetchImpl:this.fetchImpl,now:this.now})}static isAuthError($){return $?.status===401}_handleMainFetchError($){if(M1.isAuthError($))return;this.mainLastApiError=h$({error:$,now:this.now(),previous:this.mainLastApiError}),this.onApiError?.(this.mainLastApiError)}_handleFallbackFetchError($,Z,X){if(M1.isAuthError(X))return;let J=_0(Z),z=this.fallbackErrorTokenFps.get($)===J?this.fallbackApiErrors.get($):void 0;this.fallbackApiErrors.set($,h$({error:X,now:this.now(),previous:z})),this.fallbackErrorTokenFps.set($,J)}}function n7($){return Boolean($.primary||$.secondary)}function p2($){let{primary:Z,secondary:X}=$;if(!Z&&!X)return!1;if(Z&&Z.usedPercent>=100)return!1;if(X&&X.usedPercent>=100)return!1;return!0}import{readFile as LY}from"node:fs/promises";var p1=s("refresh"),c2=s("accounts"),YY=1e4,WY=15000,l2=50;function L1($){return $.type==="oauth"&&$.corrupt!==!0}function BY($){let Z=$?.trim();if(!Z)return!1;try{let X=new URL(Z);return(X.protocol==="http:"||X.protocol==="https:")&&!X.username&&!X.password}catch{return!1}}var N$="floors-v1";class R6 extends Error{code="ACCOUNT_REMOVED_DURING_REFRESH";constructor($){super(`Fallback account ${$} was removed before refresh`);this.name="AccountRemovedDuringRefreshError"}}var HY=[401,403,429],r7={primary:0,secondary:0},VY=!1,F1={primary:5,secondary:10};function b($){return $!=null&&typeof $==="object"&&!Array.isArray($)}var jY=new Set(["__proto__","constructor","prototype"]);function n2($){return $.length>0&&!jY.has($)}function UY($){return $ instanceof R6||b($)&&$.name==="AccountRemovedDuringRefreshError"&&$.code==="ACCOUNT_REMOVED_DURING_REFRESH"}function A6($){return{id:typeof $.id==="string"&&$.id.trim()?$.id.trim():GY(),label:typeof $.label==="string"?$.label:void 0,enabled:typeof $.enabled==="boolean"?$.enabled:void 0,addedAt:typeof $.addedAt==="number"?$.addedAt:void 0,lastUsed:typeof $.lastUsed==="number"?$.lastUsed:void 0,accountId:typeof $.accountId==="string"?$.accountId:void 0}}function o7($){if(!b($))return;if(typeof $.message!=="string")return;let Z=Number($.checkedAt);if(!Number.isFinite(Z))return;let X=Number($.nextRetryAt),J=Number($.retryCount);return{message:$.message,checkedAt:Z,nextRetryAt:Number.isFinite(X)?X:void 0,retryCount:Number.isFinite(J)?J:void 0,tokenHash:typeof $.tokenHash==="string"?$.tokenHash:void 0}}function KY($){if(!b($))return;let Z={};for(let z of["primary","secondary"]){let G=$[z];if(!b(G))continue;let Q=Number(G.usedPercent),Y=Number(G.remainingPercent),W=Number(G.checkedAt);if(!Number.isFinite(Q)||!Number.isFinite(Y)||!Number.isFinite(W))continue;let H=typeof G.windowMinutes==="number"?G.windowMinutes:Number.NaN;Z[z]={usedPercent:Q,remainingPercent:Y,checkedAt:W,resetsAt:typeof G.resetsAt==="string"?G.resetsAt:void 0,...Number.isFinite(H)&&H>0?{windowMinutes:H}:{}}}for(let z of["resetCreditsAvailable","resetCreditsApplicable"]){let G=typeof $[z]==="number"?$[z]:Number.NaN;if(Number.isFinite(G)&&G>=0)Z[z]=G}let X=$.spendControl;if(b(X)){let z=Number(X.limit),G=Number(X.used),Q=Number(X.remaining),Y=Number(X.usedPercent),W=Number(X.remainingPercent);if(Number.isFinite(z)&&Number.isFinite(G)&&Number.isFinite(Q)&&Number.isFinite(Y)&&Number.isFinite(W)&&typeof X.reached==="boolean")Z.spendControl={limit:z,used:G,remaining:Q,usedPercent:Y,remainingPercent:W,resetsAt:typeof X.resetsAt==="string"?X.resetsAt:void 0,unit:typeof X.unit==="string"?X.unit:void 0,source:typeof X.source==="string"?X.source:void 0,reached:X.reached}}let J=$.credits;if(b(J)&&typeof J.hasCredits==="boolean"&&typeof J.unlimited==="boolean"&&typeof J.overageLimitReached==="boolean"){let z=Number(J.balance);Z.credits={hasCredits:J.hasCredits,unlimited:J.unlimited,overageLimitReached:J.overageLimitReached,...Number.isFinite(z)?{balance:z}:{}}}return Object.keys(Z).length?Z:void 0}function qY($){if(!b($))return null;if($.type==="api"){let Z=typeof $.baseURL==="string"?$.baseURL.trim():"",X=typeof $.apiKey==="string"?$.apiKey.trim():"";if(!BY(Z))return null;let J=$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer";return{...A6($),type:"api",apiKey:X||void 0,baseURL:Z,authHeader:J}}if($.type!=="oauth")return null;if($.corrupt===!0){if(typeof $.id!=="string"||!$.id.trim())return null;return{...A6($),type:"oauth",corrupt:!0}}if(typeof $.refresh!=="string"||!$.refresh.trim()){if(!Object.hasOwn($,"refresh")||typeof $.id!=="string"||!$.id.trim())return null;return{...A6($),type:"oauth",corrupt:!0}}return{...A6($),type:"oauth",access:typeof $.access==="string"?$.access:void 0,refresh:$.refresh,expires:typeof $.expires==="number"?$.expires:void 0,lastRefreshedAt:typeof $.lastRefreshedAt==="number"?$.lastRefreshedAt:void 0,lastRefreshError:o7($.lastRefreshError),lastQuotaRefreshError:o7($.lastQuotaRefreshError),quota:KY($.quota)}}function DY($){if(!b($))return;let Z=Object.create(null);for(let[X,J]of Object.entries($)){if(!n2(X)||!b(J))continue;let z={};if(b(J.inFlight))z.inFlight={...J.inFlight};if(b(J.lastOutcome)&&typeof J.lastOutcome.code==="string"&&J.lastOutcome.code.length>0&&typeof J.lastOutcome.at==="number"&&Number.isFinite(J.lastOutcome.at))z.lastOutcome={code:J.lastOutcome.code,at:J.lastOutcome.at,...b(J.lastOutcome.previousOutcome)&&typeof J.lastOutcome.previousOutcome.code==="string"&&J.lastOutcome.previousOutcome.code.length>0&&typeof J.lastOutcome.previousOutcome.at==="number"&&Number.isFinite(J.lastOutcome.previousOutcome.at)?{previousOutcome:{code:J.lastOutcome.previousOutcome.code,at:J.lastOutcome.previousOutcome.at}}:{}};if(typeof J.cooldownUntil==="number"&&Number.isFinite(J.cooldownUntil))z.cooldownUntil=J.cooldownUntil;if(Object.keys(z).length>0)Z[X]=z}return Object.keys(Z).length>0?Z:void 0}var t7=new Set;function NY($){if($.length===0)return;let Z=JSON.stringify([...$].sort());if(t7.has(Z))return;t7.add(Z),c2.warn("account load-dropped, preserved on disk",{droppedIds:$})}function MY($){if(!b($)||!Array.isArray($.accounts))return null;let Z=$.accounts,X=Z.map(qY).filter((J)=>J!=null);if(X.length<Z.length){let J=new Set;for(let Q of Z)if(b(Q)&&typeof Q.id==="string"&&Q.id.trim())J.add(Q.id.trim());let z=new Set(X.map((Q)=>Q.id)),G=[];for(let Q of J)if(!z.has(Q))G.push(Q);NY(G)}return{version:1,main:{type:"opencode",provider:"openai"},routing:b($.routing)?$.routing:void 0,fallbackOn:Array.isArray($.fallbackOn)?$.fallbackOn.filter((J)=>Number.isInteger(J)):void 0,refresh:b($.refresh)?$.refresh:void 0,quota:b($.quota)?$.quota:void 0,reset:DY($.reset),dump:b($.dump)?$.dump:void 0,costZeroing:b($.costZeroing)?$.costZeroing:void 0,killswitch:b($.killswitch)?$.killswitch:void 0,logging:b($.logging)?$.logging:void 0,cachekeep:b($.cachekeep)?$.cachekeep:void 0,cacheKeep:b($.cacheKeep)?$.cacheKeep:void 0,mainAccountId:typeof $.mainAccountId==="string"?$.mainAccountId:void 0,accounts:X}}async function S6($){try{return{exists:!0,value:JSON.parse(await LY($,"utf8"))}}catch(Z){if(Z.code==="ENOENT")return{exists:!1,value:null};throw Z}}function I6($){return Object.fromEntries(Object.entries($).filter(([,Z])=>Z!==void 0))}async function FY($){let Z;try{Z=(await S6($)).value}catch{return null}return xY(Z)}function PY($,Z){if(!b($))return $;let X=b(Z)?Z:{},J=b(X.main)?X.main:void 0,z=b(X.accounts)?X.accounts:{},G=b($.quota)?$.quota:{},Q=b($.refresh)?$.refresh:{},Y=J??G,W=J??Q,B=Q.mainRefreshLeaseId!==void 0?{id:Q.mainRefreshLeaseId,until:Q.mainRefreshLeaseUntil,tokenHash:Q.mainRefreshLeaseTokenHash}:{id:W.refreshLeaseId,until:W.refreshLeaseUntil,tokenHash:W.refreshLeaseTokenHash},U=Array.isArray($.accounts)?$.accounts.map((K)=>{if(!b(K))return K;let j=typeof K.id==="string"&&b(z[K.id])?z[K.id]:{};return{...K,...j}}):void 0;return OY({...$,refresh:I6({...Q,mainLastRefreshError:Q.mainLastRefreshError??W.lastRefreshError,mainRefreshLeaseId:B.id,mainRefreshLeaseUntil:B.until,mainRefreshLeaseTokenHash:B.tokenHash}),quota:I6({...G,mainQuota:Y.quota,mainQuotaCheckedAt:Y.quotaCheckedAt,mainQuotaToken:Y.quotaToken,mainLastQuotaApiError:Y.lastQuotaApiError}),accounts:U})}async function r2($){let Z=await S6($.configPath);if(!Z.exists)return null;let X=await S6($.statePath);return MY(PY(Z.value,X.value))}function OY($){return Object.fromEntries(Object.entries($).filter(([,Z])=>Z!==void 0))}function _Y($){if($.type==="api")return I6({apiKey:$.apiKey,lastUsed:$.lastUsed});if($.corrupt)return{};return I6({access:$.access,refresh:$.refresh,expires:$.expires,lastUsed:$.lastUsed,lastRefreshedAt:$.lastRefreshedAt,lastRefreshError:$.lastRefreshError,lastQuotaRefreshError:$.lastQuotaRefreshError,quota:$.quota})}function x6($){return Math.max($?.primary?.checkedAt??0,$?.secondary?.checkedAt??0)}function e$($,Z,X){if(X in Z)$[X]=Z[X];else delete $[X]}function CY($,Z){return $.access===Z.access&&$.refresh===Z.refresh&&$.expires===Z.expires&&$.lastRefreshedAt===Z.lastRefreshedAt}function TY($,Z){if(!CY($,Z))return Z;if(!("lastRefreshError"in Z))return $;if(!("lastRefreshError"in $))return Z;return(Z.lastRefreshError?.checkedAt??0)>($.lastRefreshError?.checkedAt??0)?Z:$}var AY=300000;function e7($,Z){if($===void 0)return 0;return $>Z+AY?0:$}function RY($,Z,X){let J=Date.now(),z=e7(Z.lastRefreshedAt,J),G=e7(X.lastRefreshedAt,J),Q=Z.expires??0,Y=X.expires??0,W=G>z?X:z>G?Z:Y>Q?X:Q>Y?Z:TY(Z,X);e$($,W,"access"),e$($,W,"refresh"),e$($,W,"expires"),e$($,W,"lastRefreshedAt"),e$($,W,"lastRefreshError")}function SY($,Z){if(!b($))return Z;let X=$,J=x6(X.quota),z=x6(Z.quota),G=J>z,Q=G?{...X,...Z,quota:X.quota,lastQuotaRefreshError:X.lastQuotaRefreshError}:{...X,...Z};if(!G&&!("lastQuotaRefreshError"in Z))delete Q.lastQuotaRefreshError;if(!("lastRefreshError"in Z))delete Q.lastRefreshError;if(typeof X.lastUsed==="number"&&(typeof Z.lastUsed!=="number"||X.lastUsed>Z.lastUsed))Q.lastUsed=X.lastUsed;return RY(Q,X,Z),Q}async function IY($,Z=!1){let X=Date.now(),J=X+WY,z=0;while(Date.now()<=J){z++;let Y=await e({name:"save",ttlMs:YY,path:$,renew:Z});if(Y)return Y;let W=J-Date.now();if(W<=0)break;await QY(Math.min(l2+Q5(l2),W))}let G=Date.now()-X,Q=Math.round(G/Math.max(1,z));throw Error(`Timed out after ${G}ms waiting for the account store lock on ${$} (${z} attempts, ~${Q}ms apart; retry interval is ${l2}ms). A gap near the retry interval means lock contention; a much larger one means this process's event loop was saturated and the wait expired without getting scheduled.`)}function xY($){if(!b($)||!Array.isArray($.accounts))return null;let Z=new Set;for(let X of $.accounts){if(!b(X))continue;if(typeof X.id!=="string")continue;let J=X.id.trim();if(!J)continue;Z.add(J)}return Z}function bY($,Z){$.main=$.main??{};let X=typeof $.main.quotaCheckedAt==="number"?$.main.quotaCheckedAt:x6($.main.quota),J=typeof Z.quota?.mainQuotaCheckedAt==="number"?Z.quota.mainQuotaCheckedAt:x6(Z.quota?.mainQuota);if(X>J)return;$.main.quota=Z.quota?.mainQuota,$.main.quotaCheckedAt=Z.quota?.mainQuotaCheckedAt,$.main.quotaToken=Z.quota?.mainQuotaToken,$.main.lastQuotaApiError=Z.quota?.mainLastQuotaApiError}function EY($,Z){$.main=$.main??{},$.main.lastRefreshError=Z.refresh?.mainLastRefreshError,$.main.refreshLeaseId=Z.refresh?.mainRefreshLeaseId,$.main.refreshLeaseUntil=Z.refresh?.mainRefreshLeaseUntil,$.main.refreshLeaseTokenHash=Z.refresh?.mainRefreshLeaseTokenHash}function s2($){if(Array.isArray($))return $.map(s2);if(!b($))return $;return Object.fromEntries(Object.entries($).filter(([,Z])=>Z!==void 0).map(([Z,X])=>[Z,s2(X)]))}async function kY($,Z,X={mainQuota:!0,mainRefresh:!0,accounts:!0},J){let z=Z.statePath,G=await IY(z);try{let Q=(await S6(z)).value,Y=b(Q)?{...Q,version:1}:{version:1};if(X.mainQuota)bY(Y,$);if(X.mainRefresh)EY(Y,$);if(X.accounts){let W=X.accounts===!0?null:new Set(X.accounts),H=await FY(Z.configPath);Y.accounts={...b(Y.accounts)?Y.accounts:{}};for(let B of $.accounts){if(W&&!W.has(B.id))continue;if(H&&!H.has(B.id))continue;Y.accounts[B.id]=SY(Y.accounts[B.id],_Y(B))}if(W){for(let B of W)if(!$.accounts.some((V)=>V.id===B))delete Y.accounts[B]}if(H){for(let B of Object.keys(Y.accounts))if(!H.has(B))delete Y.accounts[B]}}if(J&&!J())return;await O0(z,s2(Y))}finally{await G.release()}}function z5($){return $?.fallbackOn?.length?$.fallbackOn:HY}function fY($){let Z=$?.quota?.minimumRemaining||{};return{primary:Z.primary??Z["5h"]??r7.primary,secondary:Z.secondary??Z["1w"]??r7.secondary}}function i2($){return $?.quota?.enabled!==!1}function Z3($){return $?.quota?.failClosedOnUnknownQuota??VY}function b6($,Z,X=Date.now()){if(!i2(Z))return!0;if(!$)return!Z3(Z);let J=fY(Z),z=Z3(Z);for(let G of["primary","secondary"]){let Q=$[G];if(!Q)continue;if(u2(Q,X)){if(z)return!1;continue}if(Q.remainingPercent<J[G])return!1}return!0}function o2($){return $?.killswitch?.enabled===!0}function $5($){return{primary:$?.primary??$?.["5h"]??F1.primary,secondary:$?.secondary??$?.["1w"]??F1.secondary}}function Z5($){return typeof $==="number"&&Number.isFinite($)?$:0}function P1($,Z){if(!$?.killswitch)return F1;if($.killswitch.schema===N$){let{accounts:X,defaults:J}=$.killswitch,z=Z??"main",G=b(X)&&Object.hasOwn(X,z)&&b(X[z])?X[z]:b(J)?J:void 0;return{primary:Z5(G?.primary),secondary:Z5(G?.secondary)}}if(Z&&$.killswitch.accounts?.[Z])return $5($.killswitch.accounts[Z]);return $5($.killswitch.main)}function G5($,Z,X,J=Date.now()){if(!o2(Z))return!0;if(!$)return!Z3(Z);let z=P1(Z,X),G=Z3(Z);for(let Q of["primary","secondary"]){let Y=$[Q];if(!Y)continue;if(u2(Y,J)){if(G)return!1;continue}if(Y.remainingPercent<z[Q])return!1}return!0}function yY($){return $?.refresh?.enabled!==!1}function t2($){return($?.refresh?.refreshBeforeExpiryMinutes??240)*60000}function Q5($){return Math.floor(Math.random()*($+1))}function u1($,Z,X){return!$.access||!$.expires||$.expires-X<=t2(Z)}function vY($,Z){return Boolean($.access&&typeof $.expires==="number"&&$.expires>Z)}function D$($,Z){return Boolean($?.mainAccountId&&Z.accountId&&Z.accountId===$.mainAccountId)}class Y5 extends Error{constructor($){super(`Refusing to refresh account ${$}: it holds the main account's credential while the main slot is live`);this.name="ShieldedMainRowRefreshError"}}function M0($,Z){let X=$.accounts.findIndex((J)=>J.id===Z.id);if(X!==-1)$.accounts[X]=Z}function $3($){return $ instanceof Error?$.message:String($)}function a2($,Z,X){if(Z instanceof o$)return;$.lastRefreshError=d3({error:Z,now:X,refreshToken:$.refresh,previous:$.lastRefreshError})}function d2($,Z,X){if(Z instanceof o$)return;if($.lastQuotaRefreshError=h$({error:Z,now:X,previous:$.lastQuotaRefreshError}),Z?.isRefreshError===!0)a2($,Z,X)}function X5($,Z){if(!$)return!1;if(!$.resetsAt)return!0;let X=Date.parse($.resetsAt);return Number.isFinite(X)?X>Z:!0}function gY($,Z){if(!$)return!1;return X5($.primary,Z)||X5($.secondary,Z)}function hY($,Z,X){if(!$)return!1;let J=Z?.quota?.checkIntervalMinutes??5,z=Math.max(1,J)*60000,G=Math.max($.primary?.checkedAt??0,$.secondary?.checkedAt??0);return X-G<z}function J5($,Z,X){return!hY($.quota,Z,X)}function wY($,Z,X,J){return u8(X)&&b6($.quota,Z,J)&&gY($.quota,J)}function mY($){let Z=$?.quota?.checkIntervalMinutes??5;return Math.max(1,Z)*60000}var pY=60000,uY=60000,lY=600000;function dY($){return`fallback-oauth-refresh-${zY("sha256").update($).digest("base64url").slice(0,16)}`}var cY=1e4,sY=100;class iY{now;fetchImpl;paths;refreshPromises=new Map;refreshTimer=null;quotaTimer=null;quotaManager;onFallbackStorageChanged;options;constructor($){this.options=$,this.now=$.now??Date.now,this.fetchImpl=$.fetchImpl??fetch,this.paths=$.paths,this.quotaManager=$.quotaManager??null,this.onFallbackStorageChanged=$.onFallbackStorageChanged}assertNotTombstoned($){if($)T6($.refresh)}seedFallbackQuota($,Z){if(!this.quotaManager)return;if(!$.quota)return;let X=Math.max($.quota.primary?.checkedAt??0,$.quota.secondary?.checkedAt??0);if(X<=0)return;let J=this.quotaManager.getFallback($.id,$.access);if(J&&J.checkedAt>=X)return;this.quotaManager.setFallback($.id,{quota:$.quota,refreshAfter:X+mY(Z),checkedAt:X},$.access,!1,$.accountId)}async load(){return r2(this.paths)}selectionBookkeeping=Promise.resolve();selectionBookkeepingSettled(){return this.selectionBookkeeping}async save($,Z){await kY($,this.paths,{accounts:Z??!0},this.options.canWrite)}startBackgroundRefresh(){let $=async()=>{if(await this.options.backgroundRefreshPaused?.())return;if(await this.refreshDueAccounts(),this.options.fetchQuotaFn)await this.refreshQuotaForDueAccounts()};if($().catch(()=>{}),!this.refreshTimer){if(this.refreshTimer=setInterval(()=>{$().catch(()=>{})},pY+Q5(uY)),"unref"in this.refreshTimer)this.refreshTimer.unref()}}stopBackgroundRefresh(){if(this.refreshTimer)clearInterval(this.refreshTimer);if(this.quotaTimer)clearInterval(this.quotaTimer);this.refreshTimer=null,this.quotaTimer=null}async getUsableFallbackAccounts($){let Z=$!==void 0?$:await this.load();if(!Z)return[];let X=[],J=!1;for(let z of Z.accounts){if(z.enabled===!1||!L1(z))continue;if(D$(Z,z))continue;if(l0(z))continue;let G=!1,Q=z;try{if(u1(Q,Z,this.now())){let Y=Q.lastRefreshError;if(Y&&V1(Y,Q.refresh,this.now()))throw G=!0,Error(g$(Y,this.now()));try{Q=await this.refreshAccount(Q,Z),J=!0}catch(W){if(UY(W))continue;G=!0;let H=Z.accounts.find((B)=>B.id===z.id&&L1(B));if(H&&!V1(H.lastRefreshError,H.refresh,this.now()))a2(H,W,this.now()),M0(Z,H),J=!0;throw W}}if(this.seedFallbackQuota(Q,Z),this.accountPassesQuotaPolicy(this.quotaPolicyAccount(Q),Z))X.push(Q)}catch(Y){let W=vY(Q,this.now());if(G){if(!W)continue}else if(!W)continue;if(wY(Q,Z,Y,this.now()))p1.debug("fallback quota using cached quota after refresh error",{pid:process.pid,accountId:Q.id,error:$3(Y)}),X.push(Q);else if(!Z3(Z))X.push(Q)}}if(J){let z=structuredClone(Z);this.selectionBookkeeping=this.selectionBookkeeping.then(()=>this.save(z)).catch((G)=>{c2.warn("fallback selection bookkeeping not persisted",{pid:process.pid,error:$3(G)})})}return X}async markUsed($){try{let Z=await this.load();if(!Z)return;let X=Z.accounts.find((J)=>J.id===$.id);if(!X)return;X.lastUsed=this.now(),await this.save(Z,[X.id])}catch(Z){c2.warn("lastUsed stamp not persisted",{pid:process.pid,accountId:$.id,error:$3(Z)})}}accountPassesQuotaPolicy($,Z){return b6($.quota,Z,this.now())}quotaPolicyAccount($){if(!this.quotaManager)return $;let Z=this.quotaManager.getFallback($.id,$.access)?.quota;return Z?{...$,quota:Z}:$}async refreshDueAccounts(){let $=await this.load();if(!$||!yY($))return;let Z=!1;for(let X of $.accounts){if(X.enabled===!1||!L1(X))continue;if(D$($,X))continue;if(l0(X))continue;if(!u1(X,$,this.now()))continue;if(V1(X.lastRefreshError,X.refresh,this.now()))continue;try{p1.debug("fallback oauth background due",{pid:process.pid,accountId:X.id,expiresInMs:X.expires?X.expires-this.now():void 0}),await this.refreshAccount(X,$),Z=!0}catch(J){p1.warn("fallback oauth background failed",{pid:process.pid,accountId:X.id,error:$3(J)}),a2(X,J,this.now()),M0($,X),Z=!0}}if(Z)await this.save($)}async refreshQuotaForDueAccounts(){let $=await this.load();if(!$||!i2($))return;if(!this.options.fetchQuotaFn)return;let Z=!1;for(let X of $.accounts){if(X.enabled===!1||!L1(X))continue;if(D$($,X))continue;if(l0(X))continue;let J=X;try{if(u1(J,$,this.now())){if(V1(J.lastRefreshError,J.refresh,this.now()))continue;J=await this.refreshAccount(J,$),Z=!0}if(G$(J.lastQuotaRefreshError,this.now()))continue;if(this.seedFallbackQuota(J,$),!(this.quotaManager?this.quotaManager.isFallbackStale(J.id,J.access):J5(J,$,this.now())))continue;await this.refreshAccountQuota(J,$),Z=!0}catch(z){d2(X,z,this.now()),M0($,X),Z=!0}}if(Z)await this.save($),this.onFallbackStorageChanged?.()}async refreshQuotaForAllAccounts($={}){let Z=await this.load(),X=[];if(!Z||!i2(Z))return{storage:Z,errors:X};if(!this.options.fetchQuotaFn)return{storage:Z,errors:X};let J=$.force??!1,z=!1;for(let G of Z.accounts){if(G.enabled===!1||!L1(G))continue;if(D$(Z,G))continue;if(l0(G))continue;let Q=G;try{if(u1(Q,Z,this.now())){let Y=Q.lastRefreshError;if(Y&&V1(Y,Q.refresh,this.now()))throw Error(g$(Y,this.now()));Q=await this.refreshAccount(Q,Z),z=!0}if(!J&&!J5(Q,Z,this.now())){if(Q.lastQuotaRefreshError)Q.lastQuotaRefreshError=void 0,M0(Z,Q),z=!0;continue}await this.refreshAccountQuota(Q,Z),z=!0}catch(Y){d2(G,Y,this.now()),M0(Z,G),z=!0,X.push({accountId:G.id,message:$3(Y)})}}if(z)await this.save(Z);return{storage:Z,errors:X}}async refreshAccount($,Z,X={}){let J=this.refreshPromises.get($.id);if(J){let Q=await J;return M0(Z,Q),Q}let z=this.refreshAccountNow($,Z,X).finally(()=>{this.refreshPromises.delete($.id)});this.refreshPromises.set($.id,z);let G=await z;return M0(Z,G),G}async waitForConcurrentFallbackRefresh($,Z,X,J){let z=Date.now()+cY;while(Date.now()<z){await new Promise((H)=>setTimeout(H,sY));let G=await this.load(),Q=G?.accounts.find((H)=>H.id===$.id&&L1(H));if(!Q)continue;if(this.assertNotTombstoned(Q),(Q.access!==X.access||Q.refresh!==X.refresh||(Q.expires??0)>(X.expires??0)+60000)&&(J.force||!u1(Q,G,this.now())))return M0(Z,Q),p1.debug("fallback oauth joined concurrent refresh",{pid:process.pid,accountId:Q.id,expiresInMs:Q.expires?Q.expires-this.now():void 0}),Q;let W=Q.lastRefreshError;if(W&&V1(W,Q.refresh,this.now()))throw M0(Z,Q),Error(g$(W,this.now()))}return null}assertNotShieldedMainRow($,Z,X){if(X.asPoolMain||!Z)return;if(D$($,Z))throw new Y5(Z.id)}async refreshAccountNow($,Z,X){let J=await this.load(),z=J?.accounts.find((Y)=>Y.id===$.id&&L1(Y));if(this.assertNotTombstoned(z),this.assertNotShieldedMainRow(J,z,X),z&&!X.force&&!u1(z,J,this.now()))return M0(Z,z),z;let G=z??$,Q=await e({name:dY(G.id),ttlMs:lY,path:this.paths.configPath,now:this.now,renew:!0});if(!Q){p1.debug("fallback oauth refresh skipped file lock",{pid:process.pid,accountId:G.id});let Y=await this.waitForConcurrentFallbackRefresh($,Z,G,X);if(Y)return Y;throw Error("Fallback OAuth refresh is already in progress")}try{if(J=await this.load(),z=J?.accounts.find((B)=>B.id===$.id&&L1(B)),this.assertNotTombstoned(z),this.assertNotShieldedMainRow(J,z,X),z&&!X.force&&!u1(z,J,this.now()))return M0(Z,z),z;if(!z)throw new R6($.id);G=z;let Y=this.options.refreshFn??(async()=>{throw Error("No refreshFn injected into FallbackAccountManager")});p1.debug("fallback oauth refresh request start",{pid:process.pid,accountId:G.id,force:X.force===!0,expiresInMs:G.expires?G.expires-this.now():void 0});let W=await Y({refreshToken:G.refresh,fetchImpl:this.fetchImpl,now:this.now});if(G.access=W.access,G.refresh=W.refresh,G.expires=W.expires,G.lastRefreshedAt=W.expires-W.expiresIn*1000,G.lastRefreshError=void 0,M0(Z,G),await this.save(Z),!(await this.load())?.accounts.some((B)=>B.id===$.id))throw new R6($.id);return p1.debug("fallback oauth refresh succeeded",{pid:process.pid,accountId:G.id,expiresInMs:G.expires?G.expires-this.now():void 0}),G}finally{await Q.release()}}async refreshAccountQuota($,Z){let X=$;if(this.assertNotTombstoned(X),!X.access)throw Error(`Fallback account ${$.id} has no access token`);if(!this.options.fetchQuotaFn)throw Error("No fetchQuotaFn injected — wham/usage supplement is disabled");let J=this.options.fetchQuotaFn??(async()=>{throw Error("No fetchQuotaFn injected — wham/usage supplement is disabled")}),z=(G)=>this.quotaManager?this.quotaManager.refreshFallback(X.id,G):J({accessToken:G,fetchImpl:this.fetchImpl,now:this.now});try{if(!X.access)throw Error(`Fallback account ${$.id} has no access token`);let G=await z(X.access);X.quota=G,X.lastQuotaRefreshError=void 0,M0(Z,X),await this.save(Z)}catch(G){throw d2($,G,this.now()),M0(Z,$),G}}}var W5="/backend-api/wham/rate-limit-reset-credits",KD=`https://chatgpt.com${W5}`,aY=`${W5}/consume`,qD=`https://chatgpt.com${aY}`;function f0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}import{statSync as oY}from"node:fs";import{rm as H5}from"node:fs/promises";import{dirname as tY,join as V5}from"node:path";var B5=["primary","secondary"];function e2($){return $!=null&&typeof $==="object"&&!Array.isArray($)}function X3($){return typeof $==="number"&&Number.isFinite($)}function nY($,Z){if(!e2(Z))return;let X=Z.usedPercent;if(!X3(X)||X<0||X>100)return;return{label:$,usedPercent:X,...typeof Z.resetsAt==="string"?{resetsAt:Z.resetsAt}:{},...X3(Z.windowMinutes)&&Z.windowMinutes>0?{windowMinutes:Z.windowMinutes}:{}}}function rY($){let Z=$.spendControl;if(e2(Z)&&typeof Z.reached==="boolean"){let X=(J)=>X3(Z[J])?{[J]:Z[J]}:{};return{kind:"reading",reached:Z.reached,...X("remainingPercent"),...X("usedPercent"),...X("limit"),...X("used"),...X("remaining"),...typeof Z.resetsAt==="string"?{resetsAt:Z.resetsAt}:{},...typeof Z.unit==="string"?{unit:Z.unit}:{}}}if($.spendControlCleared===!0)return{kind:"cleared"};return}function X1($,Z,X){if(!e2($)||!X3(Z))return;let J=[],z=[];for(let Q of B5){let Y=nY(Q,$[Q]);if(Y)J.push(Y);else if(X)z.push({label:Q})}let G=rY($);if(J.length===0&&z.length===0&&!G)return;return{checkedAt:Z,...J.length>0?{readings:J}:{},...z.length>0?{coverage:z}:{},...G?{budget:G}:{}}}function M$($){if(!t($))return;let Z=d($),X={};for(let J of B5){let z=Z.limits.find((Q)=>Q.label===J&&Q.kind==="reading");if(!z||!X3(z.usedPercent))continue;let G={usedPercent:z.usedPercent,remainingPercent:100-z.usedPercent,checkedAt:z.checkedAt,...z.resetsAt!==void 0?{resetsAt:z.resetsAt}:{},...z.windowMinutes!==void 0?{windowMinutes:z.windowMinutes}:{}};X[J]=G}return X.primary||X.secondary?X:void 0}var J1=s("vault"),eY="openai-auth",j5={refreshAdapter:"openai",category:"openai-native",apiKeys:!1},$W={opencode:"OpenCode",pi:"Pi"};function ZW($){return O2(eY,$)}function E6($){return V5(tY($),"openai-auth-vault")}function XW($,Z){return{...C2({stateDir:$,host:Z}),rosterPath:V5($,`${Z}-roster.json`)}}var k6=2000,U5={"vault-unreachable":"Request refused locally: this host is connected to the credential vault, which could not be reached, and local accounts are not used while it is connected. Start the vault and connect accounts in it, or disconnect this host from the vault.","vault-empty":"Request refused locally: this host is connected to the credential vault, which serves it no usable OpenAI account, and local accounts are not used while it is connected. Connect accounts in the vault, or disconnect this host from the vault.","vault-refused":"Request refused locally: the credential vault did not authorize an account, and local accounts are not used while this host is connected to it. Check the accounts in the vault, or disconnect this host from the vault."};function K5($){return $.snapshot()===void 0?"vault-unreachable":"vault-empty"}function JW($){let Z=Q$($);return Z?Y$(Z):void 0}class $4{host;name;paths;#$;#Z;#W=new Map;#G=new Map;#Q;#J;#X;#B=!1;#H=!1;#z=Promise.withResolvers();#Y;#V="unknown";#j;constructor($){this.#$=$,this.host=$.host,this.name=ZW($.host),this.paths=XW($.stateDir,$.host),this.#Z=new C6({rosterPath:this.paths.rosterPath,tokenPath:this.paths.tokenPath,family:j5,connect:()=>this.#M(),isCustodyActive:()=>this.enrolled(),...$.reservedRouteIds?{reservedRouteIds:$.reservedRouteIds}:{},parseIdentity:JW,...$.now?{now:$.now}:{},onRoster:()=>{this.#Q=void 0},onError:(Z)=>this.#U("vault roster refresh failed",Z),logger:J1})}#q(){return(this.#$.connectionFile??s$)()}#D(){return{connectionFile:this.#q(),projectRoot:this.#$.projectRoot??process.cwd(),storagePath:this.paths.tokenPath,logger:($)=>J1.debug("vault transport error",{errorClass:$})}}#M(){return this.#$.connectScoped?.()??c7(this.#D())}#L(){return this.#$.connectEnrollment?.()??_2(this.#D())}#U($,Z){this.#Q=Z1(Z),J1.warn($,{host:this.host,error:this.#Q})}#K(){return[this.paths.tokenPath,this.paths.statePath].map(($)=>{try{let Z=oY($);return`${Z.ino}:${Z.size}:${Z.mtimeMs}:${Z.ctimeMs}`}catch{return"?"}}).join("|")}async authority(){let $=this.#K(),Z=await A2(this.paths,this.name);if($===this.#K())return this.#V=Z,this.#j=$,Z;return"unreadable"}enrolled(){return this.#j!==this.#K()||this.#V!=="local"}start(){if(this.#B||this.#H)return;this.#B=!0;let $=async()=>{try{await this.authority(),await this.#N()}catch(X){if(!this.#H)this.#U("vault roster refresh failed",X)}if(this.#H)return;let Z=this.#$.pollIntervalMs??5000;if(Z<=0)return;this.#Y=setTimeout(()=>{this.#Y=void 0,$()},Z),this.#Y.unref?.()};$()}#N(){return this.#X??=this.#Z.refresh().finally(()=>{this.#X=void 0,this.#z.resolve()}),this.#X}firstRoster(){return this.#z.promise}async refresh(){try{await this.authority();let $=this.#X;if($)await $.catch(()=>{return});let Z=await this.#N();return this.#Q=void 0,Z}catch($){return this.#U("vault roster refresh failed",$),this.#Z.snapshot()}}snapshot(){return this.#Z.snapshot()}serves(){return this.enrolled()&&(this.snapshot()?.rows.length??0)>0}identities(){if(!this.enrolled())return new Set;return new Set((this.snapshot()?.rows??[]).flatMap(($)=>$.accountIdentity!==void 0?[$.accountIdentity]:[]))}routes(){if(!this.enrolled())return[];let $=new Map((this.snapshot()?.rows??[]).map((Z)=>[Z.routeId,Z]));return this.#Z.routingRows().map((Z)=>{let X=$.get(Z.id)?.accountIdentity;return{id:Z.id,kind:Z.kind==="api-key"?"api-key":"oauth",...X!==void 0?{identity:X}:{},...Z.quota!==void 0?{quota:Z.quota}:{}}})}owns($){return(this.snapshot()?.rows??[]).some((Z)=>Z.routeId===$)}async send($,Z,X){let J=!1;try{return await this.#Z.send($,(z)=>{return J=!0,Z(z.accessToken,z)},{site:X.site,...X.signal?{signal:X.signal}:{}})}catch(z){if(J)throw z;this.#U("vault refused to serve an account",z);return}}async authorize($,Z={}){try{return await this.#Z.authorize($,Z.signal)}catch(X){this.#U("vault refused to serve an account",X);return}}async reportFailure($,Z){if(Z!==401)return;try{await this.#Z.reportFailure($,401,"direct")}catch(X){this.#U("vault failure report failed",X)}await this.refresh()}recordSnapshot($,Z,X,J){let z=X1(Z,(this.#$.now??Date.now)(),X);if(!z)return Promise.resolve();return this.#Z.recordQuota($,z,J).then(()=>{},(G)=>this.#U("vault quota write failed",G))}pollQuota($){let Z=this.#G.get($);if(Z)return Z;let X=this.#F($).finally(()=>{this.#G.delete($)});return this.#G.set($,X),X}async#F($){let Z,X=this.#$.fetchImpl?.()??globalThis.fetch,J=await this.send($,async(z,G)=>{try{let Q=await q$({accessToken:z,fetchImpl:X,now:this.#$.now??Date.now,...G.accountIdentity?{accountId:G.accountIdentity}:{},accountKey:$,logger:J1});return await this.recordSnapshot($,Q,!0,G),Z=void 0,new Response(null,{status:200})}catch(Q){Z=Z1(Q);let Y=Q?.status;if(typeof Y==="number")return new Response(null,{status:Y});throw Q}},{site:"quota"}).catch((z)=>{Z=Z1(z);return});if(!J)return{ok:!1,error:Z??"vault refused"};return J.ok?{ok:!0}:{ok:!1,error:Z??`status ${J.status}`}}requestReading($){let Z=this.#W.get($);if(Z)return Z;let X=this.pollQuota($).catch((J)=>{J1.warn("vault quota poll failed",{routeId:$,error:Z1(J)})}).finally(()=>{this.#W.delete($)});return this.#W.set($,X),X}async pollStale($){let Z=(this.#$.now??Date.now)(),X=[];for(let J of this.routes()){let z=zW(J.quota);if(z!==void 0&&Z-z<$)continue;X.push({id:J.id,...await this.pollQuota(J.id)})}return X}async decline($){await this.#Z.decline($),J1.info("vault account declined",{routeId:$})}async accept($){await this.#Z.accept($),J1.info("vault account accepted",{routeId:$})}async status(){await this.authority();let $;try{$=await a$(this.paths,this.name)}catch(Z){this.#U("vault enrollment state unreadable",Z),$={state:"blocked",proposedName:this.name,code:Z instanceof R?Z.kind:"unreadable-state"}}return{host:this.host,name:this.name,enrollment:$,accounts:this.enrolled()?this.snapshot()?.rows??[]:[],...this.#Q?{lastError:this.#Q}:{}}}async connectStep(){let $=await this.#L().catch((Z)=>{throw new U0("vault-unreachable",`Could not reach the Claustrum vault (${this.#q()}): ${Z1(Z)}. Is the vault running?`)});try{let Z=new L6({client:$,paths:this.paths,proposedName:this.name,...this.#$.now?{now:this.#$.now}:{}}),X=await Z.status();if(X.state==="denied"||X.state==="blocked")await Z.resetTerminal();let J=await Z.reconcile();if(J1.info("vault enrollment step",{host:this.host,state:J.state}),J.state==="approved")this.#Q=void 0,await this.refresh();return J}finally{$.close()}}waitForApproval($={}){return this.#J??=(async()=>{let Z=$.sleep??((G)=>new Promise((Q)=>setTimeout(Q,G))),X=$.pollIntervalMs??2000,J=Date.now()+($.timeoutMs??600000),z=await this.connectStep();while(z.state==="pending"||z.state==="busy"){if($.onPending?.(z),Date.now()>=J)return z;await Z(X),z=await this.connectStep()}return z})().finally(()=>{this.#J=void 0}),this.#J}async disconnect(){await H5(this.paths.tokenPath,{force:!0}),await H5(this.paths.statePath,{force:!0}),await this.authority(),this.#Q=void 0,J1.info("vault enrollment forgotten",{host:this.host})}assertHostSlot($){if(this.serves())I2({mode:"custody",auth:$,provider:"openai"})}close(){if(this.#H=!0,this.#z.resolve(),this.#Y)clearTimeout(this.#Y);this.#Y=void 0,this.#Z.close()}}function zW($){if(!$)return;let Z=d($).limits.map((X)=>X.checkedAt);return Z.length>0?Math.max(...Z):void 0}function f6($,Z){if(Z.state!=="pending")return[];if(!Z.requestId)return[`The vault did not take the enrollment request yet${Z.retryCode?` (${Z.retryCode})`:""}. Run Connect again in a moment.`];return[`Enrollment request ${Z.requestId} for ${$} is waiting for approval. Approve it with:`,`  ck auth enroll approve --request-id ${Z.requestId}`,"and let it read your OpenAI accounts with:",`  ck auth grant --principal enrolled:${$} --selector-kind category --selector ${j5.category} --operation read`]}function q5($,Z,X){let J=`${$W[$]} (${Z})`;switch(X.state){case"approved":return`${J}: connected to the Claustrum vault.`;case"idle":return`${J}: not connected to the Claustrum vault.`;case"pending":return X.requestId?`${J}: waiting for approval of request ${X.requestId}.`:`${J}: enrollment request not taken yet${X.retryCode?` (${X.retryCode})`:""}.`;case"denied":return`${J}: the vault denied the enrollment request.`;case"blocked":return`${J}: enrollment stopped (${X.code}).`;case"unavailable":return`${J}: the vault is unavailable (${X.code}).`;case"busy":return`${J}: another process is enrolling right now.`}}function Z4($,Z){switch(Z.state){case"approved":{let X=$.snapshot()?.rows.length??0;return{ok:!0,text:`Connected: the vault approved ${$.name}. It serves ${X} OpenAI account${X===1?"":"s"} to this host${X===0?" (grant it the openai-native category with `ck auth grant` to add some)":""}.`}}case"denied":return{ok:!1,text:"The vault denied the enrollment request. Run Connect again to send a new one."};case"blocked":return{ok:!1,text:`Enrollment stopped (${Z.code}). Run Connect again to send a new request.`};case"pending":case"busy":return{ok:!1,text:[...f6($.name,Z),"Still waiting. The request stays open: run Connect again after approving it."].join(`
-`)};default:return{ok:!1,text:`Enrollment is ${Z.state}.`}}}var D5=`${String.fromCharCode(27)}\\[[0-9;]*m`,yD=new RegExp(D5,"g"),vD=new RegExp(`^${D5}`);function L$($){return $.authority!=="local"}async function z1($){return{authority:await $.authority(),status:await $.status(),identities:$.identities(),routes:new Set($.routes().map((Z)=>Z.id))}}async function L5($){let Z;try{return await Promise.race([Promise.resolve().then(()=>$.refresh()).then(()=>{return},(X)=>X instanceof Error?X.message:String(X)),new Promise((X)=>{Z=setTimeout(()=>X("Vault roster refresh did not finish within the roster wait budget."),k6)})])}finally{clearTimeout(Z)}}function O1($){return $.email||$.label||$.routeId}var J4="Accounts are managed in the vault with ck. Disconnect to use local accounts.",z4="Nothing was changed: accounts are managed in the vault with ck. Disconnect to use local accounts.";function F5($){return f0($)?{...$}:{}}function y6($,Z,X,J){let z=X.confirm?.irreversible?{irreversible:!0,confirm:X.confirm.message}:{...X.confirm?{confirm:X.confirm.message}:{}};return{id:X.id,label:X.label,...X.description?{description:X.description}:{},...X.group?{group:X.group}:{},knobs:X.knobs,...z,run:async({values:G,invocation:Q})=>{let Y=await $.apply({command:$.command,sectionId:Z,...J?{itemId:J}:{},actionId:X.id,values:G,confirmed:!0},Q);return{ok:Y.ok,text:Y.text,...Y.code?{code:Y.code}:{}}}}}function G4($,Z){return new Proxy($,{get(X,J){if(J==="read")return async()=>{let G=await X.read();if(G.status!=="ready")return G;let Q={...G,rows:G.rows.map((H)=>({...H,label:H.label??H.id}))};if(!Z)return Q;let Y=await z1(Z);if(!L$(Y))return Q;let W=[...Y.status.accounts.map((H)=>({id:H.routeId,label:O1(H),type:"oauth",enabled:H.enabled,identity:H.accountIdentity,quota:H.quota,hasEntry:!1,needsFirstReading:!1,candidate:!1}))];return{...G,rows:W}};if(J==="readSettings")return async()=>{let G=await X.readSettings();if(G.status==="error"||!Z)return G;let Q=await z1(Z),Y=F5(G.settings.killswitch);if(!L$(Q)||!G.settings.killswitch)return G;let W=F5(Y.accounts);for(let H of Q.status.accounts)W[H.routeId]=P1({version:1,accounts:[],...G.settings},H.routeId);return{...G,settings:{...G.settings,killswitch:{...Y,accounts:W}}}};let z=Reflect.get(X,J);return typeof z==="function"?z.bind(X):z}})}function P5($,Z){let X=x1($),J=x1({command:$.command,title:$.title,store:G4($.store,Z),accounts:$.accounts,quota:$.quota,limits:$.limits,routing:$.routing,...$.extraLocks?{extraLocks:$.extraLocks}:{},...$.now?{now:$.now}:{}}),z=async(W,H)=>{let B=await z1(Z),V=L$(B),U=V?J:X,j=(await U.open(H)).menu.sections.find((L)=>L.id===W);if(!j)throw new U0("unavailable","The account menu is unavailable.");if(!V)return{lines:j.lines,items:j.items.map((L)=>({...L,actions:L.actions.map((N)=>y6(U,W,N,L.id))})),actions:j.actions.map((L)=>y6(U,W,L))};let M=new Map(B.status.accounts.map((L)=>[L.routeId,L])),D=($.now??Date.now)(),q=(L)=>({id:"check",label:L?"Check this account":"Check now",group:"Actions",run:async()=>{let P=[...(await z1(Z)).routes].filter((S)=>!L||S===L);if(L&&P.length===0)throw new U0("unavailable","This vault account cannot be checked right now.");for(let S of P){let f=await Z.pollQuota(S);if(!f.ok)throw new U0("quota-check-failed",`${S}: ${f.error??"vault unavailable"}`)}return`Checked quota for ${P.length} account${P.length===1?"":"s"}.`}});if(W==="quota"){let L=(N,P)=>A0(d(N.quota,$.quota?.scope),{now:D,form:P});return{lines:B.status.accounts.filter((N)=>!B.routes.has(N.routeId)).map((N)=>`${O1(N)} (${N.enabled?N.state:"disabled"}): ${L(N,"compact")}`),items:B.status.accounts.filter((N)=>B.routes.has(N.routeId)).map((N)=>({id:N.routeId,label:O1(N),group:"Accounts",status:L(N,"compact"),detail:L(N,"full"),actions:[q(N.routeId)]})),actions:B.routes.size>0?[q()]:[]}}let F=j.items.map((L)=>{let N=M.get(L.id),P=N&&W==="accounts"?`Vault · ${N.credentialType==="oauth"?"login":"API key"} · ${N.state} · ${N.enabled?"enabled":"declined"}`:L.detail;return{id:L.id,label:L.label,detail:P,group:L.group,status:N&&W==="accounts"?N.enabled?N.state:"disabled":L.status,...L.facts?{facts:L.facts}:{},actions:N&&W!=="limits"?[]:L.actions.map((S)=>y6(U,W,S,L.id))}}),C=j.actions.filter((L)=>W==="limits"||W==="routing"&&L.id==="mode").map((L)=>y6(U,W,L));return{lines:W==="accounts"?[`${B.status.accounts.length} vault account${B.status.accounts.length===1?"":"s"}`,`${B.routes.size} can route`,J4]:j.lines,items:F,actions:C}},G=x1({...$,accounts:void 0,quota:void 0,routing:void 0,limits:void 0,replace:{accounts:{title:"Accounts",build:(W)=>z("accounts",W)},quota:{title:"Quota",build:(W)=>z("quota",W)},routing:{title:"Routing",build:(W)=>z("routing",W)},limits:{title:"Limits",build:(W)=>z("limits",W)}},extras:$.extras?.map((W)=>W.id!=="reset"?W:{...W,build:async(H)=>{let B=await z1(Z);if(L$(B))return{lines:[J4]};return W.build(H)}})}),Q=async()=>{if(!L$(await z1(Z)))return{menu:X,error:void 0};let W=await L5(Z);return{menu:G,error:W}},Y=async(W,H)=>{let B=await W.menu.open(H);if(W.error)B.menu.sections.find((U)=>U.id==="vault")?.lines.push(`Last error: ${W.error}`);return B};return{command:$.command,open:async(W)=>Y(await Q(),W),apply:async(W,H)=>{let B=await Q(),{menu:V}=B;if(V===G&&(W.sectionId==="accounts"||W.sectionId==="routing"&&W.actionId==="order"||W.sectionId==="reset"||W.sectionId==="quota"&&(await z1(Z)).routes.size===0||W.sectionId==="limits"&&W.itemId!==void 0&&!(await z1(Z)).status.accounts.some((U)=>U.routeId===W.itemId)))return{...await Y(B,H),ok:!1,code:"vault-local-action",text:z4};return V.apply(W,H)}}}var _1="openai",W4="OpenAI accounts",F$="main",_5="that account is already your main account, so it was not added again",J3=s("commands"),C5=new Set(["__proto__","constructor","prototype"]);function T5($,Z){let X={version:1,accounts:[],killswitch:$},J=f0($.accounts)?Object.keys($.accounts):[],z={};for(let Y of new Set([F$,...Z,...J])){if(C5.has(Y))continue;let W=P1(X,Y===F$?void 0:Y);z[Y]={primary:W.primary,secondary:W.secondary}}let G=P1(X,void 0),Q={...$};return delete Q.main,Q.accounts=z,Q.defaults={primary:G.primary,secondary:G.secondary},Q.schema=N$,Q}function A5($,Z){let X=f0($.accounts)?{...$.accounts}:{};for(let z of new Set([F$,...Z])){if(C5.has(z)||Object.hasOwn(X,z))continue;X[z]={primary:F1.primary,secondary:F1.secondary}}let J=f0($.defaults)?$.defaults:{primary:F1.primary,secondary:F1.secondary};return{...$,accounts:X,defaults:J,schema:N$}}function Q4($,Z){let X=!1;if(f0($.cachekeep))$.cacheKeep={...$.cachekeep,...f0($.cacheKeep)?$.cacheKeep:{}},delete $.cachekeep,X=!0;let J=$.killswitch;if(f0(J)&&J.schema!==N$)$.killswitch=T5(J,Z),X=!0;return X}async function O5($){let Z=await $.read();return Z.status==="ready"?Z.rows.map((X)=>X.id):[]}function R5($){let Z=async()=>{let J=await $.readSettings();if(J.status==="error")return J;let z=structuredClone(J.settings);return Q4(z,await O5($)),{...J,settings:z}},X=async(J,z)=>{let G=await O5($);return $.updateSettings(async(Q)=>{Q4(Q,G);let Y=await J(Q)??Q;if(f0(Y.killswitch)&&Y.killswitch.schema!==N$)Y.killswitch=A5(Y.killswitch,G);return Y},z)};return new Proxy($,{get(J,z){if(z==="readSettings")return Z;if(z==="updateSettings")return X;let G=Reflect.get(J,z,J);return typeof G==="function"?G.bind(J):G}})}function S5($,Z){let X=(W,H)=>Z.rowLocks?Z.rowLocks(W):H,J=(W,H)=>{let B=X(W,H?.extraLocks);return{...H??{},...B?{extraLocks:B}:{}}},z=(W,H,B,V)=>$.replace(W,H,B,J(W,V)),Y={add:async(W,H)=>{let B=await $.read(),U=(B.status==="ready"?B.rows:[]).filter((D)=>D.type==="oauth"&&!D.invalid),K=W.identity?U.find((D)=>D.identity===W.identity):void 0;if(K?.id===F$)throw new U0("main-account",_5);let j=K??U.find((D)=>D.id===W.id&&D.id!==F$);if(!j||W.credential.type!=="oauth")return $.add(W,H);let M=await z(j.id,W.credential,W.identity!==void 0?{identity:W.identity}:{},H?.extraLocks?{extraLocks:H.extraLocks}:void 0);return J3.info("account signed in again",{id:j.id}),{id:M.id,outcome:"rotated",credential:M.credential,credentialEpoch:M.credentialEpoch}},replace:z,enable:(W,H)=>$.enable(W,J(W,H)),disable:(W,H,B)=>$.disable(W,H,J(W,B)),remove:(W,H)=>$.remove(W,J(W,H))};return new Proxy($,{get(W,H){if(Object.hasOwn(Y,H))return Y[H];let B=Reflect.get(W,H,W);return typeof B==="function"?B.bind(W):B}})}var I5="migration";function Y4($){let Z=["Accounts move to the new account layout once every OpenCode process on this machine runs this version of OpenAI auth. This menu works on that layout, so it opens after the move.",$.length>0?"These processes still hold the move back:":"No running process holds the move back."],X={command:_1,title:W4,sections:[{id:I5,slot:"extra",title:"Accounts are moving",lines:Z,items:$.map((J,z)=>({id:`blocker-${z}`,label:J.pid==="unknown"?"processes that could not be read":`pid ${J.pid}`,detail:`version ${J.version}`,actions:[]})),actions:[]}]};return DW(X)}var KW=new Set(["access","refresh","apikey","authheader","password","credential","credentials"]);function qW($){let Z=$.toLowerCase().replace(/[-_]/g,"");if(KW.has(Z))return!0;return Z.endsWith("token")||Z.endsWith("key")||Z.endsWith("secret")}function v6($,Z,X){if(Array.isArray($))return $.map((z,G)=>v6(z,`${Z}[${G}]`,X));if(!f0($))return $;let J={};for(let[z,G]of Object.entries($)){if(qW(z)){X.push(`${Z}.${z}`);continue}J[z]=v6(G,`${Z}.${z}`,X)}return J}function DW($){let Z=[],X=v6($,"menu",Z);if(Z.length>0)J3.warn("credential-shaped field stripped before RPC",{fields:Z});return X}function x5($){return{id:$.id,credential:{type:"oauth",refresh:$.refresh,...$.access!==void 0?{access:$.access}:{},...$.expires!==void 0?{expires:$.expires}:{}},...$.accountId!==void 0?{identity:$.accountId}:{},...$.label!==void 0?{label:$.label}:{}}}function b5($){return{label:"Add account",knobs:[{kind:"text",id:"label",label:"Label (optional)"},{kind:"toggle",id:"headless",label:"Sign in with a device code (no browser on this machine)",value:!1}],run:async(Z)=>{let X=typeof Z.label==="string"&&Z.label.trim().length>0?Z.label.trim():void 0,J=Z.headless===!0,z=await $.begin({...X!==void 0?{label:X}:{},headless:J}),G=J?`Open this verification URL:
+</html>`,b6=[],T$,d0=new Map;function A4($,Z){return new Promise((X,J)=>{let G=(B)=>{$.off("listening",z),J(B)},z=()=>{$.off("error",G),X()};$.once("error",G),$.once("listening",z),$.listen(A$,Z)})}function I4($){$.close(()=>{}),$.closeIdleConnections?.(),setTimeout(()=>{$.closeAllConnections?.()},25).unref?.()}function O1(){return d0.size}function T1($){if(d0.delete($),O1()===0)C1()}async function IJ(){let $=`http://localhost:${A$}/auth/callback`;if(b6.length>0)return{port:A$,redirectUri:$};if(T$)return T$;T$=(async()=>{let Z=(z,B)=>{let Q=new URL(z.url||"/",`http://127.0.0.1:${A$}`);if(Q.pathname==="/auth/callback"){let Y=Q.searchParams.get("code"),H=Q.searchParams.get("state"),W=Q.searchParams.get("error"),U=Q.searchParams.get("error_description");if(W){let K=U||W;if(H){let V=d0.get(H);if(V)V.reject(Error(K)),T1(H);else if(O1()===0)C1()}else if(O1()===0)C1();B.writeHead(200,{"Content-Type":"text/html"}),B.end(I6(K));return}if(!H){if(O1()===0)C1();B.writeHead(400,{"Content-Type":"text/html"}),B.end(I6("Missing state parameter"));return}if(!Y){if(O1()===0)C1();B.writeHead(400,{"Content-Type":"text/html"}),B.end(I6("Missing authorization code"));return}let j=d0.get(H);if(!j){if(O1()===0)C1();B.writeHead(400,{"Content-Type":"text/html"}),B.end(I6("Unknown state — authorization may have expired"));return}T1(H),SJ(Y,$,j.pkce).then((K)=>j.resolve(K)).catch((K)=>j.reject(K)),B.writeHead(200,{"Content-Type":"text/html"}),B.end(EJ);return}if(Q.pathname==="/cancel"){let Y=Q.searchParams.get("state"),H=Y?[Y]:[...d0.keys()];B.writeHead(200),B.end("Login cancelled");for(let W of H){let U=d0.get(W);if(!U)continue;U.reject(Error("Login cancelled")),T1(W)}if(O1()===0)C1();return}B.writeHead(404),B.end("Not found")},X=T4(Z);await A4(X,"127.0.0.1");let J=[X],G=T4(Z);try{await A4(G,"::1"),J.push(G)}catch(z){let B=z.code;if(B!=="EADDRNOTAVAIL"&&B!=="EAFNOSUPPORT")throw I4(X),z}return b6=J,{port:A$,redirectUri:$}})();try{return await T$}finally{T$=void 0}}function C1(){let $=b6;b6=[];for(let Z of $)I4(Z)}function bJ($,Z,X=300000,J){return new Promise((G,z)=>{if(J?.aborted){T1(Z),z(Error("Login cancelled"));return}let B=setTimeout(()=>{if(d0.get(Z))T1(Z),z(Error("OAuth callback timeout — authorization took too long"))},X),Q=()=>{if(clearTimeout(B),d0.get(Z))T1(Z),z(Error("Login cancelled"))};if(J)J.addEventListener("abort",Q);d0.set(Z,{pkce:$,state:Z,resolve:(Y)=>{if(clearTimeout(B),J)J.removeEventListener("abort",Q);G(Y)},reject:(Y)=>{if(clearTimeout(B),J)J.removeEventListener("abort",Q);z(Y)}})})}async function xJ($){let Z=await fetch(`${P1}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"Content-Type":"application/json","User-Agent":S4($)},body:JSON.stringify({client_id:x6})});if(!Z.ok)throw Error("Failed to initiate device authorization");let X=await Z.json();return{deviceData:X,url:`${P1}/codex/device`,instructions:`Enter code: ${X.user_code}`}}async function kJ($,Z,X){let J=Math.max(parseInt($.interval,10)||5,1)*1000,G=typeof $.expires_in==="number"?$.expires_in:parseInt($.expires_in||"",10),z=!Number.isNaN(G)&&G>0?G*1000:900000,B=Date.now();while(!0){if(X?.aborted)throw Error("Device authorization cancelled");if(Date.now()-B>z)throw Error("Device authorization expired");let Q=await fetch(`${P1}/api/accounts/deviceauth/token`,{method:"POST",headers:{"Content-Type":"application/json","User-Agent":S4(Z)},body:JSON.stringify({device_auth_id:$.device_auth_id,user_code:$.user_code})});if(Q.ok){let W=await Q.json(),U=await fetch(`${P1}/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:W.authorization_code,redirect_uri:`${P1}/deviceauth/callback`,client_id:x6,code_verifier:W.code_verifier}).toString()});if(!U.ok)throw Error(`Token exchange failed: ${U.status}`);return await U.json()}if(Q.status!==403&&Q.status!==404)throw Error(`Device authorization failed: ${Q.status}`);let Y=z-(Date.now()-B);if(Y<=0)throw Error("Device authorization expired");let H=Math.min(J+_J,Y);try{await LJ(H,void 0,{signal:X})}catch(W){if(W instanceof Error&&W.name==="AbortError")throw Error("Device authorization cancelled");throw W}}}async function b4($){let{label:Z,headless:X=!1,signal:J,version:G}=$;if(U3(Z),X){let{deviceData:W,url:U,instructions:j}=await xJ(G),K=(async()=>{let V=await kJ(W,G,J),N=Date.now(),q=S$(V);return{id:U3(Z||q||crypto.randomUUID()),label:Z||void 0,type:"oauth",access:V.access_token,refresh:V.refresh_token,expires:N+(V.expires_in??3600)*1000,enabled:!0,addedAt:N,lastUsed:N,lastRefreshedAt:N,accountId:q}})();return{url:U,instructions:j,completion:K}}let{redirectUri:z}=await IJ(),B=await PJ(),Q=E4(crypto.getRandomValues(new Uint8Array(32)).buffer),Y=AJ(z,B,Q),H=(async()=>{try{if(J?.aborted)throw Error("Login cancelled");let W=await bJ(B,Q,void 0,J),U=Date.now(),j=S$(W);return{id:U3(Z||j||crypto.randomUUID()),label:Z||void 0,type:"oauth",access:W.access_token,refresh:W.refresh_token,expires:U+(W.expires_in??3600)*1000,enabled:!0,addedAt:U,lastUsed:U,lastRefreshedAt:U,accountId:j}}finally{T1(Q)}})();return{url:Y,instructions:"Complete authorization in your browser. This window will close automatically.",completion:H}}import{basename as yJ,dirname as fJ,join as gJ}from"node:path";var k6="openai-auth.json",x4="openai-auth-state.json";function j3($){return yJ($)===k6?gJ(fJ($),x4):`${$}.state.json`}function y6($){if($==null||$==="")return;let Z=typeof $==="number"?$:Number($);if(Number.isFinite(Z)){let J=Z<100000000000?Z*1000:Z,G=new Date(J);return Number.isNaN(G.getTime())?void 0:G.toISOString()}let X=new Date($);return Number.isNaN(X.getTime())?void 0:X.toISOString()}function D3($){let Z=Number($);return Number.isFinite(Z)&&Z>0?Z:void 0}function k4($){return typeof $==="number"&&Number.isFinite($)&&$>=0?$:void 0}function y4($,Z){let X=$.get(Z);if(X===null||X.trim()==="")return;let J=Number(X);if(!Number.isFinite(J)||J<0||J>100)return;let G=Z.slice(0,-13),z=D3($.get(`${G}-window-minutes`)),B=y6($.get(`${G}-reset-at`)??void 0);if(J===0&&$.get(`${G}-window-minutes`)==="0"&&!B)return;return{usedPercent:J,remainingPercent:100-J,resetsAt:B,checkedAt:Date.now(),...z!==void 0?{windowMinutes:z}:{}}}var h4=["x-codex-primary-used-percent","x-codex-secondary-used-percent"];function v4($,Z){let X=$.get(Z);if(X===null)return"absent";if(X.trim()==="")return"invalid";let J=Number(X);return Number.isFinite(J)&&J>=0&&J<=100?"valid":"invalid"}function m4($){if(h4.some((G)=>v4($,G)==="invalid"))return{};let Z={},X=y4($,"x-codex-primary-used-percent");if(X)Z.primary=X;let J=y4($,"x-codex-secondary-used-percent");if(J)Z.secondary=J;return Z}function w4($){let Z=h4.map((X)=>v4($,X));return Z.includes("valid")&&!Z.includes("invalid")}function f4($){if(!$)return;if(!Number.isFinite($.used_percent)||$.used_percent<0||$.used_percent>100)return;let Z=D3($.window_minutes),X=y6($.reset_at);if($.used_percent===0&&Z===void 0&&!X)return;return{usedPercent:$.used_percent,remainingPercent:100-$.used_percent,resetsAt:X,checkedAt:Date.now(),...Z!==void 0?{windowMinutes:Z}:{}}}function p4($){let Z={},X=f4($.rate_limits?.primary);if(X)Z.primary=X;let J=f4($.rate_limits?.secondary);if(J)Z.secondary=J;return Z}function o1($){if($==null||$==="")return;let Z=Number($);return Number.isFinite(Z)&&Z>=0?Z:void 0}function g4($){if(!$)return;if(!Number.isFinite($.used_percent)||$.used_percent<0||$.used_percent>100)return;let Z=D3($.limit_window_seconds),X=y6($.reset_at);if($.used_percent===0&&Z===void 0&&!X)return;return{usedPercent:$.used_percent,remainingPercent:100-$.used_percent,resetsAt:X,checkedAt:Date.now(),...Z!==void 0?{windowMinutes:Z/60}:{}}}function u4($){let Z={},X=g4($.rate_limit?.primary_window);if(X)Z.primary=X;let J=g4($.rate_limit?.secondary_window);if(J)Z.secondary=J;let G=k4($.rate_limit_reset_credits?.available_count);if(G!==void 0)Z.resetCreditsAvailable=G;let z=k4($.rate_limit_reset_credits?.applicable_available_count);if(z!==void 0)Z.resetCreditsApplicable=z;let B=$.spend_control?.individual_limit;if($.spend_control===null||B===null)Z.spendControlCleared=!0;if(B&&typeof $.spend_control?.reached==="boolean"){let Y=o1(B.limit),H=o1(B.used),W=o1(B.remaining),U=o1(B.used_percent),j=o1(B.remaining_percent);if(Y!==void 0&&H!==void 0&&W!==void 0&&U!==void 0&&j!==void 0)Z.spendControl={limit:Y,used:H,remaining:W,usedPercent:U,remainingPercent:j,resetsAt:y6(B.reset_at),unit:B.unit,source:B.source,reached:$.spend_control.reached}}let Q=$.credits;if(Q&&typeof Q.has_credits==="boolean"&&typeof Q.unlimited==="boolean"&&typeof Q.overage_limit_reached==="boolean"){let Y=o1(Q.balance);Z.credits={hasCredits:Q.has_credits,unlimited:Q.unlimited,overageLimitReached:Q.overage_limit_reached,...Y!==void 0?{balance:Y}:{}}}return Z}import{ClaustrumClient as DG}from"@cortexkit/claustrum-client";import{resolve as l4}from"node:path";import{storeIdentity as hJ}from"@cortexkit/claustrum-client";import{SubcClient as vJ}from"@cortexkit/subc-client";function d4($){let Z=$.identity??hJ($.projectRoot??process.cwd(),$.storagePath??process.cwd());return{connectionFile:$.connectionFile,async getUsage(){let X,J=!1,G,z=new Promise((Q,Y)=>{G=setTimeout(()=>Y(Error("insula usage timeout")),3000),G.unref?.()}),B=(async()=>{if(X=$.connector?await $.connector({connectionFile:$.connectionFile,handshakeTimeoutMs:Math.min($.handshakeTimeoutMs??3000,3000)}):await vJ.connect({connectionFile:$.connectionFile,handshakeTimeoutMs:Math.min($.handshakeTimeoutMs??3000,3000)}),J)throw X.close(),Error("insula usage timeout");let Q=await X.routeOpen({kind:"management_surface",module_id:"insula"},Z);return await X.request(Q,{method:"usage.get",params:{}})})();try{return await Promise.race([B,z])}finally{J=!0,clearTimeout(G),X?.close()}}}}var N3=60000,mJ=4*N3,K3=new Map,f6=new Map;function q3($){return typeof $==="object"&&$!==null&&!Array.isArray($)}class c4{transport;key;#$=[];#Z;constructor($,Z){this.transport=$,this.key=Z}refresh($){if(this.#Z)return this.#Z;for(let[X,J]of f6)if($-J>=N3)f6.delete(X);let Z=f6.get(this.key);if(Z!==void 0&&$-Z<N3)return Promise.resolve();return f6.set(this.key,$),this.#Z=(async()=>{try{let X=await this.transport.getUsage();if(!q3(X)||!Array.isArray(X.result)||X.error!==void 0)throw Error("unavailable insula usage");this.#$=X.result.filter((J)=>q3(J)&&typeof J.provider==="string")}catch{this.#$=[]}})().finally(()=>{this.#Z=void 0}),this.#Z}current($,Z,X){for(let J of this.#$){if(J.provider!==$||typeof J.account!=="string"||J.account.trim()!==Z)continue;if(J.stale!==void 0||J.errorClass!==void 0||!q3(J.usage))continue;let G=typeof J.fetchedAt==="string"?Date.parse(J.fetchedAt):Number.NaN;if(!Number.isFinite(G)||X-G>=mJ)continue;return{entry:J,context:{fetchedAt:G,...typeof J.source==="string"&&{source:J.source}}}}return}}function s4($,Z){let X=JSON.stringify([l4($.connectionFile),l4(Z)]),J=K3.get(X);if(!J)J={source:new c4($,X),refs:0},K3.set(X,J);J.refs++;let G=!1;return{source:J.source,release(){if(G)return;if(G=!0,--J.refs===0)K3.delete(X)}}}import{ClaustrumCredentialError as lV}from"@cortexkit/claustrum-client";function M3($){let Z=new AbortController,X=[],J=!1,G=()=>{if(J)return;J=!0;for(let{source:Q,listener:Y}of X)Q.removeEventListener("abort",Y);X.length=0},z=(Q)=>{if(J||Z.signal.aborted)return;Z.abort(Q),G()},B=$.find((Q)=>Q.aborted);if(B)return Z.abort(B.reason),{signal:Z.signal,dispose:G};for(let Q of $){if(Z.signal.aborted)break;let Y=()=>z(Q.reason);if(X.push({source:Q,listener:Y}),Q.addEventListener("abort",Y,{once:!0}),Q.aborted)z(Q.reason)}return{signal:Z.signal,dispose:G}}import{ClaustrumCredentialError as $G}from"@cortexkit/claustrum-client";import{createHash as wJ,randomBytes as pJ,randomUUID as uJ}from"node:crypto";import{constants as i4}from"node:fs";import{chmod as lJ,mkdir as dJ,open as t4,readFile as F3,realpath as cJ,rename as sJ,stat as e4,unlink as $2}from"node:fs/promises";import{basename as Z2,dirname as J1,extname as a4,isAbsolute as n4,join as _3,resolve as iJ}from"node:path";import{ClaustrumCredentialError as aJ,ClaustrumClient as nJ,writeEnrollmentTokenFile as rJ}from"@cortexkit/claustrum-client";class S extends Error{kind;constructor($,Z){super(Z);this.name="ClaustrumConsumerError",this.kind=$}}var oJ=1,h6=16384,X2=30000,O3=/^[0-9a-f]{64}$/,J2=new Set(["invalid_params","pending_exists","not_found","already_consumed","superseded","stale_generation"]),G2=new Set(["pending_queue_full"]);function L3($){if(!($ instanceof aJ))return;if(J2.has($.code))return{code:$.code,disposition:"terminal"};if(G2.has($.code))return{code:$.code,disposition:"retry"};return{code:$.code,disposition:$.action==="retry"?"retry":"terminal"}}function C3($,Z){if(!/^[a-z0-9][a-z0-9-]*$/.test($)||!/^[a-z0-9][a-z0-9-]*$/.test(Z))throw new S("invalid-state","Claustrum enrollment names use lowercase letters, digits and dashes");return`${$}-${Z}`}function P3($){return nJ.connect($)}function z2($){let Z=a4($)||".json",X=Z2($,a4($));return{statePath:_3(J1($),`${X}-state${Z}`),tokenPath:$}}function T3($){let Z=$.override?.trim();if(Z&&!n4(Z)&&!$.cwd)throw new S("invalid-state","A relative Claustrum enrollment override needs a base directory");let X=Z?n4(Z)?Z:iJ($.cwd,Z):_3($.stateDir,`${$.host}-enrollment.json`);return z2(X)}function B2($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function g6($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0}function Q2($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=1}function R$(){return new S("invalid-state","invalid Claustrum enrollment state")}function m6($){if(!B2($)||$.version!==oJ||typeof $.proposedName!=="string"||$.proposedName.length===0)throw R$();if($.phase==="pending"){if(!O3.test(String($.requestSecret??""))||$.requestId!==void 0&&(typeof $.requestId!=="string"||$.requestId.length===0)||!g6($.createdAt)||!g6($.updatedAt))throw R$();return{version:1,phase:"pending",proposedName:$.proposedName,requestSecret:$.requestSecret,...$.requestId!==void 0&&{requestId:$.requestId},createdAt:$.createdAt,updatedAt:$.updatedAt}}if($.phase==="approved"){if($.approvedName!==void 0&&(typeof $.approvedName!=="string"||$.approvedName.length===0)||!Q2($.tokenGeneration)||!g6($.updatedAt))throw R$();return{version:1,phase:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration,updatedAt:$.updatedAt}}if($.phase==="denied"||$.phase==="blocked"){if($.errorCode!==void 0&&typeof $.errorCode!=="string"||!g6($.updatedAt))throw R$();return{version:1,phase:$.phase,proposedName:$.proposedName,...$.errorCode!==void 0&&{errorCode:$.errorCode},updatedAt:$.updatedAt}}throw R$()}function A3($){if(!B2($)||!O3.test(String($.token??""))||!Q2($.token_generation))throw new S("invalid-token","invalid Claustrum enrollment token file");return{token:$.token,token_generation:$.token_generation}}function tJ($){if(!$.isFile())throw new S("unsafe-file","Claustrum enrollment file must be a regular file");if(($.mode&63)!==0)throw new S("unsafe-file","Claustrum enrollment file must be owner-only");let Z=process.geteuid?.();if(Z!==void 0&&$.uid!==Z)throw new S("unsafe-file","Claustrum enrollment file must be owned by the current user")}function r4($){try{return JSON.parse($)}catch{throw new S("invalid-state","Claustrum enrollment file is not valid JSON")}}async function G1($){if(R)try{await q0(J1($));let X=await F0($,!0);if(Buffer.byteLength(X)>h6)throw new S("unsafe-file","Claustrum enrollment file is too large");return r4(X)}catch(X){if(X.code==="ENOENT")return;throw X}let Z;try{Z=await t4($,i4.O_RDONLY|i4.O_NOFOLLOW)}catch(X){if(X.code==="ENOENT")return;throw new S("unsafe-file","Claustrum enrollment file could not be opened safely")}try{tJ(await Z.stat());let X=Buffer.alloc(h6+1),{bytesRead:J}=await Z.read(X,0,X.byteLength,0);if(J>h6)throw new S("unsafe-file","Claustrum enrollment file is too large");return r4(X.subarray(0,J).toString("utf8"))}finally{await Z.close()}}function o4($,Z){let X=[];for(let J of $.split(`
+`)){if(J.trim()===""||J.startsWith("#"))continue;let G=J.split(":");if(G.length!==Z||!/^[^\s:,]+$/.test(G[0]??"")||!/^\d+$/.test(G[2]??"")||!Number.isSafeInteger(Number(G[2]))||Z===7&&(!/^\d+$/.test(G[3]??"")||!Number.isSafeInteger(Number(G[3])))||Z===4&&G[3]!==""&&!/^[^\s:,]+(?:,[^\s:,]+)*$/.test(G[3]??""))return;X.push(G)}return X}async function eJ($,Z,X){try{let[J,G]=await Promise.all([F3(X.passwdPath??"/etc/passwd","utf8"),F3(X.groupPath??"/etc/group","utf8")]),z=o4(J,7),B=o4(G,4);if(!z||!B)return!1;let Q=z.filter((U)=>Number(U[2])===$),Y=B.filter((U)=>Number(U[2])===Z);if(Q.length!==1||Y.length!==1)return!1;let H=Q[0]?.[0],W=Y[0]?.[3]??"";return(W===""||W.split(",").every((U)=>U===H))&&!z.some((U)=>Number(U[2])!==$&&Number(U[3])===Z)}catch{return!1}}function Y2($){if(!$.passwdPath&&!$.groupPath)return;return{fs:{readFile:(Z)=>F3(Z==="/etc/passwd"?$.passwdPath??Z:Z==="/etc/group"?$.groupPath??Z:Z)}}}async function H2($,Z={}){if(!R){let X=process.geteuid?.();if(X===void 0)return;let J=process.getegid?.(),G;try{G=await cJ($)}catch{return}let z;for(;;){let B=await e4(G).catch(()=>{return});if(B&&(B.mode&18)!==0&&(B.mode&512)===0){if(z===void 0)z=J!==void 0&&await eJ(X,J,Z);if((B.mode&2)!==0||B.uid!==X||B.gid!==J||!z)throw new S("unsafe-file",`Claustrum enrollment path has a writable ancestor: ${G}. Another user could replace it. Run: chmod g-w,o-w ${G}`)}let Q=J1(G);if(Q===G)return;G=Q}}try{await v0($,Y2(Z))}catch(X){if(!(X instanceof l))throw X;throw new S("unsafe-file",`Claustrum enrollment parent refused: ${X.path} (${X.reason??X.code}). Use a folder that other users cannot write or replace.`)}}async function v6($,Z={}){if(R){await q0($,!1,Y2(Z));return}await dJ($,{recursive:!0,mode:448});let X=await e4($),J=process.geteuid?.();if(J!==void 0&&X.uid!==J)throw new S("unsafe-file","Claustrum enrollment directory must be owned by the current user");if((X.mode&63)!==0)await lJ($,448)}async function A1($,Z,X={}){let J=J1($);await v6(J,X),await H2(J,X);let G=`${JSON.stringify(Z)}
+`;if(Buffer.byteLength(G)>h6)throw new S("invalid-state","Claustrum enrollment state is too large");if(R)return h1($,G);let z=_3(J,`.${Z2($)}.${process.pid}.${uJ()}.tmp`),B,Q=!1;try{B=await t4(z,"wx",384),Q=!0,await B.writeFile(G,"utf8"),await B.chmod(384),await B.sync(),await B.close(),B=void 0,await sJ(z,$),Q=!1}finally{if(await B?.close().catch(()=>{}),Q)await $2(z).catch(()=>{})}}async function E$($,Z){let X=await G1($.tokenPath),J=X===void 0?void 0:A3(X),G=await G1($.statePath),z=G===void 0?void 0:m6(G);if(J)return{state:"approved",proposedName:z?.proposedName??Z,...z?.phase==="approved"&&z.approvedName!==void 0&&{approvedName:z.approvedName},tokenGeneration:J.token_generation};if(!z)return{state:"idle"};if(z.phase==="approved")return{state:"blocked",proposedName:z.proposedName,code:"missing_token"};return X1(z)}async function S3($,Z){let X;try{X=await E$($,Z)}catch(J){if(!(J instanceof S)||J.kind!=="invalid-state"&&J.kind!=="invalid-token")return"unreadable";try{let G=await G1($.statePath);if(G===void 0)return"unreadable";let z=m6(G);return z.phase==="approved"&&z.proposedName===Z?"vault":"unreadable"}catch{return"unreadable"}}if("proposedName"in X&&X.proposedName!==Z)return"unreadable";if(X.state==="approved"||X.state==="blocked"&&X.code==="missing_token")return"vault";return"local"}async function S1($){let Z=await G1($);if(Z===void 0)throw new S("not-enrolled","Claustrum enrollment is not configured");return A3(Z)}function X1($){if($.phase==="pending")return{state:"pending",proposedName:$.proposedName,...$.requestId!==void 0&&{requestId:$.requestId}};if($.phase==="approved")return{state:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration};if($.phase==="denied")return{state:"denied",proposedName:$.proposedName};return{state:"blocked",proposedName:$.proposedName,code:$.errorCode??"unknown"}}function W2(){return new S("wrong-consumer","Claustrum enrollment state belongs to a different consumer")}class w6{#$;#Z;#z;#J;#W;#Q;#X;constructor($){this.#X=$.ancestorOptions??{},this.#$=$.client,this.#Z=$.paths,this.#z=$.proposedName,this.#J=$.now??Date.now,this.#W=$.mintSecret??(()=>pJ(32).toString("hex")),this.#Q=$.writeTokenFile??rJ}async status(){return E$(this.#Z,this.#z)}async resetTerminal(){return V2(this.#Z,this.#z)}async#B($,Z){let X={version:1,phase:"blocked",proposedName:$.proposedName,errorCode:Z,updatedAt:this.#J()};return await A1(this.#Z.statePath,X,this.#X),X1(X)}async reconcile(){await v6(J1(this.#Z.statePath),this.#X);let $=await e({name:"ceremony",path:this.#Z.statePath,ttlMs:X2,renew:!0});if(!$)return{state:"busy"};try{let Z=await G1(this.#Z.tokenPath),X=Z===void 0?void 0:A3(Z),J=await G1(this.#Z.statePath),G=J===void 0?void 0:m6(J);if(G&&G.proposedName!==this.#z)throw W2();if(X){if(!G||G.phase==="pending"){let B={version:1,phase:"approved",proposedName:G?.proposedName??this.#z,tokenGeneration:X.token_generation,updatedAt:this.#J()};await A1(this.#Z.statePath,B,this.#X),G=B}return{state:"approved",proposedName:G.proposedName,...G.phase==="approved"&&G.approvedName!==void 0&&{approvedName:G.approvedName},tokenGeneration:X.token_generation}}if(G?.phase==="approved"){let B={version:1,phase:"blocked",proposedName:G.proposedName,errorCode:"missing_token",updatedAt:this.#J()};return await A1(this.#Z.statePath,B,this.#X),X1(B)}if(G&&G.phase!=="pending")return X1(G);if(!G){let B=this.#J();if(G={version:1,phase:"pending",proposedName:this.#z,requestSecret:this.#W(),createdAt:B,updatedAt:B},!O3.test(G.requestSecret))throw new S("invalid-state","invalid minted Claustrum enrollment secret");await A1(this.#Z.statePath,G,this.#X)}if(!G.requestId)try{let B=wJ("sha256").update(Buffer.from(G.requestSecret,"hex")).digest("hex"),Q=await this.#$.enrollPropose({name:G.proposedName,requestSecretHash:B});G={...G,requestId:Q.requestId,updatedAt:this.#J()},await A1(this.#Z.statePath,G,this.#X)}catch(B){let Q=L3(B);if(!Q)throw B;if(Q.disposition==="retry")return{state:"pending",proposedName:G.proposedName,retryCode:Q.code};return this.#B(G,Q.code)}let z=G.requestId;if(!z)return X1(G);try{let B=await this.#$.enrollPoll({requestId:z,requestSecret:G.requestSecret});if(B.status==="pending")return X1(G);if(B.status==="denied"){let Y={version:1,phase:"denied",proposedName:G.proposedName,updatedAt:this.#J()};return await A1(this.#Z.statePath,Y,this.#X),X1(Y)}await v6(J1(this.#Z.tokenPath),this.#X),await H2(J1(this.#Z.tokenPath),this.#X),await this.#Q(this.#Z.tokenPath,{token:B.token,token_generation:B.tokenGeneration});let Q={version:1,phase:"approved",proposedName:G.proposedName,approvedName:B.name,tokenGeneration:B.tokenGeneration,updatedAt:this.#J()};return await A1(this.#Z.statePath,Q,this.#X),X1(Q)}catch(B){let Q=L3(B);if(!Q)throw B;if(Q.disposition==="retry")return{state:"pending",proposedName:G.proposedName,requestId:z,retryCode:Q.code};return this.#B(G,Q.code)}}finally{await $.release()}}}async function V2($,Z){await v6(J1($.statePath));let X=await e({name:"ceremony",path:$.statePath,ttlMs:X2,renew:!0});if(!X)return"busy";try{if(await G1($.tokenPath)!==void 0)return"refused-approved";let J=await G1($.statePath);if(J===void 0)return"idle";let G=m6(J);if(G.proposedName!==Z)throw W2();if(G.phase==="pending")return"refused-pending";return await X.assertOwned(),await $2($.statePath),"reset"}finally{await X.release()}}var I$="claustrum-tombstone:v1:";function p6($){return`${I$}${$}`}function R3($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function u6($){return typeof $==="string"&&$.startsWith(I$)}function U2($,Z){if(!R3($)||$.type!=="oauth")return!1;return $.refresh===p6(Z)}function j2($,Z){if(U2($,Z))return"placeholder";if(R3($)&&$.type==="oauth"&&typeof $.refresh==="string"&&$.refresh.length>0&&!u6($.refresh))return"login";if(R3($)&&$.type==="api"&&typeof $.key==="string"&&$.key.length>0)return"login";return"empty"}function E3($){let Z=j2($.auth,$.provider);if($.mode==="custody"&&Z==="login")throw new S("host-slot-login",`${$.provider} has a host login while its accounts are vault-custodied; refusing to serve until one is removed`);if($.mode==="local"&&Z==="placeholder")throw new S("host-slot-placeholder",`${$.provider} host slot holds the vault placeholder; sign in to use local accounts`);return Z}function D2($,Z){return Z!==void 0&&Z.credentialId===$.credentialId&&Z.accountIdentity===$.accountIdentity&&Z.recordVersion!==$.recordVersion}function ZG($,Z){if(Z===void 0)return"reauthorize-failed";if(Z.credentialId!==$.credentialId)return"credential-changed";if(Z.accountIdentity!==$.accountIdentity)return"account-changed";if(Z.recordVersion===$.recordVersion)return"version-unchanged";return"rotated"}var K2=i("claustrum");function x3($,Z,X,J=K2){let G=D2(Z,X);return J.debug("scoped 401 re-authorized",{site:$,credentialId:Z.credentialId,servedVersion:Z.recordVersion,currentVersion:X?.recordVersion??null,retry:G,reason:ZG(Z,X)}),G}var b3=300000;function I3(){return new S("invalid-material","Claustrum returned invalid credential material")}function XG($){let Z=$.trim();if(Z.startsWith("{")){let X;try{X=JSON.parse(Z)}catch{throw I3()}if(!X||typeof X!=="object")throw I3();let J=X,G=J.access_token??J.access;Z=typeof G==="string"?G:""}if(!/^[\x21-\x7e]+$/.test(Z)||Z.startsWith(I$))throw I3();return Z}function JG($,Z){if(!$.operations.includes("read"))return;if(!$.categories.includes(Z.category))return;if($.credentialType==="oauth")return $.refreshAdapter===Z.refreshAdapter?"oauth":void 0;if($.credentialType==="api_key"&&Z.apiKeys)return $.refreshAdapter===void 0?"api_key":void 0;return}class l6{#$;#Z;#z;#J;#W;#Q;#X;#B=new WeakMap;#V=new WeakMap;#Y=!1;constructor($){let Z=$.tokenPath;if($.readToken)this.#Z=$.readToken;else if(Z)this.#Z=()=>S1(Z);else throw new S("not-enrolled","Claustrum enrollment token path is required");this.#$=$.client,this.#J=$.family,this.#W=$.parseIdentity,this.#Q=$.requireAssertion??!1,this.#z=$.now??Date.now,this.#X=$.logger??K2}#G($){if(this.#Y)throw new S("closed","Claustrum scoped custody is closed");$?.throwIfAborted()}async#U($){this.#G($);let Z=await this.#Z();if(this.#G($),!/^[0-9a-f]{64}$/.test(Z.token)||!Number.isSafeInteger(Z.token_generation)||Z.token_generation<1)throw new S("invalid-token","Invalid Claustrum enrollment token");return Z.token}async#H($,Z){this.#G(Z);let X,J;try{let G=$();X=Z?await Promise.race([G,new Promise((z,B)=>{let Q=()=>B(Z.reason);if(Z.addEventListener("abort",Q,{once:!0}),J=()=>Z.removeEventListener("abort",Q),Z.aborted)Q()})]):await G}catch(G){if(this.#G(Z),G instanceof $G)throw G;throw new S("unavailable","Claustrum scoped operation unavailable")}finally{J?.()}return this.#G(Z),X}async discover($){let Z=await this.#U($),X=await this.#H(()=>this.#$.listScoped(Z),$),J=[],G=[],z=new Map;for(let Q of X.rows){let Y=JG(Q,this.#J);if(!Y)continue;G.push({row:Q,type:Y}),z.set(Q.id,(z.get(Q.id)??0)+1)}let B=[];for(let{row:Q,type:Y}of G){let H;if(!Q.id.trim())H="empty credential id";else if((z.get(Q.id)??0)>1)H="duplicate credential id";else if(Q.accountId!==void 0&&!Q.accountId.trim())H="blank account identity";else if(!Q.state.trim())H="empty state";if(H){J.push({...Q.id.trim()&&{credentialId:Q.id},reason:H});continue}B.push(Object.freeze({credentialId:Q.id,credentialType:Y,...Q.accountId!==void 0&&{accountIdentity:Q.accountId},state:Q.state,...Q.email!==void 0&&{email:Q.email},...Q.orgName!==void 0&&{orgName:Q.orgName}}))}for(let Q of J)this.#X.warn("skipped malformed vault record",Q);return{view:X.view,credentials:Object.freeze(B),skipped:Object.freeze(J)}}async authorize($,Z){if(!$.credentialId)throw new S("route-unavailable","Claustrum dispatch requires a credential id");let{credentialId:X,credentialType:J,accountIdentity:G}=$;if(this.#Q&&G===void 0)throw new S("identity-unasserted","Claustrum dispatch requires a known account identity");let z=await this.#U(Z),B=await this.#H(()=>this.#$.getScoped({credentialId:X,enrollmentToken:z,...J==="oauth"&&{minTtlMs:b3}}),Z);if(B.credentialId!==void 0&&B.credentialId!==X)throw new S("identity-changed","Claustrum served credential identity changed");let Q=B.expiresAtMs;if(!Number.isSafeInteger(B.recordVersion)||B.recordVersion<0||Q===null&&J==="oauth"||Q!==null&&(!Number.isFinite(Q)||Q-this.#z()<b3))throw new S("insufficient-validity","Claustrum served credential has insufficient validity");let Y=XG(B.material),H=B.accountId?.trim()?B.accountId:void 0;if(this.#Q&&(B.credentialId===void 0||H===void 0))throw new S("identity-unasserted","Claustrum served credential did not assert its identity");let W=H===void 0?this.#W?.(Y):void 0,U=H??W;if(G!==void 0&&U!==void 0&&U!==G)throw new S("identity-changed","Claustrum served credential identity changed");let j=U??G,V=Object.freeze(Object.defineProperty({credentialId:X,credentialType:J,...j!==void 0&&{accountIdentity:j},accountIdentitySource:H!==void 0?"asserted":W!==void 0?"parsed":G!==void 0?"expected":"none",...G!==void 0&&{expectedAccountIdentity:G},...B.credentialId!==void 0&&{assertedCredentialId:B.credentialId},...H!==void 0&&{assertedAccountIdentity:H},...B.projectId!==void 0&&{projectId:B.projectId},recordVersion:B.recordVersion,expiresAtMs:Q},"accessToken",{value:Y,enumerable:!1}));return this.#B.set(V,z),V}async reportFailure($,Z,X){if(Z!==401)return;this.#G();let J=this.#B.get($);if(!J)throw new S("no-receipt","Claustrum failure report requires an original dispatch receipt");let G=this.#V.get($);if(G)return G;let z=this.#H(()=>this.#$.reportAuthFailureScoped({credentialId:$.credentialId,enrollmentToken:J,providerStatus:401,recordVersion:$.recordVersion,reporterSource:X}));this.#V.set($,z);try{await z,this.#X.debug("scoped 401 reported",{credentialId:$.credentialId,recordVersion:$.recordVersion,reporterSource:X})}catch(B){throw this.#V.delete($),B}}close(){if(this.#Y)return;this.#Y=!0,this.#$.close()}}import{createHash as GG}from"node:crypto";function q2($,Z,X){if($.accountIdentity!==void 0&&X!==void 0)return $.accountIdentity===X;return $.credentialId===Z}function k3($,Z,X){return $.some((J)=>q2(J,Z,X))}function y3($,Z,X){let J={credentialId:Z,...X!==void 0&&{accountIdentity:X}};return[...$.filter((G)=>G.credentialId!==Z||G.accountIdentity!==X),J]}function f3($,Z,X){return $.filter((J)=>!Z.some((G)=>q2(J,G,X)))}var M2="vault:";function zG($){return GG("sha256").update($).digest("hex")}function BG($){let Z=$.credentialId.split(":");return(Z.length>=3?Z.slice(2).join(":").trim():void 0)||$.email||$.credentialId}function QG($){return $.identity!==void 0?`identity:${$.identity}`:`credential:${$.credential.credentialId}`}function z1($){return[$.credentialId,...$.aliases??[]]}function F2($,Z,X={}){let J=X.now??Date.now(),G=X.routePrefix??M2,z=X.reservedRouteIds??new Set,B=$?.rows??[],Q=[...$?.declined??[]],Y=Z.skipped.length===0,H=new Set(Z.credentials.map((F)=>F.credentialId)),W=new Set(Z.skipped.flatMap((F)=>F.credentialId===void 0?[]:[F.credentialId])),U=Z.skipped.some((F)=>F.credentialId===void 0),j=(F)=>!H.has(F)&&(W.has(F)||U),K=new Map;for(let F of B){if(F.accountIdentity===void 0)continue;for(let D of z1(F))if(!K.has(D))K.set(D,F.accountIdentity)}let V=new Map;for(let F of Z.credentials){let D=F.accountIdentity!==void 0?{credential:F,identity:F.accountIdentity,claimed:!0}:{credential:F,identity:K.get(F.credentialId),claimed:!1},L=QG(D),A=V.get(L)??[];A.push(D),V.set(L,A)}let N=new Set,q=new Set(z),M=[],P=(F,D)=>F.credential.credentialId.localeCompare(D.credential.credentialId),E=[...V.values()].map((F)=>F.toSorted(P)).sort((F,D)=>F[0]&&D[0]?P(F[0],D[0]):0);for(let F of E){let D=F[0]?.identity,L=F.filter((g)=>g.credential.state==="active"),A=L.length?L:F,v=A.filter((g)=>g.claimed),u=v.length?v:A,n=new Set(F.map((g)=>g.credential.credentialId)),f=B.find((g)=>!N.has(g)&&z1(g).some((g0)=>n.has(g0))&&(g.accountIdentity===void 0||g.accountIdentity===D)),k=u.find((g)=>g.credential.credentialId===f?.credentialId)??u[0];if(!k)continue;let y=k.credential,r=f??(D===void 0?void 0:B.find((g)=>!N.has(g)&&g.accountIdentity===D));if(r)N.add(r);let d=r?.routeId;if(!d||z.has(d)){let g=`${G}${y.credentialId}${D===void 0?"":`~${zG(D).slice(0,10)}`}`;d=g;for(let g0=2;q.has(d);g0++)d=`${g}~${g0}`}q.add(d);let n$=r?z1(r).filter(j):[],b1=[...new Set([...F.map((g)=>g.credential.credentialId),...n$])].filter((g)=>g!==y.credentialId).sort((g,g0)=>g.localeCompare(g0)),r$=X.mapAccount?.(y)??{};M.push({previousIndex:r?B.indexOf(r):1/0,row:{routeId:d,credentialId:y.credentialId,credentialType:y.credentialType,...D!==void 0&&{accountIdentity:D},...b1.length&&{aliases:b1},state:y.state,label:r$.label?.trim()||BG(y),...y.email!==void 0&&{email:y.email},...y.orgName!==void 0&&{orgName:y.orgName},enabled:![y.credentialId,...b1].some((g)=>k3(Q,g,D)),addedAt:r?.addedAt??J,...r?.quota!==void 0&&{quota:r.quota},...!k.claimed&&D!==void 0&&{unclaimed:!0}}})}return B.forEach((F,D)=>{if(N.has(F)||!z1(F).some(j))return;if(q.has(F.routeId))return;let[L,...A]=z1(F).filter((n)=>!H.has(n));if(L===void 0)return;q.add(F.routeId);let{aliases:v,...u}=F;M.push({previousIndex:D,row:{...u,credentialId:L,...A.length&&{aliases:A},stale:!0}})}),M.sort((F,D)=>F.previousIndex===D.previousIndex?F.row.credentialId.localeCompare(D.row.credentialId):F.previousIndex-D.previousIndex),{version:1,view:Z.view,complete:Y,...!Y&&{rejected:Z.skipped.map((F)=>({...F.credentialId!==void 0&&{credentialId:F.credentialId},reason:F.reason}))},rows:M.map((F)=>F.row),declined:Q}}function g3($){return($?.rows??[]).filter((Z)=>Z.enabled&&Z.state==="active").map((Z)=>({id:Z.routeId,kind:Z.credentialType==="oauth"?"oauth":"api-key",...Z.quota!==void 0&&{quota:Z.quota}}))}function b$($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function t1($){return $===void 0||typeof $==="string"}function YG($){let Z=b$($)?q1($.quota):void 0;if(!b$($)||typeof $.routeId!=="string"||typeof $.credentialId!=="string"||$.credentialType!=="oauth"&&$.credentialType!=="api_key"||typeof $.state!=="string"||typeof $.label!=="string"||typeof $.enabled!=="boolean"||typeof $.addedAt!=="number"||!t1($.accountIdentity)||!t1($.email)||!t1($.orgName)||$.aliases!==void 0&&(!Array.isArray($.aliases)||!$.aliases.every((X)=>typeof X==="string"))||$.quota!==void 0&&Z===void 0||$.stale!==void 0&&$.stale!==!0||$.unclaimed!==void 0&&$.unclaimed!==!0)return;return{...$,...Z===void 0?{}:{quota:Z}}}var HG=new Set(["empty credential id","duplicate credential id","blank account identity","empty state"]);function N2($){if(!Array.isArray($))return;let Z=[];for(let X of $){if(!b$(X)||!t1(X.credentialId)||typeof X.reason!=="string"||!HG.has(X.reason))return;Z.push(X)}return Z}function WG($){if(!b$($)||$.version!==1||!t1($.view)||!Array.isArray($.rows)||!Array.isArray($.declined)||$.complete!==void 0&&typeof $.complete!=="boolean"||$.rejected!==void 0&&!N2($.rejected))throw new S("invalid-state","Claustrum roster file is not valid");let Z=[];for(let G of $.rows){let z=YG(G);if(!z)throw new S("invalid-state","Claustrum roster file is not valid");Z.push(z)}let X=[];for(let G of $.declined){if(!b$(G)||typeof G.credentialId!=="string"||!t1(G.accountIdentity))throw new S("invalid-state","Claustrum roster file is not valid");X.push(G)}let J=N2($.rejected);return{version:1,...typeof $.view==="string"&&{view:$.view},complete:$.complete!==!1,...J&&{rejected:J},rows:Z,declined:X}}async function _0($){let Z;try{Z=await F0($,R)}catch(J){if(J.code==="ENOENT")return;throw J}let X;try{X=JSON.parse(Z)}catch{throw new S("invalid-state","Claustrum roster file is not valid")}return WG(X)}var VG={name:"claustrum-roster-write",ttlMs:1e4,timeoutMs:5000},UG={name:"claustrum-roster",ttlMs:30000};async function e1($,Z,X={}){return vZ($,VG,async(J)=>{let G=await _0($),{next:z,result:B}=await Z(G,{assertOwned:()=>J.assertOwned()});if(z)await J.assertOwned(),await L0($,z,{beforeRename:async()=>{await X.beforePublish?.(),await J.assertOwned()}});return B})}function h3($,Z){return e1($,(X)=>{let J=X?.rows.find((z)=>z.routeId===Z);if(!X||!J)throw new S("route-unavailable","Claustrum route is not in the roster");let G=y3(X.declined,J.credentialId,J.accountIdentity);return{next:{...X,declined:G,rows:X.rows.map((z)=>z===J?{...z,enabled:!1}:z)},result:void 0}})}function v3($,Z){return e1($,(X)=>{let J=X?.rows.find((G)=>G.routeId===Z);if(!X||!J)throw new S("route-unavailable","Claustrum route is not in the roster");return{next:{...X,declined:f3(X.declined,z1(J),J.accountIdentity),rows:X.rows.map((G)=>G===J?{...G,enabled:!0}:G)},result:void 0}})}function jG($,Z){if(!z1($).includes(Z.credentialId))return"refuse";if($.unclaimed&&(Z.accountIdentitySource==="expected"||Z.accountIdentitySource==="none"))return"refuse";if($.accountIdentity===Z.accountIdentity)return"hold";if($.accountIdentity===void 0&&Z.expectedAccountIdentity===void 0&&Z.accountIdentity!==void 0&&(Z.accountIdentitySource==="asserted"||Z.accountIdentitySource==="parsed")&&z1($).length===1)return"bind";return"refuse"}function m3($,Z){return e1($,(X)=>{let J=X?.rows.find((Q)=>Q.routeId===Z.routeId),G=!X||!J?"refuse":jG(J,Z);if(!X||!J||G==="refuse")return{result:!1};let z=E0(J.quota,Z.observation),B=G==="bind"?{accountIdentity:Z.accountIdentity,unclaimed:!0}:{};return{next:{...X,rows:X.rows.map((Q)=>Q===J?{...Q,...B,quota:z}:Q)},result:!0}})}function w3($,Z){return e1($,(X)=>{let J=X?.rows.find((z)=>z.routeId===Z.routeId);if(!X||!J||J.accountIdentity===void 0||J.accountIdentity!==Z.accountIdentity)return{result:!1};let G=E0(J.quota,Z.observation);return{next:{...X,rows:X.rows.map((z)=>z===J?{...z,quota:G}:z)},result:!0}})}async function p3($){$.signal?.throwIfAborted();let Z=async()=>await $.isActive?.()??!0;if(!await Z())return;let X=await e({...UG,path:$.path,renew:!0});if(!X){let J=await _0($.path);if($.signal?.throwIfAborted(),!J?.view)throw new S("roster-busy","Claustrum account discovery is already in progress");return J}try{let J=await $.custody.discover($.signal);return $.signal?.throwIfAborted(),await e1($.path,async(G)=>{if(!await Z())return{result:void 0};$.signal?.throwIfAborted(),await X.assertOwned();let z=typeof $.projection==="function"?$.projection():$.projection,B=F2(G,J,z);return{...JSON.stringify(G)!==JSON.stringify(B)&&{next:B},result:B}})}finally{await X.release()}}class d6{#$;#Z=new AbortController;#z;#J;#W;#Q;#X;#B;#V=!1;#Y;constructor($){this.#$=$,this.#z=$.logger??i("claustrum")}#G($){this.#Z.signal.throwIfAborted(),$?.throwIfAborted()}async#U(){return await this.#$.isCustodyActive?.()??!0}#H($,Z){let X=M3([this.#Z.signal,...Z?[Z]:[]]);return new Promise((J,G)=>{let z=()=>{X.signal.removeEventListener("abort",B),X.dispose()},B=()=>{z(),G(X.signal.reason)};if(X.signal.addEventListener("abort",B,{once:!0}),$.then((Q)=>{if(z(),X.signal.aborted)G(X.signal.reason);else J(Q)},(Q)=>{z(),G(Q)}),X.signal.aborted)B()})}async#D(){if(this.#G(),this.#J)return this.#J;if(!this.#W)this.#W=this.#$.connect().then(($)=>{if(this.#Z.signal.aborted)$.close(),this.#G();if(this.#J=new l6({client:$,family:this.#$.family,tokenPath:this.#$.tokenPath,parseIdentity:this.#$.parseIdentity,requireAssertion:this.#$.requireAssertion,now:this.#$.now,logger:this.#z}),this.#$.insula&&$.insula)this.#Y=s4($.insula,this.#$.tokenPath);return this.#J}).finally(()=>{this.#W=void 0});return this.#H(this.#W)}snapshot(){return this.#X}routingRows(){return g3(this.#X)}refresh(){if(this.#G(),this.#Q)return this.#Q;return this.#Q=(async()=>{if(!await this.#U()){this.#X=void 0,this.#J?.close(),this.#J=void 0,this.#Y?.release(),this.#Y=void 0;return}let $=await this.#D(),Z=await p3({path:this.#$.rosterPath,custody:$,isActive:()=>this.#U(),signal:this.#Z.signal,projection:()=>({reservedRouteIds:new Set(this.#$.reservedRouteIds?.()??[]),routePrefix:this.#$.routePrefix,mapAccount:this.#$.mapAccount,now:(this.#$.now??Date.now)()})});this.#G();let X=Z?.view!==this.#X?.view;if(this.#X=Z,Z&&X)this.#$.onRoster?.(Z);return Z})().finally(()=>{this.#Q=void 0}),this.#Q}start(){if(this.#V)return;this.#G(),this.#V=!0;let $=async()=>{try{await this.refresh(),await this.refreshInsulaQuota()}catch(X){if(!this.#Z.signal.aborted)this.#$.onError?.(X)}if(this.#Z.signal.aborted)return;let Z=this.#$.pollIntervalMs??5000;if(Z<=0)return;this.#B=(this.#$.setTimeoutImpl??setTimeout)(()=>{this.#B=void 0,$()},Z),this.#B.unref?.()};$()}async refreshInsulaQuota(){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#U())return;try{await S1(this.#$.tokenPath),await this.#D(),await this.#Y?.source.refresh((this.#$.now??Date.now)())}catch{}}async cachedInsulaQuota($){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#U())return;try{return await S1(this.#$.tokenPath),this.#K($.assertedAccountIdentity)}catch{return}}async cachedInsulaQuotaForRoute($){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#U())return;try{await S1(this.#$.tokenPath);let X=(await _0(this.#$.rosterPath))?.rows.find((J)=>J.routeId===$);return this.#K(X?.accountIdentity)}catch{return}}#K($){if(!this.#$.insula||!$)return;let Z=this.#Y?.source.current(this.#$.insula.provider,$,(this.#$.now??Date.now)());return Z?this.#$.insula.normalize(Z.entry,Z.context):void 0}async authorize($,Z){this.#G(Z);let X=this.#X??await this.#H(this.refresh(),Z);if(!X||!await this.#U())throw new S("not-active","Claustrum scoped custody is not active");let J=await _0(this.#$.rosterPath);this.#G(Z);let G=X.rows.find((Y)=>Y.routeId===$),z=J?.rows.find((Y)=>Y.routeId===$);if(z&&!z.enabled)throw new S("route-declined","Claustrum route is disabled");if(!G||!z||z.state!=="active"||z.credentialId!==G.credentialId||z.accountIdentity!==G.accountIdentity)throw new S("route-unavailable","Claustrum route is disabled, removed or changed");let B=await this.#H(this.#D(),Z),Q=M3([this.#Z.signal,...Z?[Z]:[]]);try{return await B.authorize({credentialId:z.credentialId,credentialType:z.credentialType,...z.accountIdentity!==void 0&&{accountIdentity:z.accountIdentity}},Q.signal)}finally{Q.dispose()}}async reportFailure($,Z,X){if(this.#G(),!this.#J)throw new S("no-receipt","Claustrum dispatch receipt has no active owner");await this.#J.reportFailure($,Z,X)}async send($,Z,X){let J=X.signal,G=await this.authorize($,J),z=await Z(G,J);if(z.status===401&&!J?.aborted){let B;try{B=await this.authorize($,J)}catch{}if(x3(X.site,G,B,this.#z))await z.body?.cancel().catch(()=>{}),G=B,z=await Z(B,J)}if(z.status===401)await this.reportFailure(G,401,X.reporterSource??"direct").catch((B)=>this.#$.onError?.(B)),Promise.resolve().then(()=>this.refresh()).catch((B)=>{if(!this.#Z.signal.aborted)this.#$.onError?.(B)});return z}async decline($){this.#G(),await h3(this.#$.rosterPath,$),this.#X=await _0(this.#$.rosterPath)}async accept($){this.#G(),await v3(this.#$.rosterPath,$),this.#X=await _0(this.#$.rosterPath)}async recordQuota($,Z,X){this.#G();let J=await m3(this.#$.rosterPath,{routeId:$,observation:Z,credentialId:X.credentialId,accountIdentitySource:X.accountIdentitySource,...X.accountIdentity!==void 0&&{accountIdentity:X.accountIdentity},...X.expectedAccountIdentity!==void 0&&{expectedAccountIdentity:X.expectedAccountIdentity}});if(J)this.#X=await _0(this.#$.rosterPath);return J}async recordAccountQuota($,Z,X){this.#G();let J=await w3(this.#$.rosterPath,{routeId:$,accountIdentity:Z,observation:X});if(J)this.#X=await _0(this.#$.rosterPath);return J}close(){if(this.#Z.signal.aborted)return;if(this.#Z.abort(new S("closed","Claustrum consumer is closed")),this.#B)(this.#$.clearTimeoutImpl??clearTimeout)(this.#B);this.#B=void 0,this.#J?.close(),this.#Y?.release(),this.#Y=void 0,this.#X=void 0}}async function L2($){let Z=await DG.connect($);return Object.assign(Z,{insula:d4($)})}var KG=p6("openai");function _2($){return u6($)}function k0($){if(!$||$.corrupt===!0)return!1;return _2($.refresh)}class x$ extends Error{code="tombstone-refresh";constructor(){super("This OpenAI account was moved into the Claustrum vault by an older version of OpenAI auth and holds no local credential. Connect the vault, or sign in to the account again.");this.name="TombstoneRefreshError"}}function c6($){if(_2($))throw new x$}function c0($){if($ instanceof Error)return $.message;if(typeof $==="string")return $;try{return JSON.stringify($)}catch{return String($)}}var qG=i("quota");var NG="app_EMoamEEZ73f0CkXaXp7hrann",MG="https://auth.openai.com";async function O2($){c6($.refreshToken);let Z=await $.fetchImpl(`${MG}/oauth/token`,{method:"POST",signal:AbortSignal.timeout(15000),headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"refresh_token",refresh_token:$.refreshToken,client_id:NG}).toString()});if(!Z.ok){let G=V3(Z.headers.get("retry-after"));throw Object.assign(Error(`Token refresh failed: ${Z.status}`),{status:Z.status,retryAfter:G,isRefreshError:!0})}let X=await Z.json();if(!X||typeof X.access_token!=="string"||!X.access_token||typeof X.expires_in!=="number")throw Object.assign(Error("Token refresh failed: malformed response"),{status:Z.status,isRefreshError:!0});if(X.refresh_token!==void 0&&typeof X.refresh_token!=="string")throw Object.assign(Error("Token refresh failed: malformed response"),{status:Z.status,isRefreshError:!0});let J=typeof X.refresh_token==="string"&&X.refresh_token?X.refresh_token:$.refreshToken;return{access:X.access_token,refresh:J,expires:$.now()+X.expires_in*1000,expiresIn:X.expires_in}}var FG="https://chatgpt.com/backend-api/wham/usage";async function $$($){let Z=$.logger??qG,X=$.accountKey??"unknown",J=Date.now();Z.debug("wham usage fetch started",{pid:process.pid,accountId:X});try{let G=await $.fetchImpl(FG,{signal:AbortSignal.timeout(15000),headers:{authorization:`Bearer ${$.accessToken}`,"chatgpt-account-id":$.accountId??"","oai-client-platform":"web","oai-client-version":"0","x-openai-target-path":"/backend-api/wham/usage"}});if(!G.ok){let B=V3(G.headers.get("retry-after"));throw Object.assign(Error(`wham usage check failed: ${G.status}`),{status:G.status,retryAfter:B})}let z=u4(await G.json());return Z.debug("wham usage fetch succeeded",{pid:process.pid,accountId:X,status:G.status,elapsedMs:Date.now()-J}),z}catch(G){throw Z.warn("wham usage fetch failed",{pid:process.pid,accountId:X,status:typeof G?.status==="number"?G.status:"error",elapsedMs:Date.now()-J,error:c0(G)}),G}}import{createHash as OG}from"node:crypto";var CG=globalThis.setTimeout,PG=5;function k$($){let Z=$?.quota?.checkIntervalMinutes??PG;return Math.max(1,Z)*60000}function TG($){return $?.quota?.enabled!==!1}function l3($,Z){if(!$?.resetsAt)return!1;let X=Date.parse($.resetsAt);return Number.isFinite(X)&&X<=Z}function AG($){let Z=$?.quota?.minimumRemaining||{};return{primary:Z.primary??Z["5h"]??15,secondary:Z.secondary??Z["1w"]??10}}function C2($,Z,X){if(!TG(Z))return X+k$(Z);let J=AG(Z),G=[];for(let z of["primary","secondary"]){let B=$?.[z];if(!B)continue;if(B.remainingPercent>=J[z])continue;let Q=B.resetsAt?Date.parse(B.resetsAt):Number.NaN;if(!Number.isFinite(Q)||Q<=X)return X+k$(Z);G.push(Q)}if(!G.length)return X+k$(Z);return Math.min(...G)+60000}function SG($){if(!$?.quota?.mainQuota||!$.quota.mainQuotaCheckedAt)return null;return{quota:$.quota.mainQuota,checkedAt:$.quota.mainQuotaCheckedAt,tokenFingerprint:$.quota.mainQuotaToken}}function RG($){let Z=$?.quota?.refreshEveryNRequests;return typeof Z==="number"&&Number.isFinite(Z)&&Z>0?Math.floor(Z):0}function O0($){return OG("sha256").update($).digest("hex").slice(0,16)}class B1{main=null;mainTokenFp=null;mainQuotaAccountId=null;fallbacks=new Map;fallbackTokenFps=new Map;inflightMain=null;inflightMainFp=null;inflightFallbacks=new Map;mainLastApiError=void 0;fallbackApiErrors=new Map;fallbackErrorTokenFps=new Map;rateLimitedUntilMap=new Map;apiGate=Promise.resolve();lastApiCallAt=0;storage;fetchImpl;now;fetchQuotaFn;onMainQuotaFetched;onApiError;configPath;constructor($){this.storage=$.storage,this.fetchImpl=$.fetchImpl??fetch,this.configPath=$.configPath,this.now=$.now??Date.now,this.fetchQuotaFn=$.fetchQuotaFn,this.onMainQuotaFetched=$.onMainQuotaFetched,this.onApiError=$.onApiError,this.seedMainFromStorage($.storage),this.seedMainBackoffFromStorage($.storage)}getMain($){if($&&this.main&&this.mainTokenFp&&this.mainTokenFp!==O0($))this.main=null,this.mainTokenFp=null;return this.main}getFallback($,Z){let X=this.fallbacks.get($)??null;if(!Z||!X)return X;if(this.fallbackTokenFps.get($)!==O0(Z))return this.fallbacks.delete($),this.fallbackTokenFps.delete($),null;return X}getAllFallbacks(){return this.fallbacks}setMain($,Z,X,J=!1){if(!J&&!P2(Z.quota))return;if(this.mainTokenFp=O0($),X&&this.mainQuotaAccountId&&this.mainQuotaAccountId!==X)this.clearRateLimited("main");if(X)this.mainQuotaAccountId=X;if(this.main=Z,u3(Z.quota))this.clearRateLimited("main")}peekMainForPolicy($){if($&&this.mainQuotaAccountId&&this.mainQuotaAccountId!==$)return null;return this.main}peekFallbackForPolicy($,Z){let X=this.fallbacks.get($)??null;if(Z&&X?.accountId&&X.accountId!==Z)return null;return X}setFallback($,Z,X,J=!1,G){if(!J&&!P2(Z.quota))return;let z=this.fallbacks.get($)?.accountId;if(G&&z&&G!==z)this.clearRateLimited($);let B=G??z;if(this.fallbacks.set($,{...Z,accountId:B}),X)this.fallbackTokenFps.set($,O0(X));else this.fallbackTokenFps.delete($);if(u3(Z.quota))this.clearRateLimited($)}markRateLimited($,Z){let X=this.rateLimitedUntilMap.get($);if(X!==void 0&&X>Z)return;this.rateLimitedUntilMap.set($,Z)}isRateLimited($){let Z=this.rateLimitedUntilMap.get($);return Z!==void 0&&this.now()<Z}rateLimitedUntil($){return this.rateLimitedUntilMap.get($)}clearRateLimited($){this.rateLimitedUntilMap.delete($)}async refreshMain($){let Z=O0($);if(this.mainTokenFp&&this.mainTokenFp!==Z)this.main=null,this.mainTokenFp=null;if(this.inflightMain&&this.inflightMainFp===Z)return this.inflightMain;if(this.isBackedOff()){if(this.main)return this.main.quota;throw Error("Quota API rate-limited — try again later")}return this.inflightMainFp=Z,this.inflightMain=this._fetchMain($),this.inflightMain}async refreshFallback($,Z){let X=B1.fallbackInflightKey($,Z),J=this.inflightFallbacks.get(X);if(J)return J;if(this.isFallbackBackedOff($,Z)){let z=this.getFallback($,Z);if(z)return z.quota;throw Error("Quota API rate-limited — try again later")}let G=this._fetchFallback($,Z);return this.inflightFallbacks.set(X,G),G}async refreshAllFallbacks($){let Z=this.now();for(let X of $){if(X.enabled===!1)continue;if(k0(X)||!X.access)continue;let J=this.getFallback(X.id,X.access);if(J&&Z<J.refreshAfter)continue;try{await this.refreshFallback(X.id,X.access)}catch{}}}refreshMainInBackground($){let Z=O0($);if(this.inflightMain&&this.inflightMainFp===Z)return;if(this.isBackedOff())return;this.refreshMain($).catch(()=>{})}isMainStale(){if(!this.main)return!0;return this.now()>=this.main.refreshAfter}isFallbackStale($,Z){let X=this.getFallback($,Z);if(!X)return!0;return this.now()>=X.refreshAfter}shouldRefreshOnRequestCount($){let Z=RG(this.storage);if(Z<=0)return!1;return $>0&&$%Z===0}needsRefresh($){return this.isMainStale()||this.shouldRefreshOnRequestCount($)}updateStorage($){this.storage=$,this.seedMainFromStorage($),this.seedMainBackoffFromStorage($)}seedMainFromStorage($,Z){let X=SG($);if(!X)return;let J=Z?O0(Z):null;if(J&&X.tokenFingerprint&&X.tokenFingerprint!==J)return;let G={quota:X.quota,refreshAfter:C2(X.quota,$,X.checkedAt),checkedAt:X.checkedAt};if(this.main&&this.main.checkedAt>=G.checkedAt&&(!J||!this.mainTokenFp||this.mainTokenFp===J))return;if(this.main=G,this.mainTokenFp=X.tokenFingerprint??null,$?.mainAccountId){if(this.mainQuotaAccountId&&this.mainQuotaAccountId!==$.mainAccountId)this.clearRateLimited("main");this.mainQuotaAccountId=$.mainAccountId}}seedMainBackoffFromStorage($){let Z=$?.quota?.mainLastQuotaApiError;this.mainLastApiError=Z&&a1(Z,this.now())?Z:void 0}seedFallbacksFromAccounts($){let Z=k$(this.storage);for(let X of $){if(X.enabled===!1)continue;if(!X.quota)continue;let J=Math.max(X.quota.primary?.checkedAt??0,X.quota.secondary?.checkedAt??0);if(J<=0)continue;let G=this.getFallback(X.id,X.access);if(G&&G.checkedAt>=J)continue;this.setFallback(X.id,{quota:X.quota,refreshAfter:J+Z,checkedAt:J},X.access,!1,X.accountId)}}isBackedOff(){return a1(this.mainLastApiError,this.now())}isFallbackBackedOff($,Z){if(Z){if(this.fallbackErrorTokenFps.get($)!==O0(Z))return!1}return a1(this.fallbackApiErrors.get($),this.now())}getLastApiError(){return this.mainLastApiError}static API_CALL_GAP_MS=1000;static fallbackInflightKey($,Z){return JSON.stringify([$,O0(Z)])}static quotaLockName($){return`opencode-fallback-quota-refresh-${$.replace(/[^a-zA-Z0-9._-]+/g,"-")||"account"}`}_enqueueApiFetch($){let Z=async()=>{let J=this.now()-this.lastApiCallAt;if(J<B1.API_CALL_GAP_MS)await new Promise((G)=>{let z=CG(G,B1.API_CALL_GAP_MS-J);if(typeof z==="object"&&"unref"in z)z.unref()});return this.lastApiCallAt=this.now(),$()},X=this.apiGate.then(Z,Z);return this.apiGate=X.catch(()=>{}),X}async _fetchMain($){let Z=O0($);return this._enqueueApiFetch(async()=>{try{if(this.isBackedOff()){if(this.main)return this.main.quota;throw Error("Quota API rate-limited — try again later")}let X=await e({name:"opencode-main-quota-refresh",ttlMs:30000,path:this.configPath});if(!X){let J=this.main;if(J&&this.now()<J.refreshAfter)return J.quota;throw Error("Quota refresh is already in progress")}try{let J=this.now(),G=await this._fetchQuota($),z=this.now();if(this.mainTokenFp=O0($),this.main={quota:G,refreshAfter:C2(G,this.storage,z),checkedAt:z},u3(G))this.clearRateLimited("main");return this.mainLastApiError=void 0,this.onMainQuotaFetched?.(G,z,this.mainTokenFp,J),G}catch(J){throw this._handleMainFetchError(J),J}finally{await X.release()}}finally{if(this.inflightMainFp===Z)this.inflightMain=null,this.inflightMainFp=null}})}async _fetchFallback($,Z){return this._enqueueApiFetch(async()=>{try{if(this.isFallbackBackedOff($,Z)){let J=this.getFallback($,Z);if(J)return J.quota;throw Error("Quota API rate-limited — try again later")}let X=await e({name:B1.quotaLockName($),ttlMs:30000,path:this.configPath});if(!X){let J=this.getFallback($,Z);if(J&&this.now()<J.refreshAfter)return J.quota;throw Error("Quota refresh is already in progress")}try{let J=await this._fetchQuota(Z),G=this.now();return this.setFallback($,{quota:J,refreshAfter:G+k$(this.storage),checkedAt:G},Z,!0),this.fallbackApiErrors.delete($),this.fallbackErrorTokenFps.delete($),J}finally{await X.release()}}catch(X){throw this._handleFallbackFetchError($,Z,X),X}finally{this.inflightFallbacks.delete(B1.fallbackInflightKey($,Z))}})}async _fetchQuota($){if(!this.fetchQuotaFn)throw Error("Quota fetch not available — no fetchQuotaFn injected (push-only mode)");return this.fetchQuotaFn({accessToken:$,fetchImpl:this.fetchImpl,now:this.now})}static isAuthError($){return $?.status===401}_handleMainFetchError($){if(B1.isAuthError($))return;this.mainLastApiError=P$({error:$,now:this.now(),previous:this.mainLastApiError}),this.onApiError?.(this.mainLastApiError)}_handleFallbackFetchError($,Z,X){if(B1.isAuthError(X))return;let J=O0(Z),G=this.fallbackErrorTokenFps.get($)===J?this.fallbackApiErrors.get($):void 0;this.fallbackApiErrors.set($,P$({error:X,now:this.now(),previous:G})),this.fallbackErrorTokenFps.set($,J)}}function P2($){return Boolean($.primary||$.secondary)}function u3($){let{primary:Z,secondary:X}=$;if(!Z&&!X)return!1;if(Z&&Z.usedPercent>=100)return!1;if(X&&X.usedPercent>=100)return!1;return!0}import{readFile as dG}from"node:fs/promises";var R1=i("refresh"),s3=i("accounts"),xG=1e4,kG=15000,d3=50;function Q1($){return $.type==="oauth"&&$.corrupt!==!0}function yG($){let Z=$?.trim();if(!Z)return!1;try{let X=new URL(Z);return(X.protocol==="http:"||X.protocol==="https:")&&!X.username&&!X.password}catch{return!1}}var X$="floors-v1";class i6 extends Error{code="ACCOUNT_REMOVED_DURING_REFRESH";constructor($){super(`Fallback account ${$} was removed before refresh`);this.name="AccountRemovedDuringRefreshError"}}var fG=[401,403,429],T2={primary:0,secondary:0},gG=!1,Y1={primary:5,secondary:10};function b($){return $!=null&&typeof $==="object"&&!Array.isArray($)}var hG=new Set(["__proto__","constructor","prototype"]);function r3($){return $.length>0&&!hG.has($)}function vG($){return $ instanceof i6||b($)&&$.name==="AccountRemovedDuringRefreshError"&&$.code==="ACCOUNT_REMOVED_DURING_REFRESH"}function s6($){return{id:typeof $.id==="string"&&$.id.trim()?$.id.trim():IG(),label:typeof $.label==="string"?$.label:void 0,enabled:typeof $.enabled==="boolean"?$.enabled:void 0,addedAt:typeof $.addedAt==="number"?$.addedAt:void 0,lastUsed:typeof $.lastUsed==="number"?$.lastUsed:void 0,accountId:typeof $.accountId==="string"?$.accountId:void 0}}function A2($){if(!b($))return;if(typeof $.message!=="string")return;let Z=Number($.checkedAt);if(!Number.isFinite(Z))return;let X=Number($.nextRetryAt),J=Number($.retryCount);return{message:$.message,checkedAt:Z,nextRetryAt:Number.isFinite(X)?X:void 0,retryCount:Number.isFinite(J)?J:void 0,tokenHash:typeof $.tokenHash==="string"?$.tokenHash:void 0}}function mG($){if(!b($))return;let Z={};for(let G of["primary","secondary"]){let z=$[G];if(!b(z))continue;let B=Number(z.usedPercent),Q=Number(z.remainingPercent),Y=Number(z.checkedAt);if(!Number.isFinite(B)||!Number.isFinite(Q)||!Number.isFinite(Y))continue;let H=typeof z.windowMinutes==="number"?z.windowMinutes:Number.NaN;Z[G]={usedPercent:B,remainingPercent:Q,checkedAt:Y,resetsAt:typeof z.resetsAt==="string"?z.resetsAt:void 0,...Number.isFinite(H)&&H>0?{windowMinutes:H}:{}}}for(let G of["resetCreditsAvailable","resetCreditsApplicable"]){let z=typeof $[G]==="number"?$[G]:Number.NaN;if(Number.isFinite(z)&&z>=0)Z[G]=z}let X=$.spendControl;if(b(X)){let G=Number(X.limit),z=Number(X.used),B=Number(X.remaining),Q=Number(X.usedPercent),Y=Number(X.remainingPercent);if(Number.isFinite(G)&&Number.isFinite(z)&&Number.isFinite(B)&&Number.isFinite(Q)&&Number.isFinite(Y)&&typeof X.reached==="boolean")Z.spendControl={limit:G,used:z,remaining:B,usedPercent:Q,remainingPercent:Y,resetsAt:typeof X.resetsAt==="string"?X.resetsAt:void 0,unit:typeof X.unit==="string"?X.unit:void 0,source:typeof X.source==="string"?X.source:void 0,reached:X.reached}}let J=$.credits;if(b(J)&&typeof J.hasCredits==="boolean"&&typeof J.unlimited==="boolean"&&typeof J.overageLimitReached==="boolean"){let G=Number(J.balance);Z.credits={hasCredits:J.hasCredits,unlimited:J.unlimited,overageLimitReached:J.overageLimitReached,...Number.isFinite(G)?{balance:G}:{}}}return Object.keys(Z).length?Z:void 0}function wG($){if(!b($))return null;if($.type==="api"){let Z=typeof $.baseURL==="string"?$.baseURL.trim():"",X=typeof $.apiKey==="string"?$.apiKey.trim():"";if(!yG(Z))return null;let J=$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer";return{...s6($),type:"api",apiKey:X||void 0,baseURL:Z,authHeader:J}}if($.type!=="oauth")return null;if($.corrupt===!0){if(typeof $.id!=="string"||!$.id.trim())return null;return{...s6($),type:"oauth",corrupt:!0}}if(typeof $.refresh!=="string"||!$.refresh.trim()){if(!Object.hasOwn($,"refresh")||typeof $.id!=="string"||!$.id.trim())return null;return{...s6($),type:"oauth",corrupt:!0}}return{...s6($),type:"oauth",access:typeof $.access==="string"?$.access:void 0,refresh:$.refresh,expires:typeof $.expires==="number"?$.expires:void 0,lastRefreshedAt:typeof $.lastRefreshedAt==="number"?$.lastRefreshedAt:void 0,lastRefreshError:A2($.lastRefreshError),lastQuotaRefreshError:A2($.lastQuotaRefreshError),quota:mG($.quota)}}function pG($){if(!b($))return;let Z=Object.create(null);for(let[X,J]of Object.entries($)){if(!r3(X)||!b(J))continue;let G={};if(b(J.inFlight))G.inFlight={...J.inFlight};if(b(J.lastOutcome)&&typeof J.lastOutcome.code==="string"&&J.lastOutcome.code.length>0&&typeof J.lastOutcome.at==="number"&&Number.isFinite(J.lastOutcome.at))G.lastOutcome={code:J.lastOutcome.code,at:J.lastOutcome.at,...b(J.lastOutcome.previousOutcome)&&typeof J.lastOutcome.previousOutcome.code==="string"&&J.lastOutcome.previousOutcome.code.length>0&&typeof J.lastOutcome.previousOutcome.at==="number"&&Number.isFinite(J.lastOutcome.previousOutcome.at)?{previousOutcome:{code:J.lastOutcome.previousOutcome.code,at:J.lastOutcome.previousOutcome.at}}:{}};if(typeof J.cooldownUntil==="number"&&Number.isFinite(J.cooldownUntil))G.cooldownUntil=J.cooldownUntil;if(Object.keys(G).length>0)Z[X]=G}return Object.keys(Z).length>0?Z:void 0}var S2=new Set;function uG($){if($.length===0)return;let Z=JSON.stringify([...$].sort());if(S2.has(Z))return;S2.add(Z),s3.warn("account load-dropped, preserved on disk",{droppedIds:$})}function lG($){if(!b($)||!Array.isArray($.accounts))return null;let Z=$.accounts,X=Z.map(wG).filter((J)=>J!=null);if(X.length<Z.length){let J=new Set;for(let B of Z)if(b(B)&&typeof B.id==="string"&&B.id.trim())J.add(B.id.trim());let G=new Set(X.map((B)=>B.id)),z=[];for(let B of J)if(!G.has(B))z.push(B);uG(z)}return{version:1,main:{type:"opencode",provider:"openai"},routing:b($.routing)?$.routing:void 0,fallbackOn:Array.isArray($.fallbackOn)?$.fallbackOn.filter((J)=>Number.isInteger(J)):void 0,refresh:b($.refresh)?$.refresh:void 0,quota:b($.quota)?$.quota:void 0,reset:pG($.reset),dump:b($.dump)?$.dump:void 0,costZeroing:b($.costZeroing)?$.costZeroing:void 0,killswitch:b($.killswitch)?$.killswitch:void 0,logging:b($.logging)?$.logging:void 0,cachekeep:b($.cachekeep)?$.cachekeep:void 0,cacheKeep:b($.cacheKeep)?$.cacheKeep:void 0,mainAccountId:typeof $.mainAccountId==="string"?$.mainAccountId:void 0,accounts:X}}async function a6($){try{return{exists:!0,value:JSON.parse(await dG($,"utf8"))}}catch(Z){if(Z.code==="ENOENT")return{exists:!1,value:null};throw Z}}function n6($){return Object.fromEntries(Object.entries($).filter(([,Z])=>Z!==void 0))}async function cG($){let Z;try{Z=(await a6($)).value}catch{return null}return Zz(Z)}function sG($,Z){if(!b($))return $;let X=b(Z)?Z:{},J=b(X.main)?X.main:void 0,G=b(X.accounts)?X.accounts:{},z=b($.quota)?$.quota:{},B=b($.refresh)?$.refresh:{},Q=J??z,Y=J??B,W=B.mainRefreshLeaseId!==void 0?{id:B.mainRefreshLeaseId,until:B.mainRefreshLeaseUntil,tokenHash:B.mainRefreshLeaseTokenHash}:{id:Y.refreshLeaseId,until:Y.refreshLeaseUntil,tokenHash:Y.refreshLeaseTokenHash},j=Array.isArray($.accounts)?$.accounts.map((K)=>{if(!b(K))return K;let V=typeof K.id==="string"&&b(G[K.id])?G[K.id]:{};return{...K,...V}}):void 0;return iG({...$,refresh:n6({...B,mainLastRefreshError:B.mainLastRefreshError??Y.lastRefreshError,mainRefreshLeaseId:W.id,mainRefreshLeaseUntil:W.until,mainRefreshLeaseTokenHash:W.tokenHash}),quota:n6({...z,mainQuota:Q.quota,mainQuotaCheckedAt:Q.quotaCheckedAt,mainQuotaToken:Q.quotaToken,mainLastQuotaApiError:Q.lastQuotaApiError}),accounts:j})}async function o3($){let Z=await a6($.configPath);if(!Z.exists)return null;let X=await a6($.statePath);return lG(sG(Z.value,X.value))}function iG($){return Object.fromEntries(Object.entries($).filter(([,Z])=>Z!==void 0))}function aG($){if($.type==="api")return n6({apiKey:$.apiKey,lastUsed:$.lastUsed});if($.corrupt)return{};return n6({access:$.access,refresh:$.refresh,expires:$.expires,lastUsed:$.lastUsed,lastRefreshedAt:$.lastRefreshedAt,lastRefreshError:$.lastRefreshError,lastQuotaRefreshError:$.lastQuotaRefreshError,quota:$.quota})}function r6($){return Math.max($?.primary?.checkedAt??0,$?.secondary?.checkedAt??0)}function y$($,Z,X){if(X in Z)$[X]=Z[X];else delete $[X]}function nG($,Z){return $.access===Z.access&&$.refresh===Z.refresh&&$.expires===Z.expires&&$.lastRefreshedAt===Z.lastRefreshedAt}function rG($,Z){if(!nG($,Z))return Z;if(!("lastRefreshError"in Z))return $;if(!("lastRefreshError"in $))return Z;return(Z.lastRefreshError?.checkedAt??0)>($.lastRefreshError?.checkedAt??0)?Z:$}var oG=300000;function R2($,Z){if($===void 0)return 0;return $>Z+oG?0:$}function tG($,Z,X){let J=Date.now(),G=R2(Z.lastRefreshedAt,J),z=R2(X.lastRefreshedAt,J),B=Z.expires??0,Q=X.expires??0,Y=z>G?X:G>z?Z:Q>B?X:B>Q?Z:rG(Z,X);y$($,Y,"access"),y$($,Y,"refresh"),y$($,Y,"expires"),y$($,Y,"lastRefreshedAt"),y$($,Y,"lastRefreshError")}function eG($,Z){if(!b($))return Z;let X=$,J=r6(X.quota),G=r6(Z.quota),z=J>G,B=z?{...X,...Z,quota:X.quota,lastQuotaRefreshError:X.lastQuotaRefreshError}:{...X,...Z};if(!z&&!("lastQuotaRefreshError"in Z))delete B.lastQuotaRefreshError;if(!("lastRefreshError"in Z))delete B.lastRefreshError;if(typeof X.lastUsed==="number"&&(typeof Z.lastUsed!=="number"||X.lastUsed>Z.lastUsed))B.lastUsed=X.lastUsed;return tG(B,X,Z),B}async function $z($,Z=!1){let X=Date.now(),J=X+kG,G=0;while(Date.now()<=J){G++;let Q=await e({name:"save",ttlMs:xG,path:$,renew:Z});if(Q)return Q;let Y=J-Date.now();if(Y<=0)break;await bG(Math.min(d3+f2(d3),Y))}let z=Date.now()-X,B=Math.round(z/Math.max(1,G));throw Error(`Timed out after ${z}ms waiting for the account store lock on ${$} (${G} attempts, ~${B}ms apart; retry interval is ${d3}ms). A gap near the retry interval means lock contention; a much larger one means this process's event loop was saturated and the wait expired without getting scheduled.`)}function Zz($){if(!b($)||!Array.isArray($.accounts))return null;let Z=new Set;for(let X of $.accounts){if(!b(X))continue;if(typeof X.id!=="string")continue;let J=X.id.trim();if(!J)continue;Z.add(J)}return Z}function Xz($,Z){$.main=$.main??{};let X=typeof $.main.quotaCheckedAt==="number"?$.main.quotaCheckedAt:r6($.main.quota),J=typeof Z.quota?.mainQuotaCheckedAt==="number"?Z.quota.mainQuotaCheckedAt:r6(Z.quota?.mainQuota);if(X>J)return;$.main.quota=Z.quota?.mainQuota,$.main.quotaCheckedAt=Z.quota?.mainQuotaCheckedAt,$.main.quotaToken=Z.quota?.mainQuotaToken,$.main.lastQuotaApiError=Z.quota?.mainLastQuotaApiError}function Jz($,Z){$.main=$.main??{},$.main.lastRefreshError=Z.refresh?.mainLastRefreshError,$.main.refreshLeaseId=Z.refresh?.mainRefreshLeaseId,$.main.refreshLeaseUntil=Z.refresh?.mainRefreshLeaseUntil,$.main.refreshLeaseTokenHash=Z.refresh?.mainRefreshLeaseTokenHash}function i3($){if(Array.isArray($))return $.map(i3);if(!b($))return $;return Object.fromEntries(Object.entries($).filter(([,Z])=>Z!==void 0).map(([Z,X])=>[Z,i3(X)]))}async function Gz($,Z,X={mainQuota:!0,mainRefresh:!0,accounts:!0},J){let G=Z.statePath,z=await $z(G);try{let B=(await a6(G)).value,Q=b(B)?{...B,version:1}:{version:1};if(X.mainQuota)Xz(Q,$);if(X.mainRefresh)Jz(Q,$);if(X.accounts){let Y=X.accounts===!0?null:new Set(X.accounts),H=await cG(Z.configPath);Q.accounts={...b(Q.accounts)?Q.accounts:{}};for(let W of $.accounts){if(Y&&!Y.has(W.id))continue;if(H&&!H.has(W.id))continue;Q.accounts[W.id]=eG(Q.accounts[W.id],aG(W))}if(Y){for(let W of Y)if(!$.accounts.some((U)=>U.id===W))delete Q.accounts[W]}if(H){for(let W of Object.keys(Q.accounts))if(!H.has(W))delete Q.accounts[W]}}if(J&&!J())return;await L0(G,i3(Q))}finally{await z.release()}}function k2($){return $?.fallbackOn?.length?$.fallbackOn:fG}function zz($){let Z=$?.quota?.minimumRemaining||{};return{primary:Z.primary??Z["5h"]??T2.primary,secondary:Z.secondary??Z["1w"]??T2.secondary}}function a3($){return $?.quota?.enabled!==!1}function g$($){return $?.quota?.failClosedOnUnknownQuota??gG}function o6($,Z,X=Date.now()){if(!a3(Z))return!0;if(!$)return!g$(Z);let J=zz(Z),G=g$(Z);for(let z of["primary","secondary"]){let B=$[z];if(!B)continue;if(l3(B,X)){if(G)return!1;continue}if(B.remainingPercent<J[z])return!1}return!0}function t3($){return $?.killswitch?.enabled===!0}function E2($){return{primary:$?.primary??$?.["5h"]??Y1.primary,secondary:$?.secondary??$?.["1w"]??Y1.secondary}}function I2($){return typeof $==="number"&&Number.isFinite($)?$:0}function H1($,Z){if(!$?.killswitch)return Y1;if($.killswitch.schema===X$){let{accounts:X,defaults:J}=$.killswitch,G=Z??"main",z=b(X)&&Object.hasOwn(X,G)&&b(X[G])?X[G]:b(J)?J:void 0;return{primary:I2(z?.primary),secondary:I2(z?.secondary)}}if(Z&&$.killswitch.accounts?.[Z])return E2($.killswitch.accounts[Z]);return E2($.killswitch.main)}function y2($,Z,X,J=Date.now()){if(!t3(Z))return!0;if(!$)return!g$(Z);let G=H1(Z,X),z=g$(Z);for(let B of["primary","secondary"]){let Q=$[B];if(!Q)continue;if(l3(Q,J)){if(z)return!1;continue}if(Q.remainingPercent<G[B])return!1}return!0}function Bz($){return $?.refresh?.enabled!==!1}function e3($){return($?.refresh?.refreshBeforeExpiryMinutes??240)*60000}function f2($){return Math.floor(Math.random()*($+1))}function E1($,Z,X){return!$.access||!$.expires||$.expires-X<=e3(Z)}function Qz($,Z){return Boolean($.access&&typeof $.expires==="number"&&$.expires>Z)}function Z$($,Z){return Boolean($?.mainAccountId&&Z.accountId&&Z.accountId===$.mainAccountId)}class g2 extends Error{constructor($){super(`Refusing to refresh account ${$}: it holds the main account's credential while the main slot is live`);this.name="ShieldedMainRowRefreshError"}}function j0($,Z){let X=$.accounts.findIndex((J)=>J.id===Z.id);if(X!==-1)$.accounts[X]=Z}function f$($){return $ instanceof Error?$.message:String($)}function n3($,Z,X){if(Z instanceof x$)return;$.lastRefreshError=E6({error:Z,now:X,refreshToken:$.refresh,previous:$.lastRefreshError})}function c3($,Z,X){if(Z instanceof x$)return;if($.lastQuotaRefreshError=P$({error:Z,now:X,previous:$.lastQuotaRefreshError}),Z?.isRefreshError===!0)n3($,Z,X)}function b2($,Z){if(!$)return!1;if(!$.resetsAt)return!0;let X=Date.parse($.resetsAt);return Number.isFinite(X)?X>Z:!0}function Yz($,Z){if(!$)return!1;return b2($.primary,Z)||b2($.secondary,Z)}function Hz($,Z,X){if(!$)return!1;let J=Z?.quota?.checkIntervalMinutes??5,G=Math.max(1,J)*60000,z=Math.max($.primary?.checkedAt??0,$.secondary?.checkedAt??0);return X-z<G}function x2($,Z,X){return!Hz($.quota,Z,X)}function Wz($,Z,X,J){return W3(X)&&o6($.quota,Z,J)&&Yz($.quota,J)}function Vz($){let Z=$?.quota?.checkIntervalMinutes??5;return Math.max(1,Z)*60000}var Uz=60000,jz=60000,Dz=600000;function Kz($){return`fallback-oauth-refresh-${EG("sha256").update($).digest("base64url").slice(0,16)}`}var qz=1e4,Nz=100;class Mz{now;fetchImpl;paths;refreshPromises=new Map;refreshTimer=null;quotaTimer=null;quotaManager;onFallbackStorageChanged;options;constructor($){this.options=$,this.now=$.now??Date.now,this.fetchImpl=$.fetchImpl??fetch,this.paths=$.paths,this.quotaManager=$.quotaManager??null,this.onFallbackStorageChanged=$.onFallbackStorageChanged}assertNotTombstoned($){if($)c6($.refresh)}seedFallbackQuota($,Z){if(!this.quotaManager)return;if(!$.quota)return;let X=Math.max($.quota.primary?.checkedAt??0,$.quota.secondary?.checkedAt??0);if(X<=0)return;let J=this.quotaManager.getFallback($.id,$.access);if(J&&J.checkedAt>=X)return;this.quotaManager.setFallback($.id,{quota:$.quota,refreshAfter:X+Vz(Z),checkedAt:X},$.access,!1,$.accountId)}async load(){return o3(this.paths)}selectionBookkeeping=Promise.resolve();selectionBookkeepingSettled(){return this.selectionBookkeeping}async save($,Z){await Gz($,this.paths,{accounts:Z??!0},this.options.canWrite)}startBackgroundRefresh(){let $=async()=>{if(await this.options.backgroundRefreshPaused?.())return;if(await this.refreshDueAccounts(),this.options.fetchQuotaFn)await this.refreshQuotaForDueAccounts()};if($().catch(()=>{}),!this.refreshTimer){if(this.refreshTimer=setInterval(()=>{$().catch(()=>{})},Uz+f2(jz)),"unref"in this.refreshTimer)this.refreshTimer.unref()}}stopBackgroundRefresh(){if(this.refreshTimer)clearInterval(this.refreshTimer);if(this.quotaTimer)clearInterval(this.quotaTimer);this.refreshTimer=null,this.quotaTimer=null}async getUsableFallbackAccounts($){let Z=$!==void 0?$:await this.load();if(!Z)return[];let X=[],J=!1;for(let G of Z.accounts){if(G.enabled===!1||!Q1(G))continue;if(Z$(Z,G))continue;if(k0(G))continue;let z=!1,B=G;try{if(E1(B,Z,this.now())){let Q=B.lastRefreshError;if(Q&&Z1(Q,B.refresh,this.now()))throw z=!0,Error(C$(Q,this.now()));try{B=await this.refreshAccount(B,Z),J=!0}catch(Y){if(vG(Y))continue;z=!0;let H=Z.accounts.find((W)=>W.id===G.id&&Q1(W));if(H&&!Z1(H.lastRefreshError,H.refresh,this.now()))n3(H,Y,this.now()),j0(Z,H),J=!0;throw Y}}if(this.seedFallbackQuota(B,Z),this.accountPassesQuotaPolicy(this.quotaPolicyAccount(B),Z))X.push(B)}catch(Q){let Y=Qz(B,this.now());if(z){if(!Y)continue}else if(!Y)continue;if(Wz(B,Z,Q,this.now()))R1.debug("fallback quota using cached quota after refresh error",{pid:process.pid,accountId:B.id,error:f$(Q)}),X.push(B);else if(!g$(Z))X.push(B)}}if(J){let G=structuredClone(Z);this.selectionBookkeeping=this.selectionBookkeeping.then(()=>this.save(G)).catch((z)=>{s3.warn("fallback selection bookkeeping not persisted",{pid:process.pid,error:f$(z)})})}return X}async markUsed($){try{let Z=await this.load();if(!Z)return;let X=Z.accounts.find((J)=>J.id===$.id);if(!X)return;X.lastUsed=this.now(),await this.save(Z,[X.id])}catch(Z){s3.warn("lastUsed stamp not persisted",{pid:process.pid,accountId:$.id,error:f$(Z)})}}accountPassesQuotaPolicy($,Z){return o6($.quota,Z,this.now())}quotaPolicyAccount($){if(!this.quotaManager)return $;let Z=this.quotaManager.getFallback($.id,$.access)?.quota;return Z?{...$,quota:Z}:$}async refreshDueAccounts(){let $=await this.load();if(!$||!Bz($))return;let Z=!1;for(let X of $.accounts){if(X.enabled===!1||!Q1(X))continue;if(Z$($,X))continue;if(k0(X))continue;if(!E1(X,$,this.now()))continue;if(Z1(X.lastRefreshError,X.refresh,this.now()))continue;try{R1.debug("fallback oauth background due",{pid:process.pid,accountId:X.id,expiresInMs:X.expires?X.expires-this.now():void 0}),await this.refreshAccount(X,$),Z=!0}catch(J){R1.warn("fallback oauth background failed",{pid:process.pid,accountId:X.id,error:f$(J)}),n3(X,J,this.now()),j0($,X),Z=!0}}if(Z)await this.save($)}async refreshQuotaForDueAccounts(){let $=await this.load();if(!$||!a3($))return;if(!this.options.fetchQuotaFn)return;let Z=!1;for(let X of $.accounts){if(X.enabled===!1||!Q1(X))continue;if(Z$($,X))continue;if(k0(X))continue;let J=X;try{if(E1(J,$,this.now())){if(Z1(J.lastRefreshError,J.refresh,this.now()))continue;J=await this.refreshAccount(J,$),Z=!0}if(a1(J.lastQuotaRefreshError,this.now()))continue;if(this.seedFallbackQuota(J,$),!(this.quotaManager?this.quotaManager.isFallbackStale(J.id,J.access):x2(J,$,this.now())))continue;await this.refreshAccountQuota(J,$),Z=!0}catch(G){c3(X,G,this.now()),j0($,X),Z=!0}}if(Z)await this.save($),this.onFallbackStorageChanged?.()}async refreshQuotaForAllAccounts($={}){let Z=await this.load(),X=[];if(!Z||!a3(Z))return{storage:Z,errors:X};if(!this.options.fetchQuotaFn)return{storage:Z,errors:X};let J=$.force??!1,G=!1;for(let z of Z.accounts){if(z.enabled===!1||!Q1(z))continue;if(Z$(Z,z))continue;if(k0(z))continue;let B=z;try{if(E1(B,Z,this.now())){let Q=B.lastRefreshError;if(Q&&Z1(Q,B.refresh,this.now()))throw Error(C$(Q,this.now()));B=await this.refreshAccount(B,Z),G=!0}if(!J&&!x2(B,Z,this.now())){if(B.lastQuotaRefreshError)B.lastQuotaRefreshError=void 0,j0(Z,B),G=!0;continue}await this.refreshAccountQuota(B,Z),G=!0}catch(Q){c3(z,Q,this.now()),j0(Z,z),G=!0,X.push({accountId:z.id,message:f$(Q)})}}if(G)await this.save(Z);return{storage:Z,errors:X}}async refreshAccount($,Z,X={}){let J=this.refreshPromises.get($.id);if(J){let B=await J;return j0(Z,B),B}let G=this.refreshAccountNow($,Z,X).finally(()=>{this.refreshPromises.delete($.id)});this.refreshPromises.set($.id,G);let z=await G;return j0(Z,z),z}async waitForConcurrentFallbackRefresh($,Z,X,J){let G=Date.now()+qz;while(Date.now()<G){await new Promise((H)=>setTimeout(H,Nz));let z=await this.load(),B=z?.accounts.find((H)=>H.id===$.id&&Q1(H));if(!B)continue;if(this.assertNotTombstoned(B),(B.access!==X.access||B.refresh!==X.refresh||(B.expires??0)>(X.expires??0)+60000)&&(J.force||!E1(B,z,this.now())))return j0(Z,B),R1.debug("fallback oauth joined concurrent refresh",{pid:process.pid,accountId:B.id,expiresInMs:B.expires?B.expires-this.now():void 0}),B;let Y=B.lastRefreshError;if(Y&&Z1(Y,B.refresh,this.now()))throw j0(Z,B),Error(C$(Y,this.now()))}return null}assertNotShieldedMainRow($,Z,X){if(X.asPoolMain||!Z)return;if(Z$($,Z))throw new g2(Z.id)}async refreshAccountNow($,Z,X){let J=await this.load(),G=J?.accounts.find((Q)=>Q.id===$.id&&Q1(Q));if(this.assertNotTombstoned(G),this.assertNotShieldedMainRow(J,G,X),G&&!X.force&&!E1(G,J,this.now()))return j0(Z,G),G;let z=G??$,B=await e({name:Kz(z.id),ttlMs:Dz,path:this.paths.configPath,now:this.now,renew:!0});if(!B){R1.debug("fallback oauth refresh skipped file lock",{pid:process.pid,accountId:z.id});let Q=await this.waitForConcurrentFallbackRefresh($,Z,z,X);if(Q)return Q;throw Error("Fallback OAuth refresh is already in progress")}try{if(J=await this.load(),G=J?.accounts.find((W)=>W.id===$.id&&Q1(W)),this.assertNotTombstoned(G),this.assertNotShieldedMainRow(J,G,X),G&&!X.force&&!E1(G,J,this.now()))return j0(Z,G),G;if(!G)throw new i6($.id);z=G;let Q=this.options.refreshFn??(async()=>{throw Error("No refreshFn injected into FallbackAccountManager")});R1.debug("fallback oauth refresh request start",{pid:process.pid,accountId:z.id,force:X.force===!0,expiresInMs:z.expires?z.expires-this.now():void 0});let Y=await Q({refreshToken:z.refresh,fetchImpl:this.fetchImpl,now:this.now});if(z.access=Y.access,z.refresh=Y.refresh,z.expires=Y.expires,z.lastRefreshedAt=Y.expires-Y.expiresIn*1000,z.lastRefreshError=void 0,j0(Z,z),await this.save(Z),!(await this.load())?.accounts.some((W)=>W.id===$.id))throw new i6($.id);return R1.debug("fallback oauth refresh succeeded",{pid:process.pid,accountId:z.id,expiresInMs:z.expires?z.expires-this.now():void 0}),z}finally{await B.release()}}async refreshAccountQuota($,Z){let X=$;if(this.assertNotTombstoned(X),!X.access)throw Error(`Fallback account ${$.id} has no access token`);if(!this.options.fetchQuotaFn)throw Error("No fetchQuotaFn injected — wham/usage supplement is disabled");let J=this.options.fetchQuotaFn??(async()=>{throw Error("No fetchQuotaFn injected — wham/usage supplement is disabled")}),G=(z)=>this.quotaManager?this.quotaManager.refreshFallback(X.id,z):J({accessToken:z,fetchImpl:this.fetchImpl,now:this.now});try{if(!X.access)throw Error(`Fallback account ${$.id} has no access token`);let z=await G(X.access);X.quota=z,X.lastQuotaRefreshError=void 0,j0(Z,X),await this.save(Z)}catch(z){throw c3($,z,this.now()),j0(Z,$),z}}}var h2="/backend-api/wham/rate-limit-reset-credits",TU=`https://chatgpt.com${h2}`,Fz=`${h2}/consume`,AU=`https://chatgpt.com${Fz}`;function Z0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}import{statSync as Cz}from"node:fs";import{rm as u2}from"node:fs/promises";import{dirname as Pz,join as l2}from"node:path";import{resolveClaustrumConnectionPath as Tz}from"@cortexkit/claustrum-client";function v2($,Z){if(!$)return;let X=$.rawUsedPercent??$.usedPercent;if(!Number.isFinite(X)||X<0||X>100)return;return{usedPercent:X,remainingPercent:100-X,checkedAt:Z,...typeof $.resetsAt==="string"&&{resetsAt:$.resetsAt},...typeof $.windowMinutes==="number"&&Number.isFinite($.windowMinutes)&&$.windowMinutes>0&&{windowMinutes:$.windowMinutes}}}function m2($){if(!Z0($)||typeof $.minor!=="number"||!Number.isSafeInteger($.minor)||typeof $.exponent!=="number"||!Number.isInteger($.exponent))return;let Z=$.minor/10**$.exponent;return Number.isFinite(Z)?Z:void 0}function Lz($){let Z=m2($.total),X=m2($.remaining);if(Z===void 0||X===void 0||Z<0||X<0)return;let J=Z-X,G=$.spendable===!1,z=Z>0?J/Z*100:G?100:0;return{limit:Z,used:J,remaining:X,usedPercent:z,remainingPercent:100-z,reached:G,...typeof $.resetsAt==="string"&&{resetsAt:$.resetsAt},...Z0($.total)&&typeof $.total.unit==="string"&&{unit:$.total.unit}}}function w2($,Z){let X=v2($.usage?.primary,Z.fetchedAt);if(!X||!Number.isFinite(Z.fetchedAt))return;let J=v2($.usage?.secondary,Z.fetchedAt),G=Array.isArray($.spend)?$.spend.find((Q)=>Z0(Q)&&Q.id==="individual_limit"):void 0,z=Z0(G)?Lz(G):void 0,B=Z0($.savedResets)?$.savedResets.availableCount:void 0;return{primary:X,...J&&{secondary:J},...typeof B==="number"&&Number.isFinite(B)&&B>=0&&{resetCreditsAvailable:B},...z&&{spendControl:z},...!G&&{spendControlCleared:!0}}}var p2=["primary","secondary"];function $8($){return $!=null&&typeof $==="object"&&!Array.isArray($)}function h$($){return typeof $==="number"&&Number.isFinite($)}function _z($,Z){if(!$8(Z))return;let X=Z.usedPercent;if(!h$(X)||X<0||X>100)return;return{label:$,usedPercent:X,...typeof Z.resetsAt==="string"?{resetsAt:Z.resetsAt}:{},...h$(Z.windowMinutes)&&Z.windowMinutes>0?{windowMinutes:Z.windowMinutes}:{}}}function Oz($){let Z=$.spendControl;if($8(Z)&&typeof Z.reached==="boolean"){let X=(J)=>h$(Z[J])?{[J]:Z[J]}:{};return{kind:"reading",reached:Z.reached,...X("remainingPercent"),...X("usedPercent"),...X("limit"),...X("used"),...X("remaining"),...typeof Z.resetsAt==="string"?{resetsAt:Z.resetsAt}:{},...typeof Z.unit==="string"?{unit:Z.unit}:{}}}if($.spendControlCleared===!0)return{kind:"cleared"};return}function R0($,Z,X){if(!$8($)||!h$(Z))return;let J=[],G=[];for(let Y of p2){let H=_z(Y,$[Y]);if(H)J.push(H);else if(X)G.push({label:Y})}let z=Oz($),B=$.resetCreditsAvailable,Q=typeof B==="number"&&Number.isSafeInteger(B)&&B>=0?{resetCredits:{value:B,checkedAt:Z}}:void 0;if(J.length===0&&G.length===0&&!z&&!Q)return;return{checkedAt:Z,...J.length>0?{readings:J}:{},...G.length>0?{coverage:G}:{},...z?{budget:z}:{},...Q?{counters:Q}:{}}}function J$($){if(!B0($))return;let Z=c($),X={};for(let J of p2){let G=Z.limits.find((B)=>B.label===J&&B.kind==="reading");if(!G||!h$(G.usedPercent))continue;let z={usedPercent:G.usedPercent,remainingPercent:100-G.usedPercent,checkedAt:G.checkedAt,...G.resetsAt!==void 0?{resetsAt:G.resetsAt}:{},...G.windowMinutes!==void 0?{windowMinutes:G.windowMinutes}:{}};X[J]=z}return X.primary||X.secondary?X:void 0}var y0=i("vault"),Az="openai-auth",d2={refreshAdapter:"openai",category:"openai-native",apiKeys:!1},Sz={opencode:"OpenCode",pi:"Pi"};function Rz($){return C3(Az,$)}function t6($){return l2(Pz($),"openai-auth-vault")}function Ez($,Z){return{...T3({stateDir:$,host:Z}),rosterPath:l2($,`${Z}-roster.json`)}}var e6=2000,c2={"vault-unreachable":"Request refused locally: this host is connected to the credential vault, which could not be reached, and local accounts are not used while it is connected. Start the vault and connect accounts in it, or disconnect this host from the vault.","vault-empty":"Request refused locally: this host is connected to the credential vault, which serves it no usable OpenAI account, and local accounts are not used while it is connected. Connect accounts in the vault, or disconnect this host from the vault.","vault-refused":"Request refused locally: the credential vault did not authorize an account, and local accounts are not used while this host is connected to it. Check the accounts in the vault, or disconnect this host from the vault."};function s2($){return $.snapshot()===void 0?"vault-unreachable":"vault-empty"}function Iz($){let Z=n1($);return Z?r1(Z):void 0}class Z8{host;name;paths;#$;#Z;#z=new Map;#J=new Map;#W=new Map;#Q;#X;#B;#V;#Y=!1;#G=!1;#U=Promise.withResolvers();#H;#D="unknown";#K;constructor($){this.#$=$,this.host=$.host,this.name=Rz($.host),this.paths=Ez($.stateDir,$.host),this.#Z=new d6({rosterPath:this.paths.rosterPath,tokenPath:this.paths.tokenPath,family:d2,connect:()=>this.#_(),isCustodyActive:()=>this.enrolled(),...$.reservedRouteIds?{reservedRouteIds:$.reservedRouteIds}:{},parseIdentity:Iz,insula:{provider:"codex",normalize:w2},...$.now?{now:$.now}:{},onRoster:()=>{this.#X=void 0},onError:(Z)=>this.#j("vault roster refresh failed",Z),logger:y0})}#F(){return(this.#$.connectionFile??Tz)()}#L(){return{connectionFile:this.#F(),projectRoot:this.#$.projectRoot??process.cwd(),storagePath:this.paths.tokenPath,logger:($)=>y0.debug("vault transport error",{errorClass:$})}}#_(){return(this.#$.connectScoped?.()??L2(this.#L())).then(($)=>{return this.#Q=$.insula!==void 0,$})}#q($,Z,X){if(this.#W.get($)===Z)return;this.#W.set($,Z),y0.info("vault background quota source changed",{routeId:$,source:Z,reason:X})}#O(){return this.#$.connectEnrollment?.()??P3(this.#L())}#j($,Z){this.#X=c0(Z),y0.warn($,{host:this.host,error:this.#X})}#N(){return[this.paths.tokenPath,this.paths.statePath].map(($)=>{try{let Z=Cz($);return`${Z.ino}:${Z.size}:${Z.mtimeMs}:${Z.ctimeMs}`}catch{return"?"}}).join("|")}async authority(){let $=this.#N(),Z=await S3(this.paths,this.name);if($===this.#N())return this.#D=Z,this.#K=$,Z;return"unreadable"}enrolled(){return this.#K!==this.#N()||this.#D!=="local"}start(){if(this.#Y||this.#G)return;this.#Y=!0;let $=async()=>{try{await this.authority(),await this.#M(),await this.#Z.refreshInsulaQuota()}catch(X){if(!this.#G)this.#j("vault roster refresh failed",X)}if(this.#G)return;let Z=this.#$.pollIntervalMs??5000;if(Z<=0)return;this.#H=setTimeout(()=>{this.#H=void 0,$()},Z),this.#H.unref?.()};$()}#M(){return this.#V??=this.#Z.refresh().finally(()=>{this.#V=void 0,this.#U.resolve()}),this.#V}firstRoster(){return this.#U.promise}async awaitRequestRoster(){if(this.snapshot())return;if(await this.authority()!=="vault")return;let $=this.#V;if($)await $.catch(()=>{return});if(this.snapshot()||await this.authority()!=="vault")return;await(this.#V??this.#M()).catch((X)=>{this.#j("vault roster refresh failed",X)})}async refresh(){try{await this.authority();let $=this.#V;if($)await $.catch(()=>{return});let Z=await this.#M();return this.#X=void 0,Z}catch($){return this.#j("vault roster refresh failed",$),this.#Z.snapshot()}}snapshot(){return this.#Z.snapshot()}serves(){return this.enrolled()&&(this.snapshot()?.rows.length??0)>0}identities(){if(!this.enrolled())return new Set;return new Set((this.snapshot()?.rows??[]).flatMap(($)=>$.accountIdentity!==void 0?[$.accountIdentity]:[]))}routes(){if(!this.enrolled())return[];let $=new Map((this.snapshot()?.rows??[]).map((Z)=>[Z.routeId,Z]));return this.#Z.routingRows().map((Z)=>{let X=$.get(Z.id)?.accountIdentity;return{id:Z.id,kind:Z.kind==="api-key"?"api-key":"oauth",...X!==void 0?{identity:X}:{},...Z.quota!==void 0?{quota:Z.quota}:{}}})}owns($){return(this.snapshot()?.rows??[]).some((Z)=>Z.routeId===$)}async send($,Z,X){let J=!1;try{return await this.#Z.send($,(G)=>{return J=!0,Z(G.accessToken,G)},{site:X.site,...X.signal?{signal:X.signal}:{}})}catch(G){if(J)throw G;this.#j("vault refused to serve an account",G);return}}async authorize($,Z={}){try{return await this.#Z.authorize($,Z.signal)}catch(X){this.#j("vault refused to serve an account",X);return}}async reportFailure($,Z){if(Z!==401)return;try{await this.#Z.reportFailure($,401,"direct")}catch(X){this.#j("vault failure report failed",X)}await this.refresh()}recordSnapshot($,Z,X,J){let G=R0(Z,(this.#$.now??Date.now)(),X);if(!G)return Promise.resolve();return this.#Z.recordQuota($,G,J).then(()=>{},(z)=>this.#j("vault quota write failed",z))}pollQuota($,Z=!0){let X=this.#J.get($);if(X)return X;let J=this.#C($,Z).finally(()=>{this.#J.delete($)});return this.#J.set($,J),J}async#C($,Z){if(Z){await this.authority(),await this.#Z.refreshInsulaQuota();let z=(await _0(this.paths.rosterPath))?.rows.find((Q)=>Q.routeId===$),B=await this.#Z.cachedInsulaQuotaForRoute($);if(B!==void 0&&z?.accountIdentity){let Q=R0(B,B.primary.checkedAt,!0);if(!Q)return this.#q($,"fallback","insula-unusable"),{ok:!1,error:"unusable insula reading"};if(await this.#Z.recordAccountQuota($,z.accountIdentity,Q))return this.#q($,"insula",null),{ok:!0};return this.#q($,"fallback","account-changed"),{ok:!1,error:"vault account changed"}}this.#q($,"fallback",this.#Q===!1?"insula-not-configured":"no-insula-reading")}let X,J=this.#$.fetchImpl?.()??globalThis.fetch,G=await this.send($,async(z,B)=>{try{let Q=Z?void 0:await this.#Z.cachedInsulaQuota(B);if(Q!==void 0){let H=R0(Q,Q.primary.checkedAt,!0);if(!H)throw Error("unusable insula reading");return await this.#Z.recordQuota($,H,B),new Response(null,{status:200})}let Y=await $$({accessToken:z,fetchImpl:J,now:this.#$.now??Date.now,...B.accountIdentity?{accountId:B.accountIdentity}:{},accountKey:$,logger:y0});return await this.recordSnapshot($,Y,!0,B),X=void 0,new Response(null,{status:200})}catch(Q){X=c0(Q);let Y=Q?.status;if(typeof Y==="number")return new Response(null,{status:Y});throw Q}},{site:"quota"}).catch((z)=>{X=c0(z);return});if(!G)return{ok:!1,error:X??"vault refused"};return G.ok?{ok:!0}:{ok:!1,error:X??`status ${G.status}`}}requestReading($){let Z=this.#z.get($);if(Z)return Z;let X=this.pollQuota($,!1).catch((J)=>{y0.warn("vault quota poll failed",{routeId:$,error:c0(J)})}).finally(()=>{this.#z.delete($)});return this.#z.set($,X),X}async pollStale($){let Z=(this.#$.now??Date.now)(),X=[];for(let J of this.routes()){let G=bz(J.quota);if(G!==void 0&&Z-G<$)continue;X.push({id:J.id,...await this.pollQuota(J.id)})}return X}async decline($){await this.#Z.decline($),y0.info("vault account declined",{routeId:$})}async accept($){await this.#Z.accept($),y0.info("vault account accepted",{routeId:$})}async status(){await this.authority();let $;try{$=await E$(this.paths,this.name)}catch(Z){this.#j("vault enrollment state unreadable",Z),$={state:"blocked",proposedName:this.name,code:Z instanceof S?Z.kind:"unreadable-state"}}return{host:this.host,name:this.name,enrollment:$,accounts:this.enrolled()?this.snapshot()?.rows??[]:[],...this.#X?{lastError:this.#X}:{}}}async connectStep(){let $=await this.#O().catch((Z)=>{throw new W0("vault-unreachable",`Could not reach the Claustrum vault (${this.#F()}): ${c0(Z)}. Is the vault running?`)});try{let Z=new w6({client:$,paths:this.paths,proposedName:this.name,...this.#$.now?{now:this.#$.now}:{}}),X=await Z.status();if(X.state==="denied"||X.state==="blocked")await Z.resetTerminal();let J=await Z.reconcile();if(y0.info("vault enrollment step",{host:this.host,state:J.state}),J.state==="approved")this.#X=void 0,await this.refresh();return J}finally{$.close()}}waitForApproval($={}){return this.#B??=(async()=>{let Z=$.sleep??((z)=>new Promise((B)=>setTimeout(B,z))),X=$.pollIntervalMs??2000,J=Date.now()+($.timeoutMs??600000),G=await this.connectStep();while(G.state==="pending"||G.state==="busy"){if($.onPending?.(G),Date.now()>=J)return G;await Z(X),G=await this.connectStep()}return G})().finally(()=>{this.#B=void 0}),this.#B}async disconnect(){await u2(this.paths.tokenPath,{force:!0}),await u2(this.paths.statePath,{force:!0}),await this.authority(),this.#X=void 0,y0.info("vault enrollment forgotten",{host:this.host})}assertHostSlot($){if(this.serves())E3({mode:"custody",auth:$,provider:"openai"})}close(){if(this.#G=!0,this.#U.resolve(),this.#H)clearTimeout(this.#H);this.#H=void 0,this.#Z.close()}}function bz($){if(!$)return;let Z=c($).limits.map((X)=>X.checkedAt);return Z.length>0?Math.max(...Z):void 0}function $Z($,Z){if(Z.state!=="pending")return[];if(!Z.requestId)return[`The vault did not take the enrollment request yet${Z.retryCode?` (${Z.retryCode})`:""}. Run Connect again in a moment.`];return[`Enrollment request ${Z.requestId} for ${$} is waiting for approval. Approve it with:`,`  ck auth enroll approve --request-id ${Z.requestId}`,"and let it read your OpenAI accounts with:",`  ck auth grant --principal enrolled:${$} --selector-kind category --selector ${d2.category} --operation read`]}function i2($,Z,X){let J=`${Sz[$]} (${Z})`;switch(X.state){case"approved":return`${J}: connected to the Claustrum vault.`;case"idle":return`${J}: not connected to the Claustrum vault.`;case"pending":return X.requestId?`${J}: waiting for approval of request ${X.requestId}.`:`${J}: enrollment request not taken yet${X.retryCode?` (${X.retryCode})`:""}.`;case"denied":return`${J}: the vault denied the enrollment request.`;case"blocked":return`${J}: enrollment stopped (${X.code}).`;case"unavailable":return`${J}: the vault is unavailable (${X.code}).`;case"busy":return`${J}: another process is enrolling right now.`}}function X8($,Z){switch(Z.state){case"approved":{let X=$.snapshot()?.rows.length??0;return{ok:!0,text:`Connected: the vault approved ${$.name}. It serves ${X} OpenAI account${X===1?"":"s"} to this host${X===0?" (grant it the openai-native category with `ck auth grant` to add some)":""}.`}}case"denied":return{ok:!1,text:"The vault denied the enrollment request. Run Connect again to send a new one."};case"blocked":return{ok:!1,text:`Enrollment stopped (${Z.code}). Run Connect again to send a new request.`};case"pending":case"busy":return{ok:!1,text:[...$Z($.name,Z),"Still waiting. The request stays open: run Connect again after approving it."].join(`
+`)};default:return{ok:!1,text:`Enrollment is ${Z.state}.`}}}var a2=`${String.fromCharCode(27)}\\[[0-9;]*m`,nU=new RegExp(a2,"g"),rU=new RegExp(`^${a2}`);function G$($){return $.authority!=="local"}async function s0($){return{authority:await $.authority(),status:await $.status(),identities:$.identities(),routes:new Set($.routes().map((Z)=>Z.id))}}async function o2($){let Z;try{return await Promise.race([Promise.resolve().then(()=>$.refresh()).then(()=>{return},(X)=>X instanceof Error?X.message:String(X)),new Promise((X)=>{Z=setTimeout(()=>X("Vault roster refresh did not finish within the roster wait budget."),e6)})])}finally{clearTimeout(Z)}}function W1($){return $.email||$.label||$.routeId}var G8="Accounts are managed in the vault with ck. Disconnect to use local accounts.",z8="Nothing was changed: accounts are managed in the vault with ck. Disconnect to use local accounts.";function t2($){return Z0($)?{...$}:{}}function ZZ($,Z,X,J){let G=X.confirm?.irreversible?{irreversible:!0,confirm:X.confirm.message}:{...X.confirm?{confirm:X.confirm.message}:{}};return{id:X.id,label:X.label,...X.description?{description:X.description}:{},...X.group?{group:X.group}:{},knobs:X.knobs,...G,run:async({values:z,invocation:B})=>{let Q=await $.apply({command:$.command,sectionId:Z,...J?{itemId:J}:{},actionId:X.id,values:z,confirmed:!0},B);return{ok:Q.ok,text:Q.text,...Q.code?{code:Q.code}:{}}}}}function B8($,Z){return new Proxy($,{get(X,J){if(J==="read")return async()=>{let z=await X.read();if(z.status!=="ready")return z;let B={...z,rows:z.rows.map((H)=>({...H,label:H.label??H.id}))};if(!Z)return B;let Q=await s0(Z);if(!G$(Q))return B;let Y=[...Q.status.accounts.map((H)=>({id:H.routeId,label:W1(H),type:"oauth",enabled:H.enabled,identity:H.accountIdentity,quota:H.quota,hasEntry:!1,needsFirstReading:!1,candidate:!1}))];return{...z,rows:Y}};if(J==="readSettings")return async()=>{let z=await X.readSettings();if(z.status==="error"||!Z)return z;let B=await s0(Z),Q=t2(z.settings.killswitch);if(!G$(B)||!z.settings.killswitch)return z;let Y=t2(Q.accounts);for(let H of B.status.accounts)Y[H.routeId]=H1({version:1,accounts:[],...z.settings},H.routeId);return{...z,settings:{...z.settings,killswitch:{...Q,accounts:Y}}}};let G=Reflect.get(X,J);return typeof G==="function"?G.bind(X):G}})}function e2($,Z){let X=_1($),J=_1({command:$.command,title:$.title,store:B8($.store,Z),accounts:$.accounts,quota:$.quota,limits:$.limits,routing:$.routing,...$.extraLocks?{extraLocks:$.extraLocks}:{},...$.now?{now:$.now}:{}}),G=async(Y,H)=>{let W=await s0(Z),U=G$(W),j=U?J:X,V=(await j.open(H)).menu.sections.find((F)=>F.id===Y);if(!V)throw new W0("unavailable","The account menu is unavailable.");if(!U)return{lines:V.lines,items:V.items.map((F)=>({...F,actions:F.actions.map((D)=>ZZ(j,Y,D,F.id))})),actions:V.actions.map((F)=>ZZ(j,Y,F))};let N=new Map(W.status.accounts.map((F)=>[F.routeId,F])),q=($.now??Date.now)(),M=(F)=>({id:"check",label:F?"Check this account":"Check now",group:"Actions",run:async()=>{let L=[...(await s0(Z)).routes].filter((A)=>!F||A===F);if(F&&L.length===0)throw new W0("unavailable","This vault account cannot be checked right now.");for(let A of L){let v=await Z.pollQuota(A);if(!v.ok)throw new W0("quota-check-failed",`${A}: ${v.error??"vault unavailable"}`)}return`Checked quota for ${L.length} account${L.length===1?"":"s"}.`}});if(Y==="quota"){let F=(D,L)=>P0(c(D.quota,$.quota?.scope),{now:q,form:L});return{lines:W.status.accounts.filter((D)=>!W.routes.has(D.routeId)).map((D)=>`${W1(D)} (${D.enabled?D.state:"disabled"}): ${F(D,"compact")}`),items:W.status.accounts.filter((D)=>W.routes.has(D.routeId)).map((D)=>({id:D.routeId,label:W1(D),group:"Accounts",status:F(D,"compact"),detail:F(D,"full"),actions:[M(D.routeId)]})),actions:W.routes.size>0?[M()]:[]}}let P=V.items.map((F)=>{let D=N.get(F.id),L=D&&Y==="accounts"?`Vault · ${D.credentialType==="oauth"?"login":"API key"} · ${D.state} · ${D.enabled?"enabled":"declined"}`:F.detail;return{id:F.id,label:F.label,detail:L,group:F.group,status:D&&Y==="accounts"?D.enabled?D.state:"disabled":F.status,...F.facts?{facts:F.facts}:{},actions:D&&Y!=="limits"?[]:F.actions.map((A)=>ZZ(j,Y,A,F.id))}}),E=V.actions.filter((F)=>Y==="limits"||Y==="routing"&&F.id==="mode").map((F)=>ZZ(j,Y,F));return{lines:Y==="accounts"?[`${W.status.accounts.length} vault account${W.status.accounts.length===1?"":"s"}`,`${W.routes.size} can route`,G8]:V.lines,items:P,actions:E}},z=_1({...$,accounts:void 0,quota:void 0,routing:void 0,limits:void 0,replace:{accounts:{title:"Accounts",build:(Y)=>G("accounts",Y)},quota:{title:"Quota",build:(Y)=>G("quota",Y)},routing:{title:"Routing",build:(Y)=>G("routing",Y)},limits:{title:"Limits",build:(Y)=>G("limits",Y)}},extras:$.extras?.map((Y)=>Y.id!=="reset"?Y:{...Y,build:async(H)=>{let W=await s0(Z);if(G$(W))return{lines:[G8]};return Y.build(H)}})}),B=async()=>{if(!G$(await s0(Z)))return{menu:X,error:void 0};let Y=await o2(Z);return{menu:z,error:Y}},Q=async(Y,H)=>{let W=await Y.menu.open(H);if(Y.error)W.menu.sections.find((j)=>j.id==="vault")?.lines.push(`Last error: ${Y.error}`);return W};return{command:$.command,open:async(Y)=>Q(await B(),Y),apply:async(Y,H)=>{let W=await B(),{menu:U}=W;if(U===z&&(Y.sectionId==="accounts"||Y.sectionId==="routing"&&Y.actionId==="order"||Y.sectionId==="reset"||Y.sectionId==="quota"&&(await s0(Z)).routes.size===0||Y.sectionId==="limits"&&Y.itemId!==void 0&&!(await s0(Z)).status.accounts.some((j)=>j.routeId===Y.itemId)))return{...await Q(W,H),ok:!1,code:"vault-local-action",text:z8};return U.apply(Y,H)}}}var V1="openai",H8="OpenAI accounts",z$="main",Z7="that account is already your main account, so it was not added again",v$=i("commands"),X7=new Set(["__proto__","constructor","prototype"]);function J7($,Z){let X={version:1,accounts:[],killswitch:$},J=Z0($.accounts)?Object.keys($.accounts):[],G={};for(let Q of new Set([z$,...Z,...J])){if(X7.has(Q))continue;let Y=H1(X,Q===z$?void 0:Q);G[Q]={primary:Y.primary,secondary:Y.secondary}}let z=H1(X,void 0),B={...$};return delete B.main,B.accounts=G,B.defaults={primary:z.primary,secondary:z.secondary},B.schema=X$,B}function G7($,Z){let X=Z0($.accounts)?{...$.accounts}:{};for(let G of new Set([z$,...Z])){if(X7.has(G)||Object.hasOwn(X,G))continue;X[G]={primary:Y1.primary,secondary:Y1.secondary}}let J=Z0($.defaults)?$.defaults:{primary:Y1.primary,secondary:Y1.secondary};return{...$,accounts:X,defaults:J,schema:X$}}function Q8($,Z){let X=!1;if(Z0($.cachekeep))$.cacheKeep={...$.cachekeep,...Z0($.cacheKeep)?$.cacheKeep:{}},delete $.cachekeep,X=!0;let J=$.killswitch;if(Z0(J)&&J.schema!==X$)$.killswitch=J7(J,Z),X=!0;return X}async function $7($){let Z=await $.read();return Z.status==="ready"?Z.rows.map((X)=>X.id):[]}function z7($){let Z=async()=>{let J=await $.readSettings();if(J.status==="error")return J;let G=structuredClone(J.settings);return Q8(G,await $7($)),{...J,settings:G}},X=async(J,G)=>{let z=await $7($);return $.updateSettings(async(B)=>{Q8(B,z);let Q=await J(B)??B;if(Z0(Q.killswitch)&&Q.killswitch.schema!==X$)Q.killswitch=G7(Q.killswitch,z);return Q},G)};return new Proxy($,{get(J,G){if(G==="readSettings")return Z;if(G==="updateSettings")return X;let z=Reflect.get(J,G,J);return typeof z==="function"?z.bind(J):z}})}function B7($,Z){let X=(Y,H)=>Z.rowLocks?Z.rowLocks(Y):H,J=(Y,H)=>{let W=X(Y,H?.extraLocks);return{...H??{},...W?{extraLocks:W}:{}}},G=(Y,H,W,U)=>$.replace(Y,H,W,J(Y,U)),Q={add:async(Y,H)=>{let W=await $.read(),j=(W.status==="ready"?W.rows:[]).filter((q)=>q.type==="oauth"&&!q.invalid),K=Y.identity?j.find((q)=>q.identity===Y.identity):void 0;if(K?.id===z$)throw new W0("main-account",Z7);let V=K??j.find((q)=>q.id===Y.id&&q.id!==z$);if(!V||Y.credential.type!=="oauth")return $.add(Y,H);let N=await G(V.id,Y.credential,Y.identity!==void 0?{identity:Y.identity}:{},H?.extraLocks?{extraLocks:H.extraLocks}:void 0);return v$.info("account signed in again",{id:V.id}),{id:N.id,outcome:"rotated",credential:N.credential,credentialEpoch:N.credentialEpoch}},replace:G,enable:(Y,H)=>$.enable(Y,J(Y,H)),disable:(Y,H,W)=>$.disable(Y,H,J(Y,W)),remove:(Y,H)=>$.remove(Y,J(Y,H))};return new Proxy($,{get(Y,H){if(Object.hasOwn(Q,H))return Q[H];let W=Reflect.get(Y,H,Y);return typeof W==="function"?W.bind(Y):W}})}var Q7="migration";function Y8($){let Z=["Accounts move to the new account layout once every OpenCode process on this machine runs this version of OpenAI auth. This menu works on that layout, so it opens after the move.",$.length>0?"These processes still hold the move back:":"No running process holds the move back."],X={command:V1,title:H8,sections:[{id:Q7,slot:"extra",title:"Accounts are moving",lines:Z,items:$.map((J,G)=>({id:`blocker-${G}`,label:J.pid==="unknown"?"processes that could not be read":`pid ${J.pid}`,detail:`version ${J.version}`,actions:[]})),actions:[]}]};return lz(X)}var pz=new Set(["access","refresh","apikey","authheader","password","credential","credentials"]);function uz($){let Z=$.toLowerCase().replace(/[-_]/g,"");if(pz.has(Z))return!0;return Z.endsWith("token")||Z.endsWith("key")||Z.endsWith("secret")}function XZ($,Z,X){if(Array.isArray($))return $.map((G,z)=>XZ(G,`${Z}[${z}]`,X));if(!Z0($))return $;let J={};for(let[G,z]of Object.entries($)){if(uz(G)){X.push(`${Z}.${G}`);continue}J[G]=XZ(z,`${Z}.${G}`,X)}return J}function lz($){let Z=[],X=XZ($,"menu",Z);if(Z.length>0)v$.warn("credential-shaped field stripped before RPC",{fields:Z});return X}function Y7($){return{id:$.id,credential:{type:"oauth",refresh:$.refresh,...$.access!==void 0?{access:$.access}:{},...$.expires!==void 0?{expires:$.expires}:{}},...$.accountId!==void 0?{identity:$.accountId}:{},...$.label!==void 0?{label:$.label}:{}}}function H7($){return{label:"Add account",knobs:[{kind:"text",id:"label",label:"Label (optional)"},{kind:"toggle",id:"headless",label:"Sign in with a device code (no browser on this machine)",value:!1}],run:async(Z)=>{let X=typeof Z.label==="string"&&Z.label.trim().length>0?Z.label.trim():void 0,J=Z.headless===!0,G=await $.begin({...X!==void 0?{label:X}:{},headless:J}),z=J?`Open this verification URL:
-${z.url}
+${G.url}
-Then enter the code: ${z.instructions.match(/Enter code: (.+)/)?.[1]??z.instructions}
+Then enter the code: ${G.instructions.match(/Enter code: (.+)/)?.[1]??G.instructions}
 The account is added when you finish.`:`Open this URL and complete sign-in:
-${z.url}
+${G.url}
-${z.instructions}
+${G.instructions}
-The account is added when you finish.`,Q=z.completion.then(async(Y)=>{let W=await $.mainIdentity?.();if(Y.accountId&&W&&Y.accountId===W)throw J3.warn("account add rejected (main identity)",{id:Y.id}),new U0("main-account",_5);return J3.info("account added",{id:Y.id}),x5(Y)});return{status:"pending",message:G,completion:Q}}}}function B4($){return{id:"session",title:"This session",build:async(Z)=>{let X=Z.sessionId;if(!X)return{lines:["No current session"]};let J=await $.getPin?.(X);return{lines:[J?`Pinned to ${J}`:"No sticky pin"],actions:$.clearPin?[{id:"clear-pin",label:"Clear this session's pin",description:"The next request may still choose the same account.",run:async({invocation:z})=>{if(!z.sessionId)return"No current session.";return await $.clearPin?.(z.sessionId),J3.info("routing session pin cleared"),"This session's pin was cleared. The next request may choose the same account if it remains the best selection."}}]:[]}}}}function H4($){let{vault:Z}=$;return{id:"vault",title:"Vault",build:async()=>{let X=await Z.status(),J=await Z.authority()!=="local",z=Z.routes().length;return{lines:[J?`Connected · ${X.accounts.length} account${X.accounts.length===1?"":"s"}`:X.enrollment.state==="idle"?"Not connected":`Enrollment ${X.enrollment.state}`,q5(X.host,X.name,X.enrollment),...f6(X.name,X.enrollment),...J?[X.accounts.length===0?"The vault serves no OpenAI account to this host yet.":`The vault serves ${X.accounts.length} OpenAI account${X.accounts.length===1?"":"s"}; ${z} can route now.`]:[],...J&&Z.snapshot()?.complete===!1?["The vault's last list had records this host could not read; accounts it did not list are kept as they were until a complete list arrives."]:[],...X.lastError?[`Last error: ${X.lastError}`]:[]],items:X.accounts.map((G)=>({id:G.routeId,label:O1(G),group:"Accounts",status:G.enabled?G.state:"disabled",detail:[G.credentialType==="api_key"?"API key":"login",G.state==="active"?"active":`vault state ${G.state}`,G.enabled?"enabled":"disabled here"].join(", "),actions:[G.enabled?{id:"disable",label:"Disable on this host",description:"It stays in the vault and in this list, and is never sent from this host until enabled again.",run:async()=>{return await Z.decline(G.routeId),await $.changed?.(),`${O1(G)} is disabled on this host.`}}:{id:"enable",label:"Enable on this host",run:async()=>{return await Z.accept(G.routeId),await $.changed?.(),`${O1(G)} is enabled on this host.`}}]})),actions:J?[{id:"disconnect",label:"Disconnect",description:"Forgets this host's vault token; its vault accounts stop routing at once. Revoke the enrollment itself with `ck auth enroll revoke`.",confirm:"Disconnect from the vault? Connecting again needs a new approval with `ck`.",run:async()=>{return await Z.disconnect(),await $.changed?.(),`Disconnected: ${Z.name} no longer reads from the vault. Run \`ck auth enroll revoke --name ${Z.name}\` to revoke it in the vault too.`}}]:[{id:"connect",label:"Connect",description:"Asks the vault to enroll this host; you approve the request with `ck`.",run:async({invocation:G})=>{let Q=await Z.connectStep();if(Q.state!=="pending"&&Q.state!=="busy")return await $.changed?.(),Z4(Z,Q);return Z.waitForApproval($.wait).then(async(Y)=>{await $.changed?.();let W=Z4(Z,Y);G.notify(W.text,W.ok?"info":"warning")}).catch((Y)=>{G.notify(`Connecting to the vault failed: ${Y instanceof Error?Y.message:String(Y)}`,"error")}),{ok:!0,text:[...f6(Z.name,Q),"Waiting for the approval; you are told here when it lands."].join(`
-`)}}}]}}}}var E5=[{value:"main-first",label:"Main first"},{value:"fallback-first",label:"Fallback first"}],k5=["primary","secondary"];function V4($){let Z={command:_1,title:W4,store:G4(R5(S5($.store,{...$.rowLocks?{rowLocks:$.rowLocks}:{}}))),...$.extraLocks?{extraLocks:$.extraLocks}:{},accounts:{...$.login?{login:b5($.login)}:{},...$.protect?{protect:$.protect}:{},...$.describeIdentity?{describeIdentity:$.describeIdentity}:{}},quota:$.quotaCheck?{check:$.quotaCheck}:{},routing:{orderedVariants:E5,formerMainId:F$},limits:{labels:k5},...$.cache?{cache:$.cache}:{},...$.diagnostics?{diagnostics:$.diagnostics}:{},...$.extras?{extras:$.extras}:{},...$.logger?{logger:$.logger}:{},...$.now?{now:$.now}:{}},X=$.vault?P5(Z,$.vault):x1(Z),J=(z)=>{let{sessionId:G}=z,Q=z.notify.bind(z);return{...G!==void 0?{sessionId:G}:{},notify:Q}};return{command:_1,async open(z){let G=J(z),Q=$.vault&&await $.vault.authority()!=="local"?void 0:await $.migration?.();if(Q&&!Q.migrated)return{command:_1,menu:Y4(Q.blockers)};return X.open(G)},async apply(z,G){let Q=J(G),Y=$.vault&&await $.vault.authority()!=="local"?void 0:await $.migration?.();if(Y&&!Y.migrated)return{command:_1,ok:!1,text:"Nothing was changed: the accounts have not moved to the new layout yet.",menu:Y4(Y.blockers)};let W=await X.apply(z,Q);if(W.ok)await $.afterApply?.();return W}}}function f5($,Z,X){let J=$.get(Z.sessionId),z=new Set(Z.validPinnedAccountIds);if(J&&!Z.excludeAccountIds.includes(J.accountId)&&C$(J,z,Z.wireAccountIdByAccount[J.accountId])){if(Z.persist){let W=Z.quotaCheckedAtByAccount[J.accountId];X(Z.sessionId,{accountId:J.accountId,inputBytes:Z.requestBytes,...J.wireIdentity!==void 0?{wireIdentity:J.wireIdentity}:{},...W!==void 0?{quotaCheckedAt:W}:{}})}return{accountId:J.accountId}}let G=new Map(Object.entries(Z.quotaCheckedAtByAccount)),Q=$8($,G,Z.sessionId),Y=Z.select(Q);if(!Y)return;if(Z.persist){let W=Z.wireAccountIdByAccount[Y.accountId];X(Z.sessionId,{accountId:Y.accountId,inputBytes:Z.requestBytes,...W!==void 0?{wireIdentity:W}:{},...Y.quotaCheckedAt!==void 0?{quotaCheckedAt:Y.quotaCheckedAt}:{}})}return{accountId:Y.accountId}}import{statSync as NW}from"node:fs";var y5=30000,MW=8,LW=1800000;function v5($){return $.identity?`identity:${$.identity}`:`row:${$.id}`}function j4($){try{let Z=NW($);return`${Z.ino}:${Z.size}:${Z.mtimeMs}`}catch{return"-"}}function l1($){let Z=$.credential;if(Z?.type!=="oauth")return;return{access:Z.access??"",expires:Z.expires,refresh:Z.refresh}}function U4($,Z){try{return s0($,Z)}catch{return $}}function g5($,Z,X){let J=v5(Z);$.set(J,[...$.get(J)??[],{credentialEpoch:Z.credentialEpoch,identity:Z.identity,observation:X}].slice(-MW))}function h5($,Z,X){let J=$;for(let z of Z.get(v5($))??[]){if(!(X-z.observation.checkedAt<=LW)||z.credentialEpoch!==$.credentialEpoch||z.identity!==$.identity)continue;J={...J,quota:U4(J.quota,z.observation)}}return J}function w5($,Z,X,J){let z=z$($);if(typeof Z?.status==="number"||p8(Z)){let Q=d3({error:Z,now:X,refreshToken:$,...J?{previous:{message:"",checkedAt:X,nextRetryAt:J.nextRetryAt,retryCount:J.retryCount,tokenHash:J.tokenHash}}:{}});return{nextRetryAt:Q.nextRetryAt,tokenHash:z,retryCount:Q.retryCount}}return{nextRetryAt:X+y5,tokenHash:z,retryCount:J?.tokenHash===z?J.retryCount:0}}function m5($,Z,X,J){let z=new Map;for(let G of $){if(J(G,X))continue;let Q=Z.get(G.id);z.set(G.id,Q&&Q.nextRetryAt>X?Q.nextRetryAt:X+y5)}return z}var IM=s("quota");import{types as FW}from"node:util";var PW=/"(?:e|\\u0065)(?:r|\\u0072){2}(?:o|\\u006f)(?:r|\\u0072)"\s*:/i,OW=/"(?:t|\\u0074)(?:y|\\u0079)(?:p|\\u0070)(?:e|\\u0065)"\s*:\s*"(?:e|\\u0065)(?:r|\\u0072){2}(?:o|\\u006f)(?:r|\\u0072)"/i;function d5($){return $.replace(/\\(?:u([a-f\d]{4})|(["\\/bfnrt]))/gi,(Z,X,J)=>{if(X)return String.fromCharCode(Number.parseInt(X,16));return{b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t"}[J]??J??Z})}function _W($,Z){if(!Z)return $;let X=$.split(Z).join("[credential]"),J=Z.replace(/\s/g,"");if(!J)return X;let z=X.replace(/\s/g,"");if(!z.includes(J))return X;let G=[];for(let W=0;W<X.length;W++){let H=X[W]??"";if(!/\s/.test(H))G.push(W)}let Q=[],Y=0;for(let W=z.indexOf(J);W>=0;W=z.indexOf(J,W+J.length)){let H=G[W]??Y,B=(G[W+J.length-1]??H)+1;Q.push(X.slice(Y,H),"[credential]"),Y=B}return Q.length?Q.join("")+X.slice(Y):X}function p5($,Z){let X=_W($,Z);return WZ(X).replaceAll("***REDACTED***","[credential]")}function C1($,Z){let X=p5($,Z),J=d5(X),z=p5(J,Z);return z===J?X:z}function u5($){let Z=/^(-?)(0|[1-9]\d*)(?:\.(\d+))?(?:[eE]([+-]?\d+))?$/.exec($);if(!Z)return;let X=Z[3]??"",J=(Z[2]??"")+X,z=0;while(J[z]==="0")z++;if(z===J.length)return"0";let G=J.length;while(J[G-1]==="0")G--;let Q=Z[4]??"0",Y=Q.startsWith("-")||Q.startsWith("+")?1:0;while(Q[Y]==="0")Y++;let W=Q.slice(Y)||"0";if(W.length>16)return;let H=BigInt((Q.startsWith("-")?"-":"")+W)-BigInt(X.length)+BigInt(J.length-G);return`${Z[1]}${J.slice(z,G)}e${H}`}function c5($,Z){let X=Z?u5(Z):void 0;return $.replace(/"(?:\\.|[^"\\])*"|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null/g,(J)=>{if(!J.startsWith('"'))return Z&&(J===Z||X!==void 0&&u5(J)===X||(Z==="Infinity"||Z==="-Infinity")&&/^[-\d]/.test(J)&&String(Number(J))===Z)?'"[credential]"':J;let z=d5(J.slice(1,-1)),G=C1(z,Z);return G===z?J:JSON.stringify(G)})}function K4($,Z){let X=c5($,Z);try{return JSON.parse($),X}catch{return C1(X,Z)}}var CW=16384,TW=65536,AW=[/429|500|502|503|504|524/i,/rate increased too quickly|rate limit|rate-limit|rate_limit|too many requests/i,/overloaded|service unavailable|service_unavailable|service-unavailable|internal error|internal_error|internal server error|server error|server_error|server-error|provider returned error|provider_returned_error|provider-returned-error/i,/terminated|fetch failed|failed to fetch|network[-_\s]error|upstream connect|connection error|connection refused|connection lost|socket connection was closed|socket hang up|reset before headers|getaddrinfo|enotfound|eai_again|econnrefused|econnreset|etimedout/i,/^timeout$|\b(?:request|response|connection|network|stream|read) (?:timeout|timed out|time out)\b/i,/try your request again|retry your request|resource exhausted|resource_exhausted/i,/\btry again (?:later|in\b)|\b(?:currently|temporarily) at capacity\b/i];function RW($){try{let Z=o(JSON.parse($),"request_id");if(typeof Z==="string")return Z;if(typeof Z!=="number")return;let X=0,J,z=!0,G=!1,Q;for(let Y of $.matchAll(/"(?:\\.|[^"\\])*"|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?|[{}[\]:,]/g)){let W=Y[0];if(W==="{"||W==="["){X++;continue}if(W==="}"||W==="]"){X--;continue}if(X!==1)continue;if(W===","){z=!0,G=!1,J=void 0;continue}if(W===":"){G=!0;continue}if(z&&W.startsWith('"')){J=JSON.parse(W),z=!1;continue}if(G&&J==="request_id"&&!W.startsWith('"'))Q=W;G=!1}return Q}catch{return}}function SW($,Z){let X=K4($,Z);if(Buffer.byteLength(X,"utf8")<=TW)return X;let J=AW.flatMap((G)=>G.exec(X)?.[0]??[]);for(let G of["FreeUsageLimitError","GoUsageLimitError"])if(X.includes(G))J.push(G);let z={retry:J};try{let G=JSON.parse(X);if(o(G,"type")==="error")z.type="error";let Q=o(G,"error"),Y={};for(let H of["code","type"]){let B=o(Q,H);if(typeof B==="string")Y[H]=B.slice(0,256)}if(Object.keys(Y).length)z.error=Y;let W={};for(let H of["workspace","limitName"]){let B=o(o(G,"metadata"),H);if(typeof B==="string")W[H]=B.slice(0,256)}if(Object.keys(W).length)z.metadata=W}catch{}return JSON.stringify(z)}function g6($){if(!$||typeof $!=="object")return!1;let Z=$;for(let X=0;Z&&X<16;X++){if(FW.isProxy(Z))return!1;Z=Object.getPrototypeOf(Z)}return Z===null}function o($,Z){if(!g6($))return;let X=Object.getOwnPropertyDescriptor($,Z);return X&&"value"in X?X.value:void 0}function z3($,Z){return C1($,Z).slice(0,CW)}function P$($,Z){let X=Object.getOwnPropertyDescriptor($,Z)?.get;if(!X)throw Error(`Missing native ${Z} accessor`);return X}var IW=P$(DOMException.prototype,"message"),xW=P$(DOMException.prototype,"name");function T1($,Z){let X=o($,"message"),J=o($,"name");if(g6($)&&$ instanceof DOMException)try{X=IW.call($),J=xW.call($)}catch{}let z=Error(z3(typeof X==="string"?X:typeof $==="string"?$:"Provider request failed",Z));for(let V of Object.getOwnPropertyNames(z))if(V!=="message")Reflect.deleteProperty(z,V);Object.defineProperty(z,"name",{value:typeof J==="string"?z3(J,Z):"Error",configurable:!0,writable:!0});let G=(V,U,K)=>{let j=o(V,K);if(typeof j==="string"||typeof j==="number"&&Number.isFinite(j)||typeof j==="boolean")Object.defineProperty(U,K,{value:typeof j==="string"?z3(j,Z):j,enumerable:!0,configurable:!0,writable:!0})};for(let V of["status","statusCode","status_code","resets_at","resets_in_seconds"]){let U=o($,V);if(typeof U==="number"&&Number.isFinite(U))G($,z,V)}for(let V of["code","type","isRetryable"])G($,z,V);for(let V of["error","data"]){let U=o($,V),K=Object.create(null);for(let M of["type","code","message","resets_at","resets_in_seconds"])G(U,K,M);let j=o(U,"error");if(g6(j)){let M=Object.create(null);for(let D of["type","code","message","resets_at","resets_in_seconds"])G(j,M,D);K.error=M}if(Object.keys(K).length)Object.defineProperty(z,V,{value:K,enumerable:!0})}let Q=o($,"responseHeaders");if(Q&&typeof Q==="object"){let V={};for(let U of["retry-after-ms","retry-after"]){let K=o(Q,U);if(typeof K==="string")V[U]=z3(K,Z)}Object.defineProperty(z,"responseHeaders",{value:V,enumerable:!0})}let Y=o($,"responseBody");if(typeof Y==="string")Object.defineProperty(z,"responseBody",{value:SW(Y,Z),enumerable:!0});let W=o($,"request_id"),H=o(Q,"x-request-id"),B=typeof W==="string"?W:typeof H==="string"?H:typeof Y==="string"?RW(K4(Y,Z)):void 0;if(typeof B==="string")Object.defineProperty(z,"request_id",{value:z3(B,Z),enumerable:!0});for(let V of["vercel.ai.error","vercel.ai.error.AI_APICallError"]){let U=Symbol.for(V);if(o($,U)===!0)Object.defineProperty(z,U,{value:!0})}return z}function bW($,Z){if(!$.includes("error")&&(!$.includes("\\u00")||!PW.test($)&&!OW.test($)))return $;let X;try{X=JSON.parse($)}catch{return $}if(X?.type==="error"||X?.error||X?.response?.error)return c5($,Z);return $}var EW=P$(Response.prototype,"status"),kW=P$(Response.prototype,"statusText"),fW=P$(Response.prototype,"headers"),yW=P$(Response.prototype,"body"),vW=Response.prototype.text,l5=Headers.prototype.entries;async function s5($,Z,X="http"){try{let K=function(j){let M=U&&j.startsWith("\uFEFF")?"\uFEFF":"";return U=!1,M+j.slice(M.length).replace(/^data: ?([^\r\n]*)/gm,(D,q)=>D.slice(0,D.length-q.length)+bW(q,Z))};if(!g6($))throw Error("Invalid provider response");let J=EW.call($),z=fW.call($),G=yW.call($),Q=new Headers;for(let[j,M]of l5.call(z))Q.append(j,M);let Y={status:J,statusText:C1(kW.call($),Z),headers:Q};if(J<200||J>299){for(let[M,D]of l5.call(z)){if(C1(M,Z?.toLowerCase())!==M){Y.headers.delete(M);continue}try{Y.headers.set(M,C1(D,Z))}catch{Y.headers.delete(M)}}Y.headers.delete("content-length");let j=await vW.call($);return new Response(K4(j,Z),Y)}if(!G||X==="http")return $;Y.headers.delete("content-length");let W=ReadableStream.prototype.getReader.call(G),H=new TextDecoder("utf-8",{ignoreBOM:!0}),B=new TextEncoder,V="",U=!0;return new Response(new ReadableStream({async pull(j){try{for(;;){let M=await W.read();V+=H.decode(M.value,{stream:!M.done});let D=!1;for(;;){let q=/\r?\n\r?\n/.exec(V);if(!q)break;let F=q.index+q[0].length;j.enqueue(B.encode(K(V.slice(0,F)))),V=V.slice(F),D=!0}if(M.done){if(V)j.enqueue(B.encode(K(V)));j.close();return}if(D)return}}catch(M){j.error(T1(M,Z))}},async cancel(j){try{await W.cancel(j)}catch(M){throw T1(M,Z)}finally{W.releaseLock()}}}),Y)}catch(J){throw T1(J,Z)}}var i5={name:"@cortexkit/pi-openai-auth",version:"1.0.3",license:"MIT",type:"module",repository:{type:"git",url:"git+https://github.com/cortexkit/openai-auth.git",directory:"packages/pi"},main:"./dist/index.js",types:"./dist/index.d.ts",exports:{".":{import:"./dist/index.js",types:"./dist/index.d.ts"}},files:["dist","README.md","LICENSE"],keywords:["pi-package"],pi:{extensions:["./dist/index.js"]},scripts:{build:"rm -rf dist && bun build src/index.ts --outdir dist --target node --format esm --external '@earendil-works/pi-ai' --external '@earendil-works/pi-ai/*' --external '@earendil-works/pi-coding-agent' --external '@earendil-works/pi-coding-agent/*' --external '@earendil-works/pi-tui' --external '@earendil-works/pi-tui/*' --minify && bun run build:types","build:types":"cd ../core && bun run build && cd ../pi && tsdown --config tsdown.config.ts --config-loader native",test:"bun test src/tests",typecheck:"tsc",types:"tsc",prepublishOnly:"bun run build"},devDependencies:{"@cortexkit/claustrum-client":"^0.6.2","@cortexkit/common-auth":"^0.14.2","@cortexkit/openai-auth-core":"workspace:*"},peerDependencies:{"@earendil-works/pi-ai":">=1.0.1","@earendil-works/pi-coding-agent":">=1.0.1","@earendil-works/pi-tui":">=1.0.1"}};var h6=new Map;function a5($){return h6.get($)?.accountId}function n5($){return h6.delete($)}function r5($){return f5(h6,$,(Z,X)=>h6.set(Z,X))}import{join as YX}from"node:path";import{createHash as dW}from"node:crypto";import{constants as $X}from"node:fs";import{lstat as GX,mkdir as ZX,open as QX,unlink as cW}from"node:fs/promises";import{dirname as p6,resolve as XX}from"node:path";import{setTimeout as sW}from"node:timers/promises";import{rmdirSync as hW,statSync as wW}from"node:fs";import{mkdir as mW,rmdir as pW,stat as m6,utimes as t5}from"node:fs/promises";var uW=30000,w6=1e4,lW=3000,q4,G3=new Map;process.once("exit",()=>{for(let[$,Z]of G3)try{if(Z.renewedAt+w6<Date.now())continue;let X=wW($);if(D4(X,Z)&&X.mtime.getTime()===Z.mtime)hW($)}catch{}});function D4($,Z){return $.dev===Z.dev&&$.ino===Z.ino}function Q3($){return typeof $==="object"&&$!==null&&"code"in $?$.code:void 0}function o5(){return Object.assign(Error("Pi auth lock held"),{code:"ELOCKED"})}async function N4($){try{await pW($)}catch(Z){if(Q3(Z)!=="ENOENT")throw Z}}async function M4($,Z){try{await mW($)}catch(X){if(Q3(X)!=="EEXIST")throw X;if(Z<=0)throw o5();let J;try{J=(await m6($)).mtime.getTime()}catch(z){if(Q3(z)==="ENOENT")return M4($,0);throw z}if(!(J<Date.now()-Z))throw o5();return await N4($),M4($,0)}try{if(!q4){let z=new Date(Math.ceil(Date.now()/1000)*1000+5);await t5($,z,z)}let X=await m6($),J=X.mtime.getTime();return q4??=J%1000===0?"s":"ms",{dev:X.dev,ino:X.ino,mtime:J}}catch(X){throw await N4($).catch(()=>{}),X}}async function e5($,Z,X){let J=`${$}.lock`,z=await M4(J,uW),G=z.mtime,Q=Date.now(),Y=!1,W;G3.set(J,{...z,renewedAt:Q});function H(){if(Y=!0,W)clearTimeout(W);G3.delete(J),Z()}function B(){if(!Y&&Q+w6<Date.now())H()}function V(j=lW){if(Y)return;W=setTimeout(()=>{K()},j),W.unref()}function U(j){if(Y)return;if(Q3(j)==="ENOENT"||Q+w6<Date.now())H();else V(1000)}async function K(){if(B(),Y)return;let j;try{j=await m6(J)}catch(D){U(D);return}if(B(),Y)return;if(!D4(j,z)||j.mtime.getTime()!==G){H();return}let M=new Date(q4==="s"?Math.ceil(Date.now()/1000)*1000:Date.now());try{await t5(J,M,M)}catch(D){U(D);return}if(Y)return;G=M.getTime(),Q=Date.now(),G3.set(J,{...z,mtime:G,renewedAt:Q}),V()}return X?.(async()=>{if(W)clearTimeout(W);await K()}),V(),{assertFresh:B,async release(){if(Y)return;if(Y=!0,W)clearTimeout(W);G3.delete(J);let j=()=>Q+w6<Date.now();if(j()){H();return}let M;try{M=await m6(J)}catch(D){if(Q3(D)!=="ENOENT")throw D;H();return}if(j()||!D4(M,z)||G!==M.mtime.getTime()){H();return}await N4(J)}}}class a extends Error{code;constructor($){super(`Pi slot: ${$}`);this.code=$,this.name="PiSlotError"}}function iW($){let Z=$.indexOf("{")+1,X={offset:Z-1,children:[]},J=()=>{while(/\s/.test($[Z]??"")&&Z<$.length)Z++},z=()=>{Z++;while(Z<$.length){if($[Z++]==='"')return;if($[Z-1]==="\\")Z++}};J();while($[Z]!=="}"){let G=Z;z();let Q=JSON.parse($.slice(G,Z));J(),Z++,J();let Y=Z,W=0;while(Z<$.length){let B=$[Z];if(B==='"'){z();continue}if(B==="{"||B==="[")W++;if(B==="}"||B==="]"){if(W===0)break;W--}if(B===","&&W===0)break;Z++}let H=Z;while(/\s/.test($[H-1]??""))H--;if(X.children.push({key:Q,offset:G,length:H-G,value:{offset:Y,length:H-Y}}),J(),$[Z]==="}")break;Z++,J()}return X}function Y3($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function F4($){if(Array.isArray($))return`[${$.map(F4).join(",")}]`;if(Y3($))return`{${Object.keys($).sort().map((Z)=>`${JSON.stringify(Z)}:${F4($[Z])}`).join(",")}}`;return JSON.stringify($)}function d0($){return dW("sha256").update(F4($)).digest("hex")}function u6($){return Y3($)?$.code:void 0}async function JX($,Z=!1,X){let J;try{J=await QX($,$X.O_RDONLY|$X.O_NOFOLLOW);let z=await J.stat();if(!z.isFile()||Z&&(z.mode&511)!==384)throw new a("unsafe-path");await X?.($);let G=await GX($);if(!G.isFile()||G.dev!==z.dev||G.ino!==z.ino)throw new a("unsafe-path");let Q=await J.readFile(),Y=Q.toString("utf8");if(!Q.equals(Buffer.from(Y)))throw new a(Z?"invalid-stash":"invalid-auth");return Y}catch(z){if(u6(z)==="ENOENT"&&!J)return;if(u6(z)==="ELOOP"||u6(z)==="ENOENT")throw new a("unsafe-path");throw z}finally{await J?.close()}}function aW($,Z){try{let X=JSON.parse($);if(!Y3(X))throw Error();let J=iW($),z=J.children,G=z.map((W)=>W.key);if(new Set(G).size!==G.length)throw Error();let Q=z.find((W)=>W.key===Z),Y=Q?X[Z]:null;if(Y!==null&&!Y3(Y))throw Error();if(Q&&Y===null)throw Error();return{text:$,root:J,property:Q,entry:Y}}catch{throw new a("invalid-auth")}}function nW($){let Z=$.property?.value;return Z?$.text.slice(Z.offset,Z.offset+Z.length):null}function zX($,Z,X){let{text:J,root:z,property:G}=$,Q=z.children??[];if(G){let H=G.value;if(!H)throw new a("invalid-auth");if(X!==null)return J.slice(0,H.offset)+X+J.slice(H.offset+H.length);let B=Q.indexOf(G),V=Q[B-1],U=Q[B+1],K=V?V.offset+V.length:G.offset,j=!V&&U?U.offset:G.offset+G.length;return J.slice(0,K)+J.slice(j)}if(X===null)return J;let Y=Q.at(-1),W=Y?Y.offset+Y.length:z.offset+1;return`${J.slice(0,W)}${Y?",":""}${JSON.stringify(Z)}:${X}${J.slice(W)}`}async function rW($){let Z=await QX($,"r");try{await Z.sync()}finally{await Z.close()}}async function L4($,Z,X,J){await O0($,null,{serialize:()=>Z,durable:!0,beforeRename:async()=>{await J?.($),X()}})}function P4($){return oW($)}function oW($,Z,X){let{provider:J,placeholderKey:z}=$,G=$.lockTimeoutMs??30000;if(!J||!$.authPath||!$.stashPath||!z||z.startsWith("!")||z.includes("$")||!Number.isFinite(G)||G<0)throw new a("invalid-options");let Q=XX($.authPath),Y=XX($.stashPath);if(Q===Y||Y===`${Q}.lock`)throw new a("invalid-options");let W=d0(Q),H=d0(z),B={type:"api_key",key:z},V=(D)=>d0(D)===d0(B);async function U(){let D=await JX(Y,!0,X?.afterReadCheck);if(D===void 0)return;try{let q=JSON.parse(D);if(q.version!==1||q.provider!==J||q.authIdentity!==W||q.placeholderIdentity!==H||q.entry!==null&&!Y3(q.entry)||q.sha256!==d0(q.entry)||(q.entry===null?q.entryJson!==null:typeof q.entryJson!=="string"||d0(JSON.parse(q.entryJson))!==q.sha256))throw Error();return q}catch{throw new a("invalid-stash")}}async function K(D){let q,F,C=!1,L=()=>{if(F?.(),C)throw new a("lock-compromised")};try{await ZX(p6(Q),{recursive:!0,mode:448});let N=Date.now()+G,P=0;while(!q)try{let f=await e5(Q,()=>{C=!0},X?.onRenew);q=f.release,F=f.assertFresh}catch(f){if(u6(f)!=="ELOCKED")throw f;let n=N-Date.now();if(n<=0)throw new a("lock-timeout");await sW(Math.min(Math.round(Math.min(10*2**P++,1000)*(1+Math.random())),n))}L();let S=await D(L);return L(),S}catch(N){if(N instanceof a)throw N;throw new a("io")}finally{await q?.().catch(()=>{}),L()}}async function j(){let D=aW(await JX(Q,!1,X?.afterReadCheck)??"{}",J),q=await U();return{auth:D,stash:q}}async function M(D){D(),await cW(Y),await rW(p6(Y)),Z?.("stash-deleted")}return{inspect:()=>K(async()=>{let{auth:D,stash:q}=await j();return{slot:V(D.entry)?"placeholder":D.entry===null?"empty":!q||d0(D.entry)===q.sha256?"original":"foreign",stash:q?"valid":"missing"}}),enterVault:()=>K(async(D)=>{let{auth:q,stash:F}=await j();if(V(q.entry)){if(!F)throw new a("missing-stash");return}if(F&&d0(q.entry)!==F.sha256)throw new a("conflict");if(!F){await ZX(p6(Y),{recursive:!0,mode:448});let C=await GX(p6(Y));if(!C.isDirectory()||(C.mode&511)!==448)throw new a("unsafe-path");let L={version:1,provider:J,authIdentity:W,placeholderIdentity:H,entry:q.entry,entryJson:nW(q),sha256:d0(q.entry)};await L4(Y,JSON.stringify(L),D,X?.beforeRename),Z?.("stash-written")}await L4(Q,zX(q,J,JSON.stringify(B)),D,X?.beforeRename),Z?.("auth-written")}),exitVault:()=>K(async(D)=>{let{auth:q,stash:F}=await j();if(!F){if(V(q.entry))throw new a("missing-stash");return"nothing-to-do"}if(V(q.entry))await L4(Q,zX(q,J,F.entryJson),D,X?.beforeRename),Z?.("auth-written");else if(d0(q.entry)!==F.sha256)return"conflict";return await M(D),"restored"})}}import{getAgentDir as tW}from"@earendil-works/pi-coding-agent";var W3="openai-auth-vault-mode-not-a-credential",WX="Request refused locally: Pi has not loaded the credential vault placeholder. Reopen the session or disconnect Pi from the vault in /openai; local credentials are not used while connected.",BX="A Pi login was added while connected to the vault. Both that login and the stashed original are kept; neither was overwritten.";function HX($){return P4({authPath:YX(tW(),"auth.json"),provider:"openai-codex",stashPath:YX(E6($),"pi-openai-codex-login.json"),placeholderKey:W3})}function eW($){return{id:"pi-login",title:"Pi login",build:()=>{let Z=$(),X=Date.now(),J=d({limits:["primary","secondary"].flatMap((G)=>{let Q=Z?.[G];return Q?[{...Q,kind:"reading",scope:"all",label:G,checkedAt:Q.checkedAt??X}]:[]}),...Z?.spendControl?{budget:{...Z.spendControl,kind:"reading",checkedAt:X}}:{}}),z=c1(J,{now:X});return{lines:["Managed by Pi /login",...z.length>0?z:[A0(J,{now:X})]]}}}}function $B($,Z={}){let X=Z.beginAccountLogin??qZ,J=Z.packageVersion??i5.version,z=H4({vault:$.vault,changed:Z.afterApply,...Z.vaultWait?{wait:Z.vaultWait}:{}}),G=V4({store:$.store(),vault:$.vault,login:{begin:(Q)=>X({...Q,version:J}),mainIdentity:async()=>$.mainIdentity()},quotaCheck:async(Q)=>{if(Q.length===1){let W=$.store();for(let H of Q)await W.requestReading(H);await W.pullsSettled();return}let Y=(await $.refreshAllQuota()).filter((W)=>!W.ok);if(Y.length>0)throw new U0("quota-check-failed",Y.map((W)=>`${W.account}: ${W.error??"quota check failed"}`).join(`
-`))},extras:[eW(()=>$.mainQuota()),B4({getPin:async(Q)=>a5(Q),clearPin:async(Q)=>n5(Q)}),{...z,build:async(Q)=>{let Y=await z.build(Q),W={id:"disconnect",label:"Disconnect",confirm:"Disconnect this Pi host from the vault and restore its original login?",run:async()=>{let B;try{B=await $.disconnectVault?.()}catch{let V=!1;try{await Z.afterApply?.()}catch{V=!0}let U=await $.readAuthority();throw new U0("vault-disconnect-failed",[U==="local"?"Disconnect did not finish cleanly; local accounts are active. Retry Disconnect if Pi login restoration did not complete.":"Disconnect failed; Pi is still enrolled or enrollment is unreadable. Local accounts remain disabled; retry Disconnect to restore the login.",...V?["Pi could not reload its auth snapshot; reopen the session."]:[]].join(`
-`))}return await Z.afterApply?.(),[`Disconnected: ${$.vault.name} no longer reads from the vault. Run \`ck auth enroll revoke --name ${$.vault.name}\` to revoke it in the vault too.`,...B==="conflict"?[BX]:[]].join(`
-`)}},H=Y.actions??[];return{...Y,actions:[...H.map((B)=>B.id==="disconnect"&&$.disconnectVault?{...B,run:W.run}:B),...$.vaultMode()&&$.disconnectVault&&!H.some((B)=>B.id==="disconnect")?[W]:[]]}}}],afterApply:async()=>{return await Z.afterApply?.(),$.reload()}});return{command:G.command,open:async(Q)=>{return await $.readAuthority(),G.open(Q)},apply:async(Q,Y)=>{return await $.readAuthority(),G.apply(Q,Y)}}}async function ZB($,Z){let X=Z.pool;if(!X){$.ui.notify("The OpenAI account pool is not available.","error");return}if(Z.onContext?.($),Z.afterApply)await Z.afterApply();else await X.syncVaultSlot?.(()=>$.modelRegistry.refresh(),!0);if(!X.vaultMode())try{await X.observeLogin(await $.modelRegistry?.getApiKeyForProvider("openai-codex"))}catch{}await w8($B(X,Z),$.ui,{sessionId:$.sessionManager.getSessionId()})}function VX($,Z={}){$.registerCommand(_1,{description:"OpenAI accounts: add and manage accounts, quota, routing and limits",handler:(X,J)=>ZB(J,Z)})}import{connect as XB}from"node:net";import{connect as JB}from"node:tls";var zB="258EAFA5-E914-47DA-95CA-C5AB0DC85B11",jX=["chatgpt-account-id","authorization","user-agent","originator","openai-beta","version","x-codex-beta-features","x-codex-turn-metadata","x-client-request-id","session-id","thread-id","x-codex-window-id"];class O4{url;readyState=0;socket;listeners={open:new Set,message:new Set,error:new Set,close:new Set};rxBuffer=new Uint8Array(0);handshakeDone=!1;expectedAccept="";fragOpcode=0;fragChunks=[];constructor($,Z){this.url=$,this.connect($,Z)}addEventListener($,Z,X){this.listeners[$]?.add(Z)}removeEventListener($,Z){this.listeners[$]?.delete(Z)}emit($,Z){for(let X of[...this.listeners[$]??[]])try{X(Z)}catch{}}async connect($,Z){let X=new URL($.replace(/^ws:/,"http:").replace(/^wss:/,"https:")),J=X.hostname,z=X.port?Number(X.port):X.protocol==="https:"?443:80,G=`${X.pathname}${X.search}`,Q=crypto.getRandomValues(new Uint8Array(16)),Y=Buffer.from(Q).toString("base64"),W=await crypto.subtle.digest("SHA-1",new TextEncoder().encode(Y+zB));this.expectedAccept=Buffer.from(new Uint8Array(W)).toString("base64");let H={};for(let[U,K]of Object.entries(Z))H[U.toLowerCase()]=K;let B=[`GET ${G} HTTP/1.1`,`Host: ${J}`,"Connection: Upgrade","Upgrade: websocket","Sec-WebSocket-Version: 13",`Sec-WebSocket-Key: ${Y}`];for(let U of jX)if(H[U]!==void 0)B.push(`${GB(U)}: ${H[U]}`);for(let[U,K]of Object.entries(Z))if(!jX.includes(U.toLowerCase())&&U.toLowerCase()!=="content-length")B.push(`${U}: ${K}`);let V=`${B.join(`\r
+The account is added when you finish.`,B=G.completion.then(async(Q)=>{let Y=await $.mainIdentity?.();if(Q.accountId&&Y&&Q.accountId===Y)throw v$.warn("account add rejected (main identity)",{id:Q.id}),new W0("main-account",Z7);return v$.info("account added",{id:Q.id}),Y7(Q)});return{status:"pending",message:z,completion:B}}}}function W8($){return{id:"session",title:"This session",build:async(Z)=>{let X=Z.sessionId;if(!X)return{lines:["No current session"]};let J=await $.getPin?.(X);return{lines:[J?`Pinned to ${J}`:"No sticky pin"],actions:$.clearPin?[{id:"clear-pin",label:"Clear this session's pin",description:"The next request may still choose the same account.",run:async({invocation:G})=>{if(!G.sessionId)return"No current session.";return await $.clearPin?.(G.sessionId),v$.info("routing session pin cleared"),"This session's pin was cleared. The next request may choose the same account if it remains the best selection."}}]:[]}}}}function V8($){let{vault:Z}=$;return{id:"vault",title:"Vault",build:async()=>{let X=await Z.status(),J=await Z.authority()!=="local",G=Z.routes().length;return{lines:[J?`Connected · ${X.accounts.length} account${X.accounts.length===1?"":"s"}`:X.enrollment.state==="idle"?"Not connected":`Enrollment ${X.enrollment.state}`,i2(X.host,X.name,X.enrollment),...$Z(X.name,X.enrollment),...J?[X.accounts.length===0?"The vault serves no OpenAI account to this host yet.":`The vault serves ${X.accounts.length} OpenAI account${X.accounts.length===1?"":"s"}; ${G} can route now.`]:[],...J&&Z.snapshot()?.complete===!1?["The vault's last list had records this host could not read; accounts it did not list are kept as they were until a complete list arrives."]:[],...X.lastError?[`Last error: ${X.lastError}`]:[]],items:X.accounts.map((z)=>({id:z.routeId,label:W1(z),group:"Accounts",status:z.enabled?z.state:"disabled",detail:[z.credentialType==="api_key"?"API key":"login",z.state==="active"?"active":`vault state ${z.state}`,z.enabled?"enabled":"disabled here"].join(", "),actions:[z.enabled?{id:"disable",label:"Disable on this host",description:"It stays in the vault and in this list, and is never sent from this host until enabled again.",run:async()=>{return await Z.decline(z.routeId),await $.changed?.(),`${W1(z)} is disabled on this host.`}}:{id:"enable",label:"Enable on this host",run:async()=>{return await Z.accept(z.routeId),await $.changed?.(),`${W1(z)} is enabled on this host.`}}]})),actions:J?[{id:"disconnect",label:"Disconnect",description:"Forgets this host's vault token; its vault accounts stop routing at once. Revoke the enrollment itself with `ck auth enroll revoke`.",confirm:"Disconnect from the vault? Connecting again needs a new approval with `ck`.",run:async()=>{return await Z.disconnect(),await $.changed?.(),`Disconnected: ${Z.name} no longer reads from the vault. Run \`ck auth enroll revoke --name ${Z.name}\` to revoke it in the vault too.`}}]:[{id:"connect",label:"Connect",description:"Asks the vault to enroll this host; you approve the request with `ck`.",run:async({invocation:z})=>{let B=await Z.connectStep();if(B.state!=="pending"&&B.state!=="busy")return await $.changed?.(),X8(Z,B);return Z.waitForApproval($.wait).then(async(Q)=>{await $.changed?.();let Y=X8(Z,Q);z.notify(Y.text,Y.ok?"info":"warning")}).catch((Q)=>{z.notify(`Connecting to the vault failed: ${Q instanceof Error?Q.message:String(Q)}`,"error")}),{ok:!0,text:[...$Z(Z.name,B),"Waiting for the approval; you are told here when it lands."].join(`
+`)}}}]}}}}var W7=[{value:"main-first",label:"Main first"},{value:"fallback-first",label:"Fallback first"}],V7=["primary","secondary"];function U8($){let Z={command:V1,title:H8,store:B8(z7(B7($.store,{...$.rowLocks?{rowLocks:$.rowLocks}:{}}))),...$.extraLocks?{extraLocks:$.extraLocks}:{},accounts:{...$.login?{login:H7($.login)}:{},...$.protect?{protect:$.protect}:{},...$.describeIdentity?{describeIdentity:$.describeIdentity}:{}},quota:$.quotaCheck?{check:$.quotaCheck}:{},routing:{orderedVariants:W7,formerMainId:z$},limits:{labels:V7},...$.cache?{cache:$.cache}:{},...$.diagnostics?{diagnostics:$.diagnostics}:{},...$.extras?{extras:$.extras}:{},...$.logger?{logger:$.logger}:{},...$.now?{now:$.now}:{}},X=$.vault?e2(Z,$.vault):_1(Z),J=(G)=>{let{sessionId:z}=G,B=G.notify.bind(G);return{...z!==void 0?{sessionId:z}:{},notify:B}};return{command:V1,async open(G){let z=J(G),B=$.vault&&await $.vault.authority()!=="local"?void 0:await $.migration?.();if(B&&!B.migrated)return{command:V1,menu:Y8(B.blockers)};return X.open(z)},async apply(G,z){let B=J(z),Q=$.vault&&await $.vault.authority()!=="local"?void 0:await $.migration?.();if(Q&&!Q.migrated)return{command:V1,ok:!1,text:"Nothing was changed: the accounts have not moved to the new layout yet.",menu:Y8(Q.blockers)};let Y=await X.apply(G,B);if(Y.ok)await $.afterApply?.();return Y}}}function U7($,Z,X){let J=$.get(Z.sessionId),G=new Set(Z.validPinnedAccountIds);if(J&&!Z.excludeAccountIds.includes(J.accountId)&&W$(J,G,Z.wireAccountIdByAccount[J.accountId])){if(Z.persist){let Y=Z.quotaCheckedAtByAccount[J.accountId];X(Z.sessionId,{accountId:J.accountId,inputBytes:Z.requestBytes,...J.wireIdentity!==void 0?{wireIdentity:J.wireIdentity}:{},...Y!==void 0?{quotaCheckedAt:Y}:{}})}return{accountId:J.accountId}}let z=new Map(Object.entries(Z.quotaCheckedAtByAccount)),B=LZ($,z,Z.sessionId),Q=Z.select(B);if(!Q)return;if(Z.persist){let Y=Z.wireAccountIdByAccount[Q.accountId];X(Z.sessionId,{accountId:Q.accountId,inputBytes:Z.requestBytes,...Y!==void 0?{wireIdentity:Y}:{},...Q.quotaCheckedAt!==void 0?{quotaCheckedAt:Q.quotaCheckedAt}:{}})}return{accountId:Q.accountId}}import{statSync as dz}from"node:fs";var j7=30000,cz=8,sz=1800000;function D7($){return $.identity?`identity:${$.identity}`:`row:${$.id}`}function j8($){try{let Z=dz($);return`${Z.ino}:${Z.size}:${Z.mtimeMs}`}catch{return"-"}}function I1($){let Z=$.credential;if(Z?.type!=="oauth")return;return{access:Z.access??"",expires:Z.expires,refresh:Z.refresh}}function D8($,Z){try{return E0($,Z)}catch{return $}}function K7($,Z,X){let J=D7(Z);$.set(J,[...$.get(J)??[],{credentialEpoch:Z.credentialEpoch,identity:Z.identity,observation:X}].slice(-cz))}function q7($,Z,X){let J=$;for(let G of Z.get(D7($))??[]){if(!(X-G.observation.checkedAt<=sz)||G.credentialEpoch!==$.credentialEpoch||G.identity!==$.identity)continue;J={...J,quota:D8(J.quota,G.observation)}}return J}function N7($,Z,X,J){let G=i1($);if(typeof Z?.status==="number"||H3(Z)){let B=E6({error:Z,now:X,refreshToken:$,...J?{previous:{message:"",checkedAt:X,nextRetryAt:J.nextRetryAt,retryCount:J.retryCount,tokenHash:J.tokenHash}}:{}});return{nextRetryAt:B.nextRetryAt,tokenHash:G,retryCount:B.retryCount}}return{nextRetryAt:X+j7,tokenHash:G,retryCount:J?.tokenHash===G?J.retryCount:0}}function M7($,Z,X,J){let G=new Map;for(let z of $){if(J(z,X))continue;let B=Z.get(z.id);G.set(z.id,B&&B.nextRetryAt>X?B.nextRetryAt:X+j7)}return G}var lD=i("quota");import{types as iz}from"node:util";var az=/"(?:e|\\u0065)(?:r|\\u0072){2}(?:o|\\u006f)(?:r|\\u0072)"\s*:/i,nz=/"(?:t|\\u0074)(?:y|\\u0079)(?:p|\\u0070)(?:e|\\u0065)"\s*:\s*"(?:e|\\u0065)(?:r|\\u0072){2}(?:o|\\u006f)(?:r|\\u0072)"/i;function O7($){return $.replace(/\\(?:u([a-f\d]{4})|(["\\/bfnrt]))/gi,(Z,X,J)=>{if(X)return String.fromCharCode(Number.parseInt(X,16));return{b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t"}[J]??J??Z})}function rz($,Z){if(!Z)return $;let X=$.split(Z).join("[credential]"),J=Z.replace(/\s/g,"");if(!J)return X;let G=X.replace(/\s/g,"");if(!G.includes(J))return X;let z=[];for(let Y=0;Y<X.length;Y++){let H=X[Y]??"";if(!/\s/.test(H))z.push(Y)}let B=[],Q=0;for(let Y=G.indexOf(J);Y>=0;Y=G.indexOf(J,Y+J.length)){let H=z[Y]??Q,W=(z[Y+J.length-1]??H)+1;B.push(X.slice(Q,H),"[credential]"),Q=W}return B.length?B.join("")+X.slice(Q):X}function F7($,Z){let X=rz($,Z);return P4(X).replaceAll("***REDACTED***","[credential]")}function U1($,Z){let X=F7($,Z),J=O7(X),G=F7(J,Z);return G===J?X:G}function L7($){let Z=/^(-?)(0|[1-9]\d*)(?:\.(\d+))?(?:[eE]([+-]?\d+))?$/.exec($);if(!Z)return;let X=Z[3]??"",J=(Z[2]??"")+X,G=0;while(J[G]==="0")G++;if(G===J.length)return"0";let z=J.length;while(J[z-1]==="0")z--;let B=Z[4]??"0",Q=B.startsWith("-")||B.startsWith("+")?1:0;while(B[Q]==="0")Q++;let Y=B.slice(Q)||"0";if(Y.length>16)return;let H=BigInt((B.startsWith("-")?"-":"")+Y)-BigInt(X.length)+BigInt(J.length-z);return`${Z[1]}${J.slice(G,z)}e${H}`}function C7($,Z){let X=Z?L7(Z):void 0;return $.replace(/"(?:\\.|[^"\\])*"|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null/g,(J)=>{if(!J.startsWith('"'))return Z&&(J===Z||X!==void 0&&L7(J)===X||(Z==="Infinity"||Z==="-Infinity")&&/^[-\d]/.test(J)&&String(Number(J))===Z)?'"[credential]"':J;let G=O7(J.slice(1,-1)),z=U1(G,Z);return z===G?J:JSON.stringify(z)})}function K8($,Z){let X=C7($,Z);try{return JSON.parse($),X}catch{return U1(X,Z)}}var oz=16384,tz=65536,ez=[/429|500|502|503|504|524/i,/rate increased too quickly|rate limit|rate-limit|rate_limit|too many requests/i,/overloaded|service unavailable|service_unavailable|service-unavailable|internal error|internal_error|internal server error|server error|server_error|server-error|provider returned error|provider_returned_error|provider-returned-error/i,/terminated|fetch failed|failed to fetch|network[-_\s]error|upstream connect|connection error|connection refused|connection lost|socket connection was closed|socket hang up|reset before headers|getaddrinfo|enotfound|eai_again|econnrefused|econnreset|etimedout/i,/^timeout$|\b(?:request|response|connection|network|stream|read) (?:timeout|timed out|time out)\b/i,/try your request again|retry your request|resource exhausted|resource_exhausted/i,/\btry again (?:later|in\b)|\b(?:currently|temporarily) at capacity\b/i];function $B($){try{let Z=t(JSON.parse($),"request_id");if(typeof Z==="string")return Z;if(typeof Z!=="number")return;let X=0,J,G=!0,z=!1,B;for(let Q of $.matchAll(/"(?:\\.|[^"\\])*"|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?|[{}[\]:,]/g)){let Y=Q[0];if(Y==="{"||Y==="["){X++;continue}if(Y==="}"||Y==="]"){X--;continue}if(X!==1)continue;if(Y===","){G=!0,z=!1,J=void 0;continue}if(Y===":"){z=!0;continue}if(G&&Y.startsWith('"')){J=JSON.parse(Y),G=!1;continue}if(z&&J==="request_id"&&!Y.startsWith('"'))B=Y;z=!1}return B}catch{return}}function ZB($,Z){let X=K8($,Z);if(Buffer.byteLength(X,"utf8")<=tz)return X;let J=ez.flatMap((z)=>z.exec(X)?.[0]??[]);for(let z of["FreeUsageLimitError","GoUsageLimitError"])if(X.includes(z))J.push(z);let G={retry:J};try{let z=JSON.parse(X);if(t(z,"type")==="error")G.type="error";let B=t(z,"error"),Q={};for(let H of["code","type"]){let W=t(B,H);if(typeof W==="string")Q[H]=W.slice(0,256)}if(Object.keys(Q).length)G.error=Q;let Y={};for(let H of["workspace","limitName"]){let W=t(t(z,"metadata"),H);if(typeof W==="string")Y[H]=W.slice(0,256)}if(Object.keys(Y).length)G.metadata=Y}catch{}return JSON.stringify(G)}function JZ($){if(!$||typeof $!=="object")return!1;let Z=$;for(let X=0;Z&&X<16;X++){if(iz.isProxy(Z))return!1;Z=Object.getPrototypeOf(Z)}return Z===null}function t($,Z){if(!JZ($))return;let X=Object.getOwnPropertyDescriptor($,Z);return X&&"value"in X?X.value:void 0}function m$($,Z){return U1($,Z).slice(0,oz)}function B$($,Z){let X=Object.getOwnPropertyDescriptor($,Z)?.get;if(!X)throw Error(`Missing native ${Z} accessor`);return X}var XB=B$(DOMException.prototype,"message"),JB=B$(DOMException.prototype,"name");function j1($,Z){let X=t($,"message"),J=t($,"name");if(JZ($)&&$ instanceof DOMException)try{X=XB.call($),J=JB.call($)}catch{}let G=Error(m$(typeof X==="string"?X:typeof $==="string"?$:"Provider request failed",Z));for(let U of Object.getOwnPropertyNames(G))if(U!=="message")Reflect.deleteProperty(G,U);Object.defineProperty(G,"name",{value:typeof J==="string"?m$(J,Z):"Error",configurable:!0,writable:!0});let z=(U,j,K)=>{let V=t(U,K);if(typeof V==="string"||typeof V==="number"&&Number.isFinite(V)||typeof V==="boolean")Object.defineProperty(j,K,{value:typeof V==="string"?m$(V,Z):V,enumerable:!0,configurable:!0,writable:!0})};for(let U of["status","statusCode","status_code","resets_at","resets_in_seconds"]){let j=t($,U);if(typeof j==="number"&&Number.isFinite(j))z($,G,U)}for(let U of["code","type","isRetryable"])z($,G,U);for(let U of["error","data"]){let j=t($,U),K=Object.create(null);for(let N of["type","code","message","resets_at","resets_in_seconds"])z(j,K,N);let V=t(j,"error");if(JZ(V)){let N=Object.create(null);for(let q of["type","code","message","resets_at","resets_in_seconds"])z(V,N,q);K.error=N}if(Object.keys(K).length)Object.defineProperty(G,U,{value:K,enumerable:!0})}let B=t($,"responseHeaders");if(B&&typeof B==="object"){let U={};for(let j of["retry-after-ms","retry-after"]){let K=t(B,j);if(typeof K==="string")U[j]=m$(K,Z)}Object.defineProperty(G,"responseHeaders",{value:U,enumerable:!0})}let Q=t($,"responseBody");if(typeof Q==="string")Object.defineProperty(G,"responseBody",{value:ZB(Q,Z),enumerable:!0});let Y=t($,"request_id"),H=t(B,"x-request-id"),W=typeof Y==="string"?Y:typeof H==="string"?H:typeof Q==="string"?$B(K8(Q,Z)):void 0;if(typeof W==="string")Object.defineProperty(G,"request_id",{value:m$(W,Z),enumerable:!0});for(let U of["vercel.ai.error","vercel.ai.error.AI_APICallError"]){let j=Symbol.for(U);if(t($,j)===!0)Object.defineProperty(G,j,{value:!0})}return G}function GB($,Z){if(!$.includes("error")&&(!$.includes("\\u00")||!az.test($)&&!nz.test($)))return $;let X;try{X=JSON.parse($)}catch{return $}if(X?.type==="error"||X?.error||X?.response?.error)return C7($,Z);return $}var zB=B$(Response.prototype,"status"),BB=B$(Response.prototype,"statusText"),QB=B$(Response.prototype,"headers"),YB=B$(Response.prototype,"body"),HB=Response.prototype.text,_7=Headers.prototype.entries;async function P7($,Z,X="http"){try{let K=function(V){let N=j&&V.startsWith("\uFEFF")?"\uFEFF":"";return j=!1,N+V.slice(N.length).replace(/^data: ?([^\r\n]*)/gm,(q,M)=>q.slice(0,q.length-M.length)+GB(M,Z))};if(!JZ($))throw Error("Invalid provider response");let J=zB.call($),G=QB.call($),z=YB.call($),B=new Headers;for(let[V,N]of _7.call(G))B.append(V,N);let Q={status:J,statusText:U1(BB.call($),Z),headers:B};if(J<200||J>299){for(let[N,q]of _7.call(G)){if(U1(N,Z?.toLowerCase())!==N){Q.headers.delete(N);continue}try{Q.headers.set(N,U1(q,Z))}catch{Q.headers.delete(N)}}Q.headers.delete("content-length");let V=await HB.call($);return new Response(K8(V,Z),Q)}if(!z||X==="http")return $;Q.headers.delete("content-length");let Y=ReadableStream.prototype.getReader.call(z),H=new TextDecoder("utf-8",{ignoreBOM:!0}),W=new TextEncoder,U="",j=!0;return new Response(new ReadableStream({async pull(V){try{for(;;){let N=await Y.read();U+=H.decode(N.value,{stream:!N.done});let q=!1;for(;;){let M=/\r?\n\r?\n/.exec(U);if(!M)break;let P=M.index+M[0].length;V.enqueue(W.encode(K(U.slice(0,P)))),U=U.slice(P),q=!0}if(N.done){if(U)V.enqueue(W.encode(K(U)));V.close();return}if(q)return}}catch(N){V.error(j1(N,Z))}},async cancel(V){try{await Y.cancel(V)}catch(N){throw j1(N,Z)}finally{Y.releaseLock()}}}),Q)}catch(J){throw j1(J,Z)}}var T7={name:"@cortexkit/pi-openai-auth",version:"1.0.5",license:"MIT",type:"module",repository:{type:"git",url:"git+https://github.com/cortexkit/openai-auth.git",directory:"packages/pi"},main:"./dist/index.js",types:"./dist/index.d.ts",exports:{".":{import:"./dist/index.js",types:"./dist/index.d.ts"}},files:["dist","README.md","LICENSE"],keywords:["pi-package"],pi:{extensions:["./dist/index.js"]},scripts:{build:"rm -rf dist && bun build src/index.ts --outdir dist --target node --format esm --external '@earendil-works/pi-ai' --external '@earendil-works/pi-ai/*' --external '@earendil-works/pi-coding-agent' --external '@earendil-works/pi-coding-agent/*' --external '@earendil-works/pi-tui' --external '@earendil-works/pi-tui/*' --external @cortexkit/private-files --external @cortexkit/claustrum-client --external @cortexkit/subc-client --minify && bun run build:types","build:types":"cd ../core && bun run build && cd ../pi && tsdown --config tsdown.config.ts --config-loader native",test:"bun test src/tests",typecheck:"tsc",types:"tsc",prepublishOnly:"bun run build"},devDependencies:{"@cortexkit/common-auth":"^0.17.1","@cortexkit/openai-auth-core":"workspace:*"},dependencies:{"@cortexkit/claustrum-client":"^0.9.0","@cortexkit/private-files":"^0.2.1","@cortexkit/subc-client":"^0.16.0"},peerDependencies:{"@earendil-works/pi-ai":">=1.0.1","@earendil-works/pi-coding-agent":">=1.0.1","@earendil-works/pi-tui":">=1.0.1"}};var GZ=new Map;function A7($){return GZ.get($)?.accountId}function S7($){return GZ.delete($)}function R7($){return U7(GZ,$,(Z,X)=>GZ.set(Z,X))}import{join as m7}from"node:path";import{createHash as NB}from"node:crypto";import{constants as x7}from"node:fs";import{lstat as h7,mkdir as k7,open as v7,unlink as MB}from"node:fs/promises";import{dirname as Q$,resolve as y7}from"node:path";import{setTimeout as FB}from"node:timers/promises";import{rmdirSync as VB,statSync as UB}from"node:fs";import{mkdir as jB,rmdir as DB,stat as BZ,utimes as I7}from"node:fs/promises";var KB=30000,zZ=1e4,qB=3000,q8,w$=new Map;process.once("exit",()=>{for(let[$,Z]of w$)try{if(Z.renewedAt+zZ<Date.now())continue;let X=UB($);if(N8(X,Z)&&X.mtime.getTime()===Z.mtime)VB($)}catch{}});function N8($,Z){return $.dev===Z.dev&&$.ino===Z.ino}function p$($){return typeof $==="object"&&$!==null&&"code"in $?$.code:void 0}function E7(){return Object.assign(Error("Pi auth lock held"),{code:"ELOCKED"})}async function M8($){try{await DB($)}catch(Z){if(p$(Z)!=="ENOENT")throw Z}}async function F8($,Z){try{await jB($)}catch(X){if(p$(X)!=="EEXIST")throw X;if(Z<=0)throw E7();let J;try{J=(await BZ($)).mtime.getTime()}catch(G){if(p$(G)==="ENOENT")return F8($,0);throw G}if(!(J<Date.now()-Z))throw E7();return await M8($),F8($,0)}try{if(!q8){let G=new Date(Math.ceil(Date.now()/1000)*1000+5);await I7($,G,G)}let X=await BZ($),J=X.mtime.getTime();return q8??=J%1000===0?"s":"ms",{dev:X.dev,ino:X.ino,mtime:J}}catch(X){throw await M8($).catch(()=>{}),X}}async function b7($,Z,X){let J=`${$}.lock`,G=await F8(J,KB),z=G.mtime,B=Date.now(),Q=!1,Y;w$.set(J,{...G,renewedAt:B});function H(){if(Q=!0,Y)clearTimeout(Y);w$.delete(J),Z()}function W(){if(!Q&&B+zZ<Date.now())H()}function U(V=qB){if(Q)return;Y=setTimeout(()=>{K()},V),Y.unref()}function j(V){if(Q)return;if(p$(V)==="ENOENT"||B+zZ<Date.now())H();else U(1000)}async function K(){if(W(),Q)return;let V;try{V=await BZ(J)}catch(q){j(q);return}if(W(),Q)return;if(!N8(V,G)||V.mtime.getTime()!==z){H();return}let N=new Date(q8==="s"?Math.ceil(Date.now()/1000)*1000:Date.now());try{await I7(J,N,N)}catch(q){j(q);return}if(Q)return;z=N.getTime(),B=Date.now(),w$.set(J,{...G,mtime:z,renewedAt:B}),U()}return X?.(async()=>{if(Y)clearTimeout(Y);await K()}),U(),{assertFresh:W,async release(){if(Q)return;if(Q=!0,Y)clearTimeout(Y);w$.delete(J);let V=()=>B+zZ<Date.now();if(V()){H();return}let N;try{N=await BZ(J)}catch(q){if(p$(q)!=="ENOENT")throw q;H();return}if(V()||!N8(N,G)||z!==N.mtime.getTime()){H();return}await M8(J)}}}class s extends Error{code;constructor($){super(`Pi slot: ${$}`);this.code=$,this.name="PiSlotError"}}function LB($){let Z=$.indexOf("{")+1,X={offset:Z-1,children:[]},J=()=>{while(/\s/.test($[Z]??"")&&Z<$.length)Z++},G=()=>{Z++;while(Z<$.length){if($[Z++]==='"')return;if($[Z-1]==="\\")Z++}};J();while($[Z]!=="}"){let z=Z;G();let B=JSON.parse($.slice(z,Z));J(),Z++,J();let Q=Z,Y=0;while(Z<$.length){let W=$[Z];if(W==='"'){G();continue}if(W==="{"||W==="[")Y++;if(W==="}"||W==="]"){if(Y===0)break;Y--}if(W===","&&Y===0)break;Z++}let H=Z;while(/\s/.test($[H-1]??""))H--;if(X.children.push({key:B,offset:z,length:H-z,value:{offset:Q,length:H-Q}}),J(),$[Z]==="}")break;Z++,J()}return X}function l$($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function _8($){if(Array.isArray($))return`[${$.map(_8).join(",")}]`;if(l$($))return`{${Object.keys($).sort().map((Z)=>`${JSON.stringify(Z)}:${_8($[Z])}`).join(",")}}`;return JSON.stringify($)}function f0($){return NB("sha256").update(_8($)).digest("hex")}function u$($){return l$($)?$.code:void 0}async function f7($,Z=!1,X){if(R)try{await X?.($);let G=await SZ($,!0),z=G.toString("utf8");if(!G.equals(Buffer.from(z)))throw new s(Z?"invalid-stash":"invalid-auth");return z}catch(G){if(u$(G)==="ENOENT")return;throw G}let J;try{J=await v7($,x7.O_RDONLY|x7.O_NOFOLLOW);let G=await J.stat();if(!G.isFile()||Z&&(G.mode&511)!==384)throw new s("unsafe-path");await X?.($);let z=await h7($);if(!z.isFile()||z.dev!==G.dev||z.ino!==G.ino)throw new s("unsafe-path");let B=await J.readFile(),Q=B.toString("utf8");if(!B.equals(Buffer.from(Q)))throw new s(Z?"invalid-stash":"invalid-auth");return Q}catch(G){if(u$(G)==="ENOENT"&&!J)return;if(u$(G)==="ELOOP"||u$(G)==="ENOENT")throw new s("unsafe-path");throw G}finally{await J?.close()}}function _B($,Z){try{let X=JSON.parse($);if(!l$(X))throw Error();let J=LB($),G=J.children,z=G.map((Y)=>Y.key);if(new Set(z).size!==z.length)throw Error();let B=G.find((Y)=>Y.key===Z),Q=B?X[Z]:null;if(Q!==null&&!l$(Q))throw Error();if(B&&Q===null)throw Error();return{text:$,root:J,property:B,entry:Q}}catch{throw new s("invalid-auth")}}function OB($){let Z=$.property?.value;return Z?$.text.slice(Z.offset,Z.offset+Z.length):null}function g7($,Z,X){let{text:J,root:G,property:z}=$,B=G.children??[];if(z){let H=z.value;if(!H)throw new s("invalid-auth");if(X!==null)return J.slice(0,H.offset)+X+J.slice(H.offset+H.length);let W=B.indexOf(z),U=B[W-1],j=B[W+1],K=U?U.offset+U.length:z.offset,V=!U&&j?j.offset:z.offset+z.length;return J.slice(0,K)+J.slice(V)}if(X===null)return J;let Q=B.at(-1),Y=Q?Q.offset+Q.length:G.offset+1;return`${J.slice(0,Y)}${Q?",":""}${JSON.stringify(Z)}:${X}${J.slice(Y)}`}async function CB($){if(R)return;let Z=await v7($,"r");try{await Z.sync()}finally{await Z.close()}}async function L8($,Z,X,J){await L0($,null,{serialize:()=>Z,durable:!0,durability:R?"file-only-on-windows":void 0,beforeRename:async()=>{await J?.($),X()}})}function O8($){return PB($)}function PB($,Z,X){let{provider:J,placeholderKey:G}=$,z=$.lockTimeoutMs??30000;if(!J||!$.authPath||!$.stashPath||!G||G.startsWith("!")||G.includes("$")||!Number.isFinite(z)||z<0)throw new s("invalid-options");let B=y7($.authPath),Q=y7($.stashPath);if(B===Q||Q===`${B}.lock`)throw new s("invalid-options");let Y=f0(B),H=f0(G),W={type:"api_key",key:G},U=(q)=>f0(q)===f0(W);async function j(){let q=await f7(Q,!0,X?.afterReadCheck);if(q===void 0)return;try{let M=JSON.parse(q);if(M.version!==1||M.provider!==J||M.authIdentity!==Y||M.placeholderIdentity!==H||M.entry!==null&&!l$(M.entry)||M.sha256!==f0(M.entry)||(M.entry===null?M.entryJson!==null:typeof M.entryJson!=="string"||f0(JSON.parse(M.entryJson))!==M.sha256))throw Error();return M}catch{throw new s("invalid-stash")}}async function K(q){let M,P,E=!1,F=()=>{if(P?.(),E)throw new s("lock-compromised")};try{if(R)await q0(Q$(B));else await k7(Q$(B),{recursive:!0,mode:448});let D=Date.now()+z,L=0;while(!M)try{let v=await b7(B,()=>{E=!0},X?.onRenew);M=v.release,P=v.assertFresh}catch(v){if(u$(v)!=="ELOCKED")throw v;let u=D-Date.now();if(u<=0)throw new s("lock-timeout");await FB(Math.min(Math.round(Math.min(10*2**L++,1000)*(1+Math.random())),u))}F();let A=await q(F);return F(),A}catch(D){if(D instanceof s||D instanceof l)throw D;throw new s("io")}finally{await M?.().catch(()=>{}),F()}}async function V(){let q=_B(await f7(B,!1,X?.afterReadCheck)??"{}",J),M=await j();return{auth:q,stash:M}}async function N(q){q(),await MB(Q),await CB(Q$(Q)),Z?.("stash-deleted")}return{inspect:()=>K(async()=>{let{auth:q,stash:M}=await V();return{slot:U(q.entry)?"placeholder":q.entry===null?"empty":!M||f0(q.entry)===M.sha256?"original":"foreign",stash:M?"valid":"missing"}}),enterVault:()=>K(async(q)=>{let{auth:M,stash:P}=await V();if(U(M.entry)){if(!P)throw new s("missing-stash");return}if(P&&f0(M.entry)!==P.sha256)throw new s("conflict");if(!P){if(R)await q0(Q$(Q));else{await k7(Q$(Q),{recursive:!0,mode:448});let F=await h7(Q$(Q));if(!F.isDirectory()||(F.mode&511)!==448)throw new s("unsafe-path")}let E={version:1,provider:J,authIdentity:Y,placeholderIdentity:H,entry:M.entry,entryJson:OB(M),sha256:f0(M.entry)};await L8(Q,JSON.stringify(E),q,X?.beforeRename),Z?.("stash-written")}await L8(B,g7(M,J,JSON.stringify(W)),q,X?.beforeRename),Z?.("auth-written")}),exitVault:()=>K(async(q)=>{let{auth:M,stash:P}=await V();if(!P){if(U(M.entry))throw new s("missing-stash");return"nothing-to-do"}if(U(M.entry))await L8(B,g7(M,J,P.entryJson),q,X?.beforeRename),Z?.("auth-written");else if(f0(M.entry)!==P.sha256)return"conflict";return await N(q),"restored"})}}import{getAgentDir as TB}from"@earendil-works/pi-coding-agent";var d$="openai-auth-vault-mode-not-a-credential",w7="Request refused locally: Pi has not loaded the credential vault placeholder. Reopen the session or disconnect Pi from the vault in /openai; local credentials are not used while connected.",p7="A Pi login was added while connected to the vault. Both that login and the stashed original are kept; neither was overwritten.";function u7($){return O8({authPath:m7(TB(),"auth.json"),provider:"openai-codex",stashPath:m7(t6($),"pi-openai-codex-login.json"),placeholderKey:d$})}function AB($){return{id:"pi-login",title:"Pi login",build:()=>{let Z=$(),X=Date.now(),J=c({limits:["primary","secondary"].flatMap((z)=>{let B=Z?.[z];return B?[{...B,kind:"reading",scope:"all",label:z,checkedAt:B.checkedAt??X}]:[]}),...Z?.spendControl?{budget:{...Z.spendControl,kind:"reading",checkedAt:X}}:{}}),G=k1(J,{now:X});return{lines:["Managed by Pi /login",...G.length>0?G:[P0(J,{now:X})]]}}}}function SB($,Z={}){let X=Z.beginAccountLogin??b4,J=Z.packageVersion??T7.version,G=V8({vault:$.vault,changed:Z.afterApply,...Z.vaultWait?{wait:Z.vaultWait}:{}}),z=U8({store:$.store(),vault:$.vault,login:{begin:(B)=>X({...B,version:J}),mainIdentity:async()=>$.mainIdentity()},quotaCheck:async(B)=>{if(B.length===1){let Y=$.store();for(let H of B)await Y.requestReading(H);await Y.pullsSettled();return}let Q=(await $.refreshAllQuota()).filter((Y)=>!Y.ok);if(Q.length>0)throw new W0("quota-check-failed",Q.map((Y)=>`${Y.account}: ${Y.error??"quota check failed"}`).join(`
+`))},extras:[AB(()=>$.mainQuota()),W8({getPin:async(B)=>A7(B),clearPin:async(B)=>S7(B)}),{...G,build:async(B)=>{let Q=await G.build(B),Y={id:"disconnect",label:"Disconnect",confirm:"Disconnect this Pi host from the vault and restore its original login?",run:async()=>{let W;try{W=await $.disconnectVault?.()}catch{let U=!1;try{await Z.afterApply?.()}catch{U=!0}let j=await $.readAuthority();throw new W0("vault-disconnect-failed",[j==="local"?"Disconnect did not finish cleanly; local accounts are active. Retry Disconnect if Pi login restoration did not complete.":"Disconnect failed; Pi is still enrolled or enrollment is unreadable. Local accounts remain disabled; retry Disconnect to restore the login.",...U?["Pi could not reload its auth snapshot; reopen the session."]:[]].join(`
+`))}return await Z.afterApply?.(),[`Disconnected: ${$.vault.name} no longer reads from the vault. Run \`ck auth enroll revoke --name ${$.vault.name}\` to revoke it in the vault too.`,...W==="conflict"?[p7]:[]].join(`
+`)}},H=Q.actions??[];return{...Q,actions:[...H.map((W)=>W.id==="disconnect"&&$.disconnectVault?{...W,run:Y.run}:W),...$.vaultMode()&&$.disconnectVault&&!H.some((W)=>W.id==="disconnect")?[Y]:[]]}}}],afterApply:async()=>{return await Z.afterApply?.(),$.reload()}});return{command:z.command,open:async(B)=>{return await $.readAuthority(),z.open(B)},apply:async(B,Q)=>{return await $.readAuthority(),z.apply(B,Q)}}}async function RB($,Z){let X=Z.pool;if(!X){$.ui.notify("The OpenAI account pool is not available.","error");return}if(Z.onContext?.($),Z.afterApply)await Z.afterApply();else await X.syncVaultSlot?.(()=>$.modelRegistry.refresh(),!0);if(!X.vaultMode())try{await X.observeLogin(await $.modelRegistry?.getApiKeyForProvider("openai-codex"))}catch{}await Q3(SB(X,Z),$.ui,{sessionId:$.sessionManager.getSessionId()})}function l7($,Z={}){$.registerCommand(V1,{description:"OpenAI accounts: add and manage accounts, quota, routing and limits",handler:(X,J)=>RB(J,Z)})}import{connect as EB}from"node:net";import{connect as IB}from"node:tls";var bB="258EAFA5-E914-47DA-95CA-C5AB0DC85B11",d7=["chatgpt-account-id","authorization","user-agent","originator","openai-beta","version","x-codex-beta-features","x-codex-turn-metadata","x-client-request-id","session-id","thread-id","x-codex-window-id"];class C8{url;readyState=0;socket;listeners={open:new Set,message:new Set,error:new Set,close:new Set};rxBuffer=new Uint8Array(0);handshakeDone=!1;expectedAccept="";fragOpcode=0;fragChunks=[];constructor($,Z){this.url=$,this.connect($,Z)}addEventListener($,Z,X){this.listeners[$]?.add(Z)}removeEventListener($,Z){this.listeners[$]?.delete(Z)}emit($,Z){for(let X of[...this.listeners[$]??[]])try{X(Z)}catch{}}async connect($,Z){let X=new URL($.replace(/^ws:/,"http:").replace(/^wss:/,"https:")),J=X.hostname,G=X.port?Number(X.port):X.protocol==="https:"?443:80,z=`${X.pathname}${X.search}`,B=crypto.getRandomValues(new Uint8Array(16)),Q=Buffer.from(B).toString("base64"),Y=await crypto.subtle.digest("SHA-1",new TextEncoder().encode(Q+bB));this.expectedAccept=Buffer.from(new Uint8Array(Y)).toString("base64");let H={};for(let[j,K]of Object.entries(Z))H[j.toLowerCase()]=K;let W=[`GET ${z} HTTP/1.1`,`Host: ${J}`,"Connection: Upgrade","Upgrade: websocket","Sec-WebSocket-Version: 13",`Sec-WebSocket-Key: ${Q}`];for(let j of d7)if(H[j]!==void 0)W.push(`${xB(j)}: ${H[j]}`);for(let[j,K]of Object.entries(Z))if(!d7.includes(j.toLowerCase())&&j.toLowerCase()!=="content-length")W.push(`${j}: ${K}`);let U=`${W.join(`\r
 `)}\r
 \r
-`;try{this.log("connect_start",{host:J,port:z,tls:X.protocol==="https:"});let U=()=>{this.socket?.write(V)},K=X.protocol==="https:"?JB({host:J,port:z,servername:J},U):XB({host:J,port:z},U);this.socket=K,K.on("data",(j)=>{this.onData(typeof j==="string"?Buffer.from(j,"binary"):j)}),K.on("error",(j)=>{this.readyState=3;let M=j instanceof Error?j.message:String(j);this.log("socket_error",{message:M}),this.emit("error",{message:M})}),K.on("close",(j)=>{this.readyState=3,this.log("socket_close",{hadError:j}),this.emit("close",{code:1006,reason:"socket closed"})})}catch(U){this.readyState=3,this.log("connect_exception",{message:U instanceof Error?U.message:String(U)}),this.emit("error",{message:U instanceof Error?U.message:String(U)})}}onData($){if(this.rxBuffer=QB(this.rxBuffer,$),!this.handshakeDone){let Z=Buffer.from(this.rxBuffer).toString("latin1"),X=Z.indexOf(`\r
+`;try{this.log("connect_start",{host:J,port:G,tls:X.protocol==="https:"});let j=()=>{this.socket?.write(U)},K=X.protocol==="https:"?IB({host:J,port:G,servername:J},j):EB({host:J,port:G},j);this.socket=K,K.on("data",(V)=>{this.onData(typeof V==="string"?Buffer.from(V,"binary"):V)}),K.on("error",(V)=>{this.readyState=3;let N=V instanceof Error?V.message:String(V);this.log("socket_error",{message:N}),this.emit("error",{message:N})}),K.on("close",(V)=>{this.readyState=3,this.log("socket_close",{hadError:V}),this.emit("close",{code:1006,reason:"socket closed"})})}catch(j){this.readyState=3,this.log("connect_exception",{message:j instanceof Error?j.message:String(j)}),this.emit("error",{message:j instanceof Error?j.message:String(j)})}}onData($){if(this.rxBuffer=kB(this.rxBuffer,$),!this.handshakeDone){let Z=Buffer.from(this.rxBuffer).toString("latin1"),X=Z.indexOf(`\r
 \r
-`);if(X===-1)return;let J=Z.slice(0,X),z=J.split(`\r
-`)[0]??"",G=J.match(/sec-websocket-accept:\s*(\S+)/i);if(!z.includes(" 101")){this.readyState=3,this.socket?.destroy?.(),this.log("upgrade_failed",{statusLine:z}),this.emit("error",{message:`WS upgrade failed: ${z}`});return}if(!G||G[1]!==this.expectedAccept){this.readyState=3,this.socket?.destroy?.(),this.log("accept_mismatch",{statusLine:z}),this.emit("error",{message:"WS upgrade Sec-WebSocket-Accept mismatch"});return}this.handshakeDone=!0,this.readyState=1,this.rxBuffer=this.rxBuffer.slice(X+4),this.log("open",{statusLine:z}),this.emit("open",{})}this.drainFrames()}drainFrames(){for(;;){let $=this.rxBuffer;if($.length<2)return;let Z=$[0],X=$[1],J=(Z&128)!==0,z=Z&15,G=(X&128)!==0,Q=X&127,Y=2;if(Q===126){if($.length<4)return;Q=$[2]<<8|$[3],Y=4}else if(Q===127){if($.length<10)return;Q=0;for(let H=0;H<8;H++)Q=Q*256+$[2+H];Y=10}if(G)Y+=4;if($.length<Y+Q)return;let W=$.slice(Y,Y+Q);this.rxBuffer=$.slice(Y+Q),this.handleFrame(J,z,W)}}handleFrame($,Z,X){if(Z===9){this.writeFrame(10,X);return}if(Z===10)return;if(Z===8){let z=1005,G="";if(X.length>=2)z=X[0]<<8|X[1],G=Buffer.from(X.slice(2)).toString("utf-8");this.readyState=3;try{this.socket?.end()}catch{}this.emit("close",{code:z,reason:G});return}if(Z===1||Z===2)this.fragOpcode=Z,this.fragChunks=[X];else if(Z===0)this.fragChunks.push(X);if(!$)return;let J=YB(this.fragChunks);if(this.fragChunks=[],this.fragOpcode===1){let z=Buffer.from(J).toString("utf-8");this.emit("message",{data:z})}}send($){if(this.readyState!==1)return;this.writeFrame(1,new TextEncoder().encode($))}writeFrame($,Z){let X=Z.length,J=crypto.getRandomValues(new Uint8Array(4)),z;if(X<126)z=[128|$,128|X];else if(X<65536)z=[128|$,254,X>>8&255,X&255];else{z=[128|$,255];for(let Y=7;Y>=0;Y--)z.push(X/2**(8*Y)&255)}let G=new Uint8Array(X);for(let Y=0;Y<X;Y++)G[Y]=Z[Y]^J[Y%4];let Q=new Uint8Array(z.length+4+X);Q.set(z,0),Q.set(J,z.length),Q.set(G,z.length+4);try{this.socket?.write(Q)}catch{}}close(){if(this.readyState===3)return;this.readyState=2;try{this.writeFrame(8,new Uint8Array([3,232])),this.socket?.end()}catch{}this.readyState=3}log($,Z){return Promise.resolve()}}function GB($){return $}function QB($,Z){let X=new Uint8Array($.length+Z.length);return X.set($,0),X.set(Z,$.length),X}function YB($){let Z=0;for(let z of $)Z+=z.length;let X=new Uint8Array(Z),J=0;for(let z of $)X.set(z,J),J+=z.length;return X}import{statSync as NB}from"node:fs";var D0="main";function KX($,Z,X){let J=new Map;if(o2(Z))for(let z of $)J.set(z.id,G5(M$(z.quota),Z,z.id===D0?void 0:z.id,X));return J}var qX=5,_4=5000;function DX($){if($==="ordered")return"roster";return $==="fallback-first"?"fallback-first":"main-first"}function NX($,Z=_4){let X=$.rows.filter((Q)=>Q.kind==="oauth"&&$.killswitch.get(Q.id)!==!1&&d(Q.quota).limits.length===0);if(X.length===0)return;if(i0({rows:$.rows,now:$.now,rateLimitMarks:$.rateLimitMarks,refreshBackoff:$.refreshBackoff,requestPull:()=>{}}).admitted.some((Q)=>$.killswitch.get(Q.id)!==!1))return;let z=[];if(i0({rows:X,now:$.now,rateLimitMarks:$.rateLimitMarks,refreshBackoff:$.refreshBackoff,requestPull:(Q)=>{let Y=$.requestPull(Q);if(Y)z.push(Y.catch(()=>{}))}}),z.length===0)return;let G;return Promise.race([Promise.all(z),new Promise((Q)=>{G=setTimeout(Q,Z)})]).then(()=>{}).finally(()=>clearTimeout(G))}function C4($){return $.reason==="exhausted"||$.reason==="budget-spent"}function MX($,Z,X){if($===void 0)return{reason:"no-credential"};if(X.get($)===!1)return{reason:"killswitch"};let J=Z.excluded.find((G)=>G.id===$);if(J?.reason==="rate-limited")return{reason:"mid-stream-rate-limit",resetAtMs:J.until};if(J)return{reason:"no-credential"};let z=Z.refused.find((G)=>G.id===$);if(z&&"resetAtMs"in z)return{reason:"quota-exhausted",resetAtMs:z.resetAtMs};if(z)return{reason:"quota-unknown"};return{reason:"no-credential"}}function UX($,Z,X){if(Z.refused.find((z)=>!C4(z)&&X.get(z.id)!==!1))return{reason:"quota-unknown"};return MX($[0],Z,X)}function LX($){let Z=$.replayable!==!1,X=Z?$.placement:"main-first",J=t6({rows:$.rows,placement:X,formerMainId:D0,killswitch:$.killswitch,rateLimitMarks:$.rateLimitMarks,refreshBackoff:$.refreshBackoff,now:$.now,requestPull:$.requestPull}),z=s1($.rows.map((Y)=>Y.id),X,D0),G=new Set(J.admission.refused.filter((Y)=>C4(Y)&&$.killswitch.get(Y.id)!==!1).map((Y)=>Y.id)),Q=z.filter((Y)=>G.has(Y));if(!Z){let Y=z.includes(D0),W=Y?D0:J.order[0]??Q[0];if(W!==void 0&&J.order.includes(W))return{kind:"send",order:[W],lastPath:!1};if(W!==void 0&&G.has(W))return{kind:"send",order:[W],lastPath:!0};return{kind:"block",block:Y?MX(D0,J.admission,$.killswitch):UX(z,J.admission,$.killswitch)}}if(J.order.length>0)return{kind:"send",order:J.order,lastPath:!1};if(Q.length>0)return{kind:"send",order:Q,lastPath:!0};return{kind:"block",block:UX(z,J.admission,$.killswitch)}}function T4($){let Z=i0({rows:$.rows,rateLimitMarks:$.rateLimitMarks,refreshBackoff:$.refreshBackoff,now:$.now,requestPull:$.requestPull}),X=new Map;for(let J of $.rows)X.set(J.id,d(J.quota));for(let J of Z.admitted)if(J.projection)X.set(J.id,J.projection);return{projections:X,excluded:new Set(Z.excluded.map((J)=>J.id))}}function FX($,Z,X){let J=X.exclude,z=J?$.rows.filter((Q)=>!J.has(Q.id)):$.rows,G=new Map;for(let Q of z){let Y=Z.resetCredits(Q.id);if(Y!==void 0)G.set(Q.id,Y)}return G8({rows:z,now:$.now,rateLimitMarks:$.rateLimitMarks,refreshBackoff:$.refreshBackoff,requestPull:$.requestPull,killswitch:$.killswitch,requestBytes:Z.requestBytes,...X.pendingBytes?{pendingBytes:X.pendingBytes}:{},rowReservePercent:(Q)=>Z.reservePercent(Q.id),refusedPinPolicy:"move-on-confirmed-exhaustion",resetCreditsApplicable:G,...X.pin===void 0?{}:{pin:{accountId:X.pin}},...Z.onEmptyWeightedSet?{onEmptyWeightedSet:Z.onEmptyWeightedSet}:{}})}function PX($,Z,X,J){let z=FX($,Z,{exclude:X,pendingBytes:J});if(z.outcome!=="dispatch"||z.source==="pin")return;return{accountId:z.accountId,source:z.source,...z.quotaCheckedAt===void 0?{}:{quotaCheckedAt:z.quotaCheckedAt}}}function OX($,Z,X){let J=$.killswitch.get(X)===!1,z=FX($,Z,{pin:X});if(z.outcome==="dispatch"){if(z.pin.action==="assign")return{kind:"move",reason:J?"killswitch":"exhausted"};return z.accountId===X?{kind:"serve"}:{kind:"detour"}}let G=z.admission.refused.find((Q)=>Q.id===X);if(!J&&G&&C4(G))return{kind:"last-path"};return{kind:"none"}}function _X($,Z,X,J){let z=$.killswitch.get(X);return z8({quota:Z.projections.get(X),now:$.now,...J===void 0?{}:{status:J},...z===void 0?{}:{killswitchPasses:z}})}var WB=15000;function B3($){if(!$)return;let Z=Q$($);return Z?Y$(Z):void 0}class A4{deps;now;token;identity;quota;snapshot;firstPolledFor;inflight;lastPull;constructor($){this.deps=$,this.now=$.now??Date.now}observeToken($){if(!$)return;let Z=B3($);if(this.token!==void 0&&this.accountKey(this.token,this.identity)!==this.accountKey($,Z))this.quota=void 0,this.snapshot=void 0;this.token=$,this.identity=Z;let X=this.accountKey($,Z);if(this.firstPolledFor!==X)this.firstPolledFor=X,this.pollNow()}currentToken(){return this.token}currentIdentity(){return this.identity}quotaMap(){return this.quota}quotaSnapshot(){let $=M$(this.quota);if(!$&&!this.snapshot)return;return{...this.snapshot?.resetCreditsAvailable!==void 0?{resetCreditsAvailable:this.snapshot.resetCreditsAvailable}:{},...this.snapshot?.spendControl?{spendControl:this.snapshot.spendControl}:{},...$}}requestReading($=!1){let Z=this.now();if(!$&&this.lastPull!==void 0&&Z-this.lastPull<(this.deps.pullRetryMs??WB))return this.inflight;return this.pollNow()}pending(){return this.inflight}pollNow(){if(this.inflight)return this.inflight;let $=this.token;if(!$)return Promise.resolve({ok:!1,error:"Pi holds no OpenAI login"});let Z=this.identity;this.lastPull=this.now();let X=(async()=>{try{let J=await this.deps.poll($,Z);if(this.accountKey(this.token,this.identity)!==this.accountKey($,Z))return{ok:!0};return this.snapshot=J.snapshot,this.merge(J.observation),{ok:!0}}catch(J){let z=J instanceof Error?J.message:String(J);return this.deps.log?.warn("Pi login quota poll failed",{error:z}),{ok:!1,error:z}}})();return this.inflight=X,X.finally(()=>{if(this.inflight===X)this.inflight=void 0}),X}record($,Z,X){if(!this.owns(Z))return!1;let J=X1($,this.now(),X);if(J)this.merge(J);return!0}owns($){if(!this.token)return!1;let Z=B3($);return Z&&this.identity?Z===this.identity:$===this.token}merge($){try{let Z=s0(this.quota,$);if(t(Z))this.quota=Z}catch(Z){this.deps.log?.warn("Pi login quota observation not merged",{error:Z instanceof Error?Z.message:String(Z)})}}accountKey($,Z){if(Z)return`identity:${Z}`;return $?`token:${$}`:void 0}}import{homedir as BB}from"node:os";import{join as CX}from"node:path";function HB(){return process.env.PI_AGENT_DIR?.trim()||CX(BB(),".pi","agent")}function TX(){return process.env.PI_OPENAI_AUTH_FILE?.trim()||CX(HB(),a3)}function VB($=TX()){return process.env.PI_OPENAI_AUTH_STATE_FILE?.trim()||c8($)}function AX($=TX()){return{configPath:$,statePath:VB($)}}function R4($){return $!==void 0&&($.vault===!0||!!$.token)}function RX($,Z,X,J,z=new Set){return $.filter((G)=>{if(!G.candidate||G.type!=="oauth")return!1;if(G.credential?.type!=="oauth")return!1;if(l0(G.credential))return!1;if(G.id===D0)return!1;if(J&&G.identity===J)return!1;if(G.identity!==void 0&&z.has(G.identity))return!1;return b6(M$(G.quota),Z,X)})}function l6($,Z){let X=$.now(),J=KX(Z,$.storage,X);return{rows:Z.map((G)=>({id:G.id,kind:G.kind??"oauth",...t(G.quota)?{quota:G.quota}:{}})),now:X,rateLimitMarks:new Map,refreshBackoff:$.refreshBackoff(Z),killswitch:J,requestPull:$.requestPull}}async function SX($){let Z=$.accounts(),X=NX(l6($,Z),$.firstReadingWaitMs);if(X)await X,Z=$.accounts();if($.mode==="sticky-balanced"&&$.sessionId){let J=await UB($,Z,$.sessionId);if(J)return J}return jB($,Z)}async function jB($,Z){let X=DX($.mode),J=LX({...l6($,Z),placement:X});if(J.kind==="block")return $.log?.debug("pool admission blocked the request",{reason:J.block.reason}),{kind:"blocked",block:J.block};if(J.lastPath)$.log?.debug("pool admission: every account is exhausted; probing anyway",{order:J.order});let z=new Map(Z.map((H)=>[H.id,H])),G=z5($.storage),Q=[],Y=new Set,W;for(;;){let H=e6(J.order.filter((U)=>!Y.has(U)),Q,G);if(H===void 0)break;let B=z.get(H);if(!R4(B)){Y.add(H);continue}let V=await $.send(B);if(!V){Y.add(H);continue}W={attempt:V,accountId:B.id},Q.push({id:B.id,...V.status!==void 0?{status:V.status}:{}})}if(W)return{kind:"sent",...W};return{kind:"blocked",block:{reason:"no-credential"}}}async function UB($,Z,X){let J=$.requestBytes,z=new Map(Z.map((D)=>[D.id,D])),G=l6($,Z),Q=T4(G),Y={requestBytes:J,reservePercent:(D)=>P1($.storage,D===D0?void 0:D),resetCredits:()=>{return},onEmptyWeightedSet:()=>{$.log?.debug("sticky routing: no fresh weighted candidates; using configured order")}},W=(D,q,F)=>(C,L)=>{let N=new Set(C);return $.placePin({sessionId:X,requestBytes:J,validPinnedAccountIds:D.rows.map((P)=>P.id).filter((P)=>!q.excluded.has(P)),excludeAccountIds:C,quotaCheckedAtByAccount:Object.fromEntries(D.rows.map((P)=>[P.id,q.projections.get(P.id)?.checkedAt])),wireAccountIdByAccount:Object.fromEntries(F.map((P)=>[P.id,P.identity])),select:(P)=>PX(D,Y,N,P),persist:L})},H=W(G,Q,Z),B=H([],!0);if(!B)return;let V=B.accountId,U=(D)=>{let q=H([V],!0);if(!q)return!1;return $.log?.debug("sticky routing: migrated session pin",{fromAccountId:V,toAccountId:q.accountId,reason:D}),V=q.accountId,!0},K=OX(G,Y,V);if(K.kind==="none")return;if(K.kind==="move"){if(!U(K.reason)&&K.reason==="killswitch")return}else if(K.kind==="detour"){let D=H([V],!1);if(!D)return;$.log?.debug("sticky routing: pinned account awaits a quota reading",{pinnedAccountId:V,servedAccountId:D.accountId}),V=D.accountId}let j=z.get(V);if(!R4(j))return;let M=await $.send(j);if(!M)return;if(M.status===401||M.status===403||M.status===429){let D=$.accounts();G=l6($,D),Q=T4(G),H=W(G,Q,D);let q=_X(G,Q,V,M.status);if(q.action==="migrate"){let F=V;if(U(q.reason)&&V!==F){let C=D.find((N)=>N.id===V),L=R4(C)?await $.send(C):void 0;if(C&&L)M=L,j=C;else V=F}}}return{kind:"sent",attempt:M,accountId:j.id}}var KB=500,qB=15000;function d6($,Z,X){return new Promise((J,z)=>{let G=setTimeout(()=>J(X()),Z);G.unref?.(),$.then((Q)=>{clearTimeout(G),J(Q)},(Q)=>{clearTimeout(G),z(Q)})})}var DB={info(){},warn(){}};class S4{deps;now;log;snapshot={active:!1,rows:[],key:void 0,readAt:0};inflightRead;store;initializing;refreshing=new Map;backoff=new Map;rotated=new Map;pending=new Map;writes=new Map;lastPull=new Map;quotaPulls=new Map;polled=new Set;polledSnapshots=new Map;pollOutcomes=new Map;disposed=!1;constructor($){this.deps=$,this.now=$.now??Date.now,this.log=$.log??DB}peek(){return{active:this.snapshot.active,rows:this.snapshot.rows}}async current(){let $=this.filesKey();if(this.snapshot.key===$)return this.peek();let Z=await d6(this.startRead($),this.deps.readBudgetMs??KB,()=>this.snapshot);return{active:Z.active,rows:Z.rows}}async load(){let $=await this.startRead(this.filesKey());return{active:$.active,rows:$.rows}}poolStore(){return this.storeFor(this.deps.paths())}polledSnapshot($){return this.polledSnapshots.get($)}filesKey(){let $=this.deps.paths();return`${$.configPath}|${j4($.configPath)}|${j4($.statePath)}`}storeFor($){if(this.store?.configPath===$.configPath)return this.store.store;let Z=k8({provider:"openai",configPath:$.configPath,statePath:$.statePath,quota:n6,now:this.now,pull:(X)=>this.coalescedPull(X),onPullFailure:(X,J)=>{this.pollOutcomes.set(X,{id:X,ok:!1,error:J.message}),this.log.warn("pool quota poll failed",{rowId:X,kind:J.kind,error:J.message})},logger:this.log,...this.deps.store,onStep:async(X,J)=>{if(await this.deps.store?.onStep?.(X,J),J.operation!=="updateSettings"&&X.startsWith("before-")&&(this.deps.vaultAuthority?await this.deps.vaultAuthority()!=="local":this.setAside()))throw Error("Local account writes are disabled while connected to the vault.")}});return this.store={configPath:$.configPath,store:Z},Z}startRead($){if(this.inflightRead?.key===$)return this.inflightRead.promise;let Z=this.now(),X=this.read($,Z),J={key:$,promise:X};this.inflightRead=J;let z=()=>{if(this.inflightRead===J)this.inflightRead=void 0};return X.then(z,z),X}async read($,Z){let X=this.deps.paths(),J;try{J=await this.storeFor(X).read()}catch(G){return this.log.warn("account pool read failed",{error:G instanceof Error?G.message:String(G)}),this.snapshot}if(J.status==="pending-migration"){if(!this.setAside())this.initialize(X)}else if(J.status==="error")this.log.warn("account pool is unreadable",{file:J.file,reason:J.reason});let z=J.status==="ready"?{active:!0,rows:J.rows,key:$,readAt:Z}:{active:!1,rows:[],key:$,readAt:Z};if(Z>=this.snapshot.readAt)this.snapshot={...z,rows:this.withLocalState(z.rows)};if(this.snapshot.active)this.pollUnseenRows();return this.snapshot}initialize($){if(this.disposed||this.initializing?.configPath===$.configPath)return;let Z=this.storeFor($).initialize().then((X)=>{this.log.info("account pool initialized",{status:X.status})},(X)=>{if(this.log.warn("account pool initialization failed",{error:X instanceof Error?X.message:String(X)}),this.initializing?.promise===Z)this.initializing=void 0});this.initializing={configPath:$.configPath,promise:Z}}withLocalState($){let Z=this.now();return $.map((X)=>{let J=X,z=this.rotated.get(X.id);if(z?.type==="oauth"&&X.credential?.type==="oauth"){let G=X.credential.lastRefreshedAt??0,Q=z.lastRefreshedAt??0;if(G>=Q)this.rotated.delete(X.id);else J={...J,credential:z}}return h5(J,this.pending,Z)})}replaceRow($,Z){this.snapshot={...this.snapshot,rows:this.snapshot.rows.map((X)=>X.id===$?Z(X):X)}}pollUnseenRows(){if(this.disposed||this.setAside())return;for(let $ of this.snapshot.rows){let Z=$.torn===!0&&$.enabled;if(!($.candidate||Z)||$.type!=="oauth")continue;let X=`${$.id}\x00${$.credentialEpoch??0}\x00${$.identity??""}`;if(this.polled.has(X))continue;this.polled.add(X),this.requestReading($.id,!0)}}requestReading($,Z=!1){if(this.disposed||this.setAside())return;let X=this.now(),J=this.lastPull.get($);if(!Z&&J!==void 0&&X-J<(this.deps.pullRetryMs??qB))return this.storeFor(this.deps.paths()).pullsSettled();this.lastPull.set($,X);let z=this.storeFor(this.deps.paths());return z.requestReading($),z.pullsSettled()}coalescedPull($){let Z=JSON.stringify([this.deps.paths().configPath,$.id,$.credentialEpoch,$.identity]),X=this.quotaPulls.get(Z);if(X)return X;let J=this.pull($).finally(()=>this.quotaPulls.delete(Z));return this.quotaPulls.set(Z,J),J}async pull($){let Z;try{Z=await this.deps.pullQuota($)}catch(J){throw this.pollOutcomes.set($.id,{id:$.id,ok:!1,error:J instanceof Error?J.message:String(J)}),J}this.pollOutcomes.set($.id,{id:$.id,ok:!0}),this.polledSnapshots.set($.id,Z.snapshot);let X=this.snapshot.rows.find((J)=>J.id===$.id);if(X&&X.credentialEpoch===$.credentialEpoch&&X.identity===$.identity)this.applyObservation(X,Z.observation);return Z.observation}applyObservation($,Z){g5(this.pending,$,Z),this.replaceRow($.id,(X)=>({...X,quota:U4(X.quota,Z),needsFirstReading:!1}))}recordSnapshot($,Z,X,J){if(!this.snapshot.active||this.disposed||this.setAside())return;let z=this.snapshot.rows.find((U)=>U.id===$);if(z?.type!=="oauth")return;let G=B3(X);if(!(G&&z.identity?G===z.identity:l1(z)?.access===X))return;let Y=X1(Z,this.now(),J);if(!Y)return;if(this.applyObservation(z,Y),z.credentialEpoch===void 0)return;let W={credentialEpoch:z.credentialEpoch,...z.identity!==void 0?{identity:z.identity}:{}},H=this.storeFor(this.deps.paths()),V=(this.writes.get(z.id)??Promise.resolve()).then(async()=>{if(this.disposed||(this.deps.vaultAuthority?await this.deps.vaultAuthority()!=="local":this.setAside()))return;return H.recordQuota(z.id,W,Y)}).catch((U)=>{this.log.warn("pool quota not recorded",{rowId:z.id,error:U instanceof Error?U.message:String(U)})});this.writes.set(z.id,V),V.finally(()=>{if(this.writes.get(z.id)===V)this.writes.delete(z.id)})}rowForToken($){let Z=B3($);return this.snapshot.rows.find((X)=>Z&&X.identity?X.identity===Z:l1(X)?.access===$)}refreshDueTokens($,Z){if(this.setAside())return Promise.resolve();let X=this.now(),J=t2(Z),z=[];for(let G of $){if(!G.candidate)continue;let Q=l1(G);if(!Q)continue;let Y=(Q.expires??0)-X;if(!(!Q.access||!Q.expires||Y<=J)||this.refreshBackedOff(G,X))continue;z.push(this.refresh(G.id))}return Promise.all(z).then(()=>{})}refreshBackedOff($,Z=this.now()){let X=l1($);if(!X)return!1;let J=this.backoff.get($.id);return Boolean(J&&J.tokenHash===z$(X.refresh)&&J.nextRetryAt>Z)}usableToken($,Z=this.now()){if(this.setAside())return;let X=l1($);if(!X?.access.trim())return;if(typeof X.expires!=="number"||X.expires<=Z)return;return X.access}refresh($){let Z=this.refreshing.get($);if(Z)return Z;let X=this.runRefresh($).finally(()=>{if(this.refreshing.get($)===X)this.refreshing.delete($)});return this.refreshing.set($,X),X}async runRefresh($){let Z=this.snapshot.rows.find((J)=>J.id===$),X=Z?l1(Z)?.refresh:void 0;try{let J=await this.storeFor(this.deps.paths()).refresh($,this.deps.refreshProvider,{refuse:()=>this.setAside()?"vault-mode":void 0});if(this.setAside())return;if(J.status==="rotated"){this.backoff.delete($),this.rotated.set($,J.credential),this.replaceRow($,(z)=>({...z,credential:J.credential,...J.identity!==void 0&&z.identity===void 0?{identity:J.identity}:{}}));return}if(J.status==="identity-contradicted"){this.backoff.delete($),this.replaceRow($,(z)=>({...z,enabled:!1,candidate:!1})),this.log.warn("pool row disabled: its refresh returned a different account",{rowId:$});return}this.recordRefreshFailure($,X,Error(J.reason))}catch(J){this.recordRefreshFailure($,X,J)}}recordRefreshFailure($,Z,X){if(this.log.warn("pool row refresh failed",{rowId:$,error:X instanceof Error?X.message:String(X)}),!Z)return;this.backoff.set($,w5(Z,X,this.now(),this.backoff.get($)))}refreshBackoffFor($){return m5($,this.backoff,this.now(),(Z,X)=>this.usableToken(Z,X))}async pollRows($){if(this.setAside())return[];let Z=await this.load();if(!Z.active||this.disposed)return[];let X=Z.rows.filter((J)=>J.candidate&&J.type==="oauth");if(X.length===0)return[];await this.refreshDueTokens(X,$);for(let J of X)this.pollOutcomes.delete(J.id),this.requestReading(J.id,!0);return await this.poolStore().pullsSettled(),X.map((J)=>this.pollOutcomes.get(J.id)??{id:J.id,ok:!1,error:"the quota poll did not run"})}setAside(){return this.deps.vaultMode?.()===!0}dispose(){this.disposed=!0}async settled(){for(;;){let $=[...this.writes.values(),...this.refreshing.values(),...this.initializing?[this.initializing.promise]:[]];if(await Promise.allSettled($),await this.store?.store.pullsSettled(),this.writes.size===0&&this.refreshing.size===0)return}}}var MB=_4,LB=500,FB=64;function PB(){return{input:0,output:0,cacheRead:0,cacheWrite:0,totalTokens:0,cost:{input:0,output:0,cacheRead:0,cacheWrite:0,total:0}}}function H3($,Z){return{type:"error",reason:"error",error:{role:"assistant",content:[],api:$.api,provider:$.provider,model:$.id,usage:PB(),stopReason:"error",errorMessage:Z,timestamp:Date.now()}}}function OB($){let Z=$.resetAtMs!==void 0?` It resets at ${new Date($.resetAtMs).toISOString()}.`:"";switch($.reason){case"quota-unknown":return`No OpenAI account has a quota reading yet; one is being taken now. Try again in ${qX} seconds.`;case"quota-exhausted":return`Every OpenAI account has used up its quota.${Z}`;case"killswitch":return"Every OpenAI account is below its killswitch quota floor (see the Limits section of `/openai`).";case"mid-stream-rate-limit":return`Every OpenAI account is rate-limited.${Z}`;case"no-credential":return"No OpenAI account holds a usable sign-in. Sign in with `/login` or add an account with `/openai`."}}function _B($){for(let[Z,X]of Object.entries($)){if(Z.toLowerCase()!=="authorization")continue;return/^Bearer\s+(.+)$/i.exec(X.trim())?.[1]}return}class I4{main;pool;vault;deps;vaultTokens=new Map;now;paths;slot;slotVaultMode;slotNeedsRefresh=!1;slotQueue=Promise.resolve();storageCache;storageRead;constructor($){this.deps=$,this.now=$.now??Date.now,this.paths=$.paths??AX;let Z=()=>$.fetchImpl??globalThis.fetch;this.main=new A4({now:this.now,poll:async(X,J)=>{if(await this.readAuthority()!=="local")throw Error("Pi login quota polling is disabled while enrolled");let z=await q$({accessToken:X,fetchImpl:Z(),now:this.now,...J?{accountId:J}:{},accountKey:D0}),G=X1(z,this.now(),!0);if(!G)throw Error("the quota poll returned no reading");return{snapshot:z,observation:G}}}),this.pool=new S4({paths:this.paths,now:this.now,...$.readBudgetMs!==void 0?{readBudgetMs:$.readBudgetMs}:{},vaultMode:()=>this.vaultMode(),vaultAuthority:()=>this.readAuthority(),refreshProvider:async(X)=>{if(await this.readAuthority()!=="local")throw Error("Local token refresh is disabled while enrolled");let J=await i7({refreshToken:X.refresh,fetchImpl:Z(),now:this.now}),z=p$({id_token:"",access_token:J.access,refresh_token:J.refresh});return{...J,...z?{identity:z}:{}}},pullQuota:async(X)=>{if(await this.readAuthority()!=="local")throw Error("Local quota polling is disabled while enrolled");let J=X.credential;if(J.type!=="oauth"||!J.access)throw Error("the row holds no access token to poll with");let z=await q$({accessToken:J.access,fetchImpl:Z(),now:this.now,...X.identity?{accountId:X.identity}:{},accountKey:X.id}),G=X1(z,this.now(),!0);if(!G)throw Error("the quota poll returned no reading");return{snapshot:z,observation:G}}}),this.vault=$.vault??new $4({host:"pi",stateDir:E6(this.paths().statePath),reservedRouteIds:()=>this.pool.peek().rows.map((X)=>X.id),fetchImpl:Z,now:this.now})}vaultMode(){return this.vault.enrolled()}readAuthority(){return this.vault.authority()}vaultSlot(){return this.slot??=this.deps.slot??HX(this.paths().statePath),this.slot}withSlot($){let Z=this.slotQueue.then($);return this.slotQueue=Z.catch(()=>{this.slotVaultMode=void 0}),Z}syncVaultSlot($,Z=!1){return this.withSlot(async()=>{if(await this.reconcileSlot(Z),this.slotNeedsRefresh&&$)await $(),this.slotNeedsRefresh=!1})}disconnectVault(){return this.withSlot(async()=>{this.slotVaultMode=void 0;try{let $=await this.vaultSlot().exitVault();return this.slotNeedsRefresh=!0,await this.vault.disconnect(),$}finally{await this.reconcileSlot()}})}async reconcileSlot($=!1){let Z=await this.readAuthority()!=="local";if(Z===this.slotVaultMode&&!$)return;let X=this.slotVaultMode;this.slotVaultMode=void 0;let J=await this.vaultSlot().inspect();if(Z)await this.vaultSlot().enterVault();else await this.vaultSlot().exitVault();this.slotNeedsRefresh=Z&&J.slot!=="placeholder"||!Z&&J.slot==="placeholder"||X!==void 0&&Z!==X||this.slotNeedsRefresh;let z=await this.readAuthority()!=="local";if(z!==Z){if(z)await this.vaultSlot().enterVault();else await this.vaultSlot().exitVault();this.slotNeedsRefresh=!0}this.slotVaultMode=z}async start(){return await this.readAuthority(),this.vault.start(),this.pool.load().then(()=>{},()=>{})}async storage(){let $=this.paths(),Z;try{let X=NB($.configPath);Z=`${$.configPath}|${X.ino}:${X.size}:${X.mtimeMs}`}catch{Z=`${$.configPath}|-`}if(this.storageCache?.key===Z)return this.storageCache.storage;if(this.storageRead?.key!==Z){let X=r2($).then((J)=>{return this.storageCache={key:Z,storage:J},J},()=>this.storageCache?.storage??null);this.storageRead={key:Z,promise:X}}return d6(this.storageRead.promise,this.deps.readBudgetMs??LB,()=>this.storageCache?.storage??null)}accounts($){let Z=[];if(!this.vaultMode())this.localAccounts($,Z);for(let X of this.vault.routes())Z.push({id:X.id,token:void 0,kind:X.kind,vault:!0,...X.identity?{identity:X.identity}:{},...X.quota!==void 0?{quota:X.quota}:{}});return Z}localAccounts($,Z){let X=this.main.currentToken(),J=this.main.currentIdentity(),z=this.vault.identities();if(X&&!(J!==void 0&&z.has(J))){let Y=this.main.quotaMap();Z.push({id:D0,token:X,...J?{identity:J}:{},...Y?{quota:Y}:{}})}let G=this.pool.peek(),Q=this.now();if(G.active)for(let Y of RX(G.rows,$,Q,J,z))Z.push({id:Y.id,token:this.pool.usableToken(Y,Q),...Y.identity?{identity:Y.identity}:{},...Y.quota!==void 0?{quota:Y.quota}:{}})}poolRowById($){return this.pool.peek().rows.find((Z)=>Z.id===$)}requestPull($){if($===D0)return this.main.requestReading();if(this.vault.owns($))return this.vault.requestReading($);return this.pool.requestReading($)}rememberVaultToken($,Z){this.vaultTokens.delete($),this.vaultTokens.set($,Z);while(this.vaultTokens.size>FB){let X=this.vaultTokens.keys().next().value;if(X===void 0)break;this.vaultTokens.delete(X)}}recordHeaders($,Z,X){let J=new Headers(X),z=_Z(J),G=CZ(J),Q=this.vaultTokens.get(Z);if(Q?.id===$)this.vault.recordSnapshot($,z,G,Q.receipt);else if($===D0)this.main.record(z,Z,G);else this.pool.recordSnapshot($,z,Z,G)}recordRateLimitFrame($,Z){let X=this.vaultTokens.get($);if(X){this.vault.recordSnapshot(X.id,Z,!0,X.receipt);return}if(this.main.record(Z,$,!0))return;let J=this.pool.rowForToken($);if(J)this.pool.recordSnapshot(J.id,Z,$,!0)}observeWebSocketMessage($,Z){if(!Z.includes("codex.rate_limits"))return;let X=_B($);if(!X)return;let J;try{J=JSON.parse(Z)}catch{return}if(!J||typeof J!=="object"||J.type!=="codex.rate_limits")return;this.recordRateLimitFrame(X,TZ(J))}stream($,Z,X){let J=this.deps.createStream(),z=this.deps.installWebSocket?.()??(()=>{});return(async()=>{try{if(await this.readAuthority()!=="local"&&X?.apiKey!==W3){J.push(H3($,WX));return}let G=await this.route($,Z,X);if(G.kind==="blocked"){J.push(H3($,G.refusal?U5[G.refusal]:OB(G.block)));return}if(G.head)J.push(G.head);if(G.rest)for(;;){let Q=await G.rest.next();if(Q.done)break;J.push(Q.value)}}catch(G){J.push(H3($,T1(G,X?.apiKey).message))}finally{J.end(),z()}})(),J}async route($,Z,X){let J=await this.storage(),z=await this.readAuthority()!=="local";if(z)await d6(this.vault.firstRoster().then(()=>!0),k6,()=>!1);else this.main.observeToken(X?.apiKey),await this.pool.current(),this.pool.refreshDueTokens(this.pool.peek().rows,J);let G=J?.routing?.mode??"main-first",Q=!1,Y=0,H=await(()=>SX({accounts:()=>{let B=this.accounts(J);return Y=B.length,B},storage:J,mode:G,sessionId:X?.sessionId,requestBytes:Buffer.byteLength(JSON.stringify(Z),"utf8"),now:this.now,refreshBackoff:(B)=>this.pool.refreshBackoffFor(B.map((V)=>this.poolRowById(V.id)).filter((V)=>V!==void 0)),requestPull:(B)=>this.requestPull(B),firstReadingWaitMs:this.deps.firstReadingWaitMs??MB,send:(B)=>B.vault?this.vaultAttempt($,Z,X,B.id).then((V)=>{if(!V)Q=!0;return V}):B.token?this.attempt($,Z,X,B.id,B.token):Promise.resolve(void 0),placePin:r5}))();if(H.kind==="blocked"){if(z&&(Y===0||Q))return{...H,refusal:Q?"vault-refused":K5(this.vault)};if(z&&H.block.reason==="no-credential")return{...H,refusal:"vault-empty"};return H}return{kind:"sent",...H.attempt}}async attempt($,Z,X,J,z){let G,Q;try{let B=X?.fetch??globalThis.fetch;Q=this.deps.streamSimple($,Z,{...X,apiKey:z,fetch:Object.assign(async(V,U)=>{try{return await s5(await B(V,U),z,"event-stream")}catch(K){throw T1(K,z)}},B),onResponse:async(V,U)=>{G=V.status,this.recordHeaders(J,z,V.headers),await X?.onResponse?.(V,U)}})}catch(B){return{head:H3($,T1(B,z).message),rest:void 0}}let Y=async function*(){try{for await(let B of Q){if(B.type==="error")B.error.errorMessage=C1(B.error.errorMessage??"",z);yield B}}catch(B){yield H3($,T1(B,z).message)}}(),W=await Y.next(),H=W.done?void 0:W.value;return{...G!==void 0?{status:G}:{},head:H,rest:W.done||H?.type==="error"?void 0:Y}}async vaultAttempt($,Z,X,J){let z;return await this.vault.send(J,async(Q,Y)=>{return this.rememberVaultToken(Q,{id:J,receipt:{credentialId:Y.credentialId,accountIdentitySource:Y.accountIdentitySource,...Y.accountIdentity!==void 0?{accountIdentity:Y.accountIdentity}:{},...Y.expectedAccountIdentity!==void 0?{expectedAccountIdentity:Y.expectedAccountIdentity}:{}}}),z=await this.attempt($,Z,X,J,Q),new Response(null,{status:z.status??200})},{site:"model",...X?.signal?{signal:X.signal}:{}})?z:void 0}commandSupport(){return{vaultMode:()=>this.vaultMode(),readAuthority:()=>this.readAuthority(),syncVaultSlot:($,Z)=>this.syncVaultSlot($,Z),disconnectVault:()=>this.disconnectVault(),observeLogin:async($)=>{if(await this.readAuthority()==="local")this.main.observeToken($)},store:()=>this.pool.poolStore(),mainIdentity:()=>this.main.currentIdentity(),mainQuota:()=>this.main.quotaSnapshot(),reload:()=>this.pool.load(),vault:this.vault,refreshAllQuota:async()=>{let $=await this.readAuthority()==="local"?await this.storage():null;if(await this.readAuthority()!=="local")return(await this.vault.pollStale(0)).map((G)=>({account:G.id,ok:G.ok,...G.error?{error:G.error}:{}}));let[Z,X,J]=await Promise.all([this.main.currentToken()?this.main.pollNow():void 0,this.pool.pollRows($),this.vault.pollStale(0)]),z=[];if(Z)z.push({account:D0,ok:Z.ok,...Z.error?{error:Z.error}:{}});for(let G of[...X,...J])z.push({account:G.id,ok:G.ok,...G.error?{error:G.error}:{}});return z}}}}var j3="https://chatgpt.com/backend-api",xX;class b4 extends O4{constructor($,Z){let X=Z&&typeof Z==="object"&&!Array.isArray(Z)?Z.headers??{}:{};super(String($),X);let J=xX;if(J)this.addEventListener("message",(z)=>{let G=z?.data;if(typeof G==="string")J(X,G)})}}var V3=0,x4;function AB(){let $=globalThis;if(V3===0)x4=$.WebSocket,$.WebSocket=b4;return V3++,()=>{if(V3=Math.max(0,V3-1),V3===0){if($.WebSocket===b4)$.WebSocket=x4;x4=void 0}}}var RB=[{id:"gpt-5.5",name:"GPT-5.5",api:"openai-codex-responses",provider:"openai-codex",baseUrl:j3,reasoning:!0,thinkingLevelMap:{xhigh:"xhigh",minimal:"low"},input:["text","image"],cost:{input:5,output:30,cacheRead:0.5,cacheWrite:0},contextWindow:272000,maxTokens:128000},{id:"gpt-5.4",name:"GPT-5.4",api:"openai-codex-responses",provider:"openai-codex",baseUrl:j3,reasoning:!0,thinkingLevelMap:{xhigh:"xhigh",minimal:"low"},input:["text","image"],cost:{input:2.5,output:15,cacheRead:0.25,cacheWrite:0},contextWindow:272000,maxTokens:128000},{id:"gpt-5.4-mini",name:"GPT-5.4 mini",api:"openai-codex-responses",provider:"openai-codex",baseUrl:j3,reasoning:!0,thinkingLevelMap:{xhigh:"xhigh",minimal:"low"},input:["text","image"],cost:{input:0.75,output:4.5,cacheRead:0.075,cacheWrite:0},contextWindow:272000,maxTokens:128000},{id:"gpt-5.3-codex-spark",name:"GPT-5.3 Codex Spark",api:"openai-codex-responses",provider:"openai-codex",baseUrl:j3,reasoning:!0,thinkingLevelMap:{xhigh:"xhigh",minimal:"low"},input:["text"],cost:{input:1.75,output:14,cacheRead:0.175,cacheWrite:0},contextWindow:128000,maxTokens:128000}],SB=5000;function IX($,Z){$.registerProvider("openai-codex",{baseUrl:j3,api:"openai-codex-responses",name:"OpenAI Codex (CortexKit)",...Z.vaultMode()?{apiKey:W3}:{},models:RB,streamSimple:(X,J,z)=>Z.stream(X,J,z)})}function IB(){return new I4({streamSimple:($,Z,X)=>TB($,Z,X),createStream:CB,installWebSocket:AB})}async function xB($){let Z=IB();xX=(Q,Y)=>Z.observeWebSocketMessage(Q,Y);let X,J,z=(Q=!0)=>Z.syncVaultSlot(X?async()=>{IX($,Z),await X?.()}:void 0,Q),G=()=>{z(!1).catch(()=>{J?.("Pi could not load the vault login slot. Reopen the session or disconnect in /openai.","error")})};if(VX($,{pool:Z.commandSupport(),afterApply:z,onContext:(Q)=>{X=()=>Q.modelRegistry.refresh(),J=(Y,W)=>Q.ui.notify(Y,W)}}),await z().catch(()=>{}),IX($,Z),setInterval(G,SB).unref?.(),typeof $.on==="function")$.on("session_start",async(Q,Y)=>{X=()=>Y.modelRegistry.refresh(),J=(W,H)=>Y.ui.notify(W,H),Z.start();try{await z()}catch{J("Pi could not load the vault login slot. Reopen the session or disconnect in /openai.","error");return}if(Z.vaultMode())return;try{await Z.commandSupport().observeLogin(await Y.modelRegistry.getApiKeyForProvider("openai-codex"))}catch{}})}export{IX as registerPiProvider,AB as installRawCodexWebSocket,xB as default,IB as createPiOpenAIRuntime};
+`);if(X===-1)return;let J=Z.slice(0,X),G=J.split(`\r
+`)[0]??"",z=J.match(/sec-websocket-accept:\s*(\S+)/i);if(!G.includes(" 101")){this.readyState=3,this.socket?.destroy?.(),this.log("upgrade_failed",{statusLine:G}),this.emit("error",{message:`WS upgrade failed: ${G}`});return}if(!z||z[1]!==this.expectedAccept){this.readyState=3,this.socket?.destroy?.(),this.log("accept_mismatch",{statusLine:G}),this.emit("error",{message:"WS upgrade Sec-WebSocket-Accept mismatch"});return}this.handshakeDone=!0,this.readyState=1,this.rxBuffer=this.rxBuffer.slice(X+4),this.log("open",{statusLine:G}),this.emit("open",{})}this.drainFrames()}drainFrames(){for(;;){let $=this.rxBuffer;if($.length<2)return;let Z=$[0],X=$[1],J=(Z&128)!==0,G=Z&15,z=(X&128)!==0,B=X&127,Q=2;if(B===126){if($.length<4)return;B=$[2]<<8|$[3],Q=4}else if(B===127){if($.length<10)return;B=0;for(let H=0;H<8;H++)B=B*256+$[2+H];Q=10}if(z)Q+=4;if($.length<Q+B)return;let Y=$.slice(Q,Q+B);this.rxBuffer=$.slice(Q+B),this.handleFrame(J,G,Y)}}handleFrame($,Z,X){if(Z===9){this.writeFrame(10,X);return}if(Z===10)return;if(Z===8){let G=1005,z="";if(X.length>=2)G=X[0]<<8|X[1],z=Buffer.from(X.slice(2)).toString("utf-8");this.readyState=3;try{this.socket?.end()}catch{}this.emit("close",{code:G,reason:z});return}if(Z===1||Z===2)this.fragOpcode=Z,this.fragChunks=[X];else if(Z===0)this.fragChunks.push(X);if(!$)return;let J=yB(this.fragChunks);if(this.fragChunks=[],this.fragOpcode===1){let G=Buffer.from(J).toString("utf-8");this.emit("message",{data:G})}}send($){if(this.readyState!==1)return;this.writeFrame(1,new TextEncoder().encode($))}writeFrame($,Z){let X=Z.length,J=crypto.getRandomValues(new Uint8Array(4)),G;if(X<126)G=[128|$,128|X];else if(X<65536)G=[128|$,254,X>>8&255,X&255];else{G=[128|$,255];for(let Q=7;Q>=0;Q--)G.push(X/2**(8*Q)&255)}let z=new Uint8Array(X);for(let Q=0;Q<X;Q++)z[Q]=Z[Q]^J[Q%4];let B=new Uint8Array(G.length+4+X);B.set(G,0),B.set(J,G.length),B.set(z,G.length+4);try{this.socket?.write(B)}catch{}}close(){if(this.readyState===3)return;this.readyState=2;try{this.writeFrame(8,new Uint8Array([3,232])),this.socket?.end()}catch{}this.readyState=3}log($,Z){return Promise.resolve()}}function xB($){return $}function kB($,Z){let X=new Uint8Array($.length+Z.length);return X.set($,0),X.set(Z,$.length),X}function yB($){let Z=0;for(let G of $)Z+=G.length;let X=new Uint8Array(Z),J=0;for(let G of $)X.set(G,J),J+=G.length;return X}import{statSync as dB}from"node:fs";var V0="main";function s7($,Z,X){let J=new Map;if(t3(Z))for(let G of $)J.set(G.id,y2(J$(G.quota),Z,G.id===V0?void 0:G.id,X));return J}var i7=5,P8=5000;function a7($){if($==="ordered")return"roster";return $==="fallback-first"?"fallback-first":"main-first"}function n7($,Z=P8){let X=$.rows.filter((B)=>B.kind==="oauth"&&$.killswitch.get(B.id)!==!1&&c(B.quota).limits.length===0);if(X.length===0)return;if(h0({rows:$.rows,now:$.now,rateLimitMarks:$.rateLimitMarks,refreshBackoff:$.refreshBackoff,requestPull:()=>{}}).admitted.some((B)=>$.killswitch.get(B.id)!==!1))return;let G=[];if(h0({rows:X,now:$.now,rateLimitMarks:$.rateLimitMarks,refreshBackoff:$.refreshBackoff,requestPull:(B)=>{let Q=$.requestPull(B);if(Q)G.push(Q.catch(()=>{}))}}),G.length===0)return;let z;return Promise.race([Promise.all(G),new Promise((B)=>{z=setTimeout(B,Z)})]).then(()=>{}).finally(()=>clearTimeout(z))}function T8($){return $.reason==="exhausted"||$.reason==="budget-spent"}function r7($,Z,X){if($===void 0)return{reason:"no-credential"};if(X.get($)===!1)return{reason:"killswitch"};let J=Z.excluded.find((z)=>z.id===$);if(J?.reason==="rate-limited")return{reason:"mid-stream-rate-limit",resetAtMs:J.until};if(J)return{reason:"no-credential"};let G=Z.refused.find((z)=>z.id===$);if(G&&"resetAtMs"in G)return{reason:"quota-exhausted",resetAtMs:G.resetAtMs};if(G)return{reason:"quota-unknown"};return{reason:"no-credential"}}function c7($,Z,X){if(Z.refused.find((G)=>!T8(G)&&X.get(G.id)!==!1))return{reason:"quota-unknown"};return r7($[0],Z,X)}function o7($){let Z=$.replayable!==!1,X=Z?$.placement:"main-first",J=MZ({rows:$.rows,placement:X,formerMainId:V0,killswitch:$.killswitch,rateLimitMarks:$.rateLimitMarks,refreshBackoff:$.refreshBackoff,now:$.now,requestPull:$.requestPull}),G=y1($.rows.map((Q)=>Q.id),X,V0),z=new Set(J.admission.refused.filter((Q)=>T8(Q)&&$.killswitch.get(Q.id)!==!1).map((Q)=>Q.id)),B=G.filter((Q)=>z.has(Q));if(!Z){let Q=G.includes(V0),Y=Q?V0:J.order[0]??B[0];if(Y!==void 0&&J.order.includes(Y))return{kind:"send",order:[Y],lastPath:!1};if(Y!==void 0&&z.has(Y))return{kind:"send",order:[Y],lastPath:!0};return{kind:"block",block:Q?r7(V0,J.admission,$.killswitch):c7(G,J.admission,$.killswitch)}}if(J.order.length>0)return{kind:"send",order:J.order,lastPath:!1};if(B.length>0)return{kind:"send",order:B,lastPath:!0};return{kind:"block",block:c7(G,J.admission,$.killswitch)}}function A8($){let Z=h0({rows:$.rows,rateLimitMarks:$.rateLimitMarks,refreshBackoff:$.refreshBackoff,now:$.now,requestPull:$.requestPull}),X=new Map;for(let J of $.rows)X.set(J.id,c(J.quota));for(let J of Z.admitted)if(J.projection)X.set(J.id,J.projection);return{projections:X,excluded:new Set(Z.excluded.map((J)=>J.id))}}function t7($,Z,X){let J=X.exclude,G=J?$.rows.filter((B)=>!J.has(B.id)):$.rows,z=new Map;for(let B of G){let Q=Z.resetCredits(B.id);if(Q!==void 0)z.set(B.id,Q)}return TZ({rows:G,now:$.now,rateLimitMarks:$.rateLimitMarks,refreshBackoff:$.refreshBackoff,requestPull:$.requestPull,killswitch:$.killswitch,requestBytes:Z.requestBytes,...X.pendingBytes?{pendingBytes:X.pendingBytes}:{},rowReservePercent:(B)=>Z.reservePercent(B.id),refusedPinPolicy:"move-on-confirmed-exhaustion",resetCreditsApplicable:z,...X.pin===void 0?{}:{pin:{accountId:X.pin}},...Z.onEmptyWeightedSet?{onEmptyWeightedSet:Z.onEmptyWeightedSet}:{}})}function e7($,Z,X,J){let G=t7($,Z,{exclude:X,pendingBytes:J});if(G.outcome!=="dispatch"||G.source==="pin")return;return{accountId:G.accountId,source:G.source,...G.quotaCheckedAt===void 0?{}:{quotaCheckedAt:G.quotaCheckedAt}}}function $5($,Z,X){let J=$.killswitch.get(X)===!1,G=t7($,Z,{pin:X});if(G.outcome==="dispatch"){if(G.pin.action==="assign")return{kind:"move",reason:J?"killswitch":"exhausted"};return G.accountId===X?{kind:"serve"}:{kind:"detour"}}let z=G.admission.refused.find((B)=>B.id===X);if(!J&&z&&T8(z))return{kind:"last-path"};return{kind:"none"}}function Z5($,Z,X,J){let G=$.killswitch.get(X);return PZ({quota:Z.projections.get(X),now:$.now,...J===void 0?{}:{status:J},...G===void 0?{}:{killswitchPasses:G}})}var fB=15000;function c$($){if(!$)return;let Z=n1($);return Z?r1(Z):void 0}class S8{deps;now;token;identity;quota;snapshot;firstPolledFor;inflight;lastPull;constructor($){this.deps=$,this.now=$.now??Date.now}observeToken($){if(!$)return;let Z=c$($);if(this.token!==void 0&&this.accountKey(this.token,this.identity)!==this.accountKey($,Z))this.quota=void 0,this.snapshot=void 0;this.token=$,this.identity=Z;let X=this.accountKey($,Z);if(this.firstPolledFor!==X)this.firstPolledFor=X,this.pollNow()}currentToken(){return this.token}currentIdentity(){return this.identity}quotaMap(){return this.quota}quotaSnapshot(){let $=J$(this.quota);if(!$&&!this.snapshot)return;return{...this.snapshot?.resetCreditsAvailable!==void 0?{resetCreditsAvailable:this.snapshot.resetCreditsAvailable}:{},...this.snapshot?.spendControl?{spendControl:this.snapshot.spendControl}:{},...$}}requestReading($=!1){let Z=this.now();if(!$&&this.lastPull!==void 0&&Z-this.lastPull<(this.deps.pullRetryMs??fB))return this.inflight;return this.pollNow()}pending(){return this.inflight}pollNow(){if(this.inflight)return this.inflight;let $=this.token;if(!$)return Promise.resolve({ok:!1,error:"Pi holds no OpenAI login"});let Z=this.identity;this.lastPull=this.now();let X=(async()=>{try{let J=await this.deps.poll($,Z);if(this.accountKey(this.token,this.identity)!==this.accountKey($,Z))return{ok:!0};return this.snapshot=J.snapshot,this.merge(J.observation),{ok:!0}}catch(J){let G=J instanceof Error?J.message:String(J);return this.deps.log?.warn("Pi login quota poll failed",{error:G}),{ok:!1,error:G}}})();return this.inflight=X,X.finally(()=>{if(this.inflight===X)this.inflight=void 0}),X}record($,Z,X){if(!this.owns(Z))return!1;let J=R0($,this.now(),X);if(J)this.merge(J);return!0}owns($){if(!this.token)return!1;let Z=c$($);return Z&&this.identity?Z===this.identity:$===this.token}merge($){try{let Z=E0(this.quota,$);if(B0(Z))this.quota=Z}catch(Z){this.deps.log?.warn("Pi login quota observation not merged",{error:Z instanceof Error?Z.message:String(Z)})}}accountKey($,Z){if(Z)return`identity:${Z}`;return $?`token:${$}`:void 0}}import{homedir as gB}from"node:os";import{join as X5}from"node:path";function hB(){return process.env.PI_AGENT_DIR?.trim()||X5(gB(),".pi","agent")}function J5(){return process.env.PI_OPENAI_AUTH_FILE?.trim()||X5(hB(),k6)}function vB($=J5()){return process.env.PI_OPENAI_AUTH_STATE_FILE?.trim()||j3($)}function G5($=J5()){return{configPath:$,statePath:vB($)}}function R8($){return $!==void 0&&($.vault===!0||!!$.token)}function z5($,Z,X,J,G=new Set){return $.filter((z)=>{if(!z.candidate||z.type!=="oauth")return!1;if(z.credential?.type!=="oauth")return!1;if(k0(z.credential))return!1;if(z.id===V0)return!1;if(J&&z.identity===J)return!1;if(z.identity!==void 0&&G.has(z.identity))return!1;return o6(J$(z.quota),Z,X)})}function QZ($,Z){let X=$.now(),J=s7(Z,$.storage,X);return{rows:Z.map((z)=>({id:z.id,kind:z.kind??"oauth",...B0(z.quota)?{quota:z.quota}:{}})),now:X,rateLimitMarks:new Map,refreshBackoff:$.refreshBackoff(Z),killswitch:J,requestPull:$.requestPull}}async function B5($){let Z=$.accounts(),X=n7(QZ($,Z),$.firstReadingWaitMs);if(X)await X,Z=$.accounts();if($.mode==="sticky-balanced"&&$.sessionId){let J=await wB($,Z,$.sessionId);if(J)return J}return mB($,Z)}async function mB($,Z){let X=a7($.mode),J=o7({...QZ($,Z),placement:X});if(J.kind==="block")return $.log?.debug("pool admission blocked the request",{reason:J.block.reason}),{kind:"blocked",block:J.block};if(J.lastPath)$.log?.debug("pool admission: every account is exhausted; probing anyway",{order:J.order});let G=new Map(Z.map((H)=>[H.id,H])),z=k2($.storage),B=[],Q=new Set,Y;for(;;){let H=FZ(J.order.filter((j)=>!Q.has(j)),B,z);if(H===void 0)break;let W=G.get(H);if(!R8(W)){Q.add(H);continue}let U=await $.send(W);if(!U){Q.add(H);continue}Y={attempt:U,accountId:W.id},B.push({id:W.id,...U.status!==void 0?{status:U.status}:{}})}if(Y)return{kind:"sent",...Y};return{kind:"blocked",block:{reason:"no-credential"}}}async function wB($,Z,X){let J=$.requestBytes,G=new Map(Z.map((q)=>[q.id,q])),z=QZ($,Z),B=A8(z),Q={requestBytes:J,reservePercent:(q)=>H1($.storage,q===V0?void 0:q),resetCredits:()=>{return},onEmptyWeightedSet:()=>{$.log?.debug("sticky routing: no fresh weighted candidates; using configured order")}},Y=(q,M,P)=>(E,F)=>{let D=new Set(E);return $.placePin({sessionId:X,requestBytes:J,validPinnedAccountIds:q.rows.map((L)=>L.id).filter((L)=>!M.excluded.has(L)),excludeAccountIds:E,quotaCheckedAtByAccount:Object.fromEntries(q.rows.map((L)=>[L.id,M.projections.get(L.id)?.checkedAt])),wireAccountIdByAccount:Object.fromEntries(P.map((L)=>[L.id,L.identity])),select:(L)=>e7(q,Q,D,L),persist:F})},H=Y(z,B,Z),W=H([],!0);if(!W)return;let U=W.accountId,j=(q)=>{let M=H([U],!0);if(!M)return!1;return $.log?.debug("sticky routing: migrated session pin",{fromAccountId:U,toAccountId:M.accountId,reason:q}),U=M.accountId,!0},K=$5(z,Q,U);if(K.kind==="none")return;if(K.kind==="move"){if(!j(K.reason)&&K.reason==="killswitch")return}else if(K.kind==="detour"){let q=H([U],!1);if(!q)return;$.log?.debug("sticky routing: pinned account awaits a quota reading",{pinnedAccountId:U,servedAccountId:q.accountId}),U=q.accountId}let V=G.get(U);if(!R8(V))return;let N=await $.send(V);if(!N)return;if(N.status===401||N.status===403||N.status===429){let q=$.accounts();z=QZ($,q),B=A8(z),H=Y(z,B,q);let M=Z5(z,B,U,N.status);if(M.action==="migrate"){let P=U;if(j(M.reason)&&U!==P){let E=q.find((D)=>D.id===U),F=R8(E)?await $.send(E):void 0;if(E&&F)N=F,V=E;else U=P}}}return{kind:"sent",attempt:N,accountId:V.id}}var pB=500,uB=15000;function YZ($,Z,X){return new Promise((J,G)=>{let z=setTimeout(()=>J(X()),Z);z.unref?.(),$.then((B)=>{clearTimeout(z),J(B)},(B)=>{clearTimeout(z),G(B)})})}var lB={info(){},warn(){}};class E8{deps;now;log;snapshot={active:!1,rows:[],key:void 0,readAt:0};inflightRead;store;initializing;refreshing=new Map;backoff=new Map;rotated=new Map;pending=new Map;writes=new Map;lastPull=new Map;quotaPulls=new Map;polled=new Set;polledSnapshots=new Map;pollOutcomes=new Map;disposed=!1;constructor($){this.deps=$,this.now=$.now??Date.now,this.log=$.log??lB}peek(){return{active:this.snapshot.active,rows:this.snapshot.rows}}async current(){let $=this.filesKey();if(this.snapshot.key===$)return this.peek();let Z=await YZ(this.startRead($),this.deps.readBudgetMs??pB,()=>this.snapshot);return{active:Z.active,rows:Z.rows}}async load(){let $=await this.startRead(this.filesKey());return{active:$.active,rows:$.rows}}poolStore(){return this.storeFor(this.deps.paths())}polledSnapshot($){return this.polledSnapshots.get($)}filesKey(){let $=this.deps.paths();return`${$.configPath}|${j8($.configPath)}|${j8($.statePath)}`}storeFor($){if(this.store?.configPath===$.configPath)return this.store.store;let Z=Z3({provider:"openai",configPath:$.configPath,statePath:$.statePath,quota:DZ,now:this.now,pull:(X)=>this.coalescedPull(X),onPullFailure:(X,J)=>{this.pollOutcomes.set(X,{id:X,ok:!1,error:J.message}),this.log.warn("pool quota poll failed",{rowId:X,kind:J.kind,error:J.message})},logger:this.log,...this.deps.store,onStep:async(X,J)=>{if(await this.deps.store?.onStep?.(X,J),J.operation!=="updateSettings"&&X.startsWith("before-")&&(this.deps.vaultAuthority?await this.deps.vaultAuthority()!=="local":this.setAside()))throw Error("Local account writes are disabled while connected to the vault.")}});return this.store={configPath:$.configPath,store:Z},Z}startRead($){if(this.inflightRead?.key===$)return this.inflightRead.promise;let Z=this.now(),X=this.read($,Z),J={key:$,promise:X};this.inflightRead=J;let G=()=>{if(this.inflightRead===J)this.inflightRead=void 0};return X.then(G,G),X}async read($,Z){let X=this.deps.paths(),J;try{J=await this.storeFor(X).read()}catch(z){return this.log.warn("account pool read failed",{error:z instanceof Error?z.message:String(z)}),this.snapshot}if(J.status==="pending-migration"){if(!this.setAside())this.initialize(X)}else if(J.status==="error")this.log.warn("account pool is unreadable",{file:J.file,reason:J.reason});let G=J.status==="ready"?{active:!0,rows:J.rows,key:$,readAt:Z}:{active:!1,rows:[],key:$,readAt:Z};if(Z>=this.snapshot.readAt)this.snapshot={...G,rows:this.withLocalState(G.rows)};if(this.snapshot.active)this.pollUnseenRows();return this.snapshot}initialize($){if(this.disposed||this.initializing?.configPath===$.configPath)return;let Z=this.storeFor($).initialize().then((X)=>{this.log.info("account pool initialized",{status:X.status})},(X)=>{if(this.log.warn("account pool initialization failed",{error:X instanceof Error?X.message:String(X)}),this.initializing?.promise===Z)this.initializing=void 0});this.initializing={configPath:$.configPath,promise:Z}}withLocalState($){let Z=this.now();return $.map((X)=>{let J=X,G=this.rotated.get(X.id);if(G?.type==="oauth"&&X.credential?.type==="oauth"){let z=X.credential.lastRefreshedAt??0,B=G.lastRefreshedAt??0;if(z>=B)this.rotated.delete(X.id);else J={...J,credential:G}}return q7(J,this.pending,Z)})}replaceRow($,Z){this.snapshot={...this.snapshot,rows:this.snapshot.rows.map((X)=>X.id===$?Z(X):X)}}pollUnseenRows(){if(this.disposed||this.setAside())return;for(let $ of this.snapshot.rows){let Z=$.torn===!0&&$.enabled;if(!($.candidate||Z)||$.type!=="oauth")continue;let X=`${$.id}\x00${$.credentialEpoch??0}\x00${$.identity??""}`;if(this.polled.has(X))continue;this.polled.add(X),this.requestReading($.id,!0)}}requestReading($,Z=!1){if(this.disposed||this.setAside())return;let X=this.now(),J=this.lastPull.get($);if(!Z&&J!==void 0&&X-J<(this.deps.pullRetryMs??uB))return this.storeFor(this.deps.paths()).pullsSettled();this.lastPull.set($,X);let G=this.storeFor(this.deps.paths());return G.requestReading($),G.pullsSettled()}coalescedPull($){let Z=JSON.stringify([this.deps.paths().configPath,$.id,$.credentialEpoch,$.identity]),X=this.quotaPulls.get(Z);if(X)return X;let J=this.pull($).finally(()=>this.quotaPulls.delete(Z));return this.quotaPulls.set(Z,J),J}async pull($){let Z;try{Z=await this.deps.pullQuota($)}catch(J){throw this.pollOutcomes.set($.id,{id:$.id,ok:!1,error:J instanceof Error?J.message:String(J)}),J}this.pollOutcomes.set($.id,{id:$.id,ok:!0}),this.polledSnapshots.set($.id,Z.snapshot);let X=this.snapshot.rows.find((J)=>J.id===$.id);if(X&&X.credentialEpoch===$.credentialEpoch&&X.identity===$.identity)this.applyObservation(X,Z.observation);return Z.observation}applyObservation($,Z){K7(this.pending,$,Z),this.replaceRow($.id,(X)=>({...X,quota:D8(X.quota,Z),needsFirstReading:!1}))}recordSnapshot($,Z,X,J){if(!this.snapshot.active||this.disposed||this.setAside())return;let G=this.snapshot.rows.find((j)=>j.id===$);if(G?.type!=="oauth")return;let z=c$(X);if(!(z&&G.identity?z===G.identity:I1(G)?.access===X))return;let Q=R0(Z,this.now(),J);if(!Q)return;if(this.applyObservation(G,Q),G.credentialEpoch===void 0)return;let Y={credentialEpoch:G.credentialEpoch,...G.identity!==void 0?{identity:G.identity}:{}},H=this.storeFor(this.deps.paths()),U=(this.writes.get(G.id)??Promise.resolve()).then(async()=>{if(this.disposed||(this.deps.vaultAuthority?await this.deps.vaultAuthority()!=="local":this.setAside()))return;return H.recordQuota(G.id,Y,Q)}).catch((j)=>{this.log.warn("pool quota not recorded",{rowId:G.id,error:j instanceof Error?j.message:String(j)})});this.writes.set(G.id,U),U.finally(()=>{if(this.writes.get(G.id)===U)this.writes.delete(G.id)})}rowForToken($){let Z=c$($);return this.snapshot.rows.find((X)=>Z&&X.identity?X.identity===Z:I1(X)?.access===$)}refreshDueTokens($,Z){if(this.setAside())return Promise.resolve();let X=this.now(),J=e3(Z),G=[];for(let z of $){if(!z.candidate)continue;let B=I1(z);if(!B)continue;let Q=(B.expires??0)-X;if(!(!B.access||!B.expires||Q<=J)||this.refreshBackedOff(z,X))continue;G.push(this.refresh(z.id))}return Promise.all(G).then(()=>{})}refreshBackedOff($,Z=this.now()){let X=I1($);if(!X)return!1;let J=this.backoff.get($.id);return Boolean(J&&J.tokenHash===i1(X.refresh)&&J.nextRetryAt>Z)}usableToken($,Z=this.now()){if(this.setAside())return;let X=I1($);if(!X?.access.trim())return;if(typeof X.expires!=="number"||X.expires<=Z)return;return X.access}refresh($){let Z=this.refreshing.get($);if(Z)return Z;let X=this.runRefresh($).finally(()=>{if(this.refreshing.get($)===X)this.refreshing.delete($)});return this.refreshing.set($,X),X}async runRefresh($){let Z=this.snapshot.rows.find((J)=>J.id===$),X=Z?I1(Z)?.refresh:void 0;try{let J=await this.storeFor(this.deps.paths()).refresh($,this.deps.refreshProvider,{refuse:()=>this.setAside()?"vault-mode":void 0});if(this.setAside())return;if(J.status==="rotated"){this.backoff.delete($),this.rotated.set($,J.credential),this.replaceRow($,(G)=>({...G,credential:J.credential,...J.identity!==void 0&&G.identity===void 0?{identity:J.identity}:{}}));return}if(J.status==="identity-contradicted"){this.backoff.delete($),this.replaceRow($,(G)=>({...G,enabled:!1,candidate:!1})),this.log.warn("pool row disabled: its refresh returned a different account",{rowId:$});return}this.recordRefreshFailure($,X,Error(J.reason))}catch(J){this.recordRefreshFailure($,X,J)}}recordRefreshFailure($,Z,X){if(this.log.warn("pool row refresh failed",{rowId:$,error:X instanceof Error?X.message:String(X)}),!Z)return;this.backoff.set($,N7(Z,X,this.now(),this.backoff.get($)))}refreshBackoffFor($){return M7($,this.backoff,this.now(),(Z,X)=>this.usableToken(Z,X))}async pollRows($){if(this.setAside())return[];let Z=await this.load();if(!Z.active||this.disposed)return[];let X=Z.rows.filter((J)=>J.candidate&&J.type==="oauth");if(X.length===0)return[];await this.refreshDueTokens(X,$);for(let J of X)this.pollOutcomes.delete(J.id),this.requestReading(J.id,!0);return await this.poolStore().pullsSettled(),X.map((J)=>this.pollOutcomes.get(J.id)??{id:J.id,ok:!1,error:"the quota poll did not run"})}setAside(){return this.deps.vaultMode?.()===!0}dispose(){this.disposed=!0}async settled(){for(;;){let $=[...this.writes.values(),...this.refreshing.values(),...this.initializing?[this.initializing.promise]:[]];if(await Promise.allSettled($),await this.store?.store.pullsSettled(),this.writes.size===0&&this.refreshing.size===0)return}}}var cB=P8,sB=500,iB=64;function aB(){return{input:0,output:0,cacheRead:0,cacheWrite:0,totalTokens:0,cost:{input:0,output:0,cacheRead:0,cacheWrite:0,total:0}}}function s$($,Z){return{type:"error",reason:"error",error:{role:"assistant",content:[],api:$.api,provider:$.provider,model:$.id,usage:aB(),stopReason:"error",errorMessage:Z,timestamp:Date.now()}}}function nB($){let Z=$.resetAtMs!==void 0?` It resets at ${new Date($.resetAtMs).toISOString()}.`:"";switch($.reason){case"quota-unknown":return`No OpenAI account has a quota reading yet; one is being taken now. Try again in ${i7} seconds.`;case"quota-exhausted":return`Every OpenAI account has used up its quota.${Z}`;case"killswitch":return"Every OpenAI account is below its killswitch quota floor (see the Limits section of `/openai`).";case"mid-stream-rate-limit":return`Every OpenAI account is rate-limited.${Z}`;case"no-credential":return"No OpenAI account holds a usable sign-in. Sign in with `/login` or add an account with `/openai`."}}function rB($){for(let[Z,X]of Object.entries($)){if(Z.toLowerCase()!=="authorization")continue;return/^Bearer\s+(.+)$/i.exec(X.trim())?.[1]}return}class I8{main;pool;vault;deps;vaultTokens=new Map;now;paths;slot;slotVaultMode;slotNeedsRefresh=!1;slotQueue=Promise.resolve();storageCache;storageRead;constructor($){this.deps=$,this.now=$.now??Date.now,this.paths=$.paths??G5;let Z=()=>$.fetchImpl??globalThis.fetch;this.main=new S8({now:this.now,poll:async(X,J)=>{if(await this.readAuthority()!=="local")throw Error("Pi login quota polling is disabled while enrolled");let G=await $$({accessToken:X,fetchImpl:Z(),now:this.now,...J?{accountId:J}:{},accountKey:V0}),z=R0(G,this.now(),!0);if(!z)throw Error("the quota poll returned no reading");return{snapshot:G,observation:z}}}),this.pool=new E8({paths:this.paths,now:this.now,...$.readBudgetMs!==void 0?{readBudgetMs:$.readBudgetMs}:{},vaultMode:()=>this.vaultMode(),vaultAuthority:()=>this.readAuthority(),refreshProvider:async(X)=>{if(await this.readAuthority()!=="local")throw Error("Local token refresh is disabled while enrolled");let J=await O2({refreshToken:X.refresh,fetchImpl:Z(),now:this.now}),G=S$({id_token:"",access_token:J.access,refresh_token:J.refresh});return{...J,...G?{identity:G}:{}}},pullQuota:async(X)=>{if(await this.readAuthority()!=="local")throw Error("Local quota polling is disabled while enrolled");let J=X.credential;if(J.type!=="oauth"||!J.access)throw Error("the row holds no access token to poll with");let G=await $$({accessToken:J.access,fetchImpl:Z(),now:this.now,...X.identity?{accountId:X.identity}:{},accountKey:X.id}),z=R0(G,this.now(),!0);if(!z)throw Error("the quota poll returned no reading");return{snapshot:G,observation:z}}}),this.vault=$.vault??new Z8({host:"pi",stateDir:t6(this.paths().statePath),reservedRouteIds:()=>this.pool.peek().rows.map((X)=>X.id),fetchImpl:Z,now:this.now})}vaultMode(){return this.vault.enrolled()}readAuthority(){return this.vault.authority()}vaultSlot(){return this.slot??=this.deps.slot??u7(this.paths().statePath),this.slot}withSlot($){let Z=this.slotQueue.then($);return this.slotQueue=Z.catch(()=>{this.slotVaultMode=void 0}),Z}syncVaultSlot($,Z=!1){return this.withSlot(async()=>{if(await this.reconcileSlot(Z),this.slotNeedsRefresh&&$)await $(),this.slotNeedsRefresh=!1})}disconnectVault(){return this.withSlot(async()=>{this.slotVaultMode=void 0;try{let $=await this.vaultSlot().exitVault();return this.slotNeedsRefresh=!0,await this.vault.disconnect(),$}finally{await this.reconcileSlot()}})}async reconcileSlot($=!1){let Z=await this.readAuthority()!=="local";if(Z===this.slotVaultMode&&!$)return;let X=this.slotVaultMode;this.slotVaultMode=void 0;let J=await this.vaultSlot().inspect();if(Z)await this.vaultSlot().enterVault();else await this.vaultSlot().exitVault();this.slotNeedsRefresh=Z&&J.slot!=="placeholder"||!Z&&J.slot==="placeholder"||X!==void 0&&Z!==X||this.slotNeedsRefresh;let G=await this.readAuthority()!=="local";if(G!==Z){if(G)await this.vaultSlot().enterVault();else await this.vaultSlot().exitVault();this.slotNeedsRefresh=!0}this.slotVaultMode=G}async start(){return await this.readAuthority(),this.vault.start(),this.pool.load().then(()=>{},()=>{})}async storage(){let $=this.paths(),Z;try{let X=dB($.configPath);Z=`${$.configPath}|${X.ino}:${X.size}:${X.mtimeMs}`}catch{Z=`${$.configPath}|-`}if(this.storageCache?.key===Z)return this.storageCache.storage;if(this.storageRead?.key!==Z){let X=o3($).then((J)=>{return this.storageCache={key:Z,storage:J},J},()=>this.storageCache?.storage??null);this.storageRead={key:Z,promise:X}}return YZ(this.storageRead.promise,this.deps.readBudgetMs??sB,()=>this.storageCache?.storage??null)}accounts($){let Z=[];if(!this.vaultMode())this.localAccounts($,Z);for(let X of this.vault.routes())Z.push({id:X.id,token:void 0,kind:X.kind,vault:!0,...X.identity?{identity:X.identity}:{},...X.quota!==void 0?{quota:X.quota}:{}});return Z}localAccounts($,Z){let X=this.main.currentToken(),J=this.main.currentIdentity(),G=this.vault.identities();if(X&&!(J!==void 0&&G.has(J))){let Q=this.main.quotaMap();Z.push({id:V0,token:X,...J?{identity:J}:{},...Q?{quota:Q}:{}})}let z=this.pool.peek(),B=this.now();if(z.active)for(let Q of z5(z.rows,$,B,J,G))Z.push({id:Q.id,token:this.pool.usableToken(Q,B),...Q.identity?{identity:Q.identity}:{},...Q.quota!==void 0?{quota:Q.quota}:{}})}poolRowById($){return this.pool.peek().rows.find((Z)=>Z.id===$)}requestPull($){if($===V0)return this.main.requestReading();if(this.vault.owns($))return this.vault.requestReading($);return this.pool.requestReading($)}rememberVaultToken($,Z){this.vaultTokens.delete($),this.vaultTokens.set($,Z);while(this.vaultTokens.size>iB){let X=this.vaultTokens.keys().next().value;if(X===void 0)break;this.vaultTokens.delete(X)}}recordHeaders($,Z,X){let J=new Headers(X),G=m4(J),z=w4(J),B=this.vaultTokens.get(Z);if(B?.id===$)this.vault.recordSnapshot($,G,z,B.receipt);else if($===V0)this.main.record(G,Z,z);else this.pool.recordSnapshot($,G,Z,z)}recordRateLimitFrame($,Z){let X=this.vaultTokens.get($);if(X){this.vault.recordSnapshot(X.id,Z,!0,X.receipt);return}if(this.main.record(Z,$,!0))return;let J=this.pool.rowForToken($);if(J)this.pool.recordSnapshot(J.id,Z,$,!0)}observeWebSocketMessage($,Z){if(!Z.includes("codex.rate_limits"))return;let X=rB($);if(!X)return;let J;try{J=JSON.parse(Z)}catch{return}if(!J||typeof J!=="object"||J.type!=="codex.rate_limits")return;this.recordRateLimitFrame(X,p4(J))}stream($,Z,X){let J=this.deps.createStream(),G=this.deps.installWebSocket?.()??(()=>{});return(async()=>{try{if(await this.readAuthority()!=="local"&&X?.apiKey!==d$){J.push(s$($,w7));return}let z=await this.route($,Z,X);if(z.kind==="blocked"){J.push(s$($,z.refusal?c2[z.refusal]:nB(z.block)));return}if(z.head)J.push(z.head);if(z.rest)for(;;){let B=await z.rest.next();if(B.done)break;J.push(B.value)}}catch(z){J.push(s$($,j1(z,X?.apiKey).message))}finally{J.end(),G()}})(),J}async route($,Z,X){let J=await this.storage(),G=await this.readAuthority()!=="local";if(G)await YZ(this.vault.awaitRequestRoster().then(()=>!0),e6,()=>!1);else this.main.observeToken(X?.apiKey),await this.pool.current(),this.pool.refreshDueTokens(this.pool.peek().rows,J);let z=J?.routing?.mode??"main-first",B=!1,Q=0,H=await(()=>B5({accounts:()=>{let W=this.accounts(J);return Q=W.length,W},storage:J,mode:z,sessionId:X?.sessionId,requestBytes:Buffer.byteLength(JSON.stringify(Z),"utf8"),now:this.now,refreshBackoff:(W)=>this.pool.refreshBackoffFor(W.map((U)=>this.poolRowById(U.id)).filter((U)=>U!==void 0)),requestPull:(W)=>this.requestPull(W),firstReadingWaitMs:this.deps.firstReadingWaitMs??cB,send:(W)=>W.vault?this.vaultAttempt($,Z,X,W.id).then((U)=>{if(!U)B=!0;return U}):W.token?this.attempt($,Z,X,W.id,W.token):Promise.resolve(void 0),placePin:R7}))();if(H.kind==="blocked"){if(G&&(Q===0||B))return{...H,refusal:B?"vault-refused":s2(this.vault)};if(G&&H.block.reason==="no-credential")return{...H,refusal:"vault-empty"};return H}return{kind:"sent",...H.attempt}}async attempt($,Z,X,J,G){let z,B;try{let W=X?.fetch??globalThis.fetch;B=this.deps.streamSimple($,Z,{...X,apiKey:G,fetch:Object.assign(async(U,j)=>{try{return await P7(await W(U,j),G,"event-stream")}catch(K){throw j1(K,G)}},W),onResponse:async(U,j)=>{z=U.status,this.recordHeaders(J,G,U.headers),await X?.onResponse?.(U,j)}})}catch(W){return{head:s$($,j1(W,G).message),rest:void 0}}let Q=async function*(){try{for await(let W of B){if(W.type==="error")W.error.errorMessage=U1(W.error.errorMessage??"",G);yield W}}catch(W){yield s$($,j1(W,G).message)}}(),Y=await Q.next(),H=Y.done?void 0:Y.value;return{...z!==void 0?{status:z}:{},head:H,rest:Y.done||H?.type==="error"?void 0:Q}}async vaultAttempt($,Z,X,J){let G;return await this.vault.send(J,async(B,Q)=>{return this.rememberVaultToken(B,{id:J,receipt:{credentialId:Q.credentialId,accountIdentitySource:Q.accountIdentitySource,...Q.accountIdentity!==void 0?{accountIdentity:Q.accountIdentity}:{},...Q.expectedAccountIdentity!==void 0?{expectedAccountIdentity:Q.expectedAccountIdentity}:{}}}),G=await this.attempt($,Z,X,J,B),new Response(null,{status:G.status??200})},{site:"model",...X?.signal?{signal:X.signal}:{}})?G:void 0}commandSupport(){return{vaultMode:()=>this.vaultMode(),readAuthority:()=>this.readAuthority(),syncVaultSlot:($,Z)=>this.syncVaultSlot($,Z),disconnectVault:()=>this.disconnectVault(),observeLogin:async($)=>{if(await this.readAuthority()==="local")this.main.observeToken($)},store:()=>this.pool.poolStore(),mainIdentity:()=>this.main.currentIdentity(),mainQuota:()=>this.main.quotaSnapshot(),reload:()=>this.pool.load(),vault:this.vault,refreshAllQuota:async()=>{let $=await this.readAuthority()==="local"?await this.storage():null;if(await this.readAuthority()!=="local")return(await this.vault.pollStale(0)).map((z)=>({account:z.id,ok:z.ok,...z.error?{error:z.error}:{}}));let[Z,X,J]=await Promise.all([this.main.currentToken()?this.main.pollNow():void 0,this.pool.pollRows($),this.vault.pollStale(0)]),G=[];if(Z)G.push({account:V0,ok:Z.ok,...Z.error?{error:Z.error}:{}});for(let z of[...X,...J])G.push({account:z.id,ok:z.ok,...z.error?{error:z.error}:{}});return G}}}}var a$="https://chatgpt.com/backend-api",Y5;class x8 extends C8{constructor($,Z){let X=Z&&typeof Z==="object"&&!Array.isArray(Z)?Z.headers??{}:{};super(String($),X);let J=Y5;if(J)this.addEventListener("message",(G)=>{let z=G?.data;if(typeof z==="string")J(X,z)})}}var i$=0,b8;function eB(){let $=globalThis;if(i$===0)b8=$.WebSocket,$.WebSocket=x8;return i$++,()=>{if(i$=Math.max(0,i$-1),i$===0){if($.WebSocket===x8)$.WebSocket=b8;b8=void 0}}}var $Q=[{id:"gpt-5.5",name:"GPT-5.5",api:"openai-codex-responses",provider:"openai-codex",baseUrl:a$,reasoning:!0,thinkingLevelMap:{xhigh:"xhigh",minimal:"low"},input:["text","image"],cost:{input:5,output:30,cacheRead:0.5,cacheWrite:0},contextWindow:272000,maxTokens:128000},{id:"gpt-5.4",name:"GPT-5.4",api:"openai-codex-responses",provider:"openai-codex",baseUrl:a$,reasoning:!0,thinkingLevelMap:{xhigh:"xhigh",minimal:"low"},input:["text","image"],cost:{input:2.5,output:15,cacheRead:0.25,cacheWrite:0},contextWindow:272000,maxTokens:128000},{id:"gpt-5.4-mini",name:"GPT-5.4 mini",api:"openai-codex-responses",provider:"openai-codex",baseUrl:a$,reasoning:!0,thinkingLevelMap:{xhigh:"xhigh",minimal:"low"},input:["text","image"],cost:{input:0.75,output:4.5,cacheRead:0.075,cacheWrite:0},contextWindow:272000,maxTokens:128000},{id:"gpt-5.3-codex-spark",name:"GPT-5.3 Codex Spark",api:"openai-codex-responses",provider:"openai-codex",baseUrl:a$,reasoning:!0,thinkingLevelMap:{xhigh:"xhigh",minimal:"low"},input:["text"],cost:{input:1.75,output:14,cacheRead:0.175,cacheWrite:0},contextWindow:128000,maxTokens:128000}],ZQ=5000;function Q5($,Z){$.registerProvider("openai-codex",{baseUrl:a$,api:"openai-codex-responses",name:"OpenAI Codex (CortexKit)",...Z.vaultMode()?{apiKey:d$}:{},models:$Q,streamSimple:(X,J,G)=>Z.stream(X,J,G)})}function XQ(){return new I8({streamSimple:($,Z,X)=>tB($,Z,X),createStream:oB,installWebSocket:eB})}async function JQ($){let Z=XQ();Y5=(B,Q)=>Z.observeWebSocketMessage(B,Q);let X,J,G=(B=!0)=>Z.syncVaultSlot(X?async()=>{Q5($,Z),await X?.()}:void 0,B),z=()=>{G(!1).catch(()=>{J?.("Pi could not load the vault login slot. Reopen the session or disconnect in /openai.","error")})};if(l7($,{pool:Z.commandSupport(),afterApply:G,onContext:(B)=>{X=()=>B.modelRegistry.refresh(),J=(Q,Y)=>B.ui.notify(Q,Y)}}),await G().catch(()=>{}),Q5($,Z),setInterval(z,ZQ).unref?.(),typeof $.on==="function")$.on("session_start",async(B,Q)=>{X=()=>Q.modelRegistry.refresh(),J=(Y,H)=>Q.ui.notify(Y,H),Z.start();try{await G()}catch{J("Pi could not load the vault login slot. Reopen the session or disconnect in /openai.","error");return}if(Z.vaultMode())return;try{await Z.commandSupport().observeLogin(await Q.modelRegistry.getApiKeyForProvider("openai-codex"))}catch{}})}export{Q5 as registerPiProvider,eB as installRawCodexWebSocket,JQ as default,XQ as createPiOpenAIRuntime};