npm - @cortexkit/pi-openai-auth - Versions diffs - 1.0.4 → 1.1.0 - Mend

@cortexkit/pi-openai-auth 1.0.4 → 1.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/dist/index.js CHANGED Viewed

@@ -1,13 +1,13 @@
-import{createRequire as B5}from"node:module";var H5=B5(import.meta.url);import{createAssistantMessageEventStream as nQ}from"@earendil-works/pi-ai";import{streamSimple as rQ}from"@earendil-works/pi-ai/compat";var X0="all",WZ=Object.freeze(["primary"]);function y8($){return $.kind==="retired"?$.retiredAt:$.checkedAt}function x1($,Z){return JSON.stringify([$,Z])}function K1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function D0($){return typeof $==="number"&&Number.isFinite($)}function k8($){return typeof $==="string"&&$.length>0}function C0($,Z,X){return $[Z]===void 0||X($[Z])}function Y5($){return D0($)&&$>0}function YZ($){return typeof $==="string"}function W5($){if(!K1($)||!k8($.scope)||!k8($.label))return!1;switch($.kind){case"reading":return D0($.checkedAt)&&D0($.usedPercent)&&C0($,"resetsAt",YZ)&&C0($,"windowMinutes",Y5);case"retired":return D0($.retiredAt);case"absent":return D0($.checkedAt);default:return!1}}function V5($){if(!K1($)||!D0($.checkedAt))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&C0($,"remainingPercent",D0)&&C0($,"usedPercent",D0)&&C0($,"resetsAt",YZ)&&C0($,"limit",D0)&&C0($,"used",D0)&&C0($,"remaining",D0)&&C0($,"unit",YZ)}function f8($){return K1($)&&D0($.value)&&Number.isInteger($.value)&&$.value>=0&&D0($.checkedAt)}function VZ($){return K1($)&&Object.values($).every(f8)}function UZ($){if(!K1($))return;let Z=Object.entries($).filter(([,X])=>f8(X));return Z.length===0?void 0:Object.fromEntries(Z)}function q1($){if(Q0($))return $;if(!K1($))return;let{counters:Z,...X}=$;if(!Q0(X))return;let J=UZ(Z);return{...X,...J===void 0?{}:{counters:J}}}function Q0($){if(!K1($)||!Array.isArray($.limits))return!1;let Z=new Set;for(let X of $.limits){if(!W5(X))return!1;let J=x1(X.scope,X.label);if(Z.has(J))return!1;Z.add(J)}return C0($,"budget",V5)&&C0($,"counters",VZ)}class t$ extends TypeError{constructor($){super($);this.name="QuotaCodecError"}}function $6($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function e$($){return typeof $==="number"&&Number.isFinite($)}function g8($){return $===void 0||typeof $==="string"&&$!==""}function h8($){return typeof $==="string"&&$!==""}function H$($,Z){return $[Z]===void 0||e$($[Z])}function jZ($,Z){return $[Z]===void 0||typeof $[Z]==="string"}function U5($){return $6($)&&g8($.scope)&&h8($.label)&&e$($.usedPercent)&&jZ($,"resetsAt")&&($.windowMinutes===void 0||e$($.windowMinutes)&&$.windowMinutes>0)}function j5($){return $6($)&&g8($.scope)&&h8($.label)}function D5($){if(!$6($))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&H$($,"remainingPercent")&&H$($,"usedPercent")&&jZ($,"resetsAt")&&H$($,"limit")&&H$($,"used")&&H$($,"remaining")&&jZ($,"unit")}function v8($){if(!$6($)||!e$($.checkedAt))return!1;let Z=$.readings??[],X=$.coverage??[];if(!Array.isArray(Z)||!Array.isArray(X))return!1;let J=new Set;for(let G of Z){if(!U5(G))return!1;let z=x1(G.scope??X0,G.label);if(J.has(z))return!1;J.add(z)}if(!X.every(j5))return!1;return($.budget===void 0||D5($.budget))&&($.counters===void 0||VZ($.counters))}function K5($,Z){if($.scope!==Z.scope)return $.scope<Z.scope?-1:1;if($.label!==Z.label)return $.label<Z.label?-1:1;return 0}function q5($,Z,X){if(Z===void 0)return $;if($!==void 0&&X<$.checkedAt)return $;return{...Z,checkedAt:X}}function N5($,Z){let X=new Map(Object.entries($??{}));for(let[J,G]of Object.entries(Z??{})){let z=X.get(J);if(z===void 0||G.checkedAt>=z.checkedAt)X.set(J,G)}return X.size===0?void 0:Object.fromEntries(X)}function E0($,Z){let X=$===void 0?void 0:q1($);if($!==void 0&&X===void 0)throw new t$("stored quota map is malformed");if(!v8(Z))throw new t$("quota observation is malformed");let J=X??{limits:[]},G=Z.checkedAt,z=new Map;for(let V of J.limits)z.set(x1(V.scope,V.label),V);let Q=(V)=>{let N=z.get(V);return N===void 0||G>=y8(N)},B=new Set;for(let V of Z.readings??[]){let N=V.scope??X0,q=x1(N,V.label);if(B.add(q),!Q(q))continue;z.set(q,{scope:N,label:V.label,kind:"reading",checkedAt:G,usedPercent:V.usedPercent,...V.resetsAt===void 0?{}:{resetsAt:V.resetsAt},...V.windowMinutes===void 0?{}:{windowMinutes:V.windowMinutes}})}for(let V of Z.coverage??[]){let N=V.scope??X0,q=x1(N,V.label);if(B.has(q)||!Q(q))continue;let M=z.get(q);z.set(q,M===void 0||M.kind==="absent"?{scope:N,label:V.label,kind:"absent",checkedAt:G}:{scope:N,label:V.label,kind:"retired",retiredAt:G})}let{limits:H,budget:Y,counters:W,...U}=J,j=q5(J.budget,Z.budget,G),K=N5(J.counters,Z.counters);return{...U,limits:[...z.values()].sort(K5),...j===void 0?{}:{budget:j},...K===void 0?{}:{counters:K}}}var DZ=Object.freeze({validate:Q0,decode:q1,merge:E0});var p8=900000,u8="no quota reading yet",l8="no limits reported";function d8($){let Z=Math.max(1,Math.round($/60000));if(Z<60)return`${Z}m`;let X=Math.round(Z/60);if(X<24)return`${X}h`;return`${Math.max(1,Math.round(Z/1440))}d`}function M5($){if($%1440===0)return`${$/1440}d`;if($%60===0)return`${$/60}h`;return`${$}m`}function Z6($){if($.scope!==X0||$.windowMinutes===void 0)return $.label;return M5($.windowMinutes)}function m8($){return`${Math.round(Math.min(100,Math.max(0,$)))}% left`}function w8($,Z){if($===void 0)return"";let X=Date.parse($);if(!Number.isFinite(X)||X<=Z)return"";return`, resets ${d8(X-Z)}`}function F5($,Z){let X=$.windowMinutes,J=Z.windowMinutes;if(X!==void 0&&J!==void 0&&X!==J)return X-J;if(X===void 0!==(J===void 0))return X===void 0?1:-1;if($.scope!==Z.scope){if($.scope===X0)return-1;if(Z.scope===X0)return 1;return $.scope<Z.scope?-1:1}return $.label<Z.label?-1:$.label>Z.label?1:0}function k1($,Z){if(!$)return[];let{now:X}=Z,J=(Z.form??"full")==="full",G=[],z=[],Q=$.limits.filter((H)=>H.kind==="reading"&&H.remainingPercent!==void 0).sort(F5);for(let H of Q)z.push(H.checkedAt),G.push(`${Z6(H)} ${m8(H.remainingPercent??0)}${J?w8(H.resetsAt,X):""}`);let B=$.budget;if(B){z.push(B.checkedAt);let H=B.reached?"credits spent":B.remainingPercent!==void 0?`credits ${m8(B.remainingPercent)}`:"credits available";G.push(`${H}${J?w8(B.resetsAt,X):""}`)}if(z.length>0){let H=X-Math.min(...z);if(H>(Z.staleAfterMs??p8))G.push(`checked ${d8(H)} ago`)}return G}function P0($,Z){let X=k1($,Z);if(X.length>0)return X.join(" · ");return $&&$.limits.length>0?l8:u8}function L5($){if($.kind==="retired")return{scope:$.scope,label:$.label,kind:"retired",checkedAt:$.retiredAt};if($.kind==="absent")return{scope:$.scope,label:$.label,kind:"absent",checkedAt:$.checkedAt};return{scope:$.scope,label:$.label,kind:"reading",checkedAt:$.checkedAt,usedPercent:$.usedPercent,remainingPercent:100-$.usedPercent,...$.windowMinutes===void 0?{}:{windowMinutes:$.windowMinutes},...$.resetsAt===void 0?{}:{resetsAt:$.resetsAt}}}function _5($,Z){let X=$.windowMinutes!==void 0,J=Z.windowMinutes!==void 0;if(X!==J)return X?-1:1;if(X&&J&&$.windowMinutes!==Z.windowMinutes)return(Z.windowMinutes??0)-($.windowMinutes??0);if($.label!==Z.label)return $.label<Z.label?-1:1;return 0}function O5($){return{checkedAt:$.checkedAt,reached:$.reached,...$.remainingPercent===void 0?{}:{remainingPercent:$.remainingPercent},...$.resetsAt===void 0?{}:{resetsAt:$.resetsAt}}}function c($,Z=X0){let X=new Map;for(let Y of $?.limits??[]){if(Y.scope!==Z&&Y.scope!==X0)continue;let W=X.get(Y.label);if(W===void 0){X.set(Y.label,Y);continue}let U=Y.scope===X0?W:Y,j=Y.scope===X0?Y:W;X.set(Y.label,U.kind==="reading"?U:j)}let J=[...X.values()].map(L5).sort(_5),G=J.filter((Y)=>Y.kind==="reading"),z=G.length>0?G:J,Q=z.length>0?Math.min(...z.map((Y)=>Y.checkedAt)):void 0,B=$?.budget?.kind==="reading"?O5($.budget):void 0,H=UZ($?.counters);return{scope:Z,limits:J,...Q===void 0?{}:{checkedAt:Q},...B===void 0?{}:{budget:B},...H===void 0?{}:{counters:H}}}function Y$($,Z){let X=$?.budget;if(X?.reached!==!0||typeof X.resetsAt!=="string")return;let J=Date.parse(X.resetsAt);if(!Number.isFinite(J)||J<=Z)return;return{resetsAt:X.resetsAt,resetAtMs:J}}function KZ($){return $.kind==="reading"&&typeof $.usedPercent==="number"&&Number.isFinite($.usedPercent)&&$.usedPercent>=100}function X6($,Z){if(typeof $.resetsAt!=="string")return;let X=Date.parse($.resetsAt);return Number.isFinite(X)&&X>Z?X:void 0}function c8($,Z,X){let J=Z.rateLimitMarks?.get($);if(J!==void 0&&X<J)return{id:$,reason:"rate-limited",until:J};let G=Z.refreshBackoff?.get($);if(G!==void 0&&X<G)return{id:$,reason:"refresh-backoff",until:G};return}function C5($,Z,X,J){if(Z.limits.length===0)return{id:$,stage:1,gate:2,reason:"needs-first-reading",pullRequested:!0};for(let z of X)if(!Z.limits.some((Q)=>Q.label===z))return{id:$,stage:1,gate:3,reason:"unknown-window",window:{scope:Z.scope,label:z},pullRequested:!0};let G=Z.limits.filter(KZ);for(let z of G)if(X6(z,J)===void 0)return{id:$,stage:1,gate:4,reason:"unknown-reset",window:{scope:z.scope,label:z.label},pullRequested:!0};for(let z of G){let Q=X6(z,J);if(Q!==void 0&&typeof z.resetsAt==="string")return{id:$,stage:1,gate:5,reason:"exhausted",window:{scope:z.scope,label:z.label},resetsAt:z.resetsAt,resetAtMs:Q}}return}function g0($){let Z=$.scope??X0,X=$.requiredLabels??WZ,J=[],G=[],z=[];for(let j of $.rows){let K=c8(j.id,$,$.now);if(K){J.push(K);continue}if(j.kind==="api-key"){z.push({id:j.id,kind:j.kind});continue}let V=c(j.quota,Z),N=C5(j.id,V,X,$.now);if(N){G.push(N);continue}z.push({id:j.id,kind:j.kind,projection:V})}let Q=new Map(z.flatMap((j)=>{let K=Y$(j.projection,$.now);return K?[[j.id,K]]:[]})),B=Q.size>0&&Q.size===z.length,H=[];for(let j of z){let K=Q.get(j.id);if(K===void 0)H.push(j);else if(B)H.push({...j,lastPath:!0});else G.push({id:j.id,stage:2,reason:"budget-spent",...K})}let Y=new Map($.rows.map((j,K)=>[j.id,K])),W=(j,K)=>(Y.get(j.id)??0)-(Y.get(K.id)??0);G.sort(W);let U=G.filter((j)=>("pullRequested"in j)).map((j)=>j.id);for(let j of U)$.requestPull?.(j);return{admitted:H,refused:G,excluded:J,pulls:U}}var J6="main";function qZ($){switch($){case"sticky-balanced":return{mode:"sticky-balanced",placement:"roster"};case"main-first":return{mode:"ordered",placement:"main-first"};case"fallback-first":return{mode:"ordered",placement:"fallback-first"};default:return{mode:"ordered",placement:"roster"}}}function y1($,Z,X=J6){if(Z==="roster"||!$.includes(X))return[...$];let J=$.filter((G)=>G!==X);return Z==="main-first"?[X,...J]:[...J,X]}function NZ($){let Z=g0($),X=new Set(Z.admitted.map((G)=>G.id));return{order:y1($.rows.map((G)=>G.id),$.placement??"roster",$.formerMainId).filter((G)=>X.has(G)&&$.killswitch?.get(G)!==!1),admission:Z}}function MZ($,Z,X){let J=Z.at(-1);if(J!==void 0){if(J.status===void 0||!X.includes(J.status))return}let G=new Set(Z.map((z)=>z.id));return $.find((z)=>!G.has(z))}function W$($,Z,X){if(!Z.has($.accountId))return!1;return!(typeof $.wireIdentity==="string"&&typeof X==="string"&&$.wireIdentity!==X)}function FZ($,Z,X){let J=new Map;for(let[G,z]of $){if(G===X)continue;if(z.quotaCheckedAt!==Z.get(z.accountId))continue;J.set(z.accountId,(J.get(z.accountId)??0)+(z.inputBytes??0))}return J}var OZ=900000,i8=0.016666666666666666,LZ=0.000001;function G6($,Z){for(let X of[$?.checkedAt,Z])if(typeof X==="number"&&Number.isFinite(X))return X;return}function a8($){if($===401||$===403)return"permanent";if($===void 0||$===0||!Number.isFinite($)||$>=500&&$<=599||$===429)return"transient";return"healthy"}function n8($){return $.limits.filter((Z)=>Z.kind==="reading").sort((Z,X)=>{let J=Z.windowMinutes!==void 0,G=X.windowMinutes!==void 0;if(J!==G)return J?-1:1;if(J&&G)return(X.windowMinutes??0)-(Z.windowMinutes??0);return 0})}function CZ($){let Z=($.classifyStatus??a8)($.status);if(Z==="permanent")return{action:"migrate",reason:"permanent"};if(!$.quota)return{action:"retain",reason:"unknown"};let X=G6($.quota,$.quotaCheckedAt);if(X===void 0||!Number.isFinite(X)||$.now-X>OZ)return{action:"retain",reason:"stale"};if($.killswitchPasses===!1)return{action:"migrate",reason:"killswitch"};for(let G of n8($.quota)){let z=G.remainingPercent;if(typeof z==="number"&&Number.isFinite(z)&&z<=0)return{action:"migrate",reason:"exhausted",window:{scope:G.scope,label:G.label},...typeof G.resetsAt==="string"?{resetsAt:G.resetsAt}:{}}}let J=Y$($.quota,$.now);if(J)return{action:"migrate",reason:"exhausted",resetsAt:J.resetsAt};return{action:"retain",reason:Z}}function _Z($,Z,X){let J=Math.max(0,$.remainingPercent-Z);if(J<=0)return 0;if(!$.resetsAt)return J;let G=Date.parse($.resetsAt);if(!Number.isFinite(G)||G<=X)return J;let z=Math.max((G-X)/3600000,i8);return J/z}function s8($,Z){if($<Z)return-1;if($>Z)return 1;return 0}function P5($,Z){if(!$.quota)return;let X=G6($.quota,$.quotaCheckedAt);if(X===void 0||Z-X>OZ)return;let J=n8($.quota).map((Q)=>_Z({remainingPercent:Q.remainingPercent??Number.NaN,...Q.resetsAt===void 0?{}:{resetsAt:Q.resetsAt}},$.reservePercent[Q.label]??0,Z)),G=$.quota.budget;if(G&&typeof G.remainingPercent==="number"&&Number.isFinite(G.remainingPercent))J.push(_Z({remainingPercent:G.remainingPercent,...G.resetsAt===void 0?{}:{resetsAt:G.resetsAt}},0,Z));let z=J.length>0?Math.min(...J):0;return z>0?{candidate:$,quotaCheckedAt:X,weight:z}:void 0}function r8($){let Z=$.candidates.filter((G)=>G.killswitchPasses!==!1);if($.candidates.length===0)throw Error("Cannot select a sticky candidate: input.candidates is empty");if(Z.length===0)return;let X=Z.map((G)=>P5(G,$.now)).filter((G)=>G!==void 0);if(X.length>0){X.sort((z,Q)=>{let B=(($.pendingBytes.get(z.candidate.accountId)??0)+$.requestBytes)/Math.max(z.weight,LZ),H=(($.pendingBytes.get(Q.candidate.accountId)??0)+$.requestBytes)/Math.max(Q.weight,LZ);return B-H||z.candidate.configuredOrder-Q.candidate.configuredOrder||s8(z.candidate.accountId,Q.candidate.accountId)});let G=X[0];if(G)return{accountId:G.candidate.accountId,quotaCheckedAt:G.quotaCheckedAt,source:"weighted"}}$.onEmptyWeightedSet?.();let J=[...Z].sort((G,z)=>{let Q=(G.resetCreditsApplicable??0)>0?1:0;return((z.resetCreditsApplicable??0)>0?1:0)-Q||G.configuredOrder-z.configuredOrder||s8(G.accountId,z.accountId)})[0];if(!J)throw Error("Cannot select a sticky candidate: input.candidates is empty");return{accountId:J.accountId,quotaCheckedAt:G6(J.quota,J.quotaCheckedAt),source:"mode-fallback"}}function PZ($){let Z=g0($),X=new Map(Z.admitted.map((V)=>[V.id,V])),J=new Map(Z.refused.map((V)=>[V.id,V])),G=new Set(Z.excluded.map((V)=>V.id)),z=new Set($.rows.map((V)=>V.id)),Q=$.pin!==void 0&&W$($.pin,z,$.identities?.get($.pin.accountId));if(Q&&$.pin){let V=X.get($.pin.accountId);if(V&&$.killswitch?.get(V.id)!==!1)return{outcome:"dispatch",accountId:V.id,source:"pin",...V.projection?.checkedAt===void 0?{}:{quotaCheckedAt:V.projection.checkedAt},pin:{action:"retain"},refusedSelections:[],admission:Z}}let B=$.pin?J.get($.pin.accountId):void 0,H=Q&&$.pin!==void 0&&$.refusedPinPolicy==="move-on-confirmed-exhaustion"&&($.killswitch?.get($.pin.accountId)===!1||B?.reason==="exhausted"||B?.reason==="budget-spent"),Y=(V)=>{return(typeof $.rowReservePercent==="function"?$.rowReservePercent(V):$.rowReservePercent?.get(V.id))??$.reservePercent??{}},W=$.scope,U=$.rows.map((V,N)=>({row:V,configuredOrder:N})).filter(({row:V})=>!G.has(V.id)).map(({row:V,configuredOrder:N})=>{let q=$.killswitch?.get(V.id),M=$.resetCreditsApplicable?.get(V.id);return{accountId:V.id,quota:V.kind==="api-key"?void 0:X.get(V.id)?.projection??c(V.quota,W),reservePercent:Y(V),configuredOrder:N,...M===void 0?{}:{resetCreditsApplicable:M},...q===void 0?{}:{killswitchPasses:q}}}),j=[],K=Q?{action:"retain"}:$.pin?{action:"clear"}:{action:"none"};while(U.length>0){let V=r8({candidates:U,pendingBytes:$.pendingBytes??new Map,requestBytes:$.requestBytes,now:$.now,...$.onEmptyWeightedSet?{onEmptyWeightedSet:$.onEmptyWeightedSet}:{}});if(!V)break;let N=J.get(V.accountId);if(N){j.push(N),U=U.filter((M)=>M.accountId!==V.accountId);continue}let q=$.identities?.get(V.accountId);return{outcome:"dispatch",accountId:V.accountId,source:V.source,...V.quotaCheckedAt===void 0?{}:{quotaCheckedAt:V.quotaCheckedAt},pin:Q&&!H?{action:"retain"}:{action:"assign",pin:{accountId:V.accountId,inputBytes:$.requestBytes,...q===void 0?{}:{wireIdentity:q},...V.quotaCheckedAt===void 0?{}:{quotaCheckedAt:V.quotaCheckedAt}}},refusedSelections:j,admission:Z}}return{outcome:"no-admissible-account",pin:K,refusedSelections:j,admission:Z}}import{appendFileSync as k5,chmodSync as y5,existsSync as RZ,renameSync as G9,statSync as f5}from"node:fs";import{open as g5}from"node:fs/promises";import{dirname as h5,resolve as v5}from"node:path";import{randomUUID as T5}from"node:crypto";import{lstat as $9,readFile as Z9,rename as S5,unlink as o8}from"node:fs/promises";import{dirname as i0,resolve as M0}from"node:path";var R=process.platform==="win32",t8=new Set;function TZ($){if($?.reason==="io-error"){if($.win32Code===2||$.win32Code===3)return"ENOENT";if($.win32Code===80||$.win32Code===183)return"EEXIST"}return $?.code??"ERR_PRIVATE_FILE"}var e8;function f1(){return e8??=import("@cortexkit/private-files"),e8}class l extends Error{path;stage;code;win32Code;reason;published=!1;durabilityConfirmed=!1;fileDurable=!1;attempts=0;elapsedMs=0;orphanPath;constructor($,Z,X){let J=X;super(`Private file refused at ${Z}: ${$} (${J?.reason??J?.code??"io-error"}). Use a safe parent directory. Repair only a named secret file in safe ancestry whose owner the published policy trusts, without changing its owner or any existing directory. Previously exposed credentials may need rotation. Windows requires the private-files native prebuild and an ACL-persisting local filesystem such as NTFS.`,{cause:X});this.path=$,this.stage=Z,this.name="PrivateFileError",this.code=TZ(J),this.win32Code=J?.win32Code,this.reason=J?.reason}}async function K0($,Z,X){try{return await X()}catch(J){if(J instanceof l)throw J;throw new l($,Z,J)}}var A5;async function h0($,Z){$=M0($),Z??=A5,await K0($,"safe-parent",async()=>{let X=await(await f1()).verifySafeParent($,Z);if(X.ok===!1){if(X.reason==="io-error"||X.reason==="wrong-kind")await $9($);throw new l(X.level??X.path,"safe-parent",{...X,code:"ERR_PRIVATE_FILES_SECURITY"})}})}async function J0($,Z,X=!1){if($=M0($),Z==="directory")return h0($);await K0($,"verify",async()=>{let J=await f1(),G=await J.verifyOwnerOnly($),z=!1;if(!G.ok){let{reason:Q}=G.refusal;if(Q==="io-error")await J.verifyPrivatePath($,Z);if(X&&[J.EXTRA_ACE,J.NOT_PROTECTED,J.NULL_DACL,J.EMPTY_DACL].includes(Q))await h0(i0($)),await J.securePrivatePath($,Z),z=!0;else throw Object.assign(Error("Owner-only verification refused"),{reason:Q,code:"ERR_PRIVATE_FILES_SECURITY"})}if(await J.verifyPrivatePath($,Z),z&&!t8.has($))t8.add($),process.emitWarning(`Private permissions tightened: ${$}. This object may have been readable before; rotate credentials if needed.`,"PrivateFileMigration")})}async function q0($,Z=!1,X){$=M0($),await K0($,"directory",async()=>{let J=await f1();try{return await $9($),await h0($,X)}catch(z){if(TZ(z)!=="ENOENT")throw z}let G=i0($);if(G===$)throw Object.assign(Error("Missing root"),{code:"ENOENT"});await q0(G,!1,X);try{await J.createOwnerOnly($,{kind:"dir"})}catch(z){if(TZ(z)!=="EEXIST")throw z}await h0($,X)})}async function F0($,Z=!1){if(!R)return Z9($,"utf8");return(await SZ($,Z)).toString("utf8")}async function SZ($,Z=!1){if(!R)return Z9($);if($=M0($),Z)await h0(i0($)),await J0($,"file",!0);return K0($,"read",async()=>(await f1()).readOwnerOnly($))}async function g1($,Z){await h0(i0(M0($))),await K0($,"create",async()=>{await(await f1()).createPrivateFile(M0($),Z)})}async function X9($){await h0(i0(M0($))),await K0($,"directory-create",async()=>{await(await f1()).createOwnerOnly(M0($),{kind:"dir"})})}async function AZ($,Z,X={}){$=M0($),Z=M0(Z);let J=X.now??(()=>performance.now()),G=J(),z=Math.min(G+500,X.deadline??1/0),Q=[0,10,20,40,80,100],B,H=0;for(let W of Q){if(J()>=z)break;if(W)await(X.sleep??((U)=>new Promise((j)=>setTimeout(j,U))))(Math.min(W,Math.max(0,z-J())));if(J()>=z)break;if(await X.beforeRename?.(),J()>=z)break;H++;try{return await(X.rename??S5)($,Z),{attempts:H,elapsedMs:J()-G}}catch(U){B??=U;let j=U;if(!(j.win32Code!==void 0?j.win32Code===32||j.win32Code===33:["EBUSY","EPERM","EACCES"].includes(j.code??"")&&!j.reason))break}}let Y=new l(Z,"rename",B??Object.assign(Error("Publication deadline expired"),{code:"ETIMEDOUT"}));throw Y.attempts=H,Y.elapsedMs=J()-G,Y}async function h1($,Z,X={}){$=M0($),await q0(i0($));try{await J0($,"file",!0)}catch(Y){if(Y.code!=="ENOENT")throw Y}let J=M0(X.stagePath??`${$}.${T5()}.tmp`);if(i0(J)!==i0($))throw new l($,"stage-directory",{code:"EXDEV"});let G=!1,z=!1,Q={attempts:0,elapsedMs:0},B="stage-create",H=(Y)=>{try{X.onOutcome?.({path:$,stage:Y?.stage??"published",published:z,fileDurable:z,durabilityConfirmed:!1,attempts:Y?.attempts??Q.attempts,elapsedMs:Y?.elapsedMs??Q.elapsedMs,...Y&&{code:Y.code,win32Code:Y.win32Code}})}catch{}};try{if(await g1(J,Z),G=!0,B="before-rename",Q=await AZ(J,$,X),G=!1,z=!0,B="published-callback",X.onRenamed?.(),B="published-verify",await J0($,"file"),X.durable&&X.durability!=="file-only-on-windows")throw new l($,"directory-sync-unsupported",{code:"ENOTSUP"});H()}catch(Y){let W=Y instanceof l?Y:new l($,B,Y);if(W.published=z,W.fileDurable=z,z)Object.assign(W,Q);if(G){try{await o8(J)}catch{W.orphanPath=J}G=!1}throw H(W),W}finally{if(G)await o8(J).catch(()=>{})}}var R5=/^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i,E5=/\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g;function I5($){return $ instanceof Error||Object.prototype.toString.call($)==="[object Error]"}function I0($={}){let Z=[E5,...$.extraValuePatterns??[]].map((z)=>new RegExp(z.source,z.flags.includes("g")?z.flags:`${z.flags}g`));function X(z){let Q=z.toLowerCase().replace(/[-_]/g,"");return R5.test(z)||Q.includes("apikey")||Q.endsWith("secret")||Q.endsWith("password")||Q.endsWith("token")&&!Q.endsWith("tokens")||!!$.extraSecretKeys?.(Q)}function J(z){let Q=z,B=[["name",z.name],["message",z.message],["stack",z.stack]];for(let Y of["code","status","cause"])if(Q[Y]!==void 0)B.push([Y,Q[Y]]);let H=new Set(B.map(([Y])=>Y));for(let Y of Object.entries(z))if(!H.has(Y[0]))B.push(Y);return B}function G(z,Q,B,H=0){if(typeof z==="string")return Z.reduce((Y,W)=>Y.replace(W,"***REDACTED***"),z);if(!z||typeof z!=="object")return z;if(B.has(z))return"[Circular]";B.add(z);try{if(Array.isArray(z))return z.map((U)=>G(U,Q,B,H));let Y=I5(z);if(Y&&H>=8)return"[Truncated]";let W=Y?H+1:H;return Object.fromEntries((Y?J(z):Object.entries(z)).map(([U,j])=>[U,Q&&X(U)?"***REDACTED***":G(j,Q,B,W)]))}finally{B.delete(z)}}return{redact:(z)=>G(z,!0,new WeakSet),redactStrings:(z)=>G(z,!1,new WeakSet)}}var J9=I0(),b5=J9.redact,x5=J9.redactStrings;var z6={error:0,warn:1,info:2,debug:3,trace:4},Q9=5242880,B9=3;function EZ($){try{y5($,384)}catch{}}function m5($){try{if(!(RZ($)&&f5($).size>=Q9))return;for(let X=B9-1;X>=1;X--)if(RZ(`${$}.${X}`)){let J=`${$}.${X+1}`;G9(`${$}.${X}`,J),EZ(J)}let Z=`${$}.1`;G9($,Z),EZ(Z)}catch{}}async function v0($){let{file:Z,handle:X}=$;if($.file=void 0,$.handle=void 0,Z&&X)await K0(Z,"log-close",()=>X.close())}async function z9($,Z){await q0(h5(Z));try{await J0(Z,"file",!0)}catch(X){if(X.code!=="ENOENT")throw X;try{await g1(Z,"")}catch(J){if(J.code!=="EEXIST")throw J;await J0(Z,"file",!0)}}return $.handle=await K0(Z,"log-open",()=>g5(Z,"a")),$.file=Z,$.handle}async function w5($,Z,X){Z=v5(Z);try{if($.file!==Z)await v0($);let J=$.handle??await z9($,Z);if((await K0(Z,"log-stat",()=>J.stat())).size>=Q9){await v0($);for(let z=B9-1;z>=0;z--){let Q=z===0?Z:`${Z}.${z}`,B=`${Z}.${z+1}`;try{await J0(Q,"file",!0)}catch(H){if(H.code==="ENOENT")continue;throw H}try{await J0(B,"file",!0)}catch(H){if(H.code!=="ENOENT")throw H}await AZ(Q,B),await J0(B,"file")}J=await z9($,Z)}await K0(Z,"log-append",()=>J.appendFile(X,"utf8"))}catch(J){throw await v0($).catch(()=>{}),J}}function p5($){try{return` ${JSON.stringify($)}`}catch{return" [unserializable]"}}function u5($){let Z,X,J,G=I0(),z,Q=[],B,H=Promise.resolve(),Y,W={};function U(D){let L=H.then(D);return H=L.catch((S)=>{Y=S}),L}function j(D){if(R&&D.file!==Z)U(()=>v0(W)).catch(()=>{});Z=D.file,X=D.level,G=I0(D),z=D.captureSink}function K(D){if(D===void 0||D in z6)J=D}function V(){if(Z===void 0)return;return(typeof Z==="function"?Z():Z)||void 0}function N(){if(J)return J;let D=typeof X==="function"?X():X;if(D&&D in z6)return D;return"info"}function q(D=!0){if(B)clearTimeout(B),B=void 0;if(!Q.length){if(R)return U(async()=>{if(D)await v0(W);if(Y)throw Y});return}let L;try{L=V()}catch{if(Q=[],R&&D)return U(()=>v0(W));return}let S=Q.join("");if(Q=[],!L){if(R&&D)return U(()=>v0(W));return}if(R)return U(async()=>{try{await w5(W,L,S)}finally{if(D)await v0(W)}});try{if(m5(L),RZ(L))EZ(L);k5(L,S,{encoding:"utf8",mode:384})}catch{}}function M(){if(!B)B=setTimeout(()=>{B=void 0;let D=q(!1);if(D instanceof Promise)D.catch(()=>{})},500)}function P(D,L,S,v){if(Z===void 0&&z===void 0)return;try{if(z6[L]>z6[N()])return;let u=G.redactStrings(S),n;try{n=G.redact(v)}catch{n="[unserializable]"}let f=`[${new Date().toISOString()}] ${L.toUpperCase()} [${D}] ${u}`+(v===void 0?"":p5(n))+`
-`;try{z?.({channel:D,level:L,message:u,data:n})}catch{}if(Z===void 0)return;if(Q.push(f),Q.length>=50){let k=q(!1);if(k instanceof Promise)k.catch(()=>{})}else M()}catch{}}function E(D){return{error:(L,S)=>P(D,"error",L,S),warn:(L,S)=>P(D,"warn",L,S),info:(L,S)=>P(D,"info",L,S),debug:(L,S)=>P(D,"debug",L,S),trace:(L,S)=>P(D,"trace",L,S)}}function F(){if(R)U(()=>v0(W)).catch(()=>{});if(Y=void 0,Q=[],B)clearTimeout(B),B=void 0;Z=void 0,X=void 0,J=void 0,G=I0(),z=void 0}if($)j($);return{configure:j,createLogger:E,setLogLevel:K,flushLogs:q,reset:F}}var l5=u5();function i($){return l5.createLogger($)}class x extends Error{operation;rowId;phase;retryable;kind;committed;constructor($){super($.message??`${$.operation} failed (${$.kind}, ${$.phase})`,$.cause===void 0?void 0:{cause:$.cause});this.name="PoolOperationError",this.operation=$.operation,this.rowId=$.rowId,this.phase=$.phase,this.retryable=$.retryable,this.kind=$.kind,this.committed=$.committed}}class Q6 extends Error{operation;constructor($){super(`${$} was called from inside a store hook; hand it to the caller's continuation instead`);this.name="PoolReentryError",this.operation=$}}var v1="identity-contradicted: ",IZ="duplicate-identity";function a0($,Z,X){let J=$.rosterRow(Z);if(!J)return;J.enabled=!1;let G=$.entry(Z)??{credentialEpoch:1,needsFirstReading:!0},z=typeof G.disabledReason==="string"&&G.disabledReason.startsWith("identity-contradicted: ");$.setEntry(Z,{...G,disabledReason:z?G.disabledReason:X})}function V$($,Z){let X=$.rosterRow(Z);if(!X)return;X.enabled=!0;let J=$.entry(Z);if(J&&"disabledReason"in J){let G={...J};delete G.disabledReason,$.setEntry(Z,G)}}function m1($,Z){let X=$.rows().filter((G)=>G.invalid===void 0&&!G.staged&&G.type==="oauth"&&G.enabled&&G.identity===Z),J=[];for(let G of X.slice(1))a0($,G.id,"duplicate-identity"),J.push(G.id);return J}function N1($,Z,X){let J=$.rosterRow(Z);if(!J)return[];return J.accountId=X,m1($,X)}import{setTimeout as MX}from"node:timers/promises";import{randomUUID as H9}from"node:crypto";import{mkdir as n5,open as B6,rename as r5,rm as o5}from"node:fs/promises";import{dirname as bZ}from"node:path";class U$ extends Error{constructor($){super("file or directory sync failed",{cause:$});this.name="AtomicSyncError"}}async function L0($,Z,X={}){await xZ($,Z,X)}async function xZ($,Z,X,J){if(R)return h1($,X.serialize?X.serialize(Z):`${JSON.stringify(Z,null,2)}
-`,{beforeRename:X.beforeRename,stagePath:`${$}.${(X.stageName??H9)()}.tmp`,onRenamed:J,durable:X.durable,durability:X.durability,onOutcome:X.onOutcome});await n5(bZ($),{recursive:!0});let G=`${$}.${(X.stageName??H9)()}.tmp`,z,Q=!1;try{if(z=await B6(G,"wx",384),Q=!0,await z.writeFile(X.serialize?X.serialize(Z):`${JSON.stringify(Z,null,2)}
-`,"utf8"),await z.chmod(384),X.durable)try{await z.sync()}catch(B){throw new U$(B)}if(await z.close(),z=void 0,await X.beforeRename?.(),await r5(G,$),Q=!1,J?.(),X.durable){let B=await B6(bZ($),"r");try{await B.sync()}catch(H){throw new U$(H)}finally{await B.close()}}}finally{if(await z?.close().catch(()=>{}),Q)await o5(G,{force:!0}).catch(()=>{})}}async function kZ($){if(R){await J0($,"file");let J=new l($,"directory-sync-unsupported",{code:"ENOTSUP"});throw J.published=!0,J}let Z=await B6($,"r");try{await Z.sync()}finally{await Z.close()}let X=await B6(bZ($),"r");try{await X.sync()}finally{await X.close()}}import{randomUUID as H6}from"node:crypto";import{mkdir as Y9,open as t5,readFile as W9,rename as V9,rm as Y6,stat as U9,writeFile as j9}from"node:fs/promises";import{dirname as yZ,join as D9}from"node:path";var e5=globalThis.setTimeout.bind(globalThis),$X=globalThis.clearTimeout.bind(globalThis);function fZ($){let Z=$?.code;return Z==="ENOENT"||!R&&(Z==="EINVAL"||Z==="ENOTDIR")}async function e($){let Z=gZ($.path,$.name),X=D9(Z,"owner.json"),J=H6(),G=$.now??Date.now,z=null,Q=!1,B=!1,H,Y,W=new Promise((C)=>{Y=C});function U(C){try{let T=$.onRenewalTimer?.(C);if(T&&(typeof T==="object"||typeof T==="function")&&"then"in T&&typeof T.then==="function")Promise.resolve(T).catch(()=>{})}catch{}}function j(){if(!z)return;$X(z),z=null,U("cancelled")}function K(C,T){if(H||Q)return;H=Object.freeze({reason:C,expectedOwnerId:J,...typeof T?.ownerId==="string"?{observedOwnerId:T.ownerId}:{},...typeof T?.expiresAt==="number"?{observedExpiresAt:T.expiresAt}:{}}),j(),Y(H)}let V,N=null,q=`${Z}.evicting`,M=D9(q,"owner.json"),P=H6(),E=5000,F=8;async function D(){if(R)try{return JSON.parse(await F0(Z,!0))}catch(C){if(C.code!=="EISDIR"&&C.reason!=="wrong-kind")throw C;return await J0(Z,"directory",!0),JSON.parse(await F0(X,!0))}try{return JSON.parse(await W9(Z,"utf8"))}catch(C){if(C.code!=="EISDIR")throw C;return JSON.parse(await W9(X,"utf8"))}}async function L(){if(R){let w=await D(),o=Number(w?.expiresAt)-G();await h1(Z,`${JSON.stringify({ownerId:J,expiresAt:G()+$.ttlMs})}
-`,{deadline:performance.now()+Math.max(0,o),beforeRename:async()=>{let o$=await D();if(o$?.ownerId!==J||!(Number(o$?.expiresAt)>G())||!await y())throw new n0({target:$.path,name:$.name})}});return}let C=`${Z}.${H6()}.tmp`,T,I=!1;try{T=await t5(C,"wx",384),I=!0,await T.writeFile(`${JSON.stringify({ownerId:J,expiresAt:G()+$.ttlMs})}
-`,"utf8"),await T.chmod(384),await T.close(),T=void 0;let w=await D();if(w?.ownerId!==J||!(Number(w?.expiresAt)>G())||!await y())throw new n0({target:$.path,name:$.name});await V9(C,Z),I=!1}finally{if(await T?.close().catch(()=>{}),I)await Y6(C,{force:!0}).catch(()=>{})}}async function S(){let C=`${JSON.stringify({ownerId:J,expiresAt:G()+$.ttlMs})}
-`;if(R)await g1(Z,C);else await j9(Z,C,{encoding:"utf8",mode:384,flag:"wx"})}async function v(C){let T=C.code;if(T==="EEXIST"){if(R)await D();return!0}if(T==="EISDIR"){if(R)await J0(Z,"directory",!0),await F0(X,!0);return!0}return!1}async function u(){if(R)await q0(yZ(Z));try{return await S(),!0}catch(C){let T=C.code;if(await v(C))return!1;if(T==="ENOENT"){if(R)await q0(yZ(Z));else await Y9(yZ(Z),{recursive:!0});try{return await S(),!0}catch(I){if(await v(I))return!1;throw I}}throw C}}async function n(){await new Promise((C)=>setTimeout(C,Math.floor(Math.random()*4)))}async function f(C=!0){if(C&&$.onStep)await $.onStep("lock-read-ready");let T;try{T=await D()}catch(w){if(R&&w.code!=="ENOENT")throw w}let I=Number(T?.expiresAt);if(Number.isFinite(I)&&I>G())return{status:"live"};if(typeof T?.ownerId==="string"&&Number.isFinite(I))return{status:"stale",identity:{kind:"owner",ownerId:T.ownerId,expiresAt:I}};try{let w=await U9(Z),o=Number.isFinite(I)?I:w.mtimeMs+$.ttlMs;if(o>G())return{status:"live"};return{status:"stale",identity:{kind:"stat",dev:w.dev,ino:w.ino,mtimeMs:w.mtimeMs,expiresAt:o}}}catch(w){if(w.code==="ENOENT"){if($.onStep)await $.onStep("lock-missing");return{status:"missing"}}throw w}}function k(C,T){if(T.status!=="stale")return!1;let I=T.identity;if(C.kind==="owner"&&I.kind==="owner")return C.ownerId===I.ownerId&&C.expiresAt===I.expiresAt;return C.kind==="stat"&&I.kind==="stat"&&C.dev===I.dev&&C.ino===I.ino&&C.mtimeMs===I.mtimeMs&&C.expiresAt===I.expiresAt}async function y(){try{return JSON.parse(await F0(M,R))?.ownerId===P}catch(C){if(R&&C.code!=="ENOENT")throw C;return!1}}async function r(C){if(R)await K0(C,"remove",()=>Y6(C,{recursive:!0,force:!0}));else await Y6(C,{recursive:!0,force:!0}).catch(()=>{})}async function d(){if(await y())await r(q)}async function n$(){if(R)await X9(q);else await Y9(q);try{let C=`${JSON.stringify({ownerId:P,createdAt:G()})}
-`;if(R)await g1(M,C);else await j9(M,C,{encoding:"utf8",mode:384,flag:"wx"})}catch(C){if(fZ(C))return!1;throw await d(),C}if($.onStep)await $.onStep("eviction-marker-acquired");return!0}async function b1(){let C;try{C=await U9(q)}catch(I){if(I.code==="ENOENT")return"missing";throw I}if(R)await J0(q,"directory",!0);if(C.mtimeMs+E>G())return"fresh";if($.onStep)await $.onStep("stale-marker-stat");let T=`${q}.${H6()}`;try{await V9(q,T)}catch(I){if(I.code==="ENOENT")return"missing";throw I}if($.onStep)await $.onStep("stale-marker-claimed");return await r(T),"recovered"}async function r$(C){try{if(!await n$())return!1}catch(T){if(T.code==="EEXIST"){if(R){await J0(q,"directory",!0);try{await F0(M,!0)}catch(I){if(I.code!=="ENOENT")throw I}}return!1}throw T}try{await C()}finally{await d()}return!0}async function g(){for(let C=0;C<F;C++){if($.onStep)await $.onStep("relinquish-read");let T;try{T=await D()}catch(I){if(R)throw I;return}if(T?.ownerId!==J)return;try{await Y6(Z,{recursive:!0,force:!0});return}catch(I){if(R)throw I;await n()}}}function f0(){if(!$.renew||Q||H)return;let C=$.renewIntervalMs??Math.max(1000,Math.floor($.ttlMs/3));if(z=e5(()=>{z=null;let T=(async()=>{let I=!Q;try{if(!await r$(async()=>{let o=await D(),o$=G();if(Q||H){I=!1;return}if(o?.ownerId!==J){K("taken-over",o),I=!1;return}if(!(Number(o?.expiresAt)>o$)){K("expired",o),I=!1;return}if($.onStep)await $.onStep("renewal-owner-confirmed");if(Q||H){I=!1;return}if(!await y())return;if($.onStep)await $.onStep("renewal-write-fenced");if(Q||H){I=!1;return}if(!await y())return;if($.onStep)await $.onStep("renewal-write-ready");if(Q||H){I=!1;return}if(await L(),$.onStep)await $.onStep("renewal-write-finished");if(!await y()){K("marker-lost"),I=!1,await g();return}})&&$.onStep)await $.onStep("renewal-marker-unavailable")}catch(w){if(R&&w instanceof l)V=w,K("renewal-failed"),I=!1;try{let o=await D();if(o?.ownerId!==J)K("taken-over",o);else if(!(Number(o?.expiresAt)>G()))K("expired",o)}catch{K("renewal-failed")}}finally{if($.onStep)try{await $.onStep("renewal-finished")}catch{}if(I&&!Q&&!H)f0()}})();N=T,T.finally(()=>{if(N===T)N=null})},C),"unref"in z)z.unref();U("scheduled")}function x8(){try{let C=$.onContended?.();if(C&&(typeof C==="object"||typeof C==="function")&&"then"in C&&typeof C.then==="function")Promise.resolve(C).catch(()=>{})}catch{}return null}let D1=await u();if(!D1)for(let C=0;C<F;C++){if(D1=await u(),D1)break;let T=await f();if(T.status==="live")return x8();if(T.status==="missing")continue;if($.onStep)await $.onStep("stale-lock-observed");try{if(!await n$()){await n();continue}}catch(I){if(I.code!=="EEXIST")throw I;if(await b1()==="fresh")return null;await n();continue}try{let I=await f();if(I.status==="live")return x8();if(!k(T.identity,I))continue;if(!await y())return null;if($.onStep)await $.onStep("stale-lock-confirmed");if(!await y())return null;let w=await f(!1);if(!k(T.identity,w))continue;if(await r(Z),!await y())return null;if($.onStep)await $.onStep("stale-lock-removed");if(D1=await u(),!D1)return null;if($.onStep)await $.onStep("stale-lock-recreated");if(!await y())return await g(),D1=!1,null;break}finally{await d()}}if(!D1)return null;return f0(),{ownerId:J,whenLost:()=>W,hasLost:()=>H!==void 0,assertOwned:async()=>{if(V)throw V;let C;try{let T=await D();if(C=T,!Q&&!H&&T?.ownerId===J&&Number(T?.expiresAt)>G())return;K(T?.ownerId!==J?"taken-over":"expired",T)}catch(T){if(K("unreadable"),R&&T instanceof l)throw T}throw new n0({target:$.path,name:$.name,expectedOwnerId:J,...typeof C?.ownerId==="string"?{observedOwnerId:C.ownerId}:{},...typeof C?.expiresAt==="number"?{observedExpiresAt:C.expiresAt}:{}})},release:async()=>{if(R&&B)return;Q=!0,j(),await N;for(let C=0;C<F;C++){try{let T=!1;if(await r$(async()=>{let w;try{w=await D()}catch(o){if(R&&o.code==="ENOENT"){T=!0;return}throw o}if(w?.ownerId!==J){T=!0;return}if($.onStep)await $.onStep("release-owner-confirmed");if(!await y())return;await r(Z),T=!0})){if(R&&!T)throw new l(Z,"release-not-confirmed",{code:"EIO"});B=T;return}await b1()}catch(T){if(R)throw T;return}await n()}if(R)throw new l(Z,"release-not-confirmed",{code:"ETIMEDOUT"})}}}function gZ($,Z){return`${$}.${Z}.lock`}class M1 extends Error{details;constructor($){super(`Timed out acquiring ${$.name} lock for ${$.target}`);this.name="LockContentionError",this.details=$}}class n0 extends Error{details;constructor($){super(`Lost ${$.name} lock for ${$.target}`);this.name="LockOwnershipError",this.details=$}}async function hZ($,Z,X){let J=performance.now();for(;;){let G=await e({path:$,name:Z.name,ttlMs:Z.ttlMs,renew:Z.renew??!1,...Z.onStep?{onStep:Z.onStep}:{},...Z.onRenewalTimer?{onRenewalTimer:Z.onRenewalTimer}:{}});if(G)try{return await X(G)}finally{await G.release()}let z=Z.timeoutMs-(performance.now()-J);if(z<=0)throw new M1({target:$,name:Z.name,timeoutMs:Z.timeoutMs});await new Promise((Q)=>setTimeout(Q,Math.min(25,Math.ceil(z))))}}import{AsyncLocalStorage as ZX}from"node:async_hooks";var K9=new ZX;function G0($){if(K9.getStore()!==void 0)throw new Q6($)}function b0($,Z){return K9.run($,async()=>await Z())}async function q9($,Z,X,J,G){if(!Z)return;try{await b0($,()=>Z(X,J))}catch(z){G?.warn("store failure hook threw; the original failure stands",{operation:$,rowId:X,error:z instanceof Error?z.message:String(z)})}}var vZ=Object.freeze({ttlMs:1e4,timeoutMs:15000,retryMs:50,renew:!0});async function XX($,Z,X){let J=(Q)=>{try{let B=X.onLockEvent?.({type:Q,name:$.name,path:$.path});if(B&&(typeof B==="object"||typeof B==="function")&&"then"in B&&typeof B.then==="function")Promise.resolve(B).catch(()=>{})}catch{}},G={...Z,...JX($)},z=performance.now();for(;;){let Q=await e({name:$.name,path:$.path,ttlMs:G.ttlMs,now:X.now,renew:G.renew,onContended:()=>J("contended"),...X.onRenewalTimer?{onRenewalTimer:(Y)=>X.onRenewalTimer?.({name:$.name,path:$.path},Y)}:{},...G.renewIntervalMs!==void 0?{renewIntervalMs:G.renewIntervalMs}:{},...X.onLockStep?{onStep:(Y)=>X.onLockStep?.({name:$.name,path:$.path},Y)}:{}});if(Q){J("acquired");let Y={name:$.name,path:$.path,assertOwned:()=>Q.assertOwned(),release:async()=>{await Q.release(),J("released")}};try{await Y.assertOwned()}catch(W){throw await Y.release(),W}return Y}let B=G.timeoutMs-(performance.now()-z);if(B<=0)throw new M1({target:$.path,name:$.name,timeoutMs:G.timeoutMs});let H=Math.floor(Math.random()*(G.retryMs+1));await new Promise((Y)=>setTimeout(Y,Math.min(G.retryMs+H,B)))}}function JX($){let Z={};if($.ttlMs!==void 0)Z.ttlMs=$.ttlMs;if($.timeoutMs!==void 0)Z.timeoutMs=$.timeoutMs;if($.retryMs!==void 0)Z.retryMs=$.retryMs;if($.renew!==void 0)Z.renew=$.renew;if($.renewIntervalMs!==void 0)Z.renewIntervalMs=$.renewIntervalMs;return Z}class r0{defaults;env;held=[];constructor($,Z){this.defaults=$,this.env=Z}async acquire($){let Z=await XX($,this.defaults,this.env);return this.held.push(Z),await this.assertAll(),Z}async assertAll(){for(let $ of this.held)await $.assertOwned()}async releaseTo($){while(this.held.length>$)await this.held.pop()?.release().catch(()=>{})}async releaseAll(){await this.releaseTo(0)}}function F1($,Z,X){if(X!==void 0)throw new x({operation:$,rowId:Z,kind:"row-staged",phase:$==="pull"?"pull":"before-first-write",retryable:!1,message:`row ${Z} is reserved for roster publication`})}import{createHash as j$}from"node:crypto";var m="commonAuthPool",o0=1,T0="rows",W6="retiredEpochs",D$=1,mZ=300000,h=m;function GX($){let Z=JSON.parse(JSON.stringify($)),X=(J)=>{if(Array.isArray(J))return`[${J.map(X).join(",")}]`;if(O(J))return`{${Object.keys(J).sort().map((G)=>`${JSON.stringify(G)}:${X(J[G])}`).join(",")}}`;return JSON.stringify(J)};return X(Z)}function L1($){return j$("sha256").update(GX($)).digest("hex")}function N9($){if(!O($)||Object.keys($).length!==1||typeof $.reservation!=="string"||!$.reservation)return;return{reservation:$.reservation}}function zX($){if(!O($)||typeof $.reservation!=="string"||!$.reservation||typeof $.disabledReason!=="string")return;if(Object.keys($).some((Z)=>!["reservation","label","disabledReason","providerState"].includes(Z)))return;if("label"in $&&typeof $.label!=="string")return;if("providerState"in $&&(typeof $.providerState!=="string"||!/^[a-f0-9]{64}$/.test($.providerState)))return;return $}var B0="commonAuthProviderState";function O($){return $!=null&&typeof $==="object"&&!Array.isArray($)}var QX=new Set(["__proto__","constructor","prototype"]);function w1($){if(typeof $!=="string"||$.length===0)return"id must be non-empty";if($.trim()!==$)return"id must not carry surrounding whitespace";if(QX.has($))return"id is a reserved object key";return}function wZ($){let Z=typeof $==="string"?$.trim():"";if(!Z)return!1;try{let X=new URL(Z);return(X.protocol==="http:"||X.protocol==="https:")&&!X.username&&!X.password}catch{return!1}}function M9($){return $.type==="oauth"?`oauth\x00${$.refresh}`:`api\x00${$.apiKey}`}function t0($){return j$("sha256").update(M9($)).digest("hex")}function x0($){return j$("sha256").update(`credential-stamp\x00${M9($)}`).digest("hex")}function m0($){let Z=$.type==="oauth"?["oauth",typeof $.access==="string"?$.access:null,$.refresh,typeof $.expires==="number"&&Number.isFinite($.expires)?$.expires:null]:["api",$.apiKey,$.baseURL.trim(),$.authHeader??"authorization-bearer"];return j$("sha256").update(`credential-dispatch\x00${JSON.stringify(Z)}`).digest("hex")}function pZ($,Z,X,J={}){return{credentialEpoch:Z,digest:x0($),dispatch:m0($),binding:{...X},...J.replace?{replace:!0}:{},...J.providerState!==void 0?{providerState:J.providerState}:{}}}function p1($,Z){let X=$?.credentialBound?$.credentialBound(Z):Z;return j$("sha256").update(`provider-state\x00${JSON.stringify(X??null)}`).digest("hex")}function K$($,Z,X,J){if(!Z||X===void 0)return;if(!O($)||!Object.hasOwn($,B0))return;let G=U0($[h]);if(!G||G.providerState===void 0||G.digest!==x0(Z)||G.credentialEpoch!==X||G.binding?.identity!==J)return;return G.providerState}function $0($){return Number.isSafeInteger($)&&$>=1}function U0($){if(!O($))return;let Z=$.credentialEpoch;if(!$0(Z))return;if(typeof $.digest!=="string")return;if("dispatch"in $&&typeof $.dispatch!=="string")return;if("replace"in $&&$.replace!==!0)return;if("providerState"in $&&typeof $.providerState!=="string")return;let X="staged"in $?zX($.staged):void 0;if("staged"in $&&!X)return;let J={...X?{staged:X}:{},...typeof $.dispatch==="string"?{dispatch:$.dispatch}:{},...$.replace===!0?{replace:!0}:{},...typeof $.providerState==="string"?{providerState:$.providerState}:{}};if(!("binding"in $))return"dispatch"in $||"replace"in $||"providerState"in $||"staged"in $?void 0:{credentialEpoch:Z,digest:$.digest};let G=$.binding;if(!O(G))return;if("identity"in G&&(typeof G.identity!=="string"||!G.identity))return;if("baseURL"in G&&!wZ(G.baseURL))return;if("authHeader"in G&&G.authHeader!=="authorization-bearer"&&G.authHeader!=="x-api-key")return;return{credentialEpoch:Z,digest:$.digest,...J,binding:{...typeof G.identity==="string"?{identity:G.identity}:{},...typeof G.baseURL==="string"?{baseURL:G.baseURL.trim()}:{},...G.authHeader==="authorization-bearer"||G.authHeader==="x-api-key"?{authHeader:G.authHeader}:{}}}}function BX($,Z,X){if($.identity!==X)return!1;if($.baseURL!==void 0&&(Z.type!=="api"||Z.baseURL!==$.baseURL))return!1;if($.authHeader!==void 0&&(Z.type!=="api"||Z.authHeader!==$.authHeader))return!1;return!0}function HX($,Z,X,J){if(!$)return"none";if(!O(J)||!Object.hasOwn(J,h))return"missing";let G=U0(J[h]);if(!G)return"malformed";if(G.digest!==x0($))return"mismatched";if(G.dispatch===void 0)return"legacy";if(G.credentialEpoch!==Z)return"mismatched";if(!G.binding||!BX(G.binding,$,X))return"mismatched";if(G.dispatch!==m0($))return"mismatched";return"bound"}function F9($){if(!$.exists)return{status:"ready",exists:!1,config:{}};if("parseError"in $)return{status:"error",reason:"config file is not valid JSON"};let Z=$.value;if(!O(Z))return{status:"error",reason:"config root is not an object"};if("accounts"in Z&&!Array.isArray(Z.accounts))return{status:"error",reason:"config accounts is not an array"};if(!(m in Z))return Array.isArray(Z.accounts)?{status:"pending-migration",config:Z}:{status:"ready",exists:!0,config:Z};let X=Z[m];if(!O(X))return{status:"error",reason:`${m} is not an object`};let J=X.schemaVersion;if(typeof J!=="number"||!Number.isInteger(J)||J<1)return{status:"error",reason:`${m}.schemaVersion is invalid`};if(J>o0)return{status:"error",reason:`${m}.schemaVersion ${J} is newer than ${o0}`};if(T0 in X&&!O(X[T0]))return{status:"error",reason:`${m}.${T0} is not an object`};return{status:"ready",exists:!0,config:Z}}function L9($){if(!$.exists)return{status:"ready",exists:!1,state:{}};if("parseError"in $)return{status:"error",reason:"state file is not valid JSON"};if(!O($.value))return{status:"error",reason:"state root is not an object"};if("accounts"in $.value&&!O($.value.accounts))return{status:"error",reason:"state accounts is not an object"};return{status:"ready",exists:!0,state:$.value}}function u1($){return Array.isArray($.accounts)?$.accounts:[]}function _9($){let Z=$[m];if(!O(Z))return{};let X=Z[T0];return O(X)?X:{}}function YX($){return O($.accounts)?$.accounts:{}}function WX($){if(!O($))return"not an object";let Z=w1($.id);if(Z)return Z;if($.type==="api")return wZ($.baseURL)?void 0:"invalid baseURL";if($.type==="oauth")return;return"unknown type"}function VX($,Z){if(!O($))return;let X=$.credentialEpoch;if(!$0(X))return;if("needsFirstReading"in $&&typeof $.needsFirstReading!=="boolean")return;if("disabledReason"in $&&typeof $.disabledReason!=="string")return;let J="quota"in $&&Z.decode?Z.decode($.quota):$.quota;if("quota"in $&&!Z.validate(J))return;if("staged"in $&&!N9($.staged))return;return{credentialEpoch:X,needsFirstReading:$.needsFirstReading===!0,...typeof $.disabledReason==="string"?{disabledReason:$.disabledReason}:{},..."quota"in $?{quota:J}:{}}}function UX($,Z){if(!O(Z))return;if($.type==="api"){let J=typeof Z.apiKey==="string"?Z.apiKey.trim():"";if(!J)return;return{type:"api",apiKey:J,baseURL:String($.baseURL).trim(),authHeader:$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer"}}if($.corrupt===!0)return;let X=Z.refresh;if(typeof X!=="string"||!X.trim())return;return{type:"oauth",refresh:X,...typeof Z.access==="string"?{access:Z.access}:{},...typeof Z.expires==="number"?{expires:Z.expires}:{},...typeof Z.lastRefreshedAt==="number"?{lastRefreshedAt:Z.lastRefreshedAt}:{}}}function V6($,Z){return u1($).find((X)=>O(X)&&X.id===Z)}function O9($){if(!O($[m]))$[m]={};return $[m]}function uZ($){let Z=O9($);if(!O(Z[T0]))Z[T0]={};return Z[T0]}function e0($,Z){let X=_9($),J=Object.hasOwn(X,Z)?X[Z]:void 0;return O(J)?J:void 0}function U6($,Z,X){Object.defineProperty(uZ($),Z,{value:X,enumerable:!0,writable:!0,configurable:!0})}function C9($,Z){let X=$[m];if(!O(X))return;let J=X[W6];if(!O(J)||!Object.hasOwn(J,Z))return;let G=J[Z];return $0(G)?G:void 0}function P9($,Z){let X=e0($,Z)?.credentialEpoch;return $0(X)?X:void 0}function j6($,Z){return Math.max(C9($,Z)??0,P9($,Z)??0)+1}function T9($,Z){let X=[...Z];if(X.length===0)return;let J=O9($),G=O(J[W6])?J[W6]:{},z={},Q=(B,H)=>Object.defineProperty(z,B,{value:H,enumerable:!0,writable:!0,configurable:!0});for(let[B,H]of Object.entries(G))if($0(H))Q(B,H);for(let B of X)Q(B,Math.max(C9($,B)??0,P9($,B)??1));J[W6]=z}function $1($,Z,X,J){let G=_9($),z=YX(Z),Q=new Set,B=[];for(let H of u1($)){let Y=WX(H),W=O(H)&&typeof H.id==="string"?H.id:void 0,U=W===void 0?void 0:G[W],j=O(U)&&Object.hasOwn(U,"staged"),K=j?N9(U.staged):void 0;if(Y||!O(H)||W===void 0||Q.has(W)){if(W!==void 0&&!Q.has(W))Q.add(W);if(W!==void 0)B.push({id:W,type:O(H)&&H.type==="api"?"api":"oauth",enabled:!1,needsFirstReading:!0,hasEntry:Object.hasOwn(G,W),candidate:!1,invalid:"roster",stamp:"none",...K?{staged:K}:{}});continue}Q.add(W);let V=H.type==="api"?"api":"oauth",N=Object.hasOwn(G,W),q=N?VX(G[W],X):void 0,M=UX(H,z[W]),P=H.enabled!==!1,E=q?q.credentialEpoch:N?void 0:1,F=typeof H.accountId==="string"&&H.accountId?H.accountId:void 0,D={id:W,type:V,enabled:P,needsFirstReading:q?q.needsFirstReading:V==="oauth",hasEntry:N,candidate:!1,...typeof H.label==="string"?{label:H.label}:{},...typeof H.addedAt==="number"?{addedAt:H.addedAt}:{},...F!==void 0?{identity:F}:{},...M?{credential:M,fingerprint:t0(M)}:{},...q?{credentialEpoch:q.credentialEpoch}:{},...K?{staged:K}:{},...q?.disabledReason!==void 0?{disabledReason:q.disabledReason}:{},...q&&"quota"in q?{quota:q.quota}:{},...jX(z[W],M,E,F,J),stamp:HX(M,E,F,z[W])};if(N&&!q)D.invalid="entry";else D.candidate=P&&M!==void 0&&!j;B.push(D)}return B}function jX($,Z,X,J,G){if(!O($)||!Object.hasOwn($,B0))return{};let z=K$($,Z,X,J);if(z===void 0)return{providerStateDropped:"uncovered"};let Q=$[B0];if(!G?.validate(Q))return{providerStateDropped:"invalid"};if(p1(G,Q)!==z)return{providerStateDropped:"uncovered"};return{providerState:Q}}function p($){return $.identity??$.id}function q$($,Z){if($===void 0||$>Z+mZ)return Z;return Math.max(Z,$+1)}function lZ($,Z){return q$($,Z)>Z+mZ}function l1($){let{id:Z,credential:X,identity:J,label:G,addedAt:z}=$;return{id:Z,...G!==void 0?{label:G}:{},type:X.type,addedAt:z,...J!==void 0?{accountId:J}:{},...X.type==="api"?{baseURL:X.baseURL.trim(),authHeader:X.authHeader??"authorization-bearer"}:{}}}function S9($,Z){if($.type==="api")return{apiKey:$.apiKey};return{...$.access!==void 0?{access:$.access}:{},refresh:$.refresh,...$.expires!==void 0?{expires:$.expires}:{},...Z!==void 0?{lastRefreshedAt:Z}:{}}}function A9($,Z){if($.type==="api")return{...$,baseURL:$.baseURL.trim(),authHeader:$.authHeader??"authorization-bearer"};return{...$,...Z!==void 0?{lastRefreshedAt:Z}:{}}}function R9($,Z={}){if(!O($))return"credential must be an object";if($.type==="oauth"){if(typeof $.refresh!=="string"||!$.refresh.trim())return"oauth credential needs a refresh token";return}if($.type==="api"){if(typeof $.apiKey!=="string"||!$.apiKey.trim())return"api credential needs an api key";if($.apiKey.trim()!==$.apiKey)return"api key must not carry surrounding whitespace";if(!(Z.baseURLOptional&&$.baseURL===void 0)&&!wZ($.baseURL))return"api credential needs a valid baseURL";return}return"credential type must be oauth or api"}var D6="transition",E9="transitionMark";function DX($){if(!O($))return;let Z=$[D6];if(!O(Z))return;if(typeof Z.mark!=="string"||Z.mark.length===0)return;if(Z.enabled===!0)return{mark:Z.mark,enabled:!0};if(Z.enabled===!1&&typeof Z.reason==="string")return{mark:Z.mark,enabled:!1,reason:Z.reason};return}function N$($,Z,X){if(X.enabled)V$($,Z);else a0($,Z,X.reason??"");if(!$.rosterRow(Z))return;let J=$.entry(Z)??{credentialEpoch:1,needsFirstReading:!0};if($.setEntry(Z,{...J,[E9]:X.mark}),!X.enabled)return;let G=$.rows().find((z)=>z.id===Z);if(G?.type==="oauth"&&G.identity!==void 0)m1($,G.identity)}function KX($,Z){if($.type!=="api")return $;return{...$,...Z.baseURL!==void 0?{baseURL:Z.baseURL}:{},...Z.authHeader!==void 0?{authHeader:Z.authHeader}:{}}}function qX($){if(!$.binding)return!1;return $.replace===!0||$.dispatch===void 0}function NX($,Z,X,J={}){let G=O(Z.accounts)?Z.accounts:{},z=new Map;for(let Q of $1($,Z,X)){if(Q.invalid||Q.staged||!Q.credential)continue;let B=Object.hasOwn(G,Q.id)?G[Q.id]:void 0;if(!O(B))continue;let H=U0(B[h]);if(!H?.binding)continue;if(H.digest!==x0(Q.credential))continue;let Y=Q.credentialEpoch??1;if(H.credentialEpoch>Y){if(!qX(H))continue;if(J.requireCredentialStamps){if(H.dispatch===void 0)continue;if(H.dispatch!==m0(KX(Q.credential,H.binding)))continue}z.set(Q.id,{kind:"replace",stamp:{...H,binding:H.binding}})}else if(H.credentialEpoch===Y&&H.dispatch!==void 0&&H.dispatch===m0(Q.credential)&&H.binding.identity!==void 0&&Q.identity===void 0)z.set(Q.id,{kind:"identity",identity:H.binding.identity});else if(H.credentialEpoch===Y&&H.binding.identity===Q.identity){if(J.requireCredentialStamps&&H.dispatch!==m0(Q.credential))continue;let W=DX(B[h]);if(W&&e0($,Q.id)?.[E9]!==W.mark)z.set(Q.id,{kind:"transition",transition:W})}}return z}function dZ($,Z,X,J){let z={...$.entry(Z)??{},credentialEpoch:X,needsFirstReading:!0};if(delete z.quota,J.identity!==void 0&&typeof z.disabledReason==="string"&&z.disabledReason.startsWith(v1))delete z.disabledReason;$.setEntry(Z,z);let Q=$.rosterRow(Z);if(!Q)return;if(J.identity!==void 0)Q.accountId=J.identity;else delete Q.accountId;if(J.baseURL!==void 0)Q.baseURL=J.baseURL;if(J.authHeader!==void 0)Q.authHeader=J.authHeader}function cZ($,Z,X,J={}){let G=NX($,Z,X,J);if(G.size===0)return{config:$,torn:[]};let z=structuredClone($),Q={rows:()=>$1(z,Z,X),rosterRow:(B)=>V6(z,B),entry:(B)=>e0(z,B),setEntry:(B,H)=>U6(z,B,H)};for(let[B,H]of G)if(H.kind==="replace")dZ(Q,B,H.stamp.credentialEpoch,H.stamp.binding);for(let[B,H]of G)if(H.kind==="identity")N1(Q,B,H.identity);else if(H.kind==="transition")N$(Q,B,H.transition);else if(H.stamp.binding.identity!==void 0)m1(Q,H.stamp.binding.identity);return{config:z,torn:[...G.keys()]}}function sZ($,Z,X,J={}){let{config:G,torn:z}=cZ($,Z,X,J),Q=$1(G,Z,X,J.providerState);for(let B of Q){if(z.includes(B.id))B.torn=!0,B.candidate=!1;if(J.requireCredentialStamps&&B.stamp!=="bound")B.unbound=!0,B.candidate=!1}return Q}async function iZ($){try{return await F0($,R)}catch(Z){if(Z.code==="ENOENT")return;throw Z}}function I9($){if($===void 0)return{exists:!1};try{return{exists:!0,value:JSON.parse($)}}catch(Z){return{exists:!0,parseError:Z}}}async function H0($){for(let Z=0;Z<3;Z++){let X=await iZ($.configPath),J=await iZ($.statePath),G=await iZ($.configPath);if(X!==G){if(Z<2)await MX(2+Math.floor(Math.random()*4));continue}let z=F9(I9(X));if(z.status==="error")return{status:"error",file:"config",reason:z.reason};let Q=L9(I9(J));if(Q.status==="error")return{status:"error",file:"state",reason:Q.reason};if(z.status==="pending-migration")return{status:"pending-migration",config:z.config};return{status:"ready",configExists:z.exists,stateExists:Q.exists,config:z.config,state:Q.state,rows:sZ(z.config,Q.state,$.codec,{requireCredentialStamps:$.requireCredentialStamps===!0,...$.providerState?{providerState:$.providerState}:{}})}}return{status:"error",file:"config",kind:"snapshot-contended",retryable:!0,reason:"The store was changing; retry the operation once writes settle."}}function S0($,Z,X,J="before-first-write"){if($.status==="error"&&$.kind==="snapshot-contended")return new x({operation:Z,...X!==void 0?{rowId:X}:{},phase:J,kind:"snapshot-contended",retryable:!0,message:$.reason});return new x({operation:Z,...X!==void 0?{rowId:X}:{},phase:J,retryable:!1,kind:$.status==="pending-migration"?"pending-migration":"load-error",message:$.status==="pending-migration"?"the config holds a legacy roster that has not been migrated into the pool":`${$.file} file cannot be loaded: ${$.reason}`})}class b9{ctx;snapshot;locks;progress;info;config;state;constructor($,Z,X,J,G){this.ctx=$,this.snapshot=Z,this.locks=X,this.progress=J,this.info=G,this.config=structuredClone(Z.config),this.state=structuredClone(Z.state)}rows(){return sZ(this.config,this.state,this.ctx.codec,{requireCredentialStamps:this.ctx.requireCredentialStamps===!0,...this.ctx.providerState?{providerState:this.ctx.providerState}:{}})}row($){return this.rows().find((Z)=>Z.id===$)}reservation($){if(this.rosterRow($)){let X=this.entry($);return X&&Object.hasOwn(X,"staged")?X.staged:void 0}let Z=this.stateAccount($)?.[h];return O(Z)&&Object.hasOwn(Z,"staged")?Z.staged:void 0}assertNotStaged($){F1(this.info.operation,$,this.reservation($))}roster(){if(!Array.isArray(this.config.accounts))this.config.accounts=[];return this.config.accounts}rosterRow($){return this.roster(),V6(this.config,$)}dropRosterRows($){let Z=this.roster(),X=Z.filter((J)=>!(O(J)&&J.id===$));return this.config.accounts=X,Z.length-X.length}entries(){return uZ(this.config)}entry($){return this.entries(),e0(this.config,$)}setEntry($,Z){U6(this.config,$,Z)}async completeTorn(){let{config:$,torn:Z}=cZ(this.config,this.state,this.ctx.codec,{requireCredentialStamps:this.ctx.requireCredentialStamps===!0});if(Z.length===0)return;this.config=$,await this.commitConfig({counted:!1})}stateAccount($){let Z=O(this.state.accounts)?this.state.accounts:{},X=Object.hasOwn(Z,$)?Z[$]:void 0;return O(X)?X:void 0}dropStateAccount($){if(O(this.state.accounts)&&Object.hasOwn(this.state.accounts,$))delete this.state.accounts[$]}setStateAccount($,Z){if(!O(this.state.accounts))this.state.accounts={};Object.defineProperty(this.state.accounts,$,{value:Z,enumerable:!0,writable:!0,configurable:!0})}async commitConfig($={}){let Z=this.roster(),X=new Set;for(let H of Z)if(O(H)&&typeof H.id==="string")X.add(H.id);let J=new Set;for(let H of u1(this.snapshot.config))if(O(H)&&typeof H.id==="string"&&!X.has(H.id))J.add(H.id);for(let H of Object.keys(this.entries()))if(!X.has(H))J.add(H);T9(this.config,J);let G=this.entries(),z={};for(let[H,Y]of Object.entries(G))if(X.has(H))Object.defineProperty(z,H,{value:Y,enumerable:!0,writable:!0,configurable:!0});let Q=this.config[m],B={...this.config,version:D$,accounts:Z,[m]:{...Q,schemaVersion:o0,[T0]:z}};await this.write(this.ctx.configPath,B,"config",$.counted??!0,$.durable??!1,()=>{if($.publicationDecision)this.markPublicationDecision();for(let H of J)this.ctx.removedIds.add(H);this.config=B}),this.config=B}async commitState($,Z={}){let X={...this.state,version:D$,accounts:O(this.state.accounts)?this.state.accounts:{}};if(await this.write(this.ctx.statePath,X,"state",!0,Z.durable??!1),this.state=X,$)this.progress.committed=$}async assertAll(){await this.locks.assertAll()}async syncState(){await this.assertAll();try{if(this.snapshot.stateExists)await kZ(this.ctx.statePath)}catch($){throw new x({operation:this.info.operation,rowId:this.info.rowId,phase:"before-first-write",kind:"publication-sync",retryable:!0,message:"Publication sync failed before the decision; nothing was written. Retry the same plan.",cause:$})}}markPublicationDecision(){this.progress.publicationDecided=!0}async syncConfig(){await this.assertAll(),await kZ(this.ctx.configPath)}async write($,Z,X,J=!0,G=!1,z){await xZ($,Z,{durable:G,beforeRename:async()=>{await this.ctx.onStep?.(`before-${X}-write`,this.info),await this.locks.assertAll()}},()=>{if(J)this.progress.writes++;z?.()}),await this.ctx.onStep?.(`after-${X}-write`,this.info)}}async function x9($,Z){let X=new r0($.lockDefaults,$.lockEnv),J={writes:0};try{for(let B of $.storeLocks)await X.acquire(B);let G=await H0($);if(G.status==="error")throw S0(G,"initialize",void 0);if(G.status==="ready")return"already-ready";let z={};for(let[B,H]of Object.entries(G.config))if(!Z.includes(B))z[B]=H;z.version=D$,z[m]={schemaVersion:o0,[T0]:{}};let Q={operation:"initialize",rowId:void 0};return await L0($.configPath,z,{beforeRename:async()=>{await $.onStep?.("before-config-write",Q),await X.assertAll()}}),J.writes++,await $.onStep?.("after-config-write",Q),"initialized"}catch(G){throw d1(G,"initialize",void 0,J)}finally{await X.releaseAll()}}async function a($,Z,X,J,G,z={}){let Q=Z.held.length;try{for(let Y of $.storeLocks)await Z.acquire(Y);let B=await H0($);if(B.status!=="ready")throw S0(B,J.operation,J.rowId,X.writes>0?"after-first-write":"before-first-write");let H=new b9($,B,Z,X,J);if(J.rowId!==void 0&&!["add","remove","pull","publishRoster","enable","disable"].includes(J.operation))H.assertNotStaged(J.rowId);if(z.completeTorn??!0)await H.completeTorn();return await G(H)}finally{await Z.releaseTo(Q)}}function d1($,Z,X,J){let G=Z==="pull"?"pull":J.writes>0?"after-first-write":"before-first-write",z=G==="after-first-write"?J.committed:void 0;if(Z==="publishRoster"&&J.publicationDecided)return new x({operation:Z,...X!==void 0?{rowId:X}:{},phase:G,kind:"publication-incomplete",retryable:!0,message:"The publication may already be decided. Replay the same plan or check publication(operationId).",cause:$});if(Z==="publishRoster"&&$ instanceof U$)return new x({operation:Z,...X!==void 0?{rowId:X}:{},phase:G,kind:"publication-sync",retryable:!0,message:"Publication sync failed before the decision; nothing was written. Retry the same plan.",cause:$});if($ instanceof x){if($.phase===G&&$.rowId===X&&$.operation===Z&&$.committed===z)return $;return new x({operation:Z,...X!==void 0?{rowId:X}:{},phase:$.kind==="after-persist-hook"?$.phase:G,retryable:$.retryable,kind:$.kind,...$.committed??z?{committed:$.committed??z}:{},message:$.message,...$.cause!==void 0?{cause:$.cause}:{}})}let Q={operation:Z,...X!==void 0?{rowId:X}:{},phase:G,...z?{committed:z}:{},cause:$};if($ instanceof n0)return new x({...Q,retryable:!0,kind:"lock-ownership",message:G==="after-first-write"?`${Z} lost a lease after its first write; the intermediate stays on disk`:`${Z} lost a lease before writing; nothing was written`});if($ instanceof M1)return new x({...Q,retryable:!0,kind:"lock-contention",message:$.message});return new x({...Q,retryable:!1,kind:"unexpected",message:$ instanceof Error?$.message:String($)})}async function z0($,Z,X,J,G){let z=new r0($.lockDefaults,$.lockEnv),Q={writes:0};try{return await G(z,Q)}catch(B){let H=d1(B,Z,X,Q);if(H.kind!=="after-persist-hook")await q9(Z,J,X,H,$.logger);throw H}finally{await z.releaseAll()}}function N0($,Z){return{...$.rowLockOptions,name:`row-${encodeURIComponent(p(Z))}`,path:$.ctx.statePath}}async function w0($,Z,X){let J=await H0($.ctx);if(J.status!=="ready")throw S0(J,Z,X);let G=J.rows.find((Y)=>Y.id===X),z=e0(J.config,X),Q=J.state.accounts,B=O(Q)&&Object.hasOwn(Q,X)?Q[X]:void 0,H=O(B)?B[h]:void 0;if(G&&!["enable","disable"].includes(Z)&&z&&Object.hasOwn(z,"staged"))F1(Z,X,z.staged);if(!G&&O(H)&&Object.hasOwn(H,"staged"))F1(Z,X,H.staged);if(!G)throw A0(Z,X);return{result:J,row:G}}function A0($,Z){return new x({operation:$,rowId:Z,phase:$==="pull"?"pull":"before-first-write",retryable:!1,kind:"unknown-row",message:`no row ${Z} in the pool`})}function Y0($,Z){if(Z.unbound)throw _($,Z.id,"unbound-credential",`row ${Z.id}'s credential is not the one this store stamped for it (stamp ${Z.stamp}); replace it with fresh material`)}function _($,Z,X,J,G=!1){return new x({operation:$,rowId:Z,phase:$==="pull"?"pull":"before-first-write",retryable:G,kind:X,message:J})}async function K6($,Z,X,J){let{ctx:G}=$,z=new r0(G.lockDefaults,G.lockEnv),Q={writes:0};try{if(!$0(X?.credentialEpoch))throw _("pull",Z,"invalid-input","the credential epoch the reading was issued for must be a positive safe integer");await a(G,z,Q,{operation:"pull",rowId:Z},async(B)=>{B.assertNotStaged(Z);let H=B.row(Z);if(!H)throw A0("pull",Z);if(H.invalid)throw _("pull",Z,"invalid-row",`row ${Z} is invalid`);if(!H.credential)throw _("pull",Z,"no-credential",`row ${Z} holds no credential`);Y0("pull",H);let Y=B.entry(Z);if(H.torn||!Y||Y.credentialEpoch!==X.credentialEpoch||H.identity!==X.identity)throw new x({operation:"pull",rowId:Z,phase:"pull",retryable:!0,kind:"attribution",message:`quota for ${Z} was issued for a credential the row no longer holds`});let W=G.codec.merge(Y.quota,J);if(!G.codec.validate(W))throw _("pull",Z,"invalid-quota","the quota codec rejected the merged map");B.setEntry(Z,{...Y,quota:W,needsFirstReading:!1}),await B.commitConfig()},{completeTorn:!1})}catch(B){throw d1(B,"pull",Z,Q)}finally{await z.releaseAll()}}function p0($,Z,X,J,G="the provider state"){if(!$)throw _(Z,X,"invalid-input","the store was opened without a provider-state codec");let z;try{let Q=JSON.stringify(J);z=Q===void 0?void 0:JSON.parse(Q)}catch{z=void 0}if(z===void 0)throw _(Z,X,"invalid-provider-state",`${G} cannot be stored as JSON`);if(!$.validate(z))throw _(Z,X,"invalid-provider-state",`the provider-state codec rejected ${G}`);return z}function M$($,Z,X,J,G){if(J===void 0||!$?.merge)return{kind:"set",value:G};return{kind:"set",value:p0($,Z,X,$.merge(structuredClone(J),structuredClone(G)),"the merged provider state")}}function k9($,Z,X,J,G){let z=$?.onReplace,Q=z?z(Z.providerState===void 0?void 0:structuredClone(Z.providerState),{id:Z.id,credentialEpoch:X,...Z.identity!==void 0?{previousIdentity:Z.identity}:{},...J!==void 0?{identity:J}:{},...G!==void 0?{incoming:structuredClone(G)}:{}}):G;if(Q===void 0)return{kind:"clear"};if(!z)return{kind:"set",value:Q};return{kind:"set",value:p0($,"replace",Z.id,Q,"the provider state onReplace returned")}}function y9($,Z,X,J,G){if(Z.kind==="set")return p1($,Z.value);if(Z.kind==="clear")return;return K$(X,J?.credential,G,J?.identity)}async function f9($,Z,X,J,G={}){G0("updateProviderState");let{ctx:z}=$,Q="updateProviderState";return z0(z,Q,Z,G.onFailure,async(B,H)=>{let Y=z.providerState;if(!Y)throw _(Q,Z,"invalid-input","the store was opened without a provider-state codec");if(typeof J!=="function")throw _(Q,Z,"invalid-input","a mutator is required");let W=O(X)?X.credentialEpoch:void 0;if(!$0(W))throw _(Q,Z,"invalid-input","the credential epoch the provider state was read at is required");let{row:U}=await w0($,Q,Z);await B.acquire(N0($,U));for(let j of G.extraLocks??[])await B.acquire(j);return a(z,B,H,{operation:Q,rowId:Z},async(j)=>{let K=j.row(Z);if(!K)throw A0(Q,Z);if(p(K)!==p(U))throw _(Q,Z,"row-key-changed",`row ${Z}'s wire identity changed while its lock was being taken`,!0);if(K.invalid)throw _(Q,Z,"invalid-row",`row ${Z} failed validation`);if(!K.credential)throw _(Q,Z,"no-credential",`row ${Z} holds no credential`);if(Y0(Q,K),(K.credentialEpoch??1)!==W||K.identity!==X.identity)throw _(Q,Z,"attribution",`the provider state for ${Z} was read for a credential or account the row no longer holds`,!0);let N=await aZ(j,Y,Q,K,J);if(N.kind!=="changed")return{id:Z,outcome:"unchanged",...N.kind==="unchanged"&&N.value!==void 0?{providerState:N.value}:{}};return j.setStateAccount(Z,N.account),await j.commitState(),N.value===void 0?{id:Z,outcome:"cleared"}:{id:Z,outcome:"updated",providerState:N.value}})})}var g9=Symbol.for("@cortexkit/common-auth/store/decline-transition");async function aZ($,Z,X,J,G,z=!1){let{id:Q,credential:B}=J;if(!B)throw _(X,Q,"no-credential",`row ${Q} holds no credential`);let H=J.credentialEpoch??1,Y=$.stateAccount(Q),W=Y?.[h],U=U0(W);if(!O(W)||!U?.binding||U.digest!==x0(B)||U.credentialEpoch!==H||U.binding.identity!==J.identity)throw _(X,Q,"unbound-credential",`row ${Q}'s credential carries no stamp of this store to bind a provider state to (stamp ${J.stamp}); rotate or replace it first`);let j=J.providerState===void 0?void 0:structuredClone(J.providerState),K=await b0(X,()=>G(j,J));if(z&&K===g9)return{kind:"declined"};let V=K===void 0?void 0:p0(Z,X,Q,K,"the provider state the mutator returned"),N=Y!==void 0&&Object.hasOwn(Y,B0);if(V===void 0?!N:J.providerState!==void 0&&JSON.stringify(J.providerState)===JSON.stringify(V))return{kind:"unchanged",...V!==void 0?{value:V}:{}};let q={...Y};if(V===void 0){delete q[B0];let M={...W};delete M.providerState,q[h]=M}else{q[B0]=V;let M=p1(Z,V);if(U.providerState!==M)q[h]={...W,providerState:M}}return{kind:"changed",...V!==void 0?{value:V}:{},account:q}}import{randomUUID as h9}from"node:crypto";async function F6($,Z,X){if(!X)return;let J=$.rows().map((z)=>{let{id:Q,type:B,label:H,enabled:Y,disabledReason:W,identity:U,credentialEpoch:j,stamp:K,staged:V,torn:N,invalid:q}=z;return{id:Q,type:B,label:H,enabled:Y,disabledReason:W,identity:U,credentialEpoch:j,stamp:K,staged:V,torn:N,invalid:q}}),G=await b0($.info.operation,()=>X({id:Z,row:J.find((z)=>z.id===Z),rows:J,config:structuredClone($.snapshot.config)}));if(G!==void 0)throw _($.info.operation,Z,"row-protected",G)}var FX=["access","refresh","expires","lastRefreshedAt","apiKey"];function LX($){return{baseURL:String($.baseURL).trim(),authHeader:$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer"}}function _X($,Z,X){if(X.type!=="api")return X;let J=$.rosterRow(Z);if(!O(J)){if(X.baseURL===void 0)throw _($.info.operation,Z,"invalid-input","api credential needs a valid baseURL");return{...X,baseURL:X.baseURL}}let G=$.row(Z)?.credential,z=G?.type==="api"?{baseURL:G.baseURL.trim(),authHeader:G.authHeader??"authorization-bearer"}:LX(J),Q=X.baseURL?.trim()??z.baseURL,B=X.authHeader??z.authHeader;if(Q!==z.baseURL||B!==z.authHeader)throw _($.info.operation,Z,"endpoint-mismatch",`row ${Z} sends its key to another endpoint or header; a key for another endpoint is a replacement`);return{...X,baseURL:Q,authHeader:B}}function v9($,Z,X,J){let G=$.rosterRow(Z),z=$.row(Z),Q=J??(z?z.identity:O(G)&&typeof G.accountId==="string"&&G.accountId?G.accountId:void 0);return{...Q!==void 0?{identity:Q}:{},...X.type==="api"?{baseURL:X.baseURL,authHeader:X.authHeader??"authorization-bearer"}:{}}}function q6($,Z,X,J,G={}){let z=_X(Z,X,J),Q=Z.stateAccount(X),B=G.providerState??{kind:"keep"},H=Z.row(X)?.credentialEpoch??Z.entry(X)?.credentialEpoch,Y=typeof H==="number"?H:1,W=y9($.ctx.providerState,B,Q,Q&&Object.hasOwn(Q,B0)?Z.row(X):void 0,Y),U=typeof Q?.lastRefreshedAt==="number"?Q.lastRefreshedAt:void 0,j=z.type==="oauth"?G.stamp??q$(U,$.ctx.now()):void 0,K={...Q??{}};for(let q of FX)delete K[q];if(G.clearErrors)delete K.lastRefreshError,delete K.lastQuotaRefreshError,delete K.quota;if(B.kind==="clear")delete K[B0];else if(B.kind==="set")K[B0]=B.value;let V=A9(z,j),N={...K,...S9(z,j),[h]:{...G.staged?{staged:G.staged}:{},...G.transition!==void 0?{[D6]:G.transition}:{},...pZ(V,Y,G.binding??v9(Z,X,V,G.identity),{replace:G.binding!==void 0,...W!==void 0?{providerState:W}:{}})}};return{stored:V,account:N}}async function N6($,Z,X){return $.setStateAccount(Z,X.account),await $.commitState(X.stored),X.stored}async function L6($,Z,X,J,G={}){return N6(Z,X,q6($,Z,X,J,G))}async function OX($,Z,X){if(!Z.credential||Z.stamp!=="bound")return;let J=$.stateAccount(Z.id),G=K$(J,Z.credential,Z.credentialEpoch??1,Z.identity);$.setStateAccount(Z.id,{...J??{},[h]:pZ(Z.credential,Z.credentialEpoch??1,v9($,Z.id,Z.credential,X),G!==void 0?{providerState:G}:{})}),await $.commitState()}function rZ($,Z,X){let J=$==="add"?w1(Z):void 0;if(J)throw _($,Z,"invalid-input",J);let G=R9(X,{baseURLOptional:$==="rotate"});if(G)throw _($,Z,"invalid-input",G)}function _6($,Z,X,J){if(!X)throw A0($,Z);if(X.invalid)throw _($,Z,"invalid-row",`row ${Z} failed validation`);if(J&&J.type!==X.type)throw _($,Z,"type-mismatch",`row ${Z} holds a ${X.type} credential`);return X}function s1($,Z,X){if(X!==void 0&&!$0(O(X)?X.credentialEpoch:void 0))throw _($,Z,"invalid-input","the attribution must name a credential epoch that is a positive safe integer")}function O6($,Z,X,J){if(!X)throw A0($,Z);if(X.invalid)throw _($,Z,"invalid-row",`row ${Z} failed validation`);if((X.credentialEpoch??1)!==J.credentialEpoch||X.identity!==J.identity)throw _($,Z,"attribution",`the ${$} of ${Z} was issued for a credential or account the row no longer holds`,!0)}function M6($,Z){return _($,Z,"identity-mismatch",`row ${Z} is recorded for another account; a credential of a different account is a replacement`)}function F$($,Z){return _($,Z,"row-key-changed",`row ${Z}'s wire identity changed while its lock was being taken`,!0)}function CX($,Z,X,J){let{id:G,credential:z,identity:Q}=X;if(!$.ctx.requireCredentialStamps||Z.rosterRow(G)||!c1(Z.state,G))return;let B=()=>{throw _("add",G,"unbound-credential",`orphan ${G} cannot be bound to this add's material; remove it explicitly before adding different material`)},H=Z.stateAccount(G),Y=U0(H?.[h]);if(!Y?.binding||Y.dispatch===void 0||Y.replace)return B();if(z.type==="api"&&(Y.binding.baseURL===void 0||Y.binding.authHeader===void 0))return B();let W=z.type==="api"?{...z,baseURL:Y.binding.baseURL,authHeader:Y.binding.authHeader}:z,[U]=$1({accounts:[l1({id:G,credential:W,identity:Y.binding.identity,addedAt:0})],[m]:{rows:{[G]:{credentialEpoch:j6(Z.config,G)}}}},Z.state,$.ctx.codec,$.ctx.providerState);if(!U?.credential||U.invalid||U.stamp!=="bound")return B();if(Q!==void 0&&Q!==U.identity)return B();if(x0(z)!==Y.digest)return B();if(z.type==="api"){if(z.baseURL.trim()!==Y.binding.baseURL)return B();if((z.authHeader??"authorization-bearer")!==Y.binding.authHeader)return B()}else if(m0(z)!==Y.dispatch)return B();if(Y.providerState!==void 0&&U.providerState===void 0)return B();if(J!==void 0&&p1($.ctx.providerState,J)!==Y.providerState)return B();return U}function PX($,Z,X,J){let{id:G,credential:z,identity:Q,label:B}=X,H=Z.rosterRow(G),Y=()=>{throw _("add",G,H?"id-exists":"unbound-credential",`row ${G} does not match this staged add`)},W=Z.stateAccount(G),U=U0(W?.[h]),j=U?.staged;if(!U?.binding||!j||U.replace||U.dispatch===void 0)return Y();if(H&&(H.type!==z.type||H.label!==B||H.accountId!==Q))return Y();if(j.reservation!==X.stage?.reservation||j.label!==B||j.disabledReason!==X.disabled?.reason||U.binding.identity!==Q)return Y();let K=J===void 0?void 0:L1(J),V=W?.[B0],N=V===void 0?void 0:L1(V);if(j.providerState!==K||j.providerState!==N)return Y();if(x0(z)!==U.digest||m0(z)!==U.dispatch)return Y();let q=H?Z.config:{accounts:[{...l1({id:G,credential:z.type==="api"?{...z,baseURL:U.binding.baseURL??"",authHeader:U.binding.authHeader}:z,identity:U.binding.identity,label:j.label,addedAt:0}),enabled:!1}],[m]:{rows:{[G]:{credentialEpoch:U.credentialEpoch,disabledReason:j.disabledReason,staged:{reservation:j.reservation}}}}},M=$1(q,Z.state,$.ctx.codec,$.ctx.providerState).find((P)=>P.id===G);if(!M?.credential||M.invalid||M.stamp!=="bound"||M.type!==z.type||M.enabled||M.label!==j.label||M.identity!==U.binding.identity||M.disabledReason!==j.disabledReason||M.staged?.reservation!==j.reservation)return Y();if(H)return{id:G,outcome:"exists",credential:M.credential,credentialEpoch:U.credentialEpoch};if(j6(Z.config,G)!==U.credentialEpoch)return Y();return Z.roster().push({...l1({id:G,credential:z,identity:Q,label:B,addedAt:$.ctx.now()}),enabled:!1}),Z.setEntry(G,{credentialEpoch:U.credentialEpoch,needsFirstReading:z.type==="oauth",disabledReason:j.disabledReason,staged:{reservation:j.reservation}}),Z.commitConfig().then(()=>({id:G,outcome:"completed",credential:M.credential,credentialEpoch:U.credentialEpoch}))}async function m9($,Z,X={}){G0("add");let{ctx:J}=$,{id:G,credential:z,identity:Q,label:B}=Z,H=Z.stage!==void 0||Z.disabled!==void 0,Y=await z0(J,"add",G,X.onFailure,async(W,U)=>{rZ("add",G,z);let j=X.onExisting??"rotate";if(Z.stage!==void 0&&j==="rotate")throw _("add",G,"invalid-input","a staged add needs onExisting: 'refuse' or 'stage-duplicate'");if(!["rotate","refuse","stage-duplicate"].includes(j)||Z.stage!==void 0&&(B!==void 0&&typeof B!=="string"||Q!==void 0&&(typeof Q!=="string"||!Q))||Z.disabled!==void 0&&(!O(Z.disabled)||typeof Z.disabled.reason!=="string")||Z.stage!==void 0&&(!O(Z.stage)||typeof Z.stage.reservation!=="string"||!Z.stage.reservation||!Z.disabled)||j==="stage-duplicate"&&(!Z.disabled||!Z.stage))throw _("add",G,"invalid-input","staging requires a reservation and a disabled reason");let K=Z.providerState===void 0?void 0:p0(J.providerState,"add",G,Z.providerState);if(await W.acquire(N0($,{id:G,identity:Q})),z.type==="oauth")await W.acquire(X.providerLock??$.providerLock);for(let V of X.extraLocks??[])await W.acquire(V);return a(J,W,U,{operation:"add",rowId:G},async(V)=>{await F6(V,G,X.protect);let N=O(V.state.accounts)?V.state.accounts:{},q=Object.entries(N).find(([f,k])=>{if(f===G||V.rosterRow(f)||!O(k))return!1;let y=k[h];if(!O(y)||!Object.hasOwn(y,"staged"))return!1;return z.type==="oauth"?k.refresh===z.refresh:typeof k.apiKey==="string"&&k.apiKey.trim()===z.apiKey.trim()});if(q)throw _("add",q[0],"row-staged",`orphan ${q[0]} reserves this secret until its staged add is replayed or removed`);if(J.removedIds.has(G))throw _("add",G,"id-removed",`id ${G} was removed from the roster in this process and is not reused`);if(Z.stage&&j!=="rotate"&&(V.rosterRow(G)||c1(V.state,G)))return PX($,V,Z,K);if(j==="rotate"){V.assertNotStaged(G);let f=V.rows().find((k)=>k.fingerprint===t0(z));if(f)V.assertNotStaged(f.id)}if(j==="refuse"){let f=V.rows().find((d)=>d.fingerprint===t0(z)||d.id===G&&d.credential),k=O(V.state.accounts)?V.state.accounts:{},y=Object.entries(k).find(([,d])=>{if(!O(d))return!1;if(z.type==="oauth")return d.refresh===z.refresh;return typeof d.apiKey==="string"&&d.apiKey.trim()===z.apiKey.trim()})?.[0],r=f?.id??y??G;if(f||y!==void 0||c1(V.state,G))throw _("add",r,"credential-exists",`row ${r} already holds this secret or id`)}if(j==="stage-duplicate"&&(V.rosterRow(G)||c1(V.state,G)))throw _("add",G,"id-exists",`row ${G} already exists`);let M=CX($,V,Z,K),P=V.rows(),E=t0(z),F=j==="rotate"&&!M&&P.find((f)=>f.invalid===void 0&&f.fingerprint===E);if(F){if(V.assertNotStaged(F.id),Y0("add",F),Q!==void 0&&F.identity!==void 0&&Q!==F.identity)throw M6("add",F.id);let f=q6($,V,F.id,z,{...K!==void 0?{providerState:M$(J.providerState,"add",F.id,F.providerState,K)}:{}});await V.completeTorn(),V.assertNotStaged(F.id);let k=await N6(V,F.id,f);return{id:F.id,outcome:"rotated",credential:k,credentialEpoch:F.credentialEpoch??1}}let D=P.find((f)=>f.id===G);if(D){if(D.invalid)throw _("add",G,"invalid-row",`row ${G} is invalid`);if(D.credential)throw _("add",G,"id-exists",`row ${G} already holds a credential`);if(Y0("add",D),D.type!==z.type)throw _("add",G,"type-mismatch",`row ${G} is a ${D.type} row`);if(Q!==void 0&&D.identity!==void 0&&Q!==D.identity)throw M6("add",G);if(!D.hasEntry)V.setEntry(G,{credentialEpoch:1,needsFirstReading:z.type==="oauth"});let f=q6($,V,G,z,{clearErrors:!0,...K!==void 0?{providerState:{kind:"set",value:K}}:{}});await V.completeTorn();let k=await N6(V,G,f);if(!D.hasEntry)await V.commitConfig();return{id:G,outcome:"completed",credential:k,credentialEpoch:D.credentialEpoch??1}}let L=j6(V.config,G);if(!$0(L))throw _("add",G,"id-removed",`id ${G} has held every credential epoch and is not reused; add the credential under another id`);let S=M?.identity??Q;V.roster().push(l1({id:G,credential:z,...S!==void 0?{identity:S}:{},...B!==void 0?{label:B}:{},addedAt:J.now()})),V.setEntry(G,{credentialEpoch:L,needsFirstReading:z.type==="oauth",...Z.stage?{staged:{reservation:Z.stage.reservation}}:{}});let v="added";if(Z.disabled)a0(V,G,Z.disabled.reason),v="added-disabled";if(!Z.disabled&&S!==void 0&&z.type==="oauth"){if(P.find((k)=>k.invalid===void 0&&k.type==="oauth"&&k.enabled&&k.identity===S))a0(V,G,IZ),v="added-disabled"}if(M?.credential)return await V.commitConfig(),{id:G,outcome:v,credential:M.credential,credentialEpoch:M.credentialEpoch??L};V.dropStateAccount(G);let u=q6($,V,G,z,{...Z.stage&&Z.disabled?{staged:{reservation:Z.stage.reservation,disabledReason:Z.disabled.reason,...B!==void 0?{label:B}:{},...K!==void 0?{providerState:L1(K)}:{}}}:{},...K!==void 0?{providerState:{kind:"set",value:K}}:{}});if(j==="rotate")await V.completeTorn();let n=await N6(V,G,u);return await V.commitConfig(),{id:G,outcome:v,credential:n,credentialEpoch:L}},{completeTorn:!1})});if(!H&&z.type==="oauth"&&(Y.outcome==="added"||Y.outcome==="completed"))$.firePull(Y.id,"add");return Y}async function w9($,Z,X,J={},G={}){G0("replace");let{ctx:z}=$,Q=await z0(z,"replace",Z,G.onFailure,async(B,H)=>{rZ("replace",Z,X),s1("replace",Z,G.attribution);let Y=J.providerState===void 0?void 0:p0(z.providerState,"replace",Z,J.providerState),{row:W}=await w0($,"replace",Z);if(await B.acquire(N0($,W)),X.type==="oauth")await B.acquire(G.providerLock??$.providerLock);for(let U of G.extraLocks??[])await B.acquire(U);return a(z,B,H,{operation:"replace",rowId:Z},async(U)=>{if(G.attribution!==void 0)O6("replace",Z,U.row(Z),G.attribution),await U.completeTorn();let j=_6("replace",Z,U.row(Z),X);if(p(j)!==p(W))throw F$("replace",Z);let K=U.entry(Z)?.credentialEpoch,V=(typeof K==="number"?K:1)+1;if(!$0(V))throw _("replace",Z,"invalid-row",`row ${Z}'s credential epoch cannot advance past ${Number.MAX_SAFE_INTEGER}; remove the row and add the new credential as a new row`);let N=k9(z.providerState,j,V,J.identity,Y),q={...J.identity!==void 0?{identity:J.identity}:{},...X.type==="api"?{baseURL:X.baseURL.trim(),authHeader:X.authHeader??"authorization-bearer"}:{}};if(dZ(U,Z,V,q),J.identity!==void 0)m1(U,J.identity);let M=await L6($,U,Z,X,{clearErrors:!0,binding:q,providerState:N});return await U.commitConfig(),{id:Z,credential:M,credentialEpoch:V}},{completeTorn:G.attribution===void 0})});if(X.type==="oauth")$.firePull(Z,"replace");return Q}async function p9($,Z,X,J={},G={}){G0("rotate");let{ctx:z}=$;return z0(z,"rotate",Z,G.onFailure,async(Q,B)=>{rZ("rotate",Z,X),s1("rotate",Z,G.attribution);let H=J.providerState===void 0?void 0:p0(z.providerState,"rotate",Z,J.providerState),{row:Y}=await w0($,"rotate",Z);if(await Q.acquire(N0($,Y)),J.identity!==void 0&&X.type==="oauth")await Q.acquire(G.providerLock??$.providerLock);for(let W of G.extraLocks??[])await Q.acquire(W);return a(z,Q,B,{operation:"rotate",rowId:Z},async(W)=>{if(G.attribution!==void 0)O6("rotate",Z,W.row(Z),G.attribution),await W.completeTorn();let U=_6("rotate",Z,W.row(Z),X);if(p(U)!==p(Y))throw F$("rotate",Z);if(Y0("rotate",U),J.identity!==void 0&&U.identity!==void 0&&J.identity!==U.identity)throw M6("rotate",Z);let j=J.identity!==void 0&&U.identity===void 0?J.identity:void 0,K=await L6($,W,Z,X,{identity:j,...H!==void 0?{providerState:M$(z.providerState,"rotate",Z,U.providerState,H)}:{}}),V=!1;if(!U.hasEntry)W.setEntry(Z,{credentialEpoch:1,needsFirstReading:U.type==="oauth"}),V=!0;if(J.identity!==void 0&&U.identity!==J.identity)N1(W,Z,J.identity),V=!0;if(V)await W.commitConfig();return{id:Z,credential:K}},{completeTorn:G.attribution===void 0})})}async function u9($,Z,X,J,G){G0(Z);let{ctx:z}=$,Q=z.providerState,B=G.attribution,H=G.providerState;return z0(z,Z,X,G.onFailure,async(Y,W)=>{if(s1(Z,X,B),H!==void 0){if(typeof H!=="function")throw _(Z,X,"invalid-input","the provider-state mutator must be a function");if(B===void 0)throw _(Z,X,"invalid-input","a provider-state change needs the attribution of the credential it is for");if(!Q)throw _(Z,X,"invalid-input","the store was opened without a provider-state codec")}let{row:U}=await w0($,Z,X);await Y.acquire(N0($,U));for(let j of G.extraLocks??[])await Y.acquire(j);return a(z,Y,W,{operation:Z,rowId:X},async(j)=>{await F6(j,X,G.protect),j.assertNotStaged(X);let K=j.row(X),V=J.enabled?_6("enable",X,K):K;if(!V||!j.rosterRow(X))throw A0(Z,X);if(p(V)!==p(U))throw F$(Z,X);if(B!==void 0)O6(Z,X,V,B);if(J.enabled&&V.disabledReason?.startsWith(v1))throw _("enable",X,"identity-contradicted",`row ${X} needs an identity-validated credential replacement before it can be enabled`);let N=!J.enabled||!V.enabled||V.disabledReason!==void 0;if(J.enabled&&N&&V.type==="oauth"){let F=V.identity===void 0?void 0:j.rows().find((D)=>D.id!==X&&D.invalid===void 0&&D.type==="oauth"&&D.enabled&&D.identity===V.identity);if(F)throw _("enable",X,"duplicate-identity",`row ${F.id} is enabled with the same identity as row ${X}`)}if(H===void 0||Q===void 0){if(await j.completeTorn(),!N)return{id:X};if(J.enabled)V$(j,X);else a0(j,X,J.reason);return await j.commitConfig(),{id:X}}if(!V.credential)throw _(Z,X,"no-credential",`row ${X} holds no credential`);Y0(Z,V);let q=await aZ(j,Q,Z,V,H,!0);if(q.kind==="declined")return{id:X,declined:!0};await j.completeTorn();let M={id:X,providerStateOutcome:q.kind==="unchanged"?"unchanged":q.value===void 0?"cleared":"updated",...q.value!==void 0?{providerState:q.value}:{}};if(q.kind==="unchanged"){if(N){if(J.enabled)V$(j,X);else a0(j,X,J.reason);await j.commitConfig()}return M}if(!N)return j.setStateAccount(X,q.account),await j.commitState(),M;let P=J.enabled?{mark:h9(),enabled:!0}:{mark:h9(),enabled:!1,reason:J.reason},E=q.account[h];return j.setStateAccount(X,{...q.account,[h]:{...E,[D6]:P}}),await j.commitState(),N$(j,X,P),await j.commitConfig(),M},{completeTorn:!1})})}function l9($,Z,X,J={}){return u9($,"disable",Z,{enabled:!1,reason:X},J)}function d9($,Z,X={}){return u9($,"enable",Z,{enabled:!0},X)}async function c9($,Z,X={}){G0("remove");let{ctx:J}=$;return z0(J,"remove",Z,X.onFailure,async(G,z)=>{if(typeof Z!=="string"||Z.length===0)throw _("remove",Z,"invalid-input","id must be non-empty");let Q=X.attribution;if(s1("remove",Z,Q),X.staged!==void 0&&(!O(X.staged)||typeof X.staged.reservation!=="string"||!X.staged.reservation))throw _("remove",Z,"invalid-input","a staged removal needs a reservation");let B=await H0(J);if(B.status!=="ready")throw S0(B,"remove",Z);let H=B.rows.find((W)=>W.id===Z);if(!H&&!c1(B.state,Z))throw A0("remove",Z);let Y=p(H??{id:Z});await G.acquire(N0($,H??{id:Z}));for(let W of X.extraLocks??[])await G.acquire(W);return a(J,G,z,{operation:"remove",rowId:Z},async(W)=>{let U=W.reservation(Z);if(U!==void 0){if(!O(U)||!X.staged||U.reservation!==X.staged.reservation)throw _("remove",Z,"row-staged",`row ${Z} is reserved for roster publication`)}else if(X.staged)throw _("remove",Z,"attribution",`row ${Z} is no longer reserved`);let j=W.row(Z),K=c1(W.state,Z);if(!j&&!K)throw A0("remove",Z);if(p(j??{id:Z})!==Y)throw F$("remove",Z);if(Q!==void 0)if(j)C6(Z,j,Q);else TX($,W,Z,Q);let V=X.protect;if(V){let N={row:j,config:W.snapshot.config,state:W.snapshot.state},q=await b0("remove",()=>V(Z,N));if(q!==void 0)throw _("remove",Z,"row-protected",q)}if(j){if(Q===void 0)await W.completeTorn();W.dropRosterRows(Z),await W.commitConfig()}if(K)W.dropStateAccount(Z),await W.commitState();return{id:Z,outcome:j?"removed":"completed"}},{completeTorn:!1})})}function C6($,Z,X,J="remove"){if(O6(J,$,Z,X),Z.torn)throw _(J,$,"attribution",`row ${$} is between the writes of another operation; retry once it completes`,!0);if(Z.stamp!=="bound")throw _(J,$,"unbound-credential",`row ${$}'s credential is not bound to its stamp, so the removal cannot be attributed to it`)}function TX($,Z,X,J){let G=()=>_("remove",X,"unbound-credential",`orphan ${X} has no credential stamp this store can bind, so the removal cannot be attributed to it`),z=Z.stateAccount(X),Q=U0(z?.[h]);if(!z||!Q?.binding||Q.dispatch===void 0||Q.replace)throw G();let B;if(typeof z.apiKey==="string"){if(Q.binding.baseURL===void 0||Q.binding.authHeader===void 0)throw G();B={type:"api",apiKey:z.apiKey,baseURL:Q.binding.baseURL,authHeader:Q.binding.authHeader}}else if(typeof z.refresh==="string")B={type:"oauth",refresh:z.refresh};else throw G();let[H]=$1({accounts:[l1({id:X,credential:B,identity:Q.binding.identity,addedAt:0})],[m]:{rows:{[X]:{credentialEpoch:Q.credentialEpoch}}}},Z.state,$.ctx.codec,$.ctx.providerState);if(!H?.credential||H.invalid||H.stamp!=="bound")throw G();if(Q.credentialEpoch!==J.credentialEpoch||Q.binding.identity!==J.identity)throw _("remove",X,"attribution",`orphan ${X} was written for a credential or account other than the one this removal was decided for`,!0)}function c1($,Z){let X=$.accounts;return O(X)&&Object.hasOwn(X,Z)}function nZ($){return O($)&&typeof $.id==="string"?$.id:void 0}function SX($,Z){if(!Array.isArray(Z))return"ids must be an array of roster ids";let X=new Set;for(let z of $){let Q=nZ(z);if(Q!==void 0)X.add(Q)}let J=new Set;for(let z of Z){if(typeof z!=="string")return"ids must be an array of roster ids";if(J.has(z))return`id ${z} appears more than once`;if(!X.has(z))return`id ${z} is not in the roster`;J.add(z)}let G=[...X].filter((z)=>!J.has(z));if(G.length>0)return`the order leaves out roster id(s) ${G.join(", ")}`;return}function AX($,Z){let X=new Map;for(let z of $){let Q=nZ(z);if(Q===void 0)continue;let B=X.get(Q);if(B)B.push(z);else X.set(Q,[z])}let J=Z.flatMap((z)=>X.get(z)??[]),G=0;return $.map((z)=>nZ(z)===void 0?z:J[G++])}async function s9($,Z,X={}){G0("reorder");let{ctx:J}=$,G=X.onFailure;return z0(J,"reorder",void 0,G&&((z,Q)=>G(Q)),async(z,Q)=>{for(let B of X.extraLocks??[])await z.acquire(B);return a(J,z,Q,{operation:"reorder",rowId:void 0},async(B)=>{let H=B.roster(),Y=SX(H,Z);if(Y)throw new x({operation:"reorder",phase:"before-first-write",retryable:!1,kind:"invalid-order",message:Y});let W=[...Z],U=AX(H,W);if(U.every((j,K)=>j===H[K]))return{ids:W,outcome:"unchanged"};return B.config.accounts=U,await B.commitConfig(),{ids:W,outcome:"reordered"}},{completeTorn:!1})})}async function i9($,Z,X,J,G={}){return G0("recordIdentity"),z0($.ctx,"recordIdentity",Z,G.onFailure,async(z,Q)=>{if(typeof X!=="string"||X.length===0)throw _("recordIdentity",Z,"invalid-input","identity must be non-empty");let B=O(J)?J.credentialEpoch:void 0;if(!$0(B))throw _("recordIdentity",Z,"invalid-input","the credential epoch the identity lookup was issued for is required");let{row:H}=await w0($,"recordIdentity",Z);await z.acquire(N0($,H)),await z.acquire(G.providerLock??$.providerLock);for(let Y of G.extraLocks??[])await z.acquire(Y);return a($.ctx,z,Q,{operation:"recordIdentity",rowId:Z},async(Y)=>{let W=_6("recordIdentity",Z,Y.row(Z));if(p(W)!==p(H))throw F$("recordIdentity",Z);if(Y0("recordIdentity",W),(W.credentialEpoch??1)!==B)throw _("recordIdentity",Z,"attribution",`the identity for ${Z} was looked up for a credential the row no longer holds`,!0);if(W.identity!==void 0&&W.identity!==X)throw M6("recordIdentity",Z);if(W.identity===void 0)await OX(Y,W,X);let U=N1(Y,Z,X);return await Y.commitConfig(),{id:Z,disabled:U}})})}function n9($){let Z=$[m];return O(Z)&&O(Z.publications)?Z.publications:{}}function r9($,Z){let X=n9($);if(!Object.hasOwn(X,Z))return;let J=X[Z];if(!O(J)||J.operationId!==Z||typeof J.planDigest!=="string"||!/^[a-f0-9]{64}$/.test(J.planDigest)||!["committed","cleaned"].includes(String(J.phase))||!Array.isArray(J.removed)||!Array.isArray(J.finalized)||J.removed.some((G)=>!O(G)||typeof G.id!=="string"||!$0(G.credentialEpoch))||J.finalized.some((G)=>!O(G)||typeof G.id!=="string"||!$0(G.credentialEpoch)||typeof G.reservation!=="string"||!G.reservation||typeof G.enabled!=="boolean"))throw _("publishRoster",Z,"invalid-input","the stored publication receipt is malformed");return structuredClone(J)}async function o9($,Z){let X=await H0($.ctx);if(X.status!=="ready")throw S0(X,"publishRoster",Z);return r9(X.config,Z)}function RX($,Z){let X=()=>{throw _("publishRoster",Z?.operationId??"","invalid-input","the publication plan is invalid")};if(!O(Z)||typeof Z.operationId!=="string"||!Z.operationId||!Array.isArray(Z.remove)||!Array.isArray(Z.finalize)||!Array.isArray(Z.order))X();let J=new Set;for(let G of[...Z.remove,...Z.finalize]){if(!O(G)||typeof G.id!=="string"||w1(G.id)||J.has(G.id)||!G.attribution)X();if(J.add(G.id),s1("publishRoster",G.id,G.attribution),G.attribution.identity!==void 0&&(typeof G.attribution.identity!=="string"||!G.attribution.identity))X()}for(let G of Z.remove)if($.ctx.requireRemovedFingerprint&&!G.fingerprint||G.fingerprint!==void 0&&typeof G.fingerprint!=="string")X();for(let G of Z.finalize)if(typeof G.reservation!=="string"||!G.reservation||typeof G.enabled!=="boolean"||(G.enabled?G.disabledReason!==void 0:typeof G.disabledReason!=="string"))X();if(Z.order.some((G)=>typeof G!=="string"||w1(G))||new Set(Z.order).size!==Z.order.length)X()}function t9($,Z){$.entries();let X=$.config[m],J={...n9($.config)};Object.defineProperty(J,Z.operationId,{value:Z,enumerable:!0,writable:!0,configurable:!0}),X.publications=J,delete X.publicationOrder}function EX($,Z,X){let J=new Set;for(let Q of u1($.config)){if(!O(Q)||typeof Q.id!=="string")continue;if(J.has(Q.id))throw _("publishRoster",Z.operationId,"invalid-input","publication needs a roster of unique named rows");J.add(Q.id)}let G=new Set(Z.remove.map((Q)=>Q.id)),z=X.filter((Q)=>Q.invalid!=="roster"&&!G.has(Q.id));if(z.length!==Z.order.length||Z.order.some((Q)=>!z.some((B)=>B.id===Q))||z.some((Q)=>!Z.order.includes(Q.id)))throw _("publishRoster",Z.operationId,"invalid-input","order must name exactly the surviving roster");return z}async function a9($,Z){await $.assertAll();for(let J of Z.removed)if(U0($.stateAccount(J.id)?.[h])?.credentialEpoch===J.credentialEpoch&&!$.rosterRow(J.id))$.dropStateAccount(J.id);for(let J of Z.finalized){let G=$.stateAccount(J.id),z=U0(G?.[h]);if(G&&z?.credentialEpoch===J.credentialEpoch&&z.staged?.reservation===J.reservation){let Q={...G[h]};delete Q.staged,$.setStateAccount(J.id,{...G,[h]:Q})}}await $.commitState(void 0,{durable:!0});let X={...Z,phase:"cleaned"};return t9($,X),await $.commitConfig({durable:!0}),X}async function e9($,Z,X={}){return G0("publishRoster"),z0($.ctx,"publishRoster",Z?.operationId??"",X.onFailure,async(J,G)=>{if(!O(Z)||typeof Z.operationId!=="string"||!Z.operationId)throw _("publishRoster",Z?.operationId??"","invalid-input","the publication needs an operation id");Z=structuredClone(Z);let z=L1(Z),Q=[...Array.isArray(Z.remove)?Z.remove:[],...Array.isArray(Z.finalize)?Z.finalize:[]].filter((B)=>O(B)&&typeof B.id==="string");for(let B=0;;B++){let H=await H0($.ctx);if(H.status!=="ready")throw S0(H,"publishRoster",Z.operationId);let Y=new Map(Q.map(({id:U})=>[U,p(H.rows.find((j)=>j.id===U)??{id:U})]));for(let U of[...new Set(Y.values())].sort())await J.acquire(N0($,{id:U}));await J.acquire(X.providerLock??$.providerLock);for(let U of X.extraLocks??[])await J.acquire(U);let W=await a($.ctx,J,G,{operation:"publishRoster",rowId:Z.operationId},async(U)=>{let j=U.rows();if(Q.some(({id:D})=>p(j.find((L)=>L.id===D)??{id:D})!==Y.get(D)))return;let K=r9(U.config,Z.operationId);if(K){if(K.planDigest!==z)throw _("publishRoster",Z.operationId,"publication-mismatch","the operation id belongs to a different publication plan");if(K.phase==="cleaned")return{outcome:"already-cleaned",receipt:K};return U.markPublicationDecision(),await U.syncConfig(),{outcome:"cleaned",receipt:await a9(U,K)}}RX($,Z);let V=EX(U,Z,j),N=[];for(let D of Z.remove){U.assertNotStaged(D.id);let L=j.find((S)=>S.id===D.id);if(!L)throw _("publishRoster",D.id,"attribution","the removed row no longer exists");if(C6(D.id,L,D.attribution,"publishRoster"),!L.credential||D.fingerprint!==void 0&&t0(L.credential)!==D.fingerprint)throw _("publishRoster",D.id,"attribution","the removed secret no longer matches");N.push(L)}let q=[];for(let D of Z.finalize){let L=j.find((k)=>k.id===D.id),S=U0(U.stateAccount(D.id)?.[h]);if(!L||L.staged?.reservation!==D.reservation||S?.staged?.reservation!==D.reservation||L.enabled)throw _("publishRoster",D.id,"row-staged","the finalized row is not disabled under this reservation");let v=U.stateAccount(D.id),u=U.rosterRow(D.id),n=v?.[B0],f=n===void 0?void 0:L1(n);if(!S?.staged||S.staged.label!==u?.label||S.staged.disabledReason!==L.disabledReason||S.staged.providerState!==f)throw _("publishRoster",D.id,"row-staged","the staged label, disabled reason or full provider state no longer matches its stamp");C6(D.id,L,D.attribution,"publishRoster"),q.push(L)}let M=V.find((D)=>D.torn);if(M)throw _("publishRoster",Z.operationId,"attribution",`Row ${M.id} has an interrupted write; complete it with a normal store operation before publishing.`,!1);let P=new Set;for(let D of V){if(!(Z.finalize.find((S)=>S.id===D.id)?.enabled??D.enabled)||D.type!=="oauth"||D.identity===void 0)continue;if(P.has(D.identity))throw _("publishRoster",D.id,"invalid-input","the final enabled roster repeats a known identity");P.add(D.identity)}for(let D of V)if(D.identity!==void 0&&D.fingerprint!==void 0&&V.some((L)=>L.id!==D.id&&L.identity!==void 0&&L.identity!==D.identity&&L.fingerprint===D.fingerprint))throw _("publishRoster",D.id,"attribution","the resulting pool gives the same secret different known identities");for(let D of q)if(D.identity!==void 0&&N.some((L)=>L.identity!==void 0&&L.identity!==D.identity&&L.fingerprint===D.fingerprint))throw _("publishRoster",D.id,"attribution","the staged secret belonged to a different known identity");await F6(U,Z.operationId,X.protect);let E={operationId:Z.operationId,planDigest:z,phase:"committed",removed:N.map((D)=>({id:D.id,credentialEpoch:D.credentialEpoch??1})),finalized:Z.finalize.map((D,L)=>({id:D.id,credentialEpoch:q[L]?.credentialEpoch??1,reservation:D.reservation,enabled:D.enabled}))};for(let D of Z.remove)U.dropRosterRows(D.id);for(let D of Z.finalize){let L=U.rosterRow(D.id);L.enabled=D.enabled;let S={...U.entry(D.id)};if(delete S.staged,D.enabled)delete S.disabledReason;else S.disabledReason=D.disabledReason;U.setEntry(D.id,S)}let F=U.roster().filter((D)=>!O(D)||typeof D.id!=="string"||j.find((L)=>L.id===D.id)?.invalid==="roster");return U.config.accounts=[...Z.order.map((D)=>U.rosterRow(D)),...F],t9(U,E),await U.syncState(),await U.commitConfig({durable:!0,publicationDecision:!0}),{outcome:"published",receipt:await a9(U,E)}},{completeTorn:!1});if(W)return W;if(await J.releaseAll(),B>=1)throw _("publishRoster",Z.operationId,"row-key-changed","a named row changed lock key twice during publication",!0)}})}class oZ{rt;hook;onFailure;firedAtLoad;logger;inflight=new Set;constructor($,Z,X,J,G){this.rt=$,this.hook=Z,this.onFailure=X,this.firedAtLoad=J,this.logger=G}fire($,Z){if(!this.hook)return;if(Z==="load"){if(this.firedAtLoad.has($))return;this.firedAtLoad.add($)}let X=this.run($,Z);this.inflight.add(X),X.finally(()=>this.inflight.delete(X))}async settled(){while(this.inflight.size>0)await Promise.allSettled([...this.inflight])}async run($,Z){let X=this.rt(),{ctx:J}=X,G=new r0(J.lockDefaults,J.lockEnv),z={writes:0};try{let Q=await a(J,G,z,{operation:"pull",rowId:$},async(H)=>{if(H.reservation($)!==void 0)return;await H.completeTorn();let Y=H.row($);if(Y?.unbound&&Y.enabled&&Y.type==="oauth"&&Y.credential&&!Y.invalid)Y0("pull",Y);if(!Y?.candidate||Y.type!=="oauth")return;if(!Y.hasEntry)H.setEntry($,{credentialEpoch:1,needsFirstReading:!0}),await H.commitConfig();let W=H.row($);if(!W?.credential||W.credentialEpoch===void 0)return;return{id:$,credential:W.credential,credentialEpoch:W.credentialEpoch,...W.identity!==void 0?{identity:W.identity}:{},reason:Z}},{completeTorn:!1});if(await G.releaseAll(),!Q){this.firedAtLoad.delete($);return}await J.hold?.("pull-before-request",$);let B;try{B=await this.hook?.(Q)}catch(H){throw new x({operation:"pull",rowId:$,phase:"pull",retryable:!0,kind:"pull",message:"the quota pull rejected",cause:H})}await K6(X,$,{credentialEpoch:Q.credentialEpoch,...Q.identity!==void 0?{identity:Q.identity}:{}},B)}catch(Q){this.firedAtLoad.delete($);let B=d1(Q,"pull",$,z);if(this.onFailure)try{await this.onFailure($,B)}catch(H){this.logger?.warn("pull failure hook threw",{rowId:$,error:H instanceof Error?H.message:String(H)})}else this.logger?.warn("quota pull failed",{rowId:$,kind:B.kind})}finally{await G.releaseAll()}}}import{randomUUID as IX}from"node:crypto";function tZ($,Z){if(F1("refresh",$,Z?.staged),!Z)throw _("refresh",$,"unknown-row",`no row ${$} in the pool`);if(Z.invalid)throw _("refresh",$,"invalid-row",`row ${$} is invalid`);if(Z.type!=="oauth"||Z.credential?.type!=="oauth")throw _("refresh",$,"no-credential",`row ${$} holds no OAuth credential`);if(!Z.enabled)throw _("refresh",$,"row-disabled",`row ${$} is disabled`);return Z}function $4($){return _("refresh",$,"refresh-stamp-ahead",`row ${$}'s stored refresh stamp is ahead of the clock; a rotation now could not be stamped newer within the trust bound`,!0)}async function Z4($,Z,X,J={}){G0("refresh");let{ctx:G}=$;return z0(G,"refresh",Z,J.onFailure,async(z,Q)=>{let{row:B}=await w0($,"refresh",Z);tZ(Z,B);let H=await J.refuse?.(B);if(H!==void 0)return{status:"refused",rowId:Z,reason:H};let Y=p(B),W;for(let V=0;;V++){await z.acquire(N0($,{id:Z,identity:Y===Z?void 0:Y})),await z.acquire(J.providerLock??$.providerLock);for(let M of J.extraLocks??[])await z.acquire(M);let q=await a(G,z,{writes:0},{operation:"refresh",rowId:Z},async(M)=>{let P=tZ(Z,M.row(Z));if(Y0("refresh",P),!P.hasEntry)M.setEntry(Z,{credentialEpoch:1,needsFirstReading:!0}),await M.commitConfig(),P=tZ(Z,M.row(Z));if(p(P)!==Y)return{keyNow:p(P)};let E=await J.refuse?.(P);if(E!==void 0)return{refused:E};return{row:P,credential:P.credential,credentialEpoch:P.credentialEpoch,identity:P.identity}});if("refused"in q)return{status:"refused",rowId:Z,reason:q.refused};if("keyNow"in q){if(await z.releaseAll(),V>=1)throw _("refresh",Z,"row-key-changed",`row ${Z}'s wire identity changed twice while its lock was held`,!0);Y=q.keyNow;continue}W=q;break}if(lZ(W.credential.lastRefreshedAt,G.now()))throw $4(Z);await G.hold?.("refresh-before-provider",Z),await z.assertAll();let U;try{U=await X(W.credential,W.row)}catch(V){throw new x({operation:"refresh",rowId:Z,phase:"before-first-write",retryable:!0,kind:"provider",message:"the provider refresh failed",cause:V})}if(typeof U?.refresh!=="string"||!U.refresh.trim())throw _("refresh",Z,"provider","the provider returned no refresh token",!0);let j=U.providerState===void 0?void 0:p0(G.providerState,"refresh",Z,U.providerState,"the provider state the provider returned"),K=await a(G,z,Q,{operation:"refresh",rowId:Z},async(V)=>{let N=V.row(Z),q=V.entry(Z);if(!N||N.invalid||!q||q.credentialEpoch!==W.credentialEpoch||N.identity!==W.identity)throw new x({operation:"refresh",rowId:Z,phase:"before-first-write",retryable:!0,kind:"attribution",message:`row ${Z} changed credential while its refresh was in flight; the rotation is discarded`});Y0("refresh",N);let M=await J.refuse?.(N);if(M!==void 0)return{refused:M};let P=G.now(),E=N.credential?.type==="oauth"?N.credential.lastRefreshedAt:void 0;if(lZ(E,P))throw $4(Z);let F={type:"oauth",access:U.access,refresh:U.refresh,expires:U.expires},D=N.identity!==void 0&&U.identity!==void 0&&N.identity!==U.identity?{expectedIdentity:N.identity,returnedIdentity:U.identity}:void 0,L=D?{mark:IX(),enabled:!1,reason:`${v1}${JSON.stringify(D)}`}:void 0,S=N.identity===void 0&&U.identity?U.identity:void 0,v=await L6($,V,Z,F,{stamp:q$(E,P),transition:L,identity:S,...j!==void 0?{providerState:M$(G.providerState,"refresh",Z,N.providerState,j)}:{}});if(L!==void 0)N$(V,Z,L),await V.commitConfig();let u=N.identity;if(S!==void 0)N1(V,Z,S),u=S,await V.commitConfig();return{stored:v,identity:u,contradiction:D,refused:void 0}});if(K.refused!==void 0)return{status:"refused",rowId:Z,reason:K.refused};if(K.contradiction!==void 0)return{status:"identity-contradicted",rowId:Z,...K.contradiction,credential:K.stored};if(J.onPersisted)try{let V=J.onPersisted;await b0("refresh",()=>V(Z,K.stored))}catch(V){throw new x({operation:"refresh",rowId:Z,phase:"after-first-write",retryable:!1,kind:"after-persist-hook",committed:K.stored,message:"the after-persist hook threw; the rotation stays committed",cause:V})}return{status:"rotated",rowId:Z,credential:K.stored,...K.identity!==void 0?{identity:K.identity}:{}}})}import{isDeepStrictEqual as bX}from"node:util";var T6=Object.freeze(["version","accounts",m]);function eZ($){let Z={};for(let[X,J]of Object.entries($))if(!T6.includes(X))P6(Z,X,J);return Z}function P6($,Z,X){Object.defineProperty($,Z,{value:X,enumerable:!0,writable:!0,configurable:!0})}function xX($,Z){let X={};for(let[J,G]of Object.entries($))if(T6.includes(J))P6(X,J,G);else if(Object.hasOwn(Z,J))P6(X,J,Z[J]);for(let[J,G]of Object.entries(Z))if(!Object.hasOwn($,J))P6(X,J,G);return X}function X4($){return new x({operation:"updateSettings",phase:"before-first-write",retryable:!1,kind:"invalid-input",message:$})}async function J4($){let Z=await H0($.ctx);if(Z.status==="error")return Z;return{status:Z.status,settings:eZ(Z.config)}}async function G4($,Z,X={}){G0("updateSettings");let{ctx:J}=$,G=X.onFailure;return z0(J,"updateSettings",void 0,G&&((z,Q)=>G(Q)),async(z,Q)=>{for(let H of X.extraLocks??[])await z.acquire(H);let B=z.held.length;try{for(let q of J.storeLocks)await z.acquire(q);let H=await H0(J);if(H.status!=="ready")throw S0(H,"updateSettings",void 0);let Y=eZ(H.config),W=structuredClone(Y),U=await b0("updateSettings",()=>Z(W)),j=U===void 0?W:U;if(!O(j))throw X4("the settings mutator must produce an object");let K=T6.filter((q)=>Object.hasOwn(j,q));if(K.length>0)throw X4(`settings cannot set the pool-owned key(s) ${K.join(", ")}`);if(bX(j,Y))return{settings:Y,outcome:"unchanged"};let V=xX(H.config,j),N={operation:"updateSettings",rowId:void 0};return await L0(J.configPath,V,{beforeRename:async()=>{await J.onStep?.("before-config-write",N),await z.assertAll()}}),Q.writes++,await J.onStep?.("after-config-write",N),{settings:eZ(V),outcome:"updated"}}finally{await z.releaseTo(B)}})}var z4=new Map;function kX($){let Z=z4.get($);if(!Z)Z={removedIds:new Set,firedAtLoad:new Set},z4.set($,Z);return Z}function Q4($){if($.status==="ready")return{status:"ready",schemaVersion:o0,rows:$.rows};if($.status==="pending-migration")return{status:"pending-migration",roster:Array.isArray($.config.accounts)?$.config.accounts:[]};return $}function $3($){let Z=kX($.configPath),X={...vZ,...$.lockOptions},J={provider:$.provider,configPath:$.configPath,statePath:$.statePath,codec:$.quota,...$.providerState?{providerState:$.providerState}:{},now:$.now??Date.now,storeLocks:$.storeLocks??[{name:"save",path:$.configPath},{name:"save",path:$.statePath}],lockDefaults:X,lockEnv:{now:$.now??Date.now,...$.onLockEvent?{onLockEvent:$.onLockEvent}:{},...$.onLockStep?{onLockStep:$.onLockStep}:{},...$.onRenewalTimer?{onRenewalTimer:$.onRenewalTimer}:{}},removedIds:Z.removedIds,requireCredentialStamps:$.requireCredentialStamps===!0,requireRemovedFingerprint:$.requireRemovedFingerprint===!0,...$.logger?{logger:$.logger}:{},...$.onStep?{onStep:$.onStep}:{},...$.hold?{hold:$.hold}:{}},G=new oZ(()=>z,$.pull,$.onPullFailure,Z.firedAtLoad,$.logger),z={ctx:J,providerLock:$.providerLock??{name:`provider-${encodeURIComponent($.provider)}`,path:$.statePath},rowLockOptions:$.rowLockOptions??{},firePull:(Q,B)=>G.fire(Q,B)};return{async load(){let Q=await H0(J);if(Q.status==="ready"){for(let B of Q.rows)if((B.candidate||B.torn&&B.enabled)&&B.type==="oauth"&&B.needsFirstReading)G.fire(B.id,"load")}return Q4(Q)},async read(){return Q4(await H0(J))},async initialize(Q={}){return{status:await x9(J,Q.dropKeys??[])}},add:(Q,B)=>m9(z,Q,B),publishRoster:(Q,B)=>e9(z,Q,B),publication:(Q)=>o9(z,Q),replace:(Q,B,H,Y)=>w9(z,Q,B,H,Y),rotate:(Q,B,H,Y)=>p9(z,Q,B,H,Y),updateProviderState:(Q,B,H,Y)=>f9(z,Q,B,H,Y),disable:(Q,B,H)=>l9(z,Q,B,H),enable:(Q,B)=>d9(z,Q,B),remove:(Q,B)=>c9(z,Q,B),reorder:(Q,B)=>s9(z,Q,B),readSettings:()=>J4(z),updateSettings:(Q,B)=>G4(z,Q,B),recordIdentity:(Q,B,H,Y)=>i9(z,Q,B,H,Y),refresh:(Q,B,H)=>Z4(z,Q,B,H),recordQuota:(Q,B,H)=>K6(z,Q,B,H),requestReading:(Q)=>G.fire(Q,"admission"),pullsSettled:()=>G.settled()}}var yX=[/\b[\w-]*(?:secret|token|password|passwd|api[_-]?key|authorization|verifier)["']?\s*[:=]\s*["']?(?:(?:Bearer|Basic)\s+)?[^\s"'&,;}]+/gi,/\b[0-9a-fA-F]{32,}\b/g];function J3($={}){let{redactStrings:Z}=I0({...$,extraValuePatterns:[...yX,...$.extraValuePatterns??[]]});return(X)=>Z(X)}class W0 extends Error{code;constructor($,Z,X){super(Z,X);this.name="CommandError",this.code=$}}var B4=/^[a-z][a-z0-9-]{0,63}$/,Z3={code:"action-failed",text:"That action failed."},fX=new Set(["unknown-row","invalid-row","invalid-input","id-exists","id-removed","type-mismatch","no-credential","row-disabled","row-protected","duplicate-identity","row-key-changed","invalid-order","pending-migration","provider","pull","attribution"]);function L$($){if($ instanceof W0)return{code:B4.test($.code)?$.code:Z3.code,text:$.message};if($ instanceof x)return{code:`pool-${$.kind}`,text:fX.has($.kind)?$.message:`The account pool could not do that (${$.kind}).`};return Z3}var H4="This cannot be undone. Continue?",gX=new Set(["access","refresh","apikey","password","authheader","credential","credentials"]);function hX($){let Z=$.toLowerCase().replace(/[-_]/g,"");return gX.has(Z)||Z.endsWith("token")||Z.endsWith("key")||Z.endsWith("secret")}function vX($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function X3($,Z,X){if(typeof $==="string"){let G=X.redact($);if(G!==$)X.redacted.push(Z);return G}if(Array.isArray($))return $.map((G,z)=>X3(G,`${Z}[${z}]`,X));if(!vX($))return $;let J={};for(let[G,z]of Object.entries($)){if(hX(G)){X.dropped.push(`${Z}.${G}`);continue}Object.defineProperty(J,G,{value:X3(z,`${Z}.${G}`,X),enumerable:!0,writable:!0,configurable:!0})}return J}function Y4($,Z,X){let J={redact:X.redact,dropped:[],redacted:[]},G=X3($,"payload",J);if(J.dropped.length>0)X.logger.warn("credential-shaped field dropped from a command payload",{command:Z,fields:J.dropped});if(J.redacted.length>0)X.logger.warn("secret-shaped text masked in a command payload",{command:Z,fields:J.redacted});return G}function mX($){return{value:String($.value),label:String($.label)}}function wX($){switch($.kind){case"choice":return{kind:"choice",id:$.id,label:$.label,choices:($.choices??[]).map(mX),...$.value!==void 0?{value:$.value}:{}};case"toggle":return{kind:"toggle",id:$.id,label:$.label,value:$.value===!0};case"number":return{kind:"number",id:$.id,label:$.label,...$.value!==void 0?{value:$.value}:{},...$.min!==void 0?{min:$.min}:{},...$.max!==void 0?{max:$.max}:{},...$.required?{required:!0}:{}};case"text":return{kind:"text",id:$.id,label:$.label,...$.value!==void 0&&!$.masked?{value:$.value}:{},...$.placeholder!==void 0?{placeholder:$.placeholder}:{},...$.masked?{masked:!0}:{},...$.required?{required:!0}:{}}}}function G3($){if($.irreversible===!0)return{message:$.confirm||H4,irreversible:!0};if($.confirm)return{message:$.confirm,irreversible:!1};return}function W4($){let Z=G3($);return{id:$.id,label:$.label,...$.description!==void 0?{description:$.description}:{},...$.group!==void 0?{group:String($.group)}:{},knobs:($.knobs??[]).map(wX),...Z?{confirm:Z}:{}}}function pX($){return{id:$.id,...$.label!==void 0?{label:$.label}:{},enabled:$.enabled,type:$.type,...$.identity!==void 0?{identity:$.identity}:{}}}function uX($){return{id:$.id,label:$.label,...$.detail!==void 0?{detail:$.detail}:{},...$.group!==void 0?{group:String($.group)}:{},...$.status!==void 0?{status:String($.status)}:{},...$.account?{account:pX($.account)}:{},...$.facts!==void 0?{facts:$.facts}:{},actions:($.actions??[]).map(W4)}}function lX($){let{content:Z}=$;return{id:$.id,slot:$.slot,title:$.title,lines:(Z.lines??[]).map(String),items:(Z.items??[]).map(uX),actions:(Z.actions??[]).map(W4),...Z.facts!==void 0?{facts:Z.facts}:{}}}function V4($,Z,X){return{command:$,title:Z,sections:X.map(lX)}}function U4($,Z,X,J){return Y4({command:$,menu:V4($,Z,X)},$,J)}function j4($,Z,X,J,G){return Y4({command:$,ok:J.ok,text:String(J.text),...!J.ok&&J.code!==void 0?{code:B4.test(J.code)?J.code:"refused"}:{},...J.needsConfirmation?{needsConfirmation:!0}:{},menu:V4($,Z,X)},$,G)}var q4="disabled from the command menu";function dX($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function u0($){return dX($)?{...$}:{}}function cX($){if($.status!=="ready")return[];let Z=new Set;return $.rows.filter((X)=>{if(Z.has(X.id))return!1;return Z.add(X.id),!0})}function sX($,Z){return $.label??Z??$.id}function S6($,Z){return Q0($.quota)?c($.quota,Z):void 0}function N4($,Z){return`${$} ${Z}${$===1?"":"s"}`}var _$="Actions";function iX($){if($.status==="pending-migration")return"The account pool has not been migrated yet.";if($.status==="error")return`The ${$.file} file cannot be read: ${$.reason}`;return}function D4($,Z){switch(Z.outcome){case"added":return`Added ${$}.`;case"added-disabled":return`Added ${$}, disabled: another enabled account has the same identity.`;case"completed":return`Finished adding ${$}.`;case"rotated":return`${$} was already in the pool; its credential was updated.`;case"exists":return`${$} was already in the pool; its credential is unchanged.`}}function K4($){return L$($).text}async function aX($){let Z=await $.read(),X=await $.readSettings();return{load:Z,rows:cX(Z),settings:X.status==="error"?{}:X.settings}}function A6($,Z){let X=Z.accounts?.describeIdentity?Z.accounts.describeIdentity($):$.identity;return{account:{id:$.id,...$.label!==void 0?{label:$.label}:{},enabled:$.enabled,type:$.type,...X!==void 0?{identity:X}:{}},name:sX($,X)}}function nX($,Z){let{store:X,extraLocks:J}=$,G=J?{extraLocks:J}:{},z=Z.rows.map((U)=>U.id),Q=iX(Z.load),B=Z.rows.filter((U)=>U.enabled).length,H=Z.rows.map((U,j)=>{let{account:K,name:V}=A6(U,$),N=[U.type==="api"?"API key":"OAuth",...K.identity!==void 0?[K.identity]:[],...!U.invalid&&!U.enabled&&U.disabledReason?[`disabled: ${U.disabledReason}`]:[]].join(" · "),q=U.invalid?"invalid":U.enabled?"enabled":"disabled",M=[];if(!U.invalid&&U.enabled)M.push({id:"disable",label:"Disable",run:async()=>{return await X.disable(U.id,q4,G),`Disabled ${V}.`}});if(!U.invalid&&!U.enabled)M.push({id:"enable",label:"Enable",run:async()=>{return await X.enable(U.id,G),`Enabled ${V}.`}});if(z.length>1)M.push({id:"move",label:"Move",knobs:[{kind:"choice",id:"position",label:"Position",choices:z.map((P,E)=>({value:String(E+1),label:String(E+1)})),value:String(j+1)}],run:async({values:P})=>{let E=Number(P.position),F=z.filter((L)=>L!==U.id);return F.splice(E-1,0,U.id),(await X.reorder(F,G)).outcome==="unchanged"?`${V} is already at position ${E}.`:`Moved ${V} to position ${E}.`}});return M.push({id:"remove",label:"Remove",irreversible:!0,confirm:`Remove ${V}? Its stored credential is deleted.`,run:async()=>{return await X.remove(U.id,{...G,...$.accounts?.protect?{protect:$.accounts.protect}:{}}),`Removed ${V}.`}}),{id:U.id,label:V,detail:N,group:"Accounts",status:q,account:K,actions:M}}),Y=$.accounts?.login,W=[];if(Y&&!Q)W.push({id:"add",label:Y.label??"Add account",group:_$,knobs:Y.knobs??[],run:async({values:U,invocation:j})=>{let K=await Y.run(U,j);if(K.status==="cancelled")return{ok:!1,text:K.message??"Login cancelled."};if(K.status==="ready"){let V=await X.add(K.account,G);return D4(K.account.label??V.id,V)}return K.completion.then(async(V)=>{if(!V){j.notify("Login cancelled.","warning");return}let N=await X.add(V,G);j.notify(D4(V.label??N.id,N))},(V)=>{j.notify(`Adding the account failed: ${K4(V)}`,"error")}).catch((V)=>{j.notify(`Adding the account failed: ${K4(V)}`,"error")}),K.message}});return{id:"accounts",slot:"accounts",title:"Accounts",content:{lines:Q?[Q]:[Z.rows.length===0?"No accounts yet":`${N4(Z.rows.length,"account")}, ${B} enabled`],items:Q?[]:H,actions:W}}}function rX($,Z){let X=$.quota?.scope??"all",J=$.now(),G=X==="all"?"Accounts":`Accounts · ${X}`,z=async(W,U)=>{if($.quota?.check)await $.quota.check(W,U);else{for(let j of W)$.store.requestReading(j);await $.store.pullsSettled()}},Q=Z.rows.filter((W)=>W.candidate),B=Q.map((W)=>{let{account:U,name:j}=A6(W,$),K=S6(W,X);return{id:W.id,label:j,group:G,status:P0(K,{now:J,form:"compact"}),detail:P0(K,{now:J,form:"full"}),account:U,actions:[{id:"check",label:"Check this account",run:async({invocation:V})=>{return await z([W.id],V),`Checked quota for ${j}.`}}]}}),H=Z.rows.filter((W)=>!W.candidate).map((W)=>{let{name:U}=A6(W,$),j=W.invalid?"invalid":!W.enabled?"disabled":W.credential===void 0?"no credential":"unavailable",K=P0(S6(W,X),{now:J,form:"compact"});return`${U} (${j}): ${K}`}),Y=[];if(Q.length>0)Y.push({id:"check",label:"Check now",description:"Checks every account that can be checked.",group:_$,run:async({invocation:W})=>{let U=Q.map((j)=>j.id);return await z(U,W),`Checked quota for ${N4(U.length,"account")}.`}});return{id:"quota",slot:"quota",title:"Quota",content:{lines:Z.rows.length===0?["No accounts yet"]:H,items:B,actions:Y}}}function oX($,Z){let{store:X,extraLocks:J}=$,G=J?{extraLocks:J}:{},z=[{value:"ordered",label:"Ordered (roster order)"},...$.routing?.orderedVariants??[],{value:"sticky-balanced",label:"Sticky balanced"}],Q=u0(Z.settings.routing).mode,B=typeof Q==="string"&&z.some((V)=>V.value===Q)?Q:"ordered",H=qZ(B),Y=Z.rows.map((V)=>V.id),W=y1(Y,H.placement,$.routing?.formerMainId??J6),j=[`Mode: ${z.find((V)=>V.value===B)?.label??B}`];if(Y.length>0)j.push(`Roster order: ${Y.join(", ")}`);if(H.mode==="ordered"&&W.join()!==Y.join())j.push(`Tried in order: ${W.join(", ")}`);let K=[{id:"mode",label:"Change mode",group:_$,knobs:[{kind:"choice",id:"mode",label:"Mode",choices:z,value:B}],run:async({values:V})=>{let N=String(V.mode);return await X.updateSettings((q)=>{q.routing={...u0(q.routing),mode:N};return},G),`Routing mode set to ${z.find((q)=>q.value===N)?.label??N}.`}}];if(Y.length>1)K.push({id:"order",label:"Set order",group:_$,knobs:[{kind:"text",id:"order",label:"Account ids, first to last",value:Y.join(", "),required:!0}],run:async({values:V})=>{let N=String(V.order).split(/[\s,]+/).filter((M)=>M.length>0),q=await X.reorder(N,G);return q.outcome==="unchanged"?"The order is unchanged.":`Order set to ${q.ids.join(", ")}.`}});return{id:"routing",slot:"routing",title:"Routing",content:{lines:j,actions:K}}}function tX($,Z){if($.limits?.labels)return[...$.limits.labels];let X=$.quota?.scope??"all",J=[];for(let G of Z.rows)for(let z of S6(G,X)?.limits??[])if(!J.includes(z.label))J.push(z.label);return J.length>0?J:["primary"]}function eX($,Z){let X=$.quota?.scope??"all",J=new Map;for(let G of Z.rows)for(let z of S6(G,X)?.limits??[])if(z.windowMinutes!==void 0&&!J.has(z.label))J.set(z.label,Z6(z));return(G)=>J.get(G)??G}function $J($,Z){let{store:X,extraLocks:J}=$,G=J?{extraLocks:J}:{},z=u0(Z.settings.killswitch),Q=z.enabled===!0,B=u0(z.accounts),H=tX($,Z),Y=eX($,Z),W=Q?"on":"off",U=Z.rows.map((j)=>{let{account:K,name:V}=A6(j,$),N=u0(B[j.id]),q=H.filter((M)=>typeof N[M]==="number");return{id:j.id,label:V,group:`Floors · killswitch ${W}`,status:q.length===0?"no floors":q.map((M)=>`${Y(M)} ≥${N[M]}%`).join(" · "),account:K,actions:[{id:"floors",label:"Set floors",knobs:H.map((M)=>({kind:"number",id:M,label:`Minimum % left for ${Y(M)}`,min:0,max:100,...typeof N[M]==="number"?{value:N[M]}:{}})),run:async({values:M})=>{return await X.updateSettings((P)=>{let E=u0(P.killswitch),F=u0(E.accounts),D=u0(F[j.id]);for(let L of H){let S=M[L];if(typeof S==="number")D[L]=S;else if(S===null)delete D[L]}if(Object.keys(D).length>0)F[j.id]=D;else delete F[j.id];if(Object.keys(F).length>0)E.accounts=F;else delete E.accounts;P.killswitch=E;return},G),`Floors updated for ${V}.`}}]}});return{id:"limits",slot:"limits",title:"Limits",content:{lines:[`Killswitch ${W}`],items:U,actions:[{id:"killswitch",label:Q?"Turn killswitch off":"Turn killswitch on",description:"With the killswitch on, an account whose quota falls below one of its floors is not used.",group:_$,knobs:[{kind:"toggle",id:"enabled",label:"Killswitch",value:!Q}],run:async({values:j})=>{let K=j.enabled===!0;return await X.updateSettings((V)=>{V.killswitch={...u0(V.killswitch),enabled:K};return},G),`Killswitch ${K?"on":"off"}.`}}]}}}async function M4($){let Z=await aX($.store);return[nX($,Z),rX($,Z),oX($,Z),$J($,Z)]}var ZJ=new Set(["accounts","quota","routing","limits","cache","diagnostics"]),z3=["accounts","quota","routing","limits"];function F4($,Z){let{sessionId:X}=$,J=$.notify.bind($);return Object.freeze({...X!==void 0?{sessionId:X}:{},notify:(G,z)=>z===void 0?J(Z(String(G))):J(Z(String(G)),z)})}function XJ($,Z){switch($.kind){case"choice":{let X=Z??$.value;if(typeof X==="string"&&$.choices.some((J)=>J.value===X))return{value:X};return{problem:`Choose one of the options for ${$.label}.`}}case"toggle":{let X=Z??$.value;return typeof X==="boolean"?{value:X}:{problem:`${$.label} must be on or off.`}}case"number":{let X=Z===void 0?$.value??null:Z;if(X===null||X==="")return $.required?{problem:`${$.label} needs a number.`}:{value:null};let J=typeof X==="number"?X:Number(X);if(typeof X==="boolean"||!Number.isFinite(J))return{problem:`${$.label} needs a number.`};if($.min!==void 0&&J<$.min)return{problem:`${$.label} must be at least ${$.min}.`};if($.max!==void 0&&J>$.max)return{problem:`${$.label} must be at most ${$.max}.`};return{value:J}}case"text":{let X=Z===void 0?$.value??null:Z;if(X===null||X==="")return $.required?{problem:`${$.label} cannot be empty.`}:{value:null};return typeof X==="string"?{value:X}:{problem:`${$.label} must be text.`}}}}function JJ($,Z){let X={};for(let J of $){let G=Z&&Object.hasOwn(Z,J.id)?Z[J.id]:void 0,z=XJ(J,G);if("problem"in z)return z;X[J.id]=z.value}return{values:X}}function GJ($,Z){let X=$.find((G)=>G.id===Z.sectionId);if(!X)return;return(Z.itemId===void 0?X.content.actions:X.content.items?.find((G)=>G.id===Z.itemId)?.actions)?.find((G)=>G.id===Z.actionId)}function _1($){let Z=$.logger??i("commands"),X=J3($.redaction),J={logger:Z,redact:X},G=$.now??Date.now,z=$.extras??[],Q=$.replace??{},B=z3.filter((j)=>!Q[j]);for(let j of z3)if(Q[j]&&$[j]!==void 0)throw Error(`the ${j} section is replaced; its built-in options cannot also be given`);let H=$.store;if(B.length>0&&!H)throw Error(`a store is required for the built-in ${B.join(", ")} section${B.length>1?"s":""}`);let Y=new Set;for(let j of z){if(ZJ.has(j.id)||Y.has(j.id))throw Error(`extra section id ${j.id} is taken`);Y.add(j.id)}async function W(j,K,V,N){try{return{id:j,slot:K,title:V.title,content:await V.build(N)}}catch(q){return Z.warn("command menu section failed to build",{command:$.command,section:j,error:X(q instanceof Error?q.message:String(q))}),{id:j,slot:K,title:V.title,content:{lines:["This section could not be loaded."]}}}}async function U(j){let K=H&&B.length>0?await M4({store:H,now:G,...$.extraLocks?{extraLocks:$.extraLocks}:{},...$.accounts?{accounts:$.accounts}:{},...$.quota?{quota:$.quota}:{},...$.routing?{routing:$.routing}:{},...$.limits?{limits:$.limits}:{}}):[],V=[];for(let N of z3){let q=Q[N];if(q)V.push(await W(N,N,q,j));else{let M=K.find((P)=>P.slot===N);if(M)V.push(M)}}if($.cache)V.push(await W("cache","cache",$.cache,j));if($.diagnostics)V.push(await W("diagnostics","diagnostics",$.diagnostics,j));for(let N of z)V.push(await W(N.id,"extra",N,j));return V}return{command:$.command,async open(j){let K=F4(j,X);return U4($.command,$.title,await U(K),J)},async apply(j,K){let V=F4(K,X),N=async(F)=>j4($.command,$.title,await U(V),F,J),q=j.command===$.command?GJ(await U(V),j):void 0;if(!q)return N({ok:!1,code:"unavailable",text:"That action is no longer available."});let M=G3(q);if(M&&j.confirmed!==!0)return N({ok:!1,code:"needs-confirmation",text:M.message,needsConfirmation:!0});let P=JJ(q.knobs??[],j.values);if("problem"in P)return N({ok:!1,code:"invalid-input",text:P.problem});let E;try{let F=await q.run({values:P.values,...j.itemId!==void 0?{itemId:j.itemId}:{},invocation:V});E=typeof F==="string"?{ok:!0,text:F}:{ok:F.ok,text:F.text,...F.ok?{}:{code:F.code??"refused"}}}catch(F){let D=L$(F);Z.warn("command menu action failed",{command:$.command,section:j.sectionId,action:j.actionId,code:D.code,error:X(F instanceof Error?F.message:String(F))}),E={ok:!1,...D}}return N(E)}}}async function O$($,Z,X){let J=new Map,G=[];for(let Q of X){let B=Q.label;for(let H=2;J.has(B);H++)B=`${Q.label} (${H})`;J.set(B,Q.value),G.push(B)}let z=await $.select(Z,G);return z===void 0?void 0:J.get(z)}function L4($,Z){return Z.length>0?`${$}
+import{createRequire as j5}from"node:module";var D5=j5(import.meta.url);import{createAssistantMessageEventStream as ZQ}from"@earendil-works/pi-ai";import{streamSimple as XQ}from"@earendil-works/pi-ai/compat";var X0="all",UZ=Object.freeze(["primary"]);function m8($){return $.kind==="retired"?$.retiredAt:$.checkedAt}function k1($,Z){return JSON.stringify([$,Z])}function K1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function j0($){return typeof $==="number"&&Number.isFinite($)}function v8($){return typeof $==="string"&&$.length>0}function O0($,Z,X){return $[Z]===void 0||X($[Z])}function K5($){return j0($)&&$>0}function VZ($){return typeof $==="string"}function q5($){if(!K1($)||!v8($.scope)||!v8($.label))return!1;switch($.kind){case"reading":return j0($.checkedAt)&&j0($.usedPercent)&&O0($,"resetsAt",VZ)&&O0($,"windowMinutes",K5);case"retired":return j0($.retiredAt);case"absent":return j0($.checkedAt);default:return!1}}function N5($){if(!K1($)||!j0($.checkedAt))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&O0($,"remainingPercent",j0)&&O0($,"usedPercent",j0)&&O0($,"resetsAt",VZ)&&O0($,"limit",j0)&&O0($,"used",j0)&&O0($,"remaining",j0)&&O0($,"unit",VZ)}function w8($){return K1($)&&j0($.value)&&Number.isInteger($.value)&&$.value>=0&&j0($.checkedAt)}function jZ($){return K1($)&&Object.values($).every(w8)}function DZ($){if(!K1($))return;let Z=Object.entries($).filter(([,X])=>w8(X));return Z.length===0?void 0:Object.fromEntries(Z)}function q1($){if(Q0($))return $;if(!K1($))return;let{counters:Z,...X}=$;if(!Q0(X))return;let J=DZ(Z);return{...X,...J===void 0?{}:{counters:J}}}function Q0($){if(!K1($)||!Array.isArray($.limits))return!1;let Z=new Set;for(let X of $.limits){if(!q5(X))return!1;let J=k1(X.scope,X.label);if(Z.has(J))return!1;Z.add(J)}return O0($,"budget",N5)&&O0($,"counters",jZ)}class e$ extends TypeError{constructor($){super($);this.name="QuotaCodecError"}}function Z6($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function $6($){return typeof $==="number"&&Number.isFinite($)}function p8($){return $===void 0||typeof $==="string"&&$!==""}function u8($){return typeof $==="string"&&$!==""}function Y$($,Z){return $[Z]===void 0||$6($[Z])}function KZ($,Z){return $[Z]===void 0||typeof $[Z]==="string"}function M5($){return Z6($)&&p8($.scope)&&u8($.label)&&$6($.usedPercent)&&KZ($,"resetsAt")&&($.windowMinutes===void 0||$6($.windowMinutes)&&$.windowMinutes>0)}function F5($){return Z6($)&&p8($.scope)&&u8($.label)}function L5($){if(!Z6($))return!1;if($.kind==="cleared")return!0;return $.kind==="reading"&&typeof $.reached==="boolean"&&Y$($,"remainingPercent")&&Y$($,"usedPercent")&&KZ($,"resetsAt")&&Y$($,"limit")&&Y$($,"used")&&Y$($,"remaining")&&KZ($,"unit")}function l8($){if(!Z6($)||!$6($.checkedAt))return!1;let Z=$.readings??[],X=$.coverage??[];if(!Array.isArray(Z)||!Array.isArray(X))return!1;let J=new Set;for(let G of Z){if(!M5(G))return!1;let z=k1(G.scope??X0,G.label);if(J.has(z))return!1;J.add(z)}if(!X.every(F5))return!1;return($.budget===void 0||L5($.budget))&&($.counters===void 0||jZ($.counters))}function _5($,Z){if($.scope!==Z.scope)return $.scope<Z.scope?-1:1;if($.label!==Z.label)return $.label<Z.label?-1:1;return 0}function O5($,Z,X){if(Z===void 0)return $;if($!==void 0&&X<$.checkedAt)return $;return{...Z,checkedAt:X}}function C5($,Z){let X=new Map(Object.entries($??{}));for(let[J,G]of Object.entries(Z??{})){let z=X.get(J);if(z===void 0||G.checkedAt>=z.checkedAt)X.set(J,G)}return X.size===0?void 0:Object.fromEntries(X)}function E0($,Z){let X=$===void 0?void 0:q1($);if($!==void 0&&X===void 0)throw new e$("stored quota map is malformed");if(!l8(Z))throw new e$("quota observation is malformed");let J=X??{limits:[]},G=Z.checkedAt,z=new Map;for(let U of J.limits)z.set(k1(U.scope,U.label),U);let B=(U)=>{let N=z.get(U);return N===void 0||G>=m8(N)},Q=new Set;for(let U of Z.readings??[]){let N=U.scope??X0,K=k1(N,U.label);if(Q.add(K),!B(K))continue;z.set(K,{scope:N,label:U.label,kind:"reading",checkedAt:G,usedPercent:U.usedPercent,...U.resetsAt===void 0?{}:{resetsAt:U.resetsAt},...U.windowMinutes===void 0?{}:{windowMinutes:U.windowMinutes}})}for(let U of Z.coverage??[]){let N=U.scope??X0,K=k1(N,U.label);if(Q.has(K)||!B(K))continue;let M=z.get(K);z.set(K,M===void 0||M.kind==="absent"?{scope:N,label:U.label,kind:"absent",checkedAt:G}:{scope:N,label:U.label,kind:"retired",retiredAt:G})}let{limits:Y,budget:H,counters:W,...V}=J,j=O5(J.budget,Z.budget,G),D=C5(J.counters,Z.counters);return{...V,limits:[...z.values()].sort(_5),...j===void 0?{}:{budget:j},...D===void 0?{}:{counters:D}}}var qZ=Object.freeze({validate:Q0,decode:q1,merge:E0});var s8=900000,i8="no quota reading yet",a8="no limits reported";function n8($){let Z=Math.max(1,Math.floor($/60000));if(Z<60)return`${Z}m`;if(Z<1440){let G=Math.floor(Z/60),z=Z%60;return z===0?`${G}h`:`${G}h${z}m`}let X=Math.floor(Z/1440),J=Math.floor(Z%1440/60);return J===0?`${X}d`:`${X}d${J}h`}function P5($){if($%1440===0)return`${$/1440}d`;if($%60===0)return`${$/60}h`;return`${$}m`}function X6($){if($.scope!==X0||$.windowMinutes===void 0)return $.label;return P5($.windowMinutes)}function NZ($){return Math.min(100,Math.max(0,$))}function d8($){return`${Math.round(NZ($))}% left`}function c8($,Z,X){let J=$===void 0?Number.NaN:Date.parse($);return{...Number.isFinite(J)&&J>X?{resetIn:n8(J-X)}:{},resetSinceReading:Number.isFinite(J)&&J>Z&&J<=X}}function T5($,Z){let X=$.windowMinutes,J=Z.windowMinutes;if(X!==void 0&&J!==void 0&&X!==J)return X-J;if(X===void 0!==(J===void 0))return X===void 0?1:-1;if($.scope!==Z.scope){if($.scope===X0)return-1;if(Z.scope===X0)return 1;return $.scope<Z.scope?-1:1}return $.label<Z.label?-1:$.label>Z.label?1:0}function r8($,Z){if(!$)return{windows:[]};let{now:X}=Z,G=$.limits.filter((B)=>B.kind==="reading"&&B.remainingPercent!==void 0).sort(T5).map((B)=>{let Q=NZ(B.remainingPercent??0);return{kind:"window",name:X6(B),figure:d8(B.remainingPercent??0),remainingPercent:Q,checkedAt:B.checkedAt,...c8(B.resetsAt,B.checkedAt,X)}}),z=$.budget;if(z){let B=z.remainingPercent,Q=z.reached?"credits spent":B!==void 0?`credits ${d8(B)}`:"credits available";G.push({kind:"budget",name:"credits",figure:Q,...B===void 0?{}:{remainingPercent:NZ(B)},checkedAt:z.checkedAt,...c8(z.resetsAt,z.checkedAt,X)})}if(G.length>0){let B=X-Math.min(...G.map((Q)=>Q.checkedAt));if(B>(Z.staleAfterMs??s8))return{windows:G,age:`checked ${n8(B)} ago`}}return{windows:G}}function y1($,Z){let X=r8($,Z),J=(Z.form??"full")==="full",G=X.windows.map((z)=>{let B=J&&z.resetIn?`, resets ${z.resetIn}`:"";return`${z.kind==="budget"?"":`${z.name} `}${z.figure}${B}`});return X.age===void 0?G:[...G,X.age]}function C0($,Z){let X=y1($,Z);if(X.length>0)return X.join(" · ");return $&&$.limits.length>0?a8:i8}function A5($){if($.kind==="retired")return{scope:$.scope,label:$.label,kind:"retired",checkedAt:$.retiredAt};if($.kind==="absent")return{scope:$.scope,label:$.label,kind:"absent",checkedAt:$.checkedAt};return{scope:$.scope,label:$.label,kind:"reading",checkedAt:$.checkedAt,usedPercent:$.usedPercent,remainingPercent:100-$.usedPercent,...$.windowMinutes===void 0?{}:{windowMinutes:$.windowMinutes},...$.resetsAt===void 0?{}:{resetsAt:$.resetsAt}}}function S5($,Z){let X=$.windowMinutes!==void 0,J=Z.windowMinutes!==void 0;if(X!==J)return X?-1:1;if(X&&J&&$.windowMinutes!==Z.windowMinutes)return(Z.windowMinutes??0)-($.windowMinutes??0);if($.label!==Z.label)return $.label<Z.label?-1:1;return 0}function R5($){return{checkedAt:$.checkedAt,reached:$.reached,...$.remainingPercent===void 0?{}:{remainingPercent:$.remainingPercent},...$.resetsAt===void 0?{}:{resetsAt:$.resetsAt}}}function s($,Z=X0){let X=new Map;for(let H of $?.limits??[]){if(H.scope!==Z&&H.scope!==X0)continue;let W=X.get(H.label);if(W===void 0){X.set(H.label,H);continue}let V=H.scope===X0?W:H,j=H.scope===X0?H:W;X.set(H.label,V.kind==="reading"?V:j)}let J=[...X.values()].map(A5).sort(S5),G=J.filter((H)=>H.kind==="reading"),z=G.length>0?G:J,B=z.length>0?Math.min(...z.map((H)=>H.checkedAt)):void 0,Q=$?.budget?.kind==="reading"?R5($.budget):void 0,Y=DZ($?.counters);return{scope:Z,limits:J,...B===void 0?{}:{checkedAt:B},...Q===void 0?{}:{budget:Q},...Y===void 0?{}:{counters:Y}}}function H$($,Z){let X=$?.budget;if(X?.reached!==!0||typeof X.resetsAt!=="string")return;let J=Date.parse(X.resetsAt);if(!Number.isFinite(J)||J<=Z)return;return{resetsAt:X.resetsAt,resetAtMs:J}}function MZ($){return $.kind==="reading"&&typeof $.usedPercent==="number"&&Number.isFinite($.usedPercent)&&$.usedPercent>=100}function J6($,Z){if(typeof $.resetsAt!=="string")return;let X=Date.parse($.resetsAt);return Number.isFinite(X)&&X>Z?X:void 0}function o8($,Z,X){let J=Z.rateLimitMarks?.get($);if(J!==void 0&&X<J)return{id:$,reason:"rate-limited",until:J};let G=Z.refreshBackoff?.get($);if(G!==void 0&&X<G)return{id:$,reason:"refresh-backoff",until:G};return}function E5($,Z,X,J){if(Z.limits.length===0)return{id:$,stage:1,gate:2,reason:"needs-first-reading",pullRequested:!0};for(let z of X)if(!Z.limits.some((B)=>B.label===z))return{id:$,stage:1,gate:3,reason:"unknown-window",window:{scope:Z.scope,label:z},pullRequested:!0};let G=Z.limits.filter(MZ);for(let z of G)if(J6(z,J)===void 0)return{id:$,stage:1,gate:4,reason:"unknown-reset",window:{scope:z.scope,label:z.label},pullRequested:!0};for(let z of G){let B=J6(z,J);if(B!==void 0&&typeof z.resetsAt==="string")return{id:$,stage:1,gate:5,reason:"exhausted",window:{scope:z.scope,label:z.label},resetsAt:z.resetsAt,resetAtMs:B}}return}function h0($){let Z=$.scope??X0,X=$.requiredLabels??UZ,J=[],G=[],z=[];for(let j of $.rows){let D=o8(j.id,$,$.now);if(D){J.push(D);continue}if(j.kind==="api-key"){z.push({id:j.id,kind:j.kind});continue}let U=s(j.quota,Z),N=E5(j.id,U,X,$.now);if(N){G.push(N);continue}z.push({id:j.id,kind:j.kind,projection:U})}let B=new Map(z.flatMap((j)=>{let D=H$(j.projection,$.now);return D?[[j.id,D]]:[]})),Q=B.size>0&&B.size===z.length,Y=[];for(let j of z){let D=B.get(j.id);if(D===void 0)Y.push(j);else if(Q)Y.push({...j,lastPath:!0});else G.push({id:j.id,stage:2,reason:"budget-spent",...D})}let H=new Map($.rows.map((j,D)=>[j.id,D])),W=(j,D)=>(H.get(j.id)??0)-(H.get(D.id)??0);G.sort(W);let V=G.filter((j)=>("pullRequested"in j)).map((j)=>j.id);for(let j of V)$.requestPull?.(j);return{admitted:Y,refused:G,excluded:J,pulls:V}}var G6="main";function FZ($){switch($){case"sticky-balanced":return{mode:"sticky-balanced",placement:"roster"};case"main-first":return{mode:"ordered",placement:"main-first"};case"fallback-first":return{mode:"ordered",placement:"fallback-first"};default:return{mode:"ordered",placement:"roster"}}}function f1($,Z,X=G6){if(Z==="roster"||!$.includes(X))return[...$];let J=$.filter((G)=>G!==X);return Z==="main-first"?[X,...J]:[...J,X]}function LZ($){let Z=h0($),X=new Set(Z.admitted.map((G)=>G.id));return{order:f1($.rows.map((G)=>G.id),$.placement??"roster",$.formerMainId).filter((G)=>X.has(G)&&$.killswitch?.get(G)!==!1),admission:Z}}function _Z($,Z,X){let J=Z.at(-1);if(J!==void 0){if(J.status===void 0||!X.includes(J.status))return}let G=new Set(Z.map((z)=>z.id));return $.find((z)=>!G.has(z))}function W$($,Z,X){if(!Z.has($.accountId))return!1;return!(typeof $.wireIdentity==="string"&&typeof X==="string"&&$.wireIdentity!==X)}function OZ($,Z,X){let J=new Map;for(let[G,z]of $){if(G===X)continue;if(z.quotaCheckedAt!==Z.get(z.accountId))continue;J.set(z.accountId,(J.get(z.accountId)??0)+(z.inputBytes??0))}return J}var TZ=900000,e8=0.016666666666666666,CZ=0.000001;function z6($,Z){for(let X of[$?.checkedAt,Z])if(typeof X==="number"&&Number.isFinite(X))return X;return}function $9($){if($===401||$===403)return"permanent";if($===void 0||$===0||!Number.isFinite($)||$>=500&&$<=599||$===429)return"transient";return"healthy"}function Z9($){return $.limits.filter((Z)=>Z.kind==="reading").sort((Z,X)=>{let J=Z.windowMinutes!==void 0,G=X.windowMinutes!==void 0;if(J!==G)return J?-1:1;if(J&&G)return(X.windowMinutes??0)-(Z.windowMinutes??0);return 0})}function AZ($){let Z=($.classifyStatus??$9)($.status);if(Z==="permanent")return{action:"migrate",reason:"permanent"};if(!$.quota)return{action:"retain",reason:"unknown"};let X=z6($.quota,$.quotaCheckedAt);if(X===void 0||!Number.isFinite(X)||$.now-X>TZ)return{action:"retain",reason:"stale"};if($.killswitchPasses===!1)return{action:"migrate",reason:"killswitch"};for(let G of Z9($.quota)){let z=G.remainingPercent;if(typeof z==="number"&&Number.isFinite(z)&&z<=0)return{action:"migrate",reason:"exhausted",window:{scope:G.scope,label:G.label},...typeof G.resetsAt==="string"?{resetsAt:G.resetsAt}:{}}}let J=H$($.quota,$.now);if(J)return{action:"migrate",reason:"exhausted",resetsAt:J.resetsAt};return{action:"retain",reason:Z}}function PZ($,Z,X){let J=Math.max(0,$.remainingPercent-Z);if(J<=0)return 0;if(!$.resetsAt)return J;let G=Date.parse($.resetsAt);if(!Number.isFinite(G)||G<=X)return J;let z=Math.max((G-X)/3600000,e8);return J/z}function t8($,Z){if($<Z)return-1;if($>Z)return 1;return 0}function I5($,Z){if(!$.quota)return;let X=z6($.quota,$.quotaCheckedAt);if(X===void 0||Z-X>TZ)return;let J=Z9($.quota).map((B)=>PZ({remainingPercent:B.remainingPercent??Number.NaN,...B.resetsAt===void 0?{}:{resetsAt:B.resetsAt}},$.reservePercent[B.label]??0,Z)),G=$.quota.budget;if(G&&typeof G.remainingPercent==="number"&&Number.isFinite(G.remainingPercent))J.push(PZ({remainingPercent:G.remainingPercent,...G.resetsAt===void 0?{}:{resetsAt:G.resetsAt}},0,Z));let z=J.length>0?Math.min(...J):0;return z>0?{candidate:$,quotaCheckedAt:X,weight:z}:void 0}function X9($){let Z=$.candidates.filter((G)=>G.killswitchPasses!==!1);if($.candidates.length===0)throw Error("Cannot select a sticky candidate: input.candidates is empty");if(Z.length===0)return;let X=Z.map((G)=>I5(G,$.now)).filter((G)=>G!==void 0);if(X.length>0){X.sort((z,B)=>{let Q=(($.pendingBytes.get(z.candidate.accountId)??0)+$.requestBytes)/Math.max(z.weight,CZ),Y=(($.pendingBytes.get(B.candidate.accountId)??0)+$.requestBytes)/Math.max(B.weight,CZ);return Q-Y||z.candidate.configuredOrder-B.candidate.configuredOrder||t8(z.candidate.accountId,B.candidate.accountId)});let G=X[0];if(G)return{accountId:G.candidate.accountId,quotaCheckedAt:G.quotaCheckedAt,source:"weighted"}}$.onEmptyWeightedSet?.();let J=[...Z].sort((G,z)=>{let B=(G.resetCreditsApplicable??0)>0?1:0;return((z.resetCreditsApplicable??0)>0?1:0)-B||G.configuredOrder-z.configuredOrder||t8(G.accountId,z.accountId)})[0];if(!J)throw Error("Cannot select a sticky candidate: input.candidates is empty");return{accountId:J.accountId,quotaCheckedAt:z6(J.quota,J.quotaCheckedAt),source:"mode-fallback"}}function SZ($){let Z=h0($),X=new Map(Z.admitted.map((U)=>[U.id,U])),J=new Map(Z.refused.map((U)=>[U.id,U])),G=new Set(Z.excluded.map((U)=>U.id)),z=new Set($.rows.map((U)=>U.id)),B=$.pin!==void 0&&W$($.pin,z,$.identities?.get($.pin.accountId));if(B&&$.pin){let U=X.get($.pin.accountId);if(U&&$.killswitch?.get(U.id)!==!1)return{outcome:"dispatch",accountId:U.id,source:"pin",...U.projection?.checkedAt===void 0?{}:{quotaCheckedAt:U.projection.checkedAt},pin:{action:"retain"},refusedSelections:[],admission:Z}}let Q=$.pin?J.get($.pin.accountId):void 0,Y=B&&$.pin!==void 0&&$.refusedPinPolicy==="move-on-confirmed-exhaustion"&&($.killswitch?.get($.pin.accountId)===!1||Q?.reason==="exhausted"||Q?.reason==="budget-spent"),H=(U)=>{return(typeof $.rowReservePercent==="function"?$.rowReservePercent(U):$.rowReservePercent?.get(U.id))??$.reservePercent??{}},W=$.scope,V=$.rows.map((U,N)=>({row:U,configuredOrder:N})).filter(({row:U})=>!G.has(U.id)).map(({row:U,configuredOrder:N})=>{let K=$.killswitch?.get(U.id),M=$.resetCreditsApplicable?.get(U.id);return{accountId:U.id,quota:U.kind==="api-key"?void 0:X.get(U.id)?.projection??s(U.quota,W),reservePercent:H(U),configuredOrder:N,...M===void 0?{}:{resetCreditsApplicable:M},...K===void 0?{}:{killswitchPasses:K}}}),j=[],D=B?{action:"retain"}:$.pin?{action:"clear"}:{action:"none"};while(V.length>0){let U=X9({candidates:V,pendingBytes:$.pendingBytes??new Map,requestBytes:$.requestBytes,now:$.now,...$.onEmptyWeightedSet?{onEmptyWeightedSet:$.onEmptyWeightedSet}:{}});if(!U)break;let N=J.get(U.accountId);if(N){j.push(N),V=V.filter((M)=>M.accountId!==U.accountId);continue}let K=$.identities?.get(U.accountId);return{outcome:"dispatch",accountId:U.accountId,source:U.source,...U.quotaCheckedAt===void 0?{}:{quotaCheckedAt:U.quotaCheckedAt},pin:B&&!Y?{action:"retain"}:{action:"assign",pin:{accountId:U.accountId,inputBytes:$.requestBytes,...K===void 0?{}:{wireIdentity:K},...U.quotaCheckedAt===void 0?{}:{quotaCheckedAt:U.quotaCheckedAt}}},refusedSelections:j,admission:Z}}return{outcome:"no-admissible-account",pin:D,refusedSelections:j,admission:Z}}import{appendFileSync as m5,chmodSync as w5,existsSync as bZ,renameSync as W9,statSync as p5}from"node:fs";import{open as u5}from"node:fs/promises";import{dirname as l5,resolve as d5}from"node:path";import{randomUUID as b5}from"node:crypto";import{lstat as B9,readFile as Q9,rename as x5,unlink as J9}from"node:fs/promises";import{dirname as i0,resolve as N0}from"node:path";var I=process.platform==="win32",G9=new Set;function RZ($){if($?.reason==="io-error"){if($.win32Code===2||$.win32Code===3)return"ENOENT";if($.win32Code===80||$.win32Code===183)return"EEXIST"}return $?.code??"ERR_PRIVATE_FILE"}var z9;function g1(){return z9??=import("@cortexkit/private-files"),z9}class d extends Error{path;stage;code;win32Code;reason;published=!1;durabilityConfirmed=!1;fileDurable=!1;attempts=0;elapsedMs=0;orphanPath;constructor($,Z,X){let J=X;super(`Private file refused at ${Z}: ${$} (${J?.reason??J?.code??"io-error"}). Use a safe parent directory. Repair only a named secret file in safe ancestry whose owner the published policy trusts, without changing its owner or any existing directory. Previously exposed credentials may need rotation. Windows requires the private-files native prebuild and an ACL-persisting local filesystem such as NTFS.`,{cause:X});this.path=$,this.stage=Z,this.name="PrivateFileError",this.code=RZ(J),this.win32Code=J?.win32Code,this.reason=J?.reason}}async function D0($,Z,X){try{return await X()}catch(J){if(J instanceof d)throw J;throw new d($,Z,J)}}var k5;async function v0($,Z){$=N0($),Z??=k5,await D0($,"safe-parent",async()=>{let X=await(await g1()).verifySafeParent($,Z);if(X.ok===!1){if(X.reason==="io-error"||X.reason==="wrong-kind")await B9($);throw new d(X.level??X.path,"safe-parent",{...X,code:"ERR_PRIVATE_FILES_SECURITY"})}})}async function J0($,Z,X=!1){if($=N0($),Z==="directory")return v0($);await D0($,"verify",async()=>{let J=await g1(),G=await J.verifyOwnerOnly($),z=!1;if(!G.ok){let{reason:B}=G.refusal;if(B==="io-error")await J.verifyPrivatePath($,Z);if(X&&[J.EXTRA_ACE,J.NOT_PROTECTED,J.NULL_DACL,J.EMPTY_DACL].includes(B))await v0(i0($)),await J.securePrivatePath($,Z),z=!0;else throw Object.assign(Error("Owner-only verification refused"),{reason:B,code:"ERR_PRIVATE_FILES_SECURITY"})}if(await J.verifyPrivatePath($,Z),z&&!G9.has($))G9.add($),process.emitWarning(`Private permissions tightened: ${$}. This object may have been readable before; rotate credentials if needed.`,"PrivateFileMigration")})}async function K0($,Z=!1,X){$=N0($),await D0($,"directory",async()=>{let J=await g1();try{return await B9($),await v0($,X)}catch(z){if(RZ(z)!=="ENOENT")throw z}let G=i0($);if(G===$)throw Object.assign(Error("Missing root"),{code:"ENOENT"});await K0(G,!1,X);try{await J.createOwnerOnly($,{kind:"dir"})}catch(z){if(RZ(z)!=="EEXIST")throw z}await v0($,X)})}async function M0($,Z=!1){if(!I)return Q9($,"utf8");return(await EZ($,Z)).toString("utf8")}async function EZ($,Z=!1){if(!I)return Q9($);if($=N0($),Z)await v0(i0($)),await J0($,"file",!0);return D0($,"read",async()=>(await g1()).readOwnerOnly($))}async function h1($,Z){await v0(i0(N0($))),await D0($,"create",async()=>{await(await g1()).createPrivateFile(N0($),Z)})}async function Y9($){await v0(i0(N0($))),await D0($,"directory-create",async()=>{await(await g1()).createOwnerOnly(N0($),{kind:"dir"})})}async function IZ($,Z,X={}){$=N0($),Z=N0(Z);let J=X.now??(()=>performance.now()),G=J(),z=Math.min(G+500,X.deadline??1/0),B=[0,10,20,40,80,100],Q,Y=0;for(let W of B){if(J()>=z)break;if(W)await(X.sleep??((V)=>new Promise((j)=>setTimeout(j,V))))(Math.min(W,Math.max(0,z-J())));if(J()>=z)break;if(await X.beforeRename?.(),J()>=z)break;Y++;try{return await(X.rename??x5)($,Z),{attempts:Y,elapsedMs:J()-G}}catch(V){Q??=V;let j=V;if(!(j.win32Code!==void 0?j.win32Code===32||j.win32Code===33:["EBUSY","EPERM","EACCES"].includes(j.code??"")&&!j.reason))break}}let H=new d(Z,"rename",Q??Object.assign(Error("Publication deadline expired"),{code:"ETIMEDOUT"}));throw H.attempts=Y,H.elapsedMs=J()-G,H}async function v1($,Z,X={}){$=N0($),await K0(i0($));try{await J0($,"file",!0)}catch(H){if(H.code!=="ENOENT")throw H}let J=N0(X.stagePath??`${$}.${b5()}.tmp`);if(i0(J)!==i0($))throw new d($,"stage-directory",{code:"EXDEV"});let G=!1,z=!1,B={attempts:0,elapsedMs:0},Q="stage-create",Y=(H)=>{try{X.onOutcome?.({path:$,stage:H?.stage??"published",published:z,fileDurable:z,durabilityConfirmed:!1,attempts:H?.attempts??B.attempts,elapsedMs:H?.elapsedMs??B.elapsedMs,...H&&{code:H.code,win32Code:H.win32Code}})}catch{}};try{if(await h1(J,Z),G=!0,Q="before-rename",B=await IZ(J,$,X),G=!1,z=!0,Q="published-callback",X.onRenamed?.(),Q="published-verify",await J0($,"file"),X.durable&&X.durability!=="file-only-on-windows")throw new d($,"directory-sync-unsupported",{code:"ENOTSUP"});Y()}catch(H){let W=H instanceof d?H:new d($,Q,H);if(W.published=z,W.fileDurable=z,z)Object.assign(W,B);if(G){try{await J9(J)}catch{W.orphanPath=J}G=!1}throw Y(W),W}finally{if(G)await J9(J).catch(()=>{})}}var y5=/^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i,f5=/\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g;function g5($){return $ instanceof Error||Object.prototype.toString.call($)==="[object Error]"}function I0($={}){let Z=[f5,...$.extraValuePatterns??[]].map((z)=>new RegExp(z.source,z.flags.includes("g")?z.flags:`${z.flags}g`));function X(z){let B=z.toLowerCase().replace(/[-_]/g,"");return y5.test(z)||B.includes("apikey")||B.endsWith("secret")||B.endsWith("password")||B.endsWith("token")&&!B.endsWith("tokens")||!!$.extraSecretKeys?.(B)}function J(z){let B=z,Q=[["name",z.name],["message",z.message],["stack",z.stack]];for(let H of["code","status","cause"])if(B[H]!==void 0)Q.push([H,B[H]]);let Y=new Set(Q.map(([H])=>H));for(let H of Object.entries(z))if(!Y.has(H[0]))Q.push(H);return Q}function G(z,B,Q,Y=0){if(typeof z==="string")return Z.reduce((H,W)=>H.replace(W,"***REDACTED***"),z);if(!z||typeof z!=="object")return z;if(Q.has(z))return"[Circular]";Q.add(z);try{if(Array.isArray(z))return z.map((V)=>G(V,B,Q,Y));let H=g5(z);if(H&&Y>=8)return"[Truncated]";let W=H?Y+1:Y;return Object.fromEntries((H?J(z):Object.entries(z)).map(([V,j])=>[V,B&&X(V)?"***REDACTED***":G(j,B,Q,W)]))}finally{Q.delete(z)}}return{redact:(z)=>G(z,!0,new WeakSet),redactStrings:(z)=>G(z,!1,new WeakSet)}}var H9=I0(),h5=H9.redact,v5=H9.redactStrings;var B6={error:0,warn:1,info:2,debug:3,trace:4},U9=5242880,j9=3;function xZ($){try{w5($,384)}catch{}}function c5($){try{if(!(bZ($)&&p5($).size>=U9))return;for(let X=j9-1;X>=1;X--)if(bZ(`${$}.${X}`)){let J=`${$}.${X+1}`;W9(`${$}.${X}`,J),xZ(J)}let Z=`${$}.1`;W9($,Z),xZ(Z)}catch{}}async function m0($){let{file:Z,handle:X}=$;if($.file=void 0,$.handle=void 0,Z&&X)await D0(Z,"log-close",()=>X.close())}async function V9($,Z){await K0(l5(Z));try{await J0(Z,"file",!0)}catch(X){if(X.code!=="ENOENT")throw X;try{await h1(Z,"")}catch(J){if(J.code!=="EEXIST")throw J;await J0(Z,"file",!0)}}return $.handle=await D0(Z,"log-open",()=>u5(Z,"a")),$.file=Z,$.handle}async function s5($,Z,X){Z=d5(Z);try{if($.file!==Z)await m0($);let J=$.handle??await V9($,Z);if((await D0(Z,"log-stat",()=>J.stat())).size>=U9){await m0($);for(let z=j9-1;z>=0;z--){let B=z===0?Z:`${Z}.${z}`,Q=`${Z}.${z+1}`;try{await J0(B,"file",!0)}catch(Y){if(Y.code==="ENOENT")continue;throw Y}try{await J0(Q,"file",!0)}catch(Y){if(Y.code!=="ENOENT")throw Y}await IZ(B,Q),await J0(Q,"file")}J=await V9($,Z)}await D0(Z,"log-append",()=>J.appendFile(X,"utf8"))}catch(J){throw await m0($).catch(()=>{}),J}}function i5($){try{return` ${JSON.stringify($)}`}catch{return" [unserializable]"}}function a5($){let Z,X,J,G=I0(),z,B=[],Q,Y=Promise.resolve(),H,W={};function V(q){let L=Y.then(q);return Y=L.catch((S)=>{H=S}),L}function j(q){if(I&&q.file!==Z)V(()=>m0(W)).catch(()=>{});Z=q.file,X=q.level,G=I0(q),z=q.captureSink}function D(q){if(q===void 0||q in B6)J=q}function U(){if(Z===void 0)return;return(typeof Z==="function"?Z():Z)||void 0}function N(){if(J)return J;let q=typeof X==="function"?X():X;if(q&&q in B6)return q;return"info"}function K(q=!0){if(Q)clearTimeout(Q),Q=void 0;if(!B.length){if(I)return V(async()=>{if(q)await m0(W);if(H)throw H});return}let L;try{L=U()}catch{if(B=[],I&&q)return V(()=>m0(W));return}let S=B.join("");if(B=[],!L){if(I&&q)return V(()=>m0(W));return}if(I)return V(async()=>{try{await s5(W,L,S)}finally{if(q)await m0(W)}});try{if(c5(L),bZ(L))xZ(L);m5(L,S,{encoding:"utf8",mode:384})}catch{}}function M(){if(!Q)Q=setTimeout(()=>{Q=void 0;let q=K(!1);if(q instanceof Promise)q.catch(()=>{})},500)}function P(q,L,S,A){if(Z===void 0&&z===void 0)return;try{if(B6[L]>B6[N()])return;let x=G.redactStrings(S),w;try{w=G.redact(A)}catch{w="[unserializable]"}let y=`[${new Date().toISOString()}] ${L.toUpperCase()} [${q}] ${x}`+(A===void 0?"":i5(w))+`
+`;try{z?.({channel:q,level:L,message:x,data:w})}catch{}if(Z===void 0)return;if(B.push(y),B.length>=50){let f=K(!1);if(f instanceof Promise)f.catch(()=>{})}else M()}catch{}}function E(q){return{error:(L,S)=>P(q,"error",L,S),warn:(L,S)=>P(q,"warn",L,S),info:(L,S)=>P(q,"info",L,S),debug:(L,S)=>P(q,"debug",L,S),trace:(L,S)=>P(q,"trace",L,S)}}function F(){if(I)V(()=>m0(W)).catch(()=>{});if(H=void 0,B=[],Q)clearTimeout(Q),Q=void 0;Z=void 0,X=void 0,J=void 0,G=I0(),z=void 0}if($)j($);return{configure:j,createLogger:E,setLogLevel:D,flushLogs:K,reset:F}}var n5=a5();function a($){return n5.createLogger($)}class g extends Error{operation;rowId;phase;retryable;kind;committed;constructor($){super($.message??`${$.operation} failed (${$.kind}, ${$.phase})`,$.cause===void 0?void 0:{cause:$.cause});this.name="PoolOperationError",this.operation=$.operation,this.rowId=$.rowId,this.phase=$.phase,this.retryable=$.retryable,this.kind=$.kind,this.committed=$.committed}}class Q6 extends Error{operation;constructor($){super(`${$} was called from inside a store hook; hand it to the caller's continuation instead`);this.name="PoolReentryError",this.operation=$}}var m1="identity-contradicted: ",kZ="duplicate-identity";function a0($,Z,X){let J=$.rosterRow(Z);if(!J)return;J.enabled=!1;let G=$.entry(Z)??{credentialEpoch:1,needsFirstReading:!0},z=typeof G.disabledReason==="string"&&G.disabledReason.startsWith("identity-contradicted: ");$.setEntry(Z,{...G,disabledReason:z?G.disabledReason:X})}function V$($,Z){let X=$.rosterRow(Z);if(!X)return;X.enabled=!0;let J=$.entry(Z);if(J&&"disabledReason"in J){let G={...J};delete G.disabledReason,$.setEntry(Z,G)}}function w1($,Z){let X=$.rows().filter((G)=>G.invalid===void 0&&!G.staged&&G.type==="oauth"&&G.enabled&&G.identity===Z),J=[];for(let G of X.slice(1))a0($,G.id,"duplicate-identity"),J.push(G.id);return J}function N1($,Z,X){let J=$.rosterRow(Z);if(!J)return[];return J.accountId=X,w1($,X)}import{setTimeout as PX}from"node:timers/promises";import{randomUUID as D9}from"node:crypto";import{mkdir as ZX,open as Y6,rename as XX,rm as JX}from"node:fs/promises";import{dirname as yZ}from"node:path";class U$ extends Error{constructor($){super("file or directory sync failed",{cause:$});this.name="AtomicSyncError"}}async function F0($,Z,X={}){await fZ($,Z,X)}async function fZ($,Z,X,J){if(I)return v1($,X.serialize?X.serialize(Z):`${JSON.stringify(Z,null,2)}
+`,{beforeRename:X.beforeRename,stagePath:`${$}.${(X.stageName??D9)()}.tmp`,onRenamed:J,durable:X.durable,durability:X.durability,onOutcome:X.onOutcome});await ZX(yZ($),{recursive:!0});let G=`${$}.${(X.stageName??D9)()}.tmp`,z,B=!1;try{if(z=await Y6(G,"wx",384),B=!0,await z.writeFile(X.serialize?X.serialize(Z):`${JSON.stringify(Z,null,2)}
+`,"utf8"),await z.chmod(384),X.durable)try{await z.sync()}catch(Q){throw new U$(Q)}if(await z.close(),z=void 0,await X.beforeRename?.(),await XX(G,$),B=!1,J?.(),X.durable){let Q=await Y6(yZ($),"r");try{await Q.sync()}catch(Y){throw new U$(Y)}finally{await Q.close()}}}finally{if(await z?.close().catch(()=>{}),B)await JX(G,{force:!0}).catch(()=>{})}}async function gZ($){if(I){await J0($,"file");let J=new d($,"directory-sync-unsupported",{code:"ENOTSUP"});throw J.published=!0,J}let Z=await Y6($,"r");try{await Z.sync()}finally{await Z.close()}let X=await Y6(yZ($),"r");try{await X.sync()}finally{await X.close()}}import{randomUUID as H6}from"node:crypto";import{mkdir as K9,open as _9,readFile as q9,rename as N9,rm as W6,stat as M9}from"node:fs/promises";import{dirname as hZ,join as F9}from"node:path";async function L9($,Z){let X=await _9($,"wx",384);try{await X.writeFile(Z,"utf8")}finally{await X.close()}}var GX=globalThis.setTimeout.bind(globalThis),zX=globalThis.clearTimeout.bind(globalThis);function vZ($){let Z=$?.code;return Z==="ENOENT"||!I&&(Z==="EINVAL"||Z==="ENOTDIR")}function e($){return BX({...$,now:Date.now})}async function BX($){let Z=mZ($.path,$.name),X=F9(Z,"owner.json"),J=H6(),G=$.now??Date.now,z=null,B=!1,Q=!1,Y,H,W=new Promise((C)=>{H=C});function V(C){try{let T=$.onRenewalTimer?.(C);if(T&&(typeof T==="object"||typeof T==="function")&&"then"in T&&typeof T.then==="function")Promise.resolve(T).catch(()=>{})}catch{}}function j(){if(!z)return;zX(z),z=null,V("cancelled")}function D(C,T){if(Y||B)return;Y=Object.freeze({reason:C,expectedOwnerId:J,...typeof T?.ownerId==="string"?{observedOwnerId:T.ownerId}:{},...typeof T?.expiresAt==="number"?{observedExpiresAt:T.expiresAt}:{}}),j(),H(Y)}let U,N=null,K=`${Z}.evicting`,M=F9(K,"owner.json"),P=H6(),E=5000,F=8;async function q(){if(I)try{return JSON.parse(await M0(Z,!0))}catch(C){if(C.code!=="EISDIR"&&C.reason!=="wrong-kind")throw C;return await J0(Z,"directory",!0),JSON.parse(await M0(X,!0))}try{return JSON.parse(await q9(Z,"utf8"))}catch(C){if(C.code!=="EISDIR")throw C;return JSON.parse(await q9(X,"utf8"))}}async function L(){if(I){let u=await q(),o=Number(u?.expiresAt)-G();await v1(Z,`${JSON.stringify({ownerId:J,expiresAt:G()+$.ttlMs})}
+`,{deadline:performance.now()+Math.max(0,o),beforeRename:async()=>{let t$=await q();if(t$?.ownerId!==J||!(Number(t$?.expiresAt)>G())||!await h())throw new n0({target:$.path,name:$.name})}});return}let C=`${Z}.${H6()}.tmp`,T,b=!1;try{T=await _9(C,"wx",384),b=!0,await T.writeFile(`${JSON.stringify({ownerId:J,expiresAt:G()+$.ttlMs})}
+`,"utf8"),await T.chmod(384),await T.close(),T=void 0;let u=await q();if(u?.ownerId!==J||!(Number(u?.expiresAt)>G())||!await h())throw new n0({target:$.path,name:$.name});await N9(C,Z),b=!1}finally{if(await T?.close().catch(()=>{}),b)await W6(C,{force:!0}).catch(()=>{})}}async function S(){let C=`${JSON.stringify({ownerId:J,expiresAt:G()+$.ttlMs})}
+`;if(I)await h1(Z,C);else await L9(Z,C)}async function A(C){let T=C.code;if(T==="EEXIST"){if(I)await q();return!0}if(T==="EISDIR"){if(I)await J0(Z,"directory",!0),await M0(X,!0);return!0}return!1}async function x(){if(I)await K0(hZ(Z));try{return await S(),!0}catch(C){let T=C.code;if(await A(C))return!1;if(T==="ENOENT"){if(I)await K0(hZ(Z));else await K9(hZ(Z),{recursive:!0});try{return await S(),!0}catch(b){if(await A(b))return!1;throw b}}throw C}}async function w(){await new Promise((C)=>setTimeout(C,Math.floor(Math.random()*4)))}async function y(C=!0){if(C&&$.onStep)await $.onStep("lock-read-ready");let T;try{T=await q()}catch(u){if(I&&u.code!=="ENOENT")throw u}let b=Number(T?.expiresAt);if(Number.isFinite(b)&&b>G())return{status:"live"};if(typeof T?.ownerId==="string"&&Number.isFinite(b))return{status:"stale",identity:{kind:"owner",ownerId:T.ownerId,expiresAt:b}};try{let u=await M9(Z),o=Number.isFinite(b)?b:u.mtimeMs+$.ttlMs;if(o>G())return{status:"live"};return{status:"stale",identity:{kind:"stat",dev:u.dev,ino:u.ino,mtimeMs:u.mtimeMs,expiresAt:o}}}catch(u){if(u.code==="ENOENT"){if($.onStep)await $.onStep("lock-missing");return{status:"missing"}}throw u}}function f(C,T){if(T.status!=="stale")return!1;let b=T.identity;if(C.kind==="owner"&&b.kind==="owner")return C.ownerId===b.ownerId&&C.expiresAt===b.expiresAt;return C.kind==="stat"&&b.kind==="stat"&&C.dev===b.dev&&C.ino===b.ino&&C.mtimeMs===b.mtimeMs&&C.expiresAt===b.expiresAt}async function h(){try{return JSON.parse(await M0(M,I))?.ownerId===P}catch(C){if(I&&C.code!=="ENOENT")throw C;return!1}}async function r(C){if(I)await D0(C,"remove",()=>W6(C,{recursive:!0,force:!0}));else await W6(C,{recursive:!0,force:!0}).catch(()=>{})}async function c(){if(await h())await r(K)}async function r$(){if(I)await Y9(K);else await K9(K);try{let C=`${JSON.stringify({ownerId:P,createdAt:G()})}
+`;if(I)await h1(M,C);else await L9(M,C)}catch(C){if(vZ(C))return!1;throw await c(),C}if($.onStep)await $.onStep("eviction-marker-acquired");return!0}async function x1(){let C;try{C=await M9(K)}catch(b){if(b.code==="ENOENT")return"missing";throw b}if(I)await J0(K,"directory",!0);if(C.mtimeMs+E>G())return"fresh";if($.onStep)await $.onStep("stale-marker-stat");let T=`${K}.${H6()}`;try{await N9(K,T)}catch(b){if(b.code==="ENOENT")return"missing";throw b}if($.onStep)await $.onStep("stale-marker-claimed");return await r(T),"recovered"}async function o$(C){try{if(!await r$())return!1}catch(T){if(T.code==="EEXIST"){if(I){await J0(K,"directory",!0);try{await M0(M,!0)}catch(b){if(b.code!=="ENOENT")throw b}}return!1}throw T}try{await C()}finally{await c()}return!0}async function v(){for(let C=0;C<F;C++){if($.onStep)await $.onStep("relinquish-read");let T;try{T=await q()}catch(b){if(I)throw b;return}if(T?.ownerId!==J)return;try{await W6(Z,{recursive:!0,force:!0});return}catch(b){if(I)throw b;await w()}}}function g0(){if(!$.renew||B||Y)return;let C=$.renewIntervalMs??Math.max(1000,Math.floor($.ttlMs/3));if(z=GX(()=>{z=null;let T=(async()=>{let b=!B;try{if(!await o$(async()=>{let o=await q(),t$=G();if(B||Y){b=!1;return}if(o?.ownerId!==J){D("taken-over",o),b=!1;return}if(!(Number(o?.expiresAt)>t$)){D("expired",o),b=!1;return}if($.onStep)await $.onStep("renewal-owner-confirmed");if(B||Y){b=!1;return}if(!await h())return;if($.onStep)await $.onStep("renewal-write-fenced");if(B||Y){b=!1;return}if(!await h())return;if($.onStep)await $.onStep("renewal-write-ready");if(B||Y){b=!1;return}if(await L(),$.onStep)await $.onStep("renewal-write-finished");if(!await h()){D("marker-lost"),b=!1,await v();return}})&&$.onStep)await $.onStep("renewal-marker-unavailable")}catch(u){if(I&&u instanceof d)U=u,D("renewal-failed"),b=!1;try{let o=await q();if(o?.ownerId!==J)D("taken-over",o);else if(!(Number(o?.expiresAt)>G()))D("expired",o)}catch{D("renewal-failed")}}finally{if($.onStep)try{await $.onStep("renewal-finished")}catch{}if(b&&!B&&!Y)g0()}})();N=T,T.finally(()=>{if(N===T)N=null})},C),"unref"in z)z.unref();V("scheduled")}function h8(){try{let C=$.onContended?.();if(C&&(typeof C==="object"||typeof C==="function")&&"then"in C&&typeof C.then==="function")Promise.resolve(C).catch(()=>{})}catch{}return null}let D1=await x();if(!D1)for(let C=0;C<F;C++){if(D1=await x(),D1)break;let T=await y();if(T.status==="live")return h8();if(T.status==="missing")continue;if($.onStep)await $.onStep("stale-lock-observed");try{if(!await r$()){await w();continue}}catch(b){if(b.code!=="EEXIST")throw b;if(await x1()==="fresh")return null;await w();continue}try{let b=await y();if(b.status==="live")return h8();if(!f(T.identity,b))continue;if(!await h())return null;if($.onStep)await $.onStep("stale-lock-confirmed");if(!await h())return null;let u=await y(!1);if(!f(T.identity,u))continue;if(await r(Z),!await h())return null;if($.onStep)await $.onStep("stale-lock-removed");if(D1=await x(),!D1)return null;if($.onStep)await $.onStep("stale-lock-recreated");if(!await h())return await v(),D1=!1,null;break}finally{await c()}}if(!D1)return null;return g0(),{ownerId:J,whenLost:()=>W,hasLost:()=>Y!==void 0,assertOwned:async()=>{if(U)throw U;let C;try{let T=await q();if(C=T,!B&&!Y&&T?.ownerId===J&&Number(T?.expiresAt)>G())return;D(T?.ownerId!==J?"taken-over":"expired",T)}catch(T){if(D("unreadable"),I&&T instanceof d)throw T}throw new n0({target:$.path,name:$.name,expectedOwnerId:J,...typeof C?.ownerId==="string"?{observedOwnerId:C.ownerId}:{},...typeof C?.expiresAt==="number"?{observedExpiresAt:C.expiresAt}:{}})},release:async()=>{if(I&&Q)return;B=!0,j(),await N;for(let C=0;C<F;C++){try{let T=!1;if(await o$(async()=>{let u;try{u=await q()}catch(o){if(I&&o.code==="ENOENT"){T=!0;return}throw o}if(u?.ownerId!==J){T=!0;return}if($.onStep)await $.onStep("release-owner-confirmed");if(!await h())return;await r(Z),T=!0})){if(I&&!T)throw new d(Z,"release-not-confirmed",{code:"EIO"});Q=T;return}await x1()}catch(T){if(I)throw T;return}await w()}if(I)throw new d(Z,"release-not-confirmed",{code:"ETIMEDOUT"})}}}function mZ($,Z){return`${$}.${Z}.lock`}class M1 extends Error{details;constructor($){super(`Timed out acquiring ${$.name} lock for ${$.target}`);this.name="LockContentionError",this.details=$}}class n0 extends Error{details;constructor($){super(`Lost ${$.name} lock for ${$.target}`);this.name="LockOwnershipError",this.details=$}}async function wZ($,Z,X){let J=performance.now();for(;;){let G=await e({path:$,name:Z.name,ttlMs:Z.ttlMs,renew:Z.renew??!1,...Z.onStep?{onStep:Z.onStep}:{},...Z.onRenewalTimer?{onRenewalTimer:Z.onRenewalTimer}:{}});if(G)try{return await X(G)}finally{await G.release()}let z=Z.timeoutMs-(performance.now()-J);if(z<=0)throw new M1({target:$,name:Z.name,timeoutMs:Z.timeoutMs});await new Promise((B)=>setTimeout(B,Math.min(25,Math.ceil(z))))}}import{AsyncLocalStorage as QX}from"node:async_hooks";var O9=new QX;function G0($){if(O9.getStore()!==void 0)throw new Q6($)}function b0($,Z){return O9.run($,async()=>await Z())}async function C9($,Z,X,J,G){if(!Z)return;try{await b0($,()=>Z(X,J))}catch(z){G?.warn("store failure hook threw; the original failure stands",{operation:$,rowId:X,error:z instanceof Error?z.message:String(z)})}}var pZ=Object.freeze({ttlMs:1e4,timeoutMs:15000,retryMs:50,renew:!0});async function YX($,Z,X){let J=(B)=>{try{let Q=X.onLockEvent?.({type:B,name:$.name,path:$.path});if(Q&&(typeof Q==="object"||typeof Q==="function")&&"then"in Q&&typeof Q.then==="function")Promise.resolve(Q).catch(()=>{})}catch{}},G={...Z,...HX($)},z=performance.now();for(;;){let B=await e({name:$.name,path:$.path,ttlMs:G.ttlMs,renew:G.renew,onContended:()=>J("contended"),...X.onRenewalTimer?{onRenewalTimer:(H)=>X.onRenewalTimer?.({name:$.name,path:$.path},H)}:{},...G.renewIntervalMs!==void 0?{renewIntervalMs:G.renewIntervalMs}:{},...X.onLockStep?{onStep:(H)=>X.onLockStep?.({name:$.name,path:$.path},H)}:{}});if(B){J("acquired");let H={name:$.name,path:$.path,assertOwned:()=>B.assertOwned(),release:async()=>{await B.release(),J("released")}};try{await H.assertOwned()}catch(W){throw await H.release(),W}return H}let Q=G.timeoutMs-(performance.now()-z);if(Q<=0)throw new M1({target:$.path,name:$.name,timeoutMs:G.timeoutMs});let Y=Math.floor(Math.random()*(G.retryMs+1));await new Promise((H)=>setTimeout(H,Math.min(G.retryMs+Y,Q)))}}function HX($){let Z={};if($.ttlMs!==void 0)Z.ttlMs=$.ttlMs;if($.timeoutMs!==void 0)Z.timeoutMs=$.timeoutMs;if($.retryMs!==void 0)Z.retryMs=$.retryMs;if($.renew!==void 0)Z.renew=$.renew;if($.renewIntervalMs!==void 0)Z.renewIntervalMs=$.renewIntervalMs;return Z}class r0{defaults;env;held=[];constructor($,Z){this.defaults=$,this.env=Z}async acquire($){let Z=await YX($,this.defaults,this.env);return this.held.push(Z),await this.assertAll(),Z}async assertAll(){for(let $ of this.held)await $.assertOwned()}async releaseTo($){while(this.held.length>$)await this.held.pop()?.release().catch(()=>{})}async releaseAll(){await this.releaseTo(0)}}function F1($,Z,X){if(X!==void 0)throw new g({operation:$,rowId:Z,kind:"row-staged",phase:$==="pull"?"pull":"before-first-write",retryable:!1,message:`row ${Z} is reserved for roster publication`})}import{createHash as j$}from"node:crypto";var p="commonAuthPool",o0=1,P0="rows",V6="retiredEpochs",D$=1,uZ=300000,m=p;function WX($){let Z=JSON.parse(JSON.stringify($)),X=(J)=>{if(Array.isArray(J))return`[${J.map(X).join(",")}]`;if(O(J))return`{${Object.keys(J).sort().map((G)=>`${JSON.stringify(G)}:${X(J[G])}`).join(",")}}`;return JSON.stringify(J)};return X(Z)}function L1($){return j$("sha256").update(WX($)).digest("hex")}function P9($){if(!O($)||Object.keys($).length!==1||typeof $.reservation!=="string"||!$.reservation)return;return{reservation:$.reservation}}function VX($){if(!O($)||typeof $.reservation!=="string"||!$.reservation||typeof $.disabledReason!=="string")return;if(Object.keys($).some((Z)=>!["reservation","label","disabledReason","providerState"].includes(Z)))return;if("label"in $&&typeof $.label!=="string")return;if("providerState"in $&&(typeof $.providerState!=="string"||!/^[a-f0-9]{64}$/.test($.providerState)))return;return $}var Y0="commonAuthProviderState";function O($){return $!=null&&typeof $==="object"&&!Array.isArray($)}var UX=new Set(["__proto__","constructor","prototype"]);function p1($){if(typeof $!=="string"||$.length===0)return"id must be non-empty";if($.trim()!==$)return"id must not carry surrounding whitespace";if(UX.has($))return"id is a reserved object key";return}function lZ($){let Z=typeof $==="string"?$.trim():"";if(!Z)return!1;try{let X=new URL(Z);return(X.protocol==="http:"||X.protocol==="https:")&&!X.username&&!X.password}catch{return!1}}function T9($){return $.type==="oauth"?`oauth\x00${$.refresh}`:`api\x00${$.apiKey}`}function t0($){return j$("sha256").update(T9($)).digest("hex")}function x0($){return j$("sha256").update(`credential-stamp\x00${T9($)}`).digest("hex")}function w0($){let Z=$.type==="oauth"?["oauth",typeof $.access==="string"?$.access:null,$.refresh,typeof $.expires==="number"&&Number.isFinite($.expires)?$.expires:null]:["api",$.apiKey,$.baseURL.trim(),$.authHeader??"authorization-bearer"];return j$("sha256").update(`credential-dispatch\x00${JSON.stringify(Z)}`).digest("hex")}function dZ($,Z,X,J={}){return{credentialEpoch:Z,digest:x0($),dispatch:w0($),binding:{...X},...J.replace?{replace:!0}:{},...J.providerState!==void 0?{providerState:J.providerState}:{}}}function u1($,Z){let X=$?.credentialBound?$.credentialBound(Z):Z;return j$("sha256").update(`provider-state\x00${JSON.stringify(X??null)}`).digest("hex")}function K$($,Z,X,J){if(!Z||X===void 0)return;if(!O($)||!Object.hasOwn($,Y0))return;let G=V0($[m]);if(!G||G.providerState===void 0||G.digest!==x0(Z)||G.credentialEpoch!==X||G.binding?.identity!==J)return;return G.providerState}function $0($){return Number.isSafeInteger($)&&$>=1}function V0($){if(!O($))return;let Z=$.credentialEpoch;if(!$0(Z))return;if(typeof $.digest!=="string")return;if("dispatch"in $&&typeof $.dispatch!=="string")return;if("replace"in $&&$.replace!==!0)return;if("providerState"in $&&typeof $.providerState!=="string")return;let X="staged"in $?VX($.staged):void 0;if("staged"in $&&!X)return;let J={...X?{staged:X}:{},...typeof $.dispatch==="string"?{dispatch:$.dispatch}:{},...$.replace===!0?{replace:!0}:{},...typeof $.providerState==="string"?{providerState:$.providerState}:{}};if(!("binding"in $))return"dispatch"in $||"replace"in $||"providerState"in $||"staged"in $?void 0:{credentialEpoch:Z,digest:$.digest};let G=$.binding;if(!O(G))return;if("identity"in G&&(typeof G.identity!=="string"||!G.identity))return;if("baseURL"in G&&!lZ(G.baseURL))return;if("authHeader"in G&&G.authHeader!=="authorization-bearer"&&G.authHeader!=="x-api-key")return;return{credentialEpoch:Z,digest:$.digest,...J,binding:{...typeof G.identity==="string"?{identity:G.identity}:{},...typeof G.baseURL==="string"?{baseURL:G.baseURL.trim()}:{},...G.authHeader==="authorization-bearer"||G.authHeader==="x-api-key"?{authHeader:G.authHeader}:{}}}}function jX($,Z,X){if($.identity!==X)return!1;if($.baseURL!==void 0&&(Z.type!=="api"||Z.baseURL!==$.baseURL))return!1;if($.authHeader!==void 0&&(Z.type!=="api"||Z.authHeader!==$.authHeader))return!1;return!0}function DX($,Z,X,J){if(!$)return"none";if(!O(J)||!Object.hasOwn(J,m))return"missing";let G=V0(J[m]);if(!G)return"malformed";if(G.digest!==x0($))return"mismatched";if(G.dispatch===void 0)return"legacy";if(G.credentialEpoch!==Z)return"mismatched";if(!G.binding||!jX(G.binding,$,X))return"mismatched";if(G.dispatch!==w0($))return"mismatched";return"bound"}function A9($){if(!$.exists)return{status:"ready",exists:!1,config:{}};if("parseError"in $)return{status:"error",reason:"config file is not valid JSON"};let Z=$.value;if(!O(Z))return{status:"error",reason:"config root is not an object"};if("accounts"in Z&&!Array.isArray(Z.accounts))return{status:"error",reason:"config accounts is not an array"};if(!(p in Z))return Array.isArray(Z.accounts)?{status:"pending-migration",config:Z}:{status:"ready",exists:!0,config:Z};let X=Z[p];if(!O(X))return{status:"error",reason:`${p} is not an object`};let J=X.schemaVersion;if(typeof J!=="number"||!Number.isInteger(J)||J<1)return{status:"error",reason:`${p}.schemaVersion is invalid`};if(J>o0)return{status:"error",reason:`${p}.schemaVersion ${J} is newer than ${o0}`};if(P0 in X&&!O(X[P0]))return{status:"error",reason:`${p}.${P0} is not an object`};return{status:"ready",exists:!0,config:Z}}function S9($){if(!$.exists)return{status:"ready",exists:!1,state:{}};if("parseError"in $)return{status:"error",reason:"state file is not valid JSON"};if(!O($.value))return{status:"error",reason:"state root is not an object"};if("accounts"in $.value&&!O($.value.accounts))return{status:"error",reason:"state accounts is not an object"};return{status:"ready",exists:!0,state:$.value}}function l1($){return Array.isArray($.accounts)?$.accounts:[]}function R9($){let Z=$[p];if(!O(Z))return{};let X=Z[P0];return O(X)?X:{}}function KX($){return O($.accounts)?$.accounts:{}}function qX($){if(!O($))return"not an object";let Z=p1($.id);if(Z)return Z;if($.type==="api")return lZ($.baseURL)?void 0:"invalid baseURL";if($.type==="oauth")return;return"unknown type"}function NX($,Z){if(!O($))return;let X=$.credentialEpoch;if(!$0(X))return;if("needsFirstReading"in $&&typeof $.needsFirstReading!=="boolean")return;if("disabledReason"in $&&typeof $.disabledReason!=="string")return;let J="quota"in $&&Z.decode?Z.decode($.quota):$.quota;if("quota"in $&&!Z.validate(J))return;if("staged"in $&&!P9($.staged))return;return{credentialEpoch:X,needsFirstReading:$.needsFirstReading===!0,...typeof $.disabledReason==="string"?{disabledReason:$.disabledReason}:{},..."quota"in $?{quota:J}:{}}}function MX($,Z){if(!O(Z))return;if($.type==="api"){let J=typeof Z.apiKey==="string"?Z.apiKey.trim():"";if(!J)return;return{type:"api",apiKey:J,baseURL:String($.baseURL).trim(),authHeader:$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer"}}if($.corrupt===!0)return;let X=Z.refresh;if(typeof X!=="string"||!X.trim())return;return{type:"oauth",refresh:X,...typeof Z.access==="string"?{access:Z.access}:{},...typeof Z.expires==="number"?{expires:Z.expires}:{},...typeof Z.lastRefreshedAt==="number"?{lastRefreshedAt:Z.lastRefreshedAt}:{}}}function U6($,Z){return l1($).find((X)=>O(X)&&X.id===Z)}function E9($){if(!O($[p]))$[p]={};return $[p]}function cZ($){let Z=E9($);if(!O(Z[P0]))Z[P0]={};return Z[P0]}function e0($,Z){let X=R9($),J=Object.hasOwn(X,Z)?X[Z]:void 0;return O(J)?J:void 0}function j6($,Z,X){Object.defineProperty(cZ($),Z,{value:X,enumerable:!0,writable:!0,configurable:!0})}function I9($,Z){let X=$[p];if(!O(X))return;let J=X[V6];if(!O(J)||!Object.hasOwn(J,Z))return;let G=J[Z];return $0(G)?G:void 0}function b9($,Z){let X=e0($,Z)?.credentialEpoch;return $0(X)?X:void 0}function D6($,Z){return Math.max(I9($,Z)??0,b9($,Z)??0)+1}function x9($,Z){let X=[...Z];if(X.length===0)return;let J=E9($),G=O(J[V6])?J[V6]:{},z={},B=(Q,Y)=>Object.defineProperty(z,Q,{value:Y,enumerable:!0,writable:!0,configurable:!0});for(let[Q,Y]of Object.entries(G))if($0(Y))B(Q,Y);for(let Q of X)B(Q,Math.max(I9($,Q)??0,b9($,Q)??1));J[V6]=z}function $1($,Z,X,J){let G=R9($),z=KX(Z),B=new Set,Q=[];for(let Y of l1($)){let H=qX(Y),W=O(Y)&&typeof Y.id==="string"?Y.id:void 0,V=W===void 0?void 0:G[W],j=O(V)&&Object.hasOwn(V,"staged"),D=j?P9(V.staged):void 0;if(H||!O(Y)||W===void 0||B.has(W)){if(W!==void 0&&!B.has(W))B.add(W);if(W!==void 0)Q.push({id:W,type:O(Y)&&Y.type==="api"?"api":"oauth",enabled:!1,needsFirstReading:!0,hasEntry:Object.hasOwn(G,W),candidate:!1,invalid:"roster",stamp:"none",...D?{staged:D}:{}});continue}B.add(W);let U=Y.type==="api"?"api":"oauth",N=Object.hasOwn(G,W),K=N?NX(G[W],X):void 0,M=MX(Y,z[W]),P=Y.enabled!==!1,E=K?K.credentialEpoch:N?void 0:1,F=typeof Y.accountId==="string"&&Y.accountId?Y.accountId:void 0,q={id:W,type:U,enabled:P,needsFirstReading:K?K.needsFirstReading:U==="oauth",hasEntry:N,candidate:!1,...typeof Y.label==="string"?{label:Y.label}:{},...typeof Y.addedAt==="number"?{addedAt:Y.addedAt}:{},...F!==void 0?{identity:F}:{},...M?{credential:M,fingerprint:t0(M)}:{},...K?{credentialEpoch:K.credentialEpoch}:{},...D?{staged:D}:{},...K?.disabledReason!==void 0?{disabledReason:K.disabledReason}:{},...K&&"quota"in K?{quota:K.quota}:{},...FX(z[W],M,E,F,J),stamp:DX(M,E,F,z[W])};if(N&&!K)q.invalid="entry";else q.candidate=P&&M!==void 0&&!j;Q.push(q)}return Q}function FX($,Z,X,J,G){if(!O($)||!Object.hasOwn($,Y0))return{};let z=K$($,Z,X,J);if(z===void 0)return{providerStateDropped:"uncovered"};let B=$[Y0];if(!G?.validate(B))return{providerStateDropped:"invalid"};if(u1(G,B)!==z)return{providerStateDropped:"uncovered"};return{providerState:B}}function l($){return $.identity??$.id}function q$($,Z){if($===void 0||$>Z+uZ)return Z;return Math.max(Z,$+1)}function sZ($,Z){return q$($,Z)>Z+uZ}function d1($){let{id:Z,credential:X,identity:J,label:G,addedAt:z}=$;return{id:Z,...G!==void 0?{label:G}:{},type:X.type,addedAt:z,...J!==void 0?{accountId:J}:{},...X.type==="api"?{baseURL:X.baseURL.trim(),authHeader:X.authHeader??"authorization-bearer"}:{}}}function k9($,Z){if($.type==="api")return{apiKey:$.apiKey};return{...$.access!==void 0?{access:$.access}:{},refresh:$.refresh,...$.expires!==void 0?{expires:$.expires}:{},...Z!==void 0?{lastRefreshedAt:Z}:{}}}function y9($,Z){if($.type==="api")return{...$,baseURL:$.baseURL.trim(),authHeader:$.authHeader??"authorization-bearer"};return{...$,...Z!==void 0?{lastRefreshedAt:Z}:{}}}function f9($,Z={}){if(!O($))return"credential must be an object";if($.type==="oauth"){if(typeof $.refresh!=="string"||!$.refresh.trim())return"oauth credential needs a refresh token";return}if($.type==="api"){if(typeof $.apiKey!=="string"||!$.apiKey.trim())return"api credential needs an api key";if($.apiKey.trim()!==$.apiKey)return"api key must not carry surrounding whitespace";if(!(Z.baseURLOptional&&$.baseURL===void 0)&&!lZ($.baseURL))return"api credential needs a valid baseURL";return}return"credential type must be oauth or api"}var K6="transition",g9="transitionMark";function LX($){if(!O($))return;let Z=$[K6];if(!O(Z))return;if(typeof Z.mark!=="string"||Z.mark.length===0)return;if(Z.enabled===!0)return{mark:Z.mark,enabled:!0};if(Z.enabled===!1&&typeof Z.reason==="string")return{mark:Z.mark,enabled:!1,reason:Z.reason};return}function N$($,Z,X){if(X.enabled)V$($,Z);else a0($,Z,X.reason??"");if(!$.rosterRow(Z))return;let J=$.entry(Z)??{credentialEpoch:1,needsFirstReading:!0};if($.setEntry(Z,{...J,[g9]:X.mark}),!X.enabled)return;let G=$.rows().find((z)=>z.id===Z);if(G?.type==="oauth"&&G.identity!==void 0)w1($,G.identity)}function _X($,Z){if($.type!=="api")return $;return{...$,...Z.baseURL!==void 0?{baseURL:Z.baseURL}:{},...Z.authHeader!==void 0?{authHeader:Z.authHeader}:{}}}function OX($){if(!$.binding)return!1;return $.replace===!0||$.dispatch===void 0}function CX($,Z,X,J={}){let G=O(Z.accounts)?Z.accounts:{},z=new Map;for(let B of $1($,Z,X)){if(B.invalid||B.staged||!B.credential)continue;let Q=Object.hasOwn(G,B.id)?G[B.id]:void 0;if(!O(Q))continue;let Y=V0(Q[m]);if(!Y?.binding)continue;if(Y.digest!==x0(B.credential))continue;let H=B.credentialEpoch??1;if(Y.credentialEpoch>H){if(!OX(Y))continue;if(J.requireCredentialStamps){if(Y.dispatch===void 0)continue;if(Y.dispatch!==w0(_X(B.credential,Y.binding)))continue}z.set(B.id,{kind:"replace",stamp:{...Y,binding:Y.binding}})}else if(Y.credentialEpoch===H&&Y.dispatch!==void 0&&Y.dispatch===w0(B.credential)&&Y.binding.identity!==void 0&&B.identity===void 0)z.set(B.id,{kind:"identity",identity:Y.binding.identity});else if(Y.credentialEpoch===H&&Y.binding.identity===B.identity){if(J.requireCredentialStamps&&Y.dispatch!==w0(B.credential))continue;let W=LX(Q[m]);if(W&&e0($,B.id)?.[g9]!==W.mark)z.set(B.id,{kind:"transition",transition:W})}}return z}function iZ($,Z,X,J){let z={...$.entry(Z)??{},credentialEpoch:X,needsFirstReading:!0};if(delete z.quota,J.identity!==void 0&&typeof z.disabledReason==="string"&&z.disabledReason.startsWith(m1))delete z.disabledReason;$.setEntry(Z,z);let B=$.rosterRow(Z);if(!B)return;if(J.identity!==void 0)B.accountId=J.identity;else delete B.accountId;if(J.baseURL!==void 0)B.baseURL=J.baseURL;if(J.authHeader!==void 0)B.authHeader=J.authHeader}function aZ($,Z,X,J={}){let G=CX($,Z,X,J);if(G.size===0)return{config:$,torn:[]};let z=structuredClone($),B={rows:()=>$1(z,Z,X),rosterRow:(Q)=>U6(z,Q),entry:(Q)=>e0(z,Q),setEntry:(Q,Y)=>j6(z,Q,Y)};for(let[Q,Y]of G)if(Y.kind==="replace")iZ(B,Q,Y.stamp.credentialEpoch,Y.stamp.binding);for(let[Q,Y]of G)if(Y.kind==="identity")N1(B,Q,Y.identity);else if(Y.kind==="transition")N$(B,Q,Y.transition);else if(Y.stamp.binding.identity!==void 0)w1(B,Y.stamp.binding.identity);return{config:z,torn:[...G.keys()]}}function nZ($,Z,X,J={}){let{config:G,torn:z}=aZ($,Z,X,J),B=$1(G,Z,X,J.providerState);for(let Q of B){if(z.includes(Q.id))Q.torn=!0,Q.candidate=!1;if(J.requireCredentialStamps&&Q.stamp!=="bound")Q.unbound=!0,Q.candidate=!1}return B}async function rZ($){try{return await M0($,I)}catch(Z){if(Z.code==="ENOENT")return;throw Z}}function h9($){if($===void 0)return{exists:!1};try{return{exists:!0,value:JSON.parse($)}}catch(Z){return{exists:!0,parseError:Z}}}async function H0($){for(let Z=0;Z<3;Z++){let X=await rZ($.configPath),J=await rZ($.statePath),G=await rZ($.configPath);if(X!==G){if(Z<2)await PX(2+Math.floor(Math.random()*4));continue}let z=A9(h9(X));if(z.status==="error")return{status:"error",file:"config",reason:z.reason};let B=S9(h9(J));if(B.status==="error")return{status:"error",file:"state",reason:B.reason};if(z.status==="pending-migration")return{status:"pending-migration",config:z.config};return{status:"ready",configExists:z.exists,stateExists:B.exists,config:z.config,state:B.state,rows:nZ(z.config,B.state,$.codec,{requireCredentialStamps:$.requireCredentialStamps===!0,...$.providerState?{providerState:$.providerState}:{}})}}return{status:"error",file:"config",kind:"snapshot-contended",retryable:!0,reason:"The store was changing; retry the operation once writes settle."}}function T0($,Z,X,J="before-first-write"){if($.status==="error"&&$.kind==="snapshot-contended")return new g({operation:Z,...X!==void 0?{rowId:X}:{},phase:J,kind:"snapshot-contended",retryable:!0,message:$.reason});return new g({operation:Z,...X!==void 0?{rowId:X}:{},phase:J,retryable:!1,kind:$.status==="pending-migration"?"pending-migration":"load-error",message:$.status==="pending-migration"?"the config holds a legacy roster that has not been migrated into the pool":`${$.file} file cannot be loaded: ${$.reason}`})}class v9{ctx;snapshot;locks;progress;info;config;state;constructor($,Z,X,J,G){this.ctx=$,this.snapshot=Z,this.locks=X,this.progress=J,this.info=G,this.config=structuredClone(Z.config),this.state=structuredClone(Z.state)}rows(){return nZ(this.config,this.state,this.ctx.codec,{requireCredentialStamps:this.ctx.requireCredentialStamps===!0,...this.ctx.providerState?{providerState:this.ctx.providerState}:{}})}row($){return this.rows().find((Z)=>Z.id===$)}reservation($){if(this.rosterRow($)){let X=this.entry($);return X&&Object.hasOwn(X,"staged")?X.staged:void 0}let Z=this.stateAccount($)?.[m];return O(Z)&&Object.hasOwn(Z,"staged")?Z.staged:void 0}assertNotStaged($){F1(this.info.operation,$,this.reservation($))}roster(){if(!Array.isArray(this.config.accounts))this.config.accounts=[];return this.config.accounts}rosterRow($){return this.roster(),U6(this.config,$)}dropRosterRows($){let Z=this.roster(),X=Z.filter((J)=>!(O(J)&&J.id===$));return this.config.accounts=X,Z.length-X.length}entries(){return cZ(this.config)}entry($){return this.entries(),e0(this.config,$)}setEntry($,Z){j6(this.config,$,Z)}async completeTorn(){let{config:$,torn:Z}=aZ(this.config,this.state,this.ctx.codec,{requireCredentialStamps:this.ctx.requireCredentialStamps===!0});if(Z.length===0)return;this.config=$,await this.commitConfig({counted:!1})}stateAccount($){let Z=O(this.state.accounts)?this.state.accounts:{},X=Object.hasOwn(Z,$)?Z[$]:void 0;return O(X)?X:void 0}dropStateAccount($){if(O(this.state.accounts)&&Object.hasOwn(this.state.accounts,$))delete this.state.accounts[$]}setStateAccount($,Z){if(!O(this.state.accounts))this.state.accounts={};Object.defineProperty(this.state.accounts,$,{value:Z,enumerable:!0,writable:!0,configurable:!0})}async commitConfig($={}){let Z=this.roster(),X=new Set;for(let Y of Z)if(O(Y)&&typeof Y.id==="string")X.add(Y.id);let J=new Set;for(let Y of l1(this.snapshot.config))if(O(Y)&&typeof Y.id==="string"&&!X.has(Y.id))J.add(Y.id);for(let Y of Object.keys(this.entries()))if(!X.has(Y))J.add(Y);x9(this.config,J);let G=this.entries(),z={};for(let[Y,H]of Object.entries(G))if(X.has(Y))Object.defineProperty(z,Y,{value:H,enumerable:!0,writable:!0,configurable:!0});let B=this.config[p],Q={...this.config,version:D$,accounts:Z,[p]:{...B,schemaVersion:o0,[P0]:z}};await this.write(this.ctx.configPath,Q,"config",$.counted??!0,$.durable??!1,()=>{if($.publicationDecision)this.markPublicationDecision();for(let Y of J)this.ctx.removedIds.add(Y);this.config=Q}),this.config=Q}async commitState($,Z={}){let X={...this.state,version:D$,accounts:O(this.state.accounts)?this.state.accounts:{}};if(await this.write(this.ctx.statePath,X,"state",!0,Z.durable??!1),this.state=X,$)this.progress.committed=$}async assertAll(){await this.locks.assertAll()}async syncState(){await this.assertAll();try{if(this.snapshot.stateExists)await gZ(this.ctx.statePath)}catch($){throw new g({operation:this.info.operation,rowId:this.info.rowId,phase:"before-first-write",kind:"publication-sync",retryable:!0,message:"Publication sync failed before the decision; nothing was written. Retry the same plan.",cause:$})}}markPublicationDecision(){this.progress.publicationDecided=!0}async syncConfig(){await this.assertAll(),await gZ(this.ctx.configPath)}async write($,Z,X,J=!0,G=!1,z){await fZ($,Z,{durable:G,beforeRename:async()=>{await this.ctx.onStep?.(`before-${X}-write`,this.info),await this.locks.assertAll()}},()=>{if(J)this.progress.writes++;z?.()}),await this.ctx.onStep?.(`after-${X}-write`,this.info)}}async function m9($,Z){let X=new r0($.lockDefaults,$.lockEnv),J={writes:0};try{for(let Q of $.storeLocks)await X.acquire(Q);let G=await H0($);if(G.status==="error")throw T0(G,"initialize",void 0);if(G.status==="ready")return"already-ready";let z={};for(let[Q,Y]of Object.entries(G.config))if(!Z.includes(Q))z[Q]=Y;z.version=D$,z[p]={schemaVersion:o0,[P0]:{}};let B={operation:"initialize",rowId:void 0};return await F0($.configPath,z,{beforeRename:async()=>{await $.onStep?.("before-config-write",B),await X.assertAll()}}),J.writes++,await $.onStep?.("after-config-write",B),"initialized"}catch(G){throw c1(G,"initialize",void 0,J)}finally{await X.releaseAll()}}async function n($,Z,X,J,G,z={}){let B=Z.held.length;try{for(let H of $.storeLocks)await Z.acquire(H);let Q=await H0($);if(Q.status!=="ready")throw T0(Q,J.operation,J.rowId,X.writes>0?"after-first-write":"before-first-write");let Y=new v9($,Q,Z,X,J);if(J.rowId!==void 0&&!["add","remove","pull","publishRoster","enable","disable"].includes(J.operation))Y.assertNotStaged(J.rowId);if(z.completeTorn??!0)await Y.completeTorn();return await G(Y)}finally{await Z.releaseTo(B)}}function c1($,Z,X,J){let G=Z==="pull"?"pull":J.writes>0?"after-first-write":"before-first-write",z=G==="after-first-write"?J.committed:void 0;if(Z==="publishRoster"&&J.publicationDecided)return new g({operation:Z,...X!==void 0?{rowId:X}:{},phase:G,kind:"publication-incomplete",retryable:!0,message:"The publication may already be decided. Replay the same plan or check publication(operationId).",cause:$});if(Z==="publishRoster"&&$ instanceof U$)return new g({operation:Z,...X!==void 0?{rowId:X}:{},phase:G,kind:"publication-sync",retryable:!0,message:"Publication sync failed before the decision; nothing was written. Retry the same plan.",cause:$});if($ instanceof g){if($.phase===G&&$.rowId===X&&$.operation===Z&&$.committed===z)return $;return new g({operation:Z,...X!==void 0?{rowId:X}:{},phase:$.kind==="after-persist-hook"?$.phase:G,retryable:$.retryable,kind:$.kind,...$.committed??z?{committed:$.committed??z}:{},message:$.message,...$.cause!==void 0?{cause:$.cause}:{}})}let B={operation:Z,...X!==void 0?{rowId:X}:{},phase:G,...z?{committed:z}:{},cause:$};if($ instanceof n0)return new g({...B,retryable:!0,kind:"lock-ownership",message:G==="after-first-write"?`${Z} lost a lease after its first write; the intermediate stays on disk`:`${Z} lost a lease before writing; nothing was written`});if($ instanceof M1)return new g({...B,retryable:!0,kind:"lock-contention",message:$.message});return new g({...B,retryable:!1,kind:"unexpected",message:$ instanceof Error?$.message:String($)})}async function z0($,Z,X,J,G){let z=new r0($.lockDefaults,$.lockEnv),B={writes:0};try{return await G(z,B)}catch(Q){let Y=c1(Q,Z,X,B);if(Y.kind!=="after-persist-hook")await C9(Z,J,X,Y,$.logger);throw Y}finally{await z.releaseAll()}}function q0($,Z){return{...$.rowLockOptions,name:`row-${encodeURIComponent(l(Z))}`,path:$.ctx.statePath}}async function p0($,Z,X){let J=await H0($.ctx);if(J.status!=="ready")throw T0(J,Z,X);let G=J.rows.find((H)=>H.id===X),z=e0(J.config,X),B=J.state.accounts,Q=O(B)&&Object.hasOwn(B,X)?B[X]:void 0,Y=O(Q)?Q[m]:void 0;if(G&&!["enable","disable"].includes(Z)&&z&&Object.hasOwn(z,"staged"))F1(Z,X,z.staged);if(!G&&O(Y)&&Object.hasOwn(Y,"staged"))F1(Z,X,Y.staged);if(!G)throw A0(Z,X);return{result:J,row:G}}function A0($,Z){return new g({operation:$,rowId:Z,phase:$==="pull"?"pull":"before-first-write",retryable:!1,kind:"unknown-row",message:`no row ${Z} in the pool`})}function W0($,Z){if(Z.unbound)throw _($,Z.id,"unbound-credential",`row ${Z.id}'s credential is not the one this store stamped for it (stamp ${Z.stamp}); replace it with fresh material`)}function _($,Z,X,J,G=!1){return new g({operation:$,rowId:Z,phase:$==="pull"?"pull":"before-first-write",retryable:G,kind:X,message:J})}async function q6($,Z,X,J){let{ctx:G}=$,z=new r0(G.lockDefaults,G.lockEnv),B={writes:0};try{if(!$0(X?.credentialEpoch))throw _("pull",Z,"invalid-input","the credential epoch the reading was issued for must be a positive safe integer");await n(G,z,B,{operation:"pull",rowId:Z},async(Q)=>{Q.assertNotStaged(Z);let Y=Q.row(Z);if(!Y)throw A0("pull",Z);if(Y.invalid)throw _("pull",Z,"invalid-row",`row ${Z} is invalid`);if(!Y.credential)throw _("pull",Z,"no-credential",`row ${Z} holds no credential`);W0("pull",Y);let H=Q.entry(Z);if(Y.torn||!H||H.credentialEpoch!==X.credentialEpoch||Y.identity!==X.identity)throw new g({operation:"pull",rowId:Z,phase:"pull",retryable:!0,kind:"attribution",message:`quota for ${Z} was issued for a credential the row no longer holds`});let W=G.codec.merge(H.quota,J);if(!G.codec.validate(W))throw _("pull",Z,"invalid-quota","the quota codec rejected the merged map");Q.setEntry(Z,{...H,quota:W,needsFirstReading:!1}),await Q.commitConfig()},{completeTorn:!1})}catch(Q){throw c1(Q,"pull",Z,B)}finally{await z.releaseAll()}}function u0($,Z,X,J,G="the provider state"){if(!$)throw _(Z,X,"invalid-input","the store was opened without a provider-state codec");let z;try{let B=JSON.stringify(J);z=B===void 0?void 0:JSON.parse(B)}catch{z=void 0}if(z===void 0)throw _(Z,X,"invalid-provider-state",`${G} cannot be stored as JSON`);if(!$.validate(z))throw _(Z,X,"invalid-provider-state",`the provider-state codec rejected ${G}`);return z}function M$($,Z,X,J,G){if(J===void 0||!$?.merge)return{kind:"set",value:G};return{kind:"set",value:u0($,Z,X,$.merge(structuredClone(J),structuredClone(G)),"the merged provider state")}}function w9($,Z,X,J,G){let z=$?.onReplace,B=z?z(Z.providerState===void 0?void 0:structuredClone(Z.providerState),{id:Z.id,credentialEpoch:X,...Z.identity!==void 0?{previousIdentity:Z.identity}:{},...J!==void 0?{identity:J}:{},...G!==void 0?{incoming:structuredClone(G)}:{}}):G;if(B===void 0)return{kind:"clear"};if(!z)return{kind:"set",value:B};return{kind:"set",value:u0($,"replace",Z.id,B,"the provider state onReplace returned")}}function p9($,Z,X,J,G){if(Z.kind==="set")return u1($,Z.value);if(Z.kind==="clear")return;return K$(X,J?.credential,G,J?.identity)}async function u9($,Z,X,J,G={}){G0("updateProviderState");let{ctx:z}=$,B="updateProviderState";return z0(z,B,Z,G.onFailure,async(Q,Y)=>{let H=z.providerState;if(!H)throw _(B,Z,"invalid-input","the store was opened without a provider-state codec");if(typeof J!=="function")throw _(B,Z,"invalid-input","a mutator is required");let W=O(X)?X.credentialEpoch:void 0;if(!$0(W))throw _(B,Z,"invalid-input","the credential epoch the provider state was read at is required");let{row:V}=await p0($,B,Z);await Q.acquire(q0($,V));for(let j of G.extraLocks??[])await Q.acquire(j);return n(z,Q,Y,{operation:B,rowId:Z},async(j)=>{let D=j.row(Z);if(!D)throw A0(B,Z);if(l(D)!==l(V))throw _(B,Z,"row-key-changed",`row ${Z}'s wire identity changed while its lock was being taken`,!0);if(D.invalid)throw _(B,Z,"invalid-row",`row ${Z} failed validation`);if(!D.credential)throw _(B,Z,"no-credential",`row ${Z} holds no credential`);if(W0(B,D),(D.credentialEpoch??1)!==W||D.identity!==X.identity)throw _(B,Z,"attribution",`the provider state for ${Z} was read for a credential or account the row no longer holds`,!0);let N=await oZ(j,H,B,D,J);if(N.kind!=="changed")return{id:Z,outcome:"unchanged",...N.kind==="unchanged"&&N.value!==void 0?{providerState:N.value}:{}};return j.setStateAccount(Z,N.account),await j.commitState(),N.value===void 0?{id:Z,outcome:"cleared"}:{id:Z,outcome:"updated",providerState:N.value}})})}var l9=Symbol.for("@cortexkit/common-auth/store/decline-transition");async function oZ($,Z,X,J,G,z=!1){let{id:B,credential:Q}=J;if(!Q)throw _(X,B,"no-credential",`row ${B} holds no credential`);let Y=J.credentialEpoch??1,H=$.stateAccount(B),W=H?.[m],V=V0(W);if(!O(W)||!V?.binding||V.digest!==x0(Q)||V.credentialEpoch!==Y||V.binding.identity!==J.identity)throw _(X,B,"unbound-credential",`row ${B}'s credential carries no stamp of this store to bind a provider state to (stamp ${J.stamp}); rotate or replace it first`);let j=J.providerState===void 0?void 0:structuredClone(J.providerState),D=await b0(X,()=>G(j,J));if(z&&D===l9)return{kind:"declined"};let U=D===void 0?void 0:u0(Z,X,B,D,"the provider state the mutator returned"),N=H!==void 0&&Object.hasOwn(H,Y0);if(U===void 0?!N:J.providerState!==void 0&&JSON.stringify(J.providerState)===JSON.stringify(U))return{kind:"unchanged",...U!==void 0?{value:U}:{}};let K={...H};if(U===void 0){delete K[Y0];let M={...W};delete M.providerState,K[m]=M}else{K[Y0]=U;let M=u1(Z,U);if(V.providerState!==M)K[m]={...W,providerState:M}}return{kind:"changed",...U!==void 0?{value:U}:{},account:K}}import{randomUUID as d9}from"node:crypto";async function L6($,Z,X){if(!X)return;let J=$.rows().map((z)=>{let{id:B,type:Q,label:Y,enabled:H,disabledReason:W,identity:V,credentialEpoch:j,stamp:D,staged:U,torn:N,invalid:K}=z;return{id:B,type:Q,label:Y,enabled:H,disabledReason:W,identity:V,credentialEpoch:j,stamp:D,staged:U,torn:N,invalid:K}}),G=await b0($.info.operation,()=>X({id:Z,row:J.find((z)=>z.id===Z),rows:J,config:structuredClone($.snapshot.config)}));if(G!==void 0)throw _($.info.operation,Z,"row-protected",G)}var TX=["access","refresh","expires","lastRefreshedAt","apiKey"];function AX($){return{baseURL:String($.baseURL).trim(),authHeader:$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer"}}function SX($,Z,X){if(X.type!=="api")return X;let J=$.rosterRow(Z);if(!O(J)){if(X.baseURL===void 0)throw _($.info.operation,Z,"invalid-input","api credential needs a valid baseURL");return{...X,baseURL:X.baseURL}}let G=$.row(Z)?.credential,z=G?.type==="api"?{baseURL:G.baseURL.trim(),authHeader:G.authHeader??"authorization-bearer"}:AX(J),B=X.baseURL?.trim()??z.baseURL,Q=X.authHeader??z.authHeader;if(B!==z.baseURL||Q!==z.authHeader)throw _($.info.operation,Z,"endpoint-mismatch",`row ${Z} sends its key to another endpoint or header; a key for another endpoint is a replacement`);return{...X,baseURL:B,authHeader:Q}}function c9($,Z,X,J){let G=$.rosterRow(Z),z=$.row(Z),B=J??(z?z.identity:O(G)&&typeof G.accountId==="string"&&G.accountId?G.accountId:void 0);return{...B!==void 0?{identity:B}:{},...X.type==="api"?{baseURL:X.baseURL,authHeader:X.authHeader??"authorization-bearer"}:{}}}function N6($,Z,X,J,G={}){let z=SX(Z,X,J),B=Z.stateAccount(X),Q=G.providerState??{kind:"keep"},Y=Z.row(X)?.credentialEpoch??Z.entry(X)?.credentialEpoch,H=typeof Y==="number"?Y:1,W=p9($.ctx.providerState,Q,B,B&&Object.hasOwn(B,Y0)?Z.row(X):void 0,H),V=typeof B?.lastRefreshedAt==="number"?B.lastRefreshedAt:void 0,j=z.type==="oauth"?G.stamp??q$(V,$.ctx.now()):void 0,D={...B??{}};for(let K of TX)delete D[K];if(G.clearErrors)delete D.lastRefreshError,delete D.lastQuotaRefreshError,delete D.quota;if(Q.kind==="clear")delete D[Y0];else if(Q.kind==="set")D[Y0]=Q.value;let U=y9(z,j),N={...D,...k9(z,j),[m]:{...G.staged?{staged:G.staged}:{},...G.transition!==void 0?{[K6]:G.transition}:{},...dZ(U,H,G.binding??c9(Z,X,U,G.identity),{replace:G.binding!==void 0,...W!==void 0?{providerState:W}:{}})}};return{stored:U,account:N}}async function M6($,Z,X){return $.setStateAccount(Z,X.account),await $.commitState(X.stored),X.stored}async function _6($,Z,X,J,G={}){return M6(Z,X,N6($,Z,X,J,G))}async function RX($,Z,X){if(!Z.credential||Z.stamp!=="bound")return;let J=$.stateAccount(Z.id),G=K$(J,Z.credential,Z.credentialEpoch??1,Z.identity);$.setStateAccount(Z.id,{...J??{},[m]:dZ(Z.credential,Z.credentialEpoch??1,c9($,Z.id,Z.credential,X),G!==void 0?{providerState:G}:{})}),await $.commitState()}function eZ($,Z,X){let J=$==="add"?p1(Z):void 0;if(J)throw _($,Z,"invalid-input",J);let G=f9(X,{baseURLOptional:$==="rotate"});if(G)throw _($,Z,"invalid-input",G)}function O6($,Z,X,J){if(!X)throw A0($,Z);if(X.invalid)throw _($,Z,"invalid-row",`row ${Z} failed validation`);if(J&&J.type!==X.type)throw _($,Z,"type-mismatch",`row ${Z} holds a ${X.type} credential`);return X}function i1($,Z,X){if(X!==void 0&&!$0(O(X)?X.credentialEpoch:void 0))throw _($,Z,"invalid-input","the attribution must name a credential epoch that is a positive safe integer")}function C6($,Z,X,J){if(!X)throw A0($,Z);if(X.invalid)throw _($,Z,"invalid-row",`row ${Z} failed validation`);if((X.credentialEpoch??1)!==J.credentialEpoch||X.identity!==J.identity)throw _($,Z,"attribution",`the ${$} of ${Z} was issued for a credential or account the row no longer holds`,!0)}function F6($,Z){return _($,Z,"identity-mismatch",`row ${Z} is recorded for another account; a credential of a different account is a replacement`)}function F$($,Z){return _($,Z,"row-key-changed",`row ${Z}'s wire identity changed while its lock was being taken`,!0)}function EX($,Z,X,J){let{id:G,credential:z,identity:B}=X;if(!$.ctx.requireCredentialStamps||Z.rosterRow(G)||!s1(Z.state,G))return;let Q=()=>{throw _("add",G,"unbound-credential",`orphan ${G} cannot be bound to this add's material; remove it explicitly before adding different material`)},Y=Z.stateAccount(G),H=V0(Y?.[m]);if(!H?.binding||H.dispatch===void 0||H.replace)return Q();if(z.type==="api"&&(H.binding.baseURL===void 0||H.binding.authHeader===void 0))return Q();let W=z.type==="api"?{...z,baseURL:H.binding.baseURL,authHeader:H.binding.authHeader}:z,[V]=$1({accounts:[d1({id:G,credential:W,identity:H.binding.identity,addedAt:0})],[p]:{rows:{[G]:{credentialEpoch:D6(Z.config,G)}}}},Z.state,$.ctx.codec,$.ctx.providerState);if(!V?.credential||V.invalid||V.stamp!=="bound")return Q();if(B!==void 0&&B!==V.identity)return Q();if(x0(z)!==H.digest)return Q();if(z.type==="api"){if(z.baseURL.trim()!==H.binding.baseURL)return Q();if((z.authHeader??"authorization-bearer")!==H.binding.authHeader)return Q()}else if(w0(z)!==H.dispatch)return Q();if(H.providerState!==void 0&&V.providerState===void 0)return Q();if(J!==void 0&&u1($.ctx.providerState,J)!==H.providerState)return Q();return V}function IX($,Z,X,J){let{id:G,credential:z,identity:B,label:Q}=X,Y=Z.rosterRow(G),H=()=>{throw _("add",G,Y?"id-exists":"unbound-credential",`row ${G} does not match this staged add`)},W=Z.stateAccount(G),V=V0(W?.[m]),j=V?.staged;if(!V?.binding||!j||V.replace||V.dispatch===void 0)return H();if(Y&&(Y.type!==z.type||Y.label!==Q||Y.accountId!==B))return H();if(j.reservation!==X.stage?.reservation||j.label!==Q||j.disabledReason!==X.disabled?.reason||V.binding.identity!==B)return H();let D=J===void 0?void 0:L1(J),U=W?.[Y0],N=U===void 0?void 0:L1(U);if(j.providerState!==D||j.providerState!==N)return H();if(x0(z)!==V.digest||w0(z)!==V.dispatch)return H();let K=Y?Z.config:{accounts:[{...d1({id:G,credential:z.type==="api"?{...z,baseURL:V.binding.baseURL??"",authHeader:V.binding.authHeader}:z,identity:V.binding.identity,label:j.label,addedAt:0}),enabled:!1}],[p]:{rows:{[G]:{credentialEpoch:V.credentialEpoch,disabledReason:j.disabledReason,staged:{reservation:j.reservation}}}}},M=$1(K,Z.state,$.ctx.codec,$.ctx.providerState).find((P)=>P.id===G);if(!M?.credential||M.invalid||M.stamp!=="bound"||M.type!==z.type||M.enabled||M.label!==j.label||M.identity!==V.binding.identity||M.disabledReason!==j.disabledReason||M.staged?.reservation!==j.reservation)return H();if(Y)return{id:G,outcome:"exists",credential:M.credential,credentialEpoch:V.credentialEpoch};if(D6(Z.config,G)!==V.credentialEpoch)return H();return Z.roster().push({...d1({id:G,credential:z,identity:B,label:Q,addedAt:$.ctx.now()}),enabled:!1}),Z.setEntry(G,{credentialEpoch:V.credentialEpoch,needsFirstReading:z.type==="oauth",disabledReason:j.disabledReason,staged:{reservation:j.reservation}}),Z.commitConfig().then(()=>({id:G,outcome:"completed",credential:M.credential,credentialEpoch:V.credentialEpoch}))}async function s9($,Z,X={}){G0("add");let{ctx:J}=$,{id:G,credential:z,identity:B,label:Q}=Z,Y=Z.stage!==void 0||Z.disabled!==void 0,H=await z0(J,"add",G,X.onFailure,async(W,V)=>{eZ("add",G,z);let j=X.onExisting??"rotate";if(Z.stage!==void 0&&j==="rotate")throw _("add",G,"invalid-input","a staged add needs onExisting: 'refuse' or 'stage-duplicate'");if(!["rotate","refuse","stage-duplicate"].includes(j)||Z.stage!==void 0&&(Q!==void 0&&typeof Q!=="string"||B!==void 0&&(typeof B!=="string"||!B))||Z.disabled!==void 0&&(!O(Z.disabled)||typeof Z.disabled.reason!=="string")||Z.stage!==void 0&&(!O(Z.stage)||typeof Z.stage.reservation!=="string"||!Z.stage.reservation||!Z.disabled)||j==="stage-duplicate"&&(!Z.disabled||!Z.stage))throw _("add",G,"invalid-input","staging requires a reservation and a disabled reason");let D=Z.providerState===void 0?void 0:u0(J.providerState,"add",G,Z.providerState);if(await W.acquire(q0($,{id:G,identity:B})),z.type==="oauth")await W.acquire(X.providerLock??$.providerLock);for(let U of X.extraLocks??[])await W.acquire(U);return n(J,W,V,{operation:"add",rowId:G},async(U)=>{await L6(U,G,X.protect);let N=O(U.state.accounts)?U.state.accounts:{},K=Object.entries(N).find(([y,f])=>{if(y===G||U.rosterRow(y)||!O(f))return!1;let h=f[m];if(!O(h)||!Object.hasOwn(h,"staged"))return!1;return z.type==="oauth"?f.refresh===z.refresh:typeof f.apiKey==="string"&&f.apiKey.trim()===z.apiKey.trim()});if(K)throw _("add",K[0],"row-staged",`orphan ${K[0]} reserves this secret until its staged add is replayed or removed`);if(J.removedIds.has(G))throw _("add",G,"id-removed",`id ${G} was removed from the roster in this process and is not reused`);if(Z.stage&&j!=="rotate"&&(U.rosterRow(G)||s1(U.state,G)))return IX($,U,Z,D);if(j==="rotate"){U.assertNotStaged(G);let y=U.rows().find((f)=>f.fingerprint===t0(z));if(y)U.assertNotStaged(y.id)}if(j==="refuse"){let y=U.rows().find((c)=>c.fingerprint===t0(z)||c.id===G&&c.credential),f=O(U.state.accounts)?U.state.accounts:{},h=Object.entries(f).find(([,c])=>{if(!O(c))return!1;if(z.type==="oauth")return c.refresh===z.refresh;return typeof c.apiKey==="string"&&c.apiKey.trim()===z.apiKey.trim()})?.[0],r=y?.id??h??G;if(y||h!==void 0||s1(U.state,G))throw _("add",r,"credential-exists",`row ${r} already holds this secret or id`)}if(j==="stage-duplicate"&&(U.rosterRow(G)||s1(U.state,G)))throw _("add",G,"id-exists",`row ${G} already exists`);let M=EX($,U,Z,D),P=U.rows(),E=t0(z),F=j==="rotate"&&!M&&P.find((y)=>y.invalid===void 0&&y.fingerprint===E);if(F){if(U.assertNotStaged(F.id),W0("add",F),B!==void 0&&F.identity!==void 0&&B!==F.identity)throw F6("add",F.id);let y=N6($,U,F.id,z,{...D!==void 0?{providerState:M$(J.providerState,"add",F.id,F.providerState,D)}:{}});await U.completeTorn(),U.assertNotStaged(F.id);let f=await M6(U,F.id,y);return{id:F.id,outcome:"rotated",credential:f,credentialEpoch:F.credentialEpoch??1}}let q=P.find((y)=>y.id===G);if(q){if(q.invalid)throw _("add",G,"invalid-row",`row ${G} is invalid`);if(q.credential)throw _("add",G,"id-exists",`row ${G} already holds a credential`);if(W0("add",q),q.type!==z.type)throw _("add",G,"type-mismatch",`row ${G} is a ${q.type} row`);if(B!==void 0&&q.identity!==void 0&&B!==q.identity)throw F6("add",G);if(!q.hasEntry)U.setEntry(G,{credentialEpoch:1,needsFirstReading:z.type==="oauth"});let y=N6($,U,G,z,{clearErrors:!0,...D!==void 0?{providerState:{kind:"set",value:D}}:{}});await U.completeTorn();let f=await M6(U,G,y);if(!q.hasEntry)await U.commitConfig();return{id:G,outcome:"completed",credential:f,credentialEpoch:q.credentialEpoch??1}}let L=D6(U.config,G);if(!$0(L))throw _("add",G,"id-removed",`id ${G} has held every credential epoch and is not reused; add the credential under another id`);let S=M?.identity??B;U.roster().push(d1({id:G,credential:z,...S!==void 0?{identity:S}:{},...Q!==void 0?{label:Q}:{},addedAt:J.now()})),U.setEntry(G,{credentialEpoch:L,needsFirstReading:z.type==="oauth",...Z.stage?{staged:{reservation:Z.stage.reservation}}:{}});let A="added";if(Z.disabled)a0(U,G,Z.disabled.reason),A="added-disabled";if(!Z.disabled&&S!==void 0&&z.type==="oauth"){if(P.find((f)=>f.invalid===void 0&&f.type==="oauth"&&f.enabled&&f.identity===S))a0(U,G,kZ),A="added-disabled"}if(M?.credential)return await U.commitConfig(),{id:G,outcome:A,credential:M.credential,credentialEpoch:M.credentialEpoch??L};U.dropStateAccount(G);let x=N6($,U,G,z,{...Z.stage&&Z.disabled?{staged:{reservation:Z.stage.reservation,disabledReason:Z.disabled.reason,...Q!==void 0?{label:Q}:{},...D!==void 0?{providerState:L1(D)}:{}}}:{},...D!==void 0?{providerState:{kind:"set",value:D}}:{}});if(j==="rotate")await U.completeTorn();let w=await M6(U,G,x);return await U.commitConfig(),{id:G,outcome:A,credential:w,credentialEpoch:L}},{completeTorn:!1})});if(!Y&&z.type==="oauth"&&(H.outcome==="added"||H.outcome==="completed"))$.firePull(H.id,"add");return H}async function i9($,Z,X,J={},G={}){G0("replace");let{ctx:z}=$,B=await z0(z,"replace",Z,G.onFailure,async(Q,Y)=>{eZ("replace",Z,X),i1("replace",Z,G.attribution);let H=J.providerState===void 0?void 0:u0(z.providerState,"replace",Z,J.providerState),{row:W}=await p0($,"replace",Z);if(await Q.acquire(q0($,W)),X.type==="oauth")await Q.acquire(G.providerLock??$.providerLock);for(let V of G.extraLocks??[])await Q.acquire(V);return n(z,Q,Y,{operation:"replace",rowId:Z},async(V)=>{if(G.attribution!==void 0)C6("replace",Z,V.row(Z),G.attribution),await V.completeTorn();let j=O6("replace",Z,V.row(Z),X);if(l(j)!==l(W))throw F$("replace",Z);let D=V.entry(Z)?.credentialEpoch,U=(typeof D==="number"?D:1)+1;if(!$0(U))throw _("replace",Z,"invalid-row",`row ${Z}'s credential epoch cannot advance past ${Number.MAX_SAFE_INTEGER}; remove the row and add the new credential as a new row`);let N=w9(z.providerState,j,U,J.identity,H),K={...J.identity!==void 0?{identity:J.identity}:{},...X.type==="api"?{baseURL:X.baseURL.trim(),authHeader:X.authHeader??"authorization-bearer"}:{}};if(iZ(V,Z,U,K),J.identity!==void 0)w1(V,J.identity);let M=await _6($,V,Z,X,{clearErrors:!0,binding:K,providerState:N});return await V.commitConfig(),{id:Z,credential:M,credentialEpoch:U}},{completeTorn:G.attribution===void 0})});if(X.type==="oauth")$.firePull(Z,"replace");return B}async function a9($,Z,X,J={},G={}){G0("rotate");let{ctx:z}=$;return z0(z,"rotate",Z,G.onFailure,async(B,Q)=>{eZ("rotate",Z,X),i1("rotate",Z,G.attribution);let Y=J.providerState===void 0?void 0:u0(z.providerState,"rotate",Z,J.providerState),{row:H}=await p0($,"rotate",Z);if(await B.acquire(q0($,H)),J.identity!==void 0&&X.type==="oauth")await B.acquire(G.providerLock??$.providerLock);for(let W of G.extraLocks??[])await B.acquire(W);return n(z,B,Q,{operation:"rotate",rowId:Z},async(W)=>{if(G.attribution!==void 0)C6("rotate",Z,W.row(Z),G.attribution),await W.completeTorn();let V=O6("rotate",Z,W.row(Z),X);if(l(V)!==l(H))throw F$("rotate",Z);if(W0("rotate",V),J.identity!==void 0&&V.identity!==void 0&&J.identity!==V.identity)throw F6("rotate",Z);let j=J.identity!==void 0&&V.identity===void 0?J.identity:void 0,D=await _6($,W,Z,X,{identity:j,...Y!==void 0?{providerState:M$(z.providerState,"rotate",Z,V.providerState,Y)}:{}}),U=!1;if(!V.hasEntry)W.setEntry(Z,{credentialEpoch:1,needsFirstReading:V.type==="oauth"}),U=!0;if(J.identity!==void 0&&V.identity!==J.identity)N1(W,Z,J.identity),U=!0;if(U)await W.commitConfig();return{id:Z,credential:D}},{completeTorn:G.attribution===void 0})})}async function n9($,Z,X,J,G){G0(Z);let{ctx:z}=$,B=z.providerState,Q=G.attribution,Y=G.providerState;return z0(z,Z,X,G.onFailure,async(H,W)=>{if(i1(Z,X,Q),Y!==void 0){if(typeof Y!=="function")throw _(Z,X,"invalid-input","the provider-state mutator must be a function");if(Q===void 0)throw _(Z,X,"invalid-input","a provider-state change needs the attribution of the credential it is for");if(!B)throw _(Z,X,"invalid-input","the store was opened without a provider-state codec")}let{row:V}=await p0($,Z,X);await H.acquire(q0($,V));for(let j of G.extraLocks??[])await H.acquire(j);return n(z,H,W,{operation:Z,rowId:X},async(j)=>{await L6(j,X,G.protect),j.assertNotStaged(X);let D=j.row(X),U=J.enabled?O6("enable",X,D):D;if(!U||!j.rosterRow(X))throw A0(Z,X);if(l(U)!==l(V))throw F$(Z,X);if(Q!==void 0)C6(Z,X,U,Q);if(J.enabled&&U.disabledReason?.startsWith(m1))throw _("enable",X,"identity-contradicted",`row ${X} needs an identity-validated credential replacement before it can be enabled`);let N=!J.enabled||!U.enabled||U.disabledReason!==void 0;if(J.enabled&&N&&U.type==="oauth"){let F=U.identity===void 0?void 0:j.rows().find((q)=>q.id!==X&&q.invalid===void 0&&q.type==="oauth"&&q.enabled&&q.identity===U.identity);if(F)throw _("enable",X,"duplicate-identity",`row ${F.id} is enabled with the same identity as row ${X}`)}if(Y===void 0||B===void 0){if(await j.completeTorn(),!N)return{id:X};if(J.enabled)V$(j,X);else a0(j,X,J.reason);return await j.commitConfig(),{id:X}}if(!U.credential)throw _(Z,X,"no-credential",`row ${X} holds no credential`);W0(Z,U);let K=await oZ(j,B,Z,U,Y,!0);if(K.kind==="declined")return{id:X,declined:!0};await j.completeTorn();let M={id:X,providerStateOutcome:K.kind==="unchanged"?"unchanged":K.value===void 0?"cleared":"updated",...K.value!==void 0?{providerState:K.value}:{}};if(K.kind==="unchanged"){if(N){if(J.enabled)V$(j,X);else a0(j,X,J.reason);await j.commitConfig()}return M}if(!N)return j.setStateAccount(X,K.account),await j.commitState(),M;let P=J.enabled?{mark:d9(),enabled:!0}:{mark:d9(),enabled:!1,reason:J.reason},E=K.account[m];return j.setStateAccount(X,{...K.account,[m]:{...E,[K6]:P}}),await j.commitState(),N$(j,X,P),await j.commitConfig(),M},{completeTorn:!1})})}function r9($,Z,X,J={}){return n9($,"disable",Z,{enabled:!1,reason:X},J)}function o9($,Z,X={}){return n9($,"enable",Z,{enabled:!0},X)}async function t9($,Z,X={}){G0("remove");let{ctx:J}=$;return z0(J,"remove",Z,X.onFailure,async(G,z)=>{if(typeof Z!=="string"||Z.length===0)throw _("remove",Z,"invalid-input","id must be non-empty");let B=X.attribution;if(i1("remove",Z,B),X.staged!==void 0&&(!O(X.staged)||typeof X.staged.reservation!=="string"||!X.staged.reservation))throw _("remove",Z,"invalid-input","a staged removal needs a reservation");let Q=await H0(J);if(Q.status!=="ready")throw T0(Q,"remove",Z);let Y=Q.rows.find((W)=>W.id===Z);if(!Y&&!s1(Q.state,Z))throw A0("remove",Z);let H=l(Y??{id:Z});await G.acquire(q0($,Y??{id:Z}));for(let W of X.extraLocks??[])await G.acquire(W);return n(J,G,z,{operation:"remove",rowId:Z},async(W)=>{let V=W.reservation(Z);if(V!==void 0){if(!O(V)||!X.staged||V.reservation!==X.staged.reservation)throw _("remove",Z,"row-staged",`row ${Z} is reserved for roster publication`)}else if(X.staged)throw _("remove",Z,"attribution",`row ${Z} is no longer reserved`);let j=W.row(Z),D=s1(W.state,Z);if(!j&&!D)throw A0("remove",Z);if(l(j??{id:Z})!==H)throw F$("remove",Z);if(B!==void 0)if(j)P6(Z,j,B);else bX($,W,Z,B);let U=X.protect;if(U){let N={row:j,config:W.snapshot.config,state:W.snapshot.state},K=await b0("remove",()=>U(Z,N));if(K!==void 0)throw _("remove",Z,"row-protected",K)}if(j){if(B===void 0)await W.completeTorn();W.dropRosterRows(Z),await W.commitConfig()}if(D)W.dropStateAccount(Z),await W.commitState();return{id:Z,outcome:j?"removed":"completed"}},{completeTorn:!1})})}function P6($,Z,X,J="remove"){if(C6(J,$,Z,X),Z.torn)throw _(J,$,"attribution",`row ${$} is between the writes of another operation; retry once it completes`,!0);if(Z.stamp!=="bound")throw _(J,$,"unbound-credential",`row ${$}'s credential is not bound to its stamp, so the removal cannot be attributed to it`)}function bX($,Z,X,J){let G=()=>_("remove",X,"unbound-credential",`orphan ${X} has no credential stamp this store can bind, so the removal cannot be attributed to it`),z=Z.stateAccount(X),B=V0(z?.[m]);if(!z||!B?.binding||B.dispatch===void 0||B.replace)throw G();let Q;if(typeof z.apiKey==="string"){if(B.binding.baseURL===void 0||B.binding.authHeader===void 0)throw G();Q={type:"api",apiKey:z.apiKey,baseURL:B.binding.baseURL,authHeader:B.binding.authHeader}}else if(typeof z.refresh==="string")Q={type:"oauth",refresh:z.refresh};else throw G();let[Y]=$1({accounts:[d1({id:X,credential:Q,identity:B.binding.identity,addedAt:0})],[p]:{rows:{[X]:{credentialEpoch:B.credentialEpoch}}}},Z.state,$.ctx.codec,$.ctx.providerState);if(!Y?.credential||Y.invalid||Y.stamp!=="bound")throw G();if(B.credentialEpoch!==J.credentialEpoch||B.binding.identity!==J.identity)throw _("remove",X,"attribution",`orphan ${X} was written for a credential or account other than the one this removal was decided for`,!0)}function s1($,Z){let X=$.accounts;return O(X)&&Object.hasOwn(X,Z)}function tZ($){return O($)&&typeof $.id==="string"?$.id:void 0}function xX($,Z){if(!Array.isArray(Z))return"ids must be an array of roster ids";let X=new Set;for(let z of $){let B=tZ(z);if(B!==void 0)X.add(B)}let J=new Set;for(let z of Z){if(typeof z!=="string")return"ids must be an array of roster ids";if(J.has(z))return`id ${z} appears more than once`;if(!X.has(z))return`id ${z} is not in the roster`;J.add(z)}let G=[...X].filter((z)=>!J.has(z));if(G.length>0)return`the order leaves out roster id(s) ${G.join(", ")}`;return}function kX($,Z){let X=new Map;for(let z of $){let B=tZ(z);if(B===void 0)continue;let Q=X.get(B);if(Q)Q.push(z);else X.set(B,[z])}let J=Z.flatMap((z)=>X.get(z)??[]),G=0;return $.map((z)=>tZ(z)===void 0?z:J[G++])}async function e9($,Z,X={}){G0("reorder");let{ctx:J}=$,G=X.onFailure;return z0(J,"reorder",void 0,G&&((z,B)=>G(B)),async(z,B)=>{for(let Q of X.extraLocks??[])await z.acquire(Q);return n(J,z,B,{operation:"reorder",rowId:void 0},async(Q)=>{let Y=Q.roster(),H=xX(Y,Z);if(H)throw new g({operation:"reorder",phase:"before-first-write",retryable:!1,kind:"invalid-order",message:H});let W=[...Z],V=kX(Y,W);if(V.every((j,D)=>j===Y[D]))return{ids:W,outcome:"unchanged"};return Q.config.accounts=V,await Q.commitConfig(),{ids:W,outcome:"reordered"}},{completeTorn:!1})})}async function $4($,Z,X,J,G={}){return G0("recordIdentity"),z0($.ctx,"recordIdentity",Z,G.onFailure,async(z,B)=>{if(typeof X!=="string"||X.length===0)throw _("recordIdentity",Z,"invalid-input","identity must be non-empty");let Q=O(J)?J.credentialEpoch:void 0;if(!$0(Q))throw _("recordIdentity",Z,"invalid-input","the credential epoch the identity lookup was issued for is required");let{row:Y}=await p0($,"recordIdentity",Z);await z.acquire(q0($,Y)),await z.acquire(G.providerLock??$.providerLock);for(let H of G.extraLocks??[])await z.acquire(H);return n($.ctx,z,B,{operation:"recordIdentity",rowId:Z},async(H)=>{let W=O6("recordIdentity",Z,H.row(Z));if(l(W)!==l(Y))throw F$("recordIdentity",Z);if(W0("recordIdentity",W),(W.credentialEpoch??1)!==Q)throw _("recordIdentity",Z,"attribution",`the identity for ${Z} was looked up for a credential the row no longer holds`,!0);if(W.identity!==void 0&&W.identity!==X)throw F6("recordIdentity",Z);if(W.identity===void 0)await RX(H,W,X);let V=N1(H,Z,X);return await H.commitConfig(),{id:Z,disabled:V}})})}function X4($){let Z=$[p];return O(Z)&&O(Z.publications)?Z.publications:{}}function J4($,Z){let X=X4($);if(!Object.hasOwn(X,Z))return;let J=X[Z];if(!O(J)||J.operationId!==Z||typeof J.planDigest!=="string"||!/^[a-f0-9]{64}$/.test(J.planDigest)||!["committed","cleaned"].includes(String(J.phase))||!Array.isArray(J.removed)||!Array.isArray(J.finalized)||J.removed.some((G)=>!O(G)||typeof G.id!=="string"||!$0(G.credentialEpoch))||J.finalized.some((G)=>!O(G)||typeof G.id!=="string"||!$0(G.credentialEpoch)||typeof G.reservation!=="string"||!G.reservation||typeof G.enabled!=="boolean"))throw _("publishRoster",Z,"invalid-input","the stored publication receipt is malformed");return structuredClone(J)}async function G4($,Z){let X=await H0($.ctx);if(X.status!=="ready")throw T0(X,"publishRoster",Z);return J4(X.config,Z)}function yX($,Z){let X=()=>{throw _("publishRoster",Z?.operationId??"","invalid-input","the publication plan is invalid")};if(!O(Z)||typeof Z.operationId!=="string"||!Z.operationId||!Array.isArray(Z.remove)||!Array.isArray(Z.finalize)||!Array.isArray(Z.order))X();let J=new Set;for(let G of[...Z.remove,...Z.finalize]){if(!O(G)||typeof G.id!=="string"||p1(G.id)||J.has(G.id)||!G.attribution)X();if(J.add(G.id),i1("publishRoster",G.id,G.attribution),G.attribution.identity!==void 0&&(typeof G.attribution.identity!=="string"||!G.attribution.identity))X()}for(let G of Z.remove)if($.ctx.requireRemovedFingerprint&&!G.fingerprint||G.fingerprint!==void 0&&typeof G.fingerprint!=="string")X();for(let G of Z.finalize)if(typeof G.reservation!=="string"||!G.reservation||typeof G.enabled!=="boolean"||(G.enabled?G.disabledReason!==void 0:typeof G.disabledReason!=="string"))X();if(Z.order.some((G)=>typeof G!=="string"||p1(G))||new Set(Z.order).size!==Z.order.length)X()}function z4($,Z){$.entries();let X=$.config[p],J={...X4($.config)};Object.defineProperty(J,Z.operationId,{value:Z,enumerable:!0,writable:!0,configurable:!0}),X.publications=J,delete X.publicationOrder}function fX($,Z,X){let J=new Set;for(let B of l1($.config)){if(!O(B)||typeof B.id!=="string")continue;if(J.has(B.id))throw _("publishRoster",Z.operationId,"invalid-input","publication needs a roster of unique named rows");J.add(B.id)}let G=new Set(Z.remove.map((B)=>B.id)),z=X.filter((B)=>B.invalid!=="roster"&&!G.has(B.id));if(z.length!==Z.order.length||Z.order.some((B)=>!z.some((Q)=>Q.id===B))||z.some((B)=>!Z.order.includes(B.id)))throw _("publishRoster",Z.operationId,"invalid-input","order must name exactly the surviving roster");return z}async function Z4($,Z){await $.assertAll();for(let J of Z.removed)if(V0($.stateAccount(J.id)?.[m])?.credentialEpoch===J.credentialEpoch&&!$.rosterRow(J.id))$.dropStateAccount(J.id);for(let J of Z.finalized){let G=$.stateAccount(J.id),z=V0(G?.[m]);if(G&&z?.credentialEpoch===J.credentialEpoch&&z.staged?.reservation===J.reservation){let B={...G[m]};delete B.staged,$.setStateAccount(J.id,{...G,[m]:B})}}await $.commitState(void 0,{durable:!0});let X={...Z,phase:"cleaned"};return z4($,X),await $.commitConfig({durable:!0}),X}async function B4($,Z,X={}){return G0("publishRoster"),z0($.ctx,"publishRoster",Z?.operationId??"",X.onFailure,async(J,G)=>{if(!O(Z)||typeof Z.operationId!=="string"||!Z.operationId)throw _("publishRoster",Z?.operationId??"","invalid-input","the publication needs an operation id");Z=structuredClone(Z);let z=L1(Z),B=[...Array.isArray(Z.remove)?Z.remove:[],...Array.isArray(Z.finalize)?Z.finalize:[]].filter((Q)=>O(Q)&&typeof Q.id==="string");for(let Q=0;;Q++){let Y=await H0($.ctx);if(Y.status!=="ready")throw T0(Y,"publishRoster",Z.operationId);let H=new Map(B.map(({id:V})=>[V,l(Y.rows.find((j)=>j.id===V)??{id:V})]));for(let V of[...new Set(H.values())].sort())await J.acquire(q0($,{id:V}));await J.acquire(X.providerLock??$.providerLock);for(let V of X.extraLocks??[])await J.acquire(V);let W=await n($.ctx,J,G,{operation:"publishRoster",rowId:Z.operationId},async(V)=>{let j=V.rows();if(B.some(({id:q})=>l(j.find((L)=>L.id===q)??{id:q})!==H.get(q)))return;let D=J4(V.config,Z.operationId);if(D){if(D.planDigest!==z)throw _("publishRoster",Z.operationId,"publication-mismatch","the operation id belongs to a different publication plan");if(D.phase==="cleaned")return{outcome:"already-cleaned",receipt:D};return V.markPublicationDecision(),await V.syncConfig(),{outcome:"cleaned",receipt:await Z4(V,D)}}yX($,Z);let U=fX(V,Z,j),N=[];for(let q of Z.remove){V.assertNotStaged(q.id);let L=j.find((S)=>S.id===q.id);if(!L)throw _("publishRoster",q.id,"attribution","the removed row no longer exists");if(P6(q.id,L,q.attribution,"publishRoster"),!L.credential||q.fingerprint!==void 0&&t0(L.credential)!==q.fingerprint)throw _("publishRoster",q.id,"attribution","the removed secret no longer matches");N.push(L)}let K=[];for(let q of Z.finalize){let L=j.find((f)=>f.id===q.id),S=V0(V.stateAccount(q.id)?.[m]);if(!L||L.staged?.reservation!==q.reservation||S?.staged?.reservation!==q.reservation||L.enabled)throw _("publishRoster",q.id,"row-staged","the finalized row is not disabled under this reservation");let A=V.stateAccount(q.id),x=V.rosterRow(q.id),w=A?.[Y0],y=w===void 0?void 0:L1(w);if(!S?.staged||S.staged.label!==x?.label||S.staged.disabledReason!==L.disabledReason||S.staged.providerState!==y)throw _("publishRoster",q.id,"row-staged","the staged label, disabled reason or full provider state no longer matches its stamp");P6(q.id,L,q.attribution,"publishRoster"),K.push(L)}let M=U.find((q)=>q.torn);if(M)throw _("publishRoster",Z.operationId,"attribution",`Row ${M.id} has an interrupted write; complete it with a normal store operation before publishing.`,!1);let P=new Set;for(let q of U){if(!(Z.finalize.find((S)=>S.id===q.id)?.enabled??q.enabled)||q.type!=="oauth"||q.identity===void 0)continue;if(P.has(q.identity))throw _("publishRoster",q.id,"invalid-input","the final enabled roster repeats a known identity");P.add(q.identity)}for(let q of U)if(q.identity!==void 0&&q.fingerprint!==void 0&&U.some((L)=>L.id!==q.id&&L.identity!==void 0&&L.identity!==q.identity&&L.fingerprint===q.fingerprint))throw _("publishRoster",q.id,"attribution","the resulting pool gives the same secret different known identities");for(let q of K)if(q.identity!==void 0&&N.some((L)=>L.identity!==void 0&&L.identity!==q.identity&&L.fingerprint===q.fingerprint))throw _("publishRoster",q.id,"attribution","the staged secret belonged to a different known identity");await L6(V,Z.operationId,X.protect);let E={operationId:Z.operationId,planDigest:z,phase:"committed",removed:N.map((q)=>({id:q.id,credentialEpoch:q.credentialEpoch??1})),finalized:Z.finalize.map((q,L)=>({id:q.id,credentialEpoch:K[L]?.credentialEpoch??1,reservation:q.reservation,enabled:q.enabled}))};for(let q of Z.remove)V.dropRosterRows(q.id);for(let q of Z.finalize){let L=V.rosterRow(q.id);L.enabled=q.enabled;let S={...V.entry(q.id)};if(delete S.staged,q.enabled)delete S.disabledReason;else S.disabledReason=q.disabledReason;V.setEntry(q.id,S)}let F=V.roster().filter((q)=>!O(q)||typeof q.id!=="string"||j.find((L)=>L.id===q.id)?.invalid==="roster");return V.config.accounts=[...Z.order.map((q)=>V.rosterRow(q)),...F],z4(V,E),await V.syncState(),await V.commitConfig({durable:!0,publicationDecision:!0}),{outcome:"published",receipt:await Z4(V,E)}},{completeTorn:!1});if(W)return W;if(await J.releaseAll(),Q>=1)throw _("publishRoster",Z.operationId,"row-key-changed","a named row changed lock key twice during publication",!0)}})}class $3{rt;hook;onFailure;firedAtLoad;logger;inflight=new Set;constructor($,Z,X,J,G){this.rt=$,this.hook=Z,this.onFailure=X,this.firedAtLoad=J,this.logger=G}fire($,Z){if(!this.hook)return;if(Z==="load"){if(this.firedAtLoad.has($))return;this.firedAtLoad.add($)}let X=this.run($,Z);this.inflight.add(X),X.finally(()=>this.inflight.delete(X))}async settled(){while(this.inflight.size>0)await Promise.allSettled([...this.inflight])}async run($,Z){let X=this.rt(),{ctx:J}=X,G=new r0(J.lockDefaults,J.lockEnv),z={writes:0};try{let B=await n(J,G,z,{operation:"pull",rowId:$},async(Y)=>{if(Y.reservation($)!==void 0)return;await Y.completeTorn();let H=Y.row($);if(H?.unbound&&H.enabled&&H.type==="oauth"&&H.credential&&!H.invalid)W0("pull",H);if(!H?.candidate||H.type!=="oauth")return;if(!H.hasEntry)Y.setEntry($,{credentialEpoch:1,needsFirstReading:!0}),await Y.commitConfig();let W=Y.row($);if(!W?.credential||W.credentialEpoch===void 0)return;return{id:$,credential:W.credential,credentialEpoch:W.credentialEpoch,...W.identity!==void 0?{identity:W.identity}:{},reason:Z}},{completeTorn:!1});if(await G.releaseAll(),!B){this.firedAtLoad.delete($);return}await J.hold?.("pull-before-request",$);let Q;try{Q=await this.hook?.(B)}catch(Y){throw new g({operation:"pull",rowId:$,phase:"pull",retryable:!0,kind:"pull",message:"the quota pull rejected",cause:Y})}await q6(X,$,{credentialEpoch:B.credentialEpoch,...B.identity!==void 0?{identity:B.identity}:{}},Q)}catch(B){this.firedAtLoad.delete($);let Q=c1(B,"pull",$,z);if(this.onFailure)try{await this.onFailure($,Q)}catch(Y){this.logger?.warn("pull failure hook threw",{rowId:$,error:Y instanceof Error?Y.message:String(Y)})}else this.logger?.warn("quota pull failed",{rowId:$,kind:Q.kind})}finally{await G.releaseAll()}}}import{randomUUID as gX}from"node:crypto";function Z3($,Z){if(F1("refresh",$,Z?.staged),!Z)throw _("refresh",$,"unknown-row",`no row ${$} in the pool`);if(Z.invalid)throw _("refresh",$,"invalid-row",`row ${$} is invalid`);if(Z.type!=="oauth"||Z.credential?.type!=="oauth")throw _("refresh",$,"no-credential",`row ${$} holds no OAuth credential`);if(!Z.enabled)throw _("refresh",$,"row-disabled",`row ${$} is disabled`);return Z}function Q4($){return _("refresh",$,"refresh-stamp-ahead",`row ${$}'s stored refresh stamp is ahead of the clock; a rotation now could not be stamped newer within the trust bound`,!0)}async function Y4($,Z,X,J={}){G0("refresh");let{ctx:G}=$;return z0(G,"refresh",Z,J.onFailure,async(z,B)=>{let{row:Q}=await p0($,"refresh",Z);Z3(Z,Q);let Y=await J.refuse?.(Q);if(Y!==void 0)return{status:"refused",rowId:Z,reason:Y};let H=l(Q),W;for(let U=0;;U++){await z.acquire(q0($,{id:Z,identity:H===Z?void 0:H})),await z.acquire(J.providerLock??$.providerLock);for(let M of J.extraLocks??[])await z.acquire(M);let K=await n(G,z,{writes:0},{operation:"refresh",rowId:Z},async(M)=>{let P=Z3(Z,M.row(Z));if(W0("refresh",P),!P.hasEntry)M.setEntry(Z,{credentialEpoch:1,needsFirstReading:!0}),await M.commitConfig(),P=Z3(Z,M.row(Z));if(l(P)!==H)return{keyNow:l(P)};let E=await J.refuse?.(P);if(E!==void 0)return{refused:E};return{row:P,credential:P.credential,credentialEpoch:P.credentialEpoch,identity:P.identity}});if("refused"in K)return{status:"refused",rowId:Z,reason:K.refused};if("keyNow"in K){if(await z.releaseAll(),U>=1)throw _("refresh",Z,"row-key-changed",`row ${Z}'s wire identity changed twice while its lock was held`,!0);H=K.keyNow;continue}W=K;break}if(sZ(W.credential.lastRefreshedAt,G.now()))throw Q4(Z);await G.hold?.("refresh-before-provider",Z),await z.assertAll();let V;try{V=await X(W.credential,W.row)}catch(U){throw new g({operation:"refresh",rowId:Z,phase:"before-first-write",retryable:!0,kind:"provider",message:"the provider refresh failed",cause:U})}if(typeof V?.refresh!=="string"||!V.refresh.trim())throw _("refresh",Z,"provider","the provider returned no refresh token",!0);let j=V.providerState===void 0?void 0:u0(G.providerState,"refresh",Z,V.providerState,"the provider state the provider returned"),D=await n(G,z,B,{operation:"refresh",rowId:Z},async(U)=>{let N=U.row(Z),K=U.entry(Z);if(!N||N.invalid||!K||K.credentialEpoch!==W.credentialEpoch||N.identity!==W.identity)throw new g({operation:"refresh",rowId:Z,phase:"before-first-write",retryable:!0,kind:"attribution",message:`row ${Z} changed credential while its refresh was in flight; the rotation is discarded`});W0("refresh",N);let M=await J.refuse?.(N);if(M!==void 0)return{refused:M};let P=G.now(),E=N.credential?.type==="oauth"?N.credential.lastRefreshedAt:void 0;if(sZ(E,P))throw Q4(Z);let F={type:"oauth",access:V.access,refresh:V.refresh,expires:V.expires},q=N.identity!==void 0&&V.identity!==void 0&&N.identity!==V.identity?{expectedIdentity:N.identity,returnedIdentity:V.identity}:void 0,L=q?{mark:gX(),enabled:!1,reason:`${m1}${JSON.stringify(q)}`}:void 0,S=N.identity===void 0&&V.identity?V.identity:void 0,A=await _6($,U,Z,F,{stamp:q$(E,P),transition:L,identity:S,...j!==void 0?{providerState:M$(G.providerState,"refresh",Z,N.providerState,j)}:{}});if(L!==void 0)N$(U,Z,L),await U.commitConfig();let x=N.identity;if(S!==void 0)N1(U,Z,S),x=S,await U.commitConfig();return{stored:A,identity:x,contradiction:q,refused:void 0}});if(D.refused!==void 0)return{status:"refused",rowId:Z,reason:D.refused};if(D.contradiction!==void 0)return{status:"identity-contradicted",rowId:Z,...D.contradiction,credential:D.stored};if(J.onPersisted)try{let U=J.onPersisted;await b0("refresh",()=>U(Z,D.stored))}catch(U){throw new g({operation:"refresh",rowId:Z,phase:"after-first-write",retryable:!1,kind:"after-persist-hook",committed:D.stored,message:"the after-persist hook threw; the rotation stays committed",cause:U})}return{status:"rotated",rowId:Z,credential:D.stored,...D.identity!==void 0?{identity:D.identity}:{}}})}import{isDeepStrictEqual as hX}from"node:util";var A6=Object.freeze(["version","accounts",p]);function X3($){let Z={};for(let[X,J]of Object.entries($))if(!A6.includes(X))T6(Z,X,J);return Z}function T6($,Z,X){Object.defineProperty($,Z,{value:X,enumerable:!0,writable:!0,configurable:!0})}function vX($,Z){let X={};for(let[J,G]of Object.entries($))if(A6.includes(J))T6(X,J,G);else if(Object.hasOwn(Z,J))T6(X,J,Z[J]);for(let[J,G]of Object.entries(Z))if(!Object.hasOwn($,J))T6(X,J,G);return X}function H4($){return new g({operation:"updateSettings",phase:"before-first-write",retryable:!1,kind:"invalid-input",message:$})}async function W4($){let Z=await H0($.ctx);if(Z.status==="error")return Z;return{status:Z.status,settings:X3(Z.config)}}async function V4($,Z,X={}){G0("updateSettings");let{ctx:J}=$,G=X.onFailure;return z0(J,"updateSettings",void 0,G&&((z,B)=>G(B)),async(z,B)=>{for(let Y of X.extraLocks??[])await z.acquire(Y);let Q=z.held.length;try{for(let K of J.storeLocks)await z.acquire(K);let Y=await H0(J);if(Y.status!=="ready")throw T0(Y,"updateSettings",void 0);let H=X3(Y.config),W=structuredClone(H),V=await b0("updateSettings",()=>Z(W)),j=V===void 0?W:V;if(!O(j))throw H4("the settings mutator must produce an object");let D=A6.filter((K)=>Object.hasOwn(j,K));if(D.length>0)throw H4(`settings cannot set the pool-owned key(s) ${D.join(", ")}`);if(hX(j,H))return{settings:H,outcome:"unchanged"};let U=vX(Y.config,j),N={operation:"updateSettings",rowId:void 0};return await F0(J.configPath,U,{beforeRename:async()=>{await J.onStep?.("before-config-write",N),await z.assertAll()}}),B.writes++,await J.onStep?.("after-config-write",N),{settings:X3(U),outcome:"updated"}}finally{await z.releaseTo(Q)}})}var U4=new Map;function mX($){let Z=U4.get($);if(!Z)Z={removedIds:new Set,firedAtLoad:new Set},U4.set($,Z);return Z}function j4($){if($.status==="ready")return{status:"ready",schemaVersion:o0,rows:$.rows};if($.status==="pending-migration")return{status:"pending-migration",roster:Array.isArray($.config.accounts)?$.config.accounts:[]};return $}function J3($){let Z=mX($.configPath),X={...pZ,...$.lockOptions},J={provider:$.provider,configPath:$.configPath,statePath:$.statePath,codec:$.quota,...$.providerState?{providerState:$.providerState}:{},now:$.now??Date.now,storeLocks:$.storeLocks??[{name:"save",path:$.configPath},{name:"save",path:$.statePath}],lockDefaults:X,lockEnv:{...$.onLockEvent?{onLockEvent:$.onLockEvent}:{},...$.onLockStep?{onLockStep:$.onLockStep}:{},...$.onRenewalTimer?{onRenewalTimer:$.onRenewalTimer}:{}},removedIds:Z.removedIds,requireCredentialStamps:$.requireCredentialStamps===!0,requireRemovedFingerprint:$.requireRemovedFingerprint===!0,...$.logger?{logger:$.logger}:{},...$.onStep?{onStep:$.onStep}:{},...$.hold?{hold:$.hold}:{}},G=new $3(()=>z,$.pull,$.onPullFailure,Z.firedAtLoad,$.logger),z={ctx:J,providerLock:$.providerLock??{name:`provider-${encodeURIComponent($.provider)}`,path:$.statePath},rowLockOptions:$.rowLockOptions??{},firePull:(B,Q)=>G.fire(B,Q)};return{async load(){let B=await H0(J);if(B.status==="ready"){for(let Q of B.rows)if((Q.candidate||Q.torn&&Q.enabled)&&Q.type==="oauth"&&Q.needsFirstReading)G.fire(Q.id,"load")}return j4(B)},async read(){return j4(await H0(J))},async initialize(B={}){return{status:await m9(J,B.dropKeys??[])}},add:(B,Q)=>s9(z,B,Q),publishRoster:(B,Q)=>B4(z,B,Q),publication:(B)=>G4(z,B),replace:(B,Q,Y,H)=>i9(z,B,Q,Y,H),rotate:(B,Q,Y,H)=>a9(z,B,Q,Y,H),updateProviderState:(B,Q,Y,H)=>u9(z,B,Q,Y,H),disable:(B,Q,Y)=>r9(z,B,Q,Y),enable:(B,Q)=>o9(z,B,Q),remove:(B,Q)=>t9(z,B,Q),reorder:(B,Q)=>e9(z,B,Q),readSettings:()=>W4(z),updateSettings:(B,Q)=>V4(z,B,Q),recordIdentity:(B,Q,Y,H)=>$4(z,B,Q,Y,H),refresh:(B,Q,Y)=>Y4(z,B,Q,Y),recordQuota:(B,Q,Y)=>q6(z,B,Q,Y),requestReading:(B)=>G.fire(B,"admission"),pullsSettled:()=>G.settled()}}var wX=[/\b[\w-]*(?:secret|token|password|passwd|api[_-]?key|authorization|verifier)["']?\s*[:=]\s*["']?(?:(?:Bearer|Basic)\s+)?[^\s"'&,;}]+/gi,/\b[0-9a-fA-F]{32,}\b/g];function B3($={}){let{redactStrings:Z}=I0({...$,extraValuePatterns:[...wX,...$.extraValuePatterns??[]]});return(X)=>Z(X)}class B0 extends Error{code;constructor($,Z,X){super(Z,X);this.name="CommandError",this.code=$}}var D4=/^[a-z][a-z0-9-]{0,63}$/,G3={code:"action-failed",text:"That action failed."},pX=new Set(["unknown-row","invalid-row","invalid-input","id-exists","id-removed","type-mismatch","no-credential","row-disabled","row-protected","duplicate-identity","row-key-changed","invalid-order","pending-migration","provider","pull","attribution"]);function L$($){if($ instanceof B0)return{code:D4.test($.code)?$.code:G3.code,text:$.message};if($ instanceof g)return{code:`pool-${$.kind}`,text:pX.has($.kind)?$.message:`The account pool could not do that (${$.kind}).`};return G3}var K4="This cannot be undone. Continue?",uX=new Set(["access","refresh","apikey","password","authheader","credential","credentials"]);function lX($){let Z=$.toLowerCase().replace(/[-_]/g,"");return uX.has(Z)||Z.endsWith("token")||Z.endsWith("key")||Z.endsWith("secret")}function dX($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function z3($,Z,X){if(typeof $==="string"){let G=X.redact($);if(G!==$)X.redacted.push(Z);return G}if(Array.isArray($))return $.map((G,z)=>z3(G,`${Z}[${z}]`,X));if(!dX($))return $;let J={};for(let[G,z]of Object.entries($)){if(lX(G)){X.dropped.push(`${Z}.${G}`);continue}Object.defineProperty(J,G,{value:z3(z,`${Z}.${G}`,X),enumerable:!0,writable:!0,configurable:!0})}return J}function q4($,Z,X){let J={redact:X.redact,dropped:[],redacted:[]},G=z3($,"payload",J);if(J.dropped.length>0)X.logger.warn("credential-shaped field dropped from a command payload",{command:Z,fields:J.dropped});if(J.redacted.length>0)X.logger.warn("secret-shaped text masked in a command payload",{command:Z,fields:J.redacted});return G}function cX($){return{value:String($.value),label:String($.label)}}function sX($){switch($.kind){case"choice":return{kind:"choice",id:$.id,label:$.label,choices:($.choices??[]).map(cX),...$.value!==void 0?{value:$.value}:{}};case"toggle":return{kind:"toggle",id:$.id,label:$.label,value:$.value===!0};case"number":return{kind:"number",id:$.id,label:$.label,...$.value!==void 0?{value:$.value}:{},...$.min!==void 0?{min:$.min}:{},...$.max!==void 0?{max:$.max}:{},...$.required?{required:!0}:{}};case"text":return{kind:"text",id:$.id,label:$.label,...$.value!==void 0&&!$.masked?{value:$.value}:{},...$.placeholder!==void 0?{placeholder:$.placeholder}:{},...$.masked?{masked:!0}:{},...$.required?{required:!0}:{}}}}function Q3($){if($.irreversible===!0)return{message:$.confirm||K4,irreversible:!0};if($.confirm)return{message:$.confirm,irreversible:!1};return}function N4($){let Z=Q3($);return{id:$.id,label:$.label,...$.description!==void 0?{description:$.description}:{},...$.group!==void 0?{group:String($.group)}:{},knobs:($.knobs??[]).map(sX),...Z?{confirm:Z}:{}}}function iX($){return{id:$.id,...$.label!==void 0?{label:$.label}:{},enabled:$.enabled,type:$.type,...$.identity!==void 0?{identity:$.identity}:{}}}function aX($){return{id:$.id,label:$.label,...$.detail!==void 0?{detail:$.detail}:{},...$.group!==void 0?{group:String($.group)}:{},...$.status!==void 0?{status:String($.status)}:{},...$.account?{account:iX($.account)}:{},...$.facts!==void 0?{facts:$.facts}:{},actions:($.actions??[]).map(N4)}}function nX($){let{content:Z}=$;return{id:$.id,slot:$.slot,title:$.title,lines:(Z.lines??[]).map(String),items:(Z.items??[]).map(aX),actions:(Z.actions??[]).map(N4),...Z.facts!==void 0?{facts:Z.facts}:{}}}function M4($,Z,X){return{command:$,title:Z,sections:X.map(nX)}}function F4($,Z,X,J){return q4({command:$,menu:M4($,Z,X)},$,J)}function L4($,Z,X,J,G){return q4({command:$,ok:J.ok,text:String(J.text),...!J.ok&&J.code!==void 0?{code:D4.test(J.code)?J.code:"refused"}:{},...J.needsConfirmation?{needsConfirmation:!0}:{},menu:M4($,Z,X)},$,G)}var C4="disabled from the command menu";function rX($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function l0($){return rX($)?{...$}:{}}function oX($){if($.status!=="ready")return[];let Z=new Set;return $.rows.filter((X)=>{if(Z.has(X.id))return!1;return Z.add(X.id),!0})}function tX($,Z){return $.label??Z??$.id}function S6($,Z){return Q0($.quota)?s($.quota,Z):void 0}function P4($,Z){return`${$} ${Z}${$===1?"":"s"}`}var _$="Actions";function eX($){if($.status==="pending-migration")return"The account pool has not been migrated yet.";if($.status==="error")return`The ${$.file} file cannot be read: ${$.reason}`;return}function _4($,Z){switch(Z.outcome){case"added":return`Added ${$}.`;case"added-disabled":return`Added ${$}, disabled: another enabled account has the same identity.`;case"completed":return`Finished adding ${$}.`;case"rotated":return`${$} was already in the pool; its credential was updated.`;case"exists":return`${$} was already in the pool; its credential is unchanged.`}}function O4($){return L$($).text}async function $J($){let Z=await $.read(),X=await $.readSettings();return{load:Z,rows:oX(Z),settings:X.status==="error"?{}:X.settings}}function R6($,Z){let X=Z.accounts?.describeIdentity?Z.accounts.describeIdentity($):$.identity;return{account:{id:$.id,...$.label!==void 0?{label:$.label}:{},enabled:$.enabled,type:$.type,...X!==void 0?{identity:X}:{}},name:tX($,X)}}function ZJ($,Z){let{store:X,extraLocks:J}=$,G=J?{extraLocks:J}:{},z=Z.rows.map((V)=>V.id),B=eX(Z.load),Q=Z.rows.filter((V)=>V.enabled).length,Y=Z.rows.map((V,j)=>{let{account:D,name:U}=R6(V,$),N=[V.type==="api"?"API key":"OAuth",...D.identity!==void 0?[D.identity]:[],...!V.invalid&&!V.enabled&&V.disabledReason?[`disabled: ${V.disabledReason}`]:[]].join(" · "),K=V.invalid?"invalid":V.enabled?"enabled":"disabled",M=[];if(!V.invalid&&V.enabled)M.push({id:"disable",label:"Disable",run:async()=>{return await X.disable(V.id,C4,G),`Disabled ${U}.`}});if(!V.invalid&&!V.enabled)M.push({id:"enable",label:"Enable",run:async()=>{return await X.enable(V.id,G),`Enabled ${U}.`}});if(z.length>1)M.push({id:"move",label:"Move",knobs:[{kind:"choice",id:"position",label:"Position",choices:z.map((P,E)=>({value:String(E+1),label:String(E+1)})),value:String(j+1)}],run:async({values:P})=>{let E=Number(P.position),F=z.filter((L)=>L!==V.id);return F.splice(E-1,0,V.id),(await X.reorder(F,G)).outcome==="unchanged"?`${U} is already at position ${E}.`:`Moved ${U} to position ${E}.`}});return M.push({id:"remove",label:"Remove",irreversible:!0,confirm:`Remove ${U}? Its stored credential is deleted.`,run:async()=>{return await X.remove(V.id,{...G,...$.accounts?.protect?{protect:$.accounts.protect}:{}}),`Removed ${U}.`}}),{id:V.id,label:U,detail:N,group:"Accounts",status:K,account:D,actions:M}}),H=$.accounts?.login,W=[];if(H&&!B)W.push({id:"add",label:H.label??"Add account",group:_$,knobs:H.knobs??[],run:async({values:V,invocation:j})=>{let D=await H.run(V,j);if(D.status==="cancelled")return{ok:!1,text:D.message??"Login cancelled."};if(D.status==="ready"){let U=await X.add(D.account,G);return _4(D.account.label??U.id,U)}return D.completion.then(async(U)=>{if(!U){j.notify("Login cancelled.","warning");return}let N=await X.add(U,G);j.notify(_4(U.label??N.id,N))},(U)=>{j.notify(`Adding the account failed: ${O4(U)}`,"error")}).catch((U)=>{j.notify(`Adding the account failed: ${O4(U)}`,"error")}),D.message}});return{id:"accounts",slot:"accounts",title:"Accounts",content:{lines:B?[B]:[Z.rows.length===0?"No accounts yet":`${P4(Z.rows.length,"account")}, ${Q} enabled`],items:B?[]:Y,actions:W}}}function XJ($,Z){let X=$.quota?.scope??"all",J=$.now(),G=X==="all"?"Accounts":`Accounts · ${X}`,z=async(W,V)=>{if($.quota?.check)await $.quota.check(W,V);else{for(let j of W)$.store.requestReading(j);await $.store.pullsSettled()}},B=Z.rows.filter((W)=>W.candidate),Q=B.map((W)=>{let{account:V,name:j}=R6(W,$),D=S6(W,X);return{id:W.id,label:j,group:G,status:C0(D,{now:J,form:"compact"}),detail:C0(D,{now:J,form:"full"}),account:V,actions:[{id:"check",label:"Check this account",run:async({invocation:U})=>{return await z([W.id],U),`Checked quota for ${j}.`}}]}}),Y=Z.rows.filter((W)=>!W.candidate).map((W)=>{let{name:V}=R6(W,$),j=W.invalid?"invalid":!W.enabled?"disabled":W.credential===void 0?"no credential":"unavailable",D=C0(S6(W,X),{now:J,form:"compact"});return`${V} (${j}): ${D}`}),H=[];if(B.length>0)H.push({id:"check",label:"Check now",description:"Checks every account that can be checked.",group:_$,run:async({invocation:W})=>{let V=B.map((j)=>j.id);return await z(V,W),`Checked quota for ${P4(V.length,"account")}.`}});return{id:"quota",slot:"quota",title:"Quota",content:{lines:Z.rows.length===0?["No accounts yet"]:Y,items:Q,actions:H}}}function JJ($,Z){let{store:X,extraLocks:J}=$,G=J?{extraLocks:J}:{},z=[{value:"ordered",label:"Ordered (roster order)"},...$.routing?.orderedVariants??[],{value:"sticky-balanced",label:"Sticky balanced"}],B=l0(Z.settings.routing).mode,Q=typeof B==="string"&&z.some((U)=>U.value===B)?B:"ordered",Y=FZ(Q),H=Z.rows.map((U)=>U.id),W=f1(H,Y.placement,$.routing?.formerMainId??G6),j=[`Mode: ${z.find((U)=>U.value===Q)?.label??Q}`];if(H.length>0)j.push(`Roster order: ${H.join(", ")}`);if(Y.mode==="ordered"&&W.join()!==H.join())j.push(`Tried in order: ${W.join(", ")}`);let D=[{id:"mode",label:"Change mode",group:_$,knobs:[{kind:"choice",id:"mode",label:"Mode",choices:z,value:Q}],run:async({values:U})=>{let N=String(U.mode);return await X.updateSettings((K)=>{K.routing={...l0(K.routing),mode:N};return},G),`Routing mode set to ${z.find((K)=>K.value===N)?.label??N}.`}}];if(H.length>1)D.push({id:"order",label:"Set order",group:_$,knobs:[{kind:"text",id:"order",label:"Account ids, first to last",value:H.join(", "),required:!0}],run:async({values:U})=>{let N=String(U.order).split(/[\s,]+/).filter((M)=>M.length>0),K=await X.reorder(N,G);return K.outcome==="unchanged"?"The order is unchanged.":`Order set to ${K.ids.join(", ")}.`}});return{id:"routing",slot:"routing",title:"Routing",content:{lines:j,actions:D}}}function GJ($,Z){if($.limits?.labels)return[...$.limits.labels];let X=$.quota?.scope??"all",J=[];for(let G of Z.rows)for(let z of S6(G,X)?.limits??[])if(!J.includes(z.label))J.push(z.label);return J.length>0?J:["primary"]}function zJ($,Z){let X=$.quota?.scope??"all",J=new Map;for(let G of Z.rows)for(let z of S6(G,X)?.limits??[])if(z.windowMinutes!==void 0&&!J.has(z.label))J.set(z.label,X6(z));return(G)=>J.get(G)??G}function BJ($,Z){let{store:X,extraLocks:J}=$,G=J?{extraLocks:J}:{},z=l0(Z.settings.killswitch),B=z.enabled===!0,Q=l0(z.accounts),Y=GJ($,Z),H=zJ($,Z),W=B?"on":"off",V=Z.rows.map((j)=>{let{account:D,name:U}=R6(j,$),N=l0(Q[j.id]),K=Y.filter((M)=>typeof N[M]==="number");return{id:j.id,label:U,group:`Floors · killswitch ${W}`,status:K.length===0?"no floors":K.map((M)=>`${H(M)} ≥${N[M]}%`).join(" · "),account:D,actions:[{id:"floors",label:"Set floors",knobs:Y.map((M)=>({kind:"number",id:M,label:`Minimum % left for ${H(M)}`,min:0,max:100,...typeof N[M]==="number"?{value:N[M]}:{}})),run:async({values:M})=>{return await X.updateSettings((P)=>{let E=l0(P.killswitch),F=l0(E.accounts),q=l0(F[j.id]);for(let L of Y){let S=M[L];if(typeof S==="number")q[L]=S;else if(S===null)delete q[L]}if(Object.keys(q).length>0)F[j.id]=q;else delete F[j.id];if(Object.keys(F).length>0)E.accounts=F;else delete E.accounts;P.killswitch=E;return},G),`Floors updated for ${U}.`}}]}});return{id:"limits",slot:"limits",title:"Limits",content:{lines:[`Killswitch ${W}`],items:V,actions:[{id:"killswitch",label:B?"Turn killswitch off":"Turn killswitch on",description:"With the killswitch on, an account whose quota falls below one of its floors is not used.",group:_$,knobs:[{kind:"toggle",id:"enabled",label:"Killswitch",value:!B}],run:async({values:j})=>{let D=j.enabled===!0;return await X.updateSettings((U)=>{U.killswitch={...l0(U.killswitch),enabled:D};return},G),`Killswitch ${D?"on":"off"}.`}}]}}}async function T4($){let Z=await $J($.store);return[ZJ($,Z),XJ($,Z),JJ($,Z),BJ($,Z)]}var QJ=new Set(["accounts","quota","routing","limits","cache","diagnostics"]),Y3=["accounts","quota","routing","limits"];function A4($,Z){let{sessionId:X}=$,J=$.notify.bind($);return Object.freeze({...X!==void 0?{sessionId:X}:{},notify:(G,z)=>z===void 0?J(Z(String(G))):J(Z(String(G)),z)})}function YJ($,Z){switch($.kind){case"choice":{let X=Z??$.value;if(typeof X==="string"&&$.choices.some((J)=>J.value===X))return{value:X};return{problem:`Choose one of the options for ${$.label}.`}}case"toggle":{let X=Z??$.value;return typeof X==="boolean"?{value:X}:{problem:`${$.label} must be on or off.`}}case"number":{let X=Z===void 0?$.value??null:Z;if(X===null||X==="")return $.required?{problem:`${$.label} needs a number.`}:{value:null};let J=typeof X==="number"?X:Number(X);if(typeof X==="boolean"||!Number.isFinite(J))return{problem:`${$.label} needs a number.`};if($.min!==void 0&&J<$.min)return{problem:`${$.label} must be at least ${$.min}.`};if($.max!==void 0&&J>$.max)return{problem:`${$.label} must be at most ${$.max}.`};return{value:J}}case"text":{let X=Z===void 0?$.value??null:Z;if(X===null||X==="")return $.required?{problem:`${$.label} cannot be empty.`}:{value:null};return typeof X==="string"?{value:X}:{problem:`${$.label} must be text.`}}}}function HJ($,Z){let X={};for(let J of $){let G=Z&&Object.hasOwn(Z,J.id)?Z[J.id]:void 0,z=YJ(J,G);if("problem"in z)return z;X[J.id]=z.value}return{values:X}}function WJ($,Z){let X=$.find((G)=>G.id===Z.sectionId);if(!X)return;return(Z.itemId===void 0?X.content.actions:X.content.items?.find((G)=>G.id===Z.itemId)?.actions)?.find((G)=>G.id===Z.actionId)}function _1($){let Z=$.logger??a("commands"),X=B3($.redaction),J={logger:Z,redact:X},G=$.now??Date.now,z=$.extras??[],B=$.replace??{},Q=Y3.filter((j)=>!B[j]);for(let j of Y3)if(B[j]&&$[j]!==void 0)throw Error(`the ${j} section is replaced; its built-in options cannot also be given`);let Y=$.store;if(Q.length>0&&!Y)throw Error(`a store is required for the built-in ${Q.join(", ")} section${Q.length>1?"s":""}`);let H=new Set;for(let j of z){if(QJ.has(j.id)||H.has(j.id))throw Error(`extra section id ${j.id} is taken`);H.add(j.id)}async function W(j,D,U,N){try{return{id:j,slot:D,title:U.title,content:await U.build(N)}}catch(K){return Z.warn("command menu section failed to build",{command:$.command,section:j,error:X(K instanceof Error?K.message:String(K))}),{id:j,slot:D,title:U.title,content:{lines:["This section could not be loaded."]}}}}async function V(j){let D=Y&&Q.length>0?await T4({store:Y,now:G,...$.extraLocks?{extraLocks:$.extraLocks}:{},...$.accounts?{accounts:$.accounts}:{},...$.quota?{quota:$.quota}:{},...$.routing?{routing:$.routing}:{},...$.limits?{limits:$.limits}:{}}):[],U=[];for(let N of Y3){let K=B[N];if(K)U.push(await W(N,N,K,j));else{let M=D.find((P)=>P.slot===N);if(M)U.push(M)}}if($.cache)U.push(await W("cache","cache",$.cache,j));if($.diagnostics)U.push(await W("diagnostics","diagnostics",$.diagnostics,j));for(let N of z)U.push(await W(N.id,"extra",N,j));return U}return{command:$.command,async open(j){let D=A4(j,X);return F4($.command,$.title,await V(D),J)},async apply(j,D){let U=A4(D,X),N=async(F)=>L4($.command,$.title,await V(U),F,J),K=j.command===$.command?WJ(await V(U),j):void 0;if(!K)return N({ok:!1,code:"unavailable",text:"That action is no longer available."});let M=Q3(K);if(M&&j.confirmed!==!0)return N({ok:!1,code:"needs-confirmation",text:M.message,needsConfirmation:!0});let P=HJ(K.knobs??[],j.values);if("problem"in P)return N({ok:!1,code:"invalid-input",text:P.problem});let E;try{let F=await K.run({values:P.values,...j.itemId!==void 0?{itemId:j.itemId}:{},invocation:U});E=typeof F==="string"?{ok:!0,text:F}:{ok:F.ok,text:F.text,...F.ok?{}:{code:F.code??"refused"}}}catch(F){let q=L$(F);Z.warn("command menu action failed",{command:$.command,section:j.sectionId,action:j.actionId,code:q.code,error:X(F instanceof Error?F.message:String(F))}),E={ok:!1,...q}}return N(E)}}}async function O$($,Z,X){let J=new Map,G=[];for(let B of X){let Q=B.label;for(let Y=2;J.has(Q);Y++)Q=`${B.label} (${Y})`;J.set(Q,B.value),G.push(Q)}let z=await $.select(Z,G);return z===void 0?void 0:J.get(z)}function S4($,Z){return Z.length>0?`${$}
 ${Z.join(`
-`)}`:$}function R6($){return $.status?`${$.label} · ${$.status}`:$.label}function zJ($){let Z=[...$.lines],X;for(let J of $.items){if(J.actions.length>0)continue;if(J.group!==void 0&&J.group!==X)Z.push(J.group);X=J.group,Z.push(J.group!==void 0?`  ${R6(J)}`:R6(J))}return Z}function QJ($){let Z=$.detail?[$.detail]:[];for(let[X,J]of Object.entries($.facts??{}))Z.push(`${X}: ${String(J)}`);return L4(R6($),Z)}async function BJ($,Z){switch(Z.kind){case"choice":{let X=await O$($,Z.label,Z.choices.map((J)=>({label:J.value===Z.value?`${J.label} (current)`:J.label,value:J.value})));return X===void 0?void 0:{value:X}}case"toggle":{let X=await O$($,Z.label,[{label:Z.value?"On (current)":"On",value:!0},{label:Z.value?"Off":"Off (current)",value:!1}]);return X===void 0?void 0:{value:X}}case"number":{let X=Z.min!==void 0&&Z.max!==void 0?` (${Z.min}-${Z.max}${Z.required?"":", empty clears"})`:Z.required?"":" (empty clears)",J=await $.input(`${Z.label}${X}`,Z.value!==void 0?String(Z.value):void 0);if(J===void 0)return;let G=J.trim();if(G==="")return Z.required&&Z.value!==void 0?{value:Z.value}:{value:null};let z=Number(G);if(!Number.isFinite(z)){$.notify(`${Z.label} needs a number.`,"error");return}return{value:z}}case"text":{let X=await $.input(Z.label,Z.value??Z.placeholder);if(X===void 0)return;let J=X.trim();if(J==="")return Z.required&&Z.value!==void 0?{value:Z.value}:{value:null};return{value:J}}}}async function HJ($,Z){let X={};for(let J of Z.knobs){let G=await BJ($,J);if(!G)return;X[J.id]=G.value}return X}async function Q3($,Z,X={}){let J={...X.sessionId!==void 0?{sessionId:X.sessionId}:{},notify:(z,Q)=>Z.notify(z,Q)},G=(await $.open(J)).menu;for(;;){let z=await O$(Z,G.title,G.sections.map((Q)=>({label:Q.lines[0]?`${Q.title}: ${Q.lines[0]}`:Q.title,value:Q.id})));if(z===void 0)return;for(;;){let Q=G.sections.find((V)=>V.id===z);if(!Q)break;let B=[...Q.items.filter((V)=>V.actions.length>0).map((V)=>({label:R6(V),value:{kind:"item",item:V}})),...Q.actions.map((V)=>({label:V.label,value:{kind:"action",action:V}}))],H=zJ(Q);if(B.length===0&&H.length===0){Z.notify("Nothing to do here.");break}let Y=await O$(Z,L4(Q.title,H),[...B,{label:"Back",value:{kind:"back"}}]);if(!Y||Y.kind==="back")break;let W,U;if(Y.kind==="item"){if(U=Y.item,W=await O$(Z,QJ(U),U.actions.map((V)=>({label:V.label,value:V}))),!W)continue}else W=Y.action;let j=await HJ(Z,W);if(!j)continue;if(W.confirm){if(!await Z.confirm(W.label,W.confirm.message)){Z.notify("Cancelled.");continue}}let K=await $.apply({command:G.command,sectionId:Q.id,...U?{itemId:U.id}:{},actionId:W.id,values:j,...W.confirm?{confirmed:!0}:{},...X.sessionId!==void 0?{sessionId:X.sessionId}:{}},J);Z.notify(K.text,K.ok?"info":"error"),G=K.menu}}}import{createHash as AG,randomUUID as RG}from"node:crypto";import{setTimeout as EG}from"node:timers/promises";var YJ=Object.freeze({sidebar:Object.freeze({name:"sidebar-write",ttlMs:1e4,timeoutMs:15000,renew:!0}),preferences:Object.freeze({name:"preferences",ttlMs:1e4,timeoutMs:2000,renew:!0})});import{createHash as WJ}from"node:crypto";var VJ=86400000,UJ=300000,jJ=3600000,DJ=60000,KJ=900000,qJ=300000;function B3($){return $ instanceof Error?$.message:String($)}function H3($){let Z=$?.status;if(typeof Z==="number")return Z===429||Z>=500;if(!($ instanceof Error))return!1;return $.name==="AbortError"||$.name==="TimeoutError"||$.message.includes("fetch failed")||"code"in $&&($.code==="ECONNRESET"||$.code==="ECONNREFUSED"||$.code==="ETIMEDOUT"||$.code==="UND_ERR_CONNECT_TIMEOUT")}function Y3($){let Z=B3($),X=$?.status;if(typeof X==="number")return X===429||X>=500;if(!($ instanceof Error))return!1;let J=$.code;return $.name==="AbortError"||$.name==="TimeoutError"||Z.includes("fetch failed")||J==="ECONNRESET"||J==="ECONNREFUSED"||J==="ETIMEDOUT"||J==="UND_ERR_CONNECT_TIMEOUT"}function i1($){return WJ("sha256").update($).digest("hex")}function E6($){let Z=i1($.refreshToken),J=($.previous?.tokenHash===Z?$.previous.retryCount??0:0)+1,G,z=$.error?.retryAfter;if(typeof z==="number"&&z>0)G=z*1000;else if(H3($.error))G=Math.min(jJ,UJ*2**Math.min(J-1,6));else G=VJ;return{message:B3($.error),checkedAt:$.now,nextRetryAt:$.now+G,retryCount:J,tokenHash:Z}}function Z1($,Z,X){if(!$?.nextRetryAt||$.nextRetryAt<=X)return!1;if(!Z)return!0;return $.tokenHash===i1(Z)}function C$($,Z){return`Codex OAuth refresh is backed off for ${Math.max(1,Math.ceil((($.nextRetryAt??Z)-Z)/1000))}s after: ${$.message}`}function P$($){let X=($.previous?.retryCount??0)+1,J,G=$.error?.retryAfter;if(typeof G==="number"&&G>0)J=G*1000;else if(Y3($.error))J=Math.min(KJ,DJ*2**Math.min(X-1,6));else J=qJ;return{message:B3($.error),checkedAt:$.now,nextRetryAt:$.now+J,retryCount:X}}function a1($,Z){if(!$?.nextRetryAt||$.nextRetryAt<=Z)return!1;return!0}function W3($){if(!$)return;let Z=Number($);if(Number.isFinite(Z)&&Z>0)return Math.ceil(Z);let X=Date.parse($);if(Number.isFinite(X)){let J=Math.ceil((X-Date.now())/1000);return J>0?J:void 0}return}function NJ($){return $==="chatgptaccountid"||$==="email"||$==="orgname"||$==="organizationname"}var _4=I0({extraSecretKeys:NJ}),mW=_4.redact,O4=_4.redactStrings;import{createServer as C4}from"node:http";import{setTimeout as MJ}from"node:timers/promises";var x6="app_EMoamEEZ73f0CkXaXp7hrann",P1="https://auth.openai.com",S$=1455,FJ=3000,LJ="cortexkit-opencode-openai-auth";function T4($){return`${LJ}/${$}`}var S4="main",_J=`"${S4}" is a reserved account id; choose a different label.`;function A4($){let Z=new Uint8Array($),X=String.fromCharCode(...Z);return btoa(X).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function OJ(){let Z=Array.from(crypto.getRandomValues(new Uint8Array(43))).map((J)=>"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"[J%66]).join(""),X=A4(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(Z)));return{verifier:Z,challenge:X}}function n1($){if($.length>16384)return;let Z=$.split(".");if(Z.length!==3)return;let X=Z[1];if(!X||X.length>8192)return;try{return JSON.parse(Buffer.from(X,"base64url").toString())}catch{return}}function r1($){let Z=$.chatgpt_account_id;if(typeof Z==="string"&&Z.length>0)return Z;let X=$["https://api.openai.com/auth"];if(X&&typeof X==="object"&&!Array.isArray(X)&&typeof X.chatgpt_account_id==="string"&&X.chatgpt_account_id.length>0)return X.chatgpt_account_id;let J=$.organizations;if(Array.isArray(J)){let G=J[0];if(G&&typeof G==="object"&&!Array.isArray(G)&&typeof G.id==="string"&&G.id.length>0)return G.id}return}function A$($){if($.id_token){let Z=n1($.id_token),X=Z&&r1(Z);if(X)return X}if($.access_token){let Z=n1($.access_token);return Z?r1(Z):void 0}return}function CJ($){return typeof $==="string"&&$.toLowerCase()===S4}function V3($){if(CJ($))throw Error(_J);return $}function PJ($,Z,X){let J=new URLSearchParams({response_type:"code",client_id:x6,redirect_uri:$,scope:"openid profile email offline_access",code_challenge:Z.challenge,code_challenge_method:"S256",id_token_add_organizations:"true",codex_cli_simplified_flow:"true",state:X,originator:"opencode"});return`${P1}/oauth/authorize?${J.toString()}`}async function TJ($,Z,X){let J=await fetch(`${P1}/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:$,redirect_uri:Z,client_id:x6,code_verifier:X.verifier}).toString()});if(!J.ok)throw Error(`Token exchange failed: ${J.status}`);return await J.json()}function SJ($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&#39;")}var AJ=`<!doctype html>
+`)}`:$}function E6($){return $.status?`${$.label} · ${$.status}`:$.label}function VJ($){let Z=[...$.lines],X;for(let J of $.items){if(J.actions.length>0)continue;if(J.group!==void 0&&J.group!==X)Z.push(J.group);X=J.group,Z.push(J.group!==void 0?`  ${E6(J)}`:E6(J))}return Z}function UJ($){let Z=$.detail?[$.detail]:[];for(let[X,J]of Object.entries($.facts??{}))Z.push(`${X}: ${String(J)}`);return S4(E6($),Z)}async function jJ($,Z){switch(Z.kind){case"choice":{let X=await O$($,Z.label,Z.choices.map((J)=>({label:J.value===Z.value?`${J.label} (current)`:J.label,value:J.value})));return X===void 0?void 0:{value:X}}case"toggle":{let X=await O$($,Z.label,[{label:Z.value?"On (current)":"On",value:!0},{label:Z.value?"Off":"Off (current)",value:!1}]);return X===void 0?void 0:{value:X}}case"number":{let X=Z.min!==void 0&&Z.max!==void 0?` (${Z.min}-${Z.max}${Z.required?"":", empty clears"})`:Z.required?"":" (empty clears)",J=await $.input(`${Z.label}${X}`,Z.value!==void 0?String(Z.value):void 0);if(J===void 0)return;let G=J.trim();if(G==="")return Z.required&&Z.value!==void 0?{value:Z.value}:{value:null};let z=Number(G);if(!Number.isFinite(z)){$.notify(`${Z.label} needs a number.`,"error");return}return{value:z}}case"text":{let X=await $.input(Z.label,Z.value??Z.placeholder);if(X===void 0)return;let J=X.trim();if(J==="")return Z.required&&Z.value!==void 0?{value:Z.value}:{value:null};return{value:J}}}}async function DJ($,Z){let X={};for(let J of Z.knobs){let G=await jJ($,J);if(!G)return;X[J.id]=G.value}return X}async function H3($,Z,X={}){let J={...X.sessionId!==void 0?{sessionId:X.sessionId}:{},notify:(z,B)=>Z.notify(z,B)},G=(await $.open(J)).menu;for(;;){let z=await O$(Z,G.title,G.sections.map((B)=>({label:B.lines[0]?`${B.title}: ${B.lines[0]}`:B.title,value:B.id})));if(z===void 0)return;for(;;){let B=G.sections.find((U)=>U.id===z);if(!B)break;let Q=[...B.items.filter((U)=>U.actions.length>0).map((U)=>({label:E6(U),value:{kind:"item",item:U}})),...B.actions.map((U)=>({label:U.label,value:{kind:"action",action:U}}))],Y=VJ(B);if(Q.length===0&&Y.length===0){Z.notify("Nothing to do here.");break}let H=await O$(Z,S4(B.title,Y),[...Q,{label:"Back",value:{kind:"back"}}]);if(!H||H.kind==="back")break;let W,V;if(H.kind==="item"){if(V=H.item,W=await O$(Z,UJ(V),V.actions.map((U)=>({label:U.label,value:U}))),!W)continue}else W=H.action;let j=await DJ(Z,W);if(!j)continue;if(W.confirm){if(!await Z.confirm(W.label,W.confirm.message)){Z.notify("Cancelled.");continue}}let D=await $.apply({command:G.command,sectionId:B.id,...V?{itemId:V.id}:{},actionId:W.id,values:j,...W.confirm?{confirmed:!0}:{},...X.sessionId!==void 0?{sessionId:X.sessionId}:{}},J);Z.notify(D.text,D.ok?"info":"error"),G=D.menu}}}import{createHash as kG,randomUUID as yG}from"node:crypto";import{setTimeout as fG}from"node:timers/promises";var KJ=Object.freeze({sidebar:Object.freeze({name:"sidebar-write",ttlMs:1e4,timeoutMs:15000,renew:!0}),preferences:Object.freeze({name:"preferences",ttlMs:1e4,timeoutMs:2000,renew:!0})});import{createHash as qJ}from"node:crypto";var NJ=86400000,MJ=300000,FJ=3600000,LJ=60000,_J=900000,OJ=300000;function W3($){return $ instanceof Error?$.message:String($)}function V3($){let Z=$?.status;if(typeof Z==="number")return Z===429||Z>=500;if(!($ instanceof Error))return!1;return $.name==="AbortError"||$.name==="TimeoutError"||$.message.includes("fetch failed")||"code"in $&&($.code==="ECONNRESET"||$.code==="ECONNREFUSED"||$.code==="ETIMEDOUT"||$.code==="UND_ERR_CONNECT_TIMEOUT")}function U3($){let Z=W3($),X=$?.status;if(typeof X==="number")return X===429||X>=500;if(!($ instanceof Error))return!1;let J=$.code;return $.name==="AbortError"||$.name==="TimeoutError"||Z.includes("fetch failed")||J==="ECONNRESET"||J==="ECONNREFUSED"||J==="ETIMEDOUT"||J==="UND_ERR_CONNECT_TIMEOUT"}function a1($){return qJ("sha256").update($).digest("hex")}function I6($){let Z=a1($.refreshToken),J=($.previous?.tokenHash===Z?$.previous.retryCount??0:0)+1,G,z=$.error?.retryAfter;if(typeof z==="number"&&z>0)G=z*1000;else if(V3($.error))G=Math.min(FJ,MJ*2**Math.min(J-1,6));else G=NJ;return{message:W3($.error),checkedAt:$.now,nextRetryAt:$.now+G,retryCount:J,tokenHash:Z}}function Z1($,Z,X){if(!$?.nextRetryAt||$.nextRetryAt<=X)return!1;if(!Z)return!0;return $.tokenHash===a1(Z)}function C$($,Z){return`Codex OAuth refresh is backed off for ${Math.max(1,Math.ceil((($.nextRetryAt??Z)-Z)/1000))}s after: ${$.message}`}function P$($){let X=($.previous?.retryCount??0)+1,J,G=$.error?.retryAfter;if(typeof G==="number"&&G>0)J=G*1000;else if(U3($.error))J=Math.min(_J,LJ*2**Math.min(X-1,6));else J=OJ;return{message:W3($.error),checkedAt:$.now,nextRetryAt:$.now+J,retryCount:X}}function n1($,Z){if(!$?.nextRetryAt||$.nextRetryAt<=Z)return!1;return!0}function j3($){if(!$)return;let Z=Number($);if(Number.isFinite(Z)&&Z>0)return Math.ceil(Z);let X=Date.parse($);if(Number.isFinite(X)){let J=Math.ceil((X-Date.now())/1000);return J>0?J:void 0}return}function CJ($){return $==="chatgptaccountid"||$==="email"||$==="orgname"||$==="organizationname"}var R4=I0({extraSecretKeys:CJ}),cW=R4.redact,E4=R4.redactStrings;import{createServer as I4}from"node:http";import{setTimeout as PJ}from"node:timers/promises";var k6="app_EMoamEEZ73f0CkXaXp7hrann",P1="https://auth.openai.com",A$=1455,TJ=3000,AJ="cortexkit-opencode-openai-auth";function x4($){return`${AJ}/${$}`}var k4="main",SJ=`"${k4}" is a reserved account id; choose a different label.`;function y4($){let Z=new Uint8Array($),X=String.fromCharCode(...Z);return btoa(X).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function RJ(){let Z=Array.from(crypto.getRandomValues(new Uint8Array(43))).map((J)=>"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"[J%66]).join(""),X=y4(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(Z)));return{verifier:Z,challenge:X}}function r1($){if($.length>16384)return;let Z=$.split(".");if(Z.length!==3)return;let X=Z[1];if(!X||X.length>8192)return;try{return JSON.parse(Buffer.from(X,"base64url").toString())}catch{return}}function o1($){let Z=$.chatgpt_account_id;if(typeof Z==="string"&&Z.length>0)return Z;let X=$["https://api.openai.com/auth"];if(X&&typeof X==="object"&&!Array.isArray(X)&&typeof X.chatgpt_account_id==="string"&&X.chatgpt_account_id.length>0)return X.chatgpt_account_id;let J=$.organizations;if(Array.isArray(J)){let G=J[0];if(G&&typeof G==="object"&&!Array.isArray(G)&&typeof G.id==="string"&&G.id.length>0)return G.id}return}function S$($){if($.id_token){let Z=r1($.id_token),X=Z&&o1(Z);if(X)return X}if($.access_token){let Z=r1($.access_token);return Z?o1(Z):void 0}return}function EJ($){return typeof $==="string"&&$.toLowerCase()===k4}function D3($){if(EJ($))throw Error(SJ);return $}function IJ($,Z,X){let J=new URLSearchParams({response_type:"code",client_id:k6,redirect_uri:$,scope:"openid profile email offline_access",code_challenge:Z.challenge,code_challenge_method:"S256",id_token_add_organizations:"true",codex_cli_simplified_flow:"true",state:X,originator:"opencode"});return`${P1}/oauth/authorize?${J.toString()}`}async function bJ($,Z,X){let J=await fetch(`${P1}/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:$,redirect_uri:Z,client_id:k6,code_verifier:X.verifier}).toString()});if(!J.ok)throw Error(`Token exchange failed: ${J.status}`);return await J.json()}function xJ($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&#39;")}var kJ=`<!doctype html>
 <html>
   <head>
     <title>CortexKit OpenAI Auth - Authorization Successful</title>
@@ -47,7 +47,7 @@ ${Z.join(`
       setTimeout(() => window.close(), 2000)
     </script>
   </body>
-</html>`,I6=($)=>`<!doctype html>
+</html>`,b6=($)=>`<!doctype html>
 <html>
   <head>
     <title>CortexKit OpenAI Auth - Authorization Failed</title>
@@ -90,33 +90,33 @@ ${Z.join(`
     <div class="container">
       <h1>Authorization Failed</h1>
       <p>An error occurred during authorization.</p>
-      <div class="error">${SJ($)}</div>
+      <div class="error">${xJ($)}</div>
     </div>
   </body>
-</html>`,b6=[],T$,l0=new Map;function P4($,Z){return new Promise((X,J)=>{let G=(Q)=>{$.off("listening",z),J(Q)},z=()=>{$.off("error",G),X()};$.once("error",G),$.once("listening",z),$.listen(S$,Z)})}function R4($){$.close(()=>{}),$.closeIdleConnections?.(),setTimeout(()=>{$.closeAllConnections?.()},25).unref?.()}function O1(){return l0.size}function T1($){if(l0.delete($),O1()===0)C1()}async function RJ(){let $=`http://localhost:${S$}/auth/callback`;if(b6.length>0)return{port:S$,redirectUri:$};if(T$)return T$;T$=(async()=>{let Z=(z,Q)=>{let B=new URL(z.url||"/",`http://127.0.0.1:${S$}`);if(B.pathname==="/auth/callback"){let H=B.searchParams.get("code"),Y=B.searchParams.get("state"),W=B.searchParams.get("error"),U=B.searchParams.get("error_description");if(W){let K=U||W;if(Y){let V=l0.get(Y);if(V)V.reject(Error(K)),T1(Y);else if(O1()===0)C1()}else if(O1()===0)C1();Q.writeHead(200,{"Content-Type":"text/html"}),Q.end(I6(K));return}if(!Y){if(O1()===0)C1();Q.writeHead(400,{"Content-Type":"text/html"}),Q.end(I6("Missing state parameter"));return}if(!H){if(O1()===0)C1();Q.writeHead(400,{"Content-Type":"text/html"}),Q.end(I6("Missing authorization code"));return}let j=l0.get(Y);if(!j){if(O1()===0)C1();Q.writeHead(400,{"Content-Type":"text/html"}),Q.end(I6("Unknown state — authorization may have expired"));return}T1(Y),TJ(H,$,j.pkce).then((K)=>j.resolve(K)).catch((K)=>j.reject(K)),Q.writeHead(200,{"Content-Type":"text/html"}),Q.end(AJ);return}if(B.pathname==="/cancel"){let H=B.searchParams.get("state"),Y=H?[H]:[...l0.keys()];Q.writeHead(200),Q.end("Login cancelled");for(let W of Y){let U=l0.get(W);if(!U)continue;U.reject(Error("Login cancelled")),T1(W)}if(O1()===0)C1();return}Q.writeHead(404),Q.end("Not found")},X=C4(Z);await P4(X,"127.0.0.1");let J=[X],G=C4(Z);try{await P4(G,"::1"),J.push(G)}catch(z){let Q=z.code;if(Q!=="EADDRNOTAVAIL"&&Q!=="EAFNOSUPPORT")throw R4(X),z}return b6=J,{port:S$,redirectUri:$}})();try{return await T$}finally{T$=void 0}}function C1(){let $=b6;b6=[];for(let Z of $)R4(Z)}function EJ($,Z,X=300000,J){return new Promise((G,z)=>{if(J?.aborted){T1(Z),z(Error("Login cancelled"));return}let Q=setTimeout(()=>{if(l0.get(Z))T1(Z),z(Error("OAuth callback timeout — authorization took too long"))},X),B=()=>{if(clearTimeout(Q),l0.get(Z))T1(Z),z(Error("Login cancelled"))};if(J)J.addEventListener("abort",B);l0.set(Z,{pkce:$,state:Z,resolve:(H)=>{if(clearTimeout(Q),J)J.removeEventListener("abort",B);G(H)},reject:(H)=>{if(clearTimeout(Q),J)J.removeEventListener("abort",B);z(H)}})})}async function IJ($){let Z=await fetch(`${P1}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"Content-Type":"application/json","User-Agent":T4($)},body:JSON.stringify({client_id:x6})});if(!Z.ok)throw Error("Failed to initiate device authorization");let X=await Z.json();return{deviceData:X,url:`${P1}/codex/device`,instructions:`Enter code: ${X.user_code}`}}async function bJ($,Z,X){let J=Math.max(parseInt($.interval,10)||5,1)*1000,G=typeof $.expires_in==="number"?$.expires_in:parseInt($.expires_in||"",10),z=!Number.isNaN(G)&&G>0?G*1000:900000,Q=Date.now();while(!0){if(X?.aborted)throw Error("Device authorization cancelled");if(Date.now()-Q>z)throw Error("Device authorization expired");let B=await fetch(`${P1}/api/accounts/deviceauth/token`,{method:"POST",headers:{"Content-Type":"application/json","User-Agent":T4(Z)},body:JSON.stringify({device_auth_id:$.device_auth_id,user_code:$.user_code})});if(B.ok){let W=await B.json(),U=await fetch(`${P1}/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:W.authorization_code,redirect_uri:`${P1}/deviceauth/callback`,client_id:x6,code_verifier:W.code_verifier}).toString()});if(!U.ok)throw Error(`Token exchange failed: ${U.status}`);return await U.json()}if(B.status!==403&&B.status!==404)throw Error(`Device authorization failed: ${B.status}`);let H=z-(Date.now()-Q);if(H<=0)throw Error("Device authorization expired");let Y=Math.min(J+FJ,H);try{await MJ(Y,void 0,{signal:X})}catch(W){if(W instanceof Error&&W.name==="AbortError")throw Error("Device authorization cancelled");throw W}}}async function E4($){let{label:Z,headless:X=!1,signal:J,version:G}=$;if(V3(Z),X){let{deviceData:W,url:U,instructions:j}=await IJ(G),K=(async()=>{let V=await bJ(W,G,J),N=Date.now(),q=A$(V);return{id:V3(Z||q||crypto.randomUUID()),label:Z||void 0,type:"oauth",access:V.access_token,refresh:V.refresh_token,expires:N+(V.expires_in??3600)*1000,enabled:!0,addedAt:N,lastUsed:N,lastRefreshedAt:N,accountId:q}})();return{url:U,instructions:j,completion:K}}let{redirectUri:z}=await RJ(),Q=await OJ(),B=A4(crypto.getRandomValues(new Uint8Array(32)).buffer),H=PJ(z,Q,B),Y=(async()=>{try{if(J?.aborted)throw Error("Login cancelled");let W=await EJ(Q,B,void 0,J),U=Date.now(),j=A$(W);return{id:V3(Z||j||crypto.randomUUID()),label:Z||void 0,type:"oauth",access:W.access_token,refresh:W.refresh_token,expires:U+(W.expires_in??3600)*1000,enabled:!0,addedAt:U,lastUsed:U,lastRefreshedAt:U,accountId:j}}finally{T1(B)}})();return{url:H,instructions:"Complete authorization in your browser. This window will close automatically.",completion:Y}}import{basename as xJ,dirname as kJ,join as yJ}from"node:path";var k6="openai-auth.json",I4="openai-auth-state.json";function U3($){return xJ($)===k6?yJ(kJ($),I4):`${$}.state.json`}function y6($){if($==null||$==="")return;let Z=typeof $==="number"?$:Number($);if(Number.isFinite(Z)){let J=Z<100000000000?Z*1000:Z,G=new Date(J);return Number.isNaN(G.getTime())?void 0:G.toISOString()}let X=new Date($);return Number.isNaN(X.getTime())?void 0:X.toISOString()}function j3($){let Z=Number($);return Number.isFinite(Z)&&Z>0?Z:void 0}function b4($){return typeof $==="number"&&Number.isFinite($)&&$>=0?$:void 0}function x4($,Z){let X=$.get(Z);if(X===null||X.trim()==="")return;let J=Number(X);if(!Number.isFinite(J)||J<0||J>100)return;let G=Z.slice(0,-13),z=j3($.get(`${G}-window-minutes`)),Q=y6($.get(`${G}-reset-at`)??void 0);if(J===0&&$.get(`${G}-window-minutes`)==="0"&&!Q)return;return{usedPercent:J,remainingPercent:100-J,resetsAt:Q,checkedAt:Date.now(),...z!==void 0?{windowMinutes:z}:{}}}var f4=["x-codex-primary-used-percent","x-codex-secondary-used-percent"];function g4($,Z){let X=$.get(Z);if(X===null)return"absent";if(X.trim()==="")return"invalid";let J=Number(X);return Number.isFinite(J)&&J>=0&&J<=100?"valid":"invalid"}function h4($){if(f4.some((G)=>g4($,G)==="invalid"))return{};let Z={},X=x4($,"x-codex-primary-used-percent");if(X)Z.primary=X;let J=x4($,"x-codex-secondary-used-percent");if(J)Z.secondary=J;return Z}function v4($){let Z=f4.map((X)=>g4($,X));return Z.includes("valid")&&!Z.includes("invalid")}function k4($){if(!$)return;if(!Number.isFinite($.used_percent)||$.used_percent<0||$.used_percent>100)return;let Z=j3($.window_minutes),X=y6($.reset_at);if($.used_percent===0&&Z===void 0&&!X)return;return{usedPercent:$.used_percent,remainingPercent:100-$.used_percent,resetsAt:X,checkedAt:Date.now(),...Z!==void 0?{windowMinutes:Z}:{}}}function m4($){let Z={},X=k4($.rate_limits?.primary);if(X)Z.primary=X;let J=k4($.rate_limits?.secondary);if(J)Z.secondary=J;return Z}function o1($){if($==null||$==="")return;let Z=Number($);return Number.isFinite(Z)&&Z>=0?Z:void 0}function y4($){if(!$)return;if(!Number.isFinite($.used_percent)||$.used_percent<0||$.used_percent>100)return;let Z=j3($.limit_window_seconds),X=y6($.reset_at);if($.used_percent===0&&Z===void 0&&!X)return;return{usedPercent:$.used_percent,remainingPercent:100-$.used_percent,resetsAt:X,checkedAt:Date.now(),...Z!==void 0?{windowMinutes:Z/60}:{}}}function w4($){let Z={},X=y4($.rate_limit?.primary_window);if(X)Z.primary=X;let J=y4($.rate_limit?.secondary_window);if(J)Z.secondary=J;let G=b4($.rate_limit_reset_credits?.available_count);if(G!==void 0)Z.resetCreditsAvailable=G;let z=b4($.rate_limit_reset_credits?.applicable_available_count);if(z!==void 0)Z.resetCreditsApplicable=z;let Q=$.spend_control?.individual_limit;if($.spend_control===null||Q===null)Z.spendControlCleared=!0;if(Q&&typeof $.spend_control?.reached==="boolean"){let H=o1(Q.limit),Y=o1(Q.used),W=o1(Q.remaining),U=o1(Q.used_percent),j=o1(Q.remaining_percent);if(H!==void 0&&Y!==void 0&&W!==void 0&&U!==void 0&&j!==void 0)Z.spendControl={limit:H,used:Y,remaining:W,usedPercent:U,remainingPercent:j,resetsAt:y6(Q.reset_at),unit:Q.unit,source:Q.source,reached:$.spend_control.reached}}let B=$.credits;if(B&&typeof B.has_credits==="boolean"&&typeof B.unlimited==="boolean"&&typeof B.overage_limit_reached==="boolean"){let H=o1(B.balance);Z.credits={hasCredits:B.has_credits,unlimited:B.unlimited,overageLimitReached:B.overage_limit_reached,...H!==void 0?{balance:H}:{}}}return Z}import{ClaustrumClient as UG}from"@cortexkit/claustrum-client";import{resolve as p4}from"node:path";import{storeIdentity as fJ}from"@cortexkit/claustrum-client";import{SubcClient as gJ}from"@cortexkit/subc-client";function u4($){let Z=$.identity??fJ($.projectRoot??process.cwd(),$.storagePath??process.cwd());return{connectionFile:$.connectionFile,async getUsage(){let X,J=!1,G,z=new Promise((B,H)=>{G=setTimeout(()=>H(Error("insula usage timeout")),3000),G.unref?.()}),Q=(async()=>{if(X=$.connector?await $.connector({connectionFile:$.connectionFile,handshakeTimeoutMs:Math.min($.handshakeTimeoutMs??3000,3000)}):await gJ.connect({connectionFile:$.connectionFile,handshakeTimeoutMs:Math.min($.handshakeTimeoutMs??3000,3000)}),J)throw X.close(),Error("insula usage timeout");let B=await X.routeOpen({kind:"management_surface",module_id:"insula"},Z);return await X.request(B,{method:"usage.get",params:{}})})();try{return await Promise.race([Q,z])}finally{J=!0,clearTimeout(G),X?.close()}}}}var q3=60000,hJ=4*q3,D3=new Map,f6=new Map;function K3($){return typeof $==="object"&&$!==null&&!Array.isArray($)}class l4{transport;key;#$=[];#Z;constructor($,Z){this.transport=$,this.key=Z}refresh($){if(this.#Z)return this.#Z;for(let[X,J]of f6)if($-J>=q3)f6.delete(X);let Z=f6.get(this.key);if(Z!==void 0&&$-Z<q3)return Promise.resolve();return f6.set(this.key,$),this.#Z=(async()=>{try{let X=await this.transport.getUsage();if(!K3(X)||!Array.isArray(X.result)||X.error!==void 0)throw Error("unavailable insula usage");this.#$=X.result.filter((J)=>K3(J)&&typeof J.provider==="string")}catch{this.#$=[]}})().finally(()=>{this.#Z=void 0}),this.#Z}current($,Z,X){for(let J of this.#$){if(J.provider!==$||typeof J.account!=="string"||J.account.trim()!==Z)continue;if(J.stale!==void 0||J.errorClass!==void 0||!K3(J.usage))continue;let G=typeof J.fetchedAt==="string"?Date.parse(J.fetchedAt):Number.NaN;if(!Number.isFinite(G)||X-G>=hJ)continue;return{entry:J,context:{fetchedAt:G,...typeof J.source==="string"&&{source:J.source}}}}return}}function d4($,Z){let X=JSON.stringify([p4($.connectionFile),p4(Z)]),J=D3.get(X);if(!J)J={source:new l4($,X),refs:0},D3.set(X,J);J.refs++;let G=!1;return{source:J.source,release(){if(G)return;if(G=!0,--J.refs===0)D3.delete(X)}}}import{ClaustrumCredentialError as pV}from"@cortexkit/claustrum-client";function N3($){let Z=new AbortController,X=[],J=!1,G=()=>{if(J)return;J=!0;for(let{source:B,listener:H}of X)B.removeEventListener("abort",H);X.length=0},z=(B)=>{if(J||Z.signal.aborted)return;Z.abort(B),G()},Q=$.find((B)=>B.aborted);if(Q)return Z.abort(Q.reason),{signal:Z.signal,dispose:G};for(let B of $){if(Z.signal.aborted)break;let H=()=>z(B.reason);if(X.push({source:B,listener:H}),B.addEventListener("abort",H,{once:!0}),B.aborted)z(B.reason)}return{signal:Z.signal,dispose:G}}import{ClaustrumCredentialError as tJ}from"@cortexkit/claustrum-client";import{createHash as vJ,randomBytes as mJ,randomUUID as wJ}from"node:crypto";import{constants as c4}from"node:fs";import{chmod as pJ,mkdir as uJ,open as r4,readFile as M3,realpath as lJ,rename as dJ,stat as o4,unlink as t4}from"node:fs/promises";import{basename as e4,dirname as J1,extname as s4,isAbsolute as i4,join as L3,resolve as cJ}from"node:path";import{ClaustrumCredentialError as sJ,ClaustrumClient as iJ,writeEnrollmentTokenFile as aJ}from"@cortexkit/claustrum-client";class A extends Error{kind;constructor($,Z){super(Z);this.name="ClaustrumConsumerError",this.kind=$}}var nJ=1,h6=16384,$2=30000,_3=/^[0-9a-f]{64}$/,Z2=new Set(["invalid_params","pending_exists","not_found","already_consumed","superseded","stale_generation"]),X2=new Set(["pending_queue_full"]);function F3($){if(!($ instanceof sJ))return;if(Z2.has($.code))return{code:$.code,disposition:"terminal"};if(X2.has($.code))return{code:$.code,disposition:"retry"};return{code:$.code,disposition:$.action==="retry"?"retry":"terminal"}}function O3($,Z){if(!/^[a-z0-9][a-z0-9-]*$/.test($)||!/^[a-z0-9][a-z0-9-]*$/.test(Z))throw new A("invalid-state","Claustrum enrollment names use lowercase letters, digits and dashes");return`${$}-${Z}`}function C3($){return iJ.connect($)}function J2($){let Z=s4($)||".json",X=e4($,s4($));return{statePath:L3(J1($),`${X}-state${Z}`),tokenPath:$}}function P3($){let Z=$.override?.trim();if(Z&&!i4(Z)&&!$.cwd)throw new A("invalid-state","A relative Claustrum enrollment override needs a base directory");let X=Z?i4(Z)?Z:cJ($.cwd,Z):L3($.stateDir,`${$.host}-enrollment.json`);return J2(X)}function G2($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function g6($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0}function z2($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=1}function R$(){return new A("invalid-state","invalid Claustrum enrollment state")}function m6($){if(!G2($)||$.version!==nJ||typeof $.proposedName!=="string"||$.proposedName.length===0)throw R$();if($.phase==="pending"){if(!_3.test(String($.requestSecret??""))||$.requestId!==void 0&&(typeof $.requestId!=="string"||$.requestId.length===0)||!g6($.createdAt)||!g6($.updatedAt))throw R$();return{version:1,phase:"pending",proposedName:$.proposedName,requestSecret:$.requestSecret,...$.requestId!==void 0&&{requestId:$.requestId},createdAt:$.createdAt,updatedAt:$.updatedAt}}if($.phase==="approved"){if($.approvedName!==void 0&&(typeof $.approvedName!=="string"||$.approvedName.length===0)||!z2($.tokenGeneration)||!g6($.updatedAt))throw R$();return{version:1,phase:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration,updatedAt:$.updatedAt}}if($.phase==="denied"||$.phase==="blocked"){if($.errorCode!==void 0&&typeof $.errorCode!=="string"||!g6($.updatedAt))throw R$();return{version:1,phase:$.phase,proposedName:$.proposedName,...$.errorCode!==void 0&&{errorCode:$.errorCode},updatedAt:$.updatedAt}}throw R$()}function T3($){if(!G2($)||!_3.test(String($.token??""))||!z2($.token_generation))throw new A("invalid-token","invalid Claustrum enrollment token file");return{token:$.token,token_generation:$.token_generation}}function rJ($){if(!$.isFile())throw new A("unsafe-file","Claustrum enrollment file must be a regular file");if(($.mode&63)!==0)throw new A("unsafe-file","Claustrum enrollment file must be owner-only");let Z=process.geteuid?.();if(Z!==void 0&&$.uid!==Z)throw new A("unsafe-file","Claustrum enrollment file must be owned by the current user")}function a4($){try{return JSON.parse($)}catch{throw new A("invalid-state","Claustrum enrollment file is not valid JSON")}}async function G1($){if(R)try{await q0(J1($));let X=await F0($,!0);if(Buffer.byteLength(X)>h6)throw new A("unsafe-file","Claustrum enrollment file is too large");return a4(X)}catch(X){if(X.code==="ENOENT")return;throw X}let Z;try{Z=await r4($,c4.O_RDONLY|c4.O_NOFOLLOW)}catch(X){if(X.code==="ENOENT")return;throw new A("unsafe-file","Claustrum enrollment file could not be opened safely")}try{rJ(await Z.stat());let X=Buffer.alloc(h6+1),{bytesRead:J}=await Z.read(X,0,X.byteLength,0);if(J>h6)throw new A("unsafe-file","Claustrum enrollment file is too large");return a4(X.subarray(0,J).toString("utf8"))}finally{await Z.close()}}function n4($,Z){let X=[];for(let J of $.split(`
-`)){if(J.trim()===""||J.startsWith("#"))continue;let G=J.split(":");if(G.length!==Z||!/^[^\s:,]+$/.test(G[0]??"")||!/^\d+$/.test(G[2]??"")||!Number.isSafeInteger(Number(G[2]))||Z===7&&(!/^\d+$/.test(G[3]??"")||!Number.isSafeInteger(Number(G[3])))||Z===4&&G[3]!==""&&!/^[^\s:,]+(?:,[^\s:,]+)*$/.test(G[3]??""))return;X.push(G)}return X}async function oJ($,Z,X){try{let[J,G]=await Promise.all([M3(X.passwdPath??"/etc/passwd","utf8"),M3(X.groupPath??"/etc/group","utf8")]),z=n4(J,7),Q=n4(G,4);if(!z||!Q)return!1;let B=z.filter((U)=>Number(U[2])===$),H=Q.filter((U)=>Number(U[2])===Z);if(B.length!==1||H.length!==1)return!1;let Y=B[0]?.[0],W=H[0]?.[3]??"";return(W===""||W.split(",").every((U)=>U===Y))&&!z.some((U)=>Number(U[2])!==$&&Number(U[3])===Z)}catch{return!1}}function Q2($){if(!$.passwdPath&&!$.groupPath)return;return{fs:{readFile:(Z)=>M3(Z==="/etc/passwd"?$.passwdPath??Z:Z==="/etc/group"?$.groupPath??Z:Z)}}}async function B2($,Z={}){if(!R){let X=process.geteuid?.();if(X===void 0)return;let J=process.getegid?.(),G;try{G=await lJ($)}catch{return}let z;for(;;){let Q=await o4(G).catch(()=>{return});if(Q&&(Q.mode&18)!==0&&(Q.mode&512)===0){if(z===void 0)z=J!==void 0&&await oJ(X,J,Z);if((Q.mode&2)!==0||Q.uid!==X||Q.gid!==J||!z)throw new A("unsafe-file",`Claustrum enrollment path has a writable ancestor: ${G}. Another user could replace it. Run: chmod g-w,o-w ${G}`)}let B=J1(G);if(B===G)return;G=B}}try{await h0($,Q2(Z))}catch(X){if(!(X instanceof l))throw X;throw new A("unsafe-file",`Claustrum enrollment parent refused: ${X.path} (${X.reason??X.code}). Use a folder that other users cannot write or replace.`)}}async function v6($,Z={}){if(R){await q0($,!1,Q2(Z));return}await uJ($,{recursive:!0,mode:448});let X=await o4($),J=process.geteuid?.();if(J!==void 0&&X.uid!==J)throw new A("unsafe-file","Claustrum enrollment directory must be owned by the current user");if((X.mode&63)!==0)await pJ($,448)}async function S1($,Z,X={}){let J=J1($);await v6(J,X),await B2(J,X);let G=`${JSON.stringify(Z)}
-`;if(Buffer.byteLength(G)>h6)throw new A("invalid-state","Claustrum enrollment state is too large");if(R)return h1($,G);let z=L3(J,`.${e4($)}.${process.pid}.${wJ()}.tmp`),Q,B=!1;try{Q=await r4(z,"wx",384),B=!0,await Q.writeFile(G,"utf8"),await Q.chmod(384),await Q.sync(),await Q.close(),Q=void 0,await dJ(z,$),B=!1}finally{if(await Q?.close().catch(()=>{}),B)await t4(z).catch(()=>{})}}async function E$($,Z){let X=await G1($.tokenPath),J=X===void 0?void 0:T3(X),G=await G1($.statePath),z=G===void 0?void 0:m6(G);if(J)return{state:"approved",proposedName:z?.proposedName??Z,...z?.phase==="approved"&&z.approvedName!==void 0&&{approvedName:z.approvedName},tokenGeneration:J.token_generation};if(!z)return{state:"idle"};if(z.phase==="approved")return{state:"blocked",proposedName:z.proposedName,code:"missing_token"};return X1(z)}async function S3($,Z){let X;try{X=await E$($,Z)}catch(J){if(!(J instanceof A)||J.kind!=="invalid-state"&&J.kind!=="invalid-token")return"unreadable";try{let G=await G1($.statePath);if(G===void 0)return"unreadable";let z=m6(G);return z.phase==="approved"&&z.proposedName===Z?"vault":"unreadable"}catch{return"unreadable"}}if("proposedName"in X&&X.proposedName!==Z)return"unreadable";if(X.state==="approved"||X.state==="blocked"&&X.code==="missing_token")return"vault";return"local"}async function A1($){let Z=await G1($);if(Z===void 0)throw new A("not-enrolled","Claustrum enrollment is not configured");return T3(Z)}function X1($){if($.phase==="pending")return{state:"pending",proposedName:$.proposedName,...$.requestId!==void 0&&{requestId:$.requestId}};if($.phase==="approved")return{state:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration};if($.phase==="denied")return{state:"denied",proposedName:$.proposedName};return{state:"blocked",proposedName:$.proposedName,code:$.errorCode??"unknown"}}function H2(){return new A("wrong-consumer","Claustrum enrollment state belongs to a different consumer")}class w6{#$;#Z;#Q;#G;#z;#B;#X;constructor($){this.#X=$.ancestorOptions??{},this.#$=$.client,this.#Z=$.paths,this.#Q=$.proposedName,this.#G=$.now??Date.now,this.#z=$.mintSecret??(()=>mJ(32).toString("hex")),this.#B=$.writeTokenFile??aJ}async status(){return E$(this.#Z,this.#Q)}async resetTerminal(){return Y2(this.#Z,this.#Q)}async#H($,Z){let X={version:1,phase:"blocked",proposedName:$.proposedName,errorCode:Z,updatedAt:this.#G()};return await S1(this.#Z.statePath,X,this.#X),X1(X)}async reconcile(){await v6(J1(this.#Z.statePath),this.#X);let $=await e({name:"ceremony",path:this.#Z.statePath,ttlMs:$2,renew:!0});if(!$)return{state:"busy"};try{let Z=await G1(this.#Z.tokenPath),X=Z===void 0?void 0:T3(Z),J=await G1(this.#Z.statePath),G=J===void 0?void 0:m6(J);if(G&&G.proposedName!==this.#Q)throw H2();if(X){if(!G||G.phase==="pending"){let Q={version:1,phase:"approved",proposedName:G?.proposedName??this.#Q,tokenGeneration:X.token_generation,updatedAt:this.#G()};await S1(this.#Z.statePath,Q,this.#X),G=Q}return{state:"approved",proposedName:G.proposedName,...G.phase==="approved"&&G.approvedName!==void 0&&{approvedName:G.approvedName},tokenGeneration:X.token_generation}}if(G?.phase==="approved"){let Q={version:1,phase:"blocked",proposedName:G.proposedName,errorCode:"missing_token",updatedAt:this.#G()};return await S1(this.#Z.statePath,Q,this.#X),X1(Q)}if(G&&G.phase!=="pending")return X1(G);if(!G){let Q=this.#G();if(G={version:1,phase:"pending",proposedName:this.#Q,requestSecret:this.#z(),createdAt:Q,updatedAt:Q},!_3.test(G.requestSecret))throw new A("invalid-state","invalid minted Claustrum enrollment secret");await S1(this.#Z.statePath,G,this.#X)}if(!G.requestId)try{let Q=vJ("sha256").update(Buffer.from(G.requestSecret,"hex")).digest("hex"),B=await this.#$.enrollPropose({name:G.proposedName,requestSecretHash:Q});G={...G,requestId:B.requestId,updatedAt:this.#G()},await S1(this.#Z.statePath,G,this.#X)}catch(Q){let B=F3(Q);if(!B)throw Q;if(B.disposition==="retry")return{state:"pending",proposedName:G.proposedName,retryCode:B.code};return this.#H(G,B.code)}let z=G.requestId;if(!z)return X1(G);try{let Q=await this.#$.enrollPoll({requestId:z,requestSecret:G.requestSecret});if(Q.status==="pending")return X1(G);if(Q.status==="denied"){let H={version:1,phase:"denied",proposedName:G.proposedName,updatedAt:this.#G()};return await S1(this.#Z.statePath,H,this.#X),X1(H)}await v6(J1(this.#Z.tokenPath),this.#X),await B2(J1(this.#Z.tokenPath),this.#X),await this.#B(this.#Z.tokenPath,{token:Q.token,token_generation:Q.tokenGeneration});let B={version:1,phase:"approved",proposedName:G.proposedName,approvedName:Q.name,tokenGeneration:Q.tokenGeneration,updatedAt:this.#G()};return await S1(this.#Z.statePath,B,this.#X),X1(B)}catch(Q){let B=F3(Q);if(!B)throw Q;if(B.disposition==="retry")return{state:"pending",proposedName:G.proposedName,requestId:z,retryCode:B.code};return this.#H(G,B.code)}}finally{await $.release()}}}async function Y2($,Z){await v6(J1($.statePath));let X=await e({name:"ceremony",path:$.statePath,ttlMs:$2,renew:!0});if(!X)return"busy";try{if(await G1($.tokenPath)!==void 0)return"refused-approved";let J=await G1($.statePath);if(J===void 0)return"idle";let G=m6(J);if(G.proposedName!==Z)throw H2();if(G.phase==="pending")return"refused-pending";return await X.assertOwned(),await t4($.statePath),"reset"}finally{await X.release()}}var I$="claustrum-tombstone:v1:";function p6($){return`${I$}${$}`}function A3($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function u6($){return typeof $==="string"&&$.startsWith(I$)}function W2($,Z){if(!A3($)||$.type!=="oauth")return!1;return $.refresh===p6(Z)}function V2($,Z){if(W2($,Z))return"placeholder";if(A3($)&&$.type==="oauth"&&typeof $.refresh==="string"&&$.refresh.length>0&&!u6($.refresh))return"login";if(A3($)&&$.type==="api"&&typeof $.key==="string"&&$.key.length>0)return"login";return"empty"}function R3($){let Z=V2($.auth,$.provider);if($.mode==="custody"&&Z==="login")throw new A("host-slot-login",`${$.provider} has a host login while its accounts are vault-custodied; refusing to serve until one is removed`);if($.mode==="local"&&Z==="placeholder")throw new A("host-slot-placeholder",`${$.provider} host slot holds the vault placeholder; sign in to use local accounts`);return Z}function U2($,Z){return Z!==void 0&&Z.credentialId===$.credentialId&&Z.accountIdentity===$.accountIdentity&&Z.recordVersion!==$.recordVersion}function eJ($,Z){if(Z===void 0)return"reauthorize-failed";if(Z.credentialId!==$.credentialId)return"credential-changed";if(Z.accountIdentity!==$.accountIdentity)return"account-changed";if(Z.recordVersion===$.recordVersion)return"version-unchanged";return"rotated"}var j2=i("claustrum");function b3($,Z,X,J=j2){let G=U2(Z,X);return J.debug("scoped 401 re-authorized",{site:$,credentialId:Z.credentialId,servedVersion:Z.recordVersion,currentVersion:X?.recordVersion??null,retry:G,reason:eJ(Z,X)}),G}var I3=300000;function E3(){return new A("invalid-material","Claustrum returned invalid credential material")}function $G($){let Z=$.trim();if(Z.startsWith("{")){let X;try{X=JSON.parse(Z)}catch{throw E3()}if(!X||typeof X!=="object")throw E3();let J=X,G=J.access_token??J.access;Z=typeof G==="string"?G:""}if(!/^[\x21-\x7e]+$/.test(Z)||Z.startsWith(I$))throw E3();return Z}function ZG($,Z){if(!$.operations.includes("read"))return;if(!$.categories.includes(Z.category))return;if($.credentialType==="oauth")return $.refreshAdapter===Z.refreshAdapter?"oauth":void 0;if($.credentialType==="api_key"&&Z.apiKeys)return $.refreshAdapter===void 0?"api_key":void 0;return}class l6{#$;#Z;#Q;#G;#z;#B;#X;#H=new WeakMap;#V=new WeakMap;#Y=!1;constructor($){let Z=$.tokenPath;if($.readToken)this.#Z=$.readToken;else if(Z)this.#Z=()=>A1(Z);else throw new A("not-enrolled","Claustrum enrollment token path is required");this.#$=$.client,this.#G=$.family,this.#z=$.parseIdentity,this.#B=$.requireAssertion??!1,this.#Q=$.now??Date.now,this.#X=$.logger??j2}#J($){if(this.#Y)throw new A("closed","Claustrum scoped custody is closed");$?.throwIfAborted()}async#W($){this.#J($);let Z=await this.#Z();if(this.#J($),!/^[0-9a-f]{64}$/.test(Z.token)||!Number.isSafeInteger(Z.token_generation)||Z.token_generation<1)throw new A("invalid-token","Invalid Claustrum enrollment token");return Z.token}async#U($,Z){this.#J(Z);let X,J;try{let G=$();X=Z?await Promise.race([G,new Promise((z,Q)=>{let B=()=>Q(Z.reason);if(Z.addEventListener("abort",B,{once:!0}),J=()=>Z.removeEventListener("abort",B),Z.aborted)B()})]):await G}catch(G){if(this.#J(Z),G instanceof tJ)throw G;throw new A("unavailable","Claustrum scoped operation unavailable")}finally{J?.()}return this.#J(Z),X}async discover($){let Z=await this.#W($),X=await this.#U(()=>this.#$.listScoped(Z),$),J=[],G=[],z=new Map;for(let B of X.rows){let H=ZG(B,this.#G);if(!H)continue;G.push({row:B,type:H}),z.set(B.id,(z.get(B.id)??0)+1)}let Q=[];for(let{row:B,type:H}of G){let Y;if(!B.id.trim())Y="empty credential id";else if((z.get(B.id)??0)>1)Y="duplicate credential id";else if(B.accountId!==void 0&&!B.accountId.trim())Y="blank account identity";else if(!B.state.trim())Y="empty state";if(Y){J.push({...B.id.trim()&&{credentialId:B.id},reason:Y});continue}Q.push(Object.freeze({credentialId:B.id,credentialType:H,...B.accountId!==void 0&&{accountIdentity:B.accountId},state:B.state,...B.email!==void 0&&{email:B.email},...B.orgName!==void 0&&{orgName:B.orgName}}))}for(let B of J)this.#X.warn("skipped malformed vault record",B);return{view:X.view,credentials:Object.freeze(Q),skipped:Object.freeze(J)}}async authorize($,Z){if(!$.credentialId)throw new A("route-unavailable","Claustrum dispatch requires a credential id");let{credentialId:X,credentialType:J,accountIdentity:G}=$;if(this.#B&&G===void 0)throw new A("identity-unasserted","Claustrum dispatch requires a known account identity");let z=await this.#W(Z),Q=await this.#U(()=>this.#$.getScoped({credentialId:X,enrollmentToken:z,...J==="oauth"&&{minTtlMs:I3}}),Z);if(Q.credentialId!==void 0&&Q.credentialId!==X)throw new A("identity-changed","Claustrum served credential identity changed");let B=Q.expiresAtMs;if(!Number.isSafeInteger(Q.recordVersion)||Q.recordVersion<0||B===null&&J==="oauth"||B!==null&&(!Number.isFinite(B)||B-this.#Q()<I3))throw new A("insufficient-validity","Claustrum served credential has insufficient validity");let H=$G(Q.material),Y=Q.accountId?.trim()?Q.accountId:void 0;if(this.#B&&(Q.credentialId===void 0||Y===void 0))throw new A("identity-unasserted","Claustrum served credential did not assert its identity");let W=Y===void 0?this.#z?.(H):void 0,U=Y??W;if(G!==void 0&&U!==void 0&&U!==G)throw new A("identity-changed","Claustrum served credential identity changed");let j=U??G,V=Object.freeze(Object.defineProperty({credentialId:X,credentialType:J,...j!==void 0&&{accountIdentity:j},accountIdentitySource:Y!==void 0?"asserted":W!==void 0?"parsed":G!==void 0?"expected":"none",...G!==void 0&&{expectedAccountIdentity:G},...Q.credentialId!==void 0&&{assertedCredentialId:Q.credentialId},...Y!==void 0&&{assertedAccountIdentity:Y},...Q.projectId!==void 0&&{projectId:Q.projectId},recordVersion:Q.recordVersion,expiresAtMs:B},"accessToken",{value:H,enumerable:!1}));return this.#H.set(V,z),V}async reportFailure($,Z,X){if(Z!==401)return;this.#J();let J=this.#H.get($);if(!J)throw new A("no-receipt","Claustrum failure report requires an original dispatch receipt");let G=this.#V.get($);if(G)return G;let z=this.#U(()=>this.#$.reportAuthFailureScoped({credentialId:$.credentialId,enrollmentToken:J,providerStatus:401,recordVersion:$.recordVersion,reporterSource:X}));this.#V.set($,z);try{await z,this.#X.debug("scoped 401 reported",{credentialId:$.credentialId,recordVersion:$.recordVersion,reporterSource:X})}catch(Q){throw this.#V.delete($),Q}}close(){if(this.#Y)return;this.#Y=!0,this.#$.close()}}import{createHash as XG}from"node:crypto";function D2($,Z,X){if($.accountIdentity!==void 0&&X!==void 0)return $.accountIdentity===X;return $.credentialId===Z}function x3($,Z,X){return $.some((J)=>D2(J,Z,X))}function k3($,Z,X){let J={credentialId:Z,...X!==void 0&&{accountIdentity:X}};return[...$.filter((G)=>G.credentialId!==Z||G.accountIdentity!==X),J]}function y3($,Z,X){return $.filter((J)=>!Z.some((G)=>D2(J,G,X)))}var q2="vault:";function JG($){return XG("sha256").update($).digest("hex")}function GG($){let Z=$.credentialId.split(":");return(Z.length>=3?Z.slice(2).join(":").trim():void 0)||$.email||$.credentialId}function zG($){return $.identity!==void 0?`identity:${$.identity}`:`credential:${$.credential.credentialId}`}function z1($){return[$.credentialId,...$.aliases??[]]}function N2($,Z,X={}){let J=X.now??Date.now(),G=X.routePrefix??q2,z=X.reservedRouteIds??new Set,Q=$?.rows??[],B=[...$?.declined??[]],H=Z.skipped.length===0,Y=new Set(Z.credentials.map((F)=>F.credentialId)),W=new Set(Z.skipped.flatMap((F)=>F.credentialId===void 0?[]:[F.credentialId])),U=Z.skipped.some((F)=>F.credentialId===void 0),j=(F)=>!Y.has(F)&&(W.has(F)||U),K=new Map;for(let F of Q){if(F.accountIdentity===void 0)continue;for(let D of z1(F))if(!K.has(D))K.set(D,F.accountIdentity)}let V=new Map;for(let F of Z.credentials){let D=F.accountIdentity!==void 0?{credential:F,identity:F.accountIdentity,claimed:!0}:{credential:F,identity:K.get(F.credentialId),claimed:!1},L=zG(D),S=V.get(L)??[];S.push(D),V.set(L,S)}let N=new Set,q=new Set(z),M=[],P=(F,D)=>F.credential.credentialId.localeCompare(D.credential.credentialId),E=[...V.values()].map((F)=>F.toSorted(P)).sort((F,D)=>F[0]&&D[0]?P(F[0],D[0]):0);for(let F of E){let D=F[0]?.identity,L=F.filter((g)=>g.credential.state==="active"),S=L.length?L:F,v=S.filter((g)=>g.claimed),u=v.length?v:S,n=new Set(F.map((g)=>g.credential.credentialId)),f=Q.find((g)=>!N.has(g)&&z1(g).some((f0)=>n.has(f0))&&(g.accountIdentity===void 0||g.accountIdentity===D)),k=u.find((g)=>g.credential.credentialId===f?.credentialId)??u[0];if(!k)continue;let y=k.credential,r=f??(D===void 0?void 0:Q.find((g)=>!N.has(g)&&g.accountIdentity===D));if(r)N.add(r);let d=r?.routeId;if(!d||z.has(d)){let g=`${G}${y.credentialId}${D===void 0?"":`~${JG(D).slice(0,10)}`}`;d=g;for(let f0=2;q.has(d);f0++)d=`${g}~${f0}`}q.add(d);let n$=r?z1(r).filter(j):[],b1=[...new Set([...F.map((g)=>g.credential.credentialId),...n$])].filter((g)=>g!==y.credentialId).sort((g,f0)=>g.localeCompare(f0)),r$=X.mapAccount?.(y)??{};M.push({previousIndex:r?Q.indexOf(r):1/0,row:{routeId:d,credentialId:y.credentialId,credentialType:y.credentialType,...D!==void 0&&{accountIdentity:D},...b1.length&&{aliases:b1},state:y.state,label:r$.label?.trim()||GG(y),...y.email!==void 0&&{email:y.email},...y.orgName!==void 0&&{orgName:y.orgName},enabled:![y.credentialId,...b1].some((g)=>x3(B,g,D)),addedAt:r?.addedAt??J,...r?.quota!==void 0&&{quota:r.quota},...!k.claimed&&D!==void 0&&{unclaimed:!0}}})}return Q.forEach((F,D)=>{if(N.has(F)||!z1(F).some(j))return;if(q.has(F.routeId))return;let[L,...S]=z1(F).filter((n)=>!Y.has(n));if(L===void 0)return;q.add(F.routeId);let{aliases:v,...u}=F;M.push({previousIndex:D,row:{...u,credentialId:L,...S.length&&{aliases:S},stale:!0}})}),M.sort((F,D)=>F.previousIndex===D.previousIndex?F.row.credentialId.localeCompare(D.row.credentialId):F.previousIndex-D.previousIndex),{version:1,view:Z.view,complete:H,...!H&&{rejected:Z.skipped.map((F)=>({...F.credentialId!==void 0&&{credentialId:F.credentialId},reason:F.reason}))},rows:M.map((F)=>F.row),declined:B}}function f3($){return($?.rows??[]).filter((Z)=>Z.enabled&&Z.state==="active").map((Z)=>({id:Z.routeId,kind:Z.credentialType==="oauth"?"oauth":"api-key",...Z.quota!==void 0&&{quota:Z.quota}}))}function b$($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function t1($){return $===void 0||typeof $==="string"}function QG($){let Z=b$($)?q1($.quota):void 0;if(!b$($)||typeof $.routeId!=="string"||typeof $.credentialId!=="string"||$.credentialType!=="oauth"&&$.credentialType!=="api_key"||typeof $.state!=="string"||typeof $.label!=="string"||typeof $.enabled!=="boolean"||typeof $.addedAt!=="number"||!t1($.accountIdentity)||!t1($.email)||!t1($.orgName)||$.aliases!==void 0&&(!Array.isArray($.aliases)||!$.aliases.every((X)=>typeof X==="string"))||$.quota!==void 0&&Z===void 0||$.stale!==void 0&&$.stale!==!0||$.unclaimed!==void 0&&$.unclaimed!==!0)return;return{...$,...Z===void 0?{}:{quota:Z}}}var BG=new Set(["empty credential id","duplicate credential id","blank account identity","empty state"]);function K2($){if(!Array.isArray($))return;let Z=[];for(let X of $){if(!b$(X)||!t1(X.credentialId)||typeof X.reason!=="string"||!BG.has(X.reason))return;Z.push(X)}return Z}function HG($){if(!b$($)||$.version!==1||!t1($.view)||!Array.isArray($.rows)||!Array.isArray($.declined)||$.complete!==void 0&&typeof $.complete!=="boolean"||$.rejected!==void 0&&!K2($.rejected))throw new A("invalid-state","Claustrum roster file is not valid");let Z=[];for(let G of $.rows){let z=QG(G);if(!z)throw new A("invalid-state","Claustrum roster file is not valid");Z.push(z)}let X=[];for(let G of $.declined){if(!b$(G)||typeof G.credentialId!=="string"||!t1(G.accountIdentity))throw new A("invalid-state","Claustrum roster file is not valid");X.push(G)}let J=K2($.rejected);return{version:1,...typeof $.view==="string"&&{view:$.view},complete:$.complete!==!1,...J&&{rejected:J},rows:Z,declined:X}}async function _0($){let Z;try{Z=await F0($,R)}catch(J){if(J.code==="ENOENT")return;throw J}let X;try{X=JSON.parse(Z)}catch{throw new A("invalid-state","Claustrum roster file is not valid")}return HG(X)}var YG={name:"claustrum-roster-write",ttlMs:1e4,timeoutMs:5000},WG={name:"claustrum-roster",ttlMs:30000};async function e1($,Z,X={}){return hZ($,YG,async(J)=>{let G=await _0($),{next:z,result:Q}=await Z(G,{assertOwned:()=>J.assertOwned()});if(z)await J.assertOwned(),await L0($,z,{beforeRename:async()=>{await X.beforePublish?.(),await J.assertOwned()}});return Q})}function g3($,Z){return e1($,(X)=>{let J=X?.rows.find((z)=>z.routeId===Z);if(!X||!J)throw new A("route-unavailable","Claustrum route is not in the roster");let G=k3(X.declined,J.credentialId,J.accountIdentity);return{next:{...X,declined:G,rows:X.rows.map((z)=>z===J?{...z,enabled:!1}:z)},result:void 0}})}function h3($,Z){return e1($,(X)=>{let J=X?.rows.find((G)=>G.routeId===Z);if(!X||!J)throw new A("route-unavailable","Claustrum route is not in the roster");return{next:{...X,declined:y3(X.declined,z1(J),J.accountIdentity),rows:X.rows.map((G)=>G===J?{...G,enabled:!0}:G)},result:void 0}})}function VG($,Z){if(!z1($).includes(Z.credentialId))return"refuse";if($.unclaimed&&(Z.accountIdentitySource==="expected"||Z.accountIdentitySource==="none"))return"refuse";if($.accountIdentity===Z.accountIdentity)return"hold";if($.accountIdentity===void 0&&Z.expectedAccountIdentity===void 0&&Z.accountIdentity!==void 0&&(Z.accountIdentitySource==="asserted"||Z.accountIdentitySource==="parsed")&&z1($).length===1)return"bind";return"refuse"}function v3($,Z){return e1($,(X)=>{let J=X?.rows.find((B)=>B.routeId===Z.routeId),G=!X||!J?"refuse":VG(J,Z);if(!X||!J||G==="refuse")return{result:!1};let z=E0(J.quota,Z.observation),Q=G==="bind"?{accountIdentity:Z.accountIdentity,unclaimed:!0}:{};return{next:{...X,rows:X.rows.map((B)=>B===J?{...B,...Q,quota:z}:B)},result:!0}})}function m3($,Z){return e1($,(X)=>{let J=X?.rows.find((z)=>z.routeId===Z.routeId);if(!X||!J||J.accountIdentity===void 0||J.accountIdentity!==Z.accountIdentity)return{result:!1};let G=E0(J.quota,Z.observation);return{next:{...X,rows:X.rows.map((z)=>z===J?{...z,quota:G}:z)},result:!0}})}async function w3($){$.signal?.throwIfAborted();let Z=async()=>await $.isActive?.()??!0;if(!await Z())return;let X=await e({...WG,path:$.path,renew:!0});if(!X){let J=await _0($.path);if($.signal?.throwIfAborted(),!J?.view)throw new A("roster-busy","Claustrum account discovery is already in progress");return J}try{let J=await $.custody.discover($.signal);return $.signal?.throwIfAborted(),await e1($.path,async(G)=>{if(!await Z())return{result:void 0};$.signal?.throwIfAborted(),await X.assertOwned();let z=typeof $.projection==="function"?$.projection():$.projection,Q=N2(G,J,z);return{...JSON.stringify(G)!==JSON.stringify(Q)&&{next:Q},result:Q}})}finally{await X.release()}}class d6{#$;#Z=new AbortController;#Q;#G;#z;#B;#X;#H;#V=!1;#Y;constructor($){this.#$=$,this.#Q=$.logger??i("claustrum")}#J($){this.#Z.signal.throwIfAborted(),$?.throwIfAborted()}async#W(){return await this.#$.isCustodyActive?.()??!0}#U($,Z){let X=N3([this.#Z.signal,...Z?[Z]:[]]);return new Promise((J,G)=>{let z=()=>{X.signal.removeEventListener("abort",Q),X.dispose()},Q=()=>{z(),G(X.signal.reason)};if(X.signal.addEventListener("abort",Q,{once:!0}),$.then((B)=>{if(z(),X.signal.aborted)G(X.signal.reason);else J(B)},(B)=>{z(),G(B)}),X.signal.aborted)Q()})}async#D(){if(this.#J(),this.#G)return this.#G;if(!this.#z)this.#z=this.#$.connect().then(($)=>{if(this.#Z.signal.aborted)$.close(),this.#J();if(this.#G=new l6({client:$,family:this.#$.family,tokenPath:this.#$.tokenPath,parseIdentity:this.#$.parseIdentity,requireAssertion:this.#$.requireAssertion,now:this.#$.now,logger:this.#Q}),this.#$.insula&&$.insula)this.#Y=d4($.insula,this.#$.tokenPath);return this.#G}).finally(()=>{this.#z=void 0});return this.#U(this.#z)}snapshot(){return this.#X}routingRows(){return f3(this.#X)}refresh(){if(this.#J(),this.#B)return this.#B;return this.#B=(async()=>{if(!await this.#W()){this.#X=void 0,this.#G?.close(),this.#G=void 0,this.#Y?.release(),this.#Y=void 0;return}let $=await this.#D(),Z=await w3({path:this.#$.rosterPath,custody:$,isActive:()=>this.#W(),signal:this.#Z.signal,projection:()=>({reservedRouteIds:new Set(this.#$.reservedRouteIds?.()??[]),routePrefix:this.#$.routePrefix,mapAccount:this.#$.mapAccount,now:(this.#$.now??Date.now)()})});this.#J();let X=Z?.view!==this.#X?.view;if(this.#X=Z,Z&&X)this.#$.onRoster?.(Z);return Z})().finally(()=>{this.#B=void 0}),this.#B}start(){if(this.#V)return;this.#J(),this.#V=!0;let $=async()=>{try{await this.refresh(),await this.refreshInsulaQuota()}catch(X){if(!this.#Z.signal.aborted)this.#$.onError?.(X)}if(this.#Z.signal.aborted)return;let Z=this.#$.pollIntervalMs??5000;if(Z<=0)return;this.#H=(this.#$.setTimeoutImpl??setTimeout)(()=>{this.#H=void 0,$()},Z),this.#H.unref?.()};$()}async refreshInsulaQuota(){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#W())return;try{await A1(this.#$.tokenPath),await this.#D(),await this.#Y?.source.refresh((this.#$.now??Date.now)())}catch{}}async cachedInsulaQuota($){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#W())return;try{return await A1(this.#$.tokenPath),this.#K($.assertedAccountIdentity)}catch{return}}async cachedInsulaQuotaForRoute($){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#W())return;try{await A1(this.#$.tokenPath);let X=(await _0(this.#$.rosterPath))?.rows.find((J)=>J.routeId===$);return this.#K(X?.accountIdentity)}catch{return}}#K($){if(!this.#$.insula||!$)return;let Z=this.#Y?.source.current(this.#$.insula.provider,$,(this.#$.now??Date.now)());return Z?this.#$.insula.normalize(Z.entry,Z.context):void 0}async authorize($,Z){this.#J(Z);let X=this.#X??await this.#U(this.refresh(),Z);if(!X||!await this.#W())throw new A("not-active","Claustrum scoped custody is not active");let J=await _0(this.#$.rosterPath);this.#J(Z);let G=X.rows.find((H)=>H.routeId===$),z=J?.rows.find((H)=>H.routeId===$);if(z&&!z.enabled)throw new A("route-declined","Claustrum route is disabled");if(!G||!z||z.state!=="active"||z.credentialId!==G.credentialId||z.accountIdentity!==G.accountIdentity)throw new A("route-unavailable","Claustrum route is disabled, removed or changed");let Q=await this.#U(this.#D(),Z),B=N3([this.#Z.signal,...Z?[Z]:[]]);try{return await Q.authorize({credentialId:z.credentialId,credentialType:z.credentialType,...z.accountIdentity!==void 0&&{accountIdentity:z.accountIdentity}},B.signal)}finally{B.dispose()}}async reportFailure($,Z,X){if(this.#J(),!this.#G)throw new A("no-receipt","Claustrum dispatch receipt has no active owner");await this.#G.reportFailure($,Z,X)}async send($,Z,X){let J=X.signal,G=await this.authorize($,J),z=await Z(G,J);if(z.status===401&&!J?.aborted){let Q;try{Q=await this.authorize($,J)}catch{}if(b3(X.site,G,Q,this.#Q))await z.body?.cancel().catch(()=>{}),G=Q,z=await Z(Q,J)}if(z.status===401)await this.reportFailure(G,401,X.reporterSource??"direct").catch((Q)=>this.#$.onError?.(Q)),Promise.resolve().then(()=>this.refresh()).catch((Q)=>{if(!this.#Z.signal.aborted)this.#$.onError?.(Q)});return z}async decline($){this.#J(),await g3(this.#$.rosterPath,$),this.#X=await _0(this.#$.rosterPath)}async accept($){this.#J(),await h3(this.#$.rosterPath,$),this.#X=await _0(this.#$.rosterPath)}async recordQuota($,Z,X){this.#J();let J=await v3(this.#$.rosterPath,{routeId:$,observation:Z,credentialId:X.credentialId,accountIdentitySource:X.accountIdentitySource,...X.accountIdentity!==void 0&&{accountIdentity:X.accountIdentity},...X.expectedAccountIdentity!==void 0&&{expectedAccountIdentity:X.expectedAccountIdentity}});if(J)this.#X=await _0(this.#$.rosterPath);return J}async recordAccountQuota($,Z,X){this.#J();let J=await m3(this.#$.rosterPath,{routeId:$,accountIdentity:Z,observation:X});if(J)this.#X=await _0(this.#$.rosterPath);return J}close(){if(this.#Z.signal.aborted)return;if(this.#Z.abort(new A("closed","Claustrum consumer is closed")),this.#H)(this.#$.clearTimeoutImpl??clearTimeout)(this.#H);this.#H=void 0,this.#G?.close(),this.#Y?.release(),this.#Y=void 0,this.#X=void 0}}async function M2($){let Z=await UG.connect($);return Object.assign(Z,{insula:u4($)})}var jG=p6("openai");function F2($){return u6($)}function k0($){if(!$||$.corrupt===!0)return!1;return F2($.refresh)}class x$ extends Error{code="tombstone-refresh";constructor(){super("This OpenAI account was moved into the Claustrum vault by an older version of OpenAI auth and holds no local credential. Connect the vault, or sign in to the account again.");this.name="TombstoneRefreshError"}}function c6($){if(F2($))throw new x$}function d0($){if($ instanceof Error)return $.message;if(typeof $==="string")return $;try{return JSON.stringify($)}catch{return String($)}}var DG=i("quota");var KG="app_EMoamEEZ73f0CkXaXp7hrann",qG="https://auth.openai.com";async function L2($){c6($.refreshToken);let Z=await $.fetchImpl(`${qG}/oauth/token`,{method:"POST",signal:AbortSignal.timeout(15000),headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"refresh_token",refresh_token:$.refreshToken,client_id:KG}).toString()});if(!Z.ok){let G=W3(Z.headers.get("retry-after"));throw Object.assign(Error(`Token refresh failed: ${Z.status}`),{status:Z.status,retryAfter:G,isRefreshError:!0})}let X=await Z.json();if(!X||typeof X.access_token!=="string"||!X.access_token||typeof X.expires_in!=="number")throw Object.assign(Error("Token refresh failed: malformed response"),{status:Z.status,isRefreshError:!0});if(X.refresh_token!==void 0&&typeof X.refresh_token!=="string")throw Object.assign(Error("Token refresh failed: malformed response"),{status:Z.status,isRefreshError:!0});let J=typeof X.refresh_token==="string"&&X.refresh_token?X.refresh_token:$.refreshToken;return{access:X.access_token,refresh:J,expires:$.now()+X.expires_in*1000,expiresIn:X.expires_in}}var NG="https://chatgpt.com/backend-api/wham/usage";async function $$($){let Z=$.logger??DG,X=$.accountKey??"unknown",J=Date.now();Z.debug("wham usage fetch started",{pid:process.pid,accountId:X});try{let G=await $.fetchImpl(NG,{signal:AbortSignal.timeout(15000),headers:{authorization:`Bearer ${$.accessToken}`,"chatgpt-account-id":$.accountId??"","oai-client-platform":"web","oai-client-version":"0","x-openai-target-path":"/backend-api/wham/usage"}});if(!G.ok){let Q=W3(G.headers.get("retry-after"));throw Object.assign(Error(`wham usage check failed: ${G.status}`),{status:G.status,retryAfter:Q})}let z=w4(await G.json());return Z.debug("wham usage fetch succeeded",{pid:process.pid,accountId:X,status:G.status,elapsedMs:Date.now()-J}),z}catch(G){throw Z.warn("wham usage fetch failed",{pid:process.pid,accountId:X,status:typeof G?.status==="number"?G.status:"error",elapsedMs:Date.now()-J,error:d0(G)}),G}}import{createHash as LG}from"node:crypto";var _G=globalThis.setTimeout,OG=5;function k$($){let Z=$?.quota?.checkIntervalMinutes??OG;return Math.max(1,Z)*60000}function CG($){return $?.quota?.enabled!==!1}function u3($,Z){if(!$?.resetsAt)return!1;let X=Date.parse($.resetsAt);return Number.isFinite(X)&&X<=Z}function PG($){let Z=$?.quota?.minimumRemaining||{};return{primary:Z.primary??Z["5h"]??15,secondary:Z.secondary??Z["1w"]??10}}function _2($,Z,X){if(!CG(Z))return X+k$(Z);let J=PG(Z),G=[];for(let z of["primary","secondary"]){let Q=$?.[z];if(!Q)continue;if(Q.remainingPercent>=J[z])continue;let B=Q.resetsAt?Date.parse(Q.resetsAt):Number.NaN;if(!Number.isFinite(B)||B<=X)return X+k$(Z);G.push(B)}if(!G.length)return X+k$(Z);return Math.min(...G)+60000}function TG($){if(!$?.quota?.mainQuota||!$.quota.mainQuotaCheckedAt)return null;return{quota:$.quota.mainQuota,checkedAt:$.quota.mainQuotaCheckedAt,tokenFingerprint:$.quota.mainQuotaToken}}function SG($){let Z=$?.quota?.refreshEveryNRequests;return typeof Z==="number"&&Number.isFinite(Z)&&Z>0?Math.floor(Z):0}function O0($){return LG("sha256").update($).digest("hex").slice(0,16)}class Q1{main=null;mainTokenFp=null;mainQuotaAccountId=null;fallbacks=new Map;fallbackTokenFps=new Map;inflightMain=null;inflightMainFp=null;inflightFallbacks=new Map;mainLastApiError=void 0;fallbackApiErrors=new Map;fallbackErrorTokenFps=new Map;rateLimitedUntilMap=new Map;apiGate=Promise.resolve();lastApiCallAt=0;storage;fetchImpl;now;fetchQuotaFn;onMainQuotaFetched;onApiError;configPath;constructor($){this.storage=$.storage,this.fetchImpl=$.fetchImpl??fetch,this.configPath=$.configPath,this.now=$.now??Date.now,this.fetchQuotaFn=$.fetchQuotaFn,this.onMainQuotaFetched=$.onMainQuotaFetched,this.onApiError=$.onApiError,this.seedMainFromStorage($.storage),this.seedMainBackoffFromStorage($.storage)}getMain($){if($&&this.main&&this.mainTokenFp&&this.mainTokenFp!==O0($))this.main=null,this.mainTokenFp=null;return this.main}getFallback($,Z){let X=this.fallbacks.get($)??null;if(!Z||!X)return X;if(this.fallbackTokenFps.get($)!==O0(Z))return this.fallbacks.delete($),this.fallbackTokenFps.delete($),null;return X}getAllFallbacks(){return this.fallbacks}setMain($,Z,X,J=!1){if(!J&&!O2(Z.quota))return;if(this.mainTokenFp=O0($),X&&this.mainQuotaAccountId&&this.mainQuotaAccountId!==X)this.clearRateLimited("main");if(X)this.mainQuotaAccountId=X;if(this.main=Z,p3(Z.quota))this.clearRateLimited("main")}peekMainForPolicy($){if($&&this.mainQuotaAccountId&&this.mainQuotaAccountId!==$)return null;return this.main}peekFallbackForPolicy($,Z){let X=this.fallbacks.get($)??null;if(Z&&X?.accountId&&X.accountId!==Z)return null;return X}setFallback($,Z,X,J=!1,G){if(!J&&!O2(Z.quota))return;let z=this.fallbacks.get($)?.accountId;if(G&&z&&G!==z)this.clearRateLimited($);let Q=G??z;if(this.fallbacks.set($,{...Z,accountId:Q}),X)this.fallbackTokenFps.set($,O0(X));else this.fallbackTokenFps.delete($);if(p3(Z.quota))this.clearRateLimited($)}markRateLimited($,Z){let X=this.rateLimitedUntilMap.get($);if(X!==void 0&&X>Z)return;this.rateLimitedUntilMap.set($,Z)}isRateLimited($){let Z=this.rateLimitedUntilMap.get($);return Z!==void 0&&this.now()<Z}rateLimitedUntil($){return this.rateLimitedUntilMap.get($)}clearRateLimited($){this.rateLimitedUntilMap.delete($)}async refreshMain($){let Z=O0($);if(this.mainTokenFp&&this.mainTokenFp!==Z)this.main=null,this.mainTokenFp=null;if(this.inflightMain&&this.inflightMainFp===Z)return this.inflightMain;if(this.isBackedOff()){if(this.main)return this.main.quota;throw Error("Quota API rate-limited — try again later")}return this.inflightMainFp=Z,this.inflightMain=this._fetchMain($),this.inflightMain}async refreshFallback($,Z){let X=Q1.fallbackInflightKey($,Z),J=this.inflightFallbacks.get(X);if(J)return J;if(this.isFallbackBackedOff($,Z)){let z=this.getFallback($,Z);if(z)return z.quota;throw Error("Quota API rate-limited — try again later")}let G=this._fetchFallback($,Z);return this.inflightFallbacks.set(X,G),G}async refreshAllFallbacks($){let Z=this.now();for(let X of $){if(X.enabled===!1)continue;if(k0(X)||!X.access)continue;let J=this.getFallback(X.id,X.access);if(J&&Z<J.refreshAfter)continue;try{await this.refreshFallback(X.id,X.access)}catch{}}}refreshMainInBackground($){let Z=O0($);if(this.inflightMain&&this.inflightMainFp===Z)return;if(this.isBackedOff())return;this.refreshMain($).catch(()=>{})}isMainStale(){if(!this.main)return!0;return this.now()>=this.main.refreshAfter}isFallbackStale($,Z){let X=this.getFallback($,Z);if(!X)return!0;return this.now()>=X.refreshAfter}shouldRefreshOnRequestCount($){let Z=SG(this.storage);if(Z<=0)return!1;return $>0&&$%Z===0}needsRefresh($){return this.isMainStale()||this.shouldRefreshOnRequestCount($)}updateStorage($){this.storage=$,this.seedMainFromStorage($),this.seedMainBackoffFromStorage($)}seedMainFromStorage($,Z){let X=TG($);if(!X)return;let J=Z?O0(Z):null;if(J&&X.tokenFingerprint&&X.tokenFingerprint!==J)return;let G={quota:X.quota,refreshAfter:_2(X.quota,$,X.checkedAt),checkedAt:X.checkedAt};if(this.main&&this.main.checkedAt>=G.checkedAt&&(!J||!this.mainTokenFp||this.mainTokenFp===J))return;if(this.main=G,this.mainTokenFp=X.tokenFingerprint??null,$?.mainAccountId){if(this.mainQuotaAccountId&&this.mainQuotaAccountId!==$.mainAccountId)this.clearRateLimited("main");this.mainQuotaAccountId=$.mainAccountId}}seedMainBackoffFromStorage($){let Z=$?.quota?.mainLastQuotaApiError;this.mainLastApiError=Z&&a1(Z,this.now())?Z:void 0}seedFallbacksFromAccounts($){let Z=k$(this.storage);for(let X of $){if(X.enabled===!1)continue;if(!X.quota)continue;let J=Math.max(X.quota.primary?.checkedAt??0,X.quota.secondary?.checkedAt??0);if(J<=0)continue;let G=this.getFallback(X.id,X.access);if(G&&G.checkedAt>=J)continue;this.setFallback(X.id,{quota:X.quota,refreshAfter:J+Z,checkedAt:J},X.access,!1,X.accountId)}}isBackedOff(){return a1(this.mainLastApiError,this.now())}isFallbackBackedOff($,Z){if(Z){if(this.fallbackErrorTokenFps.get($)!==O0(Z))return!1}return a1(this.fallbackApiErrors.get($),this.now())}getLastApiError(){return this.mainLastApiError}static API_CALL_GAP_MS=1000;static fallbackInflightKey($,Z){return JSON.stringify([$,O0(Z)])}static quotaLockName($){return`opencode-fallback-quota-refresh-${$.replace(/[^a-zA-Z0-9._-]+/g,"-")||"account"}`}_enqueueApiFetch($){let Z=async()=>{let J=this.now()-this.lastApiCallAt;if(J<Q1.API_CALL_GAP_MS)await new Promise((G)=>{let z=_G(G,Q1.API_CALL_GAP_MS-J);if(typeof z==="object"&&"unref"in z)z.unref()});return this.lastApiCallAt=this.now(),$()},X=this.apiGate.then(Z,Z);return this.apiGate=X.catch(()=>{}),X}async _fetchMain($){let Z=O0($);return this._enqueueApiFetch(async()=>{try{if(this.isBackedOff()){if(this.main)return this.main.quota;throw Error("Quota API rate-limited — try again later")}let X=await e({name:"opencode-main-quota-refresh",ttlMs:30000,path:this.configPath});if(!X){let J=this.main;if(J&&this.now()<J.refreshAfter)return J.quota;throw Error("Quota refresh is already in progress")}try{let J=this.now(),G=await this._fetchQuota($),z=this.now();if(this.mainTokenFp=O0($),this.main={quota:G,refreshAfter:_2(G,this.storage,z),checkedAt:z},p3(G))this.clearRateLimited("main");return this.mainLastApiError=void 0,this.onMainQuotaFetched?.(G,z,this.mainTokenFp,J),G}catch(J){throw this._handleMainFetchError(J),J}finally{await X.release()}}finally{if(this.inflightMainFp===Z)this.inflightMain=null,this.inflightMainFp=null}})}async _fetchFallback($,Z){return this._enqueueApiFetch(async()=>{try{if(this.isFallbackBackedOff($,Z)){let J=this.getFallback($,Z);if(J)return J.quota;throw Error("Quota API rate-limited — try again later")}let X=await e({name:Q1.quotaLockName($),ttlMs:30000,path:this.configPath});if(!X){let J=this.getFallback($,Z);if(J&&this.now()<J.refreshAfter)return J.quota;throw Error("Quota refresh is already in progress")}try{let J=await this._fetchQuota(Z),G=this.now();return this.setFallback($,{quota:J,refreshAfter:G+k$(this.storage),checkedAt:G},Z,!0),this.fallbackApiErrors.delete($),this.fallbackErrorTokenFps.delete($),J}finally{await X.release()}}catch(X){throw this._handleFallbackFetchError($,Z,X),X}finally{this.inflightFallbacks.delete(Q1.fallbackInflightKey($,Z))}})}async _fetchQuota($){if(!this.fetchQuotaFn)throw Error("Quota fetch not available — no fetchQuotaFn injected (push-only mode)");return this.fetchQuotaFn({accessToken:$,fetchImpl:this.fetchImpl,now:this.now})}static isAuthError($){return $?.status===401}_handleMainFetchError($){if(Q1.isAuthError($))return;this.mainLastApiError=P$({error:$,now:this.now(),previous:this.mainLastApiError}),this.onApiError?.(this.mainLastApiError)}_handleFallbackFetchError($,Z,X){if(Q1.isAuthError(X))return;let J=O0(Z),G=this.fallbackErrorTokenFps.get($)===J?this.fallbackApiErrors.get($):void 0;this.fallbackApiErrors.set($,P$({error:X,now:this.now(),previous:G})),this.fallbackErrorTokenFps.set($,J)}}function O2($){return Boolean($.primary||$.secondary)}function p3($){let{primary:Z,secondary:X}=$;if(!Z&&!X)return!1;if(Z&&Z.usedPercent>=100)return!1;if(X&&X.usedPercent>=100)return!1;return!0}import{readFile as uG}from"node:fs/promises";var R1=i("refresh"),c3=i("accounts"),IG=1e4,bG=15000,l3=50;function B1($){return $.type==="oauth"&&$.corrupt!==!0}function xG($){let Z=$?.trim();if(!Z)return!1;try{let X=new URL(Z);return(X.protocol==="http:"||X.protocol==="https:")&&!X.username&&!X.password}catch{return!1}}var X$="floors-v1";class i6 extends Error{code="ACCOUNT_REMOVED_DURING_REFRESH";constructor($){super(`Fallback account ${$} was removed before refresh`);this.name="AccountRemovedDuringRefreshError"}}var kG=[401,403,429],C2={primary:0,secondary:0},yG=!1,H1={primary:5,secondary:10};function b($){return $!=null&&typeof $==="object"&&!Array.isArray($)}var fG=new Set(["__proto__","constructor","prototype"]);function n3($){return $.length>0&&!fG.has($)}function gG($){return $ instanceof i6||b($)&&$.name==="AccountRemovedDuringRefreshError"&&$.code==="ACCOUNT_REMOVED_DURING_REFRESH"}function s6($){return{id:typeof $.id==="string"&&$.id.trim()?$.id.trim():RG(),label:typeof $.label==="string"?$.label:void 0,enabled:typeof $.enabled==="boolean"?$.enabled:void 0,addedAt:typeof $.addedAt==="number"?$.addedAt:void 0,lastUsed:typeof $.lastUsed==="number"?$.lastUsed:void 0,accountId:typeof $.accountId==="string"?$.accountId:void 0}}function P2($){if(!b($))return;if(typeof $.message!=="string")return;let Z=Number($.checkedAt);if(!Number.isFinite(Z))return;let X=Number($.nextRetryAt),J=Number($.retryCount);return{message:$.message,checkedAt:Z,nextRetryAt:Number.isFinite(X)?X:void 0,retryCount:Number.isFinite(J)?J:void 0,tokenHash:typeof $.tokenHash==="string"?$.tokenHash:void 0}}function hG($){if(!b($))return;let Z={};for(let G of["primary","secondary"]){let z=$[G];if(!b(z))continue;let Q=Number(z.usedPercent),B=Number(z.remainingPercent),H=Number(z.checkedAt);if(!Number.isFinite(Q)||!Number.isFinite(B)||!Number.isFinite(H))continue;let Y=typeof z.windowMinutes==="number"?z.windowMinutes:Number.NaN;Z[G]={usedPercent:Q,remainingPercent:B,checkedAt:H,resetsAt:typeof z.resetsAt==="string"?z.resetsAt:void 0,...Number.isFinite(Y)&&Y>0?{windowMinutes:Y}:{}}}for(let G of["resetCreditsAvailable","resetCreditsApplicable"]){let z=typeof $[G]==="number"?$[G]:Number.NaN;if(Number.isFinite(z)&&z>=0)Z[G]=z}let X=$.spendControl;if(b(X)){let G=Number(X.limit),z=Number(X.used),Q=Number(X.remaining),B=Number(X.usedPercent),H=Number(X.remainingPercent);if(Number.isFinite(G)&&Number.isFinite(z)&&Number.isFinite(Q)&&Number.isFinite(B)&&Number.isFinite(H)&&typeof X.reached==="boolean")Z.spendControl={limit:G,used:z,remaining:Q,usedPercent:B,remainingPercent:H,resetsAt:typeof X.resetsAt==="string"?X.resetsAt:void 0,unit:typeof X.unit==="string"?X.unit:void 0,source:typeof X.source==="string"?X.source:void 0,reached:X.reached}}let J=$.credits;if(b(J)&&typeof J.hasCredits==="boolean"&&typeof J.unlimited==="boolean"&&typeof J.overageLimitReached==="boolean"){let G=Number(J.balance);Z.credits={hasCredits:J.hasCredits,unlimited:J.unlimited,overageLimitReached:J.overageLimitReached,...Number.isFinite(G)?{balance:G}:{}}}return Object.keys(Z).length?Z:void 0}function vG($){if(!b($))return null;if($.type==="api"){let Z=typeof $.baseURL==="string"?$.baseURL.trim():"",X=typeof $.apiKey==="string"?$.apiKey.trim():"";if(!xG(Z))return null;let J=$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer";return{...s6($),type:"api",apiKey:X||void 0,baseURL:Z,authHeader:J}}if($.type!=="oauth")return null;if($.corrupt===!0){if(typeof $.id!=="string"||!$.id.trim())return null;return{...s6($),type:"oauth",corrupt:!0}}if(typeof $.refresh!=="string"||!$.refresh.trim()){if(!Object.hasOwn($,"refresh")||typeof $.id!=="string"||!$.id.trim())return null;return{...s6($),type:"oauth",corrupt:!0}}return{...s6($),type:"oauth",access:typeof $.access==="string"?$.access:void 0,refresh:$.refresh,expires:typeof $.expires==="number"?$.expires:void 0,lastRefreshedAt:typeof $.lastRefreshedAt==="number"?$.lastRefreshedAt:void 0,lastRefreshError:P2($.lastRefreshError),lastQuotaRefreshError:P2($.lastQuotaRefreshError),quota:hG($.quota)}}function mG($){if(!b($))return;let Z=Object.create(null);for(let[X,J]of Object.entries($)){if(!n3(X)||!b(J))continue;let G={};if(b(J.inFlight))G.inFlight={...J.inFlight};if(b(J.lastOutcome)&&typeof J.lastOutcome.code==="string"&&J.lastOutcome.code.length>0&&typeof J.lastOutcome.at==="number"&&Number.isFinite(J.lastOutcome.at))G.lastOutcome={code:J.lastOutcome.code,at:J.lastOutcome.at,...b(J.lastOutcome.previousOutcome)&&typeof J.lastOutcome.previousOutcome.code==="string"&&J.lastOutcome.previousOutcome.code.length>0&&typeof J.lastOutcome.previousOutcome.at==="number"&&Number.isFinite(J.lastOutcome.previousOutcome.at)?{previousOutcome:{code:J.lastOutcome.previousOutcome.code,at:J.lastOutcome.previousOutcome.at}}:{}};if(typeof J.cooldownUntil==="number"&&Number.isFinite(J.cooldownUntil))G.cooldownUntil=J.cooldownUntil;if(Object.keys(G).length>0)Z[X]=G}return Object.keys(Z).length>0?Z:void 0}var T2=new Set;function wG($){if($.length===0)return;let Z=JSON.stringify([...$].sort());if(T2.has(Z))return;T2.add(Z),c3.warn("account load-dropped, preserved on disk",{droppedIds:$})}function pG($){if(!b($)||!Array.isArray($.accounts))return null;let Z=$.accounts,X=Z.map(vG).filter((J)=>J!=null);if(X.length<Z.length){let J=new Set;for(let Q of Z)if(b(Q)&&typeof Q.id==="string"&&Q.id.trim())J.add(Q.id.trim());let G=new Set(X.map((Q)=>Q.id)),z=[];for(let Q of J)if(!G.has(Q))z.push(Q);wG(z)}return{version:1,main:{type:"opencode",provider:"openai"},routing:b($.routing)?$.routing:void 0,fallbackOn:Array.isArray($.fallbackOn)?$.fallbackOn.filter((J)=>Number.isInteger(J)):void 0,refresh:b($.refresh)?$.refresh:void 0,quota:b($.quota)?$.quota:void 0,reset:mG($.reset),dump:b($.dump)?$.dump:void 0,costZeroing:b($.costZeroing)?$.costZeroing:void 0,killswitch:b($.killswitch)?$.killswitch:void 0,logging:b($.logging)?$.logging:void 0,cachekeep:b($.cachekeep)?$.cachekeep:void 0,cacheKeep:b($.cacheKeep)?$.cacheKeep:void 0,mainAccountId:typeof $.mainAccountId==="string"?$.mainAccountId:void 0,accounts:X}}async function a6($){try{return{exists:!0,value:JSON.parse(await uG($,"utf8"))}}catch(Z){if(Z.code==="ENOENT")return{exists:!1,value:null};throw Z}}function n6($){return Object.fromEntries(Object.entries($).filter(([,Z])=>Z!==void 0))}async function lG($){let Z;try{Z=(await a6($)).value}catch{return null}return eG(Z)}function dG($,Z){if(!b($))return $;let X=b(Z)?Z:{},J=b(X.main)?X.main:void 0,G=b(X.accounts)?X.accounts:{},z=b($.quota)?$.quota:{},Q=b($.refresh)?$.refresh:{},B=J??z,H=J??Q,W=Q.mainRefreshLeaseId!==void 0?{id:Q.mainRefreshLeaseId,until:Q.mainRefreshLeaseUntil,tokenHash:Q.mainRefreshLeaseTokenHash}:{id:H.refreshLeaseId,until:H.refreshLeaseUntil,tokenHash:H.refreshLeaseTokenHash},j=Array.isArray($.accounts)?$.accounts.map((K)=>{if(!b(K))return K;let V=typeof K.id==="string"&&b(G[K.id])?G[K.id]:{};return{...K,...V}}):void 0;return cG({...$,refresh:n6({...Q,mainLastRefreshError:Q.mainLastRefreshError??H.lastRefreshError,mainRefreshLeaseId:W.id,mainRefreshLeaseUntil:W.until,mainRefreshLeaseTokenHash:W.tokenHash}),quota:n6({...z,mainQuota:B.quota,mainQuotaCheckedAt:B.quotaCheckedAt,mainQuotaToken:B.quotaToken,mainLastQuotaApiError:B.lastQuotaApiError}),accounts:j})}async function r3($){let Z=await a6($.configPath);if(!Z.exists)return null;let X=await a6($.statePath);return pG(dG(Z.value,X.value))}function cG($){return Object.fromEntries(Object.entries($).filter(([,Z])=>Z!==void 0))}function sG($){if($.type==="api")return n6({apiKey:$.apiKey,lastUsed:$.lastUsed});if($.corrupt)return{};return n6({access:$.access,refresh:$.refresh,expires:$.expires,lastUsed:$.lastUsed,lastRefreshedAt:$.lastRefreshedAt,lastRefreshError:$.lastRefreshError,lastQuotaRefreshError:$.lastQuotaRefreshError,quota:$.quota})}function r6($){return Math.max($?.primary?.checkedAt??0,$?.secondary?.checkedAt??0)}function y$($,Z,X){if(X in Z)$[X]=Z[X];else delete $[X]}function iG($,Z){return $.access===Z.access&&$.refresh===Z.refresh&&$.expires===Z.expires&&$.lastRefreshedAt===Z.lastRefreshedAt}function aG($,Z){if(!iG($,Z))return Z;if(!("lastRefreshError"in Z))return $;if(!("lastRefreshError"in $))return Z;return(Z.lastRefreshError?.checkedAt??0)>($.lastRefreshError?.checkedAt??0)?Z:$}var nG=300000;function S2($,Z){if($===void 0)return 0;return $>Z+nG?0:$}function rG($,Z,X){let J=Date.now(),G=S2(Z.lastRefreshedAt,J),z=S2(X.lastRefreshedAt,J),Q=Z.expires??0,B=X.expires??0,H=z>G?X:G>z?Z:B>Q?X:Q>B?Z:aG(Z,X);y$($,H,"access"),y$($,H,"refresh"),y$($,H,"expires"),y$($,H,"lastRefreshedAt"),y$($,H,"lastRefreshError")}function oG($,Z){if(!b($))return Z;let X=$,J=r6(X.quota),G=r6(Z.quota),z=J>G,Q=z?{...X,...Z,quota:X.quota,lastQuotaRefreshError:X.lastQuotaRefreshError}:{...X,...Z};if(!z&&!("lastQuotaRefreshError"in Z))delete Q.lastQuotaRefreshError;if(!("lastRefreshError"in Z))delete Q.lastRefreshError;if(typeof X.lastUsed==="number"&&(typeof Z.lastUsed!=="number"||X.lastUsed>Z.lastUsed))Q.lastUsed=X.lastUsed;return rG(Q,X,Z),Q}async function tG($,Z=!1){let X=Date.now(),J=X+bG,G=0;while(Date.now()<=J){G++;let B=await e({name:"save",ttlMs:IG,path:$,renew:Z});if(B)return B;let H=J-Date.now();if(H<=0)break;await EG(Math.min(l3+k2(l3),H))}let z=Date.now()-X,Q=Math.round(z/Math.max(1,G));throw Error(`Timed out after ${z}ms waiting for the account store lock on ${$} (${G} attempts, ~${Q}ms apart; retry interval is ${l3}ms). A gap near the retry interval means lock contention; a much larger one means this process's event loop was saturated and the wait expired without getting scheduled.`)}function eG($){if(!b($)||!Array.isArray($.accounts))return null;let Z=new Set;for(let X of $.accounts){if(!b(X))continue;if(typeof X.id!=="string")continue;let J=X.id.trim();if(!J)continue;Z.add(J)}return Z}function $z($,Z){$.main=$.main??{};let X=typeof $.main.quotaCheckedAt==="number"?$.main.quotaCheckedAt:r6($.main.quota),J=typeof Z.quota?.mainQuotaCheckedAt==="number"?Z.quota.mainQuotaCheckedAt:r6(Z.quota?.mainQuota);if(X>J)return;$.main.quota=Z.quota?.mainQuota,$.main.quotaCheckedAt=Z.quota?.mainQuotaCheckedAt,$.main.quotaToken=Z.quota?.mainQuotaToken,$.main.lastQuotaApiError=Z.quota?.mainLastQuotaApiError}function Zz($,Z){$.main=$.main??{},$.main.lastRefreshError=Z.refresh?.mainLastRefreshError,$.main.refreshLeaseId=Z.refresh?.mainRefreshLeaseId,$.main.refreshLeaseUntil=Z.refresh?.mainRefreshLeaseUntil,$.main.refreshLeaseTokenHash=Z.refresh?.mainRefreshLeaseTokenHash}function s3($){if(Array.isArray($))return $.map(s3);if(!b($))return $;return Object.fromEntries(Object.entries($).filter(([,Z])=>Z!==void 0).map(([Z,X])=>[Z,s3(X)]))}async function Xz($,Z,X={mainQuota:!0,mainRefresh:!0,accounts:!0},J){let G=Z.statePath,z=await tG(G);try{let Q=(await a6(G)).value,B=b(Q)?{...Q,version:1}:{version:1};if(X.mainQuota)$z(B,$);if(X.mainRefresh)Zz(B,$);if(X.accounts){let H=X.accounts===!0?null:new Set(X.accounts),Y=await lG(Z.configPath);B.accounts={...b(B.accounts)?B.accounts:{}};for(let W of $.accounts){if(H&&!H.has(W.id))continue;if(Y&&!Y.has(W.id))continue;B.accounts[W.id]=oG(B.accounts[W.id],sG(W))}if(H){for(let W of H)if(!$.accounts.some((U)=>U.id===W))delete B.accounts[W]}if(Y){for(let W of Object.keys(B.accounts))if(!Y.has(W))delete B.accounts[W]}}if(J&&!J())return;await L0(G,s3(B))}finally{await z.release()}}function b2($){return $?.fallbackOn?.length?$.fallbackOn:kG}function Jz($){let Z=$?.quota?.minimumRemaining||{};return{primary:Z.primary??Z["5h"]??C2.primary,secondary:Z.secondary??Z["1w"]??C2.secondary}}function i3($){return $?.quota?.enabled!==!1}function g$($){return $?.quota?.failClosedOnUnknownQuota??yG}function o6($,Z,X=Date.now()){if(!i3(Z))return!0;if(!$)return!g$(Z);let J=Jz(Z),G=g$(Z);for(let z of["primary","secondary"]){let Q=$[z];if(!Q)continue;if(u3(Q,X)){if(G)return!1;continue}if(Q.remainingPercent<J[z])return!1}return!0}function o3($){return $?.killswitch?.enabled===!0}function A2($){return{primary:$?.primary??$?.["5h"]??H1.primary,secondary:$?.secondary??$?.["1w"]??H1.secondary}}function R2($){return typeof $==="number"&&Number.isFinite($)?$:0}function Y1($,Z){if(!$?.killswitch)return H1;if($.killswitch.schema===X$){let{accounts:X,defaults:J}=$.killswitch,G=Z??"main",z=b(X)&&Object.hasOwn(X,G)&&b(X[G])?X[G]:b(J)?J:void 0;return{primary:R2(z?.primary),secondary:R2(z?.secondary)}}if(Z&&$.killswitch.accounts?.[Z])return A2($.killswitch.accounts[Z]);return A2($.killswitch.main)}function x2($,Z,X,J=Date.now()){if(!o3(Z))return!0;if(!$)return!g$(Z);let G=Y1(Z,X),z=g$(Z);for(let Q of["primary","secondary"]){let B=$[Q];if(!B)continue;if(u3(B,J)){if(z)return!1;continue}if(B.remainingPercent<G[Q])return!1}return!0}function Gz($){return $?.refresh?.enabled!==!1}function t3($){return($?.refresh?.refreshBeforeExpiryMinutes??240)*60000}function k2($){return Math.floor(Math.random()*($+1))}function E1($,Z,X){return!$.access||!$.expires||$.expires-X<=t3(Z)}function zz($,Z){return Boolean($.access&&typeof $.expires==="number"&&$.expires>Z)}function Z$($,Z){return Boolean($?.mainAccountId&&Z.accountId&&Z.accountId===$.mainAccountId)}class y2 extends Error{constructor($){super(`Refusing to refresh account ${$}: it holds the main account's credential while the main slot is live`);this.name="ShieldedMainRowRefreshError"}}function j0($,Z){let X=$.accounts.findIndex((J)=>J.id===Z.id);if(X!==-1)$.accounts[X]=Z}function f$($){return $ instanceof Error?$.message:String($)}function a3($,Z,X){if(Z instanceof x$)return;$.lastRefreshError=E6({error:Z,now:X,refreshToken:$.refresh,previous:$.lastRefreshError})}function d3($,Z,X){if(Z instanceof x$)return;if($.lastQuotaRefreshError=P$({error:Z,now:X,previous:$.lastQuotaRefreshError}),Z?.isRefreshError===!0)a3($,Z,X)}function E2($,Z){if(!$)return!1;if(!$.resetsAt)return!0;let X=Date.parse($.resetsAt);return Number.isFinite(X)?X>Z:!0}function Qz($,Z){if(!$)return!1;return E2($.primary,Z)||E2($.secondary,Z)}function Bz($,Z,X){if(!$)return!1;let J=Z?.quota?.checkIntervalMinutes??5,G=Math.max(1,J)*60000,z=Math.max($.primary?.checkedAt??0,$.secondary?.checkedAt??0);return X-z<G}function I2($,Z,X){return!Bz($.quota,Z,X)}function Hz($,Z,X,J){return Y3(X)&&o6($.quota,Z,J)&&Qz($.quota,J)}function Yz($){let Z=$?.quota?.checkIntervalMinutes??5;return Math.max(1,Z)*60000}var Wz=60000,Vz=60000,Uz=600000;function jz($){return`fallback-oauth-refresh-${AG("sha256").update($).digest("base64url").slice(0,16)}`}var Dz=1e4,Kz=100;class qz{now;fetchImpl;paths;refreshPromises=new Map;refreshTimer=null;quotaTimer=null;quotaManager;onFallbackStorageChanged;options;constructor($){this.options=$,this.now=$.now??Date.now,this.fetchImpl=$.fetchImpl??fetch,this.paths=$.paths,this.quotaManager=$.quotaManager??null,this.onFallbackStorageChanged=$.onFallbackStorageChanged}assertNotTombstoned($){if($)c6($.refresh)}seedFallbackQuota($,Z){if(!this.quotaManager)return;if(!$.quota)return;let X=Math.max($.quota.primary?.checkedAt??0,$.quota.secondary?.checkedAt??0);if(X<=0)return;let J=this.quotaManager.getFallback($.id,$.access);if(J&&J.checkedAt>=X)return;this.quotaManager.setFallback($.id,{quota:$.quota,refreshAfter:X+Yz(Z),checkedAt:X},$.access,!1,$.accountId)}async load(){return r3(this.paths)}selectionBookkeeping=Promise.resolve();selectionBookkeepingSettled(){return this.selectionBookkeeping}async save($,Z){await Xz($,this.paths,{accounts:Z??!0},this.options.canWrite)}startBackgroundRefresh(){let $=async()=>{if(await this.options.backgroundRefreshPaused?.())return;if(await this.refreshDueAccounts(),this.options.fetchQuotaFn)await this.refreshQuotaForDueAccounts()};if($().catch(()=>{}),!this.refreshTimer){if(this.refreshTimer=setInterval(()=>{$().catch(()=>{})},Wz+k2(Vz)),"unref"in this.refreshTimer)this.refreshTimer.unref()}}stopBackgroundRefresh(){if(this.refreshTimer)clearInterval(this.refreshTimer);if(this.quotaTimer)clearInterval(this.quotaTimer);this.refreshTimer=null,this.quotaTimer=null}async getUsableFallbackAccounts($){let Z=$!==void 0?$:await this.load();if(!Z)return[];let X=[],J=!1;for(let G of Z.accounts){if(G.enabled===!1||!B1(G))continue;if(Z$(Z,G))continue;if(k0(G))continue;let z=!1,Q=G;try{if(E1(Q,Z,this.now())){let B=Q.lastRefreshError;if(B&&Z1(B,Q.refresh,this.now()))throw z=!0,Error(C$(B,this.now()));try{Q=await this.refreshAccount(Q,Z),J=!0}catch(H){if(gG(H))continue;z=!0;let Y=Z.accounts.find((W)=>W.id===G.id&&B1(W));if(Y&&!Z1(Y.lastRefreshError,Y.refresh,this.now()))a3(Y,H,this.now()),j0(Z,Y),J=!0;throw H}}if(this.seedFallbackQuota(Q,Z),this.accountPassesQuotaPolicy(this.quotaPolicyAccount(Q),Z))X.push(Q)}catch(B){let H=zz(Q,this.now());if(z){if(!H)continue}else if(!H)continue;if(Hz(Q,Z,B,this.now()))R1.debug("fallback quota using cached quota after refresh error",{pid:process.pid,accountId:Q.id,error:f$(B)}),X.push(Q);else if(!g$(Z))X.push(Q)}}if(J){let G=structuredClone(Z);this.selectionBookkeeping=this.selectionBookkeeping.then(()=>this.save(G)).catch((z)=>{c3.warn("fallback selection bookkeeping not persisted",{pid:process.pid,error:f$(z)})})}return X}async markUsed($){try{let Z=await this.load();if(!Z)return;let X=Z.accounts.find((J)=>J.id===$.id);if(!X)return;X.lastUsed=this.now(),await this.save(Z,[X.id])}catch(Z){c3.warn("lastUsed stamp not persisted",{pid:process.pid,accountId:$.id,error:f$(Z)})}}accountPassesQuotaPolicy($,Z){return o6($.quota,Z,this.now())}quotaPolicyAccount($){if(!this.quotaManager)return $;let Z=this.quotaManager.getFallback($.id,$.access)?.quota;return Z?{...$,quota:Z}:$}async refreshDueAccounts(){let $=await this.load();if(!$||!Gz($))return;let Z=!1;for(let X of $.accounts){if(X.enabled===!1||!B1(X))continue;if(Z$($,X))continue;if(k0(X))continue;if(!E1(X,$,this.now()))continue;if(Z1(X.lastRefreshError,X.refresh,this.now()))continue;try{R1.debug("fallback oauth background due",{pid:process.pid,accountId:X.id,expiresInMs:X.expires?X.expires-this.now():void 0}),await this.refreshAccount(X,$),Z=!0}catch(J){R1.warn("fallback oauth background failed",{pid:process.pid,accountId:X.id,error:f$(J)}),a3(X,J,this.now()),j0($,X),Z=!0}}if(Z)await this.save($)}async refreshQuotaForDueAccounts(){let $=await this.load();if(!$||!i3($))return;if(!this.options.fetchQuotaFn)return;let Z=!1;for(let X of $.accounts){if(X.enabled===!1||!B1(X))continue;if(Z$($,X))continue;if(k0(X))continue;let J=X;try{if(E1(J,$,this.now())){if(Z1(J.lastRefreshError,J.refresh,this.now()))continue;J=await this.refreshAccount(J,$),Z=!0}if(a1(J.lastQuotaRefreshError,this.now()))continue;if(this.seedFallbackQuota(J,$),!(this.quotaManager?this.quotaManager.isFallbackStale(J.id,J.access):I2(J,$,this.now())))continue;await this.refreshAccountQuota(J,$),Z=!0}catch(G){d3(X,G,this.now()),j0($,X),Z=!0}}if(Z)await this.save($),this.onFallbackStorageChanged?.()}async refreshQuotaForAllAccounts($={}){let Z=await this.load(),X=[];if(!Z||!i3(Z))return{storage:Z,errors:X};if(!this.options.fetchQuotaFn)return{storage:Z,errors:X};let J=$.force??!1,G=!1;for(let z of Z.accounts){if(z.enabled===!1||!B1(z))continue;if(Z$(Z,z))continue;if(k0(z))continue;let Q=z;try{if(E1(Q,Z,this.now())){let B=Q.lastRefreshError;if(B&&Z1(B,Q.refresh,this.now()))throw Error(C$(B,this.now()));Q=await this.refreshAccount(Q,Z),G=!0}if(!J&&!I2(Q,Z,this.now())){if(Q.lastQuotaRefreshError)Q.lastQuotaRefreshError=void 0,j0(Z,Q),G=!0;continue}await this.refreshAccountQuota(Q,Z),G=!0}catch(B){d3(z,B,this.now()),j0(Z,z),G=!0,X.push({accountId:z.id,message:f$(B)})}}if(G)await this.save(Z);return{storage:Z,errors:X}}async refreshAccount($,Z,X={}){let J=this.refreshPromises.get($.id);if(J){let Q=await J;return j0(Z,Q),Q}let G=this.refreshAccountNow($,Z,X).finally(()=>{this.refreshPromises.delete($.id)});this.refreshPromises.set($.id,G);let z=await G;return j0(Z,z),z}async waitForConcurrentFallbackRefresh($,Z,X,J){let G=Date.now()+Dz;while(Date.now()<G){await new Promise((Y)=>setTimeout(Y,Kz));let z=await this.load(),Q=z?.accounts.find((Y)=>Y.id===$.id&&B1(Y));if(!Q)continue;if(this.assertNotTombstoned(Q),(Q.access!==X.access||Q.refresh!==X.refresh||(Q.expires??0)>(X.expires??0)+60000)&&(J.force||!E1(Q,z,this.now())))return j0(Z,Q),R1.debug("fallback oauth joined concurrent refresh",{pid:process.pid,accountId:Q.id,expiresInMs:Q.expires?Q.expires-this.now():void 0}),Q;let H=Q.lastRefreshError;if(H&&Z1(H,Q.refresh,this.now()))throw j0(Z,Q),Error(C$(H,this.now()))}return null}assertNotShieldedMainRow($,Z,X){if(X.asPoolMain||!Z)return;if(Z$($,Z))throw new y2(Z.id)}async refreshAccountNow($,Z,X){let J=await this.load(),G=J?.accounts.find((B)=>B.id===$.id&&B1(B));if(this.assertNotTombstoned(G),this.assertNotShieldedMainRow(J,G,X),G&&!X.force&&!E1(G,J,this.now()))return j0(Z,G),G;let z=G??$,Q=await e({name:jz(z.id),ttlMs:Uz,path:this.paths.configPath,now:this.now,renew:!0});if(!Q){R1.debug("fallback oauth refresh skipped file lock",{pid:process.pid,accountId:z.id});let B=await this.waitForConcurrentFallbackRefresh($,Z,z,X);if(B)return B;throw Error("Fallback OAuth refresh is already in progress")}try{if(J=await this.load(),G=J?.accounts.find((W)=>W.id===$.id&&B1(W)),this.assertNotTombstoned(G),this.assertNotShieldedMainRow(J,G,X),G&&!X.force&&!E1(G,J,this.now()))return j0(Z,G),G;if(!G)throw new i6($.id);z=G;let B=this.options.refreshFn??(async()=>{throw Error("No refreshFn injected into FallbackAccountManager")});R1.debug("fallback oauth refresh request start",{pid:process.pid,accountId:z.id,force:X.force===!0,expiresInMs:z.expires?z.expires-this.now():void 0});let H=await B({refreshToken:z.refresh,fetchImpl:this.fetchImpl,now:this.now});if(z.access=H.access,z.refresh=H.refresh,z.expires=H.expires,z.lastRefreshedAt=H.expires-H.expiresIn*1000,z.lastRefreshError=void 0,j0(Z,z),await this.save(Z),!(await this.load())?.accounts.some((W)=>W.id===$.id))throw new i6($.id);return R1.debug("fallback oauth refresh succeeded",{pid:process.pid,accountId:z.id,expiresInMs:z.expires?z.expires-this.now():void 0}),z}finally{await Q.release()}}async refreshAccountQuota($,Z){let X=$;if(this.assertNotTombstoned(X),!X.access)throw Error(`Fallback account ${$.id} has no access token`);if(!this.options.fetchQuotaFn)throw Error("No fetchQuotaFn injected — wham/usage supplement is disabled");let J=this.options.fetchQuotaFn??(async()=>{throw Error("No fetchQuotaFn injected — wham/usage supplement is disabled")}),G=(z)=>this.quotaManager?this.quotaManager.refreshFallback(X.id,z):J({accessToken:z,fetchImpl:this.fetchImpl,now:this.now});try{if(!X.access)throw Error(`Fallback account ${$.id} has no access token`);let z=await G(X.access);X.quota=z,X.lastQuotaRefreshError=void 0,j0(Z,X),await this.save(Z)}catch(z){throw d3($,z,this.now()),j0(Z,$),z}}}var f2="/backend-api/wham/rate-limit-reset-credits",CU=`https://chatgpt.com${f2}`,Nz=`${f2}/consume`,PU=`https://chatgpt.com${Nz}`;function Z0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}import{statSync as _z}from"node:fs";import{rm as w2}from"node:fs/promises";import{dirname as Oz,join as p2}from"node:path";import{resolveClaustrumConnectionPath as Cz}from"@cortexkit/claustrum-client";function g2($,Z){if(!$)return;let X=$.rawUsedPercent??$.usedPercent;if(!Number.isFinite(X)||X<0||X>100)return;return{usedPercent:X,remainingPercent:100-X,checkedAt:Z,...typeof $.resetsAt==="string"&&{resetsAt:$.resetsAt},...typeof $.windowMinutes==="number"&&Number.isFinite($.windowMinutes)&&$.windowMinutes>0&&{windowMinutes:$.windowMinutes}}}function h2($){if(!Z0($)||typeof $.minor!=="number"||!Number.isSafeInteger($.minor)||typeof $.exponent!=="number"||!Number.isInteger($.exponent))return;let Z=$.minor/10**$.exponent;return Number.isFinite(Z)?Z:void 0}function Mz($){let Z=h2($.total),X=h2($.remaining);if(Z===void 0||X===void 0||Z<0||X<0)return;let J=Z-X,G=$.spendable===!1,z=Z>0?J/Z*100:G?100:0;return{limit:Z,used:J,remaining:X,usedPercent:z,remainingPercent:100-z,reached:G,...typeof $.resetsAt==="string"&&{resetsAt:$.resetsAt},...Z0($.total)&&typeof $.total.unit==="string"&&{unit:$.total.unit}}}function v2($,Z){let X=g2($.usage?.primary,Z.fetchedAt);if(!X||!Number.isFinite(Z.fetchedAt))return;let J=g2($.usage?.secondary,Z.fetchedAt),G=Array.isArray($.spend)?$.spend.find((B)=>Z0(B)&&B.id==="individual_limit"):void 0,z=Z0(G)?Mz(G):void 0,Q=Z0($.savedResets)?$.savedResets.availableCount:void 0;return{primary:X,...J&&{secondary:J},...typeof Q==="number"&&Number.isFinite(Q)&&Q>=0&&{resetCreditsAvailable:Q},...z&&{spendControl:z},...!G&&{spendControlCleared:!0}}}var m2=["primary","secondary"];function e3($){return $!=null&&typeof $==="object"&&!Array.isArray($)}function h$($){return typeof $==="number"&&Number.isFinite($)}function Fz($,Z){if(!e3(Z))return;let X=Z.usedPercent;if(!h$(X)||X<0||X>100)return;return{label:$,usedPercent:X,...typeof Z.resetsAt==="string"?{resetsAt:Z.resetsAt}:{},...h$(Z.windowMinutes)&&Z.windowMinutes>0?{windowMinutes:Z.windowMinutes}:{}}}function Lz($){let Z=$.spendControl;if(e3(Z)&&typeof Z.reached==="boolean"){let X=(J)=>h$(Z[J])?{[J]:Z[J]}:{};return{kind:"reading",reached:Z.reached,...X("remainingPercent"),...X("usedPercent"),...X("limit"),...X("used"),...X("remaining"),...typeof Z.resetsAt==="string"?{resetsAt:Z.resetsAt}:{},...typeof Z.unit==="string"?{unit:Z.unit}:{}}}if($.spendControlCleared===!0)return{kind:"cleared"};return}function R0($,Z,X){if(!e3($)||!h$(Z))return;let J=[],G=[];for(let H of m2){let Y=Fz(H,$[H]);if(Y)J.push(Y);else if(X)G.push({label:H})}let z=Lz($),Q=$.resetCreditsAvailable,B=typeof Q==="number"&&Number.isSafeInteger(Q)&&Q>=0?{resetCredits:{value:Q,checkedAt:Z}}:void 0;if(J.length===0&&G.length===0&&!z&&!B)return;return{checkedAt:Z,...J.length>0?{readings:J}:{},...G.length>0?{coverage:G}:{},...z?{budget:z}:{},...B?{counters:B}:{}}}function J$($){if(!Q0($))return;let Z=c($),X={};for(let J of m2){let G=Z.limits.find((Q)=>Q.label===J&&Q.kind==="reading");if(!G||!h$(G.usedPercent))continue;let z={usedPercent:G.usedPercent,remainingPercent:100-G.usedPercent,checkedAt:G.checkedAt,...G.resetsAt!==void 0?{resetsAt:G.resetsAt}:{},...G.windowMinutes!==void 0?{windowMinutes:G.windowMinutes}:{}};X[J]=z}return X.primary||X.secondary?X:void 0}var c0=i("vault"),Pz="openai-auth",u2={refreshAdapter:"openai",category:"openai-native",apiKeys:!1},Tz={opencode:"OpenCode",pi:"Pi"};function Sz($){return O3(Pz,$)}function t6($){return p2(Oz($),"openai-auth-vault")}function Az($,Z){return{...P3({stateDir:$,host:Z}),rosterPath:p2($,`${Z}-roster.json`)}}var e6=2000,l2={"vault-unreachable":"Request refused locally: this host is connected to the credential vault, which could not be reached, and local accounts are not used while it is connected. Start the vault and connect accounts in it, or disconnect this host from the vault.","vault-empty":"Request refused locally: this host is connected to the credential vault, which serves it no usable OpenAI account, and local accounts are not used while it is connected. Connect accounts in the vault, or disconnect this host from the vault.","vault-refused":"Request refused locally: the credential vault did not authorize an account, and local accounts are not used while this host is connected to it. Check the accounts in the vault, or disconnect this host from the vault."};function d2($){return $.snapshot()===void 0?"vault-unreachable":"vault-empty"}function Rz($){let Z=n1($);return Z?r1(Z):void 0}class $8{host;name;paths;#$;#Z;#Q=new Map;#G=new Map;#z;#B;#X;#H=!1;#V=!1;#Y=Promise.withResolvers();#J;#W="unknown";#U;constructor($){this.#$=$,this.host=$.host,this.name=Sz($.host),this.paths=Az($.stateDir,$.host),this.#Z=new d6({rosterPath:this.paths.rosterPath,tokenPath:this.paths.tokenPath,family:u2,connect:()=>this.#M(),isCustodyActive:()=>this.enrolled(),...$.reservedRouteIds?{reservedRouteIds:$.reservedRouteIds}:{},parseIdentity:Rz,insula:{provider:"codex",normalize:v2},...$.now?{now:$.now}:{},onRoster:()=>{this.#z=void 0},onError:(Z)=>this.#j("vault roster refresh failed",Z),logger:c0})}#D(){return(this.#$.connectionFile??Cz)()}#K(){return{connectionFile:this.#D(),projectRoot:this.#$.projectRoot??process.cwd(),storagePath:this.paths.tokenPath,logger:($)=>c0.debug("vault transport error",{errorClass:$})}}#M(){return this.#$.connectScoped?.()??M2(this.#K())}#F(){return this.#$.connectEnrollment?.()??C3(this.#K())}#j($,Z){this.#z=d0(Z),c0.warn($,{host:this.host,error:this.#z})}#q(){return[this.paths.tokenPath,this.paths.statePath].map(($)=>{try{let Z=_z($);return`${Z.ino}:${Z.size}:${Z.mtimeMs}:${Z.ctimeMs}`}catch{return"?"}}).join("|")}async authority(){let $=this.#q(),Z=await S3(this.paths,this.name);if($===this.#q())return this.#W=Z,this.#U=$,Z;return"unreadable"}enrolled(){return this.#U!==this.#q()||this.#W!=="local"}start(){if(this.#H||this.#V)return;this.#H=!0;let $=async()=>{try{await this.authority(),await this.#N(),await this.#Z.refreshInsulaQuota()}catch(X){if(!this.#V)this.#j("vault roster refresh failed",X)}if(this.#V)return;let Z=this.#$.pollIntervalMs??5000;if(Z<=0)return;this.#J=setTimeout(()=>{this.#J=void 0,$()},Z),this.#J.unref?.()};$()}#N(){return this.#X??=this.#Z.refresh().finally(()=>{this.#X=void 0,this.#Y.resolve()}),this.#X}firstRoster(){return this.#Y.promise}async awaitRequestRoster(){if(this.snapshot())return;if(await this.authority()!=="vault")return;let $=this.#X;if($)await $.catch(()=>{return});if(this.snapshot()||await this.authority()!=="vault")return;await(this.#X??this.#N()).catch((X)=>{this.#j("vault roster refresh failed",X)})}async refresh(){try{await this.authority();let $=this.#X;if($)await $.catch(()=>{return});let Z=await this.#N();return this.#z=void 0,Z}catch($){return this.#j("vault roster refresh failed",$),this.#Z.snapshot()}}snapshot(){return this.#Z.snapshot()}serves(){return this.enrolled()&&(this.snapshot()?.rows.length??0)>0}identities(){if(!this.enrolled())return new Set;return new Set((this.snapshot()?.rows??[]).flatMap(($)=>$.accountIdentity!==void 0?[$.accountIdentity]:[]))}routes(){if(!this.enrolled())return[];let $=new Map((this.snapshot()?.rows??[]).map((Z)=>[Z.routeId,Z]));return this.#Z.routingRows().map((Z)=>{let X=$.get(Z.id)?.accountIdentity;return{id:Z.id,kind:Z.kind==="api-key"?"api-key":"oauth",...X!==void 0?{identity:X}:{},...Z.quota!==void 0?{quota:Z.quota}:{}}})}owns($){return(this.snapshot()?.rows??[]).some((Z)=>Z.routeId===$)}async send($,Z,X){let J=!1;try{return await this.#Z.send($,(G)=>{return J=!0,Z(G.accessToken,G)},{site:X.site,...X.signal?{signal:X.signal}:{}})}catch(G){if(J)throw G;this.#j("vault refused to serve an account",G);return}}async authorize($,Z={}){try{return await this.#Z.authorize($,Z.signal)}catch(X){this.#j("vault refused to serve an account",X);return}}async reportFailure($,Z){if(Z!==401)return;try{await this.#Z.reportFailure($,401,"direct")}catch(X){this.#j("vault failure report failed",X)}await this.refresh()}recordSnapshot($,Z,X,J){let G=R0(Z,(this.#$.now??Date.now)(),X);if(!G)return Promise.resolve();return this.#Z.recordQuota($,G,J).then(()=>{},(z)=>this.#j("vault quota write failed",z))}pollQuota($,Z=!0){let X=this.#G.get($);if(X)return X;let J=this.#L($,Z).finally(()=>{this.#G.delete($)});return this.#G.set($,J),J}async#L($,Z){if(Z){await this.authority(),await this.#Z.refreshInsulaQuota();let z=(await _0(this.paths.rosterPath))?.rows.find((B)=>B.routeId===$),Q=await this.#Z.cachedInsulaQuotaForRoute($);if(Q!==void 0&&z?.accountIdentity){let B=R0(Q,Q.primary.checkedAt,!0);if(!B)return{ok:!1,error:"unusable insula reading"};return await this.#Z.recordAccountQuota($,z.accountIdentity,B)?{ok:!0}:{ok:!1,error:"vault account changed"}}}let X,J=this.#$.fetchImpl?.()??globalThis.fetch,G=await this.send($,async(z,Q)=>{try{let B=Z?void 0:await this.#Z.cachedInsulaQuota(Q);if(B!==void 0){let Y=R0(B,B.primary.checkedAt,!0);if(!Y)throw Error("unusable insula reading");return await this.#Z.recordQuota($,Y,Q),new Response(null,{status:200})}let H=await $$({accessToken:z,fetchImpl:J,now:this.#$.now??Date.now,...Q.accountIdentity?{accountId:Q.accountIdentity}:{},accountKey:$,logger:c0});return await this.recordSnapshot($,H,!0,Q),X=void 0,new Response(null,{status:200})}catch(B){X=d0(B);let H=B?.status;if(typeof H==="number")return new Response(null,{status:H});throw B}},{site:"quota"}).catch((z)=>{X=d0(z);return});if(!G)return{ok:!1,error:X??"vault refused"};return G.ok?{ok:!0}:{ok:!1,error:X??`status ${G.status}`}}requestReading($){let Z=this.#Q.get($);if(Z)return Z;let X=this.pollQuota($,!1).catch((J)=>{c0.warn("vault quota poll failed",{routeId:$,error:d0(J)})}).finally(()=>{this.#Q.delete($)});return this.#Q.set($,X),X}async pollStale($){let Z=(this.#$.now??Date.now)(),X=[];for(let J of this.routes()){let G=Ez(J.quota);if(G!==void 0&&Z-G<$)continue;X.push({id:J.id,...await this.pollQuota(J.id)})}return X}async decline($){await this.#Z.decline($),c0.info("vault account declined",{routeId:$})}async accept($){await this.#Z.accept($),c0.info("vault account accepted",{routeId:$})}async status(){await this.authority();let $;try{$=await E$(this.paths,this.name)}catch(Z){this.#j("vault enrollment state unreadable",Z),$={state:"blocked",proposedName:this.name,code:Z instanceof A?Z.kind:"unreadable-state"}}return{host:this.host,name:this.name,enrollment:$,accounts:this.enrolled()?this.snapshot()?.rows??[]:[],...this.#z?{lastError:this.#z}:{}}}async connectStep(){let $=await this.#F().catch((Z)=>{throw new W0("vault-unreachable",`Could not reach the Claustrum vault (${this.#D()}): ${d0(Z)}. Is the vault running?`)});try{let Z=new w6({client:$,paths:this.paths,proposedName:this.name,...this.#$.now?{now:this.#$.now}:{}}),X=await Z.status();if(X.state==="denied"||X.state==="blocked")await Z.resetTerminal();let J=await Z.reconcile();if(c0.info("vault enrollment step",{host:this.host,state:J.state}),J.state==="approved")this.#z=void 0,await this.refresh();return J}finally{$.close()}}waitForApproval($={}){return this.#B??=(async()=>{let Z=$.sleep??((z)=>new Promise((Q)=>setTimeout(Q,z))),X=$.pollIntervalMs??2000,J=Date.now()+($.timeoutMs??600000),G=await this.connectStep();while(G.state==="pending"||G.state==="busy"){if($.onPending?.(G),Date.now()>=J)return G;await Z(X),G=await this.connectStep()}return G})().finally(()=>{this.#B=void 0}),this.#B}async disconnect(){await w2(this.paths.tokenPath,{force:!0}),await w2(this.paths.statePath,{force:!0}),await this.authority(),this.#z=void 0,c0.info("vault enrollment forgotten",{host:this.host})}assertHostSlot($){if(this.serves())R3({mode:"custody",auth:$,provider:"openai"})}close(){if(this.#V=!0,this.#Y.resolve(),this.#J)clearTimeout(this.#J);this.#J=void 0,this.#Z.close()}}function Ez($){if(!$)return;let Z=c($).limits.map((X)=>X.checkedAt);return Z.length>0?Math.max(...Z):void 0}function $Z($,Z){if(Z.state!=="pending")return[];if(!Z.requestId)return[`The vault did not take the enrollment request yet${Z.retryCode?` (${Z.retryCode})`:""}. Run Connect again in a moment.`];return[`Enrollment request ${Z.requestId} for ${$} is waiting for approval. Approve it with:`,`  ck auth enroll approve --request-id ${Z.requestId}`,"and let it read your OpenAI accounts with:",`  ck auth grant --principal enrolled:${$} --selector-kind category --selector ${u2.category} --operation read`]}function c2($,Z,X){let J=`${Tz[$]} (${Z})`;switch(X.state){case"approved":return`${J}: connected to the Claustrum vault.`;case"idle":return`${J}: not connected to the Claustrum vault.`;case"pending":return X.requestId?`${J}: waiting for approval of request ${X.requestId}.`:`${J}: enrollment request not taken yet${X.retryCode?` (${X.retryCode})`:""}.`;case"denied":return`${J}: the vault denied the enrollment request.`;case"blocked":return`${J}: enrollment stopped (${X.code}).`;case"unavailable":return`${J}: the vault is unavailable (${X.code}).`;case"busy":return`${J}: another process is enrolling right now.`}}function Z8($,Z){switch(Z.state){case"approved":{let X=$.snapshot()?.rows.length??0;return{ok:!0,text:`Connected: the vault approved ${$.name}. It serves ${X} OpenAI account${X===1?"":"s"} to this host${X===0?" (grant it the openai-native category with `ck auth grant` to add some)":""}.`}}case"denied":return{ok:!1,text:"The vault denied the enrollment request. Run Connect again to send a new one."};case"blocked":return{ok:!1,text:`Enrollment stopped (${Z.code}). Run Connect again to send a new request.`};case"pending":case"busy":return{ok:!1,text:[...$Z($.name,Z),"Still waiting. The request stays open: run Connect again after approving it."].join(`
-`)};default:return{ok:!1,text:`Enrollment is ${Z.state}.`}}}var s2=`${String.fromCharCode(27)}\\[[0-9;]*m`,iU=new RegExp(s2,"g"),aU=new RegExp(`^${s2}`);function G$($){return $.authority!=="local"}async function s0($){return{authority:await $.authority(),status:await $.status(),identities:$.identities(),routes:new Set($.routes().map((Z)=>Z.id))}}async function n2($){let Z;try{return await Promise.race([Promise.resolve().then(()=>$.refresh()).then(()=>{return},(X)=>X instanceof Error?X.message:String(X)),new Promise((X)=>{Z=setTimeout(()=>X("Vault roster refresh did not finish within the roster wait budget."),e6)})])}finally{clearTimeout(Z)}}function W1($){return $.email||$.label||$.routeId}var J8="Accounts are managed in the vault with ck. Disconnect to use local accounts.",G8="Nothing was changed: accounts are managed in the vault with ck. Disconnect to use local accounts.";function r2($){return Z0($)?{...$}:{}}function ZZ($,Z,X,J){let G=X.confirm?.irreversible?{irreversible:!0,confirm:X.confirm.message}:{...X.confirm?{confirm:X.confirm.message}:{}};return{id:X.id,label:X.label,...X.description?{description:X.description}:{},...X.group?{group:X.group}:{},knobs:X.knobs,...G,run:async({values:z,invocation:Q})=>{let B=await $.apply({command:$.command,sectionId:Z,...J?{itemId:J}:{},actionId:X.id,values:z,confirmed:!0},Q);return{ok:B.ok,text:B.text,...B.code?{code:B.code}:{}}}}}function z8($,Z){return new Proxy($,{get(X,J){if(J==="read")return async()=>{let z=await X.read();if(z.status!=="ready")return z;let Q={...z,rows:z.rows.map((Y)=>({...Y,label:Y.label??Y.id}))};if(!Z)return Q;let B=await s0(Z);if(!G$(B))return Q;let H=[...B.status.accounts.map((Y)=>({id:Y.routeId,label:W1(Y),type:"oauth",enabled:Y.enabled,identity:Y.accountIdentity,quota:Y.quota,hasEntry:!1,needsFirstReading:!1,candidate:!1}))];return{...z,rows:H}};if(J==="readSettings")return async()=>{let z=await X.readSettings();if(z.status==="error"||!Z)return z;let Q=await s0(Z),B=r2(z.settings.killswitch);if(!G$(Q)||!z.settings.killswitch)return z;let H=r2(B.accounts);for(let Y of Q.status.accounts)H[Y.routeId]=Y1({version:1,accounts:[],...z.settings},Y.routeId);return{...z,settings:{...z.settings,killswitch:{...B,accounts:H}}}};let G=Reflect.get(X,J);return typeof G==="function"?G.bind(X):G}})}function o2($,Z){let X=_1($),J=_1({command:$.command,title:$.title,store:z8($.store,Z),accounts:$.accounts,quota:$.quota,limits:$.limits,routing:$.routing,...$.extraLocks?{extraLocks:$.extraLocks}:{},...$.now?{now:$.now}:{}}),G=async(H,Y)=>{let W=await s0(Z),U=G$(W),j=U?J:X,V=(await j.open(Y)).menu.sections.find((F)=>F.id===H);if(!V)throw new W0("unavailable","The account menu is unavailable.");if(!U)return{lines:V.lines,items:V.items.map((F)=>({...F,actions:F.actions.map((D)=>ZZ(j,H,D,F.id))})),actions:V.actions.map((F)=>ZZ(j,H,F))};let N=new Map(W.status.accounts.map((F)=>[F.routeId,F])),q=($.now??Date.now)(),M=(F)=>({id:"check",label:F?"Check this account":"Check now",group:"Actions",run:async()=>{let L=[...(await s0(Z)).routes].filter((S)=>!F||S===F);if(F&&L.length===0)throw new W0("unavailable","This vault account cannot be checked right now.");for(let S of L){let v=await Z.pollQuota(S);if(!v.ok)throw new W0("quota-check-failed",`${S}: ${v.error??"vault unavailable"}`)}return`Checked quota for ${L.length} account${L.length===1?"":"s"}.`}});if(H==="quota"){let F=(D,L)=>P0(c(D.quota,$.quota?.scope),{now:q,form:L});return{lines:W.status.accounts.filter((D)=>!W.routes.has(D.routeId)).map((D)=>`${W1(D)} (${D.enabled?D.state:"disabled"}): ${F(D,"compact")}`),items:W.status.accounts.filter((D)=>W.routes.has(D.routeId)).map((D)=>({id:D.routeId,label:W1(D),group:"Accounts",status:F(D,"compact"),detail:F(D,"full"),actions:[M(D.routeId)]})),actions:W.routes.size>0?[M()]:[]}}let P=V.items.map((F)=>{let D=N.get(F.id),L=D&&H==="accounts"?`Vault · ${D.credentialType==="oauth"?"login":"API key"} · ${D.state} · ${D.enabled?"enabled":"declined"}`:F.detail;return{id:F.id,label:F.label,detail:L,group:F.group,status:D&&H==="accounts"?D.enabled?D.state:"disabled":F.status,...F.facts?{facts:F.facts}:{},actions:D&&H!=="limits"?[]:F.actions.map((S)=>ZZ(j,H,S,F.id))}}),E=V.actions.filter((F)=>H==="limits"||H==="routing"&&F.id==="mode").map((F)=>ZZ(j,H,F));return{lines:H==="accounts"?[`${W.status.accounts.length} vault account${W.status.accounts.length===1?"":"s"}`,`${W.routes.size} can route`,J8]:V.lines,items:P,actions:E}},z=_1({...$,accounts:void 0,quota:void 0,routing:void 0,limits:void 0,replace:{accounts:{title:"Accounts",build:(H)=>G("accounts",H)},quota:{title:"Quota",build:(H)=>G("quota",H)},routing:{title:"Routing",build:(H)=>G("routing",H)},limits:{title:"Limits",build:(H)=>G("limits",H)}},extras:$.extras?.map((H)=>H.id!=="reset"?H:{...H,build:async(Y)=>{let W=await s0(Z);if(G$(W))return{lines:[J8]};return H.build(Y)}})}),Q=async()=>{if(!G$(await s0(Z)))return{menu:X,error:void 0};let H=await n2(Z);return{menu:z,error:H}},B=async(H,Y)=>{let W=await H.menu.open(Y);if(H.error)W.menu.sections.find((j)=>j.id==="vault")?.lines.push(`Last error: ${H.error}`);return W};return{command:$.command,open:async(H)=>B(await Q(),H),apply:async(H,Y)=>{let W=await Q(),{menu:U}=W;if(U===z&&(H.sectionId==="accounts"||H.sectionId==="routing"&&H.actionId==="order"||H.sectionId==="reset"||H.sectionId==="quota"&&(await s0(Z)).routes.size===0||H.sectionId==="limits"&&H.itemId!==void 0&&!(await s0(Z)).status.accounts.some((j)=>j.routeId===H.itemId)))return{...await B(W,Y),ok:!1,code:"vault-local-action",text:G8};return U.apply(H,Y)}}}var V1="openai",H8="OpenAI accounts",z$="main",e2="that account is already your main account, so it was not added again",v$=i("commands"),$7=new Set(["__proto__","constructor","prototype"]);function Z7($,Z){let X={version:1,accounts:[],killswitch:$},J=Z0($.accounts)?Object.keys($.accounts):[],G={};for(let B of new Set([z$,...Z,...J])){if($7.has(B))continue;let H=Y1(X,B===z$?void 0:B);G[B]={primary:H.primary,secondary:H.secondary}}let z=Y1(X,void 0),Q={...$};return delete Q.main,Q.accounts=G,Q.defaults={primary:z.primary,secondary:z.secondary},Q.schema=X$,Q}function X7($,Z){let X=Z0($.accounts)?{...$.accounts}:{};for(let G of new Set([z$,...Z])){if($7.has(G)||Object.hasOwn(X,G))continue;X[G]={primary:H1.primary,secondary:H1.secondary}}let J=Z0($.defaults)?$.defaults:{primary:H1.primary,secondary:H1.secondary};return{...$,accounts:X,defaults:J,schema:X$}}function Q8($,Z){let X=!1;if(Z0($.cachekeep))$.cacheKeep={...$.cachekeep,...Z0($.cacheKeep)?$.cacheKeep:{}},delete $.cachekeep,X=!0;let J=$.killswitch;if(Z0(J)&&J.schema!==X$)$.killswitch=Z7(J,Z),X=!0;return X}async function t2($){let Z=await $.read();return Z.status==="ready"?Z.rows.map((X)=>X.id):[]}function J7($){let Z=async()=>{let J=await $.readSettings();if(J.status==="error")return J;let G=structuredClone(J.settings);return Q8(G,await t2($)),{...J,settings:G}},X=async(J,G)=>{let z=await t2($);return $.updateSettings(async(Q)=>{Q8(Q,z);let B=await J(Q)??Q;if(Z0(B.killswitch)&&B.killswitch.schema!==X$)B.killswitch=X7(B.killswitch,z);return B},G)};return new Proxy($,{get(J,G){if(G==="readSettings")return Z;if(G==="updateSettings")return X;let z=Reflect.get(J,G,J);return typeof z==="function"?z.bind(J):z}})}function G7($,Z){let X=(H,Y)=>Z.rowLocks?Z.rowLocks(H):Y,J=(H,Y)=>{let W=X(H,Y?.extraLocks);return{...Y??{},...W?{extraLocks:W}:{}}},G=(H,Y,W,U)=>$.replace(H,Y,W,J(H,U)),B={add:async(H,Y)=>{let W=await $.read(),j=(W.status==="ready"?W.rows:[]).filter((q)=>q.type==="oauth"&&!q.invalid),K=H.identity?j.find((q)=>q.identity===H.identity):void 0;if(K?.id===z$)throw new W0("main-account",e2);let V=K??j.find((q)=>q.id===H.id&&q.id!==z$);if(!V||H.credential.type!=="oauth")return $.add(H,Y);let N=await G(V.id,H.credential,H.identity!==void 0?{identity:H.identity}:{},Y?.extraLocks?{extraLocks:Y.extraLocks}:void 0);return v$.info("account signed in again",{id:V.id}),{id:N.id,outcome:"rotated",credential:N.credential,credentialEpoch:N.credentialEpoch}},replace:G,enable:(H,Y)=>$.enable(H,J(H,Y)),disable:(H,Y,W)=>$.disable(H,Y,J(H,W)),remove:(H,Y)=>$.remove(H,J(H,Y))};return new Proxy($,{get(H,Y){if(Object.hasOwn(B,Y))return B[Y];let W=Reflect.get(H,Y,H);return typeof W==="function"?W.bind(H):W}})}var z7="migration";function B8($){let Z=["Accounts move to the new account layout once every OpenCode process on this machine runs this version of OpenAI auth. This menu works on that layout, so it opens after the move.",$.length>0?"These processes still hold the move back:":"No running process holds the move back."],X={command:V1,title:H8,sections:[{id:z7,slot:"extra",title:"Accounts are moving",lines:Z,items:$.map((J,G)=>({id:`blocker-${G}`,label:J.pid==="unknown"?"processes that could not be read":`pid ${J.pid}`,detail:`version ${J.version}`,actions:[]})),actions:[]}]};return pz(X)}var mz=new Set(["access","refresh","apikey","authheader","password","credential","credentials"]);function wz($){let Z=$.toLowerCase().replace(/[-_]/g,"");if(mz.has(Z))return!0;return Z.endsWith("token")||Z.endsWith("key")||Z.endsWith("secret")}function XZ($,Z,X){if(Array.isArray($))return $.map((G,z)=>XZ(G,`${Z}[${z}]`,X));if(!Z0($))return $;let J={};for(let[G,z]of Object.entries($)){if(wz(G)){X.push(`${Z}.${G}`);continue}J[G]=XZ(z,`${Z}.${G}`,X)}return J}function pz($){let Z=[],X=XZ($,"menu",Z);if(Z.length>0)v$.warn("credential-shaped field stripped before RPC",{fields:Z});return X}function Q7($){return{id:$.id,credential:{type:"oauth",refresh:$.refresh,...$.access!==void 0?{access:$.access}:{},...$.expires!==void 0?{expires:$.expires}:{}},...$.accountId!==void 0?{identity:$.accountId}:{},...$.label!==void 0?{label:$.label}:{}}}function B7($){return{label:"Add account",knobs:[{kind:"text",id:"label",label:"Label (optional)"},{kind:"toggle",id:"headless",label:"Sign in with a device code (no browser on this machine)",value:!1}],run:async(Z)=>{let X=typeof Z.label==="string"&&Z.label.trim().length>0?Z.label.trim():void 0,J=Z.headless===!0,G=await $.begin({...X!==void 0?{label:X}:{},headless:J}),z=J?`Open this verification URL:
+</html>`,x6=[],T$,d0=new Map;function b4($,Z){return new Promise((X,J)=>{let G=(B)=>{$.off("listening",z),J(B)},z=()=>{$.off("error",G),X()};$.once("error",G),$.once("listening",z),$.listen(A$,Z)})}function f4($){$.close(()=>{}),$.closeIdleConnections?.(),setTimeout(()=>{$.closeAllConnections?.()},25).unref?.()}function O1(){return d0.size}function T1($){if(d0.delete($),O1()===0)C1()}async function yJ(){let $=`http://localhost:${A$}/auth/callback`;if(x6.length>0)return{port:A$,redirectUri:$};if(T$)return T$;T$=(async()=>{let Z=(z,B)=>{let Q=new URL(z.url||"/",`http://127.0.0.1:${A$}`);if(Q.pathname==="/auth/callback"){let Y=Q.searchParams.get("code"),H=Q.searchParams.get("state"),W=Q.searchParams.get("error"),V=Q.searchParams.get("error_description");if(W){let D=V||W;if(H){let U=d0.get(H);if(U)U.reject(Error(D)),T1(H);else if(O1()===0)C1()}else if(O1()===0)C1();B.writeHead(200,{"Content-Type":"text/html"}),B.end(b6(D));return}if(!H){if(O1()===0)C1();B.writeHead(400,{"Content-Type":"text/html"}),B.end(b6("Missing state parameter"));return}if(!Y){if(O1()===0)C1();B.writeHead(400,{"Content-Type":"text/html"}),B.end(b6("Missing authorization code"));return}let j=d0.get(H);if(!j){if(O1()===0)C1();B.writeHead(400,{"Content-Type":"text/html"}),B.end(b6("Unknown state — authorization may have expired"));return}T1(H),bJ(Y,$,j.pkce).then((D)=>j.resolve(D)).catch((D)=>j.reject(D)),B.writeHead(200,{"Content-Type":"text/html"}),B.end(kJ);return}if(Q.pathname==="/cancel"){let Y=Q.searchParams.get("state"),H=Y?[Y]:[...d0.keys()];B.writeHead(200),B.end("Login cancelled");for(let W of H){let V=d0.get(W);if(!V)continue;V.reject(Error("Login cancelled")),T1(W)}if(O1()===0)C1();return}B.writeHead(404),B.end("Not found")},X=I4(Z);await b4(X,"127.0.0.1");let J=[X],G=I4(Z);try{await b4(G,"::1"),J.push(G)}catch(z){let B=z.code;if(B!=="EADDRNOTAVAIL"&&B!=="EAFNOSUPPORT")throw f4(X),z}return x6=J,{port:A$,redirectUri:$}})();try{return await T$}finally{T$=void 0}}function C1(){let $=x6;x6=[];for(let Z of $)f4(Z)}function fJ($,Z,X=300000,J){return new Promise((G,z)=>{if(J?.aborted){T1(Z),z(Error("Login cancelled"));return}let B=setTimeout(()=>{if(d0.get(Z))T1(Z),z(Error("OAuth callback timeout — authorization took too long"))},X),Q=()=>{if(clearTimeout(B),d0.get(Z))T1(Z),z(Error("Login cancelled"))};if(J)J.addEventListener("abort",Q);d0.set(Z,{pkce:$,state:Z,resolve:(Y)=>{if(clearTimeout(B),J)J.removeEventListener("abort",Q);G(Y)},reject:(Y)=>{if(clearTimeout(B),J)J.removeEventListener("abort",Q);z(Y)}})})}async function gJ($){let Z=await fetch(`${P1}/api/accounts/deviceauth/usercode`,{method:"POST",headers:{"Content-Type":"application/json","User-Agent":x4($)},body:JSON.stringify({client_id:k6})});if(!Z.ok)throw Error("Failed to initiate device authorization");let X=await Z.json();return{deviceData:X,url:`${P1}/codex/device`,instructions:`Enter code: ${X.user_code}`}}async function hJ($,Z,X){let J=Math.max(parseInt($.interval,10)||5,1)*1000,G=typeof $.expires_in==="number"?$.expires_in:parseInt($.expires_in||"",10),z=!Number.isNaN(G)&&G>0?G*1000:900000,B=Date.now();while(!0){if(X?.aborted)throw Error("Device authorization cancelled");if(Date.now()-B>z)throw Error("Device authorization expired");let Q=await fetch(`${P1}/api/accounts/deviceauth/token`,{method:"POST",headers:{"Content-Type":"application/json","User-Agent":x4(Z)},body:JSON.stringify({device_auth_id:$.device_auth_id,user_code:$.user_code})});if(Q.ok){let W=await Q.json(),V=await fetch(`${P1}/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:W.authorization_code,redirect_uri:`${P1}/deviceauth/callback`,client_id:k6,code_verifier:W.code_verifier}).toString()});if(!V.ok)throw Error(`Token exchange failed: ${V.status}`);return await V.json()}if(Q.status!==403&&Q.status!==404)throw Error(`Device authorization failed: ${Q.status}`);let Y=z-(Date.now()-B);if(Y<=0)throw Error("Device authorization expired");let H=Math.min(J+TJ,Y);try{await PJ(H,void 0,{signal:X})}catch(W){if(W instanceof Error&&W.name==="AbortError")throw Error("Device authorization cancelled");throw W}}}async function g4($){let{label:Z,headless:X=!1,signal:J,version:G}=$;if(D3(Z),X){let{deviceData:W,url:V,instructions:j}=await gJ(G),D=(async()=>{let U=await hJ(W,G,J),N=Date.now(),K=S$(U);return{id:D3(Z||K||crypto.randomUUID()),label:Z||void 0,type:"oauth",access:U.access_token,refresh:U.refresh_token,expires:N+(U.expires_in??3600)*1000,enabled:!0,addedAt:N,lastUsed:N,lastRefreshedAt:N,accountId:K}})();return{url:V,instructions:j,completion:D}}let{redirectUri:z}=await yJ(),B=await RJ(),Q=y4(crypto.getRandomValues(new Uint8Array(32)).buffer),Y=IJ(z,B,Q),H=(async()=>{try{if(J?.aborted)throw Error("Login cancelled");let W=await fJ(B,Q,void 0,J),V=Date.now(),j=S$(W);return{id:D3(Z||j||crypto.randomUUID()),label:Z||void 0,type:"oauth",access:W.access_token,refresh:W.refresh_token,expires:V+(W.expires_in??3600)*1000,enabled:!0,addedAt:V,lastUsed:V,lastRefreshedAt:V,accountId:j}}finally{T1(Q)}})();return{url:Y,instructions:"Complete authorization in your browser. This window will close automatically.",completion:H}}import{basename as vJ,dirname as mJ,join as wJ}from"node:path";var y6="openai-auth.json",h4="openai-auth-state.json";function K3($){return vJ($)===y6?wJ(mJ($),h4):`${$}.state.json`}function f6($){if($==null||$==="")return;let Z=typeof $==="number"?$:Number($);if(Number.isFinite(Z)){let J=Z<100000000000?Z*1000:Z,G=new Date(J);return Number.isNaN(G.getTime())?void 0:G.toISOString()}let X=new Date($);return Number.isNaN(X.getTime())?void 0:X.toISOString()}function q3($){let Z=Number($);return Number.isFinite(Z)&&Z>0?Z:void 0}function v4($){return typeof $==="number"&&Number.isFinite($)&&$>=0?$:void 0}function m4($,Z){let X=$.get(Z);if(X===null||X.trim()==="")return;let J=Number(X);if(!Number.isFinite(J)||J<0||J>100)return;let G=Z.slice(0,-13),z=q3($.get(`${G}-window-minutes`)),B=f6($.get(`${G}-reset-at`)??void 0);if(J===0&&$.get(`${G}-window-minutes`)==="0"&&!B)return;return{usedPercent:J,remainingPercent:100-J,resetsAt:B,checkedAt:Date.now(),...z!==void 0?{windowMinutes:z}:{}}}var u4=["x-codex-primary-used-percent","x-codex-secondary-used-percent"];function l4($,Z){let X=$.get(Z);if(X===null)return"absent";if(X.trim()==="")return"invalid";let J=Number(X);return Number.isFinite(J)&&J>=0&&J<=100?"valid":"invalid"}function d4($){if(u4.some((G)=>l4($,G)==="invalid"))return{};let Z={},X=m4($,"x-codex-primary-used-percent");if(X)Z.primary=X;let J=m4($,"x-codex-secondary-used-percent");if(J)Z.secondary=J;return Z}function c4($){let Z=u4.map((X)=>l4($,X));return Z.includes("valid")&&!Z.includes("invalid")}function w4($){if(!$)return;if(!Number.isFinite($.used_percent)||$.used_percent<0||$.used_percent>100)return;let Z=q3($.window_minutes),X=f6($.reset_at);if($.used_percent===0&&Z===void 0&&!X)return;return{usedPercent:$.used_percent,remainingPercent:100-$.used_percent,resetsAt:X,checkedAt:Date.now(),...Z!==void 0?{windowMinutes:Z}:{}}}function s4($){let Z={},X=w4($.rate_limits?.primary);if(X)Z.primary=X;let J=w4($.rate_limits?.secondary);if(J)Z.secondary=J;return Z}function t1($){if($==null||$==="")return;let Z=Number($);return Number.isFinite(Z)&&Z>=0?Z:void 0}function p4($){if(!$)return;if(!Number.isFinite($.used_percent)||$.used_percent<0||$.used_percent>100)return;let Z=q3($.limit_window_seconds),X=f6($.reset_at);if($.used_percent===0&&Z===void 0&&!X)return;return{usedPercent:$.used_percent,remainingPercent:100-$.used_percent,resetsAt:X,checkedAt:Date.now(),...Z!==void 0?{windowMinutes:Z/60}:{}}}function i4($){let Z={},X=p4($.rate_limit?.primary_window);if(X)Z.primary=X;let J=p4($.rate_limit?.secondary_window);if(J)Z.secondary=J;let G=v4($.rate_limit_reset_credits?.available_count);if(G!==void 0)Z.resetCreditsAvailable=G;let z=v4($.rate_limit_reset_credits?.applicable_available_count);if(z!==void 0)Z.resetCreditsApplicable=z;let B=$.spend_control?.individual_limit;if($.spend_control===null||B===null)Z.spendControlCleared=!0;if(B&&typeof $.spend_control?.reached==="boolean"){let Y=t1(B.limit),H=t1(B.used),W=t1(B.remaining),V=t1(B.used_percent),j=t1(B.remaining_percent);if(Y!==void 0&&H!==void 0&&W!==void 0&&V!==void 0&&j!==void 0)Z.spendControl={limit:Y,used:H,remaining:W,usedPercent:V,remainingPercent:j,resetsAt:f6(B.reset_at),unit:B.unit,source:B.source,reached:$.spend_control.reached}}let Q=$.credits;if(Q&&typeof Q.has_credits==="boolean"&&typeof Q.unlimited==="boolean"&&typeof Q.overage_limit_reached==="boolean"){let Y=t1(Q.balance);Z.credits={hasCredits:Q.has_credits,unlimited:Q.unlimited,overageLimitReached:Q.overage_limit_reached,...Y!==void 0?{balance:Y}:{}}}return Z}import{ClaustrumClient as MG}from"@cortexkit/claustrum-client";import{resolve as a4}from"node:path";import{storeIdentity as pJ}from"@cortexkit/claustrum-client";import{SubcClient as uJ}from"@cortexkit/subc-client";function n4($){let Z=$.identity??pJ($.projectRoot??process.cwd(),$.storagePath??process.cwd());return{connectionFile:$.connectionFile,async getUsage(){let X,J=!1,G,z=new Promise((Q,Y)=>{G=setTimeout(()=>Y(Error("insula usage timeout")),3000),G.unref?.()}),B=(async()=>{if(X=$.connector?await $.connector({connectionFile:$.connectionFile,handshakeTimeoutMs:Math.min($.handshakeTimeoutMs??3000,3000)}):await uJ.connect({connectionFile:$.connectionFile,handshakeTimeoutMs:Math.min($.handshakeTimeoutMs??3000,3000)}),J)throw X.close(),Error("insula usage timeout");let Q=await X.routeOpen({kind:"management_surface",module_id:"insula"},Z);return await X.request(Q,{method:"usage.get",params:{}})})();try{return await Promise.race([B,z])}finally{J=!0,clearTimeout(G),X?.close()}}}}var F3=60000,lJ=4*F3,N3=new Map,g6=new Map;function M3($){return typeof $==="object"&&$!==null&&!Array.isArray($)}class r4{transport;key;#$=[];#Z;constructor($,Z){this.transport=$,this.key=Z}refresh($){if(this.#Z)return this.#Z;for(let[X,J]of g6)if($-J>=F3)g6.delete(X);let Z=g6.get(this.key);if(Z!==void 0&&$-Z<F3)return Promise.resolve();return g6.set(this.key,$),this.#Z=(async()=>{try{let X=await this.transport.getUsage();if(!M3(X)||!Array.isArray(X.result)||X.error!==void 0)throw Error("unavailable insula usage");this.#$=X.result.filter((J)=>M3(J)&&typeof J.provider==="string")}catch{this.#$=[]}})().finally(()=>{this.#Z=void 0}),this.#Z}current($,Z,X){for(let J of this.#$){if(J.provider!==$||typeof J.account!=="string"||J.account.trim()!==Z)continue;if(J.stale!==void 0||J.errorClass!==void 0||!M3(J.usage))continue;let G=typeof J.fetchedAt==="string"?Date.parse(J.fetchedAt):Number.NaN;if(!Number.isFinite(G)||X-G>=lJ)continue;return{entry:J,context:{fetchedAt:G,...typeof J.source==="string"&&{source:J.source}}}}return}}function o4($,Z){let X=JSON.stringify([a4($.connectionFile),a4(Z)]),J=N3.get(X);if(!J)J={source:new r4($,X),refs:0},N3.set(X,J);J.refs++;let G=!1;return{source:J.source,release(){if(G)return;if(G=!0,--J.refs===0)N3.delete(X)}}}import{ClaustrumCredentialError as iV}from"@cortexkit/claustrum-client";function L3($){let Z=new AbortController,X=[],J=!1,G=()=>{if(J)return;J=!0;for(let{source:Q,listener:Y}of X)Q.removeEventListener("abort",Y);X.length=0},z=(Q)=>{if(J||Z.signal.aborted)return;Z.abort(Q),G()},B=$.find((Q)=>Q.aborted);if(B)return Z.abort(B.reason),{signal:Z.signal,dispose:G};for(let Q of $){if(Z.signal.aborted)break;let Y=()=>z(Q.reason);if(X.push({source:Q,listener:Y}),Q.addEventListener("abort",Y,{once:!0}),Q.aborted)z(Q.reason)}return{signal:Z.signal,dispose:G}}import{ClaustrumCredentialError as GG}from"@cortexkit/claustrum-client";import{createHash as dJ,randomBytes as cJ,randomUUID as sJ}from"node:crypto";import{constants as t4}from"node:fs";import{chmod as iJ,mkdir as aJ,open as J2,readFile as _3,realpath as nJ,rename as rJ,stat as G2,unlink as z2}from"node:fs/promises";import{basename as B2,dirname as J1,extname as e4,isAbsolute as $2,join as C3,resolve as oJ}from"node:path";import{ClaustrumCredentialError as tJ,ClaustrumClient as eJ,writeEnrollmentTokenFile as $G}from"@cortexkit/claustrum-client";class R extends Error{kind;constructor($,Z){super(Z);this.name="ClaustrumConsumerError",this.kind=$}}var ZG=1,v6=16384,Q2=30000,P3=/^[0-9a-f]{64}$/,Y2=new Set(["invalid_params","pending_exists","not_found","already_consumed","superseded","stale_generation"]),H2=new Set(["pending_queue_full"]);function O3($){if(!($ instanceof tJ))return;if(Y2.has($.code))return{code:$.code,disposition:"terminal"};if(H2.has($.code))return{code:$.code,disposition:"retry"};return{code:$.code,disposition:$.action==="retry"?"retry":"terminal"}}function T3($,Z){if(!/^[a-z0-9][a-z0-9-]*$/.test($)||!/^[a-z0-9][a-z0-9-]*$/.test(Z))throw new R("invalid-state","Claustrum enrollment names use lowercase letters, digits and dashes");return`${$}-${Z}`}function A3($){return eJ.connect($)}function W2($){let Z=e4($)||".json",X=B2($,e4($));return{statePath:C3(J1($),`${X}-state${Z}`),tokenPath:$}}function S3($){let Z=$.override?.trim();if(Z&&!$2(Z)&&!$.cwd)throw new R("invalid-state","A relative Claustrum enrollment override needs a base directory");let X=Z?$2(Z)?Z:oJ($.cwd,Z):C3($.stateDir,`${$.host}-enrollment.json`);return W2(X)}function V2($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function h6($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=0}function U2($){return typeof $==="number"&&Number.isSafeInteger($)&&$>=1}function R$(){return new R("invalid-state","invalid Claustrum enrollment state")}function w6($){if(!V2($)||$.version!==ZG||typeof $.proposedName!=="string"||$.proposedName.length===0)throw R$();if($.phase==="pending"){if(!P3.test(String($.requestSecret??""))||$.requestId!==void 0&&(typeof $.requestId!=="string"||$.requestId.length===0)||!h6($.createdAt)||!h6($.updatedAt))throw R$();return{version:1,phase:"pending",proposedName:$.proposedName,requestSecret:$.requestSecret,...$.requestId!==void 0&&{requestId:$.requestId},createdAt:$.createdAt,updatedAt:$.updatedAt}}if($.phase==="approved"){if($.approvedName!==void 0&&(typeof $.approvedName!=="string"||$.approvedName.length===0)||!U2($.tokenGeneration)||!h6($.updatedAt))throw R$();return{version:1,phase:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration,updatedAt:$.updatedAt}}if($.phase==="denied"||$.phase==="blocked"){if($.errorCode!==void 0&&typeof $.errorCode!=="string"||!h6($.updatedAt))throw R$();return{version:1,phase:$.phase,proposedName:$.proposedName,...$.errorCode!==void 0&&{errorCode:$.errorCode},updatedAt:$.updatedAt}}throw R$()}function R3($){if(!V2($)||!P3.test(String($.token??""))||!U2($.token_generation))throw new R("invalid-token","invalid Claustrum enrollment token file");return{token:$.token,token_generation:$.token_generation}}function XG($){if(!$.isFile())throw new R("unsafe-file","Claustrum enrollment file must be a regular file");if(($.mode&63)!==0)throw new R("unsafe-file","Claustrum enrollment file must be owner-only");let Z=process.geteuid?.();if(Z!==void 0&&$.uid!==Z)throw new R("unsafe-file","Claustrum enrollment file must be owned by the current user")}function Z2($){try{return JSON.parse($)}catch{throw new R("invalid-state","Claustrum enrollment file is not valid JSON")}}async function G1($){if(I)try{await K0(J1($));let X=await M0($,!0);if(Buffer.byteLength(X)>v6)throw new R("unsafe-file","Claustrum enrollment file is too large");return Z2(X)}catch(X){if(X.code==="ENOENT")return;throw X}let Z;try{Z=await J2($,t4.O_RDONLY|t4.O_NOFOLLOW)}catch(X){if(X.code==="ENOENT")return;throw new R("unsafe-file","Claustrum enrollment file could not be opened safely")}try{XG(await Z.stat());let X=Buffer.alloc(v6+1),{bytesRead:J}=await Z.read(X,0,X.byteLength,0);if(J>v6)throw new R("unsafe-file","Claustrum enrollment file is too large");return Z2(X.subarray(0,J).toString("utf8"))}finally{await Z.close()}}function X2($,Z){let X=[];for(let J of $.split(`
+`)){if(J.trim()===""||J.startsWith("#"))continue;let G=J.split(":");if(G.length!==Z||!/^[^\s:,]+$/.test(G[0]??"")||!/^\d+$/.test(G[2]??"")||!Number.isSafeInteger(Number(G[2]))||Z===7&&(!/^\d+$/.test(G[3]??"")||!Number.isSafeInteger(Number(G[3])))||Z===4&&G[3]!==""&&!/^[^\s:,]+(?:,[^\s:,]+)*$/.test(G[3]??""))return;X.push(G)}return X}async function JG($,Z,X){try{let[J,G]=await Promise.all([_3(X.passwdPath??"/etc/passwd","utf8"),_3(X.groupPath??"/etc/group","utf8")]),z=X2(J,7),B=X2(G,4);if(!z||!B)return!1;let Q=z.filter((V)=>Number(V[2])===$),Y=B.filter((V)=>Number(V[2])===Z);if(Q.length!==1||Y.length!==1)return!1;let H=Q[0]?.[0],W=Y[0]?.[3]??"";return(W===""||W.split(",").every((V)=>V===H))&&!z.some((V)=>Number(V[2])!==$&&Number(V[3])===Z)}catch{return!1}}function j2($){if(!$.passwdPath&&!$.groupPath)return;return{fs:{readFile:(Z)=>_3(Z==="/etc/passwd"?$.passwdPath??Z:Z==="/etc/group"?$.groupPath??Z:Z)}}}async function D2($,Z={}){if(!I){let X=process.geteuid?.();if(X===void 0)return;let J=process.getegid?.(),G;try{G=await nJ($)}catch{return}let z;for(;;){let B=await G2(G).catch(()=>{return});if(B&&(B.mode&18)!==0&&(B.mode&512)===0){if(z===void 0)z=J!==void 0&&await JG(X,J,Z);if((B.mode&2)!==0||B.uid!==X||B.gid!==J||!z)throw new R("unsafe-file",`Claustrum enrollment path has a writable ancestor: ${G}. Another user could replace it. Run: chmod g-w,o-w ${G}`)}let Q=J1(G);if(Q===G)return;G=Q}}try{await v0($,j2(Z))}catch(X){if(!(X instanceof d))throw X;throw new R("unsafe-file",`Claustrum enrollment parent refused: ${X.path} (${X.reason??X.code}). Use a folder that other users cannot write or replace.`)}}async function m6($,Z={}){if(I){await K0($,!1,j2(Z));return}await aJ($,{recursive:!0,mode:448});let X=await G2($),J=process.geteuid?.();if(J!==void 0&&X.uid!==J)throw new R("unsafe-file","Claustrum enrollment directory must be owned by the current user");if((X.mode&63)!==0)await iJ($,448)}async function A1($,Z,X={}){let J=J1($);await m6(J,X),await D2(J,X);let G=`${JSON.stringify(Z)}
+`;if(Buffer.byteLength(G)>v6)throw new R("invalid-state","Claustrum enrollment state is too large");if(I)return v1($,G);let z=C3(J,`.${B2($)}.${process.pid}.${sJ()}.tmp`),B,Q=!1;try{B=await J2(z,"wx",384),Q=!0,await B.writeFile(G,"utf8"),await B.chmod(384),await B.sync(),await B.close(),B=void 0,await rJ(z,$),Q=!1}finally{if(await B?.close().catch(()=>{}),Q)await z2(z).catch(()=>{})}}async function E$($,Z){let X=await G1($.tokenPath),J=X===void 0?void 0:R3(X),G=await G1($.statePath),z=G===void 0?void 0:w6(G);if(J)return{state:"approved",proposedName:z?.proposedName??Z,...z?.phase==="approved"&&z.approvedName!==void 0&&{approvedName:z.approvedName},tokenGeneration:J.token_generation};if(!z)return{state:"idle"};if(z.phase==="approved")return{state:"blocked",proposedName:z.proposedName,code:"missing_token"};return X1(z)}async function E3($,Z){let X;try{X=await E$($,Z)}catch(J){if(!(J instanceof R)||J.kind!=="invalid-state"&&J.kind!=="invalid-token")return"unreadable";try{let G=await G1($.statePath);if(G===void 0)return"unreadable";let z=w6(G);return z.phase==="approved"&&z.proposedName===Z?"vault":"unreadable"}catch{return"unreadable"}}if("proposedName"in X&&X.proposedName!==Z)return"unreadable";if(X.state==="approved"||X.state==="blocked"&&X.code==="missing_token")return"vault";return"local"}async function S1($){let Z=await G1($);if(Z===void 0)throw new R("not-enrolled","Claustrum enrollment is not configured");return R3(Z)}function X1($){if($.phase==="pending")return{state:"pending",proposedName:$.proposedName,...$.requestId!==void 0&&{requestId:$.requestId}};if($.phase==="approved")return{state:"approved",proposedName:$.proposedName,...$.approvedName!==void 0&&{approvedName:$.approvedName},tokenGeneration:$.tokenGeneration};if($.phase==="denied")return{state:"denied",proposedName:$.proposedName};return{state:"blocked",proposedName:$.proposedName,code:$.errorCode??"unknown"}}function K2(){return new R("wrong-consumer","Claustrum enrollment state belongs to a different consumer")}class p6{#$;#Z;#z;#J;#W;#Q;#X;constructor($){this.#X=$.ancestorOptions??{},this.#$=$.client,this.#Z=$.paths,this.#z=$.proposedName,this.#J=$.now??Date.now,this.#W=$.mintSecret??(()=>cJ(32).toString("hex")),this.#Q=$.writeTokenFile??$G}async status(){return E$(this.#Z,this.#z)}async resetTerminal(){return q2(this.#Z,this.#z)}async#B($,Z){let X={version:1,phase:"blocked",proposedName:$.proposedName,errorCode:Z,updatedAt:this.#J()};return await A1(this.#Z.statePath,X,this.#X),X1(X)}async reconcile(){await m6(J1(this.#Z.statePath),this.#X);let $=await e({name:"ceremony",path:this.#Z.statePath,ttlMs:Q2,renew:!0});if(!$)return{state:"busy"};try{let Z=await G1(this.#Z.tokenPath),X=Z===void 0?void 0:R3(Z),J=await G1(this.#Z.statePath),G=J===void 0?void 0:w6(J);if(G&&G.proposedName!==this.#z)throw K2();if(X){if(!G||G.phase==="pending"){let B={version:1,phase:"approved",proposedName:G?.proposedName??this.#z,tokenGeneration:X.token_generation,updatedAt:this.#J()};await A1(this.#Z.statePath,B,this.#X),G=B}return{state:"approved",proposedName:G.proposedName,...G.phase==="approved"&&G.approvedName!==void 0&&{approvedName:G.approvedName},tokenGeneration:X.token_generation}}if(G?.phase==="approved"){let B={version:1,phase:"blocked",proposedName:G.proposedName,errorCode:"missing_token",updatedAt:this.#J()};return await A1(this.#Z.statePath,B,this.#X),X1(B)}if(G&&G.phase!=="pending")return X1(G);if(!G){let B=this.#J();if(G={version:1,phase:"pending",proposedName:this.#z,requestSecret:this.#W(),createdAt:B,updatedAt:B},!P3.test(G.requestSecret))throw new R("invalid-state","invalid minted Claustrum enrollment secret");await A1(this.#Z.statePath,G,this.#X)}if(!G.requestId)try{let B=dJ("sha256").update(Buffer.from(G.requestSecret,"hex")).digest("hex"),Q=await this.#$.enrollPropose({name:G.proposedName,requestSecretHash:B});G={...G,requestId:Q.requestId,updatedAt:this.#J()},await A1(this.#Z.statePath,G,this.#X)}catch(B){let Q=O3(B);if(!Q)throw B;if(Q.disposition==="retry")return{state:"pending",proposedName:G.proposedName,retryCode:Q.code};return this.#B(G,Q.code)}let z=G.requestId;if(!z)return X1(G);try{let B=await this.#$.enrollPoll({requestId:z,requestSecret:G.requestSecret});if(B.status==="pending")return X1(G);if(B.status==="denied"){let Y={version:1,phase:"denied",proposedName:G.proposedName,updatedAt:this.#J()};return await A1(this.#Z.statePath,Y,this.#X),X1(Y)}await m6(J1(this.#Z.tokenPath),this.#X),await D2(J1(this.#Z.tokenPath),this.#X),await this.#Q(this.#Z.tokenPath,{token:B.token,token_generation:B.tokenGeneration});let Q={version:1,phase:"approved",proposedName:G.proposedName,approvedName:B.name,tokenGeneration:B.tokenGeneration,updatedAt:this.#J()};return await A1(this.#Z.statePath,Q,this.#X),X1(Q)}catch(B){let Q=O3(B);if(!Q)throw B;if(Q.disposition==="retry")return{state:"pending",proposedName:G.proposedName,requestId:z,retryCode:Q.code};return this.#B(G,Q.code)}}finally{await $.release()}}}async function q2($,Z){await m6(J1($.statePath));let X=await e({name:"ceremony",path:$.statePath,ttlMs:Q2,renew:!0});if(!X)return"busy";try{if(await G1($.tokenPath)!==void 0)return"refused-approved";let J=await G1($.statePath);if(J===void 0)return"idle";let G=w6(J);if(G.proposedName!==Z)throw K2();if(G.phase==="pending")return"refused-pending";return await X.assertOwned(),await z2($.statePath),"reset"}finally{await X.release()}}var I$="claustrum-tombstone:v1:";function u6($){return`${I$}${$}`}function I3($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function l6($){return typeof $==="string"&&$.startsWith(I$)}function N2($,Z){if(!I3($)||$.type!=="oauth")return!1;return $.refresh===u6(Z)}function M2($,Z){if(N2($,Z))return"placeholder";if(I3($)&&$.type==="oauth"&&typeof $.refresh==="string"&&$.refresh.length>0&&!l6($.refresh))return"login";if(I3($)&&$.type==="api"&&typeof $.key==="string"&&$.key.length>0)return"login";return"empty"}function b3($){let Z=M2($.auth,$.provider);if($.mode==="custody"&&Z==="login")throw new R("host-slot-login",`${$.provider} has a host login while its accounts are vault-custodied; refusing to serve until one is removed`);if($.mode==="local"&&Z==="placeholder")throw new R("host-slot-placeholder",`${$.provider} host slot holds the vault placeholder; sign in to use local accounts`);return Z}function F2($,Z){return Z!==void 0&&Z.credentialId===$.credentialId&&Z.accountIdentity===$.accountIdentity&&Z.recordVersion!==$.recordVersion}function zG($,Z){if(Z===void 0)return"reauthorize-failed";if(Z.credentialId!==$.credentialId)return"credential-changed";if(Z.accountIdentity!==$.accountIdentity)return"account-changed";if(Z.recordVersion===$.recordVersion)return"version-unchanged";return"rotated"}var L2=a("claustrum");function y3($,Z,X,J=L2){let G=F2(Z,X);return J.debug("scoped 401 re-authorized",{site:$,credentialId:Z.credentialId,servedVersion:Z.recordVersion,currentVersion:X?.recordVersion??null,retry:G,reason:zG(Z,X)}),G}var k3=300000;function x3(){return new R("invalid-material","Claustrum returned invalid credential material")}function BG($){let Z=$.trim();if(Z.startsWith("{")){let X;try{X=JSON.parse(Z)}catch{throw x3()}if(!X||typeof X!=="object")throw x3();let J=X,G=J.access_token??J.access;Z=typeof G==="string"?G:""}if(!/^[\x21-\x7e]+$/.test(Z)||Z.startsWith(I$))throw x3();return Z}function QG($,Z){if(!$.operations.includes("read"))return;if(!$.categories.includes(Z.category))return;if($.credentialType==="oauth")return $.refreshAdapter===Z.refreshAdapter?"oauth":void 0;if($.credentialType==="api_key"&&Z.apiKeys)return $.refreshAdapter===void 0?"api_key":void 0;return}class d6{#$;#Z;#z;#J;#W;#Q;#X;#B=new WeakMap;#V=new WeakMap;#Y=!1;constructor($){let Z=$.tokenPath;if($.readToken)this.#Z=$.readToken;else if(Z)this.#Z=()=>S1(Z);else throw new R("not-enrolled","Claustrum enrollment token path is required");this.#$=$.client,this.#J=$.family,this.#W=$.parseIdentity,this.#Q=$.requireAssertion??!1,this.#z=$.now??Date.now,this.#X=$.logger??L2}#G($){if(this.#Y)throw new R("closed","Claustrum scoped custody is closed");$?.throwIfAborted()}async#U($){this.#G($);let Z=await this.#Z();if(this.#G($),!/^[0-9a-f]{64}$/.test(Z.token)||!Number.isSafeInteger(Z.token_generation)||Z.token_generation<1)throw new R("invalid-token","Invalid Claustrum enrollment token");return Z.token}async#H($,Z){this.#G(Z);let X,J;try{let G=$();X=Z?await Promise.race([G,new Promise((z,B)=>{let Q=()=>B(Z.reason);if(Z.addEventListener("abort",Q,{once:!0}),J=()=>Z.removeEventListener("abort",Q),Z.aborted)Q()})]):await G}catch(G){if(this.#G(Z),G instanceof GG)throw G;throw new R("unavailable","Claustrum scoped operation unavailable")}finally{J?.()}return this.#G(Z),X}async discover($){let Z=await this.#U($),X=await this.#H(()=>this.#$.listScoped(Z),$),J=[],G=[],z=new Map;for(let Q of X.rows){let Y=QG(Q,this.#J);if(!Y)continue;G.push({row:Q,type:Y}),z.set(Q.id,(z.get(Q.id)??0)+1)}let B=[];for(let{row:Q,type:Y}of G){let H;if(!Q.id.trim())H="empty credential id";else if((z.get(Q.id)??0)>1)H="duplicate credential id";else if(Q.accountId!==void 0&&!Q.accountId.trim())H="blank account identity";else if(!Q.state.trim())H="empty state";if(H){J.push({...Q.id.trim()&&{credentialId:Q.id},reason:H});continue}B.push(Object.freeze({credentialId:Q.id,credentialType:Y,...Q.accountId!==void 0&&{accountIdentity:Q.accountId},state:Q.state,...Q.email!==void 0&&{email:Q.email},...Q.orgName!==void 0&&{orgName:Q.orgName}}))}for(let Q of J)this.#X.warn("skipped malformed vault record",Q);return{view:X.view,credentials:Object.freeze(B),skipped:Object.freeze(J)}}async authorize($,Z){if(!$.credentialId)throw new R("route-unavailable","Claustrum dispatch requires a credential id");let{credentialId:X,credentialType:J,accountIdentity:G}=$;if(this.#Q&&G===void 0)throw new R("identity-unasserted","Claustrum dispatch requires a known account identity");let z=await this.#U(Z),B=await this.#H(()=>this.#$.getScoped({credentialId:X,enrollmentToken:z,...J==="oauth"&&{minTtlMs:k3}}),Z);if(B.credentialId!==void 0&&B.credentialId!==X)throw new R("identity-changed","Claustrum served credential identity changed");let Q=B.expiresAtMs;if(!Number.isSafeInteger(B.recordVersion)||B.recordVersion<0||Q===null&&J==="oauth"||Q!==null&&(!Number.isFinite(Q)||Q-this.#z()<k3))throw new R("insufficient-validity","Claustrum served credential has insufficient validity");let Y=BG(B.material),H=B.accountId?.trim()?B.accountId:void 0;if(this.#Q&&(B.credentialId===void 0||H===void 0))throw new R("identity-unasserted","Claustrum served credential did not assert its identity");let W=H===void 0?this.#W?.(Y):void 0,V=H??W;if(G!==void 0&&V!==void 0&&V!==G)throw new R("identity-changed","Claustrum served credential identity changed");let j=V??G,U=Object.freeze(Object.defineProperty({credentialId:X,credentialType:J,...j!==void 0&&{accountIdentity:j},accountIdentitySource:H!==void 0?"asserted":W!==void 0?"parsed":G!==void 0?"expected":"none",...G!==void 0&&{expectedAccountIdentity:G},...B.credentialId!==void 0&&{assertedCredentialId:B.credentialId},...H!==void 0&&{assertedAccountIdentity:H},...B.projectId!==void 0&&{projectId:B.projectId},recordVersion:B.recordVersion,expiresAtMs:Q},"accessToken",{value:Y,enumerable:!1}));return this.#B.set(U,z),U}async reportFailure($,Z,X){if(Z!==401)return;this.#G();let J=this.#B.get($);if(!J)throw new R("no-receipt","Claustrum failure report requires an original dispatch receipt");let G=this.#V.get($);if(G)return G;let z=this.#H(()=>this.#$.reportAuthFailureScoped({credentialId:$.credentialId,enrollmentToken:J,providerStatus:401,recordVersion:$.recordVersion,reporterSource:X}));this.#V.set($,z);try{await z,this.#X.debug("scoped 401 reported",{credentialId:$.credentialId,recordVersion:$.recordVersion,reporterSource:X})}catch(B){throw this.#V.delete($),B}}close(){if(this.#Y)return;this.#Y=!0,this.#$.close()}}import{createHash as YG}from"node:crypto";function _2($,Z,X){if($.accountIdentity!==void 0&&X!==void 0)return $.accountIdentity===X;return $.credentialId===Z}function f3($,Z,X){return $.some((J)=>_2(J,Z,X))}function g3($,Z,X){let J={credentialId:Z,...X!==void 0&&{accountIdentity:X}};return[...$.filter((G)=>G.credentialId!==Z||G.accountIdentity!==X),J]}function h3($,Z,X){return $.filter((J)=>!Z.some((G)=>_2(J,G,X)))}var C2="vault:";function HG($){return YG("sha256").update($).digest("hex")}function WG($){let Z=$.credentialId.split(":");return(Z.length>=3?Z.slice(2).join(":").trim():void 0)||$.email||$.credentialId}function VG($){return $.identity!==void 0?`identity:${$.identity}`:`credential:${$.credential.credentialId}`}function z1($){return[$.credentialId,...$.aliases??[]]}function P2($,Z,X={}){let J=X.now??Date.now(),G=X.routePrefix??C2,z=X.reservedRouteIds??new Set,B=$?.rows??[],Q=[...$?.declined??[]],Y=Z.skipped.length===0,H=new Set(Z.credentials.map((F)=>F.credentialId)),W=new Set(Z.skipped.flatMap((F)=>F.credentialId===void 0?[]:[F.credentialId])),V=Z.skipped.some((F)=>F.credentialId===void 0),j=(F)=>!H.has(F)&&(W.has(F)||V),D=new Map;for(let F of B){if(F.accountIdentity===void 0)continue;for(let q of z1(F))if(!D.has(q))D.set(q,F.accountIdentity)}let U=new Map;for(let F of Z.credentials){let q=F.accountIdentity!==void 0?{credential:F,identity:F.accountIdentity,claimed:!0}:{credential:F,identity:D.get(F.credentialId),claimed:!1},L=VG(q),S=U.get(L)??[];S.push(q),U.set(L,S)}let N=new Set,K=new Set(z),M=[],P=(F,q)=>F.credential.credentialId.localeCompare(q.credential.credentialId),E=[...U.values()].map((F)=>F.toSorted(P)).sort((F,q)=>F[0]&&q[0]?P(F[0],q[0]):0);for(let F of E){let q=F[0]?.identity,L=F.filter((v)=>v.credential.state==="active"),S=L.length?L:F,A=S.filter((v)=>v.claimed),x=A.length?A:S,w=new Set(F.map((v)=>v.credential.credentialId)),y=B.find((v)=>!N.has(v)&&z1(v).some((g0)=>w.has(g0))&&(v.accountIdentity===void 0||v.accountIdentity===q)),f=x.find((v)=>v.credential.credentialId===y?.credentialId)??x[0];if(!f)continue;let h=f.credential,r=y??(q===void 0?void 0:B.find((v)=>!N.has(v)&&v.accountIdentity===q));if(r)N.add(r);let c=r?.routeId;if(!c||z.has(c)){let v=`${G}${h.credentialId}${q===void 0?"":`~${HG(q).slice(0,10)}`}`;c=v;for(let g0=2;K.has(c);g0++)c=`${v}~${g0}`}K.add(c);let r$=r?z1(r).filter(j):[],x1=[...new Set([...F.map((v)=>v.credential.credentialId),...r$])].filter((v)=>v!==h.credentialId).sort((v,g0)=>v.localeCompare(g0)),o$=X.mapAccount?.(h)??{};M.push({previousIndex:r?B.indexOf(r):1/0,row:{routeId:c,credentialId:h.credentialId,credentialType:h.credentialType,...q!==void 0&&{accountIdentity:q},...x1.length&&{aliases:x1},state:h.state,label:o$.label?.trim()||WG(h),...h.email!==void 0&&{email:h.email},...h.orgName!==void 0&&{orgName:h.orgName},enabled:![h.credentialId,...x1].some((v)=>f3(Q,v,q)),addedAt:r?.addedAt??J,...r?.quota!==void 0&&{quota:r.quota},...!f.claimed&&q!==void 0&&{unclaimed:!0}}})}return B.forEach((F,q)=>{if(N.has(F)||!z1(F).some(j))return;if(K.has(F.routeId))return;let[L,...S]=z1(F).filter((w)=>!H.has(w));if(L===void 0)return;K.add(F.routeId);let{aliases:A,...x}=F;M.push({previousIndex:q,row:{...x,credentialId:L,...S.length&&{aliases:S},stale:!0}})}),M.sort((F,q)=>F.previousIndex===q.previousIndex?F.row.credentialId.localeCompare(q.row.credentialId):F.previousIndex-q.previousIndex),{version:1,view:Z.view,complete:Y,...!Y&&{rejected:Z.skipped.map((F)=>({...F.credentialId!==void 0&&{credentialId:F.credentialId},reason:F.reason}))},rows:M.map((F)=>F.row),declined:Q}}function v3($){return($?.rows??[]).filter((Z)=>Z.enabled&&Z.state==="active").map((Z)=>({id:Z.routeId,kind:Z.credentialType==="oauth"?"oauth":"api-key",...Z.quota!==void 0&&{quota:Z.quota}}))}function b$($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function e1($){return $===void 0||typeof $==="string"}function UG($){let Z=b$($)?q1($.quota):void 0;if(!b$($)||typeof $.routeId!=="string"||typeof $.credentialId!=="string"||$.credentialType!=="oauth"&&$.credentialType!=="api_key"||typeof $.state!=="string"||typeof $.label!=="string"||typeof $.enabled!=="boolean"||typeof $.addedAt!=="number"||!e1($.accountIdentity)||!e1($.email)||!e1($.orgName)||$.aliases!==void 0&&(!Array.isArray($.aliases)||!$.aliases.every((X)=>typeof X==="string"))||$.quota!==void 0&&Z===void 0||$.stale!==void 0&&$.stale!==!0||$.unclaimed!==void 0&&$.unclaimed!==!0)return;return{...$,...Z===void 0?{}:{quota:Z}}}var jG=new Set(["empty credential id","duplicate credential id","blank account identity","empty state"]);function O2($){if(!Array.isArray($))return;let Z=[];for(let X of $){if(!b$(X)||!e1(X.credentialId)||typeof X.reason!=="string"||!jG.has(X.reason))return;Z.push(X)}return Z}function DG($){if(!b$($)||$.version!==1||!e1($.view)||!Array.isArray($.rows)||!Array.isArray($.declined)||$.complete!==void 0&&typeof $.complete!=="boolean"||$.rejected!==void 0&&!O2($.rejected))throw new R("invalid-state","Claustrum roster file is not valid");let Z=[];for(let G of $.rows){let z=UG(G);if(!z)throw new R("invalid-state","Claustrum roster file is not valid");Z.push(z)}let X=[];for(let G of $.declined){if(!b$(G)||typeof G.credentialId!=="string"||!e1(G.accountIdentity))throw new R("invalid-state","Claustrum roster file is not valid");X.push(G)}let J=O2($.rejected);return{version:1,...typeof $.view==="string"&&{view:$.view},complete:$.complete!==!1,...J&&{rejected:J},rows:Z,declined:X}}async function L0($){let Z;try{Z=await M0($,I)}catch(J){if(J.code==="ENOENT")return;throw J}let X;try{X=JSON.parse(Z)}catch{throw new R("invalid-state","Claustrum roster file is not valid")}return DG(X)}var KG={name:"claustrum-roster-write",ttlMs:1e4,timeoutMs:5000},qG={name:"claustrum-roster",ttlMs:30000};async function $$($,Z,X={}){return wZ($,KG,async(J)=>{let G=await L0($),{next:z,result:B}=await Z(G,{assertOwned:()=>J.assertOwned()});if(z)await J.assertOwned(),await F0($,z,{beforeRename:async()=>{await X.beforePublish?.(),await J.assertOwned()}});return B})}function m3($,Z){return $$($,(X)=>{let J=X?.rows.find((z)=>z.routeId===Z);if(!X||!J)throw new R("route-unavailable","Claustrum route is not in the roster");let G=g3(X.declined,J.credentialId,J.accountIdentity);return{next:{...X,declined:G,rows:X.rows.map((z)=>z===J?{...z,enabled:!1}:z)},result:void 0}})}function w3($,Z){return $$($,(X)=>{let J=X?.rows.find((G)=>G.routeId===Z);if(!X||!J)throw new R("route-unavailable","Claustrum route is not in the roster");return{next:{...X,declined:h3(X.declined,z1(J),J.accountIdentity),rows:X.rows.map((G)=>G===J?{...G,enabled:!0}:G)},result:void 0}})}function NG($,Z){if(!z1($).includes(Z.credentialId))return"refuse";if($.unclaimed&&(Z.accountIdentitySource==="expected"||Z.accountIdentitySource==="none"))return"refuse";if($.accountIdentity===Z.accountIdentity)return"hold";if($.accountIdentity===void 0&&Z.expectedAccountIdentity===void 0&&Z.accountIdentity!==void 0&&(Z.accountIdentitySource==="asserted"||Z.accountIdentitySource==="parsed")&&z1($).length===1)return"bind";return"refuse"}function p3($,Z){return $$($,(X)=>{let J=X?.rows.find((Q)=>Q.routeId===Z.routeId),G=!X||!J?"refuse":NG(J,Z);if(!X||!J||G==="refuse")return{result:!1};let z=E0(J.quota,Z.observation),B=G==="bind"?{accountIdentity:Z.accountIdentity,unclaimed:!0}:{};return{next:{...X,rows:X.rows.map((Q)=>Q===J?{...Q,...B,quota:z}:Q)},result:!0}})}function u3($,Z){return $$($,(X)=>{let J=X?.rows.find((z)=>z.routeId===Z.routeId);if(!X||!J||J.accountIdentity===void 0||J.accountIdentity!==Z.accountIdentity)return{result:!1};let G=E0(J.quota,Z.observation);return{next:{...X,rows:X.rows.map((z)=>z===J?{...z,quota:G}:z)},result:!0}})}async function l3($){$.signal?.throwIfAborted();let Z=async()=>await $.isActive?.()??!0;if(!await Z())return;let X=await e({...qG,path:$.path,renew:!0});if(!X){let J=await L0($.path);if($.signal?.throwIfAborted(),!J?.view)throw new R("roster-busy","Claustrum account discovery is already in progress");return J}try{let J=await $.custody.discover($.signal);return $.signal?.throwIfAborted(),await $$($.path,async(G)=>{if(!await Z())return{result:void 0};$.signal?.throwIfAborted(),await X.assertOwned();let z=typeof $.projection==="function"?$.projection():$.projection,B=P2(G,J,z);return{...JSON.stringify(G)!==JSON.stringify(B)&&{next:B},result:B}})}finally{await X.release()}}class c6{#$;#Z=new AbortController;#z;#J;#W;#Q;#X;#B;#V=!1;#Y;constructor($){this.#$=$,this.#z=$.logger??a("claustrum")}#G($){this.#Z.signal.throwIfAborted(),$?.throwIfAborted()}async#U(){return await this.#$.isCustodyActive?.()??!0}#H($,Z){let X=L3([this.#Z.signal,...Z?[Z]:[]]);return new Promise((J,G)=>{let z=()=>{X.signal.removeEventListener("abort",B),X.dispose()},B=()=>{z(),G(X.signal.reason)};if(X.signal.addEventListener("abort",B,{once:!0}),$.then((Q)=>{if(z(),X.signal.aborted)G(X.signal.reason);else J(Q)},(Q)=>{z(),G(Q)}),X.signal.aborted)B()})}async#D(){if(this.#G(),this.#J)return this.#J;if(!this.#W)this.#W=this.#$.connect().then(($)=>{if(this.#Z.signal.aborted)$.close(),this.#G();if(this.#J=new d6({client:$,family:this.#$.family,tokenPath:this.#$.tokenPath,parseIdentity:this.#$.parseIdentity,requireAssertion:this.#$.requireAssertion,now:this.#$.now,logger:this.#z}),this.#$.insula&&$.insula)this.#Y=o4($.insula,this.#$.tokenPath);return this.#J}).finally(()=>{this.#W=void 0});return this.#H(this.#W)}snapshot(){return this.#X}routingRows(){return v3(this.#X)}refresh(){if(this.#G(),this.#Q)return this.#Q;return this.#Q=(async()=>{if(!await this.#U()){this.#X=void 0,this.#J?.close(),this.#J=void 0,this.#Y?.release(),this.#Y=void 0;return}let $=await this.#D(),Z=await l3({path:this.#$.rosterPath,custody:$,isActive:()=>this.#U(),signal:this.#Z.signal,projection:()=>({reservedRouteIds:new Set(this.#$.reservedRouteIds?.()??[]),routePrefix:this.#$.routePrefix,mapAccount:this.#$.mapAccount,now:(this.#$.now??Date.now)()})});this.#G();let X=Z?.view!==this.#X?.view;if(this.#X=Z,Z&&X)this.#$.onRoster?.(Z);return Z})().finally(()=>{this.#Q=void 0}),this.#Q}start(){if(this.#V)return;this.#G(),this.#V=!0;let $=async()=>{try{await this.refresh(),await this.refreshInsulaQuota()}catch(X){if(!this.#Z.signal.aborted)this.#$.onError?.(X)}if(this.#Z.signal.aborted)return;let Z=this.#$.pollIntervalMs??5000;if(Z<=0)return;this.#B=(this.#$.setTimeoutImpl??setTimeout)(()=>{this.#B=void 0,$()},Z),this.#B.unref?.()};$()}async refreshInsulaQuota(){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#U())return;try{await S1(this.#$.tokenPath),await this.#D(),await this.#Y?.source.refresh((this.#$.now??Date.now)())}catch{}}async cachedInsulaQuota($){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#U())return;try{return await S1(this.#$.tokenPath),this.#K($.assertedAccountIdentity)}catch{return}}async cachedInsulaQuotaForRoute($){if(!this.#$.insula||this.#Z.signal.aborted||!await this.#U())return;try{await S1(this.#$.tokenPath);let X=(await L0(this.#$.rosterPath))?.rows.find((J)=>J.routeId===$);return this.#K(X?.accountIdentity)}catch{return}}#K($){if(!this.#$.insula||!$)return;let Z=this.#Y?.source.current(this.#$.insula.provider,$,(this.#$.now??Date.now)());return Z?this.#$.insula.normalize(Z.entry,Z.context):void 0}async authorize($,Z){this.#G(Z);let X=this.#X??await this.#H(this.refresh(),Z);if(!X||!await this.#U())throw new R("not-active","Claustrum scoped custody is not active");let J=await L0(this.#$.rosterPath);this.#G(Z);let G=X.rows.find((Y)=>Y.routeId===$),z=J?.rows.find((Y)=>Y.routeId===$);if(z&&!z.enabled)throw new R("route-declined","Claustrum route is disabled");if(!G||!z||z.state!=="active"||z.credentialId!==G.credentialId||z.accountIdentity!==G.accountIdentity)throw new R("route-unavailable","Claustrum route is disabled, removed or changed");let B=await this.#H(this.#D(),Z),Q=L3([this.#Z.signal,...Z?[Z]:[]]);try{return await B.authorize({credentialId:z.credentialId,credentialType:z.credentialType,...z.accountIdentity!==void 0&&{accountIdentity:z.accountIdentity}},Q.signal)}finally{Q.dispose()}}async reportFailure($,Z,X){if(this.#G(),!this.#J)throw new R("no-receipt","Claustrum dispatch receipt has no active owner");await this.#J.reportFailure($,Z,X)}async send($,Z,X){let J=X.signal,G=await this.authorize($,J),z=await Z(G,J);if(z.status===401&&!J?.aborted){let B;try{B=await this.authorize($,J)}catch{}if(y3(X.site,G,B,this.#z))await z.body?.cancel().catch(()=>{}),G=B,z=await Z(B,J)}if(z.status===401)await this.reportFailure(G,401,X.reporterSource??"direct").catch((B)=>this.#$.onError?.(B)),Promise.resolve().then(()=>this.refresh()).catch((B)=>{if(!this.#Z.signal.aborted)this.#$.onError?.(B)});return z}async decline($){this.#G(),await m3(this.#$.rosterPath,$),this.#X=await L0(this.#$.rosterPath)}async accept($){this.#G(),await w3(this.#$.rosterPath,$),this.#X=await L0(this.#$.rosterPath)}async recordQuota($,Z,X){this.#G();let J=await p3(this.#$.rosterPath,{routeId:$,observation:Z,credentialId:X.credentialId,accountIdentitySource:X.accountIdentitySource,...X.accountIdentity!==void 0&&{accountIdentity:X.accountIdentity},...X.expectedAccountIdentity!==void 0&&{expectedAccountIdentity:X.expectedAccountIdentity}});if(J)this.#X=await L0(this.#$.rosterPath);return J}async recordAccountQuota($,Z,X){this.#G();let J=await u3(this.#$.rosterPath,{routeId:$,accountIdentity:Z,observation:X});if(J)this.#X=await L0(this.#$.rosterPath);return J}close(){if(this.#Z.signal.aborted)return;if(this.#Z.abort(new R("closed","Claustrum consumer is closed")),this.#B)(this.#$.clearTimeoutImpl??clearTimeout)(this.#B);this.#B=void 0,this.#J?.close(),this.#Y?.release(),this.#Y=void 0,this.#X=void 0}}async function T2($){let Z=await MG.connect($);return Object.assign(Z,{insula:n4($)})}var FG=u6("openai");function A2($){return l6($)}function k0($){if(!$||$.corrupt===!0)return!1;return A2($.refresh)}class x$ extends Error{code="tombstone-refresh";constructor(){super("This OpenAI account was moved into the Claustrum vault by an older version of OpenAI auth and holds no local credential. Connect the vault, or sign in to the account again.");this.name="TombstoneRefreshError"}}function s6($){if(A2($))throw new x$}function c0($){if($ instanceof Error)return $.message;if(typeof $==="string")return $;try{return JSON.stringify($)}catch{return String($)}}var LG=a("quota");var _G="app_EMoamEEZ73f0CkXaXp7hrann",OG="https://auth.openai.com";async function S2($){s6($.refreshToken);let Z=await $.fetchImpl(`${OG}/oauth/token`,{method:"POST",signal:AbortSignal.timeout(15000),headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"refresh_token",refresh_token:$.refreshToken,client_id:_G}).toString()});if(!Z.ok){let G=j3(Z.headers.get("retry-after"));throw Object.assign(Error(`Token refresh failed: ${Z.status}`),{status:Z.status,retryAfter:G,isRefreshError:!0})}let X=await Z.json();if(!X||typeof X.access_token!=="string"||!X.access_token||typeof X.expires_in!=="number")throw Object.assign(Error("Token refresh failed: malformed response"),{status:Z.status,isRefreshError:!0});if(X.refresh_token!==void 0&&typeof X.refresh_token!=="string")throw Object.assign(Error("Token refresh failed: malformed response"),{status:Z.status,isRefreshError:!0});let J=typeof X.refresh_token==="string"&&X.refresh_token?X.refresh_token:$.refreshToken;return{access:X.access_token,refresh:J,expires:$.now()+X.expires_in*1000,expiresIn:X.expires_in}}var CG="https://chatgpt.com/backend-api/wham/usage";async function Z$($){let Z=$.logger??LG,X=$.accountKey??"unknown",J=Date.now();Z.debug("wham usage fetch started",{pid:process.pid,accountId:X});try{let G=await $.fetchImpl(CG,{signal:AbortSignal.timeout(15000),headers:{authorization:`Bearer ${$.accessToken}`,"chatgpt-account-id":$.accountId??"","oai-client-platform":"web","oai-client-version":"0","x-openai-target-path":"/backend-api/wham/usage"}});if(!G.ok){let B=j3(G.headers.get("retry-after"));throw Object.assign(Error(`wham usage check failed: ${G.status}`),{status:G.status,retryAfter:B})}let z=i4(await G.json());return Z.debug("wham usage fetch succeeded",{pid:process.pid,accountId:X,status:G.status,elapsedMs:Date.now()-J}),z}catch(G){throw Z.warn("wham usage fetch failed",{pid:process.pid,accountId:X,status:typeof G?.status==="number"?G.status:"error",elapsedMs:Date.now()-J,error:c0(G)}),G}}import{createHash as AG}from"node:crypto";var SG=globalThis.setTimeout,RG=5;function k$($){let Z=$?.quota?.checkIntervalMinutes??RG;return Math.max(1,Z)*60000}function EG($){return $?.quota?.enabled!==!1}function c3($,Z){if(!$?.resetsAt)return!1;let X=Date.parse($.resetsAt);return Number.isFinite(X)&&X<=Z}function IG($){let Z=$?.quota?.minimumRemaining||{};return{primary:Z.primary??Z["5h"]??15,secondary:Z.secondary??Z["1w"]??10}}function R2($,Z,X){if(!EG(Z))return X+k$(Z);let J=IG(Z),G=[];for(let z of["primary","secondary"]){let B=$?.[z];if(!B)continue;if(B.remainingPercent>=J[z])continue;let Q=B.resetsAt?Date.parse(B.resetsAt):Number.NaN;if(!Number.isFinite(Q)||Q<=X)return X+k$(Z);G.push(Q)}if(!G.length)return X+k$(Z);return Math.min(...G)+60000}function bG($){if(!$?.quota?.mainQuota||!$.quota.mainQuotaCheckedAt)return null;return{quota:$.quota.mainQuota,checkedAt:$.quota.mainQuotaCheckedAt,tokenFingerprint:$.quota.mainQuotaToken}}function xG($){let Z=$?.quota?.refreshEveryNRequests;return typeof Z==="number"&&Number.isFinite(Z)&&Z>0?Math.floor(Z):0}function _0($){return AG("sha256").update($).digest("hex").slice(0,16)}class B1{main=null;mainTokenFp=null;mainQuotaAccountId=null;fallbacks=new Map;fallbackTokenFps=new Map;inflightMain=null;inflightMainFp=null;inflightFallbacks=new Map;mainLastApiError=void 0;fallbackApiErrors=new Map;fallbackErrorTokenFps=new Map;rateLimitedUntilMap=new Map;apiGate=Promise.resolve();lastApiCallAt=0;storage;fetchImpl;now;fetchQuotaFn;onMainQuotaFetched;onApiError;configPath;constructor($){this.storage=$.storage,this.fetchImpl=$.fetchImpl??fetch,this.configPath=$.configPath,this.now=$.now??Date.now,this.fetchQuotaFn=$.fetchQuotaFn,this.onMainQuotaFetched=$.onMainQuotaFetched,this.onApiError=$.onApiError,this.seedMainFromStorage($.storage),this.seedMainBackoffFromStorage($.storage)}getMain($){if($&&this.main&&this.mainTokenFp&&this.mainTokenFp!==_0($))this.main=null,this.mainTokenFp=null;return this.main}getFallback($,Z){let X=this.fallbacks.get($)??null;if(!Z||!X)return X;if(this.fallbackTokenFps.get($)!==_0(Z))return this.fallbacks.delete($),this.fallbackTokenFps.delete($),null;return X}getAllFallbacks(){return this.fallbacks}setMain($,Z,X,J=!1){if(!J&&!E2(Z.quota))return;if(this.mainTokenFp=_0($),X&&this.mainQuotaAccountId&&this.mainQuotaAccountId!==X)this.clearRateLimited("main");if(X)this.mainQuotaAccountId=X;if(this.main=Z,d3(Z.quota))this.clearRateLimited("main")}peekMainForPolicy($){if($&&this.mainQuotaAccountId&&this.mainQuotaAccountId!==$)return null;return this.main}peekFallbackForPolicy($,Z){let X=this.fallbacks.get($)??null;if(Z&&X?.accountId&&X.accountId!==Z)return null;return X}setFallback($,Z,X,J=!1,G){if(!J&&!E2(Z.quota))return;let z=this.fallbacks.get($)?.accountId;if(G&&z&&G!==z)this.clearRateLimited($);let B=G??z;if(this.fallbacks.set($,{...Z,accountId:B}),X)this.fallbackTokenFps.set($,_0(X));else this.fallbackTokenFps.delete($);if(d3(Z.quota))this.clearRateLimited($)}markRateLimited($,Z){let X=this.rateLimitedUntilMap.get($);if(X!==void 0&&X>Z)return;this.rateLimitedUntilMap.set($,Z)}isRateLimited($){let Z=this.rateLimitedUntilMap.get($);return Z!==void 0&&this.now()<Z}rateLimitedUntil($){return this.rateLimitedUntilMap.get($)}clearRateLimited($){this.rateLimitedUntilMap.delete($)}async refreshMain($){let Z=_0($);if(this.mainTokenFp&&this.mainTokenFp!==Z)this.main=null,this.mainTokenFp=null;if(this.inflightMain&&this.inflightMainFp===Z)return this.inflightMain;if(this.isBackedOff()){if(this.main)return this.main.quota;throw Error("Quota API rate-limited — try again later")}return this.inflightMainFp=Z,this.inflightMain=this._fetchMain($),this.inflightMain}async refreshFallback($,Z){let X=B1.fallbackInflightKey($,Z),J=this.inflightFallbacks.get(X);if(J)return J;if(this.isFallbackBackedOff($,Z)){let z=this.getFallback($,Z);if(z)return z.quota;throw Error("Quota API rate-limited — try again later")}let G=this._fetchFallback($,Z);return this.inflightFallbacks.set(X,G),G}async refreshAllFallbacks($){let Z=this.now();for(let X of $){if(X.enabled===!1)continue;if(k0(X)||!X.access)continue;let J=this.getFallback(X.id,X.access);if(J&&Z<J.refreshAfter)continue;try{await this.refreshFallback(X.id,X.access)}catch{}}}refreshMainInBackground($){let Z=_0($);if(this.inflightMain&&this.inflightMainFp===Z)return;if(this.isBackedOff())return;this.refreshMain($).catch(()=>{})}isMainStale(){if(!this.main)return!0;return this.now()>=this.main.refreshAfter}isFallbackStale($,Z){let X=this.getFallback($,Z);if(!X)return!0;return this.now()>=X.refreshAfter}shouldRefreshOnRequestCount($){let Z=xG(this.storage);if(Z<=0)return!1;return $>0&&$%Z===0}needsRefresh($){return this.isMainStale()||this.shouldRefreshOnRequestCount($)}updateStorage($){this.storage=$,this.seedMainFromStorage($),this.seedMainBackoffFromStorage($)}seedMainFromStorage($,Z){let X=bG($);if(!X)return;let J=Z?_0(Z):null;if(J&&X.tokenFingerprint&&X.tokenFingerprint!==J)return;let G={quota:X.quota,refreshAfter:R2(X.quota,$,X.checkedAt),checkedAt:X.checkedAt};if(this.main&&this.main.checkedAt>=G.checkedAt&&(!J||!this.mainTokenFp||this.mainTokenFp===J))return;if(this.main=G,this.mainTokenFp=X.tokenFingerprint??null,$?.mainAccountId){if(this.mainQuotaAccountId&&this.mainQuotaAccountId!==$.mainAccountId)this.clearRateLimited("main");this.mainQuotaAccountId=$.mainAccountId}}seedMainBackoffFromStorage($){let Z=$?.quota?.mainLastQuotaApiError;this.mainLastApiError=Z&&n1(Z,this.now())?Z:void 0}seedFallbacksFromAccounts($){let Z=k$(this.storage);for(let X of $){if(X.enabled===!1)continue;if(!X.quota)continue;let J=Math.max(X.quota.primary?.checkedAt??0,X.quota.secondary?.checkedAt??0);if(J<=0)continue;let G=this.getFallback(X.id,X.access);if(G&&G.checkedAt>=J)continue;this.setFallback(X.id,{quota:X.quota,refreshAfter:J+Z,checkedAt:J},X.access,!1,X.accountId)}}isBackedOff(){return n1(this.mainLastApiError,this.now())}isFallbackBackedOff($,Z){if(Z){if(this.fallbackErrorTokenFps.get($)!==_0(Z))return!1}return n1(this.fallbackApiErrors.get($),this.now())}getLastApiError(){return this.mainLastApiError}static API_CALL_GAP_MS=1000;static fallbackInflightKey($,Z){return JSON.stringify([$,_0(Z)])}static quotaLockName($){return`opencode-fallback-quota-refresh-${$.replace(/[^a-zA-Z0-9._-]+/g,"-")||"account"}`}_enqueueApiFetch($){let Z=async()=>{let J=this.now()-this.lastApiCallAt;if(J<B1.API_CALL_GAP_MS)await new Promise((G)=>{let z=SG(G,B1.API_CALL_GAP_MS-J);if(typeof z==="object"&&"unref"in z)z.unref()});return this.lastApiCallAt=this.now(),$()},X=this.apiGate.then(Z,Z);return this.apiGate=X.catch(()=>{}),X}async _fetchMain($){let Z=_0($);return this._enqueueApiFetch(async()=>{try{if(this.isBackedOff()){if(this.main)return this.main.quota;throw Error("Quota API rate-limited — try again later")}let X=await e({name:"opencode-main-quota-refresh",ttlMs:30000,path:this.configPath});if(!X){let J=this.main;if(J&&this.now()<J.refreshAfter)return J.quota;throw Error("Quota refresh is already in progress")}try{let J=this.now(),G=await this._fetchQuota($),z=this.now();if(this.mainTokenFp=_0($),this.main={quota:G,refreshAfter:R2(G,this.storage,z),checkedAt:z},d3(G))this.clearRateLimited("main");return this.mainLastApiError=void 0,this.onMainQuotaFetched?.(G,z,this.mainTokenFp,J),G}catch(J){throw this._handleMainFetchError(J),J}finally{await X.release()}}finally{if(this.inflightMainFp===Z)this.inflightMain=null,this.inflightMainFp=null}})}async _fetchFallback($,Z){return this._enqueueApiFetch(async()=>{try{if(this.isFallbackBackedOff($,Z)){let J=this.getFallback($,Z);if(J)return J.quota;throw Error("Quota API rate-limited — try again later")}let X=await e({name:B1.quotaLockName($),ttlMs:30000,path:this.configPath});if(!X){let J=this.getFallback($,Z);if(J&&this.now()<J.refreshAfter)return J.quota;throw Error("Quota refresh is already in progress")}try{let J=await this._fetchQuota(Z),G=this.now();return this.setFallback($,{quota:J,refreshAfter:G+k$(this.storage),checkedAt:G},Z,!0),this.fallbackApiErrors.delete($),this.fallbackErrorTokenFps.delete($),J}finally{await X.release()}}catch(X){throw this._handleFallbackFetchError($,Z,X),X}finally{this.inflightFallbacks.delete(B1.fallbackInflightKey($,Z))}})}async _fetchQuota($){if(!this.fetchQuotaFn)throw Error("Quota fetch not available — no fetchQuotaFn injected (push-only mode)");return this.fetchQuotaFn({accessToken:$,fetchImpl:this.fetchImpl,now:this.now})}static isAuthError($){return $?.status===401}_handleMainFetchError($){if(B1.isAuthError($))return;this.mainLastApiError=P$({error:$,now:this.now(),previous:this.mainLastApiError}),this.onApiError?.(this.mainLastApiError)}_handleFallbackFetchError($,Z,X){if(B1.isAuthError(X))return;let J=_0(Z),G=this.fallbackErrorTokenFps.get($)===J?this.fallbackApiErrors.get($):void 0;this.fallbackApiErrors.set($,P$({error:X,now:this.now(),previous:G})),this.fallbackErrorTokenFps.set($,J)}}function E2($){return Boolean($.primary||$.secondary)}function d3($){let{primary:Z,secondary:X}=$;if(!Z&&!X)return!1;if(Z&&Z.usedPercent>=100)return!1;if(X&&X.usedPercent>=100)return!1;return!0}import{readFile as aG}from"node:fs/promises";var R1=a("refresh"),a3=a("accounts"),gG=1e4,hG=15000,s3=50;function Q1($){return $.type==="oauth"&&$.corrupt!==!0}function vG($){let Z=$?.trim();if(!Z)return!1;try{let X=new URL(Z);return(X.protocol==="http:"||X.protocol==="https:")&&!X.username&&!X.password}catch{return!1}}var J$="floors-v1";class a6 extends Error{code="ACCOUNT_REMOVED_DURING_REFRESH";constructor($){super(`Fallback account ${$} was removed before refresh`);this.name="AccountRemovedDuringRefreshError"}}var mG=[401,403,429],I2={primary:0,secondary:0},wG=!1,Y1={primary:5,secondary:10};function k($){return $!=null&&typeof $==="object"&&!Array.isArray($)}var pG=new Set(["__proto__","constructor","prototype"]);function t3($){return $.length>0&&!pG.has($)}function uG($){return $ instanceof a6||k($)&&$.name==="AccountRemovedDuringRefreshError"&&$.code==="ACCOUNT_REMOVED_DURING_REFRESH"}function i6($){return{id:typeof $.id==="string"&&$.id.trim()?$.id.trim():yG(),label:typeof $.label==="string"?$.label:void 0,enabled:typeof $.enabled==="boolean"?$.enabled:void 0,addedAt:typeof $.addedAt==="number"?$.addedAt:void 0,lastUsed:typeof $.lastUsed==="number"?$.lastUsed:void 0,accountId:typeof $.accountId==="string"?$.accountId:void 0}}function b2($){if(!k($))return;if(typeof $.message!=="string")return;let Z=Number($.checkedAt);if(!Number.isFinite(Z))return;let X=Number($.nextRetryAt),J=Number($.retryCount);return{message:$.message,checkedAt:Z,nextRetryAt:Number.isFinite(X)?X:void 0,retryCount:Number.isFinite(J)?J:void 0,tokenHash:typeof $.tokenHash==="string"?$.tokenHash:void 0}}function lG($){if(!k($))return;let Z={};for(let G of["primary","secondary"]){let z=$[G];if(!k(z))continue;let B=Number(z.usedPercent),Q=Number(z.remainingPercent),Y=Number(z.checkedAt);if(!Number.isFinite(B)||!Number.isFinite(Q)||!Number.isFinite(Y))continue;let H=typeof z.windowMinutes==="number"?z.windowMinutes:Number.NaN;Z[G]={usedPercent:B,remainingPercent:Q,checkedAt:Y,resetsAt:typeof z.resetsAt==="string"?z.resetsAt:void 0,...Number.isFinite(H)&&H>0?{windowMinutes:H}:{}}}for(let G of["resetCreditsAvailable","resetCreditsApplicable"]){let z=typeof $[G]==="number"?$[G]:Number.NaN;if(Number.isFinite(z)&&z>=0)Z[G]=z}let X=$.spendControl;if(k(X)){let G=Number(X.limit),z=Number(X.used),B=Number(X.remaining),Q=Number(X.usedPercent),Y=Number(X.remainingPercent);if(Number.isFinite(G)&&Number.isFinite(z)&&Number.isFinite(B)&&Number.isFinite(Q)&&Number.isFinite(Y)&&typeof X.reached==="boolean")Z.spendControl={limit:G,used:z,remaining:B,usedPercent:Q,remainingPercent:Y,resetsAt:typeof X.resetsAt==="string"?X.resetsAt:void 0,unit:typeof X.unit==="string"?X.unit:void 0,source:typeof X.source==="string"?X.source:void 0,reached:X.reached}}let J=$.credits;if(k(J)&&typeof J.hasCredits==="boolean"&&typeof J.unlimited==="boolean"&&typeof J.overageLimitReached==="boolean"){let G=Number(J.balance);Z.credits={hasCredits:J.hasCredits,unlimited:J.unlimited,overageLimitReached:J.overageLimitReached,...Number.isFinite(G)?{balance:G}:{}}}return Object.keys(Z).length?Z:void 0}function dG($){if(!k($))return null;if($.type==="api"){let Z=typeof $.baseURL==="string"?$.baseURL.trim():"",X=typeof $.apiKey==="string"?$.apiKey.trim():"";if(!vG(Z))return null;let J=$.authHeader==="x-api-key"?"x-api-key":"authorization-bearer";return{...i6($),type:"api",apiKey:X||void 0,baseURL:Z,authHeader:J}}if($.type!=="oauth")return null;if($.corrupt===!0){if(typeof $.id!=="string"||!$.id.trim())return null;return{...i6($),type:"oauth",corrupt:!0}}if(typeof $.refresh!=="string"||!$.refresh.trim()){if(!Object.hasOwn($,"refresh")||typeof $.id!=="string"||!$.id.trim())return null;return{...i6($),type:"oauth",corrupt:!0}}return{...i6($),type:"oauth",access:typeof $.access==="string"?$.access:void 0,refresh:$.refresh,expires:typeof $.expires==="number"?$.expires:void 0,lastRefreshedAt:typeof $.lastRefreshedAt==="number"?$.lastRefreshedAt:void 0,lastRefreshError:b2($.lastRefreshError),lastQuotaRefreshError:b2($.lastQuotaRefreshError),quota:lG($.quota)}}function cG($){if(!k($))return;let Z=Object.create(null);for(let[X,J]of Object.entries($)){if(!t3(X)||!k(J))continue;let G={};if(k(J.inFlight))G.inFlight={...J.inFlight};if(k(J.lastOutcome)&&typeof J.lastOutcome.code==="string"&&J.lastOutcome.code.length>0&&typeof J.lastOutcome.at==="number"&&Number.isFinite(J.lastOutcome.at))G.lastOutcome={code:J.lastOutcome.code,at:J.lastOutcome.at,...k(J.lastOutcome.previousOutcome)&&typeof J.lastOutcome.previousOutcome.code==="string"&&J.lastOutcome.previousOutcome.code.length>0&&typeof J.lastOutcome.previousOutcome.at==="number"&&Number.isFinite(J.lastOutcome.previousOutcome.at)?{previousOutcome:{code:J.lastOutcome.previousOutcome.code,at:J.lastOutcome.previousOutcome.at}}:{}};if(typeof J.cooldownUntil==="number"&&Number.isFinite(J.cooldownUntil))G.cooldownUntil=J.cooldownUntil;if(Object.keys(G).length>0)Z[X]=G}return Object.keys(Z).length>0?Z:void 0}var x2=new Set;function sG($){if($.length===0)return;let Z=JSON.stringify([...$].sort());if(x2.has(Z))return;x2.add(Z),a3.warn("account load-dropped, preserved on disk",{droppedIds:$})}function iG($){if(!k($)||!Array.isArray($.accounts))return null;let Z=$.accounts,X=Z.map(dG).filter((J)=>J!=null);if(X.length<Z.length){let J=new Set;for(let B of Z)if(k(B)&&typeof B.id==="string"&&B.id.trim())J.add(B.id.trim());let G=new Set(X.map((B)=>B.id)),z=[];for(let B of J)if(!G.has(B))z.push(B);sG(z)}return{version:1,main:{type:"opencode",provider:"openai"},routing:k($.routing)?$.routing:void 0,fallbackOn:Array.isArray($.fallbackOn)?$.fallbackOn.filter((J)=>Number.isInteger(J)):void 0,refresh:k($.refresh)?$.refresh:void 0,quota:k($.quota)?$.quota:void 0,reset:cG($.reset),dump:k($.dump)?$.dump:void 0,costZeroing:k($.costZeroing)?$.costZeroing:void 0,killswitch:k($.killswitch)?$.killswitch:void 0,logging:k($.logging)?$.logging:void 0,cachekeep:k($.cachekeep)?$.cachekeep:void 0,cacheKeep:k($.cacheKeep)?$.cacheKeep:void 0,mainAccountId:typeof $.mainAccountId==="string"?$.mainAccountId:void 0,accounts:X}}async function n6($){try{return{exists:!0,value:JSON.parse(await aG($,"utf8"))}}catch(Z){if(Z.code==="ENOENT")return{exists:!1,value:null};throw Z}}function r6($){return Object.fromEntries(Object.entries($).filter(([,Z])=>Z!==void 0))}async function nG($){let Z;try{Z=(await n6($)).value}catch{return null}return zz(Z)}function rG($,Z){if(!k($))return $;let X=k(Z)?Z:{},J=k(X.main)?X.main:void 0,G=k(X.accounts)?X.accounts:{},z=k($.quota)?$.quota:{},B=k($.refresh)?$.refresh:{},Q=J??z,Y=J??B,W=B.mainRefreshLeaseId!==void 0?{id:B.mainRefreshLeaseId,until:B.mainRefreshLeaseUntil,tokenHash:B.mainRefreshLeaseTokenHash}:{id:Y.refreshLeaseId,until:Y.refreshLeaseUntil,tokenHash:Y.refreshLeaseTokenHash},j=Array.isArray($.accounts)?$.accounts.map((D)=>{if(!k(D))return D;let U=typeof D.id==="string"&&k(G[D.id])?G[D.id]:{};return{...D,...U}}):void 0;return oG({...$,refresh:r6({...B,mainLastRefreshError:B.mainLastRefreshError??Y.lastRefreshError,mainRefreshLeaseId:W.id,mainRefreshLeaseUntil:W.until,mainRefreshLeaseTokenHash:W.tokenHash}),quota:r6({...z,mainQuota:Q.quota,mainQuotaCheckedAt:Q.quotaCheckedAt,mainQuotaToken:Q.quotaToken,mainLastQuotaApiError:Q.lastQuotaApiError}),accounts:j})}async function e3($){let Z=await n6($.configPath);if(!Z.exists)return null;let X=await n6($.statePath);return iG(rG(Z.value,X.value))}function oG($){return Object.fromEntries(Object.entries($).filter(([,Z])=>Z!==void 0))}function tG($){if($.type==="api")return r6({apiKey:$.apiKey,lastUsed:$.lastUsed});if($.corrupt)return{};return r6({access:$.access,refresh:$.refresh,expires:$.expires,lastUsed:$.lastUsed,lastRefreshedAt:$.lastRefreshedAt,lastRefreshError:$.lastRefreshError,lastQuotaRefreshError:$.lastQuotaRefreshError,quota:$.quota})}function o6($){return Math.max($?.primary?.checkedAt??0,$?.secondary?.checkedAt??0)}function y$($,Z,X){if(X in Z)$[X]=Z[X];else delete $[X]}function eG($,Z){return $.access===Z.access&&$.refresh===Z.refresh&&$.expires===Z.expires&&$.lastRefreshedAt===Z.lastRefreshedAt}function $z($,Z){if(!eG($,Z))return Z;if(!("lastRefreshError"in Z))return $;if(!("lastRefreshError"in $))return Z;return(Z.lastRefreshError?.checkedAt??0)>($.lastRefreshError?.checkedAt??0)?Z:$}var Zz=300000;function k2($,Z){if($===void 0)return 0;return $>Z+Zz?0:$}function Xz($,Z,X){let J=Date.now(),G=k2(Z.lastRefreshedAt,J),z=k2(X.lastRefreshedAt,J),B=Z.expires??0,Q=X.expires??0,Y=z>G?X:G>z?Z:Q>B?X:B>Q?Z:$z(Z,X);y$($,Y,"access"),y$($,Y,"refresh"),y$($,Y,"expires"),y$($,Y,"lastRefreshedAt"),y$($,Y,"lastRefreshError")}function Jz($,Z){if(!k($))return Z;let X=$,J=o6(X.quota),G=o6(Z.quota),z=J>G,B=z?{...X,...Z,quota:X.quota,lastQuotaRefreshError:X.lastQuotaRefreshError}:{...X,...Z};if(!z&&!("lastQuotaRefreshError"in Z))delete B.lastQuotaRefreshError;if(!("lastRefreshError"in Z))delete B.lastRefreshError;if(typeof X.lastUsed==="number"&&(typeof Z.lastUsed!=="number"||X.lastUsed>Z.lastUsed))B.lastUsed=X.lastUsed;return Xz(B,X,Z),B}async function Gz($,Z=!1){let X=Date.now(),J=X+hG,G=0;while(Date.now()<=J){G++;let Q=await e({name:"save",ttlMs:gG,path:$,renew:Z});if(Q)return Q;let Y=J-Date.now();if(Y<=0)break;await fG(Math.min(s3+w2(s3),Y))}let z=Date.now()-X,B=Math.round(z/Math.max(1,G));throw Error(`Timed out after ${z}ms waiting for the account store lock on ${$} (${G} attempts, ~${B}ms apart; retry interval is ${s3}ms). A gap near the retry interval means lock contention; a much larger one means this process's event loop was saturated and the wait expired without getting scheduled.`)}function zz($){if(!k($)||!Array.isArray($.accounts))return null;let Z=new Set;for(let X of $.accounts){if(!k(X))continue;if(typeof X.id!=="string")continue;let J=X.id.trim();if(!J)continue;Z.add(J)}return Z}function Bz($,Z){$.main=$.main??{};let X=typeof $.main.quotaCheckedAt==="number"?$.main.quotaCheckedAt:o6($.main.quota),J=typeof Z.quota?.mainQuotaCheckedAt==="number"?Z.quota.mainQuotaCheckedAt:o6(Z.quota?.mainQuota);if(X>J)return;$.main.quota=Z.quota?.mainQuota,$.main.quotaCheckedAt=Z.quota?.mainQuotaCheckedAt,$.main.quotaToken=Z.quota?.mainQuotaToken,$.main.lastQuotaApiError=Z.quota?.mainLastQuotaApiError}function Qz($,Z){$.main=$.main??{},$.main.lastRefreshError=Z.refresh?.mainLastRefreshError,$.main.refreshLeaseId=Z.refresh?.mainRefreshLeaseId,$.main.refreshLeaseUntil=Z.refresh?.mainRefreshLeaseUntil,$.main.refreshLeaseTokenHash=Z.refresh?.mainRefreshLeaseTokenHash}function n3($){if(Array.isArray($))return $.map(n3);if(!k($))return $;return Object.fromEntries(Object.entries($).filter(([,Z])=>Z!==void 0).map(([Z,X])=>[Z,n3(X)]))}async function Yz($,Z,X={mainQuota:!0,mainRefresh:!0,accounts:!0},J){let G=Z.statePath,z=await Gz(G);try{let B=(await n6(G)).value,Q=k(B)?{...B,version:1}:{version:1};if(X.mainQuota)Bz(Q,$);if(X.mainRefresh)Qz(Q,$);if(X.accounts){let Y=X.accounts===!0?null:new Set(X.accounts),H=await nG(Z.configPath);Q.accounts={...k(Q.accounts)?Q.accounts:{}};for(let W of $.accounts){if(Y&&!Y.has(W.id))continue;if(H&&!H.has(W.id))continue;Q.accounts[W.id]=Jz(Q.accounts[W.id],tG(W))}if(Y){for(let W of Y)if(!$.accounts.some((V)=>V.id===W))delete Q.accounts[W]}if(H){for(let W of Object.keys(Q.accounts))if(!H.has(W))delete Q.accounts[W]}}if(J&&!J())return;await F0(G,n3(Q))}finally{await z.release()}}function v2($){return $?.fallbackOn?.length?$.fallbackOn:mG}function Hz($){let Z=$?.quota?.minimumRemaining||{};return{primary:Z.primary??Z["5h"]??I2.primary,secondary:Z.secondary??Z["1w"]??I2.secondary}}function r3($){return $?.quota?.enabled!==!1}function g$($){return $?.quota?.failClosedOnUnknownQuota??wG}function t6($,Z,X=Date.now()){if(!r3(Z))return!0;if(!$)return!g$(Z);let J=Hz(Z),G=g$(Z);for(let z of["primary","secondary"]){let B=$[z];if(!B)continue;if(c3(B,X)){if(G)return!1;continue}if(B.remainingPercent<J[z])return!1}return!0}function $8($){return $?.killswitch?.enabled===!0}function y2($){return{primary:$?.primary??$?.["5h"]??Y1.primary,secondary:$?.secondary??$?.["1w"]??Y1.secondary}}function f2($){return typeof $==="number"&&Number.isFinite($)?$:0}function H1($,Z){if(!$?.killswitch)return Y1;if($.killswitch.schema===J$){let{accounts:X,defaults:J}=$.killswitch,G=Z??"main",z=k(X)&&Object.hasOwn(X,G)&&k(X[G])?X[G]:k(J)?J:void 0;return{primary:f2(z?.primary),secondary:f2(z?.secondary)}}if(Z&&$.killswitch.accounts?.[Z])return y2($.killswitch.accounts[Z]);return y2($.killswitch.main)}function m2($,Z,X,J=Date.now()){if(!$8(Z))return!0;if(!$)return!g$(Z);let G=H1(Z,X),z=g$(Z);for(let B of["primary","secondary"]){let Q=$[B];if(!Q)continue;if(c3(Q,J)){if(z)return!1;continue}if(Q.remainingPercent<G[B])return!1}return!0}function Wz($){return $?.refresh?.enabled!==!1}function Z8($){return($?.refresh?.refreshBeforeExpiryMinutes??240)*60000}function w2($){return Math.floor(Math.random()*($+1))}function E1($,Z,X){return!$.access||!$.expires||$.expires-X<=Z8(Z)}function Vz($,Z){return Boolean($.access&&typeof $.expires==="number"&&$.expires>Z)}function X$($,Z){return Boolean($?.mainAccountId&&Z.accountId&&Z.accountId===$.mainAccountId)}class p2 extends Error{constructor($){super(`Refusing to refresh account ${$}: it holds the main account's credential while the main slot is live`);this.name="ShieldedMainRowRefreshError"}}function U0($,Z){let X=$.accounts.findIndex((J)=>J.id===Z.id);if(X!==-1)$.accounts[X]=Z}function f$($){return $ instanceof Error?$.message:String($)}function o3($,Z,X){if(Z instanceof x$)return;$.lastRefreshError=I6({error:Z,now:X,refreshToken:$.refresh,previous:$.lastRefreshError})}function i3($,Z,X){if(Z instanceof x$)return;if($.lastQuotaRefreshError=P$({error:Z,now:X,previous:$.lastQuotaRefreshError}),Z?.isRefreshError===!0)o3($,Z,X)}function g2($,Z){if(!$)return!1;if(!$.resetsAt)return!0;let X=Date.parse($.resetsAt);return Number.isFinite(X)?X>Z:!0}function Uz($,Z){if(!$)return!1;return g2($.primary,Z)||g2($.secondary,Z)}function jz($,Z,X){if(!$)return!1;let J=Z?.quota?.checkIntervalMinutes??5,G=Math.max(1,J)*60000,z=Math.max($.primary?.checkedAt??0,$.secondary?.checkedAt??0);return X-z<G}function h2($,Z,X){return!jz($.quota,Z,X)}function Dz($,Z,X,J){return U3(X)&&t6($.quota,Z,J)&&Uz($.quota,J)}function Kz($){let Z=$?.quota?.checkIntervalMinutes??5;return Math.max(1,Z)*60000}var qz=60000,Nz=60000,Mz=600000;function Fz($){return`fallback-oauth-refresh-${kG("sha256").update($).digest("base64url").slice(0,16)}`}var Lz=1e4,_z=100;class Oz{now;fetchImpl;paths;refreshPromises=new Map;refreshTimer=null;quotaTimer=null;quotaManager;onFallbackStorageChanged;options;constructor($){this.options=$,this.now=$.now??Date.now,this.fetchImpl=$.fetchImpl??fetch,this.paths=$.paths,this.quotaManager=$.quotaManager??null,this.onFallbackStorageChanged=$.onFallbackStorageChanged}assertNotTombstoned($){if($)s6($.refresh)}seedFallbackQuota($,Z){if(!this.quotaManager)return;if(!$.quota)return;let X=Math.max($.quota.primary?.checkedAt??0,$.quota.secondary?.checkedAt??0);if(X<=0)return;let J=this.quotaManager.getFallback($.id,$.access);if(J&&J.checkedAt>=X)return;this.quotaManager.setFallback($.id,{quota:$.quota,refreshAfter:X+Kz(Z),checkedAt:X},$.access,!1,$.accountId)}async load(){return e3(this.paths)}selectionBookkeeping=Promise.resolve();selectionBookkeepingSettled(){return this.selectionBookkeeping}async save($,Z){await Yz($,this.paths,{accounts:Z??!0},this.options.canWrite)}startBackgroundRefresh(){let $=async()=>{if(await this.options.backgroundRefreshPaused?.())return;if(await this.refreshDueAccounts(),this.options.fetchQuotaFn)await this.refreshQuotaForDueAccounts()};if($().catch(()=>{}),!this.refreshTimer){if(this.refreshTimer=setInterval(()=>{$().catch(()=>{})},qz+w2(Nz)),"unref"in this.refreshTimer)this.refreshTimer.unref()}}stopBackgroundRefresh(){if(this.refreshTimer)clearInterval(this.refreshTimer);if(this.quotaTimer)clearInterval(this.quotaTimer);this.refreshTimer=null,this.quotaTimer=null}async getUsableFallbackAccounts($){let Z=$!==void 0?$:await this.load();if(!Z)return[];let X=[],J=!1;for(let G of Z.accounts){if(G.enabled===!1||!Q1(G))continue;if(X$(Z,G))continue;if(k0(G))continue;let z=!1,B=G;try{if(E1(B,Z,this.now())){let Q=B.lastRefreshError;if(Q&&Z1(Q,B.refresh,this.now()))throw z=!0,Error(C$(Q,this.now()));try{B=await this.refreshAccount(B,Z),J=!0}catch(Y){if(uG(Y))continue;z=!0;let H=Z.accounts.find((W)=>W.id===G.id&&Q1(W));if(H&&!Z1(H.lastRefreshError,H.refresh,this.now()))o3(H,Y,this.now()),U0(Z,H),J=!0;throw Y}}if(this.seedFallbackQuota(B,Z),this.accountPassesQuotaPolicy(this.quotaPolicyAccount(B),Z))X.push(B)}catch(Q){let Y=Vz(B,this.now());if(z){if(!Y)continue}else if(!Y)continue;if(Dz(B,Z,Q,this.now()))R1.debug("fallback quota using cached quota after refresh error",{pid:process.pid,accountId:B.id,error:f$(Q)}),X.push(B);else if(!g$(Z))X.push(B)}}if(J){let G=structuredClone(Z);this.selectionBookkeeping=this.selectionBookkeeping.then(()=>this.save(G)).catch((z)=>{a3.warn("fallback selection bookkeeping not persisted",{pid:process.pid,error:f$(z)})})}return X}async markUsed($){try{let Z=await this.load();if(!Z)return;let X=Z.accounts.find((J)=>J.id===$.id);if(!X)return;X.lastUsed=this.now(),await this.save(Z,[X.id])}catch(Z){a3.warn("lastUsed stamp not persisted",{pid:process.pid,accountId:$.id,error:f$(Z)})}}accountPassesQuotaPolicy($,Z){return t6($.quota,Z,this.now())}quotaPolicyAccount($){if(!this.quotaManager)return $;let Z=this.quotaManager.getFallback($.id,$.access)?.quota;return Z?{...$,quota:Z}:$}async refreshDueAccounts(){let $=await this.load();if(!$||!Wz($))return;let Z=!1;for(let X of $.accounts){if(X.enabled===!1||!Q1(X))continue;if(X$($,X))continue;if(k0(X))continue;if(!E1(X,$,this.now()))continue;if(Z1(X.lastRefreshError,X.refresh,this.now()))continue;try{R1.debug("fallback oauth background due",{pid:process.pid,accountId:X.id,expiresInMs:X.expires?X.expires-this.now():void 0}),await this.refreshAccount(X,$),Z=!0}catch(J){R1.warn("fallback oauth background failed",{pid:process.pid,accountId:X.id,error:f$(J)}),o3(X,J,this.now()),U0($,X),Z=!0}}if(Z)await this.save($)}async refreshQuotaForDueAccounts(){let $=await this.load();if(!$||!r3($))return;if(!this.options.fetchQuotaFn)return;let Z=!1;for(let X of $.accounts){if(X.enabled===!1||!Q1(X))continue;if(X$($,X))continue;if(k0(X))continue;let J=X;try{if(E1(J,$,this.now())){if(Z1(J.lastRefreshError,J.refresh,this.now()))continue;J=await this.refreshAccount(J,$),Z=!0}if(n1(J.lastQuotaRefreshError,this.now()))continue;if(this.seedFallbackQuota(J,$),!(this.quotaManager?this.quotaManager.isFallbackStale(J.id,J.access):h2(J,$,this.now())))continue;await this.refreshAccountQuota(J,$),Z=!0}catch(G){i3(X,G,this.now()),U0($,X),Z=!0}}if(Z)await this.save($),this.onFallbackStorageChanged?.()}async refreshQuotaForAllAccounts($={}){let Z=await this.load(),X=[];if(!Z||!r3(Z))return{storage:Z,errors:X};if(!this.options.fetchQuotaFn)return{storage:Z,errors:X};let J=$.force??!1,G=!1;for(let z of Z.accounts){if(z.enabled===!1||!Q1(z))continue;if(X$(Z,z))continue;if(k0(z))continue;let B=z;try{if(E1(B,Z,this.now())){let Q=B.lastRefreshError;if(Q&&Z1(Q,B.refresh,this.now()))throw Error(C$(Q,this.now()));B=await this.refreshAccount(B,Z),G=!0}if(!J&&!h2(B,Z,this.now())){if(B.lastQuotaRefreshError)B.lastQuotaRefreshError=void 0,U0(Z,B),G=!0;continue}await this.refreshAccountQuota(B,Z),G=!0}catch(Q){i3(z,Q,this.now()),U0(Z,z),G=!0,X.push({accountId:z.id,message:f$(Q)})}}if(G)await this.save(Z);return{storage:Z,errors:X}}async refreshAccount($,Z,X={}){let J=this.refreshPromises.get($.id);if(J){let B=await J;return U0(Z,B),B}let G=this.refreshAccountNow($,Z,X).finally(()=>{this.refreshPromises.delete($.id)});this.refreshPromises.set($.id,G);let z=await G;return U0(Z,z),z}async waitForConcurrentFallbackRefresh($,Z,X,J){let G=Date.now()+Lz;while(Date.now()<G){await new Promise((H)=>setTimeout(H,_z));let z=await this.load(),B=z?.accounts.find((H)=>H.id===$.id&&Q1(H));if(!B)continue;if(this.assertNotTombstoned(B),(B.access!==X.access||B.refresh!==X.refresh||(B.expires??0)>(X.expires??0)+60000)&&(J.force||!E1(B,z,this.now())))return U0(Z,B),R1.debug("fallback oauth joined concurrent refresh",{pid:process.pid,accountId:B.id,expiresInMs:B.expires?B.expires-this.now():void 0}),B;let Y=B.lastRefreshError;if(Y&&Z1(Y,B.refresh,this.now()))throw U0(Z,B),Error(C$(Y,this.now()))}return null}assertNotShieldedMainRow($,Z,X){if(X.asPoolMain||!Z)return;if(X$($,Z))throw new p2(Z.id)}async refreshAccountNow($,Z,X){let J=await this.load(),G=J?.accounts.find((Q)=>Q.id===$.id&&Q1(Q));if(this.assertNotTombstoned(G),this.assertNotShieldedMainRow(J,G,X),G&&!X.force&&!E1(G,J,this.now()))return U0(Z,G),G;let z=G??$,B=await e({name:Fz(z.id),ttlMs:Mz,path:this.paths.configPath,renew:!0});if(!B){R1.debug("fallback oauth refresh skipped file lock",{pid:process.pid,accountId:z.id});let Q=await this.waitForConcurrentFallbackRefresh($,Z,z,X);if(Q)return Q;throw Error("Fallback OAuth refresh is already in progress")}try{if(J=await this.load(),G=J?.accounts.find((W)=>W.id===$.id&&Q1(W)),this.assertNotTombstoned(G),this.assertNotShieldedMainRow(J,G,X),G&&!X.force&&!E1(G,J,this.now()))return U0(Z,G),G;if(!G)throw new a6($.id);z=G;let Q=this.options.refreshFn??(async()=>{throw Error("No refreshFn injected into FallbackAccountManager")});R1.debug("fallback oauth refresh request start",{pid:process.pid,accountId:z.id,force:X.force===!0,expiresInMs:z.expires?z.expires-this.now():void 0});let Y=await Q({refreshToken:z.refresh,fetchImpl:this.fetchImpl,now:this.now});if(z.access=Y.access,z.refresh=Y.refresh,z.expires=Y.expires,z.lastRefreshedAt=Y.expires-Y.expiresIn*1000,z.lastRefreshError=void 0,U0(Z,z),await this.save(Z),!(await this.load())?.accounts.some((W)=>W.id===$.id))throw new a6($.id);return R1.debug("fallback oauth refresh succeeded",{pid:process.pid,accountId:z.id,expiresInMs:z.expires?z.expires-this.now():void 0}),z}finally{await B.release()}}async refreshAccountQuota($,Z){let X=$;if(this.assertNotTombstoned(X),!X.access)throw Error(`Fallback account ${$.id} has no access token`);if(!this.options.fetchQuotaFn)throw Error("No fetchQuotaFn injected — wham/usage supplement is disabled");let J=this.options.fetchQuotaFn??(async()=>{throw Error("No fetchQuotaFn injected — wham/usage supplement is disabled")}),G=(z)=>this.quotaManager?this.quotaManager.refreshFallback(X.id,z):J({accessToken:z,fetchImpl:this.fetchImpl,now:this.now});try{if(!X.access)throw Error(`Fallback account ${$.id} has no access token`);let z=await G(X.access);X.quota=z,X.lastQuotaRefreshError=void 0,U0(Z,X),await this.save(Z)}catch(z){throw i3($,z,this.now()),U0(Z,$),z}}}var u2="/backend-api/wham/rate-limit-reset-credits",EU=`https://chatgpt.com${u2}`,Cz=`${u2}/consume`,IU=`https://chatgpt.com${Cz}`;function Z0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}import{statSync as Sz}from"node:fs";import{rm as i2}from"node:fs/promises";import{dirname as Rz,join as a2}from"node:path";import{resolveClaustrumConnectionPath as Ez}from"@cortexkit/claustrum-client";function l2($,Z){if(!$)return;let X=$.rawUsedPercent??$.usedPercent;if(!Number.isFinite(X)||X<0||X>100)return;return{usedPercent:X,remainingPercent:100-X,checkedAt:Z,...typeof $.resetsAt==="string"&&{resetsAt:$.resetsAt},...typeof $.windowMinutes==="number"&&Number.isFinite($.windowMinutes)&&$.windowMinutes>0&&{windowMinutes:$.windowMinutes}}}function d2($){if(!Z0($)||typeof $.minor!=="number"||!Number.isSafeInteger($.minor)||typeof $.exponent!=="number"||!Number.isInteger($.exponent))return;let Z=$.minor/10**$.exponent;return Number.isFinite(Z)?Z:void 0}function Pz($){let Z=d2($.total),X=d2($.remaining);if(Z===void 0||X===void 0||Z<0||X<0)return;let J=Z-X,G=$.spendable===!1,z=Z>0?J/Z*100:G?100:0;return{limit:Z,used:J,remaining:X,usedPercent:z,remainingPercent:100-z,reached:G,...typeof $.resetsAt==="string"&&{resetsAt:$.resetsAt},...Z0($.total)&&typeof $.total.unit==="string"&&{unit:$.total.unit}}}function c2($,Z){let X=l2($.usage?.primary,Z.fetchedAt);if(!X||!Number.isFinite(Z.fetchedAt))return;let J=l2($.usage?.secondary,Z.fetchedAt),G=Array.isArray($.spend)?$.spend.find((Q)=>Z0(Q)&&Q.id==="individual_limit"):void 0,z=Z0(G)?Pz(G):void 0,B=Z0($.savedResets)?$.savedResets.availableCount:void 0;return{primary:X,...J&&{secondary:J},...typeof B==="number"&&Number.isFinite(B)&&B>=0&&{resetCreditsAvailable:B},...z&&{spendControl:z},...!G&&{spendControlCleared:!0}}}var s2=["primary","secondary"];function X8($){return $!=null&&typeof $==="object"&&!Array.isArray($)}function h$($){return typeof $==="number"&&Number.isFinite($)}function Tz($,Z){if(!X8(Z))return;let X=Z.usedPercent;if(!h$(X)||X<0||X>100)return;return{label:$,usedPercent:X,...typeof Z.resetsAt==="string"?{resetsAt:Z.resetsAt}:{},...h$(Z.windowMinutes)&&Z.windowMinutes>0?{windowMinutes:Z.windowMinutes}:{}}}function Az($){let Z=$.spendControl;if(X8(Z)&&typeof Z.reached==="boolean"){let X=(J)=>h$(Z[J])?{[J]:Z[J]}:{};return{kind:"reading",reached:Z.reached,...X("remainingPercent"),...X("usedPercent"),...X("limit"),...X("used"),...X("remaining"),...typeof Z.resetsAt==="string"?{resetsAt:Z.resetsAt}:{},...typeof Z.unit==="string"?{unit:Z.unit}:{}}}if($.spendControlCleared===!0)return{kind:"cleared"};return}function S0($,Z,X){if(!X8($)||!h$(Z))return;let J=[],G=[];for(let Y of s2){let H=Tz(Y,$[Y]);if(H)J.push(H);else if(X)G.push({label:Y})}let z=Az($),B=$.resetCreditsAvailable,Q=typeof B==="number"&&Number.isSafeInteger(B)&&B>=0?{resetCredits:{value:B,checkedAt:Z}}:void 0;if(J.length===0&&G.length===0&&!z&&!Q)return;return{checkedAt:Z,...J.length>0?{readings:J}:{},...G.length>0?{coverage:G}:{},...z?{budget:z}:{},...Q?{counters:Q}:{}}}function G$($){if(!Q0($))return;let Z=s($),X={};for(let J of s2){let G=Z.limits.find((B)=>B.label===J&&B.kind==="reading");if(!G||!h$(G.usedPercent))continue;let z={usedPercent:G.usedPercent,remainingPercent:100-G.usedPercent,checkedAt:G.checkedAt,...G.resetsAt!==void 0?{resetsAt:G.resetsAt}:{},...G.windowMinutes!==void 0?{windowMinutes:G.windowMinutes}:{}};X[J]=z}return X.primary||X.secondary?X:void 0}var e6="No ChatGPT login in the vault has the `openai-native` category, or the grant is missing. Check `ck auth status` for categories and `ck auth grant` for the grant.";var y0=a("vault"),Iz="openai-auth",n2={refreshAdapter:"openai",category:"openai-native",apiKeys:!1},bz={opencode:"OpenCode",pi:"Pi"};function xz($){return T3(Iz,$)}function $Z($){return a2(Rz($),"openai-auth-vault")}function kz($,Z){return{...S3({stateDir:$,host:Z}),rosterPath:a2($,`${Z}-roster.json`)}}var ZZ=2000,r2={"vault-unreachable":"Request refused locally: this host is connected to the credential vault, which could not be reached, and local accounts are not used while it is connected. Start the vault and connect accounts in it, or disconnect this host from the vault.","vault-empty":"Request refused locally: this host is connected to the credential vault, which serves it no usable OpenAI account, and local accounts are not used while it is connected. Connect accounts in the vault, or disconnect this host from the vault.","vault-refused":"Request refused locally: the credential vault did not authorize an account, and local accounts are not used while this host is connected to it. Check the accounts in the vault, or disconnect this host from the vault."};function o2($){return $.snapshot()===void 0?"vault-unreachable":"vault-empty"}function yz($){let Z=r1($);return Z?o1(Z):void 0}class J8{host;name;paths;#$;#Z;#z=new Map;#J=new Map;#W=new Map;#Q;#X;#B;#V;#Y=!1;#G=!1;#U=Promise.withResolvers();#H;#D="unknown";#K;constructor($){this.#$=$,this.host=$.host,this.name=xz($.host),this.paths=kz($.stateDir,$.host),this.#Z=new c6({rosterPath:this.paths.rosterPath,tokenPath:this.paths.tokenPath,family:n2,connect:()=>this.#_(),isCustodyActive:()=>this.enrolled(),...$.reservedRouteIds?{reservedRouteIds:$.reservedRouteIds}:{},parseIdentity:yz,insula:{provider:"codex",normalize:c2},...$.now?{now:$.now}:{},onRoster:()=>{this.#X=void 0},onError:(Z)=>this.#j("vault roster refresh failed",Z),logger:y0})}#F(){return(this.#$.connectionFile??Ez)()}#L(){return{connectionFile:this.#F(),projectRoot:this.#$.projectRoot??process.cwd(),storagePath:this.paths.tokenPath,logger:($)=>y0.debug("vault transport error",{errorClass:$})}}#_(){return(this.#$.connectScoped?.()??T2(this.#L())).then(($)=>{return this.#Q=$.insula!==void 0,$})}#q($,Z,X){if(this.#W.get($)===Z)return;this.#W.set($,Z),y0.info("vault background quota source changed",{routeId:$,source:Z,reason:X})}#O(){return this.#$.connectEnrollment?.()??A3(this.#L())}#j($,Z){this.#X=c0(Z),y0.warn($,{host:this.host,error:this.#X})}#N(){return[this.paths.tokenPath,this.paths.statePath].map(($)=>{try{let Z=Sz($);return`${Z.ino}:${Z.size}:${Z.mtimeMs}:${Z.ctimeMs}`}catch{return"?"}}).join("|")}async authority(){let $=this.#N(),Z=await E3(this.paths,this.name);if($===this.#N())return this.#D=Z,this.#K=$,Z;return"unreadable"}enrolled(){return this.#K!==this.#N()||this.#D!=="local"}start(){if(this.#Y||this.#G)return;this.#Y=!0;let $=async()=>{try{await this.authority(),await this.#M(),await this.#Z.refreshInsulaQuota()}catch(X){if(!this.#G)this.#j("vault roster refresh failed",X)}if(this.#G)return;let Z=this.#$.pollIntervalMs??5000;if(Z<=0)return;this.#H=setTimeout(()=>{this.#H=void 0,$()},Z),this.#H.unref?.()};$()}#M(){return this.#V??=this.#Z.refresh().finally(()=>{this.#V=void 0,this.#U.resolve()}),this.#V}firstRoster(){return this.#U.promise}async awaitRequestRoster(){if(this.snapshot())return;if(await this.authority()!=="vault")return;let $=this.#V;if($)await $.catch(()=>{return});if(this.snapshot()||await this.authority()!=="vault")return;await(this.#V??this.#M()).catch((X)=>{this.#j("vault roster refresh failed",X)})}async refresh(){try{await this.authority();let $=this.#V;if($)await $.catch(()=>{return});let Z=await this.#M();return this.#X=void 0,Z}catch($){return this.#j("vault roster refresh failed",$),this.#Z.snapshot()}}snapshot(){return this.#Z.snapshot()}serves(){return this.enrolled()&&(this.snapshot()?.rows.length??0)>0}identities(){if(!this.enrolled())return new Set;return new Set((this.snapshot()?.rows??[]).flatMap(($)=>$.accountIdentity!==void 0?[$.accountIdentity]:[]))}routes(){if(!this.enrolled())return[];let $=new Map((this.snapshot()?.rows??[]).map((Z)=>[Z.routeId,Z]));return this.#Z.routingRows().map((Z)=>{let X=$.get(Z.id)?.accountIdentity;return{id:Z.id,credentialId:$.get(Z.id)?.credentialId,kind:Z.kind==="api-key"?"api-key":"oauth",...X!==void 0?{identity:X}:{},...Z.quota!==void 0?{quota:Z.quota}:{}}})}owns($){return(this.snapshot()?.rows??[]).some((Z)=>Z.routeId===$)}async send($,Z,X){let J=!1;try{return await this.#Z.send($,(G)=>{return J=!0,Z(G.accessToken,G)},{site:X.site,...X.signal?{signal:X.signal}:{}})}catch(G){if(J)throw G;this.#j("vault refused to serve an account",G);return}}async authorize($,Z={}){try{return await this.#Z.authorize($,Z.signal)}catch(X){this.#j("vault refused to serve an account",X);return}}async reportFailure($,Z){if(Z!==401)return;try{await this.#Z.reportFailure($,401,"direct")}catch(X){this.#j("vault failure report failed",X)}await this.refresh()}recordSnapshot($,Z,X,J){let G=S0(Z,(this.#$.now??Date.now)(),X);if(!G)return Promise.resolve();return this.#Z.recordQuota($,G,J).then(()=>{},(z)=>this.#j("vault quota write failed",z))}pollQuota($,Z=!0){let X=this.#J.get($);if(X)return X;let J=this.#C($,Z).finally(()=>{this.#J.delete($)});return this.#J.set($,J),J}async#C($,Z){if(Z){await this.authority(),await this.#Z.refreshInsulaQuota();let z=(await L0(this.paths.rosterPath))?.rows.find((Q)=>Q.routeId===$),B=await this.#Z.cachedInsulaQuotaForRoute($);if(B!==void 0&&z?.accountIdentity){let Q=S0(B,B.primary.checkedAt,!0);if(!Q)return this.#q($,"fallback","insula-unusable"),{ok:!1,error:"unusable insula reading"};if(await this.#Z.recordAccountQuota($,z.accountIdentity,Q))return this.#q($,"insula",null),{ok:!0};return this.#q($,"fallback","account-changed"),{ok:!1,error:"vault account changed"}}this.#q($,"fallback",this.#Q===!1?"insula-not-configured":"no-insula-reading")}let X,J=this.#$.fetchImpl?.()??globalThis.fetch,G=await this.send($,async(z,B)=>{try{let Q=Z?void 0:await this.#Z.cachedInsulaQuota(B);if(Q!==void 0){let H=S0(Q,Q.primary.checkedAt,!0);if(!H)throw Error("unusable insula reading");return await this.#Z.recordQuota($,H,B),new Response(null,{status:200})}let Y=await Z$({accessToken:z,fetchImpl:J,now:this.#$.now??Date.now,...B.accountIdentity?{accountId:B.accountIdentity}:{},accountKey:$,logger:y0});return await this.recordSnapshot($,Y,!0,B),X=void 0,new Response(null,{status:200})}catch(Q){X=c0(Q);let Y=Q?.status;if(typeof Y==="number")return new Response(null,{status:Y});throw Q}},{site:"quota"}).catch((z)=>{X=c0(z);return});if(!G)return{ok:!1,error:X??"vault refused"};return G.ok?{ok:!0}:{ok:!1,error:X??`status ${G.status}`}}requestReading($){let Z=this.#z.get($);if(Z)return Z;let X=this.pollQuota($,!1).catch((J)=>{y0.warn("vault quota poll failed",{routeId:$,error:c0(J)})}).finally(()=>{this.#z.delete($)});return this.#z.set($,X),X}async pollStale($){let Z=(this.#$.now??Date.now)(),X=[];for(let J of this.routes()){let G=fz(J.quota);if(G!==void 0&&Z-G<$)continue;X.push({id:J.id,...await this.pollQuota(J.id)})}return X}async decline($){await this.#Z.decline($),y0.info("vault account declined",{routeId:$})}async accept($){await this.#Z.accept($),y0.info("vault account accepted",{routeId:$})}async status(){await this.authority();let $;try{$=await E$(this.paths,this.name)}catch(Z){this.#j("vault enrollment state unreadable",Z),$={state:"blocked",proposedName:this.name,code:Z instanceof R?Z.kind:"unreadable-state"}}return{host:this.host,name:this.name,enrollment:$,accounts:this.enrolled()?this.snapshot()?.rows??[]:[],...this.#X?{lastError:this.#X}:{}}}async connectStep(){let $=await this.#O().catch((Z)=>{throw new B0("vault-unreachable",`Could not reach the Claustrum vault (${this.#F()}): ${c0(Z)}. Is the vault running?`)});try{let Z=new p6({client:$,paths:this.paths,proposedName:this.name,...this.#$.now?{now:this.#$.now}:{}}),X=await Z.status();if(X.state==="denied"||X.state==="blocked")await Z.resetTerminal();let J=await Z.reconcile();if(y0.info("vault enrollment step",{host:this.host,state:J.state}),J.state==="approved")this.#X=void 0,await this.refresh();return J}finally{$.close()}}waitForApproval($={}){return this.#B??=(async()=>{let Z=$.sleep??((z)=>new Promise((B)=>setTimeout(B,z))),X=$.pollIntervalMs??2000,J=Date.now()+($.timeoutMs??600000),G=await this.connectStep();while(G.state==="pending"||G.state==="busy"){if($.onPending?.(G),Date.now()>=J)return G;await Z(X),G=await this.connectStep()}return G})().finally(()=>{this.#B=void 0}),this.#B}async disconnect(){await i2(this.paths.tokenPath,{force:!0}),await i2(this.paths.statePath,{force:!0}),await this.authority(),this.#X=void 0,y0.info("vault enrollment forgotten",{host:this.host})}assertHostSlot($){if(this.serves())b3({mode:"custody",auth:$,provider:"openai"})}close(){if(this.#G=!0,this.#U.resolve(),this.#H)clearTimeout(this.#H);this.#H=void 0,this.#Z.close()}}function fz($){if(!$)return;let Z=s($).limits.map((X)=>X.checkedAt);return Z.length>0?Math.max(...Z):void 0}function XZ($,Z){if(Z.state!=="pending")return[];if(!Z.requestId)return[`The vault did not take the enrollment request yet${Z.retryCode?` (${Z.retryCode})`:""}. Run Connect again in a moment.`];return[`Enrollment request ${Z.requestId} for ${$} is waiting for approval. Approve it with:`,`  ck auth enroll approve --request-id ${Z.requestId}`,"and let it read your OpenAI accounts with:",`  ck auth grant --principal enrolled:${$} --selector-kind category --selector ${n2.category} --operation read`]}function t2($,Z,X){let J=`${bz[$]} (${Z})`;switch(X.state){case"approved":return`${J}: connected to the Claustrum vault.`;case"idle":return`${J}: not connected to the Claustrum vault.`;case"pending":return X.requestId?`${J}: waiting for approval of request ${X.requestId}.`:`${J}: enrollment request not taken yet${X.retryCode?` (${X.retryCode})`:""}.`;case"denied":return`${J}: the vault denied the enrollment request.`;case"blocked":return`${J}: enrollment stopped (${X.code}).`;case"unavailable":return`${J}: the vault is unavailable (${X.code}).`;case"busy":return`${J}: another process is enrolling right now.`}}function G8($,Z){switch(Z.state){case"approved":{let X=$.snapshot()?.rows.length??0;return{ok:!0,text:`Connected: the vault approved ${$.name}. It serves ${X} OpenAI account${X===1?"":"s"} to this host${X===0?`. ${e6}`:"."}`}}case"denied":return{ok:!1,text:"The vault denied the enrollment request. Run Connect again to send a new one."};case"blocked":return{ok:!1,text:`Enrollment stopped (${Z.code}). Run Connect again to send a new request.`};case"pending":case"busy":return{ok:!1,text:[...XZ($.name,Z),"Still waiting. The request stays open: run Connect again after approving it."].join(`
+`)};default:return{ok:!1,text:`Enrollment is ${Z.state}.`}}}var e2=`${String.fromCharCode(27)}\\[[0-9;]*m`,Zj=new RegExp(e2,"g"),Xj=new RegExp(`^${e2}`);function z$($){return $.authority!=="local"}async function s0($){return{authority:await $.authority(),status:await $.status(),identities:$.identities(),routes:new Set($.routes().map((Z)=>Z.id))}}async function X7($){let Z;try{return await Promise.race([Promise.resolve().then(()=>$.refresh()).then(()=>{return},(X)=>X instanceof Error?X.message:String(X)),new Promise((X)=>{Z=setTimeout(()=>X("Vault roster refresh did not finish within the roster wait budget."),ZZ)})])}finally{clearTimeout(Z)}}function W1($){return $.email||$.label||$.routeId}var B8="Accounts are managed in the vault with ck. Disconnect to use local accounts.",v$="Nothing was changed: accounts are managed in the vault with ck. Disconnect to use local accounts.";var R0="main";function JZ($){return $.find((Z)=>Z.id.startsWith("vault:")&&Z.credentialId==="chatgpt:openai")?.id??null}function G7($,Z,X){let J=new Map;if($8(Z))for(let G of $)J.set(G.id,m2(G$(G.quota),Z,G.id===R0?void 0:G.id,X));return J}var z7=5,Q8=5000;function B7($){if($==="ordered")return"roster";return $==="fallback-first"?"fallback-first":"main-first"}function Q7($,Z=Q8){let X=$.rows.filter((B)=>B.kind==="oauth"&&$.killswitch.get(B.id)!==!1&&s(B.quota).limits.length===0);if(X.length===0)return;if(h0({rows:$.rows,now:$.now,rateLimitMarks:$.rateLimitMarks,refreshBackoff:$.refreshBackoff,requestPull:()=>{}}).admitted.some((B)=>$.killswitch.get(B.id)!==!1))return;let G=[];if(h0({rows:X,now:$.now,rateLimitMarks:$.rateLimitMarks,refreshBackoff:$.refreshBackoff,requestPull:(B)=>{let Q=$.requestPull(B);if(Q)G.push(Q.catch(()=>{}))}}),G.length===0)return;let z;return Promise.race([Promise.all(G),new Promise((B)=>{z=setTimeout(B,Z)})]).then(()=>{}).finally(()=>clearTimeout(z))}function Y8($){return $.reason==="exhausted"||$.reason==="budget-spent"}function Y7($,Z,X){if($===void 0)return{reason:"no-credential"};if(X.get($)===!1)return{reason:"killswitch"};let J=Z.excluded.find((z)=>z.id===$);if(J?.reason==="rate-limited")return{reason:"mid-stream-rate-limit",resetAtMs:J.until};if(J)return{reason:"no-credential"};let G=Z.refused.find((z)=>z.id===$);if(G&&"resetAtMs"in G)return{reason:"quota-exhausted",resetAtMs:G.resetAtMs};if(G)return{reason:"quota-unknown"};return{reason:"no-credential"}}function J7($,Z,X){if(Z.refused.find((G)=>!Y8(G)&&X.get(G.id)!==!1))return{reason:"quota-unknown"};return Y7($[0],Z,X)}function H7($){let Z=$.replayable!==!1,X=$.mainId===void 0?R0:$.mainId??"",J=Z?$.placement:"main-first",G=LZ({rows:$.rows,placement:J,formerMainId:X,killswitch:$.killswitch,rateLimitMarks:$.rateLimitMarks,refreshBackoff:$.refreshBackoff,now:$.now,requestPull:$.requestPull}),z=f1($.rows.map((Y)=>Y.id),J,X),B=new Set(G.admission.refused.filter((Y)=>Y8(Y)&&$.killswitch.get(Y.id)!==!1).map((Y)=>Y.id)),Q=z.filter((Y)=>B.has(Y));if(!Z){let Y=z.includes(X),H=Y?X:G.order[0]??Q[0];if(H!==void 0&&G.order.includes(H))return{kind:"send",order:[H],lastPath:!1};if(H!==void 0&&B.has(H))return{kind:"send",order:[H],lastPath:!0};return{kind:"block",block:Y?Y7(X,G.admission,$.killswitch):J7(z,G.admission,$.killswitch)}}if(G.order.length>0)return{kind:"send",order:G.order,lastPath:!1};if(Q.length>0)return{kind:"send",order:Q,lastPath:!0};return{kind:"block",block:J7(z,G.admission,$.killswitch)}}function H8($){let Z=h0({rows:$.rows,rateLimitMarks:$.rateLimitMarks,refreshBackoff:$.refreshBackoff,now:$.now,requestPull:$.requestPull}),X=new Map;for(let J of $.rows)X.set(J.id,s(J.quota));for(let J of Z.admitted)if(J.projection)X.set(J.id,J.projection);return{projections:X,excluded:new Set(Z.excluded.map((J)=>J.id))}}function W7($,Z,X){let J=X.exclude,G=J?$.rows.filter((B)=>!J.has(B.id)):$.rows,z=new Map;for(let B of G){let Q=Z.resetCredits(B.id);if(Q!==void 0)z.set(B.id,Q)}return SZ({rows:G,now:$.now,rateLimitMarks:$.rateLimitMarks,refreshBackoff:$.refreshBackoff,requestPull:$.requestPull,killswitch:$.killswitch,requestBytes:Z.requestBytes,...X.pendingBytes?{pendingBytes:X.pendingBytes}:{},rowReservePercent:(B)=>Z.reservePercent(B.id),refusedPinPolicy:"move-on-confirmed-exhaustion",resetCreditsApplicable:z,...X.pin===void 0?{}:{pin:{accountId:X.pin}},...Z.onEmptyWeightedSet?{onEmptyWeightedSet:Z.onEmptyWeightedSet}:{}})}function V7($,Z,X,J){let G=W7($,Z,{exclude:X,pendingBytes:J});if(G.outcome!=="dispatch"||G.source==="pin")return;return{accountId:G.accountId,source:G.source,...G.quotaCheckedAt===void 0?{}:{quotaCheckedAt:G.quotaCheckedAt}}}function U7($,Z,X){let J=$.killswitch.get(X)===!1,G=W7($,Z,{pin:X});if(G.outcome==="dispatch"){if(G.pin.action==="assign")return{kind:"move",reason:J?"killswitch":"exhausted"};return G.accountId===X?{kind:"serve"}:{kind:"detour"}}let z=G.admission.refused.find((B)=>B.id===X);if(!J&&z&&Y8(z))return{kind:"last-path"};return{kind:"none"}}function j7($,Z,X,J){let G=$.killswitch.get(X);return AZ({quota:Z.projections.get(X),now:$.now,...J===void 0?{}:{status:J},...G===void 0?{}:{killswitchPasses:G}})}function D7($){return Z0($)?{...$}:{}}function GZ($,Z,X,J){let G=X.confirm?.irreversible?{irreversible:!0,confirm:X.confirm.message}:{...X.confirm?{confirm:X.confirm.message}:{}};return{id:X.id,label:X.label,...X.description?{description:X.description}:{},...X.group?{group:X.group}:{},knobs:X.knobs,...G,run:async({values:z,invocation:B})=>{let Q=await $.apply({command:$.command,sectionId:Z,...J?{itemId:J}:{},actionId:X.id,values:z,confirmed:!0},B);return{ok:Q.ok,text:Q.text,...Q.code?{code:Q.code}:{}}}}}function W8($,Z){return new Proxy($,{get(X,J){if(J==="read")return async()=>{let z=await X.read();if(z.status!=="ready")return z;let B={...z,rows:z.rows.map((H)=>({...H,label:H.label??H.id}))};if(!Z)return B;let Q=await s0(Z);if(!z$(Q))return B;let Y=[...Q.status.accounts.map((H)=>({id:H.routeId,label:W1(H),type:"oauth",enabled:H.enabled,identity:H.accountIdentity,quota:H.quota,hasEntry:!1,needsFirstReading:!1,candidate:!1}))];return{...z,rows:Y}};if(J==="readSettings")return async()=>{let z=await X.readSettings();if(z.status==="error"||!Z)return z;let B=await s0(Z),Q=D7(z.settings.killswitch);if(!z$(B)||!z.settings.killswitch)return z;let Y=D7(Q.accounts);for(let H of B.status.accounts)Y[H.routeId]=H1({version:1,accounts:[],...z.settings},H.routeId);return{...z,settings:{...z.settings,killswitch:{...Q,accounts:Y}}}};let G=Reflect.get(X,J);return typeof G==="function"?G.bind(X):G}})}function V8($,Z,X={}){let J=_1($),G=(H)=>_1({command:$.command,title:$.title,store:W8($.store,Z),accounts:$.accounts,quota:$.quota,limits:$.limits,routing:{...$.routing,formerMainId:H??""},...$.extraLocks?{extraLocks:$.extraLocks}:{},...$.now?{now:$.now}:{}}),z=async(H,W)=>{let V=await s0(Z),j=z$(V),D=JZ(V.status.accounts.map((A)=>({id:A.routeId,credentialId:A.credentialId}))),U=j?G(D):J,K=(await U.open(W)).menu.sections.find((A)=>A.id===H);if(!K)throw new B0("unavailable","The account menu is unavailable.");if(!j)return{lines:K.lines,items:K.items.map((A)=>({...A,actions:A.actions.map((x)=>GZ(U,H,x,A.id))})),actions:K.actions.map((A)=>GZ(U,H,A))};let M=new Map(V.status.accounts.map((A)=>[A.routeId,A])),P=($.now??Date.now)(),E=(A)=>({id:"check",label:A?"Check this account":"Check now",group:"Actions",run:async()=>{let w=[...(await s0(Z)).routes].filter((y)=>!A||y===A);if(A&&w.length===0)throw new B0("unavailable","This vault account cannot be checked right now.");for(let y of w){let f=await Z.pollQuota(y);if(!f.ok)throw new B0("quota-check-failed",`${y}: ${f.error??"vault unavailable"}`)}return`Checked quota for ${w.length} account${w.length===1?"":"s"}.`}});if(H==="quota"){let A=(x,w)=>C0(s(x.quota,$.quota?.scope),{now:P,form:w});return{lines:V.status.accounts.filter((x)=>!V.routes.has(x.routeId)).map((x)=>`${W1(x)} (${x.enabled?x.state:"disabled"}): ${A(x,"compact")}`),items:V.status.accounts.filter((x)=>V.routes.has(x.routeId)).map((x)=>({id:x.routeId,label:W1(x),group:"Accounts",status:A(x,"compact"),detail:A(x,"full"),actions:[E(x.routeId)]})),actions:V.routes.size>0?[E()]:[]}}let F=K.items.map((A)=>{let x=M.get(A.id),w=x&&H==="accounts"?`Vault · ${x.credentialType==="oauth"?"login":"API key"} · ${x.state} · ${x.enabled?"enabled":"declined"}`:A.detail;return{id:A.id,label:A.label,detail:w,group:A.group,status:x&&H==="accounts"?x.enabled?x.state:"disabled":A.status,...A.facts?{facts:A.facts}:{},actions:x&&H!=="limits"?[]:A.actions.map((y)=>GZ(U,H,y,A.id))}}),q=K.actions.filter((A)=>H==="limits"||H==="routing"&&A.id==="mode").map((A)=>GZ(U,H,A)),L=K.actions.find((A)=>A.id==="mode")?.knobs.find((A)=>A.id==="mode"),S=H==="routing"&&D===null&&L?.kind==="choice"&&(L.value==="main-first"||L.value==="fallback-first");return{lines:H==="accounts"?[`${V.status.accounts.length} vault account${V.status.accounts.length===1?"":"s"}`,`${V.routes.size} can route`,B8]:[...K.lines,...S?["No default vault account, so this mode orders like Ordered"]:[]],items:F,actions:q}},B=_1({...$,accounts:void 0,quota:void 0,routing:void 0,limits:void 0,replace:{accounts:{title:"Accounts",build:(H)=>z("accounts",H)},quota:{title:"Quota",build:(H)=>z("quota",H)},routing:{title:"Routing",build:(H)=>z("routing",H)},limits:{title:"Limits",build:(H)=>z("limits",H)}},extras:$.extras?.map((H)=>H.id!=="reset"?H:{...H,build:async(W)=>{let V=await s0(Z);if(z$(V))return{lines:[B8]};return H.build(W)}})}),Q=async()=>{if(!z$(await s0(Z)))return{menu:J,error:void 0};let H=X.refresh===!1?void 0:await X7(Z);return{menu:B,error:H}},Y=async(H,W)=>{let V=await H.menu.open(W);if(H.error)V.menu.sections.find((D)=>D.id==="vault")?.lines.push(`Last error: ${H.error}`);return V};return{command:$.command,open:async(H)=>Y(await Q(),H),apply:async(H,W)=>{let V=await Q(),{menu:j}=V;if(j===B&&(H.sectionId==="accounts"||H.sectionId==="routing"&&H.actionId==="order"||H.sectionId==="reset"||H.sectionId==="quota"&&(await s0(Z)).routes.size===0||H.sectionId==="limits"&&H.itemId!==void 0&&!(await s0(Z)).status.accounts.some((D)=>D.routeId===H.itemId)))return{...await Y(V,W),ok:!1,code:"vault-local-action",text:v$};if(X.refuseApply)return{...await Y(V,W),ok:!1,...X.refuseApply};return j.apply(H,W)}}}var V1="openai",K8="OpenAI accounts",I1="main",q7="that account is already your main account, so it was not added again",m$=a("commands"),N7=new Set(["__proto__","constructor","prototype"]);function M7($,Z){let X={version:1,accounts:[],killswitch:$},J=Z0($.accounts)?Object.keys($.accounts):[],G={};for(let Q of new Set([I1,...Z,...J])){if(N7.has(Q))continue;let Y=H1(X,Q===I1?void 0:Q);G[Q]={primary:Y.primary,secondary:Y.secondary}}let z=H1(X,void 0),B={...$};return delete B.main,B.accounts=G,B.defaults={primary:z.primary,secondary:z.secondary},B.schema=J$,B}function F7($,Z){let X=Z0($.accounts)?{...$.accounts}:{};for(let G of new Set([I1,...Z])){if(N7.has(G)||Object.hasOwn(X,G))continue;X[G]={primary:Y1.primary,secondary:Y1.secondary}}let J=Z0($.defaults)?$.defaults:{primary:Y1.primary,secondary:Y1.secondary};return{...$,accounts:X,defaults:J,schema:J$}}function U8($,Z){let X=!1;if(Z0($.cachekeep))$.cacheKeep={...$.cachekeep,...Z0($.cacheKeep)?$.cacheKeep:{}},delete $.cachekeep,X=!0;let J=$.killswitch;if(Z0(J)&&J.schema!==J$)$.killswitch=M7(J,Z),X=!0;return X}async function K7($){let Z=await $.read();return Z.status==="ready"?Z.rows.map((X)=>X.id):[]}function L7($){let Z=async()=>{let J=await $.readSettings();if(J.status==="error")return J;let G=structuredClone(J.settings);return U8(G,await K7($)),{...J,settings:G}},X=async(J,G)=>{let z=await K7($);return $.updateSettings(async(B)=>{U8(B,z);let Q=await J(B)??B;if(Z0(Q.killswitch)&&Q.killswitch.schema!==J$)Q.killswitch=F7(Q.killswitch,z);return Q},G)};return new Proxy($,{get(J,G){if(G==="readSettings")return Z;if(G==="updateSettings")return X;let z=Reflect.get(J,G,J);return typeof z==="function"?z.bind(J):z}})}function _7($,Z){let X=(Y,H)=>Z.rowLocks?Z.rowLocks(Y):H,J=(Y,H)=>{let W=X(Y,H?.extraLocks);return{...H??{},...W?{extraLocks:W}:{}}},G=(Y,H,W,V)=>$.replace(Y,H,W,J(Y,V)),Q={add:async(Y,H)=>{let W=await $.read(),j=(W.status==="ready"?W.rows:[]).filter((K)=>K.type==="oauth"&&!K.invalid),D=Y.identity?j.find((K)=>K.identity===Y.identity):void 0;if(D?.id===I1)throw new B0("main-account",q7);let U=D??j.find((K)=>K.id===Y.id&&K.id!==I1);if(!U||Y.credential.type!=="oauth")return $.add(Y,H);let N=await G(U.id,Y.credential,Y.identity!==void 0?{identity:Y.identity}:{},H?.extraLocks?{extraLocks:H.extraLocks}:void 0);return m$.info("account signed in again",{id:U.id}),{id:N.id,outcome:"rotated",credential:N.credential,credentialEpoch:N.credentialEpoch}},replace:G,enable:(Y,H)=>$.enable(Y,J(Y,H)),disable:(Y,H,W)=>$.disable(Y,H,J(Y,W)),remove:(Y,H)=>$.remove(Y,J(Y,H))};return new Proxy($,{get(Y,H){if(Object.hasOwn(Q,H))return Q[H];let W=Reflect.get(Y,H,Y);return typeof W==="function"?W.bind(Y):W}})}var O7="migration";function j8($){let Z=["Accounts move to the new account layout once every OpenCode process on this machine runs this version of OpenAI auth. This menu works on that layout, so it opens after the move.",$.length>0?"These processes still hold the move back:":"No running process holds the move back."],X={command:V1,title:K8,sections:[{id:O7,slot:"extra",title:"Accounts are moving",lines:Z,items:$.map((J,G)=>({id:`blocker-${G}`,label:J.pid==="unknown"?"processes that could not be read":`pid ${J.pid}`,detail:`version ${J.version}`,actions:[]})),actions:[]}]};return D8(X)}var cz=new Set(["access","refresh","apikey","authheader","password","credential","credentials"]);function sz($){let Z=$.toLowerCase().replace(/[-_]/g,"");if(cz.has(Z))return!0;return Z.endsWith("token")||Z.endsWith("key")||Z.endsWith("secret")}function zZ($,Z,X){if(Array.isArray($))return $.map((G,z)=>zZ(G,`${Z}[${z}]`,X));if(!Z0($))return $;let J={};for(let[G,z]of Object.entries($)){if(sz(G)){X.push(`${Z}.${G}`);continue}J[G]=zZ(z,`${Z}.${G}`,X)}return J}function D8($){let Z=[],X=zZ($,"menu",Z);if(Z.length>0)m$.warn("credential-shaped field stripped before RPC",{fields:Z});return X}function C7($){return{id:$.id,credential:{type:"oauth",refresh:$.refresh,...$.access!==void 0?{access:$.access}:{},...$.expires!==void 0?{expires:$.expires}:{}},...$.accountId!==void 0?{identity:$.accountId}:{},...$.label!==void 0?{label:$.label}:{}}}function P7($,Z){return{label:"Add account",knobs:[{kind:"text",id:"label",label:"Label (optional)"},{kind:"toggle",id:"headless",label:"Sign in with a device code (no browser on this machine)",value:!1}],run:async(X)=>{let J=typeof X.label==="string"&&X.label.trim().length>0?X.label.trim():void 0,G=X.headless===!0,z=await $.begin({...J!==void 0?{label:J}:{},headless:G}),B=G?`Open this verification URL:
-${G.url}
+${z.url}
-Then enter the code: ${G.instructions.match(/Enter code: (.+)/)?.[1]??G.instructions}
+Then enter the code: ${z.instructions.match(/Enter code: (.+)/)?.[1]??z.instructions}
 The account is added when you finish.`:`Open this URL and complete sign-in:
-${G.url}
+${z.url}
-${G.instructions}
+${z.instructions}
-The account is added when you finish.`,Q=G.completion.then(async(B)=>{let H=await $.mainIdentity?.();if(B.accountId&&H&&B.accountId===H)throw v$.warn("account add rejected (main identity)",{id:B.id}),new W0("main-account",e2);return v$.info("account added",{id:B.id}),Q7(B)});return{status:"pending",message:z,completion:Q}}}}function Y8($){return{id:"session",title:"This session",build:async(Z)=>{let X=Z.sessionId;if(!X)return{lines:["No current session"]};let J=await $.getPin?.(X);return{lines:[J?`Pinned to ${J}`:"No sticky pin"],actions:$.clearPin?[{id:"clear-pin",label:"Clear this session's pin",description:"The next request may still choose the same account.",run:async({invocation:G})=>{if(!G.sessionId)return"No current session.";return await $.clearPin?.(G.sessionId),v$.info("routing session pin cleared"),"This session's pin was cleared. The next request may choose the same account if it remains the best selection."}}]:[]}}}}function W8($){let{vault:Z}=$;return{id:"vault",title:"Vault",build:async()=>{let X=await Z.status(),J=await Z.authority()!=="local",G=Z.routes().length;return{lines:[J?`Connected · ${X.accounts.length} account${X.accounts.length===1?"":"s"}`:X.enrollment.state==="idle"?"Not connected":`Enrollment ${X.enrollment.state}`,c2(X.host,X.name,X.enrollment),...$Z(X.name,X.enrollment),...J?[X.accounts.length===0?"The vault serves no OpenAI account to this host yet.":`The vault serves ${X.accounts.length} OpenAI account${X.accounts.length===1?"":"s"}; ${G} can route now.`]:[],...J&&Z.snapshot()?.complete===!1?["The vault's last list had records this host could not read; accounts it did not list are kept as they were until a complete list arrives."]:[],...X.lastError?[`Last error: ${X.lastError}`]:[]],items:X.accounts.map((z)=>({id:z.routeId,label:W1(z),group:"Accounts",status:z.enabled?z.state:"disabled",detail:[z.credentialType==="api_key"?"API key":"login",z.state==="active"?"active":`vault state ${z.state}`,z.enabled?"enabled":"disabled here"].join(", "),actions:[z.enabled?{id:"disable",label:"Disable on this host",description:"It stays in the vault and in this list, and is never sent from this host until enabled again.",run:async()=>{return await Z.decline(z.routeId),await $.changed?.(),`${W1(z)} is disabled on this host.`}}:{id:"enable",label:"Enable on this host",run:async()=>{return await Z.accept(z.routeId),await $.changed?.(),`${W1(z)} is enabled on this host.`}}]})),actions:J?[{id:"disconnect",label:"Disconnect",description:"Forgets this host's vault token; its vault accounts stop routing at once. Revoke the enrollment itself with `ck auth enroll revoke`.",confirm:"Disconnect from the vault? Connecting again needs a new approval with `ck`.",run:async()=>{return await Z.disconnect(),await $.changed?.(),`Disconnected: ${Z.name} no longer reads from the vault. Run \`ck auth enroll revoke --name ${Z.name}\` to revoke it in the vault too.`}}]:[{id:"connect",label:"Connect",description:"Asks the vault to enroll this host; you approve the request with `ck`.",run:async({invocation:z})=>{let Q=await Z.connectStep();if(Q.state!=="pending"&&Q.state!=="busy")return await $.changed?.(),Z8(Z,Q);return Z.waitForApproval($.wait).then(async(B)=>{await $.changed?.();let H=Z8(Z,B);z.notify(H.text,H.ok?"info":"warning")}).catch((B)=>{z.notify(`Connecting to the vault failed: ${B instanceof Error?B.message:String(B)}`,"error")}),{ok:!0,text:[...$Z(Z.name,Q),"Waiting for the approval; you are told here when it lands."].join(`
-`)}}}]}}}}var H7=[{value:"main-first",label:"Main first"},{value:"fallback-first",label:"Fallback first"}],Y7=["primary","secondary"];function V8($){let Z={command:V1,title:H8,store:z8(J7(G7($.store,{...$.rowLocks?{rowLocks:$.rowLocks}:{}}))),...$.extraLocks?{extraLocks:$.extraLocks}:{},accounts:{...$.login?{login:B7($.login)}:{},...$.protect?{protect:$.protect}:{},...$.describeIdentity?{describeIdentity:$.describeIdentity}:{}},quota:$.quotaCheck?{check:$.quotaCheck}:{},routing:{orderedVariants:H7,formerMainId:z$},limits:{labels:Y7},...$.cache?{cache:$.cache}:{},...$.diagnostics?{diagnostics:$.diagnostics}:{},...$.extras?{extras:$.extras}:{},...$.logger?{logger:$.logger}:{},...$.now?{now:$.now}:{}},X=$.vault?o2(Z,$.vault):_1(Z),J=(G)=>{let{sessionId:z}=G,Q=G.notify.bind(G);return{...z!==void 0?{sessionId:z}:{},notify:Q}};return{command:V1,async open(G){let z=J(G),Q=$.vault&&await $.vault.authority()!=="local"?void 0:await $.migration?.();if(Q&&!Q.migrated)return{command:V1,menu:B8(Q.blockers)};return X.open(z)},async apply(G,z){let Q=J(z),B=$.vault&&await $.vault.authority()!=="local"?void 0:await $.migration?.();if(B&&!B.migrated)return{command:V1,ok:!1,text:"Nothing was changed: the accounts have not moved to the new layout yet.",menu:B8(B.blockers)};let H=await X.apply(G,Q);if(H.ok)await $.afterApply?.();return H}}}function W7($,Z,X){let J=$.get(Z.sessionId),G=new Set(Z.validPinnedAccountIds);if(J&&!Z.excludeAccountIds.includes(J.accountId)&&W$(J,G,Z.wireAccountIdByAccount[J.accountId])){if(Z.persist){let H=Z.quotaCheckedAtByAccount[J.accountId];X(Z.sessionId,{accountId:J.accountId,inputBytes:Z.requestBytes,...J.wireIdentity!==void 0?{wireIdentity:J.wireIdentity}:{},...H!==void 0?{quotaCheckedAt:H}:{}})}return{accountId:J.accountId}}let z=new Map(Object.entries(Z.quotaCheckedAtByAccount)),Q=FZ($,z,Z.sessionId),B=Z.select(Q);if(!B)return;if(Z.persist){let H=Z.wireAccountIdByAccount[B.accountId];X(Z.sessionId,{accountId:B.accountId,inputBytes:Z.requestBytes,...H!==void 0?{wireIdentity:H}:{},...B.quotaCheckedAt!==void 0?{quotaCheckedAt:B.quotaCheckedAt}:{}})}return{accountId:B.accountId}}import{statSync as uz}from"node:fs";var V7=30000,lz=8,dz=1800000;function U7($){return $.identity?`identity:${$.identity}`:`row:${$.id}`}function U8($){try{let Z=uz($);return`${Z.ino}:${Z.size}:${Z.mtimeMs}`}catch{return"-"}}function I1($){let Z=$.credential;if(Z?.type!=="oauth")return;return{access:Z.access??"",expires:Z.expires,refresh:Z.refresh}}function j8($,Z){try{return E0($,Z)}catch{return $}}function j7($,Z,X){let J=U7(Z);$.set(J,[...$.get(J)??[],{credentialEpoch:Z.credentialEpoch,identity:Z.identity,observation:X}].slice(-lz))}function D7($,Z,X){let J=$;for(let G of Z.get(U7($))??[]){if(!(X-G.observation.checkedAt<=dz)||G.credentialEpoch!==$.credentialEpoch||G.identity!==$.identity)continue;J={...J,quota:j8(J.quota,G.observation)}}return J}function K7($,Z,X,J){let G=i1($);if(typeof Z?.status==="number"||H3(Z)){let Q=E6({error:Z,now:X,refreshToken:$,...J?{previous:{message:"",checkedAt:X,nextRetryAt:J.nextRetryAt,retryCount:J.retryCount,tokenHash:J.tokenHash}}:{}});return{nextRetryAt:Q.nextRetryAt,tokenHash:G,retryCount:Q.retryCount}}return{nextRetryAt:X+V7,tokenHash:G,retryCount:J?.tokenHash===G?J.retryCount:0}}function q7($,Z,X,J){let G=new Map;for(let z of $){if(J(z,X))continue;let Q=Z.get(z.id);G.set(z.id,Q&&Q.nextRetryAt>X?Q.nextRetryAt:X+V7)}return G}var pD=i("quota");import{types as cz}from"node:util";var sz=/"(?:e|\\u0065)(?:r|\\u0072){2}(?:o|\\u006f)(?:r|\\u0072)"\s*:/i,iz=/"(?:t|\\u0074)(?:y|\\u0079)(?:p|\\u0070)(?:e|\\u0065)"\s*:\s*"(?:e|\\u0065)(?:r|\\u0072){2}(?:o|\\u006f)(?:r|\\u0072)"/i;function L7($){return $.replace(/\\(?:u([a-f\d]{4})|(["\\/bfnrt]))/gi,(Z,X,J)=>{if(X)return String.fromCharCode(Number.parseInt(X,16));return{b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t"}[J]??J??Z})}function az($,Z){if(!Z)return $;let X=$.split(Z).join("[credential]"),J=Z.replace(/\s/g,"");if(!J)return X;let G=X.replace(/\s/g,"");if(!G.includes(J))return X;let z=[];for(let H=0;H<X.length;H++){let Y=X[H]??"";if(!/\s/.test(Y))z.push(H)}let Q=[],B=0;for(let H=G.indexOf(J);H>=0;H=G.indexOf(J,H+J.length)){let Y=z[H]??B,W=(z[H+J.length-1]??Y)+1;Q.push(X.slice(B,Y),"[credential]"),B=W}return Q.length?Q.join("")+X.slice(B):X}function N7($,Z){let X=az($,Z);return O4(X).replaceAll("***REDACTED***","[credential]")}function U1($,Z){let X=N7($,Z),J=L7(X),G=N7(J,Z);return G===J?X:G}function M7($){let Z=/^(-?)(0|[1-9]\d*)(?:\.(\d+))?(?:[eE]([+-]?\d+))?$/.exec($);if(!Z)return;let X=Z[3]??"",J=(Z[2]??"")+X,G=0;while(J[G]==="0")G++;if(G===J.length)return"0";let z=J.length;while(J[z-1]==="0")z--;let Q=Z[4]??"0",B=Q.startsWith("-")||Q.startsWith("+")?1:0;while(Q[B]==="0")B++;let H=Q.slice(B)||"0";if(H.length>16)return;let Y=BigInt((Q.startsWith("-")?"-":"")+H)-BigInt(X.length)+BigInt(J.length-z);return`${Z[1]}${J.slice(G,z)}e${Y}`}function _7($,Z){let X=Z?M7(Z):void 0;return $.replace(/"(?:\\.|[^"\\])*"|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null/g,(J)=>{if(!J.startsWith('"'))return Z&&(J===Z||X!==void 0&&M7(J)===X||(Z==="Infinity"||Z==="-Infinity")&&/^[-\d]/.test(J)&&String(Number(J))===Z)?'"[credential]"':J;let G=L7(J.slice(1,-1)),z=U1(G,Z);return z===G?J:JSON.stringify(z)})}function D8($,Z){let X=_7($,Z);try{return JSON.parse($),X}catch{return U1(X,Z)}}var nz=16384,rz=65536,oz=[/429|500|502|503|504|524/i,/rate increased too quickly|rate limit|rate-limit|rate_limit|too many requests/i,/overloaded|service unavailable|service_unavailable|service-unavailable|internal error|internal_error|internal server error|server error|server_error|server-error|provider returned error|provider_returned_error|provider-returned-error/i,/terminated|fetch failed|failed to fetch|network[-_\s]error|upstream connect|connection error|connection refused|connection lost|socket connection was closed|socket hang up|reset before headers|getaddrinfo|enotfound|eai_again|econnrefused|econnreset|etimedout/i,/^timeout$|\b(?:request|response|connection|network|stream|read) (?:timeout|timed out|time out)\b/i,/try your request again|retry your request|resource exhausted|resource_exhausted/i,/\btry again (?:later|in\b)|\b(?:currently|temporarily) at capacity\b/i];function tz($){try{let Z=t(JSON.parse($),"request_id");if(typeof Z==="string")return Z;if(typeof Z!=="number")return;let X=0,J,G=!0,z=!1,Q;for(let B of $.matchAll(/"(?:\\.|[^"\\])*"|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?|[{}[\]:,]/g)){let H=B[0];if(H==="{"||H==="["){X++;continue}if(H==="}"||H==="]"){X--;continue}if(X!==1)continue;if(H===","){G=!0,z=!1,J=void 0;continue}if(H===":"){z=!0;continue}if(G&&H.startsWith('"')){J=JSON.parse(H),G=!1;continue}if(z&&J==="request_id"&&!H.startsWith('"'))Q=H;z=!1}return Q}catch{return}}function ez($,Z){let X=D8($,Z);if(Buffer.byteLength(X,"utf8")<=rz)return X;let J=oz.flatMap((z)=>z.exec(X)?.[0]??[]);for(let z of["FreeUsageLimitError","GoUsageLimitError"])if(X.includes(z))J.push(z);let G={retry:J};try{let z=JSON.parse(X);if(t(z,"type")==="error")G.type="error";let Q=t(z,"error"),B={};for(let Y of["code","type"]){let W=t(Q,Y);if(typeof W==="string")B[Y]=W.slice(0,256)}if(Object.keys(B).length)G.error=B;let H={};for(let Y of["workspace","limitName"]){let W=t(t(z,"metadata"),Y);if(typeof W==="string")H[Y]=W.slice(0,256)}if(Object.keys(H).length)G.metadata=H}catch{}return JSON.stringify(G)}function JZ($){if(!$||typeof $!=="object")return!1;let Z=$;for(let X=0;Z&&X<16;X++){if(cz.isProxy(Z))return!1;Z=Object.getPrototypeOf(Z)}return Z===null}function t($,Z){if(!JZ($))return;let X=Object.getOwnPropertyDescriptor($,Z);return X&&"value"in X?X.value:void 0}function m$($,Z){return U1($,Z).slice(0,nz)}function Q$($,Z){let X=Object.getOwnPropertyDescriptor($,Z)?.get;if(!X)throw Error(`Missing native ${Z} accessor`);return X}var $Q=Q$(DOMException.prototype,"message"),ZQ=Q$(DOMException.prototype,"name");function j1($,Z){let X=t($,"message"),J=t($,"name");if(JZ($)&&$ instanceof DOMException)try{X=$Q.call($),J=ZQ.call($)}catch{}let G=Error(m$(typeof X==="string"?X:typeof $==="string"?$:"Provider request failed",Z));for(let U of Object.getOwnPropertyNames(G))if(U!=="message")Reflect.deleteProperty(G,U);Object.defineProperty(G,"name",{value:typeof J==="string"?m$(J,Z):"Error",configurable:!0,writable:!0});let z=(U,j,K)=>{let V=t(U,K);if(typeof V==="string"||typeof V==="number"&&Number.isFinite(V)||typeof V==="boolean")Object.defineProperty(j,K,{value:typeof V==="string"?m$(V,Z):V,enumerable:!0,configurable:!0,writable:!0})};for(let U of["status","statusCode","status_code","resets_at","resets_in_seconds"]){let j=t($,U);if(typeof j==="number"&&Number.isFinite(j))z($,G,U)}for(let U of["code","type","isRetryable"])z($,G,U);for(let U of["error","data"]){let j=t($,U),K=Object.create(null);for(let N of["type","code","message","resets_at","resets_in_seconds"])z(j,K,N);let V=t(j,"error");if(JZ(V)){let N=Object.create(null);for(let q of["type","code","message","resets_at","resets_in_seconds"])z(V,N,q);K.error=N}if(Object.keys(K).length)Object.defineProperty(G,U,{value:K,enumerable:!0})}let Q=t($,"responseHeaders");if(Q&&typeof Q==="object"){let U={};for(let j of["retry-after-ms","retry-after"]){let K=t(Q,j);if(typeof K==="string")U[j]=m$(K,Z)}Object.defineProperty(G,"responseHeaders",{value:U,enumerable:!0})}let B=t($,"responseBody");if(typeof B==="string")Object.defineProperty(G,"responseBody",{value:ez(B,Z),enumerable:!0});let H=t($,"request_id"),Y=t(Q,"x-request-id"),W=typeof H==="string"?H:typeof Y==="string"?Y:typeof B==="string"?tz(D8(B,Z)):void 0;if(typeof W==="string")Object.defineProperty(G,"request_id",{value:m$(W,Z),enumerable:!0});for(let U of["vercel.ai.error","vercel.ai.error.AI_APICallError"]){let j=Symbol.for(U);if(t($,j)===!0)Object.defineProperty(G,j,{value:!0})}return G}function XQ($,Z){if(!$.includes("error")&&(!$.includes("\\u00")||!sz.test($)&&!iz.test($)))return $;let X;try{X=JSON.parse($)}catch{return $}if(X?.type==="error"||X?.error||X?.response?.error)return _7($,Z);return $}var JQ=Q$(Response.prototype,"status"),GQ=Q$(Response.prototype,"statusText"),zQ=Q$(Response.prototype,"headers"),QQ=Q$(Response.prototype,"body"),BQ=Response.prototype.text,F7=Headers.prototype.entries;async function O7($,Z,X="http"){try{let K=function(V){let N=j&&V.startsWith("\uFEFF")?"\uFEFF":"";return j=!1,N+V.slice(N.length).replace(/^data: ?([^\r\n]*)/gm,(q,M)=>q.slice(0,q.length-M.length)+XQ(M,Z))};if(!JZ($))throw Error("Invalid provider response");let J=JQ.call($),G=zQ.call($),z=QQ.call($),Q=new Headers;for(let[V,N]of F7.call(G))Q.append(V,N);let B={status:J,statusText:U1(GQ.call($),Z),headers:Q};if(J<200||J>299){for(let[N,q]of F7.call(G)){if(U1(N,Z?.toLowerCase())!==N){B.headers.delete(N);continue}try{B.headers.set(N,U1(q,Z))}catch{B.headers.delete(N)}}B.headers.delete("content-length");let V=await BQ.call($);return new Response(D8(V,Z),B)}if(!z||X==="http")return $;B.headers.delete("content-length");let H=ReadableStream.prototype.getReader.call(z),Y=new TextDecoder("utf-8",{ignoreBOM:!0}),W=new TextEncoder,U="",j=!0;return new Response(new ReadableStream({async pull(V){try{for(;;){let N=await H.read();U+=Y.decode(N.value,{stream:!N.done});let q=!1;for(;;){let M=/\r?\n\r?\n/.exec(U);if(!M)break;let P=M.index+M[0].length;V.enqueue(W.encode(K(U.slice(0,P)))),U=U.slice(P),q=!0}if(N.done){if(U)V.enqueue(W.encode(K(U)));V.close();return}if(q)return}}catch(N){V.error(j1(N,Z))}},async cancel(V){try{await H.cancel(V)}catch(N){throw j1(N,Z)}finally{H.releaseLock()}}}),B)}catch(J){throw j1(J,Z)}}var C7={name:"@cortexkit/pi-openai-auth",version:"1.0.4",license:"MIT",type:"module",repository:{type:"git",url:"git+https://github.com/cortexkit/openai-auth.git",directory:"packages/pi"},main:"./dist/index.js",types:"./dist/index.d.ts",exports:{".":{import:"./dist/index.js",types:"./dist/index.d.ts"}},files:["dist","README.md","LICENSE"],keywords:["pi-package"],pi:{extensions:["./dist/index.js"]},scripts:{build:"rm -rf dist && bun build src/index.ts --outdir dist --target node --format esm --external '@earendil-works/pi-ai' --external '@earendil-works/pi-ai/*' --external '@earendil-works/pi-coding-agent' --external '@earendil-works/pi-coding-agent/*' --external '@earendil-works/pi-tui' --external '@earendil-works/pi-tui/*' --external @cortexkit/private-files --external @cortexkit/claustrum-client --external @cortexkit/subc-client --minify && bun run build:types","build:types":"cd ../core && bun run build && cd ../pi && tsdown --config tsdown.config.ts --config-loader native",test:"bun test src/tests",typecheck:"tsc",types:"tsc",prepublishOnly:"bun run build"},devDependencies:{"@cortexkit/common-auth":"^0.17.0","@cortexkit/openai-auth-core":"workspace:*"},dependencies:{"@cortexkit/claustrum-client":"^0.9.0","@cortexkit/private-files":"^0.2.1","@cortexkit/subc-client":"^0.16.0"},peerDependencies:{"@earendil-works/pi-ai":">=1.0.1","@earendil-works/pi-coding-agent":">=1.0.1","@earendil-works/pi-tui":">=1.0.1"}};var GZ=new Map;function P7($){return GZ.get($)?.accountId}function T7($){return GZ.delete($)}function S7($){return W7(GZ,$,(Z,X)=>GZ.set(Z,X))}import{join as h7}from"node:path";import{createHash as KQ}from"node:crypto";import{constants as I7}from"node:fs";import{lstat as f7,mkdir as b7,open as g7,unlink as qQ}from"node:fs/promises";import{dirname as B$,resolve as x7}from"node:path";import{setTimeout as NQ}from"node:timers/promises";import{rmdirSync as YQ,statSync as WQ}from"node:fs";import{mkdir as VQ,rmdir as UQ,stat as QZ,utimes as R7}from"node:fs/promises";var jQ=30000,zZ=1e4,DQ=3000,K8,w$=new Map;process.once("exit",()=>{for(let[$,Z]of w$)try{if(Z.renewedAt+zZ<Date.now())continue;let X=WQ($);if(q8(X,Z)&&X.mtime.getTime()===Z.mtime)YQ($)}catch{}});function q8($,Z){return $.dev===Z.dev&&$.ino===Z.ino}function p$($){return typeof $==="object"&&$!==null&&"code"in $?$.code:void 0}function A7(){return Object.assign(Error("Pi auth lock held"),{code:"ELOCKED"})}async function N8($){try{await UQ($)}catch(Z){if(p$(Z)!=="ENOENT")throw Z}}async function M8($,Z){try{await VQ($)}catch(X){if(p$(X)!=="EEXIST")throw X;if(Z<=0)throw A7();let J;try{J=(await QZ($)).mtime.getTime()}catch(G){if(p$(G)==="ENOENT")return M8($,0);throw G}if(!(J<Date.now()-Z))throw A7();return await N8($),M8($,0)}try{if(!K8){let G=new Date(Math.ceil(Date.now()/1000)*1000+5);await R7($,G,G)}let X=await QZ($),J=X.mtime.getTime();return K8??=J%1000===0?"s":"ms",{dev:X.dev,ino:X.ino,mtime:J}}catch(X){throw await N8($).catch(()=>{}),X}}async function E7($,Z,X){let J=`${$}.lock`,G=await M8(J,jQ),z=G.mtime,Q=Date.now(),B=!1,H;w$.set(J,{...G,renewedAt:Q});function Y(){if(B=!0,H)clearTimeout(H);w$.delete(J),Z()}function W(){if(!B&&Q+zZ<Date.now())Y()}function U(V=DQ){if(B)return;H=setTimeout(()=>{K()},V),H.unref()}function j(V){if(B)return;if(p$(V)==="ENOENT"||Q+zZ<Date.now())Y();else U(1000)}async function K(){if(W(),B)return;let V;try{V=await QZ(J)}catch(q){j(q);return}if(W(),B)return;if(!q8(V,G)||V.mtime.getTime()!==z){Y();return}let N=new Date(K8==="s"?Math.ceil(Date.now()/1000)*1000:Date.now());try{await R7(J,N,N)}catch(q){j(q);return}if(B)return;z=N.getTime(),Q=Date.now(),w$.set(J,{...G,mtime:z,renewedAt:Q}),U()}return X?.(async()=>{if(H)clearTimeout(H);await K()}),U(),{assertFresh:W,async release(){if(B)return;if(B=!0,H)clearTimeout(H);w$.delete(J);let V=()=>Q+zZ<Date.now();if(V()){Y();return}let N;try{N=await QZ(J)}catch(q){if(p$(q)!=="ENOENT")throw q;Y();return}if(V()||!q8(N,G)||z!==N.mtime.getTime()){Y();return}await N8(J)}}}class s extends Error{code;constructor($){super(`Pi slot: ${$}`);this.code=$,this.name="PiSlotError"}}function MQ($){let Z=$.indexOf("{")+1,X={offset:Z-1,children:[]},J=()=>{while(/\s/.test($[Z]??"")&&Z<$.length)Z++},G=()=>{Z++;while(Z<$.length){if($[Z++]==='"')return;if($[Z-1]==="\\")Z++}};J();while($[Z]!=="}"){let z=Z;G();let Q=JSON.parse($.slice(z,Z));J(),Z++,J();let B=Z,H=0;while(Z<$.length){let W=$[Z];if(W==='"'){G();continue}if(W==="{"||W==="[")H++;if(W==="}"||W==="]"){if(H===0)break;H--}if(W===","&&H===0)break;Z++}let Y=Z;while(/\s/.test($[Y-1]??""))Y--;if(X.children.push({key:Q,offset:z,length:Y-z,value:{offset:B,length:Y-B}}),J(),$[Z]==="}")break;Z++,J()}return X}function l$($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function L8($){if(Array.isArray($))return`[${$.map(L8).join(",")}]`;if(l$($))return`{${Object.keys($).sort().map((Z)=>`${JSON.stringify(Z)}:${L8($[Z])}`).join(",")}}`;return JSON.stringify($)}function y0($){return KQ("sha256").update(L8($)).digest("hex")}function u$($){return l$($)?$.code:void 0}async function k7($,Z=!1,X){if(R)try{await X?.($);let G=await SZ($,!0),z=G.toString("utf8");if(!G.equals(Buffer.from(z)))throw new s(Z?"invalid-stash":"invalid-auth");return z}catch(G){if(u$(G)==="ENOENT")return;throw G}let J;try{J=await g7($,I7.O_RDONLY|I7.O_NOFOLLOW);let G=await J.stat();if(!G.isFile()||Z&&(G.mode&511)!==384)throw new s("unsafe-path");await X?.($);let z=await f7($);if(!z.isFile()||z.dev!==G.dev||z.ino!==G.ino)throw new s("unsafe-path");let Q=await J.readFile(),B=Q.toString("utf8");if(!Q.equals(Buffer.from(B)))throw new s(Z?"invalid-stash":"invalid-auth");return B}catch(G){if(u$(G)==="ENOENT"&&!J)return;if(u$(G)==="ELOOP"||u$(G)==="ENOENT")throw new s("unsafe-path");throw G}finally{await J?.close()}}function FQ($,Z){try{let X=JSON.parse($);if(!l$(X))throw Error();let J=MQ($),G=J.children,z=G.map((H)=>H.key);if(new Set(z).size!==z.length)throw Error();let Q=G.find((H)=>H.key===Z),B=Q?X[Z]:null;if(B!==null&&!l$(B))throw Error();if(Q&&B===null)throw Error();return{text:$,root:J,property:Q,entry:B}}catch{throw new s("invalid-auth")}}function LQ($){let Z=$.property?.value;return Z?$.text.slice(Z.offset,Z.offset+Z.length):null}function y7($,Z,X){let{text:J,root:G,property:z}=$,Q=G.children??[];if(z){let Y=z.value;if(!Y)throw new s("invalid-auth");if(X!==null)return J.slice(0,Y.offset)+X+J.slice(Y.offset+Y.length);let W=Q.indexOf(z),U=Q[W-1],j=Q[W+1],K=U?U.offset+U.length:z.offset,V=!U&&j?j.offset:z.offset+z.length;return J.slice(0,K)+J.slice(V)}if(X===null)return J;let B=Q.at(-1),H=B?B.offset+B.length:G.offset+1;return`${J.slice(0,H)}${B?",":""}${JSON.stringify(Z)}:${X}${J.slice(H)}`}async function _Q($){if(R)return;let Z=await g7($,"r");try{await Z.sync()}finally{await Z.close()}}async function F8($,Z,X,J){await L0($,null,{serialize:()=>Z,durable:!0,durability:R?"file-only-on-windows":void 0,beforeRename:async()=>{await J?.($),X()}})}function _8($){return OQ($)}function OQ($,Z,X){let{provider:J,placeholderKey:G}=$,z=$.lockTimeoutMs??30000;if(!J||!$.authPath||!$.stashPath||!G||G.startsWith("!")||G.includes("$")||!Number.isFinite(z)||z<0)throw new s("invalid-options");let Q=x7($.authPath),B=x7($.stashPath);if(Q===B||B===`${Q}.lock`)throw new s("invalid-options");let H=y0(Q),Y=y0(G),W={type:"api_key",key:G},U=(q)=>y0(q)===y0(W);async function j(){let q=await k7(B,!0,X?.afterReadCheck);if(q===void 0)return;try{let M=JSON.parse(q);if(M.version!==1||M.provider!==J||M.authIdentity!==H||M.placeholderIdentity!==Y||M.entry!==null&&!l$(M.entry)||M.sha256!==y0(M.entry)||(M.entry===null?M.entryJson!==null:typeof M.entryJson!=="string"||y0(JSON.parse(M.entryJson))!==M.sha256))throw Error();return M}catch{throw new s("invalid-stash")}}async function K(q){let M,P,E=!1,F=()=>{if(P?.(),E)throw new s("lock-compromised")};try{if(R)await q0(B$(Q));else await b7(B$(Q),{recursive:!0,mode:448});let D=Date.now()+z,L=0;while(!M)try{let v=await E7(Q,()=>{E=!0},X?.onRenew);M=v.release,P=v.assertFresh}catch(v){if(u$(v)!=="ELOCKED")throw v;let u=D-Date.now();if(u<=0)throw new s("lock-timeout");await NQ(Math.min(Math.round(Math.min(10*2**L++,1000)*(1+Math.random())),u))}F();let S=await q(F);return F(),S}catch(D){if(D instanceof s||D instanceof l)throw D;throw new s("io")}finally{await M?.().catch(()=>{}),F()}}async function V(){let q=FQ(await k7(Q,!1,X?.afterReadCheck)??"{}",J),M=await j();return{auth:q,stash:M}}async function N(q){q(),await qQ(B),await _Q(B$(B)),Z?.("stash-deleted")}return{inspect:()=>K(async()=>{let{auth:q,stash:M}=await V();return{slot:U(q.entry)?"placeholder":q.entry===null?"empty":!M||y0(q.entry)===M.sha256?"original":"foreign",stash:M?"valid":"missing"}}),enterVault:()=>K(async(q)=>{let{auth:M,stash:P}=await V();if(U(M.entry)){if(!P)throw new s("missing-stash");return}if(P&&y0(M.entry)!==P.sha256)throw new s("conflict");if(!P){if(R)await q0(B$(B));else{await b7(B$(B),{recursive:!0,mode:448});let F=await f7(B$(B));if(!F.isDirectory()||(F.mode&511)!==448)throw new s("unsafe-path")}let E={version:1,provider:J,authIdentity:H,placeholderIdentity:Y,entry:M.entry,entryJson:LQ(M),sha256:y0(M.entry)};await F8(B,JSON.stringify(E),q,X?.beforeRename),Z?.("stash-written")}await F8(Q,y7(M,J,JSON.stringify(W)),q,X?.beforeRename),Z?.("auth-written")}),exitVault:()=>K(async(q)=>{let{auth:M,stash:P}=await V();if(!P){if(U(M.entry))throw new s("missing-stash");return"nothing-to-do"}if(U(M.entry))await F8(Q,y7(M,J,P.entryJson),q,X?.beforeRename),Z?.("auth-written");else if(y0(M.entry)!==P.sha256)return"conflict";return await N(q),"restored"})}}import{getAgentDir as CQ}from"@earendil-works/pi-coding-agent";var d$="openai-auth-vault-mode-not-a-credential",v7="Request refused locally: Pi has not loaded the credential vault placeholder. Reopen the session or disconnect Pi from the vault in /openai; local credentials are not used while connected.",m7="A Pi login was added while connected to the vault. Both that login and the stashed original are kept; neither was overwritten.";function w7($){return _8({authPath:h7(CQ(),"auth.json"),provider:"openai-codex",stashPath:h7(t6($),"pi-openai-codex-login.json"),placeholderKey:d$})}function PQ($){return{id:"pi-login",title:"Pi login",build:()=>{let Z=$(),X=Date.now(),J=c({limits:["primary","secondary"].flatMap((z)=>{let Q=Z?.[z];return Q?[{...Q,kind:"reading",scope:"all",label:z,checkedAt:Q.checkedAt??X}]:[]}),...Z?.spendControl?{budget:{...Z.spendControl,kind:"reading",checkedAt:X}}:{}}),G=k1(J,{now:X});return{lines:["Managed by Pi /login",...G.length>0?G:[P0(J,{now:X})]]}}}}function TQ($,Z={}){let X=Z.beginAccountLogin??E4,J=Z.packageVersion??C7.version,G=W8({vault:$.vault,changed:Z.afterApply,...Z.vaultWait?{wait:Z.vaultWait}:{}}),z=V8({store:$.store(),vault:$.vault,login:{begin:(Q)=>X({...Q,version:J}),mainIdentity:async()=>$.mainIdentity()},quotaCheck:async(Q)=>{if(Q.length===1){let H=$.store();for(let Y of Q)await H.requestReading(Y);await H.pullsSettled();return}let B=(await $.refreshAllQuota()).filter((H)=>!H.ok);if(B.length>0)throw new W0("quota-check-failed",B.map((H)=>`${H.account}: ${H.error??"quota check failed"}`).join(`
-`))},extras:[PQ(()=>$.mainQuota()),Y8({getPin:async(Q)=>P7(Q),clearPin:async(Q)=>T7(Q)}),{...G,build:async(Q)=>{let B=await G.build(Q),H={id:"disconnect",label:"Disconnect",confirm:"Disconnect this Pi host from the vault and restore its original login?",run:async()=>{let W;try{W=await $.disconnectVault?.()}catch{let U=!1;try{await Z.afterApply?.()}catch{U=!0}let j=await $.readAuthority();throw new W0("vault-disconnect-failed",[j==="local"?"Disconnect did not finish cleanly; local accounts are active. Retry Disconnect if Pi login restoration did not complete.":"Disconnect failed; Pi is still enrolled or enrollment is unreadable. Local accounts remain disabled; retry Disconnect to restore the login.",...U?["Pi could not reload its auth snapshot; reopen the session."]:[]].join(`
-`))}return await Z.afterApply?.(),[`Disconnected: ${$.vault.name} no longer reads from the vault. Run \`ck auth enroll revoke --name ${$.vault.name}\` to revoke it in the vault too.`,...W==="conflict"?[m7]:[]].join(`
-`)}},Y=B.actions??[];return{...B,actions:[...Y.map((W)=>W.id==="disconnect"&&$.disconnectVault?{...W,run:H.run}:W),...$.vaultMode()&&$.disconnectVault&&!Y.some((W)=>W.id==="disconnect")?[H]:[]]}}}],afterApply:async()=>{return await Z.afterApply?.(),$.reload()}});return{command:z.command,open:async(Q)=>{return await $.readAuthority(),z.open(Q)},apply:async(Q,B)=>{return await $.readAuthority(),z.apply(Q,B)}}}async function SQ($,Z){let X=Z.pool;if(!X){$.ui.notify("The OpenAI account pool is not available.","error");return}if(Z.onContext?.($),Z.afterApply)await Z.afterApply();else await X.syncVaultSlot?.(()=>$.modelRegistry.refresh(),!0);if(!X.vaultMode())try{await X.observeLogin(await $.modelRegistry?.getApiKeyForProvider("openai-codex"))}catch{}await Q3(TQ(X,Z),$.ui,{sessionId:$.sessionManager.getSessionId()})}function p7($,Z={}){$.registerCommand(V1,{description:"OpenAI accounts: add and manage accounts, quota, routing and limits",handler:(X,J)=>SQ(J,Z)})}import{connect as AQ}from"node:net";import{connect as RQ}from"node:tls";var EQ="258EAFA5-E914-47DA-95CA-C5AB0DC85B11",u7=["chatgpt-account-id","authorization","user-agent","originator","openai-beta","version","x-codex-beta-features","x-codex-turn-metadata","x-client-request-id","session-id","thread-id","x-codex-window-id"];class O8{url;readyState=0;socket;listeners={open:new Set,message:new Set,error:new Set,close:new Set};rxBuffer=new Uint8Array(0);handshakeDone=!1;expectedAccept="";fragOpcode=0;fragChunks=[];constructor($,Z){this.url=$,this.connect($,Z)}addEventListener($,Z,X){this.listeners[$]?.add(Z)}removeEventListener($,Z){this.listeners[$]?.delete(Z)}emit($,Z){for(let X of[...this.listeners[$]??[]])try{X(Z)}catch{}}async connect($,Z){let X=new URL($.replace(/^ws:/,"http:").replace(/^wss:/,"https:")),J=X.hostname,G=X.port?Number(X.port):X.protocol==="https:"?443:80,z=`${X.pathname}${X.search}`,Q=crypto.getRandomValues(new Uint8Array(16)),B=Buffer.from(Q).toString("base64"),H=await crypto.subtle.digest("SHA-1",new TextEncoder().encode(B+EQ));this.expectedAccept=Buffer.from(new Uint8Array(H)).toString("base64");let Y={};for(let[j,K]of Object.entries(Z))Y[j.toLowerCase()]=K;let W=[`GET ${z} HTTP/1.1`,`Host: ${J}`,"Connection: Upgrade","Upgrade: websocket","Sec-WebSocket-Version: 13",`Sec-WebSocket-Key: ${B}`];for(let j of u7)if(Y[j]!==void 0)W.push(`${IQ(j)}: ${Y[j]}`);for(let[j,K]of Object.entries(Z))if(!u7.includes(j.toLowerCase())&&j.toLowerCase()!=="content-length")W.push(`${j}: ${K}`);let U=`${W.join(`\r
+The account is added when you finish.`,Q=z.completion.then(async(Y)=>{if(Z&&await Z.authority()!=="local")throw new B0("vault-local-action",v$);let H=await $.mainIdentity?.();if(Y.id===I1||Y.accountId&&H&&Y.accountId===H)throw m$.warn("account add rejected (main identity)",{id:Y.id}),new B0("main-account",q7);return m$.info("account added",{id:Y.id}),C7(Y)});return{status:"pending",message:B,completion:Q}}}}function q8($){return{id:"session",title:"This session",build:async(Z)=>{let X=Z.sessionId;if(!X)return{lines:["No current session"]};let J=await $.getPin?.(X);return{lines:[J?`Pinned to ${J}`:"No sticky pin"],actions:$.clearPin?[{id:"clear-pin",label:"Clear this session's pin",description:"The next request may still choose the same account.",run:async({invocation:G})=>{if(!G.sessionId)return"No current session.";return await $.clearPin?.(G.sessionId),m$.info("routing session pin cleared"),"This session's pin was cleared. The next request may choose the same account if it remains the best selection."}}]:[]}}}}function N8($){let{vault:Z}=$;return{id:"vault",title:"Vault",build:async()=>{let X=await Z.status(),J=await Z.authority()!=="local",G=Z.routes().length;return{lines:[J?`Connected · ${X.accounts.length} account${X.accounts.length===1?"":"s"}`:X.enrollment.state==="idle"?"Not connected":`Enrollment ${X.enrollment.state}`,t2(X.host,X.name,X.enrollment),...XZ(X.name,X.enrollment),...J?[X.accounts.length===0?e6:`The vault serves ${X.accounts.length} OpenAI account${X.accounts.length===1?"":"s"}; ${G} can route now.`]:[],...J&&Z.snapshot()?.complete===!1?["The vault's last list had records this host could not read; accounts it did not list are kept as they were until a complete list arrives."]:[],...X.lastError?[`Last error: ${X.lastError}`]:[]],items:X.accounts.map((z)=>({id:z.routeId,label:W1(z),group:"Accounts",status:z.enabled?z.state:"disabled",detail:[z.credentialType==="api_key"?"API key":"login",z.state==="active"?"active":`vault state ${z.state}`,z.enabled?"enabled":"disabled here"].join(", "),actions:[z.enabled?{id:"disable",label:"Disable on this host",description:"It stays in the vault and in this list, and is never sent from this host until enabled again.",run:async()=>{return await Z.decline(z.routeId),await $.changed?.(),`${W1(z)} is disabled on this host.`}}:{id:"enable",label:"Enable on this host",run:async()=>{return await Z.accept(z.routeId),await $.changed?.(),`${W1(z)} is enabled on this host.`}}]})),actions:J?[{id:"disconnect",label:"Disconnect",description:"Forgets this host's vault token; its vault accounts stop routing at once. Revoke the enrollment itself with `ck auth enroll revoke`.",confirm:"Disconnect from the vault? Connecting again needs a new approval with `ck`.",run:async()=>{return await Z.disconnect(),await $.changed?.(),`Disconnected: ${Z.name} no longer reads from the vault. Run \`ck auth enroll revoke --name ${Z.name}\` to revoke it in the vault too.`}}]:[{id:"connect",label:"Connect",description:"Asks the vault to enroll this host; you approve the request with `ck`.",run:async({invocation:z})=>{let B=await Z.connectStep();if(B.state!=="pending"&&B.state!=="busy")return await $.changed?.(),G8(Z,B);return Z.waitForApproval($.wait).then(async(Q)=>{await $.changed?.();let Y=G8(Z,Q);z.notify(Y.text,Y.ok?"info":"warning")}).catch((Q)=>{z.notify(`Connecting to the vault failed: ${Q instanceof Error?Q.message:String(Q)}`,"error")}),{ok:!0,text:[...XZ(Z.name,B),"Waiting for the approval; you are told here when it lands."].join(`
+`)}}}]}}}}var T7=[{value:"main-first",label:"Main first"},{value:"fallback-first",label:"Fallback first"}],A7=["primary","secondary"];function M8($){let Z=new Set($.unavailableSections),X=(Y)=>({title:Y,build:async()=>({lines:["Not available on OpenCode 2 yet."]})}),J=[...$.extras??[]];if(Z.has("reset")){let Y={id:"reset",...X("Reset credits")},H=J.findIndex((W)=>W.id==="reset");if(H<0)J.unshift(Y);else J[H]=Y}let G={command:V1,title:K8,store:W8(L7(_7($.store,{...$.rowLocks?{rowLocks:$.rowLocks}:{}}))),...$.extraLocks?{extraLocks:$.extraLocks}:{},accounts:{...$.login?{login:P7($.login,$.vault)}:{},...$.protect?{protect:$.protect}:{},...$.describeIdentity?{describeIdentity:$.describeIdentity}:{}},quota:$.quotaCheck?{check:$.quotaCheck}:{},routing:{orderedVariants:T7,formerMainId:I1},limits:{labels:A7},...Z.has("cache")?{cache:X("Cache")}:$.cache?{cache:$.cache}:{},...Z.has("diagnostics")?{diagnostics:X("Diagnostics")}:$.diagnostics?{diagnostics:$.diagnostics}:{},extras:J,...$.logger?{logger:$.logger}:{},...$.now?{now:$.now}:{}},z=$.vault?V8(G,$.vault,{refresh:!$.readOnly,...$.readOnly?{refuseApply:{code:"unavailable",text:"Not available on OpenCode 2 yet."}}:{}}):_1(G),B=$.vault?V8(G,$.vault,{refresh:!1,refuseApply:{code:"unavailable",text:"Not available on OpenCode 2 yet."}}):void 0,Q=(Y)=>{let{sessionId:H}=Y,W=Y.notify.bind(Y);return{...H!==void 0?{sessionId:H}:{},notify:W}};return{command:V1,async open(Y){let H=Q(Y),W=$.vault&&await $.vault.authority()!=="local"?void 0:await $.migration?.();if(W&&!W.migrated)return{command:V1,menu:j8(W.blockers)};let V=await z.open(H);return{...V,menu:D8(V.menu)}},async apply(Y,H){let W=Q(H),V=$.vault&&await $.vault.authority()!=="local"?void 0:await $.migration?.();if(V&&!V.migrated)return{command:V1,ok:!1,text:"Nothing was changed: the accounts have not moved to the new layout yet.",menu:j8(V.blockers)};if($.readOnly&&$.vault)return z.apply(Y,W);if($.readOnly||$.allowAction&&!$.allowAction(Y)||Z.has(Y.sectionId)){if(B)return B.apply(Y,W);return{...await z.open(W),ok:!1,code:"unavailable",text:"Not available on OpenCode 2 yet."}}let j=await z.apply(Y,W);if(j.ok)await $.afterApply?.();return{...j,menu:D8(j.menu)}}}}function S7($,Z,X){let J=$.get(Z.sessionId),G=new Set(Z.validPinnedAccountIds);if(J&&!Z.excludeAccountIds.includes(J.accountId)&&W$(J,G,Z.wireAccountIdByAccount[J.accountId])){if(Z.persist){let Y=Z.quotaCheckedAtByAccount[J.accountId];X(Z.sessionId,{accountId:J.accountId,inputBytes:Z.requestBytes,...J.wireIdentity!==void 0?{wireIdentity:J.wireIdentity}:{},...Y!==void 0?{quotaCheckedAt:Y}:{}})}return{accountId:J.accountId}}let z=new Map(Object.entries(Z.quotaCheckedAtByAccount)),B=OZ($,z,Z.sessionId),Q=Z.select(B);if(!Q)return;if(Z.persist){let Y=Z.wireAccountIdByAccount[Q.accountId];X(Z.sessionId,{accountId:Q.accountId,inputBytes:Z.requestBytes,...Y!==void 0?{wireIdentity:Y}:{},...Q.quotaCheckedAt!==void 0?{quotaCheckedAt:Q.quotaCheckedAt}:{}})}return{accountId:Q.accountId}}import{statSync as iz}from"node:fs";var R7=30000,az=8,nz=1800000;function E7($){return $.identity?`identity:${$.identity}`:`row:${$.id}`}function F8($){try{let Z=iz($);return`${Z.ino}:${Z.size}:${Z.mtimeMs}`}catch{return"-"}}function b1($){let Z=$.credential;if(Z?.type!=="oauth")return;return{access:Z.access??"",expires:Z.expires,refresh:Z.refresh}}function L8($,Z){try{return E0($,Z)}catch{return $}}function I7($,Z,X){let J=E7(Z);$.set(J,[...$.get(J)??[],{credentialEpoch:Z.credentialEpoch,identity:Z.identity,observation:X}].slice(-az))}function b7($,Z,X){let J=$;for(let G of Z.get(E7($))??[]){if(!(X-G.observation.checkedAt<=nz)||G.credentialEpoch!==$.credentialEpoch||G.identity!==$.identity)continue;J={...J,quota:L8(J.quota,G.observation)}}return J}function x7($,Z,X,J){let G=a1($);if(typeof Z?.status==="number"||V3(Z)){let B=I6({error:Z,now:X,refreshToken:$,...J?{previous:{message:"",checkedAt:X,nextRetryAt:J.nextRetryAt,retryCount:J.retryCount,tokenHash:J.tokenHash}}:{}});return{nextRetryAt:B.nextRetryAt,tokenHash:G,retryCount:B.retryCount}}return{nextRetryAt:X+R7,tokenHash:G,retryCount:J?.tokenHash===G?J.retryCount:0}}function k7($,Z,X,J){let G=new Map;for(let z of $){if(J(z,X))continue;let B=Z.get(z.id);G.set(z.id,B&&B.nextRetryAt>X?B.nextRetryAt:X+R7)}return G}var XK=a("quota");import{types as rz}from"node:util";var oz=/"(?:e|\\u0065)(?:r|\\u0072){2}(?:o|\\u006f)(?:r|\\u0072)"\s*:/i,tz=/"(?:t|\\u0074)(?:y|\\u0079)(?:p|\\u0070)(?:e|\\u0065)"\s*:\s*"(?:e|\\u0065)(?:r|\\u0072){2}(?:o|\\u006f)(?:r|\\u0072)"/i;function h7($){return $.replace(/\\(?:u([a-f\d]{4})|(["\\/bfnrt]))/gi,(Z,X,J)=>{if(X)return String.fromCharCode(Number.parseInt(X,16));return{b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t"}[J]??J??Z})}function ez($,Z){if(!Z)return $;let X=$.split(Z).join("[credential]"),J=Z.replace(/\s/g,"");if(!J)return X;let G=X.replace(/\s/g,"");if(!G.includes(J))return X;let z=[];for(let Y=0;Y<X.length;Y++){let H=X[Y]??"";if(!/\s/.test(H))z.push(Y)}let B=[],Q=0;for(let Y=G.indexOf(J);Y>=0;Y=G.indexOf(J,Y+J.length)){let H=z[Y]??Q,W=(z[Y+J.length-1]??H)+1;B.push(X.slice(Q,H),"[credential]"),Q=W}return B.length?B.join("")+X.slice(Q):X}function y7($,Z){let X=ez($,Z);return E4(X).replaceAll("***REDACTED***","[credential]")}function U1($,Z){let X=y7($,Z),J=h7(X),G=y7(J,Z);return G===J?X:G}function f7($){let Z=/^(-?)(0|[1-9]\d*)(?:\.(\d+))?(?:[eE]([+-]?\d+))?$/.exec($);if(!Z)return;let X=Z[3]??"",J=(Z[2]??"")+X,G=0;while(J[G]==="0")G++;if(G===J.length)return"0";let z=J.length;while(J[z-1]==="0")z--;let B=Z[4]??"0",Q=B.startsWith("-")||B.startsWith("+")?1:0;while(B[Q]==="0")Q++;let Y=B.slice(Q)||"0";if(Y.length>16)return;let H=BigInt((B.startsWith("-")?"-":"")+Y)-BigInt(X.length)+BigInt(J.length-z);return`${Z[1]}${J.slice(G,z)}e${H}`}function v7($,Z){let X=Z?f7(Z):void 0;return $.replace(/"(?:\\.|[^"\\])*"|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null/g,(J)=>{if(!J.startsWith('"'))return Z&&(J===Z||X!==void 0&&f7(J)===X||(Z==="Infinity"||Z==="-Infinity")&&/^[-\d]/.test(J)&&String(Number(J))===Z)?'"[credential]"':J;let G=h7(J.slice(1,-1)),z=U1(G,Z);return z===G?J:JSON.stringify(z)})}function _8($,Z){let X=v7($,Z);try{return JSON.parse($),X}catch{return U1(X,Z)}}var $B=16384,ZB=65536,XB=[/429|500|502|503|504|524/i,/rate increased too quickly|rate limit|rate-limit|rate_limit|too many requests/i,/overloaded|service unavailable|service_unavailable|service-unavailable|internal error|internal_error|internal server error|server error|server_error|server-error|provider returned error|provider_returned_error|provider-returned-error/i,/terminated|fetch failed|failed to fetch|network[-_\s]error|upstream connect|connection error|connection refused|connection lost|socket connection was closed|socket hang up|reset before headers|getaddrinfo|enotfound|eai_again|econnrefused|econnreset|etimedout/i,/^timeout$|\b(?:request|response|connection|network|stream|read) (?:timeout|timed out|time out)\b/i,/try your request again|retry your request|resource exhausted|resource_exhausted/i,/\btry again (?:later|in\b)|\b(?:currently|temporarily) at capacity\b/i];function JB($){try{let Z=t(JSON.parse($),"request_id");if(typeof Z==="string")return Z;if(typeof Z!=="number")return;let X=0,J,G=!0,z=!1,B;for(let Q of $.matchAll(/"(?:\\.|[^"\\])*"|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?|[{}[\]:,]/g)){let Y=Q[0];if(Y==="{"||Y==="["){X++;continue}if(Y==="}"||Y==="]"){X--;continue}if(X!==1)continue;if(Y===","){G=!0,z=!1,J=void 0;continue}if(Y===":"){z=!0;continue}if(G&&Y.startsWith('"')){J=JSON.parse(Y),G=!1;continue}if(z&&J==="request_id"&&!Y.startsWith('"'))B=Y;z=!1}return B}catch{return}}function GB($,Z){let X=_8($,Z);if(Buffer.byteLength(X,"utf8")<=ZB)return X;let J=XB.flatMap((z)=>z.exec(X)?.[0]??[]);for(let z of["FreeUsageLimitError","GoUsageLimitError"])if(X.includes(z))J.push(z);let G={retry:J};try{let z=JSON.parse(X);if(t(z,"type")==="error")G.type="error";let B=t(z,"error"),Q={};for(let H of["code","type"]){let W=t(B,H);if(typeof W==="string")Q[H]=W.slice(0,256)}if(Object.keys(Q).length)G.error=Q;let Y={};for(let H of["workspace","limitName"]){let W=t(t(z,"metadata"),H);if(typeof W==="string")Y[H]=W.slice(0,256)}if(Object.keys(Y).length)G.metadata=Y}catch{}return JSON.stringify(G)}function BZ($){if(!$||typeof $!=="object")return!1;let Z=$;for(let X=0;Z&&X<16;X++){if(rz.isProxy(Z))return!1;Z=Object.getPrototypeOf(Z)}return Z===null}function t($,Z){if(!BZ($))return;let X=Object.getOwnPropertyDescriptor($,Z);return X&&"value"in X?X.value:void 0}function w$($,Z){return U1($,Z).slice(0,$B)}function B$($,Z){let X=Object.getOwnPropertyDescriptor($,Z)?.get;if(!X)throw Error(`Missing native ${Z} accessor`);return X}var zB=B$(DOMException.prototype,"message"),BB=B$(DOMException.prototype,"name");function j1($,Z){let X=t($,"message"),J=t($,"name");if(BZ($)&&$ instanceof DOMException)try{X=zB.call($),J=BB.call($)}catch{}let G=Error(w$(typeof X==="string"?X:typeof $==="string"?$:"Provider request failed",Z));for(let V of Object.getOwnPropertyNames(G))if(V!=="message")Reflect.deleteProperty(G,V);Object.defineProperty(G,"name",{value:typeof J==="string"?w$(J,Z):"Error",configurable:!0,writable:!0});let z=(V,j,D)=>{let U=t(V,D);if(typeof U==="string"||typeof U==="number"&&Number.isFinite(U)||typeof U==="boolean")Object.defineProperty(j,D,{value:typeof U==="string"?w$(U,Z):U,enumerable:!0,configurable:!0,writable:!0})};for(let V of["status","statusCode","status_code","resets_at","resets_in_seconds"]){let j=t($,V);if(typeof j==="number"&&Number.isFinite(j))z($,G,V)}for(let V of["code","type","isRetryable"])z($,G,V);for(let V of["error","data"]){let j=t($,V),D=Object.create(null);for(let N of["type","code","message","resets_at","resets_in_seconds"])z(j,D,N);let U=t(j,"error");if(BZ(U)){let N=Object.create(null);for(let K of["type","code","message","resets_at","resets_in_seconds"])z(U,N,K);D.error=N}if(Object.keys(D).length)Object.defineProperty(G,V,{value:D,enumerable:!0})}let B=t($,"responseHeaders");if(B&&typeof B==="object"){let V={};for(let j of["retry-after-ms","retry-after"]){let D=t(B,j);if(typeof D==="string")V[j]=w$(D,Z)}Object.defineProperty(G,"responseHeaders",{value:V,enumerable:!0})}let Q=t($,"responseBody");if(typeof Q==="string")Object.defineProperty(G,"responseBody",{value:GB(Q,Z),enumerable:!0});let Y=t($,"request_id"),H=t(B,"x-request-id"),W=typeof Y==="string"?Y:typeof H==="string"?H:typeof Q==="string"?JB(_8(Q,Z)):void 0;if(typeof W==="string")Object.defineProperty(G,"request_id",{value:w$(W,Z),enumerable:!0});for(let V of["vercel.ai.error","vercel.ai.error.AI_APICallError"]){let j=Symbol.for(V);if(t($,j)===!0)Object.defineProperty(G,j,{value:!0})}return G}function QB($,Z){if(!$.includes("error")&&(!$.includes("\\u00")||!oz.test($)&&!tz.test($)))return $;let X;try{X=JSON.parse($)}catch{return $}if(X?.type==="error"||X?.error||X?.response?.error)return v7($,Z);return $}var YB=B$(Response.prototype,"status"),HB=B$(Response.prototype,"statusText"),WB=B$(Response.prototype,"headers"),VB=B$(Response.prototype,"body"),UB=Response.prototype.text,g7=Headers.prototype.entries;async function m7($,Z,X="http"){try{let D=function(U){let N=j&&U.startsWith("\uFEFF")?"\uFEFF":"";return j=!1,N+U.slice(N.length).replace(/^data: ?([^\r\n]*)/gm,(K,M)=>K.slice(0,K.length-M.length)+QB(M,Z))};if(!BZ($))throw Error("Invalid provider response");let J=YB.call($),G=WB.call($),z=VB.call($),B=new Headers;for(let[U,N]of g7.call(G))B.append(U,N);let Q={status:J,statusText:U1(HB.call($),Z),headers:B};if(J<200||J>299){for(let[N,K]of g7.call(G)){if(U1(N,Z?.toLowerCase())!==N){Q.headers.delete(N);continue}try{Q.headers.set(N,U1(K,Z))}catch{Q.headers.delete(N)}}Q.headers.delete("content-length");let U=await UB.call($);return new Response(_8(U,Z),Q)}if(!z||X==="http")return $;Q.headers.delete("content-length");let Y=ReadableStream.prototype.getReader.call(z),H=new TextDecoder("utf-8",{ignoreBOM:!0}),W=new TextEncoder,V="",j=!0;return new Response(new ReadableStream({async pull(U){try{for(;;){let N=await Y.read();V+=H.decode(N.value,{stream:!N.done});let K=!1;for(;;){let M=/\r?\n\r?\n/.exec(V);if(!M)break;let P=M.index+M[0].length;U.enqueue(W.encode(D(V.slice(0,P)))),V=V.slice(P),K=!0}if(N.done){if(V)U.enqueue(W.encode(D(V)));U.close();return}if(K)return}}catch(N){U.error(j1(N,Z))}},async cancel(U){try{await Y.cancel(U)}catch(N){throw j1(N,Z)}finally{Y.releaseLock()}}}),Q)}catch(J){throw j1(J,Z)}}var w7={name:"@cortexkit/pi-openai-auth",version:"1.1.0",license:"MIT",type:"module",repository:{type:"git",url:"git+https://github.com/cortexkit/openai-auth.git",directory:"packages/pi"},main:"./dist/index.js",types:"./dist/index.d.ts",exports:{".":{import:"./dist/index.js",types:"./dist/index.d.ts"}},files:["dist","README.md","LICENSE"],keywords:["pi-package"],pi:{extensions:["./dist/index.js"]},scripts:{build:"rm -rf dist && bun build src/index.ts --outdir dist --target node --format esm --external '@earendil-works/pi-ai' --external '@earendil-works/pi-ai/*' --external '@earendil-works/pi-coding-agent' --external '@earendil-works/pi-coding-agent/*' --external '@earendil-works/pi-tui' --external '@earendil-works/pi-tui/*' --external @cortexkit/private-files --external @cortexkit/claustrum-client --external @cortexkit/subc-client --minify && bun run build:types","build:types":"cd ../core && bun run build && cd ../pi && tsdown --config tsdown.config.ts --config-loader native",test:"bun test src/tests",typecheck:"tsc",types:"tsc",prepublishOnly:"bun run build"},devDependencies:{"@cortexkit/common-auth":"^0.18.0","@cortexkit/openai-auth-core":"workspace:*"},dependencies:{"@cortexkit/claustrum-client":"^0.9.0","@cortexkit/private-files":"^0.2.1","@cortexkit/subc-client":"^0.16.0"},peerDependencies:{"@earendil-works/pi-ai":">=1.0.1","@earendil-works/pi-coding-agent":">=1.0.1","@earendil-works/pi-tui":">=1.0.1"}};var QZ=new Map;function p7($){return QZ.get($)?.accountId}function u7($){return QZ.delete($)}function l7($){return S7(QZ,$,(Z,X)=>QZ.set(Z,X))}import{join as $5}from"node:path";import{createHash as _B}from"node:crypto";import{constants as i7}from"node:fs";import{lstat as t7,mkdir as a7,open as e7,unlink as OB}from"node:fs/promises";import{dirname as Q$,resolve as n7}from"node:path";import{setTimeout as CB}from"node:timers/promises";import{rmdirSync as DB,statSync as c7,utimesSync as KB}from"node:fs";import{mkdir as qB,rmdir as NB,stat as O8,utimes as MB}from"node:fs/promises";var FB=30000,YZ=1e4,LB=3000,C8,p$=new Map;process.once("exit",()=>{for(let[$,Z]of p$)try{if(Z.renewedAt+YZ<Date.now())continue;let X=c7($);if(P8(X,Z)&&X.mtime.getTime()===Z.mtime)DB($)}catch{}});function P8($,Z){return $.dev===Z.dev&&$.ino===Z.ino}function u$($){return typeof $==="object"&&$!==null&&"code"in $?$.code:void 0}function d7(){return Object.assign(Error("Pi auth lock held"),{code:"ELOCKED"})}async function T8($){try{await NB($)}catch(Z){if(u$(Z)!=="ENOENT")throw Z}}async function A8($,Z){try{await qB($)}catch(X){if(u$(X)!=="EEXIST")throw X;if(Z<=0)throw d7();let J;try{J=(await O8($)).mtime.getTime()}catch(G){if(u$(G)==="ENOENT")return A8($,0);throw G}if(!(J<Date.now()-Z))throw d7();return await T8($),A8($,0)}try{if(!C8){let G=new Date(Math.ceil(Date.now()/1000)*1000+5);await MB($,G,G)}let X=await O8($),J=X.mtime.getTime();return C8??=J%1000===0?"s":"ms",{dev:X.dev,ino:X.ino,mtime:J}}catch(X){throw await T8($).catch(()=>{}),X}}async function s7($,Z,X){let J=`${$}.lock`,G=await A8(J,FB),z=G.mtime,B=Date.now(),Q=!1,Y;p$.set(J,{...G,renewedAt:B});function H(){if(Q=!0,Y)clearTimeout(Y);p$.delete(J),Z()}function W(){if(!Q&&B+YZ<Date.now())H()}function V(U=LB){if(Q)return;Y=setTimeout(()=>{D()},U),Y.unref()}function j(U){if(Q)return;if(u$(U)==="ENOENT"||B+YZ<Date.now())H();else V(1000)}async function D(){if(W(),Q)return;let U;try{U=c7(J)}catch(K){j(K);return}if(W(),Q)return;if(!P8(U,G)||U.mtime.getTime()!==z){H();return}let N=new Date(C8==="s"?Math.ceil(Date.now()/1000)*1000:Date.now());try{KB(J,N,N)}catch(K){j(K);return}if(W(),Q)return;z=N.getTime(),B=Date.now(),p$.set(J,{...G,mtime:z,renewedAt:B}),V()}return X?.(async()=>{if(Y)clearTimeout(Y);await D()}),V(),{assertFresh:W,async release(){if(Q)return;if(Q=!0,Y)clearTimeout(Y);p$.delete(J);let U=()=>B+YZ<Date.now();if(U()){H();return}let N;try{N=await O8(J)}catch(K){if(u$(K)!=="ENOENT")throw K;H();return}if(U()||!P8(N,G)||z!==N.mtime.getTime()){H();return}await T8(J)}}}class i extends Error{code;constructor($){super(`Pi slot: ${$}`);this.code=$,this.name="PiSlotError"}}function PB($){let Z=$.indexOf("{")+1,X={offset:Z-1,children:[]},J=()=>{while(/\s/.test($[Z]??"")&&Z<$.length)Z++},G=()=>{Z++;while(Z<$.length){if($[Z++]==='"')return;if($[Z-1]==="\\")Z++}};J();while($[Z]!=="}"){let z=Z;G();let B=JSON.parse($.slice(z,Z));J(),Z++,J();let Q=Z,Y=0;while(Z<$.length){let W=$[Z];if(W==='"'){G();continue}if(W==="{"||W==="[")Y++;if(W==="}"||W==="]"){if(Y===0)break;Y--}if(W===","&&Y===0)break;Z++}let H=Z;while(/\s/.test($[H-1]??""))H--;if(X.children.push({key:B,offset:z,length:H-z,value:{offset:Q,length:H-Q}}),J(),$[Z]==="}")break;Z++,J()}return X}function d$($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function R8($){if(Array.isArray($))return`[${$.map(R8).join(",")}]`;if(d$($))return`{${Object.keys($).sort().map((Z)=>`${JSON.stringify(Z)}:${R8($[Z])}`).join(",")}}`;return JSON.stringify($)}function f0($){return _B("sha256").update(R8($)).digest("hex")}function l$($){return d$($)?$.code:void 0}async function r7($,Z=!1,X){if(I)try{await X?.($);let G=await EZ($,!0),z=G.toString("utf8");if(!G.equals(Buffer.from(z)))throw new i(Z?"invalid-stash":"invalid-auth");return z}catch(G){if(l$(G)==="ENOENT")return;throw G}let J;try{J=await e7($,i7.O_RDONLY|i7.O_NOFOLLOW);let G=await J.stat();if(!G.isFile()||Z&&(G.mode&511)!==384)throw new i("unsafe-path");await X?.($);let z=await t7($);if(!z.isFile()||z.dev!==G.dev||z.ino!==G.ino)throw new i("unsafe-path");let B=await J.readFile(),Q=B.toString("utf8");if(!B.equals(Buffer.from(Q)))throw new i(Z?"invalid-stash":"invalid-auth");return Q}catch(G){if(l$(G)==="ENOENT"&&!J)return;if(l$(G)==="ELOOP"||l$(G)==="ENOENT")throw new i("unsafe-path");throw G}finally{await J?.close()}}function TB($,Z){try{let X=JSON.parse($);if(!d$(X))throw Error();let J=PB($),G=J.children,z=G.map((Y)=>Y.key);if(new Set(z).size!==z.length)throw Error();let B=G.find((Y)=>Y.key===Z),Q=B?X[Z]:null;if(Q!==null&&!d$(Q))throw Error();if(B&&Q===null)throw Error();return{text:$,root:J,property:B,entry:Q}}catch{throw new i("invalid-auth")}}function AB($){let Z=$.property?.value;return Z?$.text.slice(Z.offset,Z.offset+Z.length):null}function o7($,Z,X){let{text:J,root:G,property:z}=$,B=G.children??[];if(z){let H=z.value;if(!H)throw new i("invalid-auth");if(X!==null)return J.slice(0,H.offset)+X+J.slice(H.offset+H.length);let W=B.indexOf(z),V=B[W-1],j=B[W+1],D=V?V.offset+V.length:z.offset,U=!V&&j?j.offset:z.offset+z.length;return J.slice(0,D)+J.slice(U)}if(X===null)return J;let Q=B.at(-1),Y=Q?Q.offset+Q.length:G.offset+1;return`${J.slice(0,Y)}${Q?",":""}${JSON.stringify(Z)}:${X}${J.slice(Y)}`}async function SB($){if(I)return;let Z=await e7($,"r");try{await Z.sync()}finally{await Z.close()}}async function S8($,Z,X,J){await F0($,null,{serialize:()=>Z,durable:!0,durability:I?"file-only-on-windows":void 0,beforeRename:async()=>{await J?.($),X()}})}function E8($){return RB($)}function RB($,Z,X){let{provider:J,placeholderKey:G}=$,z=$.lockTimeoutMs??30000;if(!J||!$.authPath||!$.stashPath||!G||G.startsWith("!")||G.includes("$")||!Number.isFinite(z)||z<0)throw new i("invalid-options");let B=n7($.authPath),Q=n7($.stashPath);if(B===Q||Q===`${B}.lock`)throw new i("invalid-options");let Y=f0(B),H=f0(G),W={type:"api_key",key:G},V=(K)=>f0(K)===f0(W);async function j(){let K=await r7(Q,!0,X?.afterReadCheck);if(K===void 0)return;try{let M=JSON.parse(K);if(M.version!==1||M.provider!==J||M.authIdentity!==Y||M.placeholderIdentity!==H||M.entry!==null&&!d$(M.entry)||M.sha256!==f0(M.entry)||(M.entry===null?M.entryJson!==null:typeof M.entryJson!=="string"||f0(JSON.parse(M.entryJson))!==M.sha256))throw Error();return M}catch{throw new i("invalid-stash")}}async function D(K){let M,P,E=!1,F=()=>{if(P?.(),E)throw new i("lock-compromised")};try{if(I)await K0(Q$(B));else await a7(Q$(B),{recursive:!0,mode:448});let q=Date.now()+z,L=0;while(!M)try{let A=await s7(B,()=>{E=!0},X?.onRenew);M=A.release,P=A.assertFresh}catch(A){if(l$(A)!=="ELOCKED")throw A;let x=q-Date.now();if(x<=0)throw new i("lock-timeout");await CB(Math.min(Math.round(Math.min(10*2**L++,1000)*(1+Math.random())),x))}F();let S=await K(F);return F(),S}catch(q){if(q instanceof i||q instanceof d)throw q;throw new i("io")}finally{await M?.().catch(()=>{}),F()}}async function U(){let K=TB(await r7(B,!1,X?.afterReadCheck)??"{}",J),M=await j();return{auth:K,stash:M}}async function N(K){K(),await OB(Q),await SB(Q$(Q)),Z?.("stash-deleted")}return{inspect:()=>D(async()=>{let{auth:K,stash:M}=await U();return{slot:V(K.entry)?"placeholder":K.entry===null?"empty":!M||f0(K.entry)===M.sha256?"original":"foreign",stash:M?"valid":"missing"}}),enterVault:()=>D(async(K)=>{let{auth:M,stash:P}=await U();if(V(M.entry)){if(!P)throw new i("missing-stash");return}if(P&&f0(M.entry)!==P.sha256)throw new i("conflict");if(!P){if(I)await K0(Q$(Q));else{await a7(Q$(Q),{recursive:!0,mode:448});let F=await t7(Q$(Q));if(!F.isDirectory()||(F.mode&511)!==448)throw new i("unsafe-path")}let E={version:1,provider:J,authIdentity:Y,placeholderIdentity:H,entry:M.entry,entryJson:AB(M),sha256:f0(M.entry)};await S8(Q,JSON.stringify(E),K,X?.beforeRename),Z?.("stash-written")}await S8(B,o7(M,J,JSON.stringify(W)),K,X?.beforeRename),Z?.("auth-written")}),exitVault:()=>D(async(K)=>{let{auth:M,stash:P}=await U();if(!P){if(V(M.entry))throw new i("missing-stash");return"nothing-to-do"}if(V(M.entry))await S8(B,o7(M,J,P.entryJson),K,X?.beforeRename),Z?.("auth-written");else if(f0(M.entry)!==P.sha256)return"conflict";return await N(K),"restored"})}}import{getAgentDir as EB}from"@earendil-works/pi-coding-agent";var c$="openai-auth-vault-mode-not-a-credential",Z5="Request refused locally: Pi has not loaded the credential vault placeholder. Reopen the session or disconnect Pi from the vault in /openai; local credentials are not used while connected.",X5="A Pi login was added while connected to the vault. Both that login and the stashed original are kept; neither was overwritten.";function J5($){return E8({authPath:$5(EB(),"auth.json"),provider:"openai-codex",stashPath:$5($Z($),"pi-openai-codex-login.json"),placeholderKey:c$})}function IB($){return{id:"pi-login",title:"Pi login",build:()=>{let Z=$(),X=Date.now(),J=s({limits:["primary","secondary"].flatMap((z)=>{let B=Z?.[z];return B?[{...B,kind:"reading",scope:"all",label:z,checkedAt:B.checkedAt??X}]:[]}),...Z?.spendControl?{budget:{...Z.spendControl,kind:"reading",checkedAt:X}}:{}}),G=y1(J,{now:X});return{lines:["Managed by Pi /login",...G.length>0?G:[C0(J,{now:X})]]}}}}function bB($,Z={}){let X=Z.beginAccountLogin??g4,J=Z.packageVersion??w7.version,G=N8({vault:$.vault,changed:Z.afterApply,...Z.vaultWait?{wait:Z.vaultWait}:{}}),z=M8({store:$.store(),vault:$.vault,login:{begin:(B)=>X({...B,version:J}),mainIdentity:async()=>$.mainIdentity()},quotaCheck:async(B)=>{if(B.length===1){let Y=$.store();for(let H of B)await Y.requestReading(H);await Y.pullsSettled();return}let Q=(await $.refreshAllQuota()).filter((Y)=>!Y.ok);if(Q.length>0)throw new B0("quota-check-failed",Q.map((Y)=>`${Y.account}: ${Y.error??"quota check failed"}`).join(`
+`))},extras:[IB(()=>$.mainQuota()),q8({getPin:async(B)=>p7(B),clearPin:async(B)=>u7(B)}),{...G,build:async(B)=>{let Q=await G.build(B),Y={id:"disconnect",label:"Disconnect",confirm:"Disconnect this Pi host from the vault and restore its original login?",run:async()=>{let W;try{W=await $.disconnectVault?.()}catch{let V=!1;try{await Z.afterApply?.()}catch{V=!0}let j=await $.readAuthority();throw new B0("vault-disconnect-failed",[j==="local"?"Disconnect did not finish cleanly; local accounts are active. Retry Disconnect if Pi login restoration did not complete.":"Disconnect failed; Pi is still enrolled or enrollment is unreadable. Local accounts remain disabled; retry Disconnect to restore the login.",...V?["Pi could not reload its auth snapshot; reopen the session."]:[]].join(`
+`))}return await Z.afterApply?.(),[`Disconnected: ${$.vault.name} no longer reads from the vault. Run \`ck auth enroll revoke --name ${$.vault.name}\` to revoke it in the vault too.`,...W==="conflict"?[X5]:[]].join(`
+`)}},H=Q.actions??[];return{...Q,actions:[...H.map((W)=>W.id==="disconnect"&&$.disconnectVault?{...W,run:Y.run}:W),...$.vaultMode()&&$.disconnectVault&&!H.some((W)=>W.id==="disconnect")?[Y]:[]]}}}],afterApply:async()=>{return await Z.afterApply?.(),$.reload()}});return{command:z.command,open:async(B)=>{return await $.readAuthority(),z.open(B)},apply:async(B,Q)=>{return await $.readAuthority(),z.apply(B,Q)}}}async function xB($,Z){let X=Z.pool;if(!X){$.ui.notify("The OpenAI account pool is not available.","error");return}if(Z.onContext?.($),Z.afterApply)await Z.afterApply();else await X.syncVaultSlot?.(()=>$.modelRegistry.refresh(),!0);if(!X.vaultMode())try{await X.observeLogin(await $.modelRegistry?.getApiKeyForProvider("openai-codex"))}catch{}await H3(bB(X,Z),$.ui,{sessionId:$.sessionManager.getSessionId()})}function G5($,Z={}){$.registerCommand(V1,{description:"OpenAI accounts: add and manage accounts, quota, routing and limits",handler:(X,J)=>xB(J,Z)})}import{connect as kB}from"node:net";import{connect as yB}from"node:tls";var fB="258EAFA5-E914-47DA-95CA-C5AB0DC85B11",z5=["chatgpt-account-id","authorization","user-agent","originator","openai-beta","version","x-codex-beta-features","x-codex-turn-metadata","x-client-request-id","session-id","thread-id","x-codex-window-id"];class I8{url;readyState=0;socket;listeners={open:new Set,message:new Set,error:new Set,close:new Set};rxBuffer=new Uint8Array(0);handshakeDone=!1;expectedAccept="";fragOpcode=0;fragChunks=[];constructor($,Z){this.url=$,this.connect($,Z)}addEventListener($,Z,X){this.listeners[$]?.add(Z)}removeEventListener($,Z){this.listeners[$]?.delete(Z)}emit($,Z){for(let X of[...this.listeners[$]??[]])try{X(Z)}catch{}}async connect($,Z){let X=new URL($.replace(/^ws:/,"http:").replace(/^wss:/,"https:")),J=X.hostname,G=X.port?Number(X.port):X.protocol==="https:"?443:80,z=`${X.pathname}${X.search}`,B=crypto.getRandomValues(new Uint8Array(16)),Q=Buffer.from(B).toString("base64"),Y=await crypto.subtle.digest("SHA-1",new TextEncoder().encode(Q+fB));this.expectedAccept=Buffer.from(new Uint8Array(Y)).toString("base64");let H={};for(let[j,D]of Object.entries(Z))H[j.toLowerCase()]=D;let W=[`GET ${z} HTTP/1.1`,`Host: ${J}`,"Connection: Upgrade","Upgrade: websocket","Sec-WebSocket-Version: 13",`Sec-WebSocket-Key: ${Q}`];for(let j of z5)if(H[j]!==void 0)W.push(`${gB(j)}: ${H[j]}`);for(let[j,D]of Object.entries(Z))if(!z5.includes(j.toLowerCase())&&j.toLowerCase()!=="content-length")W.push(`${j}: ${D}`);let V=`${W.join(`\r
 `)}\r
 \r
-`;try{this.log("connect_start",{host:J,port:G,tls:X.protocol==="https:"});let j=()=>{this.socket?.write(U)},K=X.protocol==="https:"?RQ({host:J,port:G,servername:J},j):AQ({host:J,port:G},j);this.socket=K,K.on("data",(V)=>{this.onData(typeof V==="string"?Buffer.from(V,"binary"):V)}),K.on("error",(V)=>{this.readyState=3;let N=V instanceof Error?V.message:String(V);this.log("socket_error",{message:N}),this.emit("error",{message:N})}),K.on("close",(V)=>{this.readyState=3,this.log("socket_close",{hadError:V}),this.emit("close",{code:1006,reason:"socket closed"})})}catch(j){this.readyState=3,this.log("connect_exception",{message:j instanceof Error?j.message:String(j)}),this.emit("error",{message:j instanceof Error?j.message:String(j)})}}onData($){if(this.rxBuffer=bQ(this.rxBuffer,$),!this.handshakeDone){let Z=Buffer.from(this.rxBuffer).toString("latin1"),X=Z.indexOf(`\r
+`;try{this.log("connect_start",{host:J,port:G,tls:X.protocol==="https:"});let j=()=>{this.socket?.write(V)},D=X.protocol==="https:"?yB({host:J,port:G,servername:J},j):kB({host:J,port:G},j);this.socket=D,D.on("data",(U)=>{this.onData(typeof U==="string"?Buffer.from(U,"binary"):U)}),D.on("error",(U)=>{this.readyState=3;let N=U instanceof Error?U.message:String(U);this.log("socket_error",{message:N}),this.emit("error",{message:N})}),D.on("close",(U)=>{this.readyState=3,this.log("socket_close",{hadError:U}),this.emit("close",{code:1006,reason:"socket closed"})})}catch(j){this.readyState=3,this.log("connect_exception",{message:j instanceof Error?j.message:String(j)}),this.emit("error",{message:j instanceof Error?j.message:String(j)})}}onData($){if(this.rxBuffer=hB(this.rxBuffer,$),!this.handshakeDone){let Z=Buffer.from(this.rxBuffer).toString("latin1"),X=Z.indexOf(`\r
 \r
 `);if(X===-1)return;let J=Z.slice(0,X),G=J.split(`\r
-`)[0]??"",z=J.match(/sec-websocket-accept:\s*(\S+)/i);if(!G.includes(" 101")){this.readyState=3,this.socket?.destroy?.(),this.log("upgrade_failed",{statusLine:G}),this.emit("error",{message:`WS upgrade failed: ${G}`});return}if(!z||z[1]!==this.expectedAccept){this.readyState=3,this.socket?.destroy?.(),this.log("accept_mismatch",{statusLine:G}),this.emit("error",{message:"WS upgrade Sec-WebSocket-Accept mismatch"});return}this.handshakeDone=!0,this.readyState=1,this.rxBuffer=this.rxBuffer.slice(X+4),this.log("open",{statusLine:G}),this.emit("open",{})}this.drainFrames()}drainFrames(){for(;;){let $=this.rxBuffer;if($.length<2)return;let Z=$[0],X=$[1],J=(Z&128)!==0,G=Z&15,z=(X&128)!==0,Q=X&127,B=2;if(Q===126){if($.length<4)return;Q=$[2]<<8|$[3],B=4}else if(Q===127){if($.length<10)return;Q=0;for(let Y=0;Y<8;Y++)Q=Q*256+$[2+Y];B=10}if(z)B+=4;if($.length<B+Q)return;let H=$.slice(B,B+Q);this.rxBuffer=$.slice(B+Q),this.handleFrame(J,G,H)}}handleFrame($,Z,X){if(Z===9){this.writeFrame(10,X);return}if(Z===10)return;if(Z===8){let G=1005,z="";if(X.length>=2)G=X[0]<<8|X[1],z=Buffer.from(X.slice(2)).toString("utf-8");this.readyState=3;try{this.socket?.end()}catch{}this.emit("close",{code:G,reason:z});return}if(Z===1||Z===2)this.fragOpcode=Z,this.fragChunks=[X];else if(Z===0)this.fragChunks.push(X);if(!$)return;let J=xQ(this.fragChunks);if(this.fragChunks=[],this.fragOpcode===1){let G=Buffer.from(J).toString("utf-8");this.emit("message",{data:G})}}send($){if(this.readyState!==1)return;this.writeFrame(1,new TextEncoder().encode($))}writeFrame($,Z){let X=Z.length,J=crypto.getRandomValues(new Uint8Array(4)),G;if(X<126)G=[128|$,128|X];else if(X<65536)G=[128|$,254,X>>8&255,X&255];else{G=[128|$,255];for(let B=7;B>=0;B--)G.push(X/2**(8*B)&255)}let z=new Uint8Array(X);for(let B=0;B<X;B++)z[B]=Z[B]^J[B%4];let Q=new Uint8Array(G.length+4+X);Q.set(G,0),Q.set(J,G.length),Q.set(z,G.length+4);try{this.socket?.write(Q)}catch{}}close(){if(this.readyState===3)return;this.readyState=2;try{this.writeFrame(8,new Uint8Array([3,232])),this.socket?.end()}catch{}this.readyState=3}log($,Z){return Promise.resolve()}}function IQ($){return $}function bQ($,Z){let X=new Uint8Array($.length+Z.length);return X.set($,0),X.set(Z,$.length),X}function xQ($){let Z=0;for(let G of $)Z+=G.length;let X=new Uint8Array(Z),J=0;for(let G of $)X.set(G,J),J+=G.length;return X}import{statSync as uQ}from"node:fs";var V0="main";function d7($,Z,X){let J=new Map;if(o3(Z))for(let G of $)J.set(G.id,x2(J$(G.quota),Z,G.id===V0?void 0:G.id,X));return J}var c7=5,C8=5000;function s7($){if($==="ordered")return"roster";return $==="fallback-first"?"fallback-first":"main-first"}function i7($,Z=C8){let X=$.rows.filter((Q)=>Q.kind==="oauth"&&$.killswitch.get(Q.id)!==!1&&c(Q.quota).limits.length===0);if(X.length===0)return;if(g0({rows:$.rows,now:$.now,rateLimitMarks:$.rateLimitMarks,refreshBackoff:$.refreshBackoff,requestPull:()=>{}}).admitted.some((Q)=>$.killswitch.get(Q.id)!==!1))return;let G=[];if(g0({rows:X,now:$.now,rateLimitMarks:$.rateLimitMarks,refreshBackoff:$.refreshBackoff,requestPull:(Q)=>{let B=$.requestPull(Q);if(B)G.push(B.catch(()=>{}))}}),G.length===0)return;let z;return Promise.race([Promise.all(G),new Promise((Q)=>{z=setTimeout(Q,Z)})]).then(()=>{}).finally(()=>clearTimeout(z))}function P8($){return $.reason==="exhausted"||$.reason==="budget-spent"}function a7($,Z,X){if($===void 0)return{reason:"no-credential"};if(X.get($)===!1)return{reason:"killswitch"};let J=Z.excluded.find((z)=>z.id===$);if(J?.reason==="rate-limited")return{reason:"mid-stream-rate-limit",resetAtMs:J.until};if(J)return{reason:"no-credential"};let G=Z.refused.find((z)=>z.id===$);if(G&&"resetAtMs"in G)return{reason:"quota-exhausted",resetAtMs:G.resetAtMs};if(G)return{reason:"quota-unknown"};return{reason:"no-credential"}}function l7($,Z,X){if(Z.refused.find((G)=>!P8(G)&&X.get(G.id)!==!1))return{reason:"quota-unknown"};return a7($[0],Z,X)}function n7($){let Z=$.replayable!==!1,X=Z?$.placement:"main-first",J=NZ({rows:$.rows,placement:X,formerMainId:V0,killswitch:$.killswitch,rateLimitMarks:$.rateLimitMarks,refreshBackoff:$.refreshBackoff,now:$.now,requestPull:$.requestPull}),G=y1($.rows.map((B)=>B.id),X,V0),z=new Set(J.admission.refused.filter((B)=>P8(B)&&$.killswitch.get(B.id)!==!1).map((B)=>B.id)),Q=G.filter((B)=>z.has(B));if(!Z){let B=G.includes(V0),H=B?V0:J.order[0]??Q[0];if(H!==void 0&&J.order.includes(H))return{kind:"send",order:[H],lastPath:!1};if(H!==void 0&&z.has(H))return{kind:"send",order:[H],lastPath:!0};return{kind:"block",block:B?a7(V0,J.admission,$.killswitch):l7(G,J.admission,$.killswitch)}}if(J.order.length>0)return{kind:"send",order:J.order,lastPath:!1};if(Q.length>0)return{kind:"send",order:Q,lastPath:!0};return{kind:"block",block:l7(G,J.admission,$.killswitch)}}function T8($){let Z=g0({rows:$.rows,rateLimitMarks:$.rateLimitMarks,refreshBackoff:$.refreshBackoff,now:$.now,requestPull:$.requestPull}),X=new Map;for(let J of $.rows)X.set(J.id,c(J.quota));for(let J of Z.admitted)if(J.projection)X.set(J.id,J.projection);return{projections:X,excluded:new Set(Z.excluded.map((J)=>J.id))}}function r7($,Z,X){let J=X.exclude,G=J?$.rows.filter((Q)=>!J.has(Q.id)):$.rows,z=new Map;for(let Q of G){let B=Z.resetCredits(Q.id);if(B!==void 0)z.set(Q.id,B)}return PZ({rows:G,now:$.now,rateLimitMarks:$.rateLimitMarks,refreshBackoff:$.refreshBackoff,requestPull:$.requestPull,killswitch:$.killswitch,requestBytes:Z.requestBytes,...X.pendingBytes?{pendingBytes:X.pendingBytes}:{},rowReservePercent:(Q)=>Z.reservePercent(Q.id),refusedPinPolicy:"move-on-confirmed-exhaustion",resetCreditsApplicable:z,...X.pin===void 0?{}:{pin:{accountId:X.pin}},...Z.onEmptyWeightedSet?{onEmptyWeightedSet:Z.onEmptyWeightedSet}:{}})}function o7($,Z,X,J){let G=r7($,Z,{exclude:X,pendingBytes:J});if(G.outcome!=="dispatch"||G.source==="pin")return;return{accountId:G.accountId,source:G.source,...G.quotaCheckedAt===void 0?{}:{quotaCheckedAt:G.quotaCheckedAt}}}function t7($,Z,X){let J=$.killswitch.get(X)===!1,G=r7($,Z,{pin:X});if(G.outcome==="dispatch"){if(G.pin.action==="assign")return{kind:"move",reason:J?"killswitch":"exhausted"};return G.accountId===X?{kind:"serve"}:{kind:"detour"}}let z=G.admission.refused.find((Q)=>Q.id===X);if(!J&&z&&P8(z))return{kind:"last-path"};return{kind:"none"}}function e7($,Z,X,J){let G=$.killswitch.get(X);return CZ({quota:Z.projections.get(X),now:$.now,...J===void 0?{}:{status:J},...G===void 0?{}:{killswitchPasses:G}})}var kQ=15000;function c$($){if(!$)return;let Z=n1($);return Z?r1(Z):void 0}class S8{deps;now;token;identity;quota;snapshot;firstPolledFor;inflight;lastPull;constructor($){this.deps=$,this.now=$.now??Date.now}observeToken($){if(!$)return;let Z=c$($);if(this.token!==void 0&&this.accountKey(this.token,this.identity)!==this.accountKey($,Z))this.quota=void 0,this.snapshot=void 0;this.token=$,this.identity=Z;let X=this.accountKey($,Z);if(this.firstPolledFor!==X)this.firstPolledFor=X,this.pollNow()}currentToken(){return this.token}currentIdentity(){return this.identity}quotaMap(){return this.quota}quotaSnapshot(){let $=J$(this.quota);if(!$&&!this.snapshot)return;return{...this.snapshot?.resetCreditsAvailable!==void 0?{resetCreditsAvailable:this.snapshot.resetCreditsAvailable}:{},...this.snapshot?.spendControl?{spendControl:this.snapshot.spendControl}:{},...$}}requestReading($=!1){let Z=this.now();if(!$&&this.lastPull!==void 0&&Z-this.lastPull<(this.deps.pullRetryMs??kQ))return this.inflight;return this.pollNow()}pending(){return this.inflight}pollNow(){if(this.inflight)return this.inflight;let $=this.token;if(!$)return Promise.resolve({ok:!1,error:"Pi holds no OpenAI login"});let Z=this.identity;this.lastPull=this.now();let X=(async()=>{try{let J=await this.deps.poll($,Z);if(this.accountKey(this.token,this.identity)!==this.accountKey($,Z))return{ok:!0};return this.snapshot=J.snapshot,this.merge(J.observation),{ok:!0}}catch(J){let G=J instanceof Error?J.message:String(J);return this.deps.log?.warn("Pi login quota poll failed",{error:G}),{ok:!1,error:G}}})();return this.inflight=X,X.finally(()=>{if(this.inflight===X)this.inflight=void 0}),X}record($,Z,X){if(!this.owns(Z))return!1;let J=R0($,this.now(),X);if(J)this.merge(J);return!0}owns($){if(!this.token)return!1;let Z=c$($);return Z&&this.identity?Z===this.identity:$===this.token}merge($){try{let Z=E0(this.quota,$);if(Q0(Z))this.quota=Z}catch(Z){this.deps.log?.warn("Pi login quota observation not merged",{error:Z instanceof Error?Z.message:String(Z)})}}accountKey($,Z){if(Z)return`identity:${Z}`;return $?`token:${$}`:void 0}}import{homedir as yQ}from"node:os";import{join as $5}from"node:path";function fQ(){return process.env.PI_AGENT_DIR?.trim()||$5(yQ(),".pi","agent")}function Z5(){return process.env.PI_OPENAI_AUTH_FILE?.trim()||$5(fQ(),k6)}function gQ($=Z5()){return process.env.PI_OPENAI_AUTH_STATE_FILE?.trim()||U3($)}function X5($=Z5()){return{configPath:$,statePath:gQ($)}}function A8($){return $!==void 0&&($.vault===!0||!!$.token)}function J5($,Z,X,J,G=new Set){return $.filter((z)=>{if(!z.candidate||z.type!=="oauth")return!1;if(z.credential?.type!=="oauth")return!1;if(k0(z.credential))return!1;if(z.id===V0)return!1;if(J&&z.identity===J)return!1;if(z.identity!==void 0&&G.has(z.identity))return!1;return o6(J$(z.quota),Z,X)})}function BZ($,Z){let X=$.now(),J=d7(Z,$.storage,X);return{rows:Z.map((z)=>({id:z.id,kind:z.kind??"oauth",...Q0(z.quota)?{quota:z.quota}:{}})),now:X,rateLimitMarks:new Map,refreshBackoff:$.refreshBackoff(Z),killswitch:J,requestPull:$.requestPull}}async function G5($){let Z=$.accounts(),X=i7(BZ($,Z),$.firstReadingWaitMs);if(X)await X,Z=$.accounts();if($.mode==="sticky-balanced"&&$.sessionId){let J=await vQ($,Z,$.sessionId);if(J)return J}return hQ($,Z)}async function hQ($,Z){let X=s7($.mode),J=n7({...BZ($,Z),placement:X});if(J.kind==="block")return $.log?.debug("pool admission blocked the request",{reason:J.block.reason}),{kind:"blocked",block:J.block};if(J.lastPath)$.log?.debug("pool admission: every account is exhausted; probing anyway",{order:J.order});let G=new Map(Z.map((Y)=>[Y.id,Y])),z=b2($.storage),Q=[],B=new Set,H;for(;;){let Y=MZ(J.order.filter((j)=>!B.has(j)),Q,z);if(Y===void 0)break;let W=G.get(Y);if(!A8(W)){B.add(Y);continue}let U=await $.send(W);if(!U){B.add(Y);continue}H={attempt:U,accountId:W.id},Q.push({id:W.id,...U.status!==void 0?{status:U.status}:{}})}if(H)return{kind:"sent",...H};return{kind:"blocked",block:{reason:"no-credential"}}}async function vQ($,Z,X){let J=$.requestBytes,G=new Map(Z.map((q)=>[q.id,q])),z=BZ($,Z),Q=T8(z),B={requestBytes:J,reservePercent:(q)=>Y1($.storage,q===V0?void 0:q),resetCredits:()=>{return},onEmptyWeightedSet:()=>{$.log?.debug("sticky routing: no fresh weighted candidates; using configured order")}},H=(q,M,P)=>(E,F)=>{let D=new Set(E);return $.placePin({sessionId:X,requestBytes:J,validPinnedAccountIds:q.rows.map((L)=>L.id).filter((L)=>!M.excluded.has(L)),excludeAccountIds:E,quotaCheckedAtByAccount:Object.fromEntries(q.rows.map((L)=>[L.id,M.projections.get(L.id)?.checkedAt])),wireAccountIdByAccount:Object.fromEntries(P.map((L)=>[L.id,L.identity])),select:(L)=>o7(q,B,D,L),persist:F})},Y=H(z,Q,Z),W=Y([],!0);if(!W)return;let U=W.accountId,j=(q)=>{let M=Y([U],!0);if(!M)return!1;return $.log?.debug("sticky routing: migrated session pin",{fromAccountId:U,toAccountId:M.accountId,reason:q}),U=M.accountId,!0},K=t7(z,B,U);if(K.kind==="none")return;if(K.kind==="move"){if(!j(K.reason)&&K.reason==="killswitch")return}else if(K.kind==="detour"){let q=Y([U],!1);if(!q)return;$.log?.debug("sticky routing: pinned account awaits a quota reading",{pinnedAccountId:U,servedAccountId:q.accountId}),U=q.accountId}let V=G.get(U);if(!A8(V))return;let N=await $.send(V);if(!N)return;if(N.status===401||N.status===403||N.status===429){let q=$.accounts();z=BZ($,q),Q=T8(z),Y=H(z,Q,q);let M=e7(z,Q,U,N.status);if(M.action==="migrate"){let P=U;if(j(M.reason)&&U!==P){let E=q.find((D)=>D.id===U),F=A8(E)?await $.send(E):void 0;if(E&&F)N=F,V=E;else U=P}}}return{kind:"sent",attempt:N,accountId:V.id}}var mQ=500,wQ=15000;function HZ($,Z,X){return new Promise((J,G)=>{let z=setTimeout(()=>J(X()),Z);z.unref?.(),$.then((Q)=>{clearTimeout(z),J(Q)},(Q)=>{clearTimeout(z),G(Q)})})}var pQ={info(){},warn(){}};class R8{deps;now;log;snapshot={active:!1,rows:[],key:void 0,readAt:0};inflightRead;store;initializing;refreshing=new Map;backoff=new Map;rotated=new Map;pending=new Map;writes=new Map;lastPull=new Map;quotaPulls=new Map;polled=new Set;polledSnapshots=new Map;pollOutcomes=new Map;disposed=!1;constructor($){this.deps=$,this.now=$.now??Date.now,this.log=$.log??pQ}peek(){return{active:this.snapshot.active,rows:this.snapshot.rows}}async current(){let $=this.filesKey();if(this.snapshot.key===$)return this.peek();let Z=await HZ(this.startRead($),this.deps.readBudgetMs??mQ,()=>this.snapshot);return{active:Z.active,rows:Z.rows}}async load(){let $=await this.startRead(this.filesKey());return{active:$.active,rows:$.rows}}poolStore(){return this.storeFor(this.deps.paths())}polledSnapshot($){return this.polledSnapshots.get($)}filesKey(){let $=this.deps.paths();return`${$.configPath}|${U8($.configPath)}|${U8($.statePath)}`}storeFor($){if(this.store?.configPath===$.configPath)return this.store.store;let Z=$3({provider:"openai",configPath:$.configPath,statePath:$.statePath,quota:DZ,now:this.now,pull:(X)=>this.coalescedPull(X),onPullFailure:(X,J)=>{this.pollOutcomes.set(X,{id:X,ok:!1,error:J.message}),this.log.warn("pool quota poll failed",{rowId:X,kind:J.kind,error:J.message})},logger:this.log,...this.deps.store,onStep:async(X,J)=>{if(await this.deps.store?.onStep?.(X,J),J.operation!=="updateSettings"&&X.startsWith("before-")&&(this.deps.vaultAuthority?await this.deps.vaultAuthority()!=="local":this.setAside()))throw Error("Local account writes are disabled while connected to the vault.")}});return this.store={configPath:$.configPath,store:Z},Z}startRead($){if(this.inflightRead?.key===$)return this.inflightRead.promise;let Z=this.now(),X=this.read($,Z),J={key:$,promise:X};this.inflightRead=J;let G=()=>{if(this.inflightRead===J)this.inflightRead=void 0};return X.then(G,G),X}async read($,Z){let X=this.deps.paths(),J;try{J=await this.storeFor(X).read()}catch(z){return this.log.warn("account pool read failed",{error:z instanceof Error?z.message:String(z)}),this.snapshot}if(J.status==="pending-migration"){if(!this.setAside())this.initialize(X)}else if(J.status==="error")this.log.warn("account pool is unreadable",{file:J.file,reason:J.reason});let G=J.status==="ready"?{active:!0,rows:J.rows,key:$,readAt:Z}:{active:!1,rows:[],key:$,readAt:Z};if(Z>=this.snapshot.readAt)this.snapshot={...G,rows:this.withLocalState(G.rows)};if(this.snapshot.active)this.pollUnseenRows();return this.snapshot}initialize($){if(this.disposed||this.initializing?.configPath===$.configPath)return;let Z=this.storeFor($).initialize().then((X)=>{this.log.info("account pool initialized",{status:X.status})},(X)=>{if(this.log.warn("account pool initialization failed",{error:X instanceof Error?X.message:String(X)}),this.initializing?.promise===Z)this.initializing=void 0});this.initializing={configPath:$.configPath,promise:Z}}withLocalState($){let Z=this.now();return $.map((X)=>{let J=X,G=this.rotated.get(X.id);if(G?.type==="oauth"&&X.credential?.type==="oauth"){let z=X.credential.lastRefreshedAt??0,Q=G.lastRefreshedAt??0;if(z>=Q)this.rotated.delete(X.id);else J={...J,credential:G}}return D7(J,this.pending,Z)})}replaceRow($,Z){this.snapshot={...this.snapshot,rows:this.snapshot.rows.map((X)=>X.id===$?Z(X):X)}}pollUnseenRows(){if(this.disposed||this.setAside())return;for(let $ of this.snapshot.rows){let Z=$.torn===!0&&$.enabled;if(!($.candidate||Z)||$.type!=="oauth")continue;let X=`${$.id}\x00${$.credentialEpoch??0}\x00${$.identity??""}`;if(this.polled.has(X))continue;this.polled.add(X),this.requestReading($.id,!0)}}requestReading($,Z=!1){if(this.disposed||this.setAside())return;let X=this.now(),J=this.lastPull.get($);if(!Z&&J!==void 0&&X-J<(this.deps.pullRetryMs??wQ))return this.storeFor(this.deps.paths()).pullsSettled();this.lastPull.set($,X);let G=this.storeFor(this.deps.paths());return G.requestReading($),G.pullsSettled()}coalescedPull($){let Z=JSON.stringify([this.deps.paths().configPath,$.id,$.credentialEpoch,$.identity]),X=this.quotaPulls.get(Z);if(X)return X;let J=this.pull($).finally(()=>this.quotaPulls.delete(Z));return this.quotaPulls.set(Z,J),J}async pull($){let Z;try{Z=await this.deps.pullQuota($)}catch(J){throw this.pollOutcomes.set($.id,{id:$.id,ok:!1,error:J instanceof Error?J.message:String(J)}),J}this.pollOutcomes.set($.id,{id:$.id,ok:!0}),this.polledSnapshots.set($.id,Z.snapshot);let X=this.snapshot.rows.find((J)=>J.id===$.id);if(X&&X.credentialEpoch===$.credentialEpoch&&X.identity===$.identity)this.applyObservation(X,Z.observation);return Z.observation}applyObservation($,Z){j7(this.pending,$,Z),this.replaceRow($.id,(X)=>({...X,quota:j8(X.quota,Z),needsFirstReading:!1}))}recordSnapshot($,Z,X,J){if(!this.snapshot.active||this.disposed||this.setAside())return;let G=this.snapshot.rows.find((j)=>j.id===$);if(G?.type!=="oauth")return;let z=c$(X);if(!(z&&G.identity?z===G.identity:I1(G)?.access===X))return;let B=R0(Z,this.now(),J);if(!B)return;if(this.applyObservation(G,B),G.credentialEpoch===void 0)return;let H={credentialEpoch:G.credentialEpoch,...G.identity!==void 0?{identity:G.identity}:{}},Y=this.storeFor(this.deps.paths()),U=(this.writes.get(G.id)??Promise.resolve()).then(async()=>{if(this.disposed||(this.deps.vaultAuthority?await this.deps.vaultAuthority()!=="local":this.setAside()))return;return Y.recordQuota(G.id,H,B)}).catch((j)=>{this.log.warn("pool quota not recorded",{rowId:G.id,error:j instanceof Error?j.message:String(j)})});this.writes.set(G.id,U),U.finally(()=>{if(this.writes.get(G.id)===U)this.writes.delete(G.id)})}rowForToken($){let Z=c$($);return this.snapshot.rows.find((X)=>Z&&X.identity?X.identity===Z:I1(X)?.access===$)}refreshDueTokens($,Z){if(this.setAside())return Promise.resolve();let X=this.now(),J=t3(Z),G=[];for(let z of $){if(!z.candidate)continue;let Q=I1(z);if(!Q)continue;let B=(Q.expires??0)-X;if(!(!Q.access||!Q.expires||B<=J)||this.refreshBackedOff(z,X))continue;G.push(this.refresh(z.id))}return Promise.all(G).then(()=>{})}refreshBackedOff($,Z=this.now()){let X=I1($);if(!X)return!1;let J=this.backoff.get($.id);return Boolean(J&&J.tokenHash===i1(X.refresh)&&J.nextRetryAt>Z)}usableToken($,Z=this.now()){if(this.setAside())return;let X=I1($);if(!X?.access.trim())return;if(typeof X.expires!=="number"||X.expires<=Z)return;return X.access}refresh($){let Z=this.refreshing.get($);if(Z)return Z;let X=this.runRefresh($).finally(()=>{if(this.refreshing.get($)===X)this.refreshing.delete($)});return this.refreshing.set($,X),X}async runRefresh($){let Z=this.snapshot.rows.find((J)=>J.id===$),X=Z?I1(Z)?.refresh:void 0;try{let J=await this.storeFor(this.deps.paths()).refresh($,this.deps.refreshProvider,{refuse:()=>this.setAside()?"vault-mode":void 0});if(this.setAside())return;if(J.status==="rotated"){this.backoff.delete($),this.rotated.set($,J.credential),this.replaceRow($,(G)=>({...G,credential:J.credential,...J.identity!==void 0&&G.identity===void 0?{identity:J.identity}:{}}));return}if(J.status==="identity-contradicted"){this.backoff.delete($),this.replaceRow($,(G)=>({...G,enabled:!1,candidate:!1})),this.log.warn("pool row disabled: its refresh returned a different account",{rowId:$});return}this.recordRefreshFailure($,X,Error(J.reason))}catch(J){this.recordRefreshFailure($,X,J)}}recordRefreshFailure($,Z,X){if(this.log.warn("pool row refresh failed",{rowId:$,error:X instanceof Error?X.message:String(X)}),!Z)return;this.backoff.set($,K7(Z,X,this.now(),this.backoff.get($)))}refreshBackoffFor($){return q7($,this.backoff,this.now(),(Z,X)=>this.usableToken(Z,X))}async pollRows($){if(this.setAside())return[];let Z=await this.load();if(!Z.active||this.disposed)return[];let X=Z.rows.filter((J)=>J.candidate&&J.type==="oauth");if(X.length===0)return[];await this.refreshDueTokens(X,$);for(let J of X)this.pollOutcomes.delete(J.id),this.requestReading(J.id,!0);return await this.poolStore().pullsSettled(),X.map((J)=>this.pollOutcomes.get(J.id)??{id:J.id,ok:!1,error:"the quota poll did not run"})}setAside(){return this.deps.vaultMode?.()===!0}dispose(){this.disposed=!0}async settled(){for(;;){let $=[...this.writes.values(),...this.refreshing.values(),...this.initializing?[this.initializing.promise]:[]];if(await Promise.allSettled($),await this.store?.store.pullsSettled(),this.writes.size===0&&this.refreshing.size===0)return}}}var lQ=C8,dQ=500,cQ=64;function sQ(){return{input:0,output:0,cacheRead:0,cacheWrite:0,totalTokens:0,cost:{input:0,output:0,cacheRead:0,cacheWrite:0,total:0}}}function s$($,Z){return{type:"error",reason:"error",error:{role:"assistant",content:[],api:$.api,provider:$.provider,model:$.id,usage:sQ(),stopReason:"error",errorMessage:Z,timestamp:Date.now()}}}function iQ($){let Z=$.resetAtMs!==void 0?` It resets at ${new Date($.resetAtMs).toISOString()}.`:"";switch($.reason){case"quota-unknown":return`No OpenAI account has a quota reading yet; one is being taken now. Try again in ${c7} seconds.`;case"quota-exhausted":return`Every OpenAI account has used up its quota.${Z}`;case"killswitch":return"Every OpenAI account is below its killswitch quota floor (see the Limits section of `/openai`).";case"mid-stream-rate-limit":return`Every OpenAI account is rate-limited.${Z}`;case"no-credential":return"No OpenAI account holds a usable sign-in. Sign in with `/login` or add an account with `/openai`."}}function aQ($){for(let[Z,X]of Object.entries($)){if(Z.toLowerCase()!=="authorization")continue;return/^Bearer\s+(.+)$/i.exec(X.trim())?.[1]}return}class E8{main;pool;vault;deps;vaultTokens=new Map;now;paths;slot;slotVaultMode;slotNeedsRefresh=!1;slotQueue=Promise.resolve();storageCache;storageRead;constructor($){this.deps=$,this.now=$.now??Date.now,this.paths=$.paths??X5;let Z=()=>$.fetchImpl??globalThis.fetch;this.main=new S8({now:this.now,poll:async(X,J)=>{if(await this.readAuthority()!=="local")throw Error("Pi login quota polling is disabled while enrolled");let G=await $$({accessToken:X,fetchImpl:Z(),now:this.now,...J?{accountId:J}:{},accountKey:V0}),z=R0(G,this.now(),!0);if(!z)throw Error("the quota poll returned no reading");return{snapshot:G,observation:z}}}),this.pool=new R8({paths:this.paths,now:this.now,...$.readBudgetMs!==void 0?{readBudgetMs:$.readBudgetMs}:{},vaultMode:()=>this.vaultMode(),vaultAuthority:()=>this.readAuthority(),refreshProvider:async(X)=>{if(await this.readAuthority()!=="local")throw Error("Local token refresh is disabled while enrolled");let J=await L2({refreshToken:X.refresh,fetchImpl:Z(),now:this.now}),G=A$({id_token:"",access_token:J.access,refresh_token:J.refresh});return{...J,...G?{identity:G}:{}}},pullQuota:async(X)=>{if(await this.readAuthority()!=="local")throw Error("Local quota polling is disabled while enrolled");let J=X.credential;if(J.type!=="oauth"||!J.access)throw Error("the row holds no access token to poll with");let G=await $$({accessToken:J.access,fetchImpl:Z(),now:this.now,...X.identity?{accountId:X.identity}:{},accountKey:X.id}),z=R0(G,this.now(),!0);if(!z)throw Error("the quota poll returned no reading");return{snapshot:G,observation:z}}}),this.vault=$.vault??new $8({host:"pi",stateDir:t6(this.paths().statePath),reservedRouteIds:()=>this.pool.peek().rows.map((X)=>X.id),fetchImpl:Z,now:this.now})}vaultMode(){return this.vault.enrolled()}readAuthority(){return this.vault.authority()}vaultSlot(){return this.slot??=this.deps.slot??w7(this.paths().statePath),this.slot}withSlot($){let Z=this.slotQueue.then($);return this.slotQueue=Z.catch(()=>{this.slotVaultMode=void 0}),Z}syncVaultSlot($,Z=!1){return this.withSlot(async()=>{if(await this.reconcileSlot(Z),this.slotNeedsRefresh&&$)await $(),this.slotNeedsRefresh=!1})}disconnectVault(){return this.withSlot(async()=>{this.slotVaultMode=void 0;try{let $=await this.vaultSlot().exitVault();return this.slotNeedsRefresh=!0,await this.vault.disconnect(),$}finally{await this.reconcileSlot()}})}async reconcileSlot($=!1){let Z=await this.readAuthority()!=="local";if(Z===this.slotVaultMode&&!$)return;let X=this.slotVaultMode;this.slotVaultMode=void 0;let J=await this.vaultSlot().inspect();if(Z)await this.vaultSlot().enterVault();else await this.vaultSlot().exitVault();this.slotNeedsRefresh=Z&&J.slot!=="placeholder"||!Z&&J.slot==="placeholder"||X!==void 0&&Z!==X||this.slotNeedsRefresh;let G=await this.readAuthority()!=="local";if(G!==Z){if(G)await this.vaultSlot().enterVault();else await this.vaultSlot().exitVault();this.slotNeedsRefresh=!0}this.slotVaultMode=G}async start(){return await this.readAuthority(),this.vault.start(),this.pool.load().then(()=>{},()=>{})}async storage(){let $=this.paths(),Z;try{let X=uQ($.configPath);Z=`${$.configPath}|${X.ino}:${X.size}:${X.mtimeMs}`}catch{Z=`${$.configPath}|-`}if(this.storageCache?.key===Z)return this.storageCache.storage;if(this.storageRead?.key!==Z){let X=r3($).then((J)=>{return this.storageCache={key:Z,storage:J},J},()=>this.storageCache?.storage??null);this.storageRead={key:Z,promise:X}}return HZ(this.storageRead.promise,this.deps.readBudgetMs??dQ,()=>this.storageCache?.storage??null)}accounts($){let Z=[];if(!this.vaultMode())this.localAccounts($,Z);for(let X of this.vault.routes())Z.push({id:X.id,token:void 0,kind:X.kind,vault:!0,...X.identity?{identity:X.identity}:{},...X.quota!==void 0?{quota:X.quota}:{}});return Z}localAccounts($,Z){let X=this.main.currentToken(),J=this.main.currentIdentity(),G=this.vault.identities();if(X&&!(J!==void 0&&G.has(J))){let B=this.main.quotaMap();Z.push({id:V0,token:X,...J?{identity:J}:{},...B?{quota:B}:{}})}let z=this.pool.peek(),Q=this.now();if(z.active)for(let B of J5(z.rows,$,Q,J,G))Z.push({id:B.id,token:this.pool.usableToken(B,Q),...B.identity?{identity:B.identity}:{},...B.quota!==void 0?{quota:B.quota}:{}})}poolRowById($){return this.pool.peek().rows.find((Z)=>Z.id===$)}requestPull($){if($===V0)return this.main.requestReading();if(this.vault.owns($))return this.vault.requestReading($);return this.pool.requestReading($)}rememberVaultToken($,Z){this.vaultTokens.delete($),this.vaultTokens.set($,Z);while(this.vaultTokens.size>cQ){let X=this.vaultTokens.keys().next().value;if(X===void 0)break;this.vaultTokens.delete(X)}}recordHeaders($,Z,X){let J=new Headers(X),G=h4(J),z=v4(J),Q=this.vaultTokens.get(Z);if(Q?.id===$)this.vault.recordSnapshot($,G,z,Q.receipt);else if($===V0)this.main.record(G,Z,z);else this.pool.recordSnapshot($,G,Z,z)}recordRateLimitFrame($,Z){let X=this.vaultTokens.get($);if(X){this.vault.recordSnapshot(X.id,Z,!0,X.receipt);return}if(this.main.record(Z,$,!0))return;let J=this.pool.rowForToken($);if(J)this.pool.recordSnapshot(J.id,Z,$,!0)}observeWebSocketMessage($,Z){if(!Z.includes("codex.rate_limits"))return;let X=aQ($);if(!X)return;let J;try{J=JSON.parse(Z)}catch{return}if(!J||typeof J!=="object"||J.type!=="codex.rate_limits")return;this.recordRateLimitFrame(X,m4(J))}stream($,Z,X){let J=this.deps.createStream(),G=this.deps.installWebSocket?.()??(()=>{});return(async()=>{try{if(await this.readAuthority()!=="local"&&X?.apiKey!==d$){J.push(s$($,v7));return}let z=await this.route($,Z,X);if(z.kind==="blocked"){J.push(s$($,z.refusal?l2[z.refusal]:iQ(z.block)));return}if(z.head)J.push(z.head);if(z.rest)for(;;){let Q=await z.rest.next();if(Q.done)break;J.push(Q.value)}}catch(z){J.push(s$($,j1(z,X?.apiKey).message))}finally{J.end(),G()}})(),J}async route($,Z,X){let J=await this.storage(),G=await this.readAuthority()!=="local";if(G)await HZ(this.vault.awaitRequestRoster().then(()=>!0),e6,()=>!1);else this.main.observeToken(X?.apiKey),await this.pool.current(),this.pool.refreshDueTokens(this.pool.peek().rows,J);let z=J?.routing?.mode??"main-first",Q=!1,B=0,Y=await(()=>G5({accounts:()=>{let W=this.accounts(J);return B=W.length,W},storage:J,mode:z,sessionId:X?.sessionId,requestBytes:Buffer.byteLength(JSON.stringify(Z),"utf8"),now:this.now,refreshBackoff:(W)=>this.pool.refreshBackoffFor(W.map((U)=>this.poolRowById(U.id)).filter((U)=>U!==void 0)),requestPull:(W)=>this.requestPull(W),firstReadingWaitMs:this.deps.firstReadingWaitMs??lQ,send:(W)=>W.vault?this.vaultAttempt($,Z,X,W.id).then((U)=>{if(!U)Q=!0;return U}):W.token?this.attempt($,Z,X,W.id,W.token):Promise.resolve(void 0),placePin:S7}))();if(Y.kind==="blocked"){if(G&&(B===0||Q))return{...Y,refusal:Q?"vault-refused":d2(this.vault)};if(G&&Y.block.reason==="no-credential")return{...Y,refusal:"vault-empty"};return Y}return{kind:"sent",...Y.attempt}}async attempt($,Z,X,J,G){let z,Q;try{let W=X?.fetch??globalThis.fetch;Q=this.deps.streamSimple($,Z,{...X,apiKey:G,fetch:Object.assign(async(U,j)=>{try{return await O7(await W(U,j),G,"event-stream")}catch(K){throw j1(K,G)}},W),onResponse:async(U,j)=>{z=U.status,this.recordHeaders(J,G,U.headers),await X?.onResponse?.(U,j)}})}catch(W){return{head:s$($,j1(W,G).message),rest:void 0}}let B=async function*(){try{for await(let W of Q){if(W.type==="error")W.error.errorMessage=U1(W.error.errorMessage??"",G);yield W}}catch(W){yield s$($,j1(W,G).message)}}(),H=await B.next(),Y=H.done?void 0:H.value;return{...z!==void 0?{status:z}:{},head:Y,rest:H.done||Y?.type==="error"?void 0:B}}async vaultAttempt($,Z,X,J){let G;return await this.vault.send(J,async(Q,B)=>{return this.rememberVaultToken(Q,{id:J,receipt:{credentialId:B.credentialId,accountIdentitySource:B.accountIdentitySource,...B.accountIdentity!==void 0?{accountIdentity:B.accountIdentity}:{},...B.expectedAccountIdentity!==void 0?{expectedAccountIdentity:B.expectedAccountIdentity}:{}}}),G=await this.attempt($,Z,X,J,Q),new Response(null,{status:G.status??200})},{site:"model",...X?.signal?{signal:X.signal}:{}})?G:void 0}commandSupport(){return{vaultMode:()=>this.vaultMode(),readAuthority:()=>this.readAuthority(),syncVaultSlot:($,Z)=>this.syncVaultSlot($,Z),disconnectVault:()=>this.disconnectVault(),observeLogin:async($)=>{if(await this.readAuthority()==="local")this.main.observeToken($)},store:()=>this.pool.poolStore(),mainIdentity:()=>this.main.currentIdentity(),mainQuota:()=>this.main.quotaSnapshot(),reload:()=>this.pool.load(),vault:this.vault,refreshAllQuota:async()=>{let $=await this.readAuthority()==="local"?await this.storage():null;if(await this.readAuthority()!=="local")return(await this.vault.pollStale(0)).map((z)=>({account:z.id,ok:z.ok,...z.error?{error:z.error}:{}}));let[Z,X,J]=await Promise.all([this.main.currentToken()?this.main.pollNow():void 0,this.pool.pollRows($),this.vault.pollStale(0)]),G=[];if(Z)G.push({account:V0,ok:Z.ok,...Z.error?{error:Z.error}:{}});for(let z of[...X,...J])G.push({account:z.id,ok:z.ok,...z.error?{error:z.error}:{}});return G}}}}var a$="https://chatgpt.com/backend-api",Q5;class b8 extends O8{constructor($,Z){let X=Z&&typeof Z==="object"&&!Array.isArray(Z)?Z.headers??{}:{};super(String($),X);let J=Q5;if(J)this.addEventListener("message",(G)=>{let z=G?.data;if(typeof z==="string")J(X,z)})}}var i$=0,I8;function oQ(){let $=globalThis;if(i$===0)I8=$.WebSocket,$.WebSocket=b8;return i$++,()=>{if(i$=Math.max(0,i$-1),i$===0){if($.WebSocket===b8)$.WebSocket=I8;I8=void 0}}}var tQ=[{id:"gpt-5.5",name:"GPT-5.5",api:"openai-codex-responses",provider:"openai-codex",baseUrl:a$,reasoning:!0,thinkingLevelMap:{xhigh:"xhigh",minimal:"low"},input:["text","image"],cost:{input:5,output:30,cacheRead:0.5,cacheWrite:0},contextWindow:272000,maxTokens:128000},{id:"gpt-5.4",name:"GPT-5.4",api:"openai-codex-responses",provider:"openai-codex",baseUrl:a$,reasoning:!0,thinkingLevelMap:{xhigh:"xhigh",minimal:"low"},input:["text","image"],cost:{input:2.5,output:15,cacheRead:0.25,cacheWrite:0},contextWindow:272000,maxTokens:128000},{id:"gpt-5.4-mini",name:"GPT-5.4 mini",api:"openai-codex-responses",provider:"openai-codex",baseUrl:a$,reasoning:!0,thinkingLevelMap:{xhigh:"xhigh",minimal:"low"},input:["text","image"],cost:{input:0.75,output:4.5,cacheRead:0.075,cacheWrite:0},contextWindow:272000,maxTokens:128000},{id:"gpt-5.3-codex-spark",name:"GPT-5.3 Codex Spark",api:"openai-codex-responses",provider:"openai-codex",baseUrl:a$,reasoning:!0,thinkingLevelMap:{xhigh:"xhigh",minimal:"low"},input:["text"],cost:{input:1.75,output:14,cacheRead:0.175,cacheWrite:0},contextWindow:128000,maxTokens:128000}],eQ=5000;function z5($,Z){$.registerProvider("openai-codex",{baseUrl:a$,api:"openai-codex-responses",name:"OpenAI Codex (CortexKit)",...Z.vaultMode()?{apiKey:d$}:{},models:tQ,streamSimple:(X,J,G)=>Z.stream(X,J,G)})}function $B(){return new E8({streamSimple:($,Z,X)=>rQ($,Z,X),createStream:nQ,installWebSocket:oQ})}async function ZB($){let Z=$B();Q5=(Q,B)=>Z.observeWebSocketMessage(Q,B);let X,J,G=(Q=!0)=>Z.syncVaultSlot(X?async()=>{z5($,Z),await X?.()}:void 0,Q),z=()=>{G(!1).catch(()=>{J?.("Pi could not load the vault login slot. Reopen the session or disconnect in /openai.","error")})};if(p7($,{pool:Z.commandSupport(),afterApply:G,onContext:(Q)=>{X=()=>Q.modelRegistry.refresh(),J=(B,H)=>Q.ui.notify(B,H)}}),await G().catch(()=>{}),z5($,Z),setInterval(z,eQ).unref?.(),typeof $.on==="function")$.on("session_start",async(Q,B)=>{X=()=>B.modelRegistry.refresh(),J=(H,Y)=>B.ui.notify(H,Y),Z.start();try{await G()}catch{J("Pi could not load the vault login slot. Reopen the session or disconnect in /openai.","error");return}if(Z.vaultMode())return;try{await Z.commandSupport().observeLogin(await B.modelRegistry.getApiKeyForProvider("openai-codex"))}catch{}})}export{z5 as registerPiProvider,oQ as installRawCodexWebSocket,ZB as default,$B as createPiOpenAIRuntime};
+`)[0]??"",z=J.match(/sec-websocket-accept:\s*(\S+)/i);if(!G.includes(" 101")){this.readyState=3,this.socket?.destroy?.(),this.log("upgrade_failed",{statusLine:G}),this.emit("error",{message:`WS upgrade failed: ${G}`});return}if(!z||z[1]!==this.expectedAccept){this.readyState=3,this.socket?.destroy?.(),this.log("accept_mismatch",{statusLine:G}),this.emit("error",{message:"WS upgrade Sec-WebSocket-Accept mismatch"});return}this.handshakeDone=!0,this.readyState=1,this.rxBuffer=this.rxBuffer.slice(X+4),this.log("open",{statusLine:G}),this.emit("open",{})}this.drainFrames()}drainFrames(){for(;;){let $=this.rxBuffer;if($.length<2)return;let Z=$[0],X=$[1],J=(Z&128)!==0,G=Z&15,z=(X&128)!==0,B=X&127,Q=2;if(B===126){if($.length<4)return;B=$[2]<<8|$[3],Q=4}else if(B===127){if($.length<10)return;B=0;for(let H=0;H<8;H++)B=B*256+$[2+H];Q=10}if(z)Q+=4;if($.length<Q+B)return;let Y=$.slice(Q,Q+B);this.rxBuffer=$.slice(Q+B),this.handleFrame(J,G,Y)}}handleFrame($,Z,X){if(Z===9){this.writeFrame(10,X);return}if(Z===10)return;if(Z===8){let G=1005,z="";if(X.length>=2)G=X[0]<<8|X[1],z=Buffer.from(X.slice(2)).toString("utf-8");this.readyState=3;try{this.socket?.end()}catch{}this.emit("close",{code:G,reason:z});return}if(Z===1||Z===2)this.fragOpcode=Z,this.fragChunks=[X];else if(Z===0)this.fragChunks.push(X);if(!$)return;let J=vB(this.fragChunks);if(this.fragChunks=[],this.fragOpcode===1){let G=Buffer.from(J).toString("utf-8");this.emit("message",{data:G})}}send($){if(this.readyState!==1)return;this.writeFrame(1,new TextEncoder().encode($))}writeFrame($,Z){let X=Z.length,J=crypto.getRandomValues(new Uint8Array(4)),G;if(X<126)G=[128|$,128|X];else if(X<65536)G=[128|$,254,X>>8&255,X&255];else{G=[128|$,255];for(let Q=7;Q>=0;Q--)G.push(X/2**(8*Q)&255)}let z=new Uint8Array(X);for(let Q=0;Q<X;Q++)z[Q]=Z[Q]^J[Q%4];let B=new Uint8Array(G.length+4+X);B.set(G,0),B.set(J,G.length),B.set(z,G.length+4);try{this.socket?.write(B)}catch{}}close(){if(this.readyState===3)return;this.readyState=2;try{this.writeFrame(8,new Uint8Array([3,232])),this.socket?.end()}catch{}this.readyState=3}log($,Z){return Promise.resolve()}}function gB($){return $}function hB($,Z){let X=new Uint8Array($.length+Z.length);return X.set($,0),X.set(Z,$.length),X}function vB($){let Z=0;for(let G of $)Z+=G.length;let X=new Uint8Array(Z),J=0;for(let G of $)X.set(G,J),J+=G.length;return X}import{statSync as aB}from"node:fs";var mB=15000;function s$($){if(!$)return;let Z=r1($);return Z?o1(Z):void 0}class b8{deps;now;token;identity;quota;snapshot;firstPolledFor;inflight;lastPull;constructor($){this.deps=$,this.now=$.now??Date.now}observeToken($){if(!$)return;let Z=s$($);if(this.token!==void 0&&this.accountKey(this.token,this.identity)!==this.accountKey($,Z))this.quota=void 0,this.snapshot=void 0;this.token=$,this.identity=Z;let X=this.accountKey($,Z);if(this.firstPolledFor!==X)this.firstPolledFor=X,this.pollNow()}currentToken(){return this.token}currentIdentity(){return this.identity}quotaMap(){return this.quota}quotaSnapshot(){let $=G$(this.quota);if(!$&&!this.snapshot)return;return{...this.snapshot?.resetCreditsAvailable!==void 0?{resetCreditsAvailable:this.snapshot.resetCreditsAvailable}:{},...this.snapshot?.spendControl?{spendControl:this.snapshot.spendControl}:{},...$}}requestReading($=!1){let Z=this.now();if(!$&&this.lastPull!==void 0&&Z-this.lastPull<(this.deps.pullRetryMs??mB))return this.inflight;return this.pollNow()}pending(){return this.inflight}pollNow(){if(this.inflight)return this.inflight;let $=this.token;if(!$)return Promise.resolve({ok:!1,error:"Pi holds no OpenAI login"});let Z=this.identity;this.lastPull=this.now();let X=(async()=>{try{let J=await this.deps.poll($,Z);if(this.accountKey(this.token,this.identity)!==this.accountKey($,Z))return{ok:!0};return this.snapshot=J.snapshot,this.merge(J.observation),{ok:!0}}catch(J){let G=J instanceof Error?J.message:String(J);return this.deps.log?.warn("Pi login quota poll failed",{error:G}),{ok:!1,error:G}}})();return this.inflight=X,X.finally(()=>{if(this.inflight===X)this.inflight=void 0}),X}record($,Z,X){if(!this.owns(Z))return!1;let J=S0($,this.now(),X);if(J)this.merge(J);return!0}owns($){if(!this.token)return!1;let Z=s$($);return Z&&this.identity?Z===this.identity:$===this.token}merge($){try{let Z=E0(this.quota,$);if(Q0(Z))this.quota=Z}catch(Z){this.deps.log?.warn("Pi login quota observation not merged",{error:Z instanceof Error?Z.message:String(Z)})}}accountKey($,Z){if(Z)return`identity:${Z}`;return $?`token:${$}`:void 0}}import{homedir as wB}from"node:os";import{join as B5}from"node:path";function pB(){return process.env.PI_AGENT_DIR?.trim()||B5(wB(),".pi","agent")}function Q5(){return process.env.PI_OPENAI_AUTH_FILE?.trim()||B5(pB(),y6)}function uB($=Q5()){return process.env.PI_OPENAI_AUTH_STATE_FILE?.trim()||K3($)}function Y5($=Q5()){return{configPath:$,statePath:uB($)}}function x8($){return $!==void 0&&($.vault===!0||!!$.token)}function H5($,Z,X,J,G=new Set){return $.filter((z)=>{if(!z.candidate||z.type!=="oauth")return!1;if(z.credential?.type!=="oauth")return!1;if(k0(z.credential))return!1;if(z.id===R0)return!1;if(J&&z.identity===J)return!1;if(z.identity!==void 0&&G.has(z.identity))return!1;return t6(G$(z.quota),Z,X)})}function HZ($,Z){let X=$.now(),J=G7(Z,$.storage,X);return{rows:Z.map((z)=>({id:z.id,kind:z.kind??"oauth",...Q0(z.quota)?{quota:z.quota}:{}})),now:X,rateLimitMarks:new Map,refreshBackoff:$.refreshBackoff(Z),killswitch:J,requestPull:$.requestPull}}async function W5($){let Z=$.accounts(),X=Q7(HZ($,Z),$.firstReadingWaitMs);if(X)await X,Z=$.accounts();if($.mode==="sticky-balanced"&&$.sessionId){let J=await dB($,Z,$.sessionId);if(J)return J}return lB($,Z)}async function lB($,Z){let X=B7($.mode),J=H7({...HZ($,Z),placement:X,mainId:$.mainId});if(J.kind==="block")return $.log?.debug("pool admission blocked the request",{reason:J.block.reason}),{kind:"blocked",block:J.block};if(J.lastPath)$.log?.debug("pool admission: every account is exhausted; probing anyway",{order:J.order});let G=new Map(Z.map((H)=>[H.id,H])),z=v2($.storage),B=[],Q=new Set,Y;for(;;){let H=_Z(J.order.filter((j)=>!Q.has(j)),B,z);if(H===void 0)break;let W=G.get(H);if(!x8(W)){Q.add(H);continue}let V=await $.send(W);if(!V){Q.add(H);continue}Y={attempt:V,accountId:W.id},B.push({id:W.id,...V.status!==void 0?{status:V.status}:{}})}if(Y)return{kind:"sent",...Y};return{kind:"blocked",block:{reason:"no-credential"}}}async function dB($,Z,X){let J=$.requestBytes,G=new Map(Z.map((K)=>[K.id,K])),z=HZ($,Z),B=H8(z),Q={requestBytes:J,reservePercent:(K)=>H1($.storage,K===R0?void 0:K),resetCredits:()=>{return},onEmptyWeightedSet:()=>{$.log?.debug("sticky routing: no fresh weighted candidates; using configured order")}},Y=(K,M,P)=>(E,F)=>{let q=new Set(E);return $.placePin({sessionId:X,requestBytes:J,validPinnedAccountIds:K.rows.map((L)=>L.id).filter((L)=>!M.excluded.has(L)),excludeAccountIds:E,quotaCheckedAtByAccount:Object.fromEntries(K.rows.map((L)=>[L.id,M.projections.get(L.id)?.checkedAt])),wireAccountIdByAccount:Object.fromEntries(P.map((L)=>[L.id,L.identity])),select:(L)=>V7(K,Q,q,L),persist:F})},H=Y(z,B,Z),W=H([],!0);if(!W)return;let V=W.accountId,j=(K)=>{let M=H([V],!0);if(!M)return!1;return $.log?.debug("sticky routing: migrated session pin",{fromAccountId:V,toAccountId:M.accountId,reason:K}),V=M.accountId,!0},D=U7(z,Q,V);if(D.kind==="none")return;if(D.kind==="move"){if(!j(D.reason)&&D.reason==="killswitch")return}else if(D.kind==="detour"){let K=H([V],!1);if(!K)return;$.log?.debug("sticky routing: pinned account awaits a quota reading",{pinnedAccountId:V,servedAccountId:K.accountId}),V=K.accountId}let U=G.get(V);if(!x8(U))return;let N=await $.send(U);if(!N)return;if(N.status===401||N.status===403||N.status===429){let K=$.accounts();z=HZ($,K),B=H8(z),H=Y(z,B,K);let M=j7(z,B,V,N.status);if(M.action==="migrate"){let P=V;if(j(M.reason)&&V!==P){let E=K.find((q)=>q.id===V),F=x8(E)?await $.send(E):void 0;if(E&&F)N=F,U=E;else V=P}}}return{kind:"sent",attempt:N,accountId:U.id}}var cB=500,sB=15000;function WZ($,Z,X){return new Promise((J,G)=>{let z=setTimeout(()=>J(X()),Z);z.unref?.(),$.then((B)=>{clearTimeout(z),J(B)},(B)=>{clearTimeout(z),G(B)})})}var iB={info(){},warn(){}};class k8{deps;now;log;snapshot={active:!1,rows:[],key:void 0,readAt:0};inflightRead;store;initializing;refreshing=new Map;backoff=new Map;rotated=new Map;pending=new Map;writes=new Map;lastPull=new Map;quotaPulls=new Map;polled=new Set;polledSnapshots=new Map;pollOutcomes=new Map;disposed=!1;constructor($){this.deps=$,this.now=$.now??Date.now,this.log=$.log??iB}peek(){return{active:this.snapshot.active,rows:this.snapshot.rows}}async current(){let $=this.filesKey();if(this.snapshot.key===$)return this.peek();let Z=await WZ(this.startRead($),this.deps.readBudgetMs??cB,()=>this.snapshot);return{active:Z.active,rows:Z.rows}}async load(){let $=await this.startRead(this.filesKey());return{active:$.active,rows:$.rows}}poolStore(){return this.storeFor(this.deps.paths())}polledSnapshot($){return this.polledSnapshots.get($)}filesKey(){let $=this.deps.paths();return`${$.configPath}|${F8($.configPath)}|${F8($.statePath)}`}storeFor($){if(this.store?.configPath===$.configPath)return this.store.store;let Z=J3({provider:"openai",configPath:$.configPath,statePath:$.statePath,quota:qZ,now:this.now,pull:(X)=>this.coalescedPull(X),onPullFailure:(X,J)=>{this.pollOutcomes.set(X,{id:X,ok:!1,error:J.message}),this.log.warn("pool quota poll failed",{rowId:X,kind:J.kind,error:J.message})},logger:this.log,...this.deps.store,onStep:async(X,J)=>{if(await this.deps.store?.onStep?.(X,J),J.operation!=="updateSettings"&&X.startsWith("before-")&&(this.deps.vaultAuthority?await this.deps.vaultAuthority()!=="local":this.setAside()))throw Error("Local account writes are disabled while connected to the vault.")}});return this.store={configPath:$.configPath,store:Z},Z}startRead($){if(this.inflightRead?.key===$)return this.inflightRead.promise;let Z=this.now(),X=this.read($,Z),J={key:$,promise:X};this.inflightRead=J;let G=()=>{if(this.inflightRead===J)this.inflightRead=void 0};return X.then(G,G),X}async read($,Z){let X=this.deps.paths(),J;try{J=await this.storeFor(X).read()}catch(z){return this.log.warn("account pool read failed",{error:z instanceof Error?z.message:String(z)}),this.snapshot}if(J.status==="pending-migration"){if(!this.setAside())this.initialize(X)}else if(J.status==="error")this.log.warn("account pool is unreadable",{file:J.file,reason:J.reason});let G=J.status==="ready"?{active:!0,rows:J.rows,key:$,readAt:Z}:{active:!1,rows:[],key:$,readAt:Z};if(Z>=this.snapshot.readAt)this.snapshot={...G,rows:this.withLocalState(G.rows)};if(this.snapshot.active)this.pollUnseenRows();return this.snapshot}initialize($){if(this.disposed||this.initializing?.configPath===$.configPath)return;let Z=this.storeFor($).initialize().then((X)=>{this.log.info("account pool initialized",{status:X.status})},(X)=>{if(this.log.warn("account pool initialization failed",{error:X instanceof Error?X.message:String(X)}),this.initializing?.promise===Z)this.initializing=void 0});this.initializing={configPath:$.configPath,promise:Z}}withLocalState($){let Z=this.now();return $.map((X)=>{let J=X,G=this.rotated.get(X.id);if(G?.type==="oauth"&&X.credential?.type==="oauth"){let z=X.credential.lastRefreshedAt??0,B=G.lastRefreshedAt??0;if(z>=B)this.rotated.delete(X.id);else J={...J,credential:G}}return b7(J,this.pending,Z)})}replaceRow($,Z){this.snapshot={...this.snapshot,rows:this.snapshot.rows.map((X)=>X.id===$?Z(X):X)}}pollUnseenRows(){if(this.disposed||this.setAside())return;for(let $ of this.snapshot.rows){let Z=$.torn===!0&&$.enabled;if(!($.candidate||Z)||$.type!=="oauth")continue;let X=`${$.id}\x00${$.credentialEpoch??0}\x00${$.identity??""}`;if(this.polled.has(X))continue;this.polled.add(X),this.requestReading($.id,!0)}}requestReading($,Z=!1){if(this.disposed||this.setAside())return;let X=this.now(),J=this.lastPull.get($);if(!Z&&J!==void 0&&X-J<(this.deps.pullRetryMs??sB))return this.storeFor(this.deps.paths()).pullsSettled();this.lastPull.set($,X);let G=this.storeFor(this.deps.paths());return G.requestReading($),G.pullsSettled()}coalescedPull($){let Z=JSON.stringify([this.deps.paths().configPath,$.id,$.credentialEpoch,$.identity]),X=this.quotaPulls.get(Z);if(X)return X;let J=this.pull($).finally(()=>this.quotaPulls.delete(Z));return this.quotaPulls.set(Z,J),J}async pull($){let Z;try{Z=await this.deps.pullQuota($)}catch(J){throw this.pollOutcomes.set($.id,{id:$.id,ok:!1,error:J instanceof Error?J.message:String(J)}),J}this.pollOutcomes.set($.id,{id:$.id,ok:!0}),this.polledSnapshots.set($.id,Z.snapshot);let X=this.snapshot.rows.find((J)=>J.id===$.id);if(X&&X.credentialEpoch===$.credentialEpoch&&X.identity===$.identity)this.applyObservation(X,Z.observation);return Z.observation}applyObservation($,Z){I7(this.pending,$,Z),this.replaceRow($.id,(X)=>({...X,quota:L8(X.quota,Z),needsFirstReading:!1}))}recordSnapshot($,Z,X,J){if(!this.snapshot.active||this.disposed||this.setAside())return;let G=this.snapshot.rows.find((j)=>j.id===$);if(G?.type!=="oauth")return;let z=s$(X);if(!(z&&G.identity?z===G.identity:b1(G)?.access===X))return;let Q=S0(Z,this.now(),J);if(!Q)return;if(this.applyObservation(G,Q),G.credentialEpoch===void 0)return;let Y={credentialEpoch:G.credentialEpoch,...G.identity!==void 0?{identity:G.identity}:{}},H=this.storeFor(this.deps.paths()),V=(this.writes.get(G.id)??Promise.resolve()).then(async()=>{if(this.disposed||(this.deps.vaultAuthority?await this.deps.vaultAuthority()!=="local":this.setAside()))return;return H.recordQuota(G.id,Y,Q)}).catch((j)=>{this.log.warn("pool quota not recorded",{rowId:G.id,error:j instanceof Error?j.message:String(j)})});this.writes.set(G.id,V),V.finally(()=>{if(this.writes.get(G.id)===V)this.writes.delete(G.id)})}rowForToken($){let Z=s$($);return this.snapshot.rows.find((X)=>Z&&X.identity?X.identity===Z:b1(X)?.access===$)}refreshDueTokens($,Z){if(this.setAside())return Promise.resolve();let X=this.now(),J=Z8(Z),G=[];for(let z of $){if(!z.candidate)continue;let B=b1(z);if(!B)continue;let Q=(B.expires??0)-X;if(!(!B.access||!B.expires||Q<=J)||this.refreshBackedOff(z,X))continue;G.push(this.refresh(z.id))}return Promise.all(G).then(()=>{})}refreshBackedOff($,Z=this.now()){let X=b1($);if(!X)return!1;let J=this.backoff.get($.id);return Boolean(J&&J.tokenHash===a1(X.refresh)&&J.nextRetryAt>Z)}usableToken($,Z=this.now()){if(this.setAside())return;let X=b1($);if(!X?.access.trim())return;if(typeof X.expires!=="number"||X.expires<=Z)return;return X.access}refresh($){let Z=this.refreshing.get($);if(Z)return Z;let X=this.runRefresh($).finally(()=>{if(this.refreshing.get($)===X)this.refreshing.delete($)});return this.refreshing.set($,X),X}async runRefresh($){let Z=this.snapshot.rows.find((J)=>J.id===$),X=Z?b1(Z)?.refresh:void 0;try{let J=await this.storeFor(this.deps.paths()).refresh($,this.deps.refreshProvider,{refuse:()=>this.setAside()?"vault-mode":void 0});if(this.setAside())return;if(J.status==="rotated"){this.backoff.delete($),this.rotated.set($,J.credential),this.replaceRow($,(G)=>({...G,credential:J.credential,...J.identity!==void 0&&G.identity===void 0?{identity:J.identity}:{}}));return}if(J.status==="identity-contradicted"){this.backoff.delete($),this.replaceRow($,(G)=>({...G,enabled:!1,candidate:!1})),this.log.warn("pool row disabled: its refresh returned a different account",{rowId:$});return}this.recordRefreshFailure($,X,Error(J.reason))}catch(J){this.recordRefreshFailure($,X,J)}}recordRefreshFailure($,Z,X){if(this.log.warn("pool row refresh failed",{rowId:$,error:X instanceof Error?X.message:String(X)}),!Z)return;this.backoff.set($,x7(Z,X,this.now(),this.backoff.get($)))}refreshBackoffFor($){return k7($,this.backoff,this.now(),(Z,X)=>this.usableToken(Z,X))}async pollRows($){if(this.setAside())return[];let Z=await this.load();if(!Z.active||this.disposed)return[];let X=Z.rows.filter((J)=>J.candidate&&J.type==="oauth");if(X.length===0)return[];await this.refreshDueTokens(X,$);for(let J of X)this.pollOutcomes.delete(J.id),this.requestReading(J.id,!0);return await this.poolStore().pullsSettled(),X.map((J)=>this.pollOutcomes.get(J.id)??{id:J.id,ok:!1,error:"the quota poll did not run"})}setAside(){return this.deps.vaultMode?.()===!0}dispose(){this.disposed=!0}async settled(){for(;;){let $=[...this.writes.values(),...this.refreshing.values(),...this.initializing?[this.initializing.promise]:[]];if(await Promise.allSettled($),await this.store?.store.pullsSettled(),this.writes.size===0&&this.refreshing.size===0)return}}}var nB=Q8,rB=500,oB=64;function tB(){return{input:0,output:0,cacheRead:0,cacheWrite:0,totalTokens:0,cost:{input:0,output:0,cacheRead:0,cacheWrite:0,total:0}}}function i$($,Z){return{type:"error",reason:"error",error:{role:"assistant",content:[],api:$.api,provider:$.provider,model:$.id,usage:tB(),stopReason:"error",errorMessage:Z,timestamp:Date.now()}}}function eB($){let Z=$.resetAtMs!==void 0?` It resets at ${new Date($.resetAtMs).toISOString()}.`:"";switch($.reason){case"quota-unknown":return`No OpenAI account has a quota reading yet; one is being taken now. Try again in ${z7} seconds.`;case"quota-exhausted":return`Every OpenAI account has used up its quota.${Z}`;case"killswitch":return"Every OpenAI account is below its killswitch quota floor (see the Limits section of `/openai`).";case"mid-stream-rate-limit":return`Every OpenAI account is rate-limited.${Z}`;case"no-credential":return"No OpenAI account holds a usable sign-in. Sign in with `/login` or add an account with `/openai`."}}function $Q($){for(let[Z,X]of Object.entries($)){if(Z.toLowerCase()!=="authorization")continue;return/^Bearer\s+(.+)$/i.exec(X.trim())?.[1]}return}class y8{main;pool;vault;deps;vaultTokens=new Map;now;paths;slot;slotVaultMode;slotNeedsRefresh=!1;slotQueue=Promise.resolve();storageCache;storageRead;constructor($){this.deps=$,this.now=$.now??Date.now,this.paths=$.paths??Y5;let Z=()=>$.fetchImpl??globalThis.fetch;this.main=new b8({now:this.now,poll:async(X,J)=>{if(await this.readAuthority()!=="local")throw Error("Pi login quota polling is disabled while enrolled");let G=await Z$({accessToken:X,fetchImpl:Z(),now:this.now,...J?{accountId:J}:{},accountKey:R0}),z=S0(G,this.now(),!0);if(!z)throw Error("the quota poll returned no reading");return{snapshot:G,observation:z}}}),this.pool=new k8({paths:this.paths,now:this.now,...$.readBudgetMs!==void 0?{readBudgetMs:$.readBudgetMs}:{},vaultMode:()=>this.vaultMode(),vaultAuthority:()=>this.readAuthority(),refreshProvider:async(X)=>{if(await this.readAuthority()!=="local")throw Error("Local token refresh is disabled while enrolled");let J=await S2({refreshToken:X.refresh,fetchImpl:Z(),now:this.now}),G=S$({id_token:"",access_token:J.access,refresh_token:J.refresh});return{...J,...G?{identity:G}:{}}},pullQuota:async(X)=>{if(await this.readAuthority()!=="local")throw Error("Local quota polling is disabled while enrolled");let J=X.credential;if(J.type!=="oauth"||!J.access)throw Error("the row holds no access token to poll with");let G=await Z$({accessToken:J.access,fetchImpl:Z(),now:this.now,...X.identity?{accountId:X.identity}:{},accountKey:X.id}),z=S0(G,this.now(),!0);if(!z)throw Error("the quota poll returned no reading");return{snapshot:G,observation:z}}}),this.vault=$.vault??new J8({host:"pi",stateDir:$Z(this.paths().statePath),reservedRouteIds:()=>this.pool.peek().rows.map((X)=>X.id),fetchImpl:Z,now:this.now})}vaultMode(){return this.vault.enrolled()}readAuthority(){return this.vault.authority()}vaultSlot(){return this.slot??=this.deps.slot??J5(this.paths().statePath),this.slot}withSlot($){let Z=this.slotQueue.then($);return this.slotQueue=Z.catch(()=>{this.slotVaultMode=void 0}),Z}syncVaultSlot($,Z=!1){return this.withSlot(async()=>{if(await this.reconcileSlot(Z),this.slotNeedsRefresh&&$)await $(),this.slotNeedsRefresh=!1})}disconnectVault(){return this.withSlot(async()=>{this.slotVaultMode=void 0;try{let $=await this.vaultSlot().exitVault();return this.slotNeedsRefresh=!0,await this.vault.disconnect(),$}finally{await this.reconcileSlot()}})}async reconcileSlot($=!1){let Z=await this.readAuthority()!=="local";if(Z===this.slotVaultMode&&!$)return;let X=this.slotVaultMode;this.slotVaultMode=void 0;let J=await this.vaultSlot().inspect();if(Z)await this.vaultSlot().enterVault();else await this.vaultSlot().exitVault();this.slotNeedsRefresh=Z&&J.slot!=="placeholder"||!Z&&J.slot==="placeholder"||X!==void 0&&Z!==X||this.slotNeedsRefresh;let G=await this.readAuthority()!=="local";if(G!==Z){if(G)await this.vaultSlot().enterVault();else await this.vaultSlot().exitVault();this.slotNeedsRefresh=!0}this.slotVaultMode=G}async start(){return await this.readAuthority(),this.vault.start(),this.pool.load().then(()=>{},()=>{})}async storage(){let $=this.paths(),Z;try{let X=aB($.configPath);Z=`${$.configPath}|${X.ino}:${X.size}:${X.mtimeMs}`}catch{Z=`${$.configPath}|-`}if(this.storageCache?.key===Z)return this.storageCache.storage;if(this.storageRead?.key!==Z){let X=e3($).then((J)=>{return this.storageCache={key:Z,storage:J},J},()=>this.storageCache?.storage??null);this.storageRead={key:Z,promise:X}}return WZ(this.storageRead.promise,this.deps.readBudgetMs??rB,()=>this.storageCache?.storage??null)}accounts($){let Z=[];if(!this.vaultMode())this.localAccounts($,Z);for(let X of this.vault.routes())Z.push({id:X.id,token:void 0,kind:X.kind,vault:!0,...X.identity?{identity:X.identity}:{},...X.quota!==void 0?{quota:X.quota}:{}});return Z}localAccounts($,Z){let X=this.main.currentToken(),J=this.main.currentIdentity(),G=this.vault.identities();if(X&&!(J!==void 0&&G.has(J))){let Q=this.main.quotaMap();Z.push({id:R0,token:X,...J?{identity:J}:{},...Q?{quota:Q}:{}})}let z=this.pool.peek(),B=this.now();if(z.active)for(let Q of H5(z.rows,$,B,J,G))Z.push({id:Q.id,token:this.pool.usableToken(Q,B),...Q.identity?{identity:Q.identity}:{},...Q.quota!==void 0?{quota:Q.quota}:{}})}poolRowById($){return this.pool.peek().rows.find((Z)=>Z.id===$)}requestPull($){if($===R0)return this.main.requestReading();if(this.vault.owns($))return this.vault.requestReading($);return this.pool.requestReading($)}rememberVaultToken($,Z){this.vaultTokens.delete($),this.vaultTokens.set($,Z);while(this.vaultTokens.size>oB){let X=this.vaultTokens.keys().next().value;if(X===void 0)break;this.vaultTokens.delete(X)}}recordHeaders($,Z,X){let J=new Headers(X),G=d4(J),z=c4(J),B=this.vaultTokens.get(Z);if(B?.id===$)this.vault.recordSnapshot($,G,z,B.receipt);else if($===R0)this.main.record(G,Z,z);else this.pool.recordSnapshot($,G,Z,z)}recordRateLimitFrame($,Z){let X=this.vaultTokens.get($);if(X){this.vault.recordSnapshot(X.id,Z,!0,X.receipt);return}if(this.main.record(Z,$,!0))return;let J=this.pool.rowForToken($);if(J)this.pool.recordSnapshot(J.id,Z,$,!0)}observeWebSocketMessage($,Z){if(!Z.includes("codex.rate_limits"))return;let X=$Q($);if(!X)return;let J;try{J=JSON.parse(Z)}catch{return}if(!J||typeof J!=="object"||J.type!=="codex.rate_limits")return;this.recordRateLimitFrame(X,s4(J))}stream($,Z,X){let J=this.deps.createStream(),G=this.deps.installWebSocket?.()??(()=>{});return(async()=>{try{if(await this.readAuthority()!=="local"&&X?.apiKey!==c$){J.push(i$($,Z5));return}let z=await this.route($,Z,X);if(z.kind==="blocked"){J.push(i$($,z.refusal?r2[z.refusal]:eB(z.block)));return}if(z.head)J.push(z.head);if(z.rest)for(;;){let B=await z.rest.next();if(B.done)break;J.push(B.value)}}catch(z){J.push(i$($,j1(z,X?.apiKey).message))}finally{J.end(),G()}})(),J}async route($,Z,X){let J=await this.storage(),G=await this.readAuthority()!=="local";if(G)await WZ(this.vault.awaitRequestRoster().then(()=>!0),ZZ,()=>!1);else this.main.observeToken(X?.apiKey),await this.pool.current(),this.pool.refreshDueTokens(this.pool.peek().rows,J);let z=J?.routing?.mode??"main-first",B=!1,Q=0,H=await(()=>W5({accounts:()=>{let W=this.accounts(J);return Q=W.length,W},storage:J,mode:z,mainId:G?JZ(this.vault.routes()):void 0,sessionId:X?.sessionId,requestBytes:Buffer.byteLength(JSON.stringify(Z),"utf8"),now:this.now,refreshBackoff:(W)=>this.pool.refreshBackoffFor(W.map((V)=>this.poolRowById(V.id)).filter((V)=>V!==void 0)),requestPull:(W)=>this.requestPull(W),firstReadingWaitMs:this.deps.firstReadingWaitMs??nB,send:(W)=>W.vault?this.vaultAttempt($,Z,X,W.id).then((V)=>{if(!V)B=!0;return V}):W.token?this.attempt($,Z,X,W.id,W.token):Promise.resolve(void 0),placePin:l7}))();if(H.kind==="blocked"){if(G&&(Q===0||B))return{...H,refusal:B?"vault-refused":o2(this.vault)};if(G&&H.block.reason==="no-credential")return{...H,refusal:"vault-empty"};return H}return{kind:"sent",...H.attempt}}async attempt($,Z,X,J,G){let z,B;try{let W=X?.fetch??globalThis.fetch;B=this.deps.streamSimple($,Z,{...X,apiKey:G,fetch:Object.assign(async(V,j)=>{try{return await m7(await W(V,j),G,"event-stream")}catch(D){throw j1(D,G)}},W),onResponse:async(V,j)=>{z=V.status,this.recordHeaders(J,G,V.headers),await X?.onResponse?.(V,j)}})}catch(W){return{head:i$($,j1(W,G).message),rest:void 0}}let Q=async function*(){try{for await(let W of B){if(W.type==="error")W.error.errorMessage=U1(W.error.errorMessage??"",G);yield W}}catch(W){yield i$($,j1(W,G).message)}}(),Y=await Q.next(),H=Y.done?void 0:Y.value;return{...z!==void 0?{status:z}:{},head:H,rest:Y.done||H?.type==="error"?void 0:Q}}async vaultAttempt($,Z,X,J){let G;return await this.vault.send(J,async(B,Q)=>{return this.rememberVaultToken(B,{id:J,receipt:{credentialId:Q.credentialId,accountIdentitySource:Q.accountIdentitySource,...Q.accountIdentity!==void 0?{accountIdentity:Q.accountIdentity}:{},...Q.expectedAccountIdentity!==void 0?{expectedAccountIdentity:Q.expectedAccountIdentity}:{}}}),G=await this.attempt($,Z,X,J,B),new Response(null,{status:G.status??200})},{site:"model",...X?.signal?{signal:X.signal}:{}})?G:void 0}commandSupport(){return{vaultMode:()=>this.vaultMode(),readAuthority:()=>this.readAuthority(),syncVaultSlot:($,Z)=>this.syncVaultSlot($,Z),disconnectVault:()=>this.disconnectVault(),observeLogin:async($)=>{if(await this.readAuthority()==="local")this.main.observeToken($)},store:()=>this.pool.poolStore(),mainIdentity:()=>this.main.currentIdentity(),mainQuota:()=>this.main.quotaSnapshot(),reload:()=>this.pool.load(),vault:this.vault,refreshAllQuota:async()=>{let $=await this.readAuthority()==="local"?await this.storage():null;if(await this.readAuthority()!=="local")return(await this.vault.pollStale(0)).map((z)=>({account:z.id,ok:z.ok,...z.error?{error:z.error}:{}}));let[Z,X,J]=await Promise.all([this.main.currentToken()?this.main.pollNow():void 0,this.pool.pollRows($),this.vault.pollStale(0)]),G=[];if(Z)G.push({account:R0,ok:Z.ok,...Z.error?{error:Z.error}:{}});for(let z of[...X,...J])G.push({account:z.id,ok:z.ok,...z.error?{error:z.error}:{}});return G}}}}var n$="https://chatgpt.com/backend-api",U5;class g8 extends I8{constructor($,Z){let X=Z&&typeof Z==="object"&&!Array.isArray(Z)?Z.headers??{}:{};super(String($),X);let J=U5;if(J)this.addEventListener("message",(G)=>{let z=G?.data;if(typeof z==="string")J(X,z)})}}var a$=0,f8;function JQ(){let $=globalThis;if(a$===0)f8=$.WebSocket,$.WebSocket=g8;return a$++,()=>{if(a$=Math.max(0,a$-1),a$===0){if($.WebSocket===g8)$.WebSocket=f8;f8=void 0}}}var GQ=[{id:"gpt-5.5",name:"GPT-5.5",api:"openai-codex-responses",provider:"openai-codex",baseUrl:n$,reasoning:!0,thinkingLevelMap:{xhigh:"xhigh",minimal:"low"},input:["text","image"],cost:{input:5,output:30,cacheRead:0.5,cacheWrite:0},contextWindow:272000,maxTokens:128000},{id:"gpt-5.4",name:"GPT-5.4",api:"openai-codex-responses",provider:"openai-codex",baseUrl:n$,reasoning:!0,thinkingLevelMap:{xhigh:"xhigh",minimal:"low"},input:["text","image"],cost:{input:2.5,output:15,cacheRead:0.25,cacheWrite:0},contextWindow:272000,maxTokens:128000},{id:"gpt-5.4-mini",name:"GPT-5.4 mini",api:"openai-codex-responses",provider:"openai-codex",baseUrl:n$,reasoning:!0,thinkingLevelMap:{xhigh:"xhigh",minimal:"low"},input:["text","image"],cost:{input:0.75,output:4.5,cacheRead:0.075,cacheWrite:0},contextWindow:272000,maxTokens:128000},{id:"gpt-5.3-codex-spark",name:"GPT-5.3 Codex Spark",api:"openai-codex-responses",provider:"openai-codex",baseUrl:n$,reasoning:!0,thinkingLevelMap:{xhigh:"xhigh",minimal:"low"},input:["text"],cost:{input:1.75,output:14,cacheRead:0.175,cacheWrite:0},contextWindow:128000,maxTokens:128000}],zQ=5000;function V5($,Z){$.registerProvider("openai-codex",{baseUrl:n$,api:"openai-codex-responses",name:"OpenAI Codex (CortexKit)",...Z.vaultMode()?{apiKey:c$}:{},models:GQ,streamSimple:(X,J,G)=>Z.stream(X,J,G)})}function BQ(){return new y8({streamSimple:($,Z,X)=>XQ($,Z,X),createStream:ZQ,installWebSocket:JQ})}async function QQ($){let Z=BQ();U5=(B,Q)=>Z.observeWebSocketMessage(B,Q);let X,J,G=(B=!0)=>Z.syncVaultSlot(X?async()=>{V5($,Z),await X?.()}:void 0,B),z=()=>{G(!1).catch(()=>{J?.("Pi could not load the vault login slot. Reopen the session or disconnect in /openai.","error")})};if(G5($,{pool:Z.commandSupport(),afterApply:G,onContext:(B)=>{X=()=>B.modelRegistry.refresh(),J=(Q,Y)=>B.ui.notify(Q,Y)}}),await G().catch(()=>{}),V5($,Z),setInterval(z,zQ).unref?.(),typeof $.on==="function")$.on("session_start",async(B,Q)=>{X=()=>Q.modelRegistry.refresh(),J=(Y,H)=>Q.ui.notify(Y,H),Z.start();try{await G()}catch{J("Pi could not load the vault login slot. Reopen the session or disconnect in /openai.","error");return}if(Z.vaultMode())return;try{await Z.commandSupport().observeLogin(await Q.modelRegistry.getApiKeyForProvider("openai-codex"))}catch{}})}export{V5 as registerPiProvider,JQ as installRawCodexWebSocket,QQ as default,BQ as createPiOpenAIRuntime};