@desplega.ai/agent-swarm 2.5.4 → 2.7.0

package/dist/cli-gt4h8cxw.js

@@ -0,0 +1,895 @@
+import {
+  openAICompatibleProviders,
+  providerKeyVars,
+  providerForModel,
+  providerForKeyVar,
+  init_src2
+} from "./cli-gxee0bqa.js";
+import {
+  __esm
+} from "./cli-242037k3.js";
+
+// packages/model-routing/src/env.ts
+function envValue(env, key) {
+  const value = env[key]?.trim();
+  return value ? value : undefined;
+}
+function isEnvTruthy(env, key) {
+  const value = envValue(env, key)?.toLowerCase();
+  return value === "1" || value === "true" || value === "yes" || value === "on";
+}
+var init_env = () => {};
+
+// packages/model-routing/src/protocols.ts
+function defineRouteProvider(p) {
+  return {
+    ...p,
+    isHarnessDefaultProtocol: p.isHarnessDefaultProtocol ?? ((harness, protocol) => HARNESS_DEFAULT_PROTOCOL[harness] === protocol)
+  };
+}
+var HARNESS_DEFAULT_PROTOCOL;
+var init_protocols = __esm(() => {
+  HARNESS_DEFAULT_PROTOCOL = {
+    claude: "anthropic-messages",
+    codex: "openai-responses",
+    pi: "openai-chat",
+    opencode: "openai-chat",
+    dsh: "openai-chat"
+  };
+});
+
+// packages/model-routing/src/providers/anthropic-models.ts
+function routeAuthHeaders(ctx) {
+  const { auth } = ctx.route;
+  if (auth.kind !== "bearer" && auth.kind !== "x-api-key" && auth.kind !== "header")
+    return {};
+  const secret = envValue(ctx.env, auth.secretKey);
+  if (!secret)
+    return {};
+  if (auth.kind === "bearer")
+    return { Authorization: `Bearer ${secret}` };
+  if (auth.kind === "x-api-key")
+    return { "x-api-key": secret };
+  return { [auth.header]: secret };
+}
+async function readBody(res) {
+  try {
+    return await res.text();
+  } catch {
+    return "";
+  }
+}
+function modelIds(body) {
+  try {
+    const parsed = JSON.parse(body);
+    if (!Array.isArray(parsed.data))
+      return;
+    return parsed.data.flatMap((m) => typeof m.id === "string" ? [m.id] : []);
+  } catch {
+    return;
+  }
+}
+async function checkAnthropicModels(ctx, opts = {}) {
+  const res = await ctx.fetch("/v1/models", {
+    method: "GET",
+    headers: {
+      "anthropic-version": ANTHROPIC_VERSION,
+      ...opts.extraHeaders,
+      ...routeAuthHeaders(ctx)
+    },
+    signal: ctx.signal
+  });
+  const body = await readBody(res);
+  if (res.ok)
+    return { status: "verified", models: modelIds(body) };
+  if (opts.notFoundIsConfigured && (res.status === 404 || res.status === 405)) {
+    return {
+      status: "configured",
+      reason: `HTTP ${res.status}: the endpoint does not list models, so the key was not checked`
+    };
+  }
+  return {
+    status: "failed",
+    reason: `HTTP ${res.status}: ${body.slice(0, 200)}`,
+    httpStatus: res.status
+  };
+}
+var ANTHROPIC_VERSION = "2023-06-01";
+var init_anthropic_models = __esm(() => {
+  init_env();
+});
+
+// packages/model-routing/src/providers/secret-env.ts
+function secretEnv(route) {
+  const { auth } = route;
+  return "secretKey" in auth ? [auth.secretKey] : [];
+}
+var init_secret_env = () => {};
+
+// packages/model-routing/src/providers/anthropic.ts
+var ANTHROPIC_API_BASE_URL = "https://api.anthropic.com", anthropicProvider;
+var init_anthropic = __esm(() => {
+  init_protocols();
+  init_anthropic_models();
+  init_secret_env();
+  anthropicProvider = defineRouteProvider({
+    id: "anthropic",
+    name: "Anthropic API",
+    protocols: ["anthropic-messages"],
+    defaultBaseUrl: ANTHROPIC_API_BASE_URL,
+    requiredEnv: (route) => secretEnv(route),
+    validate: (ctx) => checkAnthropicModels(ctx)
+  });
+});
+
+// packages/model-routing/src/providers/anthropic-gateway.ts
+function customHeaders(route, env) {
+  if (route.source !== "default")
+    return {};
+  const raw = envValue(env, "ANTHROPIC_CUSTOM_HEADERS");
+  if (!raw)
+    return {};
+  const headers = {};
+  for (const line of raw.split(`
+`)) {
+    const colon = line.indexOf(":");
+    if (colon <= 0)
+      continue;
+    const name = line.slice(0, colon).trim();
+    const value = line.slice(colon + 1).trim();
+    if (name && value)
+      headers[name] = value;
+  }
+  return headers;
+}
+var anthropicGatewayProvider;
+var init_anthropic_gateway = __esm(() => {
+  init_env();
+  init_protocols();
+  init_anthropic_models();
+  init_secret_env();
+  anthropicGatewayProvider = defineRouteProvider({
+    id: "anthropic-gateway",
+    name: "Anthropic-compatible gateway",
+    protocols: ["anthropic-messages"],
+    requiredEnv: (route) => secretEnv(route),
+    validate: (ctx) => checkAnthropicModels(ctx, {
+      extraHeaders: customHeaders(ctx.route, ctx.env),
+      notFoundIsConfigured: true
+    })
+  });
+});
+
+// packages/model-routing/src/providers/bedrock.ts
+var bedrockProvider;
+var init_bedrock = __esm(() => {
+  init_protocols();
+  init_secret_env();
+  bedrockProvider = defineRouteProvider({
+    id: "bedrock",
+    name: "Amazon Bedrock",
+    protocols: ["bedrock"],
+    requiredEnv: (route) => ["AWS_REGION", ...secretEnv(route)]
+  });
+});
+
+// packages/model-routing/src/providers/claude-subscription.ts
+function errorType(body) {
+  try {
+    const parsed = JSON.parse(body);
+    return typeof parsed.error?.type === "string" ? parsed.error.type : undefined;
+  } catch {
+    return;
+  }
+}
+var claudeSubscriptionProvider;
+var init_claude_subscription = __esm(() => {
+  init_env();
+  init_protocols();
+  init_anthropic();
+  claudeSubscriptionProvider = defineRouteProvider({
+    id: "claude-subscription",
+    name: "Claude subscription",
+    protocols: ["anthropic-messages"],
+    harnesses: ["claude"],
+    defaultBaseUrl: ANTHROPIC_API_BASE_URL,
+    requiredEnv: () => ["CLAUDE_CODE_OAUTH_TOKEN"],
+    validate: async (ctx) => {
+      const token = envValue(ctx.env, "CLAUDE_CODE_OAUTH_TOKEN");
+      const res = await ctx.fetch("/api/oauth/profile", {
+        method: "GET",
+        headers: { Authorization: `Bearer ${token}` },
+        signal: ctx.signal
+      });
+      if (res.ok)
+        return { status: "verified" };
+      const body = await res.text().catch(() => "");
+      if (res.status === 403 && errorType(body) === "permission_error") {
+        return { status: "verified" };
+      }
+      if (res.status === 429 || res.status >= 500) {
+        return {
+          status: "configured",
+          reason: `Anthropic did not answer the token check (HTTP ${res.status}), so it was not tested.`
+        };
+      }
+      if (res.status === 401) {
+        return {
+          status: "failed",
+          reason: "Anthropic rejected the Claude subscription token (HTTP 401). Make a new one with the claude setup-token command.",
+          httpStatus: 401
+        };
+      }
+      return {
+        status: "failed",
+        reason: `HTTP ${res.status}: ${body.slice(0, 200)}`,
+        httpStatus: res.status
+      };
+    }
+  });
+});
+
+// packages/model-routing/src/providers/foundry.ts
+function foundryBaseUrl(resource) {
+  return `https://${resource}.services.ai.azure.com/anthropic`;
+}
+var foundryProvider;
+var init_foundry = __esm(() => {
+  init_protocols();
+  init_secret_env();
+  foundryProvider = defineRouteProvider({
+    id: "foundry",
+    name: "Microsoft Foundry",
+    protocols: ["foundry"],
+    requiredEnv: (route) => [
+      ...route.baseUrl ? [] : ["ANTHROPIC_FOUNDRY_RESOURCE"],
+      ...secretEnv(route)
+    ]
+  });
+});
+
+// packages/model-routing/src/providers/openai-gateway.ts
+async function checkOpenAiModels(ctx) {
+  const res = await ctx.fetch("/models", {
+    method: "GET",
+    headers: routeAuthHeaders(ctx),
+    signal: ctx.signal
+  });
+  const body = await readBody(res);
+  if (res.ok)
+    return { status: "verified", models: modelIds(body) };
+  if (res.status === 404 || res.status === 405) {
+    return {
+      status: "configured",
+      reason: `HTTP ${res.status}: the endpoint does not list models, so the key was not checked`
+    };
+  }
+  return {
+    status: "failed",
+    reason: `HTTP ${res.status}: ${body.slice(0, 200)}`,
+    httpStatus: res.status
+  };
+}
+var OPENAI_API_BASE_URL = "https://api.openai.com", openAiGatewayProvider;
+var init_openai_gateway = __esm(() => {
+  init_protocols();
+  init_anthropic_models();
+  init_secret_env();
+  openAiGatewayProvider = defineRouteProvider({
+    id: "openai-gateway",
+    name: "OpenAI-compatible gateway",
+    protocols: ["openai-responses"],
+    harnesses: ["codex"],
+    requiredEnv: (route) => secretEnv(route),
+    validate: checkOpenAiModels
+  });
+});
+
+// packages/model-routing/src/providers/vertex.ts
+var vertexProvider;
+var init_vertex = __esm(() => {
+  init_protocols();
+  vertexProvider = defineRouteProvider({
+    id: "vertex",
+    name: "Google Vertex AI",
+    protocols: ["vertex"],
+    requiredEnv: () => ["CLOUD_ML_REGION", "ANTHROPIC_VERTEX_PROJECT_ID"]
+  });
+});
+
+// packages/model-routing/src/providers/index.ts
+function getRouteProvider(id) {
+  return ROUTE_PROVIDERS.find((p) => p.id === id);
+}
+var ROUTE_PROVIDERS;
+var init_providers = __esm(() => {
+  init_anthropic();
+  init_anthropic_gateway();
+  init_bedrock();
+  init_claude_subscription();
+  init_foundry();
+  init_openai_gateway();
+  init_vertex();
+  ROUTE_PROVIDERS = [
+    anthropicProvider,
+    claudeSubscriptionProvider,
+    anthropicGatewayProvider,
+    foundryProvider,
+    bedrockProvider,
+    vertexProvider,
+    openAiGatewayProvider
+  ];
+});
+
+// packages/model-routing/src/scoped-fetch.ts
+function isAbsolute(path) {
+  return /^[a-z][a-z0-9+.-]*:/i.test(path) || path.startsWith("//");
+}
+function createScopedFetch(baseUrl, impl) {
+  let base;
+  try {
+    base = new URL(baseUrl);
+  } catch {
+    throw new ScopedFetchError(`Invalid route base URL: ${baseUrl}`);
+  }
+  const prefix = base.href.replace(/\/+$/, "");
+  return (path, init) => {
+    let target;
+    try {
+      target = isAbsolute(path) ? new URL(path, base) : new URL(`${prefix}/${path.replace(/^\/+/, "")}`);
+    } catch {
+      return Promise.reject(new ScopedFetchError(`Invalid route path: ${path}`));
+    }
+    if (target.origin !== base.origin) {
+      return Promise.reject(new ScopedFetchError(`Refusing request to ${target.origin}: route is scoped to ${base.origin}`));
+    }
+    const doFetch = impl ?? globalThis.fetch;
+    return doFetch(target.href, { ...init, redirect: "manual" });
+  };
+}
+var ScopedFetchError;
+var init_scoped_fetch = __esm(() => {
+  ScopedFetchError = class ScopedFetchError extends Error {
+    name = "ScopedFetchError";
+  };
+});
+
+// packages/model-routing/src/credential-status.ts
+function describeRoute(route, providerName) {
+  return route.baseUrl ? `${providerName} at ${route.baseUrl}` : providerName;
+}
+function routeCredentialStatus(route, env) {
+  const provider = getRouteProvider(route.provider);
+  if (!provider) {
+    return { ready: false, missing: [], hint: `Unknown route provider "${route.provider}".` };
+  }
+  const missing = provider.requiredEnv(route).filter((key) => !envValue(env, key));
+  const where = describeRoute(route, provider.name);
+  return missing.length === 0 ? { ready: true, missing: [], hint: `Routing through ${where}.` } : { ready: false, missing, hint: `${where} needs ${missing.join(", ")}.` };
+}
+async function validateRoute(route, env, opts = {}) {
+  const provider = getRouteProvider(route.provider);
+  const status = routeCredentialStatus(route, env);
+  if (!provider || !status.ready) {
+    return { status: "failed", reason: status.hint, missing: status.missing };
+  }
+  if (!provider.validate) {
+    return {
+      status: "configured",
+      reason: `${provider.name} has no free credential check; the first task proves the route.`
+    };
+  }
+  const baseUrl = route.baseUrl ?? provider.defaultBaseUrl;
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? VALIDATE_TIMEOUT_MS);
+  try {
+    const scopedFetch = baseUrl ? createScopedFetch(baseUrl) : () => Promise.reject(new ScopedFetchError(`Route "${route.name}" has no base URL.`));
+    return await provider.validate({ route, env, fetch: scopedFetch, signal: controller.signal });
+  } catch (err) {
+    return { status: "failed", reason: err instanceof Error ? err.message : String(err) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var VALIDATE_TIMEOUT_MS = 5000;
+var init_credential_status = __esm(() => {
+  init_env();
+  init_protocols();
+  init_providers();
+  init_scoped_fetch();
+});
+
+// packages/model-routing/src/default-route.ts
+function isFirstPartyAnthropicUrl(url) {
+  try {
+    return new URL(url).origin === ANTHROPIC_API_BASE_URL;
+  } catch {
+    return false;
+  }
+}
+function isFirstPartyOpenAiUrl(url) {
+  try {
+    return new URL(url).origin === OPENAI_API_BASE_URL;
+  } catch {
+    return false;
+  }
+}
+function defaultRoute(harness, route) {
+  return { id: `default:${harness}`, name: `default:${harness}`, source: "default", ...route };
+}
+function deriveClaudeDefaultRoute(env) {
+  if (isEnvTruthy(env, "CLAUDE_CODE_USE_FOUNDRY")) {
+    const resource = envValue(env, "ANTHROPIC_FOUNDRY_RESOURCE");
+    const auth = envValue(env, "ANTHROPIC_FOUNDRY_AUTH_TOKEN") ? { kind: "bearer", secretKey: "ANTHROPIC_FOUNDRY_AUTH_TOKEN" } : envValue(env, "ANTHROPIC_FOUNDRY_API_KEY") ? { kind: "x-api-key", secretKey: "ANTHROPIC_FOUNDRY_API_KEY" } : { kind: "cloud-chain" };
+    return defaultRoute("claude", {
+      provider: "foundry",
+      protocol: "foundry",
+      baseUrl: envValue(env, "ANTHROPIC_FOUNDRY_BASE_URL") ?? (resource ? foundryBaseUrl(resource) : undefined),
+      auth,
+      cloud: { resource }
+    });
+  }
+  if (isEnvTruthy(env, "CLAUDE_CODE_USE_BEDROCK")) {
+    const region = envValue(env, "AWS_REGION");
+    return defaultRoute("claude", {
+      provider: "bedrock",
+      protocol: "bedrock",
+      baseUrl: envValue(env, "ANTHROPIC_BEDROCK_BASE_URL") ?? (region ? `https://bedrock-runtime.${region}.amazonaws.com` : undefined),
+      auth: envValue(env, "AWS_BEARER_TOKEN_BEDROCK") ? { kind: "bearer", secretKey: "AWS_BEARER_TOKEN_BEDROCK" } : { kind: "cloud-chain" },
+      cloud: { region }
+    });
+  }
+  if (isEnvTruthy(env, "CLAUDE_CODE_USE_VERTEX")) {
+    const region = envValue(env, "CLOUD_ML_REGION");
+    const vertexHost = region === "global" ? "aiplatform.googleapis.com" : `${region}-aiplatform.googleapis.com`;
+    return defaultRoute("claude", {
+      provider: "vertex",
+      protocol: "vertex",
+      baseUrl: envValue(env, "ANTHROPIC_VERTEX_BASE_URL") ?? (region ? `https://${vertexHost}` : undefined),
+      auth: { kind: "cloud-chain" },
+      cloud: { region, project: envValue(env, "ANTHROPIC_VERTEX_PROJECT_ID") }
+    });
+  }
+  const oauthToken = envValue(env, "CLAUDE_CODE_OAUTH_TOKEN");
+  const baseUrl = envValue(env, "ANTHROPIC_BASE_URL");
+  if (baseUrl && !isFirstPartyAnthropicUrl(baseUrl)) {
+    const authToken = envValue(env, "ANTHROPIC_AUTH_TOKEN");
+    const apiKey = envValue(env, "ANTHROPIC_API_KEY");
+    return defaultRoute("claude", {
+      provider: "anthropic-gateway",
+      protocol: "anthropic-messages",
+      baseUrl,
+      auth: authToken || !apiKey ? { kind: "bearer", secretKey: "ANTHROPIC_AUTH_TOKEN" } : { kind: "x-api-key", secretKey: "ANTHROPIC_API_KEY" }
+    });
+  }
+  if (oauthToken) {
+    return defaultRoute("claude", {
+      provider: "claude-subscription",
+      protocol: "anthropic-messages",
+      baseUrl: baseUrl ?? ANTHROPIC_API_BASE_URL,
+      auth: { kind: "subscription", plan: "claude" }
+    });
+  }
+  if (envValue(env, "ANTHROPIC_API_KEY")) {
+    return defaultRoute("claude", {
+      provider: "anthropic",
+      protocol: "anthropic-messages",
+      baseUrl: baseUrl ?? ANTHROPIC_API_BASE_URL,
+      auth: { kind: "x-api-key", secretKey: "ANTHROPIC_API_KEY" }
+    });
+  }
+  return null;
+}
+function deriveCodexDefaultRoute(env) {
+  const baseUrl = envValue(env, CODEX_GATEWAY_BASE_URL);
+  if (!baseUrl || isFirstPartyOpenAiUrl(baseUrl))
+    return null;
+  return defaultRoute("codex", {
+    provider: "openai-gateway",
+    protocol: "openai-responses",
+    baseUrl,
+    auth: { kind: "bearer", secretKey: CODEX_GATEWAY_API_KEY }
+  });
+}
+function deriveDefaultRoute(harness, env) {
+  if (harness === "claude")
+    return deriveClaudeDefaultRoute(env);
+  if (harness === "codex")
+    return deriveCodexDefaultRoute(env);
+  return null;
+}
+function routeUnsetEnv(harness, route) {
+  if (harness === "claude" && route.provider !== "claude-subscription") {
+    return ["CLAUDE_CODE_OAUTH_TOKEN"];
+  }
+  if (harness === "codex" && route.provider === "openai-gateway") {
+    return ["CODEX_OAUTH", "OPENAI_API_KEY"];
+  }
+  return [];
+}
+var CODEX_GATEWAY_BASE_URL = "CODEX_GATEWAY_BASE_URL", CODEX_GATEWAY_API_KEY = "CODEX_GATEWAY_API_KEY";
+var init_default_route = __esm(() => {
+  init_env();
+  init_anthropic();
+  init_foundry();
+  init_openai_gateway();
+});
+
+// packages/model-routing/src/index.ts
+var init_src = __esm(() => {
+  init_credential_status();
+  init_default_route();
+  init_protocols();
+  init_anthropic();
+  init_providers();
+  init_openai_gateway();
+  init_scoped_fetch();
+});
+
+// src/utils/model-rate-limit-windows.ts
+function modelFamilyOf(model) {
+  if (!model)
+    return;
+  const lower = model.toLowerCase();
+  const families = ["fable", "opus", "sonnet", "haiku"];
+  for (const family of families) {
+    if (lower.includes(family))
+      return family;
+  }
+  return;
+}
+function windowForModelFamily(family) {
+  switch (family) {
+    case "fable":
+      return FABLE_WINDOW;
+    case "opus":
+      return OPUS_WINDOW;
+    case "sonnet":
+      return SONNET_WINDOW;
+    default:
+      return;
+  }
+}
+function isModelScopedWindow(type) {
+  return Object.hasOwn(MODEL_SCOPED_WINDOWS, type) && MODEL_SCOPED_WINDOWS[type] !== undefined;
+}
+function parseModelLimitMessage(text) {
+  const match = text.match(/reached your (Fable|Opus|Sonnet) limit/i);
+  if (!match)
+    return;
+  return match[1].toLowerCase();
+}
+function parseCreditsRequiredMessage(text) {
+  const match = text.match(/(Fable|Opus|Sonnet)(?:[^.]|\.(?=\d)){0,40}requires usage credits/i);
+  if (!match)
+    return;
+  return match[1].toLowerCase();
+}
+function activeModelBlock(windows, family, nowMs) {
+  if (!windows)
+    return;
+  const window = windowForModelFamily(family);
+  if (!window)
+    return;
+  const entry = windows[window];
+  if (!entry)
+    return;
+  if (entry.status !== "rejected")
+    return;
+  if (typeof entry.resetsAt !== "number" || entry.resetsAt * 1000 <= nowMs)
+    return;
+  return { window, resetsAt: entry.resetsAt };
+}
+function activeModelBlocks(windows, nowMs) {
+  if (!windows)
+    return [];
+  const blocks = [];
+  for (const [window, model] of Object.entries(MODEL_SCOPED_WINDOWS)) {
+    const entry = windows[window];
+    if (!entry)
+      continue;
+    if (entry.status !== "rejected")
+      continue;
+    if (typeof entry.resetsAt !== "number" || entry.resetsAt * 1000 <= nowMs)
+      continue;
+    blocks.push({ model, window, resetsAt: entry.resetsAt });
+  }
+  return blocks;
+}
+var FABLE_WINDOW = "seven_day_overage_included", OPUS_WINDOW = "seven_day_opus", SONNET_WINDOW = "seven_day_sonnet", MODEL_SCOPED_WINDOWS;
+var init_model_rate_limit_windows = __esm(() => {
+  MODEL_SCOPED_WINDOWS = {
+    [FABLE_WINDOW]: "fable",
+    [OPUS_WINDOW]: "opus",
+    [SONNET_WINDOW]: "sonnet"
+  };
+});
+
+// src/utils/credentials.ts
+import { existsSync } from "node:fs";
+function normalizeProviderKeyAliases(env) {
+  for (const provider of openAICompatibleProviders()) {
+    if (env[provider.envVar]?.trim())
+      continue;
+    const alias = provider.aliasEnvVars.find((name) => env[name]?.trim());
+    if (alias)
+      env[provider.envVar] = env[alias];
+  }
+}
+function getModelAwareCredentialVars(provider, model) {
+  const base = PROVIDER_CREDENTIAL_VARS[provider];
+  if (!base)
+    return CREDENTIAL_POOL_VARS;
+  if (provider === "dsh" && model) {
+    return model.startsWith("openrouter/") ? ["OPENROUTER_API_KEY"] : ["DEEPSEEK_API_KEY"];
+  }
+  if (provider === "grok" && model) {
+    return model.startsWith("openrouter/") ? ["OPENROUTER_API_KEY"] : ["XAI_API_KEY"];
+  }
+  if (!SLASH_MODEL_PROVIDERS.has(provider) || !model)
+    return base;
+  const direct = providerForModel(model);
+  if (direct)
+    return [direct.envVar];
+  if (model.includes("/")) {
+    return base.filter((v) => v !== "OPENAI_API_KEY");
+  }
+  return base;
+}
+function deriveProviderFromKeyType(keyType) {
+  if (providerForKeyVar(keyType))
+    return "pi";
+  switch (keyType) {
+    case "CLAUDE_CODE_OAUTH_TOKEN":
+    case "ANTHROPIC_API_KEY":
+      return "claude";
+    case "OPENROUTER_API_KEY":
+      return "pi";
+    case "OPENAI_API_KEY":
+    case "CODEX_OAUTH":
+      return "codex";
+    case "DEEPSEEK_API_KEY":
+      return "dsh";
+    case "AMP_API_KEY":
+      return "amp";
+    case "CURSOR_API_KEY":
+      return "cursor";
+    case "XAI_API_KEY":
+      return "grok";
+    case "DEVIN_API_KEY":
+      return "devin";
+    default:
+      return "claude";
+  }
+}
+function isJsonObject(value) {
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("{") || !trimmed.endsWith("}"))
+    return false;
+  try {
+    const parsed = JSON.parse(trimmed);
+    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed);
+  } catch {
+    return false;
+  }
+}
+function splitCredentialPool(value) {
+  return isJsonObject(value) ? [value.trim()] : value.split(",").map((s) => s.trim()).filter(Boolean);
+}
+function selectCredential(value, availableIndices, keyType = "ANTHROPIC_API_KEY") {
+  const credentials = splitCredentialPool(value);
+  if (credentials.length <= 1) {
+    const selected = value.trim();
+    const isRateLimitFallback = availableIndices !== undefined && availableIndices.length === 0;
+    return {
+      selected,
+      index: 0,
+      total: 1,
+      keySuffix: selected.slice(-5),
+      keyType,
+      isRateLimitFallback
+    };
+  }
+  let index;
+  let isRateLimitFallback = false;
+  if (availableIndices && availableIndices.length > 0) {
+    const validIndices = availableIndices.filter((i) => i >= 0 && i < credentials.length);
+    if (validIndices.length > 0) {
+      index = validIndices[Math.floor(Math.random() * validIndices.length)];
+    } else {
+      index = Math.floor(Math.random() * credentials.length);
+      isRateLimitFallback = true;
+    }
+  } else if (availableIndices && availableIndices.length === 0) {
+    index = Math.floor(Math.random() * credentials.length);
+    isRateLimitFallback = true;
+  } else {
+    index = Math.floor(Math.random() * credentials.length);
+  }
+  const selected = credentials[index];
+  return {
+    selected,
+    index,
+    total: credentials.length,
+    keySuffix: selected.slice(-5),
+    keyType,
+    isRateLimitFallback
+  };
+}
+function validateClaudeCredentials(env) {
+  const route = deriveDefaultRoute("claude", env);
+  if (!route)
+    throw new Error(`No Claude credentials found. ${CLAUDE_CREDENTIALS_HINT}`);
+  const status = routeCredentialStatus(route, env);
+  if (!status.ready)
+    throw new Error(`No Claude credentials found. ${status.hint}`);
+  return CLAUDE_CREDENTIAL_TYPE_BY_PROVIDER[route.provider] ?? route.provider;
+}
+function openAICompatibleKeyLabels() {
+  return openAICompatibleProviders().map((p) => p.aliasEnvVars.length > 0 ? `${p.envVar} (or ${p.aliasEnvVars.join(" or ")})` : p.envVar);
+}
+function validateOpencodeCredentials(env) {
+  if (env.OPENROUTER_API_KEY)
+    return "openrouter_api_key";
+  if (env.ANTHROPIC_API_KEY)
+    return "anthropic_api_key";
+  if (env.OPENAI_API_KEY)
+    return "openai_api_key";
+  const direct = openAICompatibleProviders().find((p) => providerKeyVars(p).some((n) => env[n]));
+  if (direct)
+    return direct.envVar.toLowerCase();
+  const authFile = `${process.env.HOME ?? "/root"}/.local/share/opencode/auth.json`;
+  if (existsSync(authFile))
+    return "auth_file";
+  throw new Error(`No opencode credentials found. Set OPENROUTER_API_KEY, ANTHROPIC_API_KEY, OPENAI_API_KEY, ${openAICompatibleKeyLabels().map((label) => `${label}, `).join("")}or provide ~/.local/share/opencode/auth.json.`);
+}
+async function fetchAvailableIndices(env, apiUrl, apiKey, poolVars = CREDENTIAL_POOL_VARS, modelFamily) {
+  const availableIndicesMap = {};
+  const window = modelFamily ? windowForModelFamily(modelFamily) : undefined;
+  const modelParam = window ? `&model=${encodeURIComponent(modelFamily)}` : "";
+  for (const envVar of poolVars) {
+    const val = env[envVar];
+    if (val) {
+      const keySuffixes = splitCredentialPool(val).map((key) => key.slice(-5));
+      const totalKeys = keySuffixes.length;
+      try {
+        const resp = await fetch(`${apiUrl}/api/keys/available?keyType=${encodeURIComponent(envVar)}&totalKeys=${totalKeys}${modelParam}&keySuffixes=${encodeURIComponent(keySuffixes.join(","))}`, { headers: { Authorization: `Bearer ${apiKey}` } });
+        if (resp.ok) {
+          const data = await resp.json();
+          availableIndicesMap[envVar] = {
+            availableIndices: data.availableIndices,
+            rejectedIndices: data.rejectedIndices,
+            modelBlockedIndices: data.modelBlockedIndices,
+            earliestModelResetAt: data.earliestModelResetAt,
+            seatBlockedIndices: data.seatBlockedIndices
+          };
+          if (data.availableIndices.length < totalKeys) {
+            console.log(`[credentials] ${envVar}: ${data.availableIndices.length}/${totalKeys} keys available (${totalKeys - data.availableIndices.length} unavailable)`);
+          }
+        }
+      } catch {}
+    }
+  }
+  return availableIndicesMap;
+}
+async function resolveCredentialPools(env, opts) {
+  const providerVars = opts?.provider ? getModelAwareCredentialVars(opts.provider, opts.model) : CREDENTIAL_POOL_VARS;
+  const modelFamily = modelFamilyOf(opts?.model);
+  const window = modelFamily ? windowForModelFamily(modelFamily) : undefined;
+  const availableIndicesMap = opts?.availableIndicesMap ?? (opts?.apiUrl && opts?.apiKey ? await fetchAvailableIndices(env, opts.apiUrl, opts.apiKey, providerVars, modelFamily) : undefined);
+  const nowMs = Date.now();
+  const selections = [];
+  for (const envVar of providerVars) {
+    const val = env[envVar];
+    if (val) {
+      const info = availableIndicesMap?.[envVar];
+      let available = info?.availableIndices;
+      let modelBlockedCount = info?.modelBlockedIndices?.length ?? 0;
+      if (available && window && opts?.localBlocks) {
+        const beforeCount = available.length;
+        available = available.filter((i) => {
+          const blockedUntilMs = opts.localBlocks?.get(`${envVar}:${i}:${window}`);
+          return blockedUntilMs === undefined || blockedUntilMs <= nowMs;
+        });
+        modelBlockedCount += beforeCount - available.length;
+      }
+      const seatBlockedIndices = info?.seatBlockedIndices ?? [];
+      const seatBlockedCount = seatBlockedIndices.length;
+      let seatFallbackIndices;
+      if (opts?.enforceModelCapacity && modelFamily && available && available.length === 0) {
+        const policy = (env.MODEL_WINDOW_EXHAUSTED_POLICY ?? "fail").trim().toLowerCase();
+        const windowExhausted = window !== undefined && modelBlockedCount > 0 && policy !== "fallback";
+        if (seatBlockedCount > 0) {
+          seatFallbackIndices = splitCredentialPool(val).map((_, i) => i).filter((i) => !seatBlockedIndices.includes(i));
+        }
+        if (windowExhausted || seatFallbackIndices?.length === 0) {
+          throw new ModelWindowExhaustedError({
+            model: modelFamily,
+            window: window ?? "",
+            earliestResetAt: info?.earliestModelResetAt ?? null,
+            keyType: envVar,
+            seatBlockedCount,
+            modelBlockedCount
+          });
+        }
+      }
+      const result = seatFallbackIndices ? { ...selectCredential(val, seatFallbackIndices, envVar), isRateLimitFallback: true } : selectCredential(val, available, envVar);
+      env[envVar] = result.selected;
+      const availInfo = available ? ` (${available.length} available of ${result.total})` : "";
+      console.log(`[credentials] Selected ${envVar} credential ${result.index + 1}/${result.total}${availInfo} [...${result.keySuffix}]${info?.rejectedIndices?.length ? ` (${info.rejectedIndices.length} rejected)` : ""}`);
+      selections.push({
+        ...result,
+        modelBlockedIndices: info?.modelBlockedIndices,
+        earliestModelResetAt: info?.earliestModelResetAt,
+        seatBlockedIndices: info?.seatBlockedIndices
+      });
+    }
+  }
+  return selections;
+}
+var CREDENTIAL_POOL_VARS, PROVIDER_CREDENTIAL_VARS, SLASH_MODEL_PROVIDERS, MODEL_LABELS, ModelWindowExhaustedError, CLAUDE_CREDENTIALS_HINT = "Set CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY, or route Claude Code through a gateway (ANTHROPIC_BASE_URL + ANTHROPIC_AUTH_TOKEN or ANTHROPIC_API_KEY), Microsoft Foundry (CLAUDE_CODE_USE_FOUNDRY), Amazon Bedrock (CLAUDE_CODE_USE_BEDROCK), or Google Vertex AI (CLAUDE_CODE_USE_VERTEX).", CLAUDE_CREDENTIAL_TYPE_BY_PROVIDER;
+var init_credentials = __esm(() => {
+  init_src2();
+  init_src();
+  init_model_rate_limit_windows();
+  CREDENTIAL_POOL_VARS = [
+    "CLAUDE_CODE_OAUTH_TOKEN",
+    "ANTHROPIC_API_KEY",
+    "OPENROUTER_API_KEY",
+    "OPENAI_API_KEY",
+    "CODEX_OAUTH",
+    "DEVIN_API_KEY",
+    "DEEPSEEK_API_KEY",
+    "AMP_API_KEY",
+    "CURSOR_API_KEY",
+    "XAI_API_KEY",
+    ...openAICompatibleProviders().map((p) => p.envVar)
+  ];
+  PROVIDER_CREDENTIAL_VARS = {
+    claude: ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"],
+    pi: ["OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "OPENAI_API_KEY"],
+    codex: ["OPENAI_API_KEY", "CODEX_OAUTH"],
+    devin: ["DEVIN_API_KEY"],
+    dsh: ["OPENROUTER_API_KEY", "DEEPSEEK_API_KEY"],
+    amp: ["AMP_API_KEY"],
+    cursor: ["CURSOR_API_KEY"],
+    grok: ["XAI_API_KEY", "OPENROUTER_API_KEY"],
+    opencode: ["OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "OPENAI_API_KEY"]
+  };
+  SLASH_MODEL_PROVIDERS = new Set(["opencode", "pi"]);
+  MODEL_LABELS = {
+    fable: "Fable",
+    opus: "Opus",
+    sonnet: "Sonnet",
+    haiku: "Haiku"
+  };
+  ModelWindowExhaustedError = class ModelWindowExhaustedError extends Error {
+    model;
+    window;
+    earliestResetAt;
+    keyType;
+    seatBlockedCount;
+    modelBlockedCount;
+    constructor(opts) {
+      const modelLabel = MODEL_LABELS[opts.model];
+      const seatBlockedCount = opts.seatBlockedCount ?? 0;
+      const modelBlockedCount = opts.modelBlockedCount ?? 0;
+      const windowClause = modelBlockedCount > 0 && opts.earliestResetAt ? `${modelBlockedCount} keys have the ${modelLabel} window exhausted until ${opts.earliestResetAt}` : `${modelBlockedCount} keys have the ${modelLabel} window exhausted`;
+      super(seatBlockedCount > 0 ? `No ${opts.keyType} key can run ${modelLabel}: ${seatBlockedCount} keys are on a seat without ${modelLabel}, ${windowClause}. Re-dispatch with another model or modelTier.` : `No ${opts.keyType} key has ${modelLabel} capacity until ${opts.earliestResetAt ?? "unknown"}. Re-dispatch with another model or modelTier.`);
+      this.name = "ModelWindowExhaustedError";
+      this.model = opts.model;
+      this.window = opts.window;
+      this.earliestResetAt = opts.earliestResetAt;
+      this.keyType = opts.keyType;
+      this.seatBlockedCount = seatBlockedCount;
+      this.modelBlockedCount = modelBlockedCount;
+    }
+  };
+  CLAUDE_CREDENTIAL_TYPE_BY_PROVIDER = {
+    "claude-subscription": "oauth",
+    anthropic: "api_key",
+    "anthropic-gateway": "gateway"
+  };
+});
+
+export { getRouteProvider, createScopedFetch, routeCredentialStatus, validateRoute, isFirstPartyAnthropicUrl, CODEX_GATEWAY_API_KEY, deriveDefaultRoute, routeUnsetEnv, init_src, MODEL_SCOPED_WINDOWS, modelFamilyOf, windowForModelFamily, isModelScopedWindow, parseModelLimitMessage, parseCreditsRequiredMessage, activeModelBlock, activeModelBlocks, init_model_rate_limit_windows, CREDENTIAL_POOL_VARS, normalizeProviderKeyAliases, deriveProviderFromKeyType, ModelWindowExhaustedError, splitCredentialPool, selectCredential, CLAUDE_CREDENTIALS_HINT, validateClaudeCredentials, openAICompatibleKeyLabels, validateOpencodeCredentials, resolveCredentialPools, init_credentials };