@omnicross/subscriptions 0.1.0

package/dist/index.cjs

@@ -0,0 +1,1679 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  SubscriptionAccountService: () => SubscriptionAccountService,
+  SubscriptionDispatcher: () => SubscriptionDispatcher,
+  SubscriptionProviderRegistry: () => SubscriptionProviderRegistry,
+  claudeOAuth: () => claude_exports,
+  codexOAuth: () => codex_exports,
+  geminiOAuth: () => gemini_exports,
+  getSubscriptionAccountService: () => getSubscriptionAccountService,
+  getSubscriptionProviderRegistry: () => getSubscriptionProviderRegistry,
+  setSubscriptionAccountService: () => setSubscriptionAccountService,
+  setSubscriptionProviderRegistry: () => setSubscriptionProviderRegistry
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/auth/OAuthBearerAuthStrategy.ts
+var REFRESH_LEAD_MS = 5 * 6e4;
+var OAuthBearerAuthStrategy = class {
+  constructor(providerId, tokens, mutex) {
+    this.tokens = tokens;
+    this.mutex = mutex;
+    this.providerId = providerId;
+  }
+  tokens;
+  mutex;
+  kind = "oauth-bearer";
+  providerId;
+  async applyHeaders(headers, _hints) {
+    const token = await this.resolveAccessToken();
+    if (!token) {
+      return;
+    }
+    headers["Authorization"] = `Bearer ${token}`;
+  }
+  async onUnauthorized() {
+    return this.mutex.run(`${this.providerId}:refresh`, async () => {
+      try {
+        return this.providerId === "codex" ? await this.tokens.refreshCodexToken() : await this.tokens.refreshGeminiToken();
+      } catch (err) {
+        console.warn(`[OAuthBearerAuthStrategy] ${this.providerId} refresh failed:`, err);
+        return false;
+      }
+    });
+  }
+  async describeStatus() {
+    const config = await this.tokens.getFullConfig();
+    const entry = this.providerId === "codex" ? config.codex : config.gemini;
+    if (!entry?.accessToken) {
+      return { providerId: this.providerId, ok: false, reason: "missing-credential" };
+    }
+    if (entry.status === "expired") {
+      return {
+        providerId: this.providerId,
+        ok: false,
+        reason: entry.refreshToken ? "expired" : "reauth-required",
+        expiresAt: entry.expiresAt
+      };
+    }
+    return { providerId: this.providerId, ok: true, expiresAt: entry.expiresAt };
+  }
+  /** Read the current token, refreshing in-line if it's within the lead window. */
+  async resolveAccessToken() {
+    const config = await this.tokens.getFullConfig();
+    const entry = this.providerId === "codex" ? config.codex : config.gemini;
+    if (!entry?.accessToken) return null;
+    const expiresAtMs = entry.expiresAt ? new Date(entry.expiresAt).getTime() : 0;
+    const expiringSoon = expiresAtMs > 0 && Date.now() >= expiresAtMs - REFRESH_LEAD_MS;
+    if (expiringSoon && entry.refreshToken) {
+      const refreshed = await this.mutex.run(`${this.providerId}:refresh`, async () => {
+        return this.providerId === "codex" ? await this.tokens.refreshCodexToken() : await this.tokens.refreshGeminiToken();
+      });
+      if (!refreshed) return null;
+      const fresh = await this.tokens.getFullConfig();
+      const freshEntry = this.providerId === "codex" ? fresh.codex : fresh.gemini;
+      return freshEntry?.accessToken ?? null;
+    }
+    if (entry.status === "expired") return null;
+    return entry.accessToken;
+  }
+};
+
+// src/auth/PassThroughAuthStrategy.ts
+var PassThroughAuthStrategy = class {
+  constructor(tokens, mutex) {
+    this.tokens = tokens;
+    this.mutex = mutex;
+  }
+  tokens;
+  mutex;
+  kind = "pass-through";
+  providerId = "claude";
+  async applyHeaders(headers, _hints) {
+    const token = await this.tokens.getValidClaudeAccessToken();
+    if (!token) return;
+    headers["Authorization"] = `Bearer ${token}`;
+  }
+  async onUnauthorized() {
+    return this.mutex.run("claude:refresh", async () => {
+      try {
+        return await this.tokens.refreshClaudeToken();
+      } catch (err) {
+        console.warn("[PassThroughAuthStrategy] Claude refresh failed:", err);
+        return false;
+      }
+    });
+  }
+  async describeStatus() {
+    const config = await this.tokens.getFullConfig();
+    const claude = config.claude;
+    if (!claude?.accessToken) {
+      return { providerId: "claude", ok: false, reason: "missing-credential" };
+    }
+    if (claude.status === "expired") {
+      return {
+        providerId: "claude",
+        ok: false,
+        reason: claude.refreshToken ? "expired" : "reauth-required",
+        expiresAt: claude.expiresAt
+      };
+    }
+    return { providerId: "claude", ok: true, expiresAt: claude.expiresAt };
+  }
+};
+
+// src/auth/RefreshMutex.ts
+var RefreshMutex = class {
+  inflight = /* @__PURE__ */ new Map();
+  /**
+   * Run `task()` exclusively for `key`. If another caller is already running
+   * for the same key, this call awaits the existing promise instead of
+   * starting a new one — both get the SAME result.
+   */
+  async run(key, task) {
+    const existing = this.inflight.get(key);
+    if (existing) return existing;
+    const promise = (async () => {
+      try {
+        return await task();
+      } finally {
+        this.inflight.delete(key);
+      }
+    })();
+    this.inflight.set(key, promise);
+    return promise;
+  }
+};
+
+// src/auth/StaticBearerAuthStrategy.ts
+var ANTHROPIC_SHAPE_PATH = "/v1/messages";
+var StaticBearerAuthStrategy = class {
+  constructor(tokens) {
+    this.tokens = tokens;
+  }
+  tokens;
+  kind = "static-bearer";
+  providerId = "opencodego";
+  async applyHeaders(headers, hints) {
+    const key = await this.tokens.getValidOpenCodeGoApiKey();
+    if (!key) {
+      return;
+    }
+    headers["Authorization"] = `Bearer ${key}`;
+    if (hints?.upstreamUrl?.includes(ANTHROPIC_SHAPE_PATH)) {
+      headers["x-api-key"] = key;
+    }
+  }
+  async onUnauthorized() {
+    return false;
+  }
+  async describeStatus() {
+    const config = await this.tokens.getFullConfig();
+    const oc = config.opencodego;
+    if (!oc?.apiKey) {
+      return { providerId: "opencodego", ok: false, reason: "missing-credential" };
+    }
+    if (oc.status === "error") {
+      return { providerId: "opencodego", ok: false, reason: "unknown" };
+    }
+    return { providerId: "opencodego", ok: true };
+  }
+};
+
+// src/SubscriptionAccountService.ts
+var DISPLAY_NAMES = {
+  claude: "Claude (Anthropic OAuth)",
+  codex: "Codex (ChatGPT OAuth)",
+  gemini: "Gemini (Google OAuth)",
+  opencodego: "OpenCodeGo (Bearer key)"
+};
+var SubscriptionAccountService = class {
+  mutex = new RefreshMutex();
+  strategies;
+  constructor(tokens) {
+    this.strategies = /* @__PURE__ */ new Map([
+      ["claude", new PassThroughAuthStrategy(tokens, this.mutex)],
+      ["codex", new OAuthBearerAuthStrategy("codex", tokens, this.mutex)],
+      ["gemini", new OAuthBearerAuthStrategy("gemini", tokens, this.mutex)],
+      ["opencodego", new StaticBearerAuthStrategy(tokens)]
+    ]);
+  }
+  /** Returns the strategy bound to a subscription provider, or `null` for unknown ids. */
+  getStrategy(providerId) {
+    return this.strategies.get(providerId) ?? null;
+  }
+  /** Diagnostic for the `subscription:status` IPC. */
+  async getStatus(providerId) {
+    const strategy = this.strategies.get(providerId);
+    if (!strategy) {
+      return { providerId, ok: false, reason: "unknown" };
+    }
+    return strategy.describeStatus();
+  }
+  /** Catalog entry list for the `subscription:list` IPC. */
+  async listAll() {
+    const entries = [];
+    for (const [providerId, strategy] of this.strategies.entries()) {
+      entries.push({
+        providerId,
+        displayName: DISPLAY_NAMES[providerId],
+        kind: strategy.kind,
+        credentialStatus: await strategy.describeStatus()
+      });
+    }
+    return entries;
+  }
+};
+var _moduleSingleton = null;
+function setSubscriptionAccountService(svc) {
+  _moduleSingleton = svc;
+}
+function getSubscriptionAccountService() {
+  return _moduleSingleton;
+}
+
+// ../core/src/outbound-api/subscriptionRegistryPort.ts
+var _registry = null;
+function setSubscriptionRegistryForOutbound(registry) {
+  _registry = registry;
+}
+
+// ../core/src/transformer/transformers/GeminiCodeAssistTransformer.ts
+var DEFAULT_CODE_ASSIST_ENDPOINT = "https://cloudcode-pa.googleapis.com";
+var DEFAULT_CODE_ASSIST_API_VERSION = "v1internal";
+function resolveCodeAssistEndpoint() {
+  return (process.env.CODE_ASSIST_ENDPOINT || DEFAULT_CODE_ASSIST_ENDPOINT).replace(/\/+$/, "");
+}
+function resolveCodeAssistApiVersion() {
+  return process.env.CODE_ASSIST_API_VERSION || DEFAULT_CODE_ASSIST_API_VERSION;
+}
+function buildCodeAssistUrl(stream) {
+  const base = resolveCodeAssistEndpoint();
+  const version = resolveCodeAssistApiVersion();
+  const method = stream ? "streamGenerateContent?alt=sse" : "generateContent";
+  return `${base}/${version}:${method}`;
+}
+
+// src/opencodego/CircuitBreaker.ts
+var CircuitBreaker = class {
+  state = "closed";
+  /** CONSECUTIVE failures while closed (reset by any closed success). */
+  failureCount = 0;
+  /** Successes accumulated in the current half-open probe window. */
+  successCount = 0;
+  /** Test calls admitted in the current half-open window (cap = halfOpenMaxCalls). */
+  halfOpenCalls = 0;
+  /** `now()` at the last recorded failure — drives the open→half-open elapsed check. */
+  lastFailureTime = 0;
+  threshold;
+  openMs;
+  halfOpenMaxCalls;
+  now;
+  constructor(opts = {}) {
+    this.threshold = opts.threshold ?? 3;
+    this.openMs = opts.openMs ?? 3e4;
+    this.halfOpenMaxCalls = opts.halfOpenMaxCalls ?? 3;
+    this.now = opts.now ?? Date.now;
+  }
+  /** Current state (diagnostics / tests). */
+  getState() {
+    return this.state;
+  }
+  /**
+   * Admission gate (`fallback.go:54-72` `AllowRequest`). Returns whether a
+   * request to this model is allowed RIGHT NOW. Side-effecting BY DESIGN:
+   *   - `closed`    → always admit.
+   *   - `open`      → if `now() - lastFailureTime > openMs`, FLIP to `half-open`,
+   *                   reset the probe counters, admit the FIRST test call;
+   *                   otherwise reject.
+   *   - `half-open` → admit while `halfOpenCalls < halfOpenMaxCalls`, counting
+   *                   each admission; reject once the cap is reached (until a
+   *                   recorded outcome resolves the state).
+   */
+  allowRequest() {
+    switch (this.state) {
+      case "closed":
+        return true;
+      case "open":
+        if (this.now() - this.lastFailureTime > this.openMs) {
+          this.state = "half-open";
+          this.successCount = 0;
+          this.halfOpenCalls = 1;
+          return true;
+        }
+        return false;
+      case "half-open":
+        if (this.halfOpenCalls < this.halfOpenMaxCalls) {
+          this.halfOpenCalls += 1;
+          return true;
+        }
+        return false;
+      default:
+        return true;
+    }
+  }
+  /**
+   * Record a successful attempt (`fallback.go:75-91` `RecordSuccess`).
+   *   - `half-open` → increment `successCount`; at `halfOpenMaxCalls` successes,
+   *     CLOSE the circuit and reset all counters.
+   *   - `closed`    → reset the consecutive `failureCount` (a single good call
+   *     clears the streak).
+   */
+  recordSuccess() {
+    if (this.state === "half-open") {
+      this.successCount += 1;
+      if (this.successCount >= this.halfOpenMaxCalls) {
+        this.state = "closed";
+        this.failureCount = 0;
+        this.successCount = 0;
+        this.halfOpenCalls = 0;
+      }
+      return;
+    }
+    this.failureCount = 0;
+  }
+  /**
+   * Record a failed attempt (`fallback.go:94-115` `RecordFailure`).
+   *   - `half-open` → immediately RE-OPEN (one probe failure is enough); stamp
+   *     `lastFailureTime`, reset `successCount`.
+   *   - `closed`    → increment the consecutive `failureCount`; at `threshold`,
+   *     OPEN the circuit. Always stamp `lastFailureTime`.
+   */
+  recordFailure() {
+    this.lastFailureTime = this.now();
+    if (this.state === "half-open") {
+      this.state = "open";
+      this.successCount = 0;
+      this.halfOpenCalls = 0;
+      return;
+    }
+    this.failureCount += 1;
+    if (this.failureCount >= this.threshold) {
+      this.state = "open";
+    }
+  }
+};
+var CircuitBreakerRegistry = class {
+  constructor(options = {}) {
+    this.options = options;
+  }
+  options;
+  breakers = /* @__PURE__ */ new Map();
+  /** Get (or lazily create) the breaker for a model id. */
+  get(modelId) {
+    let breaker = this.breakers.get(modelId);
+    if (!breaker) {
+      breaker = new CircuitBreaker(this.options);
+      this.breakers.set(modelId, breaker);
+    }
+    return breaker;
+  }
+  /** Admission gate for a model (creates a fresh closed breaker on first sight). */
+  allowRequest(modelId) {
+    return this.get(modelId).allowRequest();
+  }
+  /** Record a successful attempt for a model. */
+  recordSuccess(modelId) {
+    this.get(modelId).recordSuccess();
+  }
+  /** Record a failed attempt for a model. */
+  recordFailure(modelId) {
+    this.get(modelId).recordFailure();
+  }
+};
+
+// src/opencodego/defaults.ts
+var DEFAULT_OPENCODEGO_LONG_CONTEXT_THRESHOLD = 8e4;
+var DEFAULT_OPENCODEGO_MODEL_MAP = {
+  default: {
+    modelId: "kimi-k2.6",
+    temperature: 0.7,
+    maxTokens: 4096
+  },
+  long_context: {
+    modelId: "minimax-m2.5",
+    contextThreshold: DEFAULT_OPENCODEGO_LONG_CONTEXT_THRESHOLD
+  },
+  think: {
+    modelId: "glm-5"
+  },
+  complex: {
+    // Reference maps `complex` → `glm-5.1` (config.example.json:55-60); was
+    // drifted to `mimo-v2-pro` (audit D4).
+    modelId: "glm-5.1"
+  },
+  fast: {
+    modelId: "qwen3.6-plus"
+  },
+  // AUTO-SELECTABLE (D3): the scenario router auto-selects `background` via the
+  // keyword heuristics in `ScenarioRouter.resolveOpenCodeGoScenario` (NO
+  // tool-blocker keyword AND ≥1 background keyword). It also remains reachable via
+  // an explicit user `modelMap.background` key. Mirrors config.example.json:9-15.
+  background: {
+    modelId: "qwen3.5-plus",
+    temperature: 0.5,
+    maxTokens: 2048
+  }
+};
+var DEFAULT_OPENCODEGO_FALLBACKS = {
+  default: [
+    { modelId: "mimo-v2-pro" },
+    { modelId: "qwen3.6-plus" }
+  ],
+  long_context: [
+    { modelId: "minimax-m2.7" },
+    { modelId: "kimi-k2.6" }
+  ],
+  think: [
+    { modelId: "kimi-k2.6" },
+    { modelId: "mimo-v2-pro" }
+  ],
+  complex: [
+    { modelId: "glm-5" },
+    { modelId: "kimi-k2.6" }
+  ],
+  fast: [
+    { modelId: "qwen3.5-plus" },
+    { modelId: "minimax-m2.5" }
+  ],
+  // AUTO-SELECTABLE (D3) — see DEFAULT_OPENCODEGO_MODEL_MAP.background. Mirrors
+  // config.example.json:69-73.
+  background: [
+    { modelId: "qwen3.6-plus" },
+    { modelId: "minimax-m2.5" }
+  ]
+};
+
+// src/opencodego/endpoints.ts
+var OPENCODEGO_OPENAI_SHAPE_URL = "https://opencode.ai/zen/go/v1/chat/completions";
+var OPENCODEGO_ANTHROPIC_SHAPE_URL = "https://opencode.ai/zen/go/v1/messages";
+var OPENCODEGO_ZEN_CHAT_URL = "https://opencode.ai/zen/v1/chat/completions";
+var OPENCODEGO_ZEN_ANTHROPIC_URL = "https://opencode.ai/zen/v1/messages";
+var OPENCODEGO_ZEN_RESPONSES_URL = "https://opencode.ai/zen/v1/responses";
+var OPENCODEGO_ZEN_GEMINI_BASE = "https://opencode.ai/zen/v1/models/";
+var OPENCODEGO_CHAT_PATH = "/v1/chat/completions";
+var OPENCODEGO_ANTHROPIC_PATH = "/v1/messages";
+var OPENCODEGO_RESPONSES_PATH = "/v1/responses";
+var OPENCODEGO_GEMINI_PATH = "/v1/models/";
+function normalizeOpenCodeGoBaseUrl(base) {
+  return base.replace(/\/+$/, "").replace(/\/v\d+(\/.*)?$/, "");
+}
+function defaultUrlFor(half, shape) {
+  if (half === "zen") {
+    switch (shape) {
+      case "anthropic":
+        return OPENCODEGO_ZEN_ANTHROPIC_URL;
+      case "responses":
+        return OPENCODEGO_ZEN_RESPONSES_URL;
+      case "gemini":
+        return OPENCODEGO_ZEN_GEMINI_BASE;
+      case "chat":
+      default:
+        return OPENCODEGO_ZEN_CHAT_URL;
+    }
+  }
+  return shape === "anthropic" ? OPENCODEGO_ANTHROPIC_SHAPE_URL : OPENCODEGO_OPENAI_SHAPE_URL;
+}
+function pathFor(shape) {
+  switch (shape) {
+    case "anthropic":
+      return OPENCODEGO_ANTHROPIC_PATH;
+    case "responses":
+      return OPENCODEGO_RESPONSES_PATH;
+    case "gemini":
+      return OPENCODEGO_GEMINI_PATH;
+    case "chat":
+    default:
+      return OPENCODEGO_CHAT_PATH;
+  }
+}
+function buildOpenCodeGoUrl(half, shape, baseOverride) {
+  if (baseOverride) {
+    const base = normalizeOpenCodeGoBaseUrl(baseOverride);
+    return `${base}${pathFor(shape)}`;
+  }
+  return defaultUrlFor(half, shape);
+}
+
+// src/opencodego/model-shape.ts
+var GO_ANTHROPIC_SHAPE_PREFIXES = ["minimax-", "minimax_"];
+function isZenResponsesModel(modelId) {
+  return modelId.startsWith("gpt-5") || modelId.endsWith("-codex");
+}
+function isZenGeminiModel(modelId) {
+  return modelId.startsWith("gemini-");
+}
+function isZenAnthropicModel(modelId) {
+  if (modelId.startsWith("claude") || modelId.startsWith("minimax")) return true;
+  return modelId === "qwen3.7-max";
+}
+function classifyZenShape(modelId) {
+  const normalized = modelId.toLowerCase();
+  if (isZenAnthropicModel(normalized)) return "anthropic";
+  if (isZenGeminiModel(normalized)) return "gemini";
+  if (isZenResponsesModel(normalized)) return "responses";
+  return "chat";
+}
+function resolveOpenCodeGoShape(entry) {
+  const half = entry.provider ?? "go";
+  if (half === "zen") return classifyZenShape(entry.modelId);
+  const normalized = entry.modelId.toLowerCase();
+  if (GO_ANTHROPIC_SHAPE_PREFIXES.some((p) => normalized.startsWith(p))) {
+    return "anthropic";
+  }
+  return "chat";
+}
+function resolveOpenCodeGoHalf(modelId, config) {
+  if (!config) return "go";
+  for (const entry of Object.values(config.modelMap ?? {})) {
+    if (entry?.modelId === modelId) return entry.provider ?? "go";
+  }
+  for (const list of Object.values(config.fallbacks ?? {})) {
+    for (const entry of list ?? []) {
+      if (entry?.modelId === modelId) return entry.provider ?? "go";
+    }
+  }
+  return "go";
+}
+
+// src/opencodego/ScenarioRouter.ts
+var COMPLEX_KEYWORDS = [
+  // Architectural
+  "architect",
+  "architecture",
+  "refactor",
+  "redesign",
+  "complex",
+  "difficult",
+  "challenging",
+  "optimize",
+  "performance",
+  "efficiency",
+  "design pattern",
+  "best practice",
+  // Tool-related keywords indicate complex operations
+  "execute",
+  "run command",
+  "bash",
+  "shell",
+  "implement",
+  "build",
+  "create",
+  "add feature",
+  "write to",
+  "edit file",
+  "create file"
+];
+var THINKING_KEYWORDS = [
+  "think",
+  "thinking",
+  "plan",
+  "reason",
+  "reasoning",
+  "analyze",
+  "analysis",
+  "step by step"
+];
+var ANT_THINKING_MARKER = "antThinking";
+var TOOL_BLOCKERS = [
+  "tool",
+  "function",
+  "execute",
+  "run command",
+  "write",
+  "edit",
+  "create",
+  "delete",
+  "remove",
+  "implement",
+  "build",
+  "add",
+  "modify"
+];
+var BACKGROUND_KEYWORDS = [
+  "list directory",
+  "ls -",
+  "dir",
+  "show file",
+  "view file",
+  "cat file",
+  "what is",
+  "what's",
+  "tell me about",
+  "check status",
+  "show status"
+];
+function toLowerSlices(matchText) {
+  if (!matchText || matchText.length === 0) return [];
+  return matchText.map((s) => s.toLowerCase());
+}
+function containsAny(loweredSlices, keywords) {
+  for (const slice of loweredSlices) {
+    for (const kw of keywords) {
+      if (slice.includes(kw)) return true;
+    }
+  }
+  return false;
+}
+function hasComplexPattern(loweredSlices) {
+  return containsAny(loweredSlices, COMPLEX_KEYWORDS);
+}
+function hasThinkingPattern(loweredSlices, rawSlices) {
+  if (containsAny(loweredSlices, THINKING_KEYWORDS)) return true;
+  for (const slice of rawSlices) {
+    if (slice.includes(ANT_THINKING_MARKER)) return true;
+  }
+  return false;
+}
+function hasBackgroundPattern(loweredSlices) {
+  if (containsAny(loweredSlices, TOOL_BLOCKERS)) return false;
+  return containsAny(loweredSlices, BACKGROUND_KEYWORDS);
+}
+function resolveOpenCodeGoScenario(summary, config) {
+  const longContextThreshold = config?.modelMap?.long_context?.contextThreshold ?? DEFAULT_OPENCODEGO_LONG_CONTEXT_THRESHOLD;
+  if (summary.estimatedInputTokens >= longContextThreshold) {
+    return "long_context";
+  }
+  const rawSlices = summary.matchText ?? [];
+  const loweredSlices = toLowerSlices(summary.matchText);
+  if (hasComplexPattern(loweredSlices)) return "complex";
+  if (hasThinkingPattern(loweredSlices, rawSlices)) return "think";
+  if (hasBackgroundPattern(loweredSlices)) return "background";
+  return "default";
+}
+
+// src/SubscriptionProviderRegistry.ts
+var CLAUDE_MESSAGES_UPSTREAM_URL = "https://api.anthropic.com/v1/messages";
+function opencodegoTransformerNamesForShape(shape) {
+  switch (shape) {
+    case "anthropic":
+      return [];
+    case "responses":
+      return ["openai-response"];
+    case "gemini":
+      return ["gemini"];
+    case "chat":
+    default:
+      return ["opencodego"];
+  }
+}
+function resolveOpenCodeGoTarget(modelId, config) {
+  const half = resolveOpenCodeGoHalf(modelId, config);
+  const shape = resolveOpenCodeGoShape({ provider: half, modelId });
+  return { half, shape };
+}
+var SubscriptionProviderRegistry = class {
+  constructor(accounts, tokens) {
+    this.accounts = accounts;
+    this.tokens = tokens;
+    const claude = this.accounts.getStrategy("claude");
+    const codex = this.accounts.getStrategy("codex");
+    const gemini = this.accounts.getStrategy("gemini");
+    const opencodego = this.accounts.getStrategy("opencodego");
+    if (!claude || !codex || !gemini || !opencodego) {
+      throw new Error("[SubscriptionProviderRegistry] Missing strategy in SubscriptionAccountService");
+    }
+    this.profiles = /* @__PURE__ */ new Map([
+      [
+        "claude",
+        {
+          providerId: "claude",
+          displayName: "Claude (Anthropic OAuth)",
+          authStrategy: claude,
+          // The MAIN claude path stays `pass-through`: the Anthropic-ingress
+          // proxy (`buildCodeCliPassThroughResult` → `handlePassThroughRequest`)
+          // forwards the SDK's Anthropic body VERBATIM to `api.anthropic.com`
+          // with the user's OAuth, and it NEVER reads the two fields below
+          // (`resolveUpstreamUrl` / `providerTransformerNames`) — it hard-codes
+          // the URL and skips the transformer chain + the AuthStrategy entirely.
+          // So these fields are INERT for the pass-through path; they exist
+          // SOLELY so the generalized Codex/Responses route-to plan
+          // (`resolveSubscriptionChain` in `buildSubscriptionPlan`) can serve a
+          // `Codex CLI → Claude subscription` route. That plan needs (a) a
+          // provider transformer chain to re-encode Unified → Anthropic Messages
+          // and (b) an upstream URL — both supplied here, reusing the existing
+          // claude OAuth `authStrategy`. See `cliRouteResolution.ts`
+          // SOUND_SUBSCRIPTION_PROVIDERS for the un-gate rationale.
+          mode: "pass-through",
+          // Route-to (Responses ingress) only: Unified → Anthropic Messages.
+          resolveUpstreamUrl: () => CLAUDE_MESSAGES_UPSTREAM_URL,
+          providerTransformerNames: ["anthropic"],
+          modelTransformerNames: []
+        }
+      ],
+      [
+        "codex",
+        {
+          providerId: "codex",
+          displayName: "Codex (ChatGPT OAuth)",
+          authStrategy: codex,
+          mode: "transformer",
+          // ChatGPT internal endpoint — accepts the OpenAI Responses API
+          // format. Mirrors `_others/claude-relay-service/src/routes/openaiRoutes.js:454`.
+          // The Codex OAuth access token grants access here; the public
+          // `api.openai.com/v1/responses` endpoint would reject the same token.
+          resolveUpstreamUrl: () => "https://chatgpt.com/backend-api/codex/responses",
+          providerTransformerNames: ["openai-response"],
+          modelTransformerNames: []
+        }
+      ],
+      [
+        "gemini",
+        {
+          providerId: "gemini",
+          displayName: "Gemini (Google OAuth)",
+          authStrategy: gemini,
+          mode: "transformer",
+          // GAP CLOSED: Gemini CLI subscription tokens are minted for Google's
+          // **Code Assist** endpoint (`cloudcode-pa.googleapis.com`), which
+          // wraps `generateContent` in a project/session envelope and uses a
+          // colon-method URL (`v1internal:generateContent`, NO `/models/<model>`
+          // path — the model lives in the body). The `gemini-code-assist`
+          // transformer now does that envelope work (delegating inner encoding
+          // to the shared gemini utils), and the dispatch seam threads the
+          // resolved Code Assist project id onto `transformerProvider.geminiProject`
+          // (resolved once per account via `GeminiCodeAssistProjectResolver`).
+          // `resolveUpstreamUrl` ignores the model (Code Assist has no per-model
+          // path); the URL is the version-segment colon-method endpoint.
+          resolveUpstreamUrl: (_model) => buildCodeAssistUrl(false),
+          providerTransformerNames: ["gemini-code-assist"],
+          modelTransformerNames: []
+        }
+      ],
+      [
+        "opencodego",
+        {
+          providerId: "opencodego",
+          displayName: "OpenCodeGo (Bearer key)",
+          authStrategy: opencodego,
+          mode: "transformer",
+          // D1 + zen: resolve the per-model `(half, shape)` from the resolved
+          // model id + the opaque per-account config, then build the half-specific
+          // URL honoring the half-appropriate host override (`baseUrl` for go,
+          // `zenBaseUrl` for zen). The OPTIONAL `config` arg is threaded by BOTH
+          // dispatch paths (the `SubscriptionDispatcher` passes its already-fetched
+          // `ocConfig`; the core `/v1/messages` plan builder passes the opaque
+          // `route.subscriptionConfig`). With NO zen config every resolved model
+          // is go-half → byte-identical to the prior resolver.
+          // `// UNVERIFIED (no live zen key)`: the zen endpoint hosts/paths are
+          // ported from the reference + proven in-process only.
+          resolveUpstreamUrl: (model, config) => {
+            const oc = config;
+            const { half, shape } = resolveOpenCodeGoTarget(model, oc);
+            const override = half === "zen" ? oc?.zenBaseUrl : oc?.baseUrl;
+            return buildOpenCodeGoUrl(half, shape, override);
+          },
+          // zen seam (Decision 3): vary the provider transformer chain by resolved
+          // shape (anthropic⇒[] verbatim, chat⇒opencodego, responses⇒openai-response,
+          // gemini⇒gemini). OPTIONAL on the profile type — only opencodego sets it;
+          // claude/codex/gemini omit it and fall back to `providerTransformerNames`,
+          // keeping their routing byte-identical. The static `providerTransformerNames`
+          // below stays the go-half default both ingress paths use when this method
+          // is somehow unconsulted.
+          resolveProviderTransformerNames: (model, config) => {
+            const { shape } = resolveOpenCodeGoTarget(model, config);
+            return opencodegoTransformerNamesForShape(shape);
+          },
+          providerTransformerNames: ["opencodego"],
+          modelTransformerNames: [],
+          modelMapper: (sdkModel, summary, config) => {
+            const scenario = resolveOpenCodeGoScenario(summary, config);
+            const entry = config?.modelMap?.[scenario] ?? config?.modelMap?.default ?? DEFAULT_OPENCODEGO_MODEL_MAP[scenario] ?? DEFAULT_OPENCODEGO_MODEL_MAP.default;
+            if (!entry) {
+              return { resolvedModel: sdkModel, scenario };
+            }
+            return { resolvedModel: entry.modelId, scenario };
+          },
+          // D2 CONSULT: skip both already-attempted models AND models whose
+          // circuit is open. `breaker.allowRequest(modelId)` is the admission
+          // gate — calling it has the side effect of flipping an `open` model to
+          // `half-open` once its 30s window elapses AND counting a half-open admit
+          // slot. It MUST therefore be consulted EXACTLY ONCE per returned model,
+          // on the candidate about to be attempted — mirroring the reference
+          // (`fallback.go` calls `AllowRequest` once, on the model it returns).
+          // An early-returning scan (NOT `Array.filter`, which would `allowRequest`
+          // every candidate and burn the admit slots of half-open models AFTER the
+          // chosen one — those are never attempted, never recorded, so they would
+          // wedge permanently in half-open). When NO circuit is open this returns
+          // the same first non-attempted entry as the prior `!attempted` filter.
+          nextFallback: (scenario, attempted, config) => {
+            const list = config?.fallbacks?.[scenario] ?? DEFAULT_OPENCODEGO_FALLBACKS[scenario] ?? [];
+            for (const entry of list) {
+              if (attempted.includes(entry.modelId)) continue;
+              if (this.breaker.allowRequest(entry.modelId)) return entry;
+            }
+            return null;
+          },
+          // D2 PRIMARY-GATING: admission gate the loops consult for the PRIMARY
+          // (mapped) model before attempt #1 — `nextFallback` only covers
+          // fallbacks. Same side-effecting `allowRequest` semantics.
+          allowModel: (modelId) => this.breaker.allowRequest(modelId),
+          // D3 RECORD: the cross-path seam. Both fallback loops call this after
+          // each attempt; it drives the per-model breaker. Only the opencodego
+          // profile sets it — claude / codex / gemini leave it UNSET (no-op).
+          recordModelOutcome: (modelId, ok) => ok ? this.breaker.recordSuccess(modelId) : this.breaker.recordFailure(modelId)
+        }
+      ]
+    ]);
+  }
+  accounts;
+  tokens;
+  profiles;
+  /**
+   * Per-model circuit breaker for opencodego routing (D5). ONE registry-owned
+   * process singleton, built here and captured by the opencodego profile's
+   * `nextFallback` (consult) + `recordModelOutcome` (record) closures. Because
+   * the `SubscriptionProviderRegistry` is itself a process singleton (via
+   * `setSubscriptionProviderRegistry`), breaker state persists across requests —
+   * exactly the reference's long-lived `FallbackHandler`. Constructed with the
+   * default reference thresholds (3 / 30s / 3) and the default `Date.now` clock.
+   */
+  breaker = new CircuitBreakerRegistry();
+  /** Returns the dispatch profile for a known subscription provider, or
+   *  `null` for unknown ids (callers must treat null as "fall back to the
+   *  legacy LLM provider DB lookup"). */
+  getProfile(providerId) {
+    return this.profiles.get(providerId) ?? null;
+  }
+  /** Read the currently-stored OpenCodeGo config so the proxy can pick up
+   *  user overrides (modelMap / fallbacks / baseUrl). Wraps the injected
+   *  `SubscriptionCredentialStore` so the proxy doesn't need to know about
+   *  that surface. */
+  async getOpenCodeGoConfig() {
+    const full = await this.tokens.getFullConfig();
+    return full.opencodego;
+  }
+};
+var _moduleSingleton2 = null;
+function setSubscriptionProviderRegistry(svc) {
+  _moduleSingleton2 = svc;
+  setSubscriptionRegistryForOutbound(svc ?? null);
+}
+function getSubscriptionProviderRegistry() {
+  return _moduleSingleton2;
+}
+
+// ../core/src/ports/gemini-code-assist-resolver.ts
+var resolver = null;
+function getGeminiCodeAssistResolver() {
+  return resolver;
+}
+
+// ../core/src/provider-proxy/matchText.ts
+var MATCH_TEXT_PER_MESSAGE_CAP = 8192;
+var MATCH_TEXT_RECENT_MESSAGES = 6;
+function flattenMatchText(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) {
+    const parts = [];
+    for (const item of value) {
+      const text = flattenMatchText(item);
+      if (text) parts.push(text);
+    }
+    return parts.join("\n");
+  }
+  if (value && typeof value === "object") {
+    const obj = value;
+    if (obj.type === "tool_result" && obj.content !== void 0) {
+      return flattenMatchText(obj.content);
+    }
+    if (typeof obj.text === "string") return obj.text;
+  }
+  return "";
+}
+function collectMatchText(anthropicBody) {
+  const messages = Array.isArray(anthropicBody.messages) ? anthropicBody.messages : [];
+  const slices = [];
+  const sys = flattenMatchText(anthropicBody.system).trim();
+  if (sys) slices.push(sys.slice(0, MATCH_TEXT_PER_MESSAGE_CAP));
+  const recent = [];
+  for (let i = messages.length - 1; i >= 0 && recent.length < MATCH_TEXT_RECENT_MESSAGES; i--) {
+    const message = messages[i];
+    if (!message || typeof message !== "object") continue;
+    const role = message.role;
+    if (role !== "user" && role !== "system") continue;
+    const text = flattenMatchText(message.content).trim();
+    if (text) recent.push(text.slice(0, MATCH_TEXT_PER_MESSAGE_CAP));
+  }
+  for (let i = recent.length - 1; i >= 0; i--) slices.push(recent[i]);
+  return slices;
+}
+
+// ../core/src/serializeError.ts
+function serializeError(err) {
+  if (err == null) return "Unknown error (null)";
+  if (err instanceof Error) {
+    let msg = err.message || err.name || "Error";
+    if (err.cause) {
+      msg += ` [cause: ${serializeError(err.cause)}]`;
+    }
+    const anyErr = err;
+    if (anyErr.status != null) msg += ` (status: ${anyErr.status})`;
+    else if (anyErr.code != null) msg += ` (code: ${anyErr.code})`;
+    return msg;
+  }
+  if (typeof err === "string") return err || "Empty error string";
+  if (typeof err !== "object") return String(err);
+  const obj = err;
+  if (typeof obj.message === "string" && obj.message) {
+    let msg = obj.message;
+    if (obj.status != null) msg += ` (status: ${obj.status})`;
+    else if (obj.code != null) msg += ` (code: ${obj.code})`;
+    if (typeof obj.type === "string") msg += ` [type: ${obj.type}]`;
+    return msg;
+  }
+  if (typeof obj.error === "string" && obj.error) {
+    return obj.error;
+  }
+  if (obj.error && typeof obj.error === "object") {
+    const inner = obj.error;
+    if (typeof inner.message === "string" && inner.message) {
+      let msg = inner.message;
+      if (typeof inner.type === "string") msg += ` [type: ${inner.type}]`;
+      return msg;
+    }
+  }
+  try {
+    const json = JSON.stringify(err, getCircularReplacer(), 2);
+    if (json && json.length > 1e3) {
+      return json.slice(0, 1e3) + "... (truncated)";
+    }
+    return json || "Unserializable error";
+  } catch {
+    return `Unserializable error: ${Object.prototype.toString.call(err)}`;
+  }
+}
+function getCircularReplacer() {
+  const seen = /* @__PURE__ */ new WeakSet();
+  return (_key, value) => {
+    if (typeof value === "object" && value !== null) {
+      if (seen.has(value)) return "[Circular]";
+      seen.add(value);
+    }
+    return value;
+  };
+}
+
+// src/opencodego/token-count.ts
+var cachedEncode = null;
+function estimateTokensCachedSync(text) {
+  if (!text) return 0;
+  if (cachedEncode) {
+    return cachedEncode(text).length;
+  }
+  return Math.ceil(text.length / 4);
+}
+
+// src/SubscriptionDispatcher.ts
+var SubscriptionDispatcher = class {
+  constructor(profile, hooks, getOpenCodeGoConfig) {
+    this.profile = profile;
+    this.hooks = hooks;
+    this.getOpenCodeGoConfig = getOpenCodeGoConfig;
+  }
+  profile;
+  hooks;
+  getOpenCodeGoConfig;
+  /**
+   * Entry point — called by the host proxy's request handler after model
+   * resolution and probe-detection.
+   */
+  async dispatch(req) {
+    const ocConfig = this.profile.providerId === "opencodego" ? await this.getOpenCodeGoConfig() : void 0;
+    let scenario = "default";
+    let resolvedModel = req.fallbackModel;
+    if (this.profile.modelMapper) {
+      const summary = this.buildRequestSummary(req.anthropicBody);
+      const mapped = this.profile.modelMapper(req.sdkModel, summary, ocConfig);
+      resolvedModel = mapped.resolvedModel;
+      scenario = mapped.scenario;
+      req.anthropicBody.model = resolvedModel;
+    }
+    const upstreamUrl = this.profile.resolveUpstreamUrl?.(resolvedModel, ocConfig);
+    if (!upstreamUrl) {
+      throw new Error(`[SubscriptionDispatcher] profile=${this.profile.providerId} missing resolveUpstreamUrl`);
+    }
+    if (this.profile.providerId === "opencodego" && resolveOpenCodeGoShape({
+      provider: resolveOpenCodeGoHalf(resolvedModel, ocConfig),
+      modelId: resolvedModel
+    }) === "anthropic") {
+      await this.dispatchAnthropicShapeBypass(req, upstreamUrl, resolvedModel, scenario, ocConfig);
+      return;
+    }
+    await this.dispatchTransformerChain(req, upstreamUrl, resolvedModel, scenario, ocConfig);
+  }
+  /** Bypass path for OpenCodeGo MiniMax models — forwards Anthropic body verbatim. */
+  async dispatchAnthropicShapeBypass(req, upstreamUrl, resolvedModel, scenario, ocConfig) {
+    const gate = this.gatePrimaryModel(resolvedModel, scenario, ocConfig);
+    const attempted = gate.attempted;
+    let currentModel = gate.firstModel;
+    while (attempted.length < MAX_FALLBACK_ATTEMPTS_LOCAL) {
+      attempted.push(currentModel);
+      req.anthropicBody.model = currentModel;
+      const headers = { "content-type": "application/json" };
+      await this.applyHeadersWithRetry(headers, { upstreamUrl, resolvedModel: currentModel });
+      console.info(
+        `[AgentProxy:subscription] REQ#${req.reqId} | opencodego anthropic-shape -> ${upstreamUrl} model=${currentModel} attempt=${attempted.length}`
+      );
+      try {
+        const upstream = await this.hooks.fetchWithRetry(upstreamUrl, headers, req.anthropicBody, currentModel);
+        this.profile.recordModelOutcome?.(currentModel, true);
+        await this.hooks.writeProxyResponse(req.res, upstream, req.isStream, req.reqId);
+        return;
+      } catch (err) {
+        const handled = await this.maybeRetryAfterError(err, headers, req, currentModel);
+        if (handled.retryOnce) {
+          const upstream = await this.hooks.fetchWithRetry(upstreamUrl, handled.headers, req.anthropicBody, currentModel);
+          this.profile.recordModelOutcome?.(currentModel, true);
+          await this.hooks.writeProxyResponse(req.res, upstream, req.isStream, req.reqId);
+          return;
+        }
+        if (caughtErrorBreakerOutcome(err) === "failure") {
+          this.profile.recordModelOutcome?.(currentModel, false);
+        }
+        const next = this.profile.nextFallback?.(scenario, attempted, ocConfig);
+        if (!next || attempted.length >= MAX_FALLBACK_ATTEMPTS_LOCAL) {
+          throw err;
+        }
+        console.warn(
+          `[AgentProxy:subscription] REQ#${req.reqId} | opencodego fallback ${currentModel} -> ${next.modelId} after error:`,
+          serializeError(err)
+        );
+        currentModel = next.modelId;
+      }
+    }
+  }
+  /** Standard subscription transformer chain — Codex/Gemini/OpenCodeGo OpenAI-shape. */
+  async dispatchTransformerChain(req, upstreamUrl, resolvedModel, scenario, ocConfig) {
+    const providerNames = this.profile.resolveProviderTransformerNames?.(resolvedModel, ocConfig) ?? this.profile.providerTransformerNames;
+    const providerTransformers = this.resolveTransformers(providerNames);
+    const modelTransformers = this.resolveTransformers(this.profile.modelTransformerNames);
+    const transformerProvider = {
+      name: this.profile.providerId,
+      baseUrl: upstreamUrl,
+      apiKey: "",
+      // Subscription mode uses AuthStrategy; transformer auth is stripped.
+      models: [resolvedModel]
+    };
+    if (this.profile.providerId === "gemini") {
+      transformerProvider.geminiProject = await this.resolveGeminiProject();
+    }
+    const gate = this.gatePrimaryModel(resolvedModel, scenario, ocConfig);
+    const attempted = gate.attempted;
+    let currentModel = gate.firstModel;
+    while (attempted.length < MAX_FALLBACK_ATTEMPTS_LOCAL) {
+      attempted.push(currentModel);
+      req.anthropicBody.model = currentModel;
+      const { requestBody, config } = await this.hooks.executor.executeRequestChain(
+        req.anthropicBody,
+        transformerProvider,
+        { providerTransformers, modelTransformers },
+        { endpointTransformer: this.hooks.endpointTransformer }
+      );
+      const headers = {
+        "content-type": "application/json",
+        ...config.headers
+      };
+      stripAuthHeaders(headers);
+      await this.applyHeadersWithRetry(headers, { upstreamUrl, resolvedModel: currentModel });
+      const fetchUrl = usesResponsesChain(providerNames) ? upstreamUrl : resolveConfigUrl(config.url) ?? upstreamUrl;
+      console.info(
+        `[AgentProxy:subscription] REQ#${req.reqId} | provider=${this.profile.providerId} -> ${fetchUrl} model=${currentModel} attempt=${attempted.length}`
+      );
+      try {
+        const upstream = await this.hooks.fetchWithRetry(fetchUrl, headers, requestBody, currentModel);
+        this.profile.recordModelOutcome?.(currentModel, true);
+        const finalResponse = await this.hooks.executor.executeResponseChain(
+          requestBody,
+          upstream,
+          transformerProvider,
+          { providerTransformers, modelTransformers },
+          { endpointTransformer: this.hooks.endpointTransformer }
+        );
+        await this.hooks.writeProxyResponse(req.res, finalResponse, req.isStream, req.reqId);
+        return;
+      } catch (err) {
+        const handled = await this.maybeRetryAfterError(err, headers, req, currentModel);
+        if (handled.retryOnce) {
+          const upstream = await this.hooks.fetchWithRetry(fetchUrl, handled.headers, requestBody, currentModel);
+          this.profile.recordModelOutcome?.(currentModel, true);
+          const finalResponse = await this.hooks.executor.executeResponseChain(
+            requestBody,
+            upstream,
+            transformerProvider,
+            { providerTransformers, modelTransformers },
+            { endpointTransformer: this.hooks.endpointTransformer }
+          );
+          await this.hooks.writeProxyResponse(req.res, finalResponse, req.isStream, req.reqId);
+          return;
+        }
+        if (caughtErrorBreakerOutcome(err) === "failure") {
+          this.profile.recordModelOutcome?.(currentModel, false);
+        }
+        const next = this.profile.nextFallback?.(scenario, attempted, ocConfig);
+        if (!next || attempted.length >= MAX_FALLBACK_ATTEMPTS_LOCAL) {
+          throw err;
+        }
+        console.warn(
+          `[AgentProxy:subscription] REQ#${req.reqId} | ${this.profile.providerId} fallback ${currentModel} -> ${next.modelId} after error:`,
+          serializeError(err)
+        );
+        currentModel = next.modelId;
+      }
+    }
+  }
+  /**
+   * D2 PRIMARY-GATING (opencodego, D5): pick the first-attempt model for a
+   * fallback loop. Consults the breaker for the mapped primary; when the primary's
+   * circuit is open, advance to the first admitting `nextFallback` candidate
+   * WITHOUT an upstream round-trip on the open primary. When EVERY candidate is
+   * open (all-open) the breaker FAILS OPEN — it attempts the original primary
+   * anyway. Returns the resolved first-attempt model plus the `attempted` list
+   * seeded for the loop (the SKIPPED primary is recorded at chain index 0 so the
+   * loop's `nextFallback` excludes it; on fail-open the list is left empty so the
+   * primary is the first real attempt). When the profile has no `allowModel`
+   * (claude / codex / gemini, or breaker unset) this is byte-identical to the
+   * prior behavior: the primary is the first attempt, `attempted` empty.
+   */
+  gatePrimaryModel(primaryModel, scenario, ocConfig) {
+    if (!this.profile.allowModel || this.profile.allowModel(primaryModel)) {
+      return { firstModel: primaryModel, attempted: [] };
+    }
+    const skipped = [primaryModel];
+    const firstAdmitting = this.profile.nextFallback?.(scenario, skipped, ocConfig);
+    if (firstAdmitting) {
+      console.warn(
+        `[AgentProxy:subscription] opencodego primary ${primaryModel} circuit open -> first admitting fallback ${firstAdmitting.modelId}`
+      );
+      return { firstModel: firstAdmitting.modelId, attempted: skipped };
+    }
+    console.warn(
+      `[AgentProxy:subscription] all opencodego circuits open -> fail open to primary ${primaryModel}`
+    );
+    return { firstModel: primaryModel, attempted: [] };
+  }
+  /**
+   * On a 401 error from the upstream, ask the AuthStrategy whether to retry.
+   * Returns `{ retryOnce: true, headers }` when the strategy refreshed
+   * successfully (caller should retry once); otherwise re-throws.
+   */
+  async maybeRetryAfterError(err, headers, req, resolvedModel) {
+    const status = err?.status ?? 0;
+    if (status !== 401) {
+      return { retryOnce: false, headers };
+    }
+    const refreshed = await this.profile.authStrategy.onUnauthorized();
+    if (!refreshed) {
+      console.warn(
+        `[AgentProxy:subscription] REQ#${req.reqId} | 401 not recoverable for provider=${this.profile.providerId}`
+      );
+      return { retryOnce: false, headers };
+    }
+    const fresh = { ...headers };
+    stripAuthHeaders(fresh);
+    await this.applyHeadersWithRetry(fresh, { upstreamUrl: "", resolvedModel });
+    return { retryOnce: true, headers: fresh };
+  }
+  async applyHeadersWithRetry(headers, hints) {
+    try {
+      await this.profile.authStrategy.applyHeaders(headers, hints);
+    } catch (err) {
+      console.warn("[AgentProxy:subscription] authStrategy.applyHeaders threw:", serializeError(err));
+    }
+  }
+  /**
+   * Resolve the Code Assist project for the gemini subscription profile. Pulls
+   * the Bearer the bound `AuthStrategy` would inject (so the strategy stays the
+   * single source of the token), then runs the cached handshake. Returns
+   * `undefined` for a fresh free-tier account (valid — the envelope omits the
+   * project). A handshake hard failure (403/429) propagates to the dispatch
+   * error handler.
+   */
+  async resolveGeminiProject() {
+    const probe = {};
+    await this.applyHeadersWithRetry(probe, { upstreamUrl: "", resolvedModel: "" });
+    const bearer = probe.Authorization ?? probe.authorization ?? "";
+    const accessToken = bearer.replace(/^Bearer\s+/i, "").trim();
+    if (!accessToken) return void 0;
+    const resolver2 = getGeminiCodeAssistResolver();
+    if (!resolver2) return void 0;
+    return resolver2.resolveProject(accessToken);
+  }
+  resolveTransformers(names) {
+    if (!names || names.length === 0) return [];
+    const resolved = [];
+    for (const name of names) {
+      const t = this.hooks.transformerService.getTransformer(name);
+      if (!t) {
+        console.warn(`[AgentProxy:subscription] Transformer not registered: ${name}`);
+        continue;
+      }
+      const instance = typeof t === "function" ? new t() : t;
+      resolved.push(instance);
+    }
+    return resolved;
+  }
+  /** Build a lightweight request summary for OpenCodeGo scenario routing. */
+  buildRequestSummary(anthropicBody) {
+    const messages = Array.isArray(anthropicBody.messages) ? anthropicBody.messages : [];
+    let totalChars = 0;
+    const system = anthropicBody.system;
+    if (typeof system === "string") {
+      totalChars += system.length;
+    } else if (Array.isArray(system)) {
+      for (const block of system) {
+        if (block && typeof block === "object" && "text" in block) {
+          totalChars += String(block.text ?? "").length;
+        }
+      }
+    }
+    for (const msg of messages) {
+      const m = msg;
+      const c = m.content;
+      if (typeof c === "string") {
+        totalChars += c.length;
+      } else if (Array.isArray(c)) {
+        for (const block of c) {
+          if (block && typeof block === "object") {
+            const b = block;
+            if (b.type === "text" && typeof b.text === "string") {
+              totalChars += b.text.length;
+            } else if (b.type === "tool_result" && typeof b.content === "string") {
+              totalChars += b.content.length;
+            }
+          }
+        }
+      }
+    }
+    return {
+      messageCount: messages.length,
+      estimatedInputTokens: estimateTokensCachedSync("x".repeat(totalChars)),
+      // Shared core flattener (single source of truth) so this dispatcher path
+      // and the core `/v1/messages` path produce IDENTICAL `matchText` for the
+      // same body — equivalence by construction. `@omnicross/subscriptions` →
+      // `@omnicross/core` is the allowed direction; core imports nothing back.
+      matchText: collectMatchText(anthropicBody)
+    };
+  }
+};
+var MAX_FALLBACK_ATTEMPTS_LOCAL = 3;
+function caughtErrorBreakerOutcome(err) {
+  const status = err?.status;
+  if (typeof status !== "number") return "failure";
+  if (status === 0) return "neutral";
+  if (status >= 500 || status === 429) return "failure";
+  if (status >= 400 && status < 500) return "neutral";
+  return "failure";
+}
+function usesResponsesChain(names) {
+  return !!names && names.includes("openai-response");
+}
+function resolveConfigUrl(url) {
+  if (url instanceof URL) return url.toString();
+  if (typeof url === "string" && url.length > 0) return url;
+  return null;
+}
+function stripAuthHeaders(headers) {
+  delete headers.authorization;
+  delete headers.Authorization;
+  delete headers["x-api-key"];
+  delete headers["X-Api-Key"];
+  delete headers["x-goog-api-key"];
+  delete headers["X-Goog-Api-Key"];
+}
+
+// src/oauth/flows/claude.ts
+var claude_exports = {};
+__export(claude_exports, {
+  exchangeCodeForTokens: () => exchangeCodeForTokens,
+  exchangeSetupTokenCode: () => exchangeSetupTokenCode,
+  generateAuthParams: () => generateAuthParams,
+  generateSetupTokenParams: () => generateSetupTokenParams,
+  refreshAccessToken: () => refreshAccessToken
+});
+var import_node_crypto = __toESM(require("crypto"), 1);
+
+// src/oauth/fetchPort.ts
+function errorMessage(error, errorDescription) {
+  if (errorDescription) return errorDescription;
+  if (typeof error === "string") return error;
+  if (error && typeof error === "object") {
+    const e = error;
+    if (typeof e.message === "string" && e.message) return e.message;
+    if (typeof e.error_description === "string" && e.error_description) {
+      return e.error_description;
+    }
+    return JSON.stringify(error);
+  }
+  return String(error);
+}
+async function postForm(fetchImpl, url, params, parseErrorMessage) {
+  const response = await fetchImpl(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: params.toString()
+  });
+  const responseData = await response.text();
+  let data;
+  try {
+    data = JSON.parse(responseData);
+  } catch {
+    throw new Error(parseErrorMessage);
+  }
+  if (data.error) {
+    throw new Error(errorMessage(data.error, data.error_description));
+  }
+  return data;
+}
+async function postJson(fetchImpl, url, body, parseErrorMessage, extraHeaders = {}) {
+  const response = await fetchImpl(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...extraHeaders },
+    body: JSON.stringify(body)
+  });
+  const responseData = await response.text();
+  let data;
+  try {
+    data = JSON.parse(responseData);
+  } catch {
+    throw new Error(parseErrorMessage);
+  }
+  if (data.error) {
+    throw new Error(errorMessage(data.error, data.error_description));
+  }
+  return data;
+}
+
+// src/oauth/flows/claude.ts
+var CLAUDE_TOKEN_HEADERS = {
+  "User-Agent": "claude-cli/1.0.56 (external, cli)",
+  Accept: "application/json, text/plain, */*",
+  "Accept-Language": "en-US,en;q=0.9",
+  Referer: "https://claude.ai/",
+  Origin: "https://claude.ai"
+};
+var CLAUDE_OAUTH_CONFIG = {
+  clientId: "9d1c250a-e61b-44d9-88ed-5944d1962f5e",
+  authorizationEndpoint: "https://claude.ai/oauth/authorize",
+  // The token endpoint stays on console.anthropic.com (still the live value —
+  // matches the official Claude Code CLI / claude-relay-service reference); only
+  // the OAuth callback moved to platform.claude.com (2026). The redirect_uri MUST
+  // match what the client is registered for AND match between authorize + token
+  // exchange. Scopes mirror the live Claude Code authorize URL.
+  tokenEndpoint: "https://console.anthropic.com/v1/oauth/token",
+  redirectUri: "https://platform.claude.com/oauth/code/callback",
+  scopes: [
+    "org:create_api_key",
+    "user:profile",
+    "user:inference",
+    "user:sessions:claude_code",
+    "user:mcp_servers",
+    "user:file_upload"
+  ]
+};
+var SETUP_TOKEN_CONFIG = {
+  scopes: ["user:inference"]
+  // Only inference permission, no API key creation
+};
+function generatePkce() {
+  const codeVerifier = import_node_crypto.default.randomBytes(32).toString("base64url");
+  const codeChallenge = import_node_crypto.default.createHash("sha256").update(codeVerifier).digest("base64url");
+  const state = import_node_crypto.default.randomBytes(16).toString("hex");
+  return { codeVerifier, codeChallenge, state };
+}
+function generateAuthParams() {
+  const { codeVerifier, codeChallenge, state } = generatePkce();
+  const params = new URLSearchParams({
+    code: "true",
+    client_id: CLAUDE_OAUTH_CONFIG.clientId,
+    response_type: "code",
+    redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
+    scope: CLAUDE_OAUTH_CONFIG.scopes.join(" "),
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    state
+  });
+  const authUrl = `${CLAUDE_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
+  return { authUrl, codeVerifier, state };
+}
+function generateSetupTokenParams() {
+  const { codeVerifier, codeChallenge, state } = generatePkce();
+  const params = new URLSearchParams({
+    code: "true",
+    client_id: CLAUDE_OAUTH_CONFIG.clientId,
+    response_type: "code",
+    redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
+    scope: SETUP_TOKEN_CONFIG.scopes.join(" "),
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    state
+  });
+  const authUrl = `${CLAUDE_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
+  return { authUrl, codeVerifier, state };
+}
+async function exchangeCodeForTokens(request, fetchImpl) {
+  const { authorizationCode, codeVerifier, state } = request;
+  const code = authorizationCode.split("#")[0]?.split("&")[0] ?? authorizationCode;
+  const data = await postJson(
+    fetchImpl,
+    CLAUDE_OAUTH_CONFIG.tokenEndpoint,
+    {
+      grant_type: "authorization_code",
+      client_id: CLAUDE_OAUTH_CONFIG.clientId,
+      code,
+      code_verifier: codeVerifier,
+      redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
+      state
+    },
+    "Failed to parse token response",
+    CLAUDE_TOKEN_HEADERS
+  );
+  return {
+    accessToken: data.access_token,
+    // The authorization_code grant always returns a refresh_token; the original
+    // helper read it from an untyped `data` and declared the field `string`.
+    refreshToken: data.refresh_token,
+    expiresIn: data.expires_in,
+    scopes: data.scope?.split(" ") || CLAUDE_OAUTH_CONFIG.scopes
+  };
+}
+async function exchangeSetupTokenCode(request, fetchImpl) {
+  const { authorizationCode, codeVerifier, state } = request;
+  const code = authorizationCode.split("#")[0]?.split("&")[0] ?? authorizationCode;
+  const data = await postJson(
+    fetchImpl,
+    CLAUDE_OAUTH_CONFIG.tokenEndpoint,
+    {
+      grant_type: "authorization_code",
+      client_id: CLAUDE_OAUTH_CONFIG.clientId,
+      code,
+      code_verifier: codeVerifier,
+      redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
+      state
+    },
+    "Failed to parse setup token response",
+    CLAUDE_TOKEN_HEADERS
+  );
+  return {
+    accessToken: data.access_token,
+    expiresIn: data.expires_in,
+    scopes: data.scope?.split(" ") || SETUP_TOKEN_CONFIG.scopes
+  };
+}
+async function refreshAccessToken(refreshToken, fetchImpl) {
+  const data = await postJson(
+    fetchImpl,
+    CLAUDE_OAUTH_CONFIG.tokenEndpoint,
+    {
+      grant_type: "refresh_token",
+      client_id: CLAUDE_OAUTH_CONFIG.clientId,
+      refresh_token: refreshToken
+    },
+    "Failed to parse refresh response",
+    CLAUDE_TOKEN_HEADERS
+  );
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token || refreshToken,
+    expiresIn: data.expires_in
+  };
+}
+
+// src/oauth/flows/codex.ts
+var codex_exports = {};
+__export(codex_exports, {
+  exchangeCodeForTokens: () => exchangeCodeForTokens2,
+  generateAuthParams: () => generateAuthParams2,
+  refreshAccessToken: () => refreshAccessToken2
+});
+var import_node_crypto2 = __toESM(require("crypto"), 1);
+var CODEX_OAUTH_CONFIG = {
+  clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
+  authorizationEndpoint: "https://auth.openai.com/oauth/authorize",
+  tokenEndpoint: "https://auth.openai.com/oauth/token",
+  redirectUri: "http://localhost:1455/auth/callback",
+  scopes: ["openid", "profile", "email", "offline_access"]
+};
+function generateAuthParams2() {
+  const codeVerifier = import_node_crypto2.default.randomBytes(64).toString("hex");
+  const codeChallenge = import_node_crypto2.default.createHash("sha256").update(codeVerifier).digest("base64url");
+  const state = import_node_crypto2.default.randomBytes(16).toString("hex");
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: CODEX_OAUTH_CONFIG.clientId,
+    redirect_uri: CODEX_OAUTH_CONFIG.redirectUri,
+    scope: CODEX_OAUTH_CONFIG.scopes.join(" "),
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    state
+  });
+  const authUrl = `${CODEX_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
+  return { authUrl, codeVerifier, state };
+}
+async function exchangeCodeForTokens2(request, fetchImpl) {
+  const { authorizationCode, codeVerifier } = request;
+  const params = new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: CODEX_OAUTH_CONFIG.clientId,
+    code: authorizationCode,
+    code_verifier: codeVerifier,
+    redirect_uri: CODEX_OAUTH_CONFIG.redirectUri
+  });
+  const data = await postForm(
+    fetchImpl,
+    CODEX_OAUTH_CONFIG.tokenEndpoint,
+    params,
+    "Failed to parse token response"
+  );
+  return {
+    accessToken: data.access_token,
+    // authorization_code grant returns both; the original helper read them from
+    // an untyped `data` and declared the fields `string`.
+    refreshToken: data.refresh_token,
+    idToken: data.id_token,
+    expiresIn: data.expires_in
+  };
+}
+async function refreshAccessToken2(refreshToken, fetchImpl) {
+  const params = new URLSearchParams({
+    grant_type: "refresh_token",
+    client_id: CODEX_OAUTH_CONFIG.clientId,
+    refresh_token: refreshToken,
+    scope: "openid profile email"
+  });
+  const data = await postForm(
+    fetchImpl,
+    CODEX_OAUTH_CONFIG.tokenEndpoint,
+    params,
+    "Failed to parse refresh response"
+  );
+  return {
+    accessToken: data.access_token,
+    idToken: data.id_token,
+    refreshToken: data.refresh_token || refreshToken,
+    expiresIn: data.expires_in || 3600
+  };
+}
+
+// src/oauth/flows/gemini.ts
+var gemini_exports = {};
+__export(gemini_exports, {
+  exchangeCodeForTokens: () => exchangeCodeForTokens3,
+  generateAuthParams: () => generateAuthParams3,
+  refreshAccessToken: () => refreshAccessToken3
+});
+var import_node_crypto3 = __toESM(require("crypto"), 1);
+var GEMINI_OAUTH_CONFIG = {
+  clientId: "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com",
+  // The Gemini CLI's *public* installed-app OAuth client secret (mirrors the
+  // upstream CLI). Per Google's OAuth docs, native-app client secrets are not
+  // treated as confidential — not a leaked key.
+  clientSecret: "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",
+  // allowlist-secret
+  authorizationEndpoint: "https://accounts.google.com/o/oauth2/v2/auth",
+  tokenEndpoint: "https://oauth2.googleapis.com/token",
+  redirectUri: "urn:ietf:wg:oauth:2.0:oob",
+  scopes: ["https://www.googleapis.com/auth/cloud-platform"]
+};
+function generateAuthParams3() {
+  const codeVerifier = import_node_crypto3.default.randomBytes(32).toString("base64url");
+  const codeChallenge = import_node_crypto3.default.createHash("sha256").update(codeVerifier).digest("base64url");
+  const state = import_node_crypto3.default.randomBytes(16).toString("hex");
+  const params = new URLSearchParams({
+    client_id: GEMINI_OAUTH_CONFIG.clientId,
+    redirect_uri: GEMINI_OAUTH_CONFIG.redirectUri,
+    scope: GEMINI_OAUTH_CONFIG.scopes.join(" "),
+    response_type: "code",
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    state,
+    access_type: "offline",
+    prompt: "consent"
+  });
+  const authUrl = `${GEMINI_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
+  return { authUrl, codeVerifier, state };
+}
+async function exchangeCodeForTokens3(authorizationCode, codeVerifier, fetchImpl) {
+  const params = new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: GEMINI_OAUTH_CONFIG.clientId,
+    client_secret: GEMINI_OAUTH_CONFIG.clientSecret,
+    code: authorizationCode,
+    code_verifier: codeVerifier,
+    redirect_uri: GEMINI_OAUTH_CONFIG.redirectUri
+  });
+  const data = await postForm(
+    fetchImpl,
+    GEMINI_OAUTH_CONFIG.tokenEndpoint,
+    params,
+    "Failed to parse token response"
+  );
+  return {
+    accessToken: data.access_token,
+    // authorization_code grant returns a refresh_token; the original helper read
+    // it from an untyped `data` and declared the field `string`.
+    refreshToken: data.refresh_token,
+    expiresIn: data.expires_in
+  };
+}
+async function refreshAccessToken3(refreshToken, fetchImpl) {
+  const params = new URLSearchParams({
+    grant_type: "refresh_token",
+    client_id: GEMINI_OAUTH_CONFIG.clientId,
+    client_secret: GEMINI_OAUTH_CONFIG.clientSecret,
+    refresh_token: refreshToken
+  });
+  const data = await postForm(
+    fetchImpl,
+    GEMINI_OAUTH_CONFIG.tokenEndpoint,
+    params,
+    "Failed to parse refresh response"
+  );
+  return {
+    accessToken: data.access_token,
+    expiresIn: data.expires_in
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SubscriptionAccountService,
+  SubscriptionDispatcher,
+  SubscriptionProviderRegistry,
+  claudeOAuth,
+  codexOAuth,
+  geminiOAuth,
+  getSubscriptionAccountService,
+  getSubscriptionProviderRegistry,
+  setSubscriptionAccountService,
+  setSubscriptionProviderRegistry
+});