@route_33/opencode 0.4.5 → 0.4.7-rc.10

package/dist/v2-entry/index.js

@@ -0,0 +1,4266 @@
+// src/v2-entry/create-route33-v2-plugin/create-route33-v2-plugin.ts
+import { Integration as Integration2, Plugin } from "@opencode/plugin";
+
+// src/auth/authorization-url-stash/authorization-url-stash.ts
+var FALLBACK_URL = "https://route33.ai";
+var SIGN_IN_INSTRUCTIONS = "Open the Route 33 sign-in link \u2014 your browser will finish at a confirmation page.";
+var FINISHING_INSTRUCTIONS = "Finishing Route 33 setup\u2026";
+var URL_WAIT_BUDGET_MS = 3e4;
+var createAuthorizationUrlStash = () => {
+  let resolveUrl;
+  const nextUrl = new Promise((resolve2) => {
+    resolveUrl = resolve2;
+  });
+  const browserRunner = (url) => {
+    resolveUrl?.(url);
+    return Promise.resolve();
+  };
+  const urlForConnect = async (callback) => {
+    let decide;
+    const decided = new Promise((resolve2) => {
+      decide = resolve2;
+    });
+    const timer = setTimeout(() => {
+      decide({ instructions: SIGN_IN_INSTRUCTIONS, url: FALLBACK_URL });
+    }, URL_WAIT_BUDGET_MS);
+    void nextUrl.then((url) => {
+      clearTimeout(timer);
+      decide({ instructions: SIGN_IN_INSTRUCTIONS, url: url.toString() });
+    });
+    void Promise.resolve(callback).catch(() => void 0).then(() => {
+      clearTimeout(timer);
+      decide({ instructions: FINISHING_INSTRUCTIONS, url: FALLBACK_URL });
+    });
+    return decided;
+  };
+  return { browserRunner, urlForConnect };
+};
+
+// src/cli/read-env-base-url/read-env-base-url.ts
+var readEnvBaseUrl = (env = process.env) => {
+  const value = env["ROUTE33_BASE_URL"]?.trim();
+  return value === "" ? void 0 : value;
+};
+
+// src/cli/read-env-api-base/read-env-api-base.ts
+var readEnvApiBase = (env = process.env) => {
+  const value = env["ROUTE33_API_BASE"]?.trim();
+  return value === "" ? void 0 : value;
+};
+
+// src/cli/read-env-auth-issuer/read-env-auth-issuer.ts
+var readEnvAuthIssuer = (env = process.env) => {
+  const value = env["ROUTE33_AUTH_ISSUER"]?.trim();
+  return value === "" ? void 0 : value;
+};
+
+// src/shared/default-auth-issuer-url/default-auth-issuer-url.ts
+var DEFAULT_AUTH_ISSUER_URL = "https://auth.route33.ai";
+
+// src/shared/default-base-url/default-base-url.ts
+var DEFAULT_BASE_URL = "https://api.route33.ai/v1";
+
+// src/shared/default-management-api-base-url/default-management-api-base-url.ts
+var DEFAULT_MANAGEMENT_API_BASE_URL = "https://mapi.route33.ai/api/v1";
+
+// src/shared/default-catalog-ttl-ms/default-catalog-ttl-ms.ts
+var DEFAULT_CATALOG_TTL_MS = 36e5;
+
+// src/shared/logger/logger.ts
+var logger = {
+  info: (...args) => {
+    console.log("[route_33]", ...args);
+  },
+  warn: (...args) => {
+    console.warn("[route_33]", ...args);
+  },
+  error: (...args) => {
+    console.error("[route_33]", ...args);
+  }
+};
+
+// src/shared/models-dev-ttl-ms/models-dev-ttl-ms.ts
+var MODELS_DEV_TTL_MS = 864e5;
+
+// src/shared/native-sdk-api-key-placeholder/native-sdk-api-key-placeholder.ts
+var NATIVE_SDK_API_KEY_PLACEHOLDER = "__route33_fetch_shim_auth__";
+
+// src/shared/resolve-cache-dir/resolve-cache-dir.ts
+import * as os from "node:os";
+import * as path from "node:path";
+var resolveCacheDir = (env) => {
+  const override = env["ROUTE33_CACHE_DIR"];
+  if (override !== void 0 && override !== "") {
+    return override;
+  }
+  return path.join(
+    env["XDG_CACHE_HOME"] ?? path.join(os.homedir(), ".cache"),
+    "opencode-route33"
+  );
+};
+
+// src/cli/read-env-cache-dir/read-env-cache-dir.ts
+var readEnvCacheDir = (env = process.env) => resolveCacheDir(env);
+
+// src/cli/read-env-catalog-ttl-ms/read-env-catalog-ttl-ms.ts
+var readEnvCatalogTtlMs = (env = process.env) => {
+  const value = Number(env["ROUTE33_CATALOG_TTL_MS"]);
+  return Number.isFinite(value) && value > 0 ? value : DEFAULT_CATALOG_TTL_MS;
+};
+
+// src/cli/read-env-client-id/read-env-client-id.ts
+var readEnvClientId = (env = process.env) => {
+  const value = env["ROUTE33_CLIENT_ID"]?.trim();
+  return value === "" ? void 0 : value;
+};
+
+// src/cli/read-env-direct-api-key/read-env-direct-api-key.ts
+var readEnvDirectApiKey = (env = process.env) => {
+  const value = env["ROUTE33_API_KEY"]?.trim();
+  return value === "" ? void 0 : value;
+};
+
+// src/cli/read-env-disable-id-shim/read-env-disable-id-shim.ts
+var readEnvDisableIdShim = (env = process.env) => env["ROUTE33_DISABLE_ID_SHIM"] === "1";
+
+// src/cli/read-env-discovery/read-env-discovery.ts
+var readEnvDiscovery = (env = process.env) => env["ROUTE33_DISCOVERY"] !== "0";
+
+// src/cli/read-env-strict/read-env-strict.ts
+var readEnvStrict = (env = process.env) => env["ROUTE33_STRICT"] !== "0";
+
+// src/cli/resolve-v1-secret-store-directory/resolve-v1-secret-store-directory.ts
+import * as os2 from "node:os";
+import * as path2 from "node:path";
+var resolveV1SecretStoreDirectory = (options = {}) => {
+  const explicit = options.directory?.trim();
+  if (explicit !== void 0 && explicit.length > 0) {
+    return path2.resolve(explicit);
+  }
+  const hostConfig = (options.env ?? process.env)["OPENCODE_CONFIG_DIR"]?.trim();
+  if (hostConfig !== void 0 && hostConfig.length > 0) {
+    return path2.join(path2.resolve(hostConfig), "route33");
+  }
+  return path2.join(
+    options.homeDirectory ?? os2.homedir(),
+    ".config",
+    "opencode",
+    "route33"
+  );
+};
+
+// src/config/abortable-sleep/abortable-sleep.ts
+var abortableSleep = (milliseconds, signal) => new Promise((resolve2, reject) => {
+  if (signal === void 0) {
+    setTimeout(resolve2, milliseconds);
+    return;
+  }
+  const abortError = () => {
+    const reason = signal.reason;
+    if (reason instanceof Error) {
+      return reason;
+    }
+    return new Error(String(reason), { cause: reason });
+  };
+  if (signal.aborted) {
+    reject(abortError());
+    return;
+  }
+  const onAbort = () => {
+    clearTimeout(timer);
+    reject(abortError());
+  };
+  const timer = setTimeout(() => {
+    signal.removeEventListener("abort", onAbort);
+    resolve2();
+  }, milliseconds);
+  signal.addEventListener("abort", onAbort, { once: true });
+});
+
+// src/config/is-resendable-body/is-resendable-body.ts
+var isResendableBody = (body) => body === void 0 || typeof body === "string" || body instanceof ArrayBuffer || ArrayBuffer.isView(body) || body instanceof Blob || body instanceof URLSearchParams || body instanceof FormData;
+
+// src/contract/predicates/has-string-fields/has-string-fields.ts
+var hasStringFields = (record, fields) => fields.every((field) => typeof record[field] === "string");
+
+// src/contract/predicates/is-nullable-string/is-nullable-string.ts
+var isNullableString = (value) => typeof value === "string" || value === null;
+
+// src/contract/predicates/is-owner-type/is-owner-type.ts
+var isOwnerType = (value) => value === "project" || value === "user_personal" || value === "user_project";
+
+// src/contract/predicates/is-record/is-record.ts
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+
+// src/config/parse-exhaustion-envelope/parse-exhaustion-envelope.ts
+var parseExhaustionEnvelope = async (response) => {
+  let body;
+  try {
+    body = await response.clone().json();
+  } catch (error) {
+    if (error instanceof Error) {
+      return void 0;
+    }
+    throw error;
+  }
+  if (!isRecord(body)) {
+    return void 0;
+  }
+  const nestedError = body["error"];
+  const nestedCode = isRecord(nestedError) ? nestedError["code"] : void 0;
+  if (body["code"] !== "PROVIDER_LANES_EXHAUSTED" && nestedCode !== "PROVIDER_LANES_EXHAUSTED") {
+    return void 0;
+  }
+  const nestedId = isRecord(nestedError) ? nestedError["correlationId"] : void 0;
+  const directId = body["correlationId"];
+  let correlationId;
+  if (typeof directId === "string") {
+    correlationId = directId;
+  } else if (typeof nestedId === "string") {
+    correlationId = nestedId;
+  }
+  return { correlationId };
+};
+
+// src/config/request-model/request-model.ts
+var requestModel = (body) => {
+  if (typeof body !== "string") {
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch (error) {
+    if (error instanceof SyntaxError) {
+      return void 0;
+    }
+    throw error;
+  }
+  return isRecord(parsed) && typeof parsed["model"] === "string" ? parsed["model"] : void 0;
+};
+
+// src/config/retry-wait-seconds/retry-wait-seconds.ts
+var retryWaitSeconds = (options) => {
+  const advised = options.retryAfter !== null && /^\d+$/.test(options.retryAfter) ? Number(options.retryAfter) : void 0;
+  return advised !== void 0 && advised > 0 ? Math.min(advised, options.maxWaitSeconds) : Math.min(
+    options.baseSeconds * 2 ** (options.attempt - 1),
+    options.maxWaitSeconds
+  );
+};
+
+// src/config/exhaustion-retry-fetch/exhaustion-retry-fetch.ts
+var buildExhaustionRetryFetch = (innerFetch, options = {}) => {
+  const sleep = options.sleep ?? abortableSleep;
+  const maxWaitSeconds = options.maxWaitSeconds ?? 1200;
+  const baseSeconds = options.baseSeconds ?? 5;
+  const parseRetryableExhaustion = async (response) => {
+    if (response.status !== 429) {
+      return void 0;
+    }
+    const contentType = response.headers.get("content-type") ?? "";
+    if (!/(?:^|\/)json(?:;|$)|\+json(?:;|$)/i.test(contentType)) {
+      return void 0;
+    }
+    return parseExhaustionEnvelope(response);
+  };
+  return async (input, init) => {
+    const body = init?.body;
+    const signal = init?.signal ?? void 0;
+    const resendable = isResendableBody(body);
+    const model = requestModel(body);
+    for (let attempt = 1; ; attempt += 1) {
+      const response = await innerFetch(input, init);
+      const exhaustion = await parseRetryableExhaustion(response);
+      if (exhaustion === void 0 || !resendable) {
+        return response;
+      }
+      const seconds = retryWaitSeconds({
+        attempt,
+        baseSeconds,
+        maxWaitSeconds,
+        retryAfter: response.headers.get("retry-after")
+      });
+      logger.warn("provider lanes exhausted; retrying", {
+        attempt,
+        correlationId: exhaustion.correlationId,
+        ...model === void 0 ? {} : { model },
+        seconds
+      });
+      await sleep(seconds * 1e3, signal);
+      signal?.throwIfAborted();
+    }
+  };
+};
+
+// src/config/rewrite-openai-body/rewrite-openai-body.ts
+var rewriteOpenAiBody = (body) => {
+  const parseOpenAiRecord = () => {
+    let value;
+    try {
+      value = JSON.parse(body);
+    } catch (error) {
+      if (error instanceof SyntaxError) {
+        return void 0;
+      }
+      throw error;
+    }
+    if (!isRecord(value)) {
+      return void 0;
+    }
+    const model = value["model"];
+    if (typeof model !== "string" || !model.startsWith("openai/")) {
+      return void 0;
+    }
+    return value;
+  };
+  const parsed = parseOpenAiRecord();
+  if (parsed === void 0) {
+    return void 0;
+  }
+  const tools = parsed["tools"];
+  const dropsEffort = "reasoning_effort" in parsed && Array.isArray(tools) && tools.length > 0;
+  const renamesMaxTokens = "max_tokens" in parsed;
+  if (!dropsEffort && !renamesMaxTokens) {
+    return void 0;
+  }
+  const rewritten = { ...parsed };
+  if (dropsEffort) {
+    delete rewritten["reasoning_effort"];
+  }
+  if (renamesMaxTokens) {
+    rewritten["max_completion_tokens"] ??= rewritten["max_tokens"];
+    delete rewritten["max_tokens"];
+  }
+  return JSON.stringify(rewritten);
+};
+
+// src/config/openai-chat-compat-fetch/openai-chat-compat-fetch.ts
+var buildOpenAiChatCompatFetch = (fetchImpl) => (input, init) => {
+  const rewritten = typeof init?.body === "string" ? rewriteOpenAiBody(init.body) : void 0;
+  const finalInit = rewritten === void 0 ? init : { ...init, body: rewritten };
+  return (fetchImpl ?? globalThis.fetch)(input, finalInit);
+};
+
+// src/config/build-options/build-options.ts
+var buildOptions = (baseURL) => ({
+  apiKey: NATIVE_SDK_API_KEY_PLACEHOLDER,
+  baseURL,
+  fetch: buildExhaustionRetryFetch(buildOpenAiChatCompatFetch()),
+  headerTimeout: 15e5
+});
+
+// src/config/native-sdk-by-vendor/native-sdk-by-vendor.ts
+var NATIVE_SDK_BY_VENDOR = {
+  anthropic: "@ai-sdk/anthropic",
+  mistralai: "@ai-sdk/mistral",
+  openai: "@ai-sdk/openai"
+};
+
+// src/config/to-model-patch/to-model-patch.ts
+var toModelPatch = (options) => {
+  const entry = { name: options.meta.name };
+  if (options.routingSlug !== void 0) {
+    entry.id = options.routingSlug;
+  }
+  if (options.nativeNpm !== void 0) {
+    entry.provider = { npm: options.nativeNpm };
+  }
+  const applyMetadata = () => {
+    const capabilities = options.meta.capabilities;
+    entry.attachment = options.meta.attachment ?? capabilities.attachment;
+    if (options.meta.modalities !== void 0) {
+      entry.modalities = structuredClone(options.meta.modalities);
+    }
+    entry.reasoning = options.forceReasoning ? true : capabilities.reasoning;
+    entry.temperature = capabilities.temperature;
+    entry.tool_call = capabilities.tool_call;
+    if (options.meta.cost !== void 0) {
+      entry.cost = structuredClone(options.meta.cost);
+    }
+    if (options.meta.limit !== void 0) {
+      entry.limit = {
+        context: options.meta.limit.context,
+        output: options.meta.limit.output
+      };
+    }
+    if (options.meta.variants !== void 0) {
+      entry.variants = structuredClone(options.meta.variants);
+    }
+  };
+  applyMetadata();
+  const compactEntry = { name: entry.name };
+  for (const [key, value] of Object.entries(entry)) {
+    if (value !== void 0) {
+      compactEntry[key] = value;
+    }
+  }
+  return compactEntry;
+};
+
+// src/config/build-provider-blocks/build-provider-blocks.ts
+var buildProviderBlocks = (enriched, options) => {
+  const models = {};
+  for (const [slug, meta] of Object.entries(enriched).sort(
+    ([left], [right]) => left.localeCompare(right)
+  )) {
+    const separator = slug.indexOf("/");
+    const vendor = separator === -1 ? slug : slug.slice(0, separator);
+    models[slug] = toModelPatch({
+      forceReasoning: vendor === "anthropic",
+      meta,
+      ...NATIVE_SDK_BY_VENDOR[vendor] === void 0 ? {} : { nativeNpm: NATIVE_SDK_BY_VENDOR[vendor] }
+    });
+  }
+  return {
+    route_33: {
+      models,
+      name: "route_33",
+      npm: "@ai-sdk/openai-compatible",
+      options: buildOptions(options.baseURL)
+    }
+  };
+};
+
+// src/config/collected-ref/collected-ref.ts
+var pushRef = (refs, value, source) => {
+  if (typeof value !== "string") {
+    return;
+  }
+  const separator = value.indexOf("/");
+  if (separator <= 0 || separator >= value.length - 1) {
+    return;
+  }
+  const providerId = value.slice(0, separator);
+  const suffix = value.slice(separator + 1);
+  if (providerId === "route_33") {
+    refs.push({ providerId, modelKey: suffix, ref: value, source });
+    return;
+  }
+  if (providerId === "route_33_anthropic") {
+    refs.push({
+      providerId: "route_33",
+      modelKey: `anthropic/${suffix}`,
+      ref: value,
+      source,
+      legacyReplacement: `route_33/anthropic/${suffix}`
+    });
+  }
+};
+
+// src/config/collect-cfg-refs/collect-cfg-refs.ts
+var collectCfgRefs = (config) => {
+  const refs = [];
+  pushRef(refs, config.model, 'opencode config "model"');
+  pushRef(refs, config.small_model, 'opencode config "small_model"');
+  for (const [name, agent] of Object.entries(config.agent ?? {})) {
+    pushRef(refs, agent?.model, `opencode agent "${name}"`);
+  }
+  return refs;
+};
+
+// src/catalog/catalog-fetch-error/catalog-fetch-error.ts
+var CatalogFetchError = class extends Error {
+  constructor(reason, message, statusCode) {
+    super(`catalog fetch failed (${reason}): ${message}`);
+    this.reason = reason;
+    this.statusCode = statusCode;
+    this.name = "CatalogFetchError";
+  }
+  reason;
+  statusCode;
+};
+
+// src/catalog/catalog-cache/cache-file-path/cache-file-path.ts
+import * as path3 from "node:path";
+var cacheFilePath = (keyHash, cacheDir) => path3.join(cacheDir, `catalog-${keyHash}.json`);
+
+// src/catalog/catalog-cache/cache-state/cache-state.ts
+var catalogMemory = /* @__PURE__ */ new Map();
+
+// src/catalog/catalog-cache/cache-version/cache-version.ts
+var CATALOG_CACHE_VERSION = 2;
+
+// src/catalog/catalog-cache/hash-key/hash-key.ts
+import { createHash } from "node:crypto";
+var hashKey = (baseURL, gatewayKey) => createHash("sha256").update(`${baseURL}
+${gatewayKey.value}`).digest("hex").slice(0, 12);
+
+// src/catalog/catalog-cache/is-catalog-model-record/is-catalog-model-record.ts
+var isCatalogModelRecord = (value) => isRecord(value) && Object.values(value).every(
+  (model) => isRecord(model) && typeof model["id"] === "string"
+);
+
+// src/catalog/catalog-cache/read-disk/read-disk.ts
+import * as fs from "node:fs";
+var readDisk = (keyHash, cacheDir) => {
+  try {
+    const parsed = JSON.parse(
+      fs.readFileSync(cacheFilePath(keyHash, cacheDir), "utf8")
+    );
+    if (!isRecord(parsed) || parsed["version"] !== CATALOG_CACHE_VERSION || typeof parsed["fetchedAt"] !== "number" || !isCatalogModelRecord(parsed["models"])) {
+      return void 0;
+    }
+    return {
+      fetchedAt: parsed["fetchedAt"],
+      keyHash,
+      models: parsed["models"]
+    };
+  } catch {
+    return void 0;
+  }
+};
+
+// src/catalog/catalog-cache/read-fresh-catalog/read-fresh-catalog.ts
+var readFreshCatalog = (options) => {
+  const keyHash = hashKey(options.baseURL, options.gatewayKey);
+  const now = options.now ?? Date.now();
+  const requestedTtl = options.catalogTtlMs ?? DEFAULT_CATALOG_TTL_MS;
+  const ttl = Number.isFinite(requestedTtl) && requestedTtl > 0 ? requestedTtl : DEFAULT_CATALOG_TTL_MS;
+  const inMemory = catalogMemory.get(keyHash);
+  if (inMemory !== void 0 && now - inMemory.fetchedAt <= ttl) {
+    return inMemory.models;
+  }
+  const onDisk = readDisk(keyHash, options.cacheDir);
+  if (onDisk === void 0 || now - onDisk.fetchedAt > ttl) {
+    return void 0;
+  }
+  catalogMemory.set(keyHash, onDisk);
+  return onDisk.models;
+};
+
+// src/catalog/catalog-cache/read-stale-catalog/read-stale-catalog.ts
+var readStaleCatalog = (options) => {
+  const keyHash = hashKey(options.baseURL, options.gatewayKey);
+  return (catalogMemory.get(keyHash) ?? readDisk(keyHash, options.cacheDir))?.models;
+};
+
+// src/catalog/catalog-cache/write-catalog/write-catalog.ts
+import * as fs2 from "node:fs";
+var writeCatalog = (options) => {
+  const keyHash = hashKey(options.baseURL, options.gatewayKey);
+  const record = {
+    fetchedAt: options.now ?? Date.now(),
+    keyHash,
+    models: options.models
+  };
+  catalogMemory.set(keyHash, record);
+  try {
+    fs2.mkdirSync(options.cacheDir, { recursive: true });
+    fs2.writeFileSync(
+      cacheFilePath(keyHash, options.cacheDir),
+      JSON.stringify({ version: CATALOG_CACHE_VERSION, ...record })
+    );
+  } catch (error) {
+    logger.warn(
+      `could not persist catalog cache: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+};
+
+// src/catalog/build-cache-read-options/build-cache-read-options.ts
+var buildCacheReadOptions = (options) => ({
+  baseURL: options.baseURL,
+  cacheDir: options.cacheDir,
+  ...options.catalogTtlMs === void 0 ? {} : { catalogTtlMs: options.catalogTtlMs },
+  gatewayKey: options.gatewayKey,
+  ...options.now === void 0 ? {} : { now: options.now }
+});
+
+// src/catalog/build-fetch-catalog-options/build-fetch-catalog-options.ts
+var buildFetchCatalogOptions = (options) => ({
+  baseURL: options.baseURL,
+  gatewayKey: options.gatewayKey,
+  ...options.disableIdShim === void 0 ? {} : { disableIdShim: options.disableIdShim },
+  ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl }
+});
+
+// src/catalog/catalog-models-url/catalog-models-url.ts
+var catalogModelsUrl = (baseURL) => {
+  let normalizedBaseURL = baseURL;
+  while (normalizedBaseURL.endsWith("/")) {
+    normalizedBaseURL = normalizedBaseURL.slice(0, -1);
+  }
+  return `${normalizedBaseURL}/models`;
+};
+
+// src/catalog/default-fetch-timeout-ms/default-fetch-timeout-ms.ts
+var DEFAULT_FETCH_TIMEOUT_MS = 5e3;
+
+// src/contract/adapters/contract-parse-error/contract-parse-error.ts
+var ContractParseError = class extends Error {
+};
+
+// src/contract/adapters/gateway-api-key/gateway-api-key.ts
+var GatewayApiKey = class {
+  value;
+  constructor(value) {
+    this.value = value;
+  }
+};
+
+// src/contract/adapters/management-jwt/management-jwt.ts
+var ManagementJwt = class {
+  value;
+  constructor(value) {
+    this.value = value;
+  }
+};
+
+// src/contract/adapters/parse-gateway-key/parse-gateway-key.ts
+var parseGatewayKey = (value) => {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error("gateway key must be non-empty");
+  }
+  return new GatewayApiKey(value);
+};
+
+// src/contract/adapters/parse-management-jwt/parse-management-jwt.ts
+var parseManagementJwt = (value) => {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error("management token must be non-empty");
+  }
+  return new ManagementJwt(value);
+};
+
+// src/contract/adapters/parse-management-subject/parse-management-subject.ts
+var parseManagementSubject = (credential) => {
+  const encodedPayload = credential.value.split(".")[1];
+  if (encodedPayload === void 0 || encodedPayload.length === 0) {
+    throw new ContractParseError("management token carries no usable subject");
+  }
+  let payload;
+  try {
+    payload = JSON.parse(
+      Buffer.from(encodedPayload, "base64url").toString("utf8")
+    );
+  } catch {
+    throw new ContractParseError("management token payload is not JSON");
+  }
+  if (!isRecord(payload)) {
+    throw new ContractParseError("management token payload is not an object");
+  }
+  const subject = payload["sub"];
+  if (typeof subject !== "string" || subject.length === 0) {
+    throw new ContractParseError("management token carries no usable subject");
+  }
+  return subject;
+};
+
+// src/contract/gateway-catalog/parse-catalog-result/parse-catalog-result.ts
+var parseCatalogResult = (value) => {
+  if (!isRecord(value) || !Array.isArray(value["data"])) {
+    throw new ContractParseError("invalid catalog response");
+  }
+  return value;
+};
+
+// src/catalog/parse-catalog-entries/parse-catalog-entries.ts
+var parseCatalogEntries = (payload) => {
+  if (Array.isArray(payload)) {
+    return payload;
+  }
+  try {
+    return parseCatalogResult(payload).data;
+  } catch (error) {
+    if (error instanceof ContractParseError) {
+      throw new CatalogFetchError("parse", error.message);
+    }
+    throw error;
+  }
+};
+
+// src/catalog/parse-model-capabilities/parse-model-capabilities.ts
+var parseModelCapabilities = (raw) => {
+  if (!isRecord(raw)) {
+    return void 0;
+  }
+  const reasoning = raw["reasoning"] === true;
+  const toolCall = raw["tool_support"] === true;
+  if (!reasoning && !toolCall) {
+    return void 0;
+  }
+  return {
+    ...reasoning ? { reasoning: true } : {},
+    ...toolCall ? { tool_call: true } : {}
+  };
+};
+
+// src/catalog/parse-model-limit/parse-model-limit.ts
+var parseModelLimit = (raw) => {
+  if (!isRecord(raw)) {
+    return void 0;
+  }
+  const context = raw["context"];
+  const output = raw["output"];
+  if (typeof context !== "number" || !Number.isInteger(context) || context <= 0 || typeof output !== "number" || !Number.isInteger(output) || output <= 0) {
+    return void 0;
+  }
+  return { context, output };
+};
+
+// src/catalog/parse-model-modalities/parse-model-modalities.ts
+var MODEL_MODALITIES = /* @__PURE__ */ new Set([
+  "text",
+  "audio",
+  "image",
+  "video",
+  "pdf"
+]);
+var parseModelModalities = (raw) => {
+  if (!isRecord(raw) || !Array.isArray(raw["input"]) || !Array.isArray(raw["output"])) {
+    return void 0;
+  }
+  return {
+    input: raw["input"].filter(
+      (value) => MODEL_MODALITIES.has(value)
+    ),
+    output: raw["output"].filter(
+      (value) => MODEL_MODALITIES.has(value)
+    )
+  };
+};
+
+// src/catalog/parse-model-variants/parse-model-variants.ts
+var parseModelVariants = (raw) => {
+  if (!isRecord(raw)) {
+    return void 0;
+  }
+  const variants = {};
+  for (const [name, value] of Object.entries(raw)) {
+    if (!isRecord(value)) {
+      return void 0;
+    }
+    variants[name] = value;
+  }
+  return variants;
+};
+
+// src/catalog/extract-catalog-model-broadcast/extract-catalog-model-broadcast.ts
+var extractCatalogModelBroadcast = (entry) => {
+  const limit = parseModelLimit(entry["limits"]);
+  const capabilities = parseModelCapabilities(entry["capabilities"]);
+  const variants = parseModelVariants(entry["variants"]);
+  const modalities = parseModelModalities(entry["modalities"]);
+  return {
+    ...limit === void 0 ? {} : { limit },
+    ...capabilities === void 0 ? {} : { capabilities },
+    ...variants === void 0 ? {} : { variants },
+    ...typeof entry["hasZdrLane"] === "boolean" ? { hasZdrLane: entry["hasZdrLane"] } : {},
+    ...modalities === void 0 ? {} : { modalities },
+    ...typeof entry["attachment"] === "boolean" ? { attachment: entry["attachment"] } : {}
+  };
+};
+
+// src/catalog/per-million-rate/per-million-rate.ts
+var perMillionRate = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
+
+// src/catalog/extract-models-dev-pricing/extract-models-dev-pricing.ts
+var extractModelsDevPricing = (raw) => {
+  const input = perMillionRate(raw["input"]);
+  const output = perMillionRate(raw["output"]);
+  if (input === void 0 || output === void 0) {
+    return void 0;
+  }
+  const rawCacheRead = raw["cache_read"];
+  const rawCacheWrite = raw["cache_write"];
+  const cacheRead = perMillionRate(rawCacheRead);
+  const cacheWrite = perMillionRate(rawCacheWrite);
+  if (rawCacheRead !== void 0 && cacheRead === void 0 || rawCacheWrite !== void 0 && cacheWrite === void 0) {
+    return void 0;
+  }
+  return {
+    input,
+    output,
+    currency: "USD",
+    ...cacheRead === void 0 ? {} : { cache_read: cacheRead },
+    ...cacheWrite === void 0 ? {} : { cache_write: cacheWrite }
+  };
+};
+
+// src/catalog/per-token-rate/per-token-rate.ts
+var perTokenRate = (value) => {
+  if (typeof value !== "string" || value.trim() === "") {
+    return void 0;
+  }
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : void 0;
+};
+
+// src/catalog/extract-open-router-pricing/extract-open-router-pricing.ts
+var extractOpenRouterPricing = (raw) => {
+  const input = perTokenRate(raw["prompt"]);
+  const output = perTokenRate(raw["completion"]);
+  if (input === void 0 || output === void 0) {
+    return void 0;
+  }
+  const rawCacheRead = raw["input_cache_read"];
+  const rawCacheWrite = raw["input_cache_write"];
+  const cacheRead = perTokenRate(rawCacheRead);
+  const cacheWrite = perTokenRate(rawCacheWrite);
+  if (rawCacheRead !== void 0 && cacheRead === void 0 || rawCacheWrite !== void 0 && cacheWrite === void 0) {
+    return void 0;
+  }
+  return {
+    input: Number((input * 1e6).toPrecision(12)),
+    output: Number((output * 1e6).toPrecision(12)),
+    currency: "USD",
+    ...cacheRead === void 0 ? {} : { cache_read: Number((cacheRead * 1e6).toPrecision(12)) },
+    ...cacheWrite === void 0 ? {} : { cache_write: Number((cacheWrite * 1e6).toPrecision(12)) }
+  };
+};
+
+// src/catalog/extract-pricing/extract-pricing.ts
+var OPEN_ROUTER_PRICING_KEYS = [
+  "prompt",
+  "completion",
+  "request",
+  "input_cache_read",
+  "input_cache_write"
+];
+var MODELS_DEV_PRICING_KEYS = [
+  "input",
+  "output",
+  "cache_read",
+  "cache_write"
+];
+var extractPricing = (raw) => {
+  if (!isRecord(raw) || raw["currency"] !== void 0 && raw["currency"] !== "USD") {
+    return void 0;
+  }
+  const hasOpenRouterKeys = OPEN_ROUTER_PRICING_KEYS.some((key) => key in raw);
+  const hasModelsDevKeys = MODELS_DEV_PRICING_KEYS.some((key) => key in raw);
+  if (hasOpenRouterKeys === hasModelsDevKeys) {
+    return void 0;
+  }
+  return hasOpenRouterKeys ? extractOpenRouterPricing(raw) : extractModelsDevPricing(raw);
+};
+
+// src/catalog/extract-catalog-model-metadata/extract-catalog-model-metadata.ts
+var extractCatalogModelMetadata = (entry) => {
+  const displayName = typeof entry["display_name"] === "string" ? entry["display_name"].trim() : "";
+  const pricing = isRecord(entry["pricing"]) && extractPricing(entry["pricing"]) !== void 0 ? entry["pricing"] : void 0;
+  return {
+    ...displayName === "" ? {} : { displayName },
+    ...pricing === void 0 ? {} : { pricing }
+  };
+};
+
+// src/catalog/normalize-model-id/normalize-model-id.ts
+var normalizeId = (raw, disableShim = false) => {
+  const id = raw.trim();
+  if (id === "") {
+    logger.warn("dropping empty model id");
+    return void 0;
+  }
+  if (!id.includes(":")) return id;
+  const match = disableShim ? null : /^([^:/]+):global:global:([^:]+):(.+)$/.exec(id);
+  if (match?.[2] !== void 0 && match[3] !== void 0)
+    return `${match[2]}/${match[3]}`;
+  logger.warn(`dropping colon-form model id ${id}`);
+  return void 0;
+};
+
+// src/catalog/parse-catalog-model/parse-catalog-model.ts
+var parseCatalogModel = (entry, disableIdShim = false) => {
+  if (!isRecord(entry) || typeof entry["id"] !== "string") {
+    return void 0;
+  }
+  const id = normalizeId(entry["id"], disableIdShim);
+  if (id === void 0) {
+    return void 0;
+  }
+  return {
+    id,
+    ...extractCatalogModelMetadata(entry),
+    ...extractCatalogModelBroadcast(entry)
+  };
+};
+
+// src/catalog/to-catalog-models/to-catalog-models.ts
+var toCatalogModels = (entries, disableIdShim = false) => {
+  const models = {};
+  for (const entry of entries) {
+    const model = parseCatalogModel(entry, disableIdShim);
+    if (model === void 0 || models[model.id] !== void 0) {
+      continue;
+    }
+    models[model.id] = model;
+  }
+  return models;
+};
+
+// src/catalog/fetch-catalog/fetch-catalog.ts
+var fetchCatalog = async (options) => {
+  const controller = new AbortController();
+  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const timer = setTimeout(() => {
+    controller.abort();
+  }, timeoutMs);
+  const url = catalogModelsUrl(options.baseURL);
+  try {
+    let response;
+    try {
+      response = await (options.fetchImpl ?? fetch)(url, {
+        headers: { Authorization: `Bearer ${options.gatewayKey.value}` },
+        signal: controller.signal
+      });
+    } catch (error) {
+      throw new CatalogFetchError(
+        controller.signal.aborted ? "timeout" : "network",
+        error instanceof Error ? error.message : String(error)
+      );
+    }
+    if (!response.ok) {
+      throw new CatalogFetchError(
+        "http",
+        `${url} responded ${String(response.status)}`,
+        response.status
+      );
+    }
+    let payload;
+    try {
+      payload = await response.json();
+    } catch {
+      throw new CatalogFetchError(
+        controller.signal.aborted ? "timeout" : "parse",
+        controller.signal.aborted ? `body not read within ${String(timeoutMs)}ms` : "response body is not valid JSON"
+      );
+    }
+    const models = toCatalogModels(
+      parseCatalogEntries(payload),
+      options.disableIdShim
+    );
+    logger.info(
+      `fetched ${String(Object.keys(models).length)} model(s) from ${url}`
+    );
+    return models;
+  } finally {
+    clearTimeout(timer);
+  }
+};
+
+// src/catalog/none-catalog-result/none-catalog-result.ts
+var noneCatalogResult = (reason, intentionalOptOut) => {
+  const message = `route33: no model catalog available \u2014 0 models injected (${reason}). route33 is unusable without a catalog: resolve an API key (opencode auth login / ROUTE33_API_KEY) \u2014 the key dictates which models are available.`;
+  if (intentionalOptOut) {
+    logger.info(message);
+  } else {
+    logger.warn(message);
+  }
+  return { models: {}, source: "none" };
+};
+
+// src/catalog/catalog-service/catalog-service.ts
+var getCatalog = async (options) => {
+  try {
+    if (options.discoveryEnabled === false) {
+      return noneCatalogResult(
+        "discovery disabled via ROUTE33_DISCOVERY=0",
+        true
+      );
+    }
+    if (options.gatewayKey === void 0) {
+      return noneCatalogResult("no API key resolved", false);
+    }
+    const cacheOptions = buildCacheReadOptions({
+      baseURL: options.baseURL,
+      cacheDir: options.cacheDir,
+      catalogTtlMs: options.catalogTtlMs,
+      gatewayKey: options.gatewayKey,
+      now: options.now
+    });
+    const fresh = readFreshCatalog(cacheOptions);
+    if (fresh !== void 0) {
+      logger.info(
+        `catalog source: cache (${String(Object.keys(fresh).length)} model(s))`
+      );
+      return { models: fresh, source: "cache" };
+    }
+    try {
+      const live = await fetchCatalog(
+        buildFetchCatalogOptions({
+          baseURL: options.baseURL,
+          disableIdShim: options.disableIdShim,
+          fetchImpl: options.fetchImpl,
+          gatewayKey: options.gatewayKey
+        })
+      );
+      if (Object.keys(live).length === 0) {
+        throw new CatalogFetchError(
+          "parse",
+          "gateway returned an empty catalog"
+        );
+      }
+      writeCatalog({ ...cacheOptions, models: live });
+      logger.info(
+        `catalog source: live (${String(Object.keys(live).length)} model(s))`
+      );
+      return { models: live, source: "live" };
+    } catch (error) {
+      logger.warn(
+        `live catalog fetch failed \u2014 trying stale cache: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+    const stale = readStaleCatalog(cacheOptions);
+    if (stale !== void 0) {
+      logger.info(
+        `catalog source: stale-cache (${String(Object.keys(stale).length)} model(s))`
+      );
+      return { models: stale, source: "stale-cache" };
+    }
+    return {
+      ...noneCatalogResult("live fetch failed and no cache available", false),
+      liveFetchFailed: true
+    };
+  } catch (error) {
+    logger.error(
+      `unexpected catalog-service failure \u2014 no catalog available: ${error instanceof Error ? error.message : String(error)}`
+    );
+    return noneCatalogResult("unexpected internal failure", false);
+  }
+};
+
+// src/enrich/resolve-capabilities/resolve-capabilities.ts
+var resolveCapabilities = (catalogModel, modelsDevLookup) => {
+  const catalogCapabilities = catalogModel?.capabilities ?? {};
+  const modelsDevCapabilities = modelsDevLookup ?? {};
+  const candidates = [
+    [
+      "reasoning",
+      catalogCapabilities.reasoning ?? modelsDevCapabilities.reasoning
+    ],
+    [
+      "tool_call",
+      catalogCapabilities.tool_call ?? modelsDevCapabilities.tool_call
+    ],
+    ["attachment", modelsDevCapabilities.attachment],
+    ["temperature", modelsDevCapabilities.temperature]
+  ];
+  const result = {};
+  for (const [key, value] of candidates) {
+    if (value !== void 0) {
+      result[key] = value;
+    }
+  }
+  return result;
+};
+
+// src/enrich/resolve-model-name/resolve-model-name.ts
+var resolveModelName = (slug, catalogModel) => catalogModel?.id === slug && catalogModel.displayName !== void 0 ? catalogModel.displayName : slug;
+
+// src/enrich/build-model-meta/build-model-meta.ts
+var buildModelMeta = (options) => {
+  const meta = {
+    name: resolveModelName(options.slug, options.catalogModel),
+    capabilities: resolveCapabilities(
+      options.catalogModel,
+      options.modelsDevLookup
+    )
+  };
+  let attachment = options.modelsDevLookup?.attachment;
+  if (options.catalogModel !== void 0) {
+    if (options.catalogModel.modalities !== void 0) {
+      meta.modalities = options.catalogModel.modalities;
+    }
+    if (options.catalogModel.attachment !== void 0) {
+      attachment = options.catalogModel.attachment;
+    }
+    if (options.catalogModel.variants !== void 0) {
+      meta.variants = options.catalogModel.variants;
+    }
+  }
+  if (attachment !== void 0) {
+    meta.attachment = attachment;
+  }
+  if (options.limit !== void 0) {
+    meta.limit = options.limit;
+  }
+  if (options.cost !== void 0) {
+    meta.cost = options.cost;
+  }
+  return meta;
+};
+
+// src/enrich/report-metadata-gaps/report-metadata-gaps.ts
+var reportMetadataGaps = (report) => {
+  if (report.limit === void 0) {
+    if (report.catalogPresent) {
+      logger.warn(
+        `limit metadata unavailable for ${report.slug} \u2014 no context/output ceiling will be enforced until added`
+      );
+    } else {
+      logger.info(
+        `not in the current gateway catalog \u2014 serving cached metadata for ${report.slug}`
+      );
+    }
+  }
+  if (report.cost === void 0) {
+    logger.warn(
+      `cost metadata unavailable for ${report.slug} \u2014 reported cost will be $0 until added`
+    );
+  }
+};
+
+// src/enrich/resolve-cost/resolve-cost.ts
+var resolveCost = (catalogModel, modelsDevLookup) => {
+  const catalogCost = catalogModel?.pricing === void 0 ? void 0 : extractPricing(catalogModel.pricing);
+  return catalogCost ?? modelsDevLookup?.cost;
+};
+
+// src/enrich/resolve-limit/resolve-limit.ts
+var resolveLimit = (catalogModel, modelsDevLookup) => catalogModel?.limit ?? modelsDevLookup?.limit;
+
+// src/enrich/enrich-model/enrich-model.ts
+var enrichModel = (slug, sources) => {
+  const modelsDevLookup = sources.modelsDev.lookup(slug);
+  const catalogModel = sources.catalogModel;
+  const catalogPresent = sources.catalogPresent ?? catalogModel !== void 0;
+  const limit = resolveLimit(catalogModel, modelsDevLookup);
+  const cost = resolveCost(catalogModel, modelsDevLookup);
+  reportMetadataGaps({ slug, catalogPresent, limit, cost });
+  return buildModelMeta({ slug, catalogModel, modelsDevLookup, limit, cost });
+};
+
+// src/enrich/models-dev/load-models-dev/load-models-dev.ts
+import * as path5 from "node:path";
+
+// src/enrich/models-dev/is-expressible-context-tier/is-expressible-context-tier.ts
+var EXPRESSIBLE_TIER_SIZE = 2e5;
+var isExpressibleContextTier = (tier) => {
+  const marker = tier["tier"];
+  return isRecord(marker) && marker["type"] === "context" && marker["size"] === EXPRESSIBLE_TIER_SIZE;
+};
+
+// src/enrich/models-dev/num/num.ts
+var num = (value) => typeof value === "number" && Number.isFinite(value) ? value : void 0;
+
+// src/enrich/models-dev/max-rate/max-rate.ts
+var maxRate = (current, candidate) => {
+  const rate = num(candidate);
+  if (rate === void 0) {
+    return current;
+  }
+  return current === void 0 || rate > current ? rate : current;
+};
+
+// src/enrich/models-dev/parse-rate-block/parse-rate-block.ts
+var parseRateBlock = (value) => {
+  if (!isRecord(value)) {
+    return void 0;
+  }
+  const input = num(value["input"]);
+  const output = num(value["output"]);
+  if (input === void 0 || output === void 0) {
+    return void 0;
+  }
+  const cacheRead = num(value["cache_read"]);
+  const cacheWrite = num(value["cache_write"]);
+  return {
+    input,
+    output,
+    ...cacheRead === void 0 ? {} : { cache_read: cacheRead },
+    ...cacheWrite === void 0 ? {} : { cache_write: cacheWrite }
+  };
+};
+
+// src/enrich/models-dev/collapse-cost-tiers/collapse-cost-tiers.ts
+var collapseCostTiers = (cost, tiers) => {
+  const collapsed = { ...cost };
+  for (const tier of tiers) {
+    if (isExpressibleContextTier(tier)) {
+      if (collapsed.context_over_200k === void 0) {
+        const preciseTier = parseRateBlock(tier);
+        if (preciseTier !== void 0) {
+          collapsed.context_over_200k = preciseTier;
+        }
+      }
+      continue;
+    }
+    collapsed.input = maxRate(collapsed.input, tier["input"]) ?? collapsed.input;
+    collapsed.output = maxRate(collapsed.output, tier["output"]) ?? collapsed.output;
+    const cacheRead = maxRate(collapsed.cache_read, tier["cache_read"]);
+    const cacheWrite = maxRate(collapsed.cache_write, tier["cache_write"]);
+    if (cacheRead !== void 0) {
+      collapsed.cache_read = cacheRead;
+    }
+    if (cacheWrite !== void 0) {
+      collapsed.cache_write = cacheWrite;
+    }
+  }
+  return collapsed;
+};
+
+// src/enrich/models-dev/normalize-cost/normalize-cost.ts
+var normalizeCost = (raw) => {
+  if (!isRecord(raw)) {
+    return void 0;
+  }
+  const baseInput = num(raw["input"]);
+  const baseOutput = num(raw["output"]);
+  if (baseInput === void 0 || baseOutput === void 0) {
+    return void 0;
+  }
+  const cacheRead = num(raw["cache_read"]);
+  const cacheWrite = num(raw["cache_write"]);
+  const contextOver200k = parseRateBlock(raw["context_over_200k"]);
+  const cost = {
+    input: baseInput,
+    output: baseOutput,
+    ...cacheRead === void 0 ? {} : { cache_read: cacheRead },
+    ...cacheWrite === void 0 ? {} : { cache_write: cacheWrite },
+    ...contextOver200k === void 0 ? {} : { context_over_200k: contextOver200k }
+  };
+  const tiers = Array.isArray(raw["tiers"]) ? raw["tiers"].filter(isRecord) : [];
+  return collapseCostTiers(cost, tiers);
+};
+
+// src/enrich/models-dev/normalize-model-limit/normalize-model-limit.ts
+var normalizeModelLimit = (raw) => {
+  if (!isRecord(raw)) {
+    return void 0;
+  }
+  const context = num(raw["context"]);
+  const output = num(raw["output"]);
+  if (context === void 0 || output === void 0) {
+    return void 0;
+  }
+  const input = num(raw["input"]);
+  return {
+    context,
+    output,
+    ...input === void 0 ? {} : { input }
+  };
+};
+
+// src/enrich/models-dev/build-models-dev-lookup/build-models-dev-lookup.ts
+var buildModelsDevLookup = (model) => {
+  const cost = normalizeCost(model["cost"]);
+  const limit = normalizeModelLimit(model["limit"]);
+  const reasoning = model["reasoning"];
+  const toolCall = model["tool_call"];
+  const attachment = model["attachment"];
+  const temperature = model["temperature"];
+  return {
+    ...cost === void 0 ? {} : { cost },
+    ...limit === void 0 ? {} : { limit },
+    ...typeof reasoning === "boolean" ? { reasoning } : {},
+    ...typeof toolCall === "boolean" ? { tool_call: toolCall } : {},
+    ...typeof attachment === "boolean" ? { attachment } : {},
+    ...typeof temperature === "boolean" ? { temperature } : {}
+  };
+};
+
+// src/enrich/models-dev/swap-last/swap-last.ts
+var swapLast = (value, from, to) => {
+  const index = value.lastIndexOf(from);
+  return index === -1 ? value : `${value.slice(0, index)}${to}${value.slice(index + from.length)}`;
+};
+
+// src/enrich/models-dev/vendor-aliases/vendor-aliases.ts
+var VENDOR_ALIASES = {
+  "z-ai": "zai"
+};
+
+// src/enrich/models-dev/probe-candidates/probe-candidates.ts
+var probeCandidates = (slug) => {
+  const separatorIndex = slug.indexOf("/");
+  if (separatorIndex <= 0 || separatorIndex >= slug.length - 1) {
+    return [];
+  }
+  const vendor = slug.slice(0, separatorIndex);
+  const model = slug.slice(separatorIndex + 1);
+  const alias = VENDOR_ALIASES[vendor];
+  const vendors = alias === void 0 || alias === vendor ? [vendor] : [vendor, alias];
+  const swaps = [];
+  for (const candidate of [
+    model.replaceAll(".", "-"),
+    model.replaceAll("-", "."),
+    swapLast(model, ".", "-"),
+    swapLast(model, "-", ".")
+  ]) {
+    if (candidate !== model && !swaps.includes(candidate)) {
+      swaps.push(candidate);
+    }
+  }
+  return [
+    ...vendors.map((provider) => [provider, model]),
+    ...vendors.flatMap(
+      (provider) => swaps.map((candidate) => [provider, candidate])
+    )
+  ];
+};
+
+// src/enrich/models-dev/lookup/lookup.ts
+var lookupSlug = (data, slug) => {
+  for (const [providerKey, modelKey] of probeCandidates(slug)) {
+    const provider = data[providerKey];
+    if (!isRecord(provider) || !isRecord(provider["models"])) {
+      continue;
+    }
+    const model = provider["models"][modelKey];
+    if (isRecord(model)) {
+      return buildModelsDevLookup(model);
+    }
+  }
+  return void 0;
+};
+
+// src/enrich/models-dev/create-models-dev-source/create-models-dev-source.ts
+var createModelsDevSource = (source, data) => ({
+  source,
+  lookup: (slug) => lookupSlug(data, slug)
+});
+
+// src/enrich/models-dev/fetch-live/fetch-live.ts
+var MODELS_DEV_API_URL = "https://models.dev/api.json";
+var FETCH_TIMEOUT_MS = 5e3;
+var fetchLive = async (fetchImpl) => {
+  const controller = new AbortController();
+  const timer = setTimeout(() => {
+    controller.abort();
+  }, FETCH_TIMEOUT_MS);
+  try {
+    const response = await fetchImpl(MODELS_DEV_API_URL, {
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      logger.warn(`models.dev responded ${String(response.status)}`);
+      return void 0;
+    }
+    const body = await response.json();
+    return isRecord(body) ? body : void 0;
+  } catch (error) {
+    logger.warn(
+      "models.dev fetch failed:",
+      error instanceof Error ? error.message : String(error)
+    );
+    return void 0;
+  } finally {
+    clearTimeout(timer);
+  }
+};
+
+// src/enrich/models-dev/read-models-dev-cache/read-models-dev-cache.ts
+import * as fs3 from "node:fs";
+var readModelsDevCache = (cachePath) => {
+  try {
+    const parsed = JSON.parse(fs3.readFileSync(cachePath, "utf8"));
+    if (!isRecord(parsed)) {
+      return void 0;
+    }
+    const fetchedAt = num(parsed["fetchedAt"]);
+    const data = parsed["data"];
+    if (fetchedAt === void 0 || !isRecord(data)) {
+      return void 0;
+    }
+    return { fetchedAt, data };
+  } catch {
+    return void 0;
+  }
+};
+
+// src/enrich/models-dev/write-models-dev-cache/write-models-dev-cache.ts
+import * as fs4 from "node:fs";
+import * as path4 from "node:path";
+var writeModelsDevCache = (cachePath, envelope) => {
+  try {
+    fs4.mkdirSync(path4.dirname(cachePath), { recursive: true });
+    fs4.writeFileSync(cachePath, JSON.stringify(envelope), "utf8");
+  } catch (error) {
+    logger.warn(
+      "failed to write models.dev cache:",
+      error instanceof Error ? error.message : String(error)
+    );
+  }
+};
+
+// src/enrich/models-dev/load-models-dev/load-models-dev.ts
+var CACHE_FILE = "models-dev.json";
+var loadModelsDev = async (options = {}) => {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const cacheDir = options.cacheDir ?? resolveCacheDir({});
+  const ttlMs = options.ttlMs ?? MODELS_DEV_TTL_MS;
+  const now = options.now ?? Date.now;
+  const cachePath = path5.join(cacheDir, CACHE_FILE);
+  const cached = readModelsDevCache(cachePath);
+  if (cached !== void 0 && now() - cached.fetchedAt < ttlMs) {
+    return createModelsDevSource("cache", cached.data);
+  }
+  const live = await fetchLive(fetchImpl);
+  if (live !== void 0) {
+    writeModelsDevCache(cachePath, { fetchedAt: now(), data: live });
+    return createModelsDevSource("live", live);
+  }
+  if (cached !== void 0) {
+    logger.warn("models.dev unreachable \u2014 serving stale cache");
+    return createModelsDevSource("stale-cache", cached.data);
+  }
+  logger.warn(
+    "models.dev unavailable (no network, no cache) \u2014 enrichment source disabled"
+  );
+  return { source: null, lookup: () => void 0 };
+};
+
+// src/config/enrich-catalog/enrich-catalog.ts
+var enrichCatalog = (catalog, modelsDev) => {
+  const enriched = {};
+  for (const catalogModel of Object.values(catalog.models)) {
+    enriched[catalogModel.id] = enrichModel(catalogModel.id, {
+      catalogModel,
+      catalogPresent: true,
+      modelsDev
+    });
+  }
+  return enriched;
+};
+
+// src/config/merge-provider/merge-provider.ts
+var mergeProvider = (target, patch) => {
+  target.npm ??= patch.npm;
+  target.name ??= patch.name;
+  if (target.options === void 0) {
+    target.options = { ...patch.options };
+    return;
+  }
+  for (const [field, value] of Object.entries(patch.options)) {
+    const forced = field === "baseURL" || field === "headers" || field === "apiKey" && value !== NATIVE_SDK_API_KEY_PLACEHOLDER;
+    if (forced || target.options[field] === void 0) {
+      target.options[field] = value;
+    }
+  }
+};
+
+// src/config/merge-config/merge-config.ts
+var mergeConfig = (config, blocks) => {
+  config.provider ??= {};
+  const target = config.provider.route_33 ?? {};
+  config.provider.route_33 = target;
+  mergeProvider(target, blocks.route_33);
+};
+
+// src/config/regenerate-models/regenerate-models.ts
+var regenerateModels = (input) => {
+  if (input.source === "none" && input.failedLiveFetch === true) {
+    const current = Object.fromEntries(
+      Object.entries(input.currentModels ?? {}).filter(
+        (entry) => entry[1] !== void 0
+      ).map(([key, entry]) => [key, structuredClone(entry)])
+    );
+    return { models: current, prunedKeys: [], skipped: true };
+  }
+  const models = Object.fromEntries(
+    Object.entries(input.freshModels).map(([key, entry]) => [
+      key,
+      structuredClone(entry)
+    ])
+  );
+  const prunedKeys = Object.keys(input.currentModels ?? {}).filter((key) => input.freshModels[key] === void 0).sort((left, right) => left.localeCompare(right));
+  return { models, prunedKeys };
+};
+
+// src/config/remove-legacy-manifest/remove-legacy-manifest.ts
+import * as fs5 from "node:fs";
+import * as path6 from "node:path";
+var removeLegacyManifest = (root) => {
+  const file = path6.join(root, ".opencode", "route33-generated.json");
+  try {
+    if (!fs5.existsSync(file)) {
+      return;
+    }
+    fs5.rmSync(file);
+    logger.info(
+      "route_33: removed obsolete route33-generated.json (regeneration is stateless since 0.4.4)"
+    );
+  } catch (error) {
+    logger.info(
+      `route_33: unable to remove legacy route33-generated.json: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+};
+
+// src/config/resolve-provider-base-url/resolve-provider-base-url.ts
+var resolveProviderBaseUrl = (config, override) => {
+  if (override !== void 0) {
+    return override;
+  }
+  const configured = config.provider?.route_33?.options?.["baseURL"];
+  return typeof configured === "string" && configured.trim() !== "" && !configured.startsWith("{env:") ? configured : DEFAULT_BASE_URL;
+};
+
+// src/config/configure-route33/configure-route33.ts
+var configureRoute33 = async (config, options) => {
+  removeLegacyManifest(options.cwd);
+  const gatewayKey = await options.credentialProvider();
+  const baseURL = resolveProviderBaseUrl(config, options.baseURL);
+  const buildCatalogOptions = () => ({
+    baseURL,
+    cacheDir: options.cacheDir,
+    ...options.catalogTtlMs === void 0 ? {} : { catalogTtlMs: options.catalogTtlMs },
+    ...options.disableIdShim === void 0 ? {} : { disableIdShim: options.disableIdShim },
+    ...options.discoveryEnabled === void 0 ? {} : { discoveryEnabled: options.discoveryEnabled },
+    ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl },
+    ...gatewayKey === void 0 ? {} : { gatewayKey }
+  });
+  const buildModelsDevOptions = () => ({
+    cacheDir: options.cacheDir,
+    ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl }
+  });
+  const catalog = await getCatalog(buildCatalogOptions());
+  const modelsDev = await loadModelsDev(buildModelsDevOptions());
+  const blocks = buildProviderBlocks(enrichCatalog(catalog, modelsDev), {
+    baseURL
+  });
+  const mergeableConfig = config;
+  mergeConfig(mergeableConfig, blocks);
+  const provider = mergeableConfig.provider?.route_33;
+  if (provider !== void 0) {
+    const regeneration = regenerateModels({
+      currentModels: provider.models,
+      failedLiveFetch: catalog.liveFetchFailed,
+      freshModels: blocks.route_33.models,
+      source: catalog.source
+    });
+    provider.models = regeneration.models;
+    if (regeneration.skipped === true) {
+      logger.info(
+        "route_33: catalog fetch failed without a cache; preserving existing model entries"
+      );
+    } else {
+      for (const key of regeneration.prunedKeys) {
+        logger.info(
+          `route_33: dropped model entry '${key}' (not in the gateway catalog)`
+        );
+      }
+    }
+  }
+  return {
+    catalogAvailable: catalog.source !== "none",
+    keyResolved: gatewayKey !== void 0
+  };
+};
+
+// src/config/gateway-credential-error/gateway-credential-error.ts
+var GatewayCredentialError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "GatewayCredentialError";
+  }
+};
+
+// src/config/describe-missing/describe-missing.ts
+var describeMissing = (config, missing) => {
+  const sections = missing.map((entry) => {
+    const available = Object.keys(
+      config.provider?.[entry.providerId]?.models ?? {}
+    ).sort((left, right) => left.localeCompare(right)).map((key) => `${entry.providerId}/${key}`).join(", ");
+    return [
+      `  ${entry.ref}`,
+      `    referenced by: ${entry.sources.join(", ")}`,
+      ...entry.legacyReplacement === void 0 ? [] : [`    rename to "${entry.legacyReplacement}"`],
+      `    available on ${entry.providerId}: ${available || "(none)"}`
+    ].join("\n");
+  });
+  return `[route_33] ${String(missing.length)} unresolvable model reference(s):
+
+${sections.join("\n\n")}`;
+};
+
+// src/config/find-missing-refs/find-missing-refs.ts
+var findMissingRefs = (config, refs) => {
+  const byRef = /* @__PURE__ */ new Map();
+  for (const ref of refs) {
+    const models = config.provider?.[ref.providerId]?.models;
+    if (ref.legacyReplacement === void 0 && models?.[ref.modelKey] !== void 0) {
+      continue;
+    }
+    const existing = byRef.get(ref.ref);
+    if (existing === void 0) {
+      byRef.set(ref.ref, {
+        providerId: ref.providerId,
+        modelKey: ref.modelKey,
+        ref: ref.ref,
+        sources: [ref.source],
+        ...ref.legacyReplacement === void 0 ? {} : { legacyReplacement: ref.legacyReplacement }
+      });
+    } else if (!existing.sources.includes(ref.source)) {
+      byRef.set(ref.ref, {
+        ...existing,
+        sources: [...existing.sources, ref.source]
+      });
+    }
+  }
+  return [...byRef.values()].sort(
+    (left, right) => left.ref.localeCompare(right.ref)
+  );
+};
+
+// src/config/inject-stubs/inject-stubs.ts
+var injectStubs = (config, missing) => {
+  config.provider ??= {};
+  for (const entry of missing) {
+    const provider = config.provider[entry.providerId] ?? {};
+    config.provider[entry.providerId] = provider;
+    provider.models ??= {};
+    provider.models[entry.modelKey] = { name: entry.modelKey };
+  }
+};
+
+// src/config/inject-aliased/inject-aliased.ts
+var injectAliased = (config, missing, servedKey) => {
+  const models = config.provider?.[missing.providerId]?.models;
+  if (models === void 0) {
+    return;
+  }
+  const served = models[servedKey];
+  if (typeof served !== "object" || served === null || Array.isArray(served)) {
+    return;
+  }
+  models[missing.modelKey] = { ...structuredClone(served), id: servedKey };
+};
+
+// src/config/swap-at-digit-boundaries/swap-at-digit-boundaries.ts
+var swapAtDigitBoundaries = (tail, from, to) => {
+  let result = "";
+  for (let index = 0; index < tail.length; index += 1) {
+    const character = tail.charAt(index);
+    const previous = tail[index - 1];
+    const next = tail[index + 1];
+    const previousIsDigit = previous !== void 0 && previous >= "0" && previous <= "9";
+    const nextIsDigit = next !== void 0 && next >= "0" && next <= "9";
+    result += character === from && previousIsDigit && nextIsDigit ? to : character;
+  }
+  return result;
+};
+
+// src/config/resolve-spelling/resolve-spelling.ts
+var resolveSpelling = (modelKey, availableKeys) => {
+  const separator = modelKey.indexOf("/");
+  const vendor = separator === -1 ? "" : modelKey.slice(0, separator);
+  const tail = separator === -1 ? modelKey : modelKey.slice(separator + 1);
+  const candidates = new Set(
+    [
+      swapAtDigitBoundaries(tail, ".", "-"),
+      swapAtDigitBoundaries(tail, "-", ".")
+    ].filter((candidate) => candidate !== tail)
+  );
+  if (candidates.size === 0) {
+    return void 0;
+  }
+  const matches = availableKeys.filter((key) => {
+    const keySeparator = key.indexOf("/");
+    const keyVendor = keySeparator === -1 ? "" : key.slice(0, keySeparator);
+    const keyTail = keySeparator === -1 ? key : key.slice(keySeparator + 1);
+    return keyVendor === vendor && candidates.has(keyTail);
+  });
+  return matches.length === 1 ? matches[0] : void 0;
+};
+
+// src/config/resolve-ref-spellings/resolve-ref-spellings.ts
+var resolveRefSpellings = (config, missing) => {
+  const unresolved = [];
+  for (const entry of missing) {
+    const servedKey = entry.legacyReplacement === void 0 ? resolveSpelling(
+      entry.modelKey,
+      Object.keys(config.provider?.[entry.providerId]?.models ?? {})
+    ) : void 0;
+    if (servedKey === void 0) {
+      unresolved.push(entry);
+      continue;
+    }
+    injectAliased(config, entry, servedKey);
+    logger.info(
+      `${entry.ref} resolved to the served spelling "${entry.providerId}/${servedKey}" via dot\u2194dash tolerance \u2014 injected an aliased model entry routing to the served id`
+    );
+  }
+  return unresolved;
+};
+
+// src/config/validation-error/validation-error.ts
+var Route33ValidationError = class extends Error {
+  name = "Route33ValidationError";
+  missingRefs;
+  constructor(message, missingRefs) {
+    super(message);
+    this.missingRefs = missingRefs;
+  }
+};
+
+// src/config/validation-remediation/validation-remediation.ts
+var VALIDATION_REMEDIATION = [
+  "Remediation:",
+  "  1. Set ROUTE33_STRICT=0 to downgrade this error to a warning (missing models get a name-only stub entry).",
+  '  2. Declare the model explicitly under "provider" in opencode.jsonc.',
+  "  3. Verify the authenticated Route 33 account can access this model \u2014 the catalog is credential-scoped."
+].join("\n");
+
+// src/config/validate-refs/validate-refs.ts
+var validateRefs = (config, options = {}) => {
+  const missing = findMissingRefs(config, collectCfgRefs(config));
+  if (missing.length === 0) {
+    return;
+  }
+  const unresolved = resolveRefSpellings(config, missing);
+  if (unresolved.length === 0) {
+    return;
+  }
+  const details = describeMissing(config, unresolved);
+  const missingIds = unresolved.map((entry) => entry.ref);
+  if (unresolved.some((entry) => entry.legacyReplacement !== void 0)) {
+    throw new Route33ValidationError(details, missingIds);
+  }
+  if (options.strict === false) {
+    logger.warn(
+      `${details}
+
+(ROUTE33_STRICT=0 \u2014 continuing with name-only stub entries)`
+    );
+    injectStubs(config, unresolved);
+    return;
+  }
+  if (options.keyResolved === false) {
+    logger.warn(
+      `no route_33 gateway credential resolved \u2014 no model catalog available; ${String(unresolved.length)} referenced model(s) remain unavailable: ${missingIds.join(", ")}. Authenticate with Route 33, then restart. (Continuing with name-only stub entries.)`
+    );
+    injectStubs(config, unresolved);
+    return;
+  }
+  if (options.catalogAvailable === false) {
+    logger.warn(
+      `route33 model catalog unavailable \u2014 ${String(unresolved.length)} referenced model(s) could not be validated against the credential-scoped catalog: ${missingIds.join(", ")}. Restore gateway connectivity or declare the model explicitly under "provider" in opencode.jsonc, then restart. (Continuing with name-only stub entries.)`
+    );
+    injectStubs(config, unresolved);
+    return;
+  }
+  throw new Route33ValidationError(
+    `${details}
+
+${VALIDATION_REMEDIATION}`,
+    missingIds
+  );
+};
+
+// src/config/config-hook/config-hook.ts
+var createConfigHook = (options) => async (config) => {
+  let state = {
+    catalogAvailable: false,
+    keyResolved: false
+  };
+  try {
+    state = await configureRoute33(config, options);
+  } catch (error) {
+    if (error instanceof GatewayCredentialError) {
+      throw error;
+    }
+    logger.error(
+      `model discovery/injection failed unexpectedly \u2014 opencode startup continues without injected models: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  try {
+    validateRefs(config, {
+      catalogAvailable: state.catalogAvailable,
+      keyResolved: state.keyResolved,
+      strict: options.strict
+    });
+  } catch (error) {
+    if (error instanceof Route33ValidationError) {
+      logger.error(error.message);
+      throw error;
+    }
+    logger.error(
+      `ref validation failed unexpectedly \u2014 skipping: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+};
+
+// src/key-lease/default-gateway-key-renewal-ratio/default-gateway-key-renewal-ratio.ts
+var DEFAULT_GATEWAY_KEY_RENEWAL_RATIO = 0.8;
+
+// src/key-lease/default-gateway-key-ttl-ms/default-gateway-key-ttl-ms.ts
+var DEFAULT_GATEWAY_KEY_TTL_MS = 15 * 60 * 1e3;
+
+// src/key-lease/file-secret-store/file-secret-store.ts
+import { randomUUID } from "node:crypto";
+import * as fs6 from "node:fs/promises";
+import * as path7 from "node:path";
+var FileSecretStore = class {
+  #directory;
+  #file;
+  constructor(options) {
+    if (options.directory.length === 0) {
+      throw new TypeError("File secret store requires a directory");
+    }
+    if (!/^[a-zA-Z0-9._-]+$/u.test(options.scopeId)) {
+      throw new TypeError("File secret store scope is not portable");
+    }
+    this.#directory = options.directory;
+    this.#file = path7.join(options.directory, `lease-${options.scopeId}.json`);
+  }
+  /** Reads and parses the scoped gateway credential.
+   * @returns The persisted credential, when present.
+   */
+  async get() {
+    let contents;
+    try {
+      contents = await fs6.readFile(this.#file, "utf8");
+    } catch (cause) {
+      if (cause instanceof Error && "code" in cause && cause.code === "ENOENT") {
+        return void 0;
+      }
+      throw cause;
+    }
+    const value = JSON.parse(contents);
+    return parseGatewayKey(value);
+  }
+  /** Writes the scoped gateway credential through an atomic private file.
+   * @param key - The credential to persist, or undefined to remove it.
+   * @returns A promise that settles after the file write or removal.
+   */
+  async set(key) {
+    if (key === void 0) {
+      await fs6.rm(this.#file, { force: true });
+      return;
+    }
+    await fs6.mkdir(this.#directory, { mode: 448, recursive: true });
+    await fs6.chmod(this.#directory, 448);
+    const temporary = path7.join(this.#directory, `.lease-${randomUUID()}.tmp`);
+    try {
+      await fs6.writeFile(temporary, `${JSON.stringify(key.value)}
+`, {
+        encoding: "utf8",
+        flag: "wx",
+        mode: 384
+      });
+      await fs6.rename(temporary, this.#file);
+    } finally {
+      await fs6.rm(temporary, { force: true });
+    }
+  }
+};
+
+// src/key-lease/host-storage-secret-store/host-storage-secret-store.ts
+var HostStorageSecretStore = class {
+  #key;
+  #storage;
+  constructor(options) {
+    this.#key = options.key;
+    this.#storage = options.storage;
+  }
+  /** Reads and parses the scoped gateway credential.
+   * @returns The persisted credential, when present.
+   */
+  async get() {
+    const value = await this.#storage.get(this.#key);
+    return value === void 0 ? void 0 : parseGatewayKey(value);
+  }
+  /** Writes the scoped gateway credential only through host-owned storage.
+   * @param key - The credential to persist, or undefined to remove it.
+   * @returns A promise that settles after the host write or removal.
+   */
+  set(key) {
+    return key === void 0 ? this.#storage.remove(this.#key) : this.#storage.set(this.#key, key.value);
+  }
+};
+
+// src/key-lease/key-lease-error/key-lease-error.ts
+var REDACTED_CAUSE = "Route 33 gateway key lease dependency failed";
+var KeyLeaseError = class extends Error {
+  constructor(code, options) {
+    super(
+      "Route 33 gateway key lease failed",
+      options?.cause === void 0 ? void 0 : { cause: REDACTED_CAUSE }
+    );
+    this.code = code;
+    this.name = "KeyLeaseError";
+  }
+  code;
+};
+
+// src/key-lease/map-renewal-failure/map-renewal-failure.ts
+var mapRenewalFailure = (options) => {
+  if (options.current === void 0) {
+    throw options.cause;
+  }
+  if (options.now < Date.parse(options.current.expiresAt)) {
+    throw options.cause;
+  }
+  if (!(options.cause instanceof KeyLeaseError)) {
+    throw options.cause;
+  }
+  if (options.cause.code !== "KEY_LEASE_MINT_FAILED") {
+    throw options.cause;
+  }
+  throw new KeyLeaseError("KEY_LEASE_EXPIRED", { cause: options.cause });
+};
+
+// src/key-lease/orphan-control/orphan-control.ts
+var controlOrphans = async (options) => {
+  const now = options.clock();
+  if (!Number.isFinite(now) || !Number.isInteger(options.retentionCycles) || options.retentionCycles <= 0 || !Number.isFinite(options.ttlMs) || options.ttlMs <= 0) {
+    return { kind: "unavailable" };
+  }
+  let keys;
+  try {
+    keys = await options.managementClient.list(options.managementCredential);
+  } catch {
+    return { kind: "unavailable" };
+  }
+  const staleKeys = keys.data.filter(
+    (key) => key.name === options.keyName && key.id !== options.currentKeyId && Date.parse(key.expires_at) <= now
+  );
+  const deletions = await Promise.allSettled(
+    staleKeys.map(
+      (key) => Promise.resolve().then(
+        () => options.managementClient.delete(options.managementCredential, key.id)
+      )
+    )
+  );
+  return {
+    attempted: deletions.length,
+    deleted: deletions.filter(({ status }) => status === "fulfilled").length,
+    kind: "completed"
+  };
+};
+
+// src/key-lease/is-management-unauthorized/is-management-unauthorized.ts
+var isManagementUnauthorized = (cause) => {
+  if (cause instanceof Response) {
+    return cause.status === 401;
+  }
+  if (typeof cause !== "object") {
+    return false;
+  }
+  if (cause === null) {
+    return false;
+  }
+  if ("status" in cause && cause.status === 401) {
+    return true;
+  }
+  if ("statusCode" in cause && cause.statusCode === 401) {
+    return true;
+  }
+  return "response" in cause && cause.response instanceof Response && cause.response.status === 401;
+};
+
+// src/key-lease/recover-lease-state/recover-lease-state.ts
+var recoverLeaseState = async (options) => {
+  let keys;
+  try {
+    keys = (await options.managementClient.list(options.managementCredential)).data;
+  } catch (cause) {
+    throw new KeyLeaseError(
+      isManagementUnauthorized(cause) ? "KEY_LEASE_UNAUTHORIZED" : "KEY_LEASE_MINT_FAILED",
+      { cause }
+    );
+  }
+  const matches = keys.filter((key2) => {
+    if (key2.name !== options.keyName || key2.revoked || key2.status !== "active" || !Number.isFinite(Date.parse(key2.expires_at))) {
+      return false;
+    }
+    switch (options.attribution.kind) {
+      case "personal":
+        return key2.ownership_type === "user_personal" && key2.project_id === null;
+      case "project":
+        return key2.ownership_type === "project" && key2.project_id === options.attribution.projectId;
+      default: {
+        const unexpected = options.attribution;
+        throw new TypeError(`Unexpected attribution: ${String(unexpected)}`);
+      }
+    }
+  });
+  const key = matches.length === 1 ? matches[0] : void 0;
+  if (key === void 0) {
+    return void 0;
+  }
+  const recovered = {
+    attribution: options.attribution,
+    expiresAt: key.expires_at,
+    keyId: key.id
+  };
+  return options.state.compareAndSwap(void 0, recovered) ? recovered : options.state.snapshot();
+};
+
+// src/key-lease/reject-lease/reject-lease.ts
+var rejectLease = async (options) => {
+  const shouldClear = options.storedKey === void 0 || options.storedKey.value === options.rejection.key.value;
+  if (shouldClear) {
+    try {
+      await options.secretStore.set(void 0);
+    } catch (cause) {
+      throw new KeyLeaseError("KEY_LEASE_STORE_UNAVAILABLE", { cause });
+    }
+    if (!options.state.clear(options.current)) {
+      throw new KeyLeaseError("KEY_LEASE_RENEWAL_RACE");
+    }
+  }
+  switch (options.rejection.kind) {
+    case "expired":
+      throw new KeyLeaseError("KEY_LEASE_EXPIRED");
+    case "unauthorized":
+      throw new KeyLeaseError("KEY_LEASE_UNAUTHORIZED");
+    default: {
+      const unexpected = options.rejection;
+      throw new TypeError(`Unexpected lease rejection: ${String(unexpected)}`);
+    }
+  }
+};
+
+// src/key-lease/resolve-key-ownership/resolve-key-ownership.ts
+var resolveKeyOwnership = (options) => {
+  switch (options.attribution.kind) {
+    case "personal":
+      if (options.managementSubject.length === 0) {
+        throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+      }
+      return {
+        ownerId: options.managementSubject,
+        ownerType: "user_personal",
+        projectId: null
+      };
+    case "project":
+      return {
+        ownerId: null,
+        ownerType: "project",
+        projectId: options.attribution.projectId
+      };
+    default: {
+      const unexpected = options.attribution;
+      throw new TypeError(`Unexpected attribution: ${String(unexpected)}`);
+    }
+  }
+};
+
+// src/key-lease/mint-key/mint-key.ts
+var mintKey = async (options) => {
+  const now = options.clock();
+  if (!Number.isFinite(now)) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  if (!Number.isFinite(options.installation.ttlMs)) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  if (options.installation.ttlMs <= 0) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  if (options.installation.keyName.length === 0) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  const ownership = resolveKeyOwnership({
+    attribution: options.attribution,
+    managementSubject: options.identity.subject
+  });
+  let material;
+  try {
+    material = await options.managementClient.create(
+      options.identity.credential,
+      {
+        expiresAt: new Date(now + options.installation.ttlMs).toISOString(),
+        name: options.installation.keyName,
+        ...ownership
+      }
+    );
+  } catch (cause) {
+    if (isManagementUnauthorized(cause)) {
+      throw new KeyLeaseError("KEY_LEASE_UNAUTHORIZED", { cause });
+    }
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED", { cause });
+  }
+  return {
+    key: material.key,
+    lease: {
+      attribution: options.attribution,
+      expiresAt: material.expires_at,
+      keyId: material.id
+    }
+  };
+};
+
+// src/key-lease/renew-key/renew-key.ts
+var renewals = /* @__PURE__ */ new WeakMap();
+var renewKey = async (options) => {
+  const inFlight = renewals.get(options.leaseState);
+  if (inFlight !== void 0) {
+    return inFlight;
+  }
+  const expected = options.leaseState.snapshot();
+  const renewal = (async () => {
+    const discard = async (keyId) => {
+      const cleared = options.leaseState.clear(expected);
+      await Promise.allSettled([
+        Promise.resolve().then(() => options.secretStore.set(void 0)),
+        Promise.resolve().then(
+          () => options.mint.managementClient.delete(
+            options.mint.identity.credential,
+            keyId
+          )
+        )
+      ]);
+      return cleared;
+    };
+    let renewed;
+    if (expected === void 0) {
+      renewed = await mintKey(options.mint);
+    } else {
+      try {
+        const material = await options.mint.managementClient.regenerate(
+          options.mint.identity.credential,
+          expected.keyId,
+          new Date(
+            options.mint.clock() + options.mint.installation.ttlMs
+          ).toISOString()
+        );
+        renewed = {
+          key: material.key,
+          lease: {
+            attribution: options.mint.attribution,
+            expiresAt: material.expires_at,
+            keyId: expected.keyId
+          }
+        };
+      } catch (cause) {
+        const cleared = await discard(expected.keyId);
+        if (!cleared) {
+          throw new KeyLeaseError("KEY_LEASE_RENEWAL_RACE", { cause });
+        }
+        throw new KeyLeaseError(
+          isManagementUnauthorized(cause) ? "KEY_LEASE_UNAUTHORIZED" : "KEY_LEASE_MINT_FAILED",
+          { cause }
+        );
+      }
+    }
+    try {
+      await options.secretStore.set(renewed.key);
+    } catch (cause) {
+      const cleared = await discard(renewed.lease.keyId);
+      if (!cleared) {
+        throw new KeyLeaseError("KEY_LEASE_RENEWAL_RACE", { cause });
+      }
+      throw new KeyLeaseError("KEY_LEASE_STORE_UNAVAILABLE", { cause });
+    }
+    if (!options.leaseState.compareAndSwap(expected, renewed.lease)) {
+      await discard(renewed.lease.keyId);
+      throw new KeyLeaseError("KEY_LEASE_RENEWAL_RACE");
+    }
+    return renewed;
+  })();
+  renewals.set(options.leaseState, renewal);
+  try {
+    return await renewal;
+  } finally {
+    if (renewals.get(options.leaseState) === renewal) {
+      renewals.delete(options.leaseState);
+    }
+  }
+};
+
+// src/key-lease/resolve-lease-policy/resolve-lease-policy.ts
+var resolveLeasePolicy = (policy) => {
+  const resolved = {
+    deletePreviousKey: false,
+    renewalRatio: DEFAULT_GATEWAY_KEY_RENEWAL_RATIO,
+    ttlMs: DEFAULT_GATEWAY_KEY_TTL_MS,
+    ...policy
+  };
+  if (!Number.isFinite(resolved.ttlMs)) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  if (resolved.ttlMs <= 0) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  if (!Number.isFinite(resolved.renewalRatio)) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  if (resolved.renewalRatio <= 0) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  if (resolved.renewalRatio >= 1) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  if (resolved.orphanRetentionCycles === void 0) {
+    return resolved;
+  }
+  if (!Number.isInteger(resolved.orphanRetentionCycles)) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  if (resolved.orphanRetentionCycles <= 0) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  return resolved;
+};
+
+// src/key-lease/resolve-seam-value/resolve-seam-value.ts
+var resolveSeamValue = async (value) => typeof value === "function" ? value() : value;
+
+// src/key-lease/reusable-lease/reusable-lease.ts
+var reusableLease = (options) => {
+  if (options.current === void 0) {
+    return void 0;
+  }
+  if (options.storedKey === void 0) {
+    return void 0;
+  }
+  if (!options.state.matchesAttribution(options.attribution)) {
+    return void 0;
+  }
+  const renewalAt = Date.parse(options.current.expiresAt) - options.policy.ttlMs * (1 - options.policy.renewalRatio);
+  if (options.now >= renewalAt) {
+    return void 0;
+  }
+  return { key: options.storedKey, lease: options.current };
+};
+
+// src/key-lease/lease-for-attribution/lease-for-attribution.ts
+var leaseForAttribution = async (options) => {
+  const policy = resolveLeasePolicy(options.policy);
+  const clock = options.clock ?? Date.now;
+  const now = clock();
+  if (!Number.isFinite(now)) {
+    throw new KeyLeaseError("KEY_LEASE_MINT_FAILED");
+  }
+  let current = options.installation.state.snapshot();
+  let storedKey;
+  try {
+    storedKey = await options.installation.secretStore.get();
+  } catch (cause) {
+    throw new KeyLeaseError("KEY_LEASE_STORE_UNAVAILABLE", { cause });
+  }
+  if (current === void 0 && storedKey !== void 0) {
+    current = await recoverLeaseState({
+      attribution: options.attribution,
+      keyName: options.installation.keyName,
+      managementClient: options.management.client,
+      managementCredential: await resolveSeamValue(
+        options.management.credential
+      ),
+      state: options.installation.state
+    });
+  }
+  if (options.rejection !== void 0) {
+    return rejectLease({
+      current,
+      rejection: options.rejection,
+      secretStore: options.installation.secretStore,
+      state: options.installation.state,
+      storedKey
+    });
+  }
+  const reusable = reusableLease({
+    attribution: options.attribution,
+    current,
+    now,
+    policy,
+    state: options.installation.state,
+    storedKey
+  });
+  if (reusable !== void 0) {
+    return reusable;
+  }
+  try {
+    const renewed = await renewKey({
+      leaseState: options.installation.state,
+      mint: {
+        attribution: options.attribution,
+        clock,
+        identity: {
+          credential: await resolveSeamValue(options.management.credential),
+          subject: await resolveSeamValue(options.management.subject)
+        },
+        installation: {
+          keyName: options.installation.keyName,
+          ttlMs: policy.ttlMs
+        },
+        managementClient: options.management.client
+      },
+      secretStore: options.installation.secretStore
+    });
+    if (policy.orphanRetentionCycles !== void 0) {
+      await controlOrphans({
+        clock,
+        currentKeyId: renewed.lease.keyId,
+        keyName: options.installation.keyName,
+        managementClient: options.management.client,
+        managementCredential: await resolveSeamValue(
+          options.management.credential
+        ),
+        retentionCycles: policy.orphanRetentionCycles,
+        ttlMs: policy.ttlMs
+      });
+    }
+    return renewed;
+  } catch (cause) {
+    return mapRenewalFailure({ cause, current, now });
+  }
+};
+
+// src/attribution/clear-attribution/clear-attribution.ts
+import * as fs9 from "node:fs";
+
+// src/attribution/resolve-attribution-file/resolve-attribution-file.ts
+import * as fs8 from "node:fs";
+import * as path9 from "node:path";
+
+// src/attribution/detect-worktree-root/detect-worktree-root.ts
+import * as fs7 from "node:fs";
+import * as path8 from "node:path";
+var detectWorktreeRoot = (startDirectory) => {
+  let directory = fs7.realpathSync(startDirectory);
+  for (; ; ) {
+    const gitEntry = path8.join(directory, ".git");
+    if (fs7.existsSync(gitEntry)) {
+      const entry = fs7.statSync(gitEntry);
+      if (entry.isDirectory() || entry.isFile()) {
+        return directory;
+      }
+    }
+    const parent = path8.dirname(directory);
+    if (parent === directory) {
+      return void 0;
+    }
+    directory = parent;
+  }
+};
+
+// src/attribution/resolve-attribution-file/resolve-attribution-file.ts
+var resolveAttributionFile = (options) => {
+  const worktreeRoot = detectWorktreeRoot(options.directory);
+  if (worktreeRoot !== void 0) {
+    return path9.join(worktreeRoot, ".opencode", "route33.attribution.json");
+  }
+  const fallbackRoots = {
+    "return-undefined": void 0,
+    "use-directory": fs8.realpathSync(options.directory)
+  };
+  const fallbackRoot = fallbackRoots[options.outsideWorktree];
+  return fallbackRoot === void 0 ? void 0 : path9.join(fallbackRoot, ".opencode", "route33.attribution.json");
+};
+
+// src/attribution/clear-attribution/clear-attribution.ts
+var clearAttribution = (options) => {
+  const file = resolveAttributionFile(options);
+  if (file === void 0) {
+    return false;
+  }
+  fs9.rmSync(file, { force: true });
+  return true;
+};
+
+// src/attribution/parse-attribution/parse-attribution.ts
+var parseAttribution = (value) => {
+  if (!isRecord(value)) {
+    throw new ContractParseError("invalid attribution");
+  }
+  if (value["kind"] === "personal") {
+    return { kind: "personal" };
+  }
+  if (value["kind"] === "project" && typeof value["projectId"] === "string") {
+    return { kind: "project", projectId: value["projectId"] };
+  }
+  throw new ContractParseError("invalid attribution");
+};
+
+// src/attribution/read-attribution/read-attribution.ts
+import * as fs10 from "node:fs";
+var readAttribution = (options) => {
+  const file = resolveAttributionFile(options);
+  if (file === void 0) {
+    return void 0;
+  }
+  try {
+    const parsed = JSON.parse(fs10.readFileSync(file, "utf8"));
+    return parseAttribution(parsed);
+  } catch {
+    return void 0;
+  }
+};
+
+// src/attribution/write-attribution/write-attribution.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import * as fs11 from "node:fs";
+import * as path10 from "node:path";
+var writeAttribution = (options, attribution) => {
+  const file = resolveAttributionFile(options);
+  if (file === void 0) {
+    return false;
+  }
+  fs11.mkdirSync(path10.dirname(file), { recursive: true });
+  const temporaryFile = `${file}.${String(process.pid)}.${randomUUID2()}.tmp`;
+  try {
+    fs11.writeFileSync(temporaryFile, `${JSON.stringify(attribution)}
+`, "utf8");
+    fs11.renameSync(temporaryFile, file);
+  } catch (error) {
+    fs11.rmSync(temporaryFile, { force: true });
+    throw error;
+  }
+  return true;
+};
+
+// src/key-lease/lease-state/lease-state.ts
+var LeaseState = class _LeaseState {
+  /** Current committed snapshot; mutation is limited to compare-and-swap transitions. */
+  #current;
+  constructor(current) {
+    this.#current = current;
+  }
+  /** Restores untrusted persisted metadata or an empty lease.
+   * @param value - Persisted metadata, or undefined for a new installation.
+   * @returns A lease-state coordinator.
+   */
+  static restore(value) {
+    if (value === void 0) {
+      return new _LeaseState(void 0);
+    }
+    if (!isRecord(value)) {
+      throw new ContractParseError("invalid gateway key lease state");
+    }
+    const fields = Object.keys(value);
+    if (fields.length !== 3 || fields.some(
+      (field) => field !== "attribution" && field !== "expiresAt" && field !== "keyId"
+    )) {
+      throw new ContractParseError("invalid gateway key lease state");
+    }
+    const expiresAt = value["expiresAt"];
+    const keyId = value["keyId"];
+    if (typeof expiresAt !== "string" || !Number.isFinite(Date.parse(expiresAt)) || typeof keyId !== "string" || keyId.length === 0) {
+      throw new ContractParseError("invalid gateway key lease state");
+    }
+    return new _LeaseState({
+      attribution: parseAttribution(value["attribution"]),
+      expiresAt,
+      keyId
+    });
+  }
+  /** Reads the current non-secret metadata.
+   * @returns The current lease metadata, if one is committed.
+   */
+  snapshot() {
+    return this.#current;
+  }
+  /** Checks whether current metadata belongs to an attribution.
+   * @param attribution - The requested ownership choice.
+   * @returns Whether the current lease has the same attribution.
+   */
+  matchesAttribution(attribution) {
+    if (this.#current === void 0) {
+      return false;
+    }
+    switch (this.#current.attribution.kind) {
+      case "personal":
+        return attribution.kind === "personal";
+      case "project":
+        return attribution.kind === "project" && attribution.projectId === this.#current.attribution.projectId;
+      default:
+        return _LeaseState.#unexpectedAttribution(this.#current.attribution);
+    }
+  }
+  /** Atomically swaps metadata when the expected snapshot is still current.
+   * @param expected - Snapshot observed before asynchronous renewal.
+   * @param next - Fresh metadata to commit.
+   * @returns Whether the swap committed.
+   */
+  compareAndSwap(expected, next) {
+    if (this.#current !== expected) {
+      return false;
+    }
+    this.#current = next;
+    return true;
+  }
+  /** Clears metadata only while the expected snapshot remains current.
+   * @param expected - Snapshot whose lease is being invalidated.
+   * @returns Whether the state was cleared.
+   */
+  clear(expected) {
+    if (this.#current !== expected) {
+      return false;
+    }
+    this.#current = void 0;
+    return true;
+  }
+  static #unexpectedAttribution(value) {
+    throw new TypeError(`Unexpected attribution: ${String(value)}`);
+  }
+};
+
+// src/key-lease/lease-installation-factory/lease-installation-factory.ts
+var createLeaseInstallationFactory = (options) => {
+  const installations = /* @__PURE__ */ new Map();
+  return (scopeId) => {
+    const existing = installations.get(scopeId);
+    if (existing !== void 0) {
+      return existing;
+    }
+    const installation = {
+      keyName: `route33:lease:${scopeId}`,
+      secretStore: options.createSecretStore(scopeId),
+      ...options.createStateStore === void 0 ? {} : { stateStore: options.createStateStore(scopeId) },
+      state: LeaseState.restore(void 0)
+    };
+    installations.set(scopeId, installation);
+    return installation;
+  };
+};
+
+// src/key-lease/scope-id/scope-id.ts
+import { createHash as createHash2 } from "node:crypto";
+var deriveScopeId = (input) => {
+  let identity;
+  switch (input.attribution.kind) {
+    case "personal":
+      identity = ["route33-lease", "personal"];
+      break;
+    case "project":
+      if (input.folderRealpath === void 0 || input.folderRealpath.length === 0) {
+        throw new TypeError("Project lease scope requires a real folder path");
+      }
+      identity = [
+        "route33-lease",
+        "project",
+        input.attribution.projectId,
+        input.folderRealpath
+      ];
+      break;
+    default: {
+      const unexpected = input.attribution;
+      throw new TypeError(`Unexpected attribution: ${String(unexpected)}`);
+    }
+  }
+  return createHash2("sha256").update(JSON.stringify(identity)).digest("hex");
+};
+
+// src/requested-client-id/requested-client-id.ts
+var DEFAULT_ROUTE33_CLIENT_ID = false ? "" : "oa_platform_203623de";
+
+// src/commands/change-attribution/change-attribution.ts
+var changeAttribution = async (options) => {
+  await options.clear();
+  return options.prompt();
+};
+
+// src/commands/inspect-session/inspect-session.ts
+var inspectSession = (options) => {
+  const attribution = options.readAttribution();
+  const lease = options.readLease();
+  return {
+    attribution,
+    ...lease === void 0 ? {} : { lease: { expiresAt: lease.expiresAt, keyId: lease.keyId } }
+  };
+};
+
+// src/commands/reset-attribution/reset-attribution.ts
+var resetAttribution = async (options) => {
+  await options.clear();
+};
+
+// src/commands/rotate-now/rotate-now.ts
+var rotateNow = async (options) => {
+  const rotated = await options.lease({ renewalRatio: Number.EPSILON });
+  return rotated.lease;
+};
+
+// src/ux/attribution-prompt/attribution-prompt.ts
+var createAttributionPrompt = (projects) => {
+  const choicesBySelection = {
+    personal: { kind: "personal" }
+  };
+  const projectOptions = projects.map((project) => {
+    const selection = `project:${project.id}`;
+    choicesBySelection[selection] = {
+      kind: "project",
+      projectId: project.id
+    };
+    return {
+      label: `${project.name} (${project.organisation.name})`,
+      selection
+    };
+  });
+  return {
+    choicesBySelection,
+    options: [
+      ...projectOptions,
+      { label: "Use my personal key", selection: "personal" }
+    ],
+    title: "Choose where Route 33 should manage this key"
+  };
+};
+
+// src/ux/attribution-prompt-error/attribution-prompt-error.ts
+var MESSAGES = {
+  ATTRIBUTION_PRESENTER_UNAVAILABLE: "Route 33 needs OpenCode v2 to assign a budget for this folder. Update to OpenCode v2, run /connect, choose Route 33, and follow the steps.",
+  ATTRIBUTION_SELECTION_INVALID: "That Route 33 option is no longer available. Connect again and pick another."
+};
+var AttributionPromptError = class extends GatewayCredentialError {
+  code;
+  constructor(code) {
+    super(MESSAGES[code]);
+    this.name = "AttributionPromptError";
+    this.code = code;
+  }
+};
+
+// src/ux/prompt-flow/prompt-flow.ts
+var resolveAttribution = async (options) => {
+  const remembered = readAttribution(options.state);
+  if (remembered !== void 0) {
+    return remembered;
+  }
+  if (options.presenter === void 0) {
+    throw new AttributionPromptError("ATTRIBUTION_PRESENTER_UNAVAILABLE");
+  }
+  const plan = createAttributionPrompt(await options.loadProjects());
+  const selection = await options.presenter.pick(plan);
+  const attribution = plan.choicesBySelection[selection];
+  if (attribution === void 0) {
+    throw new AttributionPromptError("ATTRIBUTION_SELECTION_INVALID");
+  }
+  writeAttribution(options.state, attribution);
+  return attribution;
+};
+
+// src/ux/trusted-party-copy/trusted-party-copy.ts
+var TRUSTED_PARTY_COPY = {
+  message: "Route 33 wants to manage your keys for this OpenCode installation.",
+  title: "Connect Route 33"
+};
+
+// src/auth/auth-error/auth-error.ts
+var AuthError = class extends Error {
+  constructor(code, options) {
+    super(
+      "Route 33 authorization failed",
+      options?.cause === void 0 ? void 0 : { cause: options.cause }
+    );
+    this.code = code;
+    this.name = "AuthError";
+    this.statusCode = options?.statusCode;
+  }
+  code;
+  statusCode;
+};
+
+// src/auth/build-authorize-url/build-authorize-url.ts
+var buildAuthorizeUrl = (issuerUrl, request) => {
+  const url = new URL("/authorize", issuerUrl);
+  url.search = new URLSearchParams({
+    client_id: request.clientId,
+    code_challenge: request.codeChallenge,
+    code_challenge_method: "S256",
+    redirect_uri: request.redirectUri,
+    response_type: "code",
+    scope: request.scope,
+    state: request.state
+  }).toString();
+  return url;
+};
+
+// src/contract/auth-session/parse-token-set/parse-token-set.ts
+var parseTokenSet = (value) => {
+  if (!isRecord(value)) {
+    throw new ContractParseError("invalid token response");
+  }
+  if (typeof value["access_token"] !== "string" || typeof value["expires_in"] !== "number" || value["token_type"] !== "Bearer") {
+    throw new ContractParseError("invalid token response");
+  }
+  return {
+    access_token: value["access_token"],
+    expires_in: value["expires_in"],
+    token_type: "Bearer",
+    ...typeof value["id_token"] === "string" ? { id_token: value["id_token"] } : {},
+    ...typeof value["refresh_token"] === "string" ? { refresh_token: value["refresh_token"] } : {},
+    ...typeof value["scope"] === "string" ? { scope: value["scope"] } : {}
+  };
+};
+
+// src/auth/exchange-code-and-parse/exchange-code-and-parse.ts
+var exchangeCodeAndParse = async (options) => {
+  const body = new URLSearchParams({
+    client_id: options.clientId,
+    code: options.input.code,
+    code_verifier: options.input.codeVerifier,
+    grant_type: "authorization_code",
+    redirect_uri: options.input.redirectUri
+  });
+  let response;
+  try {
+    response = await (options.fetchImpl ?? fetch)(options.tokenUrl, {
+      body,
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      method: "POST"
+    });
+  } catch (cause) {
+    throw new AuthError("AUTH_CODE_EXCHANGE_FAILED", { cause });
+  }
+  if (!response.ok) {
+    throw new AuthError("AUTH_CODE_EXCHANGE_FAILED", {
+      statusCode: response.status
+    });
+  }
+  let payload;
+  try {
+    payload = await response.json();
+  } catch (cause) {
+    throw new AuthError("AUTH_CODE_EXCHANGE_FAILED", { cause });
+  }
+  try {
+    return parseTokenSet(payload);
+  } catch (cause) {
+    if (cause instanceof ContractParseError) {
+      throw new AuthError("AUTH_CODE_EXCHANGE_FAILED", { cause });
+    }
+    throw cause;
+  }
+};
+
+// src/auth/refresh-session/refresh-session.ts
+var refreshSession = async (options) => {
+  const body = new URLSearchParams({
+    client_id: options.clientId,
+    grant_type: "refresh_token",
+    refresh_token: options.refreshToken
+  });
+  let response;
+  try {
+    response = await (options.fetchImpl ?? fetch)(options.tokenUrl, {
+      body,
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      method: "POST"
+    });
+  } catch (cause) {
+    throw new AuthError("AUTH_REAUTHENTICATION_REQUIRED", { cause });
+  }
+  if (!response.ok) {
+    throw new AuthError("AUTH_REAUTHENTICATION_REQUIRED", {
+      statusCode: response.status
+    });
+  }
+  let payload;
+  try {
+    payload = await response.json();
+  } catch (cause) {
+    throw new AuthError("AUTH_REAUTHENTICATION_REQUIRED", { cause });
+  }
+  try {
+    return parseTokenSet(payload);
+  } catch (cause) {
+    if (cause instanceof ContractParseError) {
+      throw new AuthError("AUTH_REAUTHENTICATION_REQUIRED", { cause });
+    }
+    throw cause;
+  }
+};
+
+// src/auth/create-auth-session/create-auth-session.ts
+var createAuthSession = (options) => {
+  const tokenUrl = new URL("/oauth/token", options.issuerUrl);
+  return {
+    authorizationUrl: (request) => buildAuthorizeUrl(options.issuerUrl, request),
+    exchangeCode: (input) => exchangeCodeAndParse({
+      clientId: options.clientId,
+      ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl },
+      input,
+      tokenUrl
+    }),
+    refresh: (refreshToken) => refreshSession({
+      clientId: options.clientId,
+      ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl },
+      refreshToken,
+      tokenUrl
+    })
+  };
+};
+
+// src/auth/open-browser-and-capture/open-browser-and-capture.ts
+import { timingSafeEqual } from "node:crypto";
+
+// src/auth/loopback-callback/loopback-callback.ts
+import { createServer } from "node:http";
+
+// src/auth/loopback-callback/callback-page/callback-page.ts
+var MARK_PATHS = [
+  "M310.6,175.8c0-6.1-2.7-11.8-7.2-15.9l-127.6-114.4V7h-43.5v48.3c0,6.2,2.6,12.1,7.2,16.2l92.5,82.9H0v43.5h234.7l-95.6,91.4c-4.3,4.1-6.7,9.8-6.7,15.7v48.3h43.5v-39l128.1-122.4c4.4-4.2,6.8-10,6.7-16.1h0Z",
+  "M457.2,175.9v-2.6c18.4-4.9,33-14.1,44-27.7,11-13.6,16.5-30.3,16.5-50.3s-4.5-32.9-13.4-47.5c-9-14.5-21.6-26.1-38-34.9-16.4-8.7-35.8-13.1-58.3-13.1s-41.1,4-58.8,12.1-31.8,19.3-42.4,33.7-16.1,31-16.6,50h51.1c.3-10.8,3.6-20,9.8-27.7,6.2-7.6,14.2-13.5,24.1-17.5,9.9-4.1,20.6-6.1,32-6.1s22.3,2.2,31.1,6.7c8.8,4.5,15.6,10.8,20.5,18.8,4.9,8.1,7.3,17.5,7.3,28.4s-2.8,21.1-8.4,29.4-13.3,14.8-23.2,19.5-21.3,7.1-34.2,7.1h-29.9v43.3h29.9c16.2,0,30,2.5,41.5,7.5,11.5,5,20.2,12,26.1,21.1,6,9,9,19.4,9,31.2s-3,21.2-9.1,29.8-14.4,15.3-25.1,20.1c-10.7,4.9-22.9,7.3-36.7,7.3s-24.2-2.1-34.5-6.2-18.6-10-24.8-17.5c-6.3-7.5-9.8-16.5-10.6-26.8h-53.2c.6,19,6.3,35.7,17,50.2,10.7,14.5,25.2,25.7,43.6,33.8,18.4,8.1,39.4,12.1,63.1,12.1s45.1-4.4,63.7-13.2c18.6-8.8,33.3-20.8,44-36,10.8-15.2,16.1-32.5,16.1-51.8s-6.4-40.7-19.2-55.6c-12.8-14.9-30.8-24.2-54-27.8h0Z",
+  "M763,203.7c-12.8-14.9-30.8-24.2-54-27.8v-2.6c18.4-4.9,33-14.1,44-27.7,11-13.6,16.5-30.3,16.5-50.3s-4.5-32.9-13.4-47.5c-8.9-14.5-21.6-26.1-38-34.9-16.4-8.7-35.8-13.1-58.3-13.1s-41.1,4-58.8,12.1-31.8,19.3-42.4,33.7-16.1,31-16.6,50h51.1c.3-10.8,3.6-20,9.8-27.7,6.2-7.6,14.2-13.5,24.1-17.5,9.9-4.1,20.6-6.1,32-6.1s22.3,2.2,31.1,6.7c8.8,4.5,15.6,10.8,20.5,18.8,4.9,8.1,7.3,17.5,7.3,28.4s-2.8,21.1-8.4,29.4c-5.6,8.3-13.3,14.8-23.2,19.5s-21.3,7.1-34.2,7.1h-29.9v43.3h29.9c16.2,0,30,2.5,41.5,7.5,11.5,5,20.2,12,26.1,21.1,6,9,8.9,19.4,8.9,31.2s-3,21.2-9.1,29.8c-6.1,8.6-14.4,15.3-25.1,20.1-10.7,4.9-22.9,7.3-36.7,7.3s-24.2-2.1-34.5-6.2-18.6-10-24.8-17.5c-6.3-7.5-9.8-16.5-10.6-26.8h-53.2c.6,19,6.3,35.7,17,50.2,10.7,14.5,25.2,25.7,43.6,33.8,18.4,8.1,39.4,12.1,63.1,12.1s45.1-4.4,63.7-13.2,33.3-20.8,44-36c10.8-15.2,16.1-32.5,16.1-51.8s-6.4-40.7-19.2-55.6h0Z"
+];
+var BRAND_MARK = `<svg class="r33-mark" viewBox="0 0 782.2 360.3" fill="currentColor" role="img" aria-label="route33.ai" xmlns="http://www.w3.org/2000/svg"><path d="${MARK_PATHS[0]}"/><path d="${MARK_PATHS[1]}"/><path d="${MARK_PATHS[2]}"/></svg>`;
+var PAGE_STYLE = `:root{color-scheme:dark;--r33-euro-blue:#0000FF;--r33-off-white:#F1F1F1;--r33-off-black:#121212;--r33-grey-300:#C9CBCF;--r33-radius-fillet:4px;--r33-space-2:8px;--r33-space-3:16px;--r33-space-4:24px;--r33-space-6:64px;--r33-font-body:"Geist","Helvetica Neue",Arial,sans-serif;--r33-font-mono:"Geist Mono","SFMono-Regular",Menlo,monospace;--r33-surface:var(--r33-off-black);--r33-text-primary:var(--r33-off-white);--r33-text-secondary:var(--r33-grey-300);--r33-fill-accent:var(--r33-euro-blue);--r33-on-fill-accent:var(--r33-off-white)}
+*{box-sizing:border-box}
+html,body{margin:0}
+.r33-page{min-height:100vh;display:flex;align-items:center;justify-content:center;padding:var(--r33-space-6);background:var(--r33-surface);color:var(--r33-text-primary);font-family:var(--r33-font-body);-webkit-font-smoothing:antialiased}
+.r33-panel{display:grid;gap:var(--r33-space-4);max-width:460px;width:100%}
+.r33-mark{height:40px;width:auto;color:var(--r33-text-primary)}
+.r33-status{display:inline-flex;align-items:center;gap:var(--r33-space-2);font-size:11px;letter-spacing:0.08em;text-transform:uppercase;color:var(--r33-text-secondary)}
+.r33-status__dot{width:8px;height:8px;background:var(--r33-fill-accent)}
+.r33-status__dot--error{background:transparent;border:1px solid var(--r33-text-primary);border-radius:50%}
+.r33-headline{margin:0;font-size:48px;line-height:0.85;letter-spacing:-0.02em;font-weight:600;color:var(--r33-text-primary);text-wrap:balance}
+.r33-subline{margin:0;font-size:16px;line-height:1.45;color:var(--r33-text-secondary);max-width:40ch;text-wrap:pretty}
+.r33-code{margin:0;font-size:13px;letter-spacing:0.04em;color:var(--r33-text-secondary)}
+.r33-code__value{font-family:var(--r33-font-mono);text-transform:uppercase;color:var(--r33-text-primary)}
+@media (prefers-reduced-motion:reduce){*{animation-duration:1ms!important;transition-duration:1ms!important}}`;
+var buildCallbackPage = (state, errorCode) => {
+  const isError = state === "error";
+  const safeCode = (errorCode ?? "").replace(/[^a-z0-9_-]/gi, "");
+  const title = isError ? "Sign-in failed" : "Signed in";
+  const headline = isError ? "Sign-in failed" : "Signed in to route33";
+  const subline = isError ? "Return to OpenCode and retry." : "Return to OpenCode \u2014 one more step may wait there: if it asks which budget covers usage, pick a project. This window can be closed.";
+  const statusLabel = isError ? "Authentication error" : "Authenticated";
+  const dotClass = isError ? "r33-status__dot r33-status__dot--error" : "r33-status__dot";
+  const codeLine = isError && safeCode.length > 0 ? `<p class="r33-code">Error code: <span class="r33-code__value">${safeCode}</span></p>` : "";
+  return `<!doctype html>
+<html lang="en" data-theme="dark">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${title} \xB7 route33.ai</title>
+<style>${PAGE_STYLE}</style>
+</head>
+<body>
+<main class="r33-page">
+<div class="r33-panel">
+${BRAND_MARK}
+<span class="r33-status"><span class="${dotClass}"></span>${statusLabel}</span>
+<h1 class="r33-headline">${headline}</h1>
+<p class="r33-subline">${subline}</p>
+${codeLine}
+</div>
+</main>
+</body>
+</html>`;
+};
+
+// src/auth/loopback-callback/loopback-callback.ts
+var createAuthLoopbackCallback = async () => {
+  let redirectUri = "http://127.0.0.1/callback";
+  let resolveCapture;
+  const captured = new Promise((resolve2) => {
+    resolveCapture = resolve2;
+  });
+  const server = createServer((request, response) => {
+    const url = new URL(request.url ?? "/", redirectUri);
+    if (request.method !== "GET" || url.pathname !== "/callback") {
+      response.writeHead(404).end();
+      return;
+    }
+    const resolve2 = resolveCapture;
+    resolveCapture = void 0;
+    resolve2?.(url);
+    const error = url.searchParams.get("error");
+    const page = error === null || error.length === 0 ? buildCallbackPage("success") : buildCallbackPage("error", error);
+    response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+    response.end(page);
+  });
+  await new Promise((resolve2, reject) => {
+    const onError = (cause) => {
+      reject(new AuthError("AUTH_CALLBACK_LISTEN_FAILED", { cause }));
+    };
+    server.once("error", onError);
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", onError);
+      resolve2();
+    });
+  });
+  const address = server.address();
+  if (address === null || typeof address === "string") {
+    server.close();
+    throw new AuthError("AUTH_CALLBACK_LISTEN_FAILED");
+  }
+  redirectUri = `http://127.0.0.1:${String(address.port)}/callback`;
+  return {
+    redirectUri,
+    close: () => {
+      if (!server.listening) {
+        return Promise.resolve();
+      }
+      return new Promise((resolve2, reject) => {
+        server.close((cause) => {
+          if (cause === void 0) {
+            resolve2();
+            return;
+          }
+          reject(new AuthError("AUTH_CALLBACK_CLEANUP_FAILED", { cause }));
+        });
+      });
+    },
+    wait: () => captured
+  };
+};
+
+// src/auth/open-system-browser/open-system-browser.ts
+import { spawn } from "node:child_process";
+var openSystemBrowser = async (url, options = {}) => new Promise((resolve2, reject) => {
+  let command = "xdg-open";
+  let args = [url.href];
+  if (process.platform === "darwin") {
+    command = "open";
+  } else if (process.platform === "win32") {
+    command = "cmd";
+    args = ["/c", "start", "", url.href];
+  }
+  if (options.spawnUrl !== void 0) {
+    options.spawnUrl(command, args, { detached: true, stdio: "ignore" });
+    resolve2();
+    return;
+  }
+  const child = spawn(command, args, {
+    detached: true,
+    stdio: "ignore"
+  });
+  child.once("error", reject);
+  child.once("spawn", () => {
+    child.unref();
+    resolve2();
+  });
+});
+
+// src/auth/open-browser-and-capture/open-browser-and-capture.ts
+var openBrowserAndCapture = async (options) => {
+  const callback = await createAuthLoopbackCallback();
+  const authorizationUrl = options.authorizationUrl(callback.redirectUri);
+  const browserRunner = options.browserRunner ?? ((url) => openSystemBrowser(url));
+  let timer;
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      reject(new AuthError("AUTH_CALLBACK_TIMEOUT"));
+    }, options.timeoutMs ?? 12e4);
+  });
+  const launch = browserRunner(authorizationUrl).catch((cause) => {
+    throw new AuthError("AUTH_BROWSER_LAUNCH_FAILED", { cause });
+  });
+  try {
+    const completed = await Promise.race([
+      Promise.all([launch, callback.wait()]),
+      timeout
+    ]);
+    const callbackUrl = completed[1];
+    const actualState = callbackUrl.searchParams.get("state");
+    if (actualState === null) {
+      throw new AuthError("AUTH_CALLBACK_RESPONSE_INVALID");
+    }
+    const expectedState = Buffer.from(options.expectedState);
+    const receivedState = Buffer.from(actualState);
+    if (expectedState.length !== receivedState.length || !timingSafeEqual(expectedState, receivedState)) {
+      throw new AuthError("AUTH_CALLBACK_STATE_MISMATCH");
+    }
+    const code = callbackUrl.searchParams.get("code");
+    if (code === null || code.length === 0) {
+      throw new AuthError("AUTH_CALLBACK_RESPONSE_INVALID");
+    }
+    return { code, redirectUri: callback.redirectUri };
+  } finally {
+    if (timer !== void 0) {
+      clearTimeout(timer);
+    }
+    await callback.close();
+  }
+};
+
+// src/auth/pkce-verifier-and-challenge/pkce-verifier-and-challenge.ts
+import { randomBytes } from "node:crypto";
+
+// src/auth/pkce-challenge/pkce-challenge.ts
+import { createHash as createHash3 } from "node:crypto";
+var pkceChallenge = (verifier) => createHash3("sha256").update(verifier).digest("base64url");
+
+// src/auth/pkce-verifier-and-challenge/pkce-verifier-and-challenge.ts
+var createPkceVerifierAndChallenge = () => {
+  const codeVerifier = randomBytes(32).toString("base64url");
+  return {
+    codeChallenge: pkceChallenge(codeVerifier),
+    codeVerifier,
+    state: randomBytes(32).toString("base64url")
+  };
+};
+
+// src/auth/requested-scopes/requested-scopes.ts
+var REQUESTED_OAUTH_SCOPES = "openid offline_access orgs:read projects:read keys:read keys:write";
+
+// src/auth/login-flow/login-flow.ts
+var loginFlow = async (options) => {
+  const log = options.logger ?? logger;
+  log.info("auth.login.started");
+  const pkce = createPkceVerifierAndChallenge();
+  const captured = await openBrowserAndCapture({
+    authorizationUrl: (redirectUri) => options.session.authorizationUrl({
+      clientId: options.clientId,
+      codeChallenge: pkce.codeChallenge,
+      redirectUri,
+      scope: REQUESTED_OAUTH_SCOPES,
+      state: pkce.state
+    }),
+    ...options.browserRunner === void 0 ? {} : { browserRunner: options.browserRunner },
+    expectedState: pkce.state,
+    ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
+  });
+  const tokenSet = await options.session.exchangeCode({
+    code: captured.code,
+    codeVerifier: pkce.codeVerifier,
+    redirectUri: captured.redirectUri
+  });
+  let credential;
+  try {
+    credential = parseManagementJwt(tokenSet.access_token);
+  } catch (cause) {
+    throw new AuthError("AUTH_TOKEN_RESPONSE_INVALID", { cause });
+  }
+  log.info("auth.login.completed");
+  return { credential, tokenSet };
+};
+
+// src/route33-runtime/login-session/login-session.ts
+var EXPIRY_SKEW_MS = 6e4;
+var LoginSession = class {
+  #options;
+  #result;
+  #expiresAt;
+  constructor(options) {
+    this.#options = options;
+  }
+  /**
+   * Resolves the login once per process, sharing in-flight attempts.
+   * @param policy - Whether this attempt may start a browser login; an in-flight attempt is always shared.
+   * @returns The token set plus its typed management credential.
+   */
+  result(policy = {}) {
+    if (this.#result !== void 0 && this.#expiresAt !== void 0 && Date.now() >= this.#expiresAt - EXPIRY_SKEW_MS) {
+      this.#result = void 0;
+    }
+    this.#result ??= this.#start(policy).catch((cause) => {
+      this.#result = void 0;
+      throw cause;
+    });
+    return this.#result;
+  }
+  /**
+   * Resolves only the management credential for lazy management clients.
+   * @param policy - Whether this attempt may start a browser login.
+   * @returns The current login's typed management credential.
+   */
+  async credential(policy = {}) {
+    return (await this.result(policy)).credential;
+  }
+  async #start(policy) {
+    const viaRefresh = await this.#tryRefresh();
+    if (viaRefresh !== void 0) {
+      return viaRefresh;
+    }
+    if (policy.allowBrowser === false) {
+      throw new AuthError("AUTH_REAUTHENTICATION_REQUIRED");
+    }
+    await this.#options.presenter?.present(TRUSTED_PARTY_COPY);
+    const result = await loginFlow(this.#options.auth);
+    this.#trackExpiry(result.tokenSet.expires_in);
+    await this.#persist(result.tokenSet.refresh_token);
+    return result;
+  }
+  async #tryRefresh() {
+    const tokenStore = this.#options.tokenStore;
+    if (tokenStore === void 0) {
+      return void 0;
+    }
+    const stored = await tokenStore.get();
+    if (stored === void 0 || stored === "") {
+      return void 0;
+    }
+    let tokenSet;
+    try {
+      tokenSet = await this.#options.auth.session.refresh(stored);
+    } catch {
+      logger.info("auth.refresh.fell-back-to-browser");
+      return void 0;
+    }
+    let credential;
+    try {
+      credential = parseManagementJwt(tokenSet.access_token);
+    } catch (cause) {
+      throw new AuthError("AUTH_TOKEN_RESPONSE_INVALID", { cause });
+    }
+    this.#trackExpiry(tokenSet.expires_in);
+    await this.#persist(tokenSet.refresh_token);
+    return { credential, tokenSet };
+  }
+  #trackExpiry(expiresIn) {
+    this.#expiresAt = Date.now() + expiresIn * 1e3;
+  }
+  async #persist(token) {
+    try {
+      await this.#options.tokenStore?.set(token);
+    } catch {
+      logger.warn("auth.token.persist-failed");
+    }
+  }
+};
+
+// src/route33-runtime/route33-runtime.ts
+var Route33Runtime = class {
+  #options;
+  #session;
+  #managementClient;
+  constructor(options) {
+    this.#options = options;
+    this.#session = new LoginSession({
+      auth: options.auth,
+      ...options.presenter === void 0 ? {} : { presenter: options.presenter },
+      ...options.tokenStore === void 0 ? {} : { tokenStore: options.tokenStore }
+    });
+  }
+  /**
+   * Runs the browser or refresh-token login once for this process.
+   * @param policy - Whether this attempt may start a browser login.
+   * @returns The token set plus its typed management credential.
+   */
+  login(policy = {}) {
+    return this.#session.result(policy);
+  }
+  /**
+   * Lists projects visible to the current management login.
+   * @returns Projects with their listing organisation stitched in.
+   */
+  async listProjects() {
+    const credential = await this.#session.credential();
+    const client = this.#client();
+    const organizations = await client.listOrganizations(credential);
+    const projects = await Promise.all(
+      organizations.data.map(async (organization) => {
+        const collection = await client.listProjects(
+          credential,
+          organization.id
+        );
+        return collection.data.map((project) => ({
+          ...project,
+          organisation: { id: organization.id, name: organization.name }
+        }));
+      })
+    );
+    return projects.flat();
+  }
+  /**
+   * Reads the stored key for a saved attribution without any login.
+   * @returns The reusable key and lease when the stored lease is still valid.
+   */
+  async storedReusableKey() {
+    const attribution = readAttribution(this.#options.state);
+    if (attribution === void 0) {
+      return void 0;
+    }
+    const installation = this.#installation(attribution);
+    await this.#hydrateState(installation);
+    const storedKey = await installation.secretStore.get();
+    return reusableLease({
+      attribution,
+      current: installation.state.snapshot(),
+      now: this.#now(),
+      policy: resolveLeasePolicy(this.#options.policy),
+      state: installation.state,
+      storedKey
+    });
+  }
+  /**
+   * Resolves the current gateway credential for the config hook.
+   * @returns A leased inference key.
+   */
+  async resolveCredential() {
+    return (await this.#lease(this.#options.policy)).key;
+  }
+  /**
+   * Resolves the workspace-owned key for any directory without prompting.
+   * @param directory - Session directory whose worktree attribution decides the key.
+   * @returns That workspace's leased key, or undefined when it never connected.
+   */
+  async resolveWorkspaceCredential(directory) {
+    const attribution = readAttribution({
+      directory,
+      outsideWorktree: "return-undefined"
+    });
+    if (attribution === void 0) {
+      return void 0;
+    }
+    return (await this.#leaseAttribution(attribution, void 0, directory)).key;
+  }
+  /**
+   * Builds injectable handlers for the host's command surface.
+   * @returns Change, reset, rotate, and safe inspection handlers.
+   */
+  commandHandlers() {
+    return {
+      "change-attribution": () => changeAttribution({
+        clear: () => {
+          clearAttribution(this.#options.state);
+        },
+        prompt: () => this.#resolveAttribution()
+      }),
+      "inspect-session": () => inspectSession({
+        readAttribution: () => readAttribution(this.#options.state),
+        readLease: () => {
+          const attribution = readAttribution(this.#options.state);
+          return attribution === void 0 ? void 0 : this.#installation(attribution).state.snapshot();
+        }
+      }),
+      "reset-attribution": () => resetAttribution({
+        clear: () => {
+          clearAttribution(this.#options.state);
+        }
+      }),
+      "rotate-now": () => rotateNow({
+        lease: (policy) => this.#lease({ ...this.#options.policy, ...policy })
+      })
+    };
+  }
+  #client() {
+    const client = this.#options.management.client;
+    if (typeof client !== "function") {
+      return client;
+    }
+    this.#managementClient ??= client();
+    return this.#managementClient;
+  }
+  #subject(credential) {
+    const subject = this.#options.management.subject;
+    if (subject === void 0) {
+      return parseManagementSubject(credential);
+    }
+    return typeof subject === "string" ? subject : subject(credential);
+  }
+  #now() {
+    return (this.#options.clock ?? Date.now)();
+  }
+  async #resolveAttribution() {
+    return resolveAttribution({
+      loadProjects: async () => {
+        await this.#session.credential();
+        return this.listProjects();
+      },
+      ...this.#options.presenter === void 0 ? {} : { presenter: this.#options.presenter },
+      state: this.#options.state
+    });
+  }
+  async #lease(policy) {
+    const attribution = await this.#resolveAttribution();
+    return this.#leaseAttribution(attribution, policy);
+  }
+  async #leaseAttribution(attribution, policy, directory = this.#options.state.directory) {
+    const installation = this.#installation(attribution, directory);
+    await this.#hydrateState(installation);
+    const minted = await leaseForAttribution({
+      attribution,
+      ...this.#options.clock === void 0 ? {} : { clock: this.#options.clock },
+      installation,
+      management: {
+        client: this.#client(),
+        credential: () => this.#session.credential(),
+        subject: async () => this.#subject(await this.#session.credential())
+      },
+      ...policy === void 0 ? {} : { policy }
+    });
+    await this.#persistState(installation, minted.lease);
+    return minted;
+  }
+  async #hydrateState(installation) {
+    const store = installation.stateStore;
+    if (store === void 0 || installation.state.snapshot() !== void 0) {
+      return;
+    }
+    try {
+      const persisted = await store.get();
+      if (persisted !== void 0) {
+        installation.state.compareAndSwap(void 0, persisted);
+      }
+    } catch {
+    }
+  }
+  async #persistState(installation, lease) {
+    try {
+      await installation.stateStore?.set(lease);
+    } catch {
+    }
+  }
+  #installation(attribution, directory = this.#options.state.directory) {
+    switch (attribution.kind) {
+      case "personal":
+        return this.#options.installation(deriveScopeId({ attribution }));
+      case "project": {
+        const folderRealpath = detectWorktreeRoot(directory);
+        if (folderRealpath === void 0) {
+          throw new TypeError("Project lease scope requires a worktree root");
+        }
+        return this.#options.installation(
+          deriveScopeId({ attribution, folderRealpath })
+        );
+      }
+      default: {
+        const unexpected = attribution;
+        throw new TypeError(`Unexpected attribution: ${String(unexpected)}`);
+      }
+    }
+  }
+};
+
+// src/v1-entry/unattributed-prompt-gate/unattributed-prompt-gate.ts
+var createUnattributedPromptGate = ({ directory, outsideWorktree }) => (input) => {
+  if (input.model?.providerID !== "route_33") return Promise.resolve();
+  const attribution = readAttribution({ directory, outsideWorktree });
+  if (attribution !== void 0) return Promise.resolve();
+  return Promise.reject(
+    new Error(
+      "Route 33 needs a budget for this folder first \u2014 run /r33 in OpenCode, choose Route 33, and assign a budget."
+    )
+  );
+};
+
+// src/v1-entry/workspace-key-headers/workspace-key-headers.ts
+var createWorkspaceKeyHeaders = ({ resolveKey, session }) => async (input, output) => {
+  const workspace = await session.get({ sessionID: input.sessionID });
+  const key = await resolveKey(workspace.location.directory);
+  if (key === void 0) return;
+  output.headers["Authorization"] = `Bearer ${key.value}`;
+};
+
+// src/create-route33-plugin/create-route33-plugin.ts
+var createRoute33Plugin = (options = {}) => {
+  const baseURL = readEnvBaseUrl();
+  const clientId = options.clientId ?? readEnvClientId() ?? DEFAULT_ROUTE33_CLIENT_ID;
+  const directKey = readEnvDirectApiKey();
+  const resolvedConfig = {
+    ...baseURL === void 0 ? {} : { baseURL },
+    cacheDir: readEnvCacheDir(),
+    catalogTtlMs: readEnvCatalogTtlMs(),
+    disableIdShim: readEnvDisableIdShim(),
+    discoveryEnabled: readEnvDiscovery(),
+    strict: readEnvStrict(),
+    ...options.config
+  };
+  const runtimeOptions = options.runtime;
+  const installation = runtimeOptions === void 0 ? void 0 : runtimeOptions.installation ?? createLeaseInstallationFactory({
+    createSecretStore: (scopeId) => new FileSecretStore({
+      directory: resolveV1SecretStoreDirectory({
+        ...options.secretStoreDirectory === void 0 ? {} : { directory: options.secretStoreDirectory }
+      }),
+      scopeId
+    })
+  });
+  return (input) => {
+    const runtime = runtimeOptions === void 0 || installation === void 0 ? void 0 : new Route33Runtime({
+      ...runtimeOptions,
+      auth: { ...runtimeOptions.auth, clientId },
+      installation,
+      state: {
+        directory: input.worktree,
+        outsideWorktree: "return-undefined"
+      }
+    });
+    if (runtime !== void 0) {
+      options.bindRuntime?.(runtime);
+      if (options.registerCommands !== void 0) {
+        options.registerCommands(runtime.commandHandlers());
+      }
+    }
+    let credentialProvider;
+    let workspaceHeaders;
+    let promptGate;
+    if (directKey !== void 0) {
+      credentialProvider = () => Promise.resolve(parseGatewayKey(directKey));
+    } else if (runtime === void 0) {
+      credentialProvider = () => Promise.reject(
+        new AttributionPromptError("ATTRIBUTION_PRESENTER_UNAVAILABLE")
+      );
+    } else {
+      credentialProvider = () => runtime.resolveCredential();
+      workspaceHeaders = createWorkspaceKeyHeaders({
+        resolveKey: (directory) => runtime.resolveWorkspaceCredential(directory),
+        session: {
+          get: async ({ sessionID }) => {
+            const session = await options.readSession?.(sessionID);
+            return session ?? { location: { directory: input.worktree } };
+          }
+        }
+      });
+      promptGate = createUnattributedPromptGate({
+        directory: input.worktree,
+        outsideWorktree: "return-undefined"
+      });
+    }
+    return Promise.resolve({
+      config: createConfigHook({
+        ...resolvedConfig,
+        credentialProvider,
+        cwd: input.worktree
+      }),
+      ...workspaceHeaders === void 0 ? {} : { "chat.headers": workspaceHeaders },
+      ...promptGate === void 0 ? {} : { "chat.message": promptGate }
+    });
+  };
+};
+
+// src/contract/management-keys/parse-api-key/parse-api-key.ts
+var parseApiKey = (value) => {
+  if (!isRecord(value) || !isOwnerType(value["ownership_type"]) || !isNullableString(value["project_id"])) {
+    throw new ContractParseError("invalid API key");
+  }
+  const field = (name) => {
+    const text = value[name];
+    if (typeof text !== "string") {
+      throw new ContractParseError("invalid API key");
+    }
+    return text;
+  };
+  const status = value["status"];
+  if (status !== "active" && status !== "revoked") {
+    throw new ContractParseError("invalid API key");
+  }
+  return {
+    expires_at: field("expires_at"),
+    id: field("id"),
+    name: field("name"),
+    org_id: field("org_id"),
+    ownership_type: value["ownership_type"],
+    project_id: value["project_id"],
+    revoked: value["revoked"] === true,
+    status
+  };
+};
+
+// src/contract/management-keys/parse-collection/parse-collection.ts
+var parseCollection = (value, parseItem) => {
+  if (!isRecord(value)) {
+    throw new ContractParseError("invalid management collection");
+  }
+  const data = value["data"];
+  if (!Array.isArray(data)) {
+    throw new ContractParseError("invalid management collection");
+  }
+  const page = value["page"];
+  if (!isRecord(page)) {
+    throw new ContractParseError("invalid management collection");
+  }
+  const limit = page["limit"];
+  if (typeof limit !== "number") {
+    throw new ContractParseError("invalid management collection");
+  }
+  if (![Number.isInteger(limit), limit >= 1, limit <= 500].every(Boolean)) {
+    throw new ContractParseError("invalid management collection");
+  }
+  const nextCursor = page["next_cursor"];
+  if (!isNullableString(nextCursor)) {
+    throw new ContractParseError("invalid management collection");
+  }
+  const hasMore = page["has_more"];
+  if (typeof hasMore !== "boolean") {
+    throw new ContractParseError("invalid management collection");
+  }
+  const collection = {
+    data: data.map(parseItem),
+    page: {
+      has_more: hasMore,
+      limit,
+      next_cursor: nextCursor
+    }
+  };
+  const meta = value["meta"];
+  if (meta === void 0) {
+    return collection;
+  }
+  if (!isRecord(meta)) {
+    throw new ContractParseError("invalid management collection");
+  }
+  return { ...collection, meta };
+};
+
+// src/contract/management-keys/parse-key-material/parse-key-material.ts
+var parseKeyMaterial = (value) => {
+  if (!isRecord(value) || typeof value["key"] !== "string") {
+    throw new ContractParseError("invalid key material");
+  }
+  return { ...parseApiKey(value), key: new GatewayApiKey(value["key"]) };
+};
+
+// src/contract/management-keys/parse-organization/parse-organization.ts
+var parseOrganization = (value) => {
+  if (!isRecord(value)) {
+    throw new ContractParseError("invalid organization");
+  }
+  const stringField = (name) => {
+    const field = value[name];
+    if (typeof field !== "string") {
+      throw new ContractParseError("invalid organization");
+    }
+    return field;
+  };
+  const nullableStringField = (name) => {
+    const field = value[name];
+    if (!isNullableString(field)) {
+      throw new ContractParseError("invalid organization");
+    }
+    return field;
+  };
+  const numberField = (name) => {
+    const field = value[name];
+    if (typeof field !== "number") {
+      throw new ContractParseError("invalid organization");
+    }
+    return field;
+  };
+  const nullableNumberField = (name) => {
+    const field = value[name];
+    if (typeof field !== "number" && field !== null) {
+      throw new ContractParseError("invalid organization");
+    }
+    return field;
+  };
+  const booleanField = (name) => {
+    const field = value[name];
+    if (typeof field !== "boolean") {
+      throw new ContractParseError("invalid organization");
+    }
+    return field;
+  };
+  const budgetField = (name) => {
+    const field = value[name];
+    if (field === null) {
+      return null;
+    }
+    if (!isRecord(field) || typeof field["amount"] !== "string" || typeof field["currency"] !== "string") {
+      throw new ContractParseError("invalid organization");
+    }
+    return { amount: field["amount"], currency: field["currency"] };
+  };
+  const setupStatus = value["setup_status"];
+  if (setupStatus !== "broken" && setupStatus !== "ok" && setupStatus !== "partial" && setupStatus !== "unvalidated") {
+    throw new ContractParseError("invalid organization");
+  }
+  return {
+    alert_active: booleanField("alert_active"),
+    alert_percentage: numberField("alert_percentage"),
+    azure_group_id: nullableStringField("azure_group_id"),
+    azure_owners_group_id: nullableStringField("azure_owners_group_id"),
+    created_at: nullableStringField("created_at"),
+    deactivated_at: nullableStringField("deactivated_at"),
+    default_project_budget: budgetField("default_project_budget"),
+    default_user_budget: budgetField("default_user_budget"),
+    domain: nullableStringField("domain"),
+    id: stringField("id"),
+    idp_connection: nullableStringField("idp_connection"),
+    member_count: nullableNumberField("member_count"),
+    name: stringField("name"),
+    scim_sync: nullableStringField("scim_sync"),
+    setup_status: setupStatus,
+    slug: nullableStringField("slug"),
+    tenant_id: nullableStringField("tenant_id"),
+    updated_at: nullableStringField("updated_at")
+  };
+};
+
+// src/contract/management-keys/parse-project/parse-project.ts
+var parseProject = (value) => {
+  if (!isRecord(value) || !hasStringFields(value, ["id", "name"]) || !hasStringFields(value, ["id", "name", "org_id"])) {
+    throw new ContractParseError("invalid project");
+  }
+  return {
+    id: value["id"] ?? "",
+    name: value["name"] ?? "",
+    org_id: value["org_id"] ?? ""
+  };
+};
+
+// src/management/management-error/management-error.ts
+var ManagementError = class extends Error {
+  constructor(code, options) {
+    super(
+      "Route 33 management request failed",
+      options?.cause === void 0 ? void 0 : { cause: "Route 33 management dependency failed" }
+    );
+    this.code = code;
+    this.name = "ManagementError";
+    this.statusCode = options?.statusCode;
+  }
+  code;
+  statusCode;
+};
+
+// src/management/management-http-transport/management-http-transport.ts
+var ManagementHttpTransport = class {
+  #baseUrl;
+  #credential;
+  #fetchImpl;
+  #onUnauthorized;
+  #timeoutMs;
+  constructor(options) {
+    const baseUrl = options.baseUrl ?? "https://api.route33.ai/v1";
+    this.#baseUrl = new URL(baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`);
+    this.#credential = options.credential;
+    this.#fetchImpl = options.fetchImpl ?? fetch;
+    this.#onUnauthorized = options.onUnauthorized;
+    this.#timeoutMs = options.timeoutMs ?? 1e4;
+  }
+  /** Sends a request and reads one JSON value under the request timeout.
+   * @param request - Management path, method, and optional JSON body.
+   * @returns The untrusted response value.
+   */
+  json(request) {
+    return this.#perform(request, async (response) => {
+      try {
+        return await response.json();
+      } catch (cause) {
+        throw new ContractParseError("invalid management response", { cause });
+      }
+    });
+  }
+  /** Sends a request whose successful response has no body.
+   * @param request - Management path and method.
+   */
+  empty(request) {
+    return this.#perform(request, () => Promise.resolve());
+  }
+  async #perform(request, consume) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => {
+      controller.abort();
+    }, this.#timeoutMs);
+    const headers = new Headers({
+      accept: "application/json",
+      authorization: `Bearer ${this.#credential.value}`
+    });
+    if (request.body !== void 0) {
+      headers.set("content-type", "application/json");
+    }
+    try {
+      const send = () => this.#fetchImpl(new URL(request.path, this.#baseUrl), {
+        ...request.body === void 0 ? {} : { body: JSON.stringify(request.body) },
+        headers,
+        method: request.method,
+        signal: controller.signal
+      });
+      let response = await send();
+      if (response.status === 401 && this.#onUnauthorized !== void 0) {
+        await this.#onUnauthorized();
+        response = await send();
+      }
+      if (!response.ok) {
+        throw new ManagementError(
+          response.status === 401 ? "MANAGEMENT_UNAUTHORIZED" : "MANAGEMENT_HTTP_ERROR",
+          { statusCode: response.status }
+        );
+      }
+      return await consume(response);
+    } catch (cause) {
+      if (cause instanceof ManagementError) {
+        throw cause;
+      }
+      if (controller.signal.aborted) {
+        throw new ManagementError("MANAGEMENT_TIMEOUT", { cause });
+      }
+      if (cause instanceof ContractParseError) {
+        throw cause;
+      }
+      throw new ManagementError("MANAGEMENT_NETWORK_ERROR", { cause });
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+};
+
+// src/management/http-management-keys/http-management-keys.ts
+var HttpManagementKeys = class {
+  #credential;
+  #transport;
+  constructor(options) {
+    this.#credential = options.credential;
+    this.#transport = new ManagementHttpTransport(options);
+  }
+  /** Creates a future-expiring ownership-scoped key.
+   * @param accessToken - Credential required by the frozen contract.
+   * @param input - Key name, expiry, and ownership.
+   * @returns One-time key material.
+   */
+  async create(accessToken, input) {
+    this.#authorize(accessToken);
+    return parseKeyMaterial(
+      await this.#transport.json({
+        body: {
+          expires_at: input.expiresAt,
+          name: input.name,
+          ...input.ownerId === null ? {} : { owner_user_id: input.ownerId },
+          owner_type: input.ownerType,
+          ...input.projectId === null ? {} : { project_id: input.projectId }
+        },
+        method: "POST",
+        path: "api-keys"
+      })
+    );
+  }
+  /** Treats a successful empty response as confirmation of permanent removal.
+   * @param accessToken - Credential required by the frozen contract.
+   * @param id - Key identifier.
+   */
+  async delete(accessToken, id) {
+    this.#authorize(accessToken);
+    await this.#transport.empty({
+      method: "DELETE",
+      path: `api-keys/${encodeURIComponent(id)}`
+    });
+  }
+  /** Gets a safe key DTO.
+   * @param accessToken - Credential required by the frozen contract.
+   * @param id - Key identifier.
+   * @returns The secret-free key DTO.
+   */
+  async get(accessToken, id) {
+    this.#authorize(accessToken);
+    return parseApiKey(
+      await this.#transport.json({
+        method: "GET",
+        path: `api-keys/${encodeURIComponent(id)}`
+      })
+    );
+  }
+  /** Lists safe key DTOs.
+   * @param accessToken - Credential required by the frozen contract.
+   * @returns The parsed key collection.
+   */
+  async list(accessToken) {
+    this.#authorize(accessToken);
+    return parseCollection(
+      await this.#transport.json({ method: "GET", path: "api-keys" }),
+      parseApiKey
+    );
+  }
+  /** Lists organizations visible to the authenticated management subject.
+   * @param accessToken - Credential required by the frozen contract.
+   * @returns The parsed organization collection.
+   */
+  async listOrganizations(accessToken) {
+    this.#authorize(accessToken);
+    return parseCollection(
+      await this.#transport.json({ method: "GET", path: "orgs" }),
+      parseOrganization
+    );
+  }
+  /** Lists projects visible within an organisation filter.
+   * @param accessToken - Credential required by the frozen contract.
+   * @param organisationId - Required backend organisation filter.
+   * @returns The parsed project collection.
+   */
+  async listProjects(accessToken, organisationId) {
+    this.#authorize(accessToken);
+    if (organisationId.trim().length === 0) {
+      throw new ManagementError("MANAGEMENT_ORGANISATION_ID_REQUIRED", {
+        statusCode: 400
+      });
+    }
+    const query = new URLSearchParams({ org_id: organisationId });
+    return parseCollection(
+      await this.#transport.json({
+        method: "GET",
+        path: `projects?${query.toString()}`
+      }),
+      parseProject
+    );
+  }
+  /** Regenerates one-time key material while preserving expiry when omitted.
+   * @param accessToken - Credential required by the frozen contract.
+   * @param id - Key identifier.
+   * @param expiresAt - Optional replacement expiry.
+   * @returns Regenerated one-time key material.
+   */
+  async regenerate(accessToken, id, expiresAt) {
+    this.#authorize(accessToken);
+    return parseKeyMaterial(
+      await this.#transport.json({
+        body: expiresAt === void 0 ? {} : { expires_at: expiresAt },
+        method: "POST",
+        path: `api-keys/${encodeURIComponent(id)}/secrets`
+      })
+    );
+  }
+  /** Updates mutable key metadata.
+   * @param accessToken - Credential required by the frozen contract.
+   * @param id - Key identifier.
+   * @param input - Optional name and expiry replacements.
+   * @returns The updated safe key DTO.
+   */
+  async update(accessToken, id, input) {
+    this.#authorize(accessToken);
+    return parseApiKey(
+      await this.#transport.json({
+        body: {
+          ...input.expiresAt === void 0 ? {} : { expires_at: input.expiresAt },
+          ...input.name === void 0 ? {} : { name: input.name }
+        },
+        method: "PATCH",
+        path: `api-keys/${encodeURIComponent(id)}`
+      })
+    );
+  }
+  #authorize(accessToken) {
+    if (accessToken.value !== this.#credential.value) {
+      throw new ManagementError("MANAGEMENT_UNAUTHORIZED", {
+        statusCode: 401
+      });
+    }
+  }
+};
+
+// src/lazy-management-keys/lazy-management-keys.ts
+var lazyManagementKeys = (options) => {
+  const client = (accessToken) => new HttpManagementKeys({
+    baseUrl: options.apiBaseUrl,
+    credential: accessToken,
+    ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl }
+  });
+  return {
+    create: async (accessToken, input) => client(accessToken).create(accessToken, input),
+    delete: async (accessToken, id) => client(accessToken).delete(accessToken, id),
+    get: async (accessToken, id) => client(accessToken).get(accessToken, id),
+    list: async (accessToken) => client(accessToken).list(accessToken),
+    listOrganizations: async (accessToken) => client(accessToken).listOrganizations(accessToken),
+    listProjects: async (accessToken, organisationId) => client(accessToken).listProjects(accessToken, organisationId),
+    regenerate: async (accessToken, id, expiresAt) => client(accessToken).regenerate(accessToken, id, expiresAt),
+    update: async (accessToken, id, input) => client(accessToken).update(accessToken, id, input)
+  };
+};
+
+// src/production-runtime-options/production-runtime-options.ts
+var LOGIN_BUDGET_MS = 8.5 * 60 * 1e3;
+var buildProductionRuntimeOptions = (input) => ({
+  auth: {
+    ...input.browserRunner === void 0 ? {} : { browserRunner: input.browserRunner },
+    session: createAuthSession({
+      clientId: input.clientId,
+      issuerUrl: input.issuerUrl
+    }),
+    timeoutMs: LOGIN_BUDGET_MS
+  },
+  management: {
+    client: () => lazyManagementKeys({ apiBaseUrl: input.apiBaseUrl })
+  },
+  ...input.tokenStore === void 0 ? {} : { tokenStore: input.tokenStore }
+});
+
+// src/v2-entry/connect-copy/connect-copy.ts
+var CONNECT_COPY = {
+  failFastClientId: "This Route 33 build has no OAuth client id. Reinstall it from the opencode-dist ref, or set ROUTE33_CLIENT_ID and restart OpenCode.",
+  failFastWorktree: "Route 33 attributes usage to a project inside a Git worktree. Open a Git repository (or run git init), then connect again.",
+  selectionInvalid: "That Route 33 option is no longer available. Connect again and pick another.",
+  signedInNextStep: "Signed in to Route 33 \u2713. One more step: connect again, choose Route 33, and assign a budget for this folder."
+};
+
+// src/v2-entry/parse-connect-answer/parse-connect-answer.ts
+var ATTRIBUTION_FIELD_KEY = "attribution";
+var parseConnectAnswer = (answer) => {
+  const value = answer[ATTRIBUTION_FIELD_KEY];
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+};
+
+// src/v2-entry/connect-authorize/connect-authorize.ts
+var createConnectAuthorize = (deps) => async (answer = {}) => {
+  if (deps.clientId === "") {
+    throw new GatewayCredentialError(CONNECT_COPY.failFastClientId);
+  }
+  if (detectWorktreeRoot(deps.directory) === void 0) {
+    throw new GatewayCredentialError(CONNECT_COPY.failFastWorktree);
+  }
+  const selection = parseConnectAnswer(answer);
+  if (selection !== void 0) {
+    const choice = deps.getPlan()?.choicesBySelection[selection];
+    if (choice === void 0) {
+      throw new AttributionPromptError("ATTRIBUTION_SELECTION_INVALID");
+    }
+    writeAttribution(deps.state, choice);
+  }
+  if (readAttribution(deps.state) !== void 0) {
+    const callback2 = deps.resolveCredential();
+    const decision2 = await deps.stash.urlForConnect(
+      callback2.then(() => void 0)
+    );
+    return {
+      callback: callback2,
+      instructions: decision2.instructions,
+      mode: "auto",
+      url: decision2.url
+    };
+  }
+  const runtime = deps.getRuntime();
+  if (runtime === void 0) {
+    throw new GatewayCredentialError(
+      "Route 33 authorization is unavailable in this host"
+    );
+  }
+  const callback = (async () => {
+    await runtime.login();
+    try {
+      return await deps.resolveCredential();
+    } catch (error) {
+      if (error instanceof AttributionPromptError && error.code === "ATTRIBUTION_PRESENTER_UNAVAILABLE") {
+        await deps.registerProjectForm();
+        throw new GatewayCredentialError(CONNECT_COPY.signedInNextStep);
+      }
+      throw error;
+    }
+  })();
+  const decision = await deps.stash.urlForConnect(
+    callback.catch(() => void 0)
+  );
+  return {
+    callback,
+    instructions: decision.instructions,
+    mode: "auto",
+    url: decision.url
+  };
+};
+
+// src/v2-entry/connect-form/connect-form.ts
+var ATTRIBUTION_FIELD_KEY2 = "attribution";
+var buildConnectForm = (plan) => ({
+  key: ATTRIBUTION_FIELD_KEY2,
+  options: plan.options.map((option) => ({
+    label: option.label,
+    value: option.selection
+  })),
+  required: true,
+  title: "Which budget covers Route 33 usage in this folder?",
+  type: "string"
+});
+
+// src/v2-entry/map-route33-v2-provider/map-route33-v2-provider.ts
+import { Integration, Model, Provider } from "@opencode/plugin";
+var mapRoute33V2Provider = (provider) => {
+  const providerID = Provider.ID.make("route_33");
+  const info = Object.assign(Provider.Info.empty(providerID), {
+    activation: "enabled",
+    integrationID: Integration.ID.make("route33"),
+    name: provider?.name ?? "route_33",
+    package: "@opencode/ai/providers/openai-compatible"
+  });
+  if (provider === void 0) {
+    return { info, models: [] };
+  }
+  const options = provider.options;
+  const baseURL = options?.["baseURL"];
+  const apiKey = options?.["apiKey"];
+  const headerTimeout = options?.["headerTimeout"];
+  return {
+    info: Object.assign(info, {
+      settings: {
+        apiKey,
+        baseURL,
+        headerTimeout
+      }
+    }),
+    models: Object.entries(provider.models ?? {}).flatMap(
+      ([modelID, model]) => model === void 0 ? [] : [
+        {
+          ...Model.Info.default(providerID, Model.ID.make(modelID)),
+          name: typeof model["name"] === "string" ? model["name"] : modelID
+        }
+      ]
+    )
+  };
+};
+
+// src/v2-entry/direct-key-mode/direct-key-mode.ts
+var directKeyMode = async (context, options, compose) => {
+  const hooks = await compose(options)({
+    worktree: context.location.directory
+  });
+  const config = {};
+  await hooks.config(config);
+  const provider = mapRoute33V2Provider(
+    config.provider?.route_33
+  );
+  const providerTransform = await context.provider.transform((editor) => {
+    editor.add(provider);
+  });
+  await context.provider.reload();
+  return async () => {
+    await providerTransform.dispose();
+  };
+};
+
+// src/v2-entry/host-lease-state-store/host-lease-state-store.ts
+var hostLeaseStateStore = (options) => ({
+  get: async () => {
+    const value = await options.storage.get(options.key);
+    if (value === void 0) {
+      return void 0;
+    }
+    if (typeof value !== "string") {
+      throw new ContractParseError("lease metadata must be a JSON string");
+    }
+    return LeaseState.restore(JSON.parse(value)).snapshot();
+  },
+  set: async (state) => {
+    if (state === void 0) {
+      await options.storage.remove(options.key);
+      return;
+    }
+    await options.storage.set(options.key, JSON.stringify(state));
+  }
+});
+
+// src/v2-entry/host-token-store/host-token-store.ts
+var DEFAULT_TOKEN_KEY = "route33:auth";
+var hostTokenStore = (options) => ({
+  get: async () => {
+    const value = await options.storage.get(options.key ?? DEFAULT_TOKEN_KEY);
+    return typeof value === "string" ? value : void 0;
+  },
+  set: async (value) => {
+    if (value === void 0) {
+      await options.storage.remove(options.key ?? DEFAULT_TOKEN_KEY);
+      return;
+    }
+    await options.storage.set(options.key ?? DEFAULT_TOKEN_KEY, value);
+  }
+});
+
+// src/v2-entry/parse-r33-subcommand/parse-r33-subcommand.ts
+var SUBCOMMANDS = ["inspect", "rotate", "reset"];
+var parseR33Subcommand = (promptText) => {
+  const [first = "", ...rest] = promptText.trim().split(/\s+/u).filter(Boolean);
+  const name = first.replace(/^\/+/u, "").split(":")[0] ?? "";
+  const argument = name === "r33" ? rest[0] : first;
+  if (argument === void 0 || argument === "") {
+    return "inspect";
+  }
+  return SUBCOMMANDS.includes(argument) ? argument : "help";
+};
+
+// src/v2-entry/r33-command/r33-command.ts
+var executeR33Command = async (input) => {
+  const subcommand = parseR33Subcommand(input.promptText);
+  if (input.handlers === void 0) {
+    return "Route 33 is not connected in this folder. Run /connect, choose Route 33, and follow the steps.";
+  }
+  if (subcommand === "help") {
+    return "Route 33 usage: /r33 [inspect|rotate|reset] \u2014 inspect shows attribution and key rotation, rotate rotates the key now, reset clears the assigned budget (assign again with /connect).";
+  }
+  switch (subcommand) {
+    case "rotate": {
+      const lease = await input.handlers["rotate-now"]();
+      return `Route 33 key rotated. Key ${lease.keyId} is valid until ${lease.expiresAt}.`;
+    }
+    case "reset": {
+      await input.handlers["reset-attribution"]();
+      return "Route 33 attribution cleared. Run /connect, choose Route 33, and assign a budget again.";
+    }
+    default: {
+      return JSON.stringify(input.handlers["inspect-session"](), null, 2);
+    }
+  }
+};
+
+// src/v2-entry/v2-unattributed-model-gate/v2-unattributed-model-gate.ts
+var GATE_COPY = "Route 33 needs a budget for this folder first \u2014 finish the setup dialog in the TUI, or run /connect, choose Route 33, and follow the steps.";
+var createV2UnattributedModelGate = (deps) => async (input) => {
+  if (input.model.providerID !== "route_33") return;
+  const session = await deps.session.get({ sessionID: input.sessionID });
+  const directory = session?.location.directory ?? deps.fallbackDirectory;
+  const state = {
+    directory,
+    outsideWorktree: "return-undefined"
+  };
+  if (readAttribution(state) !== void 0) return;
+  throw new Error(GATE_COPY);
+};
+
+// src/v2-entry/workspace-key-request-hook/workspace-key-request-hook.ts
+var createWorkspaceKeyHook = (deps) => async (input) => {
+  const target = new URL(input.request.url);
+  const gateway = new URL(deps.gatewayBase);
+  if (target.origin !== gateway.origin) {
+    return;
+  }
+  const session = await deps.session.get({ sessionID: input.sessionID });
+  const key = await deps.resolveKey(session.location.directory);
+  if (key === void 0) {
+    return;
+  }
+  input.request.headers.set("Authorization", `Bearer ${key.value}`);
+};
+
+// src/v2-entry/create-route33-v2-plugin/create-route33-v2-plugin.ts
+var createRoute33V2Plugin = (options = {}) => {
+  const clientId = options.clientId ?? readEnvClientId() ?? DEFAULT_ROUTE33_CLIENT_ID;
+  const issuerUrl = options.issuerUrl ?? readEnvAuthIssuer() ?? DEFAULT_AUTH_ISSUER_URL;
+  const apiBaseUrl = options.apiBaseUrl ?? readEnvApiBase() ?? DEFAULT_MANAGEMENT_API_BASE_URL;
+  return Plugin.define({
+    id: "route33",
+    setup: async (context) => {
+      const directKey = readEnvDirectApiKey();
+      if (directKey !== void 0) {
+        return directKeyMode(context, options, createRoute33Plugin);
+      }
+      const methodID = Integration2.MethodID.make("browser");
+      const stash = createAuthorizationUrlStash();
+      const state = {
+        directory: context.location.directory,
+        outsideWorktree: "return-undefined"
+      };
+      const installation = createLeaseInstallationFactory({
+        createSecretStore: (scopeId) => new HostStorageSecretStore({
+          key: `route33:lease:${scopeId}`,
+          storage: context.storage
+        }),
+        createStateStore: (scopeId) => hostLeaseStateStore({
+          key: `route33:lease:${scopeId}:state`,
+          storage: context.storage
+        })
+      });
+      let runtime;
+      let provider = mapRoute33V2Provider(void 0);
+      let connectField;
+      let plan;
+      const runtimeInput = {
+        ...options.runtime ?? buildProductionRuntimeOptions({
+          apiBaseUrl,
+          browserRunner: stash.browserRunner,
+          clientId,
+          issuerUrl,
+          tokenStore: hostTokenStore({ storage: context.storage })
+        }),
+        installation
+      };
+      const hooks = await createRoute33Plugin({
+        ...options,
+        bindRuntime: (instance) => {
+          runtime = instance;
+        },
+        clientId,
+        runtime: runtimeInput
+      })({ worktree: context.location.directory });
+      const resolveCredential = async () => {
+        const config = {};
+        await hooks.config(config);
+        provider = mapRoute33V2Provider(
+          config.provider?.route_33
+        );
+        const stored = await runtime?.storedReusableKey();
+        if (stored === void 0) {
+          throw new GatewayCredentialError(
+            "Route 33 authorization completed without a usable gateway lease"
+          );
+        }
+        await context.provider.reload();
+        return {
+          access: stored.key.value,
+          expires: Date.parse(stored.lease.expiresAt),
+          methodID,
+          refresh: stored.lease.keyId,
+          type: "oauth"
+        };
+      };
+      const registerProjectForm = async () => {
+        if (runtime === void 0 || plan !== void 0) {
+          return;
+        }
+        plan = createAttributionPrompt(await runtime.listProjects());
+        connectField = buildConnectForm(plan);
+        await context.integration.reload();
+      };
+      const authorize = createConnectAuthorize({
+        clientId,
+        directory: context.location.directory,
+        getPlan: () => plan,
+        getRuntime: () => runtime,
+        registerProjectForm,
+        resolveCredential,
+        stash,
+        state
+      });
+      const providerTransform = await context.provider.transform((editor) => {
+        editor.add(provider);
+      });
+      const integrationTransform = await context.integration.transform(
+        (editor) => {
+          editor.method.update({
+            authorize: (answer) => authorize(answer),
+            integrationID: "route33",
+            method: {
+              id: methodID,
+              label: TRUSTED_PARTY_COPY.title,
+              type: "oauth",
+              ...connectField === void 0 ? {} : { form: [connectField] }
+            },
+            refresh: () => resolveCredential()
+          });
+        }
+      );
+      const commandTransform = await context.command.transform((editor) => {
+        editor.add({
+          description: "Route 33 status and key rotation: /r33 [inspect|rotate|reset]",
+          execute: async ({ prompt, sessionID }) => {
+            const text = await executeR33Command({
+              handlers: runtime?.commandHandlers(),
+              promptText: prompt.text
+            });
+            await context.session.synthetic({
+              delivery: "queue",
+              sessionID,
+              text
+            });
+          },
+          name: "r33"
+        });
+      });
+      const sessionHook = await context.session.hook(
+        "http.request",
+        createWorkspaceKeyHook({
+          gatewayBase: readEnvBaseUrl() ?? DEFAULT_BASE_URL,
+          resolveKey: (directory) => {
+            const active = runtime;
+            return active === void 0 ? Promise.resolve(void 0) : active.resolveWorkspaceCredential(directory);
+          },
+          session: context.session
+        })
+      );
+      const modelGate = await context.session.hook(
+        "model.request",
+        createV2UnattributedModelGate({
+          fallbackDirectory: context.location.directory,
+          session: context.session
+        }),
+        { providerID: "route_33" }
+      );
+      const bootstrapFromRefresh = async () => {
+        if (runtime === void 0) {
+          return;
+        }
+        try {
+          await runtime.login({ allowBrowser: false });
+        } catch {
+          return;
+        }
+        await registerProjectForm().catch(() => void 0);
+        try {
+          const config = {};
+          await hooks.config(config);
+          provider = mapRoute33V2Provider(
+            config.provider?.route_33
+          );
+        } catch (error) {
+          logger.info(
+            `route_33: catalog bootstrap skipped: ${error instanceof Error ? error.message : String(error)}`
+          );
+        }
+      };
+      await bootstrapFromRefresh();
+      await Promise.all([
+        context.integration.reload(),
+        context.provider.reload()
+      ]);
+      return async () => {
+        await Promise.all([
+          commandTransform.dispose(),
+          integrationTransform.dispose(),
+          providerTransform.dispose(),
+          sessionHook.dispose(),
+          modelGate.dispose()
+        ]);
+      };
+    }
+  });
+};
+
+// src/v2-entry/index.ts
+var Route33PluginV2 = createRoute33V2Plugin();
+var v2_entry_default = Route33PluginV2;
+export {
+  Route33PluginV2,
+  createRoute33V2Plugin,
+  v2_entry_default as default
+};