@route_33/opencode 0.4.7-rc.7 → 0.4.7-rc.9

package/dist/index.js

@@ -1,19 +1,219 @@
-// src/cli/read-env-base-url/read-env-base-url.ts
-var readEnvBaseUrl = (env = process.env) => {
-  const value = env["ROUTE33_BASE_URL"]?.trim();
-  return value === "" ? void 0 : value;
+// src/auth/auth-error/auth-error.ts
+var AuthError = class extends Error {
+  constructor(code, options) {
+    super(
+      "Route 33 authorization failed",
+      options?.cause === void 0 ? void 0 : { cause: options.cause }
+    );
+    this.code = code;
+    this.name = "AuthError";
+    this.statusCode = options?.statusCode;
+  }
+  code;
+  statusCode;
 };
 
-// src/cli/read-env-api-base/read-env-api-base.ts
-var readEnvApiBase = (env = process.env) => {
-  const value = env["ROUTE33_API_BASE"]?.trim();
-  return value === "" ? void 0 : value;
+// src/auth/build-authorize-url/build-authorize-url.ts
+var buildAuthorizeUrl = (issuerUrl2, request) => {
+  const url = new URL("/authorize", issuerUrl2);
+  url.search = new URLSearchParams({
+    client_id: request.clientId,
+    code_challenge: request.codeChallenge,
+    code_challenge_method: "S256",
+    redirect_uri: request.redirectUri,
+    response_type: "code",
+    scope: request.scope,
+    state: request.state
+  }).toString();
+  return url;
 };
 
-// src/cli/read-env-auth-issuer/read-env-auth-issuer.ts
-var readEnvAuthIssuer = (env = process.env) => {
-  const value = env["ROUTE33_AUTH_ISSUER"]?.trim();
-  return value === "" ? void 0 : value;
+// src/contract/adapters/contract-parse-error/contract-parse-error.ts
+var ContractParseError = class extends Error {
+};
+
+// src/contract/adapters/gateway-api-key/gateway-api-key.ts
+var GatewayApiKey = class {
+  value;
+  constructor(value) {
+    this.value = value;
+  }
+};
+
+// src/contract/adapters/management-jwt/management-jwt.ts
+var ManagementJwt = class {
+  value;
+  constructor(value) {
+    this.value = value;
+  }
+};
+
+// src/contract/adapters/parse-gateway-key/parse-gateway-key.ts
+var parseGatewayKey = (value) => {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error("gateway key must be non-empty");
+  }
+  return new GatewayApiKey(value);
+};
+
+// src/contract/adapters/parse-management-jwt/parse-management-jwt.ts
+var parseManagementJwt = (value) => {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error("management token must be non-empty");
+  }
+  return new ManagementJwt(value);
+};
+
+// src/contract/predicates/has-string-fields/has-string-fields.ts
+var hasStringFields = (record, fields) => fields.every((field) => typeof record[field] === "string");
+
+// src/contract/predicates/is-nullable-string/is-nullable-string.ts
+var isNullableString = (value) => typeof value === "string" || value === null;
+
+// src/contract/predicates/is-owner-type/is-owner-type.ts
+var isOwnerType = (value) => value === "project" || value === "user_personal" || value === "user_project";
+
+// src/contract/predicates/is-record/is-record.ts
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+
+// src/contract/adapters/parse-management-subject/parse-management-subject.ts
+var parseManagementSubject = (credential) => {
+  const encodedPayload = credential.value.split(".")[1];
+  if (encodedPayload === void 0 || encodedPayload.length === 0) {
+    throw new ContractParseError("management token carries no usable subject");
+  }
+  let payload;
+  try {
+    payload = JSON.parse(
+      Buffer.from(encodedPayload, "base64url").toString("utf8")
+    );
+  } catch {
+    throw new ContractParseError("management token payload is not JSON");
+  }
+  if (!isRecord(payload)) {
+    throw new ContractParseError("management token payload is not an object");
+  }
+  const subject = payload["sub"];
+  if (typeof subject !== "string" || subject.length === 0) {
+    throw new ContractParseError("management token carries no usable subject");
+  }
+  return subject;
+};
+
+// src/contract/auth-session/parse-token-set/parse-token-set.ts
+var parseTokenSet = (value) => {
+  if (!isRecord(value)) {
+    throw new ContractParseError("invalid token response");
+  }
+  if (typeof value["access_token"] !== "string" || typeof value["expires_in"] !== "number" || value["token_type"] !== "Bearer") {
+    throw new ContractParseError("invalid token response");
+  }
+  return {
+    access_token: value["access_token"],
+    expires_in: value["expires_in"],
+    token_type: "Bearer",
+    ...typeof value["id_token"] === "string" ? { id_token: value["id_token"] } : {},
+    ...typeof value["refresh_token"] === "string" ? { refresh_token: value["refresh_token"] } : {},
+    ...typeof value["scope"] === "string" ? { scope: value["scope"] } : {}
+  };
+};
+
+// src/auth/exchange-code-and-parse/exchange-code-and-parse.ts
+var exchangeCodeAndParse = async (options) => {
+  const body = new URLSearchParams({
+    client_id: options.clientId,
+    code: options.input.code,
+    code_verifier: options.input.codeVerifier,
+    grant_type: "authorization_code",
+    redirect_uri: options.input.redirectUri
+  });
+  let response;
+  try {
+    response = await (options.fetchImpl ?? fetch)(options.tokenUrl, {
+      body,
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      method: "POST"
+    });
+  } catch (cause) {
+    throw new AuthError("AUTH_CODE_EXCHANGE_FAILED", { cause });
+  }
+  if (!response.ok) {
+    throw new AuthError("AUTH_CODE_EXCHANGE_FAILED", {
+      statusCode: response.status
+    });
+  }
+  let payload;
+  try {
+    payload = await response.json();
+  } catch (cause) {
+    throw new AuthError("AUTH_CODE_EXCHANGE_FAILED", { cause });
+  }
+  try {
+    return parseTokenSet(payload);
+  } catch (cause) {
+    if (cause instanceof ContractParseError) {
+      throw new AuthError("AUTH_CODE_EXCHANGE_FAILED", { cause });
+    }
+    throw cause;
+  }
+};
+
+// src/auth/refresh-session/refresh-session.ts
+var refreshSession = async (options) => {
+  const body = new URLSearchParams({
+    client_id: options.clientId,
+    grant_type: "refresh_token",
+    refresh_token: options.refreshToken
+  });
+  let response;
+  try {
+    response = await (options.fetchImpl ?? fetch)(options.tokenUrl, {
+      body,
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      method: "POST"
+    });
+  } catch (cause) {
+    throw new AuthError("AUTH_REAUTHENTICATION_REQUIRED", { cause });
+  }
+  if (!response.ok) {
+    throw new AuthError("AUTH_REAUTHENTICATION_REQUIRED", {
+      statusCode: response.status
+    });
+  }
+  let payload;
+  try {
+    payload = await response.json();
+  } catch (cause) {
+    throw new AuthError("AUTH_REAUTHENTICATION_REQUIRED", { cause });
+  }
+  try {
+    return parseTokenSet(payload);
+  } catch (cause) {
+    if (cause instanceof ContractParseError) {
+      throw new AuthError("AUTH_REAUTHENTICATION_REQUIRED", { cause });
+    }
+    throw cause;
+  }
+};
+
+// src/auth/create-auth-session/create-auth-session.ts
+var createAuthSession = (options) => {
+  const tokenUrl = new URL("/oauth/token", options.issuerUrl);
+  return {
+    authorizationUrl: (request) => buildAuthorizeUrl(options.issuerUrl, request),
+    exchangeCode: (input) => exchangeCodeAndParse({
+      clientId: options.clientId,
+      ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl },
+      input,
+      tokenUrl
+    }),
+    refresh: (refreshToken) => refreshSession({
+      clientId: options.clientId,
+      ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl },
+      refreshToken,
+      tokenUrl
+    })
+  };
 };
 
 // src/shared/default-auth-issuer-url/default-auth-issuer-url.ts
@@ -61,164 +261,406 @@ var resolveCacheDir = (env) => {
   );
 };
 
-// src/cli/read-env-cache-dir/read-env-cache-dir.ts
-var readEnvCacheDir = (env = process.env) => resolveCacheDir(env);
-
-// src/cli/read-env-catalog-ttl-ms/read-env-catalog-ttl-ms.ts
-var readEnvCatalogTtlMs = (env = process.env) => {
-  const value = Number(env["ROUTE33_CATALOG_TTL_MS"]);
-  return Number.isFinite(value) && value > 0 ? value : DEFAULT_CATALOG_TTL_MS;
-};
-
-// src/cli/read-env-client-id/read-env-client-id.ts
-var readEnvClientId = (env = process.env) => {
-  const value = env["ROUTE33_CLIENT_ID"]?.trim();
-  return value === "" ? void 0 : value;
-};
-
-// src/cli/read-env-direct-api-key/read-env-direct-api-key.ts
-var readEnvDirectApiKey = (env = process.env) => {
-  const value = env["ROUTE33_API_KEY"]?.trim();
-  return value === "" ? void 0 : value;
-};
-
-// src/cli/read-env-disable-id-shim/read-env-disable-id-shim.ts
-var readEnvDisableIdShim = (env = process.env) => env["ROUTE33_DISABLE_ID_SHIM"] === "1";
-
-// src/cli/read-env-discovery/read-env-discovery.ts
-var readEnvDiscovery = (env = process.env) => env["ROUTE33_DISCOVERY"] !== "0";
+// src/auth/open-browser-and-capture/open-browser-and-capture.ts
+import { timingSafeEqual } from "node:crypto";
 
-// src/cli/read-env-strict/read-env-strict.ts
-var readEnvStrict = (env = process.env) => env["ROUTE33_STRICT"] !== "0";
+// src/auth/loopback-callback/loopback-callback.ts
+import { createServer } from "node:http";
 
-// src/cli/resolve-v1-secret-store-directory/resolve-v1-secret-store-directory.ts
-import * as os2 from "node:os";
-import * as path2 from "node:path";
-var resolveV1SecretStoreDirectory = (options = {}) => {
-  const explicit = options.directory?.trim();
-  if (explicit !== void 0 && explicit.length > 0) {
-    return path2.resolve(explicit);
-  }
-  const hostConfig = (options.env ?? process.env)["OPENCODE_CONFIG_DIR"]?.trim();
-  if (hostConfig !== void 0 && hostConfig.length > 0) {
-    return path2.join(path2.resolve(hostConfig), "route33");
-  }
-  return path2.join(
-    options.homeDirectory ?? os2.homedir(),
-    ".config",
-    "opencode",
-    "route33"
-  );
+// src/auth/loopback-callback/callback-page/callback-page.ts
+var MARK_PATHS = [
+  "M310.6,175.8c0-6.1-2.7-11.8-7.2-15.9l-127.6-114.4V7h-43.5v48.3c0,6.2,2.6,12.1,7.2,16.2l92.5,82.9H0v43.5h234.7l-95.6,91.4c-4.3,4.1-6.7,9.8-6.7,15.7v48.3h43.5v-39l128.1-122.4c4.4-4.2,6.8-10,6.7-16.1h0Z",
+  "M457.2,175.9v-2.6c18.4-4.9,33-14.1,44-27.7,11-13.6,16.5-30.3,16.5-50.3s-4.5-32.9-13.4-47.5c-9-14.5-21.6-26.1-38-34.9-16.4-8.7-35.8-13.1-58.3-13.1s-41.1,4-58.8,12.1-31.8,19.3-42.4,33.7-16.1,31-16.6,50h51.1c.3-10.8,3.6-20,9.8-27.7,6.2-7.6,14.2-13.5,24.1-17.5,9.9-4.1,20.6-6.1,32-6.1s22.3,2.2,31.1,6.7c8.8,4.5,15.6,10.8,20.5,18.8,4.9,8.1,7.3,17.5,7.3,28.4s-2.8,21.1-8.4,29.4-13.3,14.8-23.2,19.5-21.3,7.1-34.2,7.1h-29.9v43.3h29.9c16.2,0,30,2.5,41.5,7.5,11.5,5,20.2,12,26.1,21.1,6,9,9,19.4,9,31.2s-3,21.2-9.1,29.8-14.4,15.3-25.1,20.1c-10.7,4.9-22.9,7.3-36.7,7.3s-24.2-2.1-34.5-6.2-18.6-10-24.8-17.5c-6.3-7.5-9.8-16.5-10.6-26.8h-53.2c.6,19,6.3,35.7,17,50.2,10.7,14.5,25.2,25.7,43.6,33.8,18.4,8.1,39.4,12.1,63.1,12.1s45.1-4.4,63.7-13.2c18.6-8.8,33.3-20.8,44-36,10.8-15.2,16.1-32.5,16.1-51.8s-6.4-40.7-19.2-55.6c-12.8-14.9-30.8-24.2-54-27.8h0Z",
+  "M763,203.7c-12.8-14.9-30.8-24.2-54-27.8v-2.6c18.4-4.9,33-14.1,44-27.7,11-13.6,16.5-30.3,16.5-50.3s-4.5-32.9-13.4-47.5c-8.9-14.5-21.6-26.1-38-34.9-16.4-8.7-35.8-13.1-58.3-13.1s-41.1,4-58.8,12.1-31.8,19.3-42.4,33.7-16.1,31-16.6,50h51.1c.3-10.8,3.6-20,9.8-27.7,6.2-7.6,14.2-13.5,24.1-17.5,9.9-4.1,20.6-6.1,32-6.1s22.3,2.2,31.1,6.7c8.8,4.5,15.6,10.8,20.5,18.8,4.9,8.1,7.3,17.5,7.3,28.4s-2.8,21.1-8.4,29.4c-5.6,8.3-13.3,14.8-23.2,19.5s-21.3,7.1-34.2,7.1h-29.9v43.3h29.9c16.2,0,30,2.5,41.5,7.5,11.5,5,20.2,12,26.1,21.1,6,9,8.9,19.4,8.9,31.2s-3,21.2-9.1,29.8c-6.1,8.6-14.4,15.3-25.1,20.1-10.7,4.9-22.9,7.3-36.7,7.3s-24.2-2.1-34.5-6.2-18.6-10-24.8-17.5c-6.3-7.5-9.8-16.5-10.6-26.8h-53.2c.6,19,6.3,35.7,17,50.2,10.7,14.5,25.2,25.7,43.6,33.8,18.4,8.1,39.4,12.1,63.1,12.1s45.1-4.4,63.7-13.2,33.3-20.8,44-36c10.8-15.2,16.1-32.5,16.1-51.8s-6.4-40.7-19.2-55.6h0Z"
+];
+var BRAND_MARK = `<svg class="r33-mark" viewBox="0 0 782.2 360.3" fill="currentColor" role="img" aria-label="route33.ai" xmlns="http://www.w3.org/2000/svg"><path d="${MARK_PATHS[0]}"/><path d="${MARK_PATHS[1]}"/><path d="${MARK_PATHS[2]}"/></svg>`;
+var PAGE_STYLE = `:root{color-scheme:dark;--r33-euro-blue:#0000FF;--r33-off-white:#F1F1F1;--r33-off-black:#121212;--r33-grey-300:#C9CBCF;--r33-radius-fillet:4px;--r33-space-2:8px;--r33-space-3:16px;--r33-space-4:24px;--r33-space-6:64px;--r33-font-body:"Geist","Helvetica Neue",Arial,sans-serif;--r33-font-mono:"Geist Mono","SFMono-Regular",Menlo,monospace;--r33-surface:var(--r33-off-black);--r33-text-primary:var(--r33-off-white);--r33-text-secondary:var(--r33-grey-300);--r33-fill-accent:var(--r33-euro-blue);--r33-on-fill-accent:var(--r33-off-white)}
+*{box-sizing:border-box}
+html,body{margin:0}
+.r33-page{min-height:100vh;display:flex;align-items:center;justify-content:center;padding:var(--r33-space-6);background:var(--r33-surface);color:var(--r33-text-primary);font-family:var(--r33-font-body);-webkit-font-smoothing:antialiased}
+.r33-panel{display:grid;gap:var(--r33-space-4);max-width:460px;width:100%}
+.r33-mark{height:40px;width:auto;color:var(--r33-text-primary)}
+.r33-status{display:inline-flex;align-items:center;gap:var(--r33-space-2);font-size:11px;letter-spacing:0.08em;text-transform:uppercase;color:var(--r33-text-secondary)}
+.r33-status__dot{width:8px;height:8px;background:var(--r33-fill-accent)}
+.r33-status__dot--error{background:transparent;border:1px solid var(--r33-text-primary);border-radius:50%}
+.r33-headline{margin:0;font-size:48px;line-height:0.85;letter-spacing:-0.02em;font-weight:600;color:var(--r33-text-primary);text-wrap:balance}
+.r33-subline{margin:0;font-size:16px;line-height:1.45;color:var(--r33-text-secondary);max-width:40ch;text-wrap:pretty}
+.r33-code{margin:0;font-size:13px;letter-spacing:0.04em;color:var(--r33-text-secondary)}
+.r33-code__value{font-family:var(--r33-font-mono);text-transform:uppercase;color:var(--r33-text-primary)}
+@media (prefers-reduced-motion:reduce){*{animation-duration:1ms!important;transition-duration:1ms!important}}`;
+var buildCallbackPage = (state, errorCode) => {
+  const isError = state === "error";
+  const safeCode = (errorCode ?? "").replace(/[^a-z0-9_-]/gi, "");
+  const title = isError ? "Sign-in failed" : "Signed in";
+  const headline = isError ? "Sign-in failed" : "Signed in to route33";
+  const subline = isError ? "Return to OpenCode and retry." : "Return to OpenCode \u2014 one more step may wait there: if it asks which budget covers usage, pick a project. Then this window can be closed.";
+  const statusLabel = isError ? "Authentication error" : "Authenticated";
+  const dotClass = isError ? "r33-status__dot r33-status__dot--error" : "r33-status__dot";
+  const codeLine = isError && safeCode.length > 0 ? `<p class="r33-code">Error code: <span class="r33-code__value">${safeCode}</span></p>` : "";
+  return `<!doctype html>
+<html lang="en" data-theme="dark">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${title} \xB7 route33.ai</title>
+<style>${PAGE_STYLE}</style>
+</head>
+<body>
+<main class="r33-page">
+<div class="r33-panel">
+${BRAND_MARK}
+<span class="r33-status"><span class="${dotClass}"></span>${statusLabel}</span>
+<h1 class="r33-headline">${headline}</h1>
+<p class="r33-subline">${subline}</p>
+${codeLine}
+</div>
+</main>
+</body>
+</html>`;
 };
 
-// src/config/abortable-sleep/abortable-sleep.ts
-var abortableSleep = (milliseconds, signal) => new Promise((resolve2, reject) => {
-  if (signal === void 0) {
-    setTimeout(resolve2, milliseconds);
-    return;
-  }
-  const abortError = () => {
-    const reason = signal.reason;
-    if (reason instanceof Error) {
-      return reason;
+// src/auth/loopback-callback/loopback-callback.ts
+var createAuthLoopbackCallback = async () => {
+  let redirectUri = "http://127.0.0.1/callback";
+  let resolveCapture;
+  const captured = new Promise((resolve2) => {
+    resolveCapture = resolve2;
+  });
+  const server = createServer((request, response) => {
+    const url = new URL(request.url ?? "/", redirectUri);
+    if (request.method !== "GET" || url.pathname !== "/callback") {
+      response.writeHead(404).end();
+      return;
     }
-    return new Error(String(reason), { cause: reason });
+    const resolve2 = resolveCapture;
+    resolveCapture = void 0;
+    resolve2?.(url);
+    const error = url.searchParams.get("error");
+    const page = error === null || error.length === 0 ? buildCallbackPage("success") : buildCallbackPage("error", error);
+    response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+    response.end(page);
+  });
+  await new Promise((resolve2, reject) => {
+    const onError = (cause) => {
+      reject(new AuthError("AUTH_CALLBACK_LISTEN_FAILED", { cause }));
+    };
+    server.once("error", onError);
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", onError);
+      resolve2();
+    });
+  });
+  const address = server.address();
+  if (address === null || typeof address === "string") {
+    server.close();
+    throw new AuthError("AUTH_CALLBACK_LISTEN_FAILED");
+  }
+  redirectUri = `http://127.0.0.1:${String(address.port)}/callback`;
+  return {
+    redirectUri,
+    close: () => {
+      if (!server.listening) {
+        return Promise.resolve();
+      }
+      return new Promise((resolve2, reject) => {
+        server.close((cause) => {
+          if (cause === void 0) {
+            resolve2();
+            return;
+          }
+          reject(new AuthError("AUTH_CALLBACK_CLEANUP_FAILED", { cause }));
+        });
+      });
+    },
+    wait: () => captured
   };
-  if (signal.aborted) {
-    reject(abortError());
+};
+
+// src/auth/open-system-browser/open-system-browser.ts
+import { spawn } from "node:child_process";
+var openSystemBrowser = async (url, options = {}) => new Promise((resolve2, reject) => {
+  let command = "xdg-open";
+  let args = [url.href];
+  if (process.platform === "darwin") {
+    command = "open";
+  } else if (process.platform === "win32") {
+    command = "cmd";
+    args = ["/c", "start", "", url.href];
+  }
+  if (options.spawnUrl !== void 0) {
+    options.spawnUrl(command, args, { detached: true, stdio: "ignore" });
+    resolve2();
     return;
   }
-  const onAbort = () => {
-    clearTimeout(timer);
-    reject(abortError());
-  };
-  const timer = setTimeout(() => {
-    signal.removeEventListener("abort", onAbort);
+  const child = spawn(command, args, {
+    detached: true,
+    stdio: "ignore"
+  });
+  child.once("error", reject);
+  child.once("spawn", () => {
+    child.unref();
     resolve2();
-  }, milliseconds);
-  signal.addEventListener("abort", onAbort, { once: true });
+  });
 });
 
-// src/config/is-resendable-body/is-resendable-body.ts
-var isResendableBody = (body) => body === void 0 || typeof body === "string" || body instanceof ArrayBuffer || ArrayBuffer.isView(body) || body instanceof Blob || body instanceof URLSearchParams || body instanceof FormData;
-
-// src/contract/predicates/has-string-fields/has-string-fields.ts
-var hasStringFields = (record, fields) => fields.every((field) => typeof record[field] === "string");
-
-// src/contract/predicates/is-nullable-string/is-nullable-string.ts
-var isNullableString = (value) => typeof value === "string" || value === null;
-
-// src/contract/predicates/is-owner-type/is-owner-type.ts
-var isOwnerType = (value) => value === "project" || value === "user_personal" || value === "user_project";
-
-// src/contract/predicates/is-record/is-record.ts
-var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-
-// src/config/parse-exhaustion-envelope/parse-exhaustion-envelope.ts
-var parseExhaustionEnvelope = async (response) => {
-  let body;
+// src/auth/open-browser-and-capture/open-browser-and-capture.ts
+var openBrowserAndCapture = async (options) => {
+  const callback = await createAuthLoopbackCallback();
+  const authorizationUrl = options.authorizationUrl(callback.redirectUri);
+  const browserRunner = options.browserRunner ?? ((url) => openSystemBrowser(url));
+  let timer;
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      reject(new AuthError("AUTH_CALLBACK_TIMEOUT"));
+    }, options.timeoutMs ?? 12e4);
+  });
+  const launch = browserRunner(authorizationUrl).catch((cause) => {
+    throw new AuthError("AUTH_BROWSER_LAUNCH_FAILED", { cause });
+  });
   try {
-    body = await response.clone().json();
-  } catch (error) {
-    if (error instanceof Error) {
-      return void 0;
+    const completed = await Promise.race([
+      Promise.all([launch, callback.wait()]),
+      timeout
+    ]);
+    const callbackUrl = completed[1];
+    const actualState = callbackUrl.searchParams.get("state");
+    if (actualState === null) {
+      throw new AuthError("AUTH_CALLBACK_RESPONSE_INVALID");
     }
-    throw error;
-  }
-  if (!isRecord(body)) {
-    return void 0;
-  }
-  const nestedError = body["error"];
-  const nestedCode = isRecord(nestedError) ? nestedError["code"] : void 0;
-  if (body["code"] !== "PROVIDER_LANES_EXHAUSTED" && nestedCode !== "PROVIDER_LANES_EXHAUSTED") {
-    return void 0;
-  }
-  const nestedId = isRecord(nestedError) ? nestedError["correlationId"] : void 0;
-  const directId = body["correlationId"];
-  let correlationId;
-  if (typeof directId === "string") {
-    correlationId = directId;
-  } else if (typeof nestedId === "string") {
-    correlationId = nestedId;
-  }
-  return { correlationId };
-};
-
-// src/config/request-model/request-model.ts
-var requestModel = (body) => {
-  if (typeof body !== "string") {
-    return void 0;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(body);
-  } catch (error) {
-    if (error instanceof SyntaxError) {
-      return void 0;
+    const expectedState = Buffer.from(options.expectedState);
+    const receivedState = Buffer.from(actualState);
+    if (expectedState.length !== receivedState.length || !timingSafeEqual(expectedState, receivedState)) {
+      throw new AuthError("AUTH_CALLBACK_STATE_MISMATCH");
     }
-    throw error;
+    const code = callbackUrl.searchParams.get("code");
+    if (code === null || code.length === 0) {
+      throw new AuthError("AUTH_CALLBACK_RESPONSE_INVALID");
+    }
+    return { code, redirectUri: callback.redirectUri };
+  } finally {
+    if (timer !== void 0) {
+      clearTimeout(timer);
+    }
+    await callback.close();
   }
-  return isRecord(parsed) && typeof parsed["model"] === "string" ? parsed["model"] : void 0;
 };
 
-// src/config/retry-wait-seconds/retry-wait-seconds.ts
-var retryWaitSeconds = (options) => {
-  const advised = options.retryAfter !== null && /^\d+$/.test(options.retryAfter) ? Number(options.retryAfter) : void 0;
-  return advised !== void 0 && advised > 0 ? Math.min(advised, options.maxWaitSeconds) : Math.min(
-    options.baseSeconds * 2 ** (options.attempt - 1),
-    options.maxWaitSeconds
-  );
-};
+// src/auth/pkce-verifier-and-challenge/pkce-verifier-and-challenge.ts
+import { randomBytes } from "node:crypto";
 
-// src/config/exhaustion-retry-fetch/exhaustion-retry-fetch.ts
-var buildExhaustionRetryFetch = (innerFetch, options = {}) => {
-  const sleep = options.sleep ?? abortableSleep;
-  const maxWaitSeconds = options.maxWaitSeconds ?? 1200;
-  const baseSeconds = options.baseSeconds ?? 5;
-  const parseRetryableExhaustion = async (response) => {
-    if (response.status !== 429) {
-      return void 0;
-    }
+// src/auth/pkce-challenge/pkce-challenge.ts
+import { createHash } from "node:crypto";
+var pkceChallenge = (verifier) => createHash("sha256").update(verifier).digest("base64url");
+
+// src/auth/pkce-verifier-and-challenge/pkce-verifier-and-challenge.ts
+var createPkceVerifierAndChallenge = () => {
+  const codeVerifier = randomBytes(32).toString("base64url");
+  return {
+    codeChallenge: pkceChallenge(codeVerifier),
+    codeVerifier,
+    state: randomBytes(32).toString("base64url")
+  };
+};
+
+// src/auth/requested-scopes/requested-scopes.ts
+var REQUESTED_OAUTH_SCOPES = "openid offline_access projects:read keys:read keys:write";
+
+// src/auth/login-flow/login-flow.ts
+var loginFlow = async (options) => {
+  const log = options.logger ?? logger;
+  log.info("auth.login.started");
+  const pkce = createPkceVerifierAndChallenge();
+  const captured = await openBrowserAndCapture({
+    authorizationUrl: (redirectUri) => options.session.authorizationUrl({
+      clientId: options.clientId,
+      codeChallenge: pkce.codeChallenge,
+      redirectUri,
+      scope: REQUESTED_OAUTH_SCOPES,
+      state: pkce.state
+    }),
+    ...options.browserRunner === void 0 ? {} : { browserRunner: options.browserRunner },
+    expectedState: pkce.state,
+    ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
+  });
+  const tokenSet = await options.session.exchangeCode({
+    code: captured.code,
+    codeVerifier: pkce.codeVerifier,
+    redirectUri: captured.redirectUri
+  });
+  let credential;
+  try {
+    credential = parseManagementJwt(tokenSet.access_token);
+  } catch (cause) {
+    throw new AuthError("AUTH_TOKEN_RESPONSE_INVALID", { cause });
+  }
+  log.info("auth.login.completed");
+  return { credential, tokenSet };
+};
+
+// src/cli/read-env-base-url/read-env-base-url.ts
+var readEnvBaseUrl = (env = process.env) => {
+  const value = env["ROUTE33_BASE_URL"]?.trim();
+  return value === "" ? void 0 : value;
+};
+
+// src/cli/read-env-api-base/read-env-api-base.ts
+var readEnvApiBase = (env = process.env) => {
+  const value = env["ROUTE33_API_BASE"]?.trim();
+  return value === "" ? void 0 : value;
+};
+
+// src/cli/read-env-auth-issuer/read-env-auth-issuer.ts
+var readEnvAuthIssuer = (env = process.env) => {
+  const value = env["ROUTE33_AUTH_ISSUER"]?.trim();
+  return value === "" ? void 0 : value;
+};
+
+// src/cli/read-env-cache-dir/read-env-cache-dir.ts
+var readEnvCacheDir = (env = process.env) => resolveCacheDir(env);
+
+// src/cli/read-env-catalog-ttl-ms/read-env-catalog-ttl-ms.ts
+var readEnvCatalogTtlMs = (env = process.env) => {
+  const value = Number(env["ROUTE33_CATALOG_TTL_MS"]);
+  return Number.isFinite(value) && value > 0 ? value : DEFAULT_CATALOG_TTL_MS;
+};
+
+// src/cli/read-env-client-id/read-env-client-id.ts
+var readEnvClientId = (env = process.env) => {
+  const value = env["ROUTE33_CLIENT_ID"]?.trim();
+  return value === "" ? void 0 : value;
+};
+
+// src/cli/read-env-direct-api-key/read-env-direct-api-key.ts
+var readEnvDirectApiKey = (env = process.env) => {
+  const value = env["ROUTE33_API_KEY"]?.trim();
+  return value === "" ? void 0 : value;
+};
+
+// src/cli/read-env-disable-id-shim/read-env-disable-id-shim.ts
+var readEnvDisableIdShim = (env = process.env) => env["ROUTE33_DISABLE_ID_SHIM"] === "1";
+
+// src/cli/read-env-discovery/read-env-discovery.ts
+var readEnvDiscovery = (env = process.env) => env["ROUTE33_DISCOVERY"] !== "0";
+
+// src/cli/read-env-strict/read-env-strict.ts
+var readEnvStrict = (env = process.env) => env["ROUTE33_STRICT"] !== "0";
+
+// src/cli/resolve-v1-secret-store-directory/resolve-v1-secret-store-directory.ts
+import * as os2 from "node:os";
+import * as path2 from "node:path";
+var resolveV1SecretStoreDirectory = (options = {}) => {
+  const explicit = options.directory?.trim();
+  if (explicit !== void 0 && explicit.length > 0) {
+    return path2.resolve(explicit);
+  }
+  const hostConfig = (options.env ?? process.env)["OPENCODE_CONFIG_DIR"]?.trim();
+  if (hostConfig !== void 0 && hostConfig.length > 0) {
+    return path2.join(path2.resolve(hostConfig), "route33");
+  }
+  return path2.join(
+    options.homeDirectory ?? os2.homedir(),
+    ".config",
+    "opencode",
+    "route33"
+  );
+};
+
+// src/config/abortable-sleep/abortable-sleep.ts
+var abortableSleep = (milliseconds, signal) => new Promise((resolve2, reject) => {
+  if (signal === void 0) {
+    setTimeout(resolve2, milliseconds);
+    return;
+  }
+  const abortError = () => {
+    const reason = signal.reason;
+    if (reason instanceof Error) {
+      return reason;
+    }
+    return new Error(String(reason), { cause: reason });
+  };
+  if (signal.aborted) {
+    reject(abortError());
+    return;
+  }
+  const onAbort = () => {
+    clearTimeout(timer);
+    reject(abortError());
+  };
+  const timer = setTimeout(() => {
+    signal.removeEventListener("abort", onAbort);
+    resolve2();
+  }, milliseconds);
+  signal.addEventListener("abort", onAbort, { once: true });
+});
+
+// src/config/is-resendable-body/is-resendable-body.ts
+var isResendableBody = (body) => body === void 0 || typeof body === "string" || body instanceof ArrayBuffer || ArrayBuffer.isView(body) || body instanceof Blob || body instanceof URLSearchParams || body instanceof FormData;
+
+// src/config/parse-exhaustion-envelope/parse-exhaustion-envelope.ts
+var parseExhaustionEnvelope = async (response) => {
+  let body;
+  try {
+    body = await response.clone().json();
+  } catch (error) {
+    if (error instanceof Error) {
+      return void 0;
+    }
+    throw error;
+  }
+  if (!isRecord(body)) {
+    return void 0;
+  }
+  const nestedError = body["error"];
+  const nestedCode = isRecord(nestedError) ? nestedError["code"] : void 0;
+  if (body["code"] !== "PROVIDER_LANES_EXHAUSTED" && nestedCode !== "PROVIDER_LANES_EXHAUSTED") {
+    return void 0;
+  }
+  const nestedId = isRecord(nestedError) ? nestedError["correlationId"] : void 0;
+  const directId = body["correlationId"];
+  let correlationId;
+  if (typeof directId === "string") {
+    correlationId = directId;
+  } else if (typeof nestedId === "string") {
+    correlationId = nestedId;
+  }
+  return { correlationId };
+};
+
+// src/config/request-model/request-model.ts
+var requestModel = (body) => {
+  if (typeof body !== "string") {
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch (error) {
+    if (error instanceof SyntaxError) {
+      return void 0;
+    }
+    throw error;
+  }
+  return isRecord(parsed) && typeof parsed["model"] === "string" ? parsed["model"] : void 0;
+};
+
+// src/config/retry-wait-seconds/retry-wait-seconds.ts
+var retryWaitSeconds = (options) => {
+  const advised = options.retryAfter !== null && /^\d+$/.test(options.retryAfter) ? Number(options.retryAfter) : void 0;
+  return advised !== void 0 && advised > 0 ? Math.min(advised, options.maxWaitSeconds) : Math.min(
+    options.baseSeconds * 2 ** (options.attempt - 1),
+    options.maxWaitSeconds
+  );
+};
+
+// src/config/exhaustion-retry-fetch/exhaustion-retry-fetch.ts
+var buildExhaustionRetryFetch = (innerFetch, options = {}) => {
+  const sleep = options.sleep ?? abortableSleep;
+  const maxWaitSeconds = options.maxWaitSeconds ?? 1200;
+  const baseSeconds = options.baseSeconds ?? 5;
+  const parseRetryableExhaustion = async (response) => {
+    if (response.status !== 429) {
+      return void 0;
+    }
     const contentType = response.headers.get("content-type") ?? "";
     if (!/(?:^|\/)json(?:;|$)|\+json(?:;|$)/i.test(contentType)) {
       return void 0;
@@ -443,8 +885,8 @@ var catalogMemory = /* @__PURE__ */ new Map();
 var CATALOG_CACHE_VERSION = 2;
 
 // src/catalog/catalog-cache/hash-key/hash-key.ts
-import { createHash } from "node:crypto";
-var hashKey = (baseURL, gatewayKey) => createHash("sha256").update(`${baseURL}
+import { createHash as createHash2 } from "node:crypto";
+var hashKey = (baseURL, gatewayKey) => createHash2("sha256").update(`${baseURL}
 ${gatewayKey.value}`).digest("hex").slice(0, 12);
 
 // src/catalog/catalog-cache/is-catalog-model-record/is-catalog-model-record.ts
@@ -548,86 +990,26 @@ var catalogModelsUrl = (baseURL) => {
 // src/catalog/default-fetch-timeout-ms/default-fetch-timeout-ms.ts
 var DEFAULT_FETCH_TIMEOUT_MS = 5e3;
 
-// src/contract/adapters/contract-parse-error/contract-parse-error.ts
-var ContractParseError = class extends Error {
-};
-
-// src/contract/adapters/gateway-api-key/gateway-api-key.ts
-var GatewayApiKey = class {
-  value;
-  constructor(value) {
-    this.value = value;
+// src/contract/gateway-catalog/parse-catalog-result/parse-catalog-result.ts
+var parseCatalogResult = (value) => {
+  if (!isRecord(value) || !Array.isArray(value["data"])) {
+    throw new ContractParseError("invalid catalog response");
   }
+  return value;
 };
 
-// src/contract/adapters/management-jwt/management-jwt.ts
-var ManagementJwt = class {
-  value;
-  constructor(value) {
-    this.value = value;
+// src/catalog/parse-catalog-entries/parse-catalog-entries.ts
+var parseCatalogEntries = (payload) => {
+  if (Array.isArray(payload)) {
+    return payload;
   }
-};
-
-// src/contract/adapters/parse-gateway-key/parse-gateway-key.ts
-var parseGatewayKey = (value) => {
-  if (typeof value !== "string" || value.length === 0) {
-    throw new Error("gateway key must be non-empty");
-  }
-  return new GatewayApiKey(value);
-};
-
-// src/contract/adapters/parse-management-jwt/parse-management-jwt.ts
-var parseManagementJwt = (value) => {
-  if (typeof value !== "string" || value.length === 0) {
-    throw new Error("management token must be non-empty");
-  }
-  return new ManagementJwt(value);
-};
-
-// src/contract/adapters/parse-management-subject/parse-management-subject.ts
-var parseManagementSubject = (credential) => {
-  const encodedPayload = credential.value.split(".")[1];
-  if (encodedPayload === void 0 || encodedPayload.length === 0) {
-    throw new ContractParseError("management token carries no usable subject");
-  }
-  let payload;
-  try {
-    payload = JSON.parse(
-      Buffer.from(encodedPayload, "base64url").toString("utf8")
-    );
-  } catch {
-    throw new ContractParseError("management token payload is not JSON");
-  }
-  if (!isRecord(payload)) {
-    throw new ContractParseError("management token payload is not an object");
-  }
-  const subject = payload["sub"];
-  if (typeof subject !== "string" || subject.length === 0) {
-    throw new ContractParseError("management token carries no usable subject");
-  }
-  return subject;
-};
-
-// src/contract/gateway-catalog/parse-catalog-result/parse-catalog-result.ts
-var parseCatalogResult = (value) => {
-  if (!isRecord(value) || !Array.isArray(value["data"])) {
-    throw new ContractParseError("invalid catalog response");
-  }
-  return value;
-};
-
-// src/catalog/parse-catalog-entries/parse-catalog-entries.ts
-var parseCatalogEntries = (payload) => {
-  if (Array.isArray(payload)) {
-    return payload;
-  }
-  try {
-    return parseCatalogResult(payload).data;
-  } catch (error) {
-    if (error instanceof ContractParseError) {
-      throw new CatalogFetchError("parse", error.message);
-    }
-    throw error;
+  try {
+    return parseCatalogResult(payload).data;
+  } catch (error) {
+    if (error instanceof ContractParseError) {
+      throw new CatalogFetchError("parse", error.message);
+    }
+    throw error;
   }
 };
 
@@ -2453,508 +2835,134 @@ var createLeaseInstallationFactory = (options) => {
     const installation = {
       keyName: `route33:lease:${scopeId}`,
       secretStore: options.createSecretStore(scopeId),
-      ...options.createStateStore === void 0 ? {} : { stateStore: options.createStateStore(scopeId) },
-      state: LeaseState.restore(void 0)
-    };
-    installations.set(scopeId, installation);
-    return installation;
-  };
-};
-
-// src/key-lease/scope-id/scope-id.ts
-import { createHash as createHash2 } from "node:crypto";
-var deriveScopeId = (input) => {
-  let identity;
-  switch (input.attribution.kind) {
-    case "personal":
-      identity = ["route33-lease", "personal"];
-      break;
-    case "project":
-      if (input.folderRealpath === void 0 || input.folderRealpath.length === 0) {
-        throw new TypeError("Project lease scope requires a real folder path");
-      }
-      identity = [
-        "route33-lease",
-        "project",
-        input.attribution.projectId,
-        input.folderRealpath
-      ];
-      break;
-    default: {
-      const unexpected = input.attribution;
-      throw new TypeError(`Unexpected attribution: ${String(unexpected)}`);
-    }
-  }
-  return createHash2("sha256").update(JSON.stringify(identity)).digest("hex");
-};
-
-// src/requested-client-id/requested-client-id.ts
-var DEFAULT_ROUTE33_CLIENT_ID = false ? "" : "oa_platform_203623de";
-
-// src/commands/change-attribution/change-attribution.ts
-var changeAttribution = async (options) => {
-  await options.clear();
-  return options.prompt();
-};
-
-// src/commands/inspect-session/inspect-session.ts
-var inspectSession = (options) => {
-  const attribution = options.readAttribution();
-  const lease = options.readLease();
-  return {
-    attribution,
-    ...lease === void 0 ? {} : { lease: { expiresAt: lease.expiresAt, keyId: lease.keyId } }
-  };
-};
-
-// src/commands/reset-attribution/reset-attribution.ts
-var resetAttribution = async (options) => {
-  await options.clear();
-};
-
-// src/commands/rotate-now/rotate-now.ts
-var rotateNow = async (options) => {
-  const rotated = await options.lease({ renewalRatio: Number.EPSILON });
-  return rotated.lease;
-};
-
-// src/ux/attribution-prompt/attribution-prompt.ts
-var createAttributionPrompt = (projects) => {
-  const choicesBySelection = {
-    personal: { kind: "personal" }
-  };
-  const projectOptions = projects.map((project) => {
-    const selection = `project:${project.id}`;
-    choicesBySelection[selection] = {
-      kind: "project",
-      projectId: project.id
-    };
-    return {
-      label: `${project.name} (${project.organisation.name})`,
-      selection
-    };
-  });
-  return {
-    choicesBySelection,
-    options: [
-      ...projectOptions,
-      { label: "Use my personal key", selection: "personal" }
-    ],
-    title: "Choose where Route 33 should manage this key"
-  };
-};
-
-// src/ux/attribution-prompt-error/attribution-prompt-error.ts
-var MESSAGES = {
-  ATTRIBUTION_PRESENTER_UNAVAILABLE: "Route 33 needs OpenCode v2 to assign a budget for this folder. Update to OpenCode v2, run /connect, choose Route 33, and follow the steps.",
-  ATTRIBUTION_SELECTION_INVALID: "That Route 33 option is no longer available. Connect again and pick another."
-};
-var AttributionPromptError = class extends GatewayCredentialError {
-  code;
-  constructor(code) {
-    super(MESSAGES[code]);
-    this.name = "AttributionPromptError";
-    this.code = code;
-  }
-};
-
-// src/ux/prompt-flow/prompt-flow.ts
-var resolveAttribution = async (options) => {
-  const remembered = readAttribution(options.state);
-  if (remembered !== void 0) {
-    return remembered;
-  }
-  if (options.presenter === void 0) {
-    throw new AttributionPromptError("ATTRIBUTION_PRESENTER_UNAVAILABLE");
-  }
-  const plan = createAttributionPrompt(await options.loadProjects());
-  const selection = await options.presenter.pick(plan);
-  const attribution = plan.choicesBySelection[selection];
-  if (attribution === void 0) {
-    throw new AttributionPromptError("ATTRIBUTION_SELECTION_INVALID");
-  }
-  writeAttribution(options.state, attribution);
-  return attribution;
-};
-
-// src/ux/trusted-party-copy/trusted-party-copy.ts
-var TRUSTED_PARTY_COPY = {
-  message: "Route 33 wants to manage your keys for this OpenCode installation.",
-  title: "Connect Route 33"
-};
-
-// src/auth/auth-error/auth-error.ts
-var AuthError = class extends Error {
-  constructor(code, options) {
-    super(
-      "Route 33 authorization failed",
-      options?.cause === void 0 ? void 0 : { cause: options.cause }
-    );
-    this.code = code;
-    this.name = "AuthError";
-    this.statusCode = options?.statusCode;
-  }
-  code;
-  statusCode;
-};
-
-// src/auth/build-authorize-url/build-authorize-url.ts
-var buildAuthorizeUrl = (issuerUrl, request) => {
-  const url = new URL("/authorize", issuerUrl);
-  url.search = new URLSearchParams({
-    client_id: request.clientId,
-    code_challenge: request.codeChallenge,
-    code_challenge_method: "S256",
-    redirect_uri: request.redirectUri,
-    response_type: "code",
-    scope: request.scope,
-    state: request.state
-  }).toString();
-  return url;
-};
-
-// src/contract/auth-session/parse-token-set/parse-token-set.ts
-var parseTokenSet = (value) => {
-  if (!isRecord(value)) {
-    throw new ContractParseError("invalid token response");
-  }
-  if (typeof value["access_token"] !== "string" || typeof value["expires_in"] !== "number" || value["token_type"] !== "Bearer") {
-    throw new ContractParseError("invalid token response");
-  }
-  return {
-    access_token: value["access_token"],
-    expires_in: value["expires_in"],
-    token_type: "Bearer",
-    ...typeof value["id_token"] === "string" ? { id_token: value["id_token"] } : {},
-    ...typeof value["refresh_token"] === "string" ? { refresh_token: value["refresh_token"] } : {},
-    ...typeof value["scope"] === "string" ? { scope: value["scope"] } : {}
-  };
-};
-
-// src/auth/exchange-code-and-parse/exchange-code-and-parse.ts
-var exchangeCodeAndParse = async (options) => {
-  const body = new URLSearchParams({
-    client_id: options.clientId,
-    code: options.input.code,
-    code_verifier: options.input.codeVerifier,
-    grant_type: "authorization_code",
-    redirect_uri: options.input.redirectUri
-  });
-  let response;
-  try {
-    response = await (options.fetchImpl ?? fetch)(options.tokenUrl, {
-      body,
-      headers: { "content-type": "application/x-www-form-urlencoded" },
-      method: "POST"
-    });
-  } catch (cause) {
-    throw new AuthError("AUTH_CODE_EXCHANGE_FAILED", { cause });
-  }
-  if (!response.ok) {
-    throw new AuthError("AUTH_CODE_EXCHANGE_FAILED", {
-      statusCode: response.status
-    });
-  }
-  let payload;
-  try {
-    payload = await response.json();
-  } catch (cause) {
-    throw new AuthError("AUTH_CODE_EXCHANGE_FAILED", { cause });
-  }
-  try {
-    return parseTokenSet(payload);
-  } catch (cause) {
-    if (cause instanceof ContractParseError) {
-      throw new AuthError("AUTH_CODE_EXCHANGE_FAILED", { cause });
-    }
-    throw cause;
-  }
-};
-
-// src/auth/refresh-session/refresh-session.ts
-var refreshSession = async (options) => {
-  const body = new URLSearchParams({
-    client_id: options.clientId,
-    grant_type: "refresh_token",
-    refresh_token: options.refreshToken
-  });
-  let response;
-  try {
-    response = await (options.fetchImpl ?? fetch)(options.tokenUrl, {
-      body,
-      headers: { "content-type": "application/x-www-form-urlencoded" },
-      method: "POST"
-    });
-  } catch (cause) {
-    throw new AuthError("AUTH_REAUTHENTICATION_REQUIRED", { cause });
-  }
-  if (!response.ok) {
-    throw new AuthError("AUTH_REAUTHENTICATION_REQUIRED", {
-      statusCode: response.status
-    });
-  }
-  let payload;
-  try {
-    payload = await response.json();
-  } catch (cause) {
-    throw new AuthError("AUTH_REAUTHENTICATION_REQUIRED", { cause });
-  }
-  try {
-    return parseTokenSet(payload);
-  } catch (cause) {
-    if (cause instanceof ContractParseError) {
-      throw new AuthError("AUTH_REAUTHENTICATION_REQUIRED", { cause });
-    }
-    throw cause;
-  }
-};
-
-// src/auth/create-auth-session/create-auth-session.ts
-var createAuthSession = (options) => {
-  const tokenUrl = new URL("/oauth/token", options.issuerUrl);
-  return {
-    authorizationUrl: (request) => buildAuthorizeUrl(options.issuerUrl, request),
-    exchangeCode: (input) => exchangeCodeAndParse({
-      clientId: options.clientId,
-      ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl },
-      input,
-      tokenUrl
-    }),
-    refresh: (refreshToken) => refreshSession({
-      clientId: options.clientId,
-      ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl },
-      refreshToken,
-      tokenUrl
-    })
-  };
-};
-
-// src/auth/open-browser-and-capture/open-browser-and-capture.ts
-import { spawn } from "node:child_process";
-import { timingSafeEqual } from "node:crypto";
-
-// src/auth/loopback-callback/loopback-callback.ts
-import { createServer } from "node:http";
-
-// src/auth/loopback-callback/callback-page/callback-page.ts
-var MARK_PATHS = [
-  "M310.6,175.8c0-6.1-2.7-11.8-7.2-15.9l-127.6-114.4V7h-43.5v48.3c0,6.2,2.6,12.1,7.2,16.2l92.5,82.9H0v43.5h234.7l-95.6,91.4c-4.3,4.1-6.7,9.8-6.7,15.7v48.3h43.5v-39l128.1-122.4c4.4-4.2,6.8-10,6.7-16.1h0Z",
-  "M457.2,175.9v-2.6c18.4-4.9,33-14.1,44-27.7,11-13.6,16.5-30.3,16.5-50.3s-4.5-32.9-13.4-47.5c-9-14.5-21.6-26.1-38-34.9-16.4-8.7-35.8-13.1-58.3-13.1s-41.1,4-58.8,12.1-31.8,19.3-42.4,33.7-16.1,31-16.6,50h51.1c.3-10.8,3.6-20,9.8-27.7,6.2-7.6,14.2-13.5,24.1-17.5,9.9-4.1,20.6-6.1,32-6.1s22.3,2.2,31.1,6.7c8.8,4.5,15.6,10.8,20.5,18.8,4.9,8.1,7.3,17.5,7.3,28.4s-2.8,21.1-8.4,29.4-13.3,14.8-23.2,19.5-21.3,7.1-34.2,7.1h-29.9v43.3h29.9c16.2,0,30,2.5,41.5,7.5,11.5,5,20.2,12,26.1,21.1,6,9,9,19.4,9,31.2s-3,21.2-9.1,29.8-14.4,15.3-25.1,20.1c-10.7,4.9-22.9,7.3-36.7,7.3s-24.2-2.1-34.5-6.2-18.6-10-24.8-17.5c-6.3-7.5-9.8-16.5-10.6-26.8h-53.2c.6,19,6.3,35.7,17,50.2,10.7,14.5,25.2,25.7,43.6,33.8,18.4,8.1,39.4,12.1,63.1,12.1s45.1-4.4,63.7-13.2c18.6-8.8,33.3-20.8,44-36,10.8-15.2,16.1-32.5,16.1-51.8s-6.4-40.7-19.2-55.6c-12.8-14.9-30.8-24.2-54-27.8h0Z",
-  "M763,203.7c-12.8-14.9-30.8-24.2-54-27.8v-2.6c18.4-4.9,33-14.1,44-27.7,11-13.6,16.5-30.3,16.5-50.3s-4.5-32.9-13.4-47.5c-8.9-14.5-21.6-26.1-38-34.9-16.4-8.7-35.8-13.1-58.3-13.1s-41.1,4-58.8,12.1-31.8,19.3-42.4,33.7-16.1,31-16.6,50h51.1c.3-10.8,3.6-20,9.8-27.7,6.2-7.6,14.2-13.5,24.1-17.5,9.9-4.1,20.6-6.1,32-6.1s22.3,2.2,31.1,6.7c8.8,4.5,15.6,10.8,20.5,18.8,4.9,8.1,7.3,17.5,7.3,28.4s-2.8,21.1-8.4,29.4c-5.6,8.3-13.3,14.8-23.2,19.5s-21.3,7.1-34.2,7.1h-29.9v43.3h29.9c16.2,0,30,2.5,41.5,7.5,11.5,5,20.2,12,26.1,21.1,6,9,8.9,19.4,8.9,31.2s-3,21.2-9.1,29.8c-6.1,8.6-14.4,15.3-25.1,20.1-10.7,4.9-22.9,7.3-36.7,7.3s-24.2-2.1-34.5-6.2-18.6-10-24.8-17.5c-6.3-7.5-9.8-16.5-10.6-26.8h-53.2c.6,19,6.3,35.7,17,50.2,10.7,14.5,25.2,25.7,43.6,33.8,18.4,8.1,39.4,12.1,63.1,12.1s45.1-4.4,63.7-13.2,33.3-20.8,44-36c10.8-15.2,16.1-32.5,16.1-51.8s-6.4-40.7-19.2-55.6h0Z"
-];
-var BRAND_MARK = `<svg class="r33-mark" viewBox="0 0 782.2 360.3" fill="currentColor" role="img" aria-label="route33.ai" xmlns="http://www.w3.org/2000/svg"><path d="${MARK_PATHS[0]}"/><path d="${MARK_PATHS[1]}"/><path d="${MARK_PATHS[2]}"/></svg>`;
-var PAGE_STYLE = `:root{color-scheme:dark;--r33-euro-blue:#0000FF;--r33-off-white:#F1F1F1;--r33-off-black:#121212;--r33-grey-300:#C9CBCF;--r33-radius-fillet:4px;--r33-space-2:8px;--r33-space-3:16px;--r33-space-4:24px;--r33-space-6:64px;--r33-font-body:"Geist","Helvetica Neue",Arial,sans-serif;--r33-font-mono:"Geist Mono","SFMono-Regular",Menlo,monospace;--r33-surface:var(--r33-off-black);--r33-text-primary:var(--r33-off-white);--r33-text-secondary:var(--r33-grey-300);--r33-fill-accent:var(--r33-euro-blue);--r33-on-fill-accent:var(--r33-off-white)}
-*{box-sizing:border-box}
-html,body{margin:0}
-.r33-page{min-height:100vh;display:flex;align-items:center;justify-content:center;padding:var(--r33-space-6);background:var(--r33-surface);color:var(--r33-text-primary);font-family:var(--r33-font-body);-webkit-font-smoothing:antialiased}
-.r33-panel{display:grid;gap:var(--r33-space-4);max-width:460px;width:100%}
-.r33-mark{height:40px;width:auto;color:var(--r33-text-primary)}
-.r33-status{display:inline-flex;align-items:center;gap:var(--r33-space-2);font-size:11px;letter-spacing:0.08em;text-transform:uppercase;color:var(--r33-text-secondary)}
-.r33-status__dot{width:8px;height:8px;background:var(--r33-fill-accent)}
-.r33-status__dot--error{background:transparent;border:1px solid var(--r33-text-primary);border-radius:50%}
-.r33-headline{margin:0;font-size:48px;line-height:0.85;letter-spacing:-0.02em;font-weight:600;color:var(--r33-text-primary);text-wrap:balance}
-.r33-subline{margin:0;font-size:16px;line-height:1.45;color:var(--r33-text-secondary);max-width:40ch;text-wrap:pretty}
-.r33-code{margin:0;font-size:13px;letter-spacing:0.04em;color:var(--r33-text-secondary)}
-.r33-code__value{font-family:var(--r33-font-mono);text-transform:uppercase;color:var(--r33-text-primary)}
-@media (prefers-reduced-motion:reduce){*{animation-duration:1ms!important;transition-duration:1ms!important}}`;
-var buildCallbackPage = (state, errorCode) => {
-  const isError = state === "error";
-  const safeCode = (errorCode ?? "").replace(/[^a-z0-9_-]/gi, "");
-  const title = isError ? "Sign-in failed" : "Signed in";
-  const headline = isError ? "Sign-in failed" : "Signed in to route33";
-  const subline = isError ? "Return to OpenCode and retry." : "Return to OpenCode \u2014 one more step may wait there: if it asks which budget covers usage, pick a project. Then this window can be closed.";
-  const statusLabel = isError ? "Authentication error" : "Authenticated";
-  const dotClass = isError ? "r33-status__dot r33-status__dot--error" : "r33-status__dot";
-  const codeLine = isError && safeCode.length > 0 ? `<p class="r33-code">Error code: <span class="r33-code__value">${safeCode}</span></p>` : "";
-  return `<!doctype html>
-<html lang="en" data-theme="dark">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${title} \xB7 route33.ai</title>
-<style>${PAGE_STYLE}</style>
-</head>
-<body>
-<main class="r33-page">
-<div class="r33-panel">
-${BRAND_MARK}
-<span class="r33-status"><span class="${dotClass}"></span>${statusLabel}</span>
-<h1 class="r33-headline">${headline}</h1>
-<p class="r33-subline">${subline}</p>
-${codeLine}
-</div>
-</main>
-</body>
-</html>`;
-};
-
-// src/auth/loopback-callback/loopback-callback.ts
-var createAuthLoopbackCallback = async () => {
-  let redirectUri = "http://127.0.0.1/callback";
-  let resolveCapture;
-  const captured = new Promise((resolve2) => {
-    resolveCapture = resolve2;
-  });
-  const server = createServer((request, response) => {
-    const url = new URL(request.url ?? "/", redirectUri);
-    if (request.method !== "GET" || url.pathname !== "/callback") {
-      response.writeHead(404).end();
-      return;
-    }
-    const resolve2 = resolveCapture;
-    resolveCapture = void 0;
-    resolve2?.(url);
-    const error = url.searchParams.get("error");
-    const page = error === null || error.length === 0 ? buildCallbackPage("success") : buildCallbackPage("error", error);
-    response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-    response.end(page);
-  });
-  await new Promise((resolve2, reject) => {
-    const onError = (cause) => {
-      reject(new AuthError("AUTH_CALLBACK_LISTEN_FAILED", { cause }));
-    };
-    server.once("error", onError);
-    server.listen(0, "127.0.0.1", () => {
-      server.off("error", onError);
-      resolve2();
-    });
-  });
-  const address = server.address();
-  if (address === null || typeof address === "string") {
-    server.close();
-    throw new AuthError("AUTH_CALLBACK_LISTEN_FAILED");
-  }
-  redirectUri = `http://127.0.0.1:${String(address.port)}/callback`;
-  return {
-    redirectUri,
-    close: () => {
-      if (!server.listening) {
-        return Promise.resolve();
-      }
-      return new Promise((resolve2, reject) => {
-        server.close((cause) => {
-          if (cause === void 0) {
-            resolve2();
-            return;
-          }
-          reject(new AuthError("AUTH_CALLBACK_CLEANUP_FAILED", { cause }));
-        });
-      });
-    },
-    wait: () => captured
+      ...options.createStateStore === void 0 ? {} : { stateStore: options.createStateStore(scopeId) },
+      state: LeaseState.restore(void 0)
+    };
+    installations.set(scopeId, installation);
+    return installation;
   };
 };
 
-// src/auth/open-browser-and-capture/open-browser-and-capture.ts
-var openBrowserAndCapture = async (options) => {
-  const callback = await createAuthLoopbackCallback();
-  const authorizationUrl = options.authorizationUrl(callback.redirectUri);
-  const browserRunner = options.browserRunner ?? ((url) => new Promise((resolve2, reject) => {
-    let command = "xdg-open";
-    let args = [url.href];
-    if (process.platform === "darwin") {
-      command = "open";
-    } else if (process.platform === "win32") {
-      command = "cmd";
-      args = ["/c", "start", "", url.href];
-    }
-    const child = spawn(command, args, {
-      detached: true,
-      stdio: "ignore"
-    });
-    child.once("error", reject);
-    child.once("spawn", () => {
-      child.unref();
-      resolve2();
-    });
-  }));
-  let timer;
-  const timeout = new Promise((_resolve, reject) => {
-    timer = setTimeout(() => {
-      reject(new AuthError("AUTH_CALLBACK_TIMEOUT"));
-    }, options.timeoutMs ?? 12e4);
-  });
-  const launch = browserRunner(authorizationUrl).catch((cause) => {
-    throw new AuthError("AUTH_BROWSER_LAUNCH_FAILED", { cause });
-  });
-  try {
-    const completed = await Promise.race([
-      Promise.all([launch, callback.wait()]),
-      timeout
-    ]);
-    const callbackUrl = completed[1];
-    const actualState = callbackUrl.searchParams.get("state");
-    if (actualState === null) {
-      throw new AuthError("AUTH_CALLBACK_RESPONSE_INVALID");
-    }
-    const expectedState = Buffer.from(options.expectedState);
-    const receivedState = Buffer.from(actualState);
-    if (expectedState.length !== receivedState.length || !timingSafeEqual(expectedState, receivedState)) {
-      throw new AuthError("AUTH_CALLBACK_STATE_MISMATCH");
-    }
-    const code = callbackUrl.searchParams.get("code");
-    if (code === null || code.length === 0) {
-      throw new AuthError("AUTH_CALLBACK_RESPONSE_INVALID");
-    }
-    return { code, redirectUri: callback.redirectUri };
-  } finally {
-    if (timer !== void 0) {
-      clearTimeout(timer);
+// src/key-lease/scope-id/scope-id.ts
+import { createHash as createHash3 } from "node:crypto";
+var deriveScopeId = (input) => {
+  let identity;
+  switch (input.attribution.kind) {
+    case "personal":
+      identity = ["route33-lease", "personal"];
+      break;
+    case "project":
+      if (input.folderRealpath === void 0 || input.folderRealpath.length === 0) {
+        throw new TypeError("Project lease scope requires a real folder path");
+      }
+      identity = [
+        "route33-lease",
+        "project",
+        input.attribution.projectId,
+        input.folderRealpath
+      ];
+      break;
+    default: {
+      const unexpected = input.attribution;
+      throw new TypeError(`Unexpected attribution: ${String(unexpected)}`);
     }
-    await callback.close();
   }
+  return createHash3("sha256").update(JSON.stringify(identity)).digest("hex");
 };
 
-// src/auth/pkce-verifier-and-challenge/pkce-verifier-and-challenge.ts
-import { randomBytes } from "node:crypto";
+// src/requested-client-id/requested-client-id.ts
+var DEFAULT_ROUTE33_CLIENT_ID = false ? "" : "oa_platform_203623de";
 
-// src/auth/pkce-challenge/pkce-challenge.ts
-import { createHash as createHash3 } from "node:crypto";
-var pkceChallenge = (verifier) => createHash3("sha256").update(verifier).digest("base64url");
+// src/commands/change-attribution/change-attribution.ts
+var changeAttribution = async (options) => {
+  await options.clear();
+  return options.prompt();
+};
 
-// src/auth/pkce-verifier-and-challenge/pkce-verifier-and-challenge.ts
-var createPkceVerifierAndChallenge = () => {
-  const codeVerifier = randomBytes(32).toString("base64url");
+// src/commands/inspect-session/inspect-session.ts
+var inspectSession = (options) => {
+  const attribution = options.readAttribution();
+  const lease = options.readLease();
   return {
-    codeChallenge: pkceChallenge(codeVerifier),
-    codeVerifier,
-    state: randomBytes(32).toString("base64url")
+    attribution,
+    ...lease === void 0 ? {} : { lease: { expiresAt: lease.expiresAt, keyId: lease.keyId } }
   };
 };
 
-// src/auth/requested-scopes/requested-scopes.ts
-var REQUESTED_OAUTH_SCOPES = "openid offline_access projects:read keys:read keys:write";
+// src/commands/reset-attribution/reset-attribution.ts
+var resetAttribution = async (options) => {
+  await options.clear();
+};
 
-// src/auth/login-flow/login-flow.ts
-var loginFlow = async (options) => {
-  const log = options.logger ?? logger;
-  log.info("auth.login.started");
-  const pkce = createPkceVerifierAndChallenge();
-  const captured = await openBrowserAndCapture({
-    authorizationUrl: (redirectUri) => options.session.authorizationUrl({
-      clientId: options.clientId,
-      codeChallenge: pkce.codeChallenge,
-      redirectUri,
-      scope: REQUESTED_OAUTH_SCOPES,
-      state: pkce.state
-    }),
-    ...options.browserRunner === void 0 ? {} : { browserRunner: options.browserRunner },
-    expectedState: pkce.state,
-    ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
-  });
-  const tokenSet = await options.session.exchangeCode({
-    code: captured.code,
-    codeVerifier: pkce.codeVerifier,
-    redirectUri: captured.redirectUri
+// src/commands/rotate-now/rotate-now.ts
+var rotateNow = async (options) => {
+  const rotated = await options.lease({ renewalRatio: Number.EPSILON });
+  return rotated.lease;
+};
+
+// src/ux/attribution-prompt/attribution-prompt.ts
+var createAttributionPrompt = (projects) => {
+  const choicesBySelection = {
+    personal: { kind: "personal" }
+  };
+  const projectOptions = projects.map((project) => {
+    const selection = `project:${project.id}`;
+    choicesBySelection[selection] = {
+      kind: "project",
+      projectId: project.id
+    };
+    return {
+      label: `${project.name} (${project.organisation.name})`,
+      selection
+    };
   });
-  let credential;
-  try {
-    credential = parseManagementJwt(tokenSet.access_token);
-  } catch (cause) {
-    throw new AuthError("AUTH_TOKEN_RESPONSE_INVALID", { cause });
+  return {
+    choicesBySelection,
+    options: [
+      ...projectOptions,
+      { label: "Use my personal key", selection: "personal" }
+    ],
+    title: "Choose where Route 33 should manage this key"
+  };
+};
+
+// src/ux/attribution-prompt-error/attribution-prompt-error.ts
+var MESSAGES = {
+  ATTRIBUTION_PRESENTER_UNAVAILABLE: "Route 33 needs OpenCode v2 to assign a budget for this folder. Update to OpenCode v2, run /connect, choose Route 33, and follow the steps.",
+  ATTRIBUTION_SELECTION_INVALID: "That Route 33 option is no longer available. Connect again and pick another."
+};
+var AttributionPromptError = class extends GatewayCredentialError {
+  code;
+  constructor(code) {
+    super(MESSAGES[code]);
+    this.name = "AttributionPromptError";
+    this.code = code;
   }
-  log.info("auth.login.completed");
-  return { credential, tokenSet };
+};
+
+// src/ux/prompt-flow/prompt-flow.ts
+var resolveAttribution = async (options) => {
+  const remembered = readAttribution(options.state);
+  if (remembered !== void 0) {
+    return remembered;
+  }
+  if (options.presenter === void 0) {
+    throw new AttributionPromptError("ATTRIBUTION_PRESENTER_UNAVAILABLE");
+  }
+  const plan = createAttributionPrompt(await options.loadProjects());
+  const selection = await options.presenter.pick(plan);
+  const attribution = plan.choicesBySelection[selection];
+  if (attribution === void 0) {
+    throw new AttributionPromptError("ATTRIBUTION_SELECTION_INVALID");
+  }
+  writeAttribution(options.state, attribution);
+  return attribution;
+};
+
+// src/ux/trusted-party-copy/trusted-party-copy.ts
+var TRUSTED_PARTY_COPY = {
+  message: "Route 33 wants to manage your keys for this OpenCode installation.",
+  title: "Connect Route 33"
 };
 
 // src/route33-runtime/login-session/login-session.ts
@@ -3161,7 +3169,7 @@ var Route33Runtime = class {
     if (typeof client !== "function") {
       return client;
     }
-    this.#managementClient ??= client(() => this.#session.credential());
+    this.#managementClient ??= client();
     return this.#managementClient;
   }
   #subject(credential) {
@@ -3268,7 +3276,7 @@ var createWorkspaceKeyHeaders = ({ resolveKey, session }) => async (input, outpu
 // src/create-route33-plugin/create-route33-plugin.ts
 var createRoute33Plugin = (options = {}) => {
   const baseURL = readEnvBaseUrl();
-  const clientId = options.clientId ?? readEnvClientId() ?? DEFAULT_ROUTE33_CLIENT_ID;
+  const clientId2 = options.clientId ?? readEnvClientId() ?? DEFAULT_ROUTE33_CLIENT_ID;
   const directKey = readEnvDirectApiKey();
   const resolvedConfig = {
     ...baseURL === void 0 ? {} : { baseURL },
@@ -3289,19 +3297,19 @@ var createRoute33Plugin = (options = {}) => {
     })
   });
   return (input) => {
-    const runtime = runtimeOptions === void 0 || installation === void 0 ? void 0 : new Route33Runtime({
+    const runtime2 = runtimeOptions === void 0 || installation === void 0 ? void 0 : new Route33Runtime({
       ...runtimeOptions,
-      auth: { ...runtimeOptions.auth, clientId },
+      auth: { ...runtimeOptions.auth, clientId: clientId2 },
       installation,
       state: {
         directory: input.worktree,
         outsideWorktree: "return-undefined"
       }
     });
-    if (runtime !== void 0) {
-      options.bindRuntime?.(runtime);
+    if (runtime2 !== void 0) {
+      options.bindRuntime?.(runtime2);
       if (options.registerCommands !== void 0) {
-        options.registerCommands(runtime.commandHandlers());
+        options.registerCommands(runtime2.commandHandlers());
       }
     }
     let credentialProvider;
@@ -3309,14 +3317,14 @@ var createRoute33Plugin = (options = {}) => {
     let promptGate;
     if (directKey !== void 0) {
       credentialProvider = () => Promise.resolve(parseGatewayKey(directKey));
-    } else if (runtime === void 0) {
+    } else if (runtime2 === void 0) {
       credentialProvider = () => Promise.reject(
         new AttributionPromptError("ATTRIBUTION_PRESENTER_UNAVAILABLE")
       );
     } else {
-      credentialProvider = () => runtime.resolveCredential();
+      credentialProvider = () => runtime2.resolveCredential();
       workspaceHeaders = createWorkspaceKeyHeaders({
-        resolveKey: (directory) => runtime.resolveWorkspaceCredential(directory),
+        resolveKey: (directory) => runtime2.resolveWorkspaceCredential(directory),
         session: {
           get: async ({ sessionID }) => {
             const session = await options.readSession?.(sessionID);
@@ -3751,20 +3759,20 @@ var HttpManagementKeys = class {
 
 // src/lazy-management-keys/lazy-management-keys.ts
 var lazyManagementKeys = (options) => {
-  const client = async () => new HttpManagementKeys({
+  const client = (accessToken) => new HttpManagementKeys({
     baseUrl: options.apiBaseUrl,
-    credential: await options.obtainCredential(),
+    credential: accessToken,
     ...options.fetchImpl === void 0 ? {} : { fetchImpl: options.fetchImpl }
   });
   return {
-    create: async (accessToken, input) => (await client()).create(accessToken, input),
-    delete: async (accessToken, id) => (await client()).delete(accessToken, id),
-    get: async (accessToken, id) => (await client()).get(accessToken, id),
-    list: async (accessToken) => (await client()).list(accessToken),
-    listOrganizations: async (accessToken) => (await client()).listOrganizations(accessToken),
-    listProjects: async (accessToken, organisationId) => (await client()).listProjects(accessToken, organisationId),
-    regenerate: async (accessToken, id, expiresAt) => (await client()).regenerate(accessToken, id, expiresAt),
-    update: async (accessToken, id, input) => (await client()).update(accessToken, id, input)
+    create: async (accessToken, input) => client(accessToken).create(accessToken, input),
+    delete: async (accessToken, id) => client(accessToken).delete(accessToken, id),
+    get: async (accessToken, id) => client(accessToken).get(accessToken, id),
+    list: async (accessToken) => client(accessToken).list(accessToken),
+    listOrganizations: async (accessToken) => client(accessToken).listOrganizations(accessToken),
+    listProjects: async (accessToken, organisationId) => client(accessToken).listProjects(accessToken, organisationId),
+    regenerate: async (accessToken, id, expiresAt) => client(accessToken).regenerate(accessToken, id, expiresAt),
+    update: async (accessToken, id, input) => client(accessToken).update(accessToken, id, input)
   };
 };
 
@@ -3780,14 +3788,217 @@ var buildProductionRuntimeOptions = (input) => ({
     timeoutMs: LOGIN_BUDGET_MS
   },
   management: {
-    client: (obtainCredential) => lazyManagementKeys({
-      apiBaseUrl: input.apiBaseUrl,
-      obtainCredential
-    })
+    client: () => lazyManagementKeys({ apiBaseUrl: input.apiBaseUrl })
   },
   ...input.tokenStore === void 0 ? {} : { tokenStore: input.tokenStore }
 });
 
+// src/v1-entry/host-auth-bridge/host-auth-bridge.ts
+var createHostAuthBridge = () => {
+  let refresh;
+  return {
+    hydrate: (auth) => {
+      if (typeof auth.refresh === "string" && auth.refresh !== "") {
+        refresh = auth.refresh;
+      }
+    },
+    tokenStore: {
+      get: () => Promise.resolve(refresh),
+      set: (token) => {
+        refresh = token;
+        return Promise.resolve();
+      }
+    }
+  };
+};
+
+// src/auth/authorization-url-stash/authorization-url-stash.ts
+var FALLBACK_URL = "https://route33.ai";
+var SIGN_IN_INSTRUCTIONS = "Open the Route 33 sign-in link \u2014 your browser will finish at a confirmation page.";
+var FINISHING_INSTRUCTIONS = "Finishing Route 33 setup\u2026";
+var URL_WAIT_BUDGET_MS = 3e4;
+var createAuthorizationUrlStash = (options = {}) => {
+  const open = options.open ?? ((url) => openSystemBrowser(url));
+  const waitBudgetMs = options.waitBudgetMs ?? URL_WAIT_BUDGET_MS;
+  let resolveUrl;
+  const nextUrl = new Promise((resolve2) => {
+    resolveUrl = resolve2;
+  });
+  const browserRunner = (url) => {
+    resolveUrl?.(url);
+    return open(url);
+  };
+  const urlForConnect = async (callback) => {
+    let decide;
+    const decided = new Promise((resolve2) => {
+      decide = resolve2;
+    });
+    const timer = setTimeout(() => {
+      decide({ instructions: SIGN_IN_INSTRUCTIONS, url: FALLBACK_URL });
+    }, waitBudgetMs);
+    void nextUrl.then((url) => {
+      clearTimeout(timer);
+      decide({ instructions: SIGN_IN_INSTRUCTIONS, url: url.toString() });
+    });
+    void Promise.resolve(callback).catch(() => void 0).then(() => {
+      clearTimeout(timer);
+      decide({ instructions: FINISHING_INSTRUCTIONS, url: FALLBACK_URL });
+    });
+    return decided;
+  };
+  return { browserRunner, urlForConnect };
+};
+
+// src/v1-entry/route33-auth-hook/route33-auth-hook.ts
+var createRoute33AuthHook = (deps) => ({
+  loader: async (auth) => {
+    deps.bridge.hydrate(await auth());
+    return buildOptions(deps.providerBaseURL);
+  },
+  methods: [
+    {
+      authorize: async () => {
+        const stash = createAuthorizationUrlStash();
+        const login = deps.startLogin(stash.browserRunner);
+        const decision = await stash.urlForConnect(login.then(() => void 0));
+        return {
+          callback: async () => {
+            try {
+              const { tokenSet } = await login;
+              deps.bridge.hydrate({
+                refresh: tokenSet.refresh_token,
+                type: "oauth"
+              });
+              return {
+                access: tokenSet.access_token,
+                expires: Date.now() + tokenSet.expires_in * 1e3,
+                provider: "route_33",
+                refresh: tokenSet.refresh_token ?? "",
+                type: "success"
+              };
+            } catch {
+              return { type: "failed" };
+            }
+          },
+          instructions: decision.instructions,
+          method: "auto",
+          url: decision.url
+        };
+      },
+      label: "Route 33 (browser sign-in)",
+      type: "oauth"
+    }
+  ],
+  provider: "route_33"
+});
+
+// src/v1-entry/host-modality-flags/host-modality-flags.ts
+var hostModalityFlags = (modalities) => ({
+  audio: modalities.includes("audio"),
+  image: modalities.includes("image"),
+  pdf: modalities.includes("pdf"),
+  text: modalities.includes("text"),
+  video: modalities.includes("video")
+});
+
+// src/v1-entry/host-model-capabilities/host-model-capabilities.ts
+var hostModelCapabilities = (meta, forceReasoning) => {
+  const modalities = meta.modalities;
+  const capabilities = meta.capabilities;
+  const attachment = meta.attachment ?? capabilities.attachment ?? false;
+  return {
+    attachment,
+    input: hostModalityFlags(modalities?.input ?? ["text"]),
+    interleaved: false,
+    output: hostModalityFlags(modalities?.output ?? ["text"]),
+    reasoning: capabilities.reasoning === true || forceReasoning,
+    temperature: capabilities.temperature === true,
+    toolcall: capabilities.tool_call === true
+  };
+};
+
+// src/v1-entry/host-model-quantities/host-model-quantities.ts
+var ZERO_COST = {
+  cache: { read: 0, write: 0 },
+  input: 0,
+  output: 0
+};
+var DEFAULT_LIMIT = { context: 2e5, output: 64e3 };
+var hostModelQuantities = (meta) => {
+  const cost = meta.cost;
+  const limit = meta.limit;
+  return {
+    cost: cost === void 0 ? ZERO_COST : {
+      cache: {
+        read: cost.cache_read ?? 0,
+        write: cost.cache_write ?? 0
+      },
+      input: cost.input,
+      output: cost.output
+    },
+    limit: limit === void 0 ? DEFAULT_LIMIT : {
+      context: limit.context,
+      output: limit.output
+    }
+  };
+};
+
+// src/v1-entry/host-model-vendor/host-model-vendor.ts
+var hostModelVendor = (slug) => {
+  const separator = slug.indexOf("/");
+  const vendor = separator === -1 ? slug : slug.slice(0, separator);
+  return {
+    forceReasoning: vendor === "anthropic",
+    npm: NATIVE_SDK_BY_VENDOR[vendor] ?? "@ai-sdk/openai-compatible"
+  };
+};
+
+// src/v1-entry/host-models/host-models.ts
+var toHostModels = (input) => {
+  const models = {};
+  for (const [slug, meta] of Object.entries(input.enriched)) {
+    const vendor = hostModelVendor(slug);
+    const capabilities = hostModelCapabilities(meta, vendor.forceReasoning);
+    const quantities = hostModelQuantities(meta);
+    models[slug] = {
+      api: { id: slug, npm: vendor.npm, url: input.baseURL },
+      attachment: capabilities.attachment,
+      capabilities,
+      cost: quantities.cost,
+      headers: {},
+      id: slug,
+      limit: quantities.limit,
+      name: meta.name,
+      options: {},
+      providerID: "route_33",
+      release_date: "",
+      status: "active"
+    };
+  }
+  return models;
+};
+
+// src/v1-entry/route33-provider-models/route33-provider-models.ts
+var createRoute33ProviderModels = (deps) => async (provider) => {
+  const fallback = provider.models;
+  const key = await deps.resolveKey();
+  if (key === void 0) return fallback;
+  const [catalog, modelsDev] = await Promise.all([
+    (deps.loadCatalog ?? getCatalog)({
+      ...deps.catalog,
+      cacheDir: deps.cacheDir,
+      gatewayKey: key
+    }),
+    deps.loadModelsDev()
+  ]);
+  const enriched = enrichCatalog(catalog, modelsDev);
+  const models = toHostModels({
+    baseURL: deps.catalog.baseURL,
+    enriched
+  });
+  return Object.keys(models).length === 0 ? fallback : models;
+};
+
 // src/contract/fixtures/fixtures.ts
 var contractFixtures = {
   apiKey: {
@@ -3835,13 +4046,64 @@ var parseContractFixtures = (fixtures) => ({
 });
 
 // src/index.ts
-var Route33Plugin = createRoute33Plugin({
+var clientId = readEnvClientId() ?? DEFAULT_ROUTE33_CLIENT_ID;
+var issuerUrl = readEnvAuthIssuer() ?? DEFAULT_AUTH_ISSUER_URL;
+var authBridge = createHostAuthBridge();
+var startNativeLogin = (browserRunner) => loginFlow({
+  browserRunner,
+  clientId,
+  session: createAuthSession({ clientId, issuerUrl }),
+  timeoutMs: LOGIN_BUDGET_MS
+});
+var route33Plugin = createRoute33Plugin({
+  bindRuntime: (instance) => {
+    runtime = instance;
+  },
   runtime: buildProductionRuntimeOptions({
     apiBaseUrl: readEnvApiBase() ?? DEFAULT_MANAGEMENT_API_BASE_URL,
-    clientId: readEnvClientId() ?? DEFAULT_ROUTE33_CLIENT_ID,
-    issuerUrl: readEnvAuthIssuer() ?? DEFAULT_AUTH_ISSUER_URL
+    clientId,
+    issuerUrl,
+    tokenStore: authBridge.tokenStore
   })
 });
+var runtime;
+var modelsDevOnce;
+var Route33Plugin = async (input) => {
+  const hooks = await route33Plugin(input);
+  const native = readEnvDirectApiKey();
+  return {
+    ...hooks,
+    ...native !== void 0 ? {} : {
+      auth: createRoute33AuthHook({
+        bridge: authBridge,
+        providerBaseURL: readEnvBaseUrl() ?? DEFAULT_BASE_URL,
+        startLogin: startNativeLogin
+      }),
+      provider: {
+        id: "route_33",
+        models: createRoute33ProviderModels({
+          cacheDir: readEnvCacheDir(),
+          catalog: {
+            baseURL: readEnvBaseUrl() ?? DEFAULT_BASE_URL,
+            catalogTtlMs: readEnvCatalogTtlMs(),
+            disableIdShim: readEnvDisableIdShim(),
+            discoveryEnabled: readEnvDiscovery()
+          },
+          loadModelsDev: () => {
+            modelsDevOnce ??= loadModelsDev({
+              cacheDir: readEnvCacheDir()
+            });
+            return modelsDevOnce;
+          },
+          resolveKey: () => {
+            const active = runtime;
+            return active === void 0 ? Promise.resolve(void 0) : active.resolveWorkspaceCredential(input.worktree);
+          }
+        })
+      }
+    }
+  };
+};
 export {
   AttributionPromptError,
   AuthError,