oc-auth-switcher 0.1.0

package/dist/index.js

@@ -0,0 +1,1018 @@
+// node_modules/@ex-machina/opencode-anthropic-auth/dist/cch.js
+import { createHash } from "node:crypto";
+
+// node_modules/@ex-machina/opencode-anthropic-auth/dist/constants.js
+var CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+var AUTHORIZE_URLS = {
+  console: "https://platform.claude.com/oauth/authorize",
+  max: "https://claude.ai/oauth/authorize"
+};
+var CODE_CALLBACK_URL = "https://platform.claude.com/oauth/code/callback";
+var TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
+var OAUTH_SCOPES = [
+  "org:create_api_key",
+  "user:profile",
+  "user:inference",
+  "user:sessions:claude_code",
+  "user:mcp_servers",
+  "user:file_upload"
+];
+var TOOL_PREFIX = "mcp_";
+var REQUIRED_BETAS = [
+  "oauth-2025-04-20",
+  "interleaved-thinking-2025-05-14"
+];
+var OPENCODE_IDENTITY_PREFIX = "You are OpenCode";
+var CLAUDE_CODE_IDENTITY = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
+var CCH_SALT = "59cf53e54c78";
+var CCH_POSITIONS = [4, 7, 20];
+var CLAUDE_CODE_VERSION = "2.1.87";
+var CLAUDE_CODE_ENTRYPOINT = "sdk-cli";
+var USER_AGENT = "claude-cli/2.1.87 (external, cli)";
+var PARAGRAPH_REMOVAL_ANCHORS = [
+  "github.com/anomalyco/opencode",
+  "opencode.ai/docs"
+];
+var TEXT_REPLACEMENTS = [
+  { match: "if OpenCode honestly", replacement: "if the assistant honestly" },
+  {
+    match: "Here is some useful information about the environment you are running in:",
+    replacement: "Environment context you are running in:"
+  }
+];
+
+// node_modules/@ex-machina/opencode-anthropic-auth/dist/cch.js
+function extractFirstUserMessageText(messages) {
+  const userMsg = messages.find((message) => message.role === "user");
+  if (!userMsg)
+    return "";
+  const { content } = userMsg;
+  if (typeof content === "string")
+    return content;
+  if (Array.isArray(content)) {
+    const textBlock = content.find((block) => block.type === "text");
+    if (textBlock?.text)
+      return textBlock.text;
+  }
+  return "";
+}
+function computeCCH(messageText) {
+  return createHash("sha256").update(messageText).digest("hex").slice(0, 5);
+}
+function computeVersionSuffix(messageText, version = CLAUDE_CODE_VERSION) {
+  const chars = CCH_POSITIONS.map((index) => messageText[index] || "0").join("");
+  return createHash("sha256").update(`${CCH_SALT}${chars}${version}`).digest("hex").slice(0, 3);
+}
+function buildBillingHeaderValue(messages, version = CLAUDE_CODE_VERSION, entrypoint) {
+  const text = extractFirstUserMessageText(messages);
+  const suffix = computeVersionSuffix(text, version);
+  const cch = computeCCH(text);
+  return "x-anthropic-billing-header: " + `cc_version=${version}.${suffix}; ` + `cc_entrypoint=${entrypoint}; ` + `cch=${cch};`;
+}
+
+// node_modules/@ex-machina/opencode-anthropic-auth/dist/transform.js
+function prefixName(name) {
+  return `${TOOL_PREFIX}${name.charAt(0).toUpperCase()}${name.slice(1)}`;
+}
+function unprefixName(name) {
+  if (name === "StructuredOutput") {
+    return name;
+  }
+  return `${name.charAt(0).toLowerCase()}${name.slice(1)}`;
+}
+function mergeHeaders(input, init) {
+  const headers = new Headers;
+  if (input instanceof Request) {
+    input.headers.forEach((value, key) => {
+      headers.set(key, value);
+    });
+  }
+  const initHeaders = init?.headers;
+  if (initHeaders) {
+    if (initHeaders instanceof Headers) {
+      initHeaders.forEach((value, key) => {
+        headers.set(key, value);
+      });
+    } else if (Array.isArray(initHeaders)) {
+      for (const entry of initHeaders) {
+        const [key, value] = entry;
+        if (typeof value !== "undefined") {
+          headers.set(key, String(value));
+        }
+      }
+    } else {
+      for (const [key, value] of Object.entries(initHeaders)) {
+        if (typeof value !== "undefined") {
+          headers.set(key, String(value));
+        }
+      }
+    }
+  }
+  return headers;
+}
+function mergeBetaHeaders(headers) {
+  const incomingBeta = headers.get("anthropic-beta") || "";
+  const incomingBetasList = incomingBeta.split(",").map((b) => b.trim()).filter(Boolean);
+  return [...new Set([...REQUIRED_BETAS, ...incomingBetasList])].join(",");
+}
+function setOAuthHeaders(headers, accessToken) {
+  headers.set("authorization", `Bearer ${accessToken}`);
+  headers.set("anthropic-beta", mergeBetaHeaders(headers));
+  headers.set("user-agent", USER_AGENT);
+  headers.delete("x-api-key");
+  return headers;
+}
+function prefixToolNames(parsed) {
+  if (parsed.tools && Array.isArray(parsed.tools)) {
+    parsed.tools = parsed.tools.map((tool) => ({
+      ...tool,
+      name: tool.name ? prefixName(tool.name) : tool.name
+    }));
+  }
+  if (parsed.messages && Array.isArray(parsed.messages)) {
+    parsed.messages = parsed.messages.map((msg) => {
+      if (msg.content && Array.isArray(msg.content)) {
+        msg.content = msg.content.map((block) => {
+          if (block.type === "tool_use" && block.name) {
+            return { ...block, name: prefixName(block.name) };
+          }
+          return block;
+        });
+      }
+      return msg;
+    });
+  }
+  return JSON.stringify(parsed);
+}
+function stripToolPrefix(text) {
+  return text.replace(/"name"\s*:\s*"mcp_([^"]+)"/g, (_match, name) => `"name": "${unprefixName(name)}"`);
+}
+function isInsecure() {
+  if (!process.env.ANTHROPIC_BASE_URL?.trim())
+    return false;
+  const raw = process.env.ANTHROPIC_INSECURE?.trim();
+  return raw === "1" || raw === "true";
+}
+function resolveBaseUrl() {
+  const raw = process.env.ANTHROPIC_BASE_URL?.trim();
+  if (!raw)
+    return null;
+  try {
+    const baseUrl = new URL(raw);
+    if (baseUrl.protocol !== "http:" && baseUrl.protocol !== "https:" || baseUrl.username || baseUrl.password) {
+      return null;
+    }
+    return baseUrl;
+  } catch {
+    return null;
+  }
+}
+function rewriteUrl(input) {
+  let requestUrl = null;
+  try {
+    if (typeof input === "string" || input instanceof URL) {
+      requestUrl = new URL(input.toString());
+    } else if (input instanceof Request) {
+      requestUrl = new URL(input.url);
+    }
+  } catch {
+    requestUrl = null;
+  }
+  if (!requestUrl)
+    return { input, url: null };
+  const originalHref = requestUrl.href;
+  const baseUrl = resolveBaseUrl();
+  if (baseUrl) {
+    requestUrl.protocol = baseUrl.protocol;
+    requestUrl.host = baseUrl.host;
+  }
+  if (requestUrl.pathname === "/v1/messages" && !requestUrl.searchParams.has("beta")) {
+    requestUrl.searchParams.set("beta", "true");
+  }
+  if (requestUrl.href === originalHref) {
+    return { input, url: requestUrl };
+  }
+  const newInput = input instanceof Request ? new Request(requestUrl.toString(), input) : requestUrl;
+  return { input: newInput, url: requestUrl };
+}
+function sanitizeSystemText(text) {
+  const paragraphs = text.split(/\n\n+/);
+  const filtered = paragraphs.filter((paragraph) => {
+    if (paragraph.includes(OPENCODE_IDENTITY_PREFIX)) {
+      return false;
+    }
+    for (const anchor of PARAGRAPH_REMOVAL_ANCHORS) {
+      if (paragraph.includes(anchor))
+        return false;
+    }
+    return true;
+  });
+  let result = filtered.join(`
+
+`);
+  for (const rule of TEXT_REPLACEMENTS) {
+    result = result.replace(rule.match, rule.replacement);
+  }
+  return result.trim();
+}
+function isRecord(value) {
+  return value != null && typeof value === "object" && !Array.isArray(value);
+}
+function prependClaudeCodeIdentity(system) {
+  const identityBlock = {
+    type: "text",
+    text: CLAUDE_CODE_IDENTITY
+  };
+  if (system == null)
+    return [identityBlock];
+  if (typeof system === "string") {
+    const sanitized2 = sanitizeSystemText(system);
+    if (sanitized2 === CLAUDE_CODE_IDENTITY)
+      return [identityBlock];
+    return [identityBlock, { type: "text", text: sanitized2 }];
+  }
+  if (isRecord(system)) {
+    const type = typeof system.type === "string" ? system.type : "text";
+    const text = typeof system.text === "string" ? system.text : "";
+    return [identityBlock, { ...system, type, text: sanitizeSystemText(text) }];
+  }
+  if (!Array.isArray(system))
+    return [identityBlock];
+  const sanitized = system.map((item) => {
+    if (typeof item === "string") {
+      return { type: "text", text: sanitizeSystemText(item) };
+    }
+    if (isRecord(item) && item.type === "text" && typeof item.text === "string") {
+      return {
+        ...item,
+        type: "text",
+        text: sanitizeSystemText(item.text)
+      };
+    }
+    return { type: "text", text: String(item) };
+  });
+  if (sanitized[0]?.text === CLAUDE_CODE_IDENTITY) {
+    return sanitized;
+  }
+  return [identityBlock, ...sanitized];
+}
+function rewriteRequestBody(body) {
+  try {
+    const parsed = JSON.parse(body);
+    const billingHeader = Array.isArray(parsed.messages) && parsed.messages.some((message) => message.role === "user") ? buildBillingHeaderValue(parsed.messages, undefined, CLAUDE_CODE_ENTRYPOINT) : null;
+    parsed.system = prependClaudeCodeIdentity(parsed.system);
+    if (billingHeader && Array.isArray(parsed.system)) {
+      parsed.system.unshift({ type: "text", text: billingHeader });
+    }
+    return prefixToolNames(parsed);
+  } catch {
+    return body;
+  }
+}
+function createStrippedStream(response) {
+  if (!response.body)
+    return response;
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder;
+  const encoder = new TextEncoder;
+  const stream = new ReadableStream({
+    async pull(controller) {
+      const { done, value } = await reader.read();
+      if (done) {
+        controller.close();
+        return;
+      }
+      let text = decoder.decode(value, { stream: true });
+      text = stripToolPrefix(text);
+      controller.enqueue(encoder.encode(text));
+    }
+  });
+  return new Response(stream, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers
+  });
+}
+
+// node_modules/@ex-machina/opencode-anthropic-auth/dist/pkce.js
+function base64UrlEncode(bytes) {
+  let bin = "";
+  for (const byte of bytes)
+    bin += String.fromCharCode(byte);
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+async function generatePKCE() {
+  const buf = new Uint8Array(64);
+  crypto.getRandomValues(buf);
+  const verifier = base64UrlEncode(buf);
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return {
+    verifier,
+    challenge: base64UrlEncode(new Uint8Array(digest)),
+    method: "S256"
+  };
+}
+
+// node_modules/@ex-machina/opencode-anthropic-auth/dist/auth.js
+function generateState() {
+  return crypto.randomUUID().replace(/-/g, "");
+}
+function parseCallbackInput(input) {
+  const trimmed = input.trim();
+  try {
+    const url = new URL(trimmed);
+    const code2 = url.searchParams.get("code");
+    const state2 = url.searchParams.get("state");
+    if (code2 && state2) {
+      return { code: code2, state: state2 };
+    }
+  } catch {}
+  const hashSplits = trimmed.split("#");
+  if (hashSplits.length === 2 && hashSplits[0] && hashSplits[1]) {
+    return { code: hashSplits[0], state: hashSplits[1] };
+  }
+  const params = new URLSearchParams(trimmed);
+  const code = params.get("code");
+  const state = params.get("state");
+  if (code && state) {
+    return { code, state };
+  }
+  return null;
+}
+async function exchangeCode(callback, verifier, redirectUri) {
+  const result = await fetch(TOKEN_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Accept: "application/json, text/plain, */*",
+      "User-Agent": "axios/1.13.6"
+    },
+    body: JSON.stringify({
+      code: callback.code,
+      state: callback.state,
+      grant_type: "authorization_code",
+      client_id: CLIENT_ID,
+      redirect_uri: redirectUri,
+      code_verifier: verifier
+    })
+  });
+  if (!result.ok) {
+    return {
+      type: "failed"
+    };
+  }
+  const json = await result.json();
+  return {
+    type: "success",
+    refresh: json.refresh_token,
+    access: json.access_token,
+    expires: Date.now() + json.expires_in * 1000
+  };
+}
+async function authorize(mode) {
+  const pkce = await generatePKCE();
+  const state = generateState();
+  const url = new URL(AUTHORIZE_URLS[mode], import.meta.url);
+  url.searchParams.set("code", "true");
+  url.searchParams.set("client_id", CLIENT_ID);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("redirect_uri", CODE_CALLBACK_URL);
+  url.searchParams.set("scope", OAUTH_SCOPES.join(" "));
+  url.searchParams.set("code_challenge", pkce.challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("state", state);
+  return {
+    url: url.toString(),
+    redirectUri: CODE_CALLBACK_URL,
+    state,
+    verifier: pkce.verifier
+  };
+}
+async function exchange(input, verifier, redirectUri, expectedState) {
+  const callback = parseCallbackInput(input);
+  if (!callback) {
+    return {
+      type: "failed"
+    };
+  }
+  if (expectedState && callback.state !== expectedState) {
+    return {
+      type: "failed"
+    };
+  }
+  return exchangeCode(callback, verifier, redirectUri);
+}
+
+// src/accounts.ts
+import fs from "node:fs";
+import path2 from "node:path";
+
+// src/constants.ts
+import path from "node:path";
+import os from "node:os";
+var configDir = path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config"), "opencode");
+var ACCOUNTS_FILE = path.join(configDir, "auth-switcher-accounts.json");
+var STATE_FILE = path.join(configDir, "auth-switcher-state.json");
+var DEFAULT_THRESHOLD = 0.9;
+var DEFAULT_CHECK_INTERVAL = 60 * 60 * 1000;
+var AUTH_FAILURE_COOLDOWN = 60 * 60 * 1000;
+
+// src/accounts.ts
+function normalizeAccount(raw) {
+  const name = raw.name || "unnamed";
+  const access = raw.access || raw.accessToken || "";
+  const refresh = raw.refresh || raw.refreshToken || "";
+  let expires = 0;
+  const rawExpires = raw.expires ?? raw.expiresAt;
+  if (typeof rawExpires === "number") {
+    expires = rawExpires;
+  } else if (typeof rawExpires === "string") {
+    const parsed = Date.parse(rawExpires);
+    if (!isNaN(parsed))
+      expires = parsed;
+  }
+  return { name, access, refresh, expires };
+}
+function ensureDir(filePath) {
+  const dir = path2.dirname(filePath);
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
+  }
+}
+function safeReadJSON(filePath, fallback) {
+  for (const p of [filePath, filePath + ".bak"]) {
+    try {
+      const raw = fs.readFileSync(p, "utf-8");
+      return JSON.parse(raw);
+    } catch {}
+  }
+  return fallback;
+}
+function safeWriteJSON(filePath, data) {
+  ensureDir(filePath);
+  const content = JSON.stringify(data, null, 2);
+  const tmpPath = filePath + ".tmp";
+  const bakPath = filePath + ".bak";
+  if (fs.existsSync(filePath)) {
+    try {
+      fs.copyFileSync(filePath, bakPath);
+    } catch {}
+  }
+  fs.writeFileSync(tmpPath, content, { mode: 384 });
+  fs.renameSync(tmpPath, filePath);
+}
+function loadAccounts() {
+  const raw = safeReadJSON(ACCOUNTS_FILE, {
+    accounts: []
+  });
+  const accounts = (raw.accounts || []).map((a) => normalizeAccount(a));
+  return { accounts };
+}
+function saveAccounts(data) {
+  safeWriteJSON(ACCOUNTS_FILE, data);
+}
+function updateAccountTokens(name, access, refresh, expires) {
+  const data = loadAccounts();
+  const account = data.accounts.find((a) => a.name === name);
+  if (account) {
+    account.access = access;
+    account.refresh = refresh;
+    account.expires = expires;
+    saveAccounts(data);
+  }
+}
+
+// src/state.ts
+var EMPTY_METRIC = { utilization: 0, reset: 0, status: "" };
+var EMPTY_USAGE = {
+  session5h: { ...EMPTY_METRIC },
+  weekly7d: { ...EMPTY_METRIC },
+  weekly7dSonnet: { ...EMPTY_METRIC }
+};
+function defaultState() {
+  return {
+    currentAccount: null,
+    lastRotationCheck: 0,
+    requestCount: 0,
+    config: {
+      threshold: DEFAULT_THRESHOLD,
+      checkInterval: DEFAULT_CHECK_INTERVAL
+    },
+    usage: {},
+    authFailures: {}
+  };
+}
+function loadState() {
+  const raw = safeReadJSON(STATE_FILE, {});
+  const defaults = defaultState();
+  return {
+    currentAccount: raw.currentAccount ?? defaults.currentAccount,
+    lastRotationCheck: raw.lastRotationCheck ?? defaults.lastRotationCheck,
+    requestCount: raw.requestCount ?? defaults.requestCount,
+    config: {
+      threshold: raw.config?.threshold ?? defaults.config.threshold,
+      checkInterval: raw.config?.checkInterval ?? defaults.config.checkInterval
+    },
+    usage: raw.usage ?? defaults.usage,
+    authFailures: raw.authFailures ?? defaults.authFailures
+  };
+}
+function saveState(state) {
+  safeWriteJSON(STATE_FILE, state);
+}
+function getThresholds(config) {
+  if (typeof config.threshold === "number") {
+    return {
+      session5h: config.threshold,
+      weekly7d: config.threshold,
+      weekly7dSonnet: config.threshold
+    };
+  }
+  return config.threshold;
+}
+function resolveStaleMetrics(state) {
+  const now = Date.now() / 1000;
+  for (const accountName of Object.keys(state.usage)) {
+    const usage = state.usage[accountName];
+    const metrics = ["session5h", "weekly7d", "weekly7dSonnet"];
+    for (const key of metrics) {
+      const metric = usage[key];
+      if (metric.reset > 0 && metric.reset <= now) {
+        metric.utilization = 0;
+        metric.reset = 0;
+        metric.status = "";
+      }
+    }
+  }
+}
+function ensureAccountsInState(state, accountNames) {
+  for (const name of accountNames) {
+    if (!state.usage[name]) {
+      state.usage[name] = {
+        session5h: { ...EMPTY_METRIC },
+        weekly7d: { ...EMPTY_METRIC },
+        weekly7dSonnet: { ...EMPTY_METRIC }
+      };
+    }
+  }
+}
+function updateUsageFromHeaders(state, accountName, headers) {
+  if (!state.usage[accountName]) {
+    state.usage[accountName] = {
+      session5h: { ...EMPTY_METRIC },
+      weekly7d: { ...EMPTY_METRIC },
+      weekly7dSonnet: { ...EMPTY_METRIC }
+    };
+  }
+  const usage = state.usage[accountName];
+  let updated = false;
+  const metricFamilies = [
+    {
+      key: "session5h",
+      prefix: "anthropic-ratelimit-unified-5h"
+    },
+    {
+      key: "weekly7d",
+      prefix: "anthropic-ratelimit-unified-7d"
+    },
+    {
+      key: "weekly7dSonnet",
+      prefix: "anthropic-ratelimit-unified-7d_sonnet"
+    }
+  ];
+  for (const { key, prefix } of metricFamilies) {
+    const utilHeader = headers.get(`${prefix}-utilization`);
+    const resetHeader = headers.get(`${prefix}-reset`);
+    const statusHeader = headers.get(`${prefix}-status`);
+    if (utilHeader !== null || resetHeader !== null || statusHeader !== null) {
+      if (utilHeader !== null) {
+        const val = parseFloat(utilHeader);
+        if (!isNaN(val)) {
+          usage[key].utilization = val;
+          updated = true;
+        }
+      }
+      if (resetHeader !== null) {
+        const val = Number(resetHeader);
+        if (!isNaN(val)) {
+          usage[key].reset = val;
+        } else {
+          const parsed = Date.parse(resetHeader);
+          if (!isNaN(parsed)) {
+            usage[key].reset = parsed / 1000;
+          }
+        }
+      }
+      if (statusHeader !== null) {
+        usage[key].status = statusHeader;
+      }
+    }
+  }
+  if (updated) {
+    usage.timestamp = new Date().toISOString();
+  }
+  return updated;
+}
+
+// src/rotation.ts
+function isTemporarilyUnavailable(state, accountName) {
+  const cooldownUntil = state.authFailures[accountName];
+  if (!cooldownUntil)
+    return false;
+  if (Date.now() > cooldownUntil) {
+    delete state.authFailures[accountName];
+    return false;
+  }
+  return true;
+}
+function isOverThreshold(usage, state) {
+  if (!usage)
+    return false;
+  const thresholds = getThresholds(state.config);
+  return usage.session5h.utilization > thresholds.session5h || usage.weekly7d.utilization > thresholds.weekly7d || usage.weekly7dSonnet.utilization > thresholds.weekly7dSonnet;
+}
+function getUtilizationScore(usage, state) {
+  if (!usage)
+    return 0;
+  const thresholds = getThresholds(state.config);
+  return Math.max(usage.session5h.utilization / thresholds.session5h, usage.weekly7d.utilization / thresholds.weekly7d, usage.weekly7dSonnet.utilization / thresholds.weekly7dSonnet);
+}
+function getExceededMetric(usage, state) {
+  if (!usage)
+    return null;
+  const thresholds = getThresholds(state.config);
+  const metrics = [
+    { name: "session5h", util: usage.session5h.utilization, thresh: thresholds.session5h },
+    { name: "weekly7d", util: usage.weekly7d.utilization, thresh: thresholds.weekly7d },
+    { name: "weekly7dSonnet", util: usage.weekly7dSonnet.utilization, thresh: thresholds.weekly7dSonnet }
+  ];
+  const exceeded = metrics.filter((m) => m.util > m.thresh).sort((a, b) => b.util / b.thresh - a.util / a.thresh);
+  return exceeded.length > 0 ? exceeded[0].name : null;
+}
+function getEarliestReset(usage) {
+  if (!usage)
+    return 0;
+  const resets = [
+    usage.session5h.reset,
+    usage.weekly7d.reset,
+    usage.weekly7dSonnet.reset
+  ].filter((r) => r > 0);
+  return resets.length > 0 ? Math.min(...resets) * 1000 : 0;
+}
+function selectAccount(accounts, state) {
+  if (accounts.length === 0) {
+    throw new Error("No accounts available");
+  }
+  if (accounts.length === 1) {
+    return { account: accounts[0], switched: false };
+  }
+  const primary = accounts[0];
+  const fallbacks = accounts.slice(1);
+  if (!state.currentAccount) {
+    return {
+      account: primary,
+      switched: true,
+      reason: "Initial selection — using primary account"
+    };
+  }
+  const currentIdx = accounts.findIndex((a) => a.name === state.currentAccount);
+  if (currentIdx < 0) {
+    return {
+      account: primary,
+      switched: true,
+      reason: "Current account no longer in pool — switching to primary"
+    };
+  }
+  const current = accounts[currentIdx];
+  const currentUsage = state.usage[current.name];
+  const primaryUsage = state.usage[primary.name];
+  const isPrimary = current.name === primary.name;
+  if (isPrimary) {
+    if (isOverThreshold(primaryUsage, state)) {
+      const exceededMetric = getExceededMetric(primaryUsage, state);
+      for (const fb of fallbacks) {
+        if (isTemporarilyUnavailable(state, fb.name))
+          continue;
+        const fbUsage = state.usage[fb.name];
+        if (!isOverThreshold(fbUsage, state)) {
+          return {
+            account: fb,
+            switched: true,
+            reason: `Primary exceeded ${exceededMetric} threshold — switching to ${fb.name}`
+          };
+        }
+      }
+      let bestFb = null;
+      let bestScore = Infinity;
+      for (const fb of fallbacks) {
+        if (isTemporarilyUnavailable(state, fb.name))
+          continue;
+        const score = getUtilizationScore(state.usage[fb.name], state);
+        if (score < bestScore) {
+          bestScore = score;
+          bestFb = fb;
+        }
+      }
+      if (bestFb) {
+        return {
+          account: bestFb,
+          switched: true,
+          reason: `Primary exceeded threshold, all fallbacks busy — using least loaded: ${bestFb.name}`
+        };
+      }
+      return { account: primary, switched: false };
+    }
+    return { account: primary, switched: false };
+  }
+  const now = Date.now();
+  const checkInterval = state.config.checkInterval;
+  const earliestReset = getEarliestReset(primaryUsage);
+  const timeSinceLastCheck = now - state.lastRotationCheck;
+  const shouldCheckPrimary = earliestReset > 0 && earliestReset <= now || timeSinceLastCheck >= checkInterval;
+  if (shouldCheckPrimary) {
+    state.lastRotationCheck = now;
+    if (!isOverThreshold(primaryUsage, state) && !isTemporarilyUnavailable(state, primary.name)) {
+      return {
+        account: primary,
+        switched: true,
+        reason: "Primary has recovered — switching back"
+      };
+    }
+  }
+  if (!isTemporarilyUnavailable(state, current.name)) {
+    return { account: current, switched: false };
+  }
+  for (const fb of fallbacks) {
+    if (fb.name === current.name)
+      continue;
+    if (isTemporarilyUnavailable(state, fb.name))
+      continue;
+    const fbUsage = state.usage[fb.name];
+    if (!isOverThreshold(fbUsage, state)) {
+      return {
+        account: fb,
+        switched: true,
+        reason: `Current account ${current.name} in cooldown — switching to ${fb.name}`
+      };
+    }
+  }
+  if (!isTemporarilyUnavailable(state, primary.name)) {
+    return {
+      account: primary,
+      switched: true,
+      reason: "All fallbacks unavailable — falling back to primary"
+    };
+  }
+  return { account: current, switched: false };
+}
+function markAuthFailure(state, accountName) {
+  state.authFailures[accountName] = Date.now() + AUTH_FAILURE_COOLDOWN;
+}
+function clearAuthFailure(state, accountName) {
+  delete state.authFailures[accountName];
+}
+
+// src/index.ts
+async function refreshAccountToken(refreshTokenValue) {
+  try {
+    const response = await fetch(TOKEN_URL, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json, text/plain, */*",
+        "User-Agent": "axios/1.13.6"
+      },
+      body: JSON.stringify({
+        grant_type: "refresh_token",
+        refresh_token: refreshTokenValue,
+        client_id: CLIENT_ID
+      })
+    });
+    if (!response.ok) {
+      const body = await response.text().catch(() => "");
+      return { ok: false, error: `HTTP ${response.status}: ${body}` };
+    }
+    const json = await response.json();
+    return {
+      ok: true,
+      access: json.access_token,
+      refresh: json.refresh_token,
+      expires: Date.now() + json.expires_in * 1000
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+var AuthSwitcherPlugin = async ({ client }) => {
+  return {
+    auth: {
+      provider: "anthropic",
+      async loader(getAuth, provider) {
+        const auth = await getAuth();
+        if (auth.type !== "oauth")
+          return {};
+        for (const model of Object.values(provider.models)) {
+          model.cost = {
+            input: 0,
+            output: 0,
+            cache: { read: 0, write: 0 }
+          };
+        }
+        let refreshPromise = null;
+        return {
+          apiKey: "",
+          async fetch(input, init) {
+            const { accounts } = loadAccounts();
+            const state = loadState();
+            if (accounts.length === 0) {
+              const auth2 = await getAuth();
+              if (auth2.type !== "oauth")
+                return fetch(input, init);
+              if (!auth2.access || !auth2.expires || auth2.expires < Date.now()) {
+                if (!refreshPromise) {
+                  refreshPromise = (async () => {
+                    const freshAuth = await getAuth();
+                    const result = await refreshAccountToken(freshAuth.refresh);
+                    if (!result.ok)
+                      throw new Error(result.error);
+                    await client.auth.set({
+                      path: { id: "anthropic" },
+                      body: {
+                        type: "oauth",
+                        refresh: result.refresh,
+                        access: result.access,
+                        expires: result.expires
+                      }
+                    });
+                    return result.access;
+                  })().finally(() => {
+                    refreshPromise = null;
+                  });
+                }
+                auth2.access = await refreshPromise;
+              }
+              const requestHeaders2 = mergeHeaders(input, init);
+              setOAuthHeaders(requestHeaders2, auth2.access);
+              let body2 = init?.body;
+              if (body2 && typeof body2 === "string") {
+                body2 = rewriteRequestBody(body2);
+              }
+              const rewritten2 = rewriteUrl(input);
+              const response2 = await fetch(rewritten2.input, {
+                ...init,
+                body: body2,
+                headers: requestHeaders2,
+                ...isInsecure() && {
+                  tls: { rejectUnauthorized: false }
+                }
+              });
+              return createStrippedStream(response2);
+            }
+            ensureAccountsInState(state, accounts.map((a) => a.name));
+            resolveStaleMetrics(state);
+            const selection = selectAccount(accounts, state);
+            let account = selection.account;
+            if (selection.switched) {
+              console.log(`[oc-auth-switcher] ${selection.reason}`);
+            }
+            state.currentAccount = account.name;
+            const attemptedAccounts = new Set;
+            while (true) {
+              attemptedAccounts.add(account.name);
+              if (!account.access || account.expires <= Date.now()) {
+                const result = await refreshAccountToken(account.refresh);
+                if (result.ok && result.access && result.refresh && result.expires) {
+                  account.access = result.access;
+                  account.refresh = result.refresh;
+                  account.expires = result.expires;
+                  updateAccountTokens(account.name, result.access, result.refresh, result.expires);
+                } else {
+                  markAuthFailure(state, account.name);
+                  const next = accounts.find((a) => !attemptedAccounts.has(a.name) && !state.authFailures[a.name]);
+                  if (!next) {
+                    throw new Error(`[oc-auth-switcher] All accounts failed token refresh`);
+                  }
+                  account = next;
+                  state.currentAccount = account.name;
+                  continue;
+                }
+              }
+              break;
+            }
+            const requestHeaders = mergeHeaders(input, init);
+            setOAuthHeaders(requestHeaders, account.access);
+            let body = init?.body;
+            if (body && typeof body === "string") {
+              body = rewriteRequestBody(body);
+            }
+            const rewritten = rewriteUrl(input);
+            const response = await fetch(rewritten.input, {
+              ...init,
+              body,
+              headers: requestHeaders,
+              ...isInsecure() && {
+                tls: { rejectUnauthorized: false }
+              }
+            });
+            if ((response.status === 401 || response.status === 403) && !attemptedAccounts.has("__retried__")) {
+              const errorBody = await response.clone().text().catch(() => "");
+              const isScopeError = errorBody.includes("scope") || errorBody.includes("unauthorized") || errorBody.includes("invalid");
+              if (isScopeError) {
+                markAuthFailure(state, account.name);
+                const next = accounts.find((a) => !attemptedAccounts.has(a.name) && (!state.authFailures[a.name] || state.authFailures[a.name] <= Date.now()));
+                if (next) {
+                  attemptedAccounts.add("__retried__");
+                  account = next;
+                  state.currentAccount = next.name;
+                  if (!next.access || next.expires <= Date.now()) {
+                    const result = await refreshAccountToken(next.refresh);
+                    if (result.ok && result.access && result.refresh && result.expires) {
+                      next.access = result.access;
+                      next.refresh = result.refresh;
+                      next.expires = result.expires;
+                      updateAccountTokens(next.name, result.access, result.refresh, result.expires);
+                    }
+                  }
+                  const retryHeaders = mergeHeaders(input, init);
+                  setOAuthHeaders(retryHeaders, next.access);
+                  const retryResponse = await fetch(rewritten.input, {
+                    ...init,
+                    body,
+                    headers: retryHeaders,
+                    ...isInsecure() && {
+                      tls: { rejectUnauthorized: false }
+                    }
+                  });
+                  updateUsageFromHeaders(state, next.name, retryResponse.headers);
+                  clearAuthFailure(state, next.name);
+                  saveState(state);
+                  return createStrippedStream(retryResponse);
+                }
+              }
+            }
+            updateUsageFromHeaders(state, account.name, response.headers);
+            clearAuthFailure(state, account.name);
+            state.requestCount = (state.requestCount || 0) + 1;
+            saveState(state);
+            return createStrippedStream(response);
+          }
+        };
+      },
+      methods: [
+        {
+          label: "Claude Pro/Max",
+          type: "oauth",
+          authorize: async () => {
+            const result = await authorize("max");
+            return {
+              url: result.url,
+              instructions: "Paste the authorization code here:",
+              method: "code",
+              callback: async (code) => {
+                return exchange(code, result.verifier, result.redirectUri, result.state);
+              }
+            };
+          }
+        },
+        {
+          label: "Create an API Key",
+          type: "oauth",
+          authorize: async () => {
+            const result = await authorize("console");
+            return {
+              url: result.url,
+              instructions: "Paste the authorization code here:",
+              method: "code",
+              callback: async (code) => {
+                const credentials = await exchange(code, result.verifier, result.redirectUri, result.state);
+                if (credentials.type === "failed")
+                  return credentials;
+                const apiKey = await fetch("https://api.anthropic.com/api/oauth/claude_cli/create_api_key", {
+                  method: "POST",
+                  headers: {
+                    "Content-Type": "application/json",
+                    authorization: `Bearer ${credentials.access}`
+                  }
+                }).then((r) => r.json());
+                return { type: "success", key: apiKey.raw_key };
+              }
+            };
+          }
+        },
+        {
+          provider: "anthropic",
+          label: "Manually enter API Key",
+          type: "api"
+        }
+      ]
+    }
+  };
+};
+var src_default = AuthSwitcherPlugin;
+export {
+  src_default as default,
+  AuthSwitcherPlugin
+};