@cortexkit/anthropic-auth-core 2.0.1 → 2.0.2

package/dist/index.js

@@ -8042,7 +8042,8 @@ function parseEntry(raw, codec) {
     return;
   if ("disabledReason" in raw && typeof raw.disabledReason !== "string")
     return;
-  if ("quota" in raw && !codec.validate(raw.quota))
+  const quota = "quota" in raw && codec.decode ? codec.decode(raw.quota) : raw.quota;
+  if ("quota" in raw && !codec.validate(quota))
     return;
   if ("staged" in raw && !parseReservation(raw.staged))
     return;
@@ -8050,7 +8051,7 @@ function parseEntry(raw, codec) {
     credentialEpoch: epoch,
     needsFirstReading: raw.needsFirstReading === true,
     ...typeof raw.disabledReason === "string" ? { disabledReason: raw.disabledReason } : {},
-    ..."quota" in raw ? { quota: raw.quota } : {}
+    ..."quota" in raw ? { quota } : {}
   };
 }
 function credentialFor(raw, stateEntry) {
@@ -10701,6 +10702,29 @@ function isCreditBudgetEntry(value) {
     return true;
   return value.kind === "reading" && typeof value.reached === "boolean" && optional(value, "remainingPercent", isFiniteNumber) && optional(value, "usedPercent", isFiniteNumber) && optional(value, "resetsAt", isString) && optional(value, "limit", isFiniteNumber) && optional(value, "used", isFiniteNumber) && optional(value, "remaining", isFiniteNumber) && optional(value, "unit", isString);
 }
+function isQuotaCounter(value) {
+  return isRecord6(value) && isFiniteNumber(value.value) && Number.isInteger(value.value) && value.value >= 0 && isFiniteNumber(value.checkedAt);
+}
+function isQuotaCounters(value) {
+  return isRecord6(value) && Object.values(value).every(isQuotaCounter);
+}
+function readQuotaCounters(value) {
+  if (!isRecord6(value))
+    return;
+  const entries = Object.entries(value).filter(([, entry]) => isQuotaCounter(entry));
+  return entries.length === 0 ? undefined : Object.fromEntries(entries);
+}
+function decodeQuotaMap(value) {
+  if (isQuotaMap(value))
+    return value;
+  if (!isRecord6(value))
+    return;
+  const { counters: rawCounters, ...rest } = value;
+  if (!isQuotaMap(rest))
+    return;
+  const counters = readQuotaCounters(rawCounters);
+  return { ...rest, ...counters === undefined ? {} : { counters } };
+}
 function isQuotaMap(value) {
   if (!isRecord6(value) || !Array.isArray(value.limits))
     return false;
@@ -10713,7 +10737,7 @@ function isQuotaMap(value) {
       return false;
     seen.add(key);
   }
-  return optional(value, "budget", isCreditBudgetEntry);
+  return optional(value, "budget", isCreditBudgetEntry) && optional(value, "counters", isQuotaCounters);
 }
 
 // ../../node_modules/@cortexkit/common-auth/dist/quota/merge.js
@@ -10772,7 +10796,7 @@ function isQuotaObservation(value) {
   }
   if (!coverage.every(isObservedPair))
     return false;
-  return value.budget === undefined || isObservedBudget(value.budget);
+  return (value.budget === undefined || isObservedBudget(value.budget)) && (value.counters === undefined || isQuotaCounters(value.counters));
 }
 function compareEntries(left, right) {
   if (left.scope !== right.scope)
@@ -10788,14 +10812,25 @@ function mergeBudget(stored, observed, checkedAt) {
     return stored;
   return { ...observed, checkedAt };
 }
+function mergeCounters(stored, observed) {
+  const counters = new Map(Object.entries(stored ?? {}));
+  for (const [name, counter] of Object.entries(observed ?? {})) {
+    const existing = counters.get(name);
+    if (existing === undefined || counter.checkedAt >= existing.checkedAt) {
+      counters.set(name, counter);
+    }
+  }
+  return counters.size === 0 ? undefined : Object.fromEntries(counters);
+}
 function mergeQuotaObservation(stored, observation) {
-  if (stored !== undefined && !isQuotaMap(stored)) {
+  const decoded = stored === undefined ? undefined : decodeQuotaMap(stored);
+  if (stored !== undefined && decoded === undefined) {
     throw new QuotaCodecError("stored quota map is malformed");
   }
   if (!isQuotaObservation(observation)) {
     throw new QuotaCodecError("quota observation is malformed");
   }
-  const base = stored ?? { limits: [] };
+  const base = decoded ?? { limits: [] };
   const at = observation.checkedAt;
   const entries = new Map;
   for (const entry of base.limits) {
@@ -10830,18 +10865,21 @@ function mergeQuotaObservation(stored, observation) {
     const existing = entries.get(key);
     entries.set(key, existing === undefined || existing.kind === "absent" ? { scope, label: pair.label, kind: "absent", checkedAt: at } : { scope, label: pair.label, kind: "retired", retiredAt: at });
   }
-  const { limits: _limits, budget: _budget, ...unknownKeys } = base;
+  const { limits: _limits, budget: _budget, counters: _counters, ...unknownKeys } = base;
   const budget = mergeBudget(base.budget, observation.budget, at);
+  const counters = mergeCounters(base.counters, observation.counters);
   return {
     ...unknownKeys,
     limits: [...entries.values()].sort(compareEntries),
-    ...budget === undefined ? {} : { budget }
+    ...budget === undefined ? {} : { budget },
+    ...counters === undefined ? {} : { counters }
   };
 }
 
 // ../../node_modules/@cortexkit/common-auth/dist/quota/codec.js
 var quotaCodec = Object.freeze({
   validate: isQuotaMap,
+  decode: decodeQuotaMap,
   merge: mergeQuotaObservation
 });
 // ../../node_modules/@cortexkit/common-auth/dist/quota/format.js
@@ -13305,11 +13343,103 @@ function logCommittedNativeAccountAdded(account) {
 
 // ../../node_modules/@cortexkit/common-auth/dist/claustrum/index.js
 import { ClaustrumClient } from "@cortexkit/claustrum-client";
+
+// ../../node_modules/@cortexkit/common-auth/dist/claustrum/insula.js
+import { resolve as resolve4 } from "node:path";
+import { storeIdentity } from "@cortexkit/claustrum-client";
+import { SubcClient } from "@cortexkit/subc-client";
+var MINUTE = 60000;
+var MAX_AGE = 4 * MINUTE;
+var sources = new Map;
+var attempts = new Map;
+function record7(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+class InsulaQuotaSource {
+  transport;
+  key;
+  #entries = [];
+  #pending;
+  constructor(transport, key) {
+    this.transport = transport;
+    this.key = key;
+  }
+  refresh(now) {
+    if (this.#pending)
+      return this.#pending;
+    for (const [key, time4] of attempts) {
+      if (now - time4 >= MINUTE)
+        attempts.delete(key);
+    }
+    const lastAttempt = attempts.get(this.key);
+    if (lastAttempt !== undefined && now - lastAttempt < MINUTE)
+      return Promise.resolve();
+    attempts.set(this.key, now);
+    this.#pending = (async () => {
+      try {
+        const reply = await this.transport.getUsage();
+        if (!record7(reply) || !Array.isArray(reply.result) || reply.error !== undefined)
+          throw new Error("unavailable insula usage");
+        this.#entries = reply.result.filter((entry2) => record7(entry2) && typeof entry2.provider === "string");
+      } catch {
+        this.#entries = [];
+      }
+    })().finally(() => {
+      this.#pending = undefined;
+    });
+    return this.#pending;
+  }
+  current(provider, accountId, now) {
+    for (const entry2 of this.#entries) {
+      if (entry2.provider !== provider || typeof entry2.account !== "string" || entry2.account.trim() !== accountId)
+        continue;
+      if (entry2.stale !== undefined || entry2.errorClass !== undefined || !record7(entry2.usage))
+        continue;
+      const fetchedAt = typeof entry2.fetchedAt === "string" ? Date.parse(entry2.fetchedAt) : Number.NaN;
+      if (!Number.isFinite(fetchedAt) || now - fetchedAt >= MAX_AGE)
+        continue;
+      return {
+        entry: entry2,
+        context: {
+          fetchedAt,
+          ...typeof entry2.source === "string" && { source: entry2.source }
+        }
+      };
+    }
+    return;
+  }
+}
+function acquireInsulaQuotaSource(transport, tokenPath) {
+  const key = JSON.stringify([
+    resolve4(transport.connectionFile),
+    resolve4(tokenPath)
+  ]);
+  let shared = sources.get(key);
+  if (!shared) {
+    shared = { source: new InsulaQuotaSource(transport, key), refs: 0 };
+    sources.set(key, shared);
+  }
+  shared.refs++;
+  let released = false;
+  return {
+    source: shared.source,
+    release() {
+      if (released)
+        return;
+      released = true;
+      if (--shared.refs === 0)
+        sources.delete(key);
+    }
+  };
+}
+
+// ../../node_modules/@cortexkit/common-auth/dist/claustrum/index.js
 import { ClaustrumCredentialError as ClaustrumCredentialError4 } from "@cortexkit/claustrum-client";
 // ../../node_modules/@cortexkit/common-auth/dist/logger/engine.js
 import { appendFileSync as appendFileSync2, chmodSync, existsSync as existsSync2, renameSync as renameSync2, statSync as statSync3 } from "node:fs";
 import { open as open5 } from "node:fs/promises";
-import { dirname as dirname7, resolve as resolve4 } from "node:path";
+import { dirname as dirname7, resolve as resolve5 } from "node:path";
 
 // ../../node_modules/@cortexkit/common-auth/dist/logger/redact.js
 var SECRET_KEY_EXACT2 = /^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i;
@@ -13432,7 +13562,7 @@ async function openWindowsFile(sink, file) {
   return sink.handle;
 }
 async function flushWindowsFile(sink, file, text4) {
-  file = resolve4(file);
+  file = resolve5(file);
   try {
     if (sink.file !== file)
       await closeWindowsFile(sink);
@@ -13685,7 +13815,7 @@ import { ClaustrumCredentialError as ClaustrumCredentialError3 } from "@cortexki
 import { createHash as createHash11, randomBytes as randomBytes4, randomUUID as randomUUID11 } from "node:crypto";
 import { constants as fsConstants2 } from "node:fs";
 import { chmod as chmod2, mkdir as mkdir8, open as open6, readFile as readFile8, realpath as realpath2, rename as rename9, stat as stat4, unlink as unlink4 } from "node:fs/promises";
-import { basename as basename3, dirname as dirname8, extname as extname2, isAbsolute as isAbsolute3, join as join9, resolve as resolve5 } from "node:path";
+import { basename as basename3, dirname as dirname8, extname as extname2, isAbsolute as isAbsolute3, join as join9, resolve as resolve6 } from "node:path";
 import { ClaustrumCredentialError as ClaustrumCredentialError2, ClaustrumClient as ClaustrumWireClient2, writeEnrollmentTokenFile as writeEnrollmentTokenFile2 } from "@cortexkit/claustrum-client";
 
 // ../../node_modules/@cortexkit/common-auth/dist/claustrum/errors.js
@@ -14361,8 +14491,8 @@ function accessTokenFromMaterial(material) {
     }
     if (!parsed || typeof parsed !== "object")
       throw invalidMaterial();
-    const record7 = parsed;
-    const value = record7.access_token ?? record7.access;
+    const record8 = parsed;
+    const value = record8.access_token ?? record8.access;
     access = typeof value === "string" ? value : "";
   }
   if (!/^[\x21-\x7e]+$/.test(access) || access.startsWith(CUSTODY_PLACEHOLDER_PREFIX)) {
@@ -14489,8 +14619,8 @@ class ClaustrumScopedCustody {
         ...row.orgName !== undefined && { orgName: row.orgName }
       }));
     }
-    for (const record7 of skipped)
-      this.#logger.warn("skipped malformed vault record", record7);
+    for (const record8 of skipped)
+      this.#logger.warn("skipped malformed vault record", record8);
     return {
       view: inventory.view,
       credentials: Object.freeze(credentials),
@@ -14640,8 +14770,8 @@ function projectVaultRoster(previous, inventory, options = {}) {
   const declined = [...previous?.declined ?? []];
   const complete = inventory.skipped.length === 0;
   const listed = new Set(inventory.credentials.map((credential2) => credential2.credentialId));
-  const rejectedIds = new Set(inventory.skipped.flatMap((record7) => record7.credentialId === undefined ? [] : [record7.credentialId]));
-  const unrecoverable = inventory.skipped.some((record7) => record7.credentialId === undefined);
+  const rejectedIds = new Set(inventory.skipped.flatMap((record8) => record8.credentialId === undefined ? [] : [record8.credentialId]));
+  const unrecoverable = inventory.skipped.some((record8) => record8.credentialId === undefined);
   const unaccounted = (id2) => !listed.has(id2) && (rejectedIds.has(id2) || unrecoverable);
   const lastKnown = new Map;
   for (const row of previousRows) {
@@ -14748,11 +14878,11 @@ function projectVaultRoster(previous, inventory, options = {}) {
     view: inventory.view,
     complete,
     ...!complete && {
-      rejected: inventory.skipped.map((record7) => ({
-        ...record7.credentialId !== undefined && {
-          credentialId: record7.credentialId
+      rejected: inventory.skipped.map((record8) => ({
+        ...record8.credentialId !== undefined && {
+          credentialId: record8.credentialId
         },
-        reason: record7.reason
+        reason: record8.reason
       }))
     },
     rows: projected.map((entry2) => entry2.row),
@@ -14773,9 +14903,13 @@ function optionalString2(value) {
   return value === undefined || typeof value === "string";
 }
 function decodeRow(value) {
-  if (!isRecord9(value) || typeof value.routeId !== "string" || typeof value.credentialId !== "string" || value.credentialType !== "oauth" && value.credentialType !== "api_key" || typeof value.state !== "string" || typeof value.label !== "string" || typeof value.enabled !== "boolean" || typeof value.addedAt !== "number" || !optionalString2(value.accountIdentity) || !optionalString2(value.email) || !optionalString2(value.orgName) || value.aliases !== undefined && (!Array.isArray(value.aliases) || !value.aliases.every((alias) => typeof alias === "string")) || value.quota !== undefined && !isQuotaMap(value.quota) || value.stale !== undefined && value.stale !== true || value.unclaimed !== undefined && value.unclaimed !== true)
+  const quota2 = isRecord9(value) ? decodeQuotaMap(value.quota) : undefined;
+  if (!isRecord9(value) || typeof value.routeId !== "string" || typeof value.credentialId !== "string" || value.credentialType !== "oauth" && value.credentialType !== "api_key" || typeof value.state !== "string" || typeof value.label !== "string" || typeof value.enabled !== "boolean" || typeof value.addedAt !== "number" || !optionalString2(value.accountIdentity) || !optionalString2(value.email) || !optionalString2(value.orgName) || value.aliases !== undefined && (!Array.isArray(value.aliases) || !value.aliases.every((alias) => typeof alias === "string")) || value.quota !== undefined && quota2 === undefined || value.stale !== undefined && value.stale !== true || value.unclaimed !== undefined && value.unclaimed !== true)
     return;
-  return value;
+  return {
+    ...value,
+    ...quota2 === undefined ? {} : { quota: quota2 }
+  };
 }
 var SKIPPED_REASONS = new Set([
   "empty credential id",
@@ -14920,6 +15054,21 @@ function recordVaultQuota(path2, input) {
     };
   });
 }
+function recordVaultAccountQuota(path2, input) {
+  return mutateVaultRoster(path2, (current) => {
+    const row = current?.rows.find((entry2) => entry2.routeId === input.routeId);
+    if (!current || !row || row.accountIdentity === undefined || row.accountIdentity !== input.accountIdentity)
+      return { result: false };
+    const quota2 = mergeQuotaObservation(row.quota, input.observation);
+    return {
+      next: {
+        ...current,
+        rows: current.rows.map((entry2) => entry2 === row ? { ...entry2, quota: quota2 } : entry2)
+      },
+      result: true
+    };
+  });
+}
 async function refreshVaultRoster(options) {
   options.signal?.throwIfAborted();
   const active = async () => await options.isActive?.() ?? true;
@@ -14966,6 +15115,7 @@ class ClaustrumConsumer {
   #roster;
   #timer;
   #started = false;
+  #insula;
   constructor(options) {
     this.#options = options;
     this.#logger = options.logger ?? createLogger("claustrum");
@@ -14982,7 +15132,7 @@ class ClaustrumConsumer {
       this.#shutdown.signal,
       ...signal ? [signal] : []
     ]);
-    return new Promise((resolve6, reject) => {
+    return new Promise((resolve7, reject) => {
       const cleanup2 = () => {
         combined.signal.removeEventListener("abort", abort);
         combined.dispose();
@@ -14997,7 +15147,7 @@ class ClaustrumConsumer {
         if (combined.signal.aborted)
           reject(combined.signal.reason);
         else
-          resolve6(value);
+          resolve7(value);
       }, (error) => {
         cleanup2();
         reject(error);
@@ -15025,6 +15175,9 @@ class ClaustrumConsumer {
           now: this.#options.now,
           logger: this.#logger
         });
+        if (this.#options.insula && client.insula) {
+          this.#insula = acquireInsulaQuotaSource(client.insula, this.#options.tokenPath);
+        }
         return this.#custody;
       }).finally(() => {
         this.#connecting = undefined;
@@ -15047,6 +15200,8 @@ class ClaustrumConsumer {
         this.#roster = undefined;
         this.#custody?.close();
         this.#custody = undefined;
+        this.#insula?.release();
+        this.#insula = undefined;
         return;
       }
       const custody = await this.#getCustody();
@@ -15081,6 +15236,7 @@ class ClaustrumConsumer {
     const tick = async () => {
       try {
         await this.refresh();
+        await this.refreshInsulaQuota();
       } catch (error) {
         if (!this.#shutdown.signal.aborted)
           this.#options.onError?.(error);
@@ -15098,6 +15254,43 @@ class ClaustrumConsumer {
     };
     tick();
   }
+  async refreshInsulaQuota() {
+    if (!this.#options.insula || this.#shutdown.signal.aborted || !await this.#active())
+      return;
+    try {
+      await readClaustrumEnrollmentToken2(this.#options.tokenPath);
+      await this.#getCustody();
+      await this.#insula?.source.refresh((this.#options.now ?? Date.now)());
+    } catch {}
+  }
+  async cachedInsulaQuota(receipt) {
+    if (!this.#options.insula || this.#shutdown.signal.aborted || !await this.#active())
+      return;
+    try {
+      await readClaustrumEnrollmentToken2(this.#options.tokenPath);
+      return this.#normalizeInsulaQuota(receipt.assertedAccountIdentity);
+    } catch {
+      return;
+    }
+  }
+  async cachedInsulaQuotaForRoute(routeId) {
+    if (!this.#options.insula || this.#shutdown.signal.aborted || !await this.#active())
+      return;
+    try {
+      await readClaustrumEnrollmentToken2(this.#options.tokenPath);
+      const roster = await readVaultRoster(this.#options.rosterPath);
+      const row = roster?.rows.find((entry2) => entry2.routeId === routeId);
+      return this.#normalizeInsulaQuota(row?.accountIdentity);
+    } catch {
+      return;
+    }
+  }
+  #normalizeInsulaQuota(accountIdentity) {
+    if (!this.#options.insula || !accountIdentity)
+      return;
+    const current = this.#insula?.source.current(this.#options.insula.provider, accountIdentity, (this.#options.now ?? Date.now)());
+    return current ? this.#options.insula.normalize(current.entry, current.context) : undefined;
+  }
   async authorize(routeId, signal) {
     this.#assertOpen(signal);
     const roster = this.#roster ?? await this.#wait(this.refresh(), signal);
@@ -15186,6 +15379,17 @@ class ClaustrumConsumer {
       this.#roster = await readVaultRoster(this.#options.rosterPath);
     return kept;
   }
+  async recordAccountQuota(routeId, accountIdentity, observation) {
+    this.#assertOpen();
+    const kept = await recordVaultAccountQuota(this.#options.rosterPath, {
+      routeId,
+      accountIdentity,
+      observation
+    });
+    if (kept)
+      this.#roster = await readVaultRoster(this.#options.rosterPath);
+    return kept;
+  }
   close() {
     if (this.#shutdown.signal.aborted)
       return;
@@ -15194,6 +15398,8 @@ class ClaustrumConsumer {
       (this.#options.clearTimeoutImpl ?? clearTimeout)(this.#timer);
     this.#timer = undefined;
     this.#custody?.close();
+    this.#insula?.release();
+    this.#insula = undefined;
     this.#roster = undefined;
   }
 }
@@ -15715,7 +15921,7 @@ function createNativeRefreshCoordinator(options) {
           name: spec.name,
           timeoutMs: POOL_LOCK_DEFAULTS.timeoutMs
         });
-      await new Promise((resolve6) => setTimeout(resolve6, Math.min(POOL_LOCK_DEFAULTS.retryMs, remaining)));
+      await new Promise((resolve7) => setTimeout(resolve7, Math.min(POOL_LOCK_DEFAULTS.retryMs, remaining)));
     }
   }
   async function run(job, request) {
@@ -16579,6 +16785,7 @@ async function requireNativePoolAuthority(paths) {
   if (!nativeMigrationAuthorityPhase(journal)) {
     throw new NativeAuthorityError("migration-incomplete");
   }
+  return journal;
 }
 function deepFreeze(value) {
   if (value === null || typeof value !== "object")
@@ -16929,7 +17136,7 @@ function createNativeLocalCredentialService(options) {
 }
 
 // src/native-runtime-registry.ts
-import { resolve as resolve6 } from "node:path";
+import { resolve as resolve7 } from "node:path";
 var identities = new WeakMap;
 var nextIdentity = 0;
 function nativeRuntimeOptionIdentity(value) {
@@ -16958,14 +17165,14 @@ function nativeRuntimeStorageKey(options) {
       "runtime",
       "journal",
       "roster"
-    ].map((field) => resolve6(paths[field])),
-    resolve6(enrollment.tokenPath),
-    resolve6(enrollment.statePath),
-    resolve6(connection)
+    ].map((field) => resolve7(paths[field])),
+    resolve7(enrollment.tokenPath),
+    resolve7(enrollment.statePath),
+    resolve7(connection)
   ]);
 }
 function nativeRuntimeConnectionFile(host, env) {
-  return resolve6(resolveClaustrumConnectionPath(host === "pi" ? env.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE : undefined, host === "pi" ? {
+  return resolve7(resolveClaustrumConnectionPath(host === "pi" ? env.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE : undefined, host === "pi" ? {
     ...env,
     OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE: undefined
   } : env));
@@ -17082,12 +17289,12 @@ async function joinNativePoolWrite(paths, signals, check, now = Date.now) {
 function pause(ms, signals) {
   if (signals.some((signal) => signal.aborted))
     return Promise.resolve();
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const wake = () => {
       clearTimeout(timer);
       for (const signal of signals)
         signal.removeEventListener("abort", wake);
-      resolve7();
+      resolve8();
     };
     const timer = setTimeout(wake, ms);
     for (const signal of signals)
@@ -17218,12 +17425,12 @@ function expectedSeed(input, boundary, refuse3) {
   const inventory = capture(top("inventory", "roster-incomplete"), ["view", "credentials", "skipped"], "roster-incomplete", refuse3);
   const view = inventory.view;
   const skipped = items(inventory.skipped, "roster-incomplete", refuse3);
-  const credentialRecords = items(inventory.credentials, "roster-incomplete", refuse3).map((record7) => capture(record7, ["credentialId", "credentialType", "accountIdentity", "state"], "roster-incomplete", refuse3));
+  const credentialRecords = items(inventory.credentials, "roster-incomplete", refuse3).map((record8) => capture(record8, ["credentialId", "credentialType", "accountIdentity", "state"], "roster-incomplete", refuse3));
   if (!filled(view) || skipped.length > 0)
     refuse3("roster-incomplete");
   const listed = new Map;
-  for (const record7 of credentialRecords) {
-    const { credentialId, credentialType, accountIdentity, state } = record7;
+  for (const record8 of credentialRecords) {
+    const { credentialId, credentialType, accountIdentity, state } = record8;
     if (!filled(credentialId) || !filled(accountIdentity) || !filled(state) || listed.has(credentialId)) {
       refuse3("roster-incomplete");
     }
@@ -17234,7 +17441,7 @@ function expectedSeed(input, boundary, refuse3) {
   const primaryIdentity = primary.accountIdentity;
   boundary.fallback = "seed-conflict";
   const primaryRouteId = top("primaryRouteId", "seed-conflict");
-  const legacyRecords = items(top("legacyRows", "seed-conflict"), "seed-conflict", refuse3).map((record7) => capture(record7, [
+  const legacyRecords = items(top("legacyRows", "seed-conflict"), "seed-conflict", refuse3).map((record8) => capture(record8, [
     "routeId",
     "scopedCredentialId",
     "anthropicAccountUuid",
@@ -18022,7 +18229,7 @@ function recencyOnly(patch) {
   return keys4.length === 1 && keys4[0] === "lastUsed" && typeof patch.lastUsed === "number";
 }
 function waitFor(pending, signal) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const abort = () => {
       cleanup2();
       reject(signal.reason);
@@ -18031,7 +18238,7 @@ function waitFor(pending, signal) {
     signal.addEventListener("abort", abort, { once: true });
     pending.then((value) => {
       cleanup2();
-      signal.aborted ? reject(signal.reason) : resolve7(value);
+      signal.aborted ? reject(signal.reason) : resolve8(value);
     }, (error) => {
       cleanup2();
       reject(error);
@@ -18348,6 +18555,7 @@ function stickyRetryAfterWithJitter(sessionId, retryAfterSeconds) {
   const hash2 = createHash16("sha256").update(sessionId).digest().readUInt32BE(0);
   return Math.max(1, Math.ceil(retryAfterSeconds)) + hash2 % 21;
 }
+var localRecoveries = new Map;
 
 class StickySessionRouter {
   options;
@@ -18408,7 +18616,7 @@ class StickySessionRouter {
     this.stateMtimeNs = await this.readStateMtimeNs();
     this.loaded = true;
   }
-  async acquireLock() {
+  async acquireLock(wait = true) {
     await mkdir9(dirname10(this.options.path), { recursive: true, mode: 448 });
     const deadline = this.now() + STICKY_ROUTING_LOCK_WAIT_MS;
     while (true) {
@@ -18420,10 +18628,53 @@ class StickySessionRouter {
       });
       if (lock)
         return lock;
-      if (this.now() >= deadline) {
+      if (!wait || this.now() >= deadline) {
         throw new Error("Timed out acquiring sticky routing state lock");
       }
-      await new Promise((resolve7) => setTimeout(resolve7, STICKY_ROUTING_LOCK_POLL_MS));
+      await new Promise((resolve8) => setTimeout(resolve8, STICKY_ROUTING_LOCK_POLL_MS));
+    }
+  }
+  async recoverLocalPins() {
+    const source2 = this.options.localRecoveryPath;
+    if (!source2 || source2 === this.options.path)
+      return;
+    const key = JSON.stringify([this.options.path, source2]);
+    let recovery = localRecoveries.get(key);
+    if (!recovery) {
+      recovery = this.fillLocalPins(source2).catch(() => {
+        logger.warn("sticky-routing", "local pin recovery unavailable", {
+          reason: "recovery-failed"
+        });
+      });
+      localRecoveries.set(key, recovery);
+    }
+    await recovery;
+  }
+  async fillLocalPins(source2) {
+    const lock = await this.acquireLock(false);
+    try {
+      let legacy;
+      try {
+        legacy = normalizeState(JSON.parse(await readFile9(source2, "utf8")));
+      } catch (error) {
+        if (error.code === "ENOENT")
+          return;
+        throw error;
+      }
+      if (!legacy)
+        return;
+      const state = await this.readState();
+      let changed = false;
+      for (const [key, assignment] of Object.entries(legacy.assignments)) {
+        if (!/^[0-9a-f]{64}$/.test(key) || Object.hasOwn(state.assignments, key))
+          continue;
+        state.assignments[key] = assignment;
+        changed = true;
+      }
+      if (changed)
+        await this.writeState(state, () => lock.assertOwned(), false);
+    } finally {
+      await lock.release();
     }
   }
   assignmentIsActive(assignment) {
@@ -18586,6 +18837,7 @@ class StickySessionRouter {
   async resolve(input) {
     if (!input.sessionId)
       return null;
+    await this.recoverLocalPins();
     await this.prepareLegacySeed();
     await this.refreshStateIfChanged();
     const key = sessionKey(input.sessionId);
@@ -18677,6 +18929,7 @@ class StickySessionRouter {
   async clear(sessionId) {
     if (!sessionId)
       return;
+    await this.recoverLocalPins();
     const key = sessionKey(sessionId);
     const lock = await this.acquireLock();
     try {
@@ -18794,11 +19047,12 @@ function createNativeAccountRuntime(options) {
       throw new NativeCustodyError("closed");
     signal?.throwIfAborted();
   }
+  let localRouting;
   async function authority(signal) {
     check(signal);
     let mode = await readNativeEnrollmentMode(options.host, env);
     if (mode === "local") {
-      await requireNativePoolAuthority(paths);
+      localRouting = (await requireNativePoolAuthority(paths)).routingPaths;
       mode = await readNativeEnrollmentMode(options.host, env);
     }
     check(signal);
@@ -18965,6 +19219,10 @@ function createNativeAccountRuntime(options) {
       await vaultRouter.prepareLegacySeed(roster ?? null);
       snapshot.routingPath = vaultPaths.routing;
       snapshot.routingSeed = { ...routingSeed };
+    } else if (localRouting) {
+      snapshot.routingPath = localRouting.destination;
+      if (localRouting.source !== localRouting.destination)
+        snapshot.routingRecoveryPath = localRouting.source;
     }
     return {
       snapshot,
@@ -19769,9 +20027,9 @@ import { dirname as dirname13, isAbsolute as isAbsolute6 } from "node:path";
 // src/pool-paths.ts
 import { createHash as createHash17 } from "node:crypto";
 import { realpath as realpath3 } from "node:fs/promises";
-import { basename as basename6, dirname as dirname12, join as join13, resolve as resolve7 } from "node:path";
+import { basename as basename6, dirname as dirname12, join as join13, resolve as resolve8 } from "node:path";
 async function canonicalPath(path2) {
-  const absolute = resolve7(path2);
+  const absolute = resolve8(path2);
   try {
     return await realpath3(absolute);
   } catch (error) {
@@ -20078,7 +20336,7 @@ async function checkPaths(input, captured) {
     refuse3();
 }
 async function retire(input, journal, assertOwned, hooks) {
-  const sources = [
+  const sources2 = [
     {
       role: "config",
       path: input.legacyConfigPath ?? input.paths.legacyConfig,
@@ -20097,7 +20355,7 @@ async function retire(input, journal, assertOwned, hooks) {
       }
     ]
   ];
-  const snapshots = await Promise.all(sources.map(async (source2) => {
+  const snapshots = await Promise.all(sources2.map(async (source2) => {
     const snapshot = await readNativeMigrationSource(source2.role, source2.path);
     owned(snapshot);
     if (snapshot.data && snapshot.digest !== source2.digest)
@@ -20116,7 +20374,7 @@ async function retire(input, journal, assertOwned, hooks) {
   }
   return advanceNativeMigration(input.paths, "committed", "retired", {
     assertOwned: async () => {
-      for (const source2 of sources)
+      for (const source2 of sources2)
         if (!await absent(source2.path))
           refuse3("retirement-refused");
       await input.processFence();
@@ -21133,8 +21391,8 @@ async function runNativeCustodyActivation(options, hooks = {}) {
 }
 async function commitMode(paths, routingPath, plan, context) {
   let openGate = () => {};
-  const gate = new Promise((resolve8) => {
-    openGate = resolve8;
+  const gate = new Promise((resolve9) => {
+    openGate = resolve9;
   });
   let leases;
   let scope;
@@ -22800,7 +23058,7 @@ function createNativeUsagePublisher(channel) {
   return {
     observe,
     publish(write) {
-      observe(new Promise((resolve8) => setTimeout(resolve8, 0)).then(write));
+      observe(new Promise((resolve9) => setTimeout(resolve9, 0)).then(write));
     },
     async drain() {
       while (pending.size)
@@ -22861,11 +23119,11 @@ async function refreshForRequest(runtime2, ready) {
         break;
       if (combined.aborted)
         break;
-      await new Promise((resolve8) => {
+      await new Promise((resolve9) => {
         const finish = () => {
           clearTimeout(pause2);
           combined.removeEventListener("abort", finish);
-          resolve8();
+          resolve9();
         };
         const pause2 = setTimeout(finish, 25);
         combined.addEventListener("abort", finish, { once: true });
@@ -22881,16 +23139,16 @@ async function refreshForRequest(runtime2, ready) {
 function waitForRequest(pending, signal) {
   if (!signal)
     return pending;
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const abort = () => reject(signal.reason);
     signal.addEventListener("abort", abort, { once: true });
-    pending.then(resolve8, reject).finally(() => signal.removeEventListener("abort", abort));
+    pending.then(resolve9, reject).finally(() => signal.removeEventListener("abort", abort));
     if (signal.aborted)
       abort();
   });
 }
 // src/native-vault-connection.ts
-import { dirname as dirname15, join as join14, resolve as resolve9 } from "node:path";
+import { dirname as dirname15, join as join14, resolve as resolve10 } from "node:path";
 // ../../node_modules/@cortexkit/common-auth/dist/opencode2/integration.js
 var PLACEHOLDER_PREFIX = "common-auth-placeholder";
 var PLACEHOLDER_LIFETIME_MS = 365 * 24 * 60 * 60 * 1000;
@@ -22901,7 +23159,7 @@ function placeholderSecret(integrationID) {
 import { createHash as createHash19 } from "node:crypto";
 import { constants as constants3 } from "node:fs";
 import { lstat as lstat8, mkdir as mkdir12, open as open9, unlink as unlink7 } from "node:fs/promises";
-import { dirname as dirname14, resolve as resolve8 } from "node:path";
+import { dirname as dirname14, resolve as resolve9 } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 
 // ../../node_modules/@cortexkit/common-auth/dist/pi-slot/lock.js
@@ -23288,8 +23546,8 @@ function createPiSlot(options, onStep, hooks) {
   if (!provider || !options.authPath || !options.stashPath || !placeholderKey || placeholderKey.startsWith("!") || placeholderKey.includes("$") || !Number.isFinite(timeout) || timeout < 0) {
     throw new PiSlotError("invalid-options");
   }
-  const authPath = resolve8(options.authPath);
-  const stashPath = resolve8(options.stashPath);
+  const authPath = resolve9(options.authPath);
+  const stashPath = resolve9(options.stashPath);
   if (authPath === stashPath || stashPath === `${authPath}.lock`) {
     throw new PiSlotError("invalid-options");
   }
@@ -23427,7 +23685,7 @@ function createPiSlot(options, onStep, hooks) {
 // src/native-vault-connection.ts
 function nativePiAuthSlotPaths(options) {
   return {
-    authPath: resolve9(options.authPath),
+    authPath: resolve10(options.authPath),
     stashPath: join14(dirname15(getHostClaustrumEnrollmentPaths("pi", options.env).tokenPath), "pi-auth-slot", "anthropic.json"),
     provider: "anthropic",
     placeholderKey: placeholderSecret("anthropic")
@@ -23446,7 +23704,7 @@ import { createHash as createHash20 } from "node:crypto";
 import { realpathSync } from "node:fs";
 import { mkdir as mkdir13, readdir as readdir3, rm as rm7, stat as stat7, writeFile as writeFile6 } from "node:fs/promises";
 import { tmpdir as tmpdir5 } from "node:os";
-import { join as join15, resolve as resolve10 } from "node:path";
+import { join as join15, resolve as resolve11 } from "node:path";
 var CLAUDE_PRIME_COMMAND_NAME = "claude-prime";
 var PRIME_TICK_MS = 60000;
 var PRIME_DUE_OFFSET_MS = 60000;
@@ -23637,7 +23895,7 @@ function defaultMarkerDir() {
   return join15(tmpdir5(), "opencode-anthropic-auth", "prime");
 }
 function primeStorageFingerprint(storagePath) {
-  const absolutePath = resolve10(storagePath);
+  const absolutePath = resolve11(storagePath);
   let canonicalPath2;
   try {
     canonicalPath2 = realpathSync(absolutePath);
@@ -24317,9 +24575,9 @@ class QuotaHeaderFeedRegistry {
       await this.reapStaleSiblingLeases(directory);
       let entries = {};
       try {
-        const record7 = JSON.parse(await readFile10(this.filePath, "utf8"));
-        if (record7.version === QUOTA_HEADER_FEED_SCHEMA_VERSION && record7.entries && typeof record7.entries === "object")
-          entries = record7.entries;
+        const record8 = JSON.parse(await readFile10(this.filePath, "utf8"));
+        if (record8.version === QUOTA_HEADER_FEED_SCHEMA_VERSION && record8.entries && typeof record8.entries === "object")
+          entries = record8.entries;
       } catch {}
       entries[accountKey] = cleanEntry;
       const tempPath = `${this.filePath}.${randomUUID16()}.tmp`;
@@ -24373,10 +24631,10 @@ class QuotaHeaderFeedRegistry {
     const newest = new Map;
     await Promise.all(names2.map(async (name) => {
       try {
-        const record7 = JSON.parse(await readFile10(join16(directory, name), "utf8"));
-        if (record7.version !== QUOTA_HEADER_FEED_SCHEMA_VERSION || !record7.entries || typeof record7.entries !== "object")
+        const record8 = JSON.parse(await readFile10(join16(directory, name), "utf8"));
+        if (record8.version !== QUOTA_HEADER_FEED_SCHEMA_VERSION || !record8.entries || typeof record8.entries !== "object")
           return;
-        for (const [accountKey, candidate] of Object.entries(record7.entries)) {
+        for (const [accountKey, candidate] of Object.entries(record8.entries)) {
           if (!candidate || typeof candidate !== "object" || candidate.schema_version !== QUOTA_HEADER_FEED_SCHEMA_VERSION || candidate.provider !== "anthropic" || !validIdentity(candidate))
             continue;
           const observed = candidate.observed_at_ms;
@@ -24946,8 +25204,8 @@ class QuotaManager {
       if (this.lastApiCallAt !== undefined) {
         const remaining = QuotaManager.API_CALL_GAP_MS - (this.now() - this.lastApiCallAt);
         if (remaining > 0)
-          await new Promise((resolve11) => {
-            const id2 = nativeSetTimeout(resolve11, remaining);
+          await new Promise((resolve12) => {
+            const id2 = nativeSetTimeout(resolve12, remaining);
             if (typeof id2 === "object" && "unref" in id2)
               id2.unref();
           });
@@ -25850,7 +26108,7 @@ class PersistentRelaySession {
       return;
     if (this.connecting)
       return await this.connecting;
-    this.connecting = new Promise((resolve11, reject) => {
+    this.connecting = new Promise((resolve12, reject) => {
       const url = toWebSocketUrl(this.config.url, this.config.token);
       const parsed = new URL(url);
       parsed.searchParams.set("affinity", this.affinity);
@@ -25872,7 +26130,7 @@ class PersistentRelaySession {
           if (message.type === "ready") {
             this.timers.clearTimeout(timeout);
             this.serverState = message.state;
-            resolve11();
+            resolve12();
             return;
           }
           this.handleMessage(message);
@@ -25924,15 +26182,15 @@ class PersistentRelaySession {
     const sentAt = perfNowMs();
     let resolveDone;
     let rejectDone;
-    const done2 = new Promise((resolve11, reject) => {
-      resolveDone = resolve11;
+    const done2 = new Promise((resolve12, reject) => {
+      resolveDone = resolve12;
       rejectDone = reject;
     });
-    const response = new Promise((resolve11, reject) => {
+    const response = new Promise((resolve12, reject) => {
       const pending = {
         payload,
         bodyText,
-        resolve: resolve11,
+        resolve: resolve12,
         reject,
         streamDone: false,
         accepted: false,

package/dist/internal-types/quota/codec.d.ts

@@ -1,5 +1,7 @@
 export interface QuotaCodec {
     readonly validate: (value: unknown) => boolean;
+    /** Normalize persisted data before validation; older codecs may omit this. */
+    readonly decode?: (value: unknown) => unknown;
     readonly merge: (stored: unknown, observation: unknown) => unknown;
 }
 /**

package/dist/internal-types/quota/index.d.ts

@@ -2,8 +2,8 @@ export type { QuotaCodec } from './codec.js';
 export { quotaCodec } from './codec.js';
 export type { QuotaTextForm, QuotaTextOptions } from './format.js';
 export { formatQuota, NO_LIMITS_REPORTED, NO_QUOTA_READING, QUOTA_STALE_AFTER_MS, quotaTextParts, quotaWindowName, } from './format.js';
-export type { CreditBudgetCleared, CreditBudgetEntry, CreditBudgetReading, QuotaAbsentEntry, QuotaEntry, QuotaMap, QuotaReadingEntry, QuotaRetiredEntry, } from './map.js';
-export { ALL_SCOPE, DEFAULT_REQUIRED_LABELS, emptyQuotaMap, isQuotaMap, } from './map.js';
+export type { CreditBudgetCleared, CreditBudgetEntry, CreditBudgetReading, QuotaAbsentEntry, QuotaCounter, QuotaEntry, QuotaMap, QuotaReadingEntry, QuotaRetiredEntry, } from './map.js';
+export { ALL_SCOPE, DEFAULT_REQUIRED_LABELS, decodeQuotaMap, emptyQuotaMap, isQuotaMap, } from './map.js';
 export type { ObservedBudget, ObservedPair, ObservedReading, QuotaObservation, } from './merge.js';
 export { isQuotaObservation, mergeQuotaObservation, QuotaCodecError, } from './merge.js';
 export type { ExhaustionReset, ProjectedBudget, ProjectedLimit, ProjectedQuota, } from './projection.js';

package/dist/internal-types/quota/map.d.ts

@@ -44,16 +44,27 @@ export interface CreditBudgetCleared {
     checkedAt: number;
 }
 export type CreditBudgetEntry = CreditBudgetReading | CreditBudgetCleared;
+export interface QuotaCounter {
+    value: number;
+    checkedAt: number;
+}
 export interface QuotaMap {
     limits: QuotaEntry[];
     /** Absent means no observation has reported on the budget yet. */
     budget?: CreditBudgetEntry;
+    /** Provider-named counts, each with its own observation time. */
+    counters?: Record<string, QuotaCounter>;
 }
 export declare function emptyQuotaMap(): QuotaMap;
 /** The time an entry speaks for: its reading, retirement or absence time. */
 export declare function entryTime(entry: QuotaEntry): number;
 export declare function limitKey(scope: string, label: string): string;
 export declare function isCreditBudgetEntry(value: unknown): value is CreditBudgetEntry;
+export declare function isQuotaCounters(value: unknown): value is Record<string, QuotaCounter>;
+/** Keep usable counters without letting one malformed count hide a quota map. */
+export declare function readQuotaCounters(value: unknown): Record<string, QuotaCounter> | undefined;
+/** Decode persisted quota, dropping malformed counters but not limit evidence. */
+export declare function decodeQuotaMap(value: unknown): QuotaMap | undefined;
 /**
  * True when `value` is a well-formed quota map. Unrecognised top-level keys
  * are tolerated (and preserved by merge) so a newer writer's additions

package/dist/internal-types/quota/merge.d.ts

@@ -1,4 +1,4 @@
-import { type QuotaMap } from './map.js';
+import { type QuotaCounter, type QuotaMap } from './map.js';
 export interface ObservedReading {
     /** Defaults to `all`. */
     scope?: string;
@@ -32,6 +32,8 @@ export interface QuotaObservation {
     coverage?: ObservedPair[];
     /** Absent means the observation says nothing about the budget. */
     budget?: ObservedBudget;
+    /** Each named count uses its own time, independently of limits and budget. */
+    counters?: Record<string, QuotaCounter>;
 }
 /** Thrown by `mergeQuotaObservation` when either argument is malformed. */
 export declare class QuotaCodecError extends TypeError {

package/dist/internal-types/quota/projection.d.ts

@@ -1,4 +1,4 @@
-import { type QuotaMap } from './map.js';
+import { type QuotaCounter, type QuotaMap } from './map.js';
 export interface ProjectedLimit {
     scope: string;
     label: string;
@@ -30,6 +30,7 @@ export interface ProjectedQuota {
     checkedAt?: number;
     /** Present only when the stored budget is a reading, not cleared. */
     budget?: ProjectedBudget;
+    counters?: Record<string, QuotaCounter>;
 }
 /**
  * Resolves `map` for a request in `scope` (`all` or a model family). A family

package/dist/internal-types/store/schema.d.ts

@@ -49,6 +49,8 @@ export type StoredCredential = (OAuthCredential & {
 /** Quota codec supplied by `/quota`: the store never interprets the map itself. */
 export interface QuotaCodec {
     validate(value: unknown): boolean;
+    /** Normalize persisted quota before validation, when the codec supports it. */
+    decode?(value: unknown): unknown;
     merge(stored: unknown | undefined, observation: unknown): unknown;
 }
 /**

package/dist/native-account-view.d.ts

@@ -42,8 +42,10 @@ export interface NativeAccountSnapshot {
     mode: 'local' | 'claustrum';
     settings: Record<string, unknown>;
     accounts: NativeAccountView[];
-    /** Vault session-to-account assignments use this separate file. Local mode keeps the assignment file at the destination recorded by migration. */
+    /** Vault storage, or the local destination recorded by the authorized migration journal. */
     routingPath?: string;
+    /** Distinct pre-migration routing file that OpenCode local serving may have recreated. */
+    routingRecoveryPath?: string;
     routingSeed?: NativeVaultRoutingSeed;
     /** AccountStorage-shaped input for pure policy predicates, never a credential or persistence authority. */
     policyStorage: AccountStorage;

package/dist/pool-authority.d.ts

@@ -126,7 +126,7 @@ export declare function readNativeMigrationJournal(paths: NativePoolPaths): Prom
  */
 export declare function nativeMigrationAuthorityPhase(journal: NativeMigrationJournal | undefined): 'committed' | 'retired' | undefined;
 /** An empty or readable store is not proof that the offline authority flip completed. */
-export declare function requireNativePoolAuthority(paths: NativePoolPaths): Promise<void>;
+export declare function requireNativePoolAuthority(paths: NativePoolPaths): Promise<NativeMigrationJournal>;
 interface JournalHooks {
     /** Outer controller and pool leases remain held through the atomic journal rename. */
     assertOwned?: () => Promise<void>;

package/dist/sticky-routing.d.ts

@@ -106,12 +106,15 @@ export declare class StickySessionRouter {
         now?: () => number;
         assignmentTtlMs?: number;
         vaultSeed?: NativeVaultRoutingSeed;
+        localRecoveryPath?: string;
     });
     private now;
     private readState;
     private readStateMtimeNs;
     private refreshStateIfChanged;
     private acquireLock;
+    private recoverLocalPins;
+    private fillLocalPins;
     private assignmentIsActive;
     private prune;
     private writeState;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "type": "module",
   "repository": {
     "type": "git",
@@ -30,11 +30,12 @@
     "prepublishOnly": "bun run build"
   },
   "devDependencies": {
-    "@cortexkit/common-auth": "0.15.0"
+    "@cortexkit/common-auth": "0.17.0"
   },
   "dependencies": {
     "@cortexkit/claustrum-client": "0.9.0",
     "@cortexkit/private-files": "0.2.1",
+    "@cortexkit/subc-client": "^0.16.0",
     "jsonc-parser": "^3.3.1",
     "xxhash-wasm": "^1.1.0"
   }