@cortexkit/anthropic-auth-core 2.1.0 → 2.1.2

package/dist/index.js

@@ -13922,18 +13922,43 @@ function nativeLocalCredentialValidationMatches(validation, binding, material) {
 }
 
 // src/native-lock-observer.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+var detachedLocks = new AsyncLocalStorage2;
+function withDetachedNativeLocks(work) {
+  return detachedLocks.run(true, work);
+}
 function nativeLockObserver(observer) {
   if (!observer)
     return;
   return (event) => {
     try {
-      const result = observer(event);
+      const result = observer(detachedLocks.getStore() ? { ...event, detached: true } : event);
       if (result !== null && (typeof result === "object" || typeof result === "function") && "then" in result && typeof result.then === "function") {
         Promise.resolve(result).catch(() => {});
       }
     } catch {}
   };
 }
+async function withNativeLock(path2, options, run, acquire = withLock) {
+  const observer = nativeLockObserver(options.onLockEvent);
+  if (!observer)
+    return acquire(path2, options, run);
+  observer({ type: "acquiring", name: options.name, path: path2 });
+  let acquired = false;
+  try {
+    return await acquire(path2, options, async (lease) => {
+      acquired = true;
+      observer({ type: "acquired", name: options.name, path: path2 });
+      return run(lease);
+    });
+  } finally {
+    if (acquired)
+      observer({ type: "released", name: options.name, path: path2 });
+  }
+}
+function observeNativeLocks(acquire, observer) {
+  return (path2, options, run) => withNativeLock(path2, { ...options, onLockEvent: options.onLockEvent ?? observer }, run, acquire());
+}
 
 // src/native-vault-seed.ts
 import { lstat as lstat4, readFile as readFile8 } from "node:fs/promises";
@@ -14932,18 +14957,27 @@ async function renameWithWindowsSharingRetry(from, to, options = {}, beforeRetry
 }
 
 // src/native-runtime.ts
+var withLock2 = observeNativeLocks(() => withLock);
+
 class NativeRuntimeError extends Error {
   code;
+  status;
+  retryable;
   constructor(code) {
     super({
       "invalid-runtime": "Anthropic runtime state is invalid",
       "unsafe-runtime": "Anthropic runtime file is not owner-only regular storage",
       "runtime-io": "Anthropic runtime storage is unavailable",
       "runtime-conflict": "Anthropic runtime observation is older than persisted state",
-      "publication-refused": "Anthropic runtime publication was refused"
+      "publication-refused": "Anthropic runtime publication was refused",
+      "relay-inconsistent": "request refused: relay configuration is inconsistent; no request was sent"
     }[code]);
     this.code = code;
     this.name = "NativeRuntimeError";
+    if (code === "relay-inconsistent") {
+      this.status = 400;
+      this.retryable = false;
+    }
   }
 }
 function record6(value) {
@@ -15090,7 +15124,7 @@ function entry(value, id2, storageId) {
   return true;
 }
 function decodeNativeRuntime(value, storageId) {
-  if (!record6(value) || !keys3(value, ["version", "storageId", "accounts"], ["relay"]) || value.version !== 1 || !digest(storageId) || value.storageId !== storageId || !record6(value.accounts) || !optional3(value, "relay", (entry2) => record6(entry2) && keys3(entry2, ["token"]) && typeof entry2.token === "string"))
+  if (!record6(value) || !keys3(value, ["version", "storageId", "accounts"], ["relay", "relayGeneration"]) || value.version !== 1 || !digest(storageId) || value.storageId !== storageId || !record6(value.accounts) || !optional3(value, "relayGeneration", text3) || !optional3(value, "relay", (entry2) => record6(entry2) && keys3(entry2, ["token"]) && typeof entry2.token === "string"))
     throw new NativeRuntimeError("invalid-runtime");
   const accounts = Object.create(null);
   for (const [id2, item] of Object.entries(value.accounts)) {
@@ -15102,6 +15136,7 @@ function decodeNativeRuntime(value, storageId) {
     version: 1,
     storageId,
     accounts,
+    ...typeof value.relayGeneration === "string" ? { relayGeneration: value.relayGeneration } : {},
     ...record6(value.relay) && typeof value.relay.token === "string" ? { relay: { token: value.relay.token } } : {}
   };
 }
@@ -15218,7 +15253,8 @@ async function updateNativeRuntime(path2, storageId, change, hooks = {}) {
 async function updateNativeRuntimeOptional(path2, storageId, change, hooks) {
   return writeNativeRuntimeOutcome(path2, storageId, change, {
     beforeRename: hooks.beforeRename,
-    publication: hooks.publication
+    publication: hooks.publication,
+    onLockEvent: hooks.onLockEvent
   });
 }
 async function writeNativeRuntime(path2, storageId, change, hooks, firstIdentity) {
@@ -15229,7 +15265,8 @@ async function writeNativeRuntime(path2, storageId, change, hooks, firstIdentity
     },
     beforePublish: hooks.beforePublish,
     afterRename: hooks.afterRename,
-    publication: hooks.publication
+    publication: hooks.publication,
+    onLockEvent: hooks.onLockEvent
   }, firstIdentity);
   if (outcome.status !== "published")
     throw new NativeRuntimeError("publication-refused");
@@ -15240,7 +15277,13 @@ async function writeNativeRuntimeOutcome(path2, storageId, change, hooks, firstI
   const publication2 = capturePublicationOptions(hooks.publication);
   try {
     await mkdir9(dirname9(path2), { recursive: true, mode: 448 });
-    return await withLock(path2, { name: "native-runtime", ttlMs: 1e4, timeoutMs: 15000, renew: true }, async (lock) => {
+    return await withLock2(path2, {
+      name: "native-runtime",
+      ttlMs: 1e4,
+      timeoutMs: 15000,
+      renew: true,
+      onLockEvent: hooks.onLockEvent
+    }, async (lock) => {
       const read = await readNativeRuntime(path2, storageId);
       const current = read.status === "ready" ? read.state : { version: 1, storageId, accounts: {} };
       const next = decodeNativeRuntime(await change(structuredClone(current)), storageId);
@@ -15638,7 +15681,11 @@ async function publishNativeLocalRefreshFailure(paths, observation, policy, hook
 }
 async function publishLocalEntry(paths, subject, matches, replacement, firstIdentity, superseded, hooks = {}) {
   try {
-    const store = createNativePoolStore({ paths, quota: nativeQuotaCodec });
+    const store = createNativePoolStore({
+      paths,
+      quota: nativeQuotaCodec,
+      onLockEvent: hooks.onLockEvent
+    });
     const [config, state] = nativePoolStoreLocks(paths);
     const checkPool = async () => {
       const read = await store.read();
@@ -15654,7 +15701,15 @@ async function publishLocalEntry(paths, subject, matches, replacement, firstIden
         throw new NativeRuntimeError("publication-refused");
       }
     };
-    return await withLock(config.path, { ...POOL_LOCK_DEFAULTS, name: config.name }, async (configLease) => withLock(state.path, { ...POOL_LOCK_DEFAULTS, name: state.name }, async (stateLease) => {
+    return await withLock2(config.path, {
+      ...POOL_LOCK_DEFAULTS,
+      name: config.name,
+      onLockEvent: hooks.onLockEvent
+    }, async (configLease) => withLock2(state.path, {
+      ...POOL_LOCK_DEFAULTS,
+      name: state.name,
+      onLockEvent: hooks.onLockEvent
+    }, async (stateLease) => {
       await checkPool();
       return writeNativeRuntime(paths.runtime, paths.storageId, (current) => {
         const id2 = subject.binding.rowId;
@@ -15666,7 +15721,8 @@ async function publishLocalEntry(paths, subject, matches, replacement, firstIden
           await configLease.assertOwned();
           await stateLease.assertOwned();
         },
-        beforePublish: hooks.beforePublish
+        beforePublish: hooks.beforePublish,
+        onLockEvent: hooks.onLockEvent
       }, firstIdentity);
     }));
   } catch (error) {
@@ -20196,7 +20252,8 @@ var optionKeys = [
   "failurePolicy",
   "now",
   "refreshToken",
-  "resolveIdentity"
+  "resolveIdentity",
+  "onLockEvent"
 ];
 var pathKeys = [
   "legacyConfig",
@@ -20283,6 +20340,7 @@ function createNativeLocalCredentialService(options) {
   const publicationGuard = requiredFunction(descriptors, "publicationGuard");
   const externalPolicy = requiredFunction(descriptors, "externalPolicy");
   const failurePolicy = requiredFunction(descriptors, "failurePolicy");
+  const onLockEvent = optionalFunction(descriptors, "onLockEvent");
   const now = optionalFunction(descriptors, "now");
   const refreshToken = optionalFunction(descriptors, "refreshToken");
   const resolveIdentity = optionalFunction(descriptors, "resolveIdentity");
@@ -20290,6 +20348,7 @@ function createNativeLocalCredentialService(options) {
     if (await publicationGuard(event) !== true)
       return;
     const hooks = {
+      onLockEvent,
       beforePublish: async () => {
         if (await publicationGuard(event) !== true)
           throw new NativeRuntimeError("publication-refused");
@@ -20324,6 +20383,7 @@ function createNativeLocalCredentialService(options) {
   const coordinator = createNativeRefreshCoordinator({
     paths,
     quota: nativeQuotaCodec,
+    onLockEvent,
     ...now ? { now } : {},
     ...refreshToken ? { refreshToken } : {},
     ...resolveIdentity ? { resolveIdentity } : {},
@@ -20636,7 +20696,8 @@ function isNativeTransientAccountError(value) {
   return typeof value === "object" && value !== null && transientAccountErrors.has(value);
 }
 var NATIVE_POOL_WRITE_JOIN_BUDGET_MS = 2000;
-async function joinNativePoolWrite(paths, signals, check) {
+async function joinNativePoolWrite(paths, signals, check, onLockEvent) {
+  const observer = nativeLockObserver(onLockEvent);
   const started = performance.now();
   const remaining = () => NATIVE_POOL_WRITE_JOIN_BUDGET_MS - (performance.now() - started);
   const held = [];
@@ -20650,14 +20711,17 @@ async function joinNativePoolWrite(paths, signals, check) {
           outcome = "deadline";
           break;
         }
+        observer?.({ type: "acquiring", path: lock.path, name: lock.name });
         const lease = await acquireRefreshFileLock({
           path: lock.path,
           name: lock.name,
           ttlMs: POOL_LOCK_DEFAULTS.ttlMs,
           renew: false
         });
-        if (lease)
+        if (lease) {
           held.push(lease);
+          observer?.({ type: "acquired", path: lock.path, name: lock.name });
+        }
         if (remaining() <= 0) {
           outcome = "deadline";
           break;
@@ -21261,7 +21325,17 @@ function createNativeVaultRuntime(options) {
   const connectionFile = nativeRuntimeConnectionFile(options.host, env);
   const identity2 = options.identity ? { ...options.identity } : undefined;
   const shutdown = new AbortController;
-  const store = createNativePoolStore({ paths, quota: nativeQuotaCodec });
+  const store = createNativePoolStore({
+    paths,
+    quota: nativeQuotaCodec,
+    onLockEvent: options.onLockEvent
+  });
+  const observeLock = nativeLockObserver(options.onLockEvent);
+  const observeRosterLock = () => observeLock?.({
+    type: "acquiring",
+    name: "claustrum-roster-write",
+    path: paths.roster
+  });
   let rosterWatch;
   let rosterWatching = false;
   let rosterView;
@@ -21420,7 +21494,7 @@ function createNativeVaultRuntime(options) {
   function poll() {
     if (polling)
       return polling;
-    polling = (async () => {
+    polling = withDetachedNativeLocks(async () => {
       const allowed = await Promise.all([...watchers].map(async (watch) => !watch.shouldRefresh || await watch.shouldRefresh()));
       if (shutdown.signal.aborted || !allowed.some(Boolean))
         return;
@@ -21440,7 +21514,7 @@ function createNativeVaultRuntime(options) {
             return watch.onRefresh?.();
         }).catch(() => {});
       }
-    })().finally(() => {
+    }).finally(() => {
       polling = undefined;
     });
     return polling;
@@ -21474,6 +21548,7 @@ function createNativeVaultRuntime(options) {
     await requireActive(signal);
     if (absentOnly && !await nativeVaultFileAbsent(paths.config))
       return;
+    observeRosterLock();
     await mutateVaultRoster(paths.roster, async (roster, lease) => {
       if (absentOnly && !await nativeVaultFileAbsent(paths.config))
         return { result: undefined };
@@ -21487,6 +21562,7 @@ function createNativeVaultRuntime(options) {
       const writer = createNativePoolStore({
         paths,
         quota: nativeQuotaCodec,
+        onLockEvent: options.onLockEvent,
         onStep: async (point) => {
           if (point === "before-config-write" || point === "before-state-write") {
             await requireActive(signal);
@@ -21583,6 +21659,12 @@ function createNativeVaultRuntime(options) {
       if (!await active())
         return;
       check(signal);
+      if (!refreshing)
+        observeLock?.({
+          type: "acquiring",
+          name: "claustrum-roster",
+          path: paths.roster
+        });
       refreshing ??= refreshVaultRoster({
         path: paths.roster,
         custody: options.discover ? { discover: options.discover } : custody,
@@ -21873,6 +21955,7 @@ function createNativeVaultRuntime(options) {
     ]);
     if ((versions.get(key) ?? 0) > receipt.recordVersion)
       return false;
+    observeRosterLock();
     return mutateVaultRoster(paths.roster, async (roster, lease) => {
       const row = await rowFor(roster, route.logicalId);
       if (!row?.accountIdentity || row.routeId !== route.routeId || row.accountIdentity !== receipt.assertedAccountIdentity || row.credentialId !== receipt.credentialId && !row.aliases?.includes(receipt.credentialId))
@@ -21900,6 +21983,7 @@ function createNativeVaultRuntime(options) {
           kept = true;
           return current;
         }, {
+          onLockEvent: options.onLockEvent,
           beforeRename: async () => {
             await requireActive();
             const pinned = await rowFor(roster, route.logicalId);
@@ -22032,6 +22116,7 @@ function nativeVaultRuntimeKey(options) {
       options.discover,
       options.readToken,
       options.now,
+      options.onLockEvent,
       options.setTimeout,
       options.clearTimeout,
       options.onRosterNoticeHandled
@@ -22354,7 +22439,9 @@ class StickySessionRouter {
   loaded = false;
   state;
   stateMtimeNs;
-  touchChain = Promise.resolve();
+  publicationChain = Promise.resolve();
+  seedPublication;
+  changes = new Map;
   seedFinalized = false;
   constructor(options) {
     this.options = options;
@@ -22400,17 +22487,22 @@ class StickySessionRouter {
       if (before !== after)
         continue;
       this.state = state;
+      this.overlayChanges();
       this.stateMtimeNs = after;
       this.loaded = true;
       return;
     }
     this.state = await this.readState();
+    this.overlayChanges();
     this.stateMtimeNs = await this.readStateMtimeNs();
     this.loaded = true;
   }
-  async acquireLock(wait = true) {
+  async acquireLock(wait = true, detached = false) {
+    const observer = nativeLockObserver(this.options.onLockEvent);
+    const event = { name: "write", path: this.options.path, detached };
+    observer?.({ ...event, type: "acquiring" });
     await mkdir10(dirname12(this.options.path), { recursive: true, mode: 448 });
-    const deadline = this.now() + STICKY_ROUTING_LOCK_WAIT_MS;
+    const deadline = performance.now() + STICKY_ROUTING_LOCK_WAIT_MS;
     while (true) {
       const lock = await acquireRefreshFileLock2({
         name: "write",
@@ -22418,32 +22510,42 @@ class StickySessionRouter {
         ttlMs: STICKY_ROUTING_LOCK_TTL_MS,
         renew: true
       });
-      if (lock)
-        return lock;
-      if (!wait || this.now() >= deadline) {
+      if (lock) {
+        observer?.({ ...event, type: "acquired" });
+        return {
+          assertOwned: () => lock.assertOwned(),
+          release: async () => {
+            try {
+              await lock.release();
+            } finally {
+              observer?.({ ...event, type: "released" });
+            }
+          }
+        };
+      }
+      observer?.({ ...event, type: "contended" });
+      if (!wait || performance.now() >= deadline) {
         throw new Error("Timed out acquiring sticky routing state lock");
       }
       await new Promise((resolve9) => setTimeout(resolve9, STICKY_ROUTING_LOCK_POLL_MS));
     }
   }
-  async recoverLocalPins() {
+  recoverLocalPins() {
     const source2 = this.options.localRecoveryPath;
     if (!source2 || source2 === this.options.path)
       return;
     const key = JSON.stringify([this.options.path, source2]);
     let recovery = localRecoveries.get(key);
     if (!recovery) {
-      recovery = this.fillLocalPins(source2).catch(() => {
-        logger.warn("sticky-routing", "local pin recovery unavailable", {
-          reason: "recovery-failed"
-        });
-      });
+      recovery = this.enqueuePublication("recovery", () => this.fillLocalPins(source2));
       localRecoveries.set(key, recovery);
+    } else {
+      const shared2 = recovery;
+      this.publicationChain = this.publicationChain.then(() => shared2);
     }
-    await recovery;
   }
   async fillLocalPins(source2) {
-    const lock = await this.acquireLock(false);
+    const lock = await this.acquireLock(true, true);
     try {
       let legacy;
       try {
@@ -22498,9 +22600,7 @@ class StickySessionRouter {
     } finally {
       await rm7(tempPath, { force: true }).catch(() => {});
     }
-    this.state = state;
-    this.stateMtimeNs = await this.readStateMtimeNs();
-    this.loaded = true;
+    this.loaded = false;
   }
   async writeResolutionState(state, assertOwned, operation) {
     let ownershipLost = false;
@@ -22512,63 +22612,59 @@ class StickySessionRouter {
           ownershipLost = true;
           throw error;
         }
-      });
-    } catch (error) {
-      if (!ownershipLost)
-        throw error;
+      }, false);
+      return true;
+    } catch {
       logger.warn("sticky-routing", "assignment write refused", {
         operation,
-        reason: "ownership-lost"
+        reason: ownershipLost ? "ownership-lost" : "storage-unavailable"
       });
+      return false;
     }
   }
   async prepareLegacySeed(knownRoster) {
     const seed = this.options.vaultSeed;
-    if (!seed || this.seedFinalized)
+    if (!seed || this.seedFinalized || this.seedPublication)
       return;
-    try {
-      await this.refreshStateIfChanged();
-    } catch {
-      this.seedFinalized = true;
+    if (knownRoster !== undefined && !knownRoster?.complete)
       return;
-    }
-    if (this.state.vaultLegacySeed !== "pending") {
-      this.seedFinalized = true;
-      return;
-    }
-    const roster = knownRoster === undefined ? await readVaultRoster(seed.roster) : knownRoster;
-    if (!roster?.complete)
-      return;
-    const lock = await this.acquireLock();
-    try {
-      const state = await this.readState();
-      if (state.vaultLegacySeed !== "pending") {
-        this.seedFinalized = true;
+    this.seedPublication = this.enqueuePublication("seed", async () => {
+      const roster = knownRoster === undefined ? await readVaultRoster(seed.roster) : knownRoster;
+      if (!roster?.complete)
         return;
-      }
-      const source2 = await readNativeVaultLegacyJson(seed.legacyConfig);
-      const routes = nativeVaultLegacyRoutes(source2, roster);
-      const legacy = await readNativeVaultLegacyJson(getStickyRoutingStatePath(seed.legacyConfig));
-      if (isRecord12(legacy) && legacy.version === 1 && isRecord12(legacy.assignments)) {
-        for (const [key, raw] of Object.entries(legacy.assignments)) {
-          if (!/^[0-9a-f]{64}$/.test(key) || Object.hasOwn(state.assignments, key))
-            continue;
-          const assignment = normalizeAssignment(raw);
-          const target2 = assignment && routes.get(assignment.accountId);
-          if (assignment && target2)
-            state.assignments[key] = {
-              ...assignment,
-              accountId: target2.routeId,
-              accountIdentity: target2.accountIdentity
-            };
+      const lock = await this.acquireLock(true, true);
+      try {
+        const state = await this.readState();
+        if (state.vaultLegacySeed !== "pending") {
+          this.seedFinalized = true;
+          return;
         }
+        const source2 = await readNativeVaultLegacyJson(seed.legacyConfig);
+        const routes = nativeVaultLegacyRoutes(source2, roster);
+        const legacy = await readNativeVaultLegacyJson(getStickyRoutingStatePath(seed.legacyConfig));
+        if (isRecord12(legacy) && legacy.version === 1 && isRecord12(legacy.assignments)) {
+          for (const [key, raw] of Object.entries(legacy.assignments)) {
+            if (!/^[0-9a-f]{64}$/.test(key) || Object.hasOwn(state.assignments, key))
+              continue;
+            const assignment = normalizeAssignment(raw);
+            const target2 = assignment && routes.get(assignment.accountId);
+            if (assignment && target2)
+              state.assignments[key] = {
+                ...assignment,
+                accountId: target2.routeId,
+                accountIdentity: target2.accountIdentity
+              };
+          }
+        }
+        state.vaultLegacySeed = "complete";
+        await this.writeState(state, () => lock.assertOwned(), false);
+        this.seedFinalized = true;
+      } finally {
+        await lock.release();
       }
-      state.vaultLegacySeed = "complete";
-      await this.writeState(state, () => lock.assertOwned(), false);
-      this.seedFinalized = true;
-    } finally {
-      await lock.release();
-    }
+    }).finally(() => {
+      this.seedPublication = undefined;
+    });
   }
   logicalAccountId(assignment) {
     return assignment.accountId === this.options.vaultSeed?.mainRouteId ? STICKY_ROUTING_MAIN_ACCOUNT_ID : assignment.accountId;
@@ -22577,19 +22673,86 @@ class StickySessionRouter {
     this.options.vaultSeed = seed;
   }
   scheduleTouch(key) {
-    this.touchChain = this.touchChain.catch(() => {}).then(async () => {
-      const lock = await this.acquireLock();
+    const assignment = this.state.assignments[key];
+    if (assignment)
+      this.scheduleChange(key, assignment, "touch");
+  }
+  overlayChanges() {
+    for (const [key, change] of this.changes) {
+      if (change.assignment)
+        this.state.assignments[key] = { ...change.assignment };
+      else
+        delete this.state.assignments[key];
+    }
+  }
+  enqueuePublication(operation, work) {
+    const pending = this.publicationChain.then(work).catch(() => {
+      if (operation === "recovery") {
+        logger.warn("sticky-routing", "local pin recovery unavailable", {
+          reason: "recovery-failed"
+        });
+        return;
+      }
+      logger.warn("sticky-routing", "assignment write refused", {
+        operation,
+        reason: "storage-unavailable"
+      });
+    });
+    this.publicationChain = pending;
+    return pending;
+  }
+  scheduleChange(key, assignment, operation) {
+    const change = {
+      assignment: assignment ? { ...assignment } : undefined,
+      operation,
+      queued: false
+    };
+    this.changes.set(key, change);
+    this.overlayChanges();
+    this.retryChange(key);
+  }
+  retryChange(key) {
+    const change = this.changes.get(key);
+    if (!change || change.queued)
+      return;
+    change.queued = true;
+    this.enqueuePublication(change.operation, async () => {
+      if (this.changes.get(key) !== change)
+        return;
+      const lock = await this.acquireLock(true, true);
       try {
         const state = await this.readState();
-        const assignment = state.assignments[key];
-        if (!assignment)
+        if (this.changes.get(key) !== change)
           return;
-        assignment.lastSeenAt = this.now();
-        await this.writeState(state, () => lock.assertOwned());
+        if (change.assignment) {
+          if (change.operation === "touch") {
+            const current = state.assignments[key];
+            if (current?.accountId !== change.assignment.accountId || current.accountIdentity !== change.assignment.accountIdentity || current.affinityModelId !== change.assignment.affinityModelId || current.family !== change.assignment.family) {
+              if (this.changes.get(key) === change)
+                this.changes.delete(key);
+              return;
+            }
+            current.lastSeenAt = Math.max(current.lastSeenAt, change.assignment.lastSeenAt);
+          } else
+            state.assignments[key] = { ...change.assignment };
+        } else
+          delete state.assignments[key];
+        const saved = await this.writeResolutionState(state, () => lock.assertOwned(), change.operation);
+        if (saved && this.changes.get(key) === change)
+          this.changes.delete(key);
       } finally {
-        await lock.release();
+        await lock.release().catch(() => {});
       }
-    }).catch(() => {});
+    }).finally(() => {
+      change.queued = false;
+    });
+  }
+  async drain() {
+    let pending;
+    do {
+      pending = this.publicationChain;
+      await pending;
+    } while (pending !== this.publicationChain);
   }
   selectCandidate(input) {
     let candidates = [...input.candidates];
@@ -22629,21 +22792,21 @@ class StickySessionRouter {
   async resolve(input) {
     if (!input.sessionId)
       return null;
-    await this.recoverLocalPins();
+    this.recoverLocalPins();
     await this.prepareLegacySeed();
-    await this.refreshStateIfChanged();
+    await this.refreshStateIfChanged().catch(() => {});
     const key = sessionKey(input.sessionId);
     const affinityModelId = input.affinityModelId ?? input.modelId;
-    const matchesAffinity = (assignment) => affinityModelId !== undefined ? assignment.affinityModelId === affinityModelId : assignment.family === input.family;
+    const matchesAffinity = (assignment2) => affinityModelId !== undefined ? assignment2.affinityModelId === affinityModelId : assignment2.family === input.family;
     const identityForAccount = (accountId) => {
       const identity2 = input.accountIdentities?.get(accountId);
       return typeof identity2 === "string" && identity2.length > 0 && identity2.trim() === identity2 ? identity2 : undefined;
     };
-    const matchesAccountIdentity = (assignment) => {
+    const matchesAccountIdentity = (assignment2) => {
       if (!input.accountIdentities)
         return true;
-      const identity2 = identityForAccount(this.logicalAccountId(assignment));
-      return identity2 !== undefined && assignment.accountIdentity === identity2;
+      const identity2 = identityForAccount(this.logicalAccountId(assignment2));
+      return identity2 !== undefined && assignment2.accountIdentity === identity2;
     };
     const cached = this.state.assignments[key];
     if (cached && this.assignmentIsActive(cached) && matchesAffinity(cached) && matchesAccountIdentity(cached) && input.retainAccountIds.has(this.logicalAccountId(cached)) && !input.excludeAccountIds?.has(this.logicalAccountId(cached))) {
@@ -22651,6 +22814,7 @@ class StickySessionRouter {
         cached.lastSeenAt = this.now();
         this.scheduleTouch(key);
       }
+      this.retryChange(key);
       return {
         accountId: this.logicalAccountId(cached),
         assignment: { ...cached },
@@ -22658,81 +22822,69 @@ class StickySessionRouter {
         migrated: false
       };
     }
-    const lock = await this.acquireLock();
-    try {
-      const state = await this.readState();
-      this.prune(state);
-      const current = state.assignments[key];
-      if (current && matchesAffinity(current) && matchesAccountIdentity(current) && input.retainAccountIds.has(this.logicalAccountId(current)) && !input.excludeAccountIds?.has(this.logicalAccountId(current))) {
-        current.lastSeenAt = this.now();
-        await this.writeResolutionState(state, () => lock.assertOwned(), "touch");
-        return {
-          accountId: this.logicalAccountId(current),
-          assignment: { ...current },
-          created: false,
-          migrated: false
-        };
-      }
-      const affinityChanged = Boolean(current && !matchesAffinity(current));
-      const identityChanged = Boolean(current && !matchesAccountIdentity(current));
-      if (affinityChanged || identityChanged) {
-        delete state.assignments[key];
-      }
-      const candidates = input.candidates.filter((candidate) => !input.excludeAccountIds?.has(candidate.accountId) && (!input.accountIdentities || identityForAccount(candidate.accountId) !== undefined));
-      const preferred = !affinityChanged && !identityChanged && input.preferredAccountId ? candidates.find((candidate) => candidate.accountId === input.preferredAccountId && stickyRouteCandidateWeight({
-        candidate,
-        family: input.family,
-        modelId: input.modelId,
-        storage: input.storage,
-        now: this.now()
-      }) > 0) : undefined;
-      const selected = preferred ?? this.selectCandidate({ ...input, candidates, state });
-      if (!selected) {
-        if (current) {
-          delete state.assignments[key];
-          await this.writeResolutionState(state, () => lock.assertOwned(), "delete");
-        }
-        return null;
-      }
-      const now = this.now();
-      const selectedQuota = knownQuota(selected.quota);
-      const assignment = {
-        accountId: selected.accountId,
-        ...input.accountIdentities ? { accountIdentity: identityForAccount(selected.accountId) } : {},
-        family: input.family,
-        affinityModelId,
-        assignedAt: now,
-        lastSeenAt: now,
-        initialInputBytes: Math.max(1, input.inputBytes),
-        quotaCheckedAt: selectedQuota ? snapshotCheckedAt(selectedQuota) : 0
-      };
-      state.assignments[key] = assignment;
-      await this.writeResolutionState(state, () => lock.assertOwned(), "assign");
+    const state = structuredClone(this.state);
+    const save = (operation) => {
+      this.scheduleChange(key, state.assignments[key], operation);
+    };
+    this.prune(state);
+    const current = state.assignments[key];
+    if (current && matchesAffinity(current) && matchesAccountIdentity(current) && input.retainAccountIds.has(this.logicalAccountId(current)) && !input.excludeAccountIds?.has(this.logicalAccountId(current))) {
+      current.lastSeenAt = this.now();
+      save("touch");
       return {
-        accountId: selected.accountId,
-        assignment: { ...assignment },
-        created: !current,
-        migrated: Boolean(current && (identityChanged || current.accountId !== selected.accountId))
+        accountId: this.logicalAccountId(current),
+        assignment: { ...current },
+        created: false,
+        migrated: false
       };
-    } finally {
-      await lock.release();
     }
+    const affinityChanged = Boolean(current && !matchesAffinity(current));
+    const identityChanged = Boolean(current && !matchesAccountIdentity(current));
+    if (affinityChanged || identityChanged) {
+      delete state.assignments[key];
+    }
+    const candidates = input.candidates.filter((candidate) => !input.excludeAccountIds?.has(candidate.accountId) && (!input.accountIdentities || identityForAccount(candidate.accountId) !== undefined));
+    const preferred = !affinityChanged && !identityChanged && input.preferredAccountId ? candidates.find((candidate) => candidate.accountId === input.preferredAccountId && stickyRouteCandidateWeight({
+      candidate,
+      family: input.family,
+      modelId: input.modelId,
+      storage: input.storage,
+      now: this.now()
+    }) > 0) : undefined;
+    const selected = preferred ?? this.selectCandidate({ ...input, candidates, state });
+    if (!selected) {
+      if (current) {
+        delete state.assignments[key];
+        save("delete");
+      }
+      return null;
+    }
+    const now = this.now();
+    const selectedQuota = knownQuota(selected.quota);
+    const assignment = {
+      accountId: selected.accountId,
+      ...input.accountIdentities ? { accountIdentity: identityForAccount(selected.accountId) } : {},
+      family: input.family,
+      affinityModelId,
+      assignedAt: now,
+      lastSeenAt: now,
+      initialInputBytes: Math.max(1, input.inputBytes),
+      quotaCheckedAt: selectedQuota ? snapshotCheckedAt(selectedQuota) : 0
+    };
+    state.assignments[key] = assignment;
+    save("assign");
+    return {
+      accountId: selected.accountId,
+      assignment: { ...assignment },
+      created: !current,
+      migrated: Boolean(current && (identityChanged || current.accountId !== selected.accountId))
+    };
   }
   async clear(sessionId) {
     if (!sessionId)
       return;
-    await this.recoverLocalPins();
-    const key = sessionKey(sessionId);
-    const lock = await this.acquireLock();
-    try {
-      const state = await this.readState();
-      if (!(key in state.assignments))
-        return;
-      delete state.assignments[key];
-      await this.writeState(state, () => lock.assertOwned());
-    } finally {
-      await lock.release();
-    }
+    this.recoverLocalPins();
+    this.scheduleChange(sessionKey(sessionId), undefined, "delete");
   }
 }
 
@@ -24394,16 +24546,21 @@ function acquireNativeAccountRuntime(options) {
       options.local?.refreshToken,
       options.local?.resolveIdentity,
       options.local?.failurePolicy,
-      options.local?.now
+      options.local?.now,
+      options.local?.onLockEvent
     ].map(nativeRuntimeOptionIdentity)
   ]);
   const { use, close } = sharedAccounts.acquire(key, () => createNativeAccountRuntime(options));
   const vault = leaseNativeVaultRuntime(() => use().vault, close);
   const quotaObservations = use().quotaObservations;
+  const onLockEvent = use().onLockEvent;
+  const drainRoutingPublications = use().drainRoutingPublications;
   return {
+    onLockEvent,
     vault,
     quotaObservations,
     drainQuotaPublications: () => quotaObservations.drain(),
+    drainRoutingPublications,
     getRelayConfig: () => use().getRelayConfig(),
     getSettingsPath: () => use().getSettingsPath(),
     updateRelay: (patch) => use().updateRelay(patch),
@@ -24428,7 +24585,10 @@ function acquireNativeAccountRuntime(options) {
     fetchQuota: (id2, transport, signal, dispatch, purpose) => use().fetchQuota(id2, transport, signal, dispatch, purpose),
     fetchProfile: (id2, transport, signal) => use().fetchProfile(id2, transport, signal),
     fetchProfileForDisplay: (id2, transport, signal) => use().fetchProfileForDisplay(id2, transport, signal),
-    close: () => vault.close()
+    close: () => {
+      vault.close();
+      return drainRoutingPublications();
+    }
   };
 }
 function nativeAccountPolicy(account, snapshot, modelId) {
@@ -24440,6 +24600,8 @@ function nativeAccountPolicy(account, snapshot, modelId) {
 }
 function createNativeAccountRuntime(options) {
   const paths = Object.freeze({ ...options.paths });
+  const onLockEvent = nativeLockObserver(options.local?.onLockEvent ?? options.vault?.onLockEvent);
+  const withLock3 = observeNativeLocks(() => withLock, onLockEvent);
   const now = options.local?.now ?? options.vault?.now ?? Date.now;
   const env = { ...options.vault?.env ?? process.env };
   const vaultPaths = nativeVaultPaths(paths);
@@ -24450,6 +24612,7 @@ function createNativeAccountRuntime(options) {
   const vaultRouter = new StickySessionRouter({
     path: vaultPaths.routing,
     vaultSeed: routingSeed,
+    onLockEvent,
     now
   });
   let settingsBootstrap;
@@ -24457,6 +24620,7 @@ function createNativeAccountRuntime(options) {
     paths: vaultPaths,
     quota: nativeQuotaCodec,
     now,
+    onLockEvent: options.local?.onLockEvent,
     onStep: async (point) => {
       if (point === "before-config-write" || point === "before-state-write")
         await requireMode("claustrum");
@@ -24467,6 +24631,7 @@ function createNativeAccountRuntime(options) {
     paths,
     quota: nativeQuotaCodec,
     now,
+    onLockEvent: options.local?.onLockEvent,
     onStep: async (point) => {
       if (point === "before-config-write" || point === "before-state-write") {
         if (options.beforePoolWrite) {
@@ -24480,7 +24645,8 @@ function createNativeAccountRuntime(options) {
   const vault = acquireNativeVaultRuntime({
     ...options.vault,
     paths,
-    host: options.host
+    host: options.host,
+    onLockEvent
   });
   function check(signal) {
     if (shutdown.signal.aborted)
@@ -24547,7 +24713,15 @@ function createNativeAccountRuntime(options) {
     };
     const [config, state] = nativePoolStoreLocks(paths);
     try {
-      return await withLock(config.path, { ...POOL_LOCK_DEFAULTS, name: config.name }, async (configLease) => withLock(state.path, { ...POOL_LOCK_DEFAULTS, name: state.name }, async (stateLease) => {
+      return await withLock3(config.path, {
+        ...POOL_LOCK_DEFAULTS,
+        name: config.name,
+        onLockEvent: options.local?.onLockEvent
+      }, async (configLease) => withLock3(state.path, {
+        ...POOL_LOCK_DEFAULTS,
+        name: state.name,
+        onLockEvent: options.local?.onLockEvent
+      }, async (stateLease) => {
         if (!await matches2())
           return false;
         await updateNativeRuntime(paths.runtime, paths.storageId, (current) => {
@@ -24557,6 +24731,7 @@ function createNativeAccountRuntime(options) {
           current.accounts[binding2.rowId] = change(same && old ? old : { binding: binding2 }, old);
           return current;
         }, {
+          onLockEvent: options.local?.onLockEvent,
           beforeRename: async () => {
             if (!await matches2())
               throw new NativeRuntimeError("publication-refused");
@@ -24706,24 +24881,32 @@ function createNativeAccountRuntime(options) {
     return source2 !== undefined && nativeLocalRouteAwaitsTornWrite(paths, source2.rows, source2.settings, routeId, source2.runtime);
   }
   const runtime2 = {
+    onLockEvent,
     vault,
     quotaObservations: vault.quotaObservations,
     drainQuotaPublications: () => vault.quotaObservations.drain(),
+    drainRoutingPublications: () => vaultRouter.drain(),
     async getRelayConfig() {
       const { mode, paths: paths2, store: store2 } = await selectedStorage();
-      return withLock(paths2.config, { ...POOL_LOCK_DEFAULTS, name: "native-relay" }, async (lease) => {
+      for (let attempt = 0;attempt < 4; attempt++) {
+        if (attempt)
+          await new Promise((resolve10) => setTimeout(resolve10, 10));
         const settings = await store2.readSettings();
         if (settings.status !== "ready")
           throw new NativeRuntimeError("publication-refused");
         const flags2 = relayFlags(settings.settings.relay);
+        const generation = relayGeneration(settings.settings.relay);
         const read = await readNativeRuntime(paths2.runtime, paths2.storageId);
-        const token2 = read.status === "ready" ? read.state.relay?.token : undefined;
         await requireMode(mode);
-        await lease.assertOwned();
+        const state = read.status === "ready" ? read.state : undefined;
+        if (generation !== state?.relayGeneration)
+          continue;
+        const token2 = state?.relay?.token;
         if (!flags2.enabled || !flags2.url || !token2)
           return null;
         return { ...flags2, token: token2 };
-      });
+      }
+      throw new NativeRuntimeError("relay-inconsistent");
     },
     async updateRelay(input) {
       const patch = captureNativePlainData(input);
@@ -24745,11 +24928,13 @@ function createNativeAccountRuntime(options) {
       if (patch.token !== undefined && patch.token !== null && (typeof patch.token !== "string" || !patch.token.trim() || /\p{Cc}/u.test(patch.token)))
         throw new NativeRuntimeError("publication-refused");
       const { mode, paths: paths2, store: store2 } = await selectedStorage();
-      await withLock(paths2.config, { ...POOL_LOCK_DEFAULTS, name: "native-relay" }, async (lease) => {
+      await withLock3(paths2.config, { ...POOL_LOCK_DEFAULTS, name: "native-relay" }, async (lease) => {
         const read = await store2.readSettings();
         if (read.status !== "ready")
           throw new NativeRuntimeError("publication-refused");
         const previous = relayFlags(read.settings.relay);
+        const previousGeneration = relayGeneration(read.settings.relay);
+        const generation = randomUUID15();
         const metadata2 = await readNativeRuntime(paths2.runtime, paths2.storageId);
         const token2 = patch.token === undefined ? metadata2.status === "ready" ? metadata2.state.relay?.token : undefined : patch.token?.trim();
         const next = relayFlags({
@@ -24759,28 +24944,31 @@ function createNativeAccountRuntime(options) {
         });
         if (next.enabled && (!next.url || !token2))
           throw new NativeRuntimeError("publication-refused");
-        async function writeFlags(flags2) {
+        async function writeFlags(flags2, stamp) {
           await store2.updateSettings(async (settings) => {
             await requireMode(mode);
             await lease.assertOwned();
-            settings.relay = flags2;
+            settings.relay = {
+              ...flags2,
+              ...stamp === undefined ? {} : { generation: stamp }
+            };
           });
         }
-        await writeFlags({ ...previous, enabled: false });
-        if (patch.token !== undefined)
-          await updateNativeRuntime(paths2.runtime, paths2.storageId, (current) => {
-            if (token2)
-              current.relay = { token: token2 };
-            else
-              delete current.relay;
-            return current;
-          }, {
-            beforeRename: async () => {
-              await requireMode(mode);
-              await lease.assertOwned();
-            }
-          });
-        await writeFlags(next);
+        await writeFlags({ ...previous, enabled: false }, previousGeneration);
+        await updateNativeRuntime(paths2.runtime, paths2.storageId, (current) => {
+          if (token2)
+            current.relay = { token: token2 };
+          else
+            delete current.relay;
+          current.relayGeneration = generation;
+          return current;
+        }, {
+          beforeRename: async () => {
+            await requireMode(mode);
+            await lease.assertOwned();
+          }
+        });
+        await writeFlags(next, generation);
       });
     },
     async getSettingsPath() {
@@ -24801,7 +24989,7 @@ function createNativeAccountRuntime(options) {
         logger.debug("native-auth", "waiting for an account write to finish", {
           phase: "waiting"
         });
-        const joined = await joinNativePoolWrite(paths, request.signal ? [shutdown.signal, request.signal] : [shutdown.signal], () => check(request.signal));
+        const joined = await joinNativePoolWrite(paths, request.signal ? [shutdown.signal, request.signal] : [shutdown.signal], () => check(request.signal), onLockEvent);
         if (joined === "deadline") {
           logger.warn("native-auth", "account write did not finish in time", {
             outcome: "deadline"
@@ -25302,6 +25490,7 @@ function createNativeAccountRuntime(options) {
         shutdown.abort(new NativeCustodyError("closed"));
         vault.close();
       }
+      return vaultRouter.drain();
     }
   };
   function readLocalProfile(id2, fetchImpl, signal) {
@@ -25398,6 +25587,16 @@ function relayFlags(input) {
     fallbackToDirect: value.fallbackToDirect !== false
   };
 }
+function relayGeneration(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    return;
+  const generation = input.generation;
+  if (generation === undefined)
+    return;
+  if (typeof generation !== "string" || !generation.trim())
+    throw new NativeRuntimeError("relay-inconsistent");
+  return generation;
+}
 // src/native-host-auth-write.ts
 import { randomUUID as randomUUID16 } from "node:crypto";
 import { lstat as lstat7, open as open9, rename as rename13, unlink as unlink6 } from "node:fs/promises";
@@ -32065,6 +32264,7 @@ export {
   OAUTH_SCOPES,
   NativeVaultNoAccountError,
   NativeTransientAccountError,
+  NativeRuntimeError,
   NativeQuotaObservations,
   PiSlotError as NativePiAuthSlotError,
   NativeMigrationError,