@cortexkit/anthropic-auth-core 2.2.1 → 2.2.2

package/dist/index.js

@@ -644,6 +644,7 @@ class LockOwnershipError extends Error {
 async function withLock(target, options, fn) {
   const started = performance.now();
   for (;; ) {
+    options.signal?.throwIfAborted();
     const lock = await acquireRefreshFileLock({
       path: target,
       name: options.name,
@@ -654,6 +655,7 @@ async function withLock(target, options, fn) {
     });
     if (lock) {
       try {
+        options.signal?.throwIfAborted();
         return await fn(lock);
       } finally {
         await lock.release();
@@ -2530,6 +2532,7 @@ Please quit all OpenCode, LiteCode, and Pi processes before running setup.`);
 }
 async function listSetupProcesses(runner = defaultCommandRunner, options = {}) {
   const windows = (options.platform ?? process.platform) === "win32";
+  const selfPid = options.selfPid ?? process.pid;
   let inspection = {
     step: windows ? "tasklist" : "ps",
     exitCode: null,
@@ -2598,7 +2601,7 @@ async function listSetupProcesses(runner = defaultCommandRunner, options = {}) {
     }
     if (!processes.length)
       throw new ProcessInspectionError(inspection);
-    const runtimes = processes.filter((entry) => entry.pid !== process.pid && /^(?:node|bun)\.exe$/i.test(entry.command));
+    const runtimes = processes.filter((entry) => entry.pid !== selfPid && /^(?:node|bun)\.exe$/i.test(entry.command));
     if (windows && runtimes.length && options.inspectRuntimes !== false) {
       const details = await inspect("CIM", "powershell.exe", [
         "-NoProfile",
@@ -2631,7 +2634,8 @@ async function listSetupProcesses(runner = defaultCommandRunner, options = {}) {
   }
 }
 function createProcessFence(runner = defaultCommandRunner, options = {}) {
-  const isHost = (entry) => entry.pid !== process.pid && hostName(entry.command) !== null;
+  const selfPid = options.selfPid ?? process.pid;
+  const isHost = (entry) => entry.pid !== selfPid && hostName(entry.command) !== null;
   return {
     async listRunningHosts(env) {
       return (await listSetupProcesses(runner, { ...options, env })).filter(isHost);
@@ -2645,7 +2649,7 @@ function createProcessFence(runner = defaultCommandRunner, options = {}) {
       const windows = (options.platform ?? process.platform) === "win32";
       return {
         hosts: processes.filter(isHost),
-        uncheckedRuntimes: windows ? processes.filter((entry) => entry.pid !== process.pid && /^(?:node|bun)\.exe$/i.test(entry.command)).length : 0
+        uncheckedRuntimes: windows ? processes.filter((entry) => entry.pid !== selfPid && /^(?:node|bun)\.exe$/i.test(entry.command)).length : 0
       };
     }
   };
@@ -13272,6 +13276,12 @@ function isQuotaCounter(value) {
 function isQuotaCounters(value) {
   return isRecord8(value) && Object.values(value).every(isQuotaCounter);
 }
+function isBoolean(value) {
+  return typeof value === "boolean";
+}
+function isQuotaCredits(value) {
+  return isRecord8(value) && typeof value.hasCredits === "boolean" && typeof value.unlimited === "boolean" && optional(value, "balance", isFiniteNumber) && optional(value, "overageLimitReached", isBoolean) && isFiniteNumber(value.checkedAt);
+}
 function readQuotaCounters(value) {
   if (!isRecord8(value))
     return;
@@ -13283,11 +13293,16 @@ function decodeQuotaMap(value) {
     return value;
   if (!isRecord8(value))
     return;
-  const { counters: rawCounters, ...rest } = value;
+  const { counters: rawCounters, credits: rawCredits, ...rest } = value;
   if (!isQuotaMap(rest))
     return;
   const counters = readQuotaCounters(rawCounters);
-  return { ...rest, ...counters === undefined ? {} : { counters } };
+  const credits = isQuotaCredits(rawCredits) ? rawCredits : undefined;
+  return {
+    ...rest,
+    ...counters === undefined ? {} : { counters },
+    ...credits === undefined ? {} : { credits }
+  };
 }
 function isQuotaMap(value) {
   if (!isRecord8(value) || !Array.isArray(value.limits))
@@ -13301,7 +13316,7 @@ function isQuotaMap(value) {
       return false;
     seen.add(key);
   }
-  return optional(value, "budget", isCreditBudgetEntry) && optional(value, "counters", isQuotaCounters);
+  return optional(value, "budget", isCreditBudgetEntry) && optional(value, "counters", isQuotaCounters) && optional(value, "credits", isQuotaCredits);
 }
 
 // ../../node_modules/@cortexkit/common-auth/dist/quota/merge.js
@@ -13360,7 +13375,7 @@ function isQuotaObservation(value) {
   }
   if (!coverage.every(isObservedPair))
     return false;
-  return (value.budget === undefined || isObservedBudget(value.budget)) && (value.counters === undefined || isQuotaCounters(value.counters));
+  return (value.budget === undefined || isObservedBudget(value.budget)) && (value.counters === undefined || isQuotaCounters(value.counters)) && (value.credits === undefined || isQuotaCredits(value.credits));
 }
 function compareEntries(left, right) {
   if (left.scope !== right.scope)
@@ -13386,6 +13401,14 @@ function mergeCounters(stored, observed) {
   }
   return counters.size === 0 ? undefined : Object.fromEntries(counters);
 }
+function mergeCredits(stored, observed) {
+  if (observed === undefined)
+    return stored;
+  if (stored !== undefined && observed.checkedAt < stored.checkedAt) {
+    return stored;
+  }
+  return { ...observed };
+}
 function mergeQuotaObservation(stored, observation) {
   const decoded = stored === undefined ? undefined : decodeQuotaMap(stored);
   if (stored !== undefined && decoded === undefined) {
@@ -13429,14 +13452,16 @@ function mergeQuotaObservation(stored, observation) {
     const existing = entries.get(key);
     entries.set(key, existing === undefined || existing.kind === "absent" ? { scope, label: pair.label, kind: "absent", checkedAt: at } : { scope, label: pair.label, kind: "retired", retiredAt: at });
   }
-  const { limits: _limits, budget: _budget, counters: _counters, ...unknownKeys } = base;
+  const { limits: _limits, budget: _budget, counters: _counters, credits: _credits, ...unknownKeys } = base;
   const budget = mergeBudget(base.budget, observation.budget, at);
   const counters = mergeCounters(base.counters, observation.counters);
+  const credits = mergeCredits(base.credits, observation.credits);
   return {
     ...unknownKeys,
     limits: [...entries.values()].sort(compareEntries),
     ...budget === undefined ? {} : { budget },
-    ...counters === undefined ? {} : { counters }
+    ...counters === undefined ? {} : { counters },
+    ...credits === undefined ? {} : { credits }
   };
 }
 
@@ -13512,6 +13537,13 @@ function quotaWindowParts(quota, options) {
   const parts = windows.map(({ part }) => part);
   return age === undefined ? { windows: parts } : { windows: parts, age };
 }
+function withShortNames(windows) {
+  const abbreviations = scopeAbbreviations(windows.filter(({ part, scope }) => part.kind === "window" && scope !== ALL_SCOPE).map(({ scope }) => scope));
+  for (const window of windows) {
+    window.part.short = window.part.kind === "budget" ? "cr" : window.scope === ALL_SCOPE ? window.part.name : abbreviations.get(window.scope) ?? window.scope;
+  }
+  return windows;
+}
 function scopedWindowParts(quota, options) {
   if (!quota)
     return { windows: [] };
@@ -13525,6 +13557,7 @@ function scopedWindowParts(quota, options) {
       part: {
         kind: "window",
         name: quotaWindowName(limit),
+        short: "",
         figure: percentLeft(limit.remainingPercent ?? 0),
         remainingPercent,
         checkedAt: limit.checkedAt,
@@ -13542,6 +13575,7 @@ function scopedWindowParts(quota, options) {
       part: {
         kind: "budget",
         name: "credits",
+        short: "",
         figure,
         ...remainingPercent === undefined ? {} : { remainingPercent: clampPercent2(remainingPercent) },
         checkedAt: budget.checkedAt,
@@ -13549,6 +13583,7 @@ function scopedWindowParts(quota, options) {
       }
     });
   }
+  withShortNames(windows);
   if (windows.length > 0) {
     const age = now - Math.min(...windows.map(({ part }) => part.checkedAt));
     if (age > (options.staleAfterMs ?? QUOTA_STALE_AFTER_MS)) {
@@ -13629,15 +13664,14 @@ function narrowTextParts(quota, options) {
     return grouped;
   const general = windows.filter(({ part, scope }) => part.kind === "window" && scope === ALL_SCOPE);
   const scoped = windows.filter(({ part, scope }) => part.kind === "window" && scope !== ALL_SCOPE);
-  const abbreviations = scopeAbbreviations(scoped.map(({ scope }) => scope));
   const budget = windows.find(({ part }) => part.kind === "budget");
   const budgetLeft = budget?.spent ? 0 : budget?.part.remainingPercent;
   const extras = [
-    ...scoped.map(({ scope, part }) => ({
-      label: abbreviations.get(scope) ?? scope,
+    ...scoped.map(({ part }) => ({
+      label: part.short,
       remaining: part.remainingPercent ?? 0
     })),
-    ...budgetLeft === undefined ? [] : [{ label: "cr", remaining: budgetLeft }]
+    ...budgetLeft === undefined || budget === undefined ? [] : [{ label: budget.part.short, remaining: budgetLeft }]
   ];
   const tightest = extras.reduce((best, item) => best === undefined || item.remaining < best.remaining ? item : best, undefined);
   const pieces = general.map(({ part }) => `${part.name} ${wholePercent(part.remainingPercent ?? 0)}%`);
@@ -17774,8 +17808,12 @@ class ClaustrumScopedCustody {
   }
 }
 
+// ../../node_modules/@cortexkit/common-auth/dist/claustrum/quota-writer.js
+import { resolve as resolve8 } from "node:path";
+
 // ../../node_modules/@cortexkit/common-auth/dist/claustrum/roster.js
 import { createHash as createHash12 } from "node:crypto";
+import { resolve as resolve7 } from "node:path";
 
 // ../../node_modules/@cortexkit/common-auth/dist/claustrum/interlock.js
 function matches(entry2, credentialId, accountIdentity) {
@@ -18028,11 +18066,12 @@ async function readVaultRoster(path2) {
 var WRITE_LOCK = {
   name: "claustrum-roster-write",
   ttlMs: 1e4,
-  timeoutMs: 5000
+  timeoutMs: 5000,
+  renew: true
 };
 var DISCOVERY_LEASE = { name: "claustrum-roster", ttlMs: 30000 };
 async function mutateVaultRoster(path2, change, options = {}) {
-  return withLock(path2, WRITE_LOCK, async (lock) => {
+  return withLock(path2, { ...WRITE_LOCK, signal: options.signal }, async (lock) => {
     const current = await readVaultRoster(path2);
     const { next, result } = await change(current, {
       assertOwned: () => lock.assertOwned()
@@ -18042,6 +18081,7 @@ async function mutateVaultRoster(path2, change, options = {}) {
       await writeJsonAtomic(path2, next, {
         beforeRename: async () => {
           await options.beforePublish?.();
+          options.signal?.throwIfAborted();
           await lock.assertOwned();
         }
       });
@@ -18091,43 +18131,52 @@ function receiptFence(row, receipt) {
     return "bind";
   return "refuse";
 }
-function recordVaultQuota(path2, input) {
-  return mutateVaultRoster(path2, (current) => {
-    const row = current?.rows.find((entry2) => entry2.routeId === input.routeId);
-    const fence = !current || !row ? "refuse" : receiptFence(row, input);
-    if (!current || !row || fence === "refuse")
-      return { result: false };
-    const quota2 = mergeQuotaObservation(row.quota, input.observation);
-    const bound = fence === "bind" ? { accountIdentity: input.accountIdentity, unclaimed: true } : {};
-    return {
-      next: {
-        ...current,
-        rows: current.rows.map((entry2) => entry2 === row ? { ...entry2, ...bound, quota: quota2 } : entry2)
-      },
-      result: true
-    };
+async function recordVaultQuota(path2, input) {
+  const { routeId, observation, ...receipt } = input;
+  return enqueueFencedVaultQuota(path2, {
+    routeId,
+    observation,
+    accountIdentity: receipt.accountIdentity,
+    receipt
   });
 }
+async function enqueueFencedVaultQuota(path2, publication2) {
+  if (!isQuotaObservation(publication2.observation))
+    return false;
+  const current = pendingVaultQuota(path2, await readVaultRoster(path2));
+  if (!applyVaultQuota(current, publication2).kept)
+    return false;
+  return enqueueVaultQuota(path2, publication2);
+}
 function recordVaultAccountQuota(path2, input) {
-  return mutateVaultRoster(path2, (current) => {
-    const row = current?.rows.find((entry2) => entry2.routeId === input.routeId);
-    if (!current || !row || row.accountIdentity === undefined || row.accountIdentity !== input.accountIdentity)
-      return { result: false };
-    const quota2 = mergeQuotaObservation(row.quota, input.observation);
-    return {
-      next: {
-        ...current,
-        rows: current.rows.map((entry2) => entry2 === row ? { ...entry2, quota: quota2 } : entry2)
-      },
-      result: true
-    };
-  });
+  return enqueueFencedVaultQuota(path2, input);
+}
+function applyVaultQuota(current, input) {
+  const row = current?.rows.find((entry2) => entry2.routeId === input.routeId);
+  const fence = !row ? "refuse" : input.receipt ? receiptFence(row, input.receipt) : row.accountIdentity !== undefined && row.accountIdentity === input.accountIdentity ? "hold" : "refuse";
+  if (!current || !row || fence === "refuse")
+    return { roster: current, kept: false };
+  const quota2 = mergeQuotaObservation(row.quota, input.observation);
+  const bound = fence === "bind" ? { accountIdentity: input.accountIdentity, unclaimed: true } : {};
+  return {
+    roster: {
+      ...current,
+      rows: current.rows.map((entry2) => entry2 === row ? { ...entry2, ...bound, quota: quota2 } : entry2)
+    },
+    kept: true
+  };
+}
+var pendingDiscoveries = new Map;
+function forgetPendingVaultDiscovery(path2) {
+  pendingDiscoveries.delete(resolve7(path2));
 }
 async function refreshVaultRoster(options) {
   options.signal?.throwIfAborted();
   const active = async () => await options.isActive?.() ?? true;
-  if (!await active())
+  if (!await active()) {
+    forgetPendingVaultDiscovery(options.path);
     return;
+  }
   const lease = await acquireRefreshFileLock({
     ...DISCOVERY_LEASE,
     path: options.path,
@@ -18140,8 +18189,18 @@ async function refreshVaultRoster(options) {
       throw new ClaustrumConsumerError("roster-busy", "Claustrum account discovery is already in progress");
     return persisted;
   }
+  const key = resolve7(options.path);
+  let discovered;
   try {
-    const inventory = await options.custody.discover(options.signal);
+    const previous = await readVaultRoster(options.path);
+    const pending = pendingDiscoveries.get(key);
+    discovered = pending && (pending.previousView === previous?.view || pending.inventory.view === previous?.view) ? pending : {
+      inventory: await options.custody.discover(options.signal),
+      previousView: previous?.view
+    };
+    pendingDiscoveries.delete(key);
+    const { inventory } = discovered;
+    options.onInventory?.(inventory);
     options.signal?.throwIfAborted();
     return await mutateVaultRoster(options.path, async (current) => {
       if (!await active())
@@ -18152,12 +18211,238 @@ async function refreshVaultRoster(options) {
       const next = projectVaultRoster(current, inventory, projection);
       const changed = JSON.stringify(current) !== JSON.stringify(next);
       return { ...changed && { next }, result: next };
+    }, {
+      beforePublish: async () => {
+        options.signal?.throwIfAborted();
+        await lease.assertOwned();
+      }
     });
+  } catch (error) {
+    if (error instanceof LockContentionError && discovered && !options.signal?.aborted && await active())
+      pendingDiscoveries.set(key, discovered);
+    throw error;
   } finally {
     await lease.release();
   }
 }
 
+// ../../node_modules/@cortexkit/common-auth/dist/claustrum/quota-writer.js
+var writers = new Map;
+var logger2 = createLogger("claustrum");
+var COALESCE_MS = 100;
+function writerFor(path2) {
+  const key = resolve8(path2);
+  let writer = writers.get(key);
+  if (!writer) {
+    writer = {
+      path: key,
+      pending: new Map,
+      listeners: new Set,
+      wake: new Set,
+      abort: new AbortController,
+      failures: 0,
+      draining: false,
+      order: 0
+    };
+    writers.set(key, writer);
+  }
+  return writer;
+}
+function retainVaultQuotaWriter(path2, listener) {
+  const writer = writerFor(path2);
+  writer.listeners.add(listener);
+  let released;
+  return () => released ??= (() => {
+    writer.listeners.delete(listener);
+    return writer.listeners.size ? Promise.resolve() : drainVaultQuota(path2);
+  })();
+}
+function fields(publication2) {
+  const result = new Map;
+  const { observation } = publication2;
+  const witness = JSON.stringify([
+    publication2.routeId,
+    publication2.receipt?.credentialId,
+    publication2.receipt?.accountIdentitySource,
+    publication2.receipt?.expectedAccountIdentity
+  ]);
+  const add = (key, at, part) => result.set(`${witness}:${key}`, {
+    at,
+    order: 0,
+    publication: { ...publication2, observation: part }
+  });
+  const keyFor = (scope, label) => JSON.stringify([scope ?? "all", label]);
+  const read = new Set;
+  for (const reading2 of observation.readings ?? []) {
+    const key = keyFor(reading2.scope, reading2.label);
+    read.add(key);
+    add(key, observation.checkedAt, {
+      checkedAt: observation.checkedAt,
+      readings: [{ ...reading2 }]
+    });
+  }
+  for (const pair of observation.coverage ?? []) {
+    const key = keyFor(pair.scope, pair.label);
+    if (!read.has(key))
+      add(key, observation.checkedAt, {
+        checkedAt: observation.checkedAt,
+        coverage: [{ ...pair }]
+      });
+  }
+  if (observation.budget)
+    add("budget", observation.checkedAt, {
+      checkedAt: observation.checkedAt,
+      budget: { ...observation.budget }
+    });
+  for (const [name, counter2] of Object.entries(observation.counters ?? {})) {
+    add(`counter:${name}`, counter2.checkedAt, {
+      checkedAt: observation.checkedAt,
+      counters: { [name]: { ...counter2 } }
+    });
+  }
+  if (observation.credits)
+    add("credits", observation.credits.checkedAt, {
+      checkedAt: observation.checkedAt,
+      credits: { ...observation.credits }
+    });
+  if (!result.size)
+    add("empty", observation.checkedAt, { checkedAt: observation.checkedAt });
+  return result;
+}
+function enqueueVaultQuota(path2, publication2) {
+  if (!isQuotaObservation(publication2.observation))
+    return Promise.resolve(false);
+  const writer = writerFor(path2);
+  const account = JSON.stringify([
+    publication2.accountIdentity ?? null,
+    publication2.accountIdentity === undefined ? publication2.routeId : null
+  ]);
+  const pending = writer.pending.get(account) ?? new Map;
+  for (const [key, field] of fields(publication2)) {
+    const previous = pending.get(key);
+    if (!previous || field.at >= previous.at) {
+      field.order = ++writer.order;
+      if (field.publication.observation.coverage)
+        field.priorReading = previous?.publication.observation.readings ? previous.publication : previous?.priorReading;
+      pending.set(key, field);
+    }
+  }
+  if (pending.size)
+    writer.pending.set(account, pending);
+  for (const listener of writer.listeners)
+    listener(publication2);
+  schedule(writer, COALESCE_MS);
+  return Promise.resolve(true);
+}
+function orderedFields(pending) {
+  return [...pending.values()].flatMap((account) => [...account.values()]).sort((a, b) => a.order - b.order);
+}
+function pendingVaultQuota(path2, roster) {
+  const writer = writers.get(resolve8(path2));
+  if (writer) {
+    for (const field of orderedFields(writer.pending)) {
+      if (field.priorReading)
+        roster = applyVaultQuota(roster, field.priorReading).roster;
+      roster = applyVaultQuota(roster, field.publication).roster;
+    }
+  }
+  return roster;
+}
+function schedule(writer, delay3) {
+  if (writer.running || writer.timer || !writer.pending.size || writer.abort.signal.aborted)
+    return;
+  writer.timer = setTimeout(() => {
+    writer.timer = undefined;
+    flush2(writer);
+  }, delay3);
+  if (!writer.draining)
+    writer.timer.unref?.();
+}
+function flush2(writer) {
+  if (writer.running || writer.abort.signal.aborted)
+    return;
+  const batch = new Map([...writer.pending].map(([account, pending]) => [
+    account,
+    new Map(pending)
+  ]));
+  writer.running = (async () => {
+    try {
+      await mutateVaultRoster(writer.path, (current) => {
+        let next = current;
+        for (const field of orderedFields(batch)) {
+          if (field.priorReading)
+            next = applyVaultQuota(next, field.priorReading).roster;
+          next = applyVaultQuota(next, field.publication).roster;
+        }
+        return { ...next !== current && { next }, result: undefined };
+      }, { signal: writer.abort.signal });
+      for (const [account, fields2] of batch) {
+        const pending = writer.pending.get(account);
+        for (const [key, field] of fields2) {
+          if (pending?.get(key) === field)
+            pending.delete(key);
+        }
+        if (!pending?.size)
+          writer.pending.delete(account);
+      }
+      writer.failures = 0;
+    } catch (error) {
+      if (!writer.abort.signal.aborted && writer.failures++ === 0) {
+        logger2.warn("vault quota publication delayed; retrying", {
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+    } finally {
+      writer.running = undefined;
+      for (const wake of writer.wake)
+        wake();
+      const backoff = writer.failures ? Math.min(5000, 100 * 2 ** Math.min(writer.failures, 6)) * (0.5 + Math.random()) : COALESCE_MS;
+      schedule(writer, backoff);
+    }
+  })();
+}
+async function drainVaultQuota(path2, timeoutMs = 1000) {
+  const key = resolve8(path2);
+  const writer = writers.get(key);
+  if (!writer)
+    return;
+  writer.draining = true;
+  clearTimeout(writer.timer);
+  writer.timer = undefined;
+  let deadline;
+  let wake;
+  const drained = new Promise((done) => {
+    wake = () => {
+      if (!writer.pending.size || writer.abort.signal.aborted)
+        done();
+    };
+    writer.wake.add(wake);
+    wake();
+  });
+  try {
+    if (writer.pending.size)
+      flush2(writer);
+    await Promise.race([
+      drained,
+      new Promise((done) => {
+        deadline = setTimeout(done, Math.max(0, timeoutMs));
+      })
+    ]);
+  } finally {
+    clearTimeout(deadline);
+    if (wake)
+      writer.wake.delete(wake);
+    writer.draining = false;
+    if (!writer.listeners.size) {
+      writer.abort.abort();
+      clearTimeout(writer.timer);
+      writer.pending.clear();
+      if (writers.get(key) === writer)
+        writers.delete(key);
+    }
+  }
+}
+
 // ../../node_modules/@cortexkit/common-auth/dist/claustrum/consumer.js
 class ClaustrumConsumer {
   #options;
@@ -18175,9 +18460,13 @@ class ClaustrumConsumer {
   #releaseInsulaWatch;
   #insulaSkips = new Map;
   #discoveredAt;
+  #releaseQuotaWriter;
   constructor(options) {
     this.#options = options;
     this.#logger = options.logger ?? createLogger("claustrum");
+    this.#releaseQuotaWriter = retainVaultQuotaWriter(options.rosterPath, (publication2) => {
+      this.#roster = applyVaultQuota(this.#roster, publication2).roster;
+    });
   }
   #assertOpen(signal) {
     this.#shutdown.signal.throwIfAborted();
@@ -18191,7 +18480,7 @@ class ClaustrumConsumer {
       this.#shutdown.signal,
       ...signal ? [signal] : []
     ]);
-    return new Promise((resolve7, reject) => {
+    return new Promise((resolve9, reject) => {
       const cleanup2 = () => {
         combined.signal.removeEventListener("abort", abort);
         combined.dispose();
@@ -18206,7 +18495,7 @@ class ClaustrumConsumer {
         if (combined.signal.aborted)
           reject(combined.signal.reason);
         else
-          resolve7(value);
+          resolve9(value);
       }, (error) => {
         cleanup2();
         reject(error);
@@ -18292,11 +18581,9 @@ class ClaustrumConsumer {
       let discovered;
       const roster = await refreshVaultRoster({
         path: this.#options.rosterPath,
-        custody: {
-          discover: async (signal) => {
-            discovered = await custody.discover(signal);
-            return discovered;
-          }
+        custody,
+        onInventory: (inventory) => {
+          discovered = inventory;
         },
         isActive: () => this.#active(),
         signal: this.#shutdown.signal,
@@ -18309,7 +18596,7 @@ class ClaustrumConsumer {
       });
       this.#assertOpen();
       const changed = roster?.view !== this.#roster?.view;
-      this.#roster = roster;
+      this.#roster = pendingVaultQuota(this.#options.rosterPath, roster);
       custody.retain(roster?.rows ?? []);
       if (discovered && roster?.view !== undefined)
         this.#grantReach = discovered.grantReach ? { view: roster.view, reach: discovered.grantReach } : undefined;
@@ -18406,7 +18693,7 @@ class ClaustrumConsumer {
       return;
     try {
       await readClaustrumEnrollmentToken(this.#options.tokenPath);
-      const roster = await readVaultRoster(this.#options.rosterPath);
+      const roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
       const row = roster?.rows.find((entry2) => entry2.routeId === routeId);
       return this.#normalizeInsulaQuota(row?.accountIdentity);
     } catch {
@@ -18419,7 +18706,7 @@ class ClaustrumConsumer {
       return { miss: "unreachable" };
     try {
       await readClaustrumEnrollmentToken(this.#options.tokenPath);
-      const roster = await readVaultRoster(this.#options.rosterPath);
+      const roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
       const account = roster?.rows.find((row) => row.routeId === routeId)?.accountIdentity;
       if (!account || !this.#insula)
         return { miss: "unreachable" };
@@ -18463,7 +18750,7 @@ class ClaustrumConsumer {
       this.#insula = undefined;
       throw new ClaustrumConsumerError("not-active", "Claustrum scoped custody is not active");
     }
-    const current = await readVaultRoster(this.#options.rosterPath);
+    const current = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
     this.#assertOpen(signal);
     const observed = roster.rows.find((row) => row.routeId === routeId);
     const configured = current?.rows.find((row) => row.routeId === routeId);
@@ -18531,17 +18818,17 @@ class ClaustrumConsumer {
   async decline(routeId) {
     this.#assertOpen();
     await declineVaultRoute(this.#options.rosterPath, routeId);
-    this.#roster = await readVaultRoster(this.#options.rosterPath);
+    this.#roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
     this.#custody?.retain(this.#roster?.rows ?? []);
   }
   async accept(routeId) {
     this.#assertOpen();
     await acceptVaultRoute(this.#options.rosterPath, routeId);
-    this.#roster = await readVaultRoster(this.#options.rosterPath);
+    this.#roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
   }
   async recordQuota(routeId, observation, attempt) {
     this.#assertOpen();
-    const kept = await recordVaultQuota(this.#options.rosterPath, {
+    return recordVaultQuota(this.#options.rosterPath, {
       routeId,
       observation,
       credentialId: attempt.credentialId,
@@ -18553,20 +18840,14 @@ class ClaustrumConsumer {
         expectedAccountIdentity: attempt.expectedAccountIdentity
       }
     });
-    if (kept)
-      this.#roster = await readVaultRoster(this.#options.rosterPath);
-    return kept;
   }
   async recordAccountQuota(routeId, accountIdentity, observation) {
     this.#assertOpen();
-    const kept = await recordVaultAccountQuota(this.#options.rosterPath, {
+    return recordVaultAccountQuota(this.#options.rosterPath, {
       routeId,
       accountIdentity,
       observation
     });
-    if (kept)
-      this.#roster = await readVaultRoster(this.#options.rosterPath);
-    return kept;
   }
   close() {
     if (this.#shutdown.signal.aborted)
@@ -18581,6 +18862,12 @@ class ClaustrumConsumer {
     this.#insula = undefined;
     this.#roster = undefined;
     this.#grantReach = undefined;
+    this.#releaseQuotaWriter();
+    forgetPendingVaultDiscovery(this.#options.rosterPath);
+  }
+  async dispose() {
+    this.close();
+    await this.#releaseQuotaWriter();
   }
 }
 
@@ -18630,7 +18917,7 @@ class NativeCustodyError extends Error {
 function createNativeCustody(options) {
   const env = { ...options.env ?? process.env };
   const connect = options.connect;
-  const logger2 = options.logger;
+  const logger3 = options.logger;
   let closed = false;
   let revoked = false;
   let client;
@@ -18677,8 +18964,8 @@ function createNativeCustody(options) {
     let stopped = false;
     let inner;
     let finish = () => {};
-    const ended = new Promise((resolve7) => {
-      finish = resolve7;
+    const ended = new Promise((resolve9) => {
+      finish = resolve9;
     });
     const failed = (error) => stopped || closed || error instanceof NativeCustodyError ? { kind: "stopped" } : classifyVaultFailure(error) === "unreachable" ? { kind: "transport_lost", error: new ClaustrumUnreachableError } : { kind: "ended" };
     Promise.resolve().then(connection).then((owned) => {
@@ -18727,8 +19014,8 @@ function createNativeCustody(options) {
     ...options.setTimeout && { setTimeoutImpl: options.setTimeout },
     ...options.clearTimeout && { clearTimeoutImpl: options.clearTimeout },
     logger: {
-      warn: () => logger2?.warn("Native custody inventory record skipped"),
-      debug: () => logger2?.debug("Native custody failure reported")
+      warn: () => logger3?.warn("Native custody inventory record skipped"),
+      debug: () => logger3?.debug("Native custody failure reported")
     }
   });
   async function run(operation, signal) {
@@ -18852,13 +19139,13 @@ function createNativeCustody(options) {
 }
 
 // src/native-vault-invalidation.ts
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve9 } from "node:path";
 var holders = new Set;
 function watchNativeVaultAuthority(holder) {
   const held = {
     ...holder,
-    roster: resolve7(holder.roster),
-    tokenPath: resolve7(holder.tokenPath)
+    roster: resolve9(holder.roster),
+    tokenPath: resolve9(holder.tokenPath)
   };
   holders.add(held);
   return () => {
@@ -18867,12 +19154,12 @@ function watchNativeVaultAuthority(holder) {
 }
 function retainNativeVaultRoster(path2, roster) {
   for (const holder of holders)
-    if (holder.roster === resolve7(path2))
+    if (holder.roster === resolve9(path2))
       holder.retain(roster);
 }
 function closeNativeVaultAuthority(tokenPath) {
   for (const holder of holders)
-    if (holder.tokenPath === resolve7(tokenPath))
+    if (holder.tokenPath === resolve9(tokenPath))
       holder.close();
 }
 
@@ -19118,12 +19405,12 @@ async function joinNativePoolWrite(paths, signals, check, onLockEvent) {
 function pause(ms, signals) {
   if (signals.some((signal) => signal.aborted))
     return Promise.resolve();
-  return new Promise((resolve8) => {
+  return new Promise((resolve10) => {
     const wake = () => {
       clearTimeout(timer);
       for (const signal of signals)
         signal.removeEventListener("abort", wake);
-      resolve8();
+      resolve10();
     };
     const timer = setTimeout(wake, ms);
     for (const signal of signals)
@@ -19379,7 +19666,7 @@ function createNativeRefreshCoordinator(options) {
           name: spec.name,
           timeoutMs: POOL_LOCK_DEFAULTS.timeoutMs
         });
-      await new Promise((resolve8) => setTimeout(resolve8, Math.min(POOL_LOCK_DEFAULTS.retryMs, remaining)));
+      await new Promise((resolve10) => setTimeout(resolve10, Math.min(POOL_LOCK_DEFAULTS.retryMs, remaining)));
     }
   }
   async function run(job, request) {
@@ -20819,7 +21106,7 @@ function createNativeUsagePublisher(channel) {
   return {
     observe,
     publish(write) {
-      observe(new Promise((resolve8) => setTimeout(resolve8, 0)).then(write));
+      observe(new Promise((resolve10) => setTimeout(resolve10, 0)).then(write));
     },
     async drain() {
       while (pending.size)
@@ -20895,7 +21182,7 @@ class NativeQuotaObservations extends Map {
 }
 
 // src/native-runtime-registry.ts
-import { resolve as resolve8 } from "node:path";
+import { resolve as resolve10 } from "node:path";
 var identities = new WeakMap;
 var nextIdentity = 0;
 function nativeRuntimeOptionIdentity(value) {
@@ -20924,14 +21211,14 @@ function nativeRuntimeStorageKey(options) {
       "runtime",
       "journal",
       "roster"
-    ].map((field) => resolve8(paths[field])),
-    resolve8(enrollment.tokenPath),
-    resolve8(enrollment.statePath),
-    resolve8(connection)
+    ].map((field) => resolve10(paths[field])),
+    resolve10(enrollment.tokenPath),
+    resolve10(enrollment.statePath),
+    resolve10(connection)
   ]);
 }
 function nativeRuntimeConnectionFile(host, env) {
-  return resolve8(resolveClaustrumConnectionPath(host === "pi" ? env.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE : undefined, host === "pi" ? {
+  return resolve10(resolveClaustrumConnectionPath(host === "pi" ? env.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE : undefined, host === "pi" ? {
     ...env,
     OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE: undefined
   } : env));
@@ -21533,8 +21820,8 @@ function mergeHeaderQuotaSnapshot(existing, incoming) {
 // src/quota-manager.ts
 var nativeSetTimeout = globalThis.setTimeout;
 function pauseOnRealTimer(ms) {
-  return new Promise((resolve9) => {
-    const id2 = nativeSetTimeout(resolve9, ms);
+  return new Promise((resolve11) => {
+    const id2 = nativeSetTimeout(resolve11, ms);
     if (typeof id2 === "object" && "unref" in id2)
       id2.unref();
   });
@@ -22301,7 +22588,8 @@ async function publishNativeVaultRosterSeed(paths, input, options = {}) {
 }
 async function publishNativeVaultRuntimeSeed(paths, state, options = {}) {
   const imported = decodeNativeRuntime(captureNativePlainData(state), paths.storageId);
-  await mutateVaultRoster(paths.roster, async (roster, lease) => {
+  const assertPinned = async () => {
+    const roster = await readVaultRoster(paths.roster);
     for (const [id2, entry2] of Object.entries(imported.accounts)) {
       if (entry2.binding.kind !== "custody")
         continue;
@@ -22310,13 +22598,13 @@ async function publishNativeVaultRuntimeSeed(paths, state, options = {}) {
       if (!row?.accountIdentity || row.accountIdentity !== binding2.accountIdentity || row.credentialId !== binding2.credentialId && !row.aliases?.includes(binding2.credentialId))
         throw new NativeRuntimeError("publication-refused");
     }
-    await updateNativeRuntime(paths.runtime, paths.storageId, () => imported, {
-      beforeRename: async () => {
-        await options.assertOwned?.();
-        await lease.assertOwned();
-      }
-    });
-    return { result: undefined };
+  };
+  await assertPinned();
+  await updateNativeRuntime(paths.runtime, paths.storageId, () => imported, {
+    beforeRename: async () => {
+      await options.assertOwned?.();
+      await assertPinned();
+    }
   });
 }
 var NATIVE_VAULT_CONNECT_TIMEOUT_MS = 2000;
@@ -22363,11 +22651,6 @@ function createNativeVaultRuntime(options) {
     onLockEvent: options.onLockEvent
   });
   const observeLock = nativeLockObserver(options.onLockEvent);
-  const observeRosterLock = () => observeLock?.({
-    type: "acquiring",
-    name: "claustrum-roster-write",
-    path: paths.roster
-  });
   let rosterWatch;
   let rosterWatching = false;
   let rosterView;
@@ -22584,46 +22867,49 @@ function createNativeVaultRuntime(options) {
     await requireActive(signal);
     if (absentOnly && !await nativeVaultFileAbsent(paths.config))
       return;
-    observeRosterLock();
-    await mutateVaultRoster(paths.roster, async (roster, lease) => {
-      if (absentOnly && !await nativeVaultFileAbsent(paths.config))
-        return { result: undefined };
-      const primary = roster?.rows.find((row) => (row.credentialId === NATIVE_PRIMARY_CREDENTIAL_ID || row.aliases?.includes(NATIVE_PRIMARY_CREDENTIAL_ID)) && row.credentialType === "oauth" && !row.stale && !row.unclaimed && typeof row.accountIdentity === "string" && row.accountIdentity.length > 0);
-      const read = await store.readSettings();
-      if (read.status !== "ready")
-        throw new NativeCustodyError("invalid-state");
-      const previous = nativeVaultPrimaryPin(read.settings);
-      if (!absentOnly && (!primary && !previous || primary && previous?.routeId === primary.routeId && previous.credentialId === NATIVE_PRIMARY_CREDENTIAL_ID && previous.accountIdentity === primary.accountIdentity))
-        return { result: undefined };
-      const writer = createNativePoolStore({
-        paths,
-        quota: nativeQuotaCodec,
-        onLockEvent: options.onLockEvent,
-        onStep: async (point) => {
-          if (point === "before-config-write" || point === "before-state-write") {
-            await requireActive(signal);
-            await lease.assertOwned();
-          }
-        }
-      });
-      await writer.updateSettings(async (settings) => {
-        if (absentOnly && !await nativeVaultFileAbsent(paths.config))
-          return settings;
-        if (primary) {
-          settings.mainAccountId = primary.routeId;
-          settings.claustrum = {
-            primaryAccount: {
-              credentialId: NATIVE_PRIMARY_CREDENTIAL_ID,
-              accountId: primary.accountIdentity
-            }
-          };
-        } else {
-          delete settings.mainAccountId;
-          delete settings.claustrum;
+    const roster = await readVaultRoster(paths.roster);
+    if (absentOnly && !await nativeVaultFileAbsent(paths.config))
+      return;
+    const primaryFor = (roster2) => roster2?.rows.find((row) => (row.credentialId === NATIVE_PRIMARY_CREDENTIAL_ID || row.aliases?.includes(NATIVE_PRIMARY_CREDENTIAL_ID)) && row.credentialType === "oauth" && !row.stale && !row.unclaimed && typeof row.accountIdentity === "string" && row.accountIdentity.length > 0);
+    const primary = primaryFor(roster);
+    const read = await store.readSettings();
+    if (read.status !== "ready")
+      throw new NativeCustodyError("invalid-state");
+    const previous = nativeVaultPrimaryPin(read.settings);
+    if (!absentOnly && (!primary && !previous || primary && previous?.routeId === primary.routeId && previous.credentialId === NATIVE_PRIMARY_CREDENTIAL_ID && previous.accountIdentity === primary.accountIdentity))
+      return;
+    const assertPrimary = async () => {
+      await requireActive(signal);
+      const pinned = primaryFor(await readVaultRoster(paths.roster));
+      if (pinned?.routeId !== primary?.routeId || pinned?.accountIdentity !== primary?.accountIdentity)
+        throw new NativeRuntimeError("publication-refused");
+    };
+    const writer = createNativePoolStore({
+      paths,
+      quota: nativeQuotaCodec,
+      onLockEvent: options.onLockEvent,
+      onStep: async (point) => {
+        if (point === "before-config-write" || point === "before-state-write") {
+          await assertPrimary();
         }
+      }
+    });
+    await writer.updateSettings(async (settings) => {
+      if (absentOnly && !await nativeVaultFileAbsent(paths.config))
         return settings;
-      });
-      return { result: undefined };
+      if (primary) {
+        settings.mainAccountId = primary.routeId;
+        settings.claustrum = {
+          primaryAccount: {
+            credentialId: NATIVE_PRIMARY_CREDENTIAL_ID,
+            accountId: primary.accountIdentity
+          }
+        };
+      } else {
+        delete settings.mainAccountId;
+        delete settings.claustrum;
+      }
+      return settings;
     });
   }
   async function rowFor(roster, routeId) {
@@ -23003,56 +23289,52 @@ function createNativeVaultRuntime(options) {
     ]);
     if ((versions.get(key) ?? 0) > receipt.recordVersion)
       return false;
-    observeRosterLock();
-    return mutateVaultRoster(paths.roster, async (roster, lease) => {
-      const row = await rowFor(roster, route.logicalId);
-      if (!row?.accountIdentity || row.routeId !== route.routeId || row.accountIdentity !== receipt.assertedAccountIdentity || row.credentialId !== receipt.credentialId && !row.aliases?.includes(receipt.credentialId))
-        return { result: false };
-      const accountIdentity = row.accountIdentity;
-      let kept = false;
-      try {
-        const outcome = await updateNativeRuntimeOptional(paths.runtime, paths.storageId, (current) => {
-          const old = current.accounts[route.routeId];
-          const binding2 = old?.binding;
-          if (binding2?.kind === "custody" && binding2.credentialId === receipt.credentialId && binding2.accountIdentity === receipt.assertedAccountIdentity && binding2.recordVersion > receipt.recordVersion)
-            throw new NativeRuntimeError("runtime-conflict");
-          const same = binding2?.kind === "custody" && binding2.accountIdentity === receipt.assertedAccountIdentity;
-          current.accounts[route.routeId] = change({
-            ...same ? old : {},
-            binding: {
-              kind: "custody",
-              storageId: paths.storageId,
-              routeId: route.routeId,
-              credentialId: receipt.credentialId,
-              accountIdentity,
-              recordVersion: receipt.recordVersion
-            }
-          });
-          kept = true;
-          return current;
-        }, {
-          onLockEvent: options.onLockEvent,
-          beforeRename: async () => {
-            await requireActive();
-            const pinned = await rowFor(roster, route.logicalId);
-            if (!pinned || pinned.routeId !== route.routeId || pinned.accountIdentity !== receipt.assertedAccountIdentity)
-              throw new NativeRuntimeError("publication-refused");
-            const superseded = (versions.get(key) ?? 0) > receipt.recordVersion;
-            if (superseded && onSuperseded === "refuse")
-              throw new NativeRuntimeError("runtime-conflict");
-            await lease.assertOwned();
-            return superseded ? "skip" : "publish";
+    const row = await rowFor(await readVaultRoster(paths.roster), route.logicalId);
+    if (!row?.accountIdentity || row.routeId !== route.routeId || row.accountIdentity !== receipt.assertedAccountIdentity || row.credentialId !== receipt.credentialId && !row.aliases?.includes(receipt.credentialId))
+      return false;
+    const accountIdentity = row.accountIdentity;
+    let kept = false;
+    try {
+      const outcome = await updateNativeRuntimeOptional(paths.runtime, paths.storageId, (current) => {
+        const old = current.accounts[route.routeId];
+        const binding2 = old?.binding;
+        if (binding2?.kind === "custody" && binding2.credentialId === receipt.credentialId && binding2.accountIdentity === receipt.assertedAccountIdentity && binding2.recordVersion > receipt.recordVersion)
+          throw new NativeRuntimeError("runtime-conflict");
+        const same = binding2?.kind === "custody" && binding2.accountIdentity === receipt.assertedAccountIdentity && (binding2.credentialId === row.credentialId || row.aliases?.includes(binding2.credentialId));
+        current.accounts[route.routeId] = change({
+          ...same ? old : {},
+          binding: {
+            kind: "custody",
+            storageId: paths.storageId,
+            routeId: route.routeId,
+            credentialId: receipt.credentialId,
+            accountIdentity,
+            recordVersion: receipt.recordVersion
           }
         });
-        if (outcome.status === "skipped")
-          return { result: false };
-      } catch (error) {
-        if (error instanceof NativeRuntimeError && error.code === "runtime-conflict")
-          return { result: false };
-        throw error;
-      }
-      return { result: kept };
-    });
+        kept = true;
+        return current;
+      }, {
+        onLockEvent: options.onLockEvent,
+        beforeRename: async () => {
+          await requireActive();
+          const pinned = await rowFor(await readVaultRoster(paths.roster), route.logicalId);
+          if (!pinned || pinned.routeId !== route.routeId || pinned.accountIdentity !== receipt.assertedAccountIdentity || pinned.credentialId !== receipt.credentialId && !pinned.aliases?.includes(receipt.credentialId))
+            throw new NativeRuntimeError("publication-refused");
+          const superseded = (versions.get(key) ?? 0) > receipt.recordVersion;
+          if (superseded && onSuperseded === "refuse")
+            throw new NativeRuntimeError("runtime-conflict");
+          return superseded ? "skip" : "publish";
+        }
+      });
+      if (outcome.status === "skipped")
+        return false;
+    } catch (error) {
+      if (error instanceof NativeRuntimeError && error.code === "runtime-conflict")
+        return false;
+      throw error;
+    }
+    return kept;
   }
   async function fetchReading(routeId, fetchImpl, signal, read, onFailure, dispatch) {
     const combined = signalFor(signal);
@@ -23136,7 +23418,7 @@ function recencyOnly(patch) {
   return keys4.length === 1 && keys4[0] === "lastUsed" && typeof patch.lastUsed === "number";
 }
 function waitFor(pending, signal) {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve11, reject) => {
     const abort = () => {
       cleanup2();
       reject(signal.reason);
@@ -23145,7 +23427,7 @@ function waitFor(pending, signal) {
     signal.addEventListener("abort", abort, { once: true });
     pending.then((value) => {
       cleanup2();
-      signal.aborted ? reject(signal.reason) : resolve9(value);
+      signal.aborted ? reject(signal.reason) : resolve11(value);
     }, (error) => {
       cleanup2();
       reject(error);
@@ -23219,7 +23501,7 @@ function leaseNativeVaultRuntime(use, close) {
 // src/pool-paths.ts
 import { createHash as createHash17 } from "node:crypto";
 import { realpath as realpath3 } from "node:fs/promises";
-import { basename as basename7, dirname as dirname13, join as join14, resolve as resolve9 } from "node:path";
+import { basename as basename7, dirname as dirname13, join as join14, resolve as resolve11 } from "node:path";
 
 // src/sticky-routing.ts
 import { createHash as createHash16, randomUUID as randomUUID14 } from "node:crypto";
@@ -23348,8 +23630,8 @@ function migrateStickyRoutingState(source2, rowIdMap) {
       const assignment = state.assignments[String(index)];
       if (!isRecord13(original) || !assignment)
         throw new Error;
-      const fields = Object.keys(assignment).filter((field) => field !== "affinityModelId" || Object.hasOwn(original, "affinityModelId"));
-      if (Object.keys(original).length !== fields.length || fields.some((field) => !Object.hasOwn(original, field) || !Object.is(original[field], Reflect.get(assignment, field)))) {
+      const fields2 = Object.keys(assignment).filter((field) => field !== "affinityModelId" || Object.hasOwn(original, "affinityModelId"));
+      if (Object.keys(original).length !== fields2.length || fields2.some((field) => !Object.hasOwn(original, field) || !Object.is(original[field], Reflect.get(assignment, field)))) {
         throw new Error;
       }
       const accountId = rowIdMap.get(assignment.accountId);
@@ -23575,7 +23857,7 @@ class StickySessionRouter {
       if (!wait || performance.now() >= deadline) {
         throw new Error("Timed out acquiring sticky routing state lock");
       }
-      await new Promise((resolve9) => setTimeout(resolve9, STICKY_ROUTING_LOCK_POLL_MS));
+      await new Promise((resolve11) => setTimeout(resolve11, STICKY_ROUTING_LOCK_POLL_MS));
     }
   }
   recoverLocalPins() {
@@ -23941,7 +24223,7 @@ function resolveLocalRoutingDestination(host, paths, env) {
   return (host === "opencode" ? env.OPENCODE_ANTHROPIC_AUTH_ROUTING_STATE_FILE : env.PI_ANTHROPIC_AUTH_ROUTING_STATE_FILE) || getStickyRoutingStatePath(paths.config);
 }
 async function canonicalPath(path2) {
-  const absolute = resolve9(path2);
+  const absolute = resolve11(path2);
   try {
     return await realpath3(absolute);
   } catch (error) {
@@ -24532,7 +24814,7 @@ class PersistentRelaySession {
       return;
     if (this.connecting)
       return await this.connecting;
-    this.connecting = new Promise((resolve10, reject) => {
+    this.connecting = new Promise((resolve12, reject) => {
       const url = toWebSocketUrl(this.config.url, this.config.token);
       const parsed = new URL(url);
       parsed.searchParams.set("affinity", this.affinity);
@@ -24554,7 +24836,7 @@ class PersistentRelaySession {
           if (message.type === "ready") {
             this.timers.clearTimeout(timeout);
             this.serverState = message.state;
-            resolve10();
+            resolve12();
             return;
           }
           this.handleMessage(message);
@@ -24606,15 +24888,15 @@ class PersistentRelaySession {
     const sentAt = perfNowMs();
     let resolveDone;
     let rejectDone;
-    const done = new Promise((resolve10, reject) => {
-      resolveDone = resolve10;
+    const done = new Promise((resolve12, reject) => {
+      resolveDone = resolve12;
       rejectDone = reject;
     });
-    const response = new Promise((resolve10, reject) => {
+    const response = new Promise((resolve12, reject) => {
       const pending = {
         payload,
         bodyText,
-        resolve: resolve10,
+        resolve: resolve12,
         reject,
         streamDone: false,
         accepted: false,
@@ -25938,7 +26220,7 @@ function createNativeAccountRuntime(options) {
       const { mode, paths: paths2, store: store2 } = await selectedStorage();
       for (let attempt = 0;attempt < 4; attempt++) {
         if (attempt)
-          await new Promise((resolve10) => setTimeout(resolve10, 10));
+          await new Promise((resolve12) => setTimeout(resolve12, 10));
         const settings = await store2.readSettings();
         if (settings.status !== "ready")
           throw new NativeRuntimeError("publication-refused");
@@ -28234,8 +28516,8 @@ async function runNativeCustodyActivation(options, hooks = {}) {
 }
 async function commitMode(paths, routingPath, plan, context) {
   let openGate = () => {};
-  const gate = new Promise((resolve10) => {
-    openGate = resolve10;
+  const gate = new Promise((resolve12) => {
+    openGate = resolve12;
   });
   let leases;
   let scope;
@@ -28864,7 +29146,7 @@ function readPlain(value, allowed) {
   const prototype = Object.getPrototypeOf(value);
   if (prototype !== Object.prototype && prototype !== null)
     return "malformed";
-  const fields = new Map;
+  const fields2 = new Map;
   let unknownKey = false;
   for (const key of Reflect.ownKeys(value)) {
     if (typeof key !== "string")
@@ -28875,9 +29157,9 @@ function readPlain(value, allowed) {
     if (!allowed.includes(key))
       unknownKey = true;
     else
-      fields.set(key, descriptor.value);
+      fields2.set(key, descriptor.value);
   }
-  return unknownKey ? "unknown-key" : fields;
+  return unknownKey ? "unknown-key" : fields2;
 }
 function readArray(value) {
   if (value === null || typeof value !== "object")
@@ -28931,13 +29213,13 @@ function readKillswitchEntries(value) {
     return;
   const entries = [];
   for (const item of items2) {
-    const fields = readPlain(item, ENTRY_KEYS);
-    if (!(fields instanceof Map))
+    const fields2 = readPlain(item, ENTRY_KEYS);
+    if (!(fields2 instanceof Map))
       return;
-    const account = fields.get("account");
-    const fh = fields.get("fh");
-    const sd = fields.get("sd");
-    const scoped = fields.get("scoped");
+    const account = fields2.get("account");
+    const fh = fields2.get("fh");
+    const sd = fields2.get("sd");
+    const scoped = fields2.get("scoped");
     if (!isKillswitchAccount(account))
       return;
     if (!isDigitInteger(fh) || !isDigitInteger(sd))
@@ -29021,14 +29303,14 @@ var CONTEXT_KEYS = [
   "signal"
 ];
 function readContext(value) {
-  const fields = readPlain(value, CONTEXT_KEYS);
-  if (!(fields instanceof Map))
+  const fields2 = readPlain(value, CONTEXT_KEYS);
+  if (!(fields2 instanceof Map))
     return;
-  const interactive = fields.get("interactive");
-  const custodyMode = fields.get("custodyMode");
-  const confirmed = fields.get("confirmed");
-  const sessionId = fields.get("sessionId");
-  const rawSignal = fields.get("signal");
+  const interactive = fields2.get("interactive");
+  const custodyMode = fields2.get("custodyMode");
+  const confirmed = fields2.get("confirmed");
+  const sessionId = fields2.get("sessionId");
+  const rawSignal = fields2.get("signal");
   if (typeof interactive !== "boolean")
     return;
   if (custodyMode !== "local" && custodyMode !== "claustrum")
@@ -29128,9 +29410,9 @@ var DISCONNECT_RESULTS = new Set([
   "conflict"
 ]);
 function readOutcome(action, outcome) {
-  const fields = readPlain(outcome, ["ok", "text"]);
-  const ok = fields instanceof Map ? fields.get("ok") : undefined;
-  const text5 = fields instanceof Map ? fields.get("text") : undefined;
+  const fields2 = readPlain(outcome, ["ok", "text"]);
+  const ok = fields2 instanceof Map ? fields2.get("ok") : undefined;
+  const text5 = fields2 instanceof Map ? fields2.get("text") : undefined;
   if (typeof ok !== "boolean" || typeof text5 !== "string")
     return Object.freeze({ status: "failed", action, code: "invalid-outcome" });
   return Object.freeze({ status: "executed", action, ok, text: text5 });
@@ -29173,12 +29455,12 @@ function disconnectFailureCode(error) {
   return "execution-failed";
 }
 function createNativeMenuExecutor(options) {
-  const fields = readPlain(options, ["host", "dispatch", "disconnectVault"]);
-  if (!(fields instanceof Map))
+  const fields2 = readPlain(options, ["host", "dispatch", "disconnectVault"]);
+  if (!(fields2 instanceof Map))
     throw new TypeError("Native menu executor options are invalid");
-  const host = fields.get("host");
-  const dispatch = fields.get("dispatch");
-  const disconnectVault = fields.get("disconnectVault");
+  const host = fields2.get("host");
+  const dispatch = fields2.get("dispatch");
+  const disconnectVault = fields2.get("disconnectVault");
   if (!HOSTS2.has(host))
     throw invalidOption2("host");
   if (typeof dispatch !== "function" || utilTypes7.isProxy(dispatch))
@@ -29933,11 +30215,11 @@ async function refreshForRequest(runtime2, ready) {
         break;
       if (combined.aborted)
         break;
-      await new Promise((resolve10) => {
+      await new Promise((resolve12) => {
         const finish = () => {
           clearTimeout(pause2);
           combined.removeEventListener("abort", finish);
-          resolve10();
+          resolve12();
         };
         const pause2 = setTimeout(finish, 25);
         combined.addEventListener("abort", finish, { once: true });
@@ -29953,16 +30235,16 @@ async function refreshForRequest(runtime2, ready) {
 function waitForRequest(pending, signal) {
   if (!signal)
     return pending;
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve12, reject) => {
     const abort = () => reject(signal.reason);
     signal.addEventListener("abort", abort, { once: true });
-    pending.then(resolve10, reject).finally(() => signal.removeEventListener("abort", abort));
+    pending.then(resolve12, reject).finally(() => signal.removeEventListener("abort", abort));
     if (signal.aborted)
       abort();
   });
 }
 // src/native-vault-connection.ts
-import { dirname as dirname17, join as join16, resolve as resolve11 } from "node:path";
+import { dirname as dirname17, join as join16, resolve as resolve13 } from "node:path";
 // ../../node_modules/@cortexkit/common-auth/dist/opencode2/integration.js
 var PLACEHOLDER_PREFIX = "common-auth-placeholder";
 var PLACEHOLDER_LIFETIME_MS = 365 * 24 * 60 * 60 * 1000;
@@ -29973,7 +30255,7 @@ function placeholderSecret(integrationID) {
 import { createHash as createHash20 } from "node:crypto";
 import { constants as constants4 } from "node:fs";
 import { lstat as lstat9, mkdir as mkdir13, open as open10, unlink as unlink8 } from "node:fs/promises";
-import { dirname as dirname16, resolve as resolve10 } from "node:path";
+import { dirname as dirname16, resolve as resolve12 } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 
 // ../../node_modules/@cortexkit/common-auth/dist/pi-slot/lock.js
@@ -30066,7 +30348,7 @@ async function acquirePiLock(authPath, onCompromised, onRenew) {
     if (!released && lastUpdate + RENEWAL_STALE < Date.now())
       compromise();
   }
-  function schedule(delay3 = UPDATE) {
+  function schedule2(delay3 = UPDATE) {
     if (released)
       return;
     timer = setTimeout(() => {
@@ -30080,7 +30362,7 @@ async function acquirePiLock(authPath, onCompromised, onRenew) {
     if (errorCode2(error) === "ENOENT" || lastUpdate + RENEWAL_STALE < Date.now())
       compromise();
     else
-      schedule(1000);
+      schedule2(1000);
   }
   async function update() {
     assertFresh();
@@ -30113,14 +30395,14 @@ async function acquirePiLock(authPath, onCompromised, onRenew) {
     mtime = next.getTime();
     lastUpdate = Date.now();
     active.set(path2, { ...identity2, mtime, renewedAt: lastUpdate });
-    schedule();
+    schedule2();
   }
   onRenew?.(async () => {
     if (timer)
       clearTimeout(timer);
     await update();
   });
-  schedule();
+  schedule2();
   return {
     assertFresh,
     async release() {
@@ -30361,8 +30643,8 @@ function createPiSlot(options, onStep, hooks) {
   if (!provider || !options.authPath || !options.stashPath || !placeholderKey || placeholderKey.startsWith("!") || placeholderKey.includes("$") || !Number.isFinite(timeout) || timeout < 0) {
     throw new PiSlotError("invalid-options");
   }
-  const authPath = resolve10(options.authPath);
-  const stashPath = resolve10(options.stashPath);
+  const authPath = resolve12(options.authPath);
+  const stashPath = resolve12(options.stashPath);
   if (authPath === stashPath || stashPath === `${authPath}.lock`) {
     throw new PiSlotError("invalid-options");
   }
@@ -30500,7 +30782,7 @@ function createPiSlot(options, onStep, hooks) {
 // src/native-vault-connection.ts
 function nativePiAuthSlotPaths(options) {
   return {
-    authPath: resolve11(options.authPath),
+    authPath: resolve13(options.authPath),
     stashPath: join16(dirname17(getHostClaustrumEnrollmentPaths("pi", options.env).tokenPath), "pi-auth-slot", "anthropic.json"),
     provider: "anthropic",
     placeholderKey: placeholderSecret("anthropic")
@@ -30523,7 +30805,7 @@ import { createHash as createHash21 } from "node:crypto";
 import { realpathSync as realpathSync2 } from "node:fs";
 import { mkdir as mkdir14, readdir as readdir3, rm as rm8, stat as stat9, writeFile as writeFile5 } from "node:fs/promises";
 import { tmpdir as tmpdir6 } from "node:os";
-import { join as join17, resolve as resolve12 } from "node:path";
+import { join as join17, resolve as resolve14 } from "node:path";
 var CLAUDE_PRIME_COMMAND_NAME = "claude-prime";
 var PRIME_TICK_MS = 60000;
 var PRIME_DUE_OFFSET_MS = 60000;
@@ -30714,7 +30996,7 @@ function defaultMarkerDir() {
   return join17(tmpdir6(), "opencode-anthropic-auth", "prime");
 }
 function primeStorageFingerprint(storagePath) {
-  const absolutePath = resolve12(storagePath);
+  const absolutePath = resolve14(storagePath);
   let canonicalPath2;
   try {
     canonicalPath2 = realpathSync2(absolutePath);