@cortexkit/anthropic-auth-core 2.3.0 → 2.4.0

package/dist/index.js

@@ -1036,8 +1036,15 @@ async function acquireRefreshFileLockWithClock(options) {
         return "missing";
       throw error;
     }
-    if (windowsPrivateFiles)
-      await verifyPrivate(evictPath, "directory", true);
+    if (windowsPrivateFiles) {
+      try {
+        await verifyPrivate(evictPath, "directory", true);
+      } catch (error) {
+        if (error.code === "ENOENT")
+          return "missing";
+        throw error;
+      }
+    }
     if (evictStat.mtimeMs + EVICT_TTL > now())
       return "fresh";
     if (options.onStep)
@@ -1062,8 +1069,8 @@ async function acquireRefreshFileLockWithClock(options) {
     } catch (error) {
       if (error.code === "EEXIST") {
         if (windowsPrivateFiles) {
-          await verifyPrivate(evictPath, "directory", true);
           try {
+            await verifyPrivate(evictPath, "directory", true);
             await readPrivateText(evictOwnerPath, true);
           } catch (ownerError) {
             if (ownerError.code !== "ENOENT")
@@ -1624,7 +1631,7 @@ async function refuseWritableAncestor(parent, options = {}) {
     throw new ClaustrumConsumerError("unsafe-file", `Claustrum enrollment parent refused: ${error.path} (${error.reason ?? error.code}). Use a folder that other users cannot write or replace.`);
   }
 }
-async function ensurePrivateDirectory2(directory, options = {}) {
+async function ensureClaustrumPrivateDirectory(directory, options = {}, what = "enrollment directory") {
   if (windowsPrivateFiles) {
     await ensurePrivateDirectory(directory, false, ancestorPolicyOptions(options));
     return;
@@ -1633,14 +1640,14 @@ async function ensurePrivateDirectory2(directory, options = {}) {
   const metadata = await stat2(directory);
   const uid = process.geteuid?.();
   if (uid !== undefined && metadata.uid !== uid) {
-    throw new ClaustrumConsumerError("unsafe-file", "Claustrum enrollment directory must be owned by the current user");
+    throw new ClaustrumConsumerError("unsafe-file", `Claustrum ${what} must be owned by the current user`);
   }
   if ((metadata.mode & 63) !== 0)
     await chmod(directory, 448);
 }
 async function writeStateAtomic(path, state, ancestorOptions = {}) {
   const parent = dirname4(path);
-  await ensurePrivateDirectory2(parent, ancestorOptions);
+  await ensureClaustrumPrivateDirectory(parent, ancestorOptions);
   await refuseWritableAncestor(parent, ancestorOptions);
   const bytes = `${JSON.stringify(state)}
 `;
@@ -1808,7 +1815,7 @@ class ClaustrumEnrollmentManager {
     return statusFromState(blocked);
   }
   async reconcile() {
-    await ensurePrivateDirectory2(dirname4(this.#paths.statePath), this.#ancestorOptions);
+    await ensureClaustrumPrivateDirectory(dirname4(this.#paths.statePath), this.#ancestorOptions);
     const lock = await acquireRefreshFileLock({
       name: "ceremony",
       path: this.#paths.statePath,
@@ -1931,7 +1938,7 @@ class ClaustrumEnrollmentManager {
           await writeStateAtomic(this.#paths.statePath, denied, this.#ancestorOptions);
           return statusFromState(denied);
         }
-        await ensurePrivateDirectory2(dirname4(this.#paths.tokenPath), this.#ancestorOptions);
+        await ensureClaustrumPrivateDirectory(dirname4(this.#paths.tokenPath), this.#ancestorOptions);
         await refuseWritableAncestor(dirname4(this.#paths.tokenPath), this.#ancestorOptions);
         await this.#writeTokenFile(this.#paths.tokenPath, {
           token: outcome.token,
@@ -1967,7 +1974,7 @@ class ClaustrumEnrollmentManager {
   }
 }
 async function resetClaustrumEnrollmentState(paths, proposedName) {
-  await ensurePrivateDirectory2(dirname4(paths.statePath));
+  await ensureClaustrumPrivateDirectory(dirname4(paths.statePath));
   const lock = await acquireRefreshFileLock({
     name: "ceremony",
     path: paths.statePath,
@@ -2005,7 +2012,7 @@ async function removeIfPresent(path) {
   }
 }
 async function disconnectClaustrumEnrollment(paths, proposedName) {
-  await ensurePrivateDirectory2(dirname4(paths.statePath));
+  await ensureClaustrumPrivateDirectory(dirname4(paths.statePath));
   const lock = await acquireRefreshFileLock({
     name: "ceremony",
     path: paths.statePath,
@@ -2916,6 +2923,117 @@ async function connectSetupHost(plugin, host, io, terminal, fence) {
   }
 }
 
+// ../../node_modules/@cortexkit/common-auth/dist/setup/flags.js
+var UNAVAILABLE_HOST_MESSAGE = "Requested setup host is unknown or unavailable. Use --host=opencode or --host=pi with a detected host.";
+var SETUP_FLAGS = [
+  {
+    name: "--yes",
+    key: "yes",
+    description: "Run without questions and set up every found host. Does not choose the vault."
+  },
+  {
+    name: "--dry-run",
+    key: "dryRun",
+    description: "Print what setup would do without changing anything."
+  },
+  {
+    name: "--host",
+    key: "hosts",
+    values: ["opencode", "pi"],
+    spaceForm: true,
+    invalid: UNAVAILABLE_HOST_MESSAGE,
+    description: "Set up only this host; repeat the flag for both. Also written --host=<host>."
+  },
+  {
+    name: "--opencode",
+    key: "opencode",
+    values: ["1", "2", "both"],
+    description: "Register for this OpenCode generation."
+  },
+  {
+    name: "--claustrum",
+    key: "claustrum",
+    description: "Connect the hosts to the Claustrum vault."
+  },
+  {
+    name: "--no-claustrum",
+    key: "noClaustrum",
+    description: "Do not offer the Claustrum vault; sign in locally."
+  },
+  {
+    name: "--login",
+    key: "login",
+    description: "Sign in locally instead of using the Claustrum vault."
+  },
+  {
+    name: "--enroll-only",
+    key: "enrollOnly",
+    description: "Only connect the hosts to the Claustrum vault; register nothing and migrate nothing."
+  }
+];
+function unknownArgument(arg) {
+  return new Error(`Unknown setup argument: ${arg}. Run the plugin's own setup --help to list the flags setup accepts.`);
+}
+function parseSetupFlags(argv) {
+  const result = {
+    yes: false,
+    dryRun: false,
+    claustrum: false,
+    noClaustrum: false,
+    login: false,
+    enrollOnly: false,
+    hosts: [],
+    opencode: undefined
+  };
+  for (let index = 0;index < argv.length; index++) {
+    const arg = argv[index];
+    const equals = arg.indexOf("=");
+    const name = equals === -1 ? arg : arg.slice(0, equals);
+    const flag = SETUP_FLAGS.find((entry) => entry.name === name);
+    if (!flag)
+      throw unknownArgument(arg);
+    if (!("values" in flag)) {
+      if (equals !== -1)
+        throw unknownArgument(arg);
+      result[flag.key] = true;
+      continue;
+    }
+    let value;
+    if (equals !== -1)
+      value = arg.slice(equals + 1);
+    else if (flag.spaceForm)
+      value = argv[++index];
+    else
+      throw unknownArgument(arg);
+    if (value === undefined || !flag.values.includes(value))
+      throw flag.invalid ? new Error(flag.invalid) : unknownArgument(arg);
+    if (flag.key === "hosts")
+      result.hosts.push(value);
+    else
+      result.opencode = value;
+  }
+  if (result.claustrum && result.noClaustrum)
+    throw new Error("--claustrum and --no-claustrum cannot be used together.");
+  if (result.login && result.claustrum)
+    throw new Error("--login and --claustrum cannot be used together.");
+  if (result.enrollOnly && result.login)
+    throw new Error("--enroll-only and --login cannot be used together.");
+  if (result.enrollOnly && result.noClaustrum)
+    throw new Error("--enroll-only and --no-claustrum cannot be used together.");
+  return result;
+}
+function setupUsage(options = {}) {
+  const labels = SETUP_FLAGS.map((flag) => ("values" in flag) ? `${flag.name}${flag.spaceForm ? " " : "="}${flag.values.join("|")}` : flag.name);
+  const width = Math.max(...labels.map((label) => label.length));
+  const lines = SETUP_FLAGS.map((flag, index) => `  ${labels[index].padEnd(width)}  ${flag.description}`);
+  return [
+    ...options.command ? [`Usage: ${options.command} [flags]`, ""] : [],
+    "Flags:",
+    ...lines
+  ].join(`
+`);
+}
+
 // ../../node_modules/@cortexkit/common-auth/dist/setup/prompts.js
 async function selectSetupHosts(terminal, found) {
   const selected = new Set(found);
@@ -3177,51 +3295,6 @@ async function registerPi(plugin, executable, io = {}) {
 
 // ../../node_modules/@cortexkit/common-auth/dist/setup/command.js
 var AMBIGUOUS_OPENCODE_MESSAGE = "Multiple OpenCode generations found. Choose --opencode=1|2|both before running noninteractive setup.";
-var UNAVAILABLE_HOST_MESSAGE = "Requested setup host is unknown or unavailable. Use --host=opencode or --host=pi with a detected host.";
-function flags(argv) {
-  const result = {
-    yes: false,
-    dryRun: false,
-    claustrum: false,
-    noClaustrum: false,
-    login: false,
-    enrollOnly: false,
-    hosts: [],
-    opencode: undefined
-  };
-  for (const arg of argv) {
-    if (arg === "--yes")
-      result.yes = true;
-    else if (arg === "--dry-run")
-      result.dryRun = true;
-    else if (arg === "--claustrum")
-      result.claustrum = true;
-    else if (arg === "--no-claustrum")
-      result.noClaustrum = true;
-    else if (arg === "--login")
-      result.login = true;
-    else if (arg === "--enroll-only")
-      result.enrollOnly = true;
-    else if (arg.startsWith("--host=")) {
-      const host = arg.slice("--host=".length);
-      if (host !== "opencode" && host !== "pi")
-        throw new Error(UNAVAILABLE_HOST_MESSAGE);
-      result.hosts.push(host);
-    } else if (/^--opencode=(1|2|both)$/.test(arg))
-      result.opencode = arg.slice("--opencode=".length);
-    else
-      throw new Error(`Unknown setup argument: ${arg}`);
-  }
-  if (result.claustrum && result.noClaustrum)
-    throw new Error("--claustrum and --no-claustrum cannot be used together.");
-  if (result.login && result.claustrum)
-    throw new Error("--login and --claustrum cannot be used together.");
-  if (result.enrollOnly && result.login)
-    throw new Error("--enroll-only and --login cannot be used together.");
-  if (result.enrollOnly && result.noClaustrum)
-    throw new Error("--enroll-only and --no-claustrum cannot be used together.");
-  return result;
-}
 function validatePlugin(plugin) {
   for (const pkg of Object.values(plugin.packages)) {
     if (!/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/.test(pkg))
@@ -3251,7 +3324,7 @@ async function enrollmentReport(plugin, hosts, recorded) {
   return report;
 }
 async function runSetup(plugin, argv = [], io = {}) {
-  const options = flags(argv);
+  const options = parseSetupFlags(argv);
   validatePlugin(plugin);
   const terminal = io.terminal ?? processTerminal();
   const detection = await detectHosts(plugin, io);
@@ -3362,7 +3435,7 @@ async function runSetup(plugin, argv = [], io = {}) {
 ${write.content}`);
     if (!options.enrollOnly && hosts.includes("pi"))
       printLine(terminal, `Would run ${detection.pi.executable} install npm:${plugin.packages.pi}@${plugin.version}`);
-    if (!options.enrollOnly)
+    if (!options.enrollOnly && plugin.migrate)
       for (const host of hosts)
         printLine(terminal, `Would migrate ${host} using the plugin callback (provider-specific writes).`);
   } else {
@@ -3400,7 +3473,7 @@ ${write.content}`);
         else
           await registerPi(plugin, detection.pi.executable, io);
         await stopped();
-        await plugin.migrate(host, context);
+        await plugin.migrate?.(host, context);
       }
     } catch (error) {
       if (enrollment.size === 0)
@@ -4283,14 +4356,14 @@ var DEFAULT_MINIMUM_REMAINING = {
 };
 var DEFAULT_FAIL_CLOSED_ON_UNKNOWN_QUOTA = true;
 var FALLBACK_BACKGROUND_TICK_MS = 60000;
-function getConfigDir() {
-  if (process.env.OPENCODE_CONFIG_DIR?.trim()) {
-    return process.env.OPENCODE_CONFIG_DIR.trim();
+function getOpenCodeConfigDir(env = process.env, home = homedir2()) {
+  if (env.OPENCODE_CONFIG_DIR?.trim()) {
+    return env.OPENCODE_CONFIG_DIR.trim();
   }
-  return join7(process.env.XDG_CONFIG_HOME || join7(homedir2(), ".config"), "opencode");
+  return join7(env.XDG_CONFIG_HOME || join7(home, ".config"), "opencode");
 }
 function getAccountStoragePath() {
-  return process.env.OPENCODE_ANTHROPIC_AUTH_FILE?.trim() || join7(getConfigDir(), ACCOUNT_FILE_NAME);
+  return process.env.OPENCODE_ANTHROPIC_AUTH_FILE?.trim() || join7(getOpenCodeConfigDir(), ACCOUNT_FILE_NAME);
 }
 function getAccountStatePath(configPath = getAccountStoragePath()) {
   const explicit = process.env.OPENCODE_ANTHROPIC_AUTH_STATE_FILE?.trim();
@@ -8394,6 +8467,13 @@ class CacheKeepManager {
   trackedCount() {
     return this.targets.size;
   }
+  dropExpiredTargets(now = this.options.now?.() ?? Date.now()) {
+    this.pruneTargets(now);
+    let earliest;
+    for (const target of this.targets.values())
+      earliest = Math.min(earliest ?? target.cacheExpiresAt, target.cacheExpiresAt);
+    return earliest;
+  }
   publishTrackedSessions() {
     const callback = this.options.onTrackedSessionsChanged;
     if (!callback)
@@ -8715,18 +8795,766 @@ class CacheKeepManager {
   }
 }
 // src/cachekeep-registry.ts
-import { randomUUID as randomUUID8 } from "node:crypto";
+import { randomUUID as randomUUID9 } from "node:crypto";
 import {
   link,
-  mkdir as mkdir7,
+  mkdir as mkdir8,
   readdir as readdir2,
-  readFile as readFile7,
+  readFile as readFile8,
   rename as rename8,
   rm as rm5,
   writeFile as writeFile3
 } from "node:fs/promises";
 import { tmpdir as tmpdir6 } from "node:os";
-import { join as join10 } from "node:path";
+import { join as join13 } from "node:path";
+
+// src/holder-registry.ts
+import { execFile } from "node:child_process";
+import { randomUUID as randomUUID8 } from "node:crypto";
+import { readFileSync as readFileSync2 } from "node:fs";
+import { lstat as lstat5, mkdir as mkdir7, readFile as readFile7 } from "node:fs/promises";
+import { basename as basename5, dirname as dirname9, join as join12 } from "node:path";
+
+// src/native-lock-observer.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+var detachedLocks = new AsyncLocalStorage;
+function withDetachedNativeLocks(work) {
+  return detachedLocks.run(true, work);
+}
+function nativeLockObserver(observer) {
+  if (!observer)
+    return;
+  return (event) => {
+    try {
+      const result = observer(detachedLocks.getStore() ? { ...event, detached: true } : event);
+      if (result !== null && (typeof result === "object" || typeof result === "function") && "then" in result && typeof result.then === "function") {
+        Promise.resolve(result).catch(() => {});
+      }
+    } catch {}
+  };
+}
+async function withNativeLock(path2, options, run, acquire = withLock) {
+  const observer = nativeLockObserver(options.onLockEvent);
+  if (!observer)
+    return acquire(path2, options, run);
+  observer({ type: "acquiring", name: options.name, path: path2 });
+  let acquired = false;
+  try {
+    return await acquire(path2, options, async (lease) => {
+      acquired = true;
+      observer({ type: "acquired", name: options.name, path: path2 });
+      return run(lease);
+    });
+  } finally {
+    if (acquired)
+      observer({ type: "released", name: options.name, path: path2 });
+  }
+}
+function observeNativeLocks(acquire, observer) {
+  return (path2, options, run) => withNativeLock(path2, { ...options, onLockEvent: options.onLockEvent ?? observer }, run, acquire());
+}
+
+// src/native-vault-paths.ts
+import { createHash as createHash6 } from "node:crypto";
+import { basename as basename4, dirname as dirname8, join as join11 } from "node:path";
+
+// src/state-layout-paths.ts
+import { createHash as createHash5 } from "node:crypto";
+import { realpathSync as realpathSync2 } from "node:fs";
+import { open as open5 } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import * as nodePath from "node:path";
+var LEGACY_STATE_LAYOUT = Object.freeze({
+  kind: "legacy"
+});
+function processStateLayout() {
+  return LEGACY_STATE_LAYOUT;
+}
+function anthropicAuthStateRoot(inputs, pathApi = nodePath) {
+  const { xdgStateHome, home, acceptRelative = false } = inputs;
+  const base = xdgStateHome && (acceptRelative || pathApi.isAbsolute(xdgStateHome)) ? xdgStateHome : pathApi.join(home, ".local", "state");
+  return pathApi.join(base, "cortexkit", "anthropic-auth");
+}
+function errorCode2(error) {
+  return error instanceof Error && "code" in error ? error.code : undefined;
+}
+function configFolderIdentity(configDir = getOpenCodeConfigDir()) {
+  try {
+    return realpathSync2.native(configDir);
+  } catch (error) {
+    const code = errorCode2(error);
+    if (code === "ENOENT" || code === "ENOTDIR")
+      return;
+    throw error;
+  }
+}
+function homeDefaultConfigDir(home = homedir3(), pathApi = nodePath) {
+  return pathApi.join(home, ".config", "opencode");
+}
+function stateSubfolderName(identity2, homeDefaultIdentity) {
+  if (identity2 === homeDefaultIdentity)
+    return "opencode";
+  const hash = createHash5("sha256").update(identity2).digest("hex");
+  return `opencode-${hash.slice(0, 16)}`;
+}
+function resolveStateHomeTarget(options = {}) {
+  const env = options.env ?? process.env;
+  const home = options.home ?? homedir3();
+  const identity2 = configFolderIdentity(getOpenCodeConfigDir(env, home));
+  if (identity2 === undefined)
+    return;
+  const stateRoot = anthropicAuthStateRoot({
+    xdgStateHome: env.XDG_STATE_HOME,
+    home
+  });
+  const name = stateSubfolderName(identity2, configFolderIdentity(homeDefaultConfigDir(home)));
+  return { identity: identity2, stateRoot, dir: nodePath.join(stateRoot, name) };
+}
+var STATE_HOME_FILE_NAMES = Object.freeze({
+  localPoolState: "anthropic-auth-pool-state.json",
+  localRuntime: "anthropic-auth-native-state.json",
+  journal: "anthropic-auth-migration.json",
+  localRoster: "anthropic-auth-custody-roster.json",
+  vaultStoreState: "anthropic-auth-vault-store-state.json",
+  vaultRuntime: "anthropic-auth-vault-state.json",
+  vaultRoster: "anthropic-auth-vault-roster.json",
+  vaultRouting: "anthropic-auth-vault-routing-state.json",
+  requestGzip: "anthropic-auth-request-gzip.json",
+  configDirMarker: "config-dir.json",
+  layoutMarker: "layout.json"
+});
+function stateHomeFilePaths(dir, pathApi = nodePath) {
+  const paths = {};
+  for (const [role, name] of Object.entries(STATE_HOME_FILE_NAMES))
+    paths[role] = pathApi.join(dir, name);
+  return Object.freeze(paths);
+}
+var DEFAULT_ACCOUNT_FILE = "anthropic-auth.json";
+var DEFAULT_ACCOUNT_STATE_FILE = "anthropic-auth-state.json";
+function stateHomeDatasetFiles(layout, legacyConfig, legacyState) {
+  if (!nodePath.isAbsolute(layout.dir))
+    throw new Error("The state-home folder must be an absolute path");
+  if (nodePath.basename(legacyConfig) !== DEFAULT_ACCOUNT_FILE || nodePath.basename(legacyState) !== DEFAULT_ACCOUNT_STATE_FILE || nodePath.dirname(legacyConfig) !== nodePath.dirname(legacyState))
+    throw new Error("The state-home layout applies only to the default account files of a config folder");
+  return stateHomeFilePaths(layout.dir);
+}
+
+class StateLayoutFileError extends Error {
+  code;
+  path;
+  constructor(code, path2, cause) {
+    super(code === "invalid" ? `anthropic-auth state layout file ${path2} is invalid` : `anthropic-auth state layout file ${path2} cannot be read`, cause === undefined ? undefined : { cause });
+    this.name = "StateLayoutFileError";
+    this.code = code;
+    this.path = path2;
+  }
+}
+var MARKER_MAX_BYTES = 1024 * 1024;
+var POINTER_MAX_BYTES = 64 * 1024;
+async function readSmallFile(path2, maxBytes) {
+  let handle;
+  try {
+    handle = await open5(path2, "r");
+  } catch (error) {
+    const code = errorCode2(error);
+    if (code === "ENOENT")
+      return { status: "absent" };
+    if (code === "EISDIR")
+      return { status: "not-small-file" };
+    throw error;
+  }
+  try {
+    const info = await handle.stat();
+    if (!info.isFile() || info.size > maxBytes)
+      return { status: "not-small-file" };
+    const bytes = await handle.readFile();
+    if (bytes.length > maxBytes)
+      return { status: "not-small-file" };
+    return { status: "read", text: bytes.toString("utf8") };
+  } finally {
+    await handle.close();
+  }
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function nonEmptyString2(value) {
+  return typeof value === "string" && value.length > 0;
+}
+async function readMarker(path2, parse3) {
+  let file;
+  try {
+    file = await readSmallFile(path2, MARKER_MAX_BYTES);
+  } catch (error) {
+    throw new StateLayoutFileError("unreadable", path2, error);
+  }
+  if (file.status === "absent")
+    return;
+  if (file.status !== "read")
+    throw new StateLayoutFileError("invalid", path2);
+  let value;
+  try {
+    value = parseJsonRedacted(file.text);
+  } catch {
+    throw new StateLayoutFileError("invalid", path2);
+  }
+  const parsed = parse3(value);
+  if (parsed === undefined)
+    throw new StateLayoutFileError("invalid", path2);
+  return parsed;
+}
+async function readConfigDirMarker(dir) {
+  return readMarker(nodePath.join(dir, STATE_HOME_FILE_NAMES.configDirMarker), (value) => isRecord4(value) && value.version === 1 && nonEmptyString2(value.identity) ? Object.freeze({ version: 1, identity: value.identity }) : undefined);
+}
+var STATE_LAYOUT_PHASES = [
+  "preparing",
+  "committed",
+  "rolled-back",
+  "restoring",
+  "restore-staged",
+  "restored"
+];
+var CLEANUP_STATES = ["pending", "done", "kept"];
+var RESTORE_CLEANUP_STATES = ["pending", "done"];
+function oneOf(values, value) {
+  return typeof value === "string" && values.includes(value);
+}
+function parseLayoutMarker(value) {
+  if (!isRecord4(value) || value.version !== 1)
+    return;
+  const { phase, attempt, identity: identity2, stateRoot, sub, oldDir, storageIds } = value;
+  if (!oneOf(STATE_LAYOUT_PHASES, phase) || !nonEmptyString2(attempt) || !nonEmptyString2(identity2) || !nonEmptyString2(stateRoot) || !nonEmptyString2(sub) || !nonEmptyString2(oldDir) || !isRecord4(storageIds) || !nonEmptyString2(storageIds.local) || !nonEmptyString2(storageIds.vault))
+    return;
+  const rawCleanup = value.cleanup;
+  let cleanup;
+  if (rawCleanup === undefined) {
+    if (phase === "committed")
+      return;
+  } else if (oneOf(CLEANUP_STATES, rawCleanup))
+    cleanup = rawCleanup;
+  else
+    return;
+  let restore;
+  if (value.restore !== undefined) {
+    if (!isRecord4(value.restore))
+      return;
+    const restoreCleanup = value.restore.cleanup;
+    if (restoreCleanup !== undefined && !oneOf(RESTORE_CLEANUP_STATES, restoreCleanup))
+      return;
+    restore = Object.freeze(restoreCleanup === undefined ? {} : { cleanup: restoreCleanup });
+  } else if (phase === "restored")
+    return;
+  return Object.freeze({
+    version: 1,
+    phase,
+    attempt,
+    identity: identity2,
+    stateRoot,
+    sub,
+    oldDir,
+    storageIds: Object.freeze({
+      local: storageIds.local,
+      vault: storageIds.vault
+    }),
+    ...cleanup === undefined ? {} : { cleanup },
+    ...restore === undefined ? {} : { restore }
+  });
+}
+async function readStateLayoutMarker(dir) {
+  return readMarker(nodePath.join(dir, STATE_HOME_FILE_NAMES.layoutMarker), parseLayoutMarker);
+}
+async function readRelocationPointer(runtimePath) {
+  const file = await readSmallFile(runtimePath, POINTER_MAX_BYTES);
+  if (file.status !== "read")
+    return;
+  let value;
+  try {
+    value = parseJsonRedacted(file.text);
+  } catch {
+    return;
+  }
+  if (!isRecord4(value) || value.version !== 0)
+    return;
+  const { relocatedTo, stateRoot, identity: identity2, attempt, by } = value;
+  if (!nonEmptyString2(relocatedTo) || !nonEmptyString2(stateRoot) || !nonEmptyString2(identity2) || !nonEmptyString2(attempt) || !nonEmptyString2(by))
+    return;
+  return Object.freeze({ relocatedTo, stateRoot, identity: identity2, attempt, by });
+}
+
+// src/native-vault-paths.ts
+function sibling(path2, expected, name, suffix) {
+  return basename4(path2) === expected ? join11(dirname8(path2), name) : path2.replace(/(?:\.json)?$/, `.${suffix}.json`);
+}
+function nativeVaultPaths(local, layout = processStateLayout()) {
+  const config = sibling(local.legacyConfig, "anthropic-auth.json", "anthropic-auth-vault-settings.json", "vault-settings");
+  const legacyLayoutState = sibling(local.legacyState, "anthropic-auth-state.json", "anthropic-auth-vault-store-state.json", "vault-store");
+  let state = legacyLayoutState;
+  let runtime = sibling(local.legacyState, "anthropic-auth-state.json", "anthropic-auth-vault-state.json", "vault-native");
+  let roster = sibling(local.legacyState, "anthropic-auth-state.json", "anthropic-auth-vault-roster.json", "vault-roster");
+  let routing = sibling(local.legacyState, "anthropic-auth-state.json", "anthropic-auth-vault-routing-state.json", "vault-routing");
+  if (layout.kind === "state-home") {
+    const moved = stateHomeDatasetFiles(layout, local.legacyConfig, local.legacyState);
+    state = moved.vaultStoreState;
+    runtime = moved.vaultRuntime;
+    roster = moved.vaultRoster;
+    routing = moved.vaultRouting;
+  }
+  const destinations = [config, state, runtime, roster, routing];
+  const localFiles = [
+    local.legacyConfig,
+    local.legacyState,
+    local.config,
+    local.state,
+    local.runtime,
+    local.journal,
+    local.roster
+  ];
+  if (new Set([...localFiles, ...destinations]).size !== localFiles.length + destinations.length)
+    throw new Error("Vault storage overlaps local account storage");
+  return {
+    legacySeedConfig: local.legacyConfig,
+    config,
+    state,
+    runtime,
+    roster,
+    routing,
+    storageId: createHash6("sha256").update(JSON.stringify(["anthropic-vault", config, legacyLayoutState])).digest("hex")
+  };
+}
+
+// src/relocation-guard.ts
+import { lstat as lstat4 } from "node:fs/promises";
+var RELOCATED_MESSAGE = "Anthropic account state was moved to a new folder by a newer anthropic-auth version. Update anthropic-auth in every OpenCode and Pi that uses this folder, then restart them.";
+
+class RelocatedError extends Error {
+  code = "relocated";
+  runtimePath;
+  relocatedTo;
+  constructor(runtimePath, pointer) {
+    super(RELOCATED_MESSAGE);
+    this.name = "RelocatedError";
+    this.runtimePath = runtimePath;
+    this.relocatedTo = pointer.relocatedTo;
+  }
+}
+var TOMBSTONE_MAX_BYTES = 16 * 1024;
+var MAX_OBSERVED_PATHS = 256;
+var observations = new Map;
+var reported = new Set;
+async function pointerAt(path2) {
+  let info;
+  try {
+    info = await lstat4(path2, { bigint: true });
+  } catch {
+    observations.delete(path2);
+    return;
+  }
+  const identity2 = `${info.dev}:${info.ino}:${info.size}:${info.mtimeNs}:${info.ctimeNs}`;
+  const last = observations.get(path2);
+  if (last?.identity === identity2)
+    return last.pointer;
+  let pointer;
+  if (info.isFile() && info.size <= BigInt(TOMBSTONE_MAX_BYTES)) {
+    try {
+      pointer = await readRelocationPointer(path2);
+    } catch {
+      pointer = undefined;
+    }
+  }
+  observations.delete(path2);
+  if (observations.size >= MAX_OBSERVED_PATHS) {
+    const oldest = observations.keys().next().value;
+    if (oldest !== undefined)
+      observations.delete(oldest);
+  }
+  observations.set(path2, { identity: identity2, pointer });
+  return pointer;
+}
+async function findRelocationTombstone(runtimePaths) {
+  for (const path2 of runtimePaths) {
+    const pointer = await pointerAt(path2);
+    if (pointer)
+      return { path: path2, pointer };
+  }
+  return;
+}
+function reportRelocation(path2, pointer) {
+  if (reported.has(path2))
+    return;
+  reported.add(path2);
+  logger.error("state-layout", "anthropic-auth state was moved by a newer version; this process refuses to use the old files", { runtimePath: path2, relocatedTo: pointer.relocatedTo, by: pointer.by });
+}
+function createRelocationGuard(runtimePaths) {
+  const paths = [...runtimePaths];
+  return {
+    async assertNotRelocated() {
+      const found = await findRelocationTombstone(paths);
+      if (!found)
+        return;
+      reportRelocation(found.path, found.pointer);
+      throw new RelocatedError(found.path, found.pointer);
+    },
+    async isRelocated() {
+      const found = await findRelocationTombstone(paths);
+      if (found)
+        reportRelocation(found.path, found.pointer);
+      return found !== undefined;
+    }
+  };
+}
+function nativeRelocationRuntimePaths(paths) {
+  return [paths.runtime, nativeVaultPaths(paths, LEGACY_STATE_LAYOUT).runtime];
+}
+function nativeRelocationGuard(paths) {
+  return createRelocationGuard(nativeRelocationRuntimePaths(paths));
+}
+
+// src/holder-registry.ts
+var HOLDER_FILE_NAME = "anthropic-auth-holders.json";
+var HOLDER_LOCK_NAME = "holders";
+var HOLDER_LOCK_TIMEOUT_MS = 120000;
+var HOLDER_RETRY_INTERVAL_MS = 60000;
+var HOLDER_LOCK_TTL_MS = 1e4;
+var HOLDER_FILE_MAX_BYTES = 4 * 1024 * 1024;
+var RELEASE_PACKAGES = new Set([
+  "@cortexkit/anthropic-auth-core",
+  "@cortexkit/opencode-anthropic-auth",
+  "@cortexkit/pi-anthropic-auth"
+]);
+var release;
+function anthropicAuthRelease() {
+  if (release !== undefined)
+    return release;
+  release = "unknown";
+  try {
+    const manifest = JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8"));
+    if (typeof manifest.name === "string" && RELEASE_PACKAGES.has(manifest.name) && typeof manifest.version === "string" && manifest.version.trim())
+      release = manifest.version.trim();
+  } catch {}
+  return release;
+}
+function writerStamp() {
+  return { protocol: 1, release: anthropicAuthRelease() };
+}
+function nativeHolderDatasetFiles(paths) {
+  const vault = nativeVaultPaths(paths, LEGACY_STATE_LAYOUT);
+  return [
+    ...new Set([
+      paths.state,
+      paths.runtime,
+      paths.journal,
+      paths.roster,
+      vault.state,
+      vault.runtime,
+      vault.roster,
+      vault.routing
+    ])
+  ].sort();
+}
+function isDestinationShapedDirectory(dir) {
+  const name = basename5(dir);
+  const parent = dirname9(dir);
+  return (name === "opencode" || /^opencode-[0-9a-f]{16}$/.test(name)) && basename5(parent) === "anthropic-auth" && basename5(dirname9(parent)) === "cortexkit";
+}
+function openCodeHolderKind(env = process.env) {
+  return env.OPENCODE_ANTHROPIC_AUTH_FILE?.trim() || env.OPENCODE_ANTHROPIC_AUTH_STATE_FILE?.trim() ? "explicit" : "legacy";
+}
+var HOLDER_REGISTRATION_MESSAGES = {
+  "lock-timeout": "Another anthropic-auth process is moving or restoring state for this folder; start again in a minute.",
+  "managed-folder": "An anthropic-auth path override points into anthropic-auth's managed state folder. Remove the override.",
+  malformed: "anthropic-auth could not record its use of its state folder: the holder file there is invalid.",
+  unavailable: "anthropic-auth could not record its use of its state folder, so it refuses to use that folder."
+};
+
+class HolderRegistrationError extends Error {
+  code;
+  directory;
+  constructor(code, directory, cause) {
+    super(HOLDER_REGISTRATION_MESSAGES[code], cause === undefined ? undefined : { cause });
+    this.name = "HolderRegistrationError";
+    this.code = code;
+    this.directory = directory;
+  }
+}
+var HOLDER_REGISTRATION_ERROR_MESSAGES = Object.values(HOLDER_REGISTRATION_MESSAGES);
+function stateRefusalCause(error) {
+  let current = error;
+  for (let depth = 0;depth < 4 && current instanceof Error; depth++) {
+    if (current instanceof RelocatedError || current instanceof HolderRegistrationError)
+      return current;
+    current = current.cause;
+  }
+  return;
+}
+function pidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+var bootId;
+async function linuxIncarnation(pid) {
+  bootId ??= readFile7("/proc/sys/kernel/random/boot_id", "utf8").then((text) => text.trim() || null, () => null);
+  const boot = await bootId;
+  if (!boot)
+    return null;
+  try {
+    const stat6 = await readFile7(`/proc/${pid}/stat`, "utf8");
+    const fields = stat6.slice(stat6.lastIndexOf(")") + 2).split(" ");
+    const start = fields[19];
+    return start && /^\d+$/.test(start) ? `${boot}:${start}` : null;
+  } catch {
+    return null;
+  }
+}
+function macosIncarnation(pid) {
+  return new Promise((resolve5) => {
+    execFile("ps", ["-o", "lstart=", "-p", String(pid)], { env: { ...process.env, TZ: "UTC0" }, timeout: 5000 }, (error, stdout) => {
+      const text = String(stdout ?? "").trim();
+      resolve5(error || !text ? null : text);
+    });
+  });
+}
+function processIncarnation(pid) {
+  if (process.platform === "linux")
+    return linuxIncarnation(pid);
+  if (process.platform === "darwin")
+    return macosIncarnation(pid);
+  return Promise.resolve(null);
+}
+var defaultLiveness = {
+  pidAlive,
+  incarnation: processIncarnation
+};
+async function holderEntryIsLive(entry, liveness = defaultLiveness) {
+  if (!liveness.pidAlive(entry.pid))
+    return false;
+  if (entry.incarnation === null)
+    return true;
+  let current;
+  try {
+    current = await liveness.incarnation(entry.pid);
+  } catch {
+    current = null;
+  }
+  return current === null || current === entry.incarnation;
+}
+function isRecord5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function entryLiveness(value) {
+  if (!isRecord5(value))
+    return;
+  const { pid, incarnation } = value;
+  if (typeof pid !== "number" || !Number.isSafeInteger(pid) || pid <= 0)
+    return;
+  if (incarnation !== null && typeof incarnation !== "string")
+    return;
+  return { pid, incarnation };
+}
+function sameRegistration(value, entry) {
+  if (!isRecord5(value))
+    return false;
+  const files = value.files;
+  return value.pid === entry.pid && value.incarnation === entry.incarnation && value.role === entry.role && value.kind === entry.kind && Array.isArray(files) && files.length === entry.files.length && files.every((file, index) => file === entry.files[index]);
+}
+async function readHolderFile(path2) {
+  let text;
+  try {
+    const info = await lstat5(path2);
+    if (!info.isFile() || info.size > HOLDER_FILE_MAX_BYTES)
+      throw new HolderRegistrationError("malformed", dirname9(path2));
+    text = await readFile7(path2, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return;
+    throw error;
+  }
+  let value;
+  try {
+    value = parseJsonRedacted(text);
+  } catch (cause) {
+    throw new HolderRegistrationError("malformed", dirname9(path2), cause);
+  }
+  if (!isRecord5(value) || value.version !== 1 || !Array.isArray(value.entries))
+    throw new HolderRegistrationError("malformed", dirname9(path2));
+  return { entries: value.entries };
+}
+async function exists(path2) {
+  try {
+    await lstat5(path2);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function anyExists(paths) {
+  for (const path2 of paths)
+    if (await exists(path2))
+      return true;
+  return false;
+}
+async function isManagedDirectory(dir) {
+  return await exists(join12(dir, STATE_HOME_FILE_NAMES.configDirMarker)) || await exists(join12(dir, STATE_HOME_FILE_NAMES.layoutMarker));
+}
+var instance = randomUUID8();
+var ownIncarnation;
+var published = new Set;
+var warned = new Set;
+function registrationKey(holderFile, entry) {
+  return JSON.stringify([holderFile, entry.kind, entry.role, entry.files]);
+}
+async function assertNoTombstone(paths) {
+  const found = await findRelocationTombstone(nativeRelocationRuntimePaths(paths));
+  if (found) {
+    logger.error("state-layout", "anthropic-auth state was moved by a newer version; this process refuses to use the old files", {
+      runtimePath: found.path,
+      relocatedTo: found.pointer.relocatedTo,
+      by: found.pointer.by
+    });
+    throw new RelocatedError(found.path, found.pointer);
+  }
+}
+async function publishEntry(holderFile, entry, options, mandatory) {
+  const dir = dirname9(holderFile);
+  if (mandatory)
+    await mkdir7(dir, { recursive: true, mode: 448 });
+  await withNativeLock(holderFile, {
+    name: HOLDER_LOCK_NAME,
+    ttlMs: HOLDER_LOCK_TTL_MS,
+    timeoutMs: options.lockTimeoutMs ?? HOLDER_LOCK_TIMEOUT_MS,
+    renew: true,
+    onLockEvent: options.onLockEvent
+  }, async (lease) => {
+    await assertNoTombstone(options.paths);
+    if (entry.kind !== "legacy" && await isManagedDirectory(dir))
+      throw new HolderRegistrationError("managed-folder", dir);
+    const current = await readHolderFile(holderFile);
+    const liveness = options.liveness ?? defaultLiveness;
+    const kept = [];
+    for (const value of current?.entries ?? []) {
+      const life = entryLiveness(value);
+      if (!life || await holderEntryIsLive(life, liveness))
+        kept.push(value);
+    }
+    if (kept.some((value) => sameRegistration(value, entry)))
+      return;
+    kept.push(entry);
+    await writeJsonAtomic(holderFile, { version: 1, entries: kept }, { beforeRename: () => lease.assertOwned() });
+  });
+  published.add(registrationKey(holderFile, entry));
+}
+async function buildEntry(options) {
+  ownIncarnation ??= (options.liveness ?? defaultLiveness).incarnation(process.pid).catch(() => null);
+  let identity2 = null;
+  if (options.kind === "legacy") {
+    try {
+      identity2 = configFolderIdentity(dirname9(options.paths.legacyConfig)) ?? null;
+    } catch {
+      identity2 = null;
+    }
+  }
+  return Object.freeze({
+    pid: process.pid,
+    incarnation: await ownIncarnation,
+    instance,
+    role: options.role,
+    release: anthropicAuthRelease(),
+    kind: options.kind,
+    identity: identity2,
+    files: Object.freeze(nativeHolderDatasetFiles(options.paths)),
+    registeredAt: (options.now ?? Date.now)()
+  });
+}
+async function registerNativePoolHolder(options) {
+  const entry = await buildEntry(options);
+  const dirs = [...new Set(entry.files.map((file) => dirname9(file)))].sort();
+  const holderFiles = dirs.map((dir) => join12(dir, HOLDER_FILE_NAME));
+  const done = {
+    status: "registered",
+    settled: Promise.resolve(),
+    close() {}
+  };
+  if (holderFiles.every((file) => published.has(registrationKey(file, entry))))
+    return done;
+  await assertNoTombstone(options.paths);
+  if (entry.kind !== "legacy") {
+    for (const dir of dirs)
+      if (await isManagedDirectory(dir))
+        throw new HolderRegistrationError("managed-folder", dir);
+  }
+  const mandatory = entry.kind !== "legacy" && dirs.some(isDestinationShapedDirectory);
+  const attempt = async () => {
+    let complete = true;
+    for (const holderFile of holderFiles) {
+      if (published.has(registrationKey(holderFile, entry)))
+        continue;
+      const dir = dirname9(holderFile);
+      try {
+        if (!mandatory && !await anyExists(entry.files.filter((file) => dirname9(file) === dir))) {
+          complete = false;
+          continue;
+        }
+        await publishEntry(holderFile, entry, options, mandatory);
+      } catch (error) {
+        if (error instanceof RelocatedError || error instanceof HolderRegistrationError && error.code === "managed-folder")
+          throw error;
+        if (mandatory)
+          throw error instanceof HolderRegistrationError ? error : new HolderRegistrationError(error instanceof LockContentionError ? "lock-timeout" : "unavailable", dir, error);
+        complete = false;
+        if (!warned.has(dir)) {
+          warned.add(dir);
+          logger.warn("state-layout", `anthropic-auth could not record that it is using ${dir}; if a newer version moves these files while this process runs, this process will stop and ask for a restart`, {
+            code: error instanceof HolderRegistrationError ? error.code : error instanceof LockContentionError ? "lock-timeout" : error?.code ?? "unknown"
+          });
+        }
+      }
+    }
+    return complete;
+  };
+  if (await attempt())
+    return done;
+  let timer;
+  let closed = false;
+  let settle = () => {};
+  const settled = new Promise((resolve5) => {
+    settle = resolve5;
+  });
+  const schedule = () => {
+    if (closed)
+      return;
+    timer = setTimeout(() => {
+      timer = undefined;
+      withDetachedNativeLocks(attempt).then((complete) => {
+        if (complete)
+          settle();
+        else
+          schedule();
+      }, () => {});
+    }, options.retryIntervalMs ?? HOLDER_RETRY_INTERVAL_MS);
+    timer.unref?.();
+  };
+  schedule();
+  return {
+    status: "pending",
+    settled,
+    close() {
+      closed = true;
+      if (timer)
+        clearTimeout(timer);
+      timer = undefined;
+    }
+  };
+}
+function resetNativeHolderRegistryForTests() {
+  published.clear();
+  warned.clear();
+  ownIncarnation = undefined;
+}
+
+// src/cachekeep-registry.ts
 var CACHE_KEEP_REGISTRY_LEASE_MS = 3 * 60000;
 function normalizeSession(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
@@ -8761,7 +9589,7 @@ function isExpiredRecord(record, now, leaseMs) {
   return record.updatedAt <= now && now - record.updatedAt > leaseMs;
 }
 function getDefaultCacheKeepRegistryDirectory(scope) {
-  return join10(tmpdir6(), "opencode-anthropic-auth", "cachekeep-sessions", scope);
+  return join13(tmpdir6(), "opencode-anthropic-auth", "cachekeep-sessions", scope);
 }
 
 class CacheKeepSessionRegistry {
@@ -8771,8 +9599,8 @@ class CacheKeepSessionRegistry {
   lastSweepAt;
   constructor(options) {
     this.options = options;
-    const instanceId = options.instanceId ?? `${process.pid}-${randomUUID8()}`;
-    this.filePath = join10(options.directory, `${instanceId}.json`);
+    const instanceId = options.instanceId ?? `${process.pid}-${randomUUID9()}`;
+    this.filePath = join13(options.directory, `${instanceId}.json`);
   }
   publish(sessions) {
     const snapshot = sessions.map((session) => ({ ...session }));
@@ -8782,12 +9610,13 @@ class CacheKeepSessionRegistry {
       if (snapshot.length === 0) {
         await rm5(this.filePath, { force: true });
       } else {
-        await mkdir7(this.options.directory, { recursive: true, mode: 448 });
-        const tempPath = `${this.filePath}.${randomUUID8()}.tmp`;
+        await mkdir8(this.options.directory, { recursive: true, mode: 448 });
+        const tempPath = `${this.filePath}.${randomUUID9()}.tmp`;
         const record = {
           version: 1,
           updatedAt: now,
-          sessions: snapshot
+          sessions: snapshot,
+          writer: writerStamp()
         };
         await writeFile3(tempPath, `${JSON.stringify(record)}
 `, {
@@ -8812,7 +9641,7 @@ class CacheKeepSessionRegistry {
     }
     const records = await Promise.all(names.map(async (name) => {
       try {
-        const raw = await readFile7(join10(this.options.directory, name), "utf8");
+        const raw = await readFile8(join13(this.options.directory, name), "utf8");
         return normalizeRecord(JSON.parse(raw));
       } catch {
         return;
@@ -8854,19 +9683,19 @@ class CacheKeepSessionRegistry {
       return;
     }
     await Promise.all(names.map(async (name) => {
-      const recordPath = join10(this.options.directory, name);
+      const recordPath = join13(this.options.directory, name);
       if (recordPath === this.filePath)
         return;
       let initialRecord;
       try {
-        initialRecord = normalizeRecord(JSON.parse(await readFile7(recordPath, "utf8")));
+        initialRecord = normalizeRecord(JSON.parse(await readFile8(recordPath, "utf8")));
       } catch {
         return;
       }
       if (!initialRecord || !isExpiredRecord(initialRecord, now, leaseMs)) {
         return;
       }
-      const sweptPath = `${recordPath}.${randomUUID8()}.sweep`;
+      const sweptPath = `${recordPath}.${randomUUID9()}.sweep`;
       try {
         await rename8(recordPath, sweptPath);
       } catch {
@@ -8875,7 +9704,7 @@ class CacheKeepSessionRegistry {
       let raw;
       let record;
       try {
-        raw = await readFile7(sweptPath, "utf8");
+        raw = await readFile8(sweptPath, "utf8");
         record = normalizeRecord(JSON.parse(raw));
       } catch {}
       if (record && isExpiredRecord(record, now, leaseMs)) {
@@ -8918,24 +9747,24 @@ class CacheKeepSessionRegistry {
   }
 }
 // src/claustrum-enrollment.ts
-import { createHash as createHash5, randomBytes as randomBytes4, randomUUID as randomUUID9 } from "node:crypto";
+import { createHash as createHash7, randomBytes as randomBytes4, randomUUID as randomUUID10 } from "node:crypto";
 import { constants as fsConstants2 } from "node:fs";
 import {
   chmod as chmod2,
-  mkdir as mkdir8,
-  open as open5,
+  mkdir as mkdir9,
+  open as open6,
   realpath as realpath2,
   rename as rename9,
   stat as stat6,
   unlink as unlink5
 } from "node:fs/promises";
-import { homedir as homedir3 } from "node:os";
+import { homedir as homedir4 } from "node:os";
 import {
-  basename as basename3,
-  dirname as dirname8,
+  basename as basename6,
+  dirname as dirname11,
   extname as extname2,
-  isAbsolute as isAbsolute2,
-  join as join11,
+  isAbsolute as isAbsolute3,
+  join as join14,
   resolve as resolve5
 } from "node:path";
 import {
@@ -8945,8 +9774,8 @@ import {
 } from "@cortexkit/claustrum-client";
 
 // src/owner-only.ts
-import { lstat as lstat4 } from "node:fs/promises";
-import { dirname as dirname7 } from "node:path";
+import { lstat as lstat6 } from "node:fs/promises";
+import { dirname as dirname10 } from "node:path";
 import { types as utilTypes3 } from "node:util";
 async function windowsBackend(options) {
   if ((options.platform ?? process.platform) !== "win32")
@@ -9010,9 +9839,9 @@ async function ensureWindowsOwnerOnlyDirectory(path2, options = {}) {
     const descriptor = Object.getOwnPropertyDescriptor(error, key);
     return descriptor && "value" in descriptor ? descriptor.value : undefined;
   };
-  async function exists(directory) {
+  async function exists2(directory) {
     try {
-      const metadata = await lstat4(directory);
+      const metadata = await lstat6(directory);
       if (metadata.isSymbolicLink())
         throw refused("verify", "reparse-point");
       if (!metadata.isDirectory())
@@ -9046,21 +9875,21 @@ async function ensureWindowsOwnerOnlyDirectory(path2, options = {}) {
       if (field(error, "code") !== "EEXIST" && !(field(error, "reason") === "io-error" && typeof win32Code === "number" && [80, 183].includes(win32Code)))
         throw error;
     }
-    if (!await exists(directory))
+    if (!await exists2(directory))
       throw refused("verify", "io-error");
     await privateDirectory(directory);
   }
   async function ancestors(directory) {
-    if (await exists(directory))
+    if (await exists2(directory))
       return safe(directory);
-    const parent = dirname7(directory);
+    const parent = dirname10(directory);
     if (parent === directory)
       throw refused("safe-parent", "io-error");
     await ancestors(parent);
     await create(directory);
   }
-  await ancestors(dirname7(path2));
-  if (await exists(path2))
+  await ancestors(dirname10(path2));
+  if (await exists2(path2))
     await privateDirectory(path2);
   else
     await create(path2);
@@ -9087,18 +9916,22 @@ function connectClaustrumEnrollmentClient2(options = {}) {
 }
 function getClaustrumEnrollmentPaths2(tokenPath) {
   const extension = extname2(tokenPath) || ".json";
-  const stem = basename3(tokenPath, extname2(tokenPath));
+  const stem = basename6(tokenPath, extname2(tokenPath));
   return {
-    statePath: join11(dirname8(tokenPath), `${stem}-state${extension}`),
+    statePath: join14(dirname11(tokenPath), `${stem}-state${extension}`),
     tokenPath
   };
 }
 function getHostClaustrumEnrollmentPaths(host, env = process.env, cwd = process.cwd()) {
   const configured = env[`${host.toUpperCase()}_ANTHROPIC_AUTH_CLAUSTRUM_ENROLLMENT_FILE`]?.trim();
-  const tokenPath = configured ? isAbsolute2(configured) ? configured : resolve5(cwd, configured) : join11(env.XDG_STATE_HOME || join11(homedir3(), ".local", "state"), "cortexkit", "anthropic-auth", `${host}-enrollment.json`);
+  const tokenPath = configured ? isAbsolute3(configured) ? configured : resolve5(cwd, configured) : join14(anthropicAuthStateRoot({
+    xdgStateHome: env.XDG_STATE_HOME,
+    home: homedir4(),
+    acceptRelative: true
+  }), `${host}-enrollment.json`);
   return getClaustrumEnrollmentPaths2(tokenPath);
 }
-function isRecord4(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function validTimestamp2(value) {
@@ -9108,7 +9941,7 @@ function validGeneration2(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 1;
 }
 function decodeEnrollmentState2(value) {
-  if (!isRecord4(value) || value.version !== ENROLLMENT_SCHEMA2 || typeof value.proposedName !== "string" || value.proposedName.length === 0) {
+  if (!isRecord6(value) || value.version !== ENROLLMENT_SCHEMA2 || typeof value.proposedName !== "string" || value.proposedName.length === 0) {
     throw new Error("invalid Claustrum enrollment state");
   }
   if (value.phase === "pending") {
@@ -9159,7 +9992,7 @@ function decodeEnrollmentState2(value) {
   throw new Error("invalid Claustrum enrollment state");
 }
 function decodeTokenFile2(value) {
-  if (!isRecord4(value) || !TOKEN_RE2.test(String(value.token ?? "")) || !validGeneration2(value.token_generation)) {
+  if (!isRecord6(value) || !TOKEN_RE2.test(String(value.token ?? "")) || !validGeneration2(value.token_generation)) {
     throw new Error("invalid Claustrum enrollment token file");
   }
   return {
@@ -9188,7 +10021,7 @@ async function readBoundedJson2(path2, ownership = {}) {
         throw new Error("Claustrum enrollment file is too large");
       return parseJsonRedacted(bytes.toString("utf8"));
     }
-    descriptor = await open5(path2, fsConstants2.O_RDONLY | fsConstants2.O_NOFOLLOW);
+    descriptor = await open6(path2, fsConstants2.O_RDONLY | fsConstants2.O_NOFOLLOW);
   } catch (error) {
     if (error.code === "ENOENT")
       return;
@@ -9225,26 +10058,26 @@ async function refuseWritableAncestor2(parent, ownership = {}, metadataAt = (pat
     if (metadata && (metadata.mode & 18) !== 0 && (metadata.mode & 512) === 0) {
       throw new Error("Claustrum enrollment path has an unsafe writable ancestor");
     }
-    const next = dirname8(component);
+    const next = dirname11(component);
     if (next === component)
       return;
     component = next;
   }
 }
 async function writeStateAtomic2(path2, state, beforeRename) {
-  const parent = dirname8(path2);
-  await mkdir8(parent, { recursive: true, mode: 448 });
+  const parent = dirname11(path2);
+  await mkdir9(parent, { recursive: true, mode: 448 });
   await refuseWritableAncestor2(parent);
   const bytes = `${JSON.stringify(state)}
 `;
   if (Buffer.byteLength(bytes) > ENROLLMENT_FILE_MAX_BYTES2) {
     throw new Error("Claustrum enrollment state is too large");
   }
-  const temporary = join11(parent, `.${basename3(path2)}.${process.pid}.${randomUUID9()}.tmp`);
+  const temporary = join14(parent, `.${basename6(path2)}.${process.pid}.${randomUUID10()}.tmp`);
   let descriptor;
   try {
     const nativeCreated = await createWindowsOwnerOnly(temporary, bytes);
-    descriptor = await open5(temporary, nativeCreated ? fsConstants2.O_RDWR : "wx", 384);
+    descriptor = await open6(temporary, nativeCreated ? fsConstants2.O_RDWR : "wx", 384);
     if (!nativeCreated)
       await descriptor.writeFile(bytes, "utf8");
     await descriptor.sync();
@@ -9259,7 +10092,7 @@ async function writeStateAtomic2(path2, state, beforeRename) {
   }
 }
 async function writeTokenAtomic(path2, value, writeTokenFile, beforeRename) {
-  const staged = join11(dirname8(path2), `.${basename3(path2)}.${process.pid}.${randomUUID9()}.tmp`);
+  const staged = join14(dirname11(path2), `.${basename6(path2)}.${process.pid}.${randomUUID10()}.tmp`);
   try {
     await writeTokenFile(staged, value);
     await beforeRename();
@@ -9363,7 +10196,7 @@ class ClaustrumEnrollmentManager2 {
     return resetClaustrumEnrollmentState2(this.#paths, this.#proposedName);
   }
   async reconcile() {
-    await mkdir8(dirname8(this.#paths.statePath), {
+    await mkdir9(dirname11(this.#paths.statePath), {
       recursive: true,
       mode: 448
     });
@@ -9433,7 +10266,7 @@ class ClaustrumEnrollmentManager2 {
       }
       if (!state.requestId) {
         try {
-          const requestSecretHash = createHash5("sha256").update(Buffer.from(state.requestSecret, "hex")).digest("hex");
+          const requestSecretHash = createHash7("sha256").update(Buffer.from(state.requestSecret, "hex")).digest("hex");
           const proposed = await this.#client.enrollPropose({
             name: state.proposedName,
             requestSecretHash
@@ -9527,7 +10360,7 @@ class ClaustrumEnrollmentManager2 {
   }
 }
 async function resetClaustrumEnrollmentState2(paths, proposedName) {
-  await mkdir8(dirname8(paths.statePath), { recursive: true, mode: 448 });
+  await mkdir9(dirname11(paths.statePath), { recursive: true, mode: 448 });
   const lock = await acquireRefreshFileLock2({
     name: "ceremony",
     path: paths.statePath,
@@ -10307,7 +11140,7 @@ function executeLoggingCommand(input) {
 `);
 }
 // src/mid-conversation-output-config.ts
-function isRecord5(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function normalizeAdaptiveEffort(value) {
@@ -10327,7 +11160,7 @@ function sendsPerTurnControlBeta(model) {
 function supportsPerMessageEffort(body) {
   if (pinsEffortOnEveryRequest(body.model))
     return true;
-  return usesPerTurnControl(body.model) && isRecord5(body.thinking) && body.thinking.type === "adaptive";
+  return usesPerTurnControl(body.model) && isRecord7(body.thinking) && body.thinking.type === "adaptive";
 }
 function defaultAdaptiveEffort(model) {
   return resolveClaudeModelCapabilities(model)?.efforts.default ?? "high";
@@ -10362,7 +11195,7 @@ function applyMidConversationOutputConfig(body, transitions) {
   if (!pinsEveryRequest && compacted.length < 2) {
     return { applied: false, inserted: 0 };
   }
-  const currentOutputConfig = isRecord5(body.output_config) ? body.output_config : {};
+  const currentOutputConfig = isRecord7(body.output_config) ? body.output_config : {};
   const baseline = compacted[0]?.effort ?? normalizeAdaptiveEffort(currentOutputConfig.effort) ?? defaultAdaptiveEffort(body.model);
   const pinnedOutputConfig = { ...currentOutputConfig, effort: baseline };
   if (pinsEveryRequest)
@@ -10379,7 +11212,7 @@ function applyMidConversationOutputConfig(body, transitions) {
   let inserted = 0;
   const rewritten = [];
   for (const message of messages) {
-    if (isRecord5(message) && message.role === "user" && transitionsByBoundary.has(assistantMessages)) {
+    if (isRecord7(message) && message.role === "user" && transitionsByBoundary.has(assistantMessages)) {
       const effort = transitionsByBoundary.get(assistantMessages);
       if (effort && effort !== activeEffort) {
         rewritten.push({
@@ -10392,7 +11225,7 @@ function applyMidConversationOutputConfig(body, transitions) {
       }
     }
     rewritten.push(message);
-    if (isRecord5(message) && message.role === "assistant")
+    if (isRecord7(message) && message.role === "assistant")
       assistantMessages++;
   }
   if (!pinsEveryRequest && inserted === 0) {
@@ -10574,7 +11407,7 @@ function isOpenAIReasoningSignature(value) {
   }
 }
 // src/native-account-runtime.ts
-import { randomUUID as randomUUID15 } from "node:crypto";
+import { randomUUID as randomUUID16 } from "node:crypto";
 
 // ../../node_modules/@cortexkit/common-auth/dist/store/errors.js
 class PoolOperationError extends Error {
@@ -10651,8 +11484,8 @@ function recordIdentityIn(tx, id, identity2) {
 import { setTimeout as snapshotDelay } from "node:timers/promises";
 
 // ../../node_modules/@cortexkit/common-auth/dist/store/hooks.js
-import { AsyncLocalStorage } from "node:async_hooks";
-var insideHook = new AsyncLocalStorage;
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+var insideHook = new AsyncLocalStorage2;
 function assertNotInsideHook(operation) {
   if (insideHook.getStore() !== undefined)
     throw new PoolReentryError(operation);
@@ -10800,7 +11633,7 @@ function assertNotReserved(operation, id, reservation) {
 }
 
 // ../../node_modules/@cortexkit/common-auth/dist/store/schema.js
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 var POOL_KEY = "commonAuthPool";
 var POOL_SCHEMA_VERSION = 1;
 var POOL_ROWS_KEY = "rows";
@@ -10813,22 +11646,22 @@ function canonicalJson(value) {
   const encode = (item) => {
     if (Array.isArray(item))
       return `[${item.map(encode).join(",")}]`;
-    if (isRecord6(item))
+    if (isRecord8(item))
       return `{${Object.keys(item).sort().map((key) => `${JSON.stringify(key)}:${encode(item[key])}`).join(",")}}`;
     return JSON.stringify(item);
   };
   return encode(normalized);
 }
 function canonicalDigest(value) {
-  return createHash6("sha256").update(canonicalJson(value)).digest("hex");
+  return createHash8("sha256").update(canonicalJson(value)).digest("hex");
 }
 function parseReservation(raw) {
-  if (!isRecord6(raw) || Object.keys(raw).length !== 1 || typeof raw.reservation !== "string" || !raw.reservation)
+  if (!isRecord8(raw) || Object.keys(raw).length !== 1 || typeof raw.reservation !== "string" || !raw.reservation)
     return;
   return { reservation: raw.reservation };
 }
 function parseStagedStamp(raw) {
-  if (!isRecord6(raw) || typeof raw.reservation !== "string" || !raw.reservation || typeof raw.disabledReason !== "string")
+  if (!isRecord8(raw) || typeof raw.reservation !== "string" || !raw.reservation || typeof raw.disabledReason !== "string")
     return;
   if (Object.keys(raw).some((key) => !["reservation", "label", "disabledReason", "providerState"].includes(key)))
     return;
@@ -10839,7 +11672,7 @@ function parseStagedStamp(raw) {
   return raw;
 }
 var PROVIDER_STATE_KEY = "commonAuthProviderState";
-function isRecord6(value) {
+function isRecord8(value) {
   return value != null && typeof value === "object" && !Array.isArray(value);
 }
 var UNSAFE_IDS = new Set(["__proto__", "constructor", "prototype"]);
@@ -10867,10 +11700,10 @@ function secretOf(credential) {
   return credential.type === "oauth" ? `oauth\x00${credential.refresh}` : `api\x00${credential.apiKey}`;
 }
 function fingerprintOf(credential) {
-  return createHash6("sha256").update(secretOf(credential)).digest("hex");
+  return createHash8("sha256").update(secretOf(credential)).digest("hex");
 }
 function credentialDigest(credential) {
-  return createHash6("sha256").update(`credential-stamp\x00${secretOf(credential)}`).digest("hex");
+  return createHash8("sha256").update(`credential-stamp\x00${secretOf(credential)}`).digest("hex");
 }
 function dispatchDigest(credential) {
   const parts = credential.type === "oauth" ? [
@@ -10884,7 +11717,7 @@ function dispatchDigest(credential) {
     credential.baseURL.trim(),
     credential.authHeader ?? "authorization-bearer"
   ];
-  return createHash6("sha256").update(`credential-dispatch\x00${JSON.stringify(parts)}`).digest("hex");
+  return createHash8("sha256").update(`credential-dispatch\x00${JSON.stringify(parts)}`).digest("hex");
 }
 function stampFor(credential, credentialEpoch, binding, options = {}) {
   return {
@@ -10898,12 +11731,12 @@ function stampFor(credential, credentialEpoch, binding, options = {}) {
 }
 function providerStateDigest(codec, value) {
   const bound = codec?.credentialBound ? codec.credentialBound(value) : value;
-  return createHash6("sha256").update(`provider-state\x00${JSON.stringify(bound ?? null)}`).digest("hex");
+  return createHash8("sha256").update(`provider-state\x00${JSON.stringify(bound ?? null)}`).digest("hex");
 }
 function boundProviderStateDigest(account, credential, credentialEpoch, identity2) {
   if (!credential || credentialEpoch === undefined)
     return;
-  if (!isRecord6(account) || !Object.hasOwn(account, PROVIDER_STATE_KEY))
+  if (!isRecord8(account) || !Object.hasOwn(account, PROVIDER_STATE_KEY))
     return;
   const stamp = parseStamp(account[CREDENTIAL_STAMP_KEY]);
   if (!stamp || stamp.providerState === undefined || stamp.digest !== credentialDigest(credential) || stamp.credentialEpoch !== credentialEpoch || stamp.binding?.identity !== identity2)
@@ -10914,7 +11747,7 @@ function isCredentialEpoch(value) {
   return Number.isSafeInteger(value) && value >= 1;
 }
 function parseStamp(raw) {
-  if (!isRecord6(raw))
+  if (!isRecord8(raw))
     return;
   const epoch = raw.credentialEpoch;
   if (!isCredentialEpoch(epoch))
@@ -10939,7 +11772,7 @@ function parseStamp(raw) {
   if (!("binding" in raw))
     return "dispatch" in raw || "replace" in raw || "providerState" in raw || "staged" in raw ? undefined : { credentialEpoch: epoch, digest: raw.digest };
   const binding = raw.binding;
-  if (!isRecord6(binding))
+  if (!isRecord8(binding))
     return;
   if ("identity" in binding && (typeof binding.identity !== "string" || !binding.identity))
     return;
@@ -10970,7 +11803,7 @@ function bindingAgrees(binding, credential, identity2) {
 function stampStatusOf(credential, credentialEpoch, identity2, account) {
   if (!credential)
     return "none";
-  if (!isRecord6(account) || !Object.hasOwn(account, CREDENTIAL_STAMP_KEY))
+  if (!isRecord8(account) || !Object.hasOwn(account, CREDENTIAL_STAMP_KEY))
     return "missing";
   const stamp = parseStamp(account[CREDENTIAL_STAMP_KEY]);
   if (!stamp)
@@ -10993,7 +11826,7 @@ function classifyConfig(read) {
   if ("parseError" in read)
     return { status: "error", reason: "config file is not valid JSON" };
   const value = read.value;
-  if (!isRecord6(value))
+  if (!isRecord8(value))
     return { status: "error", reason: "config root is not an object" };
   if ("accounts" in value && !Array.isArray(value.accounts))
     return { status: "error", reason: "config accounts is not an array" };
@@ -11001,7 +11834,7 @@ function classifyConfig(read) {
     return Array.isArray(value.accounts) ? { status: "pending-migration", config: value } : { status: "ready", exists: true, config: value };
   }
   const pool = value[POOL_KEY];
-  if (!isRecord6(pool))
+  if (!isRecord8(pool))
     return { status: "error", reason: `${POOL_KEY} is not an object` };
   const version = pool.schemaVersion;
   if (typeof version !== "number" || !Number.isInteger(version) || version < 1)
@@ -11011,7 +11844,7 @@ function classifyConfig(read) {
       status: "error",
       reason: `${POOL_KEY}.schemaVersion ${version} is newer than ${POOL_SCHEMA_VERSION}`
     };
-  if (POOL_ROWS_KEY in pool && !isRecord6(pool[POOL_ROWS_KEY]))
+  if (POOL_ROWS_KEY in pool && !isRecord8(pool[POOL_ROWS_KEY]))
     return {
       status: "error",
       reason: `${POOL_KEY}.${POOL_ROWS_KEY} is not an object`
@@ -11023,9 +11856,9 @@ function classifyState(read) {
     return { status: "ready", exists: false, state: {} };
   if ("parseError" in read)
     return { status: "error", reason: "state file is not valid JSON" };
-  if (!isRecord6(read.value))
+  if (!isRecord8(read.value))
     return { status: "error", reason: "state root is not an object" };
-  if ("accounts" in read.value && !isRecord6(read.value.accounts))
+  if ("accounts" in read.value && !isRecord8(read.value.accounts))
     return { status: "error", reason: "state accounts is not an object" };
   return { status: "ready", exists: true, state: read.value };
 }
@@ -11034,16 +11867,16 @@ function rosterOf(config) {
 }
 function entriesOf(config) {
   const pool = config[POOL_KEY];
-  if (!isRecord6(pool))
+  if (!isRecord8(pool))
     return {};
   const rows = pool[POOL_ROWS_KEY];
-  return isRecord6(rows) ? rows : {};
+  return isRecord8(rows) ? rows : {};
 }
 function stateAccountsOf(state) {
-  return isRecord6(state.accounts) ? state.accounts : {};
+  return isRecord8(state.accounts) ? state.accounts : {};
 }
 function rosterRowProblem(raw) {
-  if (!isRecord6(raw))
+  if (!isRecord8(raw))
     return "not an object";
   const problem = idProblem(raw.id);
   if (problem)
@@ -11055,7 +11888,7 @@ function rosterRowProblem(raw) {
   return "unknown type";
 }
 function parseEntry(raw, codec) {
-  if (!isRecord6(raw))
+  if (!isRecord8(raw))
     return;
   const epoch = raw.credentialEpoch;
   if (!isCredentialEpoch(epoch))
@@ -11077,7 +11910,7 @@ function parseEntry(raw, codec) {
   };
 }
 function credentialFor(raw, stateEntry) {
-  if (!isRecord6(stateEntry))
+  if (!isRecord8(stateEntry))
     return;
   if (raw.type === "api") {
     const apiKey = typeof stateEntry.apiKey === "string" ? stateEntry.apiKey.trim() : "";
@@ -11104,23 +11937,23 @@ function credentialFor(raw, stateEntry) {
   };
 }
 function rosterRowIn(config, id) {
-  return rosterOf(config).find((raw) => isRecord6(raw) && raw.id === id);
+  return rosterOf(config).find((raw) => isRecord8(raw) && raw.id === id);
 }
 function ensurePool(config) {
-  if (!isRecord6(config[POOL_KEY]))
+  if (!isRecord8(config[POOL_KEY]))
     config[POOL_KEY] = {};
   return config[POOL_KEY];
 }
 function ensureEntries(config) {
   const pool = ensurePool(config);
-  if (!isRecord6(pool[POOL_ROWS_KEY]))
+  if (!isRecord8(pool[POOL_ROWS_KEY]))
     pool[POOL_ROWS_KEY] = {};
   return pool[POOL_ROWS_KEY];
 }
 function entryIn(config, id) {
   const entries = entriesOf(config);
   const entry = Object.hasOwn(entries, id) ? entries[id] : undefined;
-  return isRecord6(entry) ? entry : undefined;
+  return isRecord8(entry) ? entry : undefined;
 }
 function setEntryIn(config, id, entry) {
   Object.defineProperty(ensureEntries(config), id, {
@@ -11132,10 +11965,10 @@ function setEntryIn(config, id, entry) {
 }
 function retiredEpochIn(config, id) {
   const pool = config[POOL_KEY];
-  if (!isRecord6(pool))
+  if (!isRecord8(pool))
     return;
   const retired = pool[POOL_RETIRED_EPOCHS_KEY];
-  if (!isRecord6(retired) || !Object.hasOwn(retired, id))
+  if (!isRecord8(retired) || !Object.hasOwn(retired, id))
     return;
   const epoch = retired[id];
   return isCredentialEpoch(epoch) ? epoch : undefined;
@@ -11152,7 +11985,7 @@ function retireEpochsIn(config, dropped) {
   if (ids.length === 0)
     return;
   const pool = ensurePool(config);
-  const previous = isRecord6(pool[POOL_RETIRED_EPOCHS_KEY]) ? pool[POOL_RETIRED_EPOCHS_KEY] : {};
+  const previous = isRecord8(pool[POOL_RETIRED_EPOCHS_KEY]) ? pool[POOL_RETIRED_EPOCHS_KEY] : {};
   const next = {};
   const define = (id, epoch) => Object.defineProperty(next, id, {
     value: epoch,
@@ -11174,17 +12007,17 @@ function buildRawRows(config, state, codec, providerCodec) {
   const rows = [];
   for (const raw of rosterOf(config)) {
     const problem = rosterRowProblem(raw);
-    const id = isRecord6(raw) && typeof raw.id === "string" ? raw.id : undefined;
+    const id = isRecord8(raw) && typeof raw.id === "string" ? raw.id : undefined;
     const rawEntry = id === undefined ? undefined : entries[id];
-    const reserved = isRecord6(rawEntry) && Object.hasOwn(rawEntry, "staged");
+    const reserved = isRecord8(rawEntry) && Object.hasOwn(rawEntry, "staged");
     const staged = reserved ? parseReservation(rawEntry.staged) : undefined;
-    if (problem || !isRecord6(raw) || id === undefined || seen.has(id)) {
+    if (problem || !isRecord8(raw) || id === undefined || seen.has(id)) {
       if (id !== undefined && !seen.has(id))
         seen.add(id);
       if (id !== undefined)
         rows.push({
           id,
-          type: isRecord6(raw) && raw.type === "api" ? "api" : "oauth",
+          type: isRecord8(raw) && raw.type === "api" ? "api" : "oauth",
           enabled: false,
           needsFirstReading: true,
           hasEntry: Object.hasOwn(entries, id),
@@ -11231,7 +12064,7 @@ function buildRawRows(config, state, codec, providerCodec) {
   return rows;
 }
 function providerStateFields(account, credential, credentialEpoch, identity2, codec) {
-  if (!isRecord6(account) || !Object.hasOwn(account, PROVIDER_STATE_KEY))
+  if (!isRecord8(account) || !Object.hasOwn(account, PROVIDER_STATE_KEY))
     return {};
   const digest = boundProviderStateDigest(account, credential, credentialEpoch, identity2);
   if (digest === undefined)
@@ -11291,7 +12124,7 @@ function storedCredential(credential, lastRefreshedAt) {
   };
 }
 function credentialProblem(credential, options = {}) {
-  if (!isRecord6(credential))
+  if (!isRecord8(credential))
     return "credential must be an object";
   if (credential.type === "oauth") {
     if (typeof credential.refresh !== "string" || !credential.refresh.trim())
@@ -11315,10 +12148,10 @@ function credentialProblem(credential, options = {}) {
 var TRANSITION_STAMP_KEY = "transition";
 var TRANSITION_MARK_KEY = "transitionMark";
 function stampedTransition(rawStamp) {
-  if (!isRecord6(rawStamp))
+  if (!isRecord8(rawStamp))
     return;
   const raw = rawStamp[TRANSITION_STAMP_KEY];
-  if (!isRecord6(raw))
+  if (!isRecord8(raw))
     return;
   if (typeof raw.mark !== "string" || raw.mark.length === 0)
     return;
@@ -11361,13 +12194,13 @@ function isReplaceStamp(stamp) {
   return stamp.replace === true || stamp.dispatch === undefined;
 }
 function tornStamps(config, state, codec, options = {}) {
-  const accounts = isRecord6(state.accounts) ? state.accounts : {};
+  const accounts = isRecord8(state.accounts) ? state.accounts : {};
   const torn = new Map;
   for (const row of buildRawRows(config, state, codec)) {
     if (row.invalid || row.staged || !row.credential)
       continue;
     const account = Object.hasOwn(accounts, row.id) ? accounts[row.id] : undefined;
-    if (!isRecord6(account))
+    if (!isRecord8(account))
       continue;
     const stamp = parseStamp(account[CREDENTIAL_STAMP_KEY]);
     if (!stamp?.binding)
@@ -11575,7 +12408,7 @@ class Transaction {
       return entry && Object.hasOwn(entry, "staged") ? entry.staged : undefined;
     }
     const stamp = this.stateAccount(id)?.[CREDENTIAL_STAMP_KEY];
-    return isRecord6(stamp) && Object.hasOwn(stamp, "staged") ? stamp.staged : undefined;
+    return isRecord8(stamp) && Object.hasOwn(stamp, "staged") ? stamp.staged : undefined;
   }
   assertNotStaged(id) {
     assertNotReserved(this.info.operation, id, this.reservation(id));
@@ -11591,7 +12424,7 @@ class Transaction {
   }
   dropRosterRows(id) {
     const roster = this.roster();
-    const kept = roster.filter((raw) => !(isRecord6(raw) && raw.id === id));
+    const kept = roster.filter((raw) => !(isRecord8(raw) && raw.id === id));
     this.config.accounts = kept;
     return roster.length - kept.length;
   }
@@ -11613,16 +12446,16 @@ class Transaction {
     await this.commitConfig({ counted: false });
   }
   stateAccount(id) {
-    const accounts = isRecord6(this.state.accounts) ? this.state.accounts : {};
+    const accounts = isRecord8(this.state.accounts) ? this.state.accounts : {};
     const entry = Object.hasOwn(accounts, id) ? accounts[id] : undefined;
-    return isRecord6(entry) ? entry : undefined;
+    return isRecord8(entry) ? entry : undefined;
   }
   dropStateAccount(id) {
-    if (isRecord6(this.state.accounts) && Object.hasOwn(this.state.accounts, id))
+    if (isRecord8(this.state.accounts) && Object.hasOwn(this.state.accounts, id))
       delete this.state.accounts[id];
   }
   setStateAccount(id, fields) {
-    if (!isRecord6(this.state.accounts))
+    if (!isRecord8(this.state.accounts))
       this.state.accounts = {};
     Object.defineProperty(this.state.accounts, id, {
       value: fields,
@@ -11635,11 +12468,11 @@ class Transaction {
     const roster = this.roster();
     const rosterIds = new Set;
     for (const raw of roster)
-      if (isRecord6(raw) && typeof raw.id === "string")
+      if (isRecord8(raw) && typeof raw.id === "string")
         rosterIds.add(raw.id);
     const dropped = new Set;
     for (const raw of rosterOf(this.snapshot.config))
-      if (isRecord6(raw) && typeof raw.id === "string" && !rosterIds.has(raw.id))
+      if (isRecord8(raw) && typeof raw.id === "string" && !rosterIds.has(raw.id))
         dropped.add(raw.id);
     for (const id of Object.keys(this.entries()))
       if (!rosterIds.has(id))
@@ -11681,7 +12514,7 @@ class Transaction {
     const next = {
       ...this.state,
       version: LEGACY_STORE_VERSION,
-      accounts: isRecord6(this.state.accounts) ? this.state.accounts : {}
+      accounts: isRecord8(this.state.accounts) ? this.state.accounts : {}
     };
     await this.write(this.ctx.statePath, next, "state", true, options.durable ?? false);
     this.state = next;
@@ -11876,11 +12709,11 @@ async function readRow(rt, operation, id) {
   const row = result.rows.find((candidate) => candidate.id === id);
   const entry = entryIn(result.config, id);
   const accounts = result.state.accounts;
-  const account = isRecord6(accounts) && Object.hasOwn(accounts, id) ? accounts[id] : undefined;
-  const stamp = isRecord6(account) ? account[CREDENTIAL_STAMP_KEY] : undefined;
+  const account = isRecord8(accounts) && Object.hasOwn(accounts, id) ? accounts[id] : undefined;
+  const stamp = isRecord8(account) ? account[CREDENTIAL_STAMP_KEY] : undefined;
   if (row && !["enable", "disable"].includes(operation) && entry && Object.hasOwn(entry, "staged"))
     assertNotReserved(operation, id, entry.staged);
-  if (!row && isRecord6(stamp) && Object.hasOwn(stamp, "staged"))
+  if (!row && isRecord8(stamp) && Object.hasOwn(stamp, "staged"))
     assertNotReserved(operation, id, stamp.staged);
   if (!row)
     throw unknownRow(operation, id);
@@ -12024,7 +12857,7 @@ async function updateProviderStateRow(rt, id, fence, mutator, options = {}) {
       throw refusal(operation, id, "invalid-input", "the store was opened without a provider-state codec");
     if (typeof mutator !== "function")
       throw refusal(operation, id, "invalid-input", "a mutator is required");
-    const captured = isRecord6(fence) ? fence.credentialEpoch : undefined;
+    const captured = isRecord8(fence) ? fence.credentialEpoch : undefined;
     if (!isCredentialEpoch(captured))
       throw refusal(operation, id, "invalid-input", "the credential epoch the provider state was read at is required");
     const { row: seen } = await readRow(rt, operation, id);
@@ -12068,7 +12901,7 @@ async function planProviderStateIn(tx, codec, operation, row, mutator, declinabl
   const account = tx.stateAccount(id);
   const rawStamp = account?.[CREDENTIAL_STAMP_KEY];
   const stamp = parseStamp(rawStamp);
-  if (!isRecord6(rawStamp) || !stamp?.binding || stamp.digest !== credentialDigest(credential) || stamp.credentialEpoch !== epoch || stamp.binding.identity !== row.identity)
+  if (!isRecord8(rawStamp) || !stamp?.binding || stamp.digest !== credentialDigest(credential) || stamp.credentialEpoch !== epoch || stamp.binding.identity !== row.identity)
     throw refusal(operation, id, "unbound-credential", `row ${id}'s credential carries no stamp of this store to bind a provider state to (stamp ${row.stamp}); rotate or replace it first`);
   const current = row.providerState === undefined ? undefined : structuredClone(row.providerState);
   const returned = await runInsideHook(operation, () => mutator(current, row));
@@ -12098,7 +12931,7 @@ async function planProviderStateIn(tx, codec, operation, row, mutator, declinabl
 }
 
 // ../../node_modules/@cortexkit/common-auth/dist/store/rows.js
-import { randomUUID as randomUUID10 } from "node:crypto";
+import { randomUUID as randomUUID11 } from "node:crypto";
 async function protectIn(tx, id, protect) {
   if (!protect)
     return;
@@ -12144,7 +12977,7 @@ function onRowEndpoint(tx, id, credential) {
   if (credential.type !== "api")
     return credential;
   const raw = tx.rosterRow(id);
-  if (!isRecord6(raw)) {
+  if (!isRecord8(raw)) {
     if (credential.baseURL === undefined)
       throw refusal(tx.info.operation, id, "invalid-input", "api credential needs a valid baseURL");
     return { ...credential, baseURL: credential.baseURL };
@@ -12163,7 +12996,7 @@ function onRowEndpoint(tx, id, credential) {
 function bindingInTx(tx, id, stored, learnt) {
   const raw = tx.rosterRow(id);
   const projected = tx.row(id);
-  const identity2 = learnt ?? (projected ? projected.identity : isRecord6(raw) && typeof raw.accountId === "string" && raw.accountId ? raw.accountId : undefined);
+  const identity2 = learnt ?? (projected ? projected.identity : isRecord8(raw) && typeof raw.accountId === "string" && raw.accountId ? raw.accountId : undefined);
   return {
     ...identity2 !== undefined ? { identity: identity2 } : {},
     ...stored.type === "api" ? {
@@ -12247,7 +13080,7 @@ function requireUsableRow(operation, id, row, credential) {
   return row;
 }
 function validateAttribution(operation, id, fence) {
-  if (fence !== undefined && !isCredentialEpoch(isRecord6(fence) ? fence.credentialEpoch : undefined))
+  if (fence !== undefined && !isCredentialEpoch(isRecord8(fence) ? fence.credentialEpoch : undefined))
     throw refusal(operation, id, "invalid-input", "the attribution must name a credential epoch that is a positive safe integer");
 }
 function assertRowAttribution(operation, id, row, fence) {
@@ -12402,7 +13235,7 @@ async function addRow(rt, input, options = {}) {
     const mode = options.onExisting ?? "rotate";
     if (input.stage !== undefined && mode === "rotate")
       throw refusal("add", id, "invalid-input", "a staged add needs onExisting: 'refuse' or 'stage-duplicate'");
-    if (!["rotate", "refuse", "stage-duplicate"].includes(mode) || input.stage !== undefined && (label !== undefined && typeof label !== "string" || identity2 !== undefined && (typeof identity2 !== "string" || !identity2)) || input.disabled !== undefined && (!isRecord6(input.disabled) || typeof input.disabled.reason !== "string") || input.stage !== undefined && (!isRecord6(input.stage) || typeof input.stage.reservation !== "string" || !input.stage.reservation || !input.disabled) || mode === "stage-duplicate" && (!input.disabled || !input.stage))
+    if (!["rotate", "refuse", "stage-duplicate"].includes(mode) || input.stage !== undefined && (label !== undefined && typeof label !== "string" || identity2 !== undefined && (typeof identity2 !== "string" || !identity2)) || input.disabled !== undefined && (!isRecord8(input.disabled) || typeof input.disabled.reason !== "string") || input.stage !== undefined && (!isRecord8(input.stage) || typeof input.stage.reservation !== "string" || !input.stage.reservation || !input.disabled) || mode === "stage-duplicate" && (!input.disabled || !input.stage))
       throw refusal("add", id, "invalid-input", "staging requires a reservation and a disabled reason");
     const incoming = input.providerState === undefined ? undefined : acceptProviderState(ctx.providerState, "add", id, input.providerState);
     await locks.acquire(rowLockSpec(rt, { id, identity: identity2 }));
@@ -12412,12 +13245,12 @@ async function addRow(rt, input, options = {}) {
       await locks.acquire(extra);
     return withTransaction(ctx, locks, progress, { operation: "add", rowId: id }, async (tx) => {
       await protectIn(tx, id, options.protect);
-      const stateAccounts = isRecord6(tx.state.accounts) ? tx.state.accounts : {};
+      const stateAccounts = isRecord8(tx.state.accounts) ? tx.state.accounts : {};
       const stagedOrphan = Object.entries(stateAccounts).find(([orphanId, account]) => {
-        if (orphanId === id || tx.rosterRow(orphanId) || !isRecord6(account))
+        if (orphanId === id || tx.rosterRow(orphanId) || !isRecord8(account))
           return false;
         const stamp = account[CREDENTIAL_STAMP_KEY];
-        if (!isRecord6(stamp) || !Object.hasOwn(stamp, "staged"))
+        if (!isRecord8(stamp) || !Object.hasOwn(stamp, "staged"))
           return false;
         return credential.type === "oauth" ? account.refresh === credential.refresh : typeof account.apiKey === "string" && account.apiKey.trim() === credential.apiKey.trim();
       });
@@ -12435,9 +13268,9 @@ async function addRow(rt, input, options = {}) {
       }
       if (mode === "refuse") {
         const holder = tx.rows().find((row) => row.fingerprint === fingerprintOf(credential) || row.id === id && row.credential);
-        const accounts = isRecord6(tx.state.accounts) ? tx.state.accounts : {};
+        const accounts = isRecord8(tx.state.accounts) ? tx.state.accounts : {};
         const stateHolder = Object.entries(accounts).find(([, account]) => {
-          if (!isRecord6(account))
+          if (!isRecord8(account))
             return false;
           if (credential.type === "oauth")
             return account.refresh === credential.refresh;
@@ -12740,7 +13573,7 @@ async function transitionRow(rt, operation, id, flag, options) {
         await tx.commitState();
         return result;
       }
-      const transition = flag.enabled ? { mark: randomUUID10(), enabled: true } : { mark: randomUUID10(), enabled: false, reason: flag.reason };
+      const transition = flag.enabled ? { mark: randomUUID11(), enabled: true } : { mark: randomUUID11(), enabled: false, reason: flag.reason };
       const stamp = plan.account[CREDENTIAL_STAMP_KEY];
       tx.setStateAccount(id, {
         ...plan.account,
@@ -12770,7 +13603,7 @@ async function removeRow(rt, id, options = {}) {
       throw refusal("remove", id, "invalid-input", "id must be non-empty");
     const fence = options.attribution;
     validateAttribution("remove", id, fence);
-    if (options.staged !== undefined && (!isRecord6(options.staged) || typeof options.staged.reservation !== "string" || !options.staged.reservation))
+    if (options.staged !== undefined && (!isRecord8(options.staged) || typeof options.staged.reservation !== "string" || !options.staged.reservation))
       throw refusal("remove", id, "invalid-input", "a staged removal needs a reservation");
     const result = await readPool(ctx);
     if (result.status !== "ready")
@@ -12785,7 +13618,7 @@ async function removeRow(rt, id, options = {}) {
     return withTransaction(ctx, locks, progress, { operation: "remove", rowId: id }, async (tx) => {
       const reservation = tx.reservation(id);
       if (reservation !== undefined) {
-        if (!isRecord6(reservation) || !options.staged || reservation.reservation !== options.staged.reservation)
+        if (!isRecord8(reservation) || !options.staged || reservation.reservation !== options.staged.reservation)
           throw refusal("remove", id, "row-staged", `row ${id} is reserved for roster publication`);
       } else if (options.staged)
         throw refusal("remove", id, "attribution", `row ${id} is no longer reserved`);
@@ -12873,10 +13706,10 @@ function assertOrphanAttribution(rt, tx, id, fence) {
 }
 function hasStateAccount(state, id) {
   const accounts = state.accounts;
-  return isRecord6(accounts) && Object.hasOwn(accounts, id);
+  return isRecord8(accounts) && Object.hasOwn(accounts, id);
 }
 function rosterIdOf(raw) {
-  return isRecord6(raw) && typeof raw.id === "string" ? raw.id : undefined;
+  return isRecord8(raw) && typeof raw.id === "string" ? raw.id : undefined;
 }
 function orderProblem(roster, ids) {
   if (!Array.isArray(ids))
@@ -12951,7 +13784,7 @@ async function recordRowIdentity(rt, id, identity2, attribution, options = {}) {
   return runOperation(rt.ctx, "recordIdentity", id, options.onFailure, async (locks, progress) => {
     if (typeof identity2 !== "string" || identity2.length === 0)
       throw refusal("recordIdentity", id, "invalid-input", "identity must be non-empty");
-    const captured = isRecord6(attribution) ? attribution.credentialEpoch : undefined;
+    const captured = isRecord8(attribution) ? attribution.credentialEpoch : undefined;
     if (!isCredentialEpoch(captured))
       throw refusal("recordIdentity", id, "invalid-input", "the credential epoch the identity lookup was issued for is required");
     const { row: seen } = await readRow(rt, "recordIdentity", id);
@@ -12980,14 +13813,14 @@ async function recordRowIdentity(rt, id, identity2, attribution, options = {}) {
 // ../../node_modules/@cortexkit/common-auth/dist/store/publication.js
 function receiptsIn(config) {
   const pool = config[POOL_KEY];
-  return isRecord6(pool) && isRecord6(pool.publications) ? pool.publications : {};
+  return isRecord8(pool) && isRecord8(pool.publications) ? pool.publications : {};
 }
 function receiptIn(config, operationId) {
   const receipts = receiptsIn(config);
   if (!Object.hasOwn(receipts, operationId))
     return;
   const raw = receipts[operationId];
-  if (!isRecord6(raw) || raw.operationId !== operationId || typeof raw.planDigest !== "string" || !/^[a-f0-9]{64}$/.test(raw.planDigest) || !["committed", "cleaned"].includes(String(raw.phase)) || !Array.isArray(raw.removed) || !Array.isArray(raw.finalized) || raw.removed.some((ref) => !isRecord6(ref) || typeof ref.id !== "string" || !isCredentialEpoch(ref.credentialEpoch)) || raw.finalized.some((ref) => !isRecord6(ref) || typeof ref.id !== "string" || !isCredentialEpoch(ref.credentialEpoch) || typeof ref.reservation !== "string" || !ref.reservation || typeof ref.enabled !== "boolean"))
+  if (!isRecord8(raw) || raw.operationId !== operationId || typeof raw.planDigest !== "string" || !/^[a-f0-9]{64}$/.test(raw.planDigest) || !["committed", "cleaned"].includes(String(raw.phase)) || !Array.isArray(raw.removed) || !Array.isArray(raw.finalized) || raw.removed.some((ref) => !isRecord8(ref) || typeof ref.id !== "string" || !isCredentialEpoch(ref.credentialEpoch)) || raw.finalized.some((ref) => !isRecord8(ref) || typeof ref.id !== "string" || !isCredentialEpoch(ref.credentialEpoch) || typeof ref.reservation !== "string" || !ref.reservation || typeof ref.enabled !== "boolean"))
     throw refusal("publishRoster", operationId, "invalid-input", "the stored publication receipt is malformed");
   return structuredClone(raw);
 }
@@ -13001,11 +13834,11 @@ function validatePlan(rt, plan) {
   const fail = () => {
     throw refusal("publishRoster", plan?.operationId ?? "", "invalid-input", "the publication plan is invalid");
   };
-  if (!isRecord6(plan) || typeof plan.operationId !== "string" || !plan.operationId || !Array.isArray(plan.remove) || !Array.isArray(plan.finalize) || !Array.isArray(plan.order))
+  if (!isRecord8(plan) || typeof plan.operationId !== "string" || !plan.operationId || !Array.isArray(plan.remove) || !Array.isArray(plan.finalize) || !Array.isArray(plan.order))
     fail();
   const ids = new Set;
   for (const ref of [...plan.remove, ...plan.finalize]) {
-    if (!isRecord6(ref) || typeof ref.id !== "string" || idProblem(ref.id) || ids.has(ref.id) || !ref.attribution)
+    if (!isRecord8(ref) || typeof ref.id !== "string" || idProblem(ref.id) || ids.has(ref.id) || !ref.attribution)
       fail();
     ids.add(ref.id);
     validateAttribution("publishRoster", ref.id, ref.attribution);
@@ -13037,7 +13870,7 @@ function saveReceipt(tx, receipt) {
 function publicationSurvivors(tx, plan, rows) {
   const rosterIds = new Set;
   for (const raw of rosterOf(tx.config)) {
-    if (!isRecord6(raw) || typeof raw.id !== "string")
+    if (!isRecord8(raw) || typeof raw.id !== "string")
       continue;
     if (rosterIds.has(raw.id))
       throw refusal("publishRoster", plan.operationId, "invalid-input", "publication needs a roster of unique named rows");
@@ -13076,14 +13909,14 @@ async function cleanup(tx, receipt) {
 async function publishRoster(rt, plan, options = {}) {
   assertNotInsideHook("publishRoster");
   return runOperation(rt.ctx, "publishRoster", plan?.operationId ?? "", options.onFailure, async (locks, progress) => {
-    if (!isRecord6(plan) || typeof plan.operationId !== "string" || !plan.operationId)
+    if (!isRecord8(plan) || typeof plan.operationId !== "string" || !plan.operationId)
       throw refusal("publishRoster", plan?.operationId ?? "", "invalid-input", "the publication needs an operation id");
     plan = structuredClone(plan);
     const planDigest = canonicalDigest(plan);
     const named = [
       ...Array.isArray(plan.remove) ? plan.remove : [],
       ...Array.isArray(plan.finalize) ? plan.finalize : []
-    ].filter((ref) => isRecord6(ref) && typeof ref.id === "string");
+    ].filter((ref) => isRecord8(ref) && typeof ref.id === "string");
     for (let attempt = 0;; attempt++) {
       const seen = await readPool(rt.ctx);
       if (seen.status !== "ready")
@@ -13187,7 +14020,7 @@ async function publishRoster(rt, plan, options = {}) {
             entry.disabledReason = ref.disabledReason;
           tx.setEntry(ref.id, entry);
         }
-        const preserved = tx.roster().filter((raw) => !isRecord6(raw) || typeof raw.id !== "string" || rows.find((row) => row.id === raw.id)?.invalid === "roster");
+        const preserved = tx.roster().filter((raw) => !isRecord8(raw) || typeof raw.id !== "string" || rows.find((row) => row.id === raw.id)?.invalid === "roster");
         tx.config.accounts = [
           ...plan.order.map((id) => tx.rosterRow(id)),
           ...preserved
@@ -13317,8 +14150,8 @@ class PullScheduler {
 }
 // ../../node_modules/@cortexkit/common-auth/dist/logger/engine.js
 import { appendFileSync as appendFileSync2, chmodSync, existsSync as existsSync3, renameSync as renameSync2, statSync as statSync4 } from "node:fs";
-import { open as open6 } from "node:fs/promises";
-import { dirname as dirname9, resolve as resolve6 } from "node:path";
+import { open as open7 } from "node:fs/promises";
+import { dirname as dirname12, resolve as resolve6 } from "node:path";
 var ORDER = {
   error: 0,
   warn: 1,
@@ -13357,7 +14190,7 @@ async function closeWindowsFile(sink) {
     await privateOperation(file, "log-close", () => handle.close());
 }
 async function openWindowsFile(sink, file) {
-  await ensurePrivateDirectory(dirname9(file));
+  await ensurePrivateDirectory(dirname12(file));
   try {
     await verifyPrivate(file, "file", true);
   } catch (error) {
@@ -13371,7 +14204,7 @@ async function openWindowsFile(sink, file) {
       await verifyPrivate(file, "file", true);
     }
   }
-  sink.handle = await privateOperation(file, "log-open", () => open6(file, "a"));
+  sink.handle = await privateOperation(file, "log-open", () => open7(file, "a"));
   sink.file = file;
   return sink.handle;
 }
@@ -13853,7 +14686,7 @@ class PoolQuotaWriter {
 }
 
 // ../../node_modules/@cortexkit/common-auth/dist/store/refresh.js
-import { randomUUID as randomUUID11 } from "node:crypto";
+import { randomUUID as randomUUID12 } from "node:crypto";
 function requireRefreshable(id, row) {
   assertNotReserved("refresh", id, row?.staged);
   if (!row)
@@ -13970,7 +14803,7 @@ async function refreshRow(rt, id, provider, options = {}) {
         returnedIdentity: result.identity
       } : undefined;
       const transition = contradiction ? {
-        mark: randomUUID11(),
+        mark: randomUUID12(),
         enabled: false,
         reason: `${IDENTITY_CONTRADICTED_REASON_PREFIX}${JSON.stringify(contradiction)}`
       } : undefined;
@@ -14103,7 +14936,7 @@ async function updatePoolSettings(rt, mutator, options = {}) {
       const draft = structuredClone(current);
       const returned = await runInsideHook("updateSettings", () => mutator(draft));
       const next = returned === undefined ? draft : returned;
-      if (!isRecord6(next))
+      if (!isRecord8(next))
         throw settingsRefusal("the settings mutator must produce an object");
       const owned = POOL_OWNED_KEYS.filter((key) => Object.hasOwn(next, key));
       if (owned.length > 0)
@@ -14250,7 +15083,7 @@ function entryTime(entry) {
 function limitKey(scope, label) {
   return JSON.stringify([scope, label]);
 }
-function isRecord7(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isFiniteNumber(value) {
@@ -14269,7 +15102,7 @@ function isString(value) {
   return typeof value === "string";
 }
 function isQuotaEntry(value) {
-  if (!isRecord7(value) || !isName(value.scope) || !isName(value.label)) {
+  if (!isRecord9(value) || !isName(value.scope) || !isName(value.label)) {
     return false;
   }
   switch (value.kind) {
@@ -14284,26 +15117,26 @@ function isQuotaEntry(value) {
   }
 }
 function isCreditBudgetEntry(value) {
-  if (!isRecord7(value) || !isFiniteNumber(value.checkedAt))
+  if (!isRecord9(value) || !isFiniteNumber(value.checkedAt))
     return false;
   if (value.kind === "cleared")
     return true;
   return value.kind === "reading" && typeof value.reached === "boolean" && optional(value, "remainingPercent", isFiniteNumber) && optional(value, "usedPercent", isFiniteNumber) && optional(value, "resetsAt", isString) && optional(value, "limit", isFiniteNumber) && optional(value, "used", isFiniteNumber) && optional(value, "remaining", isFiniteNumber) && optional(value, "unit", isString);
 }
 function isQuotaCounter(value) {
-  return isRecord7(value) && isFiniteNumber(value.value) && Number.isInteger(value.value) && value.value >= 0 && isFiniteNumber(value.checkedAt);
+  return isRecord9(value) && isFiniteNumber(value.value) && Number.isInteger(value.value) && value.value >= 0 && isFiniteNumber(value.checkedAt);
 }
 function isQuotaCounters(value) {
-  return isRecord7(value) && Object.values(value).every(isQuotaCounter);
+  return isRecord9(value) && Object.values(value).every(isQuotaCounter);
 }
 function isBoolean(value) {
   return typeof value === "boolean";
 }
 function isQuotaCredits(value) {
-  return isRecord7(value) && typeof value.hasCredits === "boolean" && typeof value.unlimited === "boolean" && optional(value, "balance", isFiniteNumber) && optional(value, "overageLimitReached", isBoolean) && isFiniteNumber(value.checkedAt);
+  return isRecord9(value) && typeof value.hasCredits === "boolean" && typeof value.unlimited === "boolean" && optional(value, "balance", isFiniteNumber) && optional(value, "overageLimitReached", isBoolean) && isFiniteNumber(value.checkedAt);
 }
 function readQuotaCounters(value) {
-  if (!isRecord7(value))
+  if (!isRecord9(value))
     return;
   const entries = Object.entries(value).filter(([, entry]) => isQuotaCounter(entry));
   return entries.length === 0 ? undefined : Object.fromEntries(entries);
@@ -14311,7 +15144,7 @@ function readQuotaCounters(value) {
 function decodeQuotaMap(value) {
   if (isQuotaMap(value))
     return value;
-  if (!isRecord7(value))
+  if (!isRecord9(value))
     return;
   const { counters: rawCounters, credits: rawCredits, ...rest } = value;
   if (!isQuotaMap(rest))
@@ -14325,7 +15158,7 @@ function decodeQuotaMap(value) {
   };
 }
 function isQuotaMap(value) {
-  if (!isRecord7(value) || !Array.isArray(value.limits))
+  if (!isRecord9(value) || !Array.isArray(value.limits))
     return false;
   const seen = new Set;
   for (const entry of value.limits) {
@@ -14346,7 +15179,7 @@ class QuotaCodecError extends TypeError {
     this.name = "QuotaCodecError";
   }
 }
-function isRecord8(value) {
+function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isFiniteNumber2(value) {
@@ -14365,20 +15198,20 @@ function optionalString(record, key) {
   return record[key] === undefined || typeof record[key] === "string";
 }
 function isObservedReading(value) {
-  return isRecord8(value) && isScope(value.scope) && isLabel(value.label) && isFiniteNumber2(value.usedPercent) && optionalString(value, "resetsAt") && (value.windowMinutes === undefined || isFiniteNumber2(value.windowMinutes) && value.windowMinutes > 0);
+  return isRecord10(value) && isScope(value.scope) && isLabel(value.label) && isFiniteNumber2(value.usedPercent) && optionalString(value, "resetsAt") && (value.windowMinutes === undefined || isFiniteNumber2(value.windowMinutes) && value.windowMinutes > 0);
 }
 function isObservedPair(value) {
-  return isRecord8(value) && isScope(value.scope) && isLabel(value.label);
+  return isRecord10(value) && isScope(value.scope) && isLabel(value.label);
 }
 function isObservedBudget(value) {
-  if (!isRecord8(value))
+  if (!isRecord10(value))
     return false;
   if (value.kind === "cleared")
     return true;
   return value.kind === "reading" && typeof value.reached === "boolean" && optionalFinite(value, "remainingPercent") && optionalFinite(value, "usedPercent") && optionalString(value, "resetsAt") && optionalFinite(value, "limit") && optionalFinite(value, "used") && optionalFinite(value, "remaining") && optionalString(value, "unit");
 }
 function isQuotaObservation(value) {
-  if (!isRecord8(value) || !isFiniteNumber2(value.checkedAt))
+  if (!isRecord10(value) || !isFiniteNumber2(value.checkedAt))
     return false;
   const readings = value.readings ?? [];
   const coverage = value.coverage ?? [];
@@ -14654,11 +15487,11 @@ function groupShortNames(groups) {
 function groupedNarrowPieces(groups, windows) {
   if (!groups || groups.length === 0)
     return;
-  const reported = windows.filter(({ part }) => part.kind === "window");
-  if (reported.some(({ scope }) => scope === ALL_SCOPE))
+  const reported2 = windows.filter(({ part }) => part.kind === "window");
+  if (reported2.some(({ scope }) => scope === ALL_SCOPE))
     return;
   const candidates = groups.flatMap((group, listed) => {
-    const inGroup = reported.filter(({ scope }) => scope === group.scope);
+    const inGroup = reported2.filter(({ scope }) => scope === group.scope);
     const groupTightest = inGroup.reduce((least, window) => least === undefined || (window.part.remainingPercent ?? 0) < (least.part.remainingPercent ?? 0) ? window : least, undefined);
     return groupTightest ? [{ group, listed, window: groupTightest }] : [];
   });
@@ -14945,14 +15778,14 @@ var nativeQuotaCodec = {
 };
 
 // src/native-runtime.ts
-import { randomUUID as randomUUID12 } from "node:crypto";
+import { randomUUID as randomUUID13 } from "node:crypto";
 import { constants as constants2 } from "node:fs";
-import { lstat as lstat6, mkdir as mkdir9, open as open7, rename as rename11, rm as rm6 } from "node:fs/promises";
-import { basename as basename4, dirname as dirname10, isAbsolute as isAbsolute3, join as join12 } from "node:path";
+import { lstat as lstat8, mkdir as mkdir10, open as open8, rename as rename11, rm as rm6 } from "node:fs/promises";
+import { basename as basename7, dirname as dirname13, isAbsolute as isAbsolute4, join as join15 } from "node:path";
 import { types as utilTypes5 } from "node:util";
 
 // src/pool-binding.ts
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 
 class NativePoolBindingError extends Error {
   constructor() {
@@ -14996,7 +15829,7 @@ function nativeLocalPoolBindingMatches(binding, paths, row) {
 function nativeLocalRefreshJobKey(binding) {
   if (!isNativeLocalPoolBinding(binding))
     throw new NativePoolBindingError;
-  return createHash7("sha256").update(JSON.stringify([
+  return createHash9("sha256").update(JSON.stringify([
     "anthropic-local-refresh",
     binding.storageId,
     binding.credentialEpoch,
@@ -15005,9 +15838,9 @@ function nativeLocalRefreshJobKey(binding) {
 }
 
 // src/token-fingerprint.ts
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 function tokenFingerprint(token) {
-  return createHash8("sha256").update(token).digest("hex").slice(0, 16);
+  return createHash10("sha256").update(token).digest("hex").slice(0, 16);
 }
 
 // src/native-credential-validation.ts
@@ -15034,53 +15867,14 @@ function nativeLocalCredentialValidationMatches(validation, binding, material) {
   return validation.binding.storageId === binding.storageId && validation.binding.rowId === binding.rowId && validation.binding.credentialEpoch === binding.credentialEpoch && validation.binding.identity === binding.identity && validation.credentialFingerprint === fingerprintOf({ type: "oauth", refresh: material.refresh }) && validation.version.accessFingerprint === tokenFingerprint(material.access) && validation.version.expires === material.expires && Object.hasOwn(validation.version, "lastRefreshedAt") === Object.hasOwn(material, "lastRefreshedAt") && validation.version.lastRefreshedAt === material.lastRefreshedAt;
 }
 
-// src/native-lock-observer.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
-var detachedLocks = new AsyncLocalStorage2;
-function withDetachedNativeLocks(work) {
-  return detachedLocks.run(true, work);
-}
-function nativeLockObserver(observer) {
-  if (!observer)
-    return;
-  return (event) => {
-    try {
-      const result = observer(detachedLocks.getStore() ? { ...event, detached: true } : event);
-      if (result !== null && (typeof result === "object" || typeof result === "function") && "then" in result && typeof result.then === "function") {
-        Promise.resolve(result).catch(() => {});
-      }
-    } catch {}
-  };
-}
-async function withNativeLock(path2, options, run, acquire = withLock) {
-  const observer = nativeLockObserver(options.onLockEvent);
-  if (!observer)
-    return acquire(path2, options, run);
-  observer({ type: "acquiring", name: options.name, path: path2 });
-  let acquired = false;
-  try {
-    return await acquire(path2, options, async (lease) => {
-      acquired = true;
-      observer({ type: "acquired", name: options.name, path: path2 });
-      return run(lease);
-    });
-  } finally {
-    if (acquired)
-      observer({ type: "released", name: options.name, path: path2 });
-  }
-}
-function observeNativeLocks(acquire, observer) {
-  return (path2, options, run) => withNativeLock(path2, { ...options, onLockEvent: options.onLockEvent ?? observer }, run, acquire());
-}
-
 // src/native-vault-seed.ts
-import { lstat as lstat5, readFile as readFile8 } from "node:fs/promises";
+import { lstat as lstat7, readFile as readFile9 } from "node:fs/promises";
 
 // src/native-migration-source.ts
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash13 } from "node:crypto";
 
 // src/native-host-auth.ts
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 class NativeHostAuthError extends Error {
   code;
   constructor(code) {
@@ -15206,7 +16000,7 @@ function inspectNativeHostAuthEntry(host, hostAuth) {
     }
     return Object.freeze({
       kind,
-      digest: createHash9("sha256").update(canonical, "utf8").digest("hex")
+      digest: createHash11("sha256").update(canonical, "utf8").digest("hex")
     });
   } catch {
     throw new NativeHostAuthError("invalid-source");
@@ -15214,7 +16008,7 @@ function inspectNativeHostAuthEntry(host, hostAuth) {
 }
 
 // src/native-migration-proof.ts
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 import { types } from "node:util";
 
 class NativeMigrationProofError extends Error {
@@ -15288,7 +16082,7 @@ function nativeMigrationCanonicalJson(value) {
   return JSON.stringify(captureNativeMigrationJson(value));
 }
 function nativeMigrationDigest(value) {
-  return createHash10("sha256").update(nativeMigrationCanonicalJson(value)).digest("hex");
+  return createHash12("sha256").update(nativeMigrationCanonicalJson(value)).digest("hex");
 }
 function record3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -15569,7 +16363,7 @@ function runtime(source2, accountIdentity, current) {
       "permanent"
     ]);
     safe.message = field === "lastRefreshError" ? "Imported refresh failure" : "Imported quota failure";
-    if (field === "lastRefreshError" && current?.type === "oauth" && error.tokenHash === createHash11("sha256").update(current.refresh).digest("hex"))
+    if (field === "lastRefreshError" && current?.type === "oauth" && error.tokenHash === createHash13("sha256").update(current.refresh).digest("hex"))
       safe.credentialFingerprint = fingerprintOf(current);
     result[field] = safe;
   }
@@ -15593,7 +16387,7 @@ function projectNativeMigrationSource(input) {
     const hostEntry = inspectNativeHostAuthEntry(input.host, auth);
     if (config.version !== undefined && config.version !== 1 || state.version !== undefined && state.version !== 1)
       refuse2();
-    const formerMain = createHash11("sha256").update(JSON.stringify([input.storageId, input.configDigest, "former-main"])).digest("hex");
+    const formerMain = createHash13("sha256").update(JSON.stringify([input.storageId, input.configDigest, "former-main"])).digest("hex");
     const mainRouteId = config.mainAccountId === undefined ? `${formerMain.slice(0, 8)}-${formerMain.slice(8, 12)}-${formerMain.slice(12, 16)}-${formerMain.slice(16, 20)}-${formerMain.slice(20, 32)}` : id(config.mainAccountId);
     const settings = {
       mainAccountId: mainRouteId,
@@ -15867,14 +16661,14 @@ function record5(value) {
 }
 async function readNativeVaultLegacyJson(path2) {
   try {
-    return JSON.parse(await readFile8(path2, "utf8"));
+    return JSON.parse(await readFile9(path2, "utf8"));
   } catch {
     return;
   }
 }
 async function nativeVaultFileAbsent(path2) {
   try {
-    await lstat5(path2);
+    await lstat7(path2);
     return false;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT")
@@ -16263,7 +17057,7 @@ function missing(error) {
   return error instanceof Error && "code" in error && error.code === "ENOENT";
 }
 function checkPath(path2) {
-  if (!isAbsolute3(path2))
+  if (!isAbsolute4(path2))
     throw new NativeRuntimeError("unsafe-runtime");
 }
 async function readNativeRuntime(path2, storageId, ownership = {}) {
@@ -16273,10 +17067,10 @@ async function readNativeRuntime(path2, storageId, ownership = {}) {
   const noFollow = constants2.O_NOFOLLOW ?? 0;
   try {
     for (let attempt = 0;attempt < 2; attempt++) {
-      const info = await lstat6(path2);
+      const info = await lstat8(path2);
       if (!info.isFile() || !await isOwnerOnly(path2, () => (info.mode & 511) === 384 && (typeof process.geteuid !== "function" || info.uid === process.geteuid()), ownership))
         throw new NativeRuntimeError("unsafe-runtime");
-      const file = await open7(path2, constants2.O_RDONLY | noFollow);
+      const file = await open8(path2, constants2.O_RDONLY | noFollow);
       try {
         const opened = await file.stat();
         if (!opened.isFile() || !await isOwnerOnly(path2, () => (opened.mode & 511) === 384 && (typeof process.geteuid !== "function" || opened.uid === process.geteuid()), ownership))
@@ -16395,7 +17189,7 @@ async function writeNativeRuntimeOutcome(path2, storageId, change, hooks, firstI
   checkPath(path2);
   const publication2 = capturePublicationOptions(hooks.publication);
   try {
-    await mkdir9(dirname10(path2), { recursive: true, mode: 448 });
+    await mkdir10(dirname13(path2), { recursive: true, mode: 448 });
     return await withLock2(path2, {
       name: "native-runtime",
       ttlMs: 1e4,
@@ -16409,11 +17203,11 @@ async function writeNativeRuntimeOutcome(path2, storageId, change, hooks, firstI
       assertTransitions(current, next, firstIdentity);
       const bytes = `${JSON.stringify(next, null, 2)}
 `;
-      const stage = join12(dirname10(path2), `${basename4(path2)}.native-runtime.${randomUUID12()}.partial`);
+      const stage = join15(dirname13(path2), `${basename7(path2)}.native-runtime.${randomUUID13()}.partial`);
       let ownsStage = false;
       try {
         const nativeCreated = await createWindowsOwnerOnly(stage, bytes);
-        const file = await open7(stage, nativeCreated ? constants2.O_RDWR : "wx", 384);
+        const file = await open8(stage, nativeCreated ? constants2.O_RDWR : "wx", 384);
         ownsStage = true;
         try {
           if (!nativeCreated)
@@ -17710,7 +18504,7 @@ function insulaUsageTransport(options) {
           })), 3000);
           deadline.unref?.();
         });
-        const open8 = (async () => {
+        const open9 = (async () => {
           const handshakeTimeoutMs = Math.min(options.handshakeTimeoutMs ?? 3000, 3000);
           const connected = options.connector ? await options.connector({
             connectionFile: options.connectionFile,
@@ -17732,7 +18526,7 @@ function insulaUsageTransport(options) {
           subscription = connected.subscribe(route, { method: "usage.watch" }, onNotice);
         })();
         try {
-          await Promise.race([open8, timeout]);
+          await Promise.race([open9, timeout]);
         } catch (error) {
           stopped = true;
           throw error;
@@ -18064,12 +18858,12 @@ var CUSTODY_PLACEHOLDER_PREFIX = "claustrum-tombstone:v1:";
 
 // ../../node_modules/@cortexkit/common-auth/dist/claustrum/shutdown.js
 function shutdownWarning(logger2, shutdown) {
-  let warned = false;
+  let warned2 = false;
   return (pendingOperations) => {
-    if (warned)
+    if (warned2)
       return;
     if (!shutdown || shutdown.aborted)
-      warned = true;
+      warned2 = true;
     logger2.warn("claustrum shutdown drain timed out", { pendingOperations });
   };
 }
@@ -18719,7 +19513,7 @@ function quotaFields(publication2, witness = "") {
 }
 
 // ../../node_modules/@cortexkit/common-auth/dist/claustrum/roster.js
-import { createHash as createHash12 } from "node:crypto";
+import { createHash as createHash14 } from "node:crypto";
 import { stat as stat7 } from "node:fs/promises";
 import { resolve as resolve8 } from "node:path";
 
@@ -18766,7 +19560,7 @@ function seedIndex(seed, row) {
 }
 var DEFAULT_ROUTE_PREFIX = "vault:";
 function hash(value) {
-  return createHash12("sha256").update(value).digest("hex");
+  return createHash14("sha256").update(value).digest("hex");
 }
 function defaultLabel(credential2) {
   const parts = credential2.credentialId.split(":");
@@ -18917,15 +19711,15 @@ function vaultRoutingRows(roster) {
     ...row.quota !== undefined && { quota: row.quota }
   }));
 }
-function isRecord9(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function optionalString2(value) {
   return value === undefined || typeof value === "string";
 }
 function decodeRow(value) {
-  const quota2 = isRecord9(value) ? decodeQuotaMap(value.quota) : undefined;
-  if (!isRecord9(value) || typeof value.routeId !== "string" || typeof value.credentialId !== "string" || value.credentialType !== "oauth" && value.credentialType !== "api_key" || typeof value.state !== "string" || typeof value.label !== "string" || typeof value.enabled !== "boolean" || typeof value.addedAt !== "number" || !optionalString2(value.accountIdentity) || !optionalString2(value.email) || !optionalString2(value.orgName) || value.aliases !== undefined && (!Array.isArray(value.aliases) || !value.aliases.every((alias) => typeof alias === "string")) || value.quota !== undefined && quota2 === undefined || value.stale !== undefined && value.stale !== true || value.unclaimed !== undefined && value.unclaimed !== true)
+  const quota2 = isRecord11(value) ? decodeQuotaMap(value.quota) : undefined;
+  if (!isRecord11(value) || typeof value.routeId !== "string" || typeof value.credentialId !== "string" || value.credentialType !== "oauth" && value.credentialType !== "api_key" || typeof value.state !== "string" || typeof value.label !== "string" || typeof value.enabled !== "boolean" || typeof value.addedAt !== "number" || !optionalString2(value.accountIdentity) || !optionalString2(value.email) || !optionalString2(value.orgName) || value.aliases !== undefined && (!Array.isArray(value.aliases) || !value.aliases.every((alias) => typeof alias === "string")) || value.quota !== undefined && quota2 === undefined || value.stale !== undefined && value.stale !== true || value.unclaimed !== undefined && value.unclaimed !== true)
     return;
   return {
     ...value,
@@ -18943,14 +19737,14 @@ function decodeRejected(value) {
     return;
   const records = [];
   for (const entry2 of value) {
-    if (!isRecord9(entry2) || !optionalString2(entry2.credentialId) || typeof entry2.reason !== "string" || !SKIPPED_REASONS.has(entry2.reason))
+    if (!isRecord11(entry2) || !optionalString2(entry2.credentialId) || typeof entry2.reason !== "string" || !SKIPPED_REASONS.has(entry2.reason))
       return;
     records.push(entry2);
   }
   return records;
 }
 function decodeRoster(value) {
-  if (!isRecord9(value) || value.version !== 1 || !optionalString2(value.view) || !Array.isArray(value.rows) || !Array.isArray(value.declined) || value.complete !== undefined && typeof value.complete !== "boolean" || value.rejected !== undefined && !decodeRejected(value.rejected))
+  if (!isRecord11(value) || value.version !== 1 || !optionalString2(value.view) || !Array.isArray(value.rows) || !Array.isArray(value.declined) || value.complete !== undefined && typeof value.complete !== "boolean" || value.rejected !== undefined && !decodeRejected(value.rejected))
     throw new ClaustrumConsumerError("invalid-state", "Claustrum roster file is not valid");
   const rows = [];
   for (const entry2 of value.rows) {
@@ -18961,7 +19755,7 @@ function decodeRoster(value) {
   }
   const declined = [];
   for (const entry2 of value.declined) {
-    if (!isRecord9(entry2) || typeof entry2.credentialId !== "string" || !optionalString2(entry2.accountIdentity))
+    if (!isRecord11(entry2) || typeof entry2.credentialId !== "string" || !optionalString2(entry2.accountIdentity))
       throw new ClaustrumConsumerError("invalid-state", "Claustrum roster file is not valid");
     declined.push(entry2);
   }
@@ -20120,9 +20914,9 @@ class ClaustrumConsumer {
   }
 }
 // ../../node_modules/@cortexkit/common-auth/dist/claustrum/hub.js
-import { createHash as createHash13 } from "node:crypto";
+import { createHash as createHash15 } from "node:crypto";
 import { readdir as readdir3, stat as stat8 } from "node:fs/promises";
-import { join as join13 } from "node:path";
+import { dirname as dirname14, join as join16 } from "node:path";
 var FILE_ID = /^[a-z0-9][a-z0-9._-]{0,63}$/;
 var WINDOWS_DEVICE = /^(con|prn|aux|nul|com[0-9]|lpt[0-9])(\.|$)/;
 var FINGERPRINT = /^[0-9a-f]{16}$/;
@@ -20168,7 +20962,7 @@ function rosterFingerprint(options, members) {
   });
   if (input === undefined)
     throw new ClaustrumConsumerError("invalid-state", "Claustrum hub classifierInput must be plain JSON");
-  return createHash13("sha256").update(input).digest("hex").slice(0, 16);
+  return createHash15("sha256").update(input).digest("hex").slice(0, 16);
 }
 function fileId(value, what) {
   if (typeof value !== "string" || !FILE_ID.test(value) || WINDOWS_DEVICE.test(value))
@@ -20236,13 +21030,13 @@ class ClaustrumDiscoveryHub {
     this.#options = options;
     this.#logger = options.logger ?? createLogger("claustrum");
     this.#warnShutdown = shutdownWarning(this.#logger, this.#shutdown.signal);
-    this.#generationDirectory = join13(options.stateDir, "rosters", hostGeneration);
+    this.#generationDirectory = join16(options.stateDir, "rosters", hostGeneration);
     this.#key = rosterFingerprint(options, providers);
-    const directory = join13(this.#generationDirectory, this.#key);
+    const directory = join16(this.#generationDirectory, this.#key);
     for (const provider of providers)
       this.#members.set(provider, {
         provider,
-        path: join13(directory, `${provider}.json`),
+        path: join16(directory, `${provider}.json`),
         closed: false
       });
   }
@@ -20590,9 +21384,13 @@ class ClaustrumDiscoveryHub {
     run.generation = generation;
     if (!this.#live(generation))
       return;
-    const bases = new Map;
-    for (const entry2 of this.#members.values())
-      bases.set(entry2, await readVaultRoster(entry2.path).then((file) => file ? { file } : {}, (error) => error instanceof Error ? error : new Error(String(error))));
+    const folders = await this.#ensureRosterDirectories().then(() => {
+      return;
+    }, (error) => error instanceof Error ? error : new Error(String(error)));
+    const bases = new Map(await Promise.all([...this.#members.values()].map(async (entry2) => [
+      entry2,
+      await readVaultRoster(entry2.path).then((file) => file ? { file } : {}, (error) => error instanceof Error ? error : new Error(String(error)))
+    ])));
     if (!this.#live(generation))
       return;
     let inventory;
@@ -20606,38 +21404,21 @@ class ClaustrumDiscoveryHub {
           this.#markPending(entry2);
       throw error;
     }
+    if (!this.#live(generation))
+      return;
+    const members = this.#open();
+    const commits = await Promise.all(members.map((entry2) => entry2.hooks && !entry2.closed ? this.#commit(entry2, entry2.hooks, inventory, folders ?? bases.get(entry2), generation) : undefined));
+    if (!this.#live(generation))
+      return;
     const errors = new Map;
     let complete = true;
-    for (const entry2 of this.#open()) {
-      if (!this.#live(generation))
-        return;
+    for (const [index, entry2] of members.entries()) {
       const hooks = entry2.hooks;
-      if (!hooks || entry2.closed)
+      const commit = commits[index];
+      if (!hooks || !commit)
         continue;
-      const share = {
-        ...inventory,
-        credentials: inventory.credentials.filter((credential2) => credential2.member === entry2.provider),
-        skipped: inventory.skipped.filter((record8) => record8.member === entry2.provider)
-      };
-      const base = bases.get(entry2);
-      let roster;
-      try {
-        if (!base)
-          throw closed("Claustrum hub member has no base view");
-        if (base instanceof Error)
-          throw base;
-        const seed = base.file ? undefined : await this.#seed(entry2);
-        roster = await refreshVaultRoster({
-          path: entry2.path,
-          custody: { discover: async () => share },
-          isActive: () => this.#live(generation) && this.#active === true,
-          signal: generation.controller.signal,
-          projection: () => ({ ...hooks.projection(), ...seed && { seed } }),
-          listedOver: { view: base.file?.view }
-        });
-      } catch (error) {
-        if (!this.#live(generation))
-          return;
+      if ("error" in commit) {
+        const { error } = commit;
         complete = false;
         this.#markPending(entry2);
         if (isVaultRosterLockRefusal(entry2.path, error))
@@ -20648,6 +21429,7 @@ class ClaustrumDiscoveryHub {
           errors.set(entry2.provider, error);
         continue;
       }
+      const { roster } = commit;
       if (!this.#live(generation))
         return;
       if (roster?.view !== inventory.view) {
@@ -20679,13 +21461,46 @@ class ClaustrumDiscoveryHub {
     this.#discoveredAt = (this.#options.now ?? Date.now)();
     return { errors };
   }
+  async#commit(entry2, hooks, inventory, base, generation) {
+    const share = {
+      ...inventory,
+      credentials: inventory.credentials.filter((credential2) => credential2.member === entry2.provider),
+      skipped: inventory.skipped.filter((record8) => record8.member === entry2.provider)
+    };
+    try {
+      if (!base)
+        throw closed("Claustrum hub member has no base view");
+      if (base instanceof Error)
+        throw base;
+      const seed = base.file ? undefined : await this.#seed(entry2);
+      const roster = await refreshVaultRoster({
+        path: entry2.path,
+        custody: { discover: async () => share },
+        isActive: () => this.#live(generation) && this.#active === true,
+        signal: generation.controller.signal,
+        projection: () => ({ ...hooks.projection(), ...seed && { seed } }),
+        listedOver: { view: base.file?.view }
+      });
+      return { roster };
+    } catch (error) {
+      return { error };
+    }
+  }
+  async#ensureRosterDirectories() {
+    for (const directory of [
+      dirname14(this.#generationDirectory),
+      this.#generationDirectory,
+      join16(this.#generationDirectory, this.#key)
+    ])
+      await ensureClaustrumPrivateDirectory(directory, {}, "roster directory");
+  }
   async#seed(entry2) {
     const name = `${entry2.provider}.json`;
-    const candidates = [join13(this.#generationDirectory, name)];
+    const candidates = [join16(this.#generationDirectory, name)];
     try {
       for (const key of await readdir3(this.#generationDirectory))
         if (key !== this.#key && FINGERPRINT.test(key))
-          candidates.push(join13(this.#generationDirectory, key, name));
+          candidates.push(join16(this.#generationDirectory, key, name));
     } catch {}
     let newest;
     for (const path2 of candidates) {
@@ -20851,8 +21666,8 @@ class ClaustrumDiscoveryHub {
     return this.#committed?.reach;
   }
   watchState() {
-    const open8 = this.#watch;
-    return open8 && this.#live(open8.generation) ? open8.watch.mode : "polling";
+    const open9 = this.#watch;
+    return open9 && this.#live(open9.generation) ? open9.watch.mode : "polling";
   }
   keptReceiptState() {
     return this.#current?.custody?.keptReceiptState() ?? Object.freeze({ active: false, since: null });
@@ -21410,7 +22225,7 @@ function createNativeLocalRuntimeReaders(options) {
 }
 
 // src/native-refresh-coordinator.ts
-import { createHash as createHash14 } from "node:crypto";
+import { createHash as createHash16 } from "node:crypto";
 
 // src/native-transient-account.ts
 var TRANSIENT_ACCOUNT_MESSAGE = "Anthropic account update in progress; retry the request";
@@ -21512,7 +22327,7 @@ function pause(ms, signals) {
 var NATIVE_REFRESH_MAX_ATTEMPTS = 3;
 var NATIVE_REFRESH_JOIN_BUDGET_MS = 2000;
 function nativeAccountProviderLock(paths, identity3) {
-  const key = createHash14("sha256").update(JSON.stringify([paths.storageId, identity3])).digest("hex");
+  const key = createHash16("sha256").update(JSON.stringify([paths.storageId, identity3])).digest("hex");
   return {
     path: paths.state,
     name: `native-account-provider-${key}`,
@@ -22309,12 +23124,12 @@ function createNativeRefreshCoordinator(options) {
 }
 
 // src/pool-authority.ts
-import { isAbsolute as isAbsolute4, normalize, parse as parse3, sep } from "node:path";
+import { isAbsolute as isAbsolute5, normalize, parse as parse3, sep } from "node:path";
 
 // src/migration-source.ts
-import { createHash as createHash15 } from "node:crypto";
+import { createHash as createHash17 } from "node:crypto";
 import { constants as constants3 } from "node:fs";
-import { lstat as lstat7, open as open8 } from "node:fs/promises";
+import { lstat as lstat9, open as open9 } from "node:fs/promises";
 class NativeMigrationSourceError extends Error {
   role;
   code;
@@ -22326,7 +23141,7 @@ class NativeMigrationSourceError extends Error {
   }
 }
 var MAX_SOURCE_BYTES = 4 * 1024 * 1024;
-function isRecord10(value) {
+function isRecord12(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function freezeJson(root) {
@@ -22357,7 +23172,7 @@ async function readNativeMigrationSource(role, path2, hooks = {}) {
   });
   let initial;
   try {
-    initial = await lstat7(path2, { bigint: true });
+    initial = await lstat9(path2, { bigint: true });
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT")
       return missing2;
@@ -22367,7 +23182,7 @@ async function readNativeMigrationSource(role, path2, hooks = {}) {
     throw new NativeMigrationSourceError(role, "unsafe-source");
   let handle;
   try {
-    handle = await open8(path2, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0) | (constants3.O_NONBLOCK ?? 0));
+    handle = await open9(path2, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0) | (constants3.O_NONBLOCK ?? 0));
     const before = await handle.stat({ bigint: true });
     if (!before.isFile() || before.dev !== initial.dev || before.ino !== initial.ino) {
       throw new NativeMigrationSourceError(role, "source-changed");
@@ -22395,7 +23210,7 @@ async function readNativeMigrationSource(role, path2, hooks = {}) {
       chunks.push(chunk.subarray(0, read.bytesRead));
     }
     const after = await handle.stat({ bigint: true });
-    const current = await lstat7(path2, { bigint: true });
+    const current = await lstat9(path2, { bigint: true });
     if (before.uid !== after.uid || before.gid !== after.gid || before.mode !== after.mode || current.uid !== before.uid || current.gid !== before.gid || current.mode !== before.mode || before.dev !== after.dev || before.ino !== after.ino || before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs || before.size !== after.size || current.dev !== before.dev || current.ino !== before.ino || current.isSymbolicLink() || current.mtimeNs !== before.mtimeNs || current.ctimeNs !== before.ctimeNs || current.size !== before.size || BigInt(bytes) !== before.size) {
       throw new NativeMigrationSourceError(role, "source-changed");
     }
@@ -22406,12 +23221,12 @@ async function readNativeMigrationSource(role, path2, hooks = {}) {
     } catch {
       throw new NativeMigrationSourceError(role, "invalid-source");
     }
-    if (!isRecord10(data))
+    if (!isRecord12(data))
       throw new NativeMigrationSourceError(role, "invalid-source");
     return sourceSnapshot({
       role,
       path: path2,
-      digest: createHash15("sha256").update(content).digest("hex"),
+      digest: createHash17("sha256").update(content).digest("hex"),
       data: freezeJson(data),
       metadata: Object.freeze({
         uid: Number(before.uid),
@@ -22467,7 +23282,7 @@ class NativeAuthorityError extends Error {
     this.name = "NativeAuthorityError";
   }
 }
-function isRecord11(value) {
+function isRecord13(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function captureJournalJson(value) {
@@ -22500,22 +23315,22 @@ function isHostEntry(value) {
   return value === "absent" || isDigest(value);
 }
 function isCapturedPath(value) {
-  return typeof value === "string" && isAbsolute4(value) && !/\p{Cc}/u.test(value) && !value.endsWith(sep) && normalize(value) === value && (sep !== "\\" || parse3(value).root !== sep) && !value.split(sep).some((part) => part === "." || part === "..");
+  return typeof value === "string" && isAbsolute5(value) && !/\p{Cc}/u.test(value) && !value.endsWith(sep) && normalize(value) === value && (sep !== "\\" || parse3(value).root !== sep) && !value.split(sep).some((part) => part === "." || part === "..");
 }
 function isSources(value) {
-  return isRecord11(value) && hasKeys(value, ["config", "state", "hostAuth", "routing"]) && isFileDigest(value.config) && isFileDigest(value.state) && isHostEntry(value.hostAuth) && isFileDigest(value.routing);
+  return isRecord13(value) && hasKeys(value, ["config", "state", "hostAuth", "routing"]) && isFileDigest(value.config) && isFileDigest(value.state) && isHostEntry(value.hostAuth) && isFileDigest(value.routing);
 }
 function isRoutingPaths(value) {
-  return isRecord11(value) && hasKeys(value, ["source", "destination"]) && isCapturedPath(value.source) && isCapturedPath(value.destination);
+  return isRecord13(value) && hasKeys(value, ["source", "destination"]) && isCapturedPath(value.source) && isCapturedPath(value.destination);
 }
 function isText(value) {
   return typeof value === "string" && value.length > 0;
 }
 function decodeRoster2(value) {
-  if (!isRecord11(value) || !hasKeys(value, ["version", "view", "complete", "rows", "declined"]) || value.version !== 1 || !isText(value.view) || value.complete !== true || !Array.isArray(value.rows) || !Array.isArray(value.declined))
+  if (!isRecord13(value) || !hasKeys(value, ["version", "view", "complete", "rows", "declined"]) || value.version !== 1 || !isText(value.view) || value.complete !== true || !Array.isArray(value.rows) || !Array.isArray(value.declined))
     throw new NativeAuthorityError("invalid-journal");
   const rows = value.rows.map((row) => {
-    if (!isRecord11(row) || !hasKeys(row, [
+    if (!isRecord13(row) || !hasKeys(row, [
       "routeId",
       "credentialId",
       "credentialType",
@@ -22538,7 +23353,7 @@ function decodeRoster2(value) {
     };
   });
   const declined = value.declined.map((entry2) => {
-    if (!isRecord11(entry2) || !isText(entry2.credentialId) || !(hasKeys(entry2, ["credentialId"]) || hasKeys(entry2, ["credentialId", "accountIdentity"]) && isText(entry2.accountIdentity)))
+    if (!isRecord13(entry2) || !isText(entry2.credentialId) || !(hasKeys(entry2, ["credentialId"]) || hasKeys(entry2, ["credentialId", "accountIdentity"]) && isText(entry2.accountIdentity)))
       throw new NativeAuthorityError("invalid-journal");
     return isText(entry2.accountIdentity) ? {
       credentialId: entry2.credentialId,
@@ -22550,7 +23365,7 @@ function decodeRoster2(value) {
   return { version: 1, view: value.view, complete: true, rows, declined };
 }
 function decodeDigestPair(value, keys4, valid) {
-  if (!isRecord11(value) || !hasKeys(value, [...keys4]) || !keys4.every((key) => valid(value[key])))
+  if (!isRecord13(value) || !hasKeys(value, [...keys4]) || !keys4.every((key) => valid(value[key])))
     throw new NativeAuthorityError("invalid-journal");
   return Object.fromEntries(keys4.map((key) => [key, value[key]]));
 }
@@ -22558,7 +23373,7 @@ var ACTIVATION_PHASES = ["prepared", "published", "committed"];
 function decodeActivation(value, phase) {
   if (value === null)
     return null;
-  if (!isRecord11(value))
+  if (!isRecord13(value))
     throw new NativeAuthorityError("invalid-journal");
   if (value.kind === "requested" && hasKeys(value, ["kind"]))
     return { kind: "requested" };
@@ -22572,7 +23387,7 @@ function decodeActivation(value, phase) {
     "settings",
     "runtime",
     "hostAuth"
-  ]) || !ACTIVATION_PHASES.some((item) => item === value.phase) || !isRecord11(value.primary) || !hasKeys(value.primary, ["routeId", "credentialId", "accountIdentity"]) || !isText(value.primary.routeId) || !isText(value.primary.credentialId) || !isText(value.primary.accountIdentity) || !Array.isArray(value.removeIds) || !value.removeIds.every(isText))
+  ]) || !ACTIVATION_PHASES.some((item) => item === value.phase) || !isRecord13(value.primary) || !hasKeys(value.primary, ["routeId", "credentialId", "accountIdentity"]) || !isText(value.primary.routeId) || !isText(value.primary.credentialId) || !isText(value.primary.accountIdentity) || !Array.isArray(value.removeIds) || !value.removeIds.every(isText))
     throw new NativeAuthorityError("invalid-journal");
   const primary = {
     routeId: value.primary.routeId,
@@ -22599,7 +23414,7 @@ function decodeActivation(value, phase) {
 }
 function decodeJournal(input, storageId) {
   const value = captureJournalJson(input);
-  if (!isRecord11(value) || value.storageId !== storageId)
+  if (!isRecord13(value) || value.storageId !== storageId)
     throw new NativeAuthorityError("invalid-journal");
   if (value.version === 5 && value.kind === "empty-init") {
     if (!hasKeys(value, ["version", "kind", "storageId", "host", "phase"]) || value.host !== "opencode" || value.phase !== "committed")
@@ -22784,7 +23599,7 @@ async function beginNativeMigration(paths, input, hooks = {}, replaces) {
 }
 async function recordNativeMigrationExpectations(paths, expectations, hooks = {}) {
   const captured = captureJournalJson(expectations);
-  if (!isRecord11(captured) || !hasKeys(captured, [
+  if (!isRecord13(captured) || !hasKeys(captured, [
     "expectedHostAuth",
     "expectedRouting",
     "preparedProof"
@@ -22859,7 +23674,7 @@ function journalLock(hooks) {
 }
 async function recordNativeCustodyActivation(paths, plan, hooks = {}) {
   const captured = captureJournalJson(plan);
-  if (!isRecord11(captured) || captured.phase !== "prepared")
+  if (!isRecord13(captured) || captured.phase !== "prepared")
     throw new NativeAuthorityError("journal-conflict");
   const decoded = decodeActivation(captured, "retired");
   if (decoded?.kind !== "activation")
@@ -23435,43 +24250,8 @@ class NativeRuntimeRegistry {
   }
 }
 
-// src/native-vault-paths.ts
-import { createHash as createHash16 } from "node:crypto";
-import { basename as basename5, dirname as dirname11, join as join14 } from "node:path";
-function sibling(path2, expected, name, suffix) {
-  return basename5(path2) === expected ? join14(dirname11(path2), name) : path2.replace(/(?:\.json)?$/, `.${suffix}.json`);
-}
-function nativeVaultPaths(local) {
-  const config = sibling(local.legacyConfig, "anthropic-auth.json", "anthropic-auth-vault-settings.json", "vault-settings");
-  const state = sibling(local.legacyState, "anthropic-auth-state.json", "anthropic-auth-vault-store-state.json", "vault-store");
-  const runtime2 = sibling(local.legacyState, "anthropic-auth-state.json", "anthropic-auth-vault-state.json", "vault-native");
-  const roster = sibling(local.legacyState, "anthropic-auth-state.json", "anthropic-auth-vault-roster.json", "vault-roster");
-  const routing = sibling(local.legacyState, "anthropic-auth-state.json", "anthropic-auth-vault-routing-state.json", "vault-routing");
-  const destinations = [config, state, runtime2, roster, routing];
-  const localFiles = [
-    local.legacyConfig,
-    local.legacyState,
-    local.config,
-    local.state,
-    local.runtime,
-    local.journal,
-    local.roster
-  ];
-  if (new Set([...localFiles, ...destinations]).size !== localFiles.length + destinations.length)
-    throw new Error("Vault storage overlaps local account storage");
-  return {
-    legacySeedConfig: local.legacyConfig,
-    config,
-    state,
-    runtime: runtime2,
-    roster,
-    routing,
-    storageId: createHash16("sha256").update(JSON.stringify(["anthropic-vault", config, state])).digest("hex")
-  };
-}
-
 // src/native-vault-runtime.ts
-import { randomUUID as randomUUID13 } from "node:crypto";
+import { randomUUID as randomUUID14 } from "node:crypto";
 import { SubcClient as SubcClient2 } from "@cortexkit/subc-client";
 
 // src/insula-quota.ts
@@ -24753,7 +25533,7 @@ function nativeDisplayProfile(profile2, publish, isCurrent) {
 }
 async function publishNativeVaultRosterSeed(paths, input, options = {}) {
   const seed = buildNativeVaultRosterSeed(input);
-  const published = await mutateVaultRoster(paths.roster, async (current, lease) => {
+  const published2 = await mutateVaultRoster(paths.roster, async (current, lease) => {
     if (current) {
       validateNativeVaultRosterSeed(current, input);
       await options.assertOwned?.();
@@ -24764,7 +25544,7 @@ async function publishNativeVaultRosterSeed(paths, input, options = {}) {
     return { next: seed, result: seed };
   }, { beforePublish: options.assertOwned });
   retainNativeVaultRoster(paths.roster, await readVaultRoster(paths.roster));
-  return published;
+  return published2;
 }
 async function publishNativeVaultRuntimeSeed(paths, state, options = {}) {
   const imported = decodeNativeRuntime(captureNativePlainData(state), paths.storageId);
@@ -24831,6 +25611,7 @@ function createNativeVaultRuntime(options) {
     onLockEvent: options.onLockEvent
   });
   const observeLock = nativeLockObserver(options.onLockEvent);
+  const relocation = nativeRelocationGuard(options.paths);
   let rosterWatch;
   let rosterWatching = false;
   let rosterView;
@@ -25070,6 +25851,7 @@ function createNativeVaultRuntime(options) {
       onLockEvent: options.onLockEvent,
       onStep: async (point) => {
         if (point === "before-config-write" || point === "before-state-write") {
+          await relocation.assertNotRelocated();
           await assertPrimary();
         }
       }
@@ -25171,7 +25953,7 @@ function createNativeVaultRuntime(options) {
         path: paths.roster,
         custody: options.discover ? { discover: options.discover } : custody,
         signal: shutdown.signal,
-        isActive: active,
+        isActive: async () => await active() && !await relocation.isRelocated(),
         projection: () => ({ reservedRouteIds })
       }).then(async (roster) => {
         retainNativeVaultRoster(paths.roster, roster);
@@ -25206,6 +25988,7 @@ function createNativeVaultRuntime(options) {
         throw new NativeCustodyError("identity-changed");
       if (!nativeAccountCanServe(current))
         throw new NativeCustodyError("not-active");
+      await relocation.assertNotRelocated();
       check(combined);
       issued.set(receipt, { routeId: row.routeId, logicalId });
       const key = JSON.stringify([
@@ -25289,7 +26072,7 @@ function createNativeVaultRuntime(options) {
     async getOrCreateAuthLineage(receipt) {
       let lineage;
       const kept = await mutateReceipt(receipt, (old) => {
-        lineage = old.authLineageId ?? randomUUID13();
+        lineage = old.authLineageId ?? randomUUID14();
         return { ...old, authLineageId: lineage };
       });
       return kept ? lineage : undefined;
@@ -25402,7 +26185,8 @@ function createNativeVaultRuntime(options) {
       const row = await rowFor(roster, routeId);
       if (!row)
         throw new NativeCustodyError("route-unavailable");
-      const changed = await mutateVaultRoster(paths.roster, (current) => {
+      const changed = await mutateVaultRoster(paths.roster, async (current) => {
+        await relocation.assertNotRelocated();
         const held = current?.rows.find((entry2) => entry2.routeId === row.routeId);
         if (!current || !held)
           throw new ClaustrumConsumerError("route-unavailable", "Claustrum route is not in the roster");
@@ -25680,14 +26464,14 @@ function leaseNativeVaultRuntime(use, close) {
 }
 
 // src/pool-paths.ts
-import { createHash as createHash18 } from "node:crypto";
+import { createHash as createHash19 } from "node:crypto";
 import { realpath as realpath3 } from "node:fs/promises";
-import { basename as basename7, dirname as dirname13, join as join16, resolve as resolve12 } from "node:path";
+import { basename as basename9, dirname as dirname16, join as join18, resolve as resolve12 } from "node:path";
 
 // src/sticky-routing.ts
-import { createHash as createHash17, randomUUID as randomUUID14 } from "node:crypto";
-import { mkdir as mkdir10, readFile as readFile9, rename as rename12, rm as rm7, stat as stat9, writeFile as writeFile4 } from "node:fs/promises";
-import { basename as basename6, dirname as dirname12, join as join15 } from "node:path";
+import { createHash as createHash18, randomUUID as randomUUID15 } from "node:crypto";
+import { mkdir as mkdir11, readFile as readFile10, rename as rename12, rm as rm7, stat as stat9, writeFile as writeFile4 } from "node:fs/promises";
+import { basename as basename8, dirname as dirname15, join as join17 } from "node:path";
 var STICKY_ROUTING_MAIN_ACCOUNT_ID = "main";
 var STICKY_ROUTING_SHORT_RESET_GRACE_MS = 15 * 60000;
 var STICKY_ROUTING_ASSIGNMENT_TTL_MS = 7 * 24 * 60 * 60000;
@@ -25737,14 +26521,14 @@ function createStickyNoRouteResponse(input) {
     }
   });
 }
-function isRecord12(value) {
+function isRecord14(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function finiteNumber(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : undefined;
 }
 function normalizeAssignment(value) {
-  if (!isRecord12(value))
+  if (!isRecord14(value))
     return;
   if (typeof value.accountId !== "string" || !["fable", "opus", "general"].includes(String(value.family))) {
     return;
@@ -25773,7 +26557,7 @@ function normalizeAssignment(value) {
   };
 }
 function normalizeState(value) {
-  if (!isRecord12(value) || value.version !== 1 || !isRecord12(value.assignments)) {
+  if (!isRecord14(value) || value.version !== 1 || !isRecord14(value.assignments)) {
     return;
   }
   const assignments = {};
@@ -25791,7 +26575,7 @@ function normalizeState(value) {
 }
 function migrateStickyRoutingState(source2, rowIdMap) {
   try {
-    if (!isRecord12(source2) || !isRecord12(source2.assignments))
+    if (!isRecord14(source2) || !isRecord14(source2.assignments))
       throw new Error;
     const entries = Object.entries(source2.assignments);
     const state = normalizeState({
@@ -25809,7 +26593,7 @@ function migrateStickyRoutingState(source2, rowIdMap) {
     const assignments = Object.create(null);
     for (const [index, [key, original]] of entries.entries()) {
       const assignment = state.assignments[String(index)];
-      if (!isRecord12(original) || !assignment)
+      if (!isRecord14(original) || !assignment)
         throw new Error;
       const fields2 = Object.keys(assignment).filter((field) => field !== "affinityModelId" || Object.hasOwn(original, "affinityModelId"));
       if (Object.keys(original).length !== fields2.length || fields2.some((field) => !Object.hasOwn(original, field) || !Object.is(original[field], Reflect.get(assignment, field)))) {
@@ -25830,7 +26614,7 @@ function emptyState(now) {
   return { version: 1, updatedAt: now, assignments: {} };
 }
 function sessionKey(sessionId) {
-  return createHash17("sha256").update(sessionId).digest("hex");
+  return createHash18("sha256").update(sessionId).digest("hex");
 }
 function stickyQuotaSnapshotIsFresh(quota2, storage, now = Date.now(), modelId) {
   const maxAge = getQuotaCheckIntervalMs(storage);
@@ -25938,12 +26722,12 @@ function decideStickyQuotaFailure(input) {
   return { action: "migrate", reason: blocking.reason };
 }
 function getStickyRoutingStatePath(accountStoragePath) {
-  const name = basename6(accountStoragePath);
+  const name = basename8(accountStoragePath);
   const stem = name.endsWith(".json") ? name.slice(0, -5) : name;
-  return join15(dirname12(accountStoragePath), `${stem}-routing-state.json`);
+  return join17(dirname15(accountStoragePath), `${stem}-routing-state.json`);
 }
 function stickyRetryAfterWithJitter(sessionId, retryAfterSeconds) {
-  const hash2 = createHash17("sha256").update(sessionId).digest().readUInt32BE(0);
+  const hash2 = createHash18("sha256").update(sessionId).digest().readUInt32BE(0);
   return Math.max(1, Math.ceil(retryAfterSeconds)) + hash2 % 21;
 }
 var localRecoveries = new Map;
@@ -25966,7 +26750,7 @@ class StickySessionRouter {
   }
   async readState() {
     try {
-      const raw = await readFile9(this.options.path, "utf8");
+      const raw = await readFile10(this.options.path, "utf8");
       const normalized = normalizeState(JSON.parse(raw));
       if (!normalized) {
         throw new Error(`Invalid sticky routing state at ${this.options.path}`);
@@ -26015,7 +26799,7 @@ class StickySessionRouter {
     const observer = nativeLockObserver(this.options.onLockEvent);
     const event = { name: "write", path: this.options.path, detached };
     observer?.({ ...event, type: "acquiring" });
-    await mkdir10(dirname12(this.options.path), { recursive: true, mode: 448 });
+    await mkdir11(dirname15(this.options.path), { recursive: true, mode: 448 });
     const deadline = performance.now() + STICKY_ROUTING_LOCK_WAIT_MS;
     while (true) {
       const lock = await acquireRefreshFileLock2({
@@ -26063,7 +26847,7 @@ class StickySessionRouter {
     try {
       let legacy;
       try {
-        legacy = normalizeState(JSON.parse(await readFile9(source2, "utf8")));
+        legacy = normalizeState(JSON.parse(await readFile10(source2, "utf8")));
       } catch (error) {
         if (error.code === "ENOENT")
           return;
@@ -26102,10 +26886,11 @@ class StickySessionRouter {
     });
   }
   async writeState(state, beforeRename, prune = true) {
+    await this.options.relocationGuard?.assertNotRelocated();
     if (prune)
       this.prune(state);
     state.updatedAt = this.now();
-    const tempPath = `${this.options.path}.${randomUUID14()}.tmp`;
+    const tempPath = `${this.options.path}.${randomUUID15()}.tmp`;
     try {
       await writeFile4(tempPath, `${JSON.stringify(state)}
 `, { mode: 384 });
@@ -26156,7 +26941,7 @@ class StickySessionRouter {
         const source2 = await readNativeVaultLegacyJson(seed.legacyConfig);
         const routes = nativeVaultLegacyRoutes(source2, roster);
         const legacy = await readNativeVaultLegacyJson(getStickyRoutingStatePath(seed.legacyConfig));
-        if (isRecord12(legacy) && legacy.version === 1 && isRecord12(legacy.assignments)) {
+        if (isRecord14(legacy) && legacy.version === 1 && isRecord14(legacy.assignments)) {
           for (const [key, raw] of Object.entries(legacy.assignments)) {
             if (!/^[0-9a-f]{64}$/.test(key) || Object.hasOwn(state.assignments, key))
               continue;
@@ -26415,24 +27200,34 @@ async function canonicalPath(path2) {
       throw error;
     }
   }
-  const parent = dirname13(absolute);
+  const parent = dirname16(absolute);
   if (parent === absolute)
     return absolute;
-  return join16(await canonicalPath(parent), basename7(absolute));
+  return join18(await canonicalPath(parent), basename9(absolute));
 }
 function sibling2(path2, legacyName, name, suffix) {
-  return basename7(path2) === legacyName ? join16(dirname13(path2), name) : `${path2}.${suffix}.json`;
+  return basename9(path2) === legacyName ? join18(dirname16(path2), name) : `${path2}.${suffix}.json`;
 }
-async function resolveNativePoolPaths(legacyConfig = getAccountStoragePath(), legacyState = getAccountStatePath(legacyConfig)) {
+async function resolveNativePoolPaths(legacyConfig = getAccountStoragePath(), legacyState = getAccountStatePath(legacyConfig), layout = processStateLayout()) {
   const [sourceConfig, sourceState] = await Promise.all([
     canonicalPath(legacyConfig),
     canonicalPath(legacyState)
   ]);
   const config = await canonicalPath(sibling2(sourceConfig, "anthropic-auth.json", "anthropic-auth-pool.json", "pool"));
-  const state = await canonicalPath(sibling2(sourceState, "anthropic-auth-state.json", "anthropic-auth-pool-state.json", "pool"));
-  const runtime2 = await canonicalPath(sibling2(sourceState, "anthropic-auth-state.json", "anthropic-auth-native-state.json", "native"));
-  const journal = await canonicalPath(sibling2(sourceState, "anthropic-auth-state.json", "anthropic-auth-migration.json", "migration"));
-  const roster = await canonicalPath(sibling2(sourceState, "anthropic-auth-state.json", "anthropic-auth-custody-roster.json", "roster"));
+  const legacyLayoutState = await canonicalPath(sibling2(sourceState, "anthropic-auth-state.json", "anthropic-auth-pool-state.json", "pool"));
+  let state = legacyLayoutState;
+  let runtime2 = await canonicalPath(sibling2(sourceState, "anthropic-auth-state.json", "anthropic-auth-native-state.json", "native"));
+  let journal = await canonicalPath(sibling2(sourceState, "anthropic-auth-state.json", "anthropic-auth-migration.json", "migration"));
+  let roster = await canonicalPath(sibling2(sourceState, "anthropic-auth-state.json", "anthropic-auth-custody-roster.json", "roster"));
+  if (layout.kind === "state-home") {
+    const moved = stateHomeDatasetFiles(layout, sourceConfig, sourceState);
+    [state, runtime2, journal, roster] = await Promise.all([
+      canonicalPath(moved.localPoolState),
+      canonicalPath(moved.localRuntime),
+      canonicalPath(moved.journal),
+      canonicalPath(moved.localRoster)
+    ]);
+  }
   const paths = [
     sourceConfig,
     sourceState,
@@ -26445,7 +27240,7 @@ async function resolveNativePoolPaths(legacyConfig = getAccountStoragePath(), le
   if (new Set(paths).size !== paths.length) {
     throw new Error("Anthropic account storage paths overlap; migration requires separate files");
   }
-  const storageId = createHash18("sha256").update(JSON.stringify(["anthropic", config, state])).digest("hex");
+  const storageId = createHash19("sha256").update(JSON.stringify(["anthropic", config, legacyLayoutState])).digest("hex");
   return {
     legacyConfig: sourceConfig,
     legacyState: sourceState,
@@ -26460,7 +27255,7 @@ async function resolveNativePoolPaths(legacyConfig = getAccountStoragePath(), le
 
 // src/relay.ts
 import { Buffer as Buffer3 } from "node:buffer";
-import { createHash as createHash19, randomBytes as randomBytes5 } from "node:crypto";
+import { createHash as createHash20, randomBytes as randomBytes5 } from "node:crypto";
 var WEBSOCKET_RELAY_URL = /^wss?:\/\//i;
 function effectiveRelayTransport(stored, url) {
   if (stored === "http" || stored === "websocket")
@@ -26611,7 +27406,7 @@ function generateRelayToken() {
   return randomBytes5(32).toString("base64url");
 }
 function hashBody(body) {
-  return `sha256:${createHash19("sha256").update(body).digest("hex")}`;
+  return `sha256:${createHash20("sha256").update(body).digest("hex")}`;
 }
 function createStringPatch(previous, next) {
   let start = 0;
@@ -28079,10 +28874,12 @@ function acquireNativeAccountRuntime(options) {
   const vault = leaseNativeVaultRuntime(() => use().vault, close);
   const quotaObservations = use().quotaObservations;
   const onLockEvent = use().onLockEvent;
+  const relocationGuard = use().relocationGuard;
   const drainRoutingPublications = use().drainRoutingPublications;
   const drainQuotaPublications = use().drainQuotaPublications;
   return {
     onLockEvent,
+    relocationGuard,
     vault,
     quotaObservations,
     drainQuotaPublications,
@@ -28135,6 +28932,7 @@ function createNativeAccountRuntime(options) {
   const now = options.local?.now ?? options.vault?.now ?? Date.now;
   const env = { ...options.vault?.env ?? process.env };
   const vaultPaths = nativeVaultPaths(paths);
+  const relocation = nativeRelocationGuard(paths);
   const routingSeed = {
     legacyConfig: paths.legacyConfig,
     roster: vaultPaths.roster
@@ -28143,7 +28941,8 @@ function createNativeAccountRuntime(options) {
     path: vaultPaths.routing,
     vaultSeed: routingSeed,
     onLockEvent,
-    now
+    now,
+    relocationGuard: relocation
   });
   let settingsBootstrap;
   const vaultStore = createNativePoolStore({
@@ -28152,8 +28951,10 @@ function createNativeAccountRuntime(options) {
     now,
     onLockEvent: options.local?.onLockEvent,
     onStep: async (point) => {
-      if (point === "before-config-write" || point === "before-state-write")
+      if (point === "before-config-write" || point === "before-state-write") {
+        await relocation.assertNotRelocated();
         await requireMode("claustrum");
+      }
     }
   });
   const shutdown = new AbortController;
@@ -28356,7 +29157,7 @@ function createNativeAccountRuntime(options) {
       const sameAccount = old?.kind === "local" && old.rowId === binding2.rowId && binding2.identity !== undefined && old.identity === binding2.identity;
       const next = {
         binding: binding2,
-        ...row.credential?.type === "oauth" ? { authLineageId: randomUUID15() } : {}
+        ...row.credential?.type === "oauth" ? { authLineageId: randomUUID16() } : {}
       };
       if (sameAccount && previous) {
         for (const key of [
@@ -28460,6 +29261,7 @@ function createNativeAccountRuntime(options) {
   }
   const runtime2 = {
     onLockEvent,
+    relocationGuard: relocation,
     vault,
     quotaObservations: vault.quotaObservations,
     drainQuotaPublications: async () => {
@@ -28478,7 +29280,7 @@ function createNativeAccountRuntime(options) {
         const settings = await store2.readSettings();
         if (settings.status !== "ready")
           throw new NativeRuntimeError("publication-refused");
-        const flags2 = relayFlags(settings.settings.relay);
+        const flags = relayFlags(settings.settings.relay);
         const generation = relayGeneration(settings.settings.relay);
         const read = await readNativeRuntime(paths2.runtime, paths2.storageId);
         await requireMode(mode);
@@ -28486,9 +29288,9 @@ function createNativeAccountRuntime(options) {
         if (generation !== state?.relayGeneration)
           continue;
         const token2 = state?.relay?.token;
-        if (!flags2.enabled || !flags2.url || !token2)
+        if (!flags.enabled || !flags.url || !token2)
           return null;
-        return { ...flags2, token: token2 };
+        return { ...flags, token: token2 };
       }
       throw new NativeRuntimeError("relay-inconsistent");
     },
@@ -28518,7 +29320,7 @@ function createNativeAccountRuntime(options) {
           throw new NativeRuntimeError("publication-refused");
         const previous = relayFlags(read.settings.relay);
         const previousGeneration = relayGeneration(read.settings.relay);
-        const generation = randomUUID15();
+        const generation = randomUUID16();
         const metadata2 = await readNativeRuntime(paths2.runtime, paths2.storageId);
         const token2 = patch.token === undefined ? metadata2.status === "ready" ? metadata2.state.relay?.token : undefined : patch.token?.trim();
         const next = relayFlags({
@@ -28528,12 +29330,12 @@ function createNativeAccountRuntime(options) {
         });
         if (next.enabled && (!next.url || !token2))
           throw new NativeRuntimeError("publication-refused");
-        async function writeFlags(flags2, stamp) {
+        async function writeFlags(flags, stamp) {
           await store2.updateSettings(async (settings) => {
             await requireMode(mode);
             await lease.assertOwned();
             settings.relay = {
-              ...flags2,
+              ...flags,
               ...stamp === undefined ? {} : { generation: stamp }
             };
           });
@@ -28744,7 +29546,7 @@ function createNativeAccountRuntime(options) {
       const snapshot = await runtime2.read();
       if (snapshot.mode !== "local")
         throw new NativeCustodyError("route-unavailable");
-      const id2 = input.routeId === "main" ? await physicalId("main").catch(() => randomUUID15()) : input.routeId;
+      const id2 = input.routeId === "main" ? await physicalId("main").catch(() => randomUUID16()) : input.routeId;
       if (input.credential.type === "api" && (input.routeId === "main" || id2 === snapshot.settings.mainAccountId))
         throw new NativeCustodyError("route-unavailable");
       const old = await poolRow(id2);
@@ -28783,7 +29585,7 @@ function createNativeAccountRuntime(options) {
       return row;
     },
     addApi: (input) => runtime2.putAccount({
-      routeId: input.routeId ?? randomUUID15(),
+      routeId: input.routeId ?? randomUUID16(),
       label: input.label,
       replace: input.replace,
       credential: {
@@ -29000,7 +29802,7 @@ function createNativeAccountRuntime(options) {
         return;
       let lineage;
       const kept = await metadataPublications.run(() => localMetadataWrite(fence, (old) => {
-        lineage = old.authLineageId ?? randomUUID15();
+        lineage = old.authLineageId ?? randomUUID16();
         return {
           ...old,
           authLineageId: lineage
@@ -29204,9 +30006,9 @@ function relayGeneration(input) {
   return generation;
 }
 // src/native-host-auth-write.ts
-import { randomUUID as randomUUID16 } from "node:crypto";
-import { lstat as lstat8, open as open9, rename as rename13, unlink as unlink6 } from "node:fs/promises";
-import { dirname as dirname14, isAbsolute as isAbsolute5, join as join17 } from "node:path";
+import { randomUUID as randomUUID17 } from "node:crypto";
+import { lstat as lstat10, open as open10, rename as rename13, unlink as unlink6 } from "node:fs/promises";
+import { dirname as dirname17, isAbsolute as isAbsolute6, join as join19 } from "node:path";
 class NativeHostAuthWriteError extends Error {
   code;
   effect;
@@ -29243,7 +30045,7 @@ async function writeNativeHostAuth(input, hooks = {}) {
     requireNoSupervisedAuthContentSnapshot(input.env);
     const { beforeRecheck, beforeRename, afterRename, afterUnlink } = hooks;
     const publication2 = capturePublicationOptions(hooks.publication);
-    if (host !== "opencode" && host !== "pi" || typeof authPath !== "string" || !isAbsolute5(authPath) || /\p{Cc}/u.test(authPath) || !isEntryDigest(sourceDigest) || !isEntryDigest(expectedDigest) || typeof processFence !== "function")
+    if (host !== "opencode" && host !== "pi" || typeof authPath !== "string" || !isAbsolute6(authPath) || /\p{Cc}/u.test(authPath) || !isEntryDigest(sourceDigest) || !isEntryDigest(expectedDigest) || typeof processFence !== "function")
       throw new NativeHostAuthWriteError("invalid-source");
     const snapshot = await readNativeMigrationSource("hostAuth", authPath);
     if (snapshot.metadata && process.getuid && snapshot.metadata.uid !== process.getuid())
@@ -29267,11 +30069,11 @@ async function writeNativeHostAuth(input, hooks = {}) {
     const removingFile = host === "pi" && Object.keys(next).length === 0;
     const outcome = Object.freeze(host === "pi" ? { status: "removed", file: removingFile ? "unlinked" : "replaced" } : { status: snapshot.data === undefined ? "created" : "replaced" });
     if (!removingFile) {
-      stage = join17(dirname14(authPath), `.native-host-auth-write.${randomUUID16()}.tmp`);
+      stage = join19(dirname17(authPath), `.native-host-auth-write.${randomUUID17()}.tmp`);
       const bytes = `${JSON.stringify(next, null, 2)}
 `;
       const nativeCreated = await createWindowsOwnerOnly(stage, bytes);
-      const handle = await open9(stage, nativeCreated ? "r+" : "wx", 384);
+      const handle = await open10(stage, nativeCreated ? "r+" : "wx", 384);
       try {
         const identity3 = await handle.stat();
         ownedStage = { dev: identity3.dev, ino: identity3.ino };
@@ -29317,7 +30119,7 @@ async function writeNativeHostAuth(input, hooks = {}) {
   } finally {
     if (stage && ownedStage) {
       try {
-        const current = await lstat8(stage);
+        const current = await lstat10(stage);
         if (current.dev === ownedStage.dev && current.ino === ownedStage.ino)
           await unlink6(stage);
       } catch {}
@@ -29326,9 +30128,9 @@ async function writeNativeHostAuth(input, hooks = {}) {
 }
 
 // src/native-migration.ts
-import { createHash as createHash20 } from "node:crypto";
-import { lstat as lstat9, mkdir as mkdir11, unlink as unlink7 } from "node:fs/promises";
-import { dirname as dirname15, isAbsolute as isAbsolute6 } from "node:path";
+import { createHash as createHash21 } from "node:crypto";
+import { lstat as lstat11, mkdir as mkdir12, unlink as unlink7 } from "node:fs/promises";
+import { dirname as dirname18, isAbsolute as isAbsolute7 } from "node:path";
 class NativeMigrationError extends Error {
   code;
   constructor(code) {
@@ -29377,7 +30179,7 @@ function owned(snapshot) {
 }
 async function absent(path2) {
   try {
-    await lstat9(path2);
+    await lstat11(path2);
     return false;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT")
@@ -29417,11 +30219,11 @@ async function publishNativeEmptyInit(input, hooks = {}) {
           refuse3();
       if (!env.OPENCODE_ANTHROPIC_AUTH_ROUTING_STATE_FILE && !await absent(routingDestinationPath))
         refuse3();
-      const resolved = await resolveNativePoolPaths(paths.legacyConfig, paths.legacyState);
+      const resolved = await resolveNativePoolPaths(paths.legacyConfig, paths.legacyState, processStateLayout());
       for (const key of Object.keys(resolved))
         if (paths[key] !== resolved[key])
           refuse3();
-      if (!isAbsolute6(routingDestinationPath) || /\p{Cc}/u.test(routingDestinationPath))
+      if (!isAbsolute7(routingDestinationPath) || /\p{Cc}/u.test(routingDestinationPath))
         refuse3();
       const routing = await canonicalPath(routingDestinationPath);
       const all = [
@@ -29461,7 +30263,7 @@ function releaseNativeMigrationPreflight(token2) {
 async function capture2(input, checkPool = false) {
   requireNoSupervisedAuthContentSnapshot(input.env);
   await input.processFence();
-  const resolved = await resolveNativePoolPaths(input.paths.legacyConfig, input.paths.legacyState);
+  const resolved = await resolveNativePoolPaths(input.paths.legacyConfig, input.paths.legacyState, processStateLayout());
   for (const key of Object.keys(resolved))
     if (input.paths[key] !== resolved[key])
       refuse3();
@@ -29470,7 +30272,7 @@ async function capture2(input, checkPool = false) {
     input.routingSourcePath,
     input.routingDestinationPath
   ])
-    if (!isAbsolute6(path2) || /\p{Cc}/u.test(path2))
+    if (!isAbsolute7(path2) || /\p{Cc}/u.test(path2))
       refuse3();
   const current = await readNativeMigrationJournal(input.paths);
   const emptyInit = current?.kind === "empty-init";
@@ -29706,7 +30508,7 @@ function routingBytes(captured) {
 `;
 }
 function bytesDigest(bytes) {
-  return bytes === undefined ? null : createHash20("sha256").update(bytes).digest("hex");
+  return bytes === undefined ? null : createHash21("sha256").update(bytes).digest("hex");
 }
 function expectedAuth(input, snapshot) {
   const entry2 = inspectNativeHostAuthEntry(input.host, snapshot.data);
@@ -30081,7 +30883,7 @@ async function runNativeMigration(input, hooks = {}) {
             refuse3();
           await step("before:host");
           await recheck();
-          await mkdir11(dirname15(operation.hostAuthPath), {
+          await mkdir12(dirname18(operation.hostAuthPath), {
             recursive: true,
             mode: 448
           });
@@ -30157,7 +30959,7 @@ class NativeCustodyActivationError extends Error {
 function refuse4(code) {
   throw new NativeCustodyActivationError(code);
 }
-function isRecord13(value) {
+function isRecord15(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function sameJson(left, right) {
@@ -30242,7 +31044,7 @@ var ACCOUNT_RUNTIME_FIELDS = [
   "quotaErrorGeneration"
 ];
 function vaultSettings(settings, primary) {
-  const custody = isRecord13(settings.claustrum) ? settings.claustrum : {};
+  const custody = isRecord15(settings.claustrum) ? settings.claustrum : {};
   return {
     ...settings,
     claustrum: {
@@ -30352,7 +31154,7 @@ async function preparePlan(options, journal, store) {
   const main = pool.settings.mainAccountId;
   if (typeof main !== "string" || !main)
     refuse4("invalid-state");
-  const custody = isRecord13(pool.settings.claustrum) ? pool.settings.claustrum : {};
+  const custody = isRecord15(pool.settings.claustrum) ? pool.settings.claustrum : {};
   const host = await readHostEntry(options.host, journal.hostAuthPath);
   const hostAuth = {
     source: host.digest,
@@ -30383,7 +31185,7 @@ async function preparePlan(options, journal, store) {
   let roster;
   let targetSettings;
   if (custody.mode === "claustrum") {
-    const pin = isRecord13(custody.primaryAccount) ? custody.primaryAccount : {};
+    const pin = isRecord15(custody.primaryAccount) ? custody.primaryAccount : {};
     if (oauth.length > 0 || pin.credentialId !== primary.credentialId || pin.accountId !== primary.accountIdentity)
       refuse4("primary-mismatch");
     if (!existing)
@@ -30434,7 +31236,7 @@ async function preparePlan(options, journal, store) {
     } catch (error) {
       if (error instanceof NativeCustodyActivationError)
         throw error;
-      return refuse4(isRecord13(error) && error.code === "unenrolled-local-row" ? "unenrolled-local-row" : "roster-conflict");
+      return refuse4(isRecord15(error) && error.code === "unenrolled-local-row" ? "unenrolled-local-row" : "roster-conflict");
     }
     roster = existing ?? rosterProjection(seed);
     targetSettings = vaultSettings(pool.settings, primary);
@@ -30586,7 +31388,7 @@ async function runNativeCustodyActivation(options, hooks = {}) {
         if (settings.status !== "ready")
           refuse4("invalid-state");
         const custody = settings.settings.claustrum;
-        if (isRecord13(custody) && custody.mode === "claustrum")
+        if (isRecord15(custody) && custody.mode === "claustrum")
           return { status: "already-vault", journal };
       }
       if (journal.activation?.kind === "activation" && journal.activation.phase === "committed")
@@ -32539,7 +33341,7 @@ function waitForRequest(pending, signal) {
   });
 }
 // src/native-vault-connection.ts
-import { dirname as dirname17, join as join18, resolve as resolve14 } from "node:path";
+import { dirname as dirname20, join as join20, resolve as resolve14 } from "node:path";
 // ../../node_modules/@cortexkit/common-auth/dist/opencode2/integration.js
 var PLACEHOLDER_PREFIX = "common-auth-placeholder";
 var PLACEHOLDER_LIFETIME_MS = 365 * 24 * 60 * 60 * 1000;
@@ -32550,15 +33352,15 @@ function placeholderSecret(integrationID) {
 // ../../node_modules/@cortexkit/common-auth/dist/opencode2/install.js
 var MAX_RETRY_HOLD_MS = 20 * 60 * 1000;
 // ../../node_modules/@cortexkit/common-auth/dist/pi-slot/slot.js
-import { createHash as createHash21 } from "node:crypto";
+import { createHash as createHash22 } from "node:crypto";
 import { constants as constants4 } from "node:fs";
-import { lstat as lstat10, mkdir as mkdir13, open as open10, unlink as unlink8 } from "node:fs/promises";
-import { dirname as dirname16, resolve as resolve13 } from "node:path";
+import { lstat as lstat12, mkdir as mkdir14, open as open11, unlink as unlink8 } from "node:fs/promises";
+import { dirname as dirname19, resolve as resolve13 } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 
 // ../../node_modules/@cortexkit/common-auth/dist/pi-slot/lock.js
 import { rmdirSync, statSync as statSync5, utimesSync } from "node:fs";
-import { mkdir as mkdir12, rmdir, stat as stat10, utimes } from "node:fs/promises";
+import { mkdir as mkdir13, rmdir, stat as stat10, utimes } from "node:fs/promises";
 var STALE = 30000;
 var RENEWAL_STALE = 1e4;
 var UPDATE = 3000;
@@ -32578,7 +33380,7 @@ process.once("exit", () => {
 function sameDirectory(observed, identity3) {
   return observed.dev === identity3.dev && observed.ino === identity3.ino;
 }
-function errorCode2(error) {
+function errorCode3(error) {
   return typeof error === "object" && error !== null && "code" in error ? error.code : undefined;
 }
 function held() {
@@ -32588,15 +33390,15 @@ async function remove(path2) {
   try {
     await rmdir(path2);
   } catch (error) {
-    if (errorCode2(error) !== "ENOENT")
+    if (errorCode3(error) !== "ENOENT")
       throw error;
   }
 }
 async function acquire(path2, stale) {
   try {
-    await mkdir12(path2);
+    await mkdir13(path2);
   } catch (error) {
-    if (errorCode2(error) !== "EEXIST")
+    if (errorCode3(error) !== "EEXIST")
       throw error;
     if (stale <= 0)
       throw held();
@@ -32604,7 +33406,7 @@ async function acquire(path2, stale) {
     try {
       mtime = (await stat10(path2)).mtime.getTime();
     } catch (error2) {
-      if (errorCode2(error2) === "ENOENT")
+      if (errorCode3(error2) === "ENOENT")
         return acquire(path2, 0);
       throw error2;
     }
@@ -32657,7 +33459,7 @@ async function acquirePiLock(authPath, onCompromised, onRenew) {
   function retry(error) {
     if (released)
       return;
-    if (errorCode2(error) === "ENOENT" || lastUpdate + RENEWAL_STALE < Date.now())
+    if (errorCode3(error) === "ENOENT" || lastUpdate + RENEWAL_STALE < Date.now())
       compromise();
     else
       schedule2(1000);
@@ -32719,7 +33521,7 @@ async function acquirePiLock(authPath, onCompromised, onRenew) {
       try {
         observed = await stat10(path2);
       } catch (error) {
-        if (errorCode2(error) !== "ENOENT")
+        if (errorCode3(error) !== "ENOENT")
           throw error;
         compromise();
         return;
@@ -32814,7 +33616,7 @@ function canonical(value) {
   return JSON.stringify(value);
 }
 function digest2(value) {
-  return createHash21("sha256").update(canonical(value)).digest("hex");
+  return createHash22("sha256").update(canonical(value)).digest("hex");
 }
 function code(error) {
   return object2(error) ? error.code : undefined;
@@ -32836,13 +33638,13 @@ async function safeRead(path2, privateFile = false, afterReadCheck) {
   }
   let file;
   try {
-    file = await open10(path2, constants4.O_RDONLY | constants4.O_NOFOLLOW);
+    file = await open11(path2, constants4.O_RDONLY | constants4.O_NOFOLLOW);
     const stat11 = await file.stat();
     if (!stat11.isFile() || privateFile && (stat11.mode & 511) !== 384) {
       throw new PiSlotError("unsafe-path");
     }
     await afterReadCheck?.(path2);
-    const current = await lstat10(path2);
+    const current = await lstat12(path2);
     if (!current.isFile() || current.dev !== stat11.dev || current.ino !== stat11.ino) {
       throw new PiSlotError("unsafe-path");
     }
@@ -32914,7 +33716,7 @@ function replaceEntry(auth, provider, next) {
 async function syncDir(path2) {
   if (windowsPrivateFiles)
     return;
-  const dir = await open10(path2, "r");
+  const dir = await open11(path2, "r");
   try {
     await dir.sync();
   } finally {
@@ -32965,7 +33767,7 @@ function createPiSlot(options, onStep, hooks) {
     }
   }
   async function locked(fn) {
-    let release;
+    let release2;
     let assertFresh;
     let compromised = false;
     const assertLock = () => {
@@ -32975,17 +33777,17 @@ function createPiSlot(options, onStep, hooks) {
     };
     try {
       if (windowsPrivateFiles)
-        await ensurePrivateDirectory(dirname16(authPath));
+        await ensurePrivateDirectory(dirname19(authPath));
       else
-        await mkdir13(dirname16(authPath), { recursive: true, mode: 448 });
+        await mkdir14(dirname19(authPath), { recursive: true, mode: 448 });
       const deadline = Date.now() + timeout;
       let retry = 0;
-      while (!release) {
+      while (!release2) {
         try {
           const lease = await acquirePiLock(authPath, () => {
             compromised = true;
           }, hooks?.onRenew);
-          release = lease.release;
+          release2 = lease.release;
           assertFresh = lease.assertFresh;
         } catch (error) {
           if (code(error) !== "ELOCKED")
@@ -33005,7 +33807,7 @@ function createPiSlot(options, onStep, hooks) {
         throw error;
       throw new PiSlotError("io");
     } finally {
-      await release?.().catch(() => {});
+      await release2?.().catch(() => {});
       assertLock();
     }
   }
@@ -33017,7 +33819,7 @@ function createPiSlot(options, onStep, hooks) {
   async function deleteStash(assertLock) {
     assertLock();
     await unlink8(stashPath);
-    await syncDir(dirname16(stashPath));
+    await syncDir(dirname19(stashPath));
     onStep?.("stash-deleted");
   }
   return {
@@ -33037,10 +33839,10 @@ function createPiSlot(options, onStep, hooks) {
         throw new PiSlotError("conflict");
       if (!stash) {
         if (windowsPrivateFiles)
-          await ensurePrivateDirectory(dirname16(stashPath));
+          await ensurePrivateDirectory(dirname19(stashPath));
         else {
-          await mkdir13(dirname16(stashPath), { recursive: true, mode: 448 });
-          const dir = await lstat10(dirname16(stashPath));
+          await mkdir14(dirname19(stashPath), { recursive: true, mode: 448 });
+          const dir = await lstat12(dirname19(stashPath));
           if (!dir.isDirectory() || (dir.mode & 511) !== 448)
             throw new PiSlotError("unsafe-path");
         }
@@ -33081,7 +33883,7 @@ function createPiSlot(options, onStep, hooks) {
 function nativePiAuthSlotPaths(options) {
   return {
     authPath: resolve14(options.authPath),
-    stashPath: join18(dirname17(getHostClaustrumEnrollmentPaths("pi", options.env).tokenPath), "pi-auth-slot", "anthropic.json"),
+    stashPath: join20(dirname20(getHostClaustrumEnrollmentPaths("pi", options.env).tokenPath), "pi-auth-slot", "anthropic.json"),
     provider: "anthropic",
     placeholderKey: placeholderSecret("anthropic")
   };
@@ -33150,11 +33952,11 @@ function createAnthropicOAuthFetch(options = {}) {
   });
 }
 // src/prime.ts
-import { createHash as createHash22 } from "node:crypto";
-import { realpathSync as realpathSync2 } from "node:fs";
-import { mkdir as mkdir14, readdir as readdir4, rm as rm8, stat as stat11, writeFile as writeFile5 } from "node:fs/promises";
+import { createHash as createHash23 } from "node:crypto";
+import { realpathSync as realpathSync3 } from "node:fs";
+import { mkdir as mkdir15, readdir as readdir4, rm as rm8, stat as stat11, writeFile as writeFile5 } from "node:fs/promises";
 import { tmpdir as tmpdir7 } from "node:os";
-import { join as join19, resolve as resolve15 } from "node:path";
+import { join as join21, resolve as resolve15 } from "node:path";
 var CLAUDE_PRIME_COMMAND_NAME = "claude-prime";
 var PRIME_TICK_MS = 60000;
 var PRIME_DUE_OFFSET_MS = 60000;
@@ -33342,34 +34144,34 @@ function buildPrimeRequestBody() {
   return JSON.parse(JSON.stringify(PRIME_REQUEST_BODY));
 }
 function defaultMarkerDir() {
-  return join19(tmpdir7(), "opencode-anthropic-auth", "prime");
+  return join21(tmpdir7(), "opencode-anthropic-auth", "prime");
 }
 function primeStorageFingerprint(storagePath) {
   const absolutePath = resolve15(storagePath);
   let canonicalPath2;
   try {
-    canonicalPath2 = realpathSync2(absolutePath);
+    canonicalPath2 = realpathSync3(absolutePath);
   } catch (error) {
     if (error.code !== "ENOENT")
       throw error;
     canonicalPath2 = absolutePath;
   }
-  return createHash22("sha256").update(canonicalPath2).digest("hex").slice(0, 12);
+  return createHash23("sha256").update(canonicalPath2).digest("hex").slice(0, 12);
 }
 function primeMarkerNamespaceDir(markerDir, storagePath) {
-  return join19(markerDir, primeStorageFingerprint(storagePath));
+  return join21(markerDir, primeStorageFingerprint(storagePath));
 }
 function primeAccountMarkerDir(markerDir, storagePath, accountFingerprint) {
   if (!/^[a-f0-9]{12,}$/i.test(accountFingerprint)) {
     throw new Error("Prime account fingerprint must be a hexadecimal digest");
   }
-  return join19(primeMarkerNamespaceDir(markerDir, storagePath), accountFingerprint.toLowerCase().slice(0, 12));
+  return join21(primeMarkerNamespaceDir(markerDir, storagePath), accountFingerprint.toLowerCase().slice(0, 12));
 }
 function primeMarkerPath(markerDir, accountId2, resetsAtEpochMs) {
-  return join19(markerDir, `${encodeURIComponent(accountId2)}-${resetsAtEpochMs}`);
+  return join21(markerDir, `${encodeURIComponent(accountId2)}-${resetsAtEpochMs}`);
 }
 function primeBootstrapMarkerPath(markerDir, accountId2) {
-  return join19(markerDir, `${encodeURIComponent(accountId2)}-bootstrap`);
+  return join21(markerDir, `${encodeURIComponent(accountId2)}-bootstrap`);
 }
 function primeAccountLabel(id2, fallback) {
   if (id2 === "main")
@@ -33664,7 +34466,7 @@ class PrimeManager {
   }
   async tryClaimPath(dir, markerPath) {
     try {
-      await mkdir14(dir, { recursive: true });
+      await mkdir15(dir, { recursive: true });
     } catch {}
     try {
       await writeFile5(markerPath, "", { encoding: "utf8", flag: "wx" });
@@ -33799,7 +34601,7 @@ class PrimeManager {
     let swept = 0;
     for (const entry2 of entries) {
       try {
-        const path2 = join19(dir, entry2);
+        const path2 = join21(dir, entry2);
         const s = await stat11(path2);
         if (s.isDirectory()) {
           swept += await this.sweepMarkerDirectory(path2, now);
@@ -33821,24 +34623,24 @@ class PrimeManager {
   }
 }
 // src/quota-header-feed.ts
-import { randomUUID as randomUUID17 } from "node:crypto";
+import { randomUUID as randomUUID18 } from "node:crypto";
 import {
   chmod as chmod3,
-  lstat as lstat11,
-  mkdir as mkdir15,
+  lstat as lstat13,
+  mkdir as mkdir16,
   readdir as readdir5,
-  readFile as readFile10,
+  readFile as readFile11,
   rename as rename14,
   rm as rm9,
   stat as stat12,
   writeFile as writeFile6
 } from "node:fs/promises";
 import { tmpdir as tmpdir8 } from "node:os";
-import { join as join20 } from "node:path";
+import { join as join22 } from "node:path";
 var QUOTA_HEADER_FEED_SCHEMA_VERSION = 3;
 var QUOTA_HEADER_FEED_LEASE_MS = 180000;
 function getDefaultQuotaHeaderFeedDirectory() {
-  return process.env.OPENCODE_ANTHROPIC_AUTH_QUOTA_FEED_DIR ?? join20(tmpdir8(), "opencode-anthropic-auth", "quota-header-feed");
+  return process.env.OPENCODE_ANTHROPIC_AUTH_QUOTA_FEED_DIR ?? join22(tmpdir8(), "opencode-anthropic-auth", "quota-header-feed");
 }
 function configuredAnthropicOAuthAccountCount(input) {
   const fallbackCount = input.storage?.accounts.filter(isOAuthAccount).length ?? 0;
@@ -33996,8 +34798,8 @@ class QuotaHeaderFeedRegistry {
   writeChain = Promise.resolve();
   constructor(options = {}) {
     this.options = options;
-    const instanceId = options.instanceId ?? `${process.pid}-${randomUUID17()}`;
-    this.filePath = join20(options.directory ?? getDefaultQuotaHeaderFeedDirectory(), `${instanceId}.json`);
+    const instanceId = options.instanceId ?? `${process.pid}-${randomUUID18()}`;
+    this.filePath = join22(options.directory ?? getDefaultQuotaHeaderFeedDirectory(), `${instanceId}.json`);
   }
   publish(entry2) {
     const { accountKey, quota: quota2 } = entry2;
@@ -34026,17 +34828,17 @@ class QuotaHeaderFeedRegistry {
       return Promise.reject(new Error("Invalid quota header feed account key"));
     this.writeChain = this.writeChain.catch(() => {}).then(async () => {
       const directory = this.options.directory ?? getDefaultQuotaHeaderFeedDirectory();
-      await mkdir15(directory, { recursive: true, mode: 448 });
+      await mkdir16(directory, { recursive: true, mode: 448 });
       await chmod3(directory, 448);
       await this.reapStaleSiblingLeases(directory);
       let entries = {};
       try {
-        const record9 = JSON.parse(await readFile10(this.filePath, "utf8"));
+        const record9 = JSON.parse(await readFile11(this.filePath, "utf8"));
         if (record9.version === QUOTA_HEADER_FEED_SCHEMA_VERSION && record9.entries && typeof record9.entries === "object")
           entries = record9.entries;
       } catch {}
       entries[accountKey] = cleanEntry;
-      const tempPath = `${this.filePath}.${randomUUID17()}.tmp`;
+      const tempPath = `${this.filePath}.${randomUUID18()}.tmp`;
       try {
         await writeFile6(tempPath, `${JSON.stringify({ version: QUOTA_HEADER_FEED_SCHEMA_VERSION, lease_horizon_ms: this.options.leaseMs ?? QUOTA_HEADER_FEED_LEASE_MS, entries })}
 `, { mode: 384 });
@@ -34058,7 +34860,7 @@ class QuotaHeaderFeedRegistry {
       return;
     }
     await Promise.all(names2.filter((name) => /^\d+-[0-9a-f-]+\.json$/i.test(name)).map(async (name) => {
-      const path2 = join20(directory, name);
+      const path2 = join22(directory, name);
       if (path2 === this.filePath)
         return;
       try {
@@ -34066,7 +34868,7 @@ class QuotaHeaderFeedRegistry {
         if (file.mtimeMs > now || now - file.mtimeMs < leaseMs)
           return;
         await this.options.beforeRemoveFile?.(path2);
-        const current = await lstat11(path2);
+        const current = await lstat13(path2);
         if (current.ino !== file.ino || current.mtimeMs !== file.mtimeMs)
           return;
         await (this.options.removeFile ?? ((target2) => rm9(target2)))(path2);
@@ -34087,7 +34889,7 @@ class QuotaHeaderFeedRegistry {
     const newest = new Map;
     await Promise.all(names2.map(async (name) => {
       try {
-        const record9 = JSON.parse(await readFile10(join20(directory, name), "utf8"));
+        const record9 = JSON.parse(await readFile11(join22(directory, name), "utf8"));
         if (record9.version !== QUOTA_HEADER_FEED_SCHEMA_VERSION || !record9.entries || typeof record9.entries !== "object")
           return;
         for (const [accountKey, candidate] of Object.entries(record9.entries)) {
@@ -34267,8 +35069,8 @@ function buildClaudeQuotaSummary(input) {
 `).trimEnd();
 }
 // src/request-gzip.ts
-import { mkdir as mkdir16, readFile as readFile11, rename as rename15, rm as rm10, writeFile as writeFile7 } from "node:fs/promises";
-import { basename as basename8, dirname as dirname18, join as join21 } from "node:path";
+import { mkdir as mkdir17, readFile as readFile12, rename as rename15, rm as rm10, writeFile as writeFile7 } from "node:fs/promises";
+import { basename as basename10, dirname as dirname21, join as join23 } from "node:path";
 import { promisify } from "node:util";
 import { gzip } from "node:zlib";
 var gzipAsync = promisify(gzip);
@@ -34369,7 +35171,7 @@ class RequestGzipLatch {
       return false;
     let text5;
     try {
-      text5 = await readFile11(this.path, "utf8");
+      text5 = await readFile12(this.path, "utf8");
     } catch {
       return false;
     }
@@ -34392,7 +35194,7 @@ class RequestGzipLatch {
       return;
     const temporary = `${this.path}.${process.pid}.tmp`;
     try {
-      await mkdir16(dirname18(this.path), { recursive: true });
+      await mkdir17(dirname21(this.path), { recursive: true });
       await writeFile7(temporary, `${JSON.stringify({ latchedAt: this.now(), status })}
 `, { mode: 384 });
       await rename15(temporary, this.path);
@@ -34412,9 +35214,9 @@ function getRequestGzipLatch(path2) {
   return latch;
 }
 function getRequestGzipLatchPath(accountStoragePath) {
-  const name = basename8(accountStoragePath);
+  const name = basename10(accountStoragePath);
   const stem = name.endsWith(".json") ? name.slice(0, -5) : name;
-  return join21(dirname18(accountStoragePath), `${stem}-request-gzip.json`);
+  return join23(dirname21(accountStoragePath), `${stem}-request-gzip.json`);
 }
 async function decideRequestGzip(options) {
   if (!CLAUDE_CODE_GZIPS_REQUEST_BODIES)
@@ -34559,7 +35361,7 @@ var REPORTED_BLOCK_TYPES = new Set([
   "document"
 ]);
 var EMPTY_TEXT_BLOCK_KEYS = new Set(["type", "text", "cache_control"]);
-function isRecord14(value) {
+function isRecord16(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isProvablyEmptyContent(content) {
@@ -34567,14 +35369,14 @@ function isProvablyEmptyContent(content) {
     return content.trim() === "";
   if (!Array.isArray(content))
     return false;
-  return content.every((block) => isRecord14(block) && block.type === "text" && typeof block.text === "string" && block.text.trim() === "" && Object.keys(block).every((key) => EMPTY_TEXT_BLOCK_KEYS.has(key)));
+  return content.every((block) => isRecord16(block) && block.type === "text" && typeof block.text === "string" && block.text.trim() === "" && Object.keys(block).every((key) => EMPTY_TEXT_BLOCK_KEYS.has(key)));
 }
 function describeContent(content) {
   if (Array.isArray(content)) {
     return {
       contentShape: "array",
       contentBlockCount: content.length,
-      contentBlockTypes: content.map((block) => isRecord14(block) && typeof block.type === "string" && REPORTED_BLOCK_TYPES.has(block.type) ? block.type : "other")
+      contentBlockTypes: content.map((block) => isRecord16(block) && typeof block.type === "string" && REPORTED_BLOCK_TYPES.has(block.type) ? block.type : "other")
     };
   }
   if (typeof content === "string")
@@ -34587,7 +35389,7 @@ function assertNoMeaningfulTrailingAssistant(messages) {
   let end = messages.length;
   while (end > 0) {
     const last = messages[end - 1];
-    if (!isRecord14(last) || last.role !== "assistant")
+    if (!isRecord16(last) || last.role !== "assistant")
       break;
     if (!isProvablyEmptyContent(last.content)) {
       throw new TrailingAssistantHistoryError({
@@ -34730,11 +35532,11 @@ function executeLaneStartCommand(input) {
 }
 // src/thinking-binding.ts
 var THINKING_BINDING_CONTROLS_BETA = "thinking-binding-controls-2026-08-01";
-function isRecord15(value) {
+function isRecord17(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isReplayableThinkingBlock(block) {
-  if (!isRecord15(block))
+  if (!isRecord17(block))
     return false;
   if (block.type === "thinking") {
     return typeof block.signature === "string" && block.signature.length > 0;
@@ -34752,7 +35554,7 @@ function hasReplayableThinkingBlocks(body) {
   if (!Array.isArray(body.messages))
     return false;
   return body.messages.some((message) => {
-    if (!isRecord15(message) || message.role !== "assistant")
+    if (!isRecord17(message) || message.role !== "assistant")
       return false;
     return Array.isArray(message.content) && message.content.some(isReplayableThinkingBlock);
   });
@@ -34764,7 +35566,7 @@ function applyThinkingBindingControls(body, behavior = "account-default") {
     return false;
   if (!hasReplayableThinkingBlocks(body))
     return false;
-  if (!isRecord15(body.thinking) || body.thinking.type !== "adaptive")
+  if (!isRecord17(body.thinking) || body.thinking.type !== "adaptive")
     return false;
   body.thinking.block_binding = {
     prefix_mismatch_behavior: behavior
@@ -34772,9 +35574,9 @@ function applyThinkingBindingControls(body, behavior = "account-default") {
   return true;
 }
 function hasThinkingBindingControls(body) {
-  if (!isRecord15(body.thinking))
+  if (!isRecord17(body.thinking))
     return false;
-  if (!isRecord15(body.thinking.block_binding))
+  if (!isRecord17(body.thinking.block_binding))
     return false;
   const behavior = body.thinking.block_binding.prefix_mismatch_behavior;
   return behavior === "error" || behavior === "drop_block";
@@ -34783,7 +35585,7 @@ function hasThinkingBindingControls(body) {
 var TURN_END_NOTE_MIN_VISIBLE_CHARACTERS = 350;
 var TURN_END_NOTE_CONTENT = "Your reply above has already reached the user. The tool call after it was housekeeping and changed nothing they need to know. Do not repeat, summarize or rewrite that reply. If no new work remains, end the turn without restating anything.";
 var DEFAULT_TOOLS = ["board", "ctx_reduce"];
-function isRecord16(value) {
+function isRecord18(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function supportsTurnEndNote(model) {
@@ -34804,24 +35606,24 @@ function applyTurnEndNotes(body, options = {}) {
     let preceding = index - 1;
     while (preceding >= 0) {
       const control = messages[preceding];
-      if (!isRecord16(control) || control.role !== "system" || !Array.isArray(control.content) || control.content.length !== 0 || !isRecord16(control.output_config))
+      if (!isRecord18(control) || control.role !== "system" || !Array.isArray(control.content) || control.content.length !== 0 || !isRecord18(control.output_config))
         break;
       preceding--;
     }
     const assistant = messages[preceding];
-    if (!isRecord16(assistant) || assistant.role !== "assistant" || !Array.isArray(assistant.content) || !isRecord16(results) || results.role !== "user" || !Array.isArray(results.content))
+    if (!isRecord18(assistant) || assistant.role !== "assistant" || !Array.isArray(assistant.content) || !isRecord18(results) || results.role !== "user" || !Array.isArray(results.content))
       continue;
-    const visible = options.visibleText ? options.visibleText(assistant) : assistant.content.filter((block) => isRecord16(block) && block.type === "text" && typeof block.text === "string" && block.text.trim().length > 0).map((block) => block.text).join("");
+    const visible = options.visibleText ? options.visibleText(assistant) : assistant.content.filter((block) => isRecord18(block) && block.type === "text" && typeof block.text === "string" && block.text.trim().length > 0).map((block) => block.text).join("");
     if (visible.length < TURN_END_NOTE_MIN_VISIBLE_CHARACTERS)
       continue;
-    const calls = assistant.content.filter((block) => isRecord16(block) && block.type === "tool_use");
+    const calls = assistant.content.filter((block) => isRecord18(block) && block.type === "tool_use");
     if (!calls.length || !calls.every((call) => allowed.has(call.name)))
       continue;
-    const resultIds = new Set(results.content.filter((block) => isRecord16(block) && block.type === "tool_result").map((block) => block.tool_use_id));
+    const resultIds = new Set(results.content.filter((block) => isRecord18(block) && block.type === "tool_result").map((block) => block.tool_use_id));
     if (!calls.every((call) => typeof call.id === "string" && resultIds.has(call.id)))
       continue;
     const next = messages[index + 1];
-    if (isRecord16(next) && next.role === "user")
+    if (isRecord18(next) && next.role === "user")
       continue;
     rewritten.push({
       role: "system",
@@ -34835,6 +35637,7 @@ function applyTurnEndNotes(body, options = {}) {
   return inserted;
 }
 export {
+  writerStamp,
   writeNativeHostAuth,
   writeDumpFile,
   usesPerTurnControl,
@@ -34852,10 +35655,15 @@ export {
   stickyRouteCandidateWeight,
   stickyRetryAfterWithJitter,
   stickyQuotaSnapshotIsFresh,
+  stateSubfolderName,
+  stateRefusalCause,
+  stateHomeFilePaths,
+  stateHomeDatasetFiles,
   snapshotHasServableLocalOAuth,
   signRequestBody,
   shouldFallbackStatus,
   shouldEmit,
+  setupUsage,
   setupEnrollment,
   setLogLevel,
   setFastModeEnabled,
@@ -34872,12 +35680,14 @@ export {
   runPiCommandMenu,
   runNativeMigration,
   runNativeCustodyActivation,
+  resolveStateHomeTarget,
   resolveNativePoolPaths,
   resolveLocalRoutingDestination,
   resolveClaustrumConnectionPath,
   resolveClaudeModelCapabilities,
   resolveClaudeCodeIdentity,
   resolveClaudeCodeAccountIdentity,
+  resetNativeHolderRegistryForTests,
   resetFastModeState,
   resetDumpState,
   resetClaustrumEnrollmentState2 as resetClaustrumEnrollmentState,
@@ -34891,14 +35701,18 @@ export {
   remapModelId,
   releaseNativeMigrationPreflight,
   relayLog,
+  registerNativePoolHolder,
   refuseWritableAncestor2 as refuseWritableAncestor,
   refreshClaudeOAuthToken,
   refreshBackoffActive,
   redactPayload,
+  readStateLayoutMarker,
+  readRelocationPointer,
   readNativeMigrationJournal,
   readNativeHostAuthKind,
   readNativeEnrollmentMode,
   readNativeAccountsForRequest,
+  readConfigDirMarker,
   readClaustrumEnrollmentToken2 as readClaustrumEnrollmentToken,
   readClaustrumEnrollmentStatus2 as readClaustrumEnrollmentStatus,
   quotaWindowParts,
@@ -34914,6 +35728,8 @@ export {
   publishNativeVaultRuntimeSeed,
   publishNativeVaultRosterSeed,
   publishNativeEmptyInit,
+  processStateLayout,
+  processIncarnation,
   primeStorageFingerprint,
   primeMarkerPath,
   primeMarkerNamespaceDir,
@@ -34940,6 +35756,7 @@ export {
   parseAccountCommandAction,
   orderClaudeCodeBody,
   openNativePiAuthSlot,
+  openCodeHolderKind,
   oauthProfileMatchesIdentity,
   oauthProfileIsFresh,
   normalizeQuotaHeaders,
@@ -34948,6 +35765,8 @@ export {
   normalizeAdaptiveEffort,
   nativeSettingsRecord,
   nativeRuntimeOptionIdentity,
+  nativeRelocationRuntimePaths,
+  nativeRelocationGuard,
   nativePoolStoreLocks,
   nativePoolHoldsAccountData,
   nativePollQuotaGenerallyExhausted,
@@ -34956,6 +35775,7 @@ export {
   nativeLocalQuotaLineage,
   nativeLocalCredentialValidationMatches,
   nativeJournalMayAdoptLaterHostLogin,
+  nativeHolderDatasetFiles,
   nativeCacheKeepAlways,
   nativeAccountPolicy,
   nativeAccountCanServe,
@@ -34994,6 +35814,7 @@ export {
   isFastModeEnabled,
   isDumpPersistentlyEnabled,
   isDumpEnabled,
+  isDestinationShapedDirectory,
   isCustodyTombstoneValue,
   isCustodyTombstoneOAuth,
   isCostZeroingEnabled,
@@ -35015,6 +35836,8 @@ export {
   isCache1hEnabled,
   isApiKeyAccount,
   inspectNativeHostAuthEntry,
+  homeDefaultConfigDir,
+  holderEntryIsLive,
   hashRefreshToken,
   hashBody,
   hasThinkingBindingControls,
@@ -35035,6 +35858,7 @@ export {
   getQuotaCheckIntervalMs,
   getPersistedMainQuota,
   getPersistedLogLevel,
+  getOpenCodeConfigDir,
   getNativeMenuModel,
   getLogLevel,
   getLogFilePath,
@@ -35069,6 +35893,7 @@ export {
   formatLogLine,
   formatEnrollmentStatus,
   formatCreditAmounts,
+  findRelocationTombstone,
   findExistingClaustrumConnectionPath,
   fetchOAuthQuotaSnapshot,
   fetchOAuthAccountProfile,
@@ -35109,6 +35934,7 @@ export {
   createStringPatch,
   createStickyNoRouteResponse,
   createSseFramer,
+  createRelocationGuard,
   createProviderErrorResponseScope,
   createProviderErrorRedactor,
   createProcessFence,
@@ -35125,6 +35951,7 @@ export {
   countUserPrompts,
   connectClaustrumEnrollmentClient2 as connectClaustrumEnrollmentClient,
   configuredAnthropicOAuthAccountCount,
+  configFolderIdentity,
   computeXxhash64Hex,
   computeCcVersionSuffix,
   computeCCH,
@@ -35160,6 +35987,8 @@ export {
   applyCustomHeaders,
   applyClaudeCodeMetadata,
   applyClaudeCodeHeaders,
+  anthropicAuthStateRoot,
+  anthropicAuthRelease,
   acquireRefreshFileLock2 as acquireRefreshFileLock,
   acquireNativeVaultRuntime,
   acquireNativeAccountRuntime,
@@ -35176,14 +36005,19 @@ export {
   THINKING_BINDING_CONTROLS_BETA,
   TEXT_REPLACEMENTS,
   StickySessionRouter,
+  StateLayoutFileError,
   SseFrameTooLargeError,
   STICKY_ROUTING_SHORT_RESET_GRACE_MS,
   STICKY_ROUTING_MAIN_ACCOUNT_ID,
   STICKY_ROUTING_ASSIGNMENT_TTL_MS,
+  STATE_LAYOUT_PHASES,
+  STATE_HOME_FILE_NAMES,
   SECRET_KEY_EXACT2 as SECRET_KEY_EXACT,
   RequestGzipLatch,
+  RelocatedError,
   ROUTING_MODES,
   REQUIRED_BETAS,
+  RELOCATED_MESSAGE,
   REFRESH_SCOPE,
   QuotaRefreshDeferred,
   QuotaManager,
@@ -35219,7 +36053,14 @@ export {
   NativeCustodyActivationError,
   NATIVE_VAULT_NO_ACCOUNT_MESSAGE,
   LOGGING_LEVELS,
+  LEGACY_STATE_LAYOUT,
   KILLSWITCH_COMMAND_NAME,
+  HolderRegistrationError,
+  HOLDER_RETRY_INTERVAL_MS,
+  HOLDER_REGISTRATION_ERROR_MESSAGES,
+  HOLDER_LOCK_TIMEOUT_MS,
+  HOLDER_LOCK_NAME,
+  HOLDER_FILE_NAME,
   GZIP_REQUEST_BODIES_ENV,
   GZIP_LATCH_TTL_MS,
   FAST_MODE_BETA,