@cortexkit/anthropic-auth-core 2.4.4 → 2.4.6

package/dist/cachekeep.d.ts

@@ -171,6 +171,9 @@ export declare class CacheKeepManager {
             attempt: CacheKeepPrewarmAttempt;
         }) => Promise<Headers | undefined> | Headers | undefined;
         onTrackedSessionsChanged?: (sessions: readonly CacheKeepTrackedSession[]) => Promise<void> | void;
+        /** Hosts may mirror targets without delaying a live request on storage I/O. */
+        onTargetChanged?: (target: Readonly<CacheKeepTarget>) => void;
+        onTargetRemoved?: (id: string) => void;
         prepareBody?: (bodyText: string, target: CacheKeepTarget) => string | Promise<string>;
         /**
          * Veto a prewarm after its body is built but before anything is
@@ -248,6 +251,8 @@ export declare class CacheKeepManager {
         accountStoragePath?: string;
         isSubagent?: boolean;
         sourceWarm?: boolean;
+        /** Restore only the remaining lifetime, never grant a restarted cache a new hour. */
+        retained?: Pick<CacheKeepTarget, 'cacheExpiresAt' | 'nextPrewarmAt'>;
     }): {
         tracked: true;
     } | {

package/dist/index.d.ts

@@ -66,7 +66,7 @@ export type { NativeVaultQuotaPurpose, NativeVaultRuntime, NativeVaultRuntimeOpt
 export { acquireNativeVaultRuntime, createNativeVaultRuntime, discoverNativeVaultInventory, publishNativeVaultRosterSeed, publishNativeVaultRuntimeSeed, } from './native-vault-runtime.ts';
 export * from './oauth-origin.ts';
 export * from './oauth-profile.ts';
-export { createWindowsOwnerOnly, ensureWindowsOwnerOnlyDirectory, isOwnerOnly, type OwnerOnlyOptions, } from './owner-only.ts';
+export { createWindowsOwnerOnly, ensureWindowsOwnerOnlyDirectory, isOwnerOnly, type OwnerOnlyOptions, readWindowsOwnerOnly, } from './owner-only.ts';
 export * from './pkce.ts';
 export type { NativeEmptyInitJournal, NativeLegacyMigrationJournal, NativeMigrationJournal, } from './pool-authority.ts';
 export { nativeJournalMayAdoptLaterHostLogin, nativeMigrationAuthorityPhase, readNativeMigrationJournal, } from './pool-authority.ts';
@@ -78,6 +78,7 @@ export * from './prime.ts';
 export * from './provider.ts';
 export type { ProviderErrorRedactor, ProviderErrorResponseScope, ProviderErrorSummary, ProviderResponseMode, ProviderResponseSettlement, } from './provider-error.ts';
 export { createProviderErrorRedactor, createProviderErrorResponseScope, summarizePrewarmProviderError, } from './provider-error.ts';
+export { renameWithWindowsSharingRetry } from './publication-rename.ts';
 export * from './quota-header-feed.ts';
 export * from './quota-headers.ts';
 export * from './quota-manager.ts';

package/dist/index.js

@@ -729,7 +729,7 @@ async function withLock(target, options, fn) {
         options.signal?.throwIfAborted();
         return await fn(lock);
       } finally {
-        await lock.release();
+        await lock.release(options.signal);
       }
     }
     const remaining = options.timeoutMs - (performance.now() - started);
@@ -1387,7 +1387,7 @@ async function acquireRefreshFileLockWithClock(options) {
         ...typeof observed?.expiresAt === "number" ? { observedExpiresAt: observed.expiresAt } : {}
       });
     },
-    release: async () => {
+    release: async (signal) => {
       if (windowsPrivateFiles && releaseConfirmed)
         return;
       released = true;
@@ -1428,6 +1428,8 @@ async function acquireRefreshFileLockWithClock(options) {
             releaseConfirmed = removalConfirmed;
             return;
           }
+          if (signal?.aborted)
+            return;
           await recoverStaleEvictionMarker();
         } catch (error) {
           if (windowsPrivateFiles)
@@ -7982,15 +7984,27 @@ function credentialTypeOf(row, family) {
     return notMine;
   if (!row.categories.includes(family.category))
     return notMine;
-  if (row.credentialType !== "oauth" && row.credentialType !== "api_key")
-    return notMine;
   if ("classify" in family) {
+    const metadata = rowFactsOf(row);
+    let type;
+    switch (metadata.authMethod) {
+      case "apikey":
+        type = "api_key";
+        break;
+      case "chatgpt":
+      case "antigravity":
+      case "oauth":
+        type = "oauth";
+        break;
+      default:
+        return { kind: "refused", code: "unknown-auth-method" };
+    }
     const facts = {
       credentialId: row.id,
-      credentialType: row.credentialType,
+      credentialType: type,
       categories: row.categories,
       refreshAdapter: row.refreshAdapter,
-      ...rowFactsOf(row)
+      ...metadata
     };
     if (facts.providerIds === undefined)
       return { kind: "refused", code: "unmapped" };
@@ -7999,13 +8013,15 @@ function credentialTypeOf(row, family) {
       if (result.kind === "not-mine")
         return notMine;
       if (result.kind === "mine" && typeof result.member === "string")
-        return { kind: "mine", type: row.credentialType, member: result.member };
+        return { kind: "mine", type, member: result.member };
       if (result.kind === "refused" && typeof result.code === "string" && /^[a-z][a-z0-9-]{0,31}$/.test(result.code) && !result.code.includes(`
 `) && family.refusalCodes.includes(result.code))
         return { kind: "refused", code: result.code };
     } catch {}
     return { kind: "refused", code: "unclassified" };
   }
+  if (row.credentialType !== "oauth" && row.credentialType !== "api_key")
+    return notMine;
   if (row.credentialType === "oauth")
     return row.refreshAdapter === family.refreshAdapter ? { kind: "mine", type: "oauth" } : notMine;
   if (row.credentialType === "api_key" && family.apiKeys)
@@ -9586,7 +9602,7 @@ async function refreshVaultRoster(options) {
       pendingDiscoveries.set(key, discovered);
     throw error;
   } finally {
-    await lease.release();
+    await lease.release(options.signal);
   }
 }
 
@@ -10015,8 +10031,16 @@ class ClaustrumConsumer {
       this.#refreshing = undefined;
     });
     this.#track(this.#refreshing);
+    this.#notifyDiscovery(this.#refreshing);
     return this.#refreshing;
   }
+  #notifyDiscovery(promise) {
+    try {
+      this.#options.onDiscovery?.(promise);
+    } catch (error) {
+      this.#options.onError?.(error);
+    }
+  }
   start() {
     if (this.#started)
       return;
@@ -10199,6 +10223,13 @@ class ClaustrumConsumer {
   }
   #hubHooks() {
     return {
+      discovery: (promise) => {
+        const hub = this.#hub;
+        if (!hub || !this.#options.onDiscovery || this.#shutdown.signal.aborted)
+          return;
+        const discovery = this.#track(promise.then((outcome) => this.#hubOutcome(hub, outcome)));
+        this.#notifyDiscovery(discovery);
+      },
       install: (roster) => {
         if (this.#shutdown.signal.aborted)
           return;
@@ -10229,6 +10260,9 @@ class ClaustrumConsumer {
   }
   async#hubRefresh(hub) {
     const outcome = await hub.refresh();
+    return this.#hubOutcome(hub, outcome);
+  }
+  #hubOutcome(hub, outcome) {
     this.#assertOpen();
     if (!outcome)
       return;
@@ -10365,6 +10399,8 @@ class ClaustrumConsumer {
     this.#assertOpen();
     await declineVaultRoute(this.#options.rosterPath, routeId);
     this.#roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
+    if (this.#roster)
+      this.#hub?.publishRoster(this.#roster);
     if (this.#hub)
       this.#hub.retainUnion();
     else
@@ -10374,11 +10410,15 @@ class ClaustrumConsumer {
     this.#assertOpen();
     await acceptVaultRoute(this.#options.rosterPath, routeId);
     this.#roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
+    if (this.#roster)
+      this.#hub?.publishRoster(this.#roster);
   }
   async reorder(routeIds) {
     this.#assertOpen();
     const result = await reorderVaultRoster(this.#options.rosterPath, routeIds);
     this.#roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
+    if (this.#roster)
+      this.#hub?.publishRoster(this.#roster);
     return result;
   }
   async recordQuota(routeId, observation, attempt) {
@@ -10438,7 +10478,8 @@ class ClaustrumConsumer {
 // ../../node_modules/@cortexkit/common-auth/dist/claustrum/hub.js
 import { createHash as createHash6 } from "node:crypto";
 import { readdir as readdir2, stat as stat7 } from "node:fs/promises";
-import { dirname as dirname8, join as join10 } from "node:path";
+import { dirname as dirname8, join as join10, resolve as resolve9 } from "node:path";
+var sharedRosters = new Map;
 var FILE_ID = /^[a-z0-9][a-z0-9._-]{0,63}$/;
 var WINDOWS_DEVICE = /^(con|prn|aux|nul|com[0-9]|lpt[0-9])(\.|$)/;
 var FINGERPRINT = /^[0-9a-f]{16}$/;
@@ -10501,12 +10542,12 @@ function unreachableConnect2() {
   return new ClaustrumUnreachableError;
 }
 function untilAborted(pending, signal) {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     const abort = () => reject(signal.reason);
     signal.addEventListener("abort", abort, { once: true });
     pending.then((value) => {
       signal.removeEventListener("abort", abort);
-      resolve9(value);
+      resolve10(value);
     }, (error) => {
       signal.removeEventListener("abort", abort);
       reject(error);
@@ -10609,9 +10650,11 @@ class ClaustrumDiscoveryHub {
       watchMode: () => this.watchState(),
       keptReceiptState: () => this.keptReceiptState(),
       retainUnion: () => this.#retainUnion(),
+      publishRoster: (roster) => this.#publishRoster(entry, roster),
       forget: (credentialId) => this.#current?.custody?.forget(credentialId),
       detach: () => {
         entry.closed = true;
+        entry.releaseRoster?.();
       }
     };
     const consumerOptions = {
@@ -10624,14 +10667,51 @@ class ClaustrumDiscoveryHub {
       },
       ...this.#options.mapAccount && { mapAccount: this.#options.mapAccount },
       ...options.onRoster && { onRoster: options.onRoster },
+      ...options.onDiscovery && { onDiscovery: options.onDiscovery },
       ...options.onError && { onError: options.onError },
       logger: options.logger ?? this.#logger,
       ...this.#options.now && { now: this.#options.now }
     };
     const { consumer, hooks } = createHubMember(port, consumerOptions);
     entry.hooks = hooks;
+    const path2 = resolve9(entry.path);
+    const subscribers = sharedRosters.get(path2) ?? new Set;
+    const install = (roster) => {
+      if (entry.closed || this.#active !== true || !this.#current || !this.#live(this.#current) || !hooks.roster() || this.#collides(hooks, roster))
+        return;
+      entry.seen = JSON.stringify(decodedVaultRoster(roster));
+      hooks.install(roster);
+      if (roster.view !== this.#committed?.view)
+        entry.pending ??= { failures: 0, wait: 0 };
+      this.#retainUnion();
+    };
+    subscribers.add(install);
+    entry.receiveRoster = install;
+    sharedRosters.set(path2, subscribers);
+    let subscribed = true;
+    entry.releaseRoster = () => {
+      if (!subscribed)
+        return;
+      subscribed = false;
+      subscribers.delete(install);
+      if (!subscribers.size)
+        sharedRosters.delete(path2);
+    };
     return consumer;
   }
+  #publishRoster(entry, roster) {
+    const generation = this.#current;
+    if (entry.closed || !generation || !this.#live(generation))
+      return;
+    entry.seen = JSON.stringify(decodedVaultRoster(roster));
+    entry.hooks?.install(roster);
+    for (const install of sharedRosters.get(resolve9(entry.path)) ?? []) {
+      if (!this.#live(generation))
+        return;
+      if (install !== entry.receiveRoster)
+        install(roster);
+    }
+  }
   #startGeneration() {
     const generation = {
       id: ++this.#generations,
@@ -10896,6 +10976,8 @@ class ClaustrumDiscoveryHub {
     }));
     run.promise = promise;
     this.#run = run;
+    for (const entry of this.#open())
+      entry.hooks?.discovery(promise);
     return promise;
   }
   async#discover(run) {
@@ -10966,9 +11048,7 @@ class ClaustrumDiscoveryHub {
         this.#markPending(entry);
         continue;
       }
-      entry.seen = JSON.stringify(decodedVaultRoster(roster));
-      if (!entry.closed)
-        hooks.install(roster);
+      this.#publishRoster(entry, roster);
     }
     if (!this.#live(generation))
       return;
@@ -11077,7 +11157,7 @@ class ClaustrumDiscoveryHub {
       }
       const before = enabledRows(memory);
       entry.seen = content;
-      hooks.install(file);
+      this.#publishRoster(entry, file);
       if (enabledRows(hooks.roster()) !== before)
         this.#retainUnion();
     }
@@ -11198,6 +11278,8 @@ class ClaustrumDiscoveryHub {
     if (this.#shutdown.signal.aborted)
       return;
     this.#shutdown.abort(closed("Claustrum discovery hub is closed"));
+    for (const entry of this.#members.values())
+      entry.releaseRoster?.();
     if (this.#timer)
       (this.#options.clearTimeoutImpl ?? clearTimeout)(this.#timer);
     this.#timer = undefined;
@@ -11261,7 +11343,7 @@ import {
   extname as extname2,
   isAbsolute as isAbsolute3,
   join as join12,
-  resolve as resolve9
+  resolve as resolve10
 } from "node:path";
 import {
   ClaustrumCredentialError as ClaustrumCredentialError5,
@@ -11664,7 +11746,7 @@ function getClaustrumEnrollmentPaths2(tokenPath) {
 }
 function getHostClaustrumEnrollmentPaths(host, env = process.env, cwd = process.cwd()) {
   const configured = env[`${host.toUpperCase()}_ANTHROPIC_AUTH_CLAUSTRUM_ENROLLMENT_FILE`]?.trim();
-  const tokenPath = configured ? isAbsolute3(configured) ? configured : resolve9(cwd, configured) : join12(anthropicAuthStateRoot({
+  const tokenPath = configured ? isAbsolute3(configured) ? configured : resolve10(cwd, configured) : join12(anthropicAuthStateRoot({
     xdgStateHome: env.XDG_STATE_HOME,
     home: homedir4(),
     acceptRelative: true
@@ -12216,8 +12298,8 @@ function createNativeCustody(options) {
     let stopped = false;
     let inner;
     let finish = () => {};
-    const ended = new Promise((resolve10) => {
-      finish = resolve10;
+    const ended = new Promise((resolve11) => {
+      finish = resolve11;
     });
     const failed = (error) => stopped || closed2 || error instanceof NativeCustodyError ? { kind: "stopped" } : classifyVaultFailure(error) === "unreachable" ? { kind: "transport_lost", error: new ClaustrumUnreachableError } : { kind: "ended" };
     Promise.resolve().then(connection).then((owned) => {
@@ -13877,8 +13959,8 @@ function createProviderErrorResponseScope(secrets, mode) {
     wrappedBodies: 0
   };
   let resolveSettled = () => {};
-  const settled = new Promise((resolve10) => {
-    resolveSettled = resolve10;
+  const settled = new Promise((resolve11) => {
+    resolveSettled = resolve11;
   });
   let retired = false;
   let used = false;
@@ -14287,6 +14369,7 @@ class CacheKeepManager {
     if (!this.targets.has(id))
       return false;
     this.targets.delete(id);
+    this.options.onTargetRemoved?.(id);
     this.publishTrackedSessions();
     return true;
   }
@@ -14332,6 +14415,7 @@ class CacheKeepManager {
         ...details
       });
     this.targets.delete(target.id);
+    this.options.onTargetRemoved?.(target.id);
   }
   evictOldestTarget(now, reason) {
     const oldest = this.targets.values().next().value;
@@ -14349,8 +14433,10 @@ class CacheKeepManager {
         this.removeTarget(target, "schedule-period-ended", now);
         continue;
       }
-      if (now >= target.cacheExpiresAt)
+      if (now >= target.cacheExpiresAt) {
         this.targets.delete(id);
+        this.options.onTargetRemoved?.(id);
+      }
     }
     while (this.targets.size > CACHE_KEEP_MAX_TARGETS)
       this.evictOldestTarget(now, "count");
@@ -14363,6 +14449,8 @@ class CacheKeepManager {
   }
   track(input) {
     const now = this.options.now?.() ?? Date.now();
+    if (input.retained && input.retained.cacheExpiresAt <= now)
+      return { tracked: false, reason: "cache expired" };
     let bodyBytes;
     const refuse = (reason, reasonCode) => {
       if (reasonCode === "body-budget")
@@ -14414,8 +14502,8 @@ class CacheKeepManager {
       headers,
       bodyText: input.bodyText,
       bodyBytes,
-      cacheExpiresAt: now + CACHE_KEEP_TTL_MS,
-      nextPrewarmAt: now + CACHE_KEEP_TTL_MS - CACHE_KEEP_PREWARM_LEAD_MS,
+      cacheExpiresAt: input.retained?.cacheExpiresAt ?? now + CACHE_KEEP_TTL_MS,
+      nextPrewarmAt: input.retained?.nextPrewarmAt ?? now + CACHE_KEEP_TTL_MS - CACHE_KEEP_PREWARM_LEAD_MS,
       consecutiveFailures: 0,
       dayKey: today,
       oauthAccountId: input.oauthAccountId,
@@ -14426,8 +14514,10 @@ class CacheKeepManager {
     });
     this.pruneTargets(now, today);
     this.publishTrackedSessions();
-    if (!this.targets.has(input.sessionId))
+    const target = this.targets.get(input.sessionId);
+    if (!target)
       return { tracked: false, reason: "evicted by cachekeep limits" };
+    this.options.onTargetChanged?.(target);
     this.start();
     return { tracked: true };
   }
@@ -14504,6 +14594,9 @@ class CacheKeepManager {
         });
         target.consecutiveFailures += 1;
         target.nextPrewarmAt = now + cacheKeepRetryDelayMs(target.id, target.consecutiveFailures);
+      } finally {
+        if (this.targets.get(target.id) === target)
+          this.options.onTargetChanged?.(target);
       }
     }
     this.publishTrackedSessions();
@@ -14780,7 +14873,7 @@ import { basename as basename8, dirname as dirname15, join as join16 } from "nod
 // src/pool-paths.ts
 import { createHash as createHash17 } from "node:crypto";
 import { realpath as realpath3 } from "node:fs/promises";
-import { basename as basename7, dirname as dirname14, join as join15, resolve as resolve10 } from "node:path";
+import { basename as basename7, dirname as dirname14, join as join15, resolve as resolve11 } from "node:path";
 
 // src/sticky-routing.ts
 import { createHash as createHash16, randomUUID as randomUUID12 } from "node:crypto";
@@ -14956,7 +15049,7 @@ async function acquirePoolLock(spec, defaults, env) {
       });
     }
     const jitter = Math.floor(Math.random() * (options.retryMs + 1));
-    await new Promise((resolve10) => setTimeout(resolve10, Math.min(options.retryMs + jitter, remaining)));
+    await new Promise((resolve11) => setTimeout(resolve11, Math.min(options.retryMs + jitter, remaining)));
   }
 }
 function definedOnly(spec) {
@@ -17598,11 +17691,11 @@ class PoolQuotaWriter {
       const left = deadline - performance.now();
       if (left <= 0)
         throw refusal("pull", id, "lock-contention", `pool quota queue for ${id} is full (${POOL_QUOTA_QUEUE_LIMIT} readings) and the store locks stayed held`, true);
-      await new Promise((resolve10) => {
+      await new Promise((resolve11) => {
         const done = () => {
           clearTimeout(timer);
           this.wake.delete(done);
-          resolve10();
+          resolve11();
         };
         const timer = setTimeout(done, left);
         this.wake.add(done);
@@ -18911,7 +19004,7 @@ async function renameWithWindowsSharingRetry(from, to, options = {}, beforeRetry
     return "published";
   }
   const now = options.now ?? (() => performance.now());
-  const sleep = options.sleep ?? ((ms) => new Promise((resolve10) => setTimeout(resolve10, ms)));
+  const sleep = options.sleep ?? ((ms) => new Promise((resolve11) => setTimeout(resolve11, ms)));
   const start = now();
   let original;
   try {
@@ -20310,6 +20403,141 @@ function nativeVaultLegacyRoutes(source2, roster) {
   return routes;
 }
 
+// src/quota-headers.ts
+var PREFIX = "anthropic-ratelimit-unified-";
+var WINDOW_KEYS = {
+  "5h": "five_hour",
+  "7d": "seven_day"
+};
+function isQuotaBearingHeaderFrame(headers) {
+  return Object.keys(WINDOW_KEYS).some((suffix) => Number.isFinite(finiteHeaderNumber(headers, `${PREFIX}${suffix}-utilization`)));
+}
+function finiteHeaderNumber(headers, name) {
+  const value = headers.get(name);
+  if (value == null || value.trim() === "")
+    return;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : undefined;
+}
+function headerResetAt(headers, suffix) {
+  const seconds = finiteHeaderNumber(headers, `${PREFIX}${suffix}-reset`);
+  if (seconds == null)
+    return;
+  const reset = new Date(seconds * 1000);
+  return Number.isFinite(reset.getTime()) ? reset.toISOString() : undefined;
+}
+function normalizeWindow(headers, suffix, checkedAt) {
+  const utilization = finiteHeaderNumber(headers, `${PREFIX}${suffix}-utilization`);
+  if (utilization == null)
+    return;
+  const usedPercent = Math.min(100, Math.max(0, Math.round(utilization * 100)));
+  const resetsAt = headerResetAt(headers, suffix);
+  return {
+    usedPercent,
+    remainingPercent: 100 - usedPercent,
+    ...resetsAt && { resetsAt },
+    checkedAt
+  };
+}
+function quotaExhaustionFromHeaders(headers, modelId, now = Date.now()) {
+  const snapshot = {};
+  const exhausted = (suffix) => {
+    const utilization = finiteHeaderNumber(headers, `${PREFIX}${suffix}-utilization`);
+    if (headers.get(`${PREFIX}${suffix}-status`) !== "rejected" && (utilization == null || utilization < 1))
+      return;
+    return {
+      usedPercent: 100,
+      remainingPercent: 0,
+      checkedAt: now,
+      resetsAt: headerResetAt(headers, suffix)
+    };
+  };
+  for (const [suffix, key] of Object.entries(WINDOW_KEYS)) {
+    const window2 = exhausted(suffix);
+    if (window2)
+      snapshot[key] = window2;
+  }
+  for (const name of headers.keys()) {
+    const match = /^anthropic-ratelimit-unified-(7d[_-]([a-z0-9]+))-(?:status|utilization)$/.exec(name);
+    if (!match || !modelId?.toLowerCase().split(/[-_.]/).includes(match[2]))
+      continue;
+    const window2 = exhausted(match[1]);
+    if (window2)
+      snapshot.scoped = [
+        {
+          ...window2,
+          id: match[1],
+          title: match[2],
+          modelName: match[2],
+          modelId
+        }
+      ];
+  }
+  return snapshot;
+}
+function normalizeQuotaHeaders(headers, now = Date.now()) {
+  const fieldSources2 = {};
+  const fallbackHeader = headers.get(`${PREFIX}fallback`);
+  const snapshot = {
+    fallbackAdvised: fallbackHeader === "available",
+    source: "headers",
+    checkedAt: now
+  };
+  for (const [suffix, key] of Object.entries(WINDOW_KEYS)) {
+    const window2 = normalizeWindow(headers, suffix, now);
+    if (window2) {
+      snapshot[key] = window2;
+      fieldSources2[key] = "headers";
+    }
+  }
+  const representativeClaim = headers.get(`${PREFIX}representative-claim`);
+  if (representativeClaim) {
+    snapshot.bindingWindow = representativeClaim;
+    snapshot.bindingWindowSource = "headers";
+    fieldSources2.bindingWindow = "headers";
+  }
+  if (fallbackHeader !== null)
+    fieldSources2.fallbackAdvised = "headers";
+  return {
+    ...snapshot,
+    fieldSources: fieldSources2
+  };
+}
+function mergeHeaderQuotaSnapshot(existing, incoming) {
+  const {
+    scoped: existingScoped,
+    extraUsage: existingExtraUsage,
+    fieldSources: existingFieldSources,
+    ...existingWithoutPollOwnedFields
+  } = existing ?? {};
+  const {
+    scoped: _incomingScoped,
+    extraUsage: _incomingExtraUsage,
+    fieldSources: incomingFieldSources,
+    ...incomingWithoutPollOwnedFields
+  } = incoming;
+  const fieldSources2 = {};
+  for (const field of QUOTA_FIELD_NAMES) {
+    const value = field === "scoped" ? existingScoped : field === "extraUsage" ? existingExtraUsage : field === "fallbackAdvised" ? incomingFieldSources?.fallbackAdvised !== undefined ? incoming.fallbackAdvised : existing?.fallbackAdvised ?? incoming.fallbackAdvised : field === "bindingWindow" ? existing?.bindingWindowSource === "poll" ? existing?.bindingWindow : incoming.bindingWindow ?? existing?.bindingWindow : incoming[field] ?? existing?.[field];
+    if (value === undefined)
+      continue;
+    const source2 = field === "fallbackAdvised" ? incomingFieldSources?.fallbackAdvised ?? (existing?.fallbackAdvised !== undefined ? existingFieldSources ? existingFieldSources.fallbackAdvised : quotaFieldSource(existing, field) : undefined) : (field === "scoped" || field === "extraUsage") && value !== undefined ? "poll" : field === "bindingWindow" && existing?.bindingWindowSource === "poll" && existing.bindingWindow !== undefined ? "poll" : incoming[field] !== undefined ? incomingFieldSources?.[field] ?? quotaFieldSource(incoming, field) : existingFieldSources?.[field] ?? quotaFieldSource(existing, field);
+    if (source2)
+      fieldSources2[field] = source2;
+  }
+  return {
+    ...existingWithoutPollOwnedFields,
+    ...incomingWithoutPollOwnedFields,
+    ...Array.isArray(existingScoped) && { scoped: existingScoped },
+    ...existingExtraUsage != null && { extraUsage: existingExtraUsage },
+    fallbackAdvised: incomingFieldSources?.fallbackAdvised !== undefined ? incoming.fallbackAdvised : existing?.fallbackAdvised ?? incoming.fallbackAdvised,
+    bindingWindow: existing?.bindingWindowSource === "poll" ? existing.bindingWindow : incoming.bindingWindow ?? existing?.bindingWindow,
+    bindingWindowSource: existing?.bindingWindowSource === "poll" ? "poll" : incoming.bindingWindowSource ?? existing?.bindingWindowSource,
+    ...Object.keys(fieldSources2).length > 0 && { fieldSources: fieldSources2 },
+    source: "headers"
+  };
+}
+
 // src/sticky-routing.ts
 var STICKY_ROUTING_MAIN_ACCOUNT_ID = "main";
 var STICKY_ROUTING_SHORT_RESET_GRACE_MS = 15 * 60000;
@@ -20532,7 +20760,16 @@ function stickyRouteKnownFableExhausted(candidate, storage, now = Date.now()) {
 }
 function decideStickyQuotaFailure(input) {
   const now = input.now ?? Date.now();
-  const quota2 = knownQuota(input.quota);
+  let reading2 = knownQuota(input.quota);
+  const confirmed = input.responseHeaders ? quotaExhaustionFromHeaders(input.responseHeaders, input.modelId, now) : undefined;
+  if (reading2 && input.responseHeaders) {
+    reading2 = { ...reading2 };
+    for (const key of ["five_hour", "seven_day", "scoped"]) {
+      if (quotaFieldSource(reading2, key) === "headers")
+        delete reading2[key];
+    }
+  }
+  const quota2 = reading2 || confirmed && Object.keys(confirmed).length ? { ...reading2, ...confirmed } : undefined;
   if (!quota2)
     return { action: "retain", reason: "unknown" };
   let blocking;
@@ -20560,6 +20797,31 @@ function decideStickyQuotaFailure(input) {
   }
   return { action: "migrate", reason: blocking.reason };
 }
+function stickyRetainRetryHeaders(upstream, now = Date.now()) {
+  const headers = new Headers(upstream);
+  let seconds = 60;
+  const shorten = (value) => {
+    if (Number.isFinite(value))
+      seconds = Math.min(seconds, Math.max(0, value));
+  };
+  const after = headers.get("retry-after");
+  if (after?.trim()) {
+    shorten(Number.isFinite(Number(after)) ? Number(after) : (Date.parse(after) - now) / 1000);
+  }
+  const ms = headers.get("retry-after-ms");
+  if (ms?.trim())
+    shorten(Number(ms) / 1000);
+  const resets = [...headers.keys()].filter((name) => /^anthropic-ratelimit-.*-reset$/.test(name));
+  for (const name of resets) {
+    const value = headers.get(name);
+    if (!value.trim())
+      continue;
+    shorten((Number.isFinite(Number(value)) ? Number(value) * 1000 : Date.parse(value)) / 1000 - now / 1000);
+  }
+  headers.set("retry-after", String(seconds));
+  headers.set("retry-after-ms", String(seconds * 1000));
+  return headers;
+}
 function getStickyRoutingStatePath(accountStoragePath) {
   const name = basename6(accountStoragePath);
   const stem = name.endsWith(".json") ? name.slice(0, -5) : name;
@@ -20664,7 +20926,7 @@ class StickySessionRouter {
       if (!wait || performance.now() >= deadline) {
         throw new Error("Timed out acquiring sticky routing state lock");
       }
-      await new Promise((resolve10) => setTimeout(resolve10, STICKY_ROUTING_LOCK_POLL_MS));
+      await new Promise((resolve11) => setTimeout(resolve11, STICKY_ROUTING_LOCK_POLL_MS));
     }
   }
   recoverLocalPins() {
@@ -21035,7 +21297,7 @@ function resolveLocalRoutingDestination(host, paths, env) {
   return (host === "opencode" ? env.OPENCODE_ANTHROPIC_AUTH_ROUTING_STATE_FILE : env.PI_ANTHROPIC_AUTH_ROUTING_STATE_FILE) || getStickyRoutingStatePath(paths.config);
 }
 async function canonicalPath(path2) {
-  const absolute = resolve10(path2);
+  const absolute = resolve11(path2);
   try {
     return await realpath3(absolute);
   } catch (error) {
@@ -21336,7 +21598,7 @@ class StateLayoutLockStack {
           name: spec.name,
           timeoutMs
         });
-      await new Promise((resolve11) => setTimeout(resolve11, Math.min(remaining, POOL_LOCK_DEFAULTS.retryMs + Math.floor(Math.random() * 25))));
+      await new Promise((resolve12) => setTimeout(resolve12, Math.min(remaining, POOL_LOCK_DEFAULTS.retryMs + Math.floor(Math.random() * 25))));
     }
   }
   async assertAll() {
@@ -22004,10 +22266,10 @@ async function linuxIncarnation(pid) {
   }
 }
 function macosIncarnation(pid) {
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     execFile("ps", ["-o", "lstart=", "-p", String(pid)], { env: { ...process.env, TZ: "UTC0" }, timeout: 5000 }, (error, stdout) => {
       const text5 = String(stdout ?? "").trim();
-      resolve11(error || !text5 ? null : text5);
+      resolve12(error || !text5 ? null : text5);
     });
   });
 }
@@ -22277,8 +22539,8 @@ function retryInBackground(attempt, options) {
   let timer;
   let closed2 = false;
   let settle = () => {};
-  const settled = new Promise((resolve11) => {
-    settle = resolve11;
+  const settled = new Promise((resolve12) => {
+    settle = resolve12;
   });
   const schedule2 = () => {
     if (closed2)
@@ -23921,13 +24183,13 @@ function logCommittedNativeAccountAdded(account) {
 }
 
 // src/native-vault-invalidation.ts
-import { resolve as resolve11 } from "node:path";
+import { resolve as resolve12 } from "node:path";
 var holders = new Set;
 function watchNativeVaultAuthority(holder) {
   const held = {
     ...holder,
-    roster: resolve11(holder.roster),
-    tokenPath: resolve11(holder.tokenPath)
+    roster: resolve12(holder.roster),
+    tokenPath: resolve12(holder.tokenPath)
   };
   holders.add(held);
   return () => {
@@ -23936,12 +24198,12 @@ function watchNativeVaultAuthority(holder) {
 }
 function retainNativeVaultRoster(path2, roster) {
   for (const holder of holders)
-    if (holder.roster === resolve11(path2))
+    if (holder.roster === resolve12(path2))
       holder.retain(roster);
 }
 function closeNativeVaultAuthority(tokenPath) {
   for (const holder of holders)
-    if (holder.tokenPath === resolve11(tokenPath))
+    if (holder.tokenPath === resolve12(tokenPath))
       holder.close();
 }
 
@@ -24250,12 +24512,12 @@ async function joinNativePoolWrite(paths, signals, check, onLockEvent) {
 function pause(ms, signals) {
   if (signals.some((signal) => signal.aborted))
     return Promise.resolve();
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     const wake = () => {
       clearTimeout(timer);
       for (const signal of signals)
         signal.removeEventListener("abort", wake);
-      resolve12();
+      resolve13();
     };
     const timer = setTimeout(wake, ms);
     for (const signal of signals)
@@ -24511,7 +24773,7 @@ function createNativeRefreshCoordinator(options) {
           name: spec.name,
           timeoutMs: POOL_LOCK_DEFAULTS.timeoutMs
         });
-      await new Promise((resolve12) => setTimeout(resolve12, Math.min(POOL_LOCK_DEFAULTS.retryMs, remaining)));
+      await new Promise((resolve13) => setTimeout(resolve13, Math.min(POOL_LOCK_DEFAULTS.retryMs, remaining)));
     }
   }
   async function run(job, request) {
@@ -25906,7 +26168,7 @@ function createPublisher() {
       const batch = { patch, result: Promise.resolve(false) };
       pending.set(key, batch);
       batch.result = run(async () => {
-        await new Promise((resolve12) => setTimeout(resolve12, 0));
+        await new Promise((resolve13) => setTimeout(resolve13, 0));
         pending.delete(key);
         return write(batch.patch);
       });
@@ -26028,7 +26290,7 @@ function createNativeUsagePublisher(channel) {
   return {
     observe: observe2,
     publish(write) {
-      observe2(new Promise((resolve12) => setTimeout(resolve12, 0)).then(write));
+      observe2(new Promise((resolve13) => setTimeout(resolve13, 0)).then(write));
     },
     async drain() {
       while (pending.size)
@@ -26115,7 +26377,7 @@ class NativeQuotaObservations extends Map {
 }
 
 // src/native-runtime-registry.ts
-import { resolve as resolve12 } from "node:path";
+import { resolve as resolve13 } from "node:path";
 var identities = new WeakMap;
 var nextIdentity = 0;
 function nativeRuntimeOptionIdentity(value) {
@@ -26144,14 +26406,14 @@ function nativeRuntimeStorageKey(options) {
       "runtime",
       "journal",
       "roster"
-    ].map((field) => resolve12(paths[field])),
-    resolve12(enrollment.tokenPath),
-    resolve12(enrollment.statePath),
-    resolve12(connection)
+    ].map((field) => resolve13(paths[field])),
+    resolve13(enrollment.tokenPath),
+    resolve13(enrollment.statePath),
+    resolve13(connection)
   ]);
 }
 function nativeRuntimeConnectionFile(host, env) {
-  return resolve12(resolveClaustrumConnectionPath(host === "pi" ? env.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE : undefined, host === "pi" ? {
+  return resolve13(resolveClaustrumConnectionPath(host === "pi" ? env.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE : undefined, host === "pi" ? {
     ...env,
     OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE: undefined
   } : env));
@@ -26623,105 +26885,11 @@ function validateNativeVaultRosterSeed(existing, input) {
     }
   });
 }
-
-// src/quota-headers.ts
-var PREFIX = "anthropic-ratelimit-unified-";
-var WINDOW_KEYS = {
-  "5h": "five_hour",
-  "7d": "seven_day"
-};
-function isQuotaBearingHeaderFrame(headers) {
-  return Object.keys(WINDOW_KEYS).some((suffix) => Number.isFinite(finiteHeaderNumber(headers, `${PREFIX}${suffix}-utilization`)));
-}
-function finiteHeaderNumber(headers, name) {
-  const value = headers.get(name);
-  if (value == null || value.trim() === "")
-    return;
-  const parsed = Number(value);
-  return Number.isFinite(parsed) ? parsed : undefined;
-}
-function normalizeWindow(headers, suffix, checkedAt) {
-  const utilization = finiteHeaderNumber(headers, `${PREFIX}${suffix}-utilization`);
-  if (utilization == null)
-    return;
-  const usedPercent = Math.min(100, Math.max(0, Math.round(utilization * 100)));
-  const resetSeconds = finiteHeaderNumber(headers, `${PREFIX}${suffix}-reset`);
-  const resetDate = resetSeconds == null ? undefined : new Date(resetSeconds * 1000);
-  const resetsAt = resetDate && Number.isFinite(resetDate.getTime()) ? resetDate.toISOString() : undefined;
-  return {
-    usedPercent,
-    remainingPercent: 100 - usedPercent,
-    ...resetsAt && { resetsAt },
-    checkedAt
-  };
-}
-function normalizeQuotaHeaders(headers, now = Date.now()) {
-  const fieldSources2 = {};
-  const fallbackHeader = headers.get(`${PREFIX}fallback`);
-  const snapshot = {
-    fallbackAdvised: fallbackHeader === "available",
-    source: "headers",
-    checkedAt: now
-  };
-  for (const [suffix, key] of Object.entries(WINDOW_KEYS)) {
-    const window2 = normalizeWindow(headers, suffix, now);
-    if (window2) {
-      snapshot[key] = window2;
-      fieldSources2[key] = "headers";
-    }
-  }
-  const representativeClaim = headers.get(`${PREFIX}representative-claim`);
-  if (representativeClaim) {
-    snapshot.bindingWindow = representativeClaim;
-    snapshot.bindingWindowSource = "headers";
-    fieldSources2.bindingWindow = "headers";
-  }
-  if (fallbackHeader !== null)
-    fieldSources2.fallbackAdvised = "headers";
-  return {
-    ...snapshot,
-    fieldSources: fieldSources2
-  };
-}
-function mergeHeaderQuotaSnapshot(existing, incoming) {
-  const {
-    scoped: existingScoped,
-    extraUsage: existingExtraUsage,
-    fieldSources: existingFieldSources,
-    ...existingWithoutPollOwnedFields
-  } = existing ?? {};
-  const {
-    scoped: _incomingScoped,
-    extraUsage: _incomingExtraUsage,
-    fieldSources: incomingFieldSources,
-    ...incomingWithoutPollOwnedFields
-  } = incoming;
-  const fieldSources2 = {};
-  for (const field of QUOTA_FIELD_NAMES) {
-    const value = field === "scoped" ? existingScoped : field === "extraUsage" ? existingExtraUsage : field === "fallbackAdvised" ? incomingFieldSources?.fallbackAdvised !== undefined ? incoming.fallbackAdvised : existing?.fallbackAdvised ?? incoming.fallbackAdvised : field === "bindingWindow" ? existing?.bindingWindowSource === "poll" ? existing?.bindingWindow : incoming.bindingWindow ?? existing?.bindingWindow : incoming[field] ?? existing?.[field];
-    if (value === undefined)
-      continue;
-    const source2 = field === "fallbackAdvised" ? incomingFieldSources?.fallbackAdvised ?? (existing?.fallbackAdvised !== undefined ? existingFieldSources ? existingFieldSources.fallbackAdvised : quotaFieldSource(existing, field) : undefined) : (field === "scoped" || field === "extraUsage") && value !== undefined ? "poll" : field === "bindingWindow" && existing?.bindingWindowSource === "poll" && existing.bindingWindow !== undefined ? "poll" : incoming[field] !== undefined ? incomingFieldSources?.[field] ?? quotaFieldSource(incoming, field) : existingFieldSources?.[field] ?? quotaFieldSource(existing, field);
-    if (source2)
-      fieldSources2[field] = source2;
-  }
-  return {
-    ...existingWithoutPollOwnedFields,
-    ...incomingWithoutPollOwnedFields,
-    ...Array.isArray(existingScoped) && { scoped: existingScoped },
-    ...existingExtraUsage != null && { extraUsage: existingExtraUsage },
-    fallbackAdvised: incomingFieldSources?.fallbackAdvised !== undefined ? incoming.fallbackAdvised : existing?.fallbackAdvised ?? incoming.fallbackAdvised,
-    bindingWindow: existing?.bindingWindowSource === "poll" ? existing.bindingWindow : incoming.bindingWindow ?? existing?.bindingWindow,
-    bindingWindowSource: existing?.bindingWindowSource === "poll" ? "poll" : incoming.bindingWindowSource ?? existing?.bindingWindowSource,
-    ...Object.keys(fieldSources2).length > 0 && { fieldSources: fieldSources2 },
-    source: "headers"
-  };
-}
 // src/quota-manager.ts
 var nativeSetTimeout = globalThis.setTimeout;
 function pauseOnRealTimer(ms) {
-  return new Promise((resolve13) => {
-    const id2 = nativeSetTimeout(resolve13, ms);
+  return new Promise((resolve14) => {
+    const id2 = nativeSetTimeout(resolve14, ms);
     if (typeof id2 === "object" && "unref" in id2)
       id2.unref();
   });
@@ -28323,7 +28491,7 @@ function recencyOnly(patch) {
   return keys4.length === 1 && keys4[0] === "lastUsed" && typeof patch.lastUsed === "number";
 }
 function waitFor(pending, signal) {
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     const abort = () => {
       cleanup2();
       reject(signal.reason);
@@ -28332,7 +28500,7 @@ function waitFor(pending, signal) {
     signal.addEventListener("abort", abort, { once: true });
     pending.then((value) => {
       cleanup2();
-      signal.aborted ? reject(signal.reason) : resolve13(value);
+      signal.aborted ? reject(signal.reason) : resolve14(value);
     }, (error) => {
       cleanup2();
       reject(error);
@@ -28943,7 +29111,7 @@ class PersistentRelaySession {
       return;
     if (this.connecting)
       return await this.connecting;
-    this.connecting = new Promise((resolve13, reject) => {
+    this.connecting = new Promise((resolve14, reject) => {
       const url = toWebSocketUrl(this.config.url, this.config.token);
       const parsed = new URL(url);
       parsed.searchParams.set("affinity", this.affinity);
@@ -28965,7 +29133,7 @@ class PersistentRelaySession {
           if (message.type === "ready") {
             this.timers.clearTimeout(timeout);
             this.serverState = message.state;
-            resolve13();
+            resolve14();
             return;
           }
           this.handleMessage(message);
@@ -29017,15 +29185,15 @@ class PersistentRelaySession {
     const sentAt = perfNowMs();
     let resolveDone;
     let rejectDone;
-    const done = new Promise((resolve13, reject) => {
-      resolveDone = resolve13;
+    const done = new Promise((resolve14, reject) => {
+      resolveDone = resolve14;
       rejectDone = reject;
     });
-    const response = new Promise((resolve13, reject) => {
+    const response = new Promise((resolve14, reject) => {
       const pending = {
         payload,
         bodyText,
-        resolve: resolve13,
+        resolve: resolve14,
         reject,
         streamDone: false,
         accepted: false,
@@ -30431,7 +30599,7 @@ function createNativeAccountRuntime(options) {
       const { mode, paths: paths2, store: store2 } = await selectedStorage();
       for (let attempt = 0;attempt < 4; attempt++) {
         if (attempt)
-          await new Promise((resolve13) => setTimeout(resolve13, 10));
+          await new Promise((resolve14) => setTimeout(resolve14, 10));
         const settings = await store2.readSettings();
         if (settings.status !== "ready")
           throw new NativeRuntimeError("publication-refused");
@@ -32764,8 +32932,8 @@ async function runNativeCustodyActivation(options, hooks = {}) {
 }
 async function commitMode(paths, routingPath, plan, context) {
   let openGate = () => {};
-  const gate = new Promise((resolve13) => {
-    openGate = resolve13;
+  const gate = new Promise((resolve14) => {
+    openGate = resolve14;
   });
   let leases;
   let scope;
@@ -34467,11 +34635,11 @@ async function refreshForRequest(runtime2, ready) {
         break;
       if (combined.aborted)
         break;
-      await new Promise((resolve13) => {
+      await new Promise((resolve14) => {
         const finish = () => {
           clearTimeout(pause2);
           combined.removeEventListener("abort", finish);
-          resolve13();
+          resolve14();
         };
         const pause2 = setTimeout(finish, 25);
         combined.addEventListener("abort", finish, { once: true });
@@ -34487,16 +34655,16 @@ async function refreshForRequest(runtime2, ready) {
 function waitForRequest(pending, signal) {
   if (!signal)
     return pending;
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     const abort = () => reject(signal.reason);
     signal.addEventListener("abort", abort, { once: true });
-    pending.then(resolve13, reject).finally(() => signal.removeEventListener("abort", abort));
+    pending.then(resolve14, reject).finally(() => signal.removeEventListener("abort", abort));
     if (signal.aborted)
       abort();
   });
 }
 // src/native-vault-connection.ts
-import { dirname as dirname21, join as join22, resolve as resolve14 } from "node:path";
+import { dirname as dirname21, join as join22, resolve as resolve15 } from "node:path";
 // ../../node_modules/@cortexkit/common-auth/dist/opencode2/integration.js
 var PLACEHOLDER_PREFIX = "common-auth-placeholder";
 var PLACEHOLDER_LIFETIME_MS = 365 * 24 * 60 * 60 * 1000;
@@ -34510,7 +34678,7 @@ var MAX_RETRY_HOLD_MS = 20 * 60 * 1000;
 import { createHash as createHash24 } from "node:crypto";
 import { constants as constants4 } from "node:fs";
 import { lstat as lstat16, mkdir as mkdir14, open as open12, unlink as unlink9 } from "node:fs/promises";
-import { dirname as dirname20, resolve as resolve13 } from "node:path";
+import { dirname as dirname20, resolve as resolve14 } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 
 // ../../node_modules/@cortexkit/common-auth/dist/pi-slot/lock.js
@@ -34913,8 +35081,8 @@ function createPiSlot(options, onStep, hooks) {
   if (!provider || !options.authPath || !options.stashPath || !placeholderKey || placeholderKey.startsWith("!") || placeholderKey.includes("$") || !Number.isFinite(timeout) || timeout < 0) {
     throw new PiSlotError("invalid-options");
   }
-  const authPath = resolve13(options.authPath);
-  const stashPath = resolve13(options.stashPath);
+  const authPath = resolve14(options.authPath);
+  const stashPath = resolve14(options.stashPath);
   if (authPath === stashPath || stashPath === `${authPath}.lock`) {
     throw new PiSlotError("invalid-options");
   }
@@ -35052,7 +35220,7 @@ function createPiSlot(options, onStep, hooks) {
 // src/native-vault-connection.ts
 function nativePiAuthSlotPaths(options) {
   return {
-    authPath: resolve14(options.authPath),
+    authPath: resolve15(options.authPath),
     stashPath: join22(dirname21(getHostClaustrumEnrollmentPaths("pi", options.env).tokenPath), "pi-auth-slot", "anthropic.json"),
     provider: "anthropic",
     placeholderKey: placeholderSecret("anthropic")
@@ -35126,7 +35294,7 @@ import { createHash as createHash25 } from "node:crypto";
 import { realpathSync as realpathSync3 } from "node:fs";
 import { mkdir as mkdir15, readdir as readdir4, rm as rm8, stat as stat11, writeFile as writeFile5 } from "node:fs/promises";
 import { tmpdir as tmpdir7 } from "node:os";
-import { join as join23, resolve as resolve15 } from "node:path";
+import { join as join23, resolve as resolve16 } from "node:path";
 var CLAUDE_PRIME_COMMAND_NAME = "claude-prime";
 var PRIME_TICK_MS = 60000;
 var PRIME_DUE_OFFSET_MS = 60000;
@@ -35317,7 +35485,7 @@ function defaultMarkerDir() {
   return join23(tmpdir7(), "opencode-anthropic-auth", "prime");
 }
 function primeStorageFingerprint(storagePath) {
-  const absolutePath = resolve15(storagePath);
+  const absolutePath = resolve16(storagePath);
   let canonicalPath2;
   try {
     canonicalPath2 = realpathSync3(absolutePath);
@@ -36708,7 +36876,7 @@ import { basename as basename13, dirname as dirname24, join as join29 } from "no
 // src/layout-fence.ts
 import { readdir as readdir6, readFile as readFile15 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
-import { basename as basename11, join as join26, resolve as resolve16 } from "node:path";
+import { basename as basename11, join as join26, resolve as resolve17 } from "node:path";
 var STATE_PATH_OVERRIDE_VARIABLES = [
   "OPENCODE_ANTHROPIC_AUTH_FILE",
   "OPENCODE_ANTHROPIC_AUTH_STATE_FILE",
@@ -36795,7 +36963,7 @@ function defaultPreNArtifactLocations(env = process.env, home = homedir5()) {
   const rpcOverride = env.OPENCODE_ANTHROPIC_AUTH_RPC_DIR?.trim();
   return {
     rpcRoots: [join26(root, "rpc")],
-    rpcDirs: rpcOverride ? [resolve16(rpcOverride)] : [],
+    rpcDirs: rpcOverride ? [resolve17(rpcOverride)] : [],
     cacheKeepDirs: [
       ...new Set([
         getDefaultCacheKeepRegistryDirectory("opencode"),
@@ -38904,6 +39072,7 @@ export {
   stickyRouteFamilyForModel,
   stickyRouteCandidateWeight,
   stickyRetryAfterWithJitter,
+  stickyRetainRetryHeaders,
   stickyQuotaSnapshotIsFresh,
   stateSubfolderName,
   stateRefusalPublicMessage,
@@ -38958,6 +39127,7 @@ export {
   requireNoSupervisedAuthContentSnapshot,
   requireAnthropicOAuthOrigin,
   requestGzipPadding,
+  renameWithWindowsSharingRetry,
   remapRequestBodyModel,
   remapModelId,
   releaseNativeMigrationPreflight,
@@ -38968,6 +39138,7 @@ export {
   refreshBackoffActive,
   redactPayload,
   recordProcessStateLayout,
+  readWindowsOwnerOnly,
   readStateLayoutMarker,
   readRelocationPointer,
   readNativeMigrationJournal,
@@ -38986,6 +39157,7 @@ export {
   quotaSnapshotHasStandardWindows,
   quotaSnapshotCheckedAt,
   quotaFieldSource,
+  quotaExhaustionFromHeaders,
   quotaDisplayProjection,
   quotaBackoffActive,
   publishNativeVaultRuntimeSeed,

package/dist/internal-types/claustrum/consumer.d.ts

@@ -50,6 +50,12 @@ export interface ClaustrumConsumerOptions<Q = QuotaObservation> {
      * routine token refresh, which never moves the view.
      */
     onRoster?: (roster: VaultRosterFile) => void;
+    /**
+     * Called once when a coalesced discovery starts, with its completion promise.
+     * Covers explicit refresh, poll, watch and send-triggered discovery, even when
+     * the view does not change. Observe rejection when attaching async work.
+     */
+    onDiscovery?: (promise: Promise<VaultRosterFile | undefined>) => void;
     onError?: (error: unknown) => void;
     /**
      * How often `start()` ticks. A tick lists the vault when no vault watch is
@@ -104,6 +110,8 @@ export interface HubMemberPort {
     keptReceiptState(): KeptReceiptState;
     /** Apply the union of every member's roster in memory to kept receipts. */
     retainUnion(): void;
+    /** Share a committed preference change with live members using this roster file. */
+    publishRoster(roster: VaultRosterFile): void;
     forget(credentialId: string): void;
     /** The member closed: the hub stops committing and pushing to it. */
     detach(): void;
@@ -113,6 +121,8 @@ export interface HubRefreshOutcome {
 }
 /** What the hub may do to one member's memory. Package-internal. */
 export interface HubMemberHooks {
+    /** Observe a hub discovery without relying on member refresh overrides. */
+    discovery(promise: Promise<HubRefreshOutcome | undefined>): void;
     /**
      * Set the roster in memory as a consumer's own refresh does (pending quota
      * readings included) and notify `onRoster` when its view changed.

package/dist/internal-types/claustrum/custody.d.ts

@@ -25,7 +25,8 @@ export interface ClaustrumFamily {
 /** Non-secret classification facts, including rows decoded by older clients. */
 export interface VaultRowFacts {
     readonly credentialId: string;
-    readonly credentialType: string;
+    /** Internal serving type derived from `authMethod`, not the id's type hint. */
+    readonly credentialType: VaultCredentialType;
     readonly authMethod?: string;
     readonly refreshAdapter?: string;
     readonly providerIds?: readonly string[];
@@ -108,7 +109,10 @@ export interface VaultInventory {
     readonly view: string;
     readonly credentials: readonly VaultCredential[];
     readonly skipped: readonly SkippedVaultRecord[];
-    /** Classifying families only: fixed refusal codes, never classifier errors. */
+    /**
+     * Classifying families only: declared policy codes or the fixed library codes
+     * `unknown-auth-method`, `unmapped` and `unclassified`, never classifier errors.
+     */
     readonly refused?: readonly {
         credentialId?: string;
         code: string;

package/dist/internal-types/claustrum/hub.d.ts

@@ -1,5 +1,5 @@
 import type { QuotaObservation } from '../quota/index.js';
-import { type ClaustrumConsumer } from './consumer.js';
+import { type ClaustrumConsumer, type ClaustrumConsumerOptions } from './consumer.js';
 import { type ClassifyingClaustrumFamily, type ClaustrumScopedClient, ClaustrumScopedCustody, type IdentityParser, type KeptReceiptState, type VaultGrantReach } from './custody.js';
 import { type ClaustrumLogger } from './errors.js';
 import { type AccountMapper, type VaultRosterFile } from './roster.js';
@@ -100,6 +100,8 @@ export interface ClaustrumHubMemberOptions<_Q = QuotaObservation> {
     reservedRouteIds?: () => Iterable<string>;
     /** As `ClaustrumConsumerOptions.onRoster`: once per change of view. */
     onRoster?: (roster: VaultRosterFile) => void;
+    /** Observe every hub discovery's member result, including background work. */
+    onDiscovery?: ClaustrumConsumerOptions<_Q>['onDiscovery'];
     /** This member's own failures, such as a roster commit that failed. */
     onError?: (error: unknown) => void;
     logger?: ClaustrumLogger;

package/dist/internal-types/fs/refresh-file-lock.d.ts

@@ -21,7 +21,8 @@ export interface LockLoss {
 export interface RefreshFileLock {
     readonly ownerId: string;
     assertOwned(): Promise<void>;
-    release(): Promise<void>;
+    /** Abort stops release retries; the unrenewed lease is left to expire by TTL. */
+    release(signal?: AbortSignal): Promise<void>;
     /** Resolves once on detected loss; remains pending after an owner's release. */
     whenLost(): Promise<LockLoss>;
     hasLost(): boolean;

package/dist/quota-headers.d.ts

@@ -1,4 +1,6 @@
 import type { OAuthQuotaSnapshot } from './accounts.ts';
 export declare function isQuotaBearingHeaderFrame(headers: Headers): boolean;
+/** Only a rejected status or raw utilization at least one confirms a 429's limit. */
+export declare function quotaExhaustionFromHeaders(headers: Headers, modelId?: string, now?: number): OAuthQuotaSnapshot;
 export declare function normalizeQuotaHeaders(headers: Headers, now?: number): OAuthQuotaSnapshot;
 export declare function mergeHeaderQuotaSnapshot(existing: OAuthQuotaSnapshot | undefined, incoming: OAuthQuotaSnapshot): OAuthQuotaSnapshot;

package/dist/sticky-routing.d.ts

@@ -90,9 +90,12 @@ export declare function stickyRouteCandidateWeight(input: {
 export declare function stickyRouteKnownFableExhausted(candidate: StickyRouteCandidate, storage: AccountStorage | null, now?: number): boolean;
 export declare function decideStickyQuotaFailure(input: {
     quota: OAuthQuotaSnapshot | QuotaState | undefined;
+    responseHeaders?: Headers;
     modelId?: string;
     now?: number;
 }): StickyQuotaFailureDecision;
+/** Bound an unconfirmed 429's host retry while preserving any shorter upstream wait. */
+export declare function stickyRetainRetryHeaders(upstream: Headers, now?: number): Headers;
 export declare function getStickyRoutingStatePath(accountStoragePath: string): string;
 export declare function stickyRetryAfterWithJitter(sessionId: string, retryAfterSeconds: number): number;
 export declare class StickySessionRouter {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "2.4.4",
+  "version": "2.4.6",
   "type": "module",
   "repository": {
     "type": "git",
@@ -30,7 +30,7 @@
     "prepublishOnly": "bun run build"
   },
   "devDependencies": {
-    "@cortexkit/common-auth": "0.29.0"
+    "@cortexkit/common-auth": "0.31.0"
   },
   "dependencies": {
     "@cortexkit/claustrum-client": "0.13.0",