@cortexkit/anthropic-auth-core 2.4.6 → 2.4.8

package/dist/accounts.d.ts

@@ -400,6 +400,12 @@ export declare function getScopedQuotaWindowForModel(quota: OAuthQuotaSnapshot |
 export declare function quotaSnapshotModelScopeIsExhausted(quota: OAuthQuotaSnapshot | undefined, model: unknown): boolean;
 export declare function quotaSnapshotPassesModelScope(quota: OAuthQuotaSnapshot | undefined, model: unknown): boolean;
 export declare function quotaSnapshotPassesPolicy(quota: OAuthQuotaSnapshot | undefined, storage: AccountStorage | null): boolean;
+/** A poll's omitted session window is evidence, unlike a partial header harvest. */
+export declare function quotaSnapshotOmitsFiveHour(quota: OAuthQuotaSnapshot | undefined): quota is OAuthQuotaSnapshot & {
+    checkedAt: number;
+    five_hour?: undefined;
+    seven_day: AccountQuotaWindow;
+};
 export declare function quotaSnapshotHasStandardWindows(quota: OAuthQuotaSnapshot | undefined): quota is OAuthQuotaSnapshot;
 export declare const DEFAULT_KILLSWITCH_THRESHOLDS: Record<QuotaWindowName | 'scoped', number>;
 export declare function normalizeKillswitchThresholds(thresholds: KillswitchThresholds | undefined): Record<QuotaWindowName | 'scoped', number>;

package/dist/index.d.ts

@@ -25,7 +25,7 @@ export { CLAUDE_CODE_DEFAULT_BETAS, CLAUDE_MODEL_CAPABILITIES, getClaudeModelCap
 export * from './model-remap.ts';
 export * from './models.ts';
 export * from './native-account-refusal.ts';
-export type { NativeAccountRuntime, NativeAccountRuntimeOptions, NativeAccountWriteInput, NativeApiSubject, NativeLocalAuthorizeOptions, NativeRelayUpdate, } from './native-account-runtime.ts';
+export type { NativeAccountPolicy, NativeAccountRuntime, NativeAccountRuntimeOptions, NativeAccountWriteInput, NativeApiSubject, NativeLocalAuthorizeOptions, NativeQuotaPolicyLimit, NativeRelayUpdate, } from './native-account-runtime.ts';
 export { acquireNativeAccountRuntime, createNativeAccountRuntime, nativeAccountPolicy, } from './native-account-runtime.ts';
 export type { NativeAccountMetadataPatch, NativeAccountSnapshot, NativeAccountView, } from './native-account-view.ts';
 export { formatNativeAccountState, nativeAccountCanServe, } from './native-account-view.ts';
@@ -62,6 +62,7 @@ export * from './native-usage-publication.ts';
 export { NATIVE_VAULT_NO_ACCOUNT_MESSAGE, NativeVaultNoAccountError, readNativeAccountsForRequest, } from './native-vault-admission.ts';
 export type { NativePiAuthSlot, NativePiAuthSlotErrorCode, NativePiAuthSlotInspection, NativePiAuthSlotOptions, NativeVaultDisconnectOptions, NativeVaultDisconnectResult, } from './native-vault-connection.ts';
 export { disconnectNativeVaultForHost, NativePiAuthSlotError, nativePiAuthSlotPaths, openNativePiAuthSlot, } from './native-vault-connection.ts';
+export { createNativeVaultNoRouteResponse, NativeVaultQuotaPolicyError, } from './native-vault-refusal.ts';
 export type { NativeVaultQuotaPurpose, NativeVaultRuntime, NativeVaultRuntimeOptions, NativeVaultWatch, NativeVaultWatchOptions, } from './native-vault-runtime.ts';
 export { acquireNativeVaultRuntime, createNativeVaultRuntime, discoverNativeVaultInventory, publishNativeVaultRosterSeed, publishNativeVaultRuntimeSeed, } from './native-vault-runtime.ts';
 export * from './oauth-origin.ts';

package/dist/index.js

@@ -4509,6 +4509,8 @@ function mergeHeaderOwnedWindow(existingSnapshot, incomingSnapshot, key) {
   const incoming = incomingSnapshot[key];
   if (!incoming)
     return existing;
+  if (key === "five_hour" && quotaSnapshotOmitsFiveHour(existingSnapshot) && incoming.checkedAt <= (existingSnapshot.checkedAt ?? 0))
+    return;
   if (!existing)
     return incoming;
   if (incoming.checkedAt > existing.checkedAt)
@@ -4545,6 +4547,8 @@ function fieldSourcesForMergedQuota(existing, incoming, merged) {
     if (source)
       fieldSources[field] = source;
   }
+  if (!merged.five_hour && quotaSnapshotOmitsFiveHour(existing))
+    fieldSources.five_hour = "poll";
   return Object.keys(fieldSources).length > 0 ? fieldSources : undefined;
 }
 function mergeHeaderQuotaForPersistence(existing, incoming) {
@@ -4560,7 +4564,10 @@ function mergeHeaderQuotaForPersistence(existing, incoming) {
     extraUsage: existing.extraUsage ?? incoming.extraUsage,
     fallbackAdvised: incoming.fieldSources?.fallbackAdvised !== undefined ? incoming.fallbackAdvised : existing.fallbackAdvised ?? incoming.fallbackAdvised,
     bindingWindow: preservePollBinding ? existing.bindingWindow : incoming.bindingWindow ?? existing.bindingWindow,
-    bindingWindowSource: preservePollBinding ? "poll" : incoming.bindingWindowSource ?? existing.bindingWindowSource
+    bindingWindowSource: preservePollBinding ? "poll" : incoming.bindingWindowSource ?? existing.bindingWindowSource,
+    ...quotaSnapshotOmitsFiveHour(existing) && {
+      checkedAt: existing.checkedAt
+    }
   };
   const fieldSources = fieldSourcesForMergedQuota(existing, incoming, merged);
   return {
@@ -4993,20 +5000,25 @@ function quotaSnapshotPassesPolicy(quota, storage) {
   if (!quotaEnabled(storage))
     return true;
   const thresholds = getQuotaMinimumRemainingThresholds(storage);
+  let sawUnknownWindow = false;
   for (const key of ["five_hour", "seven_day"]) {
+    if (key === "five_hour" && quotaSnapshotOmitsFiveHour(quota))
+      continue;
     const window = quota?.[key];
-    if (!window)
-      return !failClosedOnUnknownQuota(storage);
-    if (!Number.isFinite(window.remainingPercent)) {
-      return !failClosedOnUnknownQuota(storage);
+    if (!window || !Number.isFinite(window.remainingPercent)) {
+      sawUnknownWindow = true;
+      continue;
     }
     if (window.remainingPercent < thresholds[key])
       return false;
   }
-  return true;
+  return !sawUnknownWindow || !failClosedOnUnknownQuota(storage);
+}
+function quotaSnapshotOmitsFiveHour(quota) {
+  return Boolean((quota?.source === "poll" || quota?.fieldSources?.five_hour === "poll") && quota && !quota.five_hour && quota.seven_day && Number.isFinite(quota.checkedAt) && (quota.checkedAt ?? 0) > 0);
 }
 function quotaSnapshotHasStandardWindows(quota) {
-  return Boolean(quota?.five_hour && quota.seven_day);
+  return Boolean(quota?.seven_day && (quota.five_hour || quotaSnapshotOmitsFiveHour(quota)));
 }
 var DEFAULT_KILLSWITCH_THRESHOLDS = {
   five_hour: 5,
@@ -5040,6 +5052,8 @@ function killswitchPassesPolicy(quota, storage, accountId, modelId) {
   const thresholds = getKillswitchThresholdsForAccount(storage, accountId);
   let sawUnknownWindow = false;
   for (const key of ["five_hour", "seven_day"]) {
+    if (key === "five_hour" && quotaSnapshotOmitsFiveHour(quota))
+      continue;
     const window = quota?.[key];
     if (!window || !Number.isFinite(window.remainingPercent)) {
       if (thresholds[key] > 0)
@@ -5106,6 +5120,8 @@ function getQuotaNextRefreshAt(quota, storage, now) {
   const thresholds = getQuotaMinimumRemainingThresholds(storage);
   const blockedResetTimes = [];
   for (const key of ["five_hour", "seven_day"]) {
+    if (key === "five_hour" && quotaSnapshotOmitsFiveHour(quota))
+      continue;
     const window = quota?.[key];
     if (!window)
       return capAtOldestWindow(now + intervalMs);
@@ -7539,6 +7555,8 @@ class InsulaQuotaSource {
           ...typeof entry.source === "string" && { source: entry.source }
         }
       };
+      if (entry.stale !== undefined && (!record(entry.stale) || entry.stale.class !== "local_source_unavailable"))
+        return { miss: "upstream-failed", reading };
       return now >= fetchedAt + MAX_AGE || entry.stale !== undefined ? { miss: "stale", reading } : { reading };
     }
     if (this.#completeProviders.has(provider))
@@ -7882,6 +7900,7 @@ function combineAbortSignals(signals) {
 }
 
 // ../../node_modules/@cortexkit/common-auth/dist/claustrum/custody.js
+import { channel } from "node:diagnostics_channel";
 import { ClaustrumCredentialError as ClaustrumCredentialError3 } from "@cortexkit/claustrum-client";
 
 // ../../node_modules/@cortexkit/common-auth/dist/claustrum/host-slot.js
@@ -7941,6 +7960,7 @@ function scopedRetryReason(served, current) {
   return "rotated";
 }
 var defaultLogger = createLogger("claustrum");
+var phaseDiagnostics = channel("common-auth.claustrum.phases");
 function decideScopedRetryAfter401(site, served, current, logger2 = defaultLogger) {
   const retry = isScopedCredentialRotation(served, current);
   logger2.debug("scoped 401 re-authorized", {
@@ -8140,6 +8160,11 @@ class ClaustrumScopedCustody {
   }
   async#token(signal) {
     this.#check(signal);
+    if (phaseDiagnostics.hasSubscribers)
+      phaseDiagnostics.publish({
+        logger: this.#logger,
+        phase: "token read begin"
+      });
     const pending = this.#readToken();
     this.#tokenReads.add(pending);
     let value;
@@ -8147,6 +8172,11 @@ class ClaustrumScopedCustody {
       value = await pending;
     } finally {
       this.#tokenReads.delete(pending);
+      if (phaseDiagnostics.hasSubscribers)
+        phaseDiagnostics.publish({
+          logger: this.#logger,
+          phase: "token read end"
+        });
     }
     this.#check(signal);
     if (!/^[0-9a-f]{64}$/.test(value.token) || !Number.isSafeInteger(value.token_generation) || value.token_generation < 1) {
@@ -8202,11 +8232,22 @@ class ClaustrumScopedCustody {
       this.#kept.clear();
       throw error;
     }
+    if (phaseDiagnostics.hasSubscribers)
+      phaseDiagnostics.publish({
+        logger: this.#logger,
+        phase: "list scoped begin"
+      });
     try {
       inventory = await this.#call(() => this.#client.listScoped(token), signal);
     } catch (error) {
       this.listFailed(error);
       throw error;
+    } finally {
+      if (phaseDiagnostics.hasSubscribers)
+        phaseDiagnostics.publish({
+          logger: this.#logger,
+          phase: "list scoped end"
+        });
     }
     const skipped = [];
     const refused = [];
@@ -10477,6 +10518,7 @@ class ClaustrumConsumer {
 }
 // ../../node_modules/@cortexkit/common-auth/dist/claustrum/hub.js
 import { createHash as createHash6 } from "node:crypto";
+import { channel as channel2 } from "node:diagnostics_channel";
 import { readdir as readdir2, stat as stat7 } from "node:fs/promises";
 import { dirname as dirname8, join as join10, resolve as resolve9 } from "node:path";
 var sharedRosters = new Map;
@@ -11074,7 +11116,24 @@ class ClaustrumDiscoveryHub {
         throw closed("Claustrum hub member has no base view");
       if (base instanceof Error)
         throw base;
-      const seed = base.file ? undefined : await this.#seed(entry);
+      let seed;
+      if (!base.file) {
+        const phaseDiagnostics2 = channel2("common-auth.claustrum.phases");
+        if (phaseDiagnostics2.hasSubscribers)
+          phaseDiagnostics2.publish({
+            logger: this.#logger,
+            phase: `seed read ${entry.provider} begin`
+          });
+        try {
+          seed = await this.#seed(entry);
+        } finally {
+          if (phaseDiagnostics2.hasSubscribers)
+            phaseDiagnostics2.publish({
+              logger: this.#logger,
+              phase: `seed read ${entry.provider} end`
+            });
+        }
+      }
       const roster = await refreshVaultRoster({
         path: entry.path,
         custody: { discover: async () => share },
@@ -18792,6 +18851,13 @@ var nativeQuotaCodec = {
       return toNativeQuotaMap(mergeHeaderQuotaForPersistence(previous, incoming));
     const previousTime = quotaSnapshotCheckedAt(previous);
     const incomingTime = quotaSnapshotCheckedAt(incoming);
+    if (incoming.source === "poll" && incoming.checkedAt !== undefined && previous.checkedAt !== undefined && (previous.source === "poll" || quotaSnapshotOmitsFiveHour(previous)) && incoming.checkedAt < previous.checkedAt)
+      return toNativeQuotaMap(previous);
+    if (incoming.source === "poll" && incoming.seven_day && !incoming.five_hour && incoming.checkedAt !== undefined && incoming.checkedAt > (previous.five_hour?.checkedAt ?? 0) && (previous.source !== "poll" || incoming.checkedAt >= (previous.checkedAt ?? 0)))
+      return toNativeQuotaMap(previous.source === "headers" ? mergeHeaderQuotaForPersistence(incoming, {
+        ...previous,
+        five_hour: undefined
+      }) : incoming);
     return toNativeQuotaMap(previousTime > incomingTime || previousTime === incomingTime && previous.source === "poll" && incoming.source !== "poll" ? previous : incoming);
   }
 };
@@ -20504,6 +20570,12 @@ function normalizeQuotaHeaders(headers, now = Date.now()) {
   };
 }
 function mergeHeaderQuotaSnapshot(existing, incoming) {
+  if (quotaSnapshotOmitsFiveHour(existing) && incoming.five_hour && incoming.five_hour.checkedAt <= existing.checkedAt) {
+    return mergeHeaderQuotaSnapshot(existing, {
+      ...incoming,
+      five_hour: undefined
+    });
+  }
   const {
     scoped: existingScoped,
     extraUsage: existingExtraUsage,
@@ -20525,6 +20597,8 @@ function mergeHeaderQuotaSnapshot(existing, incoming) {
     if (source2)
       fieldSources2[field] = source2;
   }
+  if (quotaSnapshotOmitsFiveHour(existing) && !incoming.five_hour)
+    fieldSources2.five_hour = "poll";
   return {
     ...existingWithoutPollOwnedFields,
     ...incomingWithoutPollOwnedFields,
@@ -20534,7 +20608,10 @@ function mergeHeaderQuotaSnapshot(existing, incoming) {
     bindingWindow: existing?.bindingWindowSource === "poll" ? existing.bindingWindow : incoming.bindingWindow ?? existing?.bindingWindow,
     bindingWindowSource: existing?.bindingWindowSource === "poll" ? "poll" : incoming.bindingWindowSource ?? existing?.bindingWindowSource,
     ...Object.keys(fieldSources2).length > 0 && { fieldSources: fieldSources2 },
-    source: "headers"
+    source: "headers",
+    ...quotaSnapshotOmitsFiveHour(existing) && {
+      checkedAt: existing.checkedAt
+    }
   };
 }
 
@@ -20575,7 +20652,8 @@ function createStickyNoRouteResponse(input) {
   const retryAfter = killswitchRetryAfterSeconds(firstQuota, remainingQuotas.map((quota2) => ({ quota: quota2 })), input.now ?? Date.now(), scopedBlocked ? modelId : undefined);
   const minutes = Math.floor(retryAfter / 60);
   const seconds = retryAfter % 60;
-  const reason = scopedBlocked && modelName ? `${modelName} weekly limit reached, no routable OAuth accounts.` : "No OAuth account currently satisfies sticky-balanced quota policy.";
+  const limitNames = input.vaultPolicyLimits?.map((limit) => limit === "model-scoped" ? `${modelName ?? "Model"} scoped limit` : limit === "killswitch" ? "killswitch limit" : "quota floor");
+  const reason = limitNames ? `No vault account currently satisfies quota policy: ${limitNames.join(", ")}. Open /claude → Killswitch / Quota to change these limits.` : scopedBlocked && modelName ? `${modelName} weekly limit reached, no routable OAuth accounts.` : "No OAuth account currently satisfies sticky-balanced quota policy.";
   const message = `${reason} Retry in ${minutes}m ${seconds}s.`;
   return new Response(JSON.stringify({
     type: "error",
@@ -20686,6 +20764,8 @@ function sessionKey(sessionId) {
 function stickyQuotaSnapshotIsFresh(quota2, storage, now = Date.now(), modelId) {
   const maxAge = getQuotaCheckIntervalMs(storage);
   const standardFresh = ["five_hour", "seven_day"].every((key) => {
+    if (key === "five_hour" && quotaSnapshotOmitsFiveHour(quota2))
+      return true;
     const window2 = quota2?.[key];
     return Boolean(window2 && now - window2.checkedAt < maxAge);
   });
@@ -20740,14 +20820,23 @@ function stickyRouteCandidateWeight(input) {
   }
   const weights = [];
   for (const key of ["five_hour", "seven_day"]) {
+    if (key === "five_hour" && quotaSnapshotOmitsFiveHour(quota2))
+      continue;
     const window2 = quota2[key];
     if (!window2 || !Number.isFinite(window2.remainingPercent))
       return 0;
-    weights.push(sustainableWindowWeight(window2.remainingPercent, remainingThreshold(storage, candidate.accountId, key), window2.resetsAt, now));
+    const threshold = remainingThreshold(storage, candidate.accountId, key);
+    if (window2.remainingPercent <= threshold) {
+      const quotaThreshold = getQuotaMinimumRemainingThresholds(storage)[key];
+      input.onPolicyBlock?.(isKillswitchEnabled(storage) && threshold > quotaThreshold ? "killswitch" : "quota-floor");
+    }
+    weights.push(sustainableWindowWeight(window2.remainingPercent, threshold, window2.resetsAt, now));
   }
   if (input.family === "fable") {
     const window2 = getScopedQuotaWindowForModel(quota2, input.modelId);
     if (window2 && Number.isFinite(window2.remainingPercent)) {
+      if (window2.remainingPercent <= remainingThreshold(storage, candidate.accountId, "scoped"))
+        input.onPolicyBlock?.("model-scoped");
       weights.push(sustainableWindowWeight(window2.remainingPercent, remainingThreshold(storage, candidate.accountId, "scoped"), window2.resetsAt, now));
     }
   }
@@ -26271,18 +26360,18 @@ function classifySafeErrorForLog(error) {
   } catch {}
   return { name, code };
 }
-function logPublicationFailure(channel, error) {
+function logPublicationFailure(channel3, error) {
   let level = "warn";
   try {
     if (usagePublicationRefusalIsFatal(error))
       level = "error";
   } catch {}
-  logger[level](channel, "Account usage publication unavailable", classifySafeErrorForLog(error));
+  logger[level](channel3, "Account usage publication unavailable", classifySafeErrorForLog(error));
 }
-function createNativeUsagePublisher(channel) {
+function createNativeUsagePublisher(channel3) {
   const pending = new Set;
   const observe2 = (write) => {
-    const work = write.then(() => {}, (error) => logPublicationFailure(channel, error));
+    const work = write.then(() => {}, (error) => logPublicationFailure(channel3, error));
     pending.add(work);
     work.then(() => pending.delete(work), () => pending.delete(work));
     return work;
@@ -26565,19 +26654,19 @@ function normalizeInsulaClaudeQuota(entry2, context) {
     kind: "weekly",
     minutes: 10080
   });
-  if (!five_hour || !seven_day)
+  if (!seven_day || usage?.primary != null && !five_hour)
     return;
   const scoped = scopedReadings(usage?.extraRateWindows, checkedAt);
   const extraUsage2 = extraUsageReading(entry2.pools ?? usage?.pools);
   return {
-    five_hour,
+    ...five_hour && { five_hour },
     seven_day,
     scoped,
     ...extraUsage2 && { extraUsage: extraUsage2 },
     source: "poll",
     checkedAt,
     fieldSources: {
-      five_hour: "poll",
+      ...five_hour && { five_hour: "poll" },
       seven_day: "poll",
       scoped: "poll",
       ...extraUsage2 && { extraUsage: "poll" }
@@ -26594,7 +26683,7 @@ function newer(reading2, stored) {
 function mergeInsulaQuota(reading2, stored) {
   if (!stored || quotaSnapshotCheckedAt(stored) <= reading2.checkedAt)
     return reading2;
-  const five_hour = newer(reading2.five_hour, stored.five_hour);
+  const five_hour = quotaSnapshotOmitsFiveHour(stored) ? undefined : !reading2.five_hour && (stored.five_hour?.checkedAt ?? 0) <= reading2.checkedAt ? undefined : newer(reading2.five_hour, stored.five_hour);
   const seven_day = newer(reading2.seven_day, stored.seven_day);
   const scoped = new Map(reading2.scoped.map((window2) => [window2.id, window2]));
   for (const window2 of stored.scoped ?? []) {
@@ -26609,10 +26698,10 @@ function mergeInsulaQuota(reading2, stored) {
     fieldSources2.seven_day = stored.fieldSources.seven_day;
   return {
     ...reading2,
-    ...five_hour && { five_hour },
+    five_hour,
     ...seven_day && { seven_day },
     scoped: [...scoped.values()],
-    checkedAt: Math.max(reading2.checkedAt, quotaSnapshotCheckedAt(stored)),
+    checkedAt: quotaSnapshotOmitsFiveHour(stored) ? stored.checkedAt : quotaSnapshotOmitsFiveHour(reading2) ? reading2.checkedAt : Math.max(reading2.checkedAt, quotaSnapshotCheckedAt(stored)),
     fieldSources: fieldSources2
   };
 }
@@ -26898,9 +26987,11 @@ function pauseOnRealTimer(ms) {
 class QuotaRefreshDeferred extends Error {
 }
 function mergePollCompletionWithNewerHeaders(current, polled) {
+  if (quotaSnapshotOmitsFiveHour(current) && (polled.checkedAt ?? quotaSnapshotCheckedAt(polled)) < current.checkedAt)
+    return current;
   if (current?.source !== "headers")
     return polled;
-  const fiveHourIsNewer = Boolean(current.five_hour && current.five_hour.checkedAt > (polled.five_hour?.checkedAt ?? 0));
+  const fiveHourIsNewer = Boolean(current.five_hour && current.five_hour.checkedAt > (polled.five_hour?.checkedAt ?? polled.checkedAt ?? 0));
   const sevenDayIsNewer = Boolean(current.seven_day && current.seven_day.checkedAt > (polled.seven_day?.checkedAt ?? 0));
   if (!fiveHourIsNewer && !sevenDayIsNewer)
     return polled;
@@ -30239,8 +30330,15 @@ function acquireNativeAccountRuntime(options) {
 function nativeAccountPolicy(account, snapshot, modelId) {
   if (!nativeAccountCanServe(account))
     return { status: "blocked", reason: "account-disabled" };
-  if (!quotaSnapshotPassesPolicy(account.quota, snapshot.policyStorage) || !quotaSnapshotPassesModelScope(account.quota, modelId) || !killswitchPassesPolicy(account.quota, snapshot.policyStorage, account.id === "main" ? undefined : account.id, modelId))
-    return { status: "blocked", reason: "quota-ineligible" };
+  const quotaPolicyLimits = [];
+  if (!quotaSnapshotPassesPolicy(account.quota, snapshot.policyStorage))
+    quotaPolicyLimits.push("quota-floor");
+  if (!quotaSnapshotPassesModelScope(account.quota, modelId))
+    quotaPolicyLimits.push("model-scoped");
+  if (!killswitchPassesPolicy(account.quota, snapshot.policyStorage, account.id === "main" ? undefined : account.id, modelId))
+    quotaPolicyLimits.push("killswitch");
+  if (quotaPolicyLimits.length)
+    return { status: "blocked", reason: "quota-ineligible", quotaPolicyLimits };
   return { status: "allowed" };
 }
 function createNativeAccountRuntime(options) {
@@ -35238,6 +35336,60 @@ async function disconnectNativeVaultForHost(options) {
     closeNativeVaultAuthority(paths.tokenPath);
   return result;
 }
+// src/native-vault-refusal.ts
+function createNativeVaultNoRouteResponse(input) {
+  const { snapshot, modelId } = input;
+  const accounts = snapshot.accounts.filter((account) => account.type === "oauth");
+  if (accounts.some((account) => account.enabled && account.state === "needs_reauth"))
+    throw new NativeVaultNoAccountError;
+  const active2 = accounts.filter(nativeAccountCanServe);
+  const limits = new Set;
+  for (const account of active2) {
+    const policy = input.policies?.get(account.id) ?? nativeAccountPolicy(account, snapshot, modelId);
+    for (const limit of policy.quotaPolicyLimits ?? [])
+      limits.add(limit);
+    if (input.sticky) {
+      stickyRouteCandidateWeight({
+        candidate: {
+          accountId: account.id,
+          order: 0,
+          quota: account.quota ?? { kind: "unknown" }
+        },
+        family: stickyRouteFamilyForModel(modelId),
+        modelId,
+        storage: snapshot.policyStorage,
+        onPolicyBlock: (limit) => limits.add(limit)
+      });
+    }
+  }
+  if (!limits.size)
+    throw new NativeVaultNoAccountError;
+  return createStickyNoRouteResponse({
+    routeQuotas: active2.flatMap((account) => account.quota ? [account.quota] : []),
+    modelId,
+    vaultPolicyLimits: [...limits]
+  });
+}
+
+class NativeVaultQuotaPolicyError extends Error {
+  response;
+  body;
+  kind = "quota-policy";
+  status = 429;
+  headers;
+  retryAfter;
+  constructor(response, body) {
+    super(body.error.message);
+    this.response = response;
+    this.body = body;
+    this.name = "NativeVaultQuotaPolicyError";
+    this.headers = new Headers(response.headers);
+    this.retryAfter = Number(this.headers.get("retry-after"));
+  }
+  static async fromResponse(response) {
+    return new NativeVaultQuotaPolicyError(response, await response.clone().json());
+  }
+}
 // src/oauth-origin.ts
 var ANTHROPIC_OAUTH_ORIGIN = "https://api.anthropic.com";
 var ANTHROPIC_OAUTH_ORIGIN_REFUSAL = "Claude OAuth requests can only go to https://api.anthropic.com. A provider baseURL that points elsewhere is not used for Claude sign-in accounts.";
@@ -35687,6 +35839,12 @@ class PrimeManager {
         });
         return;
       }
+      if (quotaSnapshotOmitsFiveHour(evaluation.storedQuota)) {
+        logger.debug("prime", "no five-hour limit", {
+          account: evaluation.label
+        });
+        return;
+      }
       const storedResetEpoch = storedResetMs(evaluation.storedFiveHour);
       if (storedResetEpoch !== undefined && now < storedResetEpoch + PRIME_DUE_OFFSET_MS) {
         logger.trace("prime", "not due", { account: evaluation.label });
@@ -35744,6 +35902,12 @@ class PrimeManager {
         });
         return;
       }
+      if (quotaSnapshotOmitsFiveHour(fresh)) {
+        logger.debug("prime", "no five-hour limit", {
+          account: evaluation.label
+        });
+        return;
+      }
       if (!killswitchPassesPolicy(fresh, reloaded, evaluation.id, CLAUDE_HAIKU_4_5_MODEL_ID)) {
         logger.debug("prime", "ineligible", {
           account: evaluation.label,
@@ -39153,6 +39317,7 @@ export {
   quotaTextParts,
   quotaSnapshotPassesPolicy,
   quotaSnapshotPassesModelScope,
+  quotaSnapshotOmitsFiveHour,
   quotaSnapshotModelScopeIsExhausted,
   quotaSnapshotHasStandardWindows,
   quotaSnapshotCheckedAt,
@@ -39389,6 +39554,7 @@ export {
   createProviderErrorRedactor,
   createProcessFence,
   createNativeVaultRuntime,
+  createNativeVaultNoRouteResponse,
   createNativeUsagePublisher,
   createNativeUi,
   createNativePoolStore,
@@ -39501,6 +39667,7 @@ export {
   PARAGRAPH_REMOVAL_ANCHORS,
   OPENCODE_IDENTITY_PREFIX,
   OAUTH_SCOPES,
+  NativeVaultQuotaPolicyError,
   NativeVaultNoAccountError,
   NativeTransientAccountError,
   NativeRuntimeError,

package/dist/insula-quota.d.ts

@@ -2,7 +2,6 @@ import type { InsulaQuotaContext, InsulaUsageEntry } from "./internal-types/clau
 import { type AccountQuotaWindow, type AccountScopedQuotaWindow, type OAuthQuotaSnapshot } from './accounts.ts';
 /** An insula reading in the shape our usage poll produces, before the account identity is attached. */
 export type InsulaClaudeQuota = OAuthQuotaSnapshot & {
-    five_hour: AccountQuotaWindow;
     seven_day: AccountQuotaWindow;
     scoped: AccountScopedQuotaWindow[];
     checkedAt: number;
@@ -10,8 +9,8 @@ export type InsulaClaudeQuota = OAuthQuotaSnapshot & {
 /**
  * Convert insula's Claude entry into our usage-poll snapshot. Every window's
  * checkedAt is when insula fetched the reading, never when we read its cache,
- * so a newer header or poll reading still wins. Both standard windows must be
- * present; otherwise this returns undefined and our own poll stays in charge.
+ * so a newer header or poll reading still wins. The weekly window is required;
+ * an absent primary slot means the five-hour limit does not apply.
  * The tertiary slot (legacy seven_day_opus/sonnet) is not a window we model.
  */
 export declare function normalizeInsulaClaudeQuota(entry: InsulaUsageEntry, context: InsulaQuotaContext): InsulaClaudeQuota | undefined;

package/dist/native-account-runtime.d.ts

@@ -127,8 +127,12 @@ export interface NativeAccountRuntime {
 }
 /** Host instances own leases, while stores and the vault connection live until the last release. */
 export declare function acquireNativeAccountRuntime(options: NativeAccountRuntimeOptions): NativeAccountRuntime;
+export type NativeQuotaPolicyLimit = 'quota-floor' | 'killswitch' | 'model-scoped';
+export type NativeAccountPolicy = NativeLocalExternalPolicy & {
+    quotaPolicyLimits?: readonly NativeQuotaPolicyLimit[];
+};
 /** Evaluate quota and killswitch policy for this caller's model, outside shared credential refresh work. */
-export declare function nativeAccountPolicy(account: NativeAccountView, snapshot: NativeAccountSnapshot, modelId?: string): NativeLocalExternalPolicy;
+export declare function nativeAccountPolicy(account: NativeAccountView, snapshot: NativeAccountSnapshot, modelId?: string): NativeAccountPolicy;
 /** The local migration journal records completed transfer from host credentials and sidecars to the credential pool. Local use refuses without that record. Host vault enrollment instead selects independent settings and metadata, leaving local credentials, journal and metadata untouched. */
 export declare function createNativeAccountRuntime(options: NativeAccountRuntimeOptions): NativeAccountRuntime;
 export declare function primeDelta(delta: PrimeUsageDelta): {

package/dist/native-vault-refusal.d.ts

@@ -0,0 +1,28 @@
+import { type NativeAccountPolicy } from './native-account-runtime.ts';
+import { type NativeAccountSnapshot } from './native-account-view.ts';
+/** Preserve authentication precedence, then explain the shared policy's exclusions. */
+export declare function createNativeVaultNoRouteResponse(input: {
+    snapshot: NativeAccountSnapshot;
+    modelId?: string;
+    policies?: ReadonlyMap<string, NativeAccountPolicy>;
+    sticky?: boolean;
+}): Response;
+type QuotaPolicyBody = {
+    type: 'error';
+    error: {
+        type: 'rate_limit_error';
+        message: string;
+    };
+};
+/** OpenCode 2 selection refuses before sending; its chooser cannot return a Response. */
+export declare class NativeVaultQuotaPolicyError extends Error {
+    readonly response: Response;
+    readonly body: QuotaPolicyBody;
+    readonly kind = "quota-policy";
+    readonly status = 429;
+    readonly headers: Headers;
+    readonly retryAfter: number;
+    private constructor();
+    static fromResponse(response: Response): Promise<NativeVaultQuotaPolicyError>;
+}
+export {};

package/dist/sticky-routing.d.ts

@@ -1,4 +1,5 @@
 import { type AccountOperationError, type AccountStorage, type OAuthQuotaSnapshot } from './accounts.ts';
+import type { NativeQuotaPolicyLimit } from './native-account-runtime.ts';
 import { type NativeLockEvent } from './native-lock-observer.ts';
 import type { NativeVaultRosterDocument } from './native-roster-seed.ts';
 import { type NativeVaultRoutingSeed } from './native-vault-seed.ts';
@@ -60,6 +61,7 @@ export declare function createStickyNoRouteResponse(input: {
     mainRefreshError?: AccountOperationError;
     fallbackReauthLabels?: readonly string[];
     routeQuotas: readonly OAuthQuotaSnapshot[];
+    vaultPolicyLimits?: readonly NativeQuotaPolicyLimit[];
     modelId?: string;
     now?: number;
 }): Response;
@@ -86,6 +88,7 @@ export declare function stickyRouteCandidateWeight(input: {
     modelId?: string;
     storage: AccountStorage | null;
     now?: number;
+    onPolicyBlock?: (limit: NativeQuotaPolicyLimit) => void;
 }): number;
 export declare function stickyRouteKnownFableExhausted(candidate: StickyRouteCandidate, storage: AccountStorage | null, now?: number): boolean;
 export declare function decideStickyQuotaFailure(input: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "2.4.6",
+  "version": "2.4.8",
   "type": "module",
   "repository": {
     "type": "git",
@@ -30,7 +30,7 @@
     "prepublishOnly": "bun run build"
   },
   "devDependencies": {
-    "@cortexkit/common-auth": "0.31.0"
+    "@cortexkit/common-auth": "0.32.1"
   },
   "dependencies": {
     "@cortexkit/claustrum-client": "0.13.0",