@cortexkit/pi-claustrum-auth 0.2.0 → 0.4.0

package/dist/index.js

@@ -138,10 +138,672 @@ function isBalanceFailure(service, body) {
     return false;
   }
 }
+// ../core/src/billing.ts
+import { randomUUID } from "node:crypto";
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/opencode2/integration.js
+var PLACEHOLDER_LIFETIME_MS = 365 * 24 * 60 * 60 * 1000;
+
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/opencode2/sse.js
+function parseBlock(block) {
+  const data = [];
+  let event;
+  for (const line of block.split(/\r?\n/)) {
+    if (line.startsWith("data:"))
+      data.push(line.slice(5).replace(/^ /, ""));
+    else if (line.startsWith("event:"))
+      event = line.slice(6).trim();
+  }
+  if (data.length === 0)
+    return;
+  return event === undefined ? { data: data.join(`
+`) } : { event, data: data.join(`
+`) };
+}
+function watchServerSentEvents(onEvent, onError) {
+  const decoder = new TextDecoder;
+  let buffer = "";
+  const emit = (block) => {
+    const event = parseBlock(block);
+    if (!event)
+      return;
+    try {
+      onEvent(event);
+    } catch (error) {
+      onError(error);
+    }
+  };
+  const drain = () => {
+    for (;; ) {
+      const match = /\r?\n\r?\n/.exec(buffer);
+      if (!match)
+        return;
+      const block = buffer.slice(0, match.index);
+      buffer = buffer.slice(match.index + match[0].length);
+      emit(block);
+    }
+  };
+  return new TransformStream({
+    transform(chunk, controller) {
+      controller.enqueue(chunk);
+      buffer += decoder.decode(chunk, { stream: true });
+      drain();
+    },
+    flush() {
+      buffer += decoder.decode();
+      drain();
+      if (buffer.trim() !== "")
+        emit(buffer);
+      buffer = "";
+    }
+  });
+}
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/routing-accessor/handle.js
+function routingHandle(sessionId) {
+  const routing = Reflect.get(globalThis, Symbol.for("cortexkit.routing"));
+  if (typeof routing !== "function")
+    return;
+  const handle = routing(sessionId);
+  return typeof handle === "object" && handle !== null ? handle : undefined;
+}
+
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/routing-accessor/cache-policy.js
+var CACHE_WARM_STOP_REASONS = [
+  "cost-cap",
+  "count-cap",
+  "outside-hours",
+  "session-ended",
+  "unsupported"
+];
+function isCacheWarmStopReason(value) {
+  return CACHE_WARM_STOP_REASONS.some((reason) => reason === value);
+}
+var warned = new Set;
+function shape(value, seen = new Set) {
+  if (typeof value !== "object" || value === null) {
+    return `${typeof value}:${String(value)}`;
+  }
+  if (seen.has(value))
+    return "cycle";
+  seen.add(value);
+  return `${Array.isArray(value) ? "array" : "object"}:{${Object.entries(Object.getOwnPropertyDescriptors(value)).sort(([a], [b]) => a.localeCompare(b)).map(([key, descriptor]) => `${key}:${"value" in descriptor ? shape(descriptor.value, seen) : "accessor"}`).join(",")}}`;
+}
+function invalid(kind, value) {
+  let fingerprint = "unreadable";
+  try {
+    fingerprint = shape(value);
+  } catch {}
+  try {
+    const key = `${kind}:${fingerprint}`;
+    if (!warned.has(key)) {
+      warned.add(key);
+      console.warn(`[common-auth] Ignoring invalid session ${kind} policy`);
+    }
+  } catch {}
+  return null;
+}
+function record(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function rejectAsync(value) {
+  if (typeof value.then !== "function")
+    return false;
+  Promise.resolve(value).catch(() => {});
+  return true;
+}
+function onlyKeys(value, keys) {
+  return Reflect.ownKeys(value).every((key) => typeof key === "string" && keys.includes(key));
+}
+function sessionCachePolicy(sessionId) {
+  let answer;
+  try {
+    const handle = routingHandle(sessionId);
+    if (!handle)
+      return null;
+    const read = handle.cache;
+    if (typeof read !== "function")
+      return null;
+    answer = read.call(handle);
+    if (answer === null)
+      return null;
+    if (!record(answer) || rejectAsync(answer))
+      return invalid("cache", answer);
+    const { ttl, keep_warm, hours } = answer;
+    if (!onlyKeys(answer, ["ttl", "keep_warm", "hours"]) || ttl !== undefined && ttl !== "none" && ttl !== "short" && ttl !== "long" || keep_warm !== undefined && keep_warm !== "off" && keep_warm !== "hours" && keep_warm !== "always" && keep_warm !== "auto" || ttl === "none" && keep_warm !== undefined && keep_warm !== "off" || keep_warm !== "hours" && "hours" in answer) {
+      return invalid("cache", answer);
+    }
+    const policy = {
+      ...ttl !== undefined ? { ttl } : {},
+      ...keep_warm !== undefined ? { keep_warm } : {}
+    };
+    if (keep_warm === "hours") {
+      if (!record(hours) || !onlyKeys(hours, ["from", "to", "tz"])) {
+        return invalid("cache", answer);
+      }
+      const { from, to, tz } = hours;
+      const time = /^(?:[01]\d|2[0-3]):[0-5]\d$/;
+      if (typeof from !== "string" || !time.test(from) || typeof to !== "string" || !time.test(to) || from === to || typeof tz !== "string" || tz.length === 0) {
+        return invalid("cache", answer);
+      }
+      new Intl.DateTimeFormat("en", { timeZone: tz });
+      policy.hours = { from, to, tz };
+    }
+    return policy;
+  } catch {
+    return invalid("cache", answer);
+  }
+}
+
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/routing-accessor/index.js
+function isObject(value) {
+  return typeof value === "object" && value !== null;
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function billingCache(value) {
+  if (!isObject(value) || Array.isArray(value))
+    return;
+  const { ttlMs, implicit, warming } = value;
+  const cache = {};
+  if (!(ttlMs !== undefined && implicit !== undefined)) {
+    if (typeof ttlMs === "number" && Number.isSafeInteger(ttlMs) && ttlMs > 0) {
+      cache.ttl_ms = ttlMs;
+    } else if (implicit === true) {
+      cache.implicit = true;
+    }
+  }
+  if (isObject(warming) && !Array.isArray(warming)) {
+    const { on, stopReason } = warming;
+    if (typeof on === "boolean") {
+      cache.warming = {
+        on,
+        ...!on && isCacheWarmStopReason(stopReason) ? { stop_reason: stopReason } : {}
+      };
+    }
+  }
+  return Object.keys(cache).length > 0 ? cache : undefined;
+}
+function billingUsage(value) {
+  if (!isObject(value) || Array.isArray(value))
+    return;
+  const usage = {};
+  for (const [inputKey, payloadKey] of [
+    ["input", "input"],
+    ["output", "output"],
+    ["cacheRead", "cache_read"],
+    ["cacheWrite", "cache_write"],
+    ["cacheWrite5m", "cache_write_5m"],
+    ["cacheWrite1h", "cache_write_1h"],
+    ["reasoning", "reasoning"]
+  ]) {
+    const count = value[inputKey];
+    if (typeof count === "number" && Number.isSafeInteger(count) && count >= 0) {
+      usage[payloadKey] = count;
+    }
+  }
+  const reasoningIncludedInOutput = value.reasoningIncludedInOutput;
+  if (typeof reasoningIncludedInOutput === "boolean") {
+    usage.reasoning_included_in_output = reasoningIncludedInOutput;
+  }
+  return Object.keys(usage).length > 0 ? usage : undefined;
+}
+function selectionFor(answer, candidates) {
+  if (!isObject(answer))
+    return;
+  const accountId = answer.account_id;
+  const credentialId = answer.credential_id;
+  if (typeof accountId !== "string")
+    return;
+  if (credentialId !== undefined && typeof credentialId !== "string") {
+    return;
+  }
+  const candidate = candidates.find((route) => route.accountId === accountId && (credentialId === undefined || route.credentialId === credentialId));
+  if (!candidate)
+    return;
+  const hold = answer.hold;
+  const retryAfterMs = isObject(hold) ? hold.retry_after_ms : undefined;
+  if (typeof retryAfterMs === "number" && Number.isFinite(retryAfterMs) && retryAfterMs >= 0) {
+    return { candidate, hold: { retry_after_ms: retryAfterMs } };
+  }
+  return { candidate };
+}
+function refusalFor(value) {
+  if (!isObject(value))
+    return;
+  const code = value.code;
+  if (code !== "account_limit_exhausted" && code !== "account_selection_refused" && code !== "account_selection_final") {
+    return;
+  }
+  const refused = { code };
+  const routingCode = value.routing_code;
+  if (typeof routingCode === "string" && /^[a-z0-9._-]{1,64}$/.test(routingCode)) {
+    refused.routingCode = routingCode;
+  }
+  const retryAfterSecs = value.retry_after_secs;
+  if (typeof retryAfterSecs === "number" && Number.isFinite(retryAfterSecs) && retryAfterSecs >= 0) {
+    refused.retryAfterSecs = retryAfterSecs;
+  }
+  const resetsAtMs = value.resets_at_ms;
+  if (typeof resetsAtMs === "number" && Number.isSafeInteger(resetsAtMs) && resetsAtMs > 0) {
+    refused.resetsAtMs = resetsAtMs;
+  }
+  return { refused };
+}
+async function askRouting(input) {
+  let timer;
+  try {
+    const handle = routingHandle(input.sessionId);
+    if (!handle)
+      return;
+    const accountFor = handle.accountFor;
+    if (typeof accountFor !== "function")
+      return;
+    const requested = input.deadlineMs ?? 1500;
+    const deadlineMs = Number.isNaN(requested) ? 1500 : Math.min(2000, Math.max(1, requested));
+    const expired = new Promise((resolve) => {
+      timer = setTimeout(() => resolve(undefined), deadlineMs);
+      timer.unref();
+    });
+    const request = {
+      provider: input.provider,
+      modelId: input.modelId
+    };
+    const cap = input.holdWaitMaxS;
+    if (typeof cap === "number" && Number.isFinite(cap)) {
+      request.hold_wait_max_s = Math.max(0, Math.floor(cap));
+    }
+    if (input.refusals === true)
+      request.refusals = true;
+    const pending = accountFor.call(handle, request, { deadlineMs });
+    if (!isObject(pending) || typeof pending.then !== "function")
+      return;
+    const answer = await Promise.race([pending, expired]);
+    if (input.refusals === true && isObject(answer) && "refused" in answer) {
+      return refusalFor(answer.refused);
+    }
+    return selectionFor(answer, input.candidates);
+  } catch {
+    return;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function reportRouting(input) {
+  try {
+    const handle = routingHandle(input.sessionId);
+    if (!handle)
+      return;
+    const report = handle.report;
+    if (typeof report !== "function")
+      return;
+    let payload;
+    if ("kind" in input) {
+      switch (input.kind) {
+        case "billing": {
+          const { attemptId, requestKind, credentialId, provider, model, outcome, accountId, providerRequestId, providerResponseId, userMessageId, status, attempt, chargeBasis, usage: inputUsage, usageByModel: inputUsageByModel, cache: inputCache } = input;
+          if (!isNonEmptyString(attemptId) || !isNonEmptyString(credentialId) || !isNonEmptyString(provider) || !isNonEmptyString(model) || requestKind !== "primary" && requestKind !== "title" && requestKind !== "compaction" && requestKind !== "generate" && requestKind !== "keep_warm" && requestKind !== "prime" || outcome !== "completed" && outcome !== "cut" && outcome !== "failed")
+            return;
+          const usage = billingUsage(inputUsage);
+          const cache = billingCache(inputCache);
+          const usageByModel = [];
+          if (Array.isArray(inputUsageByModel)) {
+            for (const entry of inputUsageByModel) {
+              if (!isObject(entry) || Array.isArray(entry))
+                continue;
+              const modelUsed = entry.modelUsed;
+              if (!isNonEmptyString(modelUsed))
+                continue;
+              const modelUsage = billingUsage(entry.usage);
+              if (!modelUsage)
+                continue;
+              usageByModel.push({ model_used: modelUsed, usage: modelUsage });
+            }
+          }
+          payload = {
+            kind: "billing",
+            attempt_id: attemptId,
+            request_kind: requestKind,
+            credential_id: credentialId,
+            provider,
+            model,
+            outcome,
+            ...isNonEmptyString(accountId) ? { account_id: accountId } : {},
+            ...isNonEmptyString(providerRequestId) ? { provider_request_id: providerRequestId } : {},
+            ...isNonEmptyString(providerResponseId) ? { provider_response_id: providerResponseId } : {},
+            ...isNonEmptyString(userMessageId) ? { user_message_id: userMessageId } : {},
+            ...typeof status === "number" && Number.isInteger(status) && status >= 0 ? { status } : {},
+            ...typeof attempt === "number" && Number.isInteger(attempt) && attempt >= 1 ? { attempt } : {},
+            ...chargeBasis === "subscription_included" || chargeBasis === "metered_api" ? { charge_basis: chargeBasis } : {},
+            ...usage ? { usage } : {},
+            ...usageByModel.length > 0 ? { usage_by_model: usageByModel } : {},
+            ...cache ? { cache } : {}
+          };
+          break;
+        }
+        case "turn_notes_supported": {
+          const { model, supported } = input;
+          if (typeof model !== "string" || model.length === 0 || typeof supported !== "boolean")
+            return;
+          payload = {
+            kind: "turn_notes_supported",
+            model,
+            supported
+          };
+          break;
+        }
+        case "turn_note_skipped": {
+          const { after_tool_use_id, reason } = input;
+          if (typeof after_tool_use_id !== "string" || after_tool_use_id.length === 0 || reason !== "anchor_missing" && reason !== "before_user_message" && reason !== "unsupported_model" && reason !== "not_oauth")
+            return;
+          payload = {
+            kind: "turn_note_skipped",
+            after_tool_use_id,
+            reason
+          };
+          break;
+        }
+        default:
+          return;
+      }
+    } else {
+      const identity = {
+        account_id: input.accountId,
+        ...input.credentialId !== undefined ? { credential_id: input.credentialId } : {}
+      };
+      switch (input.outcome) {
+        case "served":
+          payload = { ...identity, outcome: "served", headers: input.headers };
+          break;
+        case "exhausted": {
+          const { window, pool } = input;
+          if (window !== "5h" && window !== "7d")
+            return;
+          if (pool !== undefined && (typeof pool !== "string" || !/^[a-z0-9._-]{1,64}$/.test(pool)))
+            return;
+          payload = {
+            ...identity,
+            outcome: "exhausted",
+            window,
+            ...pool ? { pool } : {},
+            ...input.resetsAt !== undefined ? { resets_at: input.resetsAt } : {}
+          };
+          break;
+        }
+        case "credential_refused": {
+          const { credentialId, providerCode } = input;
+          if (!isNonEmptyString(credentialId) || typeof providerCode !== "string" || !/^[a-z0-9._-]{1,64}$/.test(providerCode))
+            return;
+          payload = {
+            ...identity,
+            outcome: "credential_refused",
+            provider_code: providerCode
+          };
+          break;
+        }
+        default:
+          return;
+      }
+    }
+    const pending = report.call(handle, payload);
+    if (isObject(pending) && typeof pending.then === "function") {
+      Promise.resolve(pending).catch(() => {});
+    }
+  } catch {}
+}
+
+// ../core/src/billing.ts
+var object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+function count(value, paths = []) {
+  for (const path of paths) {
+    let cursor = value;
+    for (const key of path.split("."))
+      cursor = object(cursor) ? cursor[key] : undefined;
+    if (typeof cursor === "number" && Number.isSafeInteger(cursor) && cursor >= 0)
+      return cursor;
+  }
+  return;
+}
+function rawBillingUsage(entry, value) {
+  const semantics = entry.billing;
+  if (!semantics)
+    return;
+  const usage = {};
+  const tokens = object(value) && object(value.usage) && object(value.usage.opencode) ? value.usage.opencode.tokens : undefined;
+  const opencode = !!semantics.opencodeTokens && object(tokens);
+  if (opencode) {
+    for (const [field, path] of [
+      ["input", "input"],
+      ["output", "output"],
+      ["cacheRead", "cache_read"],
+      ["cacheWrite5m", "cache_write_5m"],
+      ["cacheWrite1h", "cache_write_1h"],
+      ["reasoning", "reasoning"]
+    ]) {
+      const measured = count(tokens, [path]);
+      if (measured !== undefined)
+        usage[field] = measured;
+    }
+  } else {
+    for (const field of [
+      "input",
+      "output",
+      "cacheRead",
+      "cacheWrite",
+      "reasoning"
+    ]) {
+      const measured = count(value, semantics[field]);
+      if (measured !== undefined)
+        usage[field] = measured;
+    }
+  }
+  return Object.keys(usage).length ? { counts: usage, opencode } : undefined;
+}
+function finalizedUsage(entry, counts, opencode) {
+  if (!counts)
+    return;
+  const usage = { ...counts };
+  if (opencode) {
+    if (usage.cacheWrite5m !== undefined || usage.cacheWrite1h !== undefined)
+      usage.cacheWrite = (usage.cacheWrite5m ?? 0) + (usage.cacheWrite1h ?? 0);
+    usage.reasoningIncludedInOutput = true;
+  } else {
+    if (usage.input !== undefined && entry.billing?.promptIncludesCache)
+      usage.input = Math.max(0, usage.input - (usage.cacheRead ?? 0) - (usage.cacheWrite ?? 0));
+    if (entry.billing?.reasoningIncludedInOutput !== undefined)
+      usage.reasoningIncludedInOutput = entry.billing.reasoningIncludedInOutput;
+  }
+  return usage;
+}
+function hasBillingAccessor() {
+  try {
+    return typeof Reflect.get(globalThis, Symbol.for("cortexkit.routing")) === "function";
+  } catch {
+    return false;
+  }
+}
+
+class BillingAttempt {
+  entry;
+  provider;
+  sessionId;
+  requestKind;
+  model;
+  receipt;
+  attempt;
+  pi;
+  attemptId = randomUUID();
+  reported = false;
+  completed = false;
+  failed = false;
+  outputStarted = false;
+  responseId;
+  rawUsage;
+  rawOpenCodeUsage;
+  status;
+  ended = false;
+  constructor(entry, provider, sessionId, requestKind, model, receipt, attempt, pi = false) {
+    this.entry = entry;
+    this.provider = provider;
+    this.sessionId = sessionId;
+    this.requestKind = requestKind;
+    this.model = model;
+    this.receipt = receipt;
+    this.attempt = attempt;
+    this.pi = pi;
+  }
+  event(value) {
+    if (!object(value))
+      return;
+    if (value.type === "error" || value.type === "response.failed" || value.error)
+      this.failed = true;
+    if (value.type === "response.completed" || value.type === "response.incomplete")
+      this.completed = true;
+    if (typeof value.type === "string" && value.type.endsWith(".delta"))
+      this.outputStarted = true;
+    if (Array.isArray(value.choices)) {
+      for (const choice of value.choices) {
+        if (!object(choice))
+          continue;
+        if (choice.finish_reason != null)
+          this.completed = true;
+        if (object(choice.delta) && Object.keys(choice.delta).some((key) => key !== "role"))
+          this.outputStarted = true;
+        if (object(choice.message))
+          this.completed = true;
+      }
+    }
+    const response = object(value.response) ? value.response : value;
+    if (!this.pi && typeof response.id === "string")
+      this.responseId = response.id;
+    const raw = rawBillingUsage(this.entry, response);
+    if (raw?.opencode) {
+      this.rawOpenCodeUsage = { ...this.rawOpenCodeUsage, ...raw.counts };
+    } else if (raw) {
+      this.rawUsage = { ...this.rawUsage, ...raw.counts };
+    }
+  }
+  bodyEnd(ended, status) {
+    this.status = status;
+    this.ended = ended;
+    if (!this.pi || status < 200 || status >= 300)
+      this.end();
+  }
+  cancel(status) {
+    this.bodyEnd(this.completed, status);
+  }
+  json(value) {
+    this.event(value);
+    if (object(value) && !value.error)
+      this.completed = true;
+  }
+  done() {
+    this.completed = true;
+  }
+  piEnd(responseId, stopReason) {
+    this.responseId = responseId;
+    if (stopReason === "error")
+      this.failed = true;
+    if (stopReason === "aborted")
+      this.ended = false;
+    else if (stopReason && stopReason !== "error") {
+      this.completed = true;
+      this.ended = true;
+    }
+    this.end();
+  }
+  end(outputStarted = this.outputStarted, ended = this.ended, status = this.status) {
+    if (this.reported)
+      return;
+    this.reported = true;
+    const warming = sessionCachePolicy(this.sessionId)?.keep_warm;
+    const implicit = this.entry.billing?.implicitCache;
+    const usage = finalizedUsage(this.entry, this.rawOpenCodeUsage ?? this.rawUsage, this.rawOpenCodeUsage !== undefined);
+    reportRouting({
+      sessionId: this.sessionId,
+      kind: "billing",
+      attemptId: this.attemptId,
+      requestKind: this.requestKind,
+      credentialId: this.receipt.credentialId,
+      ...this.receipt.accountIdentity ? { accountId: this.receipt.accountIdentity } : {},
+      provider: this.provider,
+      model: this.model,
+      outcome: this.failed || status !== undefined && (status < 200 || status >= 300) ? "failed" : this.completed && ended ? "completed" : outputStarted ? "cut" : "failed",
+      ...status !== undefined ? { status } : {},
+      ...this.attempt !== undefined ? { attempt: this.attempt } : {},
+      ...this.responseId ? { providerResponseId: this.responseId } : {},
+      ...this.entry.chargeBasis ? { chargeBasis: this.entry.chargeBasis } : {},
+      ...usage ? { usage } : {},
+      ...implicit || warming && warming !== "off" ? {
+        cache: {
+          ...implicit ? { implicit } : {},
+          ...warming && warming !== "off" ? { warming: { on: false, stopReason: "unsupported" } } : {}
+        }
+      } : {}
+    });
+  }
+}
+function observeBillingResponse(record, response) {
+  if (!record)
+    return response;
+  if (!response.body) {
+    record.bodyEnd(true, response.status);
+    return response;
+  }
+  const sse = /^text\/event-stream(?:\s*;|$)/i.test(response.headers.get("content-type") ?? "");
+  const decoder = new TextDecoder;
+  let json = "";
+  let oversized = false;
+  const body = sse ? response.body.pipeThrough(watchServerSentEvents((event) => {
+    if (event.data === "[DONE]")
+      record.done();
+    else {
+      try {
+        record.event(JSON.parse(event.data));
+      } catch {}
+    }
+  }, () => {})) : response.body;
+  const reader = body.getReader();
+  return new Response(new ReadableStream({
+    async pull(controller) {
+      try {
+        const next = await reader.read();
+        if (next.done) {
+          if (!sse && !oversized) {
+            try {
+              record.json(JSON.parse(json + decoder.decode()));
+            } catch {}
+          }
+          record.bodyEnd(true, response.status);
+          controller.close();
+        } else {
+          if (!sse && !oversized) {
+            json += decoder.decode(next.value, { stream: true });
+            if (json.length > 1024 * 1024) {
+              oversized = true;
+              json = "";
+            }
+          }
+          controller.enqueue(next.value);
+        }
+      } catch (error) {
+        record.bodyEnd(false, response.status);
+        controller.error(error);
+      }
+    },
+    cancel(reason) {
+      record.cancel(response.status);
+      return reader.cancel(reason);
+    }
+  }, { highWaterMark: 0 }), {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers
+  });
+}
 // ../core/src/fetch.ts
-import { randomUUID as randomUUID7 } from "node:crypto";
+import { randomUUID as randomUUID8 } from "node:crypto";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/request-history.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/request-history.js
 function sameAccount(a, b) {
   return a.namespace === b.namespace && a.accountId === b.accountId && a.incarnation === b.incarnation;
 }
@@ -239,7 +901,7 @@ var REQUEST_EXCLUSION_EFFECTS = Object.freeze({
   chargeSwitch: false
 });
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/activity.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/activity.js
 function effectiveCacheTtlMs(ttlMs) {
   return ttlMs !== undefined && Number.isFinite(ttlMs) && ttlMs >= 0 ? ttlMs : 300000;
 }
@@ -284,7 +946,7 @@ function createSessionActivityStore() {
     }
   };
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/scope.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/scope.js
 function scopeCovers(scope, model, familyOf) {
   switch (scope.kind) {
     case "pool":
@@ -295,20 +957,20 @@ function scopeCovers(scope, model, familyOf) {
       return scope.model === model;
   }
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/hold.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/hold.js
 var MAX_SAME_ACCOUNT_HOLD_MS = 3621000;
 function readMaxSameAccountWait(value) {
   return value === 0 || value === 15 || value === "max" ? value : 15;
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/jitter.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/jitter.js
 import { createHash } from "node:crypto";
 function holdDelayMs(sessionId, delayMs) {
   const seconds = createHash("sha256").update(sessionId).digest().readUInt32BE(0);
   return 1000 * (Math.max(1, Math.ceil(delayMs / 1000)) + seconds % 21);
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/terminal.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/terminal.js
 function scanTerminalReset(input, now) {
   if (!Number.isFinite(input.maxAgeMs) || input.maxAgeMs < 0)
     return;
@@ -409,7 +1071,7 @@ function terminalRefusalDecision(facts, axes, history, metadata) {
   return { ...wait, action: "hold", account: kept.account };
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/wake.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/wake.js
 function waitCheckpoint(accountKey, decidedAt, windows) {
   return {
     accountKey: { ...accountKey },
@@ -431,7 +1093,7 @@ function liftedWindowsForWake(wake, account, windows, now) {
   return windows.filter((window) => canLift(window) && windows.filter((other) => other.confirmed && other.window === window.window).every(canLift)).map((window) => window.window);
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/decide.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/decide.js
 function finiteFuture(value, now) {
   return value !== undefined && Number.isFinite(value) && value > now;
 }
@@ -696,7 +1358,7 @@ function decideAfterLimit(facts, axes) {
     return refusal(facts, axes, history, "quota");
   return pass("no-override");
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/duration.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/duration.js
 function formatDuration(ms) {
   if (!Number.isFinite(ms))
     return "unknown";
@@ -716,7 +1378,7 @@ function formatDuration(ms) {
   return `${remainingMinutes}m`;
 }
 var formatReset = ({ resetAt, now }) => formatDuration(resetAt - now);
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/envelope.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/envelope.js
 var envelopeError = Symbol.for("@cortexkit/common-auth/limits-envelope-error");
 
 class LimitsEnvelopeConflictError extends Error {
@@ -738,7 +1400,7 @@ function limitsEnvelopeAbandonReason(error) {
   const reason = error && typeof error === "object" && Reflect.get(error, envelopeError);
   return reason === "conflict" || reason === "unsupported" ? reason : undefined;
 }
-function record(value) {
+function record2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 var revision = (value) => Number.isSafeInteger(value) && value >= 0;
@@ -746,16 +1408,16 @@ var finite = (value) => typeof value === "number" && Number.isFinite(value);
 var cause = (value) => value === undefined || value === "rate-limit" || value === "payment-balance";
 var arrayOf = (value, valid) => Array.isArray(value) && value.every(valid);
 function account(value, namespace) {
-  return record(value) && value.namespace === namespace && typeof value.accountId === "string" && typeof value.incarnation === "string";
+  return record2(value) && value.namespace === namespace && typeof value.accountId === "string" && typeof value.incarnation === "string";
 }
 function key(value, namespace) {
-  if (!record(value) || !record(value.scope))
+  if (!record2(value) || !record2(value.scope))
     return false;
   const scope = value.scope;
   return account(value.account, namespace) && typeof value.window === "string" && (scope.kind === "pool" || scope.kind === "family" && typeof scope.family === "string" || scope.kind === "model" && typeof scope.model === "string");
 }
 function validEnvelope(value, namespace) {
-  return value.namespace === namespace && typeof value.generation === "string" && revision(value.revision) && revision(value.lowWatermark) && arrayOf(value.marks, (mark) => record(mark) && key(mark.key, namespace) && ["latest-evidence", "max-until", "overwrite"].includes(mark.mergeLaw) && arrayOf(mark.entries, (entry) => record(entry) && cause(entry.cause) && finite(entry.until) && finite(entry.evidenceAt) && revision(entry.baseRevision) && revision(entry.committedRevision))) && arrayOf(value.tombstones, (clear) => record(clear) && key(clear.key, namespace) && revision(clear.revision) && cause(clear.cause)) && arrayOf(value.operationIds, (op) => record(op) && typeof op.producerId === "string" && typeof op.operationId === "string" && revision(op.revision)) && arrayOf(value.access, (access) => record(access) && account(access.account, namespace) && finite(access.eligibilityStateUpdatedAt) && revision(access.committedRevision));
+  return value.namespace === namespace && typeof value.generation === "string" && revision(value.revision) && revision(value.lowWatermark) && arrayOf(value.marks, (mark) => record2(mark) && key(mark.key, namespace) && ["latest-evidence", "max-until", "overwrite"].includes(mark.mergeLaw) && arrayOf(mark.entries, (entry) => record2(entry) && cause(entry.cause) && finite(entry.until) && finite(entry.evidenceAt) && revision(entry.baseRevision) && revision(entry.committedRevision))) && arrayOf(value.tombstones, (clear) => record2(clear) && key(clear.key, namespace) && revision(clear.revision) && cause(clear.cause)) && arrayOf(value.operationIds, (op) => record2(op) && typeof op.producerId === "string" && typeof op.operationId === "string" && revision(op.revision)) && arrayOf(value.access, (access) => record2(access) && account(access.account, namespace) && finite(access.eligibilityStateUpdatedAt) && revision(access.committedRevision));
 }
 
 class EnvelopeGuard {
@@ -776,7 +1438,7 @@ class EnvelopeGuard {
     if (value === undefined)
       return {};
     let replacement;
-    if (!record(value))
+    if (!record2(value))
       replacement = "malformed";
     else if (value.schemaVersion !== 1) {
       this.terminal = new LimitsEnvelopeUnsupportedError;
@@ -803,7 +1465,7 @@ class EnvelopeGuard {
     return true;
   }
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/wording.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/wording.js
 var openCode1Patterns = [
   /429|500|502|503|504|524/i,
   /rate increased too quickly|rate limit|rate-limit|rate_limit|too many requests/i,
@@ -869,7 +1531,7 @@ function hasUnsafeWording(text) {
   return openCode1Patterns.some((pattern) => pattern.test(text)) || pi140Pattern.test(text);
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/labels.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/labels.js
 var emailPattern = /[^\s@]+@[^\s@]+\.[^\s@]+/;
 function containsEmail(text) {
   return emailPattern.test(text);
@@ -878,7 +1540,7 @@ function sanitizeRefusalLabel(label) {
   return containsEmail(label) || hasUnsafeWording(label) ? "this account" : label;
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/families.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/families.js
 class ClaudeIncompleteError extends Error {
   code = "ECONNRESET";
   syscall = "sticky-routing";
@@ -996,7 +1658,7 @@ function buildRefusal(input) {
     body
   };
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/identity.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/identity.js
 function isIdentityCompatible(a, b) {
   return sameAccount(a.account, b.account) && (a.identity === undefined || b.identity === undefined || a.identity === b.identity);
 }
@@ -1012,7 +1674,7 @@ function validateIdentityFence(observed, authoritative, authorizeEpoch) {
     return "credential-epoch";
   return;
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/marker.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/marker.js
 var ANTIGRAVITY_FAILURE_LADDER = Object.freeze({
   kind: "failure-ladder",
   mergeLaw: "max-until",
@@ -1083,7 +1745,7 @@ function markFromSignal(signal, axes, history) {
     ...axes.kind === "hint" && axes.causes?.some((cause) => cause === signal.kind) ? { cause: signal.kind } : {}
   } : undefined;
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/merge-laws.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/merge-laws.js
 function mergeTimedMarkEntries(law, entries, now, clearRevision = 0) {
   const candidates = entries.filter((e) => e.baseRevision >= clearRevision);
   if (law !== "max-until") {
@@ -1105,7 +1767,7 @@ function mergeAccessState(a, b) {
   }
   return a.committedRevision > b.committedRevision ? a : b;
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/namespace.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/namespace.js
 var LIMITS_HISTORY_BOUND = 1024;
 function storedCause(cause) {
   return cause === "rate-limit" || cause === "payment-balance" ? cause : undefined;
@@ -1298,7 +1960,7 @@ function applyLimitsCommands(initial, commands, context) {
   }
   return { snapshot, outcomes };
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/path.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/path.js
 import { realpathSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 function canonicalLimitsPath(path) {
@@ -1320,7 +1982,7 @@ function canonicalLimitsPath(path) {
     }
   }
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/persistence.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/persistence.js
 class LimitsPersistenceRefusal extends Error {
   code;
   constructor(code) {
@@ -1329,9 +1991,9 @@ class LimitsPersistenceRefusal extends Error {
     this.name = "LimitsPersistenceRefusal";
   }
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/envelope-loss.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/envelope-loss.js
 import { AsyncResource } from "node:async_hooks";
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 var detached = new AsyncResource("common-auth-limits-recovery");
 
@@ -1396,8 +2058,8 @@ class EnvelopeHistory {
   }
   recover(present, previous, namespace, now) {
     if (!present)
-      this.missingGeneration ??= randomUUID();
-    const current = present ?? createLimitsNamespace(namespace, this.missingGeneration ?? randomUUID());
+      this.missingGeneration ??= randomUUID2();
+    const current = present ?? createLimitsNamespace(namespace, this.missingGeneration ?? randomUUID2());
     const sources = [...this.retained(previous), current];
     const marks = new Map;
     const tombstones = new Map;
@@ -1454,7 +2116,7 @@ class EnvelopeHistory {
     }, now);
   }
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/presets.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/presets.js
 function immutable(value) {
   if (value && typeof value === "object") {
     for (const child of Object.values(value))
@@ -1694,7 +2356,7 @@ var limitPresets = immutable({
   "window-router": windowRouter,
   "status-vault-order": statusVaultOrder
 });
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/registry.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/registry.js
 import { AsyncResource as AsyncResource2 } from "node:async_hooks";
 var LIMITS_REGISTRY_KEY = Symbol.for("@cortexkit/common-auth/limits-registry/schema-v1");
 var PREFIX = "@cortexkit/common-auth/limits-registry/schema-v";
@@ -2157,22 +2819,22 @@ async function acquireLimitsRegistry(options) {
   };
 }
 // ../core/src/limits.ts
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID7 } from "node:crypto";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/vault-adapter.js
-import { randomUUID as randomUUID5 } from "node:crypto";
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/vault-adapter.js
+import { randomUUID as randomUUID6 } from "node:crypto";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/roster.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/roster.js
 import { createHash as createHash2 } from "node:crypto";
 import { stat as stat3 } from "node:fs/promises";
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/fs/file-read-cache.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/fs/file-read-cache.js
 import { lstat, stat } from "node:fs/promises";
 import { resolve as resolve2 } from "node:path";
-async function identity(path, followSymlinks) {
+async function identity(path, probe) {
   try {
-    const metadata = await (followSymlinks ? stat(path) : lstat(path));
+    const metadata = await probe(path);
     return metadata.isFile() ? metadata : undefined;
   } catch (error) {
     return error.code === "ENOENT" ? "absent" : undefined;
@@ -2185,15 +2847,15 @@ function sameIdentity(left, right) {
 }
 
 class FileReadCache {
-  #followSymlinks;
+  #probe;
   #entries = new Map;
   constructor(options = {}) {
-    this.#followSymlinks = options.followSymlinks ?? false;
+    this.#probe = options.followSymlinks ? (path) => (options.stat ?? stat)(path) : (path) => (options.lstat ?? lstat)(path);
   }
   async read(paths, read, validateHit) {
     const resolvedPaths = paths.map((path) => resolve2(path));
     const key = JSON.stringify(resolvedPaths);
-    const probed = await Promise.all(resolvedPaths.map((path) => identity(path, this.#followSymlinks)));
+    const probed = await Promise.all(resolvedPaths.map((path) => identity(path, this.#probe)));
     const identities = probed.every((entry) => entry !== undefined) ? probed : undefined;
     const cached = this.#entries.get(key);
     if (identities && cached && identities.every((entry, index) => {
@@ -2217,13 +2879,13 @@ class FileReadCache {
   }
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/fs/atomic-write.js
-import { randomUUID as randomUUID3 } from "node:crypto";
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/fs/atomic-write.js
+import { randomUUID as randomUUID4 } from "node:crypto";
 import { mkdir, open, rename as rename2, rm } from "node:fs/promises";
 import { dirname as dirname3 } from "node:path";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/fs/private-files.js
-import { randomUUID as randomUUID2 } from "node:crypto";
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/fs/private-files.js
+import { randomUUID as randomUUID3 } from "node:crypto";
 import { lstat as lstat2, readFile, rename, unlink } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname as dirname2, join as join2, resolve as resolve3 } from "node:path";
@@ -2251,7 +2913,7 @@ function isUnavailable(api, error) {
 }
 async function assertNativeAddonLoads(api) {
   try {
-    await api.verifyPrivatePath(join2(tmpdir(), `.common-auth-private-files-probe-${randomUUID2()}`), "file");
+    await api.verifyPrivatePath(join2(tmpdir(), `.common-auth-private-files-probe-${randomUUID3()}`), "file");
   } catch (error) {
     if (isUnavailable(api, error))
       throw privateFilesUnavailable(error);
@@ -2458,7 +3120,7 @@ async function writePrivateAtomic(path, bytes, options = {}) {
     if (error.code !== "ENOENT")
       throw error;
   }
-  const stage = resolve3(options.stagePath ?? `${path}.${randomUUID2()}.tmp`);
+  const stage = resolve3(options.stagePath ?? `${path}.${randomUUID3()}.tmp`);
   if (dirname2(stage) !== dirname2(path))
     throw new PrivateFileError(path, "stage-directory", { code: "EXDEV" });
   let created = false;
@@ -2517,7 +3179,7 @@ async function writePrivateAtomic(path, bytes, options = {}) {
   }
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/fs/atomic-write.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/fs/atomic-write.js
 class AtomicSyncError extends Error {
   constructor(cause) {
     super("file or directory sync failed", { cause });
@@ -2532,7 +3194,7 @@ async function writeJsonAtomicTracked(path, value, options, onRenamed) {
     return writePrivateAtomic(path, options.serialize ? options.serialize(value) : `${JSON.stringify(value, null, 2)}
 `, {
       beforeRename: options.beforeRename,
-      stagePath: `${path}.${(options.stageName ?? randomUUID3)()}.tmp`,
+      stagePath: `${path}.${(options.stageName ?? randomUUID4)()}.tmp`,
       onRenamed,
       durable: options.durable,
       durability: options.durability,
@@ -2540,7 +3202,7 @@ async function writeJsonAtomicTracked(path, value, options, onRenamed) {
     });
   }
   await mkdir(dirname3(path), { recursive: true });
-  const tempPath = `${path}.${(options.stageName ?? randomUUID3)()}.tmp`;
+  const tempPath = `${path}.${(options.stageName ?? randomUUID4)()}.tmp`;
   let handle;
   let created = false;
   try {
@@ -2578,7 +3240,7 @@ async function writeJsonAtomicTracked(path, value, options, onRenamed) {
       await rm(tempPath, { force: true }).catch(() => {});
   }
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/fs/lock-constants.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/fs/lock-constants.js
 var WRITER_LOCK_CONSTANTS = Object.freeze({
   sidebar: Object.freeze({
     name: "sidebar-write",
@@ -2593,459 +3255,912 @@ var WRITER_LOCK_CONSTANTS = Object.freeze({
     renew: true
   })
 });
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.js
-import { randomUUID as randomUUID4 } from "node:crypto";
-import { link, lstat as lstat3, mkdir as mkdir2, open as open2, readFile as readFile2, rename as rename3, rm as rm2, stat as stat2 } from "node:fs/promises";
-import { dirname as dirname4, join as join4 } from "node:path";
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.js
+import { randomUUID as randomUUID5 } from "node:crypto";
+import { link, lstat as lstat3, mkdir as mkdir2, open as open3, readdir, readFile as readFile2, rename as rename3, rm as rm2, stat as stat2, unlink as unlink2 } from "node:fs/promises";
+import { basename as basename2, dirname as dirname5, join as join4 } from "node:path";
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/logger/engine.js
+import { appendFileSync, chmodSync, existsSync, renameSync, statSync } from "node:fs";
+import { open as open2 } from "node:fs/promises";
+import { dirname as dirname4, resolve as resolve4 } from "node:path";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/fs/with-lock.js
-import { join as join3, resolve as resolve4 } from "node:path";
-function lockPathFor(target, name) {
-  return `${target}.${name}.lock`;
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/logger/redact.js
+var SECRET_KEY_EXACT = /^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i;
+var TOKEN_VALUE = /\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g;
+var MASK = "***REDACTED***";
+var MAX_ERROR_DEPTH = 8;
+function isError(value) {
+  return value instanceof Error || Object.prototype.toString.call(value) === "[object Error]";
 }
-
-class LockContentionError extends Error {
-  details;
-  constructor(details) {
-    super(`Timed out acquiring ${details.name} lock for ${details.target}`);
-    this.name = "LockContentionError";
-    this.details = details;
+function createRedactor(options = {}) {
+  const patterns = [TOKEN_VALUE, ...options.extraValuePatterns ?? []].map((pattern) => new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`));
+  function isSecretKey(key) {
+    const normalized = key.toLowerCase().replace(/[-_]/g, "");
+    return SECRET_KEY_EXACT.test(key) || normalized.includes("apikey") || normalized.endsWith("secret") || normalized.endsWith("password") || normalized.endsWith("token") && !normalized.endsWith("tokens") || !!options.extraSecretKeys?.(normalized);
   }
-}
-
-class LockOwnershipError extends Error {
-  details;
-  constructor(details) {
-    super(`Lost ${details.name} lock for ${details.target}`);
-    this.name = "LockOwnershipError";
-    this.details = details;
+  function errorEntries(error) {
+    const fields = error;
+    const entries = [
+      ["name", error.name],
+      ["message", error.message],
+      ["stack", error.stack]
+    ];
+    for (const key of ["code", "status", "cause"])
+      if (fields[key] !== undefined)
+        entries.push([key, fields[key]]);
+    const listed = new Set(entries.map(([key]) => key));
+    for (const entry of Object.entries(error))
+      if (!listed.has(entry[0]))
+        entries.push(entry);
+    return entries;
   }
-}
-function isChangingLockRead(error, target, name) {
-  if (!isWindowsSharingViolation(error) || error.stage !== "read" && error.stage !== "verify")
-    return false;
-  const path = resolve4(lockPathFor(target, name));
-  return error.path === path || error.path === join3(path, "owner.json");
-}
-async function withLock(target, options, fn) {
-  const started = performance.now();
-  for (;; ) {
-    options.signal?.throwIfAborted();
-    let lock;
-    let changingReadError;
-    try {
-      lock = await acquireRefreshFileLock({
-        path: target,
-        name: options.name,
-        ttlMs: options.ttlMs,
-        renew: options.renew ?? false,
-        ...options.onStep ? { onStep: options.onStep } : {},
-        ...options.onRenewalTimer ? { onRenewalTimer: options.onRenewalTimer } : {}
-      });
-    } catch (error) {
-      if (!isChangingLockRead(error, target, options.name))
-        throw error;
-      lock = null;
-      changingReadError = error;
-    }
-    if (lock) {
-      try {
-        options.signal?.throwIfAborted();
-        return await fn(lock);
-      } finally {
-        await lock.release(options.signal);
-      }
+  function walk(value, keys, seen, errorDepth = 0) {
+    if (typeof value === "string") {
+      return patterns.reduce((text, pattern) => text.replace(pattern, MASK), value);
     }
-    const remaining = options.timeoutMs - (performance.now() - started);
-    if (remaining <= 0) {
-      if (changingReadError)
-        throw changingReadError;
-      throw new LockContentionError({
-        target,
-        name: options.name,
-        timeoutMs: options.timeoutMs
-      });
+    if (!value || typeof value !== "object")
+      return value;
+    if (seen.has(value))
+      return "[Circular]";
+    seen.add(value);
+    try {
+      if (Array.isArray(value))
+        return value.map((item) => walk(item, keys, seen, errorDepth));
+      const error = isError(value);
+      if (error && errorDepth >= MAX_ERROR_DEPTH)
+        return "[Truncated]";
+      const childDepth = error ? errorDepth + 1 : errorDepth;
+      return Object.fromEntries((error ? errorEntries(value) : Object.entries(value)).map(([key, item]) => [
+        key,
+        keys && isSecretKey(key) ? MASK : walk(item, keys, seen, childDepth)
+      ]));
+    } finally {
+      seen.delete(value);
     }
-    await new Promise((resolve) => setTimeout(resolve, Math.min(25, Math.ceil(remaining))));
   }
+  return {
+    redact: (value) => walk(value, true, new WeakSet),
+    redactStrings: (value) => walk(value, false, new WeakSet)
+  };
 }
+var defaultRedactor = createRedactor();
+var redact = defaultRedactor.redact;
+var redactStrings = defaultRedactor.redactStrings;
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.js
-var leaseCreationTestHooks;
-async function createExclusiveText(path, text) {
-  const tempPath = `${path}.${randomUUID4()}.tmp`;
-  let handle;
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/logger/engine.js
+var ORDER = {
+  error: 0,
+  warn: 1,
+  info: 2,
+  debug: 3,
+  trace: 4
+};
+var MAX_BYTES = 5 * 1024 * 1024;
+var ROTATE_KEEP = 3;
+function chmodPrivate(path) {
   try {
-    handle = await open2(tempPath, "wx", 384);
-    try {
-      if (leaseCreationTestHooks?.beforeWrite)
-        await leaseCreationTestHooks.beforeWrite(tempPath);
-      await handle.writeFile(text, "utf8");
-    } finally {
-      await handle.close();
+    chmodSync(path, 384);
+  } catch {}
+}
+function rotateIfNeeded(f) {
+  try {
+    if (!(existsSync(f) && statSync(f).size >= MAX_BYTES))
+      return;
+    for (let i = ROTATE_KEEP - 1;i >= 1; i--) {
+      if (existsSync(`${f}.${i}`)) {
+        const rotated = `${f}.${i + 1}`;
+        renameSync(`${f}.${i}`, rotated);
+        chmodPrivate(rotated);
+      }
     }
+    const rotated = `${f}.1`;
+    renameSync(f, rotated);
+    chmodPrivate(rotated);
+  } catch {}
+}
+async function closeWindowsFile(sink) {
+  const { file, handle } = sink;
+  sink.file = undefined;
+  sink.handle = undefined;
+  if (file && handle)
+    await privateOperation(file, "log-close", () => handle.close());
+}
+async function openWindowsFile(sink, file) {
+  await ensurePrivateDirectory(dirname4(file));
+  try {
+    await verifyPrivate(file, "file", true);
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      throw error;
     try {
-      if (leaseCreationTestHooks?.beforeLink)
-        await leaseCreationTestHooks.beforeLink(tempPath, path);
-      await link(tempPath, path);
-    } catch (error) {
-      const code = error.code;
-      if (code !== "EPERM" && code !== "ENOTSUP" && code !== "EOPNOTSUPP" && code !== "EXDEV")
-        throw error;
-      await writeExclusiveText(path, text);
+      await createPrivateBytes(file, "");
+    } catch (creationError) {
+      if (creationError.code !== "EEXIST")
+        throw creationError;
+      await verifyPrivate(file, "file", true);
     }
-  } finally {
-    if (handle)
-      await rm2(tempPath, { force: true }).catch(() => {});
   }
+  sink.handle = await privateOperation(file, "log-open", () => open2(file, "a"));
+  sink.file = file;
+  return sink.handle;
 }
-async function writeExclusiveText(path, text) {
-  const handle = await open2(path, "wx", 384);
-  let createdStat;
-  try {
-    createdStat = await handle.stat();
-  } catch {
-    createdStat = undefined;
-  }
+async function flushWindowsFile(sink, file, text) {
+  file = resolve4(file);
   try {
-    if (leaseCreationTestHooks?.beforeWrite)
-      await leaseCreationTestHooks.beforeWrite(path);
-    await handle.writeFile(text, "utf8");
-  } catch (error) {
-    try {
-      const current = await lstat3(path).catch(() => {
-        return;
-      });
-      if (createdStat && current && current.dev === createdStat.dev && current.ino === createdStat.ino) {
-        await rm2(path, { force: true }).catch(() => {});
+    if (sink.file !== file)
+      await closeWindowsFile(sink);
+    let handle = sink.handle ?? await openWindowsFile(sink, file);
+    const info = await privateOperation(file, "log-stat", () => handle.stat());
+    if (info.size >= MAX_BYTES) {
+      await closeWindowsFile(sink);
+      for (let i = ROTATE_KEEP - 1;i >= 0; i--) {
+        const source = i === 0 ? file : `${file}.${i}`;
+        const target = `${file}.${i + 1}`;
+        try {
+          await verifyPrivate(source, "file", true);
+        } catch (error) {
+          if (error.code === "ENOENT")
+            continue;
+          throw error;
+        }
+        try {
+          await verifyPrivate(target, "file", true);
+        } catch (error) {
+          if (error.code !== "ENOENT")
+            throw error;
+        }
+        await replaceWindowsFile(source, target);
+        await verifyPrivate(target, "file");
       }
-    } catch {}
+      handle = await openWindowsFile(sink, file);
+    }
+    await privateOperation(file, "log-append", () => handle.appendFile(text, "utf8"));
+  } catch (error) {
+    await closeWindowsFile(sink).catch(() => {});
     throw error;
-  } finally {
-    await handle.close();
   }
 }
-var setRefreshLockRenewalTimeout = globalThis.setTimeout.bind(globalThis);
-var clearRefreshLockRenewalTimeout = globalThis.clearTimeout.bind(globalThis);
-function isLostMarkerRaceError(error) {
-  const code = error?.code;
-  return code === "ENOENT" || !windowsPrivateFiles && (code === "EINVAL" || code === "ENOTDIR");
-}
-var evictionMarkerTestHooks;
-function sameMarkerDirectory(created, current) {
-  if (created.dev !== current.dev || created.ino !== current.ino)
-    return false;
-  if (created.ino === 0 && created.birthtimeMs !== current.birthtimeMs)
-    return false;
-  return true;
-}
-var OWNERLESS_MARKER_GRACE_MS = 1000;
-function acquireRefreshFileLock(options) {
-  return acquireRefreshFileLockWithClock({ ...options, now: Date.now });
+function safeSerialize(data) {
+  try {
+    return ` ${JSON.stringify(data)}`;
+  } catch {
+    return " [unserializable]";
+  }
 }
-async function acquireRefreshFileLockWithClock(options) {
-  const lockPath = lockPathFor(options.path, options.name);
-  const legacyOwnerPath = join4(lockPath, "owner.json");
-  const ownerId = randomUUID4();
-  const now = options.now ?? Date.now;
-  let renewTimer = null;
-  let released = false;
-  let releaseConfirmed = false;
-  let loss;
-  let resolveLoss;
-  const lostPromise = new Promise((resolve) => {
-    resolveLoss = resolve;
-  });
-  function notifyTimerStep(event) {
-    try {
-      const result = options.onRenewalTimer?.(event);
-      if (result && (typeof result === "object" || typeof result === "function") && "then" in result && typeof result.then === "function") {
-        Promise.resolve(result).catch(() => {});
-      }
-    } catch {}
+function createEngine(options) {
+  let logFileSource;
+  let initLevelSource;
+  let runtimeLevel;
+  let redactor = createRedactor();
+  let captureSink;
+  let buffer = [];
+  let timer;
+  let orderedSink = Promise.resolve();
+  let sinkError;
+  const windowsFile = {};
+  function queueWindows(operation) {
+    const next = orderedSink.then(operation);
+    orderedSink = next.catch((error) => {
+      sinkError = error;
+    });
+    return next;
   }
-  function cancelRenewalTimer() {
-    if (!renewTimer)
-      return;
-    clearRefreshLockRenewalTimeout(renewTimer);
-    renewTimer = null;
-    notifyTimerStep("cancelled");
+  function configure(next) {
+    if (windowsPrivateFiles && next.file !== logFileSource)
+      queueWindows(() => closeWindowsFile(windowsFile)).catch(() => {});
+    logFileSource = next.file;
+    initLevelSource = next.level;
+    redactor = createRedactor(next);
+    captureSink = next.captureSink;
   }
-  function recordLoss(reason, owner) {
-    if (loss || released)
+  function setLogLevel(l) {
+    if (l === undefined || l in ORDER)
+      runtimeLevel = l;
+  }
+  function logFilePath() {
+    if (logFileSource === undefined)
       return;
-    loss = Object.freeze({
-      reason,
-      expectedOwnerId: ownerId,
-      ...typeof owner?.ownerId === "string" ? { observedOwnerId: owner.ownerId } : {},
-      ...typeof owner?.expiresAt === "number" ? { observedExpiresAt: owner.expiresAt } : {}
-    });
-    cancelRenewalTimer();
-    resolveLoss(loss);
+    const resolved = typeof logFileSource === "function" ? logFileSource() : logFileSource;
+    return resolved || undefined;
   }
-  let terminalIOError;
-  let renewalInFlight = null;
-  const evictPath = `${lockPath}.evicting`;
-  const evictOwnerPath = join4(evictPath, "owner.json");
-  const evictOwnerId = randomUUID4();
-  const EVICT_TTL = 5000;
-  const MAX_STEAL_ATTEMPTS = 8;
-  async function readOwner() {
-    if (windowsPrivateFiles) {
-      try {
-        return JSON.parse(await readPrivateText(lockPath, true));
-      } catch (error) {
-        if (error.code !== "EISDIR" && error.reason !== "wrong-kind")
-          throw error;
-        await verifyPrivate(lockPath, "directory", true);
-        return JSON.parse(await readPrivateText(legacyOwnerPath, true));
-      }
-    }
-    try {
-      return JSON.parse(await readFile2(lockPath, "utf8"));
-    } catch (error) {
-      const code = error.code;
-      if (code !== "EISDIR")
-        throw error;
-      return JSON.parse(await readFile2(legacyOwnerPath, "utf8"));
-    }
+  function configuredLevel() {
+    if (runtimeLevel)
+      return runtimeLevel;
+    const floor = typeof initLevelSource === "function" ? initLevelSource() : initLevelSource;
+    if (floor && floor in ORDER)
+      return floor;
+    return "info";
   }
-  async function writeOwner() {
+  function flushLogs(close = true) {
+    if (timer) {
+      clearTimeout(timer);
+      timer = undefined;
+    }
+    if (!buffer.length) {
+      if (windowsPrivateFiles)
+        return queueWindows(async () => {
+          if (close)
+            await closeWindowsFile(windowsFile);
+          if (sinkError)
+            throw sinkError;
+        });
+      return;
+    }
+    let file;
+    try {
+      file = logFilePath();
+    } catch {
+      buffer = [];
+      if (windowsPrivateFiles && close)
+        return queueWindows(() => closeWindowsFile(windowsFile));
+      return;
+    }
+    const text = buffer.join("");
+    buffer = [];
+    if (!file) {
+      if (windowsPrivateFiles && close)
+        return queueWindows(() => closeWindowsFile(windowsFile));
+      return;
+    }
     if (windowsPrivateFiles) {
-      const owner = await readOwner();
-      const remaining = Number(owner?.expiresAt) - now();
-      await writePrivateAtomic(lockPath, `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}
-`, {
-        deadline: performance.now() + Math.max(0, remaining),
-        beforeRename: async () => {
-          const current = await readOwner();
-          if (current?.ownerId !== ownerId || !(Number(current?.expiresAt) > now()) || !await ownsEvictionMarker()) {
-            throw new LockOwnershipError({
-              target: options.path,
-              name: options.name
-            });
-          }
+      return queueWindows(async () => {
+        try {
+          await flushWindowsFile(windowsFile, file, text);
+        } finally {
+          if (close)
+            await closeWindowsFile(windowsFile);
         }
       });
-      return;
     }
-    const tempPath = `${lockPath}.${randomUUID4()}.tmp`;
-    let handle;
-    let created = false;
     try {
-      handle = await open2(tempPath, "wx", 384);
-      created = true;
-      await handle.writeFile(`${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}
-`, "utf8");
-      await handle.chmod(384);
-      await handle.close();
-      handle = undefined;
-      const current = await readOwner();
-      if (current?.ownerId !== ownerId || !(Number(current?.expiresAt) > now()) || !await ownsEvictionMarker()) {
-        throw new LockOwnershipError({
-          target: options.path,
-          name: options.name
-        });
-      }
-      await rename3(tempPath, lockPath);
-      created = false;
-    } finally {
-      await handle?.close().catch(() => {});
-      if (created)
-        await rm2(tempPath, { force: true }).catch(() => {});
-    }
+      rotateIfNeeded(file);
+      if (existsSync(file))
+        chmodPrivate(file);
+      appendFileSync(file, text, { encoding: "utf8", mode: 384 });
+    } catch {}
   }
-  async function createLease() {
-    const bytes = `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}
-`;
-    if (windowsPrivateFiles)
-      await createPrivateBytes(lockPath, bytes);
-    else
-      await createExclusiveText(lockPath, bytes);
+  function schedule() {
+    if (!timer)
+      timer = setTimeout(() => {
+        timer = undefined;
+        const flushed = flushLogs(false);
+        if (flushed instanceof Promise)
+          flushed.catch(() => {});
+      }, 500);
   }
-  async function leaseContention(error) {
-    const code = error.code;
-    if (code !== "EEXIST" && code !== "EISDIR")
-      return false;
-    if (windowsPrivateFiles) {
-      if (options.onStep)
-        await options.onStep("lease-contention-read-ready");
+  function emit(channel, level, message, data) {
+    if (logFileSource === undefined && captureSink === undefined)
+      return;
+    try {
+      if (ORDER[level] > ORDER[configuredLevel()])
+        return;
+      const scrubbedMessage = redactor.redactStrings(message);
+      let scrubbedData;
       try {
-        if (code === "EISDIR") {
-          await verifyPrivate(lockPath, "directory", true);
-          await readPrivateText(legacyOwnerPath, true);
-        } else
-          await readOwner();
-      } catch (readError) {
-        if (readError.code !== "ENOENT")
-          throw readError;
+        scrubbedData = redactor.redact(data);
+      } catch {
+        scrubbedData = "[unserializable]";
       }
-    }
-    return true;
+      const line = `[${new Date().toISOString()}] ${level.toUpperCase()} [${channel}] ${scrubbedMessage}` + (data === undefined ? "" : safeSerialize(scrubbedData)) + `
+`;
+      try {
+        captureSink?.({
+          channel,
+          level,
+          message: scrubbedMessage,
+          data: scrubbedData
+        });
+      } catch {}
+      if (logFileSource === undefined)
+        return;
+      buffer.push(line);
+      if (buffer.length >= 50) {
+        const flushed = flushLogs(false);
+        if (flushed instanceof Promise)
+          flushed.catch(() => {});
+      } else
+        schedule();
+    } catch {}
   }
-  async function tryAcquire() {
+  function createLogger(channel) {
+    return {
+      error: (m, d) => emit(channel, "error", m, d),
+      warn: (m, d) => emit(channel, "warn", m, d),
+      info: (m, d) => emit(channel, "info", m, d),
+      debug: (m, d) => emit(channel, "debug", m, d),
+      trace: (m, d) => emit(channel, "trace", m, d)
+    };
+  }
+  function reset() {
     if (windowsPrivateFiles)
-      await ensurePrivateDirectory(dirname4(lockPath));
+      queueWindows(() => closeWindowsFile(windowsFile)).catch(() => {});
+    sinkError = undefined;
+    buffer = [];
+    if (timer) {
+      clearTimeout(timer);
+      timer = undefined;
+    }
+    logFileSource = undefined;
+    initLevelSource = undefined;
+    runtimeLevel = undefined;
+    redactor = createRedactor();
+    captureSink = undefined;
+  }
+  if (options)
+    configure(options);
+  return { configure, createLogger, setLogLevel, flushLogs, reset };
+}
+var defaultEngine = createEngine();
+function createLogger(channel) {
+  return defaultEngine.createLogger(channel);
+}
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/fs/lock-record.js
+import { resolve as resolve5 } from "node:path";
+class DisappearedLockRecordError extends Error {
+  path;
+  code = "ENOENT";
+  constructor(path, cause) {
+    super(`Lock record disappeared: ${path}`, { cause });
+    this.path = path;
+  }
+}
+function isWindowsAccessDeniedRead(error, paths) {
+  return error instanceof PrivateFileError && error.reason === "io-error" && error.win32Code === 5 && (error.stage === "read" || error.stage === "verify") && paths.some((path) => resolve5(path) === error.path);
+}
+function isWindowsAccessDeniedCreate(error, paths, stage) {
+  return error instanceof PrivateFileError && error.reason === "io-error" && error.win32Code === 5 && error.stage === stage && paths.some((path) => resolve5(path) === error.path);
+}
+async function readLockRecord(path, read) {
+  try {
+    return await read();
+  } catch (error) {
+    if (!isWindowsAccessDeniedRead(error, [path]))
+      throw error;
     try {
-      await createLease();
-      return true;
-    } catch (error) {
-      const code = error.code;
-      if (await leaseContention(error))
-        return false;
-      if (code === "ENOENT") {
-        if (windowsPrivateFiles)
-          await ensurePrivateDirectory(dirname4(lockPath));
-        else
-          await mkdir2(dirname4(lockPath), { recursive: true });
-        try {
-          await createLease();
-          return true;
-        } catch (retryError) {
-          if (await leaseContention(retryError))
-            return false;
-          throw retryError;
-        }
-      }
+      return await read();
+    } catch (recheckError) {
+      if (recheckError.code === "ENOENT")
+        throw new DisappearedLockRecordError(path, error);
       throw error;
     }
   }
-  async function backoff() {
-    await new Promise((resolve) => setTimeout(resolve, Math.floor(Math.random() * 4)));
+}
+
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/fs/with-lock.js
+import { join as join3, resolve as resolve6 } from "node:path";
+function lockPathFor(target, name) {
+  return `${target}.${name}.lock`;
+}
+
+class LockContentionError extends Error {
+  details;
+  constructor(details) {
+    super(`Timed out acquiring ${details.name} lock for ${details.target}`);
+    this.name = "LockContentionError";
+    this.details = details;
   }
-  async function readLockState(notifyReady = true) {
-    if (notifyReady && options.onStep)
-      await options.onStep("lock-read-ready");
-    let owner;
+}
+
+class LockOwnershipError extends Error {
+  details;
+  constructor(details) {
+    super(`Lost ${details.name} lock for ${details.target}`);
+    this.name = "LockOwnershipError";
+    this.details = details;
+  }
+}
+function isChangingLockRecord(error, target, name) {
+  const path = resolve6(lockPathFor(target, name));
+  const paths = [path, join3(path, "owner.json")];
+  return (isWindowsSharingViolation(error) || isWindowsAccessDeniedRead(error, paths)) && (error.stage === "read" || error.stage === "verify") && paths.includes(error.path) || windowsPrivateFiles && (isWindowsAccessDeniedCreate(error, [path], "create") || isWindowsAccessDeniedCreate(error, [`${path}.evicting`], "directory-create"));
+}
+async function withLock(target, options, fn) {
+  const started = performance.now();
+  let changingRecordError;
+  for (;; ) {
+    options.signal?.throwIfAborted();
+    let lock;
     try {
-      owner = await readOwner();
+      lock = await acquireRefreshFileLock({
+        path: target,
+        name: options.name,
+        ttlMs: options.ttlMs,
+        renew: options.renew ?? false,
+        ...options.onStep ? { onStep: options.onStep } : {},
+        ...options.onRenewalTimer ? { onRenewalTimer: options.onRenewalTimer } : {}
+      });
+      changingRecordError = undefined;
     } catch (error) {
-      if (windowsPrivateFiles && error.code !== "ENOENT")
+      if (!isChangingLockRecord(error, target, options.name))
         throw error;
+      lock = null;
+      changingRecordError ??= error;
     }
-    const expiresAt = Number(owner?.expiresAt);
-    if (Number.isFinite(expiresAt) && expiresAt > now())
-      return { status: "live" };
-    if (typeof owner?.ownerId === "string" && Number.isFinite(expiresAt)) {
-      return {
-        status: "stale",
-        identity: { kind: "owner", ownerId: owner.ownerId, expiresAt }
-      };
-    }
-    try {
-      const current = await stat2(lockPath);
-      const legacyExpiry = Number.isFinite(expiresAt) ? expiresAt : current.mtimeMs + options.ttlMs;
-      if (legacyExpiry > now())
-        return { status: "live" };
-      return {
-        status: "stale",
-        identity: {
-          kind: "stat",
-          dev: current.dev,
-          ino: current.ino,
-          mtimeMs: current.mtimeMs,
-          expiresAt: legacyExpiry
-        }
-      };
-    } catch (error) {
-      if (error.code === "ENOENT") {
-        if (options.onStep)
-          await options.onStep("lock-missing");
-        return { status: "missing" };
+    if (lock) {
+      try {
+        options.signal?.throwIfAborted();
+        return await fn(lock);
+      } finally {
+        await lock.release(options.signal);
       }
-      throw error;
     }
-  }
-  function sameStaleLock(observed, current) {
-    if (current.status !== "stale")
-      return false;
-    const identity = current.identity;
-    if (observed.kind === "owner" && identity.kind === "owner") {
-      return observed.ownerId === identity.ownerId && observed.expiresAt === identity.expiresAt;
+    const remaining = options.timeoutMs - (performance.now() - started);
+    if (remaining <= 0) {
+      if (changingRecordError)
+        throw changingRecordError;
+      throw new LockContentionError({
+        target,
+        name: options.name,
+        timeoutMs: options.timeoutMs
+      });
     }
-    return observed.kind === "stat" && identity.kind === "stat" && observed.dev === identity.dev && observed.ino === identity.ino && observed.mtimeMs === identity.mtimeMs && observed.expiresAt === identity.expiresAt;
+    await new Promise((resolve) => setTimeout(resolve, Math.min(25, Math.ceil(remaining))));
   }
-  async function ownsEvictionMarker() {
+}
+
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.js
+var leaseCreationTestHooks;
+async function createExclusiveText(path, text) {
+  const tempPath = `${path}.${randomUUID5()}.tmp`;
+  let handle;
+  try {
+    handle = await open3(tempPath, "wx", 384);
     try {
-      const owner = JSON.parse(await readPrivateText(evictOwnerPath, windowsPrivateFiles));
-      return owner?.ownerId === evictOwnerId;
+      if (leaseCreationTestHooks?.beforeWrite)
+        await leaseCreationTestHooks.beforeWrite(tempPath);
+      await handle.writeFile(text, "utf8");
+    } finally {
+      await handle.close();
+    }
+    try {
+      if (leaseCreationTestHooks?.beforeLink)
+        await leaseCreationTestHooks.beforeLink(tempPath, path);
+      await link(tempPath, path);
     } catch (error) {
-      if (windowsPrivateFiles && error.code !== "ENOENT")
+      const code = error.code;
+      if (code !== "EPERM" && code !== "ENOTSUP" && code !== "EOPNOTSUPP" && code !== "EXDEV")
         throw error;
-      return false;
+      await writeExclusiveText(path, text);
     }
+  } finally {
+    if (handle)
+      await rm2(tempPath, { force: true }).catch(() => {});
   }
-  async function removeLeaseObject(path) {
-    if (windowsPrivateFiles)
-      await privateOperation(path, "remove", () => rm2(path, { recursive: true, force: true }));
-    else
-      await rm2(path, { recursive: true, force: true }).catch(() => {});
-  }
-  function isRetryableRemoval(error, path) {
-    if (!windowsPrivateFiles || !(error instanceof PrivateFileError) || error.stage !== "remove" || error.path !== path)
-      return false;
-    return isWindowsSharingViolation(error) || error.win32Code === undefined && error.reason === undefined && (error.code === "EBUSY" || error.code === "EPERM");
+}
+async function writeExclusiveText(path, text) {
+  const handle = await open3(path, "wx", 384);
+  let createdStat;
+  try {
+    createdStat = await handle.stat();
+  } catch {
+    createdStat = undefined;
   }
-  async function removeOwnedLeaseObject(path, stillOwned, deadline = performance.now() + EVICT_TTL + 1000) {
-    let original;
-    let delayMs = 5;
-    while (await stillOwned()) {
-      try {
-        await removeLeaseObject(path);
+  try {
+    if (leaseCreationTestHooks?.beforeWrite)
+      await leaseCreationTestHooks.beforeWrite(path);
+    await handle.writeFile(text, "utf8");
+  } catch (error) {
+    try {
+      const current = await lstat3(path).catch(() => {
         return;
-      } catch (error) {
-        if (!isRetryableRemoval(error, path))
-          throw error;
-        original ??= error;
+      });
+      if (createdStat && current && current.dev === createdStat.dev && current.ino === createdStat.ino) {
+        await rm2(path, { force: true }).catch(() => {});
       }
-      const remainingMs = deadline - performance.now();
-      if (remainingMs <= 0)
-        throw original;
-      await new Promise((resolve) => setTimeout(resolve, Math.min(delayMs, remainingMs)));
-      if (performance.now() >= deadline)
-        throw original;
-      delayMs = Math.min(delayMs * 2, 50);
-    }
+    } catch {}
+    throw error;
+  } finally {
+    await handle.close();
   }
-  async function releaseEvictionMarker(deadline) {
-    let ownedDirectory;
-    await removeOwnedLeaseObject(evictPath, async () => {
-      if (!windowsPrivateFiles)
-        return ownsEvictionMarker();
-      const current = await lstat3(evictPath).catch((error) => {
-        if (error.code !== "ENOENT")
-          throw error;
-        return;
-      });
-      if (!current || ownedDirectory && !sameMarkerDirectory(ownedDirectory, current))
-        return false;
-      if (await ownsEvictionMarker()) {
-        ownedDirectory = current;
-        return true;
+}
+var STAGING_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var STAGING_SWEEP_MIN_AGE_MS = 10 * 60000;
+var STAGING_SWEEP_MAX_CANDIDATES = 256;
+var STAGING_SWEEP_MAX_BYTES = 4096;
+var sweptLockPaths = new Set;
+var pendingStagingSweeps = new Set;
+var stagingSweepTestHooks;
+function isStagingName(name, lockName) {
+  const prefix = `${lockName}.`;
+  const suffix = ".tmp";
+  if (!name.startsWith(prefix) || !name.endsWith(suffix))
+    return false;
+  return STAGING_UUID.test(name.slice(prefix.length, -suffix.length));
+}
+function sameStagingFile(a, b) {
+  return a.dev === b.dev && a.ino === b.ino && a.size === b.size && a.mtimeMs === b.mtimeMs && a.birthtimeMs === b.birthtimeMs;
+}
+async function readStagedOwner(path) {
+  const before = await lstat3(path);
+  if (!before.isFile() || before.isSymbolicLink())
+    return;
+  if (before.size > STAGING_SWEEP_MAX_BYTES)
+    return;
+  const handle = await open3(path, "r");
+  let text;
+  try {
+    if (!sameStagingFile(before, await handle.stat()))
+      return;
+    text = await handle.readFile("utf8");
+  } finally {
+    await handle.close();
+  }
+  let record;
+  try {
+    record = JSON.parse(text);
+  } catch {
+    return;
+  }
+  if (!record || typeof record !== "object" || Array.isArray(record))
+    return;
+  const keys = Object.keys(record).sort();
+  if (keys.length !== 2 || keys[0] !== "expiresAt" || keys[1] !== "ownerId")
+    return;
+  const { ownerId, expiresAt } = record;
+  if (typeof ownerId !== "string" || !STAGING_UUID.test(ownerId))
+    return;
+  if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt))
+    return;
+  return { identity: before, expiresAt };
+}
+async function sweepAbandonedStaging(lockPath, ttlMs, now) {
+  const directory = dirname5(lockPath);
+  const lockName = basename2(lockPath);
+  const hooks = stagingSweepTestHooks;
+  const names = await (hooks?.readdir ?? readdir)(directory);
+  const candidates = names.filter((name) => isStagingName(name, lockName)).slice(0, STAGING_SWEEP_MAX_CANDIDATES);
+  const marginMs = Math.max(Number.isFinite(ttlMs) ? ttlMs : 0, STAGING_SWEEP_MIN_AGE_MS);
+  for (const name of candidates) {
+    const path = join4(directory, name);
+    try {
+      if (now() - (await lstat3(path)).mtimeMs < marginMs)
+        continue;
+      const staged = await readStagedOwner(path);
+      if (!staged || !(staged.expiresAt < now() - marginMs))
+        continue;
+      if (hooks?.beforeUnlink)
+        await hooks.beforeUnlink(path);
+      const current = await readStagedOwner(path);
+      if (!current || !sameStagingFile(staged.identity, current.identity) || !(current.expiresAt < now() - marginMs))
+        continue;
+      await (hooks?.unlink ?? unlink2)(path);
+    } catch {}
+  }
+}
+function startStagingSweep(lockPath, ttlMs, now) {
+  if (sweptLockPaths.has(lockPath))
+    return;
+  sweptLockPaths.add(lockPath);
+  const sweep = Promise.resolve().then(() => sweepAbandonedStaging(lockPath, ttlMs, now)).catch(() => {});
+  pendingStagingSweeps.add(sweep);
+  sweep.finally(() => pendingStagingSweeps.delete(sweep));
+}
+var setRefreshLockRenewalTimeout = globalThis.setTimeout.bind(globalThis);
+var clearRefreshLockRenewalTimeout = globalThis.clearTimeout.bind(globalThis);
+function isLostMarkerRaceError(error) {
+  const code = error?.code;
+  return code === "ENOENT" || !windowsPrivateFiles && (code === "EINVAL" || code === "ENOTDIR");
+}
+var evictionMarkerTestHooks;
+function sameMarkerDirectory(created, current) {
+  if (created.dev !== current.dev || created.ino !== current.ino)
+    return false;
+  if (created.ino === 0 && created.birthtimeMs !== current.birthtimeMs)
+    return false;
+  return true;
+}
+var OWNERLESS_MARKER_GRACE_MS = 1000;
+function acquireRefreshFileLock(options) {
+  return acquireRefreshFileLockWithClock({ ...options, now: Date.now });
+}
+async function acquireRefreshFileLockWithClock(options) {
+  const lockPath = lockPathFor(options.path, options.name);
+  const legacyOwnerPath = join4(lockPath, "owner.json");
+  const ownerId = randomUUID5();
+  const now = options.now ?? Date.now;
+  let renewTimer = null;
+  let released = false;
+  let releaseConfirmed = false;
+  let loss;
+  let resolveLoss;
+  const lostPromise = new Promise((resolve) => {
+    resolveLoss = resolve;
+  });
+  function notifyTimerStep(event) {
+    try {
+      const result = options.onRenewalTimer?.(event);
+      if (result && (typeof result === "object" || typeof result === "function") && "then" in result && typeof result.then === "function") {
+        Promise.resolve(result).catch(() => {});
       }
-      if (!ownedDirectory)
-        return false;
+    } catch {}
+  }
+  function cancelRenewalTimer() {
+    if (!renewTimer)
+      return;
+    clearRefreshLockRenewalTimeout(renewTimer);
+    renewTimer = null;
+    notifyTimerStep("cancelled");
+  }
+  function recordLoss(reason, owner) {
+    if (loss || released)
+      return;
+    loss = Object.freeze({
+      reason,
+      expectedOwnerId: ownerId,
+      ...typeof owner?.ownerId === "string" ? { observedOwnerId: owner.ownerId } : {},
+      ...typeof owner?.expiresAt === "number" ? { observedExpiresAt: owner.expiresAt } : {}
+    });
+    cancelRenewalTimer();
+    resolveLoss(loss);
+  }
+  let terminalIOError;
+  let renewalInFlight = null;
+  const evictPath = `${lockPath}.evicting`;
+  const evictOwnerPath = join4(evictPath, "owner.json");
+  const evictOwnerId = randomUUID5();
+  const EVICT_TTL = 5000;
+  const MAX_STEAL_ATTEMPTS = 8;
+  function isChangingLockCreate(error) {
+    return windowsPrivateFiles && (isWindowsAccessDeniedCreate(error, [lockPath], "create") || isWindowsAccessDeniedCreate(error, [evictPath], "directory-create"));
+  }
+  async function readOwner() {
+    if (windowsPrivateFiles) {
       try {
-        await stat2(evictOwnerPath);
-        return false;
+        return JSON.parse(await readLockRecord(lockPath, () => readPrivateText(lockPath, true)));
       } catch (error) {
-        if (error.code !== "ENOENT")
+        if (error.code !== "EISDIR" && error.reason !== "wrong-kind")
           throw error;
-        return true;
+        await readLockRecord(lockPath, () => verifyPrivate(lockPath, "directory", true));
+        return JSON.parse(await readLockRecord(legacyOwnerPath, () => readPrivateText(legacyOwnerPath, true)));
       }
-    }, deadline);
-  }
-  async function removeOwnMarkerAfterFailedOwnerWrite(created, deadline) {
-    if (!created)
-      return false;
-    let stillOurs = false;
+    }
     try {
-      await removeOwnedLeaseObject(evictPath, async () => {
-        stillOurs = false;
-        const st = await lstat3(evictPath).catch(() => {
-          return;
-        });
-        if (!st || !sameMarkerDirectory(created, st))
+      return JSON.parse(await readFile2(lockPath, "utf8"));
+    } catch (error) {
+      const code = error.code;
+      if (code !== "EISDIR")
+        throw error;
+      return JSON.parse(await readFile2(legacyOwnerPath, "utf8"));
+    }
+  }
+  async function writeOwner() {
+    if (windowsPrivateFiles) {
+      const owner = await readOwner();
+      const remaining = Number(owner?.expiresAt) - now();
+      await writePrivateAtomic(lockPath, `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}
+`, {
+        deadline: performance.now() + Math.max(0, remaining),
+        beforeRename: async () => {
+          const current = await readOwner();
+          if (current?.ownerId !== ownerId || !(Number(current?.expiresAt) > now()) || !await ownsEvictionMarker()) {
+            throw new LockOwnershipError({
+              target: options.path,
+              name: options.name
+            });
+          }
+        }
+      });
+      return;
+    }
+    const tempPath = `${lockPath}.${randomUUID5()}.tmp`;
+    let handle;
+    let created = false;
+    try {
+      handle = await open3(tempPath, "wx", 384);
+      created = true;
+      await handle.writeFile(`${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}
+`, "utf8");
+      await handle.chmod(384);
+      await handle.close();
+      handle = undefined;
+      const current = await readOwner();
+      if (current?.ownerId !== ownerId || !(Number(current?.expiresAt) > now()) || !await ownsEvictionMarker()) {
+        throw new LockOwnershipError({
+          target: options.path,
+          name: options.name
+        });
+      }
+      await rename3(tempPath, lockPath);
+      created = false;
+    } finally {
+      await handle?.close().catch(() => {});
+      if (created)
+        await rm2(tempPath, { force: true }).catch(() => {});
+    }
+  }
+  async function createLease() {
+    const bytes = `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}
+`;
+    if (windowsPrivateFiles)
+      await createPrivateBytes(lockPath, bytes);
+    else
+      await createExclusiveText(lockPath, bytes);
+  }
+  async function leaseContention(error) {
+    const code = error.code;
+    if (code !== "EEXIST" && code !== "EISDIR")
+      return false;
+    if (windowsPrivateFiles) {
+      if (options.onStep)
+        await options.onStep("lease-contention-read-ready");
+      try {
+        if (code === "EISDIR") {
+          await readLockRecord(lockPath, () => verifyPrivate(lockPath, "directory", true));
+          await readLockRecord(legacyOwnerPath, () => readPrivateText(legacyOwnerPath, true));
+        } else
+          await readOwner();
+      } catch (readError) {
+        if (readError.code !== "ENOENT")
+          throw readError;
+      }
+    }
+    return true;
+  }
+  async function tryAcquire() {
+    if (windowsPrivateFiles)
+      await ensurePrivateDirectory(dirname5(lockPath));
+    try {
+      await createLease();
+      return true;
+    } catch (error) {
+      const code = error.code;
+      if (await leaseContention(error))
+        return false;
+      if (code === "ENOENT") {
+        if (windowsPrivateFiles)
+          await ensurePrivateDirectory(dirname5(lockPath));
+        else
+          await mkdir2(dirname5(lockPath), { recursive: true });
+        try {
+          await createLease();
+          return true;
+        } catch (retryError) {
+          if (await leaseContention(retryError))
+            return false;
+          throw retryError;
+        }
+      }
+      throw error;
+    }
+  }
+  async function backoff() {
+    await new Promise((resolve) => setTimeout(resolve, Math.floor(Math.random() * 4)));
+  }
+  async function readLockState(notifyReady = true) {
+    if (notifyReady && options.onStep)
+      await options.onStep("lock-read-ready");
+    let owner;
+    try {
+      owner = await readOwner();
+    } catch (error) {
+      if (error instanceof DisappearedLockRecordError)
+        return { status: "missing" };
+      if (windowsPrivateFiles && error.code !== "ENOENT")
+        throw error;
+    }
+    const expiresAt = Number(owner?.expiresAt);
+    if (Number.isFinite(expiresAt) && expiresAt > now())
+      return { status: "live" };
+    if (typeof owner?.ownerId === "string" && Number.isFinite(expiresAt)) {
+      return {
+        status: "stale",
+        identity: { kind: "owner", ownerId: owner.ownerId, expiresAt }
+      };
+    }
+    try {
+      const current = await stat2(lockPath);
+      const legacyExpiry = Number.isFinite(expiresAt) ? expiresAt : current.mtimeMs + options.ttlMs;
+      if (legacyExpiry > now())
+        return { status: "live" };
+      return {
+        status: "stale",
+        identity: {
+          kind: "stat",
+          dev: current.dev,
+          ino: current.ino,
+          mtimeMs: current.mtimeMs,
+          expiresAt: legacyExpiry
+        }
+      };
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        if (options.onStep)
+          await options.onStep("lock-missing");
+        return { status: "missing" };
+      }
+      throw error;
+    }
+  }
+  function sameStaleLock(observed, current) {
+    if (current.status !== "stale")
+      return false;
+    const identity = current.identity;
+    if (observed.kind === "owner" && identity.kind === "owner") {
+      return observed.ownerId === identity.ownerId && observed.expiresAt === identity.expiresAt;
+    }
+    return observed.kind === "stat" && identity.kind === "stat" && observed.dev === identity.dev && observed.ino === identity.ino && observed.mtimeMs === identity.mtimeMs && observed.expiresAt === identity.expiresAt;
+  }
+  async function ownsEvictionMarker() {
+    try {
+      const owner = JSON.parse(await readLockRecord(evictOwnerPath, () => readPrivateText(evictOwnerPath, windowsPrivateFiles)));
+      return owner?.ownerId === evictOwnerId;
+    } catch (error) {
+      if (windowsPrivateFiles && error.code !== "ENOENT")
+        throw error;
+      return false;
+    }
+  }
+  async function removeLeaseObject(path) {
+    if (windowsPrivateFiles)
+      await privateOperation(path, "remove", () => rm2(path, { recursive: true, force: true }));
+    else
+      await rm2(path, { recursive: true, force: true }).catch(() => {});
+  }
+  function isRetryableRemoval(error, path) {
+    if (!windowsPrivateFiles || !(error instanceof PrivateFileError) || error.stage !== "remove" || error.path !== path)
+      return false;
+    return isWindowsSharingViolation(error) || error.win32Code === undefined && error.reason === undefined && (error.code === "EBUSY" || error.code === "EPERM");
+  }
+  async function removeOwnedLeaseObject(path, stillOwned, deadline = performance.now() + EVICT_TTL + 1000) {
+    let original;
+    let delayMs = 5;
+    while (await stillOwned()) {
+      try {
+        await removeLeaseObject(path);
+        return;
+      } catch (error) {
+        if (!isRetryableRemoval(error, path))
+          throw error;
+        original ??= error;
+      }
+      const remainingMs = deadline - performance.now();
+      if (remainingMs <= 0)
+        throw original;
+      await new Promise((resolve) => setTimeout(resolve, Math.min(delayMs, remainingMs)));
+      if (performance.now() >= deadline)
+        throw original;
+      delayMs = Math.min(delayMs * 2, 50);
+    }
+  }
+  async function releaseEvictionMarker(deadline) {
+    let ownedDirectory;
+    await removeOwnedLeaseObject(evictPath, async () => {
+      if (!windowsPrivateFiles)
+        return ownsEvictionMarker();
+      const current = await lstat3(evictPath).catch((error) => {
+        if (error.code !== "ENOENT")
+          throw error;
+        return;
+      });
+      if (!current || ownedDirectory && !sameMarkerDirectory(ownedDirectory, current))
+        return false;
+      if (await ownsEvictionMarker()) {
+        ownedDirectory = current;
+        return true;
+      }
+      if (!ownedDirectory)
+        return false;
+      try {
+        await stat2(evictOwnerPath);
+        return false;
+      } catch (error) {
+        if (error.code !== "ENOENT")
+          throw error;
+        return true;
+      }
+    }, deadline);
+  }
+  async function removeOwnMarkerAfterFailedOwnerWrite(created, deadline) {
+    if (!created)
+      return false;
+    let stillOurs = false;
+    try {
+      await removeOwnedLeaseObject(evictPath, async () => {
+        stillOurs = false;
+        const st = await lstat3(evictPath).catch(() => {
+          return;
+        });
+        if (!st || !sameMarkerDirectory(created, st))
           return false;
         stillOurs = true;
         try {
@@ -3105,7 +4220,7 @@ async function acquireRefreshFileLockWithClock(options) {
     }
     if (windowsPrivateFiles) {
       try {
-        await verifyPrivate(evictPath, "directory", true);
+        await readLockRecord(evictPath, () => verifyPrivate(evictPath, "directory", true));
       } catch (error) {
         if (error.code === "ENOENT")
           return "missing";
@@ -3129,7 +4244,7 @@ async function acquireRefreshFileLockWithClock(options) {
     }
     if (options.onStep)
       await options.onStep("stale-marker-stat");
-    const claimedPath = `${evictPath}.${randomUUID4()}`;
+    const claimedPath = `${evictPath}.${randomUUID5()}`;
     try {
       await rename3(evictPath, claimedPath);
     } catch (error) {
@@ -3160,8 +4275,8 @@ async function acquireRefreshFileLockWithClock(options) {
       if (error.code === "EEXIST") {
         if (windowsPrivateFiles) {
           try {
-            await verifyPrivate(evictPath, "directory", true);
-            await readPrivateText(evictOwnerPath, true);
+            await readLockRecord(evictPath, () => verifyPrivate(evictPath, "directory", true));
+            await readLockRecord(evictOwnerPath, () => readPrivateText(evictOwnerPath, true));
           } catch (ownerError) {
             if (ownerError.code !== "ENOENT")
               throw ownerError;
@@ -3182,7 +4297,11 @@ async function acquireRefreshFileLockWithClock(options) {
     try {
       await releaseEvictionMarker(deadline);
     } catch (error) {
-      if (isRetryableRemoval(actionError, lockPath) && isRetryableRemoval(error, evictPath))
+      if ((isRetryableRemoval(actionError, lockPath) || isWindowsAccessDeniedRead(actionError, [
+        lockPath,
+        legacyOwnerPath,
+        evictOwnerPath
+      ])) && (isRetryableRemoval(error, evictPath) || isWindowsAccessDeniedRead(error, [evictOwnerPath])))
         throw actionError;
       throw error;
     }
@@ -3198,7 +4317,7 @@ async function acquireRefreshFileLockWithClock(options) {
       try {
         owner = await readOwner();
       } catch (error) {
-        if (windowsPrivateFiles)
+        if (windowsPrivateFiles && !(error instanceof DisappearedLockRecordError))
           throw error;
         return;
       }
@@ -3276,7 +4395,7 @@ async function acquireRefreshFileLockWithClock(options) {
             await options.onStep("renewal-marker-unavailable");
           }
         } catch (error) {
-          if (windowsPrivateFiles && error instanceof PrivateFileError) {
+          if (windowsPrivateFiles && error instanceof PrivateFileError && !isChangingLockCreate(error)) {
             terminalIOError = error;
             recordLoss("renewal-failed");
             shouldReschedule = false;
@@ -3319,73 +4438,92 @@ async function acquireRefreshFileLockWithClock(options) {
     } catch {}
     return null;
   }
-  let acquired = await tryAcquire();
+  let acquired = false;
+  let changingCreateError;
+  try {
+    acquired = await tryAcquire();
+  } catch (error) {
+    if (!isChangingLockCreate(error))
+      throw error;
+    changingCreateError = error;
+  }
   if (!acquired) {
     for (let attempt = 0;attempt < MAX_STEAL_ATTEMPTS; attempt++) {
-      acquired = await tryAcquire();
-      if (acquired)
-        break;
-      const observed = await readLockState();
-      if (observed.status === "live")
-        return contended();
-      if (observed.status === "missing")
-        continue;
-      if (options.onStep)
-        await options.onStep("stale-lock-observed");
-      try {
-        if (!await tryAcquireEvictionMarker()) {
-          await backoff();
-          continue;
-        }
-      } catch (evictError) {
-        const code = evictError.code;
-        if (code !== "EEXIST")
-          throw evictError;
-        const recovered = await recoverStaleEvictionMarker();
-        if (recovered === "fresh")
-          return null;
-        await backoff();
-        continue;
-      }
       try {
-        const confirmed = await readLockState();
-        if (confirmed.status === "live")
+        acquired = await tryAcquire();
+        if (acquired)
+          break;
+        const observed = await readLockState();
+        if (observed.status === "live")
           return contended();
-        if (!sameStaleLock(observed.identity, confirmed))
-          continue;
-        if (!await ownsEvictionMarker())
-          return null;
-        if (options.onStep)
-          await options.onStep("stale-lock-confirmed");
-        if (!await ownsEvictionMarker())
-          return null;
-        const current = await readLockState(false);
-        if (!sameStaleLock(observed.identity, current))
+        if (observed.status === "missing")
           continue;
-        await removeLeaseObject(lockPath);
-        if (!await ownsEvictionMarker())
-          return null;
         if (options.onStep)
-          await options.onStep("stale-lock-removed");
-        acquired = await tryAcquire();
-        if (!acquired)
-          return null;
-        if (options.onStep)
-          await options.onStep("stale-lock-recreated");
-        if (!await ownsEvictionMarker()) {
-          await relinquishLockAfterMarkerLoss();
-          acquired = false;
-          return null;
+          await options.onStep("stale-lock-observed");
+        try {
+          if (!await tryAcquireEvictionMarker()) {
+            await backoff();
+            continue;
+          }
+        } catch (evictError) {
+          const code = evictError.code;
+          if (code !== "EEXIST")
+            throw evictError;
+          const recovered = await recoverStaleEvictionMarker();
+          if (recovered === "fresh")
+            return null;
+          await backoff();
+          continue;
         }
-        break;
-      } finally {
-        await releaseEvictionMarker();
+        try {
+          const confirmed = await readLockState();
+          if (confirmed.status === "live")
+            return contended();
+          if (!sameStaleLock(observed.identity, confirmed))
+            continue;
+          if (!await ownsEvictionMarker())
+            return null;
+          if (options.onStep)
+            await options.onStep("stale-lock-confirmed");
+          if (!await ownsEvictionMarker())
+            return null;
+          const current = await readLockState(false);
+          if (!sameStaleLock(observed.identity, current))
+            continue;
+          await removeLeaseObject(lockPath);
+          if (!await ownsEvictionMarker())
+            return null;
+          if (options.onStep)
+            await options.onStep("stale-lock-removed");
+          acquired = await tryAcquire();
+          if (!acquired)
+            return null;
+          if (options.onStep)
+            await options.onStep("stale-lock-recreated");
+          if (!await ownsEvictionMarker()) {
+            await relinquishLockAfterMarkerLoss();
+            acquired = false;
+            return null;
+          }
+          break;
+        } finally {
+          await releaseEvictionMarker();
+        }
+      } catch (error) {
+        if (!isChangingLockCreate(error))
+          throw error;
+        changingCreateError ??= error;
+        await backoff();
       }
     }
   }
-  if (!acquired)
+  if (!acquired) {
+    if (changingCreateError)
+      throw changingCreateError;
     return null;
+  }
   scheduleRenewal();
+  startStagingSweep(lockPath, options.ttlMs, now);
   return {
     ownerId,
     whenLost: () => lostPromise,
@@ -3422,6 +4560,7 @@ async function acquireRefreshFileLockWithClock(options) {
       const deadline = performance.now() + EVICT_TTL + 1000;
       let delayMs = 5;
       let removalError;
+      let changingRecordError;
       for (;; ) {
         try {
           let removalConfirmed = false;
@@ -3447,24 +4586,32 @@ async function acquireRefreshFileLockWithClock(options) {
             await removeLeaseObject(lockPath);
             removalConfirmed = true;
           }, deadline);
-          if (markerAcquired) {
-            if (windowsPrivateFiles && !removalConfirmed)
-              throw new PrivateFileError(lockPath, "release-not-confirmed", {
-                code: "EIO"
-              });
-            releaseConfirmed = removalConfirmed;
+          changingRecordError = undefined;
+          if (markerAcquired && removalConfirmed) {
+            releaseConfirmed = true;
             return;
           }
-          if (signal?.aborted)
-            return;
-          await recoverStaleEvictionMarker(deadline);
+          if (!markerAcquired) {
+            if (signal?.aborted)
+              return;
+            await recoverStaleEvictionMarker(deadline);
+          }
         } catch (error) {
-          if (!isRetryableRemoval(error, lockPath)) {
+          const changingRecord = windowsPrivateFiles && (isChangingLockCreate(error) || isWindowsAccessDeniedRead(error, [
+            lockPath,
+            legacyOwnerPath,
+            evictPath,
+            evictOwnerPath
+          ]));
+          if (!isRetryableRemoval(error, lockPath) && !changingRecord) {
             if (windowsPrivateFiles)
               throw error;
             return;
           }
-          removalError ??= error;
+          if (changingRecord)
+            changingRecordError ??= error;
+          else
+            removalError ??= error;
         }
         const remainingMs = deadline - performance.now();
         if (remainingMs <= 0)
@@ -3475,13 +4622,16 @@ async function acquireRefreshFileLockWithClock(options) {
         delayMs = Math.min(delayMs * 2, 50);
       }
       if (windowsPrivateFiles)
-        throw removalError ?? new PrivateFileError(lockPath, "release-not-confirmed", {
+        throw changingRecordError ?? removalError ?? new PrivateFileError(lockPath, "release-not-confirmed", {
           code: "ETIMEDOUT"
         });
+      createLogger("fs").warn("File lock release deadline expired", {
+        lockPath
+      });
     }
   };
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/quota/map.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/quota/map.js
 var ALL_SCOPE = "all";
 var DEFAULT_REQUIRED_LABELS = Object.freeze([
   "primary"
@@ -3581,7 +4731,7 @@ function isQuotaMap(value) {
   return optional(value, "budget", isCreditBudgetEntry) && optional(value, "counters", isQuotaCounters) && optional(value, "credits", isQuotaCredits);
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/quota/merge.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/quota/merge.js
 class QuotaCodecError extends TypeError {
   constructor(message) {
     super(message);
@@ -3657,455 +4807,121 @@ function mergeCounters(stored, observed) {
   const counters = new Map(Object.entries(stored ?? {}));
   for (const [name, counter] of Object.entries(observed ?? {})) {
     const existing = counters.get(name);
-    if (existing === undefined || counter.checkedAt >= existing.checkedAt) {
-      counters.set(name, counter);
-    }
-  }
-  return counters.size === 0 ? undefined : Object.fromEntries(counters);
-}
-function mergeCredits(stored, observed) {
-  if (observed === undefined)
-    return stored;
-  if (stored !== undefined && observed.checkedAt < stored.checkedAt) {
-    return stored;
-  }
-  return { ...observed };
-}
-function mergeQuotaObservation(stored, observation) {
-  const decoded = stored === undefined ? undefined : decodeQuotaMap(stored);
-  if (stored !== undefined && decoded === undefined) {
-    throw new QuotaCodecError("stored quota map is malformed");
-  }
-  if (!isQuotaObservation(observation)) {
-    throw new QuotaCodecError("quota observation is malformed");
-  }
-  const base = decoded ?? { limits: [] };
-  const at = observation.checkedAt;
-  const entries = new Map;
-  for (const entry of base.limits) {
-    entries.set(limitKey(entry.scope, entry.label), entry);
-  }
-  const applies = (key) => {
-    const existing = entries.get(key);
-    return existing === undefined || at >= entryTime(existing);
-  };
-  const carried = new Set;
-  for (const reading of observation.readings ?? []) {
-    const scope = reading.scope ?? ALL_SCOPE;
-    const key = limitKey(scope, reading.label);
-    carried.add(key);
-    if (!applies(key))
-      continue;
-    entries.set(key, {
-      scope,
-      label: reading.label,
-      kind: "reading",
-      checkedAt: at,
-      usedPercent: reading.usedPercent,
-      ...reading.resetsAt === undefined ? {} : { resetsAt: reading.resetsAt },
-      ...reading.windowMinutes === undefined ? {} : { windowMinutes: reading.windowMinutes }
-    });
-  }
-  for (const pair of observation.coverage ?? []) {
-    const scope = pair.scope ?? ALL_SCOPE;
-    const key = limitKey(scope, pair.label);
-    if (carried.has(key) || !applies(key))
-      continue;
-    const existing = entries.get(key);
-    entries.set(key, existing === undefined || existing.kind === "absent" ? { scope, label: pair.label, kind: "absent", checkedAt: at } : { scope, label: pair.label, kind: "retired", retiredAt: at });
-  }
-  const { limits: _limits, budget: _budget, counters: _counters, credits: _credits, ...unknownKeys } = base;
-  const budget = mergeBudget(base.budget, observation.budget, at);
-  const counters = mergeCounters(base.counters, observation.counters);
-  const credits = mergeCredits(base.credits, observation.credits);
-  return {
-    ...unknownKeys,
-    limits: [...entries.values()].sort(compareEntries),
-    ...budget === undefined ? {} : { budget },
-    ...counters === undefined ? {} : { counters },
-    ...credits === undefined ? {} : { credits }
-  };
-}
-
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/quota/codec.js
-var quotaCodec = Object.freeze({
-  validate: isQuotaMap,
-  decode: decodeQuotaMap,
-  merge: mergeQuotaObservation
-});
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/quota/format.js
-var QUOTA_STALE_AFTER_MS = 15 * 60000;
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/errors.js
-class ClaustrumConsumerError extends Error {
-  kind;
-  constructor(kind, message) {
-    super(message);
-    this.name = "ClaustrumConsumerError";
-    this.kind = kind;
-  }
-}
-
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.js
-function matches(entry, credentialId, accountIdentity) {
-  if (entry.accountIdentity !== undefined && accountIdentity !== undefined)
-    return entry.accountIdentity === accountIdentity;
-  return entry.credentialId === credentialId;
-}
-function isDeclined(entries, credentialId, accountIdentity) {
-  return entries.some((entry) => matches(entry, credentialId, accountIdentity));
-}
-function declineAccount(entries, credentialId, accountIdentity) {
-  const entry = {
-    credentialId,
-    ...accountIdentity !== undefined && { accountIdentity }
-  };
-  return [
-    ...entries.filter((existing) => existing.credentialId !== credentialId || existing.accountIdentity !== accountIdentity),
-    entry
-  ];
-}
-function acceptAccount(entries, credentialIds, accountIdentity) {
-  return entries.filter((entry) => !credentialIds.some((id) => matches(entry, id, accountIdentity)));
-}
-
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/quota-writer.js
-import { resolve as resolve6 } from "node:path";
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/logger/engine.js
-import { appendFileSync, chmodSync, existsSync, renameSync, statSync } from "node:fs";
-import { open as open3 } from "node:fs/promises";
-import { dirname as dirname5, resolve as resolve5 } from "node:path";
-
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/logger/redact.js
-var SECRET_KEY_EXACT = /^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i;
-var TOKEN_VALUE = /\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g;
-var MASK = "***REDACTED***";
-var MAX_ERROR_DEPTH = 8;
-function isError(value) {
-  return value instanceof Error || Object.prototype.toString.call(value) === "[object Error]";
-}
-function createRedactor(options = {}) {
-  const patterns = [TOKEN_VALUE, ...options.extraValuePatterns ?? []].map((pattern) => new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`));
-  function isSecretKey(key) {
-    const normalized = key.toLowerCase().replace(/[-_]/g, "");
-    return SECRET_KEY_EXACT.test(key) || normalized.includes("apikey") || normalized.endsWith("secret") || normalized.endsWith("password") || normalized.endsWith("token") && !normalized.endsWith("tokens") || !!options.extraSecretKeys?.(normalized);
-  }
-  function errorEntries(error) {
-    const fields = error;
-    const entries = [
-      ["name", error.name],
-      ["message", error.message],
-      ["stack", error.stack]
-    ];
-    for (const key of ["code", "status", "cause"])
-      if (fields[key] !== undefined)
-        entries.push([key, fields[key]]);
-    const listed = new Set(entries.map(([key]) => key));
-    for (const entry of Object.entries(error))
-      if (!listed.has(entry[0]))
-        entries.push(entry);
-    return entries;
-  }
-  function walk(value, keys, seen, errorDepth = 0) {
-    if (typeof value === "string") {
-      return patterns.reduce((text, pattern) => text.replace(pattern, MASK), value);
-    }
-    if (!value || typeof value !== "object")
-      return value;
-    if (seen.has(value))
-      return "[Circular]";
-    seen.add(value);
-    try {
-      if (Array.isArray(value))
-        return value.map((item) => walk(item, keys, seen, errorDepth));
-      const error = isError(value);
-      if (error && errorDepth >= MAX_ERROR_DEPTH)
-        return "[Truncated]";
-      const childDepth = error ? errorDepth + 1 : errorDepth;
-      return Object.fromEntries((error ? errorEntries(value) : Object.entries(value)).map(([key, item]) => [
-        key,
-        keys && isSecretKey(key) ? MASK : walk(item, keys, seen, childDepth)
-      ]));
-    } finally {
-      seen.delete(value);
-    }
-  }
-  return {
-    redact: (value) => walk(value, true, new WeakSet),
-    redactStrings: (value) => walk(value, false, new WeakSet)
-  };
-}
-var defaultRedactor = createRedactor();
-var redact = defaultRedactor.redact;
-var redactStrings = defaultRedactor.redactStrings;
-
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/logger/engine.js
-var ORDER = {
-  error: 0,
-  warn: 1,
-  info: 2,
-  debug: 3,
-  trace: 4
-};
-var MAX_BYTES = 5 * 1024 * 1024;
-var ROTATE_KEEP = 3;
-function chmodPrivate(path) {
-  try {
-    chmodSync(path, 384);
-  } catch {}
-}
-function rotateIfNeeded(f) {
-  try {
-    if (!(existsSync(f) && statSync(f).size >= MAX_BYTES))
-      return;
-    for (let i = ROTATE_KEEP - 1;i >= 1; i--) {
-      if (existsSync(`${f}.${i}`)) {
-        const rotated = `${f}.${i + 1}`;
-        renameSync(`${f}.${i}`, rotated);
-        chmodPrivate(rotated);
-      }
-    }
-    const rotated = `${f}.1`;
-    renameSync(f, rotated);
-    chmodPrivate(rotated);
-  } catch {}
-}
-async function closeWindowsFile(sink) {
-  const { file, handle } = sink;
-  sink.file = undefined;
-  sink.handle = undefined;
-  if (file && handle)
-    await privateOperation(file, "log-close", () => handle.close());
-}
-async function openWindowsFile(sink, file) {
-  await ensurePrivateDirectory(dirname5(file));
-  try {
-    await verifyPrivate(file, "file", true);
-  } catch (error) {
-    if (error.code !== "ENOENT")
-      throw error;
-    try {
-      await createPrivateBytes(file, "");
-    } catch (creationError) {
-      if (creationError.code !== "EEXIST")
-        throw creationError;
-      await verifyPrivate(file, "file", true);
-    }
-  }
-  sink.handle = await privateOperation(file, "log-open", () => open3(file, "a"));
-  sink.file = file;
-  return sink.handle;
-}
-async function flushWindowsFile(sink, file, text) {
-  file = resolve5(file);
-  try {
-    if (sink.file !== file)
-      await closeWindowsFile(sink);
-    let handle = sink.handle ?? await openWindowsFile(sink, file);
-    const info = await privateOperation(file, "log-stat", () => handle.stat());
-    if (info.size >= MAX_BYTES) {
-      await closeWindowsFile(sink);
-      for (let i = ROTATE_KEEP - 1;i >= 0; i--) {
-        const source = i === 0 ? file : `${file}.${i}`;
-        const target = `${file}.${i + 1}`;
-        try {
-          await verifyPrivate(source, "file", true);
-        } catch (error) {
-          if (error.code === "ENOENT")
-            continue;
-          throw error;
-        }
-        try {
-          await verifyPrivate(target, "file", true);
-        } catch (error) {
-          if (error.code !== "ENOENT")
-            throw error;
-        }
-        await replaceWindowsFile(source, target);
-        await verifyPrivate(target, "file");
-      }
-      handle = await openWindowsFile(sink, file);
-    }
-    await privateOperation(file, "log-append", () => handle.appendFile(text, "utf8"));
-  } catch (error) {
-    await closeWindowsFile(sink).catch(() => {});
-    throw error;
-  }
-}
-function safeSerialize(data) {
-  try {
-    return ` ${JSON.stringify(data)}`;
-  } catch {
-    return " [unserializable]";
-  }
-}
-function createEngine(options) {
-  let logFileSource;
-  let initLevelSource;
-  let runtimeLevel;
-  let redactor = createRedactor();
-  let captureSink;
-  let buffer = [];
-  let timer;
-  let orderedSink = Promise.resolve();
-  let sinkError;
-  const windowsFile = {};
-  function queueWindows(operation) {
-    const next = orderedSink.then(operation);
-    orderedSink = next.catch((error) => {
-      sinkError = error;
-    });
-    return next;
-  }
-  function configure(next) {
-    if (windowsPrivateFiles && next.file !== logFileSource)
-      queueWindows(() => closeWindowsFile(windowsFile)).catch(() => {});
-    logFileSource = next.file;
-    initLevelSource = next.level;
-    redactor = createRedactor(next);
-    captureSink = next.captureSink;
-  }
-  function setLogLevel(l) {
-    if (l === undefined || l in ORDER)
-      runtimeLevel = l;
-  }
-  function logFilePath() {
-    if (logFileSource === undefined)
-      return;
-    const resolved = typeof logFileSource === "function" ? logFileSource() : logFileSource;
-    return resolved || undefined;
-  }
-  function configuredLevel() {
-    if (runtimeLevel)
-      return runtimeLevel;
-    const floor = typeof initLevelSource === "function" ? initLevelSource() : initLevelSource;
-    if (floor && floor in ORDER)
-      return floor;
-    return "info";
-  }
-  function flushLogs(close = true) {
-    if (timer) {
-      clearTimeout(timer);
-      timer = undefined;
-    }
-    if (!buffer.length) {
-      if (windowsPrivateFiles)
-        return queueWindows(async () => {
-          if (close)
-            await closeWindowsFile(windowsFile);
-          if (sinkError)
-            throw sinkError;
-        });
-      return;
-    }
-    let file;
-    try {
-      file = logFilePath();
-    } catch {
-      buffer = [];
-      if (windowsPrivateFiles && close)
-        return queueWindows(() => closeWindowsFile(windowsFile));
-      return;
-    }
-    const text = buffer.join("");
-    buffer = [];
-    if (!file) {
-      if (windowsPrivateFiles && close)
-        return queueWindows(() => closeWindowsFile(windowsFile));
-      return;
-    }
-    if (windowsPrivateFiles) {
-      return queueWindows(async () => {
-        try {
-          await flushWindowsFile(windowsFile, file, text);
-        } finally {
-          if (close)
-            await closeWindowsFile(windowsFile);
-        }
-      });
+    if (existing === undefined || counter.checkedAt >= existing.checkedAt) {
+      counters.set(name, counter);
     }
-    try {
-      rotateIfNeeded(file);
-      if (existsSync(file))
-        chmodPrivate(file);
-      appendFileSync(file, text, { encoding: "utf8", mode: 384 });
-    } catch {}
   }
-  function schedule() {
-    if (!timer)
-      timer = setTimeout(() => {
-        timer = undefined;
-        const flushed = flushLogs(false);
-        if (flushed instanceof Promise)
-          flushed.catch(() => {});
-      }, 500);
+  return counters.size === 0 ? undefined : Object.fromEntries(counters);
+}
+function mergeCredits(stored, observed) {
+  if (observed === undefined)
+    return stored;
+  if (stored !== undefined && observed.checkedAt < stored.checkedAt) {
+    return stored;
   }
-  function emit(channel, level, message, data) {
-    if (logFileSource === undefined && captureSink === undefined)
-      return;
-    try {
-      if (ORDER[level] > ORDER[configuredLevel()])
-        return;
-      const scrubbedMessage = redactor.redactStrings(message);
-      let scrubbedData;
-      try {
-        scrubbedData = redactor.redact(data);
-      } catch {
-        scrubbedData = "[unserializable]";
-      }
-      const line = `[${new Date().toISOString()}] ${level.toUpperCase()} [${channel}] ${scrubbedMessage}` + (data === undefined ? "" : safeSerialize(scrubbedData)) + `
-`;
-      try {
-        captureSink?.({
-          channel,
-          level,
-          message: scrubbedMessage,
-          data: scrubbedData
-        });
-      } catch {}
-      if (logFileSource === undefined)
-        return;
-      buffer.push(line);
-      if (buffer.length >= 50) {
-        const flushed = flushLogs(false);
-        if (flushed instanceof Promise)
-          flushed.catch(() => {});
-      } else
-        schedule();
-    } catch {}
+  return { ...observed };
+}
+function mergeQuotaObservation(stored, observation) {
+  const decoded = stored === undefined ? undefined : decodeQuotaMap(stored);
+  if (stored !== undefined && decoded === undefined) {
+    throw new QuotaCodecError("stored quota map is malformed");
   }
-  function createLogger(channel) {
-    return {
-      error: (m, d) => emit(channel, "error", m, d),
-      warn: (m, d) => emit(channel, "warn", m, d),
-      info: (m, d) => emit(channel, "info", m, d),
-      debug: (m, d) => emit(channel, "debug", m, d),
-      trace: (m, d) => emit(channel, "trace", m, d)
-    };
+  if (!isQuotaObservation(observation)) {
+    throw new QuotaCodecError("quota observation is malformed");
   }
-  function reset() {
-    if (windowsPrivateFiles)
-      queueWindows(() => closeWindowsFile(windowsFile)).catch(() => {});
-    sinkError = undefined;
-    buffer = [];
-    if (timer) {
-      clearTimeout(timer);
-      timer = undefined;
-    }
-    logFileSource = undefined;
-    initLevelSource = undefined;
-    runtimeLevel = undefined;
-    redactor = createRedactor();
-    captureSink = undefined;
+  const base = decoded ?? { limits: [] };
+  const at = observation.checkedAt;
+  const entries = new Map;
+  for (const entry of base.limits) {
+    entries.set(limitKey(entry.scope, entry.label), entry);
   }
-  if (options)
-    configure(options);
-  return { configure, createLogger, setLogLevel, flushLogs, reset };
+  const applies = (key) => {
+    const existing = entries.get(key);
+    return existing === undefined || at >= entryTime(existing);
+  };
+  const carried = new Set;
+  for (const reading of observation.readings ?? []) {
+    const scope = reading.scope ?? ALL_SCOPE;
+    const key = limitKey(scope, reading.label);
+    carried.add(key);
+    if (!applies(key))
+      continue;
+    entries.set(key, {
+      scope,
+      label: reading.label,
+      kind: "reading",
+      checkedAt: at,
+      usedPercent: reading.usedPercent,
+      ...reading.resetsAt === undefined ? {} : { resetsAt: reading.resetsAt },
+      ...reading.windowMinutes === undefined ? {} : { windowMinutes: reading.windowMinutes }
+    });
+  }
+  for (const pair of observation.coverage ?? []) {
+    const scope = pair.scope ?? ALL_SCOPE;
+    const key = limitKey(scope, pair.label);
+    if (carried.has(key) || !applies(key))
+      continue;
+    const existing = entries.get(key);
+    entries.set(key, existing === undefined || existing.kind === "absent" ? { scope, label: pair.label, kind: "absent", checkedAt: at } : { scope, label: pair.label, kind: "retired", retiredAt: at });
+  }
+  const { limits: _limits, budget: _budget, counters: _counters, credits: _credits, ...unknownKeys } = base;
+  const budget = mergeBudget(base.budget, observation.budget, at);
+  const counters = mergeCounters(base.counters, observation.counters);
+  const credits = mergeCredits(base.credits, observation.credits);
+  return {
+    ...unknownKeys,
+    limits: [...entries.values()].sort(compareEntries),
+    ...budget === undefined ? {} : { budget },
+    ...counters === undefined ? {} : { counters },
+    ...credits === undefined ? {} : { credits }
+  };
 }
-var defaultEngine = createEngine();
-function createLogger(channel) {
-  return defaultEngine.createLogger(channel);
+
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/quota/codec.js
+var quotaCodec = Object.freeze({
+  validate: isQuotaMap,
+  decode: decodeQuotaMap,
+  merge: mergeQuotaObservation
+});
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/quota/format.js
+var QUOTA_STALE_AFTER_MS = 15 * 60000;
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/errors.js
+class ClaustrumConsumerError extends Error {
+  kind;
+  constructor(kind, message) {
+    super(message);
+    this.name = "ClaustrumConsumerError";
+    this.kind = kind;
+  }
+}
+
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.js
+function matches(entry, credentialId, accountIdentity) {
+  if (entry.accountIdentity !== undefined && accountIdentity !== undefined)
+    return entry.accountIdentity === accountIdentity;
+  return entry.credentialId === credentialId;
+}
+function isDeclined(entries, credentialId, accountIdentity) {
+  return entries.some((entry) => matches(entry, credentialId, accountIdentity));
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/quota/commit-interval.js
+function declineAccount(entries, credentialId, accountIdentity) {
+  const entry = {
+    credentialId,
+    ...accountIdentity !== undefined && { accountIdentity }
+  };
+  return [
+    ...entries.filter((existing) => existing.credentialId !== credentialId || existing.accountIdentity !== accountIdentity),
+    entry
+  ];
+}
+function acceptAccount(entries, credentialIds, accountIdentity) {
+  return entries.filter((entry) => !credentialIds.some((id) => matches(entry, id, accountIdentity)));
+}
+
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/quota-writer.js
+import { resolve as resolve7 } from "node:path";
+
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/quota/commit-interval.js
 var QUOTA_COMMIT_INTERVAL_MS = 30000;
 var quotaCommitTimer = {
   now: () => performance.now(),
@@ -4118,7 +4934,7 @@ var quotaCommitTimer = {
   }
 };
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/quota/pending.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/quota/pending.js
 function quotaFields(publication, witness = "") {
   const result = new Map;
   const { observation } = publication;
@@ -4166,12 +4982,12 @@ function quotaFields(publication, witness = "") {
   return result;
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/quota-writer.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/quota-writer.js
 var writers = new Map;
 var logger = createLogger("claustrum");
 var COALESCE_MS = 100;
 function writerFor(path, clock = quotaCommitTimer) {
-  const key = resolve6(path);
+  const key = resolve7(path);
   let writer = writers.get(key);
   if (!writer) {
     writer = {
@@ -4235,7 +5051,7 @@ function orderedFields(pending) {
   return [...pending.values()].flatMap((account) => [...account.values()]).sort((a, b) => a.order - b.order);
 }
 function pendingVaultQuota(path, roster) {
-  const writer = writers.get(resolve6(path));
+  const writer = writers.get(resolve7(path));
   if (writer) {
     for (const field of orderedFields(writer.pending)) {
       if (field.priorReading)
@@ -4246,7 +5062,7 @@ function pendingVaultQuota(path, roster) {
   return roster;
 }
 function hasPendingVaultQuota(path) {
-  return !!writers.get(resolve6(path))?.pending.size;
+  return !!writers.get(resolve7(path))?.pending.size;
 }
 function schedule(writer, delay) {
   if (writer.running || writer.timer || !writer.pending.size || writer.abort.signal.aborted)
@@ -4311,7 +5127,7 @@ function flush(writer) {
   return writer.running;
 }
 async function drainVaultQuota(path, timeoutMs = 1000) {
-  const key = resolve6(path);
+  const key = resolve7(path);
   const writer = writers.get(key);
   if (!writer)
     return;
@@ -4351,7 +5167,7 @@ async function drainVaultQuota(path, timeoutMs = 1000) {
   }
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/roster.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/roster.js
 function vaultRosterSeed(roster) {
   return {
     declined: roster.declined.map((entry) => ({ ...entry })),
@@ -4769,16 +5585,16 @@ function applyVaultQuota(current, input) {
 }
 var pendingDiscoveries = new Map;
 function forgetPendingVaultDiscovery(path) {
-  pendingDiscoveries.delete(resolve7(path));
+  pendingDiscoveries.delete(resolve8(path));
 }
 function isVaultRosterLockRefusal(path, error) {
-  const target = resolve7(path);
+  const target = resolve8(path);
   if (error instanceof ClaustrumConsumerError)
     return error.kind === "roster-busy";
   if (error instanceof LockContentionError || error instanceof LockOwnershipError)
-    return resolve7(error.details.target) === target;
+    return resolve8(error.details.target) === target;
   if (error instanceof PrivateFileError) {
-    const failed = resolve7(error.path);
+    const failed = resolve8(error.path);
     return [WRITE_LOCK.name, DISCOVERY_LEASE.name].some((name) => {
       const lock = lockPathFor(target, name);
       return failed === lock || failed.startsWith(`${lock}.`);
@@ -4839,7 +5655,7 @@ async function refreshVaultRoster(options) {
       throw new ClaustrumConsumerError("roster-busy", "Claustrum account discovery is already in progress");
     return persisted;
   }
-  const key = resolve7(options.path);
+  const key = resolve8(options.path);
   const listedOver = options.listedOver;
   let discovered;
   try {
@@ -4897,7 +5713,7 @@ async function refreshVaultRoster(options) {
   }
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/limits/vault-adapter.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/vault-adapter.js
 function bindingsOf(namespace, roster) {
   return (roster?.rows ?? []).map((row) => ({
     account: {
@@ -4911,7 +5727,7 @@ function bindingsOf(namespace, roster) {
 }
 async function createVaultLimitsAdapter(options) {
   const { namespace, path } = options;
-  const generation = randomUUID5();
+  const generation = randomUUID6();
   let history = new EnvelopeHistory;
   const guard = new EnvelopeGuard(namespace, options.logger);
   const repair = new EnvelopeRepair(options.logger);
@@ -4992,7 +5808,7 @@ async function createVaultLimitsAdapter(options) {
   await read();
   return adapter;
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/redaction/index.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/redaction/index.js
 import { types } from "node:util";
 var escapedErrorField = /"(?:e|\\u0065)(?:r|\\u0072){2}(?:o|\\u006f)(?:r|\\u0072)"\s*:/i;
 var escapedErrorType = /"(?:t|\\u0074)(?:y|\\u0079)(?:p|\\u0070)(?:e|\\u0065)"\s*:\s*"(?:e|\\u0065)(?:r|\\u0072){2}(?:o|\\u006f)(?:r|\\u0072)"/i;
@@ -5585,7 +6401,7 @@ async function createAccountLimits(options, acquire = acquireLimitsRegistry, war
     options.provider,
     canonicalLimitsPath(options.path)
   ]);
-  const producerId = randomUUID6();
+  const producerId = randomUUID7();
   let adapter;
   let hydrated;
   let registry;
@@ -5801,7 +6617,7 @@ async function createAccountLimits(options, acquire = acquireLimitsRegistry, war
       registry.enqueue({
         ...observation,
         producerId,
-        operationId: randomUUID6(),
+        operationId: randomUUID7(),
         type: "mark",
         ...target,
         until: mark.until,
@@ -5820,7 +6636,7 @@ async function createAccountLimits(options, acquire = acquireLimitsRegistry, war
       clearLimitsAfterProbe(registry, {
         ...observation,
         producerId,
-        operationId: randomUUID6(),
+        operationId: randomUUID7(),
         keys: [target],
         evidenceAt: observation.observedAt,
         cause
@@ -5847,7 +6663,69 @@ function limitRefusal(decision, host, now) {
     throw new Error("claustrum-auth: unsupported limit refusal");
   return localLimitRefusal(new Response(wire.body, { status: wire.status, headers: wire.headers }), wire.hostRetry);
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/routing/sticky.js
+
+// ../core/src/routing.ts
+var routingDeclinedText = "Thalamus routing declined this request, so it was not sent.";
+var routingNoAnswerText = "Thalamus routing did not answer, so this API key request was not sent.";
+function routingRefusalText(code) {
+  if (code === "routing-declined")
+    return routingDeclinedText;
+  if (code === "routing-no-answer")
+    return routingNoAnswerText;
+  return;
+}
+function hasVaultRoutingAccessor() {
+  try {
+    return typeof Reflect.get(globalThis, Symbol.for("cortexkit.routing")) === "function";
+  } catch {
+    return false;
+  }
+}
+async function selectRoutedKey(consumer, provider, modelId, sessionId, excluded = new Set, nextRoute) {
+  if (!hasVaultRoutingAccessor())
+    return;
+  const routes = consumer.routingRows();
+  const roster = consumer.snapshot?.()?.rows ?? [];
+  const next = nextRoute ?? routes.find((row) => !excluded.has(row.id))?.id;
+  if (roster.find((row) => row.routeId === next)?.credentialType === "oauth")
+    return;
+  if (!sessionId)
+    throw new ClaustrumAuthError("routing-no-answer");
+  const enabled = new Set(routes.map((row) => row.id));
+  const candidates = roster.filter((row) => enabled.has(row.routeId) && !excluded.has(row.routeId) && row.credentialType === "api_key").map((row) => ({
+    routeId: row.routeId,
+    credentialId: row.credentialId,
+    accountId: row.accountIdentity ?? row.credentialId
+  }));
+  const answer = await askRouting({
+    sessionId,
+    provider,
+    modelId,
+    candidates,
+    refusals: true
+  });
+  if (!answer)
+    throw new ClaustrumAuthError("routing-no-answer");
+  if ("refused" in answer)
+    throw new ClaustrumAuthError("routing-declined");
+  return answer.candidate;
+}
+async function reportRoutedBalance(key, sessionId, service, status, body) {
+  if (!key || !sessionId || status !== 402)
+    return;
+  const text = await body().catch(() => "");
+  if (!isBalanceFailure(service, text))
+    return;
+  const providerCode = service === "openrouter" ? "openrouter_credits" : "http_402";
+  reportRouting({
+    sessionId,
+    accountId: key.accountId,
+    credentialId: key.credentialId,
+    outcome: "credential_refused",
+    providerCode
+  });
+}
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/routing/sticky.js
 var QUOTA_STALENESS_MS = 15 * 60000;
 var MIN_RESET_HOURS = 1 / 60;
 // ../core/src/serving.ts
@@ -5919,11 +6797,13 @@ function createFetch(options) {
       cache: request.cache
     };
     const tried = new Set;
+    let routedAttempt = false;
     const rejected = new Set;
     const secrets = [];
+    let redirectBilling;
     let pending;
     let history = createRequestHistory({
-      requestId: randomUUID7(),
+      requestId: randomUUID8(),
       originalUrl: url.href,
       clockNow: now()
     });
@@ -5978,10 +6858,26 @@ function createFetch(options) {
     try {
       for (;; ) {
         signal.throwIfAborted();
+        if (routedAttempt && pending && !pending.parsed)
+          return await redactResponse(pending.response, secrets);
         const rows = await candidates();
+        const ownDecision = pending ? decide("after-limit", rows, pending.response.status, pending.account, pending.parsed) : decide("pre-send", rows);
+        if (ownDecision.action === "pass" && pending)
+          return await redactResponse(pending.response, secrets);
+        const nextRoute = ownDecision.action === "reroute" ? ownDecision.account.accountId : rows.find((row) => row.admitted && row.placementEligible)?.account.accountId;
+        const routed = await selectRoutedKey(options.consumer, options.routing?.provider ?? options.entry.service, options.routing?.modelId ?? "", options.routing?.sessionId, new Set([...tried, ...rejected]), nextRoute);
+        routedAttempt = routed !== undefined;
+        const routedId = routed?.routeId;
         if (!pending && !rows.some((row) => row.admitted))
           throw new ClaustrumAuthError("no-vault-account");
-        const initial = pending ? decide("after-limit", rows, pending.response.status, pending.account, pending.parsed) : decide("pre-send", rows);
+        const initial = routed ? {
+          action: "reroute",
+          account: rows.find((row) => row.account.accountId === routedId)?.account ?? {
+            namespace: "claustrum-auth:routing",
+            accountId: routed.routeId,
+            incarnation: "routing"
+          }
+        } : ownDecision;
         if (initial.action === "pass" && pending)
           return await redactResponse(pending.response, secrets);
         if (initial.action === "refuse") {
@@ -5991,11 +6887,11 @@ function createFetch(options) {
         if (initial.action !== "reroute")
           throw new Error("claustrum-auth: unsupported limit action");
         const route = initial.account.accountId;
-        if (limits && !await limits.beforeDispatch(route)) {
+        if (!routed && limits && !await limits.beforeDispatch(route)) {
           rejected.add(route);
           continue;
         }
-        if (limits) {
+        if (!routed && limits) {
           if (!(await candidates()).find((row) => row.account.accountId === route)?.ready)
             continue;
         }
@@ -6012,7 +6908,9 @@ function createFetch(options) {
         for (;; ) {
           signal.throwIfAborted();
           checkOrigin(target, options.entry);
-          response = await options.consumer.send(route, async (receipt, dispatchSignal) => {
+          const dispatch = async (receipt, dispatchSignal) => {
+            if (routed && receipt.credentialId !== routed.credentialId)
+              throw new ClaustrumAuthError("routing-no-answer");
             secrets.push(receipt.accessToken);
             const draft = placeReceipt(target, headers, options.entry, receipt);
             const dispatchHeaders = new Headers(draft.headers);
@@ -6030,8 +6928,25 @@ function createFetch(options) {
               credentials: template.credentials,
               cache: template.cache
             });
-            return options.fetch(outbound);
-          }, { site: "claustrum-auth", signal });
+            let billing;
+            try {
+              const reply = await options.fetch(outbound);
+              if (options.billing && [301, 302, 303, 307, 308].includes(reply.status) && reply.headers.has("location")) {
+                redirectBilling = { receipt, status: reply.status };
+                return reply;
+              }
+              billing = options.billing?.(receipt);
+              return observeBillingResponse(billing, reply);
+            } catch (error) {
+              const failedBilling = billing ?? options.billing?.(receipt);
+              failedBilling?.end(false, false);
+              throw error;
+            }
+          };
+          response = await options.consumer.send(route, dispatch, {
+            site: "claustrum-auth",
+            signal
+          });
           signal.throwIfAborted();
           const location = response.headers.get("location");
           if (![301, 302, 303, 307, 308].includes(response.status) || !location)
@@ -6046,6 +6961,7 @@ function createFetch(options) {
             await response.body?.cancel().catch(() => {});
             throw new ClaustrumAuthError("redirect-limit");
           }
+          redirectBilling = undefined;
           await response.body?.cancel().catch(() => {});
           if (response.status === 303 && method !== "HEAD" || [301, 302].includes(response.status) && method === "POST") {
             method = "GET";
@@ -6053,8 +6969,17 @@ function createFetch(options) {
           }
           target = next;
         }
+        if (redirectBilling) {
+          const billing = options.billing?.(redirectBilling.receipt);
+          redirectBilling = undefined;
+          response = observeBillingResponse(billing, response);
+        }
+        const account = observation?.binding.account ?? {
+          ...initial.account,
+          accountId: route
+        };
         const parsed = await limitFromReply({
-          account: observation?.binding.account ?? initial.account,
+          account,
           service: options.entry.service,
           status: response.status,
           headers: response.headers,
@@ -6062,6 +6987,7 @@ function createFetch(options) {
           now: now()
         });
         const balance402 = parsed?.kind === "payment-balance";
+        await reportRoutedBalance(routed, options.routing?.sessionId, options.entry.service, response.status, () => response.clone().text());
         if (response.ok || response.status === 402 && !balance402) {
           if (limits && observation) {
             if (hasBalanceRule(options.entry.service) && observation.paymentProbe)
@@ -6085,20 +7011,22 @@ function createFetch(options) {
         }
         pending = {
           response,
-          account: observation?.binding.account ?? initial.account,
+          account,
           parsed
         };
       }
     } catch (error) {
+      if (redirectBilling)
+        options.billing?.(redirectBilling.receipt)?.end(false, false, redirectBilling.status);
       await pending?.response.body?.cancel().catch(() => {});
       throw redactError(error, secrets);
     }
   };
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/index.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/index.js
 import { ClaustrumClient } from "@cortexkit/claustrum-client";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/availability.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/availability.js
 import { ClaustrumCredentialError } from "@cortexkit/claustrum-client";
 import { SocketClosedError, SocketTimeoutError, SubcCallError } from "@cortexkit/subc-client";
 var VAULT_FAILURE_CLASSES = Object.freeze({
@@ -6175,9 +7103,12 @@ var VAULT_FAILURE_CLASSES = Object.freeze({
 });
 
 class ClaustrumUnreachableError extends ClaustrumConsumerError {
-  constructor() {
+  reason;
+  constructor(reason) {
     super("unavailable", "Claustrum scoped operation unavailable");
     this.name = "ClaustrumUnreachableError";
+    if (reason === "host-accessor-missing" || reason === "host-accessor-failed")
+      this.reason = reason;
   }
 }
 function classifyVaultFailure(error) {
@@ -6189,12 +7120,12 @@ function classifyVaultFailure(error) {
   return VAULT_FAILURE_CLASSES[code];
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/insula.js
-import { resolve as resolve8 } from "node:path";
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/insula.js
+import { resolve as resolve9 } from "node:path";
 import { storeIdentity } from "@cortexkit/claustrum-client";
 import { SubcClient } from "@cortexkit/subc-client";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/watch.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/watch.js
 var SAFETY_POLL_MS = 5 * 60000;
 var WATCH_RETRY_MS = 5 * 60000;
 var RESUBSCRIBE_BACKOFF_MS = 1000;
@@ -6390,7 +7321,7 @@ class ScopedRosterWatch {
   }
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/insula.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/insula.js
 function insulaUsageTransport(options) {
   const identity = options.identity ?? storeIdentity(options.projectRoot ?? process.cwd(), options.storagePath ?? process.cwd());
   return {
@@ -6491,7 +7422,7 @@ var MAX_AGE = 4 * MINUTE;
 var COLD_WAIT = 2 * MINUTE;
 var sources = new Map;
 var attempts = new Map;
-function record2(value) {
+function record3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function decodeUsageNotice(body) {
@@ -6501,7 +7432,7 @@ function decodeUsageNotice(body) {
   } catch {
     return;
   }
-  if (!record2(value) || typeof value.kind !== "string" || typeof value.epoch !== "string" || value.epoch.length === 0 || typeof value.seq !== "number" || !Number.isSafeInteger(value.seq) || value.seq < 1 || value.provider !== undefined && typeof value.provider !== "string")
+  if (!record3(value) || typeof value.kind !== "string" || typeof value.epoch !== "string" || value.epoch.length === 0 || typeof value.seq !== "number" || !Number.isSafeInteger(value.seq) || value.seq < 1 || value.provider !== undefined && typeof value.provider !== "string")
     return;
   return {
     kind: value.kind,
@@ -6524,9 +7455,9 @@ class InsulaQuotaSource {
   #reads = new CoalescedRead(async () => {
     try {
       const reply = await this.transport.getUsage();
-      if (!record2(reply) || !Array.isArray(reply.result) || reply.error !== undefined)
+      if (!record3(reply) || !Array.isArray(reply.result) || reply.error !== undefined)
         throw new Error("unavailable insula usage");
-      this.#entries = reply.result.filter((entry) => record2(entry) && typeof entry.provider === "string");
+      this.#entries = reply.result.filter((entry) => record3(entry) && typeof entry.provider === "string");
       this.#available = this.#entries.length === reply.result.length && (reply.completeProviders === undefined || Array.isArray(reply.completeProviders) && reply.completeProviders.every((value) => typeof value === "string"));
       this.#completeProviders = new Set(this.#available && Array.isArray(reply.completeProviders) ? reply.completeProviders : []);
       for (const provider of this.#completeProviders)
@@ -6674,7 +7605,7 @@ class InsulaQuotaSource {
     for (const entry of this.#entries) {
       if (entry.provider !== provider || typeof entry.account !== "string" || entry.account.trim() !== accountId)
         continue;
-      if (entry.stale !== undefined || entry.errorClass !== undefined || !record2(entry.usage))
+      if (entry.stale !== undefined || entry.errorClass !== undefined || !record3(entry.usage))
         continue;
       const fetchedAt = typeof entry.fetchedAt === "string" ? Date.parse(entry.fetchedAt) : Number.NaN;
       if (!Number.isFinite(fetchedAt) || now - fetchedAt >= MAX_AGE)
@@ -6702,7 +7633,7 @@ class InsulaQuotaSource {
       return { miss: "unreachable" };
     if (entry) {
       const fetchedAt = typeof entry.fetchedAt === "string" ? Date.parse(entry.fetchedAt) : Number.NaN;
-      if (!record2(entry.usage) || !Number.isFinite(fetchedAt))
+      if (!record3(entry.usage) || !Number.isFinite(fetchedAt))
         return { miss: "unreachable" };
       const reading = {
         entry,
@@ -6711,7 +7642,7 @@ class InsulaQuotaSource {
           ...typeof entry.source === "string" && { source: entry.source }
         }
       };
-      if (entry.stale !== undefined && (!record2(entry.stale) || entry.stale.class !== "local_source_unavailable"))
+      if (entry.stale !== undefined && (!record3(entry.stale) || entry.stale.class !== "local_source_unavailable"))
         return { miss: "upstream-failed", reading };
       return now >= fetchedAt + MAX_AGE || entry.stale !== undefined ? { miss: "stale", reading } : { reading };
     }
@@ -6724,8 +7655,8 @@ class InsulaQuotaSource {
 }
 function acquireInsulaQuotaSource(transport, tokenPath) {
   const key = JSON.stringify([
-    resolve8(transport.connectionFile),
-    resolve8(tokenPath)
+    resolve9(transport.connectionFile),
+    resolve9(tokenPath)
   ]);
   let shared = sources.get(key);
   if (!shared) {
@@ -6746,10 +7677,10 @@ function acquireInsulaQuotaSource(transport, tokenPath) {
   };
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/index.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/index.js
 import { ClaustrumCredentialError as ClaustrumCredentialError6 } from "@cortexkit/claustrum-client";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/util/any-signal.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/util/any-signal.js
 function combineAbortSignals(signals) {
   const controller = new AbortController;
   const listeners = [];
@@ -6786,17 +7717,17 @@ function combineAbortSignals(signals) {
   return { signal: controller.signal, dispose };
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/custody.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/custody.js
 import { channel } from "node:diagnostics_channel";
 import { ClaustrumCredentialError as ClaustrumCredentialError5 } from "@cortexkit/claustrum-client";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.js
 import { constants as fsConstants } from "node:fs";
-import { chmod, mkdir as mkdir3, open as open4, readFile as readFile3, realpath, rename as rename4, stat as stat4, unlink as unlink2 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname6, extname, isAbsolute, join as join5, resolve as resolve9 } from "node:path";
+import { chmod, mkdir as mkdir3, open as open4, readFile as readFile3, realpath, rename as rename4, stat as stat4, unlink as unlink3 } from "node:fs/promises";
+import { basename as basename3, dirname as dirname6, extname, isAbsolute, join as join5, resolve as resolve10 } from "node:path";
 import { ClaustrumCredentialError as ClaustrumCredentialError3, ClaustrumClient as ClaustrumWireClient, writeEnrollmentTokenFile } from "@cortexkit/claustrum-client";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/host.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/host.js
 import { ClaustrumCredentialError as ClaustrumCredentialError2 } from "@cortexkit/claustrum-client";
 var VAULT_HOST_STATUS = "Served by Thalamus";
 var hostClients = new WeakSet;
@@ -6813,7 +7744,7 @@ function hostError(error) {
   if (typeof value.code === "string" && (value.class === "transient" || value.class === "permanent" || value.class === "auth_required" || value.class === "context_overflow") && (value.action === "gone" || value.action === "reauth" || value.action === "retry" || value.action === "reduce_and_retry"))
     return new ClaustrumCredentialError2(value.code, value.class, value.action);
   if (value.name === "ClaustrumUnreachableError" || typeof value.code === "string" && classifyVaultFailure(Object.assign(new Error, { code: value.code })) === "unreachable")
-    return new ClaustrumUnreachableError;
+    return new ClaustrumUnreachableError(value.reason === "host-accessor-missing" || value.reason === "host-accessor-failed" ? value.reason : undefined);
   return error;
 }
 function call(operation) {
@@ -6879,17 +7810,18 @@ function connectVaultHost(pluginId) {
     throw new ClaustrumUnreachableError;
   try {
     const accessor = globalThis[Symbol.for("cortexkit.vault")];
-    if (typeof accessor !== "function")
-      throw new ClaustrumUnreachableError;
-    const client = wrapHostClient(accessor(pluginId));
-    hostClients.add(client);
-    return client;
+    if (typeof accessor === "function") {
+      const client = wrapHostClient(accessor(pluginId));
+      hostClients.add(client);
+      return client;
+    }
   } catch {
-    throw new ClaustrumUnreachableError;
+    throw new ClaustrumUnreachableError("host-accessor-failed");
   }
+  throw new ClaustrumUnreachableError("host-accessor-missing");
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.js
 var ENROLLMENT_SCHEMA = 1;
 var ENROLLMENT_FILE_MAX_BYTES = 16 * 1024;
 var TOKEN_RE = /^[0-9a-f]{64}$/;
@@ -6906,9 +7838,28 @@ var TERMINAL_ENROLLMENT_CODES = new Set([
 var RETRYABLE_ENROLLMENT_CODES = new Set([
   "pending_queue_full"
 ]);
+function validEnrollmentRequestedGrants(grants) {
+  return Array.isArray(grants) && grants.length >= 1 && grants.length <= 4 && Array.from(grants).every((grant) => {
+    if (!isRecord4(grant) || Object.keys(grant).length !== 2 || grant.operation !== "read" && grant.operation !== "list" || !isRecord4(grant.selector))
+      return false;
+    const keys = Object.keys(grant.selector);
+    const key = keys[0];
+    return keys.length === 1 && (key === "category" || key === "exact") && typeof grant.selector[key] === "string" && grant.selector[key].trim().length > 0;
+  });
+}
+function grantProposal(state) {
+  return {
+    ...state.requestedGrants !== undefined && {
+      requestedGrants: state.requestedGrants
+    },
+    ...state.requestedGrantsStatus !== undefined && {
+      requestedGrantsStatus: state.requestedGrantsStatus
+    }
+  };
+}
 function getClaustrumEnrollmentPaths(tokenPath) {
   const extension = extname(tokenPath) || ".json";
-  const stem = basename2(tokenPath, extname(tokenPath));
+  const stem = basename3(tokenPath, extname(tokenPath));
   return {
     statePath: join5(dirname6(tokenPath), `${stem}-state${extension}`),
     tokenPath
@@ -6918,7 +7869,7 @@ function hostEnrollmentPaths(input) {
   const override = input.override?.trim();
   if (override && !isAbsolute(override) && !input.cwd)
     throw new ClaustrumConsumerError("invalid-state", "A relative Claustrum enrollment override needs a base directory");
-  const tokenPath = override ? isAbsolute(override) ? override : resolve9(input.cwd, override) : join5(input.stateDir, `${input.host}-enrollment.json`);
+  const tokenPath = override ? isAbsolute(override) ? override : resolve10(input.cwd, override) : join5(input.stateDir, `${input.host}-enrollment.json`);
   return getClaustrumEnrollmentPaths(tokenPath);
 }
 function isRecord4(value) {
@@ -6938,6 +7889,7 @@ function decodeEnrollmentState(value) {
     throw invalidState();
   }
   if (value.phase === "pending") {
+    const grants = decodeGrantProposal(value);
     if (!TOKEN_RE.test(String(value.requestSecret ?? "")) || value.requestId !== undefined && (typeof value.requestId !== "string" || value.requestId.length === 0) || !validTimestamp(value.createdAt) || !validTimestamp(value.updatedAt)) {
       throw invalidState();
     }
@@ -6950,10 +7902,12 @@ function decodeEnrollmentState(value) {
         requestId: value.requestId
       },
       createdAt: value.createdAt,
-      updatedAt: value.updatedAt
+      updatedAt: value.updatedAt,
+      ...grants
     };
   }
   if (value.phase === "approved") {
+    const grants = decodeGrantProposal(value);
     if (value.approvedName !== undefined && (typeof value.approvedName !== "string" || value.approvedName.length === 0) || !validGeneration(value.tokenGeneration) || !validTimestamp(value.updatedAt)) {
       throw invalidState();
     }
@@ -6965,7 +7919,8 @@ function decodeEnrollmentState(value) {
         approvedName: value.approvedName
       },
       tokenGeneration: value.tokenGeneration,
-      updatedAt: value.updatedAt
+      updatedAt: value.updatedAt,
+      ...grants
     };
   }
   if (value.phase === "denied" || value.phase === "blocked") {
@@ -6984,6 +7939,11 @@ function decodeEnrollmentState(value) {
   }
   throw invalidState();
 }
+function decodeGrantProposal(value) {
+  if (value.requestedGrants !== undefined && !validEnrollmentRequestedGrants(value.requestedGrants) || value.requestedGrantsStatus !== undefined && (value.requestedGrants === undefined || value.requestedGrantsStatus !== "sent" && value.requestedGrantsStatus !== "dropped"))
+    return {};
+  return grantProposal(value);
+}
 function decodeTokenFile(value) {
   if (!isRecord4(value) || !TOKEN_RE.test(String(value.token ?? "")) || !validGeneration(value.token_generation)) {
     throw new ClaustrumConsumerError("invalid-token", "invalid Claustrum enrollment token file");
@@ -7096,7 +8056,8 @@ async function readEnrollmentStatus(paths, proposedName) {
         ...state?.phase === "approved" && state.approvedName !== undefined && {
           approvedName: state.approvedName
         },
-        tokenGeneration: token.token_generation
+        tokenGeneration: token.token_generation,
+        ...state && (state.phase === "approved" || state.phase === "pending") && grantProposal(state)
       }
     };
   }
@@ -7155,7 +8116,8 @@ function statusFromState(state) {
     return {
       state: "pending",
       proposedName: state.proposedName,
-      ...state.requestId !== undefined && { requestId: state.requestId }
+      ...state.requestId !== undefined && { requestId: state.requestId },
+      ...grantProposal(state)
     };
   }
   if (state.phase === "approved") {
@@ -7165,7 +8127,8 @@ function statusFromState(state) {
       ...state.approvedName !== undefined && {
         approvedName: state.approvedName
       },
-      tokenGeneration: state.tokenGeneration
+      tokenGeneration: state.tokenGeneration,
+      ...grantProposal(state)
     };
   }
   if (state.phase === "denied")
@@ -7177,10 +8140,10 @@ function statusFromState(state) {
   };
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/host-slot.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/host-slot.js
 var CUSTODY_PLACEHOLDER_PREFIX = "claustrum-tombstone:v1:";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/shutdown.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/shutdown.js
 function shutdownWarning(logger, shutdown) {
   let warned = false;
   return (pendingOperations) => {
@@ -7218,7 +8181,7 @@ async function drainShutdown(pending, onTimeout) {
   }
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/usage.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/usage.js
 import { ClaustrumCredentialError as ClaustrumCredentialError4 } from "@cortexkit/claustrum-client";
 function plain(value) {
   return value !== null && typeof value === "object" && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
@@ -7346,7 +8309,7 @@ class ScopedUsageReporter {
   }
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/custody.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/custody.js
 function isScopedCredentialRotation(served, current) {
   return current !== undefined && !current.fromKeptReceipt && !served.fromKeptReceipt && current.credentialId === served.credentialId && current.accountIdentity === served.accountIdentity && current.recordVersion !== served.recordVersion;
 }
@@ -7523,8 +8486,14 @@ class ClaustrumScopedCustody {
     this.#warnShutdown = shutdownWarning(this.#logger);
     this.#setTimeout = options.setTimeoutImpl ?? setTimeout;
     this.#clearTimeout = options.clearTimeoutImpl ?? clearTimeout;
+    const currentClient = () => this.#client;
     this.#usage = new ScopedUsageReporter({
-      client: this.#client,
+      client: {
+        get reportUsageScoped() {
+          const client = currentClient();
+          return client.reportUsageScoped?.bind(client);
+        }
+      },
       owns: (id) => this.#usageServed.has(id),
       token: async () => hasVaultHost() ? "" : checkedEnrollmentToken(await this.#readToken()),
       logger: this.#logger,
@@ -7532,11 +8501,21 @@ class ClaustrumScopedCustody {
       clearTimeout: this.#clearTimeout
     });
   }
+  replaceClient(next) {
+    this.#check();
+    if (next === this.#client)
+      return;
+    if (hasVaultHost() && !isVaultHostClient(next))
+      throw new ClaustrumUnreachableError;
+    this.#client = next;
+    for (const watch of this.#watches)
+      watch.restart();
+  }
   transportLost(error) {
     if (this.#closed || this.#outage)
       return;
     this.#outage = true;
-    this.#outageError = error instanceof ClaustrumCredentialError5 ? error : new ClaustrumUnreachableError;
+    this.#outageError = error instanceof ClaustrumCredentialError5 ? error : new ClaustrumUnreachableError(error instanceof ClaustrumUnreachableError ? error.reason : undefined);
     this.#logger.warn("serving kept vault receipt", { reason: "unreachable" });
     this.#scheduleProbe();
   }
@@ -7633,7 +8612,7 @@ class ClaustrumScopedCustody {
       if (error instanceof ClaustrumCredentialError5)
         throw error;
       if (classifyVaultFailure(error) === "unreachable")
-        throw new ClaustrumUnreachableError;
+        throw new ClaustrumUnreachableError(error instanceof ClaustrumUnreachableError ? error.reason : undefined);
       throw new ClaustrumConsumerError("unavailable", "Claustrum scoped operation unavailable");
     } finally {
       removeAbortListener?.();
@@ -7833,7 +8812,7 @@ class ClaustrumScopedCustody {
     if (kept.since === null)
       kept.since = this.#now();
     const attempt = Object.freeze(Object.defineProperty({ ...kept.attempt, fromKeptReceipt: true }, "accessToken", { value: kept.attempt.accessToken, enumerable: false }));
-    this.#provenance.set(attempt, this.#provenance.get(kept.attempt) ?? { token, client: this.#client });
+    this.#provenance.set(attempt, this.#provenance.get(kept.attempt) ?? { token });
     this.#keptAttempts.set(attempt, routeId);
     return attempt;
   }
@@ -7888,7 +8867,7 @@ class ClaustrumScopedCustody {
       recordVersion: served.recordVersion,
       expiresAtMs
     }, "accessToken", { value: accessToken, enumerable: false }));
-    this.#provenance.set(attempt, { token, client: this.#client });
+    this.#provenance.set(attempt, { token });
     return attempt;
   }
   async reportFailure(attempt, status, reporterSource) {
@@ -7913,7 +8892,7 @@ class ClaustrumScopedCustody {
     const pending = this.#reports.get(attempt);
     if (pending)
       return pending;
-    const report = this.#call(() => provenance.client.reportAuthFailureScoped({
+    const report = this.#call(() => this.#client.reportAuthFailureScoped({
       credentialId: attempt.credentialId,
       enrollmentToken: provenance.token,
       providerStatus: 401,
@@ -7935,34 +8914,62 @@ class ClaustrumScopedCustody {
   }
   watchRoster(options) {
     this.#check();
-    const watch = new ScopedRosterWatch({
-      client: this.#client,
-      enrollmentToken: () => this.#token(),
-      view: options.view ?? (() => this.#discoveredView),
-      discover: async (view) => {
-        await options.onView(view);
-      },
-      onRefused: (error) => {
-        this.listFailed(error);
-        options.onRefused?.(error);
+    const currentView = options.view ?? (() => this.#discoveredView);
+    let discovering;
+    let watch;
+    const create = (resubscribed = false) => {
+      const opened = new ScopedRosterWatch({
+        client: this.#client,
+        enrollmentToken: () => this.#token(),
+        view: () => resubscribed ? undefined : currentView(),
+        discover: async (view) => {
+          while (discovering)
+            await discovering.catch(() => {});
+          if (watch !== opened)
+            return;
+          resubscribed = false;
+          discovering = Promise.resolve().then(() => options.onView(view));
+          try {
+            await discovering;
+          } finally {
+            discovering = undefined;
+          }
+        },
+        onRefused: (error) => {
+          this.listFailed(error);
+          options.onRefused?.(error);
+        },
+        onTransportLost: () => this.transportLost(),
+        onReachable: () => this.reachable(),
+        onError: options.onError,
+        onMode: options.onMode,
+        logger: this.#logger,
+        now: this.#now,
+        setTimeoutImpl: this.#setTimeout,
+        clearTimeoutImpl: this.#clearTimeout
+      });
+      return opened;
+    };
+    watch = create();
+    const tracked = {
+      restart: () => {
+        const previousMode = watch.mode;
+        watch.stop();
+        watch = create(true);
+        if (previousMode !== watch.mode)
+          options.onMode?.(watch.mode);
+        watch.start();
       },
-      onTransportLost: () => this.transportLost(),
-      onReachable: () => this.reachable(),
-      onError: options.onError,
-      onMode: options.onMode,
-      logger: this.#logger,
-      now: this.#now,
-      setTimeoutImpl: this.#setTimeout,
-      clearTimeoutImpl: this.#clearTimeout
-    });
-    this.#watches.add(watch);
+      stop: () => watch.stop()
+    };
+    this.#watches.add(tracked);
     watch.start();
     return {
       get mode() {
         return watch.mode;
       },
       close: () => {
-        this.#watches.delete(watch);
+        this.#watches.delete(tracked);
         watch.stop();
       }
     };
@@ -8008,7 +9015,7 @@ class ClaustrumScopedCustody {
   }
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/consumer.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/consumer.js
 var DEFAULT_CONNECT_TIMEOUT_MS = 1e4;
 function unreachableConnect() {
   return new ClaustrumUnreachableError;
@@ -8719,11 +9726,11 @@ class ClaustrumConsumer {
     await this.#disposing;
   }
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/hub.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/hub.js
 import { createHash as createHash3 } from "node:crypto";
 import { channel as channel2 } from "node:diagnostics_channel";
-import { readdir, stat as stat5 } from "node:fs/promises";
-import { dirname as dirname7, join as join6, resolve as resolve10 } from "node:path";
+import { readdir as readdir2, stat as stat5 } from "node:fs/promises";
+import { dirname as dirname7, join as join6, resolve as resolve11 } from "node:path";
 var sharedRosters = new Map;
 var FILE_ID = /^[a-z0-9][a-z0-9._-]{0,63}$/;
 var WINDOWS_DEVICE = /^(con|prn|aux|nul|com[0-9]|lpt[0-9])(\.|$)/;
@@ -8919,7 +9926,7 @@ class ClaustrumDiscoveryHub {
     };
     const { consumer, hooks } = createHubMember(port, consumerOptions);
     entry.hooks = hooks;
-    const path = resolve10(entry.path);
+    const path = resolve11(entry.path);
     const subscribers = sharedRosters.get(path) ?? new Set;
     const install = (roster) => {
       if (entry.closed || this.#active !== true || !this.#current || !this.#live(this.#current) || !hooks.roster() || this.#collides(hooks, roster))
@@ -8950,7 +9957,7 @@ class ClaustrumDiscoveryHub {
       return;
     entry.seen = JSON.stringify(decodedVaultRoster(roster));
     entry.hooks?.install(roster);
-    for (const install of sharedRosters.get(resolve10(entry.path)) ?? []) {
+    for (const install of sharedRosters.get(resolve11(entry.path)) ?? []) {
       if (!this.#live(generation))
         return;
       if (install !== entry.receiveRoster)
@@ -9370,7 +10377,7 @@ class ClaustrumDiscoveryHub {
     const name = `${entry.provider}.json`;
     const candidates = [join6(this.#generationDirectory, name)];
     try {
-      for (const key of await readdir(this.#generationDirectory))
+      for (const key of await readdir2(this.#generationDirectory))
         if (key !== this.#key && FINGERPRINT.test(key))
           candidates.push(join6(this.#generationDirectory, key, name));
     } catch {}
@@ -9567,7 +10574,7 @@ class ClaustrumDiscoveryHub {
   }
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/claustrum/index.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/index.js
 var SCOPED_CONNECT_TIMEOUT_MS = 1e4;
 async function connectClaustrumScopedClient(options) {
   const { connectTimeoutMs, ...client } = options;
@@ -9595,12 +10602,12 @@ async function connectClaustrumScopedClient(options) {
 }
 // ../core/src/menu.ts
 import { Readable, Writable } from "node:stream";
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/store/hooks.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/store/hooks.js
 import { AsyncLocalStorage } from "node:async_hooks";
 var insideHook = new AsyncLocalStorage;
 var insideCodec = new AsyncLocalStorage;
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.js
 var POOL_LOCK_DEFAULTS = Object.freeze({
   ttlMs: 1e4,
   timeoutMs: 15000,
@@ -9608,15 +10615,15 @@ var POOL_LOCK_DEFAULTS = Object.freeze({
   renew: true
 });
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/store/schema.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/store/schema.js
 var POOL_KEY = "commonAuthPool";
 var REFRESH_STAMP_TOLERANCE_MS = 5 * 60000;
 var UNSAFE_IDS = new Set(["__proto__", "constructor", "prototype"]);
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/store/provider-state.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/store/provider-state.js
 var DECLINE_TRANSITION = Symbol.for("@cortexkit/common-auth/store/decline-transition");
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/store/settings.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/store/settings.js
 var POOL_OWNED_KEYS = Object.freeze([
   "version",
   "accounts",
@@ -9624,9 +10631,9 @@ var POOL_OWNED_KEYS = Object.freeze([
 ]);
 var settingsCache = new FileReadCache;
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/store/pool.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/store/pool.js
 var processMemory = new Map;
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/auth-menu/ansi.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/auth-menu/ansi.js
 var ANSI = {
   hide: "\x1B[?25l",
   show: "\x1B[?25h",
@@ -9708,7 +10715,7 @@ function truncateAnsi(input, maxVisibleChars) {
   return output.includes("\x1B[") ? `${output}${ANSI.reset}${suffix}` : output + suffix;
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/auth-menu/terminal.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/auth-menu/terminal.js
 function processTerminal() {
   return {
     input: process.stdin,
@@ -9724,7 +10731,7 @@ function printLine(terminal, line = "") {
 `);
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/auth-menu/select.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/auth-menu/select.js
 var ESCAPE_TIMEOUT_MS = 50;
 function colorCode(color) {
   if (color === "red")
@@ -9862,7 +10869,7 @@ async function select(terminal, items, options) {
   });
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/auth-menu/confirm.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/auth-menu/confirm.js
 async function confirm(terminal, message, defaultYes = false) {
   if (!isInteractive(terminal))
     return false;
@@ -9876,7 +10883,7 @@ async function confirm(terminal, message, defaultYes = false) {
   return await select(terminal, items, { message }) ?? false;
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/auth-menu/menu.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/auth-menu/menu.js
 function menuContext(terminal) {
   const interactive = isInteractive(terminal);
   return {
@@ -10046,9 +11053,24 @@ async function vaultMenuText(options, args = "") {
   return text.trimEnd();
 }
 // ../core/src/providers.ts
+var openAIUsage = {
+  input: ["usage.prompt_tokens", "usage.input_tokens"],
+  output: ["usage.completion_tokens", "usage.output_tokens"],
+  cacheRead: [
+    "usage.prompt_tokens_details.cached_tokens",
+    "usage.input_tokens_details.cached_tokens"
+  ],
+  reasoning: [
+    "usage.completion_tokens_details.reasoning_tokens",
+    "usage.output_tokens_details.reasoning_tokens"
+  ],
+  promptIncludesCache: true,
+  reasoningIncludedInOutput: true
+};
 var supportedProviders = [
   {
     service: "cerebras",
+    billing: { ...openAIUsage, implicitCache: true },
     ids: ["cerebras"],
     hosts: { opencode1: "cerebras", opencode2: "cerebras", pi: "cerebras" },
     class: "A",
@@ -10056,6 +11078,8 @@ var supportedProviders = [
   },
   {
     service: "cline-pass",
+    chargeBasis: "subscription_included",
+    billing: { ...openAIUsage },
     ids: ["cline-pass"],
     credentialIds: ["apikey:cline-pass"],
     hosts: { opencode1: "cline-pass", opencode2: "cline-pass" },
@@ -10064,6 +11088,12 @@ var supportedProviders = [
   },
   {
     service: "deepseek",
+    chargeBasis: "metered_api",
+    billing: {
+      ...openAIUsage,
+      cacheRead: ["usage.prompt_cache_hit_tokens", ...openAIUsage.cacheRead],
+      implicitCache: true
+    },
     ids: ["deepseek"],
     hosts: { opencode1: "deepseek", opencode2: "deepseek", pi: "deepseek" },
     class: "A",
@@ -10071,6 +11101,15 @@ var supportedProviders = [
   },
   {
     service: "fireworks",
+    chargeBasis: "metered_api",
+    billing: {
+      ...openAIUsage,
+      cacheRead: [
+        "perf_metrics.cached-prompt-tokens",
+        ...openAIUsage.cacheRead
+      ],
+      implicitCache: true
+    },
     ids: ["fireworks-ai"],
     hosts: {
       opencode1: "fireworks-ai",
@@ -10082,6 +11121,12 @@ var supportedProviders = [
   },
   {
     service: "inception",
+    chargeBasis: "metered_api",
+    billing: {
+      ...openAIUsage,
+      cacheRead: ["usage.cached_input_tokens", ...openAIUsage.cacheRead],
+      reasoning: ["usage.reasoning_tokens", ...openAIUsage.reasoning]
+    },
     ids: ["inception"],
     hosts: { opencode1: "inception", opencode2: "inception" },
     class: "A",
@@ -10089,6 +11134,12 @@ var supportedProviders = [
   },
   {
     service: "kimi-coding",
+    chargeBasis: "subscription_included",
+    billing: {
+      ...openAIUsage,
+      cacheWrite: ["usage.prompt_tokens_details.cache_write_tokens"],
+      implicitCache: true
+    },
     ids: ["kimi-code-plan-global"],
     hosts: {
       opencode1: "kimi-code-plan-global",
@@ -10100,6 +11151,8 @@ var supportedProviders = [
   },
   {
     service: "minimax-coding-plan",
+    chargeBasis: "subscription_included",
+    billing: { ...openAIUsage, implicitCache: true },
     ids: ["minimax-coding-plan"],
     hosts: { opencode2: "minimax-coding-plan" },
     class: "A",
@@ -10107,6 +11160,7 @@ var supportedProviders = [
   },
   {
     service: "ollama-cloud",
+    billing: { ...openAIUsage },
     ids: ["ollama-cloud"],
     hosts: { opencode1: "ollama-cloud", opencode2: "ollama-cloud" },
     class: "A",
@@ -10114,6 +11168,11 @@ var supportedProviders = [
   },
   {
     service: "openrouter",
+    chargeBasis: "metered_api",
+    billing: {
+      ...openAIUsage,
+      cacheWrite: ["usage.prompt_tokens_details.cache_write_tokens"]
+    },
     ids: ["openrouter"],
     hosts: {
       opencode1: "openrouter",
@@ -10125,6 +11184,7 @@ var supportedProviders = [
   },
   {
     service: "synthetic",
+    billing: { ...openAIUsage },
     ids: ["synthetic"],
     hosts: { opencode1: "synthetic", opencode2: "synthetic" },
     class: "A",
@@ -10132,6 +11192,12 @@ var supportedProviders = [
   },
   {
     service: "typesafe",
+    chargeBasis: "metered_api",
+    billing: {
+      input: ["usage.input_tokens"],
+      output: ["usage.output_tokens"],
+      promptIncludesCache: false
+    },
     ids: ["typesafe"],
     hosts: { opencode1: "typesafe", opencode2: "typesafe" },
     class: "A",
@@ -10139,6 +11205,8 @@ var supportedProviders = [
   },
   {
     service: "meta",
+    chargeBasis: "metered_api",
+    billing: { ...openAIUsage, implicitCache: true },
     ids: ["meta"],
     hosts: { opencode1: "meta", opencode2: "meta", pi: "meta" },
     class: "A",
@@ -10146,6 +11214,8 @@ var supportedProviders = [
   },
   {
     service: "xai",
+    chargeBasis: "metered_api",
+    billing: { ...openAIUsage, implicitCache: true },
     ids: ["xai"],
     hosts: { opencode1: "xai", opencode2: "xai", pi: "xai" },
     class: "A",
@@ -10154,6 +11224,7 @@ var supportedProviders = [
   },
   {
     service: "opencode-go",
+    billing: { ...openAIUsage, opencodeTokens: true },
     ids: ["opencode-go"],
     hosts: {
       opencode1: "opencode-go",
@@ -10165,6 +11236,8 @@ var supportedProviders = [
   },
   {
     service: "opencode-zen",
+    chargeBasis: "metered_api",
+    billing: { ...openAIUsage, opencodeTokens: true },
     ids: ["opencode"],
     hosts: { opencode1: "opencode", pi: "opencode" },
     class: "A",
@@ -10400,14 +11473,14 @@ async function startupStep(step, action) {
 import path2 from "node:path";
 import { resolveClaustrumConnectionPath } from "@cortexkit/claustrum-client";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/pi-slot/slot.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/pi-slot/slot.js
 import { createHash as createHash4 } from "node:crypto";
 import { constants } from "node:fs";
-import { lstat as lstat4, mkdir as mkdir5, open as open5, unlink as unlink3 } from "node:fs/promises";
-import { dirname as dirname8, resolve as resolve11 } from "node:path";
+import { lstat as lstat4, mkdir as mkdir5, open as open5, unlink as unlink4 } from "node:fs/promises";
+import { dirname as dirname8, resolve as resolve12 } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/pi-slot/lock.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/pi-slot/lock.js
 import { rmdirSync, statSync as statSync2, utimesSync } from "node:fs";
 import { mkdir as mkdir4, rmdir, stat as stat6, utimes } from "node:fs/promises";
 var STALE = 30000;
@@ -10599,7 +11672,7 @@ async function acquirePiLock(authPath, onCompromised, onRenew) {
   };
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.41.1+693d25d9c0e91d8a/node_modules/@cortexkit/common-auth/dist/pi-slot/slot.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/pi-slot/slot.js
 class PiSlotError extends Error {
   code;
   constructor(code) {
@@ -10668,13 +11741,13 @@ function rootSpans(text) {
   }
   return root;
 }
-function object(value) {
+function object2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function canonical(value) {
   if (Array.isArray(value))
     return `[${value.map(canonical).join(",")}]`;
-  if (object(value)) {
+  if (object2(value)) {
     return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`;
   }
   return JSON.stringify(value);
@@ -10683,7 +11756,7 @@ function digest(value) {
   return createHash4("sha256").update(canonical(value)).digest("hex");
 }
 function code(error) {
-  return object(error) ? error.code : undefined;
+  return object2(error) ? error.code : undefined;
 }
 async function safeRead(path, privateFile = false, afterReadCheck) {
   if (windowsPrivateFiles) {
@@ -10732,7 +11805,7 @@ async function safeRead(path, privateFile = false, afterReadCheck) {
 function parseAuth(text, provider) {
   try {
     const data = JSON.parse(text);
-    if (!object(data))
+    if (!object2(data))
       throw new Error;
     const root = rootSpans(text);
     const properties = root.children;
@@ -10741,7 +11814,7 @@ function parseAuth(text, provider) {
       throw new Error;
     const property = properties.find((node) => node.key === provider);
     const entry = property ? data[provider] : null;
-    if (entry !== null && !object(entry))
+    if (entry !== null && !object2(entry))
       throw new Error;
     if (property && entry === null)
       throw new Error;
@@ -10807,8 +11880,8 @@ function createPiSlot(options, onStep, hooks) {
   if (!provider || !options.authPath || !options.stashPath || !placeholderKey || placeholderKey.startsWith("!") || placeholderKey.includes("$") || !Number.isFinite(timeout) || timeout < 0) {
     throw new PiSlotError("invalid-options");
   }
-  const authPath = resolve11(options.authPath);
-  const stashPath = resolve11(options.stashPath);
+  const authPath = resolve12(options.authPath);
+  const stashPath = resolve12(options.stashPath);
   if (authPath === stashPath || stashPath === `${authPath}.lock`) {
     throw new PiSlotError("invalid-options");
   }
@@ -10822,7 +11895,7 @@ function createPiSlot(options, onStep, hooks) {
       return;
     try {
       const stash = JSON.parse(text);
-      if (stash.version !== 1 || stash.provider !== provider || stash.authIdentity !== authIdentity || stash.placeholderIdentity !== placeholderIdentity || stash.entry !== null && !object(stash.entry) || stash.sha256 !== digest(stash.entry) || (stash.entry === null ? stash.entryJson !== null : typeof stash.entryJson !== "string" || digest(JSON.parse(stash.entryJson)) !== stash.sha256)) {
+      if (stash.version !== 1 || stash.provider !== provider || stash.authIdentity !== authIdentity || stash.placeholderIdentity !== placeholderIdentity || stash.entry !== null && !object2(stash.entry) || stash.sha256 !== digest(stash.entry) || (stash.entry === null ? stash.entryJson !== null : typeof stash.entryJson !== "string" || digest(JSON.parse(stash.entryJson)) !== stash.sha256)) {
         throw new Error;
       }
       return stash;
@@ -10882,7 +11955,7 @@ function createPiSlot(options, onStep, hooks) {
   }
   async function deleteStash(assertLock) {
     assertLock();
-    await unlink3(stashPath);
+    await unlink4(stashPath);
     await syncDir(dirname8(stashPath));
     onStep?.("stash-deleted");
   }
@@ -10997,6 +12070,9 @@ class FlagStore {
 var refused = "Request refused locally by the claustrum-auth plugin:";
 var nothingSent = "Nothing was sent.";
 function refusalText(code, provider, entry) {
+  const routing = routingRefusalText(code);
+  if (routing)
+    return routing;
   switch (code) {
     case "placement-refused":
       return `${refused} this model's request carries the ${provider} vault placeholder outside the Authorization header, and vault keys are only sent as Authorization: Bearer. ${nothingSent}`;
@@ -11231,13 +12307,34 @@ class PiRuntime {
   stream(served, model, context, options) {
     if (options?.apiKey !== served.placeholder)
       return streamSimple(model, context, options);
+    const sessionId = options.sessionId ?? this.#ctx.sessionManager?.getSessionId();
+    const routing = {
+      sessionId,
+      provider: model.provider,
+      modelId: model.id
+    };
     const inner = options.fetch ?? globalThis.fetch;
-    return streamSimple(model, context, {
+    if (!hasBillingAccessor())
+      return streamSimple(model, context, {
+        ...options,
+        fetch: this.ownedFetch(served, inner, undefined, routing)
+      });
+    let current;
+    let attempt = 0;
+    const stream = streamSimple(model, context, {
       ...options,
-      fetch: this.ownedFetch(served, inner)
+      fetch: this.ownedFetch(served, inner, (receipt) => {
+        current?.end();
+        if (!sessionId || !hasBillingAccessor())
+          return;
+        current = new BillingAttempt(served.entry, model.provider, sessionId, "primary", model.id, receipt, ++attempt, true);
+        return current;
+      }, routing)
     });
+    stream.result().then((message) => current?.piEnd(message.responseId, message.stopReason), () => current?.end());
+    return stream;
   }
-  ownedFetch(served, inner) {
+  ownedFetch(served, inner, billing, routing) {
     const serve = createFetch({
       entry: served.entry,
       placeholder: served.placeholder,
@@ -11245,7 +12342,9 @@ class PiRuntime {
       host: "pi",
       fetch: inner,
       rateLimitMarks: served.marks,
-      limits: () => this.#core.limits(served.provider)
+      limits: () => this.#core.limits(served.provider),
+      billing,
+      routing
     });
     return async (input, init) => {
       try {