@cortexkit/pi-claustrum-auth 0.3.0 → 0.4.0

package/dist/index.js

@@ -140,10 +140,10 @@ function isBalanceFailure(service, body) {
 }
 // ../core/src/billing.ts
 import { randomUUID } from "node:crypto";
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/opencode2/integration.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/opencode2/integration.js
 var PLACEHOLDER_LIFETIME_MS = 365 * 24 * 60 * 60 * 1000;
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/opencode2/sse.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/opencode2/sse.js
 function parseBlock(block) {
   const data = [];
   let event;
@@ -197,7 +197,7 @@ function watchServerSentEvents(onEvent, onError) {
     }
   });
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/routing-accessor/handle.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/routing-accessor/handle.js
 function routingHandle(sessionId) {
   const routing = Reflect.get(globalThis, Symbol.for("cortexkit.routing"));
   if (typeof routing !== "function")
@@ -206,7 +206,7 @@ function routingHandle(sessionId) {
   return typeof handle === "object" && handle !== null ? handle : undefined;
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/routing-accessor/cache-policy.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/routing-accessor/cache-policy.js
 var CACHE_WARM_STOP_REASONS = [
   "cost-cap",
   "count-cap",
@@ -293,7 +293,7 @@ function sessionCachePolicy(sessionId) {
   }
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/routing-accessor/index.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/routing-accessor/index.js
 function isObject(value) {
   return typeof value === "object" && value !== null;
 }
@@ -347,6 +347,87 @@ function billingUsage(value) {
   }
   return Object.keys(usage).length > 0 ? usage : undefined;
 }
+function selectionFor(answer, candidates) {
+  if (!isObject(answer))
+    return;
+  const accountId = answer.account_id;
+  const credentialId = answer.credential_id;
+  if (typeof accountId !== "string")
+    return;
+  if (credentialId !== undefined && typeof credentialId !== "string") {
+    return;
+  }
+  const candidate = candidates.find((route) => route.accountId === accountId && (credentialId === undefined || route.credentialId === credentialId));
+  if (!candidate)
+    return;
+  const hold = answer.hold;
+  const retryAfterMs = isObject(hold) ? hold.retry_after_ms : undefined;
+  if (typeof retryAfterMs === "number" && Number.isFinite(retryAfterMs) && retryAfterMs >= 0) {
+    return { candidate, hold: { retry_after_ms: retryAfterMs } };
+  }
+  return { candidate };
+}
+function refusalFor(value) {
+  if (!isObject(value))
+    return;
+  const code = value.code;
+  if (code !== "account_limit_exhausted" && code !== "account_selection_refused" && code !== "account_selection_final") {
+    return;
+  }
+  const refused = { code };
+  const routingCode = value.routing_code;
+  if (typeof routingCode === "string" && /^[a-z0-9._-]{1,64}$/.test(routingCode)) {
+    refused.routingCode = routingCode;
+  }
+  const retryAfterSecs = value.retry_after_secs;
+  if (typeof retryAfterSecs === "number" && Number.isFinite(retryAfterSecs) && retryAfterSecs >= 0) {
+    refused.retryAfterSecs = retryAfterSecs;
+  }
+  const resetsAtMs = value.resets_at_ms;
+  if (typeof resetsAtMs === "number" && Number.isSafeInteger(resetsAtMs) && resetsAtMs > 0) {
+    refused.resetsAtMs = resetsAtMs;
+  }
+  return { refused };
+}
+async function askRouting(input) {
+  let timer;
+  try {
+    const handle = routingHandle(input.sessionId);
+    if (!handle)
+      return;
+    const accountFor = handle.accountFor;
+    if (typeof accountFor !== "function")
+      return;
+    const requested = input.deadlineMs ?? 1500;
+    const deadlineMs = Number.isNaN(requested) ? 1500 : Math.min(2000, Math.max(1, requested));
+    const expired = new Promise((resolve) => {
+      timer = setTimeout(() => resolve(undefined), deadlineMs);
+      timer.unref();
+    });
+    const request = {
+      provider: input.provider,
+      modelId: input.modelId
+    };
+    const cap = input.holdWaitMaxS;
+    if (typeof cap === "number" && Number.isFinite(cap)) {
+      request.hold_wait_max_s = Math.max(0, Math.floor(cap));
+    }
+    if (input.refusals === true)
+      request.refusals = true;
+    const pending = accountFor.call(handle, request, { deadlineMs });
+    if (!isObject(pending) || typeof pending.then !== "function")
+      return;
+    const answer = await Promise.race([pending, expired]);
+    if (input.refusals === true && isObject(answer) && "refused" in answer) {
+      return refusalFor(answer.refused);
+    }
+    return selectionFor(answer, input.candidates);
+  } catch {
+    return;
+  } finally {
+    clearTimeout(timer);
+  }
+}
 function reportRouting(input) {
   try {
     const handle = routingHandle(input.sessionId);
@@ -448,6 +529,17 @@ function reportRouting(input) {
           };
           break;
         }
+        case "credential_refused": {
+          const { credentialId, providerCode } = input;
+          if (!isNonEmptyString(credentialId) || typeof providerCode !== "string" || !/^[a-z0-9._-]{1,64}$/.test(providerCode))
+            return;
+          payload = {
+            ...identity,
+            outcome: "credential_refused",
+            provider_code: providerCode
+          };
+          break;
+        }
         default:
           return;
       }
@@ -711,7 +803,7 @@ function observeBillingResponse(record, response) {
 // ../core/src/fetch.ts
 import { randomUUID as randomUUID8 } from "node:crypto";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/request-history.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/request-history.js
 function sameAccount(a, b) {
   return a.namespace === b.namespace && a.accountId === b.accountId && a.incarnation === b.incarnation;
 }
@@ -809,7 +901,7 @@ var REQUEST_EXCLUSION_EFFECTS = Object.freeze({
   chargeSwitch: false
 });
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/activity.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/activity.js
 function effectiveCacheTtlMs(ttlMs) {
   return ttlMs !== undefined && Number.isFinite(ttlMs) && ttlMs >= 0 ? ttlMs : 300000;
 }
@@ -854,7 +946,7 @@ function createSessionActivityStore() {
     }
   };
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/scope.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/scope.js
 function scopeCovers(scope, model, familyOf) {
   switch (scope.kind) {
     case "pool":
@@ -865,20 +957,20 @@ function scopeCovers(scope, model, familyOf) {
       return scope.model === model;
   }
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/hold.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/hold.js
 var MAX_SAME_ACCOUNT_HOLD_MS = 3621000;
 function readMaxSameAccountWait(value) {
   return value === 0 || value === 15 || value === "max" ? value : 15;
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/jitter.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/jitter.js
 import { createHash } from "node:crypto";
 function holdDelayMs(sessionId, delayMs) {
   const seconds = createHash("sha256").update(sessionId).digest().readUInt32BE(0);
   return 1000 * (Math.max(1, Math.ceil(delayMs / 1000)) + seconds % 21);
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/terminal.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/terminal.js
 function scanTerminalReset(input, now) {
   if (!Number.isFinite(input.maxAgeMs) || input.maxAgeMs < 0)
     return;
@@ -979,7 +1071,7 @@ function terminalRefusalDecision(facts, axes, history, metadata) {
   return { ...wait, action: "hold", account: kept.account };
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/wake.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/wake.js
 function waitCheckpoint(accountKey, decidedAt, windows) {
   return {
     accountKey: { ...accountKey },
@@ -1001,7 +1093,7 @@ function liftedWindowsForWake(wake, account, windows, now) {
   return windows.filter((window) => canLift(window) && windows.filter((other) => other.confirmed && other.window === window.window).every(canLift)).map((window) => window.window);
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/decide.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/decide.js
 function finiteFuture(value, now) {
   return value !== undefined && Number.isFinite(value) && value > now;
 }
@@ -1266,7 +1358,7 @@ function decideAfterLimit(facts, axes) {
     return refusal(facts, axes, history, "quota");
   return pass("no-override");
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/duration.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/duration.js
 function formatDuration(ms) {
   if (!Number.isFinite(ms))
     return "unknown";
@@ -1286,7 +1378,7 @@ function formatDuration(ms) {
   return `${remainingMinutes}m`;
 }
 var formatReset = ({ resetAt, now }) => formatDuration(resetAt - now);
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/envelope.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/envelope.js
 var envelopeError = Symbol.for("@cortexkit/common-auth/limits-envelope-error");
 
 class LimitsEnvelopeConflictError extends Error {
@@ -1373,7 +1465,7 @@ class EnvelopeGuard {
     return true;
   }
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/wording.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/wording.js
 var openCode1Patterns = [
   /429|500|502|503|504|524/i,
   /rate increased too quickly|rate limit|rate-limit|rate_limit|too many requests/i,
@@ -1439,7 +1531,7 @@ function hasUnsafeWording(text) {
   return openCode1Patterns.some((pattern) => pattern.test(text)) || pi140Pattern.test(text);
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/labels.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/labels.js
 var emailPattern = /[^\s@]+@[^\s@]+\.[^\s@]+/;
 function containsEmail(text) {
   return emailPattern.test(text);
@@ -1448,7 +1540,7 @@ function sanitizeRefusalLabel(label) {
   return containsEmail(label) || hasUnsafeWording(label) ? "this account" : label;
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/families.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/families.js
 class ClaudeIncompleteError extends Error {
   code = "ECONNRESET";
   syscall = "sticky-routing";
@@ -1566,7 +1658,7 @@ function buildRefusal(input) {
     body
   };
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/identity.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/identity.js
 function isIdentityCompatible(a, b) {
   return sameAccount(a.account, b.account) && (a.identity === undefined || b.identity === undefined || a.identity === b.identity);
 }
@@ -1582,7 +1674,7 @@ function validateIdentityFence(observed, authoritative, authorizeEpoch) {
     return "credential-epoch";
   return;
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/marker.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/marker.js
 var ANTIGRAVITY_FAILURE_LADDER = Object.freeze({
   kind: "failure-ladder",
   mergeLaw: "max-until",
@@ -1653,7 +1745,7 @@ function markFromSignal(signal, axes, history) {
     ...axes.kind === "hint" && axes.causes?.some((cause) => cause === signal.kind) ? { cause: signal.kind } : {}
   } : undefined;
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/merge-laws.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/merge-laws.js
 function mergeTimedMarkEntries(law, entries, now, clearRevision = 0) {
   const candidates = entries.filter((e) => e.baseRevision >= clearRevision);
   if (law !== "max-until") {
@@ -1675,7 +1767,7 @@ function mergeAccessState(a, b) {
   }
   return a.committedRevision > b.committedRevision ? a : b;
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/namespace.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/namespace.js
 var LIMITS_HISTORY_BOUND = 1024;
 function storedCause(cause) {
   return cause === "rate-limit" || cause === "payment-balance" ? cause : undefined;
@@ -1868,7 +1960,7 @@ function applyLimitsCommands(initial, commands, context) {
   }
   return { snapshot, outcomes };
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/path.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/path.js
 import { realpathSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 function canonicalLimitsPath(path) {
@@ -1890,7 +1982,7 @@ function canonicalLimitsPath(path) {
     }
   }
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/persistence.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/persistence.js
 class LimitsPersistenceRefusal extends Error {
   code;
   constructor(code) {
@@ -1899,7 +1991,7 @@ class LimitsPersistenceRefusal extends Error {
     this.name = "LimitsPersistenceRefusal";
   }
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/envelope-loss.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/envelope-loss.js
 import { AsyncResource } from "node:async_hooks";
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
@@ -2024,7 +2116,7 @@ class EnvelopeHistory {
     }, now);
   }
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/presets.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/presets.js
 function immutable(value) {
   if (value && typeof value === "object") {
     for (const child of Object.values(value))
@@ -2264,7 +2356,7 @@ var limitPresets = immutable({
   "window-router": windowRouter,
   "status-vault-order": statusVaultOrder
 });
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/registry.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/registry.js
 import { AsyncResource as AsyncResource2 } from "node:async_hooks";
 var LIMITS_REGISTRY_KEY = Symbol.for("@cortexkit/common-auth/limits-registry/schema-v1");
 var PREFIX = "@cortexkit/common-auth/limits-registry/schema-v";
@@ -2729,20 +2821,20 @@ async function acquireLimitsRegistry(options) {
 // ../core/src/limits.ts
 import { randomUUID as randomUUID7 } from "node:crypto";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/vault-adapter.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/vault-adapter.js
 import { randomUUID as randomUUID6 } from "node:crypto";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/roster.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/roster.js
 import { createHash as createHash2 } from "node:crypto";
 import { stat as stat3 } from "node:fs/promises";
 import { resolve as resolve8 } from "node:path";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/fs/file-read-cache.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/fs/file-read-cache.js
 import { lstat, stat } from "node:fs/promises";
 import { resolve as resolve2 } from "node:path";
-async function identity(path, followSymlinks) {
+async function identity(path, probe) {
   try {
-    const metadata = await (followSymlinks ? stat(path) : lstat(path));
+    const metadata = await probe(path);
     return metadata.isFile() ? metadata : undefined;
   } catch (error) {
     return error.code === "ENOENT" ? "absent" : undefined;
@@ -2755,15 +2847,15 @@ function sameIdentity(left, right) {
 }
 
 class FileReadCache {
-  #followSymlinks;
+  #probe;
   #entries = new Map;
   constructor(options = {}) {
-    this.#followSymlinks = options.followSymlinks ?? false;
+    this.#probe = options.followSymlinks ? (path) => (options.stat ?? stat)(path) : (path) => (options.lstat ?? lstat)(path);
   }
   async read(paths, read, validateHit) {
     const resolvedPaths = paths.map((path) => resolve2(path));
     const key = JSON.stringify(resolvedPaths);
-    const probed = await Promise.all(resolvedPaths.map((path) => identity(path, this.#followSymlinks)));
+    const probed = await Promise.all(resolvedPaths.map((path) => identity(path, this.#probe)));
     const identities = probed.every((entry) => entry !== undefined) ? probed : undefined;
     const cached = this.#entries.get(key);
     if (identities && cached && identities.every((entry, index) => {
@@ -2787,12 +2879,12 @@ class FileReadCache {
   }
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/fs/atomic-write.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/fs/atomic-write.js
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { mkdir, open, rename as rename2, rm } from "node:fs/promises";
 import { dirname as dirname3 } from "node:path";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/fs/private-files.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/fs/private-files.js
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { lstat as lstat2, readFile, rename, unlink } from "node:fs/promises";
 import { tmpdir } from "node:os";
@@ -3087,7 +3179,7 @@ async function writePrivateAtomic(path, bytes, options = {}) {
   }
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/fs/atomic-write.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/fs/atomic-write.js
 class AtomicSyncError extends Error {
   constructor(cause) {
     super("file or directory sync failed", { cause });
@@ -3148,7 +3240,7 @@ async function writeJsonAtomicTracked(path, value, options, onRenamed) {
       await rm(tempPath, { force: true }).catch(() => {});
   }
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/fs/lock-constants.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/fs/lock-constants.js
 var WRITER_LOCK_CONSTANTS = Object.freeze({
   sidebar: Object.freeze({
     name: "sidebar-write",
@@ -3163,679 +3255,1095 @@ var WRITER_LOCK_CONSTANTS = Object.freeze({
     renew: true
   })
 });
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.js
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { link, lstat as lstat3, mkdir as mkdir2, open as open2, readFile as readFile2, rename as rename3, rm as rm2, stat as stat2 } from "node:fs/promises";
-import { dirname as dirname4, join as join4 } from "node:path";
+import { link, lstat as lstat3, mkdir as mkdir2, open as open3, readdir, readFile as readFile2, rename as rename3, rm as rm2, stat as stat2, unlink as unlink2 } from "node:fs/promises";
+import { basename as basename2, dirname as dirname5, join as join4 } from "node:path";
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/logger/engine.js
+import { appendFileSync, chmodSync, existsSync, renameSync, statSync } from "node:fs";
+import { open as open2 } from "node:fs/promises";
+import { dirname as dirname4, resolve as resolve4 } from "node:path";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/fs/lock-record.js
-import { resolve as resolve4 } from "node:path";
-class DisappearedLockRecordError extends Error {
-  path;
-  code = "ENOENT";
-  constructor(path, cause) {
-    super(`Lock record disappeared: ${path}`, { cause });
-    this.path = path;
-  }
-}
-function isWindowsAccessDeniedRead(error, paths) {
-  return error instanceof PrivateFileError && error.reason === "io-error" && error.win32Code === 5 && (error.stage === "read" || error.stage === "verify") && paths.some((path) => resolve4(path) === error.path);
-}
-function isWindowsAccessDeniedCreate(error, paths, stage) {
-  return error instanceof PrivateFileError && error.reason === "io-error" && error.win32Code === 5 && error.stage === stage && paths.some((path) => resolve4(path) === error.path);
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/logger/redact.js
+var SECRET_KEY_EXACT = /^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i;
+var TOKEN_VALUE = /\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g;
+var MASK = "***REDACTED***";
+var MAX_ERROR_DEPTH = 8;
+function isError(value) {
+  return value instanceof Error || Object.prototype.toString.call(value) === "[object Error]";
 }
-async function readLockRecord(path, read) {
-  try {
-    return await read();
-  } catch (error) {
-    if (!isWindowsAccessDeniedRead(error, [path]))
-      throw error;
+function createRedactor(options = {}) {
+  const patterns = [TOKEN_VALUE, ...options.extraValuePatterns ?? []].map((pattern) => new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`));
+  function isSecretKey(key) {
+    const normalized = key.toLowerCase().replace(/[-_]/g, "");
+    return SECRET_KEY_EXACT.test(key) || normalized.includes("apikey") || normalized.endsWith("secret") || normalized.endsWith("password") || normalized.endsWith("token") && !normalized.endsWith("tokens") || !!options.extraSecretKeys?.(normalized);
+  }
+  function errorEntries(error) {
+    const fields = error;
+    const entries = [
+      ["name", error.name],
+      ["message", error.message],
+      ["stack", error.stack]
+    ];
+    for (const key of ["code", "status", "cause"])
+      if (fields[key] !== undefined)
+        entries.push([key, fields[key]]);
+    const listed = new Set(entries.map(([key]) => key));
+    for (const entry of Object.entries(error))
+      if (!listed.has(entry[0]))
+        entries.push(entry);
+    return entries;
+  }
+  function walk(value, keys, seen, errorDepth = 0) {
+    if (typeof value === "string") {
+      return patterns.reduce((text, pattern) => text.replace(pattern, MASK), value);
+    }
+    if (!value || typeof value !== "object")
+      return value;
+    if (seen.has(value))
+      return "[Circular]";
+    seen.add(value);
     try {
-      return await read();
-    } catch (recheckError) {
-      if (recheckError.code === "ENOENT")
-        throw new DisappearedLockRecordError(path, error);
-      throw error;
+      if (Array.isArray(value))
+        return value.map((item) => walk(item, keys, seen, errorDepth));
+      const error = isError(value);
+      if (error && errorDepth >= MAX_ERROR_DEPTH)
+        return "[Truncated]";
+      const childDepth = error ? errorDepth + 1 : errorDepth;
+      return Object.fromEntries((error ? errorEntries(value) : Object.entries(value)).map(([key, item]) => [
+        key,
+        keys && isSecretKey(key) ? MASK : walk(item, keys, seen, childDepth)
+      ]));
+    } finally {
+      seen.delete(value);
     }
   }
+  return {
+    redact: (value) => walk(value, true, new WeakSet),
+    redactStrings: (value) => walk(value, false, new WeakSet)
+  };
 }
+var defaultRedactor = createRedactor();
+var redact = defaultRedactor.redact;
+var redactStrings = defaultRedactor.redactStrings;
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/fs/with-lock.js
-import { join as join3, resolve as resolve5 } from "node:path";
-function lockPathFor(target, name) {
-  return `${target}.${name}.lock`;
-}
-
-class LockContentionError extends Error {
-  details;
-  constructor(details) {
-    super(`Timed out acquiring ${details.name} lock for ${details.target}`);
-    this.name = "LockContentionError";
-    this.details = details;
-  }
-}
-
-class LockOwnershipError extends Error {
-  details;
-  constructor(details) {
-    super(`Lost ${details.name} lock for ${details.target}`);
-    this.name = "LockOwnershipError";
-    this.details = details;
-  }
-}
-function isChangingLockRecord(error, target, name) {
-  const path = resolve5(lockPathFor(target, name));
-  const paths = [path, join3(path, "owner.json")];
-  return (isWindowsSharingViolation(error) || isWindowsAccessDeniedRead(error, paths)) && (error.stage === "read" || error.stage === "verify") && paths.includes(error.path) || windowsPrivateFiles && (isWindowsAccessDeniedCreate(error, [path], "create") || isWindowsAccessDeniedCreate(error, [`${path}.evicting`], "directory-create"));
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/logger/engine.js
+var ORDER = {
+  error: 0,
+  warn: 1,
+  info: 2,
+  debug: 3,
+  trace: 4
+};
+var MAX_BYTES = 5 * 1024 * 1024;
+var ROTATE_KEEP = 3;
+function chmodPrivate(path) {
+  try {
+    chmodSync(path, 384);
+  } catch {}
 }
-async function withLock(target, options, fn) {
-  const started = performance.now();
-  let changingRecordError;
-  for (;; ) {
-    options.signal?.throwIfAborted();
-    let lock;
-    try {
-      lock = await acquireRefreshFileLock({
-        path: target,
-        name: options.name,
-        ttlMs: options.ttlMs,
-        renew: options.renew ?? false,
-        ...options.onStep ? { onStep: options.onStep } : {},
-        ...options.onRenewalTimer ? { onRenewalTimer: options.onRenewalTimer } : {}
-      });
-      changingRecordError = undefined;
-    } catch (error) {
-      if (!isChangingLockRecord(error, target, options.name))
-        throw error;
-      lock = null;
-      changingRecordError ??= error;
-    }
-    if (lock) {
-      try {
-        options.signal?.throwIfAborted();
-        return await fn(lock);
-      } finally {
-        await lock.release(options.signal);
+function rotateIfNeeded(f) {
+  try {
+    if (!(existsSync(f) && statSync(f).size >= MAX_BYTES))
+      return;
+    for (let i = ROTATE_KEEP - 1;i >= 1; i--) {
+      if (existsSync(`${f}.${i}`)) {
+        const rotated = `${f}.${i + 1}`;
+        renameSync(`${f}.${i}`, rotated);
+        chmodPrivate(rotated);
       }
     }
-    const remaining = options.timeoutMs - (performance.now() - started);
-    if (remaining <= 0) {
-      if (changingRecordError)
-        throw changingRecordError;
-      throw new LockContentionError({
-        target,
-        name: options.name,
-        timeoutMs: options.timeoutMs
-      });
-    }
-    await new Promise((resolve) => setTimeout(resolve, Math.min(25, Math.ceil(remaining))));
-  }
+    const rotated = `${f}.1`;
+    renameSync(f, rotated);
+    chmodPrivate(rotated);
+  } catch {}
 }
-
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.js
-var leaseCreationTestHooks;
-async function createExclusiveText(path, text) {
-  const tempPath = `${path}.${randomUUID5()}.tmp`;
-  let handle;
+async function closeWindowsFile(sink) {
+  const { file, handle } = sink;
+  sink.file = undefined;
+  sink.handle = undefined;
+  if (file && handle)
+    await privateOperation(file, "log-close", () => handle.close());
+}
+async function openWindowsFile(sink, file) {
+  await ensurePrivateDirectory(dirname4(file));
   try {
-    handle = await open2(tempPath, "wx", 384);
-    try {
-      if (leaseCreationTestHooks?.beforeWrite)
-        await leaseCreationTestHooks.beforeWrite(tempPath);
-      await handle.writeFile(text, "utf8");
-    } finally {
-      await handle.close();
-    }
+    await verifyPrivate(file, "file", true);
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      throw error;
     try {
-      if (leaseCreationTestHooks?.beforeLink)
-        await leaseCreationTestHooks.beforeLink(tempPath, path);
-      await link(tempPath, path);
-    } catch (error) {
-      const code = error.code;
-      if (code !== "EPERM" && code !== "ENOTSUP" && code !== "EOPNOTSUPP" && code !== "EXDEV")
-        throw error;
-      await writeExclusiveText(path, text);
+      await createPrivateBytes(file, "");
+    } catch (creationError) {
+      if (creationError.code !== "EEXIST")
+        throw creationError;
+      await verifyPrivate(file, "file", true);
     }
-  } finally {
-    if (handle)
-      await rm2(tempPath, { force: true }).catch(() => {});
   }
+  sink.handle = await privateOperation(file, "log-open", () => open2(file, "a"));
+  sink.file = file;
+  return sink.handle;
 }
-async function writeExclusiveText(path, text) {
-  const handle = await open2(path, "wx", 384);
-  let createdStat;
-  try {
-    createdStat = await handle.stat();
-  } catch {
-    createdStat = undefined;
-  }
+async function flushWindowsFile(sink, file, text) {
+  file = resolve4(file);
   try {
-    if (leaseCreationTestHooks?.beforeWrite)
-      await leaseCreationTestHooks.beforeWrite(path);
-    await handle.writeFile(text, "utf8");
-  } catch (error) {
-    try {
-      const current = await lstat3(path).catch(() => {
-        return;
-      });
-      if (createdStat && current && current.dev === createdStat.dev && current.ino === createdStat.ino) {
-        await rm2(path, { force: true }).catch(() => {});
+    if (sink.file !== file)
+      await closeWindowsFile(sink);
+    let handle = sink.handle ?? await openWindowsFile(sink, file);
+    const info = await privateOperation(file, "log-stat", () => handle.stat());
+    if (info.size >= MAX_BYTES) {
+      await closeWindowsFile(sink);
+      for (let i = ROTATE_KEEP - 1;i >= 0; i--) {
+        const source = i === 0 ? file : `${file}.${i}`;
+        const target = `${file}.${i + 1}`;
+        try {
+          await verifyPrivate(source, "file", true);
+        } catch (error) {
+          if (error.code === "ENOENT")
+            continue;
+          throw error;
+        }
+        try {
+          await verifyPrivate(target, "file", true);
+        } catch (error) {
+          if (error.code !== "ENOENT")
+            throw error;
+        }
+        await replaceWindowsFile(source, target);
+        await verifyPrivate(target, "file");
       }
-    } catch {}
+      handle = await openWindowsFile(sink, file);
+    }
+    await privateOperation(file, "log-append", () => handle.appendFile(text, "utf8"));
+  } catch (error) {
+    await closeWindowsFile(sink).catch(() => {});
     throw error;
-  } finally {
-    await handle.close();
   }
 }
-var setRefreshLockRenewalTimeout = globalThis.setTimeout.bind(globalThis);
-var clearRefreshLockRenewalTimeout = globalThis.clearTimeout.bind(globalThis);
-function isLostMarkerRaceError(error) {
-  const code = error?.code;
-  return code === "ENOENT" || !windowsPrivateFiles && (code === "EINVAL" || code === "ENOTDIR");
-}
-var evictionMarkerTestHooks;
-function sameMarkerDirectory(created, current) {
-  if (created.dev !== current.dev || created.ino !== current.ino)
-    return false;
-  if (created.ino === 0 && created.birthtimeMs !== current.birthtimeMs)
-    return false;
-  return true;
-}
-var OWNERLESS_MARKER_GRACE_MS = 1000;
-function acquireRefreshFileLock(options) {
-  return acquireRefreshFileLockWithClock({ ...options, now: Date.now });
+function safeSerialize(data) {
+  try {
+    return ` ${JSON.stringify(data)}`;
+  } catch {
+    return " [unserializable]";
+  }
 }
-async function acquireRefreshFileLockWithClock(options) {
-  const lockPath = lockPathFor(options.path, options.name);
-  const legacyOwnerPath = join4(lockPath, "owner.json");
-  const ownerId = randomUUID5();
-  const now = options.now ?? Date.now;
-  let renewTimer = null;
-  let released = false;
-  let releaseConfirmed = false;
-  let loss;
-  let resolveLoss;
-  const lostPromise = new Promise((resolve) => {
-    resolveLoss = resolve;
-  });
-  function notifyTimerStep(event) {
-    try {
-      const result = options.onRenewalTimer?.(event);
-      if (result && (typeof result === "object" || typeof result === "function") && "then" in result && typeof result.then === "function") {
-        Promise.resolve(result).catch(() => {});
-      }
-    } catch {}
+function createEngine(options) {
+  let logFileSource;
+  let initLevelSource;
+  let runtimeLevel;
+  let redactor = createRedactor();
+  let captureSink;
+  let buffer = [];
+  let timer;
+  let orderedSink = Promise.resolve();
+  let sinkError;
+  const windowsFile = {};
+  function queueWindows(operation) {
+    const next = orderedSink.then(operation);
+    orderedSink = next.catch((error) => {
+      sinkError = error;
+    });
+    return next;
   }
-  function cancelRenewalTimer() {
-    if (!renewTimer)
-      return;
-    clearRefreshLockRenewalTimeout(renewTimer);
-    renewTimer = null;
-    notifyTimerStep("cancelled");
+  function configure(next) {
+    if (windowsPrivateFiles && next.file !== logFileSource)
+      queueWindows(() => closeWindowsFile(windowsFile)).catch(() => {});
+    logFileSource = next.file;
+    initLevelSource = next.level;
+    redactor = createRedactor(next);
+    captureSink = next.captureSink;
   }
-  function recordLoss(reason, owner) {
-    if (loss || released)
+  function setLogLevel(l) {
+    if (l === undefined || l in ORDER)
+      runtimeLevel = l;
+  }
+  function logFilePath() {
+    if (logFileSource === undefined)
       return;
-    loss = Object.freeze({
-      reason,
-      expectedOwnerId: ownerId,
-      ...typeof owner?.ownerId === "string" ? { observedOwnerId: owner.ownerId } : {},
-      ...typeof owner?.expiresAt === "number" ? { observedExpiresAt: owner.expiresAt } : {}
-    });
-    cancelRenewalTimer();
-    resolveLoss(loss);
+    const resolved = typeof logFileSource === "function" ? logFileSource() : logFileSource;
+    return resolved || undefined;
   }
-  let terminalIOError;
-  let renewalInFlight = null;
-  const evictPath = `${lockPath}.evicting`;
-  const evictOwnerPath = join4(evictPath, "owner.json");
-  const evictOwnerId = randomUUID5();
-  const EVICT_TTL = 5000;
-  const MAX_STEAL_ATTEMPTS = 8;
-  function isChangingLockCreate(error) {
-    return windowsPrivateFiles && (isWindowsAccessDeniedCreate(error, [lockPath], "create") || isWindowsAccessDeniedCreate(error, [evictPath], "directory-create"));
+  function configuredLevel() {
+    if (runtimeLevel)
+      return runtimeLevel;
+    const floor = typeof initLevelSource === "function" ? initLevelSource() : initLevelSource;
+    if (floor && floor in ORDER)
+      return floor;
+    return "info";
   }
-  async function readOwner() {
-    if (windowsPrivateFiles) {
-      try {
-        return JSON.parse(await readLockRecord(lockPath, () => readPrivateText(lockPath, true)));
-      } catch (error) {
-        if (error.code !== "EISDIR" && error.reason !== "wrong-kind")
-          throw error;
-        await readLockRecord(lockPath, () => verifyPrivate(lockPath, "directory", true));
-        return JSON.parse(await readLockRecord(legacyOwnerPath, () => readPrivateText(legacyOwnerPath, true)));
-      }
+  function flushLogs(close = true) {
+    if (timer) {
+      clearTimeout(timer);
+      timer = undefined;
+    }
+    if (!buffer.length) {
+      if (windowsPrivateFiles)
+        return queueWindows(async () => {
+          if (close)
+            await closeWindowsFile(windowsFile);
+          if (sinkError)
+            throw sinkError;
+        });
+      return;
     }
+    let file;
     try {
-      return JSON.parse(await readFile2(lockPath, "utf8"));
-    } catch (error) {
-      const code = error.code;
-      if (code !== "EISDIR")
-        throw error;
-      return JSON.parse(await readFile2(legacyOwnerPath, "utf8"));
+      file = logFilePath();
+    } catch {
+      buffer = [];
+      if (windowsPrivateFiles && close)
+        return queueWindows(() => closeWindowsFile(windowsFile));
+      return;
+    }
+    const text = buffer.join("");
+    buffer = [];
+    if (!file) {
+      if (windowsPrivateFiles && close)
+        return queueWindows(() => closeWindowsFile(windowsFile));
+      return;
     }
-  }
-  async function writeOwner() {
     if (windowsPrivateFiles) {
-      const owner = await readOwner();
-      const remaining = Number(owner?.expiresAt) - now();
-      await writePrivateAtomic(lockPath, `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}
-`, {
-        deadline: performance.now() + Math.max(0, remaining),
-        beforeRename: async () => {
-          const current = await readOwner();
-          if (current?.ownerId !== ownerId || !(Number(current?.expiresAt) > now()) || !await ownsEvictionMarker()) {
-            throw new LockOwnershipError({
-              target: options.path,
-              name: options.name
-            });
-          }
+      return queueWindows(async () => {
+        try {
+          await flushWindowsFile(windowsFile, file, text);
+        } finally {
+          if (close)
+            await closeWindowsFile(windowsFile);
         }
       });
-      return;
     }
-    const tempPath = `${lockPath}.${randomUUID5()}.tmp`;
-    let handle;
-    let created = false;
     try {
-      handle = await open2(tempPath, "wx", 384);
-      created = true;
-      await handle.writeFile(`${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}
-`, "utf8");
-      await handle.chmod(384);
-      await handle.close();
-      handle = undefined;
-      const current = await readOwner();
-      if (current?.ownerId !== ownerId || !(Number(current?.expiresAt) > now()) || !await ownsEvictionMarker()) {
-        throw new LockOwnershipError({
-          target: options.path,
-          name: options.name
-        });
-      }
-      await rename3(tempPath, lockPath);
-      created = false;
-    } finally {
-      await handle?.close().catch(() => {});
-      if (created)
-        await rm2(tempPath, { force: true }).catch(() => {});
-    }
-  }
-  async function createLease() {
-    const bytes = `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}
-`;
-    if (windowsPrivateFiles)
-      await createPrivateBytes(lockPath, bytes);
-    else
-      await createExclusiveText(lockPath, bytes);
+      rotateIfNeeded(file);
+      if (existsSync(file))
+        chmodPrivate(file);
+      appendFileSync(file, text, { encoding: "utf8", mode: 384 });
+    } catch {}
   }
-  async function leaseContention(error) {
-    const code = error.code;
-    if (code !== "EEXIST" && code !== "EISDIR")
-      return false;
-    if (windowsPrivateFiles) {
-      if (options.onStep)
-        await options.onStep("lease-contention-read-ready");
+  function schedule() {
+    if (!timer)
+      timer = setTimeout(() => {
+        timer = undefined;
+        const flushed = flushLogs(false);
+        if (flushed instanceof Promise)
+          flushed.catch(() => {});
+      }, 500);
+  }
+  function emit(channel, level, message, data) {
+    if (logFileSource === undefined && captureSink === undefined)
+      return;
+    try {
+      if (ORDER[level] > ORDER[configuredLevel()])
+        return;
+      const scrubbedMessage = redactor.redactStrings(message);
+      let scrubbedData;
       try {
-        if (code === "EISDIR") {
-          await readLockRecord(lockPath, () => verifyPrivate(lockPath, "directory", true));
-          await readLockRecord(legacyOwnerPath, () => readPrivateText(legacyOwnerPath, true));
-        } else
-          await readOwner();
-      } catch (readError) {
-        if (readError.code !== "ENOENT")
-          throw readError;
+        scrubbedData = redactor.redact(data);
+      } catch {
+        scrubbedData = "[unserializable]";
       }
-    }
-    return true;
+      const line = `[${new Date().toISOString()}] ${level.toUpperCase()} [${channel}] ${scrubbedMessage}` + (data === undefined ? "" : safeSerialize(scrubbedData)) + `
+`;
+      try {
+        captureSink?.({
+          channel,
+          level,
+          message: scrubbedMessage,
+          data: scrubbedData
+        });
+      } catch {}
+      if (logFileSource === undefined)
+        return;
+      buffer.push(line);
+      if (buffer.length >= 50) {
+        const flushed = flushLogs(false);
+        if (flushed instanceof Promise)
+          flushed.catch(() => {});
+      } else
+        schedule();
+    } catch {}
   }
-  async function tryAcquire() {
+  function createLogger(channel) {
+    return {
+      error: (m, d) => emit(channel, "error", m, d),
+      warn: (m, d) => emit(channel, "warn", m, d),
+      info: (m, d) => emit(channel, "info", m, d),
+      debug: (m, d) => emit(channel, "debug", m, d),
+      trace: (m, d) => emit(channel, "trace", m, d)
+    };
+  }
+  function reset() {
     if (windowsPrivateFiles)
-      await ensurePrivateDirectory(dirname4(lockPath));
+      queueWindows(() => closeWindowsFile(windowsFile)).catch(() => {});
+    sinkError = undefined;
+    buffer = [];
+    if (timer) {
+      clearTimeout(timer);
+      timer = undefined;
+    }
+    logFileSource = undefined;
+    initLevelSource = undefined;
+    runtimeLevel = undefined;
+    redactor = createRedactor();
+    captureSink = undefined;
+  }
+  if (options)
+    configure(options);
+  return { configure, createLogger, setLogLevel, flushLogs, reset };
+}
+var defaultEngine = createEngine();
+function createLogger(channel) {
+  return defaultEngine.createLogger(channel);
+}
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/fs/lock-record.js
+import { resolve as resolve5 } from "node:path";
+class DisappearedLockRecordError extends Error {
+  path;
+  code = "ENOENT";
+  constructor(path, cause) {
+    super(`Lock record disappeared: ${path}`, { cause });
+    this.path = path;
+  }
+}
+function isWindowsAccessDeniedRead(error, paths) {
+  return error instanceof PrivateFileError && error.reason === "io-error" && error.win32Code === 5 && (error.stage === "read" || error.stage === "verify") && paths.some((path) => resolve5(path) === error.path);
+}
+function isWindowsAccessDeniedCreate(error, paths, stage) {
+  return error instanceof PrivateFileError && error.reason === "io-error" && error.win32Code === 5 && error.stage === stage && paths.some((path) => resolve5(path) === error.path);
+}
+async function readLockRecord(path, read) {
+  try {
+    return await read();
+  } catch (error) {
+    if (!isWindowsAccessDeniedRead(error, [path]))
+      throw error;
     try {
-      await createLease();
-      return true;
-    } catch (error) {
-      const code = error.code;
-      if (await leaseContention(error))
-        return false;
-      if (code === "ENOENT") {
-        if (windowsPrivateFiles)
-          await ensurePrivateDirectory(dirname4(lockPath));
-        else
-          await mkdir2(dirname4(lockPath), { recursive: true });
-        try {
-          await createLease();
-          return true;
-        } catch (retryError) {
-          if (await leaseContention(retryError))
-            return false;
-          throw retryError;
-        }
-      }
+      return await read();
+    } catch (recheckError) {
+      if (recheckError.code === "ENOENT")
+        throw new DisappearedLockRecordError(path, error);
       throw error;
     }
   }
-  async function backoff() {
-    await new Promise((resolve) => setTimeout(resolve, Math.floor(Math.random() * 4)));
+}
+
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/fs/with-lock.js
+import { join as join3, resolve as resolve6 } from "node:path";
+function lockPathFor(target, name) {
+  return `${target}.${name}.lock`;
+}
+
+class LockContentionError extends Error {
+  details;
+  constructor(details) {
+    super(`Timed out acquiring ${details.name} lock for ${details.target}`);
+    this.name = "LockContentionError";
+    this.details = details;
   }
-  async function readLockState(notifyReady = true) {
-    if (notifyReady && options.onStep)
-      await options.onStep("lock-read-ready");
-    let owner;
+}
+
+class LockOwnershipError extends Error {
+  details;
+  constructor(details) {
+    super(`Lost ${details.name} lock for ${details.target}`);
+    this.name = "LockOwnershipError";
+    this.details = details;
+  }
+}
+function isChangingLockRecord(error, target, name) {
+  const path = resolve6(lockPathFor(target, name));
+  const paths = [path, join3(path, "owner.json")];
+  return (isWindowsSharingViolation(error) || isWindowsAccessDeniedRead(error, paths)) && (error.stage === "read" || error.stage === "verify") && paths.includes(error.path) || windowsPrivateFiles && (isWindowsAccessDeniedCreate(error, [path], "create") || isWindowsAccessDeniedCreate(error, [`${path}.evicting`], "directory-create"));
+}
+async function withLock(target, options, fn) {
+  const started = performance.now();
+  let changingRecordError;
+  for (;; ) {
+    options.signal?.throwIfAborted();
+    let lock;
     try {
-      owner = await readOwner();
+      lock = await acquireRefreshFileLock({
+        path: target,
+        name: options.name,
+        ttlMs: options.ttlMs,
+        renew: options.renew ?? false,
+        ...options.onStep ? { onStep: options.onStep } : {},
+        ...options.onRenewalTimer ? { onRenewalTimer: options.onRenewalTimer } : {}
+      });
+      changingRecordError = undefined;
     } catch (error) {
-      if (error instanceof DisappearedLockRecordError)
-        return { status: "missing" };
-      if (windowsPrivateFiles && error.code !== "ENOENT")
+      if (!isChangingLockRecord(error, target, options.name))
         throw error;
+      lock = null;
+      changingRecordError ??= error;
     }
-    const expiresAt = Number(owner?.expiresAt);
-    if (Number.isFinite(expiresAt) && expiresAt > now())
-      return { status: "live" };
-    if (typeof owner?.ownerId === "string" && Number.isFinite(expiresAt)) {
-      return {
-        status: "stale",
-        identity: { kind: "owner", ownerId: owner.ownerId, expiresAt }
-      };
-    }
-    try {
-      const current = await stat2(lockPath);
-      const legacyExpiry = Number.isFinite(expiresAt) ? expiresAt : current.mtimeMs + options.ttlMs;
-      if (legacyExpiry > now())
-        return { status: "live" };
-      return {
-        status: "stale",
-        identity: {
-          kind: "stat",
-          dev: current.dev,
-          ino: current.ino,
-          mtimeMs: current.mtimeMs,
-          expiresAt: legacyExpiry
-        }
-      };
-    } catch (error) {
-      if (error.code === "ENOENT") {
-        if (options.onStep)
-          await options.onStep("lock-missing");
-        return { status: "missing" };
+    if (lock) {
+      try {
+        options.signal?.throwIfAborted();
+        return await fn(lock);
+      } finally {
+        await lock.release(options.signal);
       }
-      throw error;
     }
-  }
-  function sameStaleLock(observed, current) {
-    if (current.status !== "stale")
-      return false;
-    const identity = current.identity;
-    if (observed.kind === "owner" && identity.kind === "owner") {
-      return observed.ownerId === identity.ownerId && observed.expiresAt === identity.expiresAt;
+    const remaining = options.timeoutMs - (performance.now() - started);
+    if (remaining <= 0) {
+      if (changingRecordError)
+        throw changingRecordError;
+      throw new LockContentionError({
+        target,
+        name: options.name,
+        timeoutMs: options.timeoutMs
+      });
     }
-    return observed.kind === "stat" && identity.kind === "stat" && observed.dev === identity.dev && observed.ino === identity.ino && observed.mtimeMs === identity.mtimeMs && observed.expiresAt === identity.expiresAt;
+    await new Promise((resolve) => setTimeout(resolve, Math.min(25, Math.ceil(remaining))));
   }
-  async function ownsEvictionMarker() {
+}
+
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.js
+var leaseCreationTestHooks;
+async function createExclusiveText(path, text) {
+  const tempPath = `${path}.${randomUUID5()}.tmp`;
+  let handle;
+  try {
+    handle = await open3(tempPath, "wx", 384);
     try {
-      const owner = JSON.parse(await readLockRecord(evictOwnerPath, () => readPrivateText(evictOwnerPath, windowsPrivateFiles)));
-      return owner?.ownerId === evictOwnerId;
+      if (leaseCreationTestHooks?.beforeWrite)
+        await leaseCreationTestHooks.beforeWrite(tempPath);
+      await handle.writeFile(text, "utf8");
+    } finally {
+      await handle.close();
+    }
+    try {
+      if (leaseCreationTestHooks?.beforeLink)
+        await leaseCreationTestHooks.beforeLink(tempPath, path);
+      await link(tempPath, path);
     } catch (error) {
-      if (windowsPrivateFiles && error.code !== "ENOENT")
+      const code = error.code;
+      if (code !== "EPERM" && code !== "ENOTSUP" && code !== "EOPNOTSUPP" && code !== "EXDEV")
         throw error;
-      return false;
+      await writeExclusiveText(path, text);
     }
+  } finally {
+    if (handle)
+      await rm2(tempPath, { force: true }).catch(() => {});
   }
-  async function removeLeaseObject(path) {
-    if (windowsPrivateFiles)
-      await privateOperation(path, "remove", () => rm2(path, { recursive: true, force: true }));
-    else
-      await rm2(path, { recursive: true, force: true }).catch(() => {});
-  }
-  function isRetryableRemoval(error, path) {
-    if (!windowsPrivateFiles || !(error instanceof PrivateFileError) || error.stage !== "remove" || error.path !== path)
-      return false;
-    return isWindowsSharingViolation(error) || error.win32Code === undefined && error.reason === undefined && (error.code === "EBUSY" || error.code === "EPERM");
-  }
-  async function removeOwnedLeaseObject(path, stillOwned, deadline = performance.now() + EVICT_TTL + 1000) {
-    let original;
-    let delayMs = 5;
-    while (await stillOwned()) {
-      try {
-        await removeLeaseObject(path);
-        return;
-      } catch (error) {
-        if (!isRetryableRemoval(error, path))
-          throw error;
-        original ??= error;
-      }
-      const remainingMs = deadline - performance.now();
-      if (remainingMs <= 0)
-        throw original;
-      await new Promise((resolve) => setTimeout(resolve, Math.min(delayMs, remainingMs)));
-      if (performance.now() >= deadline)
-        throw original;
-      delayMs = Math.min(delayMs * 2, 50);
-    }
+}
+async function writeExclusiveText(path, text) {
+  const handle = await open3(path, "wx", 384);
+  let createdStat;
+  try {
+    createdStat = await handle.stat();
+  } catch {
+    createdStat = undefined;
   }
-  async function releaseEvictionMarker(deadline) {
-    let ownedDirectory;
-    await removeOwnedLeaseObject(evictPath, async () => {
-      if (!windowsPrivateFiles)
-        return ownsEvictionMarker();
-      const current = await lstat3(evictPath).catch((error) => {
-        if (error.code !== "ENOENT")
-          throw error;
+  try {
+    if (leaseCreationTestHooks?.beforeWrite)
+      await leaseCreationTestHooks.beforeWrite(path);
+    await handle.writeFile(text, "utf8");
+  } catch (error) {
+    try {
+      const current = await lstat3(path).catch(() => {
         return;
       });
-      if (!current || ownedDirectory && !sameMarkerDirectory(ownedDirectory, current))
-        return false;
-      if (await ownsEvictionMarker()) {
-        ownedDirectory = current;
-        return true;
-      }
-      if (!ownedDirectory)
-        return false;
-      try {
-        await stat2(evictOwnerPath);
-        return false;
-      } catch (error) {
-        if (error.code !== "ENOENT")
-          throw error;
-        return true;
+      if (createdStat && current && current.dev === createdStat.dev && current.ino === createdStat.ino) {
+        await rm2(path, { force: true }).catch(() => {});
       }
-    }, deadline);
+    } catch {}
+    throw error;
+  } finally {
+    await handle.close();
   }
-  async function removeOwnMarkerAfterFailedOwnerWrite(created, deadline) {
-    if (!created)
-      return false;
-    let stillOurs = false;
+}
+var STAGING_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var STAGING_SWEEP_MIN_AGE_MS = 10 * 60000;
+var STAGING_SWEEP_MAX_CANDIDATES = 256;
+var STAGING_SWEEP_MAX_BYTES = 4096;
+var sweptLockPaths = new Set;
+var pendingStagingSweeps = new Set;
+var stagingSweepTestHooks;
+function isStagingName(name, lockName) {
+  const prefix = `${lockName}.`;
+  const suffix = ".tmp";
+  if (!name.startsWith(prefix) || !name.endsWith(suffix))
+    return false;
+  return STAGING_UUID.test(name.slice(prefix.length, -suffix.length));
+}
+function sameStagingFile(a, b) {
+  return a.dev === b.dev && a.ino === b.ino && a.size === b.size && a.mtimeMs === b.mtimeMs && a.birthtimeMs === b.birthtimeMs;
+}
+async function readStagedOwner(path) {
+  const before = await lstat3(path);
+  if (!before.isFile() || before.isSymbolicLink())
+    return;
+  if (before.size > STAGING_SWEEP_MAX_BYTES)
+    return;
+  const handle = await open3(path, "r");
+  let text;
+  try {
+    if (!sameStagingFile(before, await handle.stat()))
+      return;
+    text = await handle.readFile("utf8");
+  } finally {
+    await handle.close();
+  }
+  let record;
+  try {
+    record = JSON.parse(text);
+  } catch {
+    return;
+  }
+  if (!record || typeof record !== "object" || Array.isArray(record))
+    return;
+  const keys = Object.keys(record).sort();
+  if (keys.length !== 2 || keys[0] !== "expiresAt" || keys[1] !== "ownerId")
+    return;
+  const { ownerId, expiresAt } = record;
+  if (typeof ownerId !== "string" || !STAGING_UUID.test(ownerId))
+    return;
+  if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt))
+    return;
+  return { identity: before, expiresAt };
+}
+async function sweepAbandonedStaging(lockPath, ttlMs, now) {
+  const directory = dirname5(lockPath);
+  const lockName = basename2(lockPath);
+  const hooks = stagingSweepTestHooks;
+  const names = await (hooks?.readdir ?? readdir)(directory);
+  const candidates = names.filter((name) => isStagingName(name, lockName)).slice(0, STAGING_SWEEP_MAX_CANDIDATES);
+  const marginMs = Math.max(Number.isFinite(ttlMs) ? ttlMs : 0, STAGING_SWEEP_MIN_AGE_MS);
+  for (const name of candidates) {
+    const path = join4(directory, name);
     try {
-      await removeOwnedLeaseObject(evictPath, async () => {
-        stillOurs = false;
-        const st = await lstat3(evictPath).catch(() => {
-          return;
-        });
-        if (!st || !sameMarkerDirectory(created, st))
-          return false;
-        stillOurs = true;
-        try {
-          await stat2(evictOwnerPath);
-          return false;
-        } catch (error) {
-          return error.code === "ENOENT";
-        }
-      }, deadline);
+      if (now() - (await lstat3(path)).mtimeMs < marginMs)
+        continue;
+      const staged = await readStagedOwner(path);
+      if (!staged || !(staged.expiresAt < now() - marginMs))
+        continue;
+      if (hooks?.beforeUnlink)
+        await hooks.beforeUnlink(path);
+      const current = await readStagedOwner(path);
+      if (!current || !sameStagingFile(staged.identity, current.identity) || !(current.expiresAt < now() - marginMs))
+        continue;
+      await (hooks?.unlink ?? unlink2)(path);
     } catch {}
-    return stillOurs;
   }
-  async function tryAcquireEvictionMarker(deadline) {
-    if (windowsPrivateFiles)
-      await createPrivateDirectoryExclusive(evictPath);
-    else
-      await mkdir2(evictPath);
-    let created;
-    try {
-      const st = await lstat3(evictPath);
-      created = { dev: st.dev, ino: st.ino, birthtimeMs: st.birthtimeMs };
-    } catch {
-      created = undefined;
-    }
+}
+function startStagingSweep(lockPath, ttlMs, now) {
+  if (sweptLockPaths.has(lockPath))
+    return;
+  sweptLockPaths.add(lockPath);
+  const sweep = Promise.resolve().then(() => sweepAbandonedStaging(lockPath, ttlMs, now)).catch(() => {});
+  pendingStagingSweeps.add(sweep);
+  sweep.finally(() => pendingStagingSweeps.delete(sweep));
+}
+var setRefreshLockRenewalTimeout = globalThis.setTimeout.bind(globalThis);
+var clearRefreshLockRenewalTimeout = globalThis.clearTimeout.bind(globalThis);
+function isLostMarkerRaceError(error) {
+  const code = error?.code;
+  return code === "ENOENT" || !windowsPrivateFiles && (code === "EINVAL" || code === "ENOTDIR");
+}
+var evictionMarkerTestHooks;
+function sameMarkerDirectory(created, current) {
+  if (created.dev !== current.dev || created.ino !== current.ino)
+    return false;
+  if (created.ino === 0 && created.birthtimeMs !== current.birthtimeMs)
+    return false;
+  return true;
+}
+var OWNERLESS_MARKER_GRACE_MS = 1000;
+function acquireRefreshFileLock(options) {
+  return acquireRefreshFileLockWithClock({ ...options, now: Date.now });
+}
+async function acquireRefreshFileLockWithClock(options) {
+  const lockPath = lockPathFor(options.path, options.name);
+  const legacyOwnerPath = join4(lockPath, "owner.json");
+  const ownerId = randomUUID5();
+  const now = options.now ?? Date.now;
+  let renewTimer = null;
+  let released = false;
+  let releaseConfirmed = false;
+  let loss;
+  let resolveLoss;
+  const lostPromise = new Promise((resolve) => {
+    resolveLoss = resolve;
+  });
+  function notifyTimerStep(event) {
     try {
-      await evictionMarkerTestHooks?.beforeOwnerWrite?.(evictPath, evictOwnerPath);
-      const injected = await evictionMarkerTestHooks?.failOwnerWrite?.(evictPath, evictOwnerPath);
-      if (injected !== undefined)
-        throw injected;
-      const bytes = `${JSON.stringify({ ownerId: evictOwnerId, createdAt: now() })}
-`;
-      if (windowsPrivateFiles)
-        await createPrivateBytes(evictOwnerPath, bytes);
-      else
-        await writeExclusiveText(evictOwnerPath, bytes);
-    } catch (error) {
-      const stillOurs = await removeOwnMarkerAfterFailedOwnerWrite(created, deadline);
-      if (isLostMarkerRaceError(error) && !stillOurs)
-        return false;
-      try {
-        await releaseEvictionMarker(deadline);
-      } catch {}
-      throw error;
-    }
-    if (options.onStep)
-      await options.onStep("eviction-marker-acquired");
-    return true;
+      const result = options.onRenewalTimer?.(event);
+      if (result && (typeof result === "object" || typeof result === "function") && "then" in result && typeof result.then === "function") {
+        Promise.resolve(result).catch(() => {});
+      }
+    } catch {}
   }
-  async function recoverStaleEvictionMarker(deadline) {
-    let evictStat;
-    try {
-      evictStat = await stat2(evictPath);
-    } catch (error) {
-      if (error.code === "ENOENT")
-        return "missing";
-      throw error;
-    }
+  function cancelRenewalTimer() {
+    if (!renewTimer)
+      return;
+    clearRefreshLockRenewalTimeout(renewTimer);
+    renewTimer = null;
+    notifyTimerStep("cancelled");
+  }
+  function recordLoss(reason, owner) {
+    if (loss || released)
+      return;
+    loss = Object.freeze({
+      reason,
+      expectedOwnerId: ownerId,
+      ...typeof owner?.ownerId === "string" ? { observedOwnerId: owner.ownerId } : {},
+      ...typeof owner?.expiresAt === "number" ? { observedExpiresAt: owner.expiresAt } : {}
+    });
+    cancelRenewalTimer();
+    resolveLoss(loss);
+  }
+  let terminalIOError;
+  let renewalInFlight = null;
+  const evictPath = `${lockPath}.evicting`;
+  const evictOwnerPath = join4(evictPath, "owner.json");
+  const evictOwnerId = randomUUID5();
+  const EVICT_TTL = 5000;
+  const MAX_STEAL_ATTEMPTS = 8;
+  function isChangingLockCreate(error) {
+    return windowsPrivateFiles && (isWindowsAccessDeniedCreate(error, [lockPath], "create") || isWindowsAccessDeniedCreate(error, [evictPath], "directory-create"));
+  }
+  async function readOwner() {
     if (windowsPrivateFiles) {
       try {
-        await readLockRecord(evictPath, () => verifyPrivate(evictPath, "directory", true));
+        return JSON.parse(await readLockRecord(lockPath, () => readPrivateText(lockPath, true)));
       } catch (error) {
-        if (error.code === "ENOENT")
-          return "missing";
-        throw error;
+        if (error.code !== "EISDIR" && error.reason !== "wrong-kind")
+          throw error;
+        await readLockRecord(lockPath, () => verifyPrivate(lockPath, "directory", true));
+        return JSON.parse(await readLockRecord(legacyOwnerPath, () => readPrivateText(legacyOwnerPath, true)));
       }
     }
-    if (evictStat.mtimeMs + EVICT_TTL > now()) {
-      let hasOwner = true;
-      try {
-        await stat2(evictOwnerPath);
-      } catch (error) {
-        if (error.code === "ENOENT")
-          hasOwner = false;
-        else
-          return "fresh";
-      }
-      if (hasOwner)
-        return "fresh";
-      if (evictStat.mtimeMs + OWNERLESS_MARKER_GRACE_MS > now())
-        return "fresh";
-    }
-    if (options.onStep)
-      await options.onStep("stale-marker-stat");
-    const claimedPath = `${evictPath}.${randomUUID5()}`;
     try {
-      await rename3(evictPath, claimedPath);
+      return JSON.parse(await readFile2(lockPath, "utf8"));
     } catch (error) {
-      if (error.code === "ENOENT")
-        return "missing";
-      throw error;
+      const code = error.code;
+      if (code !== "EISDIR")
+        throw error;
+      return JSON.parse(await readFile2(legacyOwnerPath, "utf8"));
     }
-    if (options.onStep)
-      await options.onStep("stale-marker-claimed");
-    const claimedIdentity = windowsPrivateFiles ? await lstat3(claimedPath) : undefined;
-    await removeOwnedLeaseObject(claimedPath, async () => {
-      if (!claimedIdentity)
-        return true;
-      const current = await lstat3(claimedPath).catch((error) => {
-        if (error.code !== "ENOENT")
-          throw error;
-        return;
+  }
+  async function writeOwner() {
+    if (windowsPrivateFiles) {
+      const owner = await readOwner();
+      const remaining = Number(owner?.expiresAt) - now();
+      await writePrivateAtomic(lockPath, `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}
+`, {
+        deadline: performance.now() + Math.max(0, remaining),
+        beforeRename: async () => {
+          const current = await readOwner();
+          if (current?.ownerId !== ownerId || !(Number(current?.expiresAt) > now()) || !await ownsEvictionMarker()) {
+            throw new LockOwnershipError({
+              target: options.path,
+              name: options.name
+            });
+          }
+        }
       });
-      return !!current && sameMarkerDirectory(claimedIdentity, current);
-    }, deadline);
-    return "recovered";
+      return;
+    }
+    const tempPath = `${lockPath}.${randomUUID5()}.tmp`;
+    let handle;
+    let created = false;
+    try {
+      handle = await open3(tempPath, "wx", 384);
+      created = true;
+      await handle.writeFile(`${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}
+`, "utf8");
+      await handle.chmod(384);
+      await handle.close();
+      handle = undefined;
+      const current = await readOwner();
+      if (current?.ownerId !== ownerId || !(Number(current?.expiresAt) > now()) || !await ownsEvictionMarker()) {
+        throw new LockOwnershipError({
+          target: options.path,
+          name: options.name
+        });
+      }
+      await rename3(tempPath, lockPath);
+      created = false;
+    } finally {
+      await handle?.close().catch(() => {});
+      if (created)
+        await rm2(tempPath, { force: true }).catch(() => {});
+    }
   }
-  async function withEvictionMarker(action, deadline) {
+  async function createLease() {
+    const bytes = `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}
+`;
+    if (windowsPrivateFiles)
+      await createPrivateBytes(lockPath, bytes);
+    else
+      await createExclusiveText(lockPath, bytes);
+  }
+  async function leaseContention(error) {
+    const code = error.code;
+    if (code !== "EEXIST" && code !== "EISDIR")
+      return false;
+    if (windowsPrivateFiles) {
+      if (options.onStep)
+        await options.onStep("lease-contention-read-ready");
+      try {
+        if (code === "EISDIR") {
+          await readLockRecord(lockPath, () => verifyPrivate(lockPath, "directory", true));
+          await readLockRecord(legacyOwnerPath, () => readPrivateText(legacyOwnerPath, true));
+        } else
+          await readOwner();
+      } catch (readError) {
+        if (readError.code !== "ENOENT")
+          throw readError;
+      }
+    }
+    return true;
+  }
+  async function tryAcquire() {
+    if (windowsPrivateFiles)
+      await ensurePrivateDirectory(dirname5(lockPath));
     try {
-      if (!await tryAcquireEvictionMarker(deadline))
-        return false;
+      await createLease();
+      return true;
     } catch (error) {
-      if (error.code === "EEXIST") {
-        if (windowsPrivateFiles) {
-          try {
-            await readLockRecord(evictPath, () => verifyPrivate(evictPath, "directory", true));
-            await readLockRecord(evictOwnerPath, () => readPrivateText(evictOwnerPath, true));
-          } catch (ownerError) {
-            if (ownerError.code !== "ENOENT")
-              throw ownerError;
-          }
-        }
+      const code = error.code;
+      if (await leaseContention(error))
         return false;
+      if (code === "ENOENT") {
+        if (windowsPrivateFiles)
+          await ensurePrivateDirectory(dirname5(lockPath));
+        else
+          await mkdir2(dirname5(lockPath), { recursive: true });
+        try {
+          await createLease();
+          return true;
+        } catch (retryError) {
+          if (await leaseContention(retryError))
+            return false;
+          throw retryError;
+        }
       }
       throw error;
     }
-    let actionFailed = false;
-    let actionError;
+  }
+  async function backoff() {
+    await new Promise((resolve) => setTimeout(resolve, Math.floor(Math.random() * 4)));
+  }
+  async function readLockState(notifyReady = true) {
+    if (notifyReady && options.onStep)
+      await options.onStep("lock-read-ready");
+    let owner;
     try {
-      await action();
+      owner = await readOwner();
     } catch (error) {
-      actionFailed = true;
-      actionError = error;
+      if (error instanceof DisappearedLockRecordError)
+        return { status: "missing" };
+      if (windowsPrivateFiles && error.code !== "ENOENT")
+        throw error;
+    }
+    const expiresAt = Number(owner?.expiresAt);
+    if (Number.isFinite(expiresAt) && expiresAt > now())
+      return { status: "live" };
+    if (typeof owner?.ownerId === "string" && Number.isFinite(expiresAt)) {
+      return {
+        status: "stale",
+        identity: { kind: "owner", ownerId: owner.ownerId, expiresAt }
+      };
     }
     try {
-      await releaseEvictionMarker(deadline);
+      const current = await stat2(lockPath);
+      const legacyExpiry = Number.isFinite(expiresAt) ? expiresAt : current.mtimeMs + options.ttlMs;
+      if (legacyExpiry > now())
+        return { status: "live" };
+      return {
+        status: "stale",
+        identity: {
+          kind: "stat",
+          dev: current.dev,
+          ino: current.ino,
+          mtimeMs: current.mtimeMs,
+          expiresAt: legacyExpiry
+        }
+      };
     } catch (error) {
-      if ((isRetryableRemoval(actionError, lockPath) || isWindowsAccessDeniedRead(actionError, [
-        lockPath,
-        legacyOwnerPath,
-        evictOwnerPath
-      ])) && (isRetryableRemoval(error, evictPath) || isWindowsAccessDeniedRead(error, [evictOwnerPath])))
-        throw actionError;
+      if (error.code === "ENOENT") {
+        if (options.onStep)
+          await options.onStep("lock-missing");
+        return { status: "missing" };
+      }
       throw error;
     }
-    if (actionFailed)
-      throw actionError;
-    return true;
   }
-  async function relinquishLockAfterMarkerLoss() {
-    for (let attempt = 0;attempt < MAX_STEAL_ATTEMPTS; attempt++) {
-      if (options.onStep)
-        await options.onStep("relinquish-read");
-      let owner;
-      try {
-        owner = await readOwner();
-      } catch (error) {
-        if (windowsPrivateFiles && !(error instanceof DisappearedLockRecordError))
-          throw error;
-        return;
-      }
-      if (owner?.ownerId !== ownerId)
-        return;
+  function sameStaleLock(observed, current) {
+    if (current.status !== "stale")
+      return false;
+    const identity = current.identity;
+    if (observed.kind === "owner" && identity.kind === "owner") {
+      return observed.ownerId === identity.ownerId && observed.expiresAt === identity.expiresAt;
+    }
+    return observed.kind === "stat" && identity.kind === "stat" && observed.dev === identity.dev && observed.ino === identity.ino && observed.mtimeMs === identity.mtimeMs && observed.expiresAt === identity.expiresAt;
+  }
+  async function ownsEvictionMarker() {
+    try {
+      const owner = JSON.parse(await readLockRecord(evictOwnerPath, () => readPrivateText(evictOwnerPath, windowsPrivateFiles)));
+      return owner?.ownerId === evictOwnerId;
+    } catch (error) {
+      if (windowsPrivateFiles && error.code !== "ENOENT")
+        throw error;
+      return false;
+    }
+  }
+  async function removeLeaseObject(path) {
+    if (windowsPrivateFiles)
+      await privateOperation(path, "remove", () => rm2(path, { recursive: true, force: true }));
+    else
+      await rm2(path, { recursive: true, force: true }).catch(() => {});
+  }
+  function isRetryableRemoval(error, path) {
+    if (!windowsPrivateFiles || !(error instanceof PrivateFileError) || error.stage !== "remove" || error.path !== path)
+      return false;
+    return isWindowsSharingViolation(error) || error.win32Code === undefined && error.reason === undefined && (error.code === "EBUSY" || error.code === "EPERM");
+  }
+  async function removeOwnedLeaseObject(path, stillOwned, deadline = performance.now() + EVICT_TTL + 1000) {
+    let original;
+    let delayMs = 5;
+    while (await stillOwned()) {
       try {
-        await rm2(lockPath, { recursive: true, force: true });
+        await removeLeaseObject(path);
         return;
       } catch (error) {
-        if (windowsPrivateFiles)
+        if (!isRetryableRemoval(error, path))
           throw error;
-        await backoff();
+        original ??= error;
       }
+      const remainingMs = deadline - performance.now();
+      if (remainingMs <= 0)
+        throw original;
+      await new Promise((resolve) => setTimeout(resolve, Math.min(delayMs, remainingMs)));
+      if (performance.now() >= deadline)
+        throw original;
+      delayMs = Math.min(delayMs * 2, 50);
     }
   }
-  function scheduleRenewal() {
-    if (!options.renew || released || loss)
-      return;
-    const intervalMs = options.renewIntervalMs ?? Math.max(1000, Math.floor(options.ttlMs / 3));
-    renewTimer = setRefreshLockRenewalTimeout(() => {
-      renewTimer = null;
-      const renewal = (async () => {
-        let shouldReschedule = !released;
-        try {
-          const markerAcquired = await withEvictionMarker(async () => {
-            const owner = await readOwner();
+  async function releaseEvictionMarker(deadline) {
+    let ownedDirectory;
+    await removeOwnedLeaseObject(evictPath, async () => {
+      if (!windowsPrivateFiles)
+        return ownsEvictionMarker();
+      const current = await lstat3(evictPath).catch((error) => {
+        if (error.code !== "ENOENT")
+          throw error;
+        return;
+      });
+      if (!current || ownedDirectory && !sameMarkerDirectory(ownedDirectory, current))
+        return false;
+      if (await ownsEvictionMarker()) {
+        ownedDirectory = current;
+        return true;
+      }
+      if (!ownedDirectory)
+        return false;
+      try {
+        await stat2(evictOwnerPath);
+        return false;
+      } catch (error) {
+        if (error.code !== "ENOENT")
+          throw error;
+        return true;
+      }
+    }, deadline);
+  }
+  async function removeOwnMarkerAfterFailedOwnerWrite(created, deadline) {
+    if (!created)
+      return false;
+    let stillOurs = false;
+    try {
+      await removeOwnedLeaseObject(evictPath, async () => {
+        stillOurs = false;
+        const st = await lstat3(evictPath).catch(() => {
+          return;
+        });
+        if (!st || !sameMarkerDirectory(created, st))
+          return false;
+        stillOurs = true;
+        try {
+          await stat2(evictOwnerPath);
+          return false;
+        } catch (error) {
+          return error.code === "ENOENT";
+        }
+      }, deadline);
+    } catch {}
+    return stillOurs;
+  }
+  async function tryAcquireEvictionMarker(deadline) {
+    if (windowsPrivateFiles)
+      await createPrivateDirectoryExclusive(evictPath);
+    else
+      await mkdir2(evictPath);
+    let created;
+    try {
+      const st = await lstat3(evictPath);
+      created = { dev: st.dev, ino: st.ino, birthtimeMs: st.birthtimeMs };
+    } catch {
+      created = undefined;
+    }
+    try {
+      await evictionMarkerTestHooks?.beforeOwnerWrite?.(evictPath, evictOwnerPath);
+      const injected = await evictionMarkerTestHooks?.failOwnerWrite?.(evictPath, evictOwnerPath);
+      if (injected !== undefined)
+        throw injected;
+      const bytes = `${JSON.stringify({ ownerId: evictOwnerId, createdAt: now() })}
+`;
+      if (windowsPrivateFiles)
+        await createPrivateBytes(evictOwnerPath, bytes);
+      else
+        await writeExclusiveText(evictOwnerPath, bytes);
+    } catch (error) {
+      const stillOurs = await removeOwnMarkerAfterFailedOwnerWrite(created, deadline);
+      if (isLostMarkerRaceError(error) && !stillOurs)
+        return false;
+      try {
+        await releaseEvictionMarker(deadline);
+      } catch {}
+      throw error;
+    }
+    if (options.onStep)
+      await options.onStep("eviction-marker-acquired");
+    return true;
+  }
+  async function recoverStaleEvictionMarker(deadline) {
+    let evictStat;
+    try {
+      evictStat = await stat2(evictPath);
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return "missing";
+      throw error;
+    }
+    if (windowsPrivateFiles) {
+      try {
+        await readLockRecord(evictPath, () => verifyPrivate(evictPath, "directory", true));
+      } catch (error) {
+        if (error.code === "ENOENT")
+          return "missing";
+        throw error;
+      }
+    }
+    if (evictStat.mtimeMs + EVICT_TTL > now()) {
+      let hasOwner = true;
+      try {
+        await stat2(evictOwnerPath);
+      } catch (error) {
+        if (error.code === "ENOENT")
+          hasOwner = false;
+        else
+          return "fresh";
+      }
+      if (hasOwner)
+        return "fresh";
+      if (evictStat.mtimeMs + OWNERLESS_MARKER_GRACE_MS > now())
+        return "fresh";
+    }
+    if (options.onStep)
+      await options.onStep("stale-marker-stat");
+    const claimedPath = `${evictPath}.${randomUUID5()}`;
+    try {
+      await rename3(evictPath, claimedPath);
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return "missing";
+      throw error;
+    }
+    if (options.onStep)
+      await options.onStep("stale-marker-claimed");
+    const claimedIdentity = windowsPrivateFiles ? await lstat3(claimedPath) : undefined;
+    await removeOwnedLeaseObject(claimedPath, async () => {
+      if (!claimedIdentity)
+        return true;
+      const current = await lstat3(claimedPath).catch((error) => {
+        if (error.code !== "ENOENT")
+          throw error;
+        return;
+      });
+      return !!current && sameMarkerDirectory(claimedIdentity, current);
+    }, deadline);
+    return "recovered";
+  }
+  async function withEvictionMarker(action, deadline) {
+    try {
+      if (!await tryAcquireEvictionMarker(deadline))
+        return false;
+    } catch (error) {
+      if (error.code === "EEXIST") {
+        if (windowsPrivateFiles) {
+          try {
+            await readLockRecord(evictPath, () => verifyPrivate(evictPath, "directory", true));
+            await readLockRecord(evictOwnerPath, () => readPrivateText(evictOwnerPath, true));
+          } catch (ownerError) {
+            if (ownerError.code !== "ENOENT")
+              throw ownerError;
+          }
+        }
+        return false;
+      }
+      throw error;
+    }
+    let actionFailed = false;
+    let actionError;
+    try {
+      await action();
+    } catch (error) {
+      actionFailed = true;
+      actionError = error;
+    }
+    try {
+      await releaseEvictionMarker(deadline);
+    } catch (error) {
+      if ((isRetryableRemoval(actionError, lockPath) || isWindowsAccessDeniedRead(actionError, [
+        lockPath,
+        legacyOwnerPath,
+        evictOwnerPath
+      ])) && (isRetryableRemoval(error, evictPath) || isWindowsAccessDeniedRead(error, [evictOwnerPath])))
+        throw actionError;
+      throw error;
+    }
+    if (actionFailed)
+      throw actionError;
+    return true;
+  }
+  async function relinquishLockAfterMarkerLoss() {
+    for (let attempt = 0;attempt < MAX_STEAL_ATTEMPTS; attempt++) {
+      if (options.onStep)
+        await options.onStep("relinquish-read");
+      let owner;
+      try {
+        owner = await readOwner();
+      } catch (error) {
+        if (windowsPrivateFiles && !(error instanceof DisappearedLockRecordError))
+          throw error;
+        return;
+      }
+      if (owner?.ownerId !== ownerId)
+        return;
+      try {
+        await rm2(lockPath, { recursive: true, force: true });
+        return;
+      } catch (error) {
+        if (windowsPrivateFiles)
+          throw error;
+        await backoff();
+      }
+    }
+  }
+  function scheduleRenewal() {
+    if (!options.renew || released || loss)
+      return;
+    const intervalMs = options.renewIntervalMs ?? Math.max(1000, Math.floor(options.ttlMs / 3));
+    renewTimer = setRefreshLockRenewalTimeout(() => {
+      renewTimer = null;
+      const renewal = (async () => {
+        let shouldReschedule = !released;
+        try {
+          const markerAcquired = await withEvictionMarker(async () => {
+            const owner = await readOwner();
             const currentNow = now();
             if (released || loss) {
               shouldReschedule = false;
@@ -4015,6 +4523,7 @@ async function acquireRefreshFileLockWithClock(options) {
     return null;
   }
   scheduleRenewal();
+  startStagingSweep(lockPath, options.ttlMs, now);
   return {
     ownerId,
     whenLost: () => lostPromise,
@@ -4078,17 +4587,15 @@ async function acquireRefreshFileLockWithClock(options) {
             removalConfirmed = true;
           }, deadline);
           changingRecordError = undefined;
-          if (markerAcquired) {
-            if (windowsPrivateFiles && !removalConfirmed)
-              throw new PrivateFileError(lockPath, "release-not-confirmed", {
-                code: "EIO"
-              });
-            releaseConfirmed = removalConfirmed;
+          if (markerAcquired && removalConfirmed) {
+            releaseConfirmed = true;
             return;
           }
-          if (signal?.aborted)
-            return;
-          await recoverStaleEvictionMarker(deadline);
+          if (!markerAcquired) {
+            if (signal?.aborted)
+              return;
+            await recoverStaleEvictionMarker(deadline);
+          }
         } catch (error) {
           const changingRecord = windowsPrivateFiles && (isChangingLockCreate(error) || isWindowsAccessDeniedRead(error, [
             lockPath,
@@ -4118,10 +4625,13 @@ async function acquireRefreshFileLockWithClock(options) {
         throw changingRecordError ?? removalError ?? new PrivateFileError(lockPath, "release-not-confirmed", {
           code: "ETIMEDOUT"
         });
+      createLogger("fs").warn("File lock release deadline expired", {
+        lockPath
+      });
     }
   };
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/quota/map.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/quota/map.js
 var ALL_SCOPE = "all";
 var DEFAULT_REQUIRED_LABELS = Object.freeze([
   "primary"
@@ -4221,7 +4731,7 @@ function isQuotaMap(value) {
   return optional(value, "budget", isCreditBudgetEntry) && optional(value, "counters", isQuotaCounters) && optional(value, "credits", isQuotaCredits);
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/quota/merge.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/quota/merge.js
 class QuotaCodecError extends TypeError {
   constructor(message) {
     super(message);
@@ -4302,450 +4812,116 @@ function mergeCounters(stored, observed) {
     }
   }
   return counters.size === 0 ? undefined : Object.fromEntries(counters);
-}
-function mergeCredits(stored, observed) {
-  if (observed === undefined)
-    return stored;
-  if (stored !== undefined && observed.checkedAt < stored.checkedAt) {
-    return stored;
-  }
-  return { ...observed };
-}
-function mergeQuotaObservation(stored, observation) {
-  const decoded = stored === undefined ? undefined : decodeQuotaMap(stored);
-  if (stored !== undefined && decoded === undefined) {
-    throw new QuotaCodecError("stored quota map is malformed");
-  }
-  if (!isQuotaObservation(observation)) {
-    throw new QuotaCodecError("quota observation is malformed");
-  }
-  const base = decoded ?? { limits: [] };
-  const at = observation.checkedAt;
-  const entries = new Map;
-  for (const entry of base.limits) {
-    entries.set(limitKey(entry.scope, entry.label), entry);
-  }
-  const applies = (key) => {
-    const existing = entries.get(key);
-    return existing === undefined || at >= entryTime(existing);
-  };
-  const carried = new Set;
-  for (const reading of observation.readings ?? []) {
-    const scope = reading.scope ?? ALL_SCOPE;
-    const key = limitKey(scope, reading.label);
-    carried.add(key);
-    if (!applies(key))
-      continue;
-    entries.set(key, {
-      scope,
-      label: reading.label,
-      kind: "reading",
-      checkedAt: at,
-      usedPercent: reading.usedPercent,
-      ...reading.resetsAt === undefined ? {} : { resetsAt: reading.resetsAt },
-      ...reading.windowMinutes === undefined ? {} : { windowMinutes: reading.windowMinutes }
-    });
-  }
-  for (const pair of observation.coverage ?? []) {
-    const scope = pair.scope ?? ALL_SCOPE;
-    const key = limitKey(scope, pair.label);
-    if (carried.has(key) || !applies(key))
-      continue;
-    const existing = entries.get(key);
-    entries.set(key, existing === undefined || existing.kind === "absent" ? { scope, label: pair.label, kind: "absent", checkedAt: at } : { scope, label: pair.label, kind: "retired", retiredAt: at });
-  }
-  const { limits: _limits, budget: _budget, counters: _counters, credits: _credits, ...unknownKeys } = base;
-  const budget = mergeBudget(base.budget, observation.budget, at);
-  const counters = mergeCounters(base.counters, observation.counters);
-  const credits = mergeCredits(base.credits, observation.credits);
-  return {
-    ...unknownKeys,
-    limits: [...entries.values()].sort(compareEntries),
-    ...budget === undefined ? {} : { budget },
-    ...counters === undefined ? {} : { counters },
-    ...credits === undefined ? {} : { credits }
-  };
-}
-
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/quota/codec.js
-var quotaCodec = Object.freeze({
-  validate: isQuotaMap,
-  decode: decodeQuotaMap,
-  merge: mergeQuotaObservation
-});
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/quota/format.js
-var QUOTA_STALE_AFTER_MS = 15 * 60000;
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/errors.js
-class ClaustrumConsumerError extends Error {
-  kind;
-  constructor(kind, message) {
-    super(message);
-    this.name = "ClaustrumConsumerError";
-    this.kind = kind;
-  }
-}
-
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.js
-function matches(entry, credentialId, accountIdentity) {
-  if (entry.accountIdentity !== undefined && accountIdentity !== undefined)
-    return entry.accountIdentity === accountIdentity;
-  return entry.credentialId === credentialId;
-}
-function isDeclined(entries, credentialId, accountIdentity) {
-  return entries.some((entry) => matches(entry, credentialId, accountIdentity));
-}
-function declineAccount(entries, credentialId, accountIdentity) {
-  const entry = {
-    credentialId,
-    ...accountIdentity !== undefined && { accountIdentity }
-  };
-  return [
-    ...entries.filter((existing) => existing.credentialId !== credentialId || existing.accountIdentity !== accountIdentity),
-    entry
-  ];
-}
-function acceptAccount(entries, credentialIds, accountIdentity) {
-  return entries.filter((entry) => !credentialIds.some((id) => matches(entry, id, accountIdentity)));
-}
-
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/quota-writer.js
-import { resolve as resolve7 } from "node:path";
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/logger/engine.js
-import { appendFileSync, chmodSync, existsSync, renameSync, statSync } from "node:fs";
-import { open as open3 } from "node:fs/promises";
-import { dirname as dirname5, resolve as resolve6 } from "node:path";
-
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/logger/redact.js
-var SECRET_KEY_EXACT = /^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i;
-var TOKEN_VALUE = /\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g;
-var MASK = "***REDACTED***";
-var MAX_ERROR_DEPTH = 8;
-function isError(value) {
-  return value instanceof Error || Object.prototype.toString.call(value) === "[object Error]";
-}
-function createRedactor(options = {}) {
-  const patterns = [TOKEN_VALUE, ...options.extraValuePatterns ?? []].map((pattern) => new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`));
-  function isSecretKey(key) {
-    const normalized = key.toLowerCase().replace(/[-_]/g, "");
-    return SECRET_KEY_EXACT.test(key) || normalized.includes("apikey") || normalized.endsWith("secret") || normalized.endsWith("password") || normalized.endsWith("token") && !normalized.endsWith("tokens") || !!options.extraSecretKeys?.(normalized);
-  }
-  function errorEntries(error) {
-    const fields = error;
-    const entries = [
-      ["name", error.name],
-      ["message", error.message],
-      ["stack", error.stack]
-    ];
-    for (const key of ["code", "status", "cause"])
-      if (fields[key] !== undefined)
-        entries.push([key, fields[key]]);
-    const listed = new Set(entries.map(([key]) => key));
-    for (const entry of Object.entries(error))
-      if (!listed.has(entry[0]))
-        entries.push(entry);
-    return entries;
-  }
-  function walk(value, keys, seen, errorDepth = 0) {
-    if (typeof value === "string") {
-      return patterns.reduce((text, pattern) => text.replace(pattern, MASK), value);
-    }
-    if (!value || typeof value !== "object")
-      return value;
-    if (seen.has(value))
-      return "[Circular]";
-    seen.add(value);
-    try {
-      if (Array.isArray(value))
-        return value.map((item) => walk(item, keys, seen, errorDepth));
-      const error = isError(value);
-      if (error && errorDepth >= MAX_ERROR_DEPTH)
-        return "[Truncated]";
-      const childDepth = error ? errorDepth + 1 : errorDepth;
-      return Object.fromEntries((error ? errorEntries(value) : Object.entries(value)).map(([key, item]) => [
-        key,
-        keys && isSecretKey(key) ? MASK : walk(item, keys, seen, childDepth)
-      ]));
-    } finally {
-      seen.delete(value);
-    }
-  }
-  return {
-    redact: (value) => walk(value, true, new WeakSet),
-    redactStrings: (value) => walk(value, false, new WeakSet)
-  };
-}
-var defaultRedactor = createRedactor();
-var redact = defaultRedactor.redact;
-var redactStrings = defaultRedactor.redactStrings;
-
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/logger/engine.js
-var ORDER = {
-  error: 0,
-  warn: 1,
-  info: 2,
-  debug: 3,
-  trace: 4
-};
-var MAX_BYTES = 5 * 1024 * 1024;
-var ROTATE_KEEP = 3;
-function chmodPrivate(path) {
-  try {
-    chmodSync(path, 384);
-  } catch {}
-}
-function rotateIfNeeded(f) {
-  try {
-    if (!(existsSync(f) && statSync(f).size >= MAX_BYTES))
-      return;
-    for (let i = ROTATE_KEEP - 1;i >= 1; i--) {
-      if (existsSync(`${f}.${i}`)) {
-        const rotated = `${f}.${i + 1}`;
-        renameSync(`${f}.${i}`, rotated);
-        chmodPrivate(rotated);
-      }
-    }
-    const rotated = `${f}.1`;
-    renameSync(f, rotated);
-    chmodPrivate(rotated);
-  } catch {}
-}
-async function closeWindowsFile(sink) {
-  const { file, handle } = sink;
-  sink.file = undefined;
-  sink.handle = undefined;
-  if (file && handle)
-    await privateOperation(file, "log-close", () => handle.close());
-}
-async function openWindowsFile(sink, file) {
-  await ensurePrivateDirectory(dirname5(file));
-  try {
-    await verifyPrivate(file, "file", true);
-  } catch (error) {
-    if (error.code !== "ENOENT")
-      throw error;
-    try {
-      await createPrivateBytes(file, "");
-    } catch (creationError) {
-      if (creationError.code !== "EEXIST")
-        throw creationError;
-      await verifyPrivate(file, "file", true);
-    }
-  }
-  sink.handle = await privateOperation(file, "log-open", () => open3(file, "a"));
-  sink.file = file;
-  return sink.handle;
-}
-async function flushWindowsFile(sink, file, text) {
-  file = resolve6(file);
-  try {
-    if (sink.file !== file)
-      await closeWindowsFile(sink);
-    let handle = sink.handle ?? await openWindowsFile(sink, file);
-    const info = await privateOperation(file, "log-stat", () => handle.stat());
-    if (info.size >= MAX_BYTES) {
-      await closeWindowsFile(sink);
-      for (let i = ROTATE_KEEP - 1;i >= 0; i--) {
-        const source = i === 0 ? file : `${file}.${i}`;
-        const target = `${file}.${i + 1}`;
-        try {
-          await verifyPrivate(source, "file", true);
-        } catch (error) {
-          if (error.code === "ENOENT")
-            continue;
-          throw error;
-        }
-        try {
-          await verifyPrivate(target, "file", true);
-        } catch (error) {
-          if (error.code !== "ENOENT")
-            throw error;
-        }
-        await replaceWindowsFile(source, target);
-        await verifyPrivate(target, "file");
-      }
-      handle = await openWindowsFile(sink, file);
-    }
-    await privateOperation(file, "log-append", () => handle.appendFile(text, "utf8"));
-  } catch (error) {
-    await closeWindowsFile(sink).catch(() => {});
-    throw error;
-  }
-}
-function safeSerialize(data) {
-  try {
-    return ` ${JSON.stringify(data)}`;
-  } catch {
-    return " [unserializable]";
-  }
-}
-function createEngine(options) {
-  let logFileSource;
-  let initLevelSource;
-  let runtimeLevel;
-  let redactor = createRedactor();
-  let captureSink;
-  let buffer = [];
-  let timer;
-  let orderedSink = Promise.resolve();
-  let sinkError;
-  const windowsFile = {};
-  function queueWindows(operation) {
-    const next = orderedSink.then(operation);
-    orderedSink = next.catch((error) => {
-      sinkError = error;
-    });
-    return next;
-  }
-  function configure(next) {
-    if (windowsPrivateFiles && next.file !== logFileSource)
-      queueWindows(() => closeWindowsFile(windowsFile)).catch(() => {});
-    logFileSource = next.file;
-    initLevelSource = next.level;
-    redactor = createRedactor(next);
-    captureSink = next.captureSink;
-  }
-  function setLogLevel(l) {
-    if (l === undefined || l in ORDER)
-      runtimeLevel = l;
-  }
-  function logFilePath() {
-    if (logFileSource === undefined)
-      return;
-    const resolved = typeof logFileSource === "function" ? logFileSource() : logFileSource;
-    return resolved || undefined;
+}
+function mergeCredits(stored, observed) {
+  if (observed === undefined)
+    return stored;
+  if (stored !== undefined && observed.checkedAt < stored.checkedAt) {
+    return stored;
   }
-  function configuredLevel() {
-    if (runtimeLevel)
-      return runtimeLevel;
-    const floor = typeof initLevelSource === "function" ? initLevelSource() : initLevelSource;
-    if (floor && floor in ORDER)
-      return floor;
-    return "info";
+  return { ...observed };
+}
+function mergeQuotaObservation(stored, observation) {
+  const decoded = stored === undefined ? undefined : decodeQuotaMap(stored);
+  if (stored !== undefined && decoded === undefined) {
+    throw new QuotaCodecError("stored quota map is malformed");
   }
-  function flushLogs(close = true) {
-    if (timer) {
-      clearTimeout(timer);
-      timer = undefined;
-    }
-    if (!buffer.length) {
-      if (windowsPrivateFiles)
-        return queueWindows(async () => {
-          if (close)
-            await closeWindowsFile(windowsFile);
-          if (sinkError)
-            throw sinkError;
-        });
-      return;
-    }
-    let file;
-    try {
-      file = logFilePath();
-    } catch {
-      buffer = [];
-      if (windowsPrivateFiles && close)
-        return queueWindows(() => closeWindowsFile(windowsFile));
-      return;
-    }
-    const text = buffer.join("");
-    buffer = [];
-    if (!file) {
-      if (windowsPrivateFiles && close)
-        return queueWindows(() => closeWindowsFile(windowsFile));
-      return;
-    }
-    if (windowsPrivateFiles) {
-      return queueWindows(async () => {
-        try {
-          await flushWindowsFile(windowsFile, file, text);
-        } finally {
-          if (close)
-            await closeWindowsFile(windowsFile);
-        }
-      });
-    }
-    try {
-      rotateIfNeeded(file);
-      if (existsSync(file))
-        chmodPrivate(file);
-      appendFileSync(file, text, { encoding: "utf8", mode: 384 });
-    } catch {}
+  if (!isQuotaObservation(observation)) {
+    throw new QuotaCodecError("quota observation is malformed");
   }
-  function schedule() {
-    if (!timer)
-      timer = setTimeout(() => {
-        timer = undefined;
-        const flushed = flushLogs(false);
-        if (flushed instanceof Promise)
-          flushed.catch(() => {});
-      }, 500);
+  const base = decoded ?? { limits: [] };
+  const at = observation.checkedAt;
+  const entries = new Map;
+  for (const entry of base.limits) {
+    entries.set(limitKey(entry.scope, entry.label), entry);
   }
-  function emit(channel, level, message, data) {
-    if (logFileSource === undefined && captureSink === undefined)
-      return;
-    try {
-      if (ORDER[level] > ORDER[configuredLevel()])
-        return;
-      const scrubbedMessage = redactor.redactStrings(message);
-      let scrubbedData;
-      try {
-        scrubbedData = redactor.redact(data);
-      } catch {
-        scrubbedData = "[unserializable]";
-      }
-      const line = `[${new Date().toISOString()}] ${level.toUpperCase()} [${channel}] ${scrubbedMessage}` + (data === undefined ? "" : safeSerialize(scrubbedData)) + `
-`;
-      try {
-        captureSink?.({
-          channel,
-          level,
-          message: scrubbedMessage,
-          data: scrubbedData
-        });
-      } catch {}
-      if (logFileSource === undefined)
-        return;
-      buffer.push(line);
-      if (buffer.length >= 50) {
-        const flushed = flushLogs(false);
-        if (flushed instanceof Promise)
-          flushed.catch(() => {});
-      } else
-        schedule();
-    } catch {}
+  const applies = (key) => {
+    const existing = entries.get(key);
+    return existing === undefined || at >= entryTime(existing);
+  };
+  const carried = new Set;
+  for (const reading of observation.readings ?? []) {
+    const scope = reading.scope ?? ALL_SCOPE;
+    const key = limitKey(scope, reading.label);
+    carried.add(key);
+    if (!applies(key))
+      continue;
+    entries.set(key, {
+      scope,
+      label: reading.label,
+      kind: "reading",
+      checkedAt: at,
+      usedPercent: reading.usedPercent,
+      ...reading.resetsAt === undefined ? {} : { resetsAt: reading.resetsAt },
+      ...reading.windowMinutes === undefined ? {} : { windowMinutes: reading.windowMinutes }
+    });
   }
-  function createLogger(channel) {
-    return {
-      error: (m, d) => emit(channel, "error", m, d),
-      warn: (m, d) => emit(channel, "warn", m, d),
-      info: (m, d) => emit(channel, "info", m, d),
-      debug: (m, d) => emit(channel, "debug", m, d),
-      trace: (m, d) => emit(channel, "trace", m, d)
-    };
+  for (const pair of observation.coverage ?? []) {
+    const scope = pair.scope ?? ALL_SCOPE;
+    const key = limitKey(scope, pair.label);
+    if (carried.has(key) || !applies(key))
+      continue;
+    const existing = entries.get(key);
+    entries.set(key, existing === undefined || existing.kind === "absent" ? { scope, label: pair.label, kind: "absent", checkedAt: at } : { scope, label: pair.label, kind: "retired", retiredAt: at });
   }
-  function reset() {
-    if (windowsPrivateFiles)
-      queueWindows(() => closeWindowsFile(windowsFile)).catch(() => {});
-    sinkError = undefined;
-    buffer = [];
-    if (timer) {
-      clearTimeout(timer);
-      timer = undefined;
-    }
-    logFileSource = undefined;
-    initLevelSource = undefined;
-    runtimeLevel = undefined;
-    redactor = createRedactor();
-    captureSink = undefined;
+  const { limits: _limits, budget: _budget, counters: _counters, credits: _credits, ...unknownKeys } = base;
+  const budget = mergeBudget(base.budget, observation.budget, at);
+  const counters = mergeCounters(base.counters, observation.counters);
+  const credits = mergeCredits(base.credits, observation.credits);
+  return {
+    ...unknownKeys,
+    limits: [...entries.values()].sort(compareEntries),
+    ...budget === undefined ? {} : { budget },
+    ...counters === undefined ? {} : { counters },
+    ...credits === undefined ? {} : { credits }
+  };
+}
+
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/quota/codec.js
+var quotaCodec = Object.freeze({
+  validate: isQuotaMap,
+  decode: decodeQuotaMap,
+  merge: mergeQuotaObservation
+});
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/quota/format.js
+var QUOTA_STALE_AFTER_MS = 15 * 60000;
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/errors.js
+class ClaustrumConsumerError extends Error {
+  kind;
+  constructor(kind, message) {
+    super(message);
+    this.name = "ClaustrumConsumerError";
+    this.kind = kind;
   }
-  if (options)
-    configure(options);
-  return { configure, createLogger, setLogLevel, flushLogs, reset };
 }
-var defaultEngine = createEngine();
-function createLogger(channel) {
-  return defaultEngine.createLogger(channel);
+
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.js
+function matches(entry, credentialId, accountIdentity) {
+  if (entry.accountIdentity !== undefined && accountIdentity !== undefined)
+    return entry.accountIdentity === accountIdentity;
+  return entry.credentialId === credentialId;
+}
+function isDeclined(entries, credentialId, accountIdentity) {
+  return entries.some((entry) => matches(entry, credentialId, accountIdentity));
+}
+function declineAccount(entries, credentialId, accountIdentity) {
+  const entry = {
+    credentialId,
+    ...accountIdentity !== undefined && { accountIdentity }
+  };
+  return [
+    ...entries.filter((existing) => existing.credentialId !== credentialId || existing.accountIdentity !== accountIdentity),
+    entry
+  ];
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/quota/commit-interval.js
+function acceptAccount(entries, credentialIds, accountIdentity) {
+  return entries.filter((entry) => !credentialIds.some((id) => matches(entry, id, accountIdentity)));
+}
+
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/quota-writer.js
+import { resolve as resolve7 } from "node:path";
+
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/quota/commit-interval.js
 var QUOTA_COMMIT_INTERVAL_MS = 30000;
 var quotaCommitTimer = {
   now: () => performance.now(),
@@ -4758,7 +4934,7 @@ var quotaCommitTimer = {
   }
 };
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/quota/pending.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/quota/pending.js
 function quotaFields(publication, witness = "") {
   const result = new Map;
   const { observation } = publication;
@@ -4806,7 +4982,7 @@ function quotaFields(publication, witness = "") {
   return result;
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/quota-writer.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/quota-writer.js
 var writers = new Map;
 var logger = createLogger("claustrum");
 var COALESCE_MS = 100;
@@ -4991,7 +5167,7 @@ async function drainVaultQuota(path, timeoutMs = 1000) {
   }
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/roster.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/roster.js
 function vaultRosterSeed(roster) {
   return {
     declined: roster.declined.map((entry) => ({ ...entry })),
@@ -5537,7 +5713,7 @@ async function refreshVaultRoster(options) {
   }
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/limits/vault-adapter.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/limits/vault-adapter.js
 function bindingsOf(namespace, roster) {
   return (roster?.rows ?? []).map((row) => ({
     account: {
@@ -5632,7 +5808,7 @@ async function createVaultLimitsAdapter(options) {
   await read();
   return adapter;
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/redaction/index.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/redaction/index.js
 import { types } from "node:util";
 var escapedErrorField = /"(?:e|\\u0065)(?:r|\\u0072){2}(?:o|\\u006f)(?:r|\\u0072)"\s*:/i;
 var escapedErrorType = /"(?:t|\\u0074)(?:y|\\u0079)(?:p|\\u0070)(?:e|\\u0065)"\s*:\s*"(?:e|\\u0065)(?:r|\\u0072){2}(?:o|\\u006f)(?:r|\\u0072)"/i;
@@ -6487,7 +6663,69 @@ function limitRefusal(decision, host, now) {
     throw new Error("claustrum-auth: unsupported limit refusal");
   return localLimitRefusal(new Response(wire.body, { status: wire.status, headers: wire.headers }), wire.hostRetry);
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/routing/sticky.js
+
+// ../core/src/routing.ts
+var routingDeclinedText = "Thalamus routing declined this request, so it was not sent.";
+var routingNoAnswerText = "Thalamus routing did not answer, so this API key request was not sent.";
+function routingRefusalText(code) {
+  if (code === "routing-declined")
+    return routingDeclinedText;
+  if (code === "routing-no-answer")
+    return routingNoAnswerText;
+  return;
+}
+function hasVaultRoutingAccessor() {
+  try {
+    return typeof Reflect.get(globalThis, Symbol.for("cortexkit.routing")) === "function";
+  } catch {
+    return false;
+  }
+}
+async function selectRoutedKey(consumer, provider, modelId, sessionId, excluded = new Set, nextRoute) {
+  if (!hasVaultRoutingAccessor())
+    return;
+  const routes = consumer.routingRows();
+  const roster = consumer.snapshot?.()?.rows ?? [];
+  const next = nextRoute ?? routes.find((row) => !excluded.has(row.id))?.id;
+  if (roster.find((row) => row.routeId === next)?.credentialType === "oauth")
+    return;
+  if (!sessionId)
+    throw new ClaustrumAuthError("routing-no-answer");
+  const enabled = new Set(routes.map((row) => row.id));
+  const candidates = roster.filter((row) => enabled.has(row.routeId) && !excluded.has(row.routeId) && row.credentialType === "api_key").map((row) => ({
+    routeId: row.routeId,
+    credentialId: row.credentialId,
+    accountId: row.accountIdentity ?? row.credentialId
+  }));
+  const answer = await askRouting({
+    sessionId,
+    provider,
+    modelId,
+    candidates,
+    refusals: true
+  });
+  if (!answer)
+    throw new ClaustrumAuthError("routing-no-answer");
+  if ("refused" in answer)
+    throw new ClaustrumAuthError("routing-declined");
+  return answer.candidate;
+}
+async function reportRoutedBalance(key, sessionId, service, status, body) {
+  if (!key || !sessionId || status !== 402)
+    return;
+  const text = await body().catch(() => "");
+  if (!isBalanceFailure(service, text))
+    return;
+  const providerCode = service === "openrouter" ? "openrouter_credits" : "http_402";
+  reportRouting({
+    sessionId,
+    accountId: key.accountId,
+    credentialId: key.credentialId,
+    outcome: "credential_refused",
+    providerCode
+  });
+}
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/routing/sticky.js
 var QUOTA_STALENESS_MS = 15 * 60000;
 var MIN_RESET_HOURS = 1 / 60;
 // ../core/src/serving.ts
@@ -6559,6 +6797,7 @@ function createFetch(options) {
       cache: request.cache
     };
     const tried = new Set;
+    let routedAttempt = false;
     const rejected = new Set;
     const secrets = [];
     let redirectBilling;
@@ -6619,10 +6858,26 @@ function createFetch(options) {
     try {
       for (;; ) {
         signal.throwIfAborted();
+        if (routedAttempt && pending && !pending.parsed)
+          return await redactResponse(pending.response, secrets);
         const rows = await candidates();
+        const ownDecision = pending ? decide("after-limit", rows, pending.response.status, pending.account, pending.parsed) : decide("pre-send", rows);
+        if (ownDecision.action === "pass" && pending)
+          return await redactResponse(pending.response, secrets);
+        const nextRoute = ownDecision.action === "reroute" ? ownDecision.account.accountId : rows.find((row) => row.admitted && row.placementEligible)?.account.accountId;
+        const routed = await selectRoutedKey(options.consumer, options.routing?.provider ?? options.entry.service, options.routing?.modelId ?? "", options.routing?.sessionId, new Set([...tried, ...rejected]), nextRoute);
+        routedAttempt = routed !== undefined;
+        const routedId = routed?.routeId;
         if (!pending && !rows.some((row) => row.admitted))
           throw new ClaustrumAuthError("no-vault-account");
-        const initial = pending ? decide("after-limit", rows, pending.response.status, pending.account, pending.parsed) : decide("pre-send", rows);
+        const initial = routed ? {
+          action: "reroute",
+          account: rows.find((row) => row.account.accountId === routedId)?.account ?? {
+            namespace: "claustrum-auth:routing",
+            accountId: routed.routeId,
+            incarnation: "routing"
+          }
+        } : ownDecision;
         if (initial.action === "pass" && pending)
           return await redactResponse(pending.response, secrets);
         if (initial.action === "refuse") {
@@ -6632,11 +6887,11 @@ function createFetch(options) {
         if (initial.action !== "reroute")
           throw new Error("claustrum-auth: unsupported limit action");
         const route = initial.account.accountId;
-        if (limits && !await limits.beforeDispatch(route)) {
+        if (!routed && limits && !await limits.beforeDispatch(route)) {
           rejected.add(route);
           continue;
         }
-        if (limits) {
+        if (!routed && limits) {
           if (!(await candidates()).find((row) => row.account.accountId === route)?.ready)
             continue;
         }
@@ -6653,7 +6908,9 @@ function createFetch(options) {
         for (;; ) {
           signal.throwIfAborted();
           checkOrigin(target, options.entry);
-          response = await options.consumer.send(route, async (receipt, dispatchSignal) => {
+          const dispatch = async (receipt, dispatchSignal) => {
+            if (routed && receipt.credentialId !== routed.credentialId)
+              throw new ClaustrumAuthError("routing-no-answer");
             secrets.push(receipt.accessToken);
             const draft = placeReceipt(target, headers, options.entry, receipt);
             const dispatchHeaders = new Headers(draft.headers);
@@ -6685,7 +6942,11 @@ function createFetch(options) {
               failedBilling?.end(false, false);
               throw error;
             }
-          }, { site: "claustrum-auth", signal });
+          };
+          response = await options.consumer.send(route, dispatch, {
+            site: "claustrum-auth",
+            signal
+          });
           signal.throwIfAborted();
           const location = response.headers.get("location");
           if (![301, 302, 303, 307, 308].includes(response.status) || !location)
@@ -6713,8 +6974,12 @@ function createFetch(options) {
           redirectBilling = undefined;
           response = observeBillingResponse(billing, response);
         }
+        const account = observation?.binding.account ?? {
+          ...initial.account,
+          accountId: route
+        };
         const parsed = await limitFromReply({
-          account: observation?.binding.account ?? initial.account,
+          account,
           service: options.entry.service,
           status: response.status,
           headers: response.headers,
@@ -6722,6 +6987,7 @@ function createFetch(options) {
           now: now()
         });
         const balance402 = parsed?.kind === "payment-balance";
+        await reportRoutedBalance(routed, options.routing?.sessionId, options.entry.service, response.status, () => response.clone().text());
         if (response.ok || response.status === 402 && !balance402) {
           if (limits && observation) {
             if (hasBalanceRule(options.entry.service) && observation.paymentProbe)
@@ -6745,7 +7011,7 @@ function createFetch(options) {
         }
         pending = {
           response,
-          account: observation?.binding.account ?? initial.account,
+          account,
           parsed
         };
       }
@@ -6757,10 +7023,10 @@ function createFetch(options) {
     }
   };
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/index.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/index.js
 import { ClaustrumClient } from "@cortexkit/claustrum-client";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/availability.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/availability.js
 import { ClaustrumCredentialError } from "@cortexkit/claustrum-client";
 import { SocketClosedError, SocketTimeoutError, SubcCallError } from "@cortexkit/subc-client";
 var VAULT_FAILURE_CLASSES = Object.freeze({
@@ -6854,12 +7120,12 @@ function classifyVaultFailure(error) {
   return VAULT_FAILURE_CLASSES[code];
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/insula.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/insula.js
 import { resolve as resolve9 } from "node:path";
 import { storeIdentity } from "@cortexkit/claustrum-client";
 import { SubcClient } from "@cortexkit/subc-client";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/watch.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/watch.js
 var SAFETY_POLL_MS = 5 * 60000;
 var WATCH_RETRY_MS = 5 * 60000;
 var RESUBSCRIBE_BACKOFF_MS = 1000;
@@ -7055,7 +7321,7 @@ class ScopedRosterWatch {
   }
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/insula.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/insula.js
 function insulaUsageTransport(options) {
   const identity = options.identity ?? storeIdentity(options.projectRoot ?? process.cwd(), options.storagePath ?? process.cwd());
   return {
@@ -7411,10 +7677,10 @@ function acquireInsulaQuotaSource(transport, tokenPath) {
   };
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/index.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/index.js
 import { ClaustrumCredentialError as ClaustrumCredentialError6 } from "@cortexkit/claustrum-client";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/util/any-signal.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/util/any-signal.js
 function combineAbortSignals(signals) {
   const controller = new AbortController;
   const listeners = [];
@@ -7451,17 +7717,17 @@ function combineAbortSignals(signals) {
   return { signal: controller.signal, dispose };
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/custody.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/custody.js
 import { channel } from "node:diagnostics_channel";
 import { ClaustrumCredentialError as ClaustrumCredentialError5 } from "@cortexkit/claustrum-client";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.js
 import { constants as fsConstants } from "node:fs";
-import { chmod, mkdir as mkdir3, open as open4, readFile as readFile3, realpath, rename as rename4, stat as stat4, unlink as unlink2 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname6, extname, isAbsolute, join as join5, resolve as resolve10 } from "node:path";
+import { chmod, mkdir as mkdir3, open as open4, readFile as readFile3, realpath, rename as rename4, stat as stat4, unlink as unlink3 } from "node:fs/promises";
+import { basename as basename3, dirname as dirname6, extname, isAbsolute, join as join5, resolve as resolve10 } from "node:path";
 import { ClaustrumCredentialError as ClaustrumCredentialError3, ClaustrumClient as ClaustrumWireClient, writeEnrollmentTokenFile } from "@cortexkit/claustrum-client";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/host.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/host.js
 import { ClaustrumCredentialError as ClaustrumCredentialError2 } from "@cortexkit/claustrum-client";
 var VAULT_HOST_STATUS = "Served by Thalamus";
 var hostClients = new WeakSet;
@@ -7555,7 +7821,7 @@ function connectVaultHost(pluginId) {
   throw new ClaustrumUnreachableError("host-accessor-missing");
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.js
 var ENROLLMENT_SCHEMA = 1;
 var ENROLLMENT_FILE_MAX_BYTES = 16 * 1024;
 var TOKEN_RE = /^[0-9a-f]{64}$/;
@@ -7572,9 +7838,28 @@ var TERMINAL_ENROLLMENT_CODES = new Set([
 var RETRYABLE_ENROLLMENT_CODES = new Set([
   "pending_queue_full"
 ]);
+function validEnrollmentRequestedGrants(grants) {
+  return Array.isArray(grants) && grants.length >= 1 && grants.length <= 4 && Array.from(grants).every((grant) => {
+    if (!isRecord4(grant) || Object.keys(grant).length !== 2 || grant.operation !== "read" && grant.operation !== "list" || !isRecord4(grant.selector))
+      return false;
+    const keys = Object.keys(grant.selector);
+    const key = keys[0];
+    return keys.length === 1 && (key === "category" || key === "exact") && typeof grant.selector[key] === "string" && grant.selector[key].trim().length > 0;
+  });
+}
+function grantProposal(state) {
+  return {
+    ...state.requestedGrants !== undefined && {
+      requestedGrants: state.requestedGrants
+    },
+    ...state.requestedGrantsStatus !== undefined && {
+      requestedGrantsStatus: state.requestedGrantsStatus
+    }
+  };
+}
 function getClaustrumEnrollmentPaths(tokenPath) {
   const extension = extname(tokenPath) || ".json";
-  const stem = basename2(tokenPath, extname(tokenPath));
+  const stem = basename3(tokenPath, extname(tokenPath));
   return {
     statePath: join5(dirname6(tokenPath), `${stem}-state${extension}`),
     tokenPath
@@ -7604,6 +7889,7 @@ function decodeEnrollmentState(value) {
     throw invalidState();
   }
   if (value.phase === "pending") {
+    const grants = decodeGrantProposal(value);
     if (!TOKEN_RE.test(String(value.requestSecret ?? "")) || value.requestId !== undefined && (typeof value.requestId !== "string" || value.requestId.length === 0) || !validTimestamp(value.createdAt) || !validTimestamp(value.updatedAt)) {
       throw invalidState();
     }
@@ -7616,10 +7902,12 @@ function decodeEnrollmentState(value) {
         requestId: value.requestId
       },
       createdAt: value.createdAt,
-      updatedAt: value.updatedAt
+      updatedAt: value.updatedAt,
+      ...grants
     };
   }
   if (value.phase === "approved") {
+    const grants = decodeGrantProposal(value);
     if (value.approvedName !== undefined && (typeof value.approvedName !== "string" || value.approvedName.length === 0) || !validGeneration(value.tokenGeneration) || !validTimestamp(value.updatedAt)) {
       throw invalidState();
     }
@@ -7631,7 +7919,8 @@ function decodeEnrollmentState(value) {
         approvedName: value.approvedName
       },
       tokenGeneration: value.tokenGeneration,
-      updatedAt: value.updatedAt
+      updatedAt: value.updatedAt,
+      ...grants
     };
   }
   if (value.phase === "denied" || value.phase === "blocked") {
@@ -7650,6 +7939,11 @@ function decodeEnrollmentState(value) {
   }
   throw invalidState();
 }
+function decodeGrantProposal(value) {
+  if (value.requestedGrants !== undefined && !validEnrollmentRequestedGrants(value.requestedGrants) || value.requestedGrantsStatus !== undefined && (value.requestedGrants === undefined || value.requestedGrantsStatus !== "sent" && value.requestedGrantsStatus !== "dropped"))
+    return {};
+  return grantProposal(value);
+}
 function decodeTokenFile(value) {
   if (!isRecord4(value) || !TOKEN_RE.test(String(value.token ?? "")) || !validGeneration(value.token_generation)) {
     throw new ClaustrumConsumerError("invalid-token", "invalid Claustrum enrollment token file");
@@ -7762,7 +8056,8 @@ async function readEnrollmentStatus(paths, proposedName) {
         ...state?.phase === "approved" && state.approvedName !== undefined && {
           approvedName: state.approvedName
         },
-        tokenGeneration: token.token_generation
+        tokenGeneration: token.token_generation,
+        ...state && (state.phase === "approved" || state.phase === "pending") && grantProposal(state)
       }
     };
   }
@@ -7821,7 +8116,8 @@ function statusFromState(state) {
     return {
       state: "pending",
       proposedName: state.proposedName,
-      ...state.requestId !== undefined && { requestId: state.requestId }
+      ...state.requestId !== undefined && { requestId: state.requestId },
+      ...grantProposal(state)
     };
   }
   if (state.phase === "approved") {
@@ -7831,7 +8127,8 @@ function statusFromState(state) {
       ...state.approvedName !== undefined && {
         approvedName: state.approvedName
       },
-      tokenGeneration: state.tokenGeneration
+      tokenGeneration: state.tokenGeneration,
+      ...grantProposal(state)
     };
   }
   if (state.phase === "denied")
@@ -7843,10 +8140,10 @@ function statusFromState(state) {
   };
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/host-slot.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/host-slot.js
 var CUSTODY_PLACEHOLDER_PREFIX = "claustrum-tombstone:v1:";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/shutdown.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/shutdown.js
 function shutdownWarning(logger, shutdown) {
   let warned = false;
   return (pendingOperations) => {
@@ -7884,7 +8181,7 @@ async function drainShutdown(pending, onTimeout) {
   }
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/usage.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/usage.js
 import { ClaustrumCredentialError as ClaustrumCredentialError4 } from "@cortexkit/claustrum-client";
 function plain(value) {
   return value !== null && typeof value === "object" && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
@@ -8012,7 +8309,7 @@ class ScopedUsageReporter {
   }
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/custody.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/custody.js
 function isScopedCredentialRotation(served, current) {
   return current !== undefined && !current.fromKeptReceipt && !served.fromKeptReceipt && current.credentialId === served.credentialId && current.accountIdentity === served.accountIdentity && current.recordVersion !== served.recordVersion;
 }
@@ -8718,7 +9015,7 @@ class ClaustrumScopedCustody {
   }
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/consumer.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/consumer.js
 var DEFAULT_CONNECT_TIMEOUT_MS = 1e4;
 function unreachableConnect() {
   return new ClaustrumUnreachableError;
@@ -9429,10 +9726,10 @@ class ClaustrumConsumer {
     await this.#disposing;
   }
 }
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/hub.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/hub.js
 import { createHash as createHash3 } from "node:crypto";
 import { channel as channel2 } from "node:diagnostics_channel";
-import { readdir, stat as stat5 } from "node:fs/promises";
+import { readdir as readdir2, stat as stat5 } from "node:fs/promises";
 import { dirname as dirname7, join as join6, resolve as resolve11 } from "node:path";
 var sharedRosters = new Map;
 var FILE_ID = /^[a-z0-9][a-z0-9._-]{0,63}$/;
@@ -10080,7 +10377,7 @@ class ClaustrumDiscoveryHub {
     const name = `${entry.provider}.json`;
     const candidates = [join6(this.#generationDirectory, name)];
     try {
-      for (const key of await readdir(this.#generationDirectory))
+      for (const key of await readdir2(this.#generationDirectory))
         if (key !== this.#key && FINGERPRINT.test(key))
           candidates.push(join6(this.#generationDirectory, key, name));
     } catch {}
@@ -10277,7 +10574,7 @@ class ClaustrumDiscoveryHub {
   }
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/claustrum/index.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/claustrum/index.js
 var SCOPED_CONNECT_TIMEOUT_MS = 1e4;
 async function connectClaustrumScopedClient(options) {
   const { connectTimeoutMs, ...client } = options;
@@ -10305,12 +10602,12 @@ async function connectClaustrumScopedClient(options) {
 }
 // ../core/src/menu.ts
 import { Readable, Writable } from "node:stream";
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/store/hooks.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/store/hooks.js
 import { AsyncLocalStorage } from "node:async_hooks";
 var insideHook = new AsyncLocalStorage;
 var insideCodec = new AsyncLocalStorage;
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.js
 var POOL_LOCK_DEFAULTS = Object.freeze({
   ttlMs: 1e4,
   timeoutMs: 15000,
@@ -10318,15 +10615,15 @@ var POOL_LOCK_DEFAULTS = Object.freeze({
   renew: true
 });
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/store/schema.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/store/schema.js
 var POOL_KEY = "commonAuthPool";
 var REFRESH_STAMP_TOLERANCE_MS = 5 * 60000;
 var UNSAFE_IDS = new Set(["__proto__", "constructor", "prototype"]);
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/store/provider-state.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/store/provider-state.js
 var DECLINE_TRANSITION = Symbol.for("@cortexkit/common-auth/store/decline-transition");
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/store/settings.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/store/settings.js
 var POOL_OWNED_KEYS = Object.freeze([
   "version",
   "accounts",
@@ -10334,9 +10631,9 @@ var POOL_OWNED_KEYS = Object.freeze([
 ]);
 var settingsCache = new FileReadCache;
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/store/pool.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/store/pool.js
 var processMemory = new Map;
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/auth-menu/ansi.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/auth-menu/ansi.js
 var ANSI = {
   hide: "\x1B[?25l",
   show: "\x1B[?25h",
@@ -10418,7 +10715,7 @@ function truncateAnsi(input, maxVisibleChars) {
   return output.includes("\x1B[") ? `${output}${ANSI.reset}${suffix}` : output + suffix;
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/auth-menu/terminal.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/auth-menu/terminal.js
 function processTerminal() {
   return {
     input: process.stdin,
@@ -10434,7 +10731,7 @@ function printLine(terminal, line = "") {
 `);
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/auth-menu/select.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/auth-menu/select.js
 var ESCAPE_TIMEOUT_MS = 50;
 function colorCode(color) {
   if (color === "red")
@@ -10572,7 +10869,7 @@ async function select(terminal, items, options) {
   });
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/auth-menu/confirm.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/auth-menu/confirm.js
 async function confirm(terminal, message, defaultYes = false) {
   if (!isInteractive(terminal))
     return false;
@@ -10586,7 +10883,7 @@ async function confirm(terminal, message, defaultYes = false) {
   return await select(terminal, items, { message }) ?? false;
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/auth-menu/menu.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/auth-menu/menu.js
 function menuContext(terminal) {
   const interactive = isInteractive(terminal);
   return {
@@ -11176,14 +11473,14 @@ async function startupStep(step, action) {
 import path2 from "node:path";
 import { resolveClaustrumConnectionPath } from "@cortexkit/claustrum-client";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/pi-slot/slot.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/pi-slot/slot.js
 import { createHash as createHash4 } from "node:crypto";
 import { constants } from "node:fs";
-import { lstat as lstat4, mkdir as mkdir5, open as open5, unlink as unlink3 } from "node:fs/promises";
+import { lstat as lstat4, mkdir as mkdir5, open as open5, unlink as unlink4 } from "node:fs/promises";
 import { dirname as dirname8, resolve as resolve12 } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/pi-slot/lock.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/pi-slot/lock.js
 import { rmdirSync, statSync as statSync2, utimesSync } from "node:fs";
 import { mkdir as mkdir4, rmdir, stat as stat6, utimes } from "node:fs/promises";
 var STALE = 30000;
@@ -11375,7 +11672,7 @@ async function acquirePiLock(authPath, onCompromised, onRenew) {
   };
 }
 
-// ../../node_modules/.bun/@cortexkit+common-auth@0.43.0+7766d853e58521fa/node_modules/@cortexkit/common-auth/dist/pi-slot/slot.js
+// ../../node_modules/.bun/@cortexkit+common-auth@0.47.0+d48131f39628582b/node_modules/@cortexkit/common-auth/dist/pi-slot/slot.js
 class PiSlotError extends Error {
   code;
   constructor(code) {
@@ -11658,7 +11955,7 @@ function createPiSlot(options, onStep, hooks) {
   }
   async function deleteStash(assertLock) {
     assertLock();
-    await unlink3(stashPath);
+    await unlink4(stashPath);
     await syncDir(dirname8(stashPath));
     onStep?.("stash-deleted");
   }
@@ -11773,6 +12070,9 @@ class FlagStore {
 var refused = "Request refused locally by the claustrum-auth plugin:";
 var nothingSent = "Nothing was sent.";
 function refusalText(code, provider, entry) {
+  const routing = routingRefusalText(code);
+  if (routing)
+    return routing;
   switch (code) {
     case "placement-refused":
       return `${refused} this model's request carries the ${provider} vault placeholder outside the Authorization header, and vault keys are only sent as Authorization: Bearer. ${nothingSent}`;
@@ -12007,11 +12307,17 @@ class PiRuntime {
   stream(served, model, context, options) {
     if (options?.apiKey !== served.placeholder)
       return streamSimple(model, context, options);
+    const sessionId = options.sessionId ?? this.#ctx.sessionManager?.getSessionId();
+    const routing = {
+      sessionId,
+      provider: model.provider,
+      modelId: model.id
+    };
     const inner = options.fetch ?? globalThis.fetch;
     if (!hasBillingAccessor())
       return streamSimple(model, context, {
         ...options,
-        fetch: this.ownedFetch(served, inner)
+        fetch: this.ownedFetch(served, inner, undefined, routing)
       });
     let current;
     let attempt = 0;
@@ -12019,16 +12325,16 @@ class PiRuntime {
       ...options,
       fetch: this.ownedFetch(served, inner, (receipt) => {
         current?.end();
-        if (!hasBillingAccessor())
+        if (!sessionId || !hasBillingAccessor())
           return;
-        current = new BillingAttempt(served.entry, model.provider, options.sessionId ?? this.#ctx.sessionManager.getSessionId(), "primary", model.id, receipt, ++attempt, true);
+        current = new BillingAttempt(served.entry, model.provider, sessionId, "primary", model.id, receipt, ++attempt, true);
         return current;
-      })
+      }, routing)
     });
     stream.result().then((message) => current?.piEnd(message.responseId, message.stopReason), () => current?.end());
     return stream;
   }
-  ownedFetch(served, inner, billing) {
+  ownedFetch(served, inner, billing, routing) {
     const serve = createFetch({
       entry: served.entry,
       placeholder: served.placeholder,
@@ -12037,7 +12343,8 @@ class PiRuntime {
       fetch: inner,
       rateLimitMarks: served.marks,
       limits: () => this.#core.limits(served.provider),
-      billing
+      billing,
+      routing
     });
     return async (input, init) => {
       try {