@cortexkit/antigravity-auth-core 3.0.6 → 3.0.8

package/dist/common-auth-embedded/claustrum/watch.js

@@ -0,0 +1,254 @@
+/**
+ * While a vault watch is healthy, the roster is still read this often: the
+ * watch carries no history, so a lost notice or a silently dead stream is
+ * caught within this period.
+ */
+export const SAFETY_POLL_MS = 5 * 60_000;
+/**
+ * After a watch fails without being accepted, the host polls and tries one
+ * new watch this much later, so a refusing or draining module is never asked
+ * in a tight loop.
+ */
+export const WATCH_RETRY_MS = 5 * 60_000;
+/**
+ * First wait before re-subscribing a watch that closed after it had been
+ * accepted. It doubles for each further close in a row, up to WATCH_RETRY_MS.
+ */
+export const RESUBSCRIBE_BACKOFF_MS = 1_000;
+/**
+ * Tells whether a notice follows the previous one with nothing lost between
+ * them. `seq` restarts at 1 for every watch and `epoch` names the sending
+ * module's process lifetime. A sequence gap (notices are sheddable), a
+ * different epoch (the module restarted) or a notice of an unknown kind all
+ * mean changes may have been missed, so the caller must re-read everything.
+ */
+export class ChangeNoticeReader {
+    #epoch;
+    #seq = 0;
+    /**
+     * Begin a new watch, whose first notice is seq 1 again. The epoch is kept,
+     * so a module restart between two watches still reads as a break.
+     */
+    restart() {
+        this.#seq = 0;
+    }
+    continuous(notice) {
+        const continuous = notice.kind === 'changed' &&
+            notice.seq === this.#seq + 1 &&
+            (this.#epoch === undefined || notice.epoch === this.#epoch);
+        this.#epoch = notice.epoch;
+        this.#seq = notice.seq;
+        return continuous;
+    }
+}
+/**
+ * Runs `read` with at most one call in flight and at most one more queued
+ * behind it, however many requests arrive meanwhile. A request made while a
+ * read is running may have arrived after that read took its snapshot, so it
+ * earns exactly one more read; any further requests share that one.
+ */
+export class CoalescedRead {
+    #read;
+    #onError;
+    #running;
+    #queued = false;
+    constructor(read, onError) {
+        this.#read = read;
+        this.#onError = onError;
+    }
+    /** The read in flight (including its queued follow-up), if any. */
+    get running() {
+        return this.#running;
+    }
+    request() {
+        if (this.#running) {
+            this.#queued = true;
+            return this.#running;
+        }
+        this.#running = (async () => {
+            do {
+                this.#queued = false;
+                try {
+                    await this.#read();
+                }
+                catch (error) {
+                    this.#onError(error);
+                }
+            } while (this.#queued);
+        })().finally(() => {
+            this.#running = undefined;
+        });
+        return this.#running;
+    }
+}
+/**
+ * Keeps one vault `watchScoped` open for a host and runs the host's discovery
+ * when a notice shows the visible account list changed. Discovery runs only
+ * when the notice's view differs from the last discovered roster's view, when
+ * a notice shows a gap or a new epoch, or on the first notice of a watch that
+ * was re-subscribed after a close (the time between two watches was not
+ * observed). It never opens a second watch while one is open.
+ */
+export class ScopedRosterWatch {
+    #options;
+    #reader = new ChangeNoticeReader();
+    #reads;
+    #mode = 'polling';
+    #watch;
+    #timer;
+    #stopped = false;
+    #latestView;
+    #force = false;
+    /**
+     * How many accepted watches in a row have closed; each one doubles the wait
+     * before the next re-subscribe. Reset once a watch stays up five minutes.
+     */
+    #closes = 0;
+    constructor(options) {
+        this.#options = options;
+        this.#reads = new CoalescedRead(async () => {
+            const force = this.#force;
+            this.#force = false;
+            // A read is only ever requested by a notice, which set #latestView.
+            if (force || this.#latestView !== this.#options.view())
+                await this.#options.discover(this.#latestView ?? '');
+        }, (error) => {
+            if (!this.#stopped)
+                this.#options.onError?.(error);
+        });
+    }
+    get mode() {
+        return this.#mode;
+    }
+    start() {
+        if (this.#stopped || this.#watch || this.#timer)
+            return;
+        if (typeof this.#options.client.watchScoped !== 'function') {
+            // A claustrum-client older than 0.12.0: poll exactly as before.
+            this.#setMode('fallback', 'client-without-watch');
+            return;
+        }
+        void this.#open(false);
+    }
+    stop() {
+        if (this.#stopped)
+            return;
+        this.#stopped = true;
+        if (this.#timer)
+            (this.#options.clearTimeoutImpl ?? clearTimeout)(this.#timer);
+        this.#timer = undefined;
+        const watch = this.#watch;
+        this.#watch = undefined;
+        watch?.handle.stop();
+    }
+    #setMode(mode, reason) {
+        if (this.#mode === mode)
+            return;
+        this.#mode = mode;
+        this.#options.logger?.debug('claustrum vault watch', { mode, reason });
+        this.#options.onMode?.(mode);
+    }
+    #later(delay, run) {
+        this.#timer = (this.#options.setTimeoutImpl ?? setTimeout)(() => {
+            this.#timer = undefined;
+            if (!this.#stopped)
+                run();
+        }, delay);
+        this.#timer.unref?.();
+    }
+    async #open(resubscribed) {
+        let token;
+        try {
+            token = await this.#options.enrollmentToken();
+        }
+        catch (error) {
+            if (this.#stopped)
+                return;
+            this.#options.onError?.(error);
+            this.#fallback('token-unreadable');
+            return;
+        }
+        const watchScoped = this.#options.client.watchScoped;
+        if (this.#stopped || this.#watch || !watchScoped)
+            return;
+        this.#reader.restart();
+        // A re-subscribed watch reads on its first notice: changes made while no
+        // watch was open were never announced.
+        this.#force = resubscribed;
+        let watch;
+        let handle;
+        try {
+            handle = watchScoped.call(this.#options.client, (notice) => {
+                if (this.#stopped || !watch || this.#watch !== watch)
+                    return;
+                watch.notices++;
+                if (watch.notices === 1) {
+                    this.#options.onReachable?.();
+                    watch.acceptedAt = (this.#options.now ?? Date.now)();
+                    this.#setMode('watching', 'accepted');
+                }
+                if (!this.#reader.continuous(notice))
+                    this.#force = true;
+                this.#latestView = notice.view;
+                // The read itself decides whether to list, against the roster as
+                // it stands when the read runs.
+                void this.#reads.request();
+            }, { enrollmentToken: token });
+        }
+        catch (error) {
+            this.#options.onError?.(error);
+            this.#fallback('watch-failed');
+            return;
+        }
+        watch = { handle, notices: 0 };
+        this.#watch = watch;
+        this.#setMode('polling', resubscribed ? 'resubscribing' : 'opening');
+        const opened = watch;
+        handle.closed.then((end) => this.#closed(opened, end), (error) => this.#closed(opened, { kind: 'transport_lost', error }));
+    }
+    #closed(watch, end) {
+        if (this.#stopped || this.#watch !== watch)
+            return;
+        this.#watch = undefined;
+        if (end.kind === 'stopped')
+            return;
+        if (end.kind === 'transport_lost')
+            this.#options.onTransportLost?.();
+        if (end.kind === 'unsupported') {
+            // An older vault answers unknown_method: poll exactly as before.
+            this.#setMode('fallback', 'vault-without-watch');
+            return;
+        }
+        if (end.kind === 'refused') {
+            this.#fallback('refused');
+            try {
+                this.#options.onRefused(end.error);
+            }
+            catch (error) {
+                this.#options.onError?.(error);
+            }
+            return;
+        }
+        if (watch.notices > 0) {
+            // An accepted watch that closed (the vault restarted, or a revocation
+            // ended it) gets one new watch. A revocation then shows up as that
+            // watch's refusal.
+            const now = (this.#options.now ?? Date.now)();
+            if (watch.acceptedAt !== undefined &&
+                now - watch.acceptedAt >= SAFETY_POLL_MS)
+                this.#closes = 0;
+            const delay = Math.min(RESUBSCRIBE_BACKOFF_MS * 2 ** Math.min(this.#closes, 16), WATCH_RETRY_MS);
+            this.#closes++;
+            this.#setMode('polling', 'resubscribing');
+            this.#later(delay, () => void this.#open(true));
+            return;
+        }
+        // Zero notices: the watch was never accepted (the vault is draining, or
+        // the connection failed). The client already made one read to learn why.
+        this.#fallback(end.kind);
+    }
+    #fallback(reason) {
+        this.#setMode('fallback', reason);
+        this.#later(WATCH_RETRY_MS, () => void this.#open(false));
+    }
+}

package/dist/common-auth-embedded/fs/private-files.js

@@ -184,19 +184,25 @@ export async function replaceWindowsFile(from, to, options = {}) {
     to = resolve(to);
     const now = options.now ?? (() => performance.now());
     const start = now();
-    const deadline = Math.min(start + 500, options.deadline ?? Infinity);
+    const leaseDeadline = options.deadline ?? Infinity;
+    let retryDeadline;
     const delays = [0, 10, 20, 40, 80, 100];
     let original;
     let attempts = 0;
     for (const delay of delays) {
+        const deadline = Math.min(retryDeadline ?? Infinity, leaseDeadline);
         if (now() >= deadline)
             break;
         if (delay)
             await (options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))))(Math.min(delay, Math.max(0, deadline - now())));
         if (now() >= deadline)
             break;
+        const fenceStart = now();
         await options.beforeRename?.();
-        if (now() >= deadline)
+        // Ownership checks fence every attempt but do not spend the sharing-retry budget.
+        if (retryDeadline !== undefined)
+            retryDeadline += now() - fenceStart;
+        if (now() >= leaseDeadline)
             break;
         attempts++;
         try {
@@ -212,6 +218,8 @@ export async function replaceWindowsFile(from, to, options = {}) {
                     !detail.reason;
             if (!candidate)
                 break;
+            // Start the retry window only once a rename has actually failed.
+            retryDeadline ??= now() + 500;
         }
     }
     const error = new PrivateFileError(to, 'rename', original ??

package/dist/common-auth-embedded/fs/refresh-file-lock.d.ts

@@ -13,7 +13,7 @@ export interface RefreshFileLock {
     whenLost(): Promise<LockLoss>;
     hasLost(): boolean;
 }
-export declare function acquireRefreshFileLock(options: {
+type RefreshFileLockOptions = {
     name: string;
     ttlMs: number;
     /**
@@ -22,7 +22,6 @@ export declare function acquireRefreshFileLock(options: {
      * be one host's path.
      */
     path: string;
-    now?: () => number;
     renew?: boolean;
     renewIntervalMs?: number;
     /** Notifies a live-owner refusal without awaiting; observer failures are ignored. */
@@ -30,4 +29,11 @@ export declare function acquireRefreshFileLock(options: {
     /** Synchronous, never awaited; throws and returned promise/thenable rejections are isolated. */
     onRenewalTimer?: (event: 'scheduled' | 'cancelled') => void;
     onStep?: (step: 'stale-marker-stat' | 'stale-marker-claimed' | 'stale-lock-observed' | 'lock-read-ready' | 'lock-missing' | 'stale-lock-confirmed' | 'stale-lock-removed' | 'stale-lock-recreated' | 'eviction-marker-acquired' | 'renewal-owner-confirmed' | 'renewal-marker-unavailable' | 'renewal-write-fenced' | 'renewal-write-ready' | 'renewal-write-finished' | 'relinquish-read' | 'renewal-finished' | 'release-owner-confirmed') => void | Promise<void>;
+};
+/** Filesystem leases share wall time across all callers and processes. */
+export declare function acquireRefreshFileLock(options: RefreshFileLockOptions): Promise<RefreshFileLock | null>;
+/** @internal Clock seam for lease tests; not exported by the package's fs entry point. */
+export declare function acquireRefreshFileLockWithClock(options: RefreshFileLockOptions & {
+    now?: () => number;
 }): Promise<RefreshFileLock | null>;
+export {};

package/dist/common-auth-embedded/fs/refresh-file-lock.js

@@ -31,7 +31,12 @@ export function isLostMarkerRaceError(error) {
     return (code === 'ENOENT' ||
         (!windowsPrivateFiles && (code === 'EINVAL' || code === 'ENOTDIR')));
 }
-export async function acquireRefreshFileLock(options) {
+/** Filesystem leases share wall time across all callers and processes. */
+export function acquireRefreshFileLock(options) {
+    return acquireRefreshFileLockWithClock({ ...options, now: Date.now });
+}
+/** @internal Clock seam for lease tests; not exported by the package's fs entry point. */
+export async function acquireRefreshFileLockWithClock(options) {
     const lockPath = lockPathFor(options.path, options.name);
     const legacyOwnerPath = join(lockPath, 'owner.json');
     const ownerId = randomUUID();

package/dist/common-auth-embedded/pi-slot/lock.js

@@ -1,4 +1,4 @@
-import { rmdirSync, statSync } from 'node:fs';
+import { rmdirSync, statSync, utimesSync } from 'node:fs';
 import { mkdir, rmdir, stat, utimes } from 'node:fs/promises';
 // Protocol source: proper-lockfile 4.1.2 lib/lockfile.js and lib/mtime-precision.js;
 // line-level citations and the Pi lock options are recorded in docs/sources.md.
@@ -135,7 +135,9 @@ export async function acquirePiLock(authPath, onCompromised, onRenew) {
             return;
         let observed;
         try {
-            observed = await stat(path);
+            // Durable writes can occupy every async filesystem worker in fsync.
+            // Renew on the calling thread so their queue cannot consume the lease.
+            observed = statSync(path);
         }
         catch (error) {
             retry(error);
@@ -151,12 +153,14 @@ export async function acquirePiLock(authPath, onCompromised, onRenew) {
         }
         const next = new Date(precision === 's' ? Math.ceil(Date.now() / 1_000) * 1_000 : Date.now());
         try {
-            await utimes(path, next, next);
+            utimesSync(path, next, next);
         }
         catch (error) {
             retry(error);
             return;
         }
+        // A metadata syscall can itself stall; never confirm an expired lease.
+        assertFresh();
         if (released)
             return;
         mtime = next.getTime();

package/dist/common-auth-embedded/quota/format.d.ts

@@ -11,8 +11,14 @@ export declare const NO_LIMITS_REPORTED = "no limits reported";
 /**
  * `compact` fits a footer or a sidebar row: each window's figure, the credit
  * budget and the stale marker, without reset times. `full` adds each reset.
+ * `narrow` fits one line per account in a narrow sidebar: `5h 92% · 7d 66%
+ * · Fa 98% left`, the account-wide windows plus at most one model-scoped
+ * window or the budget (as `cr`), and no stale marker (see `isQuotaStale`).
+ * A reading whose windows belong to named groups and that has no
+ * account-wide window reads up to two groups instead:
+ * `Ge 7d 62% · Ot 7d 48% left`.
  */
-export type QuotaTextForm = 'compact' | 'full';
+export type QuotaTextForm = 'compact' | 'full' | 'narrow';
 export interface QuotaTextOptions {
     /** The current time in ms, for reset countdowns and the stale marker. */
     now: number;
@@ -55,17 +61,25 @@ export declare function quotaWindowName(limit: Pick<ProjectedLimit, 'scope' | 'l
  * and the optional age keep the shared formatter's wording.
  */
 export declare function quotaWindowParts(quota: ProjectedQuota | undefined, options: QuotaTextOptions): QuotaParts;
+/**
+ * Whether the reading is stale: true exactly when the compact and full forms
+ * would end with `checked … ago`. The narrow form leaves that age out to stay
+ * short, so a caller drawing a narrow line uses this to dim it instead.
+ */
+export declare function isQuotaStale(quota: ProjectedQuota | undefined, options: QuotaTextOptions): boolean;
 /**
  * The pieces of a quota text, in order: one per reported window
  * (`5h 58% left, resets 2h`), then the credit budget when there is one, then
  * `checked 3h ago` when the oldest piece shown is stale. Empty when nothing
  * was reported; `formatQuota` turns that into a sentence. A caller printing
- * one line per window (the terminal auth menu) uses these directly.
+ * one line per window (the terminal auth menu) uses these directly. In the
+ * narrow form the pieces are the narrow line's (`5h 92%`, `7d 66% left`).
  */
 export declare function quotaTextParts(quota: ProjectedQuota | undefined, options: QuotaTextOptions): string[];
 /**
  * A row's quota as one line: `5h 58% left · 7d 90% left` in the compact
- * form, with `, resets 2h` after each window in the full form. With nothing
+ * form, with `, resets 2h` after each window in the full form, and
+ * `5h 58% · 7d 90% left` in the narrow form. With nothing
  * reported it is `NO_QUOTA_READING`, or `NO_LIMITS_REPORTED` when the
  * provider answered without a limit for any window.
  */