@cortexkit/common-auth 0.2.9 → 0.4.0

package/dist/logger/engine.js

@@ -8,53 +8,6 @@ const ORDER = {
     trace: 4,
 };
 const MAX_BYTES = 5 * 1024 * 1024;
-/**
- * Where lines are written, and the level floor, as the host supplied them.
- *
- * Both start unset. A host decides where its log lives — that decision reads
- * host environment variables and host directories, neither of which belongs in
- * shared code — and calls `initLogger` before it runs any command. Until then
- * every `log.*` call is a silent no-op: throwing would turn the first command a
- * host forgot to wire into a crash, and buffering would hold credential-bearing
- * lines for an init that may never arrive.
- */
-let logFileSource;
-let initLevelSource;
-let runtimeLevel;
-let redactor = createRedactor();
-let captureSink;
-/**
- * Point the logger at a host's file and level. Idempotent: calling it again
- * replaces both. A runtime level installed by `setLogLevel` is deliberately
- * left alone, because it is the operator's explicit choice and outranks the
- * floor a host computed at start-up.
- */
-export function initLogger(options) {
-    logFileSource = options.file;
-    initLevelSource = options.level;
-    redactor = createRedactor(options);
-    captureSink = options.captureSink;
-}
-export function setLogLevel(l) {
-    if (l === undefined || l in ORDER)
-        runtimeLevel = l;
-}
-function logFilePath() {
-    if (logFileSource === undefined)
-        return undefined;
-    const resolved = typeof logFileSource === 'function' ? logFileSource() : logFileSource;
-    return resolved || undefined;
-}
-function configuredLevel() {
-    if (runtimeLevel)
-        return runtimeLevel;
-    const floor = typeof initLevelSource === 'function' ? initLevelSource() : initLevelSource;
-    if (floor && floor in ORDER)
-        return floor;
-    return 'info';
-}
-let buffer = [];
-let timer;
 const ROTATE_KEEP = 3;
 function chmodPrivate(path) {
     try {
@@ -83,46 +36,6 @@ function rotateIfNeeded(f) {
         /* never throw */
     }
 }
-/**
- * Write whatever is buffered. Safe to call synchronously from a process-exit
- * handler, which is how each host drains the buffer on shutdown.
- */
-export function flushLogs() {
-    if (timer) {
-        clearTimeout(timer);
-        timer = undefined;
-    }
-    if (!buffer.length)
-        return;
-    let file;
-    try {
-        file = logFilePath();
-    }
-    catch {
-        buffer = [];
-        return;
-    }
-    const text = buffer.join('');
-    buffer = [];
-    if (!file)
-        return;
-    try {
-        rotateIfNeeded(file);
-        if (existsSync(file))
-            chmodPrivate(file);
-        appendFileSync(file, text, { encoding: 'utf8', mode: 0o600 });
-    }
-    catch {
-        /* never throw */
-    }
-}
-function schedule() {
-    if (!timer)
-        timer = setTimeout(() => {
-            timer = undefined;
-            flushLogs();
-        }, 500);
-}
 function safeSerialize(data) {
     try {
         return ` ${JSON.stringify(data)}`;
@@ -131,69 +44,199 @@ function safeSerialize(data) {
         return ' [unserializable]';
     }
 }
-function emit(channel, level, message, data) {
-    if (logFileSource === undefined)
-        return;
-    try {
-        if (ORDER[level] > ORDER[configuredLevel()])
+/**
+ * One logger's settings and buffer.
+ *
+ * Where lines are written and the level floor start unset unless `options`
+ * supplies them. A host decides where its log lives (that decision reads host
+ * environment variables and host directories, neither of which belongs in
+ * shared code) and configures the logger before it runs any command. Until
+ * then every `log.*` call is a silent no-op: throwing would turn the first
+ * command a host forgot to wire into a crash, and buffering would hold
+ * credential-bearing lines for a configuration that may never arrive.
+ */
+function createEngine(options) {
+    let logFileSource;
+    let initLevelSource;
+    let runtimeLevel;
+    let redactor = createRedactor();
+    let captureSink;
+    let buffer = [];
+    let timer;
+    function configure(next) {
+        logFileSource = next.file;
+        initLevelSource = next.level;
+        redactor = createRedactor(next);
+        captureSink = next.captureSink;
+    }
+    function setLogLevel(l) {
+        if (l === undefined || l in ORDER)
+            runtimeLevel = l;
+    }
+    function logFilePath() {
+        if (logFileSource === undefined)
+            return undefined;
+        const resolved = typeof logFileSource === 'function' ? logFileSource() : logFileSource;
+        return resolved || undefined;
+    }
+    function configuredLevel() {
+        if (runtimeLevel)
+            return runtimeLevel;
+        const floor = typeof initLevelSource === 'function'
+            ? initLevelSource()
+            : initLevelSource;
+        if (floor && floor in ORDER)
+            return floor;
+        return 'info';
+    }
+    function flushLogs() {
+        if (timer) {
+            clearTimeout(timer);
+            timer = undefined;
+        }
+        if (!buffer.length)
             return;
-        const scrubbedMessage = redactor.redactStrings(message);
-        let scrubbedData;
+        let file;
         try {
-            scrubbedData = redactor.redact(data);
+            file = logFilePath();
         }
         catch {
-            scrubbedData = '[unserializable]';
+            buffer = [];
+            return;
         }
-        const line = `[${new Date().toISOString()}] ${level.toUpperCase()} [${channel}] ${scrubbedMessage}` +
-            (data === undefined ? '' : safeSerialize(scrubbedData)) +
-            '\n';
-        // A failing observer must not prevent file logging or escape into the host.
+        const text = buffer.join('');
+        buffer = [];
+        if (!file)
+            return;
         try {
-            captureSink?.({
-                channel,
-                level,
-                message: scrubbedMessage,
-                data: scrubbedData,
-            });
+            rotateIfNeeded(file);
+            if (existsSync(file))
+                chmodPrivate(file);
+            appendFileSync(file, text, { encoding: 'utf8', mode: 0o600 });
+        }
+        catch {
+            /* never throw */
         }
-        catch { }
-        buffer.push(line);
-        if (buffer.length >= 50)
-            flushLogs();
-        else
-            schedule();
     }
-    catch {
-        // Provider and redaction failures must never turn diagnostics into a host crash.
+    function schedule() {
+        if (!timer)
+            timer = setTimeout(() => {
+                timer = undefined;
+                flushLogs();
+            }, 500);
     }
+    function emit(channel, level, message, data) {
+        if (logFileSource === undefined)
+            return;
+        try {
+            if (ORDER[level] > ORDER[configuredLevel()])
+                return;
+            const scrubbedMessage = redactor.redactStrings(message);
+            let scrubbedData;
+            try {
+                scrubbedData = redactor.redact(data);
+            }
+            catch {
+                scrubbedData = '[unserializable]';
+            }
+            const line = `[${new Date().toISOString()}] ${level.toUpperCase()} [${channel}] ${scrubbedMessage}` +
+                (data === undefined ? '' : safeSerialize(scrubbedData)) +
+                '\n';
+            // A failing observer must not prevent file logging or escape into the host.
+            try {
+                captureSink?.({
+                    channel,
+                    level,
+                    message: scrubbedMessage,
+                    data: scrubbedData,
+                });
+            }
+            catch { }
+            buffer.push(line);
+            if (buffer.length >= 50)
+                flushLogs();
+            else
+                schedule();
+        }
+        catch {
+            // Provider and redaction failures must never turn diagnostics into a host crash.
+        }
+    }
+    function createLogger(channel) {
+        return {
+            error: (m, d) => emit(channel, 'error', m, d),
+            warn: (m, d) => emit(channel, 'warn', m, d),
+            info: (m, d) => emit(channel, 'info', m, d),
+            debug: (m, d) => emit(channel, 'debug', m, d),
+            trace: (m, d) => emit(channel, 'trace', m, d),
+        };
+    }
+    function reset() {
+        buffer = [];
+        if (timer) {
+            clearTimeout(timer);
+            timer = undefined;
+        }
+        logFileSource = undefined;
+        initLevelSource = undefined;
+        runtimeLevel = undefined;
+        redactor = createRedactor();
+        captureSink = undefined;
+    }
+    if (options)
+        configure(options);
+    return { configure, createLogger, setLogLevel, flushLogs, reset };
+}
+/**
+ * A logger instance of its own, configured with `options`. A plugin whose
+ * copy of this module may be shared with another plugin in the same process
+ * uses this instead of `initLogger`, so neither replaces the other's file,
+ * level, redaction or capture sink.
+ */
+export function createLoggerInstance(options) {
+    const { configure, createLogger, setLogLevel, flushLogs } = createEngine(options);
+    return { configure, createLogger, setLogLevel, flushLogs };
+}
+/**
+ * The instance behind the module-level functions below, which keep the
+ * single-plugin API: one plugin per copy of this module calls `initLogger`
+ * and `createLogger` without holding an instance.
+ */
+const defaultEngine = createEngine();
+/**
+ * Point the module's default logger at a host's file and level, and return
+ * it. Idempotent: calling it again replaces both. A runtime level installed
+ * by `setLogLevel` is deliberately left alone, because it is the operator's
+ * explicit choice and outranks the floor a host computed at start-up.
+ */
+export function initLogger(options) {
+    defaultEngine.configure(options);
+    const { configure, createLogger, setLogLevel, flushLogs } = defaultEngine;
+    return { configure, createLogger, setLogLevel, flushLogs };
+}
+export function setLogLevel(l) {
+    defaultEngine.setLogLevel(l);
+}
+/**
+ * Write whatever the default logger has buffered. Safe to call synchronously
+ * from a process-exit handler, which is how each host drains the buffer on
+ * shutdown.
+ */
+export function flushLogs() {
+    defaultEngine.flushLogs();
 }
 export function createLogger(channel) {
-    return {
-        error: (m, d) => emit(channel, 'error', m, d),
-        warn: (m, d) => emit(channel, 'warn', m, d),
-        info: (m, d) => emit(channel, 'info', m, d),
-        debug: (m, d) => emit(channel, 'debug', m, d),
-        trace: (m, d) => emit(channel, 'trace', m, d),
-    };
+    return defaultEngine.createLogger(channel);
 }
 export async function flushForTest() {
-    flushLogs();
+    defaultEngine.flushLogs();
 }
 /**
- * Return the logger to its uninitialised state. Only a test needs this: a
- * single process runs every test file, so a file path left over from one test
- * would keep a later "logger was never initialised" case writing lines.
+ * Return the default logger to its uninitialised state. Only a test needs
+ * this: a single process runs every test file, so a file path left over from
+ * one test would keep a later "logger was never initialised" case writing
+ * lines.
  */
 export function resetLoggerForTest() {
-    buffer = [];
-    if (timer) {
-        clearTimeout(timer);
-        timer = undefined;
-    }
-    logFileSource = undefined;
-    initLevelSource = undefined;
-    runtimeLevel = undefined;
-    redactor = createRedactor();
-    captureSink = undefined;
+    defaultEngine.reset();
 }

package/dist/logger/index.d.ts

@@ -1,6 +1,6 @@
 export type { CaptureSink, LogTestRecord } from './capture-sink.js';
 export { createCaptureSink } from './capture-sink.js';
-export type { InitLoggerOptions, Level } from './engine.js';
-export { createLogger, flushForTest, flushLogs, initLogger, resetLoggerForTest, setLogLevel, } from './engine.js';
+export type { ChannelLogger, InitLoggerOptions, Level, LoggerInstance, } from './engine.js';
+export { createLogger, createLoggerInstance, flushForTest, flushLogs, initLogger, resetLoggerForTest, setLogLevel, } from './engine.js';
 export type { RedactionOptions, Redactor } from './redact.js';
 export { createRedactor, redact, redactStrings } from './redact.js';

package/dist/logger/index.js

@@ -1,3 +1,3 @@
 export { createCaptureSink } from './capture-sink.js';
-export { createLogger, flushForTest, flushLogs, initLogger, resetLoggerForTest, setLogLevel, } from './engine.js';
+export { createLogger, createLoggerInstance, flushForTest, flushLogs, initLogger, resetLoggerForTest, setLogLevel, } from './engine.js';
 export { createRedactor, redact, redactStrings } from './redact.js';

package/dist/opencode2/index.d.ts

@@ -5,4 +5,4 @@ export type { FormAnswer, PoolAuthorization, PoolLoginMethod, RegisterOpenCode2A
 export { isPlaceholderCredential, PLACEHOLDER_LIFETIME_MS, PLACEHOLDER_METADATA_KEY, PLACEHOLDER_PREFIX, placeholderCredential, placeholderSecret, registerOpenCode2AuthMethods, } from './integration.js';
 export type { ServerSentEvent } from './sse.js';
 export { watchServerSentEvents } from './sse.js';
-export type { AccountRequest, ChooseAccountInput, EventVerdict, HeaderEdits, HostError, InstallOpenCode2AuthOptions, LimitSignal, OpenCode2AuthAdapter, OpenCode2AuthEventName, OpenCode2AuthEvents, OpenCode2AuthInstallation, OpenCode2AuthLogger, OpenCode2HookContext, RequestKind, RequestScope, RetryReason, SelectingHook, Transport, } from './types.js';
+export type { AccountHeadersResult, AccountRequest, Attempt, AttemptEndReason, AttemptOutcome, ChooseAccountInput, EventVerdict, HeaderEdits, HostError, InstallOpenCode2AuthOptions, LimitSignal, OpenCode2AuthAdapter, OpenCode2AuthEventName, OpenCode2AuthEvents, OpenCode2AuthInstallation, OpenCode2AuthLogger, OpenCode2HookContext, RequestKind, RequestScope, RetryReason, SelectingHook, Transport, } from './types.js';

package/dist/opencode2/install.d.ts

@@ -6,14 +6,32 @@ export declare function applyHeaderEdits(target: Record<string, string>, edits:
  * Installs multi-account auth on OpenCode 2's own provider drivers. Every
  * hook is scoped to `adapter.providerID`:
  *
- * - `model.request` picks the account for the request's `sessionID:kind` and
- *   sets its headers;
+ * - `model.request` picks the account for the request's `sessionID:kind`,
+ *   which starts a new attempt, and sets its headers;
  * - `http.request` and `experimental.ws.handshake` set them again, because
  *   the host applies its own credential after `model.request`;
- * - `http.response` and `experimental.ws.receive` read quota, refusals and
- *   whether output has started, attributed through the record above;
+ * - `experimental.ws.send` (only when the adapter rewrites frames) rewrites
+ *   each outgoing frame;
+ * - `http.response` and `experimental.ws.receive` read quota, refusals,
+ *   whether output has started and when the response ended, attributed to
+ *   an attempt by the rules below;
  * - `retry` asks the host to retry at once when an account was refused
  *   before any output, so `model.request` runs again and can pick another
  *   account, and refuses to retry once output has started.
+ *
+ * Attribution. An HTTP response belongs to the attempt whose `http.request`
+ * produced its request object, and to nothing else. The host hands
+ * `http.response` the request object the `http.request` hooks left, so a
+ * different object means a later hook replaced it; nothing then proves which
+ * send the response answers (an earlier attempt's send may still be in
+ * flight, and only the newest attempt of each session and kind is kept), and
+ * its feedback is dropped rather than guessed by recency. No marker can ride
+ * on the request instead: the host builds the wire request from that same
+ * object, so a marker would be sent to the provider. A WebSocket frame
+ * belongs to the newest attempt of its session and kind only while that
+ * attempt went out over WebSocket and has not ended: the host runs one
+ * exchange at a time per session socket, so frames between one handshake
+ * and the next belong to the earlier attempt. Anything else is attributed to
+ * no attempt and reaches no adapter callback or listener.
  */
-export declare function installOpenCode2Auth<Q>(ctx: OpenCode2HookContext, adapter: OpenCode2AuthAdapter<Q>, options?: InstallOpenCode2AuthOptions): Promise<OpenCode2AuthInstallation<Q>>;
+export declare function installOpenCode2Auth<Q, A = unknown>(ctx: OpenCode2HookContext, adapter: OpenCode2AuthAdapter<Q, A>, options?: InstallOpenCode2AuthOptions): Promise<OpenCode2AuthInstallation<Q, A>>;