@cortexkit/opencode-openai-auth 1.0.5 → 1.2.0

package/src/tui-compiled/raw/shared/0332701351b3eeec-format.js

@@ -22,18 +22,23 @@ export const NO_QUOTA_READING = 'no quota reading yet';
  */
 export const NO_LIMITS_REPORTED = 'no limits reported';
 /**
- * A length or a time span in its largest whole-ish unit: `45m`, `5h`, `3d`.
- * Spans under an hour are minutes, under a day hours, otherwise days, each
- * rounded to the nearest unit and never shown as zero.
+ * A time span in at most its two largest units: `45m`, `2h29m`, `5h`, `3d23h`,
+ * `7d`. Every unit is rounded down, so a reset is never shown later than it is;
+ * the one exception is a span under a minute, which reads `1m` rather than
+ * zero. A zero second unit is left out.
  */
 function shortSpan(ms) {
-    const minutes = Math.max(1, Math.round(ms / 60_000));
+    const minutes = Math.max(1, Math.floor(ms / 60_000));
     if (minutes < 60)
         return `${minutes}m`;
-    const hours = Math.round(minutes / 60);
-    if (hours < 24)
-        return `${hours}h`;
-    return `${Math.max(1, Math.round(minutes / 1440))}d`;
+    if (minutes < 1440) {
+        const hours = Math.floor(minutes / 60);
+        const rest = minutes % 60;
+        return rest === 0 ? `${hours}h` : `${hours}h${rest}m`;
+    }
+    const days = Math.floor(minutes / 1440);
+    const hours = Math.floor((minutes % 1440) / 60);
+    return hours === 0 ? `${days}d` : `${days}d${hours}h`;
 }
 /** A stored window length in minutes as its exact name: `5h`, `7d`, `90m`. */
 function lengthName(minutes) {
@@ -58,8 +63,12 @@ export function quotaWindowName(limit) {
 function clampPercent(remaining) {
     return Math.min(100, Math.max(0, remaining));
 }
+/** A remaining percentage as the whole number every form shows. */
+function wholePercent(remaining) {
+    return Math.round(clampPercent(remaining));
+}
 function percentLeft(remaining) {
-    return `${Math.round(clampPercent(remaining))}% left`;
+    return `${wholePercent(remaining)}% left`;
 }
 function resetDetails(resetsAt, checkedAt, now) {
     const at = resetsAt === undefined ? Number.NaN : Date.parse(resetsAt);
@@ -93,6 +102,16 @@ function displayOrder(left, right) {
  * and the optional age keep the shared formatter's wording.
  */
 export function quotaWindowParts(quota, options) {
+    const { windows, age } = scopedWindowParts(quota, options);
+    const parts = windows.map(({ part }) => part);
+    return age === undefined ? { windows: parts } : { windows: parts, age };
+}
+/**
+ * `quotaWindowParts` with each window's scope kept beside it. The narrow form
+ * needs the scope to name and pick model-scoped windows; the public parts do
+ * not carry it, so their shape stays as it was.
+ */
+function scopedWindowParts(quota, options) {
     if (!quota)
         return { windows: [] };
     const { now } = options;
@@ -102,12 +121,15 @@ export function quotaWindowParts(quota, options) {
     const windows = readings.map((limit) => {
         const remainingPercent = clampPercent(limit.remainingPercent ?? 0);
         return {
-            kind: 'window',
-            name: quotaWindowName(limit),
-            figure: percentLeft(limit.remainingPercent ?? 0),
-            remainingPercent,
-            checkedAt: limit.checkedAt,
-            ...resetDetails(limit.resetsAt, limit.checkedAt, now),
+            scope: limit.scope,
+            part: {
+                kind: 'window',
+                name: quotaWindowName(limit),
+                figure: percentLeft(limit.remainingPercent ?? 0),
+                remainingPercent,
+                checkedAt: limit.checkedAt,
+                ...resetDetails(limit.resetsAt, limit.checkedAt, now),
+            },
         };
     });
     const budget = quota.budget;
@@ -119,32 +141,131 @@ export function quotaWindowParts(quota, options) {
                 ? `credits ${percentLeft(remainingPercent)}`
                 : 'credits available';
         windows.push({
-            kind: 'budget',
-            name: 'credits',
-            figure,
-            ...(remainingPercent === undefined
-                ? {}
-                : { remainingPercent: clampPercent(remainingPercent) }),
-            checkedAt: budget.checkedAt,
-            ...resetDetails(budget.resetsAt, budget.checkedAt, now),
+            scope: ALL_SCOPE,
+            spent: budget.reached,
+            part: {
+                kind: 'budget',
+                name: 'credits',
+                figure,
+                ...(remainingPercent === undefined
+                    ? {}
+                    : { remainingPercent: clampPercent(remainingPercent) }),
+                checkedAt: budget.checkedAt,
+                ...resetDetails(budget.resetsAt, budget.checkedAt, now),
+            },
         });
     }
     if (windows.length > 0) {
-        const age = now - Math.min(...windows.map((part) => part.checkedAt));
+        const age = now - Math.min(...windows.map(({ part }) => part.checkedAt));
         if (age > (options.staleAfterMs ?? QUOTA_STALE_AFTER_MS)) {
             return { windows, age: `checked ${shortSpan(age)} ago` };
         }
     }
     return { windows };
 }
+/**
+ * Whether the reading is stale: true exactly when the compact and full forms
+ * would end with `checked … ago`. The narrow form leaves that age out to stay
+ * short, so a caller drawing a narrow line uses this to dim it instead.
+ */
+export function isQuotaStale(quota, options) {
+    return scopedWindowParts(quota, options).age !== undefined;
+}
+/**
+ * The model a scope names, as a display name: any namespace before a colon
+ * is dropped (`model:claude-opus-4` → `claude-opus-4`) and the first letter is
+ * capitalized (`fable` → `Fable`); the rest stays as written.
+ */
+function scopeDisplayName(scope) {
+    const model = scope.slice(scope.indexOf(':') + 1);
+    return model.charAt(0).toUpperCase() + model.slice(1);
+}
+/**
+ * Short names for the model scopes in one row: the first two letters of each
+ * display name. Names that would read the same for different models are each
+ * extended one letter at a time until they differ (`Fable` and `Fabric` read
+ * `Fabl` and `Fabr`); a name that runs out of letters stays whole.
+ */
+function scopeAbbreviations(scopes) {
+    const names = [...new Set(scopes.map(scopeDisplayName))];
+    const lengths = new Map(names.map((name) => [name, 2]));
+    const short = (name) => name.slice(0, lengths.get(name));
+    for (;;) {
+        const byShort = new Map();
+        for (const name of names) {
+            byShort.set(short(name), [...(byShort.get(short(name)) ?? []), name]);
+        }
+        let extended = false;
+        for (const group of byShort.values()) {
+            if (group.length < 2)
+                continue;
+            for (const name of group) {
+                const length = lengths.get(name) ?? 2;
+                if (length < name.length) {
+                    lengths.set(name, length + 1);
+                    extended = true;
+                }
+            }
+        }
+        if (!extended)
+            break;
+    }
+    return new Map(scopes.map((scope) => [scope, short(scopeDisplayName(scope))]));
+}
+/**
+ * The narrow form's pieces: every account-wide window as `5h 92%`, then at
+ * most one more item, with ` left` added once to the last piece. That item is
+ * the tightest (least remaining) of the model-scoped windows and the credit
+ * budget, so the line stays bounded whatever the account carries: a scoped
+ * window reads under its short model name (`Fa 98%`), the budget as `cr 75%`
+ * (`cr 0%` when spent). On a tie a scoped window wins over the budget, and
+ * among scoped windows the first in display order wins. The choice depends
+ * only on the reading, never on a width. A budget without a percentage cannot
+ * be chosen; when nothing at all is shown it keeps its compact wording
+ * (`credits available`). No age is added; `isQuotaStale` says whether the
+ * reading is stale. A window whose reset arrived after the reading keeps its
+ * figure, as in the other forms.
+ */
+function narrowTextParts(quota, options) {
+    const { windows } = scopedWindowParts(quota, options);
+    const general = windows.filter(({ part, scope }) => part.kind === 'window' && scope === ALL_SCOPE);
+    const scoped = windows.filter(({ part, scope }) => part.kind === 'window' && scope !== ALL_SCOPE);
+    const abbreviations = scopeAbbreviations(scoped.map(({ scope }) => scope));
+    // The items competing for the one slot after the account-wide windows, in
+    // tie-break order: scoped windows in display order, then the budget. A
+    // spent budget counts as 0% left; one without a percentage cannot compete.
+    const budget = windows.find(({ part }) => part.kind === 'budget');
+    const budgetLeft = budget?.spent ? 0 : budget?.part.remainingPercent;
+    const extras = [
+        ...scoped.map(({ scope, part }) => ({
+            label: abbreviations.get(scope) ?? scope,
+            remaining: part.remainingPercent ?? 0,
+        })),
+        ...(budgetLeft === undefined
+            ? []
+            : [{ label: 'cr', remaining: budgetLeft }]),
+    ];
+    // Strictly lower wins, so on a tie the earlier item keeps the slot.
+    const tightest = extras.reduce((best, item) => best === undefined || item.remaining < best.remaining ? item : best, undefined);
+    const pieces = general.map(({ part }) => `${part.name} ${wholePercent(part.remainingPercent ?? 0)}%`);
+    if (tightest) {
+        pieces.push(`${tightest.label} ${wholePercent(tightest.remaining)}%`);
+    }
+    if (pieces.length === 0)
+        return windows.map(({ part }) => part.figure);
+    return pieces.map((piece, index) => index === pieces.length - 1 ? `${piece} left` : piece);
+}
 /**
  * The pieces of a quota text, in order: one per reported window
  * (`5h 58% left, resets 2h`), then the credit budget when there is one, then
  * `checked 3h ago` when the oldest piece shown is stale. Empty when nothing
  * was reported; `formatQuota` turns that into a sentence. A caller printing
- * one line per window (the terminal auth menu) uses these directly.
+ * one line per window (the terminal auth menu) uses these directly. In the
+ * narrow form the pieces are the narrow line's (`5h 92%`, `7d 66% left`).
  */
 export function quotaTextParts(quota, options) {
+    if (options.form === 'narrow')
+        return narrowTextParts(quota, options);
     const parts = quotaWindowParts(quota, options);
     const full = (options.form ?? 'full') === 'full';
     const text = parts.windows.map((part) => {
@@ -155,7 +276,8 @@ export function quotaTextParts(quota, options) {
 }
 /**
  * A row's quota as one line: `5h 58% left · 7d 90% left` in the compact
- * form, with `, resets 2h` after each window in the full form. With nothing
+ * form, with `, resets 2h` after each window in the full form, and
+ * `5h 58% · 7d 90% left` in the narrow form. With nothing
  * reported it is `NO_QUOTA_READING`, or `NO_LIMITS_REPORTED` when the
  * provider answered without a limit for any window.
  */

package/src/tui-compiled/raw/shared/0f77ebc3c914c9c6-custody.js

@@ -0,0 +1,371 @@
+import { ClaustrumCredentialError, } from "@cortexkit/claustrum-client";
+import { createLogger } from "./cc9e0702a752cea7-index.js";
+import { readClaustrumEnrollmentToken } from "./b9588ad4725c1d10-enrollment.js";
+import { ClaustrumConsumerError } from "./ca0fccaba1d87af4-errors.js";
+import { CUSTODY_PLACEHOLDER_PREFIX } from "./d9d2892a4c371301-host-slot.js";
+/** Only a new version of the same account may replace an in-flight 401. */
+export function isScopedCredentialRotation(served, current) {
+    return (current !== undefined &&
+        current.credentialId === served.credentialId &&
+        current.accountIdentity === served.accountIdentity &&
+        current.recordVersion !== served.recordVersion);
+}
+function scopedRetryReason(served, current) {
+    if (current === undefined)
+        return 'reauthorize-failed';
+    if (current.credentialId !== served.credentialId)
+        return 'credential-changed';
+    if (current.accountIdentity !== served.accountIdentity)
+        return 'account-changed';
+    if (current.recordVersion === served.recordVersion)
+        return 'version-unchanged';
+    return 'rotated';
+}
+const defaultLogger = createLogger('claustrum');
+/**
+ * Decide whether a request that got a 401 should retry with the freshly
+ * re-authorized receipt, and log the decision. The vault can refresh a
+ * credential between the send and the 401; the log line lets that refresh be
+ * matched against the consumer's retry. `site` names the kind of request.
+ */
+export function decideScopedRetryAfter401(site, served, current, logger = defaultLogger) {
+    const retry = isScopedCredentialRotation(served, current);
+    logger.debug('scoped 401 re-authorized', {
+        site,
+        credentialId: served.credentialId,
+        servedVersion: served.recordVersion,
+        currentVersion: current?.recordVersion ?? null,
+        retry,
+        reason: scopedRetryReason(served, current),
+    });
+    return retry;
+}
+/**
+ * How long a served OAuth token must stay valid after the vault hands it out,
+ * so it cannot expire while a long request is still using it.
+ */
+export const SERVING_MARGIN_MS = 300_000;
+function invalidMaterial() {
+    return new ClaustrumConsumerError('invalid-material', 'Claustrum returned invalid credential material');
+}
+function accessTokenFromMaterial(material) {
+    let access = material.trim();
+    if (access.startsWith('{')) {
+        let parsed;
+        try {
+            parsed = JSON.parse(access);
+        }
+        catch {
+            throw invalidMaterial();
+        }
+        if (!parsed || typeof parsed !== 'object')
+            throw invalidMaterial();
+        const record = parsed;
+        const value = record.access_token ?? record.access;
+        access = typeof value === 'string' ? value : '';
+    }
+    // A header-safe token only: control characters could split the request,
+    // and the custody placeholder must never be sent as a credential.
+    if (!/^[\x21-\x7e]+$/.test(access) ||
+        access.startsWith(CUSTODY_PLACEHOLDER_PREFIX)) {
+        throw invalidMaterial();
+    }
+    return access;
+}
+function credentialTypeOf(row, family) {
+    if (!row.operations.includes('read'))
+        return undefined;
+    if (!row.categories.includes(family.category))
+        return undefined;
+    if (row.credentialType === 'oauth')
+        return row.refreshAdapter === family.refreshAdapter ? 'oauth' : undefined;
+    if (row.credentialType === 'api_key' && family.apiKeys)
+        return row.refreshAdapter === undefined ? 'api_key' : undefined;
+    return undefined;
+}
+/**
+ * The grants named in the vault's list reply, or undefined when it names none.
+ * Both fields must be present: a reply carrying only one of them is treated as
+ * unknown rather than completed with a guess. claustrum-client already refuses
+ * a malformed value, so nothing here validates it again.
+ */
+function grantReachOf(listed) {
+    const { grants, grantTuples } = listed;
+    if (grants === undefined || grantTuples === undefined)
+        return undefined;
+    return Object.freeze({
+        grants,
+        tuples: Object.freeze(grantTuples.map(({ selectorKind, selector, operation }) => Object.freeze({ selectorKind, selector, operation }))),
+    });
+}
+/**
+ * Reads this consumer's vault credentials (list, fetch, 401 report), with the
+ * enrollment token as authorization. Used by every host of a plugin. There is
+ * deliberately no credential cache and no single-flight of credential reads:
+ * each physical send is authorized by the vault, so a revoked enrollment or a
+ * changed record takes effect on the next send. The enrollment token is
+ * re-read per operation so an operator's reissue on disk is picked up.
+ */
+export class ClaustrumScopedCustody {
+    #client;
+    #readToken;
+    #now;
+    #family;
+    #parseIdentity;
+    #requireAssertion;
+    #logger;
+    #provenance = new WeakMap();
+    #reports = new WeakMap();
+    #closed = false;
+    constructor(options) {
+        const tokenPath = options.tokenPath;
+        if (options.readToken) {
+            this.#readToken = options.readToken;
+        }
+        else if (tokenPath) {
+            this.#readToken = () => readClaustrumEnrollmentToken(tokenPath);
+        }
+        else {
+            throw new ClaustrumConsumerError('not-enrolled', 'Claustrum enrollment token path is required');
+        }
+        this.#client = options.client;
+        this.#family = options.family;
+        this.#parseIdentity = options.parseIdentity;
+        this.#requireAssertion = options.requireAssertion ?? false;
+        this.#now = options.now ?? Date.now;
+        this.#logger = options.logger ?? defaultLogger;
+    }
+    #check(signal) {
+        if (this.#closed)
+            throw new ClaustrumConsumerError('closed', 'Claustrum scoped custody is closed');
+        signal?.throwIfAborted();
+    }
+    async #token(signal) {
+        this.#check(signal);
+        const value = await this.#readToken();
+        this.#check(signal);
+        if (!/^[0-9a-f]{64}$/.test(value.token) ||
+            !Number.isSafeInteger(value.token_generation) ||
+            value.token_generation < 1) {
+            throw new ClaustrumConsumerError('invalid-token', 'Invalid Claustrum enrollment token');
+        }
+        return value.token;
+    }
+    async #call(operation, signal) {
+        this.#check(signal);
+        let result;
+        let removeAbortListener;
+        try {
+            const pending = operation();
+            result = signal
+                ? await Promise.race([
+                    pending,
+                    new Promise((_resolve, reject) => {
+                        const abort = () => reject(signal.reason);
+                        signal.addEventListener('abort', abort, { once: true });
+                        removeAbortListener = () => signal.removeEventListener('abort', abort);
+                        if (signal.aborted)
+                            abort();
+                    }),
+                ])
+                : await pending;
+        }
+        catch (error) {
+            this.#check(signal);
+            // Keep the vault's own refusals (ClaustrumCredentialError, carrying
+            // code, class and action); replace any other error, whose text may echo
+            // request params that include the enrollment token.
+            if (error instanceof ClaustrumCredentialError)
+                throw error;
+            throw new ClaustrumConsumerError('unavailable', 'Claustrum scoped operation unavailable');
+        }
+        finally {
+            removeAbortListener?.();
+        }
+        this.#check(signal);
+        return result;
+    }
+    /**
+     * List this consumer's credentials. A record that cannot be used is skipped
+     * and warned about rather than failing the whole list, so one bad record
+     * never hides every other account. Records outside the family are not
+     * skipped records: they simply are not this consumer's.
+     */
+    async discover(signal) {
+        const token = await this.#token(signal);
+        const inventory = await this.#call(() => this.#client.listScoped(token), signal);
+        const skipped = [];
+        const candidates = [];
+        const counts = new Map();
+        for (const row of inventory.rows) {
+            const type = credentialTypeOf(row, this.#family);
+            if (!type)
+                continue;
+            candidates.push({ row, type });
+            counts.set(row.id, (counts.get(row.id) ?? 0) + 1);
+        }
+        const credentials = [];
+        for (const { row, type } of candidates) {
+            let reason;
+            if (!row.id.trim())
+                reason = 'empty credential id';
+            else if ((counts.get(row.id) ?? 0) > 1)
+                reason = 'duplicate credential id';
+            else if (row.accountId !== undefined && !row.accountId.trim())
+                reason = 'blank account identity';
+            else if (!row.state.trim())
+                reason = 'empty state';
+            if (reason) {
+                skipped.push({ ...(row.id.trim() && { credentialId: row.id }), reason });
+                continue;
+            }
+            credentials.push(Object.freeze({
+                credentialId: row.id,
+                credentialType: type,
+                ...(row.accountId !== undefined && {
+                    accountIdentity: row.accountId,
+                }),
+                state: row.state,
+                ...(row.email !== undefined && { email: row.email }),
+                ...(row.orgName !== undefined && { orgName: row.orgName }),
+            }));
+        }
+        for (const record of skipped)
+            this.#logger.warn('skipped malformed vault record', record);
+        const grantReach = grantReachOf(inventory);
+        return {
+            view: inventory.view,
+            credentials: Object.freeze(credentials),
+            skipped: Object.freeze(skipped),
+            ...(grantReach && { grantReach }),
+        };
+    }
+    /**
+     * Fetch the credential for one physical send and wrap it in a fresh receipt.
+     * The vault's served identity (or, without one, the plugin's parse of the
+     * token) must equal the roster's when both are present. Without
+     * `requireAssertion`, absence on either side proves nothing and does not
+     * refuse; the receipt records what the vault asserted separately from what
+     * the roster expected. With it, a reply that does not itself name the
+     * credential id and the expected account is refused.
+     */
+    async authorize(identity, signal) {
+        if (!identity.credentialId)
+            throw new ClaustrumConsumerError('route-unavailable', 'Claustrum dispatch requires a credential id');
+        // Capture the caller's fields before yielding so a later mutation cannot move the fence.
+        const { credentialId, credentialType, accountIdentity } = identity;
+        if (this.#requireAssertion && accountIdentity === undefined)
+            throw new ClaustrumConsumerError('identity-unasserted', 'Claustrum dispatch requires a known account identity');
+        const token = await this.#token(signal);
+        const served = await this.#call(() => this.#client.getScoped({
+            credentialId,
+            enrollmentToken: token,
+            ...(credentialType === 'oauth' && { minTtlMs: SERVING_MARGIN_MS }),
+        }), signal);
+        if (served.credentialId !== undefined &&
+            served.credentialId !== credentialId) {
+            throw new ClaustrumConsumerError('identity-changed', 'Claustrum served credential identity changed');
+        }
+        const expiresAtMs = served.expiresAtMs;
+        if (!Number.isSafeInteger(served.recordVersion) ||
+            served.recordVersion < 0 ||
+            (expiresAtMs === null && credentialType === 'oauth') ||
+            (expiresAtMs !== null &&
+                (!Number.isFinite(expiresAtMs) ||
+                    expiresAtMs - this.#now() < SERVING_MARGIN_MS))) {
+            throw new ClaustrumConsumerError('insufficient-validity', 'Claustrum served credential has insufficient validity');
+        }
+        const accessToken = accessTokenFromMaterial(served.material);
+        const assertedIdentity = served.accountId?.trim()
+            ? served.accountId
+            : undefined;
+        if (this.#requireAssertion &&
+            (served.credentialId === undefined || assertedIdentity === undefined))
+            throw new ClaustrumConsumerError('identity-unasserted', 'Claustrum served credential did not assert its identity');
+        const parsedIdentity = assertedIdentity === undefined
+            ? this.#parseIdentity?.(accessToken)
+            : undefined;
+        const servedIdentity = assertedIdentity ?? parsedIdentity;
+        if (accountIdentity !== undefined &&
+            servedIdentity !== undefined &&
+            servedIdentity !== accountIdentity) {
+            throw new ClaustrumConsumerError('identity-changed', 'Claustrum served credential identity changed');
+        }
+        const resolvedIdentity = servedIdentity ?? accountIdentity;
+        const source = assertedIdentity !== undefined
+            ? 'asserted'
+            : parsedIdentity !== undefined
+                ? 'parsed'
+                : accountIdentity !== undefined
+                    ? 'expected'
+                    : 'none';
+        const attempt = Object.freeze(Object.defineProperty({
+            credentialId,
+            credentialType,
+            ...(resolvedIdentity !== undefined && {
+                accountIdentity: resolvedIdentity,
+            }),
+            accountIdentitySource: source,
+            ...(accountIdentity !== undefined && {
+                expectedAccountIdentity: accountIdentity,
+            }),
+            ...(served.credentialId !== undefined && {
+                assertedCredentialId: served.credentialId,
+            }),
+            ...(assertedIdentity !== undefined && {
+                assertedAccountIdentity: assertedIdentity,
+            }),
+            ...(served.projectId !== undefined && {
+                projectId: served.projectId,
+            }),
+            recordVersion: served.recordVersion,
+            expiresAtMs,
+        }, 'accessToken', { value: accessToken, enumerable: false }));
+        this.#provenance.set(attempt, token);
+        return attempt;
+    }
+    /**
+     * Report that a send this consumer actually made was rejected. Only a 401
+     * is reported (the vault refuses 429, 402 and 5xx reports), addressed by
+     * credential id with the exact record version that send was served, and
+     * signed with the enrollment token that authorized it. A receipt this
+     * custody did not issue is refused rather than reported.
+     */
+    async reportFailure(attempt, status, reporterSource) {
+        if (status !== 401)
+            return;
+        this.#check();
+        const token = this.#provenance.get(attempt);
+        if (!token)
+            throw new ClaustrumConsumerError('no-receipt', 'Claustrum failure report requires an original dispatch receipt');
+        const pending = this.#reports.get(attempt);
+        if (pending)
+            return pending;
+        const report = this.#call(() => this.#client.reportAuthFailureScoped({
+            credentialId: attempt.credentialId,
+            enrollmentToken: token,
+            providerStatus: 401,
+            recordVersion: attempt.recordVersion,
+            reporterSource,
+        }));
+        this.#reports.set(attempt, report);
+        try {
+            await report;
+            this.#logger.debug('scoped 401 reported', {
+                credentialId: attempt.credentialId,
+                recordVersion: attempt.recordVersion,
+                reporterSource,
+            });
+        }
+        catch (error) {
+            this.#reports.delete(attempt);
+            throw error;
+        }
+    }
+    close() {
+        if (this.#closed)
+            return;
+        this.#closed = true;
+        this.#client.close();
+    }
+}