@cortexkit/opencode-openai-auth 1.1.0 → 1.3.0

package/src/tui-compiled/runtime/shared/d0f0b6be200311af-insula.js

@@ -5,6 +5,8 @@ import { storeIdentity } from "@cortexkit/claustrum-client";
 // import makes bundlers emit a separate chunk that a running host loses when
 // its dist folder is rebuilt underneath it.
 import { SubcClient } from "@cortexkit/subc-client";
+import { classifyVaultFailure } from "./94f53cfd572ba4bb-availability.js";
+import { ChangeNoticeReader, CoalescedRead, RESUBSCRIBE_BACKOFF_MS, WATCH_RETRY_MS, } from "./dc9290c2a7552ba6-watch.js";
 /** Constructing this transport opens no connection; getUsage opens one per call. */
 export function insulaUsageTransport(options) {
     const identity = options.identity ??
@@ -49,6 +51,79 @@ export function insulaUsageTransport(options) {
                 client?.close();
             }
         },
+        watchUsage(onNotice) {
+            // The watch holds its own connection for as long as it is open: each
+            // usage.get above opens and closes a short-lived one, and the scoped
+            // credential connection is never shared with insula. The method name
+            // alone makes the request a watch; subc-client does not yet set the
+            // SUBSCRIPTION flag, and insula does not require it.
+            let client;
+            let subscription;
+            let stopped = false;
+            const closed = (async () => {
+                let deadline;
+                const timeout = new Promise((_resolve, reject) => {
+                    deadline = setTimeout(
+                    // Coded as a timeout, so InsulaQuotaSource treats a watch that could
+                    // not open in time as an unreachable insula and tries again later,
+                    // not as a refusal.
+                    () => reject(Object.assign(new Error('insula watch timeout'), {
+                        code: 'timeout',
+                    })), 3_000);
+                    deadline.unref?.();
+                });
+                const open = (async () => {
+                    const handshakeTimeoutMs = Math.min(options.handshakeTimeoutMs ?? 3_000, 3_000);
+                    const connected = options.connector
+                        ? await options.connector({
+                            connectionFile: options.connectionFile,
+                            handshakeTimeoutMs,
+                        })
+                        : await SubcClient.connect({
+                            connectionFile: options.connectionFile,
+                            handshakeTimeoutMs,
+                        });
+                    client = connected;
+                    // A connection that arrives after stop() or after the open deadline
+                    // must not keep a route or socket alive.
+                    if (stopped) {
+                        connected.close();
+                        return;
+                    }
+                    const route = await connected.routeOpen({ kind: 'management_surface', module_id: 'insula' }, identity);
+                    if (stopped) {
+                        connected.close();
+                        return;
+                    }
+                    subscription = connected.subscribe(route, { method: 'usage.watch' }, onNotice);
+                })();
+                try {
+                    await Promise.race([open, timeout]);
+                }
+                catch (error) {
+                    stopped = true;
+                    throw error;
+                }
+                finally {
+                    clearTimeout(deadline);
+                }
+                if (subscription)
+                    await subscription.closed;
+            })().finally(() => {
+                stopped = true;
+                client?.close();
+            });
+            return {
+                stop() {
+                    if (stopped)
+                        return;
+                    stopped = true;
+                    subscription?.unsubscribe();
+                    client?.close();
+                },
+                closed,
+            };
+        },
     };
 }
 const MINUTE = 60_000;
@@ -60,18 +135,92 @@ const attempts = new Map();
 function record(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+function decodeUsageNotice(body) {
+    let value;
+    try {
+        value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(body));
+    }
+    catch {
+        return undefined;
+    }
+    if (!record(value) ||
+        typeof value.kind !== 'string' ||
+        typeof value.epoch !== 'string' ||
+        value.epoch.length === 0 ||
+        typeof value.seq !== 'number' ||
+        !Number.isSafeInteger(value.seq) ||
+        value.seq < 1 ||
+        (value.provider !== undefined && typeof value.provider !== 'string'))
+        return undefined;
+    return {
+        kind: value.kind,
+        epoch: value.epoch,
+        seq: value.seq,
+        ...(typeof value.provider === 'string' && { provider: value.provider }),
+    };
+}
+function refusalCode(error) {
+    return error instanceof Error &&
+        'code' in error &&
+        typeof error.code === 'string'
+        ? error.code
+        : undefined;
+}
 export class InsulaQuotaSource {
     transport;
     key;
     #entries = [];
-    #pending;
+    /** Every usage.get, polled or watch-driven, shares this one slot. */
+    #reads = new CoalescedRead(async () => {
+        try {
+            const reply = await this.transport.getUsage();
+            if (!record(reply) ||
+                !Array.isArray(reply.result) ||
+                reply.error !== undefined)
+                throw new Error('unavailable insula usage');
+            // Each response is a snapshot, not a delta. Missing accounts fall back;
+            // neither pending nor the entry count asserts provider completeness.
+            this.#entries = reply.result.filter((entry) => record(entry) && typeof entry.provider === 'string');
+        }
+        catch {
+            // Refusal is absence, even if the previous reading was still young.
+            this.#entries = [];
+        }
+    }, () => { });
+    #reader = new ChangeNoticeReader();
+    #mode = 'polling';
+    #watchers = 0;
+    /**
+     * How many registered watchers read every provider. Watchers limited to one
+     * provider are counted per provider in `#providers` instead.
+     */
+    #everyProvider = 0;
+    #providers = new Map();
+    #watch;
+    #timer;
+    #timers = {};
+    /**
+     * How many accepted watches in a row have closed; each one doubles the wait
+     * before the next re-subscribe. Reset once a watch brings a second notice.
+     */
+    #closes = 0;
     constructor(transport, key) {
         this.transport = transport;
         this.key = key;
     }
+    /**
+     * The background poll: at most one usage.get per minute per daemon and
+     * enrollment token. While a watch is open it reads nothing, because insula's
+     * notices announce every new reading. If insula stops announcing an account,
+     * that account's last entry grows older than the freshness limit `current()`
+     * applies, `current()` returns nothing for it, and the plugin falls back to
+     * its own provider poll for that account.
+     */
     refresh(now) {
-        if (this.#pending)
-            return this.#pending;
+        if (this.#reads.running)
+            return this.#reads.running;
+        if (this.#mode === 'watching')
+            return Promise.resolve();
         for (const [key, time] of attempts) {
             if (now - time >= MINUTE)
                 attempts.delete(key);
@@ -81,25 +230,141 @@ export class InsulaQuotaSource {
             return Promise.resolve();
         // Reserve the minute before I/O, so concurrent projects cannot each poll.
         attempts.set(this.key, now);
-        this.#pending = (async () => {
-            try {
-                const reply = await this.transport.getUsage();
-                if (!record(reply) ||
-                    !Array.isArray(reply.result) ||
-                    reply.error !== undefined)
-                    throw new Error('unavailable insula usage');
-                // Each response is a snapshot, not a delta. Missing accounts fall back;
-                // neither pending nor the entry count asserts provider completeness.
-                this.#entries = reply.result.filter((entry) => record(entry) && typeof entry.provider === 'string');
-            }
-            catch {
-                // Refusal is absence, even if the previous reading was still young.
-                this.#entries = [];
+        return this.#reads.request();
+    }
+    /** How this source currently learns about usage changes, for logs. */
+    watchMode() {
+        return this.#mode;
+    }
+    /**
+     * Hold a `usage.watch` open while any watcher wants it, and re-read
+     * usage.get when a notice says something changed. Watchers of one source
+     * share one watch, since insula admits only 64 per process. Returns the
+     * release; the last release closes the watch.
+     */
+    watch(options = {}) {
+        this.#watchers++;
+        const provider = options.provider;
+        if (provider === undefined)
+            this.#everyProvider++;
+        else
+            this.#providers.set(provider, (this.#providers.get(provider) ?? 0) + 1);
+        if (this.#watchers === 1) {
+            this.#timers = options;
+            this.#open();
+        }
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            if (provider === undefined)
+                this.#everyProvider--;
+            else {
+                const left = (this.#providers.get(provider) ?? 1) - 1;
+                if (left > 0)
+                    this.#providers.set(provider, left);
+                else
+                    this.#providers.delete(provider);
             }
-        })().finally(() => {
-            this.#pending = undefined;
-        });
-        return this.#pending;
+            if (--this.#watchers === 0)
+                this.#stopWatch();
+        };
+    }
+    #stopWatch() {
+        if (this.#timer)
+            (this.#timers.clearTimeoutImpl ?? clearTimeout)(this.#timer);
+        this.#timer = undefined;
+        const watch = this.#watch;
+        this.#watch = undefined;
+        watch?.handle?.stop();
+        this.#mode = 'polling';
+    }
+    #later(delay) {
+        this.#timer = (this.#timers.setTimeoutImpl ?? setTimeout)(() => {
+            this.#timer = undefined;
+            if (this.#watchers > 0 && !this.#watch)
+                this.#open();
+        }, delay);
+        this.#timer.unref?.();
+    }
+    #open() {
+        const watchUsage = this.transport.watchUsage;
+        if (!watchUsage) {
+            // A custom transport that cannot watch: poll exactly as before.
+            this.#mode = 'fallback';
+            return;
+        }
+        this.#mode = 'polling';
+        this.#reader.restart();
+        const watch = { notices: 0 };
+        this.#watch = watch;
+        let handle;
+        try {
+            handle = watchUsage.call(this.transport, (body) => this.#notice(watch, body));
+        }
+        catch (error) {
+            this.#closed(watch, error);
+            return;
+        }
+        watch.handle = handle;
+        handle.closed.then(() => this.#closed(watch, undefined), (error) => this.#closed(watch, error));
+    }
+    #notice(watch, body) {
+        // Frames already in transport can arrive after a local stop.
+        if (this.#watch !== watch)
+            return;
+        watch.notices++;
+        if (watch.notices === 1)
+            this.#mode = 'watching';
+        // A second notice means the watch stayed up past its acceptance.
+        if (watch.notices === 2)
+            this.#closes = 0;
+        const notice = decodeUsageNotice(body);
+        // An unreadable notice may hide any change: treat it as a break, and
+        // make the next notice read as one too.
+        if (!notice)
+            this.#reader.restart();
+        const continuous = notice ? this.#reader.continuous(notice) : false;
+        // The first notice of every watch names no provider, so it always reads:
+        // nothing was watched before it. After a gap or a new epoch notices were
+        // lost, so read even when this notice names another provider.
+        if (!continuous ||
+            notice?.provider === undefined ||
+            this.#everyProvider > 0 ||
+            this.#providers.has(notice.provider))
+            void this.#reads.request();
+    }
+    #closed(watch, error) {
+        if (this.#watch !== watch)
+            return;
+        this.#watch = undefined;
+        const code = refusalCode(error);
+        if (code === 'unknown_method' || code === 'usage_watch_limit') {
+            // An insula that predates usage.watch, or one already holding 64
+            // watches: poll exactly as before until every watcher has released.
+            this.#mode = 'fallback';
+            return;
+        }
+        if (watch.notices > 0) {
+            // An accepted watch that closed (insula shut down, or the connection
+            // dropped) gets one new watch, whose first notice reads usage.get.
+            const delay = Math.min(RESUBSCRIBE_BACKOFF_MS * 2 ** Math.min(this.#closes, 16), WATCH_RETRY_MS);
+            this.#closes++;
+            this.#mode = 'polling';
+            this.#later(delay);
+            return;
+        }
+        // Closed before any notice, so never accepted: read once to learn
+        // whether insula answers at all, then poll as before. A refusal insula
+        // answered stands until every watcher has released. A close it did not
+        // explain (a
+        // dropped connection, a timeout, a stream ended at once while insula
+        // shuts down) earns one new watch much later.
+        this.#mode = 'fallback';
+        void this.#reads.request();
+        if (error === undefined || classifyVaultFailure(error) === 'unreachable')
+            this.#later(WATCH_RETRY_MS);
     }
     current(provider, accountId, now) {
         for (const entry of this.#entries) {

package/src/tui-compiled/runtime/shared/d5a8f1061ee2f114-index.js

@@ -1,5 +1,5 @@
 export { quotaCodec } from "./053cc17b5419261e-codec.js";
-export { formatQuota, NO_LIMITS_REPORTED, NO_QUOTA_READING, QUOTA_STALE_AFTER_MS, quotaTextParts, quotaWindowName, quotaWindowParts, } from "./0332701351b3eeec-format.js";
+export { formatQuota, isQuotaStale, NO_LIMITS_REPORTED, NO_QUOTA_READING, QUOTA_STALE_AFTER_MS, quotaTextParts, quotaWindowName, quotaWindowParts, } from "./0332701351b3eeec-format.js";
 export { ALL_SCOPE, DEFAULT_REQUIRED_LABELS, decodeQuotaMap, emptyQuotaMap, isQuotaMap, } from "./905bffc0220f43d0-map.js";
 export { isQuotaObservation, mergeQuotaObservation, QuotaCodecError, } from "./4f36d333d081d040-merge.js";
 export { budgetExhaustedResetAt, futureResetAt, projectQuota, readsExhausted, } from "./39c3cb05738fcf6d-projection.js";

package/src/tui-compiled/runtime/shared/dc9290c2a7552ba6-watch.js

@@ -0,0 +1,253 @@
+/**
+ * While a vault watch is healthy, the roster is still read this often: the
+ * watch carries no history, so a lost notice or a silently dead stream is
+ * caught within this period.
+ */
+export const SAFETY_POLL_MS = 5 * 60_000;
+/**
+ * After a watch fails without being accepted, the host polls and tries one
+ * new watch this much later, so a refusing or draining module is never asked
+ * in a tight loop.
+ */
+export const WATCH_RETRY_MS = 5 * 60_000;
+/**
+ * First wait before re-subscribing a watch that closed after it had been
+ * accepted. It doubles for each further close in a row, up to WATCH_RETRY_MS.
+ */
+export const RESUBSCRIBE_BACKOFF_MS = 1_000;
+/**
+ * Tells whether a notice follows the previous one with nothing lost between
+ * them. `seq` restarts at 1 for every watch and `epoch` names the sending
+ * module's process lifetime. A sequence gap (notices are sheddable), a
+ * different epoch (the module restarted) or a notice of an unknown kind all
+ * mean changes may have been missed, so the caller must re-read everything.
+ */
+export class ChangeNoticeReader {
+    #epoch;
+    #seq = 0;
+    /**
+     * Begin a new watch, whose first notice is seq 1 again. The epoch is kept,
+     * so a module restart between two watches still reads as a break.
+     */
+    restart() {
+        this.#seq = 0;
+    }
+    continuous(notice) {
+        const continuous = notice.kind === 'changed' &&
+            notice.seq === this.#seq + 1 &&
+            (this.#epoch === undefined || notice.epoch === this.#epoch);
+        this.#epoch = notice.epoch;
+        this.#seq = notice.seq;
+        return continuous;
+    }
+}
+/**
+ * Runs `read` with at most one call in flight and at most one more queued
+ * behind it, however many requests arrive meanwhile. A request made while a
+ * read is running may have arrived after that read took its snapshot, so it
+ * earns exactly one more read; any further requests share that one.
+ */
+export class CoalescedRead {
+    #read;
+    #onError;
+    #running;
+    #queued = false;
+    constructor(read, onError) {
+        this.#read = read;
+        this.#onError = onError;
+    }
+    /** The read in flight (including its queued follow-up), if any. */
+    get running() {
+        return this.#running;
+    }
+    request() {
+        if (this.#running) {
+            this.#queued = true;
+            return this.#running;
+        }
+        this.#running = (async () => {
+            do {
+                this.#queued = false;
+                try {
+                    await this.#read();
+                }
+                catch (error) {
+                    this.#onError(error);
+                }
+            } while (this.#queued);
+        })().finally(() => {
+            this.#running = undefined;
+        });
+        return this.#running;
+    }
+}
+/**
+ * Keeps one vault `watchScoped` open for a host and runs the host's discovery
+ * when a notice shows the visible account list changed. Discovery runs only
+ * when the notice's view differs from the last discovered roster's view, when
+ * a notice shows a gap or a new epoch, or on the first notice of a watch that
+ * was re-subscribed after a close (the time between two watches was not
+ * observed). It never opens a second watch while one is open.
+ */
+export class ScopedRosterWatch {
+    #options;
+    #reader = new ChangeNoticeReader();
+    #reads;
+    #mode = 'polling';
+    #watch;
+    #timer;
+    #stopped = false;
+    #latestView;
+    #force = false;
+    /**
+     * How many accepted watches in a row have closed; each one doubles the wait
+     * before the next re-subscribe. Reset once a watch stays up five minutes.
+     */
+    #closes = 0;
+    constructor(options) {
+        this.#options = options;
+        this.#reads = new CoalescedRead(async () => {
+            const force = this.#force;
+            this.#force = false;
+            if (force || this.#latestView !== this.#options.view())
+                await this.#options.discover();
+        }, (error) => {
+            if (!this.#stopped)
+                this.#options.onError?.(error);
+        });
+    }
+    get mode() {
+        return this.#mode;
+    }
+    start() {
+        if (this.#stopped || this.#watch || this.#timer)
+            return;
+        if (typeof this.#options.client.watchScoped !== 'function') {
+            // A claustrum-client older than 0.12.0: poll exactly as before.
+            this.#setMode('fallback', 'client-without-watch');
+            return;
+        }
+        void this.#open(false);
+    }
+    stop() {
+        if (this.#stopped)
+            return;
+        this.#stopped = true;
+        if (this.#timer)
+            (this.#options.clearTimeoutImpl ?? clearTimeout)(this.#timer);
+        this.#timer = undefined;
+        const watch = this.#watch;
+        this.#watch = undefined;
+        watch?.handle.stop();
+    }
+    #setMode(mode, reason) {
+        if (this.#mode === mode)
+            return;
+        this.#mode = mode;
+        this.#options.logger?.debug('claustrum vault watch', { mode, reason });
+        this.#options.onMode?.(mode);
+    }
+    #later(delay, run) {
+        this.#timer = (this.#options.setTimeoutImpl ?? setTimeout)(() => {
+            this.#timer = undefined;
+            if (!this.#stopped)
+                run();
+        }, delay);
+        this.#timer.unref?.();
+    }
+    async #open(resubscribed) {
+        let token;
+        try {
+            token = await this.#options.enrollmentToken();
+        }
+        catch (error) {
+            if (this.#stopped)
+                return;
+            this.#options.onError?.(error);
+            this.#fallback('token-unreadable');
+            return;
+        }
+        const watchScoped = this.#options.client.watchScoped;
+        if (this.#stopped || this.#watch || !watchScoped)
+            return;
+        this.#reader.restart();
+        // A re-subscribed watch reads on its first notice: changes made while no
+        // watch was open were never announced.
+        this.#force = resubscribed;
+        let watch;
+        let handle;
+        try {
+            handle = watchScoped.call(this.#options.client, (notice) => {
+                if (this.#stopped || !watch || this.#watch !== watch)
+                    return;
+                watch.notices++;
+                if (watch.notices === 1) {
+                    this.#options.onReachable?.();
+                    watch.acceptedAt = (this.#options.now ?? Date.now)();
+                    this.#setMode('watching', 'accepted');
+                }
+                if (!this.#reader.continuous(notice))
+                    this.#force = true;
+                this.#latestView = notice.view;
+                // The read itself decides whether to list, against the roster as
+                // it stands when the read runs.
+                void this.#reads.request();
+            }, { enrollmentToken: token });
+        }
+        catch (error) {
+            this.#options.onError?.(error);
+            this.#fallback('watch-failed');
+            return;
+        }
+        watch = { handle, notices: 0 };
+        this.#watch = watch;
+        this.#setMode('polling', resubscribed ? 'resubscribing' : 'opening');
+        const opened = watch;
+        handle.closed.then((end) => this.#closed(opened, end), (error) => this.#closed(opened, { kind: 'transport_lost', error }));
+    }
+    #closed(watch, end) {
+        if (this.#stopped || this.#watch !== watch)
+            return;
+        this.#watch = undefined;
+        if (end.kind === 'stopped')
+            return;
+        if (end.kind === 'transport_lost')
+            this.#options.onTransportLost?.();
+        if (end.kind === 'unsupported') {
+            // An older vault answers unknown_method: poll exactly as before.
+            this.#setMode('fallback', 'vault-without-watch');
+            return;
+        }
+        if (end.kind === 'refused') {
+            this.#fallback('refused');
+            try {
+                this.#options.onRefused(end.error);
+            }
+            catch (error) {
+                this.#options.onError?.(error);
+            }
+            return;
+        }
+        if (watch.notices > 0) {
+            // An accepted watch that closed (the vault restarted, or a revocation
+            // ended it) gets one new watch. A revocation then shows up as that
+            // watch's refusal.
+            const now = (this.#options.now ?? Date.now)();
+            if (watch.acceptedAt !== undefined &&
+                now - watch.acceptedAt >= SAFETY_POLL_MS)
+                this.#closes = 0;
+            const delay = Math.min(RESUBSCRIBE_BACKOFF_MS * 2 ** Math.min(this.#closes, 16), WATCH_RETRY_MS);
+            this.#closes++;
+            this.#setMode('polling', 'resubscribing');
+            this.#later(delay, () => void this.#open(true));
+            return;
+        }
+        // Zero notices: the watch was never accepted (the vault is draining, or
+        // the connection failed). The client already made one read to learn why.
+        this.#fallback(end.kind);
+    }
+    #fallback(reason) {
+        this.#setMode('fallback', reason);
+        this.#later(WATCH_RETRY_MS, () => void this.#open(false));
+    }
+}

package/src/tui-compiled/runtime/shared/e8d3c8da776ef9cd-index.js

@@ -6,13 +6,16 @@
 import { ClaustrumClient, } from "@cortexkit/claustrum-client";
 import { insulaUsageTransport } from "./d0f0b6be200311af-insula.js";
 export { ClaustrumCredentialError, } from "@cortexkit/claustrum-client";
+export { ClaustrumUnreachableError, classifyVaultFailure, VAULT_FAILURE_CLASSES, } from "./94f53cfd572ba4bb-availability.js";
 export { ClaustrumConsumer, } from "./169b2b4bf30909bc-consumer.js";
-export { ClaustrumScopedCustody, decideScopedRetryAfter401, isScopedCredentialRotation, SERVING_MARGIN_MS, } from "./0f77ebc3c914c9c6-custody.js";
+export { ClaustrumScopedCustody, decideScopedRetryAfter401, isScopedCredentialRotation, KEPT_RECEIPT_MARGIN_MS, SERVING_MARGIN_MS, } from "./0f77ebc3c914c9c6-custody.js";
 export { ClaustrumEnrollmentManager, classifyEnrollmentError, connectClaustrumEnrollmentClient, disconnectClaustrumEnrollment, enrollmentAuthority, enrollmentName, getClaustrumEnrollmentPaths, hostEnrollmentPaths, RETRYABLE_ENROLLMENT_CODES, readClaustrumEnrollmentStatus, readClaustrumEnrollmentToken, resetClaustrumEnrollmentState, TERMINAL_ENROLLMENT_CODES, } from "./b9588ad4725c1d10-enrollment.js";
 export { ClaustrumConsumerError, } from "./ca0fccaba1d87af4-errors.js";
 export { assertHostSlotMatchesMode, assertNotCustodyPlaceholder, CUSTODY_PLACEHOLDER_PREFIX, classifyHostSlot, custodyPlaceholder, custodyPlaceholderKey, isCustodyPlaceholder, isCustodyPlaceholderValue, } from "./d9d2892a4c371301-host-slot.js";
+export { acquireInsulaQuotaSource, } from "./d0f0b6be200311af-insula.js";
 export { acceptAccount, declineAccount, isDeclined, } from "./7c140680fc81be92-interlock.js";
 export { acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, mutateVaultRoster, projectVaultRoster, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, resolveVaultPrimary, vaultRoutingRows, } from "./30f5bc480f31f51c-roster.js";
+export { ChangeNoticeReader, RESUBSCRIBE_BACKOFF_MS, SAFETY_POLL_MS, ScopedRosterWatch, WATCH_RETRY_MS, } from "./dc9290c2a7552ba6-watch.js";
 /**
  * Connect the client that lists and fetches this consumer's vault credentials
  * on the request path. `connectionFile` is required: this library