@cortexkit/opencode-openai-auth 1.2.0 → 1.4.0

package/src/tui-compiled/runtime/shared/dc9290c2a7552ba6-watch.js

@@ -0,0 +1,254 @@
+/**
+ * While a vault watch is healthy, the roster is still read this often: the
+ * watch carries no history, so a lost notice or a silently dead stream is
+ * caught within this period.
+ */
+export const SAFETY_POLL_MS = 5 * 60_000;
+/**
+ * After a watch fails without being accepted, the host polls and tries one
+ * new watch this much later, so a refusing or draining module is never asked
+ * in a tight loop.
+ */
+export const WATCH_RETRY_MS = 5 * 60_000;
+/**
+ * First wait before re-subscribing a watch that closed after it had been
+ * accepted. It doubles for each further close in a row, up to WATCH_RETRY_MS.
+ */
+export const RESUBSCRIBE_BACKOFF_MS = 1_000;
+/**
+ * Tells whether a notice follows the previous one with nothing lost between
+ * them. `seq` restarts at 1 for every watch and `epoch` names the sending
+ * module's process lifetime. A sequence gap (notices are sheddable), a
+ * different epoch (the module restarted) or a notice of an unknown kind all
+ * mean changes may have been missed, so the caller must re-read everything.
+ */
+export class ChangeNoticeReader {
+    #epoch;
+    #seq = 0;
+    /**
+     * Begin a new watch, whose first notice is seq 1 again. The epoch is kept,
+     * so a module restart between two watches still reads as a break.
+     */
+    restart() {
+        this.#seq = 0;
+    }
+    continuous(notice) {
+        const continuous = notice.kind === 'changed' &&
+            notice.seq === this.#seq + 1 &&
+            (this.#epoch === undefined || notice.epoch === this.#epoch);
+        this.#epoch = notice.epoch;
+        this.#seq = notice.seq;
+        return continuous;
+    }
+}
+/**
+ * Runs `read` with at most one call in flight and at most one more queued
+ * behind it, however many requests arrive meanwhile. A request made while a
+ * read is running may have arrived after that read took its snapshot, so it
+ * earns exactly one more read; any further requests share that one.
+ */
+export class CoalescedRead {
+    #read;
+    #onError;
+    #running;
+    #queued = false;
+    constructor(read, onError) {
+        this.#read = read;
+        this.#onError = onError;
+    }
+    /** The read in flight (including its queued follow-up), if any. */
+    get running() {
+        return this.#running;
+    }
+    request() {
+        if (this.#running) {
+            this.#queued = true;
+            return this.#running;
+        }
+        this.#running = (async () => {
+            do {
+                this.#queued = false;
+                try {
+                    await this.#read();
+                }
+                catch (error) {
+                    this.#onError(error);
+                }
+            } while (this.#queued);
+        })().finally(() => {
+            this.#running = undefined;
+        });
+        return this.#running;
+    }
+}
+/**
+ * Keeps one vault `watchScoped` open for a host and runs the host's discovery
+ * when a notice shows the visible account list changed. Discovery runs only
+ * when the notice's view differs from the last discovered roster's view, when
+ * a notice shows a gap or a new epoch, or on the first notice of a watch that
+ * was re-subscribed after a close (the time between two watches was not
+ * observed). It never opens a second watch while one is open.
+ */
+export class ScopedRosterWatch {
+    #options;
+    #reader = new ChangeNoticeReader();
+    #reads;
+    #mode = 'polling';
+    #watch;
+    #timer;
+    #stopped = false;
+    #latestView;
+    #force = false;
+    /**
+     * How many accepted watches in a row have closed; each one doubles the wait
+     * before the next re-subscribe. Reset once a watch stays up five minutes.
+     */
+    #closes = 0;
+    constructor(options) {
+        this.#options = options;
+        this.#reads = new CoalescedRead(async () => {
+            const force = this.#force;
+            this.#force = false;
+            // A read is only ever requested by a notice, which set #latestView.
+            if (force || this.#latestView !== this.#options.view())
+                await this.#options.discover(this.#latestView ?? '');
+        }, (error) => {
+            if (!this.#stopped)
+                this.#options.onError?.(error);
+        });
+    }
+    get mode() {
+        return this.#mode;
+    }
+    start() {
+        if (this.#stopped || this.#watch || this.#timer)
+            return;
+        if (typeof this.#options.client.watchScoped !== 'function') {
+            // A claustrum-client older than 0.12.0: poll exactly as before.
+            this.#setMode('fallback', 'client-without-watch');
+            return;
+        }
+        void this.#open(false);
+    }
+    stop() {
+        if (this.#stopped)
+            return;
+        this.#stopped = true;
+        if (this.#timer)
+            (this.#options.clearTimeoutImpl ?? clearTimeout)(this.#timer);
+        this.#timer = undefined;
+        const watch = this.#watch;
+        this.#watch = undefined;
+        watch?.handle.stop();
+    }
+    #setMode(mode, reason) {
+        if (this.#mode === mode)
+            return;
+        this.#mode = mode;
+        this.#options.logger?.debug('claustrum vault watch', { mode, reason });
+        this.#options.onMode?.(mode);
+    }
+    #later(delay, run) {
+        this.#timer = (this.#options.setTimeoutImpl ?? setTimeout)(() => {
+            this.#timer = undefined;
+            if (!this.#stopped)
+                run();
+        }, delay);
+        this.#timer.unref?.();
+    }
+    async #open(resubscribed) {
+        let token;
+        try {
+            token = await this.#options.enrollmentToken();
+        }
+        catch (error) {
+            if (this.#stopped)
+                return;
+            this.#options.onError?.(error);
+            this.#fallback('token-unreadable');
+            return;
+        }
+        const watchScoped = this.#options.client.watchScoped;
+        if (this.#stopped || this.#watch || !watchScoped)
+            return;
+        this.#reader.restart();
+        // A re-subscribed watch reads on its first notice: changes made while no
+        // watch was open were never announced.
+        this.#force = resubscribed;
+        let watch;
+        let handle;
+        try {
+            handle = watchScoped.call(this.#options.client, (notice) => {
+                if (this.#stopped || !watch || this.#watch !== watch)
+                    return;
+                watch.notices++;
+                if (watch.notices === 1) {
+                    this.#options.onReachable?.();
+                    watch.acceptedAt = (this.#options.now ?? Date.now)();
+                    this.#setMode('watching', 'accepted');
+                }
+                if (!this.#reader.continuous(notice))
+                    this.#force = true;
+                this.#latestView = notice.view;
+                // The read itself decides whether to list, against the roster as
+                // it stands when the read runs.
+                void this.#reads.request();
+            }, { enrollmentToken: token });
+        }
+        catch (error) {
+            this.#options.onError?.(error);
+            this.#fallback('watch-failed');
+            return;
+        }
+        watch = { handle, notices: 0 };
+        this.#watch = watch;
+        this.#setMode('polling', resubscribed ? 'resubscribing' : 'opening');
+        const opened = watch;
+        handle.closed.then((end) => this.#closed(opened, end), (error) => this.#closed(opened, { kind: 'transport_lost', error }));
+    }
+    #closed(watch, end) {
+        if (this.#stopped || this.#watch !== watch)
+            return;
+        this.#watch = undefined;
+        if (end.kind === 'stopped')
+            return;
+        if (end.kind === 'transport_lost')
+            this.#options.onTransportLost?.();
+        if (end.kind === 'unsupported') {
+            // An older vault answers unknown_method: poll exactly as before.
+            this.#setMode('fallback', 'vault-without-watch');
+            return;
+        }
+        if (end.kind === 'refused') {
+            this.#fallback('refused');
+            try {
+                this.#options.onRefused(end.error);
+            }
+            catch (error) {
+                this.#options.onError?.(error);
+            }
+            return;
+        }
+        if (watch.notices > 0) {
+            // An accepted watch that closed (the vault restarted, or a revocation
+            // ended it) gets one new watch. A revocation then shows up as that
+            // watch's refusal.
+            const now = (this.#options.now ?? Date.now)();
+            if (watch.acceptedAt !== undefined &&
+                now - watch.acceptedAt >= SAFETY_POLL_MS)
+                this.#closes = 0;
+            const delay = Math.min(RESUBSCRIBE_BACKOFF_MS * 2 ** Math.min(this.#closes, 16), WATCH_RETRY_MS);
+            this.#closes++;
+            this.#setMode('polling', 'resubscribing');
+            this.#later(delay, () => void this.#open(true));
+            return;
+        }
+        // Zero notices: the watch was never accepted (the vault is draining, or
+        // the connection failed). The client already made one read to learn why.
+        this.#fallback(end.kind);
+    }
+    #fallback(reason) {
+        this.#setMode('fallback', reason);
+        this.#later(WATCH_RETRY_MS, () => void this.#open(false));
+    }
+}

package/src/tui-compiled/runtime/shared/e8d3c8da776ef9cd-index.js

@@ -6,13 +6,17 @@
 import { ClaustrumClient, } from "@cortexkit/claustrum-client";
 import { insulaUsageTransport } from "./d0f0b6be200311af-insula.js";
 export { ClaustrumCredentialError, } from "@cortexkit/claustrum-client";
+export { ClaustrumUnreachableError, classifyVaultFailure, VAULT_FAILURE_CLASSES, } from "./94f53cfd572ba4bb-availability.js";
 export { ClaustrumConsumer, } from "./169b2b4bf30909bc-consumer.js";
-export { ClaustrumScopedCustody, decideScopedRetryAfter401, isScopedCredentialRotation, SERVING_MARGIN_MS, } from "./0f77ebc3c914c9c6-custody.js";
+export { ClaustrumScopedCustody, decideScopedRetryAfter401, isScopedCredentialRotation, KEPT_RECEIPT_MARGIN_MS, SERVING_MARGIN_MS, } from "./0f77ebc3c914c9c6-custody.js";
 export { ClaustrumEnrollmentManager, classifyEnrollmentError, connectClaustrumEnrollmentClient, disconnectClaustrumEnrollment, enrollmentAuthority, enrollmentName, getClaustrumEnrollmentPaths, hostEnrollmentPaths, RETRYABLE_ENROLLMENT_CODES, readClaustrumEnrollmentStatus, readClaustrumEnrollmentToken, resetClaustrumEnrollmentState, TERMINAL_ENROLLMENT_CODES, } from "./b9588ad4725c1d10-enrollment.js";
 export { ClaustrumConsumerError, } from "./ca0fccaba1d87af4-errors.js";
 export { assertHostSlotMatchesMode, assertNotCustodyPlaceholder, CUSTODY_PLACEHOLDER_PREFIX, classifyHostSlot, custodyPlaceholder, custodyPlaceholderKey, isCustodyPlaceholder, isCustodyPlaceholderValue, } from "./d9d2892a4c371301-host-slot.js";
+export { acquireInsulaQuotaSource, } from "./d0f0b6be200311af-insula.js";
 export { acceptAccount, declineAccount, isDeclined, } from "./7c140680fc81be92-interlock.js";
+export { drainVaultQuota } from "./81dddd203f1b92a3-quota-writer.js";
 export { acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, mutateVaultRoster, projectVaultRoster, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, resolveVaultPrimary, vaultRoutingRows, } from "./30f5bc480f31f51c-roster.js";
+export { ChangeNoticeReader, RESUBSCRIBE_BACKOFF_MS, SAFETY_POLL_MS, ScopedRosterWatch, WATCH_RETRY_MS, } from "./dc9290c2a7552ba6-watch.js";
 /**
  * Connect the client that lists and fetches this consumer's vault credentials
  * on the request path. `connectionFile` is required: this library

package/src/tui-compiled/runtime/sidebar-state.js

@@ -2,13 +2,35 @@ import {
   formatQuota,
   isQuotaStale,
   projectQuota,
+  quotaCreditsText,
   quotaWindowName
 } from "./shared/d5a8f1061ee2f114-index.js";
 import { orderForPlacement } from "./shared/3e7d45a77c6ad4d5-index.js";
 import {
+  creditsUsable,
   orderedPlacement,
   vaultMainRouteId
 } from "./shared/abd062d633e29fd2-pool-routing.js";
+export function accountCreditsText(quota) {
+  const credits = quota?.credits;
+  if (credits === null || typeof credits !== "object")
+    return;
+  const { hasCredits, unlimited, balance } = credits;
+  if (typeof hasCredits !== "boolean" || typeof unlimited !== "boolean")
+    return;
+  return quotaCreditsText({
+    hasCredits,
+    unlimited,
+    ...typeof balance === "number" ? { balance } : {}
+  });
+}
+export function accountServesOnCredits(quota, now = Date.now()) {
+  if (!exhaustedQuotaResetAt(quota, now))
+    return !1;
+  if (spendControlExhaustedResetAt(quota, now))
+    return !1;
+  return creditsUsable(quota?.credits, now);
+}
 const QUOTA_WINDOW_KEYS = ["primary", "secondary"], LEGACY_WINDOW_MINUTES = {
   primary: 300,
   secondary: 10080
@@ -153,7 +175,7 @@ export function normalizeSidebarState(raw) {
     };
   } else
     main = { quota: null, killed: !1 };
-  const fallbacks = normalizeAccountList(r.fallbacks), vaultAccounts = Array.isArray(r.vaultAccounts) ? normalizeAccountList(r.vaultAccounts) : void 0, activeId = typeof r.activeId === "string" ? r.activeId : void 0, route = typeof r.route === "string" ? r.route : DEFAULT_SIDEBAR_STATE.route, lastUpdated = typeof r.lastUpdated === "number" ? r.lastUpdated : 0, planType = typeof r.planType === "string" ? r.planType : void 0, credits = typeof r.credits === "number" ? r.credits : void 0, activeRouting = normalizeActiveRouting(r.activeRouting), stickyAssignments = normalizeStickyAssignments(r.stickyAssignments);
+  const fallbacks = normalizeAccountList(r.fallbacks), vaultAccounts = Array.isArray(r.vaultAccounts) ? normalizeAccountList(r.vaultAccounts) : void 0, activeId = typeof r.activeId === "string" ? r.activeId : void 0, route = typeof r.route === "string" ? r.route : DEFAULT_SIDEBAR_STATE.route, lastUpdated = typeof r.lastUpdated === "number" ? r.lastUpdated : 0, planType = typeof r.planType === "string" ? r.planType : void 0, activeRouting = normalizeActiveRouting(r.activeRouting), stickyAssignments = normalizeStickyAssignments(r.stickyAssignments);
   return {
     main,
     fallbacks,
@@ -163,7 +185,6 @@ export function normalizeSidebarState(raw) {
     ...activeRouting !== void 0 ? { activeRouting } : {},
     ...stickyAssignments !== void 0 ? { stickyAssignments } : {},
     ...planType !== void 0 ? { planType } : {},
-    ...credits !== void 0 ? { credits } : {},
     ...r.accountPool === !0 ? { accountPool: !0 } : {},
     ...vaultAccounts !== void 0 ? { vaultAccounts } : {}
   };
@@ -491,12 +512,18 @@ function mergeSpendControl(fresher, older) {
     return;
   return older.spendControl;
 }
+function fresherCredits(incoming, existing) {
+  if (!incoming || !existing)
+    return incoming ?? existing;
+  const at = (credits) => typeof credits.checkedAt === "number" && Number.isFinite(credits.checkedAt) ? credits.checkedAt : Number.NEGATIVE_INFINITY;
+  return at(existing) > at(incoming) ? existing : incoming;
+}
 function mergeQuotaByWindow(incoming, existing) {
   if (!incoming)
     return existing;
   if (!existing)
     return incoming;
-  const incomingAt = latestQuotaCheckedAt(incoming), existingAt = latestQuotaCheckedAt(existing), existingSnapshotIsFresher = existingAt !== void 0 && (incomingAt === void 0 || existingAt > incomingAt), primary = freshestWindow(incoming.primary, existing.primary, existingSnapshotIsFresher, incoming.checkedAt, existing.checkedAt), secondary = freshestWindow(incoming.secondary, existing.secondary, existingSnapshotIsFresher, incoming.checkedAt, existing.checkedAt), spendControl = existingSnapshotIsFresher ? mergeSpendControl(existing, incoming) : mergeSpendControl(incoming, existing), spendControlCleared = spendControl === void 0 && (incoming.spendControlCleared === !0 || existing.spendControlCleared === !0);
+  const incomingAt = latestQuotaCheckedAt(incoming), existingAt = latestQuotaCheckedAt(existing), existingSnapshotIsFresher = existingAt !== void 0 && (incomingAt === void 0 || existingAt > incomingAt), primary = freshestWindow(incoming.primary, existing.primary, existingSnapshotIsFresher, incoming.checkedAt, existing.checkedAt), secondary = freshestWindow(incoming.secondary, existing.secondary, existingSnapshotIsFresher, incoming.checkedAt, existing.checkedAt), spendControl = existingSnapshotIsFresher ? mergeSpendControl(existing, incoming) : mergeSpendControl(incoming, existing), spendControlCleared = spendControl === void 0 && (incoming.spendControlCleared === !0 || existing.spendControlCleared === !0), credits = fresherCredits(incoming.credits, existing.credits);
   let checkedAt;
   for (const stamp of [
     finiteWindowCheckedAt(primary),
@@ -507,6 +534,7 @@ function mergeQuotaByWindow(incoming, existing) {
   const {
     spendControl: _incomingSpendControl,
     spendControlCleared: _incomingCleared,
+    credits: _incomingCredits,
     ...incomingRest
   } = incoming;
   return {
@@ -515,6 +543,7 @@ function mergeQuotaByWindow(incoming, existing) {
     secondary,
     ...spendControl !== void 0 ? { spendControl } : {},
     ...spendControlCleared ? { spendControlCleared: !0 } : {},
+    ...credits !== void 0 ? { credits } : {},
     checkedAt: checkedAt ?? incoming.checkedAt
   };
 }

package/src/tui-compiled/runtime/tui/v2-dialog.js

@@ -22,7 +22,8 @@ export async function openControlDialog(dialog, initial, apply, active = () => !
       const choices = [
         ...section.items.filter((item) => item.actions.length > 0).map((item) => ({
           title: item.label,
-          description: inlineDescription(item.status, item.detail),
+          description: inlineDescription(item.detail),
+          ...item.status ? { footer: item.status } : {},
           value: { itemId: item.id, actions: item.actions }
         })),
         ...section.actions.map((action) => ({