@cortexkit/opencode-openai-auth 1.4.0 → 1.6.0

package/src/tui-compiled/runtime/shared/754d6017f8e419cf-builtins.js

@@ -4,7 +4,7 @@
 // the same locks as any other writer of those files.
 import { formatQuota, isQuotaMap, projectQuota, quotaWindowName, } from "./d5a8f1061ee2f114-index.js";
 import { DEFAULT_FORMER_MAIN_ID, orderForPlacement, resolveRoutingMode, } from "./3e7d45a77c6ad4d5-index.js";
-import { projectFailure, } from "./94820e324f2b4c09-seam.js";
+import { CommandError, projectFailure, } from "./94820e324f2b4c09-seam.js";
 /** `disabledReason` recorded when the user disables an account from the menu. */
 export const MENU_DISABLED_REASON = 'disabled from the command menu';
 function isRecord(value) {
@@ -65,13 +65,16 @@ function addedText(name, result) {
 function failureMessage(error) {
     return projectFailure(error).text;
 }
-async function snapshot(store) {
+async function snapshot(options) {
+    const { store } = options;
     const load = await store.read();
     const read = await store.readSettings();
+    const vault = await options.routing?.vaultOrder?.();
     return {
         load,
         rows: distinctRows(load),
         settings: read.status === 'error' ? {} : read.settings,
+        ...(vault ? { vault } : {}),
     };
 }
 function accountView(row, options) {
@@ -323,6 +326,73 @@ function quotaSection(options, snap) {
         },
     };
 }
+/**
+ * Sets the vault order. The roster's own refusal of the list (`invalid-order`:
+ * an account left out, which it counts without naming) is shown with its own
+ * message; any other failure is projected as usual. The kind is read from
+ * the error object so the menu does not import the vault client.
+ */
+async function reorderVault(vault, order) {
+    try {
+        return await vault.reorder(order);
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            error.name === 'ClaustrumConsumerError' &&
+            error.kind === 'invalid-order')
+            throw new CommandError('vault-invalid-order', error.message, {
+                cause: error,
+            });
+        throw error;
+    }
+}
+function invalidVaultOrder(message) {
+    return new CommandError('vault-invalid-order', message);
+}
+/**
+ * How the Routing section names vault accounts: by label, since route ids
+ * are long and opaque. A typed entry may be a label or a route id, and must
+ * name exactly one account. Refusals quote only the entry the user typed.
+ */
+function vaultNames(vault) {
+    const rows = vault.rows.map((row) => ({
+        id: row.id,
+        label: row.label.trim() || row.id,
+    }));
+    const matches = (entry) => rows.filter((row) => row.id === entry || row.label === entry);
+    return {
+        ids: rows.map((row) => row.id),
+        nameOf: (id) => rows.find((row) => row.id === id)?.label ?? id,
+        /**
+         * What the order input starts with for an account: its label when
+         * typing that label back names this account alone, else its route id
+         * (two accounts sharing a label, or a label with a comma or line break
+         * in it, either of which would split it into two entries).
+         */
+        entryOf: (id) => {
+            const row = rows.find((entry) => entry.id === id);
+            return row && !/[,\n]/.test(row.label) && matches(row.label).length === 1
+                ? row.label
+                : id;
+        },
+        /** The route ids the typed entries name, in order; refuses before any write. */
+        resolve: (entries) => {
+            const ids = [];
+            for (const entry of entries) {
+                const found = matches(entry);
+                if (found.length === 0)
+                    throw invalidVaultOrder(`"${entry}" is not a vault account.`);
+                if (found.length > 1)
+                    throw invalidVaultOrder(`"${entry}" matches more than one vault account; enter those accounts by route id.`);
+                const id = found[0].id;
+                if (ids.includes(id))
+                    throw invalidVaultOrder(`"${entry}" names an account already in the order.`);
+                ids.push(id);
+            }
+            return ids;
+        },
+    };
+}
 function routingSection(options, snap) {
     const { store, extraLocks } = options;
     const locks = extraLocks ? { extraLocks } : {};
@@ -336,14 +406,18 @@ function routingSection(options, snap) {
         ? raw
         : 'ordered';
     const resolved = resolveRoutingMode(current);
-    const ids = snap.rows.map((row) => row.id);
+    // In vault mode routing tries the vault accounts, so their order is the
+    // one shown and set here; the pool roster's order is not used.
+    const vault = snap.vault ? vaultNames(snap.vault) : undefined;
+    const ids = vault ? vault.ids : snap.rows.map((row) => row.id);
+    const nameOf = (id) => (vault ? vault.nameOf(id) : id);
     const tried = orderForPlacement(ids, resolved.placement, options.routing?.formerMainId ?? DEFAULT_FORMER_MAIN_ID);
     const label = choices.find((choice) => choice.value === current)?.label ?? current;
     const lines = [`Mode: ${label}`];
     if (ids.length > 0)
-        lines.push(`Roster order: ${ids.join(', ')}`);
+        lines.push(`${vault ? 'Vault account order' : 'Roster order'}: ${ids.map(nameOf).join(', ')}`);
     if (resolved.mode === 'ordered' && tried.join() !== ids.join())
-        lines.push(`Tried in order: ${tried.join(', ')}`);
+        lines.push(`Tried in order: ${tried.map(nameOf).join(', ')}`);
     const actions = [
         {
             id: 'mode',
@@ -371,19 +445,27 @@ function routingSection(options, snap) {
                 {
                     kind: 'text',
                     id: 'order',
-                    label: 'Account ids, first to last',
-                    value: ids.join(', '),
+                    label: vault
+                        ? 'Vault accounts, first to last, separated by commas'
+                        : 'Account ids, first to last',
+                    value: vault ? ids.map(vault.entryOf).join(', ') : ids.join(', '),
                     required: true,
                 },
             ],
             run: async ({ values }) => {
-                const order = String(values.order)
-                    .split(/[\s,]+/)
-                    .filter((id) => id.length > 0);
-                const result = await store.reorder(order, locks);
+                const text = String(values.order);
+                // A vault label may contain spaces, so vault entries are separated by
+                // commas or line breaks, not spaces; pool ids never contain spaces.
+                const entries = text
+                    .split(vault ? /[,\n]+/ : /[\s,]+/)
+                    .map((entry) => entry.trim())
+                    .filter((entry) => entry.length > 0);
+                const result = snap.vault && vault
+                    ? await reorderVault(snap.vault, vault.resolve(entries))
+                    : await store.reorder(entries, locks);
                 return result.outcome === 'unchanged'
                     ? 'The order is unchanged.'
-                    : `Order set to ${result.ids.join(', ')}.`;
+                    : `Order set to ${result.ids.map(nameOf).join(', ')}.`;
             },
         });
     return {
@@ -524,7 +606,7 @@ function limitsSection(options, snap) {
 }
 /** The four built-in sections, in their fixed order, from one read of the store. */
 export async function builtinSections(options) {
-    const snap = await snapshot(options.store);
+    const snap = await snapshot(options);
     return [
         accountsSection(options, snap),
         quotaSection(options, snap),

package/src/tui-compiled/runtime/shared/81dddd203f1b92a3-quota-writer.js

@@ -1,6 +1,7 @@
 import { resolve } from "node:path";
 import { createLogger } from "./cc9e0702a752cea7-index.js";
 import { isQuotaObservation } from "./d5a8f1061ee2f114-index.js";
+import { quotaFields } from "./e1c5e56df0ba4053-pending.js";
 import { applyVaultQuota, mutateVaultRoster, } from "./30f5bc480f31f51c-roster.js";
 // Every consumer of the same file shares one mailbox and one lock waiter.
 const writers = new Map();
@@ -34,65 +35,14 @@ export function retainVaultQuotaWriter(path, listener) {
         return writer.listeners.size ? Promise.resolve() : drainVaultQuota(path);
     })());
 }
-// Split one observation into its independently dated parts: each rate-limit
-// window (scope and label), each covered-but-unread window, the budget, each
-// counter and the credits record. The mailbox keeps the newest of each part on
-// its own, so a later observation that carries only some parts can't erase an
-// older but still newest reading of another part, which is how
-// mergeQuotaObservation treats them on disk. Each key also carries the
-// receipt's identity, so the identity fence still applies to every part.
+// Each field retains the receipt fence as well as its independent timestamp.
 function fields(publication) {
-    const result = new Map();
-    const { observation } = publication;
-    const witness = JSON.stringify([
+    return quotaFields(publication, JSON.stringify([
         publication.routeId,
         publication.receipt?.credentialId,
         publication.receipt?.accountIdentitySource,
         publication.receipt?.expectedAccountIdentity,
-    ]);
-    const add = (key, at, part) => result.set(`${witness}:${key}`, {
-        at,
-        order: 0,
-        publication: { ...publication, observation: part },
-    });
-    const keyFor = (scope, label) => JSON.stringify([scope ?? 'all', label]);
-    const read = new Set();
-    for (const reading of observation.readings ?? []) {
-        const key = keyFor(reading.scope, reading.label);
-        read.add(key);
-        add(key, observation.checkedAt, {
-            checkedAt: observation.checkedAt,
-            readings: [{ ...reading }],
-        });
-    }
-    for (const pair of observation.coverage ?? []) {
-        const key = keyFor(pair.scope, pair.label);
-        if (!read.has(key))
-            add(key, observation.checkedAt, {
-                checkedAt: observation.checkedAt,
-                coverage: [{ ...pair }],
-            });
-    }
-    if (observation.budget)
-        add('budget', observation.checkedAt, {
-            checkedAt: observation.checkedAt,
-            budget: { ...observation.budget },
-        });
-    for (const [name, counter] of Object.entries(observation.counters ?? {})) {
-        add(`counter:${name}`, counter.checkedAt, {
-            checkedAt: observation.checkedAt,
-            counters: { [name]: { ...counter } },
-        });
-    }
-    if (observation.credits)
-        add('credits', observation.credits.checkedAt, {
-            checkedAt: observation.checkedAt,
-            credits: { ...observation.credits },
-        });
-    // Even an empty observation can bind an account proved by its receipt.
-    if (!result.size)
-        add('empty', observation.checkedAt, { checkedAt: observation.checkedAt });
-    return result;
+    ]));
 }
 /** Enqueue without filesystem work; each quota field retains its own receipt fence. */
 export function enqueueVaultQuota(path, publication) {

package/src/tui-compiled/runtime/shared/a62a27a204266acd-attribution.js

@@ -1,8 +1,41 @@
 import { PoolOperationError } from "./04a6357627de5ed0-errors.js";
-import { toFailure, withTransaction } from "./458b934e92490331-mutate.js";
+import { toFailure, withTransaction, } from "./458b934e92490331-mutate.js";
 import { LockStack } from "./43fc9e6b994519c7-refresh-lock.js";
 import { refusal, requireBound, unknownRow, } from "./83bc3ba9d0fe2761-runtime.js";
 import { isCredentialEpoch } from "./cd94316a888b0a8e-schema.js";
+export function assertQuotaEpoch(id, attribution) {
+    if (!isCredentialEpoch(attribution?.credentialEpoch))
+        throw refusal('pull', id, 'invalid-input', 'the credential epoch the reading was issued for must be a positive safe integer');
+}
+// Shared by preflight and the locked commit: accepting into memory must never
+// hide a refusal the immediate writer would have returned to its caller.
+export function assertQuotaRow(id, attribution, row) {
+    if (!row)
+        throw unknownRow('pull', id);
+    if (row.invalid)
+        throw refusal('pull', id, 'invalid-row', `row ${id} is invalid`);
+    if (!row.credential)
+        throw refusal('pull', id, 'no-credential', `row ${id} holds no credential`);
+    requireBound('pull', row);
+    if (row.torn ||
+        !row.hasEntry ||
+        row.credentialEpoch !== attribution.credentialEpoch ||
+        row.identity !== attribution.identity)
+        throw new PoolOperationError({
+            operation: 'pull',
+            rowId: id,
+            phase: 'pull',
+            retryable: true,
+            kind: 'attribution',
+            message: `quota for ${id} was issued for a credential the row no longer holds`,
+        });
+}
+export function mergedQuota(ctx, id, stored, observation) {
+    const merged = ctx.codec.merge(stored, observation);
+    if (!ctx.codec.validate(merged))
+        throw refusal('pull', id, 'invalid-quota', 'the quota codec rejected the merged map');
+    return merged;
+}
 /**
  * Merges a quota observation into a row's stored map under the store locks,
  * after attribution passes. Needs no row lock, so it is permitted from
@@ -13,37 +46,18 @@ export async function recordQuota(rt, id, attribution, observation) {
     const locks = new LockStack(ctx.lockDefaults, ctx.lockEnv);
     const progress = { writes: 0 };
     try {
-        if (!isCredentialEpoch(attribution?.credentialEpoch))
-            throw refusal('pull', id, 'invalid-input', 'the credential epoch the reading was issued for must be a positive safe integer');
+        assertQuotaEpoch(id, attribution);
         await withTransaction(ctx, locks, progress, { operation: 'pull', rowId: id }, async (tx) => {
             tx.assertNotStaged(id);
             const row = tx.row(id);
-            if (!row)
-                throw unknownRow('pull', id);
-            if (row.invalid)
-                throw refusal('pull', id, 'invalid-row', `row ${id} is invalid`);
             // A reading belongs to one (epoch, identity, credential). A row
             // holding no credential, or torn between the writes of a replace,
             // has no such triple on disk, so no reading is recorded for it.
-            if (!row.credential)
-                throw refusal('pull', id, 'no-credential', `row ${id} holds no credential`);
-            requireBound('pull', row);
+            assertQuotaRow(id, attribution, row);
             const entry = tx.entry(id);
-            if (row.torn ||
-                !entry ||
-                entry.credentialEpoch !== attribution.credentialEpoch ||
-                row.identity !== attribution.identity)
-                throw new PoolOperationError({
-                    operation: 'pull',
-                    rowId: id,
-                    phase: 'pull',
-                    retryable: true,
-                    kind: 'attribution',
-                    message: `quota for ${id} was issued for a credential the row no longer holds`,
-                });
-            const merged = ctx.codec.merge(entry.quota, observation);
-            if (!ctx.codec.validate(merged))
-                throw refusal('pull', id, 'invalid-quota', 'the quota codec rejected the merged map');
+            if (!entry)
+                throw unknownRow('pull', id);
+            const merged = mergedQuota(ctx, id, entry.quota, observation);
             tx.setEntry(id, { ...entry, quota: merged, needsFirstReading: false });
             await tx.commitConfig();
         }, 

package/src/tui-compiled/runtime/shared/a910277ac43a8626-pull.js

@@ -105,7 +105,9 @@ export class PullScheduler {
                     cause,
                 });
             }
-            await recordQuota(rt, id, {
+            const publish = rt.publishQuota ??
+                ((rowId, attribution, value) => recordQuota(rt, rowId, attribution, value));
+            await publish(id, {
                 credentialEpoch: request.credentialEpoch,
                 ...(request.identity !== undefined
                     ? { identity: request.identity }

package/src/tui-compiled/runtime/shared/b9588ad4725c1d10-enrollment.js

@@ -10,12 +10,22 @@ const ENROLLMENT_SCHEMA = 1;
 const ENROLLMENT_FILE_MAX_BYTES = 16 * 1024;
 const ENROLLMENT_LOCK_TTL_MS = 30_000;
 const TOKEN_RE = /^[0-9a-f]{64}$/;
+/**
+ * The code a vault without the enrollment ceremony answers a proposal with.
+ * Setup reports it as "this vault cannot connect plugins" instead of waiting.
+ */
+export const UNSUPPORTED_ENROLLMENT_CODE = 'unknown_method';
 /**
  * Codes the vault's closed enrollment-refusal vocabulary marks permanent. The
  * client labels some module error frames transient/retry regardless, so the
  * producer's code takes precedence over the client's action for these.
  */
 export const TERMINAL_ENROLLMENT_CODES = new Set([
+    // The daemon's answer to an operation it does not implement: a vault built
+    // before the enrollment ceremony. It arrives as a transport Error frame with
+    // no class, which claustrum-client before 0.13.0 labels transient/retry, but
+    // asking again can never succeed.
+    UNSUPPORTED_ENROLLMENT_CODE,
     'invalid_params',
     'pending_exists',
     'not_found',
@@ -638,6 +648,23 @@ export class ClaustrumEnrollmentManager {
                             retryCode: refusal.code,
                         };
                     }
+                    // A vault without the ceremony cannot hold a request for this
+                    // proposal, now or from an earlier run (the state has no request
+                    // id). So nothing is blocked and nothing is in progress: remove the
+                    // pending state, still under the ceremony lock, so status reads as
+                    // "not enrolled" and a reset or a later run starts afresh.
+                    if (refusal.code === UNSUPPORTED_ENROLLMENT_CODE) {
+                        await lock.assertOwned();
+                        await unlink(this.#paths.statePath).catch((cause) => {
+                            if (cause.code !== 'ENOENT')
+                                throw cause;
+                        });
+                        return {
+                            state: 'unavailable',
+                            proposedName: state.proposedName,
+                            code: refusal.code,
+                        };
+                    }
                     return this.#block(state, refusal.code);
                 }
             }

package/src/tui-compiled/runtime/shared/c852a15cfe489d12-pool.js

@@ -3,6 +3,7 @@ import { initializePool, readPool, } from "./458b934e92490331-mutate.js";
 import { updateProviderStateRow, } from "./97484d9bb98c705b-provider-state.js";
 import { publication, publishRoster, } from "./83068c0dbe8a6f13-publication.js";
 import { PullScheduler } from "./a910277ac43a8626-pull.js";
+import { PoolQuotaWriter } from "./c911dbb64c9d85c7-quota-writer.js";
 import { refreshRow, } from "./9d3fc9e37456504e-refresh.js";
 import { POOL_LOCK_DEFAULTS, } from "./43fc9e6b994519c7-refresh-lock.js";
 import { addRow, disableRow, enableRow, recordRowIdentity, removeRow, reorderRows, replaceRow, rotateRow, } from "./fe02abeadc535f77-rows.js";
@@ -80,9 +81,21 @@ export function openPoolStore(options) {
         rowLockOptions: options.rowLockOptions ?? {},
         firePull: (id, reason) => pulls.fire(id, reason),
     };
+    const quotaWriter = options.coalesceQuota
+        ? new PoolQuotaWriter(rt, options.quotaDrainTimeoutMs)
+        : undefined;
+    const record = (id, attribution, observation) => quotaWriter
+        ? quotaWriter.record(id, attribution, observation)
+        : recordQuota(rt, id, attribution, observation);
+    rt.publishQuota = record;
+    const overlay = (result) => {
+        if (result.status === 'ready' && quotaWriter)
+            return { ...result, rows: quotaWriter.overlay(result.rows) };
+        return result;
+    };
     return {
         async load() {
-            const result = await readPool(ctx);
+            const result = overlay(await readPool(ctx));
             if (result.status === 'ready') {
                 // A torn row is no candidate, but its pull is fired too: the pull
                 // completes the row on disk before reading it, so an interrupted
@@ -96,7 +109,7 @@ export function openPoolStore(options) {
             return toLoad(result);
         },
         async read() {
-            return toLoad(await readPool(ctx));
+            return toLoad(overlay(await readPool(ctx)));
         },
         async initialize(input = {}) {
             return { status: await initializePool(ctx, input.dropKeys ?? []) };
@@ -115,7 +128,9 @@ export function openPoolStore(options) {
         updateSettings: (mutator, callOptions) => updatePoolSettings(rt, mutator, callOptions),
         recordIdentity: (id, identity, attribution, callOptions) => recordRowIdentity(rt, id, identity, attribution, callOptions),
         refresh: (id, provider, callOptions) => refreshRow(rt, id, provider, callOptions),
-        recordQuota: (id, attribution, observation) => recordQuota(rt, id, attribution, observation),
+        recordQuota: record,
+        close: () => quotaWriter?.close() ?? Promise.resolve(),
+        dispose: () => quotaWriter?.close() ?? Promise.resolve(),
         requestReading: (id) => pulls.fire(id, 'admission'),
         pullsSettled: () => pulls.settled(),
     };