@cortexkit/opencode-openai-auth 1.4.0 → 1.6.0

package/src/tui-compiled/raw/shared/c911dbb64c9d85c7-quota-writer.js

@@ -0,0 +1,298 @@
+import { createLogger } from "./cc9e0702a752cea7-index.js";
+import { assertQuotaEpoch, assertQuotaRow, mergedQuota, } from "./a62a27a204266acd-attribution.js";
+import { PoolOperationError } from "./04a6357627de5ed0-errors.js";
+import { toFailure, withTransaction } from "./458b934e92490331-mutate.js";
+import { LockStack } from "./43fc9e6b994519c7-refresh-lock.js";
+import { readRow, refusal } from "./83bc3ba9d0fe2761-runtime.js";
+import { entryIn } from "./cd94316a888b0a8e-schema.js";
+const COALESCE_MS = 100;
+/**
+ * The most readings one row keeps waiting for a flush. Hosts record a reading
+ * about every 100 ms at most, so for them a queue this long means another
+ * writer has held the store locks for many seconds. Reaching it starts
+ * a flush at once instead of waiting for the coalescing timer or a retry
+ * backoff; a further reading for the row waits for room (never dropping an
+ * older one) for as long as the store's normal lock budget, and is then
+ * refused with `lock-contention`, as the immediate writer would refuse it.
+ */
+export const POOL_QUOTA_QUEUE_LIMIT = 128;
+// Readings are queued whole per row and applied at flush in arrival order
+// through the codec's own merge, so the codec alone decides which fields a
+// newer or older reading replaces. Like the roster writer, a reading stays
+// queued until the flush that took it commits: one queued while a flush waits
+// for its locks must survive that flush.
+export class PoolQuotaWriter {
+    rt;
+    timeoutMs;
+    pending = new Map();
+    warned = new Set();
+    wake = new Set();
+    logger;
+    timer;
+    running;
+    closing;
+    closed = false;
+    stopped = false;
+    failures = 0;
+    constructor(rt, timeoutMs = 1_000) {
+        this.rt = rt;
+        this.timeoutMs = timeoutMs;
+        this.logger = rt.ctx.logger ?? createLogger('store');
+    }
+    async record(id, attribution, observation) {
+        try {
+            this.assertOpen(id);
+            assertQuotaEpoch(id, attribution);
+            // Snapshot before the first await: callers may reuse their headers object.
+            const publication = structuredClone({
+                id,
+                attribution,
+                observation,
+            });
+            const { row, result } = await readRow(this.rt, 'pull', id);
+            assertQuotaRow(id, publication.attribution, row);
+            // Merge into what read() shows now, so a reading the codec refuses is
+            // refused to its caller here, as the immediate writer would refuse it.
+            mergedQuota(this.rt.ctx, id, this.overlayRow({ ...row, quota: entryIn(result.config, id)?.quota })
+                .quota, publication.observation);
+            await this.room(id);
+            this.assertOpen(id);
+            // No await between the room check and the push, so the cap holds.
+            const queue = this.pending.get(id) ?? [];
+            queue.push(publication);
+            this.pending.set(id, queue);
+            if (queue.length >= POOL_QUOTA_QUEUE_LIMIT)
+                this.flushNow();
+            else
+                this.schedule(COALESCE_MS);
+        }
+        catch (error) {
+            throw toFailure(error, 'pull', id, { writes: 0 });
+        }
+    }
+    queued(id) {
+        return this.pending.get(id)?.length ?? 0;
+    }
+    // Waits while the row's queue is full, flushing at once on every wake-up,
+    // for at most the store's own lock acquisition budget.
+    async room(id) {
+        if (this.queued(id) < POOL_QUOTA_QUEUE_LIMIT)
+            return;
+        const { ctx } = this.rt;
+        const budget = Math.max(0, ...ctx.storeLocks.map((spec) => spec.timeoutMs ?? ctx.lockDefaults.timeoutMs));
+        const deadline = performance.now() + budget;
+        while (this.queued(id) >= POOL_QUOTA_QUEUE_LIMIT) {
+            this.assertOpen(id);
+            this.flushNow();
+            const left = deadline - performance.now();
+            if (left <= 0)
+                throw refusal('pull', id, 'lock-contention', `pool quota queue for ${id} is full (${POOL_QUOTA_QUEUE_LIMIT} readings) and the store locks stayed held`, true);
+            await new Promise((resolve) => {
+                const done = () => {
+                    clearTimeout(timer);
+                    this.wake.delete(done);
+                    resolve();
+                };
+                const timer = setTimeout(done, left);
+                this.wake.add(done);
+            });
+        }
+    }
+    assertOpen(id) {
+        if (this.closed)
+            throw refusal('pull', id, 'invalid-input', 'pool quota writer is closed');
+    }
+    // What read() and load() show: the stored map, then each queued reading of
+    // the row still bound to it, in arrival order through the codec's merge.
+    // A reading the codec now refuses is left out, as the flush drops it.
+    overlayRow(row) {
+        let next = row;
+        for (const publication of this.pending.get(row.id) ?? []) {
+            try {
+                assertQuotaRow(row.id, publication.attribution, row);
+                next = {
+                    ...next,
+                    quota: mergedQuota(this.rt.ctx, row.id, next.quota, publication.observation),
+                    needsFirstReading: false,
+                };
+            }
+            catch { }
+        }
+        return next;
+    }
+    overlay(rows) {
+        return rows.map((row) => this.overlayRow(row));
+    }
+    schedule(delay) {
+        if (this.running || this.timer || !this.pending.size || this.stopped)
+            return;
+        this.timer = setTimeout(() => {
+            this.timer = undefined;
+            this.flush();
+        }, delay);
+        if (!this.closed)
+            this.timer.unref?.();
+    }
+    // Starts a flush now rather than at the coalescing timer or retry backoff;
+    // a flush already running is left to finish.
+    flushNow() {
+        if (this.running)
+            return;
+        clearTimeout(this.timer);
+        this.timer = undefined;
+        this.flush();
+    }
+    flush() {
+        if (this.running || this.stopped || !this.pending.size)
+            return;
+        // Every queued reading, each row's in arrival order.
+        const batch = [...this.pending.values()].flat();
+        // Short lock attempts allow retries to pick up freshly queued readings and
+        // bound shutdown even when the normal store acquisition budget is long.
+        const ctx = {
+            ...this.rt.ctx,
+            storeLocks: this.rt.ctx.storeLocks.map((spec) => ({
+                ...spec,
+                timeoutMs: Math.min(spec.timeoutMs ?? this.rt.ctx.lockDefaults.timeoutMs, 100),
+            })),
+        };
+        const locks = new LockStack(ctx.lockDefaults, ctx.lockEnv);
+        this.running = (async () => {
+            try {
+                await withTransaction(ctx, locks, { writes: 0 }, { operation: 'pull', rowId: undefined }, async (tx) => {
+                    if (this.stopped)
+                        return;
+                    let changed = false;
+                    for (const publication of batch) {
+                        const { id, attribution, observation } = publication;
+                        const witness = JSON.stringify([
+                            id,
+                            attribution.credentialEpoch,
+                            attribution.identity,
+                        ]);
+                        try {
+                            tx.assertNotStaged(id);
+                            assertQuotaRow(id, attribution, tx.row(id));
+                        }
+                        catch (error) {
+                            if (!(error instanceof PoolOperationError))
+                                throw error;
+                            if (!this.warned.has(witness)) {
+                                this.warned.add(witness);
+                                this.warn('pool quota publication dropped; account binding changed', { id, kind: error.kind });
+                            }
+                            continue;
+                        }
+                        const entry = tx.entry(id);
+                        if (!entry)
+                            continue;
+                        let quota;
+                        try {
+                            quota = mergedQuota(ctx, id, entry.quota, observation);
+                        }
+                        catch (error) {
+                            // The codec accepted this reading when it was queued, but not
+                            // against what is stored now (another writer changed it).
+                            // Drop only this reading: failing the transaction would retry
+                            // the same refusal forever and hold back every other row.
+                            const key = `codec:${witness}`;
+                            if (!this.warned.has(key)) {
+                                this.warned.add(key);
+                                this.warn('pool quota publication dropped; the quota codec refused it', {
+                                    id,
+                                    error: error instanceof Error ? error.message : String(error),
+                                });
+                            }
+                            continue;
+                        }
+                        tx.setEntry(id, { ...entry, quota, needsFirstReading: false });
+                        changed = true;
+                    }
+                    if (changed && !this.stopped)
+                        await tx.commitConfig();
+                }, { completeTorn: false });
+                const flushed = new Set(batch);
+                for (const [id, queue] of this.pending) {
+                    const rest = queue.filter((publication) => !flushed.has(publication));
+                    if (rest.length)
+                        this.pending.set(id, rest);
+                    else
+                        this.pending.delete(id);
+                }
+                this.failures = 0;
+            }
+            catch (error) {
+                if (!this.stopped && this.failures++ === 0)
+                    this.warn('pool quota publication delayed; retrying', {
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                // Retain the mailbox on failure, including fresher readings queued meanwhile.
+            }
+            finally {
+                await locks.releaseAll();
+                this.running = undefined;
+                for (const wake of this.wake)
+                    wake();
+                const delay = this.failures
+                    ? Math.min(5_000, 100 * 2 ** Math.min(this.failures, 6)) *
+                        (0.5 + Math.random())
+                    : COALESCE_MS;
+                this.schedule(delay);
+            }
+        })();
+    }
+    warn(message, data) {
+        try {
+            this.logger.warn(message, data);
+        }
+        catch {
+            /* Logging cannot stop publication. */
+        }
+    }
+    close() {
+        if (this.closing)
+            return this.closing;
+        this.closed = true;
+        this.closing = this.drain();
+        return this.closing;
+    }
+    async drain() {
+        clearTimeout(this.timer);
+        this.timer = undefined;
+        let deadline;
+        let wake;
+        const drained = new Promise((done) => {
+            wake = () => {
+                if (!this.pending.size)
+                    done();
+            };
+            this.wake.add(wake);
+            wake();
+        });
+        try {
+            this.flush();
+            await Promise.race([
+                drained,
+                new Promise((done) => {
+                    deadline = setTimeout(done, Math.max(0, this.timeoutMs));
+                }),
+            ]);
+        }
+        finally {
+            this.stopped = true;
+            clearTimeout(deadline);
+            clearTimeout(this.timer);
+            this.wake.delete(wake);
+            if (this.pending.size)
+                this.warn('pool quota drain timed out; pending readings left', {
+                    accounts: this.pending.size,
+                    readings: [...this.pending.values()].reduce((sum, queue) => sum + queue.length, 0),
+                });
+            this.pending.clear();
+            // A reading waiting for room in a full queue is refused as closed when
+            // the drain ends, not when its own lock budget runs out.
+            for (const wake of this.wake)
+                wake();
+        }
+    }
+}

package/src/tui-compiled/raw/shared/e1c5e56df0ba4053-pending.js

@@ -0,0 +1,48 @@
+// Use the same independently dated parts as mergeQuotaObservation. A header
+// reading cannot erase a poll-only window, counter, credits record or budget.
+export function quotaFields(publication, witness = '') {
+    const result = new Map();
+    const { observation } = publication;
+    const add = (key, at, part) => result.set(`${witness}:${key}`, {
+        at,
+        order: 0,
+        publication: { ...publication, observation: part },
+    });
+    const keyFor = (scope, label) => JSON.stringify([scope ?? 'all', label]);
+    const read = new Set();
+    for (const reading of observation.readings ?? []) {
+        const key = keyFor(reading.scope, reading.label);
+        read.add(key);
+        add(key, observation.checkedAt, {
+            checkedAt: observation.checkedAt,
+            readings: [{ ...reading }],
+        });
+    }
+    for (const pair of observation.coverage ?? []) {
+        const key = keyFor(pair.scope, pair.label);
+        if (!read.has(key))
+            add(key, observation.checkedAt, {
+                checkedAt: observation.checkedAt,
+                coverage: [{ ...pair }],
+            });
+    }
+    if (observation.budget)
+        add('budget', observation.checkedAt, {
+            checkedAt: observation.checkedAt,
+            budget: { ...observation.budget },
+        });
+    for (const [name, counter] of Object.entries(observation.counters ?? {})) {
+        add(`counter:${name}`, counter.checkedAt, {
+            checkedAt: observation.checkedAt,
+            counters: { [name]: { ...counter } },
+        });
+    }
+    if (observation.credits)
+        add('credits', observation.credits.checkedAt, {
+            checkedAt: observation.checkedAt,
+            credits: { ...observation.credits },
+        });
+    if (!result.size)
+        add('empty', observation.checkedAt, { checkedAt: observation.checkedAt });
+    return result;
+}

package/src/tui-compiled/raw/shared/e8d3c8da776ef9cd-index.js

@@ -15,7 +15,7 @@ export { assertHostSlotMatchesMode, assertNotCustodyPlaceholder, CUSTODY_PLACEHO
 export { acquireInsulaQuotaSource, } from "./d0f0b6be200311af-insula.js";
 export { acceptAccount, declineAccount, isDeclined, } from "./7c140680fc81be92-interlock.js";
 export { drainVaultQuota } from "./81dddd203f1b92a3-quota-writer.js";
-export { acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, mutateVaultRoster, projectVaultRoster, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, resolveVaultPrimary, vaultRoutingRows, } from "./30f5bc480f31f51c-roster.js";
+export { acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, mutateVaultRoster, projectVaultRoster, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, reorderVaultRoster, resolveVaultPrimary, vaultRoutingRows, } from "./30f5bc480f31f51c-roster.js";
 export { ChangeNoticeReader, RESUBSCRIBE_BACKOFF_MS, SAFETY_POLL_MS, ScopedRosterWatch, WATCH_RETRY_MS, } from "./dc9290c2a7552ba6-watch.js";
 /**
  * Connect the client that lists and fetches this consumer's vault credentials

package/src/tui-compiled/runtime/shared/169b2b4bf30909bc-consumer.js

@@ -5,7 +5,7 @@ import { readClaustrumEnrollmentToken } from "./b9588ad4725c1d10-enrollment.js";
 import { ClaustrumConsumerError } from "./ca0fccaba1d87af4-errors.js";
 import { acquireInsulaQuotaSource, } from "./d0f0b6be200311af-insula.js";
 import { pendingVaultQuota, retainVaultQuotaWriter } from "./81dddd203f1b92a3-quota-writer.js";
-import { acceptVaultRoute, applyVaultQuota, declineVaultRoute, forgetPendingVaultDiscovery, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, vaultRoutingRows, } from "./30f5bc480f31f51c-roster.js";
+import { acceptVaultRoute, applyVaultQuota, declineVaultRoute, forgetPendingVaultDiscovery, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, reorderVaultRoster, vaultRoutingRows, } from "./30f5bc480f31f51c-roster.js";
 import { SAFETY_POLL_MS } from "./dc9290c2a7552ba6-watch.js";
 /**
  * One plugin host's view of its vault accounts. It turns vault credentials
@@ -485,8 +485,12 @@ export class ClaustrumConsumer {
             let current;
             try {
                 current = await this.authorize(routeId, signal);
+                // Cancellation can land after authorize settles, before this continuation.
+                signal?.throwIfAborted();
             }
-            catch {
+            catch (error) {
+                if (signal?.aborted)
+                    throw error;
                 // Re-authorization failed: keep this 401 and report it against the
                 // receipt (served record version) this request was sent with.
             }
@@ -522,6 +526,17 @@ export class ClaustrumConsumer {
         await acceptVaultRoute(this.#options.rosterPath, routeId);
         this.#roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
     }
+    /**
+     * Set the order vault accounts are tried in (`reorderVaultRoster`), then
+     * re-read the roster, so the next routing decision in this process uses
+     * the new order without waiting for a discovery. Never contacts the vault.
+     */
+    async reorder(routeIds) {
+        this.#assertOpen();
+        const result = await reorderVaultRoster(this.#options.rosterPath, routeIds);
+        this.#roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
+        return result;
+    }
     /**
      * Store a quota or profile observation for a vault route. The receipt the
      * reading was taken with is required: the observation lands only while the

package/src/tui-compiled/runtime/shared/30f5bc480f31f51c-roster.js

@@ -378,6 +378,78 @@ export function acceptVaultRoute(path, routeId) {
         };
     });
 }
+function invalidOrder(message) {
+    return new ClaustrumConsumerError('invalid-order', message);
+}
+/**
+ * Why `routeIds` is not an order of these rows: it must name every distinct
+ * route id exactly once and nothing else. The message quotes only ids the
+ * caller supplied; route ids it left out are counted, not named.
+ */
+function vaultOrderProblem(rows, routeIds) {
+    if (!Array.isArray(routeIds))
+        return 'route ids must be an array of route ids';
+    const rosterIds = new Set(rows.map((row) => row.routeId));
+    const given = new Set();
+    for (const id of routeIds) {
+        if (typeof id !== 'string')
+            return 'route ids must be an array of route ids';
+        if (given.has(id))
+            return `route id ${id} appears more than once`;
+        if (!rosterIds.has(id))
+            return `route id ${id} is not in the roster`;
+        given.add(id);
+    }
+    const missing = [...rosterIds].filter((id) => !given.has(id)).length;
+    if (missing > 0)
+        return `the order leaves out ${missing} roster route id${missing === 1 ? '' : 's'}`;
+    return undefined;
+}
+/**
+ * Set the order vault accounts are tried in. Routing reads that order from
+ * the roster's row order (`vaultRoutingRows`), and a later discovery keeps
+ * each account at its position, so the order lasts until the next reorder.
+ * The order is this host's routing preference: the vault has no order of its
+ * own, and this never contacts it.
+ *
+ * `routeIds` must name every roster route id exactly once; anything else
+ * (an unknown, missing or repeated id) refuses with `invalid-order` and
+ * writes nothing. It runs under the roster's write lock, like every other
+ * roster write, so a quota reading or decline committed meanwhile is kept.
+ * Each row is kept as the same object, so only the positions change: every
+ * row's fields and the rest of the file stay as they were. An order equal to
+ * the current one writes nothing. A host with no roster file yet has no
+ * routes, so only the empty order is accepted.
+ *
+ * A `ClaustrumConsumer` in the same process does not see the new order until
+ * it re-reads the file: call `consumer.reorder` instead to update both.
+ */
+export function reorderVaultRoster(path, routeIds, options = {}) {
+    return mutateVaultRoster(path, (current) => {
+        const rows = current?.rows ?? [];
+        const problem = vaultOrderProblem(rows, routeIds);
+        if (problem)
+            throw invalidOrder(problem);
+        // Group by route id so a hand-edited file that repeats one keeps every
+        // copy: the later copies travel right after the first.
+        const byId = new Map();
+        for (const row of rows) {
+            const group = byId.get(row.routeId);
+            if (group)
+                group.push(row);
+            else
+                byId.set(row.routeId, [row]);
+        }
+        const ids = [...routeIds];
+        const next = ids.flatMap((id) => byId.get(id) ?? []);
+        if (!current || next.every((row, index) => row === rows[index]))
+            return { result: { ids, outcome: 'unchanged' } };
+        return {
+            next: { ...current, rows: next },
+            result: { ids, outcome: 'reordered' },
+        };
+    }, { ...(options.signal && { signal: options.signal }) });
+}
 /**
  * What a receipt may do to a row's quota: `hold` (the row holds the receipt's
  * credential and account), `bind` (the row has never had a known account and

package/src/tui-compiled/runtime/shared/375d9cca2def037d-private-files.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { lstat, readFile, rename, unlink } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
 export const windowsPrivateFiles = process.platform === 'win32';
 const migrationNotices = new Set();
 function ioCode(detail) {
@@ -20,8 +21,51 @@ let backend;
 export function setPrivateFilesBackendForTest(api) {
     backend = api ? Promise.resolve(api) : undefined;
 }
+/** The fixed `reason` of a refusal because the Windows native addon did not load. */
+export const PRIVATE_FILES_UNAVAILABLE_REASON = 'native-addon-unavailable';
+function privateFilesUnavailable(cause) {
+    return Object.assign(new Error('Windows private-files native addon is unavailable', { cause }), {
+        code: 'ERR_PRIVATE_FILES_UNAVAILABLE',
+        reason: PRIVATE_FILES_UNAVAILABLE_REASON,
+    });
+}
+function isUnavailable(api, error) {
+    return (error instanceof api.PrivateFilesUnavailableError ||
+        error?.code ===
+            'ERR_PRIVATE_FILES_UNAVAILABLE');
+}
+/**
+ * Importing @cortexkit/private-files succeeds even when its Windows addon
+ * cannot load: the package loads the addon on first use, and some of its
+ * checks then report the failure as an ordinary refusal such as
+ * `unsupported-filesystem`. So prove the addon loads before handing the
+ * package out. Verifying a path that does not exist loads the addon first and
+ * then fails harmlessly; only the package's own "unavailable" error means the
+ * addon is missing.
+ */
+async function assertNativeAddonLoads(api) {
+    try {
+        await api.verifyPrivatePath(join(tmpdir(), `.common-auth-private-files-probe-${randomUUID()}`), 'file');
+    }
+    catch (error) {
+        if (isUnavailable(api, error))
+            throw privateFilesUnavailable(error);
+    }
+}
+/**
+ * Load the package once per process. On Windows a failed import or addon load
+ * is kept, so every later private-file operation refuses at once with
+ * ERR_PRIVATE_FILES_UNAVAILABLE. There is no fallback to permission bits:
+ * they do not protect files on Windows.
+ */
 function loadBackend() {
-    backend ??= import("@cortexkit/private-files");
+    backend ??= import("@cortexkit/private-files").then(async (api) => {
+        if (windowsPrivateFiles)
+            await assertNativeAddonLoads(api);
+        return api;
+    }, (cause) => {
+        throw windowsPrivateFiles ? privateFilesUnavailable(cause) : cause;
+    });
     return backend;
 }
 export class PrivateFileError extends Error {
@@ -38,7 +82,9 @@ export class PrivateFileError extends Error {
     orphanPath;
     constructor(path, stage, cause) {
         const detail = cause;
-        super(`Private file refused at ${stage}: ${path} (${detail?.reason ?? detail?.code ?? 'io-error'}). Use a safe parent directory. Repair only a named secret file in safe ancestry whose owner the published policy trusts, without changing its owner or any existing directory. Previously exposed credentials may need rotation. Windows requires the private-files native prebuild and an ACL-persisting local filesystem such as NTFS.`, { cause });
+        super(detail?.code === 'ERR_PRIVATE_FILES_UNAVAILABLE'
+            ? `Private file refused at ${stage}: ${path} (${PRIVATE_FILES_UNAVAILABLE_REASON}). The Windows native addon of @cortexkit/private-files could not be loaded, so owner-only access cannot be enforced and nothing was read or written. Reinstall the plugin so the private-files Windows prebuild for this architecture is present; Windows has no safe fallback to permission bits.`
+            : `Private file refused at ${stage}: ${path} (${detail?.reason ?? detail?.code ?? 'io-error'}). Keep this file in a folder that only you, the system or administrators can change, such as a folder in your home directory. If other users could read the file before, sign in again to replace the credentials it held. On Windows the file must also be on a local drive that keeps Windows file permissions, such as NTFS.`, { cause });
         this.path = path;
         this.stage = stage;
         this.name = 'PrivateFileError';