@cortexkit/opencode-openai-auth 1.5.0 → 1.6.0

package/src/tui-compiled/raw/shared/c911dbb64c9d85c7-quota-writer.js

@@ -0,0 +1,298 @@
+import { createLogger } from "./cc9e0702a752cea7-index.js";
+import { assertQuotaEpoch, assertQuotaRow, mergedQuota, } from "./a62a27a204266acd-attribution.js";
+import { PoolOperationError } from "./04a6357627de5ed0-errors.js";
+import { toFailure, withTransaction } from "./458b934e92490331-mutate.js";
+import { LockStack } from "./43fc9e6b994519c7-refresh-lock.js";
+import { readRow, refusal } from "./83bc3ba9d0fe2761-runtime.js";
+import { entryIn } from "./cd94316a888b0a8e-schema.js";
+const COALESCE_MS = 100;
+/**
+ * The most readings one row keeps waiting for a flush. Hosts record a reading
+ * about every 100 ms at most, so for them a queue this long means another
+ * writer has held the store locks for many seconds. Reaching it starts
+ * a flush at once instead of waiting for the coalescing timer or a retry
+ * backoff; a further reading for the row waits for room (never dropping an
+ * older one) for as long as the store's normal lock budget, and is then
+ * refused with `lock-contention`, as the immediate writer would refuse it.
+ */
+export const POOL_QUOTA_QUEUE_LIMIT = 128;
+// Readings are queued whole per row and applied at flush in arrival order
+// through the codec's own merge, so the codec alone decides which fields a
+// newer or older reading replaces. Like the roster writer, a reading stays
+// queued until the flush that took it commits: one queued while a flush waits
+// for its locks must survive that flush.
+export class PoolQuotaWriter {
+    rt;
+    timeoutMs;
+    pending = new Map();
+    warned = new Set();
+    wake = new Set();
+    logger;
+    timer;
+    running;
+    closing;
+    closed = false;
+    stopped = false;
+    failures = 0;
+    constructor(rt, timeoutMs = 1_000) {
+        this.rt = rt;
+        this.timeoutMs = timeoutMs;
+        this.logger = rt.ctx.logger ?? createLogger('store');
+    }
+    async record(id, attribution, observation) {
+        try {
+            this.assertOpen(id);
+            assertQuotaEpoch(id, attribution);
+            // Snapshot before the first await: callers may reuse their headers object.
+            const publication = structuredClone({
+                id,
+                attribution,
+                observation,
+            });
+            const { row, result } = await readRow(this.rt, 'pull', id);
+            assertQuotaRow(id, publication.attribution, row);
+            // Merge into what read() shows now, so a reading the codec refuses is
+            // refused to its caller here, as the immediate writer would refuse it.
+            mergedQuota(this.rt.ctx, id, this.overlayRow({ ...row, quota: entryIn(result.config, id)?.quota })
+                .quota, publication.observation);
+            await this.room(id);
+            this.assertOpen(id);
+            // No await between the room check and the push, so the cap holds.
+            const queue = this.pending.get(id) ?? [];
+            queue.push(publication);
+            this.pending.set(id, queue);
+            if (queue.length >= POOL_QUOTA_QUEUE_LIMIT)
+                this.flushNow();
+            else
+                this.schedule(COALESCE_MS);
+        }
+        catch (error) {
+            throw toFailure(error, 'pull', id, { writes: 0 });
+        }
+    }
+    queued(id) {
+        return this.pending.get(id)?.length ?? 0;
+    }
+    // Waits while the row's queue is full, flushing at once on every wake-up,
+    // for at most the store's own lock acquisition budget.
+    async room(id) {
+        if (this.queued(id) < POOL_QUOTA_QUEUE_LIMIT)
+            return;
+        const { ctx } = this.rt;
+        const budget = Math.max(0, ...ctx.storeLocks.map((spec) => spec.timeoutMs ?? ctx.lockDefaults.timeoutMs));
+        const deadline = performance.now() + budget;
+        while (this.queued(id) >= POOL_QUOTA_QUEUE_LIMIT) {
+            this.assertOpen(id);
+            this.flushNow();
+            const left = deadline - performance.now();
+            if (left <= 0)
+                throw refusal('pull', id, 'lock-contention', `pool quota queue for ${id} is full (${POOL_QUOTA_QUEUE_LIMIT} readings) and the store locks stayed held`, true);
+            await new Promise((resolve) => {
+                const done = () => {
+                    clearTimeout(timer);
+                    this.wake.delete(done);
+                    resolve();
+                };
+                const timer = setTimeout(done, left);
+                this.wake.add(done);
+            });
+        }
+    }
+    assertOpen(id) {
+        if (this.closed)
+            throw refusal('pull', id, 'invalid-input', 'pool quota writer is closed');
+    }
+    // What read() and load() show: the stored map, then each queued reading of
+    // the row still bound to it, in arrival order through the codec's merge.
+    // A reading the codec now refuses is left out, as the flush drops it.
+    overlayRow(row) {
+        let next = row;
+        for (const publication of this.pending.get(row.id) ?? []) {
+            try {
+                assertQuotaRow(row.id, publication.attribution, row);
+                next = {
+                    ...next,
+                    quota: mergedQuota(this.rt.ctx, row.id, next.quota, publication.observation),
+                    needsFirstReading: false,
+                };
+            }
+            catch { }
+        }
+        return next;
+    }
+    overlay(rows) {
+        return rows.map((row) => this.overlayRow(row));
+    }
+    schedule(delay) {
+        if (this.running || this.timer || !this.pending.size || this.stopped)
+            return;
+        this.timer = setTimeout(() => {
+            this.timer = undefined;
+            this.flush();
+        }, delay);
+        if (!this.closed)
+            this.timer.unref?.();
+    }
+    // Starts a flush now rather than at the coalescing timer or retry backoff;
+    // a flush already running is left to finish.
+    flushNow() {
+        if (this.running)
+            return;
+        clearTimeout(this.timer);
+        this.timer = undefined;
+        this.flush();
+    }
+    flush() {
+        if (this.running || this.stopped || !this.pending.size)
+            return;
+        // Every queued reading, each row's in arrival order.
+        const batch = [...this.pending.values()].flat();
+        // Short lock attempts allow retries to pick up freshly queued readings and
+        // bound shutdown even when the normal store acquisition budget is long.
+        const ctx = {
+            ...this.rt.ctx,
+            storeLocks: this.rt.ctx.storeLocks.map((spec) => ({
+                ...spec,
+                timeoutMs: Math.min(spec.timeoutMs ?? this.rt.ctx.lockDefaults.timeoutMs, 100),
+            })),
+        };
+        const locks = new LockStack(ctx.lockDefaults, ctx.lockEnv);
+        this.running = (async () => {
+            try {
+                await withTransaction(ctx, locks, { writes: 0 }, { operation: 'pull', rowId: undefined }, async (tx) => {
+                    if (this.stopped)
+                        return;
+                    let changed = false;
+                    for (const publication of batch) {
+                        const { id, attribution, observation } = publication;
+                        const witness = JSON.stringify([
+                            id,
+                            attribution.credentialEpoch,
+                            attribution.identity,
+                        ]);
+                        try {
+                            tx.assertNotStaged(id);
+                            assertQuotaRow(id, attribution, tx.row(id));
+                        }
+                        catch (error) {
+                            if (!(error instanceof PoolOperationError))
+                                throw error;
+                            if (!this.warned.has(witness)) {
+                                this.warned.add(witness);
+                                this.warn('pool quota publication dropped; account binding changed', { id, kind: error.kind });
+                            }
+                            continue;
+                        }
+                        const entry = tx.entry(id);
+                        if (!entry)
+                            continue;
+                        let quota;
+                        try {
+                            quota = mergedQuota(ctx, id, entry.quota, observation);
+                        }
+                        catch (error) {
+                            // The codec accepted this reading when it was queued, but not
+                            // against what is stored now (another writer changed it).
+                            // Drop only this reading: failing the transaction would retry
+                            // the same refusal forever and hold back every other row.
+                            const key = `codec:${witness}`;
+                            if (!this.warned.has(key)) {
+                                this.warned.add(key);
+                                this.warn('pool quota publication dropped; the quota codec refused it', {
+                                    id,
+                                    error: error instanceof Error ? error.message : String(error),
+                                });
+                            }
+                            continue;
+                        }
+                        tx.setEntry(id, { ...entry, quota, needsFirstReading: false });
+                        changed = true;
+                    }
+                    if (changed && !this.stopped)
+                        await tx.commitConfig();
+                }, { completeTorn: false });
+                const flushed = new Set(batch);
+                for (const [id, queue] of this.pending) {
+                    const rest = queue.filter((publication) => !flushed.has(publication));
+                    if (rest.length)
+                        this.pending.set(id, rest);
+                    else
+                        this.pending.delete(id);
+                }
+                this.failures = 0;
+            }
+            catch (error) {
+                if (!this.stopped && this.failures++ === 0)
+                    this.warn('pool quota publication delayed; retrying', {
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                // Retain the mailbox on failure, including fresher readings queued meanwhile.
+            }
+            finally {
+                await locks.releaseAll();
+                this.running = undefined;
+                for (const wake of this.wake)
+                    wake();
+                const delay = this.failures
+                    ? Math.min(5_000, 100 * 2 ** Math.min(this.failures, 6)) *
+                        (0.5 + Math.random())
+                    : COALESCE_MS;
+                this.schedule(delay);
+            }
+        })();
+    }
+    warn(message, data) {
+        try {
+            this.logger.warn(message, data);
+        }
+        catch {
+            /* Logging cannot stop publication. */
+        }
+    }
+    close() {
+        if (this.closing)
+            return this.closing;
+        this.closed = true;
+        this.closing = this.drain();
+        return this.closing;
+    }
+    async drain() {
+        clearTimeout(this.timer);
+        this.timer = undefined;
+        let deadline;
+        let wake;
+        const drained = new Promise((done) => {
+            wake = () => {
+                if (!this.pending.size)
+                    done();
+            };
+            this.wake.add(wake);
+            wake();
+        });
+        try {
+            this.flush();
+            await Promise.race([
+                drained,
+                new Promise((done) => {
+                    deadline = setTimeout(done, Math.max(0, this.timeoutMs));
+                }),
+            ]);
+        }
+        finally {
+            this.stopped = true;
+            clearTimeout(deadline);
+            clearTimeout(this.timer);
+            this.wake.delete(wake);
+            if (this.pending.size)
+                this.warn('pool quota drain timed out; pending readings left', {
+                    accounts: this.pending.size,
+                    readings: [...this.pending.values()].reduce((sum, queue) => sum + queue.length, 0),
+                });
+            this.pending.clear();
+            // A reading waiting for room in a full queue is refused as closed when
+            // the drain ends, not when its own lock budget runs out.
+            for (const wake of this.wake)
+                wake();
+        }
+    }
+}

package/src/tui-compiled/raw/shared/e1c5e56df0ba4053-pending.js

@@ -0,0 +1,48 @@
+// Use the same independently dated parts as mergeQuotaObservation. A header
+// reading cannot erase a poll-only window, counter, credits record or budget.
+export function quotaFields(publication, witness = '') {
+    const result = new Map();
+    const { observation } = publication;
+    const add = (key, at, part) => result.set(`${witness}:${key}`, {
+        at,
+        order: 0,
+        publication: { ...publication, observation: part },
+    });
+    const keyFor = (scope, label) => JSON.stringify([scope ?? 'all', label]);
+    const read = new Set();
+    for (const reading of observation.readings ?? []) {
+        const key = keyFor(reading.scope, reading.label);
+        read.add(key);
+        add(key, observation.checkedAt, {
+            checkedAt: observation.checkedAt,
+            readings: [{ ...reading }],
+        });
+    }
+    for (const pair of observation.coverage ?? []) {
+        const key = keyFor(pair.scope, pair.label);
+        if (!read.has(key))
+            add(key, observation.checkedAt, {
+                checkedAt: observation.checkedAt,
+                coverage: [{ ...pair }],
+            });
+    }
+    if (observation.budget)
+        add('budget', observation.checkedAt, {
+            checkedAt: observation.checkedAt,
+            budget: { ...observation.budget },
+        });
+    for (const [name, counter] of Object.entries(observation.counters ?? {})) {
+        add(`counter:${name}`, counter.checkedAt, {
+            checkedAt: observation.checkedAt,
+            counters: { [name]: { ...counter } },
+        });
+    }
+    if (observation.credits)
+        add('credits', observation.credits.checkedAt, {
+            checkedAt: observation.checkedAt,
+            credits: { ...observation.credits },
+        });
+    if (!result.size)
+        add('empty', observation.checkedAt, { checkedAt: observation.checkedAt });
+    return result;
+}

package/src/tui-compiled/runtime/shared/81dddd203f1b92a3-quota-writer.js

@@ -1,6 +1,7 @@
 import { resolve } from "node:path";
 import { createLogger } from "./cc9e0702a752cea7-index.js";
 import { isQuotaObservation } from "./d5a8f1061ee2f114-index.js";
+import { quotaFields } from "./e1c5e56df0ba4053-pending.js";
 import { applyVaultQuota, mutateVaultRoster, } from "./30f5bc480f31f51c-roster.js";
 // Every consumer of the same file shares one mailbox and one lock waiter.
 const writers = new Map();
@@ -34,65 +35,14 @@ export function retainVaultQuotaWriter(path, listener) {
         return writer.listeners.size ? Promise.resolve() : drainVaultQuota(path);
     })());
 }
-// Split one observation into its independently dated parts: each rate-limit
-// window (scope and label), each covered-but-unread window, the budget, each
-// counter and the credits record. The mailbox keeps the newest of each part on
-// its own, so a later observation that carries only some parts can't erase an
-// older but still newest reading of another part, which is how
-// mergeQuotaObservation treats them on disk. Each key also carries the
-// receipt's identity, so the identity fence still applies to every part.
+// Each field retains the receipt fence as well as its independent timestamp.
 function fields(publication) {
-    const result = new Map();
-    const { observation } = publication;
-    const witness = JSON.stringify([
+    return quotaFields(publication, JSON.stringify([
         publication.routeId,
         publication.receipt?.credentialId,
         publication.receipt?.accountIdentitySource,
         publication.receipt?.expectedAccountIdentity,
-    ]);
-    const add = (key, at, part) => result.set(`${witness}:${key}`, {
-        at,
-        order: 0,
-        publication: { ...publication, observation: part },
-    });
-    const keyFor = (scope, label) => JSON.stringify([scope ?? 'all', label]);
-    const read = new Set();
-    for (const reading of observation.readings ?? []) {
-        const key = keyFor(reading.scope, reading.label);
-        read.add(key);
-        add(key, observation.checkedAt, {
-            checkedAt: observation.checkedAt,
-            readings: [{ ...reading }],
-        });
-    }
-    for (const pair of observation.coverage ?? []) {
-        const key = keyFor(pair.scope, pair.label);
-        if (!read.has(key))
-            add(key, observation.checkedAt, {
-                checkedAt: observation.checkedAt,
-                coverage: [{ ...pair }],
-            });
-    }
-    if (observation.budget)
-        add('budget', observation.checkedAt, {
-            checkedAt: observation.checkedAt,
-            budget: { ...observation.budget },
-        });
-    for (const [name, counter] of Object.entries(observation.counters ?? {})) {
-        add(`counter:${name}`, counter.checkedAt, {
-            checkedAt: observation.checkedAt,
-            counters: { [name]: { ...counter } },
-        });
-    }
-    if (observation.credits)
-        add('credits', observation.credits.checkedAt, {
-            checkedAt: observation.checkedAt,
-            credits: { ...observation.credits },
-        });
-    // Even an empty observation can bind an account proved by its receipt.
-    if (!result.size)
-        add('empty', observation.checkedAt, { checkedAt: observation.checkedAt });
-    return result;
+    ]));
 }
 /** Enqueue without filesystem work; each quota field retains its own receipt fence. */
 export function enqueueVaultQuota(path, publication) {

package/src/tui-compiled/runtime/shared/a62a27a204266acd-attribution.js

@@ -1,8 +1,41 @@
 import { PoolOperationError } from "./04a6357627de5ed0-errors.js";
-import { toFailure, withTransaction } from "./458b934e92490331-mutate.js";
+import { toFailure, withTransaction, } from "./458b934e92490331-mutate.js";
 import { LockStack } from "./43fc9e6b994519c7-refresh-lock.js";
 import { refusal, requireBound, unknownRow, } from "./83bc3ba9d0fe2761-runtime.js";
 import { isCredentialEpoch } from "./cd94316a888b0a8e-schema.js";
+export function assertQuotaEpoch(id, attribution) {
+    if (!isCredentialEpoch(attribution?.credentialEpoch))
+        throw refusal('pull', id, 'invalid-input', 'the credential epoch the reading was issued for must be a positive safe integer');
+}
+// Shared by preflight and the locked commit: accepting into memory must never
+// hide a refusal the immediate writer would have returned to its caller.
+export function assertQuotaRow(id, attribution, row) {
+    if (!row)
+        throw unknownRow('pull', id);
+    if (row.invalid)
+        throw refusal('pull', id, 'invalid-row', `row ${id} is invalid`);
+    if (!row.credential)
+        throw refusal('pull', id, 'no-credential', `row ${id} holds no credential`);
+    requireBound('pull', row);
+    if (row.torn ||
+        !row.hasEntry ||
+        row.credentialEpoch !== attribution.credentialEpoch ||
+        row.identity !== attribution.identity)
+        throw new PoolOperationError({
+            operation: 'pull',
+            rowId: id,
+            phase: 'pull',
+            retryable: true,
+            kind: 'attribution',
+            message: `quota for ${id} was issued for a credential the row no longer holds`,
+        });
+}
+export function mergedQuota(ctx, id, stored, observation) {
+    const merged = ctx.codec.merge(stored, observation);
+    if (!ctx.codec.validate(merged))
+        throw refusal('pull', id, 'invalid-quota', 'the quota codec rejected the merged map');
+    return merged;
+}
 /**
  * Merges a quota observation into a row's stored map under the store locks,
  * after attribution passes. Needs no row lock, so it is permitted from
@@ -13,37 +46,18 @@ export async function recordQuota(rt, id, attribution, observation) {
     const locks = new LockStack(ctx.lockDefaults, ctx.lockEnv);
     const progress = { writes: 0 };
     try {
-        if (!isCredentialEpoch(attribution?.credentialEpoch))
-            throw refusal('pull', id, 'invalid-input', 'the credential epoch the reading was issued for must be a positive safe integer');
+        assertQuotaEpoch(id, attribution);
         await withTransaction(ctx, locks, progress, { operation: 'pull', rowId: id }, async (tx) => {
             tx.assertNotStaged(id);
             const row = tx.row(id);
-            if (!row)
-                throw unknownRow('pull', id);
-            if (row.invalid)
-                throw refusal('pull', id, 'invalid-row', `row ${id} is invalid`);
             // A reading belongs to one (epoch, identity, credential). A row
             // holding no credential, or torn between the writes of a replace,
             // has no such triple on disk, so no reading is recorded for it.
-            if (!row.credential)
-                throw refusal('pull', id, 'no-credential', `row ${id} holds no credential`);
-            requireBound('pull', row);
+            assertQuotaRow(id, attribution, row);
             const entry = tx.entry(id);
-            if (row.torn ||
-                !entry ||
-                entry.credentialEpoch !== attribution.credentialEpoch ||
-                row.identity !== attribution.identity)
-                throw new PoolOperationError({
-                    operation: 'pull',
-                    rowId: id,
-                    phase: 'pull',
-                    retryable: true,
-                    kind: 'attribution',
-                    message: `quota for ${id} was issued for a credential the row no longer holds`,
-                });
-            const merged = ctx.codec.merge(entry.quota, observation);
-            if (!ctx.codec.validate(merged))
-                throw refusal('pull', id, 'invalid-quota', 'the quota codec rejected the merged map');
+            if (!entry)
+                throw unknownRow('pull', id);
+            const merged = mergedQuota(ctx, id, entry.quota, observation);
             tx.setEntry(id, { ...entry, quota: merged, needsFirstReading: false });
             await tx.commitConfig();
         }, 

package/src/tui-compiled/runtime/shared/a910277ac43a8626-pull.js

@@ -105,7 +105,9 @@ export class PullScheduler {
                     cause,
                 });
             }
-            await recordQuota(rt, id, {
+            const publish = rt.publishQuota ??
+                ((rowId, attribution, value) => recordQuota(rt, rowId, attribution, value));
+            await publish(id, {
                 credentialEpoch: request.credentialEpoch,
                 ...(request.identity !== undefined
                     ? { identity: request.identity }

package/src/tui-compiled/runtime/shared/c852a15cfe489d12-pool.js

@@ -3,6 +3,7 @@ import { initializePool, readPool, } from "./458b934e92490331-mutate.js";
 import { updateProviderStateRow, } from "./97484d9bb98c705b-provider-state.js";
 import { publication, publishRoster, } from "./83068c0dbe8a6f13-publication.js";
 import { PullScheduler } from "./a910277ac43a8626-pull.js";
+import { PoolQuotaWriter } from "./c911dbb64c9d85c7-quota-writer.js";
 import { refreshRow, } from "./9d3fc9e37456504e-refresh.js";
 import { POOL_LOCK_DEFAULTS, } from "./43fc9e6b994519c7-refresh-lock.js";
 import { addRow, disableRow, enableRow, recordRowIdentity, removeRow, reorderRows, replaceRow, rotateRow, } from "./fe02abeadc535f77-rows.js";
@@ -80,9 +81,21 @@ export function openPoolStore(options) {
         rowLockOptions: options.rowLockOptions ?? {},
         firePull: (id, reason) => pulls.fire(id, reason),
     };
+    const quotaWriter = options.coalesceQuota
+        ? new PoolQuotaWriter(rt, options.quotaDrainTimeoutMs)
+        : undefined;
+    const record = (id, attribution, observation) => quotaWriter
+        ? quotaWriter.record(id, attribution, observation)
+        : recordQuota(rt, id, attribution, observation);
+    rt.publishQuota = record;
+    const overlay = (result) => {
+        if (result.status === 'ready' && quotaWriter)
+            return { ...result, rows: quotaWriter.overlay(result.rows) };
+        return result;
+    };
     return {
         async load() {
-            const result = await readPool(ctx);
+            const result = overlay(await readPool(ctx));
             if (result.status === 'ready') {
                 // A torn row is no candidate, but its pull is fired too: the pull
                 // completes the row on disk before reading it, so an interrupted
@@ -96,7 +109,7 @@ export function openPoolStore(options) {
             return toLoad(result);
         },
         async read() {
-            return toLoad(await readPool(ctx));
+            return toLoad(overlay(await readPool(ctx)));
         },
         async initialize(input = {}) {
             return { status: await initializePool(ctx, input.dropKeys ?? []) };
@@ -115,7 +128,9 @@ export function openPoolStore(options) {
         updateSettings: (mutator, callOptions) => updatePoolSettings(rt, mutator, callOptions),
         recordIdentity: (id, identity, attribution, callOptions) => recordRowIdentity(rt, id, identity, attribution, callOptions),
         refresh: (id, provider, callOptions) => refreshRow(rt, id, provider, callOptions),
-        recordQuota: (id, attribution, observation) => recordQuota(rt, id, attribution, observation),
+        recordQuota: record,
+        close: () => quotaWriter?.close() ?? Promise.resolve(),
+        dispose: () => quotaWriter?.close() ?? Promise.resolve(),
         requestReading: (id) => pulls.fire(id, 'admission'),
         pullsSettled: () => pulls.settled(),
     };