@whittlelabs/sifter 0.30.10 → 0.30.11

package/bin.js

@@ -11277,6 +11277,167 @@ var require_rate_limited = __commonJS({
   }
 });
 
+// ../../packages/keep/dist/exchange.js
+var require_exchange = __commonJS({
+  "../../packages/keep/dist/exchange.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.KeepUnavailableError = void 0;
+    exports2.exchangeCredentials = exchangeCredentials;
+    exports2.hostOf = hostOf;
+    var rate_limited_1 = require_rate_limited();
+    var KeepUnavailableError = class extends Error {
+      code = "SERVICE_UNAVAILABLE";
+      /** Host the exchange was sent to, so a log line names the service that is down. */
+      host;
+      /** The status whatever answered sent, or null when nothing answered at all. */
+      statusCode;
+      constructor(message, detail) {
+        super(message, detail.cause !== void 0 ? { cause: detail.cause } : void 0);
+        this.name = "KeepUnavailableError";
+        this.host = detail.host;
+        this.statusCode = detail.statusCode;
+      }
+    };
+    exports2.KeepUnavailableError = KeepUnavailableError;
+    async function exchangeCredentials(request) {
+      const { manager, url } = request;
+      const host = hostOf(url);
+      let response;
+      try {
+        response = await fetch(url, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            clientId: request.clientId,
+            clientSecret: request.clientSecret
+          })
+        });
+      } catch (err) {
+        throw new KeepUnavailableError(`[${manager}] could not reach Keep at ${host}: ${describeTransportError(err)}`, { host, statusCode: null, cause: err });
+      }
+      request.onResponse?.(response);
+      const text = await response.text().catch(() => "");
+      let json;
+      try {
+        json = JSON.parse(text);
+      } catch {
+        json = null;
+      }
+      if (response.status >= 500) {
+        const reason = json?.error?.message ?? `${request.exchangeName} failed with status ${response.status}`;
+        throw new KeepUnavailableError(`[${manager}] Keep at ${host} is unavailable (${response.status}): ${reason}`, { host, statusCode: response.status });
+      }
+      if (response.status === 429) {
+        throw request.rateLimit.close({
+          manager,
+          host,
+          reason: json?.error?.message ?? "Too Many Requests",
+          retryAfterMs: (0, rate_limited_1.retryAfterMsOf)(json, response.headers)
+        });
+      }
+      if (json === null) {
+        throw new Error(`[${manager}] Keep at ${host} answered ${response.status} with a body that is not JSON`);
+      }
+      if (!response.ok || !json.success) {
+        const msg = json.error?.message ?? `${request.exchangeName} failed with status ${response.status}`;
+        if (response.status === 401 && request.refused) {
+          throw request.refused(msg);
+        }
+        throw new Error(`[${manager}] ${msg}`);
+      }
+      return json.data;
+    }
+    function hostOf(url) {
+      try {
+        return new URL(url).host;
+      } catch {
+        return url;
+      }
+    }
+    function describeTransportError(err) {
+      if (err instanceof Error) {
+        const cause = err.cause;
+        if (cause instanceof Error && cause.message && cause.message !== err.message) {
+          return `${err.message}: ${cause.message}`;
+        }
+        return err.message;
+      }
+      return String(err);
+    }
+  }
+});
+
+// ../../packages/keep/dist/wait-for-token.js
+var require_wait_for_token = __commonJS({
+  "../../packages/keep/dist/wait-for-token.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.waitForKeepToken = waitForKeepToken;
+    var WAIT_FOR_TOKEN_MAX_MS = 20 * 6e4;
+    var INITIAL_DELAY_MS = 1e3;
+    var MAX_DELAY_MS = 3e4;
+    async function waitForKeepToken(getToken, options) {
+      const logger = options.logger ?? console;
+      const initialDelay = options.initialDelayMs ?? INITIAL_DELAY_MS;
+      const maxDelay = options.maxDelayMs ?? MAX_DELAY_MS;
+      const started = Date.now();
+      const deadline = started + (options.maxWaitMs ?? WAIT_FOR_TOKEN_MAX_MS);
+      const tag = `[${options.label}]`;
+      let delay = initialDelay;
+      let waiting = null;
+      for (; ; ) {
+        let pause;
+        try {
+          const token = await getToken();
+          if (waiting !== null) {
+            logger.info(`${tag} Keep issued a token after ${formatDuration(Date.now() - started)} of waiting`);
+          }
+          return token;
+        } catch (err) {
+          if (isRateLimited(err)) {
+            pause = Math.max(0, err.retryAfterMs);
+            delay = initialDelay;
+            if (waiting !== "rate-limited") {
+              waiting = "rate-limited";
+              logger.warn(`${tag} Keep is rate limiting this client's token exchange (${err.message}). The credentials are not in question; waiting ${formatDuration(pause)} to ask again.`);
+            }
+          } else if (isUnavailable(err)) {
+            pause = delay;
+            delay = Math.min(delay * 2, maxDelay);
+            if (waiting !== "unavailable") {
+              waiting = "unavailable";
+              logger.warn(`${tag} Keep is unavailable (${err.message}); retrying with backoff.`);
+            }
+          } else {
+            throw err;
+          }
+          if (Date.now() + pause > deadline) {
+            logger.error(`${tag} giving up on a Keep token after ${formatDuration(Date.now() - started)}: ${err.message}`);
+            throw err;
+          }
+        }
+        await new Promise((resolve) => setTimeout(resolve, pause));
+      }
+    }
+    function isRateLimited(err) {
+      const e = err;
+      return e?.code === "RATE_LIMITED" && typeof e.retryAfterMs === "number";
+    }
+    function isUnavailable(err) {
+      return err?.code === "SERVICE_UNAVAILABLE";
+    }
+    function formatDuration(ms) {
+      const s = Math.round(ms / 1e3);
+      if (s < 60)
+        return `${s}s`;
+      const m = Math.floor(s / 60);
+      const rest = s % 60;
+      return rest === 0 ? `${m}m` : `${m}m${rest}s`;
+    }
+  }
+});
+
 // ../../packages/keep/dist/service-token.js
 var require_service_token = __commonJS({
   "../../packages/keep/dist/service-token.js"(exports2) {
@@ -11284,6 +11445,8 @@ var require_service_token = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.ServiceTokenManager = void 0;
     var rate_limited_1 = require_rate_limited();
+    var exchange_1 = require_exchange();
+    var wait_for_token_1 = require_wait_for_token();
     var ServiceTokenManager = class {
       token = null;
       expiresAt = 0;
@@ -11308,6 +11471,14 @@ var require_service_token = __commonJS({
       /**
        * Returns a valid service token, refreshing if needed.
        * Returns null if Keep credentials are not configured (graceful degradation for local dev).
+       *
+       * Throws `KeepUnavailableError` when Keep did not answer or answered 5xx,
+       * `KeepRateLimitedError` when Keep's exchange limiter locked this client out
+       * (and, until the time Keep named, without asking again), and a plain `Error`
+       * for any other refusal, a 401 above all. A refresh that fails for either
+       * of the first two reasons while the cached token has not yet expired
+       * answers with the cached token instead: the refresh starts 30s early
+       * precisely so a failed one costs nothing.
        */
       async getToken() {
         if (!this.enabled)
@@ -11318,52 +11489,51 @@ var require_service_token = __commonJS({
         if (this.pendingExchange) {
           return this.pendingExchange;
         }
-        this.rateLimit.check();
-        this.pendingExchange = this.exchange();
+        this.pendingExchange = this.refresh();
         try {
           return await this.pendingExchange;
         } finally {
           this.pendingExchange = null;
         }
       }
+      /**
+       * `getToken`, for a service that cannot start without a token: waits out a
+       * rate limit (for the time Keep named) and an outage (with backoff), bounded
+       * by `maxWaitMs` (20 minutes by default, one full lockout and change), and
+       * throws a refusal at once. See `waitForKeepToken`.
+       */
+      waitForToken(options) {
+        return (0, wait_for_token_1.waitForKeepToken)(() => this.getToken(), options);
+      }
+      async refresh() {
+        try {
+          this.rateLimit.check();
+          return await this.exchange();
+        } catch (err) {
+          const code = err?.code;
+          if (this.token && Date.now() < this.expiresAt - STALE_MARGIN_MS && (code === "SERVICE_UNAVAILABLE" || code === "RATE_LIMITED")) {
+            return this.token;
+          }
+          throw err;
+        }
+      }
       async exchange() {
-        const url = `${this.keepApiUrl}/api/service-tokens`;
-        const response = await fetch(url, {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({
-            clientId: this.clientId,
-            clientSecret: this.clientSecret
-          })
+        const data = await (0, exchange_1.exchangeCredentials)({
+          manager: "ServiceTokenManager",
+          url: `${this.keepApiUrl}/api/service-tokens`,
+          clientId: this.clientId,
+          clientSecret: this.clientSecret,
+          rateLimit: this.rateLimit,
+          onResponse: this.onResponse,
+          exchangeName: "Token exchange"
         });
-        this.onResponse?.(response);
-        if (response.status === 429) {
-          const body = await response.json().catch(() => null);
-          throw this.rateLimit.close({
-            manager: "ServiceTokenManager",
-            host: hostOf(url),
-            reason: body?.error?.message ?? "Too Many Requests",
-            retryAfterMs: (0, rate_limited_1.retryAfterMsOf)(body, response.headers)
-          });
-        }
-        const json = await response.json();
-        if (!response.ok || !json.success) {
-          const msg = json.error?.message ?? `Token exchange failed with status ${response.status}`;
-          throw new Error(`[ServiceTokenManager] ${msg}`);
-        }
-        this.token = json.data.token;
-        this.expiresAt = Date.now() + json.data.expiresIn * 1e3;
+        this.token = data.token;
+        this.expiresAt = Date.now() + data.expiresIn * 1e3;
         return this.token;
       }
     };
     exports2.ServiceTokenManager = ServiceTokenManager;
-    function hostOf(url) {
-      try {
-        return new URL(url).host;
-      } catch {
-        return url;
-      }
-    }
+    var STALE_MARGIN_MS = 5e3;
   }
 });
 
@@ -11372,8 +11542,9 @@ var require_agent_token = __commonJS({
   "../../packages/keep/dist/agent-token.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.AgentTokenManager = exports2.KeepUnavailableError = exports2.AgentCredentialRevokedError = void 0;
+    exports2.AgentTokenManager = exports2.AgentCredentialRevokedError = void 0;
     var rate_limited_1 = require_rate_limited();
+    var exchange_1 = require_exchange();
     var AgentCredentialRevokedError2 = class extends Error {
       code = "PAIRING_REVOKED";
       constructor(message) {
@@ -11382,20 +11553,6 @@ var require_agent_token = __commonJS({
       }
     };
     exports2.AgentCredentialRevokedError = AgentCredentialRevokedError2;
-    var KeepUnavailableError = class extends Error {
-      code = "SERVICE_UNAVAILABLE";
-      /** Host the exchange was sent to, so a log line names the service that is down. */
-      host;
-      /** The status whatever answered sent, or null when nothing answered at all. */
-      statusCode;
-      constructor(message, detail) {
-        super(message, detail.cause !== void 0 ? { cause: detail.cause } : void 0);
-        this.name = "KeepUnavailableError";
-        this.host = detail.host;
-        this.statusCode = detail.statusCode;
-      }
-    };
-    exports2.KeepUnavailableError = KeepUnavailableError;
     var AgentTokenManager = class {
       token = null;
       expiresAt = 0;
@@ -11432,74 +11589,22 @@ var require_agent_token = __commonJS({
         }
       }
       async exchange() {
-        const url = `${this.keepApiUrl}/api/agent-tokens`;
-        const host = hostOf(url);
-        let response;
-        try {
-          response = await fetch(url, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({
-              clientId: this.clientId,
-              clientSecret: this.clientSecret
-            })
-          });
-        } catch (err) {
-          throw new KeepUnavailableError(`[AgentTokenManager] could not reach Keep at ${host}: ${describeTransportError(err)}`, { host, statusCode: null, cause: err });
-        }
-        this.onResponse?.(response);
-        const text = await response.text().catch(() => "");
-        let json;
-        try {
-          json = JSON.parse(text);
-        } catch {
-          json = null;
-        }
-        if (response.status >= 500) {
-          const reason = json?.error?.message ?? `Agent token exchange failed with status ${response.status}`;
-          throw new KeepUnavailableError(`[AgentTokenManager] Keep at ${host} is unavailable (${response.status}): ${reason}`, { host, statusCode: response.status });
-        }
-        if (response.status === 429) {
-          throw this.rateLimit.close({
-            manager: "AgentTokenManager",
-            host,
-            reason: json?.error?.message ?? "Too Many Requests",
-            retryAfterMs: (0, rate_limited_1.retryAfterMsOf)(json, response.headers)
-          });
-        }
-        if (json === null) {
-          throw new Error(`[AgentTokenManager] Keep at ${host} answered ${response.status} with a body that is not JSON`);
-        }
-        if (!response.ok || !json.success) {
-          const msg = json.error?.message ?? `Agent token exchange failed with status ${response.status}`;
-          if (response.status === 401) {
-            throw new AgentCredentialRevokedError2(`[AgentTokenManager] Keep refused this agent's credentials (401): the pairing was revoked or the secret rotated. Re-pair to continue.`);
-          }
-          throw new Error(`[AgentTokenManager] ${msg}`);
-        }
-        this.token = json.data.token;
-        this.expiresAt = Date.now() + json.data.expiresIn * 1e3;
+        const data = await (0, exchange_1.exchangeCredentials)({
+          manager: "AgentTokenManager",
+          url: `${this.keepApiUrl}/api/agent-tokens`,
+          clientId: this.clientId,
+          clientSecret: this.clientSecret,
+          rateLimit: this.rateLimit,
+          onResponse: this.onResponse,
+          exchangeName: "Agent token exchange",
+          refused: () => new AgentCredentialRevokedError2(`[AgentTokenManager] Keep refused this agent's credentials (401): the pairing was revoked or the secret rotated. Re-pair to continue.`)
+        });
+        this.token = data.token;
+        this.expiresAt = Date.now() + data.expiresIn * 1e3;
         return this.token;
       }
     };
     exports2.AgentTokenManager = AgentTokenManager;
-    function hostOf(url) {
-      try {
-        return new URL(url).host;
-      } catch {
-        return url;
-      }
-    }
-    function describeTransportError(err) {
-      if (err instanceof Error) {
-        const cause = err.cause;
-        if (cause instanceof Error && cause.message && cause.message !== err.message) {
-          return `${err.message}: ${cause.message}`;
-        }
-        return err.message;
-      }
-      return String(err);
-    }
   }
 });
 
@@ -11508,7 +11613,7 @@ var require_dist2 = __commonJS({
   "../../packages/keep/dist/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.KeepRateLimitedError = exports2.KeepUnavailableError = exports2.AgentCredentialRevokedError = exports2.AgentTokenManager = exports2.ServiceTokenManager = exports2.KeepClient = void 0;
+    exports2.waitForKeepToken = exports2.KeepRateLimitedError = exports2.KeepUnavailableError = exports2.AgentCredentialRevokedError = exports2.AgentTokenManager = exports2.ServiceTokenManager = exports2.KeepClient = void 0;
     var client_1 = require_client();
     Object.defineProperty(exports2, "KeepClient", { enumerable: true, get: function() {
       return client_1.KeepClient;
@@ -11524,13 +11629,18 @@ var require_dist2 = __commonJS({
     Object.defineProperty(exports2, "AgentCredentialRevokedError", { enumerable: true, get: function() {
       return agent_token_1.AgentCredentialRevokedError;
     } });
+    var exchange_1 = require_exchange();
     Object.defineProperty(exports2, "KeepUnavailableError", { enumerable: true, get: function() {
-      return agent_token_1.KeepUnavailableError;
+      return exchange_1.KeepUnavailableError;
     } });
     var rate_limited_1 = require_rate_limited();
     Object.defineProperty(exports2, "KeepRateLimitedError", { enumerable: true, get: function() {
       return rate_limited_1.KeepRateLimitedError;
     } });
+    var wait_for_token_1 = require_wait_for_token();
+    Object.defineProperty(exports2, "waitForKeepToken", { enumerable: true, get: function() {
+      return wait_for_token_1.waitForKeepToken;
+    } });
   }
 });
 
@@ -26751,7 +26861,7 @@ var import_path = require("path");
 var import_promises = require("fs/promises");
 var import_yaml = __toESM(require_dist3());
 var import_shuttle = __toESM(require_dist5());
-var buildVersion = true ? "0.30.10" : pkg.version;
+var buildVersion = true ? "0.30.11" : pkg.version;
 var sifterBrand = {
   product: {
     id: "sifter",