@zixt/host 0.0.8 → 0.0.9

package/dist/index.js

@@ -31,7 +31,7 @@ import { homedir } from "node:os";
 // package.json
 var package_default = {
   name: "@zixt/host",
-  version: "0.0.8",
+  version: "0.0.9",
   type: "module",
   exports: {
     ".": "./src/client.ts",
@@ -15272,6 +15272,12 @@ var HostTelemetry = external_exports.object({
      * recovery path; this is deliberately not inferred from package version.
      */
     taskAuthorityLifecycle: external_exports.literal(true).optional(),
+    /**
+     * Understands structured provider-operation retry responses and can
+     * wait cancellably before repeating the same logical request. Missing
+     * legacy Hosts must receive the original strict refusal frame.
+     */
+    providerOperationGrantRetry: external_exports.literal(true).optional(),
     linearToolPack: external_exports.boolean().default(false),
     providerToolPacks: external_exports.array(ProviderToolPackCapability).max(20).superRefine((capabilities, ctx) => {
       const providers = capabilities.map(({ provider }) => provider);
@@ -15412,12 +15418,37 @@ var HostRequiredIntegrationSummary = external_exports.object({
   failedCount: external_exports.number().int().min(0),
   unknownCount: external_exports.number().int().min(0)
 });
+var HostQueuedTaskDetail = external_exports.object({
+  id: TaskId,
+  title: external_exports.string().min(1).max(300),
+  agentName: external_exports.string().min(1).max(120),
+  runnerType: RunnerType,
+  placement: external_exports.enum([
+    "ready_here",
+    "ready_elsewhere",
+    "blocked_everywhere",
+    "assigned_elsewhere",
+    "evaluation_unknown"
+  ]),
+  placementReason: external_exports.string().min(1).max(2e3),
+  eligibleMachineCount: external_exports.number().int().min(0),
+  /** A bounded preview; eligibleMachineCount remains exact when this is truncated. */
+  eligibleMachineNames: external_exports.array(external_exports.string().min(1).max(120)).max(10),
+  /** Queue timing is independent from Machine placement above. */
+  queueState: external_exports.enum(["ready", "decision_pending", "waiting", "retry_due", "retry_overdue"]),
+  queueReason: external_exports.string().min(1).max(2e3),
+  retryAt: IsoDate2.nullable()
+});
 var HostWorkSummary = external_exports.object({
   activeTaskCount: external_exports.number().int().min(0),
   queuedOrgTaskCount: external_exports.number().int().min(0),
   queuedEligibleTaskCount: external_exports.number().int().min(0),
+  /** Exact count across the full relevant queue, independent of the bounded detail preview. */
+  overdueRelevantTaskCount: external_exports.number().int().min(0),
   /** Runner families used by queued Tasks that may target this Machine. */
   queuedRunnerTypes: external_exports.array(RunnerType),
+  /** Bounded attention-first queue preview with exact Admin/Owner placement evidence. */
+  queuedTaskDetails: external_exports.array(HostQueuedTaskDetail).max(10),
   eligibilityState: HostEligibilityState,
   eligibilityReason: external_exports.string().min(1).max(2e3)
 });
@@ -18133,6 +18164,30 @@ var ProviderOperationGrantRequestFrame = external_exports.discriminatedUnion("op
     }
   )
 ]);
+var ProviderOperationGrantFailureCode = external_exports.enum([
+  "provider_timeout",
+  "provider_rate_limited",
+  "provider_unavailable",
+  "provider_authority_rejected",
+  "provider_request_rejected",
+  "provider_not_found",
+  "provider_invalid_response",
+  "provider_issuance_unresolved",
+  "provider_grant_delivery_unresolved"
+]);
+var ProviderOperationGrantRetryCode = external_exports.enum([
+  "provider_timeout",
+  "provider_rate_limited",
+  "provider_unavailable",
+  "provider_invalid_response",
+  "provider_issuance_unresolved",
+  "provider_grant_delivery_unresolved"
+]);
+var ProviderOperationGrantRetry = external_exports.object({
+  code: ProviderOperationGrantRetryCode,
+  /** Never earlier than the durable claim's safe reclaim boundary. */
+  retryAt: IsoDate
+}).strict();
 var ProviderOperationGrantResultFrame = external_exports.discriminatedUnion("ok", [
   external_exports.object({
     type: external_exports.literal("provider.operation.grant.result"),
@@ -18150,7 +18205,9 @@ var ProviderOperationGrantResultFrame = external_exports.discriminatedUnion("ok"
     requestId: external_exports.string().min(1).max(200),
     ok: external_exports.literal(false),
     grant: external_exports.never().optional(),
-    error: external_exports.string().min(1).max(2e3).optional()
+    error: external_exports.string().min(1).max(2e3).optional(),
+    /** Sent only when the connected Host explicitly advertised support. */
+    retry: ProviderOperationGrantRetry.optional()
   }).strict()
 ]);
 var BrowserStateFrame = external_exports.object({
@@ -19210,6 +19267,52 @@ var GithubGrantError = class extends Error {
     this.name = `GithubGrantError:${reason}`;
   }
 };
+async function waitForOperationGrantRetry(retryAt, signal) {
+  const deadline = Date.parse(retryAt);
+  if (!Number.isFinite(deadline) || signal.aborted) return false;
+  if (deadline <= Date.now()) return true;
+  return await new Promise((resolve13) => {
+    let settled = false;
+    let timer;
+    const finish = (ready) => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      signal.removeEventListener("abort", onAbort);
+      resolve13(ready);
+    };
+    const onAbort = () => finish(false);
+    const schedule = () => {
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) {
+        finish(true);
+        return;
+      }
+      timer = setTimeout(schedule, Math.min(remaining, 2147e6));
+      timer.unref?.();
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    if (signal.aborted) {
+      finish(false);
+      return;
+    }
+    schedule();
+  });
+}
+function operationGrantRetryCause(code) {
+  if (code === "provider_timeout") return "GitHub did not answer the credential request in time";
+  if (code === "provider_rate_limited") return "GitHub rate-limited the credential request";
+  if (code === "provider_invalid_response") {
+    return "GitHub returned an invalid credential response";
+  }
+  if (code === "provider_issuance_unresolved") {
+    return "GitHub credential issuance is still unresolved";
+  }
+  if (code === "provider_grant_delivery_unresolved") {
+    return "Zixt is waiting for a previously issued GitHub credential to expire before retrying delivery";
+  }
+  return "GitHub is temporarily unavailable for credential issuance";
+}
 var HostClient = class _HostClient {
   constructor(opts) {
     this.opts = opts;
@@ -19887,7 +19990,13 @@ var HostClient = class _HostClient {
         if (!frame.ok) {
           clearTimeout(waiter.timer);
           this.operationGrantWaiters.delete(frame.requestId);
-          waiter.deny(false, "refused_by_zixt", frame.error);
+          waiter.deny(
+            frame.retry !== void 0,
+            "refused_by_zixt",
+            frame.error,
+            frame.retry?.retryAt,
+            frame.retry?.code
+          );
           return;
         }
         const { grant } = frame;
@@ -19977,6 +20086,7 @@ var HostClient = class _HostClient {
         capabilities: {
           ...measuredCapabilities,
           linearToolPack: measured.capabilities?.linearToolPack ?? false,
+          providerOperationGrantRetry: true,
           ...workerWatchdogIsActive() ? { taskAuthorityLifecycle: true } : {}
         },
         // Evidence, not configuration: the cloud says which paths matter and
@@ -20458,9 +20568,11 @@ var HostClient = class _HostClient {
         throw new Error("No GitHub change was attempted; the authority grant was not received.");
       }
       const attempts = options?.maxAttempts ?? 1;
+      let attemptBudget = attempts;
+      let structuredRetryUsed = false;
       let failureReason = "no_reply_from_zixt";
       let failureDetail;
-      for (let attempt = 0; attempt < attempts; attempt++) {
+      for (let attempt = 0; attempt < attemptBudget; attempt++) {
         if (authorityController.signal.aborted) break;
         const socket = this.ws;
         if (!socket || socket.readyState !== WebSocket.OPEN) break;
@@ -20497,7 +20609,14 @@ var HostClient = class _HostClient {
               addSensitiveValues(providerGrantSensitiveValues(grant));
               resolve13({ grant });
             },
-            deny: (retryable, reason, detail) => resolve13({ grant: null, retryable, reason, ...detail ? { detail } : {} })
+            deny: (retryable, reason, detail, retryAt, retryCode) => resolve13({
+              grant: null,
+              retryable,
+              reason,
+              ...detail ? { detail } : {},
+              ...retryAt ? { retryAt } : {},
+              ...retryCode ? { retryCode } : {}
+            })
           });
           try {
             socket.send(JSON.stringify(parsed.data));
@@ -20515,7 +20634,22 @@ var HostClient = class _HostClient {
         }
         failureReason = outcome.reason;
         failureDetail = outcome.detail;
-        if (!outcome.retryable) break;
+        const structuredRetryAt = outcome.retryAt;
+        const structuredRetryCode = outcome.retryCode;
+        const structuredRetry = structuredRetryAt !== void 0 && structuredRetryCode !== void 0;
+        if (structuredRetry && structuredRetryAt && structuredRetryCode) {
+          if (structuredRetryUsed) break;
+          structuredRetryUsed = true;
+          if (attempt + 1 >= attemptBudget) attemptBudget += 1;
+          emitEvent(
+            "status",
+            `${operationGrantRetryCause(structuredRetryCode)}. Zixt will retry automatically at ${structuredRetryAt}; no repository change was attempted.`
+          );
+        }
+        if (!outcome.retryable || attempt + 1 >= attemptBudget) break;
+        if (outcome.retryAt !== void 0 && !await waitForOperationGrantRetry(outcome.retryAt, authorityController.signal)) {
+          break;
+        }
       }
       throw new GithubGrantError(failureReason, failureDetail);
     };
@@ -27199,7 +27333,10 @@ function createGithubRepositoryCreator(input) {
             operation: "repository.clone_created",
             repositoryId: repository.repositoryId
           },
-          { maxAttempts: 1 }
+          // The request only obtains fenced credential authority; it does not
+          // repeat repository creation. A second transport probe is required
+          // to recover a cloud commit whose volatile success frame was lost.
+          { maxAttempts: 2 }
         ),
         {
           operation: "repository.clone_created",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zixt/host",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "type": "module",
   "exports": {
     ".": "./src/client.ts",