audit-tools 0.28.0

package/dist/shared/quota/copilotQuotaSource.js

@@ -0,0 +1,141 @@
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+import { BaseHttpQuotaSource, fetchJsonOrNull, clampFraction, } from "./httpQuotaSource.js";
+/**
+ * Proactive GitHub Copilot quota source (the LLM backend behind VS Code). GETs
+ * the undocumented `api.github.com/copilot_internal/user` snapshot — including the
+ * new premium-requests quota — with a `gho_/ghu_` GitHub OAuth token.
+ *
+ * Token sourcing on Windows is the hard part: VS Code stores the GitHub token in
+ * DPAPI-encrypted SecretStorage (`state.vscdb`), NOT a readable file. So this
+ * source extracts a `gho_/ghu_` token from the **CLI** credential stores instead
+ * (Copilot CLI `~/.copilot/config.json`, then the `gh` CLI hosts file —
+ * OS-resolved by {@link resolveGhHostsPath}: `%AppData%\GitHub CLI` on Windows,
+ * `~/.config/gh` on macOS/Linux, or `$GH_CONFIG_DIR` anywhere), or an explicit
+ * `GH_COPILOT_TOKEN`/`GH_TOKEN` env. When none is available it degrades to null
+ * (the scheduler falls back to reactive 429 handling) — the conservative,
+ * never-confidently-wrong default.
+ *
+ * Caveat (confirmed live 2026-06-17): modern `gh` defaults to OS-keyring token
+ * storage, where `hosts.yml` holds NO token — file-based discovery only finds it
+ * under `gh`'s insecure/file storage or an older `gh`. The env-var route and the
+ * Copilot CLI config are the reliable file-based sources; the keyring is out of
+ * scope for a read-only quota probe.
+ */
+const COPILOT_PROVIDER_NAMES = new Set(["copilot", "github-copilot"]);
+const USAGE_ENDPOINT = "https://api.github.com/copilot_internal/user";
+const DEFAULT_USER_AGENT = "GithubCopilot (external, cli)";
+const GH_TOKEN_RE = /\bgh[ou]_[A-Za-z0-9_]{20,}\b/;
+/**
+ * Resolve the `gh` CLI `hosts.yml` path OS-agnostically. `gh` honors
+ * `GH_CONFIG_DIR` on every platform; absent that, its config dir is
+ * `%AppData%\GitHub CLI` on Windows and `~/.config/gh` on macOS/Linux. The prior
+ * hardcoded `~/.config/gh` missed the token on Windows (OS-agnostic invariant).
+ * Parameterized by `platform` + `home` (not read from the process) so it is a
+ * pure, cross-platform-testable function.
+ */
+export function resolveGhHostsPath(env, platform, home) {
+    const p = platform === "win32" ? path.win32 : path.posix;
+    const ghConfigDir = env.GH_CONFIG_DIR?.trim()
+        ? env.GH_CONFIG_DIR
+        : platform === "win32"
+            ? p.join(env.APPDATA ?? p.join(home, "AppData", "Roaming"), "GitHub CLI")
+            : p.join(home, ".config", "gh");
+    return p.join(ghConfigDir, "hosts.yml");
+}
+export class CopilotQuotaSource extends BaseHttpQuotaSource {
+    name = "copilot";
+    copilotConfigPath;
+    ghHostsPath;
+    env;
+    providerNames;
+    constructor(options = {}) {
+        super(options, DEFAULT_USER_AGENT);
+        this.env = options.env ?? process.env;
+        const copilotHome = this.env.COPILOT_HOME ?? path.join(homedir(), ".copilot");
+        this.copilotConfigPath = options.copilotConfigPath ?? path.join(copilotHome, "config.json");
+        this.ghHostsPath =
+            options.ghHostsPath ?? resolveGhHostsPath(this.env, process.platform, homedir());
+        this.providerNames = new Set(options.copilotProviderNames ?? COPILOT_PROVIDER_NAMES);
+    }
+    handlesProvider(provider) {
+        return this.providerNames.has(provider);
+    }
+    async fetchSnapshot() {
+        const token = this.readGitHubToken();
+        if (!token)
+            return null;
+        return fetchCopilotUsage({ token }, this.fetchContext());
+    }
+    /** Extracts a `gho_/ghu_` token from env / Copilot CLI / gh CLI, or null. */
+    readGitHubToken() {
+        for (const v of [this.env.GH_COPILOT_TOKEN, this.env.GITHUB_COPILOT_TOKEN, this.env.GH_TOKEN]) {
+            if (v && GH_TOKEN_RE.test(v))
+                return v.match(GH_TOKEN_RE)[0];
+        }
+        for (const p of [this.copilotConfigPath, this.ghHostsPath]) {
+            try {
+                const m = readFileSync(p, "utf8").match(GH_TOKEN_RE);
+                if (m)
+                    return m[0];
+            }
+            catch {
+                // next candidate
+            }
+        }
+        return null;
+    }
+}
+/**
+ * Reusable Copilot usage probe (no token-file read, no guard) — used by the source
+ * above and by the OpenCode broker with OpenCode's stored github-copilot token.
+ */
+export async function fetchCopilotUsage(creds, ctx) {
+    const body = await fetchJsonOrNull(ctx.fetchImpl, USAGE_ENDPOINT, {
+        method: "GET",
+        headers: {
+            Authorization: `Bearer ${creds.token}`,
+            "Editor-Version": "audit-tools/1",
+            "User-Agent": ctx.userAgent,
+            Accept: "application/json",
+        },
+    });
+    if (body == null)
+        return null;
+    return mapCopilotUsage(body, ctx.now());
+}
+/** Maps a `copilot_internal/user` snapshot (premium-requests preferred) → 0–1 remaining + reset. */
+export function mapCopilotUsage(body, nowMs) {
+    const q = body.quota_snapshots?.premium_interactions ?? body.quota_snapshots?.chat;
+    if (!q)
+        return null;
+    let remaining;
+    if (q.unlimited) {
+        remaining = 1;
+    }
+    else if (typeof q.percent_remaining === "number") {
+        remaining = clampFraction(q.percent_remaining / 100);
+    }
+    else if (typeof q.entitlement === "number" && q.entitlement > 0 && typeof q.remaining === "number") {
+        remaining = clampFraction(q.remaining / q.entitlement);
+    }
+    else {
+        return null;
+    }
+    return {
+        remaining_pct: remaining,
+        reset_at: normalizeReset(body.quota_reset_date),
+        requests_remaining: typeof q.remaining === "number" ? q.remaining : null,
+        tokens_remaining: null,
+        captured_at: new Date(nowMs).toISOString(),
+        source: "copilot",
+    };
+}
+function normalizeReset(value) {
+    if (!value)
+        return null;
+    const ms = Date.parse(value);
+    return Number.isFinite(ms) ? new Date(ms).toISOString() : null;
+}
+//# sourceMappingURL=copilotQuotaSource.js.map

package/dist/shared/quota/copilotQuotaSource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"copilotQuotaSource.js","sourceRoot":"","sources":["../../../src/shared/quota/copilotQuotaSource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,aAAa,GAGd,MAAM,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACtE,MAAM,cAAc,GAAG,8CAA8C,CAAC;AACtE,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAC3D,MAAM,WAAW,GAAG,8BAA8B,CAAC;AA2BnD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAsB,EACtB,QAAyB,EACzB,IAAY;IAEZ,MAAM,CAAC,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;IACzD,MAAM,WAAW,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE;QAC3C,CAAC,CAAC,GAAG,CAAC,aAAa;QACnB,CAAC,CAAC,QAAQ,KAAK,OAAO;YACpB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,CAAC;YACzE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,OAAO,kBAAmB,SAAQ,mBAAmB;IAChD,IAAI,GAAG,SAAS,CAAC;IACT,iBAAiB,CAAS;IAC1B,WAAW,CAAS;IACpB,GAAG,CAAoB;IACvB,aAAa,CAAc;IAE5C,YAAY,UAAqC,EAAE;QACjD,KAAK,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;QAC9E,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAC5F,IAAI,CAAC,WAAW;YACd,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,oBAAoB,IAAI,sBAAsB,CAAC,CAAC;IACvF,CAAC;IAES,eAAe,CAAC,QAAgB;QACxC,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAES,KAAK,CAAC,aAAa;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,iBAAiB,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,6EAA6E;IACrE,eAAe;QACrB,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9F,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,WAAW,CAAE,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;gBACrD,IAAI,CAAC;oBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAwB,EACxB,GAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE;QAChE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE;YACtC,gBAAgB,EAAE,eAAe;YACjC,YAAY,EAAE,GAAG,CAAC,SAAS;YAC3B,MAAM,EAAE,kBAAkB;SAC3B;KACF,CAAC,CAAC;IACH,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,eAAe,CAAC,IAA4B,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,eAAe,CAC7B,IAA0B,EAC1B,KAAa;IAEb,MAAM,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,oBAAoB,IAAI,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC;IACnF,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAChB,SAAS,GAAG,CAAC,CAAC;IAChB,CAAC;SAAM,IAAI,OAAO,CAAC,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;QACnD,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,iBAAiB,GAAG,GAAG,CAAC,CAAC;IACvD,CAAC;SAAM,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACrG,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,aAAa,EAAE,SAAS;QACxB,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAC/C,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;QACxE,gBAAgB,EAAE,IAAI;QACtB,WAAW,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;QAC1C,MAAM,EAAE,SAAS;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAgC;IACtD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC"}

package/dist/shared/quota/errorParsers/claudeCodeErrorParser.d.ts

@@ -0,0 +1,7 @@
+import type { RateLimitDetectionResult } from "../errorParsing.js";
+import type { ErrorParser } from "./genericErrorParser.js";
+export declare class ClaudeCodeErrorParser implements ErrorParser {
+    readonly name = "claude-code";
+    parse(text: string): RateLimitDetectionResult;
+}
+//# sourceMappingURL=claudeCodeErrorParser.d.ts.map

package/dist/shared/quota/errorParsers/claudeCodeErrorParser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeCodeErrorParser.d.ts","sourceRoot":"","sources":["../../../../src/shared/quota/errorParsers/claudeCodeErrorParser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAG3D,qBAAa,qBAAsB,YAAW,WAAW;IACvD,QAAQ,CAAC,IAAI,iBAAiB;IAE9B,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB;CAgC9C"}

package/dist/shared/quota/errorParsers/claudeCodeErrorParser.js

@@ -0,0 +1,33 @@
+import { collectClaudeCodeJsonLines } from "../claudeCodeJsonLines.js";
+export class ClaudeCodeErrorParser {
+    name = "claude-code";
+    parse(text) {
+        for (const obj of collectClaudeCodeJsonLines(text)) {
+            const level = obj["level"];
+            const type = obj["type"];
+            const message = obj["message"] ?? "";
+            const statusCode = obj["status_code"];
+            if (statusCode === 429 ||
+                type === "rate_limit_error" ||
+                (level === "error" && /\brate.?limit/i.test(message))) {
+                const retryAfter = obj["retry_after"];
+                const retryAfterMs = obj["retry_after_ms"];
+                let extractedMs = null;
+                if (retryAfterMs != null && retryAfterMs > 0) {
+                    extractedMs = retryAfterMs;
+                }
+                else if (retryAfter != null && retryAfter > 0) {
+                    // retry_after is always in seconds; retry_after_ms (handled above) is explicit ms.
+                    extractedMs = retryAfter * 1000;
+                }
+                return {
+                    isRateLimited: true,
+                    retryAfterMs: extractedMs,
+                    rawMatch: `claude-code-stderr:${statusCode ?? type ?? "rate_limit"}`,
+                };
+            }
+        }
+        return { isRateLimited: false, retryAfterMs: null, rawMatch: null };
+    }
+}
+//# sourceMappingURL=claudeCodeErrorParser.js.map

package/dist/shared/quota/errorParsers/claudeCodeErrorParser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeCodeErrorParser.js","sourceRoot":"","sources":["../../../../src/shared/quota/errorParsers/claudeCodeErrorParser.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAEvE,MAAM,OAAO,qBAAqB;IACvB,IAAI,GAAG,aAAa,CAAC;IAE9B,KAAK,CAAC,IAAY;QAChB,KAAK,MAAM,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAuB,CAAC;YACjD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAuB,CAAC;YAC/C,MAAM,OAAO,GAAI,GAAG,CAAC,SAAS,CAAY,IAAI,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,GAAG,CAAC,aAAa,CAAuB,CAAC;YAE5D,IACE,UAAU,KAAK,GAAG;gBAClB,IAAI,KAAK,kBAAkB;gBAC3B,CAAC,KAAK,KAAK,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EACrD,CAAC;gBACD,MAAM,UAAU,GAAG,GAAG,CAAC,aAAa,CAAuB,CAAC;gBAC5D,MAAM,YAAY,GAAG,GAAG,CAAC,gBAAgB,CAAuB,CAAC;gBACjE,IAAI,WAAW,GAAkB,IAAI,CAAC;gBACtC,IAAI,YAAY,IAAI,IAAI,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;oBAC7C,WAAW,GAAG,YAAY,CAAC;gBAC7B,CAAC;qBAAM,IAAI,UAAU,IAAI,IAAI,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;oBAChD,mFAAmF;oBACnF,WAAW,GAAG,UAAU,GAAG,IAAI,CAAC;gBAClC,CAAC;gBAED,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,YAAY,EAAE,WAAW;oBACzB,QAAQ,EAAE,sBAAsB,UAAU,IAAI,IAAI,IAAI,YAAY,EAAE;iBACrE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;CACF"}

package/dist/shared/quota/errorParsers/genericErrorParser.d.ts

@@ -0,0 +1,10 @@
+import type { RateLimitDetectionResult } from "../errorParsing.js";
+export interface ErrorParser {
+    readonly name: string;
+    parse(text: string): RateLimitDetectionResult;
+}
+export declare class GenericErrorParser implements ErrorParser {
+    readonly name = "generic";
+    parse(text: string): RateLimitDetectionResult;
+}
+//# sourceMappingURL=genericErrorParser.d.ts.map

package/dist/shared/quota/errorParsers/genericErrorParser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"genericErrorParser.d.ts","sourceRoot":"","sources":["../../../../src/shared/quota/errorParsers/genericErrorParser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAGnE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,CAAC;CAC/C;AAED,qBAAa,kBAAmB,YAAW,WAAW;IACpD,QAAQ,CAAC,IAAI,aAAa;IAE1B,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB;CAG9C"}

package/dist/shared/quota/errorParsers/genericErrorParser.js

@@ -0,0 +1,8 @@
+import { detectRateLimitError } from "../errorParsing.js";
+export class GenericErrorParser {
+    name = "generic";
+    parse(text) {
+        return detectRateLimitError(text);
+    }
+}
+//# sourceMappingURL=genericErrorParser.js.map

package/dist/shared/quota/errorParsers/genericErrorParser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"genericErrorParser.js","sourceRoot":"","sources":["../../../../src/shared/quota/errorParsers/genericErrorParser.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAO1D,MAAM,OAAO,kBAAkB;IACpB,IAAI,GAAG,SAAS,CAAC;IAE1B,KAAK,CAAC,IAAY;QAChB,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;CACF"}

package/dist/shared/quota/errorParsers/index.d.ts

@@ -0,0 +1,6 @@
+export type { ErrorParser } from "./genericErrorParser.js";
+export { GenericErrorParser } from "./genericErrorParser.js";
+export { ClaudeCodeErrorParser } from "./claudeCodeErrorParser.js";
+import type { ErrorParser } from "./genericErrorParser.js";
+export declare const getErrorParserForProvider: (providerName: string) => ErrorParser;
+//# sourceMappingURL=index.d.ts.map

package/dist/shared/quota/errorParsers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/shared/quota/errorParsers/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgB3D,eAAO,MAAM,yBAAyB,uCAGrC,CAAC"}

package/dist/shared/quota/errorParsers/index.js

@@ -0,0 +1,16 @@
+export { GenericErrorParser } from "./genericErrorParser.js";
+export { ClaudeCodeErrorParser } from "./claudeCodeErrorParser.js";
+import { GenericErrorParser } from "./genericErrorParser.js";
+import { ClaudeCodeErrorParser } from "./claudeCodeErrorParser.js";
+import { makeProviderKeyedFactory } from "../../providers/providerKeyedFactory.js";
+// Error parsers are stateless, so a single shared instance per provider is
+// enough — allocate each once at module scope rather than per call. (Previously
+// the claude-code parser was re-allocated on every lookup while the others were
+// already singletons; this makes the factory uniform.)
+const genericParser = new GenericErrorParser();
+const claudeCodeParser = new ClaudeCodeErrorParser();
+const PROVIDER_PARSERS = {
+    "claude-code": claudeCodeParser,
+};
+export const getErrorParserForProvider = makeProviderKeyedFactory(PROVIDER_PARSERS, genericParser);
+//# sourceMappingURL=index.js.map

package/dist/shared/quota/errorParsers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/shared/quota/errorParsers/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AAEnF,2EAA2E;AAC3E,gFAAgF;AAChF,gFAAgF;AAChF,uDAAuD;AACvD,MAAM,aAAa,GAAG,IAAI,kBAAkB,EAAE,CAAC;AAC/C,MAAM,gBAAgB,GAAG,IAAI,qBAAqB,EAAE,CAAC;AAErD,MAAM,gBAAgB,GAAgC;IACpD,aAAa,EAAE,gBAAgB;CAChC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,wBAAwB,CAC/D,gBAAgB,EAChB,aAAa,CACd,CAAC"}

package/dist/shared/quota/errorParsing.d.ts

@@ -0,0 +1,8 @@
+export interface RateLimitDetectionResult {
+    isRateLimited: boolean;
+    retryAfterMs: number | null;
+    rawMatch: string | null;
+}
+export declare function detectRateLimitError(text: string, now?: number): RateLimitDetectionResult;
+export declare function computeCooldownUntil(retryAfterMs: number | null, defaultMs?: number, now?: number): string;
+//# sourceMappingURL=errorParsing.d.ts.map

package/dist/shared/quota/errorParsing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorParsing.d.ts","sourceRoot":"","sources":["../../../src/shared/quota/errorParsing.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAiHD,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,MAAmB,GACvB,wBAAwB,CAgB1B;AAID,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,SAAS,GAAE,MAA4B,EACvC,GAAG,GAAE,MAAmB,GACvB,MAAM,CAGR"}

package/dist/shared/quota/errorParsing.js

@@ -0,0 +1,129 @@
+const RATE_LIMIT_PATTERNS = [
+    /\b429\b/i,
+    /\btoo many requests\b/i,
+    /\brate.?limit/i,
+    /\boverloaded\b/i,
+    /\bresource.?exhausted\b/i,
+    /\bquota.?exceeded\b/i,
+];
+// Host *account* usage caps (e.g. Claude Code's "You've hit your session limit ·
+// resets 3:30pm"). A worker that hits one returns this sentinel instead of a
+// result; it should be treated like a rate limit — pause until the stated reset
+// rather than re-dispatch into the active cap. Kept specific to avoid matching
+// the word "limit" in ordinary audit output.
+const USAGE_LIMIT_PATTERNS = [
+    /hit your (?:session|usage|account|daily|weekly) limit/i,
+    /reached your (?:session|usage|account|daily|weekly) limit/i,
+    /\b(?:session|usage) limit reached\b/i,
+];
+const ALL_RATE_LIMIT_PATTERNS = [...RATE_LIMIT_PATTERNS, ...USAGE_LIMIT_PATTERNS];
+function tryParseJson(text) {
+    const jsonStart = text.indexOf("{");
+    if (jsonStart === -1)
+        return null;
+    try {
+        return JSON.parse(text.slice(jsonStart));
+    }
+    catch {
+        return null;
+    }
+}
+function toPositiveNumber(value) {
+    if (value == null)
+        return null;
+    const val = typeof value === "string" ? Number(value) : value;
+    if (!Number.isFinite(val) || val <= 0)
+        return null;
+    return val;
+}
+function extractRetryAfterMs(obj) {
+    // A *_ms field is already in milliseconds and must NOT be scaled. Prefer it
+    // when present, returning it verbatim.
+    const retryAfterMs = toPositiveNumber(obj["retry_after_ms"]);
+    if (retryAfterMs != null)
+        return retryAfterMs;
+    const headers = obj["headers"];
+    const retryAfterSeconds = toPositiveNumber(headers?.["retry-after"] ??
+        headers?.["Retry-After"] ??
+        obj["retry_after"]);
+    if (retryAfterSeconds == null)
+        return null;
+    // Retry-After (RFC 7231) and retry_after fields are always in seconds; convert to ms.
+    return retryAfterSeconds * 1000;
+}
+function detectFromJson(text) {
+    const obj = tryParseJson(text);
+    if (!obj)
+        return null;
+    const status = obj["status"];
+    const type = obj["type"];
+    const errorObj = obj["error"];
+    const errorType = errorObj?.["type"];
+    const isRateLimited = status === 429 ||
+        type === "rate_limit_error" ||
+        errorType === "rate_limit_error";
+    if (!isRateLimited)
+        return null;
+    return {
+        isRateLimited: true,
+        retryAfterMs: extractRetryAfterMs(obj),
+        rawMatch: `json:${status === 429 ? "status=429" : `type=${type ?? errorType}`}`,
+    };
+}
+function extractResetsInMs(text) {
+    const match = /Resets in (?:(\d+)h)?(?:(\d+)m)?(?:(\d+)s)?/i.exec(text);
+    if (!match)
+        return null;
+    const hours = match[1] ? parseInt(match[1], 10) : 0;
+    const minutes = match[2] ? parseInt(match[2], 10) : 0;
+    const seconds = match[3] ? parseInt(match[3], 10) : 0;
+    if (hours === 0 && minutes === 0 && seconds === 0)
+        return null;
+    // Add 5 seconds of buffer
+    return (hours * 3600 + minutes * 60 + seconds + 5) * 1000;
+}
+// Parse a wall-clock reset like "resets 3:30pm" or "resets at 15:30" into ms
+// until the next occurrence of that local time. Session-limit sentinels state a
+// clock time rather than a duration. Returns null when absent/ambiguous.
+function extractResetsAtClockMs(text, now) {
+    const match = /resets?\s+(?:at\s+)?(\d{1,2})(?::(\d{2}))?\s*(am|pm)?/i.exec(text);
+    if (!match)
+        return null;
+    let hour = parseInt(match[1], 10);
+    const minute = match[2] ? parseInt(match[2], 10) : 0;
+    const meridiem = match[3]?.toLowerCase();
+    if (meridiem === "pm" && hour < 12)
+        hour += 12;
+    if (meridiem === "am" && hour === 12)
+        hour = 0;
+    if (hour > 23 || minute > 59)
+        return null;
+    const target = new Date(now);
+    target.setHours(hour, minute, 0, 0);
+    if (target.getTime() <= now)
+        target.setDate(target.getDate() + 1);
+    const ms = target.getTime() - now;
+    return ms > 0 ? ms + 5000 : null;
+}
+export function detectRateLimitError(text, now = Date.now()) {
+    const jsonResult = detectFromJson(text);
+    if (jsonResult)
+        return jsonResult;
+    for (const pattern of ALL_RATE_LIMIT_PATTERNS) {
+        const match = pattern.exec(text);
+        if (match) {
+            return {
+                isRateLimited: true,
+                retryAfterMs: extractResetsInMs(text) ?? extractResetsAtClockMs(text, now),
+                rawMatch: match[0],
+            };
+        }
+    }
+    return { isRateLimited: false, retryAfterMs: null, rawMatch: null };
+}
+const DEFAULT_COOLDOWN_MS = 60_000;
+export function computeCooldownUntil(retryAfterMs, defaultMs = DEFAULT_COOLDOWN_MS, now = Date.now()) {
+    const ms = retryAfterMs != null && retryAfterMs > 0 ? retryAfterMs : defaultMs;
+    return new Date(now + ms).toISOString();
+}
+//# sourceMappingURL=errorParsing.js.map

package/dist/shared/quota/errorParsing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorParsing.js","sourceRoot":"","sources":["../../../src/shared/quota/errorParsing.ts"],"names":[],"mappings":"AAMA,MAAM,mBAAmB,GAAG;IAC1B,UAAU;IACV,wBAAwB;IACxB,gBAAgB;IAChB,iBAAiB;IACjB,0BAA0B;IAC1B,sBAAsB;CACvB,CAAC;AAEF,iFAAiF;AACjF,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,6CAA6C;AAC7C,MAAM,oBAAoB,GAAG;IAC3B,wDAAwD;IACxD,4DAA4D;IAC5D,sCAAsC;CACvC,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,GAAG,mBAAmB,EAAE,GAAG,oBAAoB,CAAC,CAAC;AAElF,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,SAAS,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAA4B,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAkC;IAC1D,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,GAA4B;IACvD,4EAA4E;IAC5E,uCAAuC;IACvC,MAAM,YAAY,GAAG,gBAAgB,CACnC,GAAG,CAAC,gBAAgB,CAAgC,CACrD,CAAC;IACF,IAAI,YAAY,IAAI,IAAI;QAAE,OAAO,YAAY,CAAC;IAE9C,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAwC,CAAC;IACtE,MAAM,iBAAiB,GAAG,gBAAgB,CACvC,OAAO,EAAE,CAAC,aAAa,CAAiC;QACtD,OAAO,EAAE,CAAC,aAAa,CAAiC;QACxD,GAAG,CAAC,aAAa,CAAiC,CACtD,CAAC;IACF,IAAI,iBAAiB,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3C,sFAAsF;IACtF,OAAO,iBAAiB,GAAG,IAAI,CAAC;AAClC,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAuB,CAAC;IACnD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAuB,CAAC;IAC/C,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAwC,CAAC;IACrE,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC,MAAM,CAAuB,CAAC;IAE3D,MAAM,aAAa,GACjB,MAAM,KAAK,GAAG;QACd,IAAI,KAAK,kBAAkB;QAC3B,SAAS,KAAK,kBAAkB,CAAC;IAEnC,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhC,OAAO;QACL,aAAa,EAAE,IAAI;QACnB,YAAY,EAAE,mBAAmB,CAAC,GAAG,CAAC;QACtC,QAAQ,EAAE,QAAQ,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,SAAS,EAAE,EAAE;KAChF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,KAAK,GAAG,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,0BAA0B;IAC1B,OAAO,CAAC,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,EAAE,GAAG,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;AAC5D,CAAC;AAED,6EAA6E;AAC7E,gFAAgF;AAChF,yEAAyE;AACzE,SAAS,sBAAsB,CAAC,IAAY,EAAE,GAAW;IACvD,MAAM,KAAK,GAAG,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClF,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACzC,IAAI,QAAQ,KAAK,IAAI,IAAI,IAAI,GAAG,EAAE;QAAE,IAAI,IAAI,EAAE,CAAC;IAC/C,IAAI,QAAQ,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE;QAAE,IAAI,GAAG,CAAC,CAAC;IAC/C,IAAI,IAAI,GAAG,EAAE,IAAI,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,GAAG;QAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAClE,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC;IAClC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO;gBACL,aAAa,EAAE,IAAI;gBACnB,YAAY,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC;gBAC1E,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;aACnB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,MAAM,UAAU,oBAAoB,CAClC,YAA2B,EAC3B,YAAoB,mBAAmB,EACvC,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,EAAE,GAAG,YAAY,IAAI,IAAI,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,OAAO,IAAI,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC1C,CAAC"}

package/dist/shared/quota/fileLock.d.ts

@@ -0,0 +1,9 @@
+import type { RunLogger } from "../observability/runLog.js";
+export declare const STALE_LOCK_MS = 30000;
+export declare class FileLockTimeoutError extends Error {
+    constructor(lockPath: string);
+}
+export declare function acquireLock(lockPath: string, timeoutMs?: number, logger?: RunLogger): Promise<string>;
+export declare function releaseLock(lockPath: string, ownerToken: string): Promise<void>;
+export declare function withFileLock<T>(lockPath: string, fn: () => Promise<T>, timeoutMs?: number, logger?: RunLogger): Promise<T>;
+//# sourceMappingURL=fileLock.d.ts.map

package/dist/shared/quota/fileLock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileLock.d.ts","sourceRoot":"","sources":["../../../src/shared/quota/fileLock.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,eAAO,MAAM,aAAa,QAAS,CAAC;AASpC,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,QAAQ,EAAE,MAAM;CAI7B;AAkGD,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,MAA2B,EACtC,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC,MAAM,CAAC,CAmDjB;AAED,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYrF;AAED,wBAAsB,YAAY,CAAC,CAAC,EAClC,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC,CAAC,CAAC,CAkBZ"}

package/dist/shared/quota/fileLock.js

@@ -0,0 +1,202 @@
+import { writeFile, unlink, stat, readFile } from "node:fs/promises";
+export const STALE_LOCK_MS = 30_000;
+// Lock-acquire retry uses exponential backoff (initial → doubling → max) rather
+// than a fixed poll, so a long contention window costs far fewer wakeups. The
+// sleep is always clamped to the time left so backoff never overshoots timeoutMs.
+const RETRY_INTERVAL_INITIAL_MS = 50;
+const RETRY_INTERVAL_MAX_MS = 500;
+const DEFAULT_TIMEOUT_MS = 10_000;
+const STALE_CHECK_INTERVAL_MS = 1_000;
+export class FileLockTimeoutError extends Error {
+    constructor(lockPath) {
+        super(`Timed out acquiring lock: ${lockPath}`);
+        this.name = "FileLockTimeoutError";
+    }
+}
+function generateOwnerToken() {
+    return `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+}
+// Returns the owner token of a stale lock (older than STALE_LOCK_MS), or null
+// when the lock is fresh or already gone. Returning the token lets stale removal
+// reuse a token-checked delete, so a lock concurrently re-created with a
+// different token is never clobbered.
+async function readStaleLockToken(lockPath) {
+    try {
+        const info = await stat(lockPath);
+        if (Date.now() - info.mtimeMs <= STALE_LOCK_MS)
+            return null;
+        return await readFile(lockPath, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+// Suffix for the per-lock exclusive "steal claim" sidecar. Acquiring this via an
+// atomic `wx` create is what serializes stale-lock removal (see stealStaleLock).
+const STEAL_CLAIM_SUFFIX = ".steal";
+// Best-effort unlink that swallows ENOENT and transient Windows contention
+// (EPERM/EACCES). Used for cleanup paths where a failure to delete is harmless
+// because the acquire loop will retry regardless.
+async function bestEffortUnlink(path) {
+    try {
+        await unlink(path);
+    }
+    catch {
+        // best-effort: already gone or briefly contended on Windows
+    }
+}
+// Atomically (lease-style) steal a lock we observed as stale.
+//
+// The previous implementation did read-token-then-unlink as two non-atomic steps
+// directly on the lock file. That admitted a double-hold: stealer X reads the
+// stale token, stealer Y reads the same stale token, X unlinks and re-creates a
+// FRESH lock via `wx`, then Y — still acting on its earlier observation — unlinks
+// X's fresh lock and re-creates its own, so both X and Y believe they hold it.
+//
+// Fix: serialize the *removal right* through an exclusive sidecar claim. Only one
+// acquirer can `wx`-create `${lockPath}.steal`; that winner is the sole party that
+// may unlink the stale lock. Everyone else (EEXIST on the claim) backs off and
+// retries the normal acquire path. After the single winner removes the stale file,
+// the lock is gained by whoever wins the ordinary atomic `wx` create on lockPath —
+// and no acquirer ever unlinks a *fresh* lock, because (a) only the claim winner
+// unlinks at all and (b) it unlinks only while the content still equals the exact
+// stale token it set out to remove. Mutual exclusion therefore holds even under
+// concurrent steal.
+//
+// The claim sidecar is itself crash-tolerant: a winner that dies mid-steal would
+// orphan it, so a claim older than STALE_LOCK_MS is treated as abandoned and
+// reclaimed, mirroring the main lock's staleness recovery. The claim is always
+// removed in a finally on the happy path so it lives only for the brief
+// token-check + unlink window.
+async function stealStaleLock(lockPath, staleToken) {
+    const claimPath = `${lockPath}${STEAL_CLAIM_SUFFIX}`;
+    try {
+        await writeFile(claimPath, generateOwnerToken(), { flag: "wx" });
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "EEXIST") {
+            // Another acquirer holds the steal claim. If that claim is itself stale, a
+            // stealer crashed mid-steal — reclaim it so the lock can never wedge
+            // permanently. Otherwise leave the in-progress steal alone and let the main
+            // loop retry the ordinary acquire path.
+            try {
+                const claimInfo = await stat(claimPath);
+                if (Date.now() - claimInfo.mtimeMs > STALE_LOCK_MS) {
+                    await bestEffortUnlink(claimPath);
+                }
+            }
+            catch {
+                // claim vanished between EEXIST and stat — nothing to reclaim
+            }
+            return;
+        }
+        if (code === "EPERM" || code === "EACCES")
+            return; // transient Windows contention
+        throw err;
+    }
+    // We exclusively hold the steal claim: we are the only party permitted to remove
+    // the stale lock. Delete it only if it STILL carries the exact stale token we
+    // observed; if a prior steal already replaced it with a fresh lock (different
+    // token), leave that lock intact.
+    try {
+        if ((await readFile(lockPath, "utf8")) === staleToken) {
+            await unlink(lockPath);
+        }
+    }
+    catch {
+        // best-effort: lock already gone or briefly contended on Windows
+    }
+    finally {
+        await bestEffortUnlink(claimPath);
+    }
+}
+export async function acquireLock(lockPath, timeoutMs = DEFAULT_TIMEOUT_MS, logger) {
+    const token = generateOwnerToken();
+    const deadline = Date.now() + timeoutMs;
+    let lastStaleCheckAt = 0;
+    let retryInterval = RETRY_INTERVAL_INITIAL_MS;
+    while (true) {
+        try {
+            await writeFile(lockPath, token, { flag: "wx" });
+            return token;
+        }
+        catch (err) {
+            const code = err.code;
+            // EEXIST means the lock is already held → wait and retry. On Windows a
+            // concurrent create/delete race on the same lock file can surface as
+            // EPERM/EACCES instead of EEXIST; treat those as transient contention and
+            // retry as well, rather than failing the whole acquisition.
+            if (code !== "EEXIST" && code !== "EPERM" && code !== "EACCES")
+                throw err;
+        }
+        // Check the deadline BEFORE any stale-check IO (stat/readFile) or sleep, so a
+        // slow filesystem cannot push the actual return time past timeoutMs.
+        if (Date.now() >= deadline) {
+            logger?.event({ kind: "error", note: "lock_timeout", lock_path: lockPath, timeout_ms: timeoutMs });
+            throw new FileLockTimeoutError(lockPath);
+        }
+        const now = Date.now();
+        if (now - lastStaleCheckAt >= STALE_CHECK_INTERVAL_MS) {
+            lastStaleCheckAt = now;
+            const staleToken = await readStaleLockToken(lockPath);
+            if (staleToken !== null) {
+                // Steal the exact stale lock we observed via a lease-style, mutually
+                // exclusive claim (see stealStaleLock). Only the single claim winner ever
+                // unlinks, and only while the lock still carries this stale token — so a
+                // fresh lock another holder created in the gap is never clobbered, and two
+                // concurrent stealers can never both end up holding the lock.
+                await stealStaleLock(lockPath, staleToken);
+                logger?.event({ kind: "step", note: "stale_lock_removed", lock_path: lockPath });
+                // Progress was made (a slot may have opened); retry promptly and reset
+                // the backoff window.
+                retryInterval = RETRY_INTERVAL_INITIAL_MS;
+                continue;
+            }
+        }
+        // Exponential backoff, clamped to the time left so we never sleep past the
+        // deadline. Doubles each idle cycle up to RETRY_INTERVAL_MAX_MS.
+        const sleepMs = Math.min(retryInterval, Math.max(0, deadline - Date.now()));
+        await new Promise((r) => setTimeout(r, sleepMs));
+        retryInterval = Math.min(retryInterval * 2, RETRY_INTERVAL_MAX_MS);
+    }
+}
+export async function releaseLock(lockPath, ownerToken) {
+    try {
+        const content = await readFile(lockPath, "utf8");
+        if (content !== ownerToken) {
+            // Lock was stolen by another holder; do not delete their lock.
+            return;
+        }
+        await unlink(lockPath);
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            throw err;
+        // ENOENT: lock already gone — swallow silently
+    }
+}
+export async function withFileLock(lockPath, fn, timeoutMs, logger) {
+    const token = await acquireLock(lockPath, timeoutMs, logger);
+    let hasFnError = false;
+    try {
+        return await fn();
+    }
+    catch (err) {
+        hasFnError = true;
+        throw err;
+    }
+    finally {
+        try {
+            await releaseLock(lockPath, token);
+        }
+        catch (releaseErr) {
+            // If fn() already threw, preserve that original error for the caller — a
+            // secondary failure while releasing the lock must not mask the real cause.
+            // If fn() succeeded, the release error is the only failure, so surface it.
+            if (!hasFnError)
+                throw releaseErr;
+        }
+    }
+}
+//# sourceMappingURL=fileLock.js.map