crewx 0.9.0-rc.71 → 0.9.0-rc.72

package/dist-server/common/cache/provider-limit-cache.js

@@ -0,0 +1,451 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProviderLimitCache = exports.FAIL_BACKOFF_STEPS_MS = exports.RATE_LIMITED_STALE_TTL_MS = exports.STALE_TTL_MS = exports.FRESH_TTL_MS = exports.PROVIDER_LIMIT_BACKOFF_STEPS_MS = exports.PROVIDER_LIMIT_RATE_LIMITED_STALE_TTL_MS = exports.PROVIDER_LIMIT_STALE_TTL_MS = exports.PROVIDER_LIMIT_FRESH_TTL_MS = void 0;
+exports.buildProviderLimitCacheKey = buildProviderLimitCacheKey;
+exports.buildProviderLimitActiveScopeKey = buildProviderLimitActiveScopeKey;
+exports.fingerprintAccountScope = fingerprintAccountScope;
+exports.createProviderLimitCache = createProviderLimitCache;
+const node_crypto_1 = require("node:crypto");
+const cache_db_js_1 = require("../cache-db.js");
+exports.PROVIDER_LIMIT_FRESH_TTL_MS = 5 * 60 * 1000;
+exports.PROVIDER_LIMIT_STALE_TTL_MS = 30 * 60 * 1000;
+exports.PROVIDER_LIMIT_RATE_LIMITED_STALE_TTL_MS = 24 * 60 * 60 * 1000;
+exports.PROVIDER_LIMIT_BACKOFF_STEPS_MS = [30 * 1000, 60 * 1000, 2 * 60 * 1000, 5 * 60 * 1000];
+// These aliases make the cache policy easy to discover at call sites.
+exports.FRESH_TTL_MS = exports.PROVIDER_LIMIT_FRESH_TTL_MS;
+exports.STALE_TTL_MS = exports.PROVIDER_LIMIT_STALE_TTL_MS;
+exports.RATE_LIMITED_STALE_TTL_MS = exports.PROVIDER_LIMIT_RATE_LIMITED_STALE_TTL_MS;
+exports.FAIL_BACKOFF_STEPS_MS = exports.PROVIDER_LIMIT_BACKOFF_STEPS_MS;
+function buildProviderLimitCacheKey(provider, accountScope, kind) {
+    return `usage:limits:v2:${provider}:${accountScope}:${kind}`;
+}
+function buildProviderLimitActiveScopeKey(provider) {
+    return `usage:limits:v2:${provider}:active-scope`;
+}
+/** Create a non-secret account discriminator from a secret account credential. */
+function fingerprintAccountScope(value) {
+    return (0, node_crypto_1.createHash)('sha256').update(value, 'utf8').digest('hex');
+}
+const VALID_STATUSES = new Set([
+    'live',
+    'cached',
+    'fallback',
+    'stale',
+    'unavailable',
+    'not_offered',
+]);
+const DEFAULT_SUCCESS = (data) => data !== null && hasMeaningfulData(data);
+function hasMeaningfulData(value) {
+    if (value === null || value === undefined)
+        return false;
+    if (Array.isArray(value))
+        return value.some((item) => hasMeaningfulData(item));
+    if (typeof value !== 'object')
+        return true;
+    const entries = Object.values(value);
+    return entries.length > 0 && entries.some((entry) => hasMeaningfulData(entry));
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+function positiveFiniteOr(value, fallback) {
+    return value !== undefined && Number.isFinite(value) && value > 0 ? value : fallback;
+}
+function validBackoffStepsOr(value) {
+    if (!value || value.length === 0 || value.some((step) => !Number.isFinite(step) || step <= 0)) {
+        return exports.PROVIDER_LIMIT_BACKOFF_STEPS_MS;
+    }
+    return [...value];
+}
+function isProviderLimitStatus(value) {
+    return VALID_STATUSES.has(value);
+}
+function isFailureKind(value) {
+    return value === 'not_authenticated'
+        || value === 'unauthorized'
+        || value === 'forbidden'
+        || value === 'rate_limited'
+        || value === 'timeout'
+        || value === 'network'
+        || value === 'upstream'
+        || value === 'invalid_response'
+        || value === 'client_unavailable';
+}
+function isProviderLimitSource(value) {
+    return value === 'codex_app_server'
+        || value === 'codex_jsonl'
+        || value === 'claude_oauth'
+        || value === 'grok_oauth'
+        || value === 'glm_oauth';
+}
+function isValidObservedAt(value) {
+    if (typeof value !== 'string')
+        return false;
+    if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:\d{2})$/.test(value)) {
+        return false;
+    }
+    return Number.isFinite(Date.parse(value));
+}
+function errorFailureKind(error) {
+    if (isRecord(error) && isFailureKind(error['failureKind']))
+        return error['failureKind'];
+    if (isRecord(error) && error['name'] === 'AbortError')
+        return 'timeout';
+    if (error instanceof TypeError)
+        return 'network';
+    return 'upstream';
+}
+/**
+ * Persistent fresh/last-good cache for provider subscription limits.
+ *
+ * The account scope must already be a non-secret account identifier or a
+ * fingerprint. Use fingerprintAccountScope when the only available value is
+ * a credential. Failure state and in-flight work intentionally stay in memory.
+ */
+class ProviderLimitCache {
+    configuredProvider;
+    configuredAccountScope;
+    configuredIsSuccess;
+    now;
+    freshTtlMs;
+    staleTtlMs;
+    rateLimitedStaleTtlMs;
+    backoffStepsMs;
+    inFlight = new Map();
+    failures = new Map();
+    constructor(providerOrOptions, accountScope, isSuccessOrOptions, tuning) {
+        const baseOptions = typeof providerOrOptions === 'object' && providerOrOptions !== null
+            ? providerOrOptions
+            : tuning ?? (typeof isSuccessOrOptions === 'object' ? isSuccessOrOptions : {});
+        this.configuredProvider = typeof providerOrOptions === 'string'
+            ? providerOrOptions
+            : baseOptions.provider;
+        this.configuredAccountScope = typeof providerOrOptions === 'string'
+            ? accountScope
+            : baseOptions.accountScope;
+        this.configuredIsSuccess = typeof providerOrOptions === 'string'
+            ? typeof isSuccessOrOptions === 'function' ? isSuccessOrOptions : DEFAULT_SUCCESS
+            : baseOptions.isSuccess ?? DEFAULT_SUCCESS;
+        this.now = baseOptions.now ?? Date.now;
+        this.freshTtlMs = positiveFiniteOr(baseOptions.freshTtlMs, exports.PROVIDER_LIMIT_FRESH_TTL_MS);
+        this.staleTtlMs = positiveFiniteOr(baseOptions.staleTtlMs, exports.PROVIDER_LIMIT_STALE_TTL_MS);
+        this.rateLimitedStaleTtlMs = positiveFiniteOr(baseOptions.rateLimitedStaleTtlMs, exports.PROVIDER_LIMIT_RATE_LIMITED_STALE_TTL_MS);
+        this.backoffStepsMs = validBackoffStepsOr(baseOptions.backoffStepsMs);
+    }
+    get(...args) {
+        const request = this.resolveRequest(args);
+        const cacheKey = buildProviderLimitCacheKey(request.provider, request.accountScope, 'fresh');
+        const fresh = this.readSuccessfulEntry(cacheKey, request.isSuccess);
+        if (fresh) {
+            return Promise.resolve({ ...fresh, status: 'cached', failureKind: null });
+        }
+        const running = this.inFlight.get(cacheKey);
+        if (running)
+            return running;
+        const now = this.now();
+        const failure = this.failures.get(cacheKey);
+        if (failure && now < failure.nextAttemptAt) {
+            return Promise.resolve(this.replayFailure(request, failure.failureKind, now));
+        }
+        const operation = Promise.resolve()
+            .then(() => this.fetchAndCache(request, cacheKey))
+            .finally(() => {
+            if (this.inFlight.get(cacheKey) === operation)
+                this.inFlight.delete(cacheKey);
+        });
+        this.inFlight.set(cacheKey, operation);
+        return operation;
+    }
+    fetch(...args) {
+        return this.get(...args);
+    }
+    getOrFetch(...args) {
+        return this.get(...args);
+    }
+    /**
+     * Return the last safe account fingerprint observed for this provider.
+     * This hint is itself short-lived and contains no credential material; it
+     * lets a process restart reuse a still-fresh scoped value without probing
+     * the provider first.
+     */
+    getActiveScope(provider = this.configuredProvider) {
+        const resolvedProvider = this.requireKeyPart(provider, 'provider');
+        const value = this.safeGet(buildProviderLimitActiveScopeKey(resolvedProvider));
+        if (typeof value === 'string' && value.length > 0 && !value.includes('\0'))
+            return value;
+        if (value !== undefined)
+            this.safeDelete(buildProviderLimitActiveScopeKey(resolvedProvider));
+        return undefined;
+    }
+    setActiveScope(provider, accountScope) {
+        const resolvedProvider = this.requireKeyPart(provider, 'provider');
+        const resolvedAccountScope = this.requireKeyPart(accountScope, 'accountScope');
+        this.safeSet(buildProviderLimitActiveScopeKey(resolvedProvider), resolvedAccountScope, this.freshTtlMs);
+    }
+    clearActiveScope(provider = this.configuredProvider) {
+        const resolvedProvider = this.requireKeyPart(provider, 'provider');
+        this.safeDelete(buildProviderLimitActiveScopeKey(resolvedProvider));
+    }
+    /**
+     * Persist one already-observed successful result under its safe scope. This
+     * is used when the first request had no scope yet and therefore could not
+     * enter `get()` until after the single direct refresh completed.
+     */
+    store(provider, accountScope, raw, isSuccess) {
+        const resolvedProvider = this.requireKeyPart(provider, 'provider');
+        const resolvedAccountScope = this.requireKeyPart(accountScope, 'accountScope');
+        const predicate = isSuccess ?? this.configuredIsSuccess;
+        const result = this.normalizeResult(raw);
+        if (!this.isSuccessfulResult(result, predicate))
+            return undefined;
+        this.storeSuccessful(resolvedProvider, resolvedAccountScope, result);
+        return result;
+    }
+    /**
+     * Retain the in-memory retry/backoff state for a direct cold refresh that
+     * completed before a scoped `get()` could be entered.
+     */
+    recordFailure(provider, accountScope, raw) {
+        const resolvedProvider = this.requireKeyPart(provider, 'provider');
+        const resolvedAccountScope = this.requireKeyPart(accountScope, 'accountScope');
+        const result = this.normalizeResult(raw);
+        if (result.status === 'not_offered') {
+            this.deletePersistentEntries(resolvedProvider, resolvedAccountScope);
+            this.clearActiveScope(resolvedProvider);
+            return;
+        }
+        this.recordFailureState(resolvedProvider, resolvedAccountScope, result);
+    }
+    clear(provider = this.configuredProvider, accountScope = this.configuredAccountScope) {
+        const resolvedProvider = this.requireKeyPart(provider, 'provider');
+        const resolvedAccountScope = this.requireKeyPart(accountScope, 'accountScope');
+        this.deletePersistentEntries(resolvedProvider, resolvedAccountScope);
+        this.failures.delete(buildProviderLimitCacheKey(resolvedProvider, resolvedAccountScope, 'fresh'));
+    }
+    reset(provider = this.configuredProvider, accountScope = this.configuredAccountScope) {
+        this.clear(provider, accountScope);
+    }
+    resolveRequest(args) {
+        const first = args[0];
+        if (typeof first === 'function') {
+            const provider = this.requireKeyPart(this.configuredProvider, 'provider');
+            const accountScope = this.requireKeyPart(this.configuredAccountScope, 'accountScope');
+            const predicate = typeof args[1] === 'function' ? args[1] : this.configuredIsSuccess;
+            return { provider, accountScope, fetcher: first, isSuccess: predicate };
+        }
+        if (typeof first === 'string') {
+            const provider = this.requireKeyPart(first, 'provider');
+            const account = args[1];
+            const fetcher = args[2];
+            if (typeof account !== 'string' || typeof fetcher !== 'function') {
+                throw new TypeError('ProviderLimitCache.get requires provider, accountScope, and fetcher');
+            }
+            const predicate = typeof args[3] === 'function' ? args[3] : this.configuredIsSuccess;
+            return { provider, accountScope: this.requireKeyPart(account, 'accountScope'), fetcher, isSuccess: predicate };
+        }
+        const fetcher = first.fetcher ?? first.fetch;
+        if (typeof fetcher !== 'function')
+            throw new TypeError('ProviderLimitCache request requires fetcher');
+        return {
+            provider: this.requireKeyPart(first.provider, 'provider'),
+            accountScope: this.requireKeyPart(first.accountScope, 'accountScope'),
+            fetcher,
+            isSuccess: first.isSuccess ?? this.configuredIsSuccess,
+        };
+    }
+    async fetchAndCache(request, cacheKey) {
+        let result;
+        const scopeObservation = { present: false, accountScope: null };
+        try {
+            const raw = await request.fetcher();
+            const rawRecord = isRecord(raw) ? raw : undefined;
+            scopeObservation.present = rawRecord !== undefined
+                && Object.prototype.hasOwnProperty.call(rawRecord, 'cacheAccountScope');
+            if (scopeObservation.present && rawRecord) {
+                const observed = rawRecord['cacheAccountScope'];
+                scopeObservation.accountScope = typeof observed === 'string'
+                    && observed.length > 0
+                    && !observed.includes('\0')
+                    ? observed
+                    : null;
+            }
+            result = this.normalizeResult(raw);
+        }
+        catch (error) {
+            result = this.unavailableResult(errorFailureKind(error));
+        }
+        if (scopeObservation.present && scopeObservation.accountScope !== request.accountScope) {
+            // A direct refresh is authoritative about the account that was actually
+            // observed. Never replay or store account A data when that observation
+            // says B or says that no safe account scope exists.
+            this.deletePersistentEntries(request.provider, request.accountScope);
+            this.failures.delete(cacheKey);
+            if (scopeObservation.accountScope === null) {
+                this.clearActiveScope(request.provider);
+                return result;
+            }
+            this.setActiveScope(request.provider, scopeObservation.accountScope);
+            if (this.isSuccessfulResult(result, request.isSuccess)) {
+                this.storeSuccessful(request.provider, scopeObservation.accountScope, result);
+            }
+            return result;
+        }
+        if (result.status === 'not_offered') {
+            this.deletePersistentEntries(request.provider, request.accountScope);
+            this.failures.delete(cacheKey);
+            this.clearActiveScope(request.provider);
+            return result;
+        }
+        if (this.isSuccessfulResult(result, request.isSuccess)) {
+            this.failures.delete(cacheKey);
+            this.storeSuccessful(request.provider, request.accountScope, result);
+            return result;
+        }
+        const now = this.now();
+        const failureKind = this.recordFailureState(request.provider, request.accountScope, result);
+        return this.replayFailure(request, failureKind, now);
+    }
+    recordFailureState(provider, accountScope, result) {
+        const cacheKey = buildProviderLimitCacheKey(provider, accountScope, 'fresh');
+        const failureKind = this.hasInvalidObservationMetadata(result)
+            ? 'invalid_response'
+            : result.failureKind ?? 'invalid_response';
+        const now = this.now();
+        const previous = this.failures.get(cacheKey);
+        const stepIndex = Math.min(previous?.count ?? 0, this.backoffStepsMs.length - 1);
+        this.failures.set(cacheKey, {
+            count: (previous?.count ?? 0) + 1,
+            nextAttemptAt: now + this.backoffStepsMs[stepIndex],
+            failureKind,
+        });
+        return failureKind;
+    }
+    readSuccessfulEntry(key, isSuccess) {
+        const stored = this.safeGet(key);
+        if (stored === undefined)
+            return undefined;
+        const normalized = this.normalizeResult(stored);
+        if (this.isSuccessfulResult(normalized, isSuccess))
+            return normalized;
+        this.safeDelete(key);
+        return undefined;
+    }
+    readLastGood(request) {
+        const key = buildProviderLimitCacheKey(request.provider, request.accountScope, 'last-good');
+        return this.readSuccessfulEntry(key, request.isSuccess);
+    }
+    replayFailure(request, failureKind, now) {
+        const lastGood = this.readLastGood(request);
+        if (lastGood && this.isWithinStaleWindow(lastGood, failureKind, now)) {
+            return {
+                ...lastGood,
+                status: 'stale',
+                failureKind,
+            };
+        }
+        return this.unavailableResult(failureKind);
+    }
+    isWithinStaleWindow(lastGood, failureKind, now) {
+        if (!lastGood.observedAt)
+            return false;
+        const observedAt = Date.parse(lastGood.observedAt);
+        if (!Number.isFinite(observedAt))
+            return false;
+        const ttl = failureKind === 'rate_limited' ? this.rateLimitedStaleTtlMs : this.staleTtlMs;
+        return now - observedAt < ttl;
+    }
+    isSuccessfulResult(result, isSuccess) {
+        if (result.status !== 'live' && result.status !== 'fallback')
+            return false;
+        if (!isValidObservedAt(result.observedAt) || !isProviderLimitSource(result.source))
+            return false;
+        if (result.data === null || result.data === undefined || !hasMeaningfulData(result.data))
+            return false;
+        try {
+            return isSuccess(result.data);
+        }
+        catch {
+            return false;
+        }
+    }
+    hasInvalidObservationMetadata(result) {
+        return (result.status === 'live' || result.status === 'fallback')
+            && result.data !== null
+            && result.data !== undefined
+            && hasMeaningfulData(result.data)
+            && (!isValidObservedAt(result.observedAt) || !isProviderLimitSource(result.source));
+    }
+    normalizeResult(raw) {
+        if (!isRecord(raw) || typeof raw['status'] !== 'string' || !isProviderLimitStatus(raw['status']) || !('data' in raw)) {
+            return this.unavailableResult('invalid_response');
+        }
+        const failureKind = raw['failureKind'];
+        const source = raw['source'];
+        const observedAt = raw['observedAt'];
+        return {
+            status: raw['status'],
+            data: raw['data'],
+            failureKind: failureKind === null || failureKind === undefined
+                ? null
+                : isFailureKind(failureKind) ? failureKind : 'invalid_response',
+            observedAt: observedAt === null || observedAt === undefined
+                ? null
+                : typeof observedAt === 'string' ? observedAt : null,
+            source: source === null || source === undefined
+                ? null
+                : isProviderLimitSource(source) ? source : null,
+        };
+    }
+    unavailableResult(failureKind) {
+        return {
+            status: 'unavailable',
+            data: null,
+            failureKind,
+            observedAt: null,
+            source: null,
+        };
+    }
+    storeSuccessful(provider, accountScope, result) {
+        const cacheKey = buildProviderLimitCacheKey(provider, accountScope, 'fresh');
+        this.safeSet(cacheKey, result, this.freshTtlMs);
+        this.safeSet(buildProviderLimitCacheKey(provider, accountScope, 'last-good'), result, Math.max(this.staleTtlMs, this.rateLimitedStaleTtlMs));
+        this.setActiveScope(provider, accountScope);
+    }
+    requireKeyPart(value, name) {
+        if (!value || value.includes('\0'))
+            throw new TypeError(`ProviderLimitCache requires a non-empty ${name}`);
+        return value;
+    }
+    deletePersistentEntries(provider, accountScope) {
+        this.safeDelete(buildProviderLimitCacheKey(provider, accountScope, 'fresh'));
+        this.safeDelete(buildProviderLimitCacheKey(provider, accountScope, 'last-good'));
+    }
+    safeGet(key) {
+        try {
+            return (0, cache_db_js_1.kvGet)(key);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    safeSet(key, value, ttlMs) {
+        try {
+            (0, cache_db_js_1.kvSet)(key, value, ttlMs);
+        }
+        catch {
+            // Cache persistence is best effort; the live provider result remains authoritative.
+        }
+    }
+    safeDelete(key) {
+        try {
+            (0, cache_db_js_1.kvDel)(key);
+        }
+        catch {
+            // Cache cleanup is best effort.
+        }
+    }
+}
+exports.ProviderLimitCache = ProviderLimitCache;
+function createProviderLimitCache(options = {}) {
+    return new ProviderLimitCache(options);
+}