@cortexkit/antigravity-auth-core 3.0.5 → 3.0.7

package/dist/common-auth-embedded/claustrum/roster.js

@@ -1,7 +1,7 @@
 import { createHash } from 'node:crypto';
 import { acquireRefreshFileLock, withLock, writeJsonAtomic, } from '../fs/index.js';
 import { readPrivateText, windowsPrivateFiles } from '../fs/private-files.js';
-import { isQuotaMap, mergeQuotaObservation, } from '../quota/index.js';
+import { decodeQuotaMap, mergeQuotaObservation, } from '../quota/index.js';
 import { ClaustrumConsumerError } from './errors.js';
 import { acceptAccount, declineAccount, isDeclined, } from './interlock.js';
 export const DEFAULT_ROUTE_PREFIX = 'vault:';
@@ -210,6 +210,7 @@ function optionalString(value) {
     return value === undefined || typeof value === 'string';
 }
 function decodeRow(value) {
+    const quota = isRecord(value) ? decodeQuotaMap(value.quota) : undefined;
     if (!isRecord(value) ||
         typeof value.routeId !== 'string' ||
         typeof value.credentialId !== 'string' ||
@@ -224,11 +225,14 @@ function decodeRow(value) {
         (value.aliases !== undefined &&
             (!Array.isArray(value.aliases) ||
                 !value.aliases.every((alias) => typeof alias === 'string'))) ||
-        (value.quota !== undefined && !isQuotaMap(value.quota)) ||
+        (value.quota !== undefined && quota === undefined) ||
         (value.stale !== undefined && value.stale !== true) ||
         (value.unclaimed !== undefined && value.unclaimed !== true))
         return undefined;
-    return value;
+    return {
+        ...value,
+        ...(quota === undefined ? {} : { quota }),
+    };
 }
 const SKIPPED_REASONS = new Set([
     'empty credential id',
@@ -435,6 +439,32 @@ export function recordVaultQuota(path, input) {
         };
     });
 }
+/**
+ * Merge a quota observation that belongs to an account rather than to a
+ * served credential, such as a background reading from insula. The write
+ * lands only while the row is still bound to that exact known account, so a
+ * reading taken before a replacement never reaches the successor. Unlike
+ * `recordVaultQuota` it never binds an account: a row without a known account
+ * is refused. Returns whether the observation was kept.
+ */
+export function recordVaultAccountQuota(path, input) {
+    return mutateVaultRoster(path, (current) => {
+        const row = current?.rows.find((entry) => entry.routeId === input.routeId);
+        if (!current ||
+            !row ||
+            row.accountIdentity === undefined ||
+            row.accountIdentity !== input.accountIdentity)
+            return { result: false };
+        const quota = mergeQuotaObservation(row.quota, input.observation);
+        return {
+            next: {
+                ...current,
+                rows: current.rows.map((entry) => entry === row ? { ...entry, quota } : entry),
+            },
+            result: true,
+        };
+    });
+}
 /**
  * Discover and commit the roster. The lease covers the list call and the
  * commit, not just the write: an opaque view cannot tell a delayed old reply

package/dist/common-auth-embedded/fs/refresh-file-lock.d.ts

@@ -13,7 +13,7 @@ export interface RefreshFileLock {
     whenLost(): Promise<LockLoss>;
     hasLost(): boolean;
 }
-export declare function acquireRefreshFileLock(options: {
+type RefreshFileLockOptions = {
     name: string;
     ttlMs: number;
     /**
@@ -22,7 +22,6 @@ export declare function acquireRefreshFileLock(options: {
      * be one host's path.
      */
     path: string;
-    now?: () => number;
     renew?: boolean;
     renewIntervalMs?: number;
     /** Notifies a live-owner refusal without awaiting; observer failures are ignored. */
@@ -30,4 +29,11 @@ export declare function acquireRefreshFileLock(options: {
     /** Synchronous, never awaited; throws and returned promise/thenable rejections are isolated. */
     onRenewalTimer?: (event: 'scheduled' | 'cancelled') => void;
     onStep?: (step: 'stale-marker-stat' | 'stale-marker-claimed' | 'stale-lock-observed' | 'lock-read-ready' | 'lock-missing' | 'stale-lock-confirmed' | 'stale-lock-removed' | 'stale-lock-recreated' | 'eviction-marker-acquired' | 'renewal-owner-confirmed' | 'renewal-marker-unavailable' | 'renewal-write-fenced' | 'renewal-write-ready' | 'renewal-write-finished' | 'relinquish-read' | 'renewal-finished' | 'release-owner-confirmed') => void | Promise<void>;
+};
+/** Filesystem leases share wall time across all callers and processes. */
+export declare function acquireRefreshFileLock(options: RefreshFileLockOptions): Promise<RefreshFileLock | null>;
+/** @internal Clock seam for lease tests; not exported by the package's fs entry point. */
+export declare function acquireRefreshFileLockWithClock(options: RefreshFileLockOptions & {
+    now?: () => number;
 }): Promise<RefreshFileLock | null>;
+export {};

package/dist/common-auth-embedded/fs/refresh-file-lock.js

@@ -1,8 +1,25 @@
 import { randomUUID } from 'node:crypto';
-import { mkdir, open, readFile, rename, rm, stat, writeFile, } from 'node:fs/promises';
+import { mkdir, open, readFile, rename, rm, stat } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { createPrivateBytes, createPrivateDirectoryExclusive, ensurePrivateDirectory, PrivateFileError, privateOperation, readPrivateText, verifyPrivate, windowsPrivateFiles, writePrivateAtomic, } from './private-files.js';
 import { LockOwnershipError, lockPathFor } from './with-lock.js';
+/**
+ * Create a new owner-only file and write `text` into it, failing with EEXIST if
+ * the file already exists. Writing through the handle rather than path-based
+ * `writeFile(path, …, { flag: 'wx' })` matters: Bun's path form also truncates
+ * the file it has just created, and on some Linux filesystems (XFS under load)
+ * that redundant ftruncate stalls for hundreds of milliseconds, inside every
+ * lock acquisition.
+ */
+async function createExclusiveText(path, text) {
+    const handle = await open(path, 'wx', 0o600);
+    try {
+        await handle.writeFile(text, 'utf8');
+    }
+    finally {
+        await handle.close();
+    }
+}
 const setRefreshLockRenewalTimeout = globalThis.setTimeout.bind(globalThis);
 const clearRefreshLockRenewalTimeout = globalThis.clearTimeout.bind(globalThis);
 // A concurrent contender renaming the freshly-created eviction-marker directory
@@ -14,7 +31,12 @@ export function isLostMarkerRaceError(error) {
     return (code === 'ENOENT' ||
         (!windowsPrivateFiles && (code === 'EINVAL' || code === 'ENOTDIR')));
 }
-export async function acquireRefreshFileLock(options) {
+/** Filesystem leases share wall time across all callers and processes. */
+export function acquireRefreshFileLock(options) {
+    return acquireRefreshFileLockWithClock({ ...options, now: Date.now });
+}
+/** @internal Clock seam for lease tests; not exported by the package's fs entry point. */
+export async function acquireRefreshFileLockWithClock(options) {
     const lockPath = lockPathFor(options.path, options.name);
     const legacyOwnerPath = join(lockPath, 'owner.json');
     const ownerId = randomUUID();
@@ -152,11 +174,7 @@ export async function acquireRefreshFileLock(options) {
         if (windowsPrivateFiles)
             await createPrivateBytes(lockPath, bytes);
         else
-            await writeFile(lockPath, bytes, {
-                encoding: 'utf8',
-                mode: 0o600,
-                flag: 'wx',
-            });
+            await createExclusiveText(lockPath, bytes);
     }
     async function leaseContention(error) {
         const code = error.code;
@@ -304,11 +322,7 @@ export async function acquireRefreshFileLock(options) {
             if (windowsPrivateFiles)
                 await createPrivateBytes(evictOwnerPath, bytes);
             else
-                await writeFile(evictOwnerPath, bytes, {
-                    encoding: 'utf8',
-                    mode: 0o600,
-                    flag: 'wx',
-                });
+                await createExclusiveText(evictOwnerPath, bytes);
         }
         catch (error) {
             // A competing contender can rename our just-created marker directory

package/dist/common-auth-embedded/pi-slot/lock.js

@@ -1,4 +1,4 @@
-import { rmdirSync, statSync } from 'node:fs';
+import { rmdirSync, statSync, utimesSync } from 'node:fs';
 import { mkdir, rmdir, stat, utimes } from 'node:fs/promises';
 // Protocol source: proper-lockfile 4.1.2 lib/lockfile.js and lib/mtime-precision.js;
 // line-level citations and the Pi lock options are recorded in docs/sources.md.
@@ -135,7 +135,9 @@ export async function acquirePiLock(authPath, onCompromised, onRenew) {
             return;
         let observed;
         try {
-            observed = await stat(path);
+            // Durable writes can occupy every async filesystem worker in fsync.
+            // Renew on the calling thread so their queue cannot consume the lease.
+            observed = statSync(path);
         }
         catch (error) {
             retry(error);
@@ -151,12 +153,14 @@ export async function acquirePiLock(authPath, onCompromised, onRenew) {
         }
         const next = new Date(precision === 's' ? Math.ceil(Date.now() / 1_000) * 1_000 : Date.now());
         try {
-            await utimes(path, next, next);
+            utimesSync(path, next, next);
         }
         catch (error) {
             retry(error);
             return;
         }
+        // A metadata syscall can itself stall; never confirm an expired lease.
+        assertFresh();
         if (released)
             return;
         mtime = next.getTime();

package/dist/common-auth-embedded/quota/codec.d.ts

@@ -1,5 +1,7 @@
 export interface QuotaCodec {
     readonly validate: (value: unknown) => boolean;
+    /** Normalize persisted data before validation; older codecs may omit this. */
+    readonly decode?: (value: unknown) => unknown;
     readonly merge: (stored: unknown, observation: unknown) => unknown;
 }
 /**

package/dist/common-auth-embedded/quota/codec.js

@@ -1,4 +1,4 @@
-import { isQuotaMap } from './map.js';
+import { decodeQuotaMap, isQuotaMap } from './map.js';
 import { mergeQuotaObservation } from './merge.js';
 /**
  * The quota codec the account-pool store (the `/store` subpath) takes when it
@@ -8,5 +8,6 @@ import { mergeQuotaObservation } from './merge.js';
  */
 export const quotaCodec = Object.freeze({
     validate: isQuotaMap,
+    decode: decodeQuotaMap,
     merge: mergeQuotaObservation,
 });

package/dist/common-auth-embedded/quota/format.d.ts

@@ -11,8 +11,11 @@ export declare const NO_LIMITS_REPORTED = "no limits reported";
 /**
  * `compact` fits a footer or a sidebar row: each window's figure, the credit
  * budget and the stale marker, without reset times. `full` adds each reset.
+ * `narrow` fits one line per account in a narrow sidebar: `5h 92% · 7d 66%
+ * · Fa 98% left`, the account-wide windows plus at most one model-scoped
+ * window or the budget (as `cr`), and no stale marker (see `isQuotaStale`).
  */
-export type QuotaTextForm = 'compact' | 'full';
+export type QuotaTextForm = 'compact' | 'full' | 'narrow';
 export interface QuotaTextOptions {
     /** The current time in ms, for reset countdowns and the stale marker. */
     now: number;
@@ -21,6 +24,26 @@ export interface QuotaTextOptions {
     /** Defaults to `QUOTA_STALE_AFTER_MS`. */
     staleAfterMs?: number;
 }
+export interface QuotaWindowPart {
+    kind: 'window' | 'budget';
+    /** The display name of a quota window, or `credits` for the budget. */
+    name: string;
+    /** The shared figure wording, including `credits` for budget figures. */
+    figure: string;
+    /** The unrounded remaining percentage, clamped to 0–100, when known. */
+    remainingPercent?: number;
+    /** A bare relative reset span such as `4d`, only when the reset is future. */
+    resetIn?: string;
+    checkedAt: number;
+    /** Whether the reset followed this reading and has arrived by `now`. */
+    resetSinceReading: boolean;
+}
+export interface QuotaParts {
+    /** Reported windows in display order, followed by the budget when present. */
+    windows: QuotaWindowPart[];
+    /** The shared checked-age wording, present only when the reading is stale. */
+    age?: string;
+}
 /**
  * The name a window is shown under. A general window (scope `all`) is named
  * by its stored length; a model-scoped window keeps the label the plugin
@@ -29,17 +52,31 @@ export interface QuotaTextOptions {
  * were recorded) falls back to its label.
  */
 export declare function quotaWindowName(limit: Pick<ProjectedLimit, 'scope' | 'label' | 'windowMinutes'>): string;
+/**
+ * Structured quota wording for layouts that need one row per window. The
+ * windows use the same filtering and order as `quotaTextParts`; future resets
+ * and the optional age keep the shared formatter's wording.
+ */
+export declare function quotaWindowParts(quota: ProjectedQuota | undefined, options: QuotaTextOptions): QuotaParts;
+/**
+ * Whether the reading is stale: true exactly when the compact and full forms
+ * would end with `checked … ago`. The narrow form leaves that age out to stay
+ * short, so a caller drawing a narrow line uses this to dim it instead.
+ */
+export declare function isQuotaStale(quota: ProjectedQuota | undefined, options: QuotaTextOptions): boolean;
 /**
  * The pieces of a quota text, in order: one per reported window
  * (`5h 58% left, resets 2h`), then the credit budget when there is one, then
  * `checked 3h ago` when the oldest piece shown is stale. Empty when nothing
  * was reported; `formatQuota` turns that into a sentence. A caller printing
- * one line per window (the terminal auth menu) uses these directly.
+ * one line per window (the terminal auth menu) uses these directly. In the
+ * narrow form the pieces are the narrow line's (`5h 92%`, `7d 66% left`).
  */
 export declare function quotaTextParts(quota: ProjectedQuota | undefined, options: QuotaTextOptions): string[];
 /**
  * A row's quota as one line: `5h 58% left · 7d 90% left` in the compact
- * form, with `, resets 2h` after each window in the full form. With nothing
+ * form, with `, resets 2h` after each window in the full form, and
+ * `5h 58% · 7d 90% left` in the narrow form. With nothing
  * reported it is `NO_QUOTA_READING`, or `NO_LIMITS_REPORTED` when the
  * provider answered without a limit for any window.
  */

package/dist/common-auth-embedded/quota/format.js

@@ -1,7 +1,7 @@
 // The one quota wording every surface shows: the command menu's dialogs on
 // OpenCode and Pi, the terminal auth menu, and the plugins' sidebars. Each of
-// them calls `formatQuota` (or `quotaTextParts` for one line per window), so
-// the wording cannot drift between plugins or between a dialog and a sidebar.
+// them calls `formatQuota`, `quotaTextParts`, or `quotaWindowParts`, so the
+// wording cannot drift between plugins or between a dialog and a sidebar.
 //
 // The rules: a window is named by its length (`5h`, `7d`), or, for a window
 // that binds only one model family, by the label the plugin stored it under.
@@ -22,18 +22,23 @@ export const NO_QUOTA_READING = 'no quota reading yet';
  */
 export const NO_LIMITS_REPORTED = 'no limits reported';
 /**
- * A length or a time span in its largest whole-ish unit: `45m`, `5h`, `3d`.
- * Spans under an hour are minutes, under a day hours, otherwise days, each
- * rounded to the nearest unit and never shown as zero.
+ * A time span in at most its two largest units: `45m`, `2h29m`, `5h`, `3d23h`,
+ * `7d`. Every unit is rounded down, so a reset is never shown later than it is;
+ * the one exception is a span under a minute, which reads `1m` rather than
+ * zero. A zero second unit is left out.
  */
 function shortSpan(ms) {
-    const minutes = Math.max(1, Math.round(ms / 60_000));
+    const minutes = Math.max(1, Math.floor(ms / 60_000));
     if (minutes < 60)
         return `${minutes}m`;
-    const hours = Math.round(minutes / 60);
-    if (hours < 24)
-        return `${hours}h`;
-    return `${Math.max(1, Math.round(minutes / 1440))}d`;
+    if (minutes < 1440) {
+        const hours = Math.floor(minutes / 60);
+        const rest = minutes % 60;
+        return rest === 0 ? `${hours}h` : `${hours}h${rest}m`;
+    }
+    const days = Math.floor(minutes / 1440);
+    const hours = Math.floor((minutes % 1440) / 60);
+    return hours === 0 ? `${days}d` : `${days}d${hours}h`;
 }
 /** A stored window length in minutes as its exact name: `5h`, `7d`, `90m`. */
 function lengthName(minutes) {
@@ -55,17 +60,24 @@ export function quotaWindowName(limit) {
         return limit.label;
     return lengthName(limit.windowMinutes);
 }
+function clampPercent(remaining) {
+    return Math.min(100, Math.max(0, remaining));
+}
+/** A remaining percentage as the whole number every form shows. */
+function wholePercent(remaining) {
+    return Math.round(clampPercent(remaining));
+}
 function percentLeft(remaining) {
-    return `${Math.round(Math.min(100, Math.max(0, remaining)))}% left`;
+    return `${wholePercent(remaining)}% left`;
 }
-function resetText(resetsAt, now) {
-    if (resetsAt === undefined)
-        return '';
-    const at = Date.parse(resetsAt);
-    // A reset already passed says nothing about the future; leave it out.
-    if (!Number.isFinite(at) || at <= now)
-        return '';
-    return `, resets ${shortSpan(at - now)}`;
+function resetDetails(resetsAt, checkedAt, now) {
+    const at = resetsAt === undefined ? Number.NaN : Date.parse(resetsAt);
+    return {
+        ...(Number.isFinite(at) && at > now
+            ? { resetIn: shortSpan(at - now) }
+            : {}),
+        resetSinceReading: Number.isFinite(at) && at > checkedAt && at <= now,
+    };
 }
 /** Shortest window first, so `5h` reads before `7d`; unknown lengths last. */
 function displayOrder(left, right) {
@@ -85,46 +97,187 @@ function displayOrder(left, right) {
     return left.label < right.label ? -1 : left.label > right.label ? 1 : 0;
 }
 /**
- * The pieces of a quota text, in order: one per reported window
- * (`5h 58% left, resets 2h`), then the credit budget when there is one, then
- * `checked 3h ago` when the oldest piece shown is stale. Empty when nothing
- * was reported; `formatQuota` turns that into a sentence. A caller printing
- * one line per window (the terminal auth menu) uses these directly.
+ * Structured quota wording for layouts that need one row per window. The
+ * windows use the same filtering and order as `quotaTextParts`; future resets
+ * and the optional age keep the shared formatter's wording.
  */
-export function quotaTextParts(quota, options) {
+export function quotaWindowParts(quota, options) {
+    const { windows, age } = scopedWindowParts(quota, options);
+    const parts = windows.map(({ part }) => part);
+    return age === undefined ? { windows: parts } : { windows: parts, age };
+}
+/**
+ * `quotaWindowParts` with each window's scope kept beside it. The narrow form
+ * needs the scope to name and pick model-scoped windows; the public parts do
+ * not carry it, so their shape stays as it was.
+ */
+function scopedWindowParts(quota, options) {
     if (!quota)
-        return [];
+        return { windows: [] };
     const { now } = options;
-    const full = (options.form ?? 'full') === 'full';
-    const parts = [];
-    const times = [];
     const readings = quota.limits
         .filter((limit) => limit.kind === 'reading' && limit.remainingPercent !== undefined)
         .sort(displayOrder);
-    for (const limit of readings) {
-        times.push(limit.checkedAt);
-        parts.push(`${quotaWindowName(limit)} ${percentLeft(limit.remainingPercent ?? 0)}${full ? resetText(limit.resetsAt, now) : ''}`);
-    }
+    const windows = readings.map((limit) => {
+        const remainingPercent = clampPercent(limit.remainingPercent ?? 0);
+        return {
+            scope: limit.scope,
+            part: {
+                kind: 'window',
+                name: quotaWindowName(limit),
+                figure: percentLeft(limit.remainingPercent ?? 0),
+                remainingPercent,
+                checkedAt: limit.checkedAt,
+                ...resetDetails(limit.resetsAt, limit.checkedAt, now),
+            },
+        };
+    });
     const budget = quota.budget;
     if (budget) {
-        times.push(budget.checkedAt);
+        const remainingPercent = budget.remainingPercent;
         const figure = budget.reached
             ? 'credits spent'
-            : budget.remainingPercent !== undefined
-                ? `credits ${percentLeft(budget.remainingPercent)}`
+            : remainingPercent !== undefined
+                ? `credits ${percentLeft(remainingPercent)}`
                 : 'credits available';
-        parts.push(`${figure}${full ? resetText(budget.resetsAt, now) : ''}`);
+        windows.push({
+            scope: ALL_SCOPE,
+            spent: budget.reached,
+            part: {
+                kind: 'budget',
+                name: 'credits',
+                figure,
+                ...(remainingPercent === undefined
+                    ? {}
+                    : { remainingPercent: clampPercent(remainingPercent) }),
+                checkedAt: budget.checkedAt,
+                ...resetDetails(budget.resetsAt, budget.checkedAt, now),
+            },
+        });
+    }
+    if (windows.length > 0) {
+        const age = now - Math.min(...windows.map(({ part }) => part.checkedAt));
+        if (age > (options.staleAfterMs ?? QUOTA_STALE_AFTER_MS)) {
+            return { windows, age: `checked ${shortSpan(age)} ago` };
+        }
+    }
+    return { windows };
+}
+/**
+ * Whether the reading is stale: true exactly when the compact and full forms
+ * would end with `checked … ago`. The narrow form leaves that age out to stay
+ * short, so a caller drawing a narrow line uses this to dim it instead.
+ */
+export function isQuotaStale(quota, options) {
+    return scopedWindowParts(quota, options).age !== undefined;
+}
+/**
+ * The model a scope names, as a display name: any namespace before a colon
+ * is dropped (`model:claude-opus-4` → `claude-opus-4`) and the first letter is
+ * capitalized (`fable` → `Fable`); the rest stays as written.
+ */
+function scopeDisplayName(scope) {
+    const model = scope.slice(scope.indexOf(':') + 1);
+    return model.charAt(0).toUpperCase() + model.slice(1);
+}
+/**
+ * Short names for the model scopes in one row: the first two letters of each
+ * display name. Names that would read the same for different models are each
+ * extended one letter at a time until they differ (`Fable` and `Fabric` read
+ * `Fabl` and `Fabr`); a name that runs out of letters stays whole.
+ */
+function scopeAbbreviations(scopes) {
+    const names = [...new Set(scopes.map(scopeDisplayName))];
+    const lengths = new Map(names.map((name) => [name, 2]));
+    const short = (name) => name.slice(0, lengths.get(name));
+    for (;;) {
+        const byShort = new Map();
+        for (const name of names) {
+            byShort.set(short(name), [...(byShort.get(short(name)) ?? []), name]);
+        }
+        let extended = false;
+        for (const group of byShort.values()) {
+            if (group.length < 2)
+                continue;
+            for (const name of group) {
+                const length = lengths.get(name) ?? 2;
+                if (length < name.length) {
+                    lengths.set(name, length + 1);
+                    extended = true;
+                }
+            }
+        }
+        if (!extended)
+            break;
     }
-    if (times.length > 0) {
-        const age = now - Math.min(...times);
-        if (age > (options.staleAfterMs ?? QUOTA_STALE_AFTER_MS))
-            parts.push(`checked ${shortSpan(age)} ago`);
+    return new Map(scopes.map((scope) => [scope, short(scopeDisplayName(scope))]));
+}
+/**
+ * The narrow form's pieces: every account-wide window as `5h 92%`, then at
+ * most one more item, with ` left` added once to the last piece. That item is
+ * the tightest (least remaining) of the model-scoped windows and the credit
+ * budget, so the line stays bounded whatever the account carries: a scoped
+ * window reads under its short model name (`Fa 98%`), the budget as `cr 75%`
+ * (`cr 0%` when spent). On a tie a scoped window wins over the budget, and
+ * among scoped windows the first in display order wins. The choice depends
+ * only on the reading, never on a width. A budget without a percentage cannot
+ * be chosen; when nothing at all is shown it keeps its compact wording
+ * (`credits available`). No age is added; `isQuotaStale` says whether the
+ * reading is stale. A window whose reset arrived after the reading keeps its
+ * figure, as in the other forms.
+ */
+function narrowTextParts(quota, options) {
+    const { windows } = scopedWindowParts(quota, options);
+    const general = windows.filter(({ part, scope }) => part.kind === 'window' && scope === ALL_SCOPE);
+    const scoped = windows.filter(({ part, scope }) => part.kind === 'window' && scope !== ALL_SCOPE);
+    const abbreviations = scopeAbbreviations(scoped.map(({ scope }) => scope));
+    // The items competing for the one slot after the account-wide windows, in
+    // tie-break order: scoped windows in display order, then the budget. A
+    // spent budget counts as 0% left; one without a percentage cannot compete.
+    const budget = windows.find(({ part }) => part.kind === 'budget');
+    const budgetLeft = budget?.spent ? 0 : budget?.part.remainingPercent;
+    const extras = [
+        ...scoped.map(({ scope, part }) => ({
+            label: abbreviations.get(scope) ?? scope,
+            remaining: part.remainingPercent ?? 0,
+        })),
+        ...(budgetLeft === undefined
+            ? []
+            : [{ label: 'cr', remaining: budgetLeft }]),
+    ];
+    // Strictly lower wins, so on a tie the earlier item keeps the slot.
+    const tightest = extras.reduce((best, item) => best === undefined || item.remaining < best.remaining ? item : best, undefined);
+    const pieces = general.map(({ part }) => `${part.name} ${wholePercent(part.remainingPercent ?? 0)}%`);
+    if (tightest) {
+        pieces.push(`${tightest.label} ${wholePercent(tightest.remaining)}%`);
     }
-    return parts;
+    if (pieces.length === 0)
+        return windows.map(({ part }) => part.figure);
+    return pieces.map((piece, index) => index === pieces.length - 1 ? `${piece} left` : piece);
+}
+/**
+ * The pieces of a quota text, in order: one per reported window
+ * (`5h 58% left, resets 2h`), then the credit budget when there is one, then
+ * `checked 3h ago` when the oldest piece shown is stale. Empty when nothing
+ * was reported; `formatQuota` turns that into a sentence. A caller printing
+ * one line per window (the terminal auth menu) uses these directly. In the
+ * narrow form the pieces are the narrow line's (`5h 92%`, `7d 66% left`).
+ */
+export function quotaTextParts(quota, options) {
+    if (options.form === 'narrow')
+        return narrowTextParts(quota, options);
+    const parts = quotaWindowParts(quota, options);
+    const full = (options.form ?? 'full') === 'full';
+    const text = parts.windows.map((part) => {
+        const reset = full && part.resetIn ? `, resets ${part.resetIn}` : '';
+        return `${part.kind === 'budget' ? '' : `${part.name} `}${part.figure}${reset}`;
+    });
+    return parts.age === undefined ? text : [...text, parts.age];
 }
 /**
  * A row's quota as one line: `5h 58% left · 7d 90% left` in the compact
- * form, with `, resets 2h` after each window in the full form. With nothing
+ * form, with `, resets 2h` after each window in the full form, and
+ * `5h 58% · 7d 90% left` in the narrow form. With nothing
  * reported it is `NO_QUOTA_READING`, or `NO_LIMITS_REPORTED` when the
  * provider answered without a limit for any window.
  */

package/dist/common-auth-embedded/quota/index.d.ts

@@ -1,9 +1,9 @@
 export type { QuotaCodec } from './codec.js';
 export { quotaCodec } from './codec.js';
-export type { QuotaTextForm, QuotaTextOptions } from './format.js';
-export { formatQuota, NO_LIMITS_REPORTED, NO_QUOTA_READING, QUOTA_STALE_AFTER_MS, quotaTextParts, quotaWindowName, } from './format.js';
-export type { CreditBudgetCleared, CreditBudgetEntry, CreditBudgetReading, QuotaAbsentEntry, QuotaEntry, QuotaMap, QuotaReadingEntry, QuotaRetiredEntry, } from './map.js';
-export { ALL_SCOPE, DEFAULT_REQUIRED_LABELS, emptyQuotaMap, isQuotaMap, } from './map.js';
+export type { QuotaParts, QuotaTextForm, QuotaTextOptions, QuotaWindowPart, } from './format.js';
+export { formatQuota, isQuotaStale, NO_LIMITS_REPORTED, NO_QUOTA_READING, QUOTA_STALE_AFTER_MS, quotaTextParts, quotaWindowName, quotaWindowParts, } from './format.js';
+export type { CreditBudgetCleared, CreditBudgetEntry, CreditBudgetReading, QuotaAbsentEntry, QuotaCounter, QuotaEntry, QuotaMap, QuotaReadingEntry, QuotaRetiredEntry, } from './map.js';
+export { ALL_SCOPE, DEFAULT_REQUIRED_LABELS, decodeQuotaMap, emptyQuotaMap, isQuotaMap, } from './map.js';
 export type { ObservedBudget, ObservedPair, ObservedReading, QuotaObservation, } from './merge.js';
 export { isQuotaObservation, mergeQuotaObservation, QuotaCodecError, } from './merge.js';
 export type { ExhaustionReset, ProjectedBudget, ProjectedLimit, ProjectedQuota, } from './projection.js';

package/dist/common-auth-embedded/quota/index.js

@@ -1,5 +1,5 @@
 export { quotaCodec } from './codec.js';
-export { formatQuota, NO_LIMITS_REPORTED, NO_QUOTA_READING, QUOTA_STALE_AFTER_MS, quotaTextParts, quotaWindowName, } from './format.js';
-export { ALL_SCOPE, DEFAULT_REQUIRED_LABELS, emptyQuotaMap, isQuotaMap, } from './map.js';
+export { formatQuota, isQuotaStale, NO_LIMITS_REPORTED, NO_QUOTA_READING, QUOTA_STALE_AFTER_MS, quotaTextParts, quotaWindowName, quotaWindowParts, } from './format.js';
+export { ALL_SCOPE, DEFAULT_REQUIRED_LABELS, decodeQuotaMap, emptyQuotaMap, isQuotaMap, } from './map.js';
 export { isQuotaObservation, mergeQuotaObservation, QuotaCodecError, } from './merge.js';
 export { budgetExhaustedResetAt, futureResetAt, projectQuota, readsExhausted, } from './projection.js';

package/dist/common-auth-embedded/quota/map.d.ts

@@ -44,16 +44,27 @@ export interface CreditBudgetCleared {
     checkedAt: number;
 }
 export type CreditBudgetEntry = CreditBudgetReading | CreditBudgetCleared;
+export interface QuotaCounter {
+    value: number;
+    checkedAt: number;
+}
 export interface QuotaMap {
     limits: QuotaEntry[];
     /** Absent means no observation has reported on the budget yet. */
     budget?: CreditBudgetEntry;
+    /** Provider-named counts, each with its own observation time. */
+    counters?: Record<string, QuotaCounter>;
 }
 export declare function emptyQuotaMap(): QuotaMap;
 /** The time an entry speaks for: its reading, retirement or absence time. */
 export declare function entryTime(entry: QuotaEntry): number;
 export declare function limitKey(scope: string, label: string): string;
 export declare function isCreditBudgetEntry(value: unknown): value is CreditBudgetEntry;
+export declare function isQuotaCounters(value: unknown): value is Record<string, QuotaCounter>;
+/** Keep usable counters without letting one malformed count hide a quota map. */
+export declare function readQuotaCounters(value: unknown): Record<string, QuotaCounter> | undefined;
+/** Decode persisted quota, dropping malformed counters but not limit evidence. */
+export declare function decodeQuotaMap(value: unknown): QuotaMap | undefined;
 /**
  * True when `value` is a well-formed quota map. Unrecognised top-level keys
  * are tolerated (and preserved by merge) so a newer writer's additions