@cortexkit/opencode-antigravity-auth 2.2.1 → 3.0.0

package/src/tui/entry.d.mts

@@ -0,0 +1,17 @@
+/**
+ * The `./tui` entry for both hosts. OpenCode 1 calls `tui(api, options,
+ * meta)`; OpenCode 2 (GA) calls `setup(context)` and receives the cleanup
+ * that stops everything the setup started.
+ *
+ * Parameters are typed `unknown` so this declaration imports neither host's
+ * SDK: each host's own plugin type accepts it (a function taking `unknown`
+ * accepts any argument), and a consumer on one host never needs the other
+ * host's SDK or renderer declarations.
+ */
+declare const plugin: {
+  readonly id: 'cortexkit.antigravity-auth'
+  readonly tui: (api: unknown, options: unknown, meta: unknown) => Promise<void>
+  readonly setup: (context: unknown) => Promise<() => Promise<void>>
+}
+
+export default plugin

package/src/tui/entry.mjs

@@ -1,74 +1,42 @@
-// Host-aware loader for the Antigravity TUI.
-//
-// Production OpenTUI hosts compile plugin source through
-// `@opentui/solid/scripts/solid-transform` and resolve module imports
-// through a virtual runtime module identifier:
-//
-//   opentui:runtime-module:<encodeURIComponent('@opentui/solid')>
-//
-// When the host has installed that virtual resolver, importing via it gives
-// back the transformed runtime that the host's precompiler emitted; otherwise
-// Bun resolves `@opentui/solid` to the node-exported JS and the host's
-// pre-built `../tui-compiled/tui.tsx` file (which already references those
-// virtual modules in its import graph) lines up correctly.
-//
-// Two import paths are tried, in order:
-//
-//   1. `../tui-compiled/tui.tsx` — the precompiled, virtual-runtime-aware
-//      bundle. Resolved successfully by hosts that ship a runtime module
-//      resolver + the precompiled tree.
-//   2. `../tui.tsx` — the dev fallback. Local development with raw TSX
-//      runs through `@opentui/solid/preload`, which installs the Solid
-//      transform plugin so the same `/** @jsxImportSource @opentui/solid */`
-//      pragma is honoured on the fly.
-//
-// Errors raised while probing for the runtime module that indicate "module
-// not found" are swallowed and the compiled tree is attempted next. Any
-// other error (syntax error, runtime error in the compiled file, etc.) is
-// re-thrown — those are real bugs, not configuration mismatches.
+// The package's `./tui` entry for both hosts: `{ id, tui, setup }`.
+// OpenCode 1 calls `tui(api, options, meta)`; OpenCode 2 (GA) calls
+// `setup(context)`. Importing this module loads neither UI: each arm loads
+// its own compiled root on first call, so the OpenCode 1 renderer never
+// starts inside GA and the GA one never starts inside OpenCode 1.
+// The public loadTui picks the compiled root when the host registers its
+// runtime modules and the raw source otherwise (development only), and
+// propagates every unrelated import error, so a missing installed root
+// fails with ERR_MODULE_NOT_FOUND instead of falling back.
+import { loadTui } from '../common-auth-embedded/tui/index.js'
 
-import { dirname, resolve } from 'node:path'
-import { fileURLToPath, pathToFileURL } from 'node:url'
+const ID = 'cortexkit.antigravity-auth'
 
-const RUNTIME_MODULE_ID = `opentui:runtime-module:${encodeURIComponent('@opentui/solid')}`
-const ENTRY_DIR = dirname(fileURLToPath(import.meta.url))
-const COMPILED_ENTRY = pathToFileURL(
-  resolve(ENTRY_DIR, '../tui-compiled/tui.tsx'),
-).href
-const RAW_ENTRY = pathToFileURL(resolve(ENTRY_DIR, '../tui.tsx')).href
+let v1Root
+let gaRoot
 
-function isMissingModuleError(error) {
-  if (!error) return false
-  const code =
-    typeof error === 'object' && 'code' in error ? error.code : undefined
-  if (code === 'ERR_MODULE_NOT_FOUND' || code === 'MODULE_NOT_FOUND')
-    return true
-  const message = typeof error.message === 'string' ? error.message : ''
-  return /cannot find module|module not found|ENOENT/i.test(message)
+function loadV1() {
+  v1Root ??= loadTui({
+    rawEntry: new URL('../tui-raw/tui.tsx', import.meta.url).href,
+    runtimeEntry: new URL('../tui-compiled/tui.js', import.meta.url).href,
+  })
+  return v1Root
 }
 
-async function probeVirtualRuntime() {
-  try {
-    await import(RUNTIME_MODULE_ID)
-    return true
-  } catch (error) {
-    if (isMissingModuleError(error)) return false
-    throw error
-  }
+function loadGa() {
+  gaRoot ??= loadTui({
+    rawEntry: new URL('../tui-ga-raw/host-ga.tsx', import.meta.url).href,
+    runtimeEntry: new URL('../tui-ga-compiled/host-ga.js', import.meta.url)
+      .href,
+  })
+  return gaRoot
 }
 
-async function importWithFallback() {
-  const compiledAvailable = await probeVirtualRuntime()
-  if (compiledAvailable) {
-    return import(COMPILED_ENTRY)
-  }
-  return import(RAW_ENTRY)
+export default {
+  id: ID,
+  async tui(api, options, meta) {
+    return (await loadV1()).tui(api, options, meta)
+  },
+  async setup(context) {
+    return (await loadGa()).setup(context)
+  },
 }
-
-const mod = await importWithFallback()
-
-// Pass the wrapped plugin shape through unchanged. `tui.tsx` exports the
-// fleet-shape `{ id, tui }` wrapper as its default export; this file just
-// selects between the precompiled and the dev-TSX entry, it does not
-// re-wrap.
-export default mod?.default ?? mod?.tui ?? mod

package/src/tui/file-logger.ts

@@ -23,6 +23,8 @@ import {
 } from 'node:fs'
 import { homedir } from 'node:os'
 import { dirname, join } from 'node:path'
+import { createLoggerInstance } from '../common-auth-embedded/logger/index.js'
+import { isProviderSecretKey } from '../logging/provider-key-policy'
 
 export type TuiLogLevel = 'debug' | 'info' | 'warn' | 'error'
 
@@ -57,9 +59,8 @@ interface FileLoggerOptions {
  *   never touch a real user log file).
  * - Otherwise write under `<xdg-state>/cortexkit/antigravity-auth/tui.log`.
  *
- * Falls back to a temp file when the host path cannot be resolved (e.g. no
- * home directory on a hostile CI box); the file logger itself never throws,
- * it just drops the line.
+ * There is no temporary-file fallback. The writer silently drops lines when
+ * the resolved destination cannot be written.
  */
 export function resolveTuiLogPath(): string {
   const override = process.env.ANTIGRAVITY_AUTH_TUI_LOG_FILE
@@ -135,11 +136,25 @@ function createFileLogger(options: FileLoggerOptions): TuiLogger {
     }
   }
 
+  // Keep the immediate host writer, not the public logger's buffered file mode.
+  // Each TUI writer owns a separate sink-only engine with an explicit debug floor.
+  const instance = createLoggerInstance({
+    level: 'debug',
+    extraSecretKeys: isProviderSecretKey,
+    captureSink: ({ level, message, data }) => {
+      const extra =
+        data !== null && typeof data === 'object' && !Array.isArray(data)
+          ? Object.fromEntries(Object.entries(data))
+          : undefined
+      write(level === 'trace' ? 'debug' : level, message, extra)
+    },
+  })
+  const channel = instance.createLogger('antigravity.tui')
   return {
-    debug: (message, extra) => write('debug', message, extra),
-    info: (message, extra) => write('info', message, extra),
-    warn: (message, extra) => write('warn', message, extra),
-    error: (message, extra) => write('error', message, extra),
+    debug: channel.debug,
+    info: channel.info,
+    warn: channel.warn,
+    error: channel.error,
     getLogPath: () => filePath,
   }
 }

package/src/tui-compiled/common-auth-embedded/logger/capture-sink.js

@@ -0,0 +1,13 @@
+export function createCaptureSink() {
+    const records = [];
+    const sink = (record) => {
+        records.push(record);
+    };
+    return {
+        records,
+        sink,
+        clear: () => {
+            records.length = 0;
+        },
+    };
+}

package/src/tui-compiled/common-auth-embedded/logger/engine.js

@@ -0,0 +1,246 @@
+import { appendFileSync, chmodSync, existsSync, renameSync, statSync, } from "node:fs";
+import { createRedactor } from "./redact.js";
+const ORDER = {
+    error: 0,
+    warn: 1,
+    info: 2,
+    debug: 3,
+    trace: 4,
+};
+const MAX_BYTES = 5 * 1024 * 1024;
+const ROTATE_KEEP = 3;
+function chmodPrivate(path) {
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        /* never throw */
+    }
+}
+function rotateIfNeeded(f) {
+    try {
+        if (!(existsSync(f) && statSync(f).size >= MAX_BYTES))
+            return;
+        for (let i = ROTATE_KEEP - 1; i >= 1; i--) {
+            if (existsSync(`${f}.${i}`)) {
+                const rotated = `${f}.${i + 1}`;
+                renameSync(`${f}.${i}`, rotated);
+                chmodPrivate(rotated);
+            }
+        }
+        const rotated = `${f}.1`;
+        renameSync(f, rotated);
+        chmodPrivate(rotated);
+    }
+    catch {
+        /* never throw */
+    }
+}
+function safeSerialize(data) {
+    try {
+        return ` ${JSON.stringify(data)}`;
+    }
+    catch {
+        return ' [unserializable]';
+    }
+}
+/**
+ * One logger's settings and buffer.
+ *
+ * Where lines are written and the level floor start unset unless `options`
+ * supplies them. A host decides where its log lives (that decision reads host
+ * environment variables and host directories, neither of which belongs in
+ * shared code) and configures the logger before it runs any command. Until
+ * then every `log.*` call is a silent no-op: throwing would turn the first
+ * command a host forgot to wire into a crash, and buffering would hold
+ * credential-bearing lines for a configuration that may never arrive.
+ */
+function createEngine(options) {
+    let logFileSource;
+    let initLevelSource;
+    let runtimeLevel;
+    let redactor = createRedactor();
+    let captureSink;
+    let buffer = [];
+    let timer;
+    function configure(next) {
+        logFileSource = next.file;
+        initLevelSource = next.level;
+        redactor = createRedactor(next);
+        captureSink = next.captureSink;
+    }
+    function setLogLevel(l) {
+        if (l === undefined || l in ORDER)
+            runtimeLevel = l;
+    }
+    function logFilePath() {
+        if (logFileSource === undefined)
+            return undefined;
+        const resolved = typeof logFileSource === 'function' ? logFileSource() : logFileSource;
+        return resolved || undefined;
+    }
+    function configuredLevel() {
+        if (runtimeLevel)
+            return runtimeLevel;
+        const floor = typeof initLevelSource === 'function'
+            ? initLevelSource()
+            : initLevelSource;
+        if (floor && floor in ORDER)
+            return floor;
+        return 'info';
+    }
+    function flushLogs() {
+        if (timer) {
+            clearTimeout(timer);
+            timer = undefined;
+        }
+        if (!buffer.length)
+            return;
+        let file;
+        try {
+            file = logFilePath();
+        }
+        catch {
+            buffer = [];
+            return;
+        }
+        const text = buffer.join('');
+        buffer = [];
+        if (!file)
+            return;
+        try {
+            rotateIfNeeded(file);
+            if (existsSync(file))
+                chmodPrivate(file);
+            appendFileSync(file, text, { encoding: 'utf8', mode: 0o600 });
+        }
+        catch {
+            /* never throw */
+        }
+    }
+    function schedule() {
+        if (!timer)
+            timer = setTimeout(() => {
+                timer = undefined;
+                flushLogs();
+            }, 500);
+    }
+    function emit(channel, level, message, data) {
+        // Unconfigured (neither a file nor a sink) stays a silent no-op.
+        if (logFileSource === undefined && captureSink === undefined)
+            return;
+        try {
+            if (ORDER[level] > ORDER[configuredLevel()])
+                return;
+            const scrubbedMessage = redactor.redactStrings(message);
+            let scrubbedData;
+            try {
+                scrubbedData = redactor.redact(data);
+            }
+            catch {
+                scrubbedData = '[unserializable]';
+            }
+            const line = `[${new Date().toISOString()}] ${level.toUpperCase()} [${channel}] ${scrubbedMessage}` +
+                (data === undefined ? '' : safeSerialize(scrubbedData)) +
+                '\n';
+            // A failing observer must not prevent file logging or escape into the host.
+            try {
+                captureSink?.({
+                    channel,
+                    level,
+                    message: scrubbedMessage,
+                    data: scrubbedData,
+                });
+            }
+            catch { }
+            // A sink-only logger has no file to buffer lines for.
+            if (logFileSource === undefined)
+                return;
+            buffer.push(line);
+            if (buffer.length >= 50)
+                flushLogs();
+            else
+                schedule();
+        }
+        catch {
+            // Provider and redaction failures must never turn diagnostics into a host crash.
+        }
+    }
+    function createLogger(channel) {
+        return {
+            error: (m, d) => emit(channel, 'error', m, d),
+            warn: (m, d) => emit(channel, 'warn', m, d),
+            info: (m, d) => emit(channel, 'info', m, d),
+            debug: (m, d) => emit(channel, 'debug', m, d),
+            trace: (m, d) => emit(channel, 'trace', m, d),
+        };
+    }
+    function reset() {
+        buffer = [];
+        if (timer) {
+            clearTimeout(timer);
+            timer = undefined;
+        }
+        logFileSource = undefined;
+        initLevelSource = undefined;
+        runtimeLevel = undefined;
+        redactor = createRedactor();
+        captureSink = undefined;
+    }
+    if (options)
+        configure(options);
+    return { configure, createLogger, setLogLevel, flushLogs, reset };
+}
+/**
+ * A logger instance of its own, configured with `options`. A plugin whose
+ * copy of this module may be shared with another plugin in the same process
+ * uses this instead of `initLogger`, so neither replaces the other's file,
+ * level, redaction or capture sink.
+ */
+export function createLoggerInstance(options) {
+    const { configure, createLogger, setLogLevel, flushLogs } = createEngine(options);
+    return { configure, createLogger, setLogLevel, flushLogs };
+}
+/**
+ * The instance behind the module-level functions below, which keep the
+ * single-plugin API: one plugin per copy of this module calls `initLogger`
+ * and `createLogger` without holding an instance.
+ */
+const defaultEngine = createEngine();
+/**
+ * Point the module's default logger at a host's file and level, and return
+ * it. Idempotent: calling it again replaces both. A runtime level installed
+ * by `setLogLevel` is deliberately left alone, because it is the operator's
+ * explicit choice and outranks the floor a host computed at start-up.
+ */
+export function initLogger(options) {
+    defaultEngine.configure(options);
+    const { configure, createLogger, setLogLevel, flushLogs } = defaultEngine;
+    return { configure, createLogger, setLogLevel, flushLogs };
+}
+export function setLogLevel(l) {
+    defaultEngine.setLogLevel(l);
+}
+/**
+ * Write whatever the default logger has buffered. Safe to call synchronously
+ * from a process-exit handler, which is how each host drains the buffer on
+ * shutdown.
+ */
+export function flushLogs() {
+    defaultEngine.flushLogs();
+}
+export function createLogger(channel) {
+    return defaultEngine.createLogger(channel);
+}
+export async function flushForTest() {
+    defaultEngine.flushLogs();
+}
+/**
+ * Return the default logger to its uninitialised state. Only a test needs
+ * this: a single process runs every test file, so a file path left over from
+ * one test would keep a later "logger was never initialised" case writing
+ * lines.
+ */
+export function resetLoggerForTest() {
+    defaultEngine.reset();
+}

package/src/tui-compiled/common-auth-embedded/logger/index.js

@@ -0,0 +1,3 @@
+export { createCaptureSink } from "./capture-sink.js";
+export { createLogger, createLoggerInstance, flushForTest, flushLogs, initLogger, resetLoggerForTest, setLogLevel, } from "./engine.js";
+export { createRedactor, redact, redactStrings } from "./redact.js";

package/src/tui-compiled/common-auth-embedded/logger/redact.js

@@ -0,0 +1,83 @@
+const SECRET_KEY_EXACT = /^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i;
+const TOKEN_VALUE = /\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g;
+const MASK = '***REDACTED***';
+// How many errors deep a cause chain is followed. A chain this long is
+// already unreadable in a log line, and an unbounded one (each cause a fresh
+// object, so the cycle check never trips) must not grow the line forever.
+const MAX_ERROR_DEPTH = 8;
+// Error's own fields are non-enumerable, so a plain entry walk renders an
+// Error as `{}` and the name, message and stack a plugin logged are lost.
+// The tag check also recognises an Error from another realm (a worker or a
+// vm context), whose prototype is not this realm's Error.
+function isError(value) {
+    return (value instanceof Error ||
+        Object.prototype.toString.call(value) === '[object Error]');
+}
+export function createRedactor(options = {}) {
+    const patterns = [TOKEN_VALUE, ...(options.extraValuePatterns ?? [])].map((pattern) => new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`));
+    function isSecretKey(key) {
+        const normalized = key.toLowerCase().replace(/[-_]/g, '');
+        return (SECRET_KEY_EXACT.test(key) ||
+            normalized.includes('apikey') ||
+            normalized.endsWith('secret') ||
+            normalized.endsWith('password') ||
+            (normalized.endsWith('token') && !normalized.endsWith('tokens')) ||
+            !!options.extraSecretKeys?.(normalized));
+    }
+    // The fields every log reader wants first, then whatever else the error
+    // carries as its own enumerable properties (which is all an Error rendered
+    // as before). Every entry goes through the same key and string scrubbing as
+    // any other object, so a token in a message or stack is still masked.
+    function errorEntries(error) {
+        const fields = error;
+        const entries = [
+            ['name', error.name],
+            ['message', error.message],
+            ['stack', error.stack],
+        ];
+        for (const key of ['code', 'status', 'cause'])
+            if (fields[key] !== undefined)
+                entries.push([key, fields[key]]);
+        const listed = new Set(entries.map(([key]) => key));
+        for (const entry of Object.entries(error))
+            if (!listed.has(entry[0]))
+                entries.push(entry);
+        return entries;
+    }
+    function walk(value, keys, seen, errorDepth = 0) {
+        if (typeof value === 'string') {
+            return patterns.reduce((text, pattern) => text.replace(pattern, MASK), value);
+        }
+        if (!value || typeof value !== 'object')
+            return value;
+        if (seen.has(value))
+            return '[Circular]';
+        seen.add(value);
+        try {
+            if (Array.isArray(value))
+                return value.map((item) => walk(item, keys, seen, errorDepth));
+            const error = isError(value);
+            if (error && errorDepth >= MAX_ERROR_DEPTH)
+                return '[Truncated]';
+            const childDepth = error ? errorDepth + 1 : errorDepth;
+            // Define own properties so a diagnostic __proto__ key cannot change the output prototype.
+            return Object.fromEntries((error ? errorEntries(value) : Object.entries(value)).map(([key, item]) => [
+                key,
+                keys && isSecretKey(key)
+                    ? MASK
+                    : walk(item, keys, seen, childDepth),
+            ]));
+        }
+        finally {
+            seen.delete(value);
+        }
+    }
+    return {
+        redact: (value) => walk(value, true, new WeakSet()),
+        // Schema keys describe arguments, not credentials; only their string values are scrubbed.
+        redactStrings: (value) => walk(value, false, new WeakSet()),
+    };
+}
+const defaultRedactor = createRedactor();
+export const redact = defaultRedactor.redact;
+export const redactStrings = defaultRedactor.redactStrings;

package/src/tui-compiled/common-auth-embedded/quota/codec.js

@@ -0,0 +1,12 @@
+import { isQuotaMap } from "./map.js";
+import { mergeQuotaObservation } from "./merge.js";
+/**
+ * The quota codec the account-pool store (the `/store` subpath) takes when it
+ * is opened: `validate` checks a stored per-row quota map and `merge` applies
+ * an observation to one, so the store persists the map without interpreting
+ * it.
+ */
+export const quotaCodec = Object.freeze({
+    validate: isQuotaMap,
+    merge: mergeQuotaObservation,
+});

package/src/tui-compiled/common-auth-embedded/quota/format.js

@@ -0,0 +1,138 @@
+// The one quota wording every surface shows: the command menu's dialogs on
+// OpenCode and Pi, the terminal auth menu, and the plugins' sidebars. Each of
+// them calls `formatQuota` (or `quotaTextParts` for one line per window), so
+// the wording cannot drift between plugins or between a dialog and a sidebar.
+//
+// The rules: a window is named by its length (`5h`, `7d`), or, for a window
+// that binds only one model family, by the label the plugin stored it under.
+// Every figure is "% left". A window the provider did not report (an absence
+// record or a retirement tombstone) is left out rather than written as "not
+// reported". A reset is a short time from now (`resets 2h`). A reading older
+// than fifteen minutes says how old it is (`checked 3h ago`).
+//
+// Like the rest of this module it reads no clock: `now` is a parameter.
+import { ALL_SCOPE } from "./map.js";
+/** A reading older than this is marked with its age. */
+export const QUOTA_STALE_AFTER_MS = 15 * 60_000;
+/** What `formatQuota` returns when there is no reading at all. */
+export const NO_QUOTA_READING = 'no quota reading yet';
+/**
+ * What `formatQuota` returns when the provider answered but reported no
+ * limit for any window (every window is an absence record or a tombstone).
+ */
+export const NO_LIMITS_REPORTED = 'no limits reported';
+/**
+ * A length or a time span in its largest whole-ish unit: `45m`, `5h`, `3d`.
+ * Spans under an hour are minutes, under a day hours, otherwise days, each
+ * rounded to the nearest unit and never shown as zero.
+ */
+function shortSpan(ms) {
+    const minutes = Math.max(1, Math.round(ms / 60_000));
+    if (minutes < 60)
+        return `${minutes}m`;
+    const hours = Math.round(minutes / 60);
+    if (hours < 24)
+        return `${hours}h`;
+    return `${Math.max(1, Math.round(minutes / 1440))}d`;
+}
+/** A stored window length in minutes as its exact name: `5h`, `7d`, `90m`. */
+function lengthName(minutes) {
+    if (minutes % 1440 === 0)
+        return `${minutes / 1440}d`;
+    if (minutes % 60 === 0)
+        return `${minutes / 60}h`;
+    return `${minutes}m`;
+}
+/**
+ * The name a window is shown under. A general window (scope `all`) is named
+ * by its stored length; a model-scoped window keeps the label the plugin
+ * stored it under, which already names the model (`seven_day_opus`). A
+ * general window stored without a length (a snapshot from before lengths
+ * were recorded) falls back to its label.
+ */
+export function quotaWindowName(limit) {
+    if (limit.scope !== ALL_SCOPE || limit.windowMinutes === undefined)
+        return limit.label;
+    return lengthName(limit.windowMinutes);
+}
+function percentLeft(remaining) {
+    return `${Math.round(Math.min(100, Math.max(0, remaining)))}% left`;
+}
+function resetText(resetsAt, now) {
+    if (resetsAt === undefined)
+        return '';
+    const at = Date.parse(resetsAt);
+    // A reset already passed says nothing about the future; leave it out.
+    if (!Number.isFinite(at) || at <= now)
+        return '';
+    return `, resets ${shortSpan(at - now)}`;
+}
+/** Shortest window first, so `5h` reads before `7d`; unknown lengths last. */
+function displayOrder(left, right) {
+    const l = left.windowMinutes;
+    const r = right.windowMinutes;
+    if (l !== undefined && r !== undefined && l !== r)
+        return l - r;
+    if ((l === undefined) !== (r === undefined))
+        return l === undefined ? 1 : -1;
+    if (left.scope !== right.scope) {
+        if (left.scope === ALL_SCOPE)
+            return -1;
+        if (right.scope === ALL_SCOPE)
+            return 1;
+        return left.scope < right.scope ? -1 : 1;
+    }
+    return left.label < right.label ? -1 : left.label > right.label ? 1 : 0;
+}
+/**
+ * The pieces of a quota text, in order: one per reported window
+ * (`5h 58% left, resets 2h`), then the credit budget when there is one, then
+ * `checked 3h ago` when the oldest piece shown is stale. Empty when nothing
+ * was reported; `formatQuota` turns that into a sentence. A caller printing
+ * one line per window (the terminal auth menu) uses these directly.
+ */
+export function quotaTextParts(quota, options) {
+    if (!quota)
+        return [];
+    const { now } = options;
+    const full = (options.form ?? 'full') === 'full';
+    const parts = [];
+    const times = [];
+    const readings = quota.limits
+        .filter((limit) => limit.kind === 'reading' && limit.remainingPercent !== undefined)
+        .sort(displayOrder);
+    for (const limit of readings) {
+        times.push(limit.checkedAt);
+        parts.push(`${quotaWindowName(limit)} ${percentLeft(limit.remainingPercent ?? 0)}${full ? resetText(limit.resetsAt, now) : ''}`);
+    }
+    const budget = quota.budget;
+    if (budget) {
+        times.push(budget.checkedAt);
+        const figure = budget.reached
+            ? 'credits spent'
+            : budget.remainingPercent !== undefined
+                ? `credits ${percentLeft(budget.remainingPercent)}`
+                : 'credits available';
+        parts.push(`${figure}${full ? resetText(budget.resetsAt, now) : ''}`);
+    }
+    if (times.length > 0) {
+        const age = now - Math.min(...times);
+        if (age > (options.staleAfterMs ?? QUOTA_STALE_AFTER_MS))
+            parts.push(`checked ${shortSpan(age)} ago`);
+    }
+    return parts;
+}
+/**
+ * A row's quota as one line: `5h 58% left · 7d 90% left` in the compact
+ * form, with `, resets 2h` after each window in the full form. With nothing
+ * reported it is `NO_QUOTA_READING`, or `NO_LIMITS_REPORTED` when the
+ * provider answered without a limit for any window.
+ */
+export function formatQuota(quota, options) {
+    const parts = quotaTextParts(quota, options);
+    if (parts.length > 0)
+        return parts.join(' · ');
+    return quota && quota.limits.length > 0
+        ? NO_LIMITS_REPORTED
+        : NO_QUOTA_READING;
+}