@cortexkit/opencode-antigravity-auth 3.0.4 → 3.0.6

package/src/common-auth-embedded/claustrum/roster.d.ts

@@ -133,6 +133,19 @@ export declare function recordVaultQuota(path: string, input: QuotaReceipt & {
     routeId: string;
     observation: QuotaObservation;
 }): Promise<boolean>;
+/**
+ * Merge a quota observation that belongs to an account rather than to a
+ * served credential, such as a background reading from insula. The write
+ * lands only while the row is still bound to that exact known account, so a
+ * reading taken before a replacement never reaches the successor. Unlike
+ * `recordVaultQuota` it never binds an account: a row without a known account
+ * is refused. Returns whether the observation was kept.
+ */
+export declare function recordVaultAccountQuota(path: string, input: {
+    routeId: string;
+    accountIdentity: string;
+    observation: QuotaObservation;
+}): Promise<boolean>;
 /**
  * Discover and commit the roster. The lease covers the list call and the
  * commit, not just the write: an opaque view cannot tell a delayed old reply

package/src/common-auth-embedded/claustrum/roster.js

@@ -1,7 +1,7 @@
 import { createHash } from 'node:crypto';
 import { acquireRefreshFileLock, withLock, writeJsonAtomic, } from '../fs/index.js';
 import { readPrivateText, windowsPrivateFiles } from '../fs/private-files.js';
-import { isQuotaMap, mergeQuotaObservation, } from '../quota/index.js';
+import { decodeQuotaMap, mergeQuotaObservation, } from '../quota/index.js';
 import { ClaustrumConsumerError } from './errors.js';
 import { acceptAccount, declineAccount, isDeclined, } from './interlock.js';
 export const DEFAULT_ROUTE_PREFIX = 'vault:';
@@ -210,6 +210,7 @@ function optionalString(value) {
     return value === undefined || typeof value === 'string';
 }
 function decodeRow(value) {
+    const quota = isRecord(value) ? decodeQuotaMap(value.quota) : undefined;
     if (!isRecord(value) ||
         typeof value.routeId !== 'string' ||
         typeof value.credentialId !== 'string' ||
@@ -224,11 +225,14 @@ function decodeRow(value) {
         (value.aliases !== undefined &&
             (!Array.isArray(value.aliases) ||
                 !value.aliases.every((alias) => typeof alias === 'string'))) ||
-        (value.quota !== undefined && !isQuotaMap(value.quota)) ||
+        (value.quota !== undefined && quota === undefined) ||
         (value.stale !== undefined && value.stale !== true) ||
         (value.unclaimed !== undefined && value.unclaimed !== true))
         return undefined;
-    return value;
+    return {
+        ...value,
+        ...(quota === undefined ? {} : { quota }),
+    };
 }
 const SKIPPED_REASONS = new Set([
     'empty credential id',
@@ -435,6 +439,32 @@ export function recordVaultQuota(path, input) {
         };
     });
 }
+/**
+ * Merge a quota observation that belongs to an account rather than to a
+ * served credential, such as a background reading from insula. The write
+ * lands only while the row is still bound to that exact known account, so a
+ * reading taken before a replacement never reaches the successor. Unlike
+ * `recordVaultQuota` it never binds an account: a row without a known account
+ * is refused. Returns whether the observation was kept.
+ */
+export function recordVaultAccountQuota(path, input) {
+    return mutateVaultRoster(path, (current) => {
+        const row = current?.rows.find((entry) => entry.routeId === input.routeId);
+        if (!current ||
+            !row ||
+            row.accountIdentity === undefined ||
+            row.accountIdentity !== input.accountIdentity)
+            return { result: false };
+        const quota = mergeQuotaObservation(row.quota, input.observation);
+        return {
+            next: {
+                ...current,
+                rows: current.rows.map((entry) => entry === row ? { ...entry, quota } : entry),
+            },
+            result: true,
+        };
+    });
+}
 /**
  * Discover and commit the roster. The lease covers the list call and the
  * commit, not just the write: an opaque view cannot tell a delayed old reply

package/src/common-auth-embedded/fs/refresh-file-lock.js

@@ -1,8 +1,25 @@
 import { randomUUID } from 'node:crypto';
-import { mkdir, open, readFile, rename, rm, stat, writeFile, } from 'node:fs/promises';
+import { mkdir, open, readFile, rename, rm, stat } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { createPrivateBytes, createPrivateDirectoryExclusive, ensurePrivateDirectory, PrivateFileError, privateOperation, readPrivateText, verifyPrivate, windowsPrivateFiles, writePrivateAtomic, } from './private-files.js';
 import { LockOwnershipError, lockPathFor } from './with-lock.js';
+/**
+ * Create a new owner-only file and write `text` into it, failing with EEXIST if
+ * the file already exists. Writing through the handle rather than path-based
+ * `writeFile(path, …, { flag: 'wx' })` matters: Bun's path form also truncates
+ * the file it has just created, and on some Linux filesystems (XFS under load)
+ * that redundant ftruncate stalls for hundreds of milliseconds, inside every
+ * lock acquisition.
+ */
+async function createExclusiveText(path, text) {
+    const handle = await open(path, 'wx', 0o600);
+    try {
+        await handle.writeFile(text, 'utf8');
+    }
+    finally {
+        await handle.close();
+    }
+}
 const setRefreshLockRenewalTimeout = globalThis.setTimeout.bind(globalThis);
 const clearRefreshLockRenewalTimeout = globalThis.clearTimeout.bind(globalThis);
 // A concurrent contender renaming the freshly-created eviction-marker directory
@@ -152,11 +169,7 @@ export async function acquireRefreshFileLock(options) {
         if (windowsPrivateFiles)
             await createPrivateBytes(lockPath, bytes);
         else
-            await writeFile(lockPath, bytes, {
-                encoding: 'utf8',
-                mode: 0o600,
-                flag: 'wx',
-            });
+            await createExclusiveText(lockPath, bytes);
     }
     async function leaseContention(error) {
         const code = error.code;
@@ -304,11 +317,7 @@ export async function acquireRefreshFileLock(options) {
             if (windowsPrivateFiles)
                 await createPrivateBytes(evictOwnerPath, bytes);
             else
-                await writeFile(evictOwnerPath, bytes, {
-                    encoding: 'utf8',
-                    mode: 0o600,
-                    flag: 'wx',
-                });
+                await createExclusiveText(evictOwnerPath, bytes);
         }
         catch (error) {
             // A competing contender can rename our just-created marker directory

package/src/common-auth-embedded/quota/codec.d.ts

@@ -1,5 +1,7 @@
 export interface QuotaCodec {
     readonly validate: (value: unknown) => boolean;
+    /** Normalize persisted data before validation; older codecs may omit this. */
+    readonly decode?: (value: unknown) => unknown;
     readonly merge: (stored: unknown, observation: unknown) => unknown;
 }
 /**

package/src/common-auth-embedded/quota/codec.js

@@ -1,4 +1,4 @@
-import { isQuotaMap } from './map.js';
+import { decodeQuotaMap, isQuotaMap } from './map.js';
 import { mergeQuotaObservation } from './merge.js';
 /**
  * The quota codec the account-pool store (the `/store` subpath) takes when it
@@ -8,5 +8,6 @@ import { mergeQuotaObservation } from './merge.js';
  */
 export const quotaCodec = Object.freeze({
     validate: isQuotaMap,
+    decode: decodeQuotaMap,
     merge: mergeQuotaObservation,
 });

package/src/common-auth-embedded/quota/format.d.ts

@@ -21,6 +21,26 @@ export interface QuotaTextOptions {
     /** Defaults to `QUOTA_STALE_AFTER_MS`. */
     staleAfterMs?: number;
 }
+export interface QuotaWindowPart {
+    kind: 'window' | 'budget';
+    /** The display name of a quota window, or `credits` for the budget. */
+    name: string;
+    /** The shared figure wording, including `credits` for budget figures. */
+    figure: string;
+    /** The unrounded remaining percentage, clamped to 0–100, when known. */
+    remainingPercent?: number;
+    /** A bare relative reset span such as `4d`, only when the reset is future. */
+    resetIn?: string;
+    checkedAt: number;
+    /** Whether the reset followed this reading and has arrived by `now`. */
+    resetSinceReading: boolean;
+}
+export interface QuotaParts {
+    /** Reported windows in display order, followed by the budget when present. */
+    windows: QuotaWindowPart[];
+    /** The shared checked-age wording, present only when the reading is stale. */
+    age?: string;
+}
 /**
  * The name a window is shown under. A general window (scope `all`) is named
  * by its stored length; a model-scoped window keeps the label the plugin
@@ -29,6 +49,12 @@ export interface QuotaTextOptions {
  * were recorded) falls back to its label.
  */
 export declare function quotaWindowName(limit: Pick<ProjectedLimit, 'scope' | 'label' | 'windowMinutes'>): string;
+/**
+ * Structured quota wording for layouts that need one row per window. The
+ * windows use the same filtering and order as `quotaTextParts`; future resets
+ * and the optional age keep the shared formatter's wording.
+ */
+export declare function quotaWindowParts(quota: ProjectedQuota | undefined, options: QuotaTextOptions): QuotaParts;
 /**
  * The pieces of a quota text, in order: one per reported window
  * (`5h 58% left, resets 2h`), then the credit budget when there is one, then

package/src/common-auth-embedded/quota/format.js

@@ -1,7 +1,7 @@
 // The one quota wording every surface shows: the command menu's dialogs on
 // OpenCode and Pi, the terminal auth menu, and the plugins' sidebars. Each of
-// them calls `formatQuota` (or `quotaTextParts` for one line per window), so
-// the wording cannot drift between plugins or between a dialog and a sidebar.
+// them calls `formatQuota`, `quotaTextParts`, or `quotaWindowParts`, so the
+// wording cannot drift between plugins or between a dialog and a sidebar.
 //
 // The rules: a window is named by its length (`5h`, `7d`), or, for a window
 // that binds only one model family, by the label the plugin stored it under.
@@ -22,18 +22,23 @@ export const NO_QUOTA_READING = 'no quota reading yet';
  */
 export const NO_LIMITS_REPORTED = 'no limits reported';
 /**
- * A length or a time span in its largest whole-ish unit: `45m`, `5h`, `3d`.
- * Spans under an hour are minutes, under a day hours, otherwise days, each
- * rounded to the nearest unit and never shown as zero.
+ * A time span in at most its two largest units: `45m`, `2h29m`, `5h`, `3d23h`,
+ * `7d`. Every unit is rounded down, so a reset is never shown later than it is;
+ * the one exception is a span under a minute, which reads `1m` rather than
+ * zero. A zero second unit is left out.
  */
 function shortSpan(ms) {
-    const minutes = Math.max(1, Math.round(ms / 60_000));
+    const minutes = Math.max(1, Math.floor(ms / 60_000));
     if (minutes < 60)
         return `${minutes}m`;
-    const hours = Math.round(minutes / 60);
-    if (hours < 24)
-        return `${hours}h`;
-    return `${Math.max(1, Math.round(minutes / 1440))}d`;
+    if (minutes < 1440) {
+        const hours = Math.floor(minutes / 60);
+        const rest = minutes % 60;
+        return rest === 0 ? `${hours}h` : `${hours}h${rest}m`;
+    }
+    const days = Math.floor(minutes / 1440);
+    const hours = Math.floor((minutes % 1440) / 60);
+    return hours === 0 ? `${days}d` : `${days}d${hours}h`;
 }
 /** A stored window length in minutes as its exact name: `5h`, `7d`, `90m`. */
 function lengthName(minutes) {
@@ -55,17 +60,20 @@ export function quotaWindowName(limit) {
         return limit.label;
     return lengthName(limit.windowMinutes);
 }
+function clampPercent(remaining) {
+    return Math.min(100, Math.max(0, remaining));
+}
 function percentLeft(remaining) {
-    return `${Math.round(Math.min(100, Math.max(0, remaining)))}% left`;
+    return `${Math.round(clampPercent(remaining))}% left`;
 }
-function resetText(resetsAt, now) {
-    if (resetsAt === undefined)
-        return '';
-    const at = Date.parse(resetsAt);
-    // A reset already passed says nothing about the future; leave it out.
-    if (!Number.isFinite(at) || at <= now)
-        return '';
-    return `, resets ${shortSpan(at - now)}`;
+function resetDetails(resetsAt, checkedAt, now) {
+    const at = resetsAt === undefined ? Number.NaN : Date.parse(resetsAt);
+    return {
+        ...(Number.isFinite(at) && at > now
+            ? { resetIn: shortSpan(at - now) }
+            : {}),
+        resetSinceReading: Number.isFinite(at) && at > checkedAt && at <= now,
+    };
 }
 /** Shortest window first, so `5h` reads before `7d`; unknown lengths last. */
 function displayOrder(left, right) {
@@ -85,42 +93,70 @@ function displayOrder(left, right) {
     return left.label < right.label ? -1 : left.label > right.label ? 1 : 0;
 }
 /**
- * The pieces of a quota text, in order: one per reported window
- * (`5h 58% left, resets 2h`), then the credit budget when there is one, then
- * `checked 3h ago` when the oldest piece shown is stale. Empty when nothing
- * was reported; `formatQuota` turns that into a sentence. A caller printing
- * one line per window (the terminal auth menu) uses these directly.
+ * Structured quota wording for layouts that need one row per window. The
+ * windows use the same filtering and order as `quotaTextParts`; future resets
+ * and the optional age keep the shared formatter's wording.
  */
-export function quotaTextParts(quota, options) {
+export function quotaWindowParts(quota, options) {
     if (!quota)
-        return [];
+        return { windows: [] };
     const { now } = options;
-    const full = (options.form ?? 'full') === 'full';
-    const parts = [];
-    const times = [];
     const readings = quota.limits
         .filter((limit) => limit.kind === 'reading' && limit.remainingPercent !== undefined)
         .sort(displayOrder);
-    for (const limit of readings) {
-        times.push(limit.checkedAt);
-        parts.push(`${quotaWindowName(limit)} ${percentLeft(limit.remainingPercent ?? 0)}${full ? resetText(limit.resetsAt, now) : ''}`);
-    }
+    const windows = readings.map((limit) => {
+        const remainingPercent = clampPercent(limit.remainingPercent ?? 0);
+        return {
+            kind: 'window',
+            name: quotaWindowName(limit),
+            figure: percentLeft(limit.remainingPercent ?? 0),
+            remainingPercent,
+            checkedAt: limit.checkedAt,
+            ...resetDetails(limit.resetsAt, limit.checkedAt, now),
+        };
+    });
     const budget = quota.budget;
     if (budget) {
-        times.push(budget.checkedAt);
+        const remainingPercent = budget.remainingPercent;
         const figure = budget.reached
             ? 'credits spent'
-            : budget.remainingPercent !== undefined
-                ? `credits ${percentLeft(budget.remainingPercent)}`
+            : remainingPercent !== undefined
+                ? `credits ${percentLeft(remainingPercent)}`
                 : 'credits available';
-        parts.push(`${figure}${full ? resetText(budget.resetsAt, now) : ''}`);
+        windows.push({
+            kind: 'budget',
+            name: 'credits',
+            figure,
+            ...(remainingPercent === undefined
+                ? {}
+                : { remainingPercent: clampPercent(remainingPercent) }),
+            checkedAt: budget.checkedAt,
+            ...resetDetails(budget.resetsAt, budget.checkedAt, now),
+        });
     }
-    if (times.length > 0) {
-        const age = now - Math.min(...times);
-        if (age > (options.staleAfterMs ?? QUOTA_STALE_AFTER_MS))
-            parts.push(`checked ${shortSpan(age)} ago`);
+    if (windows.length > 0) {
+        const age = now - Math.min(...windows.map((part) => part.checkedAt));
+        if (age > (options.staleAfterMs ?? QUOTA_STALE_AFTER_MS)) {
+            return { windows, age: `checked ${shortSpan(age)} ago` };
+        }
     }
-    return parts;
+    return { windows };
+}
+/**
+ * The pieces of a quota text, in order: one per reported window
+ * (`5h 58% left, resets 2h`), then the credit budget when there is one, then
+ * `checked 3h ago` when the oldest piece shown is stale. Empty when nothing
+ * was reported; `formatQuota` turns that into a sentence. A caller printing
+ * one line per window (the terminal auth menu) uses these directly.
+ */
+export function quotaTextParts(quota, options) {
+    const parts = quotaWindowParts(quota, options);
+    const full = (options.form ?? 'full') === 'full';
+    const text = parts.windows.map((part) => {
+        const reset = full && part.resetIn ? `, resets ${part.resetIn}` : '';
+        return `${part.kind === 'budget' ? '' : `${part.name} `}${part.figure}${reset}`;
+    });
+    return parts.age === undefined ? text : [...text, parts.age];
 }
 /**
  * A row's quota as one line: `5h 58% left · 7d 90% left` in the compact

package/src/common-auth-embedded/quota/index.d.ts

@@ -1,9 +1,9 @@
 export type { QuotaCodec } from './codec.js';
 export { quotaCodec } from './codec.js';
-export type { QuotaTextForm, QuotaTextOptions } from './format.js';
-export { formatQuota, NO_LIMITS_REPORTED, NO_QUOTA_READING, QUOTA_STALE_AFTER_MS, quotaTextParts, quotaWindowName, } from './format.js';
-export type { CreditBudgetCleared, CreditBudgetEntry, CreditBudgetReading, QuotaAbsentEntry, QuotaEntry, QuotaMap, QuotaReadingEntry, QuotaRetiredEntry, } from './map.js';
-export { ALL_SCOPE, DEFAULT_REQUIRED_LABELS, emptyQuotaMap, isQuotaMap, } from './map.js';
+export type { QuotaParts, QuotaTextForm, QuotaTextOptions, QuotaWindowPart, } from './format.js';
+export { formatQuota, NO_LIMITS_REPORTED, NO_QUOTA_READING, QUOTA_STALE_AFTER_MS, quotaTextParts, quotaWindowName, quotaWindowParts, } from './format.js';
+export type { CreditBudgetCleared, CreditBudgetEntry, CreditBudgetReading, QuotaAbsentEntry, QuotaCounter, QuotaEntry, QuotaMap, QuotaReadingEntry, QuotaRetiredEntry, } from './map.js';
+export { ALL_SCOPE, DEFAULT_REQUIRED_LABELS, decodeQuotaMap, emptyQuotaMap, isQuotaMap, } from './map.js';
 export type { ObservedBudget, ObservedPair, ObservedReading, QuotaObservation, } from './merge.js';
 export { isQuotaObservation, mergeQuotaObservation, QuotaCodecError, } from './merge.js';
 export type { ExhaustionReset, ProjectedBudget, ProjectedLimit, ProjectedQuota, } from './projection.js';

package/src/common-auth-embedded/quota/index.js

@@ -1,5 +1,5 @@
 export { quotaCodec } from './codec.js';
-export { formatQuota, NO_LIMITS_REPORTED, NO_QUOTA_READING, QUOTA_STALE_AFTER_MS, quotaTextParts, quotaWindowName, } from './format.js';
-export { ALL_SCOPE, DEFAULT_REQUIRED_LABELS, emptyQuotaMap, isQuotaMap, } from './map.js';
+export { formatQuota, NO_LIMITS_REPORTED, NO_QUOTA_READING, QUOTA_STALE_AFTER_MS, quotaTextParts, quotaWindowName, quotaWindowParts, } from './format.js';
+export { ALL_SCOPE, DEFAULT_REQUIRED_LABELS, decodeQuotaMap, emptyQuotaMap, isQuotaMap, } from './map.js';
 export { isQuotaObservation, mergeQuotaObservation, QuotaCodecError, } from './merge.js';
 export { budgetExhaustedResetAt, futureResetAt, projectQuota, readsExhausted, } from './projection.js';

package/src/common-auth-embedded/quota/map.d.ts

@@ -44,16 +44,27 @@ export interface CreditBudgetCleared {
     checkedAt: number;
 }
 export type CreditBudgetEntry = CreditBudgetReading | CreditBudgetCleared;
+export interface QuotaCounter {
+    value: number;
+    checkedAt: number;
+}
 export interface QuotaMap {
     limits: QuotaEntry[];
     /** Absent means no observation has reported on the budget yet. */
     budget?: CreditBudgetEntry;
+    /** Provider-named counts, each with its own observation time. */
+    counters?: Record<string, QuotaCounter>;
 }
 export declare function emptyQuotaMap(): QuotaMap;
 /** The time an entry speaks for: its reading, retirement or absence time. */
 export declare function entryTime(entry: QuotaEntry): number;
 export declare function limitKey(scope: string, label: string): string;
 export declare function isCreditBudgetEntry(value: unknown): value is CreditBudgetEntry;
+export declare function isQuotaCounters(value: unknown): value is Record<string, QuotaCounter>;
+/** Keep usable counters without letting one malformed count hide a quota map. */
+export declare function readQuotaCounters(value: unknown): Record<string, QuotaCounter> | undefined;
+/** Decode persisted quota, dropping malformed counters but not limit evidence. */
+export declare function decodeQuotaMap(value: unknown): QuotaMap | undefined;
 /**
  * True when `value` is a well-formed quota map. Unrecognised top-level keys
  * are tolerated (and preserved by merge) so a newer writer's additions

package/src/common-auth-embedded/quota/map.js

@@ -83,6 +83,40 @@ export function isCreditBudgetEntry(value) {
         optional(value, 'remaining', isFiniteNumber) &&
         optional(value, 'unit', isString));
 }
+function isQuotaCounter(value) {
+    return (isRecord(value) &&
+        isFiniteNumber(value.value) &&
+        Number.isInteger(value.value) &&
+        value.value >= 0 &&
+        isFiniteNumber(value.checkedAt));
+}
+export function isQuotaCounters(value) {
+    return isRecord(value) && Object.values(value).every(isQuotaCounter);
+}
+/** Keep usable counters without letting one malformed count hide a quota map. */
+export function readQuotaCounters(value) {
+    if (!isRecord(value))
+        return undefined;
+    const entries = Object.entries(value).filter(([, entry]) => isQuotaCounter(entry));
+    return entries.length === 0
+        ? undefined
+        : Object.fromEntries(entries);
+}
+/** Decode persisted quota, dropping malformed counters but not limit evidence. */
+export function decodeQuotaMap(value) {
+    // A valid map is returned as the same object, so stored quota keeps the
+    // identity it had before counters existed; only a map with a malformed
+    // counter is copied without it.
+    if (isQuotaMap(value))
+        return value;
+    if (!isRecord(value))
+        return undefined;
+    const { counters: rawCounters, ...rest } = value;
+    if (!isQuotaMap(rest))
+        return undefined;
+    const counters = readQuotaCounters(rawCounters);
+    return { ...rest, ...(counters === undefined ? {} : { counters }) };
+}
 /**
  * True when `value` is a well-formed quota map. Unrecognised top-level keys
  * are tolerated (and preserved by merge) so a newer writer's additions
@@ -101,5 +135,6 @@ export function isQuotaMap(value) {
             return false;
         seen.add(key);
     }
-    return optional(value, 'budget', isCreditBudgetEntry);
+    return (optional(value, 'budget', isCreditBudgetEntry) &&
+        optional(value, 'counters', isQuotaCounters));
 }

package/src/common-auth-embedded/quota/merge.d.ts

@@ -1,4 +1,4 @@
-import { type QuotaMap } from './map.js';
+import { type QuotaCounter, type QuotaMap } from './map.js';
 export interface ObservedReading {
     /** Defaults to `all`. */
     scope?: string;
@@ -32,6 +32,8 @@ export interface QuotaObservation {
     coverage?: ObservedPair[];
     /** Absent means the observation says nothing about the budget. */
     budget?: ObservedBudget;
+    /** Each named count uses its own time, independently of limits and budget. */
+    counters?: Record<string, QuotaCounter>;
 }
 /** Thrown by `mergeQuotaObservation` when either argument is malformed. */
 export declare class QuotaCodecError extends TypeError {

package/src/common-auth-embedded/quota/merge.js

@@ -11,7 +11,7 @@
 // no entry gets an absence record. A pair outside the coverage is never
 // touched, so a header-shaped partial observation (which covers only what it
 // carries) cannot erase a family limit or the budget.
-import { ALL_SCOPE, entryTime, isQuotaMap, limitKey, } from './map.js';
+import { ALL_SCOPE, decodeQuotaMap, entryTime, isQuotaCounters, limitKey, } from './map.js';
 /** Thrown by `mergeQuotaObservation` when either argument is malformed. */
 export class QuotaCodecError extends TypeError {
     constructor(message) {
@@ -83,7 +83,8 @@ export function isQuotaObservation(value) {
     }
     if (!coverage.every(isObservedPair))
         return false;
-    return value.budget === undefined || isObservedBudget(value.budget);
+    return ((value.budget === undefined || isObservedBudget(value.budget)) &&
+        (value.counters === undefined || isQuotaCounters(value.counters)));
 }
 function compareEntries(left, right) {
     if (left.scope !== right.scope)
@@ -99,6 +100,16 @@ function mergeBudget(stored, observed, checkedAt) {
         return stored;
     return { ...observed, checkedAt };
 }
+function mergeCounters(stored, observed) {
+    const counters = new Map(Object.entries(stored ?? {}));
+    for (const [name, counter] of Object.entries(observed ?? {})) {
+        const existing = counters.get(name);
+        if (existing === undefined || counter.checkedAt >= existing.checkedAt) {
+            counters.set(name, counter);
+        }
+    }
+    return counters.size === 0 ? undefined : Object.fromEntries(counters);
+}
 /**
  * Applies `observation` to `stored` (undefined for a row with no map yet) and
  * returns the new map. Pure: neither argument is modified. Throws
@@ -106,13 +117,16 @@ function mergeBudget(stored, observed, checkedAt) {
  * write rather than persisting a map it could not read back.
  */
 export function mergeQuotaObservation(stored, observation) {
-    if (stored !== undefined && !isQuotaMap(stored)) {
+    // Decode the stored map the way reads do, so a malformed counter that reads
+    // already hide is dropped here too instead of refusing every later write.
+    const decoded = stored === undefined ? undefined : decodeQuotaMap(stored);
+    if (stored !== undefined && decoded === undefined) {
         throw new QuotaCodecError('stored quota map is malformed');
     }
     if (!isQuotaObservation(observation)) {
         throw new QuotaCodecError('quota observation is malformed');
     }
-    const base = stored ?? { limits: [] };
+    const base = decoded ?? { limits: [] };
     const at = observation.checkedAt;
     const entries = new Map();
     for (const entry of base.limits) {
@@ -152,11 +166,13 @@ export function mergeQuotaObservation(stored, observation) {
             : { scope, label: pair.label, kind: 'retired', retiredAt: at });
     }
     // Keys this module does not recognise are carried over untouched.
-    const { limits: _limits, budget: _budget, ...unknownKeys } = base;
+    const { limits: _limits, budget: _budget, counters: _counters, ...unknownKeys } = base;
     const budget = mergeBudget(base.budget, observation.budget, at);
+    const counters = mergeCounters(base.counters, observation.counters);
     return {
         ...unknownKeys,
         limits: [...entries.values()].sort(compareEntries),
         ...(budget === undefined ? {} : { budget }),
+        ...(counters === undefined ? {} : { counters }),
     };
 }

package/src/common-auth-embedded/quota/projection.d.ts

@@ -1,4 +1,4 @@
-import { type QuotaMap } from './map.js';
+import { type QuotaCounter, type QuotaMap } from './map.js';
 export interface ProjectedLimit {
     scope: string;
     label: string;
@@ -30,6 +30,7 @@ export interface ProjectedQuota {
     checkedAt?: number;
     /** Present only when the stored budget is a reading, not cleared. */
     budget?: ProjectedBudget;
+    counters?: Record<string, QuotaCounter>;
 }
 /**
  * Resolves `map` for a request in `scope` (`all` or a model family). A family

package/src/common-auth-embedded/quota/projection.js

@@ -6,7 +6,7 @@
 // scope, orders the result the way the primitives expect, and carries each
 // entry's (scope, label) so a decision names the limit it judged rather than
 // the position it occupied.
-import { ALL_SCOPE, } from './map.js';
+import { ALL_SCOPE, readQuotaCounters, } from './map.js';
 function project(entry) {
     if (entry.kind === 'retired') {
         return {
@@ -94,11 +94,13 @@ export function projectQuota(map, scope = ALL_SCOPE) {
         ? Math.min(...stamped.map((limit) => limit.checkedAt))
         : undefined;
     const budget = map?.budget?.kind === 'reading' ? projectBudget(map.budget) : undefined;
+    const counters = readQuotaCounters(map?.counters);
     return {
         scope,
         limits,
         ...(checkedAt === undefined ? {} : { checkedAt }),
         ...(budget === undefined ? {} : { budget }),
+        ...(counters === undefined ? {} : { counters }),
     };
 }
 /**

package/src/common-auth-embedded/setup/command-runner.js

@@ -0,0 +1,49 @@
+import { execFile } from 'node:child_process';
+export const defaultCommandRunner = {
+    run(file, args, options = {}) {
+        return new Promise((resolve) => {
+            const started = performance.now();
+            const timeoutMs = options.timeoutMs ?? 15_000;
+            execFile(file, [...args], {
+                env: options.env ?? process.env,
+                timeout: timeoutMs,
+                windowsHide: true,
+                windowsVerbatimArguments: options.windowsVerbatimArguments,
+                maxBuffer: 1024 * 1024,
+            }, (error, stdout, stderr) => {
+                const durationMs = performance.now() - started;
+                resolve({
+                    exitCode: error
+                        ? typeof error.code === 'number'
+                            ? error.code
+                            : 1
+                        : 0,
+                    stdout: String(stdout ?? ''),
+                    stderr: String(stderr ?? ''),
+                    signal: error?.signal ?? null,
+                    // Buffer-limit and spawn errors have string codes, not timeout kills.
+                    timedOut: error?.killed === true &&
+                        typeof error.code !== 'string' &&
+                        error.signal === 'SIGTERM' &&
+                        durationMs >= timeoutMs &&
+                        timeoutMs > 0,
+                    durationMs,
+                });
+            });
+        });
+    },
+};
+/** Batch launchers need cmd.exe; no free-form user text is accepted as shell arguments. */
+export function runResolvedCommand(runner, platform, file, args, env, timeoutMs = 15_000) {
+    if (platform === 'win32' && /\.(cmd|bat)$/i.test(file)) {
+        if (/["%!\r\n]/.test(file) ||
+            args.some((arg) => !/^[a-zA-Z0-9@:/._+-]+$/.test(arg)))
+            throw new Error('Unsafe batch launcher or argument; use an executable instead.');
+        return runner.run('cmd.exe', ['/d', '/s', '/c', `""${file}" ${args.join(' ')}"`], {
+            env,
+            timeoutMs,
+            windowsVerbatimArguments: true,
+        });
+    }
+    return runner.run(file, args, { env, timeoutMs });
+}

package/src/common-auth-embedded/setup/command.d.ts

@@ -0,0 +1,3 @@
+import type { SetupIO, SetupPlugin, SetupResult } from './types.js';
+export declare const AMBIGUOUS_OPENCODE_MESSAGE = "Multiple OpenCode generations found. Choose --opencode=1|2|both before running noninteractive setup.";
+export declare function runSetup(plugin: SetupPlugin, argv?: readonly string[], io?: SetupIO): Promise<SetupResult>;