@dotobokuri/fleet-console 1.57.1 → 1.58.0

package/dist/fleet-plugins/quota/routes.mjs

@@ -2,7 +2,7 @@
 import { execFile } from 'node:child_process';
 import * as fs4 from 'node:fs';
 import fs4__default, { constants } from 'node:fs';
-import fs5 from 'node:fs/promises';
+import fs32 from 'node:fs/promises';
 import * as os3 from 'node:os';
 import os3__default from 'node:os';
 import { promisify } from 'node:util';
@@ -19,16 +19,16 @@ var __export = (target, all) => {
 function definePlugin(definition) {
   return definition;
 }
-function registerRouter(ctx, path5, handler, catalog) {
+function registerRouter(ctx, path6, handler, catalog) {
   if (catalog) {
-    ctx.registerRouter(normalizePath(path5), handler, catalog);
+    ctx.registerRouter(normalizePath(path6), handler, catalog);
     return;
   }
-  ctx.registerRouter(normalizePath(path5), handler);
+  ctx.registerRouter(normalizePath(path6), handler);
 }
-function normalizePath(path5) {
-  if (path5.length === 0 || path5 === "/") return "/";
-  return path5;
+function normalizePath(path6) {
+  if (path6.length === 0 || path6 === "/") return "/";
+  return path6;
 }
 
 // ../../node_modules/.pnpm/zod@4.4.1/node_modules/zod/v4/classic/external.js
@@ -793,10 +793,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path5) {
-  if (!path5)
+function getElementAtPath(obj, path6) {
+  if (!path6)
     return obj;
-  return path5.reduce((acc, key) => acc?.[key], obj);
+  return path6.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -1205,11 +1205,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path5, issues) {
+function prefixIssues(path6, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path5);
+    iss.path.unshift(path6);
     return iss;
   });
 }
@@ -1356,16 +1356,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path5 = []) => {
+  const processError = (error52, path6 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path5, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path6, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
       } else {
-        const fullpath = [...path5, ...issue2.path];
+        const fullpath = [...path6, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1392,17 +1392,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path5 = []) => {
+  const processError = (error52, path6 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path5, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path6, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
       } else {
-        const fullpath = [...path5, ...issue2.path];
+        const fullpath = [...path6, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -1434,8 +1434,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path5 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path5) {
+  const path6 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path6) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -14099,13 +14099,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path5 = ref.slice(1).split("/").filter(Boolean);
-  if (path5.length === 0) {
+  const path6 = ref.slice(1).split("/").filter(Boolean);
+  if (path6.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path5[0] === defsKey) {
-    const key = path5[1];
+  if (path6[0] === defsKey) {
+    const key = path6[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -17093,8 +17093,8 @@ function bootEnumDescriptorProto(init) {
 }
 
 // ../../node_modules/.pnpm/@bufbuild+protobuf@2.13.0/node_modules/@bufbuild/protobuf/dist/esm/codegenv2/message.js
-function messageDesc(file2, path5, ...paths) {
-  return paths.reduce((acc, cur) => acc.nestedMessages[cur], file2.messages[path5]);
+function messageDesc(file2, path6, ...paths) {
+  return paths.reduce((acc, cur) => acc.nestedMessages[cur], file2.messages[path6]);
 }
 
 // ../../node_modules/.pnpm/@bufbuild+protobuf@2.13.0/node_modules/@bufbuild/protobuf/dist/esm/wkt/gen/google/protobuf/descriptor_pb.js
@@ -17820,7 +17820,7 @@ var benchmarks_default = {
     cursorbench: {
       name: "CursorBench",
       benchVersion: "3.2",
-      observedAt: "2026-07-30T00:00:00Z",
+      observedAt: "2026-08-13T00:00:00Z",
       url: "https://cursor.com/cursorbench",
       method: "Third-party agentic-coding benchmark: ambiguous multi-file tasks from real Cursor sessions, run in Cursor's own harness. Scores are evidence about the vendor model and transfer across gateway providers serving it; token and step figures are harness-relative efficiency signals, not billing facts.",
       routingTieBandPoints: 2
@@ -17938,6 +17938,31 @@ var benchmarks_default = {
       },
       caveat: "Bench footnote: an earlier snapshot of Cursor's codebase was unintentionally present in this model's training data, inflating scores by an unknown amount; the advantage does not transfer to other repositories."
     },
+    "grok-4.6": {
+      source: "cursorbench",
+      rungs: {
+        low: {
+          score: 61,
+          tokensPerTask: 10658,
+          stepsPerTask: 23
+        },
+        medium: {
+          score: 67.1,
+          tokensPerTask: 17942,
+          stepsPerTask: 29
+        },
+        high: {
+          score: 69.9,
+          tokensPerTask: 32449,
+          stepsPerTask: 39
+        },
+        xhigh: {
+          score: 70.8,
+          tokensPerTask: 41136,
+          stepsPerTask: 46
+        }
+      }
+    },
     "kimi-k3": {
       source: "cursorbench",
       rungs: {
@@ -17986,7 +18011,7 @@ var benchmarks_default = {
 };
 var models_default = {
   version: 1,
-  updatedAt: "2026-08-11T00:00:00Z",
+  updatedAt: "2026-08-14T00:00:00Z",
   providers: {
     codex: {
       name: "Codex",
@@ -18128,7 +18153,7 @@ var models_default = {
     cursor: {
       name: "Cursor",
       defaultModel: "auto",
-      source: "Cursor GetUsableModels + Run conversationCheckpointUpdate.token_details.max_tokens (cli-2026.07.08-0c04a8a; auto, composer-2.5, and grok-4.5 families observed 2026-08-01); quotaScope from DashboardService/GetCurrentPeriodUsage autoBucketModels (2026-08-05)",
+      source: "Cursor GetUsableModels + Run conversationCheckpointUpdate.token_details.max_tokens (cli-2026.07.08-0c04a8a; auto, composer-2.5, and grok-4.5 families observed 2026-08-01); cursor-agent 2026.08.11-e8db854 observed 2026-08-13 for grok-4.6; quotaScope from DashboardService/GetCurrentPeriodUsage autoBucketModels (2026-08-05)",
       models: [
         {
           modelId: "auto",
@@ -18187,6 +18212,41 @@ var models_default = {
             ],
             upstreamModelIdTemplate: "cursor-grok-4.5-{effort}-fast"
           }
+        },
+        {
+          modelId: "grok-4.6",
+          name: "Grok-4.6",
+          capabilityClass: "flagship",
+          quotaScope: "auto",
+          contextWindow: 256e3,
+          effort: {
+            supported: true,
+            levels: [
+              "low",
+              "medium",
+              "high",
+              "xhigh"
+            ],
+            upstreamModelIdTemplate: "cursor-grok-4.6-{effort}"
+          },
+          benchmarkKey: "grok-4.6"
+        },
+        {
+          modelId: "grok-4.6-fast",
+          name: "Grok-4.6-Fast",
+          capabilityClass: "light",
+          quotaScope: "auto",
+          contextWindow: 256e3,
+          effort: {
+            supported: true,
+            levels: [
+              "low",
+              "medium",
+              "high",
+              "xhigh"
+            ],
+            upstreamModelIdTemplate: "cursor-grok-4.6-{effort}-fast"
+          }
         }
       ]
     },
@@ -18336,12 +18396,36 @@ var models_default = {
           contextWindow: 256e3
         }
       ]
+    },
+    xai: {
+      name: "xAI",
+      defaultModel: "grok-4.6",
+      source: "official Grok CLI 1.0.3 ~/.grok/models_cache.json from GET https://cli-chat-proxy.grok.com/v1/models (observed 2026-08-13)",
+      models: [
+        {
+          modelId: "grok-4.6",
+          name: "Grok-4.6",
+          capabilityClass: "flagship",
+          wire: "responses",
+          contextWindow: 5e5,
+          effort: {
+            supported: true,
+            levels: [
+              "low",
+              "medium",
+              "high",
+              "xhigh"
+            ]
+          },
+          benchmarkKey: "grok-4.6"
+        }
+      ]
     }
   }
 };
 var KIMI_AUTH_PROVIDER_ID = "Claude Code with Moonshot Kimi";
 var KIMI_CODE_API_BASE_URL = "https://api.kimi.com/coding";
-var GATEWAY_PROVIDERS = ["codex", "cursor", "kimi", "opencode"];
+var GATEWAY_PROVIDERS = ["codex", "xai", "cursor", "opencode", "kimi"];
 var GATEWAY_MODEL_WIRES = ["anthropic", "responses", "chat-completions"];
 var GATEWAY_REASONING_EFFORTS = [
   "low",
@@ -18429,7 +18513,8 @@ var GatewayModelsRegistrySchema = external_exports.object({
     codex: GatewayProviderSchema,
     cursor: GatewayProviderSchema,
     kimi: GatewayProviderSchema,
-    opencode: GatewayProviderSchema
+    opencode: GatewayProviderSchema,
+    xai: GatewayProviderSchema
   }).strict()
 }).strict();
 var UNSUPPORTED_GATEWAY_MODEL_EFFORT = Object.freeze({ supported: false });
@@ -18616,8 +18701,8 @@ function validateRegistry(value) {
       if (model.quotaScope && provider !== "cursor") {
         throw new Error(`Gateway quota scope is only supported by Cursor: ${provider}/${model.modelId}`);
       }
-      if (model.wire && provider !== "opencode") {
-        throw new Error(`Gateway model wire is only supported by OpenCode: ${provider}/${model.modelId}`);
+      if (model.wire && provider !== "opencode" && provider !== "xai") {
+        throw new Error(`Gateway model wire is not supported by provider: ${provider}/${model.modelId}`);
       }
       if (model.effort?.supported) {
         if (new Set(model.effort.levels).size !== model.effort.levels.length) {
@@ -18913,7 +18998,7 @@ var execFileAsync = promisify(execFile);
 var MAX_CREDENTIAL_BYTES = 65536;
 var CREDENTIAL_OPEN_FLAGS = process.platform === "win32" ? constants.O_RDONLY : constants.O_RDONLY | constants.O_NONBLOCK;
 async function readBoundedFile(filePath, maxBytes) {
-  const handle = await fs5.open(filePath, CREDENTIAL_OPEN_FLAGS);
+  const handle = await fs32.open(filePath, CREDENTIAL_OPEN_FLAGS);
   try {
     const stat2 = await handle.stat();
     if (!stat2.isFile() || stat2.size > maxBytes) return null;
@@ -19145,9 +19230,9 @@ function parseResetCredits(payload) {
   for (let index = 0; index < credits.length && index < MAX_CREDIT_ENTRIES; index += 1) {
     const credit = object2(credits[index]);
     if (credit?.status !== "available") continue;
-    const expiry = safeTimestamp(credit.expires_at);
-    if (expiry !== void 0 && (nextExpiresAt === void 0 || expiry < nextExpiresAt)) {
-      nextExpiresAt = expiry;
+    const expiry2 = safeTimestamp(credit.expires_at);
+    if (expiry2 !== void 0 && (nextExpiresAt === void 0 || expiry2 < nextExpiresAt)) {
+      nextExpiresAt = expiry2;
     }
   }
   return {
@@ -19167,7 +19252,7 @@ async function fetchCodexUsage(deps = {}) {
   if (credentials.accountId) headers["ChatGPT-Account-Id"] = credentials.accountId;
   try {
     const fetchImpl = deps.fetch ?? fetch;
-    const usage3 = parseCodexUsage(await getJson(fetchImpl, "https://chatgpt.com/backend-api/wham/usage", headers));
+    const usage4 = parseCodexUsage(await getJson(fetchImpl, "https://chatgpt.com/backend-api/wham/usage", headers));
     let credits;
     try {
       credits = parseResetCredits(await getJson(
@@ -19180,8 +19265,8 @@ async function fetchCodexUsage(deps = {}) {
     }
     return {
       status: "ok",
-      plan: usage3.plan,
-      windows: usage3.windows,
+      plan: usage4.plan,
+      windows: usage4.windows,
       ...credits ? { credits } : {},
       fetchedAt: (deps.now ?? Date.now)()
     };
@@ -19295,12 +19380,12 @@ async function fetchCursorUsage(deps = {}) {
   };
   try {
     const fetchImpl = deps.fetch ?? fetch;
-    const usage3 = parseCursorUsage(await postJson(
+    const usage4 = parseCursorUsage(await postJson(
       fetchImpl,
       "https://api2.cursor.sh/aiserver.v1.DashboardService/GetCurrentPeriodUsage",
       headers
     ));
-    if (usage3.status === "no_subscription") return { status: "no_subscription", method: credentials.method };
+    if (usage4.status === "no_subscription") return { status: "no_subscription", method: credentials.method };
     let plan;
     try {
       const planRoot = object2(await postJson(
@@ -19316,8 +19401,8 @@ async function fetchCursorUsage(deps = {}) {
       status: "ok",
       method: credentials.method,
       ...plan ? { plan } : {},
-      ...usage3.cycleDays !== void 0 ? { cycleDays: usage3.cycleDays } : {},
-      windows: usage3.windows,
+      ...usage4.cycleDays !== void 0 ? { cycleDays: usage4.cycleDays } : {},
+      windows: usage4.windows,
       fetchedAt: (deps.now ?? Date.now)()
     };
   } catch (error51) {
@@ -19402,16 +19487,16 @@ async function fetchKimiUsage(deps = {}) {
   const apiKey = await deps.authService.getApiKey(KIMI_AUTH_PROVIDER_ID);
   if (!apiKey) return { status: "signed_out" };
   try {
-    const usage3 = parseKimiUsage(await getJson(
+    const usage4 = parseKimiUsage(await getJson(
       deps.fetch ?? fetch,
       `${KIMI_CODE_API_BASE_URL}/v1/usages`,
       { Authorization: `Bearer ${apiKey}`, Accept: "application/json" }
     ));
-    if (usage3.status === "no_subscription") return { status: "no_subscription" };
+    if (usage4.status === "no_subscription") return { status: "no_subscription" };
     return {
       status: "ok",
-      ...usage3.plan ? { plan: usage3.plan } : {},
-      windows: usage3.windows,
+      ...usage4.plan ? { plan: usage4.plan } : {},
+      windows: usage4.windows,
       fetchedAt: (deps.now ?? Date.now)()
     };
   } catch (error51) {
@@ -19621,6 +19706,268 @@ async function fetchOpencodeUsage(deps = {}) {
     fetchedAt: now()
   };
 }
+var XAI_OIDC_ISSUER = "https://auth.x.ai";
+var XAI_CLI_REFRESH_URL = "https://auth.x.ai/oauth2/token";
+var XAI_CLI_DEFAULT_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+var XAI_CLI_REFRESH_BUFFER_MS = 5 * 60 * 1e3;
+var REFRESH_TIMEOUT_MS = 15e3;
+var FALLBACK_ACCESS_TOKEN_TTL_MS = 36e5;
+function xaiCliAuthFilePath(deps) {
+  return path32__default.join(deps.env.GROK_HOME || path32__default.join(deps.homedir(), ".grok"), "auth.json");
+}
+function expiry(value) {
+  if (typeof value !== "string" && typeof value !== "number") return void 0;
+  const parsed = typeof value === "number" ? value : Date.parse(value);
+  if (!Number.isFinite(parsed)) return void 0;
+  return parsed < 1e12 ? Math.round(parsed * 1e3) : Math.round(parsed);
+}
+function jwtExpiry(token) {
+  const parts = token.split(".");
+  if (parts.length < 2) return void 0;
+  try {
+    const payload = JSON.parse(Buffer.from(parts[1] ?? "", "base64url").toString("utf8"));
+    const record4 = credentialRecord(payload);
+    const exp = record4?.exp;
+    if (typeof exp !== "number" || !Number.isFinite(exp)) return void 0;
+    return Math.round(exp * 1e3);
+  } catch {
+    return void 0;
+  }
+}
+function effectiveExpiry(entry, accessToken) {
+  const fromEntry = expiry(entry.expires_at) ?? expiry(entry.expires);
+  const fromJwt = jwtExpiry(accessToken);
+  if (fromEntry !== void 0 && fromJwt !== void 0) return Math.min(fromEntry, fromJwt);
+  return fromEntry ?? fromJwt;
+}
+function clientId(entryKey, entry) {
+  const fromEntry = optionalTrimmedString(entry.oidc_client_id);
+  if (fromEntry) return fromEntry;
+  const suffix = optionalTrimmedString(entryKey.split("::").at(-1));
+  return suffix ?? XAI_CLI_DEFAULT_CLIENT_ID;
+}
+function refreshToken(entry) {
+  return optionalTrimmedString(entry.refresh_token) ?? optionalTrimmedString(entry.refresh);
+}
+async function defaultWriteAuthFile(filePath, contents) {
+  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    await fs32.writeFile(tmpPath, contents, { encoding: "utf8", mode: 384 });
+    await fs32.rename(tmpPath, filePath);
+  } catch (error51) {
+    await fs32.unlink(tmpPath).catch(() => void 0);
+    throw error51;
+  }
+}
+async function persistRefreshedEntry(deps, filePath, entryKey, expected, patch, writeAuthFile) {
+  const raw = await deps.readBounded(filePath, MAX_CREDENTIAL_BYTES);
+  if (raw === null) return;
+  const auth = credentialRecord(JSON.parse(raw));
+  if (!auth) return;
+  const current = credentialRecord(auth[entryKey]);
+  if (!current) return;
+  if (optionalTrimmedString(current.key) !== expected.accessToken) return;
+  if (expected.refreshToken !== void 0 && refreshToken(current) !== expected.refreshToken) return;
+  auth[entryKey] = { ...current, ...patch };
+  await writeAuthFile(filePath, `${JSON.stringify(auth, null, 2)}
+`);
+}
+async function refreshAccessToken(entryKey, entry, fetchImpl, now) {
+  const token = refreshToken(entry);
+  if (!token) return null;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), REFRESH_TIMEOUT_MS);
+  try {
+    const body = new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: clientId(entryKey, entry),
+      refresh_token: token
+    });
+    const response = await fetchImpl(XAI_CLI_REFRESH_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+      body,
+      signal: controller.signal
+    });
+    if (!response.ok) return null;
+    const payload = credentialRecord(await response.json());
+    const accessToken = optionalTrimmedString(payload?.access_token);
+    if (!accessToken) return null;
+    const expiresIn = payload?.expires_in;
+    const expiresAt = typeof expiresIn === "number" && Number.isFinite(expiresIn) && expiresIn > 0 ? now() + Math.round(expiresIn * 1e3) : jwtExpiry(accessToken) ?? now() + FALLBACK_ACCESS_TOKEN_TTL_MS;
+    const rotated = optionalTrimmedString(payload?.refresh_token);
+    return {
+      accessToken,
+      expiresAt,
+      ...rotated === void 0 ? {} : { refreshToken: rotated }
+    };
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function resolveXaiCliAuth(deps, options = {}) {
+  const now = options.now ?? Date.now;
+  const fetchImpl = options.fetch ?? fetch;
+  const writeAuthFile = options.writeAuthFile ?? defaultWriteAuthFile;
+  const filePath = xaiCliAuthFilePath(deps);
+  try {
+    const raw = await deps.readBounded(filePath, MAX_CREDENTIAL_BYTES);
+    if (raw === null || raw.length > MAX_CREDENTIAL_BYTES) return { status: "signed_out" };
+    const auth = credentialRecord(JSON.parse(raw));
+    if (!auth) return { status: "signed_out" };
+    let sawExpired = false;
+    for (const [entryKey, value] of Object.entries(auth)) {
+      if (!entryKey.startsWith(`${XAI_OIDC_ISSUER}::`)) continue;
+      const entry = credentialRecord(value);
+      const issuer = optionalTrimmedString(entry?.oidc_issuer);
+      const accessToken = optionalTrimmedString(entry?.key);
+      if (!entry || issuer !== XAI_OIDC_ISSUER || !accessToken) continue;
+      const expiresAt = effectiveExpiry(entry, accessToken);
+      const expired2 = expiresAt !== void 0 && expiresAt <= now();
+      const needsRefresh = options.forceRefresh === true || expiresAt !== void 0 && expiresAt - now() <= XAI_CLI_REFRESH_BUFFER_MS;
+      if (needsRefresh) {
+        const refreshed = await refreshAccessToken(entryKey, entry, fetchImpl, now);
+        if (refreshed) {
+          const userId2 = optionalTrimmedString(entry.user_id) ?? optionalTrimmedString(entry.principal_id);
+          const patch = {
+            key: refreshed.accessToken,
+            expires_at: new Date(refreshed.expiresAt).toISOString()
+          };
+          if (refreshed.refreshToken !== void 0) patch.refresh_token = refreshed.refreshToken;
+          try {
+            await persistRefreshedEntry(
+              deps,
+              filePath,
+              entryKey,
+              { accessToken, refreshToken: refreshToken(entry) },
+              patch,
+              writeAuthFile
+            );
+          } catch {
+          }
+          return {
+            status: "ok",
+            credentials: {
+              accessToken: refreshed.accessToken,
+              expiresAt: refreshed.expiresAt,
+              ...userId2 === void 0 ? {} : { userId: userId2 }
+            }
+          };
+        }
+        if (options.forceRefresh === true || expired2) {
+          sawExpired = true;
+          continue;
+        }
+      } else if (expired2) {
+        sawExpired = true;
+        continue;
+      }
+      const userId = optionalTrimmedString(entry.user_id) ?? optionalTrimmedString(entry.principal_id);
+      return {
+        status: "ok",
+        credentials: {
+          accessToken,
+          ...expiresAt === void 0 ? {} : { expiresAt },
+          ...userId === void 0 ? {} : { userId }
+        }
+      };
+    }
+    return { status: sawExpired ? "expired" : "signed_out" };
+  } catch {
+    return { status: "signed_out" };
+  }
+}
+var XAI_CLI_CREDITS_URL = "https://cli-chat-proxy.grok.com/v1/billing?format=credits";
+var WEEKLY_PERIOD = "USAGE_PERIOD_TYPE_WEEKLY";
+function parseXaiCredits(payload) {
+  const root = object2(payload);
+  const config2 = object2(root?.config);
+  const period = object2(config2?.currentPeriod);
+  const periodType = typeof period?.type === "string" ? period.type.trim() : "";
+  if (!config2 || !period || periodType.length === 0) return null;
+  const startsAt = safeTimestamp(period.start);
+  const resetsAt = safeTimestamp(period.end);
+  if (startsAt === void 0 || resetsAt === void 0 || resetsAt <= startsAt) return null;
+  if (periodType !== WEEKLY_PERIOD) return { status: "other" };
+  let usedPercent = 0;
+  if (config2.creditUsagePercent !== void 0) {
+    if (typeof config2.creditUsagePercent !== "number" || !Number.isFinite(config2.creditUsagePercent)) {
+      return null;
+    }
+    usedPercent = percent(config2.creditUsagePercent);
+  }
+  return {
+    status: "weekly",
+    window: {
+      id: "weekly",
+      usedPercent,
+      resetsAt,
+      period: {
+        durationMs: resetsAt - startsAt,
+        durationBasis: "upstream",
+        startsAt,
+        startsAtBasis: "upstream"
+      }
+    }
+  };
+}
+function creditsHeaders(credentials) {
+  const headers = {
+    Accept: "application/json",
+    Authorization: `Bearer ${credentials.accessToken}`,
+    "X-XAI-Token-Auth": "xai-grok-cli"
+  };
+  if (credentials.userId) headers["x-userid"] = credentials.userId;
+  return headers;
+}
+async function fetchXaiUsage(deps = {}) {
+  const credentialDeps = deps.credentials ?? defaultCredentialDeps;
+  const now = deps.now ?? Date.now;
+  const fetchImpl = deps.fetch ?? fetch;
+  const auth = await resolveXaiCliAuth(credentialDeps, { now, fetch: fetchImpl });
+  if (auth.status !== "ok") return { status: auth.status };
+  const load = (credentials) => getJson(
+    fetchImpl,
+    XAI_CLI_CREDITS_URL,
+    creditsHeaders(credentials)
+  );
+  try {
+    let credentials = auth.credentials;
+    let payload;
+    try {
+      payload = await load(credentials);
+    } catch (error51) {
+      if (!expired(error51)) throw error51;
+      const retried = await resolveXaiCliAuth(credentialDeps, {
+        now,
+        fetch: fetchImpl,
+        forceRefresh: true
+      });
+      if (retried.status !== "ok") return { status: "expired" };
+      credentials = retried.credentials;
+      try {
+        payload = await load(credentials);
+      } catch (retryError) {
+        const result = expired(retryError);
+        if (result) return result;
+        throw retryError;
+      }
+    }
+    const parsed = parseXaiCredits(payload);
+    if (!parsed) throw new Error("Grok returned an unsupported quota response");
+    return {
+      status: "ok",
+      windows: parsed.status === "weekly" ? [parsed.window] : [],
+      fetchedAt: now()
+    };
+  } catch (error51) {
+    const result = expired(error51);
+    if (result) return result;
+    throw error51;
+  }
+}
 var CACHE_TTL_MS = 12e4;
 var STALE_TTL_MS = 18e5;
 function createAiGatewayQuotaCollectors(deps) {
@@ -19636,7 +19983,8 @@ function createAiGatewayQuotaCollectors(deps) {
     fetchCodex: () => fetchCodexUsage(providerDeps),
     fetchCursor: () => fetchCursorUsage(providerDeps),
     fetchKimi: () => fetchKimiUsage(providerDeps),
-    fetchOpencode: () => fetchOpencodeUsage(providerDeps)
+    fetchOpencode: () => fetchOpencodeUsage(providerDeps),
+    fetchXai: () => fetchXaiUsage(providerDeps)
   };
 }
 function isProviderSuccess(value) {
@@ -19649,7 +19997,8 @@ function createQuotaService(deps) {
     codex: deps.fetchCodex,
     cursor: deps.fetchCursor,
     kimi: deps.fetchKimi,
-    opencode: deps.fetchOpencode
+    opencode: deps.fetchOpencode,
+    xai: deps.fetchXai ?? (async () => ({ status: "signed_out" }))
   };
   const cache = /* @__PURE__ */ new Map();
   const lastGood = /* @__PURE__ */ new Map();
@@ -19692,12 +20041,13 @@ function createQuotaService(deps) {
   }
   return {
     async getSummary(options = {}) {
-      const [claude, codex, cursor, kimi, opencode] = await Promise.all([
+      const [claude, codex, cursor, kimi, opencode, xai] = await Promise.all([
         load("claude", options.force === true || options.forceProvider === "claude"),
         load("codex", options.force === true || options.forceProvider === "codex"),
         load("cursor", options.force === true || options.forceProvider === "cursor"),
         load("kimi", options.force === true || options.forceProvider === "kimi"),
-        load("opencode", options.force === true || options.forceProvider === "opencode")
+        load("opencode", options.force === true || options.forceProvider === "opencode"),
+        load("xai", options.force === true || options.forceProvider === "xai")
       ]);
       return {
         providers: {
@@ -19705,7 +20055,8 @@ function createQuotaService(deps) {
           codex: withRisk(codex),
           cursor: withRisk(cursor),
           kimi: withRisk(kimi),
-          opencode: withRisk(opencode)
+          opencode: withRisk(opencode),
+          xai: withRisk(xai)
         }
       };
     }
@@ -20568,7 +20919,36 @@ messageDesc(cursorAgentFile, 63);
 messageDesc(cursorAgentFile, 70);
 new Set(REASONING_EFFORTS);
 
+// ../fleet-plugins/quota/provider-order.ts
+var PROVIDER_ORDER_DEFAULT = ["claude", "codex", "xai", "cursor", "opencode", "kimi"];
+function isProviderId(value) {
+  return PROVIDER_ORDER_DEFAULT.includes(value);
+}
+function sanitizeProviderOrder(value) {
+  const order = [];
+  if (Array.isArray(value)) {
+    for (const entry of value) {
+      if (isProviderId(entry) && !order.includes(entry)) order.push(entry);
+    }
+  }
+  for (const id of PROVIDER_ORDER_DEFAULT) {
+    if (!order.includes(id)) order.push(id);
+  }
+  return order;
+}
+
 // ../fleet-plugins/quota/server/handlers.ts
+async function readStoredSettings(ctx) {
+  const stored = await ctx.host.storage.readJson("quota", "settings");
+  return stored !== null && typeof stored === "object" && !Array.isArray(stored) ? stored : {};
+}
+function retainedSettings(settings) {
+  return {
+    ...typeof settings.claudeConnected === "boolean" ? { claudeConnected: settings.claudeConnected } : {},
+    ...typeof settings.cursorConnected === "boolean" ? { cursorConnected: settings.cursorConnected } : {},
+    ...Array.isArray(settings.providerOrder) ? { providerOrder: sanitizeProviderOrder(settings.providerOrder) } : {}
+  };
+}
 async function handleSummary(req, res, ctx, service) {
   if (req.method !== "GET") {
     ctx.host.http.writeJson(res, 405, { error: "method_not_allowed" });
@@ -20579,7 +20959,9 @@ async function handleSummary(req, res, ctx, service) {
     return;
   }
   const url2 = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
-  ctx.host.http.writeJson(res, 200, await service.getSummary({ force: url2.searchParams.get("force") === "1" }));
+  const summary = await service.getSummary({ force: url2.searchParams.get("force") === "1" });
+  const providerOrder = sanitizeProviderOrder((await readStoredSettings(ctx)).providerOrder);
+  ctx.host.http.writeJson(res, 200, { ...summary, providerOrder });
 }
 async function handleConnect(req, res, ctx, service, serializeSettings) {
   if (req.method !== "POST") {
@@ -20607,16 +20989,51 @@ async function handleConnect(req, res, ctx, service, serializeSettings) {
     return;
   }
   await serializeSettings(async () => {
-    const stored = await ctx.host.storage.readJson("quota", "settings");
-    const settings = stored !== null && typeof stored === "object" && !Array.isArray(stored) ? stored : {};
     const next = {
-      ...typeof settings.claudeConnected === "boolean" ? { claudeConnected: settings.claudeConnected } : {},
-      ...typeof settings.cursorConnected === "boolean" ? { cursorConnected: settings.cursorConnected } : {},
+      ...retainedSettings(await readStoredSettings(ctx)),
       ...body.provider === "claude" ? { claudeConnected: body.connected } : { cursorConnected: body.connected }
     };
     await ctx.host.storage.writeJson("quota", "settings", next);
   });
-  ctx.host.http.writeJson(res, 200, await service.getSummary({ forceProvider: body.provider }));
+  const summary = await service.getSummary({ forceProvider: body.provider });
+  const providerOrder = sanitizeProviderOrder((await readStoredSettings(ctx)).providerOrder);
+  ctx.host.http.writeJson(res, 200, { ...summary, providerOrder });
+}
+async function handleOrder(req, res, ctx, serializeSettings) {
+  if (req.method !== "POST") {
+    ctx.host.http.writeJson(res, 405, { error: "method_not_allowed" });
+    return;
+  }
+  if (!ctx.host.security.isTerminalAuthorized(req)) {
+    ctx.host.http.writeJson(res, 401, { error: "unauthorized" });
+    return;
+  }
+  const contentType = req.headers["content-type"];
+  const mediaType = typeof contentType === "string" ? contentType.split(";", 1)[0]?.trim().toLowerCase() : void 0;
+  if (mediaType !== "application/json") {
+    ctx.host.http.writeJson(res, 415, { error: "unsupported_media_type" });
+    return;
+  }
+  let body;
+  try {
+    body = await ctx.host.http.readJsonBody(req);
+  } catch {
+    body = null;
+  }
+  const order = body?.order;
+  if (!body || Object.keys(body).length !== 1 || !Array.isArray(order) || order.length !== PROVIDER_ORDER_DEFAULT.length || !order.every(isProviderId) || new Set(order).size !== order.length) {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_order_request" });
+    return;
+  }
+  const providerOrder = order;
+  await serializeSettings(async () => {
+    const next = {
+      ...retainedSettings(await readStoredSettings(ctx)),
+      providerOrder
+    };
+    await ctx.host.storage.writeJson("quota", "settings", next);
+  });
+  ctx.host.http.writeJson(res, 200, { providerOrder });
 }
 
 // ../fleet-plugins/quota/routes.ts
@@ -20649,6 +21066,10 @@ var routes_default = definePlugin({
       await handleConnect(req, res, ctx, service, serializeSettings);
       return true;
     }, { method: "POST", path: "", summary: "Update provider quota connection state.", category: "Quota Plugin", gate: "origin-write", transport: "http" });
+    registerRouter(ctx, "order", async ({ req, res }) => {
+      await handleOrder(req, res, ctx, serializeSettings);
+      return true;
+    }, { method: "POST", path: "", summary: "Persist the provider card order.", category: "Quota Plugin", gate: "origin-write", transport: "http" });
   }
 });