@modelprofile.com/authswitch 3.3.0 → 4.0.0

package/ts/classes.fileharness.ts

@@ -25,20 +25,32 @@ export abstract class FileHarness implements IAuthHarness {
   protected abstract apply(slotId: string, previous: IFileAccount | undefined, target: IFileAccount | undefined): void;
   /** The harness's own running instances. Detection informs the caller; it never blocks a write. */
   public abstract readonly processes: IHarnessProcessControl;
+  /** Whether running instances pick up a swapped login by themselves; see `IAuthHarness.liveSwap`. */
+  public abstract readonly liveSwap: boolean;
+  /** Whether `authswitch watch` may switch this harness by itself; see `IAuthHarness.autoSwitch`. */
+  public abstract readonly autoSwitch: boolean;
   /** Raw bytes of the native files a snapshot's credentials are taken from, in a fixed order. */
   protected abstract nativeSources(): (string | null)[];
   protected abstract inspect(credential: Record<string, unknown>, slotId: string): IFileAccount;
   public abstract readAccountStatus(id: string, optionsArg?: IHarnessStatusOptions): Promise<IHarnessAccountStatus>;
 
+  /**
+   * Runs a read and write of the native login under the harness's own write locks, so it never interleaves
+   * with a running instance's token refresh or save. A harness without such a protocol runs the action as it is.
+   */
+  protected async nativeTransaction(actionArg: () => string[]): Promise<string[]> {
+    return actionArg();
+  }
+
   /**
    * A snapshot proven not to have been taken across a native write.
    *
    * Saving a login without replacing it writes no native file, so it must not require the harness
-   * to be stopped. A running harness does rotate its tokens on its own schedule, and its fallback
-   * writer truncates the file in place, so reading the same sources before and after the snapshot
-   * and requiring identical bytes is what keeps a torn or half-rotated credential out of the stash.
-   * Both the retry count and the pause between attempts are bounded; an unstable file is reported,
-   * never guessed at.
+   * to be stopped. A running harness does rotate its tokens on its own schedule, and a native writer
+   * that is not transactional can leave a partial file for a moment, so reading the same sources
+   * before and after the snapshot and requiring identical bytes is what keeps a torn or half-rotated
+   * credential out of the stash. Both the retry count and the pause between attempts are bounded; an
+   * unstable file is reported, never guessed at.
    */
   private stableSnapshot(): IFileHarnessSnapshot {
     let failure: unknown;
@@ -82,11 +94,11 @@ export abstract class FileHarness implements IAuthHarness {
   /**
    * Credential slots that no longer hold the account the last switch wrote.
    *
-   * A running harness refreshes its login on its own schedule and writes the result to the same
-   * file, so a switch performed underneath one can be undone minutes later without any error. The
-   * recorded hash detects that the file changed at all; comparing the account distinguishes the
-   * benign case -- the switched-in account rotating its own token -- from the previous login coming
-   * back. Detection is advisory and never turns a read into a failure.
+   * The login can change outside authswitch -- a new native login, or, for a harness that does not pick
+   * up swaps live, a running instance writing its previous login back at its next refresh. The recorded
+   * hash detects that the file changed at all; comparing the account distinguishes the benign case -- the
+   * switched-in account rotating its own token -- from a different account. Detection is advisory and
+   * never turns a read into a failure.
    */
   private credentialDrift(snapshotArg: IFileHarnessSnapshot): IHarnessCredentialDrift[] {
     let records: ISwitchRecord[];
@@ -111,8 +123,9 @@ export abstract class FileHarness implements IAuthHarness {
   private savedLabel(accountIdArg: string): string | null {
     try { return this.store.read(accountIdArg).label; } catch { return null; }
   }
-  /** Instances that keep a replaced or cleared login in memory until they are restarted. */
+  /** Instances that keep a replaced or cleared login in memory until they are restarted; none for a live-swap harness. */
   private runningCaveat(kindArg: 'replaced' | 'cleared'): string[] {
+    if (this.liveSwap) return [];
     let count: number;
     try { count = this.processes.list().length; }
     catch { return [`Could not check for running ${this.label} processes. If any are running, restart them: an unrestarted instance can write its previous login back.`]; }
@@ -137,16 +150,24 @@ export abstract class FileHarness implements IAuthHarness {
       return [];
     } catch { return [`The login was written, but this switch could not be recorded for later credential checks.`]; }
   }
+  /** The active login with this account id, read from the native files; undefined when the account is not active. */
+  protected activeCredential(id: string): IFileAccount | undefined {
+    return this.snapshot().accounts.find(account => this.store.id(account.slotId, account.identity) === id);
+  }
+  /** The saved copy of this account, verified against its identity. */
+  protected savedCredential(id: string): IFileAccount {
+    return this.saved(this.store.read(id));
+  }
+  /** The account's current credential: the active login when it is active, which may be newer than its saved copy. */
   protected readCredential(id: string): IFileAccount {
-    const active = this.snapshot().accounts.find(account => this.store.id(account.slotId, account.identity) === id);
-    return active ?? this.saved(this.store.read(id));
+    return this.activeCredential(id) ?? this.savedCredential(id);
   }
   /** Save a newly authenticated credential without changing a native harness's login. */
-  public importCredential(slotId: string, credential: Record<string, unknown>): { accountId: string } {
+  public importCredential(slotId: string, credential: Record<string, unknown>): Promise<{ accountId: string }> {
     return this.store.locked(() => ({ accountId: this.store.save(this.inspect(credential, slotId)).id }));
   }
   /** Backend-only login handoff. Preserve the outgoing credential before replacing its slot. */
-  public activateCredential(slotId: string, credential: Record<string, unknown>): IHarnessOutcome {
+  public activateCredential(slotId: string, credential: Record<string, unknown>): Promise<IHarnessOutcome> {
     return this.outcome(() => {
       const target = this.inspect(credential, slotId);
       const snapshot = this.snapshot();
@@ -154,9 +175,15 @@ export abstract class FileHarness implements IAuthHarness {
       const previous = snapshot.accounts.find(account => account.slotId === slotId);
       if (previous) this.store.save(previous);
       this.apply(slotId, previous, target);
-      return [`Activated ${plainText(target.label)} (${plainText(slotId)}).`,
+      return [`Activated ${plainText(target.label)} (${plainText(slotId)}).`, ...this.liveSwapNote('replaced'),
         ...this.recordActivation(slotId, this.store.id(slotId, target.identity)), ...this.runningCaveat('replaced')];
-    });
+    }, true);
+  }
+  /** What a live-swap harness's running sessions do with the change; they need no restart either way. */
+  private liveSwapNote(kindArg: 'replaced' | 'cleared'): string[] {
+    if (!this.liveSwap) return [];
+    return [kindArg === 'replaced' ? `Running ${this.label} sessions use it from their next request.`
+      : `Running ${this.label} sessions have no login from their next request.`];
   }
   public resolveAccount(reference: string): { id: string } | { candidates: string[] } {
     const accounts = this.store.list();
@@ -165,11 +192,18 @@ export abstract class FileHarness implements IAuthHarness {
     const matches = exact.length ? exact : accounts.filter(account => account.label.toLowerCase().startsWith(reference.toLowerCase()));
     return matches.length === 1 ? { id: matches[0].id } : { candidates: matches.map(account => `${account.slotId}:${account.label} (${account.id})`) };
   }
-  private outcome(action: () => string | string[]): IHarnessOutcome {
-    try { return this.store.locked(() => { const lines = action(); return { lines: Array.isArray(lines) ? lines : [lines], problems: [] }; }); }
-    catch (error) { return { lines: [], problems: [error instanceof Error ? error.message : 'Credential operation failed.'] }; }
+  /**
+   * Runs one credential operation as the only authswitch operation on this harness's store. An operation that reads
+   * or writes the native login (`nativeArg`) also runs inside the harness's native transaction.
+   */
+  private async outcome(actionArg: () => string | string[], nativeArg: boolean): Promise<IHarnessOutcome> {
+    const run = (): string[] => [actionArg()].flat();
+    try {
+      const lines = await this.store.locked(() => nativeArg ? this.nativeTransaction(run) : run());
+      return { lines, problems: [] };
+    } catch (error) { return { lines: [], problems: [error instanceof Error ? error.message : 'Credential operation failed.'] }; }
   }
-  public saveCurrent(options: { keepActive: boolean; accountId?: string }): IHarnessOutcome {
+  public saveCurrent(options: { keepActive: boolean; accountId?: string }): Promise<IHarnessOutcome> {
     return this.outcome(() => {
       const snapshot = this.stableSnapshot();
       if (snapshot.unavailable) throw new Error(snapshot.unavailable);
@@ -182,10 +216,13 @@ export abstract class FileHarness implements IAuthHarness {
       const cleared: string[] = [];
       try { this.store.clearSwitch(active.slotId); }
       catch { cleared.push('The login was cleared, but its switch record could not be removed.'); }
-      return [`Saved ${plainText(active.label)} (${plainText(active.slotId)}). Start ${this.label} to log in again.`, ...cleared, ...this.runningCaveat('cleared')];
-    });
+      return [this.liveSwap
+        ? `Saved ${plainText(active.label)} (${plainText(active.slotId)}) and cleared the active login. ${this.loginHint}`
+        : `Saved ${plainText(active.label)} (${plainText(active.slotId)}). Start ${this.label} to log in again.`,
+        ...this.liveSwapNote('cleared'), ...cleared, ...this.runningCaveat('cleared')];
+    }, true);
   }
-  public switchAccount(id: string): IHarnessOutcome {
+  public switchAccount(id: string): Promise<IHarnessOutcome> {
     return this.outcome(() => {
       const target = this.saved(this.store.read(id));
       const snapshot = this.snapshot();
@@ -198,12 +235,13 @@ export abstract class FileHarness implements IAuthHarness {
         return [`${plainText(target.label)} is already active; its latest credential is saved.`, ...this.recordActivation(target.slotId, id)];
       }
       this.apply(target.slotId, previous, target);
-      return [`Activated ${plainText(target.label)} (${plainText(target.slotId)}). Start ${this.label} to use it.`,
-        ...this.recordActivation(target.slotId, id), ...this.runningCaveat('replaced')];
-    });
+      const activated = `Activated ${plainText(target.label)} (${plainText(target.slotId)}).`;
+      return [this.liveSwap ? activated : `${activated} Start ${this.label} to use it.`,
+        ...this.liveSwapNote('replaced'), ...this.recordActivation(target.slotId, id), ...this.runningCaveat('replaced')];
+    }, true);
   }
-  public removeAccount(id: string): IHarnessOutcome {
-    return this.outcome(() => { const account = this.store.read(id); this.store.remove(id); return `Removed saved login for ${plainText(account.label)}; the active login is preserved.`; });
+  public removeAccount(id: string): Promise<IHarnessOutcome> {
+    return this.outcome(() => { const account = this.store.read(id); this.store.remove(id); return `Removed saved login for ${plainText(account.label)}; the active login is preserved.`; }, false);
   }
   public diagnose(): IHarnessOutcome {
     try {

package/ts/classes.limits.ts

@@ -1,15 +1,25 @@
 import * as plugins from './plugins.js';
-import { accountTypeText, compactSince, compactUntil, credentialDriftNote, orderedUsageWindows } from './accounts.js';
-import { consoleHeading, consoleTable } from './classes.accountlist.js';
+import { accountTypeText, compactSince, compactUntil, credentialDriftNote, localDate, orderedUsageWindows, usagePercentText } from './accounts.js';
+import { consoleHeading, consoleNote, consoleTable } from './consoletable.js';
 import type { IAccountList, IAccountLimitRow, IAccountLimits, IActiveAccountDrift, IActiveAccountRow, IActiveAccounts, IHarnessAccountList } from './interfaces.list.js';
-import type { IAccountType, IHarnessCredentialDrift, TUsageSeverity } from './interfaces.harness.js';
+import type { IAccountType, IAuthHarness, IHarnessBilling, IHarnessCredentialDrift, TUsageSeverity } from './interfaces.harness.js';
 import { dim, plainText } from './formatting.js';
 
 type TListedAccount = IHarnessAccountList['accounts'][number];
 
-const UNAVAILABLE = 'n/a';
+export const UNAVAILABLE = 'n/a';
 const NONE = 'none';
 
+/** What the projections need to know about a harness beyond its account list. */
+export type THarnessTraits = Pick<IAuthHarness, 'id' | 'liveSwap' | 'renewalUnavailableReason'>;
+
+/** The declared traits of a listed harness; a list is always projected with the harnesses it was read from. */
+const traitsOf = (harnessesArg: readonly THarnessTraits[], harnessArg: IHarnessAccountList): THarnessTraits => {
+  const traits = harnessesArg.find(harness => harness.id === harnessArg.id);
+  if (traits === undefined) throw new Error(`The account list names harness ${plainText(harnessArg.id)}, which was not passed with it.`);
+  return traits;
+};
+
 /**
  * Provider naming stays data-driven.
  *
@@ -47,11 +57,46 @@ const accountKeys = (harnessArg: IHarnessAccountList, accountArg: TListedAccount
 });
 
 /** The account's plan, sanitised like every other label and copied so that no two rows share one object. */
-const accountType = (accountArg: TListedAccount): IAccountType | null => {
+export const accountType = (accountArg: TListedAccount): IAccountType | null => {
   const subscription = accountArg.status.summary?.subscription;
   return subscription === undefined ? null : { plan: plainText(subscription.plan), source: subscription.source };
 };
 
+/** The account's reported billing fields, sanitised and copied per row; null when the provider reported none. */
+export const accountBilling = (accountArg: TListedAccount): IHarnessBilling | null => {
+  const billing = accountArg.status.summary?.billing;
+  if (billing === undefined) return null;
+  const date = (valueArg: string | undefined) => valueArg === undefined ? undefined : plainText(valueArg);
+  return Object.fromEntries(Object.entries({
+    hasActiveSubscription: billing.hasActiveSubscription, autoRenew: billing.autoRenew,
+    renewsAt: date(billing.renewsAt), cancelsAt: date(billing.cancelsAt), expiresAt: date(billing.expiresAt),
+  }).filter(([, value]) => value !== undefined)) as IHarnessBilling;
+};
+
+/** The next billing event a provider reported: a renewal it will charge, or the end of a subscription it will not renew. */
+export interface IRenewal {
+  at: string;
+  kind: 'auto-renews' | 'cancels';
+}
+
+/** Read from the reported fields only; a missing or unparseable date is no event, never an inferred one. */
+export const nextRenewal = (billingArg: IHarnessBilling | null): IRenewal | null => {
+  if (billingArg === null) return null;
+  const known = (valueArg: string | undefined): valueArg is string => valueArg !== undefined && Number.isFinite(Date.parse(valueArg));
+  if (billingArg.autoRenew === true && known(billingArg.renewsAt)) return { at: billingArg.renewsAt, kind: 'auto-renews' };
+  if (known(billingArg.cancelsAt)) return { at: billingArg.cancelsAt, kind: 'cancels' };
+  if (billingArg.autoRenew === false && known(billingArg.expiresAt)) return { at: billingArg.expiresAt, kind: 'cancels' };
+  return null;
+};
+
+/** The Renewal cell: the local date, and beneath it whether the subscription renews or ends then; a dim `n/a` otherwise. */
+export const renewalCell = (billingArg: IHarnessBilling | null): plugins.smartconsole.TText => {
+  const renewal = nextRenewal(billingArg);
+  return renewal === null ? plugins.smartconsole.color.text(UNAVAILABLE, { dim: true })
+    : plugins.smartconsole.color.concat(`${localDate(renewal.at)}\n`,
+      plugins.smartconsole.color.text(renewal.kind, renewal.kind === 'cancels' ? { foreground: 'orange' } : { dim: true }));
+};
+
 const harnessProblem = (harnessArg: IHarnessAccountList): string | null =>
   harnessArg.problems.length ? harnessArg.problems.map(plainText).join(' ') : null;
 
@@ -96,44 +141,49 @@ const collectNotes = (rowsArg: { provider: string; account: string | null; unava
   [...new Set(rowsArg.map(noteFor).filter((note): note is string => note !== null))];
 
 /** The drift a switch record proves, carried into the row document with both accounts named. */
-const activeDrift = (harnessArg: IHarnessAccountList, driftArg: IHarnessCredentialDrift): IActiveAccountDrift => ({
+const activeDrift = (traitsArg: THarnessTraits, driftArg: IHarnessCredentialDrift): IActiveAccountDrift => ({
   expectedAccountId: driftArg.expectedAccountId, expectedAccount: driftArg.expectedLabel === null ? null : plainText(driftArg.expectedLabel),
   currentAccountId: driftArg.currentAccountId, currentAccount: driftArg.currentLabel === null ? null : plainText(driftArg.currentLabel),
-  currentIsSaved: driftArg.currentIsSaved, switchedAt: driftArg.switchedAt, reason: credentialDriftNote(harnessArg.id, driftArg),
+  currentIsSaved: driftArg.currentIsSaved, switchedAt: driftArg.switchedAt, reason: credentialDriftNote(traitsArg, driftArg),
 });
 
 /**
- * One row per account and limit type, projected from the account list.
+ * One row per account and limit type, projected from the account list and the harnesses it was read from.
  *
- * Nothing here talks to a provider: the list is already the read-only, per-account-isolated lookup,
- * so a single failing account costs its own rows a number and nothing else.
+ * Nothing here talks to a provider: the list is already the per-account-isolated lookup, so a single
+ * failing account costs its own rows a number and nothing else. A harness that declares its provider
+ * never reports renewal dates gets one note instead of an unexplained `n/a` per account.
  */
-export const accountLimits = (listArg: IAccountList): IAccountLimits => {
+export const accountLimits = (listArg: IAccountList, harnessesArg: readonly THarnessTraits[]): IAccountLimits => {
   const now = Date.parse(listArg.generatedAt);
   const rows: IAccountLimitRow[] = [];
+  const renewalNotes: string[] = [];
   for (const harness of listArg.harnesses) {
     const problem = harnessProblem(harness);
     const empty = {
       limitType: null, scope: null, windowSeconds: null, usedPercent: null, resetAt: null, resetsIn: UNAVAILABLE, severity: null, headline: false,
     } as const;
     if (problem !== null) {
-      rows.push({ harnessId: harness.id, provider: providerName(harness), account: null, accountId: null, isActive: false, accountType: null, ...empty, unavailableReason: problem });
+      rows.push({ harnessId: harness.id, provider: providerName(harness), account: null, accountId: null, isActive: false, accountType: null, billing: null, ...empty, unavailableReason: problem });
       continue;
     }
     if (!harness.accounts.length) {
-      rows.push({ harnessId: harness.id, provider: providerName(harness), account: null, accountId: null, isActive: false, accountType: null, ...empty,
+      rows.push({ harnessId: harness.id, provider: providerName(harness), account: null, accountId: null, isActive: false, accountType: null, billing: null, ...empty,
         unavailableReason: harness.saveUnavailableReason === null ? 'No accounts are known for this harness.' : plainText(harness.saveUnavailableReason) });
       continue;
     }
+    const renewalUnavailable = traitsOf(harnessesArg, harness).renewalUnavailableReason;
+    if (renewalUnavailable !== undefined) renewalNotes.push(`${plainText(harness.label)}: ${plainText(renewalUnavailable)}`);
     for (const account of harness.accounts) {
+      const identity = () => ({ ...accountKeys(harness, account), isActive: account.isActive, accountType: accountType(account), billing: accountBilling(account) });
       const windows = orderedUsageWindows(account.status.summary?.usageWindows);
       if (!windows.length) {
-        rows.push({ ...accountKeys(harness, account), isActive: account.isActive, accountType: accountType(account), ...empty, unavailableReason: missingLimitReason(account) });
+        rows.push({ ...identity(), ...empty, unavailableReason: missingLimitReason(account) });
         continue;
       }
       for (const window of windows) {
         rows.push({
-          ...accountKeys(harness, account), isActive: account.isActive, accountType: accountType(account),
+          ...identity(),
           limitType: plainText(window.label), scope: window.scope ?? 'account', windowSeconds: window.durationSeconds,
           usedPercent: window.usedPercent, resetAt: window.resetAt, resetsIn: compactUntil(window.resetAt, now, UNAVAILABLE),
           severity: window.severity ?? null, headline: window.headline === true, unavailableReason: null,
@@ -142,7 +192,7 @@ export const accountLimits = (listArg: IAccountList): IAccountLimits => {
     }
   }
   const limits = byProviderThenAccount(rows);
-  return { schemaVersion: 1, generatedAt: listArg.generatedAt, complete: listArg.complete, limits, notes: collectNotes(limits) };
+  return { schemaVersion: 1, generatedAt: listArg.generatedAt, complete: listArg.complete, limits, notes: [...collectNotes(limits), ...renewalNotes] };
 };
 
 /**
@@ -151,16 +201,17 @@ export const accountLimits = (listArg: IAccountList): IAccountLimits => {
  * A harness with no active login still gets a row: "nothing is active here" is an answer, and
  * silently dropping the provider would read as "this provider does not exist".
  */
-export const activeAccounts = (listArg: IAccountList): IActiveAccounts => {
+export const activeAccounts = (listArg: IAccountList, harnessesArg: readonly THarnessTraits[]): IActiveAccounts => {
   const now = Date.parse(listArg.generatedAt);
   const rows: IActiveAccountRow[] = [];
   const unattached: string[] = [];
   for (const harness of listArg.harnesses) {
+    const traits = traitsOf(harnessesArg, harness);
     const problem = harnessProblem(harness);
     const drifts = [...harness.credentialDrift];
     const driftFor = (slotIdArg?: string): IActiveAccountDrift | null => {
       const index = drifts.findIndex(item => item.slotId === slotIdArg);
-      return index < 0 ? null : activeDrift(harness, drifts.splice(index, 1)[0]);
+      return index < 0 ? null : activeDrift(traits, drifts.splice(index, 1)[0]);
     };
     if (problem !== null) {
       rows.push({ harnessId: harness.id, provider: providerName(harness), account: null, accountId: null, accountType: null, savedAt: null, savedAgo: UNAVAILABLE, source: 'none', unavailableReason: problem, drift: null });
@@ -175,7 +226,7 @@ export const activeAccounts = (listArg: IAccountList): IActiveAccounts => {
         unavailableReason: harness.saveUnavailableReason !== null ? plainText(harness.saveUnavailableReason)
           : stashed.length ? `No login is active; ${stashed.length} saved account(s) can be activated with authswitch ${plainText(harness.id)} use.`
             : `No login is active and none is saved. ${plainText(harness.loginHint)}`,
-        drift: drifts.length ? activeDrift(harness, drifts.shift()!) : null,
+        drift: drifts.length ? activeDrift(traits, drifts.shift()!) : null,
       });
     } else {
       for (const account of active) {
@@ -189,7 +240,7 @@ export const activeAccounts = (listArg: IAccountList): IActiveAccounts => {
       }
     }
     // A drifted slot with no row of its own still has to be reported, not dropped.
-    for (const drift of drifts) unattached.push(`${providerName(harness)}${drift.slotId === undefined ? '' : ` / ${plainText(drift.slotId)}`}: ${credentialDriftNote(harness.id, drift)}`);
+    for (const drift of drifts) unattached.push(`${providerName(harness)}${drift.slotId === undefined ? '' : ` / ${plainText(drift.slotId)}`}: ${credentialDriftNote(traits, drift)}`);
   }
   const active = byProviderThenAccount(rows);
   const driftNotes = active.filter(row => row.drift !== null)
@@ -200,44 +251,67 @@ export const activeAccounts = (listArg: IAccountList): IActiveAccounts => {
 /**
  * The Account cell: the label, and the account type beneath it, dim. An unknown type keeps its line as
  * `n/a`, so every account cell has the same shape; a provider row without an account has no type to name.
+ * A view without a Provider column names the credential slot in the type line (`openai · Pro`) when the
+ * harness owns several.
  */
-const accountCell = (rowArg: IAccountLimitRow): plugins.smartconsole.TText => rowArg.account === null ? UNAVAILABLE
-  : plugins.smartconsole.color.concat(`${rowArg.account}\n`, plugins.smartconsole.color.text(accountTypeText(rowArg.accountType) ?? UNAVAILABLE, { dim: true, bold: false }));
+export const accountCell = (rowArg: Pick<IAccountLimitRow, 'account' | 'accountType' | 'slotId'>, slotsArg: boolean): plugins.smartconsole.TText => {
+  if (rowArg.account === null) return UNAVAILABLE;
+  const type = [slotsArg ? rowArg.slotId : undefined, accountTypeText(rowArg.accountType) ?? undefined].filter(part => part !== undefined).join(' · ');
+  return plugins.smartconsole.color.concat(`${rowArg.account}\n`, plugins.smartconsole.color.text(type || UNAVAILABLE, { dim: true, bold: false }));
+};
 
-const percent = (rowArg: IAccountLimitRow): string => rowArg.usedPercent === null ? UNAVAILABLE : `${rowArg.usedPercent}%`;
+const percent = (rowArg: IAccountLimitRow): string => rowArg.usedPercent === null ? UNAVAILABLE : usagePercentText(rowArg.usedPercent);
 
 const SEVERITY_COLORS: Record<TUsageSeverity, plugins.smartconsole.TColorName | undefined> = { normal: undefined, warning: 'orange', critical: 'red' };
 
 /** The provider's own reading colours a window; without one, n/a and exhausted windows stand out. */
-const percentColor = (rowArg: IAccountLimitRow): plugins.smartconsole.TColorName | undefined =>
-  rowArg.severity !== null ? SEVERITY_COLORS[rowArg.severity]
-    : rowArg.usedPercent === null ? 'orange' : rowArg.usedPercent >= 100 ? 'red' : undefined;
+export const usageColor = (severityArg: TUsageSeverity | null, usedPercentArg: number | null): plugins.smartconsole.TColorName | undefined =>
+  severityArg !== null ? SEVERITY_COLORS[severityArg]
+    : usedPercentArg === null ? 'orange' : usedPercentArg >= 100 ? 'red' : undefined;
+const percentColor = (rowArg: IAccountLimitRow): plugins.smartconsole.TColorName | undefined => usageColor(rowArg.severity, rowArg.usedPercent);
+
+/** Which parts of the limits table a view shows. */
+export interface ILimitsTableOptions {
+  /** The Provider column and the per-harness colour line, for a view across harnesses. */
+  provider: boolean;
+  renewal: boolean;
+  /** Whether the harness owns several credential slots, named in the account cell when there is no Provider column. */
+  slots: boolean;
+}
 
-/** Condensed presentation for `authswitch limits` and `authswitch active`. */
+/** Condensed presentation for `authswitch limits` and `authswitch active`, and the limits table other views embed. */
 export class CondensedRenderer {
   constructor(private readonly out: plugins.smartconsole.SmartConsole) {}
 
   private notes(notesArg: string[], prefixArg: string): void {
     if (!notesArg.length) return;
     process.stdout.write('\n');
-    for (const note of notesArg) process.stdout.write(`${dim(`${prefixArg}${note}`)}\n`);
+    for (const note of notesArg) consoleNote(note, prefixArg);
   }
 
   public async renderLimits(limitsArg: IAccountLimits): Promise<void> {
     consoleHeading('Account limits');
+    if (!limitsArg.limits.length) { process.stdout.write(`${dim('No harnesses registered.')}\n`); return; }
+    await this.limitsTable(limitsArg.limits, { provider: true, renewal: true, slots: false });
+    this.notes(limitsArg.notes, 'n/a — ');
+  }
+
+  /** One row per account and limit type; `rowsArg` must be ordered by `byProviderThenAccount` and is rendered as it is. */
+  public async limitsTable(rowsArg: IAccountLimitRow[], optionsArg: ILimitsTableOptions): Promise<void> {
     // The span callbacks record these exact rows, so the table renders this array as it is.
-    const rows = limitsArg.limits;
-    if (!rows.length) { process.stdout.write(`${dim('No harnesses registered.')}\n`); return; }
-    await consoleTable(this.out, rows, [
-      { key: 'provider', title: 'Provider', value: row => row.provider, rowSpan: plugins.smartconsole.rowSpansBy(rows, providerRuns) },
-      { key: 'account', title: 'Account', value: row => row.account ?? UNAVAILABLE, render: accountCell,
-        style: row => ({ bold: row.isActive }), rowSpan: plugins.smartconsole.rowSpansBy(rows, accountRuns) },
+    const accountSpan = plugins.smartconsole.rowSpansBy(rowsArg, accountRuns);
+    const columns: plugins.smartconsole.IBackendTableColumn<IAccountLimitRow>[] = [
+      ...(optionsArg.provider ? [{ key: 'provider', title: 'Provider', value: (row: IAccountLimitRow) => row.provider, rowSpan: plugins.smartconsole.rowSpansBy(rowsArg, providerRuns) }] : []),
+      { key: 'account', title: 'Account', value: row => row.account ?? UNAVAILABLE, render: row => accountCell(row, optionsArg.slots),
+        style: row => ({ bold: row.isActive }), rowSpan: accountSpan },
       { key: 'limit', title: 'Limit type', value: row => row.limitType ?? UNAVAILABLE },
       { key: 'used', title: 'Used %', value: percent, align: 'right',
         style: row => ({ foreground: percentColor(row) }) },
       { key: 'reset', title: 'Resets in', value: row => row.resetsIn, align: 'right' },
-    ], { divider: accountRuns, colorLine: harnessRuns });
-    this.notes(limitsArg.notes, 'n/a — ');
+      ...(optionsArg.renewal ? [{ key: 'renewal', title: 'Renewal', value: (row: IAccountLimitRow) => nextRenewal(row.billing)?.at ?? UNAVAILABLE,
+        render: (row: IAccountLimitRow) => renewalCell(row.billing), rowSpan: accountSpan }] : []),
+    ];
+    await consoleTable(this.out, rowsArg, columns, optionsArg.provider ? { divider: accountRuns, colorLine: harnessRuns } : { divider: accountRuns });
   }
 
   public async renderActive(activeArg: IActiveAccounts): Promise<void> {