@phnx-labs/agents-cli 1.22.66 → 1.22.69

package/dist/lib/accounting/usage-sync.d.ts

@@ -1,107 +1,52 @@
-import { type DeviceProfile } from '../devices/registry.js';
-import { type ConfiguredDeviceRole } from '../device-config.js';
-import { type CachedUsageSnapshot } from './usage.js';
-/** How long a single peer push may take before it is abandoned for this tick. */
-export declare const USAGE_PUSH_DEADLINE_MS = 20000;
-export declare const USAGE_PULL_DEADLINE_MS = 20000;
 /**
- * A worker's newest local usage row older than this triggers a pull from the
- * primary. A worker cannot self-read usage (setup-token lacks `user:profile`,
- * RUSH-2392), so its only source of a fresh row is the daemon push every
- * `USAGE_SYNC_TICK_MS` (15m); this cutoff is 2× that tick, so one missed push
- * cycle is tolerated before the worker actively pulls. Bounds worker staleness
- * to ~30m instead of the days-old caches this replaces.
+ * Fleet distribution of identity-keyed Claude usage through the user repo.
+ *
+ * A headed device can read authoritative usage; a worker's setup-token cannot.
+ * Headed daemons therefore publish one snapshot into their conflict-free
+ * `~/.agents/devices/<device>/daemon-state.json`. The daemon's bounded Git
+ * transport delivers those files automatically; workers merge newest-wins.
+ * There is deliberately no device-to-device SSH in this module or its tick.
  */
-export declare const USAGE_SYNC_MAX_AGE_MS: number;
-/** The stdin envelope the `__usage-ingest` verb reads. `v` guards the shape. */
+import { type ConfiguredDeviceRole } from '../device-config.js';
+import { type CachedUsageSnapshot } from './usage.js';
+/** Legacy hidden ingest/export envelope kept for older fleet CLI compatibility. */
 export interface UsageSyncPayload {
     v: 1;
     rows: Record<string, CachedUsageSnapshot>;
 }
-/** One peer the local publisher is considering, reduced to the plan inputs. */
-export interface UsagePushTarget {
-    name: string;
-    /** The peer's configured role — headed peers are skipped (own reader). */
-    role: ConfiguredDeviceRole | undefined;
-    /** Live-ish reachability from the tailscale snapshot; offline peers are skipped. */
-    online: boolean;
-    /** Managed known-hosts pin — an unpinned host is skipped, never TOFU-accepted. */
-    pinned: boolean;
+export interface PublishUsageSnapshotOptions {
+    userAgentsDir?: string;
+    cachePath?: string;
+    role?: ConfiguredDeviceRole;
+    device?: string;
 }
-export type UsageSyncPlanItem = {
-    action: 'push';
-    device: string;
-} | {
-    action: 'skip';
-    device: string;
-    reason: string;
-};
-/**
- * Decide, per peer, whether to push the local usage snapshot. Pure.
- *
- * - `selfIsPublisher` is false on a `worker`/unmarked box: it has no authoritative
- *   usage to publish, so every peer is skipped.
- * - `hasLocalRows` false means the local cache is empty (nothing to teach yet).
- * - A HEADED peer is skipped — it reads its own usage; pushing risks nothing
- *   (the merge is newest-wins) but is wasted work, and keeping the fan-out to
- *   consumers only makes the intent legible.
- */
-export declare function planUsagePush(selfIsPublisher: boolean, hasLocalRows: boolean, targets: UsagePushTarget[]): UsageSyncPlanItem[];
-export interface UsageSyncResult {
-    pushed: string[];
-    skipped: Array<{
-        device: string;
-        reason: string;
-    }>;
-    errors: Array<{
-        device: string;
-        message: string;
-    }>;
+export interface PublishUsageSnapshotResult {
+    published: boolean;
+    changed: boolean;
+    skipped: string | null;
+    error: string | null;
+    path: string | null;
 }
-export interface UsageSyncDeps {
-    selfRole?: () => ConfiguredDeviceRole | undefined;
-    listDevices?: () => DeviceProfile[];
-    /** Configured roles by device name; default reads the fleet config. */
-    listRoles?: () => Record<string, ConfiguredDeviceRole>;
-    localName?: () => string;
-    isPinned?: (name: string) => boolean;
-    exportRows?: () => Record<string, CachedUsageSnapshot>;
-    /** Deliver the serialized payload to one peer. Default: ssh `__usage-ingest`. */
-    push?: (device: DeviceProfile, payload: string) => {
-        ok: boolean;
-        message?: string;
-    };
+/** Publish this headed device's stable usage snapshot into its owned store file. */
+export declare function publishUsageSnapshotToSharedStore(options?: PublishUsageSnapshotOptions): PublishUsageSnapshotResult;
+export interface ConsumeUsageSnapshotsOptions {
+    userAgentsDir?: string;
+    cachePath?: string;
+    role?: ConfiguredDeviceRole;
+    device?: string;
+    roles?: Record<string, ConfiguredDeviceRole>;
 }
-export interface UsagePullResult {
-    pulledFrom: string | null;
+export interface ConsumeUsageSnapshotsResult {
+    sources: string[];
     merged: number;
     skipped: string | null;
-    error: string | null;
-}
-export interface UsagePullDeps {
-    selfRole?: () => ConfiguredDeviceRole | undefined;
-    listDevices?: () => DeviceProfile[];
-    listRoles?: () => Record<string, ConfiguredDeviceRole>;
-    isPinned?: (name: string) => boolean;
-    exportRows?: () => Record<string, CachedUsageSnapshot>;
-    ingestRows?: (rows: Record<string, CachedUsageSnapshot>) => number;
-    /** Injectable clock for the staleness gate; defaults to `Date.now`. */
-    now?: () => number;
-    /** Read the versioned payload from the primary. Default: ssh `__usage-export`. */
-    pull?: (device: DeviceProfile) => {
-        ok: boolean;
-        stdout?: string;
-        message?: string;
-    };
+    errors: Array<{
+        device: string;
+        message: string;
+    }>;
 }
 /**
- * Pull usage from the fleet's primary headed device when this worker's local
- * cache is empty or contains an expired row. `personal` is the primary role;
- * a `desktop` is used only when the fleet has no personal device.
- */
-export declare function pullUsageFromPrimary(deps?: UsagePullDeps): UsagePullResult;
-/**
- * Push the local identity-keyed usage snapshot to every reachable, pinned,
- * non-headed peer. A no-op on a non-headed box or when the local cache is empty.
+ * Read headed publishers from the local user-repo checkout and merge one
+ * newest-wins batch into the worker cache. No network or subprocess is touched.
  */
-export declare function syncFleetUsageSnapshots(deps?: UsageSyncDeps): UsageSyncResult;
+export declare function consumeUsageSnapshotsFromSharedStore(options?: ConsumeUsageSnapshotsOptions): ConsumeUsageSnapshotsResult;

package/dist/lib/accounting/usage-sync.js

@@ -1,231 +1,87 @@
 /**
- * Fleet sync of the identity-keyed Claude usage snapshot (PHNX-3392 follow-up).
+ * Fleet distribution of identity-keyed Claude usage through the user repo.
  *
- * A rate limit is metered per ACCOUNT, so an account's 5h/weekly usage is the
- * same number on every box. But only a HEADED device (`personal`/`desktop`) can
- * read it: the interactive OAuth login it holds carries the `user:profile` scope
- * `/api/oauth/usage` requires, and its interactive Claude runs feed the native
- * windows through the status-line writer. A headless `worker` has only the
- * `user:inference` setup-token, which the usage endpoint 403s (RUSH-2392), so its
- * local `claude-usage.json` stays blank and `agents view` shows no S:/W: bars.
- *
- * This closes that gap the same way {@link ../secrets/reserved-sync.ts} closes
- * the auth-token gap: each headed daemon PUSHES its identity-keyed usage rows to
- * the worker peers that cannot read them, which merge NEWEST-WINS
- * ({@link ingestPeerClaudeUsageRows}). Publish direction is role-driven —
- * personal/desktop publish, worker/unmarked consume — so it composes with the
- * device-role taxonomy rather than adding a second notion of "which box is real".
- *
- * Double-fire safety: each daemon only writes the DESTINATION's own cache, and
- * the merge is idempotent + timestamp-guarded, so two headed publishers pushing
- * the same account to one worker converge on the freshest snapshot regardless of
- * order. The input a publisher reads is its OWN cache (device-local state), so an
- * unrestricted per-device fire is correct — no shared queue.
- *
- * The planner is pure so tests cover every skip/push branch with no SSH.
+ * A headed device can read authoritative usage; a worker's setup-token cannot.
+ * Headed daemons therefore publish one snapshot into their conflict-free
+ * `~/.agents/devices/<device>/daemon-state.json`. The daemon's bounded Git
+ * transport delivers those files automatically; workers merge newest-wins.
+ * There is deliberately no device-to-device SSH in this module or its tick.
  */
-import { sshExec } from '../ssh-exec.js';
-import { buildRemoteAgentsInvocation, buildWindowsStdinAgentsCommand, remoteShellFor, stripClixml } from '../hosts/remote-cmd.js';
-import { resolveRemoteOsSync } from '../hosts/remote-os.js';
-import { loadDevicesSync } from '../devices/registry.js';
-import { sshTargetFor } from '../devices/connect.js';
-import { isHostPinned, isDevicePinned } from '../devices/known-hosts.js';
+import { isHeadedDeviceRole, listConfiguredDeviceRoles, selfConfiguredDeviceRole } from '../device-config.js';
+import { readFleetSharedDeviceStates, updateFleetSharedDeviceState, } from '../fleet-shared-state.js';
+import { getUserAgentsDir } from '../state.js';
 import { machineId, normalizeHost } from '../session/sync/config.js';
-import { isHeadedDeviceRole, listConfiguredDeviceRoles, selfConfiguredDeviceRole, } from '../device-config.js';
 import { exportClaudeUsageCacheRows, ingestPeerClaudeUsageRows, } from './usage.js';
-/** How long a single peer push may take before it is abandoned for this tick. */
-export const USAGE_PUSH_DEADLINE_MS = 20_000;
-export const USAGE_PULL_DEADLINE_MS = 20_000;
-/**
- * A worker's newest local usage row older than this triggers a pull from the
- * primary. A worker cannot self-read usage (setup-token lacks `user:profile`,
- * RUSH-2392), so its only source of a fresh row is the daemon push every
- * `USAGE_SYNC_TICK_MS` (15m); this cutoff is 2× that tick, so one missed push
- * cycle is tolerated before the worker actively pulls. Bounds worker staleness
- * to ~30m instead of the days-old caches this replaces.
- */
-export const USAGE_SYNC_MAX_AGE_MS = 30 * 60_000;
-/** Epoch ms of a cache row's capture time, or null when unparseable/absent. */
-function capturedAtMs(capturedAt) {
-    if (!capturedAt)
-        return null;
-    const ms = Date.parse(capturedAt);
-    return Number.isFinite(ms) ? ms : null;
-}
-/**
- * Decide, per peer, whether to push the local usage snapshot. Pure.
- *
- * - `selfIsPublisher` is false on a `worker`/unmarked box: it has no authoritative
- *   usage to publish, so every peer is skipped.
- * - `hasLocalRows` false means the local cache is empty (nothing to teach yet).
- * - A HEADED peer is skipped — it reads its own usage; pushing risks nothing
- *   (the merge is newest-wins) but is wasted work, and keeping the fan-out to
- *   consumers only makes the intent legible.
- */
-export function planUsagePush(selfIsPublisher, hasLocalRows, targets) {
-    if (!selfIsPublisher) {
-        return targets.map((d) => ({
-            action: 'skip',
-            device: d.name,
-            reason: 'this device is not a usage publisher (mark it personal or desktop)',
-        }));
-    }
-    if (!hasLocalRows) {
-        return targets.map((d) => ({ action: 'skip', device: d.name, reason: 'no local usage snapshot to publish' }));
-    }
-    return targets.map((d) => {
-        if (isHeadedDeviceRole(d.role))
-            return { action: 'skip', device: d.name, reason: 'headed peer reads its own usage' };
-        if (!d.online)
-            return { action: 'skip', device: d.name, reason: 'offline' };
-        if (!d.pinned) {
-            return { action: 'skip', device: d.name, reason: `host key not pinned; run \`agents ssh ${d.name}\` once` };
-        }
-        return { action: 'push', device: d.name };
-    });
-}
-/** Production push: pipe the payload to the peer's `agents __usage-ingest` over ssh. */
-function defaultUsagePush(device, payload) {
-    const target = sshTargetFor(device);
-    const os = resolveRemoteOsSync(device.name);
-    // A Windows peer's `agents.ps1` shim does not forward ssh-piped stdin, so hand
-    // the payload through a temp file (`--from`) instead of stdin — same workaround
-    // the secrets push uses. A POSIX peer reads stdin directly.
-    const remoteCmd = remoteShellFor(os) === 'powershell'
-        ? buildWindowsStdinAgentsCommand(['__usage-ingest'])
-        : buildRemoteAgentsInvocation(['__usage-ingest'], undefined, os);
-    const res = sshExec(target, remoteCmd, { input: payload, timeoutMs: USAGE_PUSH_DEADLINE_MS });
-    if (res.timedOut)
-        return { ok: false, message: 'timed out' };
-    if (res.code !== 0)
-        return { ok: false, message: res.stderr.trim() || `remote exit ${res.code}` };
-    return { ok: true };
-}
-/** Production pull: read the primary's cache through its hidden export verb. */
-function defaultUsagePull(device) {
-    const target = sshTargetFor(device);
-    const os = resolveRemoteOsSync(device.name);
-    const remoteCmd = buildRemoteAgentsInvocation(['__usage-export'], undefined, os);
-    const res = sshExec(target, remoteCmd, { timeoutMs: USAGE_PULL_DEADLINE_MS });
-    if (res.timedOut)
-        return { ok: false, message: 'timed out' };
-    if (res.code !== 0)
-        return { ok: false, message: res.stderr.trim() || `remote exit ${res.code}` };
-    return { ok: true, stdout: res.stdout };
-}
-/**
- * Pull usage from the fleet's primary headed device when this worker's local
- * cache is empty or contains an expired row. `personal` is the primary role;
- * a `desktop` is used only when the fleet has no personal device.
- */
-export function pullUsageFromPrimary(deps = {}) {
-    const result = { pulledFrom: null, merged: 0, skipped: null, error: null };
-    if ((deps.selfRole ?? selfConfiguredDeviceRole)() !== 'worker') {
-        result.skipped = 'this device is not a worker';
+/** Publish this headed device's stable usage snapshot into its owned store file. */
+export function publishUsageSnapshotToSharedStore(options = {}) {
+    const result = {
+        published: false,
+        changed: false,
+        skipped: null,
+        error: null,
+        path: null,
+    };
+    const role = options.role ?? selfConfiguredDeviceRole();
+    if (!isHeadedDeviceRole(role)) {
+        result.skipped = 'this device is not a usage publisher (mark it personal or desktop)';
         return result;
     }
-    const localRows = (deps.exportRows ?? exportClaudeUsageCacheRows)();
-    const localEntries = Object.entries(localRows);
-    // Fresh means RECENT, not "the cache equals itself". The prior check read the
-    // SAME on-disk cache twice (exportRows() and readRow()) and compared window
-    // COUNT, so `fresh.windows.length === row.windows.length` was always true and
-    // any non-empty worker cache skipped the pull forever — which is how a worker
-    // served a days-old snapshot indefinitely and balanced launched into an
-    // account already at its weekly cap. A worker cannot self-read usage, so any
-    // row older than the sync cadence is stale and must trigger a pull; the merge
-    // is newest-wins + idempotent, so pulling when the primary is no fresher is a
-    // harmless no-op.
-    const now = (deps.now ?? Date.now)();
-    const staleCutoff = now - USAGE_SYNC_MAX_AGE_MS;
-    const allFresh = localEntries.length > 0 &&
-        localEntries.every(([, row]) => {
-            const ms = capturedAtMs(row.capturedAt);
-            return ms !== null && ms >= staleCutoff;
-        });
-    if (allFresh) {
-        result.skipped = 'local usage cache is fresh';
+    const rows = exportClaudeUsageCacheRows(options.cachePath);
+    if (Object.keys(rows).length === 0) {
+        result.skipped = 'no local usage snapshot to publish';
         return result;
     }
-    const devices = deps.listDevices?.() ?? Object.values(loadDevicesSync());
-    const roles = deps.listRoles?.() ?? (deps.listDevices
-        ? listConfiguredDeviceRoles(devices.map((device) => device.name))
-        : listConfiguredDeviceRoles());
-    const isPinned = deps.isPinned ?? isHostPinned;
-    const primary = devices
-        .filter((device) => roles[device.name] === 'personal')
-        .concat(devices.filter((device) => roles[device.name] === 'desktop'))
-        .find((device) => device.tailscale?.online !== false && isDevicePinned(device, isPinned));
-    if (!primary) {
-        result.error = 'no reachable, pinned personal or desktop device is configured as the usage primary';
-        return result;
-    }
-    const outcome = (deps.pull ?? defaultUsagePull)(primary);
-    if (!outcome.ok) {
-        result.error = outcome.message ?? 'pull failed';
-        return result;
-    }
-    let payload;
     try {
-        // A Windows usage primary's `agents.ps1` shim prepends a PowerShell CLIXML
-        // progress banner to stdout, exactly as every other remote-JSON boundary
-        // strips (remote-cmd.ts:325). Without this, a headed Windows box (win-mini
-        // is a live fleet device) makes every pull fail as "malformed JSON", the
-        // worker's cache stays null, and the PHNX-3392 capacity floor silently
-        // becomes the only thing standing between a blind pool and an exhausted pick.
-        payload = JSON.parse(stripClixml(outcome.stdout ?? ''));
-    }
-    catch {
-        result.error = 'primary returned malformed JSON';
-        return result;
+        const write = updateFleetSharedDeviceState(options.device ?? machineId(), { usage: { rows } }, options.userAgentsDir ?? getUserAgentsDir());
+        result.published = true;
+        result.changed = write.changed;
+        result.path = write.path;
     }
-    if (!payload || payload.v !== 1 || typeof payload.rows !== 'object' || payload.rows === null || Array.isArray(payload.rows)) {
-        result.error = 'primary returned an unrecognized usage-sync payload shape';
-        return result;
+    catch (err) {
+        result.error = err.message;
     }
-    result.pulledFrom = primary.name;
-    result.merged = (deps.ingestRows ?? ingestPeerClaudeUsageRows)(payload.rows);
     return result;
 }
+function capturedAtMs(row) {
+    if (!row.capturedAt)
+        return null;
+    const ms = Date.parse(row.capturedAt);
+    return Number.isFinite(ms) ? ms : null;
+}
 /**
- * Push the local identity-keyed usage snapshot to every reachable, pinned,
- * non-headed peer. A no-op on a non-headed box or when the local cache is empty.
+ * Read headed publishers from the local user-repo checkout and merge one
+ * newest-wins batch into the worker cache. No network or subprocess is touched.
  */
-export function syncFleetUsageSnapshots(deps = {}) {
-    const result = { pushed: [], skipped: [], errors: [] };
-    const selfRole = (deps.selfRole ?? selfConfiguredDeviceRole)();
-    const devices = deps.listDevices?.() ?? Object.values(loadDevicesSync());
-    const self = deps.localName?.() ?? machineId();
-    const selfNorm = normalizeHost(self);
-    const roles = deps.listRoles?.() ?? (deps.listDevices ? listConfiguredDeviceRoles(devices.map((d) => d.name)) : listConfiguredDeviceRoles());
-    const isPinned = deps.isPinned ?? isHostPinned;
-    const byName = new Map(devices.map((d) => [d.name, d]));
-    const targets = devices
-        .filter((d) => normalizeHost(d.name) !== selfNorm)
-        .map((d) => ({
-        name: d.name,
-        role: roles[d.name],
-        online: d.tailscale?.online !== false,
-        pinned: isDevicePinned(d, isPinned),
-    }));
-    const rows = (deps.exportRows ?? exportClaudeUsageCacheRows)();
-    const plan = planUsagePush(isHeadedDeviceRole(selfRole), Object.keys(rows).length > 0, targets);
-    const payload = JSON.stringify({ v: 1, rows });
-    const push = deps.push ?? defaultUsagePush;
-    for (const item of plan) {
-        if (item.action === 'skip') {
-            result.skipped.push({ device: item.device, reason: item.reason });
-            continue;
-        }
-        const device = byName.get(item.device);
-        if (!device) {
-            result.errors.push({ device: item.device, message: 'device left the registry mid-sync' });
+export function consumeUsageSnapshotsFromSharedStore(options = {}) {
+    const result = { sources: [], merged: 0, skipped: null, errors: [] };
+    if ((options.role ?? selfConfiguredDeviceRole()) !== 'worker') {
+        result.skipped = 'this device is not a worker';
+        return result;
+    }
+    const read = readFleetSharedDeviceStates(options.userAgentsDir ?? getUserAgentsDir());
+    result.errors.push(...read.errors);
+    const self = normalizeHost(options.device ?? machineId());
+    const roles = options.roles ?? listConfiguredDeviceRoles(read.states.map((state) => state.device));
+    const rows = {};
+    for (const state of read.states) {
+        if (normalizeHost(state.device) === self || !isHeadedDeviceRole(roles[state.device]) || !state.usage)
             continue;
+        result.sources.push(state.device);
+        for (const [identity, incoming] of Object.entries(state.usage.rows)) {
+            if (!incoming || !Array.isArray(incoming.windows) || incoming.windows.length === 0)
+                continue;
+            const current = rows[identity];
+            if (!current) {
+                rows[identity] = incoming;
+                continue;
+            }
+            const incomingMs = capturedAtMs(incoming);
+            const currentMs = capturedAtMs(current);
+            if (incomingMs !== null && (currentMs === null || incomingMs > currentMs))
+                rows[identity] = incoming;
         }
-        const outcome = push(device, payload);
-        if (outcome.ok)
-            result.pushed.push(item.device);
-        else
-            result.errors.push({ device: item.device, message: outcome.message ?? 'push failed' });
     }
+    result.sources.sort();
+    result.merged = ingestPeerClaudeUsageRows(rows, options.cachePath);
     return result;
 }

package/dist/lib/accounting/usage.d.ts

@@ -180,8 +180,13 @@ export interface UsageSnapshot {
      * MUST NEVER read this field — `isUsageVerified`/`hasStaleUsage`/
      * `hasUsageAvailable`/`deriveUsageStatusFromSnapshot` consult only `windows`,
      * so a stale number rendered here can never make a stale account read as
-     * verified or eligible (the RUSH-2858 property). Never serialized to the
-     * on-disk cache or `--json` (both project `windows` explicitly).
+     * verified or eligible (the RUSH-2858 property). Not a serialized key of its
+     * own, and dropped from `--json` (which projects `windows` explicitly) — but
+     * the READINGS it holds do round-trip through the on-disk cache:
+     * `serializeClaudeUsageSnapshot` persists the union of `windows` and
+     * `staleWindows`, and `deserializeClaudeUsageSnapshot` re-runs the freshness
+     * gate on read to re-partition them (so a collector like Grok that pre-splits
+     * an ended-period reading onto `staleWindows` still survives the round-trip).
      */
     staleWindows?: UsageWindow[];
     plan?: string | null;
@@ -229,6 +234,12 @@ interface UsageOptions {
      * absent, the backoff stays provider-wide.
      */
     usageScope?: string | null;
+    /**
+     * Caller-supplied abort signal (the daemon tick's deadline). Combined with each
+     * provider fetch's own timeout so a hung refresh is bounded by BOTH the
+     * per-fetch timeout and the supervisor deadline (PHNX-3608).
+     */
+    signal?: AbortSignal;
     /**
      * When true, never open the ACL-bound OS keychain item (macOS Touch ID).
      * Daemon usage refresh sets this so a background tick cannot pop biometrics.
@@ -362,6 +373,8 @@ export declare const USAGE_FETCH_CONCURRENCY = 3;
 export interface UsageLookupOptions {
     forceRefresh?: boolean;
     fileOnly?: boolean;
+    /** Daemon tick deadline signal, combined with each provider fetch's own timeout (PHNX-3608). */
+    signal?: AbortSignal;
     /**
      * Permit a foreground personal-device usage read to fall through to the
      * interactive login when no setup-token exists (USAGE-READ-2). Set ONLY by
@@ -626,11 +639,11 @@ export interface ProviderProbe {
     reason?: 'usage_scope';
 }
 /** Probe Claude's OAuth token against the usage endpoint. Never refreshes — reports `expired` for a near-expiry token; see the comment below (RUSH-1822). */
-export declare function probeClaudeStatus(home?: string, cliVersion?: string | null, usageScope?: string | null): Promise<ProviderProbe>;
+export declare function probeClaudeStatus(home?: string, cliVersion?: string | null, usageScope?: string | null, signal?: AbortSignal): Promise<ProviderProbe>;
 /** Probe Kimi's OAuth token against the /usages endpoint. Never refreshes (single-use rotation — see getKimiUsageInfo). */
-export declare function probeKimiStatus(home?: string, usageScope?: string | null): Promise<ProviderProbe>;
+export declare function probeKimiStatus(home?: string, usageScope?: string | null, signal?: AbortSignal): Promise<ProviderProbe>;
 /** Probe Droid's WorkOS token against the billing-limits endpoint. Never refreshes (single-use rotation — see getDroidUsageInfo). */
-export declare function probeDroidStatus(home?: string, usageScope?: string | null): Promise<ProviderProbe>;
+export declare function probeDroidStatus(home?: string, usageScope?: string | null, signal?: AbortSignal): Promise<ProviderProbe>;
 /**
  * Normalize the Factory billing-limits payload into the common UsageWindow
  * shape. Orgs on the legacy (non token-rate-limit) billing model have no