@slkiser/opencode-quota 5.0.2 → 6.0.0-beta.1

package/dist/core/provider-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-source.d.ts","sourceRoot":"","sources":["../../src/core/provider-source.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAGV,oBAAoB,EACrB,MAAM,mBAAmB,CAAC;AAc3B,OAAO,KAAK,EAAE,cAAc,EAAY,MAAM,sBAAsB,CAAC;AAGrE,OAAO,KAAK,EAAmD,WAAW,EAAE,MAAM,YAAY,CAAC;AAC/F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,MAAM,kBAAkB,GAAG;IAC/B,mEAAmE;IACnE,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACvC,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,cAAc,CAAC;CAChC,CAAC;AAEF,sEAAsE;AACtE,MAAM,MAAM,cAAc,GAAG;IAC3B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,gDAAgD;IAChD,mBAAmB,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,EAAE,CAAC;IACvD,wFAAwF;IACxF,2BAA2B,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,EAAE,CAAC;IAC/D,mEAAmE;IACnE,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,mEAAmE;IACnE,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AASF,4EAA4E;AAC5E,wBAAgB,eAAe,CAC7B,IAAI,EAAE,kBAAkB,EACxB,MAAM,GAAE,cAAgC,GACvC,oBAAoB,CAoBtB;AA8ED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBnB;AAuCD,sFAAsF;AACtF,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CA4CvF;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC,CAa1F"}

package/dist/core/provider-source.js

@@ -0,0 +1,210 @@
+/**
+ * The providers as the store needs them: which ones the server settings turn on and which of
+ * those are available, how to ask each one, and who it is signed in as. Every read takes the
+ * settings the host holds now, so a settings change applies to the next snapshot or refresh.
+ */
+import { createHmac, randomBytes } from "node:crypto";
+import { getQuotaProviderDisplayLabel, isLiveLocalUsageProviderId, } from "../lib/provider-metadata.js";
+import { exportProviderFromCheck } from "../lib/quota-export.js";
+import { cloneQuotaProviders, QUOTA_PROVIDERS_AGGREGATE_ID, selectEligibleQuotaProviderDefinitions, } from "../lib/quota-providers.js";
+import { deriveResolvedAuthIdentity } from "../lib/resolved-auth-identity.js";
+import { createRuntimeProviderIdResolver } from "../lib/runtime-provider-ids.js";
+import { getProviders } from "../providers/registry.js";
+import { rowsFromProviderResult } from "./rows.js";
+import { matchesQuotaProviderCurrentSelection } from "./selection.js";
+/** All registered providers except the ids switched off, with custom mapped to its registry id. */
+function registryProviderIds(off) {
+    return getProviders()
+        .map((provider) => provider.id)
+        .filter((id) => !off.includes(id === QUOTA_PROVIDERS_AGGREGATE_ID ? "custom" : id));
+}
+/** What every provider reads from the settings when it checks its quota. */
+export function providerContext(host, loaded = host.settings()) {
+    const { settings, fromFile } = loaded;
+    const { anthropic, cursor, opencode } = settings.providers;
+    return {
+        client: host.client,
+        resolveRuntimeProviderIds: createRuntimeProviderIdResolver(host.client),
+        workspaceRoot: host.workspaceRoot,
+        config: {
+            anthropicBinaryPath: anthropic.binaryPath,
+            cursorPlan: cursor.plan,
+            cursorIncludedApiUsd: cursor.includedApiUsd ?? undefined,
+            cursorBillingCycleStartDay: cursor.billingCycleStartDay ?? undefined,
+            opencodeMonthlyLimit: opencode.monthlyLimitUsd ?? undefined,
+            requestTimeoutMs: settings.providers.checking.requestTimeoutMs,
+            requestTimeoutMsConfigured: fromFile.includes("providers.checking.requestTimeoutMs"),
+            enabledProviders: registryProviderIds(settings.providers.off),
+            automaticDiscovery: true,
+            quotaProviders: cloneQuotaProviders(settings.providers.custom),
+        },
+    };
+}
+/** The registered providers that serve `model`, by the settings in `ctx`. */
+function providerIdsForModel(ctx, model) {
+    return getProviders()
+        .filter((provider) => matchesQuotaProviderCurrentSelection({
+        provider,
+        currentModel: model.id,
+        currentProviderID: model.providerID,
+        enabledProviders: ctx.config.enabledProviders,
+        automaticDiscovery: ctx.config.automaticDiscovery,
+        quotaProviders: ctx.config.quotaProviders,
+    }))
+        .map((provider) => provider.id);
+}
+/** OpenCode's provider ids; none when its list can't be read. */
+async function openCodeProviderIds(ctx) {
+    try {
+        return await ctx.resolveRuntimeProviderIds();
+    }
+    catch {
+        return new Set();
+    }
+}
+/**
+ * The custom definitions (rows `quota-providers.custom.<id>.*`) that serve `model`; without
+ * OpenCode's provider list none can be matched to a model.
+ */
+function customDefinitionIdsForModel(ctx, availableProviderIds, model) {
+    return selectEligibleQuotaProviderDefinitions({
+        definitions: ctx.config.quotaProviders ?? [],
+        availableProviderIds,
+        onlyCurrentModel: true,
+        currentModel: model.id,
+        currentProviderID: model.providerID,
+    }).map((definition) => definition.id);
+}
+/** The quota-providers aggregate needs the custom definitions OpenCode can serve right now. */
+async function cacheContextFor(provider, ctx) {
+    if (provider.id !== QUOTA_PROVIDERS_AGGREGATE_ID)
+        return {};
+    return {
+        runtimeEligibleQuotaProviders: selectEligibleQuotaProviderDefinitions({
+            definitions: ctx.config.quotaProviders ?? [],
+            availableProviderIds: await ctx.resolveRuntimeProviderIds(),
+        }),
+    };
+}
+/** The signed-in account per the provider's cache policy; null when it can't be told safely. */
+async function accountIdentity(provider, ctx, cacheContext) {
+    const policy = provider.cachePolicy;
+    if (!policy || policy.kind === "uncached")
+        return null;
+    if (policy.kind === "account-neutral")
+        return "account-neutral";
+    try {
+        return await policy.resolveIdentity(ctx, cacheContext);
+    }
+    catch {
+        return null;
+    }
+}
+/** Keys logins while the install's protected key can't be read; no account is saved then. */
+const processLoginKey = randomBytes(32);
+/**
+ * Each login (a source id: an account number, a credential id, often an email) as an opaque id
+ * keyed with the install's protected key, so the snapshot file and notice ids can't be matched
+ * against guessed emails. Without that key no account identity exists either, so the store
+ * keeps such rows in memory only, and a key of this process is enough.
+ */
+export async function keyedLogins(providerId, logins) {
+    return Promise.all(logins.map(async (login) => {
+        if (!login)
+            return "";
+        const keyed = await deriveResolvedAuthIdentity({
+            providerId,
+            principal: { kind: "stable-id", value: login },
+            qualifiers: ["v6-row-login"],
+        });
+        return (keyed ??
+            createHmac("sha256", processLoginKey)
+                .update(JSON.stringify([providerId, login]))
+                .digest("base64url"));
+    }));
+}
+function storeProvider(provider, ctx, settingsKey) {
+    return {
+        id: provider.id,
+        label: getQuotaProviderDisplayLabel(provider.id),
+        // Cursor and Alibaba Coding Plan count OpenCode's own history: cheap, and stale at once.
+        ...(isLiveLocalUsageProviderId(provider.id) ? { minIntervalMs: 0 } : {}),
+        async identity() {
+            const account = await accountIdentity(provider, ctx, await cacheContextFor(provider, ctx));
+            return account === null
+                ? { key: settingsKey, persist: false }
+                : { key: `${account}\u001f${settingsKey}`, persist: true };
+        },
+        async fetch() {
+            const result = await provider.fetch(ctx, await cacheContextFor(provider, ctx));
+            const fetched = rowsFromProviderResult(provider.id, result);
+            const buildExportPart = (check) => exportProviderFromCheck({
+                ...check,
+                providerId: provider.id,
+                label: getQuotaProviderDisplayLabel(provider.id),
+                customDefinitions: ctx.config.quotaProviders ?? [],
+                accounts: result.accounts,
+            });
+            if (!fetched.rowLogins)
+                return { ...fetched, buildExportPart };
+            return {
+                ...fetched,
+                rowLogins: await keyedLogins(provider.id, fetched.rowLogins),
+                buildExportPart,
+            };
+        },
+    };
+}
+/** The store's source: the enabled and available providers, with the settings now. */
+export async function loadProviderSource(host) {
+    const loaded = host.settings();
+    const ctx = providerContext(host, loaded);
+    const { enabledProviders } = ctx.config;
+    const enabled = getProviders().filter((provider) => enabledProviders === "auto" || enabledProviders.includes(provider.id));
+    const available = await Promise.all(enabled.map(async (provider) => {
+        try {
+            return await provider.isAvailable(ctx);
+        }
+        catch {
+            return false;
+        }
+    }));
+    // A settings change that alters what a provider reports also changes its identity.
+    const { config } = ctx;
+    const settingsKey = JSON.stringify([
+        config.anthropicBinaryPath ?? null,
+        config.cursorPlan,
+        config.cursorIncludedApiUsd ?? null,
+        config.cursorBillingCycleStartDay ?? null,
+        config.opencodeMonthlyLimit ?? null,
+        config.quotaProviders ?? [],
+    ]);
+    const availableProviderIds = config.quotaProviders?.length
+        ? await openCodeProviderIds(ctx)
+        : new Set();
+    return {
+        providers: enabled
+            .filter((_, index) => available[index])
+            .map((provider) => storeProvider(provider, ctx, settingsKey)),
+        minIntervalMs: loaded.settings.providers.checking.minIntervalMs,
+        providerIdsForModel: (model) => providerIdsForModel(ctx, model),
+        // A custom definition's rows serve only the models the definition serves.
+        rowPrefixesForModel: (model) => ({
+            [QUOTA_PROVIDERS_AGGREGATE_ID]: customDefinitionIdsForModel(ctx, availableProviderIds, model).map((id) => `${QUOTA_PROVIDERS_AGGREGATE_ID}.custom.${id}.`),
+        }),
+    };
+}
+export async function loadServerSettings(host) {
+    const loaded = host.settings();
+    const { settings } = loaded;
+    const ctx = providerContext(host, loaded);
+    const availableProviderIds = await openCodeProviderIds(ctx);
+    return {
+        waitForQuotaReset: settings.providers.checking.waitForQuotaReset,
+        providerIdsForModel: (model) => providerIdsForModel(ctx, model),
+        customDefinitionIdsForModel: (model) => customDefinitionIdsForModel(ctx, availableProviderIds, model),
+        export: { enabled: settings.system.exportFile, path: settings.system.exportPath },
+        telemetry: settings.system.telemetry,
+    };
+}
+//# sourceMappingURL=provider-source.js.map

package/dist/core/provider-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-source.js","sourceRoot":"","sources":["../../src/core/provider-source.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAMtD,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAC5B,sCAAsC,GACvC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,oCAAoC,EAAE,MAAM,gBAAgB,CAAC;AA0BtE,mGAAmG;AACnG,SAAS,mBAAmB,CAAC,GAAiC;IAC5D,OAAO,YAAY,EAAE;SAClB,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;SAC9B,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,4BAA4B,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAC7B,IAAwB,EACxB,MAAM,GAAmB,IAAI,CAAC,QAAQ,EAAE;IAExC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IACtC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC;IAC3D,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,yBAAyB,EAAE,+BAA+B,CAAC,IAAI,CAAC,MAAM,CAAC;QACvE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM,EAAE;YACN,mBAAmB,EAAE,SAAS,CAAC,UAAU;YACzC,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,oBAAoB,EAAE,MAAM,CAAC,cAAc,IAAI,SAAS;YACxD,0BAA0B,EAAE,MAAM,CAAC,oBAAoB,IAAI,SAAS;YACpE,oBAAoB,EAAE,QAAQ,CAAC,eAAe,IAAI,SAAS;YAC3D,gBAAgB,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB;YAC9D,0BAA0B,EAAE,QAAQ,CAAC,QAAQ,CAAC,qCAAqC,CAAC;YACpF,gBAAgB,EAAE,mBAAmB,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC;YAC7D,kBAAkB,EAAE,IAAI;YACxB,cAAc,EAAE,mBAAmB,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC;SAC/D;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,mBAAmB,CAAC,GAAyB,EAAE,KAAmB;IACzE,OAAO,YAAY,EAAE;SAClB,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CACnB,oCAAoC,CAAC;QACnC,QAAQ;QACR,YAAY,EAAE,KAAK,CAAC,EAAE;QACtB,iBAAiB,EAAE,KAAK,CAAC,UAAU;QACnC,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,gBAAgB;QAC7C,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,kBAAkB;QACjD,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc;KAC1C,CAAC,CACH;SACA,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,mBAAmB,CAAC,GAAyB;IAC1D,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,yBAAyB,EAAE,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,2BAA2B,CAClC,GAAyB,EACzB,oBAAyC,EACzC,KAAmB;IAEnB,OAAO,sCAAsC,CAAC;QAC5C,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE;QAC5C,oBAAoB;QACpB,gBAAgB,EAAE,IAAI;QACtB,YAAY,EAAE,KAAK,CAAC,EAAE;QACtB,iBAAiB,EAAE,KAAK,CAAC,UAAU;KACpC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,+FAA+F;AAC/F,KAAK,UAAU,eAAe,CAC5B,QAAuB,EACvB,GAAyB;IAEzB,IAAI,QAAQ,CAAC,EAAE,KAAK,4BAA4B;QAAE,OAAO,EAAE,CAAC;IAC5D,OAAO;QACL,6BAA6B,EAAE,sCAAsC,CAAC;YACpE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE;YAC5C,oBAAoB,EAAE,MAAM,GAAG,CAAC,yBAAyB,EAAE;SAC5D,CAAC;KACH,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,eAAe,CAC5B,QAAuB,EACvB,GAAyB,EACzB,YAAuC;IAEvC,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC;IACpC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,iBAAiB,CAAC;IAChE,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,eAAe,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;AAExC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAAkB,EAClB,MAAyB;IAEzB,OAAO,OAAO,CAAC,GAAG,CAChB,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACzB,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC;YAC7C,UAAU;YACV,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE;YAC9C,UAAU,EAAE,CAAC,cAAc,CAAC;SAC7B,CAAC,CAAC;QACH,OAAO,CACL,KAAK;YACL,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC;iBAClC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;iBAC3C,MAAM,CAAC,WAAW,CAAC,CACvB,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,QAAuB,EACvB,GAAyB,EACzB,WAAmB;IAEnB,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,KAAK,EAAE,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,yFAAyF;QACzF,GAAG,CAAC,0BAA0B,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,KAAK,CAAC,QAAQ;YACZ,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3F,OAAO,OAAO,KAAK,IAAI;gBACrB,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE;gBACtC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,OAAO,SAAS,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC/D,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;YAC/E,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,eAAe,GAAG,CAAC,KAAqB,EAAE,EAAE,CAChD,uBAAuB,CAAC;gBACtB,GAAG,KAAK;gBACR,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,KAAK,EAAE,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChD,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE;gBAClD,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;YACL,IAAI,CAAC,OAAO,CAAC,SAAS;gBAAE,OAAO,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,CAAC;YAC/D,OAAO;gBACL,GAAG,OAAO;gBACV,SAAS,EAAE,MAAM,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC;gBAC5D,eAAe;aAChB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAwB;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,EAAE,gBAAgB,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;IACxC,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC,MAAM,CACnC,CAAC,QAAQ,EAAE,EAAE,CAAC,gBAAgB,KAAK,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CACpF,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IACF,mFAAmF;IACnF,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACvB,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM,CAAC,mBAAmB,IAAI,IAAI;QAClC,MAAM,CAAC,UAAU;QACjB,MAAM,CAAC,oBAAoB,IAAI,IAAI;QACnC,MAAM,CAAC,0BAA0B,IAAI,IAAI;QACzC,MAAM,CAAC,oBAAoB,IAAI,IAAI;QACnC,MAAM,CAAC,cAAc,IAAI,EAAE;KAC5B,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG,MAAM,CAAC,cAAc,EAAE,MAAM;QACxD,CAAC,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC;QAChC,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;IACtB,OAAO;QACL,SAAS,EAAE,OAAO;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAC/D,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa;QAC/D,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC;QAC/D,0EAA0E;QAC1E,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC/B,CAAC,4BAA4B,CAAC,EAAE,2BAA2B,CACzD,GAAG,EACH,oBAAoB,EACpB,KAAK,CACN,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,4BAA4B,WAAW,EAAE,GAAG,CAAC;SAC/D,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAwB;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC/B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5B,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,oBAAoB,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC5D,OAAO;QACL,iBAAiB,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,iBAAiB;QAChE,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC;QAC/D,2BAA2B,EAAE,CAAC,KAAK,EAAE,EAAE,CACrC,2BAA2B,CAAC,GAAG,EAAE,oBAAoB,EAAE,KAAK,CAAC;QAC/D,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE;QACjF,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;KACrC,CAAC;AACJ,CAAC"}

package/dist/core/redact.d.ts

@@ -0,0 +1,17 @@
+/** One safe line: control characters removed, credentials redacted, then cut to `maxLength`. */
+export declare function safeDetail(text: string, maxLength: number): string;
+/**
+ * A debug detail's value made safe: fully redacted when its key holds a secret; any other
+ * value still has the secrets inside it redacted.
+ */
+export declare function safeDebugValue(key: string, value: string, maxLength: number): string;
+/**
+ * Text a public issue may show: control characters removed first, then the home dir as "~"
+ * (found before spaces are joined), then one line with credentials as "[redacted]", email
+ * addresses as "[email]", and account, team, org, user and session ids as "[id]". It is cut to
+ * `maxLength` last, so a cut never leaves part of a hidden value.
+ */
+export declare function publicDetail(text: string, maxLength: number, homeDir?: string): string;
+/** A detail's value as `publicDetail` shows it; all hidden when its key holds a secret or an id. */
+export declare function publicDebugValue(key: string, value: string, maxLength: number, homeDir?: string): string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/core/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/core/redact.ts"],"names":[],"mappings":"AA4KA,gGAAgG;AAChG,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAElE;AAYD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpF;AA2BD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,SAAY,GAAG,MAAM,CAMzF;AAED,oGAAoG;AACpG,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,OAAO,SAAY,GAClB,MAAM,CAIR"}

package/dist/core/redact.js

@@ -0,0 +1,217 @@
+/**
+ * Credential redaction for any provider text the store keeps or sends: error details, debug
+ * details and logs. Provider errors can echo a request (an Authorization header, a key in the
+ * query string, a token in a JSON body), so every such text passes here before it is cut to
+ * length, saved or shown. `publicDetail` also hides the home dir, email addresses and account
+ * ids, for the error and debug details the store keeps. /quota_status shows only structured
+ * values and passes them through `publicDetail` as a second filter.
+ */
+import { homedir } from "node:os";
+import { sanitizeDisplayText, sanitizeSingleLineDisplayText } from "../lib/display-sanitize.js";
+import { replaceHomeDirWithTilde } from "../lib/home-dir-display.js";
+const REDACTED = "[redacted]";
+const PRIVATE_ID = "[id]";
+const EMAIL_ADDRESS = "[email]";
+/** Words that make a field name secret wherever they stand in it: "session_id", "x-api-key". */
+const SECRET_WORDS = new Set([
+    "token",
+    "key",
+    "apikey",
+    "secret",
+    "password",
+    "passwd",
+    "pwd",
+    "cookie",
+    "cookies",
+    "session",
+    "sessionid",
+    "authorization",
+    "credential",
+    "credentials",
+    "signature",
+    "sig",
+    "jwt",
+    "bearer",
+]);
+/** Last words of a debug key that make it a fact about a secret: "api_key_source". */
+const FACT_WORDS = new Set([
+    "source",
+    "env",
+    "present",
+    "configured",
+    "set",
+    "kind",
+    "type",
+    "status",
+    "expires",
+    "expiry",
+    "age",
+    "state",
+    "path",
+    "paths",
+    "file",
+    "name",
+    "count",
+    "diagnostics",
+]);
+/** A field name's words, split on anything but letters and digits and on camelCase. */
+function nameWords(name) {
+    return name
+        .replace(/([a-z0-9])([A-Z])/gu, "$1 $2")
+        .replace(/([A-Z]+)([A-Z][a-z])/gu, "$1 $2")
+        .toLowerCase()
+        .split(/[^a-z0-9]+/u)
+        .filter(Boolean);
+}
+/**
+ * True when a word of a field name is a secret word: "access_token", "apiKey", "XSRFToken",
+ * "Set-Cookie", "session_id".
+ */
+function namesSecret(name) {
+    return nameWords(name).some((word) => SECRET_WORDS.has(word));
+}
+/**
+ * A field value: a JSON array (a "]" inside its strings included), quoted to its closing quote
+ * (escaped quotes and spaces included; also with escaped quotes around it, as in JSON inside
+ * JSON), or one unquoted word.
+ */
+const VALUE = String.raw `(?:\[(?:"(?:[^"\\]|\\.)*"?|'(?:[^'\\]|\\.)*'?|[^\]"'])*\]?|\\"(?:[^\\]|\\(?!"))*(?:\\")?|"(?:[^"\\]|\\.)*"?|'(?:[^'\\]|\\.)*'?|[^\s"'&,;}]+)`;
+/** Between a name and its value: `=`, `: `, JSON's `":` and escaped JSON's `\":`. */
+const SEPARATOR = String.raw `(\\?["']?\s*[:=]\s*)`;
+/** `name: value`, `name=value`, `"name":"value"` (also `\"name\":\"value\"`). */
+const NAMED_VALUE = String.raw `\b([A-Za-z_][\w-]{0,63})${SEPARATOR}${VALUE}`;
+/** The value of every pair whose name holds a secret; other values are searched as well. */
+function redactNamedValues(text) {
+    const pattern = new RegExp(NAMED_VALUE, "gu");
+    let result = "";
+    let copied = 0;
+    for (let match = pattern.exec(text); match; match = pattern.exec(text)) {
+        const [whole, name = "", separator = ""] = match;
+        const valueAt = match.index + name.length + separator.length;
+        if (holdsSecret(name)) {
+            result += `${text.slice(copied, valueAt)}${REDACTED}`;
+            copied = match.index + whole.length;
+        }
+        else {
+            // The value may hold pairs of its own: {"error":"bad api_key=abc"}.
+            pattern.lastIndex = valueAt;
+        }
+    }
+    return result + text.slice(copied);
+}
+/** Checked in order, before named values; each replaces what it matches. */
+const SECRET_PATTERNS = [
+    // Cookie, Set-Cookie and Authorization headers: the whole value, to the end of the line or
+    // the next " | " joiner. The JSON forms ("cookie": "a=1") are named values.
+    [
+        /\b((?:set-)?cookie|(?:proxy-)?authorization)(\s*[:=]\s*)(?:(?! \| )[^\r\n])*/giu,
+        `$1$2${REDACTED}`,
+    ],
+    // Bearer abc, Basic abc (outside a header too)
+    [/\b(bearer|basic)\s+[A-Za-z0-9._~+/=-]{6,}/giu, `$1 ${REDACTED}`],
+];
+/** Well-known key shapes and JWT-shaped strings; after named values. */
+const SHAPE_PATTERNS = [
+    /\b(?:sk|pk|rk)[-_][A-Za-z0-9_-]{8,}/gu,
+    /\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_]{10,}/gu,
+    /\bAIza[0-9A-Za-z_-]{20,}/gu,
+    /\bxai-[A-Za-z0-9]{10,}/gu,
+    /eyJ[A-Za-z0-9_-]{10,}(?:\.[A-Za-z0-9_-]+)*/gu,
+];
+/**
+ * One part of a name or model id: a word, also capitalised, camel-cased or with a number after
+ * it ("Coder", "DeepSeek", "Qwen3", "FP8"), a number, or up to 4 letters and digits ("A35B").
+ */
+const NAME_PART = /^(?:[a-z]{1,20}|[A-Z]{1,20}\d{0,4}|(?:[A-Z]{1,6}|[A-Z]?[a-z]{2,20}){1,3}\d{0,4}|\d{1,14}|[A-Za-z0-9]{1,4})$/u;
+/**
+ * A long run of letters, digits, `_` and `-` is a token or session id, unless it is words and
+ * numbers joined by separators: a model id ("Qwen3-Coder-480B-A35B-Instruct-FP8") or a name
+ * ("custom_production-gateway-us_check").
+ */
+function hideOpaqueRun(run) {
+    const parts = run.split(/[-_]+/u).filter(Boolean);
+    const wordsOnly = parts.length >= 2 && parts.every((part) => NAME_PART.test(part));
+    return wordsOnly ? run : REDACTED;
+}
+/** `text` with credential-looking parts replaced by "[redacted]". */
+function redactSecrets(text) {
+    let result = text;
+    for (const [pattern, replacement] of SECRET_PATTERNS) {
+        result = result.replace(pattern, replacement);
+    }
+    result = redactNamedValues(result);
+    for (const pattern of SHAPE_PATTERNS)
+        result = result.replace(pattern, REDACTED);
+    return result.replace(/[A-Za-z0-9_-]{32,}/gu, hideOpaqueRun);
+}
+/**
+ * The text as a screen shows it, before any pattern looks at it: JSON's `\u0049` escapes
+ * decoded and control characters removed (an escape inside a name or home dir would hide it
+ * from the patterns). Line breaks stay.
+ */
+function visibleText(text) {
+    const decoded = text.replace(/(?<!\\)\\u([0-9A-Fa-f]{4})/gu, (_, hex) => String.fromCharCode(Number.parseInt(hex, 16)));
+    return sanitizeDisplayText(decoded);
+}
+/** One safe line: control characters removed, credentials redacted, then cut to `maxLength`. */
+export function safeDetail(text, maxLength) {
+    return redactSecrets(sanitizeSingleLineDisplayText(visibleText(text))).slice(0, maxLength);
+}
+/**
+ * True when a debug key's value is a secret: the key names one, and its last word does not
+ * name a fact about it ("api_key_source", "token_expires_at", "apiKeyEnv").
+ */
+function holdsSecret(key) {
+    const words = nameWords(key);
+    const last = words.at(-1) === "at" ? words.at(-2) : words.at(-1);
+    return namesSecret(key) && !FACT_WORDS.has(last ?? "");
+}
+/**
+ * A debug detail's value made safe: fully redacted when its key holds a secret; any other
+ * value still has the secrets inside it redacted.
+ */
+export function safeDebugValue(key, value, maxLength) {
+    return holdsSecret(key) ? REDACTED : safeDetail(value, maxLength);
+}
+/** Whose data a field is about: a "<word> id" field holds a private identity. */
+const PRIVATE_ID_WORDS = ["account", "team", "org", "organization", "user", "session"];
+/** Checked in order; each replaces what it matches. */
+const PRIVATE_ID_PATTERNS = [
+    // account_id=abc, "teamId": "t_1", "user_ids": ["a", "b"], \"org_id\":\"o_1\"
+    [
+        new RegExp(`\\b((?:[A-Za-z0-9]+[_-])*(?:${PRIVATE_ID_WORDS.join("|")})[_-]?ids?)${SEPARATOR}${VALUE}`, "giu"),
+        `$1$2${PRIVATE_ID}`,
+    ],
+    // alice@example.com, alice%40example.com
+    [/[\w.%+-]+(?:@|%40)[\w-]+(?:\.[\w-]+)*\.[A-Za-z]{2,}\b/giu, EMAIL_ADDRESS],
+];
+/** True when a field name ends in an account, team, org, user or session id: "teamId". */
+function namesPrivateId(name) {
+    const words = nameWords(name);
+    const last = words.at(-1) ?? "";
+    if (last === "id" || last === "ids")
+        return PRIVATE_ID_WORDS.includes(words.at(-2) ?? "");
+    return PRIVATE_ID_WORDS.some((word) => last === `${word}id` || last === `${word}ids`);
+}
+/**
+ * Text a public issue may show: control characters removed first, then the home dir as "~"
+ * (found before spaces are joined), then one line with credentials as "[redacted]", email
+ * addresses as "[email]", and account, team, org, user and session ids as "[id]". It is cut to
+ * `maxLength` last, so a cut never leaves part of a hidden value.
+ */
+export function publicDetail(text, maxLength, homeDir = homedir()) {
+    let result = sanitizeSingleLineDisplayText(replaceHomeDirWithTilde(visibleText(text), homeDir));
+    for (const [pattern, replacement] of PRIVATE_ID_PATTERNS) {
+        result = result.replace(pattern, replacement);
+    }
+    return redactSecrets(result).slice(0, maxLength);
+}
+/** A detail's value as `publicDetail` shows it; all hidden when its key holds a secret or an id. */
+export function publicDebugValue(key, value, maxLength, homeDir = homedir()) {
+    if (namesPrivateId(key))
+        return PRIVATE_ID;
+    if (holdsSecret(key))
+        return REDACTED;
+    return publicDetail(value, maxLength, homeDir);
+}
+//# sourceMappingURL=redact.js.map

package/dist/core/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/core/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAChG,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAErE,MAAM,QAAQ,GAAG,YAAY,CAAC;AAC9B,MAAM,UAAU,GAAG,MAAM,CAAC;AAC1B,MAAM,aAAa,GAAG,SAAS,CAAC;AAEhC,gGAAgG;AAChG,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,OAAO;IACP,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,SAAS;IACT,SAAS;IACT,WAAW;IACX,eAAe;IACf,YAAY;IACZ,aAAa;IACb,WAAW;IACX,KAAK;IACL,KAAK;IACL,QAAQ;CACT,CAAC,CAAC;AAEH,sFAAsF;AACtF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,QAAQ;IACR,KAAK;IACL,SAAS;IACT,YAAY;IACZ,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,KAAK;IACL,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,aAAa;CACd,CAAC,CAAC;AAEH,uFAAuF;AACvF,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI;SACR,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC;SACvC,OAAO,CAAC,wBAAwB,EAAE,OAAO,CAAC;SAC1C,WAAW,EAAE;SACb,KAAK,CAAC,aAAa,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAA,8IAA8I,CAAC;AAEvK,qFAAqF;AACrF,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAA,sBAAsB,CAAC;AAEnD,iFAAiF;AACjF,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAA,2BAA2B,SAAS,GAAG,KAAK,EAAE,CAAC;AAE7E,4FAA4F;AAC5F,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC9C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,CAAC,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC;QACjD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAC7D,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ,EAAE,CAAC;YACtD,MAAM,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,4EAA4E;AAC5E,MAAM,eAAe,GAA6C;IAChE,2FAA2F;IAC3F,4EAA4E;IAC5E;QACE,iFAAiF;QACjF,OAAO,QAAQ,EAAE;KAClB;IACD,+CAA+C;IAC/C,CAAC,8CAA8C,EAAE,MAAM,QAAQ,EAAE,CAAC;CACnE,CAAC;AAEF,wEAAwE;AACxE,MAAM,cAAc,GAAsB;IACxC,uCAAuC;IACvC,iDAAiD;IACjD,4BAA4B;IAC5B,0BAA0B;IAC1B,8CAA8C;CAC/C,CAAC;AAEF;;;GAGG;AACH,MAAM,SAAS,GACb,8GAA8G,CAAC;AAEjH;;;;GAIG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACnF,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpC,CAAC;AAED,qEAAqE;AACrE,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,eAAe,EAAE,CAAC;QACrD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,MAAM,OAAO,IAAI,cAAc;QAAE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjF,OAAO,MAAM,CAAC,OAAO,CAAC,sBAAsB,EAAE,aAAa,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,8BAA8B,EAAE,CAAC,CAAC,EAAE,GAAW,EAAE,EAAE,CAC9E,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAC9C,CAAC;IACF,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAAiB;IACxD,OAAO,aAAa,CAAC,6BAA6B,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAC7F,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,KAAa,EAAE,SAAiB;IAC1E,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AACpE,CAAC;AAED,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAEvF,uDAAuD;AACvD,MAAM,mBAAmB,GAA6C;IACpE,8EAA8E;IAC9E;QACE,IAAI,MAAM,CACR,+BAA+B,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,SAAS,GAAG,KAAK,EAAE,EAC1F,KAAK,CACN;QACD,OAAO,UAAU,EAAE;KACpB;IACD,yCAAyC;IACzC,CAAC,0DAA0D,EAAE,aAAa,CAAC;CAC5E,CAAC;AAEF,0FAA0F;AAC1F,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1F,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAAiB,EAAE,OAAO,GAAG,OAAO,EAAE;IAC/E,IAAI,MAAM,GAAG,6BAA6B,CAAC,uBAAuB,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAChG,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACzD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACnD,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,gBAAgB,CAC9B,GAAW,EACX,KAAa,EACb,SAAiB,EACjB,OAAO,GAAG,OAAO,EAAE;IAEnB,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IAC3C,IAAI,WAAW,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACtC,OAAO,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC"}

package/dist/core/rows.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Provider results as v6 rows. Every provider returns the row contract (`ProviderFetchResult`,
+ * see `providers/contract.ts`); each row gets its id (`${providerId}.${key}`), its provider and
+ * its account's account text.
+ */
+import type { ProviderFetchResult } from "../providers/contract.js";
+import type { ProviderFetch } from "./store.js";
+/**
+ * The account or plan in a legacy group: "OpenAI (Pro)" → "Pro", "[Claude Work] (active)" →
+ * "Work", "[OpenAI Work] (Business)" → "Work (Business)". "(active)" is dropped: it moves
+ * when the user switches logins, and the account must stay the same.
+ */
+export declare function accountFromGroup(providerId: string, group: string | undefined): string | undefined;
+/**
+ * A provider result as v6 rows, the error to show and the debug details. Each row is checked on
+ * its own, so it keeps its login. `rowLogins` holds the logins as the provider gave them; the
+ * provider source keys them before the store gets them.
+ */
+export declare function rowsFromProviderResult(providerId: string, result: ProviderFetchResult, nowMs?: number): ProviderFetch;
+//# sourceMappingURL=rows.d.ts.map

package/dist/core/rows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rows.d.ts","sourceRoot":"","sources":["../../src/core/rows.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAGpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAmDhD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,GAAG,SAAS,CASpB;AAkCD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,mBAAmB,EAC3B,KAAK,GAAE,MAAmB,GACzB,aAAa,CA0Cf"}

package/dist/core/rows.js

@@ -0,0 +1,142 @@
+/**
+ * Provider results as v6 rows. Every provider returns the row contract (`ProviderFetchResult`,
+ * see `providers/contract.ts`); each row gets its id (`${providerId}.${key}`), its provider and
+ * its account's account text.
+ */
+import { sanitizeSingleLineDisplaySnippet } from "../lib/display-sanitize.js";
+import { QUOTA_PROVIDERS_AGGREGATE_ID } from "../lib/quota-providers.js";
+import { classifyError, errorKind } from "./errors.js";
+import { publicDebugValue } from "./redact.js";
+import { validateRows } from "./validate.js";
+const DEBUG_VALUE_MAX_LENGTH = 300;
+/** Brand words at the start of a provider's groups; what follows names the account or plan. */
+const GROUP_BRANDS = {
+    anthropic: ["Claude"],
+    copilot: ["Copilot"],
+    openai: ["OpenAI"],
+    openrouter: ["OpenRouter"],
+    kilo: ["Kilo Gateway"],
+    cursor: ["Cursor"],
+    "alibaba-coding-plan": ["Alibaba Coding Plan"],
+    "alibaba-token-plan": ["Alibaba Personal Token Plan"],
+    synthetic: ["Synthetic"],
+    chutes: ["Chutes"],
+    "google-gemini-cli": ["Gemini CLI"],
+    "google-agy": ["Google AGY", "AGY"],
+    zai: ["Z.ai"],
+    zhipu: ["Zhipu"],
+    nanogpt: ["NanoGPT"],
+    "minimax-coding-plan": ["MiniMax Token Plan"],
+    "minimax-china-coding-plan": ["MiniMax Token Plan (CN)", "MiniMax Token Plan"],
+    "kimi-code-plan-global": ["Kimi Code"],
+    "kimi-code-plan-cn": ["Kimi Code (CN)", "Kimi Code"],
+    deepseek: ["DeepSeek"],
+    xai: ["xAI"],
+    xiaomi: ["Xiaomi MiMo"],
+    "opencode-go": ["OpenCode Go"],
+    opencode: ["OpenCode Zen"],
+    "ollama-cloud": ["Ollama Cloud"],
+};
+/** "(Pro)" → "Pro", ": Standard [code]" → "Standard". */
+function unwrap(text) {
+    let result = text.trim().replace(/^:\s*/u, "");
+    const parens = /^\((.*)\)$/u.exec(result);
+    if (parens)
+        result = parens[1] ?? "";
+    const withoutCode = result.replace(/\s*\[[^\]]*\]$/u, "").trim();
+    return withoutCode || result.trim();
+}
+function stripBrand(providerId, text) {
+    const brand = (GROUP_BRANDS[providerId] ?? []).find((name) => text === name || text.startsWith(`${name} `) || text.startsWith(`${name}:`));
+    return brand ? text.slice(brand.length) : text;
+}
+/**
+ * The account or plan in a legacy group: "OpenAI (Pro)" → "Pro", "[Claude Work] (active)" →
+ * "Work", "[OpenAI Work] (Business)" → "Work (Business)". "(active)" is dropped: it moves
+ * when the user switches logins, and the account must stay the same.
+ */
+export function accountFromGroup(providerId, group) {
+    if (!group)
+        return undefined;
+    const text = group.replace(/\s*\(active\)/gu, "").trim();
+    if (providerId === QUOTA_PROVIDERS_AGGREGATE_ID)
+        return text || undefined;
+    const bracket = /^\[([^\]]*)\]\s*(.*)$/u.exec(text);
+    const alias = unwrap(stripBrand(providerId, bracket ? (bracket[1] ?? "") : text));
+    const category = bracket ? (bracket[2] ?? "").trim() : "";
+    const account = alias && category ? `${alias} ${category}` : alias || unwrap(category);
+    return account || undefined;
+}
+/**
+ * Drops a row repeated for one login (same id and account). Logins that share an account text
+ * keep it here; the store tells them apart, as it also sees logins that failed this time.
+ */
+function dropRepeatedRows(candidates, debug) {
+    const seen = new Set();
+    return candidates.filter(({ row, login }) => {
+        const slot = `${String(row.id)}\u001f${String(row.account ?? "")}\u001f${login}`;
+        if (!seen.has(slot)) {
+            seen.add(slot);
+            return true;
+        }
+        debug.push({ key: "dropped_row", value: `${String(row.id)}: repeated row` });
+        return false;
+    });
+}
+/**
+ * Debug details are kept for /quota_status, as a public issue may show them (see
+ * `publicDetail`): hidden before they are cut, so a cut never leaves part of a hidden value.
+ * A key is a name the adapter or this file chose, so it is only cleaned and shortened.
+ */
+function detail(key, value) {
+    return {
+        key: sanitizeSingleLineDisplaySnippet(key, 64),
+        value: publicDebugValue(key, value, DEBUG_VALUE_MAX_LENGTH),
+    };
+}
+/**
+ * A provider result as v6 rows, the error to show and the debug details. Each row is checked on
+ * its own, so it keeps its login. `rowLogins` holds the logins as the provider gave them; the
+ * provider source keys them before the store gets them.
+ */
+export function rowsFromProviderResult(providerId, result, nowMs = Date.now()) {
+    const debug = result.debug.map((item) => detail(item.key, item.value));
+    const candidates = result.accounts.flatMap((account) => {
+        const accountText = accountFromGroup(providerId, account.name);
+        return account.rows.map(({ key, ...fields }) => ({
+            row: {
+                ...fields,
+                id: `${providerId}.${key}`,
+                providerId,
+                ...(accountText ? { account: accountText } : {}),
+            },
+            login: account.login ?? "",
+        }));
+    });
+    const rows = [];
+    const rowLogins = [];
+    for (const { row, login } of dropRepeatedRows(candidates, debug)) {
+        const checked = validateRows(providerId, [row]);
+        debug.push(...checked.dropped);
+        for (const clean of checked.rows) {
+            rows.push(clean);
+            rowLogins.push(login);
+        }
+    }
+    const logins = rowLogins.some(Boolean) ? { rowLogins } : {};
+    const errors = result.accounts.flatMap((account) => account.errors.map((error) => ({ account: account.name, message: error.message })));
+    for (const error of errors) {
+        debug.push(detail("error", `${error.account}: ${error.message}`));
+        // Read from the message alone, so a number or word in the account name is never its kind.
+        debug.push(detail("error_kind", errorKind(classifyError(error.message, nowMs))));
+    }
+    const [firstError] = errors;
+    if (firstError) {
+        return { rows, ...logins, error: classifyError(firstError.message, nowMs), debug };
+    }
+    if (!result.attempted && rows.length === 0) {
+        return { rows: [], error: { code: "not_configured" }, debug };
+    }
+    return { rows, ...logins, debug };
+}
+//# sourceMappingURL=rows.js.map