dsh-subscriptions 0.2.3 → 0.3.1

package/lib/providers/cursor-adapter.js

@@ -1,304 +0,0 @@
-import { CursorAdapter } from 'dsh-subscriptions/cursor-transport';
-/**
- * The imported Cursor transport still reads tool results as user-role content
- * blocks. DSH 0.1.7 carries them as first-class role=tool messages instead.
- */
-export function projectCursorMessages(messages) {
-    return messages.map((message) => message.role === 'tool'
-        ? {
-            ...message,
-            role: 'user',
-            content: [
-                {
-                    type: 'tool-result',
-                    toolCallId: message.toolCallId,
-                    isError: message.isError,
-                    content: message.content,
-                },
-            ],
-        }
-        : message);
-}
-/**
- * Vendor `LlmError` codes whose whole message is a local literal (no response
- * header, trailer, body or end-stream text). Provider-derived failures can only
- * carry a `classifyCursorError` code or `CURSOR_PROTOCOL`, never these, so the
- * code is a sound discriminator for them.
- */
-const LOCAL_VENDOR_CODES = new Set([
-    'UNSUPPORTED_OPTION',
-    'UNSUPPORTED_CONTENT',
-    'TOOL_LIMIT',
-]);
-/**
- * Plain-error messages the vendor throws as fixed literals (`vendor/cursor/
- * index.js`: `waitForResponse`, the request write, the tool-continuation write,
- * the stream `close` handler, the frame reader, the stall watchdog and the
- * settings validation). None
- * interpolates response text, so they are matched by exact message, the same way
- * the auth messages are. A provider that echoed one of these sentences would
- * only make the user read a local literal.
- */
-const LOCAL_VENDOR_MESSAGES = new Set([
-    'Cursor HTTP response timeout',
-    'Cursor HTTP stream closed before response',
-    'Cursor agent bridge closed before accepting the request',
-    'Cursor tool continuation bridge closed before accepting the result',
-    'Cursor sent an unreadable compressed frame',
-    'Cursor stream idle timeout',
-    // `resolveCursorSettings`, run at the top of every stream.
-    'cursor-subscription: maxToolRounds must be an integer between 1 and 1000',
-    'cursor-subscription: retryCount must be an integer between 0 and 10',
-    'cursor-subscription: retryIntervalMs must be an integer between 0 and 300000',
-    'cursor-subscription: retryHttpStatusCodes must contain only HTTP status integers from 400 to 599',
-    'cursor-subscription: retryHttpStatusCodes must not contain duplicates',
-    'cursor-subscription: replayHistoryEachStep must be a boolean',
-]);
-/**
- * The same, for the two literals that embed a number the vendor computes: the
- * response status (`Number(headers[':status'])`, so digits or `NaN`) and the
- * configured progress timeout.
- */
-const LOCAL_VENDOR_PATTERNS = [
-    /^Cursor agent returned HTTP \d{3}$/,
-    /^Cursor stream progress timeout: no content for \d+ms$/,
-];
-/**
- * Operating-system network error codes. An `Error` carrying one of these on
- * itself, or on its `cause` (Node wraps a refused connection in
- * `ERR_HTTP2_STREAM_CANCEL`), was produced by the local socket layer, so its
- * message is local: `connect ECONNREFUSED 127.0.0.1:443`, `getaddrinfo ENOTFOUND
- * host`. This is a property of the thrown object, which a provider cannot
- * forge. It is deliberately not a test on the vendor's `TRANSPORT` code: the
- * vendor derives that code from message text, so a provider's end-stream
- * message or `grpc-message` containing "connection" or "socket" gets it too.
- * Transport failures with no such code (TLS and certificate errors, HTTP/2
- * protocol errors) are not recognised and stay replaced.
- */
-const LOCAL_SYSTEM_ERRNO = new Set([
-    'ECONNREFUSED',
-    'ECONNRESET',
-    'ECONNABORTED',
-    'ENOTFOUND',
-    'EAI_AGAIN',
-    'ETIMEDOUT',
-    'ENETUNREACH',
-    'ENETDOWN',
-    'EHOSTUNREACH',
-    'EHOSTDOWN',
-    'EPIPE',
-]);
-function errorCode(value) {
-    return typeof value === 'object' && value !== null
-        ? value.code
-        : undefined;
-}
-function isLocalSystemError(error) {
-    if (!(error instanceof Error))
-        return false;
-    const own = errorCode(error);
-    const cause = errorCode(error.cause);
-    return ((typeof own === 'string' && LOCAL_SYSTEM_ERRNO.has(own)) ||
-        (typeof cause === 'string' && LOCAL_SYSTEM_ERRNO.has(cause)));
-}
-function messageOf(error) {
-    return error instanceof Error ? error.message : String(error);
-}
-/** Bound on remembered local failure messages; they are short and few. */
-const MAX_LOCAL_MESSAGES = 64;
-/**
- * Remembers the messages of failures raised by this machine rather than read
- * from the provider: whatever the auth service threw, whatever the host
- * attachment store threw while reading an image, and a socket-layer network
- * error seen on the run. The vendor stream turns each of these into
- * `finish/error` carrying exactly `error.message`, so a failure whose message
- * equals a remembered one originated locally and may keep its text. The match
- * is by exact text: a provider that echoed a remembered message would only
- * display a local literal.
- */
-class LocalFailureMessages {
-    messages = new Set();
-    /** Wrap `auth` so its failures are remembered and rethrown unchanged. */
-    wrap(auth) {
-        return {
-            accessToken: async (options) => {
-                try {
-                    return await auth.accessToken(options);
-                }
-                catch (error) {
-                    this.remember(messageOf(error));
-                    throw error;
-                }
-            },
-        };
-    }
-    /**
-     * Wrap the host attachment store the vendor reads images through, so a read
-     * failure keeps its own message. The store is a local service; its errors
-     * carry no provider text. Anything that is not a store passes through.
-     */
-    wrapAttachments(resolve) {
-        return () => {
-            const store = resolve();
-            const readImage = store
-                ?.readImage;
-            if (typeof readImage !== 'function')
-                return store;
-            return Object.create(store, {
-                readImage: {
-                    value: async (...args) => {
-                        try {
-                            return await readImage.apply(store, args);
-                        }
-                        catch (error) {
-                            this.remember(messageOf(error));
-                            throw error;
-                        }
-                    },
-                },
-            });
-        };
-    }
-    /**
-     * Observe a vendor run's two failure channels, the response promise and the
-     * frame reader, and remember the message of an error the socket layer raised.
-     * The run's behavior is unchanged: the same error is rethrown.
-     */
-    observeRun(run) {
-        if (typeof run !== 'object' || run === null)
-            return run;
-        const target = run;
-        const observe = (error) => {
-            if (isLocalSystemError(error))
-                this.remember(messageOf(error));
-            throw error;
-        };
-        const wait = target.waitForResponse;
-        if (typeof wait === 'function') {
-            target.waitForResponse = (...args) => Promise.resolve(wait.apply(target, args)).catch(observe);
-        }
-        const frames = target.frames;
-        const next = frames?.next;
-        if (frames !== undefined && typeof next === 'function') {
-            frames.next = (...args) => Promise.resolve(next.apply(frames, args)).catch(observe);
-        }
-        return run;
-    }
-    has(message) {
-        return this.messages.has(message);
-    }
-    remember(message) {
-        // An empty message displays nothing; remembering it would exempt every
-        // empty failure from the boundary for no benefit.
-        if (message === '')
-            return;
-        this.messages.delete(message);
-        this.messages.add(message);
-        if (this.messages.size > MAX_LOCAL_MESSAGES) {
-            const oldest = this.messages.values().next().value;
-            if (oldest !== undefined)
-                this.messages.delete(oldest);
-        }
-    }
-}
-function isVendorLocalMessage(message) {
-    return (LOCAL_VENDOR_MESSAGES.has(message) ||
-        LOCAL_VENDOR_PATTERNS.some((pattern) => pattern.test(message)));
-}
-/**
- * Cursor adapter for the DSH host.
- *
- * Failure text contract: `finish/error` messages that originate from the
- * vendor stream and can quote provider-controlled text (the response content
- * type, trailers, end-stream errors, a frame-reader or other error whose message
- * is not one of the literals below, and a transport-coded failure that is not a
- * socket-layer error) are replaced by `<code> [provider response text omitted]`. Failures that are
- * wholly local keep their own message and code:
- *
- * - anything the auth service threw (not signed in, sign-in expired, token
- *   refresh status), and a host attachment read failure;
- * - the vendor's own request validation, by code (`UNSUPPORTED_OPTION`,
- *   `UNSUPPORTED_CONTENT`, `TOOL_LIMIT`);
- * - the vendor's fixed-literal plain errors, by exact message: the HTTP status
- *   (`Cursor agent returned HTTP 429`), the response, idle and progress
- *   timeouts, a closed bridge or stream, an unreadable compressed frame, and
- *   an invalid Cursor setting;
- * - a network error raised by the operating system (`ECONNREFUSED`,
- *   `ENOTFOUND`, ...), recognised from the thrown error's own code, not from
- *   the vendor's classification.
- *
- * Not a provider-origin class: a network error such as `ECONNREFUSED` is a
- * local failure (no network, daemon down, DNS), and is kept. What is still
- * replaced although it is probably local is a transport failure with no
- * socket-layer errno: a TLS or certificate failure and an HTTP/2 protocol
- * error. The vendor's `TRANSPORT` code cannot decide those, because
- * `classifyCursorError` derives it from message text (`network`, `connection`,
- * `socket`, `fetch`, `ECONN`, `http2`) and a provider's end-stream message or
- * `grpc-message` can contain any of them; so the code is never trusted alone.
- * Telling these apart would need a check on the thrown error object, as the
- * errno check above does, extended to the TLS and HTTP/2 error codes. That is
- * not done here and is not verified.
- */
-export class CursorCompatAdapter extends CursorAdapter {
-    visibleModels;
-    localFailures;
-    constructor(options) {
-        const localFailures = new LocalFailureMessages();
-        super({
-            ...options,
-            auth: localFailures.wrap(options.auth),
-            ...(options.resolveAttachments === undefined
-                ? {}
-                : {
-                    resolveAttachments: localFailures.wrapAttachments(options.resolveAttachments),
-                }),
-        });
-        this.localFailures = localFailures;
-        this.visibleModels = options.visibleModels;
-        // The vendor assigns `createAgentRun` (the injected one, or its own
-        // `AgentRun` factory) in its constructor but does not type it as a member.
-        const vendor = this;
-        const createRun = vendor.createAgentRun;
-        vendor.createAgentRun = (access) => localFailures.observeRun(createRun(access));
-    }
-    async listModels(provider) {
-        const models = await super.listModels(provider);
-        const visible = this.visibleModels?.();
-        return visible === undefined
-            ? models
-            : models.filter((model) => visible.includes(model.id));
-    }
-    async *stream(options) {
-        for await (const chunk of super.stream({
-            ...options,
-            // Existing DSH sessions may still hold this retired selection.
-            model: options.model === 'composer-2' ? 'composer-2.5' : options.model,
-            messages: projectCursorMessages(options.messages),
-        })) {
-            if (chunk.type === 'finish' &&
-                chunk.reason.kind === 'error' &&
-                !LOCAL_VENDOR_CODES.has(chunk.reason.failure.code) &&
-                !isVendorLocalMessage(chunk.reason.failure.message) &&
-                !this.localFailures.has(chunk.reason.failure.message)) {
-                // The vendor uses raw headers, trailers and end-stream errors for protocol
-                // checks and classification before this boundary. Keep its code and retry
-                // decisions; do not reclassify the replacement text. "Safe" here means no
-                // provider-controlled free text is displayed in failures, not that no
-                // secret can exist anywhere internally.
-                yield {
-                    ...chunk,
-                    reason: {
-                        ...chunk.reason,
-                        failure: {
-                            ...chunk.reason.failure,
-                            message: `${chunk.reason.failure.code} [provider response text omitted]`,
-                        },
-                    },
-                };
-            }
-            else {
-                yield chunk;
-            }
-        }
-    }
-}

package/lib/providers/cursor-auth.d.ts

@@ -1,43 +0,0 @@
-/** Cursor OAuth session and browser-login lifecycle. Credentials stay in DSH. */
-export declare const CURSOR_CREDENTIAL_REF: import("@deepseek-ai/dsh-credentials").CredentialRef;
-export interface CursorCredential {
-    type: 'oauth';
-    access: string;
-    refresh: string;
-    expires: number;
-}
-export interface CursorAuthStatus {
-    authenticated: boolean;
-    busy: boolean;
-    expiresAt?: number;
-    error?: string;
-}
-export interface CursorCredentialService {
-    resolve(ref: typeof CURSOR_CREDENTIAL_REF): Promise<{
-        value: string;
-    } | undefined>;
-    set(ref: typeof CURSOR_CREDENTIAL_REF, value: string): Promise<void>;
-    unset(ref: typeof CURSOR_CREDENTIAL_REF): Promise<void>;
-}
-export declare class CursorAuth {
-    private readonly credentials;
-    private readonly http;
-    private readonly now;
-    private loginTask;
-    private error;
-    private refreshTask;
-    constructor(credentials: CursorCredentialService, http?: typeof fetch, now?: () => number);
-    private read;
-    status(): Promise<CursorAuthStatus>;
-    accessToken({ signal, }?: {
-        signal?: AbortSignal;
-    }): Promise<string>;
-    private refresh;
-    /** Return a Cursor browser URL immediately; polling continues on the host. */
-    login(): Promise<{
-        authorizeUrl: string;
-    }>;
-    private pollLogin;
-    cancel(): Promise<void>;
-    logout(): Promise<void>;
-}

package/lib/providers/cursor-auth.js

@@ -1,221 +0,0 @@
-/** Cursor OAuth session and browser-login lifecycle. Credentials stay in DSH. */
-import { createHash, randomBytes, randomUUID } from 'node:crypto';
-import { credentialRef } from '@deepseek-ai/dsh-credentials';
-import { parseProviderJson } from './common.js';
-export const CURSOR_CREDENTIAL_REF = credentialRef('CURSOR_SUBSCRIPTION_OAUTH');
-const API_ORIGIN = 'https://api2.cursor.sh';
-const REFRESH_AHEAD_MS = 5 * 60_000;
-async function parseCredential(value) {
-    if (value === undefined || value.length === 0)
-        return undefined;
-    // A parse failure here is a local shape error, not a provider signal. That is a
-    // deliberate change: the vendor classifies a stream failure from the message
-    // text, and the raw JSON.parse message used to carry a body excerpt, so a
-    // corrupt credential whose body happened to contain a word like `quota` was
-    // classified as a rate limit. Sanitising the message removes that accident, so
-    // a malformed credential now fails as a general provider error instead.
-    const parsed = await parseProviderJson(value, 'Cursor stored credential');
-    if (parsed === null || typeof parsed !== 'object')
-        throw new Error('Cursor credential is malformed');
-    const item = parsed;
-    if (item.type !== 'oauth' ||
-        typeof item.access !== 'string' ||
-        item.access.length === 0 ||
-        typeof item.refresh !== 'string' ||
-        typeof item.expires !== 'number' ||
-        !Number.isFinite(item.expires)) {
-        throw new Error('Cursor credential is malformed');
-    }
-    return {
-        type: 'oauth',
-        access: item.access,
-        refresh: item.refresh,
-        expires: item.expires,
-    };
-}
-function tokenExpiry(token, now) {
-    try {
-        const payload = token.split('.')[1];
-        if (payload === undefined)
-            return now + 24 * 60 * 60_000;
-        const data = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
-        const exp = data?.exp;
-        if (typeof exp === 'number' && Number.isFinite(exp))
-            return exp * 1000;
-    }
-    catch {
-        /* JWTs without exp still receive a bounded lifetime. */
-    }
-    return now + 24 * 60 * 60_000;
-}
-function abortableDelay(ms, signal) {
-    if (signal.aborted)
-        return Promise.reject(signal.reason);
-    return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
-            signal.removeEventListener('abort', aborted);
-            resolve();
-        }, ms);
-        function aborted() {
-            clearTimeout(timer);
-            reject(signal.reason);
-        }
-        signal.addEventListener('abort', aborted, { once: true });
-    });
-}
-export class CursorAuth {
-    credentials;
-    http;
-    now;
-    loginTask;
-    error;
-    refreshTask;
-    constructor(credentials, http = fetch, now = Date.now) {
-        this.credentials = credentials;
-        this.http = http;
-        this.now = now;
-    }
-    async read() {
-        return parseCredential((await this.credentials.resolve(CURSOR_CREDENTIAL_REF))?.value);
-    }
-    async status() {
-        const current = await this.read();
-        return {
-            authenticated: current !== undefined,
-            busy: this.loginTask !== undefined,
-            ...(current === undefined ? {} : { expiresAt: current.expires }),
-            ...(this.error === undefined ? {} : { error: this.error }),
-        };
-    }
-    async accessToken({ signal, } = {}) {
-        signal?.throwIfAborted();
-        const current = await this.read();
-        if (current === undefined)
-            throw new Error('Cursor is not signed in');
-        if (current.expires - this.now() > REFRESH_AHEAD_MS)
-            return current.access;
-        if (current.refresh.length === 0)
-            throw new Error('Cursor sign-in needs to be renewed');
-        if (this.refreshTask === undefined) {
-            const pending = this.refresh(current, signal);
-            this.refreshTask = pending;
-            void pending
-                .finally(() => {
-                if (this.refreshTask === pending)
-                    this.refreshTask = undefined;
-            })
-                .catch(() => undefined);
-        }
-        return (await this.refreshTask).access;
-    }
-    async refresh(current, signal) {
-        const response = await this.http(`${API_ORIGIN}/auth/exchange_user_api_key`, {
-            method: 'POST',
-            redirect: 'error',
-            headers: {
-                authorization: `Bearer ${current.refresh}`,
-                accept: 'application/json',
-                'content-type': 'application/json',
-            },
-            body: '{}',
-            ...(signal === undefined ? {} : { signal }),
-        });
-        if (!response.ok)
-            throw new Error(`Cursor token refresh failed (HTTP ${response.status})`);
-        const body = (await parseProviderJson(response, 'Cursor token refresh'));
-        if (typeof body.accessToken !== 'string' || body.accessToken.length === 0) {
-            throw new Error('Cursor token refresh returned no access token');
-        }
-        const next = {
-            type: 'oauth',
-            access: body.accessToken,
-            refresh: typeof body.refreshToken === 'string' && body.refreshToken.length > 0
-                ? body.refreshToken
-                : current.refresh,
-            expires: tokenExpiry(body.accessToken, this.now()),
-        };
-        const latest = await this.read();
-        if (latest === undefined)
-            throw new Error('Cursor signed out during token refresh');
-        if (latest.refresh !== current.refresh)
-            return latest;
-        await this.credentials.set(CURSOR_CREDENTIAL_REF, JSON.stringify(next));
-        return next;
-    }
-    /** Return a Cursor browser URL immediately; polling continues on the host. */
-    async login() {
-        await this.cancel();
-        this.error = undefined;
-        const verifier = randomBytes(96).toString('base64url');
-        const challenge = createHash('sha256').update(verifier).digest('base64url');
-        const uuid = randomUUID();
-        const url = new URL('https://cursor.com/loginDeepControl');
-        url.search = new URLSearchParams({
-            challenge,
-            uuid,
-            mode: 'login',
-            redirectTarget: 'cli',
-        }).toString();
-        const abort = new AbortController();
-        const promise = this.pollLogin(uuid, verifier, abort.signal)
-            .catch((error) => {
-            if (!abort.signal.aborted)
-                this.error = error instanceof Error ? error.message : String(error);
-        })
-            .finally(() => {
-            if (this.loginTask?.abort === abort)
-                this.loginTask = undefined;
-        });
-        this.loginTask = { abort, promise };
-        return { authorizeUrl: url.href };
-    }
-    async pollLogin(uuid, verifier, signal) {
-        let delay = 1000;
-        for (let attempt = 0; attempt < 150; attempt++) {
-            await abortableDelay(delay, signal);
-            const url = `${API_ORIGIN}/auth/poll?uuid=${encodeURIComponent(uuid)}&verifier=${encodeURIComponent(verifier)}`;
-            const response = await this.http(url, {
-                headers: { accept: 'application/json' },
-                redirect: 'error',
-                signal,
-            });
-            if (response.status === 404) {
-                delay = Math.min(Math.ceil(delay * 1.2), 10_000);
-                continue;
-            }
-            if (!response.ok)
-                throw new Error(`Cursor login failed (HTTP ${response.status})`);
-            const body = (await parseProviderJson(response, 'Cursor login poll'));
-            signal.throwIfAborted();
-            if (typeof body.accessToken !== 'string' ||
-                body.accessToken.length === 0) {
-                throw new Error('Cursor login returned no access token');
-            }
-            if (typeof body.refreshToken !== 'string' ||
-                body.refreshToken.length === 0) {
-                throw new Error('Cursor login returned no refresh token');
-            }
-            const value = {
-                type: 'oauth',
-                access: body.accessToken,
-                refresh: body.refreshToken,
-                expires: tokenExpiry(body.accessToken, this.now()),
-            };
-            await this.credentials.set(CURSOR_CREDENTIAL_REF, JSON.stringify(value));
-            return;
-        }
-        throw new Error('Cursor login timed out');
-    }
-    async cancel() {
-        const task = this.loginTask;
-        task?.abort.abort(new Error('Cursor login cancelled'));
-        await task?.promise;
-        if (this.loginTask === task)
-            this.loginTask = undefined;
-        this.error = undefined;
-    }
-    async logout() {
-        await this.cancel();
-        await this.credentials.unset(CURSOR_CREDENTIAL_REF);
-    }
-}

package/lib/providers/cursor-model-settings.d.ts

@@ -1,15 +0,0 @@
-/** Cursor currently has one credential, so only provider-wide model visibility is configurable. */
-export interface CursorModelSettings {
-    visibleModels?: string[];
-}
-export declare function validateCursorModelSettings(input: unknown): CursorModelSettings;
-/** Durable visibility preference; account tokens remain in DSH credentials. */
-export declare class CursorModelSettingsStore {
-    readonly path: string;
-    private current;
-    private writes;
-    constructor(path?: string);
-    get(): CursorModelSettings;
-    visibleModels(): readonly string[] | undefined;
-    set(input: unknown): Promise<void>;
-}

package/lib/providers/cursor-model-settings.js

@@ -1,60 +0,0 @@
-import { readFileSync } from 'node:fs';
-import { mkdir, rename, rm, writeFile } from 'node:fs/promises';
-import { dirname } from 'node:path';
-import { dshHomePath } from '@deepseek-ai/dsh-home-paths';
-export function validateCursorModelSettings(input) {
-    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
-        throw new Error('Cursor model settings must be an object');
-    }
-    const models = input.visibleModels;
-    if (models === undefined)
-        return {};
-    if (!Array.isArray(models) ||
-        models.some((id) => typeof id !== 'string' || !id.trim())) {
-        throw new Error('visibleModels must be an array of model ids');
-    }
-    return { visibleModels: [...new Set(models)] };
-}
-/** Durable visibility preference; account tokens remain in DSH credentials. */
-export class CursorModelSettingsStore {
-    path;
-    current = {};
-    writes = Promise.resolve();
-    constructor(path = dshHomePath('plugins', 'subscriptions', 'cursor-model-settings.json')) {
-        this.path = path;
-        try {
-            this.current = validateCursorModelSettings(JSON.parse(readFileSync(path, 'utf8')));
-        }
-        catch (error) {
-            if (error.code !== 'ENOENT')
-                throw new Error(`Cannot read Cursor model settings at ${path}`, {
-                    cause: error,
-                });
-        }
-    }
-    get() {
-        return structuredClone(this.current);
-    }
-    visibleModels() {
-        return this.current.visibleModels;
-    }
-    set(input) {
-        const validated = validateCursorModelSettings(input);
-        const run = this.writes.then(async () => {
-            await mkdir(dirname(this.path), { recursive: true });
-            const temporary = `${this.path}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
-            try {
-                await writeFile(temporary, JSON.stringify(validated, null, 2), {
-                    mode: 0o600,
-                });
-                await rename(temporary, this.path);
-            }
-            finally {
-                await rm(temporary, { force: true });
-            }
-            this.current = validated;
-        });
-        this.writes = run.catch(() => undefined);
-        return run;
-    }
-}

package/lib/providers/cursor-usage.d.ts

@@ -1,9 +0,0 @@
-/** Cursor individual-account quota projection from its dashboard endpoints. */
-import type { ProviderUsage } from './common.js';
-/** Cursor's WorkOS user id from the access JWT, without the identity prefix. */
-export declare function cursorUserId(token: string): string | undefined;
-/**
- * Read Cursor's individual dashboard quota using an OAuth access token.
- * The dashboard cookie is request-local; no token enters ProviderUsage.
- */
-export declare function fetchCursorUsage(accessToken: string, http?: typeof fetch, signal?: AbortSignal): Promise<ProviderUsage>;