vibe-usage-cli 0.0.0-stage → 0.1.1

package/build/providers/common.js

@@ -0,0 +1,294 @@
+// Transport shared by the providers: HTTPS to the allow-listed quota endpoints, local
+// processes, and locating the tools' binaries.
+import { spawn } from 'node:child_process';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import fsp from 'node:fs/promises';
+import https from 'node:https';
+import os from 'node:os';
+import path from 'node:path';
+import { cleanEnvironment } from "../core/environment.js";
+import { ProviderError, systemErrorCode } from "../core/errors.js";
+import { isFile, isObject } from "../core/files.js";
+import { hasControlChars } from "../core/model.js";
+import { APP_SLUG, DURATION_MS } from "../shared/catalog.js";
+import { getQuotaAgent } from "./tls-trust.js";
+const packageJson = JSON.parse(fs.readFileSync(new URL('../../package.json', import.meta.url), 'utf8'));
+export const APP_VERSION = isObject(packageJson) && typeof packageJson.version === 'string' ? packageJson.version : '0.0.0';
+export const USER_AGENT = `${APP_SLUG}/${APP_VERSION}`;
+export const MAX_RESPONSE_BYTES = 1024 * 1024;
+const DEFAULT_HTTP_TIMEOUT_MS = 15000;
+const DEFAULT_PROCESS_TIMEOUT_MS = 20000;
+// Treat tokens this close to expiry as expired: a request started now would fail mid-flight.
+const TOKEN_EXPIRY_SKEW_MS = DURATION_MS.MINUTE;
+// The only remote endpoints the app may call. Everything else is rejected before a request.
+export const QUOTA_ENDPOINTS = {
+    claude: 'https://api.anthropic.com/api/oauth/usage',
+    cursor: 'https://cursor.com/api/usage-summary'
+};
+const ALLOWED_ENDPOINTS = new Set(Object.values(QUOTA_ENDPOINTS));
+const CERTIFICATE_ERRORS = new Set([
+    'SELF_SIGNED_CERT_IN_CHAIN',
+    'DEPTH_ZERO_SELF_SIGNED_CERT',
+    'UNABLE_TO_GET_ISSUER_CERT',
+    'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',
+    'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+    'CERT_HAS_EXPIRED',
+    'CERT_NOT_YET_VALID',
+    'CERT_UNTRUSTED',
+    'CERT_REJECTED',
+    'CERT_SIGNATURE_FAILURE',
+    'ERR_TLS_CERT_ALTNAME_INVALID'
+]);
+// The first `length` hex digits of the value's SHA-256: a stable, short id that reveals nothing.
+export const sha256Prefix = (value, length) => crypto.createHash('sha256').update(value).digest('hex').slice(0, length);
+export function isExpired(epochMs, clock = Date.now) {
+    return typeof epochMs === 'number' && Number.isFinite(epochMs) && epochMs <= clock() + TOKEN_EXPIRY_SKEW_MS;
+}
+// Reads JWT claims without verifying the signature: only the expiry and subject are used, to
+// fail fast locally; the provider still authenticates the token.
+export function jwtClaims(token) {
+    const payload = typeof token === 'string' ? token.split('.') : [];
+    if (payload.length !== 3)
+        throw new ProviderError('auth_invalid');
+    try {
+        const claims = JSON.parse(Buffer.from(payload[1] ?? '', 'base64url').toString('utf8'));
+        if (isObject(claims))
+            return claims;
+    }
+    catch {
+        // reported below
+    }
+    throw new ProviderError('auth_invalid');
+}
+// A credentials document written by a provider's own tool.
+export async function readCredentialFile(file) {
+    let document;
+    try {
+        const stat = await fsp.stat(file);
+        if (stat.size > MAX_RESPONSE_BYTES)
+            throw new ProviderError('invalid_response');
+        document = JSON.parse(await fsp.readFile(file, 'utf8'));
+    }
+    catch (error) {
+        if (error instanceof ProviderError)
+            throw error;
+        throw new ProviderError(systemErrorCode(error) === 'ENOENT' ? 'auth_missing' : 'auth_invalid', { cause: error });
+    }
+    if (!isObject(document))
+        throw new ProviderError('auth_invalid');
+    return document;
+}
+function retryAfterSeconds(header) {
+    if (typeof header !== 'string')
+        return undefined;
+    const seconds = Number(header);
+    return Number.isFinite(seconds) ? seconds : Math.ceil((Date.parse(header) - Date.now()) / 1000);
+}
+function httpStatusError(response) {
+    const status = response.statusCode;
+    const code = status === 429 ? 'rate_limited' : status === 401 || status === 403 ? 'auth_rejected' : 'http_rejected';
+    const retryAfter = retryAfterSeconds(response.headers['retry-after']);
+    return new ProviderError(code, retryAfter === undefined ? {} : { retryAfterSeconds: retryAfter });
+}
+// One-shot settlement shared by the HTTP clients: the first outcome wins, the deadline is
+// cleared, and a failure destroys every attached stream.
+export function settleOnce(resolve, reject, timeoutMs) {
+    let settled = false;
+    const streams = [];
+    const deadline = setTimeout(() => {
+        fail(new ProviderError('request_timeout'));
+    }, timeoutMs);
+    const settle = () => {
+        if (settled)
+            return false;
+        settled = true;
+        clearTimeout(deadline);
+        return true;
+    };
+    function fail(error) {
+        if (!settle())
+            return;
+        for (const stream of streams)
+            stream.destroy();
+        reject(error);
+    }
+    return {
+        succeed: value => {
+            if (settle())
+                resolve(value);
+        },
+        fail,
+        attach: stream => {
+            streams.push(stream);
+            return stream;
+        }
+    };
+}
+// Settles with the parsed JSON body. Handlers stay attached after settling: a destroyed
+// stream can still emit error or aborted later.
+export function readJsonResponse(response, settle, maxBytes = MAX_RESPONSE_BYTES) {
+    response.on('error', () => {
+        settle.fail(new ProviderError('transport_error'));
+    });
+    response.on('aborted', () => {
+        settle.fail(new ProviderError('transport_error'));
+    });
+    // A rejected response is destroyed on failure; its body is never read.
+    if (response.statusCode !== 200) {
+        settle.fail(httpStatusError(response));
+        return;
+    }
+    let bytes = 0;
+    let chunks = [];
+    response.on('data', (chunk) => {
+        bytes += chunk.length;
+        if (bytes > maxBytes) {
+            chunks = [];
+            settle.fail(new ProviderError('response_too_large'));
+        }
+        else
+            chunks.push(chunk);
+    });
+    response.on('end', () => {
+        try {
+            settle.succeed(JSON.parse(Buffer.concat(chunks).toString('utf8')));
+        }
+        catch {
+            settle.fail(new ProviderError('invalid_response'));
+        }
+    });
+}
+export const getJson = (endpoint, { headers = {}, timeoutMs = DEFAULT_HTTP_TIMEOUT_MS, requestImpl = https.get } = {}) => new Promise((resolve, reject) => {
+    if (!ALLOWED_ENDPOINTS.has(endpoint)) {
+        reject(new ProviderError('endpoint_not_allowed'));
+        return;
+    }
+    const settle = settleOnce(resolve, reject, timeoutMs);
+    try {
+        const request = settle.attach(requestImpl(new URL(endpoint), { headers, timeout: timeoutMs, agent: getQuotaAgent(), rejectUnauthorized: true }, response => {
+            readJsonResponse(settle.attach(response), settle);
+        }));
+        request.on('timeout', () => {
+            settle.fail(new ProviderError('request_timeout'));
+        });
+        request.on('error', error => {
+            settle.fail(new ProviderError(CERTIFICATE_ERRORS.has(String(systemErrorCode(error))) ? 'tls_certificate_error' : 'transport_error'));
+        });
+    }
+    catch (error) {
+        settle.fail(error instanceof ProviderError ? error : new ProviderError('transport_error', { cause: error }));
+    }
+});
+// Files inside app.asar cannot be executed; electron-builder unpacks them next to it.
+export function unpackedPath(file) {
+    return file.replace(/([\\/])app\.asar([\\/])/, '$1app.asar.unpacked$2');
+}
+function isValidBinary(file, platform = process.platform) {
+    if (typeof file !== 'string' || !file || hasControlChars(file) || /\.(cmd|bat|ps1)$/i.test(file))
+        return false;
+    return (platform === 'win32' ? path.win32 : path.posix).isAbsolute(file);
+}
+// Windows ships this interpreter; it is all the launch and discovery scripts need.
+export function windowsPowerShell(env = process.env) {
+    const candidate = env.VIBE_POWERSHELL_BINARY ?? path.win32.join(env.SystemRoot ?? 'C:\\Windows', 'System32/WindowsPowerShell/v1.0/powershell.exe');
+    if (!isValidBinary(candidate, 'win32'))
+        throw new ProviderError('invalid_binary');
+    return candidate;
+}
+// How each tool is installed: its command-line binaries in lookup order, and its desktop app.
+// Launches and diagnostics both look tools up here.
+export const TOOL_INSTALLS = {
+    claude: { binaries: ['claude'] },
+    codex: { binaries: ['codex'] },
+    // The Cursor Agent CLI; older installs only have the `agent` name.
+    cursor: { binaries: ['cursor-agent', 'agent'], app: { mac: 'Cursor', windows: ['cursor', 'Cursor.exe'] } },
+    antigravity: { binaries: [], app: { mac: 'Antigravity', windows: ['Antigravity', 'Antigravity.exe'] } }
+};
+const localAppData = (env, home) => env.LOCALAPPDATA ?? path.join(home, 'AppData', 'Local');
+// Where a desktop app's per-user Windows installer puts its executable.
+export const windowsAppPath = (app, env, home) => path.join(localAppData(env, home), 'Programs', ...app.windows);
+// Per-user install locations that GUI-launched apps miss: Finder/Explorer do not load the
+// shell profile that would put them on PATH.
+const HOME_BIN_TOOLS = new Set([...TOOL_INSTALLS.claude.binaries, ...TOOL_INSTALLS.cursor.binaries]);
+function knownInstallLocations(name, env, home, platform) {
+    const filename = platform === 'win32' ? `${name}.exe` : name;
+    const locations = [];
+    if (name === 'codex' && platform === 'win32')
+        locations.push(path.join(localAppData(env, home), 'Programs/OpenAI/Codex/bin/codex.exe'));
+    if (HOME_BIN_TOOLS.has(name))
+        locations.push(path.join(home, '.local/bin', filename));
+    return locations;
+}
+// The directories macOS path_helper adds to PATH (missing files simply add nothing).
+async function macPathHelperDirectories() {
+    const extra = await fsp.readdir('/etc/paths.d').catch(() => []);
+    const files = ['/etc/paths', ...extra.map(entry => path.join('/etc/paths.d', entry))];
+    const contents = await Promise.all(files.map(file => fsp.readFile(file, 'utf8').catch(() => '')));
+    return contents.flatMap(text => text.split(/\r?\n/).filter(line => line.startsWith('/')));
+}
+// `VIBE_<NAME>_BINARY` overrides the search; otherwise known install locations, then PATH.
+export async function findBinary(name, { env = process.env, home = os.homedir(), platform = process.platform } = {}) {
+    const override = env[`VIBE_${name.toUpperCase().replaceAll('-', '_')}_BINARY`];
+    if (override) {
+        if (!isValidBinary(override, platform))
+            throw new ProviderError('invalid_binary');
+        if (await isFile(override))
+            return override;
+        throw new ProviderError('binary_missing');
+    }
+    const filename = platform === 'win32' ? `${name}.exe` : name;
+    const directories = (env.PATH ?? env.Path ?? '').split(path.delimiter).filter(Boolean);
+    if (platform === 'darwin')
+        directories.push(...(await macPathHelperDirectories()));
+    const candidates = [...knownInstallLocations(name, env, home, platform), ...directories.map(directory => path.join(directory, filename))];
+    for (const candidate of candidates) {
+        if (isValidBinary(candidate, platform) && (await isFile(candidate)))
+            return candidate;
+    }
+    throw new ProviderError('binary_missing');
+}
+// Runs a binary without a shell and resolves with its stdout. The environment has no
+// credential overrides unless `env` is given.
+export const runProcess = (binary, args, { env, platform = process.platform, timeoutMs = DEFAULT_PROCESS_TIMEOUT_MS, maxBytes = MAX_RESPONSE_BYTES } = {}) => new Promise((resolve, reject) => {
+    if (!isValidBinary(binary, platform) || args.some(arg => arg.includes('\0'))) {
+        reject(new ProviderError('invalid_binary'));
+        return;
+    }
+    const child = spawn(binary, args, {
+        env: env ?? cleanEnvironment({}, platform),
+        shell: false,
+        windowsHide: true,
+        stdio: ['ignore', 'pipe', 'ignore']
+    });
+    let output = '';
+    let bytes = 0;
+    let failure = null;
+    const timer = setTimeout(() => {
+        failure = new ProviderError('process_timeout');
+        child.kill('SIGKILL');
+    }, timeoutMs);
+    child.stdout.on('data', (chunk) => {
+        bytes += chunk.length;
+        if (bytes > maxBytes) {
+            output = '';
+            failure = new ProviderError('response_too_large');
+            child.kill('SIGKILL');
+        }
+        else
+            output += chunk.toString();
+    });
+    child.on('error', () => {
+        clearTimeout(timer);
+        reject(new ProviderError('process_failed'));
+    });
+    child.on('close', code => {
+        clearTimeout(timer);
+        if (failure)
+            reject(failure);
+        else if (code !== 0)
+            reject(new ProviderError('process_failed'));
+        else
+            resolve(output);
+    });
+});

package/build/providers/cursor.d.ts

@@ -0,0 +1,14 @@
+import type { Environment } from '../core/environment.ts';
+import { type Clock, type GetJson, type RunProcess } from './common.ts';
+import type { ParsedQuota, ProviderAdapter } from './types.ts';
+export declare function parseCursorUsage(summary: unknown): ParsedQuota;
+export declare function findCursorAgent(): Promise<string | null>;
+export interface CursorProviderOptions {
+    home?: string;
+    platform?: NodeJS.Platform;
+    env?: Environment;
+    clock?: Clock;
+    getJson?: GetJson;
+    runProcess?: RunProcess;
+}
+export declare function createCursorProvider(options?: CursorProviderOptions): ProviderAdapter;

package/build/providers/cursor.js

@@ -0,0 +1,141 @@
+import os from 'node:os';
+import path from 'node:path';
+import { ProviderError } from "../core/errors.js";
+import { isObject } from "../core/files.js";
+import { normalizeWindow, safePlan } from "../core/model.js";
+import { accountId, DEFAULT_ACCOUNT_KEY } from "../shared/catalog.js";
+import { findBinary, getJson as defaultGetJson, isExpired, jwtClaims, QUOTA_ENDPOINTS, readCredentialFile, runProcess as defaultRunProcess, TOOL_INSTALLS } from "./common.js";
+const USAGE_TIMEOUT_MS = 20000;
+const SQLITE_TIMEOUT_MS = 5000;
+// Percent-based plan scopes reported as `<scope>PercentUsed`.
+const PLAN_SCOPES = {
+    auto: { labelKey: 'labelAutoScope' },
+    // Spent, it stops the API-priced models only; Auto goes on.
+    api: { labelKey: 'labelApiScope', detailKey: 'cursorApiLimitNote', partial: true, except: ['auto'] },
+    total: { labelKey: 'labelTotalUsage', detailKey: 'totalQuotaDesc', section: 'details' }
+};
+// Money pools reported in USD cents per usage group.
+const SPEND_POOLS = {
+    onDemand: 'labelOnDemandSpend',
+    overall: 'labelOverallSpend',
+    pooled: 'labelPooledSpend'
+};
+const USAGE_GROUPS = ['individual', 'team'];
+const SUMMARY_FIELDS = ['individualUsage', 'teamUsage', 'membershipType', 'billingCycleEnd'];
+const poolAmounts = (pool) => ({ used: pool.used, limit: pool.limit, remaining: pool.remaining });
+// Without a remaining amount the value says so; the UI words amounts it does have.
+function poolValue(pool) {
+    if (pool.enabled === false)
+        return { valueKey: 'disabled' };
+    return typeof pool.remaining === 'number' && Number.isFinite(pool.remaining) ? {} : { valueKey: 'amountNotReported' };
+}
+export function parseCursorUsage(summary) {
+    if (!isObject(summary) || !SUMMARY_FIELDS.some(field => summary[field] !== undefined))
+        throw new ProviderError('invalid_response');
+    const resetsAt = summary.billingCycleEnd;
+    const windows = [];
+    const individual = isObject(summary.individualUsage) ? summary.individualUsage : {};
+    if (isObject(individual.plan)) {
+        const plan = individual.plan;
+        for (const [scope, keys] of Object.entries(PLAN_SCOPES)) {
+            windows.push(normalizeWindow({ id: `plan:${scope}`, ...keys, usedPercent: plan[`${scope}PercentUsed`], resetsAt }));
+        }
+        const bonus = isObject(plan.breakdown) ? plan.breakdown.bonus : undefined;
+        windows.push(normalizeWindow({
+            id: 'plan:spend',
+            labelKey: 'labelIncludedSpend',
+            section: 'details',
+            resetsAt,
+            amounts: { ...poolAmounts(plan), bonus },
+            ...poolValue(plan)
+        }));
+    }
+    for (const group of USAGE_GROUPS) {
+        const usage = summary[`${group}Usage`];
+        for (const [key, labelKey] of Object.entries(SPEND_POOLS)) {
+            const pool = isObject(usage) ? usage[key] : undefined;
+            if (!isObject(pool))
+                continue;
+            windows.push(normalizeWindow({
+                id: `${group}:${key}`,
+                labelKey,
+                group,
+                section: 'details',
+                resetsAt,
+                amounts: poolAmounts(pool),
+                ...poolValue(pool)
+            }));
+        }
+    }
+    const membership = safePlan(summary.membershipType);
+    return {
+        windows,
+        ...(membership ? { plan: membership } : {}),
+        ...(windows.length ? {} : { status: 'no_limits_reported' })
+    };
+}
+async function readAccessToken({ home, platform, env, runProcess }) {
+    if (platform === 'win32') {
+        const auth = await readCredentialFile(path.join(env.APPDATA ?? path.join(home, 'AppData/Roaming'), 'Cursor/auth.json'));
+        return auth.accessToken;
+    }
+    if (platform !== 'darwin')
+        throw new ProviderError('unsupported_platform');
+    // Cursor keeps its access token in the editor's state database. `immutable=1` reads the live
+    // database without locking or mutating it.
+    const db = path.join(home, 'Library/Application Support/Cursor/User/globalStorage/state.vscdb');
+    const query = "SELECT value FROM ItemTable WHERE key = 'cursorAuth/accessToken' LIMIT 1;";
+    try {
+        return (await runProcess('/usr/bin/sqlite3', ['-readonly', `file:${db}?immutable=1`, query], { timeoutMs: SQLITE_TIMEOUT_MS })).trim();
+    }
+    catch (error) {
+        throw new ProviderError('auth_missing', { cause: error });
+    }
+}
+const COOKIE_USER = /^[A-Za-z0-9._-]+$/;
+// The session cookie is `<user id>::<token>`; the user id is the last `|` segment of `sub`.
+function sessionCookie(token, clock) {
+    const { sub, exp } = jwtClaims(token);
+    const user = typeof sub === 'string' ? (sub.split('|').at(-1) ?? '') : '';
+    if (!COOKIE_USER.test(user) || typeof exp !== 'number' || !Number.isFinite(exp))
+        throw new ProviderError('auth_invalid');
+    if (isExpired(exp * 1000, clock))
+        throw new ProviderError('auth_expired');
+    return `WorkosCursorSessionToken=${user}%3A%3A${token}`;
+}
+// The Cursor Agent CLI; null when not installed.
+export async function findCursorAgent() {
+    for (const name of TOOL_INSTALLS.cursor.binaries) {
+        const binary = await findBinary(name).catch(() => null);
+        if (binary)
+            return binary;
+    }
+    return null;
+}
+export function createCursorProvider(options = {}) {
+    const source = {
+        home: options.home ?? os.homedir(),
+        platform: options.platform ?? process.platform,
+        env: options.env ?? process.env,
+        runProcess: options.runProcess ?? defaultRunProcess
+    };
+    const getJson = options.getJson ?? defaultGetJson;
+    return {
+        id: 'cursor',
+        discover: () => Promise.resolve([
+            { id: accountId('cursor', DEFAULT_ACCOUNT_KEY), providerId: 'cursor', labelKey: 'defaultAccount', primary: true, enabled: true }
+        ]),
+        async fetch(account) {
+            if (account.configDir)
+                throw new ProviderError('unsupported_profile');
+            const token = await readAccessToken(source);
+            if (typeof token !== 'string' || !token.trim())
+                throw new ProviderError('auth_missing');
+            const usage = await getJson(QUOTA_ENDPOINTS.cursor, {
+                headers: { Accept: 'application/json', Cookie: sessionCookie(token, options.clock) },
+                timeoutMs: USAGE_TIMEOUT_MS
+            });
+            return parseCursorUsage(usage);
+        }
+    };
+}

package/build/providers/profiles.d.ts

@@ -0,0 +1,10 @@
+import { type ProfileProviderId } from '../shared/catalog.ts';
+import type { Account } from '../shared/types.ts';
+export declare const shortHash: (value: string) => string;
+export declare const defaultProfileDir: (providerId: ProfileProviderId, home: string) => string;
+export declare function accountProfileDirs(providerId: ProfileProviderId, home: string, accounts: readonly Account[]): string[];
+export declare const profileAccountId: (providerId: ProfileProviderId, configDir: string) => string;
+export declare function profileLabel(providerId: ProfileProviderId, configDir: string): string;
+export declare function profileFolders(providerId: ProfileProviderId, home: string): Promise<string[]>;
+export declare function createProfileFolder(providerId: ProfileProviderId, home: string, isFree: (dir: string) => Promise<boolean>): Promise<string>;
+export declare function isRegularFile(file: string): Promise<boolean>;

package/build/providers/profiles.js

@@ -0,0 +1,69 @@
+// Profile folders of the tools that keep one sign-in per folder (see PROFILE_DIRS): finding
+// them in the home directory, and the id and name of the account each one holds.
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { AppError, systemErrorCode } from "../core/errors.js";
+import { accountId, PROFILE_DIRS } from "../shared/catalog.js";
+import { sha256Prefix } from "./common.js";
+const ID_HASH_LENGTH = 12;
+// Numbered folders the app creates for new accounts: `.codex-2`, `.codex-3`, …
+const FIRST_NEW_PROFILE = 2;
+const MAX_NEW_PROFILE = 99;
+const PROFILE_NAME = /^[a-zA-Z0-9_-]+$/;
+// Sibling folders that are copies rather than profiles (`.claude-backup`, `.codex-old`).
+const COPY_NAME = /(?:^|[-_])(backup|backups|history|old|archive|copy|bak)(?:[-_]|$)/i;
+export const shortHash = (value) => sha256Prefix(value, ID_HASH_LENGTH);
+export const defaultProfileDir = (providerId, home) => path.join(home, PROFILE_DIRS[providerId]);
+// Where a tool keeps its settings and transcripts: the default profile folder and every folder
+// an enabled account of the tool uses, each once.
+export function accountProfileDirs(providerId, home, accounts) {
+    const used = accounts.filter(a => a.providerId === providerId && a.enabled).flatMap(a => (a.configDir ? [a.configDir] : []));
+    return [...new Set([defaultProfileDir(providerId, home), ...used].map(dir => path.resolve(dir)))];
+}
+export const profileAccountId = (providerId, configDir) => accountId(providerId, shortHash(path.resolve(configDir)));
+// `.codex-work` is named `work`; any other folder keeps its own name.
+export function profileLabel(providerId, configDir) {
+    const name = path.basename(configDir);
+    const prefix = `${PROFILE_DIRS[providerId]}-`;
+    const label = name === PROFILE_DIRS[providerId] ? '' : name.startsWith(prefix) ? name.slice(prefix.length) : name;
+    return label || path.resolve(configDir);
+}
+// The default profile folder and its `-<name>` siblings that exist in `home`.
+export async function profileFolders(providerId, home) {
+    const base = PROFILE_DIRS[providerId];
+    const entries = await fsp.readdir(home, { withFileTypes: true }).catch(() => []);
+    return entries
+        .filter(entry => {
+        if (!entry.isDirectory())
+            return false;
+        if (entry.name === base)
+            return true;
+        const suffix = entry.name.startsWith(`${base}-`) ? entry.name.slice(base.length + 1) : '';
+        return PROFILE_NAME.test(suffix) && !COPY_NAME.test(suffix);
+    })
+        .map(entry => path.join(home, entry.name));
+}
+// The first numbered profile folder in `home` a new account can have: a new one, private to the
+// user, or an existing one that `isFree` (no account uses it and it holds no sign-in, as one a
+// sign-in given up on leaves behind).
+export async function createProfileFolder(providerId, home, isFree) {
+    for (let n = FIRST_NEW_PROFILE; n <= MAX_NEW_PROFILE; n++) {
+        const dir = path.join(home, `${PROFILE_DIRS[providerId]}-${n}`);
+        try {
+            await fsp.mkdir(dir, { mode: 0o700 });
+            return dir;
+        }
+        catch (error) {
+            if (systemErrorCode(error) !== 'EEXIST')
+                throw error;
+            if ((await fsp.lstat(dir)).isDirectory() && (await isFree(dir)))
+                return dir;
+        }
+    }
+    throw new AppError('invalid_path');
+}
+// A sign-in file counts only as a regular file: a symbolic link could point anywhere.
+export async function isRegularFile(file) {
+    const stat = await fsp.lstat(file).catch(() => null);
+    return stat?.isFile() ?? false;
+}

package/build/providers/tls-trust.d.ts

@@ -0,0 +1,7 @@
+import https from 'node:https';
+import tls from 'node:tls';
+export type CertificateSource = Pick<typeof tls, 'getCACertificates'>;
+export declare function createQuotaAgent({ tlsApi }?: {
+    tlsApi?: CertificateSource;
+}): https.Agent;
+export declare function getQuotaAgent(): https.Agent;

package/build/providers/tls-trust.js

@@ -0,0 +1,29 @@
+import https from 'node:https';
+import tls from 'node:tls';
+import { ProviderError } from "../core/errors.js";
+import { asArray } from "../core/files.js";
+// Node's bundled roots alone do not represent Windows/macOS trust. This uses the platform
+// store, keeps the configured default and extra roots, and applies only to quota requests:
+// no global TLS state is changed.
+export function createQuotaAgent({ tlsApi = tls } = {}) {
+    let roots;
+    try {
+        roots = [tlsApi.getCACertificates('default'), tlsApi.getCACertificates('system')];
+    }
+    catch (error) {
+        throw new ProviderError('trust_store_unavailable', { cause: error });
+    }
+    if (!roots.every(Array.isArray))
+        throw new ProviderError('trust_store_unavailable');
+    return new https.Agent({
+        ca: [...new Set(roots.flatMap(list => asArray(list).filter(root => typeof root === 'string')))],
+        rejectUnauthorized: true,
+        checkServerIdentity: tls.checkServerIdentity,
+        keepAlive: false
+    });
+}
+let quotaAgent;
+export function getQuotaAgent() {
+    quotaAgent ??= createQuotaAgent();
+    return quotaAgent;
+}

package/build/providers/types.d.ts

@@ -0,0 +1,19 @@
+import type { WindowInput } from '../core/model.ts';
+import type { ProviderId } from '../shared/catalog.ts';
+import type { Account, QuotaWindow } from '../shared/types.ts';
+export interface FetchResult {
+    windows: WindowInput[];
+    plan?: string;
+    signedInAs?: string;
+    status?: 'no_limits_reported';
+}
+export interface ParsedQuota extends FetchResult {
+    windows: QuotaWindow[];
+}
+export type DiscoveredAccount = Omit<Account, 'origin'>;
+export interface ProviderAdapter {
+    readonly id: ProviderId;
+    readonly fetchTimeoutMs?: number;
+    discover(): Promise<DiscoveredAccount[]>;
+    fetch(account: Account): Promise<FetchResult>;
+}

package/build/providers/types.js

@@ -0,0 +1 @@
+export {};

package/build/shared/account-state.d.ts

@@ -0,0 +1,19 @@
+import type { AccountStatus, MeasuredAccount, ProviderState, QuotaWindow } from './types.ts';
+export declare const HEALTHY_STATUSES: ReadonlySet<AccountStatus>;
+export declare const isLowQuota: (remaining: number | null, threshold: number) => boolean;
+export declare const needsSignIn: (account: MeasuredAccount) => boolean;
+export type KnownWindow = QuotaWindow & {
+    remainingPercent: number;
+};
+export type CompactNote = 'reading' | 'waiting' | 'signIn' | 'openApp' | 'noLimits' | 'noData';
+export interface CompactLine {
+    account: MeasuredAccount;
+    window: KnownWindow | null;
+    other: KnownWindow | null;
+    tighter: KnownWindow | null;
+    stale: boolean;
+    low: boolean;
+    tighterLow: boolean;
+    note: CompactNote | null;
+}
+export declare function compactLines(state: ProviderState, lowQuotaPercent: number): CompactLine[];