@modelprofile.com/authswitch 2.1.2

package/ts/classes.accountlist.ts

@@ -0,0 +1,211 @@
+import * as plugins from './plugins.js';
+import { accountQuotaSummary, orderedUsageWindows, readAccountRows, duration, until } from './accounts.js';
+import type { IAuthHarness, IHarnessAccountStatus, IHarnessStatusFact } from './interfaces.harness.js';
+import type { IAccountList, IHarnessAccountList } from './interfaces.list.js';
+import { bold, dim, orange, plainText } from './formatting.js';
+
+type TListedAccount = IHarnessAccountList['accounts'][number];
+interface IDisplayFact { account: number; label: string; value: string; }
+
+/** Allowlist the public data contract: never serialize a harness or its credential-bearing internals. */
+const publicStatus = (statusArg: IHarnessAccountStatus): IHarnessAccountStatus => {
+  const summary = statusArg.summary;
+  return {
+    facts: statusArg.facts.map(({ label, value, section, summaryKey }) => ({ label, value, section, summaryKey })),
+    problems: [...statusArg.problems],
+    ...(summary === undefined ? {} : { summary: {
+      ...(summary.subscription === undefined ? {} : { subscription: { plan: summary.subscription.plan, source: summary.subscription.source } }),
+      ...(summary.billing === undefined ? {} : { billing: { hasActiveSubscription: summary.billing.hasActiveSubscription, autoRenew: summary.billing.autoRenew, renewsAt: summary.billing.renewsAt, cancelsAt: summary.billing.cancelsAt, expiresAt: summary.billing.expiresAt } }),
+      ...(summary.usageWindows === undefined ? {} : { usageWindows: summary.usageWindows.map(({ label, scope, durationSeconds, usedPercent, resetAt }) => ({ label, scope, durationSeconds, usedPercent, resetAt })) }),
+      ...(summary.resets === undefined ? {} : { resets: {
+        available: summary.resets.available,
+        ...(summary.resets.details === undefined ? {} : { details: summary.resets.details.map(({ status, kind, expiresAt }) => ({ status, kind, expiresAt })) }),
+      } }),
+    } }),
+  };
+};
+
+export const readAccountList = async (harnessesArg: IAuthHarness[]): Promise<IAccountList> => {
+  const harnesses: IHarnessAccountList[] = [];
+  for (const harness of harnessesArg) {
+    const result: IHarnessAccountList = { id: harness.id, label: harness.label, loginHint: harness.loginHint, saveUnavailableReason: null, accounts: [], problems: [] };
+    try {
+      const { state, rows } = await readAccountRows(harness);
+      result.saveUnavailableReason = state.saveUnavailableReason;
+      result.accounts = rows.map(({ account, status }) => ({
+        id: account.id, label: account.label, isActive: account.isActive, isStashed: account.isStashed,
+        savedAt: account.savedAt, details: [...account.details], ...(account.slotId === undefined ? {} : { slotId: account.slotId }),
+        status: publicStatus(status!),
+      }));
+    } catch {
+      result.problems.push(`Could not read accounts. Run authswitch ${harness.id} doctor.`);
+    }
+    harnesses.push(result);
+  }
+  return {
+    schemaVersion: 2, generatedAt: new Date().toISOString(),
+    complete: harnesses.every(harness => !harness.problems.length && harness.accounts.every(account => !account.status.problems.length)),
+    harnesses,
+  };
+};
+
+/** Shared, provider-independent list presentation. Adapters supply grouping metadata. */
+export class AccountListRenderer {
+  constructor(private readonly out: plugins.smartconsole.SmartConsole) {}
+  private get width(): number { return process.stdout.columns ?? 100; }
+  private heading(textArg: string): void { process.stdout.write(`\n${bold(textArg)}\n`); }
+
+  private async table<TRow>(rowsArg: TRow[], columnsArg: plugins.smartconsole.IBackendTableColumn<TRow>[]): Promise<void> {
+    if (!rowsArg.length) return;
+    if (this.width < 40) {
+      for (const row of rowsArg) {
+        process.stdout.write(columnsArg.map(column => `  ${column.title}: ${String(column.value(row) ?? 'Unavailable').replace(/\n/g, '\n    ')}`).join('\n') + '\n\n');
+      }
+      return;
+    }
+    await this.out.table(rowsArg, { columns: columnsArg, overflow: 'wrap', theme: { header: { bold: true, foreground: 'cyan' }, border: { dim: true } } });
+  }
+
+  public async render(listArg: IAccountList): Promise<void> {
+    const now = Date.parse(listArg.generatedAt);
+    if (!listArg.harnesses.length) process.stdout.write('No harnesses registered.\n');
+    for (const harness of listArg.harnesses) {
+      this.heading(plainText(harness.label));
+      if (harness.problems.length) {
+        for (const problem of harness.problems) process.stdout.write(`${orange('Unavailable')}: ${plainText(problem)}\n`);
+        continue;
+      }
+      if (!harness.accounts.length) {
+        process.stdout.write(`${dim(plainText(harness.saveUnavailableReason ?? 'No known accounts. ' + harness.loginHint))}\n`);
+        continue;
+      }
+      await this.overview(harness.accounts, now);
+      const schedules = harness.accounts.flatMap(account => orderedUsageWindows(account.status.summary?.usageWindows).map(window => ({ account: plainText(account.label), window })));
+      for (const feature of [false, true]) {
+        const scopedSchedules = schedules.filter(row => (row.window.scope === 'feature') === feature);
+        if (!scopedSchedules.length) continue;
+        this.heading(feature ? 'Feature-specific limits' : 'Usage & reset schedule');
+        await this.table(scopedSchedules, [
+          { key: 'account', title: 'Account', value: row => row.account },
+          { key: 'window', title: 'Window', value: row => `${plainText(row.window.label)} (${duration(row.window.durationSeconds)})` },
+          { key: 'usage', title: 'Usage', value: row => `${row.window.usedPercent}% used\n${Math.max(0, 100 - row.window.usedPercent)}% left` },
+          { key: 'reset', title: 'Reset in', value: row => until(row.window.resetAt, now) },
+        ]);
+      }
+      const resets = harness.accounts.flatMap(account => (account.status.summary?.resets?.details ?? []).map(reset => ({ account: plainText(account.label), reset })));
+      if (resets.length) {
+        this.heading('Earned reset details');
+        await this.table(resets, [
+          { key: 'account', title: 'Account', value: row => row.account },
+          { key: 'kind', title: 'Type', value: row => plainText(row.reset.kind) },
+          { key: 'status', title: 'Status', value: row => plainText(row.reset.status) },
+          { key: 'expiry', title: 'Expires (UTC)', value: row => row.reset.expiresAt === null ? 'Not reported' : plainText(row.reset.expiresAt).replace('T', '\n').replace('.000Z', '').replace(/Z$/, '') },
+        ]);
+      }
+      const groups = new Map<string, IDisplayFact[]>();
+      const add = (section: string, fact: IDisplayFact) => { const group = groups.get(section) ?? []; group.push(fact); groups.set(section, group); };
+      harness.accounts.forEach((account, index) => {
+        for (const fact of account.status.facts) {
+          if (!this.covered(fact, account.status)) add(plainText(fact.section ?? 'Additional information'), { account: index, label: plainText(fact.label), value: plainText(fact.value) });
+        }
+      });
+      for (const [section, facts] of groups) await this.facts(section, facts, harness.accounts);
+      const saved = harness.accounts.flatMap((account, index) => [
+        ...(account.savedAt ? [{ account: index, label: 'Saved (UTC)', value: plainText(account.savedAt) }] : []),
+        ...account.details.map((detail, detailIndex) => ({ account: index, label: `Note ${detailIndex + 1}`, value: plainText(detail) })),
+      ]);
+      await this.facts('Saved logins', saved, harness.accounts);
+      const issues = harness.accounts.flatMap(account => account.status.problems.map(problem => ({ account: plainText(account.label), issue: plainText(problem) })));
+      if (harness.saveUnavailableReason) issues.push({ account: 'Harness', issue: plainText(harness.saveUnavailableReason) });
+      if (issues.length) {
+        this.heading('Availability & actions');
+        await this.table(issues, [
+          { key: 'account', title: 'Account', value: row => row.account },
+          { key: 'issue', title: 'Unavailable / action needed', value: row => row.issue },
+        ]);
+      }
+    }
+  }
+
+  private async overview(accountsArg: TListedAccount[], nowArg: number): Promise<void> {
+    const rows = accountsArg;
+    const state = (account: TListedAccount) => `${account.isActive ? '* active\n' : ''}${account.isStashed ? 'saved' : 'not saved'}${account.status.problems.length ? '\n! partial status' : ''}`;
+    const plan = (account: TListedAccount) => account.status.summary?.subscription ? `${plainText(account.status.summary.subscription.plan)} (${account.status.summary.subscription.source})${account.status.summary.subscription.source === 'stored' ? '\nunverified' : ''}` : 'Unavailable';
+    const billing = (account: TListedAccount) => {
+      const info = account.status.summary?.billing;
+      if (!info) return 'Unavailable';
+      const dates = [
+        ...(info.renewsAt ? [`${info.autoRenew === true ? 'Renews' : 'Renewal boundary'}: ${plainText(info.renewsAt)}`] : []),
+        ...(info.cancelsAt ? [`Cancels: ${plainText(info.cancelsAt)}`] : []),
+        ...(info.expiresAt ? [`Expires: ${plainText(info.expiresAt)}`] : []),
+      ];
+      return [...(info.hasActiveSubscription === undefined ? [] : [info.hasActiveSubscription ? 'Subscription active' : 'No active subscription']),
+        info.autoRenew === true ? 'Auto-renew on' : info.autoRenew === false ? 'Auto-renew off' : 'Auto-renew unknown', ...dates,
+        ...(!dates.length ? ['Date unavailable'] : [])].join('\n');
+    };
+    const resets = (account: TListedAccount) => account.status.summary?.resets === undefined ? 'Unavailable' : String(account.status.summary.resets.available);
+    const usage = (account: TListedAccount) => accountQuotaSummary(account, nowArg);
+    const columns: plugins.smartconsole.IBackendTableColumn<typeof rows[number]>[] = [
+      { key: 'account', title: 'Account', value: row => plainText(row.label), style: row => ({ bold: row.isActive }) },
+    ];
+    if (this.width >= 100) columns.push(
+      { key: 'state', title: 'Login', value: state, style: row => ({ foreground: row.isStashed ? 'green' : 'orange' }) },
+      { key: 'plan', title: 'Plan', value: plan },
+      { key: 'usage', title: 'Usage / reset', value: usage },
+      { key: 'resets', title: 'Resets', value: resets, align: 'right' },
+    );
+    if (this.width >= 120) columns.splice(3, 0, { key: 'billing', title: 'Renewal / cancellation', value: billing });
+    else if (this.width >= 100) columns[2] = { key: 'plan', title: 'Plan / billing', value: row => `${plan(row)}\n${row.status.summary?.billing ? billing(row) : 'Billing unavailable'}` };
+    else if (this.width >= 60) columns.push(
+      { key: 'login', title: 'Login / plan', value: row => `${state(row)}\n${plan(row)}\n${row.status.summary?.billing ? billing(row) : 'Billing unavailable'}` },
+      { key: 'usage', title: 'Usage / resets', value: row => `${usage(row)}\nEarned resets: ${resets(row)}` },
+    );
+    else columns.push({ key: 'status', title: 'Status', value: row => `${state(row)}\nPlan: ${plan(row)}\nBilling: ${billing(row)}\nUsage: ${usage(row)}\nEarned resets: ${resets(row)}` });
+    await this.table(rows, columns);
+  }
+
+  private covered(factArg: IHarnessStatusFact, statusArg: IHarnessAccountStatus): boolean {
+    const summary = statusArg.summary;
+    if (!summary) return false;
+    switch (factArg.summaryKey) {
+      case 'subscription': return summary.subscription !== undefined;
+      case 'billing': return summary.billing !== undefined;
+      case 'usageWindows': return summary.usageWindows !== undefined;
+      case 'resets': return summary.resets !== undefined;
+      case 'resetDetails': return summary.resets?.details !== undefined;
+      default: return false;
+    }
+  }
+
+  /** Compare like metrics across accounts, keeping duplicate labels as separate rows. */
+  private async facts(titleArg: string, factsArg: IDisplayFact[], accountsArg: TListedAccount[]): Promise<void> {
+    if (!factsArg.length) return;
+    this.heading(titleArg);
+    const valueBudget = Math.max(10, Math.min(40, Math.max(...factsArg.map(fact => Math.max(fact.value.length, plainText(accountsArg[fact.account].label).length))) + 3));
+    const perPage = Math.max(1, Math.min(6, Math.floor((this.width - 30) / valueBudget)));
+    const accountIndices = accountsArg.map((_, index) => index).filter(index => factsArg.some(fact => fact.account === index));
+    for (let start = 0; start < accountIndices.length; start += perPage) {
+      const indices = accountIndices.slice(start, start + perPage);
+      const metrics = new Map<string, { label: string; values: Map<number, string> }>();
+      const occurrences = new Map<string, number>();
+      for (const fact of factsArg.filter(fact => indices.includes(fact.account))) {
+        const occurrenceKey = JSON.stringify([fact.account, fact.label]);
+        const occurrence = occurrences.get(occurrenceKey) ?? 0;
+        occurrences.set(occurrenceKey, occurrence + 1);
+        const key = JSON.stringify([fact.label, occurrence]);
+        const metric = metrics.get(key) ?? { label: fact.label, values: new Map<number, string>() };
+        metric.values.set(fact.account, fact.value);
+        metrics.set(key, metric);
+      }
+      if (this.width < 40) {
+        for (const index of indices) {
+          process.stdout.write(`  Account: ${plainText(accountsArg[index].label)}\n`);
+          for (const metric of metrics.values()) if (metric.values.has(index)) process.stdout.write(`  - ${metric.label}: ${metric.values.get(index)}\n`);
+        }
+      } else await this.table([...metrics.values()], [
+        { key: 'metric', title: 'Metric', value: row => row.label },
+        ...indices.map(index => ({ key: String(index), title: plainText(accountsArg[index].label), value: (row: { values: Map<number, string> }) => row.values.get(index) ?? 'Not reported' })),
+      ]);
+    }
+  }
+}

package/ts/classes.claudecodeharness.ts

@@ -0,0 +1,111 @@
+import * as plugins from './plugins.js';
+import { FileHarness, type IFileAccount, type IFileHarnessSnapshot } from './classes.fileharness.js';
+import { CredentialStore, credentialRecord, credentialText, readCredentialDocument, requireHarnessStopped } from './classes.credentialstore.js';
+import { ClaudeAccountStatus } from './classes.claudestatus.js';
+import { writeSecretFileAtomically } from './helpers.js';
+import type { IHarnessAccountStatus } from './interfaces.harness.js';
+
+export interface IClaudeCodeHarnessOptions {
+  configDir?: string;
+  globalConfigFile?: string;
+  stashRoot?: string;
+  env?: NodeJS.ProcessEnv;
+  platform?: NodeJS.Platform;
+  fetch?: typeof fetch;
+  checkStopped?: () => void;
+  /** Local settings sources to inspect for credential overrides, in increasing precedence. */
+  settingsFiles?: string[];
+}
+
+const accountCaches = ['additionalModelOptionsCache', 'additionalModelOptionsAnsweredAt', 'additionalModelCostsCache', 'modelAccessCache', 'orgModelDefaultCache', 'lastSeenOrgDefaultUpdatedAt', 'clientDataCache', 'clientDataCacheSlots', 'autoCompactWindowsCache', 'cachedUsageUtilization'];
+
+/** File-backed Claude Code subscriber login and its matching global oauthAccount metadata. */
+export class ClaudeCodeHarness extends FileHarness {
+  public readonly id = 'claude';
+  public readonly label = 'Claude Code';
+  public readonly loginHint = 'Log in using claude auth login, exit Claude Code, then authswitch claude stash --keep.';
+  protected readonly store: CredentialStore;
+  private readonly file: string;
+  private readonly configFile: string;
+  private readonly env: NodeJS.ProcessEnv;
+  private readonly platform: NodeJS.Platform;
+  private readonly status: ClaudeAccountStatus;
+  private readonly checkStopped: () => void;
+  private readonly settingsFiles: string[];
+
+  constructor(options: IClaudeCodeHarnessOptions = {}) {
+    super();
+    this.env = options.env ?? process.env;
+    const custom = options.configDir ?? this.env.CLAUDE_CONFIG_DIR;
+    const dir = custom || plugins.path.join(plugins.os.homedir(), '.claude');
+    this.file = plugins.path.join(dir, '.credentials.json');
+    this.configFile = options.globalConfigFile ?? plugins.path.join(custom || plugins.os.homedir(), '.claude.json');
+    this.store = new CredentialStore(this.id, options.stashRoot);
+    this.platform = options.platform ?? process.platform;
+    this.status = new ClaudeAccountStatus(options.fetch);
+    this.checkStopped = options.checkStopped ?? (() => requireHarnessStopped('claude'));
+    this.settingsFiles = options.settingsFiles ?? [plugins.path.join(dir, 'settings.json'),
+      plugins.path.join(process.cwd(), '.claude/settings.json'), plugins.path.join(process.cwd(), '.claude/settings.local.json')];
+  }
+  protected beforeMutation(): void { this.checkStopped(); }
+  protected inspect(credential: Record<string, unknown>, slotId: string): IFileAccount {
+    if (slotId !== 'anthropic') throw new Error('Unsupported Claude Code credential slot.');
+    const oauth = credentialRecord(credential.claudeAiOauth);
+    const account = credentialRecord(credential.oauthAccount);
+    if (!credentialText(oauth.accessToken) || !Array.isArray(oauth.scopes) || !oauth.scopes.every(scope => typeof scope === 'string')
+      || !credentialText(account.accountUuid) || !credentialText(account.organizationUuid) || !credentialText(account.emailAddress)) throw new Error('Claude Code login or its matching account metadata is incomplete. Log in again with Claude Code before saving.');
+    return { slotId, identity: JSON.stringify([account.accountUuid, account.organizationUuid]), label: String(account.emailAddress).toLowerCase(), credential };
+  }
+  protected snapshot(): IFileHarnessSnapshot {
+    if (this.platform === 'darwin') return { accounts: [], unavailable: 'Claude Code uses the macOS Keychain. This adapter supports file credentials on Linux and Windows; Keychain switching is unavailable.' };
+    const overrides = ['CLAUDE_CODE_OAUTH_TOKEN', 'CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR', 'ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN', 'ANTHROPIC_PROFILE', 'CLAUDE_CODE_USE_BEDROCK', 'CLAUDE_CODE_USE_VERTEX', 'CLAUDE_CODE_USE_FOUNDRY', 'ANTHROPIC_BASE_URL'];
+    const settings: Record<string, unknown> = {};
+    const environment: Record<string, unknown> = { ...this.env };
+    for (const file of this.settingsFiles) {
+      const data = readCredentialDocument(file).data;
+      Object.assign(settings, data);
+      if (data.env != null) Object.assign(environment, credentialRecord(data.env));
+    }
+    if (overrides.some(key => environment[key]) || credentialText(settings.apiKeyHelper)) return { accounts: [], unavailable: 'Claude Code has a settings or environment credential/provider override. Remove it before managing subscriber file logins.' };
+    const data = readCredentialDocument(this.file).data;
+    if (data.claudeAiOauth == null) return { accounts: [], unavailable: null };
+    const config = readCredentialDocument(this.configFile).data;
+    try { return { accounts: [this.inspect({ claudeAiOauth: data.claudeAiOauth, oauthAccount: config.oauthAccount }, 'anthropic')], unavailable: null }; }
+    catch { return { accounts: [], unavailable: 'Claude Code login or account metadata is incomplete. Log in again with Claude Code; existing files were preserved.' }; }
+  }
+  protected apply(_slotId: string, previous: IFileAccount | undefined, target: IFileAccount | undefined): void {
+    const original = readCredentialDocument(this.file);
+    const config = readCredentialDocument(this.configFile);
+    const oldOauth = previous?.credential.claudeAiOauth;
+    const oldAccount = previous?.credential.oauthAccount;
+    if (JSON.stringify(original.data.claudeAiOauth) !== JSON.stringify(oldOauth)
+      || (previous && JSON.stringify(config.data.oauthAccount) !== JSON.stringify(oldAccount))) throw new Error('Claude Code login changed during the operation; no credential was replaced.');
+    const next = { ...original.data };
+    const nextConfig = { ...config.data };
+    if (target) { next.claudeAiOauth = target.credential.claudeAiOauth; nextConfig.oauthAccount = target.credential.oauthAccount; }
+    else { delete next.claudeAiOauth; delete nextConfig.oauthAccount; }
+    for (const key of accountCaches) delete nextConfig[key];
+    const raw = JSON.stringify(next, null, 2) + '\n';
+    const configRaw = JSON.stringify(nextConfig, null, 2) + '\n';
+    if (readCredentialDocument(this.file).raw !== original.raw || readCredentialDocument(this.configFile).raw !== config.raw) throw new Error('Claude Code files changed during the operation; try again after Claude Code exits.');
+    plugins.fs.mkdirSync(plugins.path.dirname(this.file), { recursive: true, mode: 0o700 });
+    plugins.fs.mkdirSync(plugins.path.dirname(this.configFile), { recursive: true, mode: 0o700 });
+    try {
+      writeSecretFileAtomically(this.file, raw);
+      if (readCredentialDocument(this.file).raw !== raw || readCredentialDocument(this.configFile).raw !== config.raw) throw new Error();
+      writeSecretFileAtomically(this.configFile, configRaw);
+      if (readCredentialDocument(this.configFile).raw !== configRaw) throw new Error();
+    } catch {
+      // Roll back only our own writes; a concurrent writer's data must never be overwritten.
+      try {
+        if (readCredentialDocument(this.file).raw === raw) writeSecretFileAtomically(this.file, original.raw ?? '{}\n');
+        if (readCredentialDocument(this.configFile).raw === configRaw) writeSecretFileAtomically(this.configFile, config.raw ?? '{}\n');
+      } catch { throw new Error('Claude Code switch and rollback were incomplete. Keep Claude Code stopped and restore a verified saved account.'); }
+      throw new Error('Claude Code switch failed while updating account metadata. The outgoing login remains saved; check doctor before restarting.');
+    }
+  }
+  public async readAccountStatus(id: string): Promise<IHarnessAccountStatus> {
+    const account = this.readCredential(id);
+    return this.status.read(credentialRecord(account.credential.claudeAiOauth), credentialRecord(account.credential.oauthAccount));
+  }
+}

package/ts/classes.claudestatus.ts

@@ -0,0 +1,99 @@
+import { credentialRecord, credentialText } from './classes.credentialstore.js';
+import type { IHarnessAccountStatus, IHarnessStatusSummary } from './interfaces.harness.js';
+
+class ClaudeStatusError extends Error {}
+
+/** Read-only Claude Code OAuth account endpoints. No refresh, inference, or browser session is used. */
+export class ClaudeAccountStatus {
+  constructor(private readonly fetcher: typeof fetch = globalThis.fetch) {}
+  private async get(route: 'usage' | 'profile', accessToken: string): Promise<Record<string, unknown>> {
+    const signal = AbortSignal.timeout(10_000);
+    try {
+      const response = await this.fetcher(`https://api.anthropic.com/api/oauth/${route}`, {
+        method: 'GET', redirect: 'error', signal,
+        headers: { Authorization: `Bearer ${accessToken}`, 'Content-Type': 'application/json',
+          ...(route === 'usage' ? { 'anthropic-beta': 'oauth-2025-04-20' } : { 'Cache-Control': 'no-cache' }) },
+      });
+      if (!response.ok) {
+        await response.body?.cancel();
+        throw new ClaudeStatusError(response.status === 401 ? 'Login expired or was rejected. Log in again with Claude Code and save it.' : `Claude account service returned HTTP ${response.status}.`);
+      }
+      const reader = response.body?.getReader();
+      if (!reader) throw new ClaudeStatusError('The Claude account service returned an empty response.');
+      const chunks: Uint8Array[] = [];
+      let size = 0;
+      try {
+        while (true) {
+          const part = await reader.read();
+          if (part.done) break;
+          size += part.value.byteLength;
+          if (size > 1024 * 1024) { await reader.cancel(); throw new ClaudeStatusError('The Claude account response is too large.'); }
+          chunks.push(part.value);
+        }
+      } finally { reader.releaseLock(); }
+      try { return credentialRecord(JSON.parse(Buffer.concat(chunks).toString('utf8'))); }
+      catch { throw new ClaudeStatusError('The Claude account service returned invalid data.'); }
+    } catch (error) {
+      if (signal.aborted) throw new ClaudeStatusError('The Claude account request timed out.');
+      if (error instanceof ClaudeStatusError) throw error;
+      throw new ClaudeStatusError('The Claude account service could not be reached.');
+    }
+  }
+  public async read(oauth: Record<string, unknown>, account: Record<string, unknown>): Promise<IHarnessAccountStatus> {
+    const result: IHarnessAccountStatus = { facts: [], problems: [] };
+    const storedPlan = credentialText(oauth.subscriptionType);
+    if (storedPlan) result.summary = { subscription: { plan: storedPlan, source: 'stored' } };
+    if (!Array.isArray(oauth.scopes) || !oauth.scopes.includes('user:profile')) {
+      result.facts.push({ section: 'Availability', label: 'Live account status', value: 'This login lacks the user:profile scope. Log in through Claude Code to obtain subscriber status.' });
+      return result;
+    }
+    const token = credentialText(oauth.accessToken);
+    if (!token) return { facts: [], problems: ['No usable Claude Code access token is available.'] };
+    const [profile, usage] = await Promise.allSettled([this.get('profile', token), this.get('usage', token)]);
+    if (profile.status === 'fulfilled') {
+      try {
+        const user = credentialRecord(profile.value.account);
+        const organization = credentialRecord(profile.value.organization);
+        if (user.uuid !== account.accountUuid || organization.uuid !== account.organizationUuid) return { facts: [], problems: ['Claude returned a different account or organization; no account data was displayed.'] };
+        const plan = credentialText(organization.organization_type)?.replace(/^claude_/, '');
+        if (plan) result.summary = { ...result.summary, subscription: { plan, source: 'live' } };
+        for (const [label, value] of [['Email', user.email], ['Organization', organization.name], ['Billing type', organization.billing_type], ['Seat tier', organization.seat_tier]]) {
+          if (credentialText(value)) result.facts.push({ section: 'Account', label: String(label), value: String(value) });
+        }
+      } catch { result.problems.push('Claude profile response is unsupported; no profile values were inferred.'); }
+    } else result.problems.push(`Profile: ${profile.reason instanceof ClaudeStatusError ? profile.reason.message : 'Lookup failed.'}`);
+    if (usage.status === 'fulfilled') {
+      try {
+        const windows: NonNullable<IHarnessStatusSummary['usageWindows']> = [];
+        for (const [key, label, durationSeconds, scope] of [
+          ['five_hour', 'Claude five-hour', 18000, 'account'], ['seven_day', 'Claude weekly', 604800, 'account'],
+          ['seven_day_oauth_apps', 'OAuth apps weekly', 604800, 'feature'], ['seven_day_opus', 'Opus weekly', 604800, 'feature'], ['seven_day_sonnet', 'Sonnet weekly', 604800, 'feature'],
+        ] as const) {
+          if (usage.value[key] == null) continue;
+          const window = credentialRecord(usage.value[key]);
+          if (window.utilization == null) continue;
+          if (typeof window.utilization !== 'number' || !Number.isFinite(window.utilization) || window.utilization < 0) throw new Error();
+          const resetAt = window.resets_at == null ? null : new Date(String(window.resets_at)).toISOString();
+          windows.push({ label, durationSeconds, scope, usedPercent: window.utilization, resetAt });
+        }
+        result.summary = { ...result.summary, usageWindows: windows };
+        for (const window of windows) result.facts.push({ section: 'Usage', summaryKey: 'usageWindows', label: window.label, value: `${window.usedPercent}% used; ${window.resetAt ? 'resets ' + window.resetAt : 'reset not scheduled'}` });
+        if (usage.value.extra_usage != null) {
+          const extra = credentialRecord(usage.value.extra_usage);
+          if (typeof extra.is_enabled === 'boolean') result.facts.push({ section: 'Extra usage', label: 'Enabled', value: extra.is_enabled ? 'yes' : 'no' });
+          const currency = credentialText(extra.currency);
+          const amount = (value: unknown) => typeof value === 'number' && Number.isFinite(value) && value >= 0 ? value : undefined;
+          const limit = amount(extra.monthly_limit);
+          const used = amount(extra.used_credits);
+          for (const [label, value] of [['Monthly limit', limit], ['Spent', used]] as const) {
+            if (value !== undefined) result.facts.push({ section: 'Extra usage', label, value: currency ? `${(value / 100).toFixed(2)} ${currency}` : `${value} currency minor units (currency not reported)` });
+          }
+          if (limit !== undefined && limit > 0 && used !== undefined) result.facts.push({ section: 'Extra usage', label: 'Monthly budget used', value: `${Math.round(used / limit * 10000) / 100}%` });
+        }
+        if (Array.isArray(usage.value.limits) && usage.value.limits.length) result.facts.push({ section: 'Availability', label: 'Additional limits', value: 'The service also returned limits without a supported reset-window contract.' });
+      } catch { result.problems.push('Claude usage response is unsupported; missing values were not inferred.'); }
+    } else result.problems.push(`Usage: ${usage.reason instanceof ClaudeStatusError ? usage.reason.message : 'Lookup failed.'}`);
+    result.facts.push({ section: 'Availability', label: 'Billing dates and earned resets', value: 'Renewal dates, cancellation dates and earned reset credits are not exposed by these Claude Code endpoints.' });
+    return result;
+  }
+}