@modelprofile.com/authswitch 6.4.0 → 7.0.0

package/ts/classes.authoritycli.ts

@@ -0,0 +1,719 @@
+import type { IAuthSwitchDoctorPage, IAuthSwitchOperation, IAuthSwitchPreuseOperation,
+  IAuthSwitchSnapshot, IReq_AuthSwitchDoctor, IReq_AuthSwitchStartPreuse } from './authority-contract.js';
+import { AuthSwitchClient } from './classes.authorityclient.js';
+import { resolveAuthSwitchAuthorityPaths } from './classes.authorityservice.js';
+import { defaultPreusePrompt, validatePreuseOptions } from './preuse.js';
+import { plainText } from './formatting.js';
+import * as plugins from './plugins.js';
+
+export interface IAuthSwitchAuthorityCliClient {
+  snapshotAll(): Promise<IAuthSwitchSnapshot>;
+  doctorPage(request: IReq_AuthSwitchDoctor['request']): Promise<IAuthSwitchDoctorPage>;
+  beginAddOpenAi(operationId: string): Promise<IAuthSwitchOperation>;
+  beginReauthOpenAi(operationId: string, accountId: string, loginId: string,
+    purpose: 'openai_managed'): Promise<IAuthSwitchOperation>;
+  getOperation(operationId: string): Promise<IAuthSwitchOperation>;
+  cancelOperation(operationId: string): Promise<IAuthSwitchOperation>;
+  startPreuse(input: IReq_AuthSwitchStartPreuse['request']): Promise<IAuthSwitchPreuseOperation>;
+  getPreuse(operationId: string): Promise<IAuthSwitchPreuseOperation>;
+  cancelPreuse(operationId: string): Promise<IAuthSwitchPreuseOperation>;
+  close(reason?: Error): void;
+}
+
+export interface IAuthSwitchAuthorityCliOptions {
+  clientFactory?: () => IAuthSwitchAuthorityCliClient;
+  stdout?: (text: string) => void | Promise<void>;
+  stderr?: (text: string) => void | Promise<void>;
+  signal?: AbortSignal;
+  now?: () => number;
+  wait?: (milliseconds: number, signal: AbortSignal) => Promise<void>;
+  operationIdFactory?: () => string;
+}
+
+type TAuthorityCliCommand =
+  | { kind: 'list'; json: boolean }
+  | { kind: 'doctor'; json: boolean }
+  | { kind: 'add'; json: boolean }
+  | { kind: 'reauth'; accountId: string; loginId: string; json: boolean }
+  | { kind: 'get'; operationId: string; json: boolean }
+  | { kind: 'cancel'; operationId: string; json: boolean }
+  | { kind: 'resume'; operationId: string; json: boolean }
+  | { kind: 'preuse'; target: { accountId: string; loginId: string } | 'all';
+      prompt: string; model?: string; json: boolean }
+  | { kind: 'preuseGet'; operationId: string; json: boolean }
+  | { kind: 'preuseCancel'; operationId: string; json: boolean }
+  | { kind: 'preuseResume'; operationId: string; json: boolean };
+type TAuthorityCliFailure = 'output' | 'response';
+
+class AuthorityCliFailure extends Error {
+  constructor(public readonly kind: TAuthorityCliFailure) {
+    super(`Authswitch authority CLI ${kind} failure.`);
+  }
+}
+
+const usage = 'Usage: authswitch account list [--json] | authswitch account add openai [--json] | authswitch account reauth <account-id> <login-id> [--json] | authswitch account operation get|cancel|resume <operation-id> [--json] | authswitch account preuse <account-id> <login-id>|--all [--prompt <text>] [--model <id>] [--json] | authswitch account preuse operation get|cancel|resume <operation-id> [--json] | authswitch authority doctor [--json]';
+const safe = (value: string | number | null): string => plainText(value === null ? 'none' : String(value));
+const isId = (value: string | undefined): value is string => Boolean(value && !value.startsWith('-'));
+
+const parsePreuse = (argv: readonly string[]): TAuthorityCliCommand | null => {
+  if (argv[2] === 'operation') {
+    if ((argv[3] === 'get' || argv[3] === 'cancel' || argv[3] === 'resume') && isId(argv[4])
+      && (argv.length === 5 || (argv.length === 6 && argv[5] === '--json'))) {
+      const kind = argv[3] === 'get' ? 'preuseGet'
+        : argv[3] === 'cancel' ? 'preuseCancel' : 'preuseResume';
+      return { kind, operationId: argv[4], json: argv[5] === '--json' };
+    }
+    return null;
+  }
+  let target: Extract<TAuthorityCliCommand, { kind: 'preuse' }>['target'];
+  let index: number;
+  if (argv[2] === '--all') {
+    target = 'all';
+    index = 3;
+  } else if (isId(argv[2]) && isId(argv[3])) {
+    target = { accountId: argv[2], loginId: argv[3] };
+    index = 4;
+  } else return null;
+  let prompt = defaultPreusePrompt;
+  let model: string | undefined;
+  let json = false;
+  let promptSet = false;
+  let modelSet = false;
+  while (index < argv.length) {
+    const option = argv[index];
+    if (option === '--json' && !json) {
+      json = true;
+      index++;
+    } else if (option === '--prompt' && !promptSet && argv[index + 1] !== undefined
+      && !argv[index + 1]!.startsWith('--')) {
+      prompt = argv[index + 1]!;
+      promptSet = true;
+      index += 2;
+    } else if (option === '--model' && !modelSet && argv[index + 1] !== undefined
+      && !argv[index + 1]!.startsWith('--')) {
+      model = argv[index + 1]!;
+      modelSet = true;
+      index += 2;
+    } else return null;
+  }
+  try { validatePreuseOptions({ prompt, model }); } catch { return null; }
+  return { kind: 'preuse', target, prompt, ...(model === undefined ? {} : { model }), json };
+};
+
+const parse = (argv: readonly string[]): TAuthorityCliCommand | null => {
+  if (argv[0] === 'account' && argv[1] === 'list'
+    && (argv.length === 2 || (argv.length === 3 && argv[2] === '--json'))) {
+    return { kind: 'list', json: argv[2] === '--json' };
+  }
+  if (argv[0] === 'authority' && argv[1] === 'doctor'
+    && (argv.length === 2 || (argv.length === 3 && argv[2] === '--json'))) {
+    return { kind: 'doctor', json: argv[2] === '--json' };
+  }
+  if (argv[0] === 'account' && argv[1] === 'add' && argv[2] === 'openai'
+    && (argv.length === 3 || (argv.length === 4 && argv[3] === '--json'))) {
+    return { kind: 'add', json: argv[3] === '--json' };
+  }
+  if (argv[0] === 'account' && argv[1] === 'reauth' && isId(argv[2]) && isId(argv[3])
+    && (argv.length === 4 || (argv.length === 5 && argv[4] === '--json'))) {
+    return { kind: 'reauth', accountId: argv[2], loginId: argv[3], json: argv[4] === '--json' };
+  }
+  if (argv[0] === 'account' && argv[1] === 'operation'
+    && (argv[2] === 'get' || argv[2] === 'cancel' || argv[2] === 'resume') && isId(argv[3])
+    && (argv.length === 4 || (argv.length === 5 && argv[4] === '--json'))) {
+    return { kind: argv[2], operationId: argv[3], json: argv[4] === '--json' };
+  }
+  if (argv[0] === 'account' && argv[1] === 'preuse') return parsePreuse(argv);
+  return null;
+};
+
+class ScopedAuthorityCliClient implements IAuthSwitchAuthorityCliClient {
+  private readonly controller = new AbortController();
+  private readonly client: AuthSwitchClient;
+
+  constructor() {
+    const paths = resolveAuthSwitchAuthorityPaths();
+    this.client = new AuthSwitchClient(paths.authoritySocketPath, paths.runtimeSocketPath);
+  }
+
+  public snapshotAll(): Promise<IAuthSwitchSnapshot> {
+    return this.client.snapshotAll({ limit: 128, signal: this.controller.signal });
+  }
+
+  public doctorPage(request: IReq_AuthSwitchDoctor['request']): Promise<IAuthSwitchDoctorPage> {
+    return this.client.doctorPage(request, this.controller.signal);
+  }
+
+  public beginAddOpenAi(operationId: string): Promise<IAuthSwitchOperation> {
+    return this.client.beginAddOpenAi(operationId, this.controller.signal);
+  }
+
+  public beginReauthOpenAi(operationId: string, accountId: string, loginId: string,
+    purpose: 'openai_managed'): Promise<IAuthSwitchOperation> {
+    return this.client.beginReauthOpenAi(operationId, accountId, loginId, purpose, this.controller.signal);
+  }
+
+  public getOperation(operationId: string): Promise<IAuthSwitchOperation> {
+    return this.client.getOperation(operationId, this.controller.signal);
+  }
+
+  public cancelOperation(operationId: string): Promise<IAuthSwitchOperation> {
+    return this.client.cancelOperation(operationId, this.controller.signal);
+  }
+
+  public startPreuse(input: IReq_AuthSwitchStartPreuse['request']): Promise<IAuthSwitchPreuseOperation> {
+    return this.client.startPreuse(input, this.controller.signal);
+  }
+
+  public getPreuse(operationId: string): Promise<IAuthSwitchPreuseOperation> {
+    return this.client.getPreuse(operationId, this.controller.signal);
+  }
+
+  public cancelPreuse(operationId: string): Promise<IAuthSwitchPreuseOperation> {
+    return this.client.cancelPreuse(operationId, this.controller.signal);
+  }
+
+  public close(reason = new Error('Authswitch authority CLI closed.')): void {
+    if (!this.controller.signal.aborted) this.controller.abort(reason);
+  }
+}
+
+const renderList = (snapshot: IAuthSwitchSnapshot): string => {
+  const lines = [`Authority accounts — generated ${safe(snapshot.generatedAt)}, revision ${snapshot.revision}`];
+  if (snapshot.accounts.length === 0) lines.push('No authority accounts are registered.');
+  for (const account of snapshot.accounts) {
+    const identity = account.email ?? account.label;
+    lines.push(`${safe(identity)} [${safe(account.providerId)}]`,
+      `  account ${safe(account.id)}; plan ${safe(account.plan)}; ${account.removed ? 'removed' : 'registered'}; stored ${safe(account.statusObservedAt)}`);
+    const logins = snapshot.logins.filter(login => login.accountId === account.id);
+    if (logins.length === 0) lines.push('  logins: none');
+    else {
+      lines.push('  stored login state (live provider check not performed):');
+      for (const login of logins) {
+        lines.push(`    ${safe(login.id)}  ${safe(login.purpose)}  owner=${safe(login.owner)}  health=${safe(login.health)}  problem=${safe(login.problem)}  observed=${safe(login.statusObservedAt)}`);
+      }
+    }
+    const bindings = snapshot.bindings.filter(binding => binding.accountId === account.id);
+    if (bindings.length === 0) lines.push('  runtime bindings: none');
+    else for (const binding of bindings) {
+      lines.push(`  runtime ${safe(binding.runtime)}  scope=${safe(binding.scopeId)}  binding=${safe(binding.id)}`);
+    }
+  }
+  return lines.join('\n') + '\n';
+};
+
+const terminalOperation = (operation: IAuthSwitchOperation): boolean =>
+  operation.state === 'complete' || operation.state === 'failed' || operation.state === 'cancelled'
+  || operation.state === 'interrupted' || operation.state === 'outcome_unknown';
+
+const resumeCommand = (operationId: string, json: boolean): string =>
+  `authswitch account operation resume ${safe(operationId)}${json ? ' --json' : ''}`;
+
+const terminalPreuseOperation = (operation: IAuthSwitchPreuseOperation): boolean =>
+  operation.state === 'complete' || operation.state === 'not_sent' || operation.state === 'outcome_unknown';
+
+const preuseResumeCommand = (operationId: string, json: boolean): string =>
+  `authswitch account preuse operation resume ${safe(operationId)}${json ? ' --json' : ''}`;
+
+const renderOperation = (operation: IAuthSwitchOperation, json: boolean): string => {
+  if (json) return JSON.stringify(operation) + '\n';
+  const lines = [
+    `Authority operation ${safe(operation.id)} — ${safe(operation.state)}, revision ${operation.revision}`,
+    `  kind=${safe(operation.kind)}; purpose=${safe(operation.purpose)}`,
+  ];
+  if (operation.targetAccountId || operation.targetLoginId) {
+    lines.push(`  target account=${safe(operation.targetAccountId)}; login=${safe(operation.targetLoginId)}`);
+  }
+  if (operation.prompt?.flow === 'device') {
+    lines.push(`  Open ${safe(operation.prompt.verificationUrl)}`, `  Code: ${safe(operation.prompt.userCode)}`);
+  } else if (operation.prompt?.flow === 'browser') lines.push(`  Open ${safe(operation.prompt.authUrl)}`);
+  if (operation.result) {
+    lines.push(`  completed account=${safe(operation.result.accountId)}; login=${safe(operation.result.loginId)}; account revision=${operation.result.accountRevision}; login generation=${operation.result.loginGeneration}`);
+  }
+  if (operation.error) lines.push(`  problem=${safe(operation.error)}`);
+  if (!terminalOperation(operation)) lines.push(`  Resume: ${resumeCommand(operation.id, false)}`);
+  return lines.join('\n') + '\n';
+};
+
+const renderPreuseOperation = (operation: IAuthSwitchPreuseOperation, json: boolean,
+  batch = false): string => {
+  if (json) return JSON.stringify(batch ? { type: 'operation', operation } : operation) + '\n';
+  const lines = [
+    `Authority preuse operation ${safe(operation.id)} — ${safe(operation.state)}, revision ${operation.revision}`,
+    `  account=${safe(operation.accountId)}; login=${safe(operation.loginId)}; purpose=${safe(operation.purpose)}`,
+    `  requested model=${safe(operation.requestedModel)}; model=${safe(operation.model)}; problem=${safe(operation.problem)}`,
+  ];
+  if (operation.result) {
+    lines.push(`  tokens input=${safe(operation.result.inputTokens)}; output=${safe(operation.result.outputTokens)}; total=${safe(operation.result.totalTokens)}`);
+  }
+  if (!terminalPreuseOperation(operation)) {
+    lines.push(`  Resume: ${preuseResumeCommand(operation.id, false)}`);
+  }
+  return lines.join('\n') + '\n';
+};
+
+interface IPreuseBatchSkip {
+  type: 'skipped';
+  snapshotRevision: number;
+  accountId: string;
+  loginId: string;
+  loginRevision: number;
+  statusObservedAt: string;
+  health: IAuthSwitchSnapshot['logins'][number]['health'];
+  problem: IAuthSwitchSnapshot['logins'][number]['problem'];
+  reason: 'snapshot_not_preuse_capable';
+}
+
+const renderPreuseSkip = (skip: IPreuseBatchSkip, json: boolean): string => {
+  if (json) return JSON.stringify(skip) + '\n';
+  return `Preuse skipped account ${safe(skip.accountId)}; login ${safe(skip.loginId)} — snapshot revision ${skip.snapshotRevision}, login revision ${skip.loginRevision}; health=${safe(skip.health)}; problem=${safe(skip.problem)}; observed=${safe(skip.statusObservedAt)}; reason=${skip.reason}\n`;
+};
+
+const defaultWait = (milliseconds: number, signal: AbortSignal): Promise<void> => new Promise((resolve, reject) => {
+  if (signal.aborted) {
+    reject(signal.reason);
+    return;
+  }
+  const timer = setTimeout(() => {
+    signal.removeEventListener('abort', onAbort);
+    resolve();
+  }, milliseconds);
+  const onAbort = (): void => {
+    clearTimeout(timer);
+    signal.removeEventListener('abort', onAbort);
+    reject(signal.reason);
+  };
+  signal.addEventListener('abort', onAbort, { once: true });
+});
+
+const renderDoctorPage = (page: IAuthSwitchDoctorPage, pageNumber: number): string => {
+  const lines = [
+    `Authority doctor page ${pageNumber} — observed ${safe(page.observedAt)}`,
+    `  daemon=${safe(page.daemon.state)}; Claude native authority=${safe(page.daemon.claudeNativeAuthority)}; observed=${safe(page.daemon.observedAt)}`,
+    `  database=${safe(page.database.state)}; admission=${safe(page.database.admission)}; schema=${page.database.schemaVersion}; revision=${page.database.revision}; observed=${safe(page.database.observedAt)}`,
+    `  accounts: ${page.accounts.length} stored evidence record(s); live provider check not performed`,
+    `  logins: ${page.logins.length} stored evidence record(s); live provider check not performed`,
+  ];
+  for (const login of page.logins) {
+    lines.push(`    login ${safe(login.id)}  ${safe(login.purpose)}  state=${safe(login.state)}  owner=${safe(login.owner)}  problem=${safe(login.problem)}`);
+  }
+  for (const runtime of page.managedCodex) {
+    lines.push(`  managed Codex ${safe(runtime.scopeId)}: health=${safe(runtime.health)}; durable=${safe(runtime.durable.state)}; daemon=${safe(runtime.daemon.state)}/${safe(runtime.daemon.assignment)}; process=${safe(runtime.process.state)}/${safe(runtime.process.identity)}; problem=${safe(runtime.process.problem)}`);
+  }
+  for (const home of page.claudeHomes) {
+    lines.push(`  Claude home ${safe(home.id)}: status=${safe(home.status)}; account=${safe(home.activeAccountId)}; login=${safe(home.activeLoginId)}`);
+  }
+  for (const handoff of page.claudeHandoffs) {
+    lines.push(`  Claude handoff ${safe(handoff.id)}: phase=${safe(handoff.phase)}; problem=${safe(handoff.problem)}`);
+  }
+  for (const handoff of page.nativeHandoffs) {
+    lines.push(`  native handoff ${safe(handoff.id)}: direction=${safe(handoff.direction)}; phase=${safe(handoff.phase)}`);
+  }
+  for (const migration of page.migrations) {
+    lines.push(`  migration ${safe(migration.id)}: source=${safe(migration.sourceKind)}; status=${safe(migration.status)}`);
+  }
+  return lines.join('\n') + '\n';
+};
+
+const observationTimes = (page: IAuthSwitchDoctorPage): string[] => [
+  page.database.observedAt,
+  page.daemon.observedAt,
+  ...page.managedCodex.map(runtime => runtime.process.observedAt),
+  page.observedAt,
+];
+
+const nextDoctorRequest = (request: IReq_AuthSwitchDoctor['request'], page: IAuthSwitchDoctorPage): IReq_AuthSwitchDoctor['request'] => ({
+  accountAfter: page.nextAccountCursor ?? page.accounts.at(-1)?.id ?? request.accountAfter,
+  loginAfter: page.nextLoginCursor ?? page.logins.at(-1)?.id ?? request.loginAfter,
+  codexHomeAfter: page.nextCodexHomeCursor ?? page.managedCodex.at(-1)?.homeId ?? request.codexHomeAfter,
+  claudeHomeAfter: page.nextClaudeHomeCursor ?? page.claudeHomes.at(-1)?.id ?? request.claudeHomeAfter,
+  claudeHandoffAfter: page.nextClaudeHandoffCursor ?? page.claudeHandoffs.at(-1)?.id ?? request.claudeHandoffAfter,
+  nativeHandoffAfter: page.nextNativeHandoffCursor ?? page.nativeHandoffs.at(-1)?.id ?? request.nativeHandoffAfter,
+  migrationAfter: page.nextMigrationCursor ?? page.migrations.at(-1)?.id ?? request.migrationAfter,
+  limit: 128,
+});
+
+const doctorComplete = (page: IAuthSwitchDoctorPage): boolean => page.nextAccountCursor === null
+  && page.nextLoginCursor === null && page.nextCodexHomeCursor === null && page.nextClaudeHomeCursor === null
+  && page.nextClaudeHandoffCursor === null && page.nextNativeHandoffCursor === null
+  && page.nextMigrationCursor === null;
+
+const runDoctor = async (client: IAuthSwitchAuthorityCliClient, json: boolean,
+  write: (text: string) => void | Promise<void>): Promise<void> => {
+  let request: IReq_AuthSwitchDoctor['request'] = { limit: 128 };
+  let pageNumber = 0;
+  let observedFrom: string | null = null;
+  let observedTo: string | null = null;
+  while (true) {
+    const page = await client.doctorPage(request);
+    pageNumber++;
+    for (const timestamp of observationTimes(page)) {
+      if (observedFrom === null || timestamp < observedFrom) observedFrom = timestamp;
+      if (observedTo === null || timestamp > observedTo) observedTo = timestamp;
+    }
+    if (json) {
+      await write((pageNumber === 1 ? '{"type":"authswitch-authority-doctor","schemaVersion":1,"pages":[' : ',')
+        + JSON.stringify({ pageNumber, page }));
+    } else await write(renderDoctorPage(page, pageNumber));
+    if (doctorComplete(page)) break;
+    const next = nextDoctorRequest(request, page);
+    if (JSON.stringify(next) === JSON.stringify(request)) throw new AuthorityCliFailure('response');
+    request = next;
+  }
+  if (json) await write(`],"observationSpan":${JSON.stringify({ pageCount: pageNumber, observedFrom, observedTo })},"globallyAtomic":false}\n`);
+  else await write(`Authority doctor completed ${pageNumber} page(s); observation span ${safe(observedFrom)} to ${safe(observedTo)}. Pages are independently observed and are not globally atomic.\n`);
+};
+
+const streamWrite = (stream: NodeJS.WriteStream, text: string): Promise<void> => new Promise((resolve, reject) => {
+  let settled = false;
+  const finish = (error?: Error | null): void => {
+    if (settled) return;
+    settled = true;
+    if (error) reject(error);
+    else resolve();
+  };
+  const onError = (error: Error): void => finish(error);
+  stream.once('error', onError);
+  stream.write(text, error => {
+    if (error) {
+      // Writable streams may emit the same failure after invoking the callback. Keep the
+      // one-shot listener through the current turn so an EPIPE cannot become unhandled.
+      finish(error);
+      setImmediate(() => stream.off('error', onError));
+      return;
+    }
+    stream.off('error', onError);
+    finish();
+  });
+});
+
+const abortable = <T>(operation: Promise<T>, signal: AbortSignal): Promise<T> => {
+  if (signal.aborted) return Promise.reject(signal.reason);
+  return new Promise<T>((resolve, reject) => {
+    const onAbort = (): void => {
+      signal.removeEventListener('abort', onAbort);
+      reject(signal.reason);
+    };
+    signal.addEventListener('abort', onAbort, { once: true });
+    operation.then(value => {
+      signal.removeEventListener('abort', onAbort);
+      resolve(value);
+    }, error => {
+      signal.removeEventListener('abort', onAbort);
+      reject(error);
+    });
+  });
+};
+
+const preuseBatchTargets = (snapshot: IAuthSwitchSnapshot): IAuthSwitchSnapshot['logins'] => {
+  const accountIds = new Set(snapshot.accounts
+    .filter(account => account.providerId === 'openai' && !account.removed)
+    .map(account => account.id));
+  const seen = new Set<string>();
+  return snapshot.logins.filter(login => {
+    const key = `${login.accountId}:${login.id}`;
+    if (seen.has(key) || !accountIds.has(login.accountId) || login.providerId !== 'openai'
+      || login.purpose !== 'openai_managed' || login.owner !== 'daemon') return false;
+    seen.add(key);
+    return true;
+  });
+};
+
+const operationPollIntervalMs = 1_000;
+const operationDeadlineMs = 15 * 60 * 1_000;
+
+/** Credential-free daemon CLI. It never opens the database or falls back to native harness stores. */
+export const runAuthSwitchAuthorityCli = async (argv: readonly string[],
+  options: IAuthSwitchAuthorityCliOptions = {}): Promise<number> => {
+  const write = options.stdout ?? (text => streamWrite(process.stdout, text));
+  const writeError = options.stderr ?? (text => streamWrite(process.stderr, text));
+  const now = options.now ?? Date.now;
+  const wait = options.wait ?? defaultWait;
+  const operationIdFactory = options.operationIdFactory ?? (() => plugins.crypto.randomUUID());
+  const command = parse(argv);
+  if (!command) {
+    await writeError(`${usage}\n`);
+    return 2;
+  }
+  let client: IAuthSwitchAuthorityCliClient | undefined;
+  let clientClosed = false;
+  let cancelled = false;
+  let timedOut = false;
+  let deadlineAt: number | null = null;
+  let operationIdForHint: string | null = null;
+  let preuseHint = false;
+  let beginAttempted = false;
+  let beginResponded = false;
+  const operationController = new AbortController();
+  const closeClient = (reason?: Error): void => {
+    if (clientClosed || !client) return;
+    clientClosed = true;
+    client.close(reason);
+  };
+  const detach = (reason: Error): void => {
+    if (!operationController.signal.aborted) operationController.abort(reason);
+    closeClient(reason);
+  };
+  const close = () => {
+    cancelled = true;
+    detach(new Error('Authswitch authority request cancelled.'));
+  };
+  const expire = (): Error => {
+    const reason = new Error('Authswitch authority operation timed out.');
+    timedOut = true;
+    detach(reason);
+    return reason;
+  };
+  const withinDeadline = async <T>(work: () => Promise<T>): Promise<T> => {
+    if (deadlineAt === null) return abortable(Promise.resolve().then(work), operationController.signal);
+    const remaining = deadlineAt - now();
+    if (remaining <= 0) throw expire();
+    const timerController = new AbortController();
+    const stopTimer = (): void => {
+      if (!timerController.signal.aborted) timerController.abort(new Error('Authswitch authority deadline timer stopped.'));
+    };
+    const onOperationAbort = (): void => {
+      if (!timerController.signal.aborted) timerController.abort(operationController.signal.reason);
+    };
+    operationController.signal.addEventListener('abort', onOperationAbort, { once: true });
+    const operation = abortable(Promise.resolve().then(work), operationController.signal);
+    const timer = wait(remaining, timerController.signal).then(() => {
+      if (timerController.signal.aborted) throw timerController.signal.reason;
+      throw expire();
+    });
+    timer.catch(() => undefined);
+    try {
+      return await Promise.race([operation, timer]);
+    } finally {
+      operationController.signal.removeEventListener('abort', onOperationAbort);
+      stopTimer();
+    }
+  };
+  const writeOutput = async (text: string): Promise<void> => {
+    try {
+      await withinDeadline(() => Promise.resolve(write(text)));
+    } catch (error) {
+      if (operationController.signal.aborted) throw error;
+      throw new AuthorityCliFailure('output');
+    }
+  };
+  const writeDiagnostic = async (text: string): Promise<void> => {
+    let pending: Promise<void>;
+    try {
+      pending = Promise.resolve(writeError(text));
+    } catch {
+      return;
+    }
+    pending.catch(() => undefined);
+    if (operationController.signal.aborted) return;
+    try {
+      await withinDeadline(() => pending);
+    } catch {
+      // Diagnostics are best effort. A failed or timed-out stderr must not recurse into
+      // another diagnostic or keep signal handlers and the scoped client alive.
+    }
+  };
+  const validateOperation = (operation: IAuthSwitchOperation, expectedId: string,
+    previousRevision?: number): IAuthSwitchOperation => {
+    if (operation.id !== expectedId || (previousRevision !== undefined && operation.revision < previousRevision)) {
+      throw new AuthorityCliFailure('response');
+    }
+    return operation;
+  };
+  const validatePreuseOperation = (operation: IAuthSwitchPreuseOperation, expectedId: string,
+    previousRevision?: number, expected?: {
+      accountId: string; loginId: string; requestedModel: string | null;
+    }): IAuthSwitchPreuseOperation => {
+    if (operation.id !== expectedId || (previousRevision !== undefined && operation.revision < previousRevision)
+      || (expected && (operation.accountId !== expected.accountId || operation.loginId !== expected.loginId
+        || operation.requestedModel !== expected.requestedModel))) {
+      throw new AuthorityCliFailure('response');
+    }
+    return operation;
+  };
+  try {
+    client = options.clientFactory?.() ?? new ScopedAuthorityCliClient();
+    const activeClient = client;
+    if (options.signal?.aborted) close();
+    else options.signal?.addEventListener('abort', close, { once: true });
+    if (!options.signal) {
+      process.once('SIGINT', close);
+      process.once('SIGTERM', close);
+    }
+    if (cancelled) throw new Error('Authswitch authority request cancelled.');
+    const followOperation = async (initial: IAuthSwitchOperation): Promise<IAuthSwitchOperation> => {
+      let current = validateOperation(initial, initial.id);
+      await writeOutput(renderOperation(current, command.json));
+      while (!terminalOperation(current)) {
+        await withinDeadline(() => wait(operationPollIntervalMs, operationController.signal));
+        const next = validateOperation(
+          await withinDeadline(() => activeClient.getOperation(current.id)), current.id, current.revision);
+        if (next.revision !== current.revision) await writeOutput(renderOperation(next, command.json));
+        current = next;
+      }
+      return current;
+    };
+    const followPreuseOperation = async (initial: IAuthSwitchPreuseOperation,
+      batch: boolean): Promise<IAuthSwitchPreuseOperation> => {
+      const expected = { accountId: initial.accountId, loginId: initial.loginId,
+        requestedModel: initial.requestedModel };
+      let current = validatePreuseOperation(initial, initial.id, undefined, expected);
+      await writeOutput(renderPreuseOperation(current, command.json, batch));
+      while (!terminalPreuseOperation(current)) {
+        await withinDeadline(() => wait(operationPollIntervalMs, operationController.signal));
+        const next = validatePreuseOperation(
+          await withinDeadline(() => activeClient.getPreuse(current.id)),
+          current.id, current.revision, expected);
+        if (next.revision !== current.revision) {
+          await writeOutput(renderPreuseOperation(next, command.json, batch));
+        }
+        current = next;
+      }
+      return current;
+    };
+    if (command.kind === 'list') {
+      const snapshot = await activeClient.snapshotAll();
+      await writeOutput(command.json ? JSON.stringify(snapshot) + '\n' : renderList(snapshot));
+      return 0;
+    }
+    if (command.kind === 'doctor') {
+      await runDoctor(activeClient, command.json, writeOutput);
+      return 0;
+    }
+    if (command.kind === 'preuseGet' || command.kind === 'preuseCancel') {
+      const operation = validatePreuseOperation(command.kind === 'preuseGet'
+        ? await activeClient.getPreuse(command.operationId)
+        : await activeClient.cancelPreuse(command.operationId), command.operationId);
+      await writeOutput(renderPreuseOperation(operation, command.json));
+      return 0;
+    }
+    if (command.kind === 'get' || command.kind === 'cancel') {
+      const operation = validateOperation(command.kind === 'get'
+        ? await activeClient.getOperation(command.operationId)
+        : await activeClient.cancelOperation(command.operationId), command.operationId);
+      await writeOutput(renderOperation(operation, command.json));
+      return 0;
+    }
+    if (command.kind === 'preuseResume') {
+      deadlineAt = now() + operationDeadlineMs;
+      operationIdForHint = command.operationId;
+      preuseHint = true;
+      const initial = validatePreuseOperation(
+        await withinDeadline(() => activeClient.getPreuse(command.operationId)), command.operationId);
+      const finalOperation = await followPreuseOperation(initial, false);
+      if (finalOperation.state !== 'complete') {
+        await writeDiagnostic('Authswitch authority preuse was unsuccessful.\n');
+        return 1;
+      }
+      return 0;
+    }
+    if (command.kind === 'preuse') {
+      if (command.target === 'all') {
+        deadlineAt = now() + operationDeadlineMs;
+        const snapshot = await withinDeadline(() => activeClient.snapshotAll());
+        let unsuccessful = false;
+        for (const login of preuseBatchTargets(snapshot)) {
+          if (operationController.signal.aborted) throw operationController.signal.reason;
+          deadlineAt = now() + operationDeadlineMs;
+          if (!login.capabilities.canPreuse) {
+            operationIdForHint = null;
+            const skip: IPreuseBatchSkip = {
+              type: 'skipped', snapshotRevision: snapshot.revision,
+              accountId: login.accountId, loginId: login.id, loginRevision: login.revision,
+              statusObservedAt: login.statusObservedAt, health: login.health, problem: login.problem,
+              reason: 'snapshot_not_preuse_capable',
+            };
+            await writeOutput(renderPreuseSkip(skip, command.json));
+            continue;
+          }
+          const operationId = operationIdFactory();
+          operationIdForHint = operationId;
+          preuseHint = true;
+          beginAttempted = true;
+          beginResponded = false;
+          const expected = { accountId: login.accountId, loginId: login.id,
+            requestedModel: command.model ?? null };
+          const initial = await withinDeadline(() => activeClient.startPreuse({
+            operationId, accountId: login.accountId, loginId: login.id, purpose: 'openai_managed',
+            prompt: command.prompt, ...(command.model === undefined ? {} : { model: command.model }),
+          }));
+          beginResponded = true;
+          validatePreuseOperation(initial, operationId, undefined, expected);
+          const finalOperation = await followPreuseOperation(initial, true);
+          if (finalOperation.state !== 'complete') unsuccessful = true;
+        }
+        if (unsuccessful) {
+          await writeDiagnostic('Authswitch authority preuse was unsuccessful.\n');
+          return 1;
+        }
+        return 0;
+      }
+      deadlineAt = now() + operationDeadlineMs;
+      const target = command.target;
+      const operationId = operationIdFactory();
+      operationIdForHint = operationId;
+      preuseHint = true;
+      beginAttempted = true;
+      const expected = { accountId: target.accountId, loginId: target.loginId,
+        requestedModel: command.model ?? null };
+      const initial = await withinDeadline(() => activeClient.startPreuse({
+        operationId, accountId: target.accountId, loginId: target.loginId,
+        purpose: 'openai_managed', prompt: command.prompt,
+        ...(command.model === undefined ? {} : { model: command.model }),
+      }));
+      beginResponded = true;
+      validatePreuseOperation(initial, operationId, undefined, expected);
+      const finalOperation = await followPreuseOperation(initial, false);
+      if (finalOperation.state !== 'complete') {
+        await writeDiagnostic('Authswitch authority preuse was unsuccessful.\n');
+        return 1;
+      }
+      return 0;
+    }
+    deadlineAt = now() + operationDeadlineMs;
+    let initial: IAuthSwitchOperation;
+    if (command.kind === 'resume') {
+      operationIdForHint = command.operationId;
+      initial = validateOperation(
+        await withinDeadline(() => activeClient.getOperation(command.operationId)), command.operationId);
+    } else {
+      const operationId = operationIdFactory();
+      operationIdForHint = operationId;
+      beginAttempted = true;
+      initial = await withinDeadline(() => command.kind === 'add'
+        ? activeClient.beginAddOpenAi(operationId)
+        : activeClient.beginReauthOpenAi(operationId, command.accountId, command.loginId, 'openai_managed'));
+      beginResponded = true;
+      validateOperation(initial, operationId);
+    }
+    const finalOperation = await followOperation(initial);
+    if (finalOperation.state !== 'complete') {
+      await writeDiagnostic('Authswitch authority sign-in was unsuccessful.\n');
+      return 1;
+    }
+    return 0;
+  } catch (error) {
+    let message = cancelled ? 'Authswitch authority request was cancelled.\n'
+      : timedOut ? 'Authswitch authority operation timed out.\n'
+        : beginAttempted && !beginResponded
+          ? 'Authswitch authority operation start response was lost.\n'
+          : error instanceof AuthorityCliFailure && error.kind === 'output'
+            ? 'Authswitch authority output failed.\n'
+            : error instanceof AuthorityCliFailure && error.kind === 'response'
+              ? 'Authswitch authority daemon returned an invalid response.\n'
+              : 'Authswitch authority daemon is unavailable.\n';
+    if (operationIdForHint !== null) {
+      const resume = preuseHint ? preuseResumeCommand(operationIdForHint, command.json)
+        : resumeCommand(operationIdForHint, command.json);
+      message += `Operation ID: ${safe(operationIdForHint)}\nResume: ${resume}\n`;
+    }
+    await writeDiagnostic(message);
+    return 1;
+  } finally {
+    options.signal?.removeEventListener('abort', close);
+    if (!options.signal) {
+      process.off('SIGINT', close);
+      process.off('SIGTERM', close);
+    }
+    closeClient();
+  }
+};