@modelprofile.com/authswitch 6.5.0 → 8.0.0

package/ts/classes.authorityusage.ts

@@ -0,0 +1,527 @@
+import * as plugins from './plugins.js';
+import type { IClaudeLogin, IClaudeStatusRead } from './classes.claudestatus.js';
+import type { IHarnessAccountStatus } from './interfaces.harness.js';
+
+type TRateLimits = plugins.flexAccounts.ISmartAiProviderAccountRateLimits;
+type TAccessCredential = plugins.flexAccounts.IOpenAiChatGptAccessCredential;
+
+export type TAuthSwitchUsageProblem =
+  | 'none' | 'unsupported' | 'access_unavailable' | 'provider_unavailable'
+  | 'provider_rejected' | 'profile_unavailable' | 'usage_unavailable'
+  | 'context_changed' | 'expired';
+
+export interface IAuthSwitchNativeUsageSource {
+  homeId: string;
+  credentialDigest: string;
+  configDigest: string;
+  accessTokenDigest: string;
+}
+
+/** A credential-free, exact view of the account and login used for one usage read. */
+export interface IAuthSwitchUsageContext {
+  epoch: string;
+  accountId: string;
+  loginId: string;
+  subjectId: string;
+  workspaceId: string;
+  providerId: string;
+  purpose: string;
+  owner: string;
+  grantState: string;
+  removed: boolean;
+  authorizationGeneration: number;
+  grantGeneration: number;
+  nativeSource: IAuthSwitchNativeUsageSource | null;
+}
+
+/** A bounded, credential-free projection; it is independent of the legacy harness API. */
+export interface IAuthSwitchClaudeStatus {
+  plan: { name: string; source: 'live' | 'stored' } | null;
+  windows: { label: string; scope: 'account' | 'feature'; durationSeconds: number;
+    usedPercent: number; resetAt: string | null; severity?: 'normal' | 'warning' | 'critical';
+    headline?: true }[] | null;
+  facts: { section: string | null; label: string; value: string;
+    summaryKey?: 'subscription' | 'billing' | 'usageWindows' | 'resets' | 'resetDetails' }[];
+  problems: string[];
+  rateLimit: { retryAt: string | null } | null;
+}
+
+export type TAuthSwitchUsageReading =
+  | { kind: 'openai'; rateLimits: TRateLimits }
+  | { kind: 'anthropic'; status: IAuthSwitchClaudeStatus };
+
+export interface IAuthSwitchUsageAccess {
+  accessToken: string;
+  accountId: string;
+  isFedrampAccount: boolean;
+  expiresAt: string;
+  grantGeneration: number;
+}
+
+/** Persist through NoSQLDB in the authority integration. No credential belongs in this record. */
+export interface IAuthSwitchStoredUsage {
+  context: IAuthSwitchUsageContext;
+  updateId: string;
+  reading: TAuthSwitchUsageReading | null;
+  observedAt: string | null;
+  currentUntil: string | null;
+  staleUntil: string | null;
+  lastAttemptAt: string;
+  nextAttemptAt: string;
+  failures: number;
+  problem: Exclude<TAuthSwitchUsageProblem, 'context_changed' | 'expired'>;
+}
+
+export interface IAuthSwitchUsageSnapshot {
+  accountId: string;
+  loginId: string;
+  state: 'current' | 'partial' | 'stale' | 'unavailable';
+  reading: TAuthSwitchUsageReading | null;
+  observedAt: string | null;
+  currentUntil: string | null;
+  staleUntil: string | null;
+  lastAttemptAt: string | null;
+  nextAttemptAt: string | null;
+  problem: TAuthSwitchUsageProblem;
+}
+
+export interface IAuthSwitchUsageStore {
+  /** Read only the exact login's record. The helper discards a mismatched context. */
+  read(accountId: string, loginId: string): Promise<IAuthSwitchStoredUsage | null>;
+  /**
+   * In one NoSQLDB transaction, re-read epoch/account/login and compare every semantic
+   * context field, compare the previous usage update ID, write next, and append a revisioned
+   * account event. The account row revision may increase in that transaction; it is not
+   * part of the usage validity key and must not invalidate the reading just published.
+   * A null previousUpdateId also permits replacing a record for a different context;
+   * it must reject a concurrently written record for this same context.
+   * Return false on either conflict; do not publish an old provider callback.
+   */
+  publishIfCurrent(context: IAuthSwitchUsageContext, previousUpdateId: string | null,
+    next: IAuthSwitchStoredUsage): Promise<boolean>;
+}
+
+export interface IAuthSwitchAuthorityUsageOptions {
+  /** Re-read from the owning NoSQLDB authority. Return null for an absent login. */
+  readContext(accountId: string, loginId: string): Promise<IAuthSwitchUsageContext | null>;
+  /** Broker-owned access resolution; rejected generation may perform at most one durable refresh. */
+  resolveAccess(context: IAuthSwitchUsageContext, rejectedGrantGeneration: number | undefined,
+    minValidityMs: number): Promise<IAuthSwitchUsageAccess>;
+  resolveClaudeLogin?(context: IAuthSwitchUsageContext, rejectedGrantGeneration: number | undefined,
+    minValidityMs: number): Promise<{ login: IClaudeLogin; grantGeneration: number; expiresAt: string | null }>;
+  claudeStatus?: Pick<{ readDetailed(login: IClaudeLogin): Promise<IClaudeStatusRead> }, 'readDetailed'>;
+  /** The callback holds the qualified vendor lease through the whole read and publication. */
+  withNativeSource?(context: IAuthSwitchUsageContext,
+    action: (source: { context: IAuthSwitchUsageContext; login: IClaudeLogin;
+      readContext(): Promise<IAuthSwitchUsageContext | null> }) => Promise<IAuthSwitchUsageSnapshot>): Promise<IAuthSwitchUsageSnapshot>;
+  store: IAuthSwitchUsageStore;
+  provider: Pick<plugins.flexAccounts.ISmartAiProviderAdapter, 'getAccountRateLimits'>;
+  now?: () => number;
+  currentMaxAgeMs?: number;
+  maxStaleAgeMs?: number;
+  minAttemptIntervalMs?: number;
+  retryBaseMs?: number;
+  retryMaxMs?: number;
+  providerTimeoutMs?: number;
+  minAccessValidityMs?: number;
+}
+
+const defaults = {
+  currentMaxAgeMs: 60_000,
+  maxStaleAgeMs: 300_000,
+  minAttemptIntervalMs: 15_000,
+  retryBaseMs: 30_000,
+  retryMaxMs: 300_000,
+  providerTimeoutMs: 15_000,
+  minAccessValidityMs: 60_000,
+};
+
+const sameContext = (left: IAuthSwitchUsageContext, right: IAuthSwitchUsageContext): boolean =>
+  left.epoch === right.epoch && left.accountId === right.accountId && left.loginId === right.loginId
+  && left.subjectId === right.subjectId && left.workspaceId === right.workspaceId
+  && left.providerId === right.providerId
+  && left.purpose === right.purpose && left.owner === right.owner && left.grantState === right.grantState
+  && left.removed === right.removed && left.authorizationGeneration === right.authorizationGeneration
+  && left.grantGeneration === right.grantGeneration
+  && (left.nativeSource === null ? right.nativeSource === null
+    : right.nativeSource !== null && left.nativeSource.homeId === right.nativeSource.homeId
+      && left.nativeSource.credentialDigest === right.nativeSource.credentialDigest
+      && left.nativeSource.configDigest === right.nativeSource.configDigest
+      && left.nativeSource.accessTokenDigest === right.nativeSource.accessTokenDigest);
+
+const sameGrantAuthority = (left: IAuthSwitchUsageContext, right: IAuthSwitchUsageContext): boolean =>
+  left.epoch === right.epoch && left.accountId === right.accountId && left.loginId === right.loginId
+  && left.subjectId === right.subjectId && left.workspaceId === right.workspaceId
+  && left.providerId === right.providerId
+  && left.purpose === right.purpose && left.owner === right.owner
+  && left.authorizationGeneration === right.authorizationGeneration && !right.removed
+  && (left.nativeSource === null ? right.nativeSource === null : sameContext(left, right));
+
+const usable = (context: IAuthSwitchUsageContext): boolean =>
+  !context.removed && ((context.providerId === 'openai' && context.purpose === 'openai_managed'
+    && context.owner === 'daemon' && context.nativeSource === null
+    && (context.grantState === 'ready' || context.grantState === 'retry_wait'))
+    || (context.providerId === 'anthropic' && context.purpose === 'claude_host_native'
+      && ((context.owner === 'daemon' && context.nativeSource === null
+        && (context.grantState === 'ready' || context.grantState === 'retry_wait'))
+        || (context.owner === 'claude_native' && context.nativeSource !== null
+          && context.grantState === 'native'))));
+
+const timestamp = (millis: number): string => new Date(millis).toISOString();
+const future = (value: string | null, now: number): boolean => value !== null && Date.parse(value) > now;
+
+const safeText = (value: string): string => {
+  const text = value.replace(/[\u0000-\u001f\u007f-\u009f]/g, '');
+  if (Array.from(text).length > 500) throw new Error('Claude status text exceeds the authority projection bound.');
+  return text;
+};
+const publicClaudeStatus = (source: IHarnessAccountStatus): IAuthSwitchClaudeStatus => {
+  if ((source.summary?.usageWindows?.length ?? 0) > 128 || source.facts.length > 128
+    || source.problems.length > 32) throw new Error('Claude status exceeds the authority projection bound.');
+  return {
+    plan: source.summary?.subscription
+      ? { name: safeText(source.summary.subscription.plan), source: source.summary.subscription.source } : null,
+    windows: source.summary?.usageWindows?.map(window => ({
+      label: safeText(window.label), scope: window.scope ?? 'account',
+      durationSeconds: window.durationSeconds, usedPercent: window.usedPercent, resetAt: window.resetAt,
+      ...(window.severity ? { severity: window.severity } : {}),
+      ...(window.headline ? { headline: true as const } : {}),
+    })) ?? null,
+    facts: source.facts.map(fact => ({
+      section: fact.section ? safeText(fact.section) : null,
+      label: safeText(fact.label), value: safeText(fact.value),
+      ...(fact.summaryKey ? { summaryKey: fact.summaryKey } : {}),
+    })),
+    problems: source.problems.map(safeText),
+    rateLimit: source.rateLimit ? { retryAt: source.rateLimit.retryAt } : null,
+  };
+};
+
+/** Allowlist the provider projection before it enters a management DTO or stored usage record. */
+const publicRateLimits = (source: TRateLimits): TRateLimits => {
+  const window = (value: plugins.flexAccounts.ISmartAiProviderRateLimitWindow) => ({
+    usedPercent: value.usedPercent, limitWindowSeconds: value.limitWindowSeconds,
+    resetAfterSeconds: value.resetAfterSeconds, resetsAt: value.resetsAt,
+  });
+  const detail = (value: plugins.flexAccounts.ISmartAiProviderRateLimitDetails) => ({
+    allowed: value.allowed, limitReached: value.limitReached,
+    ...(value.primaryWindow ? { primaryWindow: window(value.primaryWindow) } : {}),
+    ...(value.secondaryWindow ? { secondaryWindow: window(value.secondaryWindow) } : {}),
+  });
+  return {
+    providerId: 'openai', plan: source.plan, observedAt: source.observedAt,
+    ...(source.rateLimit ? { rateLimit: detail(source.rateLimit) } : {}),
+    additionalRateLimits: source.additionalRateLimits.map(item => ({
+      limitName: item.limitName, meteredFeature: item.meteredFeature,
+      ...(item.rateLimit ? { rateLimit: detail(item.rateLimit) } : {}),
+    })),
+    ...(source.rateLimitReachedType === undefined ? {} : { rateLimitReachedType: source.rateLimitReachedType }),
+    ...(source.rateLimitResetCreditsAvailableCount === undefined ? {}
+      : { rateLimitResetCreditsAvailableCount: source.rateLimitResetCreditsAvailableCount }),
+  };
+};
+
+/** On-demand daemon cache coordinator. The injected store is the only publication authority. */
+export class AuthSwitchAuthorityUsage {
+  private readonly now: () => number;
+  private readonly policy: typeof defaults;
+  private readonly pending = new Map<string, Promise<IAuthSwitchUsageSnapshot>>();
+  private readonly admitted = new Set<Promise<IAuthSwitchUsageSnapshot>>();
+  private closed = false;
+  private closing?: Promise<void>;
+
+  constructor(private readonly options: IAuthSwitchAuthorityUsageOptions) {
+    this.now = options.now ?? Date.now;
+    this.policy = {
+      currentMaxAgeMs: options.currentMaxAgeMs ?? defaults.currentMaxAgeMs,
+      maxStaleAgeMs: options.maxStaleAgeMs ?? defaults.maxStaleAgeMs,
+      minAttemptIntervalMs: options.minAttemptIntervalMs ?? defaults.minAttemptIntervalMs,
+      retryBaseMs: options.retryBaseMs ?? defaults.retryBaseMs,
+      retryMaxMs: options.retryMaxMs ?? defaults.retryMaxMs,
+      providerTimeoutMs: options.providerTimeoutMs ?? defaults.providerTimeoutMs,
+      minAccessValidityMs: options.minAccessValidityMs ?? defaults.minAccessValidityMs,
+    };
+    if (Object.values(this.policy).some(value => !Number.isSafeInteger(value) || value < 1 || value > 3_600_000)
+      || this.policy.maxStaleAgeMs <= this.policy.currentMaxAgeMs
+      || this.policy.retryMaxMs < this.policy.retryBaseMs) {
+      throw new Error('Invalid authority usage freshness policy.');
+    }
+  }
+
+  private unavailable(accountId: string, loginId: string, problem: TAuthSwitchUsageProblem): IAuthSwitchUsageSnapshot {
+    return { accountId, loginId, state: 'unavailable', reading: null, observedAt: null,
+      currentUntil: null, staleUntil: null, lastAttemptAt: null, nextAttemptAt: null, problem };
+  }
+
+  private snapshot(context: IAuthSwitchUsageContext, record: IAuthSwitchStoredUsage | null,
+    now = this.now()): IAuthSwitchUsageSnapshot {
+    if (!record || !sameContext(context, record.context)) {
+      return this.unavailable(context.accountId, context.loginId, 'expired');
+    }
+    const state = record.reading && future(record.currentUntil, now)
+      ? record.problem === 'none' ? 'current'
+        : record.reading.kind === 'anthropic' && ['profile_unavailable', 'usage_unavailable'].includes(record.problem)
+          ? 'partial' : 'stale'
+      : record.reading && future(record.staleUntil, now) ? 'stale' : 'unavailable';
+    return {
+      accountId: context.accountId, loginId: context.loginId, state,
+      reading: state === 'unavailable' ? null : record.reading,
+      observedAt: state === 'unavailable' ? null : record.observedAt,
+      currentUntil: record.currentUntil, staleUntil: record.staleUntil,
+      lastAttemptAt: record.lastAttemptAt, nextAttemptAt: record.nextAttemptAt,
+      problem: state === 'unavailable' && record.reading && !future(record.staleUntil, now)
+        ? 'expired' : record.problem,
+    };
+  }
+
+  private async currentContext(accountId: string, loginId: string): Promise<IAuthSwitchUsageContext | null> {
+    try { return await this.options.readContext(accountId, loginId); }
+    catch { return null; }
+  }
+
+  public get(accountId: string, loginId: string, force = false): Promise<IAuthSwitchUsageSnapshot> {
+    if (this.closed) return Promise.reject(new Error('Authority usage helper is closed.'));
+    const request = this.read(accountId, loginId, force);
+    this.admitted.add(request);
+    void request.finally(() => this.admitted.delete(request)).catch(() => undefined);
+    return request;
+  }
+
+  private async read(accountId: string, loginId: string, force: boolean): Promise<IAuthSwitchUsageSnapshot> {
+    if (!/^[a-f0-9]{64}$/.test(accountId) || !/^[a-f0-9]{64}$/.test(loginId)) {
+      throw new Error('Invalid authority usage identity.');
+    }
+    const context = await this.currentContext(accountId, loginId);
+    if (!context) return this.unavailable(accountId, loginId, 'access_unavailable');
+    if (context.accountId !== accountId || context.loginId !== loginId) {
+      return this.unavailable(accountId, loginId, 'context_changed');
+    }
+    if (context.providerId === 'anthropic' && context.purpose === 'claude_host_native'
+      && context.owner === 'claude_native' && context.grantState === 'native') {
+      if (!this.options.withNativeSource) return this.unavailable(accountId, loginId, 'access_unavailable');
+      try {
+        return await this.options.withNativeSource(context, async source => {
+          const readCurrent = async () => {
+            try { return await source.readContext(); } catch { return null; }
+          };
+          return this.readWithContext(source.context, force, readCurrent, source.login);
+        });
+      } catch { return this.unavailable(accountId, loginId, 'access_unavailable'); }
+    }
+    return this.readWithContext(context, force, () => this.currentContext(accountId, loginId), null);
+  }
+
+  private readWithContext(context: IAuthSwitchUsageContext, force: boolean,
+    readCurrent: () => Promise<IAuthSwitchUsageContext | null>, nativeLogin: IClaudeLogin | null): Promise<IAuthSwitchUsageSnapshot> {
+    if (!usable(context)) return Promise.resolve(this.unavailable(context.accountId, context.loginId,
+      context.removed || ['handoff_pending', 'handoff_quarantined', 'legacy_native_pending'].includes(context.grantState)
+        ? 'access_unavailable' : 'unsupported'));
+    const key = JSON.stringify([context.epoch, context.accountId, context.loginId,
+      context.subjectId, context.workspaceId,
+      context.authorizationGeneration, context.grantGeneration, context.owner, context.grantState,
+      context.nativeSource]);
+    const existing = this.pending.get(key);
+    if (existing) return existing;
+    const task = this.readForContext(context, force, readCurrent, nativeLogin).finally(() => {
+      if (this.pending.get(key) === task) this.pending.delete(key);
+    });
+    this.pending.set(key, task);
+    return task;
+  }
+
+  /** Coalesce the entire read/decision/fetch lifecycle, including the first stored read. */
+  private async readForContext(context: IAuthSwitchUsageContext, force: boolean,
+    readCurrent: () => Promise<IAuthSwitchUsageContext | null>, nativeLogin: IClaudeLogin | null): Promise<IAuthSwitchUsageSnapshot> {
+    let stored: IAuthSwitchStoredUsage | null;
+    try { stored = await this.options.store.read(context.accountId, context.loginId); }
+    catch { return this.unavailable(context.accountId, context.loginId, 'access_unavailable'); }
+    const record = stored && sameContext(context, stored.context) ? stored : null;
+    const verified = await readCurrent();
+    if (!verified || !sameContext(context, verified)) {
+      return this.unavailable(context.accountId, context.loginId, 'context_changed');
+    }
+    const now = this.now();
+    const cached = this.snapshot(context, record, now);
+    if (record && future(record.nextAttemptAt, now)) return cached;
+    if (cached.state === 'current' && !force) return cached;
+    return this.refresh(context, record, readCurrent, nativeLogin);
+  }
+
+  private async refresh(initial: IAuthSwitchUsageContext,
+    initialRecord: IAuthSwitchStoredUsage | null,
+    readCurrent: () => Promise<IAuthSwitchUsageContext | null>,
+    nativeLogin: IClaudeLogin | null): Promise<IAuthSwitchUsageSnapshot> {
+    let context = initial;
+    let previous = initialRecord;
+    let reading: TAuthSwitchUsageReading | null = null;
+    let problem: IAuthSwitchStoredUsage['problem'] = 'none';
+    try {
+      if (context.providerId === 'openai') {
+      let access = await this.options.resolveAccess(context, undefined, this.policy.minAccessValidityMs);
+      const resolved = await readCurrent();
+      if (!resolved || !sameGrantAuthority(context, resolved) || !usable(resolved)
+        || resolved.grantGeneration !== access.grantGeneration) {
+        return this.unavailable(context.accountId, context.loginId, 'context_changed');
+      }
+      context = resolved;
+      if (!this.validAccess(context, access)) throw new Error('Access grant is unavailable.');
+      if (!sameContext(initial, context)) {
+        const stored = await this.options.store.read(context.accountId, context.loginId);
+        previous = stored && sameContext(context, stored.context) ? stored : null;
+      }
+      let response: Awaited<ReturnType<IAuthSwitchAuthorityUsageOptions['provider']['getAccountRateLimits']>>;
+      try { response = await this.query(access); }
+      catch { problem = 'provider_unavailable'; response = { success: false, errorCode: 'ACCOUNT_RATE_LIMITS_FAILED' }; }
+      if (!response.success && response.errorCode === 'CREDENTIAL_REFRESH_REQUIRED') {
+        const beforeRotation = await readCurrent();
+        if (!beforeRotation || !sameContext(context, beforeRotation)) {
+          return this.unavailable(context.accountId, context.loginId, 'context_changed');
+        }
+        access = await this.options.resolveAccess(context, access.grantGeneration, this.policy.minAccessValidityMs);
+        const rotated = await readCurrent();
+        if (!rotated || !sameGrantAuthority(context, rotated) || !usable(rotated)
+          || rotated.grantGeneration !== access.grantGeneration
+          || rotated.grantGeneration <= context.grantGeneration) {
+          return this.unavailable(context.accountId, context.loginId, 'context_changed');
+        }
+        context = rotated;
+        if (!this.validAccess(context, access)) throw new Error('Access grant is unavailable.');
+        const stored = await this.options.store.read(context.accountId, context.loginId);
+        previous = stored && sameContext(context, stored.context) ? stored : null;
+        try { response = await this.query(access); }
+        catch { problem = 'provider_unavailable'; response = { success: false, errorCode: 'ACCOUNT_RATE_LIMITS_FAILED' }; }
+      }
+      if (response.success) reading = { kind: 'openai', rateLimits: publicRateLimits(response.rateLimits) };
+      else if (problem === 'none') problem = response.errorCode === 'CREDENTIAL_REFRESH_REQUIRED'
+        ? 'provider_rejected' : 'provider_unavailable';
+      } else if (context.providerId === 'anthropic' && this.options.claudeStatus) {
+        let login = nativeLogin;
+        let grantGeneration = context.grantGeneration;
+        if (context.owner === 'daemon') {
+          if (!this.options.resolveClaudeLogin) throw new Error('Claude status access is unavailable.');
+          const access = await this.options.resolveClaudeLogin(context, undefined, this.policy.minAccessValidityMs);
+          login = access.login;
+          grantGeneration = access.grantGeneration;
+          if (login.scopes.includes('user:profile')
+            && !future(access.expiresAt, this.now() + this.policy.minAccessValidityMs)) {
+            throw new Error('Claude status access is not fresh enough.');
+          }
+        }
+        const resolved = await readCurrent();
+        if (!resolved || !sameGrantAuthority(context, resolved) || !usable(resolved)
+          || resolved.grantGeneration !== grantGeneration || !login) {
+          return this.unavailable(context.accountId, context.loginId, 'context_changed');
+        }
+        context = resolved;
+        if (!sameContext(initial, context)) {
+          const stored = await this.options.store.read(context.accountId, context.loginId);
+          previous = stored && sameContext(context, stored.context) ? stored : null;
+        }
+        if (!login.scopes.includes('user:profile')) {
+          problem = 'unsupported';
+        } else {
+          let result = await this.options.claudeStatus.readDetailed(login);
+          if (result.credentialRejected && context.owner === 'daemon') {
+            const beforeRotation = await readCurrent();
+            if (!beforeRotation || !sameContext(context, beforeRotation)) {
+              return this.unavailable(context.accountId, context.loginId, 'context_changed');
+            }
+            const rotated = await this.options.resolveClaudeLogin!(context, grantGeneration,
+              this.policy.minAccessValidityMs);
+            const updated = await readCurrent();
+            if (!updated || !sameGrantAuthority(context, updated) || !usable(updated)
+              || updated.grantGeneration !== rotated.grantGeneration
+              || updated.grantGeneration <= grantGeneration
+              || (rotated.login.scopes.includes('user:profile')
+                && !future(rotated.expiresAt, this.now() + this.policy.minAccessValidityMs))) {
+              return this.unavailable(context.accountId, context.loginId, 'context_changed');
+            }
+            context = updated;
+            login = rotated.login;
+            const stored = await this.options.store.read(context.accountId, context.loginId);
+            previous = stored && sameContext(context, stored.context) ? stored : null;
+            if (login.scopes.includes('user:profile')) {
+              result = await this.options.claudeStatus.readDetailed(login);
+            } else {
+              problem = 'unsupported';
+            }
+          }
+          if (problem !== 'unsupported' && result.profile === 'mismatch') {
+            return this.unavailable(context.accountId, context.loginId, 'context_changed');
+          } else if (problem !== 'unsupported' && result.credentialRejected) problem = 'provider_rejected';
+          else if (problem !== 'unsupported' && context.owner === 'claude_native' && result.profile !== 'verified') {
+            problem = 'profile_unavailable';
+          } else if (problem !== 'unsupported') {
+            try {
+              reading = { kind: 'anthropic', status: publicClaudeStatus(result.status) };
+              problem = result.profile !== 'verified' ? 'profile_unavailable'
+                : result.usage !== 'available' ? 'usage_unavailable' : 'none';
+            } catch { problem = 'unsupported'; }
+          }
+        }
+      } else {
+        problem = 'unsupported';
+      }
+    } catch {
+      problem = 'access_unavailable';
+    }
+    const latest = await readCurrent();
+    if (!latest || !sameContext(context, latest) || !usable(latest)) {
+      return this.unavailable(context.accountId, context.loginId, 'context_changed');
+    }
+    const now = this.now();
+    const failures = reading && problem === 'none' ? 0 : Math.min((previous?.failures ?? 0) + 1, 16);
+    const retryMs = Math.min(this.policy.retryBaseMs * 2 ** Math.min(failures - 1, 10), this.policy.retryMaxMs);
+    const retained = !reading && previous?.reading && future(previous.staleUntil, now) ? previous : null;
+    const next: IAuthSwitchStoredUsage = {
+      context, updateId: plugins.crypto.randomUUID(),
+      reading: reading ?? retained?.reading ?? null,
+      observedAt: reading ? timestamp(now) : retained?.observedAt ?? null,
+      currentUntil: reading ? timestamp(now + this.policy.currentMaxAgeMs) : retained?.currentUntil ?? null,
+      staleUntil: reading ? timestamp(now + this.policy.maxStaleAgeMs) : retained?.staleUntil ?? null,
+      lastAttemptAt: timestamp(now),
+      nextAttemptAt: timestamp(now + (reading && problem === 'none' ? this.policy.minAttemptIntervalMs : retryMs)),
+      failures, problem,
+    };
+    try {
+      if (!await this.options.store.publishIfCurrent(context, previous?.updateId ?? null, next)) {
+        const current = await readCurrent();
+        if (!current || !sameContext(context, current)) {
+          return this.unavailable(context.accountId, context.loginId, 'context_changed');
+        }
+        const stored = await this.options.store.read(context.accountId, context.loginId);
+        const confirmed = await readCurrent();
+        if (!confirmed || !sameContext(context, confirmed)) {
+          return this.unavailable(context.accountId, context.loginId, 'context_changed');
+        }
+        return this.snapshot(context, stored);
+      }
+    } catch { return this.unavailable(context.accountId, context.loginId, 'access_unavailable'); }
+    const confirmed = await readCurrent();
+    if (!confirmed || !sameContext(context, confirmed)) {
+      return this.unavailable(context.accountId, context.loginId, 'context_changed');
+    }
+    return this.snapshot(context, next);
+  }
+
+  private validAccess(context: IAuthSwitchUsageContext, access: IAuthSwitchUsageAccess): boolean {
+    return Boolean(access.accessToken) && access.accountId === context.workspaceId
+      && access.grantGeneration === context.grantGeneration
+      && future(access.expiresAt, this.now() + this.policy.minAccessValidityMs);
+  }
+
+  private query(access: IAuthSwitchUsageAccess): ReturnType<IAuthSwitchAuthorityUsageOptions['provider']['getAccountRateLimits']> {
+    const credential: TAccessCredential = { kind: 'chatgptAccess', providerId: 'openai',
+      accessToken: access.accessToken, accountId: access.accountId,
+      isFedrampAccount: access.isFedrampAccount };
+    return this.options.provider.getAccountRateLimits(credential, { timeoutMs: this.policy.providerTimeoutMs });
+  }
+
+  /** Wait for admitted reads before the daemon disposes the shared provider or database. */
+  public close(): Promise<void> {
+    if (this.closing) return this.closing;
+    this.closed = true;
+    this.closing = Promise.allSettled([...this.admitted]).then(() => undefined);
+    return this.closing;
+  }
+}