@modelprofile.com/authswitch 9.1.0 → 10.0.0

package/ts/classes.authoritydatabase.ts

@@ -567,8 +567,8 @@ export class AuthSwitchAuthorityDatabase {
       const draft = change(structuredClone(current));
       const allowed: Record<IStoredAuthorityPreuseOperation['state'], IStoredAuthorityPreuseOperation['state'][]> = {
         preparing: ['request_may_have_started', 'not_sent'],
-        request_may_have_started: ['complete', 'outcome_unknown'],
-        complete: [], not_sent: [], outcome_unknown: [],
+        request_may_have_started: ['complete', 'refused', 'outcome_unknown'],
+        complete: [], not_sent: [], refused: [], outcome_unknown: [],
       };
       if (draft.id !== current.id || draft.kind !== current.kind || draft.purpose !== current.purpose
         || draft.accountId !== current.accountId || draft.grantId !== current.grantId
@@ -1209,12 +1209,17 @@ export class AuthSwitchAuthorityDatabase {
   /**
    * Remove all managed grants in one transaction. Native owners must be stopped and handed off first, and a
    * runtime binding its holder releases must be released first; the daemon's own managed Codex bindings go
-   * with the account.
+   * with the account. `retired` holds the sealed ChatGPT sign-ins the removal discarded, exactly as the attempt
+   * that committed read them, so the caller can revoke them at the provider.
    */
   public async removeAccountAndGrants(updateId: string, accountId: string,
-    expectedRevision: number, statusObservedAt: string): Promise<IStoredAuthorityAccount> {
+    expectedRevision: number, statusObservedAt: string): Promise<{ account: IStoredAuthorityAccount;
+      retired: IStoredAuthorityGrant[] }> {
+    // Collected afresh by every attempt of the transaction, so after it the list is the committed attempt's.
+    let retired: IStoredAuthorityGrant[] = [];
     try {
       return await this.transaction(async session => {
+        retired = [];
         const metaStored = await AuthSwitchAuthorityMetaModel.exact.findStoredOne({ id: 'authswitch-authority' }, { session });
         const accountStored = await AuthSwitchAuthorityAccountModel.exact.findStoredOne({ id: accountId }, { session });
         if (!metaStored || !accountStored || accountStored.removed || accountStored.revision !== expectedRevision) {
@@ -1267,11 +1272,13 @@ export class AuthSwitchAuthorityDatabase {
           const listed = names.length === 1 ? names[0] : `${names.slice(0, -1).join(', ')} and ${names.at(-1)}`;
           throw new AuthSwitchRefusal('account_busy', `This account still backs ${listed} runtime bindings. `
             + 'Stop those runtimes and release their bindings before removing the account. A holder that lost '
-            + 'its capability binds the same runtime and scope again and releases the capability that returns; '
-            + 'if binding again is refused, reauthenticate the account first.');
+            + 'its capability unbinds its own runtime and scope instead, which needs no sign-in.');
         }
         await scan(async (grant, stored) => {
           if (grant.state === 'removed') return;
+          if (grant.purpose === 'openai_managed' && grant.owner === 'daemon' && grant.ciphertext !== null) {
+            retired.push(grant);
+          }
           const draft: IStoredAuthorityGrant = {
             ...grant, state: 'removed', owner: 'none', ciphertext: null, accessExpiresAt: null,
             attemptId: null, retryAt: null, retryCount: 0, problem: 'none',
@@ -1312,13 +1319,13 @@ export class AuthSwitchAuthorityDatabase {
         await this.persistAccount(session, accountStored, removed);
         await this.appendEvent(session, AuthSwitchAuthorityMetaModel.exact.toPersisted(metaStored),
           updateId, 'account', accountId);
-        return removed;
+        return { account: removed, retired };
       });
     } catch (error) {
       if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const event = await AuthSwitchAuthorityEventModel.exact.findStoredOne({ id: updateId });
       const account = await this.readAccount(accountId);
-      if (event && account?.removed && account.updateId === updateId) return account;
+      if (event && account?.removed && account.updateId === updateId) return { account, retired };
       throw new Error('Authswitch account removal outcome is unknown; refresh before retrying.');
     }
   }
@@ -1349,9 +1356,16 @@ export class AuthSwitchAuthorityDatabase {
     }
   }
 
+  /**
+   * Binds a runtime and scope, or rebinds them. The binding's revision is the authority revision of the event
+   * that writes it, handed to `change` as `revision`: the authority revision never repeats, so no two binds of
+   * a runtime and scope ever share one -- not even across a release, which deletes the record, followed by a
+   * bind that inserts it again -- and a holder that names a binding by the revision it read never names its
+   * successor. Records written before carry smaller revisions, which a later bind therefore still exceeds.
+   */
   public async changeBinding(updateId: string, bindingId: string, accountId: string, grantId: string,
     change: (draft: IStoredAuthorityBinding | null, account: IStoredAuthorityAccount,
-      grant: IStoredAuthorityGrant | null) => IStoredAuthorityBinding): Promise<{
+      grant: IStoredAuthorityGrant | null, revision: number) => IStoredAuthorityBinding): Promise<{
       meta: IStoredAuthorityMeta; binding: IStoredAuthorityBinding;
     }> {
     try {
@@ -1363,8 +1377,11 @@ export class AuthSwitchAuthorityDatabase {
         const grantStored = await AuthSwitchAuthorityGrantModel.exact.findStoredOne({ id: grantId }, { session });
         const grant = grantStored ? AuthSwitchAuthorityGrantModel.exact.toPersisted(grantStored) : null;
         const current = await AuthSwitchAuthorityBindingModel.exact.findStoredOne({ id: bindingId }, { session });
-        const draft = change(current ? structuredClone(AuthSwitchAuthorityBindingModel.exact.toPersisted(current)) : null, account, grant);
-        if (draft.id !== bindingId || draft.accountId !== accountId || draft.updateId !== updateId) throw new Error('Binding change has an invalid identity.');
+        const revision = metaStored.revision + 1;
+        const draft = change(current ? structuredClone(AuthSwitchAuthorityBindingModel.exact.toPersisted(current)) : null,
+          account, grant, revision);
+        if (draft.id !== bindingId || draft.accountId !== accountId || draft.updateId !== updateId
+          || draft.revision !== revision) throw new Error('Binding change has an invalid identity.');
         if (draft.grantId !== grantId || grant?.accountId !== accountId) {
           throw new Error('Binding login does not belong to the account.');
         }

package/ts/classes.authorityimport.ts

@@ -1,4 +1,7 @@
 import * as plugins from './plugins.js';
+import { AuthSwitchOpenAiProvider } from './classes.openaiprovider.js';
+import { parseOpenAiTokenClaims, type IOpenAiTokenClaims } from './openaiauth.js';
+import type { IOpenAiAccess, IOpenAiOAuthCredential, TOpenAiAccountRateLimitsResult, TOpenAiRefreshResult } from './interfaces.openai.js';
 import type { AuthSwitchAuthorityDatabase } from './classes.authoritydatabase.js';
 import { authSwitchEnvironmentId } from './classes.operations.js';
 import { AuthSwitchRefusal } from './authority-contract.js';
@@ -55,14 +58,12 @@ export interface IAuthSwitchImportQuiescence {
 /**
  * Exactly the two provider operations an import needs, so nothing here can reach for a third.
  *
- * `OpenAiProviderAdapter` satisfies this; naming only what is used keeps the rotating call countable and
+ * `AuthSwitchOpenAiProvider` satisfies this; naming only what is used keeps the rotating call countable and
  * makes it visible that a projection never touches `refreshCredential`.
  */
 export interface IAuthSwitchImportOpenAiOperations {
-  refreshCredential(credential: plugins.flexAccounts.IOpenAiChatGptOAuthCredential):
-  Promise<plugins.flexAccounts.TSmartAiProviderRefreshResult>;
-  getAccountRateLimits(credential: plugins.flexAccounts.TOpenAiChatGptReadCredential):
-  Promise<plugins.flexAccounts.TSmartAiProviderAccountRateLimitsResult>;
+  refreshCredential(credential: IOpenAiOAuthCredential): Promise<TOpenAiRefreshResult>;
+  getAccountRateLimits(access: IOpenAiAccess): Promise<TOpenAiAccountRateLimitsResult>;
 }
 
 /** The non-rotating Claude proof: one profile read that must name the expected immutable identity. */
@@ -289,7 +290,7 @@ export class AuthSwitchAuthorityImport {
     this.env = options.env;
     this.homeDirectory = options.homeDirectory;
     this.now = options.now ?? Date.now;
-    this.openAi = options.openAi ?? new plugins.flexAccounts.OpenAiProviderAdapter();
+    this.openAi = options.openAi ?? new AuthSwitchOpenAiProvider();
     this.claudeStatus = options.claudeStatus ?? new ClaudeAccountStatus();
     this.claudeTokens = options.claudeTokens ?? new ClaudeTokenRefresh();
     this.secrets = options.secrets ?? new AuthSwitchTpmSecretCodec();
@@ -426,8 +427,8 @@ export class AuthSwitchAuthorityImport {
 
   private externalIdentity(idToken: string): { accountId: string; subject: string; workspaceId: string;
     email: string | null; plan: string | null } {
-    let info: ReturnType<typeof plugins.flexAuth.parseOpenAiChatGptTokenInfo>;
-    try { info = plugins.flexAuth.parseOpenAiChatGptTokenInfo(idToken); }
+    let info: IOpenAiTokenClaims;
+    try { info = parseOpenAiTokenClaims(idToken); }
     catch { return refuse('The submitted login carries no readable ChatGPT identity.'); }
     if (!info.chatgptUserId || !info.chatgptAccountId) {
       refuse('The submitted login omits a stable ChatGPT user or account identity.');
@@ -618,15 +619,14 @@ export class AuthSwitchAuthorityImport {
     identity: { accountId: string; subject: string; workspaceId: string },
     material: TLegacySourceMaterial): Promise<void> {
     if (material.providerId === 'openai') {
-      const result = await this.openAi.getAccountRateLimits({ kind: 'chatgptAccess',
-        providerId: 'openai', accessToken: material.credential.accessToken,
+      const result = await this.openAi.getAccountRateLimits({ accessToken: material.credential.accessToken,
         accountId: identity.workspaceId, isFedrampAccount: false });
       if (!result.success) {
         refuse(`The stored access token could not be proven live (${result.errorCode}); let the native tool `
           + 'refresh its own store, then import again.');
       }
       // The claims of the very token that answered must still name this account.
-      const claims = plugins.flexAuth.parseOpenAiChatGptTokenInfo(material.credential.accessToken);
+      const claims = parseOpenAiTokenClaims(material.credential.accessToken);
       if (claims.chatgptAccountId !== identity.workspaceId) {
         refuse('The stored access token belongs to another ChatGPT account.');
       }
@@ -773,7 +773,7 @@ export class AuthSwitchAuthorityImport {
       const result = await this.openAi.refreshCredential(material.credential);
       if (!result.success) return null;
       let accessExpiresAt: string | null = null;
-      try { accessExpiresAt = plugins.flexAuth.parseOpenAiChatGptTokenInfo(result.credential.accessToken).expiresAt ?? null; }
+      try { accessExpiresAt = parseOpenAiTokenClaims(result.credential.accessToken).expiresAt ?? null; }
       catch { accessExpiresAt = null; }
       return { material: { providerId: 'openai', credential: { kind: 'chatgptOAuth', providerId: 'openai',
         accessToken: result.credential.accessToken, refreshToken: result.credential.refreshToken,

package/ts/classes.authoritymodels.ts

@@ -1,5 +1,6 @@
 import * as plugins from './plugins.js';
-import type { TAuthSwitchClaudeProofFailure, TAuthSwitchLoginPrompt } from './authority-contract.js';
+import type { IAuthSwitchPreuseFailure, IAuthSwitchPreuseLimit, TAuthSwitchClaudeProofFailure,
+  TAuthSwitchLoginPrompt } from './authority-contract.js';
 import type { IAuthSwitchStoredUsage } from './classes.authorityusage.js';
 
 export interface IStoredAuthorityMeta {
@@ -225,7 +226,7 @@ export interface IStoredAuthorityDeviceOperation {
 export type TStoredAuthorityPreuseProblem =
   | 'none' | 'target_unavailable' | 'access_unavailable' | 'catalog_unavailable'
   | 'account_busy' | 'cancelled' | 'authority_closing' | 'interrupted'
-  | 'request_uncertain';
+  | 'request_uncertain' | 'usage_limit' | 'rate_limit';
 
 /** One quota-consuming request. The prompt and generated prose never enter persistence. */
 export interface IStoredAuthorityPreuseOperation {
@@ -240,9 +241,13 @@ export interface IStoredAuthorityPreuseOperation {
   model: string | null;
   authorizationGeneration: number;
   grantGeneration: number | null;
-  state: 'preparing' | 'request_may_have_started' | 'complete' | 'not_sent' | 'outcome_unknown';
+  state: 'preparing' | 'request_may_have_started' | 'complete' | 'not_sent' | 'refused' | 'outcome_unknown';
   result: { inputTokens: number | null; outputTokens: number | null; totalTokens: number | null } | null;
   problem: TStoredAuthorityPreuseProblem;
+  /** Present exactly when `problem` is `usage_limit` or `rate_limit`. */
+  limit?: IAuthSwitchPreuseLimit;
+  /** Present only when `problem` is `request_uncertain` and the request failed with a stated cause. */
+  failure?: IAuthSwitchPreuseFailure;
   createdAt: string;
   updatedAt: string;
   finishedAt: string | null;
@@ -271,6 +276,8 @@ export interface IStoredAuthorityOperationDocument {
   authorizationGeneration?: number;
   grantGeneration?: number | null;
   problem?: TStoredAuthorityPreuseProblem;
+  limit?: IAuthSwitchPreuseLimit;
+  failure?: IAuthSwitchPreuseFailure;
   createdAt: string;
   updatedAt: string;
   finishedAt: string | null;
@@ -603,13 +610,11 @@ const assertStoredAuthorityDeviceOperation: (value: unknown) => asserts value is
     : value.accountId === null || value.grantId === null || value.expectedGrantGeneration === null) {
     throw new Error('Invalid authswitch operation target.');
   }
-  if (value.prompt !== null && (!object(value.prompt)
-    || (value.prompt.flow === 'device'
-      ? !exactKeys(value.prompt, ['flow', 'verificationUrl', 'userCode'])
-        || !bounded(value.prompt.verificationUrl, 2048) || !bounded(value.prompt.userCode, 128)
-      : value.prompt.flow === 'browser'
-        ? !exactKeys(value.prompt, ['flow', 'authUrl']) || !bounded(value.prompt.authUrl, 2048)
-        : true))) throw new Error('Invalid authswitch operation prompt.');
+  if (value.prompt !== null && (!object(value.prompt) || value.prompt.flow !== 'device'
+    || !exactKeys(value.prompt, ['flow', 'verificationUrl', 'userCode'])
+    || !bounded(value.prompt.verificationUrl, 2048) || !bounded(value.prompt.userCode, 128))) {
+    throw new Error('Invalid authswitch operation prompt.');
+  }
   if (value.result !== null && (!object(value.result)
     || !exactKeys(value.result, ['accountId', 'grantId', 'accountRevision', 'grantGeneration'])
     || !hash(value.result.accountId) || !hash(value.result.grantId)
@@ -635,19 +640,33 @@ const modelId = (value: unknown): value is string => typeof value === 'string'
 const tokenCount = (value: unknown): value is number | null => value === null
   || (Number.isSafeInteger(value) && Number(value) >= 0);
 
+const preuseLimitProblems: readonly string[] = ['usage_limit', 'rate_limit'];
+const preuseLimit = (value: unknown): boolean => object(value) && exactKeys(value, ['kind', 'window', 'resetsAt'])
+  && ['usage_limit', 'rate_limit'].includes(String(value.kind))
+  && (value.window === null || bounded(value.window, 64)) && (value.resetsAt === null || iso(value.resetsAt));
+const preuseFailure = (value: unknown): boolean => object(value) && exactKeys(value, ['kind', 'status', 'providerCode'])
+  && ['http', 'stream', 'response', 'network', 'aborted', 'unknown'].includes(String(value.kind))
+  && (value.status === null || (Number.isInteger(value.status) && Number(value.status) >= 100 && Number(value.status) <= 599))
+  && (value.providerCode === null || (typeof value.providerCode === 'string' && /^[A-Za-z0-9_.]{1,64}$/.test(value.providerCode)));
+
 const assertStoredAuthorityPreuseOperation: (value: unknown) => asserts value is IStoredAuthorityPreuseOperation = value => {
+  const limited = object(value) && preuseLimitProblems.includes(String(value.problem));
+  const failed = object(value) && Object.hasOwn(value, 'failure');
   if (!object(value) || !exactKeys(value, ['id', 'kind', 'purpose', 'accountId', 'grantId', 'requestHash',
     'requestedModel', 'model', 'authorizationGeneration', 'grantGeneration', 'state', 'result', 'problem',
+    ...(limited ? ['limit'] : []), ...(failed ? ['failure'] : []),
     'createdAt', 'updatedAt', 'finishedAt', 'revision', 'updateId'])
+    || (limited && !preuseLimit(value.limit))
+    || (failed && (value.problem !== 'request_uncertain' || !preuseFailure(value.failure)))
     || !uuid(value.id) || value.kind !== 'preuse_openai' || value.purpose !== 'openai_managed'
     || !hash(value.accountId) || !hash(value.grantId) || !hash(value.requestHash)
     || (value.requestedModel !== null && !modelId(value.requestedModel))
     || (value.model !== null && !modelId(value.model))
     || !revision(value.authorizationGeneration) || value.authorizationGeneration === 0
     || (value.grantGeneration !== null && (!revision(value.grantGeneration) || value.grantGeneration === 0))
-    || !['preparing', 'request_may_have_started', 'complete', 'not_sent', 'outcome_unknown'].includes(String(value.state))
+    || !['preparing', 'request_may_have_started', 'complete', 'not_sent', 'refused', 'outcome_unknown'].includes(String(value.state))
     || !['none', 'target_unavailable', 'access_unavailable', 'catalog_unavailable', 'account_busy', 'cancelled',
-      'authority_closing', 'interrupted', 'request_uncertain'].includes(String(value.problem))
+      'authority_closing', 'interrupted', 'request_uncertain', 'usage_limit', 'rate_limit'].includes(String(value.problem))
     || !iso(value.createdAt) || !iso(value.updatedAt)
     || (value.finishedAt !== null && !iso(value.finishedAt))
     || !revision(value.revision) || value.revision === 0 || !uuid(value.updateId)) {
@@ -675,13 +694,20 @@ const assertStoredAuthorityPreuseOperation: (value: unknown) => asserts value is
       throw new Error('Invalid completed authswitch preuse operation.');
     }
   } else if (value.state === 'not_sent') {
+    // Only the account's own usage reading stops a prompt with a limit before anything is sent.
     if (value.model !== null || value.grantGeneration !== null || value.result !== null
-      || value.problem === 'none' || value.problem === 'request_uncertain' || value.finishedAt === null) {
+      || value.problem === 'none' || value.problem === 'request_uncertain' || value.problem === 'rate_limit'
+      || value.finishedAt === null) {
       throw new Error('Invalid unsent authswitch preuse operation.');
     }
+  } else if (value.state === 'refused') {
+    if (value.model === null || value.grantGeneration === null || value.result !== null
+      || !limited || value.finishedAt === null) {
+      throw new Error('Invalid refused authswitch preuse operation.');
+    }
   } else if (value.result !== null || value.finishedAt === null || value.model === null
     || value.grantGeneration === null
-    || !['cancelled', 'authority_closing', 'request_uncertain'].includes(String(value.problem))) {
+    || !['cancelled', 'authority_closing', 'request_uncertain', 'usage_limit', 'rate_limit'].includes(String(value.problem))) {
     throw new Error('Invalid uncertain authswitch preuse operation.');
   }
 };
@@ -930,6 +956,8 @@ export class AuthSwitchAuthorityOperationModel extends plugins.nosqldb.SmartData
   @plugins.nosqldb.svDb() public authorizationGeneration?: number;
   @plugins.nosqldb.svDb() public grantGeneration?: number | null;
   @plugins.nosqldb.svDb() public problem?: TStoredAuthorityPreuseProblem;
+  @plugins.nosqldb.svDb() public limit?: IAuthSwitchPreuseLimit;
+  @plugins.nosqldb.svDb() public failure?: IAuthSwitchPreuseFailure;
   @plugins.nosqldb.svDb() public createdAt!: string;
   @plugins.nosqldb.svDb() public updatedAt!: string;
   @plugins.nosqldb.svDb() public finishedAt!: string | null;

package/ts/classes.authoritypreuse.ts

@@ -1,4 +1,5 @@
 import * as plugins from './plugins.js';
+import type { IOpenAiAccess } from './interfaces.openai.js';
 import type { IAuthSwitchPreuseOperation } from './authority-contract.js';
 import { AuthSwitchRefusal } from './authority-contract.js';
 import { AuthSwitchAuthorityBroker } from './classes.authoritybroker.js';
@@ -6,10 +7,10 @@ import { AuthSwitchAuthorityDatabase } from './classes.authoritydatabase.js';
 import type { IStoredAuthorityPreuseOperation, TStoredAuthorityPreuseProblem } from './classes.authoritymodels.js';
 import { CodexPreuse, type ICodexPreuseLifecycle } from './classes.codexpreuse.js';
 import type { IHarnessPreuseOptions, IHarnessPreuseResult } from './interfaces.harness.js';
-import { validatePreuseOptions } from './preuse.js';
+import { PreuseFailureError, PreuseLimitError, validatePreuseOptions } from './preuse.js';
 
 export interface IAuthSwitchAuthorityPreuseExecutor {
-  runAccess(credential: plugins.flexAccounts.IOpenAiChatGptAccessCredential,
+  runAccess(access: IOpenAiAccess,
     options: IHarnessPreuseOptions, lifecycle: ICodexPreuseLifecycle): Promise<IHarnessPreuseResult>;
 }
 
@@ -41,7 +42,8 @@ const hash = (value: unknown): value is string => typeof value === 'string' && /
 const publicOperation = (operation: IStoredAuthorityPreuseOperation): IAuthSwitchPreuseOperation => ({
   id: operation.id, accountId: operation.accountId, loginId: operation.grantId,
   purpose: operation.purpose, requestedModel: operation.requestedModel, model: operation.model,
-  state: operation.state, result: operation.result, problem: operation.problem,
+  state: operation.state, result: operation.result, problem: operation.problem, limit: operation.limit ?? null,
+  failure: operation.failure ?? null,
   createdAt: operation.createdAt, updatedAt: operation.updatedAt,
   finishedAt: operation.finishedAt, revision: operation.revision,
 });
@@ -204,11 +206,8 @@ export class AuthSwitchAuthorityPreuse {
       const access = await this.broker.resolveUsageAccess(context, undefined, this.minAccessValidityMs);
       signal.throwIfAborted();
       phase = operation.requestedModel === null ? 'catalog' : 'access';
-      const credential: plugins.flexAccounts.IOpenAiChatGptAccessCredential = {
-        kind: 'chatgptAccess', providerId: 'openai', accessToken: access.accessToken,
-        accountId: access.accountId, isFedrampAccount: access.isFedrampAccount,
-      };
-      const result = await this.executor.runAccess(credential,
+      const result = await this.executor.runAccess({ accessToken: access.accessToken,
+        accountId: access.accountId, isFedrampAccount: access.isFedrampAccount },
         { prompt, ...(operation.requestedModel === null ? {} : { model: operation.requestedModel }), signal },
         { beforeRequest: async model => {
           signal.throwIfAborted();
@@ -224,26 +223,40 @@ export class AuthSwitchAuthorityPreuse {
         state: 'complete', result: { inputTokens: count(result.inputTokens), outputTokens: count(result.outputTokens),
           totalTokens: count(result.totalTokens) }, problem: 'none', updatedAt: now, finishedAt: now,
         revision: prior.revision + 1, updateId }));
-    } catch {
-      await this.fail(operation.id, phase, signal);
+    } catch (error) {
+      await this.fail(operation.id, phase, signal,
+        error instanceof PreuseLimitError || error instanceof PreuseFailureError ? error : null);
     }
   }
 
-  private async fail(operationId: string, phase: 'target' | 'access' | 'catalog', signal: AbortSignal): Promise<void> {
+  /**
+   * Settles a preuse that did not complete. A limit is named: the account's usage reading stopped it before
+   * anything was sent, or the provider refused the prompt -- before its answer began, which consumed nothing and
+   * settles `refused`, or during it, which stays `outcome_unknown`. Any other stated cause of a sent request is
+   * named as its `failure`.
+   */
+  private async fail(operationId: string, phase: 'target' | 'access' | 'catalog', signal: AbortSignal,
+    stated: PreuseLimitError | PreuseFailureError | null): Promise<void> {
     let current: IStoredAuthorityPreuseOperation;
     try { current = await this.readStored(operationId); }
     catch { return; }
     if (!['preparing', 'request_may_have_started'].includes(current.state)) return;
     const marked = current.state === 'request_may_have_started';
-    const problem: TStoredAuthorityPreuseProblem = marked
-      ? this.closed ? 'authority_closing' : signal.aborted ? 'cancelled' : 'request_uncertain'
-      : this.closed ? 'authority_closing' : signal.aborted ? 'cancelled'
-        : phase === 'target' ? 'target_unavailable' : phase === 'catalog' ? 'catalog_unavailable' : 'access_unavailable';
+    const stopped = this.closed ? 'authority_closing' : signal.aborted ? 'cancelled' : null;
+    const limit = stopped === null && stated instanceof PreuseLimitError && (stated.source === 'provider') === marked
+      ? stated : null;
+    const failure = stopped === null && marked && stated instanceof PreuseFailureError ? stated.failure : null;
+    const problem: TStoredAuthorityPreuseProblem = stopped ?? (limit ? limit.limit.kind
+      : marked ? 'request_uncertain'
+        : phase === 'target' ? 'target_unavailable' : phase === 'catalog' ? 'catalog_unavailable' : 'access_unavailable');
+    const state: IStoredAuthorityPreuseOperation['state'] = !marked ? 'not_sent'
+      : limit && !limit.generationStarted ? 'refused' : 'outcome_unknown';
     const updateId = plugins.crypto.randomUUID();
     const now = new Date(this.now()).toISOString();
     try {
-      await this.database.changePreuseOperation(updateId, operationId, prior => ({ ...prior,
-        state: marked ? 'outcome_unknown' : 'not_sent', problem,
+      await this.database.changePreuseOperation(updateId, operationId, prior => ({ ...prior, state, problem,
+        ...(limit ? { limit: { ...limit.limit } } : {}),
+        ...(failure ? { failure: { ...failure } } : {}),
         updatedAt: now, finishedAt: now, revision: prior.revision + 1, updateId }));
     } catch { /* A durable request marker remains recoverable as outcome_unknown on restart. */ }
   }

package/ts/classes.authorityusage.ts

@@ -1,9 +1,10 @@
 import * as plugins from './plugins.js';
+import type { AuthSwitchOpenAiProvider } from './classes.openaiprovider.js';
+import type { IOpenAiAccountRateLimits, IOpenAiRateLimitDetails, IOpenAiRateLimitWindow } from './interfaces.openai.js';
 import type { IClaudeLogin, IClaudeStatusRead } from './classes.claudestatus.js';
 import type { IHarnessAccountStatus } from './interfaces.harness.js';
 
-type TRateLimits = plugins.flexAccounts.ISmartAiProviderAccountRateLimits;
-type TAccessCredential = plugins.flexAccounts.IOpenAiChatGptAccessCredential;
+type TRateLimits = IOpenAiAccountRateLimits;
 
 export type TAuthSwitchUsageProblem =
   | 'none' | 'unsupported' | 'access_unavailable' | 'provider_unavailable'
@@ -115,7 +116,7 @@ export interface IAuthSwitchAuthorityUsageOptions {
     action: (source: { context: IAuthSwitchUsageContext; login: IClaudeLogin;
       readContext(): Promise<IAuthSwitchUsageContext | null> }) => Promise<IAuthSwitchUsageSnapshot>): Promise<IAuthSwitchUsageSnapshot>;
   store: IAuthSwitchUsageStore;
-  provider: Pick<plugins.flexAccounts.ISmartAiProviderAdapter, 'getAccountRateLimits'>;
+  provider: Pick<AuthSwitchOpenAiProvider, 'getAccountRateLimits'>;
   now?: () => number;
   currentMaxAgeMs?: number;
   maxStaleAgeMs?: number;
@@ -199,11 +200,11 @@ const publicClaudeStatus = (source: IHarnessAccountStatus): IAuthSwitchClaudeSta
 
 /** Allowlist the provider projection before it enters a management DTO or stored usage record. */
 const publicRateLimits = (source: TRateLimits): TRateLimits => {
-  const window = (value: plugins.flexAccounts.ISmartAiProviderRateLimitWindow) => ({
+  const window = (value: IOpenAiRateLimitWindow) => ({
     usedPercent: value.usedPercent, limitWindowSeconds: value.limitWindowSeconds,
     resetAfterSeconds: value.resetAfterSeconds, resetsAt: value.resetsAt,
   });
-  const detail = (value: plugins.flexAccounts.ISmartAiProviderRateLimitDetails) => ({
+  const detail = (value: IOpenAiRateLimitDetails) => ({
     allowed: value.allowed, limitReached: value.limitReached,
     ...(value.primaryWindow ? { primaryWindow: window(value.primaryWindow) } : {}),
     ...(value.secondaryWindow ? { secondaryWindow: window(value.secondaryWindow) } : {}),
@@ -511,10 +512,8 @@ export class AuthSwitchAuthorityUsage {
   }
 
   private query(access: IAuthSwitchUsageAccess): ReturnType<IAuthSwitchAuthorityUsageOptions['provider']['getAccountRateLimits']> {
-    const credential: TAccessCredential = { kind: 'chatgptAccess', providerId: 'openai',
-      accessToken: access.accessToken, accountId: access.accountId,
-      isFedrampAccount: access.isFedrampAccount };
-    return this.options.provider.getAccountRateLimits(credential, { timeoutMs: this.policy.providerTimeoutMs });
+    return this.options.provider.getAccountRateLimits({ accessToken: access.accessToken, accountId: access.accountId,
+      isFedrampAccount: access.isFedrampAccount }, { timeoutMs: this.policy.providerTimeoutMs });
   }
 
   /** Wait for admitted reads before the daemon disposes the shared provider or database. */

package/ts/classes.cli.ts

@@ -372,11 +372,11 @@ ${bold('Environment')}
     const cancel = () => { cancelled = true; void handle?.cancel().catch(() => undefined); };
     process.on('SIGINT', cancel); process.on('SIGTERM', cancel);
     try {
-      handle = await harness.beginLogin({ providerId: provider.providerId, flow: provider.flows.includes('device') ? 'device' : provider.flows[0] });
+      handle = await harness.beginLogin({ providerId: provider.providerId, flow: 'device' });
       if (cancelled) await handle.cancel();
-      else if (handle.prompt.flow === 'device') {
+      else {
         process.stdout.write(`Open ${plainText(handle.prompt.verificationUrl)}\nCode: ${plainText(handle.prompt.userCode)}\nWaiting for login. Press Ctrl+C to cancel.\n`);
-      } else process.stdout.write(`Open ${plainText(handle.prompt.authUrl)}\nWaiting for login. Press Ctrl+C to cancel.\n`);
+      }
       return this.reportOutcome((await handle.completion).outcome);
     } finally {
       process.removeListener('SIGINT', cancel); process.removeListener('SIGTERM', cancel);