@modelprofile.com/authswitch 9.2.0 → 10.0.0

package/ts/classes.authoritybroker.ts

@@ -1,7 +1,10 @@
 import * as plugins from './plugins.js';
+import { AuthSwitchOpenAiProvider } from './classes.openaiprovider.js';
+import { parseOpenAiTokenClaims } from './openaiauth.js';
+import type { IOpenAiLoginHandle, IOpenAiOAuthCredential } from './interfaces.openai.js';
 import type { IAuthSwitchAccount, IAuthSwitchAccountEvent, IAuthSwitchBinding, IAuthSwitchLogin,
   IAuthSwitchNativeAssignment, IAuthSwitchOperation, IAuthSwitchSnapshot, IReq_AuthSwitchSnapshot,
-  TAuthSwitchLoginOwnerTool } from './authority-contract.js';
+  TAuthSwitchLoginOwnerTool, TAuthSwitchRevocation } from './authority-contract.js';
 import { AuthSwitchRefusal, isAuthSwitchAccountLabel } from './authority-contract.js';
 import { AuthSwitchAuthorityDatabase } from './classes.authoritydatabase.js';
 import type { IStoredAuthorityAccount, IStoredAuthorityBinding, IStoredAuthorityClaudeHome, IStoredAuthorityGrant,
@@ -9,9 +12,9 @@ import type { IStoredAuthorityAccount, IStoredAuthorityBinding, IStoredAuthority
 import type { IAuthSwitchUsageContext } from './classes.authorityusage.js';
 import { AuthSwitchTpmSecretCodec, type IAuthSwitchSecretCodec } from './classes.authoritysecrets.js';
 
-type TOpenAiCredential = plugins.flexAccounts.IOpenAiChatGptOAuthCredential;
-type TOpenAiProvider = Pick<plugins.flexAccounts.ISmartAiProviderAdapter,
-  'beginLogin' | 'refreshCredential' | 'inspectCredential' | 'getAccountRateLimits' | 'dispose'>;
+type TOpenAiCredential = IOpenAiOAuthCredential;
+type TOpenAiProvider = Pick<AuthSwitchOpenAiProvider,
+  'beginLogin' | 'refreshCredential' | 'revokeCredential' | 'inspectCredential' | 'getAccountRateLimits' | 'dispose'>;
 
 export interface IAuthSwitchAuthorityBrokerOptions {
   provider?: TOpenAiProvider;
@@ -46,9 +49,15 @@ const safeScope = (value: unknown, maximum: number): value is string => typeof v
   && value.length > 0 && value.length <= maximum && !/[\u0000-\u001f\u007f]/.test(value);
 const validRevision = (value: unknown): value is number => Number.isSafeInteger(value) && Number(value) >= 0;
 const tokenExpiry = (credential: TOpenAiCredential): string | null => {
-  try { return plugins.flexAuth.parseOpenAiChatGptTokenInfo(credential.accessToken).expiresAt ?? null; }
+  try { return parseOpenAiTokenClaims(credential.accessToken).expiresAt ?? null; }
   catch { return null; }
 };
+/**
+ * How long a removal's revocations may take in all. The daemon answers a removal once they settle, so the budget
+ * keeps a revoking removal inside the 35 seconds `AuthSwitchClient` allows any request, leaving the rest to the
+ * drain and the removal itself; a sign-in OpenAI has not confirmed revoking by then reports `failed`.
+ */
+const revocationBudgetMs = 10_000;
 const openAiGrantId = (accountId: string): string => idHash('authswitch-grant-v1', accountId, 'openai_managed', 'chatgpt');
 
 /**
@@ -144,7 +153,7 @@ const publicClaudeAssignment = (home: IStoredAuthorityClaudeHome): IAuthSwitchNa
 
 interface IManagedOperation {
   id: string;
-  handle: plugins.flexAccounts.ISmartAiProviderLoginHandle;
+  handle: IOpenAiLoginHandle;
   task: Promise<void>;
 }
 
@@ -172,7 +181,7 @@ export class AuthSwitchAuthorityBroker {
   private closing?: Promise<void>;
 
   constructor(private readonly database: AuthSwitchAuthorityDatabase, options: IAuthSwitchAuthorityBrokerOptions = {}) {
-    this.provider = options.provider ?? new plugins.flexAccounts.OpenAiProviderAdapter();
+    this.provider = options.provider ?? new AuthSwitchOpenAiProvider();
     this.secrets = options.secrets ?? new AuthSwitchTpmSecretCodec();
     this.now = options.now ?? Date.now;
     this.proactive = options.proactive ?? true;
@@ -344,7 +353,7 @@ export class AuthSwitchAuthorityBroker {
   }
 
   private identity(credential: TOpenAiCredential): { id: string; subject: string; workspaceId: string; email: string | null; plan: string | null } {
-    const token = plugins.flexAuth.parseOpenAiChatGptTokenInfo(credential.idToken);
+    const token = parseOpenAiTokenClaims(credential.idToken);
     const subject = token.chatgptUserId;
     const workspaceId = token.chatgptAccountId;
     if (!subject || !workspaceId) throw new Error('OpenAI login omitted a stable user or account identity.');
@@ -453,7 +462,7 @@ export class AuthSwitchAuthorityBroker {
       if (terminal.state === 'cancelled') return publicOperation(terminal);
       throw error;
     }
-    let handle: plugins.flexAccounts.ISmartAiProviderLoginHandle;
+    let handle: IOpenAiLoginHandle;
     try {
       handle = await this.provider.beginLogin({ flow: 'device' });
     } catch {
@@ -660,13 +669,43 @@ export class AuthSwitchAuthorityBroker {
     return publicAccount(updated.account);
   }
 
-  public async removeAccount(accountId: string, expectedRevision: number): Promise<IAuthSwitchAccount> {
+  /**
+   * Removes an account. Only `revoke: true` reaches the network: it revokes the ChatGPT sign-in the removal
+   * discarded, after the removal committed.
+   */
+  public async removeAccount(accountId: string, expectedRevision: number,
+    options: { revoke: boolean }): Promise<{ account: IAuthSwitchAccount; revoked: TAuthSwitchRevocation }> {
     if (!isId(accountId) || !validRevision(expectedRevision)) throw new Error('Invalid account change.');
     const updateId = plugins.crypto.randomUUID();
-    const account = await this.database.removeAccountAndGrants(updateId, accountId,
+    const { account, retired } = await this.database.removeAccountAndGrants(updateId, accountId,
       expectedRevision, new Date(this.now()).toISOString());
     this.publish();
-    return publicAccount(account);
+    const revoked = options.revoke ? await this.revokeRetired(account, retired) : 'not_requested';
+    return { account: publicAccount(account), revoked };
+  }
+
+  /**
+   * Revokes the ChatGPT sign-ins a removal discarded, as Codex revokes its own when it logs out, so that sign-in
+   * stops working at the service too. Like Codex's, it is best effort: the account is already removed, and the
+   * log says when the service did not confirm the revocation. All of them share `revocationBudgetMs`: each is
+   * given what remains of it, and one the budget no longer reaches is not sent and counts as not confirmed.
+   */
+  private async revokeRetired(account: IStoredAuthorityAccount,
+    retired: IStoredAuthorityGrant[]): Promise<Exclude<TAuthSwitchRevocation, 'not_requested'>> {
+    if (retired.length === 0) return 'not_applicable';
+    const deadline = this.now() + revocationBudgetMs;
+    let revoked: 'yes' | 'failed' = 'yes';
+    for (const grant of retired) {
+      const remainingMs = Math.floor(deadline - this.now());
+      const confirmed = remainingMs > 0 && await this.unsealCredential(account, grant)
+        .then(credential => this.provider.revokeCredential(credential, { timeoutMs: remainingMs }))
+        .then(() => true, () => false);
+      if (!confirmed) {
+        revoked = 'failed';
+        process.stderr.write('Authswitch removed an account, but OpenAI did not confirm revoking its sign-in.\n');
+      }
+    }
+    return revoked;
   }
 
   public async bindAccount(input: { accountId: string; loginId: string; purpose: 'openai_managed';
@@ -835,7 +874,7 @@ export class AuthSwitchAuthorityBroker {
       }
       if (!grant.accessExpiresAt) throw new AuthSwitchRefusal('access_not_fresh', accessNotFresh);
       const credential = await this.unsealCredential(account, grant);
-      const info = plugins.flexAuth.parseOpenAiChatGptTokenInfo(credential.accessToken);
+      const info = parseOpenAiTokenClaims(credential.accessToken);
       if (info.chatgptAccountId !== account.workspaceId || info.chatgptUserId !== account.subject) {
         throw new Error('Account access identity changed.');
       }

package/ts/classes.authoritycli.ts

@@ -1,11 +1,12 @@
 import type { IAuthSwitchDoctorPage, IAuthSwitchOperation, IAuthSwitchPreuseOperation,
-  IAuthSwitchSnapshot, IReq_AuthSwitchDoctor, IReq_AuthSwitchStartPreuse } from './authority-contract.js';
+  IAuthSwitchSnapshot, IReq_AuthSwitchDoctor, IReq_AuthSwitchRemoveAccount,
+  IReq_AuthSwitchStartPreuse } from './authority-contract.js';
 import { isAuthSwitchImportRefusal } from './authority-import-contract.js';
 import type { IAuthSwitchImportInventory, IAuthSwitchImportResult, IAuthSwitchImportStatus,
   IReq_AuthSwitchImportStatus, TAuthSwitchImportAction } from './authority-import-contract.js';
 import { AuthSwitchClient } from './classes.authorityclient.js';
 import { resolveAuthSwitchAuthorityPaths } from './classes.authorityservice.js';
-import { defaultPreusePrompt, validatePreuseOptions } from './preuse.js';
+import { defaultPreusePrompt, describePreuseFailure, describePreuseLimit, validatePreuseOptions } from './preuse.js';
 import { plainText } from './formatting.js';
 import * as plugins from './plugins.js';
 
@@ -23,6 +24,8 @@ export interface IAuthSwitchAuthorityCliClient {
   startPreuse(input: IReq_AuthSwitchStartPreuse['request']): Promise<IAuthSwitchPreuseOperation>;
   getPreuse(operationId: string): Promise<IAuthSwitchPreuseOperation>;
   cancelPreuse(operationId: string): Promise<IAuthSwitchPreuseOperation>;
+  removeAccount(accountId: string, expectedRevision: number,
+    options: { revoke: boolean }): Promise<IReq_AuthSwitchRemoveAccount['response']>;
   close(reason?: Error): void;
 }
 
@@ -44,6 +47,7 @@ type TAuthorityCliCommand =
   | { kind: 'importSubmit'; sourceId: string; sourceDigest: string; json: boolean }
   | { kind: 'add'; json: boolean }
   | { kind: 'reauth'; accountId: string; loginId: string; json: boolean }
+  | { kind: 'remove'; accountId: string; revoke: boolean; json: boolean }
   | { kind: 'get'; operationId: string; json: boolean }
   | { kind: 'cancel'; operationId: string; json: boolean }
   | { kind: 'resume'; operationId: string; json: boolean }
@@ -60,7 +64,7 @@ class AuthorityCliFailure extends Error {
   }
 }
 
-const usage = 'Usage: authswitch account list [--json] | authswitch account add openai [--json] | authswitch account reauth <account-id> <login-id> [--json] | authswitch account operation get|cancel|resume <operation-id> [--json] | authswitch account preuse <account-id> <login-id>|--all [--prompt <text>] [--model <id>] [--json] | authswitch account preuse operation get|cancel|resume <operation-id> [--json] | authswitch authority doctor [--json] | authswitch authority import inventory [--json] | authswitch authority import status [--json] | authswitch authority import submit <source-id> --digest <source-digest> [--json]';
+const usage = 'Usage: authswitch account list [--json] | authswitch account add openai [--json] | authswitch account reauth <account-id> <login-id> [--json] | authswitch account remove <account-id> [--revoke] [--json] | authswitch account operation get|cancel|resume <operation-id> [--json] | authswitch account preuse <account-id> <login-id>|--all [--prompt <text>] [--model <id>] [--json] | authswitch account preuse operation get|cancel|resume <operation-id> [--json] | authswitch authority doctor [--json] | authswitch authority import inventory [--json] | authswitch authority import status [--json] | authswitch authority import submit <source-id> --digest <source-digest> [--json]';
 const safe = (value: string | number | null): string => plainText(value === null ? 'none' : String(value));
 const isId = (value: string | undefined): value is string => Boolean(value && !value.startsWith('-'));
 const isHash = (value: string | undefined): value is string =>
@@ -143,6 +147,14 @@ const parse = (argv: readonly string[]): TAuthorityCliCommand | null => {
     && (argv.length === 4 || (argv.length === 5 && argv[4] === '--json'))) {
     return { kind: 'reauth', accountId: argv[2], loginId: argv[3], json: argv[4] === '--json' };
   }
+  if (argv[0] === 'account' && argv[1] === 'remove' && isId(argv[2])) {
+    const options = argv.slice(3);
+    const revoke = options.includes('--revoke');
+    const json = options.includes('--json');
+    if (options.length !== Number(revoke) + Number(json)
+      || options.some(option => option !== '--revoke' && option !== '--json')) return null;
+    return { kind: 'remove', accountId: argv[2], revoke, json };
+  }
   if (argv[0] === 'account' && argv[1] === 'operation'
     && (argv[2] === 'get' || argv[2] === 'cancel' || argv[2] === 'resume') && isId(argv[3])
     && (argv.length === 4 || (argv.length === 5 && argv[4] === '--json'))) {
@@ -210,11 +222,27 @@ class ScopedAuthorityCliClient implements IAuthSwitchAuthorityCliClient {
     return this.client.cancelPreuse(operationId, this.controller.signal);
   }
 
+  public removeAccount(accountId: string, expectedRevision: number,
+    options: { revoke: boolean }): Promise<IReq_AuthSwitchRemoveAccount['response']> {
+    return this.client.removeAccount(accountId, expectedRevision, { ...options, signal: this.controller.signal });
+  }
+
   public close(reason = new Error('Authswitch authority CLI closed.')): void {
     if (!this.controller.signal.aborted) this.controller.abort(reason);
   }
 }
 
+const revocationLines: Record<IReq_AuthSwitchRemoveAccount['response']['revoked'], string> = {
+  not_requested: 'Its ChatGPT sign-in was not revoked at OpenAI (no --revoke).',
+  yes: 'OpenAI confirmed revoking its ChatGPT sign-in.',
+  failed: 'OpenAI did not confirm revoking its ChatGPT sign-in; it may still be valid there.',
+  not_applicable: 'The authority held no ChatGPT sign-in of its own for it, so nothing was revoked.',
+};
+
+const renderRemoval = (removal: IReq_AuthSwitchRemoveAccount['response']): string =>
+  `Removed account ${safe(removal.account.email ?? removal.account.label)} (${safe(removal.account.id)}).\n`
+  + `${revocationLines[removal.revoked]}\n`;
+
 const renderList = (snapshot: IAuthSwitchSnapshot): string => {
   const lines = [`Authority accounts — generated ${safe(snapshot.generatedAt)}, revision ${snapshot.revision}`];
   if (snapshot.accounts.length === 0) lines.push('No authority accounts are registered.');
@@ -332,7 +360,8 @@ const resumeCommand = (operationId: string, json: boolean): string =>
   `authswitch account operation resume ${safe(operationId)}${json ? ' --json' : ''}`;
 
 const terminalPreuseOperation = (operation: IAuthSwitchPreuseOperation): boolean =>
-  operation.state === 'complete' || operation.state === 'not_sent' || operation.state === 'outcome_unknown';
+  operation.state === 'complete' || operation.state === 'not_sent' || operation.state === 'refused'
+  || operation.state === 'outcome_unknown';
 
 const preuseResumeCommand = (operationId: string, json: boolean): string =>
   `authswitch account preuse operation resume ${safe(operationId)}${json ? ' --json' : ''}`;
@@ -346,9 +375,9 @@ const renderOperation = (operation: IAuthSwitchOperation, json: boolean): string
   if (operation.targetAccountId || operation.targetLoginId) {
     lines.push(`  target account=${safe(operation.targetAccountId)}; login=${safe(operation.targetLoginId)}`);
   }
-  if (operation.prompt?.flow === 'device') {
+  if (operation.prompt) {
     lines.push(`  Open ${safe(operation.prompt.verificationUrl)}`, `  Code: ${safe(operation.prompt.userCode)}`);
-  } else if (operation.prompt?.flow === 'browser') lines.push(`  Open ${safe(operation.prompt.authUrl)}`);
+  }
   if (operation.result) {
     lines.push(`  completed account=${safe(operation.result.accountId)}; login=${safe(operation.result.loginId)}; account revision=${operation.result.accountRevision}; login generation=${operation.result.loginGeneration}`);
   }
@@ -368,6 +397,8 @@ const renderPreuseOperation = (operation: IAuthSwitchPreuseOperation, json: bool
   if (operation.result) {
     lines.push(`  tokens input=${safe(operation.result.inputTokens)}; output=${safe(operation.result.outputTokens)}; total=${safe(operation.result.totalTokens)}`);
   }
+  if (operation.limit) lines.push(`  ${safe(describePreuseLimit(operation.limit, Date.now()))}`);
+  if (operation.failure) lines.push(`  Cause: ${safe(describePreuseFailure(operation.failure))}`);
   if (!terminalPreuseOperation(operation)) {
     lines.push(`  Resume: ${preuseResumeCommand(operation.id, false)}`);
   }
@@ -721,6 +752,17 @@ export const runAuthSwitchAuthorityCli = async (argv: readonly string[],
       await writeOutput(command.json ? JSON.stringify(result) + '\n' : renderImportResult(result));
       return result.status === 'complete' ? 0 : 1;
     }
+    if (command.kind === 'remove') {
+      const account = (await activeClient.snapshotAll()).accounts.find(item => item.id === command.accountId);
+      if (!account) {
+        await writeDiagnostic('No authority account has this id. Run `authswitch account list` for the ids.\n');
+        return 1;
+      }
+      const removed = await activeClient.removeAccount(account.id, account.revision, { revoke: command.revoke });
+      if (removed.account.id !== account.id || !removed.account.removed) throw new AuthorityCliFailure('response');
+      await writeOutput(command.json ? JSON.stringify(removed) + '\n' : renderRemoval(removed));
+      return removed.revoked === 'failed' ? 1 : 0;
+    }
     if (command.kind === 'preuseGet' || command.kind === 'preuseCancel') {
       const operation = validatePreuseOperation(command.kind === 'preuseGet'
         ? await activeClient.getPreuse(command.operationId)

package/ts/classes.authorityclient.ts

@@ -387,10 +387,18 @@ export class AuthSwitchClient {
     return (await this.request<IReq_AuthSwitchRenameAccount>('authswitch.authority.rename',
       { accountId, expectedRevision, label }, 35_000, false, signal)).account;
   }
+  /**
+   * Removes an account; `revoke: true` also revokes its ChatGPT sign-in at OpenAI (see
+   * `IReq_AuthSwitchRemoveAccount`). An older daemon refuses `revoke` as an invalid request before it changes
+   * anything, and answers a plain removal without `revoked`, which then is `not_requested`: it never revokes.
+   */
   public async removeAccount(accountId: string, expectedRevision: number,
-    signal?: AbortSignal): Promise<IReq_AuthSwitchRemoveAccount['response']['account']> {
-    return (await this.request<IReq_AuthSwitchRemoveAccount>('authswitch.authority.remove',
-      { accountId, expectedRevision }, 35_000, false, signal)).account;
+    options: { revoke?: boolean; signal?: AbortSignal } = {}): Promise<IReq_AuthSwitchRemoveAccount['response']> {
+    const response: Partial<IReq_AuthSwitchRemoveAccount['response']> =
+      await this.request<IReq_AuthSwitchRemoveAccount>('authswitch.authority.remove',
+        { accountId, expectedRevision, ...(options.revoke ? { revoke: true as const } : {}) }, 35_000, false,
+        options.signal);
+    return { account: response.account!, revoked: response.revoked ?? 'not_requested' };
   }
   public async switchClaudeNative(accountId: string, loginId: string,
     signal?: AbortSignal): Promise<IReq_AuthSwitchSwitchClaudeNative['response']['handoff']> {

package/ts/classes.authoritydaemon.ts

@@ -1,5 +1,6 @@
 import type { ITypedRequest } from '@api.global/typedrequest-interfaces';
 import * as plugins from './plugins.js';
+import { AuthSwitchOpenAiProvider } from './classes.openaiprovider.js';
 import type {
   IAuthSwitchDoctorPage, IReq_AuthSwitchDoctor,
   IReq_AuthSwitchBeginAdd, IReq_AuthSwitchBeginReauth, IReq_AuthSwitchCancelOperation,
@@ -156,7 +157,7 @@ export class AuthSwitchAuthorityDaemon {
       throw new Error('Authswitch authority requestDeliveryMs must be a positive whole number of milliseconds.');
     }
     this.database = new AuthSwitchAuthorityDatabase(options);
-    const provider = options.broker?.provider ?? new plugins.flexAccounts.OpenAiProviderAdapter();
+    const provider = options.broker?.provider ?? new AuthSwitchOpenAiProvider();
     this.broker = new AuthSwitchAuthorityBroker(this.database, { ...options.broker, provider });
     this.usage = new AuthSwitchAuthorityUsage({
       ...options.usage,
@@ -474,15 +475,17 @@ export class AuthSwitchAuthorityDaemon {
       }));
     this.managementRouter.addTypedHandler(this.handler<IReq_AuthSwitchRemoveAccount>(
       'authswitch.authority.remove', async request => {
-        if (!hasKeys(request, ['accountId', 'expectedRevision']) || typeof request.accountId !== 'string'
-          || typeof request.expectedRevision !== 'number') invalid();
+        const revoke = Object.hasOwn(request, 'revoke');
+        if (!hasKeys(request, revoke ? ['accountId', 'expectedRevision', 'revoke'] : ['accountId', 'expectedRevision'])
+          || typeof request.accountId !== 'string' || typeof request.expectedRevision !== 'number'
+          || (revoke && request.revoke !== true)) invalid();
         if (this.drainingAccounts.has(request.accountId) || this.preuseAccounts.has(request.accountId)) {
           throw new AuthSwitchRefusal('account_busy', 'Account runtime drain is already in progress.');
         }
         this.drainingAccounts.add(request.accountId);
         try {
           await this.drainManagedCodexAccount(request.accountId);
-          return { account: await this.broker.removeAccount(request.accountId, request.expectedRevision) };
+          return await this.broker.removeAccount(request.accountId, request.expectedRevision, { revoke });
         } finally { this.drainingAccounts.delete(request.accountId); }
       }));
     this.managementRouter.addTypedHandler(this.handler<IReq_AuthSwitchBindAccount>(

package/ts/classes.authoritydatabase.ts

@@ -567,8 +567,8 @@ export class AuthSwitchAuthorityDatabase {
       const draft = change(structuredClone(current));
       const allowed: Record<IStoredAuthorityPreuseOperation['state'], IStoredAuthorityPreuseOperation['state'][]> = {
         preparing: ['request_may_have_started', 'not_sent'],
-        request_may_have_started: ['complete', 'outcome_unknown'],
-        complete: [], not_sent: [], outcome_unknown: [],
+        request_may_have_started: ['complete', 'refused', 'outcome_unknown'],
+        complete: [], not_sent: [], refused: [], outcome_unknown: [],
       };
       if (draft.id !== current.id || draft.kind !== current.kind || draft.purpose !== current.purpose
         || draft.accountId !== current.accountId || draft.grantId !== current.grantId
@@ -1209,12 +1209,17 @@ export class AuthSwitchAuthorityDatabase {
   /**
    * Remove all managed grants in one transaction. Native owners must be stopped and handed off first, and a
    * runtime binding its holder releases must be released first; the daemon's own managed Codex bindings go
-   * with the account.
+   * with the account. `retired` holds the sealed ChatGPT sign-ins the removal discarded, exactly as the attempt
+   * that committed read them, so the caller can revoke them at the provider.
    */
   public async removeAccountAndGrants(updateId: string, accountId: string,
-    expectedRevision: number, statusObservedAt: string): Promise<IStoredAuthorityAccount> {
+    expectedRevision: number, statusObservedAt: string): Promise<{ account: IStoredAuthorityAccount;
+      retired: IStoredAuthorityGrant[] }> {
+    // Collected afresh by every attempt of the transaction, so after it the list is the committed attempt's.
+    let retired: IStoredAuthorityGrant[] = [];
     try {
       return await this.transaction(async session => {
+        retired = [];
         const metaStored = await AuthSwitchAuthorityMetaModel.exact.findStoredOne({ id: 'authswitch-authority' }, { session });
         const accountStored = await AuthSwitchAuthorityAccountModel.exact.findStoredOne({ id: accountId }, { session });
         if (!metaStored || !accountStored || accountStored.removed || accountStored.revision !== expectedRevision) {
@@ -1271,6 +1276,9 @@ export class AuthSwitchAuthorityDatabase {
         }
         await scan(async (grant, stored) => {
           if (grant.state === 'removed') return;
+          if (grant.purpose === 'openai_managed' && grant.owner === 'daemon' && grant.ciphertext !== null) {
+            retired.push(grant);
+          }
           const draft: IStoredAuthorityGrant = {
             ...grant, state: 'removed', owner: 'none', ciphertext: null, accessExpiresAt: null,
             attemptId: null, retryAt: null, retryCount: 0, problem: 'none',
@@ -1311,13 +1319,13 @@ export class AuthSwitchAuthorityDatabase {
         await this.persistAccount(session, accountStored, removed);
         await this.appendEvent(session, AuthSwitchAuthorityMetaModel.exact.toPersisted(metaStored),
           updateId, 'account', accountId);
-        return removed;
+        return { account: removed, retired };
       });
     } catch (error) {
       if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const event = await AuthSwitchAuthorityEventModel.exact.findStoredOne({ id: updateId });
       const account = await this.readAccount(accountId);
-      if (event && account?.removed && account.updateId === updateId) return account;
+      if (event && account?.removed && account.updateId === updateId) return { account, retired };
       throw new Error('Authswitch account removal outcome is unknown; refresh before retrying.');
     }
   }

package/ts/classes.authorityimport.ts

@@ -1,4 +1,7 @@
 import * as plugins from './plugins.js';
+import { AuthSwitchOpenAiProvider } from './classes.openaiprovider.js';
+import { parseOpenAiTokenClaims, type IOpenAiTokenClaims } from './openaiauth.js';
+import type { IOpenAiAccess, IOpenAiOAuthCredential, TOpenAiAccountRateLimitsResult, TOpenAiRefreshResult } from './interfaces.openai.js';
 import type { AuthSwitchAuthorityDatabase } from './classes.authoritydatabase.js';
 import { authSwitchEnvironmentId } from './classes.operations.js';
 import { AuthSwitchRefusal } from './authority-contract.js';
@@ -55,14 +58,12 @@ export interface IAuthSwitchImportQuiescence {
 /**
  * Exactly the two provider operations an import needs, so nothing here can reach for a third.
  *
- * `OpenAiProviderAdapter` satisfies this; naming only what is used keeps the rotating call countable and
+ * `AuthSwitchOpenAiProvider` satisfies this; naming only what is used keeps the rotating call countable and
  * makes it visible that a projection never touches `refreshCredential`.
  */
 export interface IAuthSwitchImportOpenAiOperations {
-  refreshCredential(credential: plugins.flexAccounts.IOpenAiChatGptOAuthCredential):
-  Promise<plugins.flexAccounts.TSmartAiProviderRefreshResult>;
-  getAccountRateLimits(credential: plugins.flexAccounts.TOpenAiChatGptReadCredential):
-  Promise<plugins.flexAccounts.TSmartAiProviderAccountRateLimitsResult>;
+  refreshCredential(credential: IOpenAiOAuthCredential): Promise<TOpenAiRefreshResult>;
+  getAccountRateLimits(access: IOpenAiAccess): Promise<TOpenAiAccountRateLimitsResult>;
 }
 
 /** The non-rotating Claude proof: one profile read that must name the expected immutable identity. */
@@ -289,7 +290,7 @@ export class AuthSwitchAuthorityImport {
     this.env = options.env;
     this.homeDirectory = options.homeDirectory;
     this.now = options.now ?? Date.now;
-    this.openAi = options.openAi ?? new plugins.flexAccounts.OpenAiProviderAdapter();
+    this.openAi = options.openAi ?? new AuthSwitchOpenAiProvider();
     this.claudeStatus = options.claudeStatus ?? new ClaudeAccountStatus();
     this.claudeTokens = options.claudeTokens ?? new ClaudeTokenRefresh();
     this.secrets = options.secrets ?? new AuthSwitchTpmSecretCodec();
@@ -426,8 +427,8 @@ export class AuthSwitchAuthorityImport {
 
   private externalIdentity(idToken: string): { accountId: string; subject: string; workspaceId: string;
     email: string | null; plan: string | null } {
-    let info: ReturnType<typeof plugins.flexAuth.parseOpenAiChatGptTokenInfo>;
-    try { info = plugins.flexAuth.parseOpenAiChatGptTokenInfo(idToken); }
+    let info: IOpenAiTokenClaims;
+    try { info = parseOpenAiTokenClaims(idToken); }
     catch { return refuse('The submitted login carries no readable ChatGPT identity.'); }
     if (!info.chatgptUserId || !info.chatgptAccountId) {
       refuse('The submitted login omits a stable ChatGPT user or account identity.');
@@ -618,15 +619,14 @@ export class AuthSwitchAuthorityImport {
     identity: { accountId: string; subject: string; workspaceId: string },
     material: TLegacySourceMaterial): Promise<void> {
     if (material.providerId === 'openai') {
-      const result = await this.openAi.getAccountRateLimits({ kind: 'chatgptAccess',
-        providerId: 'openai', accessToken: material.credential.accessToken,
+      const result = await this.openAi.getAccountRateLimits({ accessToken: material.credential.accessToken,
         accountId: identity.workspaceId, isFedrampAccount: false });
       if (!result.success) {
         refuse(`The stored access token could not be proven live (${result.errorCode}); let the native tool `
           + 'refresh its own store, then import again.');
       }
       // The claims of the very token that answered must still name this account.
-      const claims = plugins.flexAuth.parseOpenAiChatGptTokenInfo(material.credential.accessToken);
+      const claims = parseOpenAiTokenClaims(material.credential.accessToken);
       if (claims.chatgptAccountId !== identity.workspaceId) {
         refuse('The stored access token belongs to another ChatGPT account.');
       }
@@ -773,7 +773,7 @@ export class AuthSwitchAuthorityImport {
       const result = await this.openAi.refreshCredential(material.credential);
       if (!result.success) return null;
       let accessExpiresAt: string | null = null;
-      try { accessExpiresAt = plugins.flexAuth.parseOpenAiChatGptTokenInfo(result.credential.accessToken).expiresAt ?? null; }
+      try { accessExpiresAt = parseOpenAiTokenClaims(result.credential.accessToken).expiresAt ?? null; }
       catch { accessExpiresAt = null; }
       return { material: { providerId: 'openai', credential: { kind: 'chatgptOAuth', providerId: 'openai',
         accessToken: result.credential.accessToken, refreshToken: result.credential.refreshToken,

package/ts/classes.authoritymodels.ts

@@ -1,5 +1,6 @@
 import * as plugins from './plugins.js';
-import type { TAuthSwitchClaudeProofFailure, TAuthSwitchLoginPrompt } from './authority-contract.js';
+import type { IAuthSwitchPreuseFailure, IAuthSwitchPreuseLimit, TAuthSwitchClaudeProofFailure,
+  TAuthSwitchLoginPrompt } from './authority-contract.js';
 import type { IAuthSwitchStoredUsage } from './classes.authorityusage.js';
 
 export interface IStoredAuthorityMeta {
@@ -225,7 +226,7 @@ export interface IStoredAuthorityDeviceOperation {
 export type TStoredAuthorityPreuseProblem =
   | 'none' | 'target_unavailable' | 'access_unavailable' | 'catalog_unavailable'
   | 'account_busy' | 'cancelled' | 'authority_closing' | 'interrupted'
-  | 'request_uncertain';
+  | 'request_uncertain' | 'usage_limit' | 'rate_limit';
 
 /** One quota-consuming request. The prompt and generated prose never enter persistence. */
 export interface IStoredAuthorityPreuseOperation {
@@ -240,9 +241,13 @@ export interface IStoredAuthorityPreuseOperation {
   model: string | null;
   authorizationGeneration: number;
   grantGeneration: number | null;
-  state: 'preparing' | 'request_may_have_started' | 'complete' | 'not_sent' | 'outcome_unknown';
+  state: 'preparing' | 'request_may_have_started' | 'complete' | 'not_sent' | 'refused' | 'outcome_unknown';
   result: { inputTokens: number | null; outputTokens: number | null; totalTokens: number | null } | null;
   problem: TStoredAuthorityPreuseProblem;
+  /** Present exactly when `problem` is `usage_limit` or `rate_limit`. */
+  limit?: IAuthSwitchPreuseLimit;
+  /** Present only when `problem` is `request_uncertain` and the request failed with a stated cause. */
+  failure?: IAuthSwitchPreuseFailure;
   createdAt: string;
   updatedAt: string;
   finishedAt: string | null;
@@ -271,6 +276,8 @@ export interface IStoredAuthorityOperationDocument {
   authorizationGeneration?: number;
   grantGeneration?: number | null;
   problem?: TStoredAuthorityPreuseProblem;
+  limit?: IAuthSwitchPreuseLimit;
+  failure?: IAuthSwitchPreuseFailure;
   createdAt: string;
   updatedAt: string;
   finishedAt: string | null;
@@ -603,13 +610,11 @@ const assertStoredAuthorityDeviceOperation: (value: unknown) => asserts value is
     : value.accountId === null || value.grantId === null || value.expectedGrantGeneration === null) {
     throw new Error('Invalid authswitch operation target.');
   }
-  if (value.prompt !== null && (!object(value.prompt)
-    || (value.prompt.flow === 'device'
-      ? !exactKeys(value.prompt, ['flow', 'verificationUrl', 'userCode'])
-        || !bounded(value.prompt.verificationUrl, 2048) || !bounded(value.prompt.userCode, 128)
-      : value.prompt.flow === 'browser'
-        ? !exactKeys(value.prompt, ['flow', 'authUrl']) || !bounded(value.prompt.authUrl, 2048)
-        : true))) throw new Error('Invalid authswitch operation prompt.');
+  if (value.prompt !== null && (!object(value.prompt) || value.prompt.flow !== 'device'
+    || !exactKeys(value.prompt, ['flow', 'verificationUrl', 'userCode'])
+    || !bounded(value.prompt.verificationUrl, 2048) || !bounded(value.prompt.userCode, 128))) {
+    throw new Error('Invalid authswitch operation prompt.');
+  }
   if (value.result !== null && (!object(value.result)
     || !exactKeys(value.result, ['accountId', 'grantId', 'accountRevision', 'grantGeneration'])
     || !hash(value.result.accountId) || !hash(value.result.grantId)
@@ -635,19 +640,33 @@ const modelId = (value: unknown): value is string => typeof value === 'string'
 const tokenCount = (value: unknown): value is number | null => value === null
   || (Number.isSafeInteger(value) && Number(value) >= 0);
 
+const preuseLimitProblems: readonly string[] = ['usage_limit', 'rate_limit'];
+const preuseLimit = (value: unknown): boolean => object(value) && exactKeys(value, ['kind', 'window', 'resetsAt'])
+  && ['usage_limit', 'rate_limit'].includes(String(value.kind))
+  && (value.window === null || bounded(value.window, 64)) && (value.resetsAt === null || iso(value.resetsAt));
+const preuseFailure = (value: unknown): boolean => object(value) && exactKeys(value, ['kind', 'status', 'providerCode'])
+  && ['http', 'stream', 'response', 'network', 'aborted', 'unknown'].includes(String(value.kind))
+  && (value.status === null || (Number.isInteger(value.status) && Number(value.status) >= 100 && Number(value.status) <= 599))
+  && (value.providerCode === null || (typeof value.providerCode === 'string' && /^[A-Za-z0-9_.]{1,64}$/.test(value.providerCode)));
+
 const assertStoredAuthorityPreuseOperation: (value: unknown) => asserts value is IStoredAuthorityPreuseOperation = value => {
+  const limited = object(value) && preuseLimitProblems.includes(String(value.problem));
+  const failed = object(value) && Object.hasOwn(value, 'failure');
   if (!object(value) || !exactKeys(value, ['id', 'kind', 'purpose', 'accountId', 'grantId', 'requestHash',
     'requestedModel', 'model', 'authorizationGeneration', 'grantGeneration', 'state', 'result', 'problem',
+    ...(limited ? ['limit'] : []), ...(failed ? ['failure'] : []),
     'createdAt', 'updatedAt', 'finishedAt', 'revision', 'updateId'])
+    || (limited && !preuseLimit(value.limit))
+    || (failed && (value.problem !== 'request_uncertain' || !preuseFailure(value.failure)))
     || !uuid(value.id) || value.kind !== 'preuse_openai' || value.purpose !== 'openai_managed'
     || !hash(value.accountId) || !hash(value.grantId) || !hash(value.requestHash)
     || (value.requestedModel !== null && !modelId(value.requestedModel))
     || (value.model !== null && !modelId(value.model))
     || !revision(value.authorizationGeneration) || value.authorizationGeneration === 0
     || (value.grantGeneration !== null && (!revision(value.grantGeneration) || value.grantGeneration === 0))
-    || !['preparing', 'request_may_have_started', 'complete', 'not_sent', 'outcome_unknown'].includes(String(value.state))
+    || !['preparing', 'request_may_have_started', 'complete', 'not_sent', 'refused', 'outcome_unknown'].includes(String(value.state))
     || !['none', 'target_unavailable', 'access_unavailable', 'catalog_unavailable', 'account_busy', 'cancelled',
-      'authority_closing', 'interrupted', 'request_uncertain'].includes(String(value.problem))
+      'authority_closing', 'interrupted', 'request_uncertain', 'usage_limit', 'rate_limit'].includes(String(value.problem))
     || !iso(value.createdAt) || !iso(value.updatedAt)
     || (value.finishedAt !== null && !iso(value.finishedAt))
     || !revision(value.revision) || value.revision === 0 || !uuid(value.updateId)) {
@@ -675,13 +694,20 @@ const assertStoredAuthorityPreuseOperation: (value: unknown) => asserts value is
       throw new Error('Invalid completed authswitch preuse operation.');
     }
   } else if (value.state === 'not_sent') {
+    // Only the account's own usage reading stops a prompt with a limit before anything is sent.
     if (value.model !== null || value.grantGeneration !== null || value.result !== null
-      || value.problem === 'none' || value.problem === 'request_uncertain' || value.finishedAt === null) {
+      || value.problem === 'none' || value.problem === 'request_uncertain' || value.problem === 'rate_limit'
+      || value.finishedAt === null) {
       throw new Error('Invalid unsent authswitch preuse operation.');
     }
+  } else if (value.state === 'refused') {
+    if (value.model === null || value.grantGeneration === null || value.result !== null
+      || !limited || value.finishedAt === null) {
+      throw new Error('Invalid refused authswitch preuse operation.');
+    }
   } else if (value.result !== null || value.finishedAt === null || value.model === null
     || value.grantGeneration === null
-    || !['cancelled', 'authority_closing', 'request_uncertain'].includes(String(value.problem))) {
+    || !['cancelled', 'authority_closing', 'request_uncertain', 'usage_limit', 'rate_limit'].includes(String(value.problem))) {
     throw new Error('Invalid uncertain authswitch preuse operation.');
   }
 };
@@ -930,6 +956,8 @@ export class AuthSwitchAuthorityOperationModel extends plugins.nosqldb.SmartData
   @plugins.nosqldb.svDb() public authorizationGeneration?: number;
   @plugins.nosqldb.svDb() public grantGeneration?: number | null;
   @plugins.nosqldb.svDb() public problem?: TStoredAuthorityPreuseProblem;
+  @plugins.nosqldb.svDb() public limit?: IAuthSwitchPreuseLimit;
+  @plugins.nosqldb.svDb() public failure?: IAuthSwitchPreuseFailure;
   @plugins.nosqldb.svDb() public createdAt!: string;
   @plugins.nosqldb.svDb() public updatedAt!: string;
   @plugins.nosqldb.svDb() public finishedAt!: string | null;