@modelprofile.com/authswitch 9.2.0 → 10.0.0

package/ts/classes.authoritypreuse.ts

@@ -1,4 +1,5 @@
 import * as plugins from './plugins.js';
+import type { IOpenAiAccess } from './interfaces.openai.js';
 import type { IAuthSwitchPreuseOperation } from './authority-contract.js';
 import { AuthSwitchRefusal } from './authority-contract.js';
 import { AuthSwitchAuthorityBroker } from './classes.authoritybroker.js';
@@ -6,10 +7,10 @@ import { AuthSwitchAuthorityDatabase } from './classes.authoritydatabase.js';
 import type { IStoredAuthorityPreuseOperation, TStoredAuthorityPreuseProblem } from './classes.authoritymodels.js';
 import { CodexPreuse, type ICodexPreuseLifecycle } from './classes.codexpreuse.js';
 import type { IHarnessPreuseOptions, IHarnessPreuseResult } from './interfaces.harness.js';
-import { validatePreuseOptions } from './preuse.js';
+import { PreuseFailureError, PreuseLimitError, validatePreuseOptions } from './preuse.js';
 
 export interface IAuthSwitchAuthorityPreuseExecutor {
-  runAccess(credential: plugins.flexAccounts.IOpenAiChatGptAccessCredential,
+  runAccess(access: IOpenAiAccess,
     options: IHarnessPreuseOptions, lifecycle: ICodexPreuseLifecycle): Promise<IHarnessPreuseResult>;
 }
 
@@ -41,7 +42,8 @@ const hash = (value: unknown): value is string => typeof value === 'string' && /
 const publicOperation = (operation: IStoredAuthorityPreuseOperation): IAuthSwitchPreuseOperation => ({
   id: operation.id, accountId: operation.accountId, loginId: operation.grantId,
   purpose: operation.purpose, requestedModel: operation.requestedModel, model: operation.model,
-  state: operation.state, result: operation.result, problem: operation.problem,
+  state: operation.state, result: operation.result, problem: operation.problem, limit: operation.limit ?? null,
+  failure: operation.failure ?? null,
   createdAt: operation.createdAt, updatedAt: operation.updatedAt,
   finishedAt: operation.finishedAt, revision: operation.revision,
 });
@@ -204,11 +206,8 @@ export class AuthSwitchAuthorityPreuse {
       const access = await this.broker.resolveUsageAccess(context, undefined, this.minAccessValidityMs);
       signal.throwIfAborted();
       phase = operation.requestedModel === null ? 'catalog' : 'access';
-      const credential: plugins.flexAccounts.IOpenAiChatGptAccessCredential = {
-        kind: 'chatgptAccess', providerId: 'openai', accessToken: access.accessToken,
-        accountId: access.accountId, isFedrampAccount: access.isFedrampAccount,
-      };
-      const result = await this.executor.runAccess(credential,
+      const result = await this.executor.runAccess({ accessToken: access.accessToken,
+        accountId: access.accountId, isFedrampAccount: access.isFedrampAccount },
         { prompt, ...(operation.requestedModel === null ? {} : { model: operation.requestedModel }), signal },
         { beforeRequest: async model => {
           signal.throwIfAborted();
@@ -224,26 +223,40 @@ export class AuthSwitchAuthorityPreuse {
         state: 'complete', result: { inputTokens: count(result.inputTokens), outputTokens: count(result.outputTokens),
           totalTokens: count(result.totalTokens) }, problem: 'none', updatedAt: now, finishedAt: now,
         revision: prior.revision + 1, updateId }));
-    } catch {
-      await this.fail(operation.id, phase, signal);
+    } catch (error) {
+      await this.fail(operation.id, phase, signal,
+        error instanceof PreuseLimitError || error instanceof PreuseFailureError ? error : null);
     }
   }
 
-  private async fail(operationId: string, phase: 'target' | 'access' | 'catalog', signal: AbortSignal): Promise<void> {
+  /**
+   * Settles a preuse that did not complete. A limit is named: the account's usage reading stopped it before
+   * anything was sent, or the provider refused the prompt -- before its answer began, which consumed nothing and
+   * settles `refused`, or during it, which stays `outcome_unknown`. Any other stated cause of a sent request is
+   * named as its `failure`.
+   */
+  private async fail(operationId: string, phase: 'target' | 'access' | 'catalog', signal: AbortSignal,
+    stated: PreuseLimitError | PreuseFailureError | null): Promise<void> {
     let current: IStoredAuthorityPreuseOperation;
     try { current = await this.readStored(operationId); }
     catch { return; }
     if (!['preparing', 'request_may_have_started'].includes(current.state)) return;
     const marked = current.state === 'request_may_have_started';
-    const problem: TStoredAuthorityPreuseProblem = marked
-      ? this.closed ? 'authority_closing' : signal.aborted ? 'cancelled' : 'request_uncertain'
-      : this.closed ? 'authority_closing' : signal.aborted ? 'cancelled'
-        : phase === 'target' ? 'target_unavailable' : phase === 'catalog' ? 'catalog_unavailable' : 'access_unavailable';
+    const stopped = this.closed ? 'authority_closing' : signal.aborted ? 'cancelled' : null;
+    const limit = stopped === null && stated instanceof PreuseLimitError && (stated.source === 'provider') === marked
+      ? stated : null;
+    const failure = stopped === null && marked && stated instanceof PreuseFailureError ? stated.failure : null;
+    const problem: TStoredAuthorityPreuseProblem = stopped ?? (limit ? limit.limit.kind
+      : marked ? 'request_uncertain'
+        : phase === 'target' ? 'target_unavailable' : phase === 'catalog' ? 'catalog_unavailable' : 'access_unavailable');
+    const state: IStoredAuthorityPreuseOperation['state'] = !marked ? 'not_sent'
+      : limit && !limit.generationStarted ? 'refused' : 'outcome_unknown';
     const updateId = plugins.crypto.randomUUID();
     const now = new Date(this.now()).toISOString();
     try {
-      await this.database.changePreuseOperation(updateId, operationId, prior => ({ ...prior,
-        state: marked ? 'outcome_unknown' : 'not_sent', problem,
+      await this.database.changePreuseOperation(updateId, operationId, prior => ({ ...prior, state, problem,
+        ...(limit ? { limit: { ...limit.limit } } : {}),
+        ...(failure ? { failure: { ...failure } } : {}),
         updatedAt: now, finishedAt: now, revision: prior.revision + 1, updateId }));
     } catch { /* A durable request marker remains recoverable as outcome_unknown on restart. */ }
   }

package/ts/classes.authorityusage.ts

@@ -1,9 +1,10 @@
 import * as plugins from './plugins.js';
+import type { AuthSwitchOpenAiProvider } from './classes.openaiprovider.js';
+import type { IOpenAiAccountRateLimits, IOpenAiRateLimitDetails, IOpenAiRateLimitWindow } from './interfaces.openai.js';
 import type { IClaudeLogin, IClaudeStatusRead } from './classes.claudestatus.js';
 import type { IHarnessAccountStatus } from './interfaces.harness.js';
 
-type TRateLimits = plugins.flexAccounts.ISmartAiProviderAccountRateLimits;
-type TAccessCredential = plugins.flexAccounts.IOpenAiChatGptAccessCredential;
+type TRateLimits = IOpenAiAccountRateLimits;
 
 export type TAuthSwitchUsageProblem =
   | 'none' | 'unsupported' | 'access_unavailable' | 'provider_unavailable'
@@ -115,7 +116,7 @@ export interface IAuthSwitchAuthorityUsageOptions {
     action: (source: { context: IAuthSwitchUsageContext; login: IClaudeLogin;
       readContext(): Promise<IAuthSwitchUsageContext | null> }) => Promise<IAuthSwitchUsageSnapshot>): Promise<IAuthSwitchUsageSnapshot>;
   store: IAuthSwitchUsageStore;
-  provider: Pick<plugins.flexAccounts.ISmartAiProviderAdapter, 'getAccountRateLimits'>;
+  provider: Pick<AuthSwitchOpenAiProvider, 'getAccountRateLimits'>;
   now?: () => number;
   currentMaxAgeMs?: number;
   maxStaleAgeMs?: number;
@@ -199,11 +200,11 @@ const publicClaudeStatus = (source: IHarnessAccountStatus): IAuthSwitchClaudeSta
 
 /** Allowlist the provider projection before it enters a management DTO or stored usage record. */
 const publicRateLimits = (source: TRateLimits): TRateLimits => {
-  const window = (value: plugins.flexAccounts.ISmartAiProviderRateLimitWindow) => ({
+  const window = (value: IOpenAiRateLimitWindow) => ({
     usedPercent: value.usedPercent, limitWindowSeconds: value.limitWindowSeconds,
     resetAfterSeconds: value.resetAfterSeconds, resetsAt: value.resetsAt,
   });
-  const detail = (value: plugins.flexAccounts.ISmartAiProviderRateLimitDetails) => ({
+  const detail = (value: IOpenAiRateLimitDetails) => ({
     allowed: value.allowed, limitReached: value.limitReached,
     ...(value.primaryWindow ? { primaryWindow: window(value.primaryWindow) } : {}),
     ...(value.secondaryWindow ? { secondaryWindow: window(value.secondaryWindow) } : {}),
@@ -511,10 +512,8 @@ export class AuthSwitchAuthorityUsage {
   }
 
   private query(access: IAuthSwitchUsageAccess): ReturnType<IAuthSwitchAuthorityUsageOptions['provider']['getAccountRateLimits']> {
-    const credential: TAccessCredential = { kind: 'chatgptAccess', providerId: 'openai',
-      accessToken: access.accessToken, accountId: access.accountId,
-      isFedrampAccount: access.isFedrampAccount };
-    return this.options.provider.getAccountRateLimits(credential, { timeoutMs: this.policy.providerTimeoutMs });
+    return this.options.provider.getAccountRateLimits({ accessToken: access.accessToken, accountId: access.accountId,
+      isFedrampAccount: access.isFedrampAccount }, { timeoutMs: this.policy.providerTimeoutMs });
   }
 
   /** Wait for admitted reads before the daemon disposes the shared provider or database. */

package/ts/classes.cli.ts

@@ -372,11 +372,11 @@ ${bold('Environment')}
     const cancel = () => { cancelled = true; void handle?.cancel().catch(() => undefined); };
     process.on('SIGINT', cancel); process.on('SIGTERM', cancel);
     try {
-      handle = await harness.beginLogin({ providerId: provider.providerId, flow: provider.flows.includes('device') ? 'device' : provider.flows[0] });
+      handle = await harness.beginLogin({ providerId: provider.providerId, flow: 'device' });
       if (cancelled) await handle.cancel();
-      else if (handle.prompt.flow === 'device') {
+      else {
         process.stdout.write(`Open ${plainText(handle.prompt.verificationUrl)}\nCode: ${plainText(handle.prompt.userCode)}\nWaiting for login. Press Ctrl+C to cancel.\n`);
-      } else process.stdout.write(`Open ${plainText(handle.prompt.authUrl)}\nWaiting for login. Press Ctrl+C to cancel.\n`);
+      }
       return this.reportOutcome((await handle.completion).outcome);
     } finally {
       process.removeListener('SIGINT', cancel); process.removeListener('SIGTERM', cancel);

package/ts/classes.codexpreuse.ts

@@ -1,7 +1,44 @@
 import * as plugins from './plugins.js';
 import type { ICodexIdentity } from './interfaces.js';
 import type { IHarnessPreuseOptions, IHarnessPreuseResult } from './interfaces.harness.js';
-import { PreuseError, validatePreuseOptions } from './preuse.js';
+import { PreuseError, PreuseFailureError, PreuseLimitError, preuseMayHaveConsumed, validatePreuseOptions,
+  type IPreuseLimit } from './preuse.js';
+import { parseOpenAiTokenClaims } from './openaiauth.js';
+import { OpenAiBackendError, readOpenAiAccountUsage, type IOpenAiAccountUsage } from './openaiusage.js';
+import { usageWindowPeriod } from './accounts.js';
+import type { IOpenAiAccess } from './interfaces.openai.js';
+
+const PREUSE_TIMEOUT_MS = 180_000;
+
+/**
+ * The limit the account's own usage reading says is reached, or null. Every window at its limit must reset
+ * before a prompt can pass, so the one that resets last is named.
+ */
+const reachedLimit = (usage: IOpenAiAccountUsage): IPreuseLimit | null => {
+  const limit = usage.rateLimits.rateLimit;
+  if (!limit || (limit.allowed && !limit.limitReached)) return null;
+  const exhausted = [limit.primaryWindow, limit.secondaryWindow]
+    .filter(window => window !== undefined && window.usedPercent >= 100)
+    .sort((left, right) => right!.resetsAt - left!.resetsAt)[0];
+  return { kind: 'usage_limit', window: exhausted ? usageWindowPeriod(exhausted.limitWindowSeconds) : null,
+    resetsAt: exhausted ? new Date(exhausted.resetsAt * 1000).toISOString() : null };
+};
+
+/** A FlexHarness limit window label (`7d`, `5h`, `90m`) as a window name; a slot name says nothing about length. */
+const windowName = (label: string | undefined): string | null => {
+  const match = /^([1-9][0-9]{0,5})([mhd])$/.exec(label ?? '');
+  return match ? usageWindowPeriod(Number(match[1]) * { m: 60, h: 3600, d: 86400 }[match[2] as 'm' | 'h' | 'd']) : null;
+};
+
+/** The first error in a cause chain that matches, so a wrapped failure is still told by its own class. */
+const inChain = <T>(error: unknown, match: (value: unknown) => value is T): T | undefined => {
+  let current = error;
+  for (let depth = 0; depth < 8 && current !== undefined && current !== null; depth++) {
+    if (match(current)) return current;
+    current = current instanceof Error ? current.cause : undefined;
+  }
+  return undefined;
+};
 
 export interface ICodexPreuseLifecycle {
   /** Persist the may-have-started marker before the inference API is invoked. */
@@ -16,67 +53,65 @@ export class CodexPreuse {
     validatePreuseOptions(optionsArg);
     if (identityArg.kind !== 'chatgpt') throw new PreuseError('Codex preuse requires a ChatGPT subscription login; API-key logins have no subscription reset window.');
     if (!identityArg.accountId) throw new PreuseError('This login has no account ID for preuse.');
-    let credentials: plugins.flexAuth.IOpenAiChatGptAuthCredentials;
-    let oauth: plugins.flexAccounts.IOpenAiChatGptOAuthCredential;
+    let access: IOpenAiAccess;
     try {
       const tokens = JSON.parse(rawArg).tokens;
-      oauth = { kind: 'chatgptOAuth', providerId: 'openai', accessToken: tokens.access_token, refreshToken: tokens.refresh_token, idToken: tokens.id_token };
-      credentials = plugins.flexAccounts.toOpenAiChatGptAuthCredentials(oauth);
-      if (credentials.accountId !== identityArg.accountId) throw new Error('Identity mismatch');
+      const claims = parseOpenAiTokenClaims(tokens.id_token);
+      if (typeof tokens.access_token !== 'string' || !tokens.access_token
+        || claims.chatgptAccountId !== identityArg.accountId) throw new Error('Identity mismatch');
+      access = { accessToken: tokens.access_token, accountId: claims.chatgptAccountId,
+        isFedrampAccount: claims.chatgptAccountIsFedramp };
     } catch {
       throw new PreuseError('No complete, matching Codex login is available for preuse. Log in again with Codex and save the account.');
     }
-    return this.runCredential(oauth, credentials, optionsArg);
+    return this.runWithAccess(access, optionsArg);
   }
 
   /** Authority-owned access grants contain no refresh token and are never serialized by this helper. */
-  public async runAccess(credentialArg: plugins.flexAccounts.IOpenAiChatGptAccessCredential,
-    optionsArg: IHarnessPreuseOptions, lifecycleArg: ICodexPreuseLifecycle): Promise<IHarnessPreuseResult> {
+  public async runAccess(accessArg: IOpenAiAccess, optionsArg: IHarnessPreuseOptions,
+    lifecycleArg: ICodexPreuseLifecycle): Promise<IHarnessPreuseResult> {
     validatePreuseOptions(optionsArg);
-    if (!credentialArg || credentialArg.kind !== 'chatgptAccess' || credentialArg.providerId !== 'openai'
-      || typeof credentialArg.accessToken !== 'string' || !credentialArg.accessToken
-      || typeof credentialArg.accountId !== 'string' || !credentialArg.accountId
-      || typeof credentialArg.isFedrampAccount !== 'boolean') {
+    if (!accessArg || typeof accessArg.accessToken !== 'string' || !accessArg.accessToken
+      || typeof accessArg.accountId !== 'string' || !accessArg.accountId
+      || typeof accessArg.isFedrampAccount !== 'boolean') {
       throw new PreuseError('No complete, matching Codex login is available for preuse. Log in again with Codex and save the account.');
     }
-    return this.runCredential(credentialArg, {
-      accessToken: credentialArg.accessToken, accountId: credentialArg.accountId,
-      isFedrampAccount: credentialArg.isFedrampAccount,
-    }, optionsArg, lifecycleArg);
+    return this.runWithAccess({ accessToken: accessArg.accessToken, accountId: accessArg.accountId,
+      isFedrampAccount: accessArg.isFedrampAccount }, optionsArg, lifecycleArg);
   }
 
-  private async runCredential(readCredentialArg: plugins.flexAccounts.TOpenAiChatGptReadCredential,
-    credentialsArg: plugins.flexAuth.IOpenAiChatGptAuthCredentials, optionsArg: IHarnessPreuseOptions,
+  private async runWithAccess(accessArg: IOpenAiAccess, optionsArg: IHarnessPreuseOptions,
     lifecycleArg?: ICodexPreuseLifecycle): Promise<IHarnessPreuseResult> {
-    const signal = optionsArg.signal
-      ? AbortSignal.any([optionsArg.signal, AbortSignal.timeout(180_000)])
-      : AbortSignal.timeout(180_000);
+    const timeout = AbortSignal.timeout(PREUSE_TIMEOUT_MS);
+    const signal = optionsArg.signal ? AbortSignal.any([optionsArg.signal, timeout]) : timeout;
+    await this.refuseReachedLimit(accessArg, signal);
     let model = optionsArg.model;
     let reasoningEffort: string | undefined;
     if (!model) {
-      const adapter = new plugins.flexAccounts.OpenAiProviderAdapter({ fetch: this.fetcher });
       try {
-        const catalog = await adapter.listModels(readCredentialArg, { signal, timeoutMs: 10_000 });
-        if (!catalog.success) throw new PreuseError(catalog.errorCode === 'CREDENTIAL_REFRESH_REQUIRED'
-          ? 'The saved login has expired. Log in again with Codex and save it before preuse.'
-          : 'Could not read the account model catalog. No preuse prompt was sent.');
-        const selected = catalog.models.find(item => item.isDefault && item.inputModalities.includes('text'));
+        const catalog = await plugins.flexOpenAi.listOpenAiChatGptModels(accessArg,
+          { signal: AbortSignal.any([signal, AbortSignal.timeout(10_000)]), fetch: this.fetcher });
+        const selected = catalog.find(item => item.isDefault && item.inputModalities.includes('text'));
         if (!selected) throw new PreuseError('The account catalog has no default text model. Specify --model explicitly.');
         model = selected.wireModel;
         reasoningEffort = ['none', 'minimal', 'low'].find(effort => selected.reasoningEfforts.some(item => item.effort === effort)) ?? selected.defaultReasoningEffort;
       } catch (error) {
         if (error instanceof PreuseError) throw error;
-        throw new PreuseError('Could not read the account model catalog. No preuse prompt was sent.');
-      } finally { await adapter.dispose(); }
+        throw new PreuseError(error instanceof plugins.flexOpenAi.OpenAiChatGptAuthError && error.status === 401
+          ? 'The saved login has expired. Log in again with Codex and save it before preuse.'
+          : 'Could not read the account model catalog. No preuse prompt was sent.');
+      }
     }
-    let requestStarted = false;
+    let phase: 'connecting' | 'marking' | 'sent' = 'connecting';
+    // The provider has begun to answer once the stream's first step starts; a refusal before that consumed nothing.
+    let generationStarted = false;
     try {
       signal.throwIfAborted();
-      const connection = plugins.flexAuth.createOpenAiChatGptModelConnection(credentialsArg);
-      connection.settings.fetch = this.fetcher;
+      const connection = plugins.flexOpenAi.createOpenAiChatGptAccessModelConnection(accessArg, { fetch: this.fetcher });
       const languageModel = plugins.flexOpenAi.createOpenAiModelProvider().getModel({ provider: 'openai', model, connection });
+      phase = 'marking';
       await lifecycleArg?.beforeRequest(model);
-      requestStarted = true;
+      phase = 'sent';
       const stream = plugins.flexModels.streamText({
         model: languageModel,
         instructions: 'Answer the user prompt with plain text. Do not use tools.',
@@ -89,16 +124,71 @@ export class CodexPreuse {
       });
       // Drain the stream; generated prose is neither printed nor persisted.
       for await (const part of stream.fullStream) {
-        if (part.type === 'error' || part.type === 'abort') throw new Error('Inference did not complete');
+        if (part.type === 'start-step') generationStarted = true;
+        if (part.type === 'error') throw part.error;
+        if (part.type === 'abort') throw signal.reason;
       }
       const [finishReason, usage] = await Promise.all([stream.finishReason, stream.totalUsage]);
-      if (finishReason !== 'stop' && finishReason !== 'length') throw new Error('Inference did not complete');
+      if (finishReason !== 'stop' && finishReason !== 'length') {
+        throw new PreuseError(`Preuse did not complete: the answer ended with finish reason ${/^[a-z-]{1,32}$/.test(finishReason) ? finishReason : 'unknown'}. ${preuseMayHaveConsumed}`, true);
+      }
       const count = (value: number | undefined) => Number.isSafeInteger(value) && value! >= 0 ? value : undefined;
       return { model, inputTokens: count(usage.inputTokens), outputTokens: count(usage.outputTokens), totalTokens: count(usage.totalTokens) };
-    } catch {
-      throw new PreuseError(requestStarted
-        ? 'Preuse did not complete. Tokens may already have been consumed; no automatic retry was made. Check the account status before trying again.'
-        : 'Preuse was cancelled before the prompt was sent.', requestStarted);
+    } catch (error) {
+      if (error instanceof PreuseError) throw error;
+      throw this.failure(error, phase, generationStarted, optionsArg.signal, timeout);
+    }
+  }
+
+  /**
+   * Reads the account's usage before anything is sent, and refuses when a limit is reached: a prompt then only
+   * meets the provider's refusal. A reading that fails decides nothing -- the prompt is sent, and a limit the
+   * provider states instead is reported by name -- except a rejected token, which no prompt would pass either.
+   */
+  private async refuseReachedLimit(accessArg: IOpenAiAccess, signalArg: AbortSignal): Promise<void> {
+    let usage: IOpenAiAccountUsage;
+    try {
+      usage = await readOpenAiAccountUsage(accessArg, { fetch: this.fetcher, signal: signalArg });
+    } catch (error) {
+      if (signalArg.aborted) throw new PreuseError('Preuse was cancelled before the prompt was sent.');
+      if (error instanceof OpenAiBackendError && error.reason === 'unauthorized') {
+        throw new PreuseError('The saved login has expired. Log in again with Codex and save it before preuse.');
+      }
+      return;
+    }
+    const limit = reachedLimit(usage);
+    if (limit) throw new PreuseLimitError(limit, 'usage', false, Date.now());
+  }
+
+  /**
+   * Names why a started preuse failed, without the provider's text: a limit, a rejected token, a deadline, a cancellation,
+   * or the cause FlexHarness describes (an HTTP status, a stream error and its code, a failed connection).
+   */
+  private failure(errorArg: unknown, phaseArg: 'connecting' | 'marking' | 'sent', generationStartedArg: boolean,
+    callerSignalArg: AbortSignal | undefined, timeoutArg: AbortSignal): PreuseError {
+    if (phaseArg !== 'sent') {
+      return new PreuseError(callerSignalArg?.aborted ? 'Preuse was cancelled before the prompt was sent.'
+        : timeoutArg.aborted ? `Preuse stopped before the prompt was sent: ${PREUSE_TIMEOUT_MS / 1000} seconds passed.`
+        : phaseArg === 'marking' ? 'Preuse stopped before the prompt was sent: its request could not be recorded as started.'
+          : 'Preuse stopped before the prompt was sent: the model connection could not be prepared.');
+    }
+    if (callerSignalArg?.aborted) return new PreuseError(`Preuse was cancelled after the prompt was sent. ${preuseMayHaveConsumed}`, true);
+    if (timeoutArg.aborted) {
+      return new PreuseError(`Preuse did not complete: no answer within ${PREUSE_TIMEOUT_MS / 1000} seconds. ${preuseMayHaveConsumed}`, true);
+    }
+    const described = plugins.flexModels.describeModelFailure(errorArg);
+    if (described.kind === 'limit' && described.limit) {
+      return new PreuseLimitError({ kind: described.limit.kind, window: windowName(described.limit.window),
+        resetsAt: described.limit.resetsAt === undefined ? null : new Date(described.limit.resetsAt).toISOString() },
+      'provider', generationStartedArg, Date.now());
+    }
+    const auth = inChain(errorArg, (value): value is InstanceType<typeof plugins.flexOpenAi.OpenAiChatGptAuthError> =>
+      value instanceof plugins.flexOpenAi.OpenAiChatGptAuthError);
+    if (auth?.status === 401 && !generationStartedArg) {
+      return new PreuseError('The provider rejected the access token before answering; no tokens were consumed. '
+        + 'Log in again with Codex and save the account before preuse.', true);
     }
+    return new PreuseFailureError({ kind: described.kind === 'limit' ? 'unknown' : described.kind,
+      status: described.status ?? null, providerCode: described.providerCode ?? null });
   }
 }

package/ts/classes.codexstatus.ts

@@ -1,6 +1,7 @@
 import type { ICodexIdentity } from './interfaces.js';
 import type { IHarnessAccountStatus, IHarnessStatusOptions, IHarnessStatusSummary } from './interfaces.harness.js';
-import { commitinfo } from './00_commitinfo_data.js';
+import { OpenAiBackendError, projectOpenAiAccountUsage, readChatGptBackend } from './openaiusage.js';
+import type { IOpenAiRateLimitDetails } from './interfaces.openai.js';
 import { usageWindowPeriod } from './accounts.js';
 import { latestRetryAt, retryAtFrom } from './ratelimit.js';
 
@@ -23,7 +24,6 @@ const boolean = (valueArg: unknown): boolean => {
   if (typeof valueArg !== 'boolean') throw new Error('Unexpected boolean status field.');
   return valueArg;
 };
-const timestamp = (secondsArg: unknown): string => new Date(numeric(secondsArg) * 1000).toISOString();
 const count = (valueArg: unknown): number => {
   const value = numeric(valueArg);
   if (!Number.isSafeInteger(value)) throw new Error('Invalid status count.');
@@ -106,43 +106,26 @@ export class CodexAccountStatus {
   }
 
   private async get(pathArg: string, tokenArg: string, accountIdArg: string, cancelArg?: AbortSignal): Promise<Record<string, unknown>> {
-    const timeout = AbortSignal.timeout(10_000);
-    const signal = cancelArg ? AbortSignal.any([cancelArg, timeout]) : timeout;
+    const billing = pathArg === 'accounts/check/v4-2023-04-27';
     try {
-      const response = await this.fetcher(`https://chatgpt.com/backend-api/${pathArg}`, {
-        method: 'GET', redirect: 'error', signal,
-        headers: { Authorization: `Bearer ${tokenArg}`, 'ChatGPT-Account-ID': accountIdArg,
-          'User-Agent': `authswitch/${commitinfo.version}`, Accept: 'application/json',
-          ...(pathArg === 'accounts/check/v4-2023-04-27' ? { originator: 'Codex Desktop', 'OAI-Language': 'en', 'User-Agent': billingUserAgent } : {}) },
+      return await readChatGptBackend(pathArg, { accessToken: tokenArg, accountId: accountIdArg, isFedrampAccount: false }, {
+        fetch: this.fetcher, signal: cancelArg,
+        ...(billing ? { originator: 'Codex Desktop', headers: { 'OAI-Language': 'en', 'User-Agent': billingUserAgent } } : {}),
       });
-      if (!response.ok) {
-        await response.body?.cancel();
-        if (response.headers.get('cf-mitigated') === 'challenge') throw new StatusRequestError('Blocked by a service verification challenge (Cloudflare); this lookup is unavailable to the current HTTP client.');
-        if (response.status === 429) throw new StatusRateLimitError(retryAtFrom(response.headers.get('retry-after'), this.now()));
-        if (response.status === 401) throw new StatusRequestError('Login expired or was rejected. Log in again with the account’s harness, then save the account.');
-        if (response.status === 403) throw new StatusRequestError('Access denied by the service (HTTP 403).');
-        throw new StatusRequestError(`Service returned HTTP ${response.status}.`);
-      }
-      const reader = response.body?.getReader();
-      if (!reader) throw new StatusRequestError('The service returned an empty response.');
-      const chunks: Uint8Array[] = [];
-      let size = 0;
-      try {
-        while (true) {
-          const part = await reader.read();
-          if (part.done) break;
-          size += part.value.byteLength;
-          if (size > 1024 * 1024) { await reader.cancel(); throw new StatusRequestError('The status response is too large.'); }
-          chunks.push(part.value);
-        }
-      } finally { reader.releaseLock(); }
-      try { return record(JSON.parse(Buffer.concat(chunks).toString('utf8'))); }
-      catch { throw new StatusRequestError('The service returned invalid status data.'); }
     } catch (errorArg) {
       // Never surface remote bodies, request headers, token strings or arbitrary fetch errors.
-      if (signal.aborted) throw new Error(timeout.aborted ? 'The status request timed out.' : 'The status request was cancelled.');
-      if (errorArg instanceof StatusRequestError) throw errorArg;
-      throw new Error('The status service could not be reached.');
+      if (!(errorArg instanceof OpenAiBackendError)) throw new Error('The status service could not be reached.');
+      switch (errorArg.reason) {
+        case 'challenge': throw new StatusRequestError('Blocked by a service verification challenge (Cloudflare); this lookup is unavailable to the current HTTP client.');
+        case 'rate_limited': throw new StatusRateLimitError(retryAtFrom(errorArg.retryAfter, this.now()));
+        case 'unauthorized': throw new StatusRequestError('Login expired or was rejected. Log in again with the account’s harness, then save the account.');
+        case 'forbidden': throw new StatusRequestError('Access denied by the service (HTTP 403).');
+        case 'http': throw new StatusRequestError(`Service returned HTTP ${errorArg.status}.`);
+        case 'protocol': throw new StatusRequestError('The service returned invalid or oversized status data.');
+        case 'timeout': throw new Error('The status request timed out.');
+        case 'aborted': throw new Error('The status request was cancelled.');
+        case 'network': throw new Error('The status service could not be reached.');
+      }
     }
   }
 
@@ -178,27 +161,22 @@ export class CodexAccountStatus {
   }
 
   private limits(bodyArg: Record<string, unknown>, accountIdArg: string): Pick<IHarnessAccountStatus, 'facts' | 'summary'> {
-    if (bodyArg.account_id != null && bodyArg.account_id !== accountIdArg) throw new Error('Account mismatch.');
-    const plan = text(bodyArg.plan_type);
+    const usage = projectOpenAiAccountUsage(bodyArg, new Date(this.now()).toISOString());
+    if (usage.accountId !== null && usage.accountId !== accountIdArg) throw new Error('Account mismatch.');
+    const plan = usage.rateLimits.plan;
     const facts: IHarnessAccountStatus['facts'] = [{ section: 'Subscription', summaryKey: 'subscription', label: 'Subscription plan', value: `${plan} (live)` }];
     const usageWindows: NonNullable<IHarnessStatusSummary['usageWindows']> = [];
     const summary: IHarnessStatusSummary = { subscription: { plan, source: 'live' }, usageWindows };
-    const appendLimit = (nameArg: string, valueArg: unknown, scopeArg: 'account' | 'feature') => {
-      if (valueArg == null) return;
-      const limit = record(valueArg);
+    const appendLimit = (nameArg: string, limitArg: IOpenAiRateLimitDetails | undefined, scopeArg: 'account' | 'feature') => {
+      if (!limitArg) return;
       // The service's own reading of the same windows, so a view that shows the windows need not repeat it.
-      facts.push({ section: 'Limits & credits', summaryKey: 'usageWindows', label: `${nameArg} usage allowed`, value: boolean(limit.allowed) ? 'yes' : 'no' });
-      facts.push({ section: 'Limits & credits', summaryKey: 'usageWindows', label: `${nameArg} limit reached`, value: boolean(limit.limit_reached) ? 'yes' : 'no' });
+      facts.push({ section: 'Limits & credits', summaryKey: 'usageWindows', label: `${nameArg} usage allowed`, value: limitArg.allowed ? 'yes' : 'no' });
+      facts.push({ section: 'Limits & credits', summaryKey: 'usageWindows', label: `${nameArg} limit reached`, value: limitArg.limitReached ? 'yes' : 'no' });
       // Both slots are read before either is named: only a second window of the same length makes the
       // vendor's slot worth showing, and that is decided from the pair.
-      const windows = (['primary_window', 'secondary_window'] as const).flatMap((slotArg) => {
-        if (limit[slotArg] == null) return [];
-        const window = record(limit[slotArg]);
-        return [{
-          slot: slotArg === 'primary_window' ? 'primary' : 'secondary',
-          usedPercent: numeric(window.used_percent), durationSeconds: numeric(window.limit_window_seconds), resetAt: timestamp(window.reset_at),
-        }];
-      });
+      const windows = ([['primary', limitArg.primaryWindow], ['secondary', limitArg.secondaryWindow]] as const)
+        .flatMap(([slot, window]) => window ? [{ slot, usedPercent: window.usedPercent,
+          durationSeconds: window.limitWindowSeconds, resetAt: new Date(window.resetsAt * 1000).toISOString() }] : []);
       for (const window of windows) {
         // Named by its length, as Codex names its own windows: a slot carries no length, and which
         // window the service puts in it varies by plan and by which limit is currently binding.
@@ -208,31 +186,20 @@ export class CodexAccountStatus {
         facts.push({ section: 'Usage', summaryKey: 'usageWindows', label, value: `${window.usedPercent}% used, ${Math.max(0, 100 - window.usedPercent)}% remaining; resets ${window.resetAt}` });
       }
     };
-    appendLimit('Codex', bodyArg.rate_limit, 'account');
-    if (bodyArg.additional_rate_limits != null) {
-      if (!Array.isArray(bodyArg.additional_rate_limits)) throw new Error('Invalid additional limits.');
-      for (const value of bodyArg.additional_rate_limits) {
-        const limit = record(value);
-        appendLimit(text(limit.limit_name), limit.rate_limit, 'feature');
-      }
-    }
-    if (bodyArg.credits != null) {
-      const credits = record(bodyArg.credits);
-      const unlimited = boolean(credits.unlimited);
-      const hasCredits = boolean(credits.has_credits);
-      facts.push({ section: 'Limits & credits', label: 'Credits', value: unlimited ? 'unlimited' : credits.balance != null ? text(credits.balance) : hasCredits ? 'available (balance not returned)' : 'none available' });
+    appendLimit('Codex', usage.rateLimits.rateLimit, 'account');
+    for (const limit of usage.rateLimits.additionalRateLimits) appendLimit(limit.limitName, limit.rateLimit, 'feature');
+    if (usage.credits) {
+      const credits = usage.credits;
+      facts.push({ section: 'Limits & credits', label: 'Credits', value: credits.unlimited ? 'unlimited' : credits.balance !== undefined ? credits.balance : credits.hasCredits ? 'available (balance not returned)' : 'none available' });
     }
-    if (bodyArg.spend_control != null) {
-      const spend = record(bodyArg.spend_control);
-      facts.push({ section: 'Limits & credits', label: 'Spend limit reached', value: boolean(spend.reached) ? 'yes' : 'no' });
-      if (spend.individual_limit != null) {
-        const limit = record(spend.individual_limit);
-        facts.push({ section: 'Limits & credits', label: 'Individual spend', value: `${text(limit.used)} used of ${text(limit.limit)}; ${text(limit.remaining)} remaining; resets ${timestamp(limit.reset_at)}` });
-      }
+    if (usage.spendControl) {
+      facts.push({ section: 'Limits & credits', label: 'Spend limit reached', value: usage.spendControl.reached ? 'yes' : 'no' });
+      const limit = usage.spendControl.individualLimit;
+      if (limit) facts.push({ section: 'Limits & credits', label: 'Individual spend', value: `${limit.used} used of ${limit.limit}; ${limit.remaining} remaining; resets ${new Date(limit.resetsAt * 1000).toISOString()}` });
     }
-    if (bodyArg.rate_limit_reached_type != null) facts.push({ section: 'Limits & credits', label: 'Limit state', value: text(record(bodyArg.rate_limit_reached_type).type) });
-    if (bodyArg.rate_limit_reset_credits != null) {
-      summary.resets = { available: count(record(bodyArg.rate_limit_reset_credits).available_count) };
+    if (usage.rateLimits.rateLimitReachedType !== undefined) facts.push({ section: 'Limits & credits', label: 'Limit state', value: usage.rateLimits.rateLimitReachedType });
+    if (usage.rateLimits.rateLimitResetCreditsAvailableCount !== undefined) {
+      summary.resets = { available: usage.rateLimits.rateLimitResetCreditsAvailableCount };
       facts.push({ section: 'Earned resets', summaryKey: 'resets', label: 'Available earned resets', value: String(summary.resets.available) });
     }
     else facts.push({ section: 'Earned resets', summaryKey: 'resets', label: 'Available earned resets', value: 'Not returned by the limits service' });