@claudexor/cli 3.5.0 → 3.8.0

package/dist/accounts-services.js

@@ -6,12 +6,14 @@ import { noProjectRepoRoot } from "@claudexor/util";
 import { validateModel } from "@claudexor/core";
 import { withQuotaAvailability } from "@claudexor/schema";
 import { vendorVerifiedProfileStatus } from "@claudexor/orchestrator";
-import { harnessAccountsProjection, profileAccountProjection } from "./accounts-projection.js";
-import { buildGateway, harnessModels } from "./registry.js";
+import { accountPoolsProjection, profileAccountProjection } from "./accounts-projection.js";
+import { buildGateway, buildRegistry, harnessModels } from "./registry.js";
 import { delegationCapabilityFor } from "./delegation-capability.js";
+import { effectiveSetupLoginCapability } from "./setup-login-capability.js";
 const NO_PROJECT_ROOT = noProjectRepoRoot();
 export async function projectHarnessStatuses(statuses) {
     const cfg = loadConfig(NO_PROJECT_ROOT);
+    const adapters = buildRegistry({ includeFakes: false });
     return Promise.all(statuses.map(async (status) => {
         const configured = cfg.global.harnesses[status.id]?.default_model ?? null;
         let check = null;
@@ -24,6 +26,9 @@ export async function projectHarnessStatuses(statuses) {
             configuredModel: configured,
             configuredModelCheck: check,
             delegation: delegationCapabilityFor(status.manifest),
+            setupLogin: await effectiveSetupLoginCapability(status.id, {
+                getAdapter: (id) => adapters.get(id),
+            }),
             readiness: normalizeReadiness({
                 checks: status.checks,
                 authSources: status.authSources,
@@ -35,11 +40,13 @@ export async function projectHarnessStatuses(statuses) {
 }
 /** One server-owned Accounts response builder. The opt-in form refreshes quota
  * first and then derives next_up from that exact returned response; no client
- * can accidentally pair a newer quota card with an older routing identity. */
+ * can accidentally pair a newer quota card with an older routing identity.
+ * Returns the listing service plus the pool-authority read
+ * (`GET /v2/account-pools`) so both share one cached projection. */
 export function createCredentialProfilesService(quotaRegistry) {
     const projectProfiles = () => {
         const profiles = loadConfig(NO_PROJECT_ROOT).global.credential_profiles;
-        return Promise.all(profiles.map(profileAccountProjection));
+        return Promise.all(profiles.map((profile) => profileAccountProjection(profile, profiles)));
     };
     // The plain (non-snapshot) form is the UI's poll target: without a cache it
     // ran a doctor probe per registered profile plus a full harness sweep
@@ -53,7 +60,10 @@ export function createCredentialProfilesService(quotaRegistry) {
         const out = withVendorVerification(await projectProfiles(), quota);
         return {
             profiles: out,
-            harnessAccounts: await harnessAccountsProjection(NO_PROJECT_ROOT, quota.snapshots, {
+            // Unified account model: the legacy carrier stays PRESENT and empty for
+            // strict old clients; routing facts ride accountPools.
+            harnessAccounts: [],
+            accountPools: await accountPoolsProjection(NO_PROJECT_ROOT, quota.snapshots, {
                 profiles: out,
             }),
         };
@@ -61,7 +71,7 @@ export function createCredentialProfilesService(quotaRegistry) {
     const pollCache = new StatusProjectionCache({
         versionOf: globalConfigVersion,
     });
-    return async (input) => {
+    const credentialProfiles = async (input) => {
         if (input?.snapshot === true) {
             const [probed, accountStatuses, git, fencedQuota] = await Promise.all([
                 projectProfiles(),
@@ -73,7 +83,6 @@ export function createCredentialProfilesService(quotaRegistry) {
                 quotaRegistry().refreshWithCursor(),
             ]);
             const statuses = accountStatuses.map((receipt) => receipt.status);
-            const accountIdentities = new Map(accountStatuses.map((receipt) => [receipt.status.id, receipt.identity]));
             const rawQuota = fencedQuota.response;
             const out = withVendorVerification(probed, rawQuota);
             // The explicit refresh proved the live state — drop the stale poll
@@ -82,10 +91,10 @@ export function createCredentialProfilesService(quotaRegistry) {
             pollCache.invalidate();
             return {
                 profiles: out,
-                harnessAccounts: await harnessAccountsProjection(NO_PROJECT_ROOT, rawQuota.snapshots, {
+                harnessAccounts: [],
+                accountPools: await accountPoolsProjection(NO_PROJECT_ROOT, rawQuota.snapshots, {
                     profiles: out,
                     statuses,
-                    accountIdentities,
                 }),
                 harnesses: await projectHarnessStatuses(statuses),
                 git,
@@ -95,6 +104,10 @@ export function createCredentialProfilesService(quotaRegistry) {
         }
         return pollCache.read(buildPollResponse);
     };
+    const accountPools = async () => ({
+        accountPools: (await pollCache.read(buildPollResponse)).accountPools,
+    });
+    return { credentialProfiles, accountPools };
 }
 /**
  * Replace each profile's LOCAL verification verdict with the vendor's, wherever

package/dist/accounts-services.js.map

@@ -1 +1 @@
-{"version":3,"file":"accounts-services.js","sourceRoot":"","sources":["../src/accounts-services.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAsB,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAOhD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAErE,MAAM,eAAe,GAAG,iBAAiB,EAAE,CAAC;AAQ5C,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAkC;IAC7E,MAAM,GAAG,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC,GAAG,CAChB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,aAAa,IAAI,IAAI,CAAC;QAC1E,IAAI,KAAK,GAAkE,IAAI,CAAC;QAChF,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;YACpE,KAAK,GAAG,aAAa,CACnB,UAAU,EACV,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EACrC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAC5C,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,MAAM;YACT,eAAe,EAAE,UAAU;YAC3B,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC;YACpD,SAAS,EAAE,kBAAkB,CAAC;gBAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,eAAe,EAAE,UAAU;gBAC3B,oBAAoB,EAAE,KAAK;aAC5B,CAAC;SACH,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;8EAE8E;AAC9E,MAAM,UAAU,+BAA+B,CAAC,aAAkC;IAChF,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;QACxE,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC;IACF,4EAA4E;IAC5E,sEAAsE;IACtE,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,MAAM,iBAAiB,GAAG,KAAK,IAAI,EAAE;QACnC,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,sBAAsB,CAAC,MAAM,eAAe,EAAE,EAAE,KAAK,CAAC,CAAC;QACnE,OAAO;YACL,QAAQ,EAAE,GAAG;YACb,eAAe,EAAE,MAAM,yBAAyB,CAAC,eAAe,EAAE,KAAK,CAAC,SAAS,EAAE;gBACjF,QAAQ,EAAE,GAAG;aACd,CAAC;SACH,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,qBAAqB,CAAgD;QACzF,SAAS,EAAE,mBAAmB;KAC/B,CAAC,CAAC;IACH,OAAO,KAAK,EAAE,KAA8B,EAAE,EAAE;QAC9C,IAAI,KAAK,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACpE,eAAe,EAAE;gBACjB,YAAY,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,oBAAoB,CAAC;oBACzD,GAAG,EAAE,eAAe;oBACpB,KAAK,EAAE,IAAI;iBACZ,CAAC;gBACF,kBAAkB,EAAE;gBACpB,aAAa,EAAE,CAAC,iBAAiB,EAAE;aACpC,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAClE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAU,CAAC,CACjF,CAAC;YACF,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;YACtC,MAAM,GAAG,GAAG,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrD,mEAAmE;YACnE,wEAAwE;YACxE,yEAAyE;YACzE,SAAS,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO;gBACL,QAAQ,EAAE,GAAG;gBACb,eAAe,EAAE,MAAM,yBAAyB,CAAC,eAAe,EAAE,QAAQ,CAAC,SAAS,EAAE;oBACpF,QAAQ,EAAE,GAAG;oBACb,QAAQ;oBACR,iBAAiB;iBAClB,CAAC;gBACF,SAAS,EAAE,MAAM,sBAAsB,CAAC,QAAQ,CAAC;gBACjD,GAAG;gBACH,KAAK,EAAE,qBAAqB,CAAC,QAAQ,CAAC;gBACtC,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;aAC/C,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC3C,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAG7B,OAAY,EACZ,KAAiF;IAEjF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7B,GAAG,KAAK;QACR,MAAM,EAAE,2BAA2B,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC;KACzD,CAAC,CAAC,CAAC;AACN,CAAC"}
+{"version":3,"file":"accounts-services.js","sourceRoot":"","sources":["../src/accounts-services.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAsB,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAOhD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAC5F,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAE5E,MAAM,eAAe,GAAG,iBAAiB,EAAE,CAAC;AAQ5C,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAkC;IAC7E,MAAM,GAAG,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,OAAO,OAAO,CAAC,GAAG,CAChB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,aAAa,IAAI,IAAI,CAAC;QAC1E,IAAI,KAAK,GAAkE,IAAI,CAAC;QAChF,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;YACpE,KAAK,GAAG,aAAa,CACnB,UAAU,EACV,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EACrC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAC5C,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,MAAM;YACT,eAAe,EAAE,UAAU;YAC3B,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC;YACpD,UAAU,EAAE,MAAM,6BAA6B,CAAC,MAAM,CAAC,EAAE,EAAE;gBACzD,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;aACrC,CAAC;YACF,SAAS,EAAE,kBAAkB,CAAC;gBAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,eAAe,EAAE,UAAU;gBAC3B,oBAAoB,EAAE,KAAK;aAC5B,CAAC;SACH,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;oEAIoE;AACpE,MAAM,UAAU,+BAA+B,CAAC,aAAkC;IAChF,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;QACxE,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC,CAAC;IACF,4EAA4E;IAC5E,sEAAsE;IACtE,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,MAAM,iBAAiB,GAAG,KAAK,IAAI,EAAE;QACnC,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,sBAAsB,CAAC,MAAM,eAAe,EAAE,EAAE,KAAK,CAAC,CAAC;QACnE,OAAO;YACL,QAAQ,EAAE,GAAG;YACb,wEAAwE;YACxE,uDAAuD;YACvD,eAAe,EAAE,EAAE;YACnB,YAAY,EAAE,MAAM,sBAAsB,CAAC,eAAe,EAAE,KAAK,CAAC,SAAS,EAAE;gBAC3E,QAAQ,EAAE,GAAG;aACd,CAAC;SACH,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,qBAAqB,CAAgD;QACzF,SAAS,EAAE,mBAAmB;KAC/B,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,KAAK,EAAE,KAA8B,EAAE,EAAE;QAClE,IAAI,KAAK,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACpE,eAAe,EAAE;gBACjB,YAAY,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,oBAAoB,CAAC;oBACzD,GAAG,EAAE,eAAe;oBACpB,KAAK,EAAE,IAAI;iBACZ,CAAC;gBACF,kBAAkB,EAAE;gBACpB,aAAa,EAAE,CAAC,iBAAiB,EAAE;aACpC,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAClE,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;YACtC,MAAM,GAAG,GAAG,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrD,mEAAmE;YACnE,wEAAwE;YACxE,yEAAyE;YACzE,SAAS,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO;gBACL,QAAQ,EAAE,GAAG;gBACb,eAAe,EAAE,EAAE;gBACnB,YAAY,EAAE,MAAM,sBAAsB,CAAC,eAAe,EAAE,QAAQ,CAAC,SAAS,EAAE;oBAC9E,QAAQ,EAAE,GAAG;oBACb,QAAQ;iBACT,CAAC;gBACF,SAAS,EAAE,MAAM,sBAAsB,CAAC,QAAQ,CAAC;gBACjD,GAAG;gBACH,KAAK,EAAE,qBAAqB,CAAC,QAAQ,CAAC;gBACtC,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;aAC/C,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC3C,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC;QAChC,YAAY,EAAE,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,YAAY;KACrE,CAAC,CAAC;IACH,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAG7B,OAAY,EACZ,KAAiF;IAEjF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7B,GAAG,KAAK;QACR,MAAM,EAAE,2BAA2B,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC;KACzD,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/accounts-unified-migration.d.ts

@@ -0,0 +1,110 @@
+import type { AccountsUnifiedMigrationFile } from "@claudexor/schema";
+/** The harnesses whose legacy default stores auto-register (cursor's host
+ * Keychain login is deliberately NOT migrated — owner decision D-U3: host
+ * logins disappear; new cursor logins are ordinary isolated file-store rows). */
+export declare const ACCOUNTS_MIGRATION_HARNESSES: readonly ["claude", "codex"];
+export type AccountsMigrationHarness = (typeof ACCOUNTS_MIGRATION_HARNESSES)[number];
+export declare function accountsMigrationFilePath(): string;
+/** Lenient read for projection/mutation consumers: any unreadable state reads
+ * as "no records" (those surfaces fail safe on their own rules). The RUN GATE
+ * and the migration itself use the strict variant below — a corrupt phase
+ * file must fail CLOSED there, never silently pass runs against unknown
+ * migration state or overwrite the evidence with a fresh reservation. */
+export declare function readAccountsMigrationFile(): AccountsUnifiedMigrationFile;
+/** ENOENT/ENOTDIR = honestly no record ({}); anything else — an unreadable
+ * file, a JSON parse failure, a schema violation — THROWS a typed error so
+ * the gate and the migration fail closed instead of treating corrupt state
+ * as absent. */
+export declare function readAccountsMigrationFileStrict(): AccountsUnifiedMigrationFile;
+/**
+ * The daemon startup wrapper: run (or crash-resume) the migration, invalidate
+ * status projections when anything changed, and NEVER crash startup — a
+ * failed pass leaves the phase file mid-state, the affected harness refuses
+ * runs typed (accountsMigrationGate), and the next start resumes the
+ * remaining phases.
+ */
+export declare function runStartupAccountsMigration(threads: AccountsMigrationStores["threads"], quota: AccountsMigrationStores["quota"] & {
+    noteCredentialChange(): void;
+}, log: (message: string) => void): void;
+/** Retire one harness's migration record (its row was deleted with its
+ * material, so a later start detects no legacy login and fabricates nothing). */
+export declare function removeAccountsMigrationRecord(harnessId: string): void;
+/**
+ * Typed per-harness run refusal while this harness's migration is incomplete
+ * (plan §L.3): a crash between phases must not let runs route against
+ * half-migrated continuity state. Complete (or absent) records never block.
+ */
+export declare function accountsMigrationGate(harnessId: string): {
+    reason: string;
+} | null;
+/** The harness's exact Claudexor-owned default native store dir, or null for
+ * harnesses without one (D-U3: cursor has no default store; agy is named-only). */
+export declare function defaultNativeStoreLocator(harnessId: string): string | null;
+/**
+ * The ONE structural "this row IS the harness's default native store" rule,
+ * shared by the delete fence and the `native_credentials_enabled` downgrade
+ * mirror: true when the locator resolves to the harness's exact
+ * defaultNative*Dir() — the same rule the startup migration matches rows by.
+ * Bootstrap rows (ensureBootstrapProfile) sit at this locator BEFORE any
+ * migration record exists, so record presence must never be the only key.
+ */
+export declare function locatorIsDefaultNativeStore(harnessId: string, locator: string | null | undefined): boolean;
+/** The stores the migration mutates, injected so tests drive temp roots. */
+export interface AccountsMigrationStores {
+    threads: {
+        migrateNullProfileContinuity(harnessId: string, rowId: string): {
+            sessions: number;
+            checkpoints: number;
+            skippedPartitions: string[];
+        };
+        rollbackProfileContinuity(harnessId: string, rowId: string): {
+            sessions: number;
+            checkpoints: number;
+            skippedPartitions: string[];
+        };
+        listThreads(): Array<{
+            repo?: {
+                root: string;
+            } | null;
+        }>;
+    };
+    quota: {
+        removeSubject(harness: string, subjectId: string | null): number;
+    };
+    log?: (message: string) => void;
+}
+export interface AccountsMigrationReceipt {
+    harness_id: string;
+    row_id: string;
+    outcome: "migrated" | "resumed" | "already_completed";
+    sessions: number;
+    checkpoints: number;
+    lanes: number;
+    skipped_partitions: string[];
+}
+/**
+ * Run (or crash-resume) the unified-accounts migration for every harness with
+ * a detected legacy login. Idempotent: the second and later starts find
+ * completed records (or nothing to detect) and mutate nothing (§K.6 case 6).
+ */
+export declare function runAccountsUnifiedMigration(stores: AccountsMigrationStores): AccountsMigrationReceipt[];
+export interface AccountsRollbackReceipt {
+    harness_id: string;
+    row_id: string;
+    sessions: number;
+    checkpoints: number;
+    lanes: number;
+    skipped_partitions: string[];
+}
+/**
+ * The supported downgrade path (run BEFORE installing 3.5.0): surgically
+ * reverses every migration phase — sessions/checkpoints/lane homes return to
+ * the null engine-default keys, the auto-registered row leaves the registry
+ * (its `enabled` state returns to the `native_credentials_enabled` mirror),
+ * the row's quota subject retires, and the harness's migration record is
+ * removed so a later new-engine start re-migrates cleanly. The pre-migration
+ * config backup (`backup_ref`) stays on disk as manual-recovery evidence.
+ * Credential bytes were never moved, so nothing is copied back.
+ */
+export declare function rollbackAccountsUnifiedMigration(stores: AccountsMigrationStores, harnessId?: string): AccountsRollbackReceipt[];
+//# sourceMappingURL=accounts-unified-migration.d.ts.map

package/dist/accounts-unified-migration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts-unified-migration.d.ts","sourceRoot":"","sources":["../src/accounts-unified-migration.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAEV,4BAA4B,EAE7B,MAAM,mBAAmB,CAAC;AAM3B;;iFAEiF;AACjF,eAAO,MAAM,4BAA4B,YAAI,QAAQ,EAAE,OAAO,CAAU,CAAC;AACzE,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC;AAErF,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED;;;;yEAIyE;AACzE,wBAAgB,yBAAyB,IAAI,4BAA4B,CAMxE;AAED;;;gBAGgB;AAChB,wBAAgB,+BAA+B,IAAI,4BAA4B,CAyB9E;AAUD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,uBAAuB,CAAC,SAAS,CAAC,EAC3C,KAAK,EAAE,uBAAuB,CAAC,OAAO,CAAC,GAAG;IAAE,oBAAoB,IAAI,IAAI,CAAA;CAAE,EAC1E,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC7B,IAAI,CAaN;AAED;iFACiF;AACjF,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAKrE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAwBlF;AAyCD;mFACmF;AACnF,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI1E;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACjC,OAAO,CAGT;AA8BD,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE;QACP,4BAA4B,CAC1B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,iBAAiB,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;QAC1E,yBAAyB,CACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,iBAAiB,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;QAC1E,WAAW,IAAI,KAAK,CAAC;YAAE,IAAI,CAAC,EAAE;gBAAE,IAAI,EAAE,MAAM,CAAA;aAAE,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;KAC1D,CAAC;IACF,KAAK,EAAE;QAAE,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAA;KAAE,CAAC;IAC5E,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAgBD,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,UAAU,GAAG,SAAS,GAAG,mBAAmB,CAAC;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,uBAAuB,GAC9B,wBAAwB,EAAE,CA8F5B;AA8BD,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,uBAAuB,EAC/B,SAAS,CAAC,EAAE,MAAM,GACjB,uBAAuB,EAAE,CAyD3B"}

package/dist/accounts-unified-migration.js

@@ -0,0 +1,422 @@
+/**
+ * Unified-accounts startup migration (INV-135 rewrite, plan §L.3).
+ *
+ * At daemon start, a DETECTED legacy default-store login (claude/codex) is
+ * auto-registered as an ordinary registry row — reserved machine id
+ * `claude-default` / `codex-default`, locator = the existing Claudexor-owned
+ * native dir, bytes never move — and the null engine-default subject's
+ * continuity state (thread sessions, lane checkpoints, durable lane homes)
+ * migrates onto that row id as ONE unit (INV-137). Progress is a
+ * crash-recoverable per-harness state machine persisted OUTSIDE config.yaml
+ * (`<config>/migration/accounts-unified.json`; a downgraded 3.5.0 engine never
+ * reads it): `reserved → registry_written → continuity_migrated → completed`,
+ * every phase restart-idempotent. While a harness's record is incomplete, that
+ * harness's runs refuse typed (`accountsMigrationGate`) — other harnesses keep
+ * working. `rollbackAccountsUnifiedMigration` is the supported downgrade
+ * path's first step: it surgically reverses every phase (run it BEFORE
+ * installing an engine whose canonicalizers refuse the native locator).
+ */
+import { copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+import { loadConfig, updateGlobalConfig } from "@claudexor/config";
+import { normalizeThroughExistingAncestor } from "@claudexor/core";
+import { claudeAccountIdentity, defaultNativeClaudeConfigDir } from "@claudexor/harness-claude";
+import { codexAccountIdentity, defaultNativeCodexHome } from "@claudexor/harness-codex";
+import { AccountsUnifiedMigrationFile as MigrationFileSchema } from "@claudexor/schema";
+import { migrateDefaultLanes, rollbackProfileLanes } from "@claudexor/workspace";
+import { invalidateStatusProjections } from "./status-projection-cache.js";
+import { noProjectRepoRoot, nowIso, userConfigDir } from "@claudexor/util";
+/** The harnesses whose legacy default stores auto-register (cursor's host
+ * Keychain login is deliberately NOT migrated — owner decision D-U3: host
+ * logins disappear; new cursor logins are ordinary isolated file-store rows). */
+export const ACCOUNTS_MIGRATION_HARNESSES = ["claude", "codex"];
+export function accountsMigrationFilePath() {
+    return join(userConfigDir(), "migration", "accounts-unified.json");
+}
+/** Lenient read for projection/mutation consumers: any unreadable state reads
+ * as "no records" (those surfaces fail safe on their own rules). The RUN GATE
+ * and the migration itself use the strict variant below — a corrupt phase
+ * file must fail CLOSED there, never silently pass runs against unknown
+ * migration state or overwrite the evidence with a fresh reservation. */
+export function readAccountsMigrationFile() {
+    try {
+        return readAccountsMigrationFileStrict();
+    }
+    catch {
+        return {};
+    }
+}
+/** ENOENT/ENOTDIR = honestly no record ({}); anything else — an unreadable
+ * file, a JSON parse failure, a schema violation — THROWS a typed error so
+ * the gate and the migration fail closed instead of treating corrupt state
+ * as absent. */
+export function readAccountsMigrationFileStrict() {
+    const path = accountsMigrationFilePath();
+    let raw;
+    try {
+        raw = readFileSync(path, "utf8");
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT" || code === "ENOTDIR")
+            return {};
+        throw Object.assign(new Error(`unified-accounts migration record ${path} is unreadable (${code ?? "io_error"})`), { code: "accounts_migration_record_unreadable" });
+    }
+    try {
+        return MigrationFileSchema.parse(JSON.parse(raw));
+    }
+    catch (error) {
+        throw Object.assign(new Error(`unified-accounts migration record ${path} is corrupt: ${error instanceof Error ? error.message : String(error)}; fix or remove the file before runs of migrated harnesses can proceed`), { code: "accounts_migration_record_unreadable" });
+    }
+}
+function writeAccountsMigrationFile(file) {
+    const path = accountsMigrationFilePath();
+    mkdirSync(join(path, ".."), { recursive: true, mode: 0o700 });
+    const tmp = `${path}.tmp.${process.pid}`;
+    writeFileSync(tmp, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
+    renameSync(tmp, path);
+}
+/**
+ * The daemon startup wrapper: run (or crash-resume) the migration, invalidate
+ * status projections when anything changed, and NEVER crash startup — a
+ * failed pass leaves the phase file mid-state, the affected harness refuses
+ * runs typed (accountsMigrationGate), and the next start resumes the
+ * remaining phases.
+ */
+export function runStartupAccountsMigration(threads, quota, log) {
+    try {
+        if (runAccountsUnifiedMigration({ threads, quota, log }).length > 0) {
+            invalidateStatusProjections();
+            quota.noteCredentialChange();
+        }
+    }
+    catch (error) {
+        log(`unified-accounts migration pass failed (will resume on the next start): ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+/** Retire one harness's migration record (its row was deleted with its
+ * material, so a later start detects no legacy login and fabricates nothing). */
+export function removeAccountsMigrationRecord(harnessId) {
+    const file = { ...readAccountsMigrationFile() };
+    if (!(harnessId in file))
+        return;
+    delete file[harnessId];
+    writeAccountsMigrationFile(file);
+}
+/**
+ * Typed per-harness run refusal while this harness's migration is incomplete
+ * (plan §L.3): a crash between phases must not let runs route against
+ * half-migrated continuity state. Complete (or absent) records never block.
+ */
+export function accountsMigrationGate(harnessId) {
+    let record;
+    try {
+        record = readAccountsMigrationFileStrict()[harnessId];
+    }
+    catch (error) {
+        // A CORRUPT phase file fails the gate CLOSED: runs must not route
+        // against unknown migration state (an absent file passes above via the
+        // strict reader's ENOENT branch).
+        return { reason: error instanceof Error ? error.message : String(error) };
+    }
+    if (!record || record.phase === "completed")
+        return null;
+    if (record.phase === "rolling_back") {
+        return {
+            reason: `${harnessId} is blocked by an interrupted unified-accounts rollback; ` +
+                `re-run the rollback command (\`claudexor accounts-migration-rollback\`) to finish it`,
+        };
+    }
+    return {
+        reason: `${harnessId} is blocked by an incomplete unified-accounts migration ` +
+            `(phase: ${record.phase}); restart the daemon (\`claudexor daemon stop\`, then any command) ` +
+            `to finish it, or roll it back (\`claudexor accounts-migration-rollback\`)`,
+    };
+}
+/** Only ACTUALLY DETECTED logins register — an empty default store writes no
+ * record and fabricates no row (§K.6 case 1). */
+function detectLegacyLogin(harnessId) {
+    if (harnessId === "claude") {
+        const dir = defaultNativeClaudeConfigDir();
+        const identity = claudeAccountIdentity(dir);
+        // macOS keeps the token in the Keychain (identity in .claude.json);
+        // Linux/Windows keep .credentials.json in the dir. Either proves a login.
+        if (identity === null && !existsSync(join(dir, ".credentials.json")))
+            return null;
+        return { locator: dir, displayName: identity?.email ?? null };
+    }
+    const home = defaultNativeCodexHome();
+    try {
+        const parsed = JSON.parse(readFileSync(join(home, "auth.json"), "utf8"));
+        // Only a subscription login migrates; an api-key auth.json can not exist
+        // in the native store (ensureCodexApiAuth refuses to write it there).
+        if (parsed.auth_mode !== "chatgpt")
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return { locator: home, displayName: codexAccountIdentity(home)?.email ?? null };
+}
+function sameLocator(a, b) {
+    if (!a)
+        return false;
+    try {
+        return normalizeThroughExistingAncestor(a) === normalizeThroughExistingAncestor(b);
+    }
+    catch {
+        return a === b;
+    }
+}
+/** The harness's exact Claudexor-owned default native store dir, or null for
+ * harnesses without one (D-U3: cursor has no default store; agy is named-only). */
+export function defaultNativeStoreLocator(harnessId) {
+    if (harnessId === "claude")
+        return defaultNativeClaudeConfigDir();
+    if (harnessId === "codex")
+        return defaultNativeCodexHome();
+    return null;
+}
+/**
+ * The ONE structural "this row IS the harness's default native store" rule,
+ * shared by the delete fence and the `native_credentials_enabled` downgrade
+ * mirror: true when the locator resolves to the harness's exact
+ * defaultNative*Dir() — the same rule the startup migration matches rows by.
+ * Bootstrap rows (ensureBootstrapProfile) sit at this locator BEFORE any
+ * migration record exists, so record presence must never be the only key.
+ */
+export function locatorIsDefaultNativeStore(harnessId, locator) {
+    const native = defaultNativeStoreLocator(harnessId);
+    return native !== null && sameLocator(locator, native);
+}
+/** Reserved machine id (§L.3): `<harness>-default`, deterministic `-2`, `-3`…
+ * suffix on collision. CROSS-HARNESS unique — the wire's scalar
+ * `credentialProfileId` must never match rows of two harnesses. */
+function reserveRowId(registry, harnessId) {
+    const base = `${harnessId}-default`;
+    let candidate = base;
+    for (let i = 2; registry.some((p) => p.profile_id === candidate); i += 1) {
+        candidate = `${base}-${i}`;
+    }
+    return candidate;
+}
+function backupConfig(harnessId) {
+    try {
+        const source = join(userConfigDir(), "config.yaml");
+        if (!existsSync(source))
+            return null;
+        const dir = join(userConfigDir(), "migration", `backup-${harnessId}-${Date.now()}`);
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        copyFileSync(source, join(dir, "config.yaml"));
+        return dir;
+    }
+    catch {
+        // Fail-soft: the backup is the manual-recovery half of the downgrade
+        // path; the supported rollback command reverses phases surgically and
+        // does not depend on it. A null backup_ref is disclosed in the record.
+        return null;
+    }
+}
+function laneRootsOf(stores) {
+    const roots = new Set([noProjectRepoRoot()]);
+    try {
+        for (const thread of stores.threads.listThreads()) {
+            if (thread.repo?.root)
+                roots.add(thread.repo.root);
+        }
+    }
+    catch {
+        /* listing failure bounds the rename to the no-project root; sessions are
+         * already migrated by the journal step, so an unrenamed lane degrades to
+         * a fresh session with the standard continuity disclosure */
+    }
+    return [...roots];
+}
+/**
+ * Run (or crash-resume) the unified-accounts migration for every harness with
+ * a detected legacy login. Idempotent: the second and later starts find
+ * completed records (or nothing to detect) and mutate nothing (§K.6 case 6).
+ */
+export function runAccountsUnifiedMigration(stores) {
+    const receipts = [];
+    for (const harnessId of ACCOUNTS_MIGRATION_HARNESSES) {
+        // STRICT read: a corrupt phase file must never be treated as "no record"
+        // here — a fresh reservation would overwrite the crash evidence. The
+        // throw is caught by runStartupAccountsMigration; the run gate keeps the
+        // affected harnesses refusing typed until the file is fixed or removed.
+        const file = readAccountsMigrationFileStrict();
+        let record = file[harnessId];
+        const resumed = record !== undefined && record.phase !== "completed";
+        if (record?.phase === "completed")
+            continue;
+        if (record?.phase === "rolling_back") {
+            // An interrupted ROLLBACK never resumes forward — re-running the
+            // rollback command finishes it; the run gate names that instruction.
+            stores.log?.(`unified-accounts migration: ${harnessId} has an interrupted rollback; ` +
+                `re-run \`claudexor accounts-migration-rollback\` to finish it`);
+            continue;
+        }
+        if (record?.phase === "reserved" && detectLegacyLogin(harnessId) === null) {
+            // Crash-resume of a RESERVED record whose login has since vanished:
+            // the reserved phase mutated nothing but the record itself, and
+            // registering a row now would fabricate a cold account for a login
+            // that no longer exists. Skip (and clear the record) — logged.
+            const remaining = { ...file };
+            delete remaining[harnessId];
+            writeAccountsMigrationFile(remaining);
+            stores.log?.(`unified-accounts migration skipped: ${harnessId} reserved row "${record.row_id}" ` +
+                `has no detectable legacy login anymore; the reservation was cleared`);
+            continue;
+        }
+        if (!record) {
+            const detected = detectLegacyLogin(harnessId);
+            if (!detected)
+                continue;
+            const registry = loadConfig(noProjectRepoRoot()).global.credential_profiles;
+            const sameLocatorRow = registry.find((p) => p.harness_id === harnessId && sameLocator(p.isolation_locator, detected.locator));
+            // Phase RESERVED: id + backup persisted BEFORE any mutation, so a crash
+            // can never re-reserve a different id (§K.3). A row already registered
+            // at this exact locator is reused as-is (D-U2 no-op reuse).
+            record = {
+                phase: "reserved",
+                row_id: sameLocatorRow?.profile_id ?? reserveRowId(registry, harnessId),
+                legacy_aliases: [null],
+                locator: detected.locator,
+                backup_ref: backupConfig(harnessId),
+            };
+            writeAccountsMigrationFile({ ...file, [harnessId]: record });
+        }
+        const rowId = record.row_id;
+        if (record.phase === "reserved") {
+            registerMigratedRow(harnessId, record);
+            record = { ...record, phase: "registry_written" };
+            writeAccountsMigrationFile({ ...readAccountsMigrationFileStrict(), [harnessId]: record });
+        }
+        let continuity = { sessions: 0, checkpoints: 0, skippedPartitions: [] };
+        let lanes = 0;
+        if (record.phase === "registry_written") {
+            continuity = stores.threads.migrateNullProfileContinuity(harnessId, rowId);
+            for (const root of laneRootsOf(stores))
+                lanes += migrateDefaultLanes(root, harnessId, rowId);
+            record = { ...record, phase: "continuity_migrated" };
+            writeAccountsMigrationFile({ ...readAccountsMigrationFileStrict(), [harnessId]: record });
+        }
+        if (record.phase === "continuity_migrated") {
+            // No replay alias (§K.3): the legacy null subject is retired here; the
+            // new row's subject refreshes fresh on the next quota cycle.
+            stores.quota.removeSubject(harnessId, null);
+            record = { ...record, phase: "completed" };
+            writeAccountsMigrationFile({ ...readAccountsMigrationFileStrict(), [harnessId]: record });
+        }
+        const receipt = {
+            harness_id: harnessId,
+            row_id: rowId,
+            outcome: resumed ? "resumed" : "migrated",
+            sessions: continuity.sessions,
+            checkpoints: continuity.checkpoints,
+            lanes,
+            skipped_partitions: continuity.skippedPartitions,
+        };
+        receipts.push(receipt);
+        stores.log?.(`unified-accounts migration ${receipt.outcome}: ${harnessId} → row "${rowId}" ` +
+            `(${receipt.sessions} sessions, ${receipt.checkpoints} checkpoints, ${receipt.lanes} lane homes` +
+            (receipt.skipped_partitions.length > 0
+                ? `; SKIPPED quarantined partition(s) ${receipt.skipped_partitions.join(", ")} — their sessions migrate after recovery`
+                : "") +
+            `)`);
+    }
+    return receipts;
+}
+/** Phase REGISTRY_WRITTEN's one locked config write. Idempotent: an existing
+ * (harness, row_id) row — or a row already holding the locator — is adopted
+ * untouched; `native_credentials_enabled=false` maps to `enabled=false`
+ * (the deprecated key stays in config as the downgrade-window mirror). */
+function registerMigratedRow(harnessId, record) {
+    const detected = detectLegacyLogin(harnessId);
+    updateGlobalConfig((config) => {
+        const existing = config.credential_profiles.find((p) => (p.harness_id === harnessId && p.profile_id === record.row_id) ||
+            (p.harness_id === harnessId && sameLocator(p.isolation_locator, record.locator)));
+        if (existing)
+            return config;
+        const nativeEnabled = config.harnesses[harnessId]?.native_credentials_enabled !== false;
+        const entry = {
+            profile_id: record.row_id,
+            harness_id: harnessId,
+            display_name: detected?.displayName ?? `${harnessId} default login`,
+            credential_kind: "config_dir_login",
+            isolation_locator: record.locator,
+            secret_ref: null,
+            enabled: nativeEnabled,
+            created_at: nowIso(),
+        };
+        return { ...config, credential_profiles: [...config.credential_profiles, entry] };
+    });
+}
+/**
+ * The supported downgrade path (run BEFORE installing 3.5.0): surgically
+ * reverses every migration phase — sessions/checkpoints/lane homes return to
+ * the null engine-default keys, the auto-registered row leaves the registry
+ * (its `enabled` state returns to the `native_credentials_enabled` mirror),
+ * the row's quota subject retires, and the harness's migration record is
+ * removed so a later new-engine start re-migrates cleanly. The pre-migration
+ * config backup (`backup_ref`) stays on disk as manual-recovery evidence.
+ * Credential bytes were never moved, so nothing is copied back.
+ */
+export function rollbackAccountsUnifiedMigration(stores, harnessId) {
+    const receipts = [];
+    const targets = harnessId ? [harnessId] : Object.keys(readAccountsMigrationFileStrict());
+    for (const target of targets) {
+        const file = readAccountsMigrationFileStrict();
+        const record = file[target];
+        if (!record)
+            continue;
+        const rowId = record.row_id;
+        // Phase ROLLING_BACK persists BEFORE the first reverse step: a crash
+        // mid-rollback must not leave a record whose phase claims a completed
+        // forward migration while continuity is half-reversed. The startup
+        // migration never resumes a rolling_back record forward; every reverse
+        // step below is idempotent, so re-running this command finishes the job.
+        if (record.phase !== "rolling_back") {
+            writeAccountsMigrationFile({ ...file, [target]: { ...record, phase: "rolling_back" } });
+        }
+        const continuity = stores.threads.rollbackProfileContinuity(target, rowId);
+        let lanes = 0;
+        for (const root of laneRootsOf(stores))
+            lanes += rollbackProfileLanes(root, target, rowId);
+        stores.quota.removeSubject(target, rowId);
+        updateGlobalConfig((config) => {
+            const row = config.credential_profiles.find((p) => p.harness_id === target && p.profile_id === rowId);
+            // Only the row this migration created leaves the registry — matched by
+            // the record's exact locator, so a later hand-registered same-id row
+            // pointing elsewhere is never silently deleted.
+            if (!row || !sameLocator(row.isolation_locator, record.locator))
+                return config;
+            return {
+                ...config,
+                harnesses: {
+                    ...config.harnesses,
+                    [target]: {
+                        ...config.harnesses[target],
+                        native_credentials_enabled: row.enabled,
+                    },
+                },
+                credential_profiles: config.credential_profiles.filter((p) => p !== row),
+            };
+        });
+        const remaining = { ...readAccountsMigrationFileStrict() };
+        delete remaining[target];
+        writeAccountsMigrationFile(remaining);
+        receipts.push({
+            harness_id: target,
+            row_id: rowId,
+            sessions: continuity.sessions,
+            checkpoints: continuity.checkpoints,
+            lanes,
+            skipped_partitions: continuity.skippedPartitions,
+        });
+        stores.log?.(`unified-accounts migration ROLLED BACK: ${target} row "${rowId}" ` +
+            `(${continuity.sessions} sessions, ${continuity.checkpoints} checkpoints, ${lanes} lane homes returned to the engine-default keys)`);
+    }
+    return receipts;
+}
+//# sourceMappingURL=accounts-unified-migration.js.map