@modelprofile.com/authswitch 6.2.0 → 6.4.0

package/readme.md

@@ -24,12 +24,47 @@ pnpm install -g @modelprofile.com/authswitch
 
 Node.js 24 or newer is required.
 
+## Authority SDK (new account registry)
+
+The package also exports a typed client for a per-user authswitch authority daemon. Its
+SmartData registry stores account identity separately from sealed refresh grants, runtime
+bindings, Codex enrollment records, and native-handoff and migration journals. A daemon
+owns OpenAI device login, targeted reauthentication, and proactive refresh for grants
+added through this API. Management snapshots and events contain no credentials.
+
+```ts
+import { AuthSwitchClient } from '@modelprofile.com/authswitch/authority-client';
+import { resolveAuthSwitchAuthorityPaths } from '@modelprofile.com/authswitch';
+
+const paths = resolveAuthSwitchAuthorityPaths();
+const client = new AuthSwitchClient(paths.authoritySocketPath, paths.runtimeSocketPath);
+const snapshot = await client.snapshotAll();
+const operation = await client.beginAddOpenAi();
+```
+
+Browser code can import the credential-free DTOs from
+`@modelprofile.com/authswitch/authority-contract`. A backend binds an account to a
+runtime incarnation and keeps the returned capability private. The runtime-only socket
+resolves that binding to a current access token; its directory can be mounted into a
+container without exposing the management socket. Reconnect and reload a snapshot after
+an event gap or daemon restart.
+
+This SDK is additive at this stage. The commands documented below still use the existing
+credential stores. The authority daemon does not import those stores automatically,
+replace their active native sessions, or take over their refresh grants. An active
+Codex/OpenCode native grant remains pending until its owner is idle and an explicit
+handoff verifies the latest native source. Claude Code's own native credential files
+remain vendor-owned; a container setup-token grant is a separate grant under the same
+account. The one-time migration and deletion of authswitch's old stores are separate
+cutover steps.
+
 ## Usage
 
 Run `authswitch`, `authswitch -i`, or `authswitch --interactive` for an interactive guide. Use the arrow keys and
 Enter to switch accounts, save the current login, list accounts and live status, check remote
-control, or remove a saved account. The guide shows the current account and returns
-to the menu after each successful action; choose **Back** in a submenu or **Exit** to finish.
+control, preuse one or all accounts, or remove a saved account. The guide shows the current
+account and returns to the menu after each successful action; choose **Back** in a submenu or
+**Exit** to finish.
 
 Before showing the actions, the guide checks whether the current credential has a
 readable saved copy of its own account. A login without one gets an offer to save it
@@ -62,6 +97,7 @@ authswitch codex use [email]      # activate one; prompts when no email is given
 authswitch opencode use [email] --stop        # stop running OpenCode instances first
 authswitch opencode use [email] --keep-running  # switch without stopping anything
 authswitch codex preuse <email>   # send the default prompt without activating the account
+authswitch codex preuse --all     # the same for every Codex account, one account at a time
 authswitch watch                  # check usage every 2 minutes and switch when an account runs out
 authswitch claude watch --threshold 90 --dry-run  # report what it would switch, for one harness
 authswitch codex current          # print the account currently in use
@@ -381,12 +417,58 @@ to make the first token-consuming request for the next usage window:
 authswitch codex preuse alice@example.com
 authswitch codex preuse alice@example.com --prompt "Write 2000 words about strawberries."
 authswitch codex preuse alice@example.com --model gpt-5.5 --prompt "Describe a strawberry in one sentence."
+authswitch codex preuse --all
+authswitch codex preuse --all --model gpt-5.5
 ```
 
 The default prompt is `Write 2000 words about strawberries.` Without an account,
-an interactive terminal shows an account picker. Scripts must specify an account
-and, when multiple harnesses are registered, the harness. Active and saved
-accounts are supported, including an active login that has not been stashed.
+an interactive terminal shows a picker of the harness's accounts, plus **All
+accounts** when it has more than one and **Back**. Choosing one account runs it
+exactly as naming it would; choosing **All accounts** confirms once and then runs
+as `--all` does, table and exit status included. Scripts must specify an account
+or `--all` and, when multiple harnesses are registered, the harness. Active and
+saved accounts are supported, including an active login that has not been stashed.
+
+`--all` preuses every account the harness lists, active and saved, each exactly
+once -- an active login and its own saved record are one account -- and it cannot
+be combined with an account reference. The accounts run strictly one after
+another, never in parallel, each with one request and no retry, and each one is
+reported as it goes. The run ends with a table and a counts line:
+
+```
+[1/3] Preusing alice@example.com (Codex)…
+Prompt completed with gpt-5.5. Tokens: 19 input, 2711 output, 2730 total.
+[2/3] Preusing bob@example.com (Codex)…
+Prompt completed with gpt-5.5. Tokens: 19 input, 2711 output, 2730 total.
+[3/3] Preusing apikey:9f2 (Codex)…
+Codex preuse requires a ChatGPT subscription login; API-key logins have no subscription reset window.
+
+Preuse results
+┌────────────────────┬───────────┬─────────┬─────────────────────┬──────────────┐
+│ Account            │ Outcome   │ Model   │ Tokens in/out/total │ Next reset   │
+├────────────────────┼───────────┼─────────┼─────────────────────┼──────────────┤
+│ alice@example.com  │ Completed │ gpt-5.5 │ 19/2711/2730        │ 5d 18h 53min │
+│ bob@example.com    │ Completed │ gpt-5.5 │ 19/2711/2730        │ 5d 18h 53min │
+│ apikey:9f2         │ Skipped   │ -       │ -                   │ -            │
+└────────────────────┴───────────┴─────────┴─────────────────────┴──────────────┘
+2 completed, 1 skipped.
+```
+
+`Next reset` is the lead window of the reset schedule read after that account's
+prompt, the same window the single-account reset table lists first. An account
+that sent no prompt has no model, token count or deadline of its own, and says so
+rather than showing a zero. `Skipped` is a refusal the adapter stated before any
+request -- an API-key login, a missing or expired credential, a model catalog
+that could not be read -- so nothing was consumed for it. `Failed` and
+`Interrupted` may both have consumed tokens and are never retried; `Not run` is
+an account the interruption never reached.
+
+The guide (`authswitch`, `authswitch -i`) offers **Preuse an account or all
+accounts (consumes quota)** for a harness that supports it. It asks which account
+or **All accounts**, confirms once and names what the prompt will be sent to, then
+reports exactly as the command line does: one account's reset schedule, or the
+results table for all of them. **Back** or a declined confirmation sends nothing,
+and an account the adapter refuses returns to the menu rather than ending the guide.
 
 Codex inference uses the published FlexHarness models/providers packages and the
 selected ChatGPT login's access token and account ID. It selects the account's
@@ -395,21 +477,25 @@ low reasoning setting when the catalog provides one. API-key logins are rejected
 because they do not have ChatGPT subscription reset windows. Expired credentials
 must be renewed through Codex and saved again.
 
-Each invocation consumes quota and sends at most one inference request. It does
-not watch for resets or schedule future requests. No active login is switched,
+Each invocation consumes quota and sends one inference request per account. It
+does not watch for resets or schedule future requests. No active login is switched,
 credential refreshed or written, app-server restarted, or earned reset consumed.
 The prompt has no tools, files or conversation history. The generated prose is
 drained without being printed or stored; the command reports provider token
 counts and then reads the account's reset schedule. It does not infer that a
 timer started merely from a zero-percent usage reading or a successful response.
 
-Ctrl-C cancels the request. Codex preuse has a three-minute deadline, with a
-ten-second model-catalog limit. Failed or interrupted requests can have consumed
-tokens and are never retried automatically. A completed prompt exits with 0 even
-if the subsequent reset lookup fails, reporting that uncertainty separately;
-inference failure exits with 1, invalid arguments or unsupported harnesses with
-2, and an interrupted prompt with 130. Check `authswitch list` before repeating
-an uncertain request. `--json` remains a list-only option.
+Ctrl-C cancels the request, and in a `--all` run it stops the run before the next
+account starts. Codex preuse has a three-minute deadline, with a ten-second
+model-catalog limit. Failed or interrupted requests can have consumed tokens and
+are never retried automatically. A completed prompt exits with 0 even if the
+subsequent reset lookup fails, reporting that uncertainty separately; inference
+failure exits with 1, invalid arguments or unsupported harnesses with 2, and an
+interrupted prompt with 130. A named single account also exits 1 when it was
+refused, because it is the account the command was asked to preuse; `--all` exits
+0 when every account either completed or was skipped for a stated reason. Check
+`authswitch list` before repeating an uncertain request. `--json` remains a
+list-only option.
 
 ### Watching usage and switching automatically
 
@@ -492,10 +578,18 @@ incrementally through each account's status API, without activating it.
 | `/`, `s`, `S` | Filter the table, cycle its sort column, reverse sorting |
 | `a` / `c` | Save the current login and keep it active / save and clear it |
 | `d` | Remove the selected saved copy, preserving the active login |
+| `p` / `P` | Preuse the selected account / every account of this harness (consumes quota) |
 | `r` / `g` | Refresh status / run harness diagnostics |
 | `q` / Ctrl-C | Close and restore the terminal |
 
-Save, switch and removal actions require confirmation. Confirmations start on
+The preuse keys appear in the key line only for a harness that supports preuse,
+and each run states how many accounts it will consume quota on before it starts.
+The footer follows the run account by account, the activity log keeps each
+account's result, and the table is read again afterwards because the prompts
+moved the usage it shows. Closing the dashboard stops the run before its next
+account.
+
+Save, switch, preuse and removal actions require confirmation. Confirmations start on
 Cancel; use Left/Right or Tab to select the action, then Enter. Switching first
 checks the current credential and offers to save an unsaved login. A declined,
 failed or unverified save prevents switching. Plain character shortcuts remain
@@ -993,7 +1087,15 @@ model identifier and cancellation signal; `IHarnessPreuseResult` returns the
 selected model and optional input/output/total token counts. The adapter owns
 credential selection and inference and must leave the active login unchanged.
 Unsupported adapters reject the command before account selection. Prompt results
-never contain credentials or raw provider responses.
+never contain credentials or raw provider responses. A refusal that sent no
+request must be a `PreuseError` with `requestStarted` false, which is what a run
+over several accounts reports as skipped rather than failed; every other error,
+`PreuseError` or not, is treated as a request that may have consumed tokens.
+`preuseAccounts(harness, accounts, options, report)` is that run: it sends one
+prompt per account in turn, reports a `started` and a `finished` event for each,
+reads the account's reset schedule after a completed prompt, stops before the
+next account once the signal aborts, and returns the per-account results with
+their counts.
 
 Adapters can also return an optional `IHarnessAccountStatus.summary` with a
 subscription plan and its live/stored provenance, labelled usage windows with

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@modelprofile.com/authswitch',
-  version: '6.2.0',
+  version: '6.4.0',
   description: 'Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status'
 }

package/ts/authority-contract.ts

@@ -0,0 +1,109 @@
+import type { ITypedRequest } from '@api.global/typedrequest-interfaces';
+
+/** Credential-free account management contract. Safe to import in browser code. */
+export type TAuthSwitchAccountHealth = 'ready' | 'refreshing' | 'retry_wait' | 'needs_reauth' | 'native' | 'legacy_native_pending' | 'removed';
+
+export interface IAuthSwitchAccount {
+  id: string;
+  providerId: string;
+  label: string;
+  email: string | null;
+  plan: string | null;
+  health: TAuthSwitchAccountHealth;
+  owner: 'daemon' | 'claude_native' | 'legacy_native' | 'none';
+  grantGeneration: number;
+  revision: number;
+  accessExpiresAt: string | null;
+  retryAt: string | null;
+  problem: 'none' | 'provider_unavailable' | 'exchange_uncertain' | 'provider_rejected' | 'native_owner';
+  statusObservedAt: string;
+}
+
+export interface IAuthSwitchBinding {
+  id: string;
+  accountId: string;
+  runtime: 'flex' | 'codex' | 'opencode' | 'claude';
+  scopeId: string;
+  incarnationId: string;
+  revision: number;
+}
+
+export interface IAuthSwitchSnapshot {
+  schemaVersion: 1;
+  epoch: string;
+  revision: number;
+  generatedAt: string;
+  accounts: IAuthSwitchAccount[];
+  bindings: IAuthSwitchBinding[];
+  nextAccountCursor: string | null;
+  nextBindingCursor: string | null;
+}
+
+export interface IAuthSwitchAccountEvent {
+  epoch: string;
+  revision: number;
+  kind: 'account' | 'binding';
+  accountId: string;
+}
+
+export type TAuthSwitchLoginPrompt =
+  | { flow: 'device'; verificationUrl: string; userCode: string }
+  | { flow: 'browser'; authUrl: string };
+
+export interface IAuthSwitchOperation {
+  id: string;
+  state: 'pending' | 'complete' | 'failed' | 'cancelled';
+  prompt: TAuthSwitchLoginPrompt | null;
+  account: IAuthSwitchAccount | null;
+  error: string | null;
+}
+
+export interface IReq_AuthSwitchSnapshot extends ITypedRequest {
+  method: 'authswitch.authority.snapshot';
+  request: { accountAfter?: string; bindingAfter?: string; limit?: number };
+  response: { snapshot: IAuthSwitchSnapshot };
+}
+
+export interface IReq_AuthSwitchEvents extends ITypedRequest {
+  method: 'authswitch.authority.events';
+  request: { epoch: string; afterRevision: number; waitMs: number };
+  response: { epoch: string; revision: number; resyncRequired: boolean; events: IAuthSwitchAccountEvent[] };
+}
+
+export interface IReq_AuthSwitchBeginAdd extends ITypedRequest {
+  method: 'authswitch.authority.add';
+  request: { providerId: 'openai'; flow: 'device' };
+  response: { operation: IAuthSwitchOperation };
+}
+
+export interface IReq_AuthSwitchBeginReauth extends ITypedRequest {
+  method: 'authswitch.authority.reauth';
+  request: { accountId: string; flow: 'device' };
+  response: { operation: IAuthSwitchOperation };
+}
+
+export interface IReq_AuthSwitchGetOperation extends ITypedRequest {
+  method: 'authswitch.authority.operation';
+  request: { operationId: string };
+  response: { operation: IAuthSwitchOperation };
+}
+
+export interface IReq_AuthSwitchCancelOperation extends ITypedRequest {
+  method: 'authswitch.authority.cancel';
+  request: { operationId: string };
+  response: { operation: IAuthSwitchOperation };
+}
+
+export interface IReq_AuthSwitchRenameAccount extends ITypedRequest {
+  method: 'authswitch.authority.rename';
+  request: { accountId: string; expectedRevision: number; label: string };
+  response: { account: IAuthSwitchAccount };
+}
+
+export interface IReq_AuthSwitchRemoveAccount extends ITypedRequest {
+  method: 'authswitch.authority.remove';
+  request: { accountId: string; expectedRevision: number };
+  response: { account: IAuthSwitchAccount };
+}
+
+/** Runtime capability is returned only to trusted backend callers; do not expose this response in a browser API. */

package/ts/authority-runtime-contract.ts

@@ -0,0 +1,27 @@
+import type { ITypedRequest } from '@api.global/typedrequest-interfaces';
+import type { IAuthSwitchBinding } from './authority-contract.js';
+
+/** Backend-only binding operation. The capability must never enter a browser-facing response. */
+export interface IReq_AuthSwitchBindAccount extends ITypedRequest {
+  method: 'authswitch.authority.bind';
+  request: {
+    accountId: string;
+    runtime: IAuthSwitchBinding['runtime'];
+    scopeId: string;
+    incarnationId: string;
+  };
+  response: { binding: IAuthSwitchBinding; capability: string };
+}
+
+/** Backend-only access operation. Refresh grants never cross this interface. */
+export interface IReq_AuthSwitchResolveAccess extends ITypedRequest {
+  method: 'authswitch.authority.resolveAccess';
+  request: { bindingId: string; capability: string; minValidityMs: number };
+  response: {
+    accessToken: string;
+    accountId: string;
+    isFedrampAccount: boolean;
+    expiresAt: string;
+    grantGeneration: number;
+  };
+}