@modelprofile.com/authswitch 6.3.0 → 6.4.0

package/dist_ts/classes.authorityframing.d.ts

@@ -0,0 +1,8 @@
+/** One bounded UTF-8 JSON line. Decode only after the complete byte frame arrives. */
+export declare class AuthSwitchAuthorityFrameReader {
+    private readonly chunks;
+    private bytes;
+    add(chunk: Buffer): string | null;
+}
+export declare const authSwitchAuthorityFrameBytes: (value: string) => number;
+export declare const maxAuthSwitchAuthorityFrameBytes: number;

package/dist_ts/classes.authorityframing.js

@@ -0,0 +1,22 @@
+const maxFrameBytes = 1024 * 1024;
+/** One bounded UTF-8 JSON line. Decode only after the complete byte frame arrives. */
+export class AuthSwitchAuthorityFrameReader {
+    chunks = [];
+    bytes = 0;
+    add(chunk) {
+        if (chunk.length > maxFrameBytes - this.bytes)
+            throw new Error('Authswitch authority frame is too large.');
+        this.chunks.push(chunk);
+        this.bytes += chunk.length;
+        const end = chunk.indexOf(0x0a);
+        if (end < 0)
+            return null;
+        if (end !== chunk.length - 1)
+            throw new Error('Authswitch authority frame contains trailing data.');
+        const frame = Buffer.concat(this.chunks, this.bytes);
+        return new TextDecoder('utf-8', { fatal: true }).decode(frame.subarray(0, frame.length - 1));
+    }
+}
+export const authSwitchAuthorityFrameBytes = (value) => Buffer.byteLength(value, 'utf8') + 1;
+export const maxAuthSwitchAuthorityFrameBytes = maxFrameBytes;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hdXRob3JpdHlmcmFtaW5nLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvY2xhc3Nlcy5hdXRob3JpdHlmcmFtaW5nLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE1BQU0sYUFBYSxHQUFHLElBQUksR0FBRyxJQUFJLENBQUM7QUFFbEMsc0ZBQXNGO0FBQ3RGLE1BQU0sT0FBTyw4QkFBOEI7SUFDeEIsTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUMvQixLQUFLLEdBQUcsQ0FBQyxDQUFDO0lBRVgsR0FBRyxDQUFDLEtBQWE7UUFDdEIsSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLGFBQWEsR0FBRyxJQUFJLENBQUMsS0FBSztZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsMENBQTBDLENBQUMsQ0FBQztRQUMzRyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN4QixJQUFJLENBQUMsS0FBSyxJQUFJLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDM0IsTUFBTSxHQUFHLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNoQyxJQUFJLEdBQUcsR0FBRyxDQUFDO1lBQUUsT0FBTyxJQUFJLENBQUM7UUFDekIsSUFBSSxHQUFHLEtBQUssS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxvREFBb0QsQ0FBQyxDQUFDO1FBQ3BHLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDckQsT0FBTyxJQUFJLFdBQVcsQ0FBQyxPQUFPLEVBQUUsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUsS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQy9GLENBQUM7Q0FDRjtBQUVELE1BQU0sQ0FBQyxNQUFNLDZCQUE2QixHQUFHLENBQUMsS0FBYSxFQUFVLEVBQUUsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7QUFDN0csTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsYUFBYSxDQUFDIn0=

package/dist_ts/classes.authoritymodels.d.ts

@@ -0,0 +1,215 @@
+import * as plugins from './plugins.js';
+export interface IStoredAuthorityMeta {
+    id: 'authswitch-authority';
+    epoch: string;
+    revision: number;
+    updateId: string;
+}
+/** Identity and presentation only. No refresh grant or native-home ownership lives here. */
+export interface IStoredAuthorityAccount {
+    id: string;
+    providerId: string;
+    issuer: string;
+    subject: string;
+    workspaceId: string;
+    label: string;
+    email: string | null;
+    plan: string | null;
+    primaryGrantId: string | null;
+    removed: boolean;
+    revision: number;
+    statusObservedAt: string;
+    updateId: string;
+}
+export type TStoredGrantPurpose = 'openai_managed' | 'claude_host_native' | 'claude_container_setup' | 'opencode_native';
+/** Each purpose has its own grant, ownership, generation and refresh state. */
+export interface IStoredAuthorityGrant {
+    id: string;
+    accountId: string;
+    providerId: string;
+    purpose: TStoredGrantPurpose;
+    audience: string;
+    state: 'ready' | 'exchange_may_have_been_sent' | 'retry_wait' | 'needs_reauth' | 'native' | 'legacy_native_pending' | 'removed';
+    owner: 'daemon' | 'claude_native' | 'legacy_native' | 'none';
+    grantGeneration: number;
+    authorizationGeneration: number;
+    revision: number;
+    ciphertext: string | null;
+    accessExpiresAt: string | null;
+    attemptId: string | null;
+    retryAt: string | null;
+    retryCount: number;
+    problem: 'none' | 'provider_unavailable' | 'exchange_uncertain' | 'provider_rejected' | 'native_owner';
+    statusObservedAt: string;
+    updateId: string;
+}
+export interface IStoredAuthorityBinding {
+    id: string;
+    accountId: string;
+    grantId: string;
+    runtime: 'flex' | 'codex' | 'opencode' | 'claude';
+    scopeId: string;
+    incarnationId: string;
+    revision: number;
+    grantAuthorizationGeneration: number;
+    capabilityHash: string;
+    updateId: string;
+}
+/** Codex enrollment is separate from a refresh grant and sealed under its own record ID. */
+export interface IStoredAuthorityEnrollment {
+    id: string;
+    accountId: string;
+    ciphertext: string;
+    revision: number;
+    updateId: string;
+}
+/** Journal for a native-home handoff. A prepared grant is never usable. */
+export interface IStoredAuthorityHandoff {
+    id: string;
+    accountId: string;
+    grantId: string;
+    nativeHomeId: string;
+    direction: 'to_native' | 'to_daemon';
+    phase: 'prepared' | 'source_stopped' | 'target_written' | 'verified' | 'committed' | 'needs_reauth' | 'aborted';
+    operationId: string;
+    sourceDigest: string;
+    verifiedSourceDigest: string | null;
+    backupDigest: string | null;
+    revision: number;
+    statusObservedAt: string;
+    updateId: string;
+}
+/** One-time legacy source inventory; source path is hashed, never exposed in snapshots. */
+export interface IStoredAuthorityMigrationLedger {
+    id: string;
+    version: number;
+    sourceKind: 'authswitch_stash' | 'authswitch_backup' | 'agl_flex' | 'codex_native' | 'opencode_native' | 'claude_native';
+    sourcePathHash: string;
+    sourceDigest: string;
+    status: 'pending_native_owner' | 'prepared' | 'verified' | 'complete' | 'quarantined';
+    accountId: string | null;
+    grantId: string | null;
+    backupDigest: string | null;
+    revision: number;
+    statusObservedAt: string;
+    updateId: string;
+}
+export interface IStoredAuthorityEvent {
+    id: string;
+    epoch: string;
+    revision: number;
+    kind: 'account' | 'binding';
+    accountId: string;
+}
+export declare const assertStoredAuthorityMeta: (value: unknown) => asserts value is IStoredAuthorityMeta;
+export declare const assertStoredAuthorityAccount: (value: unknown) => asserts value is IStoredAuthorityAccount;
+export declare const assertStoredAuthorityGrant: (value: unknown) => asserts value is IStoredAuthorityGrant;
+export declare const assertStoredAuthorityBinding: (value: unknown) => asserts value is IStoredAuthorityBinding;
+export declare const assertStoredAuthorityEnrollment: (value: unknown) => asserts value is IStoredAuthorityEnrollment;
+export declare const assertStoredAuthorityHandoff: (value: unknown) => asserts value is IStoredAuthorityHandoff;
+export declare const assertStoredAuthorityMigrationLedger: (value: unknown) => asserts value is IStoredAuthorityMigrationLedger;
+export declare const assertStoredAuthorityEvent: (value: unknown) => asserts value is IStoredAuthorityEvent;
+export declare class AuthSwitchAuthorityMetaModel extends plugins.smartdata.SmartDataDbDoc<AuthSwitchAuthorityMetaModel, IStoredAuthorityMeta> {
+    static exact: plugins.smartdata.TExact<AuthSwitchAuthorityMetaModel>;
+    id: 'authswitch-authority';
+    epoch: string;
+    revision: number;
+    updateId: string;
+}
+export declare class AuthSwitchAuthorityAccountModel extends plugins.smartdata.SmartDataDbDoc<AuthSwitchAuthorityAccountModel, IStoredAuthorityAccount> {
+    static exact: plugins.smartdata.TExact<AuthSwitchAuthorityAccountModel>;
+    id: string;
+    providerId: string;
+    issuer: string;
+    subject: string;
+    workspaceId: string;
+    label: string;
+    email: string | null;
+    plan: string | null;
+    primaryGrantId: string | null;
+    removed: boolean;
+    revision: number;
+    statusObservedAt: string;
+    updateId: string;
+}
+export declare class AuthSwitchAuthorityGrantModel extends plugins.smartdata.SmartDataDbDoc<AuthSwitchAuthorityGrantModel, IStoredAuthorityGrant> {
+    static exact: plugins.smartdata.TExact<AuthSwitchAuthorityGrantModel>;
+    id: string;
+    accountId: string;
+    providerId: string;
+    purpose: TStoredGrantPurpose;
+    audience: string;
+    state: IStoredAuthorityGrant['state'];
+    owner: IStoredAuthorityGrant['owner'];
+    grantGeneration: number;
+    authorizationGeneration: number;
+    revision: number;
+    ciphertext: string | null;
+    accessExpiresAt: string | null;
+    attemptId: string | null;
+    retryAt: string | null;
+    retryCount: number;
+    problem: IStoredAuthorityGrant['problem'];
+    statusObservedAt: string;
+    updateId: string;
+}
+export declare class AuthSwitchAuthorityBindingModel extends plugins.smartdata.SmartDataDbDoc<AuthSwitchAuthorityBindingModel, IStoredAuthorityBinding> {
+    static exact: plugins.smartdata.TExact<AuthSwitchAuthorityBindingModel>;
+    id: string;
+    accountId: string;
+    grantId: string;
+    runtime: IStoredAuthorityBinding['runtime'];
+    scopeId: string;
+    incarnationId: string;
+    revision: number;
+    grantAuthorizationGeneration: number;
+    capabilityHash: string;
+    updateId: string;
+}
+export declare class AuthSwitchAuthorityEnrollmentModel extends plugins.smartdata.SmartDataDbDoc<AuthSwitchAuthorityEnrollmentModel, IStoredAuthorityEnrollment> {
+    static exact: plugins.smartdata.TExact<AuthSwitchAuthorityEnrollmentModel>;
+    id: string;
+    accountId: string;
+    ciphertext: string;
+    revision: number;
+    updateId: string;
+}
+export declare class AuthSwitchAuthorityHandoffModel extends plugins.smartdata.SmartDataDbDoc<AuthSwitchAuthorityHandoffModel, IStoredAuthorityHandoff> {
+    static exact: plugins.smartdata.TExact<AuthSwitchAuthorityHandoffModel>;
+    id: string;
+    accountId: string;
+    grantId: string;
+    nativeHomeId: string;
+    direction: IStoredAuthorityHandoff['direction'];
+    phase: IStoredAuthorityHandoff['phase'];
+    operationId: string;
+    sourceDigest: string;
+    verifiedSourceDigest: string | null;
+    backupDigest: string | null;
+    revision: number;
+    statusObservedAt: string;
+    updateId: string;
+}
+export declare class AuthSwitchAuthorityMigrationLedgerModel extends plugins.smartdata.SmartDataDbDoc<AuthSwitchAuthorityMigrationLedgerModel, IStoredAuthorityMigrationLedger> {
+    static exact: plugins.smartdata.TExact<AuthSwitchAuthorityMigrationLedgerModel>;
+    id: string;
+    version: number;
+    sourceKind: IStoredAuthorityMigrationLedger['sourceKind'];
+    sourcePathHash: string;
+    sourceDigest: string;
+    status: IStoredAuthorityMigrationLedger['status'];
+    accountId: string | null;
+    grantId: string | null;
+    backupDigest: string | null;
+    revision: number;
+    statusObservedAt: string;
+    updateId: string;
+}
+export declare class AuthSwitchAuthorityEventModel extends plugins.smartdata.SmartDataDbDoc<AuthSwitchAuthorityEventModel, IStoredAuthorityEvent> {
+    static exact: plugins.smartdata.TExact<AuthSwitchAuthorityEventModel>;
+    id: string;
+    epoch: string;
+    revision: number;
+    kind: IStoredAuthorityEvent['kind'];
+    accountId: string;
+}