@modelprofile.com/authswitch 6.3.0 → 6.5.0

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@modelprofile.com/authswitch',
-    version: '6.3.0',
+    version: '6.5.0',
     description: 'Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSw4QkFBOEI7SUFDcEMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLDZGQUE2RjtDQUMzRyxDQUFBIn0=

package/dist_ts/authority-contract.d.ts

@@ -0,0 +1,142 @@
+import type { ITypedRequest } from '@api.global/typedrequest-interfaces';
+/** Credential-free account management contract. Safe to import in browser code. */
+export type TAuthSwitchAccountHealth = 'ready' | 'refreshing' | 'retry_wait' | 'needs_reauth' | 'native' | 'legacy_native_pending' | 'removed';
+export interface IAuthSwitchAccount {
+    id: string;
+    providerId: string;
+    label: string;
+    email: string | null;
+    plan: string | null;
+    health: TAuthSwitchAccountHealth;
+    owner: 'daemon' | 'claude_native' | 'legacy_native' | 'none';
+    grantGeneration: number;
+    revision: number;
+    accessExpiresAt: string | null;
+    retryAt: string | null;
+    problem: 'none' | 'provider_unavailable' | 'exchange_uncertain' | 'provider_rejected' | 'native_owner';
+    statusObservedAt: string;
+}
+export interface IAuthSwitchBinding {
+    id: string;
+    accountId: string;
+    runtime: 'flex' | 'codex' | 'opencode' | 'claude';
+    scopeId: string;
+    incarnationId: string;
+    revision: number;
+}
+export interface IAuthSwitchSnapshot {
+    schemaVersion: 1;
+    epoch: string;
+    revision: number;
+    generatedAt: string;
+    accounts: IAuthSwitchAccount[];
+    bindings: IAuthSwitchBinding[];
+    nextAccountCursor: string | null;
+    nextBindingCursor: string | null;
+}
+export interface IAuthSwitchAccountEvent {
+    epoch: string;
+    revision: number;
+    kind: 'account' | 'binding';
+    accountId: string;
+}
+export type TAuthSwitchLoginPrompt = {
+    flow: 'device';
+    verificationUrl: string;
+    userCode: string;
+} | {
+    flow: 'browser';
+    authUrl: string;
+};
+export interface IAuthSwitchOperation {
+    id: string;
+    state: 'pending' | 'complete' | 'failed' | 'cancelled';
+    prompt: TAuthSwitchLoginPrompt | null;
+    account: IAuthSwitchAccount | null;
+    error: string | null;
+}
+export interface IReq_AuthSwitchSnapshot extends ITypedRequest {
+    method: 'authswitch.authority.snapshot';
+    request: {
+        accountAfter?: string;
+        bindingAfter?: string;
+        limit?: number;
+    };
+    response: {
+        snapshot: IAuthSwitchSnapshot;
+    };
+}
+export interface IReq_AuthSwitchEvents extends ITypedRequest {
+    method: 'authswitch.authority.events';
+    request: {
+        epoch: string;
+        afterRevision: number;
+        waitMs: number;
+    };
+    response: {
+        epoch: string;
+        revision: number;
+        resyncRequired: boolean;
+        events: IAuthSwitchAccountEvent[];
+    };
+}
+export interface IReq_AuthSwitchBeginAdd extends ITypedRequest {
+    method: 'authswitch.authority.add';
+    request: {
+        providerId: 'openai';
+        flow: 'device';
+    };
+    response: {
+        operation: IAuthSwitchOperation;
+    };
+}
+export interface IReq_AuthSwitchBeginReauth extends ITypedRequest {
+    method: 'authswitch.authority.reauth';
+    request: {
+        accountId: string;
+        flow: 'device';
+    };
+    response: {
+        operation: IAuthSwitchOperation;
+    };
+}
+export interface IReq_AuthSwitchGetOperation extends ITypedRequest {
+    method: 'authswitch.authority.operation';
+    request: {
+        operationId: string;
+    };
+    response: {
+        operation: IAuthSwitchOperation;
+    };
+}
+export interface IReq_AuthSwitchCancelOperation extends ITypedRequest {
+    method: 'authswitch.authority.cancel';
+    request: {
+        operationId: string;
+    };
+    response: {
+        operation: IAuthSwitchOperation;
+    };
+}
+export interface IReq_AuthSwitchRenameAccount extends ITypedRequest {
+    method: 'authswitch.authority.rename';
+    request: {
+        accountId: string;
+        expectedRevision: number;
+        label: string;
+    };
+    response: {
+        account: IAuthSwitchAccount;
+    };
+}
+export interface IReq_AuthSwitchRemoveAccount extends ITypedRequest {
+    method: 'authswitch.authority.remove';
+    request: {
+        accountId: string;
+        expectedRevision: number;
+    };
+    response: {
+        account: IAuthSwitchAccount;
+    };
+}
+/** Runtime capability is returned only to trusted backend callers; do not expose this response in a browser API. */

package/dist_ts/authority-contract.js

@@ -0,0 +1,3 @@
+export {};
+/** Runtime capability is returned only to trusted backend callers; do not expose this response in a browser API. */
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXR5LWNvbnRyYWN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvYXV0aG9yaXR5LWNvbnRyYWN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUE0R0Esb0hBQW9IIn0=

package/dist_ts/authority-runtime-contract.d.ts

@@ -0,0 +1,34 @@
+import type { ITypedRequest } from '@api.global/typedrequest-interfaces';
+import type { IAuthSwitchBinding } from './authority-contract.js';
+/** Backend-only binding operation. The capability must never enter a browser-facing response. */
+export interface IReq_AuthSwitchBindAccount extends ITypedRequest {
+    method: 'authswitch.authority.bind';
+    request: {
+        accountId: string;
+        runtime: IAuthSwitchBinding['runtime'];
+        scopeId: string;
+        incarnationId: string;
+    };
+    response: {
+        binding: IAuthSwitchBinding;
+        capability: string;
+    };
+}
+/** Backend-only access operation. Refresh grants never cross this interface. */
+export interface IReq_AuthSwitchResolveAccess extends ITypedRequest {
+    method: 'authswitch.authority.resolveAccess';
+    request: {
+        bindingId: string;
+        capability: string;
+        minValidityMs: number;
+        /** The provider rejected this exact access-token generation. */
+        rejectedGrantGeneration?: number;
+    };
+    response: {
+        accessToken: string;
+        accountId: string;
+        isFedrampAccount: boolean;
+        expiresAt: string;
+        grantGeneration: number;
+    };
+}

package/dist_ts/authority-runtime-contract.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXR5LXJ1bnRpbWUtY29udHJhY3QuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9hdXRob3JpdHktcnVudGltZS1jb250cmFjdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=

package/dist_ts/classes.authoritybroker.d.ts

@@ -0,0 +1,76 @@
+import * as plugins from './plugins.js';
+import type { IAuthSwitchAccount, IAuthSwitchAccountEvent, IAuthSwitchBinding, IAuthSwitchOperation, IAuthSwitchSnapshot } from './authority-contract.js';
+import { AuthSwitchAuthorityDatabase } from './classes.authoritydatabase.js';
+import { type IAuthSwitchSecretCodec } from './classes.authoritysecrets.js';
+type TOpenAiProvider = Pick<plugins.flexAccounts.ISmartAiProviderAdapter, 'beginLogin' | 'refreshCredential' | 'inspectCredential' | 'dispose'>;
+export interface IAuthSwitchAuthorityBrokerOptions {
+    provider?: TOpenAiProvider;
+    secrets?: IAuthSwitchSecretCodec;
+    now?: () => number;
+    proactive?: boolean;
+}
+export interface IAuthSwitchResolvedAccess {
+    accessToken: string;
+    accountId: string;
+    isFedrampAccount: boolean;
+    expiresAt: string;
+    grantGeneration: number;
+}
+/** One daemon-owned authority. No management DTO contains a refresh grant. */
+export declare class AuthSwitchAuthorityBroker {
+    private readonly database;
+    private readonly provider;
+    private readonly secrets;
+    private readonly now;
+    private readonly proactive;
+    private readonly operations;
+    private readonly refreshes;
+    private readonly listeners;
+    private timer?;
+    private closed;
+    constructor(database: AuthSwitchAuthorityDatabase, options?: IAuthSwitchAuthorityBrokerOptions);
+    start(): Promise<void>;
+    private schedule;
+    refreshDueAccounts(): Promise<void>;
+    private isDue;
+    private publish;
+    snapshot(options?: {
+        accountAfter?: string;
+        bindingAfter?: string;
+        limit?: number;
+    }): Promise<IAuthSwitchSnapshot>;
+    events(epoch: string, afterRevision: number, waitMs: number, signal?: AbortSignal): Promise<{
+        epoch: string;
+        revision: number;
+        resyncRequired: boolean;
+        events: IAuthSwitchAccountEvent[];
+    }>;
+    private identity;
+    private sealCredential;
+    private unsealCredential;
+    beginAddOpenAi(): Promise<IAuthSwitchOperation>;
+    beginReauthOpenAi(accountId: string): Promise<IAuthSwitchOperation>;
+    private beginLogin;
+    getOperation(operationId: string): IAuthSwitchOperation;
+    /** Trusted daemon lifecycle hook: hold new managed runtimes out until targeted reauth settles. */
+    waitOperation(operationId: string): Promise<void>;
+    private pruneOperations;
+    cancelOperation(operationId: string): Promise<IAuthSwitchOperation>;
+    renameAccount(accountId: string, expectedRevision: number, label: string): Promise<IAuthSwitchAccount>;
+    removeAccount(accountId: string, expectedRevision: number): Promise<IAuthSwitchAccount>;
+    bindAccount(input: {
+        accountId: string;
+        runtime: IAuthSwitchBinding['runtime'];
+        scopeId: string;
+        incarnationId: string;
+    }): Promise<{
+        binding: IAuthSwitchBinding;
+        capability: string;
+    }>;
+    revokeBinding(bindingId: string, capability: string): Promise<boolean>;
+    resolveAccess(bindingId: string, capability: string, minValidityMs: number, rejectedGrantGeneration?: number): Promise<IAuthSwitchResolvedAccess>;
+    private refreshAccount;
+    private performRefresh;
+    close(): Promise<void>;
+}
+export {};