@modelprofile.com/authswitch 6.4.0 → 7.0.0

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@modelprofile.com/authswitch',
-    version: '6.4.0',
+    version: '7.0.0',
     description: 'Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSw4QkFBOEI7SUFDcEMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLDZGQUE2RjtDQUMzRyxDQUFBIn0=

package/dist_ts/authority-contract.d.ts

@@ -1,20 +1,38 @@
 import type { ITypedRequest } from '@api.global/typedrequest-interfaces';
+import type { IAuthSwitchUsageSnapshot } from './classes.authorityusage.js';
+export type { IAuthSwitchUsageSnapshot } from './classes.authorityusage.js';
 /** Credential-free account management contract. Safe to import in browser code. */
-export type TAuthSwitchAccountHealth = 'ready' | 'refreshing' | 'retry_wait' | 'needs_reauth' | 'native' | 'legacy_native_pending' | 'removed';
+export type TAuthSwitchLoginPurpose = 'openai_managed' | 'claude_host_native' | 'claude_container_setup' | 'opencode_native';
+export type TAuthSwitchLoginHealth = 'ready' | 'refreshing' | 'retry_wait' | 'needs_reauth' | 'unverified' | 'pending_handoff' | 'handoff_quarantined' | 'removed';
 export interface IAuthSwitchAccount {
     id: string;
     providerId: string;
     label: string;
     email: string | null;
     plan: string | null;
-    health: TAuthSwitchAccountHealth;
+    removed: boolean;
+    revision: number;
+    statusObservedAt: string;
+}
+/** One independently owned login. Native ownership does not imply observed health. */
+export interface IAuthSwitchLogin {
+    id: string;
+    accountId: string;
+    providerId: string;
+    purpose: TAuthSwitchLoginPurpose;
     owner: 'daemon' | 'claude_native' | 'legacy_native' | 'none';
+    health: TAuthSwitchLoginHealth;
+    problem: 'none' | 'provider_unavailable' | 'exchange_uncertain' | 'provider_rejected' | 'native_owner';
     grantGeneration: number;
     revision: number;
     accessExpiresAt: string | null;
     retryAt: string | null;
-    problem: 'none' | 'provider_unavailable' | 'exchange_uncertain' | 'provider_rejected' | 'native_owner';
     statusObservedAt: string;
+    capabilities: {
+        canReauthenticate: boolean;
+        canBind: boolean;
+        canPreuse: boolean;
+    };
 }
 export interface IAuthSwitchBinding {
     id: string;
@@ -25,15 +43,142 @@ export interface IAuthSwitchBinding {
     revision: number;
 }
 export interface IAuthSwitchSnapshot {
-    schemaVersion: 1;
+    schemaVersion: 2;
     epoch: string;
     revision: number;
     generatedAt: string;
     accounts: IAuthSwitchAccount[];
+    logins: IAuthSwitchLogin[];
     bindings: IAuthSwitchBinding[];
     nextAccountCursor: string | null;
+    nextLoginCursor: string | null;
     nextBindingCursor: string | null;
 }
+/** Persisted account evidence. No provider request is made while collecting diagnostics. */
+export interface IAuthSwitchDoctorAccountEvidence {
+    id: string;
+    providerId: string;
+    removed: boolean;
+    statusObservedAt: string;
+    evidence: 'stored';
+    liveCheck: 'not_checked';
+}
+/** Persisted login evidence. Stored readiness is not a live provider-health claim. */
+export interface IAuthSwitchDoctorLoginEvidence {
+    id: string;
+    accountId: string;
+    providerId: string;
+    purpose: TAuthSwitchLoginPurpose;
+    owner: 'daemon' | 'claude_native' | 'legacy_native' | 'none';
+    state: 'ready' | 'exchange_may_have_been_sent' | 'retry_wait' | 'needs_reauth' | 'native' | 'legacy_native_pending' | 'handoff_pending' | 'handoff_quarantined' | 'removed';
+    problem: 'none' | 'provider_unavailable' | 'exchange_uncertain' | 'provider_rejected' | 'native_owner';
+    grantGeneration: number;
+    authorizationGeneration: number;
+    accessExpiresAt: string | null;
+    retryAt: string | null;
+    statusObservedAt: string;
+    evidence: 'stored';
+    liveCheck: 'not_checked';
+}
+export interface IAuthSwitchDoctorManagedCodex {
+    homeId: string;
+    accountId: string;
+    loginId: string;
+    scopeId: string;
+    health: 'healthy' | 'degraded' | 'unknown';
+    durable: {
+        state: 'idle' | 'launch_prepared' | 'registered';
+        runId: string | null;
+        pid: number | null;
+        startedAt: string | null;
+    };
+    daemon: {
+        state: 'untracked' | 'starting' | 'ready' | 'stopping' | 'degraded';
+        assignment: 'untracked' | 'matches' | 'mismatch';
+    };
+    process: {
+        state: 'not_expected' | 'absent' | 'observed' | 'unknown';
+        identity: 'not_applicable' | 'unregistered' | 'matches' | 'mismatch' | 'unknown';
+        pid: number | null;
+        startedAt: string | null;
+        observedAt: string;
+        problem: 'none' | 'inspection_failed' | 'multiple_claimants';
+    };
+}
+export interface IAuthSwitchDoctorClaudeHome {
+    id: string;
+    activeAccountId: string;
+    activeLoginId: string;
+    pendingOperationId: string | null;
+    status: 'ready' | 'quarantined';
+    revision: number;
+    createdAt: string;
+}
+export interface IAuthSwitchDoctorClaudeHandoff {
+    id: string;
+    homeId: string;
+    outgoingAccountId: string;
+    outgoingLoginId: string;
+    incomingAccountId: string;
+    incomingLoginId: string;
+    phase: 'reserved' | 'prepared' | 'committed' | 'aborted' | 'quarantined';
+    problem: 'none' | 'native_uncertain' | 'foreign_or_torn' | 'unsupported_effective_auth' | 'database_uncertain';
+    runningEffectiveAuth: 'no_scoped_sessions' | 'unsupported_effective_auth' | null;
+    startedAt: string;
+    updatedAt: string;
+    revision: number;
+}
+export interface IAuthSwitchDoctorNativeHandoff {
+    id: string;
+    accountId: string;
+    loginId: string;
+    nativeHomeId: string;
+    direction: 'to_native' | 'to_daemon';
+    phase: 'prepared' | 'source_stopped' | 'target_written' | 'verified' | 'committed' | 'needs_reauth' | 'aborted';
+    operationId: string;
+    revision: number;
+    statusObservedAt: string;
+}
+export interface IAuthSwitchDoctorMigration {
+    id: string;
+    sourceKind: 'authswitch_stash' | 'authswitch_backup' | 'agl_flex' | 'codex_native' | 'opencode_native' | 'claude_native';
+    status: 'pending_native_owner' | 'prepared' | 'verified' | 'complete' | 'quarantined';
+    accountId: string | null;
+    loginId: string | null;
+    revision: number;
+    statusObservedAt: string;
+}
+/** One independently observed diagnostic page. Separate pages are not one atomic global snapshot. */
+export interface IAuthSwitchDoctorPage {
+    observedAt: string;
+    daemon: {
+        state: 'ready' | 'closing';
+        claudeNativeAuthority: 'configured' | 'not_configured';
+        observedAt: string;
+    };
+    database: {
+        state: 'available';
+        observedAt: string;
+        schemaVersion: 2;
+        admission: 'open' | 'closed_restored';
+        epoch: string;
+        revision: number;
+    };
+    accounts: IAuthSwitchDoctorAccountEvidence[];
+    logins: IAuthSwitchDoctorLoginEvidence[];
+    managedCodex: IAuthSwitchDoctorManagedCodex[];
+    claudeHomes: IAuthSwitchDoctorClaudeHome[];
+    claudeHandoffs: IAuthSwitchDoctorClaudeHandoff[];
+    nativeHandoffs: IAuthSwitchDoctorNativeHandoff[];
+    migrations: IAuthSwitchDoctorMigration[];
+    nextAccountCursor: string | null;
+    nextLoginCursor: string | null;
+    nextCodexHomeCursor: string | null;
+    nextClaudeHomeCursor: string | null;
+    nextClaudeHandoffCursor: string | null;
+    nextNativeHandoffCursor: string | null;
+    nextMigrationCursor: string | null;
+}
 export interface IAuthSwitchAccountEvent {
     epoch: string;
     revision: number;
@@ -50,15 +195,91 @@ export type TAuthSwitchLoginPrompt = {
 };
 export interface IAuthSwitchOperation {
     id: string;
-    state: 'pending' | 'complete' | 'failed' | 'cancelled';
+    kind: 'add_openai' | 'reauth_openai';
+    purpose: 'openai_managed';
+    targetAccountId: string | null;
+    targetLoginId: string | null;
+    state: 'starting' | 'pending' | 'committing' | 'complete' | 'failed' | 'cancelled' | 'interrupted' | 'outcome_unknown';
     prompt: TAuthSwitchLoginPrompt | null;
-    account: IAuthSwitchAccount | null;
+    result: {
+        accountId: string;
+        loginId: string;
+        accountRevision: number;
+        loginGeneration: number;
+    } | null;
     error: string | null;
+    createdAt: string;
+    updatedAt: string;
+    finishedAt: string | null;
+    revision: number;
+}
+/** Credential-free receipt for one exact, never-replayed quota-consuming request. */
+export interface IAuthSwitchPreuseOperation {
+    id: string;
+    accountId: string;
+    loginId: string;
+    purpose: 'openai_managed';
+    requestedModel: string | null;
+    model: string | null;
+    state: 'preparing' | 'request_may_have_started' | 'complete' | 'not_sent' | 'outcome_unknown';
+    result: {
+        inputTokens: number | null;
+        outputTokens: number | null;
+        totalTokens: number | null;
+    } | null;
+    problem: 'none' | 'target_unavailable' | 'access_unavailable' | 'catalog_unavailable' | 'account_busy' | 'cancelled' | 'authority_closing' | 'interrupted' | 'request_uncertain' | 'restored_history_uncertain';
+    createdAt: string;
+    updatedAt: string;
+    finishedAt: string | null;
+    revision: number;
+}
+/** Credential-free native file ownership result. It makes no claim about a running session's active request. */
+export interface IAuthSwitchClaudeNativeHandoff {
+    id: string;
+    homeId: string;
+    outgoingAccountId: string;
+    incomingAccountId: string;
+    phase: 'reserved' | 'prepared' | 'committed' | 'aborted' | 'quarantined';
+    problem: 'none' | 'native_uncertain' | 'foreign_or_torn' | 'unsupported_effective_auth' | 'database_uncertain';
+    runningEffectiveAuth: 'no_scoped_sessions' | 'unsupported_effective_auth' | null;
+    updatedAt: string;
+}
+export interface IReq_AuthSwitchSwitchClaudeNative extends ITypedRequest {
+    method: 'authswitch.authority.claude.switch';
+    request: {
+        accountId: string;
+        loginId: string;
+        purpose: 'claude_host_native';
+    };
+    response: {
+        handoff: IAuthSwitchClaudeNativeHandoff;
+    };
+}
+export interface IReq_AuthSwitchClaudeNativeHandoff extends ITypedRequest {
+    method: 'authswitch.authority.claude.handoff';
+    request: {
+        operationId: string;
+    };
+    response: {
+        handoff: IAuthSwitchClaudeNativeHandoff;
+    };
+}
+export interface IReq_AuthSwitchClaudeNativeHandoffs extends ITypedRequest {
+    method: 'authswitch.authority.claude.handoffs';
+    request: {
+        after?: string;
+        limit?: number;
+    };
+    response: {
+        handoffs: IAuthSwitchClaudeNativeHandoff[];
+        nextCursor: string | null;
+    };
 }
 export interface IReq_AuthSwitchSnapshot extends ITypedRequest {
     method: 'authswitch.authority.snapshot';
     request: {
         accountAfter?: string;
+        loginAfter?: string;
         bindingAfter?: string;
         limit?: number;
     };
@@ -66,6 +287,34 @@ export interface IReq_AuthSwitchSnapshot extends ITypedRequest {
         snapshot: IAuthSwitchSnapshot;
     };
 }
+export interface IReq_AuthSwitchDoctor extends ITypedRequest {
+    method: 'authswitch.authority.doctor';
+    request: {
+        accountAfter?: string;
+        loginAfter?: string;
+        codexHomeAfter?: string;
+        claudeHomeAfter?: string;
+        claudeHandoffAfter?: string;
+        nativeHandoffAfter?: string;
+        migrationAfter?: string;
+        limit?: number;
+    };
+    response: {
+        page: IAuthSwitchDoctorPage;
+    };
+}
+/** Management-only usage read. The DTO contains no access or refresh credential. */
+export interface IReq_AuthSwitchUsage extends ITypedRequest {
+    method: 'authswitch.authority.usage';
+    request: {
+        accountId: string;
+        loginId: string;
+        force?: boolean;
+    };
+    response: {
+        usage: IAuthSwitchUsageSnapshot;
+    };
+}
 export interface IReq_AuthSwitchEvents extends ITypedRequest {
     method: 'authswitch.authority.events';
     request: {
@@ -83,6 +332,7 @@ export interface IReq_AuthSwitchEvents extends ITypedRequest {
 export interface IReq_AuthSwitchBeginAdd extends ITypedRequest {
     method: 'authswitch.authority.add';
     request: {
+        operationId: string;
         providerId: 'openai';
         flow: 'device';
     };
@@ -93,13 +343,27 @@ export interface IReq_AuthSwitchBeginAdd extends ITypedRequest {
 export interface IReq_AuthSwitchBeginReauth extends ITypedRequest {
     method: 'authswitch.authority.reauth';
     request: {
+        operationId: string;
         accountId: string;
+        loginId: string;
+        purpose: 'openai_managed';
         flow: 'device';
     };
     response: {
         operation: IAuthSwitchOperation;
     };
 }
+export interface IReq_AuthSwitchListOperations extends ITypedRequest {
+    method: 'authswitch.authority.operations';
+    request: {
+        after?: string;
+        limit?: number;
+    };
+    response: {
+        operations: IAuthSwitchOperation[];
+        nextCursor: string | null;
+    };
+}
 export interface IReq_AuthSwitchGetOperation extends ITypedRequest {
     method: 'authswitch.authority.operation';
     request: {
@@ -118,6 +382,38 @@ export interface IReq_AuthSwitchCancelOperation extends ITypedRequest {
         operation: IAuthSwitchOperation;
     };
 }
+export interface IReq_AuthSwitchStartPreuse extends ITypedRequest {
+    method: 'authswitch.authority.preuse.start';
+    request: {
+        operationId: string;
+        accountId: string;
+        loginId: string;
+        purpose: 'openai_managed';
+        prompt: string;
+        model?: string;
+    };
+    response: {
+        operation: IAuthSwitchPreuseOperation;
+    };
+}
+export interface IReq_AuthSwitchGetPreuse extends ITypedRequest {
+    method: 'authswitch.authority.preuse.operation';
+    request: {
+        operationId: string;
+    };
+    response: {
+        operation: IAuthSwitchPreuseOperation;
+    };
+}
+export interface IReq_AuthSwitchCancelPreuse extends ITypedRequest {
+    method: 'authswitch.authority.preuse.cancel';
+    request: {
+        operationId: string;
+    };
+    response: {
+        operation: IAuthSwitchPreuseOperation;
+    };
+}
 export interface IReq_AuthSwitchRenameAccount extends ITypedRequest {
     method: 'authswitch.authority.rename';
     request: {

package/dist_ts/authority-contract.js

@@ -1,3 +1,3 @@
 export {};
 /** Runtime capability is returned only to trusted backend callers; do not expose this response in a browser API. */
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXR5LWNvbnRyYWN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvYXV0aG9yaXR5LWNvbnRyYWN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUE0R0Esb0hBQW9IIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXR5LWNvbnRyYWN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvYXV0aG9yaXR5LWNvbnRyYWN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUEyV0Esb0hBQW9IIn0=

package/dist_ts/authority-runtime-contract.d.ts

@@ -5,6 +5,8 @@ export interface IReq_AuthSwitchBindAccount extends ITypedRequest {
     method: 'authswitch.authority.bind';
     request: {
         accountId: string;
+        loginId: string;
+        purpose: 'openai_managed';
         runtime: IAuthSwitchBinding['runtime'];
         scopeId: string;
         incarnationId: string;
@@ -21,6 +23,8 @@ export interface IReq_AuthSwitchResolveAccess extends ITypedRequest {
         bindingId: string;
         capability: string;
         minValidityMs: number;
+        /** The provider rejected this exact access-token generation. */
+        rejectedGrantGeneration?: number;
     };
     response: {
         accessToken: string;
@@ -30,3 +34,14 @@ export interface IReq_AuthSwitchResolveAccess extends ITypedRequest {
         grantGeneration: number;
     };
 }
+/** Backend-only release for one exact external runtime capability. */
+export interface IReq_AuthSwitchReleaseBinding extends ITypedRequest {
+    method: 'authswitch.authority.release';
+    request: {
+        bindingId: string;
+        capability: string;
+    };
+    response: {
+        state: 'released' | 'inactive';
+    };
+}

package/dist_ts/authorityrehearsal.child.d.ts

@@ -0,0 +1 @@
+export {};