@modelprofile.com/authswitch 6.4.0 → 7.0.0

package/dist_ts/plugins.js

@@ -5,9 +5,10 @@ import * as path from 'node:path';
 import * as childProcess from 'node:child_process';
 import * as crypto from 'node:crypto';
 import * as net from 'node:net';
+import * as stream from 'node:stream';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
-export { childProcess, crypto, fileURLToPath, fs, net, os, path };
+export { childProcess, crypto, fileURLToPath, fs, net, os, path, stream };
 const nativeRequire = createRequire(import.meta.url);
 /** SQLite is needed only when accessing a Codex state database, not when hosting account APIs. */
 export const loadSqlite = () => nativeRequire('node:sqlite');
@@ -16,18 +17,22 @@ export const loadSqlite = () => nativeRequire('node:sqlite');
  * process that never changes a Claude Code login (such as a host embedding the account service) does not need.
  */
 export const loadProperLockfile = () => import('proper-lockfile');
+// @lossless.org modules
+import * as smartbucket from '@lossless.org/client/objectstorage';
 // @push.rocks modules
 import * as smartconsole from '@push.rocks/smartconsole';
+import * as smartcrypto from '@push.rocks/smartcrypto';
 import * as smartdata from '@push.rocks/smartdata';
 import * as smartdb from '@push.rocks/smartdb';
 import * as smartsecret from '@push.rocks/smartsecret';
 import * as smartdaemon from '@push.rocks/smartdaemon';
 import * as typedrequest from '@api.global/typedrequest';
-export { smartconsole, smartdata, smartdb, smartsecret, smartdaemon, typedrequest };
+export { smartbucket, smartconsole, smartcrypto, smartdata, smartdb, smartsecret, smartdaemon, typedrequest };
 // @modelprofile.com modules
 import * as flexModels from '@modelprofile.com/flexharness-models';
 import * as flexOpenAi from '@modelprofile.com/flexharness-providers/openai';
 import * as flexAuth from '@modelprofile.com/flexharness-providers/auth';
 import * as flexAccounts from '@modelprofile.com/flexharness-providers/accounts';
-export { flexModels, flexOpenAi, flexAuth, flexAccounts };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsc0JBQXNCO0FBQ3RCLE9BQU8sS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQzlCLE9BQU8sS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQzlCLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBQ2xDLE9BQU8sS0FBSyxZQUFZLE1BQU0sb0JBQW9CLENBQUM7QUFDbkQsT0FBTyxLQUFLLE1BQU0sTUFBTSxhQUFhLENBQUM7QUFDdEMsT0FBTyxLQUFLLEdBQUcsTUFBTSxVQUFVLENBQUM7QUFDaEMsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLGFBQWEsQ0FBQztBQUM1QyxPQUFPLEVBQUUsYUFBYSxFQUFFLE1BQU0sVUFBVSxDQUFDO0FBR3pDLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxFQUFFLGFBQWEsRUFBRSxFQUFFLEVBQUUsR0FBRyxFQUFFLEVBQUUsRUFBRSxJQUFJLEVBQUUsQ0FBQztBQUVsRSxNQUFNLGFBQWEsR0FBRyxhQUFhLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztBQUNyRCxrR0FBa0c7QUFDbEcsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHLEdBQWlDLEVBQUUsQ0FBQyxhQUFhLENBQUMsYUFBYSxDQUFDLENBQUM7QUFLM0Y7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sa0JBQWtCLEdBQUcsR0FBNkIsRUFBRSxDQUFDLE1BQU0sQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0FBRTVGLHNCQUFzQjtBQUN0QixPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBQ3pELE9BQU8sS0FBSyxTQUFTLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLE9BQU8sTUFBTSxxQkFBcUIsQ0FBQztBQUMvQyxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEVBQUUsWUFBWSxFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRSxZQUFZLEVBQUUsQ0FBQztBQUVwRiw0QkFBNEI7QUFDNUIsT0FBTyxLQUFLLFVBQVUsTUFBTSxzQ0FBc0MsQ0FBQztBQUNuRSxPQUFPLEtBQUssVUFBVSxNQUFNLGdEQUFnRCxDQUFDO0FBQzdFLE9BQU8sS0FBSyxRQUFRLE1BQU0sOENBQThDLENBQUM7QUFDekUsT0FBTyxLQUFLLFlBQVksTUFBTSxrREFBa0QsQ0FBQztBQUNqRixPQUFPLEVBQUUsVUFBVSxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsWUFBWSxFQUFFLENBQUMifQ==
+import * as crossharness from '@modelprofile.com/mcp-crossharness';
+export { flexModels, flexOpenAi, flexAuth, flexAccounts, crossharness };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsc0JBQXNCO0FBQ3RCLE9BQU8sS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQzlCLE9BQU8sS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQzlCLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBQ2xDLE9BQU8sS0FBSyxZQUFZLE1BQU0sb0JBQW9CLENBQUM7QUFDbkQsT0FBTyxLQUFLLE1BQU0sTUFBTSxhQUFhLENBQUM7QUFDdEMsT0FBTyxLQUFLLEdBQUcsTUFBTSxVQUFVLENBQUM7QUFDaEMsT0FBTyxLQUFLLE1BQU0sTUFBTSxhQUFhLENBQUM7QUFDdEMsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLGFBQWEsQ0FBQztBQUM1QyxPQUFPLEVBQUUsYUFBYSxFQUFFLE1BQU0sVUFBVSxDQUFDO0FBR3pDLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxFQUFFLGFBQWEsRUFBRSxFQUFFLEVBQUUsR0FBRyxFQUFFLEVBQUUsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLENBQUM7QUFFMUUsTUFBTSxhQUFhLEdBQUcsYUFBYSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7QUFDckQsa0dBQWtHO0FBQ2xHLE1BQU0sQ0FBQyxNQUFNLFVBQVUsR0FBRyxHQUFpQyxFQUFFLENBQUMsYUFBYSxDQUFDLGFBQWEsQ0FBQyxDQUFDO0FBSzNGOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLGtCQUFrQixHQUFHLEdBQTZCLEVBQUUsQ0FBQyxNQUFNLENBQUMsaUJBQWlCLENBQUMsQ0FBQztBQUU1Rix3QkFBd0I7QUFDeEIsT0FBTyxLQUFLLFdBQVcsTUFBTSxvQ0FBb0MsQ0FBQztBQUVsRSxzQkFBc0I7QUFDdEIsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxTQUFTLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLE9BQU8sTUFBTSxxQkFBcUIsQ0FBQztBQUMvQyxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEVBQUUsV0FBVyxFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsU0FBUyxFQUFFLE9BQU8sRUFBRSxXQUFXLEVBQUUsV0FBVyxFQUFFLFlBQVksRUFBRSxDQUFDO0FBRTlHLDRCQUE0QjtBQUM1QixPQUFPLEtBQUssVUFBVSxNQUFNLHNDQUFzQyxDQUFDO0FBQ25FLE9BQU8sS0FBSyxVQUFVLE1BQU0sZ0RBQWdELENBQUM7QUFDN0UsT0FBTyxLQUFLLFFBQVEsTUFBTSw4Q0FBOEMsQ0FBQztBQUN6RSxPQUFPLEtBQUssWUFBWSxNQUFNLGtEQUFrRCxDQUFDO0FBQ2pGLE9BQU8sS0FBSyxZQUFZLE1BQU0sb0NBQW9DLENBQUM7QUFDbkUsT0FBTyxFQUFFLFVBQVUsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFlBQVksRUFBRSxZQUFZLEVBQUUsQ0FBQyJ9

package/dist_ts/ts_migration/0001_authority_meta.d.ts

@@ -0,0 +1,3 @@
+import type { SmartdataDb } from '@push.rocks/smartdata';
+/** One-time published 6.4/6.5 metadata upgrade, under the exclusive LocalSmartDb root owner. */
+export declare const migrateAuthorityMetaV1: (db: SmartdataDb) => Promise<void>;

package/dist_ts/ts_migration/0001_authority_meta.js

@@ -0,0 +1,32 @@
+import { assertStoredAuthorityMeta } from '../classes.authoritymodels.js';
+const reserved = new Set(['_id', '_smartdataRevision', '_createdAt', '_updatedAt']);
+const keys = ['id', 'epoch', 'revision', 'updateId'];
+const uuid = (value) => typeof value === 'string' && /^[a-f0-9-]{36}$/.test(value);
+/** One-time published 6.4/6.5 metadata upgrade, under the exclusive LocalSmartDb root owner. */
+export const migrateAuthorityMetaV1 = async (db) => {
+    const collection = db.mongoDb.collection('authswitch_authority_meta');
+    const stored = await collection.findOne({ id: 'authswitch-authority' });
+    if (!stored)
+        throw new Error('Existing authswitch authority database has no metadata.');
+    const body = Object.fromEntries(Object.entries(stored).filter(([key]) => !reserved.has(key)));
+    if (body.schemaVersion === 2) {
+        assertStoredAuthorityMeta(body);
+        return;
+    }
+    if (Object.keys(body).length !== keys.length || !keys.every(key => Object.hasOwn(body, key))
+        || body.id !== 'authswitch-authority' || !uuid(body.epoch) || !uuid(body.updateId)
+        || !Number.isSafeInteger(body.revision) || Number(body.revision) < 0) {
+        throw new Error('Existing authswitch authority metadata has an unknown schema.');
+    }
+    const result = await collection.updateOne({ _id: stored._id, id: 'authswitch-authority',
+        schemaVersion: { $exists: false }, admission: { $exists: false } }, { $set: { schemaVersion: 2, admission: 'open' } });
+    if (result.matchedCount !== 1 || result.modifiedCount !== 1) {
+        throw new Error('Authswitch authority metadata migration did not commit exactly once.');
+    }
+    const migrated = await collection.findOne({ _id: stored._id });
+    if (!migrated)
+        throw new Error('Authswitch authority metadata disappeared during migration.');
+    assertStoredAuthorityMeta(Object.fromEntries(Object.entries(migrated)
+        .filter(([key]) => !reserved.has(key))));
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDAwMV9hdXRob3JpdHlfbWV0YS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3RzX21pZ3JhdGlvbi8wMDAxX2F1dGhvcml0eV9tZXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSx5QkFBeUIsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBRTFFLE1BQU0sUUFBUSxHQUFHLElBQUksR0FBRyxDQUFDLENBQUMsS0FBSyxFQUFFLG9CQUFvQixFQUFFLFlBQVksRUFBRSxZQUFZLENBQUMsQ0FBQyxDQUFDO0FBQ3BGLE1BQU0sSUFBSSxHQUFHLENBQUMsSUFBSSxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsVUFBVSxDQUFDLENBQUM7QUFDckQsTUFBTSxJQUFJLEdBQUcsQ0FBQyxLQUFjLEVBQVcsRUFBRSxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7QUFFckcsZ0dBQWdHO0FBQ2hHLE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLEtBQUssRUFBRSxFQUFlLEVBQWlCLEVBQUU7SUFDN0UsTUFBTSxVQUFVLEdBQUcsRUFBRSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsMkJBQTJCLENBQUMsQ0FBQztJQUN0RSxNQUFNLE1BQU0sR0FBRyxNQUFNLFVBQVUsQ0FBQyxPQUFPLENBQUMsRUFBRSxFQUFFLEVBQUUsc0JBQXNCLEVBQUUsQ0FBQyxDQUFDO0lBQ3hFLElBQUksQ0FBQyxNQUFNO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyx5REFBeUQsQ0FBQyxDQUFDO0lBQ3hGLE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzlGLElBQUksSUFBSSxDQUFDLGFBQWEsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUM3Qix5QkFBeUIsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNoQyxPQUFPO0lBQ1QsQ0FBQztJQUNELElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEtBQUssSUFBSSxDQUFDLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsQ0FBQztXQUN2RixJQUFJLENBQUMsRUFBRSxLQUFLLHNCQUFzQixJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDO1dBQy9FLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN2RSxNQUFNLElBQUksS0FBSyxDQUFDLCtEQUErRCxDQUFDLENBQUM7SUFDbkYsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLE1BQU0sVUFBVSxDQUFDLFNBQVMsQ0FBQyxFQUFFLEdBQUcsRUFBRSxNQUFNLENBQUMsR0FBRyxFQUFFLEVBQUUsRUFBRSxzQkFBc0I7UUFDckYsYUFBYSxFQUFFLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxFQUFFLFNBQVMsRUFBRSxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUNwRSxFQUFFLElBQUksRUFBRSxFQUFFLGFBQWEsRUFBRSxDQUFDLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNuRCxJQUFJLE1BQU0sQ0FBQyxZQUFZLEtBQUssQ0FBQyxJQUFJLE1BQU0sQ0FBQyxhQUFhLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDNUQsTUFBTSxJQUFJLEtBQUssQ0FBQyxzRUFBc0UsQ0FBQyxDQUFDO0lBQzFGLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBRyxNQUFNLFVBQVUsQ0FBQyxPQUFPLENBQUMsRUFBRSxHQUFHLEVBQUUsTUFBTSxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUM7SUFDL0QsSUFBSSxDQUFDLFFBQVE7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLDZEQUE2RCxDQUFDLENBQUM7SUFDOUYseUJBQXlCLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQztTQUNsRSxNQUFNLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDN0MsQ0FBQyxDQUFDIn0=

package/dist_ts/ts_migration/index.d.ts

@@ -0,0 +1,3 @@
+import type { SmartdataDb } from '@push.rocks/smartdata';
+/** The persisted metadata schema version records completion. Order is fixed for later migrations. */
+export declare const runAuthorityMigrations: (db: SmartdataDb) => Promise<void>;

package/dist_ts/ts_migration/index.js

@@ -0,0 +1,6 @@
+import { migrateAuthorityMetaV1 } from './0001_authority_meta.js';
+/** The persisted metadata schema version records completion. Order is fixed for later migrations. */
+export const runAuthorityMigrations = async (db) => {
+    await migrateAuthorityMetaV1(db);
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy90c19taWdyYXRpb24vaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQ0EsT0FBTyxFQUFFLHNCQUFzQixFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFFbEUscUdBQXFHO0FBQ3JHLE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLEtBQUssRUFBRSxFQUFlLEVBQWlCLEVBQUU7SUFDN0UsTUFBTSxzQkFBc0IsQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUNuQyxDQUFDLENBQUMifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelprofile.com/authswitch",
-  "version": "6.4.0",
+  "version": "7.0.0",
   "private": false,
   "description": "Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status",
   "main": "dist_ts/index.js",
@@ -21,6 +21,10 @@
     "./authority-client": {
       "types": "./dist_ts/classes.authorityclient.d.ts",
       "import": "./dist_ts/classes.authorityclient.js"
+    },
+    "./authority-daemon": {
+      "types": "./dist_ts/classes.authoritydaemon.d.ts",
+      "import": "./dist_ts/classes.authoritydaemon.js"
     }
   },
   "type": "module",
@@ -45,14 +49,20 @@
     "@git.zone/tsrun": "^2.0.6",
     "@git.zone/tstest": "^6.1.1",
     "@types/node": "26.5.1",
-    "esbuild": "^0.28.2"
+    "@types/ws": "8.18.1",
+    "esbuild": "^0.28.2",
+    "ws": "8.21.2"
   },
   "dependencies": {
     "@api.global/typedrequest": "8.1.0",
     "@api.global/typedrequest-interfaces": "7.1.0",
+    "@aws-sdk/client-s3": "3.1131.0",
+    "@lossless.org/client": "1.2.0",
     "@modelprofile.com/flexharness-models": "^8.0.0",
     "@modelprofile.com/flexharness-providers": "^8.0.0",
+    "@modelprofile.com/mcp-crossharness": "5.4.0",
     "@push.rocks/smartconsole": "^1.3.0",
+    "@push.rocks/smartcrypto": "2.2.0",
     "@push.rocks/smartdaemon": "2.7.0",
     "@push.rocks/smartdata": "11.14.2",
     "@push.rocks/smartdb": "7.0.1",

package/readme.md

@@ -28,26 +28,190 @@ Node.js 24 or newer is required.
 
 The package also exports a typed client for a per-user authswitch authority daemon. Its
 SmartData registry stores account identity separately from sealed refresh grants, runtime
-bindings, Codex enrollment records, and native-handoff and migration journals. A daemon
+bindings, durable device-operation receipts, Codex enrollment records, and native-handoff and migration journals. A daemon
 owns OpenAI device login, targeted reauthentication, and proactive refresh for grants
-added through this API. Management snapshots and events contain no credentials.
+added through this API. Management snapshots expose separate account and login rows,
+including each login's purpose, owner, health, problem and available actions; neither
+snapshots nor events contain credentials.
 
 ```ts
+import { randomUUID } from 'node:crypto';
 import { AuthSwitchClient } from '@modelprofile.com/authswitch/authority-client';
 import { resolveAuthSwitchAuthorityPaths } from '@modelprofile.com/authswitch';
 
 const paths = resolveAuthSwitchAuthorityPaths();
 const client = new AuthSwitchClient(paths.authoritySocketPath, paths.runtimeSocketPath);
 const snapshot = await client.snapshotAll();
-const operation = await client.beginAddOpenAi();
+const operationId = randomUUID();
+const operation = await client.beginAddOpenAi(operationId);
+// Keep operation.id to discover its final result after navigation or reconnect.
+const receipt = await client.getOperation(operation.id);
 ```
 
 Browser code can import the credential-free DTOs from
 `@modelprofile.com/authswitch/authority-contract`. A backend binds an account to a
-runtime incarnation and keeps the returned capability private. The runtime-only socket
+runtime incarnation by exact account ID, login ID and purpose, and keeps the returned
+capability private. Targeted reauthentication likewise requires the exact login; an
+account's presentation default never selects a grant for either action. Completed and
+interrupted operations remain discoverable through `getOperation()` and paged
+`listOperations()`. A completed receipt and its account/grant change commit together, so
+the receipt resolves a lost response or an event that arrives first. Add and reauthentication
+callers supply one UUID for the logical start and reuse it after a lost response. Replaying that
+UUID returns the same matching receipt without starting another provider login; using it for a
+different target is rejected. Cancelling a durable `starting` receipt prevents a late provider
+handle from promoting or overwriting it. Aborting a client request only detaches that request and
+does not cancel the daemon-owned login. The runtime-only socket
 resolves that binding to a current access token; its directory can be mounted into a
-container without exposing the management socket. Reconnect and reload a snapshot after
-an event gap or daemon restart.
+container without exposing the management socket. A provider that rejects a specific
+access-token generation can request a newer one through `rejectedGrantGeneration`; the
+authority coalesces concurrent rejection callbacks and never replays an uncertain refresh.
+After an external Flex or OpenCode runtime has fenced new work and drained its pending access
+resolutions and provider requests, it can release its exact binding capability through the
+runtime socket. Every bind receives a fresh random capability, so a stale release cannot fence
+or delete a successor even if the caller reused an incarnation label. Release waits for admitted
+server-side resolution handlers, but handler completion does not prove response delivery and
+cannot retract an access token already received or in use; the runtime owner therefore owns that
+drain. Generic release cannot revoke a managed Codex binding, whose daemon-owned stop still closes
+the runtime and clears its durable run before internal revocation. Binding release never transfers
+or changes ownership of the account grant. External-binding recovery after an owner crash remains
+a prerequisite for the full account-mutation cutover.
+
+`AuthSwitchClient.subscribe(onSnapshot, onEvent, signal, { onStatus })` reports `current`
+after a fresh snapshot or verified heartbeat, `unavailable` on disconnect or resync, and
+`closed` on abort. Keep cached account actions disabled while status is not `current`.
+Every change-event batch supplies a fresh snapshot before `onEvent`, so a consumer does
+not need to reconstruct account state from events. `lastVerifiedAt` records the last
+successful daemon response, including an empty heartbeat.
+
+`AuthSwitchClient.doctorPage()` reads credential-free diagnostic evidence without unsealing
+a grant, refreshing a token or contacting a provider. Each bounded page separately stamps
+the database observation, daemon state and managed-Codex process observation. Stored account
+and login rows explicitly report `liveCheck: not_checked`; a ready daemon therefore does not
+claim that a stored grant or provider is healthy. Native homes and journals omit paths,
+digests and sealed values, while managed Codex reports durable, in-memory and observed-process
+state independently with fixed problem categories. Continue each independent cursor to inspect
+the complete inventory. Pages are later observations rather than one atomic global snapshot,
+and the authority metadata revision is not a change clock for every native-home record. If the
+management socket is unavailable, an offline caller must leave database and admission state
+unknown instead of starting the database to inspect it.
+
+The authority CLI uses that daemon surface without constructing the legacy native harness adapters:
+
+```bash
+authswitch account list [--json]
+authswitch account add openai [--json]
+authswitch account reauth <account-id> <login-id> [--json]
+authswitch account operation get <operation-id> [--json]
+authswitch account operation cancel <operation-id> [--json]
+authswitch account operation resume <operation-id> [--json]
+authswitch account preuse <account-id> <login-id> [--prompt <text>] [--model <id>] [--json]
+authswitch account preuse --all [--prompt <text>] [--model <id>] [--json]
+authswitch account preuse operation get <operation-id> [--json]
+authswitch account preuse operation cancel <operation-id> [--json]
+authswitch account preuse operation resume <operation-id> [--json]
+authswitch authority doctor [--json]
+```
+
+`account list --json` prints the complete, consistent credential-free authority snapshot.
+Its human form labels login health as stored state and does not imply a live provider check.
+`account add openai` starts one standalone OpenAI device login. `account reauth` starts one
+device login for the exact account and managed login IDs; it never chooses a presentation
+default. Both commands print the durable operation ID, verification URL, user code and changed
+receipts until completion. `account operation resume` polls only the supplied durable ID, while
+`get` performs one read and `cancel` performs one explicit cancellation. Ctrl-C or the local
+15-minute deadline detaches the CLI and leaves the daemon-owned operation running. If a start
+response is lost, the fixed diagnostic reports the caller-generated operation ID and exact resume
+command; the CLI does not replay the start request.
+
+`account preuse` sends one quota-consuming prompt through the exact managed OpenAI account and
+login IDs. The default prompt is `Write 2000 words about strawberries.`; `--prompt` replaces it
+and `--model` requests one exact model. `--all` freezes one consistent authority snapshot, walks
+its canonical daemon-owned OpenAI managed logins in snapshot order, and starts one fresh durable
+operation per login whose stored `canPreuse` capability is true. It does not infer readiness from
+plan, usage, token expiry or binding capability. A login whose snapshot capability is false is
+reported as skipped with the snapshot revision, login revision, stored health, problem and
+observation time; no request or operation ID is created for that skip.
+
+Preuse operations run sequentially and are never retried automatically. Every terminal receipt
+advances an `--all` run, including `not_sent` and `outcome_unknown`, while any attempted operation
+that does not complete makes the final exit status nonzero. Snapshot-ineligible skips alone do not
+make an otherwise successful batch fail. Running `--all` again is a new quota-consuming run with
+new operation IDs. Use `account preuse operation resume` to continue observing an existing receipt.
+Only the explicit `cancel` command asks the daemon to cancel one.
+
+For `account add`, `account reauth` and `account operation resume`, `--json` writes JSON Lines:
+each line is one complete operation receipt, and unchanged revisions are omitted. `account
+operation get --json` and `account operation cancel --json` each write one JSON object followed by
+a newline. Human output includes the resume command on every unfinished receipt. These device
+commands do not switch the active native login.
+
+For one preuse start or resume, `--json` likewise writes each complete changed receipt as one raw
+JSON Line; preuse get and cancel write one raw JSON object. A preuse `--all --json` stream tags each
+line as `operation` or `skipped`. Operation lines contain the complete durable receipt. Skip lines
+contain the exact account and login IDs plus the stored snapshot evidence described above. A lost
+start response, transport or output failure, Ctrl-C, or the local 15-minute observation deadline
+stops the batch before another login starts and reports the current operation ID and resume command.
+It detaches without replaying or implicitly cancelling the daemon operation.
+
+`authority doctor --json` incrementally writes one JSON document. Its `pages` array contains
+every independently stamped bounded page; `observationSpan` is written only after all cursors
+complete, and `globallyAtomic` is false. A failure during paging returns nonzero and leaves the
+document incomplete rather than presenting partial evidence as a successful observation span.
+The doctor command imposes no inventory cap. Account listing and doctor do not contact a provider,
+unseal a grant, mutate authority state, start the service, open the database offline or fall back
+to a legacy credential store.
+If the daemon is unavailable before the first response, it fails with a fixed diagnostic on
+stderr and leaves stdout empty. The older native-store commands documented below still coexist until the coordinated
+major-version migration and removal; these authority routes never use them.
+
+`AuthSwitchClient.getUsage(accountId, loginId)` reads OpenAI managed limits or a Claude
+host login's profile and usage through the management socket. The tagged, credential-free
+reading preserves Claude's labelled five-hour, weekly and model windows, plan provenance,
+extra usage facts and explicit partial availability. Missing values never become zero.
+The daemon caches one result in SmartData for a bounded current and stale period; a new
+reading emits one account event without changing the account row revision. Concurrent
+reads and rejected-token refresh share the existing provider and authority owners; usage
+adds no polling timer. Native Claude reads hold the qualified vendor-home lease through
+both status requests and publication, and revalidate the exact credential and config
+source even when serving a cached result. Native grants are never refreshed by the daemon.
+Pending, quarantined, setup-token-without-profile-scope and other unsupported contexts
+return explicit unavailable status without a provider request. Production native home
+adoption still requires the separate verified migration and backup cutover.
+
+`AuthSwitchClient.startPreuse()` accepts one client-generated operation UUID and one exact
+OpenAI account/login/purpose. The daemon resolves an access-only grant, optionally reads the
+model catalog, then commits `request_may_have_started` immediately before FlexHarness sends one
+inference with retries disabled. Reusing the UUID with the same request returns its durable receipt; changing
+the target, prompt or requested model is rejected. A crash, cancellation or shutdown after the
+marker remains `outcome_unknown` and is never replayed. Before-marker refusals are `not_sent`.
+Only the request hash, selected model, timing and safe token counts are stored; the prompt,
+generated prose and credentials are absent from persistence and management responses. Account
+removal and targeted reauthentication refuse while that account has an active preuse request.
+Historical restore marks every unresolved preuse receipt `outcome_unknown`, including snapshots
+captured before the marker, because the original authority may have sent after snapshot capture.
+
+A trusted in-process daemon host can call `AuthSwitchAuthorityDaemon.startManagedCodex()`
+for a bound account and workspace. It owns a private Codex 0.155.1 app-server, passes only
+the authority's current access token through Codex's external-token login, answers its
+unauthorized callback through the authority, and revokes the binding on stop. The returned
+runtime exposes an interactive `codex --remote unix://…` launch descriptor and native
+`thread/start`, `thread/resume` and `turn/start` methods for noninteractive consumers.
+Callers supply a private, durable `codexHomeDirectory` for Codex's own configuration and
+conversation state. SmartData binds that home immutably to one account and scope, and the
+daemon records its active process/socket identity before launching it. Admission refuses
+an existing nonempty native home or a surviving app-server owner; a fresh empty home is
+created on first use. Account removal and reauthentication refuse while an in-memory or
+durably recorded managed Codex process for that account may still be running, including
+after daemon restart. A recorded run is cleared only when its exact process is proven
+gone; an uncertain launch remains blocked. Callers must explicitly stop owned processes
+after their work finishes. Once reauthentication starts, it holds new admissions until the
+device operation settles. Only the private socket directory is removed on close. Codex's
+credential store remains ephemeral and does not read or write `auth.json` in that home.
+Managed-Codex process ownership observation is qualified on Linux and reads exact argument
+boundaries from `/proc`; on other hosts doctor reports the process observation as unknown,
+and authority actions that require survivor proof refuse instead of guessing.
+Codex 0.155.1 does not persist an unused thread created by `thread/start`; resume applies
+after Codex has committed a rollout. The existing CLI has not yet been moved to this path.
 
 This SDK is additive at this stage. The commands documented below still use the existing
 credential stores. The authority daemon does not import those stores automatically,
@@ -58,6 +222,32 @@ remain vendor-owned; a container setup-token grant is a separate grant under the
 account. The one-time migration and deletion of authswitch's old stores are separate
 cutover steps.
 
+The backend-only Claude native handoff journals an exact two-file write and transfers
+ownership between two account grants in one SmartData transaction. An inactive Claude
+grant is refreshed by the daemon only after a durable pre-send marker; pending, native,
+and quarantined grants cannot enter that exchange. A native home and incoming grant
+require source-mapped migration receipts with backup metadata. The ledger field does
+not itself verify a SmartBucket backup, so the default daemon does not configure a
+Claude native home or run this path against real credentials. One-time migration and
+backup verification must precede production activation. Handoff receipts are queryable
+after a lost response. `runningEffectiveAuth: unsupported_effective_auth` means the
+native store changed, while an already-running Claude process's effective login cannot
+be proven externally; qualified live native-store switching still works.
+
+The authority database uses one versioned collection registry for startup preparation,
+ordered backup capture and exact restore readback. Startup rejects unknown collections,
+unknown metadata schemas and an incomplete restored database. Published 6.4/6.5 metadata
+is upgraded in place while account IDs, sealed grants, enrollments and uncertain states
+remain intact. A restored database keeps a durable closed-admission marker across restart;
+the daemon refuses provider and runtime work until a separate ownership-reconciliation
+step can prove it safe to open. Backup capture pins its paged records in one SmartData
+transaction and stages each retry anew before any SmartBucket publication. The closed
+restore rehearsal runs in a separate package-owned child, keeps its temporary source and
+record stream encrypted, restores metadata closed before any other record, then stops and
+reopens the same disposable database for exact stored readback. A receipt is issued only
+after the child has closed and its temporary root has been removed. This rehearsal does
+not perform a production restore or authorize a new authority instance to take ownership.
+
 ## Usage
 
 Run `authswitch`, `authswitch -i`, or `authswitch --interactive` for an interactive guide. Use the arrow keys and
@@ -950,7 +1140,7 @@ arguments to these commands exit with 2.
 
 `limits --json` emits `IAccountLimits` and `active --json` emits `IActiveAccounts`:
 the same rows as the tables, plus the machine-readable fields the tables condense —
-`accountId`, `slotId`, `accountType` (`{ plan, source }` with the adapter's plan
+`accountId`, `providerAccountId`, `slotId`, `accountType` (`{ plan, source }` with the adapter's plan
 name, such as `max` or `pro`, sanitised but not display-formatted, and `source` `live`
 or `stored`; null when no type is known or the row names no account; both documents
 carry it), the limits rows' `billing` (the account's reported `hasActiveSubscription`,
@@ -961,18 +1151,20 @@ it gave none) and `headline` (true for the window the provider picks for a
 single-value summary), the ISO `savedAt` beside the human `savedAgo`, the per-row
 `unavailableReason` that the footnotes summarise, and `drift`, which carries the
 expected and current account ids, their labels, whether the current one is saved,
-the ISO `switchedAt` of the switch that was undone, and the same sentence as `reason`. Both carry `schemaVersion: 1`, the
+the ISO `switchedAt` of the switch that was undone, and the same sentence as `reason`. `accountId` remains the opaque
+authswitch identifier used for harness operations; `providerAccountId` is the exact provider-native identifier, or null
+when the credential reports none. Both documents carry `schemaVersion: 2`, the
 shared `generatedAt` snapshot every countdown is relative to, and `complete`, which
 is false when any account or harness could not be read.
 
 The exported `IAccountList` contract contains:
 
-- `schemaVersion: 2`, `generatedAt` (ISO UTC), and `complete`.
+- `schemaVersion: 3`, `generatedAt` (ISO UTC), and `complete`.
 - `harnesses[]`: `id`, `label`, `loginHint`, `saveUnavailableReason`, `accounts`,
   `credentialDrift` (slots whose file no longer holds the account the last switch
   wrote), and harness-level `problems` (distinguishing failed discovery from an
   empty list).
-- Each account's opaque `id`, `label`, `isActive`, verified `isStashed`, `savedAt`,
+- Each account's opaque `id`, exact provider-native `providerAccountId` (or null), `label`, `isActive`, verified `isStashed`, `savedAt`,
   `details`, and `status` containing all labelled `facts`, `problems`, and optional
   typed `summary` fields. Missing fields remain omitted, not replaced by zero;
   `summary.usageWindows[]` carries `severity` and `headline` only when the provider
@@ -984,9 +1176,9 @@ harness internals. A partial result still produces valid JSON and exits with 1;
 successful and empty results exit with 0. `complete` describes lookup success,
 not whether the provider exposes every possible metric.
 
-Version 2 of this JSON schema allows `usageWindows[].resetAt` to be null and adds
-optional account `slotId` fields. Consumers migrating from authswitch 1.x must
-accept schema version 2 and handle null reset timestamps. Scripts should qualify
+Version 3 adds `providerAccountId` without changing the opaque `id` used by mutation commands. Version 2 allowed
+`usageWindows[].resetAt` to be null and added optional account `slotId` fields. Consumers must
+accept schema version 3, preserve the two identifiers' distinct meanings and handle null provider IDs and reset timestamps. Scripts should qualify
 mutation commands with `codex`, `opencode` or `claude`, since all three now register
 by default. Saved Codex credentials retain their existing format.
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@modelprofile.com/authswitch',
-  version: '6.4.0',
+  version: '7.0.0',
   description: 'Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status'
 }