@modelprofile.com/authswitch 6.4.0 → 7.0.0

package/dist_ts/classes.authoritybroker.d.ts

@@ -1,8 +1,9 @@
 import * as plugins from './plugins.js';
 import type { IAuthSwitchAccount, IAuthSwitchAccountEvent, IAuthSwitchBinding, IAuthSwitchOperation, IAuthSwitchSnapshot } from './authority-contract.js';
 import { AuthSwitchAuthorityDatabase } from './classes.authoritydatabase.js';
+import type { IAuthSwitchUsageContext } from './classes.authorityusage.js';
 import { type IAuthSwitchSecretCodec } from './classes.authoritysecrets.js';
-type TOpenAiProvider = Pick<plugins.flexAccounts.ISmartAiProviderAdapter, 'beginLogin' | 'refreshCredential' | 'inspectCredential' | 'dispose'>;
+type TOpenAiProvider = Pick<plugins.flexAccounts.ISmartAiProviderAdapter, 'beginLogin' | 'refreshCredential' | 'inspectCredential' | 'getAccountRateLimits' | 'dispose'>;
 export interface IAuthSwitchAuthorityBrokerOptions {
     provider?: TOpenAiProvider;
     secrets?: IAuthSwitchSecretCodec;
@@ -16,6 +17,7 @@ export interface IAuthSwitchResolvedAccess {
     expiresAt: string;
     grantGeneration: number;
 }
+export declare const authSwitchBindingCapabilityHash: (capability: string) => string;
 /** One daemon-owned authority. No management DTO contains a refresh grant. */
 export declare class AuthSwitchAuthorityBroker {
     private readonly database;
@@ -23,12 +25,18 @@ export declare class AuthSwitchAuthorityBroker {
     private readonly secrets;
     private readonly now;
     private readonly proactive;
+    private readonly starts;
     private readonly operations;
     private readonly refreshes;
     private readonly listeners;
+    private claudeRefresh?;
+    private maintenance?;
     private timer?;
     private closed;
+    private closing?;
     constructor(database: AuthSwitchAuthorityDatabase, options?: IAuthSwitchAuthorityBrokerOptions);
+    setClaudeRefresher(refresh: (grantId: string) => Promise<void>): void;
+    notifyChanged(): void;
     start(): Promise<void>;
     private schedule;
     refreshDueAccounts(): Promise<void>;
@@ -36,6 +44,7 @@ export declare class AuthSwitchAuthorityBroker {
     private publish;
     snapshot(options?: {
         accountAfter?: string;
+        loginAfter?: string;
         bindingAfter?: string;
         limit?: number;
     }): Promise<IAuthSwitchSnapshot>;
@@ -48,16 +57,25 @@ export declare class AuthSwitchAuthorityBroker {
     private identity;
     private sealCredential;
     private unsealCredential;
-    beginAddOpenAi(): Promise<IAuthSwitchOperation>;
-    beginReauthOpenAi(accountId: string): Promise<IAuthSwitchOperation>;
+    private startDeviceOperation;
+    private finishStartingOperation;
+    beginAddOpenAi(operationId: string): Promise<IAuthSwitchOperation>;
+    beginReauthOpenAi(operationId: string, accountId: string, loginId: string, purpose: 'openai_managed', beforeNew?: () => Promise<void>): Promise<IAuthSwitchOperation>;
     private beginLogin;
-    getOperation(operationId: string): IAuthSwitchOperation;
-    private pruneOperations;
+    getOperation(operationId: string): Promise<IAuthSwitchOperation>;
+    listOperations(after: string | null, limit?: number): Promise<{
+        operations: IAuthSwitchOperation[];
+        nextCursor: string | null;
+    }>;
+    /** Trusted daemon lifecycle hook: hold new managed runtimes out until targeted reauth settles. */
+    waitOperation(operationId: string): Promise<void>;
     cancelOperation(operationId: string): Promise<IAuthSwitchOperation>;
     renameAccount(accountId: string, expectedRevision: number, label: string): Promise<IAuthSwitchAccount>;
     removeAccount(accountId: string, expectedRevision: number): Promise<IAuthSwitchAccount>;
     bindAccount(input: {
         accountId: string;
+        loginId: string;
+        purpose: 'openai_managed';
         runtime: IAuthSwitchBinding['runtime'];
         scopeId: string;
         incarnationId: string;
@@ -65,7 +83,12 @@ export declare class AuthSwitchAuthorityBroker {
         binding: IAuthSwitchBinding;
         capability: string;
     }>;
-    resolveAccess(bindingId: string, capability: string, minValidityMs: number): Promise<IAuthSwitchResolvedAccess>;
+    revokeBinding(bindingId: string, capability: string): Promise<boolean>;
+    releaseExternalBinding(bindingId: string, capability: string): Promise<'released' | 'inactive'>;
+    resolveAccess(bindingId: string, capability: string, minValidityMs: number, rejectedGrantGeneration?: number): Promise<IAuthSwitchResolvedAccess>;
+    /** Backend-only access for usage; it never creates or bypasses a runtime binding. */
+    resolveUsageAccess(context: IAuthSwitchUsageContext, rejectedGrantGeneration: number | undefined, minValidityMs: number): Promise<IAuthSwitchResolvedAccess>;
+    private resolveManagedAccess;
     private refreshAccount;
     private performRefresh;
     close(): Promise<void>;